@objectstack/runtime 6.1.1 → 6.2.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/load-artifact-bundle.ts","../src/driver-plugin.ts","../src/seed-loader.ts","../src/sandbox/quickjs-runner.ts","../src/sandbox/body-runner.ts","../src/app-plugin.ts","../src/cloud/platform-sso.ts","../src/cloud/environment-org-seed.ts","../src/cloud/environment-owner-seed.ts","../src/index.ts","../src/runtime.ts","../src/standalone-stack.ts","../src/default-host.ts","../src/http-dispatcher.ts","../src/security/resolve-execution-context.ts","../src/security/security-headers.ts","../src/security/rate-limit.ts","../src/observability/request-context.ts","../src/observability/metrics.ts","../src/observability/error-reporter.ts","../src/observability/instrument.ts","../src/observability/observability-service-plugin.ts","../src/dispatcher-plugin.ts","../src/system-environment-plugin.ts","../src/http-server.ts","../src/middleware.ts","../src/cloud/kernel-manager.ts","../src/cloud/artifact-api-client.ts","../src/cloud/artifact-environment-registry.ts","../src/cloud/artifact-kernel-factory.ts","../src/cloud/capability-loader.ts","../src/cloud/auth-proxy-plugin.ts","../src/cloud/cloud-url.ts","../src/cloud/marketplace-proxy-plugin.ts","../src/cloud/file-artifact-api-client.ts","../src/cloud/objectos-stack.ts","../src/cloud/marketplace-install-local-plugin.ts","../src/sandbox/script-runner.ts","../src/sandbox/index.ts"],"sourcesContent":["// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Shared artifact loader used by every code path that boots a kernel\n * from an `objectstack build` artifact:\n *\n *   - `FsAppBundleResolver`         — cloud / multi-environment file binding\n *   - `runtime-stack.ts:basePlugins` — single-environment local boot\n *   - `StandaloneStack`              — `objectstack serve --standalone`\n *   - `http-dispatcher.ts`           — in-flight artifact rebind\n *\n * Reads the JSON artifact (from a local path *or* an `http(s)://` URL) and,\n * for **local** artifacts only, if the bundle declares a sibling\n * `runtimeModule` (the ESM produced by `packages/cli/src/utils/build-runtime.ts`),\n * dynamic-imports it and merges its `functions` map onto the bundle so\n * declarative Hooks resolve their handlers at boot.\n *\n * For **remote** (`http(s)://`) artifacts the `runtimeModule` reference is\n * intentionally ignored — Node cannot dynamic-import arbitrary URLs and we\n * refuse to execute remote code by default. Remote artifacts are therefore\n * expected to be fully declarative (Hooks/Flows carry their bodies inline).\n *\n * Mutates the returned bundle in place. Returns `null` on read/parse\n * failure (callers may treat as \"no bundle for this project yet\").\n * Runtime-module load failures are logged but non-fatal — the bundle\n * is still returned, just without runtime functions.\n */\n\nimport { readFile } from 'node:fs/promises';\nimport { resolve as resolvePath, isAbsolute, dirname } from 'node:path';\nimport { pathToFileURL } from 'node:url';\n\nexport interface LoadArtifactBundleOptions {\n    /** Optional log tag for warnings (defaults to `[loadArtifactBundle]`). */\n    tag?: string;\n    /** When true, an unwrapped `{ schemaVersion, metadata }` envelope is unwrapped. */\n    unwrapEnvelope?: boolean;\n    /** Optional fetch timeout in ms for `http(s)://` sources (default 15000). */\n    fetchTimeoutMs?: number;\n}\n\n/** Returns true when `pathOrUrl` looks like an `http://` or `https://` URL. */\nexport function isHttpUrl(pathOrUrl: string): boolean {\n    return /^https?:\\/\\//i.test(pathOrUrl);\n}\n\n/**\n * Read a JSON artifact from either a local file path or an `http(s)://` URL.\n * Returns the raw text body. Throws on network or filesystem failure.\n */\nexport async function readArtifactSource(\n    pathOrUrl: string,\n    opts: { fetchTimeoutMs?: number } = {},\n): Promise<string> {\n    if (isHttpUrl(pathOrUrl)) {\n        const timeoutMs = opts.fetchTimeoutMs ?? 15_000;\n        const controller = new AbortController();\n        const timer = setTimeout(() => controller.abort(), timeoutMs);\n        try {\n            const res = await fetch(pathOrUrl, {\n                redirect: 'follow',\n                signal: controller.signal,\n                headers: { Accept: 'application/json, text/plain;q=0.9, */*;q=0.5' },\n            });\n            if (!res.ok) {\n                throw new Error(`HTTP ${res.status} ${res.statusText} for ${pathOrUrl}`);\n            }\n            return await res.text();\n        } finally {\n            clearTimeout(timer);\n        }\n    }\n    return readFile(pathOrUrl, 'utf-8');\n}\n\nexport async function loadArtifactBundle(\n    absArtifactPath: string,\n    opts: LoadArtifactBundleOptions = {},\n): Promise<any | null> {\n    const tag = opts.tag ?? '[loadArtifactBundle]';\n    const isUrl = isHttpUrl(absArtifactPath);\n    let bundle: any;\n    try {\n        const raw = await readArtifactSource(absArtifactPath, { fetchTimeoutMs: opts.fetchTimeoutMs });\n        const parsed = JSON.parse(raw);\n        bundle = opts.unwrapEnvelope && parsed?.schemaVersion != null && parsed?.metadata !== undefined\n            ? parsed.metadata\n            : parsed;\n    } catch (err: any) {\n        // eslint-disable-next-line no-console\n        console.warn(`${tag} artifact read FAILED: path='${absArtifactPath}' error=${err?.message ?? err}`);\n        return null;\n    }\n\n    if (isUrl) {\n        // Remote artifacts cannot dynamic-import a sibling ESM runtime module\n        // safely (Node does not allow importing arbitrary URLs and we never\n        // want to execute remote code by default). Hooks/flow handlers must\n        // be carried in the JSON itself (declarative bodies, sandbox-eval).\n        if (typeof bundle?.runtimeModule === 'string' && bundle.runtimeModule.length > 0) {\n            // eslint-disable-next-line no-console\n            console.warn(\n                `${tag} ignoring runtimeModule='${bundle.runtimeModule}' for remote artifact ${absArtifactPath} ` +\n                `(remote ESM imports are not supported; embed handlers in the JSON instead)`,\n            );\n            // Strip the reference so downstream code doesn't try to resolve it\n            // as a local path against process.cwd().\n            delete bundle.runtimeModule;\n        }\n        return bundle;\n    }\n\n    await mergeRuntimeModule(bundle, absArtifactPath, tag);\n    return bundle;\n}\n\nexport async function mergeRuntimeModule(bundle: any, artifactAbsPath: string, tag = '[loadArtifactBundle]'): Promise<void> {\n    const ref = bundle?.runtimeModule;\n    if (typeof ref !== 'string' || ref.length === 0) return;\n    const moduleAbsPath = isAbsolute(ref) ? ref : resolvePath(dirname(artifactAbsPath), ref);\n    try {\n        const mod: any = await import(pathToFileURL(moduleAbsPath).href);\n        const fns = (mod && (mod.functions ?? mod.default?.functions)) ?? null;\n        if (!fns || typeof fns !== 'object') {\n            // eslint-disable-next-line no-console\n            console.warn(`${tag} runtime module '${moduleAbsPath}' exported no \\`functions\\` map`);\n            return;\n        }\n        const existing = (bundle.functions && typeof bundle.functions === 'object' && !Array.isArray(bundle.functions))\n            ? bundle.functions as Record<string, unknown>\n            : {};\n        bundle.functions = { ...existing, ...fns };\n    } catch (err: any) {\n        // eslint-disable-next-line no-console\n        console.warn(`${tag} runtime module load FAILED: path='${moduleAbsPath}' error=${err?.message ?? err}`);\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Plugin, PluginContext } from '@objectstack/core';\n\n/**\n * Driver Plugin\n * \n * Generic plugin wrapper for ObjectQL drivers.\n * Registers a driver with the ObjectQL engine.\n * \n * Dependencies: None (Registers service for ObjectQL to discover)\n * Services: driver.{name}\n * \n * @example\n * const memoryDriver = new InMemoryDriver();\n * const driverPlugin = new DriverPlugin(memoryDriver, 'memory');\n * kernel.use(driverPlugin);\n */\nexport interface DriverPluginOptions {\n    /**\n     * If set, registers a named datasource so packages declaring\n     * `defaultDatasource: '<name>'` resolve to this driver.\n     */\n    datasourceName?: string;\n    /**\n     * If `true` (default), registers this driver as the `default` datasource\n     * when none exists. Set to `false` for proxy drivers (e.g. cloud proxy)\n     * that should never become the default.\n     */\n    registerAsDefault?: boolean;\n}\n\nexport class DriverPlugin implements Plugin {\n    name: string;\n    type = 'driver';\n    version = '1.0.0';\n\n    private driver: any;\n    private options: DriverPluginOptions;\n\n    constructor(driver: any, driverNameOrOptions?: string | DriverPluginOptions, options?: DriverPluginOptions) {\n        this.driver = driver;\n        const driverName = typeof driverNameOrOptions === 'string' ? driverNameOrOptions : undefined;\n        this.options = (typeof driverNameOrOptions === 'object' ? driverNameOrOptions : options) ?? {};\n        this.name = `com.objectstack.driver.${driverName || driver.name || 'unknown'}`;\n    }\n\n    init = async (ctx: PluginContext) => {\n        const serviceName = `driver.${this.driver.name || 'unknown'}`;\n        ctx.registerService(serviceName, this.driver);\n        ctx.logger.info('Driver service registered', { \n            serviceName, \n            driverName: this.driver.name,\n            driverVersion: this.driver.version \n        });\n    }\n\n    start = async (ctx: PluginContext) => {\n        try {\n            const metadata = ctx.getService<any>('metadata');\n            if (!metadata?.addDatasource) return;\n\n            // Register a named datasource for this driver (e.g. 'cloud').\n            if (this.options.datasourceName) {\n                await metadata.addDatasource({\n                    name: this.options.datasourceName,\n                    driver: this.driver.name,\n                });\n                ctx.logger.info(`[DriverPlugin] Registered named datasource '${this.options.datasourceName}'`, { driver: this.driver.name });\n            }\n\n            // Auto-register as 'default' datasource unless explicitly disabled.\n            if (this.options.registerAsDefault !== false) {\n                const datasources = metadata.getDatasources ? metadata.getDatasources() : [];\n                const hasDefault = datasources.some((ds: any) => ds.name === 'default');\n                if (!hasDefault) {\n                    ctx.logger.info(`[DriverPlugin] No 'default' datasource found — registering '${this.driver.name}' as default.`);\n                    await metadata.addDatasource({ name: 'default', driver: this.driver.name });\n                }\n            }\n        } catch (e) {\n            ctx.logger.debug('[DriverPlugin] Failed to configure datasource (metadata service missing?)', { error: e });\n        }\n\n        ctx.logger.debug('Driver plugin started', { driverName: this.driver.name || 'unknown' });\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { IDataEngine, IMetadataService, ISeedLoaderService } from '@objectstack/spec/contracts';\nimport type {\n  SeedLoaderRequest,\n  SeedLoaderResult,\n  SeedLoaderConfig,\n  SeedLoaderConfigInput,\n  ObjectDependencyGraph,\n  ObjectDependencyNode,\n  ReferenceResolution,\n  ReferenceResolutionError,\n  DatasetLoadResult,\n  Dataset,\n} from '@objectstack/spec/data';\nimport { SeedLoaderConfigSchema } from '@objectstack/spec/data';\nimport { resolveSeedRecord } from '@objectstack/formula';\n\ninterface Logger {\n  info(message: string, meta?: Record<string, any>): void;\n  warn(message: string, meta?: Record<string, any>): void;\n  error(message: string, error?: Error, meta?: Record<string, any>): void;\n  debug(message: string, meta?: Record<string, any>): void;\n}\n\n/** Default field used for externalId matching on target objects */\nconst DEFAULT_EXTERNAL_ID_FIELD = 'name';\n\n/**\n * SeedLoaderService — Runtime implementation of ISeedLoaderService\n *\n * Provides metadata-driven seed data loading with:\n * - Automatic lookup/master_detail reference resolution via externalId\n * - Topological dependency ordering (parents before children)\n * - Multi-pass loading for circular references\n * - Dry-run validation mode\n * - Upsert support honoring DatasetSchema mode\n * - Actionable error reporting\n */\nexport class SeedLoaderService implements ISeedLoaderService {\n  private engine: IDataEngine;\n  private metadata: IMetadataService;\n  private logger: Logger;\n\n  constructor(engine: IDataEngine, metadata: IMetadataService, logger: Logger) {\n    this.engine = engine;\n    this.metadata = metadata;\n    this.logger = logger;\n  }\n\n  // ==========================================================================\n  // Public API\n  // ==========================================================================\n\n  async load(request: SeedLoaderRequest): Promise<SeedLoaderResult> {\n    const startTime = Date.now();\n    const config = request.config;\n    const allErrors: ReferenceResolutionError[] = [];\n    const allResults: DatasetLoadResult[] = [];\n\n    // 1. Filter datasets by environment\n    const datasets = this.filterByEnv(request.datasets, config.env);\n\n    if (datasets.length === 0) {\n      return this.buildEmptyResult(config, Date.now() - startTime);\n    }\n\n    // 2. Build dependency graph\n    const objectNames = datasets.map(d => d.object);\n    const graph = await this.buildDependencyGraph(objectNames);\n\n    this.logger.info('[SeedLoader] Dependency graph built', {\n      objects: objectNames.length,\n      insertOrder: graph.insertOrder,\n      circularDeps: graph.circularDependencies.length,\n    });\n\n    // 3. Order datasets by topological insert order\n    const orderedDatasets = this.orderDatasets(datasets, graph.insertOrder);\n\n    // 4. Build reference lookup map from metadata (field → target object)\n    const refMap = this.buildReferenceMap(graph);\n\n    // 5. Pass 1: Insert/upsert records, resolving references\n    const insertedRecords = new Map<string, Map<string, string>>(); // object → externalIdValue → internalId\n    const deferredUpdates: DeferredUpdate[] = [];\n\n    for (const dataset of orderedDatasets) {\n      const result = await this.loadDataset(\n        dataset, config, refMap, insertedRecords, deferredUpdates, allErrors\n      );\n      allResults.push(result);\n\n      if (config.haltOnError && result.errored > 0) {\n        this.logger.warn('[SeedLoader] Halting on first error', { object: dataset.object });\n        break;\n      }\n    }\n\n    // 6. Pass 2: Resolve deferred references (circular dependencies)\n    if (config.multiPass && deferredUpdates.length > 0 && !config.dryRun) {\n      this.logger.info('[SeedLoader] Pass 2: resolving deferred references', {\n        count: deferredUpdates.length,\n      });\n      await this.resolveDeferredUpdates(deferredUpdates, insertedRecords, allResults, allErrors, config.organizationId);\n    }\n\n    // 7. Build final result\n    const durationMs = Date.now() - startTime;\n    return this.buildResult(config, graph, allResults, allErrors, durationMs);\n  }\n\n  async buildDependencyGraph(objectNames: string[]): Promise<ObjectDependencyGraph> {\n    const nodes: ObjectDependencyNode[] = [];\n    const objectSet = new Set(objectNames);\n\n    for (const objectName of objectNames) {\n      const objDef = await this.metadata.getObject(objectName) as any;\n      const dependsOn: string[] = [];\n      const references: ReferenceResolution[] = [];\n\n      if (objDef && objDef.fields) {\n        const fields = objDef.fields as Record<string, any>;\n        for (const [fieldName, fieldDef] of Object.entries(fields)) {\n          if (\n            (fieldDef.type === 'lookup' || fieldDef.type === 'master_detail') &&\n            fieldDef.reference\n          ) {\n            const targetObject = fieldDef.reference as string;\n\n            // Track dependency ordering only for objects within the graph\n            if (objectSet.has(targetObject) && !dependsOn.includes(targetObject)) {\n              dependsOn.push(targetObject);\n            }\n\n            // Track ALL references for resolution (target may exist in database)\n            references.push({\n              field: fieldName,\n              targetObject,\n              targetField: DEFAULT_EXTERNAL_ID_FIELD,\n              fieldType: fieldDef.type as 'lookup' | 'master_detail',\n            });\n          }\n        }\n      }\n\n      nodes.push({ object: objectName, dependsOn, references });\n    }\n\n    // Topological sort\n    const { insertOrder, circularDependencies } = this.topologicalSort(nodes);\n\n    return { nodes, insertOrder, circularDependencies };\n  }\n\n  async validate(datasets: Dataset[], config?: SeedLoaderConfigInput): Promise<SeedLoaderResult> {\n    const parsedConfig = SeedLoaderConfigSchema.parse({ ...config, dryRun: true });\n    return this.load({ datasets, config: parsedConfig });\n  }\n\n  // ==========================================================================\n  // Internal: Dataset Loading\n  // ==========================================================================\n\n  private async loadDataset(\n    dataset: Dataset,\n    config: SeedLoaderConfig,\n    refMap: Map<string, ReferenceResolution[]>,\n    insertedRecords: Map<string, Map<string, string>>,\n    deferredUpdates: DeferredUpdate[],\n    allErrors: ReferenceResolutionError[],\n  ): Promise<DatasetLoadResult> {\n    const objectName = dataset.object;\n    const mode = dataset.mode || config.defaultMode;\n    const externalId = dataset.externalId || 'name';\n\n    let inserted = 0;\n    let updated = 0;\n    let skipped = 0;\n    let errored = 0;\n    let referencesResolved = 0;\n    let referencesDeferred = 0;\n    const errors: ReferenceResolutionError[] = [];\n\n    // Ensure the object's record map exists\n    if (!insertedRecords.has(objectName)) {\n      insertedRecords.set(objectName, new Map());\n    }\n\n    // Pre-load existing records for upsert matching. When a target\n    // organization is set, scope the lookup so each tenant gets its\n    // own copy (otherwise upsert would clobber other tenants' rows\n    // that share the same natural key — e.g. `name: 'Acme Corp'`).\n    let existingRecords: Map<string, any> | undefined;\n    if ((mode === 'upsert' || mode === 'update' || mode === 'ignore') && !config.dryRun) {\n      existingRecords = await this.loadExistingRecords(\n        objectName,\n        externalId,\n        config.organizationId,\n      );\n    }\n\n    // Get reference resolutions for this object\n    const objectRefs = refMap.get(objectName) || [];\n\n    // Pin a single `now()` snapshot for the entire dataset so multi-pass\n    // loads see one logical clock — the M9 determinism guarantee for seeds.\n    const seedNow = new Date();\n\n    for (let i = 0; i < dataset.records.length; i++) {\n      // Resolve any embedded Expression envelopes (e.g. `cel\\`daysFromNow(30)\\``)\n      // BEFORE reference resolution so downstream lookups see resolved values.\n      const seedResult = resolveSeedRecord(\n        dataset.records[i] as Record<string, never>,\n        { now: seedNow },\n      );\n      const record = seedResult.ok\n        ? { ...(seedResult.value as Record<string, unknown>) }\n        : { ...dataset.records[i] };\n      if (!seedResult.ok) {\n        this.logger.warn(\n          `[SeedLoader] Failed to resolve dynamic values for ${objectName} record #${i}: ${seedResult.error.message}`,\n        );\n      }\n\n      // Per-tenant tagging: when a target org is set, stamp every\n      // seeded row with it (unless the record itself already supplies\n      // an explicit organization_id — respect dataset author overrides).\n      // Skipped objects that don't declare `organization_id` will have\n      // the extra key silently ignored by the engine.\n      if (config.organizationId && record['organization_id'] == null) {\n        record['organization_id'] = config.organizationId;\n      }\n\n      // Resolve references\n      for (const ref of objectRefs) {\n        const fieldValue = record[ref.field];\n        if (fieldValue === undefined || fieldValue === null) continue;\n\n        // Skip if value looks like an internal ID (not a natural key)\n        if (typeof fieldValue !== 'string' || this.looksLikeInternalId(fieldValue)) continue;\n\n        // Try to resolve via already-inserted records\n        const targetMap = insertedRecords.get(ref.targetObject);\n        const resolvedId = targetMap?.get(String(fieldValue));\n\n        if (resolvedId) {\n          record[ref.field] = resolvedId;\n          referencesResolved++;\n        } else if (!config.dryRun) {\n          // Try to resolve from existing data in the database\n          const dbId = await this.resolveFromDatabase(ref.targetObject, ref.targetField, fieldValue, config.organizationId);\n          if (dbId) {\n            record[ref.field] = dbId;\n            referencesResolved++;\n          } else if (config.multiPass) {\n            // Defer to pass 2\n            record[ref.field] = null;\n            deferredUpdates.push({\n              objectName,\n              recordExternalId: String(record[externalId] ?? ''),\n              field: ref.field,\n              targetObject: ref.targetObject,\n              targetField: ref.targetField,\n              attemptedValue: fieldValue,\n              recordIndex: i,\n            });\n            referencesDeferred++;\n          } else {\n            // Cannot resolve - record error\n            const error: ReferenceResolutionError = {\n              sourceObject: objectName,\n              field: ref.field,\n              targetObject: ref.targetObject,\n              targetField: ref.targetField,\n              attemptedValue: fieldValue,\n              recordIndex: i,\n              message: `Cannot resolve reference: ${objectName}.${ref.field} = '${fieldValue}' → ${ref.targetObject}.${ref.targetField} not found`,\n            };\n            errors.push(error);\n            allErrors.push(error);\n          }\n        } else {\n          // Dry-run: attempt resolution, report error if not found\n          const targetMap2 = insertedRecords.get(ref.targetObject);\n          if (!targetMap2?.has(String(fieldValue))) {\n            const error: ReferenceResolutionError = {\n              sourceObject: objectName,\n              field: ref.field,\n              targetObject: ref.targetObject,\n              targetField: ref.targetField,\n              attemptedValue: fieldValue,\n              recordIndex: i,\n              message: `[dry-run] Reference may not resolve: ${objectName}.${ref.field} = '${fieldValue}' → ${ref.targetObject}.${ref.targetField}`,\n            };\n            errors.push(error);\n            allErrors.push(error);\n          }\n        }\n      }\n\n      // Insert/upsert the record\n      if (!config.dryRun) {\n        try {\n          const result = await this.writeRecord(\n            objectName, record, mode, externalId, existingRecords\n          );\n\n          if (result.action === 'inserted') inserted++;\n          else if (result.action === 'updated') updated++;\n          else if (result.action === 'skipped') skipped++;\n\n          // Track the inserted/updated record's ID for reference resolution\n          const externalIdValue = String(record[externalId] ?? '');\n          const internalId = result.id;\n          if (externalIdValue && internalId) {\n            insertedRecords.get(objectName)!.set(externalIdValue, String(internalId));\n          }\n        } catch (err: any) {\n          errored++;\n          this.logger.warn(`[SeedLoader] Failed to write ${objectName} record`, {\n            error: err.message,\n            recordIndex: i,\n          });\n        }\n      } else {\n        // Dry-run: simulate insert tracking\n        const externalIdValue = String(record[externalId] ?? '');\n        if (externalIdValue) {\n          insertedRecords.get(objectName)!.set(externalIdValue, `dry-run-id-${i}`);\n        }\n        inserted++; // Count as \"would be inserted\"\n      }\n    }\n\n    return {\n      object: objectName,\n      mode,\n      inserted,\n      updated,\n      skipped,\n      errored,\n      total: dataset.records.length,\n      referencesResolved,\n      referencesDeferred,\n      errors,\n    };\n  }\n\n  // ==========================================================================\n  // Internal: Reference Resolution\n  // ==========================================================================\n\n  private async resolveFromDatabase(\n    targetObject: string,\n    targetField: string,\n    value: unknown,\n    organizationId?: string,\n  ): Promise<string | null> {\n    try {\n      const where: Record<string, unknown> = { [targetField]: value };\n      // Per-tenant replay: when scoping is requested, only consider\n      // rows that belong to the target tenant so cross-tenant rows\n      // never get borrowed as a \"resolved\" reference (would silently\n      // create a cross-org FK).\n      if (organizationId) where.organization_id = organizationId;\n      const records = await this.engine.find(targetObject, {\n        where,\n        fields: ['id'],\n        limit: 1,\n        context: { isSystem: true },\n      } as any);\n      if (records && records.length > 0) {\n        return String(records[0].id || records[0]._id);\n      }\n    } catch {\n      // Target object may not exist yet\n    }\n    return null;\n  }\n\n  private async resolveDeferredUpdates(\n    deferredUpdates: DeferredUpdate[],\n    insertedRecords: Map<string, Map<string, string>>,\n    allResults: DatasetLoadResult[],\n    allErrors: ReferenceResolutionError[],\n    organizationId?: string,\n  ): Promise<void> {\n    for (const deferred of deferredUpdates) {\n      // Try to resolve from inserted records\n      const targetMap = insertedRecords.get(deferred.targetObject);\n      let resolvedId = targetMap?.get(String(deferred.attemptedValue));\n\n      // Try database fallback\n      if (!resolvedId) {\n        resolvedId = (await this.resolveFromDatabase(\n          deferred.targetObject, deferred.targetField, deferred.attemptedValue, organizationId\n        )) ?? undefined;\n      }\n\n      if (resolvedId) {\n        // Find the record and update the reference\n        const objectRecordMap = insertedRecords.get(deferred.objectName);\n        const recordId = objectRecordMap?.get(deferred.recordExternalId);\n\n        if (recordId) {\n          try {\n            await this.engine.update(deferred.objectName, {\n              id: recordId,\n              [deferred.field]: resolvedId,\n            }, { context: { isSystem: true } } as any);\n\n            // Update result stats\n            const resultEntry = allResults.find(r => r.object === deferred.objectName);\n            if (resultEntry) {\n              resultEntry.referencesResolved++;\n              resultEntry.referencesDeferred--;\n            }\n          } catch (err: any) {\n            this.logger.warn('[SeedLoader] Failed to resolve deferred reference', {\n              object: deferred.objectName,\n              field: deferred.field,\n              error: err.message,\n            });\n          }\n        }\n      } else {\n        // Still unresolved after pass 2\n        const error: ReferenceResolutionError = {\n          sourceObject: deferred.objectName,\n          field: deferred.field,\n          targetObject: deferred.targetObject,\n          targetField: deferred.targetField,\n          attemptedValue: deferred.attemptedValue,\n          recordIndex: deferred.recordIndex,\n          message: `Deferred reference unresolved after pass 2: ${deferred.objectName}.${deferred.field} = '${deferred.attemptedValue}' → ${deferred.targetObject}.${deferred.targetField} not found`,\n        };\n\n        const resultEntry = allResults.find(r => r.object === deferred.objectName);\n        if (resultEntry) {\n          resultEntry.errors.push(error);\n        }\n        allErrors.push(error);\n      }\n    }\n  }\n\n  // ==========================================================================\n  // Internal: Write Operations\n  // ==========================================================================\n\n  /**\n   * Seed writes always run as a privileged system context. This bypasses\n   * RBAC checks (so seeds can target system tables like `sys_*`) and\n   * disables the SecurityPlugin's auto-injection of `organization_id` /\n   * `owner_id` — seeds either declare those fields explicitly per\n   * record, or are intentionally cross-tenant / global.\n   */\n  private static readonly SEED_OPTIONS = { context: { isSystem: true } } as const;\n\n  private async writeRecord(\n    objectName: string,\n    record: Record<string, unknown>,\n    mode: string,\n    externalId: string,\n    existingRecords?: Map<string, any>,\n  ): Promise<{ action: 'inserted' | 'updated' | 'skipped'; id?: string }> {\n    const externalIdValue = record[externalId];\n    const existing = existingRecords?.get(String(externalIdValue ?? ''));\n    const opts = SeedLoaderService.SEED_OPTIONS as any;\n\n    switch (mode) {\n      case 'insert': {\n        const result = await this.engine.insert(objectName, record, opts);\n        return { action: 'inserted', id: this.extractId(result) };\n      }\n\n      case 'update': {\n        if (!existing) {\n          return { action: 'skipped' };\n        }\n        const id = this.extractId(existing);\n        await this.engine.update(objectName, { ...record, id }, opts);\n        return { action: 'updated', id };\n      }\n\n      case 'upsert': {\n        if (existing) {\n          const id = this.extractId(existing);\n          await this.engine.update(objectName, { ...record, id }, opts);\n          return { action: 'updated', id };\n        } else {\n          const result = await this.engine.insert(objectName, record, opts);\n          return { action: 'inserted', id: this.extractId(result) };\n        }\n      }\n\n      case 'ignore': {\n        if (existing) {\n          return { action: 'skipped', id: this.extractId(existing) };\n        }\n        const result = await this.engine.insert(objectName, record, opts);\n        return { action: 'inserted', id: this.extractId(result) };\n      }\n\n      case 'replace': {\n        // Replace mode: just insert (caller should have cleared the table)\n        const result = await this.engine.insert(objectName, record, opts);\n        return { action: 'inserted', id: this.extractId(result) };\n      }\n\n      default: {\n        const result = await this.engine.insert(objectName, record, opts);\n        return { action: 'inserted', id: this.extractId(result) };\n      }\n    }\n  }\n\n  // ==========================================================================\n  // Internal: Dependency Graph\n  // ==========================================================================\n\n  /**\n   * Kahn's algorithm for topological sort with cycle detection.\n   */\n  private topologicalSort(\n    nodes: ObjectDependencyNode[],\n  ): { insertOrder: string[]; circularDependencies: string[][] } {\n    const inDegree = new Map<string, number>();\n    const adjacency = new Map<string, string[]>();\n    const objectSet = new Set(nodes.map(n => n.object));\n\n    // Initialize\n    for (const node of nodes) {\n      inDegree.set(node.object, 0);\n      adjacency.set(node.object, []);\n    }\n\n    // Build adjacency list and in-degree counts\n    for (const node of nodes) {\n      for (const dep of node.dependsOn) {\n        // Exclude self-references from ordering (e.g., employee.manager_id → employee).\n        // Self-referencing fields are still tracked in node.references for resolution.\n        if (objectSet.has(dep) && dep !== node.object) {\n          adjacency.get(dep)!.push(node.object);\n          inDegree.set(node.object, (inDegree.get(node.object) || 0) + 1);\n        }\n      }\n    }\n\n    // Kahn's algorithm\n    const queue: string[] = [];\n    for (const [obj, degree] of inDegree) {\n      if (degree === 0) queue.push(obj);\n    }\n\n    const insertOrder: string[] = [];\n    while (queue.length > 0) {\n      const current = queue.shift()!;\n      insertOrder.push(current);\n\n      for (const neighbor of (adjacency.get(current) || [])) {\n        const newDegree = (inDegree.get(neighbor) || 0) - 1;\n        inDegree.set(neighbor, newDegree);\n        if (newDegree === 0) {\n          queue.push(neighbor);\n        }\n      }\n    }\n\n    // Detect circular dependencies\n    const circularDependencies: string[][] = [];\n    const remaining = nodes.filter(n => !insertOrder.includes(n.object));\n\n    if (remaining.length > 0) {\n      // Find cycles using DFS\n      const cycles = this.findCycles(remaining);\n      circularDependencies.push(...cycles);\n\n      // Add remaining objects to insertOrder (they'll need multi-pass)\n      for (const node of remaining) {\n        if (!insertOrder.includes(node.object)) {\n          insertOrder.push(node.object);\n        }\n      }\n    }\n\n    return { insertOrder, circularDependencies };\n  }\n\n  private findCycles(nodes: ObjectDependencyNode[]): string[][] {\n    const cycles: string[][] = [];\n    const nodeMap = new Map(nodes.map(n => [n.object, n]));\n    const visited = new Set<string>();\n    const inStack = new Set<string>();\n\n    const dfs = (current: string, path: string[]) => {\n      if (inStack.has(current)) {\n        // Found a cycle\n        const cycleStart = path.indexOf(current);\n        if (cycleStart !== -1) {\n          cycles.push([...path.slice(cycleStart), current]);\n        }\n        return;\n      }\n      if (visited.has(current)) return;\n\n      visited.add(current);\n      inStack.add(current);\n      path.push(current);\n\n      const node = nodeMap.get(current);\n      if (node) {\n        for (const dep of node.dependsOn) {\n          if (nodeMap.has(dep)) {\n            dfs(dep, [...path]);\n          }\n        }\n      }\n\n      inStack.delete(current);\n    };\n\n    for (const node of nodes) {\n      if (!visited.has(node.object)) {\n        dfs(node.object, []);\n      }\n    }\n\n    return cycles;\n  }\n\n  // ==========================================================================\n  // Internal: Helpers\n  // ==========================================================================\n\n  private filterByEnv(datasets: Dataset[], env?: string): Dataset[] {\n    if (!env) return datasets;\n    return datasets.filter(d => (d.env as string[]).includes(env));\n  }\n\n  private orderDatasets(datasets: Dataset[], insertOrder: string[]): Dataset[] {\n    const orderMap = new Map(insertOrder.map((name, i) => [name, i]));\n    return [...datasets].sort((a, b) => {\n      const orderA = orderMap.get(a.object) ?? Number.MAX_SAFE_INTEGER;\n      const orderB = orderMap.get(b.object) ?? Number.MAX_SAFE_INTEGER;\n      return orderA - orderB;\n    });\n  }\n\n  private buildReferenceMap(graph: ObjectDependencyGraph): Map<string, ReferenceResolution[]> {\n    const map = new Map<string, ReferenceResolution[]>();\n    for (const node of graph.nodes) {\n      if (node.references.length > 0) {\n        map.set(node.object, node.references);\n      }\n    }\n    return map;\n  }\n\n  private async loadExistingRecords(\n    objectName: string,\n    externalId: string,\n    organizationId?: string,\n  ): Promise<Map<string, any>> {\n    const map = new Map<string, any>();\n    try {\n      const findArgs: Record<string, unknown> = {\n        fields: ['id', externalId],\n        context: { isSystem: true },\n      };\n      // Per-tenant replay: restrict to the target tenant's own rows\n      // so upsert key matching never returns another tenant's record\n      // (would silently steal/overwrite rows across orgs).\n      if (organizationId) findArgs.where = { organization_id: organizationId };\n      const records = await this.engine.find(objectName, findArgs as any);\n      for (const record of records || []) {\n        const key = String(record[externalId] ?? '');\n        if (key) {\n          map.set(key, record);\n        }\n      }\n    } catch {\n      // Object may not have records yet\n    }\n    return map;\n  }\n\n  private looksLikeInternalId(value: string): boolean {\n    // UUID v4 pattern\n    if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value)) {\n      return true;\n    }\n    // MongoDB ObjectId pattern (24 hex chars)\n    if (/^[0-9a-f]{24}$/i.test(value)) {\n      return true;\n    }\n    return false;\n  }\n\n  private extractId(record: any): string | undefined {\n    if (!record) return undefined;\n    return String(record.id || record._id || '');\n  }\n\n  private buildEmptyResult(config: SeedLoaderConfig, durationMs: number): SeedLoaderResult {\n    return {\n      success: true,\n      dryRun: config.dryRun,\n      dependencyGraph: { nodes: [], insertOrder: [], circularDependencies: [] },\n      results: [],\n      errors: [],\n      summary: {\n        objectsProcessed: 0,\n        totalRecords: 0,\n        totalInserted: 0,\n        totalUpdated: 0,\n        totalSkipped: 0,\n        totalErrored: 0,\n        totalReferencesResolved: 0,\n        totalReferencesDeferred: 0,\n        circularDependencyCount: 0,\n        durationMs,\n      },\n    };\n  }\n\n  private buildResult(\n    config: SeedLoaderConfig,\n    graph: ObjectDependencyGraph,\n    results: DatasetLoadResult[],\n    errors: ReferenceResolutionError[],\n    durationMs: number,\n  ): SeedLoaderResult {\n    const summary = {\n      objectsProcessed: results.length,\n      totalRecords: results.reduce((sum, r) => sum + r.total, 0),\n      totalInserted: results.reduce((sum, r) => sum + r.inserted, 0),\n      totalUpdated: results.reduce((sum, r) => sum + r.updated, 0),\n      totalSkipped: results.reduce((sum, r) => sum + r.skipped, 0),\n      totalErrored: results.reduce((sum, r) => sum + r.errored, 0),\n      totalReferencesResolved: results.reduce((sum, r) => sum + r.referencesResolved, 0),\n      totalReferencesDeferred: results.reduce((sum, r) => sum + r.referencesDeferred, 0),\n      circularDependencyCount: graph.circularDependencies.length,\n      durationMs,\n    };\n\n    const hasErrors = errors.length > 0 || summary.totalErrored > 0;\n\n    return {\n      success: !hasErrors,\n      dryRun: config.dryRun,\n      dependencyGraph: graph,\n      results,\n      errors,\n      summary,\n    };\n  }\n}\n\n// ==========================================================================\n// Internal Types\n// ==========================================================================\n\ninterface DeferredUpdate {\n  objectName: string;\n  recordExternalId: string;\n  field: string;\n  targetObject: string;\n  targetField: string;\n  attemptedValue: unknown;\n  recordIndex: number;\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * # QuickJS-backed ScriptRunner\n *\n * Implements `ScriptRunner` using `quickjs-emscripten` (pure-WASM, edge-safe).\n *\n * Responsibilities:\n * - L1 ExpressionBody — evaluated as a `return (<source>)` snippet.\n * - L2 ScriptBody    — wrapped in `(async (ctx) => { <source> })(ctx)` (hooks)\n *                      or `(async (input, ctx) => { <source> })(input, ctx)` (actions).\n * - Hard timeout via QuickJS interrupt handler.\n * - Capability gating — host-side `ctx.api`, `ctx.crypto`, `ctx.log` are only\n *   wired into the VM if the body declares the matching capability.\n * - Structured marshalling — JSON-serialisable values cross the VM boundary.\n *   Functions are exposed as host-resident proxies (the script calls\n *   `ctx.api.object('foo').count(...)` and the host method runs in node).\n *\n * Trade-offs:\n * - Per-invocation overhead is dominated by VM creation. We pool runtimes per\n *   `(origin.kind, capabilities-set)` to amortise startup. Pool size is bounded\n *   by `maxPooled` (default 8); evicted runtimes are disposed.\n * - Memory caps are advisory under quickjs (engine has no hard MB cap); the\n *   runner uses `setMemoryLimit(memoryMb * 1MB)` which is best-effort.\n */\n\nimport {\n  newAsyncContext,\n  type QuickJSAsyncContext,\n  type QuickJSHandle,\n} from 'quickjs-emscripten';\nimport type { HookBody, ScriptBody, ExpressionBody, HookBodyCapability } from '@objectstack/spec/data';\nimport type {\n  ScriptContext,\n  ScriptOrigin,\n  ScriptResult,\n  ScriptRunOptions,\n  ScriptRunner,\n} from './script-runner.js';\n\nconst DEFAULT_HOOK_TIMEOUT_MS = 250;\nconst DEFAULT_ACTION_TIMEOUT_MS = 5000;\nconst DEFAULT_MEMORY_MB = 32;\n\nexport interface QuickJSScriptRunnerOptions {\n  /** Default per-invocation timeout for hooks (ms). */\n  hookTimeoutMs?: number;\n  /** Default per-invocation timeout for actions (ms). */\n  actionTimeoutMs?: number;\n  /** Default memory cap in MB. */\n  memoryMb?: number;\n}\n\nexport class QuickJSScriptRunner implements ScriptRunner {\n  private opts: Required<QuickJSScriptRunnerOptions>;\n\n  constructor(opts: QuickJSScriptRunnerOptions = {}) {\n    this.opts = {\n      hookTimeoutMs: opts.hookTimeoutMs ?? DEFAULT_HOOK_TIMEOUT_MS,\n      actionTimeoutMs: opts.actionTimeoutMs ?? DEFAULT_ACTION_TIMEOUT_MS,\n      memoryMb: opts.memoryMb ?? DEFAULT_MEMORY_MB,\n    };\n  }\n\n  async evalExpression(\n    body: ExpressionBody,\n    ctx: ScriptContext,\n    opts: ScriptRunOptions,\n  ): Promise<ScriptResult> {\n    return this.execute({\n      isExpression: true,\n      source: body.source,\n      capabilities: [],\n      timeoutMs: this.resolveTimeout(opts, undefined),\n      memoryMb: this.opts.memoryMb,\n      ctx,\n      origin: opts.origin,\n    });\n  }\n\n  async runScript(\n    body: ScriptBody,\n    ctx: ScriptContext,\n    opts: ScriptRunOptions,\n  ): Promise<ScriptResult> {\n    return this.execute({\n      isExpression: false,\n      source: body.source,\n      capabilities: body.capabilities,\n      timeoutMs: this.resolveTimeout(opts, body.timeoutMs),\n      memoryMb: body.memoryMb ?? this.opts.memoryMb,\n      ctx,\n      origin: opts.origin,\n    });\n  }\n\n  run(body: HookBody, ctx: ScriptContext, opts: ScriptRunOptions): Promise<ScriptResult> {\n    return body.language === 'expression'\n      ? this.evalExpression(body, ctx, opts)\n      : this.runScript(body, ctx, opts);\n  }\n\n  async dispose(): Promise<void> {\n    /* no-op — runtimes are per-invocation in v1 */\n  }\n\n  /** Pick the smallest of body / opts / engine-default. */\n  private resolveTimeout(opts: ScriptRunOptions, bodyTimeoutMs: number | undefined): number {\n    const def = opts.origin.kind === 'hook' ? this.opts.hookTimeoutMs : this.opts.actionTimeoutMs;\n    return Math.min(...[def, opts.timeoutMs, bodyTimeoutMs].filter((n): n is number => typeof n === 'number'));\n  }\n\n  private async execute(args: {\n    isExpression: boolean;\n    source: string;\n    capabilities: HookBodyCapability[];\n    timeoutMs: number;\n    memoryMb: number;\n    ctx: ScriptContext;\n    origin: ScriptOrigin;\n  }): Promise<ScriptResult> {\n    // Each invocation gets its own WebAssembly module via newAsyncContext().\n    // This is the canonical \"per-invocation isolate\" model and avoids the\n    // shared-runtime HostRef double-free issues we hit with a singleton\n    // QuickJSAsyncWASMModule when contexts are disposed concurrently.\n    const vm = await newAsyncContext();\n    const runtime = vm.runtime;\n    runtime.setMemoryLimit(args.memoryMb * 1024 * 1024);\n    runtime.setMaxStackSize(512 * 1024);\n\n    const start = Date.now();\n    const deadline = start + args.timeoutMs;\n    runtime.setInterruptHandler(() => Date.now() > deadline);\n\n    try {\n      this.installCtx(vm, args.ctx, new Set(args.capabilities), args.origin);\n\n      // L1 expressions are pure-sync: evaluate and read __result.\n      if (args.isExpression) {\n        const wrapped = `globalThis.__result = JSON.stringify((function(){ return (${args.source}); })());`;\n        const result = vm.evalCode(wrapped);\n        if (result.error) {\n          const err = vm.dump(result.error);\n          result.error.dispose();\n          throw new SandboxError(`${args.origin.kind} '${args.origin.name}' threw: ${formatErr(err)}`);\n        }\n        result.value.dispose();\n        const resH = vm.getProp(vm.global, '__result');\n        const resStr = vm.dump(resH);\n        resH.dispose();\n        const value = resStr === undefined || resStr === null || resStr === 'null'\n          ? undefined\n          : safeJsonParse(resStr);\n        return { value, durationMs: Date.now() - start };\n      }\n\n      // L2 scripts: wrap as async IIFE and use side-channel + asyncified pump.\n      // Each pump iteration:\n      //   1. yield to the host event loop (lets asyncified host calls resolve)\n      //   2. drain QuickJS pending jobs (advances the .then chain)\n      //   3. read __result/__error from the VM\n      const wrapped = args.origin.kind === 'hook'\n        ? `globalThis.__result = undefined; globalThis.__error = undefined;\n            (async (ctx) => { ${args.source} })(globalThis.__ctx).then(\n              function(v){ globalThis.__result = JSON.stringify(v === undefined ? null : v); },\n              function(e){ globalThis.__error = (e && e.message) ? (e.name + ': ' + e.message) : String(e); }\n            );`\n        : `globalThis.__result = undefined; globalThis.__error = undefined;\n            (async (input, ctx) => { ${args.source} })(globalThis.__input, globalThis.__ctx).then(\n              function(v){ globalThis.__result = JSON.stringify(v === undefined ? null : v); },\n              function(e){ globalThis.__error = (e && e.message) ? (e.name + ': ' + e.message) : String(e); }\n            );`;\n\n      const evalRes = await vm.evalCodeAsync(wrapped);\n      if (evalRes.error) {\n        const err = vm.dump(evalRes.error);\n        evalRes.error.dispose();\n        throw new SandboxError(`${args.origin.kind} '${args.origin.name}' threw: ${formatErr(err)}`);\n      }\n      evalRes.value.dispose();\n\n      let pumps = 0;\n      while (pumps < 1000) {\n        // Yield to host event loop so any in-flight asyncified host promises resolve.\n        await new Promise<void>((resolve) => setImmediate(resolve));\n\n        const pending = runtime.executePendingJobs();\n        if (pending.error) {\n          const err = vm.dump(pending.error);\n          pending.error.dispose();\n          throw new SandboxError(`${args.origin.kind} '${args.origin.name}' threw: ${formatErr(err)}`);\n        }\n\n        const errH = vm.getProp(vm.global, '__error');\n        const errStr = vm.dump(errH);\n        errH.dispose();\n        if (errStr) {\n          throw new SandboxError(`${args.origin.kind} '${args.origin.name}' threw: ${errStr}`);\n        }\n\n        const resH = vm.getProp(vm.global, '__result');\n        const resStr = vm.dump(resH);\n        resH.dispose();\n        if (resStr !== undefined && resStr !== null) {\n          const value = resStr === 'null' ? undefined : safeJsonParse(resStr);\n          // Capture mutated ctx.input so the host can write through.\n          const mutatedInput = readCtxInputJson(vm);\n          return { value, mutatedInput, durationMs: Date.now() - start };\n        }\n\n        if (Date.now() > deadline) {\n          throw new SandboxError(\n            `${args.origin.kind} '${args.origin.name}' exceeded timeout of ${args.timeoutMs}ms`,\n          );\n        }\n        pumps++;\n      }\n      throw new SandboxError(\n        `${args.origin.kind} '${args.origin.name}' did not resolve after ${pumps} pump iterations`,\n      );\n    } finally {\n      // newAsyncContext() owns its WASM module; disposing the context disposes\n      // the runtime + module together.\n      vm.dispose();\n    }\n  }\n\n  /**\n   * Install ctx onto the VM's globalThis. Each capability is wired in only if\n   * the body declared it; missing methods throw at call-time inside the VM\n   * with a clear diagnostic.\n   *\n   * Host API methods are installed via {@link QuickJSAsyncContext.newAsyncifiedFunction}\n   * so they may return Promises (real ObjectQL `find/count/insert/...` are async).\n   */\n  private installCtx(\n    vm: QuickJSAsyncContext,\n    ctx: ScriptContext,\n    caps: Set<HookBodyCapability>,\n    origin: ScriptOrigin,\n  ): void {\n    setGlobalJson(vm, '__input', ctx.input);\n    setGlobalJson(vm, '__previous', ctx.previous);\n\n    const ctxObj = vm.newObject();\n    setObjectJson(vm, ctxObj, 'input', ctx.input);\n    setObjectJson(vm, ctxObj, 'previous', ctx.previous);\n    setObjectJson(vm, ctxObj, 'user', ctx.user);\n    setObjectJson(vm, ctxObj, 'session', ctx.session);\n    if (typeof ctx.event === 'string') {\n      const evH = vm.newString(ctx.event);\n      vm.setProp(ctxObj, 'event', evH);\n      evH.dispose();\n    }\n    if (typeof ctx.object === 'string') {\n      const obH = vm.newString(ctx.object);\n      vm.setProp(ctxObj, 'object', obH);\n      obH.dispose();\n    }\n    if (typeof ctx.recordId === 'string') {\n      const idH = vm.newString(ctx.recordId);\n      vm.setProp(ctxObj, 'recordId', idH);\n      idH.dispose();\n    }\n    if (ctx.record !== undefined) {\n      setObjectJson(vm, ctxObj, 'record', ctx.record);\n    }\n    if (ctx.result !== undefined) {\n      setObjectJson(vm, ctxObj, 'result', ctx.result);\n    }\n\n    const apiObj = vm.newObject();\n    const objectFn = vm.newFunction('object', (nameH) => {\n      const objectName = vm.getString(nameH);\n      const wrap = vm.newObject();\n      const READ = ['find', 'findOne', 'count', 'aggregate'] as const;\n      const WRITE = ['insert', 'update', 'delete', 'updateMany', 'deleteMany', 'upsert'] as const;\n      for (const m of READ) installApiMethod(vm, wrap, m, objectName, ctx, caps, 'api.read', origin);\n      for (const m of WRITE) installApiMethod(vm, wrap, m, objectName, ctx, caps, 'api.write', origin);\n      return wrap;\n    });\n    vm.setProp(apiObj, 'object', objectFn);\n    objectFn.dispose();\n    vm.setProp(ctxObj, 'api', apiObj);\n    apiObj.dispose();\n\n    const logObj = vm.newObject();\n    for (const level of ['info', 'warn', 'error'] as const) {\n      const fn = vm.newFunction(level, (msgH, dataH) => {\n        if (!caps.has('log')) {\n          throw new SandboxError(`capability 'log' not granted to ${origin.kind} '${origin.name}'`);\n        }\n        const msg = vm.getString(msgH);\n        const data = dataH ? safeJsonParse(vm.getString(dataH)) : undefined;\n        ctx.log?.[level]?.(msg, data);\n        return vm.undefined;\n      });\n      vm.setProp(logObj, level, fn);\n      fn.dispose();\n    }\n    vm.setProp(ctxObj, 'log', logObj);\n    logObj.dispose();\n\n    const cryptoObj = vm.newObject();\n    const uuidFn = vm.newFunction('randomUUID', () => {\n      if (!caps.has('crypto.uuid')) {\n        throw new SandboxError(`capability 'crypto.uuid' not granted to ${origin.kind} '${origin.name}'`);\n      }\n      const v = ctx.crypto?.randomUUID?.() ?? cryptoRandomUUID();\n      return vm.newString(v);\n    });\n    vm.setProp(cryptoObj, 'randomUUID', uuidFn);\n    uuidFn.dispose();\n    vm.setProp(ctxObj, 'crypto', cryptoObj);\n    cryptoObj.dispose();\n\n    vm.setProp(vm.global, '__ctx', ctxObj);\n    ctxObj.dispose();\n  }\n}\n\n/**\n * Asyncified host-bound API method.\n *\n * Awaits Promise return values from the host implementation and marshals the\n * resolved value back into the VM. Capability check happens at call time and\n * surfaces inside the VM as a thrown error with a clear diagnostic.\n */\nfunction installApiMethod(\n  vm: QuickJSAsyncContext,\n  parent: QuickJSHandle,\n  method: string,\n  objectName: string,\n  ctx: ScriptContext,\n  caps: Set<HookBodyCapability>,\n  required: HookBodyCapability,\n  origin: ScriptOrigin,\n): void {\n  const fn = vm.newAsyncifiedFunction(method, async (...argHandles) => {\n    if (!caps.has(required)) {\n      throw new SandboxError(\n        `capability '${required}' not granted to ${origin.kind} '${origin.name}' (called ctx.api.object('${objectName}').${method})`,\n      );\n    }\n    const apiAny = ctx.api as Record<string, unknown> | undefined;\n    if (!apiAny || typeof apiAny.object !== 'function') {\n      throw new SandboxError(`ctx.api unavailable in ${origin.kind} '${origin.name}'`);\n    }\n    const args = argHandles.map((h) => vm.dump(h));\n    const proxy = (apiAny.object as (n: string) => Record<string, unknown>)(objectName);\n    const m = proxy[method] as ((...a: unknown[]) => unknown) | undefined;\n    if (typeof m !== 'function') {\n      throw new SandboxError(`ctx.api.object('${objectName}').${method} not implemented`);\n    }\n    const ret = await Promise.resolve(m.apply(proxy, args));\n    return jsonToHandle(vm, ret);\n  });\n  vm.setProp(parent, method, fn);\n  fn.dispose();\n}\n\n/** Marshal a host JSON-serializable value into a QuickJS handle. */\nfunction jsonToHandle(vm: QuickJSAsyncContext, v: unknown): QuickJSHandle {\n  const json = JSON.stringify(v ?? null);\n  const r = vm.evalCode(`(${json})`);\n  if (r.error) {\n    const msg = vm.dump(r.error);\n    r.error.dispose();\n    throw new SandboxError(`failed to marshal host value: ${formatErr(msg)}`);\n  }\n  return r.value;\n}\n\nfunction setGlobalJson(vm: QuickJSAsyncContext, name: string, v: unknown): void {\n  const json = JSON.stringify(v ?? null);\n  const result = vm.evalCode(`(${json})`);\n  if (result.error) {\n    result.error.dispose();\n    return;\n  }\n  vm.setProp(vm.global, name, result.value);\n  result.value.dispose();\n}\n\nfunction setObjectJson(vm: QuickJSAsyncContext, parent: QuickJSHandle, key: string, v: unknown): void {\n  const json = JSON.stringify(v ?? null);\n  const result = vm.evalCode(`(${json})`);\n  if (result.error) {\n    result.error.dispose();\n    vm.setProp(parent, key, vm.null);\n    return;\n  }\n  vm.setProp(parent, key, result.value);\n  result.value.dispose();\n}\n\n/**\n * After the script has settled, dump `globalThis.__ctx.input` so the host can\n * write through any direct property mutations the script performed (e.g.\n * `ctx.input.account_number = 'ABC'`).\n *\n * Returns `undefined` if the read fails for any reason — callers fall back to\n * the script's return value in that case.\n */\nfunction readCtxInputJson(vm: QuickJSAsyncContext): Record<string, unknown> | undefined {\n  try {\n    const r = vm.evalCode(`JSON.stringify(globalThis.__ctx && globalThis.__ctx.input || null)`);\n    if (r.error) {\n      r.error.dispose();\n      return undefined;\n    }\n    const s = vm.dump(r.value);\n    r.value.dispose();\n    if (typeof s !== 'string' || s === 'null') return undefined;\n    const parsed = safeJsonParse(s);\n    return parsed && typeof parsed === 'object' && !Array.isArray(parsed)\n      ? (parsed as Record<string, unknown>)\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction safeJsonParse(s: string | undefined): unknown {\n  if (s === undefined || s === '') return undefined;\n  try {\n    return JSON.parse(s);\n  } catch {\n    return s;\n  }\n}\n\nfunction cryptoRandomUUID(): string {\n  if (typeof globalThis.crypto?.randomUUID === 'function') return globalThis.crypto.randomUUID();\n  // RFC 4122 v4 fallback\n  const r = () => Math.floor(Math.random() * 0x100000000).toString(16).padStart(8, '0');\n  return `${r()}-${r().slice(0, 4)}-4${r().slice(0, 3)}-${r().slice(0, 4)}-${r()}${r().slice(0, 4)}`;\n}\n\nfunction formatErr(err: unknown): string {\n  if (err && typeof err === 'object') {\n    const o = err as { message?: string; name?: string; stack?: string };\n    if (o.message) return `${o.name ?? 'Error'}: ${o.message}`;\n    return JSON.stringify(err);\n  }\n  return String(err);\n}\n\nexport class SandboxError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'SandboxError';\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Hook & Action Body Runner Factory\n *\n * Bridges the metadata-only `Hook.body` / `Action.body` discriminated union\n * (defined in `@objectstack/spec/data/hook-body.zod`) into an executable\n * handler registered on the ObjectQL engine.\n *\n * The runtime owns this bridge — `objectql` itself never imports the\n * sandbox engine, so it can stay light enough to embed in tooling and\n * tests. `AppPlugin` constructs one factory per bundle bind and passes it\n * through `bindHooksToEngine({ bodyRunner })` for hooks, and walks the\n * bundle actions to register them via `engine.registerAction`.\n *\n * Per-invocation flow when a triggered hook fires:\n *   1. ObjectQL calls the wrapped handler with its native `(ctx)` arg.\n *   2. We adapt that engine-context into the sandbox `ScriptContext`\n *      shape and proxy `ctx.api.object(...)` to the running ObjectQL\n *      proxy bound to the current organization/user.\n *   3. `ScriptRunner.runScript` evaluates the body inside QuickJS with\n *      the declared capabilities + timeout.\n *   4. After settle, we write back two kinds of mutations to the host\n *      `ctx.input`:\n *      a. `result.mutatedInput` — a snapshot of `ctx.input` taken inside\n *         the VM, used to propagate direct property writes such as\n *         `ctx.input.account_number = 'ABC'`.\n *      b. `result.value` — if the script returned an object, it is\n *         shallow-merged on top of `mutatedInput` as an explicit patch.\n *      Writes go through `Object.assign`, which means the host engine's\n *      flat-record Proxy (installed by `wrapDeclarativeHook`) sees them\n *      via its set trap.\n */\n\nimport type { Hook } from '@objectstack/spec/data';\nimport { HookBodySchema } from '@objectstack/spec/data';\nimport type { ScriptRunner, ScriptContext, ScriptResult } from './script-runner.js';\n\ninterface FactoryOptions {\n  ql: any;\n  appId: string;\n  logger?: any;\n}\n\nexport function hookBodyRunnerFactory(\n  runner: ScriptRunner,\n  opts: FactoryOptions,\n): (hook: Hook) => ((engineCtx: any) => Promise<void>) | undefined {\n  return (hook: Hook) => {\n    const raw = (hook as any).body;\n    if (!raw) return undefined;\n\n    const parsed = HookBodySchema.safeParse(raw);\n    if (!parsed.success) {\n      opts.logger?.warn?.('[BodyRunner] invalid hook.body shape', {\n        appId: opts.appId,\n        hook: hook.name,\n        issues: parsed.error.issues.slice(0, 3),\n      });\n      return undefined;\n    }\n    const body = parsed.data;\n\n    return async function boundBodyHandler(engineCtx: any): Promise<void> {\n      const sandboxCtx = buildSandboxContext(engineCtx, opts.ql);\n      try {\n        opts.logger?.debug?.('[BodyRunner] hook fired', { appId: opts.appId, hook: hook.name });\n        const result = await runner.run(body, sandboxCtx, {\n          origin: {\n            kind: 'hook',\n            name: hook.name,\n            object: typeof (hook as any).object === 'string' ? (hook as any).object : undefined,\n          },\n          timeoutMs: (body as any).timeoutMs ?? 250,\n        });\n        applyMutationsToInput(engineCtx, result);\n      } catch (err: any) {\n        opts.logger?.error?.('[BodyRunner] sandboxed hook threw', err, {\n          appId: opts.appId,\n          hook: hook.name,\n        });\n        throw err;\n      }\n    };\n  };\n}\n\n/**\n * Action body runner factory.\n *\n * Returns a handler with the shape ObjectQL's `executeAction` expects:\n * `(actionCtx) => Promise<unknown>`. The action's return value bubbles up\n * to the HTTP dispatcher which JSON-serialises it back to the caller.\n */\nexport function actionBodyRunnerFactory(\n  runner: ScriptRunner,\n  opts: FactoryOptions,\n): (action: { name: string; body?: unknown; object?: string; timeoutMs?: number }) =>\n  | ((actionCtx: any) => Promise<unknown>)\n  | undefined {\n  return (action) => {\n    const raw = action.body;\n    if (!raw) return undefined;\n\n    const parsed = HookBodySchema.safeParse(raw);\n    if (!parsed.success) {\n      opts.logger?.warn?.('[BodyRunner] invalid action.body shape', {\n        appId: opts.appId,\n        action: action.name,\n        issues: parsed.error.issues.slice(0, 3),\n      });\n      return undefined;\n    }\n    const body = parsed.data;\n\n    return async function boundActionHandler(actionCtx: any): Promise<unknown> {\n      const sandboxCtx = buildActionSandboxContext(actionCtx, opts.ql);\n      try {\n        opts.logger?.debug?.('[BodyRunner] action fired', {\n          appId: opts.appId,\n          action: action.name,\n          object: action.object,\n        });\n        const result = await runner.run(body, sandboxCtx, {\n          origin: { kind: 'action', name: action.name, object: action.object },\n          timeoutMs: (body as any).timeoutMs ?? action.timeoutMs ?? 5000,\n        });\n        return result.value;\n      } catch (err: any) {\n        opts.logger?.error?.('[BodyRunner] sandboxed action threw', err, {\n          appId: opts.appId,\n          action: action.name,\n        });\n        throw err;\n      }\n    };\n  };\n}\n\nfunction applyMutationsToInput(engineCtx: any, result: ScriptResult): void {\n  const target = engineCtx?.input;\n  if (!target || typeof target !== 'object') return;\n  if (result.mutatedInput && typeof result.mutatedInput === 'object') {\n    Object.assign(target, result.mutatedInput);\n  }\n  if (\n    result.value &&\n    typeof result.value === 'object' &&\n    !Array.isArray(result.value)\n  ) {\n    Object.assign(target, result.value);\n  }\n}\n\nfunction buildEngineRepoFacade(ql: any, objectName: string) {\n  // Minimal repository surface that proxies to the raw engine.\n  // Actions execute as the system user (no user context at HTTP boundary\n  // beyond `actionCtx.user`); ObjectQL's permission middleware will still\n  // gate writes via the engine's standard insert/update path.\n  return {\n    async find(opts?: any) { return ql.find(objectName, opts); },\n    async findOne(opts?: any) {\n      const rows = await ql.find(objectName, opts);\n      return Array.isArray(rows) ? rows[0] ?? null : null;\n    },\n    async count(opts?: any) {\n      if (typeof ql.count === 'function') return ql.count(objectName, opts);\n      const rows = await ql.find(objectName, opts);\n      return Array.isArray(rows) ? rows.length : 0;\n    },\n    async insert(data: any) { return ql.insert(objectName, data); },\n    async update(data: any, opts?: any) { return ql.update(objectName, data, opts); },\n    async upsert(data: any, opts?: any) {\n      if (typeof ql.upsert === 'function') return ql.upsert(objectName, data, opts);\n      return ql.insert(objectName, data);\n    },\n    async delete(opts?: any) { return ql.delete(objectName, opts); },\n  };\n}\n\nfunction buildSandboxApi(engineCtx: any, ql: any, errLabel: string) {\n  const engineApi = engineCtx?.api;\n  if (engineApi && typeof engineApi.object === 'function') return engineApi;\n  return {\n    object: (objectName: string) => {\n      if (!ql) throw new Error(`ObjectQL engine unavailable to ${errLabel}`);\n      // Prefer the engine's own ScopedContext-based `.object()` when\n      // present; otherwise synthesize a minimal repo facade against the\n      // engine's CRUD primitives (so the body can call .insert/.find/etc).\n      if (typeof ql.object === 'function') {\n        try { return ql.object(objectName); } catch { /* fall through */ }\n      }\n      return buildEngineRepoFacade(ql, objectName);\n    },\n  };\n}\n\nfunction buildSandboxContext(engineCtx: any, ql: any): ScriptContext {\n  const inputSnapshot = unwrapProxyToPlain(engineCtx?.input ?? engineCtx?.doc);\n  const previousRaw = engineCtx?.previous ?? engineCtx?.previousDoc;\n  return {\n    input: inputSnapshot ?? {},\n    // Preserve `undefined` for `previous` on insert events so hooks can\n    // reliably distinguish create (`!ctx.previous`) from update/delete.\n    previous: unwrapProxyToPlain(previousRaw),\n    user: engineCtx?.user ?? engineCtx?.session?.user,\n    session: engineCtx?.session,\n    event: typeof engineCtx?.event === 'string' ? engineCtx.event : undefined,\n    object: typeof engineCtx?.object === 'string' ? engineCtx.object : undefined,\n    result: engineCtx?.result,\n    api: buildSandboxApi(engineCtx, ql, 'hook body'),\n    log: engineCtx?.logger,\n    crypto: globalThis.crypto,\n  };\n}\n\nfunction buildActionSandboxContext(actionCtx: any, ql: any): ScriptContext {\n  // Action ctx convention (mirrors http-dispatcher.ts):\n  //   { record, params, recordId, user, session, engine, services, ... }\n  // The script signature is `(input, ctx)` — input gets `params`, ctx gets\n  // the full action context.\n  const recordId =\n    typeof actionCtx?.recordId === 'string'\n      ? actionCtx.recordId\n      : typeof actionCtx?.record?.id === 'string'\n        ? actionCtx.record.id\n        : undefined;\n  return {\n    input: unwrapProxyToPlain(actionCtx?.params ?? {}),\n    previous: undefined,\n    user: actionCtx?.user ?? actionCtx?.session?.user,\n    session: actionCtx?.session,\n    object: typeof actionCtx?.object === 'string' ? actionCtx.object : undefined,\n    recordId,\n    record: unwrapProxyToPlain(actionCtx?.record),\n    api: buildSandboxApi(actionCtx, ql, 'action body'),\n    log: actionCtx?.logger,\n    crypto: globalThis.crypto,\n  };\n}\n\n/**\n * Convert a Proxy-wrapped record into a plain object so it round-trips through\n * JSON cleanly. `Object.fromEntries(Object.entries(p))` triggers the proxy's\n * ownKeys + get traps, materialising every visible field.\n */\nfunction unwrapProxyToPlain(v: unknown): Record<string, unknown> | undefined {\n  if (v === undefined || v === null) return undefined;\n  if (typeof v !== 'object') return undefined;\n  if (Array.isArray(v)) return undefined;\n  try {\n    return Object.fromEntries(Object.entries(v as Record<string, unknown>));\n  } catch {\n    return undefined;\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Plugin, PluginContext } from '@objectstack/core';\nimport { SeedLoaderService } from './seed-loader.js';\nimport type { IMetadataService, II18nService } from '@objectstack/spec/contracts';\nimport { QuickJSScriptRunner } from './sandbox/quickjs-runner.js';\nimport { hookBodyRunnerFactory, actionBodyRunnerFactory } from './sandbox/body-runner.js';\n\n/**\n * Optional per-project context attached when AppPlugin is instantiated by the\n * project kernel factory. Required for the `app:registered` / `app:unregistered`\n * hooks that drive the org-scoped `sys_app` catalog. Standalone (single-tenant)\n * usages may omit this — no catalog hooks are emitted in that case.\n */\nexport interface AppPluginProjectContext {\n    environmentId: string;\n    organizationId: string;\n    projectName?: string;\n    /** When the app comes from a package installation, the source package id. */\n    packageId?: string;\n    /** Defaults to 'package' when packageId is set, otherwise 'user'. */\n    source?: 'package' | 'user';\n}\n\n/**\n * AppPlugin\n * \n * Adapts a generic App Bundle (Manifest + Runtime Code) into a Kernel Plugin.\n * \n * Responsibilities:\n * 1. Register App Manifest as a service (for ObjectQL discovery)\n * 2. Execute Runtime `onEnable` hook (for code logic)\n * 3. Auto-load i18n translation bundles into the kernel's i18n service\n */\nexport class AppPlugin implements Plugin {\n    name: string;\n    type = 'app';\n    version?: string;\n    \n    private bundle: any;\n    private projectContext?: AppPluginProjectContext;\n\n    constructor(bundle: any, projectContext?: AppPluginProjectContext) {\n        this.bundle = bundle;\n        this.projectContext = projectContext;\n        // Support both direct manifest (legacy) and Stack Definition (nested manifest)\n        const sys = bundle.manifest || bundle;\n        const appId = sys.id || sys.name || 'unnamed-app';\n\n        this.name = `plugin.app.${appId}`;\n        this.version = sys.version;\n    }\n\n    init = async (ctx: PluginContext) => {\n        const sys = this.bundle.manifest || this.bundle;\n        const appId = sys.id || sys.name;\n\n        ctx.logger.info('Registering App Service', { \n            appId, \n            pluginName: this.name,\n            version: this.version \n        });\n        \n        // Register the app manifest directly via the manifest service.\n        // This immediately decomposes the manifest into SchemaRegistry entries.\n        const servicePayload = this.bundle.manifest\n            ? { ...this.bundle.manifest, ...this.bundle }\n            : this.bundle;\n\n        console.warn(\n            `[AppPlugin:init] appId=${appId} keys=${Object.keys(servicePayload).join(',')} flows=${Array.isArray((servicePayload as any).flows) ? (servicePayload as any).flows.length : 'n/a'}`,\n        );\n\n        ctx.getService<{ register(m: any): void }>('manifest').register(servicePayload);\n    }\n\n    start = async (ctx: PluginContext) => {\n        const sys = this.bundle.manifest || this.bundle;\n        const appId = sys.id || sys.name;\n        \n        // Execute Runtime Step\n        // Retrieve ObjectQL engine from services\n        // ctx.getService throws when a service is not registered, so we\n        // must use try/catch instead of a null-check.\n        let ql: any;\n        try {\n            ql = ctx.getService('objectql');\n        } catch {\n            // Service not registered — handled below\n        }\n\n        if (!ql) {\n            ctx.logger.warn('ObjectQL engine service not found', { \n                appName: this.name,\n                appId \n            });\n            return;\n        }\n\n        ctx.logger.debug('Retrieved ObjectQL engine service', { appId });\n\n        // Configure datasourceMapping if provided in the stack definition\n        if (this.bundle.datasourceMapping && Array.isArray(this.bundle.datasourceMapping)) {\n            ctx.logger.info('Configuring datasource mapping rules', {\n                appId,\n                ruleCount: this.bundle.datasourceMapping.length\n            });\n            ql.setDatasourceMapping(this.bundle.datasourceMapping);\n        }\n\n        // Resolve the runtime hook owner. Modules that declare both a\n        // `default` (defineStack(...)) export and a named `onEnable` export\n        // hide the named export from `bundle.default`, so we fall back to the\n        // top-level bundle when the default doesn't carry the hook.\n        const stackBundle = this.bundle.default || this.bundle;\n        const runtime: any = (stackBundle && typeof stackBundle.onEnable === 'function')\n            ? stackBundle\n            : this.bundle;\n\n        if (runtime && typeof runtime.onEnable === 'function') {\n             ctx.logger.info('Executing runtime.onEnable', { \n                 appName: this.name,\n                 appId \n             });\n             \n             // Construct the Host Context (mirroring old ObjectQL.use logic)\n             const hostContext = {\n                ...ctx,\n                ql,\n                logger: ctx.logger,\n                drivers: {\n                    register: (driver: any) => {\n                        ctx.logger.debug('Registering driver via app runtime', { \n                            driverName: driver.name,\n                            appId \n                        });\n                        ql.registerDriver(driver);\n                    }\n                },\n             };\n             \n             await runtime.onEnable(hostContext);\n             ctx.logger.debug('Runtime.onEnable completed', { appId });\n        } else {\n             ctx.logger.debug('No runtime.onEnable function found', { appId });\n        }\n\n        // ── Auto-bind declarative Hook metadata ─────────────────────────\n        // Hooks declared via `defineStack({ hooks })` (or attached to the\n        // bundle by other tooling) are wired into the ObjectQL execution\n        // pipeline here, with no boilerplate from user code. Inline\n        // function handlers are resolved directly; string-named handlers\n        // are looked up in `bundle.functions` (also auto-registered) or in\n        // any function previously registered on the engine.\n        //\n        // Runs AFTER `runtime.onEnable` so user code may still\n        // imperatively register additional hooks/functions for advanced\n        // cases — both will coexist on the engine.\n        try {\n            const hooks = collectBundleHooks(this.bundle);\n            const functions = collectBundleFunctions(this.bundle);\n            if (hooks.length > 0 || Object.keys(functions).length > 0) {\n                if (typeof ql.bindHooks === 'function') {\n                    ql.bindHooks(hooks, {\n                        packageId: `app:${appId}`,\n                        functions,\n                        bodyRunner: hookBodyRunnerFactory(new QuickJSScriptRunner(), {\n                            ql,\n                            logger: ctx.logger,\n                            appId,\n                        }),\n                    });\n                    ctx.logger.info('[AppPlugin] Bound declarative hooks', {\n                        appId,\n                        hookCount: hooks.length,\n                        functionCount: Object.keys(functions).length,\n                    });\n                } else {\n                    ctx.logger.warn('[AppPlugin] ql.bindHooks unavailable; declarative hooks ignored', {\n                        appId,\n                        hookCount: hooks.length,\n                    });\n                }\n            }\n        } catch (err: any) {\n            ctx.logger.error('[AppPlugin] Failed to bind declarative hooks', err as Error, {\n                appId,\n            });\n        }\n\n        // ── Auto-register declarative Action handlers ───────────────────\n        // Actions with an inline `handler` (or extracted `body`) are wired\n        // to the engine here so HTTP `POST /api/v1/actions/<obj>/<name>`\n        // can invoke them. Actions without a body are left for legacy\n        // imperative `engine.registerAction(...)` registration in user code.\n        try {\n            const actions = collectBundleActions(this.bundle);\n            const actionBodyRunner = actionBodyRunnerFactory(new QuickJSScriptRunner(), {\n                ql,\n                logger: ctx.logger,\n                appId,\n            });\n            let registered = 0;\n            if (actions.length > 0 && typeof ql.registerAction === 'function') {\n                for (const action of actions) {\n                    const handler = actionBodyRunner(action);\n                    if (!handler) continue;\n                    const objectKey =\n                        typeof action.object === 'string' && action.object.length > 0\n                            ? action.object\n                            : 'global';\n                    try {\n                        ql.registerAction(objectKey, action.name, handler, `app:${appId}`);\n                        registered++;\n                    } catch (err: any) {\n                        ctx.logger.warn('[AppPlugin] Failed to register action body', {\n                            appId,\n                            action: action.name,\n                            object: objectKey,\n                            error: err?.message ?? String(err),\n                        });\n                    }\n                }\n            }\n            if (registered > 0) {\n                ctx.logger.info('[AppPlugin] Bound declarative actions', {\n                    appId,\n                    actionCount: registered,\n                });\n            }\n        } catch (err: any) {\n            ctx.logger.error('[AppPlugin] Failed to bind declarative actions', err as Error, {\n                appId,\n            });\n        }\n\n        // ── Auto-register declarative Approval Processes ────────────────\n        // Approval processes declared via `defineStack({ approvals })` are\n        // upserted into the running `approvals` service. The `approvals`\n        // service itself registers on `kernel:ready`, so we defer to the\n        // same hook to avoid a chicken-and-egg.\n        try {\n            const approvals: any[] = Array.isArray(this.bundle.approvals)\n                ? this.bundle.approvals\n                : Array.isArray((this.bundle.manifest || {}).approvals)\n                    ? (this.bundle.manifest as any).approvals\n                    : [];\n            if (approvals.length > 0) {\n                ctx.hook('kernel:ready', async () => {\n                    let svc: any;\n                    try { svc = ctx.getService('approvals'); } catch { /* not installed */ }\n                    if (!svc || typeof svc.defineProcess !== 'function') {\n                        ctx.logger.warn('[AppPlugin] approvals service not registered — skipping declarative processes', {\n                            appId, processCount: approvals.length,\n                        });\n                        return;\n                    }\n                    const sysCtx = { isSystem: true, roles: [], permissions: [] };\n                    let ok = 0;\n                    for (const proc of approvals) {\n                        try {\n                            await svc.defineProcess({\n                                name: proc.name,\n                                label: proc.label,\n                                object: proc.object,\n                                description: proc.description,\n                                active: proc.active !== false,\n                                definition: proc,\n                            }, sysCtx);\n                            ok++;\n                        } catch (err: any) {\n                            ctx.logger.warn('[AppPlugin] Failed to register approval process', {\n                                appId, process: proc?.name, error: err?.message ?? String(err),\n                            });\n                        }\n                    }\n                    ctx.logger.info('[AppPlugin] Registered approval processes', { appId, count: ok });\n                });\n            }\n        } catch (err: any) {\n            ctx.logger.error('[AppPlugin] Failed to schedule approval-process registration', err as Error, { appId });\n        }\n\n        // ── Org-Scoped App Catalog Sync ──────────────────────────────────\n        // Emit `app:registered` so AppCatalogService (running on the\n        // control-plane kernel) can mirror this app into `sys_app`. Skipped\n        // for standalone (single-tenant) usages where no project context is\n        // attached.\n        this.emitCatalogEvent(ctx, 'app:registered', sys);\n\n        // ── i18n Translation Loading ─────────────────────────────────────\n        // Auto-load translation bundles from the app config into the\n        // kernel's i18n service, so discovery and handlers stay consistent.\n        await this.loadTranslations(ctx, appId);\n\n        // Data Seeding\n        // Collect seed data from multiple locations (top-level `data` preferred, `manifest.data` for backward compat)\n        const seedDatasets: any[] = [];\n        \n        // 1. Top-level `data` field (new standard location on ObjectStackDefinition)\n        if (Array.isArray(this.bundle.data)) {\n            seedDatasets.push(...this.bundle.data);\n        }\n        \n        // 2. Legacy: `manifest.data` (backward compatibility)\n        const manifest = this.bundle.manifest || this.bundle;\n        if (manifest && Array.isArray(manifest.data)) {\n            seedDatasets.push(...manifest.data);\n        }\n\n        // Object names in seed data are used as-is — no FQN expansion.\n        // Under the current naming convention, the object's short name IS\n        // the canonical name and the physical table name.\n\n        if (seedDatasets.length > 0) {\n             ctx.logger.info(`[AppPlugin] Found ${seedDatasets.length} seed datasets for ${appId}`);\n\n             // Pass seed datasets through unchanged — object names are canonical\n             const normalizedDatasets = seedDatasets\n                 .filter((d: any) => d.object && Array.isArray(d.records))\n                 .map((d: any) => ({\n                     ...d,\n                     object: d.object,\n                 }));\n\n             // Stash datasets on a kernel service so SecurityPlugin's\n             // sys_organization insert hook can replay them per-tenant\n             // (Salesforce-sandbox style: every new org gets its own\n             // private copy of the artifact's demo data).\n             //\n             // We also register a `seed-replayer` callable so the\n             // SecurityPlugin doesn't need to import @objectstack/runtime\n             // (would create a circular workspace dep). The replayer\n             // captures the SeedLoaderService closure and exposes a\n             // narrow `(orgId) => Promise<summary>` surface.\n             try {\n                 const kernel: any = (ctx as any).kernel;\n                 const existing = (() => {\n                     try { return kernel?.getService?.('seed-datasets'); } catch { return undefined; }\n                 })();\n                 const merged = Array.isArray(existing)\n                     ? [...existing, ...normalizedDatasets]\n                     : normalizedDatasets;\n                 const registerSvc = (name: string, value: any) => {\n                     if (kernel?.registerService) kernel.registerService(name, value);\n                     else if (typeof (ctx as any).registerService === 'function') (ctx as any).registerService(name, value);\n                 };\n                 registerSvc('seed-datasets', merged);\n\n                 const metadataNow = ctx.getService('metadata') as IMetadataService | undefined;\n                 const loggerRef = ctx.logger;\n                 const replayer = async (organizationId: string) => {\n                     if (!organizationId) return { inserted: 0, updated: 0, errors: [] as any[] };\n                     const md = metadataNow ?? (ctx.getService('metadata') as IMetadataService | undefined);\n                     if (!md) {\n                         loggerRef.warn('[seed-replayer] metadata service unavailable');\n                         return { inserted: 0, updated: 0, errors: [] as any[] };\n                     }\n                     const datasetsNow = (() => {\n                         try { return kernel?.getService?.('seed-datasets'); } catch { return merged; }\n                     })() ?? merged;\n                     if (!Array.isArray(datasetsNow) || datasetsNow.length === 0) {\n                         return { inserted: 0, updated: 0, errors: [] as any[] };\n                     }\n                     const seedLoader = new SeedLoaderService(ql, md, loggerRef);\n                     const { SeedLoaderRequestSchema } = await import('@objectstack/spec/data');\n                     const request = SeedLoaderRequestSchema.parse({\n                         datasets: datasetsNow,\n                         config: {\n                             defaultMode: 'upsert',\n                             multiPass: true,\n                             organizationId,\n                         },\n                     });\n                     const result = await seedLoader.load(request);\n                     return {\n                         inserted: result.summary.totalInserted,\n                         updated: result.summary.totalUpdated,\n                         errors: result.errors,\n                     };\n                 };\n                 registerSvc('seed-replayer', replayer);\n                 ctx.logger.info(`[Seeder] Registered ${normalizedDatasets.length} datasets + replayer on kernel (total datasets: ${merged.length})`);\n             } catch (e: any) {\n                 ctx.logger.warn('[Seeder] Failed to register seed-datasets/seed-replayer service', { error: e?.message });\n             }\n\n             // Decide whether to also run the seed inline at AppPlugin\n             // start. In multi-tenant mode, the per-org replay (driven\n             // by SecurityPlugin's sys_organization middleware) is the\n             // source of truth — running it here too would create NULL-\n             // org rows that pollute reads and need a separate claim\n             // step. So we skip it. Single-tenant deployments keep the\n             // legacy behaviour: seed immediately at boot so there's\n             // always demo data without needing an org insert.\n             const multiTenant = String(process.env.OS_MULTI_TENANT ?? 'true').toLowerCase() !== 'false';\n             if (multiTenant) {\n                 ctx.logger.info('[Seeder] multi-tenant mode — skipping inline seed; per-org replay will run on sys_organization insert');\n             } else {\n             // Use SeedLoaderService for metadata-driven loading with reference resolution\n             try {\n                 const metadata = ctx.getService('metadata') as IMetadataService | undefined;\n                 if (metadata) {\n                     const seedLoader = new SeedLoaderService(ql, metadata, ctx.logger);\n                     const { SeedLoaderRequestSchema } = await import('@objectstack/spec/data');\n                     const request = SeedLoaderRequestSchema.parse({\n                         datasets: normalizedDatasets,\n                         config: { defaultMode: 'upsert', multiPass: true },\n                     });\n                     const result = await seedLoader.load(request);\n                     ctx.logger.info('[Seeder] Seed loading complete', {\n                         inserted: result.summary.totalInserted,\n                         updated: result.summary.totalUpdated,\n                         errors: result.errors.length,\n                     });\n                 } else {\n                     // Fallback: basic insert when metadata service is not available\n                     ctx.logger.debug('[Seeder] No metadata service; using basic insert fallback');\n                     for (const dataset of normalizedDatasets) {\n                         ctx.logger.info(`[Seeder] Seeding ${dataset.records.length} records for ${dataset.object}`);\n                         for (const record of dataset.records) {\n                             try {\n                                 await ql.insert(dataset.object, record, { context: { isSystem: true } } as any);\n                             } catch (err: any) {\n                                 ctx.logger.warn(`[Seeder] Failed to insert ${dataset.object} record:`, { error: err.message });\n                             }\n                         }\n                     }\n                     ctx.logger.info('[Seeder] Data seeding complete.');\n                 }\n             } catch (err: any) {\n                 // If SeedLoaderService fails (e.g., metadata not available), fall back to basic insert\n                 ctx.logger.warn('[Seeder] SeedLoaderService failed, falling back to basic insert', { error: err.message });\n                 for (const dataset of normalizedDatasets) {\n                     for (const record of dataset.records) {\n                         try {\n                             await ql.insert(dataset.object, record, { context: { isSystem: true } } as any);\n                         } catch (insertErr: any) {\n                             ctx.logger.warn(`[Seeder] Failed to insert ${dataset.object} record:`, { error: insertErr.message });\n                         }\n                     }\n                 }\n                 ctx.logger.info('[Seeder] Data seeding complete (fallback).');\n             }\n             }\n        }\n    }\n\n    stop = async (ctx: PluginContext) => {\n        const sys = this.bundle.manifest || this.bundle;\n        this.emitCatalogEvent(ctx, 'app:unregistered', sys);\n    }\n\n    /**\n     * Emit a kernel hook so the control-plane `AppCatalogService` can\n     * upsert / delete the corresponding `sys_app` row. Silently no-ops\n     * when no project context is attached (standalone single-tenant mode)\n     * or when the kernel has no `trigger` API available.\n     */\n    private emitCatalogEvent(ctx: PluginContext, event: 'app:registered' | 'app:unregistered', sys: any): void {\n        if (!this.projectContext) return;\n\n        const trigger = (ctx as any).trigger;\n        if (typeof trigger !== 'function') {\n            ctx.logger.debug('[AppPlugin] kernel has no trigger() — skipping catalog hook', { event });\n            return;\n        }\n\n        const appName = sys.name || sys.id;\n        if (!appName) return;\n\n        const payload = {\n            environmentId: this.projectContext.environmentId,\n            organizationId: this.projectContext.organizationId,\n            projectName: this.projectContext.projectName,\n            app: {\n                name: appName,\n                label: sys.label,\n                icon: sys.icon,\n                branding: sys.branding,\n                isDefault: sys.isDefault ?? sys.is_default,\n                active: sys.active !== false,\n            },\n            source: this.projectContext.source ?? (this.projectContext.packageId ? 'package' : 'user'),\n            packageId: this.projectContext.packageId,\n        };\n\n        try {\n            trigger.call(ctx, event, payload);\n        } catch (err: any) {\n            ctx.logger.warn('[AppPlugin] catalog hook trigger failed', { event, error: err?.message });\n        }\n    }\n\n    /**\n     * Auto-load i18n translation bundles from the app config into the\n     * kernel's i18n service. Handles both `translations` (array of\n     * TranslationBundle) and `i18n` config (default locale, etc.).\n     *\n     * Gracefully skips when the i18n service is not registered —\n     * this keeps AppPlugin resilient across server/dev/mock environments.\n     */\n    private async loadTranslations(ctx: PluginContext, appId: string): Promise<void> {\n        // ctx.getService throws when a service is not registered, so we\n        // must use try/catch to gracefully skip when no i18n plugin is loaded.\n        let i18nService: II18nService | undefined;\n        try {\n            i18nService = ctx.getService('i18n') as II18nService;\n        } catch {\n            // Service not registered — handled below\n        }\n\n        // Collect translation bundles early to determine if we have data\n        const bundles: Array<Record<string, unknown>> = [];\n        if (Array.isArray(this.bundle.translations)) {\n            bundles.push(...this.bundle.translations);\n        }\n        const manifest = this.bundle.manifest || this.bundle;\n        if (manifest && Array.isArray(manifest.translations) && manifest.translations !== this.bundle.translations) {\n            bundles.push(...manifest.translations);\n        }\n\n        if (!i18nService) {\n            if (bundles.length > 0) {\n                // Auto-register the in-memory i18n fallback so the bundles\n                // we already loaded server-side become discoverable through\n                // `getService('i18n')` (used by the REST API to localize\n                // view / action / object metadata). Without this step,\n                // bundles authored in `defineStack({ translations })` were\n                // silently dropped on standalone/dev stacks that didn't\n                // explicitly install I18nServicePlugin.\n                try {\n                    const mod = await import('@objectstack/core');\n                    const createMemoryI18n = (mod as any).createMemoryI18n;\n                    if (typeof createMemoryI18n === 'function') {\n                        const fallback = createMemoryI18n();\n                        (ctx as any).registerService('i18n', fallback);\n                        i18nService = fallback;\n                        ctx.logger.info(\n                            `[i18n] Auto-registered in-memory i18n fallback for \"${appId}\" (${bundles.length} bundle(s) detected). ` +\n                            'Install I18nServicePlugin from @objectstack/service-i18n for file-based / production use.'\n                        );\n                    }\n                } catch (err: any) {\n                    ctx.logger.warn(\n                        `[i18n] App \"${appId}\" has ${bundles.length} translation bundle(s) but auto-fallback failed: ${err?.message ?? err}.`\n                    );\n                    return;\n                }\n                if (!i18nService) {\n                    ctx.logger.warn(\n                        `[i18n] App \"${appId}\" has ${bundles.length} translation bundle(s) but no i18n service is registered.`\n                    );\n                    return;\n                }\n            } else {\n                ctx.logger.debug('[i18n] No i18n service registered; skipping translation loading', { appId });\n                return;\n            }\n        }\n\n        // Apply i18n config (default locale, etc.)\n        const i18nConfig = this.bundle.i18n || (this.bundle.manifest || this.bundle)?.i18n;\n        if (i18nConfig?.defaultLocale && typeof i18nService.setDefaultLocale === 'function') {\n            i18nService.setDefaultLocale(i18nConfig.defaultLocale);\n            ctx.logger.debug('[i18n] Set default locale', { appId, locale: i18nConfig.defaultLocale });\n        }\n\n        if (bundles.length === 0) {\n            return;\n        }\n\n        let loadedLocales = 0;\n        for (const bundle of bundles) {\n            // Each bundle is a TranslationBundle: Record<locale, TranslationData>\n            for (const [locale, data] of Object.entries(bundle)) {\n                if (data && typeof data === 'object') {\n                    try {\n                        i18nService.loadTranslations(locale, data as Record<string, unknown>);\n                        loadedLocales++;\n                    } catch (err: any) {\n                        ctx.logger.warn('[i18n] Failed to load translations', { appId, locale, error: err.message });\n                    }\n                }\n            }\n        }\n\n        // Emit diagnostic when the active i18n service is a fallback/stub\n        const svcAny = i18nService as unknown as Record<string, unknown>;\n        if (svcAny._fallback || svcAny._dev) {\n            ctx.logger.info(\n                `[i18n] Loaded ${loadedLocales} locale(s) into in-memory i18n fallback for \"${appId}\". ` +\n                'For production, consider registering I18nServicePlugin from @objectstack/service-i18n.'\n            );\n        } else {\n            ctx.logger.info('[i18n] Loaded translation bundles', { appId, bundles: bundles.length, locales: loadedLocales });\n        }\n    }\n}\n\n// ─── Bundle hook & function collectors ──────────────────────────────\n// Hooks declared in `defineStack({ hooks })` end up at `bundle.hooks`;\n// some legacy bundles still nest them under `manifest.hooks`. We dedupe\n// (by reference) so the same array isn't bound twice when both shapes\n// happen to point at the same list.\n\n/** Collect declarative `Hook` definitions from a bundle (top-level + manifest). */\nexport function collectBundleHooks(bundle: any): any[] {\n    const out: any[] = [];\n    const seen = new Set<any>();\n    const push = (arr: any) => {\n        if (!Array.isArray(arr)) return;\n        for (const h of arr) {\n            if (h && !seen.has(h)) {\n                seen.add(h);\n                out.push(h);\n            }\n        }\n    };\n    push(bundle?.hooks);\n    push(bundle?.manifest?.hooks);\n    return out;\n}\n\n/**\n * Collect declarative actions from the bundle. Walks both root-level\n * `actions[]` and per-object `objects[*].actions[]`, attaching the parent\n * object name where applicable so `engine.registerAction(object, name, ...)`\n * sees the correct routing key.\n *\n * Each returned record is a shallow copy with `object` set when the action\n * originated under an object (and not already present on the action itself).\n */\nexport function collectBundleActions(\n    bundle: any,\n): Array<{ name: string; object?: string; body?: unknown; type?: string; [k: string]: unknown }> {\n    const out: any[] = [];\n    const seen = new Set<any>();\n    const push = (arr: any, parentObject?: string) => {\n        if (!Array.isArray(arr)) return;\n        for (const a of arr) {\n            if (!a || typeof a !== 'object' || typeof a.name !== 'string') continue;\n            if (seen.has(a)) continue;\n            seen.add(a);\n            const inferredObject =\n                typeof a.object === 'string' ? a.object\n                : typeof a.objectName === 'string' ? a.objectName\n                : parentObject;\n            out.push(inferredObject ? { ...a, object: inferredObject } : { ...a });\n        }\n    };\n    push(bundle?.actions);\n    push(bundle?.manifest?.actions);\n    if (Array.isArray(bundle?.objects)) {\n        for (const o of bundle.objects) push(o?.actions, o?.name);\n    }\n    if (Array.isArray(bundle?.manifest?.objects)) {\n        for (const o of bundle.manifest.objects) push(o?.actions, o?.name);\n    }\n    return out;\n}\n\n/**\n * Collect a name → handler map from `bundle.functions`. Accepted shapes:\n *\n *   - `{ functions: { foo: fn, bar: fn } }`           ← preferred map form\n *   - `{ functions: [{ name: 'foo', handler: fn }] }` ← array of records\n *\n * String-named hook handlers (`Hook.handler: 'foo'`) are resolved against\n * this map (and the engine's persistent function registry).\n */\nexport function collectBundleFunctions(bundle: any): Record<string, (ctx: any) => any> {\n    const out: Record<string, (ctx: any) => any> = {};\n    const merge = (src: any) => {\n        if (!src) return;\n        if (Array.isArray(src)) {\n            for (const item of src) {\n                if (item && typeof item.name === 'string' && typeof item.handler === 'function') {\n                    out[item.name] = item.handler;\n                }\n            }\n        } else if (typeof src === 'object') {\n            for (const [name, fn] of Object.entries(src)) {\n                if (typeof fn === 'function') out[name] = fn as any;\n            }\n        }\n    };\n    merge(bundle?.functions);\n    merge(bundle?.manifest?.functions);\n    return out;\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Platform SSO — shared between the cloud control-plane and the per-project\n * runtime kernels created by {@link ArtifactKernelFactory}.\n *\n * The architecture is \"Airtable-style unified login\": a builder signs in\n * once on `cloud.<root>` and is JIT-provisioned as a `sys_user` on every\n * per-project deployment (`<project>.<root>`) via the OAuth2 / OIDC\n * authorization-code flow.\n *\n *   - cloud  = OIDC Identity Provider (better-auth's `oauth-provider` plugin\n *              — already wired in {@link AuthPlugin} when `oidcProvider:true`)\n *   - project = OIDC Relying Party  (better-auth's `genericOAuth` plugin —\n *              opted in via the `oidcProviders` array on AuthPluginOptions)\n *\n * For the two sides to trust each other without runtime DB calls during\n * the SSO handshake, we use deterministic, derived client credentials:\n *\n *   - `client_id`     = `'project_' + environmentId`\n *   - `client_secret` = HMAC-SHA256(baseSecret, 'oauth-client:' + environmentId)\n *   - `redirect_uri`  = `https://<hostname>/api/v1/auth/oauth2/callback/<PROVIDER_ID>`\n *\n * Both cloud and project containers share the same `OS_AUTH_SECRET` (or\n * `AUTH_SECRET`) — that's the only piece of state required for the\n * project-side runtime to derive the right secret without a control-plane\n * lookup. The cloud-side row in `sys_oauth_application` is a one-time\n * write per project and is upserted in two places:\n *\n *   1. {@link seedPlatformSsoClient} — called from the project-provisioning\n *      flow in `http-dispatcher.ts` right after the `sys_environment` row is\n *      inserted, so brand-new projects can SSO from the very first request.\n *   2. {@link backfillPlatformSsoClients} — registered as a boot-time\n *      plugin in `control-plane-preset.ts` to retro-fit any pre-existing\n *      projects that were created before this code shipped.\n */\n\nimport { createHmac, createHash } from 'node:crypto';\n\n/**\n * Provider id used in better-auth's `genericOAuth` and as part of the\n * callback URL: `/api/v1/auth/oauth2/callback/<PROVIDER_ID>`. Keep stable —\n * changing it invalidates every registered redirect_uri.\n */\nexport const PLATFORM_SSO_PROVIDER_ID = 'objectstack-cloud';\n\n/**\n * Derive the per-project OAuth client_id used in `sys_oauth_application`\n * (cloud side) and {@link genericOAuth} config (project side).\n */\nexport function derivePlatformSsoClientId(environmentId: string): string {\n    return `project_${environmentId}`;\n}\n\n/**\n * Derive the per-project OAuth client_secret deterministically from the\n * shared master secret. HMAC-SHA256(baseSecret, 'oauth-client:' + environmentId)\n * yields a 64-char hex string that is:\n *   - stable across container cold-starts (no DB lookup needed)\n *   - independent per project (compromising one does not compromise others)\n *   - rotatable via OS_AUTH_SECRET rotation (invalidates all SSO clients)\n *\n * This is the **plaintext** value the RP must present at the token endpoint.\n * The cloud-side `sys_oauth_application.client_secret` column instead stores\n * {@link hashPlatformSsoClientSecret}(plaintext) — better-auth's oauth-provider\n * defaults to `storeClientSecret: 'hashed'` (SHA-256 + base64url) when the JWT\n * plugin is enabled, and looks up the row by hashing the presented secret.\n */\nexport function derivePlatformSsoClientSecret(baseSecret: string, environmentId: string): string {\n    return createHmac('sha256', baseSecret).update(`oauth-client:${environmentId}`).digest('hex');\n}\n\n/**\n * Hash the plaintext client_secret the same way `@better-auth/oauth-provider`'s\n * `defaultHasher` does it: SHA-256 → base64url (no padding). This MUST match\n * exactly or the token endpoint returns `invalid_client / invalid client_secret`\n * even though the row is present.\n *\n * Reference: `node_modules/@better-auth/oauth-provider/dist/utils-*.mjs` →\n *   `const defaultHasher = async (value) => base64Url.encode(SHA-256(value))`\n */\nexport function hashPlatformSsoClientSecret(plaintext: string): string {\n    return createHash('sha256').update(plaintext)\n        .digest('base64')\n        .replace(/=+$/, '')\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_');\n}\n\n/**\n * Build the redirect_uri better-auth's `genericOAuth` plugin will use\n * when the project kernel mounts the provider with id\n * {@link PLATFORM_SSO_PROVIDER_ID}. MUST be one of the URIs registered\n * on the cloud-side oauth client or the authorization server will reject\n * the callback with `invalid_request`.\n */\nexport function buildPlatformSsoRedirectUri(hostname: string, basePath: string = '/api/v1/auth'): string {\n    let host: string;\n    if (hostname.startsWith('http://') || hostname.startsWith('https://')) {\n        host = hostname;\n    } else if (/(\\.|^)localhost(:\\d+)?$/i.test(hostname)) {\n        // Local dev: localhost subdomains run on plain http with a custom\n        // port. When the caller passes only a hostname (no scheme/port),\n        // append the configured runtime port so the OAuth redirect_uri\n        // matches what the browser can actually reach. We read\n        // OS_RUNTIME_PORT (NOT PORT) because both the cloud control plane\n        // and the runtime container call this function — only the runtime\n        // port is meaningful for the callback.\n        const port = (process.env.OS_RUNTIME_PORT ?? '').trim();\n        const hostWithPort = /:\\d+$/.test(hostname) || !port ? hostname : `${hostname}:${port}`;\n        host = `http://${hostWithPort}`;\n    } else {\n        host = `https://${hostname}`;\n    }\n    const trimmed = host.replace(/\\/+$/, '');\n    const path = basePath.replace(/\\/+$/, '');\n    return `${trimmed}${path}/oauth2/callback/${PLATFORM_SSO_PROVIDER_ID}`;\n}\n\nexport interface SeedPlatformSsoClientOptions {\n    /**\n     * Cloud control-plane ObjectQL engine. Must expose `find(object, query)`,\n     * `insert(object, data)`, and `update(object, data, {where})`. Both the\n     * `apps/cloud` boot kernel (via `kernel.getService('objectql')`) and the\n     * dispatcher's local `ql` reference satisfy this shape.\n     */\n    ql: {\n        find: (object: string, query: any, opts?: any) => Promise<any>;\n        insert: (object: string, data: any, opts?: any) => Promise<any>;\n        update: (object: string, data: any, where: any, opts?: any) => Promise<any>;\n    };\n    /** Project id (also used to derive client_id + client_secret). */\n    environmentId: string;\n    /**\n     * Project hostname (e.g. `acme-crm.objectos.app`). Optional — projects\n     * may be created before a hostname is assigned, in which case no\n     * redirect_uri is registered yet and the row is upserted with an\n     * empty `redirect_uris` array. Calling this function again once the\n     * hostname is known will merge the new URI in.\n     */\n    hostname?: string | null;\n    /** Master secret shared between cloud and project containers. */\n    baseSecret: string;\n    /** Optional logger for diagnostics. */\n    logger?: { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };\n    /** When true, rethrow insert/update errors instead of swallowing them.\n     * Backfill uses this to surface real failures via the admin endpoint. */\n    throwOnError?: boolean;\n}\n\n/**\n * Idempotently upsert a `sys_oauth_application` row for the given project.\n * Re-running with the same `environmentId` is a no-op (the deterministic\n * `client_id` is uniquely indexed and the secret derivation is stable).\n * Re-running with a new `hostname` adds the new redirect_uri to the\n * existing row's JSON array.\n */\nexport async function seedPlatformSsoClient(opts: SeedPlatformSsoClientOptions): Promise<void> {\n    const { ql, environmentId, hostname, baseSecret, logger, throwOnError } = opts;\n    if (!baseSecret) {\n        logger?.warn?.('[platform-sso] OS_AUTH_SECRET not set — skipping client seed', { environmentId });\n        return;\n    }\n    const clientId = derivePlatformSsoClientId(environmentId);\n    const clientSecretPlaintext = derivePlatformSsoClientSecret(baseSecret, environmentId);\n    const clientSecretStored = hashPlatformSsoClientSecret(clientSecretPlaintext);\n    const desiredRedirect = hostname ? buildPlatformSsoRedirectUri(hostname) : null;\n\n    let existing: any = null;\n    try {\n        const rows = await ql.find('sys_oauth_application', {\n            where: { client_id: clientId },\n            limit: 1,\n        }, { context: { isSystem: true } });\n        const list = Array.isArray(rows) ? rows : Array.isArray((rows as any)?.records) ? (rows as any).records : [];\n        existing = list[0] ?? null;\n    } catch (err) {\n        // Table may not exist yet (control-plane not yet migrated). Treat\n        // as a no-op rather than crashing the project-create flow.\n        logger?.warn?.('[platform-sso] sys_oauth_application read failed — skipping seed', {\n            environmentId,\n            error: (err as Error)?.message,\n        });\n        return;\n    }\n\n    const nowIso = new Date().toISOString();\n    if (!existing) {\n        const redirects = desiredRedirect ? [desiredRedirect] : [];\n        try {\n            await ql.insert('sys_oauth_application', {\n                id: `oauthc_${environmentId}`,\n                name: `Project ${environmentId}`,\n                client_id: clientId,\n                client_secret: clientSecretStored,\n                type: 'web',\n                redirect_uris: JSON.stringify(redirects),\n                grant_types: JSON.stringify(['authorization_code', 'refresh_token']),\n                response_types: JSON.stringify(['code']),\n                scopes: JSON.stringify(['openid', 'email', 'profile']),\n                token_endpoint_auth_method: 'client_secret_basic',\n                require_pkce: false,\n                skip_consent: true,\n                disabled: false,\n                subject_type: 'public',\n                created_at: nowIso,\n                updated_at: nowIso,\n            }, { context: { isSystem: true } });\n            logger?.info?.('[platform-sso] sys_oauth_application row created', { environmentId, clientId });\n        } catch (err) {\n            // Unique-index conflict implies a parallel writer raced us; treat\n            // as success. Other errors are logged but non-fatal so they\n            // don't poison the project-create response.\n            logger?.warn?.('[platform-sso] sys_oauth_application create failed', {\n                environmentId,\n                error: (err as Error)?.message,\n            });\n            if (throwOnError) throw err;\n        }\n        return;\n    }\n\n    // Row exists — repair it. We always overwrite the canonical fields\n    // (client_secret, grant_types, response_types, scopes, token_endpoint_auth_method,\n    // require_pkce, skip_consent, subject_type, type, disabled) because older code\n    // paths may have written rows with missing or wrong-shape values, and\n    // re-running the seed should converge to the known-good shape.\n    // For redirect_uris we MERGE — re-provisioning a project under an\n    // additional hostname should add the new URI without dropping the old one.\n    let currentRedirects: string[] = [];\n    try {\n        const raw = existing.redirect_uris;\n        const parsed = typeof raw === 'string' ? JSON.parse(raw) : raw;\n        if (Array.isArray(parsed)) currentRedirects = parsed.filter((s): s is string => typeof s === 'string');\n    } catch { /* malformed JSON — treat as empty */ }\n    const mergedRedirects = desiredRedirect && !currentRedirects.includes(desiredRedirect)\n        ? [...currentRedirects, desiredRedirect]\n        : currentRedirects;\n\n    const repairPatch: Record<string, any> = {\n        name: existing.name || `Project ${environmentId}`,\n        client_secret: clientSecretStored,\n        type: existing.type || 'web',\n        redirect_uris: JSON.stringify(mergedRedirects),\n        grant_types: JSON.stringify(['authorization_code', 'refresh_token']),\n        response_types: JSON.stringify(['code']),\n        scopes: JSON.stringify(['openid', 'email', 'profile']),\n        token_endpoint_auth_method: 'client_secret_basic',\n        require_pkce: false,\n        skip_consent: true,\n        disabled: false,\n        subject_type: 'public',\n        updated_at: nowIso,\n    };\n    try {\n        await ql.update(\n            'sys_oauth_application',\n            repairPatch,\n            { where: { id: existing.id } },\n            { context: { isSystem: true } },\n        );\n        logger?.info?.('[platform-sso] sys_oauth_application repaired', {\n            environmentId,\n            clientId,\n            redirect_uris: mergedRedirects,\n        });\n    } catch (err) {\n        logger?.warn?.('[platform-sso] sys_oauth_application repair failed', {\n            environmentId,\n            error: (err as Error)?.message,\n        });\n        if (throwOnError) throw err;\n    }\n}\n\nexport interface BackfillPlatformSsoClientsOptions {\n    ql: SeedPlatformSsoClientOptions['ql'];\n    baseSecret: string;\n    logger?: { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };\n    /** Hard cap on rows scanned (default: 1000). */\n    limit?: number;\n}\n\n/**\n * Scan `sys_environment` and ensure every active project has a corresponding\n * `sys_oauth_application` row. Intended to run once at cloud boot — the\n * happy path is dominated by the project-create hook\n * ({@link seedPlatformSsoClient}); the backfill exists so projects\n * created before this feature shipped also get SSO support without an\n * out-of-band migration.\n */\nexport async function backfillPlatformSsoClients(opts: BackfillPlatformSsoClientsOptions): Promise<{\n    scanned: number;\n    seeded: number;\n    alreadyExisted: number;\n    failures: Array<{ environmentId: string; error: string }>;\n}> {\n    const { ql, baseSecret, logger, limit = 1000 } = opts;\n    if (!baseSecret) {\n        logger?.warn?.('[platform-sso] backfill skipped — OS_AUTH_SECRET not set');\n        return { scanned: 0, seeded: 0, alreadyExisted: 0, failures: [] };\n    }\n    let projects: any[] = [];\n    try {\n        const rows = await ql.find('sys_environment', {\n            limit,\n            fields: ['id', 'hostname', 'status'],\n        }, { context: { isSystem: true } });\n        projects = Array.isArray(rows) ? rows : Array.isArray((rows as any)?.records) ? (rows as any).records : [];\n    } catch (err) {\n        logger?.warn?.('[platform-sso] backfill: sys_environment read failed', {\n            error: (err as Error)?.message,\n        });\n        return { scanned: 0, seeded: 0, alreadyExisted: 0, failures: [{ environmentId: '<scan>', error: (err as Error)?.message ?? String(err) }] };\n    }\n    let seeded = 0;\n    let alreadyExisted = 0;\n    const failures: Array<{ environmentId: string; error: string }> = [];\n    for (const p of projects) {\n        if (!p?.id) continue;\n        const before = await (async () => {\n            try {\n                const r = await ql.find('sys_oauth_application', {\n                    where: { client_id: derivePlatformSsoClientId(p.id) },\n                    limit: 1,\n                }, { context: { isSystem: true } });\n                const list = Array.isArray(r) ? r : Array.isArray((r as any)?.records) ? (r as any).records : [];\n                return list[0] ?? null;\n            } catch { return null; }\n        })();\n        try {\n            await seedPlatformSsoClient({ ql, environmentId: p.id, hostname: p.hostname, baseSecret, logger, throwOnError: true });\n            if (before) alreadyExisted++;\n            else {\n                // Verify the row is actually readable post-insert.\n                const after = await (async () => {\n                    try {\n                        const r = await ql.find('sys_oauth_application', {\n                            where: { client_id: derivePlatformSsoClientId(p.id) },\n                            limit: 1,\n                        }, { context: { isSystem: true } });\n                        const list = Array.isArray(r) ? r : Array.isArray((r as any)?.records) ? (r as any).records : [];\n                        return list[0] ?? null;\n                    } catch (err) { return { _readErr: (err as Error)?.message }; }\n                })();\n                if (after && !(after as any)._readErr) seeded++;\n                else failures.push({ environmentId: p.id, error: `post-insert read returned ${after ? JSON.stringify(after) : 'null'}` });\n            }\n        } catch (err: any) {\n            failures.push({ environmentId: p.id, error: err?.message ?? String(err) });\n        }\n    }\n    logger?.info?.('[platform-sso] backfill complete', { scanned: projects.length, seeded, alreadyExisted, failures: failures.length });\n    return { scanned: projects.length, seeded, alreadyExisted, failures };\n}\n","/**\n * Pre-seed the OWNING cloud organization into a freshly-provisioned\n * project DB.\n *\n * Why this exists\n * ---------------\n * Every project at the cloud control plane is owned by exactly one\n * `sys_organization` (cloud-side). Without mirroring that org into the\n * project DB, the project would start empty and SecurityPlugin's\n * `ensureUserHasOrganization` middleware would auto-create a personal\n * \"Alice's Workspace\" for the project owner — completely disconnected\n * from the team workspace that owns the project at the platform level.\n *\n * Mirroring the owning org here makes the project's primary org match\n * the cloud team. Subsequent JIT-provisioned members of the same cloud\n * org get attached to this same row (Phase 2 — claim-driven by the SSO\n * callback).\n *\n * Idempotency\n * -----------\n * Keyed by the cloud `organization_id`. Re-runs across cold-boots are\n * safe no-ops; a row with that id either already exists or gets\n * inserted on the first boot of the project worker.\n */\n\nimport type { ObjectKernel } from '@objectstack/core';\n\nexport interface ProjectOrgSeed {\n    /** Cloud `sys_organization.id` of the project's owning org. Reused as the project-side `sys_organization.id` so cross-tier references stay consistent. */\n    id: string;\n    /** Display name copied from the cloud org. */\n    name: string;\n    /** URL slug copied from the cloud org. */\n    slug?: string | null;\n    /** Optional logo URL. */\n    logo?: string | null;\n}\n\nconst SYS_ORG = 'sys_organization';\n\n/**\n * Insert the project's owning organization into the project's\n * `sys_organization` table.\n *\n * Returns:\n *   - `'inserted'` — the row was newly seeded\n *   - `'exists'`   — a row with this id already existed (no-op)\n *   - `'skipped'`  — payload missing required fields (no-op)\n *   - `'error'`    — an unexpected failure; details logged via `logger.warn`\n *                     (we never throw — org seed is best-effort)\n */\nexport async function seedProjectOrganization(\n    kernel: ObjectKernel,\n    seed: ProjectOrgSeed,\n    logger?: { info?: (msg: string, ctx?: any) => void; warn?: (msg: string, ctx?: any) => void },\n): Promise<'inserted' | 'exists' | 'skipped' | 'error'> {\n    if (!seed?.id || !seed?.name) return 'skipped';\n\n    try {\n        const ql: any = kernel.getService('objectql');\n        if (!ql?.insert || !ql?.find) {\n            logger?.warn?.('[seedProjectOrganization] objectql service unavailable', { orgId: seed.id });\n            return 'skipped';\n        }\n\n        try {\n            const existing = await ql.find(SYS_ORG, { where: { id: seed.id } } as any);\n            const rows = Array.isArray(existing) ? existing : (existing?.value ?? []);\n            if (Array.isArray(rows) && rows.length > 0) return 'exists';\n        } catch {\n            // schema may not be fully synced on first cold-boot; fall\n            // through to insert — the DB layer will enforce uniqueness.\n        }\n\n        const nowIso = new Date().toISOString();\n        await ql.insert(SYS_ORG, {\n            id: seed.id,\n            name: seed.name,\n            slug: seed.slug ?? null,\n            logo: seed.logo ?? null,\n            metadata: null,\n            created_at: nowIso,\n        });\n\n        logger?.info?.('[seedProjectOrganization] org seeded', {\n            orgId: seed.id,\n            name: seed.name,\n        });\n        return 'inserted';\n    } catch (err: any) {\n        logger?.warn?.('[seedProjectOrganization] failed (non-fatal)', {\n            orgId: seed.id,\n            error: err?.message,\n        });\n        return 'error';\n    }\n}\n\n/**\n * Insert a `sys_member` row linking a user to an organization with a\n * given role. Idempotent on (user_id, organization_id).\n *\n * Used in tandem with `seedProjectOrganization` to bind the project\n * owner to the mirrored cloud org BEFORE SecurityPlugin's\n * `ensureUserHasOrganization` middleware would otherwise auto-create a\n * disjoint personal workspace.\n *\n * Returns the same status enum as the org/owner seed helpers.\n */\nexport async function seedProjectMember(\n    kernel: ObjectKernel,\n    args: {\n        userId: string;\n        organizationId: string;\n        role?: 'owner' | 'admin' | 'member';\n    },\n    logger?: { info?: (msg: string, ctx?: any) => void; warn?: (msg: string, ctx?: any) => void },\n): Promise<'inserted' | 'exists' | 'skipped' | 'error'> {\n    const { userId, organizationId } = args;\n    const role = args.role ?? 'member';\n    if (!userId || !organizationId) return 'skipped';\n\n    try {\n        const ql: any = kernel.getService('objectql');\n        if (!ql?.insert || !ql?.find) {\n            logger?.warn?.('[seedProjectMember] objectql service unavailable', { userId, organizationId });\n            return 'skipped';\n        }\n\n        try {\n            const existing = await ql.find('sys_member', {\n                where: { user_id: userId, organization_id: organizationId },\n            } as any);\n            const rows = Array.isArray(existing) ? existing : (existing?.value ?? []);\n            if (Array.isArray(rows) && rows.length > 0) return 'exists';\n        } catch {\n            // see comment in seedProjectOrganization\n        }\n\n        const nowIso = new Date().toISOString();\n        // sys_member's primary key is generated by the org plugin; we\n        // pre-generate a stable id of the form `mem_<short>` to match\n        // the existing convention in `ensureUserHasOrganization`.\n        const memId = `mem_${Math.random().toString(36).slice(2, 14)}`;\n        await ql.insert('sys_member', {\n            id: memId,\n            organization_id: organizationId,\n            user_id: userId,\n            role,\n            created_at: nowIso,\n        });\n\n        logger?.info?.('[seedProjectMember] member seeded', {\n            userId,\n            organizationId,\n            role,\n        });\n        return 'inserted';\n    } catch (err: any) {\n        logger?.warn?.('[seedProjectMember] failed (non-fatal)', {\n            userId,\n            organizationId,\n            error: err?.message,\n        });\n        return 'error';\n    }\n}\n","/**\n * Pre-seed the project owner into a freshly-provisioned project DB.\n *\n * Why this exists\n * ---------------\n * When a user creates a project on the cloud control plane, the project\n * gets a brand-new isolated database. On first access, the SSO callback\n * would otherwise treat the project owner as just another anonymous JIT\n * user — no admin role, no membership, no recognition that *this is the\n * person who owns this project*. The owner then has to manually promote\n * themselves via the org membership UI, which is friction the user does\n * not deserve to pay.\n *\n * Worse: better-auth's `accountLinking` safety check rejects implicit\n * link of an unverified local row with an unverified OAuth identity\n * (`error=account_not_linked`). Pre-seeding with `emailVerified: true`\n * (cloud already verified them upstream) makes the link clean.\n *\n * Idempotency\n * -----------\n * The seed is keyed by the cloud `userId`. If a `sys_user` row with that\n * id already exists in the project DB, this is a no-op — safe to call\n * on every cold-boot. SecurityPlugin's `sys_user` insert middleware\n * (mounted by ArtifactKernelFactory) auto-creates the personal\n * organization + `sys_member(owner)` binding as a side effect of the\n * insert, so callers do not need to wire membership themselves.\n */\n\nimport type { ObjectKernel } from '@objectstack/core';\n\nexport interface ProjectOwnerSeed {\n    /** Cloud `sys_user.id` of the project creator. Used as the project-side `sys_user.id` so SSO callbacks link by id, not by email-match. */\n    userId: string;\n    /** Verified email at cloud — copied here so the link check passes without a project-side verification flow. */\n    email: string;\n    /** Display name; nullable to tolerate users who never set one. */\n    name?: string | null;\n    /** Avatar URL; nullable. */\n    image?: string | null;\n}\n\nconst SYS_USER = 'sys_user';\n\n/**\n * Insert the project owner into the project's `sys_user` table.\n *\n * Returns:\n *   - `'inserted'` — the row was newly seeded\n *   - `'exists'`   — a row with this id already existed (no-op)\n *   - `'skipped'`  — payload missing required fields (no-op)\n *   - `'error'`    — an unexpected failure; details logged via `logger.warn`\n *                     (we never throw — owner seed is best-effort)\n */\nexport async function seedProjectOwner(\n    kernel: ObjectKernel,\n    seed: ProjectOwnerSeed,\n    logger?: { info?: (msg: string, ctx?: any) => void; warn?: (msg: string, ctx?: any) => void },\n): Promise<'inserted' | 'exists' | 'skipped' | 'error'> {\n    if (!seed?.userId || !seed?.email) return 'skipped';\n\n    try {\n        const ql: any = kernel.getService('objectql');\n        if (!ql?.insert || !ql?.find) {\n            logger?.warn?.('[seedProjectOwner] objectql service unavailable', { userId: seed.userId });\n            return 'skipped';\n        }\n\n        // Idempotency check: bail if the owner is already present. We key\n        // off `id` (not email) so re-runs are safe even if the user later\n        // changes their cloud email.\n        try {\n            const existing = await ql.find(SYS_USER, { where: { id: seed.userId } } as any);\n            const rows = Array.isArray(existing) ? existing : (existing?.value ?? []);\n            if (Array.isArray(rows) && rows.length > 0) return 'exists';\n        } catch {\n            // `find` may legitimately fail on cold-start before the schema\n            // is fully synced. Fall through to the insert — uniqueness will\n            // also be enforced at the DB layer.\n        }\n\n        const nowIso = new Date().toISOString();\n        await ql.insert(SYS_USER, {\n            id: seed.userId,\n            email: seed.email,\n            name: seed.name ?? seed.email.split('@')[0] ?? 'Owner',\n            image: seed.image ?? null,\n            // Cloud already verified the upstream email. Marking it verified\n            // here is what unblocks better-auth's accountLinking check on\n            // the first SSO callback (alongside the trustedProviders config\n            // in plugin-auth/auth-manager.ts).\n            email_verified: true,\n            created_at: nowIso,\n            updated_at: nowIso,\n        });\n\n        logger?.info?.('[seedProjectOwner] owner seeded', {\n            userId: seed.userId,\n            email: seed.email,\n        });\n        return 'inserted';\n    } catch (err: any) {\n        // Common benign cases: race with another cold-boot, or unique\n        // constraint violation if two requests interleave. Log + swallow.\n        logger?.warn?.('[seedProjectOwner] failed (non-fatal)', {\n            userId: seed.userId,\n            error: err?.message,\n        });\n        return 'error';\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n// Export Kernels\nexport { ObjectKernel } from '@objectstack/core';\n\n// Export Runtime\nexport { Runtime } from './runtime.js';\nexport type { RuntimeConfig } from './runtime.js';\n\n// Export Standalone Stack\nexport { createStandaloneStack } from './standalone-stack.js';\nexport type { StandaloneStackConfig, StandaloneStackResult } from './standalone-stack.js';\n\n// Export Default Host (artifact-first, no objectstack.config.ts required)\nexport { createDefaultHostConfig, resolveDefaultArtifactPath } from './default-host.js';\nexport type { DefaultHostConfigOptions, DefaultHostConfigResult } from './default-host.js';\n\n// Export Plugins\nexport { DriverPlugin } from './driver-plugin.js';\nexport { AppPlugin, collectBundleHooks, collectBundleFunctions, collectBundleActions } from './app-plugin.js';\nexport { SeedLoaderService } from './seed-loader.js';\nexport { createDispatcherPlugin } from './dispatcher-plugin.js';\nexport type { DispatcherPluginConfig } from './dispatcher-plugin.js';\nexport { createSystemEnvironmentPlugin, SYSTEM_ENVIRONMENT_ID } from './system-environment-plugin.js';\nexport type { SystemEnvironmentPluginConfig } from './system-environment-plugin.js';\n\n// Export HTTP Server Components\nexport { HttpServer } from './http-server.js';\nexport { HttpDispatcher } from './http-dispatcher.js';\nexport type { HttpProtocolContext, HttpDispatcherResult } from './http-dispatcher.js';\nexport { MiddlewareManager } from './middleware.js';\n\n// ── Security primitives ───────────────────────────────────────────────\n// Adapter-agnostic helpers for response hardening (CSP/HSTS/XCTO/…)\n// and per-IP token-bucket rate limiting. The dispatcher plugin wires\n// security headers automatically; rate limiting is exposed as a\n// primitive so adapters can mount it at the appropriate layer (see\n// `docs/guide/hardening.md`).\nexport {\n    buildSecurityHeaders,\n    type SecurityHeadersOptions,\n    RateLimiter,\n    DEFAULT_RATE_LIMITS,\n    type RateLimitBucketConfig,\n    type RateLimitDecision,\n    type RateLimitDefaults,\n    type RateLimitStore,\n} from './security/index.js';\n\n// ── Observability primitives ──────────────────────────────────────────\n// Request-id propagation (X-Request-Id + W3C traceparent), pluggable\n// MetricsRegistry, and pluggable ErrorReporter. The dispatcher plugin\n// wraps every route with instrumentation when these are configured;\n// see `docs/guide/observability.md`.\nexport {\n    extractRequestId,\n    generateRequestId,\n    resolveRequestId,\n    parseTraceparent,\n    formatTraceparent,\n    type TraceContext,\n    NoopMetricsRegistry,\n    InMemoryMetricsRegistry,\n    RUNTIME_METRICS,\n    type MetricsRegistry,\n    type MetricSample,\n    NoopErrorReporter,\n    InMemoryErrorReporter,\n    type ErrorReporter,\n    type CapturedError,\n    ObservabilityServicePlugin,\n    OBSERVABILITY_METRICS_SERVICE,\n    OBSERVABILITY_ERRORS_SERVICE,\n    resolveMetrics,\n    resolveErrorReporter,\n    type ObservabilityServicePluginOptions,\n} from './observability/index.js';\n\n// Export Artifact Loader\nexport { loadArtifactBundle, mergeRuntimeModule, isHttpUrl, readArtifactSource } from './load-artifact-bundle.js';\nexport type { LoadArtifactBundleOptions } from './load-artifact-bundle.js';\n\n// ── ObjectOS Cloud Runtime (artifact-fetching shared multi-tenant host) ───────\n// Boot a host process that resolves incoming hostnames to projects and\n// dispatches every request to the matching per-project ObjectKernel. The\n// artifact is fetched either from an HTTP control plane (apps/cloud or\n// the hosted ObjectStack Cloud) or from a local JSON file for single-\n// project dev workflows. See `cloud/objectos-stack.ts`.\nexport { createObjectOSStack } from './cloud/objectos-stack.js';\nexport type { ObjectOSStackConfig, ObjectOSStackResult } from './cloud/objectos-stack.js';\nexport { MarketplaceProxyPlugin } from './cloud/marketplace-proxy-plugin.js';\nexport type { MarketplaceProxyPluginConfig } from './cloud/marketplace-proxy-plugin.js';\nexport { MarketplaceInstallLocalPlugin } from './cloud/marketplace-install-local-plugin.js';\nexport type { MarketplaceInstallLocalPluginConfig } from './cloud/marketplace-install-local-plugin.js';\nexport { DEFAULT_CLOUD_URL, resolveCloudUrl } from './cloud/cloud-url.js';\nexport { ArtifactApiClient } from './cloud/artifact-api-client.js';\nexport type {\n    ArtifactApiClientConfig,\n    EnvironmentArtifactResponse,\n    EnvironmentRuntimeConfig,\n    ResolvedHostname,\n} from './cloud/artifact-api-client.js';\nexport { FileArtifactApiClient } from './cloud/file-artifact-api-client.js';\nexport type { FileArtifactApiClientConfig } from './cloud/file-artifact-api-client.js';\nexport { ArtifactEnvironmentRegistry } from './cloud/artifact-environment-registry.js';\nexport type { ArtifactEnvironmentRegistryConfig } from './cloud/artifact-environment-registry.js';\nexport { ArtifactKernelFactory } from './cloud/artifact-kernel-factory.js';\nexport type { ArtifactKernelFactoryConfig } from './cloud/artifact-kernel-factory.js';\nexport { AuthProxyPlugin } from './cloud/auth-proxy-plugin.js';\nexport { KernelManager } from './cloud/kernel-manager.js';\nexport type { EnvironmentKernelFactory, KernelManagerConfig } from './cloud/kernel-manager.js';\nexport type { EnvironmentDriverRegistry } from './cloud/environment-registry.js';\nexport {\n  PLATFORM_SSO_PROVIDER_ID,\n  derivePlatformSsoClientId,\n  derivePlatformSsoClientSecret,\n  buildPlatformSsoRedirectUri,\n  seedPlatformSsoClient,\n  backfillPlatformSsoClients,\n} from './cloud/platform-sso.js';\nexport type {\n  SeedPlatformSsoClientOptions,\n  BackfillPlatformSsoClientsOptions,\n} from './cloud/platform-sso.js';\n\n// Export Sandbox (script body runner) — engine choice is quickjs-emscripten.\n// See packages/runtime/src/sandbox/script-runner.ts for the decision rationale.\nexport { UnimplementedScriptRunner, QuickJSScriptRunner, SandboxError, hookBodyRunnerFactory, actionBodyRunnerFactory } from './sandbox/index.js';\nexport type {\n  ScriptRunner,\n  ScriptContext,\n  ScriptOrigin,\n  ScriptResult,\n  ScriptRunOptions,\n  QuickJSScriptRunnerOptions,\n} from './sandbox/index.js';\n\n// Re-export from @objectstack/rest\nexport {\n    RestServer,\n    RouteManager,\n    RouteGroupBuilder,\n    createRestApiPlugin,\n} from '@objectstack/rest';\nexport type {\n    RouteEntry,\n    RestApiPluginConfig,\n} from '@objectstack/rest';\n\n// Export Types\nexport * from '@objectstack/core';\n\n\n\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectKernel, Plugin, IHttpServer, ObjectKernelConfig } from '@objectstack/core';\nimport {\n    ClusterServicePlugin,\n    MetadataClusterBridgePlugin,\n    type ClusterServicePluginOptions,\n} from '@objectstack/service-cluster';\nimport type { ClusterCapabilityConfigInput } from '@objectstack/spec/kernel';\n\nexport interface RuntimeConfig {\n    /**\n     * Optional existing server instance (e.g. Hono, Express app)\n     * If provided, Runtime will use it as the 'http.server' service.\n     * If not provided, Runtime expects a server plugin (like HonoServerPlugin) to be registered manually.\n     */\n    server?: IHttpServer;\n\n    /**\n     * Kernel Configuration\n     */\n    kernel?: ObjectKernelConfig;\n\n    /**\n     * Cluster service configuration.\n     *\n     * - Omit (default): a single-node `memory` cluster is auto-registered.\n     * - `false`: skip auto-registration entirely. Register your own\n     *   `ClusterServicePlugin` if you need it later.\n     * - `ClusterCapabilityConfigInput`: forwarded to `defineCluster()`.\n     * - `{ cluster: IClusterService }`: bring your own instance.\n     *\n     * See `content/docs/concepts/cluster-semantics.mdx` for driver options.\n     */\n    cluster?: false | ClusterCapabilityConfigInput | ClusterServicePluginOptions;\n}\n\n/**\n * ObjectStack Runtime\n * \n * High-level entry point for bootstrapping an ObjectStack application.\n * Wraps ObjectKernel and provides standard orchestration for:\n * - HTTP Server binding\n * - Plugin Management\n * \n * REST API is opt-in — register it explicitly:\n * ```ts\n * import { createRestApiPlugin } from '@objectstack/rest';\n * runtime.use(createRestApiPlugin());\n * ```\n */\nexport class Runtime {\n    readonly kernel: ObjectKernel;\n    \n    constructor(config: RuntimeConfig = {}) {\n        this.kernel = new ObjectKernel(config.kernel);\n        \n        // If external server provided, register it immediately\n        if (config.server) {\n             this.kernel.registerService('http.server', config.server);\n        }\n\n        // Auto-register cluster service (memory driver by default) unless\n        // explicitly opted out. Plugins resolve it via\n        // `ctx.getService<IClusterService>('cluster')`.\n        if (config.cluster !== false) {\n            const opts = this.normalizeClusterOptions(config.cluster);\n            this.kernel.use(new ClusterServicePlugin(opts));\n            // Bridge metadata cache invalidation across nodes. Late-binds\n            // via kernel:ready so it picks up a metadata service whether\n            // it's registered by a plugin or directly.\n            this.kernel.use(new MetadataClusterBridgePlugin());\n        }\n    }\n\n    private normalizeClusterOptions(\n        raw: RuntimeConfig['cluster'],\n    ): ClusterServicePluginOptions {\n        if (!raw) return {};\n        // Discriminate by shape: presence of `cluster` (instance) or\n        // explicit `config` key means it's already an options bag.\n        if (\n            typeof raw === 'object' &&\n            ('cluster' in raw || 'config' in raw) &&\n            !('driver' in raw)\n        ) {\n            return raw as ClusterServicePluginOptions;\n        }\n        // Otherwise treat as `ClusterCapabilityConfigInput`.\n        return { config: raw as ClusterCapabilityConfigInput };\n    }\n    \n    /**\n     * Register a plugin\n     */\n    use(plugin: Plugin) {\n        this.kernel.use(plugin);\n        return this;\n    }\n    \n    /**\n     * Start the runtime\n     * 1. Initializes all plugins (init phase)\n     * 2. Starts all plugins (start phase)\n     */\n    async start() {\n        await this.kernel.bootstrap();\n        return this;\n    }\n    \n    /**\n     * Get the kernel instance\n     */\n    getKernel() {\n        return this.kernel;\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Standalone (runtime-only) stack factory.\n *\n * Builds the minimal plugin list for embedding ObjectStack in another\n * framework: ObjectQL + Driver + Metadata, plus AppPlugin if a compiled\n * artifact is available. No authentication, no Studio data, no control\n * plane — REST routes are served unauthenticated.\n *\n * Auto-detects the appropriate driver from the database URL scheme:\n *   - `memory://*`              → InMemoryDriver\n *   - `libsql://`, `https://`   → TursoDriver\n *   - `postgres[ql]://`, `pg://` → SqlDriver (pg)\n *   - `mongodb[+srv]://`        → MongoDBDriver (peer-dep `@objectstack/driver-mongodb`)\n *   - `file:` / no scheme       → SqlDriver (better-sqlite3)\n *\n * Unknown URL schemes throw — we never silently fall back to sqlite, since\n * that historically created bogus directories on disk (e.g. `mongodb:/`)\n * when an unsupported URL was treated as a file path.\n */\n\nimport { resolve as resolvePath } from 'node:path';\nimport { mkdirSync } from 'node:fs';\nimport { z } from 'zod';\nimport { loadArtifactBundle, isHttpUrl } from './load-artifact-bundle.js';\n\nexport const StandaloneStackConfigSchema = z.object({\n    databaseUrl: z.string().optional(),\n    databaseAuthToken: z.string().optional(),\n    databaseDriver: z.enum(['sqlite', 'sqlite-wasm', 'turso', 'memory', 'postgres', 'mongodb']).optional(),\n    environmentId: z.string().optional(),\n    artifactPath: z.string().optional(),\n});\n\nexport type StandaloneStackConfig = z.input<typeof StandaloneStackConfigSchema>;\n\nexport interface StandaloneStackResult {\n    plugins: any[];\n    api: { enableProjectScoping: false; projectResolution: 'none' };\n    /**\n     * Top-level metadata copied from the loaded artifact bundle (when an\n     * artifact was successfully loaded). These are surfaced so callers\n     * that wrap this result as a `defineStack()`-shaped config (e.g. the\n     * CLI's `serve` command without a host `objectstack.config.ts`) can\n     * still drive tier resolution, capability detection and driver\n     * auto-registration off the artifact's declarations.\n     */\n    requires?: string[];\n    objects?: any[];\n    manifest?: any;\n}\n\ntype ResolvedDriverKind = 'memory' | 'turso' | 'postgres' | 'mongodb' | 'sqlite' | 'sqlite-wasm';\n\nfunction detectDriverFromUrl(dbUrl: string): ResolvedDriverKind {\n    if (/^memory:\\/\\//i.test(dbUrl)) return 'memory';\n    if (/^(libsql|https?):\\/\\//i.test(dbUrl)) return 'turso';\n    if (/^(postgres(ql)?|pg):\\/\\//i.test(dbUrl)) return 'postgres';\n    if (/^mongodb(\\+srv)?:\\/\\//i.test(dbUrl)) return 'mongodb';\n    if (/^wasm-sqlite:\\/\\//i.test(dbUrl)) return 'sqlite-wasm';\n    if (/\\.wasm\\.db$/i.test(dbUrl)) return 'sqlite-wasm';\n    if (/^file:/i.test(dbUrl)) return 'sqlite';\n    // Bare path without a scheme — treat as a sqlite file path.\n    if (!/^[a-z][a-z0-9+.-]*:\\/\\//i.test(dbUrl)) return 'sqlite';\n    throw new Error(\n        `[StandaloneStack] Unsupported database URL scheme: ${dbUrl}. ` +\n        `Supported schemes: memory://, libsql://, https://, postgres://, pg://, mongodb://, mongodb+srv://, file:`\n    );\n}\n\nexport async function createStandaloneStack(config?: StandaloneStackConfig): Promise<StandaloneStackResult> {\n    const cfg = StandaloneStackConfigSchema.parse(config ?? {});\n\n    const { ObjectQLPlugin } = await import('@objectstack/objectql');\n    const { MetadataPlugin } = await import('@objectstack/metadata');\n    const { DriverPlugin } = await import('./driver-plugin.js');\n    const { AppPlugin } = await import('./app-plugin.js');\n\n    const cwd = process.cwd();\n    const environmentId = cfg.environmentId ?? process.env.OS_ENVIRONMENT_ID ?? 'proj_local';\n    const artifactPathInput = cfg.artifactPath\n        ?? process.env.OS_ARTIFACT_PATH\n        ?? resolvePath(cwd, 'dist/objectstack.json');\n    const artifactPath = isHttpUrl(artifactPathInput)\n        ? artifactPathInput\n        : (artifactPathInput.startsWith('/')\n            ? artifactPathInput\n            : resolvePath(cwd, artifactPathInput));\n\n    const dbUrl = cfg.databaseUrl\n        ?? process.env.OS_DATABASE_URL?.trim()\n        ?? process.env.TURSO_DATABASE_URL?.trim()\n        ?? `file:${resolvePath(cwd, '.objectstack/data/standalone.db')}`;\n    const dbAuthToken = cfg.databaseAuthToken\n        ?? process.env.OS_DATABASE_AUTH_TOKEN?.trim()\n        ?? process.env.TURSO_AUTH_TOKEN?.trim();\n    const explicitDriver = cfg.databaseDriver\n        ?? (process.env.OS_DATABASE_DRIVER?.trim() as ResolvedDriverKind | undefined);\n    const dbDriver: ResolvedDriverKind = explicitDriver ?? detectDriverFromUrl(dbUrl);\n\n    let driverPlugin: any;\n    if (dbDriver === 'memory') {\n        const { InMemoryDriver } = await import('@objectstack/driver-memory');\n        driverPlugin = new DriverPlugin(new InMemoryDriver());\n    } else if (dbDriver === 'turso') {\n        const { TursoDriver } = await import('@objectstack/driver-turso');\n        driverPlugin = new DriverPlugin(\n            new TursoDriver({ url: dbUrl, authToken: dbAuthToken }) as any,\n        );\n    } else if (dbDriver === 'postgres') {\n        const { SqlDriver } = await import('@objectstack/driver-sql');\n        driverPlugin = new DriverPlugin(\n            new SqlDriver({\n                client: 'pg',\n                connection: dbUrl,\n                pool: { min: 0, max: 5 },\n            }) as any,\n        );\n    } else if (dbDriver === 'mongodb') {\n        // MongoDB driver is an optional peer dependency. Importing it lazily\n        // avoids forcing every standalone consumer to install the mongo SDK.\n        let MongoDBDriver: any;\n        try {\n            ({ MongoDBDriver } = await import('@objectstack/driver-mongodb' as any));\n        } catch (err: any) {\n            throw new Error(\n                `[StandaloneStack] mongodb URL detected but @objectstack/driver-mongodb is not installed. ` +\n                `Add it as a dependency or pass an explicit driverPlugin. (${err?.message ?? err})`\n            );\n        }\n        driverPlugin = new DriverPlugin(new MongoDBDriver({ url: dbUrl }) as any);\n    } else if (dbDriver === 'sqlite-wasm') {\n        const { SqliteWasmDriver } = await import('@objectstack/driver-sqlite-wasm' as any);\n        const filename = dbUrl\n            .replace(/^wasm-sqlite:(\\/\\/)?/i, '')\n            .replace(/^file:(\\/\\/)?/i, '');\n        if (filename && filename !== ':memory:') {\n            mkdirSync(resolvePath(filename, '..'), { recursive: true });\n        }\n        driverPlugin = new DriverPlugin(\n            new SqliteWasmDriver({\n                filename: filename || ':memory:',\n                persist: filename && filename !== ':memory:' ? 'on-write' : undefined,\n            }) as any,\n        );\n    } else {\n        // sqlite\n        const { SqlDriver } = await import('@objectstack/driver-sql');\n        const filename = dbUrl.replace(/^file:(\\/\\/)?/, '');\n        if (!filename || /^[a-z][a-z0-9+.-]*:\\/\\//i.test(filename)) {\n            throw new Error(\n                `[StandaloneStack] sqlite driver was selected but the URL does not look like a file path: \"${dbUrl}\". ` +\n                `Use file:/path/to/db.sqlite, or set OS_DATABASE_DRIVER explicitly.`\n            );\n        }\n        mkdirSync(resolvePath(filename, '..'), { recursive: true });\n        driverPlugin = new DriverPlugin(\n            new SqlDriver({\n                client: 'better-sqlite3',\n                connection: { filename },\n                useNullAsDefault: true,\n            }),\n        );\n    }\n\n    const artifactBundle = await loadArtifactBundle(artifactPath, {\n        tag: '[StandaloneStack]',\n        unwrapEnvelope: true,\n    });\n    if (artifactBundle) {\n        const flowsCount = Array.isArray(artifactBundle?.flows) ? artifactBundle.flows.length : 'n/a';\n        // eslint-disable-next-line no-console\n        console.warn(\n            `[StandaloneStack] artifact loaded: path=${artifactPath} keys=${Object.keys(artifactBundle).join(',')} flows=${flowsCount}`,\n        );\n    }\n\n    const plugins: any[] = [\n        driverPlugin,\n        new MetadataPlugin({\n            // Source-file scanner OFF — declarative metadata is loaded\n            // from the compiled artifact, not from yaml/json files on\n            // disk. Scanning would also recursively watch the project\n            // root (incl. node_modules), which is expensive and prone\n            // to EMFILE.\n            watch: false,\n            // Artifact-file HMR ON in non-production so edits to\n            // `*.view.ts` / `*.flow.ts` (which the CLI dev-mode watcher\n            // recompiles into `dist/objectstack.json`) are picked up by\n            // the running server WITHOUT requiring a manual restart.\n            // Uses polling under the hood (see plugin.ts) to avoid\n            // `fs.watch` EMFILE on macOS / busy dev hosts.\n            artifactWatch: process.env.NODE_ENV !== 'production',\n            environmentId,\n            artifactSource: { mode: 'local-file', path: artifactPath },\n        }),\n        new ObjectQLPlugin({ environmentId }),\n    ];\n    if (artifactBundle) plugins.push(new AppPlugin(artifactBundle));\n\n    // Surface artifact-declared metadata so a caller using this result\n    // directly as a `defineStack()`-shaped config (no host\n    // `objectstack.config.ts`) can still drive CLI tier resolution\n    // and driver auto-registration. We copy *references* — no clone — so\n    // the caller can `{ ...originalConfig, ...standaloneStack }` without\n    // double-merging large object arrays.\n    const requires: string[] | undefined =\n        Array.isArray(artifactBundle?.requires)\n            ? (artifactBundle.requires.filter((c: unknown) => typeof c === 'string') as string[])\n            : undefined;\n    const objects: any[] | undefined =\n        Array.isArray(artifactBundle?.objects) ? artifactBundle.objects : undefined;\n    const manifest: any | undefined = artifactBundle?.manifest;\n\n    return {\n        plugins,\n        api: {\n            enableProjectScoping: false,\n            projectResolution: 'none',\n        },\n        ...(requires ? { requires } : {}),\n        ...(objects ? { objects } : {}),\n        ...(manifest ? { manifest } : {}),\n    };\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Default host config — built-in fallback used by `objectstack start`\n * (and `objectstack serve`) when the project does NOT ship an explicit\n * `objectstack.config.ts`.\n *\n * Goal: an `objectstack build` artifact (`dist/objectstack.json`) is\n * fully self-describing — it carries the manifest, objects, views,\n * flows and a `requires: [...]` capability list. That should be enough\n * to boot a runtime, with zero hand-written host code.\n *\n * Boot mode: **standalone only**. This module intentionally does NOT\n * depend on `@objectstack/service-cloud`. Cloud / multi-environment hosts\n * still write their own `objectstack.config.ts` (see\n * `apps/objectos/objectstack.config.ts`).\n *\n * Resolution order for the artifact path:\n *   1. `options.artifactPath` (explicit caller override)\n *   2. `OS_ARTIFACT_PATH` env var (file path **or** `http(s)://` URL)\n *   3. `<cwd>/dist/objectstack.json`\n *\n * The returned object is shaped like the result of `defineStack()` —\n * `{ plugins, api, requires, objects, manifest }` — so the CLI can use\n * it interchangeably with a user-authored stack config.\n */\n\nimport { resolve as resolvePath } from 'node:path';\nimport { existsSync } from 'node:fs';\nimport { createStandaloneStack, type StandaloneStackConfig, type StandaloneStackResult } from './standalone-stack.js';\nimport { isHttpUrl } from './load-artifact-bundle.js';\n\nexport interface DefaultHostConfigOptions extends StandaloneStackConfig {\n    /**\n     * When true (the default), throws if no artifact source can be\n     * resolved (no explicit `artifactPath`, no `OS_ARTIFACT_PATH` env,\n     * and `<cwd>/dist/objectstack.json` does not exist).\n     *\n     * Set to false to allow booting an empty kernel — useful for tests\n     * that want to assemble plugins manually after the stack is built.\n     */\n    requireArtifact?: boolean;\n}\n\nexport type DefaultHostConfigResult = StandaloneStackResult;\n\n/**\n * Resolve the artifact source for a default-host boot.\n *\n * Returns the explicit override, then `OS_ARTIFACT_PATH`, then the\n * canonical `<cwd>/dist/objectstack.json` if it exists on disk.\n * Returns `undefined` if none of these are available.\n *\n * URLs (`http(s)://`) are returned as-is — they are validated lazily by\n * the loader, since we cannot stat a remote resource cheaply.\n */\nexport function resolveDefaultArtifactPath(\n    explicitPath?: string,\n    cwd: string = process.cwd(),\n): string | undefined {\n    const candidate = explicitPath\n        ?? process.env.OS_ARTIFACT_PATH\n        ?? resolvePath(cwd, 'dist/objectstack.json');\n\n    if (isHttpUrl(candidate)) return candidate;\n    if (explicitPath || process.env.OS_ARTIFACT_PATH) return candidate;\n    return existsSync(candidate) ? candidate : undefined;\n}\n\n/**\n * Build a `defineStack()`-shaped config from an `objectstack build`\n * artifact, with no `objectstack.config.ts` required.\n *\n * @example\n *   // packages/cli/src/commands/serve.ts\n *   if (!fs.existsSync(absolutePath)) {\n *       config = await createDefaultHostConfig();\n *   }\n */\nexport async function createDefaultHostConfig(\n    options: DefaultHostConfigOptions = {},\n): Promise<DefaultHostConfigResult> {\n    const { requireArtifact = true, ...standaloneOpts } = options;\n\n    const resolvedArtifact = resolveDefaultArtifactPath(standaloneOpts.artifactPath);\n    if (!resolvedArtifact && requireArtifact) {\n        throw new Error(\n            '[createDefaultHostConfig] No artifact source available. ' +\n            'Set OS_ARTIFACT_PATH (file path or http(s):// URL), ' +\n            'place the artifact at <cwd>/dist/objectstack.json, ' +\n            'or pass `{ artifactPath: ... }` explicitly. ' +\n            'To boot an empty kernel anyway, pass `{ requireArtifact: false }`.',\n        );\n    }\n\n    return createStandaloneStack({\n        ...standaloneOpts,\n        artifactPath: resolvedArtifact,\n    });\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectKernel, getEnv, resolveLocale } from '@objectstack/core';\nimport { CoreServiceName } from '@objectstack/spec/system';\nimport { pluralToSingular } from '@objectstack/spec/shared';\nimport type { ExecutionContext } from '@objectstack/spec/kernel';\nimport type { KernelManager } from './cloud/kernel-manager.js';\n\n/** Minimal local interface — full EnvironmentScopeManager was removed in Phase R. */\ninterface EnvironmentScopeManager {\n    touch(environmentId: string): void;\n}\nimport {\n    resolveExecutionContext,\n    isPermissionDeniedError,\n} from './security/resolve-execution-context.js';\n\n/** Browser-safe UUID generator — prefers Web Crypto, falls back to RFC 4122 v4 */\nfunction randomUUID(): string {\n    if (globalThis.crypto && typeof globalThis.crypto.randomUUID === 'function') {\n        return globalThis.crypto.randomUUID();\n    }\n    return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, c => {\n        const r = (Math.random() * 16) | 0;\n        const v = c === 'x' ? r : (r & 0x3) | 0x8;\n        return v.toString(16);\n    });\n}\n\nexport interface HttpProtocolContext {\n    request: any;\n    response?: any;\n    environmentId?: string;   // Resolved environment ID\n    dataDriver?: any; // IDataDriver - Resolved environment-scoped driver\n    /**\n     * Identity envelope resolved by `resolveExecutionContext` and threaded\n     * into every ObjectQL call so the SecurityPlugin middleware can apply\n     * RBAC/RLS/FLS. Optional — anonymous requests carry an empty context.\n     */\n    executionContext?: ExecutionContext;\n}\n\nexport interface HttpDispatcherResult {\n    handled: boolean;\n    response?: {\n        status: number;\n        body?: any;\n        headers?: Record<string, string>;\n    };\n    result?: any; // For flexible return types or direct response objects (Response/NextResponse)\n}\n\n/**\n * Optional configuration passed to the dispatcher constructor. Supports the\n * legacy `enforceProjectMembership` toggle plus the new multi-kernel\n * scheduling hook required by ADR-0003's cloud runtime mode.\n */\nexport interface HttpDispatcherOptions {\n    enforceProjectMembership?: boolean;\n    /**\n     * Optional {@link KernelManager}. When present, the dispatcher resolves\n     * `context.environmentId` first and then routes the request against the\n     * project's dedicated kernel via `kernelManager.getOrCreate(environmentId)`.\n     * Requests that fail to resolve a environmentId fall through to the\n     * constructor-supplied kernel (self-hosted / legacy behavior).\n     */\n    kernelManager?: KernelManager;\n    /**\n     * Optional {@link EnvironmentScopeManager}. When present, `touch(environmentId)` is\n     * called on every scoped request so idle projects are evicted after TTL.\n     */\n    scopeManager?: EnvironmentScopeManager;\n}\n\n/**\n * @deprecated Use `createDispatcherPlugin()` from `@objectstack/runtime` instead.\n * This class will be removed in v2. Prefer the plugin-based approach:\n * ```ts\n * import { createDispatcherPlugin } from '@objectstack/runtime';\n * kernel.use(createDispatcherPlugin({ prefix: '/api/v1' }));\n * ```\n */\nexport class HttpDispatcher {\n    private kernel: any; // Casting to any to access dynamic props like services, graphql\n    private defaultKernel: ObjectKernel;\n    private envRegistry?: any; // EnvironmentDriverRegistry\n    private defaultProject?: { environmentId: string; orgId?: string };\n    private kernelManager?: KernelManager;\n    private scopeManager?: EnvironmentScopeManager;\n    /**\n     * When `true`, scoped data-plane routes enforce a\n     * `sys_environment_member` lookup and return 403 for non-members.\n     * Defaults to `true` when a environmentId is resolvable — legacy callers\n     * can opt out via the third constructor argument (see\n     * `DispatcherConfig.enforceProjectMembership`).\n     */\n    private enforceMembership: boolean;\n    /**\n     * In-memory cache of positive membership checks, keyed by\n     * `${environmentId}:${userId}`. Entries expire 60 seconds after insertion\n     * — a short TTL is acceptable because a user whose access was just\n     * revoked sees stale access for at most one minute.\n     */\n    private membershipCache: Map<string, number> = new Map();\n    private static readonly MEMBERSHIP_CACHE_TTL_MS = 60_000;\n    /** Well-known system project id — bypassed for any authenticated user. */\n    private static readonly SYSTEM_ENVIRONMENT_ID = '00000000-0000-0000-0000-000000000001';\n    /** Well-known platform org id — members bypass project membership. */\n    private static readonly PLATFORM_ORG_ID = '00000000-0000-0000-0000-000000000000';\n\n    constructor(kernel: ObjectKernel, envRegistry?: any, options?: HttpDispatcherOptions) {\n        this.kernel = kernel;\n        this.defaultKernel = kernel;\n        const resolveService = (name: string): any => {\n            try { return (kernel as any).getService?.(name); } catch { return undefined; }\n        };\n        this.envRegistry = envRegistry ?? resolveService('env-registry');\n        this.enforceMembership = options?.enforceProjectMembership ?? true;\n        this.kernelManager = options?.kernelManager ?? resolveService('kernel-manager');\n        this.scopeManager = options?.scopeManager ?? resolveService('scope-manager');\n        // Single-project default is resolved lazily on first request — the\n        // plugin that registers it (`createSingleEnvironmentPlugin`) may run\n        // its `init()` after the HttpDispatcher is constructed.\n    }\n\n    private resolveDefaultProject(): { environmentId: string; orgId?: string } | undefined {\n        if (this.defaultProject) return this.defaultProject;\n        try {\n            const v = (this.kernel as any).getService?.('default-project');\n            if (v?.environmentId) {\n                this.defaultProject = v;\n                return v;\n            }\n        } catch {\n            // service not registered — single-environment plugin not in stack\n        }\n        return undefined;\n    }\n\n    private success(data: any, meta?: any) {\n        return {\n            status: 200,\n            body: { success: true, data, meta }\n        };\n    }\n\n    private error(message: string, code: number = 500, details?: any) {\n        return {\n            status: code,\n            body: { success: false, error: { message, code, details } }\n        };\n    }\n\n    /**\n     * 404 Route Not Found — no route is registered for this path.\n     */\n    private routeNotFound(route: string) {\n        return {\n            status: 404,\n            body: {\n                success: false,\n                error: {\n                    code: 404,\n                    message: `Route Not Found: ${route}`,\n                    type: 'ROUTE_NOT_FOUND' as const,\n                    route,\n                    hint: 'No route is registered for this path. Check the API discovery endpoint for available routes.',\n                },\n            },\n        };\n    }\n\n    /**\n     * Direct data service dispatch — replaces broker.call('data.*').\n     * Tries protocol service first (supports expand/populate), falls back to ObjectQL.\n     *\n     * @param dataDriver - Optional environment-scoped driver to use instead of kernel default\n     * @param scopeId - Optional project ID for scoped service resolution (SharedProjectPlugin mode)\n     */\n    private async callData(\n        action: string,\n        params: any,\n        dataDriver?: any,\n        scopeId?: string,\n        executionContext?: ExecutionContext,\n    ): Promise<any> {\n        const protocol = await this.resolveService('protocol', scopeId);\n        const qlService = dataDriver ?? await this.getObjectQLService(scopeId);\n        const ql = qlService ?? await this.resolveService('objectql', scopeId);\n        const qlOpts = executionContext ? { context: executionContext } : undefined;\n        const findOpts = (extra?: any) => {\n            const base = qlOpts ? { ...qlOpts } : {};\n            return extra ? { ...base, ...extra } : (qlOpts ? base : undefined);\n        };\n\n        if (action === 'create') {\n            if (ql) {\n                const res = await ql.insert(params.object, params.data, qlOpts);\n                const record = { ...params.data, ...res };\n                return { object: params.object, id: record.id, record };\n            }\n            throw { statusCode: 503, message: 'Data service not available' };\n        }\n\n        if (action === 'get') {\n            if (protocol && typeof protocol.getData === 'function') {\n                return await protocol.getData({ object: params.object, id: params.id, expand: params.expand, select: params.select, context: executionContext });\n            }\n            if (ql) {\n                let all = await ql.find(params.object, findOpts({ where: { id: params.id }, limit: 1 }));\n                if (all && (all as any).value) all = (all as any).value;\n                if (!all) all = [];\n                const match = (all as any[]).find((i: any) => i.id === params.id);\n                return match ? { object: params.object, id: params.id, record: match } : null;\n            }\n            throw { statusCode: 503, message: 'Data service not available' };\n        }\n\n        if (action === 'update') {\n            if (ql && params.id) {\n                let all = await ql.find(params.object, findOpts({ where: { id: params.id }, limit: 1 }));\n                if (all && (all as any).value) all = (all as any).value;\n                if (!all) all = [];\n                const existing = (all as any[]).find((i: any) => i.id === params.id);\n                if (!existing) throw new Error('[ObjectStack] Not Found');\n                await ql.update(params.object, params.data, findOpts({ where: { id: params.id } }));\n                return { object: params.object, id: params.id, record: { ...existing, ...params.data } };\n            }\n            throw { statusCode: 503, message: 'Data service not available' };\n        }\n\n        if (action === 'delete') {\n            if (ql) {\n                await ql.delete(params.object, findOpts({ where: { id: params.id } }));\n                return { object: params.object, id: params.id, deleted: true };\n            }\n            throw { statusCode: 503, message: 'Data service not available' };\n        }\n\n        if (action === 'query' || action === 'find') {\n            if (protocol && typeof protocol.findData === 'function') {\n                // Build query: use explicit params.query if provided, otherwise extract query fields from params\n                const query = params.query || (() => {\n                    const { object, ...rest } = params;\n                    return rest;\n                })();\n                return await protocol.findData({ object: params.object, query, context: executionContext });\n            }\n            if (ql) {\n                let all = await ql.find(params.object, qlOpts);\n                if (!Array.isArray(all) && all && (all as any).value) all = (all as any).value;\n                if (!all) all = [];\n                return { object: params.object, records: all, total: all.length };\n            }\n            throw { statusCode: 503, message: 'Data service not available' };\n        }\n\n        if (action === 'batch') {\n            // Batch operations — not yet supported via direct service dispatch\n            return { object: params.object, results: [] };\n        }\n\n        throw { statusCode: 400, message: `Unknown data action: ${action}` };\n    }\n\n    /**\n     * Parse a project UUID out of a scoped URL path such as\n     * `/api/v1/environments/abc-123/data/task` or `/projects/abc-123/meta`.\n     * Returns `undefined` when the path does not match the scoped pattern.\n     */\n    /**\n     * Parse an environment UUID out of a scoped URL path such as\n     * `/api/v1/environments/abc-123/data/task` or `/environments/abc-123/meta`.\n     * Returns `undefined` when the path does not match the scoped pattern.\n     */\n    private extractEnvironmentIdFromPath(path: string): string | undefined {\n        if (!path) return undefined;\n        const m = path.match(/\\/environments\\/([^/?#]+)/);\n        if (!m) return undefined;\n        const candidate = m[1];\n        // Guard against matching control-plane routes like /cloud/environments.\n        // `/environments/<id>` directly nested under the API prefix wins;\n        // `/cloud/environments/<id>` is a CRUD endpoint on the control plane.\n        if (path.includes('/cloud/environments/')) return undefined;\n        return candidate;\n    }\n\n    /**\n     * Resolve environment context for incoming request.\n     *\n     * Precedence:\n     * 0. URL path matches `/environments/:environmentId/...` OR request.params.environmentId set by router\n     *    → envRegistry.resolveById(id)\n     * 1. request.headers.host → envRegistry.resolveByHostname(host)\n     * 2. request.headers['x-environment-id'] → envRegistry.resolveById(id)\n     * 3. session.activeEnvironmentId → envRegistry.resolveById(id)\n     * 4. session.activeOrganizationId → find default project → envRegistry.resolveById(id)\n     * 5. single-environment default (registered by `createSingleEnvironmentPlugin`)\n     *    → envRegistry.resolveById(defaultProject.environmentId). Lets bare\n     *    `/api/v1/data/...` URLs resolve to the lone project in\n     *    `cloudUrl: 'local'` deployments.\n     *\n     * Skip for paths: /auth, /cloud, /health, /discovery (NOT /meta when scoped,\n     * so project-scoped meta routes can resolve their project).\n     */\n    private async resolveEnvironmentContext(context: HttpProtocolContext, path: string): Promise<void> {\n        // Skip environment resolution for control-plane routes only.\n        // NOTE: /meta is intentionally not in this list — a scoped\n        // /projects/:id/meta path still needs the project resolved so the\n        // protocol can scope its answer.\n        // NOTE: /auth was removed — per-project AuthPlugin needs the\n        // hostname-resolved environmentId so the dispatcher kernel-swap routes\n        // to the project's auth manager (not the host's).\n        const skipPaths = ['/cloud', '/health', '/discovery'];\n        if (skipPaths.some(p => path.startsWith(p))) {\n            return;\n        }\n\n        // If no environment registry, skip\n        if (!this.envRegistry) {\n            return;\n        }\n\n        // Headers may arrive as a Fetch API `Headers` instance (Hono's\n        // `c.req.raw`) — where `.host` / `['x-environment-id']` both return\n        // undefined — or as a plain object (Vercel's incoming message\n        // shape). Normalise to a single `.get(name)` accessor so both\n        // layouts resolve correctly.\n        const headers = context.request?.headers;\n        const getHeader = (name: string): string | undefined => {\n            if (!headers) return undefined;\n            const h: any = headers;\n            if (typeof h.get === 'function') {\n                const v = h.get(name);\n                return v == null ? undefined : String(v);\n            }\n            const lower = name.toLowerCase();\n            for (const k of Object.keys(h)) {\n                if (k.toLowerCase() === lower) {\n                    const v = h[k];\n                    return Array.isArray(v) ? v[0] : (v == null ? undefined : String(v));\n                }\n            }\n            return undefined;\n        };\n\n        try {\n            // 0. Try URL-param / path-embedded environmentId (highest precedence).\n            const urlEnvironmentId = this.extractEnvironmentIdFromPath(path)\n                ?? context.request?.params?.environmentId;\n            if (urlEnvironmentId) {\n                const driver = await this.envRegistry.resolveById(urlEnvironmentId);\n                if (driver) {\n                    context.environmentId = urlEnvironmentId;\n                    context.dataDriver = driver;\n                    return;\n                }\n            }\n\n            // 1. Try hostname resolution\n            const host = getHeader('host');\n            if (host) {\n                // Strip port if present (e.g., \"localhost:3000\" → \"localhost\")\n                const hostname = host.split(':')[0];\n                const result = await this.envRegistry.resolveByHostname(hostname);\n                if (result) {\n                    context.environmentId = result.environmentId;\n                    context.dataDriver = result.driver;\n                    return;\n                }\n            }\n\n            // 2. Try X-Environment-Id header\n            const envIdHeader = getHeader('x-environment-id');\n            if (envIdHeader) {\n                const driver = await this.envRegistry.resolveById(envIdHeader);\n                if (driver) {\n                    context.environmentId = envIdHeader;\n                    context.dataDriver = driver;\n                    return;\n                }\n            }\n\n            // 3. Try session.activeEnvironmentId\n            try {\n                const authService: any = await this.getService(CoreServiceName.enum.auth);\n                const sessionData = await authService?.api?.getSession?.({\n                    headers: context.request?.headers,\n                });\n\n                const activeEnvironmentId = sessionData?.session?.activeEnvironmentId ?? sessionData?.session?.activeEnvironmentId;\n                if (activeEnvironmentId) {\n                    const driver = await this.envRegistry.resolveById(activeEnvironmentId);\n                    if (driver) {\n                        context.environmentId = activeEnvironmentId;\n                        context.dataDriver = driver;\n                        return;\n                    }\n                }\n\n                // 4. Try default environment for organization\n                const activeOrganizationId = sessionData?.session?.activeOrganizationId;\n                if (activeOrganizationId) {\n                    // Query control plane for default environment\n                    const qlService = await this.getObjectQLService();\n                    const ql = qlService ?? await this.resolveService('objectql');\n                    if (ql) {\n                        let rows = await ql.find('sys_environment', {\n                            where: {\n                                organization_id: activeOrganizationId,\n                                is_default: true\n                            },\n                            limit: 1\n                        } as any);\n                        if (rows && (rows as any).value) rows = (rows as any).value;\n                        if (Array.isArray(rows) && rows[0]) {\n                            const defaultEnv = rows[0];\n                            const driver = await this.envRegistry.resolveById(defaultEnv.id);\n                            if (driver) {\n                                context.environmentId = defaultEnv.id;\n                                context.dataDriver = driver;\n                                return;\n                            }\n                        }\n                    }\n                }\n            } catch (sessionError) {\n                // Session resolution failed, continue without environment context\n                console.debug('[HttpDispatcher] Session resolution failed:', sessionError);\n            }\n\n            // 5. Single-project default fallback. Registered by\n            //    `createSingleEnvironmentPlugin()` in `cloudUrl: 'local'` boot\n            //    shapes (apps/objectos default). Lets bare URLs like\n            //    `/api/v1/data/account` resolve to the lone project.\n            if (this.defaultProject?.environmentId || this.resolveDefaultProject()) {\n                const def = this.defaultProject!;\n                const driver = await this.envRegistry.resolveById(def.environmentId);\n                if (driver) {\n                    context.environmentId = def.environmentId;\n                    context.dataDriver = driver;\n                    return;\n                }\n            }\n        } catch (error) {\n            console.error('[HttpDispatcher] Environment resolution failed:', error);\n        }\n    }\n\n    /**\n     * Check whether the authenticated user is a member of\n     * `context.environmentId`. Runs after {@link resolveEnvironmentContext}\n     * and is a no-op when:\n     *\n     *   - Membership enforcement is disabled via the constructor.\n     *   - The route is control-plane (`/auth/*`, `/cloud/*`, `/health`,\n     *     `/discovery`) — already skipped upstream.\n     *   - No `environmentId` was resolved (e.g. unscoped legacy routes).\n     *   - The project is the well-known system project (bypassed so any\n     *     authenticated user can read platform metadata).\n     *   - The user's active organization is the platform org (staff).\n     *\n     * Positive results are cached for 60 seconds to avoid hitting the\n     * control-plane on every request. A failed check returns a 403\n     * response object that callers should surface directly — no further\n     * dispatch happens.\n     */\n    private async enforceProjectMembership(\n        context: HttpProtocolContext,\n        path: string,\n    ): Promise<{ status: number; body: any } | null> {\n        if (!this.enforceMembership) return null;\n\n        // Control-plane paths — never gated by project membership.\n        const skipPaths = ['/auth', '/cloud', '/health', '/discovery'];\n        if (skipPaths.some(p => path.startsWith(p))) return null;\n\n        const environmentId = context.environmentId;\n        if (!environmentId) return null; // Unscoped legacy routes fall through.\n\n        // System project is always reachable by any authenticated user.\n        if (environmentId === HttpDispatcher.SYSTEM_ENVIRONMENT_ID) return null;\n\n        // Read the session. If auth is not wired up, fail open — tests\n        // and single-tenant setups run without auth.\n        let userId: string | undefined;\n        let activeOrganizationId: string | undefined;\n        try {\n            const authService: any = await this.resolveService(CoreServiceName.enum.auth);\n            const sessionData = await authService?.api?.getSession?.({\n                headers: context.request?.headers,\n            });\n            userId = sessionData?.user?.id ?? sessionData?.session?.userId;\n            activeOrganizationId = sessionData?.session?.activeOrganizationId;\n        } catch {\n            // Auth resolution failed — do not block the request on RBAC.\n            return null;\n        }\n\n        if (!userId) return null; // Anonymous requests — upstream auth will decide.\n\n        // Platform-org members bypass project membership.\n        if (activeOrganizationId === HttpDispatcher.PLATFORM_ORG_ID) return null;\n\n        // Check cache.\n        const cacheKey = `${environmentId}:${userId}`;\n        const cached = this.membershipCache.get(cacheKey);\n        const now = Date.now();\n        if (cached && now - cached < HttpDispatcher.MEMBERSHIP_CACHE_TTL_MS) {\n            return null; // Recently verified as a member.\n        }\n        if (cached) {\n            this.membershipCache.delete(cacheKey); // expired\n        }\n\n        // Query sys_environment_member (control plane).\n        try {\n            const qlService = await this.getObjectQLService();\n            const ql = qlService ?? await this.resolveService('objectql');\n            if (!ql) return null; // No QL — cannot enforce; fail open.\n\n            let rows = await ql.find('sys_environment_member', {\n                where: { environment_id: environmentId, user_id: userId },\n                limit: 1,\n            } as any);\n            if (rows && (rows as any).value) rows = (rows as any).value;\n            const isMember = Array.isArray(rows) && rows.length > 0;\n\n            if (isMember) {\n                this.membershipCache.set(cacheKey, now);\n                return null;\n            }\n\n            return this.error(\n                `Forbidden: user ${userId} is not a member of project ${environmentId}`,\n                403,\n                { environmentId, userId, type: 'PROJECT_MEMBERSHIP_REQUIRED' },\n            );\n        } catch (err) {\n            // Control-plane lookup failure — log and fail open rather than\n            // break the request. Tightening this is deferred to Phase 4.\n            console.debug('[HttpDispatcher] Membership check failed:', err);\n            return null;\n        }\n    }\n\n    /**\n     * Generates the discovery JSON response for the API root.\n     *\n     * Uses the same async `resolveService()` fallback chain that request\n     * handlers use, so the reported service status is always consistent\n     * with the actual runtime availability.\n     */\n    async getDiscoveryInfo(prefix: string) {\n        // Resolve all services through the same async fallback chain\n        // that request handlers (handleI18n, handleAuth, …) use.\n        const [\n            authSvc, graphqlSvc, searchSvc, realtimeSvc, filesSvc,\n            analyticsSvc, workflowSvc, aiSvc, notificationSvc, i18nSvc,\n            uiSvc, automationSvc, cacheSvc, queueSvc, jobSvc,\n        ] = await Promise.all([\n            this.resolveService(CoreServiceName.enum.auth),\n            this.resolveService(CoreServiceName.enum.graphql),\n            this.resolveService(CoreServiceName.enum.search),\n            this.resolveService(CoreServiceName.enum.realtime),\n            this.resolveService(CoreServiceName.enum['file-storage']),\n            this.resolveService(CoreServiceName.enum.analytics),\n            this.resolveService(CoreServiceName.enum.workflow),\n            this.resolveService(CoreServiceName.enum.ai),\n            this.resolveService(CoreServiceName.enum.notification),\n            this.resolveService(CoreServiceName.enum.i18n),\n            this.resolveService(CoreServiceName.enum.ui),\n            this.resolveService(CoreServiceName.enum.automation),\n            this.resolveService(CoreServiceName.enum.cache),\n            this.resolveService(CoreServiceName.enum.queue),\n            this.resolveService(CoreServiceName.enum.job),\n        ]);\n\n        const hasAuth         = !!authSvc;\n        const hasGraphQL      = !!(graphqlSvc || this.kernel.graphql);\n        const hasSearch       = !!searchSvc;\n        const hasWebSockets   = !!realtimeSvc;\n        const hasFiles        = !!filesSvc;\n        const hasAnalytics    = !!analyticsSvc;\n        const hasWorkflow     = !!workflowSvc;\n        const hasAi           = !!aiSvc;\n        const hasNotification = !!notificationSvc;\n        const hasI18n         = !!i18nSvc;\n        const hasUi           = !!uiSvc;\n        const hasAutomation   = !!automationSvc;\n        const hasCache        = !!cacheSvc;\n        const hasQueue        = !!queueSvc;\n        const hasJob          = !!jobSvc;\n\n        // Routes are only exposed when a plugin provides the service\n        const routes = {\n                data:          `${prefix}/data`,\n                metadata:      `${prefix}/meta`,\n                packages:      `${prefix}/packages`,\n                auth:          hasAuth ? `${prefix}/auth` : undefined,\n                ui:            hasUi ? `${prefix}/ui` : undefined,\n                graphql:       hasGraphQL ? `${prefix}/graphql` : undefined,\n                storage:       hasFiles ? `${prefix}/storage` : undefined,\n                analytics:     hasAnalytics ? `${prefix}/analytics` : undefined,\n                automation:    hasAutomation ? `${prefix}/automation` : undefined,\n                workflow:      hasWorkflow ? `${prefix}/workflow` : undefined,\n                realtime:      hasWebSockets ? `${prefix}/realtime` : undefined,\n                notifications: hasNotification ? `${prefix}/notifications` : undefined,\n                ai:            hasAi ? `${prefix}/ai` : undefined,\n                i18n:          hasI18n ? `${prefix}/i18n` : undefined,\n        };\n\n        // Build per-service status map\n        // handlerReady: true means the dispatcher has a real, bound handler for this route.\n        // handlerReady: false means the route is present in the discovery table but may not\n        // yet have a concrete implementation or may be served by a stub.\n        const svcAvailable = (route?: string, provider?: string) => ({\n            enabled: true, status: 'available' as const, handlerReady: true, route, provider,\n        });\n        const svcUnavailable = (name: string) => ({\n            enabled: false, status: 'unavailable' as const, handlerReady: false,\n            message: `Install a ${name} plugin to enable`,\n        });\n\n        // Derive locale info from actual i18n service when available\n        let locale = { default: 'en', supported: ['en'], timezone: 'UTC' };\n        if (hasI18n && i18nSvc) {\n            const defaultLocale = typeof i18nSvc.getDefaultLocale === 'function'\n                ? i18nSvc.getDefaultLocale() : 'en';\n            const locales = typeof i18nSvc.getLocales === 'function'\n                ? i18nSvc.getLocales() : [];\n            locale = {\n                default: defaultLocale,\n                supported: locales.length > 0 ? locales : [defaultLocale],\n                timezone: 'UTC',\n            };\n        }\n\n        return {\n            name: 'ObjectOS',\n            version: '1.0.0',\n            environment: getEnv('NODE_ENV', 'development'),\n            routes,\n            endpoints: routes, // Alias for backward compatibility with some clients\n            features: {\n                graphql: hasGraphQL,\n                search: hasSearch,\n                websockets: hasWebSockets,\n                files: hasFiles,\n                analytics: hasAnalytics,\n                ai: hasAi,\n                workflow: hasWorkflow,\n                notifications: hasNotification,\n                i18n: hasI18n,\n            },\n            services: {\n                // Kernel-provided (always available via protocol implementation)\n                metadata:       { enabled: true, status: 'degraded' as const, handlerReady: true, route: routes.metadata, provider: 'kernel', message: 'In-memory registry; DB persistence pending' },\n                data:           svcAvailable(routes.data, 'kernel'),\n                // Plugin-provided — only available when a plugin registers the service\n                auth:           hasAuth ? svcAvailable(routes.auth) : svcUnavailable('auth'),\n                automation:     hasAutomation ? svcAvailable(routes.automation) : svcUnavailable('automation'),\n                analytics:      hasAnalytics ? svcAvailable(routes.analytics) : svcUnavailable('analytics'),\n                cache:          hasCache ? svcAvailable() : svcUnavailable('cache'),\n                queue:          hasQueue ? svcAvailable() : svcUnavailable('queue'),\n                job:            hasJob ? svcAvailable() : svcUnavailable('job'),\n                ui:             hasUi ? svcAvailable(routes.ui) : svcUnavailable('ui'),\n                workflow:       hasWorkflow ? svcAvailable(routes.workflow) : svcUnavailable('workflow'),\n                realtime:       hasWebSockets ? svcAvailable(routes.realtime) : svcUnavailable('realtime'),\n                notification:   hasNotification ? svcAvailable(routes.notifications) : svcUnavailable('notification'),\n                ai:             hasAi ? svcAvailable(routes.ai) : svcUnavailable('ai'),\n                i18n:           hasI18n ? svcAvailable(routes.i18n) : svcUnavailable('i18n'),\n                graphql:        hasGraphQL ? svcAvailable(routes.graphql) : svcUnavailable('graphql'),\n                'file-storage': hasFiles ? svcAvailable(routes.storage) : svcUnavailable('file-storage'),\n                search:         hasSearch ? svcAvailable() : svcUnavailable('search'),\n            },\n            locale,\n        };\n    }\n\n    /**\n     * Handles GraphQL requests\n     */\n    async handleGraphQL(body: { query: string; variables?: any }, context: HttpProtocolContext) {\n        if (!body || !body.query) {\n             throw { statusCode: 400, message: 'Missing query in request body' };\n        }\n        \n        if (typeof this.kernel.graphql !== 'function') {\n            throw { statusCode: 501, message: 'GraphQL service not available' };\n        }\n\n        return this.kernel.graphql(body.query, body.variables, { \n            request: context.request \n        });\n    }\n\n    /**\n     * Handles Auth requests\n     * path: sub-path after /auth/\n     */\n    async handleAuth(path: string, method: string, body: any, context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        // 1. Try generic Auth Service\n        const authService = await this.getService(CoreServiceName.enum.auth);\n        if (authService && typeof authService.handler === 'function') {\n            const response = await authService.handler(context.request, context.response);\n            return { handled: true, result: response };\n        }\n\n        // 2. Mock fallback for MSW/test environments when no auth service is registered\n        const normalizedPath = path.replace(/^\\/+/, '');\n        return this.mockAuthFallback(normalizedPath, method, body);\n    }\n\n    /**\n     * Provides mock auth responses for core better-auth endpoints when\n     * AuthPlugin is not loaded (e.g. MSW/browser-only environments).\n     * This ensures registration/sign-in flows do not 404 in mock mode.\n     */\n    private mockAuthFallback(path: string, method: string, body: any): HttpDispatcherResult {\n        const m = method.toUpperCase();\n        const MOCK_SESSION_EXPIRY_MS = 86_400_000; // 24 hours\n\n        // POST sign-up/email\n        if ((path === 'sign-up/email' || path === 'register') && m === 'POST') {\n            const id = `mock_${randomUUID()}`;\n            return {\n                handled: true,\n                response: {\n                    status: 200,\n                    body: {\n                        user: { id, name: body?.name || 'Mock User', email: body?.email || 'mock@test.local', emailVerified: false, createdAt: new Date().toISOString(), updatedAt: new Date().toISOString() },\n                        session: { id: `session_${id}`, userId: id, token: `mock_token_${id}`, expiresAt: new Date(Date.now() + MOCK_SESSION_EXPIRY_MS).toISOString() },\n                    },\n                },\n            };\n        }\n\n        // POST sign-in/email or login\n        if ((path === 'sign-in/email' || path === 'login') && m === 'POST') {\n            const id = `mock_${randomUUID()}`;\n            return {\n                handled: true,\n                response: {\n                    status: 200,\n                    body: {\n                        user: { id, name: 'Mock User', email: body?.email || 'mock@test.local', emailVerified: true, createdAt: new Date().toISOString(), updatedAt: new Date().toISOString() },\n                        session: { id: `session_${id}`, userId: id, token: `mock_token_${id}`, expiresAt: new Date(Date.now() + MOCK_SESSION_EXPIRY_MS).toISOString() },\n                    },\n                },\n            };\n        }\n\n        // GET get-session\n        if (path === 'get-session' && m === 'GET') {\n            return {\n                handled: true,\n                response: { status: 200, body: { session: null, user: null } },\n            };\n        }\n\n        // POST sign-out\n        if (path === 'sign-out' && m === 'POST') {\n            return {\n                handled: true,\n                response: { status: 200, body: { success: true } },\n            };\n        }\n\n        return { handled: false };\n    }\n\n    /**\n     * Handles Metadata requests\n     * Standard: /metadata/:type/:name\n     * Fallback for backward compat: /metadata (all objects), /metadata/:objectName (get object)\n     */\n    async handleMetadata(path: string, _context: HttpProtocolContext, method?: string, body?: any, query?: any): Promise<HttpDispatcherResult> {\n        const parts = path.replace(/^\\/+/, '').split('/').filter(Boolean);\n        \n        // GET /metadata/types\n        if (parts[0] === 'types') {\n            // PRIORITY 1: Try MetadataService directly (includes both typeRegistry with agent/tool AND runtime-registered types)\n            const metadataService = await this.resolveService('metadata', _context.environmentId);\n\n            if (metadataService && typeof (metadataService as any).getRegisteredTypes === 'function') {\n                try {\n                    const types = await (metadataService as any).getRegisteredTypes();\n                    return { handled: true, response: this.success({ types }) };\n                } catch (e: any) {\n                    // Log error but continue to fallbacks\n                    console.warn('[HttpDispatcher] MetadataService.getRegisteredTypes() failed:', e.message);\n                }\n            }\n            // PRIORITY 2: Try protocol service (returns SchemaRegistry types only - missing agent/tool)\n            const protocol = await this.resolveService('protocol');\n            if (protocol && typeof protocol.getMetaTypes === 'function') {\n                const result = await protocol.getMetaTypes({});\n                return { handled: true, response: this.success(result) };\n            }\n            // Last resort: hardcoded defaults\n            return { handled: true, response: this.success({ types: ['object', 'app', 'plugin'] }) };\n        }\n\n        // GET /metadata/:type/:name(/:subname...)/published → get published version\n        // Supports compound names like `lead/views/all_leads/published`.\n        if (parts.length >= 3 && parts[parts.length - 1] === 'published' && (!method || method === 'GET')) {\n            const type = parts[0];\n            const name = parts.slice(1, -1).join('/');\n            const metadataService = await this.getService(CoreServiceName.enum.metadata);\n            if (metadataService && typeof (metadataService as any).getPublished === 'function') {\n                const data = await (metadataService as any).getPublished(type, name);\n                if (data === undefined) return { handled: true, response: this.error('Not found', 404) };\n                return { handled: true, response: this.success(data) };\n            }\n            // Fallback — try MetadataService via resolveService\n            const metaSvc = await this.resolveService('metadata', _context.environmentId);\n            if (metaSvc && typeof (metaSvc as any).getPublished === 'function') {\n                try {\n                    const fallbackData = await (metaSvc as any).getPublished(type, name);\n                    if (fallbackData !== undefined) return { handled: true, response: this.success(fallbackData) };\n                } catch { /* fall through */ }\n            }\n            return { handled: true, response: this.error('Not found', 404) };\n        }\n\n        // /metadata/:type/:name where :name may itself contain slashes\n        // (e.g. /metadata/lead/views/all_leads → type='lead', name='views/all_leads').\n        // Compound names are how the client expresses sub-resources of a type\n        // (a view of an object, a flow under an automation, etc.) and the\n        // metadata service treats the full string as the lookup key.\n        if (parts.length >= 2) {\n            const type = parts[0];\n            const name = parts.slice(1).join('/');\n            // Extract optional package filter from query string\n            const packageId = query?.package || undefined;\n\n            // PUT /metadata/:type/:name (Save)\n            if (method === 'PUT' && body) {\n                // Try to get the protocol service directly\n                const protocol = await this.resolveService('protocol');\n\n                if (protocol && typeof protocol.saveMetaItem === 'function') {\n                    try {\n                        const organizationId = await this.resolveActiveOrganizationId(_context);\n                        const result = await protocol.saveMetaItem({ type, name, item: body, organizationId });\n                        return { handled: true, response: this.success(result) };\n                    } catch (e: any) {\n                        return { handled: true, response: this.error(e.message, 400) };\n                    }\n                }\n\n                // Fallback: try MetadataService directly\n                const metaSvc = await this.resolveService('metadata', _context.environmentId);\n                if (metaSvc && typeof (metaSvc as any).saveItem === 'function') {\n                    try {\n                        const data = await (metaSvc as any).saveItem(type, name, body);\n                        return { handled: true, response: this.success(data) };\n                    } catch (e: any) {\n                        return { handled: true, response: this.error(e.message || 'Save not supported', 501) };\n                    }\n                }\n                return { handled: true, response: this.error('Save not supported', 501) };\n            }\n\n            try {\n                // Try specific calls based on type\n                if (type === 'objects' || type === 'object') {\n                    // Check whether the kernel is project-scoped. When it is,\n                    // the process-wide SchemaRegistry is unsafe to query\n                    // directly — it would return objects that other projects\n                    // wrote in this same process. Route through the Protocol\n                    // service (which filters sys_metadata by environment_id) in that\n                    // case, and fall back to the registry only for the\n                    // unscoped (single-kernel / control-plane) path.\n                    const protocol = await this.resolveService('protocol') as any;\n                    const scopedEnv = typeof protocol?.getProjectId === 'function'\n                        ? protocol.getProjectId()\n                        : protocol?.environmentId;\n                    const scoped = scopedEnv !== undefined;\n\n                    if (scoped && typeof protocol.getMetaItem === 'function') {\n                        try {\n                            const organizationId = await this.resolveActiveOrganizationId(_context);\n                            const data = await protocol.getMetaItem({ type: 'object', name, organizationId });\n                            // Protocol returns `{ type, name, item }` — only\n                            // treat the lookup as a hit when item is present.\n                            if (data && (data.item ?? data)) {\n                                return { handled: true, response: this.success(data) };\n                            }\n                        } catch { /* fall through to registry / 404 */ }\n                    }\n\n                    const qlService = await this.getObjectQLService();\n                    if (qlService?.registry) {\n                        const data = qlService.registry.getObject(name);\n                        if (data) return { handled: true, response: this.success(data) };\n                    }\n\n                    // Last-ditch protocol attempt for unscoped kernels whose\n                    // registry missed (e.g. object persisted to DB but not\n                    // yet hydrated). Skip when we already tried above.\n                    if (!scoped && protocol && typeof protocol.getMetaItem === 'function') {\n                        try {\n                            const organizationId = await this.resolveActiveOrganizationId(_context);\n                            const data = await protocol.getMetaItem({ type: 'object', name, organizationId });\n                            if (data && (data.item ?? data)) {\n                                return { handled: true, response: this.success(data) };\n                            }\n                        } catch { /* fall through to 404 */ }\n                    }\n                    return { handled: true, response: this.error('Not found', 404) };\n                }\n\n                // Normalize plural URL paths to singular registry type names\n                const singularType = pluralToSingular(type);\n\n                // Try Protocol Service First (Preferred)\n                const protocol = await this.resolveService('protocol');\n                if (protocol && typeof protocol.getMetaItem === 'function') {\n                     try {\n                        const organizationId = await this.resolveActiveOrganizationId(_context);\n                        const data = await protocol.getMetaItem({ type: singularType, name, packageId, organizationId });\n                        return { handled: true, response: this.success(data) };\n                     } catch (e: any) {\n                        // Protocol might throw if not found or not supported\n                     }\n                }\n\n                // Try MetadataService for runtime-registered types\n                const metaSvc = await this.resolveService('metadata', _context.environmentId);\n                if (metaSvc && typeof (metaSvc as any).getItem === 'function') {\n                    try {\n                        const data = await (metaSvc as any).getItem(singularType, name);\n                        if (data) return { handled: true, response: this.success(data) };\n                    } catch { /* not found */ }\n                }\n                return { handled: true, response: this.error('Not found', 404) };\n            } catch (e: any) {\n                // Fallback: treat first part as object name if only 1 part (handled below)\n                // But here we are deep in 2 parts. Must be an error.\n                return { handled: true, response: this.error(e.message, 404) };\n            }\n        }\n        \n        // GET /metadata/:type (List items of type) OR /metadata/:objectName (Legacy)\n        if (parts.length === 1) {\n            const typeOrName = parts[0];\n            // Extract optional package filter from query string\n            const packageId = query?.package || undefined;\n\n            // Try protocol service first for any type\n            const protocol = await this.resolveService('protocol');\n            if (protocol && typeof protocol.getMetaItems === 'function') {\n                try {\n                    const organizationId = await this.resolveActiveOrganizationId(_context);\n                    const data = await protocol.getMetaItems({ type: typeOrName, packageId, organizationId });\n                    // Return any valid response from protocol (including empty items arrays)\n                    if (data && (data.items !== undefined || Array.isArray(data))) {\n                        return { handled: true, response: this.success(data) };\n                    }\n                } catch {\n                    // Protocol doesn't know this type, fall through\n                }\n            }\n\n            // Try MetadataService directly for runtime-registered metadata (agents, tools, etc.)\n            const metadataService = await this.getService(CoreServiceName.enum.metadata);\n            if (metadataService && typeof (metadataService as any).list === 'function') {\n                try {\n                    let items = await (metadataService as any).list(typeOrName);\n                    // Respect package filter: MetadataService.list() returns ALL items,\n                    // so filter by _packageId when a specific package is requested.\n                    if (packageId && items && items.length > 0) {\n                        items = items.filter((item: any) => item?._packageId === packageId);\n                    }\n                    if (items && items.length > 0) {\n                        return { handled: true, response: this.success({ type: typeOrName, items }) };\n                    }\n                } catch (e: any) {\n                    // MetadataService doesn't know this type or failed, continue to other fallbacks\n                    // Sanitize typeOrName to prevent log injection (CodeQL warning)\n                    const sanitizedType = String(typeOrName).replace(/[\\r\\n\\t]/g, '');\n                    console.debug(`[HttpDispatcher] MetadataService.list() failed for type:`, sanitizedType, 'error:', e.message);\n                }\n            }\n\n            // Try ObjectQL registry directly for object/type lookups\n            const qlService = await this.getObjectQLService();\n            if (qlService?.registry) {\n                if (typeOrName === 'objects') {\n                    const objs = qlService.registry.getAllObjects(packageId);\n                    return { handled: true, response: this.success({ type: 'object', items: objs }) };\n                }\n                // Try listing items of the given type\n                const items = qlService.registry.listItems?.(typeOrName, packageId);\n                if (items && items.length > 0) {\n                    return { handled: true, response: this.success({ type: typeOrName, items }) };\n                }\n                // Legacy: treat as object name\n                const obj = qlService.registry.getObject(typeOrName);\n                if (obj) return { handled: true, response: this.success(obj) };\n            }\n            return { handled: true, response: this.error('Not found', 404) };\n        }\n\n        // GET /metadata — return available metadata types\n        if (parts.length === 0) {\n            // Try MetadataService for registered types\n            const metadataService = await this.resolveService('metadata', _context.environmentId);\n            if (metadataService && typeof (metadataService as any).getRegisteredTypes === 'function') {\n                try {\n                    const types = await (metadataService as any).getRegisteredTypes();\n                    return { handled: true, response: this.success({ types }) };\n                } catch { /* fall through */ }\n            }\n            // Try protocol service for dynamic types\n            const protocol = await this.resolveService('protocol');\n            if (protocol && typeof protocol.getMetaTypes === 'function') {\n                const result = await protocol.getMetaTypes({});\n                return { handled: true, response: this.success(result) };\n            }\n            return { handled: true, response: this.success({ types: ['object', 'app', 'plugin'] }) };\n        }\n        \n        return { handled: false };\n    }\n\n    /**\n     * Handles Data requests\n     * path: sub-path after /data/ (e.g. \"contacts\", \"contacts/123\", \"contacts/query\")\n     */\n    async handleData(path: string, method: string, body: any, query: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        const parts = path.replace(/^\\/+/, '').split('/');\n        const objectName = parts[0];\n\n        if (!objectName) {\n            return { handled: true, response: this.error('Object name required', 400) };\n        }\n\n        // Check if environment is resolved for data-plane requests\n        if (!_context.dataDriver && this.envRegistry) {\n            return {\n                handled: true,\n                response: this.error('Project not resolved. Please specify X-Environment-Id header or ensure hostname maps to a project.', 428)\n            };\n        }\n\n        const m = method.toUpperCase();\n\n        // 1. Custom Actions (query, batch)\n        if (parts.length > 1) {\n            const action = parts[1];\n\n            // POST /data/:object/query\n            if (action === 'query' && m === 'POST') {\n                // Spec: returns FindDataResponse = { object, records, total?, hasMore? }\n                const result = await this.callData('query', { object: objectName, ...body }, _context.dataDriver, _context.environmentId, _context.executionContext);\n                return { handled: true, response: this.success(result) };\n            }\n\n            // GET /data/:object/:id\n            if (parts.length === 2 && m === 'GET') {\n                const id = parts[1];\n                // Spec: Only select/expand are allowlisted query params for GET by ID.\n                // All other query parameters are discarded to prevent parameter pollution.\n                const { select, expand } = query || {};\n                const allowedParams: Record<string, unknown> = {};\n                if (select != null) allowedParams.select = select;\n                if (expand != null) allowedParams.expand = expand;\n                // Spec: returns GetDataResponse = { object, id, record }\n                const result = await this.callData('get', { object: objectName, id, ...allowedParams }, _context.dataDriver, _context.environmentId, _context.executionContext);\n                return { handled: true, response: this.success(result) };\n            }\n\n            // PATCH /data/:object/:id\n            if (parts.length === 2 && m === 'PATCH') {\n                const id = parts[1];\n                // Spec: returns UpdateDataResponse = { object, id, record }\n                const result = await this.callData('update', { object: objectName, id, data: body }, _context.dataDriver, _context.environmentId, _context.executionContext);\n                return { handled: true, response: this.success(result) };\n            }\n\n            // DELETE /data/:object/:id\n            if (parts.length === 2 && m === 'DELETE') {\n                const id = parts[1];\n                // Spec: returns DeleteDataResponse = { object, id, deleted }\n                const result = await this.callData('delete', { object: objectName, id }, _context.dataDriver, _context.environmentId, _context.executionContext);\n                return { handled: true, response: this.success(result) };\n            }\n        } else {\n            // GET /data/:object (List)\n            if (m === 'GET') {\n                // ── Normalize HTTP transport params → Spec canonical (QueryAST) ──\n                // HTTP GET query params use transport-level names (filter, sort, top,\n                // skip, select, expand) which are normalized here to canonical\n                // QueryAST field names (where, orderBy, limit, offset, fields,\n                // expand) before forwarding to the data service layer.\n                // The protocol.ts findData() method performs a deeper normalization\n                // pass, but pre-normalizing here ensures the data service always receives\n                // Spec-canonical keys.\n                const normalized: Record<string, unknown> = { ...query };\n\n                // filter/filters → where\n                // Note: `filter` is the canonical HTTP *transport* parameter name\n                // (see HttpFindQueryParamsSchema). It is normalized here to the\n                // canonical *QueryAST* field name `where` before data dispatch.\n                // `filters` (plural) is a deprecated alias for `filter`.\n                if (normalized.filter != null || normalized.filters != null) {\n                    normalized.where = normalized.where ?? normalized.filter ?? normalized.filters;\n                    delete normalized.filter;\n                    delete normalized.filters;\n                }\n                // select → fields\n                if (normalized.select != null && normalized.fields == null) {\n                    normalized.fields = normalized.select;\n                    delete normalized.select;\n                }\n                // sort → orderBy\n                if (normalized.sort != null && normalized.orderBy == null) {\n                    normalized.orderBy = normalized.sort;\n                    delete normalized.sort;\n                }\n                // top → limit\n                if (normalized.top != null && normalized.limit == null) {\n                    normalized.limit = normalized.top;\n                    delete normalized.top;\n                }\n                // skip → offset\n                if (normalized.skip != null && normalized.offset == null) {\n                    normalized.offset = normalized.skip;\n                    delete normalized.skip;\n                }\n\n                // Spec: returns FindDataResponse = { object, records, total?, hasMore? }\n                const result = await this.callData('query', { object: objectName, query: normalized }, _context.dataDriver, _context.environmentId, _context.executionContext);\n                return { handled: true, response: this.success(result) };\n            }\n\n            // POST /data/:object (Create)\n            if (m === 'POST') {\n                // Spec: returns CreateDataResponse = { object, id, record }\n                const result = await this.callData('create', { object: objectName, data: body }, _context.dataDriver, _context.environmentId, _context.executionContext);\n                const res = this.success(result);\n                res.status = 201;\n                return { handled: true, response: res };\n            }\n        }\n\n        return { handled: false };\n    }\n\n    /**\n     * Handles Analytics requests\n     * path: sub-path after /analytics/\n     */\n    async handleAnalytics(path: string, method: string, body: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        const analyticsService = await this.getService(CoreServiceName.enum.analytics);\n        if (!analyticsService) return { handled: false }; // 404 handled by caller if unhandled\n\n        const m = method.toUpperCase();\n        const subPath = path.replace(/^\\/+/, '');\n\n        // POST /analytics/query\n        if (subPath === 'query' && m === 'POST') {\n            const result = await analyticsService.query(body);\n            return { handled: true, response: this.success(result) };\n        }\n\n        // GET /analytics/meta\n        if (subPath === 'meta' && m === 'GET') {\n            const result = await analyticsService.getMeta();\n             return { handled: true, response: this.success(result) };\n        }\n\n        // POST /analytics/sql (Dry-run or debug)\n        if (subPath === 'sql' && m === 'POST') {\n             // Assuming service has generateSql method\n             const result = await analyticsService.generateSql(body);\n             return { handled: true, response: this.success(result) };\n        }\n\n        return { handled: false };\n    }\n\n    /**\n     * Handles i18n requests\n     * path: sub-path after /i18n/\n     *\n     * Routes:\n     *   GET /locales                    → getLocales\n     *   GET /translations/:locale       → getTranslations (locale from path)\n     *   GET /translations?locale=xx     → getTranslations (locale from query)\n     *   GET /labels/:object/:locale     → getFieldLabels  (both from path)\n     *   GET /labels/:object?locale=xx   → getFieldLabels  (locale from query)\n     */\n    async handleI18n(path: string, method: string, query: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        const i18nService = await this.getService(CoreServiceName.enum.i18n);\n        if (!i18nService) return { handled: true, response: this.error('i18n service not available', 501) };\n\n        const m = method.toUpperCase();\n        const parts = path.replace(/^\\/+/, '').split('/').filter(Boolean);\n\n        if (m !== 'GET') return { handled: false };\n\n        // GET /i18n/locales\n        if (parts[0] === 'locales' && parts.length === 1) {\n            const locales = i18nService.getLocales();\n            return { handled: true, response: this.success({ locales }) };\n        }\n\n        // GET /i18n/translations/:locale  OR  /i18n/translations?locale=xx\n        if (parts[0] === 'translations') {\n            const locale = parts[1] ? decodeURIComponent(parts[1]) : query?.locale;\n            if (!locale) return { handled: true, response: this.error('Missing locale parameter', 400) };\n\n            let translations = i18nService.getTranslations(locale);\n\n            // Locale fallback: try resolving to an available locale when\n            // the exact code yields empty translations (e.g. zh → zh-CN).\n            if (Object.keys(translations).length === 0) {\n                const availableLocales = typeof i18nService.getLocales === 'function'\n                    ? i18nService.getLocales() : [];\n                const resolved = resolveLocale(locale, availableLocales);\n                if (resolved && resolved !== locale) {\n                    translations = i18nService.getTranslations(resolved);\n                    return { handled: true, response: this.success({ locale: resolved, requestedLocale: locale, translations }) };\n                }\n            }\n\n            return { handled: true, response: this.success({ locale, translations }) };\n        }\n\n        // GET /i18n/labels/:object/:locale  OR  /i18n/labels/:object?locale=xx\n        if (parts[0] === 'labels' && parts.length >= 2) {\n            const objectName = decodeURIComponent(parts[1]);\n            let locale = parts[2] ? decodeURIComponent(parts[2]) : query?.locale;\n            if (!locale) return { handled: true, response: this.error('Missing locale parameter', 400) };\n\n            // Locale fallback for labels endpoint\n            const availableLocales = typeof i18nService.getLocales === 'function'\n                ? i18nService.getLocales() : [];\n            const resolved = resolveLocale(locale, availableLocales);\n            if (resolved) locale = resolved;\n\n            if (typeof i18nService.getFieldLabels === 'function') {\n                const labels = i18nService.getFieldLabels(objectName, locale);\n                return { handled: true, response: this.success({ object: objectName, locale, labels }) };\n            }\n            // Fallback: derive field labels from full translation bundle\n            const translations = i18nService.getTranslations(locale);\n            const prefix = `o.${objectName}.fields.`;\n            const labels: Record<string, string> = {};\n            for (const [key, value] of Object.entries(translations)) {\n                if (key.startsWith(prefix)) {\n                    labels[key.substring(prefix.length)] = value as string;\n                }\n            }\n            return { handled: true, response: this.success({ object: objectName, locale, labels }) };\n        }\n\n        return { handled: false };\n    }\n\n    /**\n     * Handles Package Management requests\n     * \n     * REST Endpoints:\n     * - GET    /packages          → list all installed packages\n     * - GET    /packages/:id      → get a specific package\n     * - POST   /packages          → install a new package\n     * - DELETE  /packages/:id      → uninstall a package\n     * - PATCH  /packages/:id/enable  → enable a package\n     * - PATCH  /packages/:id/disable → disable a package\n     * - POST   /packages/:id/publish → publish a package (metadata snapshot)\n     * - POST   /packages/:id/revert  → revert a package to last published state\n     * \n     * Uses ObjectQL SchemaRegistry directly (via the 'objectql' service).\n     */\n    async handlePackages(path: string, method: string, body: any, query: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        const m = method.toUpperCase();\n        const parts = path.replace(/^\\/+/, '').split('/').filter(Boolean);\n\n        // Try to get SchemaRegistry from the ObjectQL service\n        const qlService = await this.getObjectQLService();\n        const registry = qlService?.registry;\n\n        // If no registry available, return 503\n        if (!registry) {\n            return { handled: true, response: this.error('Package service not available', 503) };\n        }\n\n        try {\n            // GET /packages → list packages\n            if (parts.length === 0 && m === 'GET') {\n                let packages = registry.getAllPackages();\n                // Apply optional filters\n                if (query?.status) {\n                    packages = packages.filter((p: any) => p.status === query.status);\n                }\n                if (query?.type) {\n                    packages = packages.filter((p: any) => p.manifest?.type === query.type);\n                }\n                return { handled: true, response: this.success({ packages, total: packages.length }) };\n            }\n\n            // POST /packages → install package\n            if (parts.length === 0 && m === 'POST') {\n                const pkg = registry.installPackage(body.manifest || body, body.settings);\n                const res = this.success(pkg);\n                res.status = 201;\n                return { handled: true, response: res };\n            }\n\n            // PATCH /packages/:id/enable\n            if (parts.length === 2 && parts[1] === 'enable' && m === 'PATCH') {\n                const id = decodeURIComponent(parts[0]);\n                const pkg = registry.enablePackage(id);\n                if (!pkg) return { handled: true, response: this.error(`Package '${id}' not found`, 404) };\n                return { handled: true, response: this.success(pkg) };\n            }\n\n            // PATCH /packages/:id/disable\n            if (parts.length === 2 && parts[1] === 'disable' && m === 'PATCH') {\n                const id = decodeURIComponent(parts[0]);\n                const pkg = registry.disablePackage(id);\n                if (!pkg) return { handled: true, response: this.error(`Package '${id}' not found`, 404) };\n                return { handled: true, response: this.success(pkg) };\n            }\n\n            // POST /packages/:id/publish → publish package metadata\n            if (parts.length === 2 && parts[1] === 'publish' && m === 'POST') {\n                const id = decodeURIComponent(parts[0]);\n                const metadataService = await this.getService(CoreServiceName.enum.metadata);\n                if (metadataService && typeof (metadataService as any).publishPackage === 'function') {\n                    const result = await (metadataService as any).publishPackage(id, body || {});\n                    return { handled: true, response: this.success(result) };\n                }\n                return { handled: true, response: this.error('Metadata service not available', 503) };\n            }\n\n            // POST /packages/:id/revert → revert package to last published state\n            if (parts.length === 2 && parts[1] === 'revert' && m === 'POST') {\n                const id = decodeURIComponent(parts[0]);\n                const metadataService = await this.getService(CoreServiceName.enum.metadata);\n                if (metadataService && typeof (metadataService as any).revertPackage === 'function') {\n                    await (metadataService as any).revertPackage(id);\n                    return { handled: true, response: this.success({ success: true }) };\n                }\n                return { handled: true, response: this.error('Metadata service not available', 503) };\n            }\n\n            // GET /packages/:id → get package\n            if (parts.length === 1 && m === 'GET') {\n                const id = decodeURIComponent(parts[0]);\n                const pkg = registry.getPackage(id);\n                if (!pkg) return { handled: true, response: this.error(`Package '${id}' not found`, 404) };\n                return { handled: true, response: this.success(pkg) };\n            }\n\n            // DELETE /packages/:id → uninstall package\n            if (parts.length === 1 && m === 'DELETE') {\n                const id = decodeURIComponent(parts[0]);\n                const success = registry.uninstallPackage(id);\n                if (!success) return { handled: true, response: this.error(`Package '${id}' not found`, 404) };\n                return { handled: true, response: this.success({ success: true }) };\n            }\n        } catch (e: any) {\n            return { handled: true, response: this.error(e.message, e.statusCode || 500) };\n        }\n\n        return { handled: false };\n    }\n\n    /**\n     * Cloud / Environment Control-Plane routes.\n     *\n     *  - GET    /cloud/drivers                                 → list registered ObjectQL drivers (for env provisioning)\n     *  - GET    /cloud/environments                            → list\n     *  - POST   /cloud/environments                            → provision (driver: memory | turso | <any registered driver>)\n     *  - GET    /cloud/environments/:id                        → detail (+ db, credential, membership)\n     *  - PATCH  /cloud/environments/:id                        → update displayName / plan / status / isDefault / metadata\n     *  - DELETE /cloud/environments/:id[?force=1]              → cascade-delete the project (cred/member/package install rows + physical DB)\n     *  - DELETE /cloud/organizations/:id                   → cascade-delete every project (and its DB) for the org, then drop the org\n     *  - POST   /cloud/environments/:id/retry                  → re-run provisioning for a failed environment\n     *  - POST   /cloud/environments/:id/activate               → mark as active for session (stub)\n     *  - POST   /cloud/environments/:id/credentials/rotate     → rotate credential\n     *  - GET    /cloud/environments/:id/members                → list members\n     *  - GET    /cloud/environments/:id/packages               → list installed packages\n     *  - POST   /cloud/environments/:id/packages               → install package into env\n     *  - GET    /cloud/environments/:id/packages/:pkgId        → get installation detail\n     *  - PATCH  /cloud/environments/:id/packages/:pkgId/enable  → enable package\n     *  - PATCH  /cloud/environments/:id/packages/:pkgId/disable → disable package\n     *  - DELETE /cloud/environments/:id/packages/:pkgId        → uninstall (scope=platform forbidden)\n     *  - POST   /cloud/environments/:id/packages/:pkgId/upgrade → upgrade to newer version\n     *\n     * Driver binding\n     * --------------\n     * Environments are not tied to any specific driver. At provisioning time the\n     * caller passes `driver` (a short name such as `memory`, `turso`, or any\n     * future `sql` / `postgres` driver). The dispatcher validates the name\n     * against the kernel's registered driver services (`driver.<name>`) and\n     * derives an appropriate placeholder `database_url` for the chosen driver.\n     * If `driver` is omitted, the dispatcher auto-selects the first available\n     * in preference order: turso → memory → any other registered driver.\n     *\n     * Backed by ObjectQL sys_environment / sys_environment_credential /\n     * sys_environment_member tables (registered by\n     * `@objectstack/service-tenant`'s `createTenantPlugin`).\n     * Physical database addressing (database_url, database_driver, etc.)\n     * is stored directly on the sys_environment row.\n     */\n    /**\n     * Resolve the calling user id from the request session, if any.\n     * Returns `undefined` for anonymous calls or when auth is not wired up.\n     */\n    private async resolveActiveOrganizationId(context: HttpProtocolContext): Promise<string | undefined> {\n        try {\n            const authService: any = await this.resolveService(CoreServiceName.enum.auth);\n            const rawHeaders = context.request?.headers;\n            let headers: any = rawHeaders;\n            if (rawHeaders && typeof rawHeaders === 'object' && typeof (rawHeaders as any).get !== 'function') {\n                try {\n                    const h = new Headers();\n                    for (const [k, v] of Object.entries(rawHeaders as Record<string, any>)) {\n                        if (v == null) continue;\n                        h.set(k, Array.isArray(v) ? v.join(', ') : String(v));\n                    }\n                    headers = h;\n                } catch {\n                    headers = rawHeaders;\n                }\n            }\n            const apiObj = authService?.auth?.api ?? authService?.api;\n            const sessionData = await apiObj?.getSession?.call(apiObj, { headers });\n            const oid = sessionData?.session?.activeOrganizationId;\n            return typeof oid === 'string' && oid.length > 0 ? oid : undefined;\n        } catch {\n            return undefined;\n        }\n    }\n\n    private async resolveCallerUserId(context: HttpProtocolContext): Promise<string | undefined> {\n        try {\n            const authService: any = await this.resolveService(CoreServiceName.enum.auth);\n            const rawHeaders = context.request?.headers;\n            // better-auth's `getSession` expects a `Headers` instance (or a plain\n            // object that the better-auth SDK happens to coerce). Hono's adapter\n            // hands us a `Record<string, string>` of lowercased header names, so\n            // convert to `Headers` to be safe.\n            let headers: any = rawHeaders;\n            if (rawHeaders && typeof rawHeaders === 'object' && typeof (rawHeaders as any).get !== 'function') {\n                try {\n                    const h = new Headers();\n                    for (const [k, v] of Object.entries(rawHeaders as Record<string, any>)) {\n                        if (v == null) continue;\n                        h.set(k, Array.isArray(v) ? v.join(', ') : String(v));\n                    }\n                    headers = h;\n                } catch {\n                    headers = rawHeaders;\n                }\n            }\n            const sessionData = await (authService?.auth?.api?.getSession ?? authService?.api?.getSession)?.call(\n                authService?.auth?.api ?? authService?.api,\n                { headers },\n            );\n            return sessionData?.user?.id ?? sessionData?.session?.userId;\n        } catch (e: any) {\n            return undefined;\n        }\n    }\n\n    async handleCloud(path: string, method: string, body: any, query: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        const m = method.toUpperCase();\n        const parts = path.replace(/^\\/+/, '').split('/').filter(Boolean);\n\n        const qlService = await this.getObjectQLService();\n        const ql = qlService ?? await this.resolveService('objectql');\n        if (!ql) {\n            return { handled: true, response: this.error('Project service not available (ObjectQL missing)', 503) };\n        }\n\n        const ENV = 'sys_environment';\n        const CRED = 'sys_environment_credential';\n        const MEM = 'sys_environment_member';\n        const PKG_INSTALL = 'sys_package_installation';\n        const PKG = 'sys_package';\n        const PKG_VERSION = 'sys_package_version';\n\n        /**\n         * Upsert a `sys_package` row keyed by `manifest_id`. Auto-publishes the\n         * package metadata from the in-memory registry the first time a project\n         * tries to install it. Returns the row id (UUID).\n         */\n        const ensureSysPackage = async (\n            manifestId: string,\n            ownerOrgId: string,\n            createdBy: string,\n            manifest?: any,\n        ): Promise<string> => {\n            const existing = await ql.findOne(PKG, { where: { manifest_id: manifestId } } as any) as any;\n            if (existing?.id) return existing.id;\n            const id = randomUUID();\n            const nowIso = new Date().toISOString();\n            await ql.insert(PKG, {\n                id,\n                manifest_id: manifestId,\n                owner_org_id: ownerOrgId,\n                display_name: manifest?.name ?? manifestId,\n                description: manifest?.description ?? null,\n                visibility: 'private',\n                created_by: createdBy,\n                created_at: nowIso,\n                updated_at: nowIso,\n            });\n            return id;\n        };\n\n        /**\n         * Upsert a `sys_package_version` row keyed by (package_id, version).\n         * Auto-publishes a version snapshot the first time it is referenced.\n         * Returns the row id (UUID).\n         */\n        const ensureSysPackageVersion = async (\n            packageId: string,\n            version: string,\n            createdBy: string,\n            manifest?: any,\n        ): Promise<string> => {\n            const existing = await ql.findOne(PKG_VERSION, {\n                where: { package_id: packageId, version },\n            } as any) as any;\n            if (existing?.id) return existing.id;\n            const id = randomUUID();\n            const nowIso = new Date().toISOString();\n            await ql.insert(PKG_VERSION, {\n                id,\n                package_id: packageId,\n                version,\n                status: 'published',\n                manifest_json: manifest ? JSON.stringify(manifest) : null,\n                is_pre_release: false,\n                published_at: nowIso,\n                published_by: createdBy,\n                created_by: createdBy,\n                created_at: nowIso,\n                updated_at: nowIso,\n            });\n            return id;\n        };\n\n        /**\n         * Resolve a per-project install record by the user-facing manifest id\n         * (e.g. `com.objectstack.audit`). The schema stores `package_id` as a\n         * sys_package UUID, so we must join through sys_package first.\n         */\n        const findInstallByManifestId = async (\n            envId: string,\n            manifestId: string,\n        ): Promise<any | null> => {\n            const pkgRow = await ql.findOne(PKG, { where: { manifest_id: manifestId } } as any) as any;\n            if (!pkgRow?.id) return null;\n            return await ql.findOne(PKG_INSTALL, {\n                where: { environment_id: envId, package_id: pkgRow.id },\n            } as any);\n        };\n\n        // Enumerate registered ObjectQL drivers. Driver services are registered\n        // by `DriverPlugin` under the key `driver.<driver.name>` where\n        // `driver.name` is typically the full FQN like `com.objectstack.driver.memory`.\n        // We derive a short name by stripping the `com.objectstack.driver.` prefix.\n        const toShortName = (driverId: string): string => {\n            const prefix = 'com.objectstack.driver.';\n            return driverId.startsWith(prefix) ? driverId.slice(prefix.length) : driverId;\n        };\n        const listRegisteredDrivers = (): Array<{ name: string; driverId: string }> => {\n            const services = this.getServicesMap();\n            // Prefer the provisioning-adapter registry installed by the tenant\n            // plugin — it exposes the *logical* storage backends the\n            // control-plane can actually allocate a project against (memory /\n            // sqlite / turso / ...). The raw ObjectQL `driver.*` services are\n            // a deeper layer (e.g. a single unified `sql` driver that covers\n            // better-sqlite3 + libsql + pg + mysql) and collapse the user's\n            // meaningful choices into one row, so they make a poor UI source.\n            const registry: any = services['project-provisioning-adapters'];\n            if (registry && typeof registry.list === 'function') {\n                try {\n                    const adapters = registry.list() as Array<{ driver: string }>;\n                    const seen = new Set<string>();\n                    const drivers: Array<{ name: string; driverId: string }> = [];\n                    for (const adapter of adapters ?? []) {\n                        const name = adapter?.driver;\n                        if (!name || seen.has(name)) continue;\n                        seen.add(name);\n                        drivers.push({ name, driverId: `com.objectstack.driver.${name}` });\n                    }\n                    if (drivers.length > 0) return drivers;\n                } catch {\n                    // Adapter registry unusable — fall through to the legacy scan.\n                }\n            }\n            const drivers: Array<{ name: string; driverId: string }> = [];\n            for (const [serviceKey, svc] of Object.entries(services)) {\n                if (!serviceKey.startsWith('driver.')) continue;\n                const raw = serviceKey.slice('driver.'.length);\n                if (!raw || raw === 'unknown') continue;\n                const driverId = (svc as any)?.name ?? raw;\n                drivers.push({ name: toShortName(driverId), driverId });\n            }\n            return drivers;\n        };\n\n        const resolveDriver = (requested: string | undefined): { name: string; driverId: string } | undefined => {\n            const registered = listRegisteredDrivers();\n            if (requested) {\n                const wanted = String(requested).toLowerCase();\n                return registered.find((d) => d.name === wanted || d.driverId === wanted);\n            }\n            // Auto-pick: prefer turso, then memory, then whatever is available.\n            return (\n                registered.find((d) => d.name === 'turso') ??\n                registered.find((d) => d.name === 'memory') ??\n                registered[0]\n            );\n        };\n\n        const buildDatabaseUrl = (driverName: string, environmentId: string): string => {\n            const dbName = `env-${environmentId}`;\n            switch (driverName) {\n                case 'memory':\n                    return `memory://${dbName}`;\n                case 'turso':\n                    return `libsql://${dbName}.mock-turso.local`;\n                default:\n                    // Generic placeholder for future SQL / postgres / mysql drivers.\n                    return `${driverName}://${dbName}`;\n            }\n        };\n\n        /**\n         * Real physical-DB adapter resolver. Looks up the\n         * `environment-provisioning-adapters` service registered by the\n         * tenant plugin. When present, provisioning actually creates a file\n         * on disk (sqlite adapter) or a Turso cloud DB (when TURSO_ORG_NAME\n         * + TURSO_API_TOKEN are set).\n         *\n         * Returns `undefined` if the service is not registered. In that\n         * case the dispatcher falls back to the mock-URL behaviour — the\n         * state machine still works, but no real DB file is created.\n         */\n        const getRealAdapter = async (\n            driverName: string,\n        ): Promise<{\n            createDatabase(params: {\n                environmentId: string;\n                databaseName: string;\n                region: string;\n                storageLimitMb: number;\n            }): Promise<{ databaseUrl: string; plaintextSecret: string }>;\n            deleteDatabase?(params: {\n                environmentId: string;\n                databaseName: string;\n                databaseUrl?: string;\n            }): Promise<void>;\n        } | undefined> => {\n            try {\n                const registry: any = await this.resolveService('project-provisioning-adapters');\n                // Alias the generic 'sql' short name onto the SQLite\n                // provisioning adapter. `sql` is SqlDriver's default short\n                // name when registered via DriverPlugin; provisioning\n                // adapters key themselves by the logical driver family\n                // ('sqlite', 'turso', 'memory') not the implementation id.\n                const aliases: Record<string, string> = { sql: 'sqlite' };\n                const effective = aliases[driverName] ?? driverName;\n                return registry?.get?.(effective) ?? registry?.get?.(driverName);\n            } catch {\n                return undefined;\n            }\n        };\n\n        const findOne = async (obj: string, where: Record<string, unknown>): Promise<any | undefined> => {\n            let rows = await ql.find(obj, { where } as any);\n            if (rows && (rows as any).value) rows = (rows as any).value;\n            if (!Array.isArray(rows)) return undefined;\n            return rows[0];\n        };\n\n        // Data crosses the wire as snake_case — matching the canonical\n        // `sys_environment` schema. The only post-processing is JSON-parsing the\n        // `metadata` column so consumers don't need to unwrap it.\n        const cleanProjectRow = (row: any): any => {\n            if (!row) return row;\n            let metadata: any = row.metadata;\n            if (typeof metadata === 'string') {\n                try { metadata = JSON.parse(metadata); } catch { /* keep raw string if not JSON */ }\n            }\n            return { ...row, metadata };\n        };\n\n        try {\n            // ----- /cloud/drivers ------------------------------------------\n            if (parts.length === 1 && parts[0] === 'drivers' && m === 'GET') {\n                const drivers = listRegisteredDrivers();\n                return { handled: true, response: this.success({ drivers, total: drivers.length }) };\n            }\n\n            // ----- /cloud/templates ----------------------------------------\n            if (parts.length === 1 && parts[0] === 'templates' && m === 'GET') {\n                try {\n                    const seeder: any = await this.resolveService('template-seeder');\n                    const templates = seeder?.listTemplates?.() ?? [];\n                    return { handled: true, response: this.success({ templates, total: templates.length }) };\n                } catch (err: any) {\n                    // Don't silently mask — log the real reason. Empty templates\n                    // here usually means MultiProjectPlugin failed to register\n                    // `template-seeder` (e.g. control-driver init error).\n                    try {\n                        // eslint-disable-next-line no-console\n                        console.error('[HttpDispatcher] /cloud/templates: failed to resolve template-seeder:', err?.message ?? err);\n                    } catch { /* noop */ }\n                    return { handled: true, response: this.success({ templates: [], total: 0 }) };\n                }\n            }\n\n            // ----- POST /cloud/admin/platform-sso/backfill ----------------\n            // Idempotent admin trigger: scans `sys_environment` and ensures every\n            // active project has a corresponding `sys_oauth_application` row\n            // for platform SSO (\"Airtable-style unified login\"). Safe to call\n            // any number of times — re-running with the same project is a\n            // no-op for existing rows and only patches in missing\n            // redirect_uris. Requires the caller to bear a Bearer token\n            // equal to OS_AUTH_SECRET (the shared cloud/objectos secret),\n            // since the boot-time backfill plugin can be flaky on cold-start\n            // and operators need an out-of-band way to recover.\n            if (parts.length === 3\n                && parts[0] === 'admin'\n                && parts[1] === 'platform-sso'\n                && parts[2] === 'backfill'\n                && m === 'POST') {\n                const baseSecret = (process.env.OS_AUTH_SECRET ?? process.env.AUTH_SECRET ?? '').trim();\n                if (!baseSecret) {\n                    return { handled: true, response: this.error('OS_AUTH_SECRET not configured on this worker', 503) };\n                }\n                const rawHeaders = _context?.request?.headers;\n                let authHeader: string | undefined;\n                if (rawHeaders && typeof (rawHeaders as any).get === 'function') {\n                    authHeader = (rawHeaders as any).get('authorization') ?? undefined;\n                } else if (rawHeaders && typeof rawHeaders === 'object') {\n                    authHeader = (rawHeaders as any)['authorization'] ?? (rawHeaders as any)['Authorization'];\n                }\n                const presented = typeof authHeader === 'string' && authHeader.startsWith('Bearer ')\n                    ? authHeader.slice(7).trim()\n                    : '';\n                if (!presented || presented !== baseSecret) {\n                    return { handled: true, response: this.error('forbidden: Bearer token must match OS_AUTH_SECRET', 403) };\n                }\n                try {\n                    const { backfillPlatformSsoClients } = await import('./cloud/platform-sso.js');\n                    const result = await backfillPlatformSsoClients({\n                        ql,\n                        baseSecret,\n                        logger: console,\n                    });\n                    // Dump a few rows so we can confirm the data actually\n                    // matches what better-auth's oauth-provider expects.\n                    let sample: any[] = [];\n                    let total = 0;\n                    try {\n                        const rows = await (ql as any).find('sys_oauth_application', { limit: 5 }, { context: { isSystem: true } });\n                        const list = Array.isArray(rows) ? rows : Array.isArray(rows?.records) ? rows.records : [];\n                        sample = list;\n                        total = typeof (rows as any)?.total === 'number' ? (rows as any).total : list.length;\n                    } catch (e: any) {\n                        sample = [{ _readErr: e?.message ?? String(e) }];\n                    }\n                    return { handled: true, response: this.success({ ...result, total, sample }) };\n                } catch (err: any) {\n                    return { handled: true, response: this.error(`backfill failed: ${err?.message ?? String(err)}`, 500) };\n                }\n            }\n\n            // ----- /cloud/environments collection routes -----\n            if (parts.length === 1 && parts[0] === 'projects' && m === 'GET') {\n                const where: Record<string, unknown> = {};\n                if (query?.organizationId) where.organization_id = query.organizationId;\n                if (query?.status) where.status = query.status;\n                let rows = await ql.find(ENV, Object.keys(where).length ? ({ where } as any) : undefined);\n                if (rows && (rows as any).value) rows = (rows as any).value;\n                const projects = (Array.isArray(rows) ? rows : []).map(cleanProjectRow);\n                return { handled: true, response: this.success({ projects, total: projects.length }) };\n            }\n\n            if (parts.length === 1 && parts[0] === 'projects' && m === 'POST') {\n                const req = body || {};\n                // Resolve `__session__` placeholders from the active session so clients\n                // can omit these fields and let the server infer them.\n                // Use `resolveCallerUserId` which properly converts plain header\n                // objects to `Headers` instances and probes both\n                // `authService.auth.api.getSession` and `authService.api.getSession`\n                // (better-auth's API shape differs across wrappings).\n                if (req.organization_id === '__session__' || req.created_by === '__session__') {\n                    try {\n                        const userId = await this.resolveCallerUserId(_context);\n                        if (req.created_by === '__session__') {\n                            req.created_by = userId ?? 'system';\n                        }\n                        if (req.organization_id === '__session__') {\n                            // We still need the activeOrganizationId — fetch the\n                            // session directly via the helper-built Headers.\n                            const authService: any = await this.resolveService(CoreServiceName.enum.auth);\n                            const rawHeaders = _context?.request?.headers;\n                            let headers: any = rawHeaders;\n                            if (rawHeaders && typeof rawHeaders === 'object' && typeof (rawHeaders as any).get !== 'function') {\n                                const h = new Headers();\n                                for (const [k, v] of Object.entries(rawHeaders as Record<string, any>)) {\n                                    if (v == null) continue;\n                                    h.set(k, Array.isArray(v) ? v.join(', ') : String(v));\n                                }\n                                headers = h;\n                            }\n                            const apiObj = authService?.auth?.api ?? authService?.api;\n                            const sessionData = await apiObj?.getSession?.call(apiObj, { headers });\n                            req.organization_id = sessionData?.session?.activeOrganizationId ?? undefined;\n                        }\n                    } catch {\n                        // Fall through — validation below will reject missing fields.\n                    }\n                }\n                if (!req.organization_id || !req.display_name) {\n                    return { handled: true, response: this.error('organization_id and display_name are required', 400) };\n                }\n                const environmentId = randomUUID();\n                const credentialId = randomUUID();\n                const nowIso = new Date().toISOString();\n\n                // Bind environment to a driver. `req.driver` is optional — any\n                // registered ObjectQL driver is accepted (memory / turso / future\n                // sql / postgres). If omitted, pick the best default available.\n                const resolved = resolveDriver(req.driver);\n                if (!resolved) {\n                    const available = listRegisteredDrivers().map((d) => d.name);\n                    if (req.driver) {\n                        return {\n                            handled: true,\n                            response: this.error(\n                                `Unknown driver '${req.driver}'. Available drivers: [${available.join(', ') || 'none'}]`,\n                                400,\n                            ),\n                        };\n                    }\n                    return {\n                        handled: true,\n                        response: this.error(\n                            'No ObjectQL driver is registered. Register at least one DriverPlugin (e.g. InMemoryDriver or TursoDriver).',\n                            503,\n                        ),\n                    };\n                }\n                const driver = resolved.name;\n                let plaintextSecret = `mock-token-${environmentId}`;\n\n                // Compute hostname if not provided.\n                // Format: {org-slug}-{short-project-id}.{rootDomain}\n                // Uses the first 8 chars of the UUID as a stable, collision-free\n                // suffix now that projects no longer carry a user-facing slug.\n                let computedHostname = req.hostname;\n                if (!computedHostname) {\n                    const shortId = environmentId.slice(0, 8);\n                    try {\n                        const orgRow = await findOne('sys_organization', { id: req.organization_id });\n                        const orgSlug = orgRow?.slug || req.organization_id;\n                        const rootDomain = getEnv('OS_ROOT_DOMAIN') ?? getEnv('ROOT_DOMAIN', 'objectstack.app');\n                        computedHostname = `${orgSlug}-${shortId}.${rootDomain}`;\n                    } catch {\n                        // Fallback if sys_organization doesn't exist\n                        computedHostname = `${req.organization_id}-${shortId}.objectstack.app`;\n                    }\n                }\n\n                // Hostname pre-flight: surface a clean 409 before we\n                // kick off fire-and-forget provisioning, so the client\n                // gets an actionable error rather than a silent\n                // status: 'failed' + metadata.provisioningError later.\n                // The sys_environment.hostname column is UNIQUE at the DB\n                // layer but that constraint would only trip during\n                // insert — by which point the caller has already moved\n                // on from the HTTP response.\n                try {\n                    const existing = await findOne('sys_environment', {\n                        hostname: computedHostname,\n                    });\n                    if (existing && existing.id !== environmentId) {\n                        return {\n                            handled: true,\n                            response: this.error(\n                                `Hostname '${computedHostname}' is already in use by another project.`,\n                                409,\n                                { code: 'HOSTNAME_TAKEN', hostname: computedHostname },\n                            ),\n                        };\n                    }\n                } catch {\n                    // sys_environment table may not yet be ready (first-run cold\n                    // boot) — fall through and let the DB enforce uniqueness.\n                }\n\n                // Insert environment row in `provisioning` state first so the\n                // UI can show a \"Provisioning…\" indicator while the driver\n                // handshake runs in the background. Status transitions to\n                // `active` on success, or `failed` (+metadata.provisioningError)\n                // on unrecoverable errors.\n                const baseMetadata: Record<string, unknown> = { ...(req.metadata ?? {}) };\n                // Dev-only: callers can set `metadata.__simulateFailure = true`\n                // (or `__simulateDelayMs = N`) to exercise the provisioning /\n                // failed / retry state machine end-to-end without a real driver.\n                const simulateFailure = Boolean((baseMetadata as any).__simulateFailure);\n                const simulateDelayMs = Number((baseMetadata as any).__simulateDelayMs ?? 1500);\n\n                // Capture project-owner identity so the per-project kernel can\n                // pre-seed a `sys_user` row for this person on first boot.\n                // Without this, the owner lands on their own project as a\n                // brand-new SSO JIT user (no admin role, no membership) and\n                // has to manually promote themselves. Best-effort: failure\n                // to resolve must not abort project creation.\n                try {\n                    // Prefer the value already resolved by the upstream\n                    // `__session__` block (now backed by `resolveCallerUserId`);\n                    // fall back to `resolveCallerUserId` directly for callers\n                    // that omitted `created_by` entirely.\n                    let ownerUserId: string | undefined =\n                        req.created_by && req.created_by !== 'system'\n                            ? String(req.created_by)\n                            : undefined;\n                    if (!ownerUserId) {\n                        ownerUserId = await this.resolveCallerUserId(_context);\n                    }\n                    if (ownerUserId) {\n                        const userRow = await ql.find('sys_user', { where: { id: ownerUserId } } as any);\n                        const userRows = Array.isArray(userRow) ? userRow : (userRow?.value ?? []);\n                        const u = Array.isArray(userRows) && userRows.length > 0 ? userRows[0] : null;\n                        if (u?.email) {\n                            (baseMetadata as any).ownerSeed = {\n                                userId: String(ownerUserId),\n                                email: String(u.email),\n                                name: u.name ? String(u.name) : null,\n                                image: u.image ? String(u.image) : null,\n                            };\n                        }\n                    }\n                } catch {\n                    // owner lookup failed entirely — skip seed; later access\n                    // flows still work via the platform-SSO JIT path.\n                }\n\n                // Also capture the OWNING cloud org so the per-project\n                // kernel can mirror it into the project's `sys_organization`\n                // table on first boot. Without this, SecurityPlugin's\n                // `ensureUserHasOrganization` middleware would auto-create a\n                // disjoint \"Alice's Workspace\" personal org for the owner,\n                // completely detached from the cloud team that actually\n                // owns the project at the platform level. Best-effort: a\n                // missing org row only means the project's primary\n                // workspace falls back to the personal-org pattern.\n                try {\n                    const orgRow = await ql.find('sys_organization', { where: { id: req.organization_id } } as any);\n                    const orgRows = Array.isArray(orgRow) ? orgRow : (orgRow?.value ?? []);\n                    const org = Array.isArray(orgRows) && orgRows.length > 0 ? orgRows[0] : null;\n                    if (org?.id && org?.name) {\n                        (baseMetadata as any).orgSeed = {\n                            id: String(org.id),\n                            name: String(org.name),\n                            slug: org.slug ? String(org.slug) : null,\n                            logo: org.logo ? String(org.logo) : null,\n                        };\n                    }\n                } catch {\n                    // org lookup failed — skip the mirror. Owner seed\n                    // still works; the user will land in the auto-created\n                    // personal workspace as before.\n                }\n                await ql.insert(ENV, {\n                    id: environmentId,\n                    organization_id: req.organization_id,\n                    display_name: req.display_name,\n                    is_default: req.is_default ?? false,\n                    is_system: req.is_system ?? false,\n                    plan: req.plan ?? 'free',\n                    status: 'provisioning',\n                    created_by: req.created_by ?? 'system',\n                    metadata: JSON.stringify(baseMetadata),\n                    created_at: nowIso,\n                    updated_at: nowIso,\n                    database_url: null,\n                    database_driver: driver,\n                    storage_limit_mb: req.storage_limit_mb ?? 1024,\n                    provisioned_at: null,\n                    hostname: computedHostname,\n                    visibility: (() => {\n                        const raw = String(req.visibility ?? 'private');\n                        return raw === 'unlisted' ? 'private' : raw;\n                    })(),\n                });\n\n                // Platform SSO seed: register a `sys_oauth_application` row\n                // so the per-project runtime can immediately exchange\n                // authorization codes with this cloud control plane. Best\n                // effort — failures are logged but do NOT abort the\n                // project-create flow (the project remains usable with\n                // email/password sign-in as the legacy fallback).\n                try {\n                    const { seedPlatformSsoClient } = await import('./cloud/platform-sso.js');\n                    const baseSecret = (process.env.OS_AUTH_SECRET ?? process.env.AUTH_SECRET ?? '').trim();\n                    if (baseSecret) {\n                        await seedPlatformSsoClient({\n                            ql,\n                            environmentId,\n                            hostname: computedHostname,\n                            baseSecret,\n                            logger: console,\n                        });\n                    }\n                } catch (ssoErr) {\n                    console.warn?.('[http-dispatcher] platform SSO seed failed (non-fatal)', {\n                        environmentId,\n                        error: (ssoErr as Error)?.message,\n                    });\n                }\n\n                // Fire-and-forget the provisioning work so the POST returns\n                // immediately with a `provisioning` record. The UI can then\n                // refresh (or poll) to observe the transition.\n                const runProvisioning = async (): Promise<void> => {\n                    try {\n                        if (simulateDelayMs > 0) {\n                            await new Promise((r) => setTimeout(r, simulateDelayMs));\n                        }\n                        if (simulateFailure) {\n                            throw new Error('Simulated provisioning failure (metadata.__simulateFailure=true)');\n                        }\n                        // Try a real adapter first (creates a real sqlite file\n                        // or Turso cloud DB). Fall back to the mock URL if no\n                        // adapter is registered for this driver.\n                        let databaseUrl: string;\n                        try {\n                            const adapter = await getRealAdapter(driver);\n                            if (adapter) {\n                                const result = await adapter.createDatabase({\n                                    environmentId,\n                                    databaseName: `p-${environmentId.replace(/-/g, \"\").slice(0, 24)}`,\n                                    region: 'us-east-1',\n                                    storageLimitMb: req.storage_limit_mb ?? 1024,\n                                });\n                                databaseUrl = result.databaseUrl;\n                                if (result.plaintextSecret) plaintextSecret = result.plaintextSecret;\n                            } else {\n                                databaseUrl = buildDatabaseUrl(driver, environmentId);\n                            }\n                        } catch (adapterErr) {\n                            // Adapter call failed (e.g. Turso API down). Surface\n                            // the underlying message — the outer catch will flip\n                            // the env to `failed`.\n                            throw adapterErr instanceof Error\n                                ? adapterErr\n                                : new Error(String(adapterErr));\n                        }\n                        // Persist `database_url` first (still `provisioning`) so\n                        // kernel-factory / template-seeder can resolve the\n                        // physical DB while seeding runs. Status flips to\n                        // `active` only AFTER seeding completes — clients\n                        // polling `waitForActive` then know the project's\n                        // schema and seed data are queryable.\n                        const seedStartedAt = new Date().toISOString();\n                        await ql.update(\n                            ENV,\n                            {\n                                database_url: databaseUrl,\n                                updated_at: seedStartedAt,\n                            },\n                            { where: { id: environmentId } } as any,\n                        );\n                        await ql.insert(CRED, {\n                            id: credentialId,\n                            environment_id: environmentId,\n                            secret_ciphertext: plaintextSecret,\n                            encryption_key_id: 'noop',\n                            authorization: 'full_access',\n                            status: 'active',\n                            created_at: seedStartedAt,\n                            updated_at: seedStartedAt,\n                        });\n\n                        // Seed template metadata into the newly-provisioned project.\n                        // Non-fatal: errors are stored in sys_environment.metadata so the\n                        // project stays `active` even if template seeding fails.\n                        const templateId = req.template_id ?? 'blank';\n                        if (templateId !== 'blank') {\n                            try {\n                                const seeder: any = await this.resolveService('template-seeder');\n                                if (seeder) {\n                                    await seeder.seed({ environmentId, templateId });\n                                }\n                            } catch (seedErr) {\n                                const seedMessage = seedErr instanceof Error ? seedErr.message : String(seedErr);\n                                // Persist seed error in metadata (non-fatal — project is active).\n                                try {\n                                    const existing = await findOne(ENV, { id: environmentId });\n                                    const existingMeta = typeof existing?.metadata === 'string'\n                                        ? JSON.parse(existing.metadata)\n                                        : (existing?.metadata ?? {});\n                                    await ql.update(\n                                        ENV,\n                                        {\n                                            metadata: JSON.stringify({\n                                                ...existingMeta,\n                                                templateSeedError: { message: seedMessage, templateId },\n                                            }),\n                                        },\n                                        { where: { id: environmentId } } as any,\n                                    );\n                                } catch {\n                                    // Best-effort metadata update — ignore secondary failure.\n                                }\n                            }\n                        }\n\n                        // Bind a third-party developer's locally compiled artifact\n                        // into this project. The caller passes\n                        // `metadata.artifact_path` (path to a compiled\n                        // ObjectStack bundle JSON) and we delegate to the same\n                        // seeder pipeline that templates use. Resolved relative\n                        // to OS_PROJECT_ARTIFACT_ROOT (or process.cwd\n                        // if unset). Uses the shared `loadArtifactBundle`\n                        // helper (read JSON + dynamic-import sibling\n                        // runtime ESM + merge `functions` map) so this path\n                        // stays in lockstep with FsAppBundleResolver and\n                        // runtime-stack basePlugins.\n                        const artifactPathRaw = (baseMetadata as any).artifact_path;\n                        if (typeof artifactPathRaw === 'string' && artifactPathRaw.length > 0) {\n                            try {\n                                const path = await import('node:path');\n                                const { isHttpUrl, loadArtifactBundle } = await import('./load-artifact-bundle.js');\n                                const root = process.env.OS_PROJECT_ARTIFACT_ROOT\n                                    ?? process.cwd();\n                                const resolved = isHttpUrl(artifactPathRaw)\n                                    ? artifactPathRaw\n                                    : (path.isAbsolute(artifactPathRaw)\n                                        ? artifactPathRaw\n                                        : path.resolve(root, artifactPathRaw));\n                                const bundle = await loadArtifactBundle(resolved, { tag: '[bind-artifact]' });\n                                if (!bundle) {\n                                    throw new Error(`failed to load artifact bundle at '${resolved}'`);\n                                }\n                                const seeder: any = await this.resolveService('template-seeder');\n                                if (seeder?.seedBundle) {\n                                    await seeder.seedBundle({ environmentId, bundle });\n                                } else {\n                                    throw new Error('template-seeder.seedBundle is unavailable');\n                                }\n                            } catch (bindErr) {\n                                const bindMessage = bindErr instanceof Error ? bindErr.message : String(bindErr);\n                                try {\n                                    const existing = await findOne(ENV, { id: environmentId });\n                                    const existingMeta = typeof existing?.metadata === 'string'\n                                        ? JSON.parse(existing.metadata)\n                                        : (existing?.metadata ?? {});\n                                    await ql.update(\n                                        ENV,\n                                        {\n                                            metadata: JSON.stringify({\n                                                ...existingMeta,\n                                                artifactBindError: { message: bindMessage, artifactPath: artifactPathRaw },\n                                            }),\n                                        },\n                                        { where: { id: environmentId } } as any,\n                                    );\n                                } catch {\n                                    // Best-effort metadata update — ignore secondary failure.\n                                }\n                            }\n                        }\n\n                        // All seeding + binding completed (or recorded as\n                        // non-fatal errors). Flip the project to `active` so\n                        // request routing + waitForActive observers can see\n                        // the project as ready.\n                        const finishedAt = new Date().toISOString();\n                        await ql.update(\n                            ENV,\n                            {\n                                status: 'active',\n                                provisioned_at: finishedAt,\n                                updated_at: finishedAt,\n                            },\n                            { where: { id: environmentId } } as any,\n                        );\n                    } catch (err) {\n                        const message = err instanceof Error ? err.message : String(err);\n                        const failedAt = new Date().toISOString();\n                        await ql.update(\n                            ENV,\n                            {\n                                status: 'failed',\n                                metadata: JSON.stringify({\n                                    ...baseMetadata,\n                                    provisioningError: { message, failedAt },\n                                }),\n                                updated_at: failedAt,\n                            },\n                            { where: { id: environmentId } } as any,\n                        );\n                    }\n                };\n                // On serverless platforms (Vercel/AWS Lambda/Netlify) the\n                // function instance freezes the moment we send the response,\n                // so a fire-and-forget background task never gets to\n                // persist `database_url` — leaving every subsequent request\n                // to crash with \"Project … missing database_url/database_driver\".\n                // Auto-detect those environments and await the provisioning\n                // inline. Operators can also force this with\n                // `OS_PROVISION_SYNC=1` (or disable with `=0`).\n                const provisionSyncEnv = process.env.OS_PROVISION_SYNC;\n                const onServerless = !!(\n                    process.env.VERCEL\n                    || process.env.AWS_LAMBDA_FUNCTION_NAME\n                    || process.env.NETLIFY\n                    || process.env.CF_PAGES\n                );\n                const syncProvisioning = provisionSyncEnv === undefined\n                    ? onServerless\n                    : provisionSyncEnv !== '0' && provisionSyncEnv !== 'false';\n                if (syncProvisioning) {\n                    await runProvisioning();\n                } else {\n                    void runProvisioning();\n                }\n\n                const project = cleanProjectRow(await findOne(ENV, { id: environmentId }));\n                const res = this.success({ project });\n                res.status = syncProvisioning ? 201 : 202;\n                return { handled: true, response: res };\n            }\n\n            // ----- /cloud/environments/:id -----\n            if (parts.length === 2 && parts[0] === 'projects') {\n                const id = decodeURIComponent(parts[1]);\n\n                if (m === 'GET') {\n                    const envRow = await findOne(ENV, { id });\n                    if (!envRow) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n                    const credRow = await findOne(CRED, { environment_id: id, status: 'active' });\n                    // Scope membership lookup to the calling user when possible so the\n                    // returned `membership.role` reflects the caller, not some other\n                    // arbitrary member of the project.\n                    const callerUserId = await this.resolveCallerUserId(_context);\n                    const membership = callerUserId\n                        ? await findOne(MEM, { environment_id: id, user_id: callerUserId })\n                        : await findOne(MEM, { environment_id: id });\n                    // Omit the ciphertext from responses — metadata only.\n                    const credMeta = credRow\n                        ? {\n                              id: credRow.id,\n                              status: credRow.status,\n                              authorization: credRow.authorization,\n                              activatedAt: credRow.created_at,\n                              expiresAt: credRow.expires_at,\n                          }\n                        : undefined;\n                    // Expose a `database` block so Studio can show physical DB\n                    // addressing directly (mirrors the legacy sys_environment_database shape).\n                    const project = cleanProjectRow(envRow);\n                    const database = project.database_url\n                        ? {\n                              driver: project.database_driver,\n                              database_name: `env-${project.id}`,\n                              database_url: project.database_url,\n                              storage_limit_mb: project.storage_limit_mb,\n                              provisioned_at: project.provisioned_at,\n                          }\n                        : undefined;\n                    return {\n                        handled: true,\n                        response: this.success({ project, database, credential: credMeta, membership }),\n                    };\n                }\n\n                if (m === 'PATCH') {\n                    const patch: Record<string, unknown> = {};\n                    if (body?.display_name !== undefined) patch.display_name = body.display_name;\n                    if (body?.plan !== undefined) patch.plan = body.plan;\n                    if (body?.status !== undefined) patch.status = body.status;\n                    if (body?.is_default !== undefined) patch.is_default = body.is_default;\n                    if (body?.visibility !== undefined) {\n                        let v = String(body.visibility);\n                        // Legacy: accept `unlisted` but persist as `private`.\n                        if (v === 'unlisted') v = 'private';\n                        if (!['private', 'public'].includes(v)) {\n                            return { handled: true, response: this.error(`Invalid visibility '${v}' (expected private | public)`, 400) };\n                        }\n                        patch.visibility = v;\n                    }\n                    if (body?.metadata !== undefined) patch.metadata = JSON.stringify(body.metadata);\n                    patch.updated_at = new Date().toISOString();\n                    await ql.update(ENV, patch, { where: { id } } as any);\n                    const envRow = await findOne(ENV, { id });\n                    if (!envRow) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n                    return { handled: true, response: this.success({ project: cleanProjectRow(envRow) }) };\n                }\n\n                if (m === 'DELETE') {\n                    const force = query?.force === '1' || query?.force === 'true' || body?.force === true;\n                    const result = await this.deleteProjectCascade(id, { ql, findOne, getRealAdapter, force });\n                    if (!result.ok) {\n                        return { handled: true, response: this.error(result.error ?? 'Delete failed', result.status ?? 500) };\n                    }\n                    return { handled: true, response: this.success({ deleted: true, environmentId: id, warnings: result.warnings }) };\n                }\n            }\n\n            // ----- /cloud/organizations/:id (DELETE only — cascades projects) -----\n            if (parts.length === 2 && parts[0] === 'organizations' && m === 'DELETE') {\n                const orgId = decodeURIComponent(parts[1]);\n                // Find every project owned by the organization and tear it down.\n                let projectRows: any[] = [];\n                try {\n                    let rows = await ql.find(ENV, { where: { organization_id: orgId } } as any);\n                    if (rows && (rows as any).value) rows = (rows as any).value;\n                    projectRows = Array.isArray(rows) ? rows : [];\n                } catch {\n                    projectRows = [];\n                }\n                const warnings: string[] = [];\n                let deletedProjects = 0;\n                for (const row of projectRows) {\n                    const pid = row?.id;\n                    if (!pid) continue;\n                    try {\n                        const r = await this.deleteProjectCascade(pid, { ql, findOne, getRealAdapter, force: true });\n                        if (r.ok) deletedProjects++;\n                        if (r.warnings?.length) warnings.push(...r.warnings);\n                        if (!r.ok && r.error) warnings.push(`Project ${pid}: ${r.error}`);\n                    } catch (err) {\n                        warnings.push(\n                            `Failed to delete project ${pid}: ${err instanceof Error ? err.message : String(err)}`,\n                        );\n                    }\n                }\n\n                // Now drop the organization itself. Prefer better-auth's\n                // organization plugin (which also cascades members /\n                // invitations / teams). Fall back to a direct sys_organization\n                // delete if the plugin isn't loaded.\n                let orgDeleted = false;\n                try {\n                    const authService: any = await this.getService(CoreServiceName.enum.auth);\n                    const fn = authService?.api?.deleteOrganization;\n                    if (typeof fn === 'function') {\n                        await fn.call(authService.api, {\n                            body: { organizationId: orgId },\n                            headers: _context?.request?.headers,\n                        });\n                        orgDeleted = true;\n                    }\n                } catch (err) {\n                    warnings.push(\n                        `auth.deleteOrganization failed: ${err instanceof Error ? err.message : String(err)}`,\n                    );\n                }\n                if (!orgDeleted) {\n                    try {\n                        await ql.delete('sys_organization', { where: { id: orgId } } as any);\n                        orgDeleted = true;\n                    } catch (err) {\n                        warnings.push(\n                            `Failed to delete sys_organization row: ${err instanceof Error ? err.message : String(err)}`,\n                        );\n                    }\n                }\n\n                return {\n                    handled: true,\n                    response: this.success({\n                        deleted: orgDeleted,\n                        organizationId: orgId,\n                        deletedProjects,\n                        warnings,\n                    }),\n                };\n            }\n\n            // ----- /cloud/environments/:id/hostname -----\n            if (parts.length === 3 && parts[0] === 'projects' && parts[2] === 'hostname' && (m === 'POST' || m === 'PUT')) {\n                const id = decodeURIComponent(parts[1]);\n                const hostname = body?.hostname;\n                if (!hostname || typeof hostname !== 'string') {\n                    return { handled: true, response: this.error('hostname is required', 400) };\n                }\n                const normalized = hostname.trim().toLowerCase();\n                if (!/^[a-z0-9]([a-z0-9\\-\\.]*[a-z0-9])?$/.test(normalized)) {\n                    return { handled: true, response: this.error('Invalid hostname format', 400) };\n                }\n                const envRow = await findOne(ENV, { id });\n                if (!envRow) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n                // Enforce uniqueness — reject if another project already owns this hostname.\n                let existing: any;\n                try {\n                    const rows = await ql.find(ENV, { where: { hostname: normalized } } as any);\n                    const arr = Array.isArray(rows) ? rows : ((rows as any)?.value ?? []);\n                    existing = arr.find((r: any) => r.id !== id);\n                } catch { /* table may be empty */ }\n                if (existing) {\n                    return {\n                        handled: true,\n                        response: this.error(\n                            `Hostname '${normalized}' is already in use by another project.`,\n                            409,\n                            { code: 'HOSTNAME_TAKEN', hostname: normalized },\n                        ),\n                    };\n                }\n                const updatedAt = new Date().toISOString();\n                await ql.update(ENV, { hostname: normalized, updated_at: updatedAt }, { where: { id } } as any);\n                // Invalidate the hostname cache entry so the routing layer picks up the new value.\n                if (this.envRegistry?.invalidate) {\n                    try { await this.envRegistry.invalidate(id); } catch { /* best-effort */ }\n                }\n                const updated = cleanProjectRow(await findOne(ENV, { id }));\n                return { handled: true, response: this.success({ project: updated }) };\n            }\n\n            // ----- /cloud/environments/:id/retry -----\n            if (parts.length === 3 && parts[0] === 'projects' && parts[2] === 'retry' && m === 'POST') {\n                const id = decodeURIComponent(parts[1]);\n                const envRow = await findOne(ENV, { id });\n                if (!envRow) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n                if (envRow.status !== 'failed' && envRow.status !== 'provisioning') {\n                    return {\n                        handled: true,\n                        response: this.error(\n                            `Project '${id}' is '${envRow.status}'; only failed or provisioning projects can be retried.`,\n                            409,\n                        ),\n                    };\n                }\n\n                const driverName = envRow.database_driver;\n                const resolved = resolveDriver(driverName);\n                if (!resolved) {\n                    return {\n                        handled: true,\n                        response: this.error(\n                            `Driver '${driverName}' is no longer registered; retry aborted.`,\n                            503,\n                        ),\n                    };\n                }\n\n                // Parse metadata so we can clear provisioningError on success\n                // (or rewrite it on another failure).\n                let metadata: Record<string, unknown> = {};\n                if (envRow.metadata) {\n                    if (typeof envRow.metadata === 'string') {\n                        try { metadata = JSON.parse(envRow.metadata); } catch { metadata = {}; }\n                    } else if (typeof envRow.metadata === 'object') {\n                        metadata = { ...(envRow.metadata as Record<string, unknown>) };\n                    }\n                }\n                delete (metadata as any).provisioningError;\n\n                // Flip back to `provisioning` while we retry — Studio renders\n                // the spinner instead of the red error card.\n                const retryStartedAt = new Date().toISOString();\n                await ql.update(\n                    ENV,\n                    {\n                        status: 'provisioning',\n                        metadata: JSON.stringify(metadata),\n                        updated_at: retryStartedAt,\n                    },\n                    { where: { id } } as any,\n                );\n\n                // Same dev-only knobs as POST /projects: if the caller\n                // originally asked to simulate a failure they must clear the\n                // flag in metadata before retry — otherwise retry fails again.\n                const simulateRetryFailure = Boolean((metadata as any).__simulateFailure);\n                const simulateRetryDelay = Number((metadata as any).__simulateDelayMs ?? 1500);\n\n                const runRetry = async (): Promise<void> => {\n                    try {\n                        if (simulateRetryDelay > 0) {\n                            await new Promise((r) => setTimeout(r, simulateRetryDelay));\n                        }\n                        if (simulateRetryFailure) {\n                            throw new Error('Simulated provisioning failure (metadata.__simulateFailure=true)');\n                        }\n                        let databaseUrl: string;\n                        let retrySecret = `mock-token-${id}`;\n                        try {\n                            const adapter = await getRealAdapter(resolved.name);\n                            if (adapter) {\n                                const result = await adapter.createDatabase({\n                                    environmentId: id,\n                                    databaseName: `p-${id.replace(/-/g, \"\").slice(0, 24)}`,\n                                    region: 'us-east-1',\n                                    storageLimitMb: envRow.storage_limit_mb ?? 1024,\n                                });\n                                databaseUrl = result.databaseUrl;\n                                if (result.plaintextSecret) retrySecret = result.plaintextSecret;\n                            } else {\n                                databaseUrl = buildDatabaseUrl(resolved.name, id);\n                            }\n                        } catch (adapterErr) {\n                            throw adapterErr instanceof Error\n                                ? adapterErr\n                                : new Error(String(adapterErr));\n                        }\n                        const nowIso = new Date().toISOString();\n                        await ql.update(\n                            ENV,\n                            {\n                                status: 'active',\n                                database_url: databaseUrl,\n                                database_driver: resolved.name,\n                                provisioned_at: nowIso,\n                                updated_at: nowIso,\n                            },\n                            { where: { id } } as any,\n                        );\n                        const existingCred = await findOne(CRED, { environment_id: id, status: 'active' });\n                        if (!existingCred) {\n                            await ql.insert(CRED, {\n                                id: randomUUID(),\n                                environment_id: id,\n                                secret_ciphertext: retrySecret,\n                                encryption_key_id: 'noop',\n                                authorization: 'full_access',\n                                status: 'active',\n                                created_at: nowIso,\n                                updated_at: nowIso,\n                            });\n                        }\n                    } catch (err) {\n                        const message = err instanceof Error ? err.message : String(err);\n                        const failedAt = new Date().toISOString();\n                        await ql.update(\n                            ENV,\n                            {\n                                status: 'failed',\n                                metadata: JSON.stringify({\n                                    ...metadata,\n                                    provisioningError: { message, failedAt },\n                                }),\n                                updated_at: failedAt,\n                            },\n                            { where: { id } } as any,\n                        );\n                    }\n                };\n                void runRetry();\n\n                const envAfter = cleanProjectRow(await findOne(ENV, { id }));\n                const retryRes = this.success({ project: envAfter });\n                retryRes.status = 202;\n                return { handled: true, response: retryRes };\n            }\n\n            // ----- /cloud/environments/:id/activate -----\n            if (parts.length === 3 && parts[0] === 'projects' && parts[2] === 'activate' && m === 'POST') {\n                const id = decodeURIComponent(parts[1]);\n                const envRow = await findOne(ENV, { id });\n                if (!envRow) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n                // TODO: persist active_environment_id on the session once session service is wired.\n                return { handled: true, response: this.success({ project: cleanProjectRow(envRow), sessionUpdated: false }) };\n            }\n\n            // ----- /cloud/environments/:id/credentials/rotate -----\n            if (parts.length === 4 && parts[0] === 'projects' && parts[2] === 'credentials' && parts[3] === 'rotate' && m === 'POST') {\n                const id = decodeURIComponent(parts[1]);\n                const plaintext = body?.plaintext;\n                if (!plaintext || typeof plaintext !== 'string') {\n                    return { handled: true, response: this.error('plaintext is required', 400) };\n                }\n                const envRow = await findOne(ENV, { id });\n                if (!envRow) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n\n                const nowIso = new Date().toISOString();\n                // Revoke existing active credentials\n                let existing = await ql.find(CRED, { where: { environment_id: id, status: 'active' } } as any);\n                if (existing && (existing as any).value) existing = (existing as any).value;\n                for (const row of (Array.isArray(existing) ? existing : [])) {\n                    await ql.update(CRED, {\n                        status: 'revoked',\n                        revoked_at: nowIso,\n                        updated_at: nowIso,\n                    }, { where: { id: row.id } } as any);\n                }\n\n                const credentialId = randomUUID();\n                await ql.insert(CRED, {\n                    id: credentialId,\n                    environment_id: id,\n                    secret_ciphertext: plaintext,\n                    encryption_key_id: 'noop',\n                    authorization: 'full_access',\n                    status: 'active',\n                    created_at: nowIso,\n                    updated_at: nowIso,\n                });\n\n                const credential = await findOne(CRED, { id: credentialId });\n                const credMeta = credential\n                    ? {\n                          id: credential.id,\n                          status: credential.status,\n                          authorization: credential.authorization,\n                          activatedAt: credential.created_at,\n                      }\n                    : undefined;\n                return { handled: true, response: this.success({ credential: credMeta }) };\n            }\n\n            // ----- /cloud/environments/:id/members -----\n            if (parts.length === 3 && parts[0] === 'projects' && parts[2] === 'members' && m === 'GET') {\n                const id = decodeURIComponent(parts[1]);\n                let rows = await ql.find(MEM, { where: { environment_id: id } } as any);\n                if (rows && (rows as any).value) rows = (rows as any).value;\n                const members = Array.isArray(rows) ? rows : [];\n                // Enrich with user display info (best-effort).\n                const userIds = Array.from(new Set(members.map((mem: any) => mem.user_id).filter(Boolean)));\n                const userMap = new Map<string, any>();\n                for (const uid of userIds) {\n                    let row: any = null;\n                    for (const tableName of ['sys_user', 'user']) {\n                        try {\n                            const u = await ql.findOne(tableName as any, { where: { id: uid } } as any);\n                            row = (u as any)?.value ?? u;\n                            if (row) break;\n                        } catch { /* try next table */ }\n                    }\n                    if (row) userMap.set(String(uid), {\n                        id: row.id,\n                        name: row.name ?? row.display_name,\n                        email: row.email,\n                        image: row.image ?? row.avatar_url,\n                    });\n                }\n                const enriched = members.map((mem: any) => ({\n                    ...mem,\n                    user: userMap.get(String(mem.user_id)) ?? undefined,\n                }));\n                return { handled: true, response: this.success({ members: enriched }) };\n            }\n\n            // ----- POST /cloud/environments/:id/members  (invite) ---------------\n            //   body: { email | user_id, role? = 'member' }\n            // Only owner / admin may invite. Idempotent: re-inviting an\n            // existing member returns 200 with the existing row instead of\n            // creating a duplicate.\n            if (parts.length === 3 && parts[0] === 'projects' && parts[2] === 'members' && m === 'POST') {\n                const id = decodeURIComponent(parts[1]);\n                const project = await findOne(ENV, { id });\n                if (!project) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n\n                const callerId = await this.resolveCallerUserId(_context);\n                if (!callerId) return { handled: true, response: this.error('Authentication required', 401) };\n                const callerMem = await findOne(MEM, { environment_id: id, user_id: callerId });\n                if (!callerMem || !['owner', 'admin'].includes(String(callerMem.role))) {\n                    return { handled: true, response: this.error('Forbidden — owner or admin required', 403) };\n                }\n\n                const email = typeof body?.email === 'string' ? String(body.email).trim().toLowerCase() : null;\n                let inviteUserId = typeof body?.user_id === 'string' ? String(body.user_id).trim() : null;\n                let role = String(body?.role ?? 'member').trim().toLowerCase();\n                if (!['owner', 'admin', 'member', 'viewer'].includes(role)) {\n                    return { handled: true, response: this.error(`Invalid role '${role}' (expected owner | admin | member | viewer)`, 400) };\n                }\n                if (!email && !inviteUserId) {\n                    return { handled: true, response: this.error('email or user_id is required', 400) };\n                }\n                // Resolve email → user_id (best-effort across schema variants).\n                if (!inviteUserId && email) {\n                    let row: any = null;\n                    for (const tableName of ['sys_user', 'user']) {\n                        try {\n                            const u = await ql.findOne(tableName as any, { where: { email } } as any);\n                            row = (u as any)?.value ?? u;\n                            if (row) break;\n                        } catch { /* try next */ }\n                    }\n                    if (!row?.id) {\n                        return { handled: true, response: this.error(`No user found with email '${email}'`, 404) };\n                    }\n                    inviteUserId = String(row.id);\n                }\n\n                const existing = await findOne(MEM, { environment_id: id, user_id: inviteUserId });\n                if (existing) {\n                    return { handled: true, response: this.success({ member: existing, alreadyMember: true }) };\n                }\n\n                try {\n                    const memberId = randomUUID();\n                    await ql.insert(MEM, {\n                        id: memberId,\n                        environment_id: id,\n                        user_id: inviteUserId,\n                        role,\n                        invited_by: callerId,\n                        organization_id: (project as any).organization_id ?? null,\n                    } as any);\n                    const created = await findOne(MEM, { id: memberId });\n                    return { handled: true, response: this.success({ member: created, alreadyMember: false }) };\n                } catch (e: any) {\n                    return { handled: true, response: this.error(e?.message ?? 'Failed to add member', 500) };\n                }\n            }\n\n            // ----- PATCH /cloud/environments/:id/members/:memberId (update role) ----\n            //   body: { role }\n            if (parts.length === 4 && parts[0] === 'projects' && parts[2] === 'members' && m === 'PATCH') {\n                const id = decodeURIComponent(parts[1]);\n                const memberId = decodeURIComponent(parts[3]);\n                const project = await findOne(ENV, { id });\n                if (!project) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n\n                const callerId = await this.resolveCallerUserId(_context);\n                if (!callerId) return { handled: true, response: this.error('Authentication required', 401) };\n                const callerMem = await findOne(MEM, { environment_id: id, user_id: callerId });\n                if (!callerMem || !['owner', 'admin'].includes(String(callerMem.role))) {\n                    return { handled: true, response: this.error('Forbidden — owner or admin required', 403) };\n                }\n\n                const target = await findOne(MEM, { id: memberId, environment_id: id });\n                if (!target) return { handled: true, response: this.error(`Member '${memberId}' not found`, 404) };\n\n                const newRole = String(body?.role ?? '').trim().toLowerCase();\n                if (!['owner', 'admin', 'member', 'viewer'].includes(newRole)) {\n                    return { handled: true, response: this.error(`Invalid role '${newRole}'`, 400) };\n                }\n\n                // Demoting the last owner is forbidden.\n                if (target.role === 'owner' && newRole !== 'owner') {\n                    let owners = await ql.find(MEM, { where: { environment_id: id, role: 'owner' } } as any);\n                    if (owners && (owners as any).value) owners = (owners as any).value;\n                    const ownerCount = Array.isArray(owners) ? owners.length : 0;\n                    if (ownerCount <= 1) {\n                        return { handled: true, response: this.error('Cannot demote the last owner', 409) };\n                    }\n                }\n\n                try {\n                    await ql.update(MEM, { role: newRole, updated_at: new Date().toISOString() } as any, { where: { id: memberId } } as any);\n                    const updated = await findOne(MEM, { id: memberId });\n                    return { handled: true, response: this.success({ member: updated }) };\n                } catch (e: any) {\n                    return { handled: true, response: this.error(e?.message ?? 'Failed to update role', 500) };\n                }\n            }\n\n            // ----- DELETE /cloud/environments/:id/members/:memberId ----------------\n            // Owner / admin may remove anyone. Anyone may remove themselves\n            // unless they are the last owner.\n            if (parts.length === 4 && parts[0] === 'projects' && parts[2] === 'members' && m === 'DELETE') {\n                const id = decodeURIComponent(parts[1]);\n                const memberId = decodeURIComponent(parts[3]);\n                const project = await findOne(ENV, { id });\n                if (!project) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n\n                const callerId = await this.resolveCallerUserId(_context);\n                if (!callerId) return { handled: true, response: this.error('Authentication required', 401) };\n\n                const target = await findOne(MEM, { id: memberId, environment_id: id });\n                if (!target) return { handled: true, response: this.error(`Member '${memberId}' not found`, 404) };\n\n                const callerMem = await findOne(MEM, { environment_id: id, user_id: callerId });\n                const isSelf = String(target.user_id) === String(callerId);\n                const isPrivileged = callerMem && ['owner', 'admin'].includes(String(callerMem.role));\n                if (!isSelf && !isPrivileged) {\n                    return { handled: true, response: this.error('Forbidden — owner or admin required', 403) };\n                }\n\n                if (target.role === 'owner') {\n                    let owners = await ql.find(MEM, { where: { environment_id: id, role: 'owner' } } as any);\n                    if (owners && (owners as any).value) owners = (owners as any).value;\n                    const ownerCount = Array.isArray(owners) ? owners.length : 0;\n                    if (ownerCount <= 1) {\n                        return { handled: true, response: this.error('Cannot remove the last owner', 409) };\n                    }\n                }\n\n                try {\n                    await ql.delete(MEM, { where: { id: memberId } } as any);\n                    return { handled: true, response: this.success({ removed: true, memberId }) };\n                } catch (e: any) {\n                    return { handled: true, response: this.error(e?.message ?? 'Failed to remove member', 500) };\n                }\n            }\n\n            // ----- /cloud/environments/:envId/packages -----\n            // GET  /cloud/environments/:envId/packages\n            if (parts.length === 3 && parts[0] === 'projects' && parts[2] === 'packages' && m === 'GET') {\n                const envId = decodeURIComponent(parts[1]);\n                let rows = await ql.find(PKG_INSTALL, { where: { environment_id: envId } } as any);\n                if (rows && (rows as any).value) rows = (rows as any).value;\n                const installs = Array.isArray(rows) ? rows : [];\n\n                // Denormalize: translate package_id (UUID) → manifest_id (string)\n                // and package_version_id (UUID) → version string. Studio joins\n                // these against the in-memory registry which uses manifest ids.\n                const packages = await Promise.all(\n                    installs.map(async (r: any) => {\n                        let manifestId: string | null = null;\n                        let versionStr: string | null = null;\n                        try {\n                            if (r.package_id) {\n                                const pkg = await ql.findOne(PKG, { where: { id: r.package_id } } as any) as any;\n                                manifestId = pkg?.manifest_id ?? null;\n                            }\n                            if (r.package_version_id) {\n                                const ver = await ql.findOne(PKG_VERSION, { where: { id: r.package_version_id } } as any) as any;\n                                versionStr = ver?.version ?? null;\n                            }\n                        } catch {\n                            // best-effort enrichment\n                        }\n                        return {\n                            ...r,\n                            // Surface user-facing identifiers expected by client SDK\n                            packageId: manifestId,\n                            package_id: manifestId ?? r.package_id,\n                            version: versionStr ?? r.version ?? null,\n                        };\n                    }),\n                );\n                return { handled: true, response: this.success({ packages, total: packages.length }) };\n            }\n\n            // POST /cloud/environments/:envId/packages\n            if (parts.length === 3 && parts[0] === 'projects' && parts[2] === 'packages' && m === 'POST') {\n                const envId = decodeURIComponent(parts[1]);\n                const { packageId, version, settings, enableOnInstall } = body ?? {};\n                if (!packageId) return { handled: true, response: this.error('packageId is required', 400) };\n\n                // Resolve manifest from the host kernel's package registry\n                const qlSvc = await this.getObjectQLService();\n                const pkgRegistry = (qlSvc as any)?.registry;\n                const allPkgs = pkgRegistry?.getAllPackages?.() ?? [];\n                const manifestEntry = allPkgs.find((p: any) => (p?.manifest?.id ?? p?.id) === packageId);\n                const manifest = manifestEntry?.manifest ?? manifestEntry;\n                if (!manifest) {\n                    return { handled: true, response: this.error(`Package '${packageId}' is not registered on this server`, 404) };\n                }\n\n                // Prevent installing cloud/system-scope packages per-project\n                const CLOUD_SCOPES = new Set(['cloud', 'system', 'platform']);\n                if (CLOUD_SCOPES.has(manifest?.scope)) {\n                    return { handled: true, response: this.error(`Package '${packageId}' has scope=${manifest.scope} and cannot be installed per-project`, 403) };\n                }\n\n                // Look up project to get organization_id (owner) and resolve session user\n                const projectRow = await findOne(ENV, { id: envId }) as any;\n                if (!projectRow) {\n                    return { handled: true, response: this.error(`Project '${envId}' not found`, 404) };\n                }\n                const ownerOrgId = projectRow.organization_id ?? 'system';\n\n                let userId = 'system';\n                try {\n                    const authService: any = await this.getService(CoreServiceName.enum.auth);\n                    const sessionData = await authService?.api?.getSession?.({\n                        headers: _context?.request?.headers,\n                    });\n                    userId = sessionData?.user?.id ?? sessionData?.session?.userId ?? 'system';\n                } catch {\n                    // Fall through with 'system'\n                }\n\n                const resolvedVersion = version ?? manifest?.version ?? '1.0.0';\n\n                // Reject duplicate installs for the same package in the same project\n                const dup = await ql.findOne(PKG_INSTALL, {\n                    where: { environment_id: envId, package_id: packageId },\n                } as any) as any;\n                if (dup?.id) {\n                    return { handled: true, response: this.error(`Package '${packageId}' is already installed in this project`, 409) };\n                }\n\n                // Upsert sys_package + sys_package_version, then create the install record\n                const sysPackageId = await ensureSysPackage(packageId, ownerOrgId, userId, manifest);\n                const sysPackageVersionId = await ensureSysPackageVersion(sysPackageId, resolvedVersion, userId, manifest);\n\n                const nowIso = new Date().toISOString();\n                const recordId = randomUUID();\n                await ql.insert(PKG_INSTALL, {\n                    id: recordId,\n                    environment_id: envId,\n                    package_id: sysPackageId,\n                    package_version_id: sysPackageVersionId,\n                    status: 'installed',\n                    enabled: enableOnInstall !== false,\n                    installed_at: nowIso,\n                    installed_by: userId,\n                    updated_at: nowIso,\n                    settings: settings ? JSON.stringify(settings) : null,\n                });\n                const record = await ql.findOne(PKG_INSTALL, { where: { id: recordId } } as any);\n                // Invalidate the project kernel cache so the freshly-installed\n                // package gets loaded on next request.\n                try { await this.kernelManager?.evict(envId); } catch { /* best effort */ }\n                return { handled: true, response: this.success({ package: record }) };\n            }\n\n            // ----- /cloud/environments/:envId/packages/:pkgId -----\n            // GET /cloud/environments/:envId/packages/:pkgId\n            if (parts.length === 4 && parts[0] === 'projects' && parts[2] === 'packages' && m === 'GET') {\n                const envId = decodeURIComponent(parts[1]);\n                const pkgId = decodeURIComponent(parts[3]);\n                const record = await ql.findOne(PKG_INSTALL, { where: { environment_id: envId, package_id: pkgId } } as any);\n                if (!record) return { handled: true, response: this.error(`Package '${pkgId}' is not installed in this project`, 404) };\n                return { handled: true, response: this.success({ package: record }) };\n            }\n\n            // DELETE /cloud/environments/:envId/packages/:pkgId\n            if (parts.length === 4 && parts[0] === 'projects' && parts[2] === 'packages' && m === 'DELETE') {\n                const envId = decodeURIComponent(parts[1]);\n                const pkgId = decodeURIComponent(parts[3]);\n                const record = await findInstallByManifestId(envId, pkgId) as any;\n                if (!record) return { handled: true, response: this.error(`Package '${pkgId}' is not installed in this project`, 404) };\n                // Re-derive scope from the in-memory registry manifest, since\n                // sys_package_installation no longer carries `scope` directly.\n                const allPkgs0 = this.kernel.packages?.getAll?.() ?? [];\n                const m0 = allPkgs0.find((p: any) => (p.manifest?.id ?? p.id) === pkgId)?.manifest;\n                if (m0?.scope && ['cloud', 'system', 'platform'].includes(m0.scope)) {\n                    return { handled: true, response: this.error(`Package '${pkgId}' with scope=${m0.scope} cannot be uninstalled`, 403) };\n                }\n                await ql.delete(PKG_INSTALL, { where: { id: record.id } } as any);\n                try { await this.kernelManager?.evict(envId); } catch { /* best effort */ }\n                return { handled: true, response: this.success({ id: record.id, success: true }) };\n            }\n\n            // PATCH /cloud/environments/:envId/packages/:pkgId/enable\n            if (parts.length === 5 && parts[0] === 'projects' && parts[2] === 'packages' && parts[4] === 'enable' && m === 'PATCH') {\n                const envId = decodeURIComponent(parts[1]);\n                const pkgId = decodeURIComponent(parts[3]);\n                const record = await findInstallByManifestId(envId, pkgId) as any;\n                if (!record) return { handled: true, response: this.error(`Package '${pkgId}' is not installed in this project`, 404) };\n                const nowIso = new Date().toISOString();\n                await ql.update(PKG_INSTALL, { enabled: true, status: 'installed', updated_at: nowIso }, { where: { id: record.id } } as any);\n                const updated = await ql.findOne(PKG_INSTALL, { where: { id: record.id } } as any);\n                try { await this.kernelManager?.evict(envId); } catch { /* best effort */ }\n                return { handled: true, response: this.success({ package: updated }) };\n            }\n\n            // PATCH /cloud/environments/:envId/packages/:pkgId/disable\n            if (parts.length === 5 && parts[0] === 'projects' && parts[2] === 'packages' && parts[4] === 'disable' && m === 'PATCH') {\n                const envId = decodeURIComponent(parts[1]);\n                const pkgId = decodeURIComponent(parts[3]);\n                const record = await findInstallByManifestId(envId, pkgId) as any;\n                if (!record) return { handled: true, response: this.error(`Package '${pkgId}' is not installed in this project`, 404) };\n                const allPkgs1 = this.kernel.packages?.getAll?.() ?? [];\n                const m1 = allPkgs1.find((p: any) => (p.manifest?.id ?? p.id) === pkgId)?.manifest;\n                if (m1?.scope && ['cloud', 'system', 'platform'].includes(m1.scope)) {\n                    return { handled: true, response: this.error(`Package '${pkgId}' with scope=${m1.scope} cannot be disabled`, 403) };\n                }\n                const nowIso = new Date().toISOString();\n                await ql.update(PKG_INSTALL, { enabled: false, status: 'disabled', updated_at: nowIso }, { where: { id: record.id } } as any);\n                const updated = await ql.findOne(PKG_INSTALL, { where: { id: record.id } } as any);\n                try { await this.kernelManager?.evict(envId); } catch { /* best effort */ }\n                return { handled: true, response: this.success({ package: updated }) };\n            }\n\n            // POST /cloud/environments/:envId/packages/:pkgId/upgrade\n            if (parts.length === 5 && parts[0] === 'projects' && parts[2] === 'packages' && parts[4] === 'upgrade' && m === 'POST') {\n                const envId = decodeURIComponent(parts[1]);\n                const pkgId = decodeURIComponent(parts[3]);\n                const record = await findInstallByManifestId(envId, pkgId) as any;\n                if (!record) return { handled: true, response: this.error(`Package '${pkgId}' is not installed in this project`, 404) };\n                const { targetVersion } = body ?? {};\n                const allPkgs2 = this.kernel.packages?.getAll?.() ?? [];\n                const manifest2 = allPkgs2.find((p: any) => (p.manifest?.id ?? p.id) === pkgId)?.manifest;\n                const currentVer = await ql.findOne(PKG_VERSION, { where: { id: record.package_version_id } } as any) as any;\n                const newVersion = targetVersion ?? manifest2?.version ?? currentVer?.version ?? '1.0.0';\n                if (newVersion === currentVer?.version) {\n                    return { handled: true, response: this.success({ package: record, message: 'Already at target version' }) };\n                }\n                // Resolve user for `created_by` audit columns\n                let userId = 'system';\n                try {\n                    const authService: any = await this.getService(CoreServiceName.enum.auth);\n                    const sessionData = await authService?.api?.getSession?.({\n                        headers: _context?.request?.headers,\n                    });\n                    userId = sessionData?.user?.id ?? 'system';\n                } catch { /* fall through */ }\n                const newVersionId = await ensureSysPackageVersion(record.package_id, newVersion, userId, manifest2);\n                const nowIso = new Date().toISOString();\n                await ql.update(PKG_INSTALL, {\n                    package_version_id: newVersionId,\n                    status: 'installed',\n                    updated_at: nowIso,\n                }, { where: { id: record.id } } as any);\n                const updated = await ql.findOne(PKG_INSTALL, { where: { id: record.id } } as any);\n                try { await this.kernelManager?.evict(envId); } catch { /* best effort */ }\n                return { handled: true, response: this.success({ package: updated }) };\n            }\n\n        } catch (e: any) {\n            return { handled: true, response: this.error(e.message, e.statusCode || 500) };\n        }\n\n        return { handled: false };\n    }\n\n    /**\n     * Cascade-delete a project: cred / member / package_installation rows,\n     * then the physical database via the provisioning adapter, then the\n     * `sys_environment` row itself. Used by both `DELETE /cloud/environments/:id`\n     * and the org-cascade in `DELETE /cloud/organizations/:id`.\n     *\n     * Idempotent and best-effort: missing rows / unreachable adapters\n     * become warnings rather than hard failures, so a half-provisioned\n     * project can still be cleaned out.\n     */\n    private async deleteProjectCascade(\n        environmentId: string,\n        deps: {\n            ql: any;\n            findOne: (obj: string, where: Record<string, unknown>) => Promise<any | undefined>;\n            getRealAdapter: (driver: string) => Promise<{\n                deleteDatabase?(params: { environmentId: string; databaseName: string; databaseUrl?: string }): Promise<void>;\n            } | undefined>;\n            force?: boolean;\n        },\n    ): Promise<{ ok: boolean; status?: number; error?: string; warnings: string[] }> {\n        const { ql, findOne, getRealAdapter, force } = deps;\n        const ENV = 'sys_environment';\n        const warnings: string[] = [];\n\n        const row = await findOne(ENV, { id: environmentId });\n        if (!row) {\n            return { ok: false, status: 404, error: `Project '${environmentId}' not found`, warnings };\n        }\n        if (row.is_system === true || row.is_system === 1) {\n            return { ok: false, status: 409, error: `Project '${environmentId}' is a system project and cannot be deleted`, warnings };\n        }\n        if ((row.is_default === true || row.is_default === 1) && !force) {\n            return {\n                ok: false,\n                status: 409,\n                error: `Project '${environmentId}' is the default project for its organization. Pass ?force=1 to delete it.`,\n                warnings,\n            };\n        }\n\n        // Cascade-delete dependent rows.\n        const cascade: Array<{ object: string; field: string }> = [\n            { object: 'sys_environment_credential', field: 'environment_id' },\n            { object: 'sys_environment_member', field: 'environment_id' },\n            { object: 'sys_package_installation', field: 'environment_id' },\n        ];\n        for (const { object, field } of cascade) {\n            try {\n                let rows = await ql.find(object, { where: { [field]: environmentId } } as any);\n                if (rows && rows.value) rows = rows.value;\n                if (Array.isArray(rows)) {\n                    for (const r of rows) {\n                        if (r?.id != null) {\n                            try {\n                                await ql.delete(object, { where: { id: r.id } } as any);\n                            } catch (innerErr) {\n                                warnings.push(\n                                    `Failed to delete ${object} ${r.id}: ${innerErr instanceof Error ? innerErr.message : String(innerErr)}`,\n                                );\n                            }\n                        }\n                    }\n                }\n            } catch (err) {\n                warnings.push(\n                    `Failed to enumerate ${object} for project ${environmentId}: ${err instanceof Error ? err.message : String(err)}`,\n                );\n            }\n        }\n\n        // Tear down the physical database (best-effort).\n        const driver = (row.database_driver as string | undefined) ?? 'memory';\n        const databaseUrl = row.database_url as string | undefined;\n        const databaseName = `p-${String(environmentId).replace(/-/g, '').slice(0, 24)}`;\n        try {\n            const adapter = await getRealAdapter(driver);\n            if (adapter?.deleteDatabase) {\n                await adapter.deleteDatabase({ environmentId, databaseName, databaseUrl });\n            } else {\n                warnings.push(`No adapter for driver '${driver}'; physical DB for project ${environmentId} not released.`);\n            }\n        } catch (err) {\n            warnings.push(\n                `Failed to delete physical database for project ${environmentId}: ${err instanceof Error ? err.message : String(err)}`,\n            );\n        }\n\n        // Drop the sys_environment row itself.\n        try {\n            await ql.delete(ENV, { where: { id: environmentId } } as any);\n        } catch (err) {\n            return {\n                ok: false,\n                status: 500,\n                error: `Failed to delete sys_environment row: ${err instanceof Error ? err.message : String(err)}`,\n                warnings,\n            };\n        }\n\n        // Invalidate routing caches so subsequent requests don't resolve to a dead env.\n        if (this.envRegistry?.invalidate) {\n            try { await this.envRegistry.invalidate(environmentId); } catch { /* best-effort */ }\n        }\n\n        return { ok: true, warnings };\n    }\n\n    /**\n     * Handles Storage requests\n     * path: sub-path after /storage/\n     */\n    async handleStorage(path: string, method: string, file: any, context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        const storageService = await this.getService(CoreServiceName.enum['file-storage']) || this.kernel.services?.['file-storage'];\n        if (!storageService) {\n             return { handled: true, response: this.error('File storage not configured', 501) };\n        }\n        \n        const m = method.toUpperCase();\n        const parts = path.replace(/^\\/+/, '').split('/');\n        \n        // POST /storage/upload\n        if (parts[0] === 'upload' && m === 'POST') {\n            if (!file) {\n                 return { handled: true, response: this.error('No file provided', 400) };\n            }\n            const result = await storageService.upload(file, { request: context.request });\n            return { handled: true, response: this.success(result) };\n        }\n        \n        // GET /storage/file/:id\n        if (parts[0] === 'file' && parts[1] && m === 'GET') {\n            const id = parts[1];\n            const result = await storageService.download(id, { request: context.request });\n            \n            // Result can be URL (redirect), Stream/Blob, or metadata\n            if (result.url && result.redirect) {\n                // Must be handled by adapter to do actual redirect\n                return { handled: true, result: { type: 'redirect', url: result.url } };\n            }\n            \n            if (result.stream) {\n                 // Must be handled by adapter to pipe stream\n                 return { \n                     handled: true, \n                     result: { \n                         type: 'stream', \n                         stream: result.stream, \n                         headers: {\n                             'Content-Type': result.mimeType || 'application/octet-stream',\n                             'Content-Length': result.size\n                         }\n                     } \n                 };\n            }\n            \n            return { handled: true, response: this.success(result) };\n        }\n        \n        return { handled: false };\n    }\n\n    /**\n     * Handles UI requests\n     * path: sub-path after /ui/\n     */\n    async handleUi(path: string, query: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        const parts = path.replace(/^\\/+/, '').split('/').filter(Boolean);\n        \n        // GET /ui/view/:object (with optional type param)\n        if (parts[0] === 'view' && parts[1]) {\n            const objectName = parts[1];\n            // Support both path param /view/obj/list AND query param /view/obj?type=list\n            const type = parts[2] || query?.type || 'list';\n\n            const protocol = await this.resolveService('protocol');\n            \n            if (protocol && typeof protocol.getUiView === 'function') {\n                try {\n                    const result = await protocol.getUiView({ object: objectName, type });\n                    return { handled: true, response: this.success(result) };\n                } catch (e: any) {\n                    return { handled: true, response: this.error(e.message, 500) };\n                }\n            } else {\n                 return { handled: true, response: this.error('Protocol service not available', 503) };\n            }\n        }\n\n        return { handled: false };\n    }\n\n    /**\n     * Handles Automation requests\n     * path: sub-path after /automation/\n     *\n     * Routes:\n     *   GET    /                     → listFlows\n     *   GET    /:name                → getFlow\n     *   POST   /                     → createFlow (registerFlow)\n     *   PUT    /:name                → updateFlow\n     *   DELETE /:name                → deleteFlow (unregisterFlow)\n     *   POST   /:name/trigger        → execute (legacy: trigger/:name also supported)\n     *   POST   /:name/toggle         → toggleFlow\n     *   GET    /:name/runs           → listRuns\n     *   GET    /:name/runs/:runId    → getRun\n     */\n    async handleAutomation(path: string, method: string, body: any, context: HttpProtocolContext, query?: any): Promise<HttpDispatcherResult> {\n        const automationService = await this.getService(CoreServiceName.enum.automation);\n        if (!automationService) return { handled: false };\n\n        const m = method.toUpperCase();\n        const parts = path.replace(/^\\/+/, '').split('/').filter(Boolean);\n\n        // Legacy: POST /automation/trigger/:name\n        if (parts[0] === 'trigger' && parts[1] && m === 'POST') {\n             const triggerName = parts[1];\n             if (typeof automationService.trigger === 'function') {\n                 const result = await automationService.trigger(triggerName, body, { request: context.request });\n                 return { handled: true, response: this.success(result) };\n             }\n             // Fallback to execute\n             if (typeof automationService.execute === 'function') {\n                 const result = await automationService.execute(triggerName, body);\n                 return { handled: true, response: this.success(result) };\n             }\n        }\n\n        // GET / → listFlows\n        if (parts.length === 0 && m === 'GET') {\n            if (typeof automationService.listFlows === 'function') {\n                const names = await automationService.listFlows();\n                return { handled: true, response: this.success({ flows: names, total: names.length, hasMore: false }) };\n            }\n        }\n\n        // POST / → createFlow\n        if (parts.length === 0 && m === 'POST') {\n            if (typeof automationService.registerFlow === 'function') {\n                automationService.registerFlow(body?.name, body);\n                return { handled: true, response: this.success(body) };\n            }\n        }\n\n        // Routes with :name\n        if (parts.length >= 1) {\n            const name = parts[0];\n\n            // POST /:name/trigger → execute\n            if (parts[1] === 'trigger' && m === 'POST') {\n                if (typeof automationService.execute === 'function') {\n                    const ctxBody = body && typeof body === 'object' ? body : {};\n                    // Translate UI/SDK request shape `{recordId, objectName, params}`\n                    // into the canonical AutomationContext shape expected by the engine.\n                    // Key transformations:\n                    //  - `recordId` is exposed in `params.recordId` AND aliased to\n                    //    `<objectName>Id` (camelCase) so flow variables like `leadId`,\n                    //    `caseId`, `opportunityId` resolve from a single REST contract.\n                    //  - `objectName` is mapped to the canonical `object` field.\n                    //  - The user identity from the auth context (if any) is forwarded\n                    //    as `userId` so node executors / template interpolation can\n                    //    expand `{$User.Id}`.\n                    const recordId = ctxBody.recordId;\n                    const objectName = ctxBody.objectName ?? ctxBody.object;\n                    const baseParams = (ctxBody.params && typeof ctxBody.params === 'object') ? { ...ctxBody.params } : {};\n                    // Back-compat: when callers POST a flat body (no `params` wrapper),\n                    // forward unknown top-level keys as flow params so the original\n                    // `{ foo: 'bar' }` payload is not silently dropped.\n                    if (!ctxBody.params) {\n                        const reserved = new Set(['recordId', 'objectName', 'object', 'event', 'params']);\n                        for (const [k, v] of Object.entries(ctxBody)) {\n                            if (reserved.has(k)) continue;\n                            if (baseParams[k] === undefined) baseParams[k] = v;\n                        }\n                    }\n                    if (recordId !== undefined && baseParams.recordId === undefined) {\n                        baseParams.recordId = recordId;\n                    }\n                    if (recordId !== undefined && objectName) {\n                        const alias = `${String(objectName).replace(/_([a-z])/g, (_: string, c: string) => c.toUpperCase())}Id`;\n                        if (baseParams[alias] === undefined) baseParams[alias] = recordId;\n                    }\n                    const automationContext: any = {\n                        params: baseParams,\n                        object: objectName,\n                        event: ctxBody.event ?? 'manual',\n                    };\n                    const userIdFromAuth = (context as any)?.user?.id ?? (context as any)?.userId;\n                    if (userIdFromAuth) automationContext.userId = userIdFromAuth;\n                    const result = await automationService.execute(name, automationContext);\n                    return { handled: true, response: this.success(result) };\n                }\n            }\n\n            // POST /:name/toggle → toggleFlow\n            if (parts[1] === 'toggle' && m === 'POST') {\n                if (typeof automationService.toggleFlow === 'function') {\n                    await automationService.toggleFlow(name, body?.enabled ?? true);\n                    return { handled: true, response: this.success({ name, enabled: body?.enabled ?? true }) };\n                }\n            }\n\n            // GET /:name/runs/:runId → getRun\n            if (parts[1] === 'runs' && parts[2] && m === 'GET') {\n                if (typeof automationService.getRun === 'function') {\n                    const run = await automationService.getRun(parts[2]);\n                    if (!run) return { handled: true, response: this.error('Execution not found', 404) };\n                    return { handled: true, response: this.success(run) };\n                }\n            }\n\n            // GET /:name/runs → listRuns\n            if (parts[1] === 'runs' && !parts[2] && m === 'GET') {\n                if (typeof automationService.listRuns === 'function') {\n                    const options = query ? { limit: query.limit ? Number(query.limit) : undefined, cursor: query.cursor } : undefined;\n                    const runs = await automationService.listRuns(name, options);\n                    return { handled: true, response: this.success({ runs, hasMore: false }) };\n                }\n            }\n\n            // GET /:name → getFlow (no sub-path)\n            if (parts.length === 1 && m === 'GET') {\n                if (typeof automationService.getFlow === 'function') {\n                    const flow = await automationService.getFlow(name);\n                    if (!flow) return { handled: true, response: this.error('Flow not found', 404) };\n                    return { handled: true, response: this.success(flow) };\n                }\n            }\n\n            // PUT /:name → updateFlow\n            if (parts.length === 1 && m === 'PUT') {\n                if (typeof automationService.registerFlow === 'function') {\n                    automationService.registerFlow(name, body?.definition ?? body);\n                    return { handled: true, response: this.success(body?.definition ?? body) };\n                }\n            }\n\n            // DELETE /:name → deleteFlow\n            if (parts.length === 1 && m === 'DELETE') {\n                if (typeof automationService.unregisterFlow === 'function') {\n                    automationService.unregisterFlow(name);\n                    return { handled: true, response: this.success({ name, deleted: true }) };\n                }\n            }\n        }\n        \n        return { handled: false };\n    }\n\n    private getServicesMap(): Record<string, any> {\n        if (this.kernel.services instanceof Map) {\n            return Object.fromEntries(this.kernel.services);\n        }\n        return this.kernel.services || {};\n    }\n\n    private async getService(name: CoreServiceName) {\n        return this.resolveService(name);\n    }\n\n    /**\n     * Resolve any service by name, supporting async factories.\n     * Fallback chain: getServiceAsync(scopeId) → getServiceAsync → getService (sync) → context.getService → services map.\n     * Only returns when a non-null service is found; otherwise falls through to the next step.\n     *\n     * When `scopeId` is provided, tries the SCOPED factory on `defaultKernel` first (SharedProjectPlugin\n     * mode). Falls back to the current `kernel` for singleton / legacy services.\n     */\n    private async resolveService(name: string, scopeId?: string) {\n        // Prefer scoped lookup on defaultKernel when scopeId is given (shared-kernel / multi-environment mode)\n        if (scopeId && typeof this.defaultKernel.getServiceAsync === 'function') {\n            try {\n                const svc = await this.defaultKernel.getServiceAsync(name, scopeId);\n                if (svc != null) return svc;\n            } catch {\n                // Not a scoped service — fall through to singleton resolution\n            }\n        }\n        // Prefer async resolution to support factory-based services (e.g. auth, analytics, protocol)\n        if (typeof this.kernel.getServiceAsync === 'function') {\n            try {\n                const svc = await this.kernel.getServiceAsync(name);\n                if (svc != null) return svc;\n            } catch {\n                // Service not registered or async resolution failed — fall through\n            }\n        }\n        if (typeof this.kernel.getService === 'function') {\n            try {\n                const svc = await this.kernel.getService(name);\n                if (svc != null) return svc;\n            } catch {\n                // Service not registered or sync resolution threw \"is async\" — fall through\n            }\n        }\n        if (this.kernel?.context?.getService) {\n            try {\n                const svc = await this.kernel.context.getService(name);\n                if (svc != null) return svc;\n            } catch {\n                // Service not registered — fall through\n            }\n        }\n        const services = this.getServicesMap();\n        return services[name];\n    }\n\n    /**\n     * Get the ObjectQL service which provides access to SchemaRegistry.\n     * Tries multiple access patterns since kernel structure varies.\n     */\n    private async getObjectQLService(scopeId?: string): Promise<any> {\n        // 1. Try via resolveService (handles scoped, async factories, sync, context, and map)\n        try {\n            const svc = await this.resolveService('objectql', scopeId);\n            if (svc?.registry) return svc;\n        } catch { /* service not available */ }\n        return null;\n    }\n\n    /**\n     * Handle action invocation routes (`/actions/...`).\n     *\n     * Dispatches a named, server-registered action handler (registered via\n     * `engine.registerAction(objectName, actionName, handler)`) over HTTP.\n     * Three URL shapes are accepted to keep the client contract flexible:\n     *\n     *  - `POST /actions/:object/:action`              — record-scoped action\n     *  - `POST /actions/:object/:action/:recordId`    — record-scoped action with id in URL\n     *  - `POST /actions/global/:action`               — wildcard (\"*\") action\n     *\n     * Body shape: `{ recordId?: string, params?: Record<string, unknown> }`.\n     * The handler is invoked with an `ActionContext` of:\n     *   `{ record, user, engine, params }`\n     * where `engine` exposes the slimmed CRUD surface used by CRM handlers\n     * (`insert`, `update`, `delete`, `find`).\n     */\n    async handleActions(path: string, method: string, body: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        if (method.toUpperCase() !== 'POST') {\n            return { handled: true, response: this.error('Method not allowed', 405) };\n        }\n        const parts = path.replace(/^\\/+|\\/+$/g, '').split('/').filter(Boolean);\n        if (parts.length < 2) {\n            return { handled: true, response: this.error('Path must be /actions/:object/:action', 400) };\n        }\n        const objectName = parts[0];\n        const actionName = parts[1];\n        const recordIdFromPath = parts[2];\n\n        // Resolve project scope so the right project kernel's ObjectQL is\n        // used. For bare URLs the URL prefix already stripped any `/projects/:id`\n        // segment, so fall back to the single-environment default if unset.\n        if (!_context.environmentId) {\n            const def = this.resolveDefaultProject();\n            if (def?.environmentId) _context.environmentId = def.environmentId;\n        }\n\n        // Replicate the kernel swap that `dispatcher.handle()` does for\n        // data/meta/automation routes. Action routes are registered on the\n        // raw HTTP server and skip the `handle()` chain, so without this\n        // swap `getObjectQLService` would resolve the control-plane kernel\n        // (where the CRM bundle's actions are NOT registered).\n        let projectQl: any = null;\n        if (this.kernelManager && _context.environmentId && _context.environmentId !== 'platform') {\n            try {\n                const projectKernel: any = await this.kernelManager.getOrCreate(_context.environmentId);\n                if (projectKernel) {\n                    this.kernel = projectKernel;\n                    // Resolve the project kernel's own ObjectQL DIRECTLY so we\n                    // bypass the control-plane's scoped factory (which would\n                    // hand back a different instance with no registered\n                    // actions/hooks for this project's bundle).\n                    if (typeof projectKernel.getServiceAsync === 'function') {\n                        projectQl = await projectKernel.getServiceAsync('objectql').catch(() => null);\n                    }\n                }\n            } catch {\n                // fall back to defaultKernel — getObjectQLService will report\n                // \"Data engine not available\" if no engine is reachable.\n            }\n        }\n\n        const ql: any = projectQl ?? await this.getObjectQLService(_context?.environmentId);\n        if (!ql || typeof ql.executeAction !== 'function') {\n            return { handled: true, response: this.error('Data engine not available', 503) };\n        }\n\n        // Resolve the handler — fall back to wildcard '*' if the object-specific key is missing.\n        // Since engine.executeAction throws when the key is unknown, we probe via the internal\n        // map by attempting the call inside a try/catch and rotating to '*'.\n        const tryExecute = async (obj: string) => {\n            return ql.executeAction(obj, actionName, actionContext);\n        };\n\n        const reqBody = body && typeof body === 'object' ? body : {};\n        const recordId = recordIdFromPath ?? reqBody.recordId;\n        const reqParams = (reqBody.params && typeof reqBody.params === 'object') ? reqBody.params : {};\n\n        // Load the record (best-effort) so handlers can rely on `ctx.record`.\n        let record: Record<string, unknown> = {};\n        if (recordId && objectName !== 'global') {\n            try {\n                const got = await this.callData('get', { object: objectName, id: recordId }, _context.dataDriver, _context.environmentId, _context.executionContext);\n                if (got?.record) record = got.record;\n            } catch { /* record may not exist for new-record actions; pass empty */ }\n        }\n        if (record && (record as any).id == null && recordId) (record as any).id = recordId;\n\n        // Slim engine facade matching the ActionContext.engine shape used by CRM handlers.\n        const engineFacade = {\n            async insert(object: string, data: Record<string, unknown>): Promise<{ id: string }> {\n                const res = await ql.insert(object, data);\n                const id = (res && (res as any).id) ?? (data as any).id;\n                return { id };\n            },\n            async update(object: string, id: string, data: Record<string, unknown>): Promise<void> {\n                await ql.update(object, data, { where: { id } });\n            },\n            async delete(object: string, id: string): Promise<void> {\n                await ql.delete(object, { where: { id } });\n            },\n            async find(object: string, query: Record<string, unknown>): Promise<Array<Record<string, unknown>>> {\n                const opts = query && Object.keys(query).length ? { where: query } : undefined;\n                const rows = await ql.find(object, opts as any);\n                return Array.isArray(rows) ? rows : ((rows as any)?.value ?? []);\n            },\n        };\n\n        const userIdFromAuth = (_context as any)?.user?.id ?? (_context as any)?.userId ?? 'system';\n        const userFromAuth = (_context as any)?.user ?? { id: userIdFromAuth, name: userIdFromAuth };\n\n        const actionContext: any = {\n            record,\n            user: userFromAuth,\n            engine: engineFacade,\n            params: { ...reqParams, recordId, objectName },\n        };\n\n        try {\n            // Try object-specific first; on \"not found\" error, fall back to wildcard.\n            let result: any;\n            try {\n                result = await tryExecute(objectName);\n            } catch (err: any) {\n                const msg = String(err?.message ?? err ?? '');\n                if (/not found/i.test(msg) && objectName !== '*') {\n                    result = await tryExecute('*');\n                } else {\n                    throw err;\n                }\n            }\n            return { handled: true, response: this.success({ success: true, data: result }) };\n        } catch (err: any) {\n            const msg = err?.message ?? String(err);\n            return { handled: true, response: this.success({ success: false, error: msg }) };\n        }\n    }\n\n    /**\n     * Handle AI service routes (/ai/chat, /ai/models, /ai/conversations, etc.)\n     * Resolves the AI service and its built-in route handlers, then dispatches.\n     */\n    async handleAI(subPath: string, method: string, body: any, query: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        let aiService: any;\n        try {\n            aiService = await this.resolveService('ai');\n        } catch {\n            // AI service not registered\n        }\n\n        if (!aiService) {\n            return {\n                handled: true,\n                response: {\n                    status: 404,\n                    body: { success: false, error: { message: 'AI service is not configured', code: 404 } },\n                },\n            };\n        }\n\n        // The AI service exposes route definitions via buildAIRoutes.\n        // We match the request path against known AI route patterns.\n        const fullPath = `/api/v1${subPath}`;\n\n        // Build a simple param-extracting matcher for route patterns like /api/v1/ai/conversations/:id\n        const matchRoute = (pattern: string, path: string): Record<string, string> | null => {\n            const patternParts = pattern.split('/');\n            const pathParts = path.split('/');\n            if (patternParts.length !== pathParts.length) return null;\n            const params: Record<string, string> = {};\n            for (let i = 0; i < patternParts.length; i++) {\n                if (patternParts[i].startsWith(':')) {\n                    params[patternParts[i].substring(1)] = pathParts[i];\n                } else if (patternParts[i] !== pathParts[i]) {\n                    return null;\n                }\n            }\n            return params;\n        };\n\n        // Try to get route definitions from the AI service's cached routes\n        const routes = (this.kernel as any).__aiRoutes as Array<{\n            method: string; path: string; handler: (req: any) => Promise<any>;\n        }> | undefined;\n\n        if (!routes) {\n            return {\n                handled: true,\n                response: {\n                    status: 503,\n                    body: { success: false, error: { message: 'AI service routes not yet initialized', code: 503 } },\n                },\n            };\n        }\n\n        for (const route of routes) {\n            if (route.method !== method) continue;\n            const params = matchRoute(route.path, fullPath);\n            if (params === null) continue;\n\n            const result = await route.handler({ body, params, query });\n\n            if (result.stream && result.events) {\n                // Return a streaming result for the adapter to handle\n                return {\n                    handled: true,\n                    result: {\n                        type: 'stream',\n                        contentType: result.vercelDataStream\n                            ? 'text/plain; charset=utf-8'\n                            : 'text/event-stream',\n                        events: result.events,\n                        vercelDataStream: result.vercelDataStream,\n                        headers: {\n                            'Content-Type': result.vercelDataStream\n                                ? 'text/plain; charset=utf-8'\n                                : 'text/event-stream',\n                            'Cache-Control': 'no-cache',\n                            'Connection': 'keep-alive',\n                        },\n                    },\n                };\n            }\n\n            return {\n                handled: true,\n                response: {\n                    status: result.status,\n                    body: result.body,\n                },\n            };\n        }\n\n        return {\n            handled: true,\n            response: this.routeNotFound(subPath),\n        };\n    }\n\n    /**\n     * Main Dispatcher Entry Point\n     * Routes the request to the appropriate handler based on path and precedence\n     */\n    async dispatch(method: string, path: string, body: any, query: any, context: HttpProtocolContext, prefix?: string): Promise<HttpDispatcherResult> {\n        let cleanPath = path.replace(/\\/$/, ''); // Remove trailing slash if present, but strict on clean paths\n\n        // ── Environment Resolution ──\n        // Resolve environment context for data-plane requests before routing\n        await this.resolveEnvironmentContext(context, cleanPath);\n\n        // ── Multi-Kernel Routing (ADR-0003 cloud mode) ──\n        // When a KernelManager is wired in, per-request routing targets the\n        // project's dedicated kernel. Self-hosted / legacy deployments leave\n        // `kernelManager` unset and continue using the constructor kernel.\n        // Reserved virtual id 'platform' addresses the control plane through\n        // the regular project URL family — never spin up a per-project kernel\n        // for it (there is no projects row to look up).\n        if (this.kernelManager && context.environmentId && context.environmentId !== 'platform') {\n            this.kernel = await this.kernelManager.getOrCreate(context.environmentId);\n        } else {\n            this.kernel = this.defaultKernel;\n        }\n\n        // Touch scope for TTL/LRU tracking in shared-kernel mode\n        if (this.scopeManager && context.environmentId && context.environmentId !== 'platform') {\n            this.scopeManager.touch(context.environmentId);\n        }\n\n        // ── Identity Resolution (RBAC/RLS/FLS context) ──\n        // Resolve once per request; SecurityPlugin middleware reads\n        // ctx.userId/roles/permissions/tenantId via opCtx.context.\n        try {\n            context.executionContext = await resolveExecutionContext({\n                getService: (n: string) => this.resolveService(n, context.environmentId),\n                getQl: () => Promise.resolve(this.getObjectQLService(context.environmentId)),\n                request: context.request,\n            });\n        } catch {\n            // anonymous request — leave executionContext undefined\n        }\n\n        // ── Project Membership Enforcement ──\n        // Once the environmentId is known, gate scoped data/meta/AI/automation\n        // routes on `sys_environment_member`. Control-plane paths, the system\n        // project, and platform-org members bypass this check.\n        const forbidden = await this.enforceProjectMembership(context, cleanPath);\n        if (forbidden) {\n            return { handled: true, response: forbidden };\n        }\n\n        // Strip the `/environments/:environmentId` prefix so the protocol dispatchers\n        // below (meta, data, ui, automation, …) see the same shape whether\n        // the caller used host-based routing, `X-Environment-Id`, or a scoped URL.\n        // `/cloud/environments/:id` is explicitly excluded — those are control\n        // plane CRUD endpoints and must reach handleCloud() unchanged.\n        if (!cleanPath.startsWith('/cloud/')) {\n            const scopedMatch = cleanPath.match(/^\\/projects\\/[^/]+(\\/.*)?$/);\n            if (scopedMatch) {\n                cleanPath = scopedMatch[1] ?? '';\n            }\n        }\n\n        // 0. Discovery Endpoint (GET /discovery or GET /)\n        // Standard route: /discovery (protocol-compliant)\n        // Legacy route: / (empty path, for backward compatibility — MSW strips base URL)\n        try {\n        if ((cleanPath === '/discovery' || cleanPath === '') && method === 'GET') {\n             const info = await this.getDiscoveryInfo(prefix ?? '');\n             return { \n                 handled: true, \n                 response: this.success(info) \n             };\n        }\n\n        // 0b. Health Endpoint (GET /health)\n        if (cleanPath === '/health' && method === 'GET') {\n            return {\n                handled: true,\n                response: this.success({\n                    status: 'ok',\n                    timestamp: new Date().toISOString(),\n                    version: '1.0.0',\n                    uptime: typeof process !== 'undefined' ? process.uptime() : undefined,\n                }),\n            };\n        }\n\n        // 0c. Plan-A diagnostics removed; the seed-replay and oauth2/callback\n        // probes were temporary debugging tools used during the SSO rollout.\n\n        // 1. System Protocols (Prefix-based)\n        if (cleanPath.startsWith('/auth')) {\n            return this.handleAuth(cleanPath.substring(5), method, body, context);\n        }\n        \n        if (cleanPath.startsWith('/meta')) {\n             return this.handleMetadata(cleanPath.substring(5), context, method, body, query);\n        }\n\n        if (cleanPath.startsWith('/data')) {\n            return this.handleData(cleanPath.substring(5), method, body, query, context);\n        }\n        \n        if (cleanPath.startsWith('/graphql')) {\n             if (method === 'POST') return this.handleGraphQL(body, context);\n             // GraphQL usually GET for Playground is handled by middleware but we can return 405 or handle it\n        }\n\n        if (cleanPath.startsWith('/storage')) {\n             return this.handleStorage(cleanPath.substring(8), method, body, context); // body here is file/stream for upload\n        }\n        \n        if (cleanPath.startsWith('/ui')) {\n             return this.handleUi(cleanPath.substring(3), query, context);\n        }\n\n        if (cleanPath.startsWith('/automation')) {\n             return this.handleAutomation(cleanPath.substring(11), method, body, context, query);\n        }\n\n        if (cleanPath.startsWith('/actions')) {\n             return this.handleActions(cleanPath.substring(8), method, body, context);\n        }\n        \n        if (cleanPath.startsWith('/analytics')) {\n             return this.handleAnalytics(cleanPath.substring(10), method, body, context);\n        }\n\n        if (cleanPath.startsWith('/packages')) {\n             return this.handlePackages(cleanPath.substring(9), method, body, query, context);\n        }\n\n        if (cleanPath.startsWith('/cloud')) {\n             return this.handleCloud(cleanPath.substring(6), method, body, query, context);\n        }\n\n        if (cleanPath.startsWith('/i18n')) {\n             return this.handleI18n(cleanPath.substring(5), method, query, context);\n        }\n\n        // AI Service — delegate to the registered AI route handlers\n        if (cleanPath.startsWith('/ai')) {\n             return this.handleAI(cleanPath, method, body, query, context);\n        }\n\n        // OpenAPI Specification\n        if (cleanPath === '/openapi.json' && method === 'GET') {\n             try {\n                const metaSvc = await this.resolveService('metadata', context.environmentId);\n                if (metaSvc && typeof (metaSvc as any).generateOpenApi === 'function') {\n                    const result = await (metaSvc as any).generateOpenApi({});\n                    return { handled: true, response: this.success(result) };\n                }\n             } catch (e) {\n                // If not implemented, fall through or return 404\n             }\n        }\n\n        // 2. Custom API Endpoints (Registry lookup)\n        // Check if there is a custom endpoint defined for this path\n        const result = await this.handleApiEndpoint(cleanPath, method, body, query, context);\n        if (result.handled) return result;\n\n        // 3. Fallback — return semantic 404 with diagnostic info\n        return {\n            handled: true,\n            response: this.routeNotFound(cleanPath),\n        };\n        } catch (e) {\n            if (isPermissionDeniedError(e)) {\n                return {\n                    handled: true,\n                    response: this.error(e.message, 403, { code: 'PERMISSION_DENIED', ...(e.details ?? {}) }),\n                };\n            }\n            throw e;\n        }\n    }\n\n    /**\n     * Handles Custom API Endpoints defined in metadata\n     */\n    async handleApiEndpoint(path: string, method: string, body: any, query: any, context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        try {\n            // Attempt to find a matching endpoint in the registry\n            const metaSvc = await this.resolveService('metadata', context.environmentId);\n            if (!metaSvc || typeof (metaSvc as any).matchEndpoint !== 'function') {\n                return { handled: false };\n            }\n            const endpoint = await (metaSvc as any).matchEndpoint({ path, method });\n            \n            if (endpoint) {\n                // Execute the endpoint target logic\n                if (endpoint.type === 'flow') {\n                    const automationSvc = await this.resolveService('automation');\n                    if (!automationSvc || typeof (automationSvc as any).runFlow !== 'function') {\n                        return { handled: true, response: this.error('Automation service not available', 503) };\n                    }\n                    const result = await (automationSvc as any).runFlow({ \n                        flowId: endpoint.target, \n                        inputs: { ...query, ...body, _request: context.request } \n                    });\n                     return { handled: true, response: this.success(result) };\n                }\n                \n                if (endpoint.type === 'script') {\n                    const automationSvc = await this.resolveService('automation');\n                    if (!automationSvc || typeof (automationSvc as any).runScript !== 'function') {\n                        return { handled: true, response: this.error('Automation service not available', 503) };\n                    }\n                     const result = await (automationSvc as any).runScript({ \n                        scriptName: endpoint.target, \n                        context: { ...query, ...body, request: context.request } \n                    });\n                     return { handled: true, response: this.success(result) };\n                }\n\n                if (endpoint.type === 'object_operation') {\n                    // e.g. Proxy to an object action\n                    if (endpoint.objectParams) {\n                        const { object, operation } = endpoint.objectParams;\n                        // Map standard CRUD operations\n                        if (operation === 'find') {\n                             const result = await this.callData('query', { object, query });\n                             // Spec: FindDataResponse = { object, records, total?, hasMore? }\n                             return { handled: true, response: this.success(result.records, { total: result.total }) };\n                        }\n                        if (operation === 'get' && query.id) {\n                             const result = await this.callData('get', { object, id: query.id });\n                             return { handled: true, response: this.success(result) };\n                        }\n                         if (operation === 'create') {\n                             const result = await this.callData('create', { object, data: body });\n                             return { handled: true, response: this.success(result) };\n                        }\n                    }\n                }\n\n                if (endpoint.type === 'proxy') {\n                     return { \n                         handled: true, \n                         response: { \n                             status: 200, \n                             body: { proxy: true, target: endpoint.target, note: 'Proxy execution requires http-client service' } \n                         } \n                     };\n                }\n            }\n        } catch (e) {\n            // If matchEndpoint fails (e.g. not found), we just return not handled\n            // so we can fallback to 404 or other handlers\n        }\n\n        return { handled: false };\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * resolveExecutionContext — REST entry-point identity resolver.\n *\n * Builds an {@link ExecutionContext} from an incoming HTTP request by combining:\n *  - better-auth Bearer/Session cookies (`authService.api.getSession`)\n *  - API Key headers (`X-API-Key` / `Authorization: ApiKey <token>`) — first\n *    via better-auth's apiKey plugin if available, otherwise a direct lookup\n *    against the `sys_api_key` system object.\n *  - `sys_member` lookup for `(userId, activeOrganizationId)` to populate\n *    organization-scoped roles, plus any extra permission sets bound through\n *    the `sys_user_permission_set` / `sys_role_permission_set` link tables.\n *\n * The resolver is intentionally non-fatal: when auth is not wired up or any\n * of the dependent services are unavailable, it returns the partial context\n * that can be reconstructed (even an empty `{ isSystem: false, roles: [],\n * permissions: [] }`). Permission enforcement is the SecurityPlugin's job.\n */\n\nimport type { ExecutionContext } from '@objectstack/spec/kernel';\n\ninterface ResolveOptions {\n  /** Function returning a service from the active kernel (or undefined). */\n  getService: (name: string) => Promise<any> | any;\n  /** Function returning the data engine (ObjectQL) for the active scope. */\n  getQl: () => Promise<any> | any;\n  /** The raw incoming HTTP request (Fetch Request, Node IncomingMessage, …). */\n  request: any;\n}\n\nfunction readHeader(headers: any, name: string): string | undefined {\n  if (!headers) return undefined;\n  const lower = name.toLowerCase();\n  if (typeof headers.get === 'function') {\n    const v = headers.get(name) ?? headers.get(lower);\n    return v == null ? undefined : String(v);\n  }\n  for (const key of Object.keys(headers)) {\n    if (key.toLowerCase() === lower) {\n      const v = headers[key];\n      return Array.isArray(v) ? v[0] : v == null ? undefined : String(v);\n    }\n  }\n  return undefined;\n}\n\nfunction extractApiKey(headers: any): string | undefined {\n  const x = readHeader(headers, 'x-api-key');\n  if (x) return x.trim();\n  const auth = readHeader(headers, 'authorization');\n  if (!auth) return undefined;\n  const m = auth.match(/^ApiKey\\s+(.+)$/i);\n  return m ? m[1].trim() : undefined;\n}\n\n/**\n * Convert the dispatcher's plain `Record<string,string>` headers map into\n * a Web `Headers` instance so libraries like better-auth (which reads via\n * `headers.get('cookie')`) work uniformly.\n */\nfunction toHeaders(input: any): any {\n  if (!input) return new Headers();\n  if (typeof Headers !== 'undefined' && input instanceof Headers) return input;\n  const h = new Headers();\n  if (typeof input.entries === 'function') {\n    for (const [k, v] of input.entries()) h.set(String(k), String(v));\n    return h;\n  }\n  for (const k of Object.keys(input)) {\n    const v = (input as any)[k];\n    if (v == null) continue;\n    h.set(String(k), Array.isArray(v) ? v.join(',') : String(v));\n  }\n  return h;\n}\n\nasync function tryFind(ql: any, object: string, where: any, limit = 100): Promise<any[]> {\n  if (!ql || typeof ql.find !== 'function') return [];\n  try {\n    let rows = await ql.find(object, { where, limit, context: { isSystem: true } } as any);\n    if (rows && (rows as any).value) rows = (rows as any).value;\n    return Array.isArray(rows) ? rows : [];\n  } catch {\n    return [];\n  }\n}\n\n/**\n * Resolve the {@link ExecutionContext} for an inbound request.\n *\n * Always resolves — never throws. Anonymous requests yield\n * `{ isSystem: false, roles: [], permissions: [] }`.\n */\nexport async function resolveExecutionContext(opts: ResolveOptions): Promise<ExecutionContext> {\n  const headers = opts.request?.headers;\n  const ctx: ExecutionContext = {\n    roles: [],\n    permissions: [],\n    isSystem: false,\n  };\n\n  let userId: string | undefined;\n  let tenantId: string | undefined;\n\n  // 1. API Key path — takes precedence over session, since callers explicitly\n  //    opt in to API-key auth via the header.\n  const apiKey = extractApiKey(headers);\n  if (apiKey) {\n    try {\n      const authService: any = await opts.getService('auth');\n      // better-auth apiKey plugin (if enabled) exposes a verify endpoint.\n      const verify = authService?.api?.verifyApiKey ?? authService?.api?.apiKey?.verify;\n      if (typeof verify === 'function') {\n        const res = await verify({ body: { key: apiKey } });\n        const payload = res?.key ?? res;\n        if (payload?.userId) userId = payload.userId;\n        if (payload?.organizationId) tenantId = payload.organizationId;\n        if (Array.isArray(payload?.permissions)) {\n          ctx.permissions!.push(...payload.permissions);\n        }\n        if (Array.isArray(payload?.scopes)) {\n          ctx.permissions!.push(...payload.scopes);\n        }\n      }\n    } catch {\n      // ignore — fall through to direct lookup\n    }\n\n    if (!userId) {\n      // Direct lookup against sys_api_key — supports keys provisioned outside\n      // of better-auth (legacy or self-managed).\n      const ql = await opts.getQl();\n      const rows = await tryFind(ql, 'sys_api_key', { key: apiKey, active: true }, 1);\n      const row = rows[0];\n      if (row) {\n        userId = row.user_id ?? row.userId;\n        tenantId = row.organization_id ?? row.organizationId;\n        if (Array.isArray(row.scopes)) ctx.permissions!.push(...row.scopes);\n      }\n    }\n  }\n\n  // 2. Session / Bearer path — fall back when API key did not resolve a user.\n  if (!userId) {\n    try {\n      const authService: any = await opts.getService('auth');\n      // better-auth's `getSession` expects a Web `Headers` instance\n      // (it calls `headers.get('cookie')`). The HTTP adapter hands us a\n      // plain `Record<string,string>`, so wrap it before forwarding.\n      const headersInstance = toHeaders(headers);\n      const sessionData = await authService?.api?.getSession?.({ headers: headersInstance });\n      userId = sessionData?.user?.id ?? sessionData?.session?.userId;\n      tenantId = tenantId ?? sessionData?.session?.activeOrganizationId;\n      ctx.accessToken = sessionData?.session?.token ?? ctx.accessToken;\n    } catch {\n      // no auth configured — return anonymous context\n    }\n  }\n\n  if (userId) ctx.userId = userId;\n  if (tenantId) ctx.tenantId = tenantId;\n\n  if (!userId) return ctx;\n\n  // 3. Resolve organization-scoped roles via sys_member, then merge any\n  //    permission sets bound via the link tables. All lookups go through\n  //    ObjectQL with `isSystem: true` to avoid recursion through the\n  //    SecurityPlugin middleware.\n  const ql = await opts.getQl();\n  if (!ql) return ctx;\n\n  const memberWhere: any = tenantId\n    ? { user_id: userId, organization_id: tenantId }\n    : { user_id: userId };\n  const members = await tryFind(ql, 'sys_member', memberWhere, 50);\n  for (const m of members) {\n    if (m.role && typeof m.role === 'string') {\n      // better-auth stores comma-separated roles for multi-role membership.\n      for (const r of m.role.split(',').map((s: string) => s.trim()).filter(Boolean)) {\n        if (!ctx.roles!.includes(r)) ctx.roles!.push(r);\n      }\n    }\n  }\n\n  // 3a. Resolve fellow-organization user IDs so RLS can scope identity\n  //     tables (`sys_user`) to collaborators in the active org via\n  //     `id IN (current_user.org_user_ids)`. Without this, the default\n  //     `id = current_user.id` policy on sys_user makes @-mention pickers,\n  //     owner/assignee lookups and reviewer selectors all return just the\n  //     current user. Hard-capped at 1000 members per request — large\n  //     enterprises should plug in a cache or directory adapter.\n  if (tenantId) {\n    const orgMembers = await tryFind(\n      ql,\n      'sys_member',\n      { organization_id: tenantId },\n      1000,\n    );\n    const orgUserIds = Array.from(\n      new Set(\n        orgMembers\n          .map((m) => m.user_id ?? m.userId)\n          .filter((v): v is string => typeof v === 'string' && v.length > 0),\n      ),\n    );\n    // Always include self even if the sys_member lookup misfires (e.g.\n    // API key auth where the user is recognised but not in sys_member).\n    if (!orgUserIds.includes(userId)) orgUserIds.push(userId);\n    (ctx as any).org_user_ids = orgUserIds;\n  } else {\n    // No active org → at minimum the user can see themselves.\n    (ctx as any).org_user_ids = [userId];\n  }\n\n  // Resolve user-scoped permission sets.\n  const upsRows = await tryFind(\n    ql,\n    'sys_user_permission_set',\n    tenantId\n      ? { user_id: userId, organization_id: tenantId }\n      : { user_id: userId },\n    100,\n  );\n  const psIds = new Set<string>(\n    upsRows.map((r) => r.permission_set_id ?? r.permissionSetId).filter(Boolean),\n  );\n\n  // Resolve role-bound permission sets.\n  if (ctx.roles!.length > 0) {\n    const roleRows = await tryFind(ql, 'sys_role', { name: { $in: ctx.roles } }, 100);\n    const roleIds = roleRows.map((r) => r.id).filter(Boolean);\n    if (roleIds.length > 0) {\n      const rpsRows = await tryFind(\n        ql,\n        'sys_role_permission_set',\n        { role_id: { $in: roleIds } },\n        500,\n      );\n      for (const r of rpsRows) {\n        const id = r.permission_set_id ?? r.permissionSetId;\n        if (id) psIds.add(id);\n      }\n    }\n  }\n\n  if (psIds.size > 0) {\n    // Surface permission set names through ctx.permissions so downstream\n    // SecurityPlugin can look them up. We store the canonical `name` field.\n    const psRows = await tryFind(\n      ql,\n      'sys_permission_set',\n      { id: { $in: Array.from(psIds) } },\n      500,\n    );\n    for (const ps of psRows) {\n      if (ps.name && !ctx.permissions!.includes(ps.name)) {\n        ctx.permissions!.push(ps.name);\n      }\n    }\n  }\n\n  return ctx;\n}\n\n/**\n * Typed sentinel error thrown by SecurityPlugin (and re-thrown here) when an\n * operation is denied. The dispatcher catches it and translates to HTTP 403.\n *\n * Kept structurally identical to {@link `@objectstack/plugin-security`}'s\n * `PermissionDeniedError` so `isPermissionDeniedError` matches whichever\n * class instance crosses the boundary, regardless of which package owns\n * the actual class identity at runtime. We do not add a hard dependency\n * on `plugin-security` here to keep the runtime usable in stack\n * compositions without security enforcement.\n */\nexport class PermissionDeniedError extends Error {\n  readonly code = 'PERMISSION_DENIED';\n  readonly statusCode = 403;\n  readonly details?: Record<string, unknown>;\n  constructor(message: string, details?: Record<string, unknown>) {\n    super(message);\n    this.name = 'PermissionDeniedError';\n    this.details = details;\n  }\n}\n\nexport function isPermissionDeniedError(e: unknown): e is PermissionDeniedError {\n  if (!e || typeof e !== 'object') return false;\n  const anyE = e as any;\n  return (\n    anyE.name === 'PermissionDeniedError' ||\n    anyE.code === 'PERMISSION_DENIED' ||\n    (typeof anyE.message === 'string' && anyE.message.startsWith('[Security] Access denied'))\n  );\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Security response headers builder.\n *\n * Returns the conservative defaults every production API server should\n * send on every response. Designed to be merged with route-specific\n * headers by the dispatcher (`sendResult`) so all adapters (Hono,\n * Fastify, Express, Next.js, …) get them uniformly without each one\n * re-implementing helmet.\n *\n * What we DO opinionate:\n *   - Content-Security-Policy (api-default: deny everything but self)\n *   - Strict-Transport-Security (HSTS, prod-only — TLS is the caller's\n *     responsibility; we just emit the header)\n *   - X-Content-Type-Options: nosniff\n *   - X-Frame-Options: DENY (anti clickjacking)\n *   - Referrer-Policy: no-referrer\n *   - Permissions-Policy: geolocation=(), camera=(), microphone=()\n *   - Cross-Origin-Resource-Policy: same-origin\n *\n * What we DON'T opinionate:\n *   - X-XSS-Protection (deprecated)\n *   - CORS — that's an app concern, configure separately\n *   - CSP for HTML pages — set a different CSP at the SPA host\n *\n * Every header can be overridden or disabled by config.\n */\n\nexport interface SecurityHeadersOptions {\n  /**\n   * Enable HSTS. Set to `true` in production behind TLS. When `false`\n   * the Strict-Transport-Security header is omitted.\n   * @default false\n   */\n  hsts?: boolean | {\n    /** Max-age in seconds. @default 15552000 (180 days) */\n    maxAge?: number;\n    includeSubDomains?: boolean;\n    preload?: boolean;\n  };\n  /**\n   * Override the Content-Security-Policy header. Pass `false` to omit.\n   * @default \"default-src 'none'; frame-ancestors 'none'\"\n   */\n  contentSecurityPolicy?: string | false;\n  /**\n   * Override X-Frame-Options. @default 'DENY'\n   */\n  frameOptions?: 'DENY' | 'SAMEORIGIN' | false;\n  /**\n   * Override Referrer-Policy. @default 'no-referrer'\n   */\n  referrerPolicy?: string | false;\n  /**\n   * Override Permissions-Policy. Pass `false` to omit.\n   * @default 'geolocation=(), camera=(), microphone=(), payment=()'\n   */\n  permissionsPolicy?: string | false;\n  /**\n   * Override Cross-Origin-Resource-Policy. @default 'same-origin'\n   */\n  corp?: 'same-origin' | 'same-site' | 'cross-origin' | false;\n  /**\n   * Free-form extra headers merged last.\n   */\n  extra?: Record<string, string>;\n}\n\n/**\n * Build a header map ready to be `Object.assign`'d into a response.\n * Idempotent and synchronous — safe to call per-request.\n */\nexport function buildSecurityHeaders(opts: SecurityHeadersOptions = {}): Record<string, string> {\n  const h: Record<string, string> = {};\n\n  if (opts.contentSecurityPolicy !== false) {\n    h['Content-Security-Policy'] =\n      opts.contentSecurityPolicy ?? \"default-src 'none'; frame-ancestors 'none'\";\n  }\n\n  if (opts.hsts) {\n    const cfg = typeof opts.hsts === 'object' ? opts.hsts : {};\n    const maxAge = cfg.maxAge ?? 15_552_000;\n    const parts = [`max-age=${maxAge}`];\n    if (cfg.includeSubDomains ?? true) parts.push('includeSubDomains');\n    if (cfg.preload) parts.push('preload');\n    h['Strict-Transport-Security'] = parts.join('; ');\n  }\n\n  h['X-Content-Type-Options'] = 'nosniff';\n\n  if (opts.frameOptions !== false) {\n    h['X-Frame-Options'] = opts.frameOptions ?? 'DENY';\n  }\n\n  if (opts.referrerPolicy !== false) {\n    h['Referrer-Policy'] = opts.referrerPolicy ?? 'no-referrer';\n  }\n\n  if (opts.permissionsPolicy !== false) {\n    h['Permissions-Policy'] =\n      opts.permissionsPolicy ?? 'geolocation=(), camera=(), microphone=(), payment=()';\n  }\n\n  if (opts.corp !== false) {\n    h['Cross-Origin-Resource-Policy'] = opts.corp ?? 'same-origin';\n  }\n\n  if (opts.extra) {\n    Object.assign(h, opts.extra);\n  }\n\n  return h;\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * In-memory token-bucket rate limiter.\n *\n * Designed to be adapter-agnostic — the dispatcher calls `consume(key)`\n * with a request fingerprint (IP, IP+route bucket, or user id) and\n * short-circuits with 429 if the bucket is empty.\n *\n * For production multi-instance deploys, swap the in-memory store via\n * `RateLimitStore`. The shape is intentionally narrow so a Redis-backed\n * implementation is straightforward.\n */\n\nexport interface RateLimitDecision {\n  allowed: boolean;\n  /** Remaining tokens in the bucket after this consume. */\n  remaining: number;\n  /** Wall-clock ms until next token is available (when not allowed). */\n  retryAfterMs: number;\n  /** UNIX ms when the limit window resets. */\n  resetAt: number;\n}\n\nexport interface RateLimitBucketConfig {\n  /** Max tokens (bucket capacity). */\n  capacity: number;\n  /** Tokens added per second. */\n  refillPerSec: number;\n  /** Optional cost override for the consume operation. @default 1 */\n  defaultCost?: number;\n}\n\ninterface BucketState {\n  tokens: number;\n  /** Last refill timestamp (ms). */\n  lastRefill: number;\n}\n\n/**\n * Storage interface — swap for Redis/Memcached in clustered deploys.\n * Implementations MUST be safe under concurrent access.\n */\nexport interface RateLimitStore {\n  get(key: string): BucketState | undefined;\n  set(key: string, state: BucketState): void;\n  /** Cleanup hint — implementations may evict idle entries. */\n  prune?(olderThanMs: number): void;\n}\n\nclass MemoryStore implements RateLimitStore {\n  private buckets = new Map<string, BucketState>();\n  private maxEntries: number;\n\n  constructor(maxEntries = 100_000) {\n    this.maxEntries = maxEntries;\n  }\n\n  get(key: string): BucketState | undefined {\n    return this.buckets.get(key);\n  }\n\n  set(key: string, state: BucketState): void {\n    // Crude LRU eviction — drop the oldest 10% when we hit the cap.\n    // Good enough for an in-memory store; replace with Redis if you\n    // need precision under load.\n    if (this.buckets.size >= this.maxEntries) {\n      const dropCount = Math.max(1, Math.floor(this.maxEntries / 10));\n      const iter = this.buckets.keys();\n      for (let i = 0; i < dropCount; i++) {\n        const k = iter.next().value;\n        if (!k) break;\n        this.buckets.delete(k);\n      }\n    }\n    this.buckets.set(key, state);\n  }\n\n  prune(olderThanMs: number): void {\n    const cutoff = Date.now() - olderThanMs;\n    for (const [k, v] of this.buckets) {\n      if (v.lastRefill < cutoff) this.buckets.delete(k);\n    }\n  }\n}\n\nexport class RateLimiter {\n  private config: RateLimitBucketConfig;\n  private store: RateLimitStore;\n  private now: () => number;\n\n  constructor(config: RateLimitBucketConfig, opts: { store?: RateLimitStore; now?: () => number } = {}) {\n    if (config.capacity <= 0) throw new Error('RateLimiter: capacity must be > 0');\n    if (config.refillPerSec <= 0) throw new Error('RateLimiter: refillPerSec must be > 0');\n    this.config = config;\n    this.store = opts.store ?? new MemoryStore();\n    // Injectable clock keeps tests deterministic.\n    this.now = opts.now ?? Date.now;\n  }\n\n  /**\n   * Attempt to consume `cost` tokens for `key`. Returns a decision\n   * describing whether the request should proceed and, if not, how\n   * long the caller should wait before retrying.\n   */\n  consume(key: string, cost = this.config.defaultCost ?? 1): RateLimitDecision {\n    const now = this.now();\n    const { capacity, refillPerSec } = this.config;\n\n    let state = this.store.get(key);\n    if (!state) {\n      state = { tokens: capacity, lastRefill: now };\n    } else {\n      const elapsedSec = (now - state.lastRefill) / 1000;\n      if (elapsedSec > 0) {\n        state = {\n          tokens: Math.min(capacity, state.tokens + elapsedSec * refillPerSec),\n          lastRefill: now,\n        };\n      }\n    }\n\n    if (state.tokens >= cost) {\n      state.tokens -= cost;\n      this.store.set(key, state);\n      return {\n        allowed: true,\n        remaining: Math.floor(state.tokens),\n        retryAfterMs: 0,\n        resetAt: now + Math.ceil(((capacity - state.tokens) / refillPerSec) * 1000),\n      };\n    }\n\n    const tokensNeeded = cost - state.tokens;\n    const retryAfterMs = Math.ceil((tokensNeeded / refillPerSec) * 1000);\n    this.store.set(key, state);\n    return {\n      allowed: false,\n      remaining: Math.floor(state.tokens),\n      retryAfterMs,\n      resetAt: now + retryAfterMs,\n    };\n  }\n\n  /** Force-reset a key (e.g. after a successful auth flow). */\n  reset(key: string): void {\n    this.store.set(key, { tokens: this.config.capacity, lastRefill: this.now() });\n  }\n}\n\n/**\n * Curated default buckets for the three traffic classes ObjectStack\n * dispatches. Conservative — tune via `DispatcherPluginConfig.rateLimit`\n * for your deployment.\n *\n *   - auth: 10 req / minute / IP — guards /auth/* against credential\n *     stuffing and password-spray.\n *   - write: 60 req / minute / IP — POST/PUT/PATCH/DELETE.\n *   - read:  600 req / minute / IP — GET, including discovery and\n *     metadata.\n *\n * \"Per-IP\" is just the suggested key shape; the dispatcher constructs\n * the key from `${ip}:${bucket}` so a single noisy IP can saturate\n * one bucket without blocking the others.\n */\nexport interface RateLimitDefaults {\n  auth: RateLimitBucketConfig;\n  write: RateLimitBucketConfig;\n  read: RateLimitBucketConfig;\n}\n\nexport const DEFAULT_RATE_LIMITS: RateLimitDefaults = {\n  auth: { capacity: 10, refillPerSec: 10 / 60 },\n  write: { capacity: 60, refillPerSec: 60 / 60 },\n  read: { capacity: 600, refillPerSec: 600 / 60 },\n};\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Request correlation primitives.\n *\n * Two concerns:\n *\n *   1. **Request IDs.** Every request gets a stable id that is echoed back\n *      via `X-Request-Id`, threaded into log records, and (where the host\n *      asks for it) made available to handlers via `req.requestId`. The id\n *      comes from the incoming `X-Request-Id` header when present and\n *      well-formed, otherwise we mint a fresh one.\n *\n *   2. **W3C Trace Context.** When clients pass `traceparent` per\n *      <https://www.w3.org/TR/trace-context/>, we surface the parsed\n *      `traceId` / `spanId` / `sampled` triple so the host can attach it\n *      to its OTel SDK / logger.\n *\n * Both helpers are pure functions — no I/O, no side effects, no\n * dependencies — so they are safe to call on the hot path and trivial to\n * test.\n */\n\nconst MAX_REQUEST_ID_LENGTH = 200;\n\n/**\n * Allowed characters in a request id: alphanumerics plus `-_.:`.\n * Rejects whitespace, control chars, anything that could interfere\n * with header serialization or log parsing.\n */\nconst REQUEST_ID_PATTERN = /^[A-Za-z0-9._:-]+$/;\n\n/**\n * Extract a request id from incoming headers, validating shape. If\n * the header is missing or malformed, returns `undefined` and the\n * caller should mint one via {@link generateRequestId}.\n *\n * Header lookup is case-insensitive — adapters normalize differently.\n */\nexport function extractRequestId(headers: unknown): string | undefined {\n    if (!headers || typeof headers !== 'object') return undefined;\n    for (const [k, v] of Object.entries(headers as Record<string, unknown>)) {\n        if (k.toLowerCase() !== 'x-request-id') continue;\n        const raw = Array.isArray(v) ? v[0] : v;\n        if (typeof raw !== 'string') return undefined;\n        const trimmed = raw.trim();\n        if (!trimmed || trimmed.length > MAX_REQUEST_ID_LENGTH) return undefined;\n        if (!REQUEST_ID_PATTERN.test(trimmed)) return undefined;\n        return trimmed;\n    }\n    return undefined;\n}\n\n/**\n * Mint a fresh request id. Uses `crypto.randomUUID()` when available\n * (Node 16+, modern browsers, edge runtimes); falls back to a\n * timestamp+random suffix otherwise so the function is universally\n * callable.\n *\n * Format is `req_<hex>`; the prefix makes it obvious in logs that the\n * id was minted by this layer (vs. propagated from a client).\n */\nexport function generateRequestId(): string {\n    const g: { randomUUID?: () => string } | undefined =\n        (globalThis as unknown as { crypto?: { randomUUID?: () => string } }).crypto;\n    if (g && typeof g.randomUUID === 'function') {\n        return `req_${g.randomUUID().replace(/-/g, '')}`;\n    }\n    const t = Date.now().toString(36);\n    const r = Math.random().toString(36).slice(2, 12);\n    return `req_${t}${r}`;\n}\n\n/**\n * Return the incoming request id if valid, otherwise mint one.\n */\nexport function resolveRequestId(\n    headers: unknown,\n    generate: () => string = generateRequestId,\n): string {\n    return extractRequestId(headers) ?? generate();\n}\n\n/**\n * Parsed W3C Trace Context. `sampled` reflects the lowest flag bit.\n */\nexport interface TraceContext {\n    traceId: string;\n    spanId: string;\n    sampled: boolean;\n}\n\nconst TRACEPARENT_PATTERN = /^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;\n\n/**\n * Parse a `traceparent` header value into its W3C fields. Returns\n * `undefined` for malformed input, the all-zero trace/span ids\n * (spec-mandated invalid), or unknown versions.\n */\nexport function parseTraceparent(value: unknown): TraceContext | undefined {\n    if (typeof value !== 'string') return undefined;\n    const m = TRACEPARENT_PATTERN.exec(value.trim().toLowerCase());\n    if (!m) return undefined;\n    const [, version, traceId, spanId, flags] = m;\n    if (version !== '00') return undefined;\n    if (/^0+$/.test(traceId) || /^0+$/.test(spanId)) return undefined;\n    const sampled = (parseInt(flags, 16) & 0x01) === 0x01;\n    return { traceId, spanId, sampled };\n}\n\n/**\n * Build the response header equivalent so downstream services\n * continue the trace.\n */\nexport function formatTraceparent(ctx: TraceContext): string {\n    const flag = ctx.sampled ? '01' : '00';\n    return `00-${ctx.traceId}-${ctx.spanId}-${flag}`;\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Backwards-compat shim. The canonical home for `MetricsRegistry`,\n * `NoopMetricsRegistry`, `InMemoryMetricsRegistry`, `MetricSample`, and\n * the `RUNTIME_METRICS` constants moved to `@objectstack/observability`\n * so deployment-target-neutral code (cloud, self-hosted, ...) can\n * import them without pulling in the whole runtime.\n *\n * Existing imports from `@objectstack/runtime`-internal paths continue\n * to work transparently via this re-export.\n */\nexport {\n    NoopMetricsRegistry,\n    InMemoryMetricsRegistry,\n    RUNTIME_METRICS,\n    type MetricsRegistry,\n    type MetricSample,\n} from '@objectstack/observability';\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Backwards-compat shim. See `metrics.ts` for the rationale — the\n * canonical home is `@objectstack/observability`.\n */\nexport {\n    NoopErrorReporter,\n    InMemoryErrorReporter,\n    type ErrorReporter,\n    type CapturedError,\n} from '@objectstack/observability';\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport {\n    NoopMetricsRegistry,\n    NoopErrorReporter,\n    resolveRequestId,\n    RUNTIME_METRICS,\n    type MetricsRegistry,\n    type ErrorReporter,\n} from './index.js';\n\n/**\n * Options for {@link instrumentRouteHandler}. All fields optional; the\n * defaults make the wrapper a no-op (zero overhead, no behavior change).\n *\n * Hosts plug their own implementations to bridge to Prometheus / OTel /\n * Sentry / Datadog without the framework taking a hard dependency on\n * any of them.\n */\nexport interface InstrumentOptions {\n    metrics?: MetricsRegistry;\n    errorReporter?: ErrorReporter;\n    /** Override the default `req_<uuid>` generator. */\n    generateRequestId?: () => string;\n    /** Response header that echoes the request id (default `X-Request-Id`). */\n    requestIdHeader?: string;\n    /**\n     * Wall clock for tests. Defaults to `Date.now`; only `now()` is\n     * called, so any monotonic source works.\n     */\n    now?: () => number;\n}\n\n/**\n * Wrap an HTTP route handler with the runtime's standard observability\n * lifecycle:\n *\n *   1. Resolve a request id from incoming `X-Request-Id` (or mint one).\n *   2. Set the request id on `req.requestId` and response header.\n *   3. Time the handler.\n *   4. Emit `http_requests_total{method,route,status}` counter and\n *      `http_request_duration_ms{method,route}` histogram.\n *   5. On thrown errors, emit `http_request_errors_total` and call\n *      `errorReporter.captureException` for 5xx.\n *   6. When the handler catches its own error and calls\n *      `errorResponseBase` (which leaves a side-channel\n *      `res.__obsRecordedError`), still call the error reporter.\n *\n * The wrapper does not catch the error — it re-throws so the host\n * server still gets a chance to render its own 500 page if needed.\n */\nexport function instrumentRouteHandler(\n    method: string,\n    route: string,\n    handler: (req: any, res: any) => unknown,\n    opts: InstrumentOptions = {},\n): (req: any, res: any) => Promise<void> {\n    const metrics = opts.metrics ?? new NoopMetricsRegistry();\n    const errorReporter = opts.errorReporter ?? new NoopErrorReporter();\n    const generateRequestId = opts.generateRequestId;\n    const requestIdHeader = opts.requestIdHeader ?? 'X-Request-Id';\n    const now = opts.now ?? Date.now;\n\n    return async (req: any, res: any) => {\n        const requestId = resolveRequestId(req?.headers, generateRequestId);\n        try {\n            (req as any).requestId = requestId;\n        } catch {\n            // frozen req object — fine, the header is the source of truth\n        }\n        if (typeof res?.header === 'function') {\n            try {\n                res.header(requestIdHeader, requestId);\n            } catch {\n                // adapter rejects header injection here — fine\n            }\n        }\n\n        // Capture the final status. We start at 200 (the adapter default\n        // when no status() is called) and override on status() calls via\n        // a tiny proxy.\n        let status = 200;\n        const origStatus =\n            typeof res?.status === 'function' ? res.status.bind(res) : undefined;\n        if (origStatus) {\n            res.status = (code: number) => {\n                status = code;\n                return origStatus(code);\n            };\n        }\n\n        const startedAt = now();\n        let threw = false;\n        try {\n            await handler(req, res);\n        } catch (err: any) {\n            threw = true;\n            status = err?.statusCode ?? 500;\n            metrics.counter(RUNTIME_METRICS.httpRequestErrorsTotal, { method, route });\n            if (status >= 500) {\n                safeReport(errorReporter, err, { requestId, method, route });\n            }\n            throw err;\n        } finally {\n            const elapsed = now() - startedAt;\n            metrics.counter(RUNTIME_METRICS.httpRequestsTotal, {\n                method,\n                route,\n                status: String(status),\n            });\n            metrics.histogram(\n                RUNTIME_METRICS.httpRequestDurationMs,\n                elapsed,\n                { method, route },\n            );\n            // Side-channel: handler caught the error and called\n            // errorResponseBase, which recorded the original error on\n            // `res.__obsRecordedError`. Pick it up so 5xx still\n            // reaches the reporter even though we did not see the throw.\n            if (!threw && status >= 500) {\n                const recorded = (res as any)?.__obsRecordedError;\n                if (recorded !== undefined) {\n                    safeReport(errorReporter, recorded, { requestId, method, route });\n                }\n            }\n        }\n    };\n}\n\nfunction safeReport(\n    reporter: ErrorReporter,\n    err: unknown,\n    ctx: Record<string, unknown>,\n): void {\n    try {\n        reporter.captureException(err, ctx);\n    } catch {\n        // never let reporter failures mask the original error\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { Plugin, PluginContext } from '@objectstack/core';\nimport {\n    OBSERVABILITY_METRICS_SERVICE,\n    OBSERVABILITY_ERRORS_SERVICE,\n} from '@objectstack/observability';\nimport {\n    NoopMetricsRegistry,\n    NoopErrorReporter,\n    type MetricsRegistry,\n    type ErrorReporter,\n} from './index.js';\n\n/**\n * Canonical service names other plugins look up to find the host's\n * configured observability backends. Re-exported from\n * `@objectstack/observability` so callers can grab them alongside the\n * plugin without straddling two packages.\n */\nexport { OBSERVABILITY_METRICS_SERVICE, OBSERVABILITY_ERRORS_SERVICE };\n\n/**\n * Options for {@link ObservabilityServicePlugin}.\n *\n * Either or both backends can be omitted; the omitted one resolves to\n * the corresponding no-op exporter so consumers can always rely on the\n * service being present.\n */\nexport interface ObservabilityServicePluginOptions {\n    /** Metrics backend (e.g. `ConsoleMetricsRegistry`, `OtlpHttpMetricsRegistry`). */\n    metrics?: MetricsRegistry;\n    /** Error reporter backend (e.g. Sentry adapter). */\n    errors?: ErrorReporter;\n}\n\n/**\n * `ObservabilityServicePlugin` — registers the host's\n * {@link MetricsRegistry} and {@link ErrorReporter} in the kernel\n * service registry under the canonical names so any other plugin can\n * look them up without each host having to thread observability config\n * through every plugin constructor.\n *\n * Resolution chain other plugins should follow:\n *\n *   1. Explicit option on the plugin's own options object (escape\n *      hatch for tests / explicit wiring).\n *   2. `ctx.getService(OBSERVABILITY_METRICS_SERVICE)`.\n *   3. `NoopMetricsRegistry()` — never null.\n *\n * Register this plugin **before** any plugin that wants to consume the\n * services (cache, storage, dispatcher), otherwise the consumer's\n * `init` will fall through to the no-op default.\n *\n * @example\n * ```ts\n * import { ObjectKernel } from '@objectstack/core';\n * import {\n *   ObservabilityServicePlugin,\n *   CacheServicePlugin,\n * } from '@objectstack/runtime';\n * import { ConsoleMetricsRegistry } from '@objectstack/observability';\n *\n * const kernel = new ObjectKernel();\n * kernel.use(new ObservabilityServicePlugin({\n *   metrics: new ConsoleMetricsRegistry(),\n * }));\n * kernel.use(new CacheServicePlugin()); // picks metrics up automatically\n * ```\n */\nexport class ObservabilityServicePlugin implements Plugin {\n    name = 'com.objectstack.observability.service';\n    version = '1.0.0';\n    type = 'standard';\n\n    private readonly options: ObservabilityServicePluginOptions;\n\n    constructor(options: ObservabilityServicePluginOptions = {}) {\n        this.options = options;\n    }\n\n    async init(ctx: PluginContext): Promise<void> {\n        const metrics = this.options.metrics ?? new NoopMetricsRegistry();\n        const errors = this.options.errors ?? new NoopErrorReporter();\n        ctx.registerService(OBSERVABILITY_METRICS_SERVICE, metrics);\n        ctx.registerService(OBSERVABILITY_ERRORS_SERVICE, errors);\n        ctx.logger.info(\n            `ObservabilityServicePlugin: registered metrics=${(metrics as any).constructor?.name ?? 'unknown'} errors=${(errors as any).constructor?.name ?? 'unknown'}`,\n        );\n    }\n}\n\n/**\n * Helper used by consumer plugins to resolve a metrics backend with\n * the canonical fallback chain. Never throws; always returns a usable\n * `MetricsRegistry`.\n *\n * @param ctx        the consuming plugin's `PluginContext`\n * @param override   explicit option set on the consuming plugin (wins)\n */\nexport function resolveMetrics(\n    ctx: PluginContext,\n    override?: MetricsRegistry,\n): MetricsRegistry {\n    if (override) return override;\n    try {\n        const m = ctx.getService<MetricsRegistry | undefined>(OBSERVABILITY_METRICS_SERVICE);\n        if (m) return m;\n    } catch {\n        // Service not registered — fall through to the noop default.\n    }\n    return new NoopMetricsRegistry();\n}\n\n/**\n * Sibling of {@link resolveMetrics} for {@link ErrorReporter}.\n */\nexport function resolveErrorReporter(\n    ctx: PluginContext,\n    override?: ErrorReporter,\n): ErrorReporter {\n    if (override) return override;\n    try {\n        const e = ctx.getService<ErrorReporter | undefined>(OBSERVABILITY_ERRORS_SERVICE);\n        if (e) return e;\n    } catch {\n        // Service not registered — fall through to the noop default.\n    }\n    return new NoopErrorReporter();\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Plugin, PluginContext, IHttpServer } from '@objectstack/core';\nimport { HttpDispatcher, HttpDispatcherResult } from './http-dispatcher.js';\nimport {\n    buildSecurityHeaders,\n    type SecurityHeadersOptions,\n} from './security/index.js';\nimport {\n    NoopMetricsRegistry,\n    NoopErrorReporter,\n    instrumentRouteHandler,\n    type MetricsRegistry,\n    type ErrorReporter,\n} from './observability/index.js';\n\nexport interface DispatcherPluginConfig {\n    /**\n     * API path prefix for all endpoints.\n     * @default '/api/v1'\n     */\n    prefix?: string;\n\n    /**\n     * Project-scoping configuration. Must match the REST API\n     * `enableProjectScoping` / `projectResolution` fields so AI / automation\n     * routes stay in lockstep with /data and /meta.\n     *\n     * When `enableProjectScoping` is true and `projectResolution` is:\n     *   - `required` — only `/environments/:environmentId/...` variants are registered.\n     *   - `optional` / `auto` — both unscoped and scoped variants are registered\n     *     (the scoped handler forwards `req.params.environmentId` into context).\n     */\n    scoping?: {\n        enableProjectScoping?: boolean;\n        projectResolution?: 'required' | 'optional' | 'auto';\n    };\n\n    /**\n     * Enforce per-project membership (`sys_environment_member`) on scoped\n     * data-plane routes. Returns 403 for non-members unless they are\n     * staff (platform org) or the project is the well-known system\n     * project.\n     *\n     * Defaults to `true` when `scoping.enableProjectScoping` is enabled;\n     * explicitly set to `false` for tests and single-tenant deployments\n     * where membership has not been seeded.\n     */\n    enforceProjectMembership?: boolean;\n\n    /**\n     * Security response headers. When provided, every response routed\n     * through this plugin gets the headers merged in (route-specific\n     * headers still win on conflict).\n     *\n     * Pass `false` to disable. Pass `true` (or omit) to enable with\n     * conservative API-server defaults (CSP=deny-all, XCTO=nosniff,\n     * X-Frame-Options=DENY, etc.). Pass an object to customize — see\n     * {@link SecurityHeadersOptions}.\n     *\n     * @default true\n     */\n    securityHeaders?: boolean | SecurityHeadersOptions;\n\n    /**\n     * Observability wiring. All fields optional; defaults are noop\n     * (zero overhead, no behavior change).\n     *\n     *   - `metrics`: registry receiving `http_requests_total`,\n     *     `http_request_duration_ms`, `http_request_errors_total` for\n     *     every route this plugin mounts. Plug in `prom-client` /\n     *     `@opentelemetry/api-metrics` / your own adapter.\n     *\n     *   - `errorReporter`: invoked on 5xx responses with the thrown\n     *     error and `{ requestId, method, route }`. Plug in Sentry /\n     *     Datadog / Rollbar.\n     *\n     *   - `generateRequestId`: customize the format of minted request\n     *     ids (default: `req_<uuid>` via `crypto.randomUUID`). The\n     *     incoming `X-Request-Id` header is honored when present and\n     *     well-formed, regardless of this setting.\n     *\n     *   - `requestIdHeader`: response header name to echo the id back\n     *     on. Defaults to `X-Request-Id`.\n     */\n    observability?: {\n        metrics?: MetricsRegistry;\n        errorReporter?: ErrorReporter;\n        generateRequestId?: () => string;\n        requestIdHeader?: string;\n    };\n}\n\n/**\n * Route definition emitted by service plugins (e.g. AIServicePlugin) via hooks.\n * Minimal interface — matches the shape produced by `buildAIRoutes()`.\n */\ninterface RouteDefinition {\n    method: 'GET' | 'POST' | 'DELETE';\n    path: string;\n    description: string;\n    handler: (req: any) => Promise<any>;\n}\n\n/**\n * Register a single RouteDefinition on the HTTP server.\n * Returns true if the route was successfully registered.\n */\nfunction mountRouteOnServer(\n    route: RouteDefinition,\n    server: IHttpServer,\n    routePath: string,\n    securityHeaders?: Record<string, string>,\n): boolean {\n    const handler = async (req: any, res: any) => {\n        try {\n            const result = await route.handler({\n                body: req.body,\n                params: req.params,\n                query: req.query,\n            });\n\n            if (result.stream && result.events) {\n                // SSE streaming response\n                res.status(result.status);\n\n                if (securityHeaders) {\n                    for (const [k, v] of Object.entries(securityHeaders)) {\n                        res.header(k, v);\n                    }\n                }\n\n                // Apply headers from the route result if available\n                if (result.headers) {\n                    for (const [k, v] of Object.entries(result.headers)) {\n                        res.header(k, String(v));\n                    }\n                } else {\n                    res.header('Content-Type', 'text/event-stream');\n                    res.header('Cache-Control', 'no-cache');\n                    res.header('Connection', 'keep-alive');\n                }\n\n                // Write the stream — events are pre-encoded SSE strings\n                if (typeof res.write === 'function' && typeof res.end === 'function') {\n                    for await (const event of result.events) {\n                        res.write(typeof event === 'string' ? event : `data: ${JSON.stringify(event)}\\n\\n`);\n                    }\n                    res.end();\n                } else {\n                    // Fallback: collect events into array\n                    const events = [];\n                    for await (const event of result.events) {\n                        events.push(event);\n                    }\n                    res.json({ events });\n                }\n            } else {\n                res.status(result.status);\n                if (securityHeaders) {\n                    for (const [k, v] of Object.entries(securityHeaders)) {\n                        res.header(k, v);\n                    }\n                }\n                if (result.body !== undefined) {\n                    res.json(result.body);\n                } else {\n                    res.end();\n                }\n            }\n        } catch (err: any) {\n            errorResponseBase(err, res, securityHeaders);\n        }\n    };\n\n    const m = route.method.toLowerCase();\n    if (m === 'get' && typeof server.get === 'function') {\n        server.get(routePath, handler);\n        return true;\n    } else if (m === 'post' && typeof server.post === 'function') {\n        server.post(routePath, handler);\n        return true;\n    } else if (m === 'delete' && typeof server.delete === 'function') {\n        server.delete(routePath, handler);\n        return true;\n    }\n    return false;\n}\n\n/**\n * Send an HttpDispatcherResult through IHttpResponse.\n * Differentiates between handled, unhandled (404), and special results.\n *\n * @param securityHeaders headers to merge into every response (under\n * the route-specific headers so the dispatcher can override on a\n * per-route basis when truly needed).\n */\nfunction sendResultBase(\n    result: HttpDispatcherResult,\n    res: any,\n    securityHeaders?: Record<string, string>,\n): void {\n    const applySecurityHeaders = () => {\n        if (!securityHeaders) return;\n        for (const [k, v] of Object.entries(securityHeaders)) {\n            // Don't clobber route-set headers — `res.header` semantics\n            // vary by adapter, so we set unconditionally and rely on the\n            // call ordering (security headers first, route headers\n            // overwrite below).\n            res.header(k, v);\n        }\n    };\n\n    if (result.handled) {\n        if (result.response) {\n            res.status(result.response.status);\n            applySecurityHeaders();\n            if (result.response.headers) {\n                for (const [k, v] of Object.entries(result.response.headers)) {\n                    res.header(k, v);\n                }\n            }\n            res.json(result.response.body);\n            return;\n        }\n        if (result.result) {\n            // Special results (redirect, stream) — pass through as JSON for now\n            res.status(200);\n            applySecurityHeaders();\n            res.json(result.result);\n            return;\n        }\n    }\n    // Semantic 404: no route matched — include diagnostic info\n    res.status(404);\n    applySecurityHeaders();\n    res.json({\n        success: false,\n        error: {\n            message: 'Not Found',\n            code: 404,\n            type: 'ROUTE_NOT_FOUND',\n            hint: 'No handler matched this request. Check the API discovery endpoint for available routes.',\n        },\n    });\n}\n\nfunction errorResponseBase(err: any, res: any, securityHeaders?: Record<string, string>): void {\n    const code = err.statusCode || 500;\n    res.status(code);\n    if (securityHeaders) {\n        for (const [k, v] of Object.entries(securityHeaders)) {\n            res.header(k, v);\n        }\n    }\n    // Side-channel: remember the original error so the observability\n    // wrapper can hand it to errorReporter on 5xx. Handlers catch the\n    // error and call us here instead of re-throwing, so this is the\n    // only place we still have it.\n    if (code >= 500) {\n        try {\n            (res as any).__obsRecordedError = err;\n        } catch {\n            // res is a frozen / proxy object — skip\n        }\n    }\n    res.json({\n        success: false,\n        error: { message: err.message || 'Internal Server Error', code },\n    });\n}\n\n/**\n * Dispatcher Plugin\n *\n * Bridges legacy HttpDispatcher handlers to the IHttpServer route-registration model.\n * Registers routes for domains NOT covered by @objectstack/rest:\n *   - /.well-known/objectstack (discovery)\n *   - /auth      (authentication)\n *   - /graphql   (GraphQL)\n *   - /analytics (BI queries)\n *   - /packages  (package management)\n *   - /i18n      (internationalization — locales, translations, field labels)\n *   - /storage   (file storage)\n *   - /automation (CRUD + triggers + runs)\n *\n * Usage:\n * ```ts\n * import { createDispatcherPlugin } from '@objectstack/runtime';\n * runtime.use(createDispatcherPlugin({ prefix: '/api/v1' }));\n * ```\n */\nexport function createDispatcherPlugin(config: DispatcherPluginConfig = {}): Plugin {\n    return {\n        name: 'com.objectstack.runtime.dispatcher',\n        version: '1.0.0',\n\n        init: async (_ctx: PluginContext) => {\n            // Consumer-only plugin — no services registered\n        },\n\n        start: async (ctx: PluginContext) => {\n            let server: IHttpServer | undefined;\n            try {\n                server = ctx.getService<IHttpServer>('http.server');\n            } catch {\n                // No HTTP server available — skip silently\n                return;\n            }\n            if (!server) return;\n\n            const kernel = ctx.getKernel();\n            // Default: enable membership enforcement iff environment-scoping is on.\n            // Tests / single-tenant deploys can opt out via the explicit flag.\n            const enforceMembership =\n                config.enforceProjectMembership ?? (config.scoping?.enableProjectScoping ?? false);\n            const dispatcher = new HttpDispatcher(kernel, undefined, {\n                enforceProjectMembership: enforceMembership,\n            });\n            const prefix = config.prefix || '/api/v1';\n\n            // ── Security: resolve once at startup; applied on every response.\n            // Defaults to ON because every production API server should be\n            // sending these headers. Opt out with `securityHeaders: false`\n            // (only sensible for tests or when an upstream reverse proxy is\n            // already setting them).\n            const securityHeaders: Record<string, string> | undefined =\n                config.securityHeaders === false\n                    ? undefined\n                    : buildSecurityHeaders(\n                          typeof config.securityHeaders === 'object'\n                              ? config.securityHeaders\n                              : {},\n                      );\n\n            // Locally-shadowed wrappers — every `sendResult(...)` /\n            // `errorResponse(...)` call below picks these up via lexical\n            // scope, so the 50+ route handlers don't need to thread the\n            // security headers through manually.\n            const sendResult = (result: HttpDispatcherResult, res: any) =>\n                sendResultBase(result, res, securityHeaders);\n            const errorResponse = (err: any, res: any) =>\n                errorResponseBase(err, res, securityHeaders);\n\n            // ── Observability ──────────────────────────────────────────\n            // Noop defaults; production hosts inject real adapters.\n            const metrics: MetricsRegistry =\n                config.observability?.metrics ?? new NoopMetricsRegistry();\n            const errorReporter: ErrorReporter =\n                config.observability?.errorReporter ?? new NoopErrorReporter();\n            const generateRequestId = config.observability?.generateRequestId;\n            const requestIdHeader =\n                config.observability?.requestIdHeader ?? 'X-Request-Id';\n\n            /**\n             * Wrap the IHttpServer so every route registration is\n             * automatically instrumented. We only override the three\n             * verb methods the dispatcher uses; everything else passes\n             * through unchanged.\n             */\n            const rawServer = server;\n            server = new Proxy(rawServer, {\n                get(target, prop, receiver) {\n                    if (prop === 'get' || prop === 'post' || prop === 'delete') {\n                        const method = String(prop).toUpperCase();\n                        const original = (target as any)[prop];\n                        if (typeof original !== 'function') return original;\n                        return (route: string, handler: any) => {\n                            return original.call(\n                                target,\n                                route,\n                                instrumentRouteHandler(method, route, handler, {\n                                    metrics,\n                                    errorReporter,\n                                    generateRequestId,\n                                    requestIdHeader,\n                                }),\n                            );\n                        };\n                    }\n                    return Reflect.get(target, prop, receiver);\n                },\n            }) as IHttpServer;\n\n            // ── Discovery (.well-known) ─────────────────────────────────\n            server.get('/.well-known/objectstack', async (_req: any, res: any) => {\n                if (securityHeaders) {\n                    for (const [k, v] of Object.entries(securityHeaders)) {\n                        res.header(k, v);\n                    }\n                }\n                res.json({ data: await dispatcher.getDiscoveryInfo(prefix) });\n            });\n\n            // ── Discovery (versioned API path) ──────────────────────────\n            server.get(`${prefix}/discovery`, async (_req: any, res: any) => {\n                if (securityHeaders) {\n                    for (const [k, v] of Object.entries(securityHeaders)) {\n                        res.header(k, v);\n                    }\n                }\n                res.json({ data: await dispatcher.getDiscoveryInfo(prefix) });\n            });\n\n            // ── Health ──────────────────────────────────────────────────\n            server.get(`${prefix}/health`, async (_req: any, res: any) => {\n                try {\n                    const result = await dispatcher.dispatch('GET', '/health', undefined, {}, { request: _req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── Auth ────────────────────────────────────────────────────\n            // NOTE: /auth/* wildcard is mounted by AuthProxyPlugin (cloud)\n            // or AuthPlugin (single-tenant) directly on the raw Hono app —\n            // those handlers can return native Web `Response` objects which\n            // is what better-auth produces. The dispatcher cannot represent\n            // a streaming Response cleanly through `IHttpServer.send`, so\n            // we deliberately do NOT register a dispatcher wildcard here.\n            //\n            // Legacy explicit /auth/login retained for self-hosted clients\n            // that still POST there; superseded by the wildcard above for\n            // the better-auth surface (sign-up/email, sign-in/email, …).\n            server.post(`${prefix}/auth/login`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleAuth('login', 'POST', req.body, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── GraphQL ─────────────────────────────────────────────────\n            server.post(`${prefix}/graphql`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleGraphQL(req.body, { request: req });\n                    if (securityHeaders) {\n                        for (const [k, v] of Object.entries(securityHeaders)) {\n                            res.header(k, v);\n                        }\n                    }\n                    res.json(result);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── Analytics ───────────────────────────────────────────────\n            // Route via dispatch() (not handleAnalytics directly) so the host\n            // dispatcher's project-aware kernel swap runs first — the per-project\n            // kernel owns the `analytics` service (registered by ObjectQLPlugin).\n            server.post(`${prefix}/analytics/query`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.dispatch('POST', '/analytics/query', req.body, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/analytics/meta`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.dispatch('GET', '/analytics/meta', undefined, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/analytics/sql`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.dispatch('POST', '/analytics/sql', req.body, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── Packages ────────────────────────────────────────────────\n            server.get(`${prefix}/packages`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handlePackages('', 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/packages`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handlePackages('', 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/packages/:id`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handlePackages(`/${req.params.id}`, 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.delete(`${prefix}/packages/:id`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handlePackages(`/${req.params.id}`, 'DELETE', {}, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.patch(`${prefix}/packages/:id/enable`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handlePackages(`/${req.params.id}/enable`, 'PATCH', {}, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.patch(`${prefix}/packages/:id/disable`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handlePackages(`/${req.params.id}/disable`, 'PATCH', {}, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/packages/:id/publish`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handlePackages(`/${req.params.id}/publish`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/packages/:id/revert`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handlePackages(`/${req.params.id}/revert`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── Cloud (Projects) ─────────────────────────────────────\n            server.get(`${prefix}/cloud/drivers`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud('/drivers', 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // POST /cloud/admin/platform-sso/backfill — idempotent admin trigger\n            // for retro-fitting sys_oauth_application rows when boot-time\n            // backfill plugin races/fails. Authenticated by Bearer == OS_AUTH_SECRET\n            // (validated inside handleCloud).\n            server.post(`${prefix}/cloud/admin/platform-sso/backfill`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud('/admin/platform-sso/backfill', 'POST', req.body, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/cloud/templates`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud('/templates', 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/cloud/environments`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud('/projects', 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/cloud/environments`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud('/projects', 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/cloud/environments/:id`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}`, 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.patch(`${prefix}/cloud/environments/:id`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}`, 'PATCH', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.delete(`${prefix}/cloud/environments/:id`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}`, 'DELETE', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.delete(`${prefix}/cloud/organizations/:id`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/organizations/${req.params.id}`, 'DELETE', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/cloud/environments/:id/hostname`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/hostname`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.put(`${prefix}/cloud/environments/:id/hostname`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/hostname`, 'PUT', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/cloud/environments/:id/rotate-credential`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/rotate-credential`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // Alias expected by @objectstack/client: POST /projects/:id/credentials/rotate\n            server.post(`${prefix}/cloud/environments/:id/credentials/rotate`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/credentials/rotate`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/cloud/environments/:id/activate`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/activate`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/cloud/environments/:id/retry`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/retry`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/cloud/environments/:id/members`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/members`, 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/cloud/environments/:id/members`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/members`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.patch(`${prefix}/cloud/environments/:id/members/:memberId`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/members/${req.params.memberId}`, 'PATCH', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.delete(`${prefix}/cloud/environments/:id/members/:memberId`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/members/${req.params.memberId}`, 'DELETE', req.body ?? {}, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── Cloud — Per-project packages ─────────────────────────────────\n            server.get(`${prefix}/cloud/environments/:id/packages`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/packages`, 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/cloud/environments/:id/packages`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/packages`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/cloud/environments/:id/packages/:pkgId`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/packages/${req.params.pkgId}`, 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.delete(`${prefix}/cloud/environments/:id/packages/:pkgId`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/packages/${req.params.pkgId}`, 'DELETE', {}, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.patch(`${prefix}/cloud/environments/:id/packages/:pkgId/enable`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/packages/${req.params.pkgId}/enable`, 'PATCH', {}, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.patch(`${prefix}/cloud/environments/:id/packages/:pkgId/disable`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/packages/${req.params.pkgId}/disable`, 'PATCH', {}, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/cloud/environments/:id/packages/:pkgId/upgrade`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/packages/${req.params.pkgId}/upgrade`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── Storage ─────────────────────────────────────────────────\n            server.post(`${prefix}/storage/upload`, async (req: any, res: any) => {\n                try {\n                    // For file uploads the body *is* the file (parsed by adapter)\n                    const result = await dispatcher.handleStorage('upload', 'POST', req.body, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/storage/file/:id`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleStorage(`file/${req.params.id}`, 'GET', undefined, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── i18n ────────────────────────────────────────────────────\n            // Route via dispatch() (not handleI18n directly) so the host\n            // dispatcher's project-aware kernel swap runs first. Without this,\n            // i18n requests hit the host kernel's in-memory fallback (which\n            // is always empty) instead of the per-project I18nServicePlugin\n            // populated by ArtifactKernelFactory with the artifact's\n            // translation bundles.\n            server.get(`${prefix}/i18n/locales`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.dispatch('GET', '/i18n/locales', undefined, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/i18n/translations/:locale`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.dispatch('GET', `/i18n/translations/${req.params.locale}`, undefined, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/i18n/labels/:object/:locale`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.dispatch('GET', `/i18n/labels/${req.params.object}/${req.params.locale}`, undefined, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── Automation ──────────────────────────────────────────────\n            // Registered at both `${prefix}/automation/...` and\n            // `${prefix}/environments/:environmentId/automation/...` when project\n            // scoping is enabled. Always dispatched through\n            // `dispatcher.dispatch()` so the multi-kernel host can swap\n            // to the per-project kernel before resolving the\n            // `automation` service (which lives on the project kernel,\n            // not the host kernel, in ObjectOS multi-tenant mode).\n            const registerAutomationRoutes = (base: string) => {\n                server!.get(`${base}/automation`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('GET', '/automation', undefined, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.post(`${base}/automation`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('POST', '/automation', req.body, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.get(`${base}/automation/:name`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('GET', `/automation/${req.params.name}`, undefined, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.put(`${base}/automation/:name`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('PUT', `/automation/${req.params.name}`, req.body, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.delete(`${base}/automation/:name`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('DELETE', `/automation/${req.params.name}`, undefined, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.post(`${base}/automation/trigger/:name`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('POST', `/automation/trigger/${req.params.name}`, req.body, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.post(`${base}/automation/:name/trigger`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('POST', `/automation/${req.params.name}/trigger`, req.body, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.post(`${base}/automation/:name/toggle`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('POST', `/automation/${req.params.name}/toggle`, req.body, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.get(`${base}/automation/:name/runs`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('GET', `/automation/${req.params.name}/runs`, undefined, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.get(`${base}/automation/:name/runs/:runId`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('GET', `/automation/${req.params.name}/runs/${req.params.runId}`, undefined, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n            };\n\n            // ── AI / Assistants ─────────────────────────────────────────\n            // The AI service plugin registers a large, dynamic surface\n            // (chat, models, conversations, tools, agents, assistants)\n            // whose exact routes are built at start() time from the\n            // service's tool / agent registries. To support multi-tenant\n            // hosts where the AI service lives on per-project kernels,\n            // mount a method-wildcard catch-all that always dispatches\n            // through `dispatcher.dispatch()` — that triggers the kernel\n            // swap and then routes via `handleAI`, which looks up the\n            // AI service on the current (project) kernel.\n            const registerAIRoutes = (base: string) => {\n                const wildcards: Array<['get'|'post'|'delete'|'put', string]> = [\n                    ['get', `${base}/ai/*`],\n                    ['post', `${base}/ai/*`],\n                    ['delete', `${base}/ai/*`],\n                    ['put', `${base}/ai/*`],\n                ];\n                for (const [method, pattern] of wildcards) {\n                    (server as any)![method](pattern, async (req: any, res: any) => {\n                        try {\n                            // Reconstruct the AI subpath without the prefix\n                            // so dispatch() routes via the /ai branch.\n                            const fullPath: string = req.path ?? '';\n                            const idx = fullPath.lastIndexOf('/ai');\n                            const aiSubPath = idx >= 0 ? fullPath.slice(idx) : '/ai';\n                            const result = await dispatcher.dispatch(method.toUpperCase(), aiSubPath, req.body, req.query, { request: req });\n                            sendResult(result, res);\n                        } catch (err: any) {\n                            errorResponse(err, res);\n                        }\n                    });\n                }\n            };\n\n            // ── Actions (server-registered handlers, e.g. CRM convertLead) ───\n            // Bridges UI `script` / `modal` actions to ObjectQL handlers\n            // registered via `engine.registerAction(object, action, fn)`.\n            const registerActionRoutes = (base: string) => {\n                server!.post(`${base}/actions/:object/:action`, async (req: any, res: any) => {\n                    try {\n                        const ctx: any = { request: req };\n                        if (req.params?.environmentId) ctx.environmentId = req.params.environmentId;\n                        const result = await dispatcher.handleActions(`/${req.params.object}/${req.params.action}`, 'POST', req.body, ctx);\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n                server!.post(`${base}/actions/:object/:action/:recordId`, async (req: any, res: any) => {\n                    try {\n                        const ctx: any = { request: req };\n                        if (req.params?.environmentId) ctx.environmentId = req.params.environmentId;\n                        const result = await dispatcher.handleActions(`/${req.params.object}/${req.params.action}/${req.params.recordId}`, 'POST', req.body, ctx);\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n            };\n\n            const enableProjectScoping = config.scoping?.enableProjectScoping ?? false;\n            const projectResolution = config.scoping?.projectResolution ?? 'auto';\n\n            if (enableProjectScoping && projectResolution === 'required') {\n                registerAutomationRoutes(`${prefix}/environments/:environmentId`);\n                registerActionRoutes(`${prefix}/environments/:environmentId`);\n                registerAIRoutes(`${prefix}/environments/:environmentId`);\n            } else {\n                registerAutomationRoutes(prefix);\n                registerActionRoutes(prefix);\n                registerAIRoutes(prefix);\n                if (enableProjectScoping) {\n                    registerAutomationRoutes(`${prefix}/environments/:environmentId`);\n                    registerActionRoutes(`${prefix}/environments/:environmentId`);\n                    registerAIRoutes(`${prefix}/environments/:environmentId`);\n                }\n            }\n\n            ctx.logger.info('Dispatcher bridge routes registered', { prefix, enableProjectScoping, projectResolution });\n\n            // ── Dynamic service routes (AI, etc.) ───────────────────\n            // Listen for route definitions emitted by service plugins.\n            // The AIServicePlugin emits 'ai:routes' with RouteDefinition[].\n            //\n            // When environment-scoping is enabled, each AI route is mounted on\n            // BOTH `${prefix}${path}` and `${prefix}/environments/:environmentId${path}`\n            // (or only the scoped variant when `projectResolution === 'required'`).\n            const toScopedPath = (routePath: string): string => {\n                // routePath may already include /api/v1; splice /environments/:environmentId\n                // after the `${prefix}` portion to produce the scoped variant.\n                if (routePath.startsWith(prefix)) {\n                    const tail = routePath.slice(prefix.length);\n                    return `${prefix}/environments/:environmentId${tail}`;\n                }\n                return `/environments/:environmentId${routePath}`;\n            };\n\n            const mountAiRoute = (route: RouteDefinition) => {\n                if (!server) return 0;\n                const routePath = route.path.startsWith('/api/v1')\n                    ? route.path\n                    : `${prefix}${route.path}`;\n\n                let count = 0;\n                if (enableProjectScoping && projectResolution === 'required') {\n                    if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders)) count++;\n                } else {\n                    if (mountRouteOnServer(route, server, routePath, securityHeaders)) count++;\n                    if (enableProjectScoping) {\n                        if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders)) count++;\n                    }\n                }\n                return count;\n            };\n\n            ctx.hook('ai:routes', async (routes: RouteDefinition[]) => {\n                if (!server) return;\n                let total = 0;\n                for (const route of routes) {\n                    total += mountAiRoute(route);\n                }\n                ctx.logger.info(`[Dispatcher] Registered ${total} AI route mount(s) from ${routes.length} definition(s)`);\n            });\n\n            // ── Fallback: recover routes cached before hook was registered ──\n            // If AIServicePlugin.start() ran before DispatcherPlugin.start()\n            // (possible when plugin start order differs from registration order),\n            // the 'ai:routes' trigger fires with no listener. The AIServicePlugin\n            // caches the routes on the kernel as __aiRoutes (see AIServicePlugin.start())\n            // as an internal cross-plugin protocol so we can recover them here.\n            // TODO: replace with a formal kernel.getCachedRoutes('ai') API in a future release.\n            const cachedRoutes = (kernel as any).__aiRoutes as RouteDefinition[] | undefined;\n            if (cachedRoutes && Array.isArray(cachedRoutes) && cachedRoutes.length > 0) {\n                let registered = 0;\n                for (const route of cachedRoutes) {\n                    registered += mountAiRoute(route);\n                }\n                if (registered > 0) {\n                    ctx.logger.info(`[Dispatcher] Recovered ${registered} cached AI route mount(s) (hook timing fallback)`);\n                }\n            }\n        },\n    };\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Plugin, PluginContext } from '@objectstack/core';\n\n/**\n * The well-known UUID for the built-in system project.\n * Kept in lockstep with `ProjectProvisioningService.provisionSystemEnvironment`.\n */\nexport const SYSTEM_ENVIRONMENT_ID = '00000000-0000-0000-0000-000000000001';\n\n/**\n * Minimal surface of `ProjectProvisioningService` consumed by the plugin.\n * Typed locally so the runtime package does not gain a hard dependency on\n * `@objectstack/service-tenant` — the service is discovered at runtime via\n * the kernel service registry.\n */\ninterface ProvisioningLike {\n  provisionSystemEnvironment(): Promise<{\n    project: { id: string; isSystem?: boolean };\n    warnings?: string[];\n  }>;\n}\n\nexport interface SystemEnvironmentPluginConfig {\n  /**\n   * Service name that resolves to a `ProjectProvisioningService`-shaped\n   * object. Defaults to `tenant.provisioning` (convention used by\n   * `@objectstack/service-tenant`).\n   */\n  serviceName?: string;\n\n  /**\n   * When true, plugin treats a missing provisioning service as an error.\n   * Defaults to false — bootstrap is opt-in and must no-op gracefully when\n   * the tenant package is not part of the stack.\n   */\n  strict?: boolean;\n}\n\n/**\n * System Project Bootstrap Plugin\n *\n * Ensures the built-in system project (well-known UUID\n * {@link SYSTEM_ENVIRONMENT_ID}) exists on the control plane the first time the\n * runtime starts. Calls are idempotent — `provisionSystemEnvironment()` returns\n * the existing row when the project has already been created.\n *\n * Register AFTER the tenant service is available so the provisioning service\n * can be resolved from the kernel.\n *\n * @example\n * ```ts\n * kernel.use(tenantPlugin);\n * kernel.use(createSystemEnvironmentPlugin());\n * ```\n */\nexport function createSystemEnvironmentPlugin(config: SystemEnvironmentPluginConfig = {}): Plugin {\n  const serviceName = config.serviceName ?? 'tenant.provisioning';\n\n  return {\n    name: 'com.objectstack.runtime.system-environment',\n    version: '1.0.0',\n\n    init: async (_ctx: PluginContext) => {\n      // Consumer-only plugin; nothing to register at init-time.\n    },\n\n    start: async (ctx: PluginContext) => {\n      let service: ProvisioningLike | undefined;\n      try {\n        service = ctx.getService<ProvisioningLike>(serviceName);\n      } catch {\n        // Service registry throws when the key is not found.\n        service = undefined;\n      }\n\n      if (!service || typeof service.provisionSystemEnvironment !== 'function') {\n        if (config.strict) {\n          throw new Error(\n            `[SystemEnvironmentPlugin] Provisioning service '${serviceName}' not found — cannot bootstrap system project.`,\n          );\n        }\n        ctx.logger.debug(\n          `[SystemEnvironmentPlugin] Provisioning service '${serviceName}' unavailable — system project bootstrap skipped.`,\n        );\n        return;\n      }\n\n      try {\n        const result = await service.provisionSystemEnvironment();\n        const warnings = result.warnings ?? [];\n        ctx.logger.info('[SystemEnvironmentPlugin] System project ready', {\n          environmentId: result.project.id,\n          isSystem: result.project.isSystem,\n          warnings,\n        });\n      } catch (err: any) {\n        if (config.strict) throw err;\n        ctx.logger.warn('[SystemEnvironmentPlugin] Failed to provision system project', {\n          error: err?.message ?? String(err),\n        });\n      }\n    },\n  };\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { IHttpServer, RouteHandler, Middleware } from '@objectstack/core';\n\n/**\n * HttpServer - Unified HTTP Server Abstraction\n * \n * Provides a framework-agnostic HTTP server interface that wraps\n * underlying server implementations (Hono, Express, Fastify, etc.)\n * \n * This class serves as an adapter between the IHttpServer interface\n * and concrete server implementations, allowing plugins to register\n * routes and middleware without depending on specific frameworks.\n * \n * Features:\n * - Unified route registration API\n * - Middleware management with ordering\n * - Request/response lifecycle hooks\n * - Framework-agnostic abstractions\n */\nexport class HttpServer implements IHttpServer {\n    protected server: IHttpServer;\n    protected routes: Map<string, RouteHandler>;\n    protected middlewares: Middleware[];\n    \n    /**\n     * Create an HTTP server wrapper\n     * @param server - The underlying server implementation (Hono, Express, etc.)\n     */\n    constructor(server: IHttpServer) {\n        this.server = server;\n        this.routes = new Map();\n        this.middlewares = [];\n    }\n    \n    /**\n     * Register a GET route handler\n     * @param path - Route path (e.g., '/api/users/:id')\n     * @param handler - Route handler function\n     */\n    get(path: string, handler: RouteHandler): void {\n        const key = `GET:${path}`;\n        this.routes.set(key, handler);\n        this.server.get(path, handler);\n    }\n    \n    /**\n     * Register a POST route handler\n     * @param path - Route path\n     * @param handler - Route handler function\n     */\n    post(path: string, handler: RouteHandler): void {\n        const key = `POST:${path}`;\n        this.routes.set(key, handler);\n        this.server.post(path, handler);\n    }\n    \n    /**\n     * Register a PUT route handler\n     * @param path - Route path\n     * @param handler - Route handler function\n     */\n    put(path: string, handler: RouteHandler): void {\n        const key = `PUT:${path}`;\n        this.routes.set(key, handler);\n        this.server.put(path, handler);\n    }\n    \n    /**\n     * Register a DELETE route handler\n     * @param path - Route path\n     * @param handler - Route handler function\n     */\n    delete(path: string, handler: RouteHandler): void {\n        const key = `DELETE:${path}`;\n        this.routes.set(key, handler);\n        this.server.delete(path, handler);\n    }\n    \n    /**\n     * Register a PATCH route handler\n     * @param path - Route path\n     * @param handler - Route handler function\n     */\n    patch(path: string, handler: RouteHandler): void {\n        const key = `PATCH:${path}`;\n        this.routes.set(key, handler);\n        this.server.patch(path, handler);\n    }\n    \n    /**\n     * Register middleware\n     * @param path - Optional path to apply middleware to (if omitted, applies globally)\n     * @param handler - Middleware function\n     */\n    use(path: string | Middleware, handler?: Middleware): void {\n        if (typeof path === 'function') {\n            // Global middleware\n            this.middlewares.push(path);\n            this.server.use(path);\n        } else if (handler) {\n            // Path-specific middleware\n            this.middlewares.push(handler);\n            this.server.use(path, handler);\n        }\n    }\n    \n    /**\n     * Start the HTTP server\n     * @param port - Port number to listen on\n     * @returns Promise that resolves when server is ready\n     */\n    async listen(port: number): Promise<void> {\n        await this.server.listen(port);\n    }\n    \n    /**\n     * Stop the HTTP server\n     * @returns Promise that resolves when server is stopped\n     */\n    async close(): Promise<void> {\n        if (this.server.close) {\n            await this.server.close();\n        }\n    }\n    \n    /**\n     * Get registered routes\n     * @returns Map of route keys to handlers\n     */\n    getRoutes(): Map<string, RouteHandler> {\n        return new Map(this.routes);\n    }\n    \n    /**\n     * Get registered middlewares\n     * @returns Array of middleware functions\n     */\n    getMiddlewares(): Middleware[] {\n        return [...this.middlewares];\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Middleware, IHttpRequest, IHttpResponse } from '@objectstack/core';\nimport { MiddlewareConfig, MiddlewareType } from '@objectstack/spec/system';\n\n/**\n * Middleware Entry\n * Internal representation of registered middleware\n */\ninterface MiddlewareEntry {\n    name: string;\n    type: MiddlewareType;\n    middleware: Middleware;\n    order: number;\n    enabled: boolean;\n    paths?: {\n        include?: string[];\n        exclude?: string[];\n    };\n}\n\n/**\n * MiddlewareManager\n * \n * Manages middleware registration, ordering, and execution.\n * Provides fine-grained control over middleware chains with:\n * - Execution order management\n * - Path-based filtering\n * - Enable/disable individual middleware\n * - Middleware categorization by type\n * \n * @example\n * const manager = new MiddlewareManager();\n * \n * // Register middleware with configuration\n * manager.register({\n *   name: 'auth',\n *   type: 'authentication',\n *   order: 10,\n *   paths: { exclude: ['/health', '/metrics'] }\n * }, authMiddleware);\n * \n * // Get sorted middleware chain\n * const chain = manager.getMiddlewareChain();\n * chain.forEach(mw => server.use(mw));\n */\nexport class MiddlewareManager {\n    private middlewares: Map<string, MiddlewareEntry>;\n    \n    constructor() {\n        this.middlewares = new Map();\n    }\n    \n    /**\n     * Register middleware with configuration\n     * @param config - Middleware configuration\n     * @param middleware - Middleware function\n     */\n    register(config: MiddlewareConfig, middleware: Middleware): void {\n        const entry: MiddlewareEntry = {\n            name: config.name,\n            type: config.type,\n            middleware,\n            order: config.order ?? 100,\n            enabled: config.enabled ?? true,\n            paths: config.paths,\n        };\n        \n        this.middlewares.set(config.name, entry);\n    }\n    \n    /**\n     * Unregister middleware by name\n     * @param name - Middleware name\n     */\n    unregister(name: string): void {\n        this.middlewares.delete(name);\n    }\n    \n    /**\n     * Enable middleware by name\n     * @param name - Middleware name\n     */\n    enable(name: string): void {\n        const entry = this.middlewares.get(name);\n        if (entry) {\n            entry.enabled = true;\n        }\n    }\n    \n    /**\n     * Disable middleware by name\n     * @param name - Middleware name\n     */\n    disable(name: string): void {\n        const entry = this.middlewares.get(name);\n        if (entry) {\n            entry.enabled = false;\n        }\n    }\n    \n    /**\n     * Get middleware entry by name\n     * @param name - Middleware name\n     */\n    get(name: string): MiddlewareEntry | undefined {\n        return this.middlewares.get(name);\n    }\n    \n    /**\n     * Get all middleware entries\n     */\n    getAll(): MiddlewareEntry[] {\n        return Array.from(this.middlewares.values());\n    }\n    \n    /**\n     * Get middleware by type\n     * @param type - Middleware type\n     */\n    getByType(type: MiddlewareType): MiddlewareEntry[] {\n        return this.getAll().filter(entry => entry.type === type);\n    }\n    \n    /**\n     * Get middleware chain sorted by order\n     * Returns only enabled middleware\n     */\n    getMiddlewareChain(): Middleware[] {\n        return this.getAll()\n            .filter(entry => entry.enabled)\n            .sort((a, b) => a.order - b.order)\n            .map(entry => entry.middleware);\n    }\n    \n    /**\n     * Get middleware chain with path filtering\n     * @param path - Request path to match against\n     */\n    getMiddlewareChainForPath(path: string): Middleware[] {\n        return this.getAll()\n            .filter(entry => {\n                if (!entry.enabled) return false;\n                \n                // Check path filters\n                if (entry.paths) {\n                    // Check exclude patterns\n                    if (entry.paths.exclude) {\n                        const excluded = entry.paths.exclude.some(pattern => \n                            this.matchPath(path, pattern)\n                        );\n                        if (excluded) return false;\n                    }\n                    \n                    // Check include patterns (if specified)\n                    if (entry.paths.include) {\n                        const included = entry.paths.include.some(pattern => \n                            this.matchPath(path, pattern)\n                        );\n                        if (!included) return false;\n                    }\n                }\n                \n                return true;\n            })\n            .sort((a, b) => a.order - b.order)\n            .map(entry => entry.middleware);\n    }\n    \n    /**\n     * Match path against pattern (simple glob matching)\n     * @param path - Request path\n     * @param pattern - Pattern to match (supports * wildcard)\n     */\n    private matchPath(path: string, pattern: string): boolean {\n        // Convert glob pattern to regex\n        const regexPattern = pattern\n            .replace(/\\*/g, '.*')\n            .replace(/\\?/g, '.');\n        \n        const regex = new RegExp(`^${regexPattern}$`);\n        return regex.test(path);\n    }\n    \n    /**\n     * Clear all middleware\n     */\n    clear(): void {\n        this.middlewares.clear();\n    }\n    \n    /**\n     * Get middleware count\n     */\n    count(): number {\n        return this.middlewares.size;\n    }\n    \n    /**\n     * Create a composite middleware from the chain\n     * This can be used to apply all middleware at once\n     */\n    createCompositeMiddleware(): Middleware {\n        const chain = this.getMiddlewareChain();\n        \n        return async (req: IHttpRequest, res: IHttpResponse, next: () => void | Promise<void>) => {\n            let index = 0;\n            \n            const executeNext = async (): Promise<void> => {\n                if (index >= chain.length) {\n                    await next();\n                    return;\n                }\n                \n                const middleware = chain[index++];\n                await middleware(req, res, executeNext);\n            };\n            \n            await executeNext();\n        };\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectKernel } from '@objectstack/core';\n\n/**\n * Factory contract for instantiating a per-project {@link ObjectKernel}.\n *\n * Given a `environmentId`, the factory is expected to:\n * 1. Read control-plane metadata (`sys_environment` + credentials + subscribed packages).\n * 2. Construct a fresh `ObjectKernel` with project-scoped driver + plugins + Apps.\n * 3. Return a **bootstrapped** kernel ready to serve requests.\n */\nexport interface EnvironmentKernelFactory {\n  create(environmentId: string): Promise<ObjectKernel>;\n}\n\ninterface CachedEntry {\n  kernel: ObjectKernel;\n  createdAt: number;\n  lastAccess: number;\n}\n\nexport interface KernelManagerConfig {\n  factory: EnvironmentKernelFactory;\n  /** Maximum number of kernels to keep resident. Defaults to 32. */\n  maxSize?: number;\n  /**\n   * Time-to-live (ms). Kernels idle longer than this are evicted on next\n   * access. `0` disables TTL expiry. Defaults to 15 minutes.\n   */\n  ttlMs?: number;\n  /**\n   * Optional logger (duck-typed). Falls back to `console` when omitted.\n   */\n  logger?: { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };\n}\n\n/**\n * LRU + TTL cache of per-project {@link ObjectKernel} instances.\n *\n * Implements ADR-0003 multi-kernel scheduling: each project gets an\n * isolated kernel (App/plugin/metadata namespaces) that is lazily built\n * on first request and evicted under memory / idle pressure. Concurrent\n * `getOrCreate()` calls for the same environmentId share a single in-flight\n * factory invocation (singleflight).\n */\nexport class KernelManager {\n  private readonly factory: EnvironmentKernelFactory;\n  private readonly maxSize: number;\n  private readonly ttlMs: number;\n  private readonly logger: NonNullable<KernelManagerConfig['logger']>;\n  private readonly cache = new Map<string, CachedEntry>();\n  private readonly pending = new Map<string, Promise<ObjectKernel>>();\n\n  constructor(config: KernelManagerConfig) {\n    this.factory = config.factory;\n    this.maxSize = config.maxSize ?? 32;\n    this.ttlMs = config.ttlMs ?? 15 * 60 * 1000;\n    this.logger = config.logger ?? console;\n  }\n\n  /** Returns the currently cached environmentIds (ordered by insertion). */\n  keys(): string[] {\n    return Array.from(this.cache.keys());\n  }\n\n  /** Cache size for diagnostics. */\n  get size(): number {\n    return this.cache.size;\n  }\n\n  /**\n   * Resolve or construct the kernel for `environmentId`.\n   *\n   * - Cache hit (fresh): bumps `lastAccess` and returns immediately.\n   * - Cache hit (TTL expired): evicts then falls through to factory.\n   * - Cache miss: dedupes concurrent callers through `pending`.\n   */\n  async getOrCreate(environmentId: string): Promise<ObjectKernel> {\n    const existing = this.cache.get(environmentId);\n    if (existing) {\n      if (this.ttlMs > 0 && Date.now() - existing.lastAccess > this.ttlMs) {\n        await this.evict(environmentId);\n      } else {\n        existing.lastAccess = Date.now();\n        return existing.kernel;\n      }\n    }\n\n    const inflight = this.pending.get(environmentId);\n    if (inflight) return inflight;\n\n    const promise = (async () => {\n      const kernel = await this.factory.create(environmentId);\n      const now = Date.now();\n      this.cache.set(environmentId, { kernel, createdAt: now, lastAccess: now });\n      await this.enforceMaxSize();\n      return kernel;\n    })();\n\n    this.pending.set(environmentId, promise);\n    try {\n      return await promise;\n    } finally {\n      this.pending.delete(environmentId);\n    }\n  }\n\n  /**\n   * Evict the kernel for `environmentId` and invoke `kernel.shutdown()`.\n   * No-op when the entry is absent.\n   */\n  async evict(environmentId: string): Promise<void> {\n    const entry = this.cache.get(environmentId);\n    if (!entry) return;\n    this.cache.delete(environmentId);\n    try {\n      await entry.kernel.shutdown();\n    } catch (err) {\n      this.logger.error?.('[KernelManager] shutdown failed', { environmentId, err });\n    }\n  }\n\n  /** Evict all resident kernels. Used on runtime shutdown. */\n  async evictAll(): Promise<void> {\n    const ids = Array.from(this.cache.keys());\n    await Promise.all(ids.map((id) => this.evict(id)));\n  }\n\n  private async enforceMaxSize(): Promise<void> {\n    while (this.cache.size > this.maxSize) {\n      // Find least-recently-accessed entry.\n      let oldestKey: string | undefined;\n      let oldestAccess = Infinity;\n      for (const [key, entry] of this.cache) {\n        if (entry.lastAccess < oldestAccess) {\n          oldestAccess = entry.lastAccess;\n          oldestKey = key;\n        }\n      }\n      if (!oldestKey) return;\n      await this.evict(oldestKey);\n    }\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Artifact API client.\n *\n * HTTP client that talks to the ObjectStack control plane (e.g.\n * `apps/cloud`) to resolve hostnames to projects and to download a\n * project's compiled artifact.\n *\n * The control plane is expected to expose two endpoints:\n *\n *   GET {controlPlaneUrl}/api/v1/cloud/resolve-hostname?host={hostname}\n *     → { environmentId: string, organizationId?: string, runtime?: EnvironmentRuntimeConfig }\n *\n *   GET {controlPlaneUrl}/api/v1/cloud/environments/:environmentId/artifact\n *     → EnvironmentArtifactResponse  (EnvironmentArtifact + optional `runtime` block)\n *\n * Both endpoints accept an optional `Authorization: Bearer <apiKey>`.\n *\n * Responses are cached in-memory with a TTL so each kernel-manager\n * miss does not produce an extra HTTP round trip. Concurrent callers\n * for the same key share a single in-flight promise (singleflight).\n */\n\nimport type { EnvironmentArtifact } from '@objectstack/spec/cloud';\n\n/**\n * Per-project runtime config injected by the control plane alongside\n * the artifact. Carries the physical database URL the runtime should\n * connect to (this is *not* part of the developer-authored compiled\n * artifact — the control plane mints it when serving the API).\n */\nexport interface EnvironmentRuntimeConfig {\n    organizationId?: string;\n    hostname?: string;\n    /** Driver type — e.g. `sqlite`, `postgres`, `turso`, `memory`. */\n    databaseDriver: string;\n    /** Driver-specific connection URL. */\n    databaseUrl: string;\n    /** Optional auth token (e.g. for libSQL/Turso). */\n    databaseAuthToken?: string;\n    /**\n     * Project-level metadata captured by the control plane at create time\n     * (e.g. `ownerSeed`, `orgSeed`). Forwarded to the runtime so cold-boot\n     * seed replay can mirror the cloud org + owner into the project DB\n     * before the user's first SSO callback arrives.\n     */\n    metadata?: Record<string, unknown>;\n}\n\n/**\n * Hostname resolution response.\n */\nexport interface ResolvedHostname {\n    environmentId: string;\n    organizationId?: string;\n    /** Optional runtime config — when present, callers can skip the artifact fetch's runtime block. */\n    runtime?: EnvironmentRuntimeConfig;\n}\n\n/**\n * Artifact response wrapping the spec's `EnvironmentArtifact` envelope plus\n * an optional `runtime` block carrying the project's database\n * connection details.\n */\nexport interface EnvironmentArtifactResponse extends EnvironmentArtifact {\n    runtime?: EnvironmentRuntimeConfig;\n}\n\nexport interface ArtifactApiClientConfig {\n    /** Control-plane base URL (no trailing slash). */\n    controlPlaneUrl: string;\n    /** Optional bearer token. */\n    apiKey?: string;\n    /** Cache TTL in ms. Default: 5 min. */\n    cacheTtlMs?: number;\n    /** Timeout for control-plane HTTP calls in ms. Default: 10s. */\n    requestTimeoutMs?: number;\n    /** Optional fetch override (testing). */\n    fetch?: typeof fetch;\n    /** Optional logger. */\n    logger?: { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };\n}\n\ninterface CacheEntry<T> {\n    value: T;\n    expiresAt: number;\n}\n\nexport class ArtifactApiClient {\n    private readonly base: string;\n    private readonly apiKey?: string;\n    private readonly cacheTtlMs: number;\n    private readonly requestTimeoutMs: number;\n    private readonly fetchImpl: typeof fetch;\n    private readonly logger: NonNullable<ArtifactApiClientConfig['logger']>;\n\n    private readonly hostnameCache = new Map<string, CacheEntry<ResolvedHostname>>();\n    private readonly artifactCache = new Map<string, CacheEntry<EnvironmentArtifactResponse>>();\n    private readonly pendingHostname = new Map<string, Promise<ResolvedHostname | null>>();\n    private readonly pendingArtifact = new Map<string, Promise<EnvironmentArtifactResponse | null>>();\n\n    constructor(config: ArtifactApiClientConfig) {\n        if (!config.controlPlaneUrl) {\n            throw new Error('[ArtifactApiClient] controlPlaneUrl is required');\n        }\n        this.base = config.controlPlaneUrl.replace(/\\/+$/, '');\n        this.apiKey = config.apiKey;\n        this.cacheTtlMs = config.cacheTtlMs ?? 5 * 60 * 1000;\n        this.requestTimeoutMs = config.requestTimeoutMs ?? 10_000;\n        this.fetchImpl = config.fetch ?? globalThis.fetch;\n        this.logger = config.logger ?? console;\n        if (typeof this.fetchImpl !== 'function') {\n            throw new Error('[ArtifactApiClient] global fetch is not available — provide config.fetch');\n        }\n    }\n\n    /**\n     * Resolve a hostname to its project. Returns `null` on 404 or\n     * malformed responses. Errors (network / 5xx) are thrown so\n     * upstream callers can retry.\n     */\n    async resolveHostname(host: string): Promise<ResolvedHostname | null> {\n        const cached = this.hostnameCache.get(host);\n        if (cached && cached.expiresAt > Date.now()) return cached.value;\n\n        const inflight = this.pendingHostname.get(host);\n        if (inflight) return inflight;\n\n        const promise = (async () => {\n            try {\n                const url = `${this.base}/api/v1/cloud/resolve-hostname?host=${encodeURIComponent(host)}`;\n                const res = await this.request(url);\n                if (res === null) return null;\n                const body = res.success === false ? null : (res.data ?? res);\n                if (!body || typeof body.environmentId !== 'string' || !body.environmentId) return null;\n                const value: ResolvedHostname = {\n                    environmentId: body.environmentId,\n                    organizationId: body.organizationId,\n                    runtime: body.runtime,\n                };\n                this.hostnameCache.set(host, { value, expiresAt: Date.now() + this.cacheTtlMs });\n                return value;\n            } finally {\n                this.pendingHostname.delete(host);\n            }\n        })();\n        this.pendingHostname.set(host, promise);\n        return promise;\n    }\n\n    /**\n     * Fetch the compiled artifact for a project.\n     *\n     * When `opts.commit` is set, requests that specific revision via the\n     * existing `?commit=` query param. Different commits are cached\n     * independently (the cache key includes the commit id) so the preview\n     * runtime can hold multiple versions in memory simultaneously.\n     */\n    async fetchArtifact(environmentId: string, opts?: { commit?: string }): Promise<EnvironmentArtifactResponse | null> {\n        const commit = opts?.commit?.trim() || '';\n        const cacheKey = commit ? `${environmentId}@${commit}` : environmentId;\n        const cached = this.artifactCache.get(cacheKey);\n        if (cached && cached.expiresAt > Date.now()) return cached.value;\n\n        const inflight = this.pendingArtifact.get(cacheKey);\n        if (inflight) return inflight;\n\n        const promise = (async () => {\n            try {\n                const qs = commit ? `?commit=${encodeURIComponent(commit)}` : '';\n                const url = `${this.base}/api/v1/cloud/environments/${encodeURIComponent(environmentId)}/artifact${qs}`;\n                const res = await this.request(url);\n                if (res === null) return null;\n                const body = res.success === false ? null : (res.data ?? res);\n                if (!body || typeof body !== 'object') return null;\n                if (!body.metadata) {\n                    this.logger.warn?.('[ArtifactApiClient] artifact response missing `metadata`', { environmentId, commit });\n                    return null;\n                }\n                const value = body as EnvironmentArtifactResponse;\n                this.artifactCache.set(cacheKey, { value, expiresAt: Date.now() + this.cacheTtlMs });\n                return value;\n            } finally {\n                this.pendingArtifact.delete(cacheKey);\n            }\n        })();\n        this.pendingArtifact.set(cacheKey, promise);\n        return promise;\n    }\n\n    /**\n     * Resolve an 8-hex project short id (first 8 hex chars of the UUID,\n     * dashes stripped) to the full environmentId. Used by the preview\n     * runtime, which encodes project ids in subdomains.\n     *\n     * Returns `null` on 404 or ambiguity (the control plane returns 409\n     * if the prefix matches more than one project).\n     */\n    async lookupProjectByShortId(shortId: string): Promise<{ environmentId: string; organizationId?: string } | null> {\n        const short = String(shortId ?? '').trim().toLowerCase();\n        if (!/^[0-9a-f]{8,}$/.test(short)) return null;\n        const url = `${this.base}/api/v1/cloud/environments-by-short-id/${encodeURIComponent(short)}`;\n        const res = await this.request(url);\n        if (res === null) return null;\n        const body = res.success === false ? null : (res.data ?? res);\n        if (!body || typeof body.environmentId !== 'string' || !body.environmentId) return null;\n        return { environmentId: body.environmentId, organizationId: body.organizationId };\n    }\n\n    /**\n     * Fetch the head commit of a branch. Returns the commit id (and the\n     * matching revision row's `published_at` for cache-validity checks).\n     * Reuses the existing `GET /cloud/environments/:id/branches` endpoint.\n     */\n    async fetchBranchHead(\n        environmentId: string,\n        branchName: string,\n    ): Promise<{ commitId: string; publishedAt?: string | null } | null> {\n        const url = `${this.base}/api/v1/cloud/environments/${encodeURIComponent(environmentId)}/branches`;\n        const res = await this.request(url);\n        if (res === null) return null;\n        const body = res.success === false ? null : (res.data ?? res);\n        const branches = Array.isArray(body?.branches) ? body.branches : [];\n        const target = String(branchName ?? '').trim().toLowerCase();\n        const found = branches.find((b: any) => String(b?.branch ?? '').toLowerCase() === target);\n        if (!found?.headCommitId) return null;\n        return { commitId: String(found.headCommitId), publishedAt: found.headPublishedAt ?? null };\n    }\n\n    /** Drop cached entries for a project (and any matching hostname). */\n    invalidate(environmentId: string): void {\n        // Cache keys are `${environmentId}` for HEAD or `${environmentId}@${commit}`\n        // for pinned reads (preview runtime). Drop both shapes.\n        this.artifactCache.delete(environmentId);\n        const prefix = `${environmentId}@`;\n        for (const key of Array.from(this.artifactCache.keys())) {\n            if (key.startsWith(prefix)) this.artifactCache.delete(key);\n        }\n        for (const [host, entry] of this.hostnameCache) {\n            if (entry.value.environmentId === environmentId) this.hostnameCache.delete(host);\n        }\n    }\n\n    /** Drop everything. Used on shutdown / hot-reload. */\n    clear(): void {\n        this.hostnameCache.clear();\n        this.artifactCache.clear();\n    }\n\n    private async request(url: string): Promise<any> {\n        const controller = typeof AbortController !== 'undefined' ? new AbortController() : null;\n        const timer = controller ? setTimeout(() => controller.abort(), this.requestTimeoutMs) : null;\n        try {\n            const res = await this.fetchImpl(url, {\n                method: 'GET',\n                headers: this.buildHeaders(),\n                signal: controller?.signal,\n            });\n            if (res.status === 404) return null;\n            if (!res.ok) {\n                throw new Error(`[ArtifactApiClient] ${url} → HTTP ${res.status}`);\n            }\n            return await res.json();\n        } finally {\n            if (timer) clearTimeout(timer);\n        }\n    }\n\n    private buildHeaders(): Record<string, string> {\n        const headers: Record<string, string> = {\n            'accept': 'application/json',\n            'user-agent': 'objectos-runtime',\n        };\n        if (this.apiKey) headers['authorization'] = `Bearer ${this.apiKey}`;\n        return headers;\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * EnvironmentDriverRegistry implementation that talks to the control plane\n * over HTTP via {@link ArtifactApiClient}.\n *\n * Mirrors {@link DefaultEnvironmentDriverRegistry} from `environment-registry.ts`\n * but does **not** read from a local control-plane database. Hostname →\n * environmentId resolution and per-project runtime config (database URL /\n * driver) come from the control plane API.\n *\n * The cached `project` payload exposed by `peekById()` is shaped to look\n * like a `sys_environment` row so callers downstream (notably\n * `ArtifactKernelFactory`) can read `id`, `organization_id`,\n * `database_url` and `database_driver` without branching.\n */\n\nimport type * as Contracts from '@objectstack/spec/contracts';\nimport { resolve as resolvePathNode } from 'node:path';\nimport type { EnvironmentDriverRegistry } from './environment-registry.js';\nimport type { ArtifactApiClient, EnvironmentRuntimeConfig } from './artifact-api-client.js';\n\ntype IDataDriver = Contracts.IDataDriver;\n\ninterface CacheEntry {\n    environmentId: string;\n    driver: IDataDriver;\n    project: any;\n    expiresAt: number;\n}\n\nexport interface ArtifactEnvironmentRegistryConfig {\n    client: ArtifactApiClient;\n    /** Cache TTL for resolved drivers in ms. Default: 5 min. */\n    cacheTtlMs?: number;\n    /** Optional logger. */\n    logger?: { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };\n}\n\nexport class ArtifactEnvironmentRegistry implements EnvironmentDriverRegistry {\n    private readonly client: ArtifactApiClient;\n    private readonly cacheTTL: number;\n    private readonly logger: NonNullable<ArtifactEnvironmentRegistryConfig['logger']>;\n\n    private readonly hostnameCache = new Map<string, CacheEntry>();\n    private readonly idCache = new Map<string, CacheEntry>();\n    private readonly pending = new Map<string, Promise<CacheEntry | null>>();\n\n    constructor(config: ArtifactEnvironmentRegistryConfig) {\n        this.client = config.client;\n        this.cacheTTL = config.cacheTtlMs ?? 5 * 60 * 1000;\n        this.logger = config.logger ?? console;\n    }\n\n    async resolveByHostname(host: string): Promise<{ environmentId: string; driver: IDataDriver } | null> {\n        const cached = this.hostnameCache.get(host);\n        if (cached && cached.expiresAt > Date.now()) {\n            return { environmentId: cached.environmentId, driver: cached.driver };\n        }\n        const key = `host:${host}`;\n        const inflight = this.pending.get(key);\n        if (inflight) {\n            const result = await inflight;\n            return result ? { environmentId: result.environmentId, driver: result.driver } : null;\n        }\n        const promise = (async (): Promise<CacheEntry | null> => {\n            try {\n                const resolved = await this.client.resolveHostname(host);\n                if (!resolved) return null;\n                const entry = await this.buildCacheEntry(resolved.environmentId, resolved.runtime, resolved.organizationId, host);\n                if (!entry) return null;\n                this.hostnameCache.set(host, entry);\n                this.idCache.set(entry.environmentId, entry);\n                return entry;\n            } catch (err: any) {\n                this.logger.error?.('[ArtifactEnvironmentRegistry] resolveByHostname failed', {\n                    host,\n                    error: err?.message ?? err,\n                });\n                return null;\n            } finally {\n                this.pending.delete(key);\n            }\n        })();\n        this.pending.set(key, promise);\n        const entry = await promise;\n        return entry ? { environmentId: entry.environmentId, driver: entry.driver } : null;\n    }\n\n    async resolveById(environmentId: string): Promise<IDataDriver | null> {\n        const cached = this.idCache.get(environmentId);\n        if (cached && cached.expiresAt > Date.now()) return cached.driver;\n\n        const key = `id:${environmentId}`;\n        const inflight = this.pending.get(key);\n        if (inflight) {\n            const result = await inflight;\n            return result?.driver ?? null;\n        }\n        const promise = (async (): Promise<CacheEntry | null> => {\n            try {\n                const entry = await this.buildCacheEntry(environmentId, undefined, undefined, undefined);\n                if (!entry) return null;\n                this.idCache.set(environmentId, entry);\n                if (entry.project?.hostname) this.hostnameCache.set(entry.project.hostname, entry);\n                return entry;\n            } catch (err: any) {\n                this.logger.error?.('[ArtifactEnvironmentRegistry] resolveById failed', {\n                    environmentId,\n                    error: err?.message ?? err,\n                });\n                return null;\n            } finally {\n                this.pending.delete(key);\n            }\n        })();\n        this.pending.set(key, promise);\n        const entry = await promise;\n        return entry?.driver ?? null;\n    }\n\n    peekById(environmentId: string): { environmentId: string; driver: IDataDriver; project: any } | null {\n        const cached = this.idCache.get(environmentId);\n        if (cached && cached.expiresAt > Date.now()) {\n            return { environmentId: cached.environmentId, driver: cached.driver, project: cached.project };\n        }\n        return null;\n    }\n\n    invalidate(environmentId: string): void {\n        this.idCache.delete(environmentId);\n        for (const [host, entry] of this.hostnameCache) {\n            if (entry.environmentId === environmentId) this.hostnameCache.delete(host);\n        }\n        this.client.invalidate(environmentId);\n    }\n\n    private async buildCacheEntry(\n        environmentId: string,\n        runtimeFromHostname: EnvironmentRuntimeConfig | undefined,\n        orgIdFromHostname: string | undefined,\n        hostname: string | undefined,\n    ): Promise<CacheEntry | null> {\n        let runtime = runtimeFromHostname;\n        let organizationId = orgIdFromHostname;\n        let host = hostname;\n        let artifactProjectId = environmentId;\n\n        if (!runtime || !organizationId) {\n            const artifact = await this.client.fetchArtifact(environmentId);\n            if (!artifact) {\n                this.logger.warn?.('[ArtifactEnvironmentRegistry] artifact not found', { environmentId });\n                return null;\n            }\n            artifactProjectId = artifact.environmentId ?? environmentId;\n            if (!runtime) runtime = artifact.runtime ?? extractRuntimeFromMetadata(artifact.metadata);\n            if (!organizationId) organizationId = artifact.runtime?.organizationId;\n            if (!host) host = artifact.runtime?.hostname;\n        }\n\n        if (!runtime || !runtime.databaseUrl || !runtime.databaseDriver) {\n            this.logger.warn?.('[ArtifactEnvironmentRegistry] no runtime config for project', { environmentId });\n            return null;\n        }\n\n        const driver = await createDriver(runtime.databaseDriver, runtime.databaseUrl, runtime.databaseAuthToken ?? '');\n\n        const projectRow = {\n            id: artifactProjectId,\n            organization_id: organizationId,\n            hostname: host,\n            database_url: runtime.databaseUrl,\n            database_driver: runtime.databaseDriver,\n            metadata: runtime.metadata,\n        };\n\n        return {\n            environmentId: artifactProjectId,\n            driver,\n            project: projectRow,\n            expiresAt: Date.now() + this.cacheTTL,\n        };\n    }\n}\n\n/**\n * Best-effort fallback: if the control plane did not return an explicit\n * `runtime` block, look for a default datasource in the compiled artifact\n * and reuse its connection config. Useful for self-published artifacts\n * where the developer encoded the connection inline (e.g. memory:// for\n * demos).\n */\nfunction extractRuntimeFromMetadata(metadata: any): EnvironmentRuntimeConfig | undefined {\n    const datasources = metadata?.datasources;\n    if (!Array.isArray(datasources) || datasources.length === 0) return undefined;\n    const mapping: any[] | undefined = metadata?.datasourceMapping;\n    let preferredName: string | undefined;\n    if (mapping) {\n        const def = mapping.find((m: any) => m?.default === true);\n        if (def?.datasource) preferredName = def.datasource;\n    }\n    const ds = preferredName\n        ? datasources.find((d: any) => d?.name === preferredName)\n        : datasources[0];\n    if (!ds || typeof ds !== 'object') return undefined;\n    const config = (ds.config ?? {}) as Record<string, any>;\n    const url = config.url ?? config.connectionString ?? config.connection ?? config.filename;\n    const driver = ds.driver;\n    if (typeof driver !== 'string' || typeof url !== 'string') return undefined;\n    return {\n        databaseDriver: driver,\n        databaseUrl: url,\n        databaseAuthToken: typeof config.authToken === 'string' ? config.authToken : undefined,\n    };\n}\n\nasync function createDriver(driverType: string, databaseUrl: string, authToken: string): Promise<IDataDriver> {\n    switch (driverType) {\n        case 'memory': {\n            const { InMemoryDriver } = await import('@objectstack/driver-memory');\n            const dbName = databaseUrl.replace(/^memory:\\/\\//, '').trim();\n            // Resolve memory persistence files under the process cwd's\n            // `.objectstack/data/projects/<name>.json` — keeps file-only dev\n            // self-contained without depending on the cloud package's\n            // serverless data-dir resolver.\n            const filePath = dbName\n                ? resolvePathNode(process.cwd(), '.objectstack/data/projects', `${dbName}.json`)\n                : undefined;\n            return new InMemoryDriver({\n                persistence: filePath ? { type: 'file', path: filePath } : 'file',\n            }) as unknown as IDataDriver;\n        }\n        case 'sqlite':\n        case 'sql': {\n            const filePath = databaseUrl.replace(/^file:/, '').replace(/^sql:\\/\\//, '');\n            const { SqlDriver } = await import('@objectstack/driver-sql');\n            return new SqlDriver({\n                client: 'better-sqlite3',\n                connection: { filename: filePath },\n                useNullAsDefault: true,\n            }) as unknown as IDataDriver;\n        }\n        case 'libsql':\n        case 'turso': {\n            const { TursoDriver } = await import('@objectstack/driver-turso');\n            return new TursoDriver({ url: databaseUrl, authToken }) as unknown as IDataDriver;\n        }\n        case 'postgres':\n        case 'postgresql':\n        case 'pg': {\n            const { SqlDriver } = await import('@objectstack/driver-sql');\n            return new SqlDriver({\n                client: 'pg',\n                connection: databaseUrl,\n                pool: { min: 0, max: 5 },\n            }) as unknown as IDataDriver;\n        }\n        case 'mongodb':\n        case 'mongo': {\n            const { MongoDBDriver } = await import('@objectstack/driver-mongodb');\n            return new MongoDBDriver({ url: databaseUrl }) as unknown as IDataDriver;\n        }\n        default:\n            throw new Error(`[ArtifactEnvironmentRegistry] Unsupported driver type: ${driverType}`);\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * EnvironmentKernelFactory backed by the control plane's Artifact API.\n *\n * Differs from {@link DefaultEnvironmentKernelFactory} in two ways:\n *\n *  1. There is no local control-plane database to query — project rows\n *     come from the {@link ArtifactEnvironmentRegistry} cache populated\n *     via HTTP.\n *  2. There is no `ControlPlaneProxyDriver` mounted on the per-project\n *     kernel. The runtime is intentionally isolated from the control\n *     plane: each project kernel only knows about its own data driver.\n *\n * The kernel is bootstrapped with:\n *   • DriverPlugin(driver)  — project-scoped data driver, also aliased\n *                              as the `'cloud'` datasource so AuthPlugin's\n *                              identity manifest resolves locally.\n *   • ObjectQLPlugin\n *   • MetadataPlugin (registers `sys_metadata` + `sys_metadata_history` on\n *                     the project DB — required by ADR-0005: customization\n *                     overlays such as user-created views/dashboards are\n *                     persisted by ObjectStackProtocolImplementation on the\n *                     per-project engine, so the table must exist there).\n *   • AuthPlugin    — per-project, derives an HKDF secret from\n *                     `OS_AUTH_SECRET` + environmentId. Each project owns its\n *                     own `sys_user/sys_session/...` tables in its own\n *                     Turso DB. Cookies are scoped to the project's\n *                     hostname (no `.<root>`-wide cross-project leak).\n *   • AppPlugin(artifact.metadata)  — compiled developer code\n */\n\nimport { createHmac } from 'node:crypto';\nimport { ObjectKernel } from '@objectstack/core';\nimport type * as Contracts from '@objectstack/spec/contracts';\nimport { DriverPlugin } from '../driver-plugin.js';\nimport { AppPlugin } from '../app-plugin.js';\nimport type { EnvironmentKernelFactory } from './kernel-manager.js';\nimport type { EnvironmentDriverRegistry } from './environment-registry.js';\nimport type { ArtifactApiClient } from './artifact-api-client.js';\nimport { loadCapabilities } from './capability-loader.js';\nimport {\n    PLATFORM_SSO_PROVIDER_ID,\n    derivePlatformSsoClientId,\n    derivePlatformSsoClientSecret,\n} from './platform-sso.js';\n\ntype IDataDriver = Contracts.IDataDriver;\n\nexport interface ArtifactKernelFactoryConfig {\n    client: ArtifactApiClient;\n    envRegistry: EnvironmentDriverRegistry;\n    /** Optional logger. */\n    logger?: { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };\n    /** Optional kernel constructor config. */\n    kernelConfig?: ConstructorParameters<typeof ObjectKernel>[0];\n    /**\n     * Base secret used to derive per-project AuthPlugin secrets via\n     * HKDF-style HMAC-SHA256(baseSecret, environmentId). Falls back to\n     * `process.env.OS_AUTH_SECRET` / `AUTH_SECRET` at construction time.\n     */\n    authBaseSecret?: string;\n}\n\n/**\n * Derive a deterministic per-project auth secret. HMAC-SHA256 of the\n * environmentId keyed by the base secret yields a 64-char hex string that is:\n *   - stable across container cold-starts (no DB lookup needed)\n *   - independent per project (forging a token on project A does not\n *     compromise project B)\n *   - rotatable by changing the base secret (will invalidate all sessions)\n */\nfunction deriveProjectAuthSecret(baseSecret: string, environmentId: string): string {\n    return createHmac('sha256', baseSecret).update(`project:${environmentId}`).digest('hex');\n}\n\nexport class ArtifactKernelFactory implements EnvironmentKernelFactory {\n    private readonly client: ArtifactApiClient;\n    private readonly envRegistry: EnvironmentDriverRegistry;\n    private readonly logger: NonNullable<ArtifactKernelFactoryConfig['logger']>;\n    private readonly kernelConfig?: ArtifactKernelFactoryConfig['kernelConfig'];\n    private readonly authBaseSecret: string;\n\n    constructor(config: ArtifactKernelFactoryConfig) {\n        this.client = config.client;\n        this.envRegistry = config.envRegistry;\n        this.logger = config.logger ?? console;\n        this.kernelConfig = config.kernelConfig;\n        this.authBaseSecret = (\n            config.authBaseSecret\n            ?? process.env.OS_AUTH_SECRET\n            ?? process.env.AUTH_SECRET\n            ?? ''\n        ).trim();\n    }\n\n    async create(environmentId: string): Promise<ObjectKernel> {\n        let cached = this.envRegistry.peekById(environmentId);\n        if (!cached) {\n            const driver = await this.envRegistry.resolveById(environmentId);\n            if (!driver) {\n                throw new Error(`[ArtifactKernelFactory] Could not resolve driver for project '${environmentId}'`);\n            }\n            cached = this.envRegistry.peekById(environmentId);\n            if (!cached) {\n                throw new Error(`[ArtifactKernelFactory] envRegistry returned a driver but no cached entry for '${environmentId}'`);\n            }\n        }\n\n        const driver: IDataDriver = cached.driver;\n        const project = cached.project as { id: string; organization_id?: string; hostname?: string };\n\n        const artifact = await this.client.fetchArtifact(environmentId);\n        if (!artifact) {\n            throw new Error(`[ArtifactKernelFactory] Artifact not available for project '${environmentId}'`);\n        }\n\n        const { ObjectQLPlugin } = await import('@objectstack/objectql');\n        const { MetadataPlugin } = await import('@objectstack/metadata');\n\n        const kernel = new ObjectKernel(this.kernelConfig);\n\n        // Register the project driver as both the unnamed default AND under\n        // the `'cloud'` alias. AuthPlugin's manifest header historically\n        // declares `defaultDatasource: 'cloud'`; aliasing here keeps that\n        // path working without forcing every project's identity table\n        // through a control-plane proxy.\n        await kernel.use(new DriverPlugin(driver, { datasourceName: 'cloud' } as any));\n        // Enable schema sync per-project so sys_user / sys_session / etc.\n        // tables get created on the project's own DB. The host worker sets\n        // `OS_SKIP_SCHEMA_SYNC=1` for the control-plane DB; that env var\n        // must NOT bleed into project kernels because their auth tables\n        // need provisioning. KernelManager caches kernels so this runs\n        // at most once per cold-start per project.\n        await kernel.use(new ObjectQLPlugin({ environmentId: environmentId, skipSchemaSync: false }));\n        await kernel.use(new MetadataPlugin({\n            watch: false,\n            environmentId: environmentId,\n            organizationId: project.organization_id,\n            // ADR-0005: customization overlays (user-created views, dashboards,\n            // edited objects, ...) are persisted by\n            // ObjectStackProtocolImplementation.saveMetaItem on whichever\n            // engine the protocol is attached to. For per-project kernels that\n            // means the project's own DB, so the sys_metadata + history tables\n            // MUST be provisioned here. The previous `false` setting caused\n            // \"no such table: sys_metadata\" errors on any PUT /api/v1/meta/*\n            // call (e.g. Studio \"Create View\") against a project deployment.\n            registerSystemObjects: true,\n        }));\n\n        // Per-project AuthPlugin — only when an OS_AUTH_SECRET base is\n        // configured. Without it we cannot derive a secret deterministically\n        // and refuse to start auth (better silent-fail than insecure default).\n        if (this.authBaseSecret) {\n            try {\n                const { AuthPlugin } = await import('@objectstack/plugin-auth');\n                const projectSecret = deriveProjectAuthSecret(this.authBaseSecret, environmentId);\n                const baseUrl = project.hostname\n                    ? (project.hostname.startsWith('http')\n                        ? project.hostname\n                        : (/(\\.|^)localhost(:\\d+)?$/i.test(project.hostname)\n                            ? (() => {\n                                const runtimePort = (process.env.OS_RUNTIME_PORT ?? '').trim();\n                                const hasPort = /:\\d+$/.test(project.hostname);\n                                const hostWithPort = hasPort || !runtimePort\n                                    ? project.hostname\n                                    : `${project.hostname}:${runtimePort}`;\n                                return `http://${hostWithPort}`;\n                            })()\n                            : `https://${project.hostname}`))\n                    : undefined;\n\n                // Build the list of trusted origins for CSRF.\n                // - Production: just the project's https baseUrl + any\n                //   platform-wide origins from OS_TRUSTED_ORIGINS (so\n                //   hostname renames don't require a kernel evict — the\n                //   parent worker already trusts `https://*.<rootdomain>`).\n                // - Dev (*.localhost): also trust http variants on any port so\n                //   the local objectos dev server (PORT=4100 or any user-chosen\n                //   port) can complete sign-in from the browser. baseUrl alone\n                //   is `https://*.localhost` (no port, https) which the\n                //   browser's Origin (`http://*.localhost:4100`) does NOT\n                //   match — leading to better-auth \"Invalid origin\" 403.\n                const trustedOriginsList: string[] = [];\n                if (baseUrl) trustedOriginsList.push(baseUrl);\n                // Inherit platform trusted-origin wildcards from the host\n                // worker. Without this, renaming an environment leaves the\n                // cached per-project kernel rejecting callbackURL=<new-host>\n                // with INVALID_CALLBACK_URL until the next cold-start.\n                const platformOrigins = (process.env.OS_TRUSTED_ORIGINS ?? '')\n                    .split(',')\n                    .map((s) => s.trim())\n                    .filter(Boolean);\n                for (const o of platformOrigins) {\n                    if (!trustedOriginsList.includes(o)) trustedOriginsList.push(o);\n                }\n                // Convenience: when OS_ROOT_DOMAIN is set, trust the entire\n                // platform subdomain space. Matches the host worker's CORS\n                // posture so SSO survives any future tenant-domain rename.\n                const rootDomain = (process.env.OS_ROOT_DOMAIN ?? '').trim().replace(/^https?:\\/\\//, '');\n                if (rootDomain) {\n                    const wildcard = `https://*.${rootDomain}`;\n                    if (!trustedOriginsList.includes(wildcard)) trustedOriginsList.push(wildcard);\n                }\n                if (project.hostname) {\n                    const bareHost = project.hostname.replace(/^https?:\\/\\//, '');\n                    if (bareHost.endsWith('.localhost') || bareHost === 'localhost') {\n                        trustedOriginsList.push(`http://${bareHost}`);\n                        trustedOriginsList.push(`http://${bareHost}:*`);\n                        trustedOriginsList.push(`https://${bareHost}:*`);\n                    }\n                }\n\n                // Platform SSO (\"Airtable-style unified login\"): when the\n                // cloud control-plane is reachable AND the master secret is\n                // shared between the two containers, wire better-auth's\n                // genericOAuth plugin so a builder who already signed in\n                // on `cloud.<root>` is JIT-provisioned as a `sys_user` on\n                // every per-project deployment without re-registering.\n                //\n                // Opt-out: set OS_PLATFORM_SSO=false to fall back to the\n                // legacy \"every project owns its own login\" mode.\n                const platformSsoEnabled = String(\n                    process.env.OS_PLATFORM_SSO ?? 'true',\n                ).toLowerCase() !== 'false';\n                const cloudBaseUrl = (process.env.OS_CLOUD_URL ?? '').trim().replace(/\\/+$/, '');\n                const oidcProviders = platformSsoEnabled\n                    && cloudBaseUrl\n                    && /^https?:\\/\\//.test(cloudBaseUrl)\n                    ? [{\n                        providerId: PLATFORM_SSO_PROVIDER_ID,\n                        name: 'ObjectStack',\n                        discoveryUrl: `${cloudBaseUrl}/.well-known/openid-configuration`,\n                        clientId: derivePlatformSsoClientId(environmentId),\n                        clientSecret: derivePlatformSsoClientSecret(this.authBaseSecret, environmentId),\n                        scopes: ['openid', 'email', 'profile'],\n                    }]\n                    : undefined;\n\n                await kernel.use(new AuthPlugin({\n                    secret: projectSecret,\n                    baseUrl,\n                    // Project kernel has no http-server (host owns it). The\n                    // dispatcher's handleAuth path resolves `auth` via\n                    // getService and invokes the handler directly — route\n                    // registration is unnecessary and would warn.\n                    registerRoutes: false,\n                    // Identity tables live in the project's own DB — keep\n                    // sys_user/sys_session local to this kernel.\n                    manifestDatasource: 'default',\n                    // Cookie scope: default to the project's own host. We\n                    // intentionally do NOT pass crossSubDomainCookies here\n                    // so cookies stay isolated per project subdomain.\n                    trustedOrigins: trustedOriginsList.length ? trustedOriginsList : undefined,\n                    ...(oidcProviders ? { oidcProviders } : {}),\n                    // Auto-provision a personal organization for every new\n                    // user. SecurityPlugin's ObjectQL middleware does this\n                    // for direct `ql.insert` calls, but better-auth's\n                    // adapter writes through `dataEngine` directly,\n                    // bypassing that middleware — so JIT-created SSO users\n                    // would otherwise land on the empty \"create\n                    // organization\" screen on first login.\n                    databaseHooks: {\n                        user: {\n                            create: {\n                                after: async (user: { id: string; email?: string; name?: string }) => {\n                                    try {\n                                        const ql = kernel.getService<any>('objectql');\n                                        if (!ql) return;\n                                        const [{ ensureUserHasOrganization, cloneTenantSeedData }] = await Promise.all([\n                                            import('@objectstack/plugin-security'),\n                                        ]);\n                                        await ensureUserHasOrganization(ql, user, {\n                                            logger: this.logger as any,\n                                            cloneSeedData: cloneTenantSeedData,\n                                        });\n                                    } catch (e: any) {\n                                        this.logger.warn?.('[ArtifactKernelFactory] auto-org provisioning hook failed', {\n                                            environmentId,\n                                            userId: user?.id,\n                                            error: e?.message,\n                                        });\n                                    }\n                                },\n                            },\n                        },\n                    },\n                } as any));\n                if (oidcProviders) {\n                    this.logger.info?.('[ArtifactKernelFactory] platform SSO wired', {\n                        environmentId,\n                        cloudBaseUrl,\n                    });\n                }\n            } catch (err: any) {\n                this.logger.warn?.('[ArtifactKernelFactory] AuthPlugin not registered', {\n                    environmentId,\n                    error: err?.message,\n                });\n            }\n        } else {\n            this.logger.warn?.('[ArtifactKernelFactory] OS_AUTH_SECRET not set — per-project AuthPlugin skipped (auth endpoints will return 404)', { environmentId });\n        }\n\n        // Per-project SecurityPlugin — provides RBAC + tenant_isolation RLS\n        // AND, crucially, the `sys_user` insert middleware that auto-creates\n        // a personal organization for new self-service signups (without it,\n        // a freshly registered user lands on a UI showing \"No data\" because\n        // they have zero `sys_member` rows and the default RLS denies all).\n        // The CLI's `objectstack serve` does this for `pnpm dev`; we have\n        // to mirror that behaviour for cloud-deployed per-project kernels.\n        try {\n            const { SecurityPlugin } = await import('@objectstack/plugin-security');\n            const multiTenant = String(process.env.OS_MULTI_TENANT ?? 'true').toLowerCase() !== 'false';\n            await kernel.use(new SecurityPlugin({ multiTenant }) as any);\n        } catch (err: any) {\n            this.logger.warn?.('[ArtifactKernelFactory] SecurityPlugin not registered', {\n                environmentId,\n                error: err?.message,\n            });\n        }\n\n        const projectName = project.hostname ?? environmentId;\n        const bundle = artifact.metadata as any;\n        const sys = bundle?.manifest ?? bundle;\n        const packageId = sys?.packageId ?? sys?.package_id ?? bundle?.packageId;\n\n        // Per-project i18n: register I18nServicePlugin BEFORE AppPlugin so\n        // AppPlugin.loadTranslations() finds an i18n service to populate.\n        // Without this, the artifact's `translations` array is silently\n        // dropped and the `/api/v1/i18n/*` endpoints return empty payloads.\n        const i18nCfg = (bundle?.i18n ?? sys?.i18n ?? {}) as Record<string, any>;\n        const trArr = Array.isArray(bundle?.translations) ? bundle.translations\n            : Array.isArray(sys?.translations) ? sys.translations : [];\n        // Always register — even with no inline translations the service\n        // can serve labels/locales loaded by hosted apps. Cheap to register.\n        try {\n            const { I18nServicePlugin } = await import('@objectstack/service-i18n');\n            await kernel.use(new I18nServicePlugin({\n                defaultLocale: i18nCfg.defaultLocale,\n                fallbackLocale: i18nCfg.fallbackLocale ?? i18nCfg.defaultLocale ?? 'en',\n                // Routes are dispatched by HttpDispatcher.handleI18n via\n                // kernel.getService('i18n'); the host worker owns the\n                // HTTP server. Skip self-registration to avoid warnings.\n                registerRoutes: false,\n            } as any));\n            console.warn(\n                `[ArtifactKernelFactory] I18nServicePlugin registered (project=${environmentId}, translations=${trArr.length}, defaultLocale=${i18nCfg.defaultLocale ?? 'en'})`,\n            );\n        } catch (err: any) {\n            this.logger.warn?.('[ArtifactKernelFactory] I18nServicePlugin not registered', {\n                environmentId,\n                error: err?.message,\n            });\n        }\n\n        // Tier-driven capability loading: install service plugins listed\n        // in the artifact's `requires` array (e.g. ['ai','automation',\n        // 'analytics']). Must be registered BEFORE AppPlugin so that\n        // AppPlugin's start phase can hand off flows/agents/cubes to\n        // services that are already initialised.\n        const requiresRaw =\n            (Array.isArray(bundle?.requires) ? bundle.requires : null) ??\n            (Array.isArray(sys?.requires) ? sys.requires : null) ??\n            [];\n        const requires: string[] = (requiresRaw as unknown[])\n            .filter((x): x is string => typeof x === 'string' && x.length > 0);\n\n        if (requires.length > 0) {\n            const installed = await loadCapabilities({\n                kernel,\n                requires,\n                bundle: { ...(bundle ?? {}), ...(sys ?? {}) } as Record<string, unknown>,\n                logger: this.logger,\n                environmentId,\n            });\n            this.logger.info?.('[ArtifactKernelFactory] capabilities loaded', {\n                environmentId,\n                requires,\n                installed,\n            });\n        }\n\n        await kernel.use(new AppPlugin(bundle, {\n            environmentId,\n            organizationId: project.organization_id ?? '',\n            projectName,\n            packageId,\n            source: packageId ? 'package' : 'user',\n        } as any));\n\n        await kernel.bootstrap();\n\n        // Pre-seed the project owner. The cloud control-plane stashed the\n        // creator's identity into `sys_environment.metadata.ownerSeed` at\n        // project-create time; replay it AFTER `kernel.bootstrap()` so\n        // ObjectQL/Security plugins have fully initialised and\n        // `kernel.getService('objectql')` resolves. Pre-bootstrap, plugins\n        // are only registered — services aren't wired yet.\n        //\n        // Order matters:\n        //   1. Seed the OWNING cloud org into `sys_organization` so the\n        //      project's primary workspace matches the cloud team that\n        //      owns the project at the platform level.\n        //   2. Seed the owner's `sys_user` row.\n        //   3. Seed a `sys_member(owner)` row binding the user to the\n        //      cloud org. This prevents SecurityPlugin's\n        //      `ensureUserHasOrganization` insert middleware from\n        //      auto-creating a disjoint \"Alice's Workspace\" personal\n        //      org (the middleware only fires when the user has zero\n        //      memberships).\n        //\n        // All three are idempotent — safe across cold-boots.\n        try {\n            const projMeta: any = typeof (project as any)?.metadata === 'string'\n                ? JSON.parse((project as any).metadata)\n                : ((project as any)?.metadata ?? {});\n            const ownerSeed = projMeta?.ownerSeed;\n            const orgSeed = projMeta?.orgSeed;\n\n            if (orgSeed?.id && orgSeed?.name) {\n                try {\n                    const { seedProjectOrganization } = await import('./environment-org-seed.js');\n                    await seedProjectOrganization(kernel, orgSeed, this.logger);\n                } catch (e: any) {\n                    this.logger.warn?.('[ArtifactKernelFactory] orgSeed threw', {\n                        environmentId,\n                        error: e?.message,\n                    });\n                }\n            }\n\n            if (ownerSeed?.userId && ownerSeed?.email) {\n                try {\n                    const { seedProjectOwner } = await import('./environment-owner-seed.js');\n                    await seedProjectOwner(kernel, ownerSeed, this.logger);\n                } catch (e: any) {\n                    this.logger.warn?.('[ArtifactKernelFactory] ownerSeed threw', {\n                        environmentId,\n                        error: e?.message,\n                    });\n                }\n\n                if (orgSeed?.id) {\n                    try {\n                        const { seedProjectMember } = await import('./environment-org-seed.js');\n                        await seedProjectMember(\n                            kernel,\n                            { userId: ownerSeed.userId, organizationId: orgSeed.id, role: 'owner' },\n                            this.logger,\n                        );\n                    } catch (e: any) {\n                        this.logger.warn?.('[ArtifactKernelFactory] memberSeed threw', {\n                            environmentId,\n                            error: e?.message,\n                        });\n                    }\n                }\n            }\n        } catch (err: any) {\n            this.logger.warn?.('[ArtifactKernelFactory] owner/org seed skipped', {\n                environmentId,\n                error: err?.message,\n            });\n        }\n\n        // Post-bootstrap seed replay. The SecurityPlugin's `sys_organization`\n        // insert middleware only fires when a brand-new org row is inserted,\n        // so packages installed AFTER the env's primary org already exists\n        // would never get their `data` arrays applied. Run the seed-replayer\n        // once per kernel cold-start so newly-installed marketplace packages\n        // (e.g. CRM with \"Include sample data\" ticked) hydrate the primary\n        // org on the next request after install.\n        //\n        // SeedLoader uses upsert semantics, so re-running across cold-starts\n        // is idempotent — at worst we pay one batch upsert per kernel boot.\n        try {\n            const datasetsNow: any[] | undefined = (() => {\n                try { return (kernel as any).getService?.('seed-datasets'); } catch { return undefined; }\n            })();\n            const replayer: any = (() => {\n                try { return (kernel as any).getService?.('seed-replayer'); } catch { return undefined; }\n            })();\n\n            if (Array.isArray(datasetsNow) && datasetsNow.length > 0 && typeof replayer === 'function') {\n                // Resolve the env's primary organization. Prefer the explicit\n                // orgSeed metadata (set when env is created via the data API);\n                // fall back to scanning sys_organization for the first row\n                // (env created via the lifecycle endpoint that doesn't stash\n                // orgSeed, or any env that has been used at least once).\n                const projMetaRaw: any = (project as any)?.metadata;\n                const projMeta: any = typeof projMetaRaw === 'string' ? (() => {\n                    try { return JSON.parse(projMetaRaw); } catch { return {}; }\n                })() : (projMetaRaw ?? {});\n                let primaryOrgId: string | undefined = projMeta?.orgSeed?.id;\n\n                if (!primaryOrgId) {\n                    try {\n                        const ql: any = (kernel as any).getService?.('objectql');\n                        if (ql?.find) {\n                            const rows = await ql.find('sys_organization', { limit: 5, orderBy: [{ field: 'created_at', direction: 'asc' }] } as any);\n                            const list = Array.isArray(rows) ? rows : (rows?.value ?? rows?.records ?? []);\n                            if (Array.isArray(list) && list.length > 0 && list[0]?.id) {\n                                primaryOrgId = String(list[0].id);\n                            }\n                        }\n                    } catch { /* org table may not exist yet on a brand-new env */ }\n                }\n\n                if (primaryOrgId) {\n                    try {\n                        const summary = await replayer(primaryOrgId);\n                        const inserted = summary?.inserted ?? 0;\n                        const updated = summary?.updated ?? 0;\n                        const errs = summary?.errors?.length ?? 0;\n                        if (inserted > 0 || updated > 0 || errs > 0) {\n                            this.logger.info?.('[ArtifactKernelFactory] post-bootstrap seed replay', {\n                                environmentId,\n                                organizationId: primaryOrgId,\n                                datasets: datasetsNow.length,\n                                inserted,\n                                updated,\n                                errors: errs,\n                            });\n                        }\n                    } catch (e: any) {\n                        this.logger.warn?.('[ArtifactKernelFactory] post-bootstrap seed replay failed', {\n                            environmentId,\n                            organizationId: primaryOrgId,\n                            error: e?.message,\n                        });\n                    }\n                }\n            }\n        } catch (err: any) {\n            this.logger.warn?.('[ArtifactKernelFactory] post-bootstrap seed step threw', {\n                environmentId,\n                error: err?.message,\n            });\n        }\n\n        // Belt-and-braces: load translation bundles directly into the i18n\n        // service after bootstrap. AppPlugin.loadTranslations should do this\n        // during its `start` phase, but several conditions (missing objectql\n        // service, runtime.onEnable throwing, bundle keys mismatch) can cause\n        // it to bail before reaching the i18n step. Loading here guarantees\n        // the bundles attached to the artifact metadata are always served via\n        // `/api/v1/i18n/*`, regardless of AppPlugin's runtime path.\n        let i18nSvc: any = null;\n        try {\n            i18nSvc = (kernel as any).getService?.('i18n');\n        } catch {\n            // getService throws when service isn't registered — leave null\n            i18nSvc = null;\n        }\n        try {\n            if (i18nSvc && typeof i18nSvc.loadTranslations === 'function') {\n                if (i18nCfg.defaultLocale && typeof i18nSvc.setDefaultLocale === 'function') {\n                    i18nSvc.setDefaultLocale(i18nCfg.defaultLocale);\n                }\n                let loaded = 0;\n                for (const tbundle of trArr) {\n                    if (!tbundle || typeof tbundle !== 'object') continue;\n                    for (const [locale, data] of Object.entries(tbundle)) {\n                        if (data && typeof data === 'object') {\n                            try {\n                                i18nSvc.loadTranslations(locale, data as Record<string, unknown>);\n                                loaded++;\n                            } catch (err: any) {\n                                this.logger.warn?.('[ArtifactKernelFactory] i18n loadTranslations failed', {\n                                    environmentId, locale, error: err?.message,\n                                });\n                            }\n                        }\n                    }\n                }\n                if (loaded > 0) {\n                    this.logger.info?.('[ArtifactKernelFactory] i18n direct-load complete', {\n                        environmentId, locales: loaded, bundles: trArr.length,\n                    });\n                }\n            }\n        } catch (err: any) {\n            this.logger.warn?.('[ArtifactKernelFactory] i18n direct-load failed', {\n                environmentId,\n                error: err?.message,\n            });\n        }\n\n        this.logger.info?.('[ArtifactKernelFactory] kernel ready', {\n            environmentId,\n            commitId: artifact.commitId,\n            checksum: artifact.checksum,\n            authEnabled: Boolean(this.authBaseSecret),\n        });\n\n        return kernel;\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Capability loader — `bundle.requires` driven dispatch.\n *\n * Mirrors the CAPABILITY_PROVIDERS table in\n * `@objectstack/cli/src/commands/serve.ts` so that per-project kernels\n * built by {@link ArtifactKernelFactory} pick up the same service plugins\n * a developer would get when running `objectstack serve` locally.\n *\n * Design goals:\n *   - Single source of truth: artifact's `requires` array. No hardcoded\n *     plugin list per host.\n *   - Lazy: each provider is dynamically imported only when requested,\n *     keeping cold-start small for artifacts that don't need that\n *     capability.\n *   - Silent on missing deps: a host that doesn't ship the optional\n *     package (e.g. service-queue) just logs a warn and continues.\n */\n\nimport type { ObjectKernel } from '@objectstack/core';\n\nexport interface CapabilitySpec {\n    /** npm package name to import. */\n    pkg: string;\n    /** Named export — class constructor for the main plugin. */\n    export: string;\n    /**\n     * Optional bundle key that, when present, is forwarded as constructor\n     * argument (e.g. analytics needs `analyticsCubes`).\n     */\n    configKey?: string;\n    /** Auxiliary plugins loaded alongside the main one. */\n    extras?: Array<{ pkg: string; export: string }>;\n}\n\n/**\n * Registry of `requires` token → plugin provider.\n *\n * Keep keys in sync with the user-facing tokens accepted by\n * `defineStack({ requires: [...] })` and the CLI's CAPABILITY_PROVIDERS.\n *\n * Tier-gated capabilities (`auth`, `ui`, `i18n`) are intentionally NOT\n * listed here — they are wired explicitly by the kernel factory because\n * they need bespoke configuration (per-project HKDF secret, UI dist\n * paths, etc).\n */\nexport const CAPABILITY_PROVIDERS: Record<string, CapabilitySpec> = {\n    automation: {\n        pkg: '@objectstack/service-automation',\n        export: 'AutomationServicePlugin',\n        extras: [\n            { pkg: '@objectstack/service-automation', export: 'CrudNodesPlugin' },\n            { pkg: '@objectstack/service-automation', export: 'LogicNodesPlugin' },\n            { pkg: '@objectstack/service-automation', export: 'HttpConnectorPlugin' },\n            { pkg: '@objectstack/service-automation', export: 'ScreenNodesPlugin' },\n        ],\n    },\n    ai: {\n        pkg: '@objectstack/service-ai',\n        export: 'AIServicePlugin',\n    },\n    analytics: {\n        pkg: '@objectstack/service-analytics',\n        export: 'AnalyticsServicePlugin',\n        configKey: 'analyticsCubes',\n    },\n    audit: {\n        pkg: '@objectstack/plugin-audit',\n        export: 'AuditPlugin',\n    },\n    cache: {\n        pkg: '@objectstack/service-cache',\n        export: 'CacheServicePlugin',\n    },\n    storage: {\n        pkg: '@objectstack/service-storage',\n        export: 'StorageServicePlugin',\n    },\n    queue: {\n        pkg: '@objectstack/service-queue',\n        export: 'QueueServicePlugin',\n    },\n    job: {\n        pkg: '@objectstack/service-job',\n        export: 'JobServicePlugin',\n    },\n    realtime: {\n        pkg: '@objectstack/service-realtime',\n        export: 'RealtimeServicePlugin',\n    },\n    feed: {\n        pkg: '@objectstack/service-feed',\n        export: 'FeedServicePlugin',\n    },\n    settings: {\n        pkg: '@objectstack/service-settings',\n        export: 'SettingsServicePlugin',\n    },\n};\n\ntype Logger = { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };\n\nexport interface LoadCapabilitiesOptions {\n    kernel: ObjectKernel;\n    /** Tokens from `bundle.requires` (e.g. `['ai','automation','analytics']`). */\n    requires: readonly string[];\n    /** Compiled artifact metadata. Used to pull `configKey`-driven args. */\n    bundle: Record<string, unknown>;\n    /** Optional logger. */\n    logger?: Logger;\n    /** environmentId for log breadcrumbs. */\n    environmentId: string;\n}\n\n/**\n * Walk `requires` and install each known capability on the kernel.\n *\n * Returns the list of plugin exports actually installed for diagnostics.\n */\nexport async function loadCapabilities(opts: LoadCapabilitiesOptions): Promise<string[]> {\n    const { kernel, requires, bundle, environmentId } = opts;\n    const logger: Logger = opts.logger ?? console;\n    const installed: string[] = [];\n\n    for (const cap of requires) {\n        const spec = CAPABILITY_PROVIDERS[cap];\n        if (!spec) {\n            // Tier-gated capability (auth/ui/i18n) — wired elsewhere.\n            continue;\n        }\n\n        try {\n            const mod: any = await import(/* webpackIgnore: true */ spec.pkg);\n            const Ctor = mod[spec.export];\n            if (!Ctor) {\n                logger.warn?.(\n                    `[CapabilityLoader] '${cap}': package '${spec.pkg}' did not export '${spec.export}'`,\n                    { environmentId },\n                );\n                continue;\n            }\n\n            let arg: unknown;\n            if (spec.configKey) {\n                const v = (bundle as Record<string, unknown>)[spec.configKey];\n                if (spec.configKey === 'analyticsCubes') {\n                    arg = { cubes: Array.isArray(v) ? v : [] };\n                } else if (v !== undefined) {\n                    arg = v;\n                }\n            }\n\n            await kernel.use(arg !== undefined ? new Ctor(arg) : new Ctor());\n            installed.push(spec.export);\n\n            if (spec.extras) {\n                for (const ex of spec.extras) {\n                    try {\n                        const exMod: any = await import(/* webpackIgnore: true */ ex.pkg);\n                        const ExCtor = exMod[ex.export];\n                        if (ExCtor) {\n                            await kernel.use(new ExCtor());\n                            installed.push(ex.export);\n                        }\n                    } catch {\n                        // Optional extra — silently skip.\n                    }\n                }\n            }\n\n            logger.info?.(\n                `[CapabilityLoader] '${cap}' installed (${spec.export}${spec.extras ? ' + ' + spec.extras.length + ' extras' : ''})`,\n                { environmentId },\n            );\n        } catch (err: any) {\n            const msg = err?.message ?? String(err);\n            if (msg.includes('Cannot find module') || msg.includes('ERR_MODULE_NOT_FOUND')) {\n                logger.warn?.(\n                    `[CapabilityLoader] '${cap}' requested but '${spec.pkg}' not installed in host — skipped`,\n                    { environmentId },\n                );\n            } else {\n                logger.error?.(\n                    `[CapabilityLoader] '${cap}' load failed: ${msg}`,\n                    { environmentId },\n                );\n            }\n        }\n    }\n\n    return installed;\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * AuthProxyPlugin\n *\n * Mounts a single `/api/v1/auth/*` wildcard route on the host's Hono server\n * that forwards every request to the per-project `AuthManager` registered\n * by `ArtifactKernelFactory`.\n *\n * Why a dedicated plugin: AuthPlugin (better-auth) registers its routes by\n * grabbing the host's `http-server` service from its own `PluginContext`.\n * In objectos runtime mode AuthPlugin lives on a per-project kernel — it\n * has no access to the host's HTTP server, so its `kernel:ready` route\n * registration is a no-op. The dispatcher plugin's wildcard registration\n * via `IHttpServer.post('/auth/*', …)` proved unreliable in practice,\n * so this plugin uses Hono's raw app directly (same path AuthPlugin took\n * historically) which is rock solid.\n *\n * Routing:\n *   1. Resolve the project from the request hostname via `env-registry`.\n *   2. Acquire the project's kernel via `kernel-manager`.\n *   3. Look up the `auth` service on that kernel — this is the better-auth\n *      handler injected by `ArtifactKernelFactory`.\n *   4. Build a Web `Request` using the project's canonical baseUrl and\n *      hand it to the better-auth handler.\n *   5. Stream the response back through Hono.\n */\n\nimport type { Plugin, PluginContext } from '@objectstack/core';\nimport type { KernelManager } from './kernel-manager.js';\nimport type { EnvironmentDriverRegistry } from './environment-registry.js';\n\nconst AUTH_PREFIX = '/api/v1/auth';\n\n// AuthCapableManager interface removed — unused (pickHandler uses duck typing on `any`).\n\nfunction pickHandler(svc: any): ((req: Request) => Promise<Response>) | undefined {\n    if (!svc) return undefined;\n    // AuthManager exposes handleRequest(req) — preferred entry point.\n    if (typeof svc.handleRequest === 'function') return svc.handleRequest.bind(svc);\n    if (typeof svc.handler === 'function') return svc.handler.bind(svc);\n    if (svc.api && typeof svc.api.handler === 'function') return svc.api.handler.bind(svc.api);\n    // AuthManager keeps the better-auth instance under `auth`.\n    if (svc.auth && typeof svc.auth.handler === 'function') return svc.auth.handler.bind(svc.auth);\n    return undefined;\n}\n\nasync function resolveAuthHandler(svc: any): Promise<((req: Request) => Promise<Response>) | undefined> {\n    const direct = pickHandler(svc);\n    if (direct) return direct;\n    if (typeof svc?.getApi === 'function') {\n        try {\n            const api = await svc.getApi();\n            return pickHandler(api) ?? pickHandler({ api });\n        } catch {\n            return undefined;\n        }\n    }\n    return undefined;\n}\n\nexport class AuthProxyPlugin implements Plugin {\n    readonly name = 'com.objectstack.runtime.auth-proxy';\n    readonly version = '1.0.0';\n\n    init = async (_ctx: PluginContext): Promise<void> => {\n        // No services registered — pure HTTP wiring during start().\n    };\n\n    start = async (ctx: PluginContext): Promise<void> => {\n        // Mount routes on kernel:ready so HonoServerPlugin has finished\n        // registering the http-server service. Doing this in start() can\n        // race with HonoServerPlugin.init/start ordering.\n        ctx.hook('kernel:ready', async () => {\n            let httpServer: any;\n            try {\n                httpServer = ctx.getService('http-server');\n            } catch {\n                ctx.logger?.warn?.('[AuthProxyPlugin] http-server not available — auth routes not mounted');\n                return;\n            }\n            if (!httpServer || typeof httpServer.getRawApp !== 'function') {\n                ctx.logger?.warn?.('[AuthProxyPlugin] http-server missing getRawApp() — auth routes not mounted');\n                return;\n            }\n\n            const rawApp = httpServer.getRawApp();\n            const kernelManager = ctx.getService<KernelManager>('kernel-manager');\n            const envRegistry = ctx.getService<EnvironmentDriverRegistry>('env-registry');\n\n            const handler = async (c: any) => {\n                try {\n                    const url = new URL(c.req.url);\n                    const host = url.hostname;\n                    let environmentId: string | undefined;\n                    try {\n                        const env = await envRegistry.resolveByHostname(host);\n                        environmentId = env?.environmentId;\n                    } catch {\n                        // ignore\n                    }\n                    if (!environmentId) {\n                        return c.json({ error: 'project_not_found', host }, 404);\n                    }\n\n                    const projectKernel = await kernelManager.getOrCreate(environmentId);\n                    let authSvc: any;\n                    try {\n                        authSvc = await (projectKernel as any).getServiceAsync?.('auth');\n                    } catch { authSvc = undefined; }\n                    if (!authSvc) {\n                        try { authSvc = (projectKernel as any).getService?.('auth'); } catch { /* ignore */ }\n                    }\n\n                    // Custom non-better-auth endpoints. better-auth has no\n                    // /config or /bootstrap-status route, so without these\n                    // short-circuits the request would fall through to the\n                    // better-auth handler and 404. The Account SPA needs\n                    // /config to render the \"Continue with ObjectStack\"\n                    // platform SSO button via SocialSignInButtons.\n                    const subPath = url.pathname.startsWith(AUTH_PREFIX + '/')\n                        ? url.pathname.substring(AUTH_PREFIX.length + 1)\n                        : '';\n                    if (c.req.method === 'GET' && (subPath === 'config' || subPath === 'bootstrap-status')) {\n                        if (subPath === 'config') {\n                            try {\n                                const config = typeof authSvc?.getPublicConfig === 'function'\n                                    ? authSvc.getPublicConfig()\n                                    : null;\n                                if (config) {\n                                    return c.json({ success: true, data: config });\n                                }\n                                return c.json({ success: false, error: { code: 'auth_config_unavailable', message: 'AuthManager has no getPublicConfig()' } }, 503);\n                            } catch (e: any) {\n                                return c.json({ success: false, error: { code: 'auth_config_error', message: String(e?.message ?? e) } }, 500);\n                            }\n                        }\n                        // bootstrap-status\n                        try {\n                            // Report the real local owner state. Earlier the\n                            // proxy short-circuited to `hasOwner: true` as\n                            // soon as the `objectstack-cloud` SSO provider\n                            // was wired — the idea being \"identity lives in\n                            // cloud, JIT-create on first SSO callback\". That\n                            // forced every project to depend on cloud being\n                            // reachable for first-time setup AND made the\n                            // local /setup wizard unreachable. With SSO now\n                            // demoted to an *optional* federation button,\n                            // bootstrap status MUST reflect the project's\n                            // own `sys_user` table so /setup can run when\n                            // there is genuinely no local owner yet.\n                            const dataEngine = typeof authSvc?.getDataEngine === 'function'\n                                ? authSvc.getDataEngine()\n                                : null;\n                            if (!dataEngine || typeof dataEngine.count !== 'function') {\n                                return c.json({ hasOwner: true });\n                            }\n                            const count = await dataEngine.count('sys_user', {});\n                            return c.json({ hasOwner: (count ?? 0) > 0 });\n                        } catch {\n                            return c.json({ hasOwner: true });\n                        }\n                    }\n\n                    const fn = await resolveAuthHandler(authSvc);\n                    if (!fn) {\n                        return c.json({ error: 'auth_service_unavailable', environmentId }, 503);\n                    }\n\n                    // Forward the original Web Request directly — better-auth\n                    // accepts a standard `Request` and returns a `Response`.\n                    const resp = await fn(c.req.raw);\n\n                    // ── Cookie-leak cleanup ─────────────────────────────────\n                    // Cloud previously set OS_COOKIE_DOMAIN=.objectos.app,\n                    // which made cloud's better-auth session cookies leak\n                    // into every *.objectos.app project subdomain and\n                    // collide with each project's own session_token.\n                    // The setting has been removed from cloud, but existing\n                    // browsers still carry the wide-scoped cookies. Append\n                    // delete instructions (Max-Age=0 + matching Domain) on\n                    // every per-project auth response so the leaked cookies\n                    // get drained on the next auth round-trip. Safe to keep\n                    // long-term: it only deletes cookies on a parent domain\n                    // that project containers never legitimately set.\n                    const rootDomain = process.env.OS_ROOT_DOMAIN || '';\n                    if (rootDomain) {\n                        const leakyDomain = rootDomain.startsWith('.') ? rootDomain : `.${rootDomain}`;\n                        const leakyNames = [\n                            '__Secure-better-auth.session_token',\n                            'better-auth.session_token',\n                            '__Secure-better-auth.state',\n                            'better-auth.state',\n                            '__Secure-better-auth.csrf_token',\n                            'better-auth.csrf_token',\n                        ];\n                        try {\n                            for (const n of leakyNames) {\n                                const isSecure = n.startsWith('__Secure-');\n                                const attrs = `Max-Age=0; Path=/; Domain=${leakyDomain}; SameSite=Lax${isSecure ? '; Secure' : ''}`;\n                                (resp as any).headers?.append?.('Set-Cookie', `${n}=; ${attrs}`);\n                            }\n                        } catch { /* best-effort cleanup */ }\n                    }\n\n                    return resp;\n                } catch (err: any) {\n                    (ctx.logger?.error as any)?.('[AuthProxyPlugin] auth dispatch failed', {\n                        error: err?.message,\n                        stack: err?.stack,\n                    });\n                    return c.json({\n                        error: 'auth_dispatch_failed',\n                        message: err?.message ?? String(err),\n                    }, 500);\n                }\n            };\n\n            // Mount on every method via Hono's `all`. AuthPlugin previously\n            // registered with `rawApp.all('/api/v1/auth/*', handler)` — same\n            // shape here.\n            if (typeof rawApp.all === 'function') {\n                rawApp.all(`${AUTH_PREFIX}/*`, handler);\n            } else {\n                for (const m of ['get', 'post', 'put', 'delete', 'patch', 'options'] as const) {\n                    try { rawApp[m]?.(`${AUTH_PREFIX}/*`, handler); } catch { /* best effort */ }\n                }\n            }\n            ctx.logger?.info?.(`[AuthProxyPlugin] auth proxy mounted at ${AUTH_PREFIX}/*`);\n        });\n    };\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Shared marketplace / cloud control-plane defaults.\n *\n * Centralised so every plugin + the CLI auto-inject path agree on\n * \"what cloud URL do we mean when the user didn't set OS_CLOUD_URL?\".\n * Until we have a competing public hosted cloud, this points at the\n * ObjectStack-operated control plane so a vanilla `objectstack dev` can\n * browse the marketplace out of the box.\n */\nexport const DEFAULT_CLOUD_URL = 'https://cloud.objectos.app';\n\n/**\n * Resolve the effective control-plane URL from an explicit constructor\n * value, the OS_CLOUD_URL env var, or the default. Returns an empty\n * string when the caller explicitly disabled cloud with\n * `OS_CLOUD_URL=off` / `local` — callers should treat that as\n * \"marketplace unavailable on this runtime\".\n */\nexport function resolveCloudUrl(explicit?: string | null): string {\n    const raw = (explicit ?? process.env.OS_CLOUD_URL ?? '').trim();\n    const lower = raw.toLowerCase();\n    if (lower === 'off' || lower === 'none' || lower === 'local' || lower === 'disabled') {\n        return '';\n    }\n    const picked = raw || DEFAULT_CLOUD_URL;\n    return picked.replace(/\\/+$/, '');\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * MarketplaceProxyPlugin\n *\n * Forwards `GET /api/v1/marketplace/*` from a tenant ObjectOS runtime to\n * the configured ObjectStack Cloud control-plane URL. The cloud endpoint\n * (`packages/service-cloud/src/routes/marketplace.ts`) is unauthenticated\n * and only exposes packages whose owner has opted in to the public catalog\n * (`sys_package.marketplace_listed = true`) — so the proxy passes through\n * without any credentials.\n *\n * Why proxy instead of direct browser → cloud:\n *   - The Console SPA stays on the tenant origin, so no CORS configuration\n *     is required on the cloud side.\n *   - Local-dev `os serve` works regardless of whether the developer's\n *     browser has cookies for cloud.objectos.app.\n *   - Adds a single, easily auditable network seam between tenant and\n *     control plane.\n *\n * Install is NOT proxied here. Installing a package mutates control-plane\n * state and requires a cloud session + active organization context — the\n * Console SPA performs install by opening the cloud's install dialog in a\n * new tab so the user authenticates against cloud directly. A future\n * iteration may introduce a delegated install token; until then, browse\n * here and install on cloud.\n */\n\nimport type { Plugin, PluginContext } from '@objectstack/core';\nimport { resolveCloudUrl } from './cloud-url.js';\n\nconst MARKETPLACE_PREFIX = '/api/v1/marketplace';\n\nexport interface MarketplaceProxyPluginConfig {\n    /**\n     * Control-plane base URL (e.g. https://cloud.objectos.app). When the\n     * caller passes nothing AND the runtime has no OS_CLOUD_URL set, the\n     * plugin falls back to the public ObjectStack-operated cloud so that\n     * `objectstack dev` can browse the marketplace out of the box. Set\n     * OS_CLOUD_URL=off (or `local`) to opt out — the plugin then mounts\n     * a stub that responds 503 and the SPA renders an empty-state\n     * explaining marketplace is unavailable in this runtime.\n     */\n    controlPlaneUrl?: string;\n}\n\nexport class MarketplaceProxyPlugin implements Plugin {\n    readonly name = 'com.objectstack.runtime.marketplace-proxy';\n    readonly version = '1.0.0';\n\n    private readonly cloudUrl: string;\n\n    constructor(config: MarketplaceProxyPluginConfig = {}) {\n        this.cloudUrl = resolveCloudUrl(config.controlPlaneUrl);\n    }\n\n    init = async (_ctx: PluginContext): Promise<void> => {\n        // No services registered — pure HTTP wiring during start().\n    };\n\n    start = async (ctx: PluginContext): Promise<void> => {\n        ctx.hook('kernel:ready', async () => {\n            let httpServer: any;\n            try {\n                httpServer = ctx.getService('http-server');\n            } catch {\n                ctx.logger?.warn?.('[MarketplaceProxyPlugin] http-server not available — marketplace routes not mounted');\n                return;\n            }\n            if (!httpServer || typeof httpServer.getRawApp !== 'function') {\n                ctx.logger?.warn?.('[MarketplaceProxyPlugin] http-server missing getRawApp() — marketplace routes not mounted');\n                return;\n            }\n\n            const rawApp = httpServer.getRawApp();\n            const cloudUrl = this.cloudUrl;\n\n            const handler = async (c: any, next: any) => {\n                if (!cloudUrl) {\n                    return c.json({\n                        success: false,\n                        error: {\n                            code: 'marketplace_unavailable',\n                            message: 'No control-plane URL configured for this runtime (OS_CLOUD_URL).',\n                        },\n                    }, 503);\n                }\n                try {\n                    const incomingUrl = new URL(c.req.url);\n                    // Do NOT proxy install-local — those are owned by\n                    // MarketplaceInstallLocalPlugin and must hit this\n                    // runtime, never cloud. Pass through so Hono can match\n                    // the install-local route registered on the same app.\n                    if (incomingUrl.pathname.startsWith(`${MARKETPLACE_PREFIX}/install-local`)) {\n                        return next();\n                    }\n                    // Preserve the full /api/v1/marketplace/... path on cloud.\n                    const target = `${cloudUrl}${incomingUrl.pathname}${incomingUrl.search}`;\n\n                    // Forward only safe, idempotent methods. We intentionally\n                    // do NOT proxy POST / PUT / DELETE here — those would\n                    // need credentialled cloud auth which the tenant runtime\n                    // does not carry.\n                    const method = String(c.req.method ?? 'GET').toUpperCase();\n                    if (method !== 'GET' && method !== 'HEAD') {\n                        return c.json({\n                            success: false,\n                            error: {\n                                code: 'marketplace_method_not_allowed',\n                                message: `Marketplace proxy only forwards GET/HEAD; install via cloud.`,\n                            },\n                        }, 405);\n                    }\n\n                    const resp = await fetch(target, {\n                        method,\n                        headers: {\n                            // Strip the inbound Host header — fetch will set\n                            // it to the cloud host. Forward only the\n                            // identifying headers cloud might log.\n                            'Accept': c.req.header('accept') ?? 'application/json',\n                            'User-Agent': `objectos-marketplace-proxy/${MarketplaceProxyPlugin.prototype.version ?? '1.0.0'}`,\n                        },\n                    });\n\n                    const headers = new Headers();\n                    const passthroughHeaders = ['content-type', 'cache-control', 'etag', 'last-modified'];\n                    for (const h of passthroughHeaders) {\n                        const v = resp.headers.get(h);\n                        if (v) headers.set(h, v);\n                    }\n\n                    const body = await resp.arrayBuffer();\n                    return new Response(body, { status: resp.status, headers });\n                } catch (err: any) {\n                    const errObj = err instanceof Error ? err : new Error(err?.message ?? String(err));\n                    ctx.logger?.error?.('[MarketplaceProxyPlugin] proxy failed', errObj);\n                    return c.json({\n                        success: false,\n                        error: {\n                            code: 'marketplace_proxy_failed',\n                            message: err?.message ?? String(err),\n                        },\n                    }, 502);\n                }\n            };\n\n            if (typeof rawApp.all === 'function') {\n                rawApp.all(`${MARKETPLACE_PREFIX}/*`, handler);\n            } else {\n                for (const m of ['get', 'head'] as const) {\n                    try { rawApp[m]?.(`${MARKETPLACE_PREFIX}/*`, handler); } catch { /* best effort */ }\n                }\n            }\n\n            ctx.logger?.info?.(`[MarketplaceProxyPlugin] mounted at ${MARKETPLACE_PREFIX}/* → ${cloudUrl || '(unconfigured)'}`);\n        });\n    };\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * File-backed ArtifactApiClient.\n *\n * A drop-in replacement for {@link ArtifactApiClient} that reads a\n * single project's compiled artifact from a local JSON file instead of\n * an HTTP control plane. Intended for:\n *\n *   - `pnpm dev` workflows where standing up a full `apps/cloud`\n *     instance to host one artifact is overkill.\n *   - Smoke tests / CI that need a hermetic objectos boot.\n *   - Single-tenant self-hosted deployments that ship one artifact\n *     baked into the container image.\n *\n * Hostname resolution is the identity function: every host resolves\n * to the same `environmentId`. The runtime config (database URL +\n * driver) is synthesised from the artifact's default datasource,\n * matching what the cloud API would mint for a project whose\n * developer declared an inline datasource in `defineStack()`.\n *\n * Public API mirrors {@link ArtifactApiClient} so callers can swap\n * implementations transparently.\n */\n\nimport { readFile, stat } from 'node:fs/promises';\nimport { resolve as resolvePath } from 'node:path';\nimport type {\n    EnvironmentArtifactResponse,\n    EnvironmentRuntimeConfig,\n    ResolvedHostname,\n} from './artifact-api-client.js';\n\nexport interface FileArtifactApiClientConfig {\n    /**\n     * Path to a compiled artifact JSON file (`dist/objectstack.json`).\n     * Resolved against `process.cwd()` when relative. Defaults to\n     * `<cwd>/dist/objectstack.json`.\n     */\n    artifactPath?: string;\n    /**\n     * Project id every hostname maps to. Defaults to\n     * `process.env.OS_ENVIRONMENT_ID` or `'proj_local'`.\n     */\n    environmentId?: string;\n    /**\n     * Organization id surfaced alongside the project. Defaults to\n     * `process.env.OS_ORGANIZATION_ID` or `'org_local'`.\n     */\n    organizationId?: string;\n    /**\n     * Override runtime config. When unset, the client tries to derive\n     * one from the artifact's `datasources` array; if that fails it\n     * falls back to a local-file SQLite DB at\n     * `<cwd>/.objectstack/data/<environmentId>.db`.\n     */\n    runtime?: EnvironmentRuntimeConfig;\n    /**\n     * Reload the artifact on every fetch instead of caching the first\n     * read. Useful when iterating on a project's metadata without\n     * restarting objectos. Defaults to `true` for dev ergonomics.\n     */\n    watch?: boolean;\n    /** Optional logger. */\n    logger?: { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };\n}\n\nexport class FileArtifactApiClient {\n    private readonly artifactPath: string;\n    private readonly environmentId: string;\n    private readonly organizationId: string;\n    private readonly overrideRuntime?: EnvironmentRuntimeConfig;\n    private readonly watch: boolean;\n    private readonly logger: NonNullable<FileArtifactApiClientConfig['logger']>;\n\n    private cached?: { mtimeMs: number; response: EnvironmentArtifactResponse };\n\n    constructor(config: FileArtifactApiClientConfig = {}) {\n        const cwd = process.cwd();\n        this.artifactPath = resolvePath(\n            cwd,\n            config.artifactPath\n                ?? process.env.OS_ARTIFACT_PATH\n                ?? 'dist/objectstack.json',\n        );\n        this.environmentId = config.environmentId\n            ?? process.env.OS_ENVIRONMENT_ID\n            ?? 'proj_local';\n        this.organizationId = config.organizationId\n            ?? process.env.OS_ORGANIZATION_ID\n            ?? 'org_local';\n        this.overrideRuntime = config.runtime;\n        this.watch = config.watch ?? true;\n        this.logger = config.logger ?? console;\n    }\n\n    async resolveHostname(_host: string): Promise<ResolvedHostname | null> {\n        // Single-project mode: every host maps to the one configured project.\n        const runtime = this.overrideRuntime ?? (await this.readRuntimeFromArtifact());\n        return {\n            environmentId: this.environmentId,\n            organizationId: this.organizationId,\n            ...(runtime ? { runtime } : {}),\n        };\n    }\n\n    async fetchArtifact(_environmentId: string, _opts?: { commit?: string }): Promise<EnvironmentArtifactResponse | null> {\n        return this.loadArtifact();\n    }\n\n    async lookupProjectByShortId(_shortId: string): Promise<{ environmentId: string; organizationId?: string } | null> {\n        return { environmentId: this.environmentId, organizationId: this.organizationId };\n    }\n\n    async fetchBranchHead(\n        _environmentId: string,\n        _branchName: string,\n    ): Promise<{ commitId: string; publishedAt?: string | null } | null> {\n        const artifact = await this.loadArtifact();\n        return artifact\n            ? { commitId: artifact.commitId ?? 'local', publishedAt: null }\n            : null;\n    }\n\n    invalidate(_environmentId: string): void {\n        this.cached = undefined;\n    }\n\n    clear(): void {\n        this.cached = undefined;\n    }\n\n    private async loadArtifact(): Promise<EnvironmentArtifactResponse | null> {\n        try {\n            const stats = await stat(this.artifactPath);\n            const mtimeMs = stats.mtimeMs;\n            if (!this.watch && this.cached) return this.cached.response;\n            if (this.cached && this.cached.mtimeMs === mtimeMs) return this.cached.response;\n\n            const raw = await readFile(this.artifactPath, 'utf8');\n            const parsed = JSON.parse(raw);\n            // The compiled JSON may already be a `EnvironmentArtifact` envelope\n            // (with a `metadata` block) or a bare bundle. Wrap when needed.\n            const isEnvelope = parsed && typeof parsed === 'object'\n                && typeof parsed.metadata === 'object'\n                && parsed.metadata !== null;\n            const metadata = isEnvelope ? parsed.metadata : parsed;\n            const runtime = this.overrideRuntime\n                ?? (isEnvelope ? parsed.runtime : undefined)\n                ?? this.deriveRuntimeFromMetadata(metadata)\n                ?? this.defaultLocalSqliteRuntime();\n            const response: EnvironmentArtifactResponse = {\n                schemaVersion: parsed.schemaVersion ?? '1',\n                environmentId: parsed.environmentId ?? this.environmentId,\n                commitId: parsed.commitId ?? 'local',\n                checksum: parsed.checksum ?? '',\n                publishedAt: parsed.publishedAt ?? new Date().toISOString(),\n                metadata,\n                functions: parsed.functions,\n                manifest: parsed.manifest,\n                runtime: {\n                    organizationId: this.organizationId,\n                    ...runtime,\n                },\n            } as EnvironmentArtifactResponse;\n            this.cached = { mtimeMs, response };\n            return response;\n        } catch (err: any) {\n            this.logger.error?.('[FileArtifactApiClient] failed to load artifact', {\n                artifactPath: this.artifactPath,\n                error: err?.message ?? err,\n            });\n            return null;\n        }\n    }\n\n    private async readRuntimeFromArtifact(): Promise<EnvironmentRuntimeConfig | undefined> {\n        const artifact = await this.loadArtifact();\n        return artifact?.runtime;\n    }\n\n    private deriveRuntimeFromMetadata(metadata: any): EnvironmentRuntimeConfig | undefined {\n        const datasources = metadata?.datasources;\n        if (!Array.isArray(datasources) || datasources.length === 0) return undefined;\n        const mapping: any[] | undefined = metadata?.datasourceMapping;\n        let preferredName: string | undefined;\n        if (mapping) {\n            const def = mapping.find((m: any) => m?.default === true);\n            if (def?.datasource) preferredName = def.datasource;\n        }\n        const ds = preferredName\n            ? datasources.find((d: any) => d?.name === preferredName) ?? datasources[0]\n            : datasources[0];\n        if (!ds || typeof ds !== 'object') return undefined;\n        const config = (ds.config ?? {}) as Record<string, any>;\n        const url = config.url ?? config.connectionString ?? config.connection ?? config.filename;\n        const driver = ds.driver;\n        if (typeof driver !== 'string' || typeof url !== 'string') return undefined;\n        return {\n            databaseDriver: driver,\n            databaseUrl: url,\n            databaseAuthToken: typeof config.authToken === 'string' ? config.authToken : undefined,\n        };\n    }\n\n    private defaultLocalSqliteRuntime(): EnvironmentRuntimeConfig {\n        const cwd = process.cwd();\n        const dbPath = resolvePath(cwd, '.objectstack/data', `${this.environmentId}.db`);\n        return {\n            databaseDriver: 'sqlite',\n            databaseUrl: `file:${dbPath}`,\n        };\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * createObjectOSStack\n *\n * ObjectOS pure-runtime stack — no control-plane database, no auth /\n * security / audit / tenant plugins. The host kernel registers:\n *\n *   - A minimal engine triplet (ObjectQL + in-memory DriverPlugin +\n *     MetadataPlugin) so CLI auto-injected plugins (Setup, Studio,\n *     Dispatcher, REST) and the runtime can boot. The host kernel itself\n *     never reads or writes business data — every record query is routed\n *     to a per-project kernel built from a remote artifact.\n *   - The `env-registry` and `kernel-manager` services, so the runtime's\n *     HTTP dispatcher can resolve hostnames and dispatch every request\n *     to the matching project kernel.\n *\n * Invoked by `createRuntimeStack()` whenever `OS_CLOUD_URL`\n * (or `config.controlPlaneUrl`) is set. The same plugin shape is returned\n * as `createCloudStack()` so host configs can swap stacks transparently.\n */\n\nimport { Plugin, PluginContext } from '@objectstack/core';\nimport type { EnvironmentDriverRegistry } from './environment-registry.js';\nimport { KernelManager } from './kernel-manager.js';\nimport { ArtifactApiClient } from './artifact-api-client.js';\nimport { ArtifactEnvironmentRegistry } from './artifact-environment-registry.js';\nimport { ArtifactKernelFactory } from './artifact-kernel-factory.js';\nimport { AuthProxyPlugin } from './auth-proxy-plugin.js';\nimport { MarketplaceProxyPlugin } from './marketplace-proxy-plugin.js';\nimport { FileArtifactApiClient, type FileArtifactApiClientConfig } from './file-artifact-api-client.js';\n\nexport interface ObjectOSStackConfig {\n    /**\n     * Control-plane base URL (HTTP) or a sentinel of `'file'` for the\n     * local file-backed dev mode. Required unless `client` is supplied.\n     *\n     * - `http(s)://…`  — talk to a real ObjectStack Cloud control plane\n     *   over HTTP and resolve hostnames via its `/cloud/*` API.\n     * - `'file'`       — load a single project from a local\n     *   `dist/objectstack.json` (or `fileConfig.artifactPath`). Every\n     *   request, regardless of hostname, resolves to the same project.\n     *   Intended for `pnpm dev` / smoke tests where standing up a\n     *   separate control plane is overkill.\n     */\n    controlPlaneUrl?: string;\n    /** Optional bearer token for the control-plane API. */\n    controlPlaneApiKey?: string;\n    /**\n     * Override the artifact client entirely. When supplied,\n     * `controlPlaneUrl` is ignored — useful for tests or custom transports.\n     */\n    client?: ArtifactApiClient | FileArtifactApiClient;\n    /** Config for the file-backed mode (used when `controlPlaneUrl === 'file'`). */\n    fileConfig?: FileArtifactApiClientConfig;\n    /** KernelManager LRU size. Default: 32. */\n    kernelCacheSize?: number;\n    /** KernelManager idle TTL (ms). Default: 15 min. */\n    kernelTtlMs?: number;\n    /** EnvironmentDriverRegistry cache TTL (ms). Default: 5 min. */\n    envCacheTtlMs?: number;\n    /** Artifact / hostname response cache TTL (ms). Default: 5 min. */\n    artifactCacheTtlMs?: number;\n    /** API prefix (carried for parity with cloud-stack). Default: /api/v1. */\n    apiPrefix?: string;\n}\n\nexport interface ObjectOSStackResult {\n    plugins: any[];\n    api: { enableProjectScoping: true; projectResolution: 'auto'; requireAuth: true };\n}\n\n/**\n * Lazy-loaded host engine plugins. Mirrors the head of\n * `createControlPlanePlugins()` — ObjectQL + InMemory Driver + Metadata.\n *\n * The host kernel in objectos is a pure routing shell. Per-tenant auth +\n * business data live in per-project kernels (each backed by the project's\n * own Turso/Postgres DB), so there is nothing to persist on the host.\n *\n * AuthPlugin is intentionally NOT injected on the host (CLI's\n * `serve.ts` auto-injection guard skips it when `OS_CLOUD_URL` is set).\n * Identity is owned by `ArtifactKernelFactory` per project so that:\n *   - users persist in the project's DB across container cold-starts\n *   - cookies are scoped to the project's hostname (no `.<root>`-wide leak)\n *   - tokens are signed with a per-project HKDF-derived secret\n */\nasync function createHostEnginePlugins(): Promise<Plugin[]> {\n    const { ObjectQLPlugin } = await import('@objectstack/objectql');\n    const { DriverPlugin } = await import('../driver-plugin.js');\n    const { MetadataPlugin } = await import('@objectstack/metadata');\n    const { InMemoryDriver } = await import('@objectstack/driver-memory');\n\n    const driver = new InMemoryDriver();\n    const driverName = 'memory';\n\n    const oqlRef: { ql: any } = { ql: null };\n    const objectql: Plugin = {\n        name: 'com.objectstack.engine.objectql',\n        version: '0.0.0',\n        async init(ctx: PluginContext) {\n            const plugin = new ObjectQLPlugin();\n            (this as any)._inner = plugin;\n            if ((plugin as any).init) await (plugin as any).init(ctx);\n            // Capture the engine instance AFTER init() — ObjectQLPlugin\n            // creates its `ql` lazily inside init(), so reading `plugin.ql`\n            // before that returns undefined and breaks the\n            // datasource-mapping wiring below.\n            oqlRef.ql = (plugin as any).ql ?? plugin;\n        },\n        async start(ctx: PluginContext) {\n            const plugin = (this as any)._inner;\n            // Forward start() so ObjectQLPlugin can discover `driver.*`\n            // services (registered by DriverPlugin.init) and wire them\n            // into the engine via `ql.registerDriver(...)`. Without this\n            // the engine has zero drivers at request time, causing\n            // `[ObjectQL] No driver available for object '...'` errors.\n            if (plugin?.start) await plugin.start(ctx);\n        },\n        async destroy() {\n            const plugin = (this as any)._inner;\n            if (plugin?.destroy) await plugin.destroy();\n            else if (plugin?.stop) await plugin.stop();\n        },\n    };\n\n    const datasourceMapping: Plugin = {\n        name: 'objectos-host-datasource-mapping',\n        version: '0.0.0',\n        dependencies: ['com.objectstack.engine.objectql'],\n        async init() {\n            const ql = oqlRef.ql;\n            if (ql?.setDatasourceMapping) {\n                ql.setDatasourceMapping([\n                    { default: true, datasource: `com.objectstack.driver.${driverName}` },\n                ]);\n            }\n        },\n    };\n\n    const driverPlugin = new DriverPlugin(driver as any, driverName);\n\n    const metadata = new MetadataPlugin({\n        watch: false,\n        // The host kernel is a routing shell. It doesn't own metadata —\n        // every per-project kernel registers its own.\n        registerSystemObjects: false,\n    });\n\n    return [objectql, datasourceMapping, driverPlugin as unknown as Plugin, metadata as unknown as Plugin];\n}\n\n/**\n * Single host plugin that owns the artifact API client, the env registry,\n * and the kernel manager. Registered as services on the host kernel so\n * downstream plugins (the dispatcher, the REST API plugin) pick them up\n * automatically.\n */\nclass ObjectOSEnvironmentPlugin implements Plugin {\n    readonly name = 'com.objectstack.runtime.objectos-environment';\n    readonly version = '1.0.0';\n\n    private readonly config: ObjectOSStackConfig;\n    private kernelManager?: KernelManager;\n    private client?: ArtifactApiClient;\n\n    constructor(config: ObjectOSStackConfig) {\n        this.config = config;\n    }\n\n    init = async (ctx: PluginContext): Promise<void> => {\n        const client: ArtifactApiClient | FileArtifactApiClient = this.config.client\n            ?? (this.config.controlPlaneUrl === 'file'\n                ? new FileArtifactApiClient({\n                    ...(this.config.fileConfig ?? {}),\n                    logger: ctx.logger as any,\n                })\n                : new ArtifactApiClient({\n                    controlPlaneUrl: this.config.controlPlaneUrl!,\n                    apiKey: this.config.controlPlaneApiKey,\n                    cacheTtlMs: this.config.artifactCacheTtlMs,\n                    logger: ctx.logger,\n                }));\n        this.client = client as ArtifactApiClient;\n\n        const envRegistry: EnvironmentDriverRegistry = new ArtifactEnvironmentRegistry({\n            client: client as ArtifactApiClient,\n            cacheTtlMs: this.config.envCacheTtlMs,\n            logger: ctx.logger,\n        });\n\n        const factory = new ArtifactKernelFactory({\n            client: client as ArtifactApiClient,\n            envRegistry,\n            logger: ctx.logger,\n        });\n\n        const kernelManager = new KernelManager({\n            factory,\n            maxSize: this.config.kernelCacheSize,\n            ttlMs: this.config.kernelTtlMs,\n            logger: ctx.logger,\n        });\n        this.kernelManager = kernelManager;\n\n        ctx.registerService('env-registry', envRegistry);\n        ctx.registerService('kernel-manager', kernelManager);\n        ctx.registerService('artifact-api-client', client);\n\n        ctx.logger.info?.('ObjectOSEnvironmentPlugin: registered env-registry + kernel-manager', {\n            mode: this.config.controlPlaneUrl === 'file' ? 'file' : 'http',\n            controlPlaneUrl: this.config.controlPlaneUrl,\n        });\n    };\n\n    destroy = async (): Promise<void> => {\n        try { await this.kernelManager?.evictAll(); } catch { /* best effort */ }\n        try { this.client?.clear(); } catch { /* best effort */ }\n    };\n}\n\nexport async function createObjectOSStack(config: ObjectOSStackConfig): Promise<ObjectOSStackResult> {\n    if (!config.controlPlaneUrl && !config.client) {\n        throw new Error('[createObjectOSStack] either controlPlaneUrl or client is required');\n    }\n    const merged: ObjectOSStackConfig = {\n        ...config,\n        kernelCacheSize: Number(process.env.OS_KERNEL_CACHE_SIZE ?? config.kernelCacheSize ?? 32),\n        kernelTtlMs: Number(process.env.OS_KERNEL_TTL_MS ?? config.kernelTtlMs ?? 15 * 60 * 1000),\n        envCacheTtlMs: Number(process.env.OS_ENV_CACHE_TTL_MS ?? config.envCacheTtlMs ?? 5 * 60 * 1000),\n        artifactCacheTtlMs: Number(process.env.OS_ARTIFACT_CACHE_TTL_MS ?? config.artifactCacheTtlMs ?? 5 * 60 * 1000),\n    };\n\n    const enginePlugins = await createHostEnginePlugins();\n\n    return {\n        plugins: [...enginePlugins, new ObjectOSEnvironmentPlugin(merged), new AuthProxyPlugin(), new MarketplaceProxyPlugin({ controlPlaneUrl: merged.controlPlaneUrl === 'file' ? undefined : merged.controlPlaneUrl })],\n        api: {\n            enableProjectScoping: true,\n            projectResolution: 'auto',\n            // ObjectOS is multi-tenant: anonymous /api/v1/data/* must never\n            // leak per-project data across organisations. AuthProxyPlugin\n            // verifies upstream tokens and populates ctx.userId; requireAuth\n            // turns missing userId into 401 at the REST layer before the\n            // request reaches the per-project kernel.\n            requireAuth: true,\n        },\n    };\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * MarketplaceInstallLocalPlugin\n *\n * Installs marketplace packages into THIS runtime's kernel as opposed to a\n * remote cloud environment. Conceptually different from cloud install in\n * three important ways:\n *\n *   1. Single target — the local kernel is the only install target; there\n *      is no `sys_environment` picker.\n *   2. Manifests are cached on disk — once installed, the package is\n *      runnable offline. Cloud is only needed during the install action\n *      itself (to fetch the manifest snapshot).\n *   3. Coexists with user-authored apps — the local runtime usually has\n *      its own `objectstack.config.ts` declared apps. Install refuses to\n *      overwrite a manifest_id that's already registered to avoid silently\n *      replacing user code.\n *\n * Endpoints (mounted by `start()` on the `kernel:ready` hook):\n *\n *   POST   /api/v1/marketplace/install-local\n *          body: { packageId: string, versionId?: string }   (default: \"latest\")\n *          → fetches manifest from cloud, caches to disk, registers via\n *            the kernel's `manifest` service. Returns the installed entry.\n *\n *   GET    /api/v1/marketplace/install-local\n *          → lists currently installed marketplace packages\n *\n *   DELETE /api/v1/marketplace/install-local/:manifestId\n *          → removes the cached manifest. Kernel must be restarted to fully\n *            unload — `engine.registerApp` is additive only. We document\n *            this in the response message.\n *\n * Persistence layout:\n *   <cwd>/.objectstack/installed-packages/<safe-manifest-id>.json\n *   Each file: { packageId, versionId, manifestId, version, manifest, installedAt, installedBy }\n *\n * On `kernel:ready`, the plugin scans the directory and re-registers each\n * cached manifest so installs survive process restarts without further\n * cloud round-trips.\n */\n\nimport { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport type { Plugin, PluginContext } from '@objectstack/core';\nimport { resolveCloudUrl } from './cloud-url.js';\n\nconst ROUTE_BASE = '/api/v1/marketplace/install-local';\nconst DEFAULT_DIR = '.objectstack/installed-packages';\n\nexport interface MarketplaceInstallLocalPluginConfig {\n    /** Cloud control-plane base URL. When unset, falls back to OS_CLOUD_URL\n     *  and then to the public ObjectStack cloud so a fresh `objectstack dev`\n     *  can install from the marketplace without configuration. Set\n     *  OS_CLOUD_URL=off to disable (the install endpoint then returns 503). */\n    controlPlaneUrl?: string;\n    /** Override the on-disk cache directory. Defaults to\n     *  `<cwd>/.objectstack/installed-packages`. */\n    storageDir?: string;\n}\n\ninterface InstalledEntry {\n    packageId: string;\n    versionId: string;\n    manifestId: string;\n    version: string;\n    manifest: any;\n    installedAt: string;\n    installedBy: string | null;\n}\n\nfunction safeFilename(manifestId: string): string {\n    return manifestId.replace(/[^a-zA-Z0-9._-]/g, '_') + '.json';\n}\n\nexport class MarketplaceInstallLocalPlugin implements Plugin {\n    readonly name = 'com.objectstack.runtime.marketplace-install-local';\n    readonly version = '1.0.0';\n\n    private readonly cloudUrl: string;\n    private readonly storageDir: string;\n\n    constructor(config: MarketplaceInstallLocalPluginConfig = {}) {\n        this.cloudUrl = resolveCloudUrl(config.controlPlaneUrl);\n        this.storageDir = config.storageDir\n            ? resolve(config.storageDir)\n            : resolve(process.cwd(), DEFAULT_DIR);\n    }\n\n    init = async (_ctx: PluginContext): Promise<void> => {\n        // No services registered — pure HTTP wiring during start().\n    };\n\n    start = async (ctx: PluginContext): Promise<void> => {\n        ctx.hook('kernel:ready', async () => {\n            // 1. Rehydrate previously installed packages so they survive restart.\n            await this.rehydrate(ctx);\n\n            // 2. Mount HTTP endpoints.\n            let httpServer: any;\n            try {\n                httpServer = ctx.getService('http-server');\n            } catch {\n                ctx.logger?.warn?.('[MarketplaceInstallLocal] http-server not available — install endpoints not mounted');\n                return;\n            }\n            if (!httpServer || typeof httpServer.getRawApp !== 'function') {\n                ctx.logger?.warn?.('[MarketplaceInstallLocal] http-server missing getRawApp() — install endpoints not mounted');\n                return;\n            }\n            const rawApp = httpServer.getRawApp();\n\n            const postHandler = async (c: any) => this.handleInstall(c, ctx);\n            const getHandler = async (c: any) => this.handleList(c);\n            const deleteHandler = async (c: any) => this.handleUninstall(c, ctx);\n\n            if (typeof rawApp.post === 'function') rawApp.post(ROUTE_BASE, postHandler);\n            if (typeof rawApp.get === 'function') rawApp.get(ROUTE_BASE, getHandler);\n            if (typeof rawApp.delete === 'function') rawApp.delete(`${ROUTE_BASE}/:manifestId`, deleteHandler);\n\n            ctx.logger?.info?.(`[MarketplaceInstallLocal] mounted at ${ROUTE_BASE} (storage: ${this.storageDir})`);\n        });\n    };\n\n    /**\n     * Re-register every cached manifest with the kernel's manifest service.\n     * Safe to call on a kernel that already has the same manifest_id (the\n     * underlying ObjectQL registry overwrites by id, but we still warn so\n     * a developer can spot the dev-time clash between their config.ts and\n     * a marketplace package).\n     */\n    private rehydrate = async (ctx: PluginContext): Promise<void> => {\n        const entries = this.readAll();\n        if (entries.length === 0) return;\n\n        let manifestService: { register(m: any): void } | null = null;\n        try {\n            manifestService = ctx.getService('manifest') as any;\n        } catch {\n            ctx.logger?.warn?.('[MarketplaceInstallLocal] no `manifest` service — rehydrate skipped');\n            return;\n        }\n\n        for (const entry of entries) {\n            try {\n                manifestService!.register(entry.manifest);\n                // Sync schemas so the driver creates tables for the newly-\n                // registered objects (idempotent — already-synced tables\n                // are no-ops).\n                try {\n                    const ql: any = ctx.getService('objectql');\n                    if (ql && typeof ql.syncSchemas === 'function') await ql.syncSchemas();\n                } catch { /* non-fatal */ }\n                // Replay translations + register seed datasets, but don't\n                // re-run seeding — existing rows are already in the DB from\n                // the original install, and multi-tenant orgs will replay\n                // via the security middleware on next sys_organization insert.\n                await this.applySideEffects(ctx, entry.manifest, { seedNow: false });\n                ctx.logger?.info?.(`[MarketplaceInstallLocal] rehydrated ${entry.manifestId}@${entry.version}`);\n            } catch (err: any) {\n                ctx.logger?.error?.(`[MarketplaceInstallLocal] rehydrate failed for ${entry.manifestId}`, err instanceof Error ? err : new Error(String(err)));\n            }\n        }\n    };\n\n    private handleInstall = async (c: any, ctx: PluginContext): Promise<Response> => {\n        if (!this.cloudUrl) {\n            return c.json({ success: false, error: { code: 'marketplace_unavailable', message: 'OS_CLOUD_URL not configured.' } }, 503);\n        }\n        const userId = await this.requireAuthenticatedUser(c, ctx);\n        if (!userId) {\n            return c.json({ success: false, error: { code: 'unauthorized', message: 'Authentication required to install packages.' } }, 401);\n        }\n\n        let body: any = {};\n        try { body = await c.req.json(); } catch { /* empty body */ }\n        const packageId = String(body?.packageId ?? '').trim();\n        const versionId = String(body?.versionId ?? 'latest').trim() || 'latest';\n        if (!packageId) {\n            return c.json({ success: false, error: { code: 'bad_request', message: 'packageId is required.' } }, 400);\n        }\n\n        // 1. Fetch manifest snapshot from cloud\n        let payload: any;\n        try {\n            const url = `${this.cloudUrl}/api/v1/marketplace/packages/${encodeURIComponent(packageId)}/versions/${encodeURIComponent(versionId)}/manifest`;\n            const resp = await fetch(url, { headers: { 'Accept': 'application/json' } });\n            if (!resp.ok) {\n                const text = await resp.text().catch(() => '');\n                return c.json({\n                    success: false,\n                    error: { code: 'cloud_fetch_failed', message: `Cloud returned ${resp.status}: ${text.slice(0, 200)}` },\n                }, resp.status === 404 ? 404 : 502);\n            }\n            payload = await resp.json();\n        } catch (err: any) {\n            return c.json({\n                success: false,\n                error: { code: 'cloud_fetch_failed', message: err?.message ?? String(err) },\n            }, 502);\n        }\n\n        const data = payload?.data ?? payload;\n        const manifest = data?.manifest;\n        const resolvedVersionId = String(data?.version_id ?? versionId);\n        const version = String(data?.version ?? 'unknown');\n        const manifestId = String(manifest?.id ?? manifest?.name ?? '');\n        if (!manifest || !manifestId) {\n            return c.json({ success: false, error: { code: 'invalid_manifest', message: 'Cloud returned an invalid manifest payload.' } }, 502);\n        }\n\n        // 2. Conflict check — refuse to overwrite user-authored apps\n        const conflict = this.findConflict(ctx, manifestId);\n        if (conflict === 'user-code') {\n            return c.json({\n                success: false,\n                error: {\n                    code: 'manifest_conflict',\n                    message: `manifest_id \"${manifestId}\" is already defined by this runtime's local code. Refusing to overwrite. Uninstall the local definition first.`,\n                },\n            }, 409);\n        }\n\n        // 3. Persist on disk\n        const entry: InstalledEntry = {\n            packageId,\n            versionId: resolvedVersionId,\n            manifestId,\n            version,\n            manifest,\n            installedAt: new Date().toISOString(),\n            installedBy: userId,\n        };\n        try {\n            mkdirSync(this.storageDir, { recursive: true });\n            writeFileSync(join(this.storageDir, safeFilename(manifestId)), JSON.stringify(entry, null, 2), 'utf8');\n        } catch (err: any) {\n            return c.json({\n                success: false,\n                error: { code: 'storage_failed', message: `Failed to persist manifest: ${err?.message ?? err}` },\n            }, 500);\n        }\n\n        // 4. Hot-register via manifest service (works post-bootstrap)\n        try {\n            const manifestService = ctx.getService('manifest') as any;\n            manifestService.register(manifest);\n        } catch (err: any) {\n            // Persisted on disk so a restart would still pick it up;\n            // surface the error but keep the install record.\n            ctx.logger?.warn?.(`[MarketplaceInstallLocal] hot-register failed for ${manifestId} (will load on next restart): ${err?.message ?? err}`);\n        }\n\n        // 4b. Sync schemas to physical tables — registerApp only adds the\n        //     object definitions to the in-memory registry; the driver\n        //     must be asked to materialize tables/columns before any seed\n        //     insert (or user write) succeeds.\n        try {\n            const ql: any = ctx.getService('objectql');\n            if (ql && typeof ql.syncSchemas === 'function') {\n                await ql.syncSchemas();\n                ctx.logger?.info?.(`[MarketplaceInstallLocal] syncSchemas() ran after registering ${manifestId}`);\n            }\n        } catch (err: any) {\n            ctx.logger?.warn?.(`[MarketplaceInstallLocal] syncSchemas failed for ${manifestId}: ${err?.message ?? err}`);\n        }\n\n        // 5. Replicate the AppPlugin start-time side-effects that the\n        //    `manifest` service does NOT do on its own:\n        //      • load translation bundles into the i18n service\n        //      • stash seed datasets on the kernel + run them now so the\n        //        installed app has demo data on first paint.\n        const seededSummary = await this.applySideEffects(ctx, manifest, { seedNow: true, c });\n\n        return c.json({\n            success: true,\n            data: {\n                manifestId,\n                version,\n                versionId: resolvedVersionId,\n                installedAt: entry.installedAt,\n                hotLoaded: true,\n                upgradedFrom: conflict === 'marketplace' ? 'previous-marketplace-version' : null,\n                translationsLoaded: seededSummary.translationsLoaded,\n                seeded: seededSummary.seeded,\n                note: 'App is now available in this runtime. Refresh the console to see it in the app switcher.',\n            },\n        }, 200);\n    };\n\n    private handleList = async (c: any): Promise<Response> => {\n        const entries = this.readAll();\n        return c.json({\n            success: true,\n            data: {\n                items: entries.map(e => ({\n                    packageId: e.packageId,\n                    versionId: e.versionId,\n                    manifestId: e.manifestId,\n                    version: e.version,\n                    installedAt: e.installedAt,\n                    installedBy: e.installedBy,\n                })),\n                total: entries.length,\n                storageDir: this.storageDir,\n            },\n        }, 200);\n    };\n\n    private handleUninstall = async (c: any, ctx: PluginContext): Promise<Response> => {\n        const userId = await this.requireAuthenticatedUser(c, ctx);\n        if (!userId) {\n            return c.json({ success: false, error: { code: 'unauthorized', message: 'Authentication required.' } }, 401);\n        }\n        const manifestId = String(c.req.param?.('manifestId') ?? c.req.params?.manifestId ?? '').trim();\n        if (!manifestId) {\n            return c.json({ success: false, error: { code: 'bad_request', message: 'manifestId path param required.' } }, 400);\n        }\n        const file = join(this.storageDir, safeFilename(manifestId));\n        if (!existsSync(file)) {\n            return c.json({ success: false, error: { code: 'not_found', message: `No marketplace install for ${manifestId}.` } }, 404);\n        }\n        try {\n            unlinkSync(file);\n        } catch (err: any) {\n            return c.json({ success: false, error: { code: 'storage_failed', message: err?.message ?? String(err) } }, 500);\n        }\n        ctx.logger?.info?.(`[MarketplaceInstallLocal] uninstalled ${manifestId} (cached manifest removed; restart runtime to unload from running kernel)`);\n        return c.json({\n            success: true,\n            data: {\n                manifestId,\n                note: 'Cached manifest removed. The app remains loaded in the running kernel until the next restart (the kernel API does not support unregistering apps in-place).',\n            },\n        }, 200);\n    };\n\n    /**\n     * Detect whether `manifestId` is already known to the kernel and classify\n     * the source so we can refuse vs upgrade gracefully.\n     *\n     *   'none'         — fresh install\n     *   'marketplace'  — previously installed by this plugin (allow upgrade)\n     *   'user-code'    — defined by AppPlugin from objectstack.config.ts\n     *                    (refuse to avoid silently overwriting authored code)\n     */\n    private findConflict = (ctx: PluginContext, manifestId: string): 'none' | 'marketplace' | 'user-code' => {\n        // First check: do we already have a marketplace install file?\n        if (existsSync(join(this.storageDir, safeFilename(manifestId)))) {\n            return 'marketplace';\n        }\n        // Then check: is the manifest_id already in the engine's registry?\n        try {\n            const ql: any = ctx.getService('objectql');\n            const packages: any[] = ql?.registry?.getAllPackages?.() ?? [];\n            const hit = packages.find((p: any) =>\n                (p?.manifest?.id ?? p?.id ?? p?.manifest?.name) === manifestId,\n            );\n            if (hit) return 'user-code';\n        } catch { /* objectql not registered yet — treat as fresh */ }\n        return 'none';\n    };\n\n    /**\n     * Pull a userId out of the request's better-auth session, if any.\n     * Returns null when there is no signed-in user. v1 does not check\n     * admin role — UI gating + the auth requirement is sufficient for\n     * dev / single-tenant runtimes. Stricter checks can be layered on\n     * via a middleware in cloud-hosted multi-tenant deployments.\n     */\n    /**\n     * Replicate the start-time side-effects that AppPlugin runs for\n     * statically-declared apps but the `manifest` service does NOT:\n     *\n     *   1. Load `manifest.translations` (array of `Record<locale, data>`)\n     *      into the i18n service — auto-creating an in-memory fallback if\n     *      none is registered, matching AppPlugin's behaviour.\n     *\n     *   2. Merge `manifest.data` (an array of seed datasets) into the\n     *      kernel's `seed-datasets` service so SecurityPlugin's per-org\n     *      replay middleware picks them up on every future\n     *      sys_organization insert.\n     *\n     *   3. When `seedNow=true`, also run the seed immediately so the user\n     *      sees demo data without having to create a new org:\n     *        • single-tenant: run SeedLoaderService inline (mirrors\n     *          AppPlugin single-tenant branch)\n     *        • multi-tenant: invoke `seed-replayer` for the caller's\n     *          active org (resolved from the request session)\n     *\n     * Errors are logged but never thrown — install succeeds even if\n     * post-register side-effects partially fail (the manifest itself is\n     * already registered + cached). Returns a small summary for the\n     * response envelope.\n     */\n    private applySideEffects = async (\n        ctx: PluginContext,\n        manifest: any,\n        opts: { seedNow: boolean; c?: any },\n    ): Promise<{ translationsLoaded: number; seeded: { mode: 'inline' | 'replayer' | 'skipped'; inserted?: number; updated?: number; errors?: number; reason?: string } }> => {\n        const appId = String(manifest?.id ?? 'unknown');\n        let translationsLoaded = 0;\n        let seedSummary: any = { mode: 'skipped', reason: 'no-datasets' };\n\n        // ── 1. i18n bundles ─────────────────────────────────────────────\n        try {\n            const bundles: Array<Record<string, unknown>> = [];\n            if (Array.isArray(manifest?.translations)) bundles.push(...manifest.translations);\n            if (Array.isArray(manifest?.i18n)) bundles.push(...manifest.i18n);\n\n            if (bundles.length > 0) {\n                let i18nService: any;\n                try { i18nService = ctx.getService('i18n'); } catch { /* not registered */ }\n                if (!i18nService) {\n                    try {\n                        const mod = await import('@objectstack/core');\n                        const createMemoryI18n = (mod as any).createMemoryI18n;\n                        if (typeof createMemoryI18n === 'function') {\n                            i18nService = createMemoryI18n();\n                            (ctx as any).registerService?.('i18n', i18nService);\n                            ctx.logger?.info?.(`[MarketplaceInstallLocal] auto-registered in-memory i18n fallback for \"${appId}\"`);\n                        }\n                    } catch { /* fallback unavailable */ }\n                }\n                if (i18nService?.loadTranslations) {\n                    for (const bundle of bundles) {\n                        for (const [locale, data] of Object.entries(bundle)) {\n                            if (data && typeof data === 'object') {\n                                try {\n                                    i18nService.loadTranslations(locale, data as Record<string, unknown>);\n                                    translationsLoaded++;\n                                } catch (err: any) {\n                                    ctx.logger?.warn?.(`[MarketplaceInstallLocal] failed to load ${appId} translations for ${locale}: ${err?.message ?? err}`);\n                                }\n                            }\n                        }\n                    }\n                    ctx.logger?.info?.(`[MarketplaceInstallLocal] loaded ${translationsLoaded} locale bundle(s) for ${appId}`);\n                }\n            }\n        } catch (err: any) {\n            ctx.logger?.warn?.(`[MarketplaceInstallLocal] i18n side-effect failed for ${appId}: ${err?.message ?? err}`);\n        }\n\n        // ── 2. Seed datasets — merge into kernel service ─────────────────\n        const datasets = Array.isArray(manifest?.data)\n            ? manifest.data.filter((d: any) => d && d.object && Array.isArray(d.records))\n            : [];\n\n        if (datasets.length > 0) {\n            try {\n                const kernel: any = (ctx as any).kernel;\n                let existing: any[] = [];\n                try {\n                    const v = kernel?.getService?.('seed-datasets');\n                    if (Array.isArray(v)) existing = v;\n                } catch { /* unset */ }\n                const merged = [...existing, ...datasets];\n                if (kernel?.registerService) kernel.registerService('seed-datasets', merged);\n                else (ctx as any).registerService?.('seed-datasets', merged);\n                ctx.logger?.info?.(`[MarketplaceInstallLocal] merged ${datasets.length} seed dataset(s) into kernel (total: ${merged.length})`);\n            } catch (err: any) {\n                ctx.logger?.warn?.(`[MarketplaceInstallLocal] failed to merge seed-datasets: ${err?.message ?? err}`);\n            }\n        }\n\n        // ── 3. Optional immediate seed ───────────────────────────────────\n        // Always seed inline via SeedLoaderService — don't rely on the\n        // `seed-replayer` registered by AppPlugin since (a) it isn't\n        // registered when the host runtime has no AppPlugin app with\n        // seed data, and (b) its closure may use stale datasets. In\n        // multi-tenant mode we pass `organizationId` so the loader\n        // writes tenant-scoped rows the same way AppPlugin's\n        // single-tenant branch + SecurityPlugin's per-org replay do.\n        if (opts.seedNow && datasets.length > 0) {\n            const multiTenant = String(process.env.OS_MULTI_TENANT ?? 'true').toLowerCase() !== 'false';\n            try {\n                const ql: any = ctx.getService('objectql');\n                let metadata: any;\n                try { metadata = ctx.getService('metadata'); } catch { /* none */ }\n                if (!ql || !metadata) {\n                    seedSummary = { mode: 'skipped', reason: 'objectql-or-metadata-missing' };\n                } else {\n                    let organizationId: string | undefined;\n                    if (multiTenant) {\n                        const resolved = await this.resolveActiveOrgId(opts.c, ctx);\n                        if (resolved) organizationId = resolved;\n                        else {\n                            seedSummary = { mode: 'skipped', reason: 'multi-tenant-no-active-org' };\n                            ctx.logger?.warn?.('[MarketplaceInstallLocal] multi-tenant: no active org on request — data not seeded');\n                        }\n                    }\n                    if (!multiTenant || organizationId) {\n                        const [{ SeedLoaderService }, { SeedLoaderRequestSchema }] = await Promise.all([\n                            import('../seed-loader.js'),\n                            import('@objectstack/spec/data'),\n                        ]);\n                        const seedLoader = new (SeedLoaderService as any)(ql, metadata, ctx.logger);\n                        const request = (SeedLoaderRequestSchema as any).parse({\n                            datasets,\n                            config: {\n                                defaultMode: 'upsert',\n                                multiPass: true,\n                                ...(organizationId ? { organizationId } : {}),\n                            },\n                        });\n                        const result = await seedLoader.load(request);\n                        seedSummary = {\n                            mode: 'inline',\n                            inserted: result.summary.totalInserted,\n                            updated: result.summary.totalUpdated,\n                            errors: result.errors.length,\n                        };\n                        ctx.logger?.info?.(`[MarketplaceInstallLocal] inline seed for ${appId}${organizationId ? ` (org=${organizationId})` : ''}: inserted=${seedSummary.inserted} updated=${seedSummary.updated} errors=${seedSummary.errors}`);\n                    }\n                }\n            } catch (err: any) {\n                seedSummary = { mode: 'skipped', reason: `seed-error: ${err?.message ?? err}` };\n                ctx.logger?.warn?.(`[MarketplaceInstallLocal] seed run failed for ${appId}: ${err?.message ?? err}`);\n            }\n        }\n\n        return { translationsLoaded, seeded: seedSummary };\n    };\n\n    /**\n     * Best-effort active-org resolution. Reads the better-auth session\n     * (same path as requireAuthenticatedUser) and returns\n     * `session.activeOrganizationId`, falling back to the user's first\n     * org membership.\n     */\n    private resolveActiveOrgId = async (c: any, ctx: PluginContext): Promise<string | null> => {\n        if (!c?.req?.raw?.headers) return null;\n        try {\n            const authService: any = ctx.getService('auth');\n            let api: any = authService?.api;\n            if (!api && typeof authService?.getApi === 'function') api = await authService.getApi();\n            if (!api?.getSession) return null;\n            const session = await api.getSession({ headers: c.req.raw.headers });\n            const direct = session?.session?.activeOrganizationId ?? session?.activeOrganizationId ?? null;\n            if (direct) return String(direct);\n            // Fall back to the user's first membership row.\n            const userId = session?.user?.id;\n            if (!userId) return null;\n            try {\n                const ql: any = ctx.getService('objectql');\n                if (ql?.find) {\n                    const rows = await ql.find('sys_organization_member', { where: { user_id: userId }, limit: 1, context: { isSystem: true } } as any);\n                    const row = Array.isArray(rows) ? rows[0] : (rows?.items?.[0] ?? null);\n                    return row?.organization_id ? String(row.organization_id) : null;\n                }\n            } catch { /* ignore */ }\n        } catch { /* ignore */ }\n        return null;\n    };\n\n    private requireAuthenticatedUser = async (c: any, ctx: PluginContext): Promise<string | null> => {\n        try {\n            // Mirror `hono-plugin.ts` resolveCtx: pull the better-auth `api`\n            // off the auth service and call `getSession({ headers })`. The\n            // earlier guess `c.get('auth').session` is wrong — AuthPlugin\n            // does not pre-populate the Hono context.\n            const authService: any = ctx.getService('auth');\n            let api: any = authService?.api;\n            if (!api && typeof authService?.getApi === 'function') {\n                api = await authService.getApi();\n            }\n            if (api?.getSession && c?.req?.raw?.headers) {\n                const session = await api.getSession({ headers: c.req.raw.headers });\n                const userId = session?.user?.id ?? null;\n                if (userId) return String(userId);\n            }\n        } catch { /* ignore — fall through */ }\n        // Header fallback for cases where auth is disabled (e.g. test stubs)\n        const xUserId = c?.req?.header?.('x-user-id');\n        if (xUserId) return String(xUserId);\n        return null;\n    };\n\n    private readAll = (): InstalledEntry[] => {\n        if (!existsSync(this.storageDir)) return [];\n        const out: InstalledEntry[] = [];\n        for (const name of readdirSync(this.storageDir)) {\n            if (!name.endsWith('.json')) continue;\n            try {\n                const raw = readFileSync(join(this.storageDir, name), 'utf8');\n                out.push(JSON.parse(raw));\n            } catch { /* skip corrupt files */ }\n        }\n        return out;\n    };\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * # Hook & Action Body Sandbox\n *\n * Pluggable execution engine for L2 `ScriptBody` payloads coming from\n * `@objectstack/spec/data` `HookBodySchema`.\n *\n * ## Engine choice — quickjs-emscripten\n *\n * Two candidates were evaluated:\n *\n * | Property                | isolated-vm                | quickjs-emscripten        |\n * |-------------------------|----------------------------|---------------------------|\n * | True isolation          | ✅ V8 isolate               | ✅ separate JS heap        |\n * | Memory limit enforced   | ✅ hard cap                 | ⚠️ soft (engine-level)     |\n * | CPU timeout enforced    | ✅ hard kill                | ✅ interrupt handler       |\n * | Native dependency       | ❌ requires N-API build     | ✅ pure WASM               |\n * | Edge runtime support    | ❌ Cloudflare/Vercel ban    | ✅ runs on every JS host   |\n * | Cold-start cost         | ~50ms (native init)        | ~100ms (WASM init)        |\n * | Per-invocation overhead | very low                   | low–medium                |\n *\n * **Decision:** `quickjs-emscripten`.\n *\n * The single biggest constraint for ObjectStack is that `objectos` ships as a\n * pure-JS runtime so it can run on serverless edges, Cloudflare Workers,\n * Vercel Edge, Deno Deploy, plus traditional Node servers. `isolated-vm`\n * disqualifies us from every edge target because of its N-API dependency.\n * The performance penalty of QuickJS for short hook/action bodies (typically\n * <1 ms of script logic) is dominated by `ctx.api` round-trips anyway, so the\n * trade is favorable.\n *\n * The engine sits behind the `ScriptRunner` interface — if a host environment\n * can guarantee node-only deployment we can plug `isolated-vm` later without\n * touching call sites.\n */\n\nimport type { HookBody, ScriptBody, ExpressionBody } from '@objectstack/spec/data';\n\n/**\n * Identity / origin information used by the sandbox for diagnostics, capability\n * gating, and audit logs.\n */\nexport interface ScriptOrigin {\n  /** Whether the body is attached to a Hook or an Action. */\n  kind: 'hook' | 'action';\n  /** Object the hook/action targets, when applicable. */\n  object?: string;\n  /** Hook/Action name, used in error messages and traces. */\n  name: string;\n}\n\n/**\n * Context object exposed to the script. The shape mirrors `HookContext` /\n * `ActionContext` from `@objectstack/spec`. The sandbox copies a subset of\n * these into the isolated heap; capability checks gate which methods are\n * actually wired up.\n */\nexport interface ScriptContext {\n  input: unknown;\n  previous?: unknown;\n  user?: unknown;\n  session?: unknown;\n  /**\n   * The lifecycle event name the hook is firing for (e.g. `beforeInsert`,\n   * `afterUpdate`). Required for hooks that subscribe to multiple events\n   * and dispatch on event name.\n   */\n  event?: string;\n  /** The object the hook/action targets — surfaces from `HookContext.object`. */\n  object?: string;\n  /**\n   * Action only: the record id passed in the action invocation URL\n   * (`POST /api/v1/actions/:object/:action/:recordId`). Hooks always have\n   * the record on `input` so this stays undefined for them.\n   */\n  recordId?: string;\n  /**\n   * Action only: the record loaded by the dispatcher before the action ran\n   * (when the dispatcher pre-fetches it). May be undefined for actions\n   * declared with `requiresRecord: false` or when no `recordId` was supplied.\n   */\n  record?: unknown;\n  /** Engine-side `result` (only set for after* hooks). */\n  result?: unknown;\n  api?: unknown;\n  log?: {\n    info: (msg: string, data?: unknown) => void;\n    warn: (msg: string, data?: unknown) => void;\n    error: (msg: string, data?: unknown) => void;\n  };\n  crypto?: {\n    randomUUID?: () => string;\n    hash?: (algo: string, data: string | Uint8Array) => Promise<string>;\n  };\n}\n\n/**\n * Result returned to the caller after script execution.\n * - For hooks the `value` is typically `undefined` (mutations happen on `ctx`).\n * - For actions the `value` is the script's return value.\n */\nexport interface ScriptResult {\n  value: unknown;\n  /** Total wall-clock time inside the sandbox, milliseconds. */\n  durationMs: number;\n  /**\n   * Snapshot of `ctx.input` *as observed inside the VM after the script settled*.\n   *\n   * Hooks frequently mutate `ctx.input.x = y` directly without returning a value.\n   * The runner dumps the post-execution `ctx.input` so the host body-runner can\n   * write the mutations back through to the engine's `hookContext.input` (which\n   * is itself usually a flat-record Proxy).\n   *\n   * `undefined` if the dump failed or the script context did not expose `input`.\n   */\n  mutatedInput?: Record<string, unknown>;\n}\n\nexport interface ScriptRunOptions {\n  origin: ScriptOrigin;\n  /** Hard timeout for this invocation. The smaller of body.timeoutMs and this wins. */\n  timeoutMs?: number;\n  /** Optional abort signal from the surrounding kernel. */\n  signal?: AbortSignal;\n}\n\n/**\n * The sandbox engine contract. Implementations live under\n * `packages/runtime/src/sandbox/engines/`.\n */\nexport interface ScriptRunner {\n  /** Execute an L1 expression. Pure, side-effect-free. */\n  evalExpression(body: ExpressionBody, ctx: ScriptContext, opts: ScriptRunOptions): Promise<ScriptResult>;\n\n  /** Execute an L2 sandboxed JS script body. */\n  runScript(body: ScriptBody, ctx: ScriptContext, opts: ScriptRunOptions): Promise<ScriptResult>;\n\n  /** Convenience dispatch on the discriminated union. */\n  run(body: HookBody, ctx: ScriptContext, opts: ScriptRunOptions): Promise<ScriptResult>;\n\n  /** Release any underlying VM resources. */\n  dispose(): Promise<void>;\n}\n\n/**\n * Default no-op runner — throws on every call. The real engine is injected\n * during runtime bootstrap once `quickjs-emscripten` is wired in. This stub\n * lets the rest of the pipeline (loader, dispatcher, type plumbing) compile\n * and be unit-tested ahead of the engine landing.\n */\nexport class UnimplementedScriptRunner implements ScriptRunner {\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  evalExpression(_body: ExpressionBody, _ctx: ScriptContext, _opts: ScriptRunOptions): Promise<ScriptResult> {\n    return Promise.reject(new Error('ScriptRunner not configured: install a quickjs engine first.'));\n  }\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  runScript(_body: ScriptBody, _ctx: ScriptContext, _opts: ScriptRunOptions): Promise<ScriptResult> {\n    return Promise.reject(new Error('ScriptRunner not configured: install a quickjs engine first.'));\n  }\n  run(body: HookBody, ctx: ScriptContext, opts: ScriptRunOptions): Promise<ScriptResult> {\n    return body.language === 'expression'\n      ? this.evalExpression(body, ctx, opts)\n      : this.runScript(body, ctx, opts);\n  }\n  dispose(): Promise<void> {\n    return Promise.resolve();\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nexport {\n  UnimplementedScriptRunner,\n} from './script-runner.js';\nexport type {\n  ScriptRunner,\n  ScriptContext,\n  ScriptOrigin,\n  ScriptResult,\n  ScriptRunOptions,\n} from './script-runner.js';\nexport { QuickJSScriptRunner, SandboxError } from './quickjs-runner.js';\nexport type { QuickJSScriptRunnerOptions } from './quickjs-runner.js';\nexport { hookBodyRunnerFactory, actionBodyRunnerFactory } from './body-runner.js';\n"],"mappings":";;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4BA,SAAS,gBAAgB;AACzB,SAAS,WAAW,aAAa,YAAY,eAAe;AAC5D,SAAS,qBAAqB;AAYvB,SAAS,UAAU,WAA4B;AAClD,SAAO,gBAAgB,KAAK,SAAS;AACzC;AAMA,eAAsB,mBAClB,WACA,OAAoC,CAAC,GACtB;AACf,MAAI,UAAU,SAAS,GAAG;AACtB,UAAM,YAAY,KAAK,kBAAkB;AACzC,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,QAAI;AACA,YAAM,MAAM,MAAM,MAAM,WAAW;AAAA,QAC/B,UAAU;AAAA,QACV,QAAQ,WAAW;AAAA,QACnB,SAAS,EAAE,QAAQ,gDAAgD;AAAA,MACvE,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACT,cAAM,IAAI,MAAM,QAAQ,IAAI,MAAM,IAAI,IAAI,UAAU,QAAQ,SAAS,EAAE;AAAA,MAC3E;AACA,aAAO,MAAM,IAAI,KAAK;AAAA,IAC1B,UAAE;AACE,mBAAa,KAAK;AAAA,IACtB;AAAA,EACJ;AACA,SAAO,SAAS,WAAW,OAAO;AACtC;AAEA,eAAsB,mBAClB,iBACA,OAAkC,CAAC,GAChB;AACnB,QAAM,MAAM,KAAK,OAAO;AACxB,QAAM,QAAQ,UAAU,eAAe;AACvC,MAAI;AACJ,MAAI;AACA,UAAM,MAAM,MAAM,mBAAmB,iBAAiB,EAAE,gBAAgB,KAAK,eAAe,CAAC;AAC7F,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,aAAS,KAAK,kBAAkB,QAAQ,iBAAiB,QAAQ,QAAQ,aAAa,SAChF,OAAO,WACP;AAAA,EACV,SAAS,KAAU;AAEf,YAAQ,KAAK,GAAG,GAAG,gCAAgC,eAAe,WAAW,KAAK,WAAW,GAAG,EAAE;AAClG,WAAO;AAAA,EACX;AAEA,MAAI,OAAO;AAKP,QAAI,OAAO,QAAQ,kBAAkB,YAAY,OAAO,cAAc,SAAS,GAAG;AAE9E,cAAQ;AAAA,QACJ,GAAG,GAAG,4BAA4B,OAAO,aAAa,yBAAyB,eAAe;AAAA,MAElG;AAGA,aAAO,OAAO;AAAA,IAClB;AACA,WAAO;AAAA,EACX;AAEA,QAAM,mBAAmB,QAAQ,iBAAiB,GAAG;AACrD,SAAO;AACX;AAEA,eAAsB,mBAAmB,QAAa,iBAAyB,MAAM,wBAAuC;AACxH,QAAM,MAAM,QAAQ;AACpB,MAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,EAAG;AACjD,QAAM,gBAAgB,WAAW,GAAG,IAAI,MAAM,YAAY,QAAQ,eAAe,GAAG,GAAG;AACvF,MAAI;AACA,UAAM,MAAW,MAAM,OAAO,cAAc,aAAa,EAAE;AAC3D,UAAM,OAAO,QAAQ,IAAI,aAAa,IAAI,SAAS,eAAe;AAClE,QAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AAEjC,cAAQ,KAAK,GAAG,GAAG,oBAAoB,aAAa,iCAAiC;AACrF;AAAA,IACJ;AACA,UAAM,WAAY,OAAO,aAAa,OAAO,OAAO,cAAc,YAAY,CAAC,MAAM,QAAQ,OAAO,SAAS,IACvG,OAAO,YACP,CAAC;AACP,WAAO,YAAY,EAAE,GAAG,UAAU,GAAG,IAAI;AAAA,EAC7C,SAAS,KAAU;AAEf,YAAQ,KAAK,GAAG,GAAG,sCAAsC,aAAa,WAAW,KAAK,WAAW,GAAG,EAAE;AAAA,EAC1G;AACJ;AAxIA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA,IAgCa;AAhCb;AAAA;AAAA;AAgCO,IAAM,eAAN,MAAqC;AAAA,MAQxC,YAAY,QAAa,qBAAoD,SAA+B;AAN5G,oBAAO;AACP,uBAAU;AAYV,oBAAO,OAAO,QAAuB;AACjC,gBAAM,cAAc,UAAU,KAAK,OAAO,QAAQ,SAAS;AAC3D,cAAI,gBAAgB,aAAa,KAAK,MAAM;AAC5C,cAAI,OAAO,KAAK,6BAA6B;AAAA,YACzC;AAAA,YACA,YAAY,KAAK,OAAO;AAAA,YACxB,eAAe,KAAK,OAAO;AAAA,UAC/B,CAAC;AAAA,QACL;AAEA,qBAAQ,OAAO,QAAuB;AAClC,cAAI;AACA,kBAAM,WAAW,IAAI,WAAgB,UAAU;AAC/C,gBAAI,CAAC,UAAU,cAAe;AAG9B,gBAAI,KAAK,QAAQ,gBAAgB;AAC7B,oBAAM,SAAS,cAAc;AAAA,gBACzB,MAAM,KAAK,QAAQ;AAAA,gBACnB,QAAQ,KAAK,OAAO;AAAA,cACxB,CAAC;AACD,kBAAI,OAAO,KAAK,+CAA+C,KAAK,QAAQ,cAAc,KAAK,EAAE,QAAQ,KAAK,OAAO,KAAK,CAAC;AAAA,YAC/H;AAGA,gBAAI,KAAK,QAAQ,sBAAsB,OAAO;AAC1C,oBAAM,cAAc,SAAS,iBAAiB,SAAS,eAAe,IAAI,CAAC;AAC3E,oBAAM,aAAa,YAAY,KAAK,CAAC,OAAY,GAAG,SAAS,SAAS;AACtE,kBAAI,CAAC,YAAY;AACb,oBAAI,OAAO,KAAK,oEAA+D,KAAK,OAAO,IAAI,eAAe;AAC9G,sBAAM,SAAS,cAAc,EAAE,MAAM,WAAW,QAAQ,KAAK,OAAO,KAAK,CAAC;AAAA,cAC9E;AAAA,YACJ;AAAA,UACJ,SAAS,GAAG;AACR,gBAAI,OAAO,MAAM,6EAA6E,EAAE,OAAO,EAAE,CAAC;AAAA,UAC9G;AAEA,cAAI,OAAO,MAAM,yBAAyB,EAAE,YAAY,KAAK,OAAO,QAAQ,UAAU,CAAC;AAAA,QAC3F;AA5CI,aAAK,SAAS;AACd,cAAM,aAAa,OAAO,wBAAwB,WAAW,sBAAsB;AACnF,aAAK,WAAW,OAAO,wBAAwB,WAAW,sBAAsB,YAAY,CAAC;AAC7F,aAAK,OAAO,0BAA0B,cAAc,OAAO,QAAQ,SAAS;AAAA,MAChF;AAAA,IAyCJ;AAAA;AAAA;;;ACtFA;AAAA;AAAA;AAAA;AAeA,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAhBlC,IA0BM,2BAaO;AAvCb;AAAA;AAAA;AA0BA,IAAM,4BAA4B;AAa3B,IAAM,qBAAN,MAAM,mBAAgD;AAAA,MAK3D,YAAY,QAAqB,UAA4B,QAAgB;AAC3E,aAAK,SAAS;AACd,aAAK,WAAW;AAChB,aAAK,SAAS;AAAA,MAChB;AAAA;AAAA;AAAA;AAAA,MAMA,MAAM,KAAK,SAAuD;AAChE,cAAM,YAAY,KAAK,IAAI;AAC3B,cAAM,SAAS,QAAQ;AACvB,cAAM,YAAwC,CAAC;AAC/C,cAAM,aAAkC,CAAC;AAGzC,cAAM,WAAW,KAAK,YAAY,QAAQ,UAAU,OAAO,GAAG;AAE9D,YAAI,SAAS,WAAW,GAAG;AACzB,iBAAO,KAAK,iBAAiB,QAAQ,KAAK,IAAI,IAAI,SAAS;AAAA,QAC7D;AAGA,cAAM,cAAc,SAAS,IAAI,OAAK,EAAE,MAAM;AAC9C,cAAM,QAAQ,MAAM,KAAK,qBAAqB,WAAW;AAEzD,aAAK,OAAO,KAAK,uCAAuC;AAAA,UACtD,SAAS,YAAY;AAAA,UACrB,aAAa,MAAM;AAAA,UACnB,cAAc,MAAM,qBAAqB;AAAA,QAC3C,CAAC;AAGD,cAAM,kBAAkB,KAAK,cAAc,UAAU,MAAM,WAAW;AAGtE,cAAM,SAAS,KAAK,kBAAkB,KAAK;AAG3C,cAAM,kBAAkB,oBAAI,IAAiC;AAC7D,cAAM,kBAAoC,CAAC;AAE3C,mBAAW,WAAW,iBAAiB;AACrC,gBAAM,SAAS,MAAM,KAAK;AAAA,YACxB;AAAA,YAAS;AAAA,YAAQ;AAAA,YAAQ;AAAA,YAAiB;AAAA,YAAiB;AAAA,UAC7D;AACA,qBAAW,KAAK,MAAM;AAEtB,cAAI,OAAO,eAAe,OAAO,UAAU,GAAG;AAC5C,iBAAK,OAAO,KAAK,uCAAuC,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAClF;AAAA,UACF;AAAA,QACF;AAGA,YAAI,OAAO,aAAa,gBAAgB,SAAS,KAAK,CAAC,OAAO,QAAQ;AACpE,eAAK,OAAO,KAAK,sDAAsD;AAAA,YACrE,OAAO,gBAAgB;AAAA,UACzB,CAAC;AACD,gBAAM,KAAK,uBAAuB,iBAAiB,iBAAiB,YAAY,WAAW,OAAO,cAAc;AAAA,QAClH;AAGA,cAAM,aAAa,KAAK,IAAI,IAAI;AAChC,eAAO,KAAK,YAAY,QAAQ,OAAO,YAAY,WAAW,UAAU;AAAA,MAC1E;AAAA,MAEA,MAAM,qBAAqB,aAAuD;AAChF,cAAM,QAAgC,CAAC;AACvC,cAAM,YAAY,IAAI,IAAI,WAAW;AAErC,mBAAW,cAAc,aAAa;AACpC,gBAAM,SAAS,MAAM,KAAK,SAAS,UAAU,UAAU;AACvD,gBAAM,YAAsB,CAAC;AAC7B,gBAAM,aAAoC,CAAC;AAE3C,cAAI,UAAU,OAAO,QAAQ;AAC3B,kBAAM,SAAS,OAAO;AACtB,uBAAW,CAAC,WAAW,QAAQ,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC1D,mBACG,SAAS,SAAS,YAAY,SAAS,SAAS,oBACjD,SAAS,WACT;AACA,sBAAM,eAAe,SAAS;AAG9B,oBAAI,UAAU,IAAI,YAAY,KAAK,CAAC,UAAU,SAAS,YAAY,GAAG;AACpE,4BAAU,KAAK,YAAY;AAAA,gBAC7B;AAGA,2BAAW,KAAK;AAAA,kBACd,OAAO;AAAA,kBACP;AAAA,kBACA,aAAa;AAAA,kBACb,WAAW,SAAS;AAAA,gBACtB,CAAC;AAAA,cACH;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,KAAK,EAAE,QAAQ,YAAY,WAAW,WAAW,CAAC;AAAA,QAC1D;AAGA,cAAM,EAAE,aAAa,qBAAqB,IAAI,KAAK,gBAAgB,KAAK;AAExE,eAAO,EAAE,OAAO,aAAa,qBAAqB;AAAA,MACpD;AAAA,MAEA,MAAM,SAAS,UAAqB,QAA2D;AAC7F,cAAM,eAAe,uBAAuB,MAAM,EAAE,GAAG,QAAQ,QAAQ,KAAK,CAAC;AAC7E,eAAO,KAAK,KAAK,EAAE,UAAU,QAAQ,aAAa,CAAC;AAAA,MACrD;AAAA;AAAA;AAAA;AAAA,MAMA,MAAc,YACZ,SACA,QACA,QACA,iBACA,iBACA,WAC4B;AAC5B,cAAM,aAAa,QAAQ;AAC3B,cAAM,OAAO,QAAQ,QAAQ,OAAO;AACpC,cAAM,aAAa,QAAQ,cAAc;AAEzC,YAAI,WAAW;AACf,YAAI,UAAU;AACd,YAAI,UAAU;AACd,YAAI,UAAU;AACd,YAAI,qBAAqB;AACzB,YAAI,qBAAqB;AACzB,cAAM,SAAqC,CAAC;AAG5C,YAAI,CAAC,gBAAgB,IAAI,UAAU,GAAG;AACpC,0BAAgB,IAAI,YAAY,oBAAI,IAAI,CAAC;AAAA,QAC3C;AAMA,YAAI;AACJ,aAAK,SAAS,YAAY,SAAS,YAAY,SAAS,aAAa,CAAC,OAAO,QAAQ;AACnF,4BAAkB,MAAM,KAAK;AAAA,YAC3B;AAAA,YACA;AAAA,YACA,OAAO;AAAA,UACT;AAAA,QACF;AAGA,cAAM,aAAa,OAAO,IAAI,UAAU,KAAK,CAAC;AAI9C,cAAM,UAAU,oBAAI,KAAK;AAEzB,iBAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,QAAQ,KAAK;AAG/C,gBAAM,aAAa;AAAA,YACjB,QAAQ,QAAQ,CAAC;AAAA,YACjB,EAAE,KAAK,QAAQ;AAAA,UACjB;AACA,gBAAM,SAAS,WAAW,KACtB,EAAE,GAAI,WAAW,MAAkC,IACnD,EAAE,GAAG,QAAQ,QAAQ,CAAC,EAAE;AAC5B,cAAI,CAAC,WAAW,IAAI;AAClB,iBAAK,OAAO;AAAA,cACV,qDAAqD,UAAU,YAAY,CAAC,KAAK,WAAW,MAAM,OAAO;AAAA,YAC3G;AAAA,UACF;AAOA,cAAI,OAAO,kBAAkB,OAAO,iBAAiB,KAAK,MAAM;AAC9D,mBAAO,iBAAiB,IAAI,OAAO;AAAA,UACrC;AAGA,qBAAW,OAAO,YAAY;AAC5B,kBAAM,aAAa,OAAO,IAAI,KAAK;AACnC,gBAAI,eAAe,UAAa,eAAe,KAAM;AAGrD,gBAAI,OAAO,eAAe,YAAY,KAAK,oBAAoB,UAAU,EAAG;AAG5E,kBAAM,YAAY,gBAAgB,IAAI,IAAI,YAAY;AACtD,kBAAM,aAAa,WAAW,IAAI,OAAO,UAAU,CAAC;AAEpD,gBAAI,YAAY;AACd,qBAAO,IAAI,KAAK,IAAI;AACpB;AAAA,YACF,WAAW,CAAC,OAAO,QAAQ;AAEzB,oBAAM,OAAO,MAAM,KAAK,oBAAoB,IAAI,cAAc,IAAI,aAAa,YAAY,OAAO,cAAc;AAChH,kBAAI,MAAM;AACR,uBAAO,IAAI,KAAK,IAAI;AACpB;AAAA,cACF,WAAW,OAAO,WAAW;AAE3B,uBAAO,IAAI,KAAK,IAAI;AACpB,gCAAgB,KAAK;AAAA,kBACnB;AAAA,kBACA,kBAAkB,OAAO,OAAO,UAAU,KAAK,EAAE;AAAA,kBACjD,OAAO,IAAI;AAAA,kBACX,cAAc,IAAI;AAAA,kBAClB,aAAa,IAAI;AAAA,kBACjB,gBAAgB;AAAA,kBAChB,aAAa;AAAA,gBACf,CAAC;AACD;AAAA,cACF,OAAO;AAEL,sBAAM,QAAkC;AAAA,kBACtC,cAAc;AAAA,kBACd,OAAO,IAAI;AAAA,kBACX,cAAc,IAAI;AAAA,kBAClB,aAAa,IAAI;AAAA,kBACjB,gBAAgB;AAAA,kBAChB,aAAa;AAAA,kBACb,SAAS,6BAA6B,UAAU,IAAI,IAAI,KAAK,OAAO,UAAU,YAAO,IAAI,YAAY,IAAI,IAAI,WAAW;AAAA,gBAC1H;AACA,uBAAO,KAAK,KAAK;AACjB,0BAAU,KAAK,KAAK;AAAA,cACtB;AAAA,YACF,OAAO;AAEL,oBAAM,aAAa,gBAAgB,IAAI,IAAI,YAAY;AACvD,kBAAI,CAAC,YAAY,IAAI,OAAO,UAAU,CAAC,GAAG;AACxC,sBAAM,QAAkC;AAAA,kBACtC,cAAc;AAAA,kBACd,OAAO,IAAI;AAAA,kBACX,cAAc,IAAI;AAAA,kBAClB,aAAa,IAAI;AAAA,kBACjB,gBAAgB;AAAA,kBAChB,aAAa;AAAA,kBACb,SAAS,wCAAwC,UAAU,IAAI,IAAI,KAAK,OAAO,UAAU,YAAO,IAAI,YAAY,IAAI,IAAI,WAAW;AAAA,gBACrI;AACA,uBAAO,KAAK,KAAK;AACjB,0BAAU,KAAK,KAAK;AAAA,cACtB;AAAA,YACF;AAAA,UACF;AAGA,cAAI,CAAC,OAAO,QAAQ;AAClB,gBAAI;AACF,oBAAM,SAAS,MAAM,KAAK;AAAA,gBACxB;AAAA,gBAAY;AAAA,gBAAQ;AAAA,gBAAM;AAAA,gBAAY;AAAA,cACxC;AAEA,kBAAI,OAAO,WAAW,WAAY;AAAA,uBACzB,OAAO,WAAW,UAAW;AAAA,uBAC7B,OAAO,WAAW,UAAW;AAGtC,oBAAM,kBAAkB,OAAO,OAAO,UAAU,KAAK,EAAE;AACvD,oBAAM,aAAa,OAAO;AAC1B,kBAAI,mBAAmB,YAAY;AACjC,gCAAgB,IAAI,UAAU,EAAG,IAAI,iBAAiB,OAAO,UAAU,CAAC;AAAA,cAC1E;AAAA,YACF,SAAS,KAAU;AACjB;AACA,mBAAK,OAAO,KAAK,gCAAgC,UAAU,WAAW;AAAA,gBACpE,OAAO,IAAI;AAAA,gBACX,aAAa;AAAA,cACf,CAAC;AAAA,YACH;AAAA,UACF,OAAO;AAEL,kBAAM,kBAAkB,OAAO,OAAO,UAAU,KAAK,EAAE;AACvD,gBAAI,iBAAiB;AACnB,8BAAgB,IAAI,UAAU,EAAG,IAAI,iBAAiB,cAAc,CAAC,EAAE;AAAA,YACzE;AACA;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,UACL,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO,QAAQ,QAAQ;AAAA,UACvB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA;AAAA;AAAA;AAAA,MAMA,MAAc,oBACZ,cACA,aACA,OACA,gBACwB;AACxB,YAAI;AACF,gBAAM,QAAiC,EAAE,CAAC,WAAW,GAAG,MAAM;AAK9D,cAAI,eAAgB,OAAM,kBAAkB;AAC5C,gBAAM,UAAU,MAAM,KAAK,OAAO,KAAK,cAAc;AAAA,YACnD;AAAA,YACA,QAAQ,CAAC,IAAI;AAAA,YACb,OAAO;AAAA,YACP,SAAS,EAAE,UAAU,KAAK;AAAA,UAC5B,CAAQ;AACR,cAAI,WAAW,QAAQ,SAAS,GAAG;AACjC,mBAAO,OAAO,QAAQ,CAAC,EAAE,MAAM,QAAQ,CAAC,EAAE,GAAG;AAAA,UAC/C;AAAA,QACF,QAAQ;AAAA,QAER;AACA,eAAO;AAAA,MACT;AAAA,MAEA,MAAc,uBACZ,iBACA,iBACA,YACA,WACA,gBACe;AACf,mBAAW,YAAY,iBAAiB;AAEtC,gBAAM,YAAY,gBAAgB,IAAI,SAAS,YAAY;AAC3D,cAAI,aAAa,WAAW,IAAI,OAAO,SAAS,cAAc,CAAC;AAG/D,cAAI,CAAC,YAAY;AACf,yBAAc,MAAM,KAAK;AAAA,cACvB,SAAS;AAAA,cAAc,SAAS;AAAA,cAAa,SAAS;AAAA,cAAgB;AAAA,YACxE,KAAM;AAAA,UACR;AAEA,cAAI,YAAY;AAEd,kBAAM,kBAAkB,gBAAgB,IAAI,SAAS,UAAU;AAC/D,kBAAM,WAAW,iBAAiB,IAAI,SAAS,gBAAgB;AAE/D,gBAAI,UAAU;AACZ,kBAAI;AACF,sBAAM,KAAK,OAAO,OAAO,SAAS,YAAY;AAAA,kBAC5C,IAAI;AAAA,kBACJ,CAAC,SAAS,KAAK,GAAG;AAAA,gBACpB,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAQ;AAGzC,sBAAM,cAAc,WAAW,KAAK,OAAK,EAAE,WAAW,SAAS,UAAU;AACzE,oBAAI,aAAa;AACf,8BAAY;AACZ,8BAAY;AAAA,gBACd;AAAA,cACF,SAAS,KAAU;AACjB,qBAAK,OAAO,KAAK,qDAAqD;AAAA,kBACpE,QAAQ,SAAS;AAAA,kBACjB,OAAO,SAAS;AAAA,kBAChB,OAAO,IAAI;AAAA,gBACb,CAAC;AAAA,cACH;AAAA,YACF;AAAA,UACF,OAAO;AAEL,kBAAM,QAAkC;AAAA,cACtC,cAAc,SAAS;AAAA,cACvB,OAAO,SAAS;AAAA,cAChB,cAAc,SAAS;AAAA,cACvB,aAAa,SAAS;AAAA,cACtB,gBAAgB,SAAS;AAAA,cACzB,aAAa,SAAS;AAAA,cACtB,SAAS,+CAA+C,SAAS,UAAU,IAAI,SAAS,KAAK,OAAO,SAAS,cAAc,YAAO,SAAS,YAAY,IAAI,SAAS,WAAW;AAAA,YACjL;AAEA,kBAAM,cAAc,WAAW,KAAK,OAAK,EAAE,WAAW,SAAS,UAAU;AACzE,gBAAI,aAAa;AACf,0BAAY,OAAO,KAAK,KAAK;AAAA,YAC/B;AACA,sBAAU,KAAK,KAAK;AAAA,UACtB;AAAA,QACF;AAAA,MACF;AAAA,MAeA,MAAc,YACZ,YACA,QACA,MACA,YACA,iBACsE;AACtE,cAAM,kBAAkB,OAAO,UAAU;AACzC,cAAM,WAAW,iBAAiB,IAAI,OAAO,mBAAmB,EAAE,CAAC;AACnE,cAAM,OAAO,mBAAkB;AAE/B,gBAAQ,MAAM;AAAA,UACZ,KAAK,UAAU;AACb,kBAAM,SAAS,MAAM,KAAK,OAAO,OAAO,YAAY,QAAQ,IAAI;AAChE,mBAAO,EAAE,QAAQ,YAAY,IAAI,KAAK,UAAU,MAAM,EAAE;AAAA,UAC1D;AAAA,UAEA,KAAK,UAAU;AACb,gBAAI,CAAC,UAAU;AACb,qBAAO,EAAE,QAAQ,UAAU;AAAA,YAC7B;AACA,kBAAM,KAAK,KAAK,UAAU,QAAQ;AAClC,kBAAM,KAAK,OAAO,OAAO,YAAY,EAAE,GAAG,QAAQ,GAAG,GAAG,IAAI;AAC5D,mBAAO,EAAE,QAAQ,WAAW,GAAG;AAAA,UACjC;AAAA,UAEA,KAAK,UAAU;AACb,gBAAI,UAAU;AACZ,oBAAM,KAAK,KAAK,UAAU,QAAQ;AAClC,oBAAM,KAAK,OAAO,OAAO,YAAY,EAAE,GAAG,QAAQ,GAAG,GAAG,IAAI;AAC5D,qBAAO,EAAE,QAAQ,WAAW,GAAG;AAAA,YACjC,OAAO;AACL,oBAAM,SAAS,MAAM,KAAK,OAAO,OAAO,YAAY,QAAQ,IAAI;AAChE,qBAAO,EAAE,QAAQ,YAAY,IAAI,KAAK,UAAU,MAAM,EAAE;AAAA,YAC1D;AAAA,UACF;AAAA,UAEA,KAAK,UAAU;AACb,gBAAI,UAAU;AACZ,qBAAO,EAAE,QAAQ,WAAW,IAAI,KAAK,UAAU,QAAQ,EAAE;AAAA,YAC3D;AACA,kBAAM,SAAS,MAAM,KAAK,OAAO,OAAO,YAAY,QAAQ,IAAI;AAChE,mBAAO,EAAE,QAAQ,YAAY,IAAI,KAAK,UAAU,MAAM,EAAE;AAAA,UAC1D;AAAA,UAEA,KAAK,WAAW;AAEd,kBAAM,SAAS,MAAM,KAAK,OAAO,OAAO,YAAY,QAAQ,IAAI;AAChE,mBAAO,EAAE,QAAQ,YAAY,IAAI,KAAK,UAAU,MAAM,EAAE;AAAA,UAC1D;AAAA,UAEA,SAAS;AACP,kBAAM,SAAS,MAAM,KAAK,OAAO,OAAO,YAAY,QAAQ,IAAI;AAChE,mBAAO,EAAE,QAAQ,YAAY,IAAI,KAAK,UAAU,MAAM,EAAE;AAAA,UAC1D;AAAA,QACF;AAAA,MACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASQ,gBACN,OAC6D;AAC7D,cAAM,WAAW,oBAAI,IAAoB;AACzC,cAAM,YAAY,oBAAI,IAAsB;AAC5C,cAAM,YAAY,IAAI,IAAI,MAAM,IAAI,OAAK,EAAE,MAAM,CAAC;AAGlD,mBAAW,QAAQ,OAAO;AACxB,mBAAS,IAAI,KAAK,QAAQ,CAAC;AAC3B,oBAAU,IAAI,KAAK,QAAQ,CAAC,CAAC;AAAA,QAC/B;AAGA,mBAAW,QAAQ,OAAO;AACxB,qBAAW,OAAO,KAAK,WAAW;AAGhC,gBAAI,UAAU,IAAI,GAAG,KAAK,QAAQ,KAAK,QAAQ;AAC7C,wBAAU,IAAI,GAAG,EAAG,KAAK,KAAK,MAAM;AACpC,uBAAS,IAAI,KAAK,SAAS,SAAS,IAAI,KAAK,MAAM,KAAK,KAAK,CAAC;AAAA,YAChE;AAAA,UACF;AAAA,QACF;AAGA,cAAM,QAAkB,CAAC;AACzB,mBAAW,CAAC,KAAK,MAAM,KAAK,UAAU;AACpC,cAAI,WAAW,EAAG,OAAM,KAAK,GAAG;AAAA,QAClC;AAEA,cAAM,cAAwB,CAAC;AAC/B,eAAO,MAAM,SAAS,GAAG;AACvB,gBAAM,UAAU,MAAM,MAAM;AAC5B,sBAAY,KAAK,OAAO;AAExB,qBAAW,YAAa,UAAU,IAAI,OAAO,KAAK,CAAC,GAAI;AACrD,kBAAM,aAAa,SAAS,IAAI,QAAQ,KAAK,KAAK;AAClD,qBAAS,IAAI,UAAU,SAAS;AAChC,gBAAI,cAAc,GAAG;AACnB,oBAAM,KAAK,QAAQ;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAGA,cAAM,uBAAmC,CAAC;AAC1C,cAAM,YAAY,MAAM,OAAO,OAAK,CAAC,YAAY,SAAS,EAAE,MAAM,CAAC;AAEnE,YAAI,UAAU,SAAS,GAAG;AAExB,gBAAM,SAAS,KAAK,WAAW,SAAS;AACxC,+BAAqB,KAAK,GAAG,MAAM;AAGnC,qBAAW,QAAQ,WAAW;AAC5B,gBAAI,CAAC,YAAY,SAAS,KAAK,MAAM,GAAG;AACtC,0BAAY,KAAK,KAAK,MAAM;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAEA,eAAO,EAAE,aAAa,qBAAqB;AAAA,MAC7C;AAAA,MAEQ,WAAW,OAA2C;AAC5D,cAAM,SAAqB,CAAC;AAC5B,cAAM,UAAU,IAAI,IAAI,MAAM,IAAI,OAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrD,cAAM,UAAU,oBAAI,IAAY;AAChC,cAAM,UAAU,oBAAI,IAAY;AAEhC,cAAM,MAAM,CAAC,SAAiB,SAAmB;AAC/C,cAAI,QAAQ,IAAI,OAAO,GAAG;AAExB,kBAAM,aAAa,KAAK,QAAQ,OAAO;AACvC,gBAAI,eAAe,IAAI;AACrB,qBAAO,KAAK,CAAC,GAAG,KAAK,MAAM,UAAU,GAAG,OAAO,CAAC;AAAA,YAClD;AACA;AAAA,UACF;AACA,cAAI,QAAQ,IAAI,OAAO,EAAG;AAE1B,kBAAQ,IAAI,OAAO;AACnB,kBAAQ,IAAI,OAAO;AACnB,eAAK,KAAK,OAAO;AAEjB,gBAAM,OAAO,QAAQ,IAAI,OAAO;AAChC,cAAI,MAAM;AACR,uBAAW,OAAO,KAAK,WAAW;AAChC,kBAAI,QAAQ,IAAI,GAAG,GAAG;AACpB,oBAAI,KAAK,CAAC,GAAG,IAAI,CAAC;AAAA,cACpB;AAAA,YACF;AAAA,UACF;AAEA,kBAAQ,OAAO,OAAO;AAAA,QACxB;AAEA,mBAAW,QAAQ,OAAO;AACxB,cAAI,CAAC,QAAQ,IAAI,KAAK,MAAM,GAAG;AAC7B,gBAAI,KAAK,QAAQ,CAAC,CAAC;AAAA,UACrB;AAAA,QACF;AAEA,eAAO;AAAA,MACT;AAAA;AAAA;AAAA;AAAA,MAMQ,YAAY,UAAqB,KAAyB;AAChE,YAAI,CAAC,IAAK,QAAO;AACjB,eAAO,SAAS,OAAO,OAAM,EAAE,IAAiB,SAAS,GAAG,CAAC;AAAA,MAC/D;AAAA,MAEQ,cAAc,UAAqB,aAAkC;AAC3E,cAAM,WAAW,IAAI,IAAI,YAAY,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAChE,eAAO,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM;AAClC,gBAAM,SAAS,SAAS,IAAI,EAAE,MAAM,KAAK,OAAO;AAChD,gBAAM,SAAS,SAAS,IAAI,EAAE,MAAM,KAAK,OAAO;AAChD,iBAAO,SAAS;AAAA,QAClB,CAAC;AAAA,MACH;AAAA,MAEQ,kBAAkB,OAAkE;AAC1F,cAAM,MAAM,oBAAI,IAAmC;AACnD,mBAAW,QAAQ,MAAM,OAAO;AAC9B,cAAI,KAAK,WAAW,SAAS,GAAG;AAC9B,gBAAI,IAAI,KAAK,QAAQ,KAAK,UAAU;AAAA,UACtC;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,MAEA,MAAc,oBACZ,YACA,YACA,gBAC2B;AAC3B,cAAM,MAAM,oBAAI,IAAiB;AACjC,YAAI;AACF,gBAAM,WAAoC;AAAA,YACxC,QAAQ,CAAC,MAAM,UAAU;AAAA,YACzB,SAAS,EAAE,UAAU,KAAK;AAAA,UAC5B;AAIA,cAAI,eAAgB,UAAS,QAAQ,EAAE,iBAAiB,eAAe;AACvE,gBAAM,UAAU,MAAM,KAAK,OAAO,KAAK,YAAY,QAAe;AAClE,qBAAW,UAAU,WAAW,CAAC,GAAG;AAClC,kBAAM,MAAM,OAAO,OAAO,UAAU,KAAK,EAAE;AAC3C,gBAAI,KAAK;AACP,kBAAI,IAAI,KAAK,MAAM;AAAA,YACrB;AAAA,UACF;AAAA,QACF,QAAQ;AAAA,QAER;AACA,eAAO;AAAA,MACT;AAAA,MAEQ,oBAAoB,OAAwB;AAElD,YAAI,kEAAkE,KAAK,KAAK,GAAG;AACjF,iBAAO;AAAA,QACT;AAEA,YAAI,kBAAkB,KAAK,KAAK,GAAG;AACjC,iBAAO;AAAA,QACT;AACA,eAAO;AAAA,MACT;AAAA,MAEQ,UAAU,QAAiC;AACjD,YAAI,CAAC,OAAQ,QAAO;AACpB,eAAO,OAAO,OAAO,MAAM,OAAO,OAAO,EAAE;AAAA,MAC7C;AAAA,MAEQ,iBAAiB,QAA0B,YAAsC;AACvF,eAAO;AAAA,UACL,SAAS;AAAA,UACT,QAAQ,OAAO;AAAA,UACf,iBAAiB,EAAE,OAAO,CAAC,GAAG,aAAa,CAAC,GAAG,sBAAsB,CAAC,EAAE;AAAA,UACxE,SAAS,CAAC;AAAA,UACV,QAAQ,CAAC;AAAA,UACT,SAAS;AAAA,YACP,kBAAkB;AAAA,YAClB,cAAc;AAAA,YACd,eAAe;AAAA,YACf,cAAc;AAAA,YACd,cAAc;AAAA,YACd,cAAc;AAAA,YACd,yBAAyB;AAAA,YACzB,yBAAyB;AAAA,YACzB,yBAAyB;AAAA,YACzB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MAEQ,YACN,QACA,OACA,SACA,QACA,YACkB;AAClB,cAAM,UAAU;AAAA,UACd,kBAAkB,QAAQ;AAAA,UAC1B,cAAc,QAAQ,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,OAAO,CAAC;AAAA,UACzD,eAAe,QAAQ,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,UAAU,CAAC;AAAA,UAC7D,cAAc,QAAQ,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,SAAS,CAAC;AAAA,UAC3D,cAAc,QAAQ,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,SAAS,CAAC;AAAA,UAC3D,cAAc,QAAQ,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,SAAS,CAAC;AAAA,UAC3D,yBAAyB,QAAQ,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,oBAAoB,CAAC;AAAA,UACjF,yBAAyB,QAAQ,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,oBAAoB,CAAC;AAAA,UACjF,yBAAyB,MAAM,qBAAqB;AAAA,UACpD;AAAA,QACF;AAEA,cAAM,YAAY,OAAO,SAAS,KAAK,QAAQ,eAAe;AAE9D,eAAO;AAAA,UACL,SAAS,CAAC;AAAA,UACV,QAAQ,OAAO;AAAA,UACf,iBAAiB;AAAA,UACjB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AA5SE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAnaW,mBAmaa,eAAe,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE;AAnahE,IAAM,oBAAN;AAAA;AAAA;;;ACbP;AAAA,EACE;AAAA,OAGK;AA0SP,SAAS,iBACP,IACA,QACA,QACA,YACA,KACA,MACA,UACA,QACM;AACN,QAAM,KAAK,GAAG,sBAAsB,QAAQ,UAAU,eAAe;AACnE,QAAI,CAAC,KAAK,IAAI,QAAQ,GAAG;AACvB,YAAM,IAAI;AAAA,QACR,eAAe,QAAQ,oBAAoB,OAAO,IAAI,KAAK,OAAO,IAAI,6BAA6B,UAAU,MAAM,MAAM;AAAA,MAC3H;AAAA,IACF;AACA,UAAM,SAAS,IAAI;AACnB,QAAI,CAAC,UAAU,OAAO,OAAO,WAAW,YAAY;AAClD,YAAM,IAAI,aAAa,0BAA0B,OAAO,IAAI,KAAK,OAAO,IAAI,GAAG;AAAA,IACjF;AACA,UAAM,OAAO,WAAW,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;AAC7C,UAAM,QAAS,OAAO,OAAkD,UAAU;AAClF,UAAM,IAAI,MAAM,MAAM;AACtB,QAAI,OAAO,MAAM,YAAY;AAC3B,YAAM,IAAI,aAAa,mBAAmB,UAAU,MAAM,MAAM,kBAAkB;AAAA,IACpF;AACA,UAAM,MAAM,MAAM,QAAQ,QAAQ,EAAE,MAAM,OAAO,IAAI,CAAC;AACtD,WAAO,aAAa,IAAI,GAAG;AAAA,EAC7B,CAAC;AACD,KAAG,QAAQ,QAAQ,QAAQ,EAAE;AAC7B,KAAG,QAAQ;AACb;AAGA,SAAS,aAAa,IAAyB,GAA2B;AACxE,QAAM,OAAO,KAAK,UAAU,KAAK,IAAI;AACrC,QAAM,IAAI,GAAG,SAAS,IAAI,IAAI,GAAG;AACjC,MAAI,EAAE,OAAO;AACX,UAAM,MAAM,GAAG,KAAK,EAAE,KAAK;AAC3B,MAAE,MAAM,QAAQ;AAChB,UAAM,IAAI,aAAa,iCAAiC,UAAU,GAAG,CAAC,EAAE;AAAA,EAC1E;AACA,SAAO,EAAE;AACX;AAEA,SAAS,cAAc,IAAyB,MAAc,GAAkB;AAC9E,QAAM,OAAO,KAAK,UAAU,KAAK,IAAI;AACrC,QAAM,SAAS,GAAG,SAAS,IAAI,IAAI,GAAG;AACtC,MAAI,OAAO,OAAO;AAChB,WAAO,MAAM,QAAQ;AACrB;AAAA,EACF;AACA,KAAG,QAAQ,GAAG,QAAQ,MAAM,OAAO,KAAK;AACxC,SAAO,MAAM,QAAQ;AACvB;AAEA,SAAS,cAAc,IAAyB,QAAuB,KAAa,GAAkB;AACpG,QAAM,OAAO,KAAK,UAAU,KAAK,IAAI;AACrC,QAAM,SAAS,GAAG,SAAS,IAAI,IAAI,GAAG;AACtC,MAAI,OAAO,OAAO;AAChB,WAAO,MAAM,QAAQ;AACrB,OAAG,QAAQ,QAAQ,KAAK,GAAG,IAAI;AAC/B;AAAA,EACF;AACA,KAAG,QAAQ,QAAQ,KAAK,OAAO,KAAK;AACpC,SAAO,MAAM,QAAQ;AACvB;AAUA,SAAS,iBAAiB,IAA8D;AACtF,MAAI;AACF,UAAM,IAAI,GAAG,SAAS,oEAAoE;AAC1F,QAAI,EAAE,OAAO;AACX,QAAE,MAAM,QAAQ;AAChB,aAAO;AAAA,IACT;AACA,UAAM,IAAI,GAAG,KAAK,EAAE,KAAK;AACzB,MAAE,MAAM,QAAQ;AAChB,QAAI,OAAO,MAAM,YAAY,MAAM,OAAQ,QAAO;AAClD,UAAM,SAAS,cAAc,CAAC;AAC9B,WAAO,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,IAC/D,SACD;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,GAAgC;AACrD,MAAI,MAAM,UAAa,MAAM,GAAI,QAAO;AACxC,MAAI;AACF,WAAO,KAAK,MAAM,CAAC;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAA2B;AAClC,MAAI,OAAO,WAAW,QAAQ,eAAe,WAAY,QAAO,WAAW,OAAO,WAAW;AAE7F,QAAM,IAAI,MAAM,KAAK,MAAM,KAAK,OAAO,IAAI,UAAW,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACpF,SAAO,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAClG;AAEA,SAAS,UAAU,KAAsB;AACvC,MAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,UAAM,IAAI;AACV,QAAI,EAAE,QAAS,QAAO,GAAG,EAAE,QAAQ,OAAO,KAAK,EAAE,OAAO;AACxD,WAAO,KAAK,UAAU,GAAG;AAAA,EAC3B;AACA,SAAO,OAAO,GAAG;AACnB;AA9bA,IAwCM,yBACA,2BACA,mBAWO,qBA2YA;AAhcb;AAAA;AAAA;AAwCA,IAAM,0BAA0B;AAChC,IAAM,4BAA4B;AAClC,IAAM,oBAAoB;AAWnB,IAAM,sBAAN,MAAkD;AAAA,MAGvD,YAAY,OAAmC,CAAC,GAAG;AACjD,aAAK,OAAO;AAAA,UACV,eAAe,KAAK,iBAAiB;AAAA,UACrC,iBAAiB,KAAK,mBAAmB;AAAA,UACzC,UAAU,KAAK,YAAY;AAAA,QAC7B;AAAA,MACF;AAAA,MAEA,MAAM,eACJ,MACA,KACA,MACuB;AACvB,eAAO,KAAK,QAAQ;AAAA,UAClB,cAAc;AAAA,UACd,QAAQ,KAAK;AAAA,UACb,cAAc,CAAC;AAAA,UACf,WAAW,KAAK,eAAe,MAAM,MAAS;AAAA,UAC9C,UAAU,KAAK,KAAK;AAAA,UACpB;AAAA,UACA,QAAQ,KAAK;AAAA,QACf,CAAC;AAAA,MACH;AAAA,MAEA,MAAM,UACJ,MACA,KACA,MACuB;AACvB,eAAO,KAAK,QAAQ;AAAA,UAClB,cAAc;AAAA,UACd,QAAQ,KAAK;AAAA,UACb,cAAc,KAAK;AAAA,UACnB,WAAW,KAAK,eAAe,MAAM,KAAK,SAAS;AAAA,UACnD,UAAU,KAAK,YAAY,KAAK,KAAK;AAAA,UACrC;AAAA,UACA,QAAQ,KAAK;AAAA,QACf,CAAC;AAAA,MACH;AAAA,MAEA,IAAI,MAAgB,KAAoB,MAA+C;AACrF,eAAO,KAAK,aAAa,eACrB,KAAK,eAAe,MAAM,KAAK,IAAI,IACnC,KAAK,UAAU,MAAM,KAAK,IAAI;AAAA,MACpC;AAAA,MAEA,MAAM,UAAyB;AAAA,MAE/B;AAAA;AAAA,MAGQ,eAAe,MAAwB,eAA2C;AACxF,cAAM,MAAM,KAAK,OAAO,SAAS,SAAS,KAAK,KAAK,gBAAgB,KAAK,KAAK;AAC9E,eAAO,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,aAAa,EAAE,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,CAAC;AAAA,MAC3G;AAAA,MAEA,MAAc,QAAQ,MAQI;AAKxB,cAAM,KAAK,MAAM,gBAAgB;AACjC,cAAM,UAAU,GAAG;AACnB,gBAAQ,eAAe,KAAK,WAAW,OAAO,IAAI;AAClD,gBAAQ,gBAAgB,MAAM,IAAI;AAElC,cAAM,QAAQ,KAAK,IAAI;AACvB,cAAM,WAAW,QAAQ,KAAK;AAC9B,gBAAQ,oBAAoB,MAAM,KAAK,IAAI,IAAI,QAAQ;AAEvD,YAAI;AACF,eAAK,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,YAAY,GAAG,KAAK,MAAM;AAGrE,cAAI,KAAK,cAAc;AACrB,kBAAMA,WAAU,6DAA6D,KAAK,MAAM;AACxF,kBAAM,SAAS,GAAG,SAASA,QAAO;AAClC,gBAAI,OAAO,OAAO;AAChB,oBAAM,MAAM,GAAG,KAAK,OAAO,KAAK;AAChC,qBAAO,MAAM,QAAQ;AACrB,oBAAM,IAAI,aAAa,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,YAAY,UAAU,GAAG,CAAC,EAAE;AAAA,YAC7F;AACA,mBAAO,MAAM,QAAQ;AACrB,kBAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,UAAU;AAC7C,kBAAM,SAAS,GAAG,KAAK,IAAI;AAC3B,iBAAK,QAAQ;AACb,kBAAM,QAAQ,WAAW,UAAa,WAAW,QAAQ,WAAW,SAChE,SACA,cAAc,MAAM;AACxB,mBAAO,EAAE,OAAO,YAAY,KAAK,IAAI,IAAI,MAAM;AAAA,UACjD;AAOA,gBAAM,UAAU,KAAK,OAAO,SAAS,SACjC;AAAA,gCACsB,KAAK,MAAM;AAAA;AAAA;AAAA,kBAIjC;AAAA,uCAC6B,KAAK,MAAM;AAAA;AAAA;AAAA;AAK5C,gBAAM,UAAU,MAAM,GAAG,cAAc,OAAO;AAC9C,cAAI,QAAQ,OAAO;AACjB,kBAAM,MAAM,GAAG,KAAK,QAAQ,KAAK;AACjC,oBAAQ,MAAM,QAAQ;AACtB,kBAAM,IAAI,aAAa,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,YAAY,UAAU,GAAG,CAAC,EAAE;AAAA,UAC7F;AACA,kBAAQ,MAAM,QAAQ;AAEtB,cAAI,QAAQ;AACZ,iBAAO,QAAQ,KAAM;AAEnB,kBAAM,IAAI,QAAc,CAACC,aAAY,aAAaA,QAAO,CAAC;AAE1D,kBAAM,UAAU,QAAQ,mBAAmB;AAC3C,gBAAI,QAAQ,OAAO;AACjB,oBAAM,MAAM,GAAG,KAAK,QAAQ,KAAK;AACjC,sBAAQ,MAAM,QAAQ;AACtB,oBAAM,IAAI,aAAa,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,YAAY,UAAU,GAAG,CAAC,EAAE;AAAA,YAC7F;AAEA,kBAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,SAAS;AAC5C,kBAAM,SAAS,GAAG,KAAK,IAAI;AAC3B,iBAAK,QAAQ;AACb,gBAAI,QAAQ;AACV,oBAAM,IAAI,aAAa,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,YAAY,MAAM,EAAE;AAAA,YACrF;AAEA,kBAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,UAAU;AAC7C,kBAAM,SAAS,GAAG,KAAK,IAAI;AAC3B,iBAAK,QAAQ;AACb,gBAAI,WAAW,UAAa,WAAW,MAAM;AAC3C,oBAAM,QAAQ,WAAW,SAAS,SAAY,cAAc,MAAM;AAElE,oBAAM,eAAe,iBAAiB,EAAE;AACxC,qBAAO,EAAE,OAAO,cAAc,YAAY,KAAK,IAAI,IAAI,MAAM;AAAA,YAC/D;AAEA,gBAAI,KAAK,IAAI,IAAI,UAAU;AACzB,oBAAM,IAAI;AAAA,gBACR,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,yBAAyB,KAAK,SAAS;AAAA,cACjF;AAAA,YACF;AACA;AAAA,UACF;AACA,gBAAM,IAAI;AAAA,YACR,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,2BAA2B,KAAK;AAAA,UAC1E;AAAA,QACF,UAAE;AAGA,aAAG,QAAQ;AAAA,QACb;AAAA,MACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAUQ,WACN,IACA,KACA,MACA,QACM;AACN,sBAAc,IAAI,WAAW,IAAI,KAAK;AACtC,sBAAc,IAAI,cAAc,IAAI,QAAQ;AAE5C,cAAM,SAAS,GAAG,UAAU;AAC5B,sBAAc,IAAI,QAAQ,SAAS,IAAI,KAAK;AAC5C,sBAAc,IAAI,QAAQ,YAAY,IAAI,QAAQ;AAClD,sBAAc,IAAI,QAAQ,QAAQ,IAAI,IAAI;AAC1C,sBAAc,IAAI,QAAQ,WAAW,IAAI,OAAO;AAChD,YAAI,OAAO,IAAI,UAAU,UAAU;AACjC,gBAAM,MAAM,GAAG,UAAU,IAAI,KAAK;AAClC,aAAG,QAAQ,QAAQ,SAAS,GAAG;AAC/B,cAAI,QAAQ;AAAA,QACd;AACA,YAAI,OAAO,IAAI,WAAW,UAAU;AAClC,gBAAM,MAAM,GAAG,UAAU,IAAI,MAAM;AACnC,aAAG,QAAQ,QAAQ,UAAU,GAAG;AAChC,cAAI,QAAQ;AAAA,QACd;AACA,YAAI,OAAO,IAAI,aAAa,UAAU;AACpC,gBAAM,MAAM,GAAG,UAAU,IAAI,QAAQ;AACrC,aAAG,QAAQ,QAAQ,YAAY,GAAG;AAClC,cAAI,QAAQ;AAAA,QACd;AACA,YAAI,IAAI,WAAW,QAAW;AAC5B,wBAAc,IAAI,QAAQ,UAAU,IAAI,MAAM;AAAA,QAChD;AACA,YAAI,IAAI,WAAW,QAAW;AAC5B,wBAAc,IAAI,QAAQ,UAAU,IAAI,MAAM;AAAA,QAChD;AAEA,cAAM,SAAS,GAAG,UAAU;AAC5B,cAAM,WAAW,GAAG,YAAY,UAAU,CAAC,UAAU;AACnD,gBAAM,aAAa,GAAG,UAAU,KAAK;AACrC,gBAAM,OAAO,GAAG,UAAU;AAC1B,gBAAM,OAAO,CAAC,QAAQ,WAAW,SAAS,WAAW;AACrD,gBAAM,QAAQ,CAAC,UAAU,UAAU,UAAU,cAAc,cAAc,QAAQ;AACjF,qBAAW,KAAK,KAAM,kBAAiB,IAAI,MAAM,GAAG,YAAY,KAAK,MAAM,YAAY,MAAM;AAC7F,qBAAW,KAAK,MAAO,kBAAiB,IAAI,MAAM,GAAG,YAAY,KAAK,MAAM,aAAa,MAAM;AAC/F,iBAAO;AAAA,QACT,CAAC;AACD,WAAG,QAAQ,QAAQ,UAAU,QAAQ;AACrC,iBAAS,QAAQ;AACjB,WAAG,QAAQ,QAAQ,OAAO,MAAM;AAChC,eAAO,QAAQ;AAEf,cAAM,SAAS,GAAG,UAAU;AAC5B,mBAAW,SAAS,CAAC,QAAQ,QAAQ,OAAO,GAAY;AACtD,gBAAM,KAAK,GAAG,YAAY,OAAO,CAAC,MAAM,UAAU;AAChD,gBAAI,CAAC,KAAK,IAAI,KAAK,GAAG;AACpB,oBAAM,IAAI,aAAa,mCAAmC,OAAO,IAAI,KAAK,OAAO,IAAI,GAAG;AAAA,YAC1F;AACA,kBAAM,MAAM,GAAG,UAAU,IAAI;AAC7B,kBAAM,OAAO,QAAQ,cAAc,GAAG,UAAU,KAAK,CAAC,IAAI;AAC1D,gBAAI,MAAM,KAAK,IAAI,KAAK,IAAI;AAC5B,mBAAO,GAAG;AAAA,UACZ,CAAC;AACD,aAAG,QAAQ,QAAQ,OAAO,EAAE;AAC5B,aAAG,QAAQ;AAAA,QACb;AACA,WAAG,QAAQ,QAAQ,OAAO,MAAM;AAChC,eAAO,QAAQ;AAEf,cAAM,YAAY,GAAG,UAAU;AAC/B,cAAM,SAAS,GAAG,YAAY,cAAc,MAAM;AAChD,cAAI,CAAC,KAAK,IAAI,aAAa,GAAG;AAC5B,kBAAM,IAAI,aAAa,2CAA2C,OAAO,IAAI,KAAK,OAAO,IAAI,GAAG;AAAA,UAClG;AACA,gBAAM,IAAI,IAAI,QAAQ,aAAa,KAAK,iBAAiB;AACzD,iBAAO,GAAG,UAAU,CAAC;AAAA,QACvB,CAAC;AACD,WAAG,QAAQ,WAAW,cAAc,MAAM;AAC1C,eAAO,QAAQ;AACf,WAAG,QAAQ,QAAQ,UAAU,SAAS;AACtC,kBAAU,QAAQ;AAElB,WAAG,QAAQ,GAAG,QAAQ,SAAS,MAAM;AACrC,eAAO,QAAQ;AAAA,MACjB;AAAA,IACF;AAiIO,IAAM,eAAN,cAA2B,MAAM;AAAA,MACtC,YAAY,SAAiB;AAC3B,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAAA;AAAA;;;AClaA,SAAS,sBAAsB;AASxB,SAAS,sBACd,QACA,MACiE;AACjE,SAAO,CAAC,SAAe;AACrB,UAAM,MAAO,KAAa;AAC1B,QAAI,CAAC,IAAK,QAAO;AAEjB,UAAM,SAAS,eAAe,UAAU,GAAG;AAC3C,QAAI,CAAC,OAAO,SAAS;AACnB,WAAK,QAAQ,OAAO,wCAAwC;AAAA,QAC1D,OAAO,KAAK;AAAA,QACZ,MAAM,KAAK;AAAA,QACX,QAAQ,OAAO,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,MACxC,CAAC;AACD,aAAO;AAAA,IACT;AACA,UAAM,OAAO,OAAO;AAEpB,WAAO,eAAe,iBAAiB,WAA+B;AACpE,YAAM,aAAa,oBAAoB,WAAW,KAAK,EAAE;AACzD,UAAI;AACF,aAAK,QAAQ,QAAQ,2BAA2B,EAAE,OAAO,KAAK,OAAO,MAAM,KAAK,KAAK,CAAC;AACtF,cAAM,SAAS,MAAM,OAAO,IAAI,MAAM,YAAY;AAAA,UAChD,QAAQ;AAAA,YACN,MAAM;AAAA,YACN,MAAM,KAAK;AAAA,YACX,QAAQ,OAAQ,KAAa,WAAW,WAAY,KAAa,SAAS;AAAA,UAC5E;AAAA,UACA,WAAY,KAAa,aAAa;AAAA,QACxC,CAAC;AACD,8BAAsB,WAAW,MAAM;AAAA,MACzC,SAAS,KAAU;AACjB,aAAK,QAAQ,QAAQ,qCAAqC,KAAK;AAAA,UAC7D,OAAO,KAAK;AAAA,UACZ,MAAM,KAAK;AAAA,QACb,CAAC;AACD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AASO,SAAS,wBACd,QACA,MAGY;AACZ,SAAO,CAAC,WAAW;AACjB,UAAM,MAAM,OAAO;AACnB,QAAI,CAAC,IAAK,QAAO;AAEjB,UAAM,SAAS,eAAe,UAAU,GAAG;AAC3C,QAAI,CAAC,OAAO,SAAS;AACnB,WAAK,QAAQ,OAAO,0CAA0C;AAAA,QAC5D,OAAO,KAAK;AAAA,QACZ,QAAQ,OAAO;AAAA,QACf,QAAQ,OAAO,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,MACxC,CAAC;AACD,aAAO;AAAA,IACT;AACA,UAAM,OAAO,OAAO;AAEpB,WAAO,eAAe,mBAAmB,WAAkC;AACzE,YAAM,aAAa,0BAA0B,WAAW,KAAK,EAAE;AAC/D,UAAI;AACF,aAAK,QAAQ,QAAQ,6BAA6B;AAAA,UAChD,OAAO,KAAK;AAAA,UACZ,QAAQ,OAAO;AAAA,UACf,QAAQ,OAAO;AAAA,QACjB,CAAC;AACD,cAAM,SAAS,MAAM,OAAO,IAAI,MAAM,YAAY;AAAA,UAChD,QAAQ,EAAE,MAAM,UAAU,MAAM,OAAO,MAAM,QAAQ,OAAO,OAAO;AAAA,UACnE,WAAY,KAAa,aAAa,OAAO,aAAa;AAAA,QAC5D,CAAC;AACD,eAAO,OAAO;AAAA,MAChB,SAAS,KAAU;AACjB,aAAK,QAAQ,QAAQ,uCAAuC,KAAK;AAAA,UAC/D,OAAO,KAAK;AAAA,UACZ,QAAQ,OAAO;AAAA,QACjB,CAAC;AACD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,WAAgB,QAA4B;AACzE,QAAM,SAAS,WAAW;AAC1B,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU;AAC3C,MAAI,OAAO,gBAAgB,OAAO,OAAO,iBAAiB,UAAU;AAClE,WAAO,OAAO,QAAQ,OAAO,YAAY;AAAA,EAC3C;AACA,MACE,OAAO,SACP,OAAO,OAAO,UAAU,YACxB,CAAC,MAAM,QAAQ,OAAO,KAAK,GAC3B;AACA,WAAO,OAAO,QAAQ,OAAO,KAAK;AAAA,EACpC;AACF;AAEA,SAAS,sBAAsB,IAAS,YAAoB;AAK1D,SAAO;AAAA,IACL,MAAM,KAAK,MAAY;AAAE,aAAO,GAAG,KAAK,YAAY,IAAI;AAAA,IAAG;AAAA,IAC3D,MAAM,QAAQ,MAAY;AACxB,YAAM,OAAO,MAAM,GAAG,KAAK,YAAY,IAAI;AAC3C,aAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,CAAC,KAAK,OAAO;AAAA,IACjD;AAAA,IACA,MAAM,MAAM,MAAY;AACtB,UAAI,OAAO,GAAG,UAAU,WAAY,QAAO,GAAG,MAAM,YAAY,IAAI;AACpE,YAAM,OAAO,MAAM,GAAG,KAAK,YAAY,IAAI;AAC3C,aAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,SAAS;AAAA,IAC7C;AAAA,IACA,MAAM,OAAO,MAAW;AAAE,aAAO,GAAG,OAAO,YAAY,IAAI;AAAA,IAAG;AAAA,IAC9D,MAAM,OAAO,MAAW,MAAY;AAAE,aAAO,GAAG,OAAO,YAAY,MAAM,IAAI;AAAA,IAAG;AAAA,IAChF,MAAM,OAAO,MAAW,MAAY;AAClC,UAAI,OAAO,GAAG,WAAW,WAAY,QAAO,GAAG,OAAO,YAAY,MAAM,IAAI;AAC5E,aAAO,GAAG,OAAO,YAAY,IAAI;AAAA,IACnC;AAAA,IACA,MAAM,OAAO,MAAY;AAAE,aAAO,GAAG,OAAO,YAAY,IAAI;AAAA,IAAG;AAAA,EACjE;AACF;AAEA,SAAS,gBAAgB,WAAgB,IAAS,UAAkB;AAClE,QAAM,YAAY,WAAW;AAC7B,MAAI,aAAa,OAAO,UAAU,WAAW,WAAY,QAAO;AAChE,SAAO;AAAA,IACL,QAAQ,CAAC,eAAuB;AAC9B,UAAI,CAAC,GAAI,OAAM,IAAI,MAAM,kCAAkC,QAAQ,EAAE;AAIrE,UAAI,OAAO,GAAG,WAAW,YAAY;AACnC,YAAI;AAAE,iBAAO,GAAG,OAAO,UAAU;AAAA,QAAG,QAAQ;AAAA,QAAqB;AAAA,MACnE;AACA,aAAO,sBAAsB,IAAI,UAAU;AAAA,IAC7C;AAAA,EACF;AACF;AAEA,SAAS,oBAAoB,WAAgB,IAAwB;AACnE,QAAM,gBAAgB,mBAAmB,WAAW,SAAS,WAAW,GAAG;AAC3E,QAAM,cAAc,WAAW,YAAY,WAAW;AACtD,SAAO;AAAA,IACL,OAAO,iBAAiB,CAAC;AAAA;AAAA;AAAA,IAGzB,UAAU,mBAAmB,WAAW;AAAA,IACxC,MAAM,WAAW,QAAQ,WAAW,SAAS;AAAA,IAC7C,SAAS,WAAW;AAAA,IACpB,OAAO,OAAO,WAAW,UAAU,WAAW,UAAU,QAAQ;AAAA,IAChE,QAAQ,OAAO,WAAW,WAAW,WAAW,UAAU,SAAS;AAAA,IACnE,QAAQ,WAAW;AAAA,IACnB,KAAK,gBAAgB,WAAW,IAAI,WAAW;AAAA,IAC/C,KAAK,WAAW;AAAA,IAChB,QAAQ,WAAW;AAAA,EACrB;AACF;AAEA,SAAS,0BAA0B,WAAgB,IAAwB;AAKzE,QAAM,WACJ,OAAO,WAAW,aAAa,WAC3B,UAAU,WACV,OAAO,WAAW,QAAQ,OAAO,WAC/B,UAAU,OAAO,KACjB;AACR,SAAO;AAAA,IACL,OAAO,mBAAmB,WAAW,UAAU,CAAC,CAAC;AAAA,IACjD,UAAU;AAAA,IACV,MAAM,WAAW,QAAQ,WAAW,SAAS;AAAA,IAC7C,SAAS,WAAW;AAAA,IACpB,QAAQ,OAAO,WAAW,WAAW,WAAW,UAAU,SAAS;AAAA,IACnE;AAAA,IACA,QAAQ,mBAAmB,WAAW,MAAM;AAAA,IAC5C,KAAK,gBAAgB,WAAW,IAAI,aAAa;AAAA,IACjD,KAAK,WAAW;AAAA,IAChB,QAAQ,WAAW;AAAA,EACrB;AACF;AAOA,SAAS,mBAAmB,GAAiD;AAC3E,MAAI,MAAM,UAAa,MAAM,KAAM,QAAO;AAC1C,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,MAAI,MAAM,QAAQ,CAAC,EAAG,QAAO;AAC7B,MAAI;AACF,WAAO,OAAO,YAAY,OAAO,QAAQ,CAA4B,CAAC;AAAA,EACxE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA/PA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+lBO,SAAS,mBAAmB,QAAoB;AACnD,QAAM,MAAa,CAAC;AACpB,QAAM,OAAO,oBAAI,IAAS;AAC1B,QAAM,OAAO,CAAC,QAAa;AACvB,QAAI,CAAC,MAAM,QAAQ,GAAG,EAAG;AACzB,eAAW,KAAK,KAAK;AACjB,UAAI,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG;AACnB,aAAK,IAAI,CAAC;AACV,YAAI,KAAK,CAAC;AAAA,MACd;AAAA,IACJ;AAAA,EACJ;AACA,OAAK,QAAQ,KAAK;AAClB,OAAK,QAAQ,UAAU,KAAK;AAC5B,SAAO;AACX;AAWO,SAAS,qBACZ,QAC6F;AAC7F,QAAM,MAAa,CAAC;AACpB,QAAM,OAAO,oBAAI,IAAS;AAC1B,QAAM,OAAO,CAAC,KAAU,iBAA0B;AAC9C,QAAI,CAAC,MAAM,QAAQ,GAAG,EAAG;AACzB,eAAW,KAAK,KAAK;AACjB,UAAI,CAAC,KAAK,OAAO,MAAM,YAAY,OAAO,EAAE,SAAS,SAAU;AAC/D,UAAI,KAAK,IAAI,CAAC,EAAG;AACjB,WAAK,IAAI,CAAC;AACV,YAAM,iBACF,OAAO,EAAE,WAAW,WAAW,EAAE,SAC/B,OAAO,EAAE,eAAe,WAAW,EAAE,aACrC;AACN,UAAI,KAAK,iBAAiB,EAAE,GAAG,GAAG,QAAQ,eAAe,IAAI,EAAE,GAAG,EAAE,CAAC;AAAA,IACzE;AAAA,EACJ;AACA,OAAK,QAAQ,OAAO;AACpB,OAAK,QAAQ,UAAU,OAAO;AAC9B,MAAI,MAAM,QAAQ,QAAQ,OAAO,GAAG;AAChC,eAAW,KAAK,OAAO,QAAS,MAAK,GAAG,SAAS,GAAG,IAAI;AAAA,EAC5D;AACA,MAAI,MAAM,QAAQ,QAAQ,UAAU,OAAO,GAAG;AAC1C,eAAW,KAAK,OAAO,SAAS,QAAS,MAAK,GAAG,SAAS,GAAG,IAAI;AAAA,EACrE;AACA,SAAO;AACX;AAWO,SAAS,uBAAuB,QAAgD;AACnF,QAAM,MAAyC,CAAC;AAChD,QAAM,QAAQ,CAAC,QAAa;AACxB,QAAI,CAAC,IAAK;AACV,QAAI,MAAM,QAAQ,GAAG,GAAG;AACpB,iBAAW,QAAQ,KAAK;AACpB,YAAI,QAAQ,OAAO,KAAK,SAAS,YAAY,OAAO,KAAK,YAAY,YAAY;AAC7E,cAAI,KAAK,IAAI,IAAI,KAAK;AAAA,QAC1B;AAAA,MACJ;AAAA,IACJ,WAAW,OAAO,QAAQ,UAAU;AAChC,iBAAW,CAAC,MAAM,EAAE,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC1C,YAAI,OAAO,OAAO,WAAY,KAAI,IAAI,IAAI;AAAA,MAC9C;AAAA,IACJ;AAAA,EACJ;AACA,QAAM,QAAQ,SAAS;AACvB,QAAM,QAAQ,UAAU,SAAS;AACjC,SAAO;AACX;AAlrBA,IAkCa;AAlCb;AAAA;AAAA;AAGA;AAEA;AACA;AA4BO,IAAM,YAAN,MAAkC;AAAA,MAQrC,YAAY,QAAa,gBAA0C;AANnE,oBAAO;AAiBP,oBAAO,OAAO,QAAuB;AACjC,gBAAM,MAAM,KAAK,OAAO,YAAY,KAAK;AACzC,gBAAM,QAAQ,IAAI,MAAM,IAAI;AAE5B,cAAI,OAAO,KAAK,2BAA2B;AAAA,YACvC;AAAA,YACA,YAAY,KAAK;AAAA,YACjB,SAAS,KAAK;AAAA,UAClB,CAAC;AAID,gBAAM,iBAAiB,KAAK,OAAO,WAC7B,EAAE,GAAG,KAAK,OAAO,UAAU,GAAG,KAAK,OAAO,IAC1C,KAAK;AAEX,kBAAQ;AAAA,YACJ,0BAA0B,KAAK,SAAS,OAAO,KAAK,cAAc,EAAE,KAAK,GAAG,CAAC,UAAU,MAAM,QAAS,eAAuB,KAAK,IAAK,eAAuB,MAAM,SAAS,KAAK;AAAA,UACtL;AAEA,cAAI,WAAuC,UAAU,EAAE,SAAS,cAAc;AAAA,QAClF;AAEA,qBAAQ,OAAO,QAAuB;AAClC,gBAAM,MAAM,KAAK,OAAO,YAAY,KAAK;AACzC,gBAAM,QAAQ,IAAI,MAAM,IAAI;AAM5B,cAAI;AACJ,cAAI;AACA,iBAAK,IAAI,WAAW,UAAU;AAAA,UAClC,QAAQ;AAAA,UAER;AAEA,cAAI,CAAC,IAAI;AACL,gBAAI,OAAO,KAAK,qCAAqC;AAAA,cACjD,SAAS,KAAK;AAAA,cACd;AAAA,YACJ,CAAC;AACD;AAAA,UACJ;AAEA,cAAI,OAAO,MAAM,qCAAqC,EAAE,MAAM,CAAC;AAG/D,cAAI,KAAK,OAAO,qBAAqB,MAAM,QAAQ,KAAK,OAAO,iBAAiB,GAAG;AAC/E,gBAAI,OAAO,KAAK,wCAAwC;AAAA,cACpD;AAAA,cACA,WAAW,KAAK,OAAO,kBAAkB;AAAA,YAC7C,CAAC;AACD,eAAG,qBAAqB,KAAK,OAAO,iBAAiB;AAAA,UACzD;AAMA,gBAAM,cAAc,KAAK,OAAO,WAAW,KAAK;AAChD,gBAAM,UAAgB,eAAe,OAAO,YAAY,aAAa,aAC/D,cACA,KAAK;AAEX,cAAI,WAAW,OAAO,QAAQ,aAAa,YAAY;AAClD,gBAAI,OAAO,KAAK,8BAA8B;AAAA,cAC1C,SAAS,KAAK;AAAA,cACd;AAAA,YACJ,CAAC;AAGD,kBAAM,cAAc;AAAA,cACjB,GAAG;AAAA,cACH;AAAA,cACA,QAAQ,IAAI;AAAA,cACZ,SAAS;AAAA,gBACL,UAAU,CAAC,WAAgB;AACvB,sBAAI,OAAO,MAAM,sCAAsC;AAAA,oBACnD,YAAY,OAAO;AAAA,oBACnB;AAAA,kBACJ,CAAC;AACD,qBAAG,eAAe,MAAM;AAAA,gBAC5B;AAAA,cACJ;AAAA,YACH;AAEA,kBAAM,QAAQ,SAAS,WAAW;AAClC,gBAAI,OAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC;AAAA,UAC7D,OAAO;AACF,gBAAI,OAAO,MAAM,sCAAsC,EAAE,MAAM,CAAC;AAAA,UACrE;AAaA,cAAI;AACA,kBAAM,QAAQ,mBAAmB,KAAK,MAAM;AAC5C,kBAAM,YAAY,uBAAuB,KAAK,MAAM;AACpD,gBAAI,MAAM,SAAS,KAAK,OAAO,KAAK,SAAS,EAAE,SAAS,GAAG;AACvD,kBAAI,OAAO,GAAG,cAAc,YAAY;AACpC,mBAAG,UAAU,OAAO;AAAA,kBAChB,WAAW,OAAO,KAAK;AAAA,kBACvB;AAAA,kBACA,YAAY,sBAAsB,IAAI,oBAAoB,GAAG;AAAA,oBACzD;AAAA,oBACA,QAAQ,IAAI;AAAA,oBACZ;AAAA,kBACJ,CAAC;AAAA,gBACL,CAAC;AACD,oBAAI,OAAO,KAAK,uCAAuC;AAAA,kBACnD;AAAA,kBACA,WAAW,MAAM;AAAA,kBACjB,eAAe,OAAO,KAAK,SAAS,EAAE;AAAA,gBAC1C,CAAC;AAAA,cACL,OAAO;AACH,oBAAI,OAAO,KAAK,mEAAmE;AAAA,kBAC/E;AAAA,kBACA,WAAW,MAAM;AAAA,gBACrB,CAAC;AAAA,cACL;AAAA,YACJ;AAAA,UACJ,SAAS,KAAU;AACf,gBAAI,OAAO,MAAM,gDAAgD,KAAc;AAAA,cAC3E;AAAA,YACJ,CAAC;AAAA,UACL;AAOA,cAAI;AACA,kBAAM,UAAU,qBAAqB,KAAK,MAAM;AAChD,kBAAM,mBAAmB,wBAAwB,IAAI,oBAAoB,GAAG;AAAA,cACxE;AAAA,cACA,QAAQ,IAAI;AAAA,cACZ;AAAA,YACJ,CAAC;AACD,gBAAI,aAAa;AACjB,gBAAI,QAAQ,SAAS,KAAK,OAAO,GAAG,mBAAmB,YAAY;AAC/D,yBAAW,UAAU,SAAS;AAC1B,sBAAM,UAAU,iBAAiB,MAAM;AACvC,oBAAI,CAAC,QAAS;AACd,sBAAM,YACF,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,SAAS,IACtD,OAAO,SACP;AACV,oBAAI;AACA,qBAAG,eAAe,WAAW,OAAO,MAAM,SAAS,OAAO,KAAK,EAAE;AACjE;AAAA,gBACJ,SAAS,KAAU;AACf,sBAAI,OAAO,KAAK,8CAA8C;AAAA,oBAC1D;AAAA,oBACA,QAAQ,OAAO;AAAA,oBACf,QAAQ;AAAA,oBACR,OAAO,KAAK,WAAW,OAAO,GAAG;AAAA,kBACrC,CAAC;AAAA,gBACL;AAAA,cACJ;AAAA,YACJ;AACA,gBAAI,aAAa,GAAG;AAChB,kBAAI,OAAO,KAAK,yCAAyC;AAAA,gBACrD;AAAA,gBACA,aAAa;AAAA,cACjB,CAAC;AAAA,YACL;AAAA,UACJ,SAAS,KAAU;AACf,gBAAI,OAAO,MAAM,kDAAkD,KAAc;AAAA,cAC7E;AAAA,YACJ,CAAC;AAAA,UACL;AAOA,cAAI;AACA,kBAAM,YAAmB,MAAM,QAAQ,KAAK,OAAO,SAAS,IACtD,KAAK,OAAO,YACZ,MAAM,SAAS,KAAK,OAAO,YAAY,CAAC,GAAG,SAAS,IAC/C,KAAK,OAAO,SAAiB,YAC9B,CAAC;AACX,gBAAI,UAAU,SAAS,GAAG;AACtB,kBAAI,KAAK,gBAAgB,YAAY;AACjC,oBAAI;AACJ,oBAAI;AAAE,wBAAM,IAAI,WAAW,WAAW;AAAA,gBAAG,QAAQ;AAAA,gBAAsB;AACvE,oBAAI,CAAC,OAAO,OAAO,IAAI,kBAAkB,YAAY;AACjD,sBAAI,OAAO,KAAK,sFAAiF;AAAA,oBAC7F;AAAA,oBAAO,cAAc,UAAU;AAAA,kBACnC,CAAC;AACD;AAAA,gBACJ;AACA,sBAAM,SAAS,EAAE,UAAU,MAAM,OAAO,CAAC,GAAG,aAAa,CAAC,EAAE;AAC5D,oBAAI,KAAK;AACT,2BAAW,QAAQ,WAAW;AAC1B,sBAAI;AACA,0BAAM,IAAI,cAAc;AAAA,sBACpB,MAAM,KAAK;AAAA,sBACX,OAAO,KAAK;AAAA,sBACZ,QAAQ,KAAK;AAAA,sBACb,aAAa,KAAK;AAAA,sBAClB,QAAQ,KAAK,WAAW;AAAA,sBACxB,YAAY;AAAA,oBAChB,GAAG,MAAM;AACT;AAAA,kBACJ,SAAS,KAAU;AACf,wBAAI,OAAO,KAAK,mDAAmD;AAAA,sBAC/D;AAAA,sBAAO,SAAS,MAAM;AAAA,sBAAM,OAAO,KAAK,WAAW,OAAO,GAAG;AAAA,oBACjE,CAAC;AAAA,kBACL;AAAA,gBACJ;AACA,oBAAI,OAAO,KAAK,6CAA6C,EAAE,OAAO,OAAO,GAAG,CAAC;AAAA,cACrF,CAAC;AAAA,YACL;AAAA,UACJ,SAAS,KAAU;AACf,gBAAI,OAAO,MAAM,gEAAgE,KAAc,EAAE,MAAM,CAAC;AAAA,UAC5G;AAOA,eAAK,iBAAiB,KAAK,kBAAkB,GAAG;AAKhD,gBAAM,KAAK,iBAAiB,KAAK,KAAK;AAItC,gBAAM,eAAsB,CAAC;AAG7B,cAAI,MAAM,QAAQ,KAAK,OAAO,IAAI,GAAG;AACjC,yBAAa,KAAK,GAAG,KAAK,OAAO,IAAI;AAAA,UACzC;AAGA,gBAAM,WAAW,KAAK,OAAO,YAAY,KAAK;AAC9C,cAAI,YAAY,MAAM,QAAQ,SAAS,IAAI,GAAG;AAC1C,yBAAa,KAAK,GAAG,SAAS,IAAI;AAAA,UACtC;AAMA,cAAI,aAAa,SAAS,GAAG;AACxB,gBAAI,OAAO,KAAK,qBAAqB,aAAa,MAAM,sBAAsB,KAAK,EAAE;AAGrF,kBAAM,qBAAqB,aACtB,OAAO,CAAC,MAAW,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,CAAC,EACvD,IAAI,CAAC,OAAY;AAAA,cACd,GAAG;AAAA,cACH,QAAQ,EAAE;AAAA,YACd,EAAE;AAYN,gBAAI;AACA,oBAAM,SAAe,IAAY;AACjC,oBAAM,YAAY,MAAM;AACpB,oBAAI;AAAE,yBAAO,QAAQ,aAAa,eAAe;AAAA,gBAAG,QAAQ;AAAE,yBAAO;AAAA,gBAAW;AAAA,cACpF,GAAG;AACH,oBAAM,SAAS,MAAM,QAAQ,QAAQ,IAC/B,CAAC,GAAG,UAAU,GAAG,kBAAkB,IACnC;AACN,oBAAM,cAAc,CAAC,MAAc,UAAe;AAC9C,oBAAI,QAAQ,gBAAiB,QAAO,gBAAgB,MAAM,KAAK;AAAA,yBACtD,OAAQ,IAAY,oBAAoB,WAAY,CAAC,IAAY,gBAAgB,MAAM,KAAK;AAAA,cACzG;AACA,0BAAY,iBAAiB,MAAM;AAEnC,oBAAM,cAAc,IAAI,WAAW,UAAU;AAC7C,oBAAM,YAAY,IAAI;AACtB,oBAAM,WAAW,OAAO,mBAA2B;AAC/C,oBAAI,CAAC,eAAgB,QAAO,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAW;AAC3E,sBAAM,KAAK,eAAgB,IAAI,WAAW,UAAU;AACpD,oBAAI,CAAC,IAAI;AACL,4BAAU,KAAK,8CAA8C;AAC7D,yBAAO,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAW;AAAA,gBAC1D;AACA,sBAAM,eAAe,MAAM;AACvB,sBAAI;AAAE,2BAAO,QAAQ,aAAa,eAAe;AAAA,kBAAG,QAAQ;AAAE,2BAAO;AAAA,kBAAQ;AAAA,gBACjF,GAAG,KAAK;AACR,oBAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,YAAY,WAAW,GAAG;AACzD,yBAAO,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAW;AAAA,gBAC1D;AACA,sBAAM,aAAa,IAAI,kBAAkB,IAAI,IAAI,SAAS;AAC1D,sBAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,wBAAwB;AACzE,sBAAM,UAAU,wBAAwB,MAAM;AAAA,kBAC1C,UAAU;AAAA,kBACV,QAAQ;AAAA,oBACJ,aAAa;AAAA,oBACb,WAAW;AAAA,oBACX;AAAA,kBACJ;AAAA,gBACJ,CAAC;AACD,sBAAM,SAAS,MAAM,WAAW,KAAK,OAAO;AAC5C,uBAAO;AAAA,kBACH,UAAU,OAAO,QAAQ;AAAA,kBACzB,SAAS,OAAO,QAAQ;AAAA,kBACxB,QAAQ,OAAO;AAAA,gBACnB;AAAA,cACJ;AACA,0BAAY,iBAAiB,QAAQ;AACrC,kBAAI,OAAO,KAAK,uBAAuB,mBAAmB,MAAM,mDAAmD,OAAO,MAAM,GAAG;AAAA,YACvI,SAAS,GAAQ;AACb,kBAAI,OAAO,KAAK,mEAAmE,EAAE,OAAO,GAAG,QAAQ,CAAC;AAAA,YAC5G;AAUA,kBAAM,cAAc,OAAO,QAAQ,IAAI,mBAAmB,MAAM,EAAE,YAAY,MAAM;AACpF,gBAAI,aAAa;AACb,kBAAI,OAAO,KAAK,4GAAuG;AAAA,YAC3H,OAAO;AAEP,kBAAI;AACA,sBAAM,WAAW,IAAI,WAAW,UAAU;AAC1C,oBAAI,UAAU;AACV,wBAAM,aAAa,IAAI,kBAAkB,IAAI,UAAU,IAAI,MAAM;AACjE,wBAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,wBAAwB;AACzE,wBAAM,UAAU,wBAAwB,MAAM;AAAA,oBAC1C,UAAU;AAAA,oBACV,QAAQ,EAAE,aAAa,UAAU,WAAW,KAAK;AAAA,kBACrD,CAAC;AACD,wBAAM,SAAS,MAAM,WAAW,KAAK,OAAO;AAC5C,sBAAI,OAAO,KAAK,kCAAkC;AAAA,oBAC9C,UAAU,OAAO,QAAQ;AAAA,oBACzB,SAAS,OAAO,QAAQ;AAAA,oBACxB,QAAQ,OAAO,OAAO;AAAA,kBAC1B,CAAC;AAAA,gBACL,OAAO;AAEH,sBAAI,OAAO,MAAM,2DAA2D;AAC5E,6BAAW,WAAW,oBAAoB;AACtC,wBAAI,OAAO,KAAK,oBAAoB,QAAQ,QAAQ,MAAM,gBAAgB,QAAQ,MAAM,EAAE;AAC1F,+BAAW,UAAU,QAAQ,SAAS;AAClC,0BAAI;AACA,8BAAM,GAAG,OAAO,QAAQ,QAAQ,QAAQ,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAQ;AAAA,sBAClF,SAAS,KAAU;AACf,4BAAI,OAAO,KAAK,6BAA6B,QAAQ,MAAM,YAAY,EAAE,OAAO,IAAI,QAAQ,CAAC;AAAA,sBACjG;AAAA,oBACJ;AAAA,kBACJ;AACA,sBAAI,OAAO,KAAK,iCAAiC;AAAA,gBACrD;AAAA,cACJ,SAAS,KAAU;AAEf,oBAAI,OAAO,KAAK,mEAAmE,EAAE,OAAO,IAAI,QAAQ,CAAC;AACzG,2BAAW,WAAW,oBAAoB;AACtC,6BAAW,UAAU,QAAQ,SAAS;AAClC,wBAAI;AACA,4BAAM,GAAG,OAAO,QAAQ,QAAQ,QAAQ,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAQ;AAAA,oBAClF,SAAS,WAAgB;AACrB,0BAAI,OAAO,KAAK,6BAA6B,QAAQ,MAAM,YAAY,EAAE,OAAO,UAAU,QAAQ,CAAC;AAAA,oBACvG;AAAA,kBACJ;AAAA,gBACJ;AACA,oBAAI,OAAO,KAAK,4CAA4C;AAAA,cAChE;AAAA,YACA;AAAA,UACL;AAAA,QACJ;AAEA,oBAAO,OAAO,QAAuB;AACjC,gBAAM,MAAM,KAAK,OAAO,YAAY,KAAK;AACzC,eAAK,iBAAiB,KAAK,oBAAoB,GAAG;AAAA,QACtD;AAxZI,aAAK,SAAS;AACd,aAAK,iBAAiB;AAEtB,cAAM,MAAM,OAAO,YAAY;AAC/B,cAAM,QAAQ,IAAI,MAAM,IAAI,QAAQ;AAEpC,aAAK,OAAO,cAAc,KAAK;AAC/B,aAAK,UAAU,IAAI;AAAA,MACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAwZQ,iBAAiB,KAAoB,OAA8C,KAAgB;AACvG,YAAI,CAAC,KAAK,eAAgB;AAE1B,cAAM,UAAW,IAAY;AAC7B,YAAI,OAAO,YAAY,YAAY;AAC/B,cAAI,OAAO,MAAM,oEAA+D,EAAE,MAAM,CAAC;AACzF;AAAA,QACJ;AAEA,cAAM,UAAU,IAAI,QAAQ,IAAI;AAChC,YAAI,CAAC,QAAS;AAEd,cAAM,UAAU;AAAA,UACZ,eAAe,KAAK,eAAe;AAAA,UACnC,gBAAgB,KAAK,eAAe;AAAA,UACpC,aAAa,KAAK,eAAe;AAAA,UACjC,KAAK;AAAA,YACD,MAAM;AAAA,YACN,OAAO,IAAI;AAAA,YACX,MAAM,IAAI;AAAA,YACV,UAAU,IAAI;AAAA,YACd,WAAW,IAAI,aAAa,IAAI;AAAA,YAChC,QAAQ,IAAI,WAAW;AAAA,UAC3B;AAAA,UACA,QAAQ,KAAK,eAAe,WAAW,KAAK,eAAe,YAAY,YAAY;AAAA,UACnF,WAAW,KAAK,eAAe;AAAA,QACnC;AAEA,YAAI;AACA,kBAAQ,KAAK,KAAK,OAAO,OAAO;AAAA,QACpC,SAAS,KAAU;AACf,cAAI,OAAO,KAAK,2CAA2C,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC;AAAA,QAC7F;AAAA,MACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAUA,MAAc,iBAAiB,KAAoB,OAA8B;AAG7E,YAAI;AACJ,YAAI;AACA,wBAAc,IAAI,WAAW,MAAM;AAAA,QACvC,QAAQ;AAAA,QAER;AAGA,cAAM,UAA0C,CAAC;AACjD,YAAI,MAAM,QAAQ,KAAK,OAAO,YAAY,GAAG;AACzC,kBAAQ,KAAK,GAAG,KAAK,OAAO,YAAY;AAAA,QAC5C;AACA,cAAM,WAAW,KAAK,OAAO,YAAY,KAAK;AAC9C,YAAI,YAAY,MAAM,QAAQ,SAAS,YAAY,KAAK,SAAS,iBAAiB,KAAK,OAAO,cAAc;AACxG,kBAAQ,KAAK,GAAG,SAAS,YAAY;AAAA,QACzC;AAEA,YAAI,CAAC,aAAa;AACd,cAAI,QAAQ,SAAS,GAAG;AAQpB,gBAAI;AACA,oBAAM,MAAM,MAAM,OAAO,mBAAmB;AAC5C,oBAAM,mBAAoB,IAAY;AACtC,kBAAI,OAAO,qBAAqB,YAAY;AACxC,sBAAM,WAAW,iBAAiB;AAClC,gBAAC,IAAY,gBAAgB,QAAQ,QAAQ;AAC7C,8BAAc;AACd,oBAAI,OAAO;AAAA,kBACP,uDAAuD,KAAK,MAAM,QAAQ,MAAM;AAAA,gBAEpF;AAAA,cACJ;AAAA,YACJ,SAAS,KAAU;AACf,kBAAI,OAAO;AAAA,gBACP,eAAe,KAAK,SAAS,QAAQ,MAAM,oDAAoD,KAAK,WAAW,GAAG;AAAA,cACtH;AACA;AAAA,YACJ;AACA,gBAAI,CAAC,aAAa;AACd,kBAAI,OAAO;AAAA,gBACP,eAAe,KAAK,SAAS,QAAQ,MAAM;AAAA,cAC/C;AACA;AAAA,YACJ;AAAA,UACJ,OAAO;AACH,gBAAI,OAAO,MAAM,mEAAmE,EAAE,MAAM,CAAC;AAC7F;AAAA,UACJ;AAAA,QACJ;AAGA,cAAM,aAAa,KAAK,OAAO,SAAS,KAAK,OAAO,YAAY,KAAK,SAAS;AAC9E,YAAI,YAAY,iBAAiB,OAAO,YAAY,qBAAqB,YAAY;AACjF,sBAAY,iBAAiB,WAAW,aAAa;AACrD,cAAI,OAAO,MAAM,6BAA6B,EAAE,OAAO,QAAQ,WAAW,cAAc,CAAC;AAAA,QAC7F;AAEA,YAAI,QAAQ,WAAW,GAAG;AACtB;AAAA,QACJ;AAEA,YAAI,gBAAgB;AACpB,mBAAW,UAAU,SAAS;AAE1B,qBAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,gBAAI,QAAQ,OAAO,SAAS,UAAU;AAClC,kBAAI;AACA,4BAAY,iBAAiB,QAAQ,IAA+B;AACpE;AAAA,cACJ,SAAS,KAAU;AACf,oBAAI,OAAO,KAAK,sCAAsC,EAAE,OAAO,QAAQ,OAAO,IAAI,QAAQ,CAAC;AAAA,cAC/F;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ;AAGA,cAAM,SAAS;AACf,YAAI,OAAO,aAAa,OAAO,MAAM;AACjC,cAAI,OAAO;AAAA,YACP,iBAAiB,aAAa,gDAAgD,KAAK;AAAA,UAEvF;AAAA,QACJ,OAAO;AACH,cAAI,OAAO,KAAK,qCAAqC,EAAE,OAAO,SAAS,QAAQ,QAAQ,SAAS,cAAc,CAAC;AAAA,QACnH;AAAA,MACJ;AAAA,IACJ;AAAA;AAAA;;;ACtlBA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqCA,SAAS,YAAY,kBAAkB;AAahC,SAAS,0BAA0B,eAA+B;AACrE,SAAO,WAAW,aAAa;AACnC;AAgBO,SAAS,8BAA8B,YAAoB,eAA+B;AAC7F,SAAO,WAAW,UAAU,UAAU,EAAE,OAAO,gBAAgB,aAAa,EAAE,EAAE,OAAO,KAAK;AAChG;AAWO,SAAS,4BAA4B,WAA2B;AACnE,SAAO,WAAW,QAAQ,EAAE,OAAO,SAAS,EACvC,OAAO,QAAQ,EACf,QAAQ,OAAO,EAAE,EACjB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG;AAC3B;AASO,SAAS,4BAA4B,UAAkB,WAAmB,gBAAwB;AACrG,MAAI;AACJ,MAAI,SAAS,WAAW,SAAS,KAAK,SAAS,WAAW,UAAU,GAAG;AACnE,WAAO;AAAA,EACX,WAAW,2BAA2B,KAAK,QAAQ,GAAG;AAQlD,UAAM,QAAQ,QAAQ,IAAI,mBAAmB,IAAI,KAAK;AACtD,UAAM,eAAe,QAAQ,KAAK,QAAQ,KAAK,CAAC,OAAO,WAAW,GAAG,QAAQ,IAAI,IAAI;AACrF,WAAO,UAAU,YAAY;AAAA,EACjC,OAAO;AACH,WAAO,WAAW,QAAQ;AAAA,EAC9B;AACA,QAAM,UAAU,KAAK,QAAQ,QAAQ,EAAE;AACvC,QAAM,OAAO,SAAS,QAAQ,QAAQ,EAAE;AACxC,SAAO,GAAG,OAAO,GAAG,IAAI,oBAAoB,wBAAwB;AACxE;AAwCA,eAAsB,sBAAsB,MAAmD;AAC3F,QAAM,EAAE,IAAI,eAAe,UAAU,YAAY,QAAQ,aAAa,IAAI;AAC1E,MAAI,CAAC,YAAY;AACb,YAAQ,OAAO,qEAAgE,EAAE,cAAc,CAAC;AAChG;AAAA,EACJ;AACA,QAAM,WAAW,0BAA0B,aAAa;AACxD,QAAM,wBAAwB,8BAA8B,YAAY,aAAa;AACrF,QAAM,qBAAqB,4BAA4B,qBAAqB;AAC5E,QAAM,kBAAkB,WAAW,4BAA4B,QAAQ,IAAI;AAE3E,MAAI,WAAgB;AACpB,MAAI;AACA,UAAM,OAAO,MAAM,GAAG,KAAK,yBAAyB;AAAA,MAChD,OAAO,EAAE,WAAW,SAAS;AAAA,MAC7B,OAAO;AAAA,IACX,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAClC,UAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,MAAM,QAAS,MAAc,OAAO,IAAK,KAAa,UAAU,CAAC;AAC3G,eAAW,KAAK,CAAC,KAAK;AAAA,EAC1B,SAAS,KAAK;AAGV,YAAQ,OAAO,yEAAoE;AAAA,MAC/E;AAAA,MACA,OAAQ,KAAe;AAAA,IAC3B,CAAC;AACD;AAAA,EACJ;AAEA,QAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,MAAI,CAAC,UAAU;AACX,UAAM,YAAY,kBAAkB,CAAC,eAAe,IAAI,CAAC;AACzD,QAAI;AACA,YAAM,GAAG,OAAO,yBAAyB;AAAA,QACrC,IAAI,UAAU,aAAa;AAAA,QAC3B,MAAM,WAAW,aAAa;AAAA,QAC9B,WAAW;AAAA,QACX,eAAe;AAAA,QACf,MAAM;AAAA,QACN,eAAe,KAAK,UAAU,SAAS;AAAA,QACvC,aAAa,KAAK,UAAU,CAAC,sBAAsB,eAAe,CAAC;AAAA,QACnE,gBAAgB,KAAK,UAAU,CAAC,MAAM,CAAC;AAAA,QACvC,QAAQ,KAAK,UAAU,CAAC,UAAU,SAAS,SAAS,CAAC;AAAA,QACrD,4BAA4B;AAAA,QAC5B,cAAc;AAAA,QACd,cAAc;AAAA,QACd,UAAU;AAAA,QACV,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,YAAY;AAAA,MAChB,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAClC,cAAQ,OAAO,oDAAoD,EAAE,eAAe,SAAS,CAAC;AAAA,IAClG,SAAS,KAAK;AAIV,cAAQ,OAAO,sDAAsD;AAAA,QACjE;AAAA,QACA,OAAQ,KAAe;AAAA,MAC3B,CAAC;AACD,UAAI,aAAc,OAAM;AAAA,IAC5B;AACA;AAAA,EACJ;AASA,MAAI,mBAA6B,CAAC;AAClC,MAAI;AACA,UAAM,MAAM,SAAS;AACrB,UAAM,SAAS,OAAO,QAAQ,WAAW,KAAK,MAAM,GAAG,IAAI;AAC3D,QAAI,MAAM,QAAQ,MAAM,EAAG,oBAAmB,OAAO,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ;AAAA,EACzG,QAAQ;AAAA,EAAwC;AAChD,QAAM,kBAAkB,mBAAmB,CAAC,iBAAiB,SAAS,eAAe,IAC/E,CAAC,GAAG,kBAAkB,eAAe,IACrC;AAEN,QAAM,cAAmC;AAAA,IACrC,MAAM,SAAS,QAAQ,WAAW,aAAa;AAAA,IAC/C,eAAe;AAAA,IACf,MAAM,SAAS,QAAQ;AAAA,IACvB,eAAe,KAAK,UAAU,eAAe;AAAA,IAC7C,aAAa,KAAK,UAAU,CAAC,sBAAsB,eAAe,CAAC;AAAA,IACnE,gBAAgB,KAAK,UAAU,CAAC,MAAM,CAAC;AAAA,IACvC,QAAQ,KAAK,UAAU,CAAC,UAAU,SAAS,SAAS,CAAC;AAAA,IACrD,4BAA4B;AAAA,IAC5B,cAAc;AAAA,IACd,cAAc;AAAA,IACd,UAAU;AAAA,IACV,cAAc;AAAA,IACd,YAAY;AAAA,EAChB;AACA,MAAI;AACA,UAAM,GAAG;AAAA,MACL;AAAA,MACA;AAAA,MACA,EAAE,OAAO,EAAE,IAAI,SAAS,GAAG,EAAE;AAAA,MAC7B,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE;AAAA,IAClC;AACA,YAAQ,OAAO,iDAAiD;AAAA,MAC5D;AAAA,MACA;AAAA,MACA,eAAe;AAAA,IACnB,CAAC;AAAA,EACL,SAAS,KAAK;AACV,YAAQ,OAAO,sDAAsD;AAAA,MACjE;AAAA,MACA,OAAQ,KAAe;AAAA,IAC3B,CAAC;AACD,QAAI,aAAc,OAAM;AAAA,EAC5B;AACJ;AAkBA,eAAsB,2BAA2B,MAK9C;AACC,QAAM,EAAE,IAAI,YAAY,QAAQ,QAAQ,IAAK,IAAI;AACjD,MAAI,CAAC,YAAY;AACb,YAAQ,OAAO,+DAA0D;AACzE,WAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,gBAAgB,GAAG,UAAU,CAAC,EAAE;AAAA,EACpE;AACA,MAAI,WAAkB,CAAC;AACvB,MAAI;AACA,UAAM,OAAO,MAAM,GAAG,KAAK,mBAAmB;AAAA,MAC1C;AAAA,MACA,QAAQ,CAAC,MAAM,YAAY,QAAQ;AAAA,IACvC,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAClC,eAAW,MAAM,QAAQ,IAAI,IAAI,OAAO,MAAM,QAAS,MAAc,OAAO,IAAK,KAAa,UAAU,CAAC;AAAA,EAC7G,SAAS,KAAK;AACV,YAAQ,OAAO,wDAAwD;AAAA,MACnE,OAAQ,KAAe;AAAA,IAC3B,CAAC;AACD,WAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,gBAAgB,GAAG,UAAU,CAAC,EAAE,eAAe,UAAU,OAAQ,KAAe,WAAW,OAAO,GAAG,EAAE,CAAC,EAAE;AAAA,EAC9I;AACA,MAAI,SAAS;AACb,MAAI,iBAAiB;AACrB,QAAM,WAA4D,CAAC;AACnE,aAAW,KAAK,UAAU;AACtB,QAAI,CAAC,GAAG,GAAI;AACZ,UAAM,SAAS,OAAO,YAAY;AAC9B,UAAI;AACA,cAAM,IAAI,MAAM,GAAG,KAAK,yBAAyB;AAAA,UAC7C,OAAO,EAAE,WAAW,0BAA0B,EAAE,EAAE,EAAE;AAAA,UACpD,OAAO;AAAA,QACX,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAClC,cAAM,OAAO,MAAM,QAAQ,CAAC,IAAI,IAAI,MAAM,QAAS,GAAW,OAAO,IAAK,EAAU,UAAU,CAAC;AAC/F,eAAO,KAAK,CAAC,KAAK;AAAA,MACtB,QAAQ;AAAE,eAAO;AAAA,MAAM;AAAA,IAC3B,GAAG;AACH,QAAI;AACA,YAAM,sBAAsB,EAAE,IAAI,eAAe,EAAE,IAAI,UAAU,EAAE,UAAU,YAAY,QAAQ,cAAc,KAAK,CAAC;AACrH,UAAI,OAAQ;AAAA,WACP;AAED,cAAM,QAAQ,OAAO,YAAY;AAC7B,cAAI;AACA,kBAAM,IAAI,MAAM,GAAG,KAAK,yBAAyB;AAAA,cAC7C,OAAO,EAAE,WAAW,0BAA0B,EAAE,EAAE,EAAE;AAAA,cACpD,OAAO;AAAA,YACX,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAClC,kBAAM,OAAO,MAAM,QAAQ,CAAC,IAAI,IAAI,MAAM,QAAS,GAAW,OAAO,IAAK,EAAU,UAAU,CAAC;AAC/F,mBAAO,KAAK,CAAC,KAAK;AAAA,UACtB,SAAS,KAAK;AAAE,mBAAO,EAAE,UAAW,KAAe,QAAQ;AAAA,UAAG;AAAA,QAClE,GAAG;AACH,YAAI,SAAS,CAAE,MAAc,SAAU;AAAA,YAClC,UAAS,KAAK,EAAE,eAAe,EAAE,IAAI,OAAO,6BAA6B,QAAQ,KAAK,UAAU,KAAK,IAAI,MAAM,GAAG,CAAC;AAAA,MAC5H;AAAA,IACJ,SAAS,KAAU;AACf,eAAS,KAAK,EAAE,eAAe,EAAE,IAAI,OAAO,KAAK,WAAW,OAAO,GAAG,EAAE,CAAC;AAAA,IAC7E;AAAA,EACJ;AACA,UAAQ,OAAO,oCAAoC,EAAE,SAAS,SAAS,QAAQ,QAAQ,gBAAgB,UAAU,SAAS,OAAO,CAAC;AAClI,SAAO,EAAE,SAAS,SAAS,QAAQ,QAAQ,gBAAgB,SAAS;AACxE;AAlWA,IA4Ca;AA5Cb;AAAA;AAAA;AA4CO,IAAM,2BAA2B;AAAA;AAAA;;;AC5CxC;AAAA;AAAA;AAAA;AAAA;AAmDA,eAAsB,wBAClB,QACA,MACA,QACoD;AACpD,MAAI,CAAC,MAAM,MAAM,CAAC,MAAM,KAAM,QAAO;AAErC,MAAI;AACA,UAAM,KAAU,OAAO,WAAW,UAAU;AAC5C,QAAI,CAAC,IAAI,UAAU,CAAC,IAAI,MAAM;AAC1B,cAAQ,OAAO,0DAA0D,EAAE,OAAO,KAAK,GAAG,CAAC;AAC3F,aAAO;AAAA,IACX;AAEA,QAAI;AACA,YAAM,WAAW,MAAM,GAAG,KAAK,SAAS,EAAE,OAAO,EAAE,IAAI,KAAK,GAAG,EAAE,CAAQ;AACzE,YAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI,WAAY,UAAU,SAAS,CAAC;AACvE,UAAI,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAG,QAAO;AAAA,IACvD,QAAQ;AAAA,IAGR;AAEA,UAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,UAAM,GAAG,OAAO,SAAS;AAAA,MACrB,IAAI,KAAK;AAAA,MACT,MAAM,KAAK;AAAA,MACX,MAAM,KAAK,QAAQ;AAAA,MACnB,MAAM,KAAK,QAAQ;AAAA,MACnB,UAAU;AAAA,MACV,YAAY;AAAA,IAChB,CAAC;AAED,YAAQ,OAAO,wCAAwC;AAAA,MACnD,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,IACf,CAAC;AACD,WAAO;AAAA,EACX,SAAS,KAAU;AACf,YAAQ,OAAO,gDAAgD;AAAA,MAC3D,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,IAChB,CAAC;AACD,WAAO;AAAA,EACX;AACJ;AAaA,eAAsB,kBAClB,QACA,MAKA,QACoD;AACpD,QAAM,EAAE,QAAQ,eAAe,IAAI;AACnC,QAAM,OAAO,KAAK,QAAQ;AAC1B,MAAI,CAAC,UAAU,CAAC,eAAgB,QAAO;AAEvC,MAAI;AACA,UAAM,KAAU,OAAO,WAAW,UAAU;AAC5C,QAAI,CAAC,IAAI,UAAU,CAAC,IAAI,MAAM;AAC1B,cAAQ,OAAO,oDAAoD,EAAE,QAAQ,eAAe,CAAC;AAC7F,aAAO;AAAA,IACX;AAEA,QAAI;AACA,YAAM,WAAW,MAAM,GAAG,KAAK,cAAc;AAAA,QACzC,OAAO,EAAE,SAAS,QAAQ,iBAAiB,eAAe;AAAA,MAC9D,CAAQ;AACR,YAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI,WAAY,UAAU,SAAS,CAAC;AACvE,UAAI,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAG,QAAO;AAAA,IACvD,QAAQ;AAAA,IAER;AAEA,UAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AAItC,UAAM,QAAQ,OAAO,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;AAC5D,UAAM,GAAG,OAAO,cAAc;AAAA,MAC1B,IAAI;AAAA,MACJ,iBAAiB;AAAA,MACjB,SAAS;AAAA,MACT;AAAA,MACA,YAAY;AAAA,IAChB,CAAC;AAED,YAAQ,OAAO,qCAAqC;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACJ,CAAC;AACD,WAAO;AAAA,EACX,SAAS,KAAU;AACf,YAAQ,OAAO,0CAA0C;AAAA,MACrD;AAAA,MACA;AAAA,MACA,OAAO,KAAK;AAAA,IAChB,CAAC;AACD,WAAO;AAAA,EACX;AACJ;AAtKA,IAsCM;AAtCN;AAAA;AAAA;AAsCA,IAAM,UAAU;AAAA;AAAA;;;ACtChB;AAAA;AAAA;AAAA;AAqDA,eAAsB,iBAClB,QACA,MACA,QACoD;AACpD,MAAI,CAAC,MAAM,UAAU,CAAC,MAAM,MAAO,QAAO;AAE1C,MAAI;AACA,UAAM,KAAU,OAAO,WAAW,UAAU;AAC5C,QAAI,CAAC,IAAI,UAAU,CAAC,IAAI,MAAM;AAC1B,cAAQ,OAAO,mDAAmD,EAAE,QAAQ,KAAK,OAAO,CAAC;AACzF,aAAO;AAAA,IACX;AAKA,QAAI;AACA,YAAM,WAAW,MAAM,GAAG,KAAK,UAAU,EAAE,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAQ;AAC9E,YAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI,WAAY,UAAU,SAAS,CAAC;AACvE,UAAI,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAG,QAAO;AAAA,IACvD,QAAQ;AAAA,IAIR;AAEA,UAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,UAAM,GAAG,OAAO,UAAU;AAAA,MACtB,IAAI,KAAK;AAAA,MACT,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ,KAAK,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,MAC/C,OAAO,KAAK,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,MAKrB,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,YAAY;AAAA,IAChB,CAAC;AAED,YAAQ,OAAO,mCAAmC;AAAA,MAC9C,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,IAChB,CAAC;AACD,WAAO;AAAA,EACX,SAAS,KAAU;AAGf,YAAQ,OAAO,yCAAyC;AAAA,MACpD,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,IAChB,CAAC;AACD,WAAO;AAAA,EACX;AACJ;AA7GA,IAyCM;AAzCN;AAAA;AAAA;AAyCA,IAAM,WAAW;AAAA;AAAA;;;ACtCjB,SAAS,gBAAAC,qBAAoB;;;ACD7B,SAAS,oBAA6D;AACtE;AAAA,EACI;AAAA,EACA;AAAA,OAEG;AA4CA,IAAM,UAAN,MAAc;AAAA,EAGjB,YAAY,SAAwB,CAAC,GAAG;AACpC,SAAK,SAAS,IAAI,aAAa,OAAO,MAAM;AAG5C,QAAI,OAAO,QAAQ;AACd,WAAK,OAAO,gBAAgB,eAAe,OAAO,MAAM;AAAA,IAC7D;AAKA,QAAI,OAAO,YAAY,OAAO;AAC1B,YAAM,OAAO,KAAK,wBAAwB,OAAO,OAAO;AACxD,WAAK,OAAO,IAAI,IAAI,qBAAqB,IAAI,CAAC;AAI9C,WAAK,OAAO,IAAI,IAAI,4BAA4B,CAAC;AAAA,IACrD;AAAA,EACJ;AAAA,EAEQ,wBACJ,KAC2B;AAC3B,QAAI,CAAC,IAAK,QAAO,CAAC;AAGlB,QACI,OAAO,QAAQ,aACd,aAAa,OAAO,YAAY,QACjC,EAAE,YAAY,MAChB;AACE,aAAO;AAAA,IACX;AAEA,WAAO,EAAE,QAAQ,IAAoC;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,QAAgB;AAChB,SAAK,OAAO,IAAI,MAAM;AACtB,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,QAAQ;AACV,UAAM,KAAK,OAAO,UAAU;AAC5B,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,YAAY;AACR,WAAO,KAAK;AAAA,EAChB;AACJ;;;AC3FA;AAHA,SAAS,WAAWC,oBAAmB;AACvC,SAAS,iBAAiB;AAC1B,SAAS,SAAS;AAGX,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAChD,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,gBAAgB,EAAE,KAAK,CAAC,UAAU,eAAe,SAAS,UAAU,YAAY,SAAS,CAAC,EAAE,SAAS;AAAA,EACrG,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,cAAc,EAAE,OAAO,EAAE,SAAS;AACtC,CAAC;AAsBD,SAAS,oBAAoB,OAAmC;AAC5D,MAAI,gBAAgB,KAAK,KAAK,EAAG,QAAO;AACxC,MAAI,yBAAyB,KAAK,KAAK,EAAG,QAAO;AACjD,MAAI,4BAA4B,KAAK,KAAK,EAAG,QAAO;AACpD,MAAI,yBAAyB,KAAK,KAAK,EAAG,QAAO;AACjD,MAAI,qBAAqB,KAAK,KAAK,EAAG,QAAO;AAC7C,MAAI,eAAe,KAAK,KAAK,EAAG,QAAO;AACvC,MAAI,UAAU,KAAK,KAAK,EAAG,QAAO;AAElC,MAAI,CAAC,2BAA2B,KAAK,KAAK,EAAG,QAAO;AACpD,QAAM,IAAI;AAAA,IACN,sDAAsD,KAAK;AAAA,EAE/D;AACJ;AAEA,eAAsB,sBAAsB,QAAgE;AACxG,QAAM,MAAM,4BAA4B,MAAM,UAAU,CAAC,CAAC;AAE1D,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,uBAAuB;AAC/D,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,uBAAuB;AAC/D,QAAM,EAAE,cAAAC,cAAa,IAAI,MAAM;AAC/B,QAAM,EAAE,WAAAC,WAAU,IAAI,MAAM;AAE5B,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,gBAAgB,IAAI,iBAAiB,QAAQ,IAAI,qBAAqB;AAC5E,QAAM,oBAAoB,IAAI,gBACvB,QAAQ,IAAI,oBACZF,aAAY,KAAK,uBAAuB;AAC/C,QAAM,eAAe,UAAU,iBAAiB,IAC1C,oBACC,kBAAkB,WAAW,GAAG,IAC7B,oBACAA,aAAY,KAAK,iBAAiB;AAE5C,QAAM,QAAQ,IAAI,eACX,QAAQ,IAAI,iBAAiB,KAAK,KAClC,QAAQ,IAAI,oBAAoB,KAAK,KACrC,QAAQA,aAAY,KAAK,iCAAiC,CAAC;AAClE,QAAM,cAAc,IAAI,qBACjB,QAAQ,IAAI,wBAAwB,KAAK,KACzC,QAAQ,IAAI,kBAAkB,KAAK;AAC1C,QAAM,iBAAiB,IAAI,kBACnB,QAAQ,IAAI,oBAAoB,KAAK;AAC7C,QAAM,WAA+B,kBAAkB,oBAAoB,KAAK;AAEhF,MAAI;AACJ,MAAI,aAAa,UAAU;AACvB,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,4BAA4B;AACpE,mBAAe,IAAIC,cAAa,IAAI,eAAe,CAAC;AAAA,EACxD,WAAW,aAAa,SAAS;AAC7B,UAAM,EAAE,YAAY,IAAI,MAAM,OAAO,2BAA2B;AAChE,mBAAe,IAAIA;AAAA,MACf,IAAI,YAAY,EAAE,KAAK,OAAO,WAAW,YAAY,CAAC;AAAA,IAC1D;AAAA,EACJ,WAAW,aAAa,YAAY;AAChC,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,yBAAyB;AAC5D,mBAAe,IAAIA;AAAA,MACf,IAAI,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,MAAM,EAAE,KAAK,GAAG,KAAK,EAAE;AAAA,MAC3B,CAAC;AAAA,IACL;AAAA,EACJ,WAAW,aAAa,WAAW;AAG/B,QAAI;AACJ,QAAI;AACA,OAAC,EAAE,cAAc,IAAI,MAAM,OAAO,6BAAoC;AAAA,IAC1E,SAAS,KAAU;AACf,YAAM,IAAI;AAAA,QACN,sJAC6D,KAAK,WAAW,GAAG;AAAA,MACpF;AAAA,IACJ;AACA,mBAAe,IAAIA,cAAa,IAAI,cAAc,EAAE,KAAK,MAAM,CAAC,CAAQ;AAAA,EAC5E,WAAW,aAAa,eAAe;AACnC,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,iCAAwC;AAClF,UAAM,WAAW,MACZ,QAAQ,yBAAyB,EAAE,EACnC,QAAQ,kBAAkB,EAAE;AACjC,QAAI,YAAY,aAAa,YAAY;AACrC,gBAAUD,aAAY,UAAU,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,IAC9D;AACA,mBAAe,IAAIC;AAAA,MACf,IAAI,iBAAiB;AAAA,QACjB,UAAU,YAAY;AAAA,QACtB,SAAS,YAAY,aAAa,aAAa,aAAa;AAAA,MAChE,CAAC;AAAA,IACL;AAAA,EACJ,OAAO;AAEH,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,yBAAyB;AAC5D,UAAM,WAAW,MAAM,QAAQ,iBAAiB,EAAE;AAClD,QAAI,CAAC,YAAY,2BAA2B,KAAK,QAAQ,GAAG;AACxD,YAAM,IAAI;AAAA,QACN,6FAA6F,KAAK;AAAA,MAEtG;AAAA,IACJ;AACA,cAAUD,aAAY,UAAU,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC1D,mBAAe,IAAIC;AAAA,MACf,IAAI,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,YAAY,EAAE,SAAS;AAAA,QACvB,kBAAkB;AAAA,MACtB,CAAC;AAAA,IACL;AAAA,EACJ;AAEA,QAAM,iBAAiB,MAAM,mBAAmB,cAAc;AAAA,IAC1D,KAAK;AAAA,IACL,gBAAgB;AAAA,EACpB,CAAC;AACD,MAAI,gBAAgB;AAChB,UAAM,aAAa,MAAM,QAAQ,gBAAgB,KAAK,IAAI,eAAe,MAAM,SAAS;AAExF,YAAQ;AAAA,MACJ,2CAA2C,YAAY,SAAS,OAAO,KAAK,cAAc,EAAE,KAAK,GAAG,CAAC,UAAU,UAAU;AAAA,IAC7H;AAAA,EACJ;AAEA,QAAM,UAAiB;AAAA,IACnB;AAAA,IACA,IAAI,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMf,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOP,eAAe,QAAQ,IAAI,aAAa;AAAA,MACxC;AAAA,MACA,gBAAgB,EAAE,MAAM,cAAc,MAAM,aAAa;AAAA,IAC7D,CAAC;AAAA,IACD,IAAI,eAAe,EAAE,cAAc,CAAC;AAAA,EACxC;AACA,MAAI,eAAgB,SAAQ,KAAK,IAAIC,WAAU,cAAc,CAAC;AAQ9D,QAAM,WACF,MAAM,QAAQ,gBAAgB,QAAQ,IAC/B,eAAe,SAAS,OAAO,CAAC,MAAe,OAAO,MAAM,QAAQ,IACrE;AACV,QAAM,UACF,MAAM,QAAQ,gBAAgB,OAAO,IAAI,eAAe,UAAU;AACtE,QAAM,WAA4B,gBAAgB;AAElD,SAAO;AAAA,IACH;AAAA,IACA,KAAK;AAAA,MACD,sBAAsB;AAAA,MACtB,mBAAmB;AAAA,IACvB;AAAA,IACA,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,IAC/B,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,EACnC;AACJ;;;ACtMA,SAAS,WAAWC,oBAAmB;AACvC,SAAS,kBAAkB;AAE3B;AA0BO,SAAS,2BACZ,cACA,MAAc,QAAQ,IAAI,GACR;AAClB,QAAM,YAAY,gBACX,QAAQ,IAAI,oBACZC,aAAY,KAAK,uBAAuB;AAE/C,MAAI,UAAU,SAAS,EAAG,QAAO;AACjC,MAAI,gBAAgB,QAAQ,IAAI,iBAAkB,QAAO;AACzD,SAAO,WAAW,SAAS,IAAI,YAAY;AAC/C;AAYA,eAAsB,wBAClB,UAAoC,CAAC,GACL;AAChC,QAAM,EAAE,kBAAkB,MAAM,GAAG,eAAe,IAAI;AAEtD,QAAM,mBAAmB,2BAA2B,eAAe,YAAY;AAC/E,MAAI,CAAC,oBAAoB,iBAAiB;AACtC,UAAM,IAAI;AAAA,MACN;AAAA,IAKJ;AAAA,EACJ;AAEA,SAAO,sBAAsB;AAAA,IACzB,GAAG;AAAA,IACH,cAAc;AAAA,EAClB,CAAC;AACL;;;AHjFA;AACA;AACA;;;AIlBA,SAAuB,QAAQ,qBAAqB;AACpD,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;;;AC2BjC,SAAS,WAAW,SAAc,MAAkC;AAClE,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,QAAQ,KAAK,YAAY;AAC/B,MAAI,OAAO,QAAQ,QAAQ,YAAY;AACrC,UAAM,IAAI,QAAQ,IAAI,IAAI,KAAK,QAAQ,IAAI,KAAK;AAChD,WAAO,KAAK,OAAO,SAAY,OAAO,CAAC;AAAA,EACzC;AACA,aAAW,OAAO,OAAO,KAAK,OAAO,GAAG;AACtC,QAAI,IAAI,YAAY,MAAM,OAAO;AAC/B,YAAM,IAAI,QAAQ,GAAG;AACrB,aAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,SAAY,OAAO,CAAC;AAAA,IACnE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,SAAkC;AACvD,QAAM,IAAI,WAAW,SAAS,WAAW;AACzC,MAAI,EAAG,QAAO,EAAE,KAAK;AACrB,QAAM,OAAO,WAAW,SAAS,eAAe;AAChD,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,IAAI,KAAK,MAAM,kBAAkB;AACvC,SAAO,IAAI,EAAE,CAAC,EAAE,KAAK,IAAI;AAC3B;AAOA,SAAS,UAAU,OAAiB;AAClC,MAAI,CAAC,MAAO,QAAO,IAAI,QAAQ;AAC/B,MAAI,OAAO,YAAY,eAAe,iBAAiB,QAAS,QAAO;AACvE,QAAM,IAAI,IAAI,QAAQ;AACtB,MAAI,OAAO,MAAM,YAAY,YAAY;AACvC,eAAW,CAAC,GAAG,CAAC,KAAK,MAAM,QAAQ,EAAG,GAAE,IAAI,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AAChE,WAAO;AAAA,EACT;AACA,aAAW,KAAK,OAAO,KAAK,KAAK,GAAG;AAClC,UAAM,IAAK,MAAc,CAAC;AAC1B,QAAI,KAAK,KAAM;AACf,MAAE,IAAI,OAAO,CAAC,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,eAAe,QAAQ,IAAS,QAAgB,OAAY,QAAQ,KAAqB;AACvF,MAAI,CAAC,MAAM,OAAO,GAAG,SAAS,WAAY,QAAO,CAAC;AAClD,MAAI;AACF,QAAI,OAAO,MAAM,GAAG,KAAK,QAAQ,EAAE,OAAO,OAAO,SAAS,EAAE,UAAU,KAAK,EAAE,CAAQ;AACrF,QAAI,QAAS,KAAa,MAAO,QAAQ,KAAa;AACtD,WAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;AAAA,EACvC,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAQA,eAAsB,wBAAwB,MAAiD;AAC7F,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,MAAwB;AAAA,IAC5B,OAAO,CAAC;AAAA,IACR,aAAa,CAAC;AAAA,IACd,UAAU;AAAA,EACZ;AAEA,MAAI;AACJ,MAAI;AAIJ,QAAM,SAAS,cAAc,OAAO;AACpC,MAAI,QAAQ;AACV,QAAI;AACF,YAAM,cAAmB,MAAM,KAAK,WAAW,MAAM;AAErD,YAAM,SAAS,aAAa,KAAK,gBAAgB,aAAa,KAAK,QAAQ;AAC3E,UAAI,OAAO,WAAW,YAAY;AAChC,cAAM,MAAM,MAAM,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,EAAE,CAAC;AAClD,cAAM,UAAU,KAAK,OAAO;AAC5B,YAAI,SAAS,OAAQ,UAAS,QAAQ;AACtC,YAAI,SAAS,eAAgB,YAAW,QAAQ;AAChD,YAAI,MAAM,QAAQ,SAAS,WAAW,GAAG;AACvC,cAAI,YAAa,KAAK,GAAG,QAAQ,WAAW;AAAA,QAC9C;AACA,YAAI,MAAM,QAAQ,SAAS,MAAM,GAAG;AAClC,cAAI,YAAa,KAAK,GAAG,QAAQ,MAAM;AAAA,QACzC;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAEA,QAAI,CAAC,QAAQ;AAGX,YAAMC,MAAK,MAAM,KAAK,MAAM;AAC5B,YAAM,OAAO,MAAM,QAAQA,KAAI,eAAe,EAAE,KAAK,QAAQ,QAAQ,KAAK,GAAG,CAAC;AAC9E,YAAM,MAAM,KAAK,CAAC;AAClB,UAAI,KAAK;AACP,iBAAS,IAAI,WAAW,IAAI;AAC5B,mBAAW,IAAI,mBAAmB,IAAI;AACtC,YAAI,MAAM,QAAQ,IAAI,MAAM,EAAG,KAAI,YAAa,KAAK,GAAG,IAAI,MAAM;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,QAAQ;AACX,QAAI;AACF,YAAM,cAAmB,MAAM,KAAK,WAAW,MAAM;AAIrD,YAAM,kBAAkB,UAAU,OAAO;AACzC,YAAM,cAAc,MAAM,aAAa,KAAK,aAAa,EAAE,SAAS,gBAAgB,CAAC;AACrF,eAAS,aAAa,MAAM,MAAM,aAAa,SAAS;AACxD,iBAAW,YAAY,aAAa,SAAS;AAC7C,UAAI,cAAc,aAAa,SAAS,SAAS,IAAI;AAAA,IACvD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,OAAQ,KAAI,SAAS;AACzB,MAAI,SAAU,KAAI,WAAW;AAE7B,MAAI,CAAC,OAAQ,QAAO;AAMpB,QAAM,KAAK,MAAM,KAAK,MAAM;AAC5B,MAAI,CAAC,GAAI,QAAO;AAEhB,QAAM,cAAmB,WACrB,EAAE,SAAS,QAAQ,iBAAiB,SAAS,IAC7C,EAAE,SAAS,OAAO;AACtB,QAAM,UAAU,MAAM,QAAQ,IAAI,cAAc,aAAa,EAAE;AAC/D,aAAW,KAAK,SAAS;AACvB,QAAI,EAAE,QAAQ,OAAO,EAAE,SAAS,UAAU;AAExC,iBAAW,KAAK,EAAE,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,GAAG;AAC9E,YAAI,CAAC,IAAI,MAAO,SAAS,CAAC,EAAG,KAAI,MAAO,KAAK,CAAC;AAAA,MAChD;AAAA,IACF;AAAA,EACF;AASA,MAAI,UAAU;AACZ,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA,EAAE,iBAAiB,SAAS;AAAA,MAC5B;AAAA,IACF;AACA,UAAM,aAAa,MAAM;AAAA,MACvB,IAAI;AAAA,QACF,WACG,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAChC,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC;AAAA,MACrE;AAAA,IACF;AAGA,QAAI,CAAC,WAAW,SAAS,MAAM,EAAG,YAAW,KAAK,MAAM;AACxD,IAAC,IAAY,eAAe;AAAA,EAC9B,OAAO;AAEL,IAAC,IAAY,eAAe,CAAC,MAAM;AAAA,EACrC;AAGA,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA,WACI,EAAE,SAAS,QAAQ,iBAAiB,SAAS,IAC7C,EAAE,SAAS,OAAO;AAAA,IACtB;AAAA,EACF;AACA,QAAM,QAAQ,IAAI;AAAA,IAChB,QAAQ,IAAI,CAAC,MAAM,EAAE,qBAAqB,EAAE,eAAe,EAAE,OAAO,OAAO;AAAA,EAC7E;AAGA,MAAI,IAAI,MAAO,SAAS,GAAG;AACzB,UAAM,WAAW,MAAM,QAAQ,IAAI,YAAY,EAAE,MAAM,EAAE,KAAK,IAAI,MAAM,EAAE,GAAG,GAAG;AAChF,UAAM,UAAU,SAAS,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,OAAO;AACxD,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA;AAAA,QACA,EAAE,SAAS,EAAE,KAAK,QAAQ,EAAE;AAAA,QAC5B;AAAA,MACF;AACA,iBAAW,KAAK,SAAS;AACvB,cAAM,KAAK,EAAE,qBAAqB,EAAE;AACpC,YAAI,GAAI,OAAM,IAAI,EAAE;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,MAAI,MAAM,OAAO,GAAG;AAGlB,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,KAAK,EAAE,EAAE;AAAA,MACjC;AAAA,IACF;AACA,eAAW,MAAM,QAAQ;AACvB,UAAI,GAAG,QAAQ,CAAC,IAAI,YAAa,SAAS,GAAG,IAAI,GAAG;AAClD,YAAI,YAAa,KAAK,GAAG,IAAI;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAwBO,SAAS,wBAAwB,GAAwC;AAC9E,MAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;AACxC,QAAM,OAAO;AACb,SACE,KAAK,SAAS,2BACd,KAAK,SAAS,uBACb,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,WAAW,0BAA0B;AAE3F;;;ADrRA,SAAS,aAAqB;AAC1B,MAAI,WAAW,UAAU,OAAO,WAAW,OAAO,eAAe,YAAY;AACzE,WAAO,WAAW,OAAO,WAAW;AAAA,EACxC;AACA,SAAO,uCAAuC,QAAQ,SAAS,OAAK;AAChE,UAAM,IAAK,KAAK,OAAO,IAAI,KAAM;AACjC,UAAM,IAAI,MAAM,MAAM,IAAK,IAAI,IAAO;AACtC,WAAO,EAAE,SAAS,EAAE;AAAA,EACxB,CAAC;AACL;AAuDO,IAAM,kBAAN,MAAM,gBAAe;AAAA,EA4BxB,YAAY,QAAsB,aAAmB,SAAiC;AAPtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAQ,kBAAuC,oBAAI,IAAI;AAQnD,SAAK,SAAS;AACd,SAAK,gBAAgB;AACrB,UAAM,iBAAiB,CAAC,SAAsB;AAC1C,UAAI;AAAE,eAAQ,OAAe,aAAa,IAAI;AAAA,MAAG,QAAQ;AAAE,eAAO;AAAA,MAAW;AAAA,IACjF;AACA,SAAK,cAAc,eAAe,eAAe,cAAc;AAC/D,SAAK,oBAAoB,SAAS,4BAA4B;AAC9D,SAAK,gBAAgB,SAAS,iBAAiB,eAAe,gBAAgB;AAC9E,SAAK,eAAe,SAAS,gBAAgB,eAAe,eAAe;AAAA,EAI/E;AAAA,EAEQ,wBAA+E;AACnF,QAAI,KAAK,eAAgB,QAAO,KAAK;AACrC,QAAI;AACA,YAAM,IAAK,KAAK,OAAe,aAAa,iBAAiB;AAC7D,UAAI,GAAG,eAAe;AAClB,aAAK,iBAAiB;AACtB,eAAO;AAAA,MACX;AAAA,IACJ,QAAQ;AAAA,IAER;AACA,WAAO;AAAA,EACX;AAAA,EAEQ,QAAQ,MAAW,MAAY;AACnC,WAAO;AAAA,MACH,QAAQ;AAAA,MACR,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK;AAAA,IACtC;AAAA,EACJ;AAAA,EAEQ,MAAM,SAAiB,OAAe,KAAK,SAAe;AAC9D,WAAO;AAAA,MACH,QAAQ;AAAA,MACR,MAAM,EAAE,SAAS,OAAO,OAAO,EAAE,SAAS,MAAM,QAAQ,EAAE;AAAA,IAC9D;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAc,OAAe;AACjC,WAAO;AAAA,MACH,QAAQ;AAAA,MACR,MAAM;AAAA,QACF,SAAS;AAAA,QACT,OAAO;AAAA,UACH,MAAM;AAAA,UACN,SAAS,oBAAoB,KAAK;AAAA,UAClC,MAAM;AAAA,UACN;AAAA,UACA,MAAM;AAAA,QACV;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,SACV,QACA,QACA,YACA,SACA,kBACY;AACZ,UAAM,WAAW,MAAM,KAAK,eAAe,YAAY,OAAO;AAC9D,UAAM,YAAY,cAAc,MAAM,KAAK,mBAAmB,OAAO;AACrE,UAAM,KAAK,aAAa,MAAM,KAAK,eAAe,YAAY,OAAO;AACrE,UAAM,SAAS,mBAAmB,EAAE,SAAS,iBAAiB,IAAI;AAClE,UAAM,WAAW,CAAC,UAAgB;AAC9B,YAAM,OAAO,SAAS,EAAE,GAAG,OAAO,IAAI,CAAC;AACvC,aAAO,QAAQ,EAAE,GAAG,MAAM,GAAG,MAAM,IAAK,SAAS,OAAO;AAAA,IAC5D;AAEA,QAAI,WAAW,UAAU;AACrB,UAAI,IAAI;AACJ,cAAM,MAAM,MAAM,GAAG,OAAO,OAAO,QAAQ,OAAO,MAAM,MAAM;AAC9D,cAAM,SAAS,EAAE,GAAG,OAAO,MAAM,GAAG,IAAI;AACxC,eAAO,EAAE,QAAQ,OAAO,QAAQ,IAAI,OAAO,IAAI,OAAO;AAAA,MAC1D;AACA,YAAM,EAAE,YAAY,KAAK,SAAS,6BAA6B;AAAA,IACnE;AAEA,QAAI,WAAW,OAAO;AAClB,UAAI,YAAY,OAAO,SAAS,YAAY,YAAY;AACpD,eAAO,MAAM,SAAS,QAAQ,EAAE,QAAQ,OAAO,QAAQ,IAAI,OAAO,IAAI,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,SAAS,iBAAiB,CAAC;AAAA,MACnJ;AACA,UAAI,IAAI;AACJ,YAAI,MAAM,MAAM,GAAG,KAAK,OAAO,QAAQ,SAAS,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,GAAG,OAAO,EAAE,CAAC,CAAC;AACvF,YAAI,OAAQ,IAAY,MAAO,OAAO,IAAY;AAClD,YAAI,CAAC,IAAK,OAAM,CAAC;AACjB,cAAM,QAAS,IAAc,KAAK,CAAC,MAAW,EAAE,OAAO,OAAO,EAAE;AAChE,eAAO,QAAQ,EAAE,QAAQ,OAAO,QAAQ,IAAI,OAAO,IAAI,QAAQ,MAAM,IAAI;AAAA,MAC7E;AACA,YAAM,EAAE,YAAY,KAAK,SAAS,6BAA6B;AAAA,IACnE;AAEA,QAAI,WAAW,UAAU;AACrB,UAAI,MAAM,OAAO,IAAI;AACjB,YAAI,MAAM,MAAM,GAAG,KAAK,OAAO,QAAQ,SAAS,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,GAAG,OAAO,EAAE,CAAC,CAAC;AACvF,YAAI,OAAQ,IAAY,MAAO,OAAO,IAAY;AAClD,YAAI,CAAC,IAAK,OAAM,CAAC;AACjB,cAAM,WAAY,IAAc,KAAK,CAAC,MAAW,EAAE,OAAO,OAAO,EAAE;AACnE,YAAI,CAAC,SAAU,OAAM,IAAI,MAAM,yBAAyB;AACxD,cAAM,GAAG,OAAO,OAAO,QAAQ,OAAO,MAAM,SAAS,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;AAClF,eAAO,EAAE,QAAQ,OAAO,QAAQ,IAAI,OAAO,IAAI,QAAQ,EAAE,GAAG,UAAU,GAAG,OAAO,KAAK,EAAE;AAAA,MAC3F;AACA,YAAM,EAAE,YAAY,KAAK,SAAS,6BAA6B;AAAA,IACnE;AAEA,QAAI,WAAW,UAAU;AACrB,UAAI,IAAI;AACJ,cAAM,GAAG,OAAO,OAAO,QAAQ,SAAS,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;AACrE,eAAO,EAAE,QAAQ,OAAO,QAAQ,IAAI,OAAO,IAAI,SAAS,KAAK;AAAA,MACjE;AACA,YAAM,EAAE,YAAY,KAAK,SAAS,6BAA6B;AAAA,IACnE;AAEA,QAAI,WAAW,WAAW,WAAW,QAAQ;AACzC,UAAI,YAAY,OAAO,SAAS,aAAa,YAAY;AAErD,cAAM,QAAQ,OAAO,UAAU,MAAM;AACjC,gBAAM,EAAE,QAAQ,GAAG,KAAK,IAAI;AAC5B,iBAAO;AAAA,QACX,GAAG;AACH,eAAO,MAAM,SAAS,SAAS,EAAE,QAAQ,OAAO,QAAQ,OAAO,SAAS,iBAAiB,CAAC;AAAA,MAC9F;AACA,UAAI,IAAI;AACJ,YAAI,MAAM,MAAM,GAAG,KAAK,OAAO,QAAQ,MAAM;AAC7C,YAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,OAAQ,IAAY,MAAO,OAAO,IAAY;AACzE,YAAI,CAAC,IAAK,OAAM,CAAC;AACjB,eAAO,EAAE,QAAQ,OAAO,QAAQ,SAAS,KAAK,OAAO,IAAI,OAAO;AAAA,MACpE;AACA,YAAM,EAAE,YAAY,KAAK,SAAS,6BAA6B;AAAA,IACnE;AAEA,QAAI,WAAW,SAAS;AAEpB,aAAO,EAAE,QAAQ,OAAO,QAAQ,SAAS,CAAC,EAAE;AAAA,IAChD;AAEA,UAAM,EAAE,YAAY,KAAK,SAAS,wBAAwB,MAAM,GAAG;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYQ,6BAA6B,MAAkC;AACnE,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,IAAI,KAAK,MAAM,2BAA2B;AAChD,QAAI,CAAC,EAAG,QAAO;AACf,UAAM,YAAY,EAAE,CAAC;AAIrB,QAAI,KAAK,SAAS,sBAAsB,EAAG,QAAO;AAClD,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAc,0BAA0B,SAA8B,MAA6B;AAQ/F,UAAM,YAAY,CAAC,UAAU,WAAW,YAAY;AACpD,QAAI,UAAU,KAAK,OAAK,KAAK,WAAW,CAAC,CAAC,GAAG;AACzC;AAAA,IACJ;AAGA,QAAI,CAAC,KAAK,aAAa;AACnB;AAAA,IACJ;AAOA,UAAM,UAAU,QAAQ,SAAS;AACjC,UAAM,YAAY,CAAC,SAAqC;AACpD,UAAI,CAAC,QAAS,QAAO;AACrB,YAAM,IAAS;AACf,UAAI,OAAO,EAAE,QAAQ,YAAY;AAC7B,cAAM,IAAI,EAAE,IAAI,IAAI;AACpB,eAAO,KAAK,OAAO,SAAY,OAAO,CAAC;AAAA,MAC3C;AACA,YAAM,QAAQ,KAAK,YAAY;AAC/B,iBAAW,KAAK,OAAO,KAAK,CAAC,GAAG;AAC5B,YAAI,EAAE,YAAY,MAAM,OAAO;AAC3B,gBAAM,IAAI,EAAE,CAAC;AACb,iBAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAK,KAAK,OAAO,SAAY,OAAO,CAAC;AAAA,QACtE;AAAA,MACJ;AACA,aAAO;AAAA,IACX;AAEA,QAAI;AAEA,YAAM,mBAAmB,KAAK,6BAA6B,IAAI,KACxD,QAAQ,SAAS,QAAQ;AAChC,UAAI,kBAAkB;AAClB,cAAM,SAAS,MAAM,KAAK,YAAY,YAAY,gBAAgB;AAClE,YAAI,QAAQ;AACR,kBAAQ,gBAAgB;AACxB,kBAAQ,aAAa;AACrB;AAAA,QACJ;AAAA,MACJ;AAGA,YAAM,OAAO,UAAU,MAAM;AAC7B,UAAI,MAAM;AAEN,cAAM,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC;AAClC,cAAM,SAAS,MAAM,KAAK,YAAY,kBAAkB,QAAQ;AAChE,YAAI,QAAQ;AACR,kBAAQ,gBAAgB,OAAO;AAC/B,kBAAQ,aAAa,OAAO;AAC5B;AAAA,QACJ;AAAA,MACJ;AAGA,YAAM,cAAc,UAAU,kBAAkB;AAChD,UAAI,aAAa;AACb,cAAM,SAAS,MAAM,KAAK,YAAY,YAAY,WAAW;AAC7D,YAAI,QAAQ;AACR,kBAAQ,gBAAgB;AACxB,kBAAQ,aAAa;AACrB;AAAA,QACJ;AAAA,MACJ;AAGA,UAAI;AACA,cAAM,cAAmB,MAAM,KAAK,WAAW,gBAAgB,KAAK,IAAI;AACxE,cAAM,cAAc,MAAM,aAAa,KAAK,aAAa;AAAA,UACrD,SAAS,QAAQ,SAAS;AAAA,QAC9B,CAAC;AAED,cAAM,sBAAsB,aAAa,SAAS,uBAAuB,aAAa,SAAS;AAC/F,YAAI,qBAAqB;AACrB,gBAAM,SAAS,MAAM,KAAK,YAAY,YAAY,mBAAmB;AACrE,cAAI,QAAQ;AACR,oBAAQ,gBAAgB;AACxB,oBAAQ,aAAa;AACrB;AAAA,UACJ;AAAA,QACJ;AAGA,cAAM,uBAAuB,aAAa,SAAS;AACnD,YAAI,sBAAsB;AAEtB,gBAAM,YAAY,MAAM,KAAK,mBAAmB;AAChD,gBAAM,KAAK,aAAa,MAAM,KAAK,eAAe,UAAU;AAC5D,cAAI,IAAI;AACJ,gBAAI,OAAO,MAAM,GAAG,KAAK,mBAAmB;AAAA,cACxC,OAAO;AAAA,gBACH,iBAAiB;AAAA,gBACjB,YAAY;AAAA,cAChB;AAAA,cACA,OAAO;AAAA,YACX,CAAQ;AACR,gBAAI,QAAS,KAAa,MAAO,QAAQ,KAAa;AACtD,gBAAI,MAAM,QAAQ,IAAI,KAAK,KAAK,CAAC,GAAG;AAChC,oBAAM,aAAa,KAAK,CAAC;AACzB,oBAAM,SAAS,MAAM,KAAK,YAAY,YAAY,WAAW,EAAE;AAC/D,kBAAI,QAAQ;AACR,wBAAQ,gBAAgB,WAAW;AACnC,wBAAQ,aAAa;AACrB;AAAA,cACJ;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ,SAAS,cAAc;AAEnB,gBAAQ,MAAM,+CAA+C,YAAY;AAAA,MAC7E;AAMA,UAAI,KAAK,gBAAgB,iBAAiB,KAAK,sBAAsB,GAAG;AACpE,cAAM,MAAM,KAAK;AACjB,cAAM,SAAS,MAAM,KAAK,YAAY,YAAY,IAAI,aAAa;AACnE,YAAI,QAAQ;AACR,kBAAQ,gBAAgB,IAAI;AAC5B,kBAAQ,aAAa;AACrB;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ,SAAS,OAAO;AACZ,cAAQ,MAAM,mDAAmD,KAAK;AAAA,IAC1E;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAc,yBACV,SACA,MAC6C;AAC7C,QAAI,CAAC,KAAK,kBAAmB,QAAO;AAGpC,UAAM,YAAY,CAAC,SAAS,UAAU,WAAW,YAAY;AAC7D,QAAI,UAAU,KAAK,OAAK,KAAK,WAAW,CAAC,CAAC,EAAG,QAAO;AAEpD,UAAM,gBAAgB,QAAQ;AAC9B,QAAI,CAAC,cAAe,QAAO;AAG3B,QAAI,kBAAkB,gBAAe,sBAAuB,QAAO;AAInE,QAAI;AACJ,QAAI;AACJ,QAAI;AACA,YAAM,cAAmB,MAAM,KAAK,eAAe,gBAAgB,KAAK,IAAI;AAC5E,YAAM,cAAc,MAAM,aAAa,KAAK,aAAa;AAAA,QACrD,SAAS,QAAQ,SAAS;AAAA,MAC9B,CAAC;AACD,eAAS,aAAa,MAAM,MAAM,aAAa,SAAS;AACxD,6BAAuB,aAAa,SAAS;AAAA,IACjD,QAAQ;AAEJ,aAAO;AAAA,IACX;AAEA,QAAI,CAAC,OAAQ,QAAO;AAGpB,QAAI,yBAAyB,gBAAe,gBAAiB,QAAO;AAGpE,UAAM,WAAW,GAAG,aAAa,IAAI,MAAM;AAC3C,UAAM,SAAS,KAAK,gBAAgB,IAAI,QAAQ;AAChD,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,UAAU,MAAM,SAAS,gBAAe,yBAAyB;AACjE,aAAO;AAAA,IACX;AACA,QAAI,QAAQ;AACR,WAAK,gBAAgB,OAAO,QAAQ;AAAA,IACxC;AAGA,QAAI;AACA,YAAM,YAAY,MAAM,KAAK,mBAAmB;AAChD,YAAM,KAAK,aAAa,MAAM,KAAK,eAAe,UAAU;AAC5D,UAAI,CAAC,GAAI,QAAO;AAEhB,UAAI,OAAO,MAAM,GAAG,KAAK,0BAA0B;AAAA,QAC/C,OAAO,EAAE,gBAAgB,eAAe,SAAS,OAAO;AAAA,QACxD,OAAO;AAAA,MACX,CAAQ;AACR,UAAI,QAAS,KAAa,MAAO,QAAQ,KAAa;AACtD,YAAM,WAAW,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS;AAEtD,UAAI,UAAU;AACV,aAAK,gBAAgB,IAAI,UAAU,GAAG;AACtC,eAAO;AAAA,MACX;AAEA,aAAO,KAAK;AAAA,QACR,mBAAmB,MAAM,+BAA+B,aAAa;AAAA,QACrE;AAAA,QACA,EAAE,eAAe,QAAQ,MAAM,8BAA8B;AAAA,MACjE;AAAA,IACJ,SAAS,KAAK;AAGV,cAAQ,MAAM,6CAA6C,GAAG;AAC9D,aAAO;AAAA,IACX;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,iBAAiB,QAAgB;AAGnC,UAAM;AAAA,MACF;AAAA,MAAS;AAAA,MAAY;AAAA,MAAW;AAAA,MAAa;AAAA,MAC7C;AAAA,MAAc;AAAA,MAAa;AAAA,MAAO;AAAA,MAAiB;AAAA,MACnD;AAAA,MAAO;AAAA,MAAe;AAAA,MAAU;AAAA,MAAU;AAAA,IAC9C,IAAI,MAAM,QAAQ,IAAI;AAAA,MAClB,KAAK,eAAe,gBAAgB,KAAK,IAAI;AAAA,MAC7C,KAAK,eAAe,gBAAgB,KAAK,OAAO;AAAA,MAChD,KAAK,eAAe,gBAAgB,KAAK,MAAM;AAAA,MAC/C,KAAK,eAAe,gBAAgB,KAAK,QAAQ;AAAA,MACjD,KAAK,eAAe,gBAAgB,KAAK,cAAc,CAAC;AAAA,MACxD,KAAK,eAAe,gBAAgB,KAAK,SAAS;AAAA,MAClD,KAAK,eAAe,gBAAgB,KAAK,QAAQ;AAAA,MACjD,KAAK,eAAe,gBAAgB,KAAK,EAAE;AAAA,MAC3C,KAAK,eAAe,gBAAgB,KAAK,YAAY;AAAA,MACrD,KAAK,eAAe,gBAAgB,KAAK,IAAI;AAAA,MAC7C,KAAK,eAAe,gBAAgB,KAAK,EAAE;AAAA,MAC3C,KAAK,eAAe,gBAAgB,KAAK,UAAU;AAAA,MACnD,KAAK,eAAe,gBAAgB,KAAK,KAAK;AAAA,MAC9C,KAAK,eAAe,gBAAgB,KAAK,KAAK;AAAA,MAC9C,KAAK,eAAe,gBAAgB,KAAK,GAAG;AAAA,IAChD,CAAC;AAED,UAAM,UAAkB,CAAC,CAAC;AAC1B,UAAM,aAAkB,CAAC,EAAE,cAAc,KAAK,OAAO;AACrD,UAAM,YAAkB,CAAC,CAAC;AAC1B,UAAM,gBAAkB,CAAC,CAAC;AAC1B,UAAM,WAAkB,CAAC,CAAC;AAC1B,UAAM,eAAkB,CAAC,CAAC;AAC1B,UAAM,cAAkB,CAAC,CAAC;AAC1B,UAAM,QAAkB,CAAC,CAAC;AAC1B,UAAM,kBAAkB,CAAC,CAAC;AAC1B,UAAM,UAAkB,CAAC,CAAC;AAC1B,UAAM,QAAkB,CAAC,CAAC;AAC1B,UAAM,gBAAkB,CAAC,CAAC;AAC1B,UAAM,WAAkB,CAAC,CAAC;AAC1B,UAAM,WAAkB,CAAC,CAAC;AAC1B,UAAM,SAAkB,CAAC,CAAC;AAG1B,UAAM,SAAS;AAAA,MACP,MAAe,GAAG,MAAM;AAAA,MACxB,UAAe,GAAG,MAAM;AAAA,MACxB,UAAe,GAAG,MAAM;AAAA,MACxB,MAAe,UAAU,GAAG,MAAM,UAAU;AAAA,MAC5C,IAAe,QAAQ,GAAG,MAAM,QAAQ;AAAA,MACxC,SAAe,aAAa,GAAG,MAAM,aAAa;AAAA,MAClD,SAAe,WAAW,GAAG,MAAM,aAAa;AAAA,MAChD,WAAe,eAAe,GAAG,MAAM,eAAe;AAAA,MACtD,YAAe,gBAAgB,GAAG,MAAM,gBAAgB;AAAA,MACxD,UAAe,cAAc,GAAG,MAAM,cAAc;AAAA,MACpD,UAAe,gBAAgB,GAAG,MAAM,cAAc;AAAA,MACtD,eAAe,kBAAkB,GAAG,MAAM,mBAAmB;AAAA,MAC7D,IAAe,QAAQ,GAAG,MAAM,QAAQ;AAAA,MACxC,MAAe,UAAU,GAAG,MAAM,UAAU;AAAA,IACpD;AAMA,UAAM,eAAe,CAAC,OAAgB,cAAuB;AAAA,MACzD,SAAS;AAAA,MAAM,QAAQ;AAAA,MAAsB,cAAc;AAAA,MAAM;AAAA,MAAO;AAAA,IAC5E;AACA,UAAM,iBAAiB,CAAC,UAAkB;AAAA,MACtC,SAAS;AAAA,MAAO,QAAQ;AAAA,MAAwB,cAAc;AAAA,MAC9D,SAAS,aAAa,IAAI;AAAA,IAC9B;AAGA,QAAI,SAAS,EAAE,SAAS,MAAM,WAAW,CAAC,IAAI,GAAG,UAAU,MAAM;AACjE,QAAI,WAAW,SAAS;AACpB,YAAM,gBAAgB,OAAO,QAAQ,qBAAqB,aACpD,QAAQ,iBAAiB,IAAI;AACnC,YAAM,UAAU,OAAO,QAAQ,eAAe,aACxC,QAAQ,WAAW,IAAI,CAAC;AAC9B,eAAS;AAAA,QACL,SAAS;AAAA,QACT,WAAW,QAAQ,SAAS,IAAI,UAAU,CAAC,aAAa;AAAA,QACxD,UAAU;AAAA,MACd;AAAA,IACJ;AAEA,WAAO;AAAA,MACH,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa,OAAO,YAAY,aAAa;AAAA,MAC7C;AAAA,MACA,WAAW;AAAA;AAAA,MACX,UAAU;AAAA,QACN,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,OAAO;AAAA,QACP,WAAW;AAAA,QACX,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,eAAe;AAAA,QACf,MAAM;AAAA,MACV;AAAA,MACA,UAAU;AAAA;AAAA,QAEN,UAAgB,EAAE,SAAS,MAAM,QAAQ,YAAqB,cAAc,MAAM,OAAO,OAAO,UAAU,UAAU,UAAU,SAAS,6CAA6C;AAAA,QACpL,MAAgB,aAAa,OAAO,MAAM,QAAQ;AAAA;AAAA,QAElD,MAAgB,UAAU,aAAa,OAAO,IAAI,IAAI,eAAe,MAAM;AAAA,QAC3E,YAAgB,gBAAgB,aAAa,OAAO,UAAU,IAAI,eAAe,YAAY;AAAA,QAC7F,WAAgB,eAAe,aAAa,OAAO,SAAS,IAAI,eAAe,WAAW;AAAA,QAC1F,OAAgB,WAAW,aAAa,IAAI,eAAe,OAAO;AAAA,QAClE,OAAgB,WAAW,aAAa,IAAI,eAAe,OAAO;AAAA,QAClE,KAAgB,SAAS,aAAa,IAAI,eAAe,KAAK;AAAA,QAC9D,IAAgB,QAAQ,aAAa,OAAO,EAAE,IAAI,eAAe,IAAI;AAAA,QACrE,UAAgB,cAAc,aAAa,OAAO,QAAQ,IAAI,eAAe,UAAU;AAAA,QACvF,UAAgB,gBAAgB,aAAa,OAAO,QAAQ,IAAI,eAAe,UAAU;AAAA,QACzF,cAAgB,kBAAkB,aAAa,OAAO,aAAa,IAAI,eAAe,cAAc;AAAA,QACpG,IAAgB,QAAQ,aAAa,OAAO,EAAE,IAAI,eAAe,IAAI;AAAA,QACrE,MAAgB,UAAU,aAAa,OAAO,IAAI,IAAI,eAAe,MAAM;AAAA,QAC3E,SAAgB,aAAa,aAAa,OAAO,OAAO,IAAI,eAAe,SAAS;AAAA,QACpF,gBAAgB,WAAW,aAAa,OAAO,OAAO,IAAI,eAAe,cAAc;AAAA,QACvF,QAAgB,YAAY,aAAa,IAAI,eAAe,QAAQ;AAAA,MACxE;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,MAA0C,SAA8B;AACxF,QAAI,CAAC,QAAQ,CAAC,KAAK,OAAO;AACrB,YAAM,EAAE,YAAY,KAAK,SAAS,gCAAgC;AAAA,IACvE;AAEA,QAAI,OAAO,KAAK,OAAO,YAAY,YAAY;AAC3C,YAAM,EAAE,YAAY,KAAK,SAAS,gCAAgC;AAAA,IACtE;AAEA,WAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,KAAK,WAAW;AAAA,MACnD,SAAS,QAAQ;AAAA,IACrB,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,MAAc,QAAgB,MAAW,SAA6D;AAEnH,UAAM,cAAc,MAAM,KAAK,WAAW,gBAAgB,KAAK,IAAI;AACnE,QAAI,eAAe,OAAO,YAAY,YAAY,YAAY;AAC1D,YAAM,WAAW,MAAM,YAAY,QAAQ,QAAQ,SAAS,QAAQ,QAAQ;AAC5E,aAAO,EAAE,SAAS,MAAM,QAAQ,SAAS;AAAA,IAC7C;AAGA,UAAM,iBAAiB,KAAK,QAAQ,QAAQ,EAAE;AAC9C,WAAO,KAAK,iBAAiB,gBAAgB,QAAQ,IAAI;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,iBAAiB,MAAc,QAAgB,MAAiC;AACpF,UAAM,IAAI,OAAO,YAAY;AAC7B,UAAM,yBAAyB;AAG/B,SAAK,SAAS,mBAAmB,SAAS,eAAe,MAAM,QAAQ;AACnE,YAAM,KAAK,QAAQ,WAAW,CAAC;AAC/B,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU;AAAA,UACN,QAAQ;AAAA,UACR,MAAM;AAAA,YACF,MAAM,EAAE,IAAI,MAAM,MAAM,QAAQ,aAAa,OAAO,MAAM,SAAS,mBAAmB,eAAe,OAAO,YAAW,oBAAI,KAAK,GAAE,YAAY,GAAG,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,YACrL,SAAS,EAAE,IAAI,WAAW,EAAE,IAAI,QAAQ,IAAI,OAAO,cAAc,EAAE,IAAI,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,sBAAsB,EAAE,YAAY,EAAE;AAAA,UAClJ;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ;AAGA,SAAK,SAAS,mBAAmB,SAAS,YAAY,MAAM,QAAQ;AAChE,YAAM,KAAK,QAAQ,WAAW,CAAC;AAC/B,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU;AAAA,UACN,QAAQ;AAAA,UACR,MAAM;AAAA,YACF,MAAM,EAAE,IAAI,MAAM,aAAa,OAAO,MAAM,SAAS,mBAAmB,eAAe,MAAM,YAAW,oBAAI,KAAK,GAAE,YAAY,GAAG,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,YACtK,SAAS,EAAE,IAAI,WAAW,EAAE,IAAI,QAAQ,IAAI,OAAO,cAAc,EAAE,IAAI,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,sBAAsB,EAAE,YAAY,EAAE;AAAA,UAClJ;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ;AAGA,QAAI,SAAS,iBAAiB,MAAM,OAAO;AACvC,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU,EAAE,QAAQ,KAAK,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,EAAE;AAAA,MACjE;AAAA,IACJ;AAGA,QAAI,SAAS,cAAc,MAAM,QAAQ;AACrC,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU,EAAE,QAAQ,KAAK,MAAM,EAAE,SAAS,KAAK,EAAE;AAAA,MACrD;AAAA,IACJ;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAe,MAAc,UAA+B,QAAiB,MAAY,OAA4C;AACvI,UAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAGhE,QAAI,MAAM,CAAC,MAAM,SAAS;AAEtB,YAAM,kBAAkB,MAAM,KAAK,eAAe,YAAY,SAAS,aAAa;AAEpF,UAAI,mBAAmB,OAAQ,gBAAwB,uBAAuB,YAAY;AACtF,YAAI;AACA,gBAAM,QAAQ,MAAO,gBAAwB,mBAAmB;AAChE,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,MAAM,CAAC,EAAE;AAAA,QAC9D,SAAS,GAAQ;AAEb,kBAAQ,KAAK,iEAAiE,EAAE,OAAO;AAAA,QAC3F;AAAA,MACJ;AAEA,YAAM,WAAW,MAAM,KAAK,eAAe,UAAU;AACrD,UAAI,YAAY,OAAO,SAAS,iBAAiB,YAAY;AACzD,cAAM,SAAS,MAAM,SAAS,aAAa,CAAC,CAAC;AAC7C,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AAEA,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,OAAO,CAAC,UAAU,OAAO,QAAQ,EAAE,CAAC,EAAE;AAAA,IAC3F;AAIA,QAAI,MAAM,UAAU,KAAK,MAAM,MAAM,SAAS,CAAC,MAAM,gBAAgB,CAAC,UAAU,WAAW,QAAQ;AAC/F,YAAM,OAAO,MAAM,CAAC;AACpB,YAAM,OAAO,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG;AACxC,YAAM,kBAAkB,MAAM,KAAK,WAAW,gBAAgB,KAAK,QAAQ;AAC3E,UAAI,mBAAmB,OAAQ,gBAAwB,iBAAiB,YAAY;AAChF,cAAM,OAAO,MAAO,gBAAwB,aAAa,MAAM,IAAI;AACnE,YAAI,SAAS,OAAW,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,aAAa,GAAG,EAAE;AACvF,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,MACzD;AAEA,YAAM,UAAU,MAAM,KAAK,eAAe,YAAY,SAAS,aAAa;AAC5E,UAAI,WAAW,OAAQ,QAAgB,iBAAiB,YAAY;AAChE,YAAI;AACA,gBAAM,eAAe,MAAO,QAAgB,aAAa,MAAM,IAAI;AACnE,cAAI,iBAAiB,OAAW,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,YAAY,EAAE;AAAA,QACjG,QAAQ;AAAA,QAAqB;AAAA,MACjC;AACA,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,aAAa,GAAG,EAAE;AAAA,IACnE;AAOA,QAAI,MAAM,UAAU,GAAG;AACnB,YAAM,OAAO,MAAM,CAAC;AACpB,YAAM,OAAO,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG;AAEpC,YAAM,YAAY,OAAO,WAAW;AAGpC,UAAI,WAAW,SAAS,MAAM;AAE1B,cAAM,WAAW,MAAM,KAAK,eAAe,UAAU;AAErD,YAAI,YAAY,OAAO,SAAS,iBAAiB,YAAY;AACzD,cAAI;AACA,kBAAM,iBAAiB,MAAM,KAAK,4BAA4B,QAAQ;AACtE,kBAAM,SAAS,MAAM,SAAS,aAAa,EAAE,MAAM,MAAM,MAAM,MAAM,eAAe,CAAC;AACrF,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,UAC3D,SAAS,GAAQ;AACb,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,EAAE,SAAS,GAAG,EAAE;AAAA,UACjE;AAAA,QACJ;AAGA,cAAM,UAAU,MAAM,KAAK,eAAe,YAAY,SAAS,aAAa;AAC5E,YAAI,WAAW,OAAQ,QAAgB,aAAa,YAAY;AAC5D,cAAI;AACA,kBAAM,OAAO,MAAO,QAAgB,SAAS,MAAM,MAAM,IAAI;AAC7D,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,UACzD,SAAS,GAAQ;AACb,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,EAAE,WAAW,sBAAsB,GAAG,EAAE;AAAA,UACzF;AAAA,QACJ;AACA,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,sBAAsB,GAAG,EAAE;AAAA,MAC5E;AAEA,UAAI;AAEA,YAAI,SAAS,aAAa,SAAS,UAAU;AAQzC,gBAAMC,YAAW,MAAM,KAAK,eAAe,UAAU;AACrD,gBAAM,YAAY,OAAOA,WAAU,iBAAiB,aAC9CA,UAAS,aAAa,IACtBA,WAAU;AAChB,gBAAM,SAAS,cAAc;AAE7B,cAAI,UAAU,OAAOA,UAAS,gBAAgB,YAAY;AACtD,gBAAI;AACA,oBAAM,iBAAiB,MAAM,KAAK,4BAA4B,QAAQ;AACtE,oBAAM,OAAO,MAAMA,UAAS,YAAY,EAAE,MAAM,UAAU,MAAM,eAAe,CAAC;AAGhF,kBAAI,SAAS,KAAK,QAAQ,OAAO;AAC7B,uBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,cACzD;AAAA,YACJ,QAAQ;AAAA,YAAuC;AAAA,UACnD;AAEA,gBAAM,YAAY,MAAM,KAAK,mBAAmB;AAChD,cAAI,WAAW,UAAU;AACrB,kBAAM,OAAO,UAAU,SAAS,UAAU,IAAI;AAC9C,gBAAI,KAAM,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,UACnE;AAKA,cAAI,CAAC,UAAUA,aAAY,OAAOA,UAAS,gBAAgB,YAAY;AACnE,gBAAI;AACA,oBAAM,iBAAiB,MAAM,KAAK,4BAA4B,QAAQ;AACtE,oBAAM,OAAO,MAAMA,UAAS,YAAY,EAAE,MAAM,UAAU,MAAM,eAAe,CAAC;AAChF,kBAAI,SAAS,KAAK,QAAQ,OAAO;AAC7B,uBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,cACzD;AAAA,YACJ,QAAQ;AAAA,YAA4B;AAAA,UACxC;AACA,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,aAAa,GAAG,EAAE;AAAA,QACnE;AAGA,cAAM,eAAe,iBAAiB,IAAI;AAG1C,cAAM,WAAW,MAAM,KAAK,eAAe,UAAU;AACrD,YAAI,YAAY,OAAO,SAAS,gBAAgB,YAAY;AACvD,cAAI;AACD,kBAAM,iBAAiB,MAAM,KAAK,4BAA4B,QAAQ;AACtE,kBAAM,OAAO,MAAM,SAAS,YAAY,EAAE,MAAM,cAAc,MAAM,WAAW,eAAe,CAAC;AAC/F,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,UACxD,SAAS,GAAQ;AAAA,UAEjB;AAAA,QACL;AAGA,cAAM,UAAU,MAAM,KAAK,eAAe,YAAY,SAAS,aAAa;AAC5E,YAAI,WAAW,OAAQ,QAAgB,YAAY,YAAY;AAC3D,cAAI;AACA,kBAAM,OAAO,MAAO,QAAgB,QAAQ,cAAc,IAAI;AAC9D,gBAAI,KAAM,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,UACnE,QAAQ;AAAA,UAAkB;AAAA,QAC9B;AACA,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,aAAa,GAAG,EAAE;AAAA,MACnE,SAAS,GAAQ;AAGb,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,EAAE,SAAS,GAAG,EAAE;AAAA,MACjE;AAAA,IACJ;AAGA,QAAI,MAAM,WAAW,GAAG;AACpB,YAAM,aAAa,MAAM,CAAC;AAE1B,YAAM,YAAY,OAAO,WAAW;AAGpC,YAAM,WAAW,MAAM,KAAK,eAAe,UAAU;AACrD,UAAI,YAAY,OAAO,SAAS,iBAAiB,YAAY;AACzD,YAAI;AACA,gBAAM,iBAAiB,MAAM,KAAK,4BAA4B,QAAQ;AACtE,gBAAM,OAAO,MAAM,SAAS,aAAa,EAAE,MAAM,YAAY,WAAW,eAAe,CAAC;AAExF,cAAI,SAAS,KAAK,UAAU,UAAa,MAAM,QAAQ,IAAI,IAAI;AAC3D,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,UACzD;AAAA,QACJ,QAAQ;AAAA,QAER;AAAA,MACJ;AAGA,YAAM,kBAAkB,MAAM,KAAK,WAAW,gBAAgB,KAAK,QAAQ;AAC3E,UAAI,mBAAmB,OAAQ,gBAAwB,SAAS,YAAY;AACxE,YAAI;AACA,cAAI,QAAQ,MAAO,gBAAwB,KAAK,UAAU;AAG1D,cAAI,aAAa,SAAS,MAAM,SAAS,GAAG;AACxC,oBAAQ,MAAM,OAAO,CAAC,SAAc,MAAM,eAAe,SAAS;AAAA,UACtE;AACA,cAAI,SAAS,MAAM,SAAS,GAAG;AAC3B,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,MAAM,YAAY,MAAM,CAAC,EAAE;AAAA,UAChF;AAAA,QACJ,SAAS,GAAQ;AAGb,gBAAM,gBAAgB,OAAO,UAAU,EAAE,QAAQ,aAAa,EAAE;AAChE,kBAAQ,MAAM,4DAA4D,eAAe,UAAU,EAAE,OAAO;AAAA,QAChH;AAAA,MACJ;AAGA,YAAM,YAAY,MAAM,KAAK,mBAAmB;AAChD,UAAI,WAAW,UAAU;AACrB,YAAI,eAAe,WAAW;AAC1B,gBAAM,OAAO,UAAU,SAAS,cAAc,SAAS;AACvD,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAAA,QACpF;AAEA,cAAM,QAAQ,UAAU,SAAS,YAAY,YAAY,SAAS;AAClE,YAAI,SAAS,MAAM,SAAS,GAAG;AAC3B,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,MAAM,YAAY,MAAM,CAAC,EAAE;AAAA,QAChF;AAEA,cAAM,MAAM,UAAU,SAAS,UAAU,UAAU;AACnD,YAAI,IAAK,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,GAAG,EAAE;AAAA,MACjE;AACA,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,aAAa,GAAG,EAAE;AAAA,IACnE;AAGA,QAAI,MAAM,WAAW,GAAG;AAEpB,YAAM,kBAAkB,MAAM,KAAK,eAAe,YAAY,SAAS,aAAa;AACpF,UAAI,mBAAmB,OAAQ,gBAAwB,uBAAuB,YAAY;AACtF,YAAI;AACA,gBAAM,QAAQ,MAAO,gBAAwB,mBAAmB;AAChE,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,MAAM,CAAC,EAAE;AAAA,QAC9D,QAAQ;AAAA,QAAqB;AAAA,MACjC;AAEA,YAAM,WAAW,MAAM,KAAK,eAAe,UAAU;AACrD,UAAI,YAAY,OAAO,SAAS,iBAAiB,YAAY;AACzD,cAAM,SAAS,MAAM,SAAS,aAAa,CAAC,CAAC;AAC7C,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AACA,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,OAAO,CAAC,UAAU,OAAO,QAAQ,EAAE,CAAC,EAAE;AAAA,IAC3F;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,MAAc,QAAgB,MAAW,OAAY,UAA8D;AAChI,UAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG;AAChD,UAAM,aAAa,MAAM,CAAC;AAE1B,QAAI,CAAC,YAAY;AACb,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,wBAAwB,GAAG,EAAE;AAAA,IAC9E;AAGA,QAAI,CAAC,SAAS,cAAc,KAAK,aAAa;AAC1C,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU,KAAK,MAAM,sGAAsG,GAAG;AAAA,MAClI;AAAA,IACJ;AAEA,UAAM,IAAI,OAAO,YAAY;AAG7B,QAAI,MAAM,SAAS,GAAG;AAClB,YAAM,SAAS,MAAM,CAAC;AAGtB,UAAI,WAAW,WAAW,MAAM,QAAQ;AAEpC,cAAM,SAAS,MAAM,KAAK,SAAS,SAAS,EAAE,QAAQ,YAAY,GAAG,KAAK,GAAG,SAAS,YAAY,SAAS,eAAe,SAAS,gBAAgB;AACnJ,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,OAAO;AACnC,cAAM,KAAK,MAAM,CAAC;AAGlB,cAAM,EAAE,QAAQ,OAAO,IAAI,SAAS,CAAC;AACrC,cAAM,gBAAyC,CAAC;AAChD,YAAI,UAAU,KAAM,eAAc,SAAS;AAC3C,YAAI,UAAU,KAAM,eAAc,SAAS;AAE3C,cAAM,SAAS,MAAM,KAAK,SAAS,OAAO,EAAE,QAAQ,YAAY,IAAI,GAAG,cAAc,GAAG,SAAS,YAAY,SAAS,eAAe,SAAS,gBAAgB;AAC9J,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,SAAS;AACrC,cAAM,KAAK,MAAM,CAAC;AAElB,cAAM,SAAS,MAAM,KAAK,SAAS,UAAU,EAAE,QAAQ,YAAY,IAAI,MAAM,KAAK,GAAG,SAAS,YAAY,SAAS,eAAe,SAAS,gBAAgB;AAC3J,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,UAAU;AACtC,cAAM,KAAK,MAAM,CAAC;AAElB,cAAM,SAAS,MAAM,KAAK,SAAS,UAAU,EAAE,QAAQ,YAAY,GAAG,GAAG,SAAS,YAAY,SAAS,eAAe,SAAS,gBAAgB;AAC/I,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AAAA,IACJ,OAAO;AAEH,UAAI,MAAM,OAAO;AASb,cAAM,aAAsC,EAAE,GAAG,MAAM;AAOvD,YAAI,WAAW,UAAU,QAAQ,WAAW,WAAW,MAAM;AACzD,qBAAW,QAAQ,WAAW,SAAS,WAAW,UAAU,WAAW;AACvE,iBAAO,WAAW;AAClB,iBAAO,WAAW;AAAA,QACtB;AAEA,YAAI,WAAW,UAAU,QAAQ,WAAW,UAAU,MAAM;AACxD,qBAAW,SAAS,WAAW;AAC/B,iBAAO,WAAW;AAAA,QACtB;AAEA,YAAI,WAAW,QAAQ,QAAQ,WAAW,WAAW,MAAM;AACvD,qBAAW,UAAU,WAAW;AAChC,iBAAO,WAAW;AAAA,QACtB;AAEA,YAAI,WAAW,OAAO,QAAQ,WAAW,SAAS,MAAM;AACpD,qBAAW,QAAQ,WAAW;AAC9B,iBAAO,WAAW;AAAA,QACtB;AAEA,YAAI,WAAW,QAAQ,QAAQ,WAAW,UAAU,MAAM;AACtD,qBAAW,SAAS,WAAW;AAC/B,iBAAO,WAAW;AAAA,QACtB;AAGA,cAAM,SAAS,MAAM,KAAK,SAAS,SAAS,EAAE,QAAQ,YAAY,OAAO,WAAW,GAAG,SAAS,YAAY,SAAS,eAAe,SAAS,gBAAgB;AAC7J,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AAGA,UAAI,MAAM,QAAQ;AAEd,cAAM,SAAS,MAAM,KAAK,SAAS,UAAU,EAAE,QAAQ,YAAY,MAAM,KAAK,GAAG,SAAS,YAAY,SAAS,eAAe,SAAS,gBAAgB;AACvJ,cAAM,MAAM,KAAK,QAAQ,MAAM;AAC/B,YAAI,SAAS;AACb,eAAO,EAAE,SAAS,MAAM,UAAU,IAAI;AAAA,MAC1C;AAAA,IACJ;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,MAAc,QAAgB,MAAW,UAA8D;AACzH,UAAM,mBAAmB,MAAM,KAAK,WAAW,gBAAgB,KAAK,SAAS;AAC7E,QAAI,CAAC,iBAAkB,QAAO,EAAE,SAAS,MAAM;AAE/C,UAAM,IAAI,OAAO,YAAY;AAC7B,UAAM,UAAU,KAAK,QAAQ,QAAQ,EAAE;AAGvC,QAAI,YAAY,WAAW,MAAM,QAAQ;AACrC,YAAM,SAAS,MAAM,iBAAiB,MAAM,IAAI;AAChD,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,IAC3D;AAGA,QAAI,YAAY,UAAU,MAAM,OAAO;AACnC,YAAM,SAAS,MAAM,iBAAiB,QAAQ;AAC7C,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,IAC5D;AAGA,QAAI,YAAY,SAAS,MAAM,QAAQ;AAElC,YAAM,SAAS,MAAM,iBAAiB,YAAY,IAAI;AACtD,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,IAC5D;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,WAAW,MAAc,QAAgB,OAAY,UAA8D;AACrH,UAAM,cAAc,MAAM,KAAK,WAAW,gBAAgB,KAAK,IAAI;AACnE,QAAI,CAAC,YAAa,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,8BAA8B,GAAG,EAAE;AAElG,UAAM,IAAI,OAAO,YAAY;AAC7B,UAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAEhE,QAAI,MAAM,MAAO,QAAO,EAAE,SAAS,MAAM;AAGzC,QAAI,MAAM,CAAC,MAAM,aAAa,MAAM,WAAW,GAAG;AAC9C,YAAM,UAAU,YAAY,WAAW;AACvC,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,QAAQ,CAAC,EAAE;AAAA,IAChE;AAGA,QAAI,MAAM,CAAC,MAAM,gBAAgB;AAC7B,YAAM,SAAS,MAAM,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI,OAAO;AAChE,UAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,4BAA4B,GAAG,EAAE;AAE3F,UAAI,eAAe,YAAY,gBAAgB,MAAM;AAIrD,UAAI,OAAO,KAAK,YAAY,EAAE,WAAW,GAAG;AACxC,cAAM,mBAAmB,OAAO,YAAY,eAAe,aACrD,YAAY,WAAW,IAAI,CAAC;AAClC,cAAM,WAAW,cAAc,QAAQ,gBAAgB;AACvD,YAAI,YAAY,aAAa,QAAQ;AACjC,yBAAe,YAAY,gBAAgB,QAAQ;AACnD,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,QAAQ,UAAU,iBAAiB,QAAQ,aAAa,CAAC,EAAE;AAAA,QAChH;AAAA,MACJ;AAEA,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,QAAQ,aAAa,CAAC,EAAE;AAAA,IAC7E;AAGA,QAAI,MAAM,CAAC,MAAM,YAAY,MAAM,UAAU,GAAG;AAC5C,YAAM,aAAa,mBAAmB,MAAM,CAAC,CAAC;AAC9C,UAAI,SAAS,MAAM,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI,OAAO;AAC9D,UAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,4BAA4B,GAAG,EAAE;AAG3F,YAAM,mBAAmB,OAAO,YAAY,eAAe,aACrD,YAAY,WAAW,IAAI,CAAC;AAClC,YAAM,WAAW,cAAc,QAAQ,gBAAgB;AACvD,UAAI,SAAU,UAAS;AAEvB,UAAI,OAAO,YAAY,mBAAmB,YAAY;AAClD,cAAMC,UAAS,YAAY,eAAe,YAAY,MAAM;AAC5D,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,QAAQ,YAAY,QAAQ,QAAAA,QAAO,CAAC,EAAE;AAAA,MAC3F;AAEA,YAAM,eAAe,YAAY,gBAAgB,MAAM;AACvD,YAAM,SAAS,KAAK,UAAU;AAC9B,YAAM,SAAiC,CAAC;AACxC,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,YAAY,GAAG;AACrD,YAAI,IAAI,WAAW,MAAM,GAAG;AACxB,iBAAO,IAAI,UAAU,OAAO,MAAM,CAAC,IAAI;AAAA,QAC3C;AAAA,MACJ;AACA,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,QAAQ,YAAY,QAAQ,OAAO,CAAC,EAAE;AAAA,IAC3F;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,eAAe,MAAc,QAAgB,MAAW,OAAY,UAA8D;AACpI,UAAM,IAAI,OAAO,YAAY;AAC7B,UAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAGhE,UAAM,YAAY,MAAM,KAAK,mBAAmB;AAChD,UAAM,WAAW,WAAW;AAG5B,QAAI,CAAC,UAAU;AACX,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,iCAAiC,GAAG,EAAE;AAAA,IACvF;AAEA,QAAI;AAEA,UAAI,MAAM,WAAW,KAAK,MAAM,OAAO;AACnC,YAAI,WAAW,SAAS,eAAe;AAEvC,YAAI,OAAO,QAAQ;AACf,qBAAW,SAAS,OAAO,CAAC,MAAW,EAAE,WAAW,MAAM,MAAM;AAAA,QACpE;AACA,YAAI,OAAO,MAAM;AACb,qBAAW,SAAS,OAAO,CAAC,MAAW,EAAE,UAAU,SAAS,MAAM,IAAI;AAAA,QAC1E;AACA,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,UAAU,OAAO,SAAS,OAAO,CAAC,EAAE;AAAA,MACzF;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,QAAQ;AACpC,cAAM,MAAM,SAAS,eAAe,KAAK,YAAY,MAAM,KAAK,QAAQ;AACxE,cAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,YAAI,SAAS;AACb,eAAO,EAAE,SAAS,MAAM,UAAU,IAAI;AAAA,MAC1C;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,YAAY,MAAM,SAAS;AAC9D,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,MAAM,SAAS,cAAc,EAAE;AACrC,YAAI,CAAC,IAAK,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AACzF,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,GAAG,EAAE;AAAA,MACxD;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,aAAa,MAAM,SAAS;AAC/D,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,MAAM,SAAS,eAAe,EAAE;AACtC,YAAI,CAAC,IAAK,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AACzF,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,GAAG,EAAE;AAAA,MACxD;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,aAAa,MAAM,QAAQ;AAC9D,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,kBAAkB,MAAM,KAAK,WAAW,gBAAgB,KAAK,QAAQ;AAC3E,YAAI,mBAAmB,OAAQ,gBAAwB,mBAAmB,YAAY;AAClF,gBAAM,SAAS,MAAO,gBAAwB,eAAe,IAAI,QAAQ,CAAC,CAAC;AAC3E,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,QAC3D;AACA,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,kCAAkC,GAAG,EAAE;AAAA,MACxF;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,YAAY,MAAM,QAAQ;AAC7D,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,kBAAkB,MAAM,KAAK,WAAW,gBAAgB,KAAK,QAAQ;AAC3E,YAAI,mBAAmB,OAAQ,gBAAwB,kBAAkB,YAAY;AACjF,gBAAO,gBAAwB,cAAc,EAAE;AAC/C,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,KAAK,CAAC,EAAE;AAAA,QACtE;AACA,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,kCAAkC,GAAG,EAAE;AAAA,MACxF;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,OAAO;AACnC,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,MAAM,SAAS,WAAW,EAAE;AAClC,YAAI,CAAC,IAAK,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AACzF,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,GAAG,EAAE;AAAA,MACxD;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,UAAU;AACtC,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,UAAU,SAAS,iBAAiB,EAAE;AAC5C,YAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAC7F,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,KAAK,CAAC,EAAE;AAAA,MACtE;AAAA,IACJ,SAAS,GAAQ;AACb,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,EAAE,SAAS,EAAE,cAAc,GAAG,EAAE;AAAA,IACjF;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4CA,MAAc,4BAA4B,SAA2D;AACjG,QAAI;AACA,YAAM,cAAmB,MAAM,KAAK,eAAe,gBAAgB,KAAK,IAAI;AAC5E,YAAM,aAAa,QAAQ,SAAS;AACpC,UAAI,UAAe;AACnB,UAAI,cAAc,OAAO,eAAe,YAAY,OAAQ,WAAmB,QAAQ,YAAY;AAC/F,YAAI;AACA,gBAAM,IAAI,IAAI,QAAQ;AACtB,qBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,UAAiC,GAAG;AACpE,gBAAI,KAAK,KAAM;AACf,cAAE,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC;AAAA,UACxD;AACA,oBAAU;AAAA,QACd,QAAQ;AACJ,oBAAU;AAAA,QACd;AAAA,MACJ;AACA,YAAM,SAAS,aAAa,MAAM,OAAO,aAAa;AACtD,YAAM,cAAc,MAAM,QAAQ,YAAY,KAAK,QAAQ,EAAE,QAAQ,CAAC;AACtE,YAAM,MAAM,aAAa,SAAS;AAClC,aAAO,OAAO,QAAQ,YAAY,IAAI,SAAS,IAAI,MAAM;AAAA,IAC7D,QAAQ;AACJ,aAAO;AAAA,IACX;AAAA,EACJ;AAAA,EAEA,MAAc,oBAAoB,SAA2D;AACzF,QAAI;AACA,YAAM,cAAmB,MAAM,KAAK,eAAe,gBAAgB,KAAK,IAAI;AAC5E,YAAM,aAAa,QAAQ,SAAS;AAKpC,UAAI,UAAe;AACnB,UAAI,cAAc,OAAO,eAAe,YAAY,OAAQ,WAAmB,QAAQ,YAAY;AAC/F,YAAI;AACA,gBAAM,IAAI,IAAI,QAAQ;AACtB,qBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,UAAiC,GAAG;AACpE,gBAAI,KAAK,KAAM;AACf,cAAE,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC;AAAA,UACxD;AACA,oBAAU;AAAA,QACd,QAAQ;AACJ,oBAAU;AAAA,QACd;AAAA,MACJ;AACA,YAAM,cAAc,OAAO,aAAa,MAAM,KAAK,cAAc,aAAa,KAAK,aAAa;AAAA,QAC5F,aAAa,MAAM,OAAO,aAAa;AAAA,QACvC,EAAE,QAAQ;AAAA,MACd;AACA,aAAO,aAAa,MAAM,MAAM,aAAa,SAAS;AAAA,IAC1D,SAAS,GAAQ;AACb,aAAO;AAAA,IACX;AAAA,EACJ;AAAA,EAEA,MAAM,YAAY,MAAc,QAAgB,MAAW,OAAY,UAA8D;AACjI,UAAM,IAAI,OAAO,YAAY;AAC7B,UAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAEhE,UAAM,YAAY,MAAM,KAAK,mBAAmB;AAChD,UAAM,KAAK,aAAa,MAAM,KAAK,eAAe,UAAU;AAC5D,QAAI,CAAC,IAAI;AACL,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,oDAAoD,GAAG,EAAE;AAAA,IAC1G;AAEA,UAAM,MAAM;AACZ,UAAM,OAAO;AACb,UAAM,MAAM;AACZ,UAAM,cAAc;AACpB,UAAM,MAAM;AACZ,UAAM,cAAc;AAOpB,UAAM,mBAAmB,OACrB,YACA,YACA,WACA,aACkB;AAClB,YAAM,WAAW,MAAM,GAAG,QAAQ,KAAK,EAAE,OAAO,EAAE,aAAa,WAAW,EAAE,CAAQ;AACpF,UAAI,UAAU,GAAI,QAAO,SAAS;AAClC,YAAM,KAAK,WAAW;AACtB,YAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,YAAM,GAAG,OAAO,KAAK;AAAA,QACjB;AAAA,QACA,aAAa;AAAA,QACb,cAAc;AAAA,QACd,cAAc,UAAU,QAAQ;AAAA,QAChC,aAAa,UAAU,eAAe;AAAA,QACtC,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACX;AAOA,UAAM,0BAA0B,OAC5B,WACA,SACA,WACA,aACkB;AAClB,YAAM,WAAW,MAAM,GAAG,QAAQ,aAAa;AAAA,QAC3C,OAAO,EAAE,YAAY,WAAW,QAAQ;AAAA,MAC5C,CAAQ;AACR,UAAI,UAAU,GAAI,QAAO,SAAS;AAClC,YAAM,KAAK,WAAW;AACtB,YAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,YAAM,GAAG,OAAO,aAAa;AAAA,QACzB;AAAA,QACA,YAAY;AAAA,QACZ;AAAA,QACA,QAAQ;AAAA,QACR,eAAe,WAAW,KAAK,UAAU,QAAQ,IAAI;AAAA,QACrD,gBAAgB;AAAA,QAChB,cAAc;AAAA,QACd,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACX;AAOA,UAAM,0BAA0B,OAC5B,OACA,eACsB;AACtB,YAAM,SAAS,MAAM,GAAG,QAAQ,KAAK,EAAE,OAAO,EAAE,aAAa,WAAW,EAAE,CAAQ;AAClF,UAAI,CAAC,QAAQ,GAAI,QAAO;AACxB,aAAO,MAAM,GAAG,QAAQ,aAAa;AAAA,QACjC,OAAO,EAAE,gBAAgB,OAAO,YAAY,OAAO,GAAG;AAAA,MAC1D,CAAQ;AAAA,IACZ;AAMA,UAAM,cAAc,CAAC,aAA6B;AAC9C,YAAM,SAAS;AACf,aAAO,SAAS,WAAW,MAAM,IAAI,SAAS,MAAM,OAAO,MAAM,IAAI;AAAA,IACzE;AACA,UAAM,wBAAwB,MAAiD;AAC3E,YAAM,WAAW,KAAK,eAAe;AAQrC,YAAM,WAAgB,SAAS,+BAA+B;AAC9D,UAAI,YAAY,OAAO,SAAS,SAAS,YAAY;AACjD,YAAI;AACA,gBAAM,WAAW,SAAS,KAAK;AAC/B,gBAAM,OAAO,oBAAI,IAAY;AAC7B,gBAAMC,WAAqD,CAAC;AAC5D,qBAAW,WAAW,YAAY,CAAC,GAAG;AAClC,kBAAM,OAAO,SAAS;AACtB,gBAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,EAAG;AAC7B,iBAAK,IAAI,IAAI;AACb,YAAAA,SAAQ,KAAK,EAAE,MAAM,UAAU,0BAA0B,IAAI,GAAG,CAAC;AAAA,UACrE;AACA,cAAIA,SAAQ,SAAS,EAAG,QAAOA;AAAA,QACnC,QAAQ;AAAA,QAER;AAAA,MACJ;AACA,YAAM,UAAqD,CAAC;AAC5D,iBAAW,CAAC,YAAY,GAAG,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACtD,YAAI,CAAC,WAAW,WAAW,SAAS,EAAG;AACvC,cAAM,MAAM,WAAW,MAAM,UAAU,MAAM;AAC7C,YAAI,CAAC,OAAO,QAAQ,UAAW;AAC/B,cAAM,WAAY,KAAa,QAAQ;AACvC,gBAAQ,KAAK,EAAE,MAAM,YAAY,QAAQ,GAAG,SAAS,CAAC;AAAA,MAC1D;AACA,aAAO;AAAA,IACX;AAEA,UAAM,gBAAgB,CAAC,cAAkF;AACrG,YAAM,aAAa,sBAAsB;AACzC,UAAI,WAAW;AACX,cAAM,SAAS,OAAO,SAAS,EAAE,YAAY;AAC7C,eAAO,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,aAAa,MAAM;AAAA,MAC5E;AAEA,aACI,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,OAAO,KACzC,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ,KAC1C,WAAW,CAAC;AAAA,IAEpB;AAEA,UAAM,mBAAmB,CAAC,YAAoB,kBAAkC;AAC5E,YAAM,SAAS,OAAO,aAAa;AACnC,cAAQ,YAAY;AAAA,QAChB,KAAK;AACD,iBAAO,YAAY,MAAM;AAAA,QAC7B,KAAK;AACD,iBAAO,YAAY,MAAM;AAAA,QAC7B;AAEI,iBAAO,GAAG,UAAU,MAAM,MAAM;AAAA,MACxC;AAAA,IACJ;AAaA,UAAM,iBAAiB,OACnB,eAac;AACd,UAAI;AACA,cAAM,WAAgB,MAAM,KAAK,eAAe,+BAA+B;AAM/E,cAAM,UAAkC,EAAE,KAAK,SAAS;AACxD,cAAM,YAAY,QAAQ,UAAU,KAAK;AACzC,eAAO,UAAU,MAAM,SAAS,KAAK,UAAU,MAAM,UAAU;AAAA,MACnE,QAAQ;AACJ,eAAO;AAAA,MACX;AAAA,IACJ;AAEA,UAAM,UAAU,OAAO,KAAa,UAA6D;AAC7F,UAAI,OAAO,MAAM,GAAG,KAAK,KAAK,EAAE,MAAM,CAAQ;AAC9C,UAAI,QAAS,KAAa,MAAO,QAAQ,KAAa;AACtD,UAAI,CAAC,MAAM,QAAQ,IAAI,EAAG,QAAO;AACjC,aAAO,KAAK,CAAC;AAAA,IACjB;AAKA,UAAM,kBAAkB,CAAC,QAAkB;AACvC,UAAI,CAAC,IAAK,QAAO;AACjB,UAAI,WAAgB,IAAI;AACxB,UAAI,OAAO,aAAa,UAAU;AAC9B,YAAI;AAAE,qBAAW,KAAK,MAAM,QAAQ;AAAA,QAAG,QAAQ;AAAA,QAAoC;AAAA,MACvF;AACA,aAAO,EAAE,GAAG,KAAK,SAAS;AAAA,IAC9B;AAEA,QAAI;AAEA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,aAAa,MAAM,OAAO;AAC7D,cAAM,UAAU,sBAAsB;AACtC,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,OAAO,QAAQ,OAAO,CAAC,EAAE;AAAA,MACvF;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,eAAe,MAAM,OAAO;AAC/D,YAAI;AACA,gBAAM,SAAc,MAAM,KAAK,eAAe,iBAAiB;AAC/D,gBAAM,YAAY,QAAQ,gBAAgB,KAAK,CAAC;AAChD,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,WAAW,OAAO,UAAU,OAAO,CAAC,EAAE;AAAA,QAC3F,SAAS,KAAU;AAIf,cAAI;AAEA,oBAAQ,MAAM,yEAAyE,KAAK,WAAW,GAAG;AAAA,UAC9G,QAAQ;AAAA,UAAa;AACrB,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,WAAW,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE;AAAA,QAChF;AAAA,MACJ;AAYA,UAAI,MAAM,WAAW,KACd,MAAM,CAAC,MAAM,WACb,MAAM,CAAC,MAAM,kBACb,MAAM,CAAC,MAAM,cACb,MAAM,QAAQ;AACjB,cAAM,cAAc,QAAQ,IAAI,kBAAkB,QAAQ,IAAI,eAAe,IAAI,KAAK;AACtF,YAAI,CAAC,YAAY;AACb,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,gDAAgD,GAAG,EAAE;AAAA,QACtG;AACA,cAAM,aAAa,UAAU,SAAS;AACtC,YAAI;AACJ,YAAI,cAAc,OAAQ,WAAmB,QAAQ,YAAY;AAC7D,uBAAc,WAAmB,IAAI,eAAe,KAAK;AAAA,QAC7D,WAAW,cAAc,OAAO,eAAe,UAAU;AACrD,uBAAc,WAAmB,eAAe,KAAM,WAAmB,eAAe;AAAA,QAC5F;AACA,cAAM,YAAY,OAAO,eAAe,YAAY,WAAW,WAAW,SAAS,IAC7E,WAAW,MAAM,CAAC,EAAE,KAAK,IACzB;AACN,YAAI,CAAC,aAAa,cAAc,YAAY;AACxC,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,qDAAqD,GAAG,EAAE;AAAA,QAC3G;AACA,YAAI;AACA,gBAAM,EAAE,4BAAAC,4BAA2B,IAAI,MAAM;AAC7C,gBAAM,SAAS,MAAMA,4BAA2B;AAAA,YAC5C;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACZ,CAAC;AAGD,cAAI,SAAgB,CAAC;AACrB,cAAI,QAAQ;AACZ,cAAI;AACA,kBAAM,OAAO,MAAO,GAAW,KAAK,yBAAyB,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAC1G,kBAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,MAAM,QAAQ,MAAM,OAAO,IAAI,KAAK,UAAU,CAAC;AACzF,qBAAS;AACT,oBAAQ,OAAQ,MAAc,UAAU,WAAY,KAAa,QAAQ,KAAK;AAAA,UAClF,SAAS,GAAQ;AACb,qBAAS,CAAC,EAAE,UAAU,GAAG,WAAW,OAAO,CAAC,EAAE,CAAC;AAAA,UACnD;AACA,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,GAAG,QAAQ,OAAO,OAAO,CAAC,EAAE;AAAA,QACjF,SAAS,KAAU;AACf,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,oBAAoB,KAAK,WAAW,OAAO,GAAG,CAAC,IAAI,GAAG,EAAE;AAAA,QACzG;AAAA,MACJ;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,OAAO;AAC9D,cAAM,QAAiC,CAAC;AACxC,YAAI,OAAO,eAAgB,OAAM,kBAAkB,MAAM;AACzD,YAAI,OAAO,OAAQ,OAAM,SAAS,MAAM;AACxC,YAAI,OAAO,MAAM,GAAG,KAAK,KAAK,OAAO,KAAK,KAAK,EAAE,SAAU,EAAE,MAAM,IAAY,MAAS;AACxF,YAAI,QAAS,KAAa,MAAO,QAAQ,KAAa;AACtD,cAAM,YAAY,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,eAAe;AACtE,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,UAAU,OAAO,SAAS,OAAO,CAAC,EAAE;AAAA,MACzF;AAEA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,QAAQ;AAC/D,cAAM,MAAM,QAAQ,CAAC;AAOrB,YAAI,IAAI,oBAAoB,iBAAiB,IAAI,eAAe,eAAe;AAC3E,cAAI;AACA,kBAAM,SAAS,MAAM,KAAK,oBAAoB,QAAQ;AACtD,gBAAI,IAAI,eAAe,eAAe;AAClC,kBAAI,aAAa,UAAU;AAAA,YAC/B;AACA,gBAAI,IAAI,oBAAoB,eAAe;AAGvC,oBAAM,cAAmB,MAAM,KAAK,eAAe,gBAAgB,KAAK,IAAI;AAC5E,oBAAM,aAAa,UAAU,SAAS;AACtC,kBAAI,UAAe;AACnB,kBAAI,cAAc,OAAO,eAAe,YAAY,OAAQ,WAAmB,QAAQ,YAAY;AAC/F,sBAAM,IAAI,IAAI,QAAQ;AACtB,2BAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,UAAiC,GAAG;AACpE,sBAAI,KAAK,KAAM;AACf,oBAAE,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC;AAAA,gBACxD;AACA,0BAAU;AAAA,cACd;AACA,oBAAM,SAAS,aAAa,MAAM,OAAO,aAAa;AACtD,oBAAM,cAAc,MAAM,QAAQ,YAAY,KAAK,QAAQ,EAAE,QAAQ,CAAC;AACtE,kBAAI,kBAAkB,aAAa,SAAS,wBAAwB;AAAA,YACxE;AAAA,UACJ,QAAQ;AAAA,UAER;AAAA,QACJ;AACA,YAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,cAAc;AAC3C,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,iDAAiD,GAAG,EAAE;AAAA,QACvG;AACA,cAAM,gBAAgB,WAAW;AACjC,cAAM,eAAe,WAAW;AAChC,cAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AAKtC,cAAM,WAAW,cAAc,IAAI,MAAM;AACzC,YAAI,CAAC,UAAU;AACX,gBAAM,YAAY,sBAAsB,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAC3D,cAAI,IAAI,QAAQ;AACZ,mBAAO;AAAA,cACH,SAAS;AAAA,cACT,UAAU,KAAK;AAAA,gBACX,mBAAmB,IAAI,MAAM,0BAA0B,UAAU,KAAK,IAAI,KAAK,MAAM;AAAA,gBACrF;AAAA,cACJ;AAAA,YACJ;AAAA,UACJ;AACA,iBAAO;AAAA,YACH,SAAS;AAAA,YACT,UAAU,KAAK;AAAA,cACX;AAAA,cACA;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ;AACA,cAAM,SAAS,SAAS;AACxB,YAAI,kBAAkB,cAAc,aAAa;AAMjD,YAAI,mBAAmB,IAAI;AAC3B,YAAI,CAAC,kBAAkB;AACnB,gBAAM,UAAU,cAAc,MAAM,GAAG,CAAC;AACxC,cAAI;AACA,kBAAM,SAAS,MAAM,QAAQ,oBAAoB,EAAE,IAAI,IAAI,gBAAgB,CAAC;AAC5E,kBAAM,UAAU,QAAQ,QAAQ,IAAI;AACpC,kBAAM,aAAa,OAAO,gBAAgB,KAAK,OAAO,eAAe,iBAAiB;AACtF,+BAAmB,GAAG,OAAO,IAAI,OAAO,IAAI,UAAU;AAAA,UAC1D,QAAQ;AAEJ,+BAAmB,GAAG,IAAI,eAAe,IAAI,OAAO;AAAA,UACxD;AAAA,QACJ;AAUA,YAAI;AACA,gBAAM,WAAW,MAAM,QAAQ,mBAAmB;AAAA,YAC9C,UAAU;AAAA,UACd,CAAC;AACD,cAAI,YAAY,SAAS,OAAO,eAAe;AAC3C,mBAAO;AAAA,cACH,SAAS;AAAA,cACT,UAAU,KAAK;AAAA,gBACX,aAAa,gBAAgB;AAAA,gBAC7B;AAAA,gBACA,EAAE,MAAM,kBAAkB,UAAU,iBAAiB;AAAA,cACzD;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ,QAAQ;AAAA,QAGR;AAOA,cAAM,eAAwC,EAAE,GAAI,IAAI,YAAY,CAAC,EAAG;AAIxE,cAAM,kBAAkB,QAAS,aAAqB,iBAAiB;AACvE,cAAM,kBAAkB,OAAQ,aAAqB,qBAAqB,IAAI;AAQ9E,YAAI;AAKA,cAAI,cACA,IAAI,cAAc,IAAI,eAAe,WAC/B,OAAO,IAAI,UAAU,IACrB;AACV,cAAI,CAAC,aAAa;AACd,0BAAc,MAAM,KAAK,oBAAoB,QAAQ;AAAA,UACzD;AACA,cAAI,aAAa;AACb,kBAAM,UAAU,MAAM,GAAG,KAAK,YAAY,EAAE,OAAO,EAAE,IAAI,YAAY,EAAE,CAAQ;AAC/E,kBAAM,WAAW,MAAM,QAAQ,OAAO,IAAI,UAAW,SAAS,SAAS,CAAC;AACxE,kBAAM,IAAI,MAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS,IAAI,SAAS,CAAC,IAAI;AACzE,gBAAI,GAAG,OAAO;AACV,cAAC,aAAqB,YAAY;AAAA,gBAC9B,QAAQ,OAAO,WAAW;AAAA,gBAC1B,OAAO,OAAO,EAAE,KAAK;AAAA,gBACrB,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,IAAI;AAAA,gBAChC,OAAO,EAAE,QAAQ,OAAO,EAAE,KAAK,IAAI;AAAA,cACvC;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ,QAAQ;AAAA,QAGR;AAWA,YAAI;AACA,gBAAM,SAAS,MAAM,GAAG,KAAK,oBAAoB,EAAE,OAAO,EAAE,IAAI,IAAI,gBAAgB,EAAE,CAAQ;AAC9F,gBAAM,UAAU,MAAM,QAAQ,MAAM,IAAI,SAAU,QAAQ,SAAS,CAAC;AACpE,gBAAM,MAAM,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,IAAI,QAAQ,CAAC,IAAI;AACxE,cAAI,KAAK,MAAM,KAAK,MAAM;AACtB,YAAC,aAAqB,UAAU;AAAA,cAC5B,IAAI,OAAO,IAAI,EAAE;AAAA,cACjB,MAAM,OAAO,IAAI,IAAI;AAAA,cACrB,MAAM,IAAI,OAAO,OAAO,IAAI,IAAI,IAAI;AAAA,cACpC,MAAM,IAAI,OAAO,OAAO,IAAI,IAAI,IAAI;AAAA,YACxC;AAAA,UACJ;AAAA,QACJ,QAAQ;AAAA,QAIR;AACA,cAAM,GAAG,OAAO,KAAK;AAAA,UACjB,IAAI;AAAA,UACJ,iBAAiB,IAAI;AAAA,UACrB,cAAc,IAAI;AAAA,UAClB,YAAY,IAAI,cAAc;AAAA,UAC9B,WAAW,IAAI,aAAa;AAAA,UAC5B,MAAM,IAAI,QAAQ;AAAA,UAClB,QAAQ;AAAA,UACR,YAAY,IAAI,cAAc;AAAA,UAC9B,UAAU,KAAK,UAAU,YAAY;AAAA,UACrC,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,iBAAiB;AAAA,UACjB,kBAAkB,IAAI,oBAAoB;AAAA,UAC1C,gBAAgB;AAAA,UAChB,UAAU;AAAA,UACV,aAAa,MAAM;AACf,kBAAM,MAAM,OAAO,IAAI,cAAc,SAAS;AAC9C,mBAAO,QAAQ,aAAa,YAAY;AAAA,UAC5C,GAAG;AAAA,QACP,CAAC;AAQD,YAAI;AACA,gBAAM,EAAE,uBAAAC,uBAAsB,IAAI,MAAM;AACxC,gBAAM,cAAc,QAAQ,IAAI,kBAAkB,QAAQ,IAAI,eAAe,IAAI,KAAK;AACtF,cAAI,YAAY;AACZ,kBAAMA,uBAAsB;AAAA,cACxB;AAAA,cACA;AAAA,cACA,UAAU;AAAA,cACV;AAAA,cACA,QAAQ;AAAA,YACZ,CAAC;AAAA,UACL;AAAA,QACJ,SAAS,QAAQ;AACb,kBAAQ,OAAO,0DAA0D;AAAA,YACrE;AAAA,YACA,OAAQ,QAAkB;AAAA,UAC9B,CAAC;AAAA,QACL;AAKA,cAAM,kBAAkB,YAA2B;AAC/C,cAAI;AACA,gBAAI,kBAAkB,GAAG;AACrB,oBAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAAA,YAC3D;AACA,gBAAI,iBAAiB;AACjB,oBAAM,IAAI,MAAM,kEAAkE;AAAA,YACtF;AAIA,gBAAI;AACJ,gBAAI;AACA,oBAAM,UAAU,MAAM,eAAe,MAAM;AAC3C,kBAAI,SAAS;AACT,sBAAM,SAAS,MAAM,QAAQ,eAAe;AAAA,kBACxC;AAAA,kBACA,cAAc,KAAK,cAAc,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,kBAC/D,QAAQ;AAAA,kBACR,gBAAgB,IAAI,oBAAoB;AAAA,gBAC5C,CAAC;AACD,8BAAc,OAAO;AACrB,oBAAI,OAAO,gBAAiB,mBAAkB,OAAO;AAAA,cACzD,OAAO;AACH,8BAAc,iBAAiB,QAAQ,aAAa;AAAA,cACxD;AAAA,YACJ,SAAS,YAAY;AAIjB,oBAAM,sBAAsB,QACtB,aACA,IAAI,MAAM,OAAO,UAAU,CAAC;AAAA,YACtC;AAOA,kBAAM,iBAAgB,oBAAI,KAAK,GAAE,YAAY;AAC7C,kBAAM,GAAG;AAAA,cACL;AAAA,cACA;AAAA,gBACI,cAAc;AAAA,gBACd,YAAY;AAAA,cAChB;AAAA,cACA,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE;AAAA,YACnC;AACA,kBAAM,GAAG,OAAO,MAAM;AAAA,cAClB,IAAI;AAAA,cACJ,gBAAgB;AAAA,cAChB,mBAAmB;AAAA,cACnB,mBAAmB;AAAA,cACnB,eAAe;AAAA,cACf,QAAQ;AAAA,cACR,YAAY;AAAA,cACZ,YAAY;AAAA,YAChB,CAAC;AAKD,kBAAM,aAAa,IAAI,eAAe;AACtC,gBAAI,eAAe,SAAS;AACxB,kBAAI;AACA,sBAAM,SAAc,MAAM,KAAK,eAAe,iBAAiB;AAC/D,oBAAI,QAAQ;AACR,wBAAM,OAAO,KAAK,EAAE,eAAe,WAAW,CAAC;AAAA,gBACnD;AAAA,cACJ,SAAS,SAAS;AACd,sBAAM,cAAc,mBAAmB,QAAQ,QAAQ,UAAU,OAAO,OAAO;AAE/E,oBAAI;AACA,wBAAM,WAAW,MAAM,QAAQ,KAAK,EAAE,IAAI,cAAc,CAAC;AACzD,wBAAM,eAAe,OAAO,UAAU,aAAa,WAC7C,KAAK,MAAM,SAAS,QAAQ,IAC3B,UAAU,YAAY,CAAC;AAC9B,wBAAM,GAAG;AAAA,oBACL;AAAA,oBACA;AAAA,sBACI,UAAU,KAAK,UAAU;AAAA,wBACrB,GAAG;AAAA,wBACH,mBAAmB,EAAE,SAAS,aAAa,WAAW;AAAA,sBAC1D,CAAC;AAAA,oBACL;AAAA,oBACA,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE;AAAA,kBACnC;AAAA,gBACJ,QAAQ;AAAA,gBAER;AAAA,cACJ;AAAA,YACJ;AAaA,kBAAM,kBAAmB,aAAqB;AAC9C,gBAAI,OAAO,oBAAoB,YAAY,gBAAgB,SAAS,GAAG;AACnE,kBAAI;AACA,sBAAMC,QAAO,MAAM,OAAO,MAAW;AACrC,sBAAM,EAAE,WAAAC,YAAW,oBAAAC,oBAAmB,IAAI,MAAM;AAChD,sBAAM,OAAO,QAAQ,IAAI,4BAClB,QAAQ,IAAI;AACnB,sBAAMC,YAAWF,WAAU,eAAe,IACpC,kBACCD,MAAK,WAAW,eAAe,IAC5B,kBACAA,MAAK,QAAQ,MAAM,eAAe;AAC5C,sBAAM,SAAS,MAAME,oBAAmBC,WAAU,EAAE,KAAK,kBAAkB,CAAC;AAC5E,oBAAI,CAAC,QAAQ;AACT,wBAAM,IAAI,MAAM,sCAAsCA,SAAQ,GAAG;AAAA,gBACrE;AACA,sBAAM,SAAc,MAAM,KAAK,eAAe,iBAAiB;AAC/D,oBAAI,QAAQ,YAAY;AACpB,wBAAM,OAAO,WAAW,EAAE,eAAe,OAAO,CAAC;AAAA,gBACrD,OAAO;AACH,wBAAM,IAAI,MAAM,2CAA2C;AAAA,gBAC/D;AAAA,cACJ,SAAS,SAAS;AACd,sBAAM,cAAc,mBAAmB,QAAQ,QAAQ,UAAU,OAAO,OAAO;AAC/E,oBAAI;AACA,wBAAM,WAAW,MAAM,QAAQ,KAAK,EAAE,IAAI,cAAc,CAAC;AACzD,wBAAM,eAAe,OAAO,UAAU,aAAa,WAC7C,KAAK,MAAM,SAAS,QAAQ,IAC3B,UAAU,YAAY,CAAC;AAC9B,wBAAM,GAAG;AAAA,oBACL;AAAA,oBACA;AAAA,sBACI,UAAU,KAAK,UAAU;AAAA,wBACrB,GAAG;AAAA,wBACH,mBAAmB,EAAE,SAAS,aAAa,cAAc,gBAAgB;AAAA,sBAC7E,CAAC;AAAA,oBACL;AAAA,oBACA,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE;AAAA,kBACnC;AAAA,gBACJ,QAAQ;AAAA,gBAER;AAAA,cACJ;AAAA,YACJ;AAMA,kBAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC1C,kBAAM,GAAG;AAAA,cACL;AAAA,cACA;AAAA,gBACI,QAAQ;AAAA,gBACR,gBAAgB;AAAA,gBAChB,YAAY;AAAA,cAChB;AAAA,cACA,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE;AAAA,YACnC;AAAA,UACJ,SAAS,KAAK;AACV,kBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,kBAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,kBAAM,GAAG;AAAA,cACL;AAAA,cACA;AAAA,gBACI,QAAQ;AAAA,gBACR,UAAU,KAAK,UAAU;AAAA,kBACrB,GAAG;AAAA,kBACH,mBAAmB,EAAE,SAAS,SAAS;AAAA,gBAC3C,CAAC;AAAA,gBACD,YAAY;AAAA,cAChB;AAAA,cACA,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE;AAAA,YACnC;AAAA,UACJ;AAAA,QACJ;AASA,cAAM,mBAAmB,QAAQ,IAAI;AACrC,cAAM,eAAe,CAAC,EAClB,QAAQ,IAAI,UACT,QAAQ,IAAI,4BACZ,QAAQ,IAAI,WACZ,QAAQ,IAAI;AAEnB,cAAM,mBAAmB,qBAAqB,SACxC,eACA,qBAAqB,OAAO,qBAAqB;AACvD,YAAI,kBAAkB;AAClB,gBAAM,gBAAgB;AAAA,QAC1B,OAAO;AACH,eAAK,gBAAgB;AAAA,QACzB;AAEA,cAAM,UAAU,gBAAgB,MAAM,QAAQ,KAAK,EAAE,IAAI,cAAc,CAAC,CAAC;AACzE,cAAM,MAAM,KAAK,QAAQ,EAAE,QAAQ,CAAC;AACpC,YAAI,SAAS,mBAAmB,MAAM;AACtC,eAAO,EAAE,SAAS,MAAM,UAAU,IAAI;AAAA,MAC1C;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,YAAY;AAC/C,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AAEtC,YAAI,MAAM,OAAO;AACb,gBAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACxC,cAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAC5F,gBAAM,UAAU,MAAM,QAAQ,MAAM,EAAE,gBAAgB,IAAI,QAAQ,SAAS,CAAC;AAI5E,gBAAM,eAAe,MAAM,KAAK,oBAAoB,QAAQ;AAC5D,gBAAM,aAAa,eACb,MAAM,QAAQ,KAAK,EAAE,gBAAgB,IAAI,SAAS,aAAa,CAAC,IAChE,MAAM,QAAQ,KAAK,EAAE,gBAAgB,GAAG,CAAC;AAE/C,gBAAM,WAAW,UACX;AAAA,YACI,IAAI,QAAQ;AAAA,YACZ,QAAQ,QAAQ;AAAA,YAChB,eAAe,QAAQ;AAAA,YACvB,aAAa,QAAQ;AAAA,YACrB,WAAW,QAAQ;AAAA,UACvB,IACA;AAGN,gBAAM,UAAU,gBAAgB,MAAM;AACtC,gBAAM,WAAW,QAAQ,eACnB;AAAA,YACI,QAAQ,QAAQ;AAAA,YAChB,eAAe,OAAO,QAAQ,EAAE;AAAA,YAChC,cAAc,QAAQ;AAAA,YACtB,kBAAkB,QAAQ;AAAA,YAC1B,gBAAgB,QAAQ;AAAA,UAC5B,IACA;AACN,iBAAO;AAAA,YACH,SAAS;AAAA,YACT,UAAU,KAAK,QAAQ,EAAE,SAAS,UAAU,YAAY,UAAU,WAAW,CAAC;AAAA,UAClF;AAAA,QACJ;AAEA,YAAI,MAAM,SAAS;AACf,gBAAM,QAAiC,CAAC;AACxC,cAAI,MAAM,iBAAiB,OAAW,OAAM,eAAe,KAAK;AAChE,cAAI,MAAM,SAAS,OAAW,OAAM,OAAO,KAAK;AAChD,cAAI,MAAM,WAAW,OAAW,OAAM,SAAS,KAAK;AACpD,cAAI,MAAM,eAAe,OAAW,OAAM,aAAa,KAAK;AAC5D,cAAI,MAAM,eAAe,QAAW;AAChC,gBAAI,IAAI,OAAO,KAAK,UAAU;AAE9B,gBAAI,MAAM,WAAY,KAAI;AAC1B,gBAAI,CAAC,CAAC,WAAW,QAAQ,EAAE,SAAS,CAAC,GAAG;AACpC,qBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,uBAAuB,CAAC,iCAAiC,GAAG,EAAE;AAAA,YAC/G;AACA,kBAAM,aAAa;AAAA,UACvB;AACA,cAAI,MAAM,aAAa,OAAW,OAAM,WAAW,KAAK,UAAU,KAAK,QAAQ;AAC/E,gBAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC1C,gBAAM,GAAG,OAAO,KAAK,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAQ;AACpD,gBAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACxC,cAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAC5F,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,gBAAgB,MAAM,EAAE,CAAC,EAAE;AAAA,QACzF;AAEA,YAAI,MAAM,UAAU;AAChB,gBAAM,QAAQ,OAAO,UAAU,OAAO,OAAO,UAAU,UAAU,MAAM,UAAU;AACjF,gBAAM,SAAS,MAAM,KAAK,qBAAqB,IAAI,EAAE,IAAI,SAAS,gBAAgB,MAAM,CAAC;AACzF,cAAI,CAAC,OAAO,IAAI;AACZ,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,OAAO,SAAS,iBAAiB,OAAO,UAAU,GAAG,EAAE;AAAA,UACxG;AACA,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,MAAM,eAAe,IAAI,UAAU,OAAO,SAAS,CAAC,EAAE;AAAA,QACpH;AAAA,MACJ;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,mBAAmB,MAAM,UAAU;AACtE,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AAEzC,YAAI,cAAqB,CAAC;AAC1B,YAAI;AACA,cAAI,OAAO,MAAM,GAAG,KAAK,KAAK,EAAE,OAAO,EAAE,iBAAiB,MAAM,EAAE,CAAQ;AAC1E,cAAI,QAAS,KAAa,MAAO,QAAQ,KAAa;AACtD,wBAAc,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;AAAA,QAChD,QAAQ;AACJ,wBAAc,CAAC;AAAA,QACnB;AACA,cAAM,WAAqB,CAAC;AAC5B,YAAI,kBAAkB;AACtB,mBAAW,OAAO,aAAa;AAC3B,gBAAM,MAAM,KAAK;AACjB,cAAI,CAAC,IAAK;AACV,cAAI;AACA,kBAAM,IAAI,MAAM,KAAK,qBAAqB,KAAK,EAAE,IAAI,SAAS,gBAAgB,OAAO,KAAK,CAAC;AAC3F,gBAAI,EAAE,GAAI;AACV,gBAAI,EAAE,UAAU,OAAQ,UAAS,KAAK,GAAG,EAAE,QAAQ;AACnD,gBAAI,CAAC,EAAE,MAAM,EAAE,MAAO,UAAS,KAAK,WAAW,GAAG,KAAK,EAAE,KAAK,EAAE;AAAA,UACpE,SAAS,KAAK;AACV,qBAAS;AAAA,cACL,4BAA4B,GAAG,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,YACxF;AAAA,UACJ;AAAA,QACJ;AAMA,YAAI,aAAa;AACjB,YAAI;AACA,gBAAM,cAAmB,MAAM,KAAK,WAAW,gBAAgB,KAAK,IAAI;AACxE,gBAAM,KAAK,aAAa,KAAK;AAC7B,cAAI,OAAO,OAAO,YAAY;AAC1B,kBAAM,GAAG,KAAK,YAAY,KAAK;AAAA,cAC3B,MAAM,EAAE,gBAAgB,MAAM;AAAA,cAC9B,SAAS,UAAU,SAAS;AAAA,YAChC,CAAC;AACD,yBAAa;AAAA,UACjB;AAAA,QACJ,SAAS,KAAK;AACV,mBAAS;AAAA,YACL,mCAAmC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,UACvF;AAAA,QACJ;AACA,YAAI,CAAC,YAAY;AACb,cAAI;AACA,kBAAM,GAAG,OAAO,oBAAoB,EAAE,OAAO,EAAE,IAAI,MAAM,EAAE,CAAQ;AACnE,yBAAa;AAAA,UACjB,SAAS,KAAK;AACV,qBAAS;AAAA,cACL,0CAA0C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,YAC9F;AAAA,UACJ;AAAA,QACJ;AAEA,eAAO;AAAA,UACH,SAAS;AAAA,UACT,UAAU,KAAK,QAAQ;AAAA,YACnB,SAAS;AAAA,YACT,gBAAgB;AAAA,YAChB;AAAA,YACA;AAAA,UACJ,CAAC;AAAA,QACL;AAAA,MACJ;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,eAAe,MAAM,UAAU,MAAM,QAAQ;AAC3G,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,WAAW,MAAM;AACvB,YAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC3C,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,wBAAwB,GAAG,EAAE;AAAA,QAC9E;AACA,cAAM,aAAa,SAAS,KAAK,EAAE,YAAY;AAC/C,YAAI,CAAC,qCAAqC,KAAK,UAAU,GAAG;AACxD,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,2BAA2B,GAAG,EAAE;AAAA,QACjF;AACA,cAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACxC,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAE5F,YAAI;AACJ,YAAI;AACA,gBAAM,OAAO,MAAM,GAAG,KAAK,KAAK,EAAE,OAAO,EAAE,UAAU,WAAW,EAAE,CAAQ;AAC1E,gBAAM,MAAM,MAAM,QAAQ,IAAI,IAAI,OAAS,MAAc,SAAS,CAAC;AACnE,qBAAW,IAAI,KAAK,CAAC,MAAW,EAAE,OAAO,EAAE;AAAA,QAC/C,QAAQ;AAAA,QAA2B;AACnC,YAAI,UAAU;AACV,iBAAO;AAAA,YACH,SAAS;AAAA,YACT,UAAU,KAAK;AAAA,cACX,aAAa,UAAU;AAAA,cACvB;AAAA,cACA,EAAE,MAAM,kBAAkB,UAAU,WAAW;AAAA,YACnD;AAAA,UACJ;AAAA,QACJ;AACA,cAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,cAAM,GAAG,OAAO,KAAK,EAAE,UAAU,YAAY,YAAY,UAAU,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAQ;AAE9F,YAAI,KAAK,aAAa,YAAY;AAC9B,cAAI;AAAE,kBAAM,KAAK,YAAY,WAAW,EAAE;AAAA,UAAG,QAAQ;AAAA,UAAoB;AAAA,QAC7E;AACA,cAAM,UAAU,gBAAgB,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC,CAAC;AAC1D,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,QAAQ,CAAC,EAAE;AAAA,MACzE;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,WAAW,MAAM,QAAQ;AACvF,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACxC,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAC5F,YAAI,OAAO,WAAW,YAAY,OAAO,WAAW,gBAAgB;AAChE,iBAAO;AAAA,YACH,SAAS;AAAA,YACT,UAAU,KAAK;AAAA,cACX,YAAY,EAAE,SAAS,OAAO,MAAM;AAAA,cACpC;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ;AAEA,cAAM,aAAa,OAAO;AAC1B,cAAM,WAAW,cAAc,UAAU;AACzC,YAAI,CAAC,UAAU;AACX,iBAAO;AAAA,YACH,SAAS;AAAA,YACT,UAAU,KAAK;AAAA,cACX,WAAW,UAAU;AAAA,cACrB;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ;AAIA,YAAI,WAAoC,CAAC;AACzC,YAAI,OAAO,UAAU;AACjB,cAAI,OAAO,OAAO,aAAa,UAAU;AACrC,gBAAI;AAAE,yBAAW,KAAK,MAAM,OAAO,QAAQ;AAAA,YAAG,QAAQ;AAAE,yBAAW,CAAC;AAAA,YAAG;AAAA,UAC3E,WAAW,OAAO,OAAO,aAAa,UAAU;AAC5C,uBAAW,EAAE,GAAI,OAAO,SAAqC;AAAA,UACjE;AAAA,QACJ;AACA,eAAQ,SAAiB;AAIzB,cAAM,kBAAiB,oBAAI,KAAK,GAAE,YAAY;AAC9C,cAAM,GAAG;AAAA,UACL;AAAA,UACA;AAAA,YACI,QAAQ;AAAA,YACR,UAAU,KAAK,UAAU,QAAQ;AAAA,YACjC,YAAY;AAAA,UAChB;AAAA,UACA,EAAE,OAAO,EAAE,GAAG,EAAE;AAAA,QACpB;AAKA,cAAM,uBAAuB,QAAS,SAAiB,iBAAiB;AACxE,cAAM,qBAAqB,OAAQ,SAAiB,qBAAqB,IAAI;AAE7E,cAAM,WAAW,YAA2B;AACxC,cAAI;AACA,gBAAI,qBAAqB,GAAG;AACxB,oBAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAAA,YAC9D;AACA,gBAAI,sBAAsB;AACtB,oBAAM,IAAI,MAAM,kEAAkE;AAAA,YACtF;AACA,gBAAI;AACJ,gBAAI,cAAc,cAAc,EAAE;AAClC,gBAAI;AACA,oBAAM,UAAU,MAAM,eAAe,SAAS,IAAI;AAClD,kBAAI,SAAS;AACT,sBAAM,SAAS,MAAM,QAAQ,eAAe;AAAA,kBACxC,eAAe;AAAA,kBACf,cAAc,KAAK,GAAG,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,kBACpD,QAAQ;AAAA,kBACR,gBAAgB,OAAO,oBAAoB;AAAA,gBAC/C,CAAC;AACD,8BAAc,OAAO;AACrB,oBAAI,OAAO,gBAAiB,eAAc,OAAO;AAAA,cACrD,OAAO;AACH,8BAAc,iBAAiB,SAAS,MAAM,EAAE;AAAA,cACpD;AAAA,YACJ,SAAS,YAAY;AACjB,oBAAM,sBAAsB,QACtB,aACA,IAAI,MAAM,OAAO,UAAU,CAAC;AAAA,YACtC;AACA,kBAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,kBAAM,GAAG;AAAA,cACL;AAAA,cACA;AAAA,gBACI,QAAQ;AAAA,gBACR,cAAc;AAAA,gBACd,iBAAiB,SAAS;AAAA,gBAC1B,gBAAgB;AAAA,gBAChB,YAAY;AAAA,cAChB;AAAA,cACA,EAAE,OAAO,EAAE,GAAG,EAAE;AAAA,YACpB;AACA,kBAAM,eAAe,MAAM,QAAQ,MAAM,EAAE,gBAAgB,IAAI,QAAQ,SAAS,CAAC;AACjF,gBAAI,CAAC,cAAc;AACf,oBAAM,GAAG,OAAO,MAAM;AAAA,gBAClB,IAAI,WAAW;AAAA,gBACf,gBAAgB;AAAA,gBAChB,mBAAmB;AAAA,gBACnB,mBAAmB;AAAA,gBACnB,eAAe;AAAA,gBACf,QAAQ;AAAA,gBACR,YAAY;AAAA,gBACZ,YAAY;AAAA,cAChB,CAAC;AAAA,YACL;AAAA,UACJ,SAAS,KAAK;AACV,kBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,kBAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,kBAAM,GAAG;AAAA,cACL;AAAA,cACA;AAAA,gBACI,QAAQ;AAAA,gBACR,UAAU,KAAK,UAAU;AAAA,kBACrB,GAAG;AAAA,kBACH,mBAAmB,EAAE,SAAS,SAAS;AAAA,gBAC3C,CAAC;AAAA,gBACD,YAAY;AAAA,cAChB;AAAA,cACA,EAAE,OAAO,EAAE,GAAG,EAAE;AAAA,YACpB;AAAA,UACJ;AAAA,QACJ;AACA,aAAK,SAAS;AAEd,cAAM,WAAW,gBAAgB,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC,CAAC;AAC3D,cAAM,WAAW,KAAK,QAAQ,EAAE,SAAS,SAAS,CAAC;AACnD,iBAAS,SAAS;AAClB,eAAO,EAAE,SAAS,MAAM,UAAU,SAAS;AAAA,MAC/C;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,cAAc,MAAM,QAAQ;AAC1F,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACxC,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAE5F,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,gBAAgB,MAAM,GAAG,gBAAgB,MAAM,CAAC,EAAE;AAAA,MAChH;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,iBAAiB,MAAM,CAAC,MAAM,YAAY,MAAM,QAAQ;AACtH,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,YAAY,MAAM;AACxB,YAAI,CAAC,aAAa,OAAO,cAAc,UAAU;AAC7C,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,yBAAyB,GAAG,EAAE;AAAA,QAC/E;AACA,cAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACxC,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAE5F,cAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AAEtC,YAAI,WAAW,MAAM,GAAG,KAAK,MAAM,EAAE,OAAO,EAAE,gBAAgB,IAAI,QAAQ,SAAS,EAAE,CAAQ;AAC7F,YAAI,YAAa,SAAiB,MAAO,YAAY,SAAiB;AACtE,mBAAW,OAAQ,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,GAAI;AACzD,gBAAM,GAAG,OAAO,MAAM;AAAA,YAClB,QAAQ;AAAA,YACR,YAAY;AAAA,YACZ,YAAY;AAAA,UAChB,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,GAAG,EAAE,CAAQ;AAAA,QACvC;AAEA,cAAM,eAAe,WAAW;AAChC,cAAM,GAAG,OAAO,MAAM;AAAA,UAClB,IAAI;AAAA,UACJ,gBAAgB;AAAA,UAChB,mBAAmB;AAAA,UACnB,mBAAmB;AAAA,UACnB,eAAe;AAAA,UACf,QAAQ;AAAA,UACR,YAAY;AAAA,UACZ,YAAY;AAAA,QAChB,CAAC;AAED,cAAM,aAAa,MAAM,QAAQ,MAAM,EAAE,IAAI,aAAa,CAAC;AAC3D,cAAM,WAAW,aACX;AAAA,UACI,IAAI,WAAW;AAAA,UACf,QAAQ,WAAW;AAAA,UACnB,eAAe,WAAW;AAAA,UAC1B,aAAa,WAAW;AAAA,QAC5B,IACA;AACN,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,YAAY,SAAS,CAAC,EAAE;AAAA,MAC7E;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,aAAa,MAAM,OAAO;AACxF,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,YAAI,OAAO,MAAM,GAAG,KAAK,KAAK,EAAE,OAAO,EAAE,gBAAgB,GAAG,EAAE,CAAQ;AACtE,YAAI,QAAS,KAAa,MAAO,QAAQ,KAAa;AACtD,cAAM,UAAU,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;AAE9C,cAAM,UAAU,MAAM,KAAK,IAAI,IAAI,QAAQ,IAAI,CAAC,QAAa,IAAI,OAAO,EAAE,OAAO,OAAO,CAAC,CAAC;AAC1F,cAAM,UAAU,oBAAI,IAAiB;AACrC,mBAAW,OAAO,SAAS;AACvB,cAAI,MAAW;AACf,qBAAW,aAAa,CAAC,YAAY,MAAM,GAAG;AAC1C,gBAAI;AACA,oBAAM,IAAI,MAAM,GAAG,QAAQ,WAAkB,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAQ;AAC1E,oBAAO,GAAW,SAAS;AAC3B,kBAAI,IAAK;AAAA,YACb,QAAQ;AAAA,YAAuB;AAAA,UACnC;AACA,cAAI,IAAK,SAAQ,IAAI,OAAO,GAAG,GAAG;AAAA,YAC9B,IAAI,IAAI;AAAA,YACR,MAAM,IAAI,QAAQ,IAAI;AAAA,YACtB,OAAO,IAAI;AAAA,YACX,OAAO,IAAI,SAAS,IAAI;AAAA,UAC5B,CAAC;AAAA,QACL;AACA,cAAM,WAAW,QAAQ,IAAI,CAAC,SAAc;AAAA,UACxC,GAAG;AAAA,UACH,MAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK;AAAA,QAC9C,EAAE;AACF,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,SAAS,CAAC,EAAE;AAAA,MAC1E;AAOA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,aAAa,MAAM,QAAQ;AACzF,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACzC,YAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAE7F,cAAM,WAAW,MAAM,KAAK,oBAAoB,QAAQ;AACxD,YAAI,CAAC,SAAU,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,2BAA2B,GAAG,EAAE;AAC5F,cAAM,YAAY,MAAM,QAAQ,KAAK,EAAE,gBAAgB,IAAI,SAAS,SAAS,CAAC;AAC9E,YAAI,CAAC,aAAa,CAAC,CAAC,SAAS,OAAO,EAAE,SAAS,OAAO,UAAU,IAAI,CAAC,GAAG;AACpE,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,4CAAuC,GAAG,EAAE;AAAA,QAC7F;AAEA,cAAM,QAAQ,OAAO,MAAM,UAAU,WAAW,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,YAAY,IAAI;AAC1F,YAAI,eAAe,OAAO,MAAM,YAAY,WAAW,OAAO,KAAK,OAAO,EAAE,KAAK,IAAI;AACrF,YAAI,OAAO,OAAO,MAAM,QAAQ,QAAQ,EAAE,KAAK,EAAE,YAAY;AAC7D,YAAI,CAAC,CAAC,SAAS,SAAS,UAAU,QAAQ,EAAE,SAAS,IAAI,GAAG;AACxD,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,iBAAiB,IAAI,gDAAgD,GAAG,EAAE;AAAA,QAC3H;AACA,YAAI,CAAC,SAAS,CAAC,cAAc;AACzB,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,gCAAgC,GAAG,EAAE;AAAA,QACtF;AAEA,YAAI,CAAC,gBAAgB,OAAO;AACxB,cAAI,MAAW;AACf,qBAAW,aAAa,CAAC,YAAY,MAAM,GAAG;AAC1C,gBAAI;AACA,oBAAM,IAAI,MAAM,GAAG,QAAQ,WAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAQ;AACxE,oBAAO,GAAW,SAAS;AAC3B,kBAAI,IAAK;AAAA,YACb,QAAQ;AAAA,YAAiB;AAAA,UAC7B;AACA,cAAI,CAAC,KAAK,IAAI;AACV,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,6BAA6B,KAAK,KAAK,GAAG,EAAE;AAAA,UAC7F;AACA,yBAAe,OAAO,IAAI,EAAE;AAAA,QAChC;AAEA,cAAM,WAAW,MAAM,QAAQ,KAAK,EAAE,gBAAgB,IAAI,SAAS,aAAa,CAAC;AACjF,YAAI,UAAU;AACV,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,QAAQ,UAAU,eAAe,KAAK,CAAC,EAAE;AAAA,QAC9F;AAEA,YAAI;AACA,gBAAM,WAAW,WAAW;AAC5B,gBAAM,GAAG,OAAO,KAAK;AAAA,YACjB,IAAI;AAAA,YACJ,gBAAgB;AAAA,YAChB,SAAS;AAAA,YACT;AAAA,YACA,YAAY;AAAA,YACZ,iBAAkB,QAAgB,mBAAmB;AAAA,UACzD,CAAQ;AACR,gBAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,IAAI,SAAS,CAAC;AACnD,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,QAAQ,SAAS,eAAe,MAAM,CAAC,EAAE;AAAA,QAC9F,SAAS,GAAQ;AACb,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,GAAG,WAAW,wBAAwB,GAAG,EAAE;AAAA,QAC5F;AAAA,MACJ;AAIA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,aAAa,MAAM,SAAS;AAC1F,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,WAAW,mBAAmB,MAAM,CAAC,CAAC;AAC5C,cAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACzC,YAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAE7F,cAAM,WAAW,MAAM,KAAK,oBAAoB,QAAQ;AACxD,YAAI,CAAC,SAAU,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,2BAA2B,GAAG,EAAE;AAC5F,cAAM,YAAY,MAAM,QAAQ,KAAK,EAAE,gBAAgB,IAAI,SAAS,SAAS,CAAC;AAC9E,YAAI,CAAC,aAAa,CAAC,CAAC,SAAS,OAAO,EAAE,SAAS,OAAO,UAAU,IAAI,CAAC,GAAG;AACpE,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,4CAAuC,GAAG,EAAE;AAAA,QAC7F;AAEA,cAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,IAAI,UAAU,gBAAgB,GAAG,CAAC;AACtE,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,WAAW,QAAQ,eAAe,GAAG,EAAE;AAEjG,cAAM,UAAU,OAAO,MAAM,QAAQ,EAAE,EAAE,KAAK,EAAE,YAAY;AAC5D,YAAI,CAAC,CAAC,SAAS,SAAS,UAAU,QAAQ,EAAE,SAAS,OAAO,GAAG;AAC3D,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,iBAAiB,OAAO,KAAK,GAAG,EAAE;AAAA,QACnF;AAGA,YAAI,OAAO,SAAS,WAAW,YAAY,SAAS;AAChD,cAAI,SAAS,MAAM,GAAG,KAAK,KAAK,EAAE,OAAO,EAAE,gBAAgB,IAAI,MAAM,QAAQ,EAAE,CAAQ;AACvF,cAAI,UAAW,OAAe,MAAO,UAAU,OAAe;AAC9D,gBAAM,aAAa,MAAM,QAAQ,MAAM,IAAI,OAAO,SAAS;AAC3D,cAAI,cAAc,GAAG;AACjB,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,gCAAgC,GAAG,EAAE;AAAA,UACtF;AAAA,QACJ;AAEA,YAAI;AACA,gBAAM,GAAG,OAAO,KAAK,EAAE,MAAM,SAAS,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE,GAAU,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAQ;AACvH,gBAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,IAAI,SAAS,CAAC;AACnD,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,QAAQ,QAAQ,CAAC,EAAE;AAAA,QACxE,SAAS,GAAQ;AACb,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,GAAG,WAAW,yBAAyB,GAAG,EAAE;AAAA,QAC7F;AAAA,MACJ;AAKA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,aAAa,MAAM,UAAU;AAC3F,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,WAAW,mBAAmB,MAAM,CAAC,CAAC;AAC5C,cAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACzC,YAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAE7F,cAAM,WAAW,MAAM,KAAK,oBAAoB,QAAQ;AACxD,YAAI,CAAC,SAAU,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,2BAA2B,GAAG,EAAE;AAE5F,cAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,IAAI,UAAU,gBAAgB,GAAG,CAAC;AACtE,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,WAAW,QAAQ,eAAe,GAAG,EAAE;AAEjG,cAAM,YAAY,MAAM,QAAQ,KAAK,EAAE,gBAAgB,IAAI,SAAS,SAAS,CAAC;AAC9E,cAAM,SAAS,OAAO,OAAO,OAAO,MAAM,OAAO,QAAQ;AACzD,cAAM,eAAe,aAAa,CAAC,SAAS,OAAO,EAAE,SAAS,OAAO,UAAU,IAAI,CAAC;AACpF,YAAI,CAAC,UAAU,CAAC,cAAc;AAC1B,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,4CAAuC,GAAG,EAAE;AAAA,QAC7F;AAEA,YAAI,OAAO,SAAS,SAAS;AACzB,cAAI,SAAS,MAAM,GAAG,KAAK,KAAK,EAAE,OAAO,EAAE,gBAAgB,IAAI,MAAM,QAAQ,EAAE,CAAQ;AACvF,cAAI,UAAW,OAAe,MAAO,UAAU,OAAe;AAC9D,gBAAM,aAAa,MAAM,QAAQ,MAAM,IAAI,OAAO,SAAS;AAC3D,cAAI,cAAc,GAAG;AACjB,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,gCAAgC,GAAG,EAAE;AAAA,UACtF;AAAA,QACJ;AAEA,YAAI;AACA,gBAAM,GAAG,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAQ;AACvD,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,MAAM,SAAS,CAAC,EAAE;AAAA,QAChF,SAAS,GAAQ;AACb,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,GAAG,WAAW,2BAA2B,GAAG,EAAE;AAAA,QAC/F;AAAA,MACJ;AAIA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,cAAc,MAAM,OAAO;AACzF,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,YAAI,OAAO,MAAM,GAAG,KAAK,aAAa,EAAE,OAAO,EAAE,gBAAgB,MAAM,EAAE,CAAQ;AACjF,YAAI,QAAS,KAAa,MAAO,QAAQ,KAAa;AACtD,cAAM,WAAW,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;AAK/C,cAAM,WAAW,MAAM,QAAQ;AAAA,UAC3B,SAAS,IAAI,OAAO,MAAW;AAC3B,gBAAI,aAA4B;AAChC,gBAAI,aAA4B;AAChC,gBAAI;AACA,kBAAI,EAAE,YAAY;AACd,sBAAM,MAAM,MAAM,GAAG,QAAQ,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAQ;AACxE,6BAAa,KAAK,eAAe;AAAA,cACrC;AACA,kBAAI,EAAE,oBAAoB;AACtB,sBAAM,MAAM,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAQ;AACxF,6BAAa,KAAK,WAAW;AAAA,cACjC;AAAA,YACJ,QAAQ;AAAA,YAER;AACA,mBAAO;AAAA,cACH,GAAG;AAAA;AAAA,cAEH,WAAW;AAAA,cACX,YAAY,cAAc,EAAE;AAAA,cAC5B,SAAS,cAAc,EAAE,WAAW;AAAA,YACxC;AAAA,UACJ,CAAC;AAAA,QACL;AACA,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,UAAU,OAAO,SAAS,OAAO,CAAC,EAAE;AAAA,MACzF;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,cAAc,MAAM,QAAQ;AAC1F,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,EAAE,WAAW,SAAS,UAAU,gBAAgB,IAAI,QAAQ,CAAC;AACnE,YAAI,CAAC,UAAW,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,yBAAyB,GAAG,EAAE;AAG3F,cAAM,QAAQ,MAAM,KAAK,mBAAmB;AAC5C,cAAM,cAAe,OAAe;AACpC,cAAM,UAAU,aAAa,iBAAiB,KAAK,CAAC;AACpD,cAAM,gBAAgB,QAAQ,KAAK,CAAC,OAAY,GAAG,UAAU,MAAM,GAAG,QAAQ,SAAS;AACvF,cAAM,WAAW,eAAe,YAAY;AAC5C,YAAI,CAAC,UAAU;AACX,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,SAAS,sCAAsC,GAAG,EAAE;AAAA,QACjH;AAGA,cAAM,eAAe,oBAAI,IAAI,CAAC,SAAS,UAAU,UAAU,CAAC;AAC5D,YAAI,aAAa,IAAI,UAAU,KAAK,GAAG;AACnC,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,SAAS,eAAe,SAAS,KAAK,wCAAwC,GAAG,EAAE;AAAA,QAChJ;AAGA,cAAM,aAAa,MAAM,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC;AACnD,YAAI,CAAC,YAAY;AACb,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,eAAe,GAAG,EAAE;AAAA,QACtF;AACA,cAAM,aAAa,WAAW,mBAAmB;AAEjD,YAAI,SAAS;AACb,YAAI;AACA,gBAAM,cAAmB,MAAM,KAAK,WAAW,gBAAgB,KAAK,IAAI;AACxE,gBAAM,cAAc,MAAM,aAAa,KAAK,aAAa;AAAA,YACrD,SAAS,UAAU,SAAS;AAAA,UAChC,CAAC;AACD,mBAAS,aAAa,MAAM,MAAM,aAAa,SAAS,UAAU;AAAA,QACtE,QAAQ;AAAA,QAER;AAEA,cAAM,kBAAkB,WAAW,UAAU,WAAW;AAGxD,cAAM,MAAM,MAAM,GAAG,QAAQ,aAAa;AAAA,UACtC,OAAO,EAAE,gBAAgB,OAAO,YAAY,UAAU;AAAA,QAC1D,CAAQ;AACR,YAAI,KAAK,IAAI;AACT,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,SAAS,0CAA0C,GAAG,EAAE;AAAA,QACrH;AAGA,cAAM,eAAe,MAAM,iBAAiB,WAAW,YAAY,QAAQ,QAAQ;AACnF,cAAM,sBAAsB,MAAM,wBAAwB,cAAc,iBAAiB,QAAQ,QAAQ;AAEzG,cAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,cAAM,WAAW,WAAW;AAC5B,cAAM,GAAG,OAAO,aAAa;AAAA,UACzB,IAAI;AAAA,UACJ,gBAAgB;AAAA,UAChB,YAAY;AAAA,UACZ,oBAAoB;AAAA,UACpB,QAAQ;AAAA,UACR,SAAS,oBAAoB;AAAA,UAC7B,cAAc;AAAA,UACd,cAAc;AAAA,UACd,YAAY;AAAA,UACZ,UAAU,WAAW,KAAK,UAAU,QAAQ,IAAI;AAAA,QACpD,CAAC;AACD,cAAM,SAAS,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAQ;AAG/E,YAAI;AAAE,gBAAM,KAAK,eAAe,MAAM,KAAK;AAAA,QAAG,QAAQ;AAAA,QAAoB;AAC1E,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,OAAO,CAAC,EAAE;AAAA,MACxE;AAIA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,cAAc,MAAM,OAAO;AACzF,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,SAAS,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,EAAE,gBAAgB,OAAO,YAAY,MAAM,EAAE,CAAQ;AAC3G,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,sCAAsC,GAAG,EAAE;AACtH,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,OAAO,CAAC,EAAE;AAAA,MACxE;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,cAAc,MAAM,UAAU;AAC5F,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,SAAS,MAAM,wBAAwB,OAAO,KAAK;AACzD,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,sCAAsC,GAAG,EAAE;AAGtH,cAAM,WAAW,KAAK,OAAO,UAAU,SAAS,KAAK,CAAC;AACtD,cAAM,KAAK,SAAS,KAAK,CAAC,OAAY,EAAE,UAAU,MAAM,EAAE,QAAQ,KAAK,GAAG;AAC1E,YAAI,IAAI,SAAS,CAAC,SAAS,UAAU,UAAU,EAAE,SAAS,GAAG,KAAK,GAAG;AACjE,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,gBAAgB,GAAG,KAAK,0BAA0B,GAAG,EAAE;AAAA,QACzH;AACA,cAAM,GAAG,OAAO,aAAa,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAQ;AAChE,YAAI;AAAE,gBAAM,KAAK,eAAe,MAAM,KAAK;AAAA,QAAG,QAAQ;AAAA,QAAoB;AAC1E,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,IAAI,OAAO,IAAI,SAAS,KAAK,CAAC,EAAE;AAAA,MACrF;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,YAAY,MAAM,SAAS;AACpH,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,SAAS,MAAM,wBAAwB,OAAO,KAAK;AACzD,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,sCAAsC,GAAG,EAAE;AACtH,cAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,cAAM,GAAG,OAAO,aAAa,EAAE,SAAS,MAAM,QAAQ,aAAa,YAAY,OAAO,GAAG,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAQ;AAC5H,cAAM,UAAU,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAQ;AACjF,YAAI;AAAE,gBAAM,KAAK,eAAe,MAAM,KAAK;AAAA,QAAG,QAAQ;AAAA,QAAoB;AAC1E,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,QAAQ,CAAC,EAAE;AAAA,MACzE;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,aAAa,MAAM,SAAS;AACrH,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,SAAS,MAAM,wBAAwB,OAAO,KAAK;AACzD,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,sCAAsC,GAAG,EAAE;AACtH,cAAM,WAAW,KAAK,OAAO,UAAU,SAAS,KAAK,CAAC;AACtD,cAAM,KAAK,SAAS,KAAK,CAAC,OAAY,EAAE,UAAU,MAAM,EAAE,QAAQ,KAAK,GAAG;AAC1E,YAAI,IAAI,SAAS,CAAC,SAAS,UAAU,UAAU,EAAE,SAAS,GAAG,KAAK,GAAG;AACjE,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,gBAAgB,GAAG,KAAK,uBAAuB,GAAG,EAAE;AAAA,QACtH;AACA,cAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,cAAM,GAAG,OAAO,aAAa,EAAE,SAAS,OAAO,QAAQ,YAAY,YAAY,OAAO,GAAG,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAQ;AAC5H,cAAM,UAAU,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAQ;AACjF,YAAI;AAAE,gBAAM,KAAK,eAAe,MAAM,KAAK;AAAA,QAAG,QAAQ;AAAA,QAAoB;AAC1E,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,QAAQ,CAAC,EAAE;AAAA,MACzE;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,aAAa,MAAM,QAAQ;AACpH,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,SAAS,MAAM,wBAAwB,OAAO,KAAK;AACzD,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,sCAAsC,GAAG,EAAE;AACtH,cAAM,EAAE,cAAc,IAAI,QAAQ,CAAC;AACnC,cAAM,WAAW,KAAK,OAAO,UAAU,SAAS,KAAK,CAAC;AACtD,cAAM,YAAY,SAAS,KAAK,CAAC,OAAY,EAAE,UAAU,MAAM,EAAE,QAAQ,KAAK,GAAG;AACjF,cAAM,aAAa,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,EAAE,IAAI,OAAO,mBAAmB,EAAE,CAAQ;AACpG,cAAM,aAAa,iBAAiB,WAAW,WAAW,YAAY,WAAW;AACjF,YAAI,eAAe,YAAY,SAAS;AACpC,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,QAAQ,SAAS,4BAA4B,CAAC,EAAE;AAAA,QAC9G;AAEA,YAAI,SAAS;AACb,YAAI;AACA,gBAAM,cAAmB,MAAM,KAAK,WAAW,gBAAgB,KAAK,IAAI;AACxE,gBAAM,cAAc,MAAM,aAAa,KAAK,aAAa;AAAA,YACrD,SAAS,UAAU,SAAS;AAAA,UAChC,CAAC;AACD,mBAAS,aAAa,MAAM,MAAM;AAAA,QACtC,QAAQ;AAAA,QAAqB;AAC7B,cAAM,eAAe,MAAM,wBAAwB,OAAO,YAAY,YAAY,QAAQ,SAAS;AACnG,cAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,cAAM,GAAG,OAAO,aAAa;AAAA,UACzB,oBAAoB;AAAA,UACpB,QAAQ;AAAA,UACR,YAAY;AAAA,QAChB,GAAG,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAQ;AACtC,cAAM,UAAU,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAQ;AACjF,YAAI;AAAE,gBAAM,KAAK,eAAe,MAAM,KAAK;AAAA,QAAG,QAAQ;AAAA,QAAoB;AAC1E,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,QAAQ,CAAC,EAAE;AAAA,MACzE;AAAA,IAEJ,SAAS,GAAQ;AACb,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,EAAE,SAAS,EAAE,cAAc,GAAG,EAAE;AAAA,IACjF;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,qBACV,eACA,MAQ6E;AAC7E,UAAM,EAAE,IAAI,SAAS,gBAAgB,MAAM,IAAI;AAC/C,UAAM,MAAM;AACZ,UAAM,WAAqB,CAAC;AAE5B,UAAM,MAAM,MAAM,QAAQ,KAAK,EAAE,IAAI,cAAc,CAAC;AACpD,QAAI,CAAC,KAAK;AACN,aAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,YAAY,aAAa,eAAe,SAAS;AAAA,IAC7F;AACA,QAAI,IAAI,cAAc,QAAQ,IAAI,cAAc,GAAG;AAC/C,aAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,YAAY,aAAa,+CAA+C,SAAS;AAAA,IAC7H;AACA,SAAK,IAAI,eAAe,QAAQ,IAAI,eAAe,MAAM,CAAC,OAAO;AAC7D,aAAO;AAAA,QACH,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,OAAO,YAAY,aAAa;AAAA,QAChC;AAAA,MACJ;AAAA,IACJ;AAGA,UAAM,UAAoD;AAAA,MACtD,EAAE,QAAQ,8BAA8B,OAAO,iBAAiB;AAAA,MAChE,EAAE,QAAQ,0BAA0B,OAAO,iBAAiB;AAAA,MAC5D,EAAE,QAAQ,4BAA4B,OAAO,iBAAiB;AAAA,IAClE;AACA,eAAW,EAAE,QAAQ,MAAM,KAAK,SAAS;AACrC,UAAI;AACA,YAAI,OAAO,MAAM,GAAG,KAAK,QAAQ,EAAE,OAAO,EAAE,CAAC,KAAK,GAAG,cAAc,EAAE,CAAQ;AAC7E,YAAI,QAAQ,KAAK,MAAO,QAAO,KAAK;AACpC,YAAI,MAAM,QAAQ,IAAI,GAAG;AACrB,qBAAW,KAAK,MAAM;AAClB,gBAAI,GAAG,MAAM,MAAM;AACf,kBAAI;AACA,sBAAM,GAAG,OAAO,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAQ;AAAA,cAC1D,SAAS,UAAU;AACf,yBAAS;AAAA,kBACL,oBAAoB,MAAM,IAAI,EAAE,EAAE,KAAK,oBAAoB,QAAQ,SAAS,UAAU,OAAO,QAAQ,CAAC;AAAA,gBAC1G;AAAA,cACJ;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ,SAAS,KAAK;AACV,iBAAS;AAAA,UACL,uBAAuB,MAAM,gBAAgB,aAAa,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACnH;AAAA,MACJ;AAAA,IACJ;AAGA,UAAM,SAAU,IAAI,mBAA0C;AAC9D,UAAM,cAAc,IAAI;AACxB,UAAM,eAAe,KAAK,OAAO,aAAa,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;AAC9E,QAAI;AACA,YAAM,UAAU,MAAM,eAAe,MAAM;AAC3C,UAAI,SAAS,gBAAgB;AACzB,cAAM,QAAQ,eAAe,EAAE,eAAe,cAAc,YAAY,CAAC;AAAA,MAC7E,OAAO;AACH,iBAAS,KAAK,0BAA0B,MAAM,8BAA8B,aAAa,gBAAgB;AAAA,MAC7G;AAAA,IACJ,SAAS,KAAK;AACV,eAAS;AAAA,QACL,kDAAkD,aAAa,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACxH;AAAA,IACJ;AAGA,QAAI;AACA,YAAM,GAAG,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,CAAQ;AAAA,IAChE,SAAS,KAAK;AACV,aAAO;AAAA,QACH,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,OAAO,yCAAyC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QAChG;AAAA,MACJ;AAAA,IACJ;AAGA,QAAI,KAAK,aAAa,YAAY;AAC9B,UAAI;AAAE,cAAM,KAAK,YAAY,WAAW,aAAa;AAAA,MAAG,QAAQ;AAAA,MAAoB;AAAA,IACxF;AAEA,WAAO,EAAE,IAAI,MAAM,SAAS;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cAAc,MAAc,QAAgB,MAAW,SAA6D;AACtH,UAAM,iBAAiB,MAAM,KAAK,WAAW,gBAAgB,KAAK,cAAc,CAAC,KAAK,KAAK,OAAO,WAAW,cAAc;AAC3H,QAAI,CAAC,gBAAgB;AAChB,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,+BAA+B,GAAG,EAAE;AAAA,IACtF;AAEA,UAAM,IAAI,OAAO,YAAY;AAC7B,UAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG;AAGhD,QAAI,MAAM,CAAC,MAAM,YAAY,MAAM,QAAQ;AACvC,UAAI,CAAC,MAAM;AACN,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,oBAAoB,GAAG,EAAE;AAAA,MAC3E;AACA,YAAM,SAAS,MAAM,eAAe,OAAO,MAAM,EAAE,SAAS,QAAQ,QAAQ,CAAC;AAC7E,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,IAC3D;AAGA,QAAI,MAAM,CAAC,MAAM,UAAU,MAAM,CAAC,KAAK,MAAM,OAAO;AAChD,YAAM,KAAK,MAAM,CAAC;AAClB,YAAM,SAAS,MAAM,eAAe,SAAS,IAAI,EAAE,SAAS,QAAQ,QAAQ,CAAC;AAG7E,UAAI,OAAO,OAAO,OAAO,UAAU;AAE/B,eAAO,EAAE,SAAS,MAAM,QAAQ,EAAE,MAAM,YAAY,KAAK,OAAO,IAAI,EAAE;AAAA,MAC1E;AAEA,UAAI,OAAO,QAAQ;AAEd,eAAO;AAAA,UACH,SAAS;AAAA,UACT,QAAQ;AAAA,YACJ,MAAM;AAAA,YACN,QAAQ,OAAO;AAAA,YACf,SAAS;AAAA,cACL,gBAAgB,OAAO,YAAY;AAAA,cACnC,kBAAkB,OAAO;AAAA,YAC7B;AAAA,UACJ;AAAA,QACJ;AAAA,MACL;AAEA,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,IAC3D;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,MAAc,OAAY,UAA8D;AACnG,UAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAGhE,QAAI,MAAM,CAAC,MAAM,UAAU,MAAM,CAAC,GAAG;AACjC,YAAM,aAAa,MAAM,CAAC;AAE1B,YAAM,OAAO,MAAM,CAAC,KAAK,OAAO,QAAQ;AAExC,YAAM,WAAW,MAAM,KAAK,eAAe,UAAU;AAErD,UAAI,YAAY,OAAO,SAAS,cAAc,YAAY;AACtD,YAAI;AACA,gBAAM,SAAS,MAAM,SAAS,UAAU,EAAE,QAAQ,YAAY,KAAK,CAAC;AACpE,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,QAC3D,SAAS,GAAQ;AACb,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,EAAE,SAAS,GAAG,EAAE;AAAA,QACjE;AAAA,MACJ,OAAO;AACF,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,kCAAkC,GAAG,EAAE;AAAA,MACzF;AAAA,IACJ;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,iBAAiB,MAAc,QAAgB,MAAW,SAA8B,OAA4C;AACtI,UAAM,oBAAoB,MAAM,KAAK,WAAW,gBAAgB,KAAK,UAAU;AAC/E,QAAI,CAAC,kBAAmB,QAAO,EAAE,SAAS,MAAM;AAEhD,UAAM,IAAI,OAAO,YAAY;AAC7B,UAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAGhE,QAAI,MAAM,CAAC,MAAM,aAAa,MAAM,CAAC,KAAK,MAAM,QAAQ;AACnD,YAAM,cAAc,MAAM,CAAC;AAC3B,UAAI,OAAO,kBAAkB,YAAY,YAAY;AACjD,cAAM,SAAS,MAAM,kBAAkB,QAAQ,aAAa,MAAM,EAAE,SAAS,QAAQ,QAAQ,CAAC;AAC9F,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AAEA,UAAI,OAAO,kBAAkB,YAAY,YAAY;AACjD,cAAM,SAAS,MAAM,kBAAkB,QAAQ,aAAa,IAAI;AAChE,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AAAA,IACL;AAGA,QAAI,MAAM,WAAW,KAAK,MAAM,OAAO;AACnC,UAAI,OAAO,kBAAkB,cAAc,YAAY;AACnD,cAAM,QAAQ,MAAM,kBAAkB,UAAU;AAChD,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,OAAO,OAAO,OAAO,MAAM,QAAQ,SAAS,MAAM,CAAC,EAAE;AAAA,MAC1G;AAAA,IACJ;AAGA,QAAI,MAAM,WAAW,KAAK,MAAM,QAAQ;AACpC,UAAI,OAAO,kBAAkB,iBAAiB,YAAY;AACtD,0BAAkB,aAAa,MAAM,MAAM,IAAI;AAC/C,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,MACzD;AAAA,IACJ;AAGA,QAAI,MAAM,UAAU,GAAG;AACnB,YAAM,OAAO,MAAM,CAAC;AAGpB,UAAI,MAAM,CAAC,MAAM,aAAa,MAAM,QAAQ;AACxC,YAAI,OAAO,kBAAkB,YAAY,YAAY;AACjD,gBAAM,UAAU,QAAQ,OAAO,SAAS,WAAW,OAAO,CAAC;AAW3D,gBAAM,WAAW,QAAQ;AACzB,gBAAM,aAAa,QAAQ,cAAc,QAAQ;AACjD,gBAAM,aAAc,QAAQ,UAAU,OAAO,QAAQ,WAAW,WAAY,EAAE,GAAG,QAAQ,OAAO,IAAI,CAAC;AAIrG,cAAI,CAAC,QAAQ,QAAQ;AACjB,kBAAM,WAAW,oBAAI,IAAI,CAAC,YAAY,cAAc,UAAU,SAAS,QAAQ,CAAC;AAChF,uBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC1C,kBAAI,SAAS,IAAI,CAAC,EAAG;AACrB,kBAAI,WAAW,CAAC,MAAM,OAAW,YAAW,CAAC,IAAI;AAAA,YACrD;AAAA,UACJ;AACA,cAAI,aAAa,UAAa,WAAW,aAAa,QAAW;AAC7D,uBAAW,WAAW;AAAA,UAC1B;AACA,cAAI,aAAa,UAAa,YAAY;AACtC,kBAAM,QAAQ,GAAG,OAAO,UAAU,EAAE,QAAQ,aAAa,CAAC,GAAW,MAAc,EAAE,YAAY,CAAC,CAAC;AACnG,gBAAI,WAAW,KAAK,MAAM,OAAW,YAAW,KAAK,IAAI;AAAA,UAC7D;AACA,gBAAM,oBAAyB;AAAA,YAC3B,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,OAAO,QAAQ,SAAS;AAAA,UAC5B;AACA,gBAAM,iBAAkB,SAAiB,MAAM,MAAO,SAAiB;AACvE,cAAI,eAAgB,mBAAkB,SAAS;AAC/C,gBAAM,SAAS,MAAM,kBAAkB,QAAQ,MAAM,iBAAiB;AACtE,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,QAC3D;AAAA,MACJ;AAGA,UAAI,MAAM,CAAC,MAAM,YAAY,MAAM,QAAQ;AACvC,YAAI,OAAO,kBAAkB,eAAe,YAAY;AACpD,gBAAM,kBAAkB,WAAW,MAAM,MAAM,WAAW,IAAI;AAC9D,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,MAAM,SAAS,MAAM,WAAW,KAAK,CAAC,EAAE;AAAA,QAC7F;AAAA,MACJ;AAGA,UAAI,MAAM,CAAC,MAAM,UAAU,MAAM,CAAC,KAAK,MAAM,OAAO;AAChD,YAAI,OAAO,kBAAkB,WAAW,YAAY;AAChD,gBAAM,MAAM,MAAM,kBAAkB,OAAO,MAAM,CAAC,CAAC;AACnD,cAAI,CAAC,IAAK,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,uBAAuB,GAAG,EAAE;AACnF,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,GAAG,EAAE;AAAA,QACxD;AAAA,MACJ;AAGA,UAAI,MAAM,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,MAAM,OAAO;AACjD,YAAI,OAAO,kBAAkB,aAAa,YAAY;AAClD,gBAAM,UAAU,QAAQ,EAAE,OAAO,MAAM,QAAQ,OAAO,MAAM,KAAK,IAAI,QAAW,QAAQ,MAAM,OAAO,IAAI;AACzG,gBAAM,OAAO,MAAM,kBAAkB,SAAS,MAAM,OAAO;AAC3D,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,MAAM,SAAS,MAAM,CAAC,EAAE;AAAA,QAC7E;AAAA,MACJ;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,OAAO;AACnC,YAAI,OAAO,kBAAkB,YAAY,YAAY;AACjD,gBAAM,OAAO,MAAM,kBAAkB,QAAQ,IAAI;AACjD,cAAI,CAAC,KAAM,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,kBAAkB,GAAG,EAAE;AAC/E,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,QACzD;AAAA,MACJ;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,OAAO;AACnC,YAAI,OAAO,kBAAkB,iBAAiB,YAAY;AACtD,4BAAkB,aAAa,MAAM,MAAM,cAAc,IAAI;AAC7D,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,cAAc,IAAI,EAAE;AAAA,QAC7E;AAAA,MACJ;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,UAAU;AACtC,YAAI,OAAO,kBAAkB,mBAAmB,YAAY;AACxD,4BAAkB,eAAe,IAAI;AACrC,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,MAAM,SAAS,KAAK,CAAC,EAAE;AAAA,QAC5E;AAAA,MACJ;AAAA,IACJ;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA,EAEQ,iBAAsC;AAC1C,QAAI,KAAK,OAAO,oBAAoB,KAAK;AACrC,aAAO,OAAO,YAAY,KAAK,OAAO,QAAQ;AAAA,IAClD;AACA,WAAO,KAAK,OAAO,YAAY,CAAC;AAAA,EACpC;AAAA,EAEA,MAAc,WAAW,MAAuB;AAC5C,WAAO,KAAK,eAAe,IAAI;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,eAAe,MAAc,SAAkB;AAEzD,QAAI,WAAW,OAAO,KAAK,cAAc,oBAAoB,YAAY;AACrE,UAAI;AACA,cAAM,MAAM,MAAM,KAAK,cAAc,gBAAgB,MAAM,OAAO;AAClE,YAAI,OAAO,KAAM,QAAO;AAAA,MAC5B,QAAQ;AAAA,MAER;AAAA,IACJ;AAEA,QAAI,OAAO,KAAK,OAAO,oBAAoB,YAAY;AACnD,UAAI;AACA,cAAM,MAAM,MAAM,KAAK,OAAO,gBAAgB,IAAI;AAClD,YAAI,OAAO,KAAM,QAAO;AAAA,MAC5B,QAAQ;AAAA,MAER;AAAA,IACJ;AACA,QAAI,OAAO,KAAK,OAAO,eAAe,YAAY;AAC9C,UAAI;AACA,cAAM,MAAM,MAAM,KAAK,OAAO,WAAW,IAAI;AAC7C,YAAI,OAAO,KAAM,QAAO;AAAA,MAC5B,QAAQ;AAAA,MAER;AAAA,IACJ;AACA,QAAI,KAAK,QAAQ,SAAS,YAAY;AAClC,UAAI;AACA,cAAM,MAAM,MAAM,KAAK,OAAO,QAAQ,WAAW,IAAI;AACrD,YAAI,OAAO,KAAM,QAAO;AAAA,MAC5B,QAAQ;AAAA,MAER;AAAA,IACJ;AACA,UAAM,WAAW,KAAK,eAAe;AACrC,WAAO,SAAS,IAAI;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,mBAAmB,SAAgC;AAE7D,QAAI;AACA,YAAM,MAAM,MAAM,KAAK,eAAe,YAAY,OAAO;AACzD,UAAI,KAAK,SAAU,QAAO;AAAA,IAC9B,QAAQ;AAAA,IAA8B;AACtC,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,cAAc,MAAc,QAAgB,MAAW,UAA8D;AACvH,QAAI,OAAO,YAAY,MAAM,QAAQ;AACjC,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,sBAAsB,GAAG,EAAE;AAAA,IAC5E;AACA,UAAM,QAAQ,KAAK,QAAQ,cAAc,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AACtE,QAAI,MAAM,SAAS,GAAG;AAClB,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,yCAAyC,GAAG,EAAE;AAAA,IAC/F;AACA,UAAM,aAAa,MAAM,CAAC;AAC1B,UAAM,aAAa,MAAM,CAAC;AAC1B,UAAM,mBAAmB,MAAM,CAAC;AAKhC,QAAI,CAAC,SAAS,eAAe;AACzB,YAAM,MAAM,KAAK,sBAAsB;AACvC,UAAI,KAAK,cAAe,UAAS,gBAAgB,IAAI;AAAA,IACzD;AAOA,QAAI,YAAiB;AACrB,QAAI,KAAK,iBAAiB,SAAS,iBAAiB,SAAS,kBAAkB,YAAY;AACvF,UAAI;AACA,cAAM,gBAAqB,MAAM,KAAK,cAAc,YAAY,SAAS,aAAa;AACtF,YAAI,eAAe;AACf,eAAK,SAAS;AAKd,cAAI,OAAO,cAAc,oBAAoB,YAAY;AACrD,wBAAY,MAAM,cAAc,gBAAgB,UAAU,EAAE,MAAM,MAAM,IAAI;AAAA,UAChF;AAAA,QACJ;AAAA,MACJ,QAAQ;AAAA,MAGR;AAAA,IACJ;AAEA,UAAM,KAAU,aAAa,MAAM,KAAK,mBAAmB,UAAU,aAAa;AAClF,QAAI,CAAC,MAAM,OAAO,GAAG,kBAAkB,YAAY;AAC/C,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,6BAA6B,GAAG,EAAE;AAAA,IACnF;AAKA,UAAM,aAAa,OAAO,QAAgB;AACtC,aAAO,GAAG,cAAc,KAAK,YAAY,aAAa;AAAA,IAC1D;AAEA,UAAM,UAAU,QAAQ,OAAO,SAAS,WAAW,OAAO,CAAC;AAC3D,UAAM,WAAW,oBAAoB,QAAQ;AAC7C,UAAM,YAAa,QAAQ,UAAU,OAAO,QAAQ,WAAW,WAAY,QAAQ,SAAS,CAAC;AAG7F,QAAI,SAAkC,CAAC;AACvC,QAAI,YAAY,eAAe,UAAU;AACrC,UAAI;AACA,cAAM,MAAM,MAAM,KAAK,SAAS,OAAO,EAAE,QAAQ,YAAY,IAAI,SAAS,GAAG,SAAS,YAAY,SAAS,eAAe,SAAS,gBAAgB;AACnJ,YAAI,KAAK,OAAQ,UAAS,IAAI;AAAA,MAClC,QAAQ;AAAA,MAAgE;AAAA,IAC5E;AACA,QAAI,UAAW,OAAe,MAAM,QAAQ,SAAU,CAAC,OAAe,KAAK;AAG3E,UAAM,eAAe;AAAA,MACjB,MAAM,OAAO,QAAgB,MAAwD;AACjF,cAAM,MAAM,MAAM,GAAG,OAAO,QAAQ,IAAI;AACxC,cAAM,MAAM,OAAQ,IAAY,OAAQ,KAAa;AACrD,eAAO,EAAE,GAAG;AAAA,MAChB;AAAA,MACA,MAAM,OAAO,QAAgB,IAAY,MAA8C;AACnF,cAAM,GAAG,OAAO,QAAQ,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAAA,MACnD;AAAA,MACA,MAAM,OAAO,QAAgB,IAA2B;AACpD,cAAM,GAAG,OAAO,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAAA,MAC7C;AAAA,MACA,MAAM,KAAK,QAAgB,OAAyE;AAChG,cAAM,OAAO,SAAS,OAAO,KAAK,KAAK,EAAE,SAAS,EAAE,OAAO,MAAM,IAAI;AACrE,cAAM,OAAO,MAAM,GAAG,KAAK,QAAQ,IAAW;AAC9C,eAAO,MAAM,QAAQ,IAAI,IAAI,OAAS,MAAc,SAAS,CAAC;AAAA,MAClE;AAAA,IACJ;AAEA,UAAM,iBAAkB,UAAkB,MAAM,MAAO,UAAkB,UAAU;AACnF,UAAM,eAAgB,UAAkB,QAAQ,EAAE,IAAI,gBAAgB,MAAM,eAAe;AAE3F,UAAM,gBAAqB;AAAA,MACvB;AAAA,MACA,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,EAAE,GAAG,WAAW,UAAU,WAAW;AAAA,IACjD;AAEA,QAAI;AAEA,UAAI;AACJ,UAAI;AACA,iBAAS,MAAM,WAAW,UAAU;AAAA,MACxC,SAAS,KAAU;AACf,cAAM,MAAM,OAAO,KAAK,WAAW,OAAO,EAAE;AAC5C,YAAI,aAAa,KAAK,GAAG,KAAK,eAAe,KAAK;AAC9C,mBAAS,MAAM,WAAW,GAAG;AAAA,QACjC,OAAO;AACH,gBAAM;AAAA,QACV;AAAA,MACJ;AACA,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,MAAM,MAAM,OAAO,CAAC,EAAE;AAAA,IACpF,SAAS,KAAU;AACf,YAAM,MAAM,KAAK,WAAW,OAAO,GAAG;AACtC,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,OAAO,OAAO,IAAI,CAAC,EAAE;AAAA,IACnF;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,SAAiB,QAAgB,MAAW,OAAY,UAA8D;AACjI,QAAI;AACJ,QAAI;AACA,kBAAY,MAAM,KAAK,eAAe,IAAI;AAAA,IAC9C,QAAQ;AAAA,IAER;AAEA,QAAI,CAAC,WAAW;AACZ,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU;AAAA,UACN,QAAQ;AAAA,UACR,MAAM,EAAE,SAAS,OAAO,OAAO,EAAE,SAAS,gCAAgC,MAAM,IAAI,EAAE;AAAA,QAC1F;AAAA,MACJ;AAAA,IACJ;AAIA,UAAM,WAAW,UAAU,OAAO;AAGlC,UAAM,aAAa,CAAC,SAAiB,SAAgD;AACjF,YAAM,eAAe,QAAQ,MAAM,GAAG;AACtC,YAAM,YAAY,KAAK,MAAM,GAAG;AAChC,UAAI,aAAa,WAAW,UAAU,OAAQ,QAAO;AACrD,YAAM,SAAiC,CAAC;AACxC,eAAS,IAAI,GAAG,IAAI,aAAa,QAAQ,KAAK;AAC1C,YAAI,aAAa,CAAC,EAAE,WAAW,GAAG,GAAG;AACjC,iBAAO,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC;AAAA,QACtD,WAAW,aAAa,CAAC,MAAM,UAAU,CAAC,GAAG;AACzC,iBAAO;AAAA,QACX;AAAA,MACJ;AACA,aAAO;AAAA,IACX;AAGA,UAAM,SAAU,KAAK,OAAe;AAIpC,QAAI,CAAC,QAAQ;AACT,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU;AAAA,UACN,QAAQ;AAAA,UACR,MAAM,EAAE,SAAS,OAAO,OAAO,EAAE,SAAS,yCAAyC,MAAM,IAAI,EAAE;AAAA,QACnG;AAAA,MACJ;AAAA,IACJ;AAEA,eAAW,SAAS,QAAQ;AACxB,UAAI,MAAM,WAAW,OAAQ;AAC7B,YAAM,SAAS,WAAW,MAAM,MAAM,QAAQ;AAC9C,UAAI,WAAW,KAAM;AAErB,YAAM,SAAS,MAAM,MAAM,QAAQ,EAAE,MAAM,QAAQ,MAAM,CAAC;AAE1D,UAAI,OAAO,UAAU,OAAO,QAAQ;AAEhC,eAAO;AAAA,UACH,SAAS;AAAA,UACT,QAAQ;AAAA,YACJ,MAAM;AAAA,YACN,aAAa,OAAO,mBACd,8BACA;AAAA,YACN,QAAQ,OAAO;AAAA,YACf,kBAAkB,OAAO;AAAA,YACzB,SAAS;AAAA,cACL,gBAAgB,OAAO,mBACjB,8BACA;AAAA,cACN,iBAAiB;AAAA,cACjB,cAAc;AAAA,YAClB;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ;AAEA,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU;AAAA,UACN,QAAQ,OAAO;AAAA,UACf,MAAM,OAAO;AAAA,QACjB;AAAA,MACJ;AAAA,IACJ;AAEA,WAAO;AAAA,MACH,SAAS;AAAA,MACT,UAAU,KAAK,cAAc,OAAO;AAAA,IACxC;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,QAAgB,MAAc,MAAW,OAAY,SAA8B,QAAgD;AAC9I,QAAI,YAAY,KAAK,QAAQ,OAAO,EAAE;AAItC,UAAM,KAAK,0BAA0B,SAAS,SAAS;AASvD,QAAI,KAAK,iBAAiB,QAAQ,iBAAiB,QAAQ,kBAAkB,YAAY;AACrF,WAAK,SAAS,MAAM,KAAK,cAAc,YAAY,QAAQ,aAAa;AAAA,IAC5E,OAAO;AACH,WAAK,SAAS,KAAK;AAAA,IACvB;AAGA,QAAI,KAAK,gBAAgB,QAAQ,iBAAiB,QAAQ,kBAAkB,YAAY;AACpF,WAAK,aAAa,MAAM,QAAQ,aAAa;AAAA,IACjD;AAKA,QAAI;AACA,cAAQ,mBAAmB,MAAM,wBAAwB;AAAA,QACrD,YAAY,CAAC,MAAc,KAAK,eAAe,GAAG,QAAQ,aAAa;AAAA,QACvE,OAAO,MAAM,QAAQ,QAAQ,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,QAC3E,SAAS,QAAQ;AAAA,MACrB,CAAC;AAAA,IACL,QAAQ;AAAA,IAER;AAMA,UAAM,YAAY,MAAM,KAAK,yBAAyB,SAAS,SAAS;AACxE,QAAI,WAAW;AACX,aAAO,EAAE,SAAS,MAAM,UAAU,UAAU;AAAA,IAChD;AAOA,QAAI,CAAC,UAAU,WAAW,SAAS,GAAG;AAClC,YAAM,cAAc,UAAU,MAAM,4BAA4B;AAChE,UAAI,aAAa;AACb,oBAAY,YAAY,CAAC,KAAK;AAAA,MAClC;AAAA,IACJ;AAKA,QAAI;AACJ,WAAK,cAAc,gBAAgB,cAAc,OAAO,WAAW,OAAO;AACrE,cAAM,OAAO,MAAM,KAAK,iBAAiB,UAAU,EAAE;AACrD,eAAO;AAAA,UACH,SAAS;AAAA,UACT,UAAU,KAAK,QAAQ,IAAI;AAAA,QAC/B;AAAA,MACL;AAGA,UAAI,cAAc,aAAa,WAAW,OAAO;AAC7C,eAAO;AAAA,UACH,SAAS;AAAA,UACT,UAAU,KAAK,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,YAClC,SAAS;AAAA,YACT,QAAQ,OAAO,YAAY,cAAc,QAAQ,OAAO,IAAI;AAAA,UAChE,CAAC;AAAA,QACL;AAAA,MACJ;AAMA,UAAI,UAAU,WAAW,OAAO,GAAG;AAC/B,eAAO,KAAK,WAAW,UAAU,UAAU,CAAC,GAAG,QAAQ,MAAM,OAAO;AAAA,MACxE;AAEA,UAAI,UAAU,WAAW,OAAO,GAAG;AAC9B,eAAO,KAAK,eAAe,UAAU,UAAU,CAAC,GAAG,SAAS,QAAQ,MAAM,KAAK;AAAA,MACpF;AAEA,UAAI,UAAU,WAAW,OAAO,GAAG;AAC/B,eAAO,KAAK,WAAW,UAAU,UAAU,CAAC,GAAG,QAAQ,MAAM,OAAO,OAAO;AAAA,MAC/E;AAEA,UAAI,UAAU,WAAW,UAAU,GAAG;AACjC,YAAI,WAAW,OAAQ,QAAO,KAAK,cAAc,MAAM,OAAO;AAAA,MAEnE;AAEA,UAAI,UAAU,WAAW,UAAU,GAAG;AACjC,eAAO,KAAK,cAAc,UAAU,UAAU,CAAC,GAAG,QAAQ,MAAM,OAAO;AAAA,MAC5E;AAEA,UAAI,UAAU,WAAW,KAAK,GAAG;AAC5B,eAAO,KAAK,SAAS,UAAU,UAAU,CAAC,GAAG,OAAO,OAAO;AAAA,MAChE;AAEA,UAAI,UAAU,WAAW,aAAa,GAAG;AACpC,eAAO,KAAK,iBAAiB,UAAU,UAAU,EAAE,GAAG,QAAQ,MAAM,SAAS,KAAK;AAAA,MACvF;AAEA,UAAI,UAAU,WAAW,UAAU,GAAG;AACjC,eAAO,KAAK,cAAc,UAAU,UAAU,CAAC,GAAG,QAAQ,MAAM,OAAO;AAAA,MAC5E;AAEA,UAAI,UAAU,WAAW,YAAY,GAAG;AACnC,eAAO,KAAK,gBAAgB,UAAU,UAAU,EAAE,GAAG,QAAQ,MAAM,OAAO;AAAA,MAC/E;AAEA,UAAI,UAAU,WAAW,WAAW,GAAG;AAClC,eAAO,KAAK,eAAe,UAAU,UAAU,CAAC,GAAG,QAAQ,MAAM,OAAO,OAAO;AAAA,MACpF;AAEA,UAAI,UAAU,WAAW,QAAQ,GAAG;AAC/B,eAAO,KAAK,YAAY,UAAU,UAAU,CAAC,GAAG,QAAQ,MAAM,OAAO,OAAO;AAAA,MACjF;AAEA,UAAI,UAAU,WAAW,OAAO,GAAG;AAC9B,eAAO,KAAK,WAAW,UAAU,UAAU,CAAC,GAAG,QAAQ,OAAO,OAAO;AAAA,MAC1E;AAGA,UAAI,UAAU,WAAW,KAAK,GAAG;AAC5B,eAAO,KAAK,SAAS,WAAW,QAAQ,MAAM,OAAO,OAAO;AAAA,MACjE;AAGA,UAAI,cAAc,mBAAmB,WAAW,OAAO;AAClD,YAAI;AACD,gBAAM,UAAU,MAAM,KAAK,eAAe,YAAY,QAAQ,aAAa;AAC3E,cAAI,WAAW,OAAQ,QAAgB,oBAAoB,YAAY;AACnE,kBAAMC,UAAS,MAAO,QAAgB,gBAAgB,CAAC,CAAC;AACxD,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQA,OAAM,EAAE;AAAA,UAC3D;AAAA,QACH,SAAS,GAAG;AAAA,QAEZ;AAAA,MACL;AAIA,YAAM,SAAS,MAAM,KAAK,kBAAkB,WAAW,QAAQ,MAAM,OAAO,OAAO;AACnF,UAAI,OAAO,QAAS,QAAO;AAG3B,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU,KAAK,cAAc,SAAS;AAAA,MAC1C;AAAA,IACA,SAAS,GAAG;AACR,UAAI,wBAAwB,CAAC,GAAG;AAC5B,eAAO;AAAA,UACH,SAAS;AAAA,UACT,UAAU,KAAK,MAAM,EAAE,SAAS,KAAK,EAAE,MAAM,qBAAqB,GAAI,EAAE,WAAW,CAAC,EAAG,CAAC;AAAA,QAC5F;AAAA,MACJ;AACA,YAAM;AAAA,IACV;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,MAAc,QAAgB,MAAW,OAAY,SAA6D;AACtI,QAAI;AAEA,YAAM,UAAU,MAAM,KAAK,eAAe,YAAY,QAAQ,aAAa;AAC3E,UAAI,CAAC,WAAW,OAAQ,QAAgB,kBAAkB,YAAY;AAClE,eAAO,EAAE,SAAS,MAAM;AAAA,MAC5B;AACA,YAAM,WAAW,MAAO,QAAgB,cAAc,EAAE,MAAM,OAAO,CAAC;AAEtE,UAAI,UAAU;AAEV,YAAI,SAAS,SAAS,QAAQ;AAC1B,gBAAM,gBAAgB,MAAM,KAAK,eAAe,YAAY;AAC5D,cAAI,CAAC,iBAAiB,OAAQ,cAAsB,YAAY,YAAY;AACxE,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,oCAAoC,GAAG,EAAE;AAAA,UAC1F;AACA,gBAAM,SAAS,MAAO,cAAsB,QAAQ;AAAA,YAChD,QAAQ,SAAS;AAAA,YACjB,QAAQ,EAAE,GAAG,OAAO,GAAG,MAAM,UAAU,QAAQ,QAAQ;AAAA,UAC3D,CAAC;AACA,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,QAC5D;AAEA,YAAI,SAAS,SAAS,UAAU;AAC5B,gBAAM,gBAAgB,MAAM,KAAK,eAAe,YAAY;AAC5D,cAAI,CAAC,iBAAiB,OAAQ,cAAsB,cAAc,YAAY;AAC1E,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,oCAAoC,GAAG,EAAE;AAAA,UAC1F;AACC,gBAAM,SAAS,MAAO,cAAsB,UAAU;AAAA,YACnD,YAAY,SAAS;AAAA,YACrB,SAAS,EAAE,GAAG,OAAO,GAAG,MAAM,SAAS,QAAQ,QAAQ;AAAA,UAC3D,CAAC;AACA,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,QAC5D;AAEA,YAAI,SAAS,SAAS,oBAAoB;AAEtC,cAAI,SAAS,cAAc;AACvB,kBAAM,EAAE,QAAQ,UAAU,IAAI,SAAS;AAEvC,gBAAI,cAAc,QAAQ;AACrB,oBAAM,SAAS,MAAM,KAAK,SAAS,SAAS,EAAE,QAAQ,MAAM,CAAC;AAE7D,qBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,OAAO,SAAS,EAAE,OAAO,OAAO,MAAM,CAAC,EAAE;AAAA,YAC7F;AACA,gBAAI,cAAc,SAAS,MAAM,IAAI;AAChC,oBAAM,SAAS,MAAM,KAAK,SAAS,OAAO,EAAE,QAAQ,IAAI,MAAM,GAAG,CAAC;AAClE,qBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,YAC5D;AACC,gBAAI,cAAc,UAAU;AACxB,oBAAM,SAAS,MAAM,KAAK,SAAS,UAAU,EAAE,QAAQ,MAAM,KAAK,CAAC;AACnE,qBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,YAC5D;AAAA,UACJ;AAAA,QACJ;AAEA,YAAI,SAAS,SAAS,SAAS;AAC1B,iBAAO;AAAA,YACH,SAAS;AAAA,YACT,UAAU;AAAA,cACN,QAAQ;AAAA,cACR,MAAM,EAAE,OAAO,MAAM,QAAQ,SAAS,QAAQ,MAAM,+CAA+C;AAAA,YACvG;AAAA,UACJ;AAAA,QACL;AAAA,MACJ;AAAA,IACJ,SAAS,GAAG;AAAA,IAGZ;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AACJ;AAvwHa,gBAsBe,0BAA0B;AAAA;AAtBzC,gBAwBe,wBAAwB;AAAA;AAxBvC,gBA0Be,kBAAkB;AA1BvC,IAAM,iBAAN;;;AETA,SAAS,qBAAqB,OAA+B,CAAC,GAA2B;AAC9F,QAAM,IAA4B,CAAC;AAEnC,MAAI,KAAK,0BAA0B,OAAO;AACxC,MAAE,yBAAyB,IACzB,KAAK,yBAAyB;AAAA,EAClC;AAEA,MAAI,KAAK,MAAM;AACb,UAAM,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,CAAC;AACzD,UAAM,SAAS,IAAI,UAAU;AAC7B,UAAM,QAAQ,CAAC,WAAW,MAAM,EAAE;AAClC,QAAI,IAAI,qBAAqB,KAAM,OAAM,KAAK,mBAAmB;AACjE,QAAI,IAAI,QAAS,OAAM,KAAK,SAAS;AACrC,MAAE,2BAA2B,IAAI,MAAM,KAAK,IAAI;AAAA,EAClD;AAEA,IAAE,wBAAwB,IAAI;AAE9B,MAAI,KAAK,iBAAiB,OAAO;AAC/B,MAAE,iBAAiB,IAAI,KAAK,gBAAgB;AAAA,EAC9C;AAEA,MAAI,KAAK,mBAAmB,OAAO;AACjC,MAAE,iBAAiB,IAAI,KAAK,kBAAkB;AAAA,EAChD;AAEA,MAAI,KAAK,sBAAsB,OAAO;AACpC,MAAE,oBAAoB,IACpB,KAAK,qBAAqB;AAAA,EAC9B;AAEA,MAAI,KAAK,SAAS,OAAO;AACvB,MAAE,8BAA8B,IAAI,KAAK,QAAQ;AAAA,EACnD;AAEA,MAAI,KAAK,OAAO;AACd,WAAO,OAAO,GAAG,KAAK,KAAK;AAAA,EAC7B;AAEA,SAAO;AACT;;;AChEA,IAAM,cAAN,MAA4C;AAAA,EAI1C,YAAY,aAAa,KAAS;AAHlC,SAAQ,UAAU,oBAAI,IAAyB;AAI7C,SAAK,aAAa;AAAA,EACpB;AAAA,EAEA,IAAI,KAAsC;AACxC,WAAO,KAAK,QAAQ,IAAI,GAAG;AAAA,EAC7B;AAAA,EAEA,IAAI,KAAa,OAA0B;AAIzC,QAAI,KAAK,QAAQ,QAAQ,KAAK,YAAY;AACxC,YAAM,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,aAAa,EAAE,CAAC;AAC9D,YAAM,OAAO,KAAK,QAAQ,KAAK;AAC/B,eAAS,IAAI,GAAG,IAAI,WAAW,KAAK;AAClC,cAAM,IAAI,KAAK,KAAK,EAAE;AACtB,YAAI,CAAC,EAAG;AACR,aAAK,QAAQ,OAAO,CAAC;AAAA,MACvB;AAAA,IACF;AACA,SAAK,QAAQ,IAAI,KAAK,KAAK;AAAA,EAC7B;AAAA,EAEA,MAAM,aAA2B;AAC/B,UAAM,SAAS,KAAK,IAAI,IAAI;AAC5B,eAAW,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS;AACjC,UAAI,EAAE,aAAa,OAAQ,MAAK,QAAQ,OAAO,CAAC;AAAA,IAClD;AAAA,EACF;AACF;AAEO,IAAM,cAAN,MAAkB;AAAA,EAKvB,YAAY,QAA+B,OAAuD,CAAC,GAAG;AACpG,QAAI,OAAO,YAAY,EAAG,OAAM,IAAI,MAAM,mCAAmC;AAC7E,QAAI,OAAO,gBAAgB,EAAG,OAAM,IAAI,MAAM,uCAAuC;AACrF,SAAK,SAAS;AACd,SAAK,QAAQ,KAAK,SAAS,IAAI,YAAY;AAE3C,SAAK,MAAM,KAAK,OAAO,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAQ,KAAa,OAAO,KAAK,OAAO,eAAe,GAAsB;AAC3E,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK;AAExC,QAAI,QAAQ,KAAK,MAAM,IAAI,GAAG;AAC9B,QAAI,CAAC,OAAO;AACV,cAAQ,EAAE,QAAQ,UAAU,YAAY,IAAI;AAAA,IAC9C,OAAO;AACL,YAAM,cAAc,MAAM,MAAM,cAAc;AAC9C,UAAI,aAAa,GAAG;AAClB,gBAAQ;AAAA,UACN,QAAQ,KAAK,IAAI,UAAU,MAAM,SAAS,aAAa,YAAY;AAAA,UACnE,YAAY;AAAA,QACd;AAAA,MACF;AAAA,IACF;AAEA,QAAI,MAAM,UAAU,MAAM;AACxB,YAAM,UAAU;AAChB,WAAK,MAAM,IAAI,KAAK,KAAK;AACzB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAW,KAAK,MAAM,MAAM,MAAM;AAAA,QAClC,cAAc;AAAA,QACd,SAAS,MAAM,KAAK,MAAO,WAAW,MAAM,UAAU,eAAgB,GAAI;AAAA,MAC5E;AAAA,IACF;AAEA,UAAM,eAAe,OAAO,MAAM;AAClC,UAAM,eAAe,KAAK,KAAM,eAAe,eAAgB,GAAI;AACnE,SAAK,MAAM,IAAI,KAAK,KAAK;AACzB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW,KAAK,MAAM,MAAM,MAAM;AAAA,MAClC;AAAA,MACA,SAAS,MAAM;AAAA,IACjB;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,KAAmB;AACvB,SAAK,MAAM,IAAI,KAAK,EAAE,QAAQ,KAAK,OAAO,UAAU,YAAY,KAAK,IAAI,EAAE,CAAC;AAAA,EAC9E;AACF;AAuBO,IAAM,sBAAyC;AAAA,EACpD,MAAM,EAAE,UAAU,IAAI,cAAc,KAAK,GAAG;AAAA,EAC5C,OAAO,EAAE,UAAU,IAAI,cAAc,KAAK,GAAG;AAAA,EAC7C,MAAM,EAAE,UAAU,KAAK,cAAc,MAAM,GAAG;AAChD;;;ACxJA,IAAM,wBAAwB;AAO9B,IAAM,qBAAqB;AASpB,SAAS,iBAAiB,SAAsC;AACnE,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAkC,GAAG;AACrE,QAAI,EAAE,YAAY,MAAM,eAAgB;AACxC,UAAM,MAAM,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI;AACtC,QAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,UAAM,UAAU,IAAI,KAAK;AACzB,QAAI,CAAC,WAAW,QAAQ,SAAS,sBAAuB,QAAO;AAC/D,QAAI,CAAC,mBAAmB,KAAK,OAAO,EAAG,QAAO;AAC9C,WAAO;AAAA,EACX;AACA,SAAO;AACX;AAWO,SAAS,oBAA4B;AACxC,QAAM,IACD,WAAqE;AAC1E,MAAI,KAAK,OAAO,EAAE,eAAe,YAAY;AACzC,WAAO,OAAO,EAAE,WAAW,EAAE,QAAQ,MAAM,EAAE,CAAC;AAAA,EAClD;AACA,QAAM,IAAI,KAAK,IAAI,EAAE,SAAS,EAAE;AAChC,QAAM,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,EAAE;AAChD,SAAO,OAAO,CAAC,GAAG,CAAC;AACvB;AAKO,SAAS,iBACZ,SACA,WAAyB,mBACnB;AACN,SAAO,iBAAiB,OAAO,KAAK,SAAS;AACjD;AAWA,IAAM,sBAAsB;AAOrB,SAAS,iBAAiB,OAA0C;AACvE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,IAAI,oBAAoB,KAAK,MAAM,KAAK,EAAE,YAAY,CAAC;AAC7D,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,CAAC,EAAE,SAAS,SAAS,QAAQ,KAAK,IAAI;AAC5C,MAAI,YAAY,KAAM,QAAO;AAC7B,MAAI,OAAO,KAAK,OAAO,KAAK,OAAO,KAAK,MAAM,EAAG,QAAO;AACxD,QAAM,WAAW,SAAS,OAAO,EAAE,IAAI,OAAU;AACjD,SAAO,EAAE,SAAS,QAAQ,QAAQ;AACtC;AAMO,SAAS,kBAAkB,KAA2B;AACzD,QAAM,OAAO,IAAI,UAAU,OAAO;AAClC,SAAO,MAAM,IAAI,OAAO,IAAI,IAAI,MAAM,IAAI,IAAI;AAClD;;;ACzGA;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,OAGG;;;ACZP;AAAA,EACI;AAAA,EACA;AAAA,OAGG;;;ACwCA,SAAS,uBACZ,QACA,OACA,SACA,OAA0B,CAAC,GACU;AACrC,QAAM,UAAU,KAAK,WAAW,IAAI,oBAAoB;AACxD,QAAM,gBAAgB,KAAK,iBAAiB,IAAI,kBAAkB;AAClE,QAAMC,qBAAoB,KAAK;AAC/B,QAAM,kBAAkB,KAAK,mBAAmB;AAChD,QAAM,MAAM,KAAK,OAAO,KAAK;AAE7B,SAAO,OAAO,KAAU,QAAa;AACjC,UAAM,YAAY,iBAAiB,KAAK,SAASA,kBAAiB;AAClE,QAAI;AACA,MAAC,IAAY,YAAY;AAAA,IAC7B,QAAQ;AAAA,IAER;AACA,QAAI,OAAO,KAAK,WAAW,YAAY;AACnC,UAAI;AACA,YAAI,OAAO,iBAAiB,SAAS;AAAA,MACzC,QAAQ;AAAA,MAER;AAAA,IACJ;AAKA,QAAI,SAAS;AACb,UAAM,aACF,OAAO,KAAK,WAAW,aAAa,IAAI,OAAO,KAAK,GAAG,IAAI;AAC/D,QAAI,YAAY;AACZ,UAAI,SAAS,CAAC,SAAiB;AAC3B,iBAAS;AACT,eAAO,WAAW,IAAI;AAAA,MAC1B;AAAA,IACJ;AAEA,UAAM,YAAY,IAAI;AACtB,QAAI,QAAQ;AACZ,QAAI;AACA,YAAM,QAAQ,KAAK,GAAG;AAAA,IAC1B,SAAS,KAAU;AACf,cAAQ;AACR,eAAS,KAAK,cAAc;AAC5B,cAAQ,QAAQ,gBAAgB,wBAAwB,EAAE,QAAQ,MAAM,CAAC;AACzE,UAAI,UAAU,KAAK;AACf,mBAAW,eAAe,KAAK,EAAE,WAAW,QAAQ,MAAM,CAAC;AAAA,MAC/D;AACA,YAAM;AAAA,IACV,UAAE;AACE,YAAM,UAAU,IAAI,IAAI;AACxB,cAAQ,QAAQ,gBAAgB,mBAAmB;AAAA,QAC/C;AAAA,QACA;AAAA,QACA,QAAQ,OAAO,MAAM;AAAA,MACzB,CAAC;AACD,cAAQ;AAAA,QACJ,gBAAgB;AAAA,QAChB;AAAA,QACA,EAAE,QAAQ,MAAM;AAAA,MACpB;AAKA,UAAI,CAAC,SAAS,UAAU,KAAK;AACzB,cAAM,WAAY,KAAa;AAC/B,YAAI,aAAa,QAAW;AACxB,qBAAW,eAAe,UAAU,EAAE,WAAW,QAAQ,MAAM,CAAC;AAAA,QACpE;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AACJ;AAEA,SAAS,WACL,UACA,KACA,KACI;AACJ,MAAI;AACA,aAAS,iBAAiB,KAAK,GAAG;AAAA,EACtC,QAAQ;AAAA,EAER;AACJ;;;ACxIA;AAAA,EACI;AAAA,EACA;AAAA,OACG;AAgEA,IAAM,6BAAN,MAAmD;AAAA,EAOtD,YAAY,UAA6C,CAAC,GAAG;AAN7D,gBAAO;AACP,mBAAU;AACV,gBAAO;AAKH,SAAK,UAAU;AAAA,EACnB;AAAA,EAEA,MAAM,KAAK,KAAmC;AAC1C,UAAM,UAAU,KAAK,QAAQ,WAAW,IAAI,oBAAoB;AAChE,UAAM,SAAS,KAAK,QAAQ,UAAU,IAAI,kBAAkB;AAC5D,QAAI,gBAAgB,+BAA+B,OAAO;AAC1D,QAAI,gBAAgB,8BAA8B,MAAM;AACxD,QAAI,OAAO;AAAA,MACP,kDAAmD,QAAgB,aAAa,QAAQ,SAAS,WAAY,OAAe,aAAa,QAAQ,SAAS;AAAA,IAC9J;AAAA,EACJ;AACJ;AAUO,SAAS,eACZ,KACA,UACe;AACf,MAAI,SAAU,QAAO;AACrB,MAAI;AACA,UAAM,IAAI,IAAI,WAAwC,6BAA6B;AACnF,QAAI,EAAG,QAAO;AAAA,EAClB,QAAQ;AAAA,EAER;AACA,SAAO,IAAI,oBAAoB;AACnC;AAKO,SAAS,qBACZ,KACA,UACa;AACb,MAAI,SAAU,QAAO;AACrB,MAAI;AACA,UAAM,IAAI,IAAI,WAAsC,4BAA4B;AAChF,QAAI,EAAG,QAAO;AAAA,EAClB,QAAQ;AAAA,EAER;AACA,SAAO,IAAI,kBAAkB;AACjC;;;ACrBA,SAAS,mBACL,OACA,QACA,WACA,iBACO;AACP,QAAM,UAAU,OAAO,KAAU,QAAa;AAC1C,QAAI;AACA,YAAM,SAAS,MAAM,MAAM,QAAQ;AAAA,QAC/B,MAAM,IAAI;AAAA,QACV,QAAQ,IAAI;AAAA,QACZ,OAAO,IAAI;AAAA,MACf,CAAC;AAED,UAAI,OAAO,UAAU,OAAO,QAAQ;AAEhC,YAAI,OAAO,OAAO,MAAM;AAExB,YAAI,iBAAiB;AACjB,qBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AAClD,gBAAI,OAAO,GAAG,CAAC;AAAA,UACnB;AAAA,QACJ;AAGA,YAAI,OAAO,SAAS;AAChB,qBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AACjD,gBAAI,OAAO,GAAG,OAAO,CAAC,CAAC;AAAA,UAC3B;AAAA,QACJ,OAAO;AACH,cAAI,OAAO,gBAAgB,mBAAmB;AAC9C,cAAI,OAAO,iBAAiB,UAAU;AACtC,cAAI,OAAO,cAAc,YAAY;AAAA,QACzC;AAGA,YAAI,OAAO,IAAI,UAAU,cAAc,OAAO,IAAI,QAAQ,YAAY;AAClE,2BAAiB,SAAS,OAAO,QAAQ;AACrC,gBAAI,MAAM,OAAO,UAAU,WAAW,QAAQ,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA;AAAA,CAAM;AAAA,UACtF;AACA,cAAI,IAAI;AAAA,QACZ,OAAO;AAEH,gBAAM,SAAS,CAAC;AAChB,2BAAiB,SAAS,OAAO,QAAQ;AACrC,mBAAO,KAAK,KAAK;AAAA,UACrB;AACA,cAAI,KAAK,EAAE,OAAO,CAAC;AAAA,QACvB;AAAA,MACJ,OAAO;AACH,YAAI,OAAO,OAAO,MAAM;AACxB,YAAI,iBAAiB;AACjB,qBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AAClD,gBAAI,OAAO,GAAG,CAAC;AAAA,UACnB;AAAA,QACJ;AACA,YAAI,OAAO,SAAS,QAAW;AAC3B,cAAI,KAAK,OAAO,IAAI;AAAA,QACxB,OAAO;AACH,cAAI,IAAI;AAAA,QACZ;AAAA,MACJ;AAAA,IACJ,SAAS,KAAU;AACf,wBAAkB,KAAK,KAAK,eAAe;AAAA,IAC/C;AAAA,EACJ;AAEA,QAAM,IAAI,MAAM,OAAO,YAAY;AACnC,MAAI,MAAM,SAAS,OAAO,OAAO,QAAQ,YAAY;AACjD,WAAO,IAAI,WAAW,OAAO;AAC7B,WAAO;AAAA,EACX,WAAW,MAAM,UAAU,OAAO,OAAO,SAAS,YAAY;AAC1D,WAAO,KAAK,WAAW,OAAO;AAC9B,WAAO;AAAA,EACX,WAAW,MAAM,YAAY,OAAO,OAAO,WAAW,YAAY;AAC9D,WAAO,OAAO,WAAW,OAAO;AAChC,WAAO;AAAA,EACX;AACA,SAAO;AACX;AAUA,SAAS,eACL,QACA,KACA,iBACI;AACJ,QAAM,uBAAuB,MAAM;AAC/B,QAAI,CAAC,gBAAiB;AACtB,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AAKlD,UAAI,OAAO,GAAG,CAAC;AAAA,IACnB;AAAA,EACJ;AAEA,MAAI,OAAO,SAAS;AAChB,QAAI,OAAO,UAAU;AACjB,UAAI,OAAO,OAAO,SAAS,MAAM;AACjC,2BAAqB;AACrB,UAAI,OAAO,SAAS,SAAS;AACzB,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,SAAS,OAAO,GAAG;AAC1D,cAAI,OAAO,GAAG,CAAC;AAAA,QACnB;AAAA,MACJ;AACA,UAAI,KAAK,OAAO,SAAS,IAAI;AAC7B;AAAA,IACJ;AACA,QAAI,OAAO,QAAQ;AAEf,UAAI,OAAO,GAAG;AACd,2BAAqB;AACrB,UAAI,KAAK,OAAO,MAAM;AACtB;AAAA,IACJ;AAAA,EACJ;AAEA,MAAI,OAAO,GAAG;AACd,uBAAqB;AACrB,MAAI,KAAK;AAAA,IACL,SAAS;AAAA,IACT,OAAO;AAAA,MACH,SAAS;AAAA,MACT,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACV;AAAA,EACJ,CAAC;AACL;AAEA,SAAS,kBAAkB,KAAU,KAAU,iBAAgD;AAC3F,QAAM,OAAO,IAAI,cAAc;AAC/B,MAAI,OAAO,IAAI;AACf,MAAI,iBAAiB;AACjB,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AAClD,UAAI,OAAO,GAAG,CAAC;AAAA,IACnB;AAAA,EACJ;AAKA,MAAI,QAAQ,KAAK;AACb,QAAI;AACA,MAAC,IAAY,qBAAqB;AAAA,IACtC,QAAQ;AAAA,IAER;AAAA,EACJ;AACA,MAAI,KAAK;AAAA,IACL,SAAS;AAAA,IACT,OAAO,EAAE,SAAS,IAAI,WAAW,yBAAyB,KAAK;AAAA,EACnE,CAAC;AACL;AAsBO,SAAS,uBAAuB,SAAiC,CAAC,GAAW;AAChF,SAAO;AAAA,IACH,MAAM;AAAA,IACN,SAAS;AAAA,IAET,MAAM,OAAO,SAAwB;AAAA,IAErC;AAAA,IAEA,OAAO,OAAO,QAAuB;AACjC,UAAI;AACJ,UAAI;AACA,iBAAS,IAAI,WAAwB,aAAa;AAAA,MACtD,QAAQ;AAEJ;AAAA,MACJ;AACA,UAAI,CAAC,OAAQ;AAEb,YAAM,SAAS,IAAI,UAAU;AAG7B,YAAM,oBACF,OAAO,6BAA6B,OAAO,SAAS,wBAAwB;AAChF,YAAM,aAAa,IAAI,eAAe,QAAQ,QAAW;AAAA,QACrD,0BAA0B;AAAA,MAC9B,CAAC;AACD,YAAM,SAAS,OAAO,UAAU;AAOhC,YAAM,kBACF,OAAO,oBAAoB,QACrB,SACA;AAAA,QACI,OAAO,OAAO,oBAAoB,WAC5B,OAAO,kBACP,CAAC;AAAA,MACX;AAMV,YAAM,aAAa,CAAC,QAA8B,QAC9C,eAAe,QAAQ,KAAK,eAAe;AAC/C,YAAM,gBAAgB,CAAC,KAAU,QAC7B,kBAAkB,KAAK,KAAK,eAAe;AAI/C,YAAM,UACF,OAAO,eAAe,WAAW,IAAI,oBAAoB;AAC7D,YAAM,gBACF,OAAO,eAAe,iBAAiB,IAAI,kBAAkB;AACjE,YAAMC,qBAAoB,OAAO,eAAe;AAChD,YAAM,kBACF,OAAO,eAAe,mBAAmB;AAQ7C,YAAM,YAAY;AAClB,eAAS,IAAI,MAAM,WAAW;AAAA,QAC1B,IAAI,QAAQ,MAAM,UAAU;AACxB,cAAI,SAAS,SAAS,SAAS,UAAU,SAAS,UAAU;AACxD,kBAAM,SAAS,OAAO,IAAI,EAAE,YAAY;AACxC,kBAAM,WAAY,OAAe,IAAI;AACrC,gBAAI,OAAO,aAAa,WAAY,QAAO;AAC3C,mBAAO,CAAC,OAAe,YAAiB;AACpC,qBAAO,SAAS;AAAA,gBACZ;AAAA,gBACA;AAAA,gBACA,uBAAuB,QAAQ,OAAO,SAAS;AAAA,kBAC3C;AAAA,kBACA;AAAA,kBACA,mBAAAA;AAAA,kBACA;AAAA,gBACJ,CAAC;AAAA,cACL;AAAA,YACJ;AAAA,UACJ;AACA,iBAAO,QAAQ,IAAI,QAAQ,MAAM,QAAQ;AAAA,QAC7C;AAAA,MACJ,CAAC;AAGD,aAAO,IAAI,4BAA4B,OAAO,MAAW,QAAa;AAClE,YAAI,iBAAiB;AACjB,qBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AAClD,gBAAI,OAAO,GAAG,CAAC;AAAA,UACnB;AAAA,QACJ;AACA,YAAI,KAAK,EAAE,MAAM,MAAM,WAAW,iBAAiB,MAAM,EAAE,CAAC;AAAA,MAChE,CAAC;AAGD,aAAO,IAAI,GAAG,MAAM,cAAc,OAAO,MAAW,QAAa;AAC7D,YAAI,iBAAiB;AACjB,qBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AAClD,gBAAI,OAAO,GAAG,CAAC;AAAA,UACnB;AAAA,QACJ;AACA,YAAI,KAAK,EAAE,MAAM,MAAM,WAAW,iBAAiB,MAAM,EAAE,CAAC;AAAA,MAChE,CAAC;AAGD,aAAO,IAAI,GAAG,MAAM,WAAW,OAAO,MAAW,QAAa;AAC1D,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,WAAW,QAAW,CAAC,GAAG,EAAE,SAAS,KAAK,CAAC;AAC3F,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAaD,aAAO,KAAK,GAAG,MAAM,eAAe,OAAO,KAAU,QAAa;AAC9D,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,WAAW,SAAS,QAAQ,IAAI,MAAM,EAAE,SAAS,IAAI,CAAC;AACtF,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAGD,aAAO,KAAK,GAAG,MAAM,YAAY,OAAO,KAAU,QAAa;AAC3D,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,cAAc,IAAI,MAAM,EAAE,SAAS,IAAI,CAAC;AACxE,cAAI,iBAAiB;AACjB,uBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AAClD,kBAAI,OAAO,GAAG,CAAC;AAAA,YACnB;AAAA,UACJ;AACA,cAAI,KAAK,MAAM;AAAA,QACnB,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAMD,aAAO,KAAK,GAAG,MAAM,oBAAoB,OAAO,KAAU,QAAa;AACnE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,oBAAoB,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC1G,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,mBAAmB,OAAO,KAAU,QAAa;AACjE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,mBAAmB,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACzG,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,kBAAkB,OAAO,KAAU,QAAa;AACjE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,kBAAkB,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACxG,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAGD,aAAO,IAAI,GAAG,MAAM,aAAa,OAAO,KAAU,QAAa;AAC3D,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,eAAe,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACzF,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,aAAa,OAAO,KAAU,QAAa;AAC5D,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,eAAe,IAAI,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACzF,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,iBAAiB,OAAO,KAAU,QAAa;AAC/D,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,eAAe,IAAI,IAAI,OAAO,EAAE,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC1G,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,OAAO,GAAG,MAAM,iBAAiB,OAAO,KAAU,QAAa;AAClE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,eAAe,IAAI,IAAI,OAAO,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACtG,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,MAAM,GAAG,MAAM,wBAAwB,OAAO,KAAU,QAAa;AACxE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,eAAe,IAAI,IAAI,OAAO,EAAE,WAAW,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AAC5G,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,MAAM,GAAG,MAAM,yBAAyB,OAAO,KAAU,QAAa;AACzE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,eAAe,IAAI,IAAI,OAAO,EAAE,YAAY,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AAC7G,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,yBAAyB,OAAO,KAAU,QAAa;AACxE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,eAAe,IAAI,IAAI,OAAO,EAAE,YAAY,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AAClH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,wBAAwB,OAAO,KAAU,QAAa;AACvE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,eAAe,IAAI,IAAI,OAAO,EAAE,WAAW,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACjH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAGD,aAAO,IAAI,GAAG,MAAM,kBAAkB,OAAO,KAAU,QAAa;AAChE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,YAAY,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC9F,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAMD,aAAO,KAAK,GAAG,MAAM,sCAAsC,OAAO,KAAU,QAAa;AACrF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,gCAAgC,QAAQ,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACzH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,oBAAoB,OAAO,KAAU,QAAa;AAClE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,cAAc,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAChG,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,uBAAuB,OAAO,KAAU,QAAa;AACrE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC/F,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,uBAAuB,OAAO,KAAU,QAAa;AACtE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AAC/F,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,2BAA2B,OAAO,KAAU,QAAa;AACzE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAChH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,MAAM,GAAG,MAAM,2BAA2B,OAAO,KAAU,QAAa;AAC3E,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,IAAI,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACjH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,OAAO,GAAG,MAAM,2BAA2B,OAAO,KAAU,QAAa;AAC5E,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,IAAI,UAAU,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACnH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,OAAO,GAAG,MAAM,4BAA4B,OAAO,KAAU,QAAa;AAC7E,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,kBAAkB,IAAI,OAAO,EAAE,IAAI,UAAU,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACxH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,oCAAoC,OAAO,KAAU,QAAa;AACnF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACzH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,oCAAoC,OAAO,KAAU,QAAa;AAClF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,OAAO,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACxH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,6CAA6C,OAAO,KAAU,QAAa;AAC5F,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,sBAAsB,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AAClI,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAGD,aAAO,KAAK,GAAG,MAAM,8CAA8C,OAAO,KAAU,QAAa;AAC7F,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,uBAAuB,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACnI,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,oCAAoC,OAAO,KAAU,QAAa;AACnF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACzH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,iCAAiC,OAAO,KAAU,QAAa;AAChF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,UAAU,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACtH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,mCAAmC,OAAO,KAAU,QAAa;AACjF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,YAAY,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACxH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,mCAAmC,OAAO,KAAU,QAAa;AAClF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,YAAY,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACxH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,MAAM,GAAG,MAAM,6CAA6C,OAAO,KAAU,QAAa;AAC7F,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,YAAY,IAAI,OAAO,QAAQ,IAAI,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AAChJ,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,OAAO,GAAG,MAAM,6CAA6C,OAAO,KAAU,QAAa;AAC9F,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,YAAY,IAAI,OAAO,QAAQ,IAAI,UAAU,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACvJ,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAGD,aAAO,IAAI,GAAG,MAAM,oCAAoC,OAAO,KAAU,QAAa;AAClF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACzH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,oCAAoC,OAAO,KAAU,QAAa;AACnF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACzH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,2CAA2C,OAAO,KAAU,QAAa;AACzF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,IAAI,OAAO,KAAK,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC7I,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,OAAO,GAAG,MAAM,2CAA2C,OAAO,KAAU,QAAa;AAC5F,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,IAAI,OAAO,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACzI,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,MAAM,GAAG,MAAM,kDAAkD,OAAO,KAAU,QAAa;AAClG,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,IAAI,OAAO,KAAK,WAAW,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AAC/I,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,MAAM,GAAG,MAAM,mDAAmD,OAAO,KAAU,QAAa;AACnG,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,IAAI,OAAO,KAAK,YAAY,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AAChJ,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,mDAAmD,OAAO,KAAU,QAAa;AAClG,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,IAAI,OAAO,KAAK,YAAY,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACrJ,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAGD,aAAO,KAAK,GAAG,MAAM,mBAAmB,OAAO,KAAU,QAAa;AAClE,YAAI;AAEA,gBAAM,SAAS,MAAM,WAAW,cAAc,UAAU,QAAQ,IAAI,MAAM,EAAE,SAAS,IAAI,CAAC;AAC1F,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,qBAAqB,OAAO,KAAU,QAAa;AACnE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,cAAc,QAAQ,IAAI,OAAO,EAAE,IAAI,OAAO,QAAW,EAAE,SAAS,IAAI,CAAC;AACzG,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AASD,aAAO,IAAI,GAAG,MAAM,iBAAiB,OAAO,KAAU,QAAa;AAC/D,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,iBAAiB,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACvG,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,8BAA8B,OAAO,KAAU,QAAa;AAC5E,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,sBAAsB,IAAI,OAAO,MAAM,IAAI,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACjI,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,gCAAgC,OAAO,KAAU,QAAa;AAC9E,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,gBAAgB,IAAI,OAAO,MAAM,IAAI,IAAI,OAAO,MAAM,IAAI,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAChJ,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAUD,YAAM,2BAA2B,CAAC,SAAiB;AAC/C,eAAQ,IAAI,GAAG,IAAI,eAAe,OAAO,KAAU,QAAa;AAC5D,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,eAAe,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACrG,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,KAAK,GAAG,IAAI,eAAe,OAAO,KAAU,QAAa;AAC7D,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,eAAe,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACrG,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,IAAI,GAAG,IAAI,qBAAqB,OAAO,KAAU,QAAa;AAClE,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,eAAe,IAAI,OAAO,IAAI,IAAI,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACxH,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,IAAI,GAAG,IAAI,qBAAqB,OAAO,KAAU,QAAa;AAClE,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,eAAe,IAAI,OAAO,IAAI,IAAI,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACvH,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,OAAO,GAAG,IAAI,qBAAqB,OAAO,KAAU,QAAa;AACrE,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,UAAU,eAAe,IAAI,OAAO,IAAI,IAAI,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC3H,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,KAAK,GAAG,IAAI,6BAA6B,OAAO,KAAU,QAAa;AAC3E,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,uBAAuB,IAAI,OAAO,IAAI,IAAI,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAChI,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,KAAK,GAAG,IAAI,6BAA6B,OAAO,KAAU,QAAa;AAC3E,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,eAAe,IAAI,OAAO,IAAI,YAAY,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAChI,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,KAAK,GAAG,IAAI,4BAA4B,OAAO,KAAU,QAAa;AAC1E,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,eAAe,IAAI,OAAO,IAAI,WAAW,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC/H,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,IAAI,GAAG,IAAI,0BAA0B,OAAO,KAAU,QAAa;AACvE,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,eAAe,IAAI,OAAO,IAAI,SAAS,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC7H,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,IAAI,GAAG,IAAI,iCAAiC,OAAO,KAAU,QAAa;AAC9E,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,eAAe,IAAI,OAAO,IAAI,SAAS,IAAI,OAAO,KAAK,IAAI,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACjJ,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAAA,MACL;AAYA,YAAM,mBAAmB,CAAC,SAAiB;AACvC,cAAM,YAA0D;AAAA,UAC5D,CAAC,OAAO,GAAG,IAAI,OAAO;AAAA,UACtB,CAAC,QAAQ,GAAG,IAAI,OAAO;AAAA,UACvB,CAAC,UAAU,GAAG,IAAI,OAAO;AAAA,UACzB,CAAC,OAAO,GAAG,IAAI,OAAO;AAAA,QAC1B;AACA,mBAAW,CAAC,QAAQ,OAAO,KAAK,WAAW;AACvC,UAAC,OAAgB,MAAM,EAAE,SAAS,OAAO,KAAU,QAAa;AAC5D,gBAAI;AAGA,oBAAM,WAAmB,IAAI,QAAQ;AACrC,oBAAM,MAAM,SAAS,YAAY,KAAK;AACtC,oBAAM,YAAY,OAAO,IAAI,SAAS,MAAM,GAAG,IAAI;AACnD,oBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,YAAY,GAAG,WAAW,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC/G,yBAAW,QAAQ,GAAG;AAAA,YAC1B,SAAS,KAAU;AACf,4BAAc,KAAK,GAAG;AAAA,YAC1B;AAAA,UACJ,CAAC;AAAA,QACL;AAAA,MACJ;AAKA,YAAM,uBAAuB,CAAC,SAAiB;AAC3C,eAAQ,KAAK,GAAG,IAAI,4BAA4B,OAAO,KAAU,QAAa;AAC1E,cAAI;AACA,kBAAMC,OAAW,EAAE,SAAS,IAAI;AAChC,gBAAI,IAAI,QAAQ,cAAe,CAAAA,KAAI,gBAAgB,IAAI,OAAO;AAC9D,kBAAM,SAAS,MAAM,WAAW,cAAc,IAAI,IAAI,OAAO,MAAM,IAAI,IAAI,OAAO,MAAM,IAAI,QAAQ,IAAI,MAAMA,IAAG;AACjH,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AACD,eAAQ,KAAK,GAAG,IAAI,sCAAsC,OAAO,KAAU,QAAa;AACpF,cAAI;AACA,kBAAMA,OAAW,EAAE,SAAS,IAAI;AAChC,gBAAI,IAAI,QAAQ,cAAe,CAAAA,KAAI,gBAAgB,IAAI,OAAO;AAC9D,kBAAM,SAAS,MAAM,WAAW,cAAc,IAAI,IAAI,OAAO,MAAM,IAAI,IAAI,OAAO,MAAM,IAAI,IAAI,OAAO,QAAQ,IAAI,QAAQ,IAAI,MAAMA,IAAG;AACxI,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAAA,MACL;AAEA,YAAM,uBAAuB,OAAO,SAAS,wBAAwB;AACrE,YAAM,oBAAoB,OAAO,SAAS,qBAAqB;AAE/D,UAAI,wBAAwB,sBAAsB,YAAY;AAC1D,iCAAyB,GAAG,MAAM,8BAA8B;AAChE,6BAAqB,GAAG,MAAM,8BAA8B;AAC5D,yBAAiB,GAAG,MAAM,8BAA8B;AAAA,MAC5D,OAAO;AACH,iCAAyB,MAAM;AAC/B,6BAAqB,MAAM;AAC3B,yBAAiB,MAAM;AACvB,YAAI,sBAAsB;AACtB,mCAAyB,GAAG,MAAM,8BAA8B;AAChE,+BAAqB,GAAG,MAAM,8BAA8B;AAC5D,2BAAiB,GAAG,MAAM,8BAA8B;AAAA,QAC5D;AAAA,MACJ;AAEA,UAAI,OAAO,KAAK,uCAAuC,EAAE,QAAQ,sBAAsB,kBAAkB,CAAC;AAS1G,YAAM,eAAe,CAAC,cAA8B;AAGhD,YAAI,UAAU,WAAW,MAAM,GAAG;AAC9B,gBAAM,OAAO,UAAU,MAAM,OAAO,MAAM;AAC1C,iBAAO,GAAG,MAAM,+BAA+B,IAAI;AAAA,QACvD;AACA,eAAO,+BAA+B,SAAS;AAAA,MACnD;AAEA,YAAM,eAAe,CAAC,UAA2B;AAC7C,YAAI,CAAC,OAAQ,QAAO;AACpB,cAAM,YAAY,MAAM,KAAK,WAAW,SAAS,IAC3C,MAAM,OACN,GAAG,MAAM,GAAG,MAAM,IAAI;AAE5B,YAAI,QAAQ;AACZ,YAAI,wBAAwB,sBAAsB,YAAY;AAC1D,cAAI,mBAAmB,OAAO,QAAQ,aAAa,SAAS,GAAG,eAAe,EAAG;AAAA,QACrF,OAAO;AACH,cAAI,mBAAmB,OAAO,QAAQ,WAAW,eAAe,EAAG;AACnE,cAAI,sBAAsB;AACtB,gBAAI,mBAAmB,OAAO,QAAQ,aAAa,SAAS,GAAG,eAAe,EAAG;AAAA,UACrF;AAAA,QACJ;AACA,eAAO;AAAA,MACX;AAEA,UAAI,KAAK,aAAa,OAAO,WAA8B;AACvD,YAAI,CAAC,OAAQ;AACb,YAAI,QAAQ;AACZ,mBAAW,SAAS,QAAQ;AACxB,mBAAS,aAAa,KAAK;AAAA,QAC/B;AACA,YAAI,OAAO,KAAK,2BAA2B,KAAK,2BAA2B,OAAO,MAAM,gBAAgB;AAAA,MAC5G,CAAC;AASD,YAAM,eAAgB,OAAe;AACrC,UAAI,gBAAgB,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,GAAG;AACxE,YAAI,aAAa;AACjB,mBAAW,SAAS,cAAc;AAC9B,wBAAc,aAAa,KAAK;AAAA,QACpC;AACA,YAAI,aAAa,GAAG;AAChB,cAAI,OAAO,KAAK,0BAA0B,UAAU,kDAAkD;AAAA,QAC1G;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AACJ;;;AC3jCO,IAAM,wBAAwB;AAgD9B,SAAS,8BAA8B,SAAwC,CAAC,GAAW;AAChG,QAAM,cAAc,OAAO,eAAe;AAE1C,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IAET,MAAM,OAAO,SAAwB;AAAA,IAErC;AAAA,IAEA,OAAO,OAAO,QAAuB;AACnC,UAAI;AACJ,UAAI;AACF,kBAAU,IAAI,WAA6B,WAAW;AAAA,MACxD,QAAQ;AAEN,kBAAU;AAAA,MACZ;AAEA,UAAI,CAAC,WAAW,OAAO,QAAQ,+BAA+B,YAAY;AACxE,YAAI,OAAO,QAAQ;AACjB,gBAAM,IAAI;AAAA,YACR,mDAAmD,WAAW;AAAA,UAChE;AAAA,QACF;AACA,YAAI,OAAO;AAAA,UACT,mDAAmD,WAAW;AAAA,QAChE;AACA;AAAA,MACF;AAEA,UAAI;AACF,cAAM,SAAS,MAAM,QAAQ,2BAA2B;AACxD,cAAM,WAAW,OAAO,YAAY,CAAC;AACrC,YAAI,OAAO,KAAK,kDAAkD;AAAA,UAChE,eAAe,OAAO,QAAQ;AAAA,UAC9B,UAAU,OAAO,QAAQ;AAAA,UACzB;AAAA,QACF,CAAC;AAAA,MACH,SAAS,KAAU;AACjB,YAAI,OAAO,OAAQ,OAAM;AACzB,YAAI,OAAO,KAAK,gEAAgE;AAAA,UAC9E,OAAO,KAAK,WAAW,OAAO,GAAG;AAAA,QACnC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;;;ACpFO,IAAM,aAAN,MAAwC;AAAA;AAAA;AAAA;AAAA;AAAA,EAS3C,YAAY,QAAqB;AAC7B,SAAK,SAAS;AACd,SAAK,SAAS,oBAAI,IAAI;AACtB,SAAK,cAAc,CAAC;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,MAAc,SAA6B;AAC3C,UAAM,MAAM,OAAO,IAAI;AACvB,SAAK,OAAO,IAAI,KAAK,OAAO;AAC5B,SAAK,OAAO,IAAI,MAAM,OAAO;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAK,MAAc,SAA6B;AAC5C,UAAM,MAAM,QAAQ,IAAI;AACxB,SAAK,OAAO,IAAI,KAAK,OAAO;AAC5B,SAAK,OAAO,KAAK,MAAM,OAAO;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,MAAc,SAA6B;AAC3C,UAAM,MAAM,OAAO,IAAI;AACvB,SAAK,OAAO,IAAI,KAAK,OAAO;AAC5B,SAAK,OAAO,IAAI,MAAM,OAAO;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,MAAc,SAA6B;AAC9C,UAAM,MAAM,UAAU,IAAI;AAC1B,SAAK,OAAO,IAAI,KAAK,OAAO;AAC5B,SAAK,OAAO,OAAO,MAAM,OAAO;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,MAAc,SAA6B;AAC7C,UAAM,MAAM,SAAS,IAAI;AACzB,SAAK,OAAO,IAAI,KAAK,OAAO;AAC5B,SAAK,OAAO,MAAM,MAAM,OAAO;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,MAA2B,SAA4B;AACvD,QAAI,OAAO,SAAS,YAAY;AAE5B,WAAK,YAAY,KAAK,IAAI;AAC1B,WAAK,OAAO,IAAI,IAAI;AAAA,IACxB,WAAW,SAAS;AAEhB,WAAK,YAAY,KAAK,OAAO;AAC7B,WAAK,OAAO,IAAI,MAAM,OAAO;AAAA,IACjC;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,MAA6B;AACtC,UAAM,KAAK,OAAO,OAAO,IAAI;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAuB;AACzB,QAAI,KAAK,OAAO,OAAO;AACnB,YAAM,KAAK,OAAO,MAAM;AAAA,IAC5B;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAuC;AACnC,WAAO,IAAI,IAAI,KAAK,MAAM;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAA+B;AAC3B,WAAO,CAAC,GAAG,KAAK,WAAW;AAAA,EAC/B;AACJ;;;AC/FO,IAAM,oBAAN,MAAwB;AAAA,EAG3B,cAAc;AACV,SAAK,cAAc,oBAAI,IAAI;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAS,QAA0B,YAA8B;AAC7D,UAAM,QAAyB;AAAA,MAC3B,MAAM,OAAO;AAAA,MACb,MAAM,OAAO;AAAA,MACb;AAAA,MACA,OAAO,OAAO,SAAS;AAAA,MACvB,SAAS,OAAO,WAAW;AAAA,MAC3B,OAAO,OAAO;AAAA,IAClB;AAEA,SAAK,YAAY,IAAI,OAAO,MAAM,KAAK;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAW,MAAoB;AAC3B,SAAK,YAAY,OAAO,IAAI;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,MAAoB;AACvB,UAAM,QAAQ,KAAK,YAAY,IAAI,IAAI;AACvC,QAAI,OAAO;AACP,YAAM,UAAU;AAAA,IACpB;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAQ,MAAoB;AACxB,UAAM,QAAQ,KAAK,YAAY,IAAI,IAAI;AACvC,QAAI,OAAO;AACP,YAAM,UAAU;AAAA,IACpB;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,MAA2C;AAC3C,WAAO,KAAK,YAAY,IAAI,IAAI;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,SAA4B;AACxB,WAAO,MAAM,KAAK,KAAK,YAAY,OAAO,CAAC;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,UAAU,MAAyC;AAC/C,WAAO,KAAK,OAAO,EAAE,OAAO,WAAS,MAAM,SAAS,IAAI;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,qBAAmC;AAC/B,WAAO,KAAK,OAAO,EACd,OAAO,WAAS,MAAM,OAAO,EAC7B,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,IAAI,WAAS,MAAM,UAAU;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,0BAA0B,MAA4B;AAClD,WAAO,KAAK,OAAO,EACd,OAAO,WAAS;AACb,UAAI,CAAC,MAAM,QAAS,QAAO;AAG3B,UAAI,MAAM,OAAO;AAEb,YAAI,MAAM,MAAM,SAAS;AACrB,gBAAM,WAAW,MAAM,MAAM,QAAQ;AAAA,YAAK,aACtC,KAAK,UAAU,MAAM,OAAO;AAAA,UAChC;AACA,cAAI,SAAU,QAAO;AAAA,QACzB;AAGA,YAAI,MAAM,MAAM,SAAS;AACrB,gBAAM,WAAW,MAAM,MAAM,QAAQ;AAAA,YAAK,aACtC,KAAK,UAAU,MAAM,OAAO;AAAA,UAChC;AACA,cAAI,CAAC,SAAU,QAAO;AAAA,QAC1B;AAAA,MACJ;AAEA,aAAO;AAAA,IACX,CAAC,EACA,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,IAAI,WAAS,MAAM,UAAU;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,UAAU,MAAc,SAA0B;AAEtD,UAAM,eAAe,QAChB,QAAQ,OAAO,IAAI,EACnB,QAAQ,OAAO,GAAG;AAEvB,UAAM,QAAQ,IAAI,OAAO,IAAI,YAAY,GAAG;AAC5C,WAAO,MAAM,KAAK,IAAI;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,QAAc;AACV,SAAK,YAAY,MAAM;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAKA,QAAgB;AACZ,WAAO,KAAK,YAAY;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,4BAAwC;AACpC,UAAM,QAAQ,KAAK,mBAAmB;AAEtC,WAAO,OAAO,KAAmB,KAAoB,SAAqC;AACtF,UAAI,QAAQ;AAEZ,YAAM,cAAc,YAA2B;AAC3C,YAAI,SAAS,MAAM,QAAQ;AACvB,gBAAM,KAAK;AACX;AAAA,QACJ;AAEA,cAAM,aAAa,MAAM,OAAO;AAChC,cAAM,WAAW,KAAK,KAAK,WAAW;AAAA,MAC1C;AAEA,YAAM,YAAY;AAAA,IACtB;AAAA,EACJ;AACJ;;;AhB9IA;;;AiBjCO,IAAM,gBAAN,MAAoB;AAAA,EAQzB,YAAY,QAA6B;AAHzC,SAAiB,QAAQ,oBAAI,IAAyB;AACtD,SAAiB,UAAU,oBAAI,IAAmC;AAGhE,SAAK,UAAU,OAAO;AACtB,SAAK,UAAU,OAAO,WAAW;AACjC,SAAK,QAAQ,OAAO,SAAS,KAAK,KAAK;AACvC,SAAK,SAAS,OAAO,UAAU;AAAA,EACjC;AAAA;AAAA,EAGA,OAAiB;AACf,WAAO,MAAM,KAAK,KAAK,MAAM,KAAK,CAAC;AAAA,EACrC;AAAA;AAAA,EAGA,IAAI,OAAe;AACjB,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,YAAY,eAA8C;AAC9D,UAAM,WAAW,KAAK,MAAM,IAAI,aAAa;AAC7C,QAAI,UAAU;AACZ,UAAI,KAAK,QAAQ,KAAK,KAAK,IAAI,IAAI,SAAS,aAAa,KAAK,OAAO;AACnE,cAAM,KAAK,MAAM,aAAa;AAAA,MAChC,OAAO;AACL,iBAAS,aAAa,KAAK,IAAI;AAC/B,eAAO,SAAS;AAAA,MAClB;AAAA,IACF;AAEA,UAAM,WAAW,KAAK,QAAQ,IAAI,aAAa;AAC/C,QAAI,SAAU,QAAO;AAErB,UAAM,WAAW,YAAY;AAC3B,YAAM,SAAS,MAAM,KAAK,QAAQ,OAAO,aAAa;AACtD,YAAM,MAAM,KAAK,IAAI;AACrB,WAAK,MAAM,IAAI,eAAe,EAAE,QAAQ,WAAW,KAAK,YAAY,IAAI,CAAC;AACzE,YAAM,KAAK,eAAe;AAC1B,aAAO;AAAA,IACT,GAAG;AAEH,SAAK,QAAQ,IAAI,eAAe,OAAO;AACvC,QAAI;AACF,aAAO,MAAM;AAAA,IACf,UAAE;AACA,WAAK,QAAQ,OAAO,aAAa;AAAA,IACnC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,eAAsC;AAChD,UAAM,QAAQ,KAAK,MAAM,IAAI,aAAa;AAC1C,QAAI,CAAC,MAAO;AACZ,SAAK,MAAM,OAAO,aAAa;AAC/B,QAAI;AACF,YAAM,MAAM,OAAO,SAAS;AAAA,IAC9B,SAAS,KAAK;AACZ,WAAK,OAAO,QAAQ,mCAAmC,EAAE,eAAe,IAAI,CAAC;AAAA,IAC/E;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,WAA0B;AAC9B,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,KAAK,CAAC;AACxC,UAAM,QAAQ,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;AAAA,EACnD;AAAA,EAEA,MAAc,iBAAgC;AAC5C,WAAO,KAAK,MAAM,OAAO,KAAK,SAAS;AAErC,UAAI;AACJ,UAAI,eAAe;AACnB,iBAAW,CAAC,KAAK,KAAK,KAAK,KAAK,OAAO;AACrC,YAAI,MAAM,aAAa,cAAc;AACnC,yBAAe,MAAM;AACrB,sBAAY;AAAA,QACd;AAAA,MACF;AACA,UAAI,CAAC,UAAW;AAChB,YAAM,KAAK,MAAM,SAAS;AAAA,IAC5B;AAAA,EACF;AACF;;;ACvDO,IAAM,oBAAN,MAAwB;AAAA,EAa3B,YAAY,QAAiC;AAL7C,SAAiB,gBAAgB,oBAAI,IAA0C;AAC/E,SAAiB,gBAAgB,oBAAI,IAAqD;AAC1F,SAAiB,kBAAkB,oBAAI,IAA8C;AACrF,SAAiB,kBAAkB,oBAAI,IAAyD;AAG5F,QAAI,CAAC,OAAO,iBAAiB;AACzB,YAAM,IAAI,MAAM,iDAAiD;AAAA,IACrE;AACA,SAAK,OAAO,OAAO,gBAAgB,QAAQ,QAAQ,EAAE;AACrD,SAAK,SAAS,OAAO;AACrB,SAAK,aAAa,OAAO,cAAc,IAAI,KAAK;AAChD,SAAK,mBAAmB,OAAO,oBAAoB;AACnD,SAAK,YAAY,OAAO,SAAS,WAAW;AAC5C,SAAK,SAAS,OAAO,UAAU;AAC/B,QAAI,OAAO,KAAK,cAAc,YAAY;AACtC,YAAM,IAAI,MAAM,+EAA0E;AAAA,IAC9F;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBAAgB,MAAgD;AAClE,UAAM,SAAS,KAAK,cAAc,IAAI,IAAI;AAC1C,QAAI,UAAU,OAAO,YAAY,KAAK,IAAI,EAAG,QAAO,OAAO;AAE3D,UAAM,WAAW,KAAK,gBAAgB,IAAI,IAAI;AAC9C,QAAI,SAAU,QAAO;AAErB,UAAM,WAAW,YAAY;AACzB,UAAI;AACA,cAAM,MAAM,GAAG,KAAK,IAAI,uCAAuC,mBAAmB,IAAI,CAAC;AACvF,cAAM,MAAM,MAAM,KAAK,QAAQ,GAAG;AAClC,YAAI,QAAQ,KAAM,QAAO;AACzB,cAAM,OAAO,IAAI,YAAY,QAAQ,OAAQ,IAAI,QAAQ;AACzD,YAAI,CAAC,QAAQ,OAAO,KAAK,kBAAkB,YAAY,CAAC,KAAK,cAAe,QAAO;AACnF,cAAM,QAA0B;AAAA,UAC5B,eAAe,KAAK;AAAA,UACpB,gBAAgB,KAAK;AAAA,UACrB,SAAS,KAAK;AAAA,QAClB;AACA,aAAK,cAAc,IAAI,MAAM,EAAE,OAAO,WAAW,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;AAC/E,eAAO;AAAA,MACX,UAAE;AACE,aAAK,gBAAgB,OAAO,IAAI;AAAA,MACpC;AAAA,IACJ,GAAG;AACH,SAAK,gBAAgB,IAAI,MAAM,OAAO;AACtC,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,cAAc,eAAuB,MAAyE;AAChH,UAAM,SAAS,MAAM,QAAQ,KAAK,KAAK;AACvC,UAAM,WAAW,SAAS,GAAG,aAAa,IAAI,MAAM,KAAK;AACzD,UAAM,SAAS,KAAK,cAAc,IAAI,QAAQ;AAC9C,QAAI,UAAU,OAAO,YAAY,KAAK,IAAI,EAAG,QAAO,OAAO;AAE3D,UAAM,WAAW,KAAK,gBAAgB,IAAI,QAAQ;AAClD,QAAI,SAAU,QAAO;AAErB,UAAM,WAAW,YAAY;AACzB,UAAI;AACA,cAAM,KAAK,SAAS,WAAW,mBAAmB,MAAM,CAAC,KAAK;AAC9D,cAAM,MAAM,GAAG,KAAK,IAAI,8BAA8B,mBAAmB,aAAa,CAAC,YAAY,EAAE;AACrG,cAAM,MAAM,MAAM,KAAK,QAAQ,GAAG;AAClC,YAAI,QAAQ,KAAM,QAAO;AACzB,cAAM,OAAO,IAAI,YAAY,QAAQ,OAAQ,IAAI,QAAQ;AACzD,YAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,YAAI,CAAC,KAAK,UAAU;AAChB,eAAK,OAAO,OAAO,4DAA4D,EAAE,eAAe,OAAO,CAAC;AACxG,iBAAO;AAAA,QACX;AACA,cAAM,QAAQ;AACd,aAAK,cAAc,IAAI,UAAU,EAAE,OAAO,WAAW,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;AACnF,eAAO;AAAA,MACX,UAAE;AACE,aAAK,gBAAgB,OAAO,QAAQ;AAAA,MACxC;AAAA,IACJ,GAAG;AACH,SAAK,gBAAgB,IAAI,UAAU,OAAO;AAC1C,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,uBAAuB,SAAqF;AAC9G,UAAM,QAAQ,OAAO,WAAW,EAAE,EAAE,KAAK,EAAE,YAAY;AACvD,QAAI,CAAC,iBAAiB,KAAK,KAAK,EAAG,QAAO;AAC1C,UAAM,MAAM,GAAG,KAAK,IAAI,0CAA0C,mBAAmB,KAAK,CAAC;AAC3F,UAAM,MAAM,MAAM,KAAK,QAAQ,GAAG;AAClC,QAAI,QAAQ,KAAM,QAAO;AACzB,UAAM,OAAO,IAAI,YAAY,QAAQ,OAAQ,IAAI,QAAQ;AACzD,QAAI,CAAC,QAAQ,OAAO,KAAK,kBAAkB,YAAY,CAAC,KAAK,cAAe,QAAO;AACnF,WAAO,EAAE,eAAe,KAAK,eAAe,gBAAgB,KAAK,eAAe;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACF,eACA,YACiE;AACjE,UAAM,MAAM,GAAG,KAAK,IAAI,8BAA8B,mBAAmB,aAAa,CAAC;AACvF,UAAM,MAAM,MAAM,KAAK,QAAQ,GAAG;AAClC,QAAI,QAAQ,KAAM,QAAO;AACzB,UAAM,OAAO,IAAI,YAAY,QAAQ,OAAQ,IAAI,QAAQ;AACzD,UAAM,WAAW,MAAM,QAAQ,MAAM,QAAQ,IAAI,KAAK,WAAW,CAAC;AAClE,UAAM,SAAS,OAAO,cAAc,EAAE,EAAE,KAAK,EAAE,YAAY;AAC3D,UAAM,QAAQ,SAAS,KAAK,CAAC,MAAW,OAAO,GAAG,UAAU,EAAE,EAAE,YAAY,MAAM,MAAM;AACxF,QAAI,CAAC,OAAO,aAAc,QAAO;AACjC,WAAO,EAAE,UAAU,OAAO,MAAM,YAAY,GAAG,aAAa,MAAM,mBAAmB,KAAK;AAAA,EAC9F;AAAA;AAAA,EAGA,WAAW,eAA6B;AAGpC,SAAK,cAAc,OAAO,aAAa;AACvC,UAAM,SAAS,GAAG,aAAa;AAC/B,eAAW,OAAO,MAAM,KAAK,KAAK,cAAc,KAAK,CAAC,GAAG;AACrD,UAAI,IAAI,WAAW,MAAM,EAAG,MAAK,cAAc,OAAO,GAAG;AAAA,IAC7D;AACA,eAAW,CAAC,MAAM,KAAK,KAAK,KAAK,eAAe;AAC5C,UAAI,MAAM,MAAM,kBAAkB,cAAe,MAAK,cAAc,OAAO,IAAI;AAAA,IACnF;AAAA,EACJ;AAAA;AAAA,EAGA,QAAc;AACV,SAAK,cAAc,MAAM;AACzB,SAAK,cAAc,MAAM;AAAA,EAC7B;AAAA,EAEA,MAAc,QAAQ,KAA2B;AAC7C,UAAM,aAAa,OAAO,oBAAoB,cAAc,IAAI,gBAAgB,IAAI;AACpF,UAAM,QAAQ,aAAa,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,gBAAgB,IAAI;AACzF,QAAI;AACA,YAAM,MAAM,MAAM,KAAK,UAAU,KAAK;AAAA,QAClC,QAAQ;AAAA,QACR,SAAS,KAAK,aAAa;AAAA,QAC3B,QAAQ,YAAY;AAAA,MACxB,CAAC;AACD,UAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,UAAI,CAAC,IAAI,IAAI;AACT,cAAM,IAAI,MAAM,uBAAuB,GAAG,gBAAW,IAAI,MAAM,EAAE;AAAA,MACrE;AACA,aAAO,MAAM,IAAI,KAAK;AAAA,IAC1B,UAAE;AACE,UAAI,MAAO,cAAa,KAAK;AAAA,IACjC;AAAA,EACJ;AAAA,EAEQ,eAAuC;AAC3C,UAAM,UAAkC;AAAA,MACpC,UAAU;AAAA,MACV,cAAc;AAAA,IAClB;AACA,QAAI,KAAK,OAAQ,SAAQ,eAAe,IAAI,UAAU,KAAK,MAAM;AACjE,WAAO;AAAA,EACX;AACJ;;;ACnQA,SAAS,WAAW,uBAAuB;AAqBpC,IAAM,8BAAN,MAAuE;AAAA,EAS1E,YAAY,QAA2C;AAJvD,SAAiB,gBAAgB,oBAAI,IAAwB;AAC7D,SAAiB,UAAU,oBAAI,IAAwB;AACvD,SAAiB,UAAU,oBAAI,IAAwC;AAGnE,SAAK,SAAS,OAAO;AACrB,SAAK,WAAW,OAAO,cAAc,IAAI,KAAK;AAC9C,SAAK,SAAS,OAAO,UAAU;AAAA,EACnC;AAAA,EAEA,MAAM,kBAAkB,MAA8E;AAClG,UAAM,SAAS,KAAK,cAAc,IAAI,IAAI;AAC1C,QAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AACzC,aAAO,EAAE,eAAe,OAAO,eAAe,QAAQ,OAAO,OAAO;AAAA,IACxE;AACA,UAAM,MAAM,QAAQ,IAAI;AACxB,UAAM,WAAW,KAAK,QAAQ,IAAI,GAAG;AACrC,QAAI,UAAU;AACV,YAAM,SAAS,MAAM;AACrB,aAAO,SAAS,EAAE,eAAe,OAAO,eAAe,QAAQ,OAAO,OAAO,IAAI;AAAA,IACrF;AACA,UAAM,WAAW,YAAwC;AACrD,UAAI;AACA,cAAM,WAAW,MAAM,KAAK,OAAO,gBAAgB,IAAI;AACvD,YAAI,CAAC,SAAU,QAAO;AACtB,cAAMC,SAAQ,MAAM,KAAK,gBAAgB,SAAS,eAAe,SAAS,SAAS,SAAS,gBAAgB,IAAI;AAChH,YAAI,CAACA,OAAO,QAAO;AACnB,aAAK,cAAc,IAAI,MAAMA,MAAK;AAClC,aAAK,QAAQ,IAAIA,OAAM,eAAeA,MAAK;AAC3C,eAAOA;AAAA,MACX,SAAS,KAAU;AACf,aAAK,OAAO,QAAQ,0DAA0D;AAAA,UAC1E;AAAA,UACA,OAAO,KAAK,WAAW;AAAA,QAC3B,CAAC;AACD,eAAO;AAAA,MACX,UAAE;AACE,aAAK,QAAQ,OAAO,GAAG;AAAA,MAC3B;AAAA,IACJ,GAAG;AACH,SAAK,QAAQ,IAAI,KAAK,OAAO;AAC7B,UAAM,QAAQ,MAAM;AACpB,WAAO,QAAQ,EAAE,eAAe,MAAM,eAAe,QAAQ,MAAM,OAAO,IAAI;AAAA,EAClF;AAAA,EAEA,MAAM,YAAY,eAAoD;AAClE,UAAM,SAAS,KAAK,QAAQ,IAAI,aAAa;AAC7C,QAAI,UAAU,OAAO,YAAY,KAAK,IAAI,EAAG,QAAO,OAAO;AAE3D,UAAM,MAAM,MAAM,aAAa;AAC/B,UAAM,WAAW,KAAK,QAAQ,IAAI,GAAG;AACrC,QAAI,UAAU;AACV,YAAM,SAAS,MAAM;AACrB,aAAO,QAAQ,UAAU;AAAA,IAC7B;AACA,UAAM,WAAW,YAAwC;AACrD,UAAI;AACA,cAAMA,SAAQ,MAAM,KAAK,gBAAgB,eAAe,QAAW,QAAW,MAAS;AACvF,YAAI,CAACA,OAAO,QAAO;AACnB,aAAK,QAAQ,IAAI,eAAeA,MAAK;AACrC,YAAIA,OAAM,SAAS,SAAU,MAAK,cAAc,IAAIA,OAAM,QAAQ,UAAUA,MAAK;AACjF,eAAOA;AAAA,MACX,SAAS,KAAU;AACf,aAAK,OAAO,QAAQ,oDAAoD;AAAA,UACpE;AAAA,UACA,OAAO,KAAK,WAAW;AAAA,QAC3B,CAAC;AACD,eAAO;AAAA,MACX,UAAE;AACE,aAAK,QAAQ,OAAO,GAAG;AAAA,MAC3B;AAAA,IACJ,GAAG;AACH,SAAK,QAAQ,IAAI,KAAK,OAAO;AAC7B,UAAM,QAAQ,MAAM;AACpB,WAAO,OAAO,UAAU;AAAA,EAC5B;AAAA,EAEA,SAAS,eAA4F;AACjG,UAAM,SAAS,KAAK,QAAQ,IAAI,aAAa;AAC7C,QAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AACzC,aAAO,EAAE,eAAe,OAAO,eAAe,QAAQ,OAAO,QAAQ,SAAS,OAAO,QAAQ;AAAA,IACjG;AACA,WAAO;AAAA,EACX;AAAA,EAEA,WAAW,eAA6B;AACpC,SAAK,QAAQ,OAAO,aAAa;AACjC,eAAW,CAAC,MAAM,KAAK,KAAK,KAAK,eAAe;AAC5C,UAAI,MAAM,kBAAkB,cAAe,MAAK,cAAc,OAAO,IAAI;AAAA,IAC7E;AACA,SAAK,OAAO,WAAW,aAAa;AAAA,EACxC;AAAA,EAEA,MAAc,gBACV,eACA,qBACA,mBACA,UAC0B;AAC1B,QAAI,UAAU;AACd,QAAI,iBAAiB;AACrB,QAAI,OAAO;AACX,QAAI,oBAAoB;AAExB,QAAI,CAAC,WAAW,CAAC,gBAAgB;AAC7B,YAAM,WAAW,MAAM,KAAK,OAAO,cAAc,aAAa;AAC9D,UAAI,CAAC,UAAU;AACX,aAAK,OAAO,OAAO,oDAAoD,EAAE,cAAc,CAAC;AACxF,eAAO;AAAA,MACX;AACA,0BAAoB,SAAS,iBAAiB;AAC9C,UAAI,CAAC,QAAS,WAAU,SAAS,WAAW,2BAA2B,SAAS,QAAQ;AACxF,UAAI,CAAC,eAAgB,kBAAiB,SAAS,SAAS;AACxD,UAAI,CAAC,KAAM,QAAO,SAAS,SAAS;AAAA,IACxC;AAEA,QAAI,CAAC,WAAW,CAAC,QAAQ,eAAe,CAAC,QAAQ,gBAAgB;AAC7D,WAAK,OAAO,OAAO,+DAA+D,EAAE,cAAc,CAAC;AACnG,aAAO;AAAA,IACX;AAEA,UAAM,SAAS,MAAM,aAAa,QAAQ,gBAAgB,QAAQ,aAAa,QAAQ,qBAAqB,EAAE;AAE9G,UAAM,aAAa;AAAA,MACf,IAAI;AAAA,MACJ,iBAAiB;AAAA,MACjB,UAAU;AAAA,MACV,cAAc,QAAQ;AAAA,MACtB,iBAAiB,QAAQ;AAAA,MACzB,UAAU,QAAQ;AAAA,IACtB;AAEA,WAAO;AAAA,MACH,eAAe;AAAA,MACf;AAAA,MACA,SAAS;AAAA,MACT,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,IACjC;AAAA,EACJ;AACJ;AASA,SAAS,2BAA2B,UAAqD;AACrF,QAAM,cAAc,UAAU;AAC9B,MAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,YAAY,WAAW,EAAG,QAAO;AACpE,QAAM,UAA6B,UAAU;AAC7C,MAAI;AACJ,MAAI,SAAS;AACT,UAAM,MAAM,QAAQ,KAAK,CAAC,MAAW,GAAG,YAAY,IAAI;AACxD,QAAI,KAAK,WAAY,iBAAgB,IAAI;AAAA,EAC7C;AACA,QAAM,KAAK,gBACL,YAAY,KAAK,CAAC,MAAW,GAAG,SAAS,aAAa,IACtD,YAAY,CAAC;AACnB,MAAI,CAAC,MAAM,OAAO,OAAO,SAAU,QAAO;AAC1C,QAAM,SAAU,GAAG,UAAU,CAAC;AAC9B,QAAM,MAAM,OAAO,OAAO,OAAO,oBAAoB,OAAO,cAAc,OAAO;AACjF,QAAM,SAAS,GAAG;AAClB,MAAI,OAAO,WAAW,YAAY,OAAO,QAAQ,SAAU,QAAO;AAClE,SAAO;AAAA,IACH,gBAAgB;AAAA,IAChB,aAAa;AAAA,IACb,mBAAmB,OAAO,OAAO,cAAc,WAAW,OAAO,YAAY;AAAA,EACjF;AACJ;AAEA,eAAe,aAAa,YAAoB,aAAqB,WAAyC;AAC1G,UAAQ,YAAY;AAAA,IAChB,KAAK,UAAU;AACX,YAAM,EAAE,eAAe,IAAI,MAAM,OAAO,4BAA4B;AACpE,YAAM,SAAS,YAAY,QAAQ,gBAAgB,EAAE,EAAE,KAAK;AAK5D,YAAM,WAAW,SACX,gBAAgB,QAAQ,IAAI,GAAG,8BAA8B,GAAG,MAAM,OAAO,IAC7E;AACN,aAAO,IAAI,eAAe;AAAA,QACtB,aAAa,WAAW,EAAE,MAAM,QAAQ,MAAM,SAAS,IAAI;AAAA,MAC/D,CAAC;AAAA,IACL;AAAA,IACA,KAAK;AAAA,IACL,KAAK,OAAO;AACR,YAAM,WAAW,YAAY,QAAQ,UAAU,EAAE,EAAE,QAAQ,aAAa,EAAE;AAC1E,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,yBAAyB;AAC5D,aAAO,IAAI,UAAU;AAAA,QACjB,QAAQ;AAAA,QACR,YAAY,EAAE,UAAU,SAAS;AAAA,QACjC,kBAAkB;AAAA,MACtB,CAAC;AAAA,IACL;AAAA,IACA,KAAK;AAAA,IACL,KAAK,SAAS;AACV,YAAM,EAAE,YAAY,IAAI,MAAM,OAAO,2BAA2B;AAChE,aAAO,IAAI,YAAY,EAAE,KAAK,aAAa,UAAU,CAAC;AAAA,IAC1D;AAAA,IACA,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,MAAM;AACP,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,yBAAyB;AAC5D,aAAO,IAAI,UAAU;AAAA,QACjB,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,MAAM,EAAE,KAAK,GAAG,KAAK,EAAE;AAAA,MAC3B,CAAC;AAAA,IACL;AAAA,IACA,KAAK;AAAA,IACL,KAAK,SAAS;AACV,YAAM,EAAE,cAAc,IAAI,MAAM,OAAO,6BAA6B;AACpE,aAAO,IAAI,cAAc,EAAE,KAAK,YAAY,CAAC;AAAA,IACjD;AAAA,IACA;AACI,YAAM,IAAI,MAAM,0DAA0D,UAAU,EAAE;AAAA,EAC9F;AACJ;;;ACtOA;AACA;AAJA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,gBAAAC,qBAAoB;;;ACctB,IAAM,uBAAuD;AAAA,EAChE,YAAY;AAAA,IACR,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,MACJ,EAAE,KAAK,mCAAmC,QAAQ,kBAAkB;AAAA,MACpE,EAAE,KAAK,mCAAmC,QAAQ,mBAAmB;AAAA,MACrE,EAAE,KAAK,mCAAmC,QAAQ,sBAAsB;AAAA,MACxE,EAAE,KAAK,mCAAmC,QAAQ,oBAAoB;AAAA,IAC1E;AAAA,EACJ;AAAA,EACA,IAAI;AAAA,IACA,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AAAA,EACA,WAAW;AAAA,IACP,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,WAAW;AAAA,EACf;AAAA,EACA,OAAO;AAAA,IACH,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AAAA,EACA,OAAO;AAAA,IACH,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AAAA,EACA,SAAS;AAAA,IACL,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AAAA,EACA,OAAO;AAAA,IACH,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AAAA,EACA,KAAK;AAAA,IACD,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AAAA,EACA,UAAU;AAAA,IACN,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AAAA,EACA,MAAM;AAAA,IACF,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AAAA,EACA,UAAU;AAAA,IACN,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AACJ;AAqBA,eAAsB,iBAAiB,MAAkD;AACrF,QAAM,EAAE,QAAQ,UAAU,QAAQ,cAAc,IAAI;AACpD,QAAM,SAAiB,KAAK,UAAU;AACtC,QAAM,YAAsB,CAAC;AAE7B,aAAW,OAAO,UAAU;AACxB,UAAM,OAAO,qBAAqB,GAAG;AACrC,QAAI,CAAC,MAAM;AAEP;AAAA,IACJ;AAEA,QAAI;AACA,YAAM,MAAW,MAAM;AAAA;AAAA,QAAiC,KAAK;AAAA;AAC7D,YAAM,OAAO,IAAI,KAAK,MAAM;AAC5B,UAAI,CAAC,MAAM;AACP,eAAO;AAAA,UACH,uBAAuB,GAAG,eAAe,KAAK,GAAG,qBAAqB,KAAK,MAAM;AAAA,UACjF,EAAE,cAAc;AAAA,QACpB;AACA;AAAA,MACJ;AAEA,UAAI;AACJ,UAAI,KAAK,WAAW;AAChB,cAAM,IAAK,OAAmC,KAAK,SAAS;AAC5D,YAAI,KAAK,cAAc,kBAAkB;AACrC,gBAAM,EAAE,OAAO,MAAM,QAAQ,CAAC,IAAI,IAAI,CAAC,EAAE;AAAA,QAC7C,WAAW,MAAM,QAAW;AACxB,gBAAM;AAAA,QACV;AAAA,MACJ;AAEA,YAAM,OAAO,IAAI,QAAQ,SAAY,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,CAAC;AAC/D,gBAAU,KAAK,KAAK,MAAM;AAE1B,UAAI,KAAK,QAAQ;AACb,mBAAW,MAAM,KAAK,QAAQ;AAC1B,cAAI;AACA,kBAAM,QAAa,MAAM;AAAA;AAAA,cAAiC,GAAG;AAAA;AAC7D,kBAAM,SAAS,MAAM,GAAG,MAAM;AAC9B,gBAAI,QAAQ;AACR,oBAAM,OAAO,IAAI,IAAI,OAAO,CAAC;AAC7B,wBAAU,KAAK,GAAG,MAAM;AAAA,YAC5B;AAAA,UACJ,QAAQ;AAAA,UAER;AAAA,QACJ;AAAA,MACJ;AAEA,aAAO;AAAA,QACH,uBAAuB,GAAG,gBAAgB,KAAK,MAAM,GAAG,KAAK,SAAS,QAAQ,KAAK,OAAO,SAAS,YAAY,EAAE;AAAA,QACjH,EAAE,cAAc;AAAA,MACpB;AAAA,IACJ,SAAS,KAAU;AACf,YAAM,MAAM,KAAK,WAAW,OAAO,GAAG;AACtC,UAAI,IAAI,SAAS,oBAAoB,KAAK,IAAI,SAAS,sBAAsB,GAAG;AAC5E,eAAO;AAAA,UACH,uBAAuB,GAAG,oBAAoB,KAAK,GAAG;AAAA,UACtD,EAAE,cAAc;AAAA,QACpB;AAAA,MACJ,OAAO;AACH,eAAO;AAAA,UACH,uBAAuB,GAAG,kBAAkB,GAAG;AAAA,UAC/C,EAAE,cAAc;AAAA,QACpB;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AAEA,SAAO;AACX;;;ADvJA;AA+BA,SAAS,wBAAwB,YAAoB,eAA+B;AAChF,SAAOC,YAAW,UAAU,UAAU,EAAE,OAAO,WAAW,aAAa,EAAE,EAAE,OAAO,KAAK;AAC3F;AAEO,IAAM,wBAAN,MAAgE;AAAA,EAOnE,YAAY,QAAqC;AAC7C,SAAK,SAAS,OAAO;AACrB,SAAK,cAAc,OAAO;AAC1B,SAAK,SAAS,OAAO,UAAU;AAC/B,SAAK,eAAe,OAAO;AAC3B,SAAK,kBACD,OAAO,kBACJ,QAAQ,IAAI,kBACZ,QAAQ,IAAI,eACZ,IACL,KAAK;AAAA,EACX;AAAA,EAEA,MAAM,OAAO,eAA8C;AACvD,QAAI,SAAS,KAAK,YAAY,SAAS,aAAa;AACpD,QAAI,CAAC,QAAQ;AACT,YAAMC,UAAS,MAAM,KAAK,YAAY,YAAY,aAAa;AAC/D,UAAI,CAACA,SAAQ;AACT,cAAM,IAAI,MAAM,iEAAiE,aAAa,GAAG;AAAA,MACrG;AACA,eAAS,KAAK,YAAY,SAAS,aAAa;AAChD,UAAI,CAAC,QAAQ;AACT,cAAM,IAAI,MAAM,kFAAkF,aAAa,GAAG;AAAA,MACtH;AAAA,IACJ;AAEA,UAAM,SAAsB,OAAO;AACnC,UAAM,UAAU,OAAO;AAEvB,UAAM,WAAW,MAAM,KAAK,OAAO,cAAc,aAAa;AAC9D,QAAI,CAAC,UAAU;AACX,YAAM,IAAI,MAAM,+DAA+D,aAAa,GAAG;AAAA,IACnG;AAEA,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,uBAAuB;AAC/D,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,uBAAuB;AAE/D,UAAM,SAAS,IAAIC,cAAa,KAAK,YAAY;AAOjD,UAAM,OAAO,IAAI,IAAI,aAAa,QAAQ,EAAE,gBAAgB,QAAQ,CAAQ,CAAC;AAO7E,UAAM,OAAO,IAAI,IAAI,eAAe,EAAE,eAA8B,gBAAgB,MAAM,CAAC,CAAC;AAC5F,UAAM,OAAO,IAAI,IAAI,eAAe;AAAA,MAChC,OAAO;AAAA,MACP;AAAA,MACA,gBAAgB,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASxB,uBAAuB;AAAA,IAC3B,CAAC,CAAC;AAKF,QAAI,KAAK,gBAAgB;AACrB,UAAI;AACA,cAAM,EAAE,WAAW,IAAI,MAAM,OAAO,0BAA0B;AAC9D,cAAM,gBAAgB,wBAAwB,KAAK,gBAAgB,aAAa;AAChF,cAAM,UAAU,QAAQ,WACjB,QAAQ,SAAS,WAAW,MAAM,IAC/B,QAAQ,WACP,2BAA2B,KAAK,QAAQ,QAAQ,KAC5C,MAAM;AACL,gBAAM,eAAe,QAAQ,IAAI,mBAAmB,IAAI,KAAK;AAC7D,gBAAM,UAAU,QAAQ,KAAK,QAAQ,QAAQ;AAC7C,gBAAM,eAAe,WAAW,CAAC,cAC3B,QAAQ,WACR,GAAG,QAAQ,QAAQ,IAAI,WAAW;AACxC,iBAAO,UAAU,YAAY;AAAA,QACjC,GAAG,IACD,WAAW,QAAQ,QAAQ,KACnC;AAaN,cAAM,qBAA+B,CAAC;AACtC,YAAI,QAAS,oBAAmB,KAAK,OAAO;AAK5C,cAAM,mBAAmB,QAAQ,IAAI,sBAAsB,IACtD,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AACnB,mBAAW,KAAK,iBAAiB;AAC7B,cAAI,CAAC,mBAAmB,SAAS,CAAC,EAAG,oBAAmB,KAAK,CAAC;AAAA,QAClE;AAIA,cAAM,cAAc,QAAQ,IAAI,kBAAkB,IAAI,KAAK,EAAE,QAAQ,gBAAgB,EAAE;AACvF,YAAI,YAAY;AACZ,gBAAM,WAAW,aAAa,UAAU;AACxC,cAAI,CAAC,mBAAmB,SAAS,QAAQ,EAAG,oBAAmB,KAAK,QAAQ;AAAA,QAChF;AACA,YAAI,QAAQ,UAAU;AAClB,gBAAM,WAAW,QAAQ,SAAS,QAAQ,gBAAgB,EAAE;AAC5D,cAAI,SAAS,SAAS,YAAY,KAAK,aAAa,aAAa;AAC7D,+BAAmB,KAAK,UAAU,QAAQ,EAAE;AAC5C,+BAAmB,KAAK,UAAU,QAAQ,IAAI;AAC9C,+BAAmB,KAAK,WAAW,QAAQ,IAAI;AAAA,UACnD;AAAA,QACJ;AAWA,cAAM,qBAAqB;AAAA,UACvB,QAAQ,IAAI,mBAAmB;AAAA,QACnC,EAAE,YAAY,MAAM;AACpB,cAAM,gBAAgB,QAAQ,IAAI,gBAAgB,IAAI,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAC/E,cAAM,gBAAgB,sBACf,gBACA,eAAe,KAAK,YAAY,IACjC,CAAC;AAAA,UACC,YAAY;AAAA,UACZ,MAAM;AAAA,UACN,cAAc,GAAG,YAAY;AAAA,UAC7B,UAAU,0BAA0B,aAAa;AAAA,UACjD,cAAc,8BAA8B,KAAK,gBAAgB,aAAa;AAAA,UAC9E,QAAQ,CAAC,UAAU,SAAS,SAAS;AAAA,QACzC,CAAC,IACC;AAEN,cAAM,OAAO,IAAI,IAAI,WAAW;AAAA,UAC5B,QAAQ;AAAA,UACR;AAAA;AAAA;AAAA;AAAA;AAAA,UAKA,gBAAgB;AAAA;AAAA;AAAA,UAGhB,oBAAoB;AAAA;AAAA;AAAA;AAAA,UAIpB,gBAAgB,mBAAmB,SAAS,qBAAqB;AAAA,UACjE,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAQzC,eAAe;AAAA,YACX,MAAM;AAAA,cACF,QAAQ;AAAA,gBACJ,OAAO,OAAO,SAAwD;AAClE,sBAAI;AACA,0BAAM,KAAK,OAAO,WAAgB,UAAU;AAC5C,wBAAI,CAAC,GAAI;AACT,0BAAM,CAAC,EAAE,2BAA2B,oBAAoB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,sBAC3E,OAAO,8BAA8B;AAAA,oBACzC,CAAC;AACD,0BAAM,0BAA0B,IAAI,MAAM;AAAA,sBACtC,QAAQ,KAAK;AAAA,sBACb,eAAe;AAAA,oBACnB,CAAC;AAAA,kBACL,SAAS,GAAQ;AACb,yBAAK,OAAO,OAAO,6DAA6D;AAAA,sBAC5E;AAAA,sBACA,QAAQ,MAAM;AAAA,sBACd,OAAO,GAAG;AAAA,oBACd,CAAC;AAAA,kBACL;AAAA,gBACJ;AAAA,cACJ;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ,CAAQ,CAAC;AACT,YAAI,eAAe;AACf,eAAK,OAAO,OAAO,8CAA8C;AAAA,YAC7D;AAAA,YACA;AAAA,UACJ,CAAC;AAAA,QACL;AAAA,MACJ,SAAS,KAAU;AACf,aAAK,OAAO,OAAO,qDAAqD;AAAA,UACpE;AAAA,UACA,OAAO,KAAK;AAAA,QAChB,CAAC;AAAA,MACL;AAAA,IACJ,OAAO;AACH,WAAK,OAAO,OAAO,yHAAoH,EAAE,cAAc,CAAC;AAAA,IAC5J;AASA,QAAI;AACA,YAAM,EAAE,eAAe,IAAI,MAAM,OAAO,8BAA8B;AACtE,YAAM,cAAc,OAAO,QAAQ,IAAI,mBAAmB,MAAM,EAAE,YAAY,MAAM;AACpF,YAAM,OAAO,IAAI,IAAI,eAAe,EAAE,YAAY,CAAC,CAAQ;AAAA,IAC/D,SAAS,KAAU;AACf,WAAK,OAAO,OAAO,yDAAyD;AAAA,QACxE;AAAA,QACA,OAAO,KAAK;AAAA,MAChB,CAAC;AAAA,IACL;AAEA,UAAM,cAAc,QAAQ,YAAY;AACxC,UAAM,SAAS,SAAS;AACxB,UAAM,MAAM,QAAQ,YAAY;AAChC,UAAM,YAAY,KAAK,aAAa,KAAK,cAAc,QAAQ;AAM/D,UAAM,UAAW,QAAQ,QAAQ,KAAK,QAAQ,CAAC;AAC/C,UAAM,QAAQ,MAAM,QAAQ,QAAQ,YAAY,IAAI,OAAO,eACrD,MAAM,QAAQ,KAAK,YAAY,IAAI,IAAI,eAAe,CAAC;AAG7D,QAAI;AACA,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,2BAA2B;AACtE,YAAM,OAAO,IAAI,IAAI,kBAAkB;AAAA,QACnC,eAAe,QAAQ;AAAA,QACvB,gBAAgB,QAAQ,kBAAkB,QAAQ,iBAAiB;AAAA;AAAA;AAAA;AAAA,QAInE,gBAAgB;AAAA,MACpB,CAAQ,CAAC;AACT,cAAQ;AAAA,QACJ,iEAAiE,aAAa,kBAAkB,MAAM,MAAM,mBAAmB,QAAQ,iBAAiB,IAAI;AAAA,MAChK;AAAA,IACJ,SAAS,KAAU;AACf,WAAK,OAAO,OAAO,4DAA4D;AAAA,QAC3E;AAAA,QACA,OAAO,KAAK;AAAA,MAChB,CAAC;AAAA,IACL;AAOA,UAAM,eACD,MAAM,QAAQ,QAAQ,QAAQ,IAAI,OAAO,WAAW,UACpD,MAAM,QAAQ,KAAK,QAAQ,IAAI,IAAI,WAAW,SAC/C,CAAC;AACL,UAAM,WAAsB,YACvB,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC;AAErE,QAAI,SAAS,SAAS,GAAG;AACrB,YAAM,YAAY,MAAM,iBAAiB;AAAA,QACrC;AAAA,QACA;AAAA,QACA,QAAQ,EAAE,GAAI,UAAU,CAAC,GAAI,GAAI,OAAO,CAAC,EAAG;AAAA,QAC5C,QAAQ,KAAK;AAAA,QACb;AAAA,MACJ,CAAC;AACD,WAAK,OAAO,OAAO,+CAA+C;AAAA,QAC9D;AAAA,QACA;AAAA,QACA;AAAA,MACJ,CAAC;AAAA,IACL;AAEA,UAAM,OAAO,IAAI,IAAI,UAAU,QAAQ;AAAA,MACnC;AAAA,MACA,gBAAgB,QAAQ,mBAAmB;AAAA,MAC3C;AAAA,MACA;AAAA,MACA,QAAQ,YAAY,YAAY;AAAA,IACpC,CAAQ,CAAC;AAET,UAAM,OAAO,UAAU;AAsBvB,QAAI;AACA,YAAM,WAAgB,OAAQ,SAAiB,aAAa,WACtD,KAAK,MAAO,QAAgB,QAAQ,IAClC,SAAiB,YAAY,CAAC;AACtC,YAAM,YAAY,UAAU;AAC5B,YAAM,UAAU,UAAU;AAE1B,UAAI,SAAS,MAAM,SAAS,MAAM;AAC9B,YAAI;AACA,gBAAM,EAAE,yBAAAC,yBAAwB,IAAI,MAAM;AAC1C,gBAAMA,yBAAwB,QAAQ,SAAS,KAAK,MAAM;AAAA,QAC9D,SAAS,GAAQ;AACb,eAAK,OAAO,OAAO,yCAAyC;AAAA,YACxD;AAAA,YACA,OAAO,GAAG;AAAA,UACd,CAAC;AAAA,QACL;AAAA,MACJ;AAEA,UAAI,WAAW,UAAU,WAAW,OAAO;AACvC,YAAI;AACA,gBAAM,EAAE,kBAAAC,kBAAiB,IAAI,MAAM;AACnC,gBAAMA,kBAAiB,QAAQ,WAAW,KAAK,MAAM;AAAA,QACzD,SAAS,GAAQ;AACb,eAAK,OAAO,OAAO,2CAA2C;AAAA,YAC1D;AAAA,YACA,OAAO,GAAG;AAAA,UACd,CAAC;AAAA,QACL;AAEA,YAAI,SAAS,IAAI;AACb,cAAI;AACA,kBAAM,EAAE,mBAAAC,mBAAkB,IAAI,MAAM;AACpC,kBAAMA;AAAA,cACF;AAAA,cACA,EAAE,QAAQ,UAAU,QAAQ,gBAAgB,QAAQ,IAAI,MAAM,QAAQ;AAAA,cACtE,KAAK;AAAA,YACT;AAAA,UACJ,SAAS,GAAQ;AACb,iBAAK,OAAO,OAAO,4CAA4C;AAAA,cAC3D;AAAA,cACA,OAAO,GAAG;AAAA,YACd,CAAC;AAAA,UACL;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ,SAAS,KAAU;AACf,WAAK,OAAO,OAAO,kDAAkD;AAAA,QACjE;AAAA,QACA,OAAO,KAAK;AAAA,MAChB,CAAC;AAAA,IACL;AAYA,QAAI;AACA,YAAM,eAAkC,MAAM;AAC1C,YAAI;AAAE,iBAAQ,OAAe,aAAa,eAAe;AAAA,QAAG,QAAQ;AAAE,iBAAO;AAAA,QAAW;AAAA,MAC5F,GAAG;AACH,YAAM,YAAiB,MAAM;AACzB,YAAI;AAAE,iBAAQ,OAAe,aAAa,eAAe;AAAA,QAAG,QAAQ;AAAE,iBAAO;AAAA,QAAW;AAAA,MAC5F,GAAG;AAEH,UAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS,KAAK,OAAO,aAAa,YAAY;AAMxF,cAAM,cAAoB,SAAiB;AAC3C,cAAM,WAAgB,OAAO,gBAAgB,YAAY,MAAM;AAC3D,cAAI;AAAE,mBAAO,KAAK,MAAM,WAAW;AAAA,UAAG,QAAQ;AAAE,mBAAO,CAAC;AAAA,UAAG;AAAA,QAC/D,GAAG,IAAK,eAAe,CAAC;AACxB,YAAI,eAAmC,UAAU,SAAS;AAE1D,YAAI,CAAC,cAAc;AACf,cAAI;AACA,kBAAM,KAAW,OAAe,aAAa,UAAU;AACvD,gBAAI,IAAI,MAAM;AACV,oBAAM,OAAO,MAAM,GAAG,KAAK,oBAAoB,EAAE,OAAO,GAAG,SAAS,CAAC,EAAE,OAAO,cAAc,WAAW,MAAM,CAAC,EAAE,CAAQ;AACxH,oBAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAQ,MAAM,SAAS,MAAM,WAAW,CAAC;AAC5E,kBAAI,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,KAAK,KAAK,CAAC,GAAG,IAAI;AACvD,+BAAe,OAAO,KAAK,CAAC,EAAE,EAAE;AAAA,cACpC;AAAA,YACJ;AAAA,UACJ,QAAQ;AAAA,UAAuD;AAAA,QACnE;AAEA,YAAI,cAAc;AACd,cAAI;AACA,kBAAM,UAAU,MAAM,SAAS,YAAY;AAC3C,kBAAM,WAAW,SAAS,YAAY;AACtC,kBAAM,UAAU,SAAS,WAAW;AACpC,kBAAM,OAAO,SAAS,QAAQ,UAAU;AACxC,gBAAI,WAAW,KAAK,UAAU,KAAK,OAAO,GAAG;AACzC,mBAAK,OAAO,OAAO,sDAAsD;AAAA,gBACrE;AAAA,gBACA,gBAAgB;AAAA,gBAChB,UAAU,YAAY;AAAA,gBACtB;AAAA,gBACA;AAAA,gBACA,QAAQ;AAAA,cACZ,CAAC;AAAA,YACL;AAAA,UACJ,SAAS,GAAQ;AACb,iBAAK,OAAO,OAAO,6DAA6D;AAAA,cAC5E;AAAA,cACA,gBAAgB;AAAA,cAChB,OAAO,GAAG;AAAA,YACd,CAAC;AAAA,UACL;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ,SAAS,KAAU;AACf,WAAK,OAAO,OAAO,0DAA0D;AAAA,QACzE;AAAA,QACA,OAAO,KAAK;AAAA,MAChB,CAAC;AAAA,IACL;AASA,QAAI,UAAe;AACnB,QAAI;AACA,gBAAW,OAAe,aAAa,MAAM;AAAA,IACjD,QAAQ;AAEJ,gBAAU;AAAA,IACd;AACA,QAAI;AACA,UAAI,WAAW,OAAO,QAAQ,qBAAqB,YAAY;AAC3D,YAAI,QAAQ,iBAAiB,OAAO,QAAQ,qBAAqB,YAAY;AACzE,kBAAQ,iBAAiB,QAAQ,aAAa;AAAA,QAClD;AACA,YAAI,SAAS;AACb,mBAAW,WAAW,OAAO;AACzB,cAAI,CAAC,WAAW,OAAO,YAAY,SAAU;AAC7C,qBAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,gBAAI,QAAQ,OAAO,SAAS,UAAU;AAClC,kBAAI;AACA,wBAAQ,iBAAiB,QAAQ,IAA+B;AAChE;AAAA,cACJ,SAAS,KAAU;AACf,qBAAK,OAAO,OAAO,wDAAwD;AAAA,kBACvE;AAAA,kBAAe;AAAA,kBAAQ,OAAO,KAAK;AAAA,gBACvC,CAAC;AAAA,cACL;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ;AACA,YAAI,SAAS,GAAG;AACZ,eAAK,OAAO,OAAO,qDAAqD;AAAA,YACpE;AAAA,YAAe,SAAS;AAAA,YAAQ,SAAS,MAAM;AAAA,UACnD,CAAC;AAAA,QACL;AAAA,MACJ;AAAA,IACJ,SAAS,KAAU;AACf,WAAK,OAAO,OAAO,mDAAmD;AAAA,QAClE;AAAA,QACA,OAAO,KAAK;AAAA,MAChB,CAAC;AAAA,IACL;AAEA,SAAK,OAAO,OAAO,wCAAwC;AAAA,MACvD;AAAA,MACA,UAAU,SAAS;AAAA,MACnB,UAAU,SAAS;AAAA,MACnB,aAAa,QAAQ,KAAK,cAAc;AAAA,IAC5C,CAAC;AAED,WAAO;AAAA,EACX;AACJ;;;AEtjBA,IAAM,cAAc;AAIpB,SAAS,YAAY,KAA6D;AAC9E,MAAI,CAAC,IAAK,QAAO;AAEjB,MAAI,OAAO,IAAI,kBAAkB,WAAY,QAAO,IAAI,cAAc,KAAK,GAAG;AAC9E,MAAI,OAAO,IAAI,YAAY,WAAY,QAAO,IAAI,QAAQ,KAAK,GAAG;AAClE,MAAI,IAAI,OAAO,OAAO,IAAI,IAAI,YAAY,WAAY,QAAO,IAAI,IAAI,QAAQ,KAAK,IAAI,GAAG;AAEzF,MAAI,IAAI,QAAQ,OAAO,IAAI,KAAK,YAAY,WAAY,QAAO,IAAI,KAAK,QAAQ,KAAK,IAAI,IAAI;AAC7F,SAAO;AACX;AAEA,eAAe,mBAAmB,KAAsE;AACpG,QAAM,SAAS,YAAY,GAAG;AAC9B,MAAI,OAAQ,QAAO;AACnB,MAAI,OAAO,KAAK,WAAW,YAAY;AACnC,QAAI;AACA,YAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,aAAO,YAAY,GAAG,KAAK,YAAY,EAAE,IAAI,CAAC;AAAA,IAClD,QAAQ;AACJ,aAAO;AAAA,IACX;AAAA,EACJ;AACA,SAAO;AACX;AAEO,IAAM,kBAAN,MAAwC;AAAA,EAAxC;AACH,SAAS,OAAO;AAChB,SAAS,UAAU;AAEnB,gBAAO,OAAO,SAAuC;AAAA,IAErD;AAEA,iBAAQ,OAAO,QAAsC;AAIjD,UAAI,KAAK,gBAAgB,YAAY;AACjC,YAAI;AACJ,YAAI;AACA,uBAAa,IAAI,WAAW,aAAa;AAAA,QAC7C,QAAQ;AACJ,cAAI,QAAQ,OAAO,4EAAuE;AAC1F;AAAA,QACJ;AACA,YAAI,CAAC,cAAc,OAAO,WAAW,cAAc,YAAY;AAC3D,cAAI,QAAQ,OAAO,kFAA6E;AAChG;AAAA,QACJ;AAEA,cAAM,SAAS,WAAW,UAAU;AACpC,cAAM,gBAAgB,IAAI,WAA0B,gBAAgB;AACpE,cAAM,cAAc,IAAI,WAAsC,cAAc;AAE5E,cAAM,UAAU,OAAO,MAAW;AAC9B,cAAI;AACA,kBAAM,MAAM,IAAI,IAAI,EAAE,IAAI,GAAG;AAC7B,kBAAM,OAAO,IAAI;AACjB,gBAAI;AACJ,gBAAI;AACA,oBAAM,MAAM,MAAM,YAAY,kBAAkB,IAAI;AACpD,8BAAgB,KAAK;AAAA,YACzB,QAAQ;AAAA,YAER;AACA,gBAAI,CAAC,eAAe;AAChB,qBAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,KAAK,GAAG,GAAG;AAAA,YAC3D;AAEA,kBAAM,gBAAgB,MAAM,cAAc,YAAY,aAAa;AACnE,gBAAI;AACJ,gBAAI;AACA,wBAAU,MAAO,cAAsB,kBAAkB,MAAM;AAAA,YACnE,QAAQ;AAAE,wBAAU;AAAA,YAAW;AAC/B,gBAAI,CAAC,SAAS;AACV,kBAAI;AAAE,0BAAW,cAAsB,aAAa,MAAM;AAAA,cAAG,QAAQ;AAAA,cAAe;AAAA,YACxF;AAQA,kBAAM,UAAU,IAAI,SAAS,WAAW,cAAc,GAAG,IACnD,IAAI,SAAS,UAAU,YAAY,SAAS,CAAC,IAC7C;AACN,gBAAI,EAAE,IAAI,WAAW,UAAU,YAAY,YAAY,YAAY,qBAAqB;AACpF,kBAAI,YAAY,UAAU;AACtB,oBAAI;AACA,wBAAM,SAAS,OAAO,SAAS,oBAAoB,aAC7C,QAAQ,gBAAgB,IACxB;AACN,sBAAI,QAAQ;AACR,2BAAO,EAAE,KAAK,EAAE,SAAS,MAAM,MAAM,OAAO,CAAC;AAAA,kBACjD;AACA,yBAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,2BAA2B,SAAS,uCAAuC,EAAE,GAAG,GAAG;AAAA,gBACtI,SAAS,GAAQ;AACb,yBAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,qBAAqB,SAAS,OAAO,GAAG,WAAW,CAAC,EAAE,EAAE,GAAG,GAAG;AAAA,gBACjH;AAAA,cACJ;AAEA,kBAAI;AAaA,sBAAM,aAAa,OAAO,SAAS,kBAAkB,aAC/C,QAAQ,cAAc,IACtB;AACN,oBAAI,CAAC,cAAc,OAAO,WAAW,UAAU,YAAY;AACvD,yBAAO,EAAE,KAAK,EAAE,UAAU,KAAK,CAAC;AAAA,gBACpC;AACA,sBAAM,QAAQ,MAAM,WAAW,MAAM,YAAY,CAAC,CAAC;AACnD,uBAAO,EAAE,KAAK,EAAE,WAAW,SAAS,KAAK,EAAE,CAAC;AAAA,cAChD,QAAQ;AACJ,uBAAO,EAAE,KAAK,EAAE,UAAU,KAAK,CAAC;AAAA,cACpC;AAAA,YACJ;AAEA,kBAAM,KAAK,MAAM,mBAAmB,OAAO;AAC3C,gBAAI,CAAC,IAAI;AACL,qBAAO,EAAE,KAAK,EAAE,OAAO,4BAA4B,cAAc,GAAG,GAAG;AAAA,YAC3E;AAIA,kBAAM,OAAO,MAAM,GAAG,EAAE,IAAI,GAAG;AAc/B,kBAAM,aAAa,QAAQ,IAAI,kBAAkB;AACjD,gBAAI,YAAY;AACZ,oBAAM,cAAc,WAAW,WAAW,GAAG,IAAI,aAAa,IAAI,UAAU;AAC5E,oBAAM,aAAa;AAAA,gBACf;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cACJ;AACA,kBAAI;AACA,2BAAW,KAAK,YAAY;AACxB,wBAAM,WAAW,EAAE,WAAW,WAAW;AACzC,wBAAM,QAAQ,6BAA6B,WAAW,iBAAiB,WAAW,aAAa,EAAE;AACjG,kBAAC,KAAa,SAAS,SAAS,cAAc,GAAG,CAAC,MAAM,KAAK,EAAE;AAAA,gBACnE;AAAA,cACJ,QAAQ;AAAA,cAA4B;AAAA,YACxC;AAEA,mBAAO;AAAA,UACX,SAAS,KAAU;AACf,YAAC,IAAI,QAAQ,QAAgB,0CAA0C;AAAA,cACnE,OAAO,KAAK;AAAA,cACZ,OAAO,KAAK;AAAA,YAChB,CAAC;AACD,mBAAO,EAAE,KAAK;AAAA,cACV,OAAO;AAAA,cACP,SAAS,KAAK,WAAW,OAAO,GAAG;AAAA,YACvC,GAAG,GAAG;AAAA,UACV;AAAA,QACJ;AAKA,YAAI,OAAO,OAAO,QAAQ,YAAY;AAClC,iBAAO,IAAI,GAAG,WAAW,MAAM,OAAO;AAAA,QAC1C,OAAO;AACH,qBAAW,KAAK,CAAC,OAAO,QAAQ,OAAO,UAAU,SAAS,SAAS,GAAY;AAC3E,gBAAI;AAAE,qBAAO,CAAC,IAAI,GAAG,WAAW,MAAM,OAAO;AAAA,YAAG,QAAQ;AAAA,YAAoB;AAAA,UAChF;AAAA,QACJ;AACA,YAAI,QAAQ,OAAO,2CAA2C,WAAW,IAAI;AAAA,MACjF,CAAC;AAAA,IACL;AAAA;AACJ;;;AC5NO,IAAM,oBAAoB;AAS1B,SAAS,gBAAgB,UAAkC;AAC9D,QAAM,OAAO,YAAY,QAAQ,IAAI,gBAAgB,IAAI,KAAK;AAC9D,QAAM,QAAQ,IAAI,YAAY;AAC9B,MAAI,UAAU,SAAS,UAAU,UAAU,UAAU,WAAW,UAAU,YAAY;AAClF,WAAO;AAAA,EACX;AACA,QAAM,SAAS,OAAO;AACtB,SAAO,OAAO,QAAQ,QAAQ,EAAE;AACpC;;;ACGA,IAAM,qBAAqB;AAepB,IAAM,yBAAN,MAAM,wBAAyC;AAAA,EAMlD,YAAY,SAAuC,CAAC,GAAG;AALvD,SAAS,OAAO;AAChB,SAAS,UAAU;AAQnB,gBAAO,OAAO,SAAuC;AAAA,IAErD;AAEA,iBAAQ,OAAO,QAAsC;AACjD,UAAI,KAAK,gBAAgB,YAAY;AACjC,YAAI;AACJ,YAAI;AACA,uBAAa,IAAI,WAAW,aAAa;AAAA,QAC7C,QAAQ;AACJ,cAAI,QAAQ,OAAO,0FAAqF;AACxG;AAAA,QACJ;AACA,YAAI,CAAC,cAAc,OAAO,WAAW,cAAc,YAAY;AAC3D,cAAI,QAAQ,OAAO,gGAA2F;AAC9G;AAAA,QACJ;AAEA,cAAM,SAAS,WAAW,UAAU;AACpC,cAAM,WAAW,KAAK;AAEtB,cAAM,UAAU,OAAO,GAAQ,SAAc;AACzC,cAAI,CAAC,UAAU;AACX,mBAAO,EAAE,KAAK;AAAA,cACV,SAAS;AAAA,cACT,OAAO;AAAA,gBACH,MAAM;AAAA,gBACN,SAAS;AAAA,cACb;AAAA,YACJ,GAAG,GAAG;AAAA,UACV;AACA,cAAI;AACA,kBAAM,cAAc,IAAI,IAAI,EAAE,IAAI,GAAG;AAKrC,gBAAI,YAAY,SAAS,WAAW,GAAG,kBAAkB,gBAAgB,GAAG;AACxE,qBAAO,KAAK;AAAA,YAChB;AAEA,kBAAM,SAAS,GAAG,QAAQ,GAAG,YAAY,QAAQ,GAAG,YAAY,MAAM;AAMtE,kBAAM,SAAS,OAAO,EAAE,IAAI,UAAU,KAAK,EAAE,YAAY;AACzD,gBAAI,WAAW,SAAS,WAAW,QAAQ;AACvC,qBAAO,EAAE,KAAK;AAAA,gBACV,SAAS;AAAA,gBACT,OAAO;AAAA,kBACH,MAAM;AAAA,kBACN,SAAS;AAAA,gBACb;AAAA,cACJ,GAAG,GAAG;AAAA,YACV;AAEA,kBAAM,OAAO,MAAM,MAAM,QAAQ;AAAA,cAC7B;AAAA,cACA,SAAS;AAAA;AAAA;AAAA;AAAA,gBAIL,UAAU,EAAE,IAAI,OAAO,QAAQ,KAAK;AAAA,gBACpC,cAAc,8BAA8B,wBAAuB,UAAU,WAAW,OAAO;AAAA,cACnG;AAAA,YACJ,CAAC;AAED,kBAAM,UAAU,IAAI,QAAQ;AAC5B,kBAAM,qBAAqB,CAAC,gBAAgB,iBAAiB,QAAQ,eAAe;AACpF,uBAAW,KAAK,oBAAoB;AAChC,oBAAM,IAAI,KAAK,QAAQ,IAAI,CAAC;AAC5B,kBAAI,EAAG,SAAQ,IAAI,GAAG,CAAC;AAAA,YAC3B;AAEA,kBAAM,OAAO,MAAM,KAAK,YAAY;AACpC,mBAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,QAAQ,CAAC;AAAA,UAC9D,SAAS,KAAU;AACf,kBAAM,SAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,KAAK,WAAW,OAAO,GAAG,CAAC;AACjF,gBAAI,QAAQ,QAAQ,yCAAyC,MAAM;AACnE,mBAAO,EAAE,KAAK;AAAA,cACV,SAAS;AAAA,cACT,OAAO;AAAA,gBACH,MAAM;AAAA,gBACN,SAAS,KAAK,WAAW,OAAO,GAAG;AAAA,cACvC;AAAA,YACJ,GAAG,GAAG;AAAA,UACV;AAAA,QACJ;AAEA,YAAI,OAAO,OAAO,QAAQ,YAAY;AAClC,iBAAO,IAAI,GAAG,kBAAkB,MAAM,OAAO;AAAA,QACjD,OAAO;AACH,qBAAW,KAAK,CAAC,OAAO,MAAM,GAAY;AACtC,gBAAI;AAAE,qBAAO,CAAC,IAAI,GAAG,kBAAkB,MAAM,OAAO;AAAA,YAAG,QAAQ;AAAA,YAAoB;AAAA,UACvF;AAAA,QACJ;AAEA,YAAI,QAAQ,OAAO,uCAAuC,kBAAkB,aAAQ,YAAY,gBAAgB,EAAE;AAAA,MACtH,CAAC;AAAA,IACL;AAxGI,SAAK,WAAW,gBAAgB,OAAO,eAAe;AAAA,EAC1D;AAwGJ;;;ACrIA,SAAS,YAAAC,WAAU,YAAY;AAC/B,SAAS,WAAWC,oBAAmB;AAyChC,IAAM,wBAAN,MAA4B;AAAA,EAU/B,YAAY,SAAsC,CAAC,GAAG;AAClD,UAAM,MAAM,QAAQ,IAAI;AACxB,SAAK,eAAeA;AAAA,MAChB;AAAA,MACA,OAAO,gBACA,QAAQ,IAAI,oBACZ;AAAA,IACX;AACA,SAAK,gBAAgB,OAAO,iBACrB,QAAQ,IAAI,qBACZ;AACP,SAAK,iBAAiB,OAAO,kBACtB,QAAQ,IAAI,sBACZ;AACP,SAAK,kBAAkB,OAAO;AAC9B,SAAK,QAAQ,OAAO,SAAS;AAC7B,SAAK,SAAS,OAAO,UAAU;AAAA,EACnC;AAAA,EAEA,MAAM,gBAAgB,OAAiD;AAEnE,UAAM,UAAU,KAAK,mBAAoB,MAAM,KAAK,wBAAwB;AAC5E,WAAO;AAAA,MACH,eAAe,KAAK;AAAA,MACpB,gBAAgB,KAAK;AAAA,MACrB,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjC;AAAA,EACJ;AAAA,EAEA,MAAM,cAAc,gBAAwB,OAA0E;AAClH,WAAO,KAAK,aAAa;AAAA,EAC7B;AAAA,EAEA,MAAM,uBAAuB,UAAsF;AAC/G,WAAO,EAAE,eAAe,KAAK,eAAe,gBAAgB,KAAK,eAAe;AAAA,EACpF;AAAA,EAEA,MAAM,gBACF,gBACA,aACiE;AACjE,UAAM,WAAW,MAAM,KAAK,aAAa;AACzC,WAAO,WACD,EAAE,UAAU,SAAS,YAAY,SAAS,aAAa,KAAK,IAC5D;AAAA,EACV;AAAA,EAEA,WAAW,gBAA8B;AACrC,SAAK,SAAS;AAAA,EAClB;AAAA,EAEA,QAAc;AACV,SAAK,SAAS;AAAA,EAClB;AAAA,EAEA,MAAc,eAA4D;AACtE,QAAI;AACA,YAAM,QAAQ,MAAM,KAAK,KAAK,YAAY;AAC1C,YAAM,UAAU,MAAM;AACtB,UAAI,CAAC,KAAK,SAAS,KAAK,OAAQ,QAAO,KAAK,OAAO;AACnD,UAAI,KAAK,UAAU,KAAK,OAAO,YAAY,QAAS,QAAO,KAAK,OAAO;AAEvE,YAAM,MAAM,MAAMD,UAAS,KAAK,cAAc,MAAM;AACpD,YAAM,SAAS,KAAK,MAAM,GAAG;AAG7B,YAAM,aAAa,UAAU,OAAO,WAAW,YACxC,OAAO,OAAO,aAAa,YAC3B,OAAO,aAAa;AAC3B,YAAM,WAAW,aAAa,OAAO,WAAW;AAChD,YAAM,UAAU,KAAK,oBACb,aAAa,OAAO,UAAU,WAC/B,KAAK,0BAA0B,QAAQ,KACvC,KAAK,0BAA0B;AACtC,YAAM,WAAwC;AAAA,QAC1C,eAAe,OAAO,iBAAiB;AAAA,QACvC,eAAe,OAAO,iBAAiB,KAAK;AAAA,QAC5C,UAAU,OAAO,YAAY;AAAA,QAC7B,UAAU,OAAO,YAAY;AAAA,QAC7B,aAAa,OAAO,gBAAe,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC1D;AAAA,QACA,WAAW,OAAO;AAAA,QAClB,UAAU,OAAO;AAAA,QACjB,SAAS;AAAA,UACL,gBAAgB,KAAK;AAAA,UACrB,GAAG;AAAA,QACP;AAAA,MACJ;AACA,WAAK,SAAS,EAAE,SAAS,SAAS;AAClC,aAAO;AAAA,IACX,SAAS,KAAU;AACf,WAAK,OAAO,QAAQ,mDAAmD;AAAA,QACnE,cAAc,KAAK;AAAA,QACnB,OAAO,KAAK,WAAW;AAAA,MAC3B,CAAC;AACD,aAAO;AAAA,IACX;AAAA,EACJ;AAAA,EAEA,MAAc,0BAAyE;AACnF,UAAM,WAAW,MAAM,KAAK,aAAa;AACzC,WAAO,UAAU;AAAA,EACrB;AAAA,EAEQ,0BAA0B,UAAqD;AACnF,UAAM,cAAc,UAAU;AAC9B,QAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,YAAY,WAAW,EAAG,QAAO;AACpE,UAAM,UAA6B,UAAU;AAC7C,QAAI;AACJ,QAAI,SAAS;AACT,YAAM,MAAM,QAAQ,KAAK,CAAC,MAAW,GAAG,YAAY,IAAI;AACxD,UAAI,KAAK,WAAY,iBAAgB,IAAI;AAAA,IAC7C;AACA,UAAM,KAAK,gBACL,YAAY,KAAK,CAAC,MAAW,GAAG,SAAS,aAAa,KAAK,YAAY,CAAC,IACxE,YAAY,CAAC;AACnB,QAAI,CAAC,MAAM,OAAO,OAAO,SAAU,QAAO;AAC1C,UAAM,SAAU,GAAG,UAAU,CAAC;AAC9B,UAAM,MAAM,OAAO,OAAO,OAAO,oBAAoB,OAAO,cAAc,OAAO;AACjF,UAAM,SAAS,GAAG;AAClB,QAAI,OAAO,WAAW,YAAY,OAAO,QAAQ,SAAU,QAAO;AAClE,WAAO;AAAA,MACH,gBAAgB;AAAA,MAChB,aAAa;AAAA,MACb,mBAAmB,OAAO,OAAO,cAAc,WAAW,OAAO,YAAY;AAAA,IACjF;AAAA,EACJ;AAAA,EAEQ,4BAAsD;AAC1D,UAAM,MAAM,QAAQ,IAAI;AACxB,UAAM,SAASC,aAAY,KAAK,qBAAqB,GAAG,KAAK,aAAa,KAAK;AAC/E,WAAO;AAAA,MACH,gBAAgB;AAAA,MAChB,aAAa,QAAQ,MAAM;AAAA,IAC/B;AAAA,EACJ;AACJ;;;AC9HA,eAAe,0BAA6C;AACxD,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,uBAAuB;AAC/D,QAAM,EAAE,cAAAC,cAAa,IAAI,MAAM;AAC/B,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,uBAAuB;AAC/D,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,4BAA4B;AAEpE,QAAM,SAAS,IAAI,eAAe;AAClC,QAAM,aAAa;AAEnB,QAAM,SAAsB,EAAE,IAAI,KAAK;AACvC,QAAM,WAAmB;AAAA,IACrB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,KAAK,KAAoB;AAC3B,YAAM,SAAS,IAAI,eAAe;AAClC,MAAC,KAAa,SAAS;AACvB,UAAK,OAAe,KAAM,OAAO,OAAe,KAAK,GAAG;AAKxD,aAAO,KAAM,OAAe,MAAM;AAAA,IACtC;AAAA,IACA,MAAM,MAAM,KAAoB;AAC5B,YAAM,SAAU,KAAa;AAM7B,UAAI,QAAQ,MAAO,OAAM,OAAO,MAAM,GAAG;AAAA,IAC7C;AAAA,IACA,MAAM,UAAU;AACZ,YAAM,SAAU,KAAa;AAC7B,UAAI,QAAQ,QAAS,OAAM,OAAO,QAAQ;AAAA,eACjC,QAAQ,KAAM,OAAM,OAAO,KAAK;AAAA,IAC7C;AAAA,EACJ;AAEA,QAAM,oBAA4B;AAAA,IAC9B,MAAM;AAAA,IACN,SAAS;AAAA,IACT,cAAc,CAAC,iCAAiC;AAAA,IAChD,MAAM,OAAO;AACT,YAAM,KAAK,OAAO;AAClB,UAAI,IAAI,sBAAsB;AAC1B,WAAG,qBAAqB;AAAA,UACpB,EAAE,SAAS,MAAM,YAAY,0BAA0B,UAAU,GAAG;AAAA,QACxE,CAAC;AAAA,MACL;AAAA,IACJ;AAAA,EACJ;AAEA,QAAM,eAAe,IAAIA,cAAa,QAAe,UAAU;AAE/D,QAAM,WAAW,IAAI,eAAe;AAAA,IAChC,OAAO;AAAA;AAAA;AAAA,IAGP,uBAAuB;AAAA,EAC3B,CAAC;AAED,SAAO,CAAC,UAAU,mBAAmB,cAAmC,QAA6B;AACzG;AAQA,IAAM,4BAAN,MAAkD;AAAA,EAQ9C,YAAY,QAA6B;AAPzC,SAAS,OAAO;AAChB,SAAS,UAAU;AAUnB,gBAAO,OAAO,QAAsC;AAChD,YAAM,SAAoD,KAAK,OAAO,WAC9D,KAAK,OAAO,oBAAoB,SAC9B,IAAI,sBAAsB;AAAA,QACxB,GAAI,KAAK,OAAO,cAAc,CAAC;AAAA,QAC/B,QAAQ,IAAI;AAAA,MAChB,CAAC,IACC,IAAI,kBAAkB;AAAA,QACpB,iBAAiB,KAAK,OAAO;AAAA,QAC7B,QAAQ,KAAK,OAAO;AAAA,QACpB,YAAY,KAAK,OAAO;AAAA,QACxB,QAAQ,IAAI;AAAA,MAChB,CAAC;AACT,WAAK,SAAS;AAEd,YAAM,cAAyC,IAAI,4BAA4B;AAAA,QAC3E;AAAA,QACA,YAAY,KAAK,OAAO;AAAA,QACxB,QAAQ,IAAI;AAAA,MAChB,CAAC;AAED,YAAM,UAAU,IAAI,sBAAsB;AAAA,QACtC;AAAA,QACA;AAAA,QACA,QAAQ,IAAI;AAAA,MAChB,CAAC;AAED,YAAM,gBAAgB,IAAI,cAAc;AAAA,QACpC;AAAA,QACA,SAAS,KAAK,OAAO;AAAA,QACrB,OAAO,KAAK,OAAO;AAAA,QACnB,QAAQ,IAAI;AAAA,MAChB,CAAC;AACD,WAAK,gBAAgB;AAErB,UAAI,gBAAgB,gBAAgB,WAAW;AAC/C,UAAI,gBAAgB,kBAAkB,aAAa;AACnD,UAAI,gBAAgB,uBAAuB,MAAM;AAEjD,UAAI,OAAO,OAAO,uEAAuE;AAAA,QACrF,MAAM,KAAK,OAAO,oBAAoB,SAAS,SAAS;AAAA,QACxD,iBAAiB,KAAK,OAAO;AAAA,MACjC,CAAC;AAAA,IACL;AAEA,mBAAU,YAA2B;AACjC,UAAI;AAAE,cAAM,KAAK,eAAe,SAAS;AAAA,MAAG,QAAQ;AAAA,MAAoB;AACxE,UAAI;AAAE,aAAK,QAAQ,MAAM;AAAA,MAAG,QAAQ;AAAA,MAAoB;AAAA,IAC5D;AAnDI,SAAK,SAAS;AAAA,EAClB;AAmDJ;AAEA,eAAsB,oBAAoB,QAA2D;AACjG,MAAI,CAAC,OAAO,mBAAmB,CAAC,OAAO,QAAQ;AAC3C,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACxF;AACA,QAAM,SAA8B;AAAA,IAChC,GAAG;AAAA,IACH,iBAAiB,OAAO,QAAQ,IAAI,wBAAwB,OAAO,mBAAmB,EAAE;AAAA,IACxF,aAAa,OAAO,QAAQ,IAAI,oBAAoB,OAAO,eAAe,KAAK,KAAK,GAAI;AAAA,IACxF,eAAe,OAAO,QAAQ,IAAI,uBAAuB,OAAO,iBAAiB,IAAI,KAAK,GAAI;AAAA,IAC9F,oBAAoB,OAAO,QAAQ,IAAI,4BAA4B,OAAO,sBAAsB,IAAI,KAAK,GAAI;AAAA,EACjH;AAEA,QAAM,gBAAgB,MAAM,wBAAwB;AAEpD,SAAO;AAAA,IACH,SAAS,CAAC,GAAG,eAAe,IAAI,0BAA0B,MAAM,GAAG,IAAI,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,iBAAiB,OAAO,oBAAoB,SAAS,SAAY,OAAO,gBAAgB,CAAC,CAAC;AAAA,IACjN,KAAK;AAAA,MACD,sBAAsB;AAAA,MACtB,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMnB,aAAa;AAAA,IACjB;AAAA,EACJ;AACJ;;;AC7MA,SAAS,cAAAC,aAAY,aAAAC,YAAW,cAAc,aAAa,YAAY,qBAAqB;AAC5F,SAAS,MAAM,eAAe;AAI9B,IAAM,aAAa;AACnB,IAAM,cAAc;AAuBpB,SAAS,aAAa,YAA4B;AAC9C,SAAO,WAAW,QAAQ,oBAAoB,GAAG,IAAI;AACzD;AAEO,IAAM,gCAAN,MAAsD;AAAA,EAOzD,YAAY,SAA8C,CAAC,GAAG;AAN9D,SAAS,OAAO;AAChB,SAAS,UAAU;AAYnB,gBAAO,OAAO,SAAuC;AAAA,IAErD;AAEA,iBAAQ,OAAO,QAAsC;AACjD,UAAI,KAAK,gBAAgB,YAAY;AAEjC,cAAM,KAAK,UAAU,GAAG;AAGxB,YAAI;AACJ,YAAI;AACA,uBAAa,IAAI,WAAW,aAAa;AAAA,QAC7C,QAAQ;AACJ,cAAI,QAAQ,OAAO,0FAAqF;AACxG;AAAA,QACJ;AACA,YAAI,CAAC,cAAc,OAAO,WAAW,cAAc,YAAY;AAC3D,cAAI,QAAQ,OAAO,gGAA2F;AAC9G;AAAA,QACJ;AACA,cAAM,SAAS,WAAW,UAAU;AAEpC,cAAM,cAAc,OAAO,MAAW,KAAK,cAAc,GAAG,GAAG;AAC/D,cAAM,aAAa,OAAO,MAAW,KAAK,WAAW,CAAC;AACtD,cAAM,gBAAgB,OAAO,MAAW,KAAK,gBAAgB,GAAG,GAAG;AAEnE,YAAI,OAAO,OAAO,SAAS,WAAY,QAAO,KAAK,YAAY,WAAW;AAC1E,YAAI,OAAO,OAAO,QAAQ,WAAY,QAAO,IAAI,YAAY,UAAU;AACvE,YAAI,OAAO,OAAO,WAAW,WAAY,QAAO,OAAO,GAAG,UAAU,gBAAgB,aAAa;AAEjG,YAAI,QAAQ,OAAO,wCAAwC,UAAU,cAAc,KAAK,UAAU,GAAG;AAAA,MACzG,CAAC;AAAA,IACL;AASA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAQ,YAAY,OAAO,QAAsC;AAC7D,YAAM,UAAU,KAAK,QAAQ;AAC7B,UAAI,QAAQ,WAAW,EAAG;AAE1B,UAAI,kBAAqD;AACzD,UAAI;AACA,0BAAkB,IAAI,WAAW,UAAU;AAAA,MAC/C,QAAQ;AACJ,YAAI,QAAQ,OAAO,0EAAqE;AACxF;AAAA,MACJ;AAEA,iBAAW,SAAS,SAAS;AACzB,YAAI;AACA,0BAAiB,SAAS,MAAM,QAAQ;AAIxC,cAAI;AACA,kBAAM,KAAU,IAAI,WAAW,UAAU;AACzC,gBAAI,MAAM,OAAO,GAAG,gBAAgB,WAAY,OAAM,GAAG,YAAY;AAAA,UACzE,QAAQ;AAAA,UAAkB;AAK1B,gBAAM,KAAK,iBAAiB,KAAK,MAAM,UAAU,EAAE,SAAS,MAAM,CAAC;AACnE,cAAI,QAAQ,OAAO,wCAAwC,MAAM,UAAU,IAAI,MAAM,OAAO,EAAE;AAAA,QAClG,SAAS,KAAU;AACf,cAAI,QAAQ,QAAQ,kDAAkD,MAAM,UAAU,IAAI,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,QACjJ;AAAA,MACJ;AAAA,IACJ;AAEA,SAAQ,gBAAgB,OAAO,GAAQ,QAA0C;AAC7E,UAAI,CAAC,KAAK,UAAU;AAChB,eAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,2BAA2B,SAAS,+BAA+B,EAAE,GAAG,GAAG;AAAA,MAC9H;AACA,YAAM,SAAS,MAAM,KAAK,yBAAyB,GAAG,GAAG;AACzD,UAAI,CAAC,QAAQ;AACT,eAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,gBAAgB,SAAS,+CAA+C,EAAE,GAAG,GAAG;AAAA,MACnI;AAEA,UAAI,OAAY,CAAC;AACjB,UAAI;AAAE,eAAO,MAAM,EAAE,IAAI,KAAK;AAAA,MAAG,QAAQ;AAAA,MAAmB;AAC5D,YAAM,YAAY,OAAO,MAAM,aAAa,EAAE,EAAE,KAAK;AACrD,YAAM,YAAY,OAAO,MAAM,aAAa,QAAQ,EAAE,KAAK,KAAK;AAChE,UAAI,CAAC,WAAW;AACZ,eAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,eAAe,SAAS,yBAAyB,EAAE,GAAG,GAAG;AAAA,MAC5G;AAGA,UAAI;AACJ,UAAI;AACA,cAAM,MAAM,GAAG,KAAK,QAAQ,gCAAgC,mBAAmB,SAAS,CAAC,aAAa,mBAAmB,SAAS,CAAC;AACnI,cAAM,OAAO,MAAM,MAAM,KAAK,EAAE,SAAS,EAAE,UAAU,mBAAmB,EAAE,CAAC;AAC3E,YAAI,CAAC,KAAK,IAAI;AACV,gBAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,MAAM,EAAE;AAC7C,iBAAO,EAAE,KAAK;AAAA,YACV,SAAS;AAAA,YACT,OAAO,EAAE,MAAM,sBAAsB,SAAS,kBAAkB,KAAK,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC,GAAG;AAAA,UACzG,GAAG,KAAK,WAAW,MAAM,MAAM,GAAG;AAAA,QACtC;AACA,kBAAU,MAAM,KAAK,KAAK;AAAA,MAC9B,SAAS,KAAU;AACf,eAAO,EAAE,KAAK;AAAA,UACV,SAAS;AAAA,UACT,OAAO,EAAE,MAAM,sBAAsB,SAAS,KAAK,WAAW,OAAO,GAAG,EAAE;AAAA,QAC9E,GAAG,GAAG;AAAA,MACV;AAEA,YAAM,OAAO,SAAS,QAAQ;AAC9B,YAAM,WAAW,MAAM;AACvB,YAAM,oBAAoB,OAAO,MAAM,cAAc,SAAS;AAC9D,YAAM,UAAU,OAAO,MAAM,WAAW,SAAS;AACjD,YAAM,aAAa,OAAO,UAAU,MAAM,UAAU,QAAQ,EAAE;AAC9D,UAAI,CAAC,YAAY,CAAC,YAAY;AAC1B,eAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,oBAAoB,SAAS,8CAA8C,EAAE,GAAG,GAAG;AAAA,MACtI;AAGA,YAAM,WAAW,KAAK,aAAa,KAAK,UAAU;AAClD,UAAI,aAAa,aAAa;AAC1B,eAAO,EAAE,KAAK;AAAA,UACV,SAAS;AAAA,UACT,OAAO;AAAA,YACH,MAAM;AAAA,YACN,SAAS,gBAAgB,UAAU;AAAA,UACvC;AAAA,QACJ,GAAG,GAAG;AAAA,MACV;AAGA,YAAM,QAAwB;AAAA,QAC1B;AAAA,QACA,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC,aAAa;AAAA,MACjB;AACA,UAAI;AACA,QAAAC,WAAU,KAAK,YAAY,EAAE,WAAW,KAAK,CAAC;AAC9C,sBAAc,KAAK,KAAK,YAAY,aAAa,UAAU,CAAC,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,MAAM;AAAA,MACzG,SAAS,KAAU;AACf,eAAO,EAAE,KAAK;AAAA,UACV,SAAS;AAAA,UACT,OAAO,EAAE,MAAM,kBAAkB,SAAS,+BAA+B,KAAK,WAAW,GAAG,GAAG;AAAA,QACnG,GAAG,GAAG;AAAA,MACV;AAGA,UAAI;AACA,cAAM,kBAAkB,IAAI,WAAW,UAAU;AACjD,wBAAgB,SAAS,QAAQ;AAAA,MACrC,SAAS,KAAU;AAGf,YAAI,QAAQ,OAAO,qDAAqD,UAAU,iCAAiC,KAAK,WAAW,GAAG,EAAE;AAAA,MAC5I;AAMA,UAAI;AACA,cAAM,KAAU,IAAI,WAAW,UAAU;AACzC,YAAI,MAAM,OAAO,GAAG,gBAAgB,YAAY;AAC5C,gBAAM,GAAG,YAAY;AACrB,cAAI,QAAQ,OAAO,iEAAiE,UAAU,EAAE;AAAA,QACpG;AAAA,MACJ,SAAS,KAAU;AACf,YAAI,QAAQ,OAAO,oDAAoD,UAAU,KAAK,KAAK,WAAW,GAAG,EAAE;AAAA,MAC/G;AAOA,YAAM,gBAAgB,MAAM,KAAK,iBAAiB,KAAK,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;AAErF,aAAO,EAAE,KAAK;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,UACF;AAAA,UACA;AAAA,UACA,WAAW;AAAA,UACX,aAAa,MAAM;AAAA,UACnB,WAAW;AAAA,UACX,cAAc,aAAa,gBAAgB,iCAAiC;AAAA,UAC5E,oBAAoB,cAAc;AAAA,UAClC,QAAQ,cAAc;AAAA,UACtB,MAAM;AAAA,QACV;AAAA,MACJ,GAAG,GAAG;AAAA,IACV;AAEA,SAAQ,aAAa,OAAO,MAA8B;AACtD,YAAM,UAAU,KAAK,QAAQ;AAC7B,aAAO,EAAE,KAAK;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,UACF,OAAO,QAAQ,IAAI,QAAM;AAAA,YACrB,WAAW,EAAE;AAAA,YACb,WAAW,EAAE;AAAA,YACb,YAAY,EAAE;AAAA,YACd,SAAS,EAAE;AAAA,YACX,aAAa,EAAE;AAAA,YACf,aAAa,EAAE;AAAA,UACnB,EAAE;AAAA,UACF,OAAO,QAAQ;AAAA,UACf,YAAY,KAAK;AAAA,QACrB;AAAA,MACJ,GAAG,GAAG;AAAA,IACV;AAEA,SAAQ,kBAAkB,OAAO,GAAQ,QAA0C;AAC/E,YAAM,SAAS,MAAM,KAAK,yBAAyB,GAAG,GAAG;AACzD,UAAI,CAAC,QAAQ;AACT,eAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,gBAAgB,SAAS,2BAA2B,EAAE,GAAG,GAAG;AAAA,MAC/G;AACA,YAAM,aAAa,OAAO,EAAE,IAAI,QAAQ,YAAY,KAAK,EAAE,IAAI,QAAQ,cAAc,EAAE,EAAE,KAAK;AAC9F,UAAI,CAAC,YAAY;AACb,eAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,eAAe,SAAS,kCAAkC,EAAE,GAAG,GAAG;AAAA,MACrH;AACA,YAAM,OAAO,KAAK,KAAK,YAAY,aAAa,UAAU,CAAC;AAC3D,UAAI,CAACC,YAAW,IAAI,GAAG;AACnB,eAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,aAAa,SAAS,8BAA8B,UAAU,IAAI,EAAE,GAAG,GAAG;AAAA,MAC7H;AACA,UAAI;AACA,mBAAW,IAAI;AAAA,MACnB,SAAS,KAAU;AACf,eAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,kBAAkB,SAAS,KAAK,WAAW,OAAO,GAAG,EAAE,EAAE,GAAG,GAAG;AAAA,MAClH;AACA,UAAI,QAAQ,OAAO,yCAAyC,UAAU,2EAA2E;AACjJ,aAAO,EAAE,KAAK;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,UACF;AAAA,UACA,MAAM;AAAA,QACV;AAAA,MACJ,GAAG,GAAG;AAAA,IACV;AAWA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAQ,eAAe,CAAC,KAAoB,eAA6D;AAErG,UAAIA,YAAW,KAAK,KAAK,YAAY,aAAa,UAAU,CAAC,CAAC,GAAG;AAC7D,eAAO;AAAA,MACX;AAEA,UAAI;AACA,cAAM,KAAU,IAAI,WAAW,UAAU;AACzC,cAAM,WAAkB,IAAI,UAAU,iBAAiB,KAAK,CAAC;AAC7D,cAAM,MAAM,SAAS;AAAA,UAAK,CAAC,OACtB,GAAG,UAAU,MAAM,GAAG,MAAM,GAAG,UAAU,UAAU;AAAA,QACxD;AACA,YAAI,IAAK,QAAO;AAAA,MACpB,QAAQ;AAAA,MAAqD;AAC7D,aAAO;AAAA,IACX;AAkCA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAQ,mBAAmB,OACvB,KACA,UACA,SACsK;AACtK,YAAM,QAAQ,OAAO,UAAU,MAAM,SAAS;AAC9C,UAAI,qBAAqB;AACzB,UAAI,cAAmB,EAAE,MAAM,WAAW,QAAQ,cAAc;AAGhE,UAAI;AACA,cAAM,UAA0C,CAAC;AACjD,YAAI,MAAM,QAAQ,UAAU,YAAY,EAAG,SAAQ,KAAK,GAAG,SAAS,YAAY;AAChF,YAAI,MAAM,QAAQ,UAAU,IAAI,EAAG,SAAQ,KAAK,GAAG,SAAS,IAAI;AAEhE,YAAI,QAAQ,SAAS,GAAG;AACpB,cAAI;AACJ,cAAI;AAAE,0BAAc,IAAI,WAAW,MAAM;AAAA,UAAG,QAAQ;AAAA,UAAuB;AAC3E,cAAI,CAAC,aAAa;AACd,gBAAI;AACA,oBAAM,MAAM,MAAM,OAAO,mBAAmB;AAC5C,oBAAM,mBAAoB,IAAY;AACtC,kBAAI,OAAO,qBAAqB,YAAY;AACxC,8BAAc,iBAAiB;AAC/B,gBAAC,IAAY,kBAAkB,QAAQ,WAAW;AAClD,oBAAI,QAAQ,OAAO,0EAA0E,KAAK,GAAG;AAAA,cACzG;AAAA,YACJ,QAAQ;AAAA,YAA6B;AAAA,UACzC;AACA,cAAI,aAAa,kBAAkB;AAC/B,uBAAW,UAAU,SAAS;AAC1B,yBAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,oBAAI,QAAQ,OAAO,SAAS,UAAU;AAClC,sBAAI;AACA,gCAAY,iBAAiB,QAAQ,IAA+B;AACpE;AAAA,kBACJ,SAAS,KAAU;AACf,wBAAI,QAAQ,OAAO,4CAA4C,KAAK,qBAAqB,MAAM,KAAK,KAAK,WAAW,GAAG,EAAE;AAAA,kBAC7H;AAAA,gBACJ;AAAA,cACJ;AAAA,YACJ;AACA,gBAAI,QAAQ,OAAO,oCAAoC,kBAAkB,yBAAyB,KAAK,EAAE;AAAA,UAC7G;AAAA,QACJ;AAAA,MACJ,SAAS,KAAU;AACf,YAAI,QAAQ,OAAO,yDAAyD,KAAK,KAAK,KAAK,WAAW,GAAG,EAAE;AAAA,MAC/G;AAGA,YAAM,WAAW,MAAM,QAAQ,UAAU,IAAI,IACvC,SAAS,KAAK,OAAO,CAAC,MAAW,KAAK,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,CAAC,IAC1E,CAAC;AAEP,UAAI,SAAS,SAAS,GAAG;AACrB,YAAI;AACA,gBAAM,SAAe,IAAY;AACjC,cAAI,WAAkB,CAAC;AACvB,cAAI;AACA,kBAAM,IAAI,QAAQ,aAAa,eAAe;AAC9C,gBAAI,MAAM,QAAQ,CAAC,EAAG,YAAW;AAAA,UACrC,QAAQ;AAAA,UAAc;AACtB,gBAAM,SAAS,CAAC,GAAG,UAAU,GAAG,QAAQ;AACxC,cAAI,QAAQ,gBAAiB,QAAO,gBAAgB,iBAAiB,MAAM;AAAA,cACtE,CAAC,IAAY,kBAAkB,iBAAiB,MAAM;AAC3D,cAAI,QAAQ,OAAO,oCAAoC,SAAS,MAAM,wCAAwC,OAAO,MAAM,GAAG;AAAA,QAClI,SAAS,KAAU;AACf,cAAI,QAAQ,OAAO,4DAA4D,KAAK,WAAW,GAAG,EAAE;AAAA,QACxG;AAAA,MACJ;AAUA,UAAI,KAAK,WAAW,SAAS,SAAS,GAAG;AACrC,cAAM,cAAc,OAAO,QAAQ,IAAI,mBAAmB,MAAM,EAAE,YAAY,MAAM;AACpF,YAAI;AACA,gBAAM,KAAU,IAAI,WAAW,UAAU;AACzC,cAAI;AACJ,cAAI;AAAE,uBAAW,IAAI,WAAW,UAAU;AAAA,UAAG,QAAQ;AAAA,UAAa;AAClE,cAAI,CAAC,MAAM,CAAC,UAAU;AAClB,0BAAc,EAAE,MAAM,WAAW,QAAQ,+BAA+B;AAAA,UAC5E,OAAO;AACH,gBAAI;AACJ,gBAAI,aAAa;AACb,oBAAM,WAAW,MAAM,KAAK,mBAAmB,KAAK,GAAG,GAAG;AAC1D,kBAAI,SAAU,kBAAiB;AAAA,mBAC1B;AACD,8BAAc,EAAE,MAAM,WAAW,QAAQ,6BAA6B;AACtE,oBAAI,QAAQ,OAAO,yFAAoF;AAAA,cAC3G;AAAA,YACJ;AACA,gBAAI,CAAC,eAAe,gBAAgB;AAChC,oBAAM,CAAC,EAAE,mBAAAC,mBAAkB,GAAG,EAAE,wBAAwB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,gBAC3E;AAAA,gBACA,OAAO,wBAAwB;AAAA,cACnC,CAAC;AACD,oBAAM,aAAa,IAAKA,mBAA0B,IAAI,UAAU,IAAI,MAAM;AAC1E,oBAAM,UAAW,wBAAgC,MAAM;AAAA,gBACnD;AAAA,gBACA,QAAQ;AAAA,kBACJ,aAAa;AAAA,kBACb,WAAW;AAAA,kBACX,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,gBAC/C;AAAA,cACJ,CAAC;AACD,oBAAM,SAAS,MAAM,WAAW,KAAK,OAAO;AAC5C,4BAAc;AAAA,gBACV,MAAM;AAAA,gBACN,UAAU,OAAO,QAAQ;AAAA,gBACzB,SAAS,OAAO,QAAQ;AAAA,gBACxB,QAAQ,OAAO,OAAO;AAAA,cAC1B;AACA,kBAAI,QAAQ,OAAO,6CAA6C,KAAK,GAAG,iBAAiB,SAAS,cAAc,MAAM,EAAE,cAAc,YAAY,QAAQ,YAAY,YAAY,OAAO,WAAW,YAAY,MAAM,EAAE;AAAA,YAC5N;AAAA,UACJ;AAAA,QACJ,SAAS,KAAU;AACf,wBAAc,EAAE,MAAM,WAAW,QAAQ,eAAe,KAAK,WAAW,GAAG,GAAG;AAC9E,cAAI,QAAQ,OAAO,iDAAiD,KAAK,KAAK,KAAK,WAAW,GAAG,EAAE;AAAA,QACvG;AAAA,MACJ;AAEA,aAAO,EAAE,oBAAoB,QAAQ,YAAY;AAAA,IACrD;AAQA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAQ,qBAAqB,OAAO,GAAQ,QAA+C;AACvF,UAAI,CAAC,GAAG,KAAK,KAAK,QAAS,QAAO;AAClC,UAAI;AACA,cAAM,cAAmB,IAAI,WAAW,MAAM;AAC9C,YAAI,MAAW,aAAa;AAC5B,YAAI,CAAC,OAAO,OAAO,aAAa,WAAW,WAAY,OAAM,MAAM,YAAY,OAAO;AACtF,YAAI,CAAC,KAAK,WAAY,QAAO;AAC7B,cAAM,UAAU,MAAM,IAAI,WAAW,EAAE,SAAS,EAAE,IAAI,IAAI,QAAQ,CAAC;AACnE,cAAM,SAAS,SAAS,SAAS,wBAAwB,SAAS,wBAAwB;AAC1F,YAAI,OAAQ,QAAO,OAAO,MAAM;AAEhC,cAAM,SAAS,SAAS,MAAM;AAC9B,YAAI,CAAC,OAAQ,QAAO;AACpB,YAAI;AACA,gBAAM,KAAU,IAAI,WAAW,UAAU;AACzC,cAAI,IAAI,MAAM;AACV,kBAAM,OAAO,MAAM,GAAG,KAAK,2BAA2B,EAAE,OAAO,EAAE,SAAS,OAAO,GAAG,OAAO,GAAG,SAAS,EAAE,UAAU,KAAK,EAAE,CAAQ;AAClI,kBAAM,MAAM,MAAM,QAAQ,IAAI,IAAI,KAAK,CAAC,IAAK,MAAM,QAAQ,CAAC,KAAK;AACjE,mBAAO,KAAK,kBAAkB,OAAO,IAAI,eAAe,IAAI;AAAA,UAChE;AAAA,QACJ,QAAQ;AAAA,QAAe;AAAA,MAC3B,QAAQ;AAAA,MAAe;AACvB,aAAO;AAAA,IACX;AAEA,SAAQ,2BAA2B,OAAO,GAAQ,QAA+C;AAC7F,UAAI;AAKA,cAAM,cAAmB,IAAI,WAAW,MAAM;AAC9C,YAAI,MAAW,aAAa;AAC5B,YAAI,CAAC,OAAO,OAAO,aAAa,WAAW,YAAY;AACnD,gBAAM,MAAM,YAAY,OAAO;AAAA,QACnC;AACA,YAAI,KAAK,cAAc,GAAG,KAAK,KAAK,SAAS;AACzC,gBAAM,UAAU,MAAM,IAAI,WAAW,EAAE,SAAS,EAAE,IAAI,IAAI,QAAQ,CAAC;AACnE,gBAAM,SAAS,SAAS,MAAM,MAAM;AACpC,cAAI,OAAQ,QAAO,OAAO,MAAM;AAAA,QACpC;AAAA,MACJ,QAAQ;AAAA,MAA8B;AAEtC,YAAM,UAAU,GAAG,KAAK,SAAS,WAAW;AAC5C,UAAI,QAAS,QAAO,OAAO,OAAO;AAClC,aAAO;AAAA,IACX;AAEA,SAAQ,UAAU,MAAwB;AACtC,UAAI,CAACD,YAAW,KAAK,UAAU,EAAG,QAAO,CAAC;AAC1C,YAAM,MAAwB,CAAC;AAC/B,iBAAW,QAAQ,YAAY,KAAK,UAAU,GAAG;AAC7C,YAAI,CAAC,KAAK,SAAS,OAAO,EAAG;AAC7B,YAAI;AACA,gBAAM,MAAM,aAAa,KAAK,KAAK,YAAY,IAAI,GAAG,MAAM;AAC5D,cAAI,KAAK,KAAK,MAAM,GAAG,CAAC;AAAA,QAC5B,QAAQ;AAAA,QAA2B;AAAA,MACvC;AACA,aAAO;AAAA,IACX;AA3fI,SAAK,WAAW,gBAAgB,OAAO,eAAe;AACtD,SAAK,aAAa,OAAO,aACnB,QAAQ,OAAO,UAAU,IACzB,QAAQ,QAAQ,IAAI,GAAG,WAAW;AAAA,EAC5C;AAwfJ;;;A3BheA;;;A4BuCO,IAAM,4BAAN,MAAwD;AAAA;AAAA,EAE7D,eAAe,OAAuB,MAAqB,OAAgD;AACzG,WAAO,QAAQ,OAAO,IAAI,MAAM,8DAA8D,CAAC;AAAA,EACjG;AAAA;AAAA,EAEA,UAAU,OAAmB,MAAqB,OAAgD;AAChG,WAAO,QAAQ,OAAO,IAAI,MAAM,8DAA8D,CAAC;AAAA,EACjG;AAAA,EACA,IAAI,MAAgB,KAAoB,MAA+C;AACrF,WAAO,KAAK,aAAa,eACrB,KAAK,eAAe,MAAM,KAAK,IAAI,IACnC,KAAK,UAAU,MAAM,KAAK,IAAI;AAAA,EACpC;AAAA,EACA,UAAyB;AACvB,WAAO,QAAQ,QAAQ;AAAA,EACzB;AACF;;;AC5JA;AAEA;;;A7B4HA;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAOP,cAAc;","names":["wrapped","resolve","ObjectKernel","resolvePath","DriverPlugin","AppPlugin","resolvePath","resolvePath","ql","protocol","labels","drivers","backfillPlatformSsoClients","seedPlatformSsoClient","path","isHttpUrl","loadArtifactBundle","resolved","result","generateRequestId","generateRequestId","ctx","entry","createHmac","ObjectKernel","createHmac","driver","ObjectKernel","seedProjectOrganization","seedProjectOwner","seedProjectMember","readFile","resolvePath","DriverPlugin","existsSync","mkdirSync","mkdirSync","existsSync","SeedLoaderService"]}
+{"version":3,"sources":["../src/load-artifact-bundle.ts","../src/driver-plugin.ts","../src/seed-loader.ts","../src/sandbox/quickjs-runner.ts","../src/sandbox/body-runner.ts","../src/app-plugin.ts","../src/cloud/platform-sso.ts","../src/cloud/environment-org-seed.ts","../src/cloud/environment-owner-seed.ts","../src/index.ts","../src/runtime.ts","../src/standalone-stack.ts","../src/default-host.ts","../src/http-dispatcher.ts","../src/security/resolve-execution-context.ts","../src/security/security-headers.ts","../src/security/rate-limit.ts","../src/observability/request-context.ts","../src/observability/metrics.ts","../src/observability/error-reporter.ts","../src/observability/instrument.ts","../src/observability/observability-service-plugin.ts","../src/dispatcher-plugin.ts","../src/system-environment-plugin.ts","../src/http-server.ts","../src/middleware.ts","../src/cloud/kernel-manager.ts","../src/cloud/artifact-api-client.ts","../src/cloud/artifact-environment-registry.ts","../src/cloud/artifact-kernel-factory.ts","../src/cloud/capability-loader.ts","../src/cloud/auth-proxy-plugin.ts","../src/cloud/cloud-url.ts","../src/cloud/marketplace-proxy-plugin.ts","../src/cloud/file-artifact-api-client.ts","../src/cloud/objectos-stack.ts","../src/cloud/marketplace-install-local-plugin.ts","../src/sandbox/script-runner.ts","../src/sandbox/index.ts"],"sourcesContent":["// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Shared artifact loader used by every code path that boots a kernel\n * from an `objectstack build` artifact:\n *\n *   - `FsAppBundleResolver`         — cloud / multi-environment file binding\n *   - `runtime-stack.ts:basePlugins` — single-environment local boot\n *   - `StandaloneStack`              — `objectstack serve --standalone`\n *   - `http-dispatcher.ts`           — in-flight artifact rebind\n *\n * Reads the JSON artifact (from a local path *or* an `http(s)://` URL) and,\n * for **local** artifacts only, if the bundle declares a sibling\n * `runtimeModule` (the ESM produced by `packages/cli/src/utils/build-runtime.ts`),\n * dynamic-imports it and merges its `functions` map onto the bundle so\n * declarative Hooks resolve their handlers at boot.\n *\n * For **remote** (`http(s)://`) artifacts the `runtimeModule` reference is\n * intentionally ignored — Node cannot dynamic-import arbitrary URLs and we\n * refuse to execute remote code by default. Remote artifacts are therefore\n * expected to be fully declarative (Hooks/Flows carry their bodies inline).\n *\n * Mutates the returned bundle in place. Returns `null` on read/parse\n * failure (callers may treat as \"no bundle for this project yet\").\n * Runtime-module load failures are logged but non-fatal — the bundle\n * is still returned, just without runtime functions.\n */\n\nimport { readFile } from 'node:fs/promises';\nimport { resolve as resolvePath, isAbsolute, dirname } from 'node:path';\nimport { pathToFileURL } from 'node:url';\n\nexport interface LoadArtifactBundleOptions {\n    /** Optional log tag for warnings (defaults to `[loadArtifactBundle]`). */\n    tag?: string;\n    /** When true, an unwrapped `{ schemaVersion, metadata }` envelope is unwrapped. */\n    unwrapEnvelope?: boolean;\n    /** Optional fetch timeout in ms for `http(s)://` sources (default 15000). */\n    fetchTimeoutMs?: number;\n}\n\n/** Returns true when `pathOrUrl` looks like an `http://` or `https://` URL. */\nexport function isHttpUrl(pathOrUrl: string): boolean {\n    return /^https?:\\/\\//i.test(pathOrUrl);\n}\n\n/**\n * Read a JSON artifact from either a local file path or an `http(s)://` URL.\n * Returns the raw text body. Throws on network or filesystem failure.\n */\nexport async function readArtifactSource(\n    pathOrUrl: string,\n    opts: { fetchTimeoutMs?: number } = {},\n): Promise<string> {\n    if (isHttpUrl(pathOrUrl)) {\n        const timeoutMs = opts.fetchTimeoutMs ?? 15_000;\n        const controller = new AbortController();\n        const timer = setTimeout(() => controller.abort(), timeoutMs);\n        try {\n            const res = await fetch(pathOrUrl, {\n                redirect: 'follow',\n                signal: controller.signal,\n                headers: { Accept: 'application/json, text/plain;q=0.9, */*;q=0.5' },\n            });\n            if (!res.ok) {\n                throw new Error(`HTTP ${res.status} ${res.statusText} for ${pathOrUrl}`);\n            }\n            return await res.text();\n        } finally {\n            clearTimeout(timer);\n        }\n    }\n    return readFile(pathOrUrl, 'utf-8');\n}\n\nexport async function loadArtifactBundle(\n    absArtifactPath: string,\n    opts: LoadArtifactBundleOptions = {},\n): Promise<any | null> {\n    const tag = opts.tag ?? '[loadArtifactBundle]';\n    const isUrl = isHttpUrl(absArtifactPath);\n    let bundle: any;\n    try {\n        const raw = await readArtifactSource(absArtifactPath, { fetchTimeoutMs: opts.fetchTimeoutMs });\n        const parsed = JSON.parse(raw);\n        bundle = opts.unwrapEnvelope && parsed?.schemaVersion != null && parsed?.metadata !== undefined\n            ? parsed.metadata\n            : parsed;\n    } catch (err: any) {\n        // eslint-disable-next-line no-console\n        console.warn(`${tag} artifact read FAILED: path='${absArtifactPath}' error=${err?.message ?? err}`);\n        return null;\n    }\n\n    if (isUrl) {\n        // Remote artifacts cannot dynamic-import a sibling ESM runtime module\n        // safely (Node does not allow importing arbitrary URLs and we never\n        // want to execute remote code by default). Hooks/flow handlers must\n        // be carried in the JSON itself (declarative bodies, sandbox-eval).\n        if (typeof bundle?.runtimeModule === 'string' && bundle.runtimeModule.length > 0) {\n            // eslint-disable-next-line no-console\n            console.warn(\n                `${tag} ignoring runtimeModule='${bundle.runtimeModule}' for remote artifact ${absArtifactPath} ` +\n                `(remote ESM imports are not supported; embed handlers in the JSON instead)`,\n            );\n            // Strip the reference so downstream code doesn't try to resolve it\n            // as a local path against process.cwd().\n            delete bundle.runtimeModule;\n        }\n        return bundle;\n    }\n\n    await mergeRuntimeModule(bundle, absArtifactPath, tag);\n    return bundle;\n}\n\nexport async function mergeRuntimeModule(bundle: any, artifactAbsPath: string, tag = '[loadArtifactBundle]'): Promise<void> {\n    const ref = bundle?.runtimeModule;\n    if (typeof ref !== 'string' || ref.length === 0) return;\n    const moduleAbsPath = isAbsolute(ref) ? ref : resolvePath(dirname(artifactAbsPath), ref);\n    try {\n        const mod: any = await import(pathToFileURL(moduleAbsPath).href);\n        const fns = (mod && (mod.functions ?? mod.default?.functions)) ?? null;\n        if (!fns || typeof fns !== 'object') {\n            // eslint-disable-next-line no-console\n            console.warn(`${tag} runtime module '${moduleAbsPath}' exported no \\`functions\\` map`);\n            return;\n        }\n        const existing = (bundle.functions && typeof bundle.functions === 'object' && !Array.isArray(bundle.functions))\n            ? bundle.functions as Record<string, unknown>\n            : {};\n        bundle.functions = { ...existing, ...fns };\n    } catch (err: any) {\n        // eslint-disable-next-line no-console\n        console.warn(`${tag} runtime module load FAILED: path='${moduleAbsPath}' error=${err?.message ?? err}`);\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Plugin, PluginContext } from '@objectstack/core';\n\n/**\n * Driver Plugin\n * \n * Generic plugin wrapper for ObjectQL drivers.\n * Registers a driver with the ObjectQL engine.\n * \n * Dependencies: None (Registers service for ObjectQL to discover)\n * Services: driver.{name}\n * \n * @example\n * const memoryDriver = new InMemoryDriver();\n * const driverPlugin = new DriverPlugin(memoryDriver, 'memory');\n * kernel.use(driverPlugin);\n */\nexport interface DriverPluginOptions {\n    /**\n     * If set, registers a named datasource so packages declaring\n     * `defaultDatasource: '<name>'` resolve to this driver.\n     */\n    datasourceName?: string;\n    /**\n     * If `true` (default), registers this driver as the `default` datasource\n     * when none exists. Set to `false` for proxy drivers (e.g. cloud proxy)\n     * that should never become the default.\n     */\n    registerAsDefault?: boolean;\n}\n\nexport class DriverPlugin implements Plugin {\n    name: string;\n    type = 'driver';\n    version = '1.0.0';\n\n    private driver: any;\n    private options: DriverPluginOptions;\n\n    constructor(driver: any, driverNameOrOptions?: string | DriverPluginOptions, options?: DriverPluginOptions) {\n        this.driver = driver;\n        const driverName = typeof driverNameOrOptions === 'string' ? driverNameOrOptions : undefined;\n        this.options = (typeof driverNameOrOptions === 'object' ? driverNameOrOptions : options) ?? {};\n        this.name = `com.objectstack.driver.${driverName || driver.name || 'unknown'}`;\n    }\n\n    init = async (ctx: PluginContext) => {\n        const serviceName = `driver.${this.driver.name || 'unknown'}`;\n        ctx.registerService(serviceName, this.driver);\n        ctx.logger.info('Driver service registered', { \n            serviceName, \n            driverName: this.driver.name,\n            driverVersion: this.driver.version \n        });\n    }\n\n    start = async (ctx: PluginContext) => {\n        try {\n            const metadata = ctx.getService<any>('metadata');\n            if (!metadata?.addDatasource) return;\n\n            // Register a named datasource for this driver (e.g. 'cloud').\n            if (this.options.datasourceName) {\n                await metadata.addDatasource({\n                    name: this.options.datasourceName,\n                    driver: this.driver.name,\n                });\n                ctx.logger.info(`[DriverPlugin] Registered named datasource '${this.options.datasourceName}'`, { driver: this.driver.name });\n            }\n\n            // Auto-register as 'default' datasource unless explicitly disabled.\n            if (this.options.registerAsDefault !== false) {\n                const datasources = metadata.getDatasources ? metadata.getDatasources() : [];\n                const hasDefault = datasources.some((ds: any) => ds.name === 'default');\n                if (!hasDefault) {\n                    ctx.logger.info(`[DriverPlugin] No 'default' datasource found — registering '${this.driver.name}' as default.`);\n                    await metadata.addDatasource({ name: 'default', driver: this.driver.name });\n                }\n            }\n        } catch (e) {\n            ctx.logger.debug('[DriverPlugin] Failed to configure datasource (metadata service missing?)', { error: e });\n        }\n\n        ctx.logger.debug('Driver plugin started', { driverName: this.driver.name || 'unknown' });\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { IDataEngine, IMetadataService, ISeedLoaderService } from '@objectstack/spec/contracts';\nimport type {\n  SeedLoaderRequest,\n  SeedLoaderResult,\n  SeedLoaderConfig,\n  SeedLoaderConfigInput,\n  ObjectDependencyGraph,\n  ObjectDependencyNode,\n  ReferenceResolution,\n  ReferenceResolutionError,\n  DatasetLoadResult,\n  Dataset,\n} from '@objectstack/spec/data';\nimport { SeedLoaderConfigSchema } from '@objectstack/spec/data';\nimport { resolveSeedRecord } from '@objectstack/formula';\n\ninterface Logger {\n  info(message: string, meta?: Record<string, any>): void;\n  warn(message: string, meta?: Record<string, any>): void;\n  error(message: string, error?: Error, meta?: Record<string, any>): void;\n  debug(message: string, meta?: Record<string, any>): void;\n}\n\n/** Default field used for externalId matching on target objects */\nconst DEFAULT_EXTERNAL_ID_FIELD = 'name';\n\n/**\n * SeedLoaderService — Runtime implementation of ISeedLoaderService\n *\n * Provides metadata-driven seed data loading with:\n * - Automatic lookup/master_detail reference resolution via externalId\n * - Topological dependency ordering (parents before children)\n * - Multi-pass loading for circular references\n * - Dry-run validation mode\n * - Upsert support honoring DatasetSchema mode\n * - Actionable error reporting\n */\nexport class SeedLoaderService implements ISeedLoaderService {\n  private engine: IDataEngine;\n  private metadata: IMetadataService;\n  private logger: Logger;\n\n  constructor(engine: IDataEngine, metadata: IMetadataService, logger: Logger) {\n    this.engine = engine;\n    this.metadata = metadata;\n    this.logger = logger;\n  }\n\n  // ==========================================================================\n  // Public API\n  // ==========================================================================\n\n  async load(request: SeedLoaderRequest): Promise<SeedLoaderResult> {\n    const startTime = Date.now();\n    const config = request.config;\n    const allErrors: ReferenceResolutionError[] = [];\n    const allResults: DatasetLoadResult[] = [];\n\n    // 1. Filter datasets by environment\n    const datasets = this.filterByEnv(request.datasets, config.env);\n\n    if (datasets.length === 0) {\n      return this.buildEmptyResult(config, Date.now() - startTime);\n    }\n\n    // 2. Build dependency graph\n    const objectNames = datasets.map(d => d.object);\n    const graph = await this.buildDependencyGraph(objectNames);\n\n    this.logger.info('[SeedLoader] Dependency graph built', {\n      objects: objectNames.length,\n      insertOrder: graph.insertOrder,\n      circularDeps: graph.circularDependencies.length,\n    });\n\n    // 3. Order datasets by topological insert order\n    const orderedDatasets = this.orderDatasets(datasets, graph.insertOrder);\n\n    // 4. Build reference lookup map from metadata (field → target object)\n    const refMap = this.buildReferenceMap(graph);\n\n    // 5. Pass 1: Insert/upsert records, resolving references\n    const insertedRecords = new Map<string, Map<string, string>>(); // object → externalIdValue → internalId\n    const deferredUpdates: DeferredUpdate[] = [];\n\n    for (const dataset of orderedDatasets) {\n      const result = await this.loadDataset(\n        dataset, config, refMap, insertedRecords, deferredUpdates, allErrors\n      );\n      allResults.push(result);\n\n      if (config.haltOnError && result.errored > 0) {\n        this.logger.warn('[SeedLoader] Halting on first error', { object: dataset.object });\n        break;\n      }\n    }\n\n    // 6. Pass 2: Resolve deferred references (circular dependencies)\n    if (config.multiPass && deferredUpdates.length > 0 && !config.dryRun) {\n      this.logger.info('[SeedLoader] Pass 2: resolving deferred references', {\n        count: deferredUpdates.length,\n      });\n      await this.resolveDeferredUpdates(deferredUpdates, insertedRecords, allResults, allErrors, config.organizationId);\n    }\n\n    // 7. Build final result\n    const durationMs = Date.now() - startTime;\n    return this.buildResult(config, graph, allResults, allErrors, durationMs);\n  }\n\n  async buildDependencyGraph(objectNames: string[]): Promise<ObjectDependencyGraph> {\n    const nodes: ObjectDependencyNode[] = [];\n    const objectSet = new Set(objectNames);\n\n    for (const objectName of objectNames) {\n      const objDef = await this.metadata.getObject(objectName) as any;\n      const dependsOn: string[] = [];\n      const references: ReferenceResolution[] = [];\n\n      if (objDef && objDef.fields) {\n        const fields = objDef.fields as Record<string, any>;\n        for (const [fieldName, fieldDef] of Object.entries(fields)) {\n          if (\n            (fieldDef.type === 'lookup' || fieldDef.type === 'master_detail') &&\n            fieldDef.reference\n          ) {\n            const targetObject = fieldDef.reference as string;\n\n            // Track dependency ordering only for objects within the graph\n            if (objectSet.has(targetObject) && !dependsOn.includes(targetObject)) {\n              dependsOn.push(targetObject);\n            }\n\n            // Track ALL references for resolution (target may exist in database)\n            references.push({\n              field: fieldName,\n              targetObject,\n              targetField: DEFAULT_EXTERNAL_ID_FIELD,\n              fieldType: fieldDef.type as 'lookup' | 'master_detail',\n            });\n          }\n        }\n      }\n\n      nodes.push({ object: objectName, dependsOn, references });\n    }\n\n    // Topological sort\n    const { insertOrder, circularDependencies } = this.topologicalSort(nodes);\n\n    return { nodes, insertOrder, circularDependencies };\n  }\n\n  async validate(datasets: Dataset[], config?: SeedLoaderConfigInput): Promise<SeedLoaderResult> {\n    const parsedConfig = SeedLoaderConfigSchema.parse({ ...config, dryRun: true });\n    return this.load({ datasets, config: parsedConfig });\n  }\n\n  // ==========================================================================\n  // Internal: Dataset Loading\n  // ==========================================================================\n\n  private async loadDataset(\n    dataset: Dataset,\n    config: SeedLoaderConfig,\n    refMap: Map<string, ReferenceResolution[]>,\n    insertedRecords: Map<string, Map<string, string>>,\n    deferredUpdates: DeferredUpdate[],\n    allErrors: ReferenceResolutionError[],\n  ): Promise<DatasetLoadResult> {\n    const objectName = dataset.object;\n    const mode = dataset.mode || config.defaultMode;\n    const externalId = dataset.externalId || 'name';\n\n    let inserted = 0;\n    let updated = 0;\n    let skipped = 0;\n    let errored = 0;\n    let referencesResolved = 0;\n    let referencesDeferred = 0;\n    const errors: ReferenceResolutionError[] = [];\n\n    // Ensure the object's record map exists\n    if (!insertedRecords.has(objectName)) {\n      insertedRecords.set(objectName, new Map());\n    }\n\n    // Pre-load existing records for upsert matching. When a target\n    // organization is set, scope the lookup so each tenant gets its\n    // own copy (otherwise upsert would clobber other tenants' rows\n    // that share the same natural key — e.g. `name: 'Acme Corp'`).\n    let existingRecords: Map<string, any> | undefined;\n    if ((mode === 'upsert' || mode === 'update' || mode === 'ignore') && !config.dryRun) {\n      existingRecords = await this.loadExistingRecords(\n        objectName,\n        externalId,\n        config.organizationId,\n      );\n    }\n\n    // Get reference resolutions for this object\n    const objectRefs = refMap.get(objectName) || [];\n\n    // Pin a single `now()` snapshot for the entire dataset so multi-pass\n    // loads see one logical clock — the M9 determinism guarantee for seeds.\n    const seedNow = new Date();\n\n    for (let i = 0; i < dataset.records.length; i++) {\n      // Resolve any embedded Expression envelopes (e.g. `cel\\`daysFromNow(30)\\``)\n      // BEFORE reference resolution so downstream lookups see resolved values.\n      const seedResult = resolveSeedRecord(\n        dataset.records[i] as Record<string, never>,\n        { now: seedNow },\n      );\n      const record = seedResult.ok\n        ? { ...(seedResult.value as Record<string, unknown>) }\n        : { ...dataset.records[i] };\n      if (!seedResult.ok) {\n        this.logger.warn(\n          `[SeedLoader] Failed to resolve dynamic values for ${objectName} record #${i}: ${seedResult.error.message}`,\n        );\n      }\n\n      // Per-tenant tagging: when a target org is set, stamp every\n      // seeded row with it (unless the record itself already supplies\n      // an explicit organization_id — respect dataset author overrides).\n      // Skipped objects that don't declare `organization_id` will have\n      // the extra key silently ignored by the engine.\n      if (config.organizationId && record['organization_id'] == null) {\n        record['organization_id'] = config.organizationId;\n      }\n\n      // Resolve references\n      for (const ref of objectRefs) {\n        const fieldValue = record[ref.field];\n        if (fieldValue === undefined || fieldValue === null) continue;\n\n        // Skip if value looks like an internal ID (not a natural key)\n        if (typeof fieldValue !== 'string' || this.looksLikeInternalId(fieldValue)) continue;\n\n        // Try to resolve via already-inserted records\n        const targetMap = insertedRecords.get(ref.targetObject);\n        const resolvedId = targetMap?.get(String(fieldValue));\n\n        if (resolvedId) {\n          record[ref.field] = resolvedId;\n          referencesResolved++;\n        } else if (!config.dryRun) {\n          // Try to resolve from existing data in the database\n          const dbId = await this.resolveFromDatabase(ref.targetObject, ref.targetField, fieldValue, config.organizationId);\n          if (dbId) {\n            record[ref.field] = dbId;\n            referencesResolved++;\n          } else if (config.multiPass) {\n            // Defer to pass 2\n            record[ref.field] = null;\n            deferredUpdates.push({\n              objectName,\n              recordExternalId: String(record[externalId] ?? ''),\n              field: ref.field,\n              targetObject: ref.targetObject,\n              targetField: ref.targetField,\n              attemptedValue: fieldValue,\n              recordIndex: i,\n            });\n            referencesDeferred++;\n          } else {\n            // Cannot resolve - record error\n            const error: ReferenceResolutionError = {\n              sourceObject: objectName,\n              field: ref.field,\n              targetObject: ref.targetObject,\n              targetField: ref.targetField,\n              attemptedValue: fieldValue,\n              recordIndex: i,\n              message: `Cannot resolve reference: ${objectName}.${ref.field} = '${fieldValue}' → ${ref.targetObject}.${ref.targetField} not found`,\n            };\n            errors.push(error);\n            allErrors.push(error);\n          }\n        } else {\n          // Dry-run: attempt resolution, report error if not found\n          const targetMap2 = insertedRecords.get(ref.targetObject);\n          if (!targetMap2?.has(String(fieldValue))) {\n            const error: ReferenceResolutionError = {\n              sourceObject: objectName,\n              field: ref.field,\n              targetObject: ref.targetObject,\n              targetField: ref.targetField,\n              attemptedValue: fieldValue,\n              recordIndex: i,\n              message: `[dry-run] Reference may not resolve: ${objectName}.${ref.field} = '${fieldValue}' → ${ref.targetObject}.${ref.targetField}`,\n            };\n            errors.push(error);\n            allErrors.push(error);\n          }\n        }\n      }\n\n      // Insert/upsert the record\n      if (!config.dryRun) {\n        try {\n          const result = await this.writeRecord(\n            objectName, record, mode, externalId, existingRecords\n          );\n\n          if (result.action === 'inserted') inserted++;\n          else if (result.action === 'updated') updated++;\n          else if (result.action === 'skipped') skipped++;\n\n          // Track the inserted/updated record's ID for reference resolution\n          const externalIdValue = String(record[externalId] ?? '');\n          const internalId = result.id;\n          if (externalIdValue && internalId) {\n            insertedRecords.get(objectName)!.set(externalIdValue, String(internalId));\n          }\n        } catch (err: any) {\n          errored++;\n          this.logger.warn(`[SeedLoader] Failed to write ${objectName} record`, {\n            error: err.message,\n            recordIndex: i,\n          });\n        }\n      } else {\n        // Dry-run: simulate insert tracking\n        const externalIdValue = String(record[externalId] ?? '');\n        if (externalIdValue) {\n          insertedRecords.get(objectName)!.set(externalIdValue, `dry-run-id-${i}`);\n        }\n        inserted++; // Count as \"would be inserted\"\n      }\n    }\n\n    return {\n      object: objectName,\n      mode,\n      inserted,\n      updated,\n      skipped,\n      errored,\n      total: dataset.records.length,\n      referencesResolved,\n      referencesDeferred,\n      errors,\n    };\n  }\n\n  // ==========================================================================\n  // Internal: Reference Resolution\n  // ==========================================================================\n\n  private async resolveFromDatabase(\n    targetObject: string,\n    targetField: string,\n    value: unknown,\n    organizationId?: string,\n  ): Promise<string | null> {\n    try {\n      const where: Record<string, unknown> = { [targetField]: value };\n      // Per-tenant replay: when scoping is requested, only consider\n      // rows that belong to the target tenant so cross-tenant rows\n      // never get borrowed as a \"resolved\" reference (would silently\n      // create a cross-org FK).\n      if (organizationId) where.organization_id = organizationId;\n      const records = await this.engine.find(targetObject, {\n        where,\n        fields: ['id'],\n        limit: 1,\n        context: { isSystem: true },\n      } as any);\n      if (records && records.length > 0) {\n        return String(records[0].id || records[0]._id);\n      }\n    } catch {\n      // Target object may not exist yet\n    }\n    return null;\n  }\n\n  private async resolveDeferredUpdates(\n    deferredUpdates: DeferredUpdate[],\n    insertedRecords: Map<string, Map<string, string>>,\n    allResults: DatasetLoadResult[],\n    allErrors: ReferenceResolutionError[],\n    organizationId?: string,\n  ): Promise<void> {\n    for (const deferred of deferredUpdates) {\n      // Try to resolve from inserted records\n      const targetMap = insertedRecords.get(deferred.targetObject);\n      let resolvedId = targetMap?.get(String(deferred.attemptedValue));\n\n      // Try database fallback\n      if (!resolvedId) {\n        resolvedId = (await this.resolveFromDatabase(\n          deferred.targetObject, deferred.targetField, deferred.attemptedValue, organizationId\n        )) ?? undefined;\n      }\n\n      if (resolvedId) {\n        // Find the record and update the reference\n        const objectRecordMap = insertedRecords.get(deferred.objectName);\n        const recordId = objectRecordMap?.get(deferred.recordExternalId);\n\n        if (recordId) {\n          try {\n            await this.engine.update(deferred.objectName, {\n              id: recordId,\n              [deferred.field]: resolvedId,\n            }, { context: { isSystem: true } } as any);\n\n            // Update result stats\n            const resultEntry = allResults.find(r => r.object === deferred.objectName);\n            if (resultEntry) {\n              resultEntry.referencesResolved++;\n              resultEntry.referencesDeferred--;\n            }\n          } catch (err: any) {\n            this.logger.warn('[SeedLoader] Failed to resolve deferred reference', {\n              object: deferred.objectName,\n              field: deferred.field,\n              error: err.message,\n            });\n          }\n        }\n      } else {\n        // Still unresolved after pass 2\n        const error: ReferenceResolutionError = {\n          sourceObject: deferred.objectName,\n          field: deferred.field,\n          targetObject: deferred.targetObject,\n          targetField: deferred.targetField,\n          attemptedValue: deferred.attemptedValue,\n          recordIndex: deferred.recordIndex,\n          message: `Deferred reference unresolved after pass 2: ${deferred.objectName}.${deferred.field} = '${deferred.attemptedValue}' → ${deferred.targetObject}.${deferred.targetField} not found`,\n        };\n\n        const resultEntry = allResults.find(r => r.object === deferred.objectName);\n        if (resultEntry) {\n          resultEntry.errors.push(error);\n        }\n        allErrors.push(error);\n      }\n    }\n  }\n\n  // ==========================================================================\n  // Internal: Write Operations\n  // ==========================================================================\n\n  /**\n   * Seed writes always run as a privileged system context. This bypasses\n   * RBAC checks (so seeds can target system tables like `sys_*`) and\n   * disables the SecurityPlugin's auto-injection of `organization_id` /\n   * `owner_id` — seeds either declare those fields explicitly per\n   * record, or are intentionally cross-tenant / global.\n   */\n  private static readonly SEED_OPTIONS = { context: { isSystem: true } } as const;\n\n  private async writeRecord(\n    objectName: string,\n    record: Record<string, unknown>,\n    mode: string,\n    externalId: string,\n    existingRecords?: Map<string, any>,\n  ): Promise<{ action: 'inserted' | 'updated' | 'skipped'; id?: string }> {\n    const externalIdValue = record[externalId];\n    const existing = existingRecords?.get(String(externalIdValue ?? ''));\n    const opts = SeedLoaderService.SEED_OPTIONS as any;\n\n    switch (mode) {\n      case 'insert': {\n        const result = await this.engine.insert(objectName, record, opts);\n        return { action: 'inserted', id: this.extractId(result) };\n      }\n\n      case 'update': {\n        if (!existing) {\n          return { action: 'skipped' };\n        }\n        const id = this.extractId(existing);\n        await this.engine.update(objectName, { ...record, id }, opts);\n        return { action: 'updated', id };\n      }\n\n      case 'upsert': {\n        if (existing) {\n          const id = this.extractId(existing);\n          await this.engine.update(objectName, { ...record, id }, opts);\n          return { action: 'updated', id };\n        } else {\n          const result = await this.engine.insert(objectName, record, opts);\n          return { action: 'inserted', id: this.extractId(result) };\n        }\n      }\n\n      case 'ignore': {\n        if (existing) {\n          return { action: 'skipped', id: this.extractId(existing) };\n        }\n        const result = await this.engine.insert(objectName, record, opts);\n        return { action: 'inserted', id: this.extractId(result) };\n      }\n\n      case 'replace': {\n        // Replace mode: just insert (caller should have cleared the table)\n        const result = await this.engine.insert(objectName, record, opts);\n        return { action: 'inserted', id: this.extractId(result) };\n      }\n\n      default: {\n        const result = await this.engine.insert(objectName, record, opts);\n        return { action: 'inserted', id: this.extractId(result) };\n      }\n    }\n  }\n\n  // ==========================================================================\n  // Internal: Dependency Graph\n  // ==========================================================================\n\n  /**\n   * Kahn's algorithm for topological sort with cycle detection.\n   */\n  private topologicalSort(\n    nodes: ObjectDependencyNode[],\n  ): { insertOrder: string[]; circularDependencies: string[][] } {\n    const inDegree = new Map<string, number>();\n    const adjacency = new Map<string, string[]>();\n    const objectSet = new Set(nodes.map(n => n.object));\n\n    // Initialize\n    for (const node of nodes) {\n      inDegree.set(node.object, 0);\n      adjacency.set(node.object, []);\n    }\n\n    // Build adjacency list and in-degree counts\n    for (const node of nodes) {\n      for (const dep of node.dependsOn) {\n        // Exclude self-references from ordering (e.g., employee.manager_id → employee).\n        // Self-referencing fields are still tracked in node.references for resolution.\n        if (objectSet.has(dep) && dep !== node.object) {\n          adjacency.get(dep)!.push(node.object);\n          inDegree.set(node.object, (inDegree.get(node.object) || 0) + 1);\n        }\n      }\n    }\n\n    // Kahn's algorithm\n    const queue: string[] = [];\n    for (const [obj, degree] of inDegree) {\n      if (degree === 0) queue.push(obj);\n    }\n\n    const insertOrder: string[] = [];\n    while (queue.length > 0) {\n      const current = queue.shift()!;\n      insertOrder.push(current);\n\n      for (const neighbor of (adjacency.get(current) || [])) {\n        const newDegree = (inDegree.get(neighbor) || 0) - 1;\n        inDegree.set(neighbor, newDegree);\n        if (newDegree === 0) {\n          queue.push(neighbor);\n        }\n      }\n    }\n\n    // Detect circular dependencies\n    const circularDependencies: string[][] = [];\n    const remaining = nodes.filter(n => !insertOrder.includes(n.object));\n\n    if (remaining.length > 0) {\n      // Find cycles using DFS\n      const cycles = this.findCycles(remaining);\n      circularDependencies.push(...cycles);\n\n      // Add remaining objects to insertOrder (they'll need multi-pass)\n      for (const node of remaining) {\n        if (!insertOrder.includes(node.object)) {\n          insertOrder.push(node.object);\n        }\n      }\n    }\n\n    return { insertOrder, circularDependencies };\n  }\n\n  private findCycles(nodes: ObjectDependencyNode[]): string[][] {\n    const cycles: string[][] = [];\n    const nodeMap = new Map(nodes.map(n => [n.object, n]));\n    const visited = new Set<string>();\n    const inStack = new Set<string>();\n\n    const dfs = (current: string, path: string[]) => {\n      if (inStack.has(current)) {\n        // Found a cycle\n        const cycleStart = path.indexOf(current);\n        if (cycleStart !== -1) {\n          cycles.push([...path.slice(cycleStart), current]);\n        }\n        return;\n      }\n      if (visited.has(current)) return;\n\n      visited.add(current);\n      inStack.add(current);\n      path.push(current);\n\n      const node = nodeMap.get(current);\n      if (node) {\n        for (const dep of node.dependsOn) {\n          if (nodeMap.has(dep)) {\n            dfs(dep, [...path]);\n          }\n        }\n      }\n\n      inStack.delete(current);\n    };\n\n    for (const node of nodes) {\n      if (!visited.has(node.object)) {\n        dfs(node.object, []);\n      }\n    }\n\n    return cycles;\n  }\n\n  // ==========================================================================\n  // Internal: Helpers\n  // ==========================================================================\n\n  private filterByEnv(datasets: Dataset[], env?: string): Dataset[] {\n    if (!env) return datasets;\n    return datasets.filter(d => (d.env as string[]).includes(env));\n  }\n\n  private orderDatasets(datasets: Dataset[], insertOrder: string[]): Dataset[] {\n    const orderMap = new Map(insertOrder.map((name, i) => [name, i]));\n    return [...datasets].sort((a, b) => {\n      const orderA = orderMap.get(a.object) ?? Number.MAX_SAFE_INTEGER;\n      const orderB = orderMap.get(b.object) ?? Number.MAX_SAFE_INTEGER;\n      return orderA - orderB;\n    });\n  }\n\n  private buildReferenceMap(graph: ObjectDependencyGraph): Map<string, ReferenceResolution[]> {\n    const map = new Map<string, ReferenceResolution[]>();\n    for (const node of graph.nodes) {\n      if (node.references.length > 0) {\n        map.set(node.object, node.references);\n      }\n    }\n    return map;\n  }\n\n  private async loadExistingRecords(\n    objectName: string,\n    externalId: string,\n    organizationId?: string,\n  ): Promise<Map<string, any>> {\n    const map = new Map<string, any>();\n    try {\n      const findArgs: Record<string, unknown> = {\n        fields: ['id', externalId],\n        context: { isSystem: true },\n      };\n      // Per-tenant replay: restrict to the target tenant's own rows\n      // so upsert key matching never returns another tenant's record\n      // (would silently steal/overwrite rows across orgs).\n      if (organizationId) findArgs.where = { organization_id: organizationId };\n      const records = await this.engine.find(objectName, findArgs as any);\n      for (const record of records || []) {\n        const key = String(record[externalId] ?? '');\n        if (key) {\n          map.set(key, record);\n        }\n      }\n    } catch {\n      // Object may not have records yet\n    }\n    return map;\n  }\n\n  private looksLikeInternalId(value: string): boolean {\n    // UUID v4 pattern\n    if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value)) {\n      return true;\n    }\n    // MongoDB ObjectId pattern (24 hex chars)\n    if (/^[0-9a-f]{24}$/i.test(value)) {\n      return true;\n    }\n    return false;\n  }\n\n  private extractId(record: any): string | undefined {\n    if (!record) return undefined;\n    return String(record.id || record._id || '');\n  }\n\n  private buildEmptyResult(config: SeedLoaderConfig, durationMs: number): SeedLoaderResult {\n    return {\n      success: true,\n      dryRun: config.dryRun,\n      dependencyGraph: { nodes: [], insertOrder: [], circularDependencies: [] },\n      results: [],\n      errors: [],\n      summary: {\n        objectsProcessed: 0,\n        totalRecords: 0,\n        totalInserted: 0,\n        totalUpdated: 0,\n        totalSkipped: 0,\n        totalErrored: 0,\n        totalReferencesResolved: 0,\n        totalReferencesDeferred: 0,\n        circularDependencyCount: 0,\n        durationMs,\n      },\n    };\n  }\n\n  private buildResult(\n    config: SeedLoaderConfig,\n    graph: ObjectDependencyGraph,\n    results: DatasetLoadResult[],\n    errors: ReferenceResolutionError[],\n    durationMs: number,\n  ): SeedLoaderResult {\n    const summary = {\n      objectsProcessed: results.length,\n      totalRecords: results.reduce((sum, r) => sum + r.total, 0),\n      totalInserted: results.reduce((sum, r) => sum + r.inserted, 0),\n      totalUpdated: results.reduce((sum, r) => sum + r.updated, 0),\n      totalSkipped: results.reduce((sum, r) => sum + r.skipped, 0),\n      totalErrored: results.reduce((sum, r) => sum + r.errored, 0),\n      totalReferencesResolved: results.reduce((sum, r) => sum + r.referencesResolved, 0),\n      totalReferencesDeferred: results.reduce((sum, r) => sum + r.referencesDeferred, 0),\n      circularDependencyCount: graph.circularDependencies.length,\n      durationMs,\n    };\n\n    const hasErrors = errors.length > 0 || summary.totalErrored > 0;\n\n    return {\n      success: !hasErrors,\n      dryRun: config.dryRun,\n      dependencyGraph: graph,\n      results,\n      errors,\n      summary,\n    };\n  }\n}\n\n// ==========================================================================\n// Internal Types\n// ==========================================================================\n\ninterface DeferredUpdate {\n  objectName: string;\n  recordExternalId: string;\n  field: string;\n  targetObject: string;\n  targetField: string;\n  attemptedValue: unknown;\n  recordIndex: number;\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * # QuickJS-backed ScriptRunner\n *\n * Implements `ScriptRunner` using `quickjs-emscripten` (pure-WASM, edge-safe).\n *\n * Responsibilities:\n * - L1 ExpressionBody — evaluated as a `return (<source>)` snippet.\n * - L2 ScriptBody    — wrapped in `(async (ctx) => { <source> })(ctx)` (hooks)\n *                      or `(async (input, ctx) => { <source> })(input, ctx)` (actions).\n * - Hard timeout via QuickJS interrupt handler.\n * - Capability gating — host-side `ctx.api`, `ctx.crypto`, `ctx.log` are only\n *   wired into the VM if the body declares the matching capability.\n * - Structured marshalling — JSON-serialisable values cross the VM boundary.\n *   Functions are exposed as host-resident proxies (the script calls\n *   `ctx.api.object('foo').count(...)` and the host method runs in node).\n *\n * Trade-offs:\n * - Per-invocation overhead is dominated by VM creation. We pool runtimes per\n *   `(origin.kind, capabilities-set)` to amortise startup. Pool size is bounded\n *   by `maxPooled` (default 8); evicted runtimes are disposed.\n * - Memory caps are advisory under quickjs (engine has no hard MB cap); the\n *   runner uses `setMemoryLimit(memoryMb * 1MB)` which is best-effort.\n */\n\nimport {\n  newAsyncContext,\n  type QuickJSAsyncContext,\n  type QuickJSHandle,\n} from 'quickjs-emscripten';\nimport type { HookBody, ScriptBody, ExpressionBody, HookBodyCapability } from '@objectstack/spec/data';\nimport type {\n  ScriptContext,\n  ScriptOrigin,\n  ScriptResult,\n  ScriptRunOptions,\n  ScriptRunner,\n} from './script-runner.js';\n\nconst DEFAULT_HOOK_TIMEOUT_MS = 250;\nconst DEFAULT_ACTION_TIMEOUT_MS = 5000;\nconst DEFAULT_MEMORY_MB = 32;\n\nexport interface QuickJSScriptRunnerOptions {\n  /** Default per-invocation timeout for hooks (ms). */\n  hookTimeoutMs?: number;\n  /** Default per-invocation timeout for actions (ms). */\n  actionTimeoutMs?: number;\n  /** Default memory cap in MB. */\n  memoryMb?: number;\n}\n\nexport class QuickJSScriptRunner implements ScriptRunner {\n  private opts: Required<QuickJSScriptRunnerOptions>;\n\n  constructor(opts: QuickJSScriptRunnerOptions = {}) {\n    this.opts = {\n      hookTimeoutMs: opts.hookTimeoutMs ?? DEFAULT_HOOK_TIMEOUT_MS,\n      actionTimeoutMs: opts.actionTimeoutMs ?? DEFAULT_ACTION_TIMEOUT_MS,\n      memoryMb: opts.memoryMb ?? DEFAULT_MEMORY_MB,\n    };\n  }\n\n  async evalExpression(\n    body: ExpressionBody,\n    ctx: ScriptContext,\n    opts: ScriptRunOptions,\n  ): Promise<ScriptResult> {\n    return this.execute({\n      isExpression: true,\n      source: body.source,\n      capabilities: [],\n      timeoutMs: this.resolveTimeout(opts, undefined),\n      memoryMb: this.opts.memoryMb,\n      ctx,\n      origin: opts.origin,\n    });\n  }\n\n  async runScript(\n    body: ScriptBody,\n    ctx: ScriptContext,\n    opts: ScriptRunOptions,\n  ): Promise<ScriptResult> {\n    return this.execute({\n      isExpression: false,\n      source: body.source,\n      capabilities: body.capabilities,\n      timeoutMs: this.resolveTimeout(opts, body.timeoutMs),\n      memoryMb: body.memoryMb ?? this.opts.memoryMb,\n      ctx,\n      origin: opts.origin,\n    });\n  }\n\n  run(body: HookBody, ctx: ScriptContext, opts: ScriptRunOptions): Promise<ScriptResult> {\n    return body.language === 'expression'\n      ? this.evalExpression(body, ctx, opts)\n      : this.runScript(body, ctx, opts);\n  }\n\n  async dispose(): Promise<void> {\n    /* no-op — runtimes are per-invocation in v1 */\n  }\n\n  /** Pick the smallest of body / opts / engine-default. */\n  private resolveTimeout(opts: ScriptRunOptions, bodyTimeoutMs: number | undefined): number {\n    const def = opts.origin.kind === 'hook' ? this.opts.hookTimeoutMs : this.opts.actionTimeoutMs;\n    return Math.min(...[def, opts.timeoutMs, bodyTimeoutMs].filter((n): n is number => typeof n === 'number'));\n  }\n\n  private async execute(args: {\n    isExpression: boolean;\n    source: string;\n    capabilities: HookBodyCapability[];\n    timeoutMs: number;\n    memoryMb: number;\n    ctx: ScriptContext;\n    origin: ScriptOrigin;\n  }): Promise<ScriptResult> {\n    // Each invocation gets its own WebAssembly module via newAsyncContext().\n    // This is the canonical \"per-invocation isolate\" model and avoids the\n    // shared-runtime HostRef double-free issues we hit with a singleton\n    // QuickJSAsyncWASMModule when contexts are disposed concurrently.\n    const vm = await newAsyncContext();\n    const runtime = vm.runtime;\n    runtime.setMemoryLimit(args.memoryMb * 1024 * 1024);\n    runtime.setMaxStackSize(512 * 1024);\n\n    const start = Date.now();\n    const deadline = start + args.timeoutMs;\n    runtime.setInterruptHandler(() => Date.now() > deadline);\n\n    try {\n      this.installCtx(vm, args.ctx, new Set(args.capabilities), args.origin);\n\n      // L1 expressions are pure-sync: evaluate and read __result.\n      if (args.isExpression) {\n        const wrapped = `globalThis.__result = JSON.stringify((function(){ return (${args.source}); })());`;\n        const result = vm.evalCode(wrapped);\n        if (result.error) {\n          const err = vm.dump(result.error);\n          result.error.dispose();\n          throw new SandboxError(`${args.origin.kind} '${args.origin.name}' threw: ${formatErr(err)}`);\n        }\n        result.value.dispose();\n        const resH = vm.getProp(vm.global, '__result');\n        const resStr = vm.dump(resH);\n        resH.dispose();\n        const value = resStr === undefined || resStr === null || resStr === 'null'\n          ? undefined\n          : safeJsonParse(resStr);\n        return { value, durationMs: Date.now() - start };\n      }\n\n      // L2 scripts: wrap as async IIFE and use side-channel + asyncified pump.\n      // Each pump iteration:\n      //   1. yield to the host event loop (lets asyncified host calls resolve)\n      //   2. drain QuickJS pending jobs (advances the .then chain)\n      //   3. read __result/__error from the VM\n      const wrapped = args.origin.kind === 'hook'\n        ? `globalThis.__result = undefined; globalThis.__error = undefined;\n            (async (ctx) => { ${args.source} })(globalThis.__ctx).then(\n              function(v){ globalThis.__result = JSON.stringify(v === undefined ? null : v); },\n              function(e){ globalThis.__error = (e && e.message) ? (e.name + ': ' + e.message) : String(e); }\n            );`\n        : `globalThis.__result = undefined; globalThis.__error = undefined;\n            (async (input, ctx) => { ${args.source} })(globalThis.__input, globalThis.__ctx).then(\n              function(v){ globalThis.__result = JSON.stringify(v === undefined ? null : v); },\n              function(e){ globalThis.__error = (e && e.message) ? (e.name + ': ' + e.message) : String(e); }\n            );`;\n\n      const evalRes = await vm.evalCodeAsync(wrapped);\n      if (evalRes.error) {\n        const err = vm.dump(evalRes.error);\n        evalRes.error.dispose();\n        throw new SandboxError(`${args.origin.kind} '${args.origin.name}' threw: ${formatErr(err)}`);\n      }\n      evalRes.value.dispose();\n\n      let pumps = 0;\n      while (pumps < 1000) {\n        // Yield to host event loop so any in-flight asyncified host promises resolve.\n        await new Promise<void>((resolve) => setImmediate(resolve));\n\n        const pending = runtime.executePendingJobs();\n        if (pending.error) {\n          const err = vm.dump(pending.error);\n          pending.error.dispose();\n          throw new SandboxError(`${args.origin.kind} '${args.origin.name}' threw: ${formatErr(err)}`);\n        }\n\n        const errH = vm.getProp(vm.global, '__error');\n        const errStr = vm.dump(errH);\n        errH.dispose();\n        if (errStr) {\n          throw new SandboxError(`${args.origin.kind} '${args.origin.name}' threw: ${errStr}`);\n        }\n\n        const resH = vm.getProp(vm.global, '__result');\n        const resStr = vm.dump(resH);\n        resH.dispose();\n        if (resStr !== undefined && resStr !== null) {\n          const value = resStr === 'null' ? undefined : safeJsonParse(resStr);\n          // Capture mutated ctx.input so the host can write through.\n          const mutatedInput = readCtxInputJson(vm);\n          return { value, mutatedInput, durationMs: Date.now() - start };\n        }\n\n        if (Date.now() > deadline) {\n          throw new SandboxError(\n            `${args.origin.kind} '${args.origin.name}' exceeded timeout of ${args.timeoutMs}ms`,\n          );\n        }\n        pumps++;\n      }\n      throw new SandboxError(\n        `${args.origin.kind} '${args.origin.name}' did not resolve after ${pumps} pump iterations`,\n      );\n    } finally {\n      // newAsyncContext() owns its WASM module; disposing the context disposes\n      // the runtime + module together.\n      vm.dispose();\n    }\n  }\n\n  /**\n   * Install ctx onto the VM's globalThis. Each capability is wired in only if\n   * the body declared it; missing methods throw at call-time inside the VM\n   * with a clear diagnostic.\n   *\n   * Host API methods are installed via {@link QuickJSAsyncContext.newAsyncifiedFunction}\n   * so they may return Promises (real ObjectQL `find/count/insert/...` are async).\n   */\n  private installCtx(\n    vm: QuickJSAsyncContext,\n    ctx: ScriptContext,\n    caps: Set<HookBodyCapability>,\n    origin: ScriptOrigin,\n  ): void {\n    setGlobalJson(vm, '__input', ctx.input);\n    setGlobalJson(vm, '__previous', ctx.previous);\n\n    const ctxObj = vm.newObject();\n    setObjectJson(vm, ctxObj, 'input', ctx.input);\n    setObjectJson(vm, ctxObj, 'previous', ctx.previous);\n    setObjectJson(vm, ctxObj, 'user', ctx.user);\n    setObjectJson(vm, ctxObj, 'session', ctx.session);\n    if (typeof ctx.event === 'string') {\n      const evH = vm.newString(ctx.event);\n      vm.setProp(ctxObj, 'event', evH);\n      evH.dispose();\n    }\n    if (typeof ctx.object === 'string') {\n      const obH = vm.newString(ctx.object);\n      vm.setProp(ctxObj, 'object', obH);\n      obH.dispose();\n    }\n    if (typeof ctx.recordId === 'string') {\n      const idH = vm.newString(ctx.recordId);\n      vm.setProp(ctxObj, 'recordId', idH);\n      idH.dispose();\n    }\n    if (ctx.record !== undefined) {\n      setObjectJson(vm, ctxObj, 'record', ctx.record);\n    }\n    if (ctx.result !== undefined) {\n      setObjectJson(vm, ctxObj, 'result', ctx.result);\n    }\n\n    const apiObj = vm.newObject();\n    const objectFn = vm.newFunction('object', (nameH) => {\n      const objectName = vm.getString(nameH);\n      const wrap = vm.newObject();\n      const READ = ['find', 'findOne', 'count', 'aggregate'] as const;\n      const WRITE = ['insert', 'update', 'delete', 'updateMany', 'deleteMany', 'upsert'] as const;\n      for (const m of READ) installApiMethod(vm, wrap, m, objectName, ctx, caps, 'api.read', origin);\n      for (const m of WRITE) installApiMethod(vm, wrap, m, objectName, ctx, caps, 'api.write', origin);\n      return wrap;\n    });\n    vm.setProp(apiObj, 'object', objectFn);\n    objectFn.dispose();\n    vm.setProp(ctxObj, 'api', apiObj);\n    apiObj.dispose();\n\n    const logObj = vm.newObject();\n    for (const level of ['info', 'warn', 'error'] as const) {\n      const fn = vm.newFunction(level, (msgH, dataH) => {\n        if (!caps.has('log')) {\n          throw new SandboxError(`capability 'log' not granted to ${origin.kind} '${origin.name}'`);\n        }\n        const msg = vm.getString(msgH);\n        const data = dataH ? safeJsonParse(vm.getString(dataH)) : undefined;\n        ctx.log?.[level]?.(msg, data);\n        return vm.undefined;\n      });\n      vm.setProp(logObj, level, fn);\n      fn.dispose();\n    }\n    vm.setProp(ctxObj, 'log', logObj);\n    logObj.dispose();\n\n    const cryptoObj = vm.newObject();\n    const uuidFn = vm.newFunction('randomUUID', () => {\n      if (!caps.has('crypto.uuid')) {\n        throw new SandboxError(`capability 'crypto.uuid' not granted to ${origin.kind} '${origin.name}'`);\n      }\n      const v = ctx.crypto?.randomUUID?.() ?? cryptoRandomUUID();\n      return vm.newString(v);\n    });\n    vm.setProp(cryptoObj, 'randomUUID', uuidFn);\n    uuidFn.dispose();\n    vm.setProp(ctxObj, 'crypto', cryptoObj);\n    cryptoObj.dispose();\n\n    vm.setProp(vm.global, '__ctx', ctxObj);\n    ctxObj.dispose();\n  }\n}\n\n/**\n * Asyncified host-bound API method.\n *\n * Awaits Promise return values from the host implementation and marshals the\n * resolved value back into the VM. Capability check happens at call time and\n * surfaces inside the VM as a thrown error with a clear diagnostic.\n */\nfunction installApiMethod(\n  vm: QuickJSAsyncContext,\n  parent: QuickJSHandle,\n  method: string,\n  objectName: string,\n  ctx: ScriptContext,\n  caps: Set<HookBodyCapability>,\n  required: HookBodyCapability,\n  origin: ScriptOrigin,\n): void {\n  const fn = vm.newAsyncifiedFunction(method, async (...argHandles) => {\n    if (!caps.has(required)) {\n      throw new SandboxError(\n        `capability '${required}' not granted to ${origin.kind} '${origin.name}' (called ctx.api.object('${objectName}').${method})`,\n      );\n    }\n    const apiAny = ctx.api as Record<string, unknown> | undefined;\n    if (!apiAny || typeof apiAny.object !== 'function') {\n      throw new SandboxError(`ctx.api unavailable in ${origin.kind} '${origin.name}'`);\n    }\n    const args = argHandles.map((h) => vm.dump(h));\n    const proxy = (apiAny.object as (n: string) => Record<string, unknown>)(objectName);\n    const m = proxy[method] as ((...a: unknown[]) => unknown) | undefined;\n    if (typeof m !== 'function') {\n      throw new SandboxError(`ctx.api.object('${objectName}').${method} not implemented`);\n    }\n    const ret = await Promise.resolve(m.apply(proxy, args));\n    return jsonToHandle(vm, ret);\n  });\n  vm.setProp(parent, method, fn);\n  fn.dispose();\n}\n\n/** Marshal a host JSON-serializable value into a QuickJS handle. */\nfunction jsonToHandle(vm: QuickJSAsyncContext, v: unknown): QuickJSHandle {\n  const json = JSON.stringify(v ?? null);\n  const r = vm.evalCode(`(${json})`);\n  if (r.error) {\n    const msg = vm.dump(r.error);\n    r.error.dispose();\n    throw new SandboxError(`failed to marshal host value: ${formatErr(msg)}`);\n  }\n  return r.value;\n}\n\nfunction setGlobalJson(vm: QuickJSAsyncContext, name: string, v: unknown): void {\n  const json = JSON.stringify(v ?? null);\n  const result = vm.evalCode(`(${json})`);\n  if (result.error) {\n    result.error.dispose();\n    return;\n  }\n  vm.setProp(vm.global, name, result.value);\n  result.value.dispose();\n}\n\nfunction setObjectJson(vm: QuickJSAsyncContext, parent: QuickJSHandle, key: string, v: unknown): void {\n  const json = JSON.stringify(v ?? null);\n  const result = vm.evalCode(`(${json})`);\n  if (result.error) {\n    result.error.dispose();\n    vm.setProp(parent, key, vm.null);\n    return;\n  }\n  vm.setProp(parent, key, result.value);\n  result.value.dispose();\n}\n\n/**\n * After the script has settled, dump `globalThis.__ctx.input` so the host can\n * write through any direct property mutations the script performed (e.g.\n * `ctx.input.account_number = 'ABC'`).\n *\n * Returns `undefined` if the read fails for any reason — callers fall back to\n * the script's return value in that case.\n */\nfunction readCtxInputJson(vm: QuickJSAsyncContext): Record<string, unknown> | undefined {\n  try {\n    const r = vm.evalCode(`JSON.stringify(globalThis.__ctx && globalThis.__ctx.input || null)`);\n    if (r.error) {\n      r.error.dispose();\n      return undefined;\n    }\n    const s = vm.dump(r.value);\n    r.value.dispose();\n    if (typeof s !== 'string' || s === 'null') return undefined;\n    const parsed = safeJsonParse(s);\n    return parsed && typeof parsed === 'object' && !Array.isArray(parsed)\n      ? (parsed as Record<string, unknown>)\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction safeJsonParse(s: string | undefined): unknown {\n  if (s === undefined || s === '') return undefined;\n  try {\n    return JSON.parse(s);\n  } catch {\n    return s;\n  }\n}\n\nfunction cryptoRandomUUID(): string {\n  if (typeof globalThis.crypto?.randomUUID === 'function') return globalThis.crypto.randomUUID();\n  // RFC 4122 v4 fallback\n  const r = () => Math.floor(Math.random() * 0x100000000).toString(16).padStart(8, '0');\n  return `${r()}-${r().slice(0, 4)}-4${r().slice(0, 3)}-${r().slice(0, 4)}-${r()}${r().slice(0, 4)}`;\n}\n\nfunction formatErr(err: unknown): string {\n  if (err && typeof err === 'object') {\n    const o = err as { message?: string; name?: string; stack?: string };\n    if (o.message) return `${o.name ?? 'Error'}: ${o.message}`;\n    return JSON.stringify(err);\n  }\n  return String(err);\n}\n\nexport class SandboxError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'SandboxError';\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Hook & Action Body Runner Factory\n *\n * Bridges the metadata-only `Hook.body` / `Action.body` discriminated union\n * (defined in `@objectstack/spec/data/hook-body.zod`) into an executable\n * handler registered on the ObjectQL engine.\n *\n * The runtime owns this bridge — `objectql` itself never imports the\n * sandbox engine, so it can stay light enough to embed in tooling and\n * tests. `AppPlugin` constructs one factory per bundle bind and passes it\n * through `bindHooksToEngine({ bodyRunner })` for hooks, and walks the\n * bundle actions to register them via `engine.registerAction`.\n *\n * Per-invocation flow when a triggered hook fires:\n *   1. ObjectQL calls the wrapped handler with its native `(ctx)` arg.\n *   2. We adapt that engine-context into the sandbox `ScriptContext`\n *      shape and proxy `ctx.api.object(...)` to the running ObjectQL\n *      proxy bound to the current organization/user.\n *   3. `ScriptRunner.runScript` evaluates the body inside QuickJS with\n *      the declared capabilities + timeout.\n *   4. After settle, we write back two kinds of mutations to the host\n *      `ctx.input`:\n *      a. `result.mutatedInput` — a snapshot of `ctx.input` taken inside\n *         the VM, used to propagate direct property writes such as\n *         `ctx.input.account_number = 'ABC'`.\n *      b. `result.value` — if the script returned an object, it is\n *         shallow-merged on top of `mutatedInput` as an explicit patch.\n *      Writes go through `Object.assign`, which means the host engine's\n *      flat-record Proxy (installed by `wrapDeclarativeHook`) sees them\n *      via its set trap.\n */\n\nimport type { Hook } from '@objectstack/spec/data';\nimport { HookBodySchema } from '@objectstack/spec/data';\nimport type { ScriptRunner, ScriptContext, ScriptResult } from './script-runner.js';\n\ninterface FactoryOptions {\n  ql: any;\n  appId: string;\n  logger?: any;\n}\n\nexport function hookBodyRunnerFactory(\n  runner: ScriptRunner,\n  opts: FactoryOptions,\n): (hook: Hook) => ((engineCtx: any) => Promise<void>) | undefined {\n  return (hook: Hook) => {\n    const raw = (hook as any).body;\n    if (!raw) return undefined;\n\n    const parsed = HookBodySchema.safeParse(raw);\n    if (!parsed.success) {\n      opts.logger?.warn?.('[BodyRunner] invalid hook.body shape', {\n        appId: opts.appId,\n        hook: hook.name,\n        issues: parsed.error.issues.slice(0, 3),\n      });\n      return undefined;\n    }\n    const body = parsed.data;\n\n    return async function boundBodyHandler(engineCtx: any): Promise<void> {\n      const sandboxCtx = buildSandboxContext(engineCtx, opts.ql);\n      try {\n        opts.logger?.debug?.('[BodyRunner] hook fired', { appId: opts.appId, hook: hook.name });\n        const result = await runner.run(body, sandboxCtx, {\n          origin: {\n            kind: 'hook',\n            name: hook.name,\n            object: typeof (hook as any).object === 'string' ? (hook as any).object : undefined,\n          },\n          timeoutMs: (body as any).timeoutMs ?? 250,\n        });\n        applyMutationsToInput(engineCtx, result);\n      } catch (err: any) {\n        opts.logger?.error?.('[BodyRunner] sandboxed hook threw', err, {\n          appId: opts.appId,\n          hook: hook.name,\n        });\n        throw err;\n      }\n    };\n  };\n}\n\n/**\n * Action body runner factory.\n *\n * Returns a handler with the shape ObjectQL's `executeAction` expects:\n * `(actionCtx) => Promise<unknown>`. The action's return value bubbles up\n * to the HTTP dispatcher which JSON-serialises it back to the caller.\n */\nexport function actionBodyRunnerFactory(\n  runner: ScriptRunner,\n  opts: FactoryOptions,\n): (action: { name: string; body?: unknown; object?: string; timeoutMs?: number }) =>\n  | ((actionCtx: any) => Promise<unknown>)\n  | undefined {\n  return (action) => {\n    const raw = action.body;\n    if (!raw) return undefined;\n\n    const parsed = HookBodySchema.safeParse(raw);\n    if (!parsed.success) {\n      opts.logger?.warn?.('[BodyRunner] invalid action.body shape', {\n        appId: opts.appId,\n        action: action.name,\n        issues: parsed.error.issues.slice(0, 3),\n      });\n      return undefined;\n    }\n    const body = parsed.data;\n\n    return async function boundActionHandler(actionCtx: any): Promise<unknown> {\n      const sandboxCtx = buildActionSandboxContext(actionCtx, opts.ql);\n      try {\n        opts.logger?.debug?.('[BodyRunner] action fired', {\n          appId: opts.appId,\n          action: action.name,\n          object: action.object,\n        });\n        const result = await runner.run(body, sandboxCtx, {\n          origin: { kind: 'action', name: action.name, object: action.object },\n          timeoutMs: (body as any).timeoutMs ?? action.timeoutMs ?? 5000,\n        });\n        return result.value;\n      } catch (err: any) {\n        opts.logger?.error?.('[BodyRunner] sandboxed action threw', err, {\n          appId: opts.appId,\n          action: action.name,\n        });\n        throw err;\n      }\n    };\n  };\n}\n\nfunction applyMutationsToInput(engineCtx: any, result: ScriptResult): void {\n  const target = engineCtx?.input;\n  if (!target || typeof target !== 'object') return;\n  if (result.mutatedInput && typeof result.mutatedInput === 'object') {\n    Object.assign(target, result.mutatedInput);\n  }\n  if (\n    result.value &&\n    typeof result.value === 'object' &&\n    !Array.isArray(result.value)\n  ) {\n    Object.assign(target, result.value);\n  }\n}\n\nfunction buildEngineRepoFacade(ql: any, objectName: string) {\n  // Minimal repository surface that proxies to the raw engine.\n  // Actions execute as the system user (no user context at HTTP boundary\n  // beyond `actionCtx.user`); ObjectQL's permission middleware will still\n  // gate writes via the engine's standard insert/update path.\n  return {\n    async find(opts?: any) { return ql.find(objectName, opts); },\n    async findOne(opts?: any) {\n      const rows = await ql.find(objectName, opts);\n      return Array.isArray(rows) ? rows[0] ?? null : null;\n    },\n    async count(opts?: any) {\n      if (typeof ql.count === 'function') return ql.count(objectName, opts);\n      const rows = await ql.find(objectName, opts);\n      return Array.isArray(rows) ? rows.length : 0;\n    },\n    async insert(data: any) { return ql.insert(objectName, data); },\n    async update(data: any, opts?: any) { return ql.update(objectName, data, opts); },\n    async upsert(data: any, opts?: any) {\n      if (typeof ql.upsert === 'function') return ql.upsert(objectName, data, opts);\n      return ql.insert(objectName, data);\n    },\n    async delete(opts?: any) { return ql.delete(objectName, opts); },\n  };\n}\n\nfunction buildSandboxApi(engineCtx: any, ql: any, errLabel: string) {\n  const engineApi = engineCtx?.api;\n  if (engineApi && typeof engineApi.object === 'function') return engineApi;\n  return {\n    object: (objectName: string) => {\n      if (!ql) throw new Error(`ObjectQL engine unavailable to ${errLabel}`);\n      // Prefer the engine's own ScopedContext-based `.object()` when\n      // present; otherwise synthesize a minimal repo facade against the\n      // engine's CRUD primitives (so the body can call .insert/.find/etc).\n      if (typeof ql.object === 'function') {\n        try { return ql.object(objectName); } catch { /* fall through */ }\n      }\n      return buildEngineRepoFacade(ql, objectName);\n    },\n  };\n}\n\nfunction buildSandboxContext(engineCtx: any, ql: any): ScriptContext {\n  const inputSnapshot = unwrapProxyToPlain(engineCtx?.input ?? engineCtx?.doc);\n  const previousRaw = engineCtx?.previous ?? engineCtx?.previousDoc;\n  return {\n    input: inputSnapshot ?? {},\n    // Preserve `undefined` for `previous` on insert events so hooks can\n    // reliably distinguish create (`!ctx.previous`) from update/delete.\n    previous: unwrapProxyToPlain(previousRaw),\n    user: engineCtx?.user ?? engineCtx?.session?.user,\n    session: engineCtx?.session,\n    event: typeof engineCtx?.event === 'string' ? engineCtx.event : undefined,\n    object: typeof engineCtx?.object === 'string' ? engineCtx.object : undefined,\n    result: engineCtx?.result,\n    api: buildSandboxApi(engineCtx, ql, 'hook body'),\n    log: engineCtx?.logger,\n    crypto: globalThis.crypto,\n  };\n}\n\nfunction buildActionSandboxContext(actionCtx: any, ql: any): ScriptContext {\n  // Action ctx convention (mirrors http-dispatcher.ts):\n  //   { record, params, recordId, user, session, engine, services, ... }\n  // The script signature is `(input, ctx)` — input gets `params`, ctx gets\n  // the full action context.\n  const recordId =\n    typeof actionCtx?.recordId === 'string'\n      ? actionCtx.recordId\n      : typeof actionCtx?.record?.id === 'string'\n        ? actionCtx.record.id\n        : undefined;\n  return {\n    input: unwrapProxyToPlain(actionCtx?.params ?? {}),\n    previous: undefined,\n    user: actionCtx?.user ?? actionCtx?.session?.user,\n    session: actionCtx?.session,\n    object: typeof actionCtx?.object === 'string' ? actionCtx.object : undefined,\n    recordId,\n    record: unwrapProxyToPlain(actionCtx?.record),\n    api: buildSandboxApi(actionCtx, ql, 'action body'),\n    log: actionCtx?.logger,\n    crypto: globalThis.crypto,\n  };\n}\n\n/**\n * Convert a Proxy-wrapped record into a plain object so it round-trips through\n * JSON cleanly. `Object.fromEntries(Object.entries(p))` triggers the proxy's\n * ownKeys + get traps, materialising every visible field.\n */\nfunction unwrapProxyToPlain(v: unknown): Record<string, unknown> | undefined {\n  if (v === undefined || v === null) return undefined;\n  if (typeof v !== 'object') return undefined;\n  if (Array.isArray(v)) return undefined;\n  try {\n    return Object.fromEntries(Object.entries(v as Record<string, unknown>));\n  } catch {\n    return undefined;\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Plugin, PluginContext } from '@objectstack/core';\nimport { SeedLoaderService } from './seed-loader.js';\nimport type { IMetadataService, II18nService } from '@objectstack/spec/contracts';\nimport { QuickJSScriptRunner } from './sandbox/quickjs-runner.js';\nimport { hookBodyRunnerFactory, actionBodyRunnerFactory } from './sandbox/body-runner.js';\n\n/**\n * Optional per-project context attached when AppPlugin is instantiated by the\n * project kernel factory. Required for the `app:registered` / `app:unregistered`\n * hooks that drive the org-scoped `sys_app` catalog. Standalone (single-tenant)\n * usages may omit this — no catalog hooks are emitted in that case.\n */\nexport interface AppPluginProjectContext {\n    environmentId: string;\n    organizationId: string;\n    projectName?: string;\n    /** When the app comes from a package installation, the source package id. */\n    packageId?: string;\n    /** Defaults to 'package' when packageId is set, otherwise 'user'. */\n    source?: 'package' | 'user';\n}\n\n/**\n * AppPlugin\n * \n * Adapts a generic App Bundle (Manifest + Runtime Code) into a Kernel Plugin.\n * \n * Responsibilities:\n * 1. Register App Manifest as a service (for ObjectQL discovery)\n * 2. Execute Runtime `onEnable` hook (for code logic)\n * 3. Auto-load i18n translation bundles into the kernel's i18n service\n */\nexport class AppPlugin implements Plugin {\n    name: string;\n    type = 'app';\n    version?: string;\n    \n    private bundle: any;\n    private projectContext?: AppPluginProjectContext;\n\n    constructor(bundle: any, projectContext?: AppPluginProjectContext) {\n        this.bundle = bundle;\n        this.projectContext = projectContext;\n        // Support both direct manifest (legacy) and Stack Definition (nested manifest)\n        const sys = bundle.manifest || bundle;\n        const appId = sys.id || sys.name || 'unnamed-app';\n\n        this.name = `plugin.app.${appId}`;\n        this.version = sys.version;\n    }\n\n    init = async (ctx: PluginContext) => {\n        const sys = this.bundle.manifest || this.bundle;\n        const appId = sys.id || sys.name;\n\n        ctx.logger.info('Registering App Service', { \n            appId, \n            pluginName: this.name,\n            version: this.version \n        });\n        \n        // Register the app manifest directly via the manifest service.\n        // This immediately decomposes the manifest into SchemaRegistry entries.\n        const servicePayload = this.bundle.manifest\n            ? { ...this.bundle.manifest, ...this.bundle }\n            : this.bundle;\n\n        console.warn(\n            `[AppPlugin:init] appId=${appId} keys=${Object.keys(servicePayload).join(',')} flows=${Array.isArray((servicePayload as any).flows) ? (servicePayload as any).flows.length : 'n/a'}`,\n        );\n\n        ctx.getService<{ register(m: any): void }>('manifest').register(servicePayload);\n    }\n\n    start = async (ctx: PluginContext) => {\n        const sys = this.bundle.manifest || this.bundle;\n        const appId = sys.id || sys.name;\n        \n        // Execute Runtime Step\n        // Retrieve ObjectQL engine from services\n        // ctx.getService throws when a service is not registered, so we\n        // must use try/catch instead of a null-check.\n        let ql: any;\n        try {\n            ql = ctx.getService('objectql');\n        } catch {\n            // Service not registered — handled below\n        }\n\n        if (!ql) {\n            ctx.logger.warn('ObjectQL engine service not found', { \n                appName: this.name,\n                appId \n            });\n            return;\n        }\n\n        ctx.logger.debug('Retrieved ObjectQL engine service', { appId });\n\n        // Configure datasourceMapping if provided in the stack definition\n        if (this.bundle.datasourceMapping && Array.isArray(this.bundle.datasourceMapping)) {\n            ctx.logger.info('Configuring datasource mapping rules', {\n                appId,\n                ruleCount: this.bundle.datasourceMapping.length\n            });\n            ql.setDatasourceMapping(this.bundle.datasourceMapping);\n        }\n\n        // Resolve the runtime hook owner. Modules that declare both a\n        // `default` (defineStack(...)) export and a named `onEnable` export\n        // hide the named export from `bundle.default`, so we fall back to the\n        // top-level bundle when the default doesn't carry the hook.\n        const stackBundle = this.bundle.default || this.bundle;\n        const runtime: any = (stackBundle && typeof stackBundle.onEnable === 'function')\n            ? stackBundle\n            : this.bundle;\n\n        if (runtime && typeof runtime.onEnable === 'function') {\n             ctx.logger.info('Executing runtime.onEnable', { \n                 appName: this.name,\n                 appId \n             });\n             \n             // Construct the Host Context (mirroring old ObjectQL.use logic)\n             const hostContext = {\n                ...ctx,\n                ql,\n                logger: ctx.logger,\n                drivers: {\n                    register: (driver: any) => {\n                        ctx.logger.debug('Registering driver via app runtime', { \n                            driverName: driver.name,\n                            appId \n                        });\n                        ql.registerDriver(driver);\n                    }\n                },\n             };\n             \n             await runtime.onEnable(hostContext);\n             ctx.logger.debug('Runtime.onEnable completed', { appId });\n        } else {\n             ctx.logger.debug('No runtime.onEnable function found', { appId });\n        }\n\n        // ── Auto-bind declarative Hook metadata ─────────────────────────\n        // Hooks declared via `defineStack({ hooks })` (or attached to the\n        // bundle by other tooling) are wired into the ObjectQL execution\n        // pipeline here, with no boilerplate from user code. Inline\n        // function handlers are resolved directly; string-named handlers\n        // are looked up in `bundle.functions` (also auto-registered) or in\n        // any function previously registered on the engine.\n        //\n        // Runs AFTER `runtime.onEnable` so user code may still\n        // imperatively register additional hooks/functions for advanced\n        // cases — both will coexist on the engine.\n        try {\n            const hooks = collectBundleHooks(this.bundle);\n            const functions = collectBundleFunctions(this.bundle);\n            if (hooks.length > 0 || Object.keys(functions).length > 0) {\n                if (typeof ql.bindHooks === 'function') {\n                    ql.bindHooks(hooks, {\n                        packageId: `app:${appId}`,\n                        functions,\n                        bodyRunner: hookBodyRunnerFactory(new QuickJSScriptRunner(), {\n                            ql,\n                            logger: ctx.logger,\n                            appId,\n                        }),\n                    });\n                    ctx.logger.info('[AppPlugin] Bound declarative hooks', {\n                        appId,\n                        hookCount: hooks.length,\n                        functionCount: Object.keys(functions).length,\n                    });\n                } else {\n                    ctx.logger.warn('[AppPlugin] ql.bindHooks unavailable; declarative hooks ignored', {\n                        appId,\n                        hookCount: hooks.length,\n                    });\n                }\n            }\n        } catch (err: any) {\n            ctx.logger.error('[AppPlugin] Failed to bind declarative hooks', err as Error, {\n                appId,\n            });\n        }\n\n        // ── Auto-register declarative Action handlers ───────────────────\n        // Actions with an inline `handler` (or extracted `body`) are wired\n        // to the engine here so HTTP `POST /api/v1/actions/<obj>/<name>`\n        // can invoke them. Actions without a body are left for legacy\n        // imperative `engine.registerAction(...)` registration in user code.\n        try {\n            const actions = collectBundleActions(this.bundle);\n            const actionBodyRunner = actionBodyRunnerFactory(new QuickJSScriptRunner(), {\n                ql,\n                logger: ctx.logger,\n                appId,\n            });\n            let registered = 0;\n            if (actions.length > 0 && typeof ql.registerAction === 'function') {\n                for (const action of actions) {\n                    const handler = actionBodyRunner(action);\n                    if (!handler) continue;\n                    const objectKey =\n                        typeof action.object === 'string' && action.object.length > 0\n                            ? action.object\n                            : 'global';\n                    try {\n                        ql.registerAction(objectKey, action.name, handler, `app:${appId}`);\n                        registered++;\n                    } catch (err: any) {\n                        ctx.logger.warn('[AppPlugin] Failed to register action body', {\n                            appId,\n                            action: action.name,\n                            object: objectKey,\n                            error: err?.message ?? String(err),\n                        });\n                    }\n                }\n            }\n            if (registered > 0) {\n                ctx.logger.info('[AppPlugin] Bound declarative actions', {\n                    appId,\n                    actionCount: registered,\n                });\n            }\n        } catch (err: any) {\n            ctx.logger.error('[AppPlugin] Failed to bind declarative actions', err as Error, {\n                appId,\n            });\n        }\n\n        // ── Auto-register declarative Approval Processes ────────────────\n        // Approval processes declared via `defineStack({ approvals })` are\n        // upserted into the running `approvals` service. The `approvals`\n        // service itself registers on `kernel:ready`, so we defer to the\n        // same hook to avoid a chicken-and-egg.\n        try {\n            const approvals: any[] = Array.isArray(this.bundle.approvals)\n                ? this.bundle.approvals\n                : Array.isArray((this.bundle.manifest || {}).approvals)\n                    ? (this.bundle.manifest as any).approvals\n                    : [];\n            if (approvals.length > 0) {\n                ctx.hook('kernel:ready', async () => {\n                    let svc: any;\n                    try { svc = ctx.getService('approvals'); } catch { /* not installed */ }\n                    if (!svc || typeof svc.defineProcess !== 'function') {\n                        ctx.logger.warn('[AppPlugin] approvals service not registered — skipping declarative processes', {\n                            appId, processCount: approvals.length,\n                        });\n                        return;\n                    }\n                    const sysCtx = { isSystem: true, roles: [], permissions: [] };\n                    let ok = 0;\n                    for (const proc of approvals) {\n                        try {\n                            await svc.defineProcess({\n                                name: proc.name,\n                                label: proc.label,\n                                object: proc.object,\n                                description: proc.description,\n                                active: proc.active !== false,\n                                definition: proc,\n                            }, sysCtx);\n                            ok++;\n                        } catch (err: any) {\n                            ctx.logger.warn('[AppPlugin] Failed to register approval process', {\n                                appId, process: proc?.name, error: err?.message ?? String(err),\n                            });\n                        }\n                    }\n                    ctx.logger.info('[AppPlugin] Registered approval processes', { appId, count: ok });\n                });\n            }\n        } catch (err: any) {\n            ctx.logger.error('[AppPlugin] Failed to schedule approval-process registration', err as Error, { appId });\n        }\n\n        // ── Org-Scoped App Catalog Sync ──────────────────────────────────\n        // Emit `app:registered` so AppCatalogService (running on the\n        // control-plane kernel) can mirror this app into `sys_app`. Skipped\n        // for standalone (single-tenant) usages where no project context is\n        // attached.\n        this.emitCatalogEvent(ctx, 'app:registered', sys);\n\n        // ── i18n Translation Loading ─────────────────────────────────────\n        // Auto-load translation bundles from the app config into the\n        // kernel's i18n service, so discovery and handlers stay consistent.\n        await this.loadTranslations(ctx, appId);\n\n        // Data Seeding\n        // Collect seed data from multiple locations (top-level `data` preferred, `manifest.data` for backward compat)\n        const seedDatasets: any[] = [];\n        \n        // 1. Top-level `data` field (new standard location on ObjectStackDefinition)\n        if (Array.isArray(this.bundle.data)) {\n            seedDatasets.push(...this.bundle.data);\n        }\n        \n        // 2. Legacy: `manifest.data` (backward compatibility)\n        const manifest = this.bundle.manifest || this.bundle;\n        if (manifest && Array.isArray(manifest.data)) {\n            seedDatasets.push(...manifest.data);\n        }\n\n        // Object names in seed data are used as-is — no FQN expansion.\n        // Under the current naming convention, the object's short name IS\n        // the canonical name and the physical table name.\n\n        if (seedDatasets.length > 0) {\n             ctx.logger.info(`[AppPlugin] Found ${seedDatasets.length} seed datasets for ${appId}`);\n\n             // Pass seed datasets through unchanged — object names are canonical\n             const normalizedDatasets = seedDatasets\n                 .filter((d: any) => d.object && Array.isArray(d.records))\n                 .map((d: any) => ({\n                     ...d,\n                     object: d.object,\n                 }));\n\n             // Stash datasets on a kernel service so SecurityPlugin's\n             // sys_organization insert hook can replay them per-tenant\n             // (Salesforce-sandbox style: every new org gets its own\n             // private copy of the artifact's demo data).\n             //\n             // We also register a `seed-replayer` callable so the\n             // SecurityPlugin doesn't need to import @objectstack/runtime\n             // (would create a circular workspace dep). The replayer\n             // captures the SeedLoaderService closure and exposes a\n             // narrow `(orgId) => Promise<summary>` surface.\n             try {\n                 const kernel: any = (ctx as any).kernel;\n                 const existing = (() => {\n                     try { return kernel?.getService?.('seed-datasets'); } catch { return undefined; }\n                 })();\n                 const merged = Array.isArray(existing)\n                     ? [...existing, ...normalizedDatasets]\n                     : normalizedDatasets;\n                 const registerSvc = (name: string, value: any) => {\n                     if (kernel?.registerService) kernel.registerService(name, value);\n                     else if (typeof (ctx as any).registerService === 'function') (ctx as any).registerService(name, value);\n                 };\n                 registerSvc('seed-datasets', merged);\n\n                 const metadataNow = ctx.getService('metadata') as IMetadataService | undefined;\n                 const loggerRef = ctx.logger;\n                 const replayer = async (organizationId: string) => {\n                     if (!organizationId) return { inserted: 0, updated: 0, errors: [] as any[] };\n                     const md = metadataNow ?? (ctx.getService('metadata') as IMetadataService | undefined);\n                     if (!md) {\n                         loggerRef.warn('[seed-replayer] metadata service unavailable');\n                         return { inserted: 0, updated: 0, errors: [] as any[] };\n                     }\n                     const datasetsNow = (() => {\n                         try { return kernel?.getService?.('seed-datasets'); } catch { return merged; }\n                     })() ?? merged;\n                     if (!Array.isArray(datasetsNow) || datasetsNow.length === 0) {\n                         return { inserted: 0, updated: 0, errors: [] as any[] };\n                     }\n                     const seedLoader = new SeedLoaderService(ql, md, loggerRef);\n                     const { SeedLoaderRequestSchema } = await import('@objectstack/spec/data');\n                     const request = SeedLoaderRequestSchema.parse({\n                         datasets: datasetsNow,\n                         config: {\n                             defaultMode: 'upsert',\n                             multiPass: true,\n                             organizationId,\n                         },\n                     });\n                     const result = await seedLoader.load(request);\n                     return {\n                         inserted: result.summary.totalInserted,\n                         updated: result.summary.totalUpdated,\n                         errors: result.errors,\n                     };\n                 };\n                 registerSvc('seed-replayer', replayer);\n                 ctx.logger.info(`[Seeder] Registered ${normalizedDatasets.length} datasets + replayer on kernel (total datasets: ${merged.length})`);\n             } catch (e: any) {\n                 ctx.logger.warn('[Seeder] Failed to register seed-datasets/seed-replayer service', { error: e?.message });\n             }\n\n             // Decide whether to also run the seed inline at AppPlugin\n             // start. In multi-tenant mode, the per-org replay (driven\n             // by SecurityPlugin's sys_organization middleware) is the\n             // source of truth — running it here too would create NULL-\n             // org rows that pollute reads and need a separate claim\n             // step. So we skip it. Single-tenant deployments keep the\n             // legacy behaviour: seed immediately at boot so there's\n             // always demo data without needing an org insert.\n             const multiTenant = String(process.env.OS_MULTI_TENANT ?? 'true').toLowerCase() !== 'false';\n             if (multiTenant) {\n                 ctx.logger.info('[Seeder] multi-tenant mode — skipping inline seed; per-org replay will run on sys_organization insert');\n             } else {\n             // Use SeedLoaderService for metadata-driven loading with reference resolution\n             try {\n                 const metadata = ctx.getService('metadata') as IMetadataService | undefined;\n                 if (metadata) {\n                     const seedLoader = new SeedLoaderService(ql, metadata, ctx.logger);\n                     const { SeedLoaderRequestSchema } = await import('@objectstack/spec/data');\n                     const request = SeedLoaderRequestSchema.parse({\n                         datasets: normalizedDatasets,\n                         config: { defaultMode: 'upsert', multiPass: true },\n                     });\n                     const result = await seedLoader.load(request);\n                     ctx.logger.info('[Seeder] Seed loading complete', {\n                         inserted: result.summary.totalInserted,\n                         updated: result.summary.totalUpdated,\n                         errors: result.errors.length,\n                     });\n                 } else {\n                     // Fallback: basic insert when metadata service is not available\n                     ctx.logger.debug('[Seeder] No metadata service; using basic insert fallback');\n                     for (const dataset of normalizedDatasets) {\n                         ctx.logger.info(`[Seeder] Seeding ${dataset.records.length} records for ${dataset.object}`);\n                         for (const record of dataset.records) {\n                             try {\n                                 await ql.insert(dataset.object, record, { context: { isSystem: true } } as any);\n                             } catch (err: any) {\n                                 ctx.logger.warn(`[Seeder] Failed to insert ${dataset.object} record:`, { error: err.message });\n                             }\n                         }\n                     }\n                     ctx.logger.info('[Seeder] Data seeding complete.');\n                 }\n             } catch (err: any) {\n                 // If SeedLoaderService fails (e.g., metadata not available), fall back to basic insert\n                 ctx.logger.warn('[Seeder] SeedLoaderService failed, falling back to basic insert', { error: err.message });\n                 for (const dataset of normalizedDatasets) {\n                     for (const record of dataset.records) {\n                         try {\n                             await ql.insert(dataset.object, record, { context: { isSystem: true } } as any);\n                         } catch (insertErr: any) {\n                             ctx.logger.warn(`[Seeder] Failed to insert ${dataset.object} record:`, { error: insertErr.message });\n                         }\n                     }\n                 }\n                 ctx.logger.info('[Seeder] Data seeding complete (fallback).');\n             }\n             }\n        }\n    }\n\n    stop = async (ctx: PluginContext) => {\n        const sys = this.bundle.manifest || this.bundle;\n        this.emitCatalogEvent(ctx, 'app:unregistered', sys);\n    }\n\n    /**\n     * Emit a kernel hook so the control-plane `AppCatalogService` can\n     * upsert / delete the corresponding `sys_app` row. Silently no-ops\n     * when no project context is attached (standalone single-tenant mode)\n     * or when the kernel has no `trigger` API available.\n     */\n    private emitCatalogEvent(ctx: PluginContext, event: 'app:registered' | 'app:unregistered', sys: any): void {\n        if (!this.projectContext) return;\n\n        const trigger = (ctx as any).trigger;\n        if (typeof trigger !== 'function') {\n            ctx.logger.debug('[AppPlugin] kernel has no trigger() — skipping catalog hook', { event });\n            return;\n        }\n\n        const appName = sys.name || sys.id;\n        if (!appName) return;\n\n        const payload = {\n            environmentId: this.projectContext.environmentId,\n            organizationId: this.projectContext.organizationId,\n            projectName: this.projectContext.projectName,\n            app: {\n                name: appName,\n                label: sys.label,\n                icon: sys.icon,\n                branding: sys.branding,\n                isDefault: sys.isDefault ?? sys.is_default,\n                active: sys.active !== false,\n            },\n            source: this.projectContext.source ?? (this.projectContext.packageId ? 'package' : 'user'),\n            packageId: this.projectContext.packageId,\n        };\n\n        try {\n            trigger.call(ctx, event, payload);\n        } catch (err: any) {\n            ctx.logger.warn('[AppPlugin] catalog hook trigger failed', { event, error: err?.message });\n        }\n    }\n\n    /**\n     * Auto-load i18n translation bundles from the app config into the\n     * kernel's i18n service. Handles both `translations` (array of\n     * TranslationBundle) and `i18n` config (default locale, etc.).\n     *\n     * Gracefully skips when the i18n service is not registered —\n     * this keeps AppPlugin resilient across server/dev/mock environments.\n     */\n    private async loadTranslations(ctx: PluginContext, appId: string): Promise<void> {\n        // ctx.getService throws when a service is not registered, so we\n        // must use try/catch to gracefully skip when no i18n plugin is loaded.\n        let i18nService: II18nService | undefined;\n        try {\n            i18nService = ctx.getService('i18n') as II18nService;\n        } catch {\n            // Service not registered — handled below\n        }\n\n        // Collect translation bundles early to determine if we have data\n        const bundles: Array<Record<string, unknown>> = [];\n        if (Array.isArray(this.bundle.translations)) {\n            bundles.push(...this.bundle.translations);\n        }\n        const manifest = this.bundle.manifest || this.bundle;\n        if (manifest && Array.isArray(manifest.translations) && manifest.translations !== this.bundle.translations) {\n            bundles.push(...manifest.translations);\n        }\n\n        if (!i18nService) {\n            if (bundles.length > 0) {\n                // Auto-register the in-memory i18n fallback so the bundles\n                // we already loaded server-side become discoverable through\n                // `getService('i18n')` (used by the REST API to localize\n                // view / action / object metadata). Without this step,\n                // bundles authored in `defineStack({ translations })` were\n                // silently dropped on standalone/dev stacks that didn't\n                // explicitly install I18nServicePlugin.\n                try {\n                    const mod = await import('@objectstack/core');\n                    const createMemoryI18n = (mod as any).createMemoryI18n;\n                    if (typeof createMemoryI18n === 'function') {\n                        const fallback = createMemoryI18n();\n                        (ctx as any).registerService('i18n', fallback);\n                        i18nService = fallback;\n                        ctx.logger.info(\n                            `[i18n] Auto-registered in-memory i18n fallback for \"${appId}\" (${bundles.length} bundle(s) detected). ` +\n                            'Install I18nServicePlugin from @objectstack/service-i18n for file-based / production use.'\n                        );\n                    }\n                } catch (err: any) {\n                    ctx.logger.warn(\n                        `[i18n] App \"${appId}\" has ${bundles.length} translation bundle(s) but auto-fallback failed: ${err?.message ?? err}.`\n                    );\n                    return;\n                }\n                if (!i18nService) {\n                    ctx.logger.warn(\n                        `[i18n] App \"${appId}\" has ${bundles.length} translation bundle(s) but no i18n service is registered.`\n                    );\n                    return;\n                }\n            } else {\n                ctx.logger.debug('[i18n] No i18n service registered; skipping translation loading', { appId });\n                return;\n            }\n        }\n\n        // Apply i18n config (default locale, etc.)\n        const i18nConfig = this.bundle.i18n || (this.bundle.manifest || this.bundle)?.i18n;\n        if (i18nConfig?.defaultLocale && typeof i18nService.setDefaultLocale === 'function') {\n            i18nService.setDefaultLocale(i18nConfig.defaultLocale);\n            ctx.logger.debug('[i18n] Set default locale', { appId, locale: i18nConfig.defaultLocale });\n        }\n\n        if (bundles.length === 0) {\n            return;\n        }\n\n        let loadedLocales = 0;\n        for (const bundle of bundles) {\n            // Each bundle is a TranslationBundle: Record<locale, TranslationData>\n            for (const [locale, data] of Object.entries(bundle)) {\n                if (data && typeof data === 'object') {\n                    try {\n                        i18nService.loadTranslations(locale, data as Record<string, unknown>);\n                        loadedLocales++;\n                    } catch (err: any) {\n                        ctx.logger.warn('[i18n] Failed to load translations', { appId, locale, error: err.message });\n                    }\n                }\n            }\n        }\n\n        // Emit diagnostic when the active i18n service is a fallback/stub\n        const svcAny = i18nService as unknown as Record<string, unknown>;\n        if (svcAny._fallback || svcAny._dev) {\n            ctx.logger.info(\n                `[i18n] Loaded ${loadedLocales} locale(s) into in-memory i18n fallback for \"${appId}\". ` +\n                'For production, consider registering I18nServicePlugin from @objectstack/service-i18n.'\n            );\n        } else {\n            ctx.logger.info('[i18n] Loaded translation bundles', { appId, bundles: bundles.length, locales: loadedLocales });\n        }\n    }\n}\n\n// ─── Bundle hook & function collectors ──────────────────────────────\n// Hooks declared in `defineStack({ hooks })` end up at `bundle.hooks`;\n// some legacy bundles still nest them under `manifest.hooks`. We dedupe\n// (by reference) so the same array isn't bound twice when both shapes\n// happen to point at the same list.\n\n/** Collect declarative `Hook` definitions from a bundle (top-level + manifest). */\nexport function collectBundleHooks(bundle: any): any[] {\n    const out: any[] = [];\n    const seen = new Set<any>();\n    const push = (arr: any) => {\n        if (!Array.isArray(arr)) return;\n        for (const h of arr) {\n            if (h && !seen.has(h)) {\n                seen.add(h);\n                out.push(h);\n            }\n        }\n    };\n    push(bundle?.hooks);\n    push(bundle?.manifest?.hooks);\n    return out;\n}\n\n/**\n * Collect declarative actions from the bundle. Walks both root-level\n * `actions[]` and per-object `objects[*].actions[]`, attaching the parent\n * object name where applicable so `engine.registerAction(object, name, ...)`\n * sees the correct routing key.\n *\n * Each returned record is a shallow copy with `object` set when the action\n * originated under an object (and not already present on the action itself).\n */\nexport function collectBundleActions(\n    bundle: any,\n): Array<{ name: string; object?: string; body?: unknown; type?: string; [k: string]: unknown }> {\n    const out: any[] = [];\n    const seen = new Set<any>();\n    const push = (arr: any, parentObject?: string) => {\n        if (!Array.isArray(arr)) return;\n        for (const a of arr) {\n            if (!a || typeof a !== 'object' || typeof a.name !== 'string') continue;\n            if (seen.has(a)) continue;\n            seen.add(a);\n            const inferredObject =\n                typeof a.object === 'string' ? a.object\n                : typeof a.objectName === 'string' ? a.objectName\n                : parentObject;\n            out.push(inferredObject ? { ...a, object: inferredObject } : { ...a });\n        }\n    };\n    push(bundle?.actions);\n    push(bundle?.manifest?.actions);\n    if (Array.isArray(bundle?.objects)) {\n        for (const o of bundle.objects) push(o?.actions, o?.name);\n    }\n    if (Array.isArray(bundle?.manifest?.objects)) {\n        for (const o of bundle.manifest.objects) push(o?.actions, o?.name);\n    }\n    return out;\n}\n\n/**\n * Collect a name → handler map from `bundle.functions`. Accepted shapes:\n *\n *   - `{ functions: { foo: fn, bar: fn } }`           ← preferred map form\n *   - `{ functions: [{ name: 'foo', handler: fn }] }` ← array of records\n *\n * String-named hook handlers (`Hook.handler: 'foo'`) are resolved against\n * this map (and the engine's persistent function registry).\n */\nexport function collectBundleFunctions(bundle: any): Record<string, (ctx: any) => any> {\n    const out: Record<string, (ctx: any) => any> = {};\n    const merge = (src: any) => {\n        if (!src) return;\n        if (Array.isArray(src)) {\n            for (const item of src) {\n                if (item && typeof item.name === 'string' && typeof item.handler === 'function') {\n                    out[item.name] = item.handler;\n                }\n            }\n        } else if (typeof src === 'object') {\n            for (const [name, fn] of Object.entries(src)) {\n                if (typeof fn === 'function') out[name] = fn as any;\n            }\n        }\n    };\n    merge(bundle?.functions);\n    merge(bundle?.manifest?.functions);\n    return out;\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Platform SSO — shared between the cloud control-plane and the per-project\n * runtime kernels created by {@link ArtifactKernelFactory}.\n *\n * The architecture is \"Airtable-style unified login\": a builder signs in\n * once on `cloud.<root>` and is JIT-provisioned as a `sys_user` on every\n * per-project deployment (`<project>.<root>`) via the OAuth2 / OIDC\n * authorization-code flow.\n *\n *   - cloud  = OIDC Identity Provider (better-auth's `oauth-provider` plugin\n *              — already wired in {@link AuthPlugin} when `oidcProvider:true`)\n *   - project = OIDC Relying Party  (better-auth's `genericOAuth` plugin —\n *              opted in via the `oidcProviders` array on AuthPluginOptions)\n *\n * For the two sides to trust each other without runtime DB calls during\n * the SSO handshake, we use deterministic, derived client credentials:\n *\n *   - `client_id`     = `'project_' + environmentId`\n *   - `client_secret` = HMAC-SHA256(baseSecret, 'oauth-client:' + environmentId)\n *   - `redirect_uri`  = `https://<hostname>/api/v1/auth/oauth2/callback/<PROVIDER_ID>`\n *\n * Both cloud and project containers share the same `OS_AUTH_SECRET` (or\n * `AUTH_SECRET`) — that's the only piece of state required for the\n * project-side runtime to derive the right secret without a control-plane\n * lookup. The cloud-side row in `sys_oauth_application` is a one-time\n * write per project and is upserted in two places:\n *\n *   1. {@link seedPlatformSsoClient} — called from the project-provisioning\n *      flow in `http-dispatcher.ts` right after the `sys_environment` row is\n *      inserted, so brand-new projects can SSO from the very first request.\n *   2. {@link backfillPlatformSsoClients} — registered as a boot-time\n *      plugin in `control-plane-preset.ts` to retro-fit any pre-existing\n *      projects that were created before this code shipped.\n */\n\nimport { createHmac, createHash } from 'node:crypto';\n\n/**\n * Provider id used in better-auth's `genericOAuth` and as part of the\n * callback URL: `/api/v1/auth/oauth2/callback/<PROVIDER_ID>`. Keep stable —\n * changing it invalidates every registered redirect_uri.\n */\nexport const PLATFORM_SSO_PROVIDER_ID = 'objectstack-cloud';\n\n/**\n * Derive the per-project OAuth client_id used in `sys_oauth_application`\n * (cloud side) and {@link genericOAuth} config (project side).\n */\nexport function derivePlatformSsoClientId(environmentId: string): string {\n    return `project_${environmentId}`;\n}\n\n/**\n * Derive the per-project OAuth client_secret deterministically from the\n * shared master secret. HMAC-SHA256(baseSecret, 'oauth-client:' + environmentId)\n * yields a 64-char hex string that is:\n *   - stable across container cold-starts (no DB lookup needed)\n *   - independent per project (compromising one does not compromise others)\n *   - rotatable via OS_AUTH_SECRET rotation (invalidates all SSO clients)\n *\n * This is the **plaintext** value the RP must present at the token endpoint.\n * The cloud-side `sys_oauth_application.client_secret` column instead stores\n * {@link hashPlatformSsoClientSecret}(plaintext) — better-auth's oauth-provider\n * defaults to `storeClientSecret: 'hashed'` (SHA-256 + base64url) when the JWT\n * plugin is enabled, and looks up the row by hashing the presented secret.\n */\nexport function derivePlatformSsoClientSecret(baseSecret: string, environmentId: string): string {\n    return createHmac('sha256', baseSecret).update(`oauth-client:${environmentId}`).digest('hex');\n}\n\n/**\n * Hash the plaintext client_secret the same way `@better-auth/oauth-provider`'s\n * `defaultHasher` does it: SHA-256 → base64url (no padding). This MUST match\n * exactly or the token endpoint returns `invalid_client / invalid client_secret`\n * even though the row is present.\n *\n * Reference: `node_modules/@better-auth/oauth-provider/dist/utils-*.mjs` →\n *   `const defaultHasher = async (value) => base64Url.encode(SHA-256(value))`\n */\nexport function hashPlatformSsoClientSecret(plaintext: string): string {\n    return createHash('sha256').update(plaintext)\n        .digest('base64')\n        .replace(/=+$/, '')\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_');\n}\n\n/**\n * Build the redirect_uri better-auth's `genericOAuth` plugin will use\n * when the project kernel mounts the provider with id\n * {@link PLATFORM_SSO_PROVIDER_ID}. MUST be one of the URIs registered\n * on the cloud-side oauth client or the authorization server will reject\n * the callback with `invalid_request`.\n */\nexport function buildPlatformSsoRedirectUri(hostname: string, basePath: string = '/api/v1/auth'): string {\n    let host: string;\n    if (hostname.startsWith('http://') || hostname.startsWith('https://')) {\n        host = hostname;\n    } else if (/(\\.|^)localhost(:\\d+)?$/i.test(hostname)) {\n        // Local dev: localhost subdomains run on plain http with a custom\n        // port. When the caller passes only a hostname (no scheme/port),\n        // append the configured runtime port so the OAuth redirect_uri\n        // matches what the browser can actually reach. We read\n        // OS_RUNTIME_PORT (NOT PORT) because both the cloud control plane\n        // and the runtime container call this function — only the runtime\n        // port is meaningful for the callback.\n        const port = (process.env.OS_RUNTIME_PORT ?? '').trim();\n        const hostWithPort = /:\\d+$/.test(hostname) || !port ? hostname : `${hostname}:${port}`;\n        host = `http://${hostWithPort}`;\n    } else {\n        host = `https://${hostname}`;\n    }\n    const trimmed = host.replace(/\\/+$/, '');\n    const path = basePath.replace(/\\/+$/, '');\n    return `${trimmed}${path}/oauth2/callback/${PLATFORM_SSO_PROVIDER_ID}`;\n}\n\nexport interface SeedPlatformSsoClientOptions {\n    /**\n     * Cloud control-plane ObjectQL engine. Must expose `find(object, query)`,\n     * `insert(object, data)`, and `update(object, data, {where})`. Both the\n     * `apps/cloud` boot kernel (via `kernel.getService('objectql')`) and the\n     * dispatcher's local `ql` reference satisfy this shape.\n     */\n    ql: {\n        find: (object: string, query: any, opts?: any) => Promise<any>;\n        insert: (object: string, data: any, opts?: any) => Promise<any>;\n        update: (object: string, data: any, where: any, opts?: any) => Promise<any>;\n    };\n    /** Project id (also used to derive client_id + client_secret). */\n    environmentId: string;\n    /**\n     * Project hostname (e.g. `acme-crm.objectos.app`). Optional — projects\n     * may be created before a hostname is assigned, in which case no\n     * redirect_uri is registered yet and the row is upserted with an\n     * empty `redirect_uris` array. Calling this function again once the\n     * hostname is known will merge the new URI in.\n     */\n    hostname?: string | null;\n    /** Master secret shared between cloud and project containers. */\n    baseSecret: string;\n    /** Optional logger for diagnostics. */\n    logger?: { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };\n    /** When true, rethrow insert/update errors instead of swallowing them.\n     * Backfill uses this to surface real failures via the admin endpoint. */\n    throwOnError?: boolean;\n}\n\n/**\n * Idempotently upsert a `sys_oauth_application` row for the given project.\n * Re-running with the same `environmentId` is a no-op (the deterministic\n * `client_id` is uniquely indexed and the secret derivation is stable).\n * Re-running with a new `hostname` adds the new redirect_uri to the\n * existing row's JSON array.\n */\nexport async function seedPlatformSsoClient(opts: SeedPlatformSsoClientOptions): Promise<void> {\n    const { ql, environmentId, hostname, baseSecret, logger, throwOnError } = opts;\n    if (!baseSecret) {\n        logger?.warn?.('[platform-sso] OS_AUTH_SECRET not set — skipping client seed', { environmentId });\n        return;\n    }\n    const clientId = derivePlatformSsoClientId(environmentId);\n    const clientSecretPlaintext = derivePlatformSsoClientSecret(baseSecret, environmentId);\n    const clientSecretStored = hashPlatformSsoClientSecret(clientSecretPlaintext);\n    const desiredRedirect = hostname ? buildPlatformSsoRedirectUri(hostname) : null;\n\n    let existing: any = null;\n    try {\n        const rows = await ql.find('sys_oauth_application', {\n            where: { client_id: clientId },\n            limit: 1,\n        }, { context: { isSystem: true } });\n        const list = Array.isArray(rows) ? rows : Array.isArray((rows as any)?.records) ? (rows as any).records : [];\n        existing = list[0] ?? null;\n    } catch (err) {\n        // Table may not exist yet (control-plane not yet migrated). Treat\n        // as a no-op rather than crashing the project-create flow.\n        logger?.warn?.('[platform-sso] sys_oauth_application read failed — skipping seed', {\n            environmentId,\n            error: (err as Error)?.message,\n        });\n        return;\n    }\n\n    const nowIso = new Date().toISOString();\n    if (!existing) {\n        const redirects = desiredRedirect ? [desiredRedirect] : [];\n        try {\n            await ql.insert('sys_oauth_application', {\n                id: `oauthc_${environmentId}`,\n                name: `Project ${environmentId}`,\n                client_id: clientId,\n                client_secret: clientSecretStored,\n                type: 'web',\n                redirect_uris: JSON.stringify(redirects),\n                grant_types: JSON.stringify(['authorization_code', 'refresh_token']),\n                response_types: JSON.stringify(['code']),\n                scopes: JSON.stringify(['openid', 'email', 'profile']),\n                token_endpoint_auth_method: 'client_secret_basic',\n                require_pkce: false,\n                skip_consent: true,\n                disabled: false,\n                subject_type: 'public',\n                created_at: nowIso,\n                updated_at: nowIso,\n            }, { context: { isSystem: true } });\n            logger?.info?.('[platform-sso] sys_oauth_application row created', { environmentId, clientId });\n        } catch (err) {\n            // Unique-index conflict implies a parallel writer raced us; treat\n            // as success. Other errors are logged but non-fatal so they\n            // don't poison the project-create response.\n            logger?.warn?.('[platform-sso] sys_oauth_application create failed', {\n                environmentId,\n                error: (err as Error)?.message,\n            });\n            if (throwOnError) throw err;\n        }\n        return;\n    }\n\n    // Row exists — repair it. We always overwrite the canonical fields\n    // (client_secret, grant_types, response_types, scopes, token_endpoint_auth_method,\n    // require_pkce, skip_consent, subject_type, type, disabled) because older code\n    // paths may have written rows with missing or wrong-shape values, and\n    // re-running the seed should converge to the known-good shape.\n    // For redirect_uris we MERGE — re-provisioning a project under an\n    // additional hostname should add the new URI without dropping the old one.\n    let currentRedirects: string[] = [];\n    try {\n        const raw = existing.redirect_uris;\n        const parsed = typeof raw === 'string' ? JSON.parse(raw) : raw;\n        if (Array.isArray(parsed)) currentRedirects = parsed.filter((s): s is string => typeof s === 'string');\n    } catch { /* malformed JSON — treat as empty */ }\n    const mergedRedirects = desiredRedirect && !currentRedirects.includes(desiredRedirect)\n        ? [...currentRedirects, desiredRedirect]\n        : currentRedirects;\n\n    const repairPatch: Record<string, any> = {\n        name: existing.name || `Project ${environmentId}`,\n        client_secret: clientSecretStored,\n        type: existing.type || 'web',\n        redirect_uris: JSON.stringify(mergedRedirects),\n        grant_types: JSON.stringify(['authorization_code', 'refresh_token']),\n        response_types: JSON.stringify(['code']),\n        scopes: JSON.stringify(['openid', 'email', 'profile']),\n        token_endpoint_auth_method: 'client_secret_basic',\n        require_pkce: false,\n        skip_consent: true,\n        disabled: false,\n        subject_type: 'public',\n        updated_at: nowIso,\n    };\n    try {\n        await ql.update(\n            'sys_oauth_application',\n            repairPatch,\n            { where: { id: existing.id } },\n            { context: { isSystem: true } },\n        );\n        logger?.info?.('[platform-sso] sys_oauth_application repaired', {\n            environmentId,\n            clientId,\n            redirect_uris: mergedRedirects,\n        });\n    } catch (err) {\n        logger?.warn?.('[platform-sso] sys_oauth_application repair failed', {\n            environmentId,\n            error: (err as Error)?.message,\n        });\n        if (throwOnError) throw err;\n    }\n}\n\nexport interface BackfillPlatformSsoClientsOptions {\n    ql: SeedPlatformSsoClientOptions['ql'];\n    baseSecret: string;\n    logger?: { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };\n    /** Hard cap on rows scanned (default: 1000). */\n    limit?: number;\n}\n\n/**\n * Scan `sys_environment` and ensure every active project has a corresponding\n * `sys_oauth_application` row. Intended to run once at cloud boot — the\n * happy path is dominated by the project-create hook\n * ({@link seedPlatformSsoClient}); the backfill exists so projects\n * created before this feature shipped also get SSO support without an\n * out-of-band migration.\n */\nexport async function backfillPlatformSsoClients(opts: BackfillPlatformSsoClientsOptions): Promise<{\n    scanned: number;\n    seeded: number;\n    alreadyExisted: number;\n    failures: Array<{ environmentId: string; error: string }>;\n}> {\n    const { ql, baseSecret, logger, limit = 1000 } = opts;\n    if (!baseSecret) {\n        logger?.warn?.('[platform-sso] backfill skipped — OS_AUTH_SECRET not set');\n        return { scanned: 0, seeded: 0, alreadyExisted: 0, failures: [] };\n    }\n    let projects: any[] = [];\n    try {\n        const rows = await ql.find('sys_environment', {\n            limit,\n            fields: ['id', 'hostname', 'status'],\n        }, { context: { isSystem: true } });\n        projects = Array.isArray(rows) ? rows : Array.isArray((rows as any)?.records) ? (rows as any).records : [];\n    } catch (err) {\n        logger?.warn?.('[platform-sso] backfill: sys_environment read failed', {\n            error: (err as Error)?.message,\n        });\n        return { scanned: 0, seeded: 0, alreadyExisted: 0, failures: [{ environmentId: '<scan>', error: (err as Error)?.message ?? String(err) }] };\n    }\n    let seeded = 0;\n    let alreadyExisted = 0;\n    const failures: Array<{ environmentId: string; error: string }> = [];\n    for (const p of projects) {\n        if (!p?.id) continue;\n        const before = await (async () => {\n            try {\n                const r = await ql.find('sys_oauth_application', {\n                    where: { client_id: derivePlatformSsoClientId(p.id) },\n                    limit: 1,\n                }, { context: { isSystem: true } });\n                const list = Array.isArray(r) ? r : Array.isArray((r as any)?.records) ? (r as any).records : [];\n                return list[0] ?? null;\n            } catch { return null; }\n        })();\n        try {\n            await seedPlatformSsoClient({ ql, environmentId: p.id, hostname: p.hostname, baseSecret, logger, throwOnError: true });\n            if (before) alreadyExisted++;\n            else {\n                // Verify the row is actually readable post-insert.\n                const after = await (async () => {\n                    try {\n                        const r = await ql.find('sys_oauth_application', {\n                            where: { client_id: derivePlatformSsoClientId(p.id) },\n                            limit: 1,\n                        }, { context: { isSystem: true } });\n                        const list = Array.isArray(r) ? r : Array.isArray((r as any)?.records) ? (r as any).records : [];\n                        return list[0] ?? null;\n                    } catch (err) { return { _readErr: (err as Error)?.message }; }\n                })();\n                if (after && !(after as any)._readErr) seeded++;\n                else failures.push({ environmentId: p.id, error: `post-insert read returned ${after ? JSON.stringify(after) : 'null'}` });\n            }\n        } catch (err: any) {\n            failures.push({ environmentId: p.id, error: err?.message ?? String(err) });\n        }\n    }\n    logger?.info?.('[platform-sso] backfill complete', { scanned: projects.length, seeded, alreadyExisted, failures: failures.length });\n    return { scanned: projects.length, seeded, alreadyExisted, failures };\n}\n","/**\n * Pre-seed the OWNING cloud organization into a freshly-provisioned\n * project DB.\n *\n * Why this exists\n * ---------------\n * Every project at the cloud control plane is owned by exactly one\n * `sys_organization` (cloud-side). Without mirroring that org into the\n * project DB, the project would start empty and SecurityPlugin's\n * `ensureUserHasOrganization` middleware would auto-create a personal\n * \"Alice's Workspace\" for the project owner — completely disconnected\n * from the team workspace that owns the project at the platform level.\n *\n * Mirroring the owning org here makes the project's primary org match\n * the cloud team. Subsequent JIT-provisioned members of the same cloud\n * org get attached to this same row (Phase 2 — claim-driven by the SSO\n * callback).\n *\n * Idempotency\n * -----------\n * Keyed by the cloud `organization_id`. Re-runs across cold-boots are\n * safe no-ops; a row with that id either already exists or gets\n * inserted on the first boot of the project worker.\n */\n\nimport type { ObjectKernel } from '@objectstack/core';\n\nexport interface ProjectOrgSeed {\n    /** Cloud `sys_organization.id` of the project's owning org. Reused as the project-side `sys_organization.id` so cross-tier references stay consistent. */\n    id: string;\n    /** Display name copied from the cloud org. */\n    name: string;\n    /** URL slug copied from the cloud org. */\n    slug?: string | null;\n    /** Optional logo URL. */\n    logo?: string | null;\n}\n\nconst SYS_ORG = 'sys_organization';\n\n/**\n * Insert the project's owning organization into the project's\n * `sys_organization` table.\n *\n * Returns:\n *   - `'inserted'` — the row was newly seeded\n *   - `'exists'`   — a row with this id already existed (no-op)\n *   - `'skipped'`  — payload missing required fields (no-op)\n *   - `'error'`    — an unexpected failure; details logged via `logger.warn`\n *                     (we never throw — org seed is best-effort)\n */\nexport async function seedProjectOrganization(\n    kernel: ObjectKernel,\n    seed: ProjectOrgSeed,\n    logger?: { info?: (msg: string, ctx?: any) => void; warn?: (msg: string, ctx?: any) => void },\n): Promise<'inserted' | 'exists' | 'skipped' | 'error'> {\n    if (!seed?.id || !seed?.name) return 'skipped';\n\n    try {\n        const ql: any = kernel.getService('objectql');\n        if (!ql?.insert || !ql?.find) {\n            logger?.warn?.('[seedProjectOrganization] objectql service unavailable', { orgId: seed.id });\n            return 'skipped';\n        }\n\n        try {\n            const existing = await ql.find(SYS_ORG, { where: { id: seed.id } } as any);\n            const rows = Array.isArray(existing) ? existing : (existing?.value ?? []);\n            if (Array.isArray(rows) && rows.length > 0) return 'exists';\n        } catch {\n            // schema may not be fully synced on first cold-boot; fall\n            // through to insert — the DB layer will enforce uniqueness.\n        }\n\n        const nowIso = new Date().toISOString();\n        await ql.insert(SYS_ORG, {\n            id: seed.id,\n            name: seed.name,\n            slug: seed.slug ?? null,\n            logo: seed.logo ?? null,\n            metadata: null,\n            created_at: nowIso,\n        });\n\n        logger?.info?.('[seedProjectOrganization] org seeded', {\n            orgId: seed.id,\n            name: seed.name,\n        });\n        return 'inserted';\n    } catch (err: any) {\n        logger?.warn?.('[seedProjectOrganization] failed (non-fatal)', {\n            orgId: seed.id,\n            error: err?.message,\n        });\n        return 'error';\n    }\n}\n\n/**\n * Insert a `sys_member` row linking a user to an organization with a\n * given role. Idempotent on (user_id, organization_id).\n *\n * Used in tandem with `seedProjectOrganization` to bind the project\n * owner to the mirrored cloud org BEFORE SecurityPlugin's\n * `ensureUserHasOrganization` middleware would otherwise auto-create a\n * disjoint personal workspace.\n *\n * Returns the same status enum as the org/owner seed helpers.\n */\nexport async function seedProjectMember(\n    kernel: ObjectKernel,\n    args: {\n        userId: string;\n        organizationId: string;\n        role?: 'owner' | 'admin' | 'member';\n    },\n    logger?: { info?: (msg: string, ctx?: any) => void; warn?: (msg: string, ctx?: any) => void },\n): Promise<'inserted' | 'exists' | 'skipped' | 'error'> {\n    const { userId, organizationId } = args;\n    const role = args.role ?? 'member';\n    if (!userId || !organizationId) return 'skipped';\n\n    try {\n        const ql: any = kernel.getService('objectql');\n        if (!ql?.insert || !ql?.find) {\n            logger?.warn?.('[seedProjectMember] objectql service unavailable', { userId, organizationId });\n            return 'skipped';\n        }\n\n        try {\n            const existing = await ql.find('sys_member', {\n                where: { user_id: userId, organization_id: organizationId },\n            } as any);\n            const rows = Array.isArray(existing) ? existing : (existing?.value ?? []);\n            if (Array.isArray(rows) && rows.length > 0) return 'exists';\n        } catch {\n            // see comment in seedProjectOrganization\n        }\n\n        const nowIso = new Date().toISOString();\n        // sys_member's primary key is generated by the org plugin; we\n        // pre-generate a stable id of the form `mem_<short>` to match\n        // the existing convention in `ensureUserHasOrganization`.\n        const memId = `mem_${Math.random().toString(36).slice(2, 14)}`;\n        await ql.insert('sys_member', {\n            id: memId,\n            organization_id: organizationId,\n            user_id: userId,\n            role,\n            created_at: nowIso,\n        });\n\n        logger?.info?.('[seedProjectMember] member seeded', {\n            userId,\n            organizationId,\n            role,\n        });\n        return 'inserted';\n    } catch (err: any) {\n        logger?.warn?.('[seedProjectMember] failed (non-fatal)', {\n            userId,\n            organizationId,\n            error: err?.message,\n        });\n        return 'error';\n    }\n}\n","/**\n * Pre-seed the project owner into a freshly-provisioned project DB.\n *\n * Why this exists\n * ---------------\n * When a user creates a project on the cloud control plane, the project\n * gets a brand-new isolated database. On first access, the SSO callback\n * would otherwise treat the project owner as just another anonymous JIT\n * user — no admin role, no membership, no recognition that *this is the\n * person who owns this project*. The owner then has to manually promote\n * themselves via the org membership UI, which is friction the user does\n * not deserve to pay.\n *\n * Worse: better-auth's `accountLinking` safety check rejects implicit\n * link of an unverified local row with an unverified OAuth identity\n * (`error=account_not_linked`). Pre-seeding with `emailVerified: true`\n * (cloud already verified them upstream) makes the link clean.\n *\n * Idempotency\n * -----------\n * The seed is keyed by the cloud `userId`. If a `sys_user` row with that\n * id already exists in the project DB, this is a no-op — safe to call\n * on every cold-boot. SecurityPlugin's `sys_user` insert middleware\n * (mounted by ArtifactKernelFactory) auto-creates the personal\n * organization + `sys_member(owner)` binding as a side effect of the\n * insert, so callers do not need to wire membership themselves.\n */\n\nimport type { ObjectKernel } from '@objectstack/core';\n\nexport interface ProjectOwnerSeed {\n    /** Cloud `sys_user.id` of the project creator. Used as the project-side `sys_user.id` so SSO callbacks link by id, not by email-match. */\n    userId: string;\n    /** Verified email at cloud — copied here so the link check passes without a project-side verification flow. */\n    email: string;\n    /** Display name; nullable to tolerate users who never set one. */\n    name?: string | null;\n    /** Avatar URL; nullable. */\n    image?: string | null;\n}\n\nconst SYS_USER = 'sys_user';\n\n/**\n * Insert the project owner into the project's `sys_user` table.\n *\n * Returns:\n *   - `'inserted'` — the row was newly seeded\n *   - `'exists'`   — a row with this id already existed (no-op)\n *   - `'skipped'`  — payload missing required fields (no-op)\n *   - `'error'`    — an unexpected failure; details logged via `logger.warn`\n *                     (we never throw — owner seed is best-effort)\n */\nexport async function seedProjectOwner(\n    kernel: ObjectKernel,\n    seed: ProjectOwnerSeed,\n    logger?: { info?: (msg: string, ctx?: any) => void; warn?: (msg: string, ctx?: any) => void },\n): Promise<'inserted' | 'exists' | 'skipped' | 'error'> {\n    if (!seed?.userId || !seed?.email) return 'skipped';\n\n    try {\n        const ql: any = kernel.getService('objectql');\n        if (!ql?.insert || !ql?.find) {\n            logger?.warn?.('[seedProjectOwner] objectql service unavailable', { userId: seed.userId });\n            return 'skipped';\n        }\n\n        // Idempotency check: bail if the owner is already present. We key\n        // off `id` (not email) so re-runs are safe even if the user later\n        // changes their cloud email.\n        try {\n            const existing = await ql.find(SYS_USER, { where: { id: seed.userId } } as any);\n            const rows = Array.isArray(existing) ? existing : (existing?.value ?? []);\n            if (Array.isArray(rows) && rows.length > 0) return 'exists';\n        } catch {\n            // `find` may legitimately fail on cold-start before the schema\n            // is fully synced. Fall through to the insert — uniqueness will\n            // also be enforced at the DB layer.\n        }\n\n        const nowIso = new Date().toISOString();\n        await ql.insert(SYS_USER, {\n            id: seed.userId,\n            email: seed.email,\n            name: seed.name ?? seed.email.split('@')[0] ?? 'Owner',\n            image: seed.image ?? null,\n            // Cloud already verified the upstream email. Marking it verified\n            // here is what unblocks better-auth's accountLinking check on\n            // the first SSO callback (alongside the trustedProviders config\n            // in plugin-auth/auth-manager.ts).\n            email_verified: true,\n            created_at: nowIso,\n            updated_at: nowIso,\n        });\n\n        logger?.info?.('[seedProjectOwner] owner seeded', {\n            userId: seed.userId,\n            email: seed.email,\n        });\n        return 'inserted';\n    } catch (err: any) {\n        // Common benign cases: race with another cold-boot, or unique\n        // constraint violation if two requests interleave. Log + swallow.\n        logger?.warn?.('[seedProjectOwner] failed (non-fatal)', {\n            userId: seed.userId,\n            error: err?.message,\n        });\n        return 'error';\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n// Export Kernels\nexport { ObjectKernel } from '@objectstack/core';\n\n// Export Runtime\nexport { Runtime } from './runtime.js';\nexport type { RuntimeConfig } from './runtime.js';\n\n// Export Standalone Stack\nexport { createStandaloneStack } from './standalone-stack.js';\nexport type { StandaloneStackConfig, StandaloneStackResult } from './standalone-stack.js';\n\n// Export Default Host (artifact-first, no objectstack.config.ts required)\nexport { createDefaultHostConfig, resolveDefaultArtifactPath } from './default-host.js';\nexport type { DefaultHostConfigOptions, DefaultHostConfigResult } from './default-host.js';\n\n// Export Plugins\nexport { DriverPlugin } from './driver-plugin.js';\nexport { AppPlugin, collectBundleHooks, collectBundleFunctions, collectBundleActions } from './app-plugin.js';\nexport { SeedLoaderService } from './seed-loader.js';\nexport { createDispatcherPlugin } from './dispatcher-plugin.js';\nexport type { DispatcherPluginConfig } from './dispatcher-plugin.js';\nexport { createSystemEnvironmentPlugin, SYSTEM_ENVIRONMENT_ID } from './system-environment-plugin.js';\nexport type { SystemEnvironmentPluginConfig } from './system-environment-plugin.js';\n\n// Export HTTP Server Components\nexport { HttpServer } from './http-server.js';\nexport { HttpDispatcher } from './http-dispatcher.js';\nexport type { HttpProtocolContext, HttpDispatcherResult } from './http-dispatcher.js';\nexport { MiddlewareManager } from './middleware.js';\n\n// ── Security primitives ───────────────────────────────────────────────\n// Adapter-agnostic helpers for response hardening (CSP/HSTS/XCTO/…)\n// and per-IP token-bucket rate limiting. The dispatcher plugin wires\n// security headers automatically; rate limiting is exposed as a\n// primitive so adapters can mount it at the appropriate layer (see\n// `docs/guide/hardening.md`).\nexport {\n    buildSecurityHeaders,\n    type SecurityHeadersOptions,\n    RateLimiter,\n    DEFAULT_RATE_LIMITS,\n    type RateLimitBucketConfig,\n    type RateLimitDecision,\n    type RateLimitDefaults,\n    type RateLimitStore,\n} from './security/index.js';\n\n// ── Observability primitives ──────────────────────────────────────────\n// Request-id propagation (X-Request-Id + W3C traceparent), pluggable\n// MetricsRegistry, and pluggable ErrorReporter. The dispatcher plugin\n// wraps every route with instrumentation when these are configured;\n// see `docs/guide/observability.md`.\nexport {\n    extractRequestId,\n    generateRequestId,\n    resolveRequestId,\n    parseTraceparent,\n    formatTraceparent,\n    type TraceContext,\n    NoopMetricsRegistry,\n    InMemoryMetricsRegistry,\n    RUNTIME_METRICS,\n    type MetricsRegistry,\n    type MetricSample,\n    NoopErrorReporter,\n    InMemoryErrorReporter,\n    type ErrorReporter,\n    type CapturedError,\n    ObservabilityServicePlugin,\n    OBSERVABILITY_METRICS_SERVICE,\n    OBSERVABILITY_ERRORS_SERVICE,\n    resolveMetrics,\n    resolveErrorReporter,\n    type ObservabilityServicePluginOptions,\n} from './observability/index.js';\n\n// Export Artifact Loader\nexport { loadArtifactBundle, mergeRuntimeModule, isHttpUrl, readArtifactSource } from './load-artifact-bundle.js';\nexport type { LoadArtifactBundleOptions } from './load-artifact-bundle.js';\n\n// ── ObjectOS Cloud Runtime (artifact-fetching shared multi-tenant host) ───────\n// Boot a host process that resolves incoming hostnames to projects and\n// dispatches every request to the matching per-project ObjectKernel. The\n// artifact is fetched either from an HTTP control plane (apps/cloud or\n// the hosted ObjectStack Cloud) or from a local JSON file for single-\n// project dev workflows. See `cloud/objectos-stack.ts`.\nexport { createObjectOSStack } from './cloud/objectos-stack.js';\nexport type { ObjectOSStackConfig, ObjectOSStackResult } from './cloud/objectos-stack.js';\nexport { MarketplaceProxyPlugin } from './cloud/marketplace-proxy-plugin.js';\nexport type { MarketplaceProxyPluginConfig } from './cloud/marketplace-proxy-plugin.js';\nexport { MarketplaceInstallLocalPlugin } from './cloud/marketplace-install-local-plugin.js';\nexport type { MarketplaceInstallLocalPluginConfig } from './cloud/marketplace-install-local-plugin.js';\nexport { DEFAULT_CLOUD_URL, resolveCloudUrl } from './cloud/cloud-url.js';\nexport { ArtifactApiClient } from './cloud/artifact-api-client.js';\nexport type {\n    ArtifactApiClientConfig,\n    EnvironmentArtifactResponse,\n    EnvironmentRuntimeConfig,\n    ResolvedHostname,\n} from './cloud/artifact-api-client.js';\nexport { FileArtifactApiClient } from './cloud/file-artifact-api-client.js';\nexport type { FileArtifactApiClientConfig } from './cloud/file-artifact-api-client.js';\nexport { ArtifactEnvironmentRegistry } from './cloud/artifact-environment-registry.js';\nexport type { ArtifactEnvironmentRegistryConfig } from './cloud/artifact-environment-registry.js';\nexport { ArtifactKernelFactory } from './cloud/artifact-kernel-factory.js';\nexport type { ArtifactKernelFactoryConfig } from './cloud/artifact-kernel-factory.js';\nexport { AuthProxyPlugin } from './cloud/auth-proxy-plugin.js';\nexport { KernelManager } from './cloud/kernel-manager.js';\nexport type { EnvironmentKernelFactory, KernelManagerConfig } from './cloud/kernel-manager.js';\nexport type { EnvironmentDriverRegistry } from './cloud/environment-registry.js';\nexport {\n  PLATFORM_SSO_PROVIDER_ID,\n  derivePlatformSsoClientId,\n  derivePlatformSsoClientSecret,\n  buildPlatformSsoRedirectUri,\n  seedPlatformSsoClient,\n  backfillPlatformSsoClients,\n} from './cloud/platform-sso.js';\nexport type {\n  SeedPlatformSsoClientOptions,\n  BackfillPlatformSsoClientsOptions,\n} from './cloud/platform-sso.js';\n\n// Export Sandbox (script body runner) — engine choice is quickjs-emscripten.\n// See packages/runtime/src/sandbox/script-runner.ts for the decision rationale.\nexport { UnimplementedScriptRunner, QuickJSScriptRunner, SandboxError, hookBodyRunnerFactory, actionBodyRunnerFactory } from './sandbox/index.js';\nexport type {\n  ScriptRunner,\n  ScriptContext,\n  ScriptOrigin,\n  ScriptResult,\n  ScriptRunOptions,\n  QuickJSScriptRunnerOptions,\n} from './sandbox/index.js';\n\n// Re-export from @objectstack/rest\nexport {\n    RestServer,\n    RouteManager,\n    RouteGroupBuilder,\n    createRestApiPlugin,\n} from '@objectstack/rest';\nexport type {\n    RouteEntry,\n    RestApiPluginConfig,\n} from '@objectstack/rest';\n\n// Export Types\nexport * from '@objectstack/core';\n\n\n\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectKernel, Plugin, IHttpServer, ObjectKernelConfig } from '@objectstack/core';\nimport {\n    ClusterServicePlugin,\n    MetadataClusterBridgePlugin,\n    type ClusterServicePluginOptions,\n} from '@objectstack/service-cluster';\nimport type { ClusterCapabilityConfigInput } from '@objectstack/spec/kernel';\n\nexport interface RuntimeConfig {\n    /**\n     * Optional existing server instance (e.g. Hono, Express app)\n     * If provided, Runtime will use it as the 'http.server' service.\n     * If not provided, Runtime expects a server plugin (like HonoServerPlugin) to be registered manually.\n     */\n    server?: IHttpServer;\n\n    /**\n     * Kernel Configuration\n     */\n    kernel?: ObjectKernelConfig;\n\n    /**\n     * Cluster service configuration.\n     *\n     * - Omit (default): a single-node `memory` cluster is auto-registered.\n     * - `false`: skip auto-registration entirely. Register your own\n     *   `ClusterServicePlugin` if you need it later.\n     * - `ClusterCapabilityConfigInput`: forwarded to `defineCluster()`.\n     * - `{ cluster: IClusterService }`: bring your own instance.\n     *\n     * See `content/docs/concepts/cluster-semantics.mdx` for driver options.\n     */\n    cluster?: false | ClusterCapabilityConfigInput | ClusterServicePluginOptions;\n}\n\n/**\n * ObjectStack Runtime\n * \n * High-level entry point for bootstrapping an ObjectStack application.\n * Wraps ObjectKernel and provides standard orchestration for:\n * - HTTP Server binding\n * - Plugin Management\n * \n * REST API is opt-in — register it explicitly:\n * ```ts\n * import { createRestApiPlugin } from '@objectstack/rest';\n * runtime.use(createRestApiPlugin());\n * ```\n */\nexport class Runtime {\n    readonly kernel: ObjectKernel;\n    \n    constructor(config: RuntimeConfig = {}) {\n        this.kernel = new ObjectKernel(config.kernel);\n        \n        // If external server provided, register it immediately\n        if (config.server) {\n             this.kernel.registerService('http.server', config.server);\n        }\n\n        // Auto-register cluster service (memory driver by default) unless\n        // explicitly opted out. Plugins resolve it via\n        // `ctx.getService<IClusterService>('cluster')`.\n        if (config.cluster !== false) {\n            const opts = this.normalizeClusterOptions(config.cluster);\n            this.kernel.use(new ClusterServicePlugin(opts));\n            // Bridge metadata cache invalidation across nodes. Late-binds\n            // via kernel:ready so it picks up a metadata service whether\n            // it's registered by a plugin or directly.\n            this.kernel.use(new MetadataClusterBridgePlugin());\n        }\n    }\n\n    private normalizeClusterOptions(\n        raw: RuntimeConfig['cluster'],\n    ): ClusterServicePluginOptions {\n        if (!raw) return {};\n        // Discriminate by shape: presence of `cluster` (instance) or\n        // explicit `config` key means it's already an options bag.\n        if (\n            typeof raw === 'object' &&\n            ('cluster' in raw || 'config' in raw) &&\n            !('driver' in raw)\n        ) {\n            return raw as ClusterServicePluginOptions;\n        }\n        // Otherwise treat as `ClusterCapabilityConfigInput`.\n        return { config: raw as ClusterCapabilityConfigInput };\n    }\n    \n    /**\n     * Register a plugin\n     */\n    use(plugin: Plugin) {\n        this.kernel.use(plugin);\n        return this;\n    }\n    \n    /**\n     * Start the runtime\n     * 1. Initializes all plugins (init phase)\n     * 2. Starts all plugins (start phase)\n     */\n    async start() {\n        await this.kernel.bootstrap();\n        return this;\n    }\n    \n    /**\n     * Get the kernel instance\n     */\n    getKernel() {\n        return this.kernel;\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Standalone (runtime-only) stack factory.\n *\n * Builds the minimal plugin list for embedding ObjectStack in another\n * framework: ObjectQL + Driver + Metadata, plus AppPlugin if a compiled\n * artifact is available. No authentication, no Studio data, no control\n * plane — REST routes are served unauthenticated.\n *\n * Auto-detects the appropriate driver from the database URL scheme:\n *   - `memory://*`              → InMemoryDriver\n *   - `libsql://`, `https://`   → TursoDriver\n *   - `postgres[ql]://`, `pg://` → SqlDriver (pg)\n *   - `mongodb[+srv]://`        → MongoDBDriver (peer-dep `@objectstack/driver-mongodb`)\n *   - `file:` / no scheme       → SqlDriver (better-sqlite3)\n *\n * Unknown URL schemes throw — we never silently fall back to sqlite, since\n * that historically created bogus directories on disk (e.g. `mongodb:/`)\n * when an unsupported URL was treated as a file path.\n */\n\nimport { resolve as resolvePath } from 'node:path';\nimport { mkdirSync } from 'node:fs';\nimport { z } from 'zod';\nimport { loadArtifactBundle, isHttpUrl } from './load-artifact-bundle.js';\n\nexport const StandaloneStackConfigSchema = z.object({\n    databaseUrl: z.string().optional(),\n    databaseAuthToken: z.string().optional(),\n    databaseDriver: z.enum(['sqlite', 'sqlite-wasm', 'turso', 'memory', 'postgres', 'mongodb']).optional(),\n    environmentId: z.string().optional(),\n    artifactPath: z.string().optional(),\n});\n\nexport type StandaloneStackConfig = z.input<typeof StandaloneStackConfigSchema>;\n\nexport interface StandaloneStackResult {\n    plugins: any[];\n    api: { enableProjectScoping: false; projectResolution: 'none' };\n    /**\n     * Top-level metadata copied from the loaded artifact bundle (when an\n     * artifact was successfully loaded). These are surfaced so callers\n     * that wrap this result as a `defineStack()`-shaped config (e.g. the\n     * CLI's `serve` command without a host `objectstack.config.ts`) can\n     * still drive tier resolution, capability detection and driver\n     * auto-registration off the artifact's declarations.\n     */\n    requires?: string[];\n    objects?: any[];\n    manifest?: any;\n}\n\ntype ResolvedDriverKind = 'memory' | 'turso' | 'postgres' | 'mongodb' | 'sqlite' | 'sqlite-wasm';\n\nfunction detectDriverFromUrl(dbUrl: string): ResolvedDriverKind {\n    if (/^memory:\\/\\//i.test(dbUrl)) return 'memory';\n    if (/^(libsql|https?):\\/\\//i.test(dbUrl)) return 'turso';\n    if (/^(postgres(ql)?|pg):\\/\\//i.test(dbUrl)) return 'postgres';\n    if (/^mongodb(\\+srv)?:\\/\\//i.test(dbUrl)) return 'mongodb';\n    if (/^wasm-sqlite:\\/\\//i.test(dbUrl)) return 'sqlite-wasm';\n    if (/\\.wasm\\.db$/i.test(dbUrl)) return 'sqlite-wasm';\n    if (/^file:/i.test(dbUrl)) return 'sqlite';\n    // Bare path without a scheme — treat as a sqlite file path.\n    if (!/^[a-z][a-z0-9+.-]*:\\/\\//i.test(dbUrl)) return 'sqlite';\n    throw new Error(\n        `[StandaloneStack] Unsupported database URL scheme: ${dbUrl}. ` +\n        `Supported schemes: memory://, libsql://, https://, postgres://, pg://, mongodb://, mongodb+srv://, file:`\n    );\n}\n\nexport async function createStandaloneStack(config?: StandaloneStackConfig): Promise<StandaloneStackResult> {\n    const cfg = StandaloneStackConfigSchema.parse(config ?? {});\n\n    const { ObjectQLPlugin } = await import('@objectstack/objectql');\n    const { MetadataPlugin } = await import('@objectstack/metadata');\n    const { DriverPlugin } = await import('./driver-plugin.js');\n    const { AppPlugin } = await import('./app-plugin.js');\n\n    const cwd = process.cwd();\n    const environmentId = cfg.environmentId ?? process.env.OS_ENVIRONMENT_ID ?? 'proj_local';\n    const artifactPathInput = cfg.artifactPath\n        ?? process.env.OS_ARTIFACT_PATH\n        ?? resolvePath(cwd, 'dist/objectstack.json');\n    const artifactPath = isHttpUrl(artifactPathInput)\n        ? artifactPathInput\n        : (artifactPathInput.startsWith('/')\n            ? artifactPathInput\n            : resolvePath(cwd, artifactPathInput));\n\n    const dbUrl = cfg.databaseUrl\n        ?? process.env.OS_DATABASE_URL?.trim()\n        ?? process.env.TURSO_DATABASE_URL?.trim()\n        ?? `file:${resolvePath(cwd, '.objectstack/data/standalone.db')}`;\n    const dbAuthToken = cfg.databaseAuthToken\n        ?? process.env.OS_DATABASE_AUTH_TOKEN?.trim()\n        ?? process.env.TURSO_AUTH_TOKEN?.trim();\n    const explicitDriver = cfg.databaseDriver\n        ?? (process.env.OS_DATABASE_DRIVER?.trim() as ResolvedDriverKind | undefined);\n    const dbDriver: ResolvedDriverKind = explicitDriver ?? detectDriverFromUrl(dbUrl);\n\n    let driverPlugin: any;\n    if (dbDriver === 'memory') {\n        const { InMemoryDriver } = await import('@objectstack/driver-memory');\n        driverPlugin = new DriverPlugin(new InMemoryDriver());\n    } else if (dbDriver === 'turso') {\n        const { TursoDriver } = await import('@objectstack/driver-turso');\n        driverPlugin = new DriverPlugin(\n            new TursoDriver({ url: dbUrl, authToken: dbAuthToken }) as any,\n        );\n    } else if (dbDriver === 'postgres') {\n        const { SqlDriver } = await import('@objectstack/driver-sql');\n        driverPlugin = new DriverPlugin(\n            new SqlDriver({\n                client: 'pg',\n                connection: dbUrl,\n                pool: { min: 0, max: 5 },\n            }) as any,\n        );\n    } else if (dbDriver === 'mongodb') {\n        // MongoDB driver is an optional peer dependency. Importing it lazily\n        // avoids forcing every standalone consumer to install the mongo SDK.\n        let MongoDBDriver: any;\n        try {\n            ({ MongoDBDriver } = await import('@objectstack/driver-mongodb' as any));\n        } catch (err: any) {\n            throw new Error(\n                `[StandaloneStack] mongodb URL detected but @objectstack/driver-mongodb is not installed. ` +\n                `Add it as a dependency or pass an explicit driverPlugin. (${err?.message ?? err})`\n            );\n        }\n        driverPlugin = new DriverPlugin(new MongoDBDriver({ url: dbUrl }) as any);\n    } else if (dbDriver === 'sqlite-wasm') {\n        const { SqliteWasmDriver } = await import('@objectstack/driver-sqlite-wasm' as any);\n        const filename = dbUrl\n            .replace(/^wasm-sqlite:(\\/\\/)?/i, '')\n            .replace(/^file:(\\/\\/)?/i, '');\n        if (filename && filename !== ':memory:') {\n            mkdirSync(resolvePath(filename, '..'), { recursive: true });\n        }\n        driverPlugin = new DriverPlugin(\n            new SqliteWasmDriver({\n                filename: filename || ':memory:',\n                persist: filename && filename !== ':memory:' ? 'on-write' : undefined,\n            }) as any,\n        );\n    } else {\n        // sqlite\n        const { SqlDriver } = await import('@objectstack/driver-sql');\n        const filename = dbUrl.replace(/^file:(\\/\\/)?/, '');\n        if (!filename || /^[a-z][a-z0-9+.-]*:\\/\\//i.test(filename)) {\n            throw new Error(\n                `[StandaloneStack] sqlite driver was selected but the URL does not look like a file path: \"${dbUrl}\". ` +\n                `Use file:/path/to/db.sqlite, or set OS_DATABASE_DRIVER explicitly.`\n            );\n        }\n        mkdirSync(resolvePath(filename, '..'), { recursive: true });\n        driverPlugin = new DriverPlugin(\n            new SqlDriver({\n                client: 'better-sqlite3',\n                connection: { filename },\n                useNullAsDefault: true,\n            }),\n        );\n    }\n\n    const artifactBundle = await loadArtifactBundle(artifactPath, {\n        tag: '[StandaloneStack]',\n        unwrapEnvelope: true,\n    });\n    if (artifactBundle) {\n        const flowsCount = Array.isArray(artifactBundle?.flows) ? artifactBundle.flows.length : 'n/a';\n        // eslint-disable-next-line no-console\n        console.warn(\n            `[StandaloneStack] artifact loaded: path=${artifactPath} keys=${Object.keys(artifactBundle).join(',')} flows=${flowsCount}`,\n        );\n    }\n\n    const plugins: any[] = [\n        driverPlugin,\n        new MetadataPlugin({\n            // Source-file scanner OFF — declarative metadata is loaded\n            // from the compiled artifact, not from yaml/json files on\n            // disk. Scanning would also recursively watch the project\n            // root (incl. node_modules), which is expensive and prone\n            // to EMFILE.\n            watch: false,\n            // Artifact-file HMR ON in non-production so edits to\n            // `*.view.ts` / `*.flow.ts` (which the CLI dev-mode watcher\n            // recompiles into `dist/objectstack.json`) are picked up by\n            // the running server WITHOUT requiring a manual restart.\n            // Uses polling under the hood (see plugin.ts) to avoid\n            // `fs.watch` EMFILE on macOS / busy dev hosts.\n            artifactWatch: process.env.NODE_ENV !== 'production',\n            environmentId,\n            artifactSource: { mode: 'local-file', path: artifactPath },\n        }),\n        new ObjectQLPlugin({ environmentId }),\n    ];\n    if (artifactBundle) plugins.push(new AppPlugin(artifactBundle));\n\n    // Surface artifact-declared metadata so a caller using this result\n    // directly as a `defineStack()`-shaped config (no host\n    // `objectstack.config.ts`) can still drive CLI tier resolution\n    // and driver auto-registration. We copy *references* — no clone — so\n    // the caller can `{ ...originalConfig, ...standaloneStack }` without\n    // double-merging large object arrays.\n    const requires: string[] | undefined =\n        Array.isArray(artifactBundle?.requires)\n            ? (artifactBundle.requires.filter((c: unknown) => typeof c === 'string') as string[])\n            : undefined;\n    const objects: any[] | undefined =\n        Array.isArray(artifactBundle?.objects) ? artifactBundle.objects : undefined;\n    const manifest: any | undefined = artifactBundle?.manifest;\n\n    return {\n        plugins,\n        api: {\n            enableProjectScoping: false,\n            projectResolution: 'none',\n        },\n        ...(requires ? { requires } : {}),\n        ...(objects ? { objects } : {}),\n        ...(manifest ? { manifest } : {}),\n    };\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Default host config — built-in fallback used by `objectstack start`\n * (and `objectstack serve`) when the project does NOT ship an explicit\n * `objectstack.config.ts`.\n *\n * Goal: an `objectstack build` artifact (`dist/objectstack.json`) is\n * fully self-describing — it carries the manifest, objects, views,\n * flows and a `requires: [...]` capability list. That should be enough\n * to boot a runtime, with zero hand-written host code.\n *\n * Boot mode: **standalone only**. This module intentionally does NOT\n * depend on `@objectstack/service-cloud`. Cloud / multi-environment hosts\n * still write their own `objectstack.config.ts` (see\n * `apps/objectos/objectstack.config.ts`).\n *\n * Resolution order for the artifact path:\n *   1. `options.artifactPath` (explicit caller override)\n *   2. `OS_ARTIFACT_PATH` env var (file path **or** `http(s)://` URL)\n *   3. `<cwd>/dist/objectstack.json`\n *\n * The returned object is shaped like the result of `defineStack()` —\n * `{ plugins, api, requires, objects, manifest }` — so the CLI can use\n * it interchangeably with a user-authored stack config.\n */\n\nimport { resolve as resolvePath } from 'node:path';\nimport { existsSync } from 'node:fs';\nimport { createStandaloneStack, type StandaloneStackConfig, type StandaloneStackResult } from './standalone-stack.js';\nimport { isHttpUrl } from './load-artifact-bundle.js';\n\nexport interface DefaultHostConfigOptions extends StandaloneStackConfig {\n    /**\n     * When true (the default), throws if no artifact source can be\n     * resolved (no explicit `artifactPath`, no `OS_ARTIFACT_PATH` env,\n     * and `<cwd>/dist/objectstack.json` does not exist).\n     *\n     * Set to false to allow booting an empty kernel — useful for tests\n     * that want to assemble plugins manually after the stack is built.\n     */\n    requireArtifact?: boolean;\n}\n\nexport type DefaultHostConfigResult = StandaloneStackResult;\n\n/**\n * Resolve the artifact source for a default-host boot.\n *\n * Returns the explicit override, then `OS_ARTIFACT_PATH`, then the\n * canonical `<cwd>/dist/objectstack.json` if it exists on disk.\n * Returns `undefined` if none of these are available.\n *\n * URLs (`http(s)://`) are returned as-is — they are validated lazily by\n * the loader, since we cannot stat a remote resource cheaply.\n */\nexport function resolveDefaultArtifactPath(\n    explicitPath?: string,\n    cwd: string = process.cwd(),\n): string | undefined {\n    const candidate = explicitPath\n        ?? process.env.OS_ARTIFACT_PATH\n        ?? resolvePath(cwd, 'dist/objectstack.json');\n\n    if (isHttpUrl(candidate)) return candidate;\n    if (explicitPath || process.env.OS_ARTIFACT_PATH) return candidate;\n    return existsSync(candidate) ? candidate : undefined;\n}\n\n/**\n * Build a `defineStack()`-shaped config from an `objectstack build`\n * artifact, with no `objectstack.config.ts` required.\n *\n * @example\n *   // packages/cli/src/commands/serve.ts\n *   if (!fs.existsSync(absolutePath)) {\n *       config = await createDefaultHostConfig();\n *   }\n */\nexport async function createDefaultHostConfig(\n    options: DefaultHostConfigOptions = {},\n): Promise<DefaultHostConfigResult> {\n    const { requireArtifact = true, ...standaloneOpts } = options;\n\n    const resolvedArtifact = resolveDefaultArtifactPath(standaloneOpts.artifactPath);\n    if (!resolvedArtifact && requireArtifact) {\n        throw new Error(\n            '[createDefaultHostConfig] No artifact source available. ' +\n            'Set OS_ARTIFACT_PATH (file path or http(s):// URL), ' +\n            'place the artifact at <cwd>/dist/objectstack.json, ' +\n            'or pass `{ artifactPath: ... }` explicitly. ' +\n            'To boot an empty kernel anyway, pass `{ requireArtifact: false }`.',\n        );\n    }\n\n    return createStandaloneStack({\n        ...standaloneOpts,\n        artifactPath: resolvedArtifact,\n    });\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectKernel, getEnv, resolveLocale } from '@objectstack/core';\nimport { CoreServiceName } from '@objectstack/spec/system';\nimport { pluralToSingular } from '@objectstack/spec/shared';\nimport type { ExecutionContext } from '@objectstack/spec/kernel';\nimport type { KernelManager } from './cloud/kernel-manager.js';\n\n/** Minimal local interface — full EnvironmentScopeManager was removed in Phase R. */\ninterface EnvironmentScopeManager {\n    touch(environmentId: string): void;\n}\nimport {\n    resolveExecutionContext,\n    isPermissionDeniedError,\n} from './security/resolve-execution-context.js';\n\n/** Browser-safe UUID generator — prefers Web Crypto, falls back to RFC 4122 v4 */\nfunction randomUUID(): string {\n    if (globalThis.crypto && typeof globalThis.crypto.randomUUID === 'function') {\n        return globalThis.crypto.randomUUID();\n    }\n    return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, c => {\n        const r = (Math.random() * 16) | 0;\n        const v = c === 'x' ? r : (r & 0x3) | 0x8;\n        return v.toString(16);\n    });\n}\n\nexport interface HttpProtocolContext {\n    request: any;\n    response?: any;\n    environmentId?: string;   // Resolved environment ID\n    dataDriver?: any; // IDataDriver - Resolved environment-scoped driver\n    /**\n     * Identity envelope resolved by `resolveExecutionContext` and threaded\n     * into every ObjectQL call so the SecurityPlugin middleware can apply\n     * RBAC/RLS/FLS. Optional — anonymous requests carry an empty context.\n     */\n    executionContext?: ExecutionContext;\n}\n\nexport interface HttpDispatcherResult {\n    handled: boolean;\n    response?: {\n        status: number;\n        body?: any;\n        headers?: Record<string, string>;\n    };\n    result?: any; // For flexible return types or direct response objects (Response/NextResponse)\n}\n\n/**\n * Optional configuration passed to the dispatcher constructor. Supports the\n * legacy `enforceProjectMembership` toggle plus the new multi-kernel\n * scheduling hook required by ADR-0003's cloud runtime mode.\n */\nexport interface HttpDispatcherOptions {\n    enforceProjectMembership?: boolean;\n    /**\n     * Optional {@link KernelManager}. When present, the dispatcher resolves\n     * `context.environmentId` first and then routes the request against the\n     * project's dedicated kernel via `kernelManager.getOrCreate(environmentId)`.\n     * Requests that fail to resolve a environmentId fall through to the\n     * constructor-supplied kernel (self-hosted / legacy behavior).\n     */\n    kernelManager?: KernelManager;\n    /**\n     * Optional {@link EnvironmentScopeManager}. When present, `touch(environmentId)` is\n     * called on every scoped request so idle projects are evicted after TTL.\n     */\n    scopeManager?: EnvironmentScopeManager;\n}\n\n/**\n * @deprecated Use `createDispatcherPlugin()` from `@objectstack/runtime` instead.\n * This class will be removed in v2. Prefer the plugin-based approach:\n * ```ts\n * import { createDispatcherPlugin } from '@objectstack/runtime';\n * kernel.use(createDispatcherPlugin({ prefix: '/api/v1' }));\n * ```\n */\nexport class HttpDispatcher {\n    private kernel: any; // Casting to any to access dynamic props like services, graphql\n    private defaultKernel: ObjectKernel;\n    private envRegistry?: any; // EnvironmentDriverRegistry\n    private defaultProject?: { environmentId: string; orgId?: string };\n    private kernelManager?: KernelManager;\n    private scopeManager?: EnvironmentScopeManager;\n    /**\n     * When `true`, scoped data-plane routes enforce a\n     * `sys_environment_member` lookup and return 403 for non-members.\n     * Defaults to `true` when a environmentId is resolvable — legacy callers\n     * can opt out via the third constructor argument (see\n     * `DispatcherConfig.enforceProjectMembership`).\n     */\n    private enforceMembership: boolean;\n    /**\n     * In-memory cache of positive membership checks, keyed by\n     * `${environmentId}:${userId}`. Entries expire 60 seconds after insertion\n     * — a short TTL is acceptable because a user whose access was just\n     * revoked sees stale access for at most one minute.\n     */\n    private membershipCache: Map<string, number> = new Map();\n    private static readonly MEMBERSHIP_CACHE_TTL_MS = 60_000;\n    /** Well-known system project id — bypassed for any authenticated user. */\n    private static readonly SYSTEM_ENVIRONMENT_ID = '00000000-0000-0000-0000-000000000001';\n    /** Well-known platform org id — members bypass project membership. */\n    private static readonly PLATFORM_ORG_ID = '00000000-0000-0000-0000-000000000000';\n\n    constructor(kernel: ObjectKernel, envRegistry?: any, options?: HttpDispatcherOptions) {\n        this.kernel = kernel;\n        this.defaultKernel = kernel;\n        const resolveService = (name: string): any => {\n            try { return (kernel as any).getService?.(name); } catch { return undefined; }\n        };\n        this.envRegistry = envRegistry ?? resolveService('env-registry');\n        this.enforceMembership = options?.enforceProjectMembership ?? true;\n        this.kernelManager = options?.kernelManager ?? resolveService('kernel-manager');\n        this.scopeManager = options?.scopeManager ?? resolveService('scope-manager');\n        // Single-project default is resolved lazily on first request — the\n        // plugin that registers it (`createSingleEnvironmentPlugin`) may run\n        // its `init()` after the HttpDispatcher is constructed.\n    }\n\n    private resolveDefaultProject(): { environmentId: string; orgId?: string } | undefined {\n        if (this.defaultProject) return this.defaultProject;\n        try {\n            const v = (this.kernel as any).getService?.('default-project');\n            if (v?.environmentId) {\n                this.defaultProject = v;\n                return v;\n            }\n        } catch {\n            // service not registered — single-environment plugin not in stack\n        }\n        return undefined;\n    }\n\n    private success(data: any, meta?: any) {\n        return {\n            status: 200,\n            body: { success: true, data, meta }\n        };\n    }\n\n    private error(message: string, code: number = 500, details?: any) {\n        return {\n            status: code,\n            body: { success: false, error: { message, code, details } }\n        };\n    }\n\n    /**\n     * 404 Route Not Found — no route is registered for this path.\n     */\n    private routeNotFound(route: string) {\n        return {\n            status: 404,\n            body: {\n                success: false,\n                error: {\n                    code: 404,\n                    message: `Route Not Found: ${route}`,\n                    type: 'ROUTE_NOT_FOUND' as const,\n                    route,\n                    hint: 'No route is registered for this path. Check the API discovery endpoint for available routes.',\n                },\n            },\n        };\n    }\n\n    /**\n     * Direct data service dispatch — replaces broker.call('data.*').\n     * Tries protocol service first (supports expand/populate), falls back to ObjectQL.\n     *\n     * @param dataDriver - Optional environment-scoped driver to use instead of kernel default\n     * @param scopeId - Optional project ID for scoped service resolution (SharedProjectPlugin mode)\n     */\n    private async callData(\n        action: string,\n        params: any,\n        dataDriver?: any,\n        scopeId?: string,\n        executionContext?: ExecutionContext,\n    ): Promise<any> {\n        const protocol = await this.resolveService('protocol', scopeId);\n        const qlService = dataDriver ?? await this.getObjectQLService(scopeId);\n        const ql = qlService ?? await this.resolveService('objectql', scopeId);\n        const qlOpts = executionContext ? { context: executionContext } : undefined;\n        const findOpts = (extra?: any) => {\n            const base = qlOpts ? { ...qlOpts } : {};\n            return extra ? { ...base, ...extra } : (qlOpts ? base : undefined);\n        };\n\n        if (action === 'create') {\n            if (ql) {\n                const res = await ql.insert(params.object, params.data, qlOpts);\n                const record = { ...params.data, ...res };\n                return { object: params.object, id: record.id, record };\n            }\n            throw { statusCode: 503, message: 'Data service not available' };\n        }\n\n        if (action === 'get') {\n            if (protocol && typeof protocol.getData === 'function') {\n                return await protocol.getData({ object: params.object, id: params.id, expand: params.expand, select: params.select, context: executionContext });\n            }\n            if (ql) {\n                let all = await ql.find(params.object, findOpts({ where: { id: params.id }, limit: 1 }));\n                if (all && (all as any).value) all = (all as any).value;\n                if (!all) all = [];\n                const match = (all as any[]).find((i: any) => i.id === params.id);\n                return match ? { object: params.object, id: params.id, record: match } : null;\n            }\n            throw { statusCode: 503, message: 'Data service not available' };\n        }\n\n        if (action === 'update') {\n            if (ql && params.id) {\n                let all = await ql.find(params.object, findOpts({ where: { id: params.id }, limit: 1 }));\n                if (all && (all as any).value) all = (all as any).value;\n                if (!all) all = [];\n                const existing = (all as any[]).find((i: any) => i.id === params.id);\n                if (!existing) throw new Error('[ObjectStack] Not Found');\n                await ql.update(params.object, params.data, findOpts({ where: { id: params.id } }));\n                return { object: params.object, id: params.id, record: { ...existing, ...params.data } };\n            }\n            throw { statusCode: 503, message: 'Data service not available' };\n        }\n\n        if (action === 'delete') {\n            if (ql) {\n                await ql.delete(params.object, findOpts({ where: { id: params.id } }));\n                return { object: params.object, id: params.id, deleted: true };\n            }\n            throw { statusCode: 503, message: 'Data service not available' };\n        }\n\n        if (action === 'query' || action === 'find') {\n            if (protocol && typeof protocol.findData === 'function') {\n                // Build query: use explicit params.query if provided, otherwise extract query fields from params\n                const query = params.query || (() => {\n                    const { object, ...rest } = params;\n                    return rest;\n                })();\n                return await protocol.findData({ object: params.object, query, context: executionContext });\n            }\n            if (ql) {\n                let all = await ql.find(params.object, qlOpts);\n                if (!Array.isArray(all) && all && (all as any).value) all = (all as any).value;\n                if (!all) all = [];\n                return { object: params.object, records: all, total: all.length };\n            }\n            throw { statusCode: 503, message: 'Data service not available' };\n        }\n\n        if (action === 'batch') {\n            // Batch operations — not yet supported via direct service dispatch\n            return { object: params.object, results: [] };\n        }\n\n        throw { statusCode: 400, message: `Unknown data action: ${action}` };\n    }\n\n    /**\n     * Parse a project UUID out of a scoped URL path such as\n     * `/api/v1/environments/abc-123/data/task` or `/projects/abc-123/meta`.\n     * Returns `undefined` when the path does not match the scoped pattern.\n     */\n    /**\n     * Parse an environment UUID out of a scoped URL path such as\n     * `/api/v1/environments/abc-123/data/task` or `/environments/abc-123/meta`.\n     * Returns `undefined` when the path does not match the scoped pattern.\n     */\n    private extractEnvironmentIdFromPath(path: string): string | undefined {\n        if (!path) return undefined;\n        const m = path.match(/\\/environments\\/([^/?#]+)/);\n        if (!m) return undefined;\n        const candidate = m[1];\n        // Guard against matching control-plane routes like /cloud/environments.\n        // `/environments/<id>` directly nested under the API prefix wins;\n        // `/cloud/environments/<id>` is a CRUD endpoint on the control plane.\n        if (path.includes('/cloud/environments/')) return undefined;\n        return candidate;\n    }\n\n    /**\n     * Resolve environment context for incoming request.\n     *\n     * Precedence:\n     * 0. URL path matches `/environments/:environmentId/...` OR request.params.environmentId set by router\n     *    → envRegistry.resolveById(id)\n     * 1. request.headers.host → envRegistry.resolveByHostname(host)\n     * 2. request.headers['x-environment-id'] → envRegistry.resolveById(id)\n     * 3. session.activeEnvironmentId → envRegistry.resolveById(id)\n     * 4. session.activeOrganizationId → find default project → envRegistry.resolveById(id)\n     * 5. single-environment default (registered by `createSingleEnvironmentPlugin`)\n     *    → envRegistry.resolveById(defaultProject.environmentId). Lets bare\n     *    `/api/v1/data/...` URLs resolve to the lone project in\n     *    `cloudUrl: 'local'` deployments.\n     *\n     * Skip for paths: /auth, /cloud, /health, /discovery (NOT /meta when scoped,\n     * so project-scoped meta routes can resolve their project).\n     */\n    private async resolveEnvironmentContext(context: HttpProtocolContext, path: string): Promise<void> {\n        // Skip environment resolution for control-plane routes only.\n        // NOTE: /meta is intentionally not in this list — a scoped\n        // /projects/:id/meta path still needs the project resolved so the\n        // protocol can scope its answer.\n        // NOTE: /auth was removed — per-project AuthPlugin needs the\n        // hostname-resolved environmentId so the dispatcher kernel-swap routes\n        // to the project's auth manager (not the host's).\n        const skipPaths = ['/cloud', '/health', '/discovery'];\n        if (skipPaths.some(p => path.startsWith(p))) {\n            return;\n        }\n\n        // If no environment registry, skip\n        if (!this.envRegistry) {\n            return;\n        }\n\n        // Headers may arrive as a Fetch API `Headers` instance (Hono's\n        // `c.req.raw`) — where `.host` / `['x-environment-id']` both return\n        // undefined — or as a plain object (Vercel's incoming message\n        // shape). Normalise to a single `.get(name)` accessor so both\n        // layouts resolve correctly.\n        const headers = context.request?.headers;\n        const getHeader = (name: string): string | undefined => {\n            if (!headers) return undefined;\n            const h: any = headers;\n            if (typeof h.get === 'function') {\n                const v = h.get(name);\n                return v == null ? undefined : String(v);\n            }\n            const lower = name.toLowerCase();\n            for (const k of Object.keys(h)) {\n                if (k.toLowerCase() === lower) {\n                    const v = h[k];\n                    return Array.isArray(v) ? v[0] : (v == null ? undefined : String(v));\n                }\n            }\n            return undefined;\n        };\n\n        try {\n            // 0. Try URL-param / path-embedded environmentId (highest precedence).\n            const urlEnvironmentId = this.extractEnvironmentIdFromPath(path)\n                ?? context.request?.params?.environmentId;\n            if (urlEnvironmentId) {\n                const driver = await this.envRegistry.resolveById(urlEnvironmentId);\n                if (driver) {\n                    context.environmentId = urlEnvironmentId;\n                    context.dataDriver = driver;\n                    return;\n                }\n            }\n\n            // 1. Try hostname resolution\n            const host = getHeader('host');\n            if (host) {\n                // Strip port if present (e.g., \"localhost:3000\" → \"localhost\")\n                const hostname = host.split(':')[0];\n                const result = await this.envRegistry.resolveByHostname(hostname);\n                if (result) {\n                    context.environmentId = result.environmentId;\n                    context.dataDriver = result.driver;\n                    return;\n                }\n            }\n\n            // 2. Try X-Environment-Id header\n            const envIdHeader = getHeader('x-environment-id');\n            if (envIdHeader) {\n                const driver = await this.envRegistry.resolveById(envIdHeader);\n                if (driver) {\n                    context.environmentId = envIdHeader;\n                    context.dataDriver = driver;\n                    return;\n                }\n            }\n\n            // 3. Try session.activeEnvironmentId\n            try {\n                const authService: any = await this.getService(CoreServiceName.enum.auth);\n                const sessionData = await authService?.api?.getSession?.({\n                    headers: context.request?.headers,\n                });\n\n                const activeEnvironmentId = sessionData?.session?.activeEnvironmentId ?? sessionData?.session?.activeEnvironmentId;\n                if (activeEnvironmentId) {\n                    const driver = await this.envRegistry.resolveById(activeEnvironmentId);\n                    if (driver) {\n                        context.environmentId = activeEnvironmentId;\n                        context.dataDriver = driver;\n                        return;\n                    }\n                }\n\n                // 4. Try default environment for organization\n                const activeOrganizationId = sessionData?.session?.activeOrganizationId;\n                if (activeOrganizationId) {\n                    // Query control plane for default environment\n                    const qlService = await this.getObjectQLService();\n                    const ql = qlService ?? await this.resolveService('objectql');\n                    if (ql) {\n                        let rows = await ql.find('sys_environment', {\n                            where: {\n                                organization_id: activeOrganizationId,\n                                is_default: true\n                            },\n                            limit: 1\n                        } as any);\n                        if (rows && (rows as any).value) rows = (rows as any).value;\n                        if (Array.isArray(rows) && rows[0]) {\n                            const defaultEnv = rows[0];\n                            const driver = await this.envRegistry.resolveById(defaultEnv.id);\n                            if (driver) {\n                                context.environmentId = defaultEnv.id;\n                                context.dataDriver = driver;\n                                return;\n                            }\n                        }\n                    }\n                }\n            } catch (sessionError) {\n                // Session resolution failed, continue without environment context\n                console.debug('[HttpDispatcher] Session resolution failed:', sessionError);\n            }\n\n            // 5. Single-project default fallback. Registered by\n            //    `createSingleEnvironmentPlugin()` in `cloudUrl: 'local'` boot\n            //    shapes (apps/objectos default). Lets bare URLs like\n            //    `/api/v1/data/account` resolve to the lone project.\n            if (this.defaultProject?.environmentId || this.resolveDefaultProject()) {\n                const def = this.defaultProject!;\n                const driver = await this.envRegistry.resolveById(def.environmentId);\n                if (driver) {\n                    context.environmentId = def.environmentId;\n                    context.dataDriver = driver;\n                    return;\n                }\n            }\n        } catch (error) {\n            console.error('[HttpDispatcher] Environment resolution failed:', error);\n        }\n    }\n\n    /**\n     * Check whether the authenticated user is a member of\n     * `context.environmentId`. Runs after {@link resolveEnvironmentContext}\n     * and is a no-op when:\n     *\n     *   - Membership enforcement is disabled via the constructor.\n     *   - The route is control-plane (`/auth/*`, `/cloud/*`, `/health`,\n     *     `/discovery`) — already skipped upstream.\n     *   - No `environmentId` was resolved (e.g. unscoped legacy routes).\n     *   - The project is the well-known system project (bypassed so any\n     *     authenticated user can read platform metadata).\n     *   - The user's active organization is the platform org (staff).\n     *\n     * Positive results are cached for 60 seconds to avoid hitting the\n     * control-plane on every request. A failed check returns a 403\n     * response object that callers should surface directly — no further\n     * dispatch happens.\n     */\n    private async enforceProjectMembership(\n        context: HttpProtocolContext,\n        path: string,\n    ): Promise<{ status: number; body: any } | null> {\n        if (!this.enforceMembership) return null;\n\n        // Control-plane paths — never gated by project membership.\n        const skipPaths = ['/auth', '/cloud', '/health', '/discovery'];\n        if (skipPaths.some(p => path.startsWith(p))) return null;\n\n        const environmentId = context.environmentId;\n        if (!environmentId) return null; // Unscoped legacy routes fall through.\n\n        // System project is always reachable by any authenticated user.\n        if (environmentId === HttpDispatcher.SYSTEM_ENVIRONMENT_ID) return null;\n\n        // Read the session. If auth is not wired up, fail open — tests\n        // and single-tenant setups run without auth.\n        let userId: string | undefined;\n        let activeOrganizationId: string | undefined;\n        try {\n            const authService: any = await this.resolveService(CoreServiceName.enum.auth);\n            const sessionData = await authService?.api?.getSession?.({\n                headers: context.request?.headers,\n            });\n            userId = sessionData?.user?.id ?? sessionData?.session?.userId;\n            activeOrganizationId = sessionData?.session?.activeOrganizationId;\n        } catch {\n            // Auth resolution failed — do not block the request on RBAC.\n            return null;\n        }\n\n        if (!userId) return null; // Anonymous requests — upstream auth will decide.\n\n        // Platform-org members bypass project membership.\n        if (activeOrganizationId === HttpDispatcher.PLATFORM_ORG_ID) return null;\n\n        // Check cache.\n        const cacheKey = `${environmentId}:${userId}`;\n        const cached = this.membershipCache.get(cacheKey);\n        const now = Date.now();\n        if (cached && now - cached < HttpDispatcher.MEMBERSHIP_CACHE_TTL_MS) {\n            return null; // Recently verified as a member.\n        }\n        if (cached) {\n            this.membershipCache.delete(cacheKey); // expired\n        }\n\n        // Query sys_environment_member (control plane).\n        try {\n            const qlService = await this.getObjectQLService();\n            const ql = qlService ?? await this.resolveService('objectql');\n            if (!ql) return null; // No QL — cannot enforce; fail open.\n\n            let rows = await ql.find('sys_environment_member', {\n                where: { environment_id: environmentId, user_id: userId },\n                limit: 1,\n            } as any);\n            if (rows && (rows as any).value) rows = (rows as any).value;\n            const isMember = Array.isArray(rows) && rows.length > 0;\n\n            if (isMember) {\n                this.membershipCache.set(cacheKey, now);\n                return null;\n            }\n\n            return this.error(\n                `Forbidden: user ${userId} is not a member of project ${environmentId}`,\n                403,\n                { environmentId, userId, type: 'PROJECT_MEMBERSHIP_REQUIRED' },\n            );\n        } catch (err) {\n            // Control-plane lookup failure — log and fail open rather than\n            // break the request. Tightening this is deferred to Phase 4.\n            console.debug('[HttpDispatcher] Membership check failed:', err);\n            return null;\n        }\n    }\n\n    /**\n     * Generates the discovery JSON response for the API root.\n     *\n     * Uses the same async `resolveService()` fallback chain that request\n     * handlers use, so the reported service status is always consistent\n     * with the actual runtime availability.\n     */\n    async getDiscoveryInfo(prefix: string) {\n        // Resolve all services through the same async fallback chain\n        // that request handlers (handleI18n, handleAuth, …) use.\n        const [\n            authSvc, graphqlSvc, searchSvc, realtimeSvc, filesSvc,\n            analyticsSvc, workflowSvc, aiSvc, notificationSvc, i18nSvc,\n            uiSvc, automationSvc, cacheSvc, queueSvc, jobSvc,\n        ] = await Promise.all([\n            this.resolveService(CoreServiceName.enum.auth),\n            this.resolveService(CoreServiceName.enum.graphql),\n            this.resolveService(CoreServiceName.enum.search),\n            this.resolveService(CoreServiceName.enum.realtime),\n            this.resolveService(CoreServiceName.enum['file-storage']),\n            this.resolveService(CoreServiceName.enum.analytics),\n            this.resolveService(CoreServiceName.enum.workflow),\n            this.resolveService(CoreServiceName.enum.ai),\n            this.resolveService(CoreServiceName.enum.notification),\n            this.resolveService(CoreServiceName.enum.i18n),\n            this.resolveService(CoreServiceName.enum.ui),\n            this.resolveService(CoreServiceName.enum.automation),\n            this.resolveService(CoreServiceName.enum.cache),\n            this.resolveService(CoreServiceName.enum.queue),\n            this.resolveService(CoreServiceName.enum.job),\n        ]);\n\n        const hasAuth         = !!authSvc;\n        const hasGraphQL      = !!(graphqlSvc || this.kernel.graphql);\n        const hasSearch       = !!searchSvc;\n        const hasWebSockets   = !!realtimeSvc;\n        const hasFiles        = !!filesSvc;\n        const hasAnalytics    = !!analyticsSvc;\n        const hasWorkflow     = !!workflowSvc;\n        const hasAi           = !!aiSvc;\n        const hasNotification = !!notificationSvc;\n        const hasI18n         = !!i18nSvc;\n        const hasUi           = !!uiSvc;\n        const hasAutomation   = !!automationSvc;\n        const hasCache        = !!cacheSvc;\n        const hasQueue        = !!queueSvc;\n        const hasJob          = !!jobSvc;\n\n        // Routes are only exposed when a plugin provides the service\n        const routes = {\n                data:          `${prefix}/data`,\n                metadata:      `${prefix}/meta`,\n                packages:      `${prefix}/packages`,\n                auth:          hasAuth ? `${prefix}/auth` : undefined,\n                ui:            hasUi ? `${prefix}/ui` : undefined,\n                graphql:       hasGraphQL ? `${prefix}/graphql` : undefined,\n                storage:       hasFiles ? `${prefix}/storage` : undefined,\n                analytics:     hasAnalytics ? `${prefix}/analytics` : undefined,\n                automation:    hasAutomation ? `${prefix}/automation` : undefined,\n                workflow:      hasWorkflow ? `${prefix}/workflow` : undefined,\n                realtime:      hasWebSockets ? `${prefix}/realtime` : undefined,\n                notifications: hasNotification ? `${prefix}/notifications` : undefined,\n                ai:            hasAi ? `${prefix}/ai` : undefined,\n                i18n:          hasI18n ? `${prefix}/i18n` : undefined,\n        };\n\n        // Build per-service status map\n        // handlerReady: true means the dispatcher has a real, bound handler for this route.\n        // handlerReady: false means the route is present in the discovery table but may not\n        // yet have a concrete implementation or may be served by a stub.\n        const svcAvailable = (route?: string, provider?: string) => ({\n            enabled: true, status: 'available' as const, handlerReady: true, route, provider,\n        });\n        const svcUnavailable = (name: string) => ({\n            enabled: false, status: 'unavailable' as const, handlerReady: false,\n            message: `Install a ${name} plugin to enable`,\n        });\n\n        // Derive locale info from actual i18n service when available\n        let locale = { default: 'en', supported: ['en'], timezone: 'UTC' };\n        if (hasI18n && i18nSvc) {\n            const defaultLocale = typeof i18nSvc.getDefaultLocale === 'function'\n                ? i18nSvc.getDefaultLocale() : 'en';\n            const locales = typeof i18nSvc.getLocales === 'function'\n                ? i18nSvc.getLocales() : [];\n            locale = {\n                default: defaultLocale,\n                supported: locales.length > 0 ? locales : [defaultLocale],\n                timezone: 'UTC',\n            };\n        }\n\n        return {\n            name: 'ObjectOS',\n            version: '1.0.0',\n            environment: getEnv('NODE_ENV', 'development'),\n            routes,\n            endpoints: routes, // Alias for backward compatibility with some clients\n            features: {\n                graphql: hasGraphQL,\n                search: hasSearch,\n                websockets: hasWebSockets,\n                files: hasFiles,\n                analytics: hasAnalytics,\n                ai: hasAi,\n                workflow: hasWorkflow,\n                notifications: hasNotification,\n                i18n: hasI18n,\n            },\n            services: {\n                // Kernel-provided (always available via protocol implementation)\n                metadata:       { enabled: true, status: 'degraded' as const, handlerReady: true, route: routes.metadata, provider: 'kernel', message: 'In-memory registry; DB persistence pending' },\n                data:           svcAvailable(routes.data, 'kernel'),\n                // Plugin-provided — only available when a plugin registers the service\n                auth:           hasAuth ? svcAvailable(routes.auth) : svcUnavailable('auth'),\n                automation:     hasAutomation ? svcAvailable(routes.automation) : svcUnavailable('automation'),\n                analytics:      hasAnalytics ? svcAvailable(routes.analytics) : svcUnavailable('analytics'),\n                cache:          hasCache ? svcAvailable() : svcUnavailable('cache'),\n                queue:          hasQueue ? svcAvailable() : svcUnavailable('queue'),\n                job:            hasJob ? svcAvailable() : svcUnavailable('job'),\n                ui:             hasUi ? svcAvailable(routes.ui) : svcUnavailable('ui'),\n                workflow:       hasWorkflow ? svcAvailable(routes.workflow) : svcUnavailable('workflow'),\n                realtime:       hasWebSockets ? svcAvailable(routes.realtime) : svcUnavailable('realtime'),\n                notification:   hasNotification ? svcAvailable(routes.notifications) : svcUnavailable('notification'),\n                ai:             hasAi ? svcAvailable(routes.ai) : svcUnavailable('ai'),\n                i18n:           hasI18n ? svcAvailable(routes.i18n) : svcUnavailable('i18n'),\n                graphql:        hasGraphQL ? svcAvailable(routes.graphql) : svcUnavailable('graphql'),\n                'file-storage': hasFiles ? svcAvailable(routes.storage) : svcUnavailable('file-storage'),\n                search:         hasSearch ? svcAvailable() : svcUnavailable('search'),\n            },\n            locale,\n        };\n    }\n\n    /**\n     * Handles GraphQL requests\n     */\n    async handleGraphQL(body: { query: string; variables?: any }, context: HttpProtocolContext) {\n        if (!body || !body.query) {\n             throw { statusCode: 400, message: 'Missing query in request body' };\n        }\n        \n        if (typeof this.kernel.graphql !== 'function') {\n            throw { statusCode: 501, message: 'GraphQL service not available' };\n        }\n\n        return this.kernel.graphql(body.query, body.variables, { \n            request: context.request \n        });\n    }\n\n    /**\n     * Handles Auth requests\n     * path: sub-path after /auth/\n     */\n    async handleAuth(path: string, method: string, body: any, context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        // 1. Try generic Auth Service\n        const authService = await this.getService(CoreServiceName.enum.auth);\n        if (authService && typeof authService.handler === 'function') {\n            const response = await authService.handler(context.request, context.response);\n            return { handled: true, result: response };\n        }\n\n        // 2. Mock fallback for MSW/test environments when no auth service is registered\n        const normalizedPath = path.replace(/^\\/+/, '');\n        return this.mockAuthFallback(normalizedPath, method, body);\n    }\n\n    /**\n     * Provides mock auth responses for core better-auth endpoints when\n     * AuthPlugin is not loaded (e.g. MSW/browser-only environments).\n     * This ensures registration/sign-in flows do not 404 in mock mode.\n     */\n    private mockAuthFallback(path: string, method: string, body: any): HttpDispatcherResult {\n        const m = method.toUpperCase();\n        const MOCK_SESSION_EXPIRY_MS = 86_400_000; // 24 hours\n\n        // POST sign-up/email\n        if ((path === 'sign-up/email' || path === 'register') && m === 'POST') {\n            const id = `mock_${randomUUID()}`;\n            return {\n                handled: true,\n                response: {\n                    status: 200,\n                    body: {\n                        user: { id, name: body?.name || 'Mock User', email: body?.email || 'mock@test.local', emailVerified: false, createdAt: new Date().toISOString(), updatedAt: new Date().toISOString() },\n                        session: { id: `session_${id}`, userId: id, token: `mock_token_${id}`, expiresAt: new Date(Date.now() + MOCK_SESSION_EXPIRY_MS).toISOString() },\n                    },\n                },\n            };\n        }\n\n        // POST sign-in/email or login\n        if ((path === 'sign-in/email' || path === 'login') && m === 'POST') {\n            const id = `mock_${randomUUID()}`;\n            return {\n                handled: true,\n                response: {\n                    status: 200,\n                    body: {\n                        user: { id, name: 'Mock User', email: body?.email || 'mock@test.local', emailVerified: true, createdAt: new Date().toISOString(), updatedAt: new Date().toISOString() },\n                        session: { id: `session_${id}`, userId: id, token: `mock_token_${id}`, expiresAt: new Date(Date.now() + MOCK_SESSION_EXPIRY_MS).toISOString() },\n                    },\n                },\n            };\n        }\n\n        // GET get-session\n        if (path === 'get-session' && m === 'GET') {\n            return {\n                handled: true,\n                response: { status: 200, body: { session: null, user: null } },\n            };\n        }\n\n        // POST sign-out\n        if (path === 'sign-out' && m === 'POST') {\n            return {\n                handled: true,\n                response: { status: 200, body: { success: true } },\n            };\n        }\n\n        return { handled: false };\n    }\n\n    /**\n     * Handles Metadata requests\n     * Standard: /metadata/:type/:name\n     * Fallback for backward compat: /metadata (all objects), /metadata/:objectName (get object)\n     */\n    async handleMetadata(path: string, _context: HttpProtocolContext, method?: string, body?: any, query?: any): Promise<HttpDispatcherResult> {\n        const parts = path.replace(/^\\/+/, '').split('/').filter(Boolean);\n        \n        // GET /metadata/types\n        if (parts[0] === 'types') {\n            // PRIORITY 1: Try MetadataService directly (includes both typeRegistry with agent/tool AND runtime-registered types)\n            const metadataService = await this.resolveService('metadata', _context.environmentId);\n\n            if (metadataService && typeof (metadataService as any).getRegisteredTypes === 'function') {\n                try {\n                    const types = await (metadataService as any).getRegisteredTypes();\n                    return { handled: true, response: this.success({ types }) };\n                } catch (e: any) {\n                    // Log error but continue to fallbacks\n                    console.warn('[HttpDispatcher] MetadataService.getRegisteredTypes() failed:', e.message);\n                }\n            }\n            // PRIORITY 2: Try protocol service (returns SchemaRegistry types only - missing agent/tool)\n            const protocol = await this.resolveService('protocol');\n            if (protocol && typeof protocol.getMetaTypes === 'function') {\n                const result = await protocol.getMetaTypes({});\n                return { handled: true, response: this.success(result) };\n            }\n            // Last resort: hardcoded defaults\n            return { handled: true, response: this.success({ types: ['object', 'app', 'plugin'] }) };\n        }\n\n        // GET /metadata/:type/:name(/:subname...)/published → get published version\n        // Supports compound names like `lead/views/all_leads/published`.\n        if (parts.length >= 3 && parts[parts.length - 1] === 'published' && (!method || method === 'GET')) {\n            const type = parts[0];\n            const name = parts.slice(1, -1).join('/');\n            const metadataService = await this.getService(CoreServiceName.enum.metadata);\n            if (metadataService && typeof (metadataService as any).getPublished === 'function') {\n                const data = await (metadataService as any).getPublished(type, name);\n                if (data === undefined) return { handled: true, response: this.error('Not found', 404) };\n                return { handled: true, response: this.success(data) };\n            }\n            // Fallback — try MetadataService via resolveService\n            const metaSvc = await this.resolveService('metadata', _context.environmentId);\n            if (metaSvc && typeof (metaSvc as any).getPublished === 'function') {\n                try {\n                    const fallbackData = await (metaSvc as any).getPublished(type, name);\n                    if (fallbackData !== undefined) return { handled: true, response: this.success(fallbackData) };\n                } catch { /* fall through */ }\n            }\n            return { handled: true, response: this.error('Not found', 404) };\n        }\n\n        // /metadata/:type/:name where :name may itself contain slashes\n        // (e.g. /metadata/lead/views/all_leads → type='lead', name='views/all_leads').\n        // Compound names are how the client expresses sub-resources of a type\n        // (a view of an object, a flow under an automation, etc.) and the\n        // metadata service treats the full string as the lookup key.\n        if (parts.length >= 2) {\n            const type = parts[0];\n            const name = parts.slice(1).join('/');\n            // Extract optional package filter from query string\n            const packageId = query?.package || undefined;\n\n            // PUT /metadata/:type/:name (Save)\n            if (method === 'PUT' && body) {\n                // Try to get the protocol service directly\n                const protocol = await this.resolveService('protocol');\n\n                if (protocol && typeof protocol.saveMetaItem === 'function') {\n                    try {\n                        const organizationId = await this.resolveActiveOrganizationId(_context);\n                        const result = await protocol.saveMetaItem({ type, name, item: body, organizationId });\n                        return { handled: true, response: this.success(result) };\n                    } catch (e: any) {\n                        return { handled: true, response: this.error(e.message, 400) };\n                    }\n                }\n\n                // Fallback: try MetadataService directly\n                const metaSvc = await this.resolveService('metadata', _context.environmentId);\n                if (metaSvc && typeof (metaSvc as any).saveItem === 'function') {\n                    try {\n                        const data = await (metaSvc as any).saveItem(type, name, body);\n                        return { handled: true, response: this.success(data) };\n                    } catch (e: any) {\n                        return { handled: true, response: this.error(e.message || 'Save not supported', 501) };\n                    }\n                }\n                return { handled: true, response: this.error('Save not supported', 501) };\n            }\n\n            try {\n                // Try specific calls based on type\n                if (type === 'objects' || type === 'object') {\n                    // Check whether the kernel is project-scoped. When it is,\n                    // the process-wide SchemaRegistry is unsafe to query\n                    // directly — it would return objects that other projects\n                    // wrote in this same process. Route through the Protocol\n                    // service (which filters sys_metadata by environment_id) in that\n                    // case, and fall back to the registry only for the\n                    // unscoped (single-kernel / control-plane) path.\n                    const protocol = await this.resolveService('protocol') as any;\n                    const scopedEnv = typeof protocol?.getProjectId === 'function'\n                        ? protocol.getProjectId()\n                        : protocol?.environmentId;\n                    const scoped = scopedEnv !== undefined;\n\n                    if (scoped && typeof protocol.getMetaItem === 'function') {\n                        try {\n                            const organizationId = await this.resolveActiveOrganizationId(_context);\n                            const data = await protocol.getMetaItem({ type: 'object', name, organizationId });\n                            // Protocol returns `{ type, name, item }` — only\n                            // treat the lookup as a hit when item is present.\n                            if (data && (data.item ?? data)) {\n                                return { handled: true, response: this.success(data) };\n                            }\n                        } catch { /* fall through to registry / 404 */ }\n                    }\n\n                    const qlService = await this.getObjectQLService();\n                    if (qlService?.registry) {\n                        const data = qlService.registry.getObject(name);\n                        if (data) return { handled: true, response: this.success(data) };\n                    }\n\n                    // Last-ditch protocol attempt for unscoped kernels whose\n                    // registry missed (e.g. object persisted to DB but not\n                    // yet hydrated). Skip when we already tried above.\n                    if (!scoped && protocol && typeof protocol.getMetaItem === 'function') {\n                        try {\n                            const organizationId = await this.resolveActiveOrganizationId(_context);\n                            const data = await protocol.getMetaItem({ type: 'object', name, organizationId });\n                            if (data && (data.item ?? data)) {\n                                return { handled: true, response: this.success(data) };\n                            }\n                        } catch { /* fall through to 404 */ }\n                    }\n                    return { handled: true, response: this.error('Not found', 404) };\n                }\n\n                // Normalize plural URL paths to singular registry type names\n                const singularType = pluralToSingular(type);\n\n                // Try Protocol Service First (Preferred)\n                const protocol = await this.resolveService('protocol');\n                if (protocol && typeof protocol.getMetaItem === 'function') {\n                     try {\n                        const organizationId = await this.resolveActiveOrganizationId(_context);\n                        const data = await protocol.getMetaItem({ type: singularType, name, packageId, organizationId });\n                        return { handled: true, response: this.success(data) };\n                     } catch (e: any) {\n                        // Protocol might throw if not found or not supported\n                     }\n                }\n\n                // Try MetadataService for runtime-registered types\n                const metaSvc = await this.resolveService('metadata', _context.environmentId);\n                if (metaSvc && typeof (metaSvc as any).getItem === 'function') {\n                    try {\n                        const data = await (metaSvc as any).getItem(singularType, name);\n                        if (data) return { handled: true, response: this.success(data) };\n                    } catch { /* not found */ }\n                }\n                return { handled: true, response: this.error('Not found', 404) };\n            } catch (e: any) {\n                // Fallback: treat first part as object name if only 1 part (handled below)\n                // But here we are deep in 2 parts. Must be an error.\n                return { handled: true, response: this.error(e.message, 404) };\n            }\n        }\n        \n        // GET /metadata/:type (List items of type) OR /metadata/:objectName (Legacy)\n        if (parts.length === 1) {\n            const typeOrName = parts[0];\n            // Extract optional package filter from query string\n            const packageId = query?.package || undefined;\n\n            // Try protocol service first for any type\n            const protocol = await this.resolveService('protocol');\n            if (protocol && typeof protocol.getMetaItems === 'function') {\n                try {\n                    const organizationId = await this.resolveActiveOrganizationId(_context);\n                    const data = await protocol.getMetaItems({ type: typeOrName, packageId, organizationId });\n                    // Return any valid response from protocol (including empty items arrays)\n                    if (data && (data.items !== undefined || Array.isArray(data))) {\n                        return { handled: true, response: this.success(data) };\n                    }\n                } catch {\n                    // Protocol doesn't know this type, fall through\n                }\n            }\n\n            // Try MetadataService directly for runtime-registered metadata (agents, tools, etc.)\n            const metadataService = await this.getService(CoreServiceName.enum.metadata);\n            if (metadataService && typeof (metadataService as any).list === 'function') {\n                try {\n                    let items = await (metadataService as any).list(typeOrName);\n                    // Respect package filter: MetadataService.list() returns ALL items,\n                    // so filter by _packageId when a specific package is requested.\n                    if (packageId && items && items.length > 0) {\n                        items = items.filter((item: any) => item?._packageId === packageId);\n                    }\n                    if (items && items.length > 0) {\n                        return { handled: true, response: this.success({ type: typeOrName, items }) };\n                    }\n                } catch (e: any) {\n                    // MetadataService doesn't know this type or failed, continue to other fallbacks\n                    // Sanitize typeOrName to prevent log injection (CodeQL warning)\n                    const sanitizedType = String(typeOrName).replace(/[\\r\\n\\t]/g, '');\n                    console.debug(`[HttpDispatcher] MetadataService.list() failed for type:`, sanitizedType, 'error:', e.message);\n                }\n            }\n\n            // Try ObjectQL registry directly for object/type lookups\n            const qlService = await this.getObjectQLService();\n            if (qlService?.registry) {\n                if (typeOrName === 'objects') {\n                    const objs = qlService.registry.getAllObjects(packageId);\n                    return { handled: true, response: this.success({ type: 'object', items: objs }) };\n                }\n                // Try listing items of the given type\n                const items = qlService.registry.listItems?.(typeOrName, packageId);\n                if (items && items.length > 0) {\n                    return { handled: true, response: this.success({ type: typeOrName, items }) };\n                }\n                // Legacy: treat as object name\n                const obj = qlService.registry.getObject(typeOrName);\n                if (obj) return { handled: true, response: this.success(obj) };\n            }\n            return { handled: true, response: this.error('Not found', 404) };\n        }\n\n        // GET /metadata — return available metadata types\n        if (parts.length === 0) {\n            // Try MetadataService for registered types\n            const metadataService = await this.resolveService('metadata', _context.environmentId);\n            if (metadataService && typeof (metadataService as any).getRegisteredTypes === 'function') {\n                try {\n                    const types = await (metadataService as any).getRegisteredTypes();\n                    return { handled: true, response: this.success({ types }) };\n                } catch { /* fall through */ }\n            }\n            // Try protocol service for dynamic types\n            const protocol = await this.resolveService('protocol');\n            if (protocol && typeof protocol.getMetaTypes === 'function') {\n                const result = await protocol.getMetaTypes({});\n                return { handled: true, response: this.success(result) };\n            }\n            return { handled: true, response: this.success({ types: ['object', 'app', 'plugin'] }) };\n        }\n        \n        return { handled: false };\n    }\n\n    /**\n     * Handles Data requests\n     * path: sub-path after /data/ (e.g. \"contacts\", \"contacts/123\", \"contacts/query\")\n     */\n    async handleData(path: string, method: string, body: any, query: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        const parts = path.replace(/^\\/+/, '').split('/');\n        const objectName = parts[0];\n\n        if (!objectName) {\n            return { handled: true, response: this.error('Object name required', 400) };\n        }\n\n        // Check if environment is resolved for data-plane requests\n        if (!_context.dataDriver && this.envRegistry) {\n            return {\n                handled: true,\n                response: this.error('Project not resolved. Please specify X-Environment-Id header or ensure hostname maps to a project.', 428)\n            };\n        }\n\n        const m = method.toUpperCase();\n\n        // 1. Custom Actions (query, batch)\n        if (parts.length > 1) {\n            const action = parts[1];\n\n            // POST /data/:object/query\n            if (action === 'query' && m === 'POST') {\n                // Spec: returns FindDataResponse = { object, records, total?, hasMore? }\n                const result = await this.callData('query', { object: objectName, ...body }, _context.dataDriver, _context.environmentId, _context.executionContext);\n                return { handled: true, response: this.success(result) };\n            }\n\n            // GET /data/:object/:id\n            if (parts.length === 2 && m === 'GET') {\n                const id = parts[1];\n                // Spec: Only select/expand are allowlisted query params for GET by ID.\n                // All other query parameters are discarded to prevent parameter pollution.\n                const { select, expand } = query || {};\n                const allowedParams: Record<string, unknown> = {};\n                if (select != null) allowedParams.select = select;\n                if (expand != null) allowedParams.expand = expand;\n                // Spec: returns GetDataResponse = { object, id, record }\n                const result = await this.callData('get', { object: objectName, id, ...allowedParams }, _context.dataDriver, _context.environmentId, _context.executionContext);\n                return { handled: true, response: this.success(result) };\n            }\n\n            // PATCH /data/:object/:id\n            if (parts.length === 2 && m === 'PATCH') {\n                const id = parts[1];\n                // Spec: returns UpdateDataResponse = { object, id, record }\n                const result = await this.callData('update', { object: objectName, id, data: body }, _context.dataDriver, _context.environmentId, _context.executionContext);\n                return { handled: true, response: this.success(result) };\n            }\n\n            // DELETE /data/:object/:id\n            if (parts.length === 2 && m === 'DELETE') {\n                const id = parts[1];\n                // Spec: returns DeleteDataResponse = { object, id, deleted }\n                const result = await this.callData('delete', { object: objectName, id }, _context.dataDriver, _context.environmentId, _context.executionContext);\n                return { handled: true, response: this.success(result) };\n            }\n        } else {\n            // GET /data/:object (List)\n            if (m === 'GET') {\n                // ── Normalize HTTP transport params → Spec canonical (QueryAST) ──\n                // HTTP GET query params use transport-level names (filter, sort, top,\n                // skip, select, expand) which are normalized here to canonical\n                // QueryAST field names (where, orderBy, limit, offset, fields,\n                // expand) before forwarding to the data service layer.\n                // The protocol.ts findData() method performs a deeper normalization\n                // pass, but pre-normalizing here ensures the data service always receives\n                // Spec-canonical keys.\n                const normalized: Record<string, unknown> = { ...query };\n\n                // filter/filters → where\n                // Note: `filter` is the canonical HTTP *transport* parameter name\n                // (see HttpFindQueryParamsSchema). It is normalized here to the\n                // canonical *QueryAST* field name `where` before data dispatch.\n                // `filters` (plural) is a deprecated alias for `filter`.\n                if (normalized.filter != null || normalized.filters != null) {\n                    normalized.where = normalized.where ?? normalized.filter ?? normalized.filters;\n                    delete normalized.filter;\n                    delete normalized.filters;\n                }\n                // select → fields\n                if (normalized.select != null && normalized.fields == null) {\n                    normalized.fields = normalized.select;\n                    delete normalized.select;\n                }\n                // sort → orderBy\n                if (normalized.sort != null && normalized.orderBy == null) {\n                    normalized.orderBy = normalized.sort;\n                    delete normalized.sort;\n                }\n                // top → limit\n                if (normalized.top != null && normalized.limit == null) {\n                    normalized.limit = normalized.top;\n                    delete normalized.top;\n                }\n                // skip → offset\n                if (normalized.skip != null && normalized.offset == null) {\n                    normalized.offset = normalized.skip;\n                    delete normalized.skip;\n                }\n\n                // Spec: returns FindDataResponse = { object, records, total?, hasMore? }\n                const result = await this.callData('query', { object: objectName, query: normalized }, _context.dataDriver, _context.environmentId, _context.executionContext);\n                return { handled: true, response: this.success(result) };\n            }\n\n            // POST /data/:object (Create)\n            if (m === 'POST') {\n                // Spec: returns CreateDataResponse = { object, id, record }\n                const result = await this.callData('create', { object: objectName, data: body }, _context.dataDriver, _context.environmentId, _context.executionContext);\n                const res = this.success(result);\n                res.status = 201;\n                return { handled: true, response: res };\n            }\n        }\n\n        return { handled: false };\n    }\n\n    /**\n     * Handles Analytics requests\n     * path: sub-path after /analytics/\n     */\n    async handleAnalytics(path: string, method: string, body: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        const analyticsService = await this.getService(CoreServiceName.enum.analytics);\n        if (!analyticsService) return { handled: false }; // 404 handled by caller if unhandled\n\n        const m = method.toUpperCase();\n        const subPath = path.replace(/^\\/+/, '');\n\n        // POST /analytics/query\n        if (subPath === 'query' && m === 'POST') {\n            const result = await analyticsService.query(body);\n            return { handled: true, response: this.success(result) };\n        }\n\n        // GET /analytics/meta\n        if (subPath === 'meta' && m === 'GET') {\n            const result = await analyticsService.getMeta();\n             return { handled: true, response: this.success(result) };\n        }\n\n        // POST /analytics/sql (Dry-run or debug)\n        if (subPath === 'sql' && m === 'POST') {\n             // Assuming service has generateSql method\n             const result = await analyticsService.generateSql(body);\n             return { handled: true, response: this.success(result) };\n        }\n\n        return { handled: false };\n    }\n\n    /**\n     * Handles i18n requests\n     * path: sub-path after /i18n/\n     *\n     * Routes:\n     *   GET /locales                    → getLocales\n     *   GET /translations/:locale       → getTranslations (locale from path)\n     *   GET /translations?locale=xx     → getTranslations (locale from query)\n     *   GET /labels/:object/:locale     → getFieldLabels  (both from path)\n     *   GET /labels/:object?locale=xx   → getFieldLabels  (locale from query)\n     */\n    async handleI18n(path: string, method: string, query: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        const i18nService = await this.getService(CoreServiceName.enum.i18n);\n        if (!i18nService) return { handled: true, response: this.error('i18n service not available', 501) };\n\n        const m = method.toUpperCase();\n        const parts = path.replace(/^\\/+/, '').split('/').filter(Boolean);\n\n        if (m !== 'GET') return { handled: false };\n\n        // GET /i18n/locales\n        if (parts[0] === 'locales' && parts.length === 1) {\n            const locales = i18nService.getLocales();\n            return { handled: true, response: this.success({ locales }) };\n        }\n\n        // GET /i18n/translations/:locale  OR  /i18n/translations?locale=xx\n        if (parts[0] === 'translations') {\n            const locale = parts[1] ? decodeURIComponent(parts[1]) : query?.locale;\n            if (!locale) return { handled: true, response: this.error('Missing locale parameter', 400) };\n\n            let translations = i18nService.getTranslations(locale);\n\n            // Locale fallback: try resolving to an available locale when\n            // the exact code yields empty translations (e.g. zh → zh-CN).\n            if (Object.keys(translations).length === 0) {\n                const availableLocales = typeof i18nService.getLocales === 'function'\n                    ? i18nService.getLocales() : [];\n                const resolved = resolveLocale(locale, availableLocales);\n                if (resolved && resolved !== locale) {\n                    translations = i18nService.getTranslations(resolved);\n                    return { handled: true, response: this.success({ locale: resolved, requestedLocale: locale, translations }) };\n                }\n            }\n\n            return { handled: true, response: this.success({ locale, translations }) };\n        }\n\n        // GET /i18n/labels/:object/:locale  OR  /i18n/labels/:object?locale=xx\n        if (parts[0] === 'labels' && parts.length >= 2) {\n            const objectName = decodeURIComponent(parts[1]);\n            let locale = parts[2] ? decodeURIComponent(parts[2]) : query?.locale;\n            if (!locale) return { handled: true, response: this.error('Missing locale parameter', 400) };\n\n            // Locale fallback for labels endpoint\n            const availableLocales = typeof i18nService.getLocales === 'function'\n                ? i18nService.getLocales() : [];\n            const resolved = resolveLocale(locale, availableLocales);\n            if (resolved) locale = resolved;\n\n            if (typeof i18nService.getFieldLabels === 'function') {\n                const labels = i18nService.getFieldLabels(objectName, locale);\n                return { handled: true, response: this.success({ object: objectName, locale, labels }) };\n            }\n            // Fallback: derive field labels from full translation bundle\n            const translations = i18nService.getTranslations(locale);\n            const prefix = `o.${objectName}.fields.`;\n            const labels: Record<string, string> = {};\n            for (const [key, value] of Object.entries(translations)) {\n                if (key.startsWith(prefix)) {\n                    labels[key.substring(prefix.length)] = value as string;\n                }\n            }\n            return { handled: true, response: this.success({ object: objectName, locale, labels }) };\n        }\n\n        return { handled: false };\n    }\n\n    /**\n     * Handles Package Management requests\n     * \n     * REST Endpoints:\n     * - GET    /packages          → list all installed packages\n     * - GET    /packages/:id      → get a specific package\n     * - POST   /packages          → install a new package\n     * - DELETE  /packages/:id      → uninstall a package\n     * - PATCH  /packages/:id/enable  → enable a package\n     * - PATCH  /packages/:id/disable → disable a package\n     * - POST   /packages/:id/publish → publish a package (metadata snapshot)\n     * - POST   /packages/:id/revert  → revert a package to last published state\n     * \n     * Uses ObjectQL SchemaRegistry directly (via the 'objectql' service).\n     */\n    async handlePackages(path: string, method: string, body: any, query: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        const m = method.toUpperCase();\n        const parts = path.replace(/^\\/+/, '').split('/').filter(Boolean);\n\n        // Try to get SchemaRegistry from the ObjectQL service\n        const qlService = await this.getObjectQLService();\n        const registry = qlService?.registry;\n\n        // If no registry available, return 503\n        if (!registry) {\n            return { handled: true, response: this.error('Package service not available', 503) };\n        }\n\n        try {\n            // GET /packages → list packages\n            if (parts.length === 0 && m === 'GET') {\n                let packages = registry.getAllPackages();\n                // Apply optional filters\n                if (query?.status) {\n                    packages = packages.filter((p: any) => p.status === query.status);\n                }\n                if (query?.type) {\n                    packages = packages.filter((p: any) => p.manifest?.type === query.type);\n                }\n                return { handled: true, response: this.success({ packages, total: packages.length }) };\n            }\n\n            // POST /packages → install package\n            if (parts.length === 0 && m === 'POST') {\n                const pkg = registry.installPackage(body.manifest || body, body.settings);\n                const res = this.success(pkg);\n                res.status = 201;\n                return { handled: true, response: res };\n            }\n\n            // PATCH /packages/:id/enable\n            if (parts.length === 2 && parts[1] === 'enable' && m === 'PATCH') {\n                const id = decodeURIComponent(parts[0]);\n                const pkg = registry.enablePackage(id);\n                if (!pkg) return { handled: true, response: this.error(`Package '${id}' not found`, 404) };\n                return { handled: true, response: this.success(pkg) };\n            }\n\n            // PATCH /packages/:id/disable\n            if (parts.length === 2 && parts[1] === 'disable' && m === 'PATCH') {\n                const id = decodeURIComponent(parts[0]);\n                const pkg = registry.disablePackage(id);\n                if (!pkg) return { handled: true, response: this.error(`Package '${id}' not found`, 404) };\n                return { handled: true, response: this.success(pkg) };\n            }\n\n            // POST /packages/:id/publish → publish package metadata\n            if (parts.length === 2 && parts[1] === 'publish' && m === 'POST') {\n                const id = decodeURIComponent(parts[0]);\n                const metadataService = await this.getService(CoreServiceName.enum.metadata);\n                if (metadataService && typeof (metadataService as any).publishPackage === 'function') {\n                    const result = await (metadataService as any).publishPackage(id, body || {});\n                    return { handled: true, response: this.success(result) };\n                }\n                return { handled: true, response: this.error('Metadata service not available', 503) };\n            }\n\n            // POST /packages/:id/revert → revert package to last published state\n            if (parts.length === 2 && parts[1] === 'revert' && m === 'POST') {\n                const id = decodeURIComponent(parts[0]);\n                const metadataService = await this.getService(CoreServiceName.enum.metadata);\n                if (metadataService && typeof (metadataService as any).revertPackage === 'function') {\n                    await (metadataService as any).revertPackage(id);\n                    return { handled: true, response: this.success({ success: true }) };\n                }\n                return { handled: true, response: this.error('Metadata service not available', 503) };\n            }\n\n            // GET /packages/:id → get package\n            if (parts.length === 1 && m === 'GET') {\n                const id = decodeURIComponent(parts[0]);\n                const pkg = registry.getPackage(id);\n                if (!pkg) return { handled: true, response: this.error(`Package '${id}' not found`, 404) };\n                return { handled: true, response: this.success(pkg) };\n            }\n\n            // DELETE /packages/:id → uninstall package\n            if (parts.length === 1 && m === 'DELETE') {\n                const id = decodeURIComponent(parts[0]);\n                const success = registry.uninstallPackage(id);\n                if (!success) return { handled: true, response: this.error(`Package '${id}' not found`, 404) };\n                return { handled: true, response: this.success({ success: true }) };\n            }\n        } catch (e: any) {\n            return { handled: true, response: this.error(e.message, e.statusCode || 500) };\n        }\n\n        return { handled: false };\n    }\n\n    /**\n     * Cloud / Environment Control-Plane routes.\n     *\n     *  - GET    /cloud/drivers                                 → list registered ObjectQL drivers (for env provisioning)\n     *  - GET    /cloud/environments                            → list\n     *  - POST   /cloud/environments                            → provision (driver: memory | turso | <any registered driver>)\n     *  - GET    /cloud/environments/:id                        → detail (+ db, credential, membership)\n     *  - PATCH  /cloud/environments/:id                        → update displayName / plan / status / isDefault / metadata\n     *  - DELETE /cloud/environments/:id[?force=1]              → cascade-delete the project (cred/member/package install rows + physical DB)\n     *  - DELETE /cloud/organizations/:id                   → cascade-delete every project (and its DB) for the org, then drop the org\n     *  - POST   /cloud/environments/:id/retry                  → re-run provisioning for a failed environment\n     *  - POST   /cloud/environments/:id/activate               → mark as active for session (stub)\n     *  - POST   /cloud/environments/:id/credentials/rotate     → rotate credential\n     *  - GET    /cloud/environments/:id/members                → list members\n     *  - GET    /cloud/environments/:id/packages               → list installed packages\n     *  - POST   /cloud/environments/:id/packages               → install package into env\n     *  - GET    /cloud/environments/:id/packages/:pkgId        → get installation detail\n     *  - PATCH  /cloud/environments/:id/packages/:pkgId/enable  → enable package\n     *  - PATCH  /cloud/environments/:id/packages/:pkgId/disable → disable package\n     *  - DELETE /cloud/environments/:id/packages/:pkgId        → uninstall (scope=platform forbidden)\n     *  - POST   /cloud/environments/:id/packages/:pkgId/upgrade → upgrade to newer version\n     *\n     * Driver binding\n     * --------------\n     * Environments are not tied to any specific driver. At provisioning time the\n     * caller passes `driver` (a short name such as `memory`, `turso`, or any\n     * future `sql` / `postgres` driver). The dispatcher validates the name\n     * against the kernel's registered driver services (`driver.<name>`) and\n     * derives an appropriate placeholder `database_url` for the chosen driver.\n     * If `driver` is omitted, the dispatcher auto-selects the first available\n     * in preference order: turso → memory → any other registered driver.\n     *\n     * Backed by ObjectQL sys_environment / sys_environment_credential /\n     * sys_environment_member tables (registered by\n     * `@objectstack/service-tenant`'s `createTenantPlugin`).\n     * Physical database addressing (database_url, database_driver, etc.)\n     * is stored directly on the sys_environment row.\n     */\n    /**\n     * Resolve the calling user id from the request session, if any.\n     * Returns `undefined` for anonymous calls or when auth is not wired up.\n     */\n    private async resolveActiveOrganizationId(context: HttpProtocolContext): Promise<string | undefined> {\n        try {\n            const authService: any = await this.resolveService(CoreServiceName.enum.auth);\n            const rawHeaders = context.request?.headers;\n            let headers: any = rawHeaders;\n            if (rawHeaders && typeof rawHeaders === 'object' && typeof (rawHeaders as any).get !== 'function') {\n                try {\n                    const h = new Headers();\n                    for (const [k, v] of Object.entries(rawHeaders as Record<string, any>)) {\n                        if (v == null) continue;\n                        h.set(k, Array.isArray(v) ? v.join(', ') : String(v));\n                    }\n                    headers = h;\n                } catch {\n                    headers = rawHeaders;\n                }\n            }\n            const apiObj = authService?.auth?.api ?? authService?.api;\n            const sessionData = await apiObj?.getSession?.call(apiObj, { headers });\n            const oid = sessionData?.session?.activeOrganizationId;\n            return typeof oid === 'string' && oid.length > 0 ? oid : undefined;\n        } catch {\n            return undefined;\n        }\n    }\n\n    private async resolveCallerUserId(context: HttpProtocolContext): Promise<string | undefined> {\n        try {\n            const authService: any = await this.resolveService(CoreServiceName.enum.auth);\n            const rawHeaders = context.request?.headers;\n            // better-auth's `getSession` expects a `Headers` instance (or a plain\n            // object that the better-auth SDK happens to coerce). Hono's adapter\n            // hands us a `Record<string, string>` of lowercased header names, so\n            // convert to `Headers` to be safe.\n            let headers: any = rawHeaders;\n            if (rawHeaders && typeof rawHeaders === 'object' && typeof (rawHeaders as any).get !== 'function') {\n                try {\n                    const h = new Headers();\n                    for (const [k, v] of Object.entries(rawHeaders as Record<string, any>)) {\n                        if (v == null) continue;\n                        h.set(k, Array.isArray(v) ? v.join(', ') : String(v));\n                    }\n                    headers = h;\n                } catch {\n                    headers = rawHeaders;\n                }\n            }\n            const sessionData = await (authService?.auth?.api?.getSession ?? authService?.api?.getSession)?.call(\n                authService?.auth?.api ?? authService?.api,\n                { headers },\n            );\n            return sessionData?.user?.id ?? sessionData?.session?.userId;\n        } catch (e: any) {\n            return undefined;\n        }\n    }\n\n    async handleCloud(path: string, method: string, body: any, query: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        const m = method.toUpperCase();\n        const parts = path.replace(/^\\/+/, '').split('/').filter(Boolean);\n\n        const qlService = await this.getObjectQLService();\n        const ql = qlService ?? await this.resolveService('objectql');\n        if (!ql) {\n            return { handled: true, response: this.error('Project service not available (ObjectQL missing)', 503) };\n        }\n\n        const ENV = 'sys_environment';\n        const CRED = 'sys_environment_credential';\n        const MEM = 'sys_environment_member';\n        const PKG_INSTALL = 'sys_package_installation';\n        const PKG = 'sys_package';\n        const PKG_VERSION = 'sys_package_version';\n\n        /**\n         * Upsert a `sys_package` row keyed by `manifest_id`. Auto-publishes the\n         * package metadata from the in-memory registry the first time a project\n         * tries to install it. Returns the row id (UUID).\n         */\n        const ensureSysPackage = async (\n            manifestId: string,\n            ownerOrgId: string,\n            createdBy: string,\n            manifest?: any,\n        ): Promise<string> => {\n            const existing = await ql.findOne(PKG, { where: { manifest_id: manifestId } } as any) as any;\n            if (existing?.id) return existing.id;\n            const id = randomUUID();\n            const nowIso = new Date().toISOString();\n            await ql.insert(PKG, {\n                id,\n                manifest_id: manifestId,\n                owner_org_id: ownerOrgId,\n                display_name: manifest?.name ?? manifestId,\n                description: manifest?.description ?? null,\n                visibility: 'private',\n                created_by: createdBy,\n                created_at: nowIso,\n                updated_at: nowIso,\n            });\n            return id;\n        };\n\n        /**\n         * Upsert a `sys_package_version` row keyed by (package_id, version).\n         * Auto-publishes a version snapshot the first time it is referenced.\n         * Returns the row id (UUID).\n         */\n        const ensureSysPackageVersion = async (\n            packageId: string,\n            version: string,\n            createdBy: string,\n            manifest?: any,\n        ): Promise<string> => {\n            const existing = await ql.findOne(PKG_VERSION, {\n                where: { package_id: packageId, version },\n            } as any) as any;\n            if (existing?.id) return existing.id;\n            const id = randomUUID();\n            const nowIso = new Date().toISOString();\n            await ql.insert(PKG_VERSION, {\n                id,\n                package_id: packageId,\n                version,\n                status: 'published',\n                manifest_json: manifest ? JSON.stringify(manifest) : null,\n                is_pre_release: false,\n                published_at: nowIso,\n                published_by: createdBy,\n                created_by: createdBy,\n                created_at: nowIso,\n                updated_at: nowIso,\n            });\n            return id;\n        };\n\n        /**\n         * Resolve a per-project install record by the user-facing manifest id\n         * (e.g. `com.objectstack.audit`). The schema stores `package_id` as a\n         * sys_package UUID, so we must join through sys_package first.\n         */\n        const findInstallByManifestId = async (\n            envId: string,\n            manifestId: string,\n        ): Promise<any | null> => {\n            const pkgRow = await ql.findOne(PKG, { where: { manifest_id: manifestId } } as any) as any;\n            if (!pkgRow?.id) return null;\n            return await ql.findOne(PKG_INSTALL, {\n                where: { environment_id: envId, package_id: pkgRow.id },\n            } as any);\n        };\n\n        // Enumerate registered ObjectQL drivers. Driver services are registered\n        // by `DriverPlugin` under the key `driver.<driver.name>` where\n        // `driver.name` is typically the full FQN like `com.objectstack.driver.memory`.\n        // We derive a short name by stripping the `com.objectstack.driver.` prefix.\n        const toShortName = (driverId: string): string => {\n            const prefix = 'com.objectstack.driver.';\n            return driverId.startsWith(prefix) ? driverId.slice(prefix.length) : driverId;\n        };\n        const listRegisteredDrivers = (): Array<{ name: string; driverId: string }> => {\n            const services = this.getServicesMap();\n            // Prefer the provisioning-adapter registry installed by the tenant\n            // plugin — it exposes the *logical* storage backends the\n            // control-plane can actually allocate a project against (memory /\n            // sqlite / turso / ...). The raw ObjectQL `driver.*` services are\n            // a deeper layer (e.g. a single unified `sql` driver that covers\n            // better-sqlite3 + libsql + pg + mysql) and collapse the user's\n            // meaningful choices into one row, so they make a poor UI source.\n            const registry: any = services['project-provisioning-adapters'];\n            if (registry && typeof registry.list === 'function') {\n                try {\n                    const adapters = registry.list() as Array<{ driver: string }>;\n                    const seen = new Set<string>();\n                    const drivers: Array<{ name: string; driverId: string }> = [];\n                    for (const adapter of adapters ?? []) {\n                        const name = adapter?.driver;\n                        if (!name || seen.has(name)) continue;\n                        seen.add(name);\n                        drivers.push({ name, driverId: `com.objectstack.driver.${name}` });\n                    }\n                    if (drivers.length > 0) return drivers;\n                } catch {\n                    // Adapter registry unusable — fall through to the legacy scan.\n                }\n            }\n            const drivers: Array<{ name: string; driverId: string }> = [];\n            for (const [serviceKey, svc] of Object.entries(services)) {\n                if (!serviceKey.startsWith('driver.')) continue;\n                const raw = serviceKey.slice('driver.'.length);\n                if (!raw || raw === 'unknown') continue;\n                const driverId = (svc as any)?.name ?? raw;\n                drivers.push({ name: toShortName(driverId), driverId });\n            }\n            return drivers;\n        };\n\n        const resolveDriver = (requested: string | undefined): { name: string; driverId: string } | undefined => {\n            const registered = listRegisteredDrivers();\n            if (requested) {\n                const wanted = String(requested).toLowerCase();\n                return registered.find((d) => d.name === wanted || d.driverId === wanted);\n            }\n            // Auto-pick: prefer turso, then memory, then whatever is available.\n            return (\n                registered.find((d) => d.name === 'turso') ??\n                registered.find((d) => d.name === 'memory') ??\n                registered[0]\n            );\n        };\n\n        const buildDatabaseUrl = (driverName: string, environmentId: string): string => {\n            const dbName = `env-${environmentId}`;\n            switch (driverName) {\n                case 'memory':\n                    return `memory://${dbName}`;\n                case 'turso':\n                    return `libsql://${dbName}.mock-turso.local`;\n                default:\n                    // Generic placeholder for future SQL / postgres / mysql drivers.\n                    return `${driverName}://${dbName}`;\n            }\n        };\n\n        /**\n         * Real physical-DB adapter resolver. Looks up the\n         * `environment-provisioning-adapters` service registered by the\n         * tenant plugin. When present, provisioning actually creates a file\n         * on disk (sqlite adapter) or a Turso cloud DB (when TURSO_ORG_NAME\n         * + TURSO_API_TOKEN are set).\n         *\n         * Returns `undefined` if the service is not registered. In that\n         * case the dispatcher falls back to the mock-URL behaviour — the\n         * state machine still works, but no real DB file is created.\n         */\n        const getRealAdapter = async (\n            driverName: string,\n        ): Promise<{\n            createDatabase(params: {\n                environmentId: string;\n                databaseName: string;\n                region: string;\n                storageLimitMb: number;\n            }): Promise<{ databaseUrl: string; plaintextSecret: string }>;\n            deleteDatabase?(params: {\n                environmentId: string;\n                databaseName: string;\n                databaseUrl?: string;\n            }): Promise<void>;\n        } | undefined> => {\n            try {\n                const registry: any = await this.resolveService('project-provisioning-adapters');\n                // Alias the generic 'sql' short name onto the SQLite\n                // provisioning adapter. `sql` is SqlDriver's default short\n                // name when registered via DriverPlugin; provisioning\n                // adapters key themselves by the logical driver family\n                // ('sqlite', 'turso', 'memory') not the implementation id.\n                const aliases: Record<string, string> = { sql: 'sqlite' };\n                const effective = aliases[driverName] ?? driverName;\n                return registry?.get?.(effective) ?? registry?.get?.(driverName);\n            } catch {\n                return undefined;\n            }\n        };\n\n        const findOne = async (obj: string, where: Record<string, unknown>): Promise<any | undefined> => {\n            let rows = await ql.find(obj, { where } as any);\n            if (rows && (rows as any).value) rows = (rows as any).value;\n            if (!Array.isArray(rows)) return undefined;\n            return rows[0];\n        };\n\n        // Data crosses the wire as snake_case — matching the canonical\n        // `sys_environment` schema. The only post-processing is JSON-parsing the\n        // `metadata` column so consumers don't need to unwrap it.\n        const cleanProjectRow = (row: any): any => {\n            if (!row) return row;\n            let metadata: any = row.metadata;\n            if (typeof metadata === 'string') {\n                try { metadata = JSON.parse(metadata); } catch { /* keep raw string if not JSON */ }\n            }\n            return { ...row, metadata };\n        };\n\n        try {\n            // ----- /cloud/drivers ------------------------------------------\n            if (parts.length === 1 && parts[0] === 'drivers' && m === 'GET') {\n                const drivers = listRegisteredDrivers();\n                return { handled: true, response: this.success({ drivers, total: drivers.length }) };\n            }\n\n            // ----- /cloud/templates ----------------------------------------\n            if (parts.length === 1 && parts[0] === 'templates' && m === 'GET') {\n                try {\n                    const seeder: any = await this.resolveService('template-seeder');\n                    const templates = seeder?.listTemplates?.() ?? [];\n                    return { handled: true, response: this.success({ templates, total: templates.length }) };\n                } catch (err: any) {\n                    // Don't silently mask — log the real reason. Empty templates\n                    // here usually means MultiProjectPlugin failed to register\n                    // `template-seeder` (e.g. control-driver init error).\n                    try {\n                        // eslint-disable-next-line no-console\n                        console.error('[HttpDispatcher] /cloud/templates: failed to resolve template-seeder:', err?.message ?? err);\n                    } catch { /* noop */ }\n                    return { handled: true, response: this.success({ templates: [], total: 0 }) };\n                }\n            }\n\n            // ----- POST /cloud/admin/platform-sso/backfill ----------------\n            // Idempotent admin trigger: scans `sys_environment` and ensures every\n            // active project has a corresponding `sys_oauth_application` row\n            // for platform SSO (\"Airtable-style unified login\"). Safe to call\n            // any number of times — re-running with the same project is a\n            // no-op for existing rows and only patches in missing\n            // redirect_uris. Requires the caller to bear a Bearer token\n            // equal to OS_AUTH_SECRET (the shared cloud/objectos secret),\n            // since the boot-time backfill plugin can be flaky on cold-start\n            // and operators need an out-of-band way to recover.\n            if (parts.length === 3\n                && parts[0] === 'admin'\n                && parts[1] === 'platform-sso'\n                && parts[2] === 'backfill'\n                && m === 'POST') {\n                const baseSecret = (process.env.OS_AUTH_SECRET ?? process.env.AUTH_SECRET ?? '').trim();\n                if (!baseSecret) {\n                    return { handled: true, response: this.error('OS_AUTH_SECRET not configured on this worker', 503) };\n                }\n                const rawHeaders = _context?.request?.headers;\n                let authHeader: string | undefined;\n                if (rawHeaders && typeof (rawHeaders as any).get === 'function') {\n                    authHeader = (rawHeaders as any).get('authorization') ?? undefined;\n                } else if (rawHeaders && typeof rawHeaders === 'object') {\n                    authHeader = (rawHeaders as any)['authorization'] ?? (rawHeaders as any)['Authorization'];\n                }\n                const presented = typeof authHeader === 'string' && authHeader.startsWith('Bearer ')\n                    ? authHeader.slice(7).trim()\n                    : '';\n                if (!presented || presented !== baseSecret) {\n                    return { handled: true, response: this.error('forbidden: Bearer token must match OS_AUTH_SECRET', 403) };\n                }\n                try {\n                    const { backfillPlatformSsoClients } = await import('./cloud/platform-sso.js');\n                    const result = await backfillPlatformSsoClients({\n                        ql,\n                        baseSecret,\n                        logger: console,\n                    });\n                    // Dump a few rows so we can confirm the data actually\n                    // matches what better-auth's oauth-provider expects.\n                    let sample: any[] = [];\n                    let total = 0;\n                    try {\n                        const rows = await (ql as any).find('sys_oauth_application', { limit: 5 }, { context: { isSystem: true } });\n                        const list = Array.isArray(rows) ? rows : Array.isArray(rows?.records) ? rows.records : [];\n                        sample = list;\n                        total = typeof (rows as any)?.total === 'number' ? (rows as any).total : list.length;\n                    } catch (e: any) {\n                        sample = [{ _readErr: e?.message ?? String(e) }];\n                    }\n                    return { handled: true, response: this.success({ ...result, total, sample }) };\n                } catch (err: any) {\n                    return { handled: true, response: this.error(`backfill failed: ${err?.message ?? String(err)}`, 500) };\n                }\n            }\n\n            // ----- /cloud/environments collection routes -----\n            if (parts.length === 1 && parts[0] === 'projects' && m === 'GET') {\n                const where: Record<string, unknown> = {};\n                if (query?.organizationId) where.organization_id = query.organizationId;\n                if (query?.status) where.status = query.status;\n                let rows = await ql.find(ENV, Object.keys(where).length ? ({ where } as any) : undefined);\n                if (rows && (rows as any).value) rows = (rows as any).value;\n                const projects = (Array.isArray(rows) ? rows : []).map(cleanProjectRow);\n                return { handled: true, response: this.success({ projects, total: projects.length }) };\n            }\n\n            if (parts.length === 1 && parts[0] === 'projects' && m === 'POST') {\n                const req = body || {};\n                // Resolve `__session__` placeholders from the active session so clients\n                // can omit these fields and let the server infer them.\n                // Use `resolveCallerUserId` which properly converts plain header\n                // objects to `Headers` instances and probes both\n                // `authService.auth.api.getSession` and `authService.api.getSession`\n                // (better-auth's API shape differs across wrappings).\n                if (req.organization_id === '__session__' || req.created_by === '__session__') {\n                    try {\n                        const userId = await this.resolveCallerUserId(_context);\n                        if (req.created_by === '__session__') {\n                            req.created_by = userId ?? 'system';\n                        }\n                        if (req.organization_id === '__session__') {\n                            // We still need the activeOrganizationId — fetch the\n                            // session directly via the helper-built Headers.\n                            const authService: any = await this.resolveService(CoreServiceName.enum.auth);\n                            const rawHeaders = _context?.request?.headers;\n                            let headers: any = rawHeaders;\n                            if (rawHeaders && typeof rawHeaders === 'object' && typeof (rawHeaders as any).get !== 'function') {\n                                const h = new Headers();\n                                for (const [k, v] of Object.entries(rawHeaders as Record<string, any>)) {\n                                    if (v == null) continue;\n                                    h.set(k, Array.isArray(v) ? v.join(', ') : String(v));\n                                }\n                                headers = h;\n                            }\n                            const apiObj = authService?.auth?.api ?? authService?.api;\n                            const sessionData = await apiObj?.getSession?.call(apiObj, { headers });\n                            req.organization_id = sessionData?.session?.activeOrganizationId ?? undefined;\n                        }\n                    } catch {\n                        // Fall through — validation below will reject missing fields.\n                    }\n                }\n                if (!req.organization_id || !req.display_name) {\n                    return { handled: true, response: this.error('organization_id and display_name are required', 400) };\n                }\n                const environmentId = randomUUID();\n                const credentialId = randomUUID();\n                const nowIso = new Date().toISOString();\n\n                // Bind environment to a driver. `req.driver` is optional — any\n                // registered ObjectQL driver is accepted (memory / turso / future\n                // sql / postgres). If omitted, pick the best default available.\n                const resolved = resolveDriver(req.driver);\n                if (!resolved) {\n                    const available = listRegisteredDrivers().map((d) => d.name);\n                    if (req.driver) {\n                        return {\n                            handled: true,\n                            response: this.error(\n                                `Unknown driver '${req.driver}'. Available drivers: [${available.join(', ') || 'none'}]`,\n                                400,\n                            ),\n                        };\n                    }\n                    return {\n                        handled: true,\n                        response: this.error(\n                            'No ObjectQL driver is registered. Register at least one DriverPlugin (e.g. InMemoryDriver or TursoDriver).',\n                            503,\n                        ),\n                    };\n                }\n                const driver = resolved.name;\n                let plaintextSecret = `mock-token-${environmentId}`;\n\n                // Compute hostname if not provided.\n                // Format: {org-slug}-{short-project-id}.{rootDomain}\n                // Uses the first 8 chars of the UUID as a stable, collision-free\n                // suffix now that projects no longer carry a user-facing slug.\n                let computedHostname = req.hostname;\n                if (!computedHostname) {\n                    const shortId = environmentId.slice(0, 8);\n                    try {\n                        const orgRow = await findOne('sys_organization', { id: req.organization_id });\n                        const orgSlug = orgRow?.slug || req.organization_id;\n                        const rootDomain = getEnv('OS_ROOT_DOMAIN') ?? getEnv('ROOT_DOMAIN', 'objectstack.app');\n                        computedHostname = `${orgSlug}-${shortId}.${rootDomain}`;\n                    } catch {\n                        // Fallback if sys_organization doesn't exist\n                        computedHostname = `${req.organization_id}-${shortId}.objectstack.app`;\n                    }\n                }\n\n                // Hostname pre-flight: surface a clean 409 before we\n                // kick off fire-and-forget provisioning, so the client\n                // gets an actionable error rather than a silent\n                // status: 'failed' + metadata.provisioningError later.\n                // The sys_environment.hostname column is UNIQUE at the DB\n                // layer but that constraint would only trip during\n                // insert — by which point the caller has already moved\n                // on from the HTTP response.\n                try {\n                    const existing = await findOne('sys_environment', {\n                        hostname: computedHostname,\n                    });\n                    if (existing && existing.id !== environmentId) {\n                        return {\n                            handled: true,\n                            response: this.error(\n                                `Hostname '${computedHostname}' is already in use by another project.`,\n                                409,\n                                { code: 'HOSTNAME_TAKEN', hostname: computedHostname },\n                            ),\n                        };\n                    }\n                } catch {\n                    // sys_environment table may not yet be ready (first-run cold\n                    // boot) — fall through and let the DB enforce uniqueness.\n                }\n\n                // Insert environment row in `provisioning` state first so the\n                // UI can show a \"Provisioning…\" indicator while the driver\n                // handshake runs in the background. Status transitions to\n                // `active` on success, or `failed` (+metadata.provisioningError)\n                // on unrecoverable errors.\n                const baseMetadata: Record<string, unknown> = { ...(req.metadata ?? {}) };\n                // Dev-only: callers can set `metadata.__simulateFailure = true`\n                // (or `__simulateDelayMs = N`) to exercise the provisioning /\n                // failed / retry state machine end-to-end without a real driver.\n                const simulateFailure = Boolean((baseMetadata as any).__simulateFailure);\n                const simulateDelayMs = Number((baseMetadata as any).__simulateDelayMs ?? 1500);\n\n                // Capture project-owner identity so the per-project kernel can\n                // pre-seed a `sys_user` row for this person on first boot.\n                // Without this, the owner lands on their own project as a\n                // brand-new SSO JIT user (no admin role, no membership) and\n                // has to manually promote themselves. Best-effort: failure\n                // to resolve must not abort project creation.\n                try {\n                    // Prefer the value already resolved by the upstream\n                    // `__session__` block (now backed by `resolveCallerUserId`);\n                    // fall back to `resolveCallerUserId` directly for callers\n                    // that omitted `created_by` entirely.\n                    let ownerUserId: string | undefined =\n                        req.created_by && req.created_by !== 'system'\n                            ? String(req.created_by)\n                            : undefined;\n                    if (!ownerUserId) {\n                        ownerUserId = await this.resolveCallerUserId(_context);\n                    }\n                    if (ownerUserId) {\n                        const userRow = await ql.find('sys_user', { where: { id: ownerUserId } } as any);\n                        const userRows = Array.isArray(userRow) ? userRow : (userRow?.value ?? []);\n                        const u = Array.isArray(userRows) && userRows.length > 0 ? userRows[0] : null;\n                        if (u?.email) {\n                            (baseMetadata as any).ownerSeed = {\n                                userId: String(ownerUserId),\n                                email: String(u.email),\n                                name: u.name ? String(u.name) : null,\n                                image: u.image ? String(u.image) : null,\n                            };\n                        }\n                    }\n                } catch {\n                    // owner lookup failed entirely — skip seed; later access\n                    // flows still work via the platform-SSO JIT path.\n                }\n\n                // Also capture the OWNING cloud org so the per-project\n                // kernel can mirror it into the project's `sys_organization`\n                // table on first boot. Without this, SecurityPlugin's\n                // `ensureUserHasOrganization` middleware would auto-create a\n                // disjoint \"Alice's Workspace\" personal org for the owner,\n                // completely detached from the cloud team that actually\n                // owns the project at the platform level. Best-effort: a\n                // missing org row only means the project's primary\n                // workspace falls back to the personal-org pattern.\n                try {\n                    const orgRow = await ql.find('sys_organization', { where: { id: req.organization_id } } as any);\n                    const orgRows = Array.isArray(orgRow) ? orgRow : (orgRow?.value ?? []);\n                    const org = Array.isArray(orgRows) && orgRows.length > 0 ? orgRows[0] : null;\n                    if (org?.id && org?.name) {\n                        (baseMetadata as any).orgSeed = {\n                            id: String(org.id),\n                            name: String(org.name),\n                            slug: org.slug ? String(org.slug) : null,\n                            logo: org.logo ? String(org.logo) : null,\n                        };\n                    }\n                } catch {\n                    // org lookup failed — skip the mirror. Owner seed\n                    // still works; the user will land in the auto-created\n                    // personal workspace as before.\n                }\n                await ql.insert(ENV, {\n                    id: environmentId,\n                    organization_id: req.organization_id,\n                    display_name: req.display_name,\n                    is_default: req.is_default ?? false,\n                    is_system: req.is_system ?? false,\n                    plan: req.plan ?? 'free',\n                    status: 'provisioning',\n                    created_by: req.created_by ?? 'system',\n                    metadata: JSON.stringify(baseMetadata),\n                    created_at: nowIso,\n                    updated_at: nowIso,\n                    database_url: null,\n                    database_driver: driver,\n                    storage_limit_mb: req.storage_limit_mb ?? 1024,\n                    provisioned_at: null,\n                    hostname: computedHostname,\n                    visibility: (() => {\n                        const raw = String(req.visibility ?? 'private');\n                        return raw === 'unlisted' ? 'private' : raw;\n                    })(),\n                });\n\n                // Platform SSO seed: register a `sys_oauth_application` row\n                // so the per-project runtime can immediately exchange\n                // authorization codes with this cloud control plane. Best\n                // effort — failures are logged but do NOT abort the\n                // project-create flow (the project remains usable with\n                // email/password sign-in as the legacy fallback).\n                try {\n                    const { seedPlatformSsoClient } = await import('./cloud/platform-sso.js');\n                    const baseSecret = (process.env.OS_AUTH_SECRET ?? process.env.AUTH_SECRET ?? '').trim();\n                    if (baseSecret) {\n                        await seedPlatformSsoClient({\n                            ql,\n                            environmentId,\n                            hostname: computedHostname,\n                            baseSecret,\n                            logger: console,\n                        });\n                    }\n                } catch (ssoErr) {\n                    console.warn?.('[http-dispatcher] platform SSO seed failed (non-fatal)', {\n                        environmentId,\n                        error: (ssoErr as Error)?.message,\n                    });\n                }\n\n                // Fire-and-forget the provisioning work so the POST returns\n                // immediately with a `provisioning` record. The UI can then\n                // refresh (or poll) to observe the transition.\n                const runProvisioning = async (): Promise<void> => {\n                    try {\n                        if (simulateDelayMs > 0) {\n                            await new Promise((r) => setTimeout(r, simulateDelayMs));\n                        }\n                        if (simulateFailure) {\n                            throw new Error('Simulated provisioning failure (metadata.__simulateFailure=true)');\n                        }\n                        // Try a real adapter first (creates a real sqlite file\n                        // or Turso cloud DB). Fall back to the mock URL if no\n                        // adapter is registered for this driver.\n                        let databaseUrl: string;\n                        try {\n                            const adapter = await getRealAdapter(driver);\n                            if (adapter) {\n                                const result = await adapter.createDatabase({\n                                    environmentId,\n                                    databaseName: `p-${environmentId.replace(/-/g, \"\").slice(0, 24)}`,\n                                    region: 'us-east-1',\n                                    storageLimitMb: req.storage_limit_mb ?? 1024,\n                                });\n                                databaseUrl = result.databaseUrl;\n                                if (result.plaintextSecret) plaintextSecret = result.plaintextSecret;\n                            } else {\n                                databaseUrl = buildDatabaseUrl(driver, environmentId);\n                            }\n                        } catch (adapterErr) {\n                            // Adapter call failed (e.g. Turso API down). Surface\n                            // the underlying message — the outer catch will flip\n                            // the env to `failed`.\n                            throw adapterErr instanceof Error\n                                ? adapterErr\n                                : new Error(String(adapterErr));\n                        }\n                        // Persist `database_url` first (still `provisioning`) so\n                        // kernel-factory / template-seeder can resolve the\n                        // physical DB while seeding runs. Status flips to\n                        // `active` only AFTER seeding completes — clients\n                        // polling `waitForActive` then know the project's\n                        // schema and seed data are queryable.\n                        const seedStartedAt = new Date().toISOString();\n                        await ql.update(\n                            ENV,\n                            {\n                                database_url: databaseUrl,\n                                updated_at: seedStartedAt,\n                            },\n                            { where: { id: environmentId } } as any,\n                        );\n                        await ql.insert(CRED, {\n                            id: credentialId,\n                            environment_id: environmentId,\n                            secret_ciphertext: plaintextSecret,\n                            encryption_key_id: 'noop',\n                            authorization: 'full_access',\n                            status: 'active',\n                            created_at: seedStartedAt,\n                            updated_at: seedStartedAt,\n                        });\n\n                        // Seed template metadata into the newly-provisioned project.\n                        // Non-fatal: errors are stored in sys_environment.metadata so the\n                        // project stays `active` even if template seeding fails.\n                        const templateId = req.template_id ?? 'blank';\n                        if (templateId !== 'blank') {\n                            try {\n                                const seeder: any = await this.resolveService('template-seeder');\n                                if (seeder) {\n                                    await seeder.seed({ environmentId, templateId });\n                                }\n                            } catch (seedErr) {\n                                const seedMessage = seedErr instanceof Error ? seedErr.message : String(seedErr);\n                                // Persist seed error in metadata (non-fatal — project is active).\n                                try {\n                                    const existing = await findOne(ENV, { id: environmentId });\n                                    const existingMeta = typeof existing?.metadata === 'string'\n                                        ? JSON.parse(existing.metadata)\n                                        : (existing?.metadata ?? {});\n                                    await ql.update(\n                                        ENV,\n                                        {\n                                            metadata: JSON.stringify({\n                                                ...existingMeta,\n                                                templateSeedError: { message: seedMessage, templateId },\n                                            }),\n                                        },\n                                        { where: { id: environmentId } } as any,\n                                    );\n                                } catch {\n                                    // Best-effort metadata update — ignore secondary failure.\n                                }\n                            }\n                        }\n\n                        // Bind a third-party developer's locally compiled artifact\n                        // into this project. The caller passes\n                        // `metadata.artifact_path` (path to a compiled\n                        // ObjectStack bundle JSON) and we delegate to the same\n                        // seeder pipeline that templates use. Resolved relative\n                        // to OS_PROJECT_ARTIFACT_ROOT (or process.cwd\n                        // if unset). Uses the shared `loadArtifactBundle`\n                        // helper (read JSON + dynamic-import sibling\n                        // runtime ESM + merge `functions` map) so this path\n                        // stays in lockstep with FsAppBundleResolver and\n                        // runtime-stack basePlugins.\n                        const artifactPathRaw = (baseMetadata as any).artifact_path;\n                        if (typeof artifactPathRaw === 'string' && artifactPathRaw.length > 0) {\n                            try {\n                                const path = await import('node:path');\n                                const { isHttpUrl, loadArtifactBundle } = await import('./load-artifact-bundle.js');\n                                const root = process.env.OS_PROJECT_ARTIFACT_ROOT\n                                    ?? process.cwd();\n                                const resolved = isHttpUrl(artifactPathRaw)\n                                    ? artifactPathRaw\n                                    : (path.isAbsolute(artifactPathRaw)\n                                        ? artifactPathRaw\n                                        : path.resolve(root, artifactPathRaw));\n                                const bundle = await loadArtifactBundle(resolved, { tag: '[bind-artifact]' });\n                                if (!bundle) {\n                                    throw new Error(`failed to load artifact bundle at '${resolved}'`);\n                                }\n                                const seeder: any = await this.resolveService('template-seeder');\n                                if (seeder?.seedBundle) {\n                                    await seeder.seedBundle({ environmentId, bundle });\n                                } else {\n                                    throw new Error('template-seeder.seedBundle is unavailable');\n                                }\n                            } catch (bindErr) {\n                                const bindMessage = bindErr instanceof Error ? bindErr.message : String(bindErr);\n                                try {\n                                    const existing = await findOne(ENV, { id: environmentId });\n                                    const existingMeta = typeof existing?.metadata === 'string'\n                                        ? JSON.parse(existing.metadata)\n                                        : (existing?.metadata ?? {});\n                                    await ql.update(\n                                        ENV,\n                                        {\n                                            metadata: JSON.stringify({\n                                                ...existingMeta,\n                                                artifactBindError: { message: bindMessage, artifactPath: artifactPathRaw },\n                                            }),\n                                        },\n                                        { where: { id: environmentId } } as any,\n                                    );\n                                } catch {\n                                    // Best-effort metadata update — ignore secondary failure.\n                                }\n                            }\n                        }\n\n                        // All seeding + binding completed (or recorded as\n                        // non-fatal errors). Flip the project to `active` so\n                        // request routing + waitForActive observers can see\n                        // the project as ready.\n                        const finishedAt = new Date().toISOString();\n                        await ql.update(\n                            ENV,\n                            {\n                                status: 'active',\n                                provisioned_at: finishedAt,\n                                updated_at: finishedAt,\n                            },\n                            { where: { id: environmentId } } as any,\n                        );\n                    } catch (err) {\n                        const message = err instanceof Error ? err.message : String(err);\n                        const failedAt = new Date().toISOString();\n                        await ql.update(\n                            ENV,\n                            {\n                                status: 'failed',\n                                metadata: JSON.stringify({\n                                    ...baseMetadata,\n                                    provisioningError: { message, failedAt },\n                                }),\n                                updated_at: failedAt,\n                            },\n                            { where: { id: environmentId } } as any,\n                        );\n                    }\n                };\n                // On serverless platforms (Vercel/AWS Lambda/Netlify) the\n                // function instance freezes the moment we send the response,\n                // so a fire-and-forget background task never gets to\n                // persist `database_url` — leaving every subsequent request\n                // to crash with \"Project … missing database_url/database_driver\".\n                // Auto-detect those environments and await the provisioning\n                // inline. Operators can also force this with\n                // `OS_PROVISION_SYNC=1` (or disable with `=0`).\n                const provisionSyncEnv = process.env.OS_PROVISION_SYNC;\n                const onServerless = !!(\n                    process.env.VERCEL\n                    || process.env.AWS_LAMBDA_FUNCTION_NAME\n                    || process.env.NETLIFY\n                    || process.env.CF_PAGES\n                );\n                const syncProvisioning = provisionSyncEnv === undefined\n                    ? onServerless\n                    : provisionSyncEnv !== '0' && provisionSyncEnv !== 'false';\n                if (syncProvisioning) {\n                    await runProvisioning();\n                } else {\n                    void runProvisioning();\n                }\n\n                const project = cleanProjectRow(await findOne(ENV, { id: environmentId }));\n                const res = this.success({ project });\n                res.status = syncProvisioning ? 201 : 202;\n                return { handled: true, response: res };\n            }\n\n            // ----- /cloud/environments/:id -----\n            if (parts.length === 2 && parts[0] === 'projects') {\n                const id = decodeURIComponent(parts[1]);\n\n                if (m === 'GET') {\n                    const envRow = await findOne(ENV, { id });\n                    if (!envRow) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n                    const credRow = await findOne(CRED, { environment_id: id, status: 'active' });\n                    // Scope membership lookup to the calling user when possible so the\n                    // returned `membership.role` reflects the caller, not some other\n                    // arbitrary member of the project.\n                    const callerUserId = await this.resolveCallerUserId(_context);\n                    const membership = callerUserId\n                        ? await findOne(MEM, { environment_id: id, user_id: callerUserId })\n                        : await findOne(MEM, { environment_id: id });\n                    // Omit the ciphertext from responses — metadata only.\n                    const credMeta = credRow\n                        ? {\n                              id: credRow.id,\n                              status: credRow.status,\n                              authorization: credRow.authorization,\n                              activatedAt: credRow.created_at,\n                              expiresAt: credRow.expires_at,\n                          }\n                        : undefined;\n                    // Expose a `database` block so Studio can show physical DB\n                    // addressing directly (mirrors the legacy sys_environment_database shape).\n                    const project = cleanProjectRow(envRow);\n                    const database = project.database_url\n                        ? {\n                              driver: project.database_driver,\n                              database_name: `env-${project.id}`,\n                              database_url: project.database_url,\n                              storage_limit_mb: project.storage_limit_mb,\n                              provisioned_at: project.provisioned_at,\n                          }\n                        : undefined;\n                    return {\n                        handled: true,\n                        response: this.success({ project, database, credential: credMeta, membership }),\n                    };\n                }\n\n                if (m === 'PATCH') {\n                    const patch: Record<string, unknown> = {};\n                    if (body?.display_name !== undefined) patch.display_name = body.display_name;\n                    if (body?.plan !== undefined) patch.plan = body.plan;\n                    if (body?.status !== undefined) patch.status = body.status;\n                    if (body?.is_default !== undefined) patch.is_default = body.is_default;\n                    if (body?.visibility !== undefined) {\n                        let v = String(body.visibility);\n                        // Legacy: accept `unlisted` but persist as `private`.\n                        if (v === 'unlisted') v = 'private';\n                        if (!['private', 'public'].includes(v)) {\n                            return { handled: true, response: this.error(`Invalid visibility '${v}' (expected private | public)`, 400) };\n                        }\n                        patch.visibility = v;\n                    }\n                    if (body?.metadata !== undefined) patch.metadata = JSON.stringify(body.metadata);\n                    patch.updated_at = new Date().toISOString();\n                    await ql.update(ENV, patch, { where: { id } } as any);\n                    const envRow = await findOne(ENV, { id });\n                    if (!envRow) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n                    return { handled: true, response: this.success({ project: cleanProjectRow(envRow) }) };\n                }\n\n                if (m === 'DELETE') {\n                    const force = query?.force === '1' || query?.force === 'true' || body?.force === true;\n                    const result = await this.deleteProjectCascade(id, { ql, findOne, getRealAdapter, force });\n                    if (!result.ok) {\n                        return { handled: true, response: this.error(result.error ?? 'Delete failed', result.status ?? 500) };\n                    }\n                    return { handled: true, response: this.success({ deleted: true, environmentId: id, warnings: result.warnings }) };\n                }\n            }\n\n            // ----- /cloud/organizations/:id (DELETE only — cascades projects) -----\n            if (parts.length === 2 && parts[0] === 'organizations' && m === 'DELETE') {\n                const orgId = decodeURIComponent(parts[1]);\n                // Find every project owned by the organization and tear it down.\n                let projectRows: any[] = [];\n                try {\n                    let rows = await ql.find(ENV, { where: { organization_id: orgId } } as any);\n                    if (rows && (rows as any).value) rows = (rows as any).value;\n                    projectRows = Array.isArray(rows) ? rows : [];\n                } catch {\n                    projectRows = [];\n                }\n                const warnings: string[] = [];\n                let deletedProjects = 0;\n                for (const row of projectRows) {\n                    const pid = row?.id;\n                    if (!pid) continue;\n                    try {\n                        const r = await this.deleteProjectCascade(pid, { ql, findOne, getRealAdapter, force: true });\n                        if (r.ok) deletedProjects++;\n                        if (r.warnings?.length) warnings.push(...r.warnings);\n                        if (!r.ok && r.error) warnings.push(`Project ${pid}: ${r.error}`);\n                    } catch (err) {\n                        warnings.push(\n                            `Failed to delete project ${pid}: ${err instanceof Error ? err.message : String(err)}`,\n                        );\n                    }\n                }\n\n                // Now drop the organization itself. Prefer better-auth's\n                // organization plugin (which also cascades members /\n                // invitations / teams). Fall back to a direct sys_organization\n                // delete if the plugin isn't loaded.\n                let orgDeleted = false;\n                try {\n                    const authService: any = await this.getService(CoreServiceName.enum.auth);\n                    const fn = authService?.api?.deleteOrganization;\n                    if (typeof fn === 'function') {\n                        await fn.call(authService.api, {\n                            body: { organizationId: orgId },\n                            headers: _context?.request?.headers,\n                        });\n                        orgDeleted = true;\n                    }\n                } catch (err) {\n                    warnings.push(\n                        `auth.deleteOrganization failed: ${err instanceof Error ? err.message : String(err)}`,\n                    );\n                }\n                if (!orgDeleted) {\n                    try {\n                        await ql.delete('sys_organization', { where: { id: orgId } } as any);\n                        orgDeleted = true;\n                    } catch (err) {\n                        warnings.push(\n                            `Failed to delete sys_organization row: ${err instanceof Error ? err.message : String(err)}`,\n                        );\n                    }\n                }\n\n                return {\n                    handled: true,\n                    response: this.success({\n                        deleted: orgDeleted,\n                        organizationId: orgId,\n                        deletedProjects,\n                        warnings,\n                    }),\n                };\n            }\n\n            // ----- /cloud/environments/:id/hostname -----\n            if (parts.length === 3 && parts[0] === 'projects' && parts[2] === 'hostname' && (m === 'POST' || m === 'PUT')) {\n                const id = decodeURIComponent(parts[1]);\n                const hostname = body?.hostname;\n                if (!hostname || typeof hostname !== 'string') {\n                    return { handled: true, response: this.error('hostname is required', 400) };\n                }\n                const normalized = hostname.trim().toLowerCase();\n                if (!/^[a-z0-9]([a-z0-9\\-\\.]*[a-z0-9])?$/.test(normalized)) {\n                    return { handled: true, response: this.error('Invalid hostname format', 400) };\n                }\n                const envRow = await findOne(ENV, { id });\n                if (!envRow) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n                // Enforce uniqueness — reject if another project already owns this hostname.\n                let existing: any;\n                try {\n                    const rows = await ql.find(ENV, { where: { hostname: normalized } } as any);\n                    const arr = Array.isArray(rows) ? rows : ((rows as any)?.value ?? []);\n                    existing = arr.find((r: any) => r.id !== id);\n                } catch { /* table may be empty */ }\n                if (existing) {\n                    return {\n                        handled: true,\n                        response: this.error(\n                            `Hostname '${normalized}' is already in use by another project.`,\n                            409,\n                            { code: 'HOSTNAME_TAKEN', hostname: normalized },\n                        ),\n                    };\n                }\n                const updatedAt = new Date().toISOString();\n                await ql.update(ENV, { hostname: normalized, updated_at: updatedAt }, { where: { id } } as any);\n                // Invalidate the hostname cache entry so the routing layer picks up the new value.\n                if (this.envRegistry?.invalidate) {\n                    try { await this.envRegistry.invalidate(id); } catch { /* best-effort */ }\n                }\n                const updated = cleanProjectRow(await findOne(ENV, { id }));\n                return { handled: true, response: this.success({ project: updated }) };\n            }\n\n            // ----- /cloud/environments/:id/retry -----\n            if (parts.length === 3 && parts[0] === 'projects' && parts[2] === 'retry' && m === 'POST') {\n                const id = decodeURIComponent(parts[1]);\n                const envRow = await findOne(ENV, { id });\n                if (!envRow) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n                if (envRow.status !== 'failed' && envRow.status !== 'provisioning') {\n                    return {\n                        handled: true,\n                        response: this.error(\n                            `Project '${id}' is '${envRow.status}'; only failed or provisioning projects can be retried.`,\n                            409,\n                        ),\n                    };\n                }\n\n                const driverName = envRow.database_driver;\n                const resolved = resolveDriver(driverName);\n                if (!resolved) {\n                    return {\n                        handled: true,\n                        response: this.error(\n                            `Driver '${driverName}' is no longer registered; retry aborted.`,\n                            503,\n                        ),\n                    };\n                }\n\n                // Parse metadata so we can clear provisioningError on success\n                // (or rewrite it on another failure).\n                let metadata: Record<string, unknown> = {};\n                if (envRow.metadata) {\n                    if (typeof envRow.metadata === 'string') {\n                        try { metadata = JSON.parse(envRow.metadata); } catch { metadata = {}; }\n                    } else if (typeof envRow.metadata === 'object') {\n                        metadata = { ...(envRow.metadata as Record<string, unknown>) };\n                    }\n                }\n                delete (metadata as any).provisioningError;\n\n                // Flip back to `provisioning` while we retry — Studio renders\n                // the spinner instead of the red error card.\n                const retryStartedAt = new Date().toISOString();\n                await ql.update(\n                    ENV,\n                    {\n                        status: 'provisioning',\n                        metadata: JSON.stringify(metadata),\n                        updated_at: retryStartedAt,\n                    },\n                    { where: { id } } as any,\n                );\n\n                // Same dev-only knobs as POST /projects: if the caller\n                // originally asked to simulate a failure they must clear the\n                // flag in metadata before retry — otherwise retry fails again.\n                const simulateRetryFailure = Boolean((metadata as any).__simulateFailure);\n                const simulateRetryDelay = Number((metadata as any).__simulateDelayMs ?? 1500);\n\n                const runRetry = async (): Promise<void> => {\n                    try {\n                        if (simulateRetryDelay > 0) {\n                            await new Promise((r) => setTimeout(r, simulateRetryDelay));\n                        }\n                        if (simulateRetryFailure) {\n                            throw new Error('Simulated provisioning failure (metadata.__simulateFailure=true)');\n                        }\n                        let databaseUrl: string;\n                        let retrySecret = `mock-token-${id}`;\n                        try {\n                            const adapter = await getRealAdapter(resolved.name);\n                            if (adapter) {\n                                const result = await adapter.createDatabase({\n                                    environmentId: id,\n                                    databaseName: `p-${id.replace(/-/g, \"\").slice(0, 24)}`,\n                                    region: 'us-east-1',\n                                    storageLimitMb: envRow.storage_limit_mb ?? 1024,\n                                });\n                                databaseUrl = result.databaseUrl;\n                                if (result.plaintextSecret) retrySecret = result.plaintextSecret;\n                            } else {\n                                databaseUrl = buildDatabaseUrl(resolved.name, id);\n                            }\n                        } catch (adapterErr) {\n                            throw adapterErr instanceof Error\n                                ? adapterErr\n                                : new Error(String(adapterErr));\n                        }\n                        const nowIso = new Date().toISOString();\n                        await ql.update(\n                            ENV,\n                            {\n                                status: 'active',\n                                database_url: databaseUrl,\n                                database_driver: resolved.name,\n                                provisioned_at: nowIso,\n                                updated_at: nowIso,\n                            },\n                            { where: { id } } as any,\n                        );\n                        const existingCred = await findOne(CRED, { environment_id: id, status: 'active' });\n                        if (!existingCred) {\n                            await ql.insert(CRED, {\n                                id: randomUUID(),\n                                environment_id: id,\n                                secret_ciphertext: retrySecret,\n                                encryption_key_id: 'noop',\n                                authorization: 'full_access',\n                                status: 'active',\n                                created_at: nowIso,\n                                updated_at: nowIso,\n                            });\n                        }\n                    } catch (err) {\n                        const message = err instanceof Error ? err.message : String(err);\n                        const failedAt = new Date().toISOString();\n                        await ql.update(\n                            ENV,\n                            {\n                                status: 'failed',\n                                metadata: JSON.stringify({\n                                    ...metadata,\n                                    provisioningError: { message, failedAt },\n                                }),\n                                updated_at: failedAt,\n                            },\n                            { where: { id } } as any,\n                        );\n                    }\n                };\n                void runRetry();\n\n                const envAfter = cleanProjectRow(await findOne(ENV, { id }));\n                const retryRes = this.success({ project: envAfter });\n                retryRes.status = 202;\n                return { handled: true, response: retryRes };\n            }\n\n            // ----- /cloud/environments/:id/activate -----\n            if (parts.length === 3 && parts[0] === 'projects' && parts[2] === 'activate' && m === 'POST') {\n                const id = decodeURIComponent(parts[1]);\n                const envRow = await findOne(ENV, { id });\n                if (!envRow) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n                // TODO: persist active_environment_id on the session once session service is wired.\n                return { handled: true, response: this.success({ project: cleanProjectRow(envRow), sessionUpdated: false }) };\n            }\n\n            // ----- /cloud/environments/:id/credentials/rotate -----\n            if (parts.length === 4 && parts[0] === 'projects' && parts[2] === 'credentials' && parts[3] === 'rotate' && m === 'POST') {\n                const id = decodeURIComponent(parts[1]);\n                const plaintext = body?.plaintext;\n                if (!plaintext || typeof plaintext !== 'string') {\n                    return { handled: true, response: this.error('plaintext is required', 400) };\n                }\n                const envRow = await findOne(ENV, { id });\n                if (!envRow) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n\n                const nowIso = new Date().toISOString();\n                // Revoke existing active credentials\n                let existing = await ql.find(CRED, { where: { environment_id: id, status: 'active' } } as any);\n                if (existing && (existing as any).value) existing = (existing as any).value;\n                for (const row of (Array.isArray(existing) ? existing : [])) {\n                    await ql.update(CRED, {\n                        status: 'revoked',\n                        revoked_at: nowIso,\n                        updated_at: nowIso,\n                    }, { where: { id: row.id } } as any);\n                }\n\n                const credentialId = randomUUID();\n                await ql.insert(CRED, {\n                    id: credentialId,\n                    environment_id: id,\n                    secret_ciphertext: plaintext,\n                    encryption_key_id: 'noop',\n                    authorization: 'full_access',\n                    status: 'active',\n                    created_at: nowIso,\n                    updated_at: nowIso,\n                });\n\n                const credential = await findOne(CRED, { id: credentialId });\n                const credMeta = credential\n                    ? {\n                          id: credential.id,\n                          status: credential.status,\n                          authorization: credential.authorization,\n                          activatedAt: credential.created_at,\n                      }\n                    : undefined;\n                return { handled: true, response: this.success({ credential: credMeta }) };\n            }\n\n            // ----- /cloud/environments/:id/members -----\n            if (parts.length === 3 && parts[0] === 'projects' && parts[2] === 'members' && m === 'GET') {\n                const id = decodeURIComponent(parts[1]);\n                let rows = await ql.find(MEM, { where: { environment_id: id } } as any);\n                if (rows && (rows as any).value) rows = (rows as any).value;\n                const members = Array.isArray(rows) ? rows : [];\n                // Enrich with user display info (best-effort).\n                const userIds = Array.from(new Set(members.map((mem: any) => mem.user_id).filter(Boolean)));\n                const userMap = new Map<string, any>();\n                for (const uid of userIds) {\n                    let row: any = null;\n                    for (const tableName of ['sys_user', 'user']) {\n                        try {\n                            const u = await ql.findOne(tableName as any, { where: { id: uid } } as any);\n                            row = (u as any)?.value ?? u;\n                            if (row) break;\n                        } catch { /* try next table */ }\n                    }\n                    if (row) userMap.set(String(uid), {\n                        id: row.id,\n                        name: row.name ?? row.display_name,\n                        email: row.email,\n                        image: row.image ?? row.avatar_url,\n                    });\n                }\n                const enriched = members.map((mem: any) => ({\n                    ...mem,\n                    user: userMap.get(String(mem.user_id)) ?? undefined,\n                }));\n                return { handled: true, response: this.success({ members: enriched }) };\n            }\n\n            // ----- POST /cloud/environments/:id/members  (invite) ---------------\n            //   body: { email | user_id, role? = 'member' }\n            // Only owner / admin may invite. Idempotent: re-inviting an\n            // existing member returns 200 with the existing row instead of\n            // creating a duplicate.\n            if (parts.length === 3 && parts[0] === 'projects' && parts[2] === 'members' && m === 'POST') {\n                const id = decodeURIComponent(parts[1]);\n                const project = await findOne(ENV, { id });\n                if (!project) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n\n                const callerId = await this.resolveCallerUserId(_context);\n                if (!callerId) return { handled: true, response: this.error('Authentication required', 401) };\n                const callerMem = await findOne(MEM, { environment_id: id, user_id: callerId });\n                if (!callerMem || !['owner', 'admin'].includes(String(callerMem.role))) {\n                    return { handled: true, response: this.error('Forbidden — owner or admin required', 403) };\n                }\n\n                const email = typeof body?.email === 'string' ? String(body.email).trim().toLowerCase() : null;\n                let inviteUserId = typeof body?.user_id === 'string' ? String(body.user_id).trim() : null;\n                let role = String(body?.role ?? 'member').trim().toLowerCase();\n                if (!['owner', 'admin', 'member', 'viewer'].includes(role)) {\n                    return { handled: true, response: this.error(`Invalid role '${role}' (expected owner | admin | member | viewer)`, 400) };\n                }\n                if (!email && !inviteUserId) {\n                    return { handled: true, response: this.error('email or user_id is required', 400) };\n                }\n                // Resolve email → user_id (best-effort across schema variants).\n                if (!inviteUserId && email) {\n                    let row: any = null;\n                    for (const tableName of ['sys_user', 'user']) {\n                        try {\n                            const u = await ql.findOne(tableName as any, { where: { email } } as any);\n                            row = (u as any)?.value ?? u;\n                            if (row) break;\n                        } catch { /* try next */ }\n                    }\n                    if (!row?.id) {\n                        return { handled: true, response: this.error(`No user found with email '${email}'`, 404) };\n                    }\n                    inviteUserId = String(row.id);\n                }\n\n                const existing = await findOne(MEM, { environment_id: id, user_id: inviteUserId });\n                if (existing) {\n                    return { handled: true, response: this.success({ member: existing, alreadyMember: true }) };\n                }\n\n                try {\n                    const memberId = randomUUID();\n                    await ql.insert(MEM, {\n                        id: memberId,\n                        environment_id: id,\n                        user_id: inviteUserId,\n                        role,\n                        invited_by: callerId,\n                        organization_id: (project as any).organization_id ?? null,\n                    } as any);\n                    const created = await findOne(MEM, { id: memberId });\n                    return { handled: true, response: this.success({ member: created, alreadyMember: false }) };\n                } catch (e: any) {\n                    return { handled: true, response: this.error(e?.message ?? 'Failed to add member', 500) };\n                }\n            }\n\n            // ----- PATCH /cloud/environments/:id/members/:memberId (update role) ----\n            //   body: { role }\n            if (parts.length === 4 && parts[0] === 'projects' && parts[2] === 'members' && m === 'PATCH') {\n                const id = decodeURIComponent(parts[1]);\n                const memberId = decodeURIComponent(parts[3]);\n                const project = await findOne(ENV, { id });\n                if (!project) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n\n                const callerId = await this.resolveCallerUserId(_context);\n                if (!callerId) return { handled: true, response: this.error('Authentication required', 401) };\n                const callerMem = await findOne(MEM, { environment_id: id, user_id: callerId });\n                if (!callerMem || !['owner', 'admin'].includes(String(callerMem.role))) {\n                    return { handled: true, response: this.error('Forbidden — owner or admin required', 403) };\n                }\n\n                const target = await findOne(MEM, { id: memberId, environment_id: id });\n                if (!target) return { handled: true, response: this.error(`Member '${memberId}' not found`, 404) };\n\n                const newRole = String(body?.role ?? '').trim().toLowerCase();\n                if (!['owner', 'admin', 'member', 'viewer'].includes(newRole)) {\n                    return { handled: true, response: this.error(`Invalid role '${newRole}'`, 400) };\n                }\n\n                // Demoting the last owner is forbidden.\n                if (target.role === 'owner' && newRole !== 'owner') {\n                    let owners = await ql.find(MEM, { where: { environment_id: id, role: 'owner' } } as any);\n                    if (owners && (owners as any).value) owners = (owners as any).value;\n                    const ownerCount = Array.isArray(owners) ? owners.length : 0;\n                    if (ownerCount <= 1) {\n                        return { handled: true, response: this.error('Cannot demote the last owner', 409) };\n                    }\n                }\n\n                try {\n                    await ql.update(MEM, { role: newRole, updated_at: new Date().toISOString() } as any, { where: { id: memberId } } as any);\n                    const updated = await findOne(MEM, { id: memberId });\n                    return { handled: true, response: this.success({ member: updated }) };\n                } catch (e: any) {\n                    return { handled: true, response: this.error(e?.message ?? 'Failed to update role', 500) };\n                }\n            }\n\n            // ----- DELETE /cloud/environments/:id/members/:memberId ----------------\n            // Owner / admin may remove anyone. Anyone may remove themselves\n            // unless they are the last owner.\n            if (parts.length === 4 && parts[0] === 'projects' && parts[2] === 'members' && m === 'DELETE') {\n                const id = decodeURIComponent(parts[1]);\n                const memberId = decodeURIComponent(parts[3]);\n                const project = await findOne(ENV, { id });\n                if (!project) return { handled: true, response: this.error(`Project '${id}' not found`, 404) };\n\n                const callerId = await this.resolveCallerUserId(_context);\n                if (!callerId) return { handled: true, response: this.error('Authentication required', 401) };\n\n                const target = await findOne(MEM, { id: memberId, environment_id: id });\n                if (!target) return { handled: true, response: this.error(`Member '${memberId}' not found`, 404) };\n\n                const callerMem = await findOne(MEM, { environment_id: id, user_id: callerId });\n                const isSelf = String(target.user_id) === String(callerId);\n                const isPrivileged = callerMem && ['owner', 'admin'].includes(String(callerMem.role));\n                if (!isSelf && !isPrivileged) {\n                    return { handled: true, response: this.error('Forbidden — owner or admin required', 403) };\n                }\n\n                if (target.role === 'owner') {\n                    let owners = await ql.find(MEM, { where: { environment_id: id, role: 'owner' } } as any);\n                    if (owners && (owners as any).value) owners = (owners as any).value;\n                    const ownerCount = Array.isArray(owners) ? owners.length : 0;\n                    if (ownerCount <= 1) {\n                        return { handled: true, response: this.error('Cannot remove the last owner', 409) };\n                    }\n                }\n\n                try {\n                    await ql.delete(MEM, { where: { id: memberId } } as any);\n                    return { handled: true, response: this.success({ removed: true, memberId }) };\n                } catch (e: any) {\n                    return { handled: true, response: this.error(e?.message ?? 'Failed to remove member', 500) };\n                }\n            }\n\n            // ----- /cloud/environments/:envId/packages -----\n            // GET  /cloud/environments/:envId/packages\n            if (parts.length === 3 && parts[0] === 'projects' && parts[2] === 'packages' && m === 'GET') {\n                const envId = decodeURIComponent(parts[1]);\n                let rows = await ql.find(PKG_INSTALL, { where: { environment_id: envId } } as any);\n                if (rows && (rows as any).value) rows = (rows as any).value;\n                const installs = Array.isArray(rows) ? rows : [];\n\n                // Denormalize: translate package_id (UUID) → manifest_id (string)\n                // and package_version_id (UUID) → version string. Studio joins\n                // these against the in-memory registry which uses manifest ids.\n                const packages = await Promise.all(\n                    installs.map(async (r: any) => {\n                        let manifestId: string | null = null;\n                        let versionStr: string | null = null;\n                        try {\n                            if (r.package_id) {\n                                const pkg = await ql.findOne(PKG, { where: { id: r.package_id } } as any) as any;\n                                manifestId = pkg?.manifest_id ?? null;\n                            }\n                            if (r.package_version_id) {\n                                const ver = await ql.findOne(PKG_VERSION, { where: { id: r.package_version_id } } as any) as any;\n                                versionStr = ver?.version ?? null;\n                            }\n                        } catch {\n                            // best-effort enrichment\n                        }\n                        return {\n                            ...r,\n                            // Surface user-facing identifiers expected by client SDK\n                            packageId: manifestId,\n                            package_id: manifestId ?? r.package_id,\n                            version: versionStr ?? r.version ?? null,\n                        };\n                    }),\n                );\n                return { handled: true, response: this.success({ packages, total: packages.length }) };\n            }\n\n            // POST /cloud/environments/:envId/packages\n            if (parts.length === 3 && parts[0] === 'projects' && parts[2] === 'packages' && m === 'POST') {\n                const envId = decodeURIComponent(parts[1]);\n                const { packageId, version, settings, enableOnInstall } = body ?? {};\n                if (!packageId) return { handled: true, response: this.error('packageId is required', 400) };\n\n                // Resolve manifest from the host kernel's package registry\n                const qlSvc = await this.getObjectQLService();\n                const pkgRegistry = (qlSvc as any)?.registry;\n                const allPkgs = pkgRegistry?.getAllPackages?.() ?? [];\n                const manifestEntry = allPkgs.find((p: any) => (p?.manifest?.id ?? p?.id) === packageId);\n                const manifest = manifestEntry?.manifest ?? manifestEntry;\n                if (!manifest) {\n                    return { handled: true, response: this.error(`Package '${packageId}' is not registered on this server`, 404) };\n                }\n\n                // Prevent installing cloud/system-scope packages per-project\n                const CLOUD_SCOPES = new Set(['cloud', 'system', 'platform']);\n                if (CLOUD_SCOPES.has(manifest?.scope)) {\n                    return { handled: true, response: this.error(`Package '${packageId}' has scope=${manifest.scope} and cannot be installed per-project`, 403) };\n                }\n\n                // Look up project to get organization_id (owner) and resolve session user\n                const projectRow = await findOne(ENV, { id: envId }) as any;\n                if (!projectRow) {\n                    return { handled: true, response: this.error(`Project '${envId}' not found`, 404) };\n                }\n                const ownerOrgId = projectRow.organization_id ?? 'system';\n\n                let userId = 'system';\n                try {\n                    const authService: any = await this.getService(CoreServiceName.enum.auth);\n                    const sessionData = await authService?.api?.getSession?.({\n                        headers: _context?.request?.headers,\n                    });\n                    userId = sessionData?.user?.id ?? sessionData?.session?.userId ?? 'system';\n                } catch {\n                    // Fall through with 'system'\n                }\n\n                const resolvedVersion = version ?? manifest?.version ?? '1.0.0';\n\n                // Reject duplicate installs for the same package in the same project\n                const dup = await ql.findOne(PKG_INSTALL, {\n                    where: { environment_id: envId, package_id: packageId },\n                } as any) as any;\n                if (dup?.id) {\n                    return { handled: true, response: this.error(`Package '${packageId}' is already installed in this project`, 409) };\n                }\n\n                // Upsert sys_package + sys_package_version, then create the install record\n                const sysPackageId = await ensureSysPackage(packageId, ownerOrgId, userId, manifest);\n                const sysPackageVersionId = await ensureSysPackageVersion(sysPackageId, resolvedVersion, userId, manifest);\n\n                const nowIso = new Date().toISOString();\n                const recordId = randomUUID();\n                await ql.insert(PKG_INSTALL, {\n                    id: recordId,\n                    environment_id: envId,\n                    package_id: sysPackageId,\n                    package_version_id: sysPackageVersionId,\n                    status: 'installed',\n                    enabled: enableOnInstall !== false,\n                    installed_at: nowIso,\n                    installed_by: userId,\n                    updated_at: nowIso,\n                    settings: settings ? JSON.stringify(settings) : null,\n                });\n                const record = await ql.findOne(PKG_INSTALL, { where: { id: recordId } } as any);\n                // Invalidate the project kernel cache so the freshly-installed\n                // package gets loaded on next request.\n                try { await this.kernelManager?.evict(envId); } catch { /* best effort */ }\n                return { handled: true, response: this.success({ package: record }) };\n            }\n\n            // ----- /cloud/environments/:envId/packages/:pkgId -----\n            // GET /cloud/environments/:envId/packages/:pkgId\n            if (parts.length === 4 && parts[0] === 'projects' && parts[2] === 'packages' && m === 'GET') {\n                const envId = decodeURIComponent(parts[1]);\n                const pkgId = decodeURIComponent(parts[3]);\n                const record = await ql.findOne(PKG_INSTALL, { where: { environment_id: envId, package_id: pkgId } } as any);\n                if (!record) return { handled: true, response: this.error(`Package '${pkgId}' is not installed in this project`, 404) };\n                return { handled: true, response: this.success({ package: record }) };\n            }\n\n            // DELETE /cloud/environments/:envId/packages/:pkgId\n            if (parts.length === 4 && parts[0] === 'projects' && parts[2] === 'packages' && m === 'DELETE') {\n                const envId = decodeURIComponent(parts[1]);\n                const pkgId = decodeURIComponent(parts[3]);\n                const record = await findInstallByManifestId(envId, pkgId) as any;\n                if (!record) return { handled: true, response: this.error(`Package '${pkgId}' is not installed in this project`, 404) };\n                // Re-derive scope from the in-memory registry manifest, since\n                // sys_package_installation no longer carries `scope` directly.\n                const allPkgs0 = this.kernel.packages?.getAll?.() ?? [];\n                const m0 = allPkgs0.find((p: any) => (p.manifest?.id ?? p.id) === pkgId)?.manifest;\n                if (m0?.scope && ['cloud', 'system', 'platform'].includes(m0.scope)) {\n                    return { handled: true, response: this.error(`Package '${pkgId}' with scope=${m0.scope} cannot be uninstalled`, 403) };\n                }\n                await ql.delete(PKG_INSTALL, { where: { id: record.id } } as any);\n                try { await this.kernelManager?.evict(envId); } catch { /* best effort */ }\n                return { handled: true, response: this.success({ id: record.id, success: true }) };\n            }\n\n            // PATCH /cloud/environments/:envId/packages/:pkgId/enable\n            if (parts.length === 5 && parts[0] === 'projects' && parts[2] === 'packages' && parts[4] === 'enable' && m === 'PATCH') {\n                const envId = decodeURIComponent(parts[1]);\n                const pkgId = decodeURIComponent(parts[3]);\n                const record = await findInstallByManifestId(envId, pkgId) as any;\n                if (!record) return { handled: true, response: this.error(`Package '${pkgId}' is not installed in this project`, 404) };\n                const nowIso = new Date().toISOString();\n                await ql.update(PKG_INSTALL, { enabled: true, status: 'installed', updated_at: nowIso }, { where: { id: record.id } } as any);\n                const updated = await ql.findOne(PKG_INSTALL, { where: { id: record.id } } as any);\n                try { await this.kernelManager?.evict(envId); } catch { /* best effort */ }\n                return { handled: true, response: this.success({ package: updated }) };\n            }\n\n            // PATCH /cloud/environments/:envId/packages/:pkgId/disable\n            if (parts.length === 5 && parts[0] === 'projects' && parts[2] === 'packages' && parts[4] === 'disable' && m === 'PATCH') {\n                const envId = decodeURIComponent(parts[1]);\n                const pkgId = decodeURIComponent(parts[3]);\n                const record = await findInstallByManifestId(envId, pkgId) as any;\n                if (!record) return { handled: true, response: this.error(`Package '${pkgId}' is not installed in this project`, 404) };\n                const allPkgs1 = this.kernel.packages?.getAll?.() ?? [];\n                const m1 = allPkgs1.find((p: any) => (p.manifest?.id ?? p.id) === pkgId)?.manifest;\n                if (m1?.scope && ['cloud', 'system', 'platform'].includes(m1.scope)) {\n                    return { handled: true, response: this.error(`Package '${pkgId}' with scope=${m1.scope} cannot be disabled`, 403) };\n                }\n                const nowIso = new Date().toISOString();\n                await ql.update(PKG_INSTALL, { enabled: false, status: 'disabled', updated_at: nowIso }, { where: { id: record.id } } as any);\n                const updated = await ql.findOne(PKG_INSTALL, { where: { id: record.id } } as any);\n                try { await this.kernelManager?.evict(envId); } catch { /* best effort */ }\n                return { handled: true, response: this.success({ package: updated }) };\n            }\n\n            // POST /cloud/environments/:envId/packages/:pkgId/upgrade\n            if (parts.length === 5 && parts[0] === 'projects' && parts[2] === 'packages' && parts[4] === 'upgrade' && m === 'POST') {\n                const envId = decodeURIComponent(parts[1]);\n                const pkgId = decodeURIComponent(parts[3]);\n                const record = await findInstallByManifestId(envId, pkgId) as any;\n                if (!record) return { handled: true, response: this.error(`Package '${pkgId}' is not installed in this project`, 404) };\n                const { targetVersion } = body ?? {};\n                const allPkgs2 = this.kernel.packages?.getAll?.() ?? [];\n                const manifest2 = allPkgs2.find((p: any) => (p.manifest?.id ?? p.id) === pkgId)?.manifest;\n                const currentVer = await ql.findOne(PKG_VERSION, { where: { id: record.package_version_id } } as any) as any;\n                const newVersion = targetVersion ?? manifest2?.version ?? currentVer?.version ?? '1.0.0';\n                if (newVersion === currentVer?.version) {\n                    return { handled: true, response: this.success({ package: record, message: 'Already at target version' }) };\n                }\n                // Resolve user for `created_by` audit columns\n                let userId = 'system';\n                try {\n                    const authService: any = await this.getService(CoreServiceName.enum.auth);\n                    const sessionData = await authService?.api?.getSession?.({\n                        headers: _context?.request?.headers,\n                    });\n                    userId = sessionData?.user?.id ?? 'system';\n                } catch { /* fall through */ }\n                const newVersionId = await ensureSysPackageVersion(record.package_id, newVersion, userId, manifest2);\n                const nowIso = new Date().toISOString();\n                await ql.update(PKG_INSTALL, {\n                    package_version_id: newVersionId,\n                    status: 'installed',\n                    updated_at: nowIso,\n                }, { where: { id: record.id } } as any);\n                const updated = await ql.findOne(PKG_INSTALL, { where: { id: record.id } } as any);\n                try { await this.kernelManager?.evict(envId); } catch { /* best effort */ }\n                return { handled: true, response: this.success({ package: updated }) };\n            }\n\n        } catch (e: any) {\n            return { handled: true, response: this.error(e.message, e.statusCode || 500) };\n        }\n\n        return { handled: false };\n    }\n\n    /**\n     * Cascade-delete a project: cred / member / package_installation rows,\n     * then the physical database via the provisioning adapter, then the\n     * `sys_environment` row itself. Used by both `DELETE /cloud/environments/:id`\n     * and the org-cascade in `DELETE /cloud/organizations/:id`.\n     *\n     * Idempotent and best-effort: missing rows / unreachable adapters\n     * become warnings rather than hard failures, so a half-provisioned\n     * project can still be cleaned out.\n     */\n    private async deleteProjectCascade(\n        environmentId: string,\n        deps: {\n            ql: any;\n            findOne: (obj: string, where: Record<string, unknown>) => Promise<any | undefined>;\n            getRealAdapter: (driver: string) => Promise<{\n                deleteDatabase?(params: { environmentId: string; databaseName: string; databaseUrl?: string }): Promise<void>;\n            } | undefined>;\n            force?: boolean;\n        },\n    ): Promise<{ ok: boolean; status?: number; error?: string; warnings: string[] }> {\n        const { ql, findOne, getRealAdapter, force } = deps;\n        const ENV = 'sys_environment';\n        const warnings: string[] = [];\n\n        const row = await findOne(ENV, { id: environmentId });\n        if (!row) {\n            return { ok: false, status: 404, error: `Project '${environmentId}' not found`, warnings };\n        }\n        if (row.is_system === true || row.is_system === 1) {\n            return { ok: false, status: 409, error: `Project '${environmentId}' is a system project and cannot be deleted`, warnings };\n        }\n        if ((row.is_default === true || row.is_default === 1) && !force) {\n            return {\n                ok: false,\n                status: 409,\n                error: `Project '${environmentId}' is the default project for its organization. Pass ?force=1 to delete it.`,\n                warnings,\n            };\n        }\n\n        // Cascade-delete dependent rows.\n        const cascade: Array<{ object: string; field: string }> = [\n            { object: 'sys_environment_credential', field: 'environment_id' },\n            { object: 'sys_environment_member', field: 'environment_id' },\n            { object: 'sys_package_installation', field: 'environment_id' },\n        ];\n        for (const { object, field } of cascade) {\n            try {\n                let rows = await ql.find(object, { where: { [field]: environmentId } } as any);\n                if (rows && rows.value) rows = rows.value;\n                if (Array.isArray(rows)) {\n                    for (const r of rows) {\n                        if (r?.id != null) {\n                            try {\n                                await ql.delete(object, { where: { id: r.id } } as any);\n                            } catch (innerErr) {\n                                warnings.push(\n                                    `Failed to delete ${object} ${r.id}: ${innerErr instanceof Error ? innerErr.message : String(innerErr)}`,\n                                );\n                            }\n                        }\n                    }\n                }\n            } catch (err) {\n                warnings.push(\n                    `Failed to enumerate ${object} for project ${environmentId}: ${err instanceof Error ? err.message : String(err)}`,\n                );\n            }\n        }\n\n        // Tear down the physical database (best-effort).\n        const driver = (row.database_driver as string | undefined) ?? 'memory';\n        const databaseUrl = row.database_url as string | undefined;\n        const databaseName = `p-${String(environmentId).replace(/-/g, '').slice(0, 24)}`;\n        try {\n            const adapter = await getRealAdapter(driver);\n            if (adapter?.deleteDatabase) {\n                await adapter.deleteDatabase({ environmentId, databaseName, databaseUrl });\n            } else {\n                warnings.push(`No adapter for driver '${driver}'; physical DB for project ${environmentId} not released.`);\n            }\n        } catch (err) {\n            warnings.push(\n                `Failed to delete physical database for project ${environmentId}: ${err instanceof Error ? err.message : String(err)}`,\n            );\n        }\n\n        // Drop the sys_environment row itself.\n        try {\n            await ql.delete(ENV, { where: { id: environmentId } } as any);\n        } catch (err) {\n            return {\n                ok: false,\n                status: 500,\n                error: `Failed to delete sys_environment row: ${err instanceof Error ? err.message : String(err)}`,\n                warnings,\n            };\n        }\n\n        // Invalidate routing caches so subsequent requests don't resolve to a dead env.\n        if (this.envRegistry?.invalidate) {\n            try { await this.envRegistry.invalidate(environmentId); } catch { /* best-effort */ }\n        }\n\n        return { ok: true, warnings };\n    }\n\n    /**\n     * Handles Storage requests\n     * path: sub-path after /storage/\n     */\n    async handleStorage(path: string, method: string, file: any, context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        const storageService = await this.getService(CoreServiceName.enum['file-storage']) || this.kernel.services?.['file-storage'];\n        if (!storageService) {\n             return { handled: true, response: this.error('File storage not configured', 501) };\n        }\n        \n        const m = method.toUpperCase();\n        const parts = path.replace(/^\\/+/, '').split('/');\n        \n        // POST /storage/upload\n        if (parts[0] === 'upload' && m === 'POST') {\n            if (!file) {\n                 return { handled: true, response: this.error('No file provided', 400) };\n            }\n            const result = await storageService.upload(file, { request: context.request });\n            return { handled: true, response: this.success(result) };\n        }\n        \n        // GET /storage/file/:id\n        if (parts[0] === 'file' && parts[1] && m === 'GET') {\n            const id = parts[1];\n            const result = await storageService.download(id, { request: context.request });\n            \n            // Result can be URL (redirect), Stream/Blob, or metadata\n            if (result.url && result.redirect) {\n                // Must be handled by adapter to do actual redirect\n                return { handled: true, result: { type: 'redirect', url: result.url } };\n            }\n            \n            if (result.stream) {\n                 // Must be handled by adapter to pipe stream\n                 return { \n                     handled: true, \n                     result: { \n                         type: 'stream', \n                         stream: result.stream, \n                         headers: {\n                             'Content-Type': result.mimeType || 'application/octet-stream',\n                             'Content-Length': result.size\n                         }\n                     } \n                 };\n            }\n            \n            return { handled: true, response: this.success(result) };\n        }\n        \n        return { handled: false };\n    }\n\n    /**\n     * Handles UI requests\n     * path: sub-path after /ui/\n     */\n    async handleUi(path: string, query: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        const parts = path.replace(/^\\/+/, '').split('/').filter(Boolean);\n        \n        // GET /ui/view/:object (with optional type param)\n        if (parts[0] === 'view' && parts[1]) {\n            const objectName = parts[1];\n            // Support both path param /view/obj/list AND query param /view/obj?type=list\n            const type = parts[2] || query?.type || 'list';\n\n            const protocol = await this.resolveService('protocol');\n            \n            if (protocol && typeof protocol.getUiView === 'function') {\n                try {\n                    const result = await protocol.getUiView({ object: objectName, type });\n                    return { handled: true, response: this.success(result) };\n                } catch (e: any) {\n                    return { handled: true, response: this.error(e.message, 500) };\n                }\n            } else {\n                 return { handled: true, response: this.error('Protocol service not available', 503) };\n            }\n        }\n\n        return { handled: false };\n    }\n\n    /**\n     * Handles Automation requests\n     * path: sub-path after /automation/\n     *\n     * Routes:\n     *   GET    /                     → listFlows\n     *   GET    /:name                → getFlow\n     *   POST   /                     → createFlow (registerFlow)\n     *   PUT    /:name                → updateFlow\n     *   DELETE /:name                → deleteFlow (unregisterFlow)\n     *   POST   /:name/trigger        → execute (legacy: trigger/:name also supported)\n     *   POST   /:name/toggle         → toggleFlow\n     *   GET    /:name/runs           → listRuns\n     *   GET    /:name/runs/:runId    → getRun\n     */\n    async handleAutomation(path: string, method: string, body: any, context: HttpProtocolContext, query?: any): Promise<HttpDispatcherResult> {\n        const automationService = await this.getService(CoreServiceName.enum.automation);\n        if (!automationService) return { handled: false };\n\n        const m = method.toUpperCase();\n        const parts = path.replace(/^\\/+/, '').split('/').filter(Boolean);\n\n        // Legacy: POST /automation/trigger/:name\n        if (parts[0] === 'trigger' && parts[1] && m === 'POST') {\n             const triggerName = parts[1];\n             if (typeof automationService.trigger === 'function') {\n                 const result = await automationService.trigger(triggerName, body, { request: context.request });\n                 return { handled: true, response: this.success(result) };\n             }\n             // Fallback to execute\n             if (typeof automationService.execute === 'function') {\n                 const result = await automationService.execute(triggerName, body);\n                 return { handled: true, response: this.success(result) };\n             }\n        }\n\n        // GET / → listFlows\n        if (parts.length === 0 && m === 'GET') {\n            if (typeof automationService.listFlows === 'function') {\n                const names = await automationService.listFlows();\n                return { handled: true, response: this.success({ flows: names, total: names.length, hasMore: false }) };\n            }\n        }\n\n        // POST / → createFlow\n        if (parts.length === 0 && m === 'POST') {\n            if (typeof automationService.registerFlow === 'function') {\n                automationService.registerFlow(body?.name, body);\n                return { handled: true, response: this.success(body) };\n            }\n        }\n\n        // Routes with :name\n        if (parts.length >= 1) {\n            const name = parts[0];\n\n            // POST /:name/trigger → execute\n            if (parts[1] === 'trigger' && m === 'POST') {\n                if (typeof automationService.execute === 'function') {\n                    const ctxBody = body && typeof body === 'object' ? body : {};\n                    // Translate UI/SDK request shape `{recordId, objectName, params}`\n                    // into the canonical AutomationContext shape expected by the engine.\n                    // Key transformations:\n                    //  - `recordId` is exposed in `params.recordId` AND aliased to\n                    //    `<objectName>Id` (camelCase) so flow variables like `leadId`,\n                    //    `caseId`, `opportunityId` resolve from a single REST contract.\n                    //  - `objectName` is mapped to the canonical `object` field.\n                    //  - The user identity from the auth context (if any) is forwarded\n                    //    as `userId` so node executors / template interpolation can\n                    //    expand `{$User.Id}`.\n                    const recordId = ctxBody.recordId;\n                    const objectName = ctxBody.objectName ?? ctxBody.object;\n                    const baseParams = (ctxBody.params && typeof ctxBody.params === 'object') ? { ...ctxBody.params } : {};\n                    // Back-compat: when callers POST a flat body (no `params` wrapper),\n                    // forward unknown top-level keys as flow params so the original\n                    // `{ foo: 'bar' }` payload is not silently dropped.\n                    if (!ctxBody.params) {\n                        const reserved = new Set(['recordId', 'objectName', 'object', 'event', 'params']);\n                        for (const [k, v] of Object.entries(ctxBody)) {\n                            if (reserved.has(k)) continue;\n                            if (baseParams[k] === undefined) baseParams[k] = v;\n                        }\n                    }\n                    if (recordId !== undefined && baseParams.recordId === undefined) {\n                        baseParams.recordId = recordId;\n                    }\n                    if (recordId !== undefined && objectName) {\n                        const alias = `${String(objectName).replace(/_([a-z])/g, (_: string, c: string) => c.toUpperCase())}Id`;\n                        if (baseParams[alias] === undefined) baseParams[alias] = recordId;\n                    }\n                    const automationContext: any = {\n                        params: baseParams,\n                        object: objectName,\n                        event: ctxBody.event ?? 'manual',\n                    };\n                    const userIdFromAuth = (context as any)?.user?.id ?? (context as any)?.userId;\n                    if (userIdFromAuth) automationContext.userId = userIdFromAuth;\n                    const result = await automationService.execute(name, automationContext);\n                    return { handled: true, response: this.success(result) };\n                }\n            }\n\n            // POST /:name/toggle → toggleFlow\n            if (parts[1] === 'toggle' && m === 'POST') {\n                if (typeof automationService.toggleFlow === 'function') {\n                    await automationService.toggleFlow(name, body?.enabled ?? true);\n                    return { handled: true, response: this.success({ name, enabled: body?.enabled ?? true }) };\n                }\n            }\n\n            // GET /:name/runs/:runId → getRun\n            if (parts[1] === 'runs' && parts[2] && m === 'GET') {\n                if (typeof automationService.getRun === 'function') {\n                    const run = await automationService.getRun(parts[2]);\n                    if (!run) return { handled: true, response: this.error('Execution not found', 404) };\n                    return { handled: true, response: this.success(run) };\n                }\n            }\n\n            // GET /:name/runs → listRuns\n            if (parts[1] === 'runs' && !parts[2] && m === 'GET') {\n                if (typeof automationService.listRuns === 'function') {\n                    const options = query ? { limit: query.limit ? Number(query.limit) : undefined, cursor: query.cursor } : undefined;\n                    const runs = await automationService.listRuns(name, options);\n                    return { handled: true, response: this.success({ runs, hasMore: false }) };\n                }\n            }\n\n            // GET /:name → getFlow (no sub-path)\n            if (parts.length === 1 && m === 'GET') {\n                if (typeof automationService.getFlow === 'function') {\n                    const flow = await automationService.getFlow(name);\n                    if (!flow) return { handled: true, response: this.error('Flow not found', 404) };\n                    return { handled: true, response: this.success(flow) };\n                }\n            }\n\n            // PUT /:name → updateFlow\n            if (parts.length === 1 && m === 'PUT') {\n                if (typeof automationService.registerFlow === 'function') {\n                    automationService.registerFlow(name, body?.definition ?? body);\n                    return { handled: true, response: this.success(body?.definition ?? body) };\n                }\n            }\n\n            // DELETE /:name → deleteFlow\n            if (parts.length === 1 && m === 'DELETE') {\n                if (typeof automationService.unregisterFlow === 'function') {\n                    automationService.unregisterFlow(name);\n                    return { handled: true, response: this.success({ name, deleted: true }) };\n                }\n            }\n        }\n        \n        return { handled: false };\n    }\n\n    private getServicesMap(): Record<string, any> {\n        if (this.kernel.services instanceof Map) {\n            return Object.fromEntries(this.kernel.services);\n        }\n        return this.kernel.services || {};\n    }\n\n    private async getService(name: CoreServiceName) {\n        return this.resolveService(name);\n    }\n\n    /**\n     * Resolve any service by name, supporting async factories.\n     * Fallback chain: getServiceAsync(scopeId) → getServiceAsync → getService (sync) → context.getService → services map.\n     * Only returns when a non-null service is found; otherwise falls through to the next step.\n     *\n     * When `scopeId` is provided, tries the SCOPED factory on `defaultKernel` first (SharedProjectPlugin\n     * mode). Falls back to the current `kernel` for singleton / legacy services.\n     */\n    private async resolveService(name: string, scopeId?: string) {\n        // Prefer scoped lookup on defaultKernel when scopeId is given (shared-kernel / multi-environment mode)\n        if (scopeId && typeof this.defaultKernel.getServiceAsync === 'function') {\n            try {\n                const svc = await this.defaultKernel.getServiceAsync(name, scopeId);\n                if (svc != null) return svc;\n            } catch {\n                // Not a scoped service — fall through to singleton resolution\n            }\n        }\n        // Prefer async resolution to support factory-based services (e.g. auth, analytics, protocol)\n        if (typeof this.kernel.getServiceAsync === 'function') {\n            try {\n                const svc = await this.kernel.getServiceAsync(name);\n                if (svc != null) return svc;\n            } catch {\n                // Service not registered or async resolution failed — fall through\n            }\n        }\n        if (typeof this.kernel.getService === 'function') {\n            try {\n                const svc = await this.kernel.getService(name);\n                if (svc != null) return svc;\n            } catch {\n                // Service not registered or sync resolution threw \"is async\" — fall through\n            }\n        }\n        if (this.kernel?.context?.getService) {\n            try {\n                const svc = await this.kernel.context.getService(name);\n                if (svc != null) return svc;\n            } catch {\n                // Service not registered — fall through\n            }\n        }\n        const services = this.getServicesMap();\n        return services[name];\n    }\n\n    /**\n     * Get the ObjectQL service which provides access to SchemaRegistry.\n     * Tries multiple access patterns since kernel structure varies.\n     */\n    private async getObjectQLService(scopeId?: string): Promise<any> {\n        // 1. Try via resolveService (handles scoped, async factories, sync, context, and map)\n        try {\n            const svc = await this.resolveService('objectql', scopeId);\n            if (svc?.registry) return svc;\n        } catch { /* service not available */ }\n        return null;\n    }\n\n    /**\n     * Handle action invocation routes (`/actions/...`).\n     *\n     * Dispatches a named, server-registered action handler (registered via\n     * `engine.registerAction(objectName, actionName, handler)`) over HTTP.\n     * Three URL shapes are accepted to keep the client contract flexible:\n     *\n     *  - `POST /actions/:object/:action`              — record-scoped action\n     *  - `POST /actions/:object/:action/:recordId`    — record-scoped action with id in URL\n     *  - `POST /actions/global/:action`               — wildcard (\"*\") action\n     *\n     * Body shape: `{ recordId?: string, params?: Record<string, unknown> }`.\n     * The handler is invoked with an `ActionContext` of:\n     *   `{ record, user, engine, params }`\n     * where `engine` exposes the slimmed CRUD surface used by CRM handlers\n     * (`insert`, `update`, `delete`, `find`).\n     */\n    async handleActions(path: string, method: string, body: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        if (method.toUpperCase() !== 'POST') {\n            return { handled: true, response: this.error('Method not allowed', 405) };\n        }\n        const parts = path.replace(/^\\/+|\\/+$/g, '').split('/').filter(Boolean);\n        if (parts.length < 2) {\n            return { handled: true, response: this.error('Path must be /actions/:object/:action', 400) };\n        }\n        const objectName = parts[0];\n        const actionName = parts[1];\n        const recordIdFromPath = parts[2];\n\n        // Resolve project scope so the right project kernel's ObjectQL is\n        // used. For bare URLs the URL prefix already stripped any `/projects/:id`\n        // segment, so fall back to the single-environment default if unset.\n        if (!_context.environmentId) {\n            const def = this.resolveDefaultProject();\n            if (def?.environmentId) _context.environmentId = def.environmentId;\n        }\n\n        // Replicate the kernel swap that `dispatcher.handle()` does for\n        // data/meta/automation routes. Action routes are registered on the\n        // raw HTTP server and skip the `handle()` chain, so without this\n        // swap `getObjectQLService` would resolve the control-plane kernel\n        // (where the CRM bundle's actions are NOT registered).\n        let projectQl: any = null;\n        if (this.kernelManager && _context.environmentId && _context.environmentId !== 'platform') {\n            try {\n                const projectKernel: any = await this.kernelManager.getOrCreate(_context.environmentId);\n                if (projectKernel) {\n                    this.kernel = projectKernel;\n                    // Resolve the project kernel's own ObjectQL DIRECTLY so we\n                    // bypass the control-plane's scoped factory (which would\n                    // hand back a different instance with no registered\n                    // actions/hooks for this project's bundle).\n                    if (typeof projectKernel.getServiceAsync === 'function') {\n                        projectQl = await projectKernel.getServiceAsync('objectql').catch(() => null);\n                    }\n                }\n            } catch {\n                // fall back to defaultKernel — getObjectQLService will report\n                // \"Data engine not available\" if no engine is reachable.\n            }\n        }\n\n        const ql: any = projectQl ?? await this.getObjectQLService(_context?.environmentId);\n        if (!ql || typeof ql.executeAction !== 'function') {\n            return { handled: true, response: this.error('Data engine not available', 503) };\n        }\n\n        // Resolve the handler — fall back to wildcard '*' if the object-specific key is missing.\n        // Since engine.executeAction throws when the key is unknown, we probe via the internal\n        // map by attempting the call inside a try/catch and rotating to '*'.\n        const tryExecute = async (obj: string) => {\n            return ql.executeAction(obj, actionName, actionContext);\n        };\n\n        const reqBody = body && typeof body === 'object' ? body : {};\n        const recordId = recordIdFromPath ?? reqBody.recordId;\n        const reqParams = (reqBody.params && typeof reqBody.params === 'object') ? reqBody.params : {};\n\n        // Load the record (best-effort) so handlers can rely on `ctx.record`.\n        let record: Record<string, unknown> = {};\n        if (recordId && objectName !== 'global') {\n            try {\n                const got = await this.callData('get', { object: objectName, id: recordId }, _context.dataDriver, _context.environmentId, _context.executionContext);\n                if (got?.record) record = got.record;\n            } catch { /* record may not exist for new-record actions; pass empty */ }\n        }\n        if (record && (record as any).id == null && recordId) (record as any).id = recordId;\n\n        // Slim engine facade matching the ActionContext.engine shape used by CRM handlers.\n        const engineFacade = {\n            async insert(object: string, data: Record<string, unknown>): Promise<{ id: string }> {\n                const res = await ql.insert(object, data);\n                const id = (res && (res as any).id) ?? (data as any).id;\n                return { id };\n            },\n            async update(object: string, id: string, data: Record<string, unknown>): Promise<void> {\n                await ql.update(object, data, { where: { id } });\n            },\n            async delete(object: string, id: string): Promise<void> {\n                await ql.delete(object, { where: { id } });\n            },\n            async find(object: string, query: Record<string, unknown>): Promise<Array<Record<string, unknown>>> {\n                const opts = query && Object.keys(query).length ? { where: query } : undefined;\n                const rows = await ql.find(object, opts as any);\n                return Array.isArray(rows) ? rows : ((rows as any)?.value ?? []);\n            },\n        };\n\n        const userIdFromAuth = (_context as any)?.user?.id ?? (_context as any)?.userId ?? 'system';\n        const userFromAuth = (_context as any)?.user ?? { id: userIdFromAuth, name: userIdFromAuth };\n\n        const actionContext: any = {\n            record,\n            user: userFromAuth,\n            engine: engineFacade,\n            params: { ...reqParams, recordId, objectName },\n        };\n\n        try {\n            // Try object-specific first; on \"not found\" error, fall back to wildcard.\n            let result: any;\n            try {\n                result = await tryExecute(objectName);\n            } catch (err: any) {\n                const msg = String(err?.message ?? err ?? '');\n                if (/not found/i.test(msg) && objectName !== '*') {\n                    result = await tryExecute('*');\n                } else {\n                    throw err;\n                }\n            }\n            return { handled: true, response: this.success({ success: true, data: result }) };\n        } catch (err: any) {\n            const msg = err?.message ?? String(err);\n            return { handled: true, response: this.success({ success: false, error: msg }) };\n        }\n    }\n\n    /**\n     * Handle AI service routes (/ai/chat, /ai/models, /ai/conversations, etc.)\n     * Resolves the AI service and its built-in route handlers, then dispatches.\n     */\n    async handleAI(subPath: string, method: string, body: any, query: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        let aiService: any;\n        try {\n            aiService = await this.resolveService('ai');\n        } catch {\n            // AI service not registered\n        }\n\n        if (!aiService) {\n            return {\n                handled: true,\n                response: {\n                    status: 404,\n                    body: { success: false, error: { message: 'AI service is not configured', code: 404 } },\n                },\n            };\n        }\n\n        // The AI service exposes route definitions via buildAIRoutes.\n        // We match the request path against known AI route patterns.\n        const fullPath = `/api/v1${subPath}`;\n\n        // Build a simple param-extracting matcher for route patterns like /api/v1/ai/conversations/:id\n        const matchRoute = (pattern: string, path: string): Record<string, string> | null => {\n            const patternParts = pattern.split('/');\n            const pathParts = path.split('/');\n            if (patternParts.length !== pathParts.length) return null;\n            const params: Record<string, string> = {};\n            for (let i = 0; i < patternParts.length; i++) {\n                if (patternParts[i].startsWith(':')) {\n                    params[patternParts[i].substring(1)] = pathParts[i];\n                } else if (patternParts[i] !== pathParts[i]) {\n                    return null;\n                }\n            }\n            return params;\n        };\n\n        // Try to get route definitions from the AI service's cached routes\n        const routes = (this.kernel as any).__aiRoutes as Array<{\n            method: string; path: string; handler: (req: any) => Promise<any>;\n        }> | undefined;\n\n        if (!routes) {\n            return {\n                handled: true,\n                response: {\n                    status: 503,\n                    body: { success: false, error: { message: 'AI service routes not yet initialized', code: 503 } },\n                },\n            };\n        }\n\n        for (const route of routes) {\n            if (route.method !== method) continue;\n            const params = matchRoute(route.path, fullPath);\n            if (params === null) continue;\n\n            const result = await route.handler({ body, params, query });\n\n            if (result.stream && result.events) {\n                // Return a streaming result for the adapter to handle\n                return {\n                    handled: true,\n                    result: {\n                        type: 'stream',\n                        contentType: result.vercelDataStream\n                            ? 'text/plain; charset=utf-8'\n                            : 'text/event-stream',\n                        events: result.events,\n                        vercelDataStream: result.vercelDataStream,\n                        headers: {\n                            'Content-Type': result.vercelDataStream\n                                ? 'text/plain; charset=utf-8'\n                                : 'text/event-stream',\n                            'Cache-Control': 'no-cache',\n                            'Connection': 'keep-alive',\n                        },\n                    },\n                };\n            }\n\n            return {\n                handled: true,\n                response: {\n                    status: result.status,\n                    body: result.body,\n                },\n            };\n        }\n\n        return {\n            handled: true,\n            response: this.routeNotFound(subPath),\n        };\n    }\n\n    /**\n     * Main Dispatcher Entry Point\n     * Routes the request to the appropriate handler based on path and precedence\n     */\n    async dispatch(method: string, path: string, body: any, query: any, context: HttpProtocolContext, prefix?: string): Promise<HttpDispatcherResult> {\n        let cleanPath = path.replace(/\\/$/, ''); // Remove trailing slash if present, but strict on clean paths\n\n        // ── Environment Resolution ──\n        // Resolve environment context for data-plane requests before routing\n        await this.resolveEnvironmentContext(context, cleanPath);\n\n        // ── Multi-Kernel Routing (ADR-0003 cloud mode) ──\n        // When a KernelManager is wired in, per-request routing targets the\n        // project's dedicated kernel. Self-hosted / legacy deployments leave\n        // `kernelManager` unset and continue using the constructor kernel.\n        // Reserved virtual id 'platform' addresses the control plane through\n        // the regular project URL family — never spin up a per-project kernel\n        // for it (there is no projects row to look up).\n        if (this.kernelManager && context.environmentId && context.environmentId !== 'platform') {\n            this.kernel = await this.kernelManager.getOrCreate(context.environmentId);\n        } else {\n            this.kernel = this.defaultKernel;\n        }\n\n        // Touch scope for TTL/LRU tracking in shared-kernel mode\n        if (this.scopeManager && context.environmentId && context.environmentId !== 'platform') {\n            this.scopeManager.touch(context.environmentId);\n        }\n\n        // ── Identity Resolution (RBAC/RLS/FLS context) ──\n        // Resolve once per request; SecurityPlugin middleware reads\n        // ctx.userId/roles/permissions/tenantId via opCtx.context.\n        try {\n            context.executionContext = await resolveExecutionContext({\n                getService: (n: string) => this.resolveService(n, context.environmentId),\n                getQl: () => Promise.resolve(this.getObjectQLService(context.environmentId)),\n                request: context.request,\n            });\n        } catch {\n            // anonymous request — leave executionContext undefined\n        }\n\n        // ── Project Membership Enforcement ──\n        // Once the environmentId is known, gate scoped data/meta/AI/automation\n        // routes on `sys_environment_member`. Control-plane paths, the system\n        // project, and platform-org members bypass this check.\n        const forbidden = await this.enforceProjectMembership(context, cleanPath);\n        if (forbidden) {\n            return { handled: true, response: forbidden };\n        }\n\n        // Strip the `/environments/:environmentId` prefix so the protocol dispatchers\n        // below (meta, data, ui, automation, …) see the same shape whether\n        // the caller used host-based routing, `X-Environment-Id`, or a scoped URL.\n        // `/cloud/environments/:id` is explicitly excluded — those are control\n        // plane CRUD endpoints and must reach handleCloud() unchanged.\n        if (!cleanPath.startsWith('/cloud/')) {\n            const scopedMatch = cleanPath.match(/^\\/projects\\/[^/]+(\\/.*)?$/);\n            if (scopedMatch) {\n                cleanPath = scopedMatch[1] ?? '';\n            }\n        }\n\n        // 0. Discovery Endpoint (GET /discovery or GET /)\n        // Standard route: /discovery (protocol-compliant)\n        // Legacy route: / (empty path, for backward compatibility — MSW strips base URL)\n        try {\n        if ((cleanPath === '/discovery' || cleanPath === '') && method === 'GET') {\n             const info = await this.getDiscoveryInfo(prefix ?? '');\n             return { \n                 handled: true, \n                 response: this.success(info) \n             };\n        }\n\n        // 0b. Health Endpoint (GET /health)\n        if (cleanPath === '/health' && method === 'GET') {\n            return {\n                handled: true,\n                response: this.success({\n                    status: 'ok',\n                    timestamp: new Date().toISOString(),\n                    version: '1.0.0',\n                    uptime: typeof process !== 'undefined' ? process.uptime() : undefined,\n                }),\n            };\n        }\n\n        // 0c. Plan-A diagnostics removed; the seed-replay and oauth2/callback\n        // probes were temporary debugging tools used during the SSO rollout.\n\n        // 1. System Protocols (Prefix-based)\n        if (cleanPath.startsWith('/auth')) {\n            return this.handleAuth(cleanPath.substring(5), method, body, context);\n        }\n        \n        if (cleanPath.startsWith('/meta')) {\n             return this.handleMetadata(cleanPath.substring(5), context, method, body, query);\n        }\n\n        if (cleanPath.startsWith('/data')) {\n            return this.handleData(cleanPath.substring(5), method, body, query, context);\n        }\n        \n        if (cleanPath.startsWith('/graphql')) {\n             if (method === 'POST') return this.handleGraphQL(body, context);\n             // GraphQL usually GET for Playground is handled by middleware but we can return 405 or handle it\n        }\n\n        if (cleanPath.startsWith('/storage')) {\n             return this.handleStorage(cleanPath.substring(8), method, body, context); // body here is file/stream for upload\n        }\n        \n        if (cleanPath.startsWith('/ui')) {\n             return this.handleUi(cleanPath.substring(3), query, context);\n        }\n\n        if (cleanPath.startsWith('/automation')) {\n             return this.handleAutomation(cleanPath.substring(11), method, body, context, query);\n        }\n\n        if (cleanPath.startsWith('/actions')) {\n             return this.handleActions(cleanPath.substring(8), method, body, context);\n        }\n        \n        if (cleanPath.startsWith('/analytics')) {\n             return this.handleAnalytics(cleanPath.substring(10), method, body, context);\n        }\n\n        if (cleanPath.startsWith('/packages')) {\n             return this.handlePackages(cleanPath.substring(9), method, body, query, context);\n        }\n\n        if (cleanPath.startsWith('/cloud')) {\n             return this.handleCloud(cleanPath.substring(6), method, body, query, context);\n        }\n\n        if (cleanPath.startsWith('/i18n')) {\n             return this.handleI18n(cleanPath.substring(5), method, query, context);\n        }\n\n        // AI Service — delegate to the registered AI route handlers\n        if (cleanPath.startsWith('/ai')) {\n             return this.handleAI(cleanPath, method, body, query, context);\n        }\n\n        // OpenAPI Specification\n        if (cleanPath === '/openapi.json' && method === 'GET') {\n             try {\n                const metaSvc = await this.resolveService('metadata', context.environmentId);\n                if (metaSvc && typeof (metaSvc as any).generateOpenApi === 'function') {\n                    const result = await (metaSvc as any).generateOpenApi({});\n                    return { handled: true, response: this.success(result) };\n                }\n             } catch (e) {\n                // If not implemented, fall through or return 404\n             }\n        }\n\n        // 2. Custom API Endpoints (Registry lookup)\n        // Check if there is a custom endpoint defined for this path\n        const result = await this.handleApiEndpoint(cleanPath, method, body, query, context);\n        if (result.handled) return result;\n\n        // 3. Fallback — return semantic 404 with diagnostic info\n        return {\n            handled: true,\n            response: this.routeNotFound(cleanPath),\n        };\n        } catch (e) {\n            if (isPermissionDeniedError(e)) {\n                return {\n                    handled: true,\n                    response: this.error(e.message, 403, { code: 'PERMISSION_DENIED', ...(e.details ?? {}) }),\n                };\n            }\n            throw e;\n        }\n    }\n\n    /**\n     * Handles Custom API Endpoints defined in metadata\n     */\n    async handleApiEndpoint(path: string, method: string, body: any, query: any, context: HttpProtocolContext): Promise<HttpDispatcherResult> {\n        try {\n            // Attempt to find a matching endpoint in the registry\n            const metaSvc = await this.resolveService('metadata', context.environmentId);\n            if (!metaSvc || typeof (metaSvc as any).matchEndpoint !== 'function') {\n                return { handled: false };\n            }\n            const endpoint = await (metaSvc as any).matchEndpoint({ path, method });\n            \n            if (endpoint) {\n                // Execute the endpoint target logic\n                if (endpoint.type === 'flow') {\n                    const automationSvc = await this.resolveService('automation');\n                    if (!automationSvc || typeof (automationSvc as any).runFlow !== 'function') {\n                        return { handled: true, response: this.error('Automation service not available', 503) };\n                    }\n                    const result = await (automationSvc as any).runFlow({ \n                        flowId: endpoint.target, \n                        inputs: { ...query, ...body, _request: context.request } \n                    });\n                     return { handled: true, response: this.success(result) };\n                }\n                \n                if (endpoint.type === 'script') {\n                    const automationSvc = await this.resolveService('automation');\n                    if (!automationSvc || typeof (automationSvc as any).runScript !== 'function') {\n                        return { handled: true, response: this.error('Automation service not available', 503) };\n                    }\n                     const result = await (automationSvc as any).runScript({ \n                        scriptName: endpoint.target, \n                        context: { ...query, ...body, request: context.request } \n                    });\n                     return { handled: true, response: this.success(result) };\n                }\n\n                if (endpoint.type === 'object_operation') {\n                    // e.g. Proxy to an object action\n                    if (endpoint.objectParams) {\n                        const { object, operation } = endpoint.objectParams;\n                        // Map standard CRUD operations\n                        if (operation === 'find') {\n                             const result = await this.callData('query', { object, query });\n                             // Spec: FindDataResponse = { object, records, total?, hasMore? }\n                             return { handled: true, response: this.success(result.records, { total: result.total }) };\n                        }\n                        if (operation === 'get' && query.id) {\n                             const result = await this.callData('get', { object, id: query.id });\n                             return { handled: true, response: this.success(result) };\n                        }\n                         if (operation === 'create') {\n                             const result = await this.callData('create', { object, data: body });\n                             return { handled: true, response: this.success(result) };\n                        }\n                    }\n                }\n\n                if (endpoint.type === 'proxy') {\n                     return { \n                         handled: true, \n                         response: { \n                             status: 200, \n                             body: { proxy: true, target: endpoint.target, note: 'Proxy execution requires http-client service' } \n                         } \n                     };\n                }\n            }\n        } catch (e) {\n            // If matchEndpoint fails (e.g. not found), we just return not handled\n            // so we can fallback to 404 or other handlers\n        }\n\n        return { handled: false };\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * resolveExecutionContext — REST entry-point identity resolver.\n *\n * Builds an {@link ExecutionContext} from an incoming HTTP request by combining:\n *  - better-auth Bearer/Session cookies (`authService.api.getSession`)\n *  - API Key headers (`X-API-Key` / `Authorization: ApiKey <token>`) — first\n *    via better-auth's apiKey plugin if available, otherwise a direct lookup\n *    against the `sys_api_key` system object.\n *  - `sys_member` lookup for `(userId, activeOrganizationId)` to populate\n *    organization-scoped roles, plus any extra permission sets bound through\n *    the `sys_user_permission_set` / `sys_role_permission_set` link tables.\n *\n * The resolver is intentionally non-fatal: when auth is not wired up or any\n * of the dependent services are unavailable, it returns the partial context\n * that can be reconstructed (even an empty `{ isSystem: false, roles: [],\n * permissions: [] }`). Permission enforcement is the SecurityPlugin's job.\n */\n\nimport type { ExecutionContext } from '@objectstack/spec/kernel';\n\ninterface ResolveOptions {\n  /** Function returning a service from the active kernel (or undefined). */\n  getService: (name: string) => Promise<any> | any;\n  /** Function returning the data engine (ObjectQL) for the active scope. */\n  getQl: () => Promise<any> | any;\n  /** The raw incoming HTTP request (Fetch Request, Node IncomingMessage, …). */\n  request: any;\n}\n\nfunction readHeader(headers: any, name: string): string | undefined {\n  if (!headers) return undefined;\n  const lower = name.toLowerCase();\n  if (typeof headers.get === 'function') {\n    const v = headers.get(name) ?? headers.get(lower);\n    return v == null ? undefined : String(v);\n  }\n  for (const key of Object.keys(headers)) {\n    if (key.toLowerCase() === lower) {\n      const v = headers[key];\n      return Array.isArray(v) ? v[0] : v == null ? undefined : String(v);\n    }\n  }\n  return undefined;\n}\n\nfunction extractApiKey(headers: any): string | undefined {\n  const x = readHeader(headers, 'x-api-key');\n  if (x) return x.trim();\n  const auth = readHeader(headers, 'authorization');\n  if (!auth) return undefined;\n  const m = auth.match(/^ApiKey\\s+(.+)$/i);\n  return m ? m[1].trim() : undefined;\n}\n\n/**\n * Convert the dispatcher's plain `Record<string,string>` headers map into\n * a Web `Headers` instance so libraries like better-auth (which reads via\n * `headers.get('cookie')`) work uniformly.\n */\nfunction toHeaders(input: any): any {\n  if (!input) return new Headers();\n  if (typeof Headers !== 'undefined' && input instanceof Headers) return input;\n  const h = new Headers();\n  if (typeof input.entries === 'function') {\n    for (const [k, v] of input.entries()) h.set(String(k), String(v));\n    return h;\n  }\n  for (const k of Object.keys(input)) {\n    const v = (input as any)[k];\n    if (v == null) continue;\n    h.set(String(k), Array.isArray(v) ? v.join(',') : String(v));\n  }\n  return h;\n}\n\nasync function tryFind(ql: any, object: string, where: any, limit = 100): Promise<any[]> {\n  if (!ql || typeof ql.find !== 'function') return [];\n  try {\n    let rows = await ql.find(object, { where, limit, context: { isSystem: true } } as any);\n    if (rows && (rows as any).value) rows = (rows as any).value;\n    return Array.isArray(rows) ? rows : [];\n  } catch {\n    return [];\n  }\n}\n\n/**\n * Resolve the {@link ExecutionContext} for an inbound request.\n *\n * Always resolves — never throws. Anonymous requests yield\n * `{ isSystem: false, roles: [], permissions: [] }`.\n */\nexport async function resolveExecutionContext(opts: ResolveOptions): Promise<ExecutionContext> {\n  const headers = opts.request?.headers;\n  const ctx: ExecutionContext = {\n    roles: [],\n    permissions: [],\n    isSystem: false,\n  };\n\n  let userId: string | undefined;\n  let tenantId: string | undefined;\n\n  // 1. API Key path — takes precedence over session, since callers explicitly\n  //    opt in to API-key auth via the header.\n  const apiKey = extractApiKey(headers);\n  if (apiKey) {\n    try {\n      const authService: any = await opts.getService('auth');\n      // better-auth apiKey plugin (if enabled) exposes a verify endpoint.\n      const verify = authService?.api?.verifyApiKey ?? authService?.api?.apiKey?.verify;\n      if (typeof verify === 'function') {\n        const res = await verify({ body: { key: apiKey } });\n        const payload = res?.key ?? res;\n        if (payload?.userId) userId = payload.userId;\n        if (payload?.organizationId) tenantId = payload.organizationId;\n        if (Array.isArray(payload?.permissions)) {\n          ctx.permissions!.push(...payload.permissions);\n        }\n        if (Array.isArray(payload?.scopes)) {\n          ctx.permissions!.push(...payload.scopes);\n        }\n      }\n    } catch {\n      // ignore — fall through to direct lookup\n    }\n\n    if (!userId) {\n      // Direct lookup against sys_api_key — supports keys provisioned outside\n      // of better-auth (legacy or self-managed).\n      const ql = await opts.getQl();\n      const rows = await tryFind(ql, 'sys_api_key', { key: apiKey, active: true }, 1);\n      const row = rows[0];\n      if (row) {\n        userId = row.user_id ?? row.userId;\n        tenantId = row.organization_id ?? row.organizationId;\n        if (Array.isArray(row.scopes)) ctx.permissions!.push(...row.scopes);\n      }\n    }\n  }\n\n  // 2. Session / Bearer path — fall back when API key did not resolve a user.\n  if (!userId) {\n    try {\n      const authService: any = await opts.getService('auth');\n      // better-auth's `getSession` expects a Web `Headers` instance\n      // (it calls `headers.get('cookie')`). The HTTP adapter hands us a\n      // plain `Record<string,string>`, so wrap it before forwarding.\n      const headersInstance = toHeaders(headers);\n      const sessionData = await authService?.api?.getSession?.({ headers: headersInstance });\n      userId = sessionData?.user?.id ?? sessionData?.session?.userId;\n      tenantId = tenantId ?? sessionData?.session?.activeOrganizationId;\n      ctx.accessToken = sessionData?.session?.token ?? ctx.accessToken;\n    } catch {\n      // no auth configured — return anonymous context\n    }\n  }\n\n  if (userId) ctx.userId = userId;\n  if (tenantId) ctx.tenantId = tenantId;\n\n  if (!userId) return ctx;\n\n  // 3. Resolve organization-scoped roles via sys_member, then merge any\n  //    permission sets bound via the link tables. All lookups go through\n  //    ObjectQL with `isSystem: true` to avoid recursion through the\n  //    SecurityPlugin middleware.\n  const ql = await opts.getQl();\n  if (!ql) return ctx;\n\n  const memberWhere: any = tenantId\n    ? { user_id: userId, organization_id: tenantId }\n    : { user_id: userId };\n  const members = await tryFind(ql, 'sys_member', memberWhere, 50);\n  for (const m of members) {\n    if (m.role && typeof m.role === 'string') {\n      // better-auth stores comma-separated roles for multi-role membership.\n      for (const r of m.role.split(',').map((s: string) => s.trim()).filter(Boolean)) {\n        if (!ctx.roles!.includes(r)) ctx.roles!.push(r);\n      }\n    }\n  }\n\n  // 3a. Resolve fellow-organization user IDs so RLS can scope identity\n  //     tables (`sys_user`) to collaborators in the active org via\n  //     `id IN (current_user.org_user_ids)`. Without this, the default\n  //     `id = current_user.id` policy on sys_user makes @-mention pickers,\n  //     owner/assignee lookups and reviewer selectors all return just the\n  //     current user. Hard-capped at 1000 members per request — large\n  //     enterprises should plug in a cache or directory adapter.\n  if (tenantId) {\n    const orgMembers = await tryFind(\n      ql,\n      'sys_member',\n      { organization_id: tenantId },\n      1000,\n    );\n    const orgUserIds = Array.from(\n      new Set(\n        orgMembers\n          .map((m) => m.user_id ?? m.userId)\n          .filter((v): v is string => typeof v === 'string' && v.length > 0),\n      ),\n    );\n    // Always include self even if the sys_member lookup misfires (e.g.\n    // API key auth where the user is recognised but not in sys_member).\n    if (!orgUserIds.includes(userId)) orgUserIds.push(userId);\n    (ctx as any).org_user_ids = orgUserIds;\n  } else {\n    // No active org → at minimum the user can see themselves.\n    (ctx as any).org_user_ids = [userId];\n  }\n\n  // Resolve user-scoped permission sets.\n  const upsRows = await tryFind(\n    ql,\n    'sys_user_permission_set',\n    tenantId\n      ? { user_id: userId, organization_id: tenantId }\n      : { user_id: userId },\n    100,\n  );\n  const psIds = new Set<string>(\n    upsRows.map((r) => r.permission_set_id ?? r.permissionSetId).filter(Boolean),\n  );\n\n  // Resolve role-bound permission sets.\n  if (ctx.roles!.length > 0) {\n    const roleRows = await tryFind(ql, 'sys_role', { name: { $in: ctx.roles } }, 100);\n    const roleIds = roleRows.map((r) => r.id).filter(Boolean);\n    if (roleIds.length > 0) {\n      const rpsRows = await tryFind(\n        ql,\n        'sys_role_permission_set',\n        { role_id: { $in: roleIds } },\n        500,\n      );\n      for (const r of rpsRows) {\n        const id = r.permission_set_id ?? r.permissionSetId;\n        if (id) psIds.add(id);\n      }\n    }\n  }\n\n  if (psIds.size > 0) {\n    // Surface permission set names through ctx.permissions so downstream\n    // SecurityPlugin can look them up. We store the canonical `name` field.\n    const psRows = await tryFind(\n      ql,\n      'sys_permission_set',\n      { id: { $in: Array.from(psIds) } },\n      500,\n    );\n    for (const ps of psRows) {\n      if (ps.name && !ctx.permissions!.includes(ps.name)) {\n        ctx.permissions!.push(ps.name);\n      }\n    }\n  }\n\n  return ctx;\n}\n\n/**\n * Typed sentinel error thrown by SecurityPlugin (and re-thrown here) when an\n * operation is denied. The dispatcher catches it and translates to HTTP 403.\n *\n * Kept structurally identical to {@link `@objectstack/plugin-security`}'s\n * `PermissionDeniedError` so `isPermissionDeniedError` matches whichever\n * class instance crosses the boundary, regardless of which package owns\n * the actual class identity at runtime. We do not add a hard dependency\n * on `plugin-security` here to keep the runtime usable in stack\n * compositions without security enforcement.\n */\nexport class PermissionDeniedError extends Error {\n  readonly code = 'PERMISSION_DENIED';\n  readonly statusCode = 403;\n  readonly details?: Record<string, unknown>;\n  constructor(message: string, details?: Record<string, unknown>) {\n    super(message);\n    this.name = 'PermissionDeniedError';\n    this.details = details;\n  }\n}\n\nexport function isPermissionDeniedError(e: unknown): e is PermissionDeniedError {\n  if (!e || typeof e !== 'object') return false;\n  const anyE = e as any;\n  return (\n    anyE.name === 'PermissionDeniedError' ||\n    anyE.code === 'PERMISSION_DENIED' ||\n    (typeof anyE.message === 'string' && anyE.message.startsWith('[Security] Access denied'))\n  );\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Security response headers builder.\n *\n * Returns the conservative defaults every production API server should\n * send on every response. Designed to be merged with route-specific\n * headers by the dispatcher (`sendResult`) so all adapters (Hono,\n * Fastify, Express, Next.js, …) get them uniformly without each one\n * re-implementing helmet.\n *\n * What we DO opinionate:\n *   - Content-Security-Policy (api-default: deny everything but self)\n *   - Strict-Transport-Security (HSTS, prod-only — TLS is the caller's\n *     responsibility; we just emit the header)\n *   - X-Content-Type-Options: nosniff\n *   - X-Frame-Options: DENY (anti clickjacking)\n *   - Referrer-Policy: no-referrer\n *   - Permissions-Policy: geolocation=(), camera=(), microphone=()\n *   - Cross-Origin-Resource-Policy: same-origin\n *\n * What we DON'T opinionate:\n *   - X-XSS-Protection (deprecated)\n *   - CORS — that's an app concern, configure separately\n *   - CSP for HTML pages — set a different CSP at the SPA host\n *\n * Every header can be overridden or disabled by config.\n */\n\nexport interface SecurityHeadersOptions {\n  /**\n   * Enable HSTS. Set to `true` in production behind TLS. When `false`\n   * the Strict-Transport-Security header is omitted.\n   * @default false\n   */\n  hsts?: boolean | {\n    /** Max-age in seconds. @default 15552000 (180 days) */\n    maxAge?: number;\n    includeSubDomains?: boolean;\n    preload?: boolean;\n  };\n  /**\n   * Override the Content-Security-Policy header. Pass `false` to omit.\n   * @default \"default-src 'none'; frame-ancestors 'none'\"\n   */\n  contentSecurityPolicy?: string | false;\n  /**\n   * Override X-Frame-Options. @default 'DENY'\n   */\n  frameOptions?: 'DENY' | 'SAMEORIGIN' | false;\n  /**\n   * Override Referrer-Policy. @default 'no-referrer'\n   */\n  referrerPolicy?: string | false;\n  /**\n   * Override Permissions-Policy. Pass `false` to omit.\n   * @default 'geolocation=(), camera=(), microphone=(), payment=()'\n   */\n  permissionsPolicy?: string | false;\n  /**\n   * Override Cross-Origin-Resource-Policy. @default 'same-origin'\n   */\n  corp?: 'same-origin' | 'same-site' | 'cross-origin' | false;\n  /**\n   * Free-form extra headers merged last.\n   */\n  extra?: Record<string, string>;\n}\n\n/**\n * Build a header map ready to be `Object.assign`'d into a response.\n * Idempotent and synchronous — safe to call per-request.\n */\nexport function buildSecurityHeaders(opts: SecurityHeadersOptions = {}): Record<string, string> {\n  const h: Record<string, string> = {};\n\n  if (opts.contentSecurityPolicy !== false) {\n    h['Content-Security-Policy'] =\n      opts.contentSecurityPolicy ?? \"default-src 'none'; frame-ancestors 'none'\";\n  }\n\n  if (opts.hsts) {\n    const cfg = typeof opts.hsts === 'object' ? opts.hsts : {};\n    const maxAge = cfg.maxAge ?? 15_552_000;\n    const parts = [`max-age=${maxAge}`];\n    if (cfg.includeSubDomains ?? true) parts.push('includeSubDomains');\n    if (cfg.preload) parts.push('preload');\n    h['Strict-Transport-Security'] = parts.join('; ');\n  }\n\n  h['X-Content-Type-Options'] = 'nosniff';\n\n  if (opts.frameOptions !== false) {\n    h['X-Frame-Options'] = opts.frameOptions ?? 'DENY';\n  }\n\n  if (opts.referrerPolicy !== false) {\n    h['Referrer-Policy'] = opts.referrerPolicy ?? 'no-referrer';\n  }\n\n  if (opts.permissionsPolicy !== false) {\n    h['Permissions-Policy'] =\n      opts.permissionsPolicy ?? 'geolocation=(), camera=(), microphone=(), payment=()';\n  }\n\n  if (opts.corp !== false) {\n    h['Cross-Origin-Resource-Policy'] = opts.corp ?? 'same-origin';\n  }\n\n  if (opts.extra) {\n    Object.assign(h, opts.extra);\n  }\n\n  return h;\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * In-memory token-bucket rate limiter.\n *\n * Designed to be adapter-agnostic — the dispatcher calls `consume(key)`\n * with a request fingerprint (IP, IP+route bucket, or user id) and\n * short-circuits with 429 if the bucket is empty.\n *\n * For production multi-instance deploys, swap the in-memory store via\n * `RateLimitStore`. The shape is intentionally narrow so a Redis-backed\n * implementation is straightforward.\n */\n\nexport interface RateLimitDecision {\n  allowed: boolean;\n  /** Remaining tokens in the bucket after this consume. */\n  remaining: number;\n  /** Wall-clock ms until next token is available (when not allowed). */\n  retryAfterMs: number;\n  /** UNIX ms when the limit window resets. */\n  resetAt: number;\n}\n\nexport interface RateLimitBucketConfig {\n  /** Max tokens (bucket capacity). */\n  capacity: number;\n  /** Tokens added per second. */\n  refillPerSec: number;\n  /** Optional cost override for the consume operation. @default 1 */\n  defaultCost?: number;\n}\n\ninterface BucketState {\n  tokens: number;\n  /** Last refill timestamp (ms). */\n  lastRefill: number;\n}\n\n/**\n * Storage interface — swap for Redis/Memcached in clustered deploys.\n * Implementations MUST be safe under concurrent access.\n */\nexport interface RateLimitStore {\n  get(key: string): BucketState | undefined;\n  set(key: string, state: BucketState): void;\n  /** Cleanup hint — implementations may evict idle entries. */\n  prune?(olderThanMs: number): void;\n}\n\nclass MemoryStore implements RateLimitStore {\n  private buckets = new Map<string, BucketState>();\n  private maxEntries: number;\n\n  constructor(maxEntries = 100_000) {\n    this.maxEntries = maxEntries;\n  }\n\n  get(key: string): BucketState | undefined {\n    return this.buckets.get(key);\n  }\n\n  set(key: string, state: BucketState): void {\n    // Crude LRU eviction — drop the oldest 10% when we hit the cap.\n    // Good enough for an in-memory store; replace with Redis if you\n    // need precision under load.\n    if (this.buckets.size >= this.maxEntries) {\n      const dropCount = Math.max(1, Math.floor(this.maxEntries / 10));\n      const iter = this.buckets.keys();\n      for (let i = 0; i < dropCount; i++) {\n        const k = iter.next().value;\n        if (!k) break;\n        this.buckets.delete(k);\n      }\n    }\n    this.buckets.set(key, state);\n  }\n\n  prune(olderThanMs: number): void {\n    const cutoff = Date.now() - olderThanMs;\n    for (const [k, v] of this.buckets) {\n      if (v.lastRefill < cutoff) this.buckets.delete(k);\n    }\n  }\n}\n\nexport class RateLimiter {\n  private config: RateLimitBucketConfig;\n  private store: RateLimitStore;\n  private now: () => number;\n\n  constructor(config: RateLimitBucketConfig, opts: { store?: RateLimitStore; now?: () => number } = {}) {\n    if (config.capacity <= 0) throw new Error('RateLimiter: capacity must be > 0');\n    if (config.refillPerSec <= 0) throw new Error('RateLimiter: refillPerSec must be > 0');\n    this.config = config;\n    this.store = opts.store ?? new MemoryStore();\n    // Injectable clock keeps tests deterministic.\n    this.now = opts.now ?? Date.now;\n  }\n\n  /**\n   * Attempt to consume `cost` tokens for `key`. Returns a decision\n   * describing whether the request should proceed and, if not, how\n   * long the caller should wait before retrying.\n   */\n  consume(key: string, cost = this.config.defaultCost ?? 1): RateLimitDecision {\n    const now = this.now();\n    const { capacity, refillPerSec } = this.config;\n\n    let state = this.store.get(key);\n    if (!state) {\n      state = { tokens: capacity, lastRefill: now };\n    } else {\n      const elapsedSec = (now - state.lastRefill) / 1000;\n      if (elapsedSec > 0) {\n        state = {\n          tokens: Math.min(capacity, state.tokens + elapsedSec * refillPerSec),\n          lastRefill: now,\n        };\n      }\n    }\n\n    if (state.tokens >= cost) {\n      state.tokens -= cost;\n      this.store.set(key, state);\n      return {\n        allowed: true,\n        remaining: Math.floor(state.tokens),\n        retryAfterMs: 0,\n        resetAt: now + Math.ceil(((capacity - state.tokens) / refillPerSec) * 1000),\n      };\n    }\n\n    const tokensNeeded = cost - state.tokens;\n    const retryAfterMs = Math.ceil((tokensNeeded / refillPerSec) * 1000);\n    this.store.set(key, state);\n    return {\n      allowed: false,\n      remaining: Math.floor(state.tokens),\n      retryAfterMs,\n      resetAt: now + retryAfterMs,\n    };\n  }\n\n  /** Force-reset a key (e.g. after a successful auth flow). */\n  reset(key: string): void {\n    this.store.set(key, { tokens: this.config.capacity, lastRefill: this.now() });\n  }\n}\n\n/**\n * Curated default buckets for the three traffic classes ObjectStack\n * dispatches. Conservative — tune via `DispatcherPluginConfig.rateLimit`\n * for your deployment.\n *\n *   - auth: 10 req / minute / IP — guards /auth/* against credential\n *     stuffing and password-spray.\n *   - write: 60 req / minute / IP — POST/PUT/PATCH/DELETE.\n *   - read:  600 req / minute / IP — GET, including discovery and\n *     metadata.\n *\n * \"Per-IP\" is just the suggested key shape; the dispatcher constructs\n * the key from `${ip}:${bucket}` so a single noisy IP can saturate\n * one bucket without blocking the others.\n */\nexport interface RateLimitDefaults {\n  auth: RateLimitBucketConfig;\n  write: RateLimitBucketConfig;\n  read: RateLimitBucketConfig;\n}\n\nexport const DEFAULT_RATE_LIMITS: RateLimitDefaults = {\n  auth: { capacity: 10, refillPerSec: 10 / 60 },\n  write: { capacity: 60, refillPerSec: 60 / 60 },\n  read: { capacity: 600, refillPerSec: 600 / 60 },\n};\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Request correlation primitives.\n *\n * Two concerns:\n *\n *   1. **Request IDs.** Every request gets a stable id that is echoed back\n *      via `X-Request-Id`, threaded into log records, and (where the host\n *      asks for it) made available to handlers via `req.requestId`. The id\n *      comes from the incoming `X-Request-Id` header when present and\n *      well-formed, otherwise we mint a fresh one.\n *\n *   2. **W3C Trace Context.** When clients pass `traceparent` per\n *      <https://www.w3.org/TR/trace-context/>, we surface the parsed\n *      `traceId` / `spanId` / `sampled` triple so the host can attach it\n *      to its OTel SDK / logger.\n *\n * Both helpers are pure functions — no I/O, no side effects, no\n * dependencies — so they are safe to call on the hot path and trivial to\n * test.\n */\n\nconst MAX_REQUEST_ID_LENGTH = 200;\n\n/**\n * Allowed characters in a request id: alphanumerics plus `-_.:`.\n * Rejects whitespace, control chars, anything that could interfere\n * with header serialization or log parsing.\n */\nconst REQUEST_ID_PATTERN = /^[A-Za-z0-9._:-]+$/;\n\n/**\n * Extract a request id from incoming headers, validating shape. If\n * the header is missing or malformed, returns `undefined` and the\n * caller should mint one via {@link generateRequestId}.\n *\n * Header lookup is case-insensitive — adapters normalize differently.\n */\nexport function extractRequestId(headers: unknown): string | undefined {\n    if (!headers || typeof headers !== 'object') return undefined;\n    for (const [k, v] of Object.entries(headers as Record<string, unknown>)) {\n        if (k.toLowerCase() !== 'x-request-id') continue;\n        const raw = Array.isArray(v) ? v[0] : v;\n        if (typeof raw !== 'string') return undefined;\n        const trimmed = raw.trim();\n        if (!trimmed || trimmed.length > MAX_REQUEST_ID_LENGTH) return undefined;\n        if (!REQUEST_ID_PATTERN.test(trimmed)) return undefined;\n        return trimmed;\n    }\n    return undefined;\n}\n\n/**\n * Mint a fresh request id. Uses `crypto.randomUUID()` when available\n * (Node 16+, modern browsers, edge runtimes); falls back to a\n * timestamp+random suffix otherwise so the function is universally\n * callable.\n *\n * Format is `req_<hex>`; the prefix makes it obvious in logs that the\n * id was minted by this layer (vs. propagated from a client).\n */\nexport function generateRequestId(): string {\n    const g: { randomUUID?: () => string } | undefined =\n        (globalThis as unknown as { crypto?: { randomUUID?: () => string } }).crypto;\n    if (g && typeof g.randomUUID === 'function') {\n        return `req_${g.randomUUID().replace(/-/g, '')}`;\n    }\n    const t = Date.now().toString(36);\n    const r = Math.random().toString(36).slice(2, 12);\n    return `req_${t}${r}`;\n}\n\n/**\n * Return the incoming request id if valid, otherwise mint one.\n */\nexport function resolveRequestId(\n    headers: unknown,\n    generate: () => string = generateRequestId,\n): string {\n    return extractRequestId(headers) ?? generate();\n}\n\n/**\n * Parsed W3C Trace Context. `sampled` reflects the lowest flag bit.\n */\nexport interface TraceContext {\n    traceId: string;\n    spanId: string;\n    sampled: boolean;\n}\n\nconst TRACEPARENT_PATTERN = /^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;\n\n/**\n * Parse a `traceparent` header value into its W3C fields. Returns\n * `undefined` for malformed input, the all-zero trace/span ids\n * (spec-mandated invalid), or unknown versions.\n */\nexport function parseTraceparent(value: unknown): TraceContext | undefined {\n    if (typeof value !== 'string') return undefined;\n    const m = TRACEPARENT_PATTERN.exec(value.trim().toLowerCase());\n    if (!m) return undefined;\n    const [, version, traceId, spanId, flags] = m;\n    if (version !== '00') return undefined;\n    if (/^0+$/.test(traceId) || /^0+$/.test(spanId)) return undefined;\n    const sampled = (parseInt(flags, 16) & 0x01) === 0x01;\n    return { traceId, spanId, sampled };\n}\n\n/**\n * Build the response header equivalent so downstream services\n * continue the trace.\n */\nexport function formatTraceparent(ctx: TraceContext): string {\n    const flag = ctx.sampled ? '01' : '00';\n    return `00-${ctx.traceId}-${ctx.spanId}-${flag}`;\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Backwards-compat shim. The canonical home for `MetricsRegistry`,\n * `NoopMetricsRegistry`, `InMemoryMetricsRegistry`, `MetricSample`, and\n * the `RUNTIME_METRICS` constants moved to `@objectstack/observability`\n * so deployment-target-neutral code (cloud, self-hosted, ...) can\n * import them without pulling in the whole runtime.\n *\n * Existing imports from `@objectstack/runtime`-internal paths continue\n * to work transparently via this re-export.\n */\nexport {\n    NoopMetricsRegistry,\n    InMemoryMetricsRegistry,\n    RUNTIME_METRICS,\n    type MetricsRegistry,\n    type MetricSample,\n} from '@objectstack/observability';\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Backwards-compat shim. See `metrics.ts` for the rationale — the\n * canonical home is `@objectstack/observability`.\n */\nexport {\n    NoopErrorReporter,\n    InMemoryErrorReporter,\n    type ErrorReporter,\n    type CapturedError,\n} from '@objectstack/observability';\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport {\n    NoopMetricsRegistry,\n    NoopErrorReporter,\n    resolveRequestId,\n    RUNTIME_METRICS,\n    type MetricsRegistry,\n    type ErrorReporter,\n} from './index.js';\n\n/**\n * Options for {@link instrumentRouteHandler}. All fields optional; the\n * defaults make the wrapper a no-op (zero overhead, no behavior change).\n *\n * Hosts plug their own implementations to bridge to Prometheus / OTel /\n * Sentry / Datadog without the framework taking a hard dependency on\n * any of them.\n */\nexport interface InstrumentOptions {\n    metrics?: MetricsRegistry;\n    errorReporter?: ErrorReporter;\n    /** Override the default `req_<uuid>` generator. */\n    generateRequestId?: () => string;\n    /** Response header that echoes the request id (default `X-Request-Id`). */\n    requestIdHeader?: string;\n    /**\n     * Wall clock for tests. Defaults to `Date.now`; only `now()` is\n     * called, so any monotonic source works.\n     */\n    now?: () => number;\n}\n\n/**\n * Wrap an HTTP route handler with the runtime's standard observability\n * lifecycle:\n *\n *   1. Resolve a request id from incoming `X-Request-Id` (or mint one).\n *   2. Set the request id on `req.requestId` and response header.\n *   3. Time the handler.\n *   4. Emit `http_requests_total{method,route,status}` counter and\n *      `http_request_duration_ms{method,route}` histogram.\n *   5. On thrown errors, emit `http_request_errors_total` and call\n *      `errorReporter.captureException` for 5xx.\n *   6. When the handler catches its own error and calls\n *      `errorResponseBase` (which leaves a side-channel\n *      `res.__obsRecordedError`), still call the error reporter.\n *\n * The wrapper does not catch the error — it re-throws so the host\n * server still gets a chance to render its own 500 page if needed.\n */\nexport function instrumentRouteHandler(\n    method: string,\n    route: string,\n    handler: (req: any, res: any) => unknown,\n    opts: InstrumentOptions = {},\n): (req: any, res: any) => Promise<void> {\n    const metrics = opts.metrics ?? new NoopMetricsRegistry();\n    const errorReporter = opts.errorReporter ?? new NoopErrorReporter();\n    const generateRequestId = opts.generateRequestId;\n    const requestIdHeader = opts.requestIdHeader ?? 'X-Request-Id';\n    const now = opts.now ?? Date.now;\n\n    return async (req: any, res: any) => {\n        const requestId = resolveRequestId(req?.headers, generateRequestId);\n        try {\n            (req as any).requestId = requestId;\n        } catch {\n            // frozen req object — fine, the header is the source of truth\n        }\n        if (typeof res?.header === 'function') {\n            try {\n                res.header(requestIdHeader, requestId);\n            } catch {\n                // adapter rejects header injection here — fine\n            }\n        }\n\n        // Capture the final status. We start at 200 (the adapter default\n        // when no status() is called) and override on status() calls via\n        // a tiny proxy.\n        let status = 200;\n        const origStatus =\n            typeof res?.status === 'function' ? res.status.bind(res) : undefined;\n        if (origStatus) {\n            res.status = (code: number) => {\n                status = code;\n                return origStatus(code);\n            };\n        }\n\n        const startedAt = now();\n        let threw = false;\n        try {\n            await handler(req, res);\n        } catch (err: any) {\n            threw = true;\n            status = err?.statusCode ?? 500;\n            metrics.counter(RUNTIME_METRICS.httpRequestErrorsTotal, { method, route });\n            if (status >= 500) {\n                safeReport(errorReporter, err, { requestId, method, route });\n            }\n            throw err;\n        } finally {\n            const elapsed = now() - startedAt;\n            metrics.counter(RUNTIME_METRICS.httpRequestsTotal, {\n                method,\n                route,\n                status: String(status),\n            });\n            metrics.histogram(\n                RUNTIME_METRICS.httpRequestDurationMs,\n                elapsed,\n                { method, route },\n            );\n            // Side-channel: handler caught the error and called\n            // errorResponseBase, which recorded the original error on\n            // `res.__obsRecordedError`. Pick it up so 5xx still\n            // reaches the reporter even though we did not see the throw.\n            if (!threw && status >= 500) {\n                const recorded = (res as any)?.__obsRecordedError;\n                if (recorded !== undefined) {\n                    safeReport(errorReporter, recorded, { requestId, method, route });\n                }\n            }\n        }\n    };\n}\n\nfunction safeReport(\n    reporter: ErrorReporter,\n    err: unknown,\n    ctx: Record<string, unknown>,\n): void {\n    try {\n        reporter.captureException(err, ctx);\n    } catch {\n        // never let reporter failures mask the original error\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { Plugin, PluginContext } from '@objectstack/core';\nimport {\n    OBSERVABILITY_METRICS_SERVICE,\n    OBSERVABILITY_ERRORS_SERVICE,\n} from '@objectstack/observability';\nimport {\n    NoopMetricsRegistry,\n    NoopErrorReporter,\n    type MetricsRegistry,\n    type ErrorReporter,\n} from './index.js';\n\n/**\n * Canonical service names other plugins look up to find the host's\n * configured observability backends. Re-exported from\n * `@objectstack/observability` so callers can grab them alongside the\n * plugin without straddling two packages.\n */\nexport { OBSERVABILITY_METRICS_SERVICE, OBSERVABILITY_ERRORS_SERVICE };\n\n/**\n * Options for {@link ObservabilityServicePlugin}.\n *\n * Either or both backends can be omitted; the omitted one resolves to\n * the corresponding no-op exporter so consumers can always rely on the\n * service being present.\n */\nexport interface ObservabilityServicePluginOptions {\n    /** Metrics backend (e.g. `ConsoleMetricsRegistry`, `OtlpHttpMetricsRegistry`). */\n    metrics?: MetricsRegistry;\n    /** Error reporter backend (e.g. Sentry adapter). */\n    errors?: ErrorReporter;\n}\n\n/**\n * `ObservabilityServicePlugin` — registers the host's\n * {@link MetricsRegistry} and {@link ErrorReporter} in the kernel\n * service registry under the canonical names so any other plugin can\n * look them up without each host having to thread observability config\n * through every plugin constructor.\n *\n * Resolution chain other plugins should follow:\n *\n *   1. Explicit option on the plugin's own options object (escape\n *      hatch for tests / explicit wiring).\n *   2. `ctx.getService(OBSERVABILITY_METRICS_SERVICE)`.\n *   3. `NoopMetricsRegistry()` — never null.\n *\n * Register this plugin **before** any plugin that wants to consume the\n * services (cache, storage, dispatcher), otherwise the consumer's\n * `init` will fall through to the no-op default.\n *\n * @example\n * ```ts\n * import { ObjectKernel } from '@objectstack/core';\n * import {\n *   ObservabilityServicePlugin,\n *   CacheServicePlugin,\n * } from '@objectstack/runtime';\n * import { ConsoleMetricsRegistry } from '@objectstack/observability';\n *\n * const kernel = new ObjectKernel();\n * kernel.use(new ObservabilityServicePlugin({\n *   metrics: new ConsoleMetricsRegistry(),\n * }));\n * kernel.use(new CacheServicePlugin()); // picks metrics up automatically\n * ```\n */\nexport class ObservabilityServicePlugin implements Plugin {\n    name = 'com.objectstack.observability.service';\n    version = '1.0.0';\n    type = 'standard';\n\n    private readonly options: ObservabilityServicePluginOptions;\n\n    constructor(options: ObservabilityServicePluginOptions = {}) {\n        this.options = options;\n    }\n\n    async init(ctx: PluginContext): Promise<void> {\n        const metrics = this.options.metrics ?? new NoopMetricsRegistry();\n        const errors = this.options.errors ?? new NoopErrorReporter();\n        ctx.registerService(OBSERVABILITY_METRICS_SERVICE, metrics);\n        ctx.registerService(OBSERVABILITY_ERRORS_SERVICE, errors);\n        ctx.logger.info(\n            `ObservabilityServicePlugin: registered metrics=${(metrics as any).constructor?.name ?? 'unknown'} errors=${(errors as any).constructor?.name ?? 'unknown'}`,\n        );\n    }\n}\n\n/**\n * Helper used by consumer plugins to resolve a metrics backend with\n * the canonical fallback chain. Never throws; always returns a usable\n * `MetricsRegistry`.\n *\n * @param ctx        the consuming plugin's `PluginContext`\n * @param override   explicit option set on the consuming plugin (wins)\n */\nexport function resolveMetrics(\n    ctx: PluginContext,\n    override?: MetricsRegistry,\n): MetricsRegistry {\n    if (override) return override;\n    try {\n        const m = ctx.getService<MetricsRegistry | undefined>(OBSERVABILITY_METRICS_SERVICE);\n        if (m) return m;\n    } catch {\n        // Service not registered — fall through to the noop default.\n    }\n    return new NoopMetricsRegistry();\n}\n\n/**\n * Sibling of {@link resolveMetrics} for {@link ErrorReporter}.\n */\nexport function resolveErrorReporter(\n    ctx: PluginContext,\n    override?: ErrorReporter,\n): ErrorReporter {\n    if (override) return override;\n    try {\n        const e = ctx.getService<ErrorReporter | undefined>(OBSERVABILITY_ERRORS_SERVICE);\n        if (e) return e;\n    } catch {\n        // Service not registered — fall through to the noop default.\n    }\n    return new NoopErrorReporter();\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Plugin, PluginContext, IHttpServer } from '@objectstack/core';\nimport { HttpDispatcher, HttpDispatcherResult } from './http-dispatcher.js';\nimport {\n    buildSecurityHeaders,\n    type SecurityHeadersOptions,\n} from './security/index.js';\nimport {\n    NoopMetricsRegistry,\n    NoopErrorReporter,\n    instrumentRouteHandler,\n    type MetricsRegistry,\n    type ErrorReporter,\n} from './observability/index.js';\n\nexport interface DispatcherPluginConfig {\n    /**\n     * API path prefix for all endpoints.\n     * @default '/api/v1'\n     */\n    prefix?: string;\n\n    /**\n     * Project-scoping configuration. Must match the REST API\n     * `enableProjectScoping` / `projectResolution` fields so AI / automation\n     * routes stay in lockstep with /data and /meta.\n     *\n     * When `enableProjectScoping` is true and `projectResolution` is:\n     *   - `required` — only `/environments/:environmentId/...` variants are registered.\n     *   - `optional` / `auto` — both unscoped and scoped variants are registered\n     *     (the scoped handler forwards `req.params.environmentId` into context).\n     */\n    scoping?: {\n        enableProjectScoping?: boolean;\n        projectResolution?: 'required' | 'optional' | 'auto';\n    };\n\n    /**\n     * Enforce per-project membership (`sys_environment_member`) on scoped\n     * data-plane routes. Returns 403 for non-members unless they are\n     * staff (platform org) or the project is the well-known system\n     * project.\n     *\n     * Defaults to `true` when `scoping.enableProjectScoping` is enabled;\n     * explicitly set to `false` for tests and single-tenant deployments\n     * where membership has not been seeded.\n     */\n    enforceProjectMembership?: boolean;\n\n    /**\n     * Security response headers. When provided, every response routed\n     * through this plugin gets the headers merged in (route-specific\n     * headers still win on conflict).\n     *\n     * Pass `false` to disable. Pass `true` (or omit) to enable with\n     * conservative API-server defaults (CSP=deny-all, XCTO=nosniff,\n     * X-Frame-Options=DENY, etc.). Pass an object to customize — see\n     * {@link SecurityHeadersOptions}.\n     *\n     * @default true\n     */\n    securityHeaders?: boolean | SecurityHeadersOptions;\n\n    /**\n     * Observability wiring. All fields optional; defaults are noop\n     * (zero overhead, no behavior change).\n     *\n     *   - `metrics`: registry receiving `http_requests_total`,\n     *     `http_request_duration_ms`, `http_request_errors_total` for\n     *     every route this plugin mounts. Plug in `prom-client` /\n     *     `@opentelemetry/api-metrics` / your own adapter.\n     *\n     *   - `errorReporter`: invoked on 5xx responses with the thrown\n     *     error and `{ requestId, method, route }`. Plug in Sentry /\n     *     Datadog / Rollbar.\n     *\n     *   - `generateRequestId`: customize the format of minted request\n     *     ids (default: `req_<uuid>` via `crypto.randomUUID`). The\n     *     incoming `X-Request-Id` header is honored when present and\n     *     well-formed, regardless of this setting.\n     *\n     *   - `requestIdHeader`: response header name to echo the id back\n     *     on. Defaults to `X-Request-Id`.\n     */\n    observability?: {\n        metrics?: MetricsRegistry;\n        errorReporter?: ErrorReporter;\n        generateRequestId?: () => string;\n        requestIdHeader?: string;\n    };\n}\n\n/**\n * Route definition emitted by service plugins (e.g. AIServicePlugin) via hooks.\n * Minimal interface — matches the shape produced by `buildAIRoutes()`.\n */\ninterface RouteDefinition {\n    method: 'GET' | 'POST' | 'DELETE';\n    path: string;\n    description: string;\n    handler: (req: any) => Promise<any>;\n}\n\n/**\n * Register a single RouteDefinition on the HTTP server.\n * Returns true if the route was successfully registered.\n */\nfunction mountRouteOnServer(\n    route: RouteDefinition,\n    server: IHttpServer,\n    routePath: string,\n    securityHeaders?: Record<string, string>,\n): boolean {\n    const handler = async (req: any, res: any) => {\n        try {\n            const result = await route.handler({\n                body: req.body,\n                params: req.params,\n                query: req.query,\n            });\n\n            if (result.stream && result.events) {\n                // SSE streaming response\n                res.status(result.status);\n\n                if (securityHeaders) {\n                    for (const [k, v] of Object.entries(securityHeaders)) {\n                        res.header(k, v);\n                    }\n                }\n\n                // Apply headers from the route result if available\n                if (result.headers) {\n                    for (const [k, v] of Object.entries(result.headers)) {\n                        res.header(k, String(v));\n                    }\n                } else {\n                    res.header('Content-Type', 'text/event-stream');\n                    res.header('Cache-Control', 'no-cache');\n                    res.header('Connection', 'keep-alive');\n                }\n\n                // Write the stream — events are pre-encoded SSE strings\n                if (typeof res.write === 'function' && typeof res.end === 'function') {\n                    for await (const event of result.events) {\n                        res.write(typeof event === 'string' ? event : `data: ${JSON.stringify(event)}\\n\\n`);\n                    }\n                    res.end();\n                } else {\n                    // Fallback: collect events into array\n                    const events = [];\n                    for await (const event of result.events) {\n                        events.push(event);\n                    }\n                    res.json({ events });\n                }\n            } else {\n                res.status(result.status);\n                if (securityHeaders) {\n                    for (const [k, v] of Object.entries(securityHeaders)) {\n                        res.header(k, v);\n                    }\n                }\n                if (result.body !== undefined) {\n                    res.json(result.body);\n                } else {\n                    res.end();\n                }\n            }\n        } catch (err: any) {\n            errorResponseBase(err, res, securityHeaders);\n        }\n    };\n\n    const m = route.method.toLowerCase();\n    if (m === 'get' && typeof server.get === 'function') {\n        server.get(routePath, handler);\n        return true;\n    } else if (m === 'post' && typeof server.post === 'function') {\n        server.post(routePath, handler);\n        return true;\n    } else if (m === 'delete' && typeof server.delete === 'function') {\n        server.delete(routePath, handler);\n        return true;\n    }\n    return false;\n}\n\n/**\n * Send an HttpDispatcherResult through IHttpResponse.\n * Differentiates between handled, unhandled (404), and special results.\n *\n * @param securityHeaders headers to merge into every response (under\n * the route-specific headers so the dispatcher can override on a\n * per-route basis when truly needed).\n */\nfunction sendResultBase(\n    result: HttpDispatcherResult,\n    res: any,\n    securityHeaders?: Record<string, string>,\n): void {\n    const applySecurityHeaders = () => {\n        if (!securityHeaders) return;\n        for (const [k, v] of Object.entries(securityHeaders)) {\n            // Don't clobber route-set headers — `res.header` semantics\n            // vary by adapter, so we set unconditionally and rely on the\n            // call ordering (security headers first, route headers\n            // overwrite below).\n            res.header(k, v);\n        }\n    };\n\n    if (result.handled) {\n        if (result.response) {\n            res.status(result.response.status);\n            applySecurityHeaders();\n            if (result.response.headers) {\n                for (const [k, v] of Object.entries(result.response.headers)) {\n                    res.header(k, v);\n                }\n            }\n            res.json(result.response.body);\n            return;\n        }\n        if (result.result) {\n            // Special results from the dispatcher's `result.result` channel.\n            // Currently the only shape we handle here is the SSE/streaming\n            // descriptor returned by AI routes:\n            //   { status, stream: true, events: AsyncIterable<string>,\n            //     headers?: Record<string, string>, contentType?: string }\n            // Anything else falls through to JSON so older callers keep\n            // working.\n            const r = result.result as any;\n            const isStream = r && typeof r === 'object' && (r.type === 'stream' || r.stream === true) && r.events;\n            if (isStream && typeof res.write === 'function' && typeof res.end === 'function') {\n                res.status(typeof r.status === 'number' ? r.status : 200);\n                applySecurityHeaders();\n                if (r.headers && typeof r.headers === 'object') {\n                    for (const [k, v] of Object.entries(r.headers)) {\n                        res.header(k, String(v));\n                    }\n                } else {\n                    res.header('Content-Type', r.contentType || 'text/event-stream');\n                    res.header('Cache-Control', 'no-cache');\n                    res.header('Connection', 'keep-alive');\n                }\n                // Flip the adapter's `isStreaming` flag synchronously so the\n                // outer handler can return before the AsyncIterable is fully\n                // drained. Without this empty write, the Hono adapter would\n                // see no streaming activity by the time the route handler\n                // resolves and would close the body, truncating the SSE.\n                res.write('');\n                // Drain the events in the background; the adapter's\n                // ReadableStream stays open until res.end() fires.\n                (async () => {\n                    try {\n                        for await (const event of r.events as AsyncIterable<unknown>) {\n                            if (event == null) continue;\n                            res.write(typeof event === 'string' ? event : `data: ${JSON.stringify(event)}\\n\\n`);\n                        }\n                    } catch (streamErr) {\n                        try {\n                            res.write(`event: error\\ndata: ${JSON.stringify({ message: streamErr instanceof Error ? streamErr.message : String(streamErr) })}\\n\\n`);\n                        } catch { /* connection already gone */ }\n                    } finally {\n                        try { res.end(); } catch { /* idem */ }\n                    }\n                })();\n                return;\n            }\n            res.status(200);\n            applySecurityHeaders();\n            res.json(result.result);\n            return;\n        }\n    }\n    // Semantic 404: no route matched — include diagnostic info\n    res.status(404);\n    applySecurityHeaders();\n    res.json({\n        success: false,\n        error: {\n            message: 'Not Found',\n            code: 404,\n            type: 'ROUTE_NOT_FOUND',\n            hint: 'No handler matched this request. Check the API discovery endpoint for available routes.',\n        },\n    });\n}\n\nfunction errorResponseBase(err: any, res: any, securityHeaders?: Record<string, string>): void {\n    const code = err.statusCode || 500;\n    res.status(code);\n    if (securityHeaders) {\n        for (const [k, v] of Object.entries(securityHeaders)) {\n            res.header(k, v);\n        }\n    }\n    // Side-channel: remember the original error so the observability\n    // wrapper can hand it to errorReporter on 5xx. Handlers catch the\n    // error and call us here instead of re-throwing, so this is the\n    // only place we still have it.\n    if (code >= 500) {\n        try {\n            (res as any).__obsRecordedError = err;\n        } catch {\n            // res is a frozen / proxy object — skip\n        }\n    }\n    res.json({\n        success: false,\n        error: { message: err.message || 'Internal Server Error', code },\n    });\n}\n\n/**\n * Dispatcher Plugin\n *\n * Bridges legacy HttpDispatcher handlers to the IHttpServer route-registration model.\n * Registers routes for domains NOT covered by @objectstack/rest:\n *   - /.well-known/objectstack (discovery)\n *   - /auth      (authentication)\n *   - /graphql   (GraphQL)\n *   - /analytics (BI queries)\n *   - /packages  (package management)\n *   - /i18n      (internationalization — locales, translations, field labels)\n *   - /storage   (file storage)\n *   - /automation (CRUD + triggers + runs)\n *\n * Usage:\n * ```ts\n * import { createDispatcherPlugin } from '@objectstack/runtime';\n * runtime.use(createDispatcherPlugin({ prefix: '/api/v1' }));\n * ```\n */\nexport function createDispatcherPlugin(config: DispatcherPluginConfig = {}): Plugin {\n    return {\n        name: 'com.objectstack.runtime.dispatcher',\n        version: '1.0.0',\n\n        init: async (_ctx: PluginContext) => {\n            // Consumer-only plugin — no services registered\n        },\n\n        start: async (ctx: PluginContext) => {\n            let server: IHttpServer | undefined;\n            try {\n                server = ctx.getService<IHttpServer>('http.server');\n            } catch {\n                // No HTTP server available — skip silently\n                return;\n            }\n            if (!server) return;\n\n            const kernel = ctx.getKernel();\n            // Default: enable membership enforcement iff environment-scoping is on.\n            // Tests / single-tenant deploys can opt out via the explicit flag.\n            const enforceMembership =\n                config.enforceProjectMembership ?? (config.scoping?.enableProjectScoping ?? false);\n            const dispatcher = new HttpDispatcher(kernel, undefined, {\n                enforceProjectMembership: enforceMembership,\n            });\n            const prefix = config.prefix || '/api/v1';\n\n            // ── Security: resolve once at startup; applied on every response.\n            // Defaults to ON because every production API server should be\n            // sending these headers. Opt out with `securityHeaders: false`\n            // (only sensible for tests or when an upstream reverse proxy is\n            // already setting them).\n            const securityHeaders: Record<string, string> | undefined =\n                config.securityHeaders === false\n                    ? undefined\n                    : buildSecurityHeaders(\n                          typeof config.securityHeaders === 'object'\n                              ? config.securityHeaders\n                              : {},\n                      );\n\n            // Locally-shadowed wrappers — every `sendResult(...)` /\n            // `errorResponse(...)` call below picks these up via lexical\n            // scope, so the 50+ route handlers don't need to thread the\n            // security headers through manually.\n            const sendResult = (result: HttpDispatcherResult, res: any) =>\n                sendResultBase(result, res, securityHeaders);\n            const errorResponse = (err: any, res: any) =>\n                errorResponseBase(err, res, securityHeaders);\n\n            // ── Observability ──────────────────────────────────────────\n            // Noop defaults; production hosts inject real adapters.\n            const metrics: MetricsRegistry =\n                config.observability?.metrics ?? new NoopMetricsRegistry();\n            const errorReporter: ErrorReporter =\n                config.observability?.errorReporter ?? new NoopErrorReporter();\n            const generateRequestId = config.observability?.generateRequestId;\n            const requestIdHeader =\n                config.observability?.requestIdHeader ?? 'X-Request-Id';\n\n            /**\n             * Wrap the IHttpServer so every route registration is\n             * automatically instrumented. We only override the three\n             * verb methods the dispatcher uses; everything else passes\n             * through unchanged.\n             */\n            const rawServer = server;\n            server = new Proxy(rawServer, {\n                get(target, prop, receiver) {\n                    if (prop === 'get' || prop === 'post' || prop === 'delete') {\n                        const method = String(prop).toUpperCase();\n                        const original = (target as any)[prop];\n                        if (typeof original !== 'function') return original;\n                        return (route: string, handler: any) => {\n                            return original.call(\n                                target,\n                                route,\n                                instrumentRouteHandler(method, route, handler, {\n                                    metrics,\n                                    errorReporter,\n                                    generateRequestId,\n                                    requestIdHeader,\n                                }),\n                            );\n                        };\n                    }\n                    return Reflect.get(target, prop, receiver);\n                },\n            }) as IHttpServer;\n\n            // ── Discovery (.well-known) ─────────────────────────────────\n            server.get('/.well-known/objectstack', async (_req: any, res: any) => {\n                if (securityHeaders) {\n                    for (const [k, v] of Object.entries(securityHeaders)) {\n                        res.header(k, v);\n                    }\n                }\n                res.json({ data: await dispatcher.getDiscoveryInfo(prefix) });\n            });\n\n            // ── Discovery (versioned API path) ──────────────────────────\n            server.get(`${prefix}/discovery`, async (_req: any, res: any) => {\n                if (securityHeaders) {\n                    for (const [k, v] of Object.entries(securityHeaders)) {\n                        res.header(k, v);\n                    }\n                }\n                res.json({ data: await dispatcher.getDiscoveryInfo(prefix) });\n            });\n\n            // ── Health ──────────────────────────────────────────────────\n            server.get(`${prefix}/health`, async (_req: any, res: any) => {\n                try {\n                    const result = await dispatcher.dispatch('GET', '/health', undefined, {}, { request: _req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── Auth ────────────────────────────────────────────────────\n            // NOTE: /auth/* wildcard is mounted by AuthProxyPlugin (cloud)\n            // or AuthPlugin (single-tenant) directly on the raw Hono app —\n            // those handlers can return native Web `Response` objects which\n            // is what better-auth produces. The dispatcher cannot represent\n            // a streaming Response cleanly through `IHttpServer.send`, so\n            // we deliberately do NOT register a dispatcher wildcard here.\n            //\n            // Legacy explicit /auth/login retained for self-hosted clients\n            // that still POST there; superseded by the wildcard above for\n            // the better-auth surface (sign-up/email, sign-in/email, …).\n            server.post(`${prefix}/auth/login`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleAuth('login', 'POST', req.body, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── GraphQL ─────────────────────────────────────────────────\n            server.post(`${prefix}/graphql`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleGraphQL(req.body, { request: req });\n                    if (securityHeaders) {\n                        for (const [k, v] of Object.entries(securityHeaders)) {\n                            res.header(k, v);\n                        }\n                    }\n                    res.json(result);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── Analytics ───────────────────────────────────────────────\n            // Route via dispatch() (not handleAnalytics directly) so the host\n            // dispatcher's project-aware kernel swap runs first — the per-project\n            // kernel owns the `analytics` service (registered by ObjectQLPlugin).\n            server.post(`${prefix}/analytics/query`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.dispatch('POST', '/analytics/query', req.body, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/analytics/meta`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.dispatch('GET', '/analytics/meta', undefined, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/analytics/sql`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.dispatch('POST', '/analytics/sql', req.body, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── Packages ────────────────────────────────────────────────\n            server.get(`${prefix}/packages`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handlePackages('', 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/packages`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handlePackages('', 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/packages/:id`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handlePackages(`/${req.params.id}`, 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.delete(`${prefix}/packages/:id`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handlePackages(`/${req.params.id}`, 'DELETE', {}, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.patch(`${prefix}/packages/:id/enable`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handlePackages(`/${req.params.id}/enable`, 'PATCH', {}, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.patch(`${prefix}/packages/:id/disable`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handlePackages(`/${req.params.id}/disable`, 'PATCH', {}, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/packages/:id/publish`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handlePackages(`/${req.params.id}/publish`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/packages/:id/revert`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handlePackages(`/${req.params.id}/revert`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── Cloud (Projects) ─────────────────────────────────────\n            server.get(`${prefix}/cloud/drivers`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud('/drivers', 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // POST /cloud/admin/platform-sso/backfill — idempotent admin trigger\n            // for retro-fitting sys_oauth_application rows when boot-time\n            // backfill plugin races/fails. Authenticated by Bearer == OS_AUTH_SECRET\n            // (validated inside handleCloud).\n            server.post(`${prefix}/cloud/admin/platform-sso/backfill`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud('/admin/platform-sso/backfill', 'POST', req.body, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/cloud/templates`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud('/templates', 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/cloud/environments`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud('/projects', 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/cloud/environments`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud('/projects', 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/cloud/environments/:id`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}`, 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.patch(`${prefix}/cloud/environments/:id`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}`, 'PATCH', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.delete(`${prefix}/cloud/environments/:id`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}`, 'DELETE', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.delete(`${prefix}/cloud/organizations/:id`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/organizations/${req.params.id}`, 'DELETE', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/cloud/environments/:id/hostname`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/hostname`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.put(`${prefix}/cloud/environments/:id/hostname`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/hostname`, 'PUT', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/cloud/environments/:id/rotate-credential`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/rotate-credential`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // Alias expected by @objectstack/client: POST /projects/:id/credentials/rotate\n            server.post(`${prefix}/cloud/environments/:id/credentials/rotate`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/credentials/rotate`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/cloud/environments/:id/activate`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/activate`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/cloud/environments/:id/retry`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/retry`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/cloud/environments/:id/members`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/members`, 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/cloud/environments/:id/members`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/members`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.patch(`${prefix}/cloud/environments/:id/members/:memberId`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/members/${req.params.memberId}`, 'PATCH', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.delete(`${prefix}/cloud/environments/:id/members/:memberId`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/members/${req.params.memberId}`, 'DELETE', req.body ?? {}, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── Cloud — Per-project packages ─────────────────────────────────\n            server.get(`${prefix}/cloud/environments/:id/packages`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/packages`, 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/cloud/environments/:id/packages`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/packages`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/cloud/environments/:id/packages/:pkgId`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/packages/${req.params.pkgId}`, 'GET', {}, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.delete(`${prefix}/cloud/environments/:id/packages/:pkgId`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/packages/${req.params.pkgId}`, 'DELETE', {}, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.patch(`${prefix}/cloud/environments/:id/packages/:pkgId/enable`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/packages/${req.params.pkgId}/enable`, 'PATCH', {}, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.patch(`${prefix}/cloud/environments/:id/packages/:pkgId/disable`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/packages/${req.params.pkgId}/disable`, 'PATCH', {}, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.post(`${prefix}/cloud/environments/:id/packages/:pkgId/upgrade`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleCloud(`/projects/${req.params.id}/packages/${req.params.pkgId}/upgrade`, 'POST', req.body, {}, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── Storage ─────────────────────────────────────────────────\n            server.post(`${prefix}/storage/upload`, async (req: any, res: any) => {\n                try {\n                    // For file uploads the body *is* the file (parsed by adapter)\n                    const result = await dispatcher.handleStorage('upload', 'POST', req.body, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/storage/file/:id`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.handleStorage(`file/${req.params.id}`, 'GET', undefined, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── i18n ────────────────────────────────────────────────────\n            // Route via dispatch() (not handleI18n directly) so the host\n            // dispatcher's project-aware kernel swap runs first. Without this,\n            // i18n requests hit the host kernel's in-memory fallback (which\n            // is always empty) instead of the per-project I18nServicePlugin\n            // populated by ArtifactKernelFactory with the artifact's\n            // translation bundles.\n            server.get(`${prefix}/i18n/locales`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.dispatch('GET', '/i18n/locales', undefined, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/i18n/translations/:locale`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.dispatch('GET', `/i18n/translations/${req.params.locale}`, undefined, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            server.get(`${prefix}/i18n/labels/:object/:locale`, async (req: any, res: any) => {\n                try {\n                    const result = await dispatcher.dispatch('GET', `/i18n/labels/${req.params.object}/${req.params.locale}`, undefined, req.query, { request: req });\n                    sendResult(result, res);\n                } catch (err: any) {\n                    errorResponse(err, res);\n                }\n            });\n\n            // ── Automation ──────────────────────────────────────────────\n            // Registered at both `${prefix}/automation/...` and\n            // `${prefix}/environments/:environmentId/automation/...` when project\n            // scoping is enabled. Always dispatched through\n            // `dispatcher.dispatch()` so the multi-kernel host can swap\n            // to the per-project kernel before resolving the\n            // `automation` service (which lives on the project kernel,\n            // not the host kernel, in ObjectOS multi-tenant mode).\n            const registerAutomationRoutes = (base: string) => {\n                server!.get(`${base}/automation`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('GET', '/automation', undefined, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.post(`${base}/automation`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('POST', '/automation', req.body, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.get(`${base}/automation/:name`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('GET', `/automation/${req.params.name}`, undefined, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.put(`${base}/automation/:name`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('PUT', `/automation/${req.params.name}`, req.body, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.delete(`${base}/automation/:name`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('DELETE', `/automation/${req.params.name}`, undefined, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.post(`${base}/automation/trigger/:name`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('POST', `/automation/trigger/${req.params.name}`, req.body, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.post(`${base}/automation/:name/trigger`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('POST', `/automation/${req.params.name}/trigger`, req.body, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.post(`${base}/automation/:name/toggle`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('POST', `/automation/${req.params.name}/toggle`, req.body, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.get(`${base}/automation/:name/runs`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('GET', `/automation/${req.params.name}/runs`, undefined, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n\n                server!.get(`${base}/automation/:name/runs/:runId`, async (req: any, res: any) => {\n                    try {\n                        const result = await dispatcher.dispatch('GET', `/automation/${req.params.name}/runs/${req.params.runId}`, undefined, req.query, { request: req });\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n            };\n\n            // ── AI / Assistants ─────────────────────────────────────────\n            // The AI service plugin registers a large, dynamic surface\n            // (chat, models, conversations, tools, agents, assistants)\n            // whose exact routes are built at start() time from the\n            // service's tool / agent registries. To support multi-tenant\n            // hosts where the AI service lives on per-project kernels,\n            // mount a method-wildcard catch-all that always dispatches\n            // through `dispatcher.dispatch()` — that triggers the kernel\n            // swap and then routes via `handleAI`, which looks up the\n            // AI service on the current (project) kernel.\n            const registerAIRoutes = (base: string) => {\n                const wildcards: Array<['get'|'post'|'delete'|'put', string]> = [\n                    ['get', `${base}/ai/*`],\n                    ['post', `${base}/ai/*`],\n                    ['delete', `${base}/ai/*`],\n                    ['put', `${base}/ai/*`],\n                ];\n                for (const [method, pattern] of wildcards) {\n                    (server as any)![method](pattern, async (req: any, res: any) => {\n                        try {\n                            // Reconstruct the AI subpath without the prefix\n                            // so dispatch() routes via the /ai branch.\n                            const fullPath: string = req.path ?? '';\n                            const idx = fullPath.lastIndexOf('/ai');\n                            const aiSubPath = idx >= 0 ? fullPath.slice(idx) : '/ai';\n                            const result = await dispatcher.dispatch(method.toUpperCase(), aiSubPath, req.body, req.query, { request: req });\n                            sendResult(result, res);\n                        } catch (err: any) {\n                            errorResponse(err, res);\n                        }\n                    });\n                }\n            };\n\n            // ── Actions (server-registered handlers, e.g. CRM convertLead) ───\n            // Bridges UI `script` / `modal` actions to ObjectQL handlers\n            // registered via `engine.registerAction(object, action, fn)`.\n            const registerActionRoutes = (base: string) => {\n                server!.post(`${base}/actions/:object/:action`, async (req: any, res: any) => {\n                    try {\n                        const ctx: any = { request: req };\n                        if (req.params?.environmentId) ctx.environmentId = req.params.environmentId;\n                        const result = await dispatcher.handleActions(`/${req.params.object}/${req.params.action}`, 'POST', req.body, ctx);\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n                server!.post(`${base}/actions/:object/:action/:recordId`, async (req: any, res: any) => {\n                    try {\n                        const ctx: any = { request: req };\n                        if (req.params?.environmentId) ctx.environmentId = req.params.environmentId;\n                        const result = await dispatcher.handleActions(`/${req.params.object}/${req.params.action}/${req.params.recordId}`, 'POST', req.body, ctx);\n                        sendResult(result, res);\n                    } catch (err: any) {\n                        errorResponse(err, res);\n                    }\n                });\n            };\n\n            const enableProjectScoping = config.scoping?.enableProjectScoping ?? false;\n            const projectResolution = config.scoping?.projectResolution ?? 'auto';\n\n            if (enableProjectScoping && projectResolution === 'required') {\n                registerAutomationRoutes(`${prefix}/environments/:environmentId`);\n                registerActionRoutes(`${prefix}/environments/:environmentId`);\n                registerAIRoutes(`${prefix}/environments/:environmentId`);\n            } else {\n                registerAutomationRoutes(prefix);\n                registerActionRoutes(prefix);\n                registerAIRoutes(prefix);\n                if (enableProjectScoping) {\n                    registerAutomationRoutes(`${prefix}/environments/:environmentId`);\n                    registerActionRoutes(`${prefix}/environments/:environmentId`);\n                    registerAIRoutes(`${prefix}/environments/:environmentId`);\n                }\n            }\n\n            ctx.logger.info('Dispatcher bridge routes registered', { prefix, enableProjectScoping, projectResolution });\n\n            // ── Dynamic service routes (AI, etc.) ───────────────────\n            // Listen for route definitions emitted by service plugins.\n            // The AIServicePlugin emits 'ai:routes' with RouteDefinition[].\n            //\n            // When environment-scoping is enabled, each AI route is mounted on\n            // BOTH `${prefix}${path}` and `${prefix}/environments/:environmentId${path}`\n            // (or only the scoped variant when `projectResolution === 'required'`).\n            const toScopedPath = (routePath: string): string => {\n                // routePath may already include /api/v1; splice /environments/:environmentId\n                // after the `${prefix}` portion to produce the scoped variant.\n                if (routePath.startsWith(prefix)) {\n                    const tail = routePath.slice(prefix.length);\n                    return `${prefix}/environments/:environmentId${tail}`;\n                }\n                return `/environments/:environmentId${routePath}`;\n            };\n\n            const mountAiRoute = (route: RouteDefinition) => {\n                if (!server) return 0;\n                const routePath = route.path.startsWith('/api/v1')\n                    ? route.path\n                    : `${prefix}${route.path}`;\n\n                let count = 0;\n                if (enableProjectScoping && projectResolution === 'required') {\n                    if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders)) count++;\n                } else {\n                    if (mountRouteOnServer(route, server, routePath, securityHeaders)) count++;\n                    if (enableProjectScoping) {\n                        if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders)) count++;\n                    }\n                }\n                return count;\n            };\n\n            ctx.hook('ai:routes', async (routes: RouteDefinition[]) => {\n                if (!server) return;\n                let total = 0;\n                for (const route of routes) {\n                    total += mountAiRoute(route);\n                }\n                ctx.logger.info(`[Dispatcher] Registered ${total} AI route mount(s) from ${routes.length} definition(s)`);\n            });\n\n            // ── Fallback: recover routes cached before hook was registered ──\n            // If AIServicePlugin.start() ran before DispatcherPlugin.start()\n            // (possible when plugin start order differs from registration order),\n            // the 'ai:routes' trigger fires with no listener. The AIServicePlugin\n            // caches the routes on the kernel as __aiRoutes (see AIServicePlugin.start())\n            // as an internal cross-plugin protocol so we can recover them here.\n            // TODO: replace with a formal kernel.getCachedRoutes('ai') API in a future release.\n            const cachedRoutes = (kernel as any).__aiRoutes as RouteDefinition[] | undefined;\n            if (cachedRoutes && Array.isArray(cachedRoutes) && cachedRoutes.length > 0) {\n                let registered = 0;\n                for (const route of cachedRoutes) {\n                    registered += mountAiRoute(route);\n                }\n                if (registered > 0) {\n                    ctx.logger.info(`[Dispatcher] Recovered ${registered} cached AI route mount(s) (hook timing fallback)`);\n                }\n            }\n        },\n    };\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Plugin, PluginContext } from '@objectstack/core';\n\n/**\n * The well-known UUID for the built-in system project.\n * Kept in lockstep with `ProjectProvisioningService.provisionSystemEnvironment`.\n */\nexport const SYSTEM_ENVIRONMENT_ID = '00000000-0000-0000-0000-000000000001';\n\n/**\n * Minimal surface of `ProjectProvisioningService` consumed by the plugin.\n * Typed locally so the runtime package does not gain a hard dependency on\n * `@objectstack/service-tenant` — the service is discovered at runtime via\n * the kernel service registry.\n */\ninterface ProvisioningLike {\n  provisionSystemEnvironment(): Promise<{\n    project: { id: string; isSystem?: boolean };\n    warnings?: string[];\n  }>;\n}\n\nexport interface SystemEnvironmentPluginConfig {\n  /**\n   * Service name that resolves to a `ProjectProvisioningService`-shaped\n   * object. Defaults to `tenant.provisioning` (convention used by\n   * `@objectstack/service-tenant`).\n   */\n  serviceName?: string;\n\n  /**\n   * When true, plugin treats a missing provisioning service as an error.\n   * Defaults to false — bootstrap is opt-in and must no-op gracefully when\n   * the tenant package is not part of the stack.\n   */\n  strict?: boolean;\n}\n\n/**\n * System Project Bootstrap Plugin\n *\n * Ensures the built-in system project (well-known UUID\n * {@link SYSTEM_ENVIRONMENT_ID}) exists on the control plane the first time the\n * runtime starts. Calls are idempotent — `provisionSystemEnvironment()` returns\n * the existing row when the project has already been created.\n *\n * Register AFTER the tenant service is available so the provisioning service\n * can be resolved from the kernel.\n *\n * @example\n * ```ts\n * kernel.use(tenantPlugin);\n * kernel.use(createSystemEnvironmentPlugin());\n * ```\n */\nexport function createSystemEnvironmentPlugin(config: SystemEnvironmentPluginConfig = {}): Plugin {\n  const serviceName = config.serviceName ?? 'tenant.provisioning';\n\n  return {\n    name: 'com.objectstack.runtime.system-environment',\n    version: '1.0.0',\n\n    init: async (_ctx: PluginContext) => {\n      // Consumer-only plugin; nothing to register at init-time.\n    },\n\n    start: async (ctx: PluginContext) => {\n      let service: ProvisioningLike | undefined;\n      try {\n        service = ctx.getService<ProvisioningLike>(serviceName);\n      } catch {\n        // Service registry throws when the key is not found.\n        service = undefined;\n      }\n\n      if (!service || typeof service.provisionSystemEnvironment !== 'function') {\n        if (config.strict) {\n          throw new Error(\n            `[SystemEnvironmentPlugin] Provisioning service '${serviceName}' not found — cannot bootstrap system project.`,\n          );\n        }\n        ctx.logger.debug(\n          `[SystemEnvironmentPlugin] Provisioning service '${serviceName}' unavailable — system project bootstrap skipped.`,\n        );\n        return;\n      }\n\n      try {\n        const result = await service.provisionSystemEnvironment();\n        const warnings = result.warnings ?? [];\n        ctx.logger.info('[SystemEnvironmentPlugin] System project ready', {\n          environmentId: result.project.id,\n          isSystem: result.project.isSystem,\n          warnings,\n        });\n      } catch (err: any) {\n        if (config.strict) throw err;\n        ctx.logger.warn('[SystemEnvironmentPlugin] Failed to provision system project', {\n          error: err?.message ?? String(err),\n        });\n      }\n    },\n  };\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { IHttpServer, RouteHandler, Middleware } from '@objectstack/core';\n\n/**\n * HttpServer - Unified HTTP Server Abstraction\n * \n * Provides a framework-agnostic HTTP server interface that wraps\n * underlying server implementations (Hono, Express, Fastify, etc.)\n * \n * This class serves as an adapter between the IHttpServer interface\n * and concrete server implementations, allowing plugins to register\n * routes and middleware without depending on specific frameworks.\n * \n * Features:\n * - Unified route registration API\n * - Middleware management with ordering\n * - Request/response lifecycle hooks\n * - Framework-agnostic abstractions\n */\nexport class HttpServer implements IHttpServer {\n    protected server: IHttpServer;\n    protected routes: Map<string, RouteHandler>;\n    protected middlewares: Middleware[];\n    \n    /**\n     * Create an HTTP server wrapper\n     * @param server - The underlying server implementation (Hono, Express, etc.)\n     */\n    constructor(server: IHttpServer) {\n        this.server = server;\n        this.routes = new Map();\n        this.middlewares = [];\n    }\n    \n    /**\n     * Register a GET route handler\n     * @param path - Route path (e.g., '/api/users/:id')\n     * @param handler - Route handler function\n     */\n    get(path: string, handler: RouteHandler): void {\n        const key = `GET:${path}`;\n        this.routes.set(key, handler);\n        this.server.get(path, handler);\n    }\n    \n    /**\n     * Register a POST route handler\n     * @param path - Route path\n     * @param handler - Route handler function\n     */\n    post(path: string, handler: RouteHandler): void {\n        const key = `POST:${path}`;\n        this.routes.set(key, handler);\n        this.server.post(path, handler);\n    }\n    \n    /**\n     * Register a PUT route handler\n     * @param path - Route path\n     * @param handler - Route handler function\n     */\n    put(path: string, handler: RouteHandler): void {\n        const key = `PUT:${path}`;\n        this.routes.set(key, handler);\n        this.server.put(path, handler);\n    }\n    \n    /**\n     * Register a DELETE route handler\n     * @param path - Route path\n     * @param handler - Route handler function\n     */\n    delete(path: string, handler: RouteHandler): void {\n        const key = `DELETE:${path}`;\n        this.routes.set(key, handler);\n        this.server.delete(path, handler);\n    }\n    \n    /**\n     * Register a PATCH route handler\n     * @param path - Route path\n     * @param handler - Route handler function\n     */\n    patch(path: string, handler: RouteHandler): void {\n        const key = `PATCH:${path}`;\n        this.routes.set(key, handler);\n        this.server.patch(path, handler);\n    }\n    \n    /**\n     * Register middleware\n     * @param path - Optional path to apply middleware to (if omitted, applies globally)\n     * @param handler - Middleware function\n     */\n    use(path: string | Middleware, handler?: Middleware): void {\n        if (typeof path === 'function') {\n            // Global middleware\n            this.middlewares.push(path);\n            this.server.use(path);\n        } else if (handler) {\n            // Path-specific middleware\n            this.middlewares.push(handler);\n            this.server.use(path, handler);\n        }\n    }\n    \n    /**\n     * Start the HTTP server\n     * @param port - Port number to listen on\n     * @returns Promise that resolves when server is ready\n     */\n    async listen(port: number): Promise<void> {\n        await this.server.listen(port);\n    }\n    \n    /**\n     * Stop the HTTP server\n     * @returns Promise that resolves when server is stopped\n     */\n    async close(): Promise<void> {\n        if (this.server.close) {\n            await this.server.close();\n        }\n    }\n    \n    /**\n     * Get registered routes\n     * @returns Map of route keys to handlers\n     */\n    getRoutes(): Map<string, RouteHandler> {\n        return new Map(this.routes);\n    }\n    \n    /**\n     * Get registered middlewares\n     * @returns Array of middleware functions\n     */\n    getMiddlewares(): Middleware[] {\n        return [...this.middlewares];\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Middleware, IHttpRequest, IHttpResponse } from '@objectstack/core';\nimport { MiddlewareConfig, MiddlewareType } from '@objectstack/spec/system';\n\n/**\n * Middleware Entry\n * Internal representation of registered middleware\n */\ninterface MiddlewareEntry {\n    name: string;\n    type: MiddlewareType;\n    middleware: Middleware;\n    order: number;\n    enabled: boolean;\n    paths?: {\n        include?: string[];\n        exclude?: string[];\n    };\n}\n\n/**\n * MiddlewareManager\n * \n * Manages middleware registration, ordering, and execution.\n * Provides fine-grained control over middleware chains with:\n * - Execution order management\n * - Path-based filtering\n * - Enable/disable individual middleware\n * - Middleware categorization by type\n * \n * @example\n * const manager = new MiddlewareManager();\n * \n * // Register middleware with configuration\n * manager.register({\n *   name: 'auth',\n *   type: 'authentication',\n *   order: 10,\n *   paths: { exclude: ['/health', '/metrics'] }\n * }, authMiddleware);\n * \n * // Get sorted middleware chain\n * const chain = manager.getMiddlewareChain();\n * chain.forEach(mw => server.use(mw));\n */\nexport class MiddlewareManager {\n    private middlewares: Map<string, MiddlewareEntry>;\n    \n    constructor() {\n        this.middlewares = new Map();\n    }\n    \n    /**\n     * Register middleware with configuration\n     * @param config - Middleware configuration\n     * @param middleware - Middleware function\n     */\n    register(config: MiddlewareConfig, middleware: Middleware): void {\n        const entry: MiddlewareEntry = {\n            name: config.name,\n            type: config.type,\n            middleware,\n            order: config.order ?? 100,\n            enabled: config.enabled ?? true,\n            paths: config.paths,\n        };\n        \n        this.middlewares.set(config.name, entry);\n    }\n    \n    /**\n     * Unregister middleware by name\n     * @param name - Middleware name\n     */\n    unregister(name: string): void {\n        this.middlewares.delete(name);\n    }\n    \n    /**\n     * Enable middleware by name\n     * @param name - Middleware name\n     */\n    enable(name: string): void {\n        const entry = this.middlewares.get(name);\n        if (entry) {\n            entry.enabled = true;\n        }\n    }\n    \n    /**\n     * Disable middleware by name\n     * @param name - Middleware name\n     */\n    disable(name: string): void {\n        const entry = this.middlewares.get(name);\n        if (entry) {\n            entry.enabled = false;\n        }\n    }\n    \n    /**\n     * Get middleware entry by name\n     * @param name - Middleware name\n     */\n    get(name: string): MiddlewareEntry | undefined {\n        return this.middlewares.get(name);\n    }\n    \n    /**\n     * Get all middleware entries\n     */\n    getAll(): MiddlewareEntry[] {\n        return Array.from(this.middlewares.values());\n    }\n    \n    /**\n     * Get middleware by type\n     * @param type - Middleware type\n     */\n    getByType(type: MiddlewareType): MiddlewareEntry[] {\n        return this.getAll().filter(entry => entry.type === type);\n    }\n    \n    /**\n     * Get middleware chain sorted by order\n     * Returns only enabled middleware\n     */\n    getMiddlewareChain(): Middleware[] {\n        return this.getAll()\n            .filter(entry => entry.enabled)\n            .sort((a, b) => a.order - b.order)\n            .map(entry => entry.middleware);\n    }\n    \n    /**\n     * Get middleware chain with path filtering\n     * @param path - Request path to match against\n     */\n    getMiddlewareChainForPath(path: string): Middleware[] {\n        return this.getAll()\n            .filter(entry => {\n                if (!entry.enabled) return false;\n                \n                // Check path filters\n                if (entry.paths) {\n                    // Check exclude patterns\n                    if (entry.paths.exclude) {\n                        const excluded = entry.paths.exclude.some(pattern => \n                            this.matchPath(path, pattern)\n                        );\n                        if (excluded) return false;\n                    }\n                    \n                    // Check include patterns (if specified)\n                    if (entry.paths.include) {\n                        const included = entry.paths.include.some(pattern => \n                            this.matchPath(path, pattern)\n                        );\n                        if (!included) return false;\n                    }\n                }\n                \n                return true;\n            })\n            .sort((a, b) => a.order - b.order)\n            .map(entry => entry.middleware);\n    }\n    \n    /**\n     * Match path against pattern (simple glob matching)\n     * @param path - Request path\n     * @param pattern - Pattern to match (supports * wildcard)\n     */\n    private matchPath(path: string, pattern: string): boolean {\n        // Convert glob pattern to regex\n        const regexPattern = pattern\n            .replace(/\\*/g, '.*')\n            .replace(/\\?/g, '.');\n        \n        const regex = new RegExp(`^${regexPattern}$`);\n        return regex.test(path);\n    }\n    \n    /**\n     * Clear all middleware\n     */\n    clear(): void {\n        this.middlewares.clear();\n    }\n    \n    /**\n     * Get middleware count\n     */\n    count(): number {\n        return this.middlewares.size;\n    }\n    \n    /**\n     * Create a composite middleware from the chain\n     * This can be used to apply all middleware at once\n     */\n    createCompositeMiddleware(): Middleware {\n        const chain = this.getMiddlewareChain();\n        \n        return async (req: IHttpRequest, res: IHttpResponse, next: () => void | Promise<void>) => {\n            let index = 0;\n            \n            const executeNext = async (): Promise<void> => {\n                if (index >= chain.length) {\n                    await next();\n                    return;\n                }\n                \n                const middleware = chain[index++];\n                await middleware(req, res, executeNext);\n            };\n            \n            await executeNext();\n        };\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectKernel } from '@objectstack/core';\n\n/**\n * Factory contract for instantiating a per-project {@link ObjectKernel}.\n *\n * Given a `environmentId`, the factory is expected to:\n * 1. Read control-plane metadata (`sys_environment` + credentials + subscribed packages).\n * 2. Construct a fresh `ObjectKernel` with project-scoped driver + plugins + Apps.\n * 3. Return a **bootstrapped** kernel ready to serve requests.\n */\nexport interface EnvironmentKernelFactory {\n  create(environmentId: string): Promise<ObjectKernel>;\n}\n\ninterface CachedEntry {\n  kernel: ObjectKernel;\n  createdAt: number;\n  lastAccess: number;\n}\n\nexport interface KernelManagerConfig {\n  factory: EnvironmentKernelFactory;\n  /** Maximum number of kernels to keep resident. Defaults to 32. */\n  maxSize?: number;\n  /**\n   * Time-to-live (ms). Kernels idle longer than this are evicted on next\n   * access. `0` disables TTL expiry. Defaults to 15 minutes.\n   */\n  ttlMs?: number;\n  /**\n   * Optional logger (duck-typed). Falls back to `console` when omitted.\n   */\n  logger?: { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };\n}\n\n/**\n * LRU + TTL cache of per-project {@link ObjectKernel} instances.\n *\n * Implements ADR-0003 multi-kernel scheduling: each project gets an\n * isolated kernel (App/plugin/metadata namespaces) that is lazily built\n * on first request and evicted under memory / idle pressure. Concurrent\n * `getOrCreate()` calls for the same environmentId share a single in-flight\n * factory invocation (singleflight).\n */\nexport class KernelManager {\n  private readonly factory: EnvironmentKernelFactory;\n  private readonly maxSize: number;\n  private readonly ttlMs: number;\n  private readonly logger: NonNullable<KernelManagerConfig['logger']>;\n  private readonly cache = new Map<string, CachedEntry>();\n  private readonly pending = new Map<string, Promise<ObjectKernel>>();\n\n  constructor(config: KernelManagerConfig) {\n    this.factory = config.factory;\n    this.maxSize = config.maxSize ?? 32;\n    this.ttlMs = config.ttlMs ?? 15 * 60 * 1000;\n    this.logger = config.logger ?? console;\n  }\n\n  /** Returns the currently cached environmentIds (ordered by insertion). */\n  keys(): string[] {\n    return Array.from(this.cache.keys());\n  }\n\n  /** Cache size for diagnostics. */\n  get size(): number {\n    return this.cache.size;\n  }\n\n  /**\n   * Resolve or construct the kernel for `environmentId`.\n   *\n   * - Cache hit (fresh): bumps `lastAccess` and returns immediately.\n   * - Cache hit (TTL expired): evicts then falls through to factory.\n   * - Cache miss: dedupes concurrent callers through `pending`.\n   */\n  async getOrCreate(environmentId: string): Promise<ObjectKernel> {\n    const existing = this.cache.get(environmentId);\n    if (existing) {\n      if (this.ttlMs > 0 && Date.now() - existing.lastAccess > this.ttlMs) {\n        await this.evict(environmentId);\n      } else {\n        existing.lastAccess = Date.now();\n        return existing.kernel;\n      }\n    }\n\n    const inflight = this.pending.get(environmentId);\n    if (inflight) return inflight;\n\n    const promise = (async () => {\n      const kernel = await this.factory.create(environmentId);\n      const now = Date.now();\n      this.cache.set(environmentId, { kernel, createdAt: now, lastAccess: now });\n      await this.enforceMaxSize();\n      return kernel;\n    })();\n\n    this.pending.set(environmentId, promise);\n    try {\n      return await promise;\n    } finally {\n      this.pending.delete(environmentId);\n    }\n  }\n\n  /**\n   * Evict the kernel for `environmentId` and invoke `kernel.shutdown()`.\n   * No-op when the entry is absent.\n   */\n  async evict(environmentId: string): Promise<void> {\n    const entry = this.cache.get(environmentId);\n    if (!entry) return;\n    this.cache.delete(environmentId);\n    try {\n      await entry.kernel.shutdown();\n    } catch (err) {\n      this.logger.error?.('[KernelManager] shutdown failed', { environmentId, err });\n    }\n  }\n\n  /** Evict all resident kernels. Used on runtime shutdown. */\n  async evictAll(): Promise<void> {\n    const ids = Array.from(this.cache.keys());\n    await Promise.all(ids.map((id) => this.evict(id)));\n  }\n\n  private async enforceMaxSize(): Promise<void> {\n    while (this.cache.size > this.maxSize) {\n      // Find least-recently-accessed entry.\n      let oldestKey: string | undefined;\n      let oldestAccess = Infinity;\n      for (const [key, entry] of this.cache) {\n        if (entry.lastAccess < oldestAccess) {\n          oldestAccess = entry.lastAccess;\n          oldestKey = key;\n        }\n      }\n      if (!oldestKey) return;\n      await this.evict(oldestKey);\n    }\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Artifact API client.\n *\n * HTTP client that talks to the ObjectStack control plane (e.g.\n * `apps/cloud`) to resolve hostnames to projects and to download a\n * project's compiled artifact.\n *\n * The control plane is expected to expose two endpoints:\n *\n *   GET {controlPlaneUrl}/api/v1/cloud/resolve-hostname?host={hostname}\n *     → { environmentId: string, organizationId?: string, runtime?: EnvironmentRuntimeConfig }\n *\n *   GET {controlPlaneUrl}/api/v1/cloud/environments/:environmentId/artifact\n *     → EnvironmentArtifactResponse  (EnvironmentArtifact + optional `runtime` block)\n *\n * Both endpoints accept an optional `Authorization: Bearer <apiKey>`.\n *\n * Responses are cached in-memory with a TTL so each kernel-manager\n * miss does not produce an extra HTTP round trip. Concurrent callers\n * for the same key share a single in-flight promise (singleflight).\n */\n\nimport type { EnvironmentArtifact } from '@objectstack/spec/cloud';\n\n/**\n * Per-project runtime config injected by the control plane alongside\n * the artifact. Carries the physical database URL the runtime should\n * connect to (this is *not* part of the developer-authored compiled\n * artifact — the control plane mints it when serving the API).\n */\nexport interface EnvironmentRuntimeConfig {\n    organizationId?: string;\n    hostname?: string;\n    /** Driver type — e.g. `sqlite`, `postgres`, `turso`, `memory`. */\n    databaseDriver: string;\n    /** Driver-specific connection URL. */\n    databaseUrl: string;\n    /** Optional auth token (e.g. for libSQL/Turso). */\n    databaseAuthToken?: string;\n    /**\n     * Project-level metadata captured by the control plane at create time\n     * (e.g. `ownerSeed`, `orgSeed`). Forwarded to the runtime so cold-boot\n     * seed replay can mirror the cloud org + owner into the project DB\n     * before the user's first SSO callback arrives.\n     */\n    metadata?: Record<string, unknown>;\n}\n\n/**\n * Hostname resolution response.\n */\nexport interface ResolvedHostname {\n    environmentId: string;\n    organizationId?: string;\n    /** Optional runtime config — when present, callers can skip the artifact fetch's runtime block. */\n    runtime?: EnvironmentRuntimeConfig;\n}\n\n/**\n * Artifact response wrapping the spec's `EnvironmentArtifact` envelope plus\n * an optional `runtime` block carrying the project's database\n * connection details.\n */\nexport interface EnvironmentArtifactResponse extends EnvironmentArtifact {\n    runtime?: EnvironmentRuntimeConfig;\n}\n\nexport interface ArtifactApiClientConfig {\n    /** Control-plane base URL (no trailing slash). */\n    controlPlaneUrl: string;\n    /** Optional bearer token. */\n    apiKey?: string;\n    /** Cache TTL in ms. Default: 5 min. */\n    cacheTtlMs?: number;\n    /** Timeout for control-plane HTTP calls in ms. Default: 10s. */\n    requestTimeoutMs?: number;\n    /** Optional fetch override (testing). */\n    fetch?: typeof fetch;\n    /** Optional logger. */\n    logger?: { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };\n}\n\ninterface CacheEntry<T> {\n    value: T;\n    expiresAt: number;\n}\n\nexport class ArtifactApiClient {\n    private readonly base: string;\n    private readonly apiKey?: string;\n    private readonly cacheTtlMs: number;\n    private readonly requestTimeoutMs: number;\n    private readonly fetchImpl: typeof fetch;\n    private readonly logger: NonNullable<ArtifactApiClientConfig['logger']>;\n\n    private readonly hostnameCache = new Map<string, CacheEntry<ResolvedHostname>>();\n    private readonly artifactCache = new Map<string, CacheEntry<EnvironmentArtifactResponse>>();\n    private readonly pendingHostname = new Map<string, Promise<ResolvedHostname | null>>();\n    private readonly pendingArtifact = new Map<string, Promise<EnvironmentArtifactResponse | null>>();\n\n    constructor(config: ArtifactApiClientConfig) {\n        if (!config.controlPlaneUrl) {\n            throw new Error('[ArtifactApiClient] controlPlaneUrl is required');\n        }\n        this.base = config.controlPlaneUrl.replace(/\\/+$/, '');\n        this.apiKey = config.apiKey;\n        this.cacheTtlMs = config.cacheTtlMs ?? 5 * 60 * 1000;\n        this.requestTimeoutMs = config.requestTimeoutMs ?? 10_000;\n        this.fetchImpl = config.fetch ?? globalThis.fetch;\n        this.logger = config.logger ?? console;\n        if (typeof this.fetchImpl !== 'function') {\n            throw new Error('[ArtifactApiClient] global fetch is not available — provide config.fetch');\n        }\n    }\n\n    /**\n     * Resolve a hostname to its project. Returns `null` on 404 or\n     * malformed responses. Errors (network / 5xx) are thrown so\n     * upstream callers can retry.\n     */\n    async resolveHostname(host: string): Promise<ResolvedHostname | null> {\n        const cached = this.hostnameCache.get(host);\n        if (cached && cached.expiresAt > Date.now()) return cached.value;\n\n        const inflight = this.pendingHostname.get(host);\n        if (inflight) return inflight;\n\n        const promise = (async () => {\n            try {\n                const url = `${this.base}/api/v1/cloud/resolve-hostname?host=${encodeURIComponent(host)}`;\n                const res = await this.request(url);\n                if (res === null) return null;\n                const body = res.success === false ? null : (res.data ?? res);\n                if (!body || typeof body.environmentId !== 'string' || !body.environmentId) return null;\n                const value: ResolvedHostname = {\n                    environmentId: body.environmentId,\n                    organizationId: body.organizationId,\n                    runtime: body.runtime,\n                };\n                this.hostnameCache.set(host, { value, expiresAt: Date.now() + this.cacheTtlMs });\n                return value;\n            } finally {\n                this.pendingHostname.delete(host);\n            }\n        })();\n        this.pendingHostname.set(host, promise);\n        return promise;\n    }\n\n    /**\n     * Fetch the compiled artifact for a project.\n     *\n     * When `opts.commit` is set, requests that specific revision via the\n     * existing `?commit=` query param. Different commits are cached\n     * independently (the cache key includes the commit id) so the preview\n     * runtime can hold multiple versions in memory simultaneously.\n     */\n    async fetchArtifact(environmentId: string, opts?: { commit?: string }): Promise<EnvironmentArtifactResponse | null> {\n        const commit = opts?.commit?.trim() || '';\n        const cacheKey = commit ? `${environmentId}@${commit}` : environmentId;\n        const cached = this.artifactCache.get(cacheKey);\n        if (cached && cached.expiresAt > Date.now()) return cached.value;\n\n        const inflight = this.pendingArtifact.get(cacheKey);\n        if (inflight) return inflight;\n\n        const promise = (async () => {\n            try {\n                const qs = commit ? `?commit=${encodeURIComponent(commit)}` : '';\n                const url = `${this.base}/api/v1/cloud/environments/${encodeURIComponent(environmentId)}/artifact${qs}`;\n                const res = await this.request(url);\n                if (res === null) return null;\n                const body = res.success === false ? null : (res.data ?? res);\n                if (!body || typeof body !== 'object') return null;\n                if (!body.metadata) {\n                    this.logger.warn?.('[ArtifactApiClient] artifact response missing `metadata`', { environmentId, commit });\n                    return null;\n                }\n                const value = body as EnvironmentArtifactResponse;\n                this.artifactCache.set(cacheKey, { value, expiresAt: Date.now() + this.cacheTtlMs });\n                return value;\n            } finally {\n                this.pendingArtifact.delete(cacheKey);\n            }\n        })();\n        this.pendingArtifact.set(cacheKey, promise);\n        return promise;\n    }\n\n    /**\n     * Resolve an 8-hex project short id (first 8 hex chars of the UUID,\n     * dashes stripped) to the full environmentId. Used by the preview\n     * runtime, which encodes project ids in subdomains.\n     *\n     * Returns `null` on 404 or ambiguity (the control plane returns 409\n     * if the prefix matches more than one project).\n     */\n    async lookupProjectByShortId(shortId: string): Promise<{ environmentId: string; organizationId?: string } | null> {\n        const short = String(shortId ?? '').trim().toLowerCase();\n        if (!/^[0-9a-f]{8,}$/.test(short)) return null;\n        const url = `${this.base}/api/v1/cloud/environments-by-short-id/${encodeURIComponent(short)}`;\n        const res = await this.request(url);\n        if (res === null) return null;\n        const body = res.success === false ? null : (res.data ?? res);\n        if (!body || typeof body.environmentId !== 'string' || !body.environmentId) return null;\n        return { environmentId: body.environmentId, organizationId: body.organizationId };\n    }\n\n    /**\n     * Fetch the head commit of a branch. Returns the commit id (and the\n     * matching revision row's `published_at` for cache-validity checks).\n     * Reuses the existing `GET /cloud/environments/:id/branches` endpoint.\n     */\n    async fetchBranchHead(\n        environmentId: string,\n        branchName: string,\n    ): Promise<{ commitId: string; publishedAt?: string | null } | null> {\n        const url = `${this.base}/api/v1/cloud/environments/${encodeURIComponent(environmentId)}/branches`;\n        const res = await this.request(url);\n        if (res === null) return null;\n        const body = res.success === false ? null : (res.data ?? res);\n        const branches = Array.isArray(body?.branches) ? body.branches : [];\n        const target = String(branchName ?? '').trim().toLowerCase();\n        const found = branches.find((b: any) => String(b?.branch ?? '').toLowerCase() === target);\n        if (!found?.headCommitId) return null;\n        return { commitId: String(found.headCommitId), publishedAt: found.headPublishedAt ?? null };\n    }\n\n    /** Drop cached entries for a project (and any matching hostname). */\n    invalidate(environmentId: string): void {\n        // Cache keys are `${environmentId}` for HEAD or `${environmentId}@${commit}`\n        // for pinned reads (preview runtime). Drop both shapes.\n        this.artifactCache.delete(environmentId);\n        const prefix = `${environmentId}@`;\n        for (const key of Array.from(this.artifactCache.keys())) {\n            if (key.startsWith(prefix)) this.artifactCache.delete(key);\n        }\n        for (const [host, entry] of this.hostnameCache) {\n            if (entry.value.environmentId === environmentId) this.hostnameCache.delete(host);\n        }\n    }\n\n    /** Drop everything. Used on shutdown / hot-reload. */\n    clear(): void {\n        this.hostnameCache.clear();\n        this.artifactCache.clear();\n    }\n\n    private async request(url: string): Promise<any> {\n        const controller = typeof AbortController !== 'undefined' ? new AbortController() : null;\n        const timer = controller ? setTimeout(() => controller.abort(), this.requestTimeoutMs) : null;\n        try {\n            const res = await this.fetchImpl(url, {\n                method: 'GET',\n                headers: this.buildHeaders(),\n                signal: controller?.signal,\n            });\n            if (res.status === 404) return null;\n            if (!res.ok) {\n                throw new Error(`[ArtifactApiClient] ${url} → HTTP ${res.status}`);\n            }\n            return await res.json();\n        } finally {\n            if (timer) clearTimeout(timer);\n        }\n    }\n\n    private buildHeaders(): Record<string, string> {\n        const headers: Record<string, string> = {\n            'accept': 'application/json',\n            'user-agent': 'objectos-runtime',\n        };\n        if (this.apiKey) headers['authorization'] = `Bearer ${this.apiKey}`;\n        return headers;\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * EnvironmentDriverRegistry implementation that talks to the control plane\n * over HTTP via {@link ArtifactApiClient}.\n *\n * Mirrors {@link DefaultEnvironmentDriverRegistry} from `environment-registry.ts`\n * but does **not** read from a local control-plane database. Hostname →\n * environmentId resolution and per-project runtime config (database URL /\n * driver) come from the control plane API.\n *\n * The cached `project` payload exposed by `peekById()` is shaped to look\n * like a `sys_environment` row so callers downstream (notably\n * `ArtifactKernelFactory`) can read `id`, `organization_id`,\n * `database_url` and `database_driver` without branching.\n */\n\nimport type * as Contracts from '@objectstack/spec/contracts';\nimport { resolve as resolvePathNode } from 'node:path';\nimport type { EnvironmentDriverRegistry } from './environment-registry.js';\nimport type { ArtifactApiClient, EnvironmentRuntimeConfig } from './artifact-api-client.js';\n\ntype IDataDriver = Contracts.IDataDriver;\n\ninterface CacheEntry {\n    environmentId: string;\n    driver: IDataDriver;\n    project: any;\n    expiresAt: number;\n}\n\nexport interface ArtifactEnvironmentRegistryConfig {\n    client: ArtifactApiClient;\n    /** Cache TTL for resolved drivers in ms. Default: 5 min. */\n    cacheTtlMs?: number;\n    /** Optional logger. */\n    logger?: { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };\n}\n\nexport class ArtifactEnvironmentRegistry implements EnvironmentDriverRegistry {\n    private readonly client: ArtifactApiClient;\n    private readonly cacheTTL: number;\n    private readonly logger: NonNullable<ArtifactEnvironmentRegistryConfig['logger']>;\n\n    private readonly hostnameCache = new Map<string, CacheEntry>();\n    private readonly idCache = new Map<string, CacheEntry>();\n    private readonly pending = new Map<string, Promise<CacheEntry | null>>();\n\n    constructor(config: ArtifactEnvironmentRegistryConfig) {\n        this.client = config.client;\n        this.cacheTTL = config.cacheTtlMs ?? 5 * 60 * 1000;\n        this.logger = config.logger ?? console;\n    }\n\n    async resolveByHostname(host: string): Promise<{ environmentId: string; driver: IDataDriver } | null> {\n        const cached = this.hostnameCache.get(host);\n        if (cached && cached.expiresAt > Date.now()) {\n            return { environmentId: cached.environmentId, driver: cached.driver };\n        }\n        const key = `host:${host}`;\n        const inflight = this.pending.get(key);\n        if (inflight) {\n            const result = await inflight;\n            return result ? { environmentId: result.environmentId, driver: result.driver } : null;\n        }\n        const promise = (async (): Promise<CacheEntry | null> => {\n            try {\n                const resolved = await this.client.resolveHostname(host);\n                if (!resolved) return null;\n                const entry = await this.buildCacheEntry(resolved.environmentId, resolved.runtime, resolved.organizationId, host);\n                if (!entry) return null;\n                this.hostnameCache.set(host, entry);\n                this.idCache.set(entry.environmentId, entry);\n                return entry;\n            } catch (err: any) {\n                this.logger.error?.('[ArtifactEnvironmentRegistry] resolveByHostname failed', {\n                    host,\n                    error: err?.message ?? err,\n                });\n                return null;\n            } finally {\n                this.pending.delete(key);\n            }\n        })();\n        this.pending.set(key, promise);\n        const entry = await promise;\n        return entry ? { environmentId: entry.environmentId, driver: entry.driver } : null;\n    }\n\n    async resolveById(environmentId: string): Promise<IDataDriver | null> {\n        const cached = this.idCache.get(environmentId);\n        if (cached && cached.expiresAt > Date.now()) return cached.driver;\n\n        const key = `id:${environmentId}`;\n        const inflight = this.pending.get(key);\n        if (inflight) {\n            const result = await inflight;\n            return result?.driver ?? null;\n        }\n        const promise = (async (): Promise<CacheEntry | null> => {\n            try {\n                const entry = await this.buildCacheEntry(environmentId, undefined, undefined, undefined);\n                if (!entry) return null;\n                this.idCache.set(environmentId, entry);\n                if (entry.project?.hostname) this.hostnameCache.set(entry.project.hostname, entry);\n                return entry;\n            } catch (err: any) {\n                this.logger.error?.('[ArtifactEnvironmentRegistry] resolveById failed', {\n                    environmentId,\n                    error: err?.message ?? err,\n                });\n                return null;\n            } finally {\n                this.pending.delete(key);\n            }\n        })();\n        this.pending.set(key, promise);\n        const entry = await promise;\n        return entry?.driver ?? null;\n    }\n\n    peekById(environmentId: string): { environmentId: string; driver: IDataDriver; project: any } | null {\n        const cached = this.idCache.get(environmentId);\n        if (cached && cached.expiresAt > Date.now()) {\n            return { environmentId: cached.environmentId, driver: cached.driver, project: cached.project };\n        }\n        return null;\n    }\n\n    invalidate(environmentId: string): void {\n        this.idCache.delete(environmentId);\n        for (const [host, entry] of this.hostnameCache) {\n            if (entry.environmentId === environmentId) this.hostnameCache.delete(host);\n        }\n        this.client.invalidate(environmentId);\n    }\n\n    private async buildCacheEntry(\n        environmentId: string,\n        runtimeFromHostname: EnvironmentRuntimeConfig | undefined,\n        orgIdFromHostname: string | undefined,\n        hostname: string | undefined,\n    ): Promise<CacheEntry | null> {\n        let runtime = runtimeFromHostname;\n        let organizationId = orgIdFromHostname;\n        let host = hostname;\n        let artifactProjectId = environmentId;\n\n        if (!runtime || !organizationId) {\n            const artifact = await this.client.fetchArtifact(environmentId);\n            if (!artifact) {\n                this.logger.warn?.('[ArtifactEnvironmentRegistry] artifact not found', { environmentId });\n                return null;\n            }\n            artifactProjectId = artifact.environmentId ?? environmentId;\n            if (!runtime) runtime = artifact.runtime ?? extractRuntimeFromMetadata(artifact.metadata);\n            if (!organizationId) organizationId = artifact.runtime?.organizationId;\n            if (!host) host = artifact.runtime?.hostname;\n        }\n\n        if (!runtime || !runtime.databaseUrl || !runtime.databaseDriver) {\n            this.logger.warn?.('[ArtifactEnvironmentRegistry] no runtime config for project', { environmentId });\n            return null;\n        }\n\n        const driver = await createDriver(runtime.databaseDriver, runtime.databaseUrl, runtime.databaseAuthToken ?? '');\n\n        const projectRow = {\n            id: artifactProjectId,\n            organization_id: organizationId,\n            hostname: host,\n            database_url: runtime.databaseUrl,\n            database_driver: runtime.databaseDriver,\n            metadata: runtime.metadata,\n        };\n\n        return {\n            environmentId: artifactProjectId,\n            driver,\n            project: projectRow,\n            expiresAt: Date.now() + this.cacheTTL,\n        };\n    }\n}\n\n/**\n * Best-effort fallback: if the control plane did not return an explicit\n * `runtime` block, look for a default datasource in the compiled artifact\n * and reuse its connection config. Useful for self-published artifacts\n * where the developer encoded the connection inline (e.g. memory:// for\n * demos).\n */\nfunction extractRuntimeFromMetadata(metadata: any): EnvironmentRuntimeConfig | undefined {\n    const datasources = metadata?.datasources;\n    if (!Array.isArray(datasources) || datasources.length === 0) return undefined;\n    const mapping: any[] | undefined = metadata?.datasourceMapping;\n    let preferredName: string | undefined;\n    if (mapping) {\n        const def = mapping.find((m: any) => m?.default === true);\n        if (def?.datasource) preferredName = def.datasource;\n    }\n    const ds = preferredName\n        ? datasources.find((d: any) => d?.name === preferredName)\n        : datasources[0];\n    if (!ds || typeof ds !== 'object') return undefined;\n    const config = (ds.config ?? {}) as Record<string, any>;\n    const url = config.url ?? config.connectionString ?? config.connection ?? config.filename;\n    const driver = ds.driver;\n    if (typeof driver !== 'string' || typeof url !== 'string') return undefined;\n    return {\n        databaseDriver: driver,\n        databaseUrl: url,\n        databaseAuthToken: typeof config.authToken === 'string' ? config.authToken : undefined,\n    };\n}\n\nasync function createDriver(driverType: string, databaseUrl: string, authToken: string): Promise<IDataDriver> {\n    switch (driverType) {\n        case 'memory': {\n            const { InMemoryDriver } = await import('@objectstack/driver-memory');\n            const dbName = databaseUrl.replace(/^memory:\\/\\//, '').trim();\n            // Resolve memory persistence files under the process cwd's\n            // `.objectstack/data/projects/<name>.json` — keeps file-only dev\n            // self-contained without depending on the cloud package's\n            // serverless data-dir resolver.\n            const filePath = dbName\n                ? resolvePathNode(process.cwd(), '.objectstack/data/projects', `${dbName}.json`)\n                : undefined;\n            return new InMemoryDriver({\n                persistence: filePath ? { type: 'file', path: filePath } : 'file',\n            }) as unknown as IDataDriver;\n        }\n        case 'sqlite':\n        case 'sql': {\n            const filePath = databaseUrl.replace(/^file:/, '').replace(/^sql:\\/\\//, '');\n            const { SqlDriver } = await import('@objectstack/driver-sql');\n            return new SqlDriver({\n                client: 'better-sqlite3',\n                connection: { filename: filePath },\n                useNullAsDefault: true,\n            }) as unknown as IDataDriver;\n        }\n        case 'libsql':\n        case 'turso': {\n            const { TursoDriver } = await import('@objectstack/driver-turso');\n            return new TursoDriver({ url: databaseUrl, authToken }) as unknown as IDataDriver;\n        }\n        case 'postgres':\n        case 'postgresql':\n        case 'pg': {\n            const { SqlDriver } = await import('@objectstack/driver-sql');\n            return new SqlDriver({\n                client: 'pg',\n                connection: databaseUrl,\n                pool: { min: 0, max: 5 },\n            }) as unknown as IDataDriver;\n        }\n        case 'mongodb':\n        case 'mongo': {\n            const { MongoDBDriver } = await import('@objectstack/driver-mongodb');\n            return new MongoDBDriver({ url: databaseUrl }) as unknown as IDataDriver;\n        }\n        default:\n            throw new Error(`[ArtifactEnvironmentRegistry] Unsupported driver type: ${driverType}`);\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * EnvironmentKernelFactory backed by the control plane's Artifact API.\n *\n * Differs from {@link DefaultEnvironmentKernelFactory} in two ways:\n *\n *  1. There is no local control-plane database to query — project rows\n *     come from the {@link ArtifactEnvironmentRegistry} cache populated\n *     via HTTP.\n *  2. There is no `ControlPlaneProxyDriver` mounted on the per-project\n *     kernel. The runtime is intentionally isolated from the control\n *     plane: each project kernel only knows about its own data driver.\n *\n * The kernel is bootstrapped with:\n *   • DriverPlugin(driver)  — project-scoped data driver, also aliased\n *                              as the `'cloud'` datasource so AuthPlugin's\n *                              identity manifest resolves locally.\n *   • ObjectQLPlugin\n *   • MetadataPlugin (registers `sys_metadata` + `sys_metadata_history` on\n *                     the project DB — required by ADR-0005: customization\n *                     overlays such as user-created views/dashboards are\n *                     persisted by ObjectStackProtocolImplementation on the\n *                     per-project engine, so the table must exist there).\n *   • AuthPlugin    — per-project, derives an HKDF secret from\n *                     `OS_AUTH_SECRET` + environmentId. Each project owns its\n *                     own `sys_user/sys_session/...` tables in its own\n *                     Turso DB. Cookies are scoped to the project's\n *                     hostname (no `.<root>`-wide cross-project leak).\n *   • AppPlugin(artifact.metadata)  — compiled developer code\n */\n\nimport { createHmac } from 'node:crypto';\nimport { ObjectKernel } from '@objectstack/core';\nimport type * as Contracts from '@objectstack/spec/contracts';\nimport { DriverPlugin } from '../driver-plugin.js';\nimport { AppPlugin } from '../app-plugin.js';\nimport type { EnvironmentKernelFactory } from './kernel-manager.js';\nimport type { EnvironmentDriverRegistry } from './environment-registry.js';\nimport type { ArtifactApiClient } from './artifact-api-client.js';\nimport { loadCapabilities } from './capability-loader.js';\nimport {\n    PLATFORM_SSO_PROVIDER_ID,\n    derivePlatformSsoClientId,\n    derivePlatformSsoClientSecret,\n} from './platform-sso.js';\n\ntype IDataDriver = Contracts.IDataDriver;\n\nexport interface ArtifactKernelFactoryConfig {\n    client: ArtifactApiClient;\n    envRegistry: EnvironmentDriverRegistry;\n    /** Optional logger. */\n    logger?: { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };\n    /** Optional kernel constructor config. */\n    kernelConfig?: ConstructorParameters<typeof ObjectKernel>[0];\n    /**\n     * Base secret used to derive per-project AuthPlugin secrets via\n     * HKDF-style HMAC-SHA256(baseSecret, environmentId). Falls back to\n     * `process.env.OS_AUTH_SECRET` / `AUTH_SECRET` at construction time.\n     */\n    authBaseSecret?: string;\n}\n\n/**\n * Derive a deterministic per-project auth secret. HMAC-SHA256 of the\n * environmentId keyed by the base secret yields a 64-char hex string that is:\n *   - stable across container cold-starts (no DB lookup needed)\n *   - independent per project (forging a token on project A does not\n *     compromise project B)\n *   - rotatable by changing the base secret (will invalidate all sessions)\n */\nfunction deriveProjectAuthSecret(baseSecret: string, environmentId: string): string {\n    return createHmac('sha256', baseSecret).update(`project:${environmentId}`).digest('hex');\n}\n\nexport class ArtifactKernelFactory implements EnvironmentKernelFactory {\n    private readonly client: ArtifactApiClient;\n    private readonly envRegistry: EnvironmentDriverRegistry;\n    private readonly logger: NonNullable<ArtifactKernelFactoryConfig['logger']>;\n    private readonly kernelConfig?: ArtifactKernelFactoryConfig['kernelConfig'];\n    private readonly authBaseSecret: string;\n\n    constructor(config: ArtifactKernelFactoryConfig) {\n        this.client = config.client;\n        this.envRegistry = config.envRegistry;\n        this.logger = config.logger ?? console;\n        this.kernelConfig = config.kernelConfig;\n        this.authBaseSecret = (\n            config.authBaseSecret\n            ?? process.env.OS_AUTH_SECRET\n            ?? process.env.AUTH_SECRET\n            ?? ''\n        ).trim();\n    }\n\n    async create(environmentId: string): Promise<ObjectKernel> {\n        let cached = this.envRegistry.peekById(environmentId);\n        if (!cached) {\n            const driver = await this.envRegistry.resolveById(environmentId);\n            if (!driver) {\n                throw new Error(`[ArtifactKernelFactory] Could not resolve driver for project '${environmentId}'`);\n            }\n            cached = this.envRegistry.peekById(environmentId);\n            if (!cached) {\n                throw new Error(`[ArtifactKernelFactory] envRegistry returned a driver but no cached entry for '${environmentId}'`);\n            }\n        }\n\n        const driver: IDataDriver = cached.driver;\n        const project = cached.project as { id: string; organization_id?: string; hostname?: string };\n\n        const artifact = await this.client.fetchArtifact(environmentId);\n        if (!artifact) {\n            throw new Error(`[ArtifactKernelFactory] Artifact not available for project '${environmentId}'`);\n        }\n\n        const { ObjectQLPlugin } = await import('@objectstack/objectql');\n        const { MetadataPlugin } = await import('@objectstack/metadata');\n\n        const kernel = new ObjectKernel(this.kernelConfig);\n\n        // Register the project driver as both the unnamed default AND under\n        // the `'cloud'` alias. AuthPlugin's manifest header historically\n        // declares `defaultDatasource: 'cloud'`; aliasing here keeps that\n        // path working without forcing every project's identity table\n        // through a control-plane proxy.\n        await kernel.use(new DriverPlugin(driver, { datasourceName: 'cloud' } as any));\n        // Enable schema sync per-project so sys_user / sys_session / etc.\n        // tables get created on the project's own DB. The host worker sets\n        // `OS_SKIP_SCHEMA_SYNC=1` for the control-plane DB; that env var\n        // must NOT bleed into project kernels because their auth tables\n        // need provisioning. KernelManager caches kernels so this runs\n        // at most once per cold-start per project.\n        await kernel.use(new ObjectQLPlugin({ environmentId: environmentId, skipSchemaSync: false }));\n        await kernel.use(new MetadataPlugin({\n            watch: false,\n            environmentId: environmentId,\n            organizationId: project.organization_id,\n            // ADR-0005: customization overlays (user-created views, dashboards,\n            // edited objects, ...) are persisted by\n            // ObjectStackProtocolImplementation.saveMetaItem on whichever\n            // engine the protocol is attached to. For per-project kernels that\n            // means the project's own DB, so the sys_metadata + history tables\n            // MUST be provisioned here. The previous `false` setting caused\n            // \"no such table: sys_metadata\" errors on any PUT /api/v1/meta/*\n            // call (e.g. Studio \"Create View\") against a project deployment.\n            registerSystemObjects: true,\n        }));\n\n        // Per-project AuthPlugin — only when an OS_AUTH_SECRET base is\n        // configured. Without it we cannot derive a secret deterministically\n        // and refuse to start auth (better silent-fail than insecure default).\n        if (this.authBaseSecret) {\n            try {\n                const { AuthPlugin } = await import('@objectstack/plugin-auth');\n                const projectSecret = deriveProjectAuthSecret(this.authBaseSecret, environmentId);\n                const baseUrl = project.hostname\n                    ? (project.hostname.startsWith('http')\n                        ? project.hostname\n                        : (/(\\.|^)localhost(:\\d+)?$/i.test(project.hostname)\n                            ? (() => {\n                                const runtimePort = (process.env.OS_RUNTIME_PORT ?? '').trim();\n                                const hasPort = /:\\d+$/.test(project.hostname);\n                                const hostWithPort = hasPort || !runtimePort\n                                    ? project.hostname\n                                    : `${project.hostname}:${runtimePort}`;\n                                return `http://${hostWithPort}`;\n                            })()\n                            : `https://${project.hostname}`))\n                    : undefined;\n\n                // Build the list of trusted origins for CSRF.\n                // - Production: just the project's https baseUrl + any\n                //   platform-wide origins from OS_TRUSTED_ORIGINS (so\n                //   hostname renames don't require a kernel evict — the\n                //   parent worker already trusts `https://*.<rootdomain>`).\n                // - Dev (*.localhost): also trust http variants on any port so\n                //   the local objectos dev server (PORT=4100 or any user-chosen\n                //   port) can complete sign-in from the browser. baseUrl alone\n                //   is `https://*.localhost` (no port, https) which the\n                //   browser's Origin (`http://*.localhost:4100`) does NOT\n                //   match — leading to better-auth \"Invalid origin\" 403.\n                const trustedOriginsList: string[] = [];\n                if (baseUrl) trustedOriginsList.push(baseUrl);\n                // Inherit platform trusted-origin wildcards from the host\n                // worker. Without this, renaming an environment leaves the\n                // cached per-project kernel rejecting callbackURL=<new-host>\n                // with INVALID_CALLBACK_URL until the next cold-start.\n                const platformOrigins = (process.env.OS_TRUSTED_ORIGINS ?? '')\n                    .split(',')\n                    .map((s) => s.trim())\n                    .filter(Boolean);\n                for (const o of platformOrigins) {\n                    if (!trustedOriginsList.includes(o)) trustedOriginsList.push(o);\n                }\n                // Convenience: when OS_ROOT_DOMAIN is set, trust the entire\n                // platform subdomain space. Matches the host worker's CORS\n                // posture so SSO survives any future tenant-domain rename.\n                const rootDomain = (process.env.OS_ROOT_DOMAIN ?? '').trim().replace(/^https?:\\/\\//, '');\n                if (rootDomain) {\n                    const wildcard = `https://*.${rootDomain}`;\n                    if (!trustedOriginsList.includes(wildcard)) trustedOriginsList.push(wildcard);\n                }\n                if (project.hostname) {\n                    const bareHost = project.hostname.replace(/^https?:\\/\\//, '');\n                    if (bareHost.endsWith('.localhost') || bareHost === 'localhost') {\n                        trustedOriginsList.push(`http://${bareHost}`);\n                        trustedOriginsList.push(`http://${bareHost}:*`);\n                        trustedOriginsList.push(`https://${bareHost}:*`);\n                    }\n                }\n\n                // Platform SSO (\"Airtable-style unified login\"): when the\n                // cloud control-plane is reachable AND the master secret is\n                // shared between the two containers, wire better-auth's\n                // genericOAuth plugin so a builder who already signed in\n                // on `cloud.<root>` is JIT-provisioned as a `sys_user` on\n                // every per-project deployment without re-registering.\n                //\n                // Opt-out: set OS_PLATFORM_SSO=false to fall back to the\n                // legacy \"every project owns its own login\" mode.\n                const platformSsoEnabled = String(\n                    process.env.OS_PLATFORM_SSO ?? 'true',\n                ).toLowerCase() !== 'false';\n                const cloudBaseUrl = (process.env.OS_CLOUD_URL ?? '').trim().replace(/\\/+$/, '');\n                const oidcProviders = platformSsoEnabled\n                    && cloudBaseUrl\n                    && /^https?:\\/\\//.test(cloudBaseUrl)\n                    ? [{\n                        providerId: PLATFORM_SSO_PROVIDER_ID,\n                        name: 'ObjectStack',\n                        discoveryUrl: `${cloudBaseUrl}/.well-known/openid-configuration`,\n                        clientId: derivePlatformSsoClientId(environmentId),\n                        clientSecret: derivePlatformSsoClientSecret(this.authBaseSecret, environmentId),\n                        scopes: ['openid', 'email', 'profile'],\n                    }]\n                    : undefined;\n\n                await kernel.use(new AuthPlugin({\n                    secret: projectSecret,\n                    baseUrl,\n                    // Project kernel has no http-server (host owns it). The\n                    // dispatcher's handleAuth path resolves `auth` via\n                    // getService and invokes the handler directly — route\n                    // registration is unnecessary and would warn.\n                    registerRoutes: false,\n                    // Identity tables live in the project's own DB — keep\n                    // sys_user/sys_session local to this kernel.\n                    manifestDatasource: 'default',\n                    // Cookie scope: default to the project's own host. We\n                    // intentionally do NOT pass crossSubDomainCookies here\n                    // so cookies stay isolated per project subdomain.\n                    trustedOrigins: trustedOriginsList.length ? trustedOriginsList : undefined,\n                    ...(oidcProviders ? { oidcProviders } : {}),\n                    // Auto-provision a personal organization for every new\n                    // user. SecurityPlugin's ObjectQL middleware does this\n                    // for direct `ql.insert` calls, but better-auth's\n                    // adapter writes through `dataEngine` directly,\n                    // bypassing that middleware — so JIT-created SSO users\n                    // would otherwise land on the empty \"create\n                    // organization\" screen on first login.\n                    databaseHooks: {\n                        user: {\n                            create: {\n                                after: async (user: { id: string; email?: string; name?: string }) => {\n                                    try {\n                                        const ql = kernel.getService<any>('objectql');\n                                        if (!ql) return;\n                                        const [{ ensureUserHasOrganization, cloneTenantSeedData }] = await Promise.all([\n                                            import('@objectstack/plugin-security'),\n                                        ]);\n                                        await ensureUserHasOrganization(ql, user, {\n                                            logger: this.logger as any,\n                                            cloneSeedData: cloneTenantSeedData,\n                                        });\n                                    } catch (e: any) {\n                                        this.logger.warn?.('[ArtifactKernelFactory] auto-org provisioning hook failed', {\n                                            environmentId,\n                                            userId: user?.id,\n                                            error: e?.message,\n                                        });\n                                    }\n                                },\n                            },\n                        },\n                    },\n                } as any));\n                if (oidcProviders) {\n                    this.logger.info?.('[ArtifactKernelFactory] platform SSO wired', {\n                        environmentId,\n                        cloudBaseUrl,\n                    });\n                }\n            } catch (err: any) {\n                this.logger.warn?.('[ArtifactKernelFactory] AuthPlugin not registered', {\n                    environmentId,\n                    error: err?.message,\n                });\n            }\n        } else {\n            this.logger.warn?.('[ArtifactKernelFactory] OS_AUTH_SECRET not set — per-project AuthPlugin skipped (auth endpoints will return 404)', { environmentId });\n        }\n\n        // Per-project SecurityPlugin — provides RBAC + tenant_isolation RLS\n        // AND, crucially, the `sys_user` insert middleware that auto-creates\n        // a personal organization for new self-service signups (without it,\n        // a freshly registered user lands on a UI showing \"No data\" because\n        // they have zero `sys_member` rows and the default RLS denies all).\n        // The CLI's `objectstack serve` does this for `pnpm dev`; we have\n        // to mirror that behaviour for cloud-deployed per-project kernels.\n        try {\n            const { SecurityPlugin } = await import('@objectstack/plugin-security');\n            const multiTenant = String(process.env.OS_MULTI_TENANT ?? 'true').toLowerCase() !== 'false';\n            await kernel.use(new SecurityPlugin({ multiTenant }) as any);\n        } catch (err: any) {\n            this.logger.warn?.('[ArtifactKernelFactory] SecurityPlugin not registered', {\n                environmentId,\n                error: err?.message,\n            });\n        }\n\n        const projectName = project.hostname ?? environmentId;\n        const bundle = artifact.metadata as any;\n        const sys = bundle?.manifest ?? bundle;\n        const packageId = sys?.packageId ?? sys?.package_id ?? bundle?.packageId;\n\n        // Per-project i18n: register I18nServicePlugin BEFORE AppPlugin so\n        // AppPlugin.loadTranslations() finds an i18n service to populate.\n        // Without this, the artifact's `translations` array is silently\n        // dropped and the `/api/v1/i18n/*` endpoints return empty payloads.\n        const i18nCfg = (bundle?.i18n ?? sys?.i18n ?? {}) as Record<string, any>;\n        const trArr = Array.isArray(bundle?.translations) ? bundle.translations\n            : Array.isArray(sys?.translations) ? sys.translations : [];\n        // Always register — even with no inline translations the service\n        // can serve labels/locales loaded by hosted apps. Cheap to register.\n        try {\n            const { I18nServicePlugin } = await import('@objectstack/service-i18n');\n            await kernel.use(new I18nServicePlugin({\n                defaultLocale: i18nCfg.defaultLocale,\n                fallbackLocale: i18nCfg.fallbackLocale ?? i18nCfg.defaultLocale ?? 'en',\n                // Routes are dispatched by HttpDispatcher.handleI18n via\n                // kernel.getService('i18n'); the host worker owns the\n                // HTTP server. Skip self-registration to avoid warnings.\n                registerRoutes: false,\n            } as any));\n            console.warn(\n                `[ArtifactKernelFactory] I18nServicePlugin registered (project=${environmentId}, translations=${trArr.length}, defaultLocale=${i18nCfg.defaultLocale ?? 'en'})`,\n            );\n        } catch (err: any) {\n            this.logger.warn?.('[ArtifactKernelFactory] I18nServicePlugin not registered', {\n                environmentId,\n                error: err?.message,\n            });\n        }\n\n        // Tier-driven capability loading: install service plugins listed\n        // in the artifact's `requires` array (e.g. ['ai','automation',\n        // 'analytics']). Must be registered BEFORE AppPlugin so that\n        // AppPlugin's start phase can hand off flows/agents/cubes to\n        // services that are already initialised.\n        const requiresRaw =\n            (Array.isArray(bundle?.requires) ? bundle.requires : null) ??\n            (Array.isArray(sys?.requires) ? sys.requires : null) ??\n            [];\n        const requires: string[] = (requiresRaw as unknown[])\n            .filter((x): x is string => typeof x === 'string' && x.length > 0);\n\n        if (requires.length > 0) {\n            const installed = await loadCapabilities({\n                kernel,\n                requires,\n                bundle: { ...(bundle ?? {}), ...(sys ?? {}) } as Record<string, unknown>,\n                logger: this.logger,\n                environmentId,\n            });\n            this.logger.info?.('[ArtifactKernelFactory] capabilities loaded', {\n                environmentId,\n                requires,\n                installed,\n            });\n        }\n\n        await kernel.use(new AppPlugin(bundle, {\n            environmentId,\n            organizationId: project.organization_id ?? '',\n            projectName,\n            packageId,\n            source: packageId ? 'package' : 'user',\n        } as any));\n\n        await kernel.bootstrap();\n\n        // Pre-seed the project owner. The cloud control-plane stashed the\n        // creator's identity into `sys_environment.metadata.ownerSeed` at\n        // project-create time; replay it AFTER `kernel.bootstrap()` so\n        // ObjectQL/Security plugins have fully initialised and\n        // `kernel.getService('objectql')` resolves. Pre-bootstrap, plugins\n        // are only registered — services aren't wired yet.\n        //\n        // Order matters:\n        //   1. Seed the OWNING cloud org into `sys_organization` so the\n        //      project's primary workspace matches the cloud team that\n        //      owns the project at the platform level.\n        //   2. Seed the owner's `sys_user` row.\n        //   3. Seed a `sys_member(owner)` row binding the user to the\n        //      cloud org. This prevents SecurityPlugin's\n        //      `ensureUserHasOrganization` insert middleware from\n        //      auto-creating a disjoint \"Alice's Workspace\" personal\n        //      org (the middleware only fires when the user has zero\n        //      memberships).\n        //\n        // All three are idempotent — safe across cold-boots.\n        try {\n            const projMeta: any = typeof (project as any)?.metadata === 'string'\n                ? JSON.parse((project as any).metadata)\n                : ((project as any)?.metadata ?? {});\n            const ownerSeed = projMeta?.ownerSeed;\n            const orgSeed = projMeta?.orgSeed;\n\n            if (orgSeed?.id && orgSeed?.name) {\n                try {\n                    const { seedProjectOrganization } = await import('./environment-org-seed.js');\n                    await seedProjectOrganization(kernel, orgSeed, this.logger);\n                } catch (e: any) {\n                    this.logger.warn?.('[ArtifactKernelFactory] orgSeed threw', {\n                        environmentId,\n                        error: e?.message,\n                    });\n                }\n            }\n\n            if (ownerSeed?.userId && ownerSeed?.email) {\n                try {\n                    const { seedProjectOwner } = await import('./environment-owner-seed.js');\n                    await seedProjectOwner(kernel, ownerSeed, this.logger);\n                } catch (e: any) {\n                    this.logger.warn?.('[ArtifactKernelFactory] ownerSeed threw', {\n                        environmentId,\n                        error: e?.message,\n                    });\n                }\n\n                if (orgSeed?.id) {\n                    try {\n                        const { seedProjectMember } = await import('./environment-org-seed.js');\n                        await seedProjectMember(\n                            kernel,\n                            { userId: ownerSeed.userId, organizationId: orgSeed.id, role: 'owner' },\n                            this.logger,\n                        );\n                    } catch (e: any) {\n                        this.logger.warn?.('[ArtifactKernelFactory] memberSeed threw', {\n                            environmentId,\n                            error: e?.message,\n                        });\n                    }\n                }\n            }\n        } catch (err: any) {\n            this.logger.warn?.('[ArtifactKernelFactory] owner/org seed skipped', {\n                environmentId,\n                error: err?.message,\n            });\n        }\n\n        // Post-bootstrap seed replay. The SecurityPlugin's `sys_organization`\n        // insert middleware only fires when a brand-new org row is inserted,\n        // so packages installed AFTER the env's primary org already exists\n        // would never get their `data` arrays applied. Run the seed-replayer\n        // once per kernel cold-start so newly-installed marketplace packages\n        // (e.g. CRM with \"Include sample data\" ticked) hydrate the primary\n        // org on the next request after install.\n        //\n        // SeedLoader uses upsert semantics, so re-running across cold-starts\n        // is idempotent — at worst we pay one batch upsert per kernel boot.\n        try {\n            const datasetsNow: any[] | undefined = (() => {\n                try { return (kernel as any).getService?.('seed-datasets'); } catch { return undefined; }\n            })();\n            const replayer: any = (() => {\n                try { return (kernel as any).getService?.('seed-replayer'); } catch { return undefined; }\n            })();\n\n            if (Array.isArray(datasetsNow) && datasetsNow.length > 0 && typeof replayer === 'function') {\n                // Resolve the env's primary organization. Prefer the explicit\n                // orgSeed metadata (set when env is created via the data API);\n                // fall back to scanning sys_organization for the first row\n                // (env created via the lifecycle endpoint that doesn't stash\n                // orgSeed, or any env that has been used at least once).\n                const projMetaRaw: any = (project as any)?.metadata;\n                const projMeta: any = typeof projMetaRaw === 'string' ? (() => {\n                    try { return JSON.parse(projMetaRaw); } catch { return {}; }\n                })() : (projMetaRaw ?? {});\n                let primaryOrgId: string | undefined = projMeta?.orgSeed?.id;\n\n                if (!primaryOrgId) {\n                    try {\n                        const ql: any = (kernel as any).getService?.('objectql');\n                        if (ql?.find) {\n                            const rows = await ql.find('sys_organization', { limit: 5, orderBy: [{ field: 'created_at', direction: 'asc' }] } as any);\n                            const list = Array.isArray(rows) ? rows : (rows?.value ?? rows?.records ?? []);\n                            if (Array.isArray(list) && list.length > 0 && list[0]?.id) {\n                                primaryOrgId = String(list[0].id);\n                            }\n                        }\n                    } catch { /* org table may not exist yet on a brand-new env */ }\n                }\n\n                if (primaryOrgId) {\n                    try {\n                        const summary = await replayer(primaryOrgId);\n                        const inserted = summary?.inserted ?? 0;\n                        const updated = summary?.updated ?? 0;\n                        const errs = summary?.errors?.length ?? 0;\n                        if (inserted > 0 || updated > 0 || errs > 0) {\n                            this.logger.info?.('[ArtifactKernelFactory] post-bootstrap seed replay', {\n                                environmentId,\n                                organizationId: primaryOrgId,\n                                datasets: datasetsNow.length,\n                                inserted,\n                                updated,\n                                errors: errs,\n                            });\n                        }\n                    } catch (e: any) {\n                        this.logger.warn?.('[ArtifactKernelFactory] post-bootstrap seed replay failed', {\n                            environmentId,\n                            organizationId: primaryOrgId,\n                            error: e?.message,\n                        });\n                    }\n                }\n            }\n        } catch (err: any) {\n            this.logger.warn?.('[ArtifactKernelFactory] post-bootstrap seed step threw', {\n                environmentId,\n                error: err?.message,\n            });\n        }\n\n        // Belt-and-braces: load translation bundles directly into the i18n\n        // service after bootstrap. AppPlugin.loadTranslations should do this\n        // during its `start` phase, but several conditions (missing objectql\n        // service, runtime.onEnable throwing, bundle keys mismatch) can cause\n        // it to bail before reaching the i18n step. Loading here guarantees\n        // the bundles attached to the artifact metadata are always served via\n        // `/api/v1/i18n/*`, regardless of AppPlugin's runtime path.\n        let i18nSvc: any = null;\n        try {\n            i18nSvc = (kernel as any).getService?.('i18n');\n        } catch {\n            // getService throws when service isn't registered — leave null\n            i18nSvc = null;\n        }\n        try {\n            if (i18nSvc && typeof i18nSvc.loadTranslations === 'function') {\n                if (i18nCfg.defaultLocale && typeof i18nSvc.setDefaultLocale === 'function') {\n                    i18nSvc.setDefaultLocale(i18nCfg.defaultLocale);\n                }\n                let loaded = 0;\n                for (const tbundle of trArr) {\n                    if (!tbundle || typeof tbundle !== 'object') continue;\n                    for (const [locale, data] of Object.entries(tbundle)) {\n                        if (data && typeof data === 'object') {\n                            try {\n                                i18nSvc.loadTranslations(locale, data as Record<string, unknown>);\n                                loaded++;\n                            } catch (err: any) {\n                                this.logger.warn?.('[ArtifactKernelFactory] i18n loadTranslations failed', {\n                                    environmentId, locale, error: err?.message,\n                                });\n                            }\n                        }\n                    }\n                }\n                if (loaded > 0) {\n                    this.logger.info?.('[ArtifactKernelFactory] i18n direct-load complete', {\n                        environmentId, locales: loaded, bundles: trArr.length,\n                    });\n                }\n            }\n        } catch (err: any) {\n            this.logger.warn?.('[ArtifactKernelFactory] i18n direct-load failed', {\n                environmentId,\n                error: err?.message,\n            });\n        }\n\n        this.logger.info?.('[ArtifactKernelFactory] kernel ready', {\n            environmentId,\n            commitId: artifact.commitId,\n            checksum: artifact.checksum,\n            authEnabled: Boolean(this.authBaseSecret),\n        });\n\n        return kernel;\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Capability loader — `bundle.requires` driven dispatch.\n *\n * Mirrors the CAPABILITY_PROVIDERS table in\n * `@objectstack/cli/src/commands/serve.ts` so that per-project kernels\n * built by {@link ArtifactKernelFactory} pick up the same service plugins\n * a developer would get when running `objectstack serve` locally.\n *\n * Design goals:\n *   - Single source of truth: artifact's `requires` array. No hardcoded\n *     plugin list per host.\n *   - Lazy: each provider is dynamically imported only when requested,\n *     keeping cold-start small for artifacts that don't need that\n *     capability.\n *   - Silent on missing deps: a host that doesn't ship the optional\n *     package (e.g. service-queue) just logs a warn and continues.\n */\n\nimport type { ObjectKernel } from '@objectstack/core';\n\nexport interface CapabilitySpec {\n    /** npm package name to import. */\n    pkg: string;\n    /** Named export — class constructor for the main plugin. */\n    export: string;\n    /**\n     * Optional bundle key that, when present, is forwarded as constructor\n     * argument (e.g. analytics needs `analyticsCubes`).\n     */\n    configKey?: string;\n    /** Auxiliary plugins loaded alongside the main one. */\n    extras?: Array<{ pkg: string; export: string }>;\n}\n\n/**\n * Registry of `requires` token → plugin provider.\n *\n * Keep keys in sync with the user-facing tokens accepted by\n * `defineStack({ requires: [...] })` and the CLI's CAPABILITY_PROVIDERS.\n *\n * Tier-gated capabilities (`auth`, `ui`, `i18n`) are intentionally NOT\n * listed here — they are wired explicitly by the kernel factory because\n * they need bespoke configuration (per-project HKDF secret, UI dist\n * paths, etc).\n */\nexport const CAPABILITY_PROVIDERS: Record<string, CapabilitySpec> = {\n    automation: {\n        pkg: '@objectstack/service-automation',\n        export: 'AutomationServicePlugin',\n        extras: [\n            { pkg: '@objectstack/service-automation', export: 'CrudNodesPlugin' },\n            { pkg: '@objectstack/service-automation', export: 'LogicNodesPlugin' },\n            { pkg: '@objectstack/service-automation', export: 'HttpConnectorPlugin' },\n            { pkg: '@objectstack/service-automation', export: 'ScreenNodesPlugin' },\n        ],\n    },\n    ai: {\n        pkg: '@objectstack/service-ai',\n        export: 'AIServicePlugin',\n    },\n    analytics: {\n        pkg: '@objectstack/service-analytics',\n        export: 'AnalyticsServicePlugin',\n        configKey: 'analyticsCubes',\n    },\n    audit: {\n        pkg: '@objectstack/plugin-audit',\n        export: 'AuditPlugin',\n    },\n    cache: {\n        pkg: '@objectstack/service-cache',\n        export: 'CacheServicePlugin',\n    },\n    storage: {\n        pkg: '@objectstack/service-storage',\n        export: 'StorageServicePlugin',\n    },\n    queue: {\n        pkg: '@objectstack/service-queue',\n        export: 'QueueServicePlugin',\n    },\n    job: {\n        pkg: '@objectstack/service-job',\n        export: 'JobServicePlugin',\n    },\n    realtime: {\n        pkg: '@objectstack/service-realtime',\n        export: 'RealtimeServicePlugin',\n    },\n    feed: {\n        pkg: '@objectstack/service-feed',\n        export: 'FeedServicePlugin',\n    },\n    settings: {\n        pkg: '@objectstack/service-settings',\n        export: 'SettingsServicePlugin',\n    },\n};\n\ntype Logger = { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };\n\nexport interface LoadCapabilitiesOptions {\n    kernel: ObjectKernel;\n    /** Tokens from `bundle.requires` (e.g. `['ai','automation','analytics']`). */\n    requires: readonly string[];\n    /** Compiled artifact metadata. Used to pull `configKey`-driven args. */\n    bundle: Record<string, unknown>;\n    /** Optional logger. */\n    logger?: Logger;\n    /** environmentId for log breadcrumbs. */\n    environmentId: string;\n}\n\n/**\n * Walk `requires` and install each known capability on the kernel.\n *\n * Returns the list of plugin exports actually installed for diagnostics.\n */\nexport async function loadCapabilities(opts: LoadCapabilitiesOptions): Promise<string[]> {\n    const { kernel, requires, bundle, environmentId } = opts;\n    const logger: Logger = opts.logger ?? console;\n    const installed: string[] = [];\n\n    for (const cap of requires) {\n        const spec = CAPABILITY_PROVIDERS[cap];\n        if (!spec) {\n            // Tier-gated capability (auth/ui/i18n) — wired elsewhere.\n            continue;\n        }\n\n        try {\n            const mod: any = await import(/* webpackIgnore: true */ spec.pkg);\n            const Ctor = mod[spec.export];\n            if (!Ctor) {\n                logger.warn?.(\n                    `[CapabilityLoader] '${cap}': package '${spec.pkg}' did not export '${spec.export}'`,\n                    { environmentId },\n                );\n                continue;\n            }\n\n            let arg: unknown;\n            if (spec.configKey) {\n                const v = (bundle as Record<string, unknown>)[spec.configKey];\n                if (spec.configKey === 'analyticsCubes') {\n                    arg = { cubes: Array.isArray(v) ? v : [] };\n                } else if (v !== undefined) {\n                    arg = v;\n                }\n            }\n\n            await kernel.use(arg !== undefined ? new Ctor(arg) : new Ctor());\n            installed.push(spec.export);\n\n            if (spec.extras) {\n                for (const ex of spec.extras) {\n                    try {\n                        const exMod: any = await import(/* webpackIgnore: true */ ex.pkg);\n                        const ExCtor = exMod[ex.export];\n                        if (ExCtor) {\n                            await kernel.use(new ExCtor());\n                            installed.push(ex.export);\n                        }\n                    } catch {\n                        // Optional extra — silently skip.\n                    }\n                }\n            }\n\n            logger.info?.(\n                `[CapabilityLoader] '${cap}' installed (${spec.export}${spec.extras ? ' + ' + spec.extras.length + ' extras' : ''})`,\n                { environmentId },\n            );\n        } catch (err: any) {\n            const msg = err?.message ?? String(err);\n            if (msg.includes('Cannot find module') || msg.includes('ERR_MODULE_NOT_FOUND')) {\n                logger.warn?.(\n                    `[CapabilityLoader] '${cap}' requested but '${spec.pkg}' not installed in host — skipped`,\n                    { environmentId },\n                );\n            } else {\n                logger.error?.(\n                    `[CapabilityLoader] '${cap}' load failed: ${msg}`,\n                    { environmentId },\n                );\n            }\n        }\n    }\n\n    return installed;\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * AuthProxyPlugin\n *\n * Mounts a single `/api/v1/auth/*` wildcard route on the host's Hono server\n * that forwards every request to the per-project `AuthManager` registered\n * by `ArtifactKernelFactory`.\n *\n * Why a dedicated plugin: AuthPlugin (better-auth) registers its routes by\n * grabbing the host's `http-server` service from its own `PluginContext`.\n * In objectos runtime mode AuthPlugin lives on a per-project kernel — it\n * has no access to the host's HTTP server, so its `kernel:ready` route\n * registration is a no-op. The dispatcher plugin's wildcard registration\n * via `IHttpServer.post('/auth/*', …)` proved unreliable in practice,\n * so this plugin uses Hono's raw app directly (same path AuthPlugin took\n * historically) which is rock solid.\n *\n * Routing:\n *   1. Resolve the project from the request hostname via `env-registry`.\n *   2. Acquire the project's kernel via `kernel-manager`.\n *   3. Look up the `auth` service on that kernel — this is the better-auth\n *      handler injected by `ArtifactKernelFactory`.\n *   4. Build a Web `Request` using the project's canonical baseUrl and\n *      hand it to the better-auth handler.\n *   5. Stream the response back through Hono.\n */\n\nimport type { Plugin, PluginContext } from '@objectstack/core';\nimport type { KernelManager } from './kernel-manager.js';\nimport type { EnvironmentDriverRegistry } from './environment-registry.js';\n\nconst AUTH_PREFIX = '/api/v1/auth';\n\n// AuthCapableManager interface removed — unused (pickHandler uses duck typing on `any`).\n\nfunction pickHandler(svc: any): ((req: Request) => Promise<Response>) | undefined {\n    if (!svc) return undefined;\n    // AuthManager exposes handleRequest(req) — preferred entry point.\n    if (typeof svc.handleRequest === 'function') return svc.handleRequest.bind(svc);\n    if (typeof svc.handler === 'function') return svc.handler.bind(svc);\n    if (svc.api && typeof svc.api.handler === 'function') return svc.api.handler.bind(svc.api);\n    // AuthManager keeps the better-auth instance under `auth`.\n    if (svc.auth && typeof svc.auth.handler === 'function') return svc.auth.handler.bind(svc.auth);\n    return undefined;\n}\n\nasync function resolveAuthHandler(svc: any): Promise<((req: Request) => Promise<Response>) | undefined> {\n    const direct = pickHandler(svc);\n    if (direct) return direct;\n    if (typeof svc?.getApi === 'function') {\n        try {\n            const api = await svc.getApi();\n            return pickHandler(api) ?? pickHandler({ api });\n        } catch {\n            return undefined;\n        }\n    }\n    return undefined;\n}\n\nexport class AuthProxyPlugin implements Plugin {\n    readonly name = 'com.objectstack.runtime.auth-proxy';\n    readonly version = '1.0.0';\n\n    init = async (_ctx: PluginContext): Promise<void> => {\n        // No services registered — pure HTTP wiring during start().\n    };\n\n    start = async (ctx: PluginContext): Promise<void> => {\n        // Mount routes on kernel:ready so HonoServerPlugin has finished\n        // registering the http-server service. Doing this in start() can\n        // race with HonoServerPlugin.init/start ordering.\n        ctx.hook('kernel:ready', async () => {\n            let httpServer: any;\n            try {\n                httpServer = ctx.getService('http-server');\n            } catch {\n                ctx.logger?.warn?.('[AuthProxyPlugin] http-server not available — auth routes not mounted');\n                return;\n            }\n            if (!httpServer || typeof httpServer.getRawApp !== 'function') {\n                ctx.logger?.warn?.('[AuthProxyPlugin] http-server missing getRawApp() — auth routes not mounted');\n                return;\n            }\n\n            const rawApp = httpServer.getRawApp();\n            const kernelManager = ctx.getService<KernelManager>('kernel-manager');\n            const envRegistry = ctx.getService<EnvironmentDriverRegistry>('env-registry');\n\n            const handler = async (c: any) => {\n                try {\n                    const url = new URL(c.req.url);\n                    const host = url.hostname;\n                    let environmentId: string | undefined;\n                    try {\n                        const env = await envRegistry.resolveByHostname(host);\n                        environmentId = env?.environmentId;\n                    } catch {\n                        // ignore\n                    }\n                    if (!environmentId) {\n                        return c.json({ error: 'project_not_found', host }, 404);\n                    }\n\n                    const projectKernel = await kernelManager.getOrCreate(environmentId);\n                    let authSvc: any;\n                    try {\n                        authSvc = await (projectKernel as any).getServiceAsync?.('auth');\n                    } catch { authSvc = undefined; }\n                    if (!authSvc) {\n                        try { authSvc = (projectKernel as any).getService?.('auth'); } catch { /* ignore */ }\n                    }\n\n                    // Custom non-better-auth endpoints. better-auth has no\n                    // /config or /bootstrap-status route, so without these\n                    // short-circuits the request would fall through to the\n                    // better-auth handler and 404. The Account SPA needs\n                    // /config to render the \"Continue with ObjectStack\"\n                    // platform SSO button via SocialSignInButtons.\n                    const subPath = url.pathname.startsWith(AUTH_PREFIX + '/')\n                        ? url.pathname.substring(AUTH_PREFIX.length + 1)\n                        : '';\n                    if (c.req.method === 'GET' && (subPath === 'config' || subPath === 'bootstrap-status')) {\n                        if (subPath === 'config') {\n                            try {\n                                const config = typeof authSvc?.getPublicConfig === 'function'\n                                    ? authSvc.getPublicConfig()\n                                    : null;\n                                if (config) {\n                                    return c.json({ success: true, data: config });\n                                }\n                                return c.json({ success: false, error: { code: 'auth_config_unavailable', message: 'AuthManager has no getPublicConfig()' } }, 503);\n                            } catch (e: any) {\n                                return c.json({ success: false, error: { code: 'auth_config_error', message: String(e?.message ?? e) } }, 500);\n                            }\n                        }\n                        // bootstrap-status\n                        try {\n                            // Report the real local owner state. Earlier the\n                            // proxy short-circuited to `hasOwner: true` as\n                            // soon as the `objectstack-cloud` SSO provider\n                            // was wired — the idea being \"identity lives in\n                            // cloud, JIT-create on first SSO callback\". That\n                            // forced every project to depend on cloud being\n                            // reachable for first-time setup AND made the\n                            // local /setup wizard unreachable. With SSO now\n                            // demoted to an *optional* federation button,\n                            // bootstrap status MUST reflect the project's\n                            // own `sys_user` table so /setup can run when\n                            // there is genuinely no local owner yet.\n                            const dataEngine = typeof authSvc?.getDataEngine === 'function'\n                                ? authSvc.getDataEngine()\n                                : null;\n                            if (!dataEngine || typeof dataEngine.count !== 'function') {\n                                return c.json({ hasOwner: true });\n                            }\n                            const count = await dataEngine.count('sys_user', {});\n                            return c.json({ hasOwner: (count ?? 0) > 0 });\n                        } catch {\n                            return c.json({ hasOwner: true });\n                        }\n                    }\n\n                    const fn = await resolveAuthHandler(authSvc);\n                    if (!fn) {\n                        return c.json({ error: 'auth_service_unavailable', environmentId }, 503);\n                    }\n\n                    // Forward the original Web Request directly — better-auth\n                    // accepts a standard `Request` and returns a `Response`.\n                    const resp = await fn(c.req.raw);\n\n                    // ── Cookie-leak cleanup ─────────────────────────────────\n                    // Cloud previously set OS_COOKIE_DOMAIN=.objectos.app,\n                    // which made cloud's better-auth session cookies leak\n                    // into every *.objectos.app project subdomain and\n                    // collide with each project's own session_token.\n                    // The setting has been removed from cloud, but existing\n                    // browsers still carry the wide-scoped cookies. Append\n                    // delete instructions (Max-Age=0 + matching Domain) on\n                    // every per-project auth response so the leaked cookies\n                    // get drained on the next auth round-trip. Safe to keep\n                    // long-term: it only deletes cookies on a parent domain\n                    // that project containers never legitimately set.\n                    const rootDomain = process.env.OS_ROOT_DOMAIN || '';\n                    if (rootDomain) {\n                        const leakyDomain = rootDomain.startsWith('.') ? rootDomain : `.${rootDomain}`;\n                        const leakyNames = [\n                            '__Secure-better-auth.session_token',\n                            'better-auth.session_token',\n                            '__Secure-better-auth.state',\n                            'better-auth.state',\n                            '__Secure-better-auth.csrf_token',\n                            'better-auth.csrf_token',\n                        ];\n                        try {\n                            for (const n of leakyNames) {\n                                const isSecure = n.startsWith('__Secure-');\n                                const attrs = `Max-Age=0; Path=/; Domain=${leakyDomain}; SameSite=Lax${isSecure ? '; Secure' : ''}`;\n                                (resp as any).headers?.append?.('Set-Cookie', `${n}=; ${attrs}`);\n                            }\n                        } catch { /* best-effort cleanup */ }\n                    }\n\n                    return resp;\n                } catch (err: any) {\n                    (ctx.logger?.error as any)?.('[AuthProxyPlugin] auth dispatch failed', {\n                        error: err?.message,\n                        stack: err?.stack,\n                    });\n                    return c.json({\n                        error: 'auth_dispatch_failed',\n                        message: err?.message ?? String(err),\n                    }, 500);\n                }\n            };\n\n            // Mount on every method via Hono's `all`. AuthPlugin previously\n            // registered with `rawApp.all('/api/v1/auth/*', handler)` — same\n            // shape here.\n            if (typeof rawApp.all === 'function') {\n                rawApp.all(`${AUTH_PREFIX}/*`, handler);\n            } else {\n                for (const m of ['get', 'post', 'put', 'delete', 'patch', 'options'] as const) {\n                    try { rawApp[m]?.(`${AUTH_PREFIX}/*`, handler); } catch { /* best effort */ }\n                }\n            }\n            ctx.logger?.info?.(`[AuthProxyPlugin] auth proxy mounted at ${AUTH_PREFIX}/*`);\n        });\n    };\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Shared marketplace / cloud control-plane defaults.\n *\n * Centralised so every plugin + the CLI auto-inject path agree on\n * \"what cloud URL do we mean when the user didn't set OS_CLOUD_URL?\".\n * Until we have a competing public hosted cloud, this points at the\n * ObjectStack-operated control plane so a vanilla `objectstack dev` can\n * browse the marketplace out of the box.\n */\nexport const DEFAULT_CLOUD_URL = 'https://cloud.objectos.app';\n\n/**\n * Resolve the effective control-plane URL from an explicit constructor\n * value, the OS_CLOUD_URL env var, or the default. Returns an empty\n * string when the caller explicitly disabled cloud with\n * `OS_CLOUD_URL=off` / `local` — callers should treat that as\n * \"marketplace unavailable on this runtime\".\n */\nexport function resolveCloudUrl(explicit?: string | null): string {\n    const raw = (explicit ?? process.env.OS_CLOUD_URL ?? '').trim();\n    const lower = raw.toLowerCase();\n    if (lower === 'off' || lower === 'none' || lower === 'local' || lower === 'disabled') {\n        return '';\n    }\n    const picked = raw || DEFAULT_CLOUD_URL;\n    return picked.replace(/\\/+$/, '');\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * MarketplaceProxyPlugin\n *\n * Forwards `GET /api/v1/marketplace/*` from a tenant ObjectOS runtime to\n * the configured ObjectStack Cloud control-plane URL. The cloud endpoint\n * (`packages/service-cloud/src/routes/marketplace.ts`) is unauthenticated\n * and only exposes packages whose owner has opted in to the public catalog\n * (`sys_package.marketplace_listed = true`) — so the proxy passes through\n * without any credentials.\n *\n * Why proxy instead of direct browser → cloud:\n *   - The Console SPA stays on the tenant origin, so no CORS configuration\n *     is required on the cloud side.\n *   - Local-dev `os serve` works regardless of whether the developer's\n *     browser has cookies for cloud.objectos.app.\n *   - Adds a single, easily auditable network seam between tenant and\n *     control plane.\n *\n * Install is NOT proxied here. Installing a package mutates control-plane\n * state and requires a cloud session + active organization context — the\n * Console SPA performs install by opening the cloud's install dialog in a\n * new tab so the user authenticates against cloud directly. A future\n * iteration may introduce a delegated install token; until then, browse\n * here and install on cloud.\n */\n\nimport type { Plugin, PluginContext } from '@objectstack/core';\nimport { resolveCloudUrl } from './cloud-url.js';\n\nconst MARKETPLACE_PREFIX = '/api/v1/marketplace';\n\nexport interface MarketplaceProxyPluginConfig {\n    /**\n     * Control-plane base URL (e.g. https://cloud.objectos.app). When the\n     * caller passes nothing AND the runtime has no OS_CLOUD_URL set, the\n     * plugin falls back to the public ObjectStack-operated cloud so that\n     * `objectstack dev` can browse the marketplace out of the box. Set\n     * OS_CLOUD_URL=off (or `local`) to opt out — the plugin then mounts\n     * a stub that responds 503 and the SPA renders an empty-state\n     * explaining marketplace is unavailable in this runtime.\n     */\n    controlPlaneUrl?: string;\n}\n\nexport class MarketplaceProxyPlugin implements Plugin {\n    readonly name = 'com.objectstack.runtime.marketplace-proxy';\n    readonly version = '1.0.0';\n\n    private readonly cloudUrl: string;\n\n    constructor(config: MarketplaceProxyPluginConfig = {}) {\n        this.cloudUrl = resolveCloudUrl(config.controlPlaneUrl);\n    }\n\n    init = async (_ctx: PluginContext): Promise<void> => {\n        // No services registered — pure HTTP wiring during start().\n    };\n\n    start = async (ctx: PluginContext): Promise<void> => {\n        ctx.hook('kernel:ready', async () => {\n            let httpServer: any;\n            try {\n                httpServer = ctx.getService('http-server');\n            } catch {\n                ctx.logger?.warn?.('[MarketplaceProxyPlugin] http-server not available — marketplace routes not mounted');\n                return;\n            }\n            if (!httpServer || typeof httpServer.getRawApp !== 'function') {\n                ctx.logger?.warn?.('[MarketplaceProxyPlugin] http-server missing getRawApp() — marketplace routes not mounted');\n                return;\n            }\n\n            const rawApp = httpServer.getRawApp();\n            const cloudUrl = this.cloudUrl;\n\n            const handler = async (c: any, next: any) => {\n                if (!cloudUrl) {\n                    return c.json({\n                        success: false,\n                        error: {\n                            code: 'marketplace_unavailable',\n                            message: 'No control-plane URL configured for this runtime (OS_CLOUD_URL).',\n                        },\n                    }, 503);\n                }\n                try {\n                    const incomingUrl = new URL(c.req.url);\n                    // Do NOT proxy install-local — those are owned by\n                    // MarketplaceInstallLocalPlugin and must hit this\n                    // runtime, never cloud. Pass through so Hono can match\n                    // the install-local route registered on the same app.\n                    if (incomingUrl.pathname.startsWith(`${MARKETPLACE_PREFIX}/install-local`)) {\n                        return next();\n                    }\n                    // Preserve the full /api/v1/marketplace/... path on cloud.\n                    const target = `${cloudUrl}${incomingUrl.pathname}${incomingUrl.search}`;\n\n                    // Forward only safe, idempotent methods. We intentionally\n                    // do NOT proxy POST / PUT / DELETE here — those would\n                    // need credentialled cloud auth which the tenant runtime\n                    // does not carry.\n                    const method = String(c.req.method ?? 'GET').toUpperCase();\n                    if (method !== 'GET' && method !== 'HEAD') {\n                        return c.json({\n                            success: false,\n                            error: {\n                                code: 'marketplace_method_not_allowed',\n                                message: `Marketplace proxy only forwards GET/HEAD; install via cloud.`,\n                            },\n                        }, 405);\n                    }\n\n                    const resp = await fetch(target, {\n                        method,\n                        headers: {\n                            // Strip the inbound Host header — fetch will set\n                            // it to the cloud host. Forward only the\n                            // identifying headers cloud might log.\n                            'Accept': c.req.header('accept') ?? 'application/json',\n                            'User-Agent': `objectos-marketplace-proxy/${MarketplaceProxyPlugin.prototype.version ?? '1.0.0'}`,\n                        },\n                    });\n\n                    const headers = new Headers();\n                    const passthroughHeaders = ['content-type', 'cache-control', 'etag', 'last-modified'];\n                    for (const h of passthroughHeaders) {\n                        const v = resp.headers.get(h);\n                        if (v) headers.set(h, v);\n                    }\n\n                    const body = await resp.arrayBuffer();\n                    return new Response(body, { status: resp.status, headers });\n                } catch (err: any) {\n                    const errObj = err instanceof Error ? err : new Error(err?.message ?? String(err));\n                    ctx.logger?.error?.('[MarketplaceProxyPlugin] proxy failed', errObj);\n                    return c.json({\n                        success: false,\n                        error: {\n                            code: 'marketplace_proxy_failed',\n                            message: err?.message ?? String(err),\n                        },\n                    }, 502);\n                }\n            };\n\n            if (typeof rawApp.all === 'function') {\n                rawApp.all(`${MARKETPLACE_PREFIX}/*`, handler);\n            } else {\n                for (const m of ['get', 'head'] as const) {\n                    try { rawApp[m]?.(`${MARKETPLACE_PREFIX}/*`, handler); } catch { /* best effort */ }\n                }\n            }\n\n            ctx.logger?.info?.(`[MarketplaceProxyPlugin] mounted at ${MARKETPLACE_PREFIX}/* → ${cloudUrl || '(unconfigured)'}`);\n        });\n    };\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * File-backed ArtifactApiClient.\n *\n * A drop-in replacement for {@link ArtifactApiClient} that reads a\n * single project's compiled artifact from a local JSON file instead of\n * an HTTP control plane. Intended for:\n *\n *   - `pnpm dev` workflows where standing up a full `apps/cloud`\n *     instance to host one artifact is overkill.\n *   - Smoke tests / CI that need a hermetic objectos boot.\n *   - Single-tenant self-hosted deployments that ship one artifact\n *     baked into the container image.\n *\n * Hostname resolution is the identity function: every host resolves\n * to the same `environmentId`. The runtime config (database URL +\n * driver) is synthesised from the artifact's default datasource,\n * matching what the cloud API would mint for a project whose\n * developer declared an inline datasource in `defineStack()`.\n *\n * Public API mirrors {@link ArtifactApiClient} so callers can swap\n * implementations transparently.\n */\n\nimport { readFile, stat } from 'node:fs/promises';\nimport { resolve as resolvePath } from 'node:path';\nimport type {\n    EnvironmentArtifactResponse,\n    EnvironmentRuntimeConfig,\n    ResolvedHostname,\n} from './artifact-api-client.js';\n\nexport interface FileArtifactApiClientConfig {\n    /**\n     * Path to a compiled artifact JSON file (`dist/objectstack.json`).\n     * Resolved against `process.cwd()` when relative. Defaults to\n     * `<cwd>/dist/objectstack.json`.\n     */\n    artifactPath?: string;\n    /**\n     * Project id every hostname maps to. Defaults to\n     * `process.env.OS_ENVIRONMENT_ID` or `'proj_local'`.\n     */\n    environmentId?: string;\n    /**\n     * Organization id surfaced alongside the project. Defaults to\n     * `process.env.OS_ORGANIZATION_ID` or `'org_local'`.\n     */\n    organizationId?: string;\n    /**\n     * Override runtime config. When unset, the client tries to derive\n     * one from the artifact's `datasources` array; if that fails it\n     * falls back to a local-file SQLite DB at\n     * `<cwd>/.objectstack/data/<environmentId>.db`.\n     */\n    runtime?: EnvironmentRuntimeConfig;\n    /**\n     * Reload the artifact on every fetch instead of caching the first\n     * read. Useful when iterating on a project's metadata without\n     * restarting objectos. Defaults to `true` for dev ergonomics.\n     */\n    watch?: boolean;\n    /** Optional logger. */\n    logger?: { info?: (...a: any[]) => void; warn?: (...a: any[]) => void; error?: (...a: any[]) => void };\n}\n\nexport class FileArtifactApiClient {\n    private readonly artifactPath: string;\n    private readonly environmentId: string;\n    private readonly organizationId: string;\n    private readonly overrideRuntime?: EnvironmentRuntimeConfig;\n    private readonly watch: boolean;\n    private readonly logger: NonNullable<FileArtifactApiClientConfig['logger']>;\n\n    private cached?: { mtimeMs: number; response: EnvironmentArtifactResponse };\n\n    constructor(config: FileArtifactApiClientConfig = {}) {\n        const cwd = process.cwd();\n        this.artifactPath = resolvePath(\n            cwd,\n            config.artifactPath\n                ?? process.env.OS_ARTIFACT_PATH\n                ?? 'dist/objectstack.json',\n        );\n        this.environmentId = config.environmentId\n            ?? process.env.OS_ENVIRONMENT_ID\n            ?? 'proj_local';\n        this.organizationId = config.organizationId\n            ?? process.env.OS_ORGANIZATION_ID\n            ?? 'org_local';\n        this.overrideRuntime = config.runtime;\n        this.watch = config.watch ?? true;\n        this.logger = config.logger ?? console;\n    }\n\n    async resolveHostname(_host: string): Promise<ResolvedHostname | null> {\n        // Single-project mode: every host maps to the one configured project.\n        const runtime = this.overrideRuntime ?? (await this.readRuntimeFromArtifact());\n        return {\n            environmentId: this.environmentId,\n            organizationId: this.organizationId,\n            ...(runtime ? { runtime } : {}),\n        };\n    }\n\n    async fetchArtifact(_environmentId: string, _opts?: { commit?: string }): Promise<EnvironmentArtifactResponse | null> {\n        return this.loadArtifact();\n    }\n\n    async lookupProjectByShortId(_shortId: string): Promise<{ environmentId: string; organizationId?: string } | null> {\n        return { environmentId: this.environmentId, organizationId: this.organizationId };\n    }\n\n    async fetchBranchHead(\n        _environmentId: string,\n        _branchName: string,\n    ): Promise<{ commitId: string; publishedAt?: string | null } | null> {\n        const artifact = await this.loadArtifact();\n        return artifact\n            ? { commitId: artifact.commitId ?? 'local', publishedAt: null }\n            : null;\n    }\n\n    invalidate(_environmentId: string): void {\n        this.cached = undefined;\n    }\n\n    clear(): void {\n        this.cached = undefined;\n    }\n\n    private async loadArtifact(): Promise<EnvironmentArtifactResponse | null> {\n        try {\n            const stats = await stat(this.artifactPath);\n            const mtimeMs = stats.mtimeMs;\n            if (!this.watch && this.cached) return this.cached.response;\n            if (this.cached && this.cached.mtimeMs === mtimeMs) return this.cached.response;\n\n            const raw = await readFile(this.artifactPath, 'utf8');\n            const parsed = JSON.parse(raw);\n            // The compiled JSON may already be a `EnvironmentArtifact` envelope\n            // (with a `metadata` block) or a bare bundle. Wrap when needed.\n            const isEnvelope = parsed && typeof parsed === 'object'\n                && typeof parsed.metadata === 'object'\n                && parsed.metadata !== null;\n            const metadata = isEnvelope ? parsed.metadata : parsed;\n            const runtime = this.overrideRuntime\n                ?? (isEnvelope ? parsed.runtime : undefined)\n                ?? this.deriveRuntimeFromMetadata(metadata)\n                ?? this.defaultLocalSqliteRuntime();\n            const response: EnvironmentArtifactResponse = {\n                schemaVersion: parsed.schemaVersion ?? '1',\n                environmentId: parsed.environmentId ?? this.environmentId,\n                commitId: parsed.commitId ?? 'local',\n                checksum: parsed.checksum ?? '',\n                publishedAt: parsed.publishedAt ?? new Date().toISOString(),\n                metadata,\n                functions: parsed.functions,\n                manifest: parsed.manifest,\n                runtime: {\n                    organizationId: this.organizationId,\n                    ...runtime,\n                },\n            } as EnvironmentArtifactResponse;\n            this.cached = { mtimeMs, response };\n            return response;\n        } catch (err: any) {\n            this.logger.error?.('[FileArtifactApiClient] failed to load artifact', {\n                artifactPath: this.artifactPath,\n                error: err?.message ?? err,\n            });\n            return null;\n        }\n    }\n\n    private async readRuntimeFromArtifact(): Promise<EnvironmentRuntimeConfig | undefined> {\n        const artifact = await this.loadArtifact();\n        return artifact?.runtime;\n    }\n\n    private deriveRuntimeFromMetadata(metadata: any): EnvironmentRuntimeConfig | undefined {\n        const datasources = metadata?.datasources;\n        if (!Array.isArray(datasources) || datasources.length === 0) return undefined;\n        const mapping: any[] | undefined = metadata?.datasourceMapping;\n        let preferredName: string | undefined;\n        if (mapping) {\n            const def = mapping.find((m: any) => m?.default === true);\n            if (def?.datasource) preferredName = def.datasource;\n        }\n        const ds = preferredName\n            ? datasources.find((d: any) => d?.name === preferredName) ?? datasources[0]\n            : datasources[0];\n        if (!ds || typeof ds !== 'object') return undefined;\n        const config = (ds.config ?? {}) as Record<string, any>;\n        const url = config.url ?? config.connectionString ?? config.connection ?? config.filename;\n        const driver = ds.driver;\n        if (typeof driver !== 'string' || typeof url !== 'string') return undefined;\n        return {\n            databaseDriver: driver,\n            databaseUrl: url,\n            databaseAuthToken: typeof config.authToken === 'string' ? config.authToken : undefined,\n        };\n    }\n\n    private defaultLocalSqliteRuntime(): EnvironmentRuntimeConfig {\n        const cwd = process.cwd();\n        const dbPath = resolvePath(cwd, '.objectstack/data', `${this.environmentId}.db`);\n        return {\n            databaseDriver: 'sqlite',\n            databaseUrl: `file:${dbPath}`,\n        };\n    }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * createObjectOSStack\n *\n * ObjectOS pure-runtime stack — no control-plane database, no auth /\n * security / audit / tenant plugins. The host kernel registers:\n *\n *   - A minimal engine triplet (ObjectQL + in-memory DriverPlugin +\n *     MetadataPlugin) so CLI auto-injected plugins (Setup, Studio,\n *     Dispatcher, REST) and the runtime can boot. The host kernel itself\n *     never reads or writes business data — every record query is routed\n *     to a per-project kernel built from a remote artifact.\n *   - The `env-registry` and `kernel-manager` services, so the runtime's\n *     HTTP dispatcher can resolve hostnames and dispatch every request\n *     to the matching project kernel.\n *\n * Invoked by `createRuntimeStack()` whenever `OS_CLOUD_URL`\n * (or `config.controlPlaneUrl`) is set. The same plugin shape is returned\n * as `createCloudStack()` so host configs can swap stacks transparently.\n */\n\nimport { Plugin, PluginContext } from '@objectstack/core';\nimport type { EnvironmentDriverRegistry } from './environment-registry.js';\nimport { KernelManager } from './kernel-manager.js';\nimport { ArtifactApiClient } from './artifact-api-client.js';\nimport { ArtifactEnvironmentRegistry } from './artifact-environment-registry.js';\nimport { ArtifactKernelFactory } from './artifact-kernel-factory.js';\nimport { AuthProxyPlugin } from './auth-proxy-plugin.js';\nimport { MarketplaceProxyPlugin } from './marketplace-proxy-plugin.js';\nimport { FileArtifactApiClient, type FileArtifactApiClientConfig } from './file-artifact-api-client.js';\n\nexport interface ObjectOSStackConfig {\n    /**\n     * Control-plane base URL (HTTP) or a sentinel of `'file'` for the\n     * local file-backed dev mode. Required unless `client` is supplied.\n     *\n     * - `http(s)://…`  — talk to a real ObjectStack Cloud control plane\n     *   over HTTP and resolve hostnames via its `/cloud/*` API.\n     * - `'file'`       — load a single project from a local\n     *   `dist/objectstack.json` (or `fileConfig.artifactPath`). Every\n     *   request, regardless of hostname, resolves to the same project.\n     *   Intended for `pnpm dev` / smoke tests where standing up a\n     *   separate control plane is overkill.\n     */\n    controlPlaneUrl?: string;\n    /** Optional bearer token for the control-plane API. */\n    controlPlaneApiKey?: string;\n    /**\n     * Override the artifact client entirely. When supplied,\n     * `controlPlaneUrl` is ignored — useful for tests or custom transports.\n     */\n    client?: ArtifactApiClient | FileArtifactApiClient;\n    /** Config for the file-backed mode (used when `controlPlaneUrl === 'file'`). */\n    fileConfig?: FileArtifactApiClientConfig;\n    /** KernelManager LRU size. Default: 32. */\n    kernelCacheSize?: number;\n    /** KernelManager idle TTL (ms). Default: 15 min. */\n    kernelTtlMs?: number;\n    /** EnvironmentDriverRegistry cache TTL (ms). Default: 5 min. */\n    envCacheTtlMs?: number;\n    /** Artifact / hostname response cache TTL (ms). Default: 5 min. */\n    artifactCacheTtlMs?: number;\n    /** API prefix (carried for parity with cloud-stack). Default: /api/v1. */\n    apiPrefix?: string;\n}\n\nexport interface ObjectOSStackResult {\n    plugins: any[];\n    api: { enableProjectScoping: true; projectResolution: 'auto'; requireAuth: true };\n}\n\n/**\n * Lazy-loaded host engine plugins. Mirrors the head of\n * `createControlPlanePlugins()` — ObjectQL + InMemory Driver + Metadata.\n *\n * The host kernel in objectos is a pure routing shell. Per-tenant auth +\n * business data live in per-project kernels (each backed by the project's\n * own Turso/Postgres DB), so there is nothing to persist on the host.\n *\n * AuthPlugin is intentionally NOT injected on the host (CLI's\n * `serve.ts` auto-injection guard skips it when `OS_CLOUD_URL` is set).\n * Identity is owned by `ArtifactKernelFactory` per project so that:\n *   - users persist in the project's DB across container cold-starts\n *   - cookies are scoped to the project's hostname (no `.<root>`-wide leak)\n *   - tokens are signed with a per-project HKDF-derived secret\n */\nasync function createHostEnginePlugins(): Promise<Plugin[]> {\n    const { ObjectQLPlugin } = await import('@objectstack/objectql');\n    const { DriverPlugin } = await import('../driver-plugin.js');\n    const { MetadataPlugin } = await import('@objectstack/metadata');\n    const { InMemoryDriver } = await import('@objectstack/driver-memory');\n\n    const driver = new InMemoryDriver();\n    const driverName = 'memory';\n\n    const oqlRef: { ql: any } = { ql: null };\n    const objectql: Plugin = {\n        name: 'com.objectstack.engine.objectql',\n        version: '0.0.0',\n        async init(ctx: PluginContext) {\n            const plugin = new ObjectQLPlugin();\n            (this as any)._inner = plugin;\n            if ((plugin as any).init) await (plugin as any).init(ctx);\n            // Capture the engine instance AFTER init() — ObjectQLPlugin\n            // creates its `ql` lazily inside init(), so reading `plugin.ql`\n            // before that returns undefined and breaks the\n            // datasource-mapping wiring below.\n            oqlRef.ql = (plugin as any).ql ?? plugin;\n        },\n        async start(ctx: PluginContext) {\n            const plugin = (this as any)._inner;\n            // Forward start() so ObjectQLPlugin can discover `driver.*`\n            // services (registered by DriverPlugin.init) and wire them\n            // into the engine via `ql.registerDriver(...)`. Without this\n            // the engine has zero drivers at request time, causing\n            // `[ObjectQL] No driver available for object '...'` errors.\n            if (plugin?.start) await plugin.start(ctx);\n        },\n        async destroy() {\n            const plugin = (this as any)._inner;\n            if (plugin?.destroy) await plugin.destroy();\n            else if (plugin?.stop) await plugin.stop();\n        },\n    };\n\n    const datasourceMapping: Plugin = {\n        name: 'objectos-host-datasource-mapping',\n        version: '0.0.0',\n        dependencies: ['com.objectstack.engine.objectql'],\n        async init() {\n            const ql = oqlRef.ql;\n            if (ql?.setDatasourceMapping) {\n                ql.setDatasourceMapping([\n                    { default: true, datasource: `com.objectstack.driver.${driverName}` },\n                ]);\n            }\n        },\n    };\n\n    const driverPlugin = new DriverPlugin(driver as any, driverName);\n\n    const metadata = new MetadataPlugin({\n        watch: false,\n        // The host kernel is a routing shell. It doesn't own metadata —\n        // every per-project kernel registers its own.\n        registerSystemObjects: false,\n    });\n\n    return [objectql, datasourceMapping, driverPlugin as unknown as Plugin, metadata as unknown as Plugin];\n}\n\n/**\n * Single host plugin that owns the artifact API client, the env registry,\n * and the kernel manager. Registered as services on the host kernel so\n * downstream plugins (the dispatcher, the REST API plugin) pick them up\n * automatically.\n */\nclass ObjectOSEnvironmentPlugin implements Plugin {\n    readonly name = 'com.objectstack.runtime.objectos-environment';\n    readonly version = '1.0.0';\n\n    private readonly config: ObjectOSStackConfig;\n    private kernelManager?: KernelManager;\n    private client?: ArtifactApiClient;\n\n    constructor(config: ObjectOSStackConfig) {\n        this.config = config;\n    }\n\n    init = async (ctx: PluginContext): Promise<void> => {\n        const client: ArtifactApiClient | FileArtifactApiClient = this.config.client\n            ?? (this.config.controlPlaneUrl === 'file'\n                ? new FileArtifactApiClient({\n                    ...(this.config.fileConfig ?? {}),\n                    logger: ctx.logger as any,\n                })\n                : new ArtifactApiClient({\n                    controlPlaneUrl: this.config.controlPlaneUrl!,\n                    apiKey: this.config.controlPlaneApiKey,\n                    cacheTtlMs: this.config.artifactCacheTtlMs,\n                    logger: ctx.logger,\n                }));\n        this.client = client as ArtifactApiClient;\n\n        const envRegistry: EnvironmentDriverRegistry = new ArtifactEnvironmentRegistry({\n            client: client as ArtifactApiClient,\n            cacheTtlMs: this.config.envCacheTtlMs,\n            logger: ctx.logger,\n        });\n\n        const factory = new ArtifactKernelFactory({\n            client: client as ArtifactApiClient,\n            envRegistry,\n            logger: ctx.logger,\n        });\n\n        const kernelManager = new KernelManager({\n            factory,\n            maxSize: this.config.kernelCacheSize,\n            ttlMs: this.config.kernelTtlMs,\n            logger: ctx.logger,\n        });\n        this.kernelManager = kernelManager;\n\n        ctx.registerService('env-registry', envRegistry);\n        ctx.registerService('kernel-manager', kernelManager);\n        ctx.registerService('artifact-api-client', client);\n\n        ctx.logger.info?.('ObjectOSEnvironmentPlugin: registered env-registry + kernel-manager', {\n            mode: this.config.controlPlaneUrl === 'file' ? 'file' : 'http',\n            controlPlaneUrl: this.config.controlPlaneUrl,\n        });\n    };\n\n    destroy = async (): Promise<void> => {\n        try { await this.kernelManager?.evictAll(); } catch { /* best effort */ }\n        try { this.client?.clear(); } catch { /* best effort */ }\n    };\n}\n\nexport async function createObjectOSStack(config: ObjectOSStackConfig): Promise<ObjectOSStackResult> {\n    if (!config.controlPlaneUrl && !config.client) {\n        throw new Error('[createObjectOSStack] either controlPlaneUrl or client is required');\n    }\n    const merged: ObjectOSStackConfig = {\n        ...config,\n        kernelCacheSize: Number(process.env.OS_KERNEL_CACHE_SIZE ?? config.kernelCacheSize ?? 32),\n        kernelTtlMs: Number(process.env.OS_KERNEL_TTL_MS ?? config.kernelTtlMs ?? 15 * 60 * 1000),\n        envCacheTtlMs: Number(process.env.OS_ENV_CACHE_TTL_MS ?? config.envCacheTtlMs ?? 5 * 60 * 1000),\n        artifactCacheTtlMs: Number(process.env.OS_ARTIFACT_CACHE_TTL_MS ?? config.artifactCacheTtlMs ?? 5 * 60 * 1000),\n    };\n\n    const enginePlugins = await createHostEnginePlugins();\n\n    return {\n        plugins: [...enginePlugins, new ObjectOSEnvironmentPlugin(merged), new AuthProxyPlugin(), new MarketplaceProxyPlugin({ controlPlaneUrl: merged.controlPlaneUrl === 'file' ? undefined : merged.controlPlaneUrl })],\n        api: {\n            enableProjectScoping: true,\n            projectResolution: 'auto',\n            // ObjectOS is multi-tenant: anonymous /api/v1/data/* must never\n            // leak per-project data across organisations. AuthProxyPlugin\n            // verifies upstream tokens and populates ctx.userId; requireAuth\n            // turns missing userId into 401 at the REST layer before the\n            // request reaches the per-project kernel.\n            requireAuth: true,\n        },\n    };\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * MarketplaceInstallLocalPlugin\n *\n * Installs marketplace packages into THIS runtime's kernel as opposed to a\n * remote cloud environment. Conceptually different from cloud install in\n * three important ways:\n *\n *   1. Single target — the local kernel is the only install target; there\n *      is no `sys_environment` picker.\n *   2. Manifests are cached on disk — once installed, the package is\n *      runnable offline. Cloud is only needed during the install action\n *      itself (to fetch the manifest snapshot).\n *   3. Coexists with user-authored apps — the local runtime usually has\n *      its own `objectstack.config.ts` declared apps. Install refuses to\n *      overwrite a manifest_id that's already registered to avoid silently\n *      replacing user code.\n *\n * Endpoints (mounted by `start()` on the `kernel:ready` hook):\n *\n *   POST   /api/v1/marketplace/install-local\n *          body: { packageId: string, versionId?: string }   (default: \"latest\")\n *          → fetches manifest from cloud, caches to disk, registers via\n *            the kernel's `manifest` service. Returns the installed entry.\n *\n *   GET    /api/v1/marketplace/install-local\n *          → lists currently installed marketplace packages\n *\n *   DELETE /api/v1/marketplace/install-local/:manifestId\n *          → removes the cached manifest. Kernel must be restarted to fully\n *            unload — `engine.registerApp` is additive only. We document\n *            this in the response message.\n *\n * Persistence layout:\n *   <cwd>/.objectstack/installed-packages/<safe-manifest-id>.json\n *   Each file: { packageId, versionId, manifestId, version, manifest, installedAt, installedBy }\n *\n * On `kernel:ready`, the plugin scans the directory and re-registers each\n * cached manifest so installs survive process restarts without further\n * cloud round-trips.\n */\n\nimport { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport type { Plugin, PluginContext } from '@objectstack/core';\nimport { resolveCloudUrl } from './cloud-url.js';\n\nconst ROUTE_BASE = '/api/v1/marketplace/install-local';\nconst DEFAULT_DIR = '.objectstack/installed-packages';\n\nexport interface MarketplaceInstallLocalPluginConfig {\n    /** Cloud control-plane base URL. When unset, falls back to OS_CLOUD_URL\n     *  and then to the public ObjectStack cloud so a fresh `objectstack dev`\n     *  can install from the marketplace without configuration. Set\n     *  OS_CLOUD_URL=off to disable (the install endpoint then returns 503). */\n    controlPlaneUrl?: string;\n    /** Override the on-disk cache directory. Defaults to\n     *  `<cwd>/.objectstack/installed-packages`. */\n    storageDir?: string;\n}\n\ninterface InstalledEntry {\n    packageId: string;\n    versionId: string;\n    manifestId: string;\n    version: string;\n    manifest: any;\n    installedAt: string;\n    installedBy: string | null;\n}\n\nfunction safeFilename(manifestId: string): string {\n    return manifestId.replace(/[^a-zA-Z0-9._-]/g, '_') + '.json';\n}\n\nexport class MarketplaceInstallLocalPlugin implements Plugin {\n    readonly name = 'com.objectstack.runtime.marketplace-install-local';\n    readonly version = '1.0.0';\n\n    private readonly cloudUrl: string;\n    private readonly storageDir: string;\n\n    constructor(config: MarketplaceInstallLocalPluginConfig = {}) {\n        this.cloudUrl = resolveCloudUrl(config.controlPlaneUrl);\n        this.storageDir = config.storageDir\n            ? resolve(config.storageDir)\n            : resolve(process.cwd(), DEFAULT_DIR);\n    }\n\n    init = async (_ctx: PluginContext): Promise<void> => {\n        // No services registered — pure HTTP wiring during start().\n    };\n\n    start = async (ctx: PluginContext): Promise<void> => {\n        ctx.hook('kernel:ready', async () => {\n            // 1. Rehydrate previously installed packages so they survive restart.\n            await this.rehydrate(ctx);\n\n            // 2. Mount HTTP endpoints.\n            let httpServer: any;\n            try {\n                httpServer = ctx.getService('http-server');\n            } catch {\n                ctx.logger?.warn?.('[MarketplaceInstallLocal] http-server not available — install endpoints not mounted');\n                return;\n            }\n            if (!httpServer || typeof httpServer.getRawApp !== 'function') {\n                ctx.logger?.warn?.('[MarketplaceInstallLocal] http-server missing getRawApp() — install endpoints not mounted');\n                return;\n            }\n            const rawApp = httpServer.getRawApp();\n\n            const postHandler = async (c: any) => this.handleInstall(c, ctx);\n            const getHandler = async (c: any) => this.handleList(c);\n            const deleteHandler = async (c: any) => this.handleUninstall(c, ctx);\n\n            if (typeof rawApp.post === 'function') rawApp.post(ROUTE_BASE, postHandler);\n            if (typeof rawApp.get === 'function') rawApp.get(ROUTE_BASE, getHandler);\n            if (typeof rawApp.delete === 'function') rawApp.delete(`${ROUTE_BASE}/:manifestId`, deleteHandler);\n\n            ctx.logger?.info?.(`[MarketplaceInstallLocal] mounted at ${ROUTE_BASE} (storage: ${this.storageDir})`);\n        });\n    };\n\n    /**\n     * Re-register every cached manifest with the kernel's manifest service.\n     * Safe to call on a kernel that already has the same manifest_id (the\n     * underlying ObjectQL registry overwrites by id, but we still warn so\n     * a developer can spot the dev-time clash between their config.ts and\n     * a marketplace package).\n     */\n    private rehydrate = async (ctx: PluginContext): Promise<void> => {\n        const entries = this.readAll();\n        if (entries.length === 0) return;\n\n        let manifestService: { register(m: any): void } | null = null;\n        try {\n            manifestService = ctx.getService('manifest') as any;\n        } catch {\n            ctx.logger?.warn?.('[MarketplaceInstallLocal] no `manifest` service — rehydrate skipped');\n            return;\n        }\n\n        for (const entry of entries) {\n            try {\n                manifestService!.register(entry.manifest);\n                // Sync schemas so the driver creates tables for the newly-\n                // registered objects (idempotent — already-synced tables\n                // are no-ops).\n                try {\n                    const ql: any = ctx.getService('objectql');\n                    if (ql && typeof ql.syncSchemas === 'function') await ql.syncSchemas();\n                } catch { /* non-fatal */ }\n                // Replay translations + register seed datasets, but don't\n                // re-run seeding — existing rows are already in the DB from\n                // the original install, and multi-tenant orgs will replay\n                // via the security middleware on next sys_organization insert.\n                await this.applySideEffects(ctx, entry.manifest, { seedNow: false });\n                ctx.logger?.info?.(`[MarketplaceInstallLocal] rehydrated ${entry.manifestId}@${entry.version}`);\n            } catch (err: any) {\n                ctx.logger?.error?.(`[MarketplaceInstallLocal] rehydrate failed for ${entry.manifestId}`, err instanceof Error ? err : new Error(String(err)));\n            }\n        }\n    };\n\n    private handleInstall = async (c: any, ctx: PluginContext): Promise<Response> => {\n        if (!this.cloudUrl) {\n            return c.json({ success: false, error: { code: 'marketplace_unavailable', message: 'OS_CLOUD_URL not configured.' } }, 503);\n        }\n        const userId = await this.requireAuthenticatedUser(c, ctx);\n        if (!userId) {\n            return c.json({ success: false, error: { code: 'unauthorized', message: 'Authentication required to install packages.' } }, 401);\n        }\n\n        let body: any = {};\n        try { body = await c.req.json(); } catch { /* empty body */ }\n        const packageId = String(body?.packageId ?? '').trim();\n        const versionId = String(body?.versionId ?? 'latest').trim() || 'latest';\n        if (!packageId) {\n            return c.json({ success: false, error: { code: 'bad_request', message: 'packageId is required.' } }, 400);\n        }\n\n        // 1. Fetch manifest snapshot from cloud\n        let payload: any;\n        try {\n            const url = `${this.cloudUrl}/api/v1/marketplace/packages/${encodeURIComponent(packageId)}/versions/${encodeURIComponent(versionId)}/manifest`;\n            const resp = await fetch(url, { headers: { 'Accept': 'application/json' } });\n            if (!resp.ok) {\n                const text = await resp.text().catch(() => '');\n                return c.json({\n                    success: false,\n                    error: { code: 'cloud_fetch_failed', message: `Cloud returned ${resp.status}: ${text.slice(0, 200)}` },\n                }, resp.status === 404 ? 404 : 502);\n            }\n            payload = await resp.json();\n        } catch (err: any) {\n            return c.json({\n                success: false,\n                error: { code: 'cloud_fetch_failed', message: err?.message ?? String(err) },\n            }, 502);\n        }\n\n        const data = payload?.data ?? payload;\n        const manifest = data?.manifest;\n        const resolvedVersionId = String(data?.version_id ?? versionId);\n        const version = String(data?.version ?? 'unknown');\n        const manifestId = String(manifest?.id ?? manifest?.name ?? '');\n        if (!manifest || !manifestId) {\n            return c.json({ success: false, error: { code: 'invalid_manifest', message: 'Cloud returned an invalid manifest payload.' } }, 502);\n        }\n\n        // 2. Conflict check — refuse to overwrite user-authored apps\n        const conflict = this.findConflict(ctx, manifestId);\n        if (conflict === 'user-code') {\n            return c.json({\n                success: false,\n                error: {\n                    code: 'manifest_conflict',\n                    message: `manifest_id \"${manifestId}\" is already defined by this runtime's local code. Refusing to overwrite. Uninstall the local definition first.`,\n                },\n            }, 409);\n        }\n\n        // 3. Persist on disk\n        const entry: InstalledEntry = {\n            packageId,\n            versionId: resolvedVersionId,\n            manifestId,\n            version,\n            manifest,\n            installedAt: new Date().toISOString(),\n            installedBy: userId,\n        };\n        try {\n            mkdirSync(this.storageDir, { recursive: true });\n            writeFileSync(join(this.storageDir, safeFilename(manifestId)), JSON.stringify(entry, null, 2), 'utf8');\n        } catch (err: any) {\n            return c.json({\n                success: false,\n                error: { code: 'storage_failed', message: `Failed to persist manifest: ${err?.message ?? err}` },\n            }, 500);\n        }\n\n        // 4. Hot-register via manifest service (works post-bootstrap)\n        try {\n            const manifestService = ctx.getService('manifest') as any;\n            manifestService.register(manifest);\n        } catch (err: any) {\n            // Persisted on disk so a restart would still pick it up;\n            // surface the error but keep the install record.\n            ctx.logger?.warn?.(`[MarketplaceInstallLocal] hot-register failed for ${manifestId} (will load on next restart): ${err?.message ?? err}`);\n        }\n\n        // 4b. Sync schemas to physical tables — registerApp only adds the\n        //     object definitions to the in-memory registry; the driver\n        //     must be asked to materialize tables/columns before any seed\n        //     insert (or user write) succeeds.\n        try {\n            const ql: any = ctx.getService('objectql');\n            if (ql && typeof ql.syncSchemas === 'function') {\n                await ql.syncSchemas();\n                ctx.logger?.info?.(`[MarketplaceInstallLocal] syncSchemas() ran after registering ${manifestId}`);\n            }\n        } catch (err: any) {\n            ctx.logger?.warn?.(`[MarketplaceInstallLocal] syncSchemas failed for ${manifestId}: ${err?.message ?? err}`);\n        }\n\n        // 5. Replicate the AppPlugin start-time side-effects that the\n        //    `manifest` service does NOT do on its own:\n        //      • load translation bundles into the i18n service\n        //      • stash seed datasets on the kernel + run them now so the\n        //        installed app has demo data on first paint.\n        const seededSummary = await this.applySideEffects(ctx, manifest, { seedNow: true, c });\n\n        return c.json({\n            success: true,\n            data: {\n                manifestId,\n                version,\n                versionId: resolvedVersionId,\n                installedAt: entry.installedAt,\n                hotLoaded: true,\n                upgradedFrom: conflict === 'marketplace' ? 'previous-marketplace-version' : null,\n                translationsLoaded: seededSummary.translationsLoaded,\n                seeded: seededSummary.seeded,\n                note: 'App is now available in this runtime. Refresh the console to see it in the app switcher.',\n            },\n        }, 200);\n    };\n\n    private handleList = async (c: any): Promise<Response> => {\n        const entries = this.readAll();\n        return c.json({\n            success: true,\n            data: {\n                items: entries.map(e => ({\n                    packageId: e.packageId,\n                    versionId: e.versionId,\n                    manifestId: e.manifestId,\n                    version: e.version,\n                    installedAt: e.installedAt,\n                    installedBy: e.installedBy,\n                })),\n                total: entries.length,\n                storageDir: this.storageDir,\n            },\n        }, 200);\n    };\n\n    private handleUninstall = async (c: any, ctx: PluginContext): Promise<Response> => {\n        const userId = await this.requireAuthenticatedUser(c, ctx);\n        if (!userId) {\n            return c.json({ success: false, error: { code: 'unauthorized', message: 'Authentication required.' } }, 401);\n        }\n        const manifestId = String(c.req.param?.('manifestId') ?? c.req.params?.manifestId ?? '').trim();\n        if (!manifestId) {\n            return c.json({ success: false, error: { code: 'bad_request', message: 'manifestId path param required.' } }, 400);\n        }\n        const file = join(this.storageDir, safeFilename(manifestId));\n        if (!existsSync(file)) {\n            return c.json({ success: false, error: { code: 'not_found', message: `No marketplace install for ${manifestId}.` } }, 404);\n        }\n        try {\n            unlinkSync(file);\n        } catch (err: any) {\n            return c.json({ success: false, error: { code: 'storage_failed', message: err?.message ?? String(err) } }, 500);\n        }\n        ctx.logger?.info?.(`[MarketplaceInstallLocal] uninstalled ${manifestId} (cached manifest removed; restart runtime to unload from running kernel)`);\n        return c.json({\n            success: true,\n            data: {\n                manifestId,\n                note: 'Cached manifest removed. The app remains loaded in the running kernel until the next restart (the kernel API does not support unregistering apps in-place).',\n            },\n        }, 200);\n    };\n\n    /**\n     * Detect whether `manifestId` is already known to the kernel and classify\n     * the source so we can refuse vs upgrade gracefully.\n     *\n     *   'none'         — fresh install\n     *   'marketplace'  — previously installed by this plugin (allow upgrade)\n     *   'user-code'    — defined by AppPlugin from objectstack.config.ts\n     *                    (refuse to avoid silently overwriting authored code)\n     */\n    private findConflict = (ctx: PluginContext, manifestId: string): 'none' | 'marketplace' | 'user-code' => {\n        // First check: do we already have a marketplace install file?\n        if (existsSync(join(this.storageDir, safeFilename(manifestId)))) {\n            return 'marketplace';\n        }\n        // Then check: is the manifest_id already in the engine's registry?\n        try {\n            const ql: any = ctx.getService('objectql');\n            const packages: any[] = ql?.registry?.getAllPackages?.() ?? [];\n            const hit = packages.find((p: any) =>\n                (p?.manifest?.id ?? p?.id ?? p?.manifest?.name) === manifestId,\n            );\n            if (hit) return 'user-code';\n        } catch { /* objectql not registered yet — treat as fresh */ }\n        return 'none';\n    };\n\n    /**\n     * Pull a userId out of the request's better-auth session, if any.\n     * Returns null when there is no signed-in user. v1 does not check\n     * admin role — UI gating + the auth requirement is sufficient for\n     * dev / single-tenant runtimes. Stricter checks can be layered on\n     * via a middleware in cloud-hosted multi-tenant deployments.\n     */\n    /**\n     * Replicate the start-time side-effects that AppPlugin runs for\n     * statically-declared apps but the `manifest` service does NOT:\n     *\n     *   1. Load `manifest.translations` (array of `Record<locale, data>`)\n     *      into the i18n service — auto-creating an in-memory fallback if\n     *      none is registered, matching AppPlugin's behaviour.\n     *\n     *   2. Merge `manifest.data` (an array of seed datasets) into the\n     *      kernel's `seed-datasets` service so SecurityPlugin's per-org\n     *      replay middleware picks them up on every future\n     *      sys_organization insert.\n     *\n     *   3. When `seedNow=true`, also run the seed immediately so the user\n     *      sees demo data without having to create a new org:\n     *        • single-tenant: run SeedLoaderService inline (mirrors\n     *          AppPlugin single-tenant branch)\n     *        • multi-tenant: invoke `seed-replayer` for the caller's\n     *          active org (resolved from the request session)\n     *\n     * Errors are logged but never thrown — install succeeds even if\n     * post-register side-effects partially fail (the manifest itself is\n     * already registered + cached). Returns a small summary for the\n     * response envelope.\n     */\n    private applySideEffects = async (\n        ctx: PluginContext,\n        manifest: any,\n        opts: { seedNow: boolean; c?: any },\n    ): Promise<{ translationsLoaded: number; seeded: { mode: 'inline' | 'replayer' | 'skipped'; inserted?: number; updated?: number; errors?: number; reason?: string } }> => {\n        const appId = String(manifest?.id ?? 'unknown');\n        let translationsLoaded = 0;\n        let seedSummary: any = { mode: 'skipped', reason: 'no-datasets' };\n\n        // ── 1. i18n bundles ─────────────────────────────────────────────\n        try {\n            const bundles: Array<Record<string, unknown>> = [];\n            if (Array.isArray(manifest?.translations)) bundles.push(...manifest.translations);\n            if (Array.isArray(manifest?.i18n)) bundles.push(...manifest.i18n);\n\n            if (bundles.length > 0) {\n                let i18nService: any;\n                try { i18nService = ctx.getService('i18n'); } catch { /* not registered */ }\n                if (!i18nService) {\n                    try {\n                        const mod = await import('@objectstack/core');\n                        const createMemoryI18n = (mod as any).createMemoryI18n;\n                        if (typeof createMemoryI18n === 'function') {\n                            i18nService = createMemoryI18n();\n                            (ctx as any).registerService?.('i18n', i18nService);\n                            ctx.logger?.info?.(`[MarketplaceInstallLocal] auto-registered in-memory i18n fallback for \"${appId}\"`);\n                        }\n                    } catch { /* fallback unavailable */ }\n                }\n                if (i18nService?.loadTranslations) {\n                    for (const bundle of bundles) {\n                        for (const [locale, data] of Object.entries(bundle)) {\n                            if (data && typeof data === 'object') {\n                                try {\n                                    i18nService.loadTranslations(locale, data as Record<string, unknown>);\n                                    translationsLoaded++;\n                                } catch (err: any) {\n                                    ctx.logger?.warn?.(`[MarketplaceInstallLocal] failed to load ${appId} translations for ${locale}: ${err?.message ?? err}`);\n                                }\n                            }\n                        }\n                    }\n                    ctx.logger?.info?.(`[MarketplaceInstallLocal] loaded ${translationsLoaded} locale bundle(s) for ${appId}`);\n                }\n            }\n        } catch (err: any) {\n            ctx.logger?.warn?.(`[MarketplaceInstallLocal] i18n side-effect failed for ${appId}: ${err?.message ?? err}`);\n        }\n\n        // ── 2. Seed datasets — merge into kernel service ─────────────────\n        const datasets = Array.isArray(manifest?.data)\n            ? manifest.data.filter((d: any) => d && d.object && Array.isArray(d.records))\n            : [];\n\n        if (datasets.length > 0) {\n            try {\n                const kernel: any = (ctx as any).kernel;\n                let existing: any[] = [];\n                try {\n                    const v = kernel?.getService?.('seed-datasets');\n                    if (Array.isArray(v)) existing = v;\n                } catch { /* unset */ }\n                const merged = [...existing, ...datasets];\n                if (kernel?.registerService) kernel.registerService('seed-datasets', merged);\n                else (ctx as any).registerService?.('seed-datasets', merged);\n                ctx.logger?.info?.(`[MarketplaceInstallLocal] merged ${datasets.length} seed dataset(s) into kernel (total: ${merged.length})`);\n            } catch (err: any) {\n                ctx.logger?.warn?.(`[MarketplaceInstallLocal] failed to merge seed-datasets: ${err?.message ?? err}`);\n            }\n        }\n\n        // ── 3. Optional immediate seed ───────────────────────────────────\n        // Always seed inline via SeedLoaderService — don't rely on the\n        // `seed-replayer` registered by AppPlugin since (a) it isn't\n        // registered when the host runtime has no AppPlugin app with\n        // seed data, and (b) its closure may use stale datasets. In\n        // multi-tenant mode we pass `organizationId` so the loader\n        // writes tenant-scoped rows the same way AppPlugin's\n        // single-tenant branch + SecurityPlugin's per-org replay do.\n        if (opts.seedNow && datasets.length > 0) {\n            const multiTenant = String(process.env.OS_MULTI_TENANT ?? 'true').toLowerCase() !== 'false';\n            try {\n                const ql: any = ctx.getService('objectql');\n                let metadata: any;\n                try { metadata = ctx.getService('metadata'); } catch { /* none */ }\n                if (!ql || !metadata) {\n                    seedSummary = { mode: 'skipped', reason: 'objectql-or-metadata-missing' };\n                } else {\n                    let organizationId: string | undefined;\n                    if (multiTenant) {\n                        const resolved = await this.resolveActiveOrgId(opts.c, ctx);\n                        if (resolved) organizationId = resolved;\n                        else {\n                            seedSummary = { mode: 'skipped', reason: 'multi-tenant-no-active-org' };\n                            ctx.logger?.warn?.('[MarketplaceInstallLocal] multi-tenant: no active org on request — data not seeded');\n                        }\n                    }\n                    if (!multiTenant || organizationId) {\n                        const [{ SeedLoaderService }, { SeedLoaderRequestSchema }] = await Promise.all([\n                            import('../seed-loader.js'),\n                            import('@objectstack/spec/data'),\n                        ]);\n                        const seedLoader = new (SeedLoaderService as any)(ql, metadata, ctx.logger);\n                        const request = (SeedLoaderRequestSchema as any).parse({\n                            datasets,\n                            config: {\n                                defaultMode: 'upsert',\n                                multiPass: true,\n                                ...(organizationId ? { organizationId } : {}),\n                            },\n                        });\n                        const result = await seedLoader.load(request);\n                        seedSummary = {\n                            mode: 'inline',\n                            inserted: result.summary.totalInserted,\n                            updated: result.summary.totalUpdated,\n                            errors: result.errors.length,\n                        };\n                        ctx.logger?.info?.(`[MarketplaceInstallLocal] inline seed for ${appId}${organizationId ? ` (org=${organizationId})` : ''}: inserted=${seedSummary.inserted} updated=${seedSummary.updated} errors=${seedSummary.errors}`);\n                    }\n                }\n            } catch (err: any) {\n                seedSummary = { mode: 'skipped', reason: `seed-error: ${err?.message ?? err}` };\n                ctx.logger?.warn?.(`[MarketplaceInstallLocal] seed run failed for ${appId}: ${err?.message ?? err}`);\n            }\n        }\n\n        return { translationsLoaded, seeded: seedSummary };\n    };\n\n    /**\n     * Best-effort active-org resolution. Reads the better-auth session\n     * (same path as requireAuthenticatedUser) and returns\n     * `session.activeOrganizationId`, falling back to the user's first\n     * org membership.\n     */\n    private resolveActiveOrgId = async (c: any, ctx: PluginContext): Promise<string | null> => {\n        if (!c?.req?.raw?.headers) return null;\n        try {\n            const authService: any = ctx.getService('auth');\n            let api: any = authService?.api;\n            if (!api && typeof authService?.getApi === 'function') api = await authService.getApi();\n            if (!api?.getSession) return null;\n            const session = await api.getSession({ headers: c.req.raw.headers });\n            const direct = session?.session?.activeOrganizationId ?? session?.activeOrganizationId ?? null;\n            if (direct) return String(direct);\n            // Fall back to the user's first membership row.\n            const userId = session?.user?.id;\n            if (!userId) return null;\n            try {\n                const ql: any = ctx.getService('objectql');\n                if (ql?.find) {\n                    const rows = await ql.find('sys_organization_member', { where: { user_id: userId }, limit: 1, context: { isSystem: true } } as any);\n                    const row = Array.isArray(rows) ? rows[0] : (rows?.items?.[0] ?? null);\n                    return row?.organization_id ? String(row.organization_id) : null;\n                }\n            } catch { /* ignore */ }\n        } catch { /* ignore */ }\n        return null;\n    };\n\n    private requireAuthenticatedUser = async (c: any, ctx: PluginContext): Promise<string | null> => {\n        try {\n            // Mirror `hono-plugin.ts` resolveCtx: pull the better-auth `api`\n            // off the auth service and call `getSession({ headers })`. The\n            // earlier guess `c.get('auth').session` is wrong — AuthPlugin\n            // does not pre-populate the Hono context.\n            const authService: any = ctx.getService('auth');\n            let api: any = authService?.api;\n            if (!api && typeof authService?.getApi === 'function') {\n                api = await authService.getApi();\n            }\n            if (api?.getSession && c?.req?.raw?.headers) {\n                const session = await api.getSession({ headers: c.req.raw.headers });\n                const userId = session?.user?.id ?? null;\n                if (userId) return String(userId);\n            }\n        } catch { /* ignore — fall through */ }\n        // Header fallback for cases where auth is disabled (e.g. test stubs)\n        const xUserId = c?.req?.header?.('x-user-id');\n        if (xUserId) return String(xUserId);\n        return null;\n    };\n\n    private readAll = (): InstalledEntry[] => {\n        if (!existsSync(this.storageDir)) return [];\n        const out: InstalledEntry[] = [];\n        for (const name of readdirSync(this.storageDir)) {\n            if (!name.endsWith('.json')) continue;\n            try {\n                const raw = readFileSync(join(this.storageDir, name), 'utf8');\n                out.push(JSON.parse(raw));\n            } catch { /* skip corrupt files */ }\n        }\n        return out;\n    };\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * # Hook & Action Body Sandbox\n *\n * Pluggable execution engine for L2 `ScriptBody` payloads coming from\n * `@objectstack/spec/data` `HookBodySchema`.\n *\n * ## Engine choice — quickjs-emscripten\n *\n * Two candidates were evaluated:\n *\n * | Property                | isolated-vm                | quickjs-emscripten        |\n * |-------------------------|----------------------------|---------------------------|\n * | True isolation          | ✅ V8 isolate               | ✅ separate JS heap        |\n * | Memory limit enforced   | ✅ hard cap                 | ⚠️ soft (engine-level)     |\n * | CPU timeout enforced    | ✅ hard kill                | ✅ interrupt handler       |\n * | Native dependency       | ❌ requires N-API build     | ✅ pure WASM               |\n * | Edge runtime support    | ❌ Cloudflare/Vercel ban    | ✅ runs on every JS host   |\n * | Cold-start cost         | ~50ms (native init)        | ~100ms (WASM init)        |\n * | Per-invocation overhead | very low                   | low–medium                |\n *\n * **Decision:** `quickjs-emscripten`.\n *\n * The single biggest constraint for ObjectStack is that `objectos` ships as a\n * pure-JS runtime so it can run on serverless edges, Cloudflare Workers,\n * Vercel Edge, Deno Deploy, plus traditional Node servers. `isolated-vm`\n * disqualifies us from every edge target because of its N-API dependency.\n * The performance penalty of QuickJS for short hook/action bodies (typically\n * <1 ms of script logic) is dominated by `ctx.api` round-trips anyway, so the\n * trade is favorable.\n *\n * The engine sits behind the `ScriptRunner` interface — if a host environment\n * can guarantee node-only deployment we can plug `isolated-vm` later without\n * touching call sites.\n */\n\nimport type { HookBody, ScriptBody, ExpressionBody } from '@objectstack/spec/data';\n\n/**\n * Identity / origin information used by the sandbox for diagnostics, capability\n * gating, and audit logs.\n */\nexport interface ScriptOrigin {\n  /** Whether the body is attached to a Hook or an Action. */\n  kind: 'hook' | 'action';\n  /** Object the hook/action targets, when applicable. */\n  object?: string;\n  /** Hook/Action name, used in error messages and traces. */\n  name: string;\n}\n\n/**\n * Context object exposed to the script. The shape mirrors `HookContext` /\n * `ActionContext` from `@objectstack/spec`. The sandbox copies a subset of\n * these into the isolated heap; capability checks gate which methods are\n * actually wired up.\n */\nexport interface ScriptContext {\n  input: unknown;\n  previous?: unknown;\n  user?: unknown;\n  session?: unknown;\n  /**\n   * The lifecycle event name the hook is firing for (e.g. `beforeInsert`,\n   * `afterUpdate`). Required for hooks that subscribe to multiple events\n   * and dispatch on event name.\n   */\n  event?: string;\n  /** The object the hook/action targets — surfaces from `HookContext.object`. */\n  object?: string;\n  /**\n   * Action only: the record id passed in the action invocation URL\n   * (`POST /api/v1/actions/:object/:action/:recordId`). Hooks always have\n   * the record on `input` so this stays undefined for them.\n   */\n  recordId?: string;\n  /**\n   * Action only: the record loaded by the dispatcher before the action ran\n   * (when the dispatcher pre-fetches it). May be undefined for actions\n   * declared with `requiresRecord: false` or when no `recordId` was supplied.\n   */\n  record?: unknown;\n  /** Engine-side `result` (only set for after* hooks). */\n  result?: unknown;\n  api?: unknown;\n  log?: {\n    info: (msg: string, data?: unknown) => void;\n    warn: (msg: string, data?: unknown) => void;\n    error: (msg: string, data?: unknown) => void;\n  };\n  crypto?: {\n    randomUUID?: () => string;\n    hash?: (algo: string, data: string | Uint8Array) => Promise<string>;\n  };\n}\n\n/**\n * Result returned to the caller after script execution.\n * - For hooks the `value` is typically `undefined` (mutations happen on `ctx`).\n * - For actions the `value` is the script's return value.\n */\nexport interface ScriptResult {\n  value: unknown;\n  /** Total wall-clock time inside the sandbox, milliseconds. */\n  durationMs: number;\n  /**\n   * Snapshot of `ctx.input` *as observed inside the VM after the script settled*.\n   *\n   * Hooks frequently mutate `ctx.input.x = y` directly without returning a value.\n   * The runner dumps the post-execution `ctx.input` so the host body-runner can\n   * write the mutations back through to the engine's `hookContext.input` (which\n   * is itself usually a flat-record Proxy).\n   *\n   * `undefined` if the dump failed or the script context did not expose `input`.\n   */\n  mutatedInput?: Record<string, unknown>;\n}\n\nexport interface ScriptRunOptions {\n  origin: ScriptOrigin;\n  /** Hard timeout for this invocation. The smaller of body.timeoutMs and this wins. */\n  timeoutMs?: number;\n  /** Optional abort signal from the surrounding kernel. */\n  signal?: AbortSignal;\n}\n\n/**\n * The sandbox engine contract. Implementations live under\n * `packages/runtime/src/sandbox/engines/`.\n */\nexport interface ScriptRunner {\n  /** Execute an L1 expression. Pure, side-effect-free. */\n  evalExpression(body: ExpressionBody, ctx: ScriptContext, opts: ScriptRunOptions): Promise<ScriptResult>;\n\n  /** Execute an L2 sandboxed JS script body. */\n  runScript(body: ScriptBody, ctx: ScriptContext, opts: ScriptRunOptions): Promise<ScriptResult>;\n\n  /** Convenience dispatch on the discriminated union. */\n  run(body: HookBody, ctx: ScriptContext, opts: ScriptRunOptions): Promise<ScriptResult>;\n\n  /** Release any underlying VM resources. */\n  dispose(): Promise<void>;\n}\n\n/**\n * Default no-op runner — throws on every call. The real engine is injected\n * during runtime bootstrap once `quickjs-emscripten` is wired in. This stub\n * lets the rest of the pipeline (loader, dispatcher, type plumbing) compile\n * and be unit-tested ahead of the engine landing.\n */\nexport class UnimplementedScriptRunner implements ScriptRunner {\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  evalExpression(_body: ExpressionBody, _ctx: ScriptContext, _opts: ScriptRunOptions): Promise<ScriptResult> {\n    return Promise.reject(new Error('ScriptRunner not configured: install a quickjs engine first.'));\n  }\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  runScript(_body: ScriptBody, _ctx: ScriptContext, _opts: ScriptRunOptions): Promise<ScriptResult> {\n    return Promise.reject(new Error('ScriptRunner not configured: install a quickjs engine first.'));\n  }\n  run(body: HookBody, ctx: ScriptContext, opts: ScriptRunOptions): Promise<ScriptResult> {\n    return body.language === 'expression'\n      ? this.evalExpression(body, ctx, opts)\n      : this.runScript(body, ctx, opts);\n  }\n  dispose(): Promise<void> {\n    return Promise.resolve();\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nexport {\n  UnimplementedScriptRunner,\n} from './script-runner.js';\nexport type {\n  ScriptRunner,\n  ScriptContext,\n  ScriptOrigin,\n  ScriptResult,\n  ScriptRunOptions,\n} from './script-runner.js';\nexport { QuickJSScriptRunner, SandboxError } from './quickjs-runner.js';\nexport type { QuickJSScriptRunnerOptions } from './quickjs-runner.js';\nexport { hookBodyRunnerFactory, actionBodyRunnerFactory } from './body-runner.js';\n"],"mappings":";;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4BA,SAAS,gBAAgB;AACzB,SAAS,WAAW,aAAa,YAAY,eAAe;AAC5D,SAAS,qBAAqB;AAYvB,SAAS,UAAU,WAA4B;AAClD,SAAO,gBAAgB,KAAK,SAAS;AACzC;AAMA,eAAsB,mBAClB,WACA,OAAoC,CAAC,GACtB;AACf,MAAI,UAAU,SAAS,GAAG;AACtB,UAAM,YAAY,KAAK,kBAAkB;AACzC,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,QAAI;AACA,YAAM,MAAM,MAAM,MAAM,WAAW;AAAA,QAC/B,UAAU;AAAA,QACV,QAAQ,WAAW;AAAA,QACnB,SAAS,EAAE,QAAQ,gDAAgD;AAAA,MACvE,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACT,cAAM,IAAI,MAAM,QAAQ,IAAI,MAAM,IAAI,IAAI,UAAU,QAAQ,SAAS,EAAE;AAAA,MAC3E;AACA,aAAO,MAAM,IAAI,KAAK;AAAA,IAC1B,UAAE;AACE,mBAAa,KAAK;AAAA,IACtB;AAAA,EACJ;AACA,SAAO,SAAS,WAAW,OAAO;AACtC;AAEA,eAAsB,mBAClB,iBACA,OAAkC,CAAC,GAChB;AACnB,QAAM,MAAM,KAAK,OAAO;AACxB,QAAM,QAAQ,UAAU,eAAe;AACvC,MAAI;AACJ,MAAI;AACA,UAAM,MAAM,MAAM,mBAAmB,iBAAiB,EAAE,gBAAgB,KAAK,eAAe,CAAC;AAC7F,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,aAAS,KAAK,kBAAkB,QAAQ,iBAAiB,QAAQ,QAAQ,aAAa,SAChF,OAAO,WACP;AAAA,EACV,SAAS,KAAU;AAEf,YAAQ,KAAK,GAAG,GAAG,gCAAgC,eAAe,WAAW,KAAK,WAAW,GAAG,EAAE;AAClG,WAAO;AAAA,EACX;AAEA,MAAI,OAAO;AAKP,QAAI,OAAO,QAAQ,kBAAkB,YAAY,OAAO,cAAc,SAAS,GAAG;AAE9E,cAAQ;AAAA,QACJ,GAAG,GAAG,4BAA4B,OAAO,aAAa,yBAAyB,eAAe;AAAA,MAElG;AAGA,aAAO,OAAO;AAAA,IAClB;AACA,WAAO;AAAA,EACX;AAEA,QAAM,mBAAmB,QAAQ,iBAAiB,GAAG;AACrD,SAAO;AACX;AAEA,eAAsB,mBAAmB,QAAa,iBAAyB,MAAM,wBAAuC;AACxH,QAAM,MAAM,QAAQ;AACpB,MAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,EAAG;AACjD,QAAM,gBAAgB,WAAW,GAAG,IAAI,MAAM,YAAY,QAAQ,eAAe,GAAG,GAAG;AACvF,MAAI;AACA,UAAM,MAAW,MAAM,OAAO,cAAc,aAAa,EAAE;AAC3D,UAAM,OAAO,QAAQ,IAAI,aAAa,IAAI,SAAS,eAAe;AAClE,QAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AAEjC,cAAQ,KAAK,GAAG,GAAG,oBAAoB,aAAa,iCAAiC;AACrF;AAAA,IACJ;AACA,UAAM,WAAY,OAAO,aAAa,OAAO,OAAO,cAAc,YAAY,CAAC,MAAM,QAAQ,OAAO,SAAS,IACvG,OAAO,YACP,CAAC;AACP,WAAO,YAAY,EAAE,GAAG,UAAU,GAAG,IAAI;AAAA,EAC7C,SAAS,KAAU;AAEf,YAAQ,KAAK,GAAG,GAAG,sCAAsC,aAAa,WAAW,KAAK,WAAW,GAAG,EAAE;AAAA,EAC1G;AACJ;AAxIA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA,IAgCa;AAhCb;AAAA;AAAA;AAgCO,IAAM,eAAN,MAAqC;AAAA,MAQxC,YAAY,QAAa,qBAAoD,SAA+B;AAN5G,oBAAO;AACP,uBAAU;AAYV,oBAAO,OAAO,QAAuB;AACjC,gBAAM,cAAc,UAAU,KAAK,OAAO,QAAQ,SAAS;AAC3D,cAAI,gBAAgB,aAAa,KAAK,MAAM;AAC5C,cAAI,OAAO,KAAK,6BAA6B;AAAA,YACzC;AAAA,YACA,YAAY,KAAK,OAAO;AAAA,YACxB,eAAe,KAAK,OAAO;AAAA,UAC/B,CAAC;AAAA,QACL;AAEA,qBAAQ,OAAO,QAAuB;AAClC,cAAI;AACA,kBAAM,WAAW,IAAI,WAAgB,UAAU;AAC/C,gBAAI,CAAC,UAAU,cAAe;AAG9B,gBAAI,KAAK,QAAQ,gBAAgB;AAC7B,oBAAM,SAAS,cAAc;AAAA,gBACzB,MAAM,KAAK,QAAQ;AAAA,gBACnB,QAAQ,KAAK,OAAO;AAAA,cACxB,CAAC;AACD,kBAAI,OAAO,KAAK,+CAA+C,KAAK,QAAQ,cAAc,KAAK,EAAE,QAAQ,KAAK,OAAO,KAAK,CAAC;AAAA,YAC/H;AAGA,gBAAI,KAAK,QAAQ,sBAAsB,OAAO;AAC1C,oBAAM,cAAc,SAAS,iBAAiB,SAAS,eAAe,IAAI,CAAC;AAC3E,oBAAM,aAAa,YAAY,KAAK,CAAC,OAAY,GAAG,SAAS,SAAS;AACtE,kBAAI,CAAC,YAAY;AACb,oBAAI,OAAO,KAAK,oEAA+D,KAAK,OAAO,IAAI,eAAe;AAC9G,sBAAM,SAAS,cAAc,EAAE,MAAM,WAAW,QAAQ,KAAK,OAAO,KAAK,CAAC;AAAA,cAC9E;AAAA,YACJ;AAAA,UACJ,SAAS,GAAG;AACR,gBAAI,OAAO,MAAM,6EAA6E,EAAE,OAAO,EAAE,CAAC;AAAA,UAC9G;AAEA,cAAI,OAAO,MAAM,yBAAyB,EAAE,YAAY,KAAK,OAAO,QAAQ,UAAU,CAAC;AAAA,QAC3F;AA5CI,aAAK,SAAS;AACd,cAAM,aAAa,OAAO,wBAAwB,WAAW,sBAAsB;AACnF,aAAK,WAAW,OAAO,wBAAwB,WAAW,sBAAsB,YAAY,CAAC;AAC7F,aAAK,OAAO,0BAA0B,cAAc,OAAO,QAAQ,SAAS;AAAA,MAChF;AAAA,IAyCJ;AAAA;AAAA;;;ACtFA;AAAA;AAAA;AAAA;AAeA,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAhBlC,IA0BM,2BAaO;AAvCb;AAAA;AAAA;AA0BA,IAAM,4BAA4B;AAa3B,IAAM,qBAAN,MAAM,mBAAgD;AAAA,MAK3D,YAAY,QAAqB,UAA4B,QAAgB;AAC3E,aAAK,SAAS;AACd,aAAK,WAAW;AAChB,aAAK,SAAS;AAAA,MAChB;AAAA;AAAA;AAAA;AAAA,MAMA,MAAM,KAAK,SAAuD;AAChE,cAAM,YAAY,KAAK,IAAI;AAC3B,cAAM,SAAS,QAAQ;AACvB,cAAM,YAAwC,CAAC;AAC/C,cAAM,aAAkC,CAAC;AAGzC,cAAM,WAAW,KAAK,YAAY,QAAQ,UAAU,OAAO,GAAG;AAE9D,YAAI,SAAS,WAAW,GAAG;AACzB,iBAAO,KAAK,iBAAiB,QAAQ,KAAK,IAAI,IAAI,SAAS;AAAA,QAC7D;AAGA,cAAM,cAAc,SAAS,IAAI,OAAK,EAAE,MAAM;AAC9C,cAAM,QAAQ,MAAM,KAAK,qBAAqB,WAAW;AAEzD,aAAK,OAAO,KAAK,uCAAuC;AAAA,UACtD,SAAS,YAAY;AAAA,UACrB,aAAa,MAAM;AAAA,UACnB,cAAc,MAAM,qBAAqB;AAAA,QAC3C,CAAC;AAGD,cAAM,kBAAkB,KAAK,cAAc,UAAU,MAAM,WAAW;AAGtE,cAAM,SAAS,KAAK,kBAAkB,KAAK;AAG3C,cAAM,kBAAkB,oBAAI,IAAiC;AAC7D,cAAM,kBAAoC,CAAC;AAE3C,mBAAW,WAAW,iBAAiB;AACrC,gBAAM,SAAS,MAAM,KAAK;AAAA,YACxB;AAAA,YAAS;AAAA,YAAQ;AAAA,YAAQ;AAAA,YAAiB;AAAA,YAAiB;AAAA,UAC7D;AACA,qBAAW,KAAK,MAAM;AAEtB,cAAI,OAAO,eAAe,OAAO,UAAU,GAAG;AAC5C,iBAAK,OAAO,KAAK,uCAAuC,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAClF;AAAA,UACF;AAAA,QACF;AAGA,YAAI,OAAO,aAAa,gBAAgB,SAAS,KAAK,CAAC,OAAO,QAAQ;AACpE,eAAK,OAAO,KAAK,sDAAsD;AAAA,YACrE,OAAO,gBAAgB;AAAA,UACzB,CAAC;AACD,gBAAM,KAAK,uBAAuB,iBAAiB,iBAAiB,YAAY,WAAW,OAAO,cAAc;AAAA,QAClH;AAGA,cAAM,aAAa,KAAK,IAAI,IAAI;AAChC,eAAO,KAAK,YAAY,QAAQ,OAAO,YAAY,WAAW,UAAU;AAAA,MAC1E;AAAA,MAEA,MAAM,qBAAqB,aAAuD;AAChF,cAAM,QAAgC,CAAC;AACvC,cAAM,YAAY,IAAI,IAAI,WAAW;AAErC,mBAAW,cAAc,aAAa;AACpC,gBAAM,SAAS,MAAM,KAAK,SAAS,UAAU,UAAU;AACvD,gBAAM,YAAsB,CAAC;AAC7B,gBAAM,aAAoC,CAAC;AAE3C,cAAI,UAAU,OAAO,QAAQ;AAC3B,kBAAM,SAAS,OAAO;AACtB,uBAAW,CAAC,WAAW,QAAQ,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC1D,mBACG,SAAS,SAAS,YAAY,SAAS,SAAS,oBACjD,SAAS,WACT;AACA,sBAAM,eAAe,SAAS;AAG9B,oBAAI,UAAU,IAAI,YAAY,KAAK,CAAC,UAAU,SAAS,YAAY,GAAG;AACpE,4BAAU,KAAK,YAAY;AAAA,gBAC7B;AAGA,2BAAW,KAAK;AAAA,kBACd,OAAO;AAAA,kBACP;AAAA,kBACA,aAAa;AAAA,kBACb,WAAW,SAAS;AAAA,gBACtB,CAAC;AAAA,cACH;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,KAAK,EAAE,QAAQ,YAAY,WAAW,WAAW,CAAC;AAAA,QAC1D;AAGA,cAAM,EAAE,aAAa,qBAAqB,IAAI,KAAK,gBAAgB,KAAK;AAExE,eAAO,EAAE,OAAO,aAAa,qBAAqB;AAAA,MACpD;AAAA,MAEA,MAAM,SAAS,UAAqB,QAA2D;AAC7F,cAAM,eAAe,uBAAuB,MAAM,EAAE,GAAG,QAAQ,QAAQ,KAAK,CAAC;AAC7E,eAAO,KAAK,KAAK,EAAE,UAAU,QAAQ,aAAa,CAAC;AAAA,MACrD;AAAA;AAAA;AAAA;AAAA,MAMA,MAAc,YACZ,SACA,QACA,QACA,iBACA,iBACA,WAC4B;AAC5B,cAAM,aAAa,QAAQ;AAC3B,cAAM,OAAO,QAAQ,QAAQ,OAAO;AACpC,cAAM,aAAa,QAAQ,cAAc;AAEzC,YAAI,WAAW;AACf,YAAI,UAAU;AACd,YAAI,UAAU;AACd,YAAI,UAAU;AACd,YAAI,qBAAqB;AACzB,YAAI,qBAAqB;AACzB,cAAM,SAAqC,CAAC;AAG5C,YAAI,CAAC,gBAAgB,IAAI,UAAU,GAAG;AACpC,0BAAgB,IAAI,YAAY,oBAAI,IAAI,CAAC;AAAA,QAC3C;AAMA,YAAI;AACJ,aAAK,SAAS,YAAY,SAAS,YAAY,SAAS,aAAa,CAAC,OAAO,QAAQ;AACnF,4BAAkB,MAAM,KAAK;AAAA,YAC3B;AAAA,YACA;AAAA,YACA,OAAO;AAAA,UACT;AAAA,QACF;AAGA,cAAM,aAAa,OAAO,IAAI,UAAU,KAAK,CAAC;AAI9C,cAAM,UAAU,oBAAI,KAAK;AAEzB,iBAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,QAAQ,KAAK;AAG/C,gBAAM,aAAa;AAAA,YACjB,QAAQ,QAAQ,CAAC;AAAA,YACjB,EAAE,KAAK,QAAQ;AAAA,UACjB;AACA,gBAAM,SAAS,WAAW,KACtB,EAAE,GAAI,WAAW,MAAkC,IACnD,EAAE,GAAG,QAAQ,QAAQ,CAAC,EAAE;AAC5B,cAAI,CAAC,WAAW,IAAI;AAClB,iBAAK,OAAO;AAAA,cACV,qDAAqD,UAAU,YAAY,CAAC,KAAK,WAAW,MAAM,OAAO;AAAA,YAC3G;AAAA,UACF;AAOA,cAAI,OAAO,kBAAkB,OAAO,iBAAiB,KAAK,MAAM;AAC9D,mBAAO,iBAAiB,IAAI,OAAO;AAAA,UACrC;AAGA,qBAAW,OAAO,YAAY;AAC5B,kBAAM,aAAa,OAAO,IAAI,KAAK;AACnC,gBAAI,eAAe,UAAa,eAAe,KAAM;AAGrD,gBAAI,OAAO,eAAe,YAAY,KAAK,oBAAoB,UAAU,EAAG;AAG5E,kBAAM,YAAY,gBAAgB,IAAI,IAAI,YAAY;AACtD,kBAAM,aAAa,WAAW,IAAI,OAAO,UAAU,CAAC;AAEpD,gBAAI,YAAY;AACd,qBAAO,IAAI,KAAK,IAAI;AACpB;AAAA,YACF,WAAW,CAAC,OAAO,QAAQ;AAEzB,oBAAM,OAAO,MAAM,KAAK,oBAAoB,IAAI,cAAc,IAAI,aAAa,YAAY,OAAO,cAAc;AAChH,kBAAI,MAAM;AACR,uBAAO,IAAI,KAAK,IAAI;AACpB;AAAA,cACF,WAAW,OAAO,WAAW;AAE3B,uBAAO,IAAI,KAAK,IAAI;AACpB,gCAAgB,KAAK;AAAA,kBACnB;AAAA,kBACA,kBAAkB,OAAO,OAAO,UAAU,KAAK,EAAE;AAAA,kBACjD,OAAO,IAAI;AAAA,kBACX,cAAc,IAAI;AAAA,kBAClB,aAAa,IAAI;AAAA,kBACjB,gBAAgB;AAAA,kBAChB,aAAa;AAAA,gBACf,CAAC;AACD;AAAA,cACF,OAAO;AAEL,sBAAM,QAAkC;AAAA,kBACtC,cAAc;AAAA,kBACd,OAAO,IAAI;AAAA,kBACX,cAAc,IAAI;AAAA,kBAClB,aAAa,IAAI;AAAA,kBACjB,gBAAgB;AAAA,kBAChB,aAAa;AAAA,kBACb,SAAS,6BAA6B,UAAU,IAAI,IAAI,KAAK,OAAO,UAAU,YAAO,IAAI,YAAY,IAAI,IAAI,WAAW;AAAA,gBAC1H;AACA,uBAAO,KAAK,KAAK;AACjB,0BAAU,KAAK,KAAK;AAAA,cACtB;AAAA,YACF,OAAO;AAEL,oBAAM,aAAa,gBAAgB,IAAI,IAAI,YAAY;AACvD,kBAAI,CAAC,YAAY,IAAI,OAAO,UAAU,CAAC,GAAG;AACxC,sBAAM,QAAkC;AAAA,kBACtC,cAAc;AAAA,kBACd,OAAO,IAAI;AAAA,kBACX,cAAc,IAAI;AAAA,kBAClB,aAAa,IAAI;AAAA,kBACjB,gBAAgB;AAAA,kBAChB,aAAa;AAAA,kBACb,SAAS,wCAAwC,UAAU,IAAI,IAAI,KAAK,OAAO,UAAU,YAAO,IAAI,YAAY,IAAI,IAAI,WAAW;AAAA,gBACrI;AACA,uBAAO,KAAK,KAAK;AACjB,0BAAU,KAAK,KAAK;AAAA,cACtB;AAAA,YACF;AAAA,UACF;AAGA,cAAI,CAAC,OAAO,QAAQ;AAClB,gBAAI;AACF,oBAAM,SAAS,MAAM,KAAK;AAAA,gBACxB;AAAA,gBAAY;AAAA,gBAAQ;AAAA,gBAAM;AAAA,gBAAY;AAAA,cACxC;AAEA,kBAAI,OAAO,WAAW,WAAY;AAAA,uBACzB,OAAO,WAAW,UAAW;AAAA,uBAC7B,OAAO,WAAW,UAAW;AAGtC,oBAAM,kBAAkB,OAAO,OAAO,UAAU,KAAK,EAAE;AACvD,oBAAM,aAAa,OAAO;AAC1B,kBAAI,mBAAmB,YAAY;AACjC,gCAAgB,IAAI,UAAU,EAAG,IAAI,iBAAiB,OAAO,UAAU,CAAC;AAAA,cAC1E;AAAA,YACF,SAAS,KAAU;AACjB;AACA,mBAAK,OAAO,KAAK,gCAAgC,UAAU,WAAW;AAAA,gBACpE,OAAO,IAAI;AAAA,gBACX,aAAa;AAAA,cACf,CAAC;AAAA,YACH;AAAA,UACF,OAAO;AAEL,kBAAM,kBAAkB,OAAO,OAAO,UAAU,KAAK,EAAE;AACvD,gBAAI,iBAAiB;AACnB,8BAAgB,IAAI,UAAU,EAAG,IAAI,iBAAiB,cAAc,CAAC,EAAE;AAAA,YACzE;AACA;AAAA,UACF;AAAA,QACF;AAEA,eAAO;AAAA,UACL,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO,QAAQ,QAAQ;AAAA,UACvB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA;AAAA;AAAA;AAAA,MAMA,MAAc,oBACZ,cACA,aACA,OACA,gBACwB;AACxB,YAAI;AACF,gBAAM,QAAiC,EAAE,CAAC,WAAW,GAAG,MAAM;AAK9D,cAAI,eAAgB,OAAM,kBAAkB;AAC5C,gBAAM,UAAU,MAAM,KAAK,OAAO,KAAK,cAAc;AAAA,YACnD;AAAA,YACA,QAAQ,CAAC,IAAI;AAAA,YACb,OAAO;AAAA,YACP,SAAS,EAAE,UAAU,KAAK;AAAA,UAC5B,CAAQ;AACR,cAAI,WAAW,QAAQ,SAAS,GAAG;AACjC,mBAAO,OAAO,QAAQ,CAAC,EAAE,MAAM,QAAQ,CAAC,EAAE,GAAG;AAAA,UAC/C;AAAA,QACF,QAAQ;AAAA,QAER;AACA,eAAO;AAAA,MACT;AAAA,MAEA,MAAc,uBACZ,iBACA,iBACA,YACA,WACA,gBACe;AACf,mBAAW,YAAY,iBAAiB;AAEtC,gBAAM,YAAY,gBAAgB,IAAI,SAAS,YAAY;AAC3D,cAAI,aAAa,WAAW,IAAI,OAAO,SAAS,cAAc,CAAC;AAG/D,cAAI,CAAC,YAAY;AACf,yBAAc,MAAM,KAAK;AAAA,cACvB,SAAS;AAAA,cAAc,SAAS;AAAA,cAAa,SAAS;AAAA,cAAgB;AAAA,YACxE,KAAM;AAAA,UACR;AAEA,cAAI,YAAY;AAEd,kBAAM,kBAAkB,gBAAgB,IAAI,SAAS,UAAU;AAC/D,kBAAM,WAAW,iBAAiB,IAAI,SAAS,gBAAgB;AAE/D,gBAAI,UAAU;AACZ,kBAAI;AACF,sBAAM,KAAK,OAAO,OAAO,SAAS,YAAY;AAAA,kBAC5C,IAAI;AAAA,kBACJ,CAAC,SAAS,KAAK,GAAG;AAAA,gBACpB,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAQ;AAGzC,sBAAM,cAAc,WAAW,KAAK,OAAK,EAAE,WAAW,SAAS,UAAU;AACzE,oBAAI,aAAa;AACf,8BAAY;AACZ,8BAAY;AAAA,gBACd;AAAA,cACF,SAAS,KAAU;AACjB,qBAAK,OAAO,KAAK,qDAAqD;AAAA,kBACpE,QAAQ,SAAS;AAAA,kBACjB,OAAO,SAAS;AAAA,kBAChB,OAAO,IAAI;AAAA,gBACb,CAAC;AAAA,cACH;AAAA,YACF;AAAA,UACF,OAAO;AAEL,kBAAM,QAAkC;AAAA,cACtC,cAAc,SAAS;AAAA,cACvB,OAAO,SAAS;AAAA,cAChB,cAAc,SAAS;AAAA,cACvB,aAAa,SAAS;AAAA,cACtB,gBAAgB,SAAS;AAAA,cACzB,aAAa,SAAS;AAAA,cACtB,SAAS,+CAA+C,SAAS,UAAU,IAAI,SAAS,KAAK,OAAO,SAAS,cAAc,YAAO,SAAS,YAAY,IAAI,SAAS,WAAW;AAAA,YACjL;AAEA,kBAAM,cAAc,WAAW,KAAK,OAAK,EAAE,WAAW,SAAS,UAAU;AACzE,gBAAI,aAAa;AACf,0BAAY,OAAO,KAAK,KAAK;AAAA,YAC/B;AACA,sBAAU,KAAK,KAAK;AAAA,UACtB;AAAA,QACF;AAAA,MACF;AAAA,MAeA,MAAc,YACZ,YACA,QACA,MACA,YACA,iBACsE;AACtE,cAAM,kBAAkB,OAAO,UAAU;AACzC,cAAM,WAAW,iBAAiB,IAAI,OAAO,mBAAmB,EAAE,CAAC;AACnE,cAAM,OAAO,mBAAkB;AAE/B,gBAAQ,MAAM;AAAA,UACZ,KAAK,UAAU;AACb,kBAAM,SAAS,MAAM,KAAK,OAAO,OAAO,YAAY,QAAQ,IAAI;AAChE,mBAAO,EAAE,QAAQ,YAAY,IAAI,KAAK,UAAU,MAAM,EAAE;AAAA,UAC1D;AAAA,UAEA,KAAK,UAAU;AACb,gBAAI,CAAC,UAAU;AACb,qBAAO,EAAE,QAAQ,UAAU;AAAA,YAC7B;AACA,kBAAM,KAAK,KAAK,UAAU,QAAQ;AAClC,kBAAM,KAAK,OAAO,OAAO,YAAY,EAAE,GAAG,QAAQ,GAAG,GAAG,IAAI;AAC5D,mBAAO,EAAE,QAAQ,WAAW,GAAG;AAAA,UACjC;AAAA,UAEA,KAAK,UAAU;AACb,gBAAI,UAAU;AACZ,oBAAM,KAAK,KAAK,UAAU,QAAQ;AAClC,oBAAM,KAAK,OAAO,OAAO,YAAY,EAAE,GAAG,QAAQ,GAAG,GAAG,IAAI;AAC5D,qBAAO,EAAE,QAAQ,WAAW,GAAG;AAAA,YACjC,OAAO;AACL,oBAAM,SAAS,MAAM,KAAK,OAAO,OAAO,YAAY,QAAQ,IAAI;AAChE,qBAAO,EAAE,QAAQ,YAAY,IAAI,KAAK,UAAU,MAAM,EAAE;AAAA,YAC1D;AAAA,UACF;AAAA,UAEA,KAAK,UAAU;AACb,gBAAI,UAAU;AACZ,qBAAO,EAAE,QAAQ,WAAW,IAAI,KAAK,UAAU,QAAQ,EAAE;AAAA,YAC3D;AACA,kBAAM,SAAS,MAAM,KAAK,OAAO,OAAO,YAAY,QAAQ,IAAI;AAChE,mBAAO,EAAE,QAAQ,YAAY,IAAI,KAAK,UAAU,MAAM,EAAE;AAAA,UAC1D;AAAA,UAEA,KAAK,WAAW;AAEd,kBAAM,SAAS,MAAM,KAAK,OAAO,OAAO,YAAY,QAAQ,IAAI;AAChE,mBAAO,EAAE,QAAQ,YAAY,IAAI,KAAK,UAAU,MAAM,EAAE;AAAA,UAC1D;AAAA,UAEA,SAAS;AACP,kBAAM,SAAS,MAAM,KAAK,OAAO,OAAO,YAAY,QAAQ,IAAI;AAChE,mBAAO,EAAE,QAAQ,YAAY,IAAI,KAAK,UAAU,MAAM,EAAE;AAAA,UAC1D;AAAA,QACF;AAAA,MACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASQ,gBACN,OAC6D;AAC7D,cAAM,WAAW,oBAAI,IAAoB;AACzC,cAAM,YAAY,oBAAI,IAAsB;AAC5C,cAAM,YAAY,IAAI,IAAI,MAAM,IAAI,OAAK,EAAE,MAAM,CAAC;AAGlD,mBAAW,QAAQ,OAAO;AACxB,mBAAS,IAAI,KAAK,QAAQ,CAAC;AAC3B,oBAAU,IAAI,KAAK,QAAQ,CAAC,CAAC;AAAA,QAC/B;AAGA,mBAAW,QAAQ,OAAO;AACxB,qBAAW,OAAO,KAAK,WAAW;AAGhC,gBAAI,UAAU,IAAI,GAAG,KAAK,QAAQ,KAAK,QAAQ;AAC7C,wBAAU,IAAI,GAAG,EAAG,KAAK,KAAK,MAAM;AACpC,uBAAS,IAAI,KAAK,SAAS,SAAS,IAAI,KAAK,MAAM,KAAK,KAAK,CAAC;AAAA,YAChE;AAAA,UACF;AAAA,QACF;AAGA,cAAM,QAAkB,CAAC;AACzB,mBAAW,CAAC,KAAK,MAAM,KAAK,UAAU;AACpC,cAAI,WAAW,EAAG,OAAM,KAAK,GAAG;AAAA,QAClC;AAEA,cAAM,cAAwB,CAAC;AAC/B,eAAO,MAAM,SAAS,GAAG;AACvB,gBAAM,UAAU,MAAM,MAAM;AAC5B,sBAAY,KAAK,OAAO;AAExB,qBAAW,YAAa,UAAU,IAAI,OAAO,KAAK,CAAC,GAAI;AACrD,kBAAM,aAAa,SAAS,IAAI,QAAQ,KAAK,KAAK;AAClD,qBAAS,IAAI,UAAU,SAAS;AAChC,gBAAI,cAAc,GAAG;AACnB,oBAAM,KAAK,QAAQ;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AAGA,cAAM,uBAAmC,CAAC;AAC1C,cAAM,YAAY,MAAM,OAAO,OAAK,CAAC,YAAY,SAAS,EAAE,MAAM,CAAC;AAEnE,YAAI,UAAU,SAAS,GAAG;AAExB,gBAAM,SAAS,KAAK,WAAW,SAAS;AACxC,+BAAqB,KAAK,GAAG,MAAM;AAGnC,qBAAW,QAAQ,WAAW;AAC5B,gBAAI,CAAC,YAAY,SAAS,KAAK,MAAM,GAAG;AACtC,0BAAY,KAAK,KAAK,MAAM;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAEA,eAAO,EAAE,aAAa,qBAAqB;AAAA,MAC7C;AAAA,MAEQ,WAAW,OAA2C;AAC5D,cAAM,SAAqB,CAAC;AAC5B,cAAM,UAAU,IAAI,IAAI,MAAM,IAAI,OAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrD,cAAM,UAAU,oBAAI,IAAY;AAChC,cAAM,UAAU,oBAAI,IAAY;AAEhC,cAAM,MAAM,CAAC,SAAiB,SAAmB;AAC/C,cAAI,QAAQ,IAAI,OAAO,GAAG;AAExB,kBAAM,aAAa,KAAK,QAAQ,OAAO;AACvC,gBAAI,eAAe,IAAI;AACrB,qBAAO,KAAK,CAAC,GAAG,KAAK,MAAM,UAAU,GAAG,OAAO,CAAC;AAAA,YAClD;AACA;AAAA,UACF;AACA,cAAI,QAAQ,IAAI,OAAO,EAAG;AAE1B,kBAAQ,IAAI,OAAO;AACnB,kBAAQ,IAAI,OAAO;AACnB,eAAK,KAAK,OAAO;AAEjB,gBAAM,OAAO,QAAQ,IAAI,OAAO;AAChC,cAAI,MAAM;AACR,uBAAW,OAAO,KAAK,WAAW;AAChC,kBAAI,QAAQ,IAAI,GAAG,GAAG;AACpB,oBAAI,KAAK,CAAC,GAAG,IAAI,CAAC;AAAA,cACpB;AAAA,YACF;AAAA,UACF;AAEA,kBAAQ,OAAO,OAAO;AAAA,QACxB;AAEA,mBAAW,QAAQ,OAAO;AACxB,cAAI,CAAC,QAAQ,IAAI,KAAK,MAAM,GAAG;AAC7B,gBAAI,KAAK,QAAQ,CAAC,CAAC;AAAA,UACrB;AAAA,QACF;AAEA,eAAO;AAAA,MACT;AAAA;AAAA;AAAA;AAAA,MAMQ,YAAY,UAAqB,KAAyB;AAChE,YAAI,CAAC,IAAK,QAAO;AACjB,eAAO,SAAS,OAAO,OAAM,EAAE,IAAiB,SAAS,GAAG,CAAC;AAAA,MAC/D;AAAA,MAEQ,cAAc,UAAqB,aAAkC;AAC3E,cAAM,WAAW,IAAI,IAAI,YAAY,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAChE,eAAO,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM;AAClC,gBAAM,SAAS,SAAS,IAAI,EAAE,MAAM,KAAK,OAAO;AAChD,gBAAM,SAAS,SAAS,IAAI,EAAE,MAAM,KAAK,OAAO;AAChD,iBAAO,SAAS;AAAA,QAClB,CAAC;AAAA,MACH;AAAA,MAEQ,kBAAkB,OAAkE;AAC1F,cAAM,MAAM,oBAAI,IAAmC;AACnD,mBAAW,QAAQ,MAAM,OAAO;AAC9B,cAAI,KAAK,WAAW,SAAS,GAAG;AAC9B,gBAAI,IAAI,KAAK,QAAQ,KAAK,UAAU;AAAA,UACtC;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,MAEA,MAAc,oBACZ,YACA,YACA,gBAC2B;AAC3B,cAAM,MAAM,oBAAI,IAAiB;AACjC,YAAI;AACF,gBAAM,WAAoC;AAAA,YACxC,QAAQ,CAAC,MAAM,UAAU;AAAA,YACzB,SAAS,EAAE,UAAU,KAAK;AAAA,UAC5B;AAIA,cAAI,eAAgB,UAAS,QAAQ,EAAE,iBAAiB,eAAe;AACvE,gBAAM,UAAU,MAAM,KAAK,OAAO,KAAK,YAAY,QAAe;AAClE,qBAAW,UAAU,WAAW,CAAC,GAAG;AAClC,kBAAM,MAAM,OAAO,OAAO,UAAU,KAAK,EAAE;AAC3C,gBAAI,KAAK;AACP,kBAAI,IAAI,KAAK,MAAM;AAAA,YACrB;AAAA,UACF;AAAA,QACF,QAAQ;AAAA,QAER;AACA,eAAO;AAAA,MACT;AAAA,MAEQ,oBAAoB,OAAwB;AAElD,YAAI,kEAAkE,KAAK,KAAK,GAAG;AACjF,iBAAO;AAAA,QACT;AAEA,YAAI,kBAAkB,KAAK,KAAK,GAAG;AACjC,iBAAO;AAAA,QACT;AACA,eAAO;AAAA,MACT;AAAA,MAEQ,UAAU,QAAiC;AACjD,YAAI,CAAC,OAAQ,QAAO;AACpB,eAAO,OAAO,OAAO,MAAM,OAAO,OAAO,EAAE;AAAA,MAC7C;AAAA,MAEQ,iBAAiB,QAA0B,YAAsC;AACvF,eAAO;AAAA,UACL,SAAS;AAAA,UACT,QAAQ,OAAO;AAAA,UACf,iBAAiB,EAAE,OAAO,CAAC,GAAG,aAAa,CAAC,GAAG,sBAAsB,CAAC,EAAE;AAAA,UACxE,SAAS,CAAC;AAAA,UACV,QAAQ,CAAC;AAAA,UACT,SAAS;AAAA,YACP,kBAAkB;AAAA,YAClB,cAAc;AAAA,YACd,eAAe;AAAA,YACf,cAAc;AAAA,YACd,cAAc;AAAA,YACd,cAAc;AAAA,YACd,yBAAyB;AAAA,YACzB,yBAAyB;AAAA,YACzB,yBAAyB;AAAA,YACzB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MAEQ,YACN,QACA,OACA,SACA,QACA,YACkB;AAClB,cAAM,UAAU;AAAA,UACd,kBAAkB,QAAQ;AAAA,UAC1B,cAAc,QAAQ,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,OAAO,CAAC;AAAA,UACzD,eAAe,QAAQ,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,UAAU,CAAC;AAAA,UAC7D,cAAc,QAAQ,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,SAAS,CAAC;AAAA,UAC3D,cAAc,QAAQ,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,SAAS,CAAC;AAAA,UAC3D,cAAc,QAAQ,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,SAAS,CAAC;AAAA,UAC3D,yBAAyB,QAAQ,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,oBAAoB,CAAC;AAAA,UACjF,yBAAyB,QAAQ,OAAO,CAAC,KAAK,MAAM,MAAM,EAAE,oBAAoB,CAAC;AAAA,UACjF,yBAAyB,MAAM,qBAAqB;AAAA,UACpD;AAAA,QACF;AAEA,cAAM,YAAY,OAAO,SAAS,KAAK,QAAQ,eAAe;AAE9D,eAAO;AAAA,UACL,SAAS,CAAC;AAAA,UACV,QAAQ,OAAO;AAAA,UACf,iBAAiB;AAAA,UACjB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AA5SE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAnaW,mBAmaa,eAAe,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE;AAnahE,IAAM,oBAAN;AAAA;AAAA;;;ACbP;AAAA,EACE;AAAA,OAGK;AA0SP,SAAS,iBACP,IACA,QACA,QACA,YACA,KACA,MACA,UACA,QACM;AACN,QAAM,KAAK,GAAG,sBAAsB,QAAQ,UAAU,eAAe;AACnE,QAAI,CAAC,KAAK,IAAI,QAAQ,GAAG;AACvB,YAAM,IAAI;AAAA,QACR,eAAe,QAAQ,oBAAoB,OAAO,IAAI,KAAK,OAAO,IAAI,6BAA6B,UAAU,MAAM,MAAM;AAAA,MAC3H;AAAA,IACF;AACA,UAAM,SAAS,IAAI;AACnB,QAAI,CAAC,UAAU,OAAO,OAAO,WAAW,YAAY;AAClD,YAAM,IAAI,aAAa,0BAA0B,OAAO,IAAI,KAAK,OAAO,IAAI,GAAG;AAAA,IACjF;AACA,UAAM,OAAO,WAAW,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;AAC7C,UAAM,QAAS,OAAO,OAAkD,UAAU;AAClF,UAAM,IAAI,MAAM,MAAM;AACtB,QAAI,OAAO,MAAM,YAAY;AAC3B,YAAM,IAAI,aAAa,mBAAmB,UAAU,MAAM,MAAM,kBAAkB;AAAA,IACpF;AACA,UAAM,MAAM,MAAM,QAAQ,QAAQ,EAAE,MAAM,OAAO,IAAI,CAAC;AACtD,WAAO,aAAa,IAAI,GAAG;AAAA,EAC7B,CAAC;AACD,KAAG,QAAQ,QAAQ,QAAQ,EAAE;AAC7B,KAAG,QAAQ;AACb;AAGA,SAAS,aAAa,IAAyB,GAA2B;AACxE,QAAM,OAAO,KAAK,UAAU,KAAK,IAAI;AACrC,QAAM,IAAI,GAAG,SAAS,IAAI,IAAI,GAAG;AACjC,MAAI,EAAE,OAAO;AACX,UAAM,MAAM,GAAG,KAAK,EAAE,KAAK;AAC3B,MAAE,MAAM,QAAQ;AAChB,UAAM,IAAI,aAAa,iCAAiC,UAAU,GAAG,CAAC,EAAE;AAAA,EAC1E;AACA,SAAO,EAAE;AACX;AAEA,SAAS,cAAc,IAAyB,MAAc,GAAkB;AAC9E,QAAM,OAAO,KAAK,UAAU,KAAK,IAAI;AACrC,QAAM,SAAS,GAAG,SAAS,IAAI,IAAI,GAAG;AACtC,MAAI,OAAO,OAAO;AAChB,WAAO,MAAM,QAAQ;AACrB;AAAA,EACF;AACA,KAAG,QAAQ,GAAG,QAAQ,MAAM,OAAO,KAAK;AACxC,SAAO,MAAM,QAAQ;AACvB;AAEA,SAAS,cAAc,IAAyB,QAAuB,KAAa,GAAkB;AACpG,QAAM,OAAO,KAAK,UAAU,KAAK,IAAI;AACrC,QAAM,SAAS,GAAG,SAAS,IAAI,IAAI,GAAG;AACtC,MAAI,OAAO,OAAO;AAChB,WAAO,MAAM,QAAQ;AACrB,OAAG,QAAQ,QAAQ,KAAK,GAAG,IAAI;AAC/B;AAAA,EACF;AACA,KAAG,QAAQ,QAAQ,KAAK,OAAO,KAAK;AACpC,SAAO,MAAM,QAAQ;AACvB;AAUA,SAAS,iBAAiB,IAA8D;AACtF,MAAI;AACF,UAAM,IAAI,GAAG,SAAS,oEAAoE;AAC1F,QAAI,EAAE,OAAO;AACX,QAAE,MAAM,QAAQ;AAChB,aAAO;AAAA,IACT;AACA,UAAM,IAAI,GAAG,KAAK,EAAE,KAAK;AACzB,MAAE,MAAM,QAAQ;AAChB,QAAI,OAAO,MAAM,YAAY,MAAM,OAAQ,QAAO;AAClD,UAAM,SAAS,cAAc,CAAC;AAC9B,WAAO,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,IAC/D,SACD;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,GAAgC;AACrD,MAAI,MAAM,UAAa,MAAM,GAAI,QAAO;AACxC,MAAI;AACF,WAAO,KAAK,MAAM,CAAC;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAA2B;AAClC,MAAI,OAAO,WAAW,QAAQ,eAAe,WAAY,QAAO,WAAW,OAAO,WAAW;AAE7F,QAAM,IAAI,MAAM,KAAK,MAAM,KAAK,OAAO,IAAI,UAAW,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACpF,SAAO,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAClG;AAEA,SAAS,UAAU,KAAsB;AACvC,MAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,UAAM,IAAI;AACV,QAAI,EAAE,QAAS,QAAO,GAAG,EAAE,QAAQ,OAAO,KAAK,EAAE,OAAO;AACxD,WAAO,KAAK,UAAU,GAAG;AAAA,EAC3B;AACA,SAAO,OAAO,GAAG;AACnB;AA9bA,IAwCM,yBACA,2BACA,mBAWO,qBA2YA;AAhcb;AAAA;AAAA;AAwCA,IAAM,0BAA0B;AAChC,IAAM,4BAA4B;AAClC,IAAM,oBAAoB;AAWnB,IAAM,sBAAN,MAAkD;AAAA,MAGvD,YAAY,OAAmC,CAAC,GAAG;AACjD,aAAK,OAAO;AAAA,UACV,eAAe,KAAK,iBAAiB;AAAA,UACrC,iBAAiB,KAAK,mBAAmB;AAAA,UACzC,UAAU,KAAK,YAAY;AAAA,QAC7B;AAAA,MACF;AAAA,MAEA,MAAM,eACJ,MACA,KACA,MACuB;AACvB,eAAO,KAAK,QAAQ;AAAA,UAClB,cAAc;AAAA,UACd,QAAQ,KAAK;AAAA,UACb,cAAc,CAAC;AAAA,UACf,WAAW,KAAK,eAAe,MAAM,MAAS;AAAA,UAC9C,UAAU,KAAK,KAAK;AAAA,UACpB;AAAA,UACA,QAAQ,KAAK;AAAA,QACf,CAAC;AAAA,MACH;AAAA,MAEA,MAAM,UACJ,MACA,KACA,MACuB;AACvB,eAAO,KAAK,QAAQ;AAAA,UAClB,cAAc;AAAA,UACd,QAAQ,KAAK;AAAA,UACb,cAAc,KAAK;AAAA,UACnB,WAAW,KAAK,eAAe,MAAM,KAAK,SAAS;AAAA,UACnD,UAAU,KAAK,YAAY,KAAK,KAAK;AAAA,UACrC;AAAA,UACA,QAAQ,KAAK;AAAA,QACf,CAAC;AAAA,MACH;AAAA,MAEA,IAAI,MAAgB,KAAoB,MAA+C;AACrF,eAAO,KAAK,aAAa,eACrB,KAAK,eAAe,MAAM,KAAK,IAAI,IACnC,KAAK,UAAU,MAAM,KAAK,IAAI;AAAA,MACpC;AAAA,MAEA,MAAM,UAAyB;AAAA,MAE/B;AAAA;AAAA,MAGQ,eAAe,MAAwB,eAA2C;AACxF,cAAM,MAAM,KAAK,OAAO,SAAS,SAAS,KAAK,KAAK,gBAAgB,KAAK,KAAK;AAC9E,eAAO,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,aAAa,EAAE,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,CAAC;AAAA,MAC3G;AAAA,MAEA,MAAc,QAAQ,MAQI;AAKxB,cAAM,KAAK,MAAM,gBAAgB;AACjC,cAAM,UAAU,GAAG;AACnB,gBAAQ,eAAe,KAAK,WAAW,OAAO,IAAI;AAClD,gBAAQ,gBAAgB,MAAM,IAAI;AAElC,cAAM,QAAQ,KAAK,IAAI;AACvB,cAAM,WAAW,QAAQ,KAAK;AAC9B,gBAAQ,oBAAoB,MAAM,KAAK,IAAI,IAAI,QAAQ;AAEvD,YAAI;AACF,eAAK,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,YAAY,GAAG,KAAK,MAAM;AAGrE,cAAI,KAAK,cAAc;AACrB,kBAAMA,WAAU,6DAA6D,KAAK,MAAM;AACxF,kBAAM,SAAS,GAAG,SAASA,QAAO;AAClC,gBAAI,OAAO,OAAO;AAChB,oBAAM,MAAM,GAAG,KAAK,OAAO,KAAK;AAChC,qBAAO,MAAM,QAAQ;AACrB,oBAAM,IAAI,aAAa,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,YAAY,UAAU,GAAG,CAAC,EAAE;AAAA,YAC7F;AACA,mBAAO,MAAM,QAAQ;AACrB,kBAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,UAAU;AAC7C,kBAAM,SAAS,GAAG,KAAK,IAAI;AAC3B,iBAAK,QAAQ;AACb,kBAAM,QAAQ,WAAW,UAAa,WAAW,QAAQ,WAAW,SAChE,SACA,cAAc,MAAM;AACxB,mBAAO,EAAE,OAAO,YAAY,KAAK,IAAI,IAAI,MAAM;AAAA,UACjD;AAOA,gBAAM,UAAU,KAAK,OAAO,SAAS,SACjC;AAAA,gCACsB,KAAK,MAAM;AAAA;AAAA;AAAA,kBAIjC;AAAA,uCAC6B,KAAK,MAAM;AAAA;AAAA;AAAA;AAK5C,gBAAM,UAAU,MAAM,GAAG,cAAc,OAAO;AAC9C,cAAI,QAAQ,OAAO;AACjB,kBAAM,MAAM,GAAG,KAAK,QAAQ,KAAK;AACjC,oBAAQ,MAAM,QAAQ;AACtB,kBAAM,IAAI,aAAa,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,YAAY,UAAU,GAAG,CAAC,EAAE;AAAA,UAC7F;AACA,kBAAQ,MAAM,QAAQ;AAEtB,cAAI,QAAQ;AACZ,iBAAO,QAAQ,KAAM;AAEnB,kBAAM,IAAI,QAAc,CAACC,aAAY,aAAaA,QAAO,CAAC;AAE1D,kBAAM,UAAU,QAAQ,mBAAmB;AAC3C,gBAAI,QAAQ,OAAO;AACjB,oBAAM,MAAM,GAAG,KAAK,QAAQ,KAAK;AACjC,sBAAQ,MAAM,QAAQ;AACtB,oBAAM,IAAI,aAAa,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,YAAY,UAAU,GAAG,CAAC,EAAE;AAAA,YAC7F;AAEA,kBAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,SAAS;AAC5C,kBAAM,SAAS,GAAG,KAAK,IAAI;AAC3B,iBAAK,QAAQ;AACb,gBAAI,QAAQ;AACV,oBAAM,IAAI,aAAa,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,YAAY,MAAM,EAAE;AAAA,YACrF;AAEA,kBAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,UAAU;AAC7C,kBAAM,SAAS,GAAG,KAAK,IAAI;AAC3B,iBAAK,QAAQ;AACb,gBAAI,WAAW,UAAa,WAAW,MAAM;AAC3C,oBAAM,QAAQ,WAAW,SAAS,SAAY,cAAc,MAAM;AAElE,oBAAM,eAAe,iBAAiB,EAAE;AACxC,qBAAO,EAAE,OAAO,cAAc,YAAY,KAAK,IAAI,IAAI,MAAM;AAAA,YAC/D;AAEA,gBAAI,KAAK,IAAI,IAAI,UAAU;AACzB,oBAAM,IAAI;AAAA,gBACR,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,yBAAyB,KAAK,SAAS;AAAA,cACjF;AAAA,YACF;AACA;AAAA,UACF;AACA,gBAAM,IAAI;AAAA,YACR,GAAG,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,2BAA2B,KAAK;AAAA,UAC1E;AAAA,QACF,UAAE;AAGA,aAAG,QAAQ;AAAA,QACb;AAAA,MACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAUQ,WACN,IACA,KACA,MACA,QACM;AACN,sBAAc,IAAI,WAAW,IAAI,KAAK;AACtC,sBAAc,IAAI,cAAc,IAAI,QAAQ;AAE5C,cAAM,SAAS,GAAG,UAAU;AAC5B,sBAAc,IAAI,QAAQ,SAAS,IAAI,KAAK;AAC5C,sBAAc,IAAI,QAAQ,YAAY,IAAI,QAAQ;AAClD,sBAAc,IAAI,QAAQ,QAAQ,IAAI,IAAI;AAC1C,sBAAc,IAAI,QAAQ,WAAW,IAAI,OAAO;AAChD,YAAI,OAAO,IAAI,UAAU,UAAU;AACjC,gBAAM,MAAM,GAAG,UAAU,IAAI,KAAK;AAClC,aAAG,QAAQ,QAAQ,SAAS,GAAG;AAC/B,cAAI,QAAQ;AAAA,QACd;AACA,YAAI,OAAO,IAAI,WAAW,UAAU;AAClC,gBAAM,MAAM,GAAG,UAAU,IAAI,MAAM;AACnC,aAAG,QAAQ,QAAQ,UAAU,GAAG;AAChC,cAAI,QAAQ;AAAA,QACd;AACA,YAAI,OAAO,IAAI,aAAa,UAAU;AACpC,gBAAM,MAAM,GAAG,UAAU,IAAI,QAAQ;AACrC,aAAG,QAAQ,QAAQ,YAAY,GAAG;AAClC,cAAI,QAAQ;AAAA,QACd;AACA,YAAI,IAAI,WAAW,QAAW;AAC5B,wBAAc,IAAI,QAAQ,UAAU,IAAI,MAAM;AAAA,QAChD;AACA,YAAI,IAAI,WAAW,QAAW;AAC5B,wBAAc,IAAI,QAAQ,UAAU,IAAI,MAAM;AAAA,QAChD;AAEA,cAAM,SAAS,GAAG,UAAU;AAC5B,cAAM,WAAW,GAAG,YAAY,UAAU,CAAC,UAAU;AACnD,gBAAM,aAAa,GAAG,UAAU,KAAK;AACrC,gBAAM,OAAO,GAAG,UAAU;AAC1B,gBAAM,OAAO,CAAC,QAAQ,WAAW,SAAS,WAAW;AACrD,gBAAM,QAAQ,CAAC,UAAU,UAAU,UAAU,cAAc,cAAc,QAAQ;AACjF,qBAAW,KAAK,KAAM,kBAAiB,IAAI,MAAM,GAAG,YAAY,KAAK,MAAM,YAAY,MAAM;AAC7F,qBAAW,KAAK,MAAO,kBAAiB,IAAI,MAAM,GAAG,YAAY,KAAK,MAAM,aAAa,MAAM;AAC/F,iBAAO;AAAA,QACT,CAAC;AACD,WAAG,QAAQ,QAAQ,UAAU,QAAQ;AACrC,iBAAS,QAAQ;AACjB,WAAG,QAAQ,QAAQ,OAAO,MAAM;AAChC,eAAO,QAAQ;AAEf,cAAM,SAAS,GAAG,UAAU;AAC5B,mBAAW,SAAS,CAAC,QAAQ,QAAQ,OAAO,GAAY;AACtD,gBAAM,KAAK,GAAG,YAAY,OAAO,CAAC,MAAM,UAAU;AAChD,gBAAI,CAAC,KAAK,IAAI,KAAK,GAAG;AACpB,oBAAM,IAAI,aAAa,mCAAmC,OAAO,IAAI,KAAK,OAAO,IAAI,GAAG;AAAA,YAC1F;AACA,kBAAM,MAAM,GAAG,UAAU,IAAI;AAC7B,kBAAM,OAAO,QAAQ,cAAc,GAAG,UAAU,KAAK,CAAC,IAAI;AAC1D,gBAAI,MAAM,KAAK,IAAI,KAAK,IAAI;AAC5B,mBAAO,GAAG;AAAA,UACZ,CAAC;AACD,aAAG,QAAQ,QAAQ,OAAO,EAAE;AAC5B,aAAG,QAAQ;AAAA,QACb;AACA,WAAG,QAAQ,QAAQ,OAAO,MAAM;AAChC,eAAO,QAAQ;AAEf,cAAM,YAAY,GAAG,UAAU;AAC/B,cAAM,SAAS,GAAG,YAAY,cAAc,MAAM;AAChD,cAAI,CAAC,KAAK,IAAI,aAAa,GAAG;AAC5B,kBAAM,IAAI,aAAa,2CAA2C,OAAO,IAAI,KAAK,OAAO,IAAI,GAAG;AAAA,UAClG;AACA,gBAAM,IAAI,IAAI,QAAQ,aAAa,KAAK,iBAAiB;AACzD,iBAAO,GAAG,UAAU,CAAC;AAAA,QACvB,CAAC;AACD,WAAG,QAAQ,WAAW,cAAc,MAAM;AAC1C,eAAO,QAAQ;AACf,WAAG,QAAQ,QAAQ,UAAU,SAAS;AACtC,kBAAU,QAAQ;AAElB,WAAG,QAAQ,GAAG,QAAQ,SAAS,MAAM;AACrC,eAAO,QAAQ;AAAA,MACjB;AAAA,IACF;AAiIO,IAAM,eAAN,cAA2B,MAAM;AAAA,MACtC,YAAY,SAAiB;AAC3B,cAAM,OAAO;AACb,aAAK,OAAO;AAAA,MACd;AAAA,IACF;AAAA;AAAA;;;AClaA,SAAS,sBAAsB;AASxB,SAAS,sBACd,QACA,MACiE;AACjE,SAAO,CAAC,SAAe;AACrB,UAAM,MAAO,KAAa;AAC1B,QAAI,CAAC,IAAK,QAAO;AAEjB,UAAM,SAAS,eAAe,UAAU,GAAG;AAC3C,QAAI,CAAC,OAAO,SAAS;AACnB,WAAK,QAAQ,OAAO,wCAAwC;AAAA,QAC1D,OAAO,KAAK;AAAA,QACZ,MAAM,KAAK;AAAA,QACX,QAAQ,OAAO,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,MACxC,CAAC;AACD,aAAO;AAAA,IACT;AACA,UAAM,OAAO,OAAO;AAEpB,WAAO,eAAe,iBAAiB,WAA+B;AACpE,YAAM,aAAa,oBAAoB,WAAW,KAAK,EAAE;AACzD,UAAI;AACF,aAAK,QAAQ,QAAQ,2BAA2B,EAAE,OAAO,KAAK,OAAO,MAAM,KAAK,KAAK,CAAC;AACtF,cAAM,SAAS,MAAM,OAAO,IAAI,MAAM,YAAY;AAAA,UAChD,QAAQ;AAAA,YACN,MAAM;AAAA,YACN,MAAM,KAAK;AAAA,YACX,QAAQ,OAAQ,KAAa,WAAW,WAAY,KAAa,SAAS;AAAA,UAC5E;AAAA,UACA,WAAY,KAAa,aAAa;AAAA,QACxC,CAAC;AACD,8BAAsB,WAAW,MAAM;AAAA,MACzC,SAAS,KAAU;AACjB,aAAK,QAAQ,QAAQ,qCAAqC,KAAK;AAAA,UAC7D,OAAO,KAAK;AAAA,UACZ,MAAM,KAAK;AAAA,QACb,CAAC;AACD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AASO,SAAS,wBACd,QACA,MAGY;AACZ,SAAO,CAAC,WAAW;AACjB,UAAM,MAAM,OAAO;AACnB,QAAI,CAAC,IAAK,QAAO;AAEjB,UAAM,SAAS,eAAe,UAAU,GAAG;AAC3C,QAAI,CAAC,OAAO,SAAS;AACnB,WAAK,QAAQ,OAAO,0CAA0C;AAAA,QAC5D,OAAO,KAAK;AAAA,QACZ,QAAQ,OAAO;AAAA,QACf,QAAQ,OAAO,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,MACxC,CAAC;AACD,aAAO;AAAA,IACT;AACA,UAAM,OAAO,OAAO;AAEpB,WAAO,eAAe,mBAAmB,WAAkC;AACzE,YAAM,aAAa,0BAA0B,WAAW,KAAK,EAAE;AAC/D,UAAI;AACF,aAAK,QAAQ,QAAQ,6BAA6B;AAAA,UAChD,OAAO,KAAK;AAAA,UACZ,QAAQ,OAAO;AAAA,UACf,QAAQ,OAAO;AAAA,QACjB,CAAC;AACD,cAAM,SAAS,MAAM,OAAO,IAAI,MAAM,YAAY;AAAA,UAChD,QAAQ,EAAE,MAAM,UAAU,MAAM,OAAO,MAAM,QAAQ,OAAO,OAAO;AAAA,UACnE,WAAY,KAAa,aAAa,OAAO,aAAa;AAAA,QAC5D,CAAC;AACD,eAAO,OAAO;AAAA,MAChB,SAAS,KAAU;AACjB,aAAK,QAAQ,QAAQ,uCAAuC,KAAK;AAAA,UAC/D,OAAO,KAAK;AAAA,UACZ,QAAQ,OAAO;AAAA,QACjB,CAAC;AACD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,WAAgB,QAA4B;AACzE,QAAM,SAAS,WAAW;AAC1B,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU;AAC3C,MAAI,OAAO,gBAAgB,OAAO,OAAO,iBAAiB,UAAU;AAClE,WAAO,OAAO,QAAQ,OAAO,YAAY;AAAA,EAC3C;AACA,MACE,OAAO,SACP,OAAO,OAAO,UAAU,YACxB,CAAC,MAAM,QAAQ,OAAO,KAAK,GAC3B;AACA,WAAO,OAAO,QAAQ,OAAO,KAAK;AAAA,EACpC;AACF;AAEA,SAAS,sBAAsB,IAAS,YAAoB;AAK1D,SAAO;AAAA,IACL,MAAM,KAAK,MAAY;AAAE,aAAO,GAAG,KAAK,YAAY,IAAI;AAAA,IAAG;AAAA,IAC3D,MAAM,QAAQ,MAAY;AACxB,YAAM,OAAO,MAAM,GAAG,KAAK,YAAY,IAAI;AAC3C,aAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,CAAC,KAAK,OAAO;AAAA,IACjD;AAAA,IACA,MAAM,MAAM,MAAY;AACtB,UAAI,OAAO,GAAG,UAAU,WAAY,QAAO,GAAG,MAAM,YAAY,IAAI;AACpE,YAAM,OAAO,MAAM,GAAG,KAAK,YAAY,IAAI;AAC3C,aAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,SAAS;AAAA,IAC7C;AAAA,IACA,MAAM,OAAO,MAAW;AAAE,aAAO,GAAG,OAAO,YAAY,IAAI;AAAA,IAAG;AAAA,IAC9D,MAAM,OAAO,MAAW,MAAY;AAAE,aAAO,GAAG,OAAO,YAAY,MAAM,IAAI;AAAA,IAAG;AAAA,IAChF,MAAM,OAAO,MAAW,MAAY;AAClC,UAAI,OAAO,GAAG,WAAW,WAAY,QAAO,GAAG,OAAO,YAAY,MAAM,IAAI;AAC5E,aAAO,GAAG,OAAO,YAAY,IAAI;AAAA,IACnC;AAAA,IACA,MAAM,OAAO,MAAY;AAAE,aAAO,GAAG,OAAO,YAAY,IAAI;AAAA,IAAG;AAAA,EACjE;AACF;AAEA,SAAS,gBAAgB,WAAgB,IAAS,UAAkB;AAClE,QAAM,YAAY,WAAW;AAC7B,MAAI,aAAa,OAAO,UAAU,WAAW,WAAY,QAAO;AAChE,SAAO;AAAA,IACL,QAAQ,CAAC,eAAuB;AAC9B,UAAI,CAAC,GAAI,OAAM,IAAI,MAAM,kCAAkC,QAAQ,EAAE;AAIrE,UAAI,OAAO,GAAG,WAAW,YAAY;AACnC,YAAI;AAAE,iBAAO,GAAG,OAAO,UAAU;AAAA,QAAG,QAAQ;AAAA,QAAqB;AAAA,MACnE;AACA,aAAO,sBAAsB,IAAI,UAAU;AAAA,IAC7C;AAAA,EACF;AACF;AAEA,SAAS,oBAAoB,WAAgB,IAAwB;AACnE,QAAM,gBAAgB,mBAAmB,WAAW,SAAS,WAAW,GAAG;AAC3E,QAAM,cAAc,WAAW,YAAY,WAAW;AACtD,SAAO;AAAA,IACL,OAAO,iBAAiB,CAAC;AAAA;AAAA;AAAA,IAGzB,UAAU,mBAAmB,WAAW;AAAA,IACxC,MAAM,WAAW,QAAQ,WAAW,SAAS;AAAA,IAC7C,SAAS,WAAW;AAAA,IACpB,OAAO,OAAO,WAAW,UAAU,WAAW,UAAU,QAAQ;AAAA,IAChE,QAAQ,OAAO,WAAW,WAAW,WAAW,UAAU,SAAS;AAAA,IACnE,QAAQ,WAAW;AAAA,IACnB,KAAK,gBAAgB,WAAW,IAAI,WAAW;AAAA,IAC/C,KAAK,WAAW;AAAA,IAChB,QAAQ,WAAW;AAAA,EACrB;AACF;AAEA,SAAS,0BAA0B,WAAgB,IAAwB;AAKzE,QAAM,WACJ,OAAO,WAAW,aAAa,WAC3B,UAAU,WACV,OAAO,WAAW,QAAQ,OAAO,WAC/B,UAAU,OAAO,KACjB;AACR,SAAO;AAAA,IACL,OAAO,mBAAmB,WAAW,UAAU,CAAC,CAAC;AAAA,IACjD,UAAU;AAAA,IACV,MAAM,WAAW,QAAQ,WAAW,SAAS;AAAA,IAC7C,SAAS,WAAW;AAAA,IACpB,QAAQ,OAAO,WAAW,WAAW,WAAW,UAAU,SAAS;AAAA,IACnE;AAAA,IACA,QAAQ,mBAAmB,WAAW,MAAM;AAAA,IAC5C,KAAK,gBAAgB,WAAW,IAAI,aAAa;AAAA,IACjD,KAAK,WAAW;AAAA,IAChB,QAAQ,WAAW;AAAA,EACrB;AACF;AAOA,SAAS,mBAAmB,GAAiD;AAC3E,MAAI,MAAM,UAAa,MAAM,KAAM,QAAO;AAC1C,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,MAAI,MAAM,QAAQ,CAAC,EAAG,QAAO;AAC7B,MAAI;AACF,WAAO,OAAO,YAAY,OAAO,QAAQ,CAA4B,CAAC;AAAA,EACxE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA/PA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+lBO,SAAS,mBAAmB,QAAoB;AACnD,QAAM,MAAa,CAAC;AACpB,QAAM,OAAO,oBAAI,IAAS;AAC1B,QAAM,OAAO,CAAC,QAAa;AACvB,QAAI,CAAC,MAAM,QAAQ,GAAG,EAAG;AACzB,eAAW,KAAK,KAAK;AACjB,UAAI,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG;AACnB,aAAK,IAAI,CAAC;AACV,YAAI,KAAK,CAAC;AAAA,MACd;AAAA,IACJ;AAAA,EACJ;AACA,OAAK,QAAQ,KAAK;AAClB,OAAK,QAAQ,UAAU,KAAK;AAC5B,SAAO;AACX;AAWO,SAAS,qBACZ,QAC6F;AAC7F,QAAM,MAAa,CAAC;AACpB,QAAM,OAAO,oBAAI,IAAS;AAC1B,QAAM,OAAO,CAAC,KAAU,iBAA0B;AAC9C,QAAI,CAAC,MAAM,QAAQ,GAAG,EAAG;AACzB,eAAW,KAAK,KAAK;AACjB,UAAI,CAAC,KAAK,OAAO,MAAM,YAAY,OAAO,EAAE,SAAS,SAAU;AAC/D,UAAI,KAAK,IAAI,CAAC,EAAG;AACjB,WAAK,IAAI,CAAC;AACV,YAAM,iBACF,OAAO,EAAE,WAAW,WAAW,EAAE,SAC/B,OAAO,EAAE,eAAe,WAAW,EAAE,aACrC;AACN,UAAI,KAAK,iBAAiB,EAAE,GAAG,GAAG,QAAQ,eAAe,IAAI,EAAE,GAAG,EAAE,CAAC;AAAA,IACzE;AAAA,EACJ;AACA,OAAK,QAAQ,OAAO;AACpB,OAAK,QAAQ,UAAU,OAAO;AAC9B,MAAI,MAAM,QAAQ,QAAQ,OAAO,GAAG;AAChC,eAAW,KAAK,OAAO,QAAS,MAAK,GAAG,SAAS,GAAG,IAAI;AAAA,EAC5D;AACA,MAAI,MAAM,QAAQ,QAAQ,UAAU,OAAO,GAAG;AAC1C,eAAW,KAAK,OAAO,SAAS,QAAS,MAAK,GAAG,SAAS,GAAG,IAAI;AAAA,EACrE;AACA,SAAO;AACX;AAWO,SAAS,uBAAuB,QAAgD;AACnF,QAAM,MAAyC,CAAC;AAChD,QAAM,QAAQ,CAAC,QAAa;AACxB,QAAI,CAAC,IAAK;AACV,QAAI,MAAM,QAAQ,GAAG,GAAG;AACpB,iBAAW,QAAQ,KAAK;AACpB,YAAI,QAAQ,OAAO,KAAK,SAAS,YAAY,OAAO,KAAK,YAAY,YAAY;AAC7E,cAAI,KAAK,IAAI,IAAI,KAAK;AAAA,QAC1B;AAAA,MACJ;AAAA,IACJ,WAAW,OAAO,QAAQ,UAAU;AAChC,iBAAW,CAAC,MAAM,EAAE,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC1C,YAAI,OAAO,OAAO,WAAY,KAAI,IAAI,IAAI;AAAA,MAC9C;AAAA,IACJ;AAAA,EACJ;AACA,QAAM,QAAQ,SAAS;AACvB,QAAM,QAAQ,UAAU,SAAS;AACjC,SAAO;AACX;AAlrBA,IAkCa;AAlCb;AAAA;AAAA;AAGA;AAEA;AACA;AA4BO,IAAM,YAAN,MAAkC;AAAA,MAQrC,YAAY,QAAa,gBAA0C;AANnE,oBAAO;AAiBP,oBAAO,OAAO,QAAuB;AACjC,gBAAM,MAAM,KAAK,OAAO,YAAY,KAAK;AACzC,gBAAM,QAAQ,IAAI,MAAM,IAAI;AAE5B,cAAI,OAAO,KAAK,2BAA2B;AAAA,YACvC;AAAA,YACA,YAAY,KAAK;AAAA,YACjB,SAAS,KAAK;AAAA,UAClB,CAAC;AAID,gBAAM,iBAAiB,KAAK,OAAO,WAC7B,EAAE,GAAG,KAAK,OAAO,UAAU,GAAG,KAAK,OAAO,IAC1C,KAAK;AAEX,kBAAQ;AAAA,YACJ,0BAA0B,KAAK,SAAS,OAAO,KAAK,cAAc,EAAE,KAAK,GAAG,CAAC,UAAU,MAAM,QAAS,eAAuB,KAAK,IAAK,eAAuB,MAAM,SAAS,KAAK;AAAA,UACtL;AAEA,cAAI,WAAuC,UAAU,EAAE,SAAS,cAAc;AAAA,QAClF;AAEA,qBAAQ,OAAO,QAAuB;AAClC,gBAAM,MAAM,KAAK,OAAO,YAAY,KAAK;AACzC,gBAAM,QAAQ,IAAI,MAAM,IAAI;AAM5B,cAAI;AACJ,cAAI;AACA,iBAAK,IAAI,WAAW,UAAU;AAAA,UAClC,QAAQ;AAAA,UAER;AAEA,cAAI,CAAC,IAAI;AACL,gBAAI,OAAO,KAAK,qCAAqC;AAAA,cACjD,SAAS,KAAK;AAAA,cACd;AAAA,YACJ,CAAC;AACD;AAAA,UACJ;AAEA,cAAI,OAAO,MAAM,qCAAqC,EAAE,MAAM,CAAC;AAG/D,cAAI,KAAK,OAAO,qBAAqB,MAAM,QAAQ,KAAK,OAAO,iBAAiB,GAAG;AAC/E,gBAAI,OAAO,KAAK,wCAAwC;AAAA,cACpD;AAAA,cACA,WAAW,KAAK,OAAO,kBAAkB;AAAA,YAC7C,CAAC;AACD,eAAG,qBAAqB,KAAK,OAAO,iBAAiB;AAAA,UACzD;AAMA,gBAAM,cAAc,KAAK,OAAO,WAAW,KAAK;AAChD,gBAAM,UAAgB,eAAe,OAAO,YAAY,aAAa,aAC/D,cACA,KAAK;AAEX,cAAI,WAAW,OAAO,QAAQ,aAAa,YAAY;AAClD,gBAAI,OAAO,KAAK,8BAA8B;AAAA,cAC1C,SAAS,KAAK;AAAA,cACd;AAAA,YACJ,CAAC;AAGD,kBAAM,cAAc;AAAA,cACjB,GAAG;AAAA,cACH;AAAA,cACA,QAAQ,IAAI;AAAA,cACZ,SAAS;AAAA,gBACL,UAAU,CAAC,WAAgB;AACvB,sBAAI,OAAO,MAAM,sCAAsC;AAAA,oBACnD,YAAY,OAAO;AAAA,oBACnB;AAAA,kBACJ,CAAC;AACD,qBAAG,eAAe,MAAM;AAAA,gBAC5B;AAAA,cACJ;AAAA,YACH;AAEA,kBAAM,QAAQ,SAAS,WAAW;AAClC,gBAAI,OAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC;AAAA,UAC7D,OAAO;AACF,gBAAI,OAAO,MAAM,sCAAsC,EAAE,MAAM,CAAC;AAAA,UACrE;AAaA,cAAI;AACA,kBAAM,QAAQ,mBAAmB,KAAK,MAAM;AAC5C,kBAAM,YAAY,uBAAuB,KAAK,MAAM;AACpD,gBAAI,MAAM,SAAS,KAAK,OAAO,KAAK,SAAS,EAAE,SAAS,GAAG;AACvD,kBAAI,OAAO,GAAG,cAAc,YAAY;AACpC,mBAAG,UAAU,OAAO;AAAA,kBAChB,WAAW,OAAO,KAAK;AAAA,kBACvB;AAAA,kBACA,YAAY,sBAAsB,IAAI,oBAAoB,GAAG;AAAA,oBACzD;AAAA,oBACA,QAAQ,IAAI;AAAA,oBACZ;AAAA,kBACJ,CAAC;AAAA,gBACL,CAAC;AACD,oBAAI,OAAO,KAAK,uCAAuC;AAAA,kBACnD;AAAA,kBACA,WAAW,MAAM;AAAA,kBACjB,eAAe,OAAO,KAAK,SAAS,EAAE;AAAA,gBAC1C,CAAC;AAAA,cACL,OAAO;AACH,oBAAI,OAAO,KAAK,mEAAmE;AAAA,kBAC/E;AAAA,kBACA,WAAW,MAAM;AAAA,gBACrB,CAAC;AAAA,cACL;AAAA,YACJ;AAAA,UACJ,SAAS,KAAU;AACf,gBAAI,OAAO,MAAM,gDAAgD,KAAc;AAAA,cAC3E;AAAA,YACJ,CAAC;AAAA,UACL;AAOA,cAAI;AACA,kBAAM,UAAU,qBAAqB,KAAK,MAAM;AAChD,kBAAM,mBAAmB,wBAAwB,IAAI,oBAAoB,GAAG;AAAA,cACxE;AAAA,cACA,QAAQ,IAAI;AAAA,cACZ;AAAA,YACJ,CAAC;AACD,gBAAI,aAAa;AACjB,gBAAI,QAAQ,SAAS,KAAK,OAAO,GAAG,mBAAmB,YAAY;AAC/D,yBAAW,UAAU,SAAS;AAC1B,sBAAM,UAAU,iBAAiB,MAAM;AACvC,oBAAI,CAAC,QAAS;AACd,sBAAM,YACF,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,SAAS,IACtD,OAAO,SACP;AACV,oBAAI;AACA,qBAAG,eAAe,WAAW,OAAO,MAAM,SAAS,OAAO,KAAK,EAAE;AACjE;AAAA,gBACJ,SAAS,KAAU;AACf,sBAAI,OAAO,KAAK,8CAA8C;AAAA,oBAC1D;AAAA,oBACA,QAAQ,OAAO;AAAA,oBACf,QAAQ;AAAA,oBACR,OAAO,KAAK,WAAW,OAAO,GAAG;AAAA,kBACrC,CAAC;AAAA,gBACL;AAAA,cACJ;AAAA,YACJ;AACA,gBAAI,aAAa,GAAG;AAChB,kBAAI,OAAO,KAAK,yCAAyC;AAAA,gBACrD;AAAA,gBACA,aAAa;AAAA,cACjB,CAAC;AAAA,YACL;AAAA,UACJ,SAAS,KAAU;AACf,gBAAI,OAAO,MAAM,kDAAkD,KAAc;AAAA,cAC7E;AAAA,YACJ,CAAC;AAAA,UACL;AAOA,cAAI;AACA,kBAAM,YAAmB,MAAM,QAAQ,KAAK,OAAO,SAAS,IACtD,KAAK,OAAO,YACZ,MAAM,SAAS,KAAK,OAAO,YAAY,CAAC,GAAG,SAAS,IAC/C,KAAK,OAAO,SAAiB,YAC9B,CAAC;AACX,gBAAI,UAAU,SAAS,GAAG;AACtB,kBAAI,KAAK,gBAAgB,YAAY;AACjC,oBAAI;AACJ,oBAAI;AAAE,wBAAM,IAAI,WAAW,WAAW;AAAA,gBAAG,QAAQ;AAAA,gBAAsB;AACvE,oBAAI,CAAC,OAAO,OAAO,IAAI,kBAAkB,YAAY;AACjD,sBAAI,OAAO,KAAK,sFAAiF;AAAA,oBAC7F;AAAA,oBAAO,cAAc,UAAU;AAAA,kBACnC,CAAC;AACD;AAAA,gBACJ;AACA,sBAAM,SAAS,EAAE,UAAU,MAAM,OAAO,CAAC,GAAG,aAAa,CAAC,EAAE;AAC5D,oBAAI,KAAK;AACT,2BAAW,QAAQ,WAAW;AAC1B,sBAAI;AACA,0BAAM,IAAI,cAAc;AAAA,sBACpB,MAAM,KAAK;AAAA,sBACX,OAAO,KAAK;AAAA,sBACZ,QAAQ,KAAK;AAAA,sBACb,aAAa,KAAK;AAAA,sBAClB,QAAQ,KAAK,WAAW;AAAA,sBACxB,YAAY;AAAA,oBAChB,GAAG,MAAM;AACT;AAAA,kBACJ,SAAS,KAAU;AACf,wBAAI,OAAO,KAAK,mDAAmD;AAAA,sBAC/D;AAAA,sBAAO,SAAS,MAAM;AAAA,sBAAM,OAAO,KAAK,WAAW,OAAO,GAAG;AAAA,oBACjE,CAAC;AAAA,kBACL;AAAA,gBACJ;AACA,oBAAI,OAAO,KAAK,6CAA6C,EAAE,OAAO,OAAO,GAAG,CAAC;AAAA,cACrF,CAAC;AAAA,YACL;AAAA,UACJ,SAAS,KAAU;AACf,gBAAI,OAAO,MAAM,gEAAgE,KAAc,EAAE,MAAM,CAAC;AAAA,UAC5G;AAOA,eAAK,iBAAiB,KAAK,kBAAkB,GAAG;AAKhD,gBAAM,KAAK,iBAAiB,KAAK,KAAK;AAItC,gBAAM,eAAsB,CAAC;AAG7B,cAAI,MAAM,QAAQ,KAAK,OAAO,IAAI,GAAG;AACjC,yBAAa,KAAK,GAAG,KAAK,OAAO,IAAI;AAAA,UACzC;AAGA,gBAAM,WAAW,KAAK,OAAO,YAAY,KAAK;AAC9C,cAAI,YAAY,MAAM,QAAQ,SAAS,IAAI,GAAG;AAC1C,yBAAa,KAAK,GAAG,SAAS,IAAI;AAAA,UACtC;AAMA,cAAI,aAAa,SAAS,GAAG;AACxB,gBAAI,OAAO,KAAK,qBAAqB,aAAa,MAAM,sBAAsB,KAAK,EAAE;AAGrF,kBAAM,qBAAqB,aACtB,OAAO,CAAC,MAAW,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,CAAC,EACvD,IAAI,CAAC,OAAY;AAAA,cACd,GAAG;AAAA,cACH,QAAQ,EAAE;AAAA,YACd,EAAE;AAYN,gBAAI;AACA,oBAAM,SAAe,IAAY;AACjC,oBAAM,YAAY,MAAM;AACpB,oBAAI;AAAE,yBAAO,QAAQ,aAAa,eAAe;AAAA,gBAAG,QAAQ;AAAE,yBAAO;AAAA,gBAAW;AAAA,cACpF,GAAG;AACH,oBAAM,SAAS,MAAM,QAAQ,QAAQ,IAC/B,CAAC,GAAG,UAAU,GAAG,kBAAkB,IACnC;AACN,oBAAM,cAAc,CAAC,MAAc,UAAe;AAC9C,oBAAI,QAAQ,gBAAiB,QAAO,gBAAgB,MAAM,KAAK;AAAA,yBACtD,OAAQ,IAAY,oBAAoB,WAAY,CAAC,IAAY,gBAAgB,MAAM,KAAK;AAAA,cACzG;AACA,0BAAY,iBAAiB,MAAM;AAEnC,oBAAM,cAAc,IAAI,WAAW,UAAU;AAC7C,oBAAM,YAAY,IAAI;AACtB,oBAAM,WAAW,OAAO,mBAA2B;AAC/C,oBAAI,CAAC,eAAgB,QAAO,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAW;AAC3E,sBAAM,KAAK,eAAgB,IAAI,WAAW,UAAU;AACpD,oBAAI,CAAC,IAAI;AACL,4BAAU,KAAK,8CAA8C;AAC7D,yBAAO,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAW;AAAA,gBAC1D;AACA,sBAAM,eAAe,MAAM;AACvB,sBAAI;AAAE,2BAAO,QAAQ,aAAa,eAAe;AAAA,kBAAG,QAAQ;AAAE,2BAAO;AAAA,kBAAQ;AAAA,gBACjF,GAAG,KAAK;AACR,oBAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,YAAY,WAAW,GAAG;AACzD,yBAAO,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAW;AAAA,gBAC1D;AACA,sBAAM,aAAa,IAAI,kBAAkB,IAAI,IAAI,SAAS;AAC1D,sBAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,wBAAwB;AACzE,sBAAM,UAAU,wBAAwB,MAAM;AAAA,kBAC1C,UAAU;AAAA,kBACV,QAAQ;AAAA,oBACJ,aAAa;AAAA,oBACb,WAAW;AAAA,oBACX;AAAA,kBACJ;AAAA,gBACJ,CAAC;AACD,sBAAM,SAAS,MAAM,WAAW,KAAK,OAAO;AAC5C,uBAAO;AAAA,kBACH,UAAU,OAAO,QAAQ;AAAA,kBACzB,SAAS,OAAO,QAAQ;AAAA,kBACxB,QAAQ,OAAO;AAAA,gBACnB;AAAA,cACJ;AACA,0BAAY,iBAAiB,QAAQ;AACrC,kBAAI,OAAO,KAAK,uBAAuB,mBAAmB,MAAM,mDAAmD,OAAO,MAAM,GAAG;AAAA,YACvI,SAAS,GAAQ;AACb,kBAAI,OAAO,KAAK,mEAAmE,EAAE,OAAO,GAAG,QAAQ,CAAC;AAAA,YAC5G;AAUA,kBAAM,cAAc,OAAO,QAAQ,IAAI,mBAAmB,MAAM,EAAE,YAAY,MAAM;AACpF,gBAAI,aAAa;AACb,kBAAI,OAAO,KAAK,4GAAuG;AAAA,YAC3H,OAAO;AAEP,kBAAI;AACA,sBAAM,WAAW,IAAI,WAAW,UAAU;AAC1C,oBAAI,UAAU;AACV,wBAAM,aAAa,IAAI,kBAAkB,IAAI,UAAU,IAAI,MAAM;AACjE,wBAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,wBAAwB;AACzE,wBAAM,UAAU,wBAAwB,MAAM;AAAA,oBAC1C,UAAU;AAAA,oBACV,QAAQ,EAAE,aAAa,UAAU,WAAW,KAAK;AAAA,kBACrD,CAAC;AACD,wBAAM,SAAS,MAAM,WAAW,KAAK,OAAO;AAC5C,sBAAI,OAAO,KAAK,kCAAkC;AAAA,oBAC9C,UAAU,OAAO,QAAQ;AAAA,oBACzB,SAAS,OAAO,QAAQ;AAAA,oBACxB,QAAQ,OAAO,OAAO;AAAA,kBAC1B,CAAC;AAAA,gBACL,OAAO;AAEH,sBAAI,OAAO,MAAM,2DAA2D;AAC5E,6BAAW,WAAW,oBAAoB;AACtC,wBAAI,OAAO,KAAK,oBAAoB,QAAQ,QAAQ,MAAM,gBAAgB,QAAQ,MAAM,EAAE;AAC1F,+BAAW,UAAU,QAAQ,SAAS;AAClC,0BAAI;AACA,8BAAM,GAAG,OAAO,QAAQ,QAAQ,QAAQ,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAQ;AAAA,sBAClF,SAAS,KAAU;AACf,4BAAI,OAAO,KAAK,6BAA6B,QAAQ,MAAM,YAAY,EAAE,OAAO,IAAI,QAAQ,CAAC;AAAA,sBACjG;AAAA,oBACJ;AAAA,kBACJ;AACA,sBAAI,OAAO,KAAK,iCAAiC;AAAA,gBACrD;AAAA,cACJ,SAAS,KAAU;AAEf,oBAAI,OAAO,KAAK,mEAAmE,EAAE,OAAO,IAAI,QAAQ,CAAC;AACzG,2BAAW,WAAW,oBAAoB;AACtC,6BAAW,UAAU,QAAQ,SAAS;AAClC,wBAAI;AACA,4BAAM,GAAG,OAAO,QAAQ,QAAQ,QAAQ,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAQ;AAAA,oBAClF,SAAS,WAAgB;AACrB,0BAAI,OAAO,KAAK,6BAA6B,QAAQ,MAAM,YAAY,EAAE,OAAO,UAAU,QAAQ,CAAC;AAAA,oBACvG;AAAA,kBACJ;AAAA,gBACJ;AACA,oBAAI,OAAO,KAAK,4CAA4C;AAAA,cAChE;AAAA,YACA;AAAA,UACL;AAAA,QACJ;AAEA,oBAAO,OAAO,QAAuB;AACjC,gBAAM,MAAM,KAAK,OAAO,YAAY,KAAK;AACzC,eAAK,iBAAiB,KAAK,oBAAoB,GAAG;AAAA,QACtD;AAxZI,aAAK,SAAS;AACd,aAAK,iBAAiB;AAEtB,cAAM,MAAM,OAAO,YAAY;AAC/B,cAAM,QAAQ,IAAI,MAAM,IAAI,QAAQ;AAEpC,aAAK,OAAO,cAAc,KAAK;AAC/B,aAAK,UAAU,IAAI;AAAA,MACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAwZQ,iBAAiB,KAAoB,OAA8C,KAAgB;AACvG,YAAI,CAAC,KAAK,eAAgB;AAE1B,cAAM,UAAW,IAAY;AAC7B,YAAI,OAAO,YAAY,YAAY;AAC/B,cAAI,OAAO,MAAM,oEAA+D,EAAE,MAAM,CAAC;AACzF;AAAA,QACJ;AAEA,cAAM,UAAU,IAAI,QAAQ,IAAI;AAChC,YAAI,CAAC,QAAS;AAEd,cAAM,UAAU;AAAA,UACZ,eAAe,KAAK,eAAe;AAAA,UACnC,gBAAgB,KAAK,eAAe;AAAA,UACpC,aAAa,KAAK,eAAe;AAAA,UACjC,KAAK;AAAA,YACD,MAAM;AAAA,YACN,OAAO,IAAI;AAAA,YACX,MAAM,IAAI;AAAA,YACV,UAAU,IAAI;AAAA,YACd,WAAW,IAAI,aAAa,IAAI;AAAA,YAChC,QAAQ,IAAI,WAAW;AAAA,UAC3B;AAAA,UACA,QAAQ,KAAK,eAAe,WAAW,KAAK,eAAe,YAAY,YAAY;AAAA,UACnF,WAAW,KAAK,eAAe;AAAA,QACnC;AAEA,YAAI;AACA,kBAAQ,KAAK,KAAK,OAAO,OAAO;AAAA,QACpC,SAAS,KAAU;AACf,cAAI,OAAO,KAAK,2CAA2C,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC;AAAA,QAC7F;AAAA,MACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAUA,MAAc,iBAAiB,KAAoB,OAA8B;AAG7E,YAAI;AACJ,YAAI;AACA,wBAAc,IAAI,WAAW,MAAM;AAAA,QACvC,QAAQ;AAAA,QAER;AAGA,cAAM,UAA0C,CAAC;AACjD,YAAI,MAAM,QAAQ,KAAK,OAAO,YAAY,GAAG;AACzC,kBAAQ,KAAK,GAAG,KAAK,OAAO,YAAY;AAAA,QAC5C;AACA,cAAM,WAAW,KAAK,OAAO,YAAY,KAAK;AAC9C,YAAI,YAAY,MAAM,QAAQ,SAAS,YAAY,KAAK,SAAS,iBAAiB,KAAK,OAAO,cAAc;AACxG,kBAAQ,KAAK,GAAG,SAAS,YAAY;AAAA,QACzC;AAEA,YAAI,CAAC,aAAa;AACd,cAAI,QAAQ,SAAS,GAAG;AAQpB,gBAAI;AACA,oBAAM,MAAM,MAAM,OAAO,mBAAmB;AAC5C,oBAAM,mBAAoB,IAAY;AACtC,kBAAI,OAAO,qBAAqB,YAAY;AACxC,sBAAM,WAAW,iBAAiB;AAClC,gBAAC,IAAY,gBAAgB,QAAQ,QAAQ;AAC7C,8BAAc;AACd,oBAAI,OAAO;AAAA,kBACP,uDAAuD,KAAK,MAAM,QAAQ,MAAM;AAAA,gBAEpF;AAAA,cACJ;AAAA,YACJ,SAAS,KAAU;AACf,kBAAI,OAAO;AAAA,gBACP,eAAe,KAAK,SAAS,QAAQ,MAAM,oDAAoD,KAAK,WAAW,GAAG;AAAA,cACtH;AACA;AAAA,YACJ;AACA,gBAAI,CAAC,aAAa;AACd,kBAAI,OAAO;AAAA,gBACP,eAAe,KAAK,SAAS,QAAQ,MAAM;AAAA,cAC/C;AACA;AAAA,YACJ;AAAA,UACJ,OAAO;AACH,gBAAI,OAAO,MAAM,mEAAmE,EAAE,MAAM,CAAC;AAC7F;AAAA,UACJ;AAAA,QACJ;AAGA,cAAM,aAAa,KAAK,OAAO,SAAS,KAAK,OAAO,YAAY,KAAK,SAAS;AAC9E,YAAI,YAAY,iBAAiB,OAAO,YAAY,qBAAqB,YAAY;AACjF,sBAAY,iBAAiB,WAAW,aAAa;AACrD,cAAI,OAAO,MAAM,6BAA6B,EAAE,OAAO,QAAQ,WAAW,cAAc,CAAC;AAAA,QAC7F;AAEA,YAAI,QAAQ,WAAW,GAAG;AACtB;AAAA,QACJ;AAEA,YAAI,gBAAgB;AACpB,mBAAW,UAAU,SAAS;AAE1B,qBAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,gBAAI,QAAQ,OAAO,SAAS,UAAU;AAClC,kBAAI;AACA,4BAAY,iBAAiB,QAAQ,IAA+B;AACpE;AAAA,cACJ,SAAS,KAAU;AACf,oBAAI,OAAO,KAAK,sCAAsC,EAAE,OAAO,QAAQ,OAAO,IAAI,QAAQ,CAAC;AAAA,cAC/F;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ;AAGA,cAAM,SAAS;AACf,YAAI,OAAO,aAAa,OAAO,MAAM;AACjC,cAAI,OAAO;AAAA,YACP,iBAAiB,aAAa,gDAAgD,KAAK;AAAA,UAEvF;AAAA,QACJ,OAAO;AACH,cAAI,OAAO,KAAK,qCAAqC,EAAE,OAAO,SAAS,QAAQ,QAAQ,SAAS,cAAc,CAAC;AAAA,QACnH;AAAA,MACJ;AAAA,IACJ;AAAA;AAAA;;;ACtlBA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqCA,SAAS,YAAY,kBAAkB;AAahC,SAAS,0BAA0B,eAA+B;AACrE,SAAO,WAAW,aAAa;AACnC;AAgBO,SAAS,8BAA8B,YAAoB,eAA+B;AAC7F,SAAO,WAAW,UAAU,UAAU,EAAE,OAAO,gBAAgB,aAAa,EAAE,EAAE,OAAO,KAAK;AAChG;AAWO,SAAS,4BAA4B,WAA2B;AACnE,SAAO,WAAW,QAAQ,EAAE,OAAO,SAAS,EACvC,OAAO,QAAQ,EACf,QAAQ,OAAO,EAAE,EACjB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG;AAC3B;AASO,SAAS,4BAA4B,UAAkB,WAAmB,gBAAwB;AACrG,MAAI;AACJ,MAAI,SAAS,WAAW,SAAS,KAAK,SAAS,WAAW,UAAU,GAAG;AACnE,WAAO;AAAA,EACX,WAAW,2BAA2B,KAAK,QAAQ,GAAG;AAQlD,UAAM,QAAQ,QAAQ,IAAI,mBAAmB,IAAI,KAAK;AACtD,UAAM,eAAe,QAAQ,KAAK,QAAQ,KAAK,CAAC,OAAO,WAAW,GAAG,QAAQ,IAAI,IAAI;AACrF,WAAO,UAAU,YAAY;AAAA,EACjC,OAAO;AACH,WAAO,WAAW,QAAQ;AAAA,EAC9B;AACA,QAAM,UAAU,KAAK,QAAQ,QAAQ,EAAE;AACvC,QAAM,OAAO,SAAS,QAAQ,QAAQ,EAAE;AACxC,SAAO,GAAG,OAAO,GAAG,IAAI,oBAAoB,wBAAwB;AACxE;AAwCA,eAAsB,sBAAsB,MAAmD;AAC3F,QAAM,EAAE,IAAI,eAAe,UAAU,YAAY,QAAQ,aAAa,IAAI;AAC1E,MAAI,CAAC,YAAY;AACb,YAAQ,OAAO,qEAAgE,EAAE,cAAc,CAAC;AAChG;AAAA,EACJ;AACA,QAAM,WAAW,0BAA0B,aAAa;AACxD,QAAM,wBAAwB,8BAA8B,YAAY,aAAa;AACrF,QAAM,qBAAqB,4BAA4B,qBAAqB;AAC5E,QAAM,kBAAkB,WAAW,4BAA4B,QAAQ,IAAI;AAE3E,MAAI,WAAgB;AACpB,MAAI;AACA,UAAM,OAAO,MAAM,GAAG,KAAK,yBAAyB;AAAA,MAChD,OAAO,EAAE,WAAW,SAAS;AAAA,MAC7B,OAAO;AAAA,IACX,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAClC,UAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,MAAM,QAAS,MAAc,OAAO,IAAK,KAAa,UAAU,CAAC;AAC3G,eAAW,KAAK,CAAC,KAAK;AAAA,EAC1B,SAAS,KAAK;AAGV,YAAQ,OAAO,yEAAoE;AAAA,MAC/E;AAAA,MACA,OAAQ,KAAe;AAAA,IAC3B,CAAC;AACD;AAAA,EACJ;AAEA,QAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,MAAI,CAAC,UAAU;AACX,UAAM,YAAY,kBAAkB,CAAC,eAAe,IAAI,CAAC;AACzD,QAAI;AACA,YAAM,GAAG,OAAO,yBAAyB;AAAA,QACrC,IAAI,UAAU,aAAa;AAAA,QAC3B,MAAM,WAAW,aAAa;AAAA,QAC9B,WAAW;AAAA,QACX,eAAe;AAAA,QACf,MAAM;AAAA,QACN,eAAe,KAAK,UAAU,SAAS;AAAA,QACvC,aAAa,KAAK,UAAU,CAAC,sBAAsB,eAAe,CAAC;AAAA,QACnE,gBAAgB,KAAK,UAAU,CAAC,MAAM,CAAC;AAAA,QACvC,QAAQ,KAAK,UAAU,CAAC,UAAU,SAAS,SAAS,CAAC;AAAA,QACrD,4BAA4B;AAAA,QAC5B,cAAc;AAAA,QACd,cAAc;AAAA,QACd,UAAU;AAAA,QACV,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,YAAY;AAAA,MAChB,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAClC,cAAQ,OAAO,oDAAoD,EAAE,eAAe,SAAS,CAAC;AAAA,IAClG,SAAS,KAAK;AAIV,cAAQ,OAAO,sDAAsD;AAAA,QACjE;AAAA,QACA,OAAQ,KAAe;AAAA,MAC3B,CAAC;AACD,UAAI,aAAc,OAAM;AAAA,IAC5B;AACA;AAAA,EACJ;AASA,MAAI,mBAA6B,CAAC;AAClC,MAAI;AACA,UAAM,MAAM,SAAS;AACrB,UAAM,SAAS,OAAO,QAAQ,WAAW,KAAK,MAAM,GAAG,IAAI;AAC3D,QAAI,MAAM,QAAQ,MAAM,EAAG,oBAAmB,OAAO,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ;AAAA,EACzG,QAAQ;AAAA,EAAwC;AAChD,QAAM,kBAAkB,mBAAmB,CAAC,iBAAiB,SAAS,eAAe,IAC/E,CAAC,GAAG,kBAAkB,eAAe,IACrC;AAEN,QAAM,cAAmC;AAAA,IACrC,MAAM,SAAS,QAAQ,WAAW,aAAa;AAAA,IAC/C,eAAe;AAAA,IACf,MAAM,SAAS,QAAQ;AAAA,IACvB,eAAe,KAAK,UAAU,eAAe;AAAA,IAC7C,aAAa,KAAK,UAAU,CAAC,sBAAsB,eAAe,CAAC;AAAA,IACnE,gBAAgB,KAAK,UAAU,CAAC,MAAM,CAAC;AAAA,IACvC,QAAQ,KAAK,UAAU,CAAC,UAAU,SAAS,SAAS,CAAC;AAAA,IACrD,4BAA4B;AAAA,IAC5B,cAAc;AAAA,IACd,cAAc;AAAA,IACd,UAAU;AAAA,IACV,cAAc;AAAA,IACd,YAAY;AAAA,EAChB;AACA,MAAI;AACA,UAAM,GAAG;AAAA,MACL;AAAA,MACA;AAAA,MACA,EAAE,OAAO,EAAE,IAAI,SAAS,GAAG,EAAE;AAAA,MAC7B,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE;AAAA,IAClC;AACA,YAAQ,OAAO,iDAAiD;AAAA,MAC5D;AAAA,MACA;AAAA,MACA,eAAe;AAAA,IACnB,CAAC;AAAA,EACL,SAAS,KAAK;AACV,YAAQ,OAAO,sDAAsD;AAAA,MACjE;AAAA,MACA,OAAQ,KAAe;AAAA,IAC3B,CAAC;AACD,QAAI,aAAc,OAAM;AAAA,EAC5B;AACJ;AAkBA,eAAsB,2BAA2B,MAK9C;AACC,QAAM,EAAE,IAAI,YAAY,QAAQ,QAAQ,IAAK,IAAI;AACjD,MAAI,CAAC,YAAY;AACb,YAAQ,OAAO,+DAA0D;AACzE,WAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,gBAAgB,GAAG,UAAU,CAAC,EAAE;AAAA,EACpE;AACA,MAAI,WAAkB,CAAC;AACvB,MAAI;AACA,UAAM,OAAO,MAAM,GAAG,KAAK,mBAAmB;AAAA,MAC1C;AAAA,MACA,QAAQ,CAAC,MAAM,YAAY,QAAQ;AAAA,IACvC,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAClC,eAAW,MAAM,QAAQ,IAAI,IAAI,OAAO,MAAM,QAAS,MAAc,OAAO,IAAK,KAAa,UAAU,CAAC;AAAA,EAC7G,SAAS,KAAK;AACV,YAAQ,OAAO,wDAAwD;AAAA,MACnE,OAAQ,KAAe;AAAA,IAC3B,CAAC;AACD,WAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,gBAAgB,GAAG,UAAU,CAAC,EAAE,eAAe,UAAU,OAAQ,KAAe,WAAW,OAAO,GAAG,EAAE,CAAC,EAAE;AAAA,EAC9I;AACA,MAAI,SAAS;AACb,MAAI,iBAAiB;AACrB,QAAM,WAA4D,CAAC;AACnE,aAAW,KAAK,UAAU;AACtB,QAAI,CAAC,GAAG,GAAI;AACZ,UAAM,SAAS,OAAO,YAAY;AAC9B,UAAI;AACA,cAAM,IAAI,MAAM,GAAG,KAAK,yBAAyB;AAAA,UAC7C,OAAO,EAAE,WAAW,0BAA0B,EAAE,EAAE,EAAE;AAAA,UACpD,OAAO;AAAA,QACX,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAClC,cAAM,OAAO,MAAM,QAAQ,CAAC,IAAI,IAAI,MAAM,QAAS,GAAW,OAAO,IAAK,EAAU,UAAU,CAAC;AAC/F,eAAO,KAAK,CAAC,KAAK;AAAA,MACtB,QAAQ;AAAE,eAAO;AAAA,MAAM;AAAA,IAC3B,GAAG;AACH,QAAI;AACA,YAAM,sBAAsB,EAAE,IAAI,eAAe,EAAE,IAAI,UAAU,EAAE,UAAU,YAAY,QAAQ,cAAc,KAAK,CAAC;AACrH,UAAI,OAAQ;AAAA,WACP;AAED,cAAM,QAAQ,OAAO,YAAY;AAC7B,cAAI;AACA,kBAAM,IAAI,MAAM,GAAG,KAAK,yBAAyB;AAAA,cAC7C,OAAO,EAAE,WAAW,0BAA0B,EAAE,EAAE,EAAE;AAAA,cACpD,OAAO;AAAA,YACX,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAClC,kBAAM,OAAO,MAAM,QAAQ,CAAC,IAAI,IAAI,MAAM,QAAS,GAAW,OAAO,IAAK,EAAU,UAAU,CAAC;AAC/F,mBAAO,KAAK,CAAC,KAAK;AAAA,UACtB,SAAS,KAAK;AAAE,mBAAO,EAAE,UAAW,KAAe,QAAQ;AAAA,UAAG;AAAA,QAClE,GAAG;AACH,YAAI,SAAS,CAAE,MAAc,SAAU;AAAA,YAClC,UAAS,KAAK,EAAE,eAAe,EAAE,IAAI,OAAO,6BAA6B,QAAQ,KAAK,UAAU,KAAK,IAAI,MAAM,GAAG,CAAC;AAAA,MAC5H;AAAA,IACJ,SAAS,KAAU;AACf,eAAS,KAAK,EAAE,eAAe,EAAE,IAAI,OAAO,KAAK,WAAW,OAAO,GAAG,EAAE,CAAC;AAAA,IAC7E;AAAA,EACJ;AACA,UAAQ,OAAO,oCAAoC,EAAE,SAAS,SAAS,QAAQ,QAAQ,gBAAgB,UAAU,SAAS,OAAO,CAAC;AAClI,SAAO,EAAE,SAAS,SAAS,QAAQ,QAAQ,gBAAgB,SAAS;AACxE;AAlWA,IA4Ca;AA5Cb;AAAA;AAAA;AA4CO,IAAM,2BAA2B;AAAA;AAAA;;;AC5CxC;AAAA;AAAA;AAAA;AAAA;AAmDA,eAAsB,wBAClB,QACA,MACA,QACoD;AACpD,MAAI,CAAC,MAAM,MAAM,CAAC,MAAM,KAAM,QAAO;AAErC,MAAI;AACA,UAAM,KAAU,OAAO,WAAW,UAAU;AAC5C,QAAI,CAAC,IAAI,UAAU,CAAC,IAAI,MAAM;AAC1B,cAAQ,OAAO,0DAA0D,EAAE,OAAO,KAAK,GAAG,CAAC;AAC3F,aAAO;AAAA,IACX;AAEA,QAAI;AACA,YAAM,WAAW,MAAM,GAAG,KAAK,SAAS,EAAE,OAAO,EAAE,IAAI,KAAK,GAAG,EAAE,CAAQ;AACzE,YAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI,WAAY,UAAU,SAAS,CAAC;AACvE,UAAI,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAG,QAAO;AAAA,IACvD,QAAQ;AAAA,IAGR;AAEA,UAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,UAAM,GAAG,OAAO,SAAS;AAAA,MACrB,IAAI,KAAK;AAAA,MACT,MAAM,KAAK;AAAA,MACX,MAAM,KAAK,QAAQ;AAAA,MACnB,MAAM,KAAK,QAAQ;AAAA,MACnB,UAAU;AAAA,MACV,YAAY;AAAA,IAChB,CAAC;AAED,YAAQ,OAAO,wCAAwC;AAAA,MACnD,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,IACf,CAAC;AACD,WAAO;AAAA,EACX,SAAS,KAAU;AACf,YAAQ,OAAO,gDAAgD;AAAA,MAC3D,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,IAChB,CAAC;AACD,WAAO;AAAA,EACX;AACJ;AAaA,eAAsB,kBAClB,QACA,MAKA,QACoD;AACpD,QAAM,EAAE,QAAQ,eAAe,IAAI;AACnC,QAAM,OAAO,KAAK,QAAQ;AAC1B,MAAI,CAAC,UAAU,CAAC,eAAgB,QAAO;AAEvC,MAAI;AACA,UAAM,KAAU,OAAO,WAAW,UAAU;AAC5C,QAAI,CAAC,IAAI,UAAU,CAAC,IAAI,MAAM;AAC1B,cAAQ,OAAO,oDAAoD,EAAE,QAAQ,eAAe,CAAC;AAC7F,aAAO;AAAA,IACX;AAEA,QAAI;AACA,YAAM,WAAW,MAAM,GAAG,KAAK,cAAc;AAAA,QACzC,OAAO,EAAE,SAAS,QAAQ,iBAAiB,eAAe;AAAA,MAC9D,CAAQ;AACR,YAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI,WAAY,UAAU,SAAS,CAAC;AACvE,UAAI,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAG,QAAO;AAAA,IACvD,QAAQ;AAAA,IAER;AAEA,UAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AAItC,UAAM,QAAQ,OAAO,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;AAC5D,UAAM,GAAG,OAAO,cAAc;AAAA,MAC1B,IAAI;AAAA,MACJ,iBAAiB;AAAA,MACjB,SAAS;AAAA,MACT;AAAA,MACA,YAAY;AAAA,IAChB,CAAC;AAED,YAAQ,OAAO,qCAAqC;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACJ,CAAC;AACD,WAAO;AAAA,EACX,SAAS,KAAU;AACf,YAAQ,OAAO,0CAA0C;AAAA,MACrD;AAAA,MACA;AAAA,MACA,OAAO,KAAK;AAAA,IAChB,CAAC;AACD,WAAO;AAAA,EACX;AACJ;AAtKA,IAsCM;AAtCN;AAAA;AAAA;AAsCA,IAAM,UAAU;AAAA;AAAA;;;ACtChB;AAAA;AAAA;AAAA;AAqDA,eAAsB,iBAClB,QACA,MACA,QACoD;AACpD,MAAI,CAAC,MAAM,UAAU,CAAC,MAAM,MAAO,QAAO;AAE1C,MAAI;AACA,UAAM,KAAU,OAAO,WAAW,UAAU;AAC5C,QAAI,CAAC,IAAI,UAAU,CAAC,IAAI,MAAM;AAC1B,cAAQ,OAAO,mDAAmD,EAAE,QAAQ,KAAK,OAAO,CAAC;AACzF,aAAO;AAAA,IACX;AAKA,QAAI;AACA,YAAM,WAAW,MAAM,GAAG,KAAK,UAAU,EAAE,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAQ;AAC9E,YAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI,WAAY,UAAU,SAAS,CAAC;AACvE,UAAI,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAG,QAAO;AAAA,IACvD,QAAQ;AAAA,IAIR;AAEA,UAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,UAAM,GAAG,OAAO,UAAU;AAAA,MACtB,IAAI,KAAK;AAAA,MACT,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ,KAAK,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,MAC/C,OAAO,KAAK,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,MAKrB,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,YAAY;AAAA,IAChB,CAAC;AAED,YAAQ,OAAO,mCAAmC;AAAA,MAC9C,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,IAChB,CAAC;AACD,WAAO;AAAA,EACX,SAAS,KAAU;AAGf,YAAQ,OAAO,yCAAyC;AAAA,MACpD,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,IAChB,CAAC;AACD,WAAO;AAAA,EACX;AACJ;AA7GA,IAyCM;AAzCN;AAAA;AAAA;AAyCA,IAAM,WAAW;AAAA;AAAA;;;ACtCjB,SAAS,gBAAAC,qBAAoB;;;ACD7B,SAAS,oBAA6D;AACtE;AAAA,EACI;AAAA,EACA;AAAA,OAEG;AA4CA,IAAM,UAAN,MAAc;AAAA,EAGjB,YAAY,SAAwB,CAAC,GAAG;AACpC,SAAK,SAAS,IAAI,aAAa,OAAO,MAAM;AAG5C,QAAI,OAAO,QAAQ;AACd,WAAK,OAAO,gBAAgB,eAAe,OAAO,MAAM;AAAA,IAC7D;AAKA,QAAI,OAAO,YAAY,OAAO;AAC1B,YAAM,OAAO,KAAK,wBAAwB,OAAO,OAAO;AACxD,WAAK,OAAO,IAAI,IAAI,qBAAqB,IAAI,CAAC;AAI9C,WAAK,OAAO,IAAI,IAAI,4BAA4B,CAAC;AAAA,IACrD;AAAA,EACJ;AAAA,EAEQ,wBACJ,KAC2B;AAC3B,QAAI,CAAC,IAAK,QAAO,CAAC;AAGlB,QACI,OAAO,QAAQ,aACd,aAAa,OAAO,YAAY,QACjC,EAAE,YAAY,MAChB;AACE,aAAO;AAAA,IACX;AAEA,WAAO,EAAE,QAAQ,IAAoC;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,QAAgB;AAChB,SAAK,OAAO,IAAI,MAAM;AACtB,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,QAAQ;AACV,UAAM,KAAK,OAAO,UAAU;AAC5B,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAKA,YAAY;AACR,WAAO,KAAK;AAAA,EAChB;AACJ;;;AC3FA;AAHA,SAAS,WAAWC,oBAAmB;AACvC,SAAS,iBAAiB;AAC1B,SAAS,SAAS;AAGX,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAChD,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,gBAAgB,EAAE,KAAK,CAAC,UAAU,eAAe,SAAS,UAAU,YAAY,SAAS,CAAC,EAAE,SAAS;AAAA,EACrG,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,cAAc,EAAE,OAAO,EAAE,SAAS;AACtC,CAAC;AAsBD,SAAS,oBAAoB,OAAmC;AAC5D,MAAI,gBAAgB,KAAK,KAAK,EAAG,QAAO;AACxC,MAAI,yBAAyB,KAAK,KAAK,EAAG,QAAO;AACjD,MAAI,4BAA4B,KAAK,KAAK,EAAG,QAAO;AACpD,MAAI,yBAAyB,KAAK,KAAK,EAAG,QAAO;AACjD,MAAI,qBAAqB,KAAK,KAAK,EAAG,QAAO;AAC7C,MAAI,eAAe,KAAK,KAAK,EAAG,QAAO;AACvC,MAAI,UAAU,KAAK,KAAK,EAAG,QAAO;AAElC,MAAI,CAAC,2BAA2B,KAAK,KAAK,EAAG,QAAO;AACpD,QAAM,IAAI;AAAA,IACN,sDAAsD,KAAK;AAAA,EAE/D;AACJ;AAEA,eAAsB,sBAAsB,QAAgE;AACxG,QAAM,MAAM,4BAA4B,MAAM,UAAU,CAAC,CAAC;AAE1D,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,uBAAuB;AAC/D,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,uBAAuB;AAC/D,QAAM,EAAE,cAAAC,cAAa,IAAI,MAAM;AAC/B,QAAM,EAAE,WAAAC,WAAU,IAAI,MAAM;AAE5B,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,gBAAgB,IAAI,iBAAiB,QAAQ,IAAI,qBAAqB;AAC5E,QAAM,oBAAoB,IAAI,gBACvB,QAAQ,IAAI,oBACZF,aAAY,KAAK,uBAAuB;AAC/C,QAAM,eAAe,UAAU,iBAAiB,IAC1C,oBACC,kBAAkB,WAAW,GAAG,IAC7B,oBACAA,aAAY,KAAK,iBAAiB;AAE5C,QAAM,QAAQ,IAAI,eACX,QAAQ,IAAI,iBAAiB,KAAK,KAClC,QAAQ,IAAI,oBAAoB,KAAK,KACrC,QAAQA,aAAY,KAAK,iCAAiC,CAAC;AAClE,QAAM,cAAc,IAAI,qBACjB,QAAQ,IAAI,wBAAwB,KAAK,KACzC,QAAQ,IAAI,kBAAkB,KAAK;AAC1C,QAAM,iBAAiB,IAAI,kBACnB,QAAQ,IAAI,oBAAoB,KAAK;AAC7C,QAAM,WAA+B,kBAAkB,oBAAoB,KAAK;AAEhF,MAAI;AACJ,MAAI,aAAa,UAAU;AACvB,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,4BAA4B;AACpE,mBAAe,IAAIC,cAAa,IAAI,eAAe,CAAC;AAAA,EACxD,WAAW,aAAa,SAAS;AAC7B,UAAM,EAAE,YAAY,IAAI,MAAM,OAAO,2BAA2B;AAChE,mBAAe,IAAIA;AAAA,MACf,IAAI,YAAY,EAAE,KAAK,OAAO,WAAW,YAAY,CAAC;AAAA,IAC1D;AAAA,EACJ,WAAW,aAAa,YAAY;AAChC,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,yBAAyB;AAC5D,mBAAe,IAAIA;AAAA,MACf,IAAI,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,MAAM,EAAE,KAAK,GAAG,KAAK,EAAE;AAAA,MAC3B,CAAC;AAAA,IACL;AAAA,EACJ,WAAW,aAAa,WAAW;AAG/B,QAAI;AACJ,QAAI;AACA,OAAC,EAAE,cAAc,IAAI,MAAM,OAAO,6BAAoC;AAAA,IAC1E,SAAS,KAAU;AACf,YAAM,IAAI;AAAA,QACN,sJAC6D,KAAK,WAAW,GAAG;AAAA,MACpF;AAAA,IACJ;AACA,mBAAe,IAAIA,cAAa,IAAI,cAAc,EAAE,KAAK,MAAM,CAAC,CAAQ;AAAA,EAC5E,WAAW,aAAa,eAAe;AACnC,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,iCAAwC;AAClF,UAAM,WAAW,MACZ,QAAQ,yBAAyB,EAAE,EACnC,QAAQ,kBAAkB,EAAE;AACjC,QAAI,YAAY,aAAa,YAAY;AACrC,gBAAUD,aAAY,UAAU,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,IAC9D;AACA,mBAAe,IAAIC;AAAA,MACf,IAAI,iBAAiB;AAAA,QACjB,UAAU,YAAY;AAAA,QACtB,SAAS,YAAY,aAAa,aAAa,aAAa;AAAA,MAChE,CAAC;AAAA,IACL;AAAA,EACJ,OAAO;AAEH,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,yBAAyB;AAC5D,UAAM,WAAW,MAAM,QAAQ,iBAAiB,EAAE;AAClD,QAAI,CAAC,YAAY,2BAA2B,KAAK,QAAQ,GAAG;AACxD,YAAM,IAAI;AAAA,QACN,6FAA6F,KAAK;AAAA,MAEtG;AAAA,IACJ;AACA,cAAUD,aAAY,UAAU,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC1D,mBAAe,IAAIC;AAAA,MACf,IAAI,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,YAAY,EAAE,SAAS;AAAA,QACvB,kBAAkB;AAAA,MACtB,CAAC;AAAA,IACL;AAAA,EACJ;AAEA,QAAM,iBAAiB,MAAM,mBAAmB,cAAc;AAAA,IAC1D,KAAK;AAAA,IACL,gBAAgB;AAAA,EACpB,CAAC;AACD,MAAI,gBAAgB;AAChB,UAAM,aAAa,MAAM,QAAQ,gBAAgB,KAAK,IAAI,eAAe,MAAM,SAAS;AAExF,YAAQ;AAAA,MACJ,2CAA2C,YAAY,SAAS,OAAO,KAAK,cAAc,EAAE,KAAK,GAAG,CAAC,UAAU,UAAU;AAAA,IAC7H;AAAA,EACJ;AAEA,QAAM,UAAiB;AAAA,IACnB;AAAA,IACA,IAAI,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMf,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOP,eAAe,QAAQ,IAAI,aAAa;AAAA,MACxC;AAAA,MACA,gBAAgB,EAAE,MAAM,cAAc,MAAM,aAAa;AAAA,IAC7D,CAAC;AAAA,IACD,IAAI,eAAe,EAAE,cAAc,CAAC;AAAA,EACxC;AACA,MAAI,eAAgB,SAAQ,KAAK,IAAIC,WAAU,cAAc,CAAC;AAQ9D,QAAM,WACF,MAAM,QAAQ,gBAAgB,QAAQ,IAC/B,eAAe,SAAS,OAAO,CAAC,MAAe,OAAO,MAAM,QAAQ,IACrE;AACV,QAAM,UACF,MAAM,QAAQ,gBAAgB,OAAO,IAAI,eAAe,UAAU;AACtE,QAAM,WAA4B,gBAAgB;AAElD,SAAO;AAAA,IACH;AAAA,IACA,KAAK;AAAA,MACD,sBAAsB;AAAA,MACtB,mBAAmB;AAAA,IACvB;AAAA,IACA,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,IAC/B,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,EACnC;AACJ;;;ACtMA,SAAS,WAAWC,oBAAmB;AACvC,SAAS,kBAAkB;AAE3B;AA0BO,SAAS,2BACZ,cACA,MAAc,QAAQ,IAAI,GACR;AAClB,QAAM,YAAY,gBACX,QAAQ,IAAI,oBACZC,aAAY,KAAK,uBAAuB;AAE/C,MAAI,UAAU,SAAS,EAAG,QAAO;AACjC,MAAI,gBAAgB,QAAQ,IAAI,iBAAkB,QAAO;AACzD,SAAO,WAAW,SAAS,IAAI,YAAY;AAC/C;AAYA,eAAsB,wBAClB,UAAoC,CAAC,GACL;AAChC,QAAM,EAAE,kBAAkB,MAAM,GAAG,eAAe,IAAI;AAEtD,QAAM,mBAAmB,2BAA2B,eAAe,YAAY;AAC/E,MAAI,CAAC,oBAAoB,iBAAiB;AACtC,UAAM,IAAI;AAAA,MACN;AAAA,IAKJ;AAAA,EACJ;AAEA,SAAO,sBAAsB;AAAA,IACzB,GAAG;AAAA,IACH,cAAc;AAAA,EAClB,CAAC;AACL;;;AHjFA;AACA;AACA;;;AIlBA,SAAuB,QAAQ,qBAAqB;AACpD,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;;;AC2BjC,SAAS,WAAW,SAAc,MAAkC;AAClE,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,QAAQ,KAAK,YAAY;AAC/B,MAAI,OAAO,QAAQ,QAAQ,YAAY;AACrC,UAAM,IAAI,QAAQ,IAAI,IAAI,KAAK,QAAQ,IAAI,KAAK;AAChD,WAAO,KAAK,OAAO,SAAY,OAAO,CAAC;AAAA,EACzC;AACA,aAAW,OAAO,OAAO,KAAK,OAAO,GAAG;AACtC,QAAI,IAAI,YAAY,MAAM,OAAO;AAC/B,YAAM,IAAI,QAAQ,GAAG;AACrB,aAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,SAAY,OAAO,CAAC;AAAA,IACnE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,SAAkC;AACvD,QAAM,IAAI,WAAW,SAAS,WAAW;AACzC,MAAI,EAAG,QAAO,EAAE,KAAK;AACrB,QAAM,OAAO,WAAW,SAAS,eAAe;AAChD,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,IAAI,KAAK,MAAM,kBAAkB;AACvC,SAAO,IAAI,EAAE,CAAC,EAAE,KAAK,IAAI;AAC3B;AAOA,SAAS,UAAU,OAAiB;AAClC,MAAI,CAAC,MAAO,QAAO,IAAI,QAAQ;AAC/B,MAAI,OAAO,YAAY,eAAe,iBAAiB,QAAS,QAAO;AACvE,QAAM,IAAI,IAAI,QAAQ;AACtB,MAAI,OAAO,MAAM,YAAY,YAAY;AACvC,eAAW,CAAC,GAAG,CAAC,KAAK,MAAM,QAAQ,EAAG,GAAE,IAAI,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AAChE,WAAO;AAAA,EACT;AACA,aAAW,KAAK,OAAO,KAAK,KAAK,GAAG;AAClC,UAAM,IAAK,MAAc,CAAC;AAC1B,QAAI,KAAK,KAAM;AACf,MAAE,IAAI,OAAO,CAAC,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,eAAe,QAAQ,IAAS,QAAgB,OAAY,QAAQ,KAAqB;AACvF,MAAI,CAAC,MAAM,OAAO,GAAG,SAAS,WAAY,QAAO,CAAC;AAClD,MAAI;AACF,QAAI,OAAO,MAAM,GAAG,KAAK,QAAQ,EAAE,OAAO,OAAO,SAAS,EAAE,UAAU,KAAK,EAAE,CAAQ;AACrF,QAAI,QAAS,KAAa,MAAO,QAAQ,KAAa;AACtD,WAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;AAAA,EACvC,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAQA,eAAsB,wBAAwB,MAAiD;AAC7F,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,MAAwB;AAAA,IAC5B,OAAO,CAAC;AAAA,IACR,aAAa,CAAC;AAAA,IACd,UAAU;AAAA,EACZ;AAEA,MAAI;AACJ,MAAI;AAIJ,QAAM,SAAS,cAAc,OAAO;AACpC,MAAI,QAAQ;AACV,QAAI;AACF,YAAM,cAAmB,MAAM,KAAK,WAAW,MAAM;AAErD,YAAM,SAAS,aAAa,KAAK,gBAAgB,aAAa,KAAK,QAAQ;AAC3E,UAAI,OAAO,WAAW,YAAY;AAChC,cAAM,MAAM,MAAM,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,EAAE,CAAC;AAClD,cAAM,UAAU,KAAK,OAAO;AAC5B,YAAI,SAAS,OAAQ,UAAS,QAAQ;AACtC,YAAI,SAAS,eAAgB,YAAW,QAAQ;AAChD,YAAI,MAAM,QAAQ,SAAS,WAAW,GAAG;AACvC,cAAI,YAAa,KAAK,GAAG,QAAQ,WAAW;AAAA,QAC9C;AACA,YAAI,MAAM,QAAQ,SAAS,MAAM,GAAG;AAClC,cAAI,YAAa,KAAK,GAAG,QAAQ,MAAM;AAAA,QACzC;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAEA,QAAI,CAAC,QAAQ;AAGX,YAAMC,MAAK,MAAM,KAAK,MAAM;AAC5B,YAAM,OAAO,MAAM,QAAQA,KAAI,eAAe,EAAE,KAAK,QAAQ,QAAQ,KAAK,GAAG,CAAC;AAC9E,YAAM,MAAM,KAAK,CAAC;AAClB,UAAI,KAAK;AACP,iBAAS,IAAI,WAAW,IAAI;AAC5B,mBAAW,IAAI,mBAAmB,IAAI;AACtC,YAAI,MAAM,QAAQ,IAAI,MAAM,EAAG,KAAI,YAAa,KAAK,GAAG,IAAI,MAAM;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,QAAQ;AACX,QAAI;AACF,YAAM,cAAmB,MAAM,KAAK,WAAW,MAAM;AAIrD,YAAM,kBAAkB,UAAU,OAAO;AACzC,YAAM,cAAc,MAAM,aAAa,KAAK,aAAa,EAAE,SAAS,gBAAgB,CAAC;AACrF,eAAS,aAAa,MAAM,MAAM,aAAa,SAAS;AACxD,iBAAW,YAAY,aAAa,SAAS;AAC7C,UAAI,cAAc,aAAa,SAAS,SAAS,IAAI;AAAA,IACvD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,OAAQ,KAAI,SAAS;AACzB,MAAI,SAAU,KAAI,WAAW;AAE7B,MAAI,CAAC,OAAQ,QAAO;AAMpB,QAAM,KAAK,MAAM,KAAK,MAAM;AAC5B,MAAI,CAAC,GAAI,QAAO;AAEhB,QAAM,cAAmB,WACrB,EAAE,SAAS,QAAQ,iBAAiB,SAAS,IAC7C,EAAE,SAAS,OAAO;AACtB,QAAM,UAAU,MAAM,QAAQ,IAAI,cAAc,aAAa,EAAE;AAC/D,aAAW,KAAK,SAAS;AACvB,QAAI,EAAE,QAAQ,OAAO,EAAE,SAAS,UAAU;AAExC,iBAAW,KAAK,EAAE,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,GAAG;AAC9E,YAAI,CAAC,IAAI,MAAO,SAAS,CAAC,EAAG,KAAI,MAAO,KAAK,CAAC;AAAA,MAChD;AAAA,IACF;AAAA,EACF;AASA,MAAI,UAAU;AACZ,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA,EAAE,iBAAiB,SAAS;AAAA,MAC5B;AAAA,IACF;AACA,UAAM,aAAa,MAAM;AAAA,MACvB,IAAI;AAAA,QACF,WACG,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAChC,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC;AAAA,MACrE;AAAA,IACF;AAGA,QAAI,CAAC,WAAW,SAAS,MAAM,EAAG,YAAW,KAAK,MAAM;AACxD,IAAC,IAAY,eAAe;AAAA,EAC9B,OAAO;AAEL,IAAC,IAAY,eAAe,CAAC,MAAM;AAAA,EACrC;AAGA,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA,WACI,EAAE,SAAS,QAAQ,iBAAiB,SAAS,IAC7C,EAAE,SAAS,OAAO;AAAA,IACtB;AAAA,EACF;AACA,QAAM,QAAQ,IAAI;AAAA,IAChB,QAAQ,IAAI,CAAC,MAAM,EAAE,qBAAqB,EAAE,eAAe,EAAE,OAAO,OAAO;AAAA,EAC7E;AAGA,MAAI,IAAI,MAAO,SAAS,GAAG;AACzB,UAAM,WAAW,MAAM,QAAQ,IAAI,YAAY,EAAE,MAAM,EAAE,KAAK,IAAI,MAAM,EAAE,GAAG,GAAG;AAChF,UAAM,UAAU,SAAS,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,OAAO;AACxD,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA;AAAA,QACA,EAAE,SAAS,EAAE,KAAK,QAAQ,EAAE;AAAA,QAC5B;AAAA,MACF;AACA,iBAAW,KAAK,SAAS;AACvB,cAAM,KAAK,EAAE,qBAAqB,EAAE;AACpC,YAAI,GAAI,OAAM,IAAI,EAAE;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,MAAI,MAAM,OAAO,GAAG;AAGlB,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,KAAK,EAAE,EAAE;AAAA,MACjC;AAAA,IACF;AACA,eAAW,MAAM,QAAQ;AACvB,UAAI,GAAG,QAAQ,CAAC,IAAI,YAAa,SAAS,GAAG,IAAI,GAAG;AAClD,YAAI,YAAa,KAAK,GAAG,IAAI;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAwBO,SAAS,wBAAwB,GAAwC;AAC9E,MAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;AACxC,QAAM,OAAO;AACb,SACE,KAAK,SAAS,2BACd,KAAK,SAAS,uBACb,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,WAAW,0BAA0B;AAE3F;;;ADrRA,SAAS,aAAqB;AAC1B,MAAI,WAAW,UAAU,OAAO,WAAW,OAAO,eAAe,YAAY;AACzE,WAAO,WAAW,OAAO,WAAW;AAAA,EACxC;AACA,SAAO,uCAAuC,QAAQ,SAAS,OAAK;AAChE,UAAM,IAAK,KAAK,OAAO,IAAI,KAAM;AACjC,UAAM,IAAI,MAAM,MAAM,IAAK,IAAI,IAAO;AACtC,WAAO,EAAE,SAAS,EAAE;AAAA,EACxB,CAAC;AACL;AAuDO,IAAM,kBAAN,MAAM,gBAAe;AAAA,EA4BxB,YAAY,QAAsB,aAAmB,SAAiC;AAPtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAQ,kBAAuC,oBAAI,IAAI;AAQnD,SAAK,SAAS;AACd,SAAK,gBAAgB;AACrB,UAAM,iBAAiB,CAAC,SAAsB;AAC1C,UAAI;AAAE,eAAQ,OAAe,aAAa,IAAI;AAAA,MAAG,QAAQ;AAAE,eAAO;AAAA,MAAW;AAAA,IACjF;AACA,SAAK,cAAc,eAAe,eAAe,cAAc;AAC/D,SAAK,oBAAoB,SAAS,4BAA4B;AAC9D,SAAK,gBAAgB,SAAS,iBAAiB,eAAe,gBAAgB;AAC9E,SAAK,eAAe,SAAS,gBAAgB,eAAe,eAAe;AAAA,EAI/E;AAAA,EAEQ,wBAA+E;AACnF,QAAI,KAAK,eAAgB,QAAO,KAAK;AACrC,QAAI;AACA,YAAM,IAAK,KAAK,OAAe,aAAa,iBAAiB;AAC7D,UAAI,GAAG,eAAe;AAClB,aAAK,iBAAiB;AACtB,eAAO;AAAA,MACX;AAAA,IACJ,QAAQ;AAAA,IAER;AACA,WAAO;AAAA,EACX;AAAA,EAEQ,QAAQ,MAAW,MAAY;AACnC,WAAO;AAAA,MACH,QAAQ;AAAA,MACR,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK;AAAA,IACtC;AAAA,EACJ;AAAA,EAEQ,MAAM,SAAiB,OAAe,KAAK,SAAe;AAC9D,WAAO;AAAA,MACH,QAAQ;AAAA,MACR,MAAM,EAAE,SAAS,OAAO,OAAO,EAAE,SAAS,MAAM,QAAQ,EAAE;AAAA,IAC9D;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAc,OAAe;AACjC,WAAO;AAAA,MACH,QAAQ;AAAA,MACR,MAAM;AAAA,QACF,SAAS;AAAA,QACT,OAAO;AAAA,UACH,MAAM;AAAA,UACN,SAAS,oBAAoB,KAAK;AAAA,UAClC,MAAM;AAAA,UACN;AAAA,UACA,MAAM;AAAA,QACV;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,SACV,QACA,QACA,YACA,SACA,kBACY;AACZ,UAAM,WAAW,MAAM,KAAK,eAAe,YAAY,OAAO;AAC9D,UAAM,YAAY,cAAc,MAAM,KAAK,mBAAmB,OAAO;AACrE,UAAM,KAAK,aAAa,MAAM,KAAK,eAAe,YAAY,OAAO;AACrE,UAAM,SAAS,mBAAmB,EAAE,SAAS,iBAAiB,IAAI;AAClE,UAAM,WAAW,CAAC,UAAgB;AAC9B,YAAM,OAAO,SAAS,EAAE,GAAG,OAAO,IAAI,CAAC;AACvC,aAAO,QAAQ,EAAE,GAAG,MAAM,GAAG,MAAM,IAAK,SAAS,OAAO;AAAA,IAC5D;AAEA,QAAI,WAAW,UAAU;AACrB,UAAI,IAAI;AACJ,cAAM,MAAM,MAAM,GAAG,OAAO,OAAO,QAAQ,OAAO,MAAM,MAAM;AAC9D,cAAM,SAAS,EAAE,GAAG,OAAO,MAAM,GAAG,IAAI;AACxC,eAAO,EAAE,QAAQ,OAAO,QAAQ,IAAI,OAAO,IAAI,OAAO;AAAA,MAC1D;AACA,YAAM,EAAE,YAAY,KAAK,SAAS,6BAA6B;AAAA,IACnE;AAEA,QAAI,WAAW,OAAO;AAClB,UAAI,YAAY,OAAO,SAAS,YAAY,YAAY;AACpD,eAAO,MAAM,SAAS,QAAQ,EAAE,QAAQ,OAAO,QAAQ,IAAI,OAAO,IAAI,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,SAAS,iBAAiB,CAAC;AAAA,MACnJ;AACA,UAAI,IAAI;AACJ,YAAI,MAAM,MAAM,GAAG,KAAK,OAAO,QAAQ,SAAS,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,GAAG,OAAO,EAAE,CAAC,CAAC;AACvF,YAAI,OAAQ,IAAY,MAAO,OAAO,IAAY;AAClD,YAAI,CAAC,IAAK,OAAM,CAAC;AACjB,cAAM,QAAS,IAAc,KAAK,CAAC,MAAW,EAAE,OAAO,OAAO,EAAE;AAChE,eAAO,QAAQ,EAAE,QAAQ,OAAO,QAAQ,IAAI,OAAO,IAAI,QAAQ,MAAM,IAAI;AAAA,MAC7E;AACA,YAAM,EAAE,YAAY,KAAK,SAAS,6BAA6B;AAAA,IACnE;AAEA,QAAI,WAAW,UAAU;AACrB,UAAI,MAAM,OAAO,IAAI;AACjB,YAAI,MAAM,MAAM,GAAG,KAAK,OAAO,QAAQ,SAAS,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,GAAG,OAAO,EAAE,CAAC,CAAC;AACvF,YAAI,OAAQ,IAAY,MAAO,OAAO,IAAY;AAClD,YAAI,CAAC,IAAK,OAAM,CAAC;AACjB,cAAM,WAAY,IAAc,KAAK,CAAC,MAAW,EAAE,OAAO,OAAO,EAAE;AACnE,YAAI,CAAC,SAAU,OAAM,IAAI,MAAM,yBAAyB;AACxD,cAAM,GAAG,OAAO,OAAO,QAAQ,OAAO,MAAM,SAAS,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;AAClF,eAAO,EAAE,QAAQ,OAAO,QAAQ,IAAI,OAAO,IAAI,QAAQ,EAAE,GAAG,UAAU,GAAG,OAAO,KAAK,EAAE;AAAA,MAC3F;AACA,YAAM,EAAE,YAAY,KAAK,SAAS,6BAA6B;AAAA,IACnE;AAEA,QAAI,WAAW,UAAU;AACrB,UAAI,IAAI;AACJ,cAAM,GAAG,OAAO,OAAO,QAAQ,SAAS,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;AACrE,eAAO,EAAE,QAAQ,OAAO,QAAQ,IAAI,OAAO,IAAI,SAAS,KAAK;AAAA,MACjE;AACA,YAAM,EAAE,YAAY,KAAK,SAAS,6BAA6B;AAAA,IACnE;AAEA,QAAI,WAAW,WAAW,WAAW,QAAQ;AACzC,UAAI,YAAY,OAAO,SAAS,aAAa,YAAY;AAErD,cAAM,QAAQ,OAAO,UAAU,MAAM;AACjC,gBAAM,EAAE,QAAQ,GAAG,KAAK,IAAI;AAC5B,iBAAO;AAAA,QACX,GAAG;AACH,eAAO,MAAM,SAAS,SAAS,EAAE,QAAQ,OAAO,QAAQ,OAAO,SAAS,iBAAiB,CAAC;AAAA,MAC9F;AACA,UAAI,IAAI;AACJ,YAAI,MAAM,MAAM,GAAG,KAAK,OAAO,QAAQ,MAAM;AAC7C,YAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,OAAQ,IAAY,MAAO,OAAO,IAAY;AACzE,YAAI,CAAC,IAAK,OAAM,CAAC;AACjB,eAAO,EAAE,QAAQ,OAAO,QAAQ,SAAS,KAAK,OAAO,IAAI,OAAO;AAAA,MACpE;AACA,YAAM,EAAE,YAAY,KAAK,SAAS,6BAA6B;AAAA,IACnE;AAEA,QAAI,WAAW,SAAS;AAEpB,aAAO,EAAE,QAAQ,OAAO,QAAQ,SAAS,CAAC,EAAE;AAAA,IAChD;AAEA,UAAM,EAAE,YAAY,KAAK,SAAS,wBAAwB,MAAM,GAAG;AAAA,EACvE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYQ,6BAA6B,MAAkC;AACnE,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,IAAI,KAAK,MAAM,2BAA2B;AAChD,QAAI,CAAC,EAAG,QAAO;AACf,UAAM,YAAY,EAAE,CAAC;AAIrB,QAAI,KAAK,SAAS,sBAAsB,EAAG,QAAO;AAClD,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAc,0BAA0B,SAA8B,MAA6B;AAQ/F,UAAM,YAAY,CAAC,UAAU,WAAW,YAAY;AACpD,QAAI,UAAU,KAAK,OAAK,KAAK,WAAW,CAAC,CAAC,GAAG;AACzC;AAAA,IACJ;AAGA,QAAI,CAAC,KAAK,aAAa;AACnB;AAAA,IACJ;AAOA,UAAM,UAAU,QAAQ,SAAS;AACjC,UAAM,YAAY,CAAC,SAAqC;AACpD,UAAI,CAAC,QAAS,QAAO;AACrB,YAAM,IAAS;AACf,UAAI,OAAO,EAAE,QAAQ,YAAY;AAC7B,cAAM,IAAI,EAAE,IAAI,IAAI;AACpB,eAAO,KAAK,OAAO,SAAY,OAAO,CAAC;AAAA,MAC3C;AACA,YAAM,QAAQ,KAAK,YAAY;AAC/B,iBAAW,KAAK,OAAO,KAAK,CAAC,GAAG;AAC5B,YAAI,EAAE,YAAY,MAAM,OAAO;AAC3B,gBAAM,IAAI,EAAE,CAAC;AACb,iBAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAK,KAAK,OAAO,SAAY,OAAO,CAAC;AAAA,QACtE;AAAA,MACJ;AACA,aAAO;AAAA,IACX;AAEA,QAAI;AAEA,YAAM,mBAAmB,KAAK,6BAA6B,IAAI,KACxD,QAAQ,SAAS,QAAQ;AAChC,UAAI,kBAAkB;AAClB,cAAM,SAAS,MAAM,KAAK,YAAY,YAAY,gBAAgB;AAClE,YAAI,QAAQ;AACR,kBAAQ,gBAAgB;AACxB,kBAAQ,aAAa;AACrB;AAAA,QACJ;AAAA,MACJ;AAGA,YAAM,OAAO,UAAU,MAAM;AAC7B,UAAI,MAAM;AAEN,cAAM,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC;AAClC,cAAM,SAAS,MAAM,KAAK,YAAY,kBAAkB,QAAQ;AAChE,YAAI,QAAQ;AACR,kBAAQ,gBAAgB,OAAO;AAC/B,kBAAQ,aAAa,OAAO;AAC5B;AAAA,QACJ;AAAA,MACJ;AAGA,YAAM,cAAc,UAAU,kBAAkB;AAChD,UAAI,aAAa;AACb,cAAM,SAAS,MAAM,KAAK,YAAY,YAAY,WAAW;AAC7D,YAAI,QAAQ;AACR,kBAAQ,gBAAgB;AACxB,kBAAQ,aAAa;AACrB;AAAA,QACJ;AAAA,MACJ;AAGA,UAAI;AACA,cAAM,cAAmB,MAAM,KAAK,WAAW,gBAAgB,KAAK,IAAI;AACxE,cAAM,cAAc,MAAM,aAAa,KAAK,aAAa;AAAA,UACrD,SAAS,QAAQ,SAAS;AAAA,QAC9B,CAAC;AAED,cAAM,sBAAsB,aAAa,SAAS,uBAAuB,aAAa,SAAS;AAC/F,YAAI,qBAAqB;AACrB,gBAAM,SAAS,MAAM,KAAK,YAAY,YAAY,mBAAmB;AACrE,cAAI,QAAQ;AACR,oBAAQ,gBAAgB;AACxB,oBAAQ,aAAa;AACrB;AAAA,UACJ;AAAA,QACJ;AAGA,cAAM,uBAAuB,aAAa,SAAS;AACnD,YAAI,sBAAsB;AAEtB,gBAAM,YAAY,MAAM,KAAK,mBAAmB;AAChD,gBAAM,KAAK,aAAa,MAAM,KAAK,eAAe,UAAU;AAC5D,cAAI,IAAI;AACJ,gBAAI,OAAO,MAAM,GAAG,KAAK,mBAAmB;AAAA,cACxC,OAAO;AAAA,gBACH,iBAAiB;AAAA,gBACjB,YAAY;AAAA,cAChB;AAAA,cACA,OAAO;AAAA,YACX,CAAQ;AACR,gBAAI,QAAS,KAAa,MAAO,QAAQ,KAAa;AACtD,gBAAI,MAAM,QAAQ,IAAI,KAAK,KAAK,CAAC,GAAG;AAChC,oBAAM,aAAa,KAAK,CAAC;AACzB,oBAAM,SAAS,MAAM,KAAK,YAAY,YAAY,WAAW,EAAE;AAC/D,kBAAI,QAAQ;AACR,wBAAQ,gBAAgB,WAAW;AACnC,wBAAQ,aAAa;AACrB;AAAA,cACJ;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ,SAAS,cAAc;AAEnB,gBAAQ,MAAM,+CAA+C,YAAY;AAAA,MAC7E;AAMA,UAAI,KAAK,gBAAgB,iBAAiB,KAAK,sBAAsB,GAAG;AACpE,cAAM,MAAM,KAAK;AACjB,cAAM,SAAS,MAAM,KAAK,YAAY,YAAY,IAAI,aAAa;AACnE,YAAI,QAAQ;AACR,kBAAQ,gBAAgB,IAAI;AAC5B,kBAAQ,aAAa;AACrB;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ,SAAS,OAAO;AACZ,cAAQ,MAAM,mDAAmD,KAAK;AAAA,IAC1E;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAc,yBACV,SACA,MAC6C;AAC7C,QAAI,CAAC,KAAK,kBAAmB,QAAO;AAGpC,UAAM,YAAY,CAAC,SAAS,UAAU,WAAW,YAAY;AAC7D,QAAI,UAAU,KAAK,OAAK,KAAK,WAAW,CAAC,CAAC,EAAG,QAAO;AAEpD,UAAM,gBAAgB,QAAQ;AAC9B,QAAI,CAAC,cAAe,QAAO;AAG3B,QAAI,kBAAkB,gBAAe,sBAAuB,QAAO;AAInE,QAAI;AACJ,QAAI;AACJ,QAAI;AACA,YAAM,cAAmB,MAAM,KAAK,eAAe,gBAAgB,KAAK,IAAI;AAC5E,YAAM,cAAc,MAAM,aAAa,KAAK,aAAa;AAAA,QACrD,SAAS,QAAQ,SAAS;AAAA,MAC9B,CAAC;AACD,eAAS,aAAa,MAAM,MAAM,aAAa,SAAS;AACxD,6BAAuB,aAAa,SAAS;AAAA,IACjD,QAAQ;AAEJ,aAAO;AAAA,IACX;AAEA,QAAI,CAAC,OAAQ,QAAO;AAGpB,QAAI,yBAAyB,gBAAe,gBAAiB,QAAO;AAGpE,UAAM,WAAW,GAAG,aAAa,IAAI,MAAM;AAC3C,UAAM,SAAS,KAAK,gBAAgB,IAAI,QAAQ;AAChD,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,UAAU,MAAM,SAAS,gBAAe,yBAAyB;AACjE,aAAO;AAAA,IACX;AACA,QAAI,QAAQ;AACR,WAAK,gBAAgB,OAAO,QAAQ;AAAA,IACxC;AAGA,QAAI;AACA,YAAM,YAAY,MAAM,KAAK,mBAAmB;AAChD,YAAM,KAAK,aAAa,MAAM,KAAK,eAAe,UAAU;AAC5D,UAAI,CAAC,GAAI,QAAO;AAEhB,UAAI,OAAO,MAAM,GAAG,KAAK,0BAA0B;AAAA,QAC/C,OAAO,EAAE,gBAAgB,eAAe,SAAS,OAAO;AAAA,QACxD,OAAO;AAAA,MACX,CAAQ;AACR,UAAI,QAAS,KAAa,MAAO,QAAQ,KAAa;AACtD,YAAM,WAAW,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS;AAEtD,UAAI,UAAU;AACV,aAAK,gBAAgB,IAAI,UAAU,GAAG;AACtC,eAAO;AAAA,MACX;AAEA,aAAO,KAAK;AAAA,QACR,mBAAmB,MAAM,+BAA+B,aAAa;AAAA,QACrE;AAAA,QACA,EAAE,eAAe,QAAQ,MAAM,8BAA8B;AAAA,MACjE;AAAA,IACJ,SAAS,KAAK;AAGV,cAAQ,MAAM,6CAA6C,GAAG;AAC9D,aAAO;AAAA,IACX;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,iBAAiB,QAAgB;AAGnC,UAAM;AAAA,MACF;AAAA,MAAS;AAAA,MAAY;AAAA,MAAW;AAAA,MAAa;AAAA,MAC7C;AAAA,MAAc;AAAA,MAAa;AAAA,MAAO;AAAA,MAAiB;AAAA,MACnD;AAAA,MAAO;AAAA,MAAe;AAAA,MAAU;AAAA,MAAU;AAAA,IAC9C,IAAI,MAAM,QAAQ,IAAI;AAAA,MAClB,KAAK,eAAe,gBAAgB,KAAK,IAAI;AAAA,MAC7C,KAAK,eAAe,gBAAgB,KAAK,OAAO;AAAA,MAChD,KAAK,eAAe,gBAAgB,KAAK,MAAM;AAAA,MAC/C,KAAK,eAAe,gBAAgB,KAAK,QAAQ;AAAA,MACjD,KAAK,eAAe,gBAAgB,KAAK,cAAc,CAAC;AAAA,MACxD,KAAK,eAAe,gBAAgB,KAAK,SAAS;AAAA,MAClD,KAAK,eAAe,gBAAgB,KAAK,QAAQ;AAAA,MACjD,KAAK,eAAe,gBAAgB,KAAK,EAAE;AAAA,MAC3C,KAAK,eAAe,gBAAgB,KAAK,YAAY;AAAA,MACrD,KAAK,eAAe,gBAAgB,KAAK,IAAI;AAAA,MAC7C,KAAK,eAAe,gBAAgB,KAAK,EAAE;AAAA,MAC3C,KAAK,eAAe,gBAAgB,KAAK,UAAU;AAAA,MACnD,KAAK,eAAe,gBAAgB,KAAK,KAAK;AAAA,MAC9C,KAAK,eAAe,gBAAgB,KAAK,KAAK;AAAA,MAC9C,KAAK,eAAe,gBAAgB,KAAK,GAAG;AAAA,IAChD,CAAC;AAED,UAAM,UAAkB,CAAC,CAAC;AAC1B,UAAM,aAAkB,CAAC,EAAE,cAAc,KAAK,OAAO;AACrD,UAAM,YAAkB,CAAC,CAAC;AAC1B,UAAM,gBAAkB,CAAC,CAAC;AAC1B,UAAM,WAAkB,CAAC,CAAC;AAC1B,UAAM,eAAkB,CAAC,CAAC;AAC1B,UAAM,cAAkB,CAAC,CAAC;AAC1B,UAAM,QAAkB,CAAC,CAAC;AAC1B,UAAM,kBAAkB,CAAC,CAAC;AAC1B,UAAM,UAAkB,CAAC,CAAC;AAC1B,UAAM,QAAkB,CAAC,CAAC;AAC1B,UAAM,gBAAkB,CAAC,CAAC;AAC1B,UAAM,WAAkB,CAAC,CAAC;AAC1B,UAAM,WAAkB,CAAC,CAAC;AAC1B,UAAM,SAAkB,CAAC,CAAC;AAG1B,UAAM,SAAS;AAAA,MACP,MAAe,GAAG,MAAM;AAAA,MACxB,UAAe,GAAG,MAAM;AAAA,MACxB,UAAe,GAAG,MAAM;AAAA,MACxB,MAAe,UAAU,GAAG,MAAM,UAAU;AAAA,MAC5C,IAAe,QAAQ,GAAG,MAAM,QAAQ;AAAA,MACxC,SAAe,aAAa,GAAG,MAAM,aAAa;AAAA,MAClD,SAAe,WAAW,GAAG,MAAM,aAAa;AAAA,MAChD,WAAe,eAAe,GAAG,MAAM,eAAe;AAAA,MACtD,YAAe,gBAAgB,GAAG,MAAM,gBAAgB;AAAA,MACxD,UAAe,cAAc,GAAG,MAAM,cAAc;AAAA,MACpD,UAAe,gBAAgB,GAAG,MAAM,cAAc;AAAA,MACtD,eAAe,kBAAkB,GAAG,MAAM,mBAAmB;AAAA,MAC7D,IAAe,QAAQ,GAAG,MAAM,QAAQ;AAAA,MACxC,MAAe,UAAU,GAAG,MAAM,UAAU;AAAA,IACpD;AAMA,UAAM,eAAe,CAAC,OAAgB,cAAuB;AAAA,MACzD,SAAS;AAAA,MAAM,QAAQ;AAAA,MAAsB,cAAc;AAAA,MAAM;AAAA,MAAO;AAAA,IAC5E;AACA,UAAM,iBAAiB,CAAC,UAAkB;AAAA,MACtC,SAAS;AAAA,MAAO,QAAQ;AAAA,MAAwB,cAAc;AAAA,MAC9D,SAAS,aAAa,IAAI;AAAA,IAC9B;AAGA,QAAI,SAAS,EAAE,SAAS,MAAM,WAAW,CAAC,IAAI,GAAG,UAAU,MAAM;AACjE,QAAI,WAAW,SAAS;AACpB,YAAM,gBAAgB,OAAO,QAAQ,qBAAqB,aACpD,QAAQ,iBAAiB,IAAI;AACnC,YAAM,UAAU,OAAO,QAAQ,eAAe,aACxC,QAAQ,WAAW,IAAI,CAAC;AAC9B,eAAS;AAAA,QACL,SAAS;AAAA,QACT,WAAW,QAAQ,SAAS,IAAI,UAAU,CAAC,aAAa;AAAA,QACxD,UAAU;AAAA,MACd;AAAA,IACJ;AAEA,WAAO;AAAA,MACH,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa,OAAO,YAAY,aAAa;AAAA,MAC7C;AAAA,MACA,WAAW;AAAA;AAAA,MACX,UAAU;AAAA,QACN,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,OAAO;AAAA,QACP,WAAW;AAAA,QACX,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,eAAe;AAAA,QACf,MAAM;AAAA,MACV;AAAA,MACA,UAAU;AAAA;AAAA,QAEN,UAAgB,EAAE,SAAS,MAAM,QAAQ,YAAqB,cAAc,MAAM,OAAO,OAAO,UAAU,UAAU,UAAU,SAAS,6CAA6C;AAAA,QACpL,MAAgB,aAAa,OAAO,MAAM,QAAQ;AAAA;AAAA,QAElD,MAAgB,UAAU,aAAa,OAAO,IAAI,IAAI,eAAe,MAAM;AAAA,QAC3E,YAAgB,gBAAgB,aAAa,OAAO,UAAU,IAAI,eAAe,YAAY;AAAA,QAC7F,WAAgB,eAAe,aAAa,OAAO,SAAS,IAAI,eAAe,WAAW;AAAA,QAC1F,OAAgB,WAAW,aAAa,IAAI,eAAe,OAAO;AAAA,QAClE,OAAgB,WAAW,aAAa,IAAI,eAAe,OAAO;AAAA,QAClE,KAAgB,SAAS,aAAa,IAAI,eAAe,KAAK;AAAA,QAC9D,IAAgB,QAAQ,aAAa,OAAO,EAAE,IAAI,eAAe,IAAI;AAAA,QACrE,UAAgB,cAAc,aAAa,OAAO,QAAQ,IAAI,eAAe,UAAU;AAAA,QACvF,UAAgB,gBAAgB,aAAa,OAAO,QAAQ,IAAI,eAAe,UAAU;AAAA,QACzF,cAAgB,kBAAkB,aAAa,OAAO,aAAa,IAAI,eAAe,cAAc;AAAA,QACpG,IAAgB,QAAQ,aAAa,OAAO,EAAE,IAAI,eAAe,IAAI;AAAA,QACrE,MAAgB,UAAU,aAAa,OAAO,IAAI,IAAI,eAAe,MAAM;AAAA,QAC3E,SAAgB,aAAa,aAAa,OAAO,OAAO,IAAI,eAAe,SAAS;AAAA,QACpF,gBAAgB,WAAW,aAAa,OAAO,OAAO,IAAI,eAAe,cAAc;AAAA,QACvF,QAAgB,YAAY,aAAa,IAAI,eAAe,QAAQ;AAAA,MACxE;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,MAA0C,SAA8B;AACxF,QAAI,CAAC,QAAQ,CAAC,KAAK,OAAO;AACrB,YAAM,EAAE,YAAY,KAAK,SAAS,gCAAgC;AAAA,IACvE;AAEA,QAAI,OAAO,KAAK,OAAO,YAAY,YAAY;AAC3C,YAAM,EAAE,YAAY,KAAK,SAAS,gCAAgC;AAAA,IACtE;AAEA,WAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,KAAK,WAAW;AAAA,MACnD,SAAS,QAAQ;AAAA,IACrB,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,MAAc,QAAgB,MAAW,SAA6D;AAEnH,UAAM,cAAc,MAAM,KAAK,WAAW,gBAAgB,KAAK,IAAI;AACnE,QAAI,eAAe,OAAO,YAAY,YAAY,YAAY;AAC1D,YAAM,WAAW,MAAM,YAAY,QAAQ,QAAQ,SAAS,QAAQ,QAAQ;AAC5E,aAAO,EAAE,SAAS,MAAM,QAAQ,SAAS;AAAA,IAC7C;AAGA,UAAM,iBAAiB,KAAK,QAAQ,QAAQ,EAAE;AAC9C,WAAO,KAAK,iBAAiB,gBAAgB,QAAQ,IAAI;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,iBAAiB,MAAc,QAAgB,MAAiC;AACpF,UAAM,IAAI,OAAO,YAAY;AAC7B,UAAM,yBAAyB;AAG/B,SAAK,SAAS,mBAAmB,SAAS,eAAe,MAAM,QAAQ;AACnE,YAAM,KAAK,QAAQ,WAAW,CAAC;AAC/B,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU;AAAA,UACN,QAAQ;AAAA,UACR,MAAM;AAAA,YACF,MAAM,EAAE,IAAI,MAAM,MAAM,QAAQ,aAAa,OAAO,MAAM,SAAS,mBAAmB,eAAe,OAAO,YAAW,oBAAI,KAAK,GAAE,YAAY,GAAG,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,YACrL,SAAS,EAAE,IAAI,WAAW,EAAE,IAAI,QAAQ,IAAI,OAAO,cAAc,EAAE,IAAI,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,sBAAsB,EAAE,YAAY,EAAE;AAAA,UAClJ;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ;AAGA,SAAK,SAAS,mBAAmB,SAAS,YAAY,MAAM,QAAQ;AAChE,YAAM,KAAK,QAAQ,WAAW,CAAC;AAC/B,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU;AAAA,UACN,QAAQ;AAAA,UACR,MAAM;AAAA,YACF,MAAM,EAAE,IAAI,MAAM,aAAa,OAAO,MAAM,SAAS,mBAAmB,eAAe,MAAM,YAAW,oBAAI,KAAK,GAAE,YAAY,GAAG,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,YACtK,SAAS,EAAE,IAAI,WAAW,EAAE,IAAI,QAAQ,IAAI,OAAO,cAAc,EAAE,IAAI,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,sBAAsB,EAAE,YAAY,EAAE;AAAA,UAClJ;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ;AAGA,QAAI,SAAS,iBAAiB,MAAM,OAAO;AACvC,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU,EAAE,QAAQ,KAAK,MAAM,EAAE,SAAS,MAAM,MAAM,KAAK,EAAE;AAAA,MACjE;AAAA,IACJ;AAGA,QAAI,SAAS,cAAc,MAAM,QAAQ;AACrC,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU,EAAE,QAAQ,KAAK,MAAM,EAAE,SAAS,KAAK,EAAE;AAAA,MACrD;AAAA,IACJ;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAe,MAAc,UAA+B,QAAiB,MAAY,OAA4C;AACvI,UAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAGhE,QAAI,MAAM,CAAC,MAAM,SAAS;AAEtB,YAAM,kBAAkB,MAAM,KAAK,eAAe,YAAY,SAAS,aAAa;AAEpF,UAAI,mBAAmB,OAAQ,gBAAwB,uBAAuB,YAAY;AACtF,YAAI;AACA,gBAAM,QAAQ,MAAO,gBAAwB,mBAAmB;AAChE,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,MAAM,CAAC,EAAE;AAAA,QAC9D,SAAS,GAAQ;AAEb,kBAAQ,KAAK,iEAAiE,EAAE,OAAO;AAAA,QAC3F;AAAA,MACJ;AAEA,YAAM,WAAW,MAAM,KAAK,eAAe,UAAU;AACrD,UAAI,YAAY,OAAO,SAAS,iBAAiB,YAAY;AACzD,cAAM,SAAS,MAAM,SAAS,aAAa,CAAC,CAAC;AAC7C,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AAEA,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,OAAO,CAAC,UAAU,OAAO,QAAQ,EAAE,CAAC,EAAE;AAAA,IAC3F;AAIA,QAAI,MAAM,UAAU,KAAK,MAAM,MAAM,SAAS,CAAC,MAAM,gBAAgB,CAAC,UAAU,WAAW,QAAQ;AAC/F,YAAM,OAAO,MAAM,CAAC;AACpB,YAAM,OAAO,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG;AACxC,YAAM,kBAAkB,MAAM,KAAK,WAAW,gBAAgB,KAAK,QAAQ;AAC3E,UAAI,mBAAmB,OAAQ,gBAAwB,iBAAiB,YAAY;AAChF,cAAM,OAAO,MAAO,gBAAwB,aAAa,MAAM,IAAI;AACnE,YAAI,SAAS,OAAW,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,aAAa,GAAG,EAAE;AACvF,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,MACzD;AAEA,YAAM,UAAU,MAAM,KAAK,eAAe,YAAY,SAAS,aAAa;AAC5E,UAAI,WAAW,OAAQ,QAAgB,iBAAiB,YAAY;AAChE,YAAI;AACA,gBAAM,eAAe,MAAO,QAAgB,aAAa,MAAM,IAAI;AACnE,cAAI,iBAAiB,OAAW,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,YAAY,EAAE;AAAA,QACjG,QAAQ;AAAA,QAAqB;AAAA,MACjC;AACA,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,aAAa,GAAG,EAAE;AAAA,IACnE;AAOA,QAAI,MAAM,UAAU,GAAG;AACnB,YAAM,OAAO,MAAM,CAAC;AACpB,YAAM,OAAO,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG;AAEpC,YAAM,YAAY,OAAO,WAAW;AAGpC,UAAI,WAAW,SAAS,MAAM;AAE1B,cAAM,WAAW,MAAM,KAAK,eAAe,UAAU;AAErD,YAAI,YAAY,OAAO,SAAS,iBAAiB,YAAY;AACzD,cAAI;AACA,kBAAM,iBAAiB,MAAM,KAAK,4BAA4B,QAAQ;AACtE,kBAAM,SAAS,MAAM,SAAS,aAAa,EAAE,MAAM,MAAM,MAAM,MAAM,eAAe,CAAC;AACrF,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,UAC3D,SAAS,GAAQ;AACb,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,EAAE,SAAS,GAAG,EAAE;AAAA,UACjE;AAAA,QACJ;AAGA,cAAM,UAAU,MAAM,KAAK,eAAe,YAAY,SAAS,aAAa;AAC5E,YAAI,WAAW,OAAQ,QAAgB,aAAa,YAAY;AAC5D,cAAI;AACA,kBAAM,OAAO,MAAO,QAAgB,SAAS,MAAM,MAAM,IAAI;AAC7D,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,UACzD,SAAS,GAAQ;AACb,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,EAAE,WAAW,sBAAsB,GAAG,EAAE;AAAA,UACzF;AAAA,QACJ;AACA,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,sBAAsB,GAAG,EAAE;AAAA,MAC5E;AAEA,UAAI;AAEA,YAAI,SAAS,aAAa,SAAS,UAAU;AAQzC,gBAAMC,YAAW,MAAM,KAAK,eAAe,UAAU;AACrD,gBAAM,YAAY,OAAOA,WAAU,iBAAiB,aAC9CA,UAAS,aAAa,IACtBA,WAAU;AAChB,gBAAM,SAAS,cAAc;AAE7B,cAAI,UAAU,OAAOA,UAAS,gBAAgB,YAAY;AACtD,gBAAI;AACA,oBAAM,iBAAiB,MAAM,KAAK,4BAA4B,QAAQ;AACtE,oBAAM,OAAO,MAAMA,UAAS,YAAY,EAAE,MAAM,UAAU,MAAM,eAAe,CAAC;AAGhF,kBAAI,SAAS,KAAK,QAAQ,OAAO;AAC7B,uBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,cACzD;AAAA,YACJ,QAAQ;AAAA,YAAuC;AAAA,UACnD;AAEA,gBAAM,YAAY,MAAM,KAAK,mBAAmB;AAChD,cAAI,WAAW,UAAU;AACrB,kBAAM,OAAO,UAAU,SAAS,UAAU,IAAI;AAC9C,gBAAI,KAAM,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,UACnE;AAKA,cAAI,CAAC,UAAUA,aAAY,OAAOA,UAAS,gBAAgB,YAAY;AACnE,gBAAI;AACA,oBAAM,iBAAiB,MAAM,KAAK,4BAA4B,QAAQ;AACtE,oBAAM,OAAO,MAAMA,UAAS,YAAY,EAAE,MAAM,UAAU,MAAM,eAAe,CAAC;AAChF,kBAAI,SAAS,KAAK,QAAQ,OAAO;AAC7B,uBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,cACzD;AAAA,YACJ,QAAQ;AAAA,YAA4B;AAAA,UACxC;AACA,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,aAAa,GAAG,EAAE;AAAA,QACnE;AAGA,cAAM,eAAe,iBAAiB,IAAI;AAG1C,cAAM,WAAW,MAAM,KAAK,eAAe,UAAU;AACrD,YAAI,YAAY,OAAO,SAAS,gBAAgB,YAAY;AACvD,cAAI;AACD,kBAAM,iBAAiB,MAAM,KAAK,4BAA4B,QAAQ;AACtE,kBAAM,OAAO,MAAM,SAAS,YAAY,EAAE,MAAM,cAAc,MAAM,WAAW,eAAe,CAAC;AAC/F,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,UACxD,SAAS,GAAQ;AAAA,UAEjB;AAAA,QACL;AAGA,cAAM,UAAU,MAAM,KAAK,eAAe,YAAY,SAAS,aAAa;AAC5E,YAAI,WAAW,OAAQ,QAAgB,YAAY,YAAY;AAC3D,cAAI;AACA,kBAAM,OAAO,MAAO,QAAgB,QAAQ,cAAc,IAAI;AAC9D,gBAAI,KAAM,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,UACnE,QAAQ;AAAA,UAAkB;AAAA,QAC9B;AACA,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,aAAa,GAAG,EAAE;AAAA,MACnE,SAAS,GAAQ;AAGb,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,EAAE,SAAS,GAAG,EAAE;AAAA,MACjE;AAAA,IACJ;AAGA,QAAI,MAAM,WAAW,GAAG;AACpB,YAAM,aAAa,MAAM,CAAC;AAE1B,YAAM,YAAY,OAAO,WAAW;AAGpC,YAAM,WAAW,MAAM,KAAK,eAAe,UAAU;AACrD,UAAI,YAAY,OAAO,SAAS,iBAAiB,YAAY;AACzD,YAAI;AACA,gBAAM,iBAAiB,MAAM,KAAK,4BAA4B,QAAQ;AACtE,gBAAM,OAAO,MAAM,SAAS,aAAa,EAAE,MAAM,YAAY,WAAW,eAAe,CAAC;AAExF,cAAI,SAAS,KAAK,UAAU,UAAa,MAAM,QAAQ,IAAI,IAAI;AAC3D,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,UACzD;AAAA,QACJ,QAAQ;AAAA,QAER;AAAA,MACJ;AAGA,YAAM,kBAAkB,MAAM,KAAK,WAAW,gBAAgB,KAAK,QAAQ;AAC3E,UAAI,mBAAmB,OAAQ,gBAAwB,SAAS,YAAY;AACxE,YAAI;AACA,cAAI,QAAQ,MAAO,gBAAwB,KAAK,UAAU;AAG1D,cAAI,aAAa,SAAS,MAAM,SAAS,GAAG;AACxC,oBAAQ,MAAM,OAAO,CAAC,SAAc,MAAM,eAAe,SAAS;AAAA,UACtE;AACA,cAAI,SAAS,MAAM,SAAS,GAAG;AAC3B,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,MAAM,YAAY,MAAM,CAAC,EAAE;AAAA,UAChF;AAAA,QACJ,SAAS,GAAQ;AAGb,gBAAM,gBAAgB,OAAO,UAAU,EAAE,QAAQ,aAAa,EAAE;AAChE,kBAAQ,MAAM,4DAA4D,eAAe,UAAU,EAAE,OAAO;AAAA,QAChH;AAAA,MACJ;AAGA,YAAM,YAAY,MAAM,KAAK,mBAAmB;AAChD,UAAI,WAAW,UAAU;AACrB,YAAI,eAAe,WAAW;AAC1B,gBAAM,OAAO,UAAU,SAAS,cAAc,SAAS;AACvD,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAAA,QACpF;AAEA,cAAM,QAAQ,UAAU,SAAS,YAAY,YAAY,SAAS;AAClE,YAAI,SAAS,MAAM,SAAS,GAAG;AAC3B,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,MAAM,YAAY,MAAM,CAAC,EAAE;AAAA,QAChF;AAEA,cAAM,MAAM,UAAU,SAAS,UAAU,UAAU;AACnD,YAAI,IAAK,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,GAAG,EAAE;AAAA,MACjE;AACA,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,aAAa,GAAG,EAAE;AAAA,IACnE;AAGA,QAAI,MAAM,WAAW,GAAG;AAEpB,YAAM,kBAAkB,MAAM,KAAK,eAAe,YAAY,SAAS,aAAa;AACpF,UAAI,mBAAmB,OAAQ,gBAAwB,uBAAuB,YAAY;AACtF,YAAI;AACA,gBAAM,QAAQ,MAAO,gBAAwB,mBAAmB;AAChE,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,MAAM,CAAC,EAAE;AAAA,QAC9D,QAAQ;AAAA,QAAqB;AAAA,MACjC;AAEA,YAAM,WAAW,MAAM,KAAK,eAAe,UAAU;AACrD,UAAI,YAAY,OAAO,SAAS,iBAAiB,YAAY;AACzD,cAAM,SAAS,MAAM,SAAS,aAAa,CAAC,CAAC;AAC7C,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AACA,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,OAAO,CAAC,UAAU,OAAO,QAAQ,EAAE,CAAC,EAAE;AAAA,IAC3F;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,MAAc,QAAgB,MAAW,OAAY,UAA8D;AAChI,UAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG;AAChD,UAAM,aAAa,MAAM,CAAC;AAE1B,QAAI,CAAC,YAAY;AACb,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,wBAAwB,GAAG,EAAE;AAAA,IAC9E;AAGA,QAAI,CAAC,SAAS,cAAc,KAAK,aAAa;AAC1C,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU,KAAK,MAAM,sGAAsG,GAAG;AAAA,MAClI;AAAA,IACJ;AAEA,UAAM,IAAI,OAAO,YAAY;AAG7B,QAAI,MAAM,SAAS,GAAG;AAClB,YAAM,SAAS,MAAM,CAAC;AAGtB,UAAI,WAAW,WAAW,MAAM,QAAQ;AAEpC,cAAM,SAAS,MAAM,KAAK,SAAS,SAAS,EAAE,QAAQ,YAAY,GAAG,KAAK,GAAG,SAAS,YAAY,SAAS,eAAe,SAAS,gBAAgB;AACnJ,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,OAAO;AACnC,cAAM,KAAK,MAAM,CAAC;AAGlB,cAAM,EAAE,QAAQ,OAAO,IAAI,SAAS,CAAC;AACrC,cAAM,gBAAyC,CAAC;AAChD,YAAI,UAAU,KAAM,eAAc,SAAS;AAC3C,YAAI,UAAU,KAAM,eAAc,SAAS;AAE3C,cAAM,SAAS,MAAM,KAAK,SAAS,OAAO,EAAE,QAAQ,YAAY,IAAI,GAAG,cAAc,GAAG,SAAS,YAAY,SAAS,eAAe,SAAS,gBAAgB;AAC9J,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,SAAS;AACrC,cAAM,KAAK,MAAM,CAAC;AAElB,cAAM,SAAS,MAAM,KAAK,SAAS,UAAU,EAAE,QAAQ,YAAY,IAAI,MAAM,KAAK,GAAG,SAAS,YAAY,SAAS,eAAe,SAAS,gBAAgB;AAC3J,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,UAAU;AACtC,cAAM,KAAK,MAAM,CAAC;AAElB,cAAM,SAAS,MAAM,KAAK,SAAS,UAAU,EAAE,QAAQ,YAAY,GAAG,GAAG,SAAS,YAAY,SAAS,eAAe,SAAS,gBAAgB;AAC/I,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AAAA,IACJ,OAAO;AAEH,UAAI,MAAM,OAAO;AASb,cAAM,aAAsC,EAAE,GAAG,MAAM;AAOvD,YAAI,WAAW,UAAU,QAAQ,WAAW,WAAW,MAAM;AACzD,qBAAW,QAAQ,WAAW,SAAS,WAAW,UAAU,WAAW;AACvE,iBAAO,WAAW;AAClB,iBAAO,WAAW;AAAA,QACtB;AAEA,YAAI,WAAW,UAAU,QAAQ,WAAW,UAAU,MAAM;AACxD,qBAAW,SAAS,WAAW;AAC/B,iBAAO,WAAW;AAAA,QACtB;AAEA,YAAI,WAAW,QAAQ,QAAQ,WAAW,WAAW,MAAM;AACvD,qBAAW,UAAU,WAAW;AAChC,iBAAO,WAAW;AAAA,QACtB;AAEA,YAAI,WAAW,OAAO,QAAQ,WAAW,SAAS,MAAM;AACpD,qBAAW,QAAQ,WAAW;AAC9B,iBAAO,WAAW;AAAA,QACtB;AAEA,YAAI,WAAW,QAAQ,QAAQ,WAAW,UAAU,MAAM;AACtD,qBAAW,SAAS,WAAW;AAC/B,iBAAO,WAAW;AAAA,QACtB;AAGA,cAAM,SAAS,MAAM,KAAK,SAAS,SAAS,EAAE,QAAQ,YAAY,OAAO,WAAW,GAAG,SAAS,YAAY,SAAS,eAAe,SAAS,gBAAgB;AAC7J,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AAGA,UAAI,MAAM,QAAQ;AAEd,cAAM,SAAS,MAAM,KAAK,SAAS,UAAU,EAAE,QAAQ,YAAY,MAAM,KAAK,GAAG,SAAS,YAAY,SAAS,eAAe,SAAS,gBAAgB;AACvJ,cAAM,MAAM,KAAK,QAAQ,MAAM;AAC/B,YAAI,SAAS;AACb,eAAO,EAAE,SAAS,MAAM,UAAU,IAAI;AAAA,MAC1C;AAAA,IACJ;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,MAAc,QAAgB,MAAW,UAA8D;AACzH,UAAM,mBAAmB,MAAM,KAAK,WAAW,gBAAgB,KAAK,SAAS;AAC7E,QAAI,CAAC,iBAAkB,QAAO,EAAE,SAAS,MAAM;AAE/C,UAAM,IAAI,OAAO,YAAY;AAC7B,UAAM,UAAU,KAAK,QAAQ,QAAQ,EAAE;AAGvC,QAAI,YAAY,WAAW,MAAM,QAAQ;AACrC,YAAM,SAAS,MAAM,iBAAiB,MAAM,IAAI;AAChD,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,IAC3D;AAGA,QAAI,YAAY,UAAU,MAAM,OAAO;AACnC,YAAM,SAAS,MAAM,iBAAiB,QAAQ;AAC7C,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,IAC5D;AAGA,QAAI,YAAY,SAAS,MAAM,QAAQ;AAElC,YAAM,SAAS,MAAM,iBAAiB,YAAY,IAAI;AACtD,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,IAC5D;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,WAAW,MAAc,QAAgB,OAAY,UAA8D;AACrH,UAAM,cAAc,MAAM,KAAK,WAAW,gBAAgB,KAAK,IAAI;AACnE,QAAI,CAAC,YAAa,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,8BAA8B,GAAG,EAAE;AAElG,UAAM,IAAI,OAAO,YAAY;AAC7B,UAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAEhE,QAAI,MAAM,MAAO,QAAO,EAAE,SAAS,MAAM;AAGzC,QAAI,MAAM,CAAC,MAAM,aAAa,MAAM,WAAW,GAAG;AAC9C,YAAM,UAAU,YAAY,WAAW;AACvC,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,QAAQ,CAAC,EAAE;AAAA,IAChE;AAGA,QAAI,MAAM,CAAC,MAAM,gBAAgB;AAC7B,YAAM,SAAS,MAAM,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI,OAAO;AAChE,UAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,4BAA4B,GAAG,EAAE;AAE3F,UAAI,eAAe,YAAY,gBAAgB,MAAM;AAIrD,UAAI,OAAO,KAAK,YAAY,EAAE,WAAW,GAAG;AACxC,cAAM,mBAAmB,OAAO,YAAY,eAAe,aACrD,YAAY,WAAW,IAAI,CAAC;AAClC,cAAM,WAAW,cAAc,QAAQ,gBAAgB;AACvD,YAAI,YAAY,aAAa,QAAQ;AACjC,yBAAe,YAAY,gBAAgB,QAAQ;AACnD,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,QAAQ,UAAU,iBAAiB,QAAQ,aAAa,CAAC,EAAE;AAAA,QAChH;AAAA,MACJ;AAEA,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,QAAQ,aAAa,CAAC,EAAE;AAAA,IAC7E;AAGA,QAAI,MAAM,CAAC,MAAM,YAAY,MAAM,UAAU,GAAG;AAC5C,YAAM,aAAa,mBAAmB,MAAM,CAAC,CAAC;AAC9C,UAAI,SAAS,MAAM,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI,OAAO;AAC9D,UAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,4BAA4B,GAAG,EAAE;AAG3F,YAAM,mBAAmB,OAAO,YAAY,eAAe,aACrD,YAAY,WAAW,IAAI,CAAC;AAClC,YAAM,WAAW,cAAc,QAAQ,gBAAgB;AACvD,UAAI,SAAU,UAAS;AAEvB,UAAI,OAAO,YAAY,mBAAmB,YAAY;AAClD,cAAMC,UAAS,YAAY,eAAe,YAAY,MAAM;AAC5D,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,QAAQ,YAAY,QAAQ,QAAAA,QAAO,CAAC,EAAE;AAAA,MAC3F;AAEA,YAAM,eAAe,YAAY,gBAAgB,MAAM;AACvD,YAAM,SAAS,KAAK,UAAU;AAC9B,YAAM,SAAiC,CAAC;AACxC,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,YAAY,GAAG;AACrD,YAAI,IAAI,WAAW,MAAM,GAAG;AACxB,iBAAO,IAAI,UAAU,OAAO,MAAM,CAAC,IAAI;AAAA,QAC3C;AAAA,MACJ;AACA,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,QAAQ,YAAY,QAAQ,OAAO,CAAC,EAAE;AAAA,IAC3F;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,eAAe,MAAc,QAAgB,MAAW,OAAY,UAA8D;AACpI,UAAM,IAAI,OAAO,YAAY;AAC7B,UAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAGhE,UAAM,YAAY,MAAM,KAAK,mBAAmB;AAChD,UAAM,WAAW,WAAW;AAG5B,QAAI,CAAC,UAAU;AACX,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,iCAAiC,GAAG,EAAE;AAAA,IACvF;AAEA,QAAI;AAEA,UAAI,MAAM,WAAW,KAAK,MAAM,OAAO;AACnC,YAAI,WAAW,SAAS,eAAe;AAEvC,YAAI,OAAO,QAAQ;AACf,qBAAW,SAAS,OAAO,CAAC,MAAW,EAAE,WAAW,MAAM,MAAM;AAAA,QACpE;AACA,YAAI,OAAO,MAAM;AACb,qBAAW,SAAS,OAAO,CAAC,MAAW,EAAE,UAAU,SAAS,MAAM,IAAI;AAAA,QAC1E;AACA,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,UAAU,OAAO,SAAS,OAAO,CAAC,EAAE;AAAA,MACzF;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,QAAQ;AACpC,cAAM,MAAM,SAAS,eAAe,KAAK,YAAY,MAAM,KAAK,QAAQ;AACxE,cAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,YAAI,SAAS;AACb,eAAO,EAAE,SAAS,MAAM,UAAU,IAAI;AAAA,MAC1C;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,YAAY,MAAM,SAAS;AAC9D,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,MAAM,SAAS,cAAc,EAAE;AACrC,YAAI,CAAC,IAAK,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AACzF,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,GAAG,EAAE;AAAA,MACxD;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,aAAa,MAAM,SAAS;AAC/D,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,MAAM,SAAS,eAAe,EAAE;AACtC,YAAI,CAAC,IAAK,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AACzF,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,GAAG,EAAE;AAAA,MACxD;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,aAAa,MAAM,QAAQ;AAC9D,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,kBAAkB,MAAM,KAAK,WAAW,gBAAgB,KAAK,QAAQ;AAC3E,YAAI,mBAAmB,OAAQ,gBAAwB,mBAAmB,YAAY;AAClF,gBAAM,SAAS,MAAO,gBAAwB,eAAe,IAAI,QAAQ,CAAC,CAAC;AAC3E,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,QAC3D;AACA,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,kCAAkC,GAAG,EAAE;AAAA,MACxF;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,YAAY,MAAM,QAAQ;AAC7D,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,kBAAkB,MAAM,KAAK,WAAW,gBAAgB,KAAK,QAAQ;AAC3E,YAAI,mBAAmB,OAAQ,gBAAwB,kBAAkB,YAAY;AACjF,gBAAO,gBAAwB,cAAc,EAAE;AAC/C,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,KAAK,CAAC,EAAE;AAAA,QACtE;AACA,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,kCAAkC,GAAG,EAAE;AAAA,MACxF;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,OAAO;AACnC,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,MAAM,SAAS,WAAW,EAAE;AAClC,YAAI,CAAC,IAAK,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AACzF,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,GAAG,EAAE;AAAA,MACxD;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,UAAU;AACtC,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,UAAU,SAAS,iBAAiB,EAAE;AAC5C,YAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAC7F,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,KAAK,CAAC,EAAE;AAAA,MACtE;AAAA,IACJ,SAAS,GAAQ;AACb,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,EAAE,SAAS,EAAE,cAAc,GAAG,EAAE;AAAA,IACjF;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4CA,MAAc,4BAA4B,SAA2D;AACjG,QAAI;AACA,YAAM,cAAmB,MAAM,KAAK,eAAe,gBAAgB,KAAK,IAAI;AAC5E,YAAM,aAAa,QAAQ,SAAS;AACpC,UAAI,UAAe;AACnB,UAAI,cAAc,OAAO,eAAe,YAAY,OAAQ,WAAmB,QAAQ,YAAY;AAC/F,YAAI;AACA,gBAAM,IAAI,IAAI,QAAQ;AACtB,qBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,UAAiC,GAAG;AACpE,gBAAI,KAAK,KAAM;AACf,cAAE,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC;AAAA,UACxD;AACA,oBAAU;AAAA,QACd,QAAQ;AACJ,oBAAU;AAAA,QACd;AAAA,MACJ;AACA,YAAM,SAAS,aAAa,MAAM,OAAO,aAAa;AACtD,YAAM,cAAc,MAAM,QAAQ,YAAY,KAAK,QAAQ,EAAE,QAAQ,CAAC;AACtE,YAAM,MAAM,aAAa,SAAS;AAClC,aAAO,OAAO,QAAQ,YAAY,IAAI,SAAS,IAAI,MAAM;AAAA,IAC7D,QAAQ;AACJ,aAAO;AAAA,IACX;AAAA,EACJ;AAAA,EAEA,MAAc,oBAAoB,SAA2D;AACzF,QAAI;AACA,YAAM,cAAmB,MAAM,KAAK,eAAe,gBAAgB,KAAK,IAAI;AAC5E,YAAM,aAAa,QAAQ,SAAS;AAKpC,UAAI,UAAe;AACnB,UAAI,cAAc,OAAO,eAAe,YAAY,OAAQ,WAAmB,QAAQ,YAAY;AAC/F,YAAI;AACA,gBAAM,IAAI,IAAI,QAAQ;AACtB,qBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,UAAiC,GAAG;AACpE,gBAAI,KAAK,KAAM;AACf,cAAE,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC;AAAA,UACxD;AACA,oBAAU;AAAA,QACd,QAAQ;AACJ,oBAAU;AAAA,QACd;AAAA,MACJ;AACA,YAAM,cAAc,OAAO,aAAa,MAAM,KAAK,cAAc,aAAa,KAAK,aAAa;AAAA,QAC5F,aAAa,MAAM,OAAO,aAAa;AAAA,QACvC,EAAE,QAAQ;AAAA,MACd;AACA,aAAO,aAAa,MAAM,MAAM,aAAa,SAAS;AAAA,IAC1D,SAAS,GAAQ;AACb,aAAO;AAAA,IACX;AAAA,EACJ;AAAA,EAEA,MAAM,YAAY,MAAc,QAAgB,MAAW,OAAY,UAA8D;AACjI,UAAM,IAAI,OAAO,YAAY;AAC7B,UAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAEhE,UAAM,YAAY,MAAM,KAAK,mBAAmB;AAChD,UAAM,KAAK,aAAa,MAAM,KAAK,eAAe,UAAU;AAC5D,QAAI,CAAC,IAAI;AACL,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,oDAAoD,GAAG,EAAE;AAAA,IAC1G;AAEA,UAAM,MAAM;AACZ,UAAM,OAAO;AACb,UAAM,MAAM;AACZ,UAAM,cAAc;AACpB,UAAM,MAAM;AACZ,UAAM,cAAc;AAOpB,UAAM,mBAAmB,OACrB,YACA,YACA,WACA,aACkB;AAClB,YAAM,WAAW,MAAM,GAAG,QAAQ,KAAK,EAAE,OAAO,EAAE,aAAa,WAAW,EAAE,CAAQ;AACpF,UAAI,UAAU,GAAI,QAAO,SAAS;AAClC,YAAM,KAAK,WAAW;AACtB,YAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,YAAM,GAAG,OAAO,KAAK;AAAA,QACjB;AAAA,QACA,aAAa;AAAA,QACb,cAAc;AAAA,QACd,cAAc,UAAU,QAAQ;AAAA,QAChC,aAAa,UAAU,eAAe;AAAA,QACtC,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACX;AAOA,UAAM,0BAA0B,OAC5B,WACA,SACA,WACA,aACkB;AAClB,YAAM,WAAW,MAAM,GAAG,QAAQ,aAAa;AAAA,QAC3C,OAAO,EAAE,YAAY,WAAW,QAAQ;AAAA,MAC5C,CAAQ;AACR,UAAI,UAAU,GAAI,QAAO,SAAS;AAClC,YAAM,KAAK,WAAW;AACtB,YAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,YAAM,GAAG,OAAO,aAAa;AAAA,QACzB;AAAA,QACA,YAAY;AAAA,QACZ;AAAA,QACA,QAAQ;AAAA,QACR,eAAe,WAAW,KAAK,UAAU,QAAQ,IAAI;AAAA,QACrD,gBAAgB;AAAA,QAChB,cAAc;AAAA,QACd,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACX;AAOA,UAAM,0BAA0B,OAC5B,OACA,eACsB;AACtB,YAAM,SAAS,MAAM,GAAG,QAAQ,KAAK,EAAE,OAAO,EAAE,aAAa,WAAW,EAAE,CAAQ;AAClF,UAAI,CAAC,QAAQ,GAAI,QAAO;AACxB,aAAO,MAAM,GAAG,QAAQ,aAAa;AAAA,QACjC,OAAO,EAAE,gBAAgB,OAAO,YAAY,OAAO,GAAG;AAAA,MAC1D,CAAQ;AAAA,IACZ;AAMA,UAAM,cAAc,CAAC,aAA6B;AAC9C,YAAM,SAAS;AACf,aAAO,SAAS,WAAW,MAAM,IAAI,SAAS,MAAM,OAAO,MAAM,IAAI;AAAA,IACzE;AACA,UAAM,wBAAwB,MAAiD;AAC3E,YAAM,WAAW,KAAK,eAAe;AAQrC,YAAM,WAAgB,SAAS,+BAA+B;AAC9D,UAAI,YAAY,OAAO,SAAS,SAAS,YAAY;AACjD,YAAI;AACA,gBAAM,WAAW,SAAS,KAAK;AAC/B,gBAAM,OAAO,oBAAI,IAAY;AAC7B,gBAAMC,WAAqD,CAAC;AAC5D,qBAAW,WAAW,YAAY,CAAC,GAAG;AAClC,kBAAM,OAAO,SAAS;AACtB,gBAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,EAAG;AAC7B,iBAAK,IAAI,IAAI;AACb,YAAAA,SAAQ,KAAK,EAAE,MAAM,UAAU,0BAA0B,IAAI,GAAG,CAAC;AAAA,UACrE;AACA,cAAIA,SAAQ,SAAS,EAAG,QAAOA;AAAA,QACnC,QAAQ;AAAA,QAER;AAAA,MACJ;AACA,YAAM,UAAqD,CAAC;AAC5D,iBAAW,CAAC,YAAY,GAAG,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACtD,YAAI,CAAC,WAAW,WAAW,SAAS,EAAG;AACvC,cAAM,MAAM,WAAW,MAAM,UAAU,MAAM;AAC7C,YAAI,CAAC,OAAO,QAAQ,UAAW;AAC/B,cAAM,WAAY,KAAa,QAAQ;AACvC,gBAAQ,KAAK,EAAE,MAAM,YAAY,QAAQ,GAAG,SAAS,CAAC;AAAA,MAC1D;AACA,aAAO;AAAA,IACX;AAEA,UAAM,gBAAgB,CAAC,cAAkF;AACrG,YAAM,aAAa,sBAAsB;AACzC,UAAI,WAAW;AACX,cAAM,SAAS,OAAO,SAAS,EAAE,YAAY;AAC7C,eAAO,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,aAAa,MAAM;AAAA,MAC5E;AAEA,aACI,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,OAAO,KACzC,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ,KAC1C,WAAW,CAAC;AAAA,IAEpB;AAEA,UAAM,mBAAmB,CAAC,YAAoB,kBAAkC;AAC5E,YAAM,SAAS,OAAO,aAAa;AACnC,cAAQ,YAAY;AAAA,QAChB,KAAK;AACD,iBAAO,YAAY,MAAM;AAAA,QAC7B,KAAK;AACD,iBAAO,YAAY,MAAM;AAAA,QAC7B;AAEI,iBAAO,GAAG,UAAU,MAAM,MAAM;AAAA,MACxC;AAAA,IACJ;AAaA,UAAM,iBAAiB,OACnB,eAac;AACd,UAAI;AACA,cAAM,WAAgB,MAAM,KAAK,eAAe,+BAA+B;AAM/E,cAAM,UAAkC,EAAE,KAAK,SAAS;AACxD,cAAM,YAAY,QAAQ,UAAU,KAAK;AACzC,eAAO,UAAU,MAAM,SAAS,KAAK,UAAU,MAAM,UAAU;AAAA,MACnE,QAAQ;AACJ,eAAO;AAAA,MACX;AAAA,IACJ;AAEA,UAAM,UAAU,OAAO,KAAa,UAA6D;AAC7F,UAAI,OAAO,MAAM,GAAG,KAAK,KAAK,EAAE,MAAM,CAAQ;AAC9C,UAAI,QAAS,KAAa,MAAO,QAAQ,KAAa;AACtD,UAAI,CAAC,MAAM,QAAQ,IAAI,EAAG,QAAO;AACjC,aAAO,KAAK,CAAC;AAAA,IACjB;AAKA,UAAM,kBAAkB,CAAC,QAAkB;AACvC,UAAI,CAAC,IAAK,QAAO;AACjB,UAAI,WAAgB,IAAI;AACxB,UAAI,OAAO,aAAa,UAAU;AAC9B,YAAI;AAAE,qBAAW,KAAK,MAAM,QAAQ;AAAA,QAAG,QAAQ;AAAA,QAAoC;AAAA,MACvF;AACA,aAAO,EAAE,GAAG,KAAK,SAAS;AAAA,IAC9B;AAEA,QAAI;AAEA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,aAAa,MAAM,OAAO;AAC7D,cAAM,UAAU,sBAAsB;AACtC,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,OAAO,QAAQ,OAAO,CAAC,EAAE;AAAA,MACvF;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,eAAe,MAAM,OAAO;AAC/D,YAAI;AACA,gBAAM,SAAc,MAAM,KAAK,eAAe,iBAAiB;AAC/D,gBAAM,YAAY,QAAQ,gBAAgB,KAAK,CAAC;AAChD,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,WAAW,OAAO,UAAU,OAAO,CAAC,EAAE;AAAA,QAC3F,SAAS,KAAU;AAIf,cAAI;AAEA,oBAAQ,MAAM,yEAAyE,KAAK,WAAW,GAAG;AAAA,UAC9G,QAAQ;AAAA,UAAa;AACrB,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,WAAW,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE;AAAA,QAChF;AAAA,MACJ;AAYA,UAAI,MAAM,WAAW,KACd,MAAM,CAAC,MAAM,WACb,MAAM,CAAC,MAAM,kBACb,MAAM,CAAC,MAAM,cACb,MAAM,QAAQ;AACjB,cAAM,cAAc,QAAQ,IAAI,kBAAkB,QAAQ,IAAI,eAAe,IAAI,KAAK;AACtF,YAAI,CAAC,YAAY;AACb,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,gDAAgD,GAAG,EAAE;AAAA,QACtG;AACA,cAAM,aAAa,UAAU,SAAS;AACtC,YAAI;AACJ,YAAI,cAAc,OAAQ,WAAmB,QAAQ,YAAY;AAC7D,uBAAc,WAAmB,IAAI,eAAe,KAAK;AAAA,QAC7D,WAAW,cAAc,OAAO,eAAe,UAAU;AACrD,uBAAc,WAAmB,eAAe,KAAM,WAAmB,eAAe;AAAA,QAC5F;AACA,cAAM,YAAY,OAAO,eAAe,YAAY,WAAW,WAAW,SAAS,IAC7E,WAAW,MAAM,CAAC,EAAE,KAAK,IACzB;AACN,YAAI,CAAC,aAAa,cAAc,YAAY;AACxC,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,qDAAqD,GAAG,EAAE;AAAA,QAC3G;AACA,YAAI;AACA,gBAAM,EAAE,4BAAAC,4BAA2B,IAAI,MAAM;AAC7C,gBAAM,SAAS,MAAMA,4BAA2B;AAAA,YAC5C;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACZ,CAAC;AAGD,cAAI,SAAgB,CAAC;AACrB,cAAI,QAAQ;AACZ,cAAI;AACA,kBAAM,OAAO,MAAO,GAAW,KAAK,yBAAyB,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAC1G,kBAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,MAAM,QAAQ,MAAM,OAAO,IAAI,KAAK,UAAU,CAAC;AACzF,qBAAS;AACT,oBAAQ,OAAQ,MAAc,UAAU,WAAY,KAAa,QAAQ,KAAK;AAAA,UAClF,SAAS,GAAQ;AACb,qBAAS,CAAC,EAAE,UAAU,GAAG,WAAW,OAAO,CAAC,EAAE,CAAC;AAAA,UACnD;AACA,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,GAAG,QAAQ,OAAO,OAAO,CAAC,EAAE;AAAA,QACjF,SAAS,KAAU;AACf,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,oBAAoB,KAAK,WAAW,OAAO,GAAG,CAAC,IAAI,GAAG,EAAE;AAAA,QACzG;AAAA,MACJ;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,OAAO;AAC9D,cAAM,QAAiC,CAAC;AACxC,YAAI,OAAO,eAAgB,OAAM,kBAAkB,MAAM;AACzD,YAAI,OAAO,OAAQ,OAAM,SAAS,MAAM;AACxC,YAAI,OAAO,MAAM,GAAG,KAAK,KAAK,OAAO,KAAK,KAAK,EAAE,SAAU,EAAE,MAAM,IAAY,MAAS;AACxF,YAAI,QAAS,KAAa,MAAO,QAAQ,KAAa;AACtD,cAAM,YAAY,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,eAAe;AACtE,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,UAAU,OAAO,SAAS,OAAO,CAAC,EAAE;AAAA,MACzF;AAEA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,QAAQ;AAC/D,cAAM,MAAM,QAAQ,CAAC;AAOrB,YAAI,IAAI,oBAAoB,iBAAiB,IAAI,eAAe,eAAe;AAC3E,cAAI;AACA,kBAAM,SAAS,MAAM,KAAK,oBAAoB,QAAQ;AACtD,gBAAI,IAAI,eAAe,eAAe;AAClC,kBAAI,aAAa,UAAU;AAAA,YAC/B;AACA,gBAAI,IAAI,oBAAoB,eAAe;AAGvC,oBAAM,cAAmB,MAAM,KAAK,eAAe,gBAAgB,KAAK,IAAI;AAC5E,oBAAM,aAAa,UAAU,SAAS;AACtC,kBAAI,UAAe;AACnB,kBAAI,cAAc,OAAO,eAAe,YAAY,OAAQ,WAAmB,QAAQ,YAAY;AAC/F,sBAAM,IAAI,IAAI,QAAQ;AACtB,2BAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,UAAiC,GAAG;AACpE,sBAAI,KAAK,KAAM;AACf,oBAAE,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC;AAAA,gBACxD;AACA,0BAAU;AAAA,cACd;AACA,oBAAM,SAAS,aAAa,MAAM,OAAO,aAAa;AACtD,oBAAM,cAAc,MAAM,QAAQ,YAAY,KAAK,QAAQ,EAAE,QAAQ,CAAC;AACtE,kBAAI,kBAAkB,aAAa,SAAS,wBAAwB;AAAA,YACxE;AAAA,UACJ,QAAQ;AAAA,UAER;AAAA,QACJ;AACA,YAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,cAAc;AAC3C,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,iDAAiD,GAAG,EAAE;AAAA,QACvG;AACA,cAAM,gBAAgB,WAAW;AACjC,cAAM,eAAe,WAAW;AAChC,cAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AAKtC,cAAM,WAAW,cAAc,IAAI,MAAM;AACzC,YAAI,CAAC,UAAU;AACX,gBAAM,YAAY,sBAAsB,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAC3D,cAAI,IAAI,QAAQ;AACZ,mBAAO;AAAA,cACH,SAAS;AAAA,cACT,UAAU,KAAK;AAAA,gBACX,mBAAmB,IAAI,MAAM,0BAA0B,UAAU,KAAK,IAAI,KAAK,MAAM;AAAA,gBACrF;AAAA,cACJ;AAAA,YACJ;AAAA,UACJ;AACA,iBAAO;AAAA,YACH,SAAS;AAAA,YACT,UAAU,KAAK;AAAA,cACX;AAAA,cACA;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ;AACA,cAAM,SAAS,SAAS;AACxB,YAAI,kBAAkB,cAAc,aAAa;AAMjD,YAAI,mBAAmB,IAAI;AAC3B,YAAI,CAAC,kBAAkB;AACnB,gBAAM,UAAU,cAAc,MAAM,GAAG,CAAC;AACxC,cAAI;AACA,kBAAM,SAAS,MAAM,QAAQ,oBAAoB,EAAE,IAAI,IAAI,gBAAgB,CAAC;AAC5E,kBAAM,UAAU,QAAQ,QAAQ,IAAI;AACpC,kBAAM,aAAa,OAAO,gBAAgB,KAAK,OAAO,eAAe,iBAAiB;AACtF,+BAAmB,GAAG,OAAO,IAAI,OAAO,IAAI,UAAU;AAAA,UAC1D,QAAQ;AAEJ,+BAAmB,GAAG,IAAI,eAAe,IAAI,OAAO;AAAA,UACxD;AAAA,QACJ;AAUA,YAAI;AACA,gBAAM,WAAW,MAAM,QAAQ,mBAAmB;AAAA,YAC9C,UAAU;AAAA,UACd,CAAC;AACD,cAAI,YAAY,SAAS,OAAO,eAAe;AAC3C,mBAAO;AAAA,cACH,SAAS;AAAA,cACT,UAAU,KAAK;AAAA,gBACX,aAAa,gBAAgB;AAAA,gBAC7B;AAAA,gBACA,EAAE,MAAM,kBAAkB,UAAU,iBAAiB;AAAA,cACzD;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ,QAAQ;AAAA,QAGR;AAOA,cAAM,eAAwC,EAAE,GAAI,IAAI,YAAY,CAAC,EAAG;AAIxE,cAAM,kBAAkB,QAAS,aAAqB,iBAAiB;AACvE,cAAM,kBAAkB,OAAQ,aAAqB,qBAAqB,IAAI;AAQ9E,YAAI;AAKA,cAAI,cACA,IAAI,cAAc,IAAI,eAAe,WAC/B,OAAO,IAAI,UAAU,IACrB;AACV,cAAI,CAAC,aAAa;AACd,0BAAc,MAAM,KAAK,oBAAoB,QAAQ;AAAA,UACzD;AACA,cAAI,aAAa;AACb,kBAAM,UAAU,MAAM,GAAG,KAAK,YAAY,EAAE,OAAO,EAAE,IAAI,YAAY,EAAE,CAAQ;AAC/E,kBAAM,WAAW,MAAM,QAAQ,OAAO,IAAI,UAAW,SAAS,SAAS,CAAC;AACxE,kBAAM,IAAI,MAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS,IAAI,SAAS,CAAC,IAAI;AACzE,gBAAI,GAAG,OAAO;AACV,cAAC,aAAqB,YAAY;AAAA,gBAC9B,QAAQ,OAAO,WAAW;AAAA,gBAC1B,OAAO,OAAO,EAAE,KAAK;AAAA,gBACrB,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,IAAI;AAAA,gBAChC,OAAO,EAAE,QAAQ,OAAO,EAAE,KAAK,IAAI;AAAA,cACvC;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ,QAAQ;AAAA,QAGR;AAWA,YAAI;AACA,gBAAM,SAAS,MAAM,GAAG,KAAK,oBAAoB,EAAE,OAAO,EAAE,IAAI,IAAI,gBAAgB,EAAE,CAAQ;AAC9F,gBAAM,UAAU,MAAM,QAAQ,MAAM,IAAI,SAAU,QAAQ,SAAS,CAAC;AACpE,gBAAM,MAAM,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,IAAI,QAAQ,CAAC,IAAI;AACxE,cAAI,KAAK,MAAM,KAAK,MAAM;AACtB,YAAC,aAAqB,UAAU;AAAA,cAC5B,IAAI,OAAO,IAAI,EAAE;AAAA,cACjB,MAAM,OAAO,IAAI,IAAI;AAAA,cACrB,MAAM,IAAI,OAAO,OAAO,IAAI,IAAI,IAAI;AAAA,cACpC,MAAM,IAAI,OAAO,OAAO,IAAI,IAAI,IAAI;AAAA,YACxC;AAAA,UACJ;AAAA,QACJ,QAAQ;AAAA,QAIR;AACA,cAAM,GAAG,OAAO,KAAK;AAAA,UACjB,IAAI;AAAA,UACJ,iBAAiB,IAAI;AAAA,UACrB,cAAc,IAAI;AAAA,UAClB,YAAY,IAAI,cAAc;AAAA,UAC9B,WAAW,IAAI,aAAa;AAAA,UAC5B,MAAM,IAAI,QAAQ;AAAA,UAClB,QAAQ;AAAA,UACR,YAAY,IAAI,cAAc;AAAA,UAC9B,UAAU,KAAK,UAAU,YAAY;AAAA,UACrC,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,iBAAiB;AAAA,UACjB,kBAAkB,IAAI,oBAAoB;AAAA,UAC1C,gBAAgB;AAAA,UAChB,UAAU;AAAA,UACV,aAAa,MAAM;AACf,kBAAM,MAAM,OAAO,IAAI,cAAc,SAAS;AAC9C,mBAAO,QAAQ,aAAa,YAAY;AAAA,UAC5C,GAAG;AAAA,QACP,CAAC;AAQD,YAAI;AACA,gBAAM,EAAE,uBAAAC,uBAAsB,IAAI,MAAM;AACxC,gBAAM,cAAc,QAAQ,IAAI,kBAAkB,QAAQ,IAAI,eAAe,IAAI,KAAK;AACtF,cAAI,YAAY;AACZ,kBAAMA,uBAAsB;AAAA,cACxB;AAAA,cACA;AAAA,cACA,UAAU;AAAA,cACV;AAAA,cACA,QAAQ;AAAA,YACZ,CAAC;AAAA,UACL;AAAA,QACJ,SAAS,QAAQ;AACb,kBAAQ,OAAO,0DAA0D;AAAA,YACrE;AAAA,YACA,OAAQ,QAAkB;AAAA,UAC9B,CAAC;AAAA,QACL;AAKA,cAAM,kBAAkB,YAA2B;AAC/C,cAAI;AACA,gBAAI,kBAAkB,GAAG;AACrB,oBAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAAA,YAC3D;AACA,gBAAI,iBAAiB;AACjB,oBAAM,IAAI,MAAM,kEAAkE;AAAA,YACtF;AAIA,gBAAI;AACJ,gBAAI;AACA,oBAAM,UAAU,MAAM,eAAe,MAAM;AAC3C,kBAAI,SAAS;AACT,sBAAM,SAAS,MAAM,QAAQ,eAAe;AAAA,kBACxC;AAAA,kBACA,cAAc,KAAK,cAAc,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,kBAC/D,QAAQ;AAAA,kBACR,gBAAgB,IAAI,oBAAoB;AAAA,gBAC5C,CAAC;AACD,8BAAc,OAAO;AACrB,oBAAI,OAAO,gBAAiB,mBAAkB,OAAO;AAAA,cACzD,OAAO;AACH,8BAAc,iBAAiB,QAAQ,aAAa;AAAA,cACxD;AAAA,YACJ,SAAS,YAAY;AAIjB,oBAAM,sBAAsB,QACtB,aACA,IAAI,MAAM,OAAO,UAAU,CAAC;AAAA,YACtC;AAOA,kBAAM,iBAAgB,oBAAI,KAAK,GAAE,YAAY;AAC7C,kBAAM,GAAG;AAAA,cACL;AAAA,cACA;AAAA,gBACI,cAAc;AAAA,gBACd,YAAY;AAAA,cAChB;AAAA,cACA,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE;AAAA,YACnC;AACA,kBAAM,GAAG,OAAO,MAAM;AAAA,cAClB,IAAI;AAAA,cACJ,gBAAgB;AAAA,cAChB,mBAAmB;AAAA,cACnB,mBAAmB;AAAA,cACnB,eAAe;AAAA,cACf,QAAQ;AAAA,cACR,YAAY;AAAA,cACZ,YAAY;AAAA,YAChB,CAAC;AAKD,kBAAM,aAAa,IAAI,eAAe;AACtC,gBAAI,eAAe,SAAS;AACxB,kBAAI;AACA,sBAAM,SAAc,MAAM,KAAK,eAAe,iBAAiB;AAC/D,oBAAI,QAAQ;AACR,wBAAM,OAAO,KAAK,EAAE,eAAe,WAAW,CAAC;AAAA,gBACnD;AAAA,cACJ,SAAS,SAAS;AACd,sBAAM,cAAc,mBAAmB,QAAQ,QAAQ,UAAU,OAAO,OAAO;AAE/E,oBAAI;AACA,wBAAM,WAAW,MAAM,QAAQ,KAAK,EAAE,IAAI,cAAc,CAAC;AACzD,wBAAM,eAAe,OAAO,UAAU,aAAa,WAC7C,KAAK,MAAM,SAAS,QAAQ,IAC3B,UAAU,YAAY,CAAC;AAC9B,wBAAM,GAAG;AAAA,oBACL;AAAA,oBACA;AAAA,sBACI,UAAU,KAAK,UAAU;AAAA,wBACrB,GAAG;AAAA,wBACH,mBAAmB,EAAE,SAAS,aAAa,WAAW;AAAA,sBAC1D,CAAC;AAAA,oBACL;AAAA,oBACA,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE;AAAA,kBACnC;AAAA,gBACJ,QAAQ;AAAA,gBAER;AAAA,cACJ;AAAA,YACJ;AAaA,kBAAM,kBAAmB,aAAqB;AAC9C,gBAAI,OAAO,oBAAoB,YAAY,gBAAgB,SAAS,GAAG;AACnE,kBAAI;AACA,sBAAMC,QAAO,MAAM,OAAO,MAAW;AACrC,sBAAM,EAAE,WAAAC,YAAW,oBAAAC,oBAAmB,IAAI,MAAM;AAChD,sBAAM,OAAO,QAAQ,IAAI,4BAClB,QAAQ,IAAI;AACnB,sBAAMC,YAAWF,WAAU,eAAe,IACpC,kBACCD,MAAK,WAAW,eAAe,IAC5B,kBACAA,MAAK,QAAQ,MAAM,eAAe;AAC5C,sBAAM,SAAS,MAAME,oBAAmBC,WAAU,EAAE,KAAK,kBAAkB,CAAC;AAC5E,oBAAI,CAAC,QAAQ;AACT,wBAAM,IAAI,MAAM,sCAAsCA,SAAQ,GAAG;AAAA,gBACrE;AACA,sBAAM,SAAc,MAAM,KAAK,eAAe,iBAAiB;AAC/D,oBAAI,QAAQ,YAAY;AACpB,wBAAM,OAAO,WAAW,EAAE,eAAe,OAAO,CAAC;AAAA,gBACrD,OAAO;AACH,wBAAM,IAAI,MAAM,2CAA2C;AAAA,gBAC/D;AAAA,cACJ,SAAS,SAAS;AACd,sBAAM,cAAc,mBAAmB,QAAQ,QAAQ,UAAU,OAAO,OAAO;AAC/E,oBAAI;AACA,wBAAM,WAAW,MAAM,QAAQ,KAAK,EAAE,IAAI,cAAc,CAAC;AACzD,wBAAM,eAAe,OAAO,UAAU,aAAa,WAC7C,KAAK,MAAM,SAAS,QAAQ,IAC3B,UAAU,YAAY,CAAC;AAC9B,wBAAM,GAAG;AAAA,oBACL;AAAA,oBACA;AAAA,sBACI,UAAU,KAAK,UAAU;AAAA,wBACrB,GAAG;AAAA,wBACH,mBAAmB,EAAE,SAAS,aAAa,cAAc,gBAAgB;AAAA,sBAC7E,CAAC;AAAA,oBACL;AAAA,oBACA,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE;AAAA,kBACnC;AAAA,gBACJ,QAAQ;AAAA,gBAER;AAAA,cACJ;AAAA,YACJ;AAMA,kBAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC1C,kBAAM,GAAG;AAAA,cACL;AAAA,cACA;AAAA,gBACI,QAAQ;AAAA,gBACR,gBAAgB;AAAA,gBAChB,YAAY;AAAA,cAChB;AAAA,cACA,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE;AAAA,YACnC;AAAA,UACJ,SAAS,KAAK;AACV,kBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,kBAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,kBAAM,GAAG;AAAA,cACL;AAAA,cACA;AAAA,gBACI,QAAQ;AAAA,gBACR,UAAU,KAAK,UAAU;AAAA,kBACrB,GAAG;AAAA,kBACH,mBAAmB,EAAE,SAAS,SAAS;AAAA,gBAC3C,CAAC;AAAA,gBACD,YAAY;AAAA,cAChB;AAAA,cACA,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE;AAAA,YACnC;AAAA,UACJ;AAAA,QACJ;AASA,cAAM,mBAAmB,QAAQ,IAAI;AACrC,cAAM,eAAe,CAAC,EAClB,QAAQ,IAAI,UACT,QAAQ,IAAI,4BACZ,QAAQ,IAAI,WACZ,QAAQ,IAAI;AAEnB,cAAM,mBAAmB,qBAAqB,SACxC,eACA,qBAAqB,OAAO,qBAAqB;AACvD,YAAI,kBAAkB;AAClB,gBAAM,gBAAgB;AAAA,QAC1B,OAAO;AACH,eAAK,gBAAgB;AAAA,QACzB;AAEA,cAAM,UAAU,gBAAgB,MAAM,QAAQ,KAAK,EAAE,IAAI,cAAc,CAAC,CAAC;AACzE,cAAM,MAAM,KAAK,QAAQ,EAAE,QAAQ,CAAC;AACpC,YAAI,SAAS,mBAAmB,MAAM;AACtC,eAAO,EAAE,SAAS,MAAM,UAAU,IAAI;AAAA,MAC1C;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,YAAY;AAC/C,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AAEtC,YAAI,MAAM,OAAO;AACb,gBAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACxC,cAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAC5F,gBAAM,UAAU,MAAM,QAAQ,MAAM,EAAE,gBAAgB,IAAI,QAAQ,SAAS,CAAC;AAI5E,gBAAM,eAAe,MAAM,KAAK,oBAAoB,QAAQ;AAC5D,gBAAM,aAAa,eACb,MAAM,QAAQ,KAAK,EAAE,gBAAgB,IAAI,SAAS,aAAa,CAAC,IAChE,MAAM,QAAQ,KAAK,EAAE,gBAAgB,GAAG,CAAC;AAE/C,gBAAM,WAAW,UACX;AAAA,YACI,IAAI,QAAQ;AAAA,YACZ,QAAQ,QAAQ;AAAA,YAChB,eAAe,QAAQ;AAAA,YACvB,aAAa,QAAQ;AAAA,YACrB,WAAW,QAAQ;AAAA,UACvB,IACA;AAGN,gBAAM,UAAU,gBAAgB,MAAM;AACtC,gBAAM,WAAW,QAAQ,eACnB;AAAA,YACI,QAAQ,QAAQ;AAAA,YAChB,eAAe,OAAO,QAAQ,EAAE;AAAA,YAChC,cAAc,QAAQ;AAAA,YACtB,kBAAkB,QAAQ;AAAA,YAC1B,gBAAgB,QAAQ;AAAA,UAC5B,IACA;AACN,iBAAO;AAAA,YACH,SAAS;AAAA,YACT,UAAU,KAAK,QAAQ,EAAE,SAAS,UAAU,YAAY,UAAU,WAAW,CAAC;AAAA,UAClF;AAAA,QACJ;AAEA,YAAI,MAAM,SAAS;AACf,gBAAM,QAAiC,CAAC;AACxC,cAAI,MAAM,iBAAiB,OAAW,OAAM,eAAe,KAAK;AAChE,cAAI,MAAM,SAAS,OAAW,OAAM,OAAO,KAAK;AAChD,cAAI,MAAM,WAAW,OAAW,OAAM,SAAS,KAAK;AACpD,cAAI,MAAM,eAAe,OAAW,OAAM,aAAa,KAAK;AAC5D,cAAI,MAAM,eAAe,QAAW;AAChC,gBAAI,IAAI,OAAO,KAAK,UAAU;AAE9B,gBAAI,MAAM,WAAY,KAAI;AAC1B,gBAAI,CAAC,CAAC,WAAW,QAAQ,EAAE,SAAS,CAAC,GAAG;AACpC,qBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,uBAAuB,CAAC,iCAAiC,GAAG,EAAE;AAAA,YAC/G;AACA,kBAAM,aAAa;AAAA,UACvB;AACA,cAAI,MAAM,aAAa,OAAW,OAAM,WAAW,KAAK,UAAU,KAAK,QAAQ;AAC/E,gBAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC1C,gBAAM,GAAG,OAAO,KAAK,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAQ;AACpD,gBAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACxC,cAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAC5F,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,gBAAgB,MAAM,EAAE,CAAC,EAAE;AAAA,QACzF;AAEA,YAAI,MAAM,UAAU;AAChB,gBAAM,QAAQ,OAAO,UAAU,OAAO,OAAO,UAAU,UAAU,MAAM,UAAU;AACjF,gBAAM,SAAS,MAAM,KAAK,qBAAqB,IAAI,EAAE,IAAI,SAAS,gBAAgB,MAAM,CAAC;AACzF,cAAI,CAAC,OAAO,IAAI;AACZ,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,OAAO,SAAS,iBAAiB,OAAO,UAAU,GAAG,EAAE;AAAA,UACxG;AACA,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,MAAM,eAAe,IAAI,UAAU,OAAO,SAAS,CAAC,EAAE;AAAA,QACpH;AAAA,MACJ;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,mBAAmB,MAAM,UAAU;AACtE,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AAEzC,YAAI,cAAqB,CAAC;AAC1B,YAAI;AACA,cAAI,OAAO,MAAM,GAAG,KAAK,KAAK,EAAE,OAAO,EAAE,iBAAiB,MAAM,EAAE,CAAQ;AAC1E,cAAI,QAAS,KAAa,MAAO,QAAQ,KAAa;AACtD,wBAAc,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;AAAA,QAChD,QAAQ;AACJ,wBAAc,CAAC;AAAA,QACnB;AACA,cAAM,WAAqB,CAAC;AAC5B,YAAI,kBAAkB;AACtB,mBAAW,OAAO,aAAa;AAC3B,gBAAM,MAAM,KAAK;AACjB,cAAI,CAAC,IAAK;AACV,cAAI;AACA,kBAAM,IAAI,MAAM,KAAK,qBAAqB,KAAK,EAAE,IAAI,SAAS,gBAAgB,OAAO,KAAK,CAAC;AAC3F,gBAAI,EAAE,GAAI;AACV,gBAAI,EAAE,UAAU,OAAQ,UAAS,KAAK,GAAG,EAAE,QAAQ;AACnD,gBAAI,CAAC,EAAE,MAAM,EAAE,MAAO,UAAS,KAAK,WAAW,GAAG,KAAK,EAAE,KAAK,EAAE;AAAA,UACpE,SAAS,KAAK;AACV,qBAAS;AAAA,cACL,4BAA4B,GAAG,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,YACxF;AAAA,UACJ;AAAA,QACJ;AAMA,YAAI,aAAa;AACjB,YAAI;AACA,gBAAM,cAAmB,MAAM,KAAK,WAAW,gBAAgB,KAAK,IAAI;AACxE,gBAAM,KAAK,aAAa,KAAK;AAC7B,cAAI,OAAO,OAAO,YAAY;AAC1B,kBAAM,GAAG,KAAK,YAAY,KAAK;AAAA,cAC3B,MAAM,EAAE,gBAAgB,MAAM;AAAA,cAC9B,SAAS,UAAU,SAAS;AAAA,YAChC,CAAC;AACD,yBAAa;AAAA,UACjB;AAAA,QACJ,SAAS,KAAK;AACV,mBAAS;AAAA,YACL,mCAAmC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,UACvF;AAAA,QACJ;AACA,YAAI,CAAC,YAAY;AACb,cAAI;AACA,kBAAM,GAAG,OAAO,oBAAoB,EAAE,OAAO,EAAE,IAAI,MAAM,EAAE,CAAQ;AACnE,yBAAa;AAAA,UACjB,SAAS,KAAK;AACV,qBAAS;AAAA,cACL,0CAA0C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,YAC9F;AAAA,UACJ;AAAA,QACJ;AAEA,eAAO;AAAA,UACH,SAAS;AAAA,UACT,UAAU,KAAK,QAAQ;AAAA,YACnB,SAAS;AAAA,YACT,gBAAgB;AAAA,YAChB;AAAA,YACA;AAAA,UACJ,CAAC;AAAA,QACL;AAAA,MACJ;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,eAAe,MAAM,UAAU,MAAM,QAAQ;AAC3G,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,WAAW,MAAM;AACvB,YAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC3C,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,wBAAwB,GAAG,EAAE;AAAA,QAC9E;AACA,cAAM,aAAa,SAAS,KAAK,EAAE,YAAY;AAC/C,YAAI,CAAC,qCAAqC,KAAK,UAAU,GAAG;AACxD,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,2BAA2B,GAAG,EAAE;AAAA,QACjF;AACA,cAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACxC,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAE5F,YAAI;AACJ,YAAI;AACA,gBAAM,OAAO,MAAM,GAAG,KAAK,KAAK,EAAE,OAAO,EAAE,UAAU,WAAW,EAAE,CAAQ;AAC1E,gBAAM,MAAM,MAAM,QAAQ,IAAI,IAAI,OAAS,MAAc,SAAS,CAAC;AACnE,qBAAW,IAAI,KAAK,CAAC,MAAW,EAAE,OAAO,EAAE;AAAA,QAC/C,QAAQ;AAAA,QAA2B;AACnC,YAAI,UAAU;AACV,iBAAO;AAAA,YACH,SAAS;AAAA,YACT,UAAU,KAAK;AAAA,cACX,aAAa,UAAU;AAAA,cACvB;AAAA,cACA,EAAE,MAAM,kBAAkB,UAAU,WAAW;AAAA,YACnD;AAAA,UACJ;AAAA,QACJ;AACA,cAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,cAAM,GAAG,OAAO,KAAK,EAAE,UAAU,YAAY,YAAY,UAAU,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAQ;AAE9F,YAAI,KAAK,aAAa,YAAY;AAC9B,cAAI;AAAE,kBAAM,KAAK,YAAY,WAAW,EAAE;AAAA,UAAG,QAAQ;AAAA,UAAoB;AAAA,QAC7E;AACA,cAAM,UAAU,gBAAgB,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC,CAAC;AAC1D,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,QAAQ,CAAC,EAAE;AAAA,MACzE;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,WAAW,MAAM,QAAQ;AACvF,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACxC,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAC5F,YAAI,OAAO,WAAW,YAAY,OAAO,WAAW,gBAAgB;AAChE,iBAAO;AAAA,YACH,SAAS;AAAA,YACT,UAAU,KAAK;AAAA,cACX,YAAY,EAAE,SAAS,OAAO,MAAM;AAAA,cACpC;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ;AAEA,cAAM,aAAa,OAAO;AAC1B,cAAM,WAAW,cAAc,UAAU;AACzC,YAAI,CAAC,UAAU;AACX,iBAAO;AAAA,YACH,SAAS;AAAA,YACT,UAAU,KAAK;AAAA,cACX,WAAW,UAAU;AAAA,cACrB;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ;AAIA,YAAI,WAAoC,CAAC;AACzC,YAAI,OAAO,UAAU;AACjB,cAAI,OAAO,OAAO,aAAa,UAAU;AACrC,gBAAI;AAAE,yBAAW,KAAK,MAAM,OAAO,QAAQ;AAAA,YAAG,QAAQ;AAAE,yBAAW,CAAC;AAAA,YAAG;AAAA,UAC3E,WAAW,OAAO,OAAO,aAAa,UAAU;AAC5C,uBAAW,EAAE,GAAI,OAAO,SAAqC;AAAA,UACjE;AAAA,QACJ;AACA,eAAQ,SAAiB;AAIzB,cAAM,kBAAiB,oBAAI,KAAK,GAAE,YAAY;AAC9C,cAAM,GAAG;AAAA,UACL;AAAA,UACA;AAAA,YACI,QAAQ;AAAA,YACR,UAAU,KAAK,UAAU,QAAQ;AAAA,YACjC,YAAY;AAAA,UAChB;AAAA,UACA,EAAE,OAAO,EAAE,GAAG,EAAE;AAAA,QACpB;AAKA,cAAM,uBAAuB,QAAS,SAAiB,iBAAiB;AACxE,cAAM,qBAAqB,OAAQ,SAAiB,qBAAqB,IAAI;AAE7E,cAAM,WAAW,YAA2B;AACxC,cAAI;AACA,gBAAI,qBAAqB,GAAG;AACxB,oBAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAAA,YAC9D;AACA,gBAAI,sBAAsB;AACtB,oBAAM,IAAI,MAAM,kEAAkE;AAAA,YACtF;AACA,gBAAI;AACJ,gBAAI,cAAc,cAAc,EAAE;AAClC,gBAAI;AACA,oBAAM,UAAU,MAAM,eAAe,SAAS,IAAI;AAClD,kBAAI,SAAS;AACT,sBAAM,SAAS,MAAM,QAAQ,eAAe;AAAA,kBACxC,eAAe;AAAA,kBACf,cAAc,KAAK,GAAG,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,kBACpD,QAAQ;AAAA,kBACR,gBAAgB,OAAO,oBAAoB;AAAA,gBAC/C,CAAC;AACD,8BAAc,OAAO;AACrB,oBAAI,OAAO,gBAAiB,eAAc,OAAO;AAAA,cACrD,OAAO;AACH,8BAAc,iBAAiB,SAAS,MAAM,EAAE;AAAA,cACpD;AAAA,YACJ,SAAS,YAAY;AACjB,oBAAM,sBAAsB,QACtB,aACA,IAAI,MAAM,OAAO,UAAU,CAAC;AAAA,YACtC;AACA,kBAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,kBAAM,GAAG;AAAA,cACL;AAAA,cACA;AAAA,gBACI,QAAQ;AAAA,gBACR,cAAc;AAAA,gBACd,iBAAiB,SAAS;AAAA,gBAC1B,gBAAgB;AAAA,gBAChB,YAAY;AAAA,cAChB;AAAA,cACA,EAAE,OAAO,EAAE,GAAG,EAAE;AAAA,YACpB;AACA,kBAAM,eAAe,MAAM,QAAQ,MAAM,EAAE,gBAAgB,IAAI,QAAQ,SAAS,CAAC;AACjF,gBAAI,CAAC,cAAc;AACf,oBAAM,GAAG,OAAO,MAAM;AAAA,gBAClB,IAAI,WAAW;AAAA,gBACf,gBAAgB;AAAA,gBAChB,mBAAmB;AAAA,gBACnB,mBAAmB;AAAA,gBACnB,eAAe;AAAA,gBACf,QAAQ;AAAA,gBACR,YAAY;AAAA,gBACZ,YAAY;AAAA,cAChB,CAAC;AAAA,YACL;AAAA,UACJ,SAAS,KAAK;AACV,kBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,kBAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,kBAAM,GAAG;AAAA,cACL;AAAA,cACA;AAAA,gBACI,QAAQ;AAAA,gBACR,UAAU,KAAK,UAAU;AAAA,kBACrB,GAAG;AAAA,kBACH,mBAAmB,EAAE,SAAS,SAAS;AAAA,gBAC3C,CAAC;AAAA,gBACD,YAAY;AAAA,cAChB;AAAA,cACA,EAAE,OAAO,EAAE,GAAG,EAAE;AAAA,YACpB;AAAA,UACJ;AAAA,QACJ;AACA,aAAK,SAAS;AAEd,cAAM,WAAW,gBAAgB,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC,CAAC;AAC3D,cAAM,WAAW,KAAK,QAAQ,EAAE,SAAS,SAAS,CAAC;AACnD,iBAAS,SAAS;AAClB,eAAO,EAAE,SAAS,MAAM,UAAU,SAAS;AAAA,MAC/C;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,cAAc,MAAM,QAAQ;AAC1F,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACxC,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAE5F,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,gBAAgB,MAAM,GAAG,gBAAgB,MAAM,CAAC,EAAE;AAAA,MAChH;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,iBAAiB,MAAM,CAAC,MAAM,YAAY,MAAM,QAAQ;AACtH,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,YAAY,MAAM;AACxB,YAAI,CAAC,aAAa,OAAO,cAAc,UAAU;AAC7C,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,yBAAyB,GAAG,EAAE;AAAA,QAC/E;AACA,cAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACxC,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAE5F,cAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AAEtC,YAAI,WAAW,MAAM,GAAG,KAAK,MAAM,EAAE,OAAO,EAAE,gBAAgB,IAAI,QAAQ,SAAS,EAAE,CAAQ;AAC7F,YAAI,YAAa,SAAiB,MAAO,YAAY,SAAiB;AACtE,mBAAW,OAAQ,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,GAAI;AACzD,gBAAM,GAAG,OAAO,MAAM;AAAA,YAClB,QAAQ;AAAA,YACR,YAAY;AAAA,YACZ,YAAY;AAAA,UAChB,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,GAAG,EAAE,CAAQ;AAAA,QACvC;AAEA,cAAM,eAAe,WAAW;AAChC,cAAM,GAAG,OAAO,MAAM;AAAA,UAClB,IAAI;AAAA,UACJ,gBAAgB;AAAA,UAChB,mBAAmB;AAAA,UACnB,mBAAmB;AAAA,UACnB,eAAe;AAAA,UACf,QAAQ;AAAA,UACR,YAAY;AAAA,UACZ,YAAY;AAAA,QAChB,CAAC;AAED,cAAM,aAAa,MAAM,QAAQ,MAAM,EAAE,IAAI,aAAa,CAAC;AAC3D,cAAM,WAAW,aACX;AAAA,UACI,IAAI,WAAW;AAAA,UACf,QAAQ,WAAW;AAAA,UACnB,eAAe,WAAW;AAAA,UAC1B,aAAa,WAAW;AAAA,QAC5B,IACA;AACN,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,YAAY,SAAS,CAAC,EAAE;AAAA,MAC7E;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,aAAa,MAAM,OAAO;AACxF,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,YAAI,OAAO,MAAM,GAAG,KAAK,KAAK,EAAE,OAAO,EAAE,gBAAgB,GAAG,EAAE,CAAQ;AACtE,YAAI,QAAS,KAAa,MAAO,QAAQ,KAAa;AACtD,cAAM,UAAU,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;AAE9C,cAAM,UAAU,MAAM,KAAK,IAAI,IAAI,QAAQ,IAAI,CAAC,QAAa,IAAI,OAAO,EAAE,OAAO,OAAO,CAAC,CAAC;AAC1F,cAAM,UAAU,oBAAI,IAAiB;AACrC,mBAAW,OAAO,SAAS;AACvB,cAAI,MAAW;AACf,qBAAW,aAAa,CAAC,YAAY,MAAM,GAAG;AAC1C,gBAAI;AACA,oBAAM,IAAI,MAAM,GAAG,QAAQ,WAAkB,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAQ;AAC1E,oBAAO,GAAW,SAAS;AAC3B,kBAAI,IAAK;AAAA,YACb,QAAQ;AAAA,YAAuB;AAAA,UACnC;AACA,cAAI,IAAK,SAAQ,IAAI,OAAO,GAAG,GAAG;AAAA,YAC9B,IAAI,IAAI;AAAA,YACR,MAAM,IAAI,QAAQ,IAAI;AAAA,YACtB,OAAO,IAAI;AAAA,YACX,OAAO,IAAI,SAAS,IAAI;AAAA,UAC5B,CAAC;AAAA,QACL;AACA,cAAM,WAAW,QAAQ,IAAI,CAAC,SAAc;AAAA,UACxC,GAAG;AAAA,UACH,MAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK;AAAA,QAC9C,EAAE;AACF,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,SAAS,CAAC,EAAE;AAAA,MAC1E;AAOA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,aAAa,MAAM,QAAQ;AACzF,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACzC,YAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAE7F,cAAM,WAAW,MAAM,KAAK,oBAAoB,QAAQ;AACxD,YAAI,CAAC,SAAU,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,2BAA2B,GAAG,EAAE;AAC5F,cAAM,YAAY,MAAM,QAAQ,KAAK,EAAE,gBAAgB,IAAI,SAAS,SAAS,CAAC;AAC9E,YAAI,CAAC,aAAa,CAAC,CAAC,SAAS,OAAO,EAAE,SAAS,OAAO,UAAU,IAAI,CAAC,GAAG;AACpE,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,4CAAuC,GAAG,EAAE;AAAA,QAC7F;AAEA,cAAM,QAAQ,OAAO,MAAM,UAAU,WAAW,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,YAAY,IAAI;AAC1F,YAAI,eAAe,OAAO,MAAM,YAAY,WAAW,OAAO,KAAK,OAAO,EAAE,KAAK,IAAI;AACrF,YAAI,OAAO,OAAO,MAAM,QAAQ,QAAQ,EAAE,KAAK,EAAE,YAAY;AAC7D,YAAI,CAAC,CAAC,SAAS,SAAS,UAAU,QAAQ,EAAE,SAAS,IAAI,GAAG;AACxD,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,iBAAiB,IAAI,gDAAgD,GAAG,EAAE;AAAA,QAC3H;AACA,YAAI,CAAC,SAAS,CAAC,cAAc;AACzB,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,gCAAgC,GAAG,EAAE;AAAA,QACtF;AAEA,YAAI,CAAC,gBAAgB,OAAO;AACxB,cAAI,MAAW;AACf,qBAAW,aAAa,CAAC,YAAY,MAAM,GAAG;AAC1C,gBAAI;AACA,oBAAM,IAAI,MAAM,GAAG,QAAQ,WAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAQ;AACxE,oBAAO,GAAW,SAAS;AAC3B,kBAAI,IAAK;AAAA,YACb,QAAQ;AAAA,YAAiB;AAAA,UAC7B;AACA,cAAI,CAAC,KAAK,IAAI;AACV,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,6BAA6B,KAAK,KAAK,GAAG,EAAE;AAAA,UAC7F;AACA,yBAAe,OAAO,IAAI,EAAE;AAAA,QAChC;AAEA,cAAM,WAAW,MAAM,QAAQ,KAAK,EAAE,gBAAgB,IAAI,SAAS,aAAa,CAAC;AACjF,YAAI,UAAU;AACV,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,QAAQ,UAAU,eAAe,KAAK,CAAC,EAAE;AAAA,QAC9F;AAEA,YAAI;AACA,gBAAM,WAAW,WAAW;AAC5B,gBAAM,GAAG,OAAO,KAAK;AAAA,YACjB,IAAI;AAAA,YACJ,gBAAgB;AAAA,YAChB,SAAS;AAAA,YACT;AAAA,YACA,YAAY;AAAA,YACZ,iBAAkB,QAAgB,mBAAmB;AAAA,UACzD,CAAQ;AACR,gBAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,IAAI,SAAS,CAAC;AACnD,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,QAAQ,SAAS,eAAe,MAAM,CAAC,EAAE;AAAA,QAC9F,SAAS,GAAQ;AACb,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,GAAG,WAAW,wBAAwB,GAAG,EAAE;AAAA,QAC5F;AAAA,MACJ;AAIA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,aAAa,MAAM,SAAS;AAC1F,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,WAAW,mBAAmB,MAAM,CAAC,CAAC;AAC5C,cAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACzC,YAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAE7F,cAAM,WAAW,MAAM,KAAK,oBAAoB,QAAQ;AACxD,YAAI,CAAC,SAAU,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,2BAA2B,GAAG,EAAE;AAC5F,cAAM,YAAY,MAAM,QAAQ,KAAK,EAAE,gBAAgB,IAAI,SAAS,SAAS,CAAC;AAC9E,YAAI,CAAC,aAAa,CAAC,CAAC,SAAS,OAAO,EAAE,SAAS,OAAO,UAAU,IAAI,CAAC,GAAG;AACpE,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,4CAAuC,GAAG,EAAE;AAAA,QAC7F;AAEA,cAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,IAAI,UAAU,gBAAgB,GAAG,CAAC;AACtE,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,WAAW,QAAQ,eAAe,GAAG,EAAE;AAEjG,cAAM,UAAU,OAAO,MAAM,QAAQ,EAAE,EAAE,KAAK,EAAE,YAAY;AAC5D,YAAI,CAAC,CAAC,SAAS,SAAS,UAAU,QAAQ,EAAE,SAAS,OAAO,GAAG;AAC3D,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,iBAAiB,OAAO,KAAK,GAAG,EAAE;AAAA,QACnF;AAGA,YAAI,OAAO,SAAS,WAAW,YAAY,SAAS;AAChD,cAAI,SAAS,MAAM,GAAG,KAAK,KAAK,EAAE,OAAO,EAAE,gBAAgB,IAAI,MAAM,QAAQ,EAAE,CAAQ;AACvF,cAAI,UAAW,OAAe,MAAO,UAAU,OAAe;AAC9D,gBAAM,aAAa,MAAM,QAAQ,MAAM,IAAI,OAAO,SAAS;AAC3D,cAAI,cAAc,GAAG;AACjB,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,gCAAgC,GAAG,EAAE;AAAA,UACtF;AAAA,QACJ;AAEA,YAAI;AACA,gBAAM,GAAG,OAAO,KAAK,EAAE,MAAM,SAAS,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE,GAAU,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAQ;AACvH,gBAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,IAAI,SAAS,CAAC;AACnD,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,QAAQ,QAAQ,CAAC,EAAE;AAAA,QACxE,SAAS,GAAQ;AACb,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,GAAG,WAAW,yBAAyB,GAAG,EAAE;AAAA,QAC7F;AAAA,MACJ;AAKA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,aAAa,MAAM,UAAU;AAC3F,cAAM,KAAK,mBAAmB,MAAM,CAAC,CAAC;AACtC,cAAM,WAAW,mBAAmB,MAAM,CAAC,CAAC;AAC5C,cAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,GAAG,CAAC;AACzC,YAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,EAAE,eAAe,GAAG,EAAE;AAE7F,cAAM,WAAW,MAAM,KAAK,oBAAoB,QAAQ;AACxD,YAAI,CAAC,SAAU,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,2BAA2B,GAAG,EAAE;AAE5F,cAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,IAAI,UAAU,gBAAgB,GAAG,CAAC;AACtE,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,WAAW,QAAQ,eAAe,GAAG,EAAE;AAEjG,cAAM,YAAY,MAAM,QAAQ,KAAK,EAAE,gBAAgB,IAAI,SAAS,SAAS,CAAC;AAC9E,cAAM,SAAS,OAAO,OAAO,OAAO,MAAM,OAAO,QAAQ;AACzD,cAAM,eAAe,aAAa,CAAC,SAAS,OAAO,EAAE,SAAS,OAAO,UAAU,IAAI,CAAC;AACpF,YAAI,CAAC,UAAU,CAAC,cAAc;AAC1B,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,4CAAuC,GAAG,EAAE;AAAA,QAC7F;AAEA,YAAI,OAAO,SAAS,SAAS;AACzB,cAAI,SAAS,MAAM,GAAG,KAAK,KAAK,EAAE,OAAO,EAAE,gBAAgB,IAAI,MAAM,QAAQ,EAAE,CAAQ;AACvF,cAAI,UAAW,OAAe,MAAO,UAAU,OAAe;AAC9D,gBAAM,aAAa,MAAM,QAAQ,MAAM,IAAI,OAAO,SAAS;AAC3D,cAAI,cAAc,GAAG;AACjB,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,gCAAgC,GAAG,EAAE;AAAA,UACtF;AAAA,QACJ;AAEA,YAAI;AACA,gBAAM,GAAG,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAQ;AACvD,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,MAAM,SAAS,CAAC,EAAE;AAAA,QAChF,SAAS,GAAQ;AACb,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,GAAG,WAAW,2BAA2B,GAAG,EAAE;AAAA,QAC/F;AAAA,MACJ;AAIA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,cAAc,MAAM,OAAO;AACzF,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,YAAI,OAAO,MAAM,GAAG,KAAK,aAAa,EAAE,OAAO,EAAE,gBAAgB,MAAM,EAAE,CAAQ;AACjF,YAAI,QAAS,KAAa,MAAO,QAAQ,KAAa;AACtD,cAAM,WAAW,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;AAK/C,cAAM,WAAW,MAAM,QAAQ;AAAA,UAC3B,SAAS,IAAI,OAAO,MAAW;AAC3B,gBAAI,aAA4B;AAChC,gBAAI,aAA4B;AAChC,gBAAI;AACA,kBAAI,EAAE,YAAY;AACd,sBAAM,MAAM,MAAM,GAAG,QAAQ,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAQ;AACxE,6BAAa,KAAK,eAAe;AAAA,cACrC;AACA,kBAAI,EAAE,oBAAoB;AACtB,sBAAM,MAAM,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAQ;AACxF,6BAAa,KAAK,WAAW;AAAA,cACjC;AAAA,YACJ,QAAQ;AAAA,YAER;AACA,mBAAO;AAAA,cACH,GAAG;AAAA;AAAA,cAEH,WAAW;AAAA,cACX,YAAY,cAAc,EAAE;AAAA,cAC5B,SAAS,cAAc,EAAE,WAAW;AAAA,YACxC;AAAA,UACJ,CAAC;AAAA,QACL;AACA,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,UAAU,OAAO,SAAS,OAAO,CAAC,EAAE;AAAA,MACzF;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,cAAc,MAAM,QAAQ;AAC1F,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,EAAE,WAAW,SAAS,UAAU,gBAAgB,IAAI,QAAQ,CAAC;AACnE,YAAI,CAAC,UAAW,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,yBAAyB,GAAG,EAAE;AAG3F,cAAM,QAAQ,MAAM,KAAK,mBAAmB;AAC5C,cAAM,cAAe,OAAe;AACpC,cAAM,UAAU,aAAa,iBAAiB,KAAK,CAAC;AACpD,cAAM,gBAAgB,QAAQ,KAAK,CAAC,OAAY,GAAG,UAAU,MAAM,GAAG,QAAQ,SAAS;AACvF,cAAM,WAAW,eAAe,YAAY;AAC5C,YAAI,CAAC,UAAU;AACX,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,SAAS,sCAAsC,GAAG,EAAE;AAAA,QACjH;AAGA,cAAM,eAAe,oBAAI,IAAI,CAAC,SAAS,UAAU,UAAU,CAAC;AAC5D,YAAI,aAAa,IAAI,UAAU,KAAK,GAAG;AACnC,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,SAAS,eAAe,SAAS,KAAK,wCAAwC,GAAG,EAAE;AAAA,QAChJ;AAGA,cAAM,aAAa,MAAM,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC;AACnD,YAAI,CAAC,YAAY;AACb,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,eAAe,GAAG,EAAE;AAAA,QACtF;AACA,cAAM,aAAa,WAAW,mBAAmB;AAEjD,YAAI,SAAS;AACb,YAAI;AACA,gBAAM,cAAmB,MAAM,KAAK,WAAW,gBAAgB,KAAK,IAAI;AACxE,gBAAM,cAAc,MAAM,aAAa,KAAK,aAAa;AAAA,YACrD,SAAS,UAAU,SAAS;AAAA,UAChC,CAAC;AACD,mBAAS,aAAa,MAAM,MAAM,aAAa,SAAS,UAAU;AAAA,QACtE,QAAQ;AAAA,QAER;AAEA,cAAM,kBAAkB,WAAW,UAAU,WAAW;AAGxD,cAAM,MAAM,MAAM,GAAG,QAAQ,aAAa;AAAA,UACtC,OAAO,EAAE,gBAAgB,OAAO,YAAY,UAAU;AAAA,QAC1D,CAAQ;AACR,YAAI,KAAK,IAAI;AACT,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,SAAS,0CAA0C,GAAG,EAAE;AAAA,QACrH;AAGA,cAAM,eAAe,MAAM,iBAAiB,WAAW,YAAY,QAAQ,QAAQ;AACnF,cAAM,sBAAsB,MAAM,wBAAwB,cAAc,iBAAiB,QAAQ,QAAQ;AAEzG,cAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,cAAM,WAAW,WAAW;AAC5B,cAAM,GAAG,OAAO,aAAa;AAAA,UACzB,IAAI;AAAA,UACJ,gBAAgB;AAAA,UAChB,YAAY;AAAA,UACZ,oBAAoB;AAAA,UACpB,QAAQ;AAAA,UACR,SAAS,oBAAoB;AAAA,UAC7B,cAAc;AAAA,UACd,cAAc;AAAA,UACd,YAAY;AAAA,UACZ,UAAU,WAAW,KAAK,UAAU,QAAQ,IAAI;AAAA,QACpD,CAAC;AACD,cAAM,SAAS,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAQ;AAG/E,YAAI;AAAE,gBAAM,KAAK,eAAe,MAAM,KAAK;AAAA,QAAG,QAAQ;AAAA,QAAoB;AAC1E,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,OAAO,CAAC,EAAE;AAAA,MACxE;AAIA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,cAAc,MAAM,OAAO;AACzF,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,SAAS,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,EAAE,gBAAgB,OAAO,YAAY,MAAM,EAAE,CAAQ;AAC3G,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,sCAAsC,GAAG,EAAE;AACtH,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,OAAO,CAAC,EAAE;AAAA,MACxE;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,cAAc,MAAM,UAAU;AAC5F,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,SAAS,MAAM,wBAAwB,OAAO,KAAK;AACzD,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,sCAAsC,GAAG,EAAE;AAGtH,cAAM,WAAW,KAAK,OAAO,UAAU,SAAS,KAAK,CAAC;AACtD,cAAM,KAAK,SAAS,KAAK,CAAC,OAAY,EAAE,UAAU,MAAM,EAAE,QAAQ,KAAK,GAAG;AAC1E,YAAI,IAAI,SAAS,CAAC,SAAS,UAAU,UAAU,EAAE,SAAS,GAAG,KAAK,GAAG;AACjE,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,gBAAgB,GAAG,KAAK,0BAA0B,GAAG,EAAE;AAAA,QACzH;AACA,cAAM,GAAG,OAAO,aAAa,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAQ;AAChE,YAAI;AAAE,gBAAM,KAAK,eAAe,MAAM,KAAK;AAAA,QAAG,QAAQ;AAAA,QAAoB;AAC1E,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,IAAI,OAAO,IAAI,SAAS,KAAK,CAAC,EAAE;AAAA,MACrF;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,YAAY,MAAM,SAAS;AACpH,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,SAAS,MAAM,wBAAwB,OAAO,KAAK;AACzD,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,sCAAsC,GAAG,EAAE;AACtH,cAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,cAAM,GAAG,OAAO,aAAa,EAAE,SAAS,MAAM,QAAQ,aAAa,YAAY,OAAO,GAAG,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAQ;AAC5H,cAAM,UAAU,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAQ;AACjF,YAAI;AAAE,gBAAM,KAAK,eAAe,MAAM,KAAK;AAAA,QAAG,QAAQ;AAAA,QAAoB;AAC1E,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,QAAQ,CAAC,EAAE;AAAA,MACzE;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,aAAa,MAAM,SAAS;AACrH,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,SAAS,MAAM,wBAAwB,OAAO,KAAK;AACzD,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,sCAAsC,GAAG,EAAE;AACtH,cAAM,WAAW,KAAK,OAAO,UAAU,SAAS,KAAK,CAAC;AACtD,cAAM,KAAK,SAAS,KAAK,CAAC,OAAY,EAAE,UAAU,MAAM,EAAE,QAAQ,KAAK,GAAG;AAC1E,YAAI,IAAI,SAAS,CAAC,SAAS,UAAU,UAAU,EAAE,SAAS,GAAG,KAAK,GAAG;AACjE,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,gBAAgB,GAAG,KAAK,uBAAuB,GAAG,EAAE;AAAA,QACtH;AACA,cAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,cAAM,GAAG,OAAO,aAAa,EAAE,SAAS,OAAO,QAAQ,YAAY,YAAY,OAAO,GAAG,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAQ;AAC5H,cAAM,UAAU,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAQ;AACjF,YAAI;AAAE,gBAAM,KAAK,eAAe,MAAM,KAAK;AAAA,QAAG,QAAQ;AAAA,QAAoB;AAC1E,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,QAAQ,CAAC,EAAE;AAAA,MACzE;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,aAAa,MAAM,QAAQ;AACpH,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,QAAQ,mBAAmB,MAAM,CAAC,CAAC;AACzC,cAAM,SAAS,MAAM,wBAAwB,OAAO,KAAK;AACzD,YAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,YAAY,KAAK,sCAAsC,GAAG,EAAE;AACtH,cAAM,EAAE,cAAc,IAAI,QAAQ,CAAC;AACnC,cAAM,WAAW,KAAK,OAAO,UAAU,SAAS,KAAK,CAAC;AACtD,cAAM,YAAY,SAAS,KAAK,CAAC,OAAY,EAAE,UAAU,MAAM,EAAE,QAAQ,KAAK,GAAG;AACjF,cAAM,aAAa,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,EAAE,IAAI,OAAO,mBAAmB,EAAE,CAAQ;AACpG,cAAM,aAAa,iBAAiB,WAAW,WAAW,YAAY,WAAW;AACjF,YAAI,eAAe,YAAY,SAAS;AACpC,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,QAAQ,SAAS,4BAA4B,CAAC,EAAE;AAAA,QAC9G;AAEA,YAAI,SAAS;AACb,YAAI;AACA,gBAAM,cAAmB,MAAM,KAAK,WAAW,gBAAgB,KAAK,IAAI;AACxE,gBAAM,cAAc,MAAM,aAAa,KAAK,aAAa;AAAA,YACrD,SAAS,UAAU,SAAS;AAAA,UAChC,CAAC;AACD,mBAAS,aAAa,MAAM,MAAM;AAAA,QACtC,QAAQ;AAAA,QAAqB;AAC7B,cAAM,eAAe,MAAM,wBAAwB,OAAO,YAAY,YAAY,QAAQ,SAAS;AACnG,cAAM,UAAS,oBAAI,KAAK,GAAE,YAAY;AACtC,cAAM,GAAG,OAAO,aAAa;AAAA,UACzB,oBAAoB;AAAA,UACpB,QAAQ;AAAA,UACR,YAAY;AAAA,QAChB,GAAG,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAQ;AACtC,cAAM,UAAU,MAAM,GAAG,QAAQ,aAAa,EAAE,OAAO,EAAE,IAAI,OAAO,GAAG,EAAE,CAAQ;AACjF,YAAI;AAAE,gBAAM,KAAK,eAAe,MAAM,KAAK;AAAA,QAAG,QAAQ;AAAA,QAAoB;AAC1E,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,QAAQ,CAAC,EAAE;AAAA,MACzE;AAAA,IAEJ,SAAS,GAAQ;AACb,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,EAAE,SAAS,EAAE,cAAc,GAAG,EAAE;AAAA,IACjF;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,qBACV,eACA,MAQ6E;AAC7E,UAAM,EAAE,IAAI,SAAS,gBAAgB,MAAM,IAAI;AAC/C,UAAM,MAAM;AACZ,UAAM,WAAqB,CAAC;AAE5B,UAAM,MAAM,MAAM,QAAQ,KAAK,EAAE,IAAI,cAAc,CAAC;AACpD,QAAI,CAAC,KAAK;AACN,aAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,YAAY,aAAa,eAAe,SAAS;AAAA,IAC7F;AACA,QAAI,IAAI,cAAc,QAAQ,IAAI,cAAc,GAAG;AAC/C,aAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,YAAY,aAAa,+CAA+C,SAAS;AAAA,IAC7H;AACA,SAAK,IAAI,eAAe,QAAQ,IAAI,eAAe,MAAM,CAAC,OAAO;AAC7D,aAAO;AAAA,QACH,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,OAAO,YAAY,aAAa;AAAA,QAChC;AAAA,MACJ;AAAA,IACJ;AAGA,UAAM,UAAoD;AAAA,MACtD,EAAE,QAAQ,8BAA8B,OAAO,iBAAiB;AAAA,MAChE,EAAE,QAAQ,0BAA0B,OAAO,iBAAiB;AAAA,MAC5D,EAAE,QAAQ,4BAA4B,OAAO,iBAAiB;AAAA,IAClE;AACA,eAAW,EAAE,QAAQ,MAAM,KAAK,SAAS;AACrC,UAAI;AACA,YAAI,OAAO,MAAM,GAAG,KAAK,QAAQ,EAAE,OAAO,EAAE,CAAC,KAAK,GAAG,cAAc,EAAE,CAAQ;AAC7E,YAAI,QAAQ,KAAK,MAAO,QAAO,KAAK;AACpC,YAAI,MAAM,QAAQ,IAAI,GAAG;AACrB,qBAAW,KAAK,MAAM;AAClB,gBAAI,GAAG,MAAM,MAAM;AACf,kBAAI;AACA,sBAAM,GAAG,OAAO,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAQ;AAAA,cAC1D,SAAS,UAAU;AACf,yBAAS;AAAA,kBACL,oBAAoB,MAAM,IAAI,EAAE,EAAE,KAAK,oBAAoB,QAAQ,SAAS,UAAU,OAAO,QAAQ,CAAC;AAAA,gBAC1G;AAAA,cACJ;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ,SAAS,KAAK;AACV,iBAAS;AAAA,UACL,uBAAuB,MAAM,gBAAgB,aAAa,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACnH;AAAA,MACJ;AAAA,IACJ;AAGA,UAAM,SAAU,IAAI,mBAA0C;AAC9D,UAAM,cAAc,IAAI;AACxB,UAAM,eAAe,KAAK,OAAO,aAAa,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;AAC9E,QAAI;AACA,YAAM,UAAU,MAAM,eAAe,MAAM;AAC3C,UAAI,SAAS,gBAAgB;AACzB,cAAM,QAAQ,eAAe,EAAE,eAAe,cAAc,YAAY,CAAC;AAAA,MAC7E,OAAO;AACH,iBAAS,KAAK,0BAA0B,MAAM,8BAA8B,aAAa,gBAAgB;AAAA,MAC7G;AAAA,IACJ,SAAS,KAAK;AACV,eAAS;AAAA,QACL,kDAAkD,aAAa,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACxH;AAAA,IACJ;AAGA,QAAI;AACA,YAAM,GAAG,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,CAAQ;AAAA,IAChE,SAAS,KAAK;AACV,aAAO;AAAA,QACH,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,OAAO,yCAAyC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QAChG;AAAA,MACJ;AAAA,IACJ;AAGA,QAAI,KAAK,aAAa,YAAY;AAC9B,UAAI;AAAE,cAAM,KAAK,YAAY,WAAW,aAAa;AAAA,MAAG,QAAQ;AAAA,MAAoB;AAAA,IACxF;AAEA,WAAO,EAAE,IAAI,MAAM,SAAS;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cAAc,MAAc,QAAgB,MAAW,SAA6D;AACtH,UAAM,iBAAiB,MAAM,KAAK,WAAW,gBAAgB,KAAK,cAAc,CAAC,KAAK,KAAK,OAAO,WAAW,cAAc;AAC3H,QAAI,CAAC,gBAAgB;AAChB,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,+BAA+B,GAAG,EAAE;AAAA,IACtF;AAEA,UAAM,IAAI,OAAO,YAAY;AAC7B,UAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG;AAGhD,QAAI,MAAM,CAAC,MAAM,YAAY,MAAM,QAAQ;AACvC,UAAI,CAAC,MAAM;AACN,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,oBAAoB,GAAG,EAAE;AAAA,MAC3E;AACA,YAAM,SAAS,MAAM,eAAe,OAAO,MAAM,EAAE,SAAS,QAAQ,QAAQ,CAAC;AAC7E,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,IAC3D;AAGA,QAAI,MAAM,CAAC,MAAM,UAAU,MAAM,CAAC,KAAK,MAAM,OAAO;AAChD,YAAM,KAAK,MAAM,CAAC;AAClB,YAAM,SAAS,MAAM,eAAe,SAAS,IAAI,EAAE,SAAS,QAAQ,QAAQ,CAAC;AAG7E,UAAI,OAAO,OAAO,OAAO,UAAU;AAE/B,eAAO,EAAE,SAAS,MAAM,QAAQ,EAAE,MAAM,YAAY,KAAK,OAAO,IAAI,EAAE;AAAA,MAC1E;AAEA,UAAI,OAAO,QAAQ;AAEd,eAAO;AAAA,UACH,SAAS;AAAA,UACT,QAAQ;AAAA,YACJ,MAAM;AAAA,YACN,QAAQ,OAAO;AAAA,YACf,SAAS;AAAA,cACL,gBAAgB,OAAO,YAAY;AAAA,cACnC,kBAAkB,OAAO;AAAA,YAC7B;AAAA,UACJ;AAAA,QACJ;AAAA,MACL;AAEA,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,IAC3D;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,MAAc,OAAY,UAA8D;AACnG,UAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAGhE,QAAI,MAAM,CAAC,MAAM,UAAU,MAAM,CAAC,GAAG;AACjC,YAAM,aAAa,MAAM,CAAC;AAE1B,YAAM,OAAO,MAAM,CAAC,KAAK,OAAO,QAAQ;AAExC,YAAM,WAAW,MAAM,KAAK,eAAe,UAAU;AAErD,UAAI,YAAY,OAAO,SAAS,cAAc,YAAY;AACtD,YAAI;AACA,gBAAM,SAAS,MAAM,SAAS,UAAU,EAAE,QAAQ,YAAY,KAAK,CAAC;AACpE,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,QAC3D,SAAS,GAAQ;AACb,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,EAAE,SAAS,GAAG,EAAE;AAAA,QACjE;AAAA,MACJ,OAAO;AACF,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,kCAAkC,GAAG,EAAE;AAAA,MACzF;AAAA,IACJ;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,iBAAiB,MAAc,QAAgB,MAAW,SAA8B,OAA4C;AACtI,UAAM,oBAAoB,MAAM,KAAK,WAAW,gBAAgB,KAAK,UAAU;AAC/E,QAAI,CAAC,kBAAmB,QAAO,EAAE,SAAS,MAAM;AAEhD,UAAM,IAAI,OAAO,YAAY;AAC7B,UAAM,QAAQ,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AAGhE,QAAI,MAAM,CAAC,MAAM,aAAa,MAAM,CAAC,KAAK,MAAM,QAAQ;AACnD,YAAM,cAAc,MAAM,CAAC;AAC3B,UAAI,OAAO,kBAAkB,YAAY,YAAY;AACjD,cAAM,SAAS,MAAM,kBAAkB,QAAQ,aAAa,MAAM,EAAE,SAAS,QAAQ,QAAQ,CAAC;AAC9F,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AAEA,UAAI,OAAO,kBAAkB,YAAY,YAAY;AACjD,cAAM,SAAS,MAAM,kBAAkB,QAAQ,aAAa,IAAI;AAChE,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC3D;AAAA,IACL;AAGA,QAAI,MAAM,WAAW,KAAK,MAAM,OAAO;AACnC,UAAI,OAAO,kBAAkB,cAAc,YAAY;AACnD,cAAM,QAAQ,MAAM,kBAAkB,UAAU;AAChD,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,OAAO,OAAO,OAAO,MAAM,QAAQ,SAAS,MAAM,CAAC,EAAE;AAAA,MAC1G;AAAA,IACJ;AAGA,QAAI,MAAM,WAAW,KAAK,MAAM,QAAQ;AACpC,UAAI,OAAO,kBAAkB,iBAAiB,YAAY;AACtD,0BAAkB,aAAa,MAAM,MAAM,IAAI;AAC/C,eAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,MACzD;AAAA,IACJ;AAGA,QAAI,MAAM,UAAU,GAAG;AACnB,YAAM,OAAO,MAAM,CAAC;AAGpB,UAAI,MAAM,CAAC,MAAM,aAAa,MAAM,QAAQ;AACxC,YAAI,OAAO,kBAAkB,YAAY,YAAY;AACjD,gBAAM,UAAU,QAAQ,OAAO,SAAS,WAAW,OAAO,CAAC;AAW3D,gBAAM,WAAW,QAAQ;AACzB,gBAAM,aAAa,QAAQ,cAAc,QAAQ;AACjD,gBAAM,aAAc,QAAQ,UAAU,OAAO,QAAQ,WAAW,WAAY,EAAE,GAAG,QAAQ,OAAO,IAAI,CAAC;AAIrG,cAAI,CAAC,QAAQ,QAAQ;AACjB,kBAAM,WAAW,oBAAI,IAAI,CAAC,YAAY,cAAc,UAAU,SAAS,QAAQ,CAAC;AAChF,uBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC1C,kBAAI,SAAS,IAAI,CAAC,EAAG;AACrB,kBAAI,WAAW,CAAC,MAAM,OAAW,YAAW,CAAC,IAAI;AAAA,YACrD;AAAA,UACJ;AACA,cAAI,aAAa,UAAa,WAAW,aAAa,QAAW;AAC7D,uBAAW,WAAW;AAAA,UAC1B;AACA,cAAI,aAAa,UAAa,YAAY;AACtC,kBAAM,QAAQ,GAAG,OAAO,UAAU,EAAE,QAAQ,aAAa,CAAC,GAAW,MAAc,EAAE,YAAY,CAAC,CAAC;AACnG,gBAAI,WAAW,KAAK,MAAM,OAAW,YAAW,KAAK,IAAI;AAAA,UAC7D;AACA,gBAAM,oBAAyB;AAAA,YAC3B,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,OAAO,QAAQ,SAAS;AAAA,UAC5B;AACA,gBAAM,iBAAkB,SAAiB,MAAM,MAAO,SAAiB;AACvE,cAAI,eAAgB,mBAAkB,SAAS;AAC/C,gBAAM,SAAS,MAAM,kBAAkB,QAAQ,MAAM,iBAAiB;AACtE,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,QAC3D;AAAA,MACJ;AAGA,UAAI,MAAM,CAAC,MAAM,YAAY,MAAM,QAAQ;AACvC,YAAI,OAAO,kBAAkB,eAAe,YAAY;AACpD,gBAAM,kBAAkB,WAAW,MAAM,MAAM,WAAW,IAAI;AAC9D,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,MAAM,SAAS,MAAM,WAAW,KAAK,CAAC,EAAE;AAAA,QAC7F;AAAA,MACJ;AAGA,UAAI,MAAM,CAAC,MAAM,UAAU,MAAM,CAAC,KAAK,MAAM,OAAO;AAChD,YAAI,OAAO,kBAAkB,WAAW,YAAY;AAChD,gBAAM,MAAM,MAAM,kBAAkB,OAAO,MAAM,CAAC,CAAC;AACnD,cAAI,CAAC,IAAK,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,uBAAuB,GAAG,EAAE;AACnF,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,GAAG,EAAE;AAAA,QACxD;AAAA,MACJ;AAGA,UAAI,MAAM,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,MAAM,OAAO;AACjD,YAAI,OAAO,kBAAkB,aAAa,YAAY;AAClD,gBAAM,UAAU,QAAQ,EAAE,OAAO,MAAM,QAAQ,OAAO,MAAM,KAAK,IAAI,QAAW,QAAQ,MAAM,OAAO,IAAI;AACzG,gBAAM,OAAO,MAAM,kBAAkB,SAAS,MAAM,OAAO;AAC3D,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,MAAM,SAAS,MAAM,CAAC,EAAE;AAAA,QAC7E;AAAA,MACJ;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,OAAO;AACnC,YAAI,OAAO,kBAAkB,YAAY,YAAY;AACjD,gBAAM,OAAO,MAAM,kBAAkB,QAAQ,IAAI;AACjD,cAAI,CAAC,KAAM,QAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,kBAAkB,GAAG,EAAE;AAC/E,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,IAAI,EAAE;AAAA,QACzD;AAAA,MACJ;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,OAAO;AACnC,YAAI,OAAO,kBAAkB,iBAAiB,YAAY;AACtD,4BAAkB,aAAa,MAAM,MAAM,cAAc,IAAI;AAC7D,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,cAAc,IAAI,EAAE;AAAA,QAC7E;AAAA,MACJ;AAGA,UAAI,MAAM,WAAW,KAAK,MAAM,UAAU;AACtC,YAAI,OAAO,kBAAkB,mBAAmB,YAAY;AACxD,4BAAkB,eAAe,IAAI;AACrC,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,MAAM,SAAS,KAAK,CAAC,EAAE;AAAA,QAC5E;AAAA,MACJ;AAAA,IACJ;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AAAA,EAEQ,iBAAsC;AAC1C,QAAI,KAAK,OAAO,oBAAoB,KAAK;AACrC,aAAO,OAAO,YAAY,KAAK,OAAO,QAAQ;AAAA,IAClD;AACA,WAAO,KAAK,OAAO,YAAY,CAAC;AAAA,EACpC;AAAA,EAEA,MAAc,WAAW,MAAuB;AAC5C,WAAO,KAAK,eAAe,IAAI;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,eAAe,MAAc,SAAkB;AAEzD,QAAI,WAAW,OAAO,KAAK,cAAc,oBAAoB,YAAY;AACrE,UAAI;AACA,cAAM,MAAM,MAAM,KAAK,cAAc,gBAAgB,MAAM,OAAO;AAClE,YAAI,OAAO,KAAM,QAAO;AAAA,MAC5B,QAAQ;AAAA,MAER;AAAA,IACJ;AAEA,QAAI,OAAO,KAAK,OAAO,oBAAoB,YAAY;AACnD,UAAI;AACA,cAAM,MAAM,MAAM,KAAK,OAAO,gBAAgB,IAAI;AAClD,YAAI,OAAO,KAAM,QAAO;AAAA,MAC5B,QAAQ;AAAA,MAER;AAAA,IACJ;AACA,QAAI,OAAO,KAAK,OAAO,eAAe,YAAY;AAC9C,UAAI;AACA,cAAM,MAAM,MAAM,KAAK,OAAO,WAAW,IAAI;AAC7C,YAAI,OAAO,KAAM,QAAO;AAAA,MAC5B,QAAQ;AAAA,MAER;AAAA,IACJ;AACA,QAAI,KAAK,QAAQ,SAAS,YAAY;AAClC,UAAI;AACA,cAAM,MAAM,MAAM,KAAK,OAAO,QAAQ,WAAW,IAAI;AACrD,YAAI,OAAO,KAAM,QAAO;AAAA,MAC5B,QAAQ;AAAA,MAER;AAAA,IACJ;AACA,UAAM,WAAW,KAAK,eAAe;AACrC,WAAO,SAAS,IAAI;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,mBAAmB,SAAgC;AAE7D,QAAI;AACA,YAAM,MAAM,MAAM,KAAK,eAAe,YAAY,OAAO;AACzD,UAAI,KAAK,SAAU,QAAO;AAAA,IAC9B,QAAQ;AAAA,IAA8B;AACtC,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,cAAc,MAAc,QAAgB,MAAW,UAA8D;AACvH,QAAI,OAAO,YAAY,MAAM,QAAQ;AACjC,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,sBAAsB,GAAG,EAAE;AAAA,IAC5E;AACA,UAAM,QAAQ,KAAK,QAAQ,cAAc,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AACtE,QAAI,MAAM,SAAS,GAAG;AAClB,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,yCAAyC,GAAG,EAAE;AAAA,IAC/F;AACA,UAAM,aAAa,MAAM,CAAC;AAC1B,UAAM,aAAa,MAAM,CAAC;AAC1B,UAAM,mBAAmB,MAAM,CAAC;AAKhC,QAAI,CAAC,SAAS,eAAe;AACzB,YAAM,MAAM,KAAK,sBAAsB;AACvC,UAAI,KAAK,cAAe,UAAS,gBAAgB,IAAI;AAAA,IACzD;AAOA,QAAI,YAAiB;AACrB,QAAI,KAAK,iBAAiB,SAAS,iBAAiB,SAAS,kBAAkB,YAAY;AACvF,UAAI;AACA,cAAM,gBAAqB,MAAM,KAAK,cAAc,YAAY,SAAS,aAAa;AACtF,YAAI,eAAe;AACf,eAAK,SAAS;AAKd,cAAI,OAAO,cAAc,oBAAoB,YAAY;AACrD,wBAAY,MAAM,cAAc,gBAAgB,UAAU,EAAE,MAAM,MAAM,IAAI;AAAA,UAChF;AAAA,QACJ;AAAA,MACJ,QAAQ;AAAA,MAGR;AAAA,IACJ;AAEA,UAAM,KAAU,aAAa,MAAM,KAAK,mBAAmB,UAAU,aAAa;AAClF,QAAI,CAAC,MAAM,OAAO,GAAG,kBAAkB,YAAY;AAC/C,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,6BAA6B,GAAG,EAAE;AAAA,IACnF;AAKA,UAAM,aAAa,OAAO,QAAgB;AACtC,aAAO,GAAG,cAAc,KAAK,YAAY,aAAa;AAAA,IAC1D;AAEA,UAAM,UAAU,QAAQ,OAAO,SAAS,WAAW,OAAO,CAAC;AAC3D,UAAM,WAAW,oBAAoB,QAAQ;AAC7C,UAAM,YAAa,QAAQ,UAAU,OAAO,QAAQ,WAAW,WAAY,QAAQ,SAAS,CAAC;AAG7F,QAAI,SAAkC,CAAC;AACvC,QAAI,YAAY,eAAe,UAAU;AACrC,UAAI;AACA,cAAM,MAAM,MAAM,KAAK,SAAS,OAAO,EAAE,QAAQ,YAAY,IAAI,SAAS,GAAG,SAAS,YAAY,SAAS,eAAe,SAAS,gBAAgB;AACnJ,YAAI,KAAK,OAAQ,UAAS,IAAI;AAAA,MAClC,QAAQ;AAAA,MAAgE;AAAA,IAC5E;AACA,QAAI,UAAW,OAAe,MAAM,QAAQ,SAAU,CAAC,OAAe,KAAK;AAG3E,UAAM,eAAe;AAAA,MACjB,MAAM,OAAO,QAAgB,MAAwD;AACjF,cAAM,MAAM,MAAM,GAAG,OAAO,QAAQ,IAAI;AACxC,cAAM,MAAM,OAAQ,IAAY,OAAQ,KAAa;AACrD,eAAO,EAAE,GAAG;AAAA,MAChB;AAAA,MACA,MAAM,OAAO,QAAgB,IAAY,MAA8C;AACnF,cAAM,GAAG,OAAO,QAAQ,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAAA,MACnD;AAAA,MACA,MAAM,OAAO,QAAgB,IAA2B;AACpD,cAAM,GAAG,OAAO,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAAA,MAC7C;AAAA,MACA,MAAM,KAAK,QAAgB,OAAyE;AAChG,cAAM,OAAO,SAAS,OAAO,KAAK,KAAK,EAAE,SAAS,EAAE,OAAO,MAAM,IAAI;AACrE,cAAM,OAAO,MAAM,GAAG,KAAK,QAAQ,IAAW;AAC9C,eAAO,MAAM,QAAQ,IAAI,IAAI,OAAS,MAAc,SAAS,CAAC;AAAA,MAClE;AAAA,IACJ;AAEA,UAAM,iBAAkB,UAAkB,MAAM,MAAO,UAAkB,UAAU;AACnF,UAAM,eAAgB,UAAkB,QAAQ,EAAE,IAAI,gBAAgB,MAAM,eAAe;AAE3F,UAAM,gBAAqB;AAAA,MACvB;AAAA,MACA,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,EAAE,GAAG,WAAW,UAAU,WAAW;AAAA,IACjD;AAEA,QAAI;AAEA,UAAI;AACJ,UAAI;AACA,iBAAS,MAAM,WAAW,UAAU;AAAA,MACxC,SAAS,KAAU;AACf,cAAM,MAAM,OAAO,KAAK,WAAW,OAAO,EAAE;AAC5C,YAAI,aAAa,KAAK,GAAG,KAAK,eAAe,KAAK;AAC9C,mBAAS,MAAM,WAAW,GAAG;AAAA,QACjC,OAAO;AACH,gBAAM;AAAA,QACV;AAAA,MACJ;AACA,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,MAAM,MAAM,OAAO,CAAC,EAAE;AAAA,IACpF,SAAS,KAAU;AACf,YAAM,MAAM,KAAK,WAAW,OAAO,GAAG;AACtC,aAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,EAAE,SAAS,OAAO,OAAO,IAAI,CAAC,EAAE;AAAA,IACnF;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,SAAiB,QAAgB,MAAW,OAAY,UAA8D;AACjI,QAAI;AACJ,QAAI;AACA,kBAAY,MAAM,KAAK,eAAe,IAAI;AAAA,IAC9C,QAAQ;AAAA,IAER;AAEA,QAAI,CAAC,WAAW;AACZ,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU;AAAA,UACN,QAAQ;AAAA,UACR,MAAM,EAAE,SAAS,OAAO,OAAO,EAAE,SAAS,gCAAgC,MAAM,IAAI,EAAE;AAAA,QAC1F;AAAA,MACJ;AAAA,IACJ;AAIA,UAAM,WAAW,UAAU,OAAO;AAGlC,UAAM,aAAa,CAAC,SAAiB,SAAgD;AACjF,YAAM,eAAe,QAAQ,MAAM,GAAG;AACtC,YAAM,YAAY,KAAK,MAAM,GAAG;AAChC,UAAI,aAAa,WAAW,UAAU,OAAQ,QAAO;AACrD,YAAM,SAAiC,CAAC;AACxC,eAAS,IAAI,GAAG,IAAI,aAAa,QAAQ,KAAK;AAC1C,YAAI,aAAa,CAAC,EAAE,WAAW,GAAG,GAAG;AACjC,iBAAO,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC;AAAA,QACtD,WAAW,aAAa,CAAC,MAAM,UAAU,CAAC,GAAG;AACzC,iBAAO;AAAA,QACX;AAAA,MACJ;AACA,aAAO;AAAA,IACX;AAGA,UAAM,SAAU,KAAK,OAAe;AAIpC,QAAI,CAAC,QAAQ;AACT,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU;AAAA,UACN,QAAQ;AAAA,UACR,MAAM,EAAE,SAAS,OAAO,OAAO,EAAE,SAAS,yCAAyC,MAAM,IAAI,EAAE;AAAA,QACnG;AAAA,MACJ;AAAA,IACJ;AAEA,eAAW,SAAS,QAAQ;AACxB,UAAI,MAAM,WAAW,OAAQ;AAC7B,YAAM,SAAS,WAAW,MAAM,MAAM,QAAQ;AAC9C,UAAI,WAAW,KAAM;AAErB,YAAM,SAAS,MAAM,MAAM,QAAQ,EAAE,MAAM,QAAQ,MAAM,CAAC;AAE1D,UAAI,OAAO,UAAU,OAAO,QAAQ;AAEhC,eAAO;AAAA,UACH,SAAS;AAAA,UACT,QAAQ;AAAA,YACJ,MAAM;AAAA,YACN,aAAa,OAAO,mBACd,8BACA;AAAA,YACN,QAAQ,OAAO;AAAA,YACf,kBAAkB,OAAO;AAAA,YACzB,SAAS;AAAA,cACL,gBAAgB,OAAO,mBACjB,8BACA;AAAA,cACN,iBAAiB;AAAA,cACjB,cAAc;AAAA,YAClB;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ;AAEA,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU;AAAA,UACN,QAAQ,OAAO;AAAA,UACf,MAAM,OAAO;AAAA,QACjB;AAAA,MACJ;AAAA,IACJ;AAEA,WAAO;AAAA,MACH,SAAS;AAAA,MACT,UAAU,KAAK,cAAc,OAAO;AAAA,IACxC;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,QAAgB,MAAc,MAAW,OAAY,SAA8B,QAAgD;AAC9I,QAAI,YAAY,KAAK,QAAQ,OAAO,EAAE;AAItC,UAAM,KAAK,0BAA0B,SAAS,SAAS;AASvD,QAAI,KAAK,iBAAiB,QAAQ,iBAAiB,QAAQ,kBAAkB,YAAY;AACrF,WAAK,SAAS,MAAM,KAAK,cAAc,YAAY,QAAQ,aAAa;AAAA,IAC5E,OAAO;AACH,WAAK,SAAS,KAAK;AAAA,IACvB;AAGA,QAAI,KAAK,gBAAgB,QAAQ,iBAAiB,QAAQ,kBAAkB,YAAY;AACpF,WAAK,aAAa,MAAM,QAAQ,aAAa;AAAA,IACjD;AAKA,QAAI;AACA,cAAQ,mBAAmB,MAAM,wBAAwB;AAAA,QACrD,YAAY,CAAC,MAAc,KAAK,eAAe,GAAG,QAAQ,aAAa;AAAA,QACvE,OAAO,MAAM,QAAQ,QAAQ,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,QAC3E,SAAS,QAAQ;AAAA,MACrB,CAAC;AAAA,IACL,QAAQ;AAAA,IAER;AAMA,UAAM,YAAY,MAAM,KAAK,yBAAyB,SAAS,SAAS;AACxE,QAAI,WAAW;AACX,aAAO,EAAE,SAAS,MAAM,UAAU,UAAU;AAAA,IAChD;AAOA,QAAI,CAAC,UAAU,WAAW,SAAS,GAAG;AAClC,YAAM,cAAc,UAAU,MAAM,4BAA4B;AAChE,UAAI,aAAa;AACb,oBAAY,YAAY,CAAC,KAAK;AAAA,MAClC;AAAA,IACJ;AAKA,QAAI;AACJ,WAAK,cAAc,gBAAgB,cAAc,OAAO,WAAW,OAAO;AACrE,cAAM,OAAO,MAAM,KAAK,iBAAiB,UAAU,EAAE;AACrD,eAAO;AAAA,UACH,SAAS;AAAA,UACT,UAAU,KAAK,QAAQ,IAAI;AAAA,QAC/B;AAAA,MACL;AAGA,UAAI,cAAc,aAAa,WAAW,OAAO;AAC7C,eAAO;AAAA,UACH,SAAS;AAAA,UACT,UAAU,KAAK,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,YAClC,SAAS;AAAA,YACT,QAAQ,OAAO,YAAY,cAAc,QAAQ,OAAO,IAAI;AAAA,UAChE,CAAC;AAAA,QACL;AAAA,MACJ;AAMA,UAAI,UAAU,WAAW,OAAO,GAAG;AAC/B,eAAO,KAAK,WAAW,UAAU,UAAU,CAAC,GAAG,QAAQ,MAAM,OAAO;AAAA,MACxE;AAEA,UAAI,UAAU,WAAW,OAAO,GAAG;AAC9B,eAAO,KAAK,eAAe,UAAU,UAAU,CAAC,GAAG,SAAS,QAAQ,MAAM,KAAK;AAAA,MACpF;AAEA,UAAI,UAAU,WAAW,OAAO,GAAG;AAC/B,eAAO,KAAK,WAAW,UAAU,UAAU,CAAC,GAAG,QAAQ,MAAM,OAAO,OAAO;AAAA,MAC/E;AAEA,UAAI,UAAU,WAAW,UAAU,GAAG;AACjC,YAAI,WAAW,OAAQ,QAAO,KAAK,cAAc,MAAM,OAAO;AAAA,MAEnE;AAEA,UAAI,UAAU,WAAW,UAAU,GAAG;AACjC,eAAO,KAAK,cAAc,UAAU,UAAU,CAAC,GAAG,QAAQ,MAAM,OAAO;AAAA,MAC5E;AAEA,UAAI,UAAU,WAAW,KAAK,GAAG;AAC5B,eAAO,KAAK,SAAS,UAAU,UAAU,CAAC,GAAG,OAAO,OAAO;AAAA,MAChE;AAEA,UAAI,UAAU,WAAW,aAAa,GAAG;AACpC,eAAO,KAAK,iBAAiB,UAAU,UAAU,EAAE,GAAG,QAAQ,MAAM,SAAS,KAAK;AAAA,MACvF;AAEA,UAAI,UAAU,WAAW,UAAU,GAAG;AACjC,eAAO,KAAK,cAAc,UAAU,UAAU,CAAC,GAAG,QAAQ,MAAM,OAAO;AAAA,MAC5E;AAEA,UAAI,UAAU,WAAW,YAAY,GAAG;AACnC,eAAO,KAAK,gBAAgB,UAAU,UAAU,EAAE,GAAG,QAAQ,MAAM,OAAO;AAAA,MAC/E;AAEA,UAAI,UAAU,WAAW,WAAW,GAAG;AAClC,eAAO,KAAK,eAAe,UAAU,UAAU,CAAC,GAAG,QAAQ,MAAM,OAAO,OAAO;AAAA,MACpF;AAEA,UAAI,UAAU,WAAW,QAAQ,GAAG;AAC/B,eAAO,KAAK,YAAY,UAAU,UAAU,CAAC,GAAG,QAAQ,MAAM,OAAO,OAAO;AAAA,MACjF;AAEA,UAAI,UAAU,WAAW,OAAO,GAAG;AAC9B,eAAO,KAAK,WAAW,UAAU,UAAU,CAAC,GAAG,QAAQ,OAAO,OAAO;AAAA,MAC1E;AAGA,UAAI,UAAU,WAAW,KAAK,GAAG;AAC5B,eAAO,KAAK,SAAS,WAAW,QAAQ,MAAM,OAAO,OAAO;AAAA,MACjE;AAGA,UAAI,cAAc,mBAAmB,WAAW,OAAO;AAClD,YAAI;AACD,gBAAM,UAAU,MAAM,KAAK,eAAe,YAAY,QAAQ,aAAa;AAC3E,cAAI,WAAW,OAAQ,QAAgB,oBAAoB,YAAY;AACnE,kBAAMC,UAAS,MAAO,QAAgB,gBAAgB,CAAC,CAAC;AACxD,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQA,OAAM,EAAE;AAAA,UAC3D;AAAA,QACH,SAAS,GAAG;AAAA,QAEZ;AAAA,MACL;AAIA,YAAM,SAAS,MAAM,KAAK,kBAAkB,WAAW,QAAQ,MAAM,OAAO,OAAO;AACnF,UAAI,OAAO,QAAS,QAAO;AAG3B,aAAO;AAAA,QACH,SAAS;AAAA,QACT,UAAU,KAAK,cAAc,SAAS;AAAA,MAC1C;AAAA,IACA,SAAS,GAAG;AACR,UAAI,wBAAwB,CAAC,GAAG;AAC5B,eAAO;AAAA,UACH,SAAS;AAAA,UACT,UAAU,KAAK,MAAM,EAAE,SAAS,KAAK,EAAE,MAAM,qBAAqB,GAAI,EAAE,WAAW,CAAC,EAAG,CAAC;AAAA,QAC5F;AAAA,MACJ;AACA,YAAM;AAAA,IACV;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,MAAc,QAAgB,MAAW,OAAY,SAA6D;AACtI,QAAI;AAEA,YAAM,UAAU,MAAM,KAAK,eAAe,YAAY,QAAQ,aAAa;AAC3E,UAAI,CAAC,WAAW,OAAQ,QAAgB,kBAAkB,YAAY;AAClE,eAAO,EAAE,SAAS,MAAM;AAAA,MAC5B;AACA,YAAM,WAAW,MAAO,QAAgB,cAAc,EAAE,MAAM,OAAO,CAAC;AAEtE,UAAI,UAAU;AAEV,YAAI,SAAS,SAAS,QAAQ;AAC1B,gBAAM,gBAAgB,MAAM,KAAK,eAAe,YAAY;AAC5D,cAAI,CAAC,iBAAiB,OAAQ,cAAsB,YAAY,YAAY;AACxE,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,oCAAoC,GAAG,EAAE;AAAA,UAC1F;AACA,gBAAM,SAAS,MAAO,cAAsB,QAAQ;AAAA,YAChD,QAAQ,SAAS;AAAA,YACjB,QAAQ,EAAE,GAAG,OAAO,GAAG,MAAM,UAAU,QAAQ,QAAQ;AAAA,UAC3D,CAAC;AACA,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,QAC5D;AAEA,YAAI,SAAS,SAAS,UAAU;AAC5B,gBAAM,gBAAgB,MAAM,KAAK,eAAe,YAAY;AAC5D,cAAI,CAAC,iBAAiB,OAAQ,cAAsB,cAAc,YAAY;AAC1E,mBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,MAAM,oCAAoC,GAAG,EAAE;AAAA,UAC1F;AACC,gBAAM,SAAS,MAAO,cAAsB,UAAU;AAAA,YACnD,YAAY,SAAS;AAAA,YACrB,SAAS,EAAE,GAAG,OAAO,GAAG,MAAM,SAAS,QAAQ,QAAQ;AAAA,UAC3D,CAAC;AACA,iBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,QAC5D;AAEA,YAAI,SAAS,SAAS,oBAAoB;AAEtC,cAAI,SAAS,cAAc;AACvB,kBAAM,EAAE,QAAQ,UAAU,IAAI,SAAS;AAEvC,gBAAI,cAAc,QAAQ;AACrB,oBAAM,SAAS,MAAM,KAAK,SAAS,SAAS,EAAE,QAAQ,MAAM,CAAC;AAE7D,qBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,OAAO,SAAS,EAAE,OAAO,OAAO,MAAM,CAAC,EAAE;AAAA,YAC7F;AACA,gBAAI,cAAc,SAAS,MAAM,IAAI;AAChC,oBAAM,SAAS,MAAM,KAAK,SAAS,OAAO,EAAE,QAAQ,IAAI,MAAM,GAAG,CAAC;AAClE,qBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,YAC5D;AACC,gBAAI,cAAc,UAAU;AACxB,oBAAM,SAAS,MAAM,KAAK,SAAS,UAAU,EAAE,QAAQ,MAAM,KAAK,CAAC;AACnE,qBAAO,EAAE,SAAS,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AAAA,YAC5D;AAAA,UACJ;AAAA,QACJ;AAEA,YAAI,SAAS,SAAS,SAAS;AAC1B,iBAAO;AAAA,YACH,SAAS;AAAA,YACT,UAAU;AAAA,cACN,QAAQ;AAAA,cACR,MAAM,EAAE,OAAO,MAAM,QAAQ,SAAS,QAAQ,MAAM,+CAA+C;AAAA,YACvG;AAAA,UACJ;AAAA,QACL;AAAA,MACJ;AAAA,IACJ,SAAS,GAAG;AAAA,IAGZ;AAEA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC5B;AACJ;AAvwHa,gBAsBe,0BAA0B;AAAA;AAtBzC,gBAwBe,wBAAwB;AAAA;AAxBvC,gBA0Be,kBAAkB;AA1BvC,IAAM,iBAAN;;;AETA,SAAS,qBAAqB,OAA+B,CAAC,GAA2B;AAC9F,QAAM,IAA4B,CAAC;AAEnC,MAAI,KAAK,0BAA0B,OAAO;AACxC,MAAE,yBAAyB,IACzB,KAAK,yBAAyB;AAAA,EAClC;AAEA,MAAI,KAAK,MAAM;AACb,UAAM,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,CAAC;AACzD,UAAM,SAAS,IAAI,UAAU;AAC7B,UAAM,QAAQ,CAAC,WAAW,MAAM,EAAE;AAClC,QAAI,IAAI,qBAAqB,KAAM,OAAM,KAAK,mBAAmB;AACjE,QAAI,IAAI,QAAS,OAAM,KAAK,SAAS;AACrC,MAAE,2BAA2B,IAAI,MAAM,KAAK,IAAI;AAAA,EAClD;AAEA,IAAE,wBAAwB,IAAI;AAE9B,MAAI,KAAK,iBAAiB,OAAO;AAC/B,MAAE,iBAAiB,IAAI,KAAK,gBAAgB;AAAA,EAC9C;AAEA,MAAI,KAAK,mBAAmB,OAAO;AACjC,MAAE,iBAAiB,IAAI,KAAK,kBAAkB;AAAA,EAChD;AAEA,MAAI,KAAK,sBAAsB,OAAO;AACpC,MAAE,oBAAoB,IACpB,KAAK,qBAAqB;AAAA,EAC9B;AAEA,MAAI,KAAK,SAAS,OAAO;AACvB,MAAE,8BAA8B,IAAI,KAAK,QAAQ;AAAA,EACnD;AAEA,MAAI,KAAK,OAAO;AACd,WAAO,OAAO,GAAG,KAAK,KAAK;AAAA,EAC7B;AAEA,SAAO;AACT;;;AChEA,IAAM,cAAN,MAA4C;AAAA,EAI1C,YAAY,aAAa,KAAS;AAHlC,SAAQ,UAAU,oBAAI,IAAyB;AAI7C,SAAK,aAAa;AAAA,EACpB;AAAA,EAEA,IAAI,KAAsC;AACxC,WAAO,KAAK,QAAQ,IAAI,GAAG;AAAA,EAC7B;AAAA,EAEA,IAAI,KAAa,OAA0B;AAIzC,QAAI,KAAK,QAAQ,QAAQ,KAAK,YAAY;AACxC,YAAM,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,aAAa,EAAE,CAAC;AAC9D,YAAM,OAAO,KAAK,QAAQ,KAAK;AAC/B,eAAS,IAAI,GAAG,IAAI,WAAW,KAAK;AAClC,cAAM,IAAI,KAAK,KAAK,EAAE;AACtB,YAAI,CAAC,EAAG;AACR,aAAK,QAAQ,OAAO,CAAC;AAAA,MACvB;AAAA,IACF;AACA,SAAK,QAAQ,IAAI,KAAK,KAAK;AAAA,EAC7B;AAAA,EAEA,MAAM,aAA2B;AAC/B,UAAM,SAAS,KAAK,IAAI,IAAI;AAC5B,eAAW,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS;AACjC,UAAI,EAAE,aAAa,OAAQ,MAAK,QAAQ,OAAO,CAAC;AAAA,IAClD;AAAA,EACF;AACF;AAEO,IAAM,cAAN,MAAkB;AAAA,EAKvB,YAAY,QAA+B,OAAuD,CAAC,GAAG;AACpG,QAAI,OAAO,YAAY,EAAG,OAAM,IAAI,MAAM,mCAAmC;AAC7E,QAAI,OAAO,gBAAgB,EAAG,OAAM,IAAI,MAAM,uCAAuC;AACrF,SAAK,SAAS;AACd,SAAK,QAAQ,KAAK,SAAS,IAAI,YAAY;AAE3C,SAAK,MAAM,KAAK,OAAO,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAQ,KAAa,OAAO,KAAK,OAAO,eAAe,GAAsB;AAC3E,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK;AAExC,QAAI,QAAQ,KAAK,MAAM,IAAI,GAAG;AAC9B,QAAI,CAAC,OAAO;AACV,cAAQ,EAAE,QAAQ,UAAU,YAAY,IAAI;AAAA,IAC9C,OAAO;AACL,YAAM,cAAc,MAAM,MAAM,cAAc;AAC9C,UAAI,aAAa,GAAG;AAClB,gBAAQ;AAAA,UACN,QAAQ,KAAK,IAAI,UAAU,MAAM,SAAS,aAAa,YAAY;AAAA,UACnE,YAAY;AAAA,QACd;AAAA,MACF;AAAA,IACF;AAEA,QAAI,MAAM,UAAU,MAAM;AACxB,YAAM,UAAU;AAChB,WAAK,MAAM,IAAI,KAAK,KAAK;AACzB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAW,KAAK,MAAM,MAAM,MAAM;AAAA,QAClC,cAAc;AAAA,QACd,SAAS,MAAM,KAAK,MAAO,WAAW,MAAM,UAAU,eAAgB,GAAI;AAAA,MAC5E;AAAA,IACF;AAEA,UAAM,eAAe,OAAO,MAAM;AAClC,UAAM,eAAe,KAAK,KAAM,eAAe,eAAgB,GAAI;AACnE,SAAK,MAAM,IAAI,KAAK,KAAK;AACzB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW,KAAK,MAAM,MAAM,MAAM;AAAA,MAClC;AAAA,MACA,SAAS,MAAM;AAAA,IACjB;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,KAAmB;AACvB,SAAK,MAAM,IAAI,KAAK,EAAE,QAAQ,KAAK,OAAO,UAAU,YAAY,KAAK,IAAI,EAAE,CAAC;AAAA,EAC9E;AACF;AAuBO,IAAM,sBAAyC;AAAA,EACpD,MAAM,EAAE,UAAU,IAAI,cAAc,KAAK,GAAG;AAAA,EAC5C,OAAO,EAAE,UAAU,IAAI,cAAc,KAAK,GAAG;AAAA,EAC7C,MAAM,EAAE,UAAU,KAAK,cAAc,MAAM,GAAG;AAChD;;;ACxJA,IAAM,wBAAwB;AAO9B,IAAM,qBAAqB;AASpB,SAAS,iBAAiB,SAAsC;AACnE,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAkC,GAAG;AACrE,QAAI,EAAE,YAAY,MAAM,eAAgB;AACxC,UAAM,MAAM,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI;AACtC,QAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,UAAM,UAAU,IAAI,KAAK;AACzB,QAAI,CAAC,WAAW,QAAQ,SAAS,sBAAuB,QAAO;AAC/D,QAAI,CAAC,mBAAmB,KAAK,OAAO,EAAG,QAAO;AAC9C,WAAO;AAAA,EACX;AACA,SAAO;AACX;AAWO,SAAS,oBAA4B;AACxC,QAAM,IACD,WAAqE;AAC1E,MAAI,KAAK,OAAO,EAAE,eAAe,YAAY;AACzC,WAAO,OAAO,EAAE,WAAW,EAAE,QAAQ,MAAM,EAAE,CAAC;AAAA,EAClD;AACA,QAAM,IAAI,KAAK,IAAI,EAAE,SAAS,EAAE;AAChC,QAAM,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,EAAE;AAChD,SAAO,OAAO,CAAC,GAAG,CAAC;AACvB;AAKO,SAAS,iBACZ,SACA,WAAyB,mBACnB;AACN,SAAO,iBAAiB,OAAO,KAAK,SAAS;AACjD;AAWA,IAAM,sBAAsB;AAOrB,SAAS,iBAAiB,OAA0C;AACvE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,IAAI,oBAAoB,KAAK,MAAM,KAAK,EAAE,YAAY,CAAC;AAC7D,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,CAAC,EAAE,SAAS,SAAS,QAAQ,KAAK,IAAI;AAC5C,MAAI,YAAY,KAAM,QAAO;AAC7B,MAAI,OAAO,KAAK,OAAO,KAAK,OAAO,KAAK,MAAM,EAAG,QAAO;AACxD,QAAM,WAAW,SAAS,OAAO,EAAE,IAAI,OAAU;AACjD,SAAO,EAAE,SAAS,QAAQ,QAAQ;AACtC;AAMO,SAAS,kBAAkB,KAA2B;AACzD,QAAM,OAAO,IAAI,UAAU,OAAO;AAClC,SAAO,MAAM,IAAI,OAAO,IAAI,IAAI,MAAM,IAAI,IAAI;AAClD;;;ACzGA;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,OAGG;;;ACZP;AAAA,EACI;AAAA,EACA;AAAA,OAGG;;;ACwCA,SAAS,uBACZ,QACA,OACA,SACA,OAA0B,CAAC,GACU;AACrC,QAAM,UAAU,KAAK,WAAW,IAAI,oBAAoB;AACxD,QAAM,gBAAgB,KAAK,iBAAiB,IAAI,kBAAkB;AAClE,QAAMC,qBAAoB,KAAK;AAC/B,QAAM,kBAAkB,KAAK,mBAAmB;AAChD,QAAM,MAAM,KAAK,OAAO,KAAK;AAE7B,SAAO,OAAO,KAAU,QAAa;AACjC,UAAM,YAAY,iBAAiB,KAAK,SAASA,kBAAiB;AAClE,QAAI;AACA,MAAC,IAAY,YAAY;AAAA,IAC7B,QAAQ;AAAA,IAER;AACA,QAAI,OAAO,KAAK,WAAW,YAAY;AACnC,UAAI;AACA,YAAI,OAAO,iBAAiB,SAAS;AAAA,MACzC,QAAQ;AAAA,MAER;AAAA,IACJ;AAKA,QAAI,SAAS;AACb,UAAM,aACF,OAAO,KAAK,WAAW,aAAa,IAAI,OAAO,KAAK,GAAG,IAAI;AAC/D,QAAI,YAAY;AACZ,UAAI,SAAS,CAAC,SAAiB;AAC3B,iBAAS;AACT,eAAO,WAAW,IAAI;AAAA,MAC1B;AAAA,IACJ;AAEA,UAAM,YAAY,IAAI;AACtB,QAAI,QAAQ;AACZ,QAAI;AACA,YAAM,QAAQ,KAAK,GAAG;AAAA,IAC1B,SAAS,KAAU;AACf,cAAQ;AACR,eAAS,KAAK,cAAc;AAC5B,cAAQ,QAAQ,gBAAgB,wBAAwB,EAAE,QAAQ,MAAM,CAAC;AACzE,UAAI,UAAU,KAAK;AACf,mBAAW,eAAe,KAAK,EAAE,WAAW,QAAQ,MAAM,CAAC;AAAA,MAC/D;AACA,YAAM;AAAA,IACV,UAAE;AACE,YAAM,UAAU,IAAI,IAAI;AACxB,cAAQ,QAAQ,gBAAgB,mBAAmB;AAAA,QAC/C;AAAA,QACA;AAAA,QACA,QAAQ,OAAO,MAAM;AAAA,MACzB,CAAC;AACD,cAAQ;AAAA,QACJ,gBAAgB;AAAA,QAChB;AAAA,QACA,EAAE,QAAQ,MAAM;AAAA,MACpB;AAKA,UAAI,CAAC,SAAS,UAAU,KAAK;AACzB,cAAM,WAAY,KAAa;AAC/B,YAAI,aAAa,QAAW;AACxB,qBAAW,eAAe,UAAU,EAAE,WAAW,QAAQ,MAAM,CAAC;AAAA,QACpE;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AACJ;AAEA,SAAS,WACL,UACA,KACA,KACI;AACJ,MAAI;AACA,aAAS,iBAAiB,KAAK,GAAG;AAAA,EACtC,QAAQ;AAAA,EAER;AACJ;;;ACxIA;AAAA,EACI;AAAA,EACA;AAAA,OACG;AAgEA,IAAM,6BAAN,MAAmD;AAAA,EAOtD,YAAY,UAA6C,CAAC,GAAG;AAN7D,gBAAO;AACP,mBAAU;AACV,gBAAO;AAKH,SAAK,UAAU;AAAA,EACnB;AAAA,EAEA,MAAM,KAAK,KAAmC;AAC1C,UAAM,UAAU,KAAK,QAAQ,WAAW,IAAI,oBAAoB;AAChE,UAAM,SAAS,KAAK,QAAQ,UAAU,IAAI,kBAAkB;AAC5D,QAAI,gBAAgB,+BAA+B,OAAO;AAC1D,QAAI,gBAAgB,8BAA8B,MAAM;AACxD,QAAI,OAAO;AAAA,MACP,kDAAmD,QAAgB,aAAa,QAAQ,SAAS,WAAY,OAAe,aAAa,QAAQ,SAAS;AAAA,IAC9J;AAAA,EACJ;AACJ;AAUO,SAAS,eACZ,KACA,UACe;AACf,MAAI,SAAU,QAAO;AACrB,MAAI;AACA,UAAM,IAAI,IAAI,WAAwC,6BAA6B;AACnF,QAAI,EAAG,QAAO;AAAA,EAClB,QAAQ;AAAA,EAER;AACA,SAAO,IAAI,oBAAoB;AACnC;AAKO,SAAS,qBACZ,KACA,UACa;AACb,MAAI,SAAU,QAAO;AACrB,MAAI;AACA,UAAM,IAAI,IAAI,WAAsC,4BAA4B;AAChF,QAAI,EAAG,QAAO;AAAA,EAClB,QAAQ;AAAA,EAER;AACA,SAAO,IAAI,kBAAkB;AACjC;;;ACrBA,SAAS,mBACL,OACA,QACA,WACA,iBACO;AACP,QAAM,UAAU,OAAO,KAAU,QAAa;AAC1C,QAAI;AACA,YAAM,SAAS,MAAM,MAAM,QAAQ;AAAA,QAC/B,MAAM,IAAI;AAAA,QACV,QAAQ,IAAI;AAAA,QACZ,OAAO,IAAI;AAAA,MACf,CAAC;AAED,UAAI,OAAO,UAAU,OAAO,QAAQ;AAEhC,YAAI,OAAO,OAAO,MAAM;AAExB,YAAI,iBAAiB;AACjB,qBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AAClD,gBAAI,OAAO,GAAG,CAAC;AAAA,UACnB;AAAA,QACJ;AAGA,YAAI,OAAO,SAAS;AAChB,qBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AACjD,gBAAI,OAAO,GAAG,OAAO,CAAC,CAAC;AAAA,UAC3B;AAAA,QACJ,OAAO;AACH,cAAI,OAAO,gBAAgB,mBAAmB;AAC9C,cAAI,OAAO,iBAAiB,UAAU;AACtC,cAAI,OAAO,cAAc,YAAY;AAAA,QACzC;AAGA,YAAI,OAAO,IAAI,UAAU,cAAc,OAAO,IAAI,QAAQ,YAAY;AAClE,2BAAiB,SAAS,OAAO,QAAQ;AACrC,gBAAI,MAAM,OAAO,UAAU,WAAW,QAAQ,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA;AAAA,CAAM;AAAA,UACtF;AACA,cAAI,IAAI;AAAA,QACZ,OAAO;AAEH,gBAAM,SAAS,CAAC;AAChB,2BAAiB,SAAS,OAAO,QAAQ;AACrC,mBAAO,KAAK,KAAK;AAAA,UACrB;AACA,cAAI,KAAK,EAAE,OAAO,CAAC;AAAA,QACvB;AAAA,MACJ,OAAO;AACH,YAAI,OAAO,OAAO,MAAM;AACxB,YAAI,iBAAiB;AACjB,qBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AAClD,gBAAI,OAAO,GAAG,CAAC;AAAA,UACnB;AAAA,QACJ;AACA,YAAI,OAAO,SAAS,QAAW;AAC3B,cAAI,KAAK,OAAO,IAAI;AAAA,QACxB,OAAO;AACH,cAAI,IAAI;AAAA,QACZ;AAAA,MACJ;AAAA,IACJ,SAAS,KAAU;AACf,wBAAkB,KAAK,KAAK,eAAe;AAAA,IAC/C;AAAA,EACJ;AAEA,QAAM,IAAI,MAAM,OAAO,YAAY;AACnC,MAAI,MAAM,SAAS,OAAO,OAAO,QAAQ,YAAY;AACjD,WAAO,IAAI,WAAW,OAAO;AAC7B,WAAO;AAAA,EACX,WAAW,MAAM,UAAU,OAAO,OAAO,SAAS,YAAY;AAC1D,WAAO,KAAK,WAAW,OAAO;AAC9B,WAAO;AAAA,EACX,WAAW,MAAM,YAAY,OAAO,OAAO,WAAW,YAAY;AAC9D,WAAO,OAAO,WAAW,OAAO;AAChC,WAAO;AAAA,EACX;AACA,SAAO;AACX;AAUA,SAAS,eACL,QACA,KACA,iBACI;AACJ,QAAM,uBAAuB,MAAM;AAC/B,QAAI,CAAC,gBAAiB;AACtB,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AAKlD,UAAI,OAAO,GAAG,CAAC;AAAA,IACnB;AAAA,EACJ;AAEA,MAAI,OAAO,SAAS;AAChB,QAAI,OAAO,UAAU;AACjB,UAAI,OAAO,OAAO,SAAS,MAAM;AACjC,2BAAqB;AACrB,UAAI,OAAO,SAAS,SAAS;AACzB,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,SAAS,OAAO,GAAG;AAC1D,cAAI,OAAO,GAAG,CAAC;AAAA,QACnB;AAAA,MACJ;AACA,UAAI,KAAK,OAAO,SAAS,IAAI;AAC7B;AAAA,IACJ;AACA,QAAI,OAAO,QAAQ;AAQf,YAAM,IAAI,OAAO;AACjB,YAAM,WAAW,KAAK,OAAO,MAAM,aAAa,EAAE,SAAS,YAAY,EAAE,WAAW,SAAS,EAAE;AAC/F,UAAI,YAAY,OAAO,IAAI,UAAU,cAAc,OAAO,IAAI,QAAQ,YAAY;AAC9E,YAAI,OAAO,OAAO,EAAE,WAAW,WAAW,EAAE,SAAS,GAAG;AACxD,6BAAqB;AACrB,YAAI,EAAE,WAAW,OAAO,EAAE,YAAY,UAAU;AAC5C,qBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,OAAO,GAAG;AAC5C,gBAAI,OAAO,GAAG,OAAO,CAAC,CAAC;AAAA,UAC3B;AAAA,QACJ,OAAO;AACH,cAAI,OAAO,gBAAgB,EAAE,eAAe,mBAAmB;AAC/D,cAAI,OAAO,iBAAiB,UAAU;AACtC,cAAI,OAAO,cAAc,YAAY;AAAA,QACzC;AAMA,YAAI,MAAM,EAAE;AAGZ,SAAC,YAAY;AACT,cAAI;AACA,6BAAiB,SAAS,EAAE,QAAkC;AAC1D,kBAAI,SAAS,KAAM;AACnB,kBAAI,MAAM,OAAO,UAAU,WAAW,QAAQ,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA;AAAA,CAAM;AAAA,YACtF;AAAA,UACJ,SAAS,WAAW;AAChB,gBAAI;AACA,kBAAI,MAAM;AAAA,QAAuB,KAAK,UAAU,EAAE,SAAS,qBAAqB,QAAQ,UAAU,UAAU,OAAO,SAAS,EAAE,CAAC,CAAC;AAAA;AAAA,CAAM;AAAA,YAC1I,QAAQ;AAAA,YAAgC;AAAA,UAC5C,UAAE;AACE,gBAAI;AAAE,kBAAI,IAAI;AAAA,YAAG,QAAQ;AAAA,YAAa;AAAA,UAC1C;AAAA,QACJ,GAAG;AACH;AAAA,MACJ;AACA,UAAI,OAAO,GAAG;AACd,2BAAqB;AACrB,UAAI,KAAK,OAAO,MAAM;AACtB;AAAA,IACJ;AAAA,EACJ;AAEA,MAAI,OAAO,GAAG;AACd,uBAAqB;AACrB,MAAI,KAAK;AAAA,IACL,SAAS;AAAA,IACT,OAAO;AAAA,MACH,SAAS;AAAA,MACT,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACV;AAAA,EACJ,CAAC;AACL;AAEA,SAAS,kBAAkB,KAAU,KAAU,iBAAgD;AAC3F,QAAM,OAAO,IAAI,cAAc;AAC/B,MAAI,OAAO,IAAI;AACf,MAAI,iBAAiB;AACjB,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AAClD,UAAI,OAAO,GAAG,CAAC;AAAA,IACnB;AAAA,EACJ;AAKA,MAAI,QAAQ,KAAK;AACb,QAAI;AACA,MAAC,IAAY,qBAAqB;AAAA,IACtC,QAAQ;AAAA,IAER;AAAA,EACJ;AACA,MAAI,KAAK;AAAA,IACL,SAAS;AAAA,IACT,OAAO,EAAE,SAAS,IAAI,WAAW,yBAAyB,KAAK;AAAA,EACnE,CAAC;AACL;AAsBO,SAAS,uBAAuB,SAAiC,CAAC,GAAW;AAChF,SAAO;AAAA,IACH,MAAM;AAAA,IACN,SAAS;AAAA,IAET,MAAM,OAAO,SAAwB;AAAA,IAErC;AAAA,IAEA,OAAO,OAAO,QAAuB;AACjC,UAAI;AACJ,UAAI;AACA,iBAAS,IAAI,WAAwB,aAAa;AAAA,MACtD,QAAQ;AAEJ;AAAA,MACJ;AACA,UAAI,CAAC,OAAQ;AAEb,YAAM,SAAS,IAAI,UAAU;AAG7B,YAAM,oBACF,OAAO,6BAA6B,OAAO,SAAS,wBAAwB;AAChF,YAAM,aAAa,IAAI,eAAe,QAAQ,QAAW;AAAA,QACrD,0BAA0B;AAAA,MAC9B,CAAC;AACD,YAAM,SAAS,OAAO,UAAU;AAOhC,YAAM,kBACF,OAAO,oBAAoB,QACrB,SACA;AAAA,QACI,OAAO,OAAO,oBAAoB,WAC5B,OAAO,kBACP,CAAC;AAAA,MACX;AAMV,YAAM,aAAa,CAAC,QAA8B,QAC9C,eAAe,QAAQ,KAAK,eAAe;AAC/C,YAAM,gBAAgB,CAAC,KAAU,QAC7B,kBAAkB,KAAK,KAAK,eAAe;AAI/C,YAAM,UACF,OAAO,eAAe,WAAW,IAAI,oBAAoB;AAC7D,YAAM,gBACF,OAAO,eAAe,iBAAiB,IAAI,kBAAkB;AACjE,YAAMC,qBAAoB,OAAO,eAAe;AAChD,YAAM,kBACF,OAAO,eAAe,mBAAmB;AAQ7C,YAAM,YAAY;AAClB,eAAS,IAAI,MAAM,WAAW;AAAA,QAC1B,IAAI,QAAQ,MAAM,UAAU;AACxB,cAAI,SAAS,SAAS,SAAS,UAAU,SAAS,UAAU;AACxD,kBAAM,SAAS,OAAO,IAAI,EAAE,YAAY;AACxC,kBAAM,WAAY,OAAe,IAAI;AACrC,gBAAI,OAAO,aAAa,WAAY,QAAO;AAC3C,mBAAO,CAAC,OAAe,YAAiB;AACpC,qBAAO,SAAS;AAAA,gBACZ;AAAA,gBACA;AAAA,gBACA,uBAAuB,QAAQ,OAAO,SAAS;AAAA,kBAC3C;AAAA,kBACA;AAAA,kBACA,mBAAAA;AAAA,kBACA;AAAA,gBACJ,CAAC;AAAA,cACL;AAAA,YACJ;AAAA,UACJ;AACA,iBAAO,QAAQ,IAAI,QAAQ,MAAM,QAAQ;AAAA,QAC7C;AAAA,MACJ,CAAC;AAGD,aAAO,IAAI,4BAA4B,OAAO,MAAW,QAAa;AAClE,YAAI,iBAAiB;AACjB,qBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AAClD,gBAAI,OAAO,GAAG,CAAC;AAAA,UACnB;AAAA,QACJ;AACA,YAAI,KAAK,EAAE,MAAM,MAAM,WAAW,iBAAiB,MAAM,EAAE,CAAC;AAAA,MAChE,CAAC;AAGD,aAAO,IAAI,GAAG,MAAM,cAAc,OAAO,MAAW,QAAa;AAC7D,YAAI,iBAAiB;AACjB,qBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AAClD,gBAAI,OAAO,GAAG,CAAC;AAAA,UACnB;AAAA,QACJ;AACA,YAAI,KAAK,EAAE,MAAM,MAAM,WAAW,iBAAiB,MAAM,EAAE,CAAC;AAAA,MAChE,CAAC;AAGD,aAAO,IAAI,GAAG,MAAM,WAAW,OAAO,MAAW,QAAa;AAC1D,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,WAAW,QAAW,CAAC,GAAG,EAAE,SAAS,KAAK,CAAC;AAC3F,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAaD,aAAO,KAAK,GAAG,MAAM,eAAe,OAAO,KAAU,QAAa;AAC9D,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,WAAW,SAAS,QAAQ,IAAI,MAAM,EAAE,SAAS,IAAI,CAAC;AACtF,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAGD,aAAO,KAAK,GAAG,MAAM,YAAY,OAAO,KAAU,QAAa;AAC3D,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,cAAc,IAAI,MAAM,EAAE,SAAS,IAAI,CAAC;AACxE,cAAI,iBAAiB;AACjB,uBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AAClD,kBAAI,OAAO,GAAG,CAAC;AAAA,YACnB;AAAA,UACJ;AACA,cAAI,KAAK,MAAM;AAAA,QACnB,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAMD,aAAO,KAAK,GAAG,MAAM,oBAAoB,OAAO,KAAU,QAAa;AACnE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,oBAAoB,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC1G,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,mBAAmB,OAAO,KAAU,QAAa;AACjE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,mBAAmB,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACzG,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,kBAAkB,OAAO,KAAU,QAAa;AACjE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,kBAAkB,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACxG,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAGD,aAAO,IAAI,GAAG,MAAM,aAAa,OAAO,KAAU,QAAa;AAC3D,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,eAAe,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACzF,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,aAAa,OAAO,KAAU,QAAa;AAC5D,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,eAAe,IAAI,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACzF,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,iBAAiB,OAAO,KAAU,QAAa;AAC/D,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,eAAe,IAAI,IAAI,OAAO,EAAE,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC1G,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,OAAO,GAAG,MAAM,iBAAiB,OAAO,KAAU,QAAa;AAClE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,eAAe,IAAI,IAAI,OAAO,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACtG,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,MAAM,GAAG,MAAM,wBAAwB,OAAO,KAAU,QAAa;AACxE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,eAAe,IAAI,IAAI,OAAO,EAAE,WAAW,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AAC5G,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,MAAM,GAAG,MAAM,yBAAyB,OAAO,KAAU,QAAa;AACzE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,eAAe,IAAI,IAAI,OAAO,EAAE,YAAY,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AAC7G,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,yBAAyB,OAAO,KAAU,QAAa;AACxE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,eAAe,IAAI,IAAI,OAAO,EAAE,YAAY,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AAClH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,wBAAwB,OAAO,KAAU,QAAa;AACvE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,eAAe,IAAI,IAAI,OAAO,EAAE,WAAW,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACjH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAGD,aAAO,IAAI,GAAG,MAAM,kBAAkB,OAAO,KAAU,QAAa;AAChE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,YAAY,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC9F,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAMD,aAAO,KAAK,GAAG,MAAM,sCAAsC,OAAO,KAAU,QAAa;AACrF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,gCAAgC,QAAQ,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACzH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,oBAAoB,OAAO,KAAU,QAAa;AAClE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,cAAc,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAChG,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,uBAAuB,OAAO,KAAU,QAAa;AACrE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC/F,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,uBAAuB,OAAO,KAAU,QAAa;AACtE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AAC/F,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,2BAA2B,OAAO,KAAU,QAAa;AACzE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAChH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,MAAM,GAAG,MAAM,2BAA2B,OAAO,KAAU,QAAa;AAC3E,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,IAAI,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACjH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,OAAO,GAAG,MAAM,2BAA2B,OAAO,KAAU,QAAa;AAC5E,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,IAAI,UAAU,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACnH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,OAAO,GAAG,MAAM,4BAA4B,OAAO,KAAU,QAAa;AAC7E,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,kBAAkB,IAAI,OAAO,EAAE,IAAI,UAAU,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACxH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,oCAAoC,OAAO,KAAU,QAAa;AACnF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACzH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,oCAAoC,OAAO,KAAU,QAAa;AAClF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,OAAO,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACxH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,6CAA6C,OAAO,KAAU,QAAa;AAC5F,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,sBAAsB,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AAClI,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAGD,aAAO,KAAK,GAAG,MAAM,8CAA8C,OAAO,KAAU,QAAa;AAC7F,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,uBAAuB,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACnI,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,oCAAoC,OAAO,KAAU,QAAa;AACnF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACzH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,iCAAiC,OAAO,KAAU,QAAa;AAChF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,UAAU,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACtH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,mCAAmC,OAAO,KAAU,QAAa;AACjF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,YAAY,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACxH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,mCAAmC,OAAO,KAAU,QAAa;AAClF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,YAAY,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACxH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,MAAM,GAAG,MAAM,6CAA6C,OAAO,KAAU,QAAa;AAC7F,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,YAAY,IAAI,OAAO,QAAQ,IAAI,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AAChJ,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,OAAO,GAAG,MAAM,6CAA6C,OAAO,KAAU,QAAa;AAC9F,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,YAAY,IAAI,OAAO,QAAQ,IAAI,UAAU,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACvJ,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAGD,aAAO,IAAI,GAAG,MAAM,oCAAoC,OAAO,KAAU,QAAa;AAClF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACzH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,oCAAoC,OAAO,KAAU,QAAa;AACnF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACzH,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,2CAA2C,OAAO,KAAU,QAAa;AACzF,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,IAAI,OAAO,KAAK,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC7I,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,OAAO,GAAG,MAAM,2CAA2C,OAAO,KAAU,QAAa;AAC5F,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,IAAI,OAAO,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACzI,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,MAAM,GAAG,MAAM,kDAAkD,OAAO,KAAU,QAAa;AAClG,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,IAAI,OAAO,KAAK,WAAW,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AAC/I,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,MAAM,GAAG,MAAM,mDAAmD,OAAO,KAAU,QAAa;AACnG,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,IAAI,OAAO,KAAK,YAAY,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AAChJ,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,KAAK,GAAG,MAAM,mDAAmD,OAAO,KAAU,QAAa;AAClG,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,YAAY,aAAa,IAAI,OAAO,EAAE,aAAa,IAAI,OAAO,KAAK,YAAY,QAAQ,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC;AACrJ,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAGD,aAAO,KAAK,GAAG,MAAM,mBAAmB,OAAO,KAAU,QAAa;AAClE,YAAI;AAEA,gBAAM,SAAS,MAAM,WAAW,cAAc,UAAU,QAAQ,IAAI,MAAM,EAAE,SAAS,IAAI,CAAC;AAC1F,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,qBAAqB,OAAO,KAAU,QAAa;AACnE,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,cAAc,QAAQ,IAAI,OAAO,EAAE,IAAI,OAAO,QAAW,EAAE,SAAS,IAAI,CAAC;AACzG,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AASD,aAAO,IAAI,GAAG,MAAM,iBAAiB,OAAO,KAAU,QAAa;AAC/D,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,iBAAiB,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACvG,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,8BAA8B,OAAO,KAAU,QAAa;AAC5E,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,sBAAsB,IAAI,OAAO,MAAM,IAAI,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACjI,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAED,aAAO,IAAI,GAAG,MAAM,gCAAgC,OAAO,KAAU,QAAa;AAC9E,YAAI;AACA,gBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,gBAAgB,IAAI,OAAO,MAAM,IAAI,IAAI,OAAO,MAAM,IAAI,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAChJ,qBAAW,QAAQ,GAAG;AAAA,QAC1B,SAAS,KAAU;AACf,wBAAc,KAAK,GAAG;AAAA,QAC1B;AAAA,MACJ,CAAC;AAUD,YAAM,2BAA2B,CAAC,SAAiB;AAC/C,eAAQ,IAAI,GAAG,IAAI,eAAe,OAAO,KAAU,QAAa;AAC5D,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,eAAe,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACrG,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,KAAK,GAAG,IAAI,eAAe,OAAO,KAAU,QAAa;AAC7D,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,eAAe,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACrG,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,IAAI,GAAG,IAAI,qBAAqB,OAAO,KAAU,QAAa;AAClE,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,eAAe,IAAI,OAAO,IAAI,IAAI,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACxH,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,IAAI,GAAG,IAAI,qBAAqB,OAAO,KAAU,QAAa;AAClE,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,eAAe,IAAI,OAAO,IAAI,IAAI,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACvH,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,OAAO,GAAG,IAAI,qBAAqB,OAAO,KAAU,QAAa;AACrE,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,UAAU,eAAe,IAAI,OAAO,IAAI,IAAI,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC3H,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,KAAK,GAAG,IAAI,6BAA6B,OAAO,KAAU,QAAa;AAC3E,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,uBAAuB,IAAI,OAAO,IAAI,IAAI,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAChI,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,KAAK,GAAG,IAAI,6BAA6B,OAAO,KAAU,QAAa;AAC3E,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,eAAe,IAAI,OAAO,IAAI,YAAY,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAChI,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,KAAK,GAAG,IAAI,4BAA4B,OAAO,KAAU,QAAa;AAC1E,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,eAAe,IAAI,OAAO,IAAI,WAAW,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC/H,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,IAAI,GAAG,IAAI,0BAA0B,OAAO,KAAU,QAAa;AACvE,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,eAAe,IAAI,OAAO,IAAI,SAAS,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC7H,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAED,eAAQ,IAAI,GAAG,IAAI,iCAAiC,OAAO,KAAU,QAAa;AAC9E,cAAI;AACA,kBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,eAAe,IAAI,OAAO,IAAI,SAAS,IAAI,OAAO,KAAK,IAAI,QAAW,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AACjJ,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAAA,MACL;AAYA,YAAM,mBAAmB,CAAC,SAAiB;AACvC,cAAM,YAA0D;AAAA,UAC5D,CAAC,OAAO,GAAG,IAAI,OAAO;AAAA,UACtB,CAAC,QAAQ,GAAG,IAAI,OAAO;AAAA,UACvB,CAAC,UAAU,GAAG,IAAI,OAAO;AAAA,UACzB,CAAC,OAAO,GAAG,IAAI,OAAO;AAAA,QAC1B;AACA,mBAAW,CAAC,QAAQ,OAAO,KAAK,WAAW;AACvC,UAAC,OAAgB,MAAM,EAAE,SAAS,OAAO,KAAU,QAAa;AAC5D,gBAAI;AAGA,oBAAM,WAAmB,IAAI,QAAQ;AACrC,oBAAM,MAAM,SAAS,YAAY,KAAK;AACtC,oBAAM,YAAY,OAAO,IAAI,SAAS,MAAM,GAAG,IAAI;AACnD,oBAAM,SAAS,MAAM,WAAW,SAAS,OAAO,YAAY,GAAG,WAAW,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC;AAC/G,yBAAW,QAAQ,GAAG;AAAA,YAC1B,SAAS,KAAU;AACf,4BAAc,KAAK,GAAG;AAAA,YAC1B;AAAA,UACJ,CAAC;AAAA,QACL;AAAA,MACJ;AAKA,YAAM,uBAAuB,CAAC,SAAiB;AAC3C,eAAQ,KAAK,GAAG,IAAI,4BAA4B,OAAO,KAAU,QAAa;AAC1E,cAAI;AACA,kBAAMC,OAAW,EAAE,SAAS,IAAI;AAChC,gBAAI,IAAI,QAAQ,cAAe,CAAAA,KAAI,gBAAgB,IAAI,OAAO;AAC9D,kBAAM,SAAS,MAAM,WAAW,cAAc,IAAI,IAAI,OAAO,MAAM,IAAI,IAAI,OAAO,MAAM,IAAI,QAAQ,IAAI,MAAMA,IAAG;AACjH,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AACD,eAAQ,KAAK,GAAG,IAAI,sCAAsC,OAAO,KAAU,QAAa;AACpF,cAAI;AACA,kBAAMA,OAAW,EAAE,SAAS,IAAI;AAChC,gBAAI,IAAI,QAAQ,cAAe,CAAAA,KAAI,gBAAgB,IAAI,OAAO;AAC9D,kBAAM,SAAS,MAAM,WAAW,cAAc,IAAI,IAAI,OAAO,MAAM,IAAI,IAAI,OAAO,MAAM,IAAI,IAAI,OAAO,QAAQ,IAAI,QAAQ,IAAI,MAAMA,IAAG;AACxI,uBAAW,QAAQ,GAAG;AAAA,UAC1B,SAAS,KAAU;AACf,0BAAc,KAAK,GAAG;AAAA,UAC1B;AAAA,QACJ,CAAC;AAAA,MACL;AAEA,YAAM,uBAAuB,OAAO,SAAS,wBAAwB;AACrE,YAAM,oBAAoB,OAAO,SAAS,qBAAqB;AAE/D,UAAI,wBAAwB,sBAAsB,YAAY;AAC1D,iCAAyB,GAAG,MAAM,8BAA8B;AAChE,6BAAqB,GAAG,MAAM,8BAA8B;AAC5D,yBAAiB,GAAG,MAAM,8BAA8B;AAAA,MAC5D,OAAO;AACH,iCAAyB,MAAM;AAC/B,6BAAqB,MAAM;AAC3B,yBAAiB,MAAM;AACvB,YAAI,sBAAsB;AACtB,mCAAyB,GAAG,MAAM,8BAA8B;AAChE,+BAAqB,GAAG,MAAM,8BAA8B;AAC5D,2BAAiB,GAAG,MAAM,8BAA8B;AAAA,QAC5D;AAAA,MACJ;AAEA,UAAI,OAAO,KAAK,uCAAuC,EAAE,QAAQ,sBAAsB,kBAAkB,CAAC;AAS1G,YAAM,eAAe,CAAC,cAA8B;AAGhD,YAAI,UAAU,WAAW,MAAM,GAAG;AAC9B,gBAAM,OAAO,UAAU,MAAM,OAAO,MAAM;AAC1C,iBAAO,GAAG,MAAM,+BAA+B,IAAI;AAAA,QACvD;AACA,eAAO,+BAA+B,SAAS;AAAA,MACnD;AAEA,YAAM,eAAe,CAAC,UAA2B;AAC7C,YAAI,CAAC,OAAQ,QAAO;AACpB,cAAM,YAAY,MAAM,KAAK,WAAW,SAAS,IAC3C,MAAM,OACN,GAAG,MAAM,GAAG,MAAM,IAAI;AAE5B,YAAI,QAAQ;AACZ,YAAI,wBAAwB,sBAAsB,YAAY;AAC1D,cAAI,mBAAmB,OAAO,QAAQ,aAAa,SAAS,GAAG,eAAe,EAAG;AAAA,QACrF,OAAO;AACH,cAAI,mBAAmB,OAAO,QAAQ,WAAW,eAAe,EAAG;AACnE,cAAI,sBAAsB;AACtB,gBAAI,mBAAmB,OAAO,QAAQ,aAAa,SAAS,GAAG,eAAe,EAAG;AAAA,UACrF;AAAA,QACJ;AACA,eAAO;AAAA,MACX;AAEA,UAAI,KAAK,aAAa,OAAO,WAA8B;AACvD,YAAI,CAAC,OAAQ;AACb,YAAI,QAAQ;AACZ,mBAAW,SAAS,QAAQ;AACxB,mBAAS,aAAa,KAAK;AAAA,QAC/B;AACA,YAAI,OAAO,KAAK,2BAA2B,KAAK,2BAA2B,OAAO,MAAM,gBAAgB;AAAA,MAC5G,CAAC;AASD,YAAM,eAAgB,OAAe;AACrC,UAAI,gBAAgB,MAAM,QAAQ,YAAY,KAAK,aAAa,SAAS,GAAG;AACxE,YAAI,aAAa;AACjB,mBAAW,SAAS,cAAc;AAC9B,wBAAc,aAAa,KAAK;AAAA,QACpC;AACA,YAAI,aAAa,GAAG;AAChB,cAAI,OAAO,KAAK,0BAA0B,UAAU,kDAAkD;AAAA,QAC1G;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AACJ;;;ACvmCO,IAAM,wBAAwB;AAgD9B,SAAS,8BAA8B,SAAwC,CAAC,GAAW;AAChG,QAAM,cAAc,OAAO,eAAe;AAE1C,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IAET,MAAM,OAAO,SAAwB;AAAA,IAErC;AAAA,IAEA,OAAO,OAAO,QAAuB;AACnC,UAAI;AACJ,UAAI;AACF,kBAAU,IAAI,WAA6B,WAAW;AAAA,MACxD,QAAQ;AAEN,kBAAU;AAAA,MACZ;AAEA,UAAI,CAAC,WAAW,OAAO,QAAQ,+BAA+B,YAAY;AACxE,YAAI,OAAO,QAAQ;AACjB,gBAAM,IAAI;AAAA,YACR,mDAAmD,WAAW;AAAA,UAChE;AAAA,QACF;AACA,YAAI,OAAO;AAAA,UACT,mDAAmD,WAAW;AAAA,QAChE;AACA;AAAA,MACF;AAEA,UAAI;AACF,cAAM,SAAS,MAAM,QAAQ,2BAA2B;AACxD,cAAM,WAAW,OAAO,YAAY,CAAC;AACrC,YAAI,OAAO,KAAK,kDAAkD;AAAA,UAChE,eAAe,OAAO,QAAQ;AAAA,UAC9B,UAAU,OAAO,QAAQ;AAAA,UACzB;AAAA,QACF,CAAC;AAAA,MACH,SAAS,KAAU;AACjB,YAAI,OAAO,OAAQ,OAAM;AACzB,YAAI,OAAO,KAAK,gEAAgE;AAAA,UAC9E,OAAO,KAAK,WAAW,OAAO,GAAG;AAAA,QACnC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;;;ACpFO,IAAM,aAAN,MAAwC;AAAA;AAAA;AAAA;AAAA;AAAA,EAS3C,YAAY,QAAqB;AAC7B,SAAK,SAAS;AACd,SAAK,SAAS,oBAAI,IAAI;AACtB,SAAK,cAAc,CAAC;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,MAAc,SAA6B;AAC3C,UAAM,MAAM,OAAO,IAAI;AACvB,SAAK,OAAO,IAAI,KAAK,OAAO;AAC5B,SAAK,OAAO,IAAI,MAAM,OAAO;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAK,MAAc,SAA6B;AAC5C,UAAM,MAAM,QAAQ,IAAI;AACxB,SAAK,OAAO,IAAI,KAAK,OAAO;AAC5B,SAAK,OAAO,KAAK,MAAM,OAAO;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,MAAc,SAA6B;AAC3C,UAAM,MAAM,OAAO,IAAI;AACvB,SAAK,OAAO,IAAI,KAAK,OAAO;AAC5B,SAAK,OAAO,IAAI,MAAM,OAAO;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,MAAc,SAA6B;AAC9C,UAAM,MAAM,UAAU,IAAI;AAC1B,SAAK,OAAO,IAAI,KAAK,OAAO;AAC5B,SAAK,OAAO,OAAO,MAAM,OAAO;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,MAAc,SAA6B;AAC7C,UAAM,MAAM,SAAS,IAAI;AACzB,SAAK,OAAO,IAAI,KAAK,OAAO;AAC5B,SAAK,OAAO,MAAM,MAAM,OAAO;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,MAA2B,SAA4B;AACvD,QAAI,OAAO,SAAS,YAAY;AAE5B,WAAK,YAAY,KAAK,IAAI;AAC1B,WAAK,OAAO,IAAI,IAAI;AAAA,IACxB,WAAW,SAAS;AAEhB,WAAK,YAAY,KAAK,OAAO;AAC7B,WAAK,OAAO,IAAI,MAAM,OAAO;AAAA,IACjC;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,MAA6B;AACtC,UAAM,KAAK,OAAO,OAAO,IAAI;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAuB;AACzB,QAAI,KAAK,OAAO,OAAO;AACnB,YAAM,KAAK,OAAO,MAAM;AAAA,IAC5B;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAuC;AACnC,WAAO,IAAI,IAAI,KAAK,MAAM;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAA+B;AAC3B,WAAO,CAAC,GAAG,KAAK,WAAW;AAAA,EAC/B;AACJ;;;AC/FO,IAAM,oBAAN,MAAwB;AAAA,EAG3B,cAAc;AACV,SAAK,cAAc,oBAAI,IAAI;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAS,QAA0B,YAA8B;AAC7D,UAAM,QAAyB;AAAA,MAC3B,MAAM,OAAO;AAAA,MACb,MAAM,OAAO;AAAA,MACb;AAAA,MACA,OAAO,OAAO,SAAS;AAAA,MACvB,SAAS,OAAO,WAAW;AAAA,MAC3B,OAAO,OAAO;AAAA,IAClB;AAEA,SAAK,YAAY,IAAI,OAAO,MAAM,KAAK;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAW,MAAoB;AAC3B,SAAK,YAAY,OAAO,IAAI;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,MAAoB;AACvB,UAAM,QAAQ,KAAK,YAAY,IAAI,IAAI;AACvC,QAAI,OAAO;AACP,YAAM,UAAU;AAAA,IACpB;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAQ,MAAoB;AACxB,UAAM,QAAQ,KAAK,YAAY,IAAI,IAAI;AACvC,QAAI,OAAO;AACP,YAAM,UAAU;AAAA,IACpB;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,MAA2C;AAC3C,WAAO,KAAK,YAAY,IAAI,IAAI;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,SAA4B;AACxB,WAAO,MAAM,KAAK,KAAK,YAAY,OAAO,CAAC;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,UAAU,MAAyC;AAC/C,WAAO,KAAK,OAAO,EAAE,OAAO,WAAS,MAAM,SAAS,IAAI;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,qBAAmC;AAC/B,WAAO,KAAK,OAAO,EACd,OAAO,WAAS,MAAM,OAAO,EAC7B,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,IAAI,WAAS,MAAM,UAAU;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,0BAA0B,MAA4B;AAClD,WAAO,KAAK,OAAO,EACd,OAAO,WAAS;AACb,UAAI,CAAC,MAAM,QAAS,QAAO;AAG3B,UAAI,MAAM,OAAO;AAEb,YAAI,MAAM,MAAM,SAAS;AACrB,gBAAM,WAAW,MAAM,MAAM,QAAQ;AAAA,YAAK,aACtC,KAAK,UAAU,MAAM,OAAO;AAAA,UAChC;AACA,cAAI,SAAU,QAAO;AAAA,QACzB;AAGA,YAAI,MAAM,MAAM,SAAS;AACrB,gBAAM,WAAW,MAAM,MAAM,QAAQ;AAAA,YAAK,aACtC,KAAK,UAAU,MAAM,OAAO;AAAA,UAChC;AACA,cAAI,CAAC,SAAU,QAAO;AAAA,QAC1B;AAAA,MACJ;AAEA,aAAO;AAAA,IACX,CAAC,EACA,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,IAAI,WAAS,MAAM,UAAU;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,UAAU,MAAc,SAA0B;AAEtD,UAAM,eAAe,QAChB,QAAQ,OAAO,IAAI,EACnB,QAAQ,OAAO,GAAG;AAEvB,UAAM,QAAQ,IAAI,OAAO,IAAI,YAAY,GAAG;AAC5C,WAAO,MAAM,KAAK,IAAI;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,QAAc;AACV,SAAK,YAAY,MAAM;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAKA,QAAgB;AACZ,WAAO,KAAK,YAAY;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,4BAAwC;AACpC,UAAM,QAAQ,KAAK,mBAAmB;AAEtC,WAAO,OAAO,KAAmB,KAAoB,SAAqC;AACtF,UAAI,QAAQ;AAEZ,YAAM,cAAc,YAA2B;AAC3C,YAAI,SAAS,MAAM,QAAQ;AACvB,gBAAM,KAAK;AACX;AAAA,QACJ;AAEA,cAAM,aAAa,MAAM,OAAO;AAChC,cAAM,WAAW,KAAK,KAAK,WAAW;AAAA,MAC1C;AAEA,YAAM,YAAY;AAAA,IACtB;AAAA,EACJ;AACJ;;;AhB9IA;;;AiBjCO,IAAM,gBAAN,MAAoB;AAAA,EAQzB,YAAY,QAA6B;AAHzC,SAAiB,QAAQ,oBAAI,IAAyB;AACtD,SAAiB,UAAU,oBAAI,IAAmC;AAGhE,SAAK,UAAU,OAAO;AACtB,SAAK,UAAU,OAAO,WAAW;AACjC,SAAK,QAAQ,OAAO,SAAS,KAAK,KAAK;AACvC,SAAK,SAAS,OAAO,UAAU;AAAA,EACjC;AAAA;AAAA,EAGA,OAAiB;AACf,WAAO,MAAM,KAAK,KAAK,MAAM,KAAK,CAAC;AAAA,EACrC;AAAA;AAAA,EAGA,IAAI,OAAe;AACjB,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,YAAY,eAA8C;AAC9D,UAAM,WAAW,KAAK,MAAM,IAAI,aAAa;AAC7C,QAAI,UAAU;AACZ,UAAI,KAAK,QAAQ,KAAK,KAAK,IAAI,IAAI,SAAS,aAAa,KAAK,OAAO;AACnE,cAAM,KAAK,MAAM,aAAa;AAAA,MAChC,OAAO;AACL,iBAAS,aAAa,KAAK,IAAI;AAC/B,eAAO,SAAS;AAAA,MAClB;AAAA,IACF;AAEA,UAAM,WAAW,KAAK,QAAQ,IAAI,aAAa;AAC/C,QAAI,SAAU,QAAO;AAErB,UAAM,WAAW,YAAY;AAC3B,YAAM,SAAS,MAAM,KAAK,QAAQ,OAAO,aAAa;AACtD,YAAM,MAAM,KAAK,IAAI;AACrB,WAAK,MAAM,IAAI,eAAe,EAAE,QAAQ,WAAW,KAAK,YAAY,IAAI,CAAC;AACzE,YAAM,KAAK,eAAe;AAC1B,aAAO;AAAA,IACT,GAAG;AAEH,SAAK,QAAQ,IAAI,eAAe,OAAO;AACvC,QAAI;AACF,aAAO,MAAM;AAAA,IACf,UAAE;AACA,WAAK,QAAQ,OAAO,aAAa;AAAA,IACnC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,eAAsC;AAChD,UAAM,QAAQ,KAAK,MAAM,IAAI,aAAa;AAC1C,QAAI,CAAC,MAAO;AACZ,SAAK,MAAM,OAAO,aAAa;AAC/B,QAAI;AACF,YAAM,MAAM,OAAO,SAAS;AAAA,IAC9B,SAAS,KAAK;AACZ,WAAK,OAAO,QAAQ,mCAAmC,EAAE,eAAe,IAAI,CAAC;AAAA,IAC/E;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,WAA0B;AAC9B,UAAM,MAAM,MAAM,KAAK,KAAK,MAAM,KAAK,CAAC;AACxC,UAAM,QAAQ,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;AAAA,EACnD;AAAA,EAEA,MAAc,iBAAgC;AAC5C,WAAO,KAAK,MAAM,OAAO,KAAK,SAAS;AAErC,UAAI;AACJ,UAAI,eAAe;AACnB,iBAAW,CAAC,KAAK,KAAK,KAAK,KAAK,OAAO;AACrC,YAAI,MAAM,aAAa,cAAc;AACnC,yBAAe,MAAM;AACrB,sBAAY;AAAA,QACd;AAAA,MACF;AACA,UAAI,CAAC,UAAW;AAChB,YAAM,KAAK,MAAM,SAAS;AAAA,IAC5B;AAAA,EACF;AACF;;;ACvDO,IAAM,oBAAN,MAAwB;AAAA,EAa3B,YAAY,QAAiC;AAL7C,SAAiB,gBAAgB,oBAAI,IAA0C;AAC/E,SAAiB,gBAAgB,oBAAI,IAAqD;AAC1F,SAAiB,kBAAkB,oBAAI,IAA8C;AACrF,SAAiB,kBAAkB,oBAAI,IAAyD;AAG5F,QAAI,CAAC,OAAO,iBAAiB;AACzB,YAAM,IAAI,MAAM,iDAAiD;AAAA,IACrE;AACA,SAAK,OAAO,OAAO,gBAAgB,QAAQ,QAAQ,EAAE;AACrD,SAAK,SAAS,OAAO;AACrB,SAAK,aAAa,OAAO,cAAc,IAAI,KAAK;AAChD,SAAK,mBAAmB,OAAO,oBAAoB;AACnD,SAAK,YAAY,OAAO,SAAS,WAAW;AAC5C,SAAK,SAAS,OAAO,UAAU;AAC/B,QAAI,OAAO,KAAK,cAAc,YAAY;AACtC,YAAM,IAAI,MAAM,+EAA0E;AAAA,IAC9F;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBAAgB,MAAgD;AAClE,UAAM,SAAS,KAAK,cAAc,IAAI,IAAI;AAC1C,QAAI,UAAU,OAAO,YAAY,KAAK,IAAI,EAAG,QAAO,OAAO;AAE3D,UAAM,WAAW,KAAK,gBAAgB,IAAI,IAAI;AAC9C,QAAI,SAAU,QAAO;AAErB,UAAM,WAAW,YAAY;AACzB,UAAI;AACA,cAAM,MAAM,GAAG,KAAK,IAAI,uCAAuC,mBAAmB,IAAI,CAAC;AACvF,cAAM,MAAM,MAAM,KAAK,QAAQ,GAAG;AAClC,YAAI,QAAQ,KAAM,QAAO;AACzB,cAAM,OAAO,IAAI,YAAY,QAAQ,OAAQ,IAAI,QAAQ;AACzD,YAAI,CAAC,QAAQ,OAAO,KAAK,kBAAkB,YAAY,CAAC,KAAK,cAAe,QAAO;AACnF,cAAM,QAA0B;AAAA,UAC5B,eAAe,KAAK;AAAA,UACpB,gBAAgB,KAAK;AAAA,UACrB,SAAS,KAAK;AAAA,QAClB;AACA,aAAK,cAAc,IAAI,MAAM,EAAE,OAAO,WAAW,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;AAC/E,eAAO;AAAA,MACX,UAAE;AACE,aAAK,gBAAgB,OAAO,IAAI;AAAA,MACpC;AAAA,IACJ,GAAG;AACH,SAAK,gBAAgB,IAAI,MAAM,OAAO;AACtC,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,cAAc,eAAuB,MAAyE;AAChH,UAAM,SAAS,MAAM,QAAQ,KAAK,KAAK;AACvC,UAAM,WAAW,SAAS,GAAG,aAAa,IAAI,MAAM,KAAK;AACzD,UAAM,SAAS,KAAK,cAAc,IAAI,QAAQ;AAC9C,QAAI,UAAU,OAAO,YAAY,KAAK,IAAI,EAAG,QAAO,OAAO;AAE3D,UAAM,WAAW,KAAK,gBAAgB,IAAI,QAAQ;AAClD,QAAI,SAAU,QAAO;AAErB,UAAM,WAAW,YAAY;AACzB,UAAI;AACA,cAAM,KAAK,SAAS,WAAW,mBAAmB,MAAM,CAAC,KAAK;AAC9D,cAAM,MAAM,GAAG,KAAK,IAAI,8BAA8B,mBAAmB,aAAa,CAAC,YAAY,EAAE;AACrG,cAAM,MAAM,MAAM,KAAK,QAAQ,GAAG;AAClC,YAAI,QAAQ,KAAM,QAAO;AACzB,cAAM,OAAO,IAAI,YAAY,QAAQ,OAAQ,IAAI,QAAQ;AACzD,YAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,YAAI,CAAC,KAAK,UAAU;AAChB,eAAK,OAAO,OAAO,4DAA4D,EAAE,eAAe,OAAO,CAAC;AACxG,iBAAO;AAAA,QACX;AACA,cAAM,QAAQ;AACd,aAAK,cAAc,IAAI,UAAU,EAAE,OAAO,WAAW,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;AACnF,eAAO;AAAA,MACX,UAAE;AACE,aAAK,gBAAgB,OAAO,QAAQ;AAAA,MACxC;AAAA,IACJ,GAAG;AACH,SAAK,gBAAgB,IAAI,UAAU,OAAO;AAC1C,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,uBAAuB,SAAqF;AAC9G,UAAM,QAAQ,OAAO,WAAW,EAAE,EAAE,KAAK,EAAE,YAAY;AACvD,QAAI,CAAC,iBAAiB,KAAK,KAAK,EAAG,QAAO;AAC1C,UAAM,MAAM,GAAG,KAAK,IAAI,0CAA0C,mBAAmB,KAAK,CAAC;AAC3F,UAAM,MAAM,MAAM,KAAK,QAAQ,GAAG;AAClC,QAAI,QAAQ,KAAM,QAAO;AACzB,UAAM,OAAO,IAAI,YAAY,QAAQ,OAAQ,IAAI,QAAQ;AACzD,QAAI,CAAC,QAAQ,OAAO,KAAK,kBAAkB,YAAY,CAAC,KAAK,cAAe,QAAO;AACnF,WAAO,EAAE,eAAe,KAAK,eAAe,gBAAgB,KAAK,eAAe;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACF,eACA,YACiE;AACjE,UAAM,MAAM,GAAG,KAAK,IAAI,8BAA8B,mBAAmB,aAAa,CAAC;AACvF,UAAM,MAAM,MAAM,KAAK,QAAQ,GAAG;AAClC,QAAI,QAAQ,KAAM,QAAO;AACzB,UAAM,OAAO,IAAI,YAAY,QAAQ,OAAQ,IAAI,QAAQ;AACzD,UAAM,WAAW,MAAM,QAAQ,MAAM,QAAQ,IAAI,KAAK,WAAW,CAAC;AAClE,UAAM,SAAS,OAAO,cAAc,EAAE,EAAE,KAAK,EAAE,YAAY;AAC3D,UAAM,QAAQ,SAAS,KAAK,CAAC,MAAW,OAAO,GAAG,UAAU,EAAE,EAAE,YAAY,MAAM,MAAM;AACxF,QAAI,CAAC,OAAO,aAAc,QAAO;AACjC,WAAO,EAAE,UAAU,OAAO,MAAM,YAAY,GAAG,aAAa,MAAM,mBAAmB,KAAK;AAAA,EAC9F;AAAA;AAAA,EAGA,WAAW,eAA6B;AAGpC,SAAK,cAAc,OAAO,aAAa;AACvC,UAAM,SAAS,GAAG,aAAa;AAC/B,eAAW,OAAO,MAAM,KAAK,KAAK,cAAc,KAAK,CAAC,GAAG;AACrD,UAAI,IAAI,WAAW,MAAM,EAAG,MAAK,cAAc,OAAO,GAAG;AAAA,IAC7D;AACA,eAAW,CAAC,MAAM,KAAK,KAAK,KAAK,eAAe;AAC5C,UAAI,MAAM,MAAM,kBAAkB,cAAe,MAAK,cAAc,OAAO,IAAI;AAAA,IACnF;AAAA,EACJ;AAAA;AAAA,EAGA,QAAc;AACV,SAAK,cAAc,MAAM;AACzB,SAAK,cAAc,MAAM;AAAA,EAC7B;AAAA,EAEA,MAAc,QAAQ,KAA2B;AAC7C,UAAM,aAAa,OAAO,oBAAoB,cAAc,IAAI,gBAAgB,IAAI;AACpF,UAAM,QAAQ,aAAa,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,gBAAgB,IAAI;AACzF,QAAI;AACA,YAAM,MAAM,MAAM,KAAK,UAAU,KAAK;AAAA,QAClC,QAAQ;AAAA,QACR,SAAS,KAAK,aAAa;AAAA,QAC3B,QAAQ,YAAY;AAAA,MACxB,CAAC;AACD,UAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,UAAI,CAAC,IAAI,IAAI;AACT,cAAM,IAAI,MAAM,uBAAuB,GAAG,gBAAW,IAAI,MAAM,EAAE;AAAA,MACrE;AACA,aAAO,MAAM,IAAI,KAAK;AAAA,IAC1B,UAAE;AACE,UAAI,MAAO,cAAa,KAAK;AAAA,IACjC;AAAA,EACJ;AAAA,EAEQ,eAAuC;AAC3C,UAAM,UAAkC;AAAA,MACpC,UAAU;AAAA,MACV,cAAc;AAAA,IAClB;AACA,QAAI,KAAK,OAAQ,SAAQ,eAAe,IAAI,UAAU,KAAK,MAAM;AACjE,WAAO;AAAA,EACX;AACJ;;;ACnQA,SAAS,WAAW,uBAAuB;AAqBpC,IAAM,8BAAN,MAAuE;AAAA,EAS1E,YAAY,QAA2C;AAJvD,SAAiB,gBAAgB,oBAAI,IAAwB;AAC7D,SAAiB,UAAU,oBAAI,IAAwB;AACvD,SAAiB,UAAU,oBAAI,IAAwC;AAGnE,SAAK,SAAS,OAAO;AACrB,SAAK,WAAW,OAAO,cAAc,IAAI,KAAK;AAC9C,SAAK,SAAS,OAAO,UAAU;AAAA,EACnC;AAAA,EAEA,MAAM,kBAAkB,MAA8E;AAClG,UAAM,SAAS,KAAK,cAAc,IAAI,IAAI;AAC1C,QAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AACzC,aAAO,EAAE,eAAe,OAAO,eAAe,QAAQ,OAAO,OAAO;AAAA,IACxE;AACA,UAAM,MAAM,QAAQ,IAAI;AACxB,UAAM,WAAW,KAAK,QAAQ,IAAI,GAAG;AACrC,QAAI,UAAU;AACV,YAAM,SAAS,MAAM;AACrB,aAAO,SAAS,EAAE,eAAe,OAAO,eAAe,QAAQ,OAAO,OAAO,IAAI;AAAA,IACrF;AACA,UAAM,WAAW,YAAwC;AACrD,UAAI;AACA,cAAM,WAAW,MAAM,KAAK,OAAO,gBAAgB,IAAI;AACvD,YAAI,CAAC,SAAU,QAAO;AACtB,cAAMC,SAAQ,MAAM,KAAK,gBAAgB,SAAS,eAAe,SAAS,SAAS,SAAS,gBAAgB,IAAI;AAChH,YAAI,CAACA,OAAO,QAAO;AACnB,aAAK,cAAc,IAAI,MAAMA,MAAK;AAClC,aAAK,QAAQ,IAAIA,OAAM,eAAeA,MAAK;AAC3C,eAAOA;AAAA,MACX,SAAS,KAAU;AACf,aAAK,OAAO,QAAQ,0DAA0D;AAAA,UAC1E;AAAA,UACA,OAAO,KAAK,WAAW;AAAA,QAC3B,CAAC;AACD,eAAO;AAAA,MACX,UAAE;AACE,aAAK,QAAQ,OAAO,GAAG;AAAA,MAC3B;AAAA,IACJ,GAAG;AACH,SAAK,QAAQ,IAAI,KAAK,OAAO;AAC7B,UAAM,QAAQ,MAAM;AACpB,WAAO,QAAQ,EAAE,eAAe,MAAM,eAAe,QAAQ,MAAM,OAAO,IAAI;AAAA,EAClF;AAAA,EAEA,MAAM,YAAY,eAAoD;AAClE,UAAM,SAAS,KAAK,QAAQ,IAAI,aAAa;AAC7C,QAAI,UAAU,OAAO,YAAY,KAAK,IAAI,EAAG,QAAO,OAAO;AAE3D,UAAM,MAAM,MAAM,aAAa;AAC/B,UAAM,WAAW,KAAK,QAAQ,IAAI,GAAG;AACrC,QAAI,UAAU;AACV,YAAM,SAAS,MAAM;AACrB,aAAO,QAAQ,UAAU;AAAA,IAC7B;AACA,UAAM,WAAW,YAAwC;AACrD,UAAI;AACA,cAAMA,SAAQ,MAAM,KAAK,gBAAgB,eAAe,QAAW,QAAW,MAAS;AACvF,YAAI,CAACA,OAAO,QAAO;AACnB,aAAK,QAAQ,IAAI,eAAeA,MAAK;AACrC,YAAIA,OAAM,SAAS,SAAU,MAAK,cAAc,IAAIA,OAAM,QAAQ,UAAUA,MAAK;AACjF,eAAOA;AAAA,MACX,SAAS,KAAU;AACf,aAAK,OAAO,QAAQ,oDAAoD;AAAA,UACpE;AAAA,UACA,OAAO,KAAK,WAAW;AAAA,QAC3B,CAAC;AACD,eAAO;AAAA,MACX,UAAE;AACE,aAAK,QAAQ,OAAO,GAAG;AAAA,MAC3B;AAAA,IACJ,GAAG;AACH,SAAK,QAAQ,IAAI,KAAK,OAAO;AAC7B,UAAM,QAAQ,MAAM;AACpB,WAAO,OAAO,UAAU;AAAA,EAC5B;AAAA,EAEA,SAAS,eAA4F;AACjG,UAAM,SAAS,KAAK,QAAQ,IAAI,aAAa;AAC7C,QAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AACzC,aAAO,EAAE,eAAe,OAAO,eAAe,QAAQ,OAAO,QAAQ,SAAS,OAAO,QAAQ;AAAA,IACjG;AACA,WAAO;AAAA,EACX;AAAA,EAEA,WAAW,eAA6B;AACpC,SAAK,QAAQ,OAAO,aAAa;AACjC,eAAW,CAAC,MAAM,KAAK,KAAK,KAAK,eAAe;AAC5C,UAAI,MAAM,kBAAkB,cAAe,MAAK,cAAc,OAAO,IAAI;AAAA,IAC7E;AACA,SAAK,OAAO,WAAW,aAAa;AAAA,EACxC;AAAA,EAEA,MAAc,gBACV,eACA,qBACA,mBACA,UAC0B;AAC1B,QAAI,UAAU;AACd,QAAI,iBAAiB;AACrB,QAAI,OAAO;AACX,QAAI,oBAAoB;AAExB,QAAI,CAAC,WAAW,CAAC,gBAAgB;AAC7B,YAAM,WAAW,MAAM,KAAK,OAAO,cAAc,aAAa;AAC9D,UAAI,CAAC,UAAU;AACX,aAAK,OAAO,OAAO,oDAAoD,EAAE,cAAc,CAAC;AACxF,eAAO;AAAA,MACX;AACA,0BAAoB,SAAS,iBAAiB;AAC9C,UAAI,CAAC,QAAS,WAAU,SAAS,WAAW,2BAA2B,SAAS,QAAQ;AACxF,UAAI,CAAC,eAAgB,kBAAiB,SAAS,SAAS;AACxD,UAAI,CAAC,KAAM,QAAO,SAAS,SAAS;AAAA,IACxC;AAEA,QAAI,CAAC,WAAW,CAAC,QAAQ,eAAe,CAAC,QAAQ,gBAAgB;AAC7D,WAAK,OAAO,OAAO,+DAA+D,EAAE,cAAc,CAAC;AACnG,aAAO;AAAA,IACX;AAEA,UAAM,SAAS,MAAM,aAAa,QAAQ,gBAAgB,QAAQ,aAAa,QAAQ,qBAAqB,EAAE;AAE9G,UAAM,aAAa;AAAA,MACf,IAAI;AAAA,MACJ,iBAAiB;AAAA,MACjB,UAAU;AAAA,MACV,cAAc,QAAQ;AAAA,MACtB,iBAAiB,QAAQ;AAAA,MACzB,UAAU,QAAQ;AAAA,IACtB;AAEA,WAAO;AAAA,MACH,eAAe;AAAA,MACf;AAAA,MACA,SAAS;AAAA,MACT,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,IACjC;AAAA,EACJ;AACJ;AASA,SAAS,2BAA2B,UAAqD;AACrF,QAAM,cAAc,UAAU;AAC9B,MAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,YAAY,WAAW,EAAG,QAAO;AACpE,QAAM,UAA6B,UAAU;AAC7C,MAAI;AACJ,MAAI,SAAS;AACT,UAAM,MAAM,QAAQ,KAAK,CAAC,MAAW,GAAG,YAAY,IAAI;AACxD,QAAI,KAAK,WAAY,iBAAgB,IAAI;AAAA,EAC7C;AACA,QAAM,KAAK,gBACL,YAAY,KAAK,CAAC,MAAW,GAAG,SAAS,aAAa,IACtD,YAAY,CAAC;AACnB,MAAI,CAAC,MAAM,OAAO,OAAO,SAAU,QAAO;AAC1C,QAAM,SAAU,GAAG,UAAU,CAAC;AAC9B,QAAM,MAAM,OAAO,OAAO,OAAO,oBAAoB,OAAO,cAAc,OAAO;AACjF,QAAM,SAAS,GAAG;AAClB,MAAI,OAAO,WAAW,YAAY,OAAO,QAAQ,SAAU,QAAO;AAClE,SAAO;AAAA,IACH,gBAAgB;AAAA,IAChB,aAAa;AAAA,IACb,mBAAmB,OAAO,OAAO,cAAc,WAAW,OAAO,YAAY;AAAA,EACjF;AACJ;AAEA,eAAe,aAAa,YAAoB,aAAqB,WAAyC;AAC1G,UAAQ,YAAY;AAAA,IAChB,KAAK,UAAU;AACX,YAAM,EAAE,eAAe,IAAI,MAAM,OAAO,4BAA4B;AACpE,YAAM,SAAS,YAAY,QAAQ,gBAAgB,EAAE,EAAE,KAAK;AAK5D,YAAM,WAAW,SACX,gBAAgB,QAAQ,IAAI,GAAG,8BAA8B,GAAG,MAAM,OAAO,IAC7E;AACN,aAAO,IAAI,eAAe;AAAA,QACtB,aAAa,WAAW,EAAE,MAAM,QAAQ,MAAM,SAAS,IAAI;AAAA,MAC/D,CAAC;AAAA,IACL;AAAA,IACA,KAAK;AAAA,IACL,KAAK,OAAO;AACR,YAAM,WAAW,YAAY,QAAQ,UAAU,EAAE,EAAE,QAAQ,aAAa,EAAE;AAC1E,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,yBAAyB;AAC5D,aAAO,IAAI,UAAU;AAAA,QACjB,QAAQ;AAAA,QACR,YAAY,EAAE,UAAU,SAAS;AAAA,QACjC,kBAAkB;AAAA,MACtB,CAAC;AAAA,IACL;AAAA,IACA,KAAK;AAAA,IACL,KAAK,SAAS;AACV,YAAM,EAAE,YAAY,IAAI,MAAM,OAAO,2BAA2B;AAChE,aAAO,IAAI,YAAY,EAAE,KAAK,aAAa,UAAU,CAAC;AAAA,IAC1D;AAAA,IACA,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,MAAM;AACP,YAAM,EAAE,UAAU,IAAI,MAAM,OAAO,yBAAyB;AAC5D,aAAO,IAAI,UAAU;AAAA,QACjB,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,MAAM,EAAE,KAAK,GAAG,KAAK,EAAE;AAAA,MAC3B,CAAC;AAAA,IACL;AAAA,IACA,KAAK;AAAA,IACL,KAAK,SAAS;AACV,YAAM,EAAE,cAAc,IAAI,MAAM,OAAO,6BAA6B;AACpE,aAAO,IAAI,cAAc,EAAE,KAAK,YAAY,CAAC;AAAA,IACjD;AAAA,IACA;AACI,YAAM,IAAI,MAAM,0DAA0D,UAAU,EAAE;AAAA,EAC9F;AACJ;;;ACtOA;AACA;AAJA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,gBAAAC,qBAAoB;;;ACctB,IAAM,uBAAuD;AAAA,EAChE,YAAY;AAAA,IACR,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,MACJ,EAAE,KAAK,mCAAmC,QAAQ,kBAAkB;AAAA,MACpE,EAAE,KAAK,mCAAmC,QAAQ,mBAAmB;AAAA,MACrE,EAAE,KAAK,mCAAmC,QAAQ,sBAAsB;AAAA,MACxE,EAAE,KAAK,mCAAmC,QAAQ,oBAAoB;AAAA,IAC1E;AAAA,EACJ;AAAA,EACA,IAAI;AAAA,IACA,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AAAA,EACA,WAAW;AAAA,IACP,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,WAAW;AAAA,EACf;AAAA,EACA,OAAO;AAAA,IACH,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AAAA,EACA,OAAO;AAAA,IACH,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AAAA,EACA,SAAS;AAAA,IACL,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AAAA,EACA,OAAO;AAAA,IACH,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AAAA,EACA,KAAK;AAAA,IACD,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AAAA,EACA,UAAU;AAAA,IACN,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AAAA,EACA,MAAM;AAAA,IACF,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AAAA,EACA,UAAU;AAAA,IACN,KAAK;AAAA,IACL,QAAQ;AAAA,EACZ;AACJ;AAqBA,eAAsB,iBAAiB,MAAkD;AACrF,QAAM,EAAE,QAAQ,UAAU,QAAQ,cAAc,IAAI;AACpD,QAAM,SAAiB,KAAK,UAAU;AACtC,QAAM,YAAsB,CAAC;AAE7B,aAAW,OAAO,UAAU;AACxB,UAAM,OAAO,qBAAqB,GAAG;AACrC,QAAI,CAAC,MAAM;AAEP;AAAA,IACJ;AAEA,QAAI;AACA,YAAM,MAAW,MAAM;AAAA;AAAA,QAAiC,KAAK;AAAA;AAC7D,YAAM,OAAO,IAAI,KAAK,MAAM;AAC5B,UAAI,CAAC,MAAM;AACP,eAAO;AAAA,UACH,uBAAuB,GAAG,eAAe,KAAK,GAAG,qBAAqB,KAAK,MAAM;AAAA,UACjF,EAAE,cAAc;AAAA,QACpB;AACA;AAAA,MACJ;AAEA,UAAI;AACJ,UAAI,KAAK,WAAW;AAChB,cAAM,IAAK,OAAmC,KAAK,SAAS;AAC5D,YAAI,KAAK,cAAc,kBAAkB;AACrC,gBAAM,EAAE,OAAO,MAAM,QAAQ,CAAC,IAAI,IAAI,CAAC,EAAE;AAAA,QAC7C,WAAW,MAAM,QAAW;AACxB,gBAAM;AAAA,QACV;AAAA,MACJ;AAEA,YAAM,OAAO,IAAI,QAAQ,SAAY,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,CAAC;AAC/D,gBAAU,KAAK,KAAK,MAAM;AAE1B,UAAI,KAAK,QAAQ;AACb,mBAAW,MAAM,KAAK,QAAQ;AAC1B,cAAI;AACA,kBAAM,QAAa,MAAM;AAAA;AAAA,cAAiC,GAAG;AAAA;AAC7D,kBAAM,SAAS,MAAM,GAAG,MAAM;AAC9B,gBAAI,QAAQ;AACR,oBAAM,OAAO,IAAI,IAAI,OAAO,CAAC;AAC7B,wBAAU,KAAK,GAAG,MAAM;AAAA,YAC5B;AAAA,UACJ,QAAQ;AAAA,UAER;AAAA,QACJ;AAAA,MACJ;AAEA,aAAO;AAAA,QACH,uBAAuB,GAAG,gBAAgB,KAAK,MAAM,GAAG,KAAK,SAAS,QAAQ,KAAK,OAAO,SAAS,YAAY,EAAE;AAAA,QACjH,EAAE,cAAc;AAAA,MACpB;AAAA,IACJ,SAAS,KAAU;AACf,YAAM,MAAM,KAAK,WAAW,OAAO,GAAG;AACtC,UAAI,IAAI,SAAS,oBAAoB,KAAK,IAAI,SAAS,sBAAsB,GAAG;AAC5E,eAAO;AAAA,UACH,uBAAuB,GAAG,oBAAoB,KAAK,GAAG;AAAA,UACtD,EAAE,cAAc;AAAA,QACpB;AAAA,MACJ,OAAO;AACH,eAAO;AAAA,UACH,uBAAuB,GAAG,kBAAkB,GAAG;AAAA,UAC/C,EAAE,cAAc;AAAA,QACpB;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AAEA,SAAO;AACX;;;ADvJA;AA+BA,SAAS,wBAAwB,YAAoB,eAA+B;AAChF,SAAOC,YAAW,UAAU,UAAU,EAAE,OAAO,WAAW,aAAa,EAAE,EAAE,OAAO,KAAK;AAC3F;AAEO,IAAM,wBAAN,MAAgE;AAAA,EAOnE,YAAY,QAAqC;AAC7C,SAAK,SAAS,OAAO;AACrB,SAAK,cAAc,OAAO;AAC1B,SAAK,SAAS,OAAO,UAAU;AAC/B,SAAK,eAAe,OAAO;AAC3B,SAAK,kBACD,OAAO,kBACJ,QAAQ,IAAI,kBACZ,QAAQ,IAAI,eACZ,IACL,KAAK;AAAA,EACX;AAAA,EAEA,MAAM,OAAO,eAA8C;AACvD,QAAI,SAAS,KAAK,YAAY,SAAS,aAAa;AACpD,QAAI,CAAC,QAAQ;AACT,YAAMC,UAAS,MAAM,KAAK,YAAY,YAAY,aAAa;AAC/D,UAAI,CAACA,SAAQ;AACT,cAAM,IAAI,MAAM,iEAAiE,aAAa,GAAG;AAAA,MACrG;AACA,eAAS,KAAK,YAAY,SAAS,aAAa;AAChD,UAAI,CAAC,QAAQ;AACT,cAAM,IAAI,MAAM,kFAAkF,aAAa,GAAG;AAAA,MACtH;AAAA,IACJ;AAEA,UAAM,SAAsB,OAAO;AACnC,UAAM,UAAU,OAAO;AAEvB,UAAM,WAAW,MAAM,KAAK,OAAO,cAAc,aAAa;AAC9D,QAAI,CAAC,UAAU;AACX,YAAM,IAAI,MAAM,+DAA+D,aAAa,GAAG;AAAA,IACnG;AAEA,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,uBAAuB;AAC/D,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,uBAAuB;AAE/D,UAAM,SAAS,IAAIC,cAAa,KAAK,YAAY;AAOjD,UAAM,OAAO,IAAI,IAAI,aAAa,QAAQ,EAAE,gBAAgB,QAAQ,CAAQ,CAAC;AAO7E,UAAM,OAAO,IAAI,IAAI,eAAe,EAAE,eAA8B,gBAAgB,MAAM,CAAC,CAAC;AAC5F,UAAM,OAAO,IAAI,IAAI,eAAe;AAAA,MAChC,OAAO;AAAA,MACP;AAAA,MACA,gBAAgB,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASxB,uBAAuB;AAAA,IAC3B,CAAC,CAAC;AAKF,QAAI,KAAK,gBAAgB;AACrB,UAAI;AACA,cAAM,EAAE,WAAW,IAAI,MAAM,OAAO,0BAA0B;AAC9D,cAAM,gBAAgB,wBAAwB,KAAK,gBAAgB,aAAa;AAChF,cAAM,UAAU,QAAQ,WACjB,QAAQ,SAAS,WAAW,MAAM,IAC/B,QAAQ,WACP,2BAA2B,KAAK,QAAQ,QAAQ,KAC5C,MAAM;AACL,gBAAM,eAAe,QAAQ,IAAI,mBAAmB,IAAI,KAAK;AAC7D,gBAAM,UAAU,QAAQ,KAAK,QAAQ,QAAQ;AAC7C,gBAAM,eAAe,WAAW,CAAC,cAC3B,QAAQ,WACR,GAAG,QAAQ,QAAQ,IAAI,WAAW;AACxC,iBAAO,UAAU,YAAY;AAAA,QACjC,GAAG,IACD,WAAW,QAAQ,QAAQ,KACnC;AAaN,cAAM,qBAA+B,CAAC;AACtC,YAAI,QAAS,oBAAmB,KAAK,OAAO;AAK5C,cAAM,mBAAmB,QAAQ,IAAI,sBAAsB,IACtD,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AACnB,mBAAW,KAAK,iBAAiB;AAC7B,cAAI,CAAC,mBAAmB,SAAS,CAAC,EAAG,oBAAmB,KAAK,CAAC;AAAA,QAClE;AAIA,cAAM,cAAc,QAAQ,IAAI,kBAAkB,IAAI,KAAK,EAAE,QAAQ,gBAAgB,EAAE;AACvF,YAAI,YAAY;AACZ,gBAAM,WAAW,aAAa,UAAU;AACxC,cAAI,CAAC,mBAAmB,SAAS,QAAQ,EAAG,oBAAmB,KAAK,QAAQ;AAAA,QAChF;AACA,YAAI,QAAQ,UAAU;AAClB,gBAAM,WAAW,QAAQ,SAAS,QAAQ,gBAAgB,EAAE;AAC5D,cAAI,SAAS,SAAS,YAAY,KAAK,aAAa,aAAa;AAC7D,+BAAmB,KAAK,UAAU,QAAQ,EAAE;AAC5C,+BAAmB,KAAK,UAAU,QAAQ,IAAI;AAC9C,+BAAmB,KAAK,WAAW,QAAQ,IAAI;AAAA,UACnD;AAAA,QACJ;AAWA,cAAM,qBAAqB;AAAA,UACvB,QAAQ,IAAI,mBAAmB;AAAA,QACnC,EAAE,YAAY,MAAM;AACpB,cAAM,gBAAgB,QAAQ,IAAI,gBAAgB,IAAI,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAC/E,cAAM,gBAAgB,sBACf,gBACA,eAAe,KAAK,YAAY,IACjC,CAAC;AAAA,UACC,YAAY;AAAA,UACZ,MAAM;AAAA,UACN,cAAc,GAAG,YAAY;AAAA,UAC7B,UAAU,0BAA0B,aAAa;AAAA,UACjD,cAAc,8BAA8B,KAAK,gBAAgB,aAAa;AAAA,UAC9E,QAAQ,CAAC,UAAU,SAAS,SAAS;AAAA,QACzC,CAAC,IACC;AAEN,cAAM,OAAO,IAAI,IAAI,WAAW;AAAA,UAC5B,QAAQ;AAAA,UACR;AAAA;AAAA;AAAA;AAAA;AAAA,UAKA,gBAAgB;AAAA;AAAA;AAAA,UAGhB,oBAAoB;AAAA;AAAA;AAAA;AAAA,UAIpB,gBAAgB,mBAAmB,SAAS,qBAAqB;AAAA,UACjE,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAQzC,eAAe;AAAA,YACX,MAAM;AAAA,cACF,QAAQ;AAAA,gBACJ,OAAO,OAAO,SAAwD;AAClE,sBAAI;AACA,0BAAM,KAAK,OAAO,WAAgB,UAAU;AAC5C,wBAAI,CAAC,GAAI;AACT,0BAAM,CAAC,EAAE,2BAA2B,oBAAoB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,sBAC3E,OAAO,8BAA8B;AAAA,oBACzC,CAAC;AACD,0BAAM,0BAA0B,IAAI,MAAM;AAAA,sBACtC,QAAQ,KAAK;AAAA,sBACb,eAAe;AAAA,oBACnB,CAAC;AAAA,kBACL,SAAS,GAAQ;AACb,yBAAK,OAAO,OAAO,6DAA6D;AAAA,sBAC5E;AAAA,sBACA,QAAQ,MAAM;AAAA,sBACd,OAAO,GAAG;AAAA,oBACd,CAAC;AAAA,kBACL;AAAA,gBACJ;AAAA,cACJ;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ,CAAQ,CAAC;AACT,YAAI,eAAe;AACf,eAAK,OAAO,OAAO,8CAA8C;AAAA,YAC7D;AAAA,YACA;AAAA,UACJ,CAAC;AAAA,QACL;AAAA,MACJ,SAAS,KAAU;AACf,aAAK,OAAO,OAAO,qDAAqD;AAAA,UACpE;AAAA,UACA,OAAO,KAAK;AAAA,QAChB,CAAC;AAAA,MACL;AAAA,IACJ,OAAO;AACH,WAAK,OAAO,OAAO,yHAAoH,EAAE,cAAc,CAAC;AAAA,IAC5J;AASA,QAAI;AACA,YAAM,EAAE,eAAe,IAAI,MAAM,OAAO,8BAA8B;AACtE,YAAM,cAAc,OAAO,QAAQ,IAAI,mBAAmB,MAAM,EAAE,YAAY,MAAM;AACpF,YAAM,OAAO,IAAI,IAAI,eAAe,EAAE,YAAY,CAAC,CAAQ;AAAA,IAC/D,SAAS,KAAU;AACf,WAAK,OAAO,OAAO,yDAAyD;AAAA,QACxE;AAAA,QACA,OAAO,KAAK;AAAA,MAChB,CAAC;AAAA,IACL;AAEA,UAAM,cAAc,QAAQ,YAAY;AACxC,UAAM,SAAS,SAAS;AACxB,UAAM,MAAM,QAAQ,YAAY;AAChC,UAAM,YAAY,KAAK,aAAa,KAAK,cAAc,QAAQ;AAM/D,UAAM,UAAW,QAAQ,QAAQ,KAAK,QAAQ,CAAC;AAC/C,UAAM,QAAQ,MAAM,QAAQ,QAAQ,YAAY,IAAI,OAAO,eACrD,MAAM,QAAQ,KAAK,YAAY,IAAI,IAAI,eAAe,CAAC;AAG7D,QAAI;AACA,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,2BAA2B;AACtE,YAAM,OAAO,IAAI,IAAI,kBAAkB;AAAA,QACnC,eAAe,QAAQ;AAAA,QACvB,gBAAgB,QAAQ,kBAAkB,QAAQ,iBAAiB;AAAA;AAAA;AAAA;AAAA,QAInE,gBAAgB;AAAA,MACpB,CAAQ,CAAC;AACT,cAAQ;AAAA,QACJ,iEAAiE,aAAa,kBAAkB,MAAM,MAAM,mBAAmB,QAAQ,iBAAiB,IAAI;AAAA,MAChK;AAAA,IACJ,SAAS,KAAU;AACf,WAAK,OAAO,OAAO,4DAA4D;AAAA,QAC3E;AAAA,QACA,OAAO,KAAK;AAAA,MAChB,CAAC;AAAA,IACL;AAOA,UAAM,eACD,MAAM,QAAQ,QAAQ,QAAQ,IAAI,OAAO,WAAW,UACpD,MAAM,QAAQ,KAAK,QAAQ,IAAI,IAAI,WAAW,SAC/C,CAAC;AACL,UAAM,WAAsB,YACvB,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC;AAErE,QAAI,SAAS,SAAS,GAAG;AACrB,YAAM,YAAY,MAAM,iBAAiB;AAAA,QACrC;AAAA,QACA;AAAA,QACA,QAAQ,EAAE,GAAI,UAAU,CAAC,GAAI,GAAI,OAAO,CAAC,EAAG;AAAA,QAC5C,QAAQ,KAAK;AAAA,QACb;AAAA,MACJ,CAAC;AACD,WAAK,OAAO,OAAO,+CAA+C;AAAA,QAC9D;AAAA,QACA;AAAA,QACA;AAAA,MACJ,CAAC;AAAA,IACL;AAEA,UAAM,OAAO,IAAI,IAAI,UAAU,QAAQ;AAAA,MACnC;AAAA,MACA,gBAAgB,QAAQ,mBAAmB;AAAA,MAC3C;AAAA,MACA;AAAA,MACA,QAAQ,YAAY,YAAY;AAAA,IACpC,CAAQ,CAAC;AAET,UAAM,OAAO,UAAU;AAsBvB,QAAI;AACA,YAAM,WAAgB,OAAQ,SAAiB,aAAa,WACtD,KAAK,MAAO,QAAgB,QAAQ,IAClC,SAAiB,YAAY,CAAC;AACtC,YAAM,YAAY,UAAU;AAC5B,YAAM,UAAU,UAAU;AAE1B,UAAI,SAAS,MAAM,SAAS,MAAM;AAC9B,YAAI;AACA,gBAAM,EAAE,yBAAAC,yBAAwB,IAAI,MAAM;AAC1C,gBAAMA,yBAAwB,QAAQ,SAAS,KAAK,MAAM;AAAA,QAC9D,SAAS,GAAQ;AACb,eAAK,OAAO,OAAO,yCAAyC;AAAA,YACxD;AAAA,YACA,OAAO,GAAG;AAAA,UACd,CAAC;AAAA,QACL;AAAA,MACJ;AAEA,UAAI,WAAW,UAAU,WAAW,OAAO;AACvC,YAAI;AACA,gBAAM,EAAE,kBAAAC,kBAAiB,IAAI,MAAM;AACnC,gBAAMA,kBAAiB,QAAQ,WAAW,KAAK,MAAM;AAAA,QACzD,SAAS,GAAQ;AACb,eAAK,OAAO,OAAO,2CAA2C;AAAA,YAC1D;AAAA,YACA,OAAO,GAAG;AAAA,UACd,CAAC;AAAA,QACL;AAEA,YAAI,SAAS,IAAI;AACb,cAAI;AACA,kBAAM,EAAE,mBAAAC,mBAAkB,IAAI,MAAM;AACpC,kBAAMA;AAAA,cACF;AAAA,cACA,EAAE,QAAQ,UAAU,QAAQ,gBAAgB,QAAQ,IAAI,MAAM,QAAQ;AAAA,cACtE,KAAK;AAAA,YACT;AAAA,UACJ,SAAS,GAAQ;AACb,iBAAK,OAAO,OAAO,4CAA4C;AAAA,cAC3D;AAAA,cACA,OAAO,GAAG;AAAA,YACd,CAAC;AAAA,UACL;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ,SAAS,KAAU;AACf,WAAK,OAAO,OAAO,kDAAkD;AAAA,QACjE;AAAA,QACA,OAAO,KAAK;AAAA,MAChB,CAAC;AAAA,IACL;AAYA,QAAI;AACA,YAAM,eAAkC,MAAM;AAC1C,YAAI;AAAE,iBAAQ,OAAe,aAAa,eAAe;AAAA,QAAG,QAAQ;AAAE,iBAAO;AAAA,QAAW;AAAA,MAC5F,GAAG;AACH,YAAM,YAAiB,MAAM;AACzB,YAAI;AAAE,iBAAQ,OAAe,aAAa,eAAe;AAAA,QAAG,QAAQ;AAAE,iBAAO;AAAA,QAAW;AAAA,MAC5F,GAAG;AAEH,UAAI,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS,KAAK,OAAO,aAAa,YAAY;AAMxF,cAAM,cAAoB,SAAiB;AAC3C,cAAM,WAAgB,OAAO,gBAAgB,YAAY,MAAM;AAC3D,cAAI;AAAE,mBAAO,KAAK,MAAM,WAAW;AAAA,UAAG,QAAQ;AAAE,mBAAO,CAAC;AAAA,UAAG;AAAA,QAC/D,GAAG,IAAK,eAAe,CAAC;AACxB,YAAI,eAAmC,UAAU,SAAS;AAE1D,YAAI,CAAC,cAAc;AACf,cAAI;AACA,kBAAM,KAAW,OAAe,aAAa,UAAU;AACvD,gBAAI,IAAI,MAAM;AACV,oBAAM,OAAO,MAAM,GAAG,KAAK,oBAAoB,EAAE,OAAO,GAAG,SAAS,CAAC,EAAE,OAAO,cAAc,WAAW,MAAM,CAAC,EAAE,CAAQ;AACxH,oBAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAQ,MAAM,SAAS,MAAM,WAAW,CAAC;AAC5E,kBAAI,MAAM,QAAQ,IAAI,KAAK,KAAK,SAAS,KAAK,KAAK,CAAC,GAAG,IAAI;AACvD,+BAAe,OAAO,KAAK,CAAC,EAAE,EAAE;AAAA,cACpC;AAAA,YACJ;AAAA,UACJ,QAAQ;AAAA,UAAuD;AAAA,QACnE;AAEA,YAAI,cAAc;AACd,cAAI;AACA,kBAAM,UAAU,MAAM,SAAS,YAAY;AAC3C,kBAAM,WAAW,SAAS,YAAY;AACtC,kBAAM,UAAU,SAAS,WAAW;AACpC,kBAAM,OAAO,SAAS,QAAQ,UAAU;AACxC,gBAAI,WAAW,KAAK,UAAU,KAAK,OAAO,GAAG;AACzC,mBAAK,OAAO,OAAO,sDAAsD;AAAA,gBACrE;AAAA,gBACA,gBAAgB;AAAA,gBAChB,UAAU,YAAY;AAAA,gBACtB;AAAA,gBACA;AAAA,gBACA,QAAQ;AAAA,cACZ,CAAC;AAAA,YACL;AAAA,UACJ,SAAS,GAAQ;AACb,iBAAK,OAAO,OAAO,6DAA6D;AAAA,cAC5E;AAAA,cACA,gBAAgB;AAAA,cAChB,OAAO,GAAG;AAAA,YACd,CAAC;AAAA,UACL;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ,SAAS,KAAU;AACf,WAAK,OAAO,OAAO,0DAA0D;AAAA,QACzE;AAAA,QACA,OAAO,KAAK;AAAA,MAChB,CAAC;AAAA,IACL;AASA,QAAI,UAAe;AACnB,QAAI;AACA,gBAAW,OAAe,aAAa,MAAM;AAAA,IACjD,QAAQ;AAEJ,gBAAU;AAAA,IACd;AACA,QAAI;AACA,UAAI,WAAW,OAAO,QAAQ,qBAAqB,YAAY;AAC3D,YAAI,QAAQ,iBAAiB,OAAO,QAAQ,qBAAqB,YAAY;AACzE,kBAAQ,iBAAiB,QAAQ,aAAa;AAAA,QAClD;AACA,YAAI,SAAS;AACb,mBAAW,WAAW,OAAO;AACzB,cAAI,CAAC,WAAW,OAAO,YAAY,SAAU;AAC7C,qBAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,gBAAI,QAAQ,OAAO,SAAS,UAAU;AAClC,kBAAI;AACA,wBAAQ,iBAAiB,QAAQ,IAA+B;AAChE;AAAA,cACJ,SAAS,KAAU;AACf,qBAAK,OAAO,OAAO,wDAAwD;AAAA,kBACvE;AAAA,kBAAe;AAAA,kBAAQ,OAAO,KAAK;AAAA,gBACvC,CAAC;AAAA,cACL;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ;AACA,YAAI,SAAS,GAAG;AACZ,eAAK,OAAO,OAAO,qDAAqD;AAAA,YACpE;AAAA,YAAe,SAAS;AAAA,YAAQ,SAAS,MAAM;AAAA,UACnD,CAAC;AAAA,QACL;AAAA,MACJ;AAAA,IACJ,SAAS,KAAU;AACf,WAAK,OAAO,OAAO,mDAAmD;AAAA,QAClE;AAAA,QACA,OAAO,KAAK;AAAA,MAChB,CAAC;AAAA,IACL;AAEA,SAAK,OAAO,OAAO,wCAAwC;AAAA,MACvD;AAAA,MACA,UAAU,SAAS;AAAA,MACnB,UAAU,SAAS;AAAA,MACnB,aAAa,QAAQ,KAAK,cAAc;AAAA,IAC5C,CAAC;AAED,WAAO;AAAA,EACX;AACJ;;;AEtjBA,IAAM,cAAc;AAIpB,SAAS,YAAY,KAA6D;AAC9E,MAAI,CAAC,IAAK,QAAO;AAEjB,MAAI,OAAO,IAAI,kBAAkB,WAAY,QAAO,IAAI,cAAc,KAAK,GAAG;AAC9E,MAAI,OAAO,IAAI,YAAY,WAAY,QAAO,IAAI,QAAQ,KAAK,GAAG;AAClE,MAAI,IAAI,OAAO,OAAO,IAAI,IAAI,YAAY,WAAY,QAAO,IAAI,IAAI,QAAQ,KAAK,IAAI,GAAG;AAEzF,MAAI,IAAI,QAAQ,OAAO,IAAI,KAAK,YAAY,WAAY,QAAO,IAAI,KAAK,QAAQ,KAAK,IAAI,IAAI;AAC7F,SAAO;AACX;AAEA,eAAe,mBAAmB,KAAsE;AACpG,QAAM,SAAS,YAAY,GAAG;AAC9B,MAAI,OAAQ,QAAO;AACnB,MAAI,OAAO,KAAK,WAAW,YAAY;AACnC,QAAI;AACA,YAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,aAAO,YAAY,GAAG,KAAK,YAAY,EAAE,IAAI,CAAC;AAAA,IAClD,QAAQ;AACJ,aAAO;AAAA,IACX;AAAA,EACJ;AACA,SAAO;AACX;AAEO,IAAM,kBAAN,MAAwC;AAAA,EAAxC;AACH,SAAS,OAAO;AAChB,SAAS,UAAU;AAEnB,gBAAO,OAAO,SAAuC;AAAA,IAErD;AAEA,iBAAQ,OAAO,QAAsC;AAIjD,UAAI,KAAK,gBAAgB,YAAY;AACjC,YAAI;AACJ,YAAI;AACA,uBAAa,IAAI,WAAW,aAAa;AAAA,QAC7C,QAAQ;AACJ,cAAI,QAAQ,OAAO,4EAAuE;AAC1F;AAAA,QACJ;AACA,YAAI,CAAC,cAAc,OAAO,WAAW,cAAc,YAAY;AAC3D,cAAI,QAAQ,OAAO,kFAA6E;AAChG;AAAA,QACJ;AAEA,cAAM,SAAS,WAAW,UAAU;AACpC,cAAM,gBAAgB,IAAI,WAA0B,gBAAgB;AACpE,cAAM,cAAc,IAAI,WAAsC,cAAc;AAE5E,cAAM,UAAU,OAAO,MAAW;AAC9B,cAAI;AACA,kBAAM,MAAM,IAAI,IAAI,EAAE,IAAI,GAAG;AAC7B,kBAAM,OAAO,IAAI;AACjB,gBAAI;AACJ,gBAAI;AACA,oBAAM,MAAM,MAAM,YAAY,kBAAkB,IAAI;AACpD,8BAAgB,KAAK;AAAA,YACzB,QAAQ;AAAA,YAER;AACA,gBAAI,CAAC,eAAe;AAChB,qBAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,KAAK,GAAG,GAAG;AAAA,YAC3D;AAEA,kBAAM,gBAAgB,MAAM,cAAc,YAAY,aAAa;AACnE,gBAAI;AACJ,gBAAI;AACA,wBAAU,MAAO,cAAsB,kBAAkB,MAAM;AAAA,YACnE,QAAQ;AAAE,wBAAU;AAAA,YAAW;AAC/B,gBAAI,CAAC,SAAS;AACV,kBAAI;AAAE,0BAAW,cAAsB,aAAa,MAAM;AAAA,cAAG,QAAQ;AAAA,cAAe;AAAA,YACxF;AAQA,kBAAM,UAAU,IAAI,SAAS,WAAW,cAAc,GAAG,IACnD,IAAI,SAAS,UAAU,YAAY,SAAS,CAAC,IAC7C;AACN,gBAAI,EAAE,IAAI,WAAW,UAAU,YAAY,YAAY,YAAY,qBAAqB;AACpF,kBAAI,YAAY,UAAU;AACtB,oBAAI;AACA,wBAAM,SAAS,OAAO,SAAS,oBAAoB,aAC7C,QAAQ,gBAAgB,IACxB;AACN,sBAAI,QAAQ;AACR,2BAAO,EAAE,KAAK,EAAE,SAAS,MAAM,MAAM,OAAO,CAAC;AAAA,kBACjD;AACA,yBAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,2BAA2B,SAAS,uCAAuC,EAAE,GAAG,GAAG;AAAA,gBACtI,SAAS,GAAQ;AACb,yBAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,qBAAqB,SAAS,OAAO,GAAG,WAAW,CAAC,EAAE,EAAE,GAAG,GAAG;AAAA,gBACjH;AAAA,cACJ;AAEA,kBAAI;AAaA,sBAAM,aAAa,OAAO,SAAS,kBAAkB,aAC/C,QAAQ,cAAc,IACtB;AACN,oBAAI,CAAC,cAAc,OAAO,WAAW,UAAU,YAAY;AACvD,yBAAO,EAAE,KAAK,EAAE,UAAU,KAAK,CAAC;AAAA,gBACpC;AACA,sBAAM,QAAQ,MAAM,WAAW,MAAM,YAAY,CAAC,CAAC;AACnD,uBAAO,EAAE,KAAK,EAAE,WAAW,SAAS,KAAK,EAAE,CAAC;AAAA,cAChD,QAAQ;AACJ,uBAAO,EAAE,KAAK,EAAE,UAAU,KAAK,CAAC;AAAA,cACpC;AAAA,YACJ;AAEA,kBAAM,KAAK,MAAM,mBAAmB,OAAO;AAC3C,gBAAI,CAAC,IAAI;AACL,qBAAO,EAAE,KAAK,EAAE,OAAO,4BAA4B,cAAc,GAAG,GAAG;AAAA,YAC3E;AAIA,kBAAM,OAAO,MAAM,GAAG,EAAE,IAAI,GAAG;AAc/B,kBAAM,aAAa,QAAQ,IAAI,kBAAkB;AACjD,gBAAI,YAAY;AACZ,oBAAM,cAAc,WAAW,WAAW,GAAG,IAAI,aAAa,IAAI,UAAU;AAC5E,oBAAM,aAAa;AAAA,gBACf;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cACJ;AACA,kBAAI;AACA,2BAAW,KAAK,YAAY;AACxB,wBAAM,WAAW,EAAE,WAAW,WAAW;AACzC,wBAAM,QAAQ,6BAA6B,WAAW,iBAAiB,WAAW,aAAa,EAAE;AACjG,kBAAC,KAAa,SAAS,SAAS,cAAc,GAAG,CAAC,MAAM,KAAK,EAAE;AAAA,gBACnE;AAAA,cACJ,QAAQ;AAAA,cAA4B;AAAA,YACxC;AAEA,mBAAO;AAAA,UACX,SAAS,KAAU;AACf,YAAC,IAAI,QAAQ,QAAgB,0CAA0C;AAAA,cACnE,OAAO,KAAK;AAAA,cACZ,OAAO,KAAK;AAAA,YAChB,CAAC;AACD,mBAAO,EAAE,KAAK;AAAA,cACV,OAAO;AAAA,cACP,SAAS,KAAK,WAAW,OAAO,GAAG;AAAA,YACvC,GAAG,GAAG;AAAA,UACV;AAAA,QACJ;AAKA,YAAI,OAAO,OAAO,QAAQ,YAAY;AAClC,iBAAO,IAAI,GAAG,WAAW,MAAM,OAAO;AAAA,QAC1C,OAAO;AACH,qBAAW,KAAK,CAAC,OAAO,QAAQ,OAAO,UAAU,SAAS,SAAS,GAAY;AAC3E,gBAAI;AAAE,qBAAO,CAAC,IAAI,GAAG,WAAW,MAAM,OAAO;AAAA,YAAG,QAAQ;AAAA,YAAoB;AAAA,UAChF;AAAA,QACJ;AACA,YAAI,QAAQ,OAAO,2CAA2C,WAAW,IAAI;AAAA,MACjF,CAAC;AAAA,IACL;AAAA;AACJ;;;AC5NO,IAAM,oBAAoB;AAS1B,SAAS,gBAAgB,UAAkC;AAC9D,QAAM,OAAO,YAAY,QAAQ,IAAI,gBAAgB,IAAI,KAAK;AAC9D,QAAM,QAAQ,IAAI,YAAY;AAC9B,MAAI,UAAU,SAAS,UAAU,UAAU,UAAU,WAAW,UAAU,YAAY;AAClF,WAAO;AAAA,EACX;AACA,QAAM,SAAS,OAAO;AACtB,SAAO,OAAO,QAAQ,QAAQ,EAAE;AACpC;;;ACGA,IAAM,qBAAqB;AAepB,IAAM,yBAAN,MAAM,wBAAyC;AAAA,EAMlD,YAAY,SAAuC,CAAC,GAAG;AALvD,SAAS,OAAO;AAChB,SAAS,UAAU;AAQnB,gBAAO,OAAO,SAAuC;AAAA,IAErD;AAEA,iBAAQ,OAAO,QAAsC;AACjD,UAAI,KAAK,gBAAgB,YAAY;AACjC,YAAI;AACJ,YAAI;AACA,uBAAa,IAAI,WAAW,aAAa;AAAA,QAC7C,QAAQ;AACJ,cAAI,QAAQ,OAAO,0FAAqF;AACxG;AAAA,QACJ;AACA,YAAI,CAAC,cAAc,OAAO,WAAW,cAAc,YAAY;AAC3D,cAAI,QAAQ,OAAO,gGAA2F;AAC9G;AAAA,QACJ;AAEA,cAAM,SAAS,WAAW,UAAU;AACpC,cAAM,WAAW,KAAK;AAEtB,cAAM,UAAU,OAAO,GAAQ,SAAc;AACzC,cAAI,CAAC,UAAU;AACX,mBAAO,EAAE,KAAK;AAAA,cACV,SAAS;AAAA,cACT,OAAO;AAAA,gBACH,MAAM;AAAA,gBACN,SAAS;AAAA,cACb;AAAA,YACJ,GAAG,GAAG;AAAA,UACV;AACA,cAAI;AACA,kBAAM,cAAc,IAAI,IAAI,EAAE,IAAI,GAAG;AAKrC,gBAAI,YAAY,SAAS,WAAW,GAAG,kBAAkB,gBAAgB,GAAG;AACxE,qBAAO,KAAK;AAAA,YAChB;AAEA,kBAAM,SAAS,GAAG,QAAQ,GAAG,YAAY,QAAQ,GAAG,YAAY,MAAM;AAMtE,kBAAM,SAAS,OAAO,EAAE,IAAI,UAAU,KAAK,EAAE,YAAY;AACzD,gBAAI,WAAW,SAAS,WAAW,QAAQ;AACvC,qBAAO,EAAE,KAAK;AAAA,gBACV,SAAS;AAAA,gBACT,OAAO;AAAA,kBACH,MAAM;AAAA,kBACN,SAAS;AAAA,gBACb;AAAA,cACJ,GAAG,GAAG;AAAA,YACV;AAEA,kBAAM,OAAO,MAAM,MAAM,QAAQ;AAAA,cAC7B;AAAA,cACA,SAAS;AAAA;AAAA;AAAA;AAAA,gBAIL,UAAU,EAAE,IAAI,OAAO,QAAQ,KAAK;AAAA,gBACpC,cAAc,8BAA8B,wBAAuB,UAAU,WAAW,OAAO;AAAA,cACnG;AAAA,YACJ,CAAC;AAED,kBAAM,UAAU,IAAI,QAAQ;AAC5B,kBAAM,qBAAqB,CAAC,gBAAgB,iBAAiB,QAAQ,eAAe;AACpF,uBAAW,KAAK,oBAAoB;AAChC,oBAAM,IAAI,KAAK,QAAQ,IAAI,CAAC;AAC5B,kBAAI,EAAG,SAAQ,IAAI,GAAG,CAAC;AAAA,YAC3B;AAEA,kBAAM,OAAO,MAAM,KAAK,YAAY;AACpC,mBAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,QAAQ,CAAC;AAAA,UAC9D,SAAS,KAAU;AACf,kBAAM,SAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,KAAK,WAAW,OAAO,GAAG,CAAC;AACjF,gBAAI,QAAQ,QAAQ,yCAAyC,MAAM;AACnE,mBAAO,EAAE,KAAK;AAAA,cACV,SAAS;AAAA,cACT,OAAO;AAAA,gBACH,MAAM;AAAA,gBACN,SAAS,KAAK,WAAW,OAAO,GAAG;AAAA,cACvC;AAAA,YACJ,GAAG,GAAG;AAAA,UACV;AAAA,QACJ;AAEA,YAAI,OAAO,OAAO,QAAQ,YAAY;AAClC,iBAAO,IAAI,GAAG,kBAAkB,MAAM,OAAO;AAAA,QACjD,OAAO;AACH,qBAAW,KAAK,CAAC,OAAO,MAAM,GAAY;AACtC,gBAAI;AAAE,qBAAO,CAAC,IAAI,GAAG,kBAAkB,MAAM,OAAO;AAAA,YAAG,QAAQ;AAAA,YAAoB;AAAA,UACvF;AAAA,QACJ;AAEA,YAAI,QAAQ,OAAO,uCAAuC,kBAAkB,aAAQ,YAAY,gBAAgB,EAAE;AAAA,MACtH,CAAC;AAAA,IACL;AAxGI,SAAK,WAAW,gBAAgB,OAAO,eAAe;AAAA,EAC1D;AAwGJ;;;ACrIA,SAAS,YAAAC,WAAU,YAAY;AAC/B,SAAS,WAAWC,oBAAmB;AAyChC,IAAM,wBAAN,MAA4B;AAAA,EAU/B,YAAY,SAAsC,CAAC,GAAG;AAClD,UAAM,MAAM,QAAQ,IAAI;AACxB,SAAK,eAAeA;AAAA,MAChB;AAAA,MACA,OAAO,gBACA,QAAQ,IAAI,oBACZ;AAAA,IACX;AACA,SAAK,gBAAgB,OAAO,iBACrB,QAAQ,IAAI,qBACZ;AACP,SAAK,iBAAiB,OAAO,kBACtB,QAAQ,IAAI,sBACZ;AACP,SAAK,kBAAkB,OAAO;AAC9B,SAAK,QAAQ,OAAO,SAAS;AAC7B,SAAK,SAAS,OAAO,UAAU;AAAA,EACnC;AAAA,EAEA,MAAM,gBAAgB,OAAiD;AAEnE,UAAM,UAAU,KAAK,mBAAoB,MAAM,KAAK,wBAAwB;AAC5E,WAAO;AAAA,MACH,eAAe,KAAK;AAAA,MACpB,gBAAgB,KAAK;AAAA,MACrB,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjC;AAAA,EACJ;AAAA,EAEA,MAAM,cAAc,gBAAwB,OAA0E;AAClH,WAAO,KAAK,aAAa;AAAA,EAC7B;AAAA,EAEA,MAAM,uBAAuB,UAAsF;AAC/G,WAAO,EAAE,eAAe,KAAK,eAAe,gBAAgB,KAAK,eAAe;AAAA,EACpF;AAAA,EAEA,MAAM,gBACF,gBACA,aACiE;AACjE,UAAM,WAAW,MAAM,KAAK,aAAa;AACzC,WAAO,WACD,EAAE,UAAU,SAAS,YAAY,SAAS,aAAa,KAAK,IAC5D;AAAA,EACV;AAAA,EAEA,WAAW,gBAA8B;AACrC,SAAK,SAAS;AAAA,EAClB;AAAA,EAEA,QAAc;AACV,SAAK,SAAS;AAAA,EAClB;AAAA,EAEA,MAAc,eAA4D;AACtE,QAAI;AACA,YAAM,QAAQ,MAAM,KAAK,KAAK,YAAY;AAC1C,YAAM,UAAU,MAAM;AACtB,UAAI,CAAC,KAAK,SAAS,KAAK,OAAQ,QAAO,KAAK,OAAO;AACnD,UAAI,KAAK,UAAU,KAAK,OAAO,YAAY,QAAS,QAAO,KAAK,OAAO;AAEvE,YAAM,MAAM,MAAMD,UAAS,KAAK,cAAc,MAAM;AACpD,YAAM,SAAS,KAAK,MAAM,GAAG;AAG7B,YAAM,aAAa,UAAU,OAAO,WAAW,YACxC,OAAO,OAAO,aAAa,YAC3B,OAAO,aAAa;AAC3B,YAAM,WAAW,aAAa,OAAO,WAAW;AAChD,YAAM,UAAU,KAAK,oBACb,aAAa,OAAO,UAAU,WAC/B,KAAK,0BAA0B,QAAQ,KACvC,KAAK,0BAA0B;AACtC,YAAM,WAAwC;AAAA,QAC1C,eAAe,OAAO,iBAAiB;AAAA,QACvC,eAAe,OAAO,iBAAiB,KAAK;AAAA,QAC5C,UAAU,OAAO,YAAY;AAAA,QAC7B,UAAU,OAAO,YAAY;AAAA,QAC7B,aAAa,OAAO,gBAAe,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC1D;AAAA,QACA,WAAW,OAAO;AAAA,QAClB,UAAU,OAAO;AAAA,QACjB,SAAS;AAAA,UACL,gBAAgB,KAAK;AAAA,UACrB,GAAG;AAAA,QACP;AAAA,MACJ;AACA,WAAK,SAAS,EAAE,SAAS,SAAS;AAClC,aAAO;AAAA,IACX,SAAS,KAAU;AACf,WAAK,OAAO,QAAQ,mDAAmD;AAAA,QACnE,cAAc,KAAK;AAAA,QACnB,OAAO,KAAK,WAAW;AAAA,MAC3B,CAAC;AACD,aAAO;AAAA,IACX;AAAA,EACJ;AAAA,EAEA,MAAc,0BAAyE;AACnF,UAAM,WAAW,MAAM,KAAK,aAAa;AACzC,WAAO,UAAU;AAAA,EACrB;AAAA,EAEQ,0BAA0B,UAAqD;AACnF,UAAM,cAAc,UAAU;AAC9B,QAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,YAAY,WAAW,EAAG,QAAO;AACpE,UAAM,UAA6B,UAAU;AAC7C,QAAI;AACJ,QAAI,SAAS;AACT,YAAM,MAAM,QAAQ,KAAK,CAAC,MAAW,GAAG,YAAY,IAAI;AACxD,UAAI,KAAK,WAAY,iBAAgB,IAAI;AAAA,IAC7C;AACA,UAAM,KAAK,gBACL,YAAY,KAAK,CAAC,MAAW,GAAG,SAAS,aAAa,KAAK,YAAY,CAAC,IACxE,YAAY,CAAC;AACnB,QAAI,CAAC,MAAM,OAAO,OAAO,SAAU,QAAO;AAC1C,UAAM,SAAU,GAAG,UAAU,CAAC;AAC9B,UAAM,MAAM,OAAO,OAAO,OAAO,oBAAoB,OAAO,cAAc,OAAO;AACjF,UAAM,SAAS,GAAG;AAClB,QAAI,OAAO,WAAW,YAAY,OAAO,QAAQ,SAAU,QAAO;AAClE,WAAO;AAAA,MACH,gBAAgB;AAAA,MAChB,aAAa;AAAA,MACb,mBAAmB,OAAO,OAAO,cAAc,WAAW,OAAO,YAAY;AAAA,IACjF;AAAA,EACJ;AAAA,EAEQ,4BAAsD;AAC1D,UAAM,MAAM,QAAQ,IAAI;AACxB,UAAM,SAASC,aAAY,KAAK,qBAAqB,GAAG,KAAK,aAAa,KAAK;AAC/E,WAAO;AAAA,MACH,gBAAgB;AAAA,MAChB,aAAa,QAAQ,MAAM;AAAA,IAC/B;AAAA,EACJ;AACJ;;;AC9HA,eAAe,0BAA6C;AACxD,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,uBAAuB;AAC/D,QAAM,EAAE,cAAAC,cAAa,IAAI,MAAM;AAC/B,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,uBAAuB;AAC/D,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,4BAA4B;AAEpE,QAAM,SAAS,IAAI,eAAe;AAClC,QAAM,aAAa;AAEnB,QAAM,SAAsB,EAAE,IAAI,KAAK;AACvC,QAAM,WAAmB;AAAA,IACrB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,KAAK,KAAoB;AAC3B,YAAM,SAAS,IAAI,eAAe;AAClC,MAAC,KAAa,SAAS;AACvB,UAAK,OAAe,KAAM,OAAO,OAAe,KAAK,GAAG;AAKxD,aAAO,KAAM,OAAe,MAAM;AAAA,IACtC;AAAA,IACA,MAAM,MAAM,KAAoB;AAC5B,YAAM,SAAU,KAAa;AAM7B,UAAI,QAAQ,MAAO,OAAM,OAAO,MAAM,GAAG;AAAA,IAC7C;AAAA,IACA,MAAM,UAAU;AACZ,YAAM,SAAU,KAAa;AAC7B,UAAI,QAAQ,QAAS,OAAM,OAAO,QAAQ;AAAA,eACjC,QAAQ,KAAM,OAAM,OAAO,KAAK;AAAA,IAC7C;AAAA,EACJ;AAEA,QAAM,oBAA4B;AAAA,IAC9B,MAAM;AAAA,IACN,SAAS;AAAA,IACT,cAAc,CAAC,iCAAiC;AAAA,IAChD,MAAM,OAAO;AACT,YAAM,KAAK,OAAO;AAClB,UAAI,IAAI,sBAAsB;AAC1B,WAAG,qBAAqB;AAAA,UACpB,EAAE,SAAS,MAAM,YAAY,0BAA0B,UAAU,GAAG;AAAA,QACxE,CAAC;AAAA,MACL;AAAA,IACJ;AAAA,EACJ;AAEA,QAAM,eAAe,IAAIA,cAAa,QAAe,UAAU;AAE/D,QAAM,WAAW,IAAI,eAAe;AAAA,IAChC,OAAO;AAAA;AAAA;AAAA,IAGP,uBAAuB;AAAA,EAC3B,CAAC;AAED,SAAO,CAAC,UAAU,mBAAmB,cAAmC,QAA6B;AACzG;AAQA,IAAM,4BAAN,MAAkD;AAAA,EAQ9C,YAAY,QAA6B;AAPzC,SAAS,OAAO;AAChB,SAAS,UAAU;AAUnB,gBAAO,OAAO,QAAsC;AAChD,YAAM,SAAoD,KAAK,OAAO,WAC9D,KAAK,OAAO,oBAAoB,SAC9B,IAAI,sBAAsB;AAAA,QACxB,GAAI,KAAK,OAAO,cAAc,CAAC;AAAA,QAC/B,QAAQ,IAAI;AAAA,MAChB,CAAC,IACC,IAAI,kBAAkB;AAAA,QACpB,iBAAiB,KAAK,OAAO;AAAA,QAC7B,QAAQ,KAAK,OAAO;AAAA,QACpB,YAAY,KAAK,OAAO;AAAA,QACxB,QAAQ,IAAI;AAAA,MAChB,CAAC;AACT,WAAK,SAAS;AAEd,YAAM,cAAyC,IAAI,4BAA4B;AAAA,QAC3E;AAAA,QACA,YAAY,KAAK,OAAO;AAAA,QACxB,QAAQ,IAAI;AAAA,MAChB,CAAC;AAED,YAAM,UAAU,IAAI,sBAAsB;AAAA,QACtC;AAAA,QACA;AAAA,QACA,QAAQ,IAAI;AAAA,MAChB,CAAC;AAED,YAAM,gBAAgB,IAAI,cAAc;AAAA,QACpC;AAAA,QACA,SAAS,KAAK,OAAO;AAAA,QACrB,OAAO,KAAK,OAAO;AAAA,QACnB,QAAQ,IAAI;AAAA,MAChB,CAAC;AACD,WAAK,gBAAgB;AAErB,UAAI,gBAAgB,gBAAgB,WAAW;AAC/C,UAAI,gBAAgB,kBAAkB,aAAa;AACnD,UAAI,gBAAgB,uBAAuB,MAAM;AAEjD,UAAI,OAAO,OAAO,uEAAuE;AAAA,QACrF,MAAM,KAAK,OAAO,oBAAoB,SAAS,SAAS;AAAA,QACxD,iBAAiB,KAAK,OAAO;AAAA,MACjC,CAAC;AAAA,IACL;AAEA,mBAAU,YAA2B;AACjC,UAAI;AAAE,cAAM,KAAK,eAAe,SAAS;AAAA,MAAG,QAAQ;AAAA,MAAoB;AACxE,UAAI;AAAE,aAAK,QAAQ,MAAM;AAAA,MAAG,QAAQ;AAAA,MAAoB;AAAA,IAC5D;AAnDI,SAAK,SAAS;AAAA,EAClB;AAmDJ;AAEA,eAAsB,oBAAoB,QAA2D;AACjG,MAAI,CAAC,OAAO,mBAAmB,CAAC,OAAO,QAAQ;AAC3C,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACxF;AACA,QAAM,SAA8B;AAAA,IAChC,GAAG;AAAA,IACH,iBAAiB,OAAO,QAAQ,IAAI,wBAAwB,OAAO,mBAAmB,EAAE;AAAA,IACxF,aAAa,OAAO,QAAQ,IAAI,oBAAoB,OAAO,eAAe,KAAK,KAAK,GAAI;AAAA,IACxF,eAAe,OAAO,QAAQ,IAAI,uBAAuB,OAAO,iBAAiB,IAAI,KAAK,GAAI;AAAA,IAC9F,oBAAoB,OAAO,QAAQ,IAAI,4BAA4B,OAAO,sBAAsB,IAAI,KAAK,GAAI;AAAA,EACjH;AAEA,QAAM,gBAAgB,MAAM,wBAAwB;AAEpD,SAAO;AAAA,IACH,SAAS,CAAC,GAAG,eAAe,IAAI,0BAA0B,MAAM,GAAG,IAAI,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,iBAAiB,OAAO,oBAAoB,SAAS,SAAY,OAAO,gBAAgB,CAAC,CAAC;AAAA,IACjN,KAAK;AAAA,MACD,sBAAsB;AAAA,MACtB,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMnB,aAAa;AAAA,IACjB;AAAA,EACJ;AACJ;;;AC7MA,SAAS,cAAAC,aAAY,aAAAC,YAAW,cAAc,aAAa,YAAY,qBAAqB;AAC5F,SAAS,MAAM,eAAe;AAI9B,IAAM,aAAa;AACnB,IAAM,cAAc;AAuBpB,SAAS,aAAa,YAA4B;AAC9C,SAAO,WAAW,QAAQ,oBAAoB,GAAG,IAAI;AACzD;AAEO,IAAM,gCAAN,MAAsD;AAAA,EAOzD,YAAY,SAA8C,CAAC,GAAG;AAN9D,SAAS,OAAO;AAChB,SAAS,UAAU;AAYnB,gBAAO,OAAO,SAAuC;AAAA,IAErD;AAEA,iBAAQ,OAAO,QAAsC;AACjD,UAAI,KAAK,gBAAgB,YAAY;AAEjC,cAAM,KAAK,UAAU,GAAG;AAGxB,YAAI;AACJ,YAAI;AACA,uBAAa,IAAI,WAAW,aAAa;AAAA,QAC7C,QAAQ;AACJ,cAAI,QAAQ,OAAO,0FAAqF;AACxG;AAAA,QACJ;AACA,YAAI,CAAC,cAAc,OAAO,WAAW,cAAc,YAAY;AAC3D,cAAI,QAAQ,OAAO,gGAA2F;AAC9G;AAAA,QACJ;AACA,cAAM,SAAS,WAAW,UAAU;AAEpC,cAAM,cAAc,OAAO,MAAW,KAAK,cAAc,GAAG,GAAG;AAC/D,cAAM,aAAa,OAAO,MAAW,KAAK,WAAW,CAAC;AACtD,cAAM,gBAAgB,OAAO,MAAW,KAAK,gBAAgB,GAAG,GAAG;AAEnE,YAAI,OAAO,OAAO,SAAS,WAAY,QAAO,KAAK,YAAY,WAAW;AAC1E,YAAI,OAAO,OAAO,QAAQ,WAAY,QAAO,IAAI,YAAY,UAAU;AACvE,YAAI,OAAO,OAAO,WAAW,WAAY,QAAO,OAAO,GAAG,UAAU,gBAAgB,aAAa;AAEjG,YAAI,QAAQ,OAAO,wCAAwC,UAAU,cAAc,KAAK,UAAU,GAAG;AAAA,MACzG,CAAC;AAAA,IACL;AASA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAQ,YAAY,OAAO,QAAsC;AAC7D,YAAM,UAAU,KAAK,QAAQ;AAC7B,UAAI,QAAQ,WAAW,EAAG;AAE1B,UAAI,kBAAqD;AACzD,UAAI;AACA,0BAAkB,IAAI,WAAW,UAAU;AAAA,MAC/C,QAAQ;AACJ,YAAI,QAAQ,OAAO,0EAAqE;AACxF;AAAA,MACJ;AAEA,iBAAW,SAAS,SAAS;AACzB,YAAI;AACA,0BAAiB,SAAS,MAAM,QAAQ;AAIxC,cAAI;AACA,kBAAM,KAAU,IAAI,WAAW,UAAU;AACzC,gBAAI,MAAM,OAAO,GAAG,gBAAgB,WAAY,OAAM,GAAG,YAAY;AAAA,UACzE,QAAQ;AAAA,UAAkB;AAK1B,gBAAM,KAAK,iBAAiB,KAAK,MAAM,UAAU,EAAE,SAAS,MAAM,CAAC;AACnE,cAAI,QAAQ,OAAO,wCAAwC,MAAM,UAAU,IAAI,MAAM,OAAO,EAAE;AAAA,QAClG,SAAS,KAAU;AACf,cAAI,QAAQ,QAAQ,kDAAkD,MAAM,UAAU,IAAI,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,QACjJ;AAAA,MACJ;AAAA,IACJ;AAEA,SAAQ,gBAAgB,OAAO,GAAQ,QAA0C;AAC7E,UAAI,CAAC,KAAK,UAAU;AAChB,eAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,2BAA2B,SAAS,+BAA+B,EAAE,GAAG,GAAG;AAAA,MAC9H;AACA,YAAM,SAAS,MAAM,KAAK,yBAAyB,GAAG,GAAG;AACzD,UAAI,CAAC,QAAQ;AACT,eAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,gBAAgB,SAAS,+CAA+C,EAAE,GAAG,GAAG;AAAA,MACnI;AAEA,UAAI,OAAY,CAAC;AACjB,UAAI;AAAE,eAAO,MAAM,EAAE,IAAI,KAAK;AAAA,MAAG,QAAQ;AAAA,MAAmB;AAC5D,YAAM,YAAY,OAAO,MAAM,aAAa,EAAE,EAAE,KAAK;AACrD,YAAM,YAAY,OAAO,MAAM,aAAa,QAAQ,EAAE,KAAK,KAAK;AAChE,UAAI,CAAC,WAAW;AACZ,eAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,eAAe,SAAS,yBAAyB,EAAE,GAAG,GAAG;AAAA,MAC5G;AAGA,UAAI;AACJ,UAAI;AACA,cAAM,MAAM,GAAG,KAAK,QAAQ,gCAAgC,mBAAmB,SAAS,CAAC,aAAa,mBAAmB,SAAS,CAAC;AACnI,cAAM,OAAO,MAAM,MAAM,KAAK,EAAE,SAAS,EAAE,UAAU,mBAAmB,EAAE,CAAC;AAC3E,YAAI,CAAC,KAAK,IAAI;AACV,gBAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,MAAM,EAAE;AAC7C,iBAAO,EAAE,KAAK;AAAA,YACV,SAAS;AAAA,YACT,OAAO,EAAE,MAAM,sBAAsB,SAAS,kBAAkB,KAAK,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC,GAAG;AAAA,UACzG,GAAG,KAAK,WAAW,MAAM,MAAM,GAAG;AAAA,QACtC;AACA,kBAAU,MAAM,KAAK,KAAK;AAAA,MAC9B,SAAS,KAAU;AACf,eAAO,EAAE,KAAK;AAAA,UACV,SAAS;AAAA,UACT,OAAO,EAAE,MAAM,sBAAsB,SAAS,KAAK,WAAW,OAAO,GAAG,EAAE;AAAA,QAC9E,GAAG,GAAG;AAAA,MACV;AAEA,YAAM,OAAO,SAAS,QAAQ;AAC9B,YAAM,WAAW,MAAM;AACvB,YAAM,oBAAoB,OAAO,MAAM,cAAc,SAAS;AAC9D,YAAM,UAAU,OAAO,MAAM,WAAW,SAAS;AACjD,YAAM,aAAa,OAAO,UAAU,MAAM,UAAU,QAAQ,EAAE;AAC9D,UAAI,CAAC,YAAY,CAAC,YAAY;AAC1B,eAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,oBAAoB,SAAS,8CAA8C,EAAE,GAAG,GAAG;AAAA,MACtI;AAGA,YAAM,WAAW,KAAK,aAAa,KAAK,UAAU;AAClD,UAAI,aAAa,aAAa;AAC1B,eAAO,EAAE,KAAK;AAAA,UACV,SAAS;AAAA,UACT,OAAO;AAAA,YACH,MAAM;AAAA,YACN,SAAS,gBAAgB,UAAU;AAAA,UACvC;AAAA,QACJ,GAAG,GAAG;AAAA,MACV;AAGA,YAAM,QAAwB;AAAA,QAC1B;AAAA,QACA,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC,aAAa;AAAA,MACjB;AACA,UAAI;AACA,QAAAC,WAAU,KAAK,YAAY,EAAE,WAAW,KAAK,CAAC;AAC9C,sBAAc,KAAK,KAAK,YAAY,aAAa,UAAU,CAAC,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,MAAM;AAAA,MACzG,SAAS,KAAU;AACf,eAAO,EAAE,KAAK;AAAA,UACV,SAAS;AAAA,UACT,OAAO,EAAE,MAAM,kBAAkB,SAAS,+BAA+B,KAAK,WAAW,GAAG,GAAG;AAAA,QACnG,GAAG,GAAG;AAAA,MACV;AAGA,UAAI;AACA,cAAM,kBAAkB,IAAI,WAAW,UAAU;AACjD,wBAAgB,SAAS,QAAQ;AAAA,MACrC,SAAS,KAAU;AAGf,YAAI,QAAQ,OAAO,qDAAqD,UAAU,iCAAiC,KAAK,WAAW,GAAG,EAAE;AAAA,MAC5I;AAMA,UAAI;AACA,cAAM,KAAU,IAAI,WAAW,UAAU;AACzC,YAAI,MAAM,OAAO,GAAG,gBAAgB,YAAY;AAC5C,gBAAM,GAAG,YAAY;AACrB,cAAI,QAAQ,OAAO,iEAAiE,UAAU,EAAE;AAAA,QACpG;AAAA,MACJ,SAAS,KAAU;AACf,YAAI,QAAQ,OAAO,oDAAoD,UAAU,KAAK,KAAK,WAAW,GAAG,EAAE;AAAA,MAC/G;AAOA,YAAM,gBAAgB,MAAM,KAAK,iBAAiB,KAAK,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;AAErF,aAAO,EAAE,KAAK;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,UACF;AAAA,UACA;AAAA,UACA,WAAW;AAAA,UACX,aAAa,MAAM;AAAA,UACnB,WAAW;AAAA,UACX,cAAc,aAAa,gBAAgB,iCAAiC;AAAA,UAC5E,oBAAoB,cAAc;AAAA,UAClC,QAAQ,cAAc;AAAA,UACtB,MAAM;AAAA,QACV;AAAA,MACJ,GAAG,GAAG;AAAA,IACV;AAEA,SAAQ,aAAa,OAAO,MAA8B;AACtD,YAAM,UAAU,KAAK,QAAQ;AAC7B,aAAO,EAAE,KAAK;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,UACF,OAAO,QAAQ,IAAI,QAAM;AAAA,YACrB,WAAW,EAAE;AAAA,YACb,WAAW,EAAE;AAAA,YACb,YAAY,EAAE;AAAA,YACd,SAAS,EAAE;AAAA,YACX,aAAa,EAAE;AAAA,YACf,aAAa,EAAE;AAAA,UACnB,EAAE;AAAA,UACF,OAAO,QAAQ;AAAA,UACf,YAAY,KAAK;AAAA,QACrB;AAAA,MACJ,GAAG,GAAG;AAAA,IACV;AAEA,SAAQ,kBAAkB,OAAO,GAAQ,QAA0C;AAC/E,YAAM,SAAS,MAAM,KAAK,yBAAyB,GAAG,GAAG;AACzD,UAAI,CAAC,QAAQ;AACT,eAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,gBAAgB,SAAS,2BAA2B,EAAE,GAAG,GAAG;AAAA,MAC/G;AACA,YAAM,aAAa,OAAO,EAAE,IAAI,QAAQ,YAAY,KAAK,EAAE,IAAI,QAAQ,cAAc,EAAE,EAAE,KAAK;AAC9F,UAAI,CAAC,YAAY;AACb,eAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,eAAe,SAAS,kCAAkC,EAAE,GAAG,GAAG;AAAA,MACrH;AACA,YAAM,OAAO,KAAK,KAAK,YAAY,aAAa,UAAU,CAAC;AAC3D,UAAI,CAACC,YAAW,IAAI,GAAG;AACnB,eAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,aAAa,SAAS,8BAA8B,UAAU,IAAI,EAAE,GAAG,GAAG;AAAA,MAC7H;AACA,UAAI;AACA,mBAAW,IAAI;AAAA,MACnB,SAAS,KAAU;AACf,eAAO,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,EAAE,MAAM,kBAAkB,SAAS,KAAK,WAAW,OAAO,GAAG,EAAE,EAAE,GAAG,GAAG;AAAA,MAClH;AACA,UAAI,QAAQ,OAAO,yCAAyC,UAAU,2EAA2E;AACjJ,aAAO,EAAE,KAAK;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,UACF;AAAA,UACA,MAAM;AAAA,QACV;AAAA,MACJ,GAAG,GAAG;AAAA,IACV;AAWA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAQ,eAAe,CAAC,KAAoB,eAA6D;AAErG,UAAIA,YAAW,KAAK,KAAK,YAAY,aAAa,UAAU,CAAC,CAAC,GAAG;AAC7D,eAAO;AAAA,MACX;AAEA,UAAI;AACA,cAAM,KAAU,IAAI,WAAW,UAAU;AACzC,cAAM,WAAkB,IAAI,UAAU,iBAAiB,KAAK,CAAC;AAC7D,cAAM,MAAM,SAAS;AAAA,UAAK,CAAC,OACtB,GAAG,UAAU,MAAM,GAAG,MAAM,GAAG,UAAU,UAAU;AAAA,QACxD;AACA,YAAI,IAAK,QAAO;AAAA,MACpB,QAAQ;AAAA,MAAqD;AAC7D,aAAO;AAAA,IACX;AAkCA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAQ,mBAAmB,OACvB,KACA,UACA,SACsK;AACtK,YAAM,QAAQ,OAAO,UAAU,MAAM,SAAS;AAC9C,UAAI,qBAAqB;AACzB,UAAI,cAAmB,EAAE,MAAM,WAAW,QAAQ,cAAc;AAGhE,UAAI;AACA,cAAM,UAA0C,CAAC;AACjD,YAAI,MAAM,QAAQ,UAAU,YAAY,EAAG,SAAQ,KAAK,GAAG,SAAS,YAAY;AAChF,YAAI,MAAM,QAAQ,UAAU,IAAI,EAAG,SAAQ,KAAK,GAAG,SAAS,IAAI;AAEhE,YAAI,QAAQ,SAAS,GAAG;AACpB,cAAI;AACJ,cAAI;AAAE,0BAAc,IAAI,WAAW,MAAM;AAAA,UAAG,QAAQ;AAAA,UAAuB;AAC3E,cAAI,CAAC,aAAa;AACd,gBAAI;AACA,oBAAM,MAAM,MAAM,OAAO,mBAAmB;AAC5C,oBAAM,mBAAoB,IAAY;AACtC,kBAAI,OAAO,qBAAqB,YAAY;AACxC,8BAAc,iBAAiB;AAC/B,gBAAC,IAAY,kBAAkB,QAAQ,WAAW;AAClD,oBAAI,QAAQ,OAAO,0EAA0E,KAAK,GAAG;AAAA,cACzG;AAAA,YACJ,QAAQ;AAAA,YAA6B;AAAA,UACzC;AACA,cAAI,aAAa,kBAAkB;AAC/B,uBAAW,UAAU,SAAS;AAC1B,yBAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,oBAAI,QAAQ,OAAO,SAAS,UAAU;AAClC,sBAAI;AACA,gCAAY,iBAAiB,QAAQ,IAA+B;AACpE;AAAA,kBACJ,SAAS,KAAU;AACf,wBAAI,QAAQ,OAAO,4CAA4C,KAAK,qBAAqB,MAAM,KAAK,KAAK,WAAW,GAAG,EAAE;AAAA,kBAC7H;AAAA,gBACJ;AAAA,cACJ;AAAA,YACJ;AACA,gBAAI,QAAQ,OAAO,oCAAoC,kBAAkB,yBAAyB,KAAK,EAAE;AAAA,UAC7G;AAAA,QACJ;AAAA,MACJ,SAAS,KAAU;AACf,YAAI,QAAQ,OAAO,yDAAyD,KAAK,KAAK,KAAK,WAAW,GAAG,EAAE;AAAA,MAC/G;AAGA,YAAM,WAAW,MAAM,QAAQ,UAAU,IAAI,IACvC,SAAS,KAAK,OAAO,CAAC,MAAW,KAAK,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,CAAC,IAC1E,CAAC;AAEP,UAAI,SAAS,SAAS,GAAG;AACrB,YAAI;AACA,gBAAM,SAAe,IAAY;AACjC,cAAI,WAAkB,CAAC;AACvB,cAAI;AACA,kBAAM,IAAI,QAAQ,aAAa,eAAe;AAC9C,gBAAI,MAAM,QAAQ,CAAC,EAAG,YAAW;AAAA,UACrC,QAAQ;AAAA,UAAc;AACtB,gBAAM,SAAS,CAAC,GAAG,UAAU,GAAG,QAAQ;AACxC,cAAI,QAAQ,gBAAiB,QAAO,gBAAgB,iBAAiB,MAAM;AAAA,cACtE,CAAC,IAAY,kBAAkB,iBAAiB,MAAM;AAC3D,cAAI,QAAQ,OAAO,oCAAoC,SAAS,MAAM,wCAAwC,OAAO,MAAM,GAAG;AAAA,QAClI,SAAS,KAAU;AACf,cAAI,QAAQ,OAAO,4DAA4D,KAAK,WAAW,GAAG,EAAE;AAAA,QACxG;AAAA,MACJ;AAUA,UAAI,KAAK,WAAW,SAAS,SAAS,GAAG;AACrC,cAAM,cAAc,OAAO,QAAQ,IAAI,mBAAmB,MAAM,EAAE,YAAY,MAAM;AACpF,YAAI;AACA,gBAAM,KAAU,IAAI,WAAW,UAAU;AACzC,cAAI;AACJ,cAAI;AAAE,uBAAW,IAAI,WAAW,UAAU;AAAA,UAAG,QAAQ;AAAA,UAAa;AAClE,cAAI,CAAC,MAAM,CAAC,UAAU;AAClB,0BAAc,EAAE,MAAM,WAAW,QAAQ,+BAA+B;AAAA,UAC5E,OAAO;AACH,gBAAI;AACJ,gBAAI,aAAa;AACb,oBAAM,WAAW,MAAM,KAAK,mBAAmB,KAAK,GAAG,GAAG;AAC1D,kBAAI,SAAU,kBAAiB;AAAA,mBAC1B;AACD,8BAAc,EAAE,MAAM,WAAW,QAAQ,6BAA6B;AACtE,oBAAI,QAAQ,OAAO,yFAAoF;AAAA,cAC3G;AAAA,YACJ;AACA,gBAAI,CAAC,eAAe,gBAAgB;AAChC,oBAAM,CAAC,EAAE,mBAAAC,mBAAkB,GAAG,EAAE,wBAAwB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,gBAC3E;AAAA,gBACA,OAAO,wBAAwB;AAAA,cACnC,CAAC;AACD,oBAAM,aAAa,IAAKA,mBAA0B,IAAI,UAAU,IAAI,MAAM;AAC1E,oBAAM,UAAW,wBAAgC,MAAM;AAAA,gBACnD;AAAA,gBACA,QAAQ;AAAA,kBACJ,aAAa;AAAA,kBACb,WAAW;AAAA,kBACX,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,gBAC/C;AAAA,cACJ,CAAC;AACD,oBAAM,SAAS,MAAM,WAAW,KAAK,OAAO;AAC5C,4BAAc;AAAA,gBACV,MAAM;AAAA,gBACN,UAAU,OAAO,QAAQ;AAAA,gBACzB,SAAS,OAAO,QAAQ;AAAA,gBACxB,QAAQ,OAAO,OAAO;AAAA,cAC1B;AACA,kBAAI,QAAQ,OAAO,6CAA6C,KAAK,GAAG,iBAAiB,SAAS,cAAc,MAAM,EAAE,cAAc,YAAY,QAAQ,YAAY,YAAY,OAAO,WAAW,YAAY,MAAM,EAAE;AAAA,YAC5N;AAAA,UACJ;AAAA,QACJ,SAAS,KAAU;AACf,wBAAc,EAAE,MAAM,WAAW,QAAQ,eAAe,KAAK,WAAW,GAAG,GAAG;AAC9E,cAAI,QAAQ,OAAO,iDAAiD,KAAK,KAAK,KAAK,WAAW,GAAG,EAAE;AAAA,QACvG;AAAA,MACJ;AAEA,aAAO,EAAE,oBAAoB,QAAQ,YAAY;AAAA,IACrD;AAQA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAQ,qBAAqB,OAAO,GAAQ,QAA+C;AACvF,UAAI,CAAC,GAAG,KAAK,KAAK,QAAS,QAAO;AAClC,UAAI;AACA,cAAM,cAAmB,IAAI,WAAW,MAAM;AAC9C,YAAI,MAAW,aAAa;AAC5B,YAAI,CAAC,OAAO,OAAO,aAAa,WAAW,WAAY,OAAM,MAAM,YAAY,OAAO;AACtF,YAAI,CAAC,KAAK,WAAY,QAAO;AAC7B,cAAM,UAAU,MAAM,IAAI,WAAW,EAAE,SAAS,EAAE,IAAI,IAAI,QAAQ,CAAC;AACnE,cAAM,SAAS,SAAS,SAAS,wBAAwB,SAAS,wBAAwB;AAC1F,YAAI,OAAQ,QAAO,OAAO,MAAM;AAEhC,cAAM,SAAS,SAAS,MAAM;AAC9B,YAAI,CAAC,OAAQ,QAAO;AACpB,YAAI;AACA,gBAAM,KAAU,IAAI,WAAW,UAAU;AACzC,cAAI,IAAI,MAAM;AACV,kBAAM,OAAO,MAAM,GAAG,KAAK,2BAA2B,EAAE,OAAO,EAAE,SAAS,OAAO,GAAG,OAAO,GAAG,SAAS,EAAE,UAAU,KAAK,EAAE,CAAQ;AAClI,kBAAM,MAAM,MAAM,QAAQ,IAAI,IAAI,KAAK,CAAC,IAAK,MAAM,QAAQ,CAAC,KAAK;AACjE,mBAAO,KAAK,kBAAkB,OAAO,IAAI,eAAe,IAAI;AAAA,UAChE;AAAA,QACJ,QAAQ;AAAA,QAAe;AAAA,MAC3B,QAAQ;AAAA,MAAe;AACvB,aAAO;AAAA,IACX;AAEA,SAAQ,2BAA2B,OAAO,GAAQ,QAA+C;AAC7F,UAAI;AAKA,cAAM,cAAmB,IAAI,WAAW,MAAM;AAC9C,YAAI,MAAW,aAAa;AAC5B,YAAI,CAAC,OAAO,OAAO,aAAa,WAAW,YAAY;AACnD,gBAAM,MAAM,YAAY,OAAO;AAAA,QACnC;AACA,YAAI,KAAK,cAAc,GAAG,KAAK,KAAK,SAAS;AACzC,gBAAM,UAAU,MAAM,IAAI,WAAW,EAAE,SAAS,EAAE,IAAI,IAAI,QAAQ,CAAC;AACnE,gBAAM,SAAS,SAAS,MAAM,MAAM;AACpC,cAAI,OAAQ,QAAO,OAAO,MAAM;AAAA,QACpC;AAAA,MACJ,QAAQ;AAAA,MAA8B;AAEtC,YAAM,UAAU,GAAG,KAAK,SAAS,WAAW;AAC5C,UAAI,QAAS,QAAO,OAAO,OAAO;AAClC,aAAO;AAAA,IACX;AAEA,SAAQ,UAAU,MAAwB;AACtC,UAAI,CAACD,YAAW,KAAK,UAAU,EAAG,QAAO,CAAC;AAC1C,YAAM,MAAwB,CAAC;AAC/B,iBAAW,QAAQ,YAAY,KAAK,UAAU,GAAG;AAC7C,YAAI,CAAC,KAAK,SAAS,OAAO,EAAG;AAC7B,YAAI;AACA,gBAAM,MAAM,aAAa,KAAK,KAAK,YAAY,IAAI,GAAG,MAAM;AAC5D,cAAI,KAAK,KAAK,MAAM,GAAG,CAAC;AAAA,QAC5B,QAAQ;AAAA,QAA2B;AAAA,MACvC;AACA,aAAO;AAAA,IACX;AA3fI,SAAK,WAAW,gBAAgB,OAAO,eAAe;AACtD,SAAK,aAAa,OAAO,aACnB,QAAQ,OAAO,UAAU,IACzB,QAAQ,QAAQ,IAAI,GAAG,WAAW;AAAA,EAC5C;AAwfJ;;;A3BheA;;;A4BuCO,IAAM,4BAAN,MAAwD;AAAA;AAAA,EAE7D,eAAe,OAAuB,MAAqB,OAAgD;AACzG,WAAO,QAAQ,OAAO,IAAI,MAAM,8DAA8D,CAAC;AAAA,EACjG;AAAA;AAAA,EAEA,UAAU,OAAmB,MAAqB,OAAgD;AAChG,WAAO,QAAQ,OAAO,IAAI,MAAM,8DAA8D,CAAC;AAAA,EACjG;AAAA,EACA,IAAI,MAAgB,KAAoB,MAA+C;AACrF,WAAO,KAAK,aAAa,eACrB,KAAK,eAAe,MAAM,KAAK,IAAI,IACnC,KAAK,UAAU,MAAM,KAAK,IAAI;AAAA,EACpC;AAAA,EACA,UAAyB;AACvB,WAAO,QAAQ,QAAQ;AAAA,EACzB;AACF;;;AC5JA;AAEA;;;A7B4HA;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAOP,cAAc;","names":["wrapped","resolve","ObjectKernel","resolvePath","DriverPlugin","AppPlugin","resolvePath","resolvePath","ql","protocol","labels","drivers","backfillPlatformSsoClients","seedPlatformSsoClient","path","isHttpUrl","loadArtifactBundle","resolved","result","generateRequestId","generateRequestId","ctx","entry","createHmac","ObjectKernel","createHmac","driver","ObjectKernel","seedProjectOrganization","seedProjectOwner","seedProjectMember","readFile","resolvePath","DriverPlugin","existsSync","mkdirSync","mkdirSync","existsSync","SeedLoaderService"]}