@odla-ai/cli 0.25.18 → 0.25.19

package/dist/chunk-S3EJ66VG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/admin-ai-auth.ts","../src/local.ts","../src/open.ts","../src/approval-prompt.ts","../src/token.ts","../src/handshake-state.ts","../src/admin-ai-policy.ts","../src/admin-ai.ts","../src/secret-input.ts","../src/admin-ai-audit.ts","../src/admin-ai-usage.ts","../src/config.ts","../src/integration-validation.ts","../src/redact.ts","../src/calendar-errors.ts","../src/calendar-http.ts","../src/calendar-poll.ts","../src/calendar.ts","../src/capabilities.ts","../src/doctor-checks.ts","../src/wrangler.ts","../src/doctor-runbooks.ts","../src/integrations.ts","../src/doctor.ts","../src/init.ts","../src/secrets.ts","../src/secrets-set.ts","../src/skill.ts","../src/skill-adapters.ts","../src/smoke.ts","../src/security-hosted-github.ts","../src/security-hosted-request.ts","../src/code-runtime-config.ts","../src/code-images.ts","../src/code-connect.ts","../../harness/src/types.ts","../../harness/src/protocol.ts","../../harness/src/container.ts","../../harness/src/workspace-git-tree.ts","../../harness/src/workspace-policy.ts","../../harness/src/workspace.ts","../../harness/src/workspace-digest.ts","../../harness/src/code-runtime-client.ts","../../harness/src/code-runtime.ts","../../harness/src/code-checkpoint.ts","../../harness/src/code-patch.ts","../../harness/src/recipe-container.ts","../../harness/src/code-verifier.ts","../../harness/src/code-runtime-checkpoint.ts","../../harness/src/code-runtime-checkpoint-manager.ts","../../harness/src/code-runtime-source.ts","../../harness/src/code-tool-broker.ts","../../harness/src/code-tool-policy.ts","../../harness/src/code-runtime-task.ts","../../harness/src/code-runtime-local-source.ts","../../harness/src/code-runtime-broker.ts","../../harness/src/code-runtime-inference.ts","../../harness/src/code-runtime-events.ts","../../harness/src/code-runtime-engine.ts","../../camel/src/errors.ts","../../camel/src/hash.ts","../../camel/src/readers.ts","../../camel/src/value.ts","../../camel/src/code-verification.ts","../../camel/src/code-checkpoint.ts","../../camel/src/code-deployment.ts","../../camel/src/code.ts","../../camel/src/conversions.ts","../../camel/src/ingress.ts","../../camel/src/policy.ts","../src/help.ts","../src/code-local-source.ts","../src/provision.ts","../src/integration-provision.ts","../src/provision-credentials.ts","../src/provision-helpers.ts","../src/surface.ts","../src/security.ts","../src/security-hosted-intent.ts","../src/security-hosted-jobs.ts","../src/argv.ts","../src/operator-context.ts","../src/operator-profiles.ts","../src/admin-command.ts","../src/tenant.ts","../src/agent-command.ts","../src/app-export.ts","../src/app-import.ts","../src/app-owners.ts","../src/app-rename.ts","../src/app-transfer.ts","../src/app-lifecycle.ts","../src/harness-options.ts","../src/cli-project.ts","../src/code-command.ts","../src/operator-credentials.ts","../src/context-command.ts","../src/discuss-actions.ts","../src/discuss-watch-http.ts","../src/discuss-watch.ts","../src/discuss-command.ts","../src/pm-actions.ts","../src/pm-command.ts","../src/o11y-verdict.ts","../src/o11y-output.ts","../src/o11y-command.ts","../src/record.ts","../src/runbook-actions.ts","../src/runbook-requires.ts","../src/runbook-import.ts","../src/runbook-impact.ts","../src/runbook-impact-scan.ts","../src/runbook-lint.ts","../src/runbook-search-command.ts","../src/runbook-editor.ts","../src/runbook-edit-flow.ts","../src/whoami-command.ts","../src/runbook-command.ts","../src/security-command-context.ts","../src/security-command-output.ts","../src/security-run-command.ts","../src/security-command.ts","../src/cli.ts"],"sourcesContent":["import { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport process from \"node:process\";\nimport { requestToken } from \"@odla-ai/db\";\nimport { ensureGitignore, readJsonFile, writePrivateJson } from \"./local\";\nimport { openUrl } from \"./open\";\nimport { printApproval } from \"./approval-prompt\";\nimport { approvalBrowser, handshakeEmail, handshakeUrl, platformAudience } from \"./token\";\n\n/** One exact platform scope obtainable through the admin device flow. */\nexport type ScopedPlatformScope =\n  | \"platform:ai:policy:read\"\n  | \"platform:ai:policy:write\"\n  | \"platform:ai:credential:read\"\n  | \"platform:ai:credential:write\"\n  | \"platform:ai:usage:read\"\n  | \"platform:ai:audit:read\"\n  | \"app:code:host:connect\"\n  | \"platform:code:host:connect\"\n  | \"platform:security:self\"\n  | \"platform:runbook:write\";\n\n/** Inputs for obtaining one short-lived, exact-scope platform device grant. */\nexport interface ScopedPlatformTokenOptions {\n  platform: string;\n  scope: ScopedPlatformScope;\n  /** Existing odla account email used only when a fresh handshake is required. */\n  email?: string;\n  open?: boolean;\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n  openApprovalUrl?: (url: string) => Promise<void>;\n  tokenFile?: string;\n  /**\n   * Project root the grant cache hangs off, mirroring how the developer token\n   * resolves `.odla/dev-token.json` against the loaded config's `rootDir`.\n   * Callers with a project should pass `cfg.rootDir`: without it the cache\n   * follows the shell's working directory rather than the project, so the same\n   * command run from a subdirectory reads a different cache — and writes a\n   * credential file wherever it happened to be standing.\n   */\n  rootDir?: string;\n  /** Keep the shown-once grant only in memory. */\n  cache?: boolean;\n  /** Human-visible purpose recorded on the exact handshake. */\n  label?: string;\n}\n\ninterface AdminPlatformTokenOptions extends ScopedPlatformTokenOptions {\n  token?: string;\n}\n\n/** Obtain/cache one exact platform scope without granting ambient admin. */\nexport async function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string> {\n  return resolveAdminPlatformToken(options);\n}\n\n/** Resolve an explicit, audience-bound env, cached, or newly approved token. */\nexport async function resolveAdminPlatformToken(options: AdminPlatformTokenOptions): Promise<string> {\n  const audience = platformAudience(options.platform);\n  if (options.token) return options.token;\n  const fromEnv = process.env.ODLA_ADMIN_TOKEN;\n  if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);\n  return scopedToken(\n    audience,\n    options.scope,\n    options,\n    options.fetch ?? fetch,\n    options.stdout ?? console,\n  );\n}\n\nfunction audienceBoundEnvToken(token: string, platform: string): string {\n  const audience = platformAudience(platform);\n  const declared = process.env.ODLA_ADMIN_TOKEN_AUDIENCE;\n  if (declared) {\n    if (platformAudience(declared) !== audience) throw new Error(\"ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform\");\n  } else if (audience !== \"https://odla.ai\") {\n    throw new Error(\"ODLA_ADMIN_TOKEN_AUDIENCE is required for a non-default platform\");\n  }\n  return token;\n}\n\n/** What a scope is FOR, in the words the approval block uses (\"Human approval\n * required to …\"). A scope with no entry falls back to its identifier. */\nconst SCOPE_PURPOSE: Record<string, string> = {\n  \"platform:runbook:write\": \"add or edit odla's operational runbooks\",\n  \"platform:ai:policy:write\": \"change System AI model routing\",\n  \"platform:ai:policy:read\": \"read System AI model routing\",\n  \"platform:ai:credential:write\": \"replace a stored AI provider key\",\n  \"platform:ai:credential:read\": \"list which AI providers have a key stored\",\n  \"platform:ai:usage:read\": \"read System AI usage\",\n  \"platform:ai:audit:read\": \"read the System AI audit log\",\n  \"app:code:host:connect\": \"connect this terminal to an app you own\",\n  \"platform:code:host:connect\": \"connect this terminal to an app you administer\",\n  \"platform:security:self\": \"run a security audit of odla itself\",\n};\n\nasync function scopedToken(\n  platform: string,\n  scope: string,\n  options: ScopedPlatformTokenOptions,\n  doFetch: typeof fetch,\n  out: Pick<typeof console, \"log\" | \"error\">,\n): Promise<string> {\n  const audience = platformAudience(platform);\n  // Anchor the cache to the project, not the shell. `process.cwd()` remains the\n  // fallback for the few scoped commands that run without a loaded config.\n  const rootDir = options.rootDir ?? process.cwd();\n  const tokenFile = options.tokenFile ?? join(rootDir, \".odla/admin-token.local.json\");\n  const cache = options.cache === false ? null\n    : readJsonFile<{ platform?: string; email?: string; tokens?: Record<string, { token?: string; expiresAt?: number }> }>(tokenFile);\n  const cached = cache?.platform === audience ? cache.tokens?.[scope] : undefined;\n  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 60_000) {\n    out.error(`auth: using cached ${scope} grant (${tokenFile})`);\n    return cached.token;\n  }\n  const email = handshakeEmail(options.email, cache?.platform === audience ? cache.email : undefined);\n  const { token, expiresAt } = await requestToken({\n    endpoint: audience,\n    email,\n    label: options.label ?? `odla CLI (${scope})`,\n    scopes: [scope],\n    fetch: doFetch,\n    onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {\n      const approvalUrl = verificationUriComplete ?? handshakeUrl(audience, userCode);\n      const browser = approvalBrowser({ open: options.open });\n      printApproval(out, {\n        userCode,\n        approvalUrl,\n        minutesLeft: Math.floor(expiresIn / 60),\n        purpose: SCOPE_PURPOSE[scope] ?? `use ${scope}`,\n        browserAttempted: browser.open,\n        browserSkipped: browser.reason,\n      });\n      if (browser.open) {\n        await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => undefined);\n      }\n    },\n  });\n  if (options.cache !== false) {\n    const tokens = cache?.platform === audience ? { ...(cache.tokens ?? {}) } : {};\n    tokens[scope] = { token, expiresAt };\n    if (existsSync(join(rootDir, \".git\"))) ensureGitignore(rootDir, [tokenFile]);\n    writePrivateJson(tokenFile, { platform: audience, email, tokens });\n    out.error(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);\n  } else {\n    out.error(`auth: ${scope} grant is in memory only; its credential record remains in odla-ai/db`);\n  }\n  return token;\n}\n","import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\nimport type { LoadedProjectConfig, LocalCredentials } from \"./types\";\n\nconst GITIGNORE_LINES = [\".odla/*.local.json\", \".odla/dev-token.json\", \".dev.vars\"];\n\nexport function readJsonFile<T>(path: string): T | null {\n  try {\n    return JSON.parse(readFileSync(path, \"utf8\")) as T;\n  } catch {\n    return null;\n  }\n}\n\nexport function writePrivateJson(path: string, value: unknown): void {\n  writePrivateText(path, `${JSON.stringify(value, null, 2)}\\n`);\n}\n\nexport function readCredentials(path: string): LocalCredentials | null {\n  if (!existsSync(path)) return null;\n  let value: unknown;\n  try {\n    value = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch {\n    throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);\n  }\n  if (!value || typeof value !== \"object\" || typeof (value as LocalCredentials).appId !== \"string\" ||\n      !(value as LocalCredentials).envs || typeof (value as LocalCredentials).envs !== \"object\") {\n    throw new Error(`credentials file ${path} has an invalid shape; fix or remove it before provisioning`);\n  }\n  return value as LocalCredentials;\n}\n\nexport function mergeCredential(\n  current: LocalCredentials | null,\n  update: { appId: string; platformUrl: string; dbEndpoint: string; env: string; tenantId: string; dbKey?: string; o11yToken?: string },\n): LocalCredentials {\n  const next: LocalCredentials = current ?? {\n    appId: update.appId,\n    platformUrl: update.platformUrl,\n    dbEndpoint: update.dbEndpoint,\n    updatedAt: new Date(0).toISOString(),\n    envs: {},\n  };\n  next.appId = update.appId;\n  next.platformUrl = update.platformUrl;\n  next.dbEndpoint = update.dbEndpoint;\n  next.updatedAt = new Date().toISOString();\n  next.envs[update.env] = {\n    ...(next.envs[update.env] ?? {}),\n    tenantId: update.tenantId,\n    ...(update.dbKey ? { dbKey: update.dbKey } : {}),\n    ...(update.o11yToken ? { o11yToken: update.o11yToken } : {}),\n  };\n  return next;\n}\n\nexport function ensureGitignore(rootDir: string, localPaths: string[] = []): void {\n  const path = resolve(rootDir, \".gitignore\");\n  const existing = existsSync(path) ? readFileSync(path, \"utf8\") : \"\";\n  const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line): line is string => !!line);\n  const wanted = [...new Set([...GITIGNORE_LINES, ...configured])];\n  const missing = wanted.filter((line) => !existing.split(/\\r?\\n/).includes(line));\n  if (missing.length === 0) return;\n  const prefix = existing && !existing.endsWith(\"\\n\") ? \"\\n\" : \"\";\n  writeFileSync(path, `${existing}${prefix}${missing.join(\"\\n\")}\\n`);\n}\n\nexport interface O11yDevVars {\n  endpoint: string;\n  service: string;\n  version?: string;\n}\n\nexport function o11yDevVars(cfg: LoadedProjectConfig): O11yDevVars | undefined {\n  if (!cfg.services.includes(\"o11y\")) return undefined;\n  return {\n    endpoint: cfg.o11y?.endpoint ?? \"https://o11y.odla.ai\",\n    service: cfg.o11y?.service ?? cfg.app.id,\n    ...(cfg.o11y?.version ? { version: cfg.o11y.version } : {}),\n  };\n}\n\nexport function resolveWriteDevVarsTarget(cfg: LoadedProjectConfig, requested: string | boolean | undefined): string | null {\n  if (!requested) return null;\n  if (requested === true) return cfg.local.devVarsFile;\n  return resolve(dirname(cfg.configPath), requested);\n}\n\nexport function writeDevVars(path: string, credentials: LocalCredentials, env: string, o11y?: O11yDevVars): void {\n  const entry = credentials.envs[env];\n  if (!entry) throw new Error(`no credentials for env \"${env}\" in ${path}`);\n  const lines = [`ODLA_PLATFORM=\"${credentials.platformUrl}\"`];\n  if (entry.dbKey) lines.push(`ODLA_ENDPOINT=\"${credentials.dbEndpoint}\"`);\n  lines.push(`ODLA_APP_ID=\"${credentials.appId}\"`, `ODLA_ENV=\"${env}\"`, `ODLA_TENANT=\"${entry.tenantId}\"`);\n  if (entry.dbKey) lines.push(`ODLA_API_KEY=\"${entry.dbKey}\"`);\n  if (o11y) {\n    lines.push(`ODLA_O11Y_ENDPOINT=\"${o11y.endpoint}\"`, `ODLA_O11Y_SERVICE=\"${o11y.service}\"`);\n    if (o11y.version) lines.push(`ODLA_O11Y_VERSION=\"${o11y.version}\"`);\n    // The ingest token is a secret; .dev.vars is gitignored (holds ODLA_API_KEY too).\n    if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN=\"${entry.o11yToken}\"`);\n  }\n  const existing = existsSync(path) ? readFileSync(path, \"utf8\") : \"\";\n  const retained = existing.split(/\\r?\\n/).filter((line) => !isManagedDevVar(line));\n  while (retained.at(-1) === \"\") retained.pop();\n  const prefix = retained.length ? `${retained.join(\"\\n\")}\\n\\n` : \"\";\n  writePrivateText(path, `${prefix}${lines.join(\"\\n\")}\\n`);\n}\n\nconst MANAGED_DEV_VARS = new Set([\n  \"ODLA_PLATFORM\", \"ODLA_ENDPOINT\", \"ODLA_APP_ID\", \"ODLA_ENV\", \"ODLA_TENANT\", \"ODLA_API_KEY\",\n  \"ODLA_O11Y_ENDPOINT\", \"ODLA_O11Y_SERVICE\", \"ODLA_O11Y_VERSION\", \"ODLA_O11Y_TOKEN\",\n]);\n\nfunction isManagedDevVar(line: string): boolean {\n  const match = line.match(/^\\s*(?:export\\s+)?([A-Z][A-Z0-9_]*)\\s*=/);\n  return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);\n}\n\nfunction writePrivateText(path: string, text: string): void {\n  mkdirSync(dirname(path), { recursive: true });\n  const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;\n  writeFileSync(temporary, text, { mode: 0o600 });\n  chmodSync(temporary, 0o600);\n  renameSync(temporary, path);\n}\n\nexport function gitignoreEntry(rootDir: string, path: string): string | null {\n  const rel = relative(resolve(rootDir), resolve(path));\n  if (!rel || rel === \"..\" || rel.startsWith(`..${process.platform === \"win32\" ? \"\\\\\" : \"/\"}`) || isAbsolute(rel)) return null;\n  return rel.replaceAll(\"\\\\\", \"/\");\n}\n\nexport function displayPath(path: string, rootDir = process.cwd()): string {\n  const rel = relative(rootDir, path);\n  return rel && !rel.startsWith(\"..\") ? rel : path;\n}\n","import { spawn } from \"node:child_process\";\nimport process from \"node:process\";\n\nexport interface OpenUrlOptions {\n  platform?: NodeJS.Platform;\n  spawnImpl?: typeof spawn;\n}\n\nexport async function openUrl(url: string, options: OpenUrlOptions = {}): Promise<void> {\n  const command = openerFor(options.platform ?? process.platform);\n  const doSpawn = options.spawnImpl ?? spawn;\n  await new Promise<void>((resolve, reject) => {\n    const child = doSpawn(command.cmd, [...command.args, url], {\n      stdio: \"ignore\",\n      detached: true,\n    });\n    child.once(\"error\", reject);\n    child.once(\"spawn\", () => {\n      child.unref();\n      resolve();\n    });\n  });\n}\n\nexport function openerFor(platform: NodeJS.Platform): { cmd: string; args: string[] } {\n  if (platform === \"darwin\") return { cmd: \"open\", args: [] };\n  if (platform === \"win32\") return { cmd: \"cmd\", args: [\"/c\", \"start\", \"\"] };\n  return { cmd: \"xdg-open\", args: [] };\n}\n","// The one place a human is required mid-command: approving a device handshake.\n// Everything about this block exists because the URL is the only thing that\n// matters and it is easy to lose —\n//\n//   * it sits ALONE on its own line, with no trailing punctuation. Terminals\n//     linkify a bare URL reliably and mangle one wrapped in prose or followed by\n//     \"(15m left).\", and an agent relaying the line can copy it verbatim without\n//     having to strip anything;\n//   * it prints whether or not the browser opened, because launching one is\n//     best-effort and unverifiable — a sandboxed or remote shell reports success\n//     and shows no tab;\n//   * it names the agent case explicitly. An agent that swallows this line\n//     leaves the human staring at a hung command.\n/** What the operator is being asked to approve. */\nexport interface ApprovalPrompt {\n  userCode: string;\n  approvalUrl: string;\n  /** Minutes the code stays valid. */\n  minutesLeft: number;\n  /** Human-readable purpose, e.g. `edit odla's runbooks`. */\n  purpose?: string;\n  /** Whether a browser launch was attempted (it may still have shown nothing). */\n  browserAttempted?: boolean;\n  /** Why no browser was attempted, when it wasn't. */\n  browserSkipped?: string;\n}\n\n/**\n * Render the approval block as lines. A pure function so the exact shape — above\n * all, the URL alone on its own line — is assertable without a terminal.\n */\nexport function approvalLines(prompt: ApprovalPrompt): string[] {\n  const lines: string[] = [\"\"];\n  lines.push(\n    `⏸  Human approval required${prompt.purpose ? ` to ${prompt.purpose}` : \"\"} — code ${prompt.userCode}, ${prompt.minutesLeft}m left.`,\n  );\n  lines.push(\"\");\n  // Alone, bare, unpunctuated. Do not decorate this line.\n  lines.push(`   ${prompt.approvalUrl}`);\n  lines.push(\"\");\n  lines.push(\"   A signed-in odla admin opens that URL, checks the code matches, and approves.\");\n  lines.push(\"   Opening the link without approving does nothing; this command waits until they do.\");\n  if (prompt.browserAttempted) {\n    lines.push(\"   A browser launch was attempted, but it is best-effort and may have shown no tab.\");\n  } else if (prompt.browserSkipped) {\n    lines.push(`   No browser was opened (${prompt.browserSkipped}).`);\n  }\n  lines.push(\"\");\n  lines.push(\"   AGENTS: relay the URL above to the human verbatim, now, before waiting.\");\n  lines.push(\"   You cannot approve it yourself — the grant is issued to you, not by you.\");\n  lines.push(\"\");\n  return lines;\n}\n\n/** Print the approval block. */\nexport function printApproval(out: Pick<typeof console, \"log\" | \"error\">, prompt: ApprovalPrompt): void {\n  for (const line of approvalLines(prompt)) out.error(line);\n}\n\n/** Minutes remaining from an absolute expiry, floored at zero. */\nexport const minutesUntil = (expiresAt: number, now = Date.now()): number =>\n  Math.max(0, Math.floor((expiresAt - now) / 60_000));\n\n/** The reminder reprinted while polling. Two lines, so the URL still lands bare\n * on its own — a shell that kills the process mid-wait then ends its captured\n * output with a copyable link rather than a truncated sentence. */\nexport function reminderLines(prompt: Pick<ApprovalPrompt, \"userCode\" | \"approvalUrl\"> & { minutesLeft: number }): string[] {\n  return [\n    `auth: still waiting for approval of ${prompt.userCode} (${prompt.minutesLeft}m left) —`,\n    `   ${prompt.approvalUrl}`,\n  ];\n}\n","// Everything this module prints is PROGRESS — cached-token notices, handshake\n// state, browser-launch outcomes — and none of it is a command's result, so it\n// all goes to stderr. That is not cosmetic: `--json` exists so a machine can\n// parse stdout, and an \"auth: using cached developer token\" line ahead of the\n// payload made every --json invocation in the CLI fail JSON.parse. Same reason\n// `runbook get` promises stdout is the runbook and nothing else.\nimport { collectToken, OdlaError, requestToken } from \"@odla-ai/db\";\nimport type { DeviceToken } from \"@odla-ai/db\";\nimport process from \"node:process\";\nimport type { LoadedProjectConfig, ProvisionOptions } from \"./types\";\nimport { printApproval } from \"./approval-prompt\";\nimport {\n  approvalHint,\n  approvalReminder,\n  clearPendingHandshake,\n  handshakeFile,\n  handshakeWaitMs,\n  readPendingHandshake,\n  writePendingHandshake,\n  type PendingHandshake,\n} from \"./handshake-state\";\nimport { openUrl } from \"./open\";\nimport { displayPath, readJsonFile, writePrivateJson } from \"./local\";\n\ntype FetchLike = typeof fetch;\n\n/** Resolve the explicit, audience-bound environment, cached, or freshly\n * human-approved developer credential for a project operation. A new\n * handshake requires `options.email` or `ODLA_USER_EMAIL`; neither is used\n * when a still-valid token is supplied or cached. */\nexport async function getDeveloperToken(\n  cfg: LoadedProjectConfig,\n  options: ProvisionOptions,\n  doFetch: FetchLike,\n  out: Pick<typeof console, \"log\" | \"error\">,\n): Promise<string> {\n  if (options.token) return options.token;\n  const audience = platformAudience(cfg.platformUrl);\n  if (process.env.ODLA_DEV_TOKEN) {\n    const declared = process.env.ODLA_DEV_TOKEN_AUDIENCE;\n    if (declared) {\n      if (platformAudience(declared) !== audience) throw new Error(\"ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform\");\n    } else if (audience !== \"https://odla.ai\") {\n      throw new Error(\"ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform\");\n    }\n    return process.env.ODLA_DEV_TOKEN;\n  }\n\n  const cached = readJsonFile<{ token?: string; expiresAt?: number; platform?: string; email?: string }>(cfg.local.tokenFile);\n  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 60_000) {\n    out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);\n    return cached.token;\n  }\n\n  const ctx: HandshakeContext = {\n    cfg,\n    options,\n    doFetch,\n    out,\n    audience,\n    browser: approvalBrowser(options),\n    email: handshakeEmail(options.email, cached?.platform === audience ? cached.email : undefined),\n    pendingFile: handshakeFile(cfg),\n  };\n  const waitMs = handshakeWaitMs(options.wait);\n  const { token, expiresAt } = (await resumePendingHandshake(ctx, waitMs)) ?? (await freshHandshake(ctx, waitMs));\n  clearPendingHandshake(ctx.pendingFile);\n  writePrivateJson(cfg.local.tokenFile, { platform: audience, email: ctx.email, token, expiresAt });\n  out.error(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);\n  return token;\n}\n\ninterface HandshakeContext {\n  cfg: LoadedProjectConfig;\n  options: ProvisionOptions;\n  doFetch: FetchLike;\n  out: Pick<typeof console, \"log\" | \"error\">;\n  audience: string;\n  browser: ReturnType<typeof approvalBrowser>;\n  email: string;\n  pendingFile: string;\n}\n\n/** Collect a persisted still-claimable handshake instead of minting a new\n * code; returns null when there is none (or it lapsed) so a fresh one starts. */\nasync function resumePendingHandshake(ctx: HandshakeContext, waitMs: number | undefined): Promise<DeviceToken | null> {\n  const pending = readPendingHandshake(ctx.pendingFile, ctx.audience, ctx.email);\n  if (!pending) return null;\n  ctx.out.error(\"\");\n  ctx.out.error(`auth: resuming pending handshake — ${approvalHint(pending)}`);\n  await launchApproval(ctx, pending.approvalUrl);\n  ctx.out.error(\"\");\n  const stopReminder = approvalReminder(ctx.out, pending);\n  try {\n    return await collectToken({\n      endpoint: ctx.cfg.platformUrl,\n      deviceCode: pending.deviceCode,\n      expiresAt: pending.expiresAt,\n      interval: pending.interval,\n      waitMs,\n      fetch: ctx.doFetch,\n    });\n  } catch (err) {\n    const code = err instanceof OdlaError ? err.code : undefined;\n    if (code === \"handshake_pending\") throw stillPending(pending, ctx.email);\n    if (code === \"handshake_expired\" || code === \"handshake_timeout\") {\n      clearPendingHandshake(ctx.pendingFile);\n      ctx.out.error(\"auth: pending handshake lapsed unapproved; starting a fresh one\");\n      return null;\n    }\n    if (code === \"handshake_denied\") clearPendingHandshake(ctx.pendingFile);\n    throw err;\n  } finally {\n    stopReminder();\n  }\n}\n\nasync function freshHandshake(ctx: HandshakeContext, waitMs: number | undefined): Promise<DeviceToken> {\n  let started: PendingHandshake | undefined;\n  let stopReminder: (() => void) | undefined;\n  try {\n    return await requestToken({\n      endpoint: ctx.cfg.platformUrl,\n      email: ctx.email,\n      label: `${ctx.cfg.app.id} provisioner`,\n      fetch: ctx.doFetch,\n      waitMs,\n      onCode: async ({ userCode, deviceCode, expiresIn, interval, verificationUriComplete }) => {\n        const approvalUrl = verificationUriComplete ?? handshakeUrl(ctx.cfg.platformUrl, userCode);\n        started = {\n          platform: ctx.audience,\n          email: ctx.email,\n          userCode,\n          deviceCode,\n          approvalUrl,\n          interval,\n          expiresAt: Date.now() + expiresIn * 1000,\n        };\n        writePendingHandshake(ctx.pendingFile, started);\n        printApproval(ctx.out, {\n          userCode,\n          approvalUrl,\n          minutesLeft: Math.floor(expiresIn / 60),\n          purpose: `sign this terminal in as ${ctx.email}`,\n          browserAttempted: ctx.browser.open,\n          browserSkipped: ctx.browser.reason,\n        });\n        await launchApproval(ctx, approvalUrl);\n        stopReminder = approvalReminder(ctx.out, started);\n      },\n    });\n  } catch (err) {\n    const code = err instanceof OdlaError ? err.code : undefined;\n    if (code === \"handshake_pending\" && started) throw stillPending(started, ctx.email);\n    if (code === \"handshake_denied\" || code === \"handshake_expired\" || code === \"handshake_timeout\") {\n      clearPendingHandshake(ctx.pendingFile);\n    }\n    throw err;\n  } finally {\n    stopReminder?.();\n  }\n}\n\n/** Launching a browser is best-effort and unverifiable: a sandboxed shell can\n * accept the spawn yet show nothing, so the printed URL stays the source of\n * truth and every outcome message points back at it. */\nasync function launchApproval(ctx: HandshakeContext, approvalUrl: string): Promise<void> {\n  if (ctx.browser.open) {\n    try {\n      await (ctx.options.openApprovalUrl ?? openUrl)(approvalUrl);\n      ctx.out.error(`auth: asked the OS to open a browser${ctx.browser.mode === \"auto\" ? \" (auto)\" : \"\"} — if no tab appeared, use the URL above`);\n    } catch (err) {\n      ctx.out.error(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);\n    }\n  } else if (ctx.browser.reason) {\n    ctx.out.error(`auth: browser launch skipped (${ctx.browser.reason}) — show the human the URL above`);\n  }\n}\n\n/** The wait cap elapsed with the handshake still approvable. The pending file\n * survives, so rerunning the same command resumes and collects. */\nfunction stillPending(pending: PendingHandshake, email: string): OdlaError {\n  return new OdlaError(\n    \"handshake_pending\",\n    `handshake still pending — ask ${email} to ${approvalHint(pending)}, then re-run this command; it resumes the same handshake and collects the token`,\n    { retryable: true },\n  );\n}\n\n/** Resolve the non-secret account identifier for a fresh handshake: explicit\n * `--email`, then `ODLA_USER_EMAIL`, then the same-audience private cache.\n * Existing tokens bypass this entirely. Agents must never request a password\n * or Clerk token. */\nexport function handshakeEmail(value?: string, cached?: string): string {\n  const email = (value ?? process.env.ODLA_USER_EMAIL ?? cached ?? \"\").trim().toLowerCase();\n  if (email.length > 254 || !/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n    throw new Error(\"a fresh odla handshake requires --email <account> or ODLA_USER_EMAIL\");\n  }\n  return email;\n}\n\n/** Host facts consulted when deciding whether a browser can be shown. */\nexport interface BrowserHost {\n  platform?: NodeJS.Platform;\n  env?: Record<string, string | undefined>;\n}\n\n/** Decide whether to open the signed-in Studio review URL. The gate asks\n * whether this machine can show the user's signed-in browser — not whether\n * stdin is a TTY — so scripted and agent-driven runs still pop the approval\n * page for the human at the keyboard. Launch is skipped only in CI, over SSH,\n * or on a display-less host; `--open` and `--no-open` always win. */\nexport function approvalBrowser(\n  options: Pick<ProvisionOptions, \"open\">,\n  host: BrowserHost = {},\n): { open: boolean; mode?: \"auto\" | \"forced\"; reason?: string } {\n  if (options.open === true) return { open: true, mode: \"forced\" };\n  if (options.open === false) return { open: false, reason: \"disabled by --no-open\" };\n  const env = host.env ?? process.env;\n  // Test runners must never reach the human's real browser (or load the\n  // production Studio handshake page): a fixture-driven flow that forgets to\n  // inject an opener would otherwise spawn real tabs on the developer's\n  // machine. Unlike agent shells — which deliberately DO auto-open — test\n  // environments are identifiable and always suppressed.\n  if (env.VITEST || env.NODE_ENV === \"test\") return { open: false, reason: \"test environment\" };\n  if (env.CI) return { open: false, reason: \"CI environment\" };\n  if (env.SSH_CONNECTION || env.SSH_TTY) return { open: false, reason: \"SSH session; pass --open to force\" };\n  const platform = host.platform ?? process.platform;\n  if (platform !== \"darwin\" && platform !== \"win32\" && !env.DISPLAY && !env.WAYLAND_DISPLAY) {\n    return { open: false, reason: \"no graphical display; pass --open to force\" };\n  }\n  return { open: true, mode: \"auto\" };\n}\n\n/** Construct the fallback Studio URL for servers predating verification URIs. */\nexport function handshakeUrl(platformUrl: string, userCode: string): string {\n  const url = new URL(\"/studio\", platformUrl);\n  url.searchParams.set(\"code\", userCode);\n  return url.toString();\n}\n\n/** Canonical credential audience: one HTTPS origin (HTTP only on loopback). */\nexport function platformAudience(value: string): string {\n  let url: URL;\n  try { url = new URL(value); } catch { throw new Error(\"platform must be an absolute URL\"); }\n  const local = url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\" || url.hostname === \"[::1]\";\n  if (url.protocol !== \"https:\" && !(local && url.protocol === \"http:\")) {\n    throw new Error(\"platform credentials require HTTPS except for loopback development\");\n  }\n  if (url.username || url.password || url.search || url.hash) {\n    throw new Error(\"platform URL must not contain credentials, query, or fragment\");\n  }\n  return url.origin;\n}\n","import { rmSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport process from \"node:process\";\nimport { readJsonFile, writePrivateJson } from \"./local\";\nimport type { LoadedProjectConfig } from \"./types\";\n\nimport { reminderLines } from \"./approval-prompt\";\n/** One pending device handshake, persisted (mode 0600) the moment it starts so\n * a killed CLI — agent tool shells time out long before a human approves — can\n * resume collecting instead of losing the approval. */\nexport interface PendingHandshake {\n  /** Canonical platform audience the handshake was started against. */\n  platform: string;\n  email: string;\n  userCode: string;\n  /** Opaque poll credential; private like the cached token, never displayed. */\n  deviceCode: string;\n  approvalUrl: string;\n  /** Seconds between polls, as announced by the server at start. */\n  interval: number;\n  /** Epoch milliseconds when the handshake lapses server-side. */\n  expiresAt: number;\n}\n\n/** The pending-handshake file lives beside the token cache; the default\n * `.odla/handshake.local.json` is covered by the managed gitignore rules. */\nexport function handshakeFile(cfg: Pick<LoadedProjectConfig, \"local\">): string {\n  return join(dirname(cfg.local.tokenFile), \"handshake.local.json\");\n}\n\n/** Don't resume a handshake about to lapse mid-poll; start fresh instead. */\nconst RESUME_MARGIN_MS = 5_000;\n\n/** Read a still-claimable pending handshake for this audience and account. */\nexport function readPendingHandshake(path: string, platform: string, email: string): PendingHandshake | null {\n  const pending = readJsonFile<Partial<PendingHandshake>>(path);\n  if (!pending || pending.platform !== platform || pending.email !== email) return null;\n  if (typeof pending.userCode !== \"string\" || typeof pending.deviceCode !== \"string\" || typeof pending.approvalUrl !== \"string\") return null;\n  if (typeof pending.expiresAt !== \"number\" || pending.expiresAt <= Date.now() + RESUME_MARGIN_MS) return null;\n  return { interval: 3, ...pending } as PendingHandshake;\n}\n\nexport function writePendingHandshake(path: string, pending: PendingHandshake): void {\n  writePrivateJson(path, pending);\n}\n\nexport function clearPendingHandshake(path: string): void {\n  rmSync(path, { force: true });\n}\n\n/** Whole minutes (at least 1) before the handshake lapses, for messages. */\nexport function minutesLeft(expiresAt: number): number {\n  return Math.max(1, Math.round((expiresAt - Date.now()) / 60_000));\n}\n\n/** One-line pointer to the approval page; every wait message ends with it. */\nexport function approvalHint(pending: Pick<PendingHandshake, \"userCode\" | \"approvalUrl\" | \"expiresAt\">): string {\n  return `approve code ${pending.userCode} at ${pending.approvalUrl} (${minutesLeft(pending.expiresAt)}m left)`;\n}\n\n/** Reprint the approval pointer while polling so even a shell that kills the\n * process mid-wait ends its captured output with the URL the human needs.\n * Returns a stop function; the timer never holds the process open. */\nexport function approvalReminder(\n  out: Pick<typeof console, \"log\">,\n  pending: Pick<PendingHandshake, \"userCode\" | \"approvalUrl\" | \"expiresAt\">,\n  periodMs = 30_000,\n): () => void {\n  const timer = setInterval(() => {\n    for (const line of reminderLines({\n      userCode: pending.userCode,\n      approvalUrl: pending.approvalUrl,\n      minutesLeft: minutesLeft(pending.expiresAt),\n    }))\n      out.log(line);\n  }, periodMs);\n  (timer as unknown as { unref?: () => void }).unref?.();\n  return () => clearInterval(timer);\n}\n\n/** Resolve the approval wait cap: an explicit `--wait` always wins; an\n * interactive terminal waits out the handshake's own expiry; every other\n * shell (agent tools, pipes, CI) is capped at 90 seconds — those shells kill\n * long-running commands, and the persisted pending handshake makes the rerun\n * resume instantly instead of minting a new code. */\nexport function handshakeWaitMs(\n  waitSeconds: number | undefined,\n  interactive: boolean = process.stdout.isTTY === true,\n): number | undefined {\n  if (waitSeconds !== undefined) return waitSeconds * 1000;\n  return interactive ? undefined : 90_000;\n}\n","/** Hosted platform purposes whose provider, model, and budgets an admin may route. */\nexport const SYSTEM_AI_PURPOSES = [\n  \"o11y.triage\",\n  \"security.discovery\",\n  \"security.validation\",\n  \"runbook.answer\",\n] as const;\n\n/** One catalog-validated, platform-funded System AI purpose. */\nexport type SystemAiPurpose = (typeof SYSTEM_AI_PURPOSES)[number];\n\n/** Validate a CLI purpose before any network mutation. */\nexport function requireSystemAiPurpose(value: string | undefined): SystemAiPurpose {\n  if (!SYSTEM_AI_PURPOSES.includes(value as SystemAiPurpose)) {\n    throw new Error(`purpose must be one of: ${SYSTEM_AI_PURPOSES.join(\", \")}`);\n  }\n  return value as SystemAiPurpose;\n}\n","import process from \"node:process\";\nimport { platformAudience } from \"./token\";\nimport { secretInputValue } from \"./secret-input\";\nimport { resolveAdminPlatformToken, type ScopedPlatformScope } from \"./admin-ai-auth\";\nimport { adminAiAuditQuery, readAdminAiAudit } from \"./admin-ai-audit\";\nimport { requireSystemAiPurpose } from \"./admin-ai-policy\";\nimport { adminAiUsageQuery, readAdminAiUsage } from \"./admin-ai-usage\";\nexport { getScopedPlatformToken } from \"./admin-ai-auth\";\nexport type { ScopedPlatformTokenOptions } from \"./admin-ai-auth\";\nexport { SYSTEM_AI_PURPOSES } from \"./admin-ai-policy\";\nexport type { SystemAiPurpose } from \"./admin-ai-policy\";\n\n/** Inputs for one System AI policy/catalog read, policy update,\n * credential-status read, write-only credential transfer, or metadata-only\n * usage or admin-audit read. Provider values may come only from a named environment variable\n * or stdin. */\nexport interface AdminAiOptions {\n  action: \"show\" | \"models\" | \"set\" | \"credentials\" | \"credential-set\" | \"usage\" | \"audit\";\n  purpose?: string;\n  provider?: string;\n  model?: string;\n  enabled?: boolean;\n  maxInputBytes?: number;\n  maxOutputTokens?: number;\n  maxCallsPerRun?: number;\n  platform?: string;\n  token?: string;\n  /** Existing odla account email used only when a fresh handshake is required. */\n  email?: string;\n  json?: boolean;\n  open?: boolean;\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n  openApprovalUrl?: (url: string) => Promise<void>;\n  credentialProvider?: string;\n  fromEnv?: string;\n  stdin?: boolean;\n  readStdin?: () => Promise<string>;\n  discoveryProvider?: string;\n  discoveryModel?: string;\n  validationProvider?: string;\n  validationModel?: string;\n  /** Optional metadata-only usage filters. */\n  appId?: string;\n  env?: string;\n  runId?: string;\n  limit?: number;\n  /** Separate short-lived admin-token cache; never reuses the app developer-token file. */\n  tokenFile?: string;\n}\n\n/** Read or update platform-funded AI routing and inspect attributed usage.\n * Authentication is a short-lived,\n * explicitly scoped device grant; ordinary app developer tokens never become\n * platform admins. Credential writes accept values only from a named env var\n * or stdin, transfer them once, and never place them in argv, output, or the\n * scoped-token cache. */\nexport async function adminAi(options: AdminAiOptions): Promise<void> {\n  const platform = platformAudience(options.platform ?? process.env.ODLA_PLATFORM ?? \"https://odla.ai\");\n  const doFetch = options.fetch ?? fetch;\n  const out = options.stdout ?? console;\n  const usageQuery = options.action === \"usage\" ? adminAiUsageQuery(options) : undefined;\n  const auditQuery = options.action === \"audit\" ? adminAiAuditQuery(options) : undefined;\n  const scope: ScopedPlatformScope = options.action === \"set\"\n    ? \"platform:ai:policy:write\"\n    : options.action === \"credential-set\"\n      ? \"platform:ai:credential:write\"\n      : options.action === \"credentials\"\n        ? \"platform:ai:credential:read\"\n        : options.action === \"usage\"\n          ? \"platform:ai:usage:read\"\n          : options.action === \"audit\"\n            ? \"platform:ai:audit:read\"\n          : \"platform:ai:policy:read\";\n  const token = await resolveAdminPlatformToken({\n    platform,\n    scope,\n    token: options.token,\n    email: options.email,\n    open: options.open,\n    fetch: doFetch,\n    stdout: out,\n    openApprovalUrl: options.openApprovalUrl,\n    tokenFile: options.tokenFile,\n  });\n  const headers = { authorization: `Bearer ${token}`, \"content-type\": \"application/json\" };\n\n  if (options.action === \"usage\") {\n    await readAdminAiUsage({ platform, query: usageQuery ?? \"\", headers, json: options.json, fetch: doFetch, stdout: out });\n    return;\n  }\n\n  if (options.action === \"audit\") {\n    await readAdminAiAudit({ platform, query: auditQuery ?? \"\", headers, json: options.json, fetch: doFetch, stdout: out });\n    return;\n  }\n\n  if (options.action === \"credentials\") {\n    const res = await doFetch(`${platform}/registry/platform/ai-credentials`, { headers });\n    const body = await responseBody(res);\n    if (!res.ok) throw new Error(apiError(\"read platform AI credential status\", res.status, body));\n    const credentials = isRecord(body) && isRecord(body.credentials) ? body.credentials : body;\n    if (options.json) out.log(JSON.stringify({ credentials }, null, 2));\n    else for (const [provider, status] of Object.entries(isRecord(credentials) ? credentials : {})) {\n      const label = isRecord(status) && status.set === true\n        ? status.readable === true ? \"vault readable\" : \"stored; vault unreadable\"\n        : \"not set\";\n      out.log(`${provider}\\t${label}`);\n    }\n    return;\n  }\n\n  if (options.action === \"credential-set\") {\n    const provider = requireProvider(options.credentialProvider);\n    const value = await secretInputValue(options);\n    const res = await doFetch(`${platform}/registry/platform/ai-credentials/${encodeURIComponent(provider)}`, {\n      method: \"PUT\",\n      headers,\n      body: JSON.stringify({ value }),\n    });\n    const body = await responseBody(res);\n    if (!res.ok) throw new Error(apiError(`store ${provider} platform credential`, res.status, body));\n    out.log(`stored ${provider} platform credential (write-only; value was not returned)`);\n    return;\n  }\n\n  if (options.action === \"show\" || options.action === \"models\") {\n    const res = await doFetch(`${platform}/registry/platform/ai-policies`, { headers });\n    const body = await responseBody(res);\n    if (!res.ok) throw new Error(apiError(\"read platform AI policies\", res.status, body));\n    if (options.action === \"models\") {\n      const models = catalogModels(body).filter((model) => !options.provider || model.provider === options.provider);\n      if (!models.length) throw new Error(options.provider ? `no System AI models found for provider ${options.provider}` : \"platform returned no System AI models\");\n      if (options.json) out.log(JSON.stringify({ models }, null, 2));\n      else for (const model of models) out.log(`${model.provider}\\t${model.id}`);\n      return;\n    }\n    const policies = policyArray(body);\n    if (options.json) {\n      out.log(JSON.stringify({ policies, models: catalogModels(body) }, null, 2));\n      return;\n    }\n    out.log(\"purpose\\tenabled\\tprovider\\tmodel\\tmax calls\\tmax input bytes\\tmax output tokens\");\n    for (const policy of policies) {\n      out.log([\n        policy.purpose,\n        String(policy.enabled),\n        policy.provider,\n        policy.model,\n        String(policy.maxCallsPerRun ?? \"\"),\n        String(policy.maxInputBytes ?? \"\"),\n        String(policy.maxOutputTokens ?? \"\"),\n      ].join(\"\\t\"));\n    }\n    return;\n  }\n\n  if (options.purpose === \"security\") {\n    const currentResponse = await doFetch(`${platform}/registry/platform/ai-policies`, { headers });\n    const currentBody = await responseBody(currentResponse);\n    if (!currentResponse.ok) throw new Error(apiError(\"read current security AI policies\", currentResponse.status, currentBody));\n    const policies = policyArray(currentBody);\n    const discovery = policies.find((policy) => policy.purpose === \"security.discovery\");\n    const validation = policies.find((policy) => policy.purpose === \"security.validation\");\n    if (!discovery || !validation || !Number.isSafeInteger(discovery.version) || !Number.isSafeInteger(validation.version)) {\n      throw new Error(\"platform returned invalid security AI policy revisions\");\n    }\n    const shared = {\n      ...(options.enabled === undefined ? {} : { enabled: options.enabled }),\n      ...(options.maxInputBytes === undefined ? {} : { maxInputBytes: options.maxInputBytes }),\n      ...(options.maxOutputTokens === undefined ? {} : { maxOutputTokens: options.maxOutputTokens }),\n      ...(options.maxCallsPerRun === undefined ? {} : { maxCallsPerRun: options.maxCallsPerRun }),\n    };\n    const discoveryUpdate = {\n      ...shared,\n      ...(options.discoveryProvider?.trim() ? { provider: options.discoveryProvider.trim() } : {}),\n      ...(options.discoveryModel?.trim() ? { model: options.discoveryModel.trim() } : {}),\n    };\n    const validationUpdate = {\n      ...shared,\n      ...(options.validationProvider?.trim() ? { provider: options.validationProvider.trim() } : {}),\n      ...(options.validationModel?.trim() ? { model: options.validationModel.trim() } : {}),\n    };\n    if (!Object.keys(discoveryUpdate).length && !Object.keys(validationUpdate).length) {\n      throw new Error(\"security set requires a route, enabled state, or budget change\");\n    }\n    const res = await doFetch(`${platform}/registry/platform/ai-policies/security`, {\n      method: \"PUT\",\n      headers,\n      body: JSON.stringify({\n        expectedVersions: { discovery: discovery.version, validation: validation.version },\n        discovery: discoveryUpdate,\n        validation: validationUpdate,\n      }),\n    });\n    const response = await responseBody(res);\n    if (!res.ok) throw new Error(apiError(\"update security review routes\", res.status, response));\n    out.log(options.json ? JSON.stringify(response, null, 2) : \"updated security review discovery and independent validation routes atomically\");\n    return;\n  }\n\n  const purpose = requireSystemAiPurpose(options.purpose);\n  const body = {\n    ...(options.provider?.trim() ? { provider: options.provider.trim() } : {}),\n    ...(options.model?.trim() ? { model: options.model.trim() } : {}),\n    ...(options.enabled === undefined ? {} : { enabled: options.enabled }),\n    ...(options.maxInputBytes === undefined ? {} : { maxInputBytes: options.maxInputBytes }),\n    ...(options.maxOutputTokens === undefined ? {} : { maxOutputTokens: options.maxOutputTokens }),\n    ...(options.maxCallsPerRun === undefined ? {} : { maxCallsPerRun: options.maxCallsPerRun }),\n  };\n  if (!Object.keys(body).length) throw new Error(\"set requires a provider, model, enabled state, or budget change\");\n  const res = await doFetch(`${platform}/registry/platform/ai-policies/${encodeURIComponent(purpose)}`, {\n    method: \"PUT\",\n    headers,\n    body: JSON.stringify(body),\n  });\n  const response = await responseBody(res);\n  if (!res.ok) throw new Error(apiError(`update ${purpose}`, res.status, response));\n  const policy: Record<string, unknown> = isRecord(response) && isRecord(response.policy)\n    ? response.policy\n    : isRecord(response) ? response : {};\n  out.log(options.json ? JSON.stringify({ policy }, null, 2) : `updated ${purpose}: ${String(policy.provider ?? \"unchanged\")}/${String(policy.model ?? \"unchanged\")}`);\n}\n\nfunction requireProvider(value: string | undefined): \"anthropic\" | \"openai\" | \"google\" {\n  if (value !== \"anthropic\" && value !== \"openai\" && value !== \"google\") {\n    throw new Error(\"provider must be one of: anthropic, openai, google\");\n  }\n  return value;\n}\n\nfunction policyArray(body: unknown): Array<Record<string, unknown>> {\n  if (isRecord(body) && Array.isArray(body.policies)) return body.policies.filter(isRecord);\n  if (isRecord(body) && isRecord(body.policies)) return Object.values(body.policies).filter(isRecord);\n  throw new Error(\"platform returned an invalid AI policy response\");\n}\n\nfunction catalogModels(body: unknown): Array<{ id: string; provider: string }> {\n  if (!isRecord(body) || !isRecord(body.catalog) || !Array.isArray(body.catalog.models)) {\n    throw new Error(\"platform returned an invalid System AI model catalog\");\n  }\n  return body.catalog.models.filter((value): value is { id: string; provider: string } =>\n    isRecord(value) && typeof value.id === \"string\" && typeof value.provider === \"string\");\n}\n\nasync function responseBody(res: Response): Promise<unknown> {\n  const text = await res.text();\n  if (!text) return {};\n  try { return JSON.parse(text) as unknown; } catch { return { message: text.slice(0, 300) }; }\n}\n\nfunction apiError(action: string, status: number, body: unknown): string {\n  const error = isRecord(body) && isRecord(body.error) ? body.error : undefined;\n  const message = error && typeof error.message === \"string\" ? error.message : isRecord(body) && typeof body.message === \"string\" ? body.message : \"request failed\";\n  return `${action} failed (${status}): ${message}`;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n","import process from \"node:process\";\n\n/**\n * Secret ingestion shared by every write-only CLI transfer (`admin ai\n * credential set`, `secrets set`, `secrets set-clerk-key`): values may come\n * only from a named environment variable or stdin — never argv — so they\n * cannot land in shell history, process listings, or an agent's transcript.\n */\nexport interface SecretInputOptions {\n  /** Environment variable holding the value. Mutually exclusive with `stdin`. */\n  fromEnv?: string;\n  /** Read the value from stdin. Mutually exclusive with `fromEnv`. */\n  stdin?: boolean;\n  /** Test/embedding override for the stdin reader. */\n  readStdin?: () => Promise<string>;\n}\n\nconst MAX_BYTES = 64 * 1024;\n\n/**\n * Resolve the secret value from exactly one of `--from-env`/`--stdin`,\n * stripping one trailing newline and rejecting empty or >64 KiB values.\n * `kind` names the value in error messages (e.g. \"credential\", \"secret\").\n */\nexport async function secretInputValue(options: SecretInputOptions, kind = \"credential\"): Promise<string> {\n  if (options.fromEnv && options.stdin) throw new Error(\"choose exactly one of --from-env or --stdin\");\n  let value: string | undefined;\n  if (options.fromEnv) value = process.env[options.fromEnv];\n  else if (options.stdin) value = await (options.readStdin ?? (() => readSecretStream(kind)))();\n  else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);\n  value = value?.replace(/[\\r\\n]+$/, \"\");\n  if (!value) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : `stdin ${kind} is empty`);\n  if (new TextEncoder().encode(value).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);\n  return value;\n}\n\n/** @internal Default stdin reader; `stream` is injectable only for tests. */\nexport async function readSecretStream(kind: string, stream: AsyncIterable<unknown> = process.stdin): Promise<string> {\n  let value = \"\";\n  for await (const chunk of stream) {\n    value += String(chunk);\n    if (value.length > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);\n  }\n  return value;\n}\n","/** Optional limit for the metadata-only System AI administration trail. */\nexport interface AdminAiAuditFilters {\n  limit?: number;\n}\n\ninterface AdminAiAuditRequest {\n  platform: string;\n  query: string;\n  headers: Record<string, string>;\n  json?: boolean;\n  fetch: typeof fetch;\n  stdout: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/** Validate the audit limit and build its query before authentication. */\nexport function adminAiAuditQuery(filters: AdminAiAuditFilters): string {\n  if (filters.limit === undefined) return \"\";\n  if (!Number.isSafeInteger(filters.limit) || filters.limit < 1 || filters.limit > 200) {\n    throw new Error(\"audit limit must be an integer from 1 to 200\");\n  }\n  return `?limit=${filters.limit}`;\n}\n\n/** Read and render immutable, metadata-only System AI admin changes. */\nexport async function readAdminAiAudit(request: AdminAiAuditRequest): Promise<void> {\n  const response = await request.fetch(`${request.platform}/registry/platform/ai-audit${request.query}`, {\n    headers: request.headers,\n  });\n  const body = await responseBody(response);\n  if (!response.ok) throw new Error(apiError(response.status, body));\n  if (request.json) {\n    request.stdout.log(JSON.stringify(body, null, 2));\n    return;\n  }\n  const events = isRecord(body) && Array.isArray(body.events) ? body.events.filter(isRecord) : [];\n  request.stdout.log(\"when\\tchange\\ttarget\\tbefore -> after\\tactor\");\n  for (const event of events) {\n    const before = isRecord(event.oldPolicy) ? event.oldPolicy : undefined;\n    const after = isRecord(event.newPolicy) ? event.newPolicy : undefined;\n    const route = before && after\n      ? `${String(before.provider)}/${String(before.model)}@v${String(before.version)} -> ${String(after.provider)}/${String(after.model)}@v${String(after.version)}`\n      : \"value not retained\";\n    request.stdout.log([\n      timestamp(event.createdAt), String(event.changeKind ?? \"\"),\n      String(event.purpose ?? event.provider ?? \"\"), route,\n      `${String(event.actorType ?? \"\")}:${String(event.actorId ?? \"\")}`,\n    ].join(\"\\t\"));\n  }\n}\n\nasync function responseBody(response: Response): Promise<unknown> {\n  const text = await response.text();\n  if (!text) return {};\n  try { return JSON.parse(text) as unknown; } catch { return { message: text.slice(0, 300) }; }\n}\n\nfunction apiError(status: number, body: unknown): string {\n  const error = isRecord(body) && isRecord(body.error) ? body.error : undefined;\n  const message = error && typeof error.message === \"string\"\n    ? error.message\n    : isRecord(body) && typeof body.message === \"string\" ? body.message : \"request failed\";\n  return `read System AI admin changes failed (${status}): ${message}`;\n}\n\nfunction timestamp(value: unknown): string {\n  if (typeof value !== \"number\" || !Number.isFinite(value)) return String(value ?? \"\");\n  const date = new Date(value);\n  return Number.isFinite(date.valueOf()) ? date.toISOString() : \"\";\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n","/** Optional metadata-only filters for attributed platform AI usage. */\nexport interface AdminAiUsageFilters {\n  appId?: string;\n  env?: string;\n  runId?: string;\n  limit?: number;\n}\n\ninterface AdminAiUsageRequest {\n  platform: string;\n  query: string;\n  headers: Record<string, string>;\n  json?: boolean;\n  fetch: typeof fetch;\n  stdout: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/** Validate usage filters and build the platform query before authentication. */\nexport function adminAiUsageQuery(filters: AdminAiUsageFilters): string {\n  const params = new URLSearchParams();\n  if (filters.appId?.trim()) params.set(\"appId\", filters.appId.trim());\n  if (filters.env?.trim()) params.set(\"env\", filters.env.trim());\n  if (filters.runId?.trim()) params.set(\"runId\", filters.runId.trim());\n  if (filters.limit !== undefined) params.set(\"limit\", String(usageLimit(filters.limit)));\n  const query = params.toString();\n  return query ? `?${query}` : \"\";\n}\n\n/** Read and render metadata-only, app-attributed platform AI usage. */\nexport async function readAdminAiUsage(request: AdminAiUsageRequest): Promise<void> {\n  const res = await request.fetch(`${request.platform}/registry/platform/ai-usage${request.query}`, {\n    headers: request.headers,\n  });\n  const body = await responseBody(res);\n  if (!res.ok) throw new Error(apiError(\"read platform AI usage\", res.status, body));\n  if (request.json) request.stdout.log(JSON.stringify(body, null, 2));\n  else printUsage(body, request.stdout);\n}\n\nfunction usageLimit(value: number): number {\n  if (!Number.isSafeInteger(value) || value < 1 || value > 500) {\n    throw new Error(\"usage limit must be an integer from 1 to 500\");\n  }\n  return value;\n}\n\nfunction printUsage(body: unknown, out: Pick<typeof console, \"log\" | \"error\">): void {\n  const aggregates = isRecord(body) && isRecord(body.aggregates) && Array.isArray(body.aggregates.byStatus)\n    ? body.aggregates.byStatus.filter(isRecord)\n    : [];\n  out.log(`All retained hosted-security status totals (up to ${String(isRecord(body) ? body.retentionDays ?? 90 : 90)} days; o11y triage excluded)\\nstatus\\tcalls\\tinput tokens\\toutput tokens\\tcost\\tunpriced calls`);\n  for (const row of aggregates) {\n    out.log([\n      String(row.status ?? \"\"), String(row.calls ?? \"\"), String(row.input_tokens ?? \"\"),\n      String(row.output_tokens ?? \"\"), formatMicrousd(row.cost_microusd), String(row.unpriced_calls ?? \"\"),\n    ].join(\"\\t\"));\n  }\n  const events = isRecord(body) && Array.isArray(body.events) ? body.events.filter(isRecord) : [];\n  out.log(`Latest ${String(isRecord(body) ? body.eventLimit ?? events.length : events.length)} hosted-security events\\nwhen\\tapp/env\\trun\\tactor\\tpurpose/role\\troute / policy\\ttokens\\tcost\\tstatus`);\n  for (const event of events) {\n    const input = numeric(event.input_tokens);\n    const output = numeric(event.output_tokens);\n    const priced = event.priced === true || event.priced === 1;\n    out.log([\n      timestamp(event.created_at), `${String(event.app_id ?? \"\")}/${String(event.env ?? \"\")}`,\n      String(event.run_id ?? \"\"), `${String(event.actor_type ?? \"\")}:${String(event.actor_id ?? \"\")}`,\n      `${String(event.purpose ?? \"\")}/${String(event.role ?? \"\")}`,\n      `${String(event.provider ?? \"\")}/${String(event.model ?? \"\")}@v${String(event.policy_version ?? \"unknown\")}`, String(input + output),\n      priced ? formatMicrousd(event.cost_microusd) : \"unpriced\",\n      `${String(event.status ?? \"\")}${event.error_code ? `:${String(event.error_code)}` : \"\"}`,\n    ].join(\"\\t\"));\n  }\n}\n\nfunction numeric(value: unknown): number {\n  return typeof value === \"number\" && Number.isFinite(value) ? value : 0;\n}\n\nfunction formatMicrousd(value: unknown): string {\n  return typeof value === \"number\" && Number.isFinite(value) ? `$${(value / 1_000_000).toFixed(6)}` : \"unpriced\";\n}\n\nfunction timestamp(value: unknown): string {\n  if (typeof value !== \"number\" || !Number.isFinite(value)) return String(value ?? \"\");\n  const date = new Date(value);\n  return Number.isFinite(date.valueOf()) ? date.toISOString() : \"\";\n}\n\nasync function responseBody(res: Response): Promise<unknown> {\n  const text = await res.text();\n  if (!text) return {};\n  try { return JSON.parse(text) as unknown; } catch { return { message: text.slice(0, 300) }; }\n}\n\nfunction apiError(action: string, status: number, body: unknown): string {\n  const error = isRecord(body) && isRecord(body.error) ? body.error : undefined;\n  const message = error && typeof error.message === \"string\" ? error.message : isRecord(body) && typeof body.message === \"string\" ? body.message : \"request failed\";\n  return `${action} failed (${status}): ${message}`;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, isAbsolute, resolve } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport type { AppRules, CalendarServiceConfig, LoadedProjectConfig, OdlaProjectConfig, ProvisionPlan } from \"./types\";\nimport { validateIntegrations } from \"./integration-validation\";\n\nconst DEFAULT_PLATFORM = \"https://odla.ai\";\n// Safe-by-default: production must be opted into explicitly in odla.config.\nconst DEFAULT_ENVS = [\"dev\"];\nconst DEFAULT_SERVICES = [\"db\", \"ai\"];\n/** The Google OAuth scope that authorizes booking writes (events read/write). */\nexport const GOOGLE_CALENDAR_EVENTS_SCOPE = \"https://www.googleapis.com/auth/calendar.events\";\n\nexport async function loadProjectConfig(configPath = \"odla.config.mjs\"): Promise<LoadedProjectConfig> {\n  const resolved = resolve(configPath);\n  if (!existsSync(resolved)) {\n    throw new Error(`config not found: ${configPath}. Run \"odla-ai init\" first or pass --config.`);\n  }\n\n  const raw = await loadConfigModule(resolved);\n  const rootDir = dirname(resolved);\n  validateRawConfig(raw, resolved);\n\n  const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);\n  const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);\n  const envs = unique(raw.envs?.length ? raw.envs : DEFAULT_ENVS);\n  const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);\n  validateCalendarConfig(raw, envs, services, resolved);\n  const local = {\n    tokenFile: resolve(rootDir, raw.local?.tokenFile ?? \".odla/dev-token.json\"),\n    credentialsFile: resolve(rootDir, raw.local?.credentialsFile ?? \".odla/credentials.local.json\"),\n    devVarsFile: resolve(rootDir, raw.local?.devVarsFile ?? \".dev.vars\"),\n    gitignore: raw.local?.gitignore ?? true,\n  };\n\n  return {\n    ...raw,\n    configPath: resolved,\n    rootDir,\n    platformUrl,\n    dbEndpoint,\n    envs,\n    services,\n    local,\n  };\n}\n\nexport async function resolveDataExport<T>(\n  cfg: LoadedProjectConfig,\n  value: unknown,\n  names: string[],\n): Promise<T | undefined> {\n  if (value === undefined || value === null || value === false) return undefined;\n  if (typeof value !== \"string\") return value as T;\n\n  const target = isAbsolute(value) ? value : resolve(cfg.rootDir, value);\n  if (target.endsWith(\".json\")) {\n    return JSON.parse(readFileSync(target, \"utf8\")) as T;\n  }\n  const mod = (await import(pathToFileURL(target).href)) as Record<string, unknown>;\n  for (const name of names) {\n    if (mod[name] !== undefined) return mod[name] as T;\n  }\n  if (mod.default !== undefined) return mod.default as T;\n  throw new Error(`${value} did not export ${names.join(\", \")} or default`);\n}\n\nexport function buildPlan(cfg: LoadedProjectConfig): ProvisionPlan {\n  const integrationSchema = cfg.integrations?.some((integration) => integration.schema) ?? false;\n  const integrationRules = cfg.integrations?.some((integration) => integration.rules) ?? false;\n  return {\n    appId: cfg.app.id,\n    appName: cfg.app.name,\n    platformUrl: cfg.platformUrl,\n    dbEndpoint: cfg.dbEndpoint,\n    envs: cfg.envs,\n    services: cfg.services,\n    integrations: (cfg.integrations ?? []).map((integration) => integration.id),\n    hasSchema: !!cfg.db?.schema || integrationSchema,\n    hasRules:\n      !!cfg.db?.rules ||\n      integrationRules ||\n      ((!!cfg.db?.schema || integrationSchema) && cfg.db?.defaultRules !== false),\n    aiProvider: cfg.ai?.provider,\n  };\n}\n\n/** Resolve the checked-in calendar block into one controller-safe env payload. */\nexport function calendarServiceConfig(cfg: LoadedProjectConfig, env: string): CalendarServiceConfig {\n  if (!cfg.services.includes(\"calendar\")) throw new Error('calendar service is not enabled in config services');\n  if (!cfg.envs.includes(env)) throw new Error(`calendar env \"${env}\" is not declared in config envs`);\n  const google = cfg.calendar?.google;\n  if (!google) throw new Error(\"calendar.google is required when the calendar service is enabled\");\n  const availability = unique(\n    (google.availabilityCalendars?.[env] ?? google.calendars?.[env])!.map((id) => id.trim()),\n  );\n  return {\n    provider: \"google\",\n    access: \"book\",\n    bookingCalendarId: google.bookingCalendar?.[env]?.trim() ?? availability[0]!,\n    availabilityCalendars: availability,\n  };\n}\n\n/** Public Appointment Schedule URL to apply separately from connector config. */\nexport function calendarBookingPageUrl(cfg: LoadedProjectConfig, env: string): string | null | undefined {\n  const value = cfg.calendar?.google.bookingPageUrl?.[env];\n  if (value === undefined || value === null) return value;\n  return new URL(value).toString();\n}\n\nexport function rulesFromSchema(schema: unknown): AppRules {\n  const entities = serializedEntities(schema);\n  return Object.fromEntries(\n    entities.map((name) => [name, { view: \"false\", create: \"false\", update: \"false\", delete: \"false\" }]),\n  );\n}\n\nexport function serializedEntities(schema: unknown): string[] {\n  if (!schema || typeof schema !== \"object\") return [];\n  const entities = (schema as { entities?: unknown }).entities;\n  if (!entities || typeof entities !== \"object\" || Array.isArray(entities)) return [];\n  return Object.keys(entities);\n}\n\nexport function envValue(value: string | undefined): string | undefined {\n  if (!value) return undefined;\n  if (value.startsWith(\"$\")) return process.env[value.slice(1)];\n  return value;\n}\n\nfunction validateRawConfig(raw: unknown, path: string): asserts raw is OdlaProjectConfig {\n  if (!raw || typeof raw !== \"object\") throw new Error(`${path} must export an object`);\n  const cfg = raw as OdlaProjectConfig;\n  if (!cfg.app || typeof cfg.app !== \"object\") throw new Error(`${path}: missing app object`);\n  if (!validId(cfg.app.id)) throw new Error(`${path}: app.id must be lowercase letters, numbers, and hyphens`);\n  if (!cfg.app.name || typeof cfg.app.name !== \"string\") throw new Error(`${path}: app.name is required`);\n  if (cfg.envs !== undefined && (!Array.isArray(cfg.envs) || cfg.envs.some((env) => typeof env !== \"string\"))) {\n    throw new Error(`${path}: envs must be an array of names`);\n  }\n  if (cfg.envs?.some((env) => !validId(env))) throw new Error(`${path}: env names must be lowercase letters, numbers, and hyphens`);\n  if (cfg.services !== undefined && (!Array.isArray(cfg.services) || cfg.services.some((service) => typeof service !== \"string\" || !service.trim()))) {\n    throw new Error(`${path}: services must be an array of non-empty names`);\n  }\n  validateIntegrations(cfg, path, DEFAULT_SERVICES);\n}\n\nfunction validateCalendarConfig(cfg: OdlaProjectConfig, envs: string[], services: string[], path: string): void {\n  const enabled = services.includes(\"calendar\");\n  if (!cfg.calendar) {\n    if (enabled) throw new Error(`${path}: calendar.google is required when services includes \"calendar\"`);\n    return;\n  }\n  if (!isRecord(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);\n  assertOnly(cfg.calendar, [\"google\"], `${path}: calendar`);\n  if (!isRecord(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);\n  const google = cfg.calendar.google;\n  assertOnly(\n    google,\n    [\"availabilityCalendars\", \"calendars\", \"bookingCalendar\", \"bookingPageUrl\"],\n    `${path}: calendar.google`,\n  );\n  // `calendars` is the retired read-mirror spelling of availabilityCalendars;\n  // exactly one of the two must be authored.\n  const availabilityKey = google.availabilityCalendars !== undefined ? \"availabilityCalendars\"\n    : google.calendars !== undefined ? \"calendars\" : null;\n  if (!availabilityKey || (google.availabilityCalendars !== undefined && google.calendars !== undefined)) {\n    throw new Error(`${path}: calendar.google requires exactly one of availabilityCalendars or calendars (legacy)`);\n  }\n  const availability = google[availabilityKey];\n  if (!isRecord(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);\n  const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env));\n  if (unknownEnv) throw new Error(`${path}: calendar.google.${availabilityKey}.${unknownEnv} is not in config envs`);\n  for (const env of envs) {\n    const ids = availability[env];\n    if (!Array.isArray(ids) || ids.length === 0) {\n      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);\n    }\n    if (ids.length > 10) {\n      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must contain at most 10 calendar ids`);\n    }\n    if (ids.some((id) => !safeText(id, 1_024))) {\n      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} contains an invalid calendar id`);\n    }\n  }\n  if (google.bookingCalendar !== undefined) {\n    if (!isRecord(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);\n    const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env));\n    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);\n    for (const [env, value] of Object.entries(google.bookingCalendar)) {\n      if (!safeText(value, 1_024)) {\n        throw new Error(`${path}: calendar.google.bookingCalendar.${env} must be a calendar id`);\n      }\n    }\n  }\n  if (google.bookingPageUrl !== undefined) {\n    if (!isRecord(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);\n    const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env));\n    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);\n    for (const [env, value] of Object.entries(google.bookingPageUrl)) {\n      if (value !== null && !safeHttpsUrl(value)) {\n        throw new Error(`${path}: calendar.google.bookingPageUrl.${env} must be an HTTPS URL without credentials or fragment`);\n      }\n    }\n  }\n  if (enabled && !services.includes(\"db\")) throw new Error(`${path}: calendar service requires the db service`);\n}\n\nfunction assertOnly(value: Record<string, unknown>, allowed: string[], label: string): void {\n  const extra = Object.keys(value).find((key) => !allowed.includes(key));\n  if (extra) throw new Error(`${label}.${extra} is not supported`);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction safeText(value: unknown, max: number): value is string {\n  return typeof value === \"string\" && value.trim().length > 0 && value.length <= max && !/[\\u0000-\\u001f\\u007f]/.test(value);\n}\n\nfunction safeHttpsUrl(value: unknown): value is string {\n  if (typeof value !== \"string\" || value.length > 2_048) return false;\n  try {\n    const url = new URL(value);\n    return url.protocol === \"https:\" && !url.username && !url.password && !url.hash;\n  } catch {\n    return false;\n  }\n}\n\nfunction validId(value: unknown): value is string {\n  return typeof value === \"string\" && /^[a-z0-9][a-z0-9-]*$/.test(value);\n}\n\nasync function loadConfigModule(path: string): Promise<OdlaProjectConfig> {\n  if (path.endsWith(\".json\")) return JSON.parse(readFileSync(path, \"utf8\")) as OdlaProjectConfig;\n  const mod = (await import(`${pathToFileURL(path).href}?t=${Date.now()}`)) as {\n    default?: OdlaProjectConfig | (() => OdlaProjectConfig | Promise<OdlaProjectConfig>);\n    config?: OdlaProjectConfig;\n  };\n  const value = mod.default ?? mod.config;\n  if (typeof value === \"function\") return await value();\n  return value as OdlaProjectConfig;\n}\n\nfunction trimSlash(value: string): string {\n  return value.replace(/\\/+$/, \"\");\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values.filter(Boolean))];\n}\n","import type { OdlaProjectConfig } from \"./types\";\n\n/** Validate the structural integration block before config normalization. */\nexport function validateIntegrations(\n  cfg: OdlaProjectConfig,\n  path: string,\n  defaultServices: readonly string[],\n): void {\n  if (cfg.integrations === undefined) return;\n  if (!Array.isArray(cfg.integrations)) throw new Error(`${path}: integrations must be an array`);\n  const ids = new Set<string>();\n  for (const [index, integration] of cfg.integrations.entries()) {\n    const at = `${path}: integrations[${index}]`;\n    if (!isRecord(integration)) throw new Error(`${at} must be an object`);\n    if (!validId(integration.id)) throw new Error(`${at}.id must be lowercase letters, numbers, and hyphens`);\n    if (ids.has(integration.id)) throw new Error(`${path}: duplicate integration id \"${integration.id}\"`);\n    ids.add(integration.id);\n    if (!safeText(integration.title, 200)) throw new Error(`${at}.title is required`);\n    if (!safeText(integration.npm, 200)) throw new Error(`${at}.npm is required`);\n    if (integration.schema !== undefined && (!isRecord(integration.schema) || !isRecord(integration.schema.entities))) {\n      throw new Error(`${at}.schema must contain an entities object`);\n    }\n    if (integration.rules !== undefined && !isRecord(integration.rules)) throw new Error(`${at}.rules must be an object`);\n    validateSeeds(integration, at);\n    validateProbes(integration, at);\n  }\n  const needsDb = cfg.integrations.some((integration) => integration.schema || integration.rules || integration.seeds?.length);\n  const services = unique(cfg.services?.length ? cfg.services : defaultServices);\n  if (needsDb && !services.includes(\"db\")) throw new Error(`${path}: schema/rules/seed integrations require the db service`);\n}\n\nfunction validateSeeds(integration: NonNullable<OdlaProjectConfig[\"integrations\"]>[number], at: string): void {\n  if (integration.seeds === undefined) return;\n  if (!Array.isArray(integration.seeds)) throw new Error(`${at}.seeds must be an array`);\n  const ids = new Set<string>();\n  for (const [index, seed] of integration.seeds.entries()) {\n    const sat = `${at}.seeds[${index}]`;\n    if (!isRecord(seed) || !safeText(seed.id, 200) || !safeText(seed.ns, 200)) throw new Error(`${sat} requires id and ns`);\n    if (ids.has(seed.id)) throw new Error(`${at} has duplicate seed id \"${seed.id}\"`);\n    ids.add(seed.id);\n    if (!isRecord(seed.key) || !safeText(seed.key.attr, 200) || !safeText(seed.key.value, 2_048)) {\n      throw new Error(`${sat}.key requires string attr and value`);\n    }\n    if (!isRecord(seed.attrs)) throw new Error(`${sat}.attrs must be an object`);\n    if (Object.hasOwn(seed.attrs, seed.key.attr) && seed.attrs[seed.key.attr] !== seed.key.value) {\n      throw new Error(`${sat}.attrs.${seed.key.attr} conflicts with its natural key`);\n    }\n  }\n}\n\nfunction validateProbes(integration: NonNullable<OdlaProjectConfig[\"integrations\"]>[number], at: string): void {\n  if (integration.probes === undefined) return;\n  if (!Array.isArray(integration.probes)) throw new Error(`${at}.probes must be an array`);\n  for (const [index, probe] of integration.probes.entries()) {\n    const pat = `${at}.probes[${index}]`;\n    if (!isRecord(probe) || !safeProbePath(probe.path)) throw new Error(`${pat}.path must be an absolute path without query or fragment`);\n    if (!Number.isInteger(probe.expectedStatus) || probe.expectedStatus < 100 || probe.expectedStatus > 599) {\n      throw new Error(`${pat}.expectedStatus must be an HTTP status`);\n    }\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction safeText(value: unknown, max: number): value is string {\n  return typeof value === \"string\" && value.trim().length > 0 && value.length <= max && !/[\\u0000-\\u001f\\u007f]/.test(value);\n}\n\nfunction safeProbePath(value: unknown): value is string {\n  return typeof value === \"string\" && /^\\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*$/.test(value);\n}\n\nfunction validId(value: unknown): value is string {\n  return typeof value === \"string\" && /^[a-z0-9][a-z0-9-]*$/.test(value);\n}\n\nfunction unique(values: readonly string[]): string[] {\n  return [...new Set(values.filter(Boolean))];\n}\n","/**\n * Secret redaction shared by every command's output path and by doctor's\n * \"does this value look like a secret\" checks. Clerk publishable keys\n * (pk_test_/pk_live_) are public by design and are deliberately not matched.\n */\nconst REPLACEMENTS: Array<[RegExp, string]> = [\n  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, \"odla_$1_[redacted]\"],\n  [/\\bsk_(live|test)_[A-Za-z0-9]+/g, \"sk_$1_[redacted]\"],\n  [/\\bsk-[A-Za-z0-9._-]+/g, \"sk-[redacted]\"],\n  [/\\bwhsec_[A-Za-z0-9+/=]+/g, \"whsec_[redacted]\"],\n  [/\\bo11y_[A-Za-z0-9]+/g, \"o11y_[redacted]\"],\n  [/\\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, \"$1_[redacted]\"],\n  [/\\bAKIA[A-Z0-9]{12,}/g, \"AKIA[redacted]\"],\n];\n\n/**\n * Return `value` with every secret-shaped substring replaced by a `[redacted]`\n * placeholder that keeps the identifying prefix (e.g. `sk_live_[redacted]`).\n * Matches odla db keys (`odla_sk_`/`odla_dev_`), Clerk secret keys\n * (`sk_live_`/`sk_test_`), OpenAI keys (`sk-`), webhook signing secrets\n * (`whsec_`), o11y tokens (`o11y_`), GitHub tokens (`ghp_`/`gho_`/`github_pat_`),\n * and AWS access-key ids (`AKIA…`). Clerk publishable keys (`pk_test_`/\n * `pk_live_`) are public by design and intentionally left untouched. Used to\n * sanitize anything the CLI echoes (notably network error bodies) before it\n * reaches stdout/stderr. Non-matching input is returned unchanged.\n */\nexport function redactSecrets(value: string): string {\n  let result = value;\n  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);\n  return result;\n}\n\n/**\n * Wrap the CLI's line-oriented output boundary so command implementations\n * cannot accidentally bypass redaction when they print a backend message.\n * Objects and arrays retain their shape for console/test sinks while every\n * nested string is sanitized.\n */\nexport function redactingOutput(\n  output: Pick<typeof console, \"log\" | \"error\">,\n): Pick<typeof console, \"log\" | \"error\"> {\n  const redactArgs = (args: unknown[]) => args.map((value) => redactOutputValue(value, new WeakMap<object, unknown>()));\n  return {\n    log: (...args: unknown[]) => output.log(...redactArgs(args)),\n    error: (...args: unknown[]) => output.error(...redactArgs(args)),\n  };\n}\n\nfunction redactOutputValue(value: unknown, seen: WeakMap<object, unknown>): unknown {\n  if (typeof value === \"string\") return redactSecrets(value);\n  if (value instanceof Error) {\n    const redacted = new Error(redactSecrets(value.message));\n    redacted.name = value.name;\n    if (value.stack) redacted.stack = redactSecrets(value.stack);\n    return redacted;\n  }\n  if (!value || typeof value !== \"object\") return value;\n  const prior = seen.get(value);\n  if (prior) return prior;\n  if (Array.isArray(value)) {\n    const next: unknown[] = [];\n    seen.set(value, next);\n    for (const item of value) next.push(redactOutputValue(item, seen));\n    return next;\n  }\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype !== Object.prototype && prototype !== null) return value;\n  const next: Record<string, unknown> = {};\n  seen.set(value, next);\n  for (const [key, item] of Object.entries(value)) next[key] = redactOutputValue(item, seen);\n  return next;\n}\n\n/** True when a value matches any known secret shape (used for detection, never display). */\nexport function looksSecret(value: string): boolean {\n  return redactSecrets(value) !== value || value.includes(\"-----BEGIN\");\n}\n","const PLATFORM_NOT_READY_CODES = new Set([\n  \"calendar_google_oauth_not_configured\",\n  \"calendar_token_vault_not_configured\",\n  // Current spelling (booking-era key verifier) plus the retired mirror-era\n  // ingress code, so the CLI stays resumable against either platform version.\n  \"calendar_db_verifier_not_configured\",\n  \"calendar_db_ingress_not_configured\",\n]);\n\n/**\n * Calendar registry request that completed with a non-2xx response. Preserves\n * the HTTP status and the platform's machine-readable `error.code` so callers\n * can branch on the code instead of parsing the redacted message.\n */\nexport class CalendarRequestError extends Error {\n  /** HTTP status returned by the registry. */\n  readonly status: number;\n  /** Machine-readable `error.code` from the response body, when present. */\n  readonly code?: string;\n\n  constructor(message: string, status: number, code?: string) {\n    super(message);\n    this.name = \"CalendarRequestError\";\n    this.status = status;\n    if (code !== undefined) this.code = code;\n  }\n}\n\n/**\n * True when the error is the platform reporting that its own calendar\n * connector is not yet configured (Google OAuth client, token vault, or DB\n * ingress). Only a platform operator can fix these, so provision reports them\n * as a resumable warning instead of aborting. Matches on the error code, not\n * the HTTP status — the code is the contract.\n */\nexport function isCalendarPlatformNotReady(error: unknown): error is CalendarRequestError & { code: string } {\n  return error instanceof CalendarRequestError && error.code !== undefined && PLATFORM_NOT_READY_CODES.has(error.code);\n}\n","import { CalendarRequestError } from \"./calendar-errors\";\nimport { redactSecrets } from \"./redact\";\nimport { platformAudience } from \"./token\";\n\nexport const CALENDAR_STATES = [\n  \"not_connected\", \"authorizing\", \"healthy\", \"degraded\", \"disconnected\", \"failed\",\n] as const;\n/** Connection lifecycle reported by the registry; mirrors the platform's\n * calendar states. `degraded` means connected but re-consent is required. */\nexport type CalendarConnectionState = (typeof CALENDAR_STATES)[number];\n\n/** Owner-visible, secret-free calendar connection health. */\nexport interface CalendarStatus {\n  env: string;\n  enabled: boolean;\n  /** True when the platform has provider credentials for this connection. */\n  connected: boolean;\n  /** True when the grant covers booking writes; false means reconnect. */\n  writable: boolean;\n  provider: \"google\" | null;\n  status: CalendarConnectionState;\n  access?: \"book\";\n  /** Calendar that receives created bookings. */\n  bookingCalendarId?: string;\n  /** Calendars consulted for FreeBusy availability. */\n  calendars: string[];\n  bookingPageUrl?: string | null;\n  grantedScopes: string[];\n  attemptId?: string;\n  error?: { code?: string; message?: string };\n}\n\nexport interface CalendarHttpContext {\n  platform: string;\n  appId: string;\n  env: string;\n  token: string;\n  fetch?: typeof fetch;\n}\n\nexport interface CalendarConnectionAttempt {\n  attemptId: string;\n  consentUrl: string;\n  expiresAt: number;\n}\n\n/** One Google calendar the connected identity may select for mirroring. */\nexport interface AvailableGoogleCalendar {\n  id: string;\n  summary?: string;\n  primary?: boolean;\n  selected?: boolean;\n  accessRole?: \"freeBusyReader\" | \"reader\" | \"writer\" | \"owner\";\n}\n\nexport async function readCalendarStatus(ctx: CalendarHttpContext): Promise<CalendarStatus> {\n  return parseCalendarStatus(await calendarJson(ctx, \"\", {}), ctx.env);\n}\n\nexport async function discoverGoogleCalendars(ctx: CalendarHttpContext): Promise<AvailableGoogleCalendar[]> {\n  const raw = await calendarJson(ctx, \"/calendars\", {});\n  const value = record(raw);\n  if (!value || !Array.isArray(value.calendars)) throw new Error(\"calendar discovery returned an invalid response\");\n  return value.calendars.map((item, index) => {\n    const calendar = record(item);\n    const id = textField(calendar?.id, 1_024);\n    if (!calendar || !id) throw new Error(`calendar discovery returned an invalid calendar at index ${index}`);\n    const role = calendar.accessRole;\n    if (role !== undefined && role !== \"freeBusyReader\" && role !== \"reader\" && role !== \"writer\" && role !== \"owner\") {\n      throw new Error(`calendar discovery returned an invalid access role at index ${index}`);\n    }\n    return {\n      id,\n      ...optionalText(\"summary\", calendar.summary, 500),\n      ...(typeof calendar.primary === \"boolean\" ? { primary: calendar.primary } : {}),\n      ...(typeof calendar.selected === \"boolean\" ? { selected: calendar.selected } : {}),\n      ...(typeof role === \"string\" ? { accessRole: role } : {}),\n    };\n  });\n}\n\nexport async function applyCalendarSettings(ctx: CalendarHttpContext, bookingPageUrl: string | null): Promise<CalendarStatus> {\n  return parseCalendarStatus(await calendarJson(ctx, \"\", { method: \"PUT\", body: JSON.stringify({ bookingPageUrl }) }), ctx.env);\n}\n\nexport async function startCalendarConnection(ctx: CalendarHttpContext): Promise<CalendarConnectionAttempt> {\n  const raw = await calendarJson(ctx, \"/google/connect\", { method: \"POST\", body: \"{}\" });\n  const value = wrapped(raw, \"attempt\");\n  const attemptId = textField(value.attemptId, 180);\n  const consentUrl = textField(value.consentUrl, 4_096);\n  const expiresAt = timestamp(value.expiresAt);\n  if (!attemptId || !consentUrl || expiresAt === undefined) throw new Error(\"calendar connect returned an invalid attempt\");\n  return { attemptId, consentUrl, expiresAt };\n}\n\nexport async function pollCalendarConnection(ctx: CalendarHttpContext, attemptId: string): Promise<CalendarStatus> {\n  return parseCalendarStatus(\n    await calendarJson(ctx, `/google/connect/${encodeURIComponent(identifier(attemptId, \"attemptId\"))}`, {}),\n    ctx.env,\n  );\n}\n\nexport async function requestCalendarDisconnect(ctx: CalendarHttpContext): Promise<CalendarStatus> {\n  return parseCalendarStatus(\n    await calendarJson(ctx, \"/disconnect\", { method: \"POST\", body: JSON.stringify({ purge: false }) }),\n    ctx.env,\n  );\n}\n\nexport function parseCalendarStatus(raw: unknown, env: string): CalendarStatus {\n  const outer = wrapped(raw, \"calendar\");\n  const value = record(outer.attempt) ?? record(outer.status) ?? outer;\n  const connection = record(value.connection) ?? {};\n  const config = record(value.config) ?? record(outer.config) ?? {};\n  const googleConfig = record(config.google) ?? config;\n  const stateValue = calendarState(value.status ?? value.state ?? connection.status ?? connection.state);\n  if (!stateValue) {\n    throw new Error(\"calendar status returned an invalid connection state\");\n  }\n  const providerValue = value.provider ?? connection.provider ?? config.provider ?? (config.google ? \"google\" : undefined);\n  if (providerValue !== undefined && providerValue !== null && providerValue !== \"google\") {\n    throw new Error(\"calendar status returned an unsupported provider\");\n  }\n  const accessValue = value.access ?? connection.access ?? config.access ?? googleConfig.access;\n  // \"read\" is the retired mirror's spelling; the live registry reports \"book\".\n  if (accessValue !== undefined && accessValue !== \"book\" && accessValue !== \"read\") {\n    throw new Error(\"calendar status returned unsupported access\");\n  }\n  const errorValue = record(value.error) ?? record(connection.error);\n  const errorCode = textField(value.lastErrorCode, 128);\n  const bookingPageValue = Object.hasOwn(value, \"bookingPageUrl\")\n    ? value.bookingPageUrl\n    : Object.hasOwn(config, \"bookingPageUrl\") ? config.bookingPageUrl : googleConfig.bookingPageUrl;\n  const connected = typeof (value.connected ?? connection.connected) === \"boolean\"\n    ? Boolean(value.connected ?? connection.connected)\n    : [\"healthy\", \"degraded\"].includes(stateValue);\n  const bookingCalendarId = textField(value.bookingCalendarId ?? config.bookingCalendarId, 1_024);\n  return {\n    env,\n    enabled: typeof value.enabled === \"boolean\" ? value.enabled : true,\n    connected,\n    writable: typeof value.writable === \"boolean\" ? value.writable : stateValue === \"healthy\",\n    provider: providerValue === \"google\" ? \"google\" : null,\n    status: stateValue,\n    ...(accessValue !== undefined ? { access: \"book\" as const } : {}),\n    ...(bookingCalendarId ? { bookingCalendarId } : {}),\n    calendars: calendarIds(\n      value.availabilityCalendars ?? config.availabilityCalendars\n      ?? value.configuredCalendars ?? value.calendars ?? config.calendars ?? googleConfig.calendars,\n    ),\n    ...optionalNullableUrl(\"bookingPageUrl\", bookingPageValue),\n    grantedScopes: stringList(value.grantedScopes ?? connection.grantedScopes ?? connection.scopes),\n    ...optionalText(\"attemptId\", value.attemptId ?? connection.attemptId, 180),\n    ...(errorValue || errorCode ? { error: {\n      ...(textField(errorValue?.code, 128) ? { code: textField(errorValue?.code, 128) } : {}),\n      ...(textField(errorValue?.message, 500) ? { message: textField(errorValue?.message, 500) } : {}),\n      ...(!errorValue && errorCode ? { code: errorCode } : {}),\n    } } : {}),\n  };\n}\n\nfunction calendarState(value: unknown): CalendarConnectionState | null {\n  if (typeof value !== \"string\") return null;\n  if ((CALENDAR_STATES as readonly string[]).includes(value)) return value as CalendarConnectionState;\n  const legacy: Record<string, CalendarConnectionState> = {\n    disabled: \"not_connected\",\n    disconnected: \"disconnected\",\n    connecting: \"authorizing\",\n    syncing: \"healthy\",\n    needs_sync: \"healthy\",\n    initial_sync: \"healthy\",\n    ready: \"healthy\",\n    error: \"failed\",\n  };\n  return legacy[value] ?? null;\n}\n\nasync function calendarJson(ctx: CalendarHttpContext, suffix: string, init: RequestInit): Promise<unknown> {\n  const platform = platformAudience(ctx.platform);\n  const appId = identifier(ctx.appId, \"appId\");\n  const env = identifier(ctx.env, \"env\");\n  const url = new URL(`/registry/apps/${encodeURIComponent(appId)}/calendar${suffix}`, platform);\n  url.searchParams.set(\"env\", env);\n  const token = credential(ctx.token);\n  let response: Response;\n  try {\n    response = await (ctx.fetch ?? fetch)(url, {\n      ...init,\n      redirect: \"error\",\n      credentials: \"omit\",\n      headers: { authorization: `Bearer ${token}`, \"content-type\": \"application/json\", ...init.headers },\n    });\n  } catch (error) {\n    throw new Error(`calendar request failed: ${error instanceof Error ? error.message : String(error)}`);\n  }\n  const body = await response.json().catch(() => ({})) as { error?: { code?: unknown; message?: unknown } };\n  if (!response.ok) {\n    const code = textField(body.error?.code, 128);\n    const message = textField(body.error?.message, 500);\n    const detail = `${code ? ` ${code}` : \"\"}${message ? `: ${message}` : \"\"}`;\n    throw new CalendarRequestError(redactSecrets(`calendar request failed (${response.status})${detail}`), response.status, code);\n  }\n  return body;\n}\n\nfunction wrapped(raw: unknown, key: string): Record<string, unknown> {\n  const outer = record(raw);\n  if (!outer) throw new Error(\"calendar returned an invalid response\");\n  return record(outer[key]) ?? outer;\n}\n\nfunction record(value: unknown): Record<string, unknown> | null {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value) ? value as Record<string, unknown> : null;\n}\n\nfunction textField(value: unknown, max: number): string | undefined {\n  return typeof value === \"string\" && value.length > 0 && value.length <= max && !/[\\u0000-\\u001f\\u007f]/.test(value) ? value : undefined;\n}\n\nfunction stringList(value: unknown): string[] {\n  return Array.isArray(value) ? [...new Set(value.filter((item): item is string => !!textField(item, 4_096)))] : [];\n}\n\nfunction calendarIds(value: unknown): string[] {\n  if (!Array.isArray(value)) return [];\n  return [...new Set(value.flatMap((item) => {\n    if (typeof item === \"string\") return textField(item, 4_096) ? [item] : [];\n    const calendar = record(item);\n    const id = textField(calendar?.id, 4_096);\n    return id && calendar?.selected !== false ? [id] : [];\n  }))];\n}\n\nfunction timestamp(value: unknown): number | undefined {\n  if (typeof value === \"number\" && Number.isFinite(value) && value >= 0) return value;\n  if (typeof value === \"string\") {\n    const parsed = Date.parse(value);\n    if (Number.isFinite(parsed)) return parsed;\n  }\n  return undefined;\n}\n\nfunction optionalText<K extends string>(key: K, value: unknown, max: number): { [P in K]?: string } {\n  const parsed = textField(value, max);\n  return parsed ? { [key]: parsed } as { [P in K]?: string } : {};\n}\n\n\n\nfunction optionalNullableUrl<K extends string>(key: K, value: unknown): { [P in K]?: string | null } {\n  if (value === null) return { [key]: null } as { [P in K]?: string | null };\n  const parsed = textField(value, 4_096);\n  return parsed ? { [key]: parsed } as { [P in K]?: string | null } : {};\n}\n\nfunction identifier(value: string, name: string): string {\n  if (typeof value !== \"string\" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,179}$/.test(value)) throw new Error(`${name} is invalid`);\n  return value;\n}\n\nfunction credential(value: string): string {\n  if (typeof value !== \"string\" || value.length < 8 || value.length > 8_192 || /\\s|[\\u0000-\\u001f\\u007f]/.test(value)) {\n    throw new Error(\"calendar requires an odla developer token\");\n  }\n  return value;\n}\n","/** Abort-aware delay shared by new-attempt and existing-sync polling. */\nexport async function waitForCalendarPoll(milliseconds: number, signal?: AbortSignal): Promise<void> {\n  if (signal?.aborted) throw signal.reason ?? new Error(\"calendar connection aborted\");\n  await new Promise<void>((resolve, reject) => {\n    const timer = setTimeout(resolve, milliseconds);\n    signal?.addEventListener(\"abort\", () => {\n      clearTimeout(timer);\n      reject(signal.reason ?? new Error(\"calendar connection aborted\"));\n    }, { once: true });\n  });\n}\n","import { calendarBookingPageUrl, calendarServiceConfig, loadProjectConfig } from \"./config\";\nimport {\n  applyCalendarSettings,\n  discoverGoogleCalendars,\n  pollCalendarConnection,\n  readCalendarStatus,\n  requestCalendarDisconnect,\n  startCalendarConnection,\n} from \"./calendar-http\";\nimport type { CalendarHttpContext, CalendarStatus } from \"./calendar-http\";\nimport type { AvailableGoogleCalendar } from \"./calendar-http\";\nimport { waitForCalendarPoll } from \"./calendar-poll\";\nimport { openUrl } from \"./open\";\nimport { approvalBrowser, getDeveloperToken, platformAudience } from \"./token\";\n\n/** Shared inputs for the calendar lifecycle commands (status, connect,\n * calendars, disconnect): the project config path and env, plus injectable\n * token, output, browser, clock, and polling hooks so agents and tests can\n * drive the flow deterministically. */\nexport interface CalendarLifecycleOptions {\n  /** Path to the checked-in odla project config. */ configPath: string;\n  /** Configured environment; defaults to dev when present. */ env?: string;\n  /** Existing developer-token override. */ token?: string;\n  /** Existing odla account email used only for a fresh handshake. */ email?: string;\n  open?: boolean; yes?: boolean; json?: boolean;\n  fetch?: typeof fetch; stdout?: Pick<typeof console, \"log\" | \"error\">;\n  openConsentUrl?: (url: string) => Promise<void>;\n  wait?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;\n  pollTimeoutMs?: number; now?: () => number; signal?: AbortSignal;\n}\n\n/** Read the owner-visible Google connection and booking health for one env. */\nexport async function calendarStatus(options: CalendarLifecycleOptions): Promise<CalendarStatus> {\n  const { ctx, out } = await lifecycleContext(options);\n  const status = await readCalendarStatus(ctx);\n  printStatus(status, options.json === true, out);\n  return status;\n}\n\n/** List calendars visible to the connected Google identity for config authoring. */\nexport async function calendarCalendars(options: CalendarLifecycleOptions): Promise<AvailableGoogleCalendar[]> {\n  const { ctx, out } = await lifecycleContext(options);\n  const calendars = await discoverGoogleCalendars(ctx);\n  if (options.json) out.log(JSON.stringify({ env: ctx.env, calendars }, null, 2));\n  else if (calendars.length === 0) out.log(`${ctx.env}: no Google calendars available`);\n  else for (const calendar of calendars) {\n    out.log(`${calendar.selected ? \"✓\" : calendar.primary ? \"*\" : \" \"} ${calendar.id}${calendar.summary ? ` — ${calendar.summary}` : \"\"}${calendar.accessRole ? ` (${calendar.accessRole})` : \"\"}`);\n  }\n  return calendars;\n}\n\n/** Apply the optional booking-page setting, then complete Google consent.\n * A connection whose grant predates booking scopes (`degraded`) re-runs\n * consent so the platform can create events and read FreeBusy. */\nexport async function calendarConnect(options: CalendarLifecycleOptions): Promise<CalendarStatus> {\n  const { cfg, ctx, out } = await lifecycleContext(options);\n  productionConsent(ctx.env, options.yes, \"connect calendar\");\n  const page = calendarBookingPageUrl(cfg, ctx.env);\n  const applied = page === undefined ? await readCalendarStatus(ctx) : await applyCalendarSettings(ctx, page);\n  const connectOptions = connectionOptions(options, out);\n  return await continueConnectedCalendar(ctx, applied, connectOptions)\n    ?? connectWithContext(ctx, connectOptions);\n}\n\n/** Provision applies public embed/link configuration through the owner route. */\nexport async function applyCalendarBookingPage(\n  ctx: CalendarHttpContext,\n  bookingPageUrl: string | null | undefined,\n  out: Pick<typeof console, \"log\">,\n): Promise<CalendarStatus | null> {\n  if (bookingPageUrl === undefined) return null;\n  const status = await applyCalendarSettings(ctx, bookingPageUrl);\n  out.log(`${ctx.env}: calendar booking page ${bookingPageUrl ? \"set\" : \"cleared\"}`);\n  return status;\n}\n\n/** Delete this connection's encrypted platform tokens. No calendar data is\n * stored anywhere, so there is nothing else to clean up; the shared Google\n * project grant is not revoked. */\nexport async function calendarDisconnect(options: CalendarLifecycleOptions): Promise<CalendarStatus> {\n  if (!options.yes) throw new Error('calendar disconnect requires --yes');\n  const { ctx, out } = await lifecycleContext(options);\n  const status = await requestCalendarDisconnect(ctx);\n  out.log(`${ctx.env}: calendar disconnected; no calendar data was stored`);\n  return status;\n}\n\n/** Provision's idempotent connection phase after service enablement/config apply. */\nexport async function ensureCalendarConnected(\n  ctx: CalendarHttpContext,\n  options: Omit<CalendarLifecycleOptions, \"configPath\" | \"env\" | \"token\" | \"fetch\">,\n): Promise<CalendarStatus> {\n  const out = options.stdout ?? console;\n  const current = await readCalendarStatus(ctx);\n  const connectOptions = connectionOptions(options, out);\n  return await continueConnectedCalendar(ctx, current, connectOptions)\n    ?? connectWithContext(ctx, connectOptions);\n}\n\nasync function lifecycleContext(options: CalendarLifecycleOptions): Promise<{\n  cfg: Awaited<ReturnType<typeof loadProjectConfig>>;\n  ctx: CalendarHttpContext;\n  out: Pick<typeof console, \"log\" | \"error\">;\n}> {\n  const cfg = await loadProjectConfig(options.configPath);\n  if (!cfg.services.includes(\"calendar\")) throw new Error('calendar service is not enabled in config services');\n  const env = options.env ?? (cfg.envs.includes(\"dev\") ? \"dev\" : cfg.envs[0]);\n  if (!env || !cfg.envs.includes(env)) throw new Error(`env \"${env ?? \"\"}\" is not declared in ${options.configPath}`);\n  // Resolving this also asserts that the authored Google block covers the env.\n  calendarServiceConfig(cfg, env);\n  const out = options.stdout ?? console;\n  const doFetch = options.fetch ?? fetch;\n  const token = await getDeveloperToken(\n    cfg,\n    {\n      configPath: cfg.configPath,\n      token: options.token,\n      email: options.email,\n      open: options.open,\n      openApprovalUrl: options.openConsentUrl,\n    },\n    doFetch,\n    out,\n  );\n  return { cfg, ctx: { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch }, out };\n}\n\nfunction connectionOptions(\n  options: Pick<CalendarLifecycleOptions, \"open\" | \"openConsentUrl\" | \"wait\" | \"pollTimeoutMs\" | \"now\" | \"signal\">,\n  out: Pick<typeof console, \"log\" | \"error\">,\n): ConnectContextOptions {\n  const browser = approvalBrowser({ open: options.open });\n  return {\n    out,\n    open: browser.open,\n    openConsentUrl: options.openConsentUrl,\n    wait: options.wait,\n    pollTimeoutMs: options.pollTimeoutMs,\n    now: options.now,\n    signal: options.signal,\n  };\n}\n\ninterface ConnectContextOptions {\n  out: Pick<typeof console, \"log\" | \"error\">;\n  open: boolean;\n  openConsentUrl?: (url: string) => Promise<void>;\n  wait?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;\n  pollTimeoutMs?: number;\n  now?: () => number;\n  signal?: AbortSignal;\n}\n\n/** Reuse an installed, writable connection; anything else falls through to a\n * fresh Google consent. `degraded` (connected but not writable — a grant from\n * the retired read-only era) always re-consents: the booking proxy cannot act\n * until the owner grants the events + freebusy scopes. */\nasync function continueConnectedCalendar(\n  ctx: CalendarHttpContext,\n  current: CalendarStatus,\n  options: ConnectContextOptions,\n): Promise<CalendarStatus | null> {\n  if (current.status === \"healthy\") {\n    options.out.log(`${ctx.env}: calendar already connected (healthy)`);\n    return current;\n  }\n  if (current.status === \"degraded\") {\n    options.out.log(`${ctx.env}: calendar grant predates booking scopes — Google re-consent required`);\n    return null;\n  }\n  if (current.status === \"failed\" && current.connected) {\n    const reason = current.error?.message ?? current.error?.code;\n    throw new Error(`calendar connection failed${reason ? `: ${reason}` : \"\"}; inspect status and reconnect explicitly`);\n  }\n  if (current.status !== \"authorizing\") return null;\n\n  // Another operator's consent is mid-flight; follow it instead of racing it.\n  const now = options.now ?? Date.now;\n  const deadline = now() + pollTimeout(options.pollTimeoutMs);\n  const wait = options.wait ?? waitForCalendarPoll;\n  let prior = \"\";\n  while (now() < deadline) {\n    if (options.signal?.aborted) throw options.signal.reason ?? new Error(\"calendar connection aborted\");\n    const status = await readCalendarStatus(ctx);\n    if (status.status !== prior) {\n      options.out.log(`${ctx.env}: calendar ${status.status.replaceAll(\"_\", \" \")}`);\n      prior = status.status;\n    }\n    if (status.status === \"healthy\") return status;\n    if (status.status === \"degraded\") return null;\n    if (status.status === \"failed\" && status.connected) {\n      const reason = status.error?.message ?? status.error?.code;\n      throw new Error(`calendar connection failed${reason ? `: ${reason}` : \"\"}; inspect status and reconnect explicitly`);\n    }\n    if (status.status !== \"authorizing\") return null;\n    await wait(Math.min(2_000, Math.max(0, deadline - now())), options.signal);\n  }\n  throw new Error('Existing Google Calendar authorization timed out; run \"odla-ai calendar status\" and retry');\n}\n\nasync function connectWithContext(ctx: CalendarHttpContext, options: ConnectContextOptions): Promise<CalendarStatus> {\n  const attempt = await startCalendarConnection(ctx);\n  const consentUrl = trustedCalendarConsentUrl(ctx.platform, attempt.consentUrl);\n  options.out.log(`${ctx.env}: Google Calendar consent: ${consentUrl}`);\n  if (options.open) {\n    await (options.openConsentUrl ?? openUrl)(consentUrl);\n    options.out.log(`${ctx.env}: opened Google Calendar consent in your browser`);\n  }\n  const now = options.now ?? Date.now;\n  const timeout = pollTimeout(options.pollTimeoutMs);\n  const deadline = Math.min(attempt.expiresAt, now() + timeout);\n  const wait = options.wait ?? waitForCalendarPoll;\n  let prior = \"\";\n  while (now() < deadline) {\n    if (options.signal?.aborted) throw options.signal.reason ?? new Error(\"calendar connection aborted\");\n    const status = await pollCalendarConnection(ctx, attempt.attemptId);\n    if (status.status !== prior) {\n      options.out.log(`${ctx.env}: calendar ${status.status.replaceAll(\"_\", \" \")}`);\n      prior = status.status;\n    }\n    if (status.status === \"healthy\") return status;\n    if (status.status === \"degraded\") {\n      throw new Error(\"calendar connected without booking scopes; re-run connect and grant calendar access\");\n    }\n    if (status.status === \"failed\" || status.status === \"disconnected\" || status.status === \"not_connected\") {\n      const reason = status.error?.message ?? status.error?.code;\n      throw new Error(`calendar connection ${status.status}${reason ? `: ${reason}` : \"\"}`);\n    }\n    await wait(Math.min(2_000, Math.max(0, deadline - now())), options.signal);\n  }\n  throw new Error('Google Calendar consent timed out; run \"odla-ai calendar status\" and retry connect');\n}\n\nexport function trustedCalendarConsentUrl(platform: string, value: string): string {\n  const origin = platformAudience(platform);\n  let url: URL;\n  try { url = value.startsWith(\"/\") ? new URL(value, origin) : new URL(value); } catch { throw new Error(\"odla.ai returned an invalid calendar consent URL\"); }\n  const platformPage = url.origin === origin;\n  const googlePage = url.origin === \"https://accounts.google.com\" && url.pathname === \"/o/oauth2/v2/auth\";\n  if ((!platformPage && !googlePage) || url.username || url.password || url.hash) {\n    throw new Error(\"odla.ai returned an untrusted calendar consent URL\");\n  }\n  return url.toString();\n}\n\nfunction pollTimeout(value = 10 * 60_000): number {\n  if (!Number.isSafeInteger(value) || value < 1_000 || value > 60 * 60_000) throw new Error(\"calendar poll timeout must be 1000-3600000ms\");\n  return value;\n}\n\nexport { waitForCalendarPoll } from \"./calendar-poll\";\n\nfunction productionConsent(env: string, yes: boolean | undefined, action: string): void {\n  if ((env === \"prod\" || env === \"production\") && !yes) throw new Error(`refusing to ${action} for \"${env}\" without --yes`);\n}\n\nfunction printStatus(status: CalendarStatus, json: boolean, out: Pick<typeof console, \"log\">): void {\n  if (json) {\n    out.log(JSON.stringify(status, null, 2));\n    return;\n  }\n  out.log(`calendar: ${status.provider ?? \"none\"}/${status.status} (${status.env})`);\n  out.log(`  bookable: ${status.writable ? \"yes\" : status.connected ? \"no — reconnect to grant booking scopes\" : \"no — not connected\"}`);\n  if (status.bookingCalendarId) out.log(`  booking calendar: ${status.bookingCalendarId}`);\n  out.log(`  availability calendars: ${status.calendars.length ? status.calendars.join(\", \") : \"none\"}`);\n  if (status.bookingPageUrl !== undefined) out.log(`  booking page: ${status.bookingPageUrl ?? \"not configured\"}`);\n  if (status.error?.code || status.error?.message) out.log(`  error: ${status.error.code ?? \"error\"}${status.error.message ? ` — ${status.error.message}` : \"\"}`);\n}\n","/** Stable, machine-readable division of work between the CLI, coding agent,\n * human operator, and Studio. Printed by `odla-ai capabilities --json`. */\nexport const CAPABILITIES = {\n  cli: [\n    \"start an email-bound device request without accepting a password or user session token\",\n    \"register the app and enable configured services per environment\",\n    \"issue, persist, and explicitly rotate configured service credentials\",\n    \"add or remove app co-owners, each of whom self-provisions their own credentials for the shared db without any secret handoff\",\n    \"write local Worker values and push deployed Worker secrets through Wrangler stdin\",\n    \"store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var\",\n    \"compose declared app-capability schema/rules, create guarded seeds when absent, and configure platform AI, auth, and deployment links\",\n    \"apply Google Calendar booking config, then drive state-bound consent, status, discovery, and disconnect flows (bookings run live through the platform proxy)\",\n    \"validate integration contracts offline and smoke-test a provisioned db environment plus anonymous capability routes\",\n    \"save and explicitly select non-secret named operator contexts with isolated credential caches; resolve and explain platform, app, environment, and credential provenance without authenticating; then run PM, Discussions, o11y, runbook, and identity operations outside a project checkout\",\n    \"read one versioned o11y status envelope spanning application RED, exact Worker versions and Cloudflare colos observed in traffic, current live-sync freshness/load, the protected commit-to-visible canary, collector ingest/scheduler trust, provider-owned runtime metrics, account-scoped Durable Object, D1, and R2 evidence under odla-db, and a bounded machine verdict\",\n    \"inspect durable agent wakeups as a versioned JSON envelope and explicitly requeue one dead-lettered job with a scoped environment credential\",\n    \"run app-attributed hosted security discovery and independent validation without provider keys\",\n    \"connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys\",\n    \"let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals\",\n  ],\n  agent: [\n    \"install and import the selected odla SDKs\",\n    \"wrap the Worker with withObservability and choose useful telemetry\",\n    \"install capability packages, mount their runtime routes, and make application-specific schema, rules, auth, UI, and migration decisions\",\n    \"wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers\",\n  ],\n  human: [\n    \"provide the existing odla account email, then sign in and explicitly review/approve the exact device code\",\n    \"review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow\",\n    \"consent to changes against an app's live database with --yes\",\n    \"request destructive credential rotation explicitly\",\n    \"review application semantics, security findings, releases, and merges\",\n    \"approve redacted-source disclosure before hosted security reasoning\",\n    \"approve GitHub App repository access separately from redacted-snippet disclosure\",\n  ],\n  studio: [\n    \"view application telemetry grouped by exact Worker version, reconciled live-sync load/freshness, commit-to-visible canary health, provider-owned Worker runtime metrics, and environment state\",\n    \"let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them\",\n    \"review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens\",\n    \"perform manual credential recovery — for the primary owner or any co-owner — when the CLI's local shown-once copy is unavailable\",\n    \"configure system AI purposes and view app/environment/run-attributed usage\",\n    \"connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports\",\n  ],\n} as const;\n\ntype Output = Pick<typeof console, \"log\">;\n\n/** Print the stable responsibility boundary for humans or agent tooling. */\nexport function printCapabilities(json = false, out: Output = console): void {\n  if (json) {\n    out.log(JSON.stringify(CAPABILITIES, null, 2));\n    return;\n  }\n  out.log(\"odla-ai responsibility boundary\\n\");\n  printGroup(out, \"CLI automates\", CAPABILITIES.cli);\n  printGroup(out, \"Coding agent changes source\", CAPABILITIES.agent);\n  printGroup(out, \"Human checkpoints\", CAPABILITIES.human);\n  printGroup(out, \"Studio\", CAPABILITIES.studio);\n}\n\nfunction printGroup(out: Output, heading: string, items: readonly string[]): void {\n  out.log(`${heading}:`);\n  for (const item of items) out.log(`  - ${item}`);\n  out.log(\"\");\n}\n","import { execFileSync } from \"node:child_process\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { looksSecret } from \"./redact\";\nimport { gitignoreEntry } from \"./local\";\nimport { findWranglerConfig, readWranglerConfig } from \"./wrangler\";\nimport type { AppRules } from \"./types\";\n\n/**\n * Rules lint: a literal \"true\" grants the action to every client. `view` may\n * be deliberate for public content — allowlist those namespaces via\n * `db.publicRead`; writes are never safely \"true\".\n */\nexport function lintRules(rules: AppRules | undefined, entities: string[], publicRead: string[]): string[] {\n  const warnings: string[] = [];\n  if (!rules) return warnings;\n  for (const [ns, actions] of Object.entries(rules)) {\n    for (const [action, expr] of Object.entries(actions)) {\n      if (typeof expr !== \"string\" || expr.trim() !== \"true\") continue;\n      if (action === \"view\" && publicRead.includes(ns)) continue;\n      warnings.push(\n        action === \"view\"\n          ? `rules.${ns}.view is \"true\" — public read; add \"${ns}\" to db.publicRead if intended`\n          : `rules.${ns}.${action} is \"true\" — any client can ${action} ${ns} rows`,\n      );\n    }\n  }\n  for (const entity of entities) {\n    if (!(entity in rules)) warnings.push(`schema entity \"${entity}\" has no rules entry (all client access denied)`);\n  }\n  return warnings;\n}\n\nexport type ExecLike = (cmd: string, args: string[], cwd: string) => string;\n\nconst defaultExec: ExecLike = (cmd, args, cwd) => execFileSync(cmd, args, { cwd, encoding: \"utf8\", stdio: [\"ignore\", \"pipe\", \"ignore\"] });\n\n/** Credential files that must never be committed. Silent when git is absent. */\nexport function trackedSecretFiles(rootDir: string, exec: ExecLike = defaultExec, localPaths: string[] = []): string[] {\n  let output: string;\n  try {\n    const custom = localPaths\n      .map((path) => gitignoreEntry(rootDir, path))\n      .filter((path): path is string => !!path);\n    output = exec(\"git\", [\"ls-files\", \"--\", \".dev.vars\", \".odla\", ...custom], rootDir);\n  } catch {\n    return [];\n  }\n  return output\n    .split(/\\r?\\n/)\n    .filter(Boolean)\n    .map((path) => `${path} is tracked by git — run \"git rm --cached ${path}\" and commit; it belongs in .gitignore`);\n}\n\n/** Wrangler config sanity: the assets-dir footgun, secret-looking vars. */\nexport function wranglerWarnings(rootDir: string): string[] {\n  const configPath = findWranglerConfig(rootDir);\n  if (!configPath) return [];\n  const config = readWranglerConfig(configPath);\n  if (!config) return [];\n\n  const warnings: string[] = [];\n  const blocks: Array<{ label: string; block: Record<string, unknown> }> = [{ label: \"\", block: config }];\n  const envs = config.env;\n  if (envs && typeof envs === \"object\") {\n    for (const [name, block] of Object.entries(envs as Record<string, unknown>)) {\n      if (block && typeof block === \"object\") blocks.push({ label: `env.${name}.`, block: block as Record<string, unknown> });\n    }\n  }\n\n  for (const { label, block } of blocks) {\n    const assets = block.assets as { directory?: string } | undefined;\n    if (assets?.directory) {\n      const dir = resolve(rootDir, assets.directory);\n      if (dir === resolve(rootDir)) {\n        warnings.push(`${label}assets.directory is the project root — point it at a dedicated build dir (wrangler dev fails with \"spawn EBADF\")`);\n      } else if (existsSync(join(dir, \"node_modules\"))) {\n        warnings.push(`${label}assets.directory contains node_modules — wrangler dev's watcher will exhaust file descriptors`);\n      }\n    }\n    const vars = block.vars;\n    if (vars && typeof vars === \"object\") {\n      for (const [name, value] of Object.entries(vars as Record<string, unknown>)) {\n        if (name === \"ODLA_API_KEY\" || name === \"ODLA_O11Y_TOKEN\" || (typeof value === \"string\" && looksSecret(value))) {\n          warnings.push(`wrangler ${label}vars.${name} looks like a secret — use \"odla-ai secrets push\" / wrangler secret put, never vars`);\n        }\n      }\n    }\n  }\n\n  const pkg = readPackageJson(rootDir);\n  if (pkg && typeof pkg.scripts === \"object\" && pkg.scripts && \"deploy\" in (pkg.scripts as Record<string, unknown>)) {\n    warnings.push(`package.json has a script named \"deploy\" — CI may auto-deploy it; rename to deploy:app`);\n  }\n  return warnings;\n}\n\n/** Offline checks for the source/config work that provisioning cannot infer\n * safely. The CLI owns control-plane enablement and secret delivery; these\n * warnings keep the remaining application edits visible instead of letting a\n * successfully provisioned but uninstrumented Worker look complete. */\nexport function o11yProjectWarnings(rootDir: string): string[] {\n  const warnings: string[] = [];\n  const pkg = readPackageJson(rootDir);\n  const dependencies = pkg?.dependencies as Record<string, unknown> | undefined;\n  const devDependencies = pkg?.devDependencies as Record<string, unknown> | undefined;\n  if (!dependencies?.[\"@odla-ai/o11y\"]) {\n    warnings.push(\n      devDependencies?.[\"@odla-ai/o11y\"]\n        ? \"@odla-ai/o11y is a devDependency — move it to dependencies so the Worker can import it\"\n        : 'Worker instrumentation is missing @odla-ai/o11y — install it and wrap the handler with \"withObservability\"',\n    );\n  }\n\n  const configPath = findWranglerConfig(rootDir);\n  const config = configPath ? readWranglerConfig(configPath) : null;\n  if (!configPath || !config) {\n    warnings.push(\"cannot verify o11y Worker instrumentation — add a parseable wrangler.jsonc/json config\");\n    return warnings;\n  }\n\n  const main = typeof config.main === \"string\" ? resolve(rootDir, config.main) : null;\n  if (!main || !existsSync(main)) {\n    warnings.push(\"cannot verify o11y Worker instrumentation — wrangler main is missing or unreadable\");\n  } else {\n    let source = \"\";\n    try {\n      source = readFileSync(main, \"utf8\");\n    } catch {\n      // The warning below is intentionally the same for an unreadable source.\n    }\n    if (!/\\bwithObservability\\b/.test(source)) {\n      warnings.push(`wrangler entrypoint ${config.main as string} does not reference withObservability`);\n    }\n  }\n\n  const flags = Array.isArray(config.compatibility_flags) ? config.compatibility_flags : [];\n  if (!flags.includes(\"nodejs_compat\")) {\n    warnings.push('wrangler compatibility_flags is missing \"nodejs_compat\" required by @odla-ai/o11y');\n  }\n  return warnings;\n}\n\n/** Source-side calendar SDK check. OAuth and sync health remain platform-owned. */\nexport function calendarProjectWarnings(rootDir: string): string[] {\n  const pkg = readPackageJson(rootDir);\n  const dependencies = pkg?.dependencies as Record<string, unknown> | undefined;\n  const devDependencies = pkg?.devDependencies as Record<string, unknown> | undefined;\n  if (dependencies?.[\"@odla-ai/calendar\"]) return [];\n  return [\n    devDependencies?.[\"@odla-ai/calendar\"]\n      ? \"@odla-ai/calendar is a devDependency — move it to dependencies so trusted Worker code can import it\"\n      : \"calendar service is enabled but @odla-ai/calendar is not installed in dependencies\",\n  ];\n}\n\nfunction readPackageJson(rootDir: string): Record<string, unknown> | null {\n  try {\n    return JSON.parse(readFileSync(join(rootDir, \"package.json\"), \"utf8\")) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n","import { spawn } from \"node:child_process\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nexport interface RunResult {\n  code: number;\n  stdout: string;\n  stderr: string;\n}\n\n/** Subprocess seam: injectable in tests, `defaultRunner` in production. */\nexport type CommandRunner = (cmd: string, args: string[], opts?: { input?: string; cwd?: string }) => Promise<RunResult>;\n\nexport const defaultRunner: CommandRunner = (cmd, args, opts) =>\n  new Promise((resolvePromise, reject) => {\n    const child = spawn(cmd, args, { cwd: opts?.cwd, stdio: [\"pipe\", \"pipe\", \"pipe\"] });\n    let stdout = \"\";\n    let stderr = \"\";\n    child.stdout.on(\"data\", (chunk: Buffer) => (stdout += chunk.toString()));\n    child.stderr.on(\"data\", (chunk: Buffer) => (stderr += chunk.toString()));\n    child.on(\"error\", reject);\n    child.on(\"close\", (code) => resolvePromise({ code: code ?? 1, stdout, stderr }));\n    child.stdin.end(opts?.input ?? \"\");\n  });\n\nconst WRANGLER_CONFIG_FILES = [\"wrangler.jsonc\", \"wrangler.json\", \"wrangler.toml\"];\n\nexport function findWranglerConfig(rootDir: string): string | null {\n  for (const name of WRANGLER_CONFIG_FILES) {\n    const path = join(rootDir, name);\n    if (existsSync(path)) return path;\n  }\n  return null;\n}\n\n/** Parses wrangler.json/jsonc. Returns null for .toml (unparsed) or invalid JSON. */\nexport function readWranglerConfig(path: string): Record<string, unknown> | null {\n  if (path.endsWith(\".toml\")) return null;\n  try {\n    return JSON.parse(stripJsonComments(readFileSync(path, \"utf8\"))) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\n/** Removes // and both-slash block comments without touching string contents. */\nexport function stripJsonComments(text: string): string {\n  let result = \"\";\n  let inString = false;\n  for (let i = 0; i < text.length; i++) {\n    const ch = text[i]!;\n    if (inString) {\n      result += ch;\n      if (ch === \"\\\\\") {\n        result += text[i + 1] ?? \"\";\n        i++;\n      } else if (ch === '\"') {\n        inString = false;\n      }\n      continue;\n    }\n    if (ch === '\"') {\n      inString = true;\n      result += ch;\n      continue;\n    }\n    if (ch === \"/\" && text[i + 1] === \"/\") {\n      while (i < text.length && text[i] !== \"\\n\") i++;\n      result += \"\\n\";\n      continue;\n    }\n    if (ch === \"/\" && text[i + 1] === \"*\") {\n      i += 2;\n      while (i < text.length && !(text[i] === \"*\" && text[i + 1] === \"/\")) i++;\n      i++;\n      continue;\n    }\n    result += ch;\n  }\n  return result;\n}\n\nexport async function wranglerLoggedIn(run: CommandRunner, cwd: string): Promise<boolean> {\n  try {\n    const result = await run(\"npx\", [\"wrangler\", \"whoami\"], { cwd });\n    return result.code === 0 && !/not authenticated/i.test(`${result.stdout}${result.stderr}`);\n  } catch {\n    return false;\n  }\n}\n\n/** Pipes the value via stdin — it never appears on argv or in process listings. */\nexport function wranglerPutSecret(\n  run: CommandRunner,\n  opts: { name: string; value: string; env?: string; cwd: string },\n): Promise<RunResult> {\n  const args = [\"wrangler\", \"secret\", \"put\", opts.name, ...(opts.env ? [\"--env\", opts.env] : [])];\n  return run(\"npx\", args, { input: opts.value, cwd: opts.cwd });\n}\n","// Which runbooks apply to THIS project, derived from the integrations it already\n// declares. `doctor` is the command someone runs when they are not sure what they\n// have, which makes it the right place to say what to read — an operator should\n// not have to already know a runbook exists in order to find it.\n//\n// Read entirely from the local config: doctor is offline by contract.\n\n/** An integration descriptor that declares which runbooks bear on it. Structural\n * so this stays independent of any one capability package. */\ninterface WithRunbooks {\n  id?: string;\n  runbooks?: { role?: string; slugs?: string[]; guidance?: string };\n}\n\n/** One line to print, plus the command that fetches it. */\nexport interface RunbookPointer {\n  guidance: string;\n  commands: string[];\n}\n\n/**\n * Collect runbook guidance from the resolved integrations.\n *\n * Returns nothing when no integration declares any, so doctor stays silent\n * rather than inventing advice for a project it knows nothing about.\n */\nexport function runbookPointers(integrations: readonly unknown[] | undefined): RunbookPointer[] {\n  const pointers: RunbookPointer[] = [];\n  for (const integration of integrations ?? []) {\n    const hints = (integration as WithRunbooks)?.runbooks;\n    const slugs = hints?.slugs?.filter((s) => typeof s === \"string\" && s) ?? [];\n    if (!hints?.guidance || !slugs.length) continue;\n    pointers.push({\n      guidance: hints.guidance,\n      commands: slugs.map((slug) => `npx odla-ai runbook get ${slug}`),\n    });\n  }\n  return pointers;\n}\n\n/** Print the applicable runbooks, if any. */\nexport function printRunbooks(out: Pick<typeof console, \"log\">, pointers: RunbookPointer[]): void {\n  if (!pointers.length) return;\n  out.log(\"\");\n  out.log(\"runbooks that apply here:\");\n  for (const pointer of pointers) {\n    out.log(`  ${pointer.guidance}`);\n    // The first slug is the primary procedure; the rest are adjacent.\n    for (const command of pointer.commands) out.log(`    ${command}`);\n  }\n  out.log(\"  Not sure which? npx odla-ai runbook search \\\"<what you are trying to do>\\\"\");\n}\n","import { isDeepStrictEqual } from \"node:util\";\nimport { resolveDataExport, rulesFromSchema, serializedEntities } from \"./config\";\nimport type { AppRules, LoadedProjectConfig, OdlaIntegration } from \"./types\";\n\nexport interface ResolvedDatabaseConfig {\n  schema: unknown;\n  rules: AppRules | undefined;\n  integrations: OdlaIntegration[];\n}\n\ntype SerializedSchema = {\n  entities: Record<string, unknown>;\n  links: Record<string, unknown>;\n};\n\n/** Resolve app-authored db exports and compose every declared integration.\n * Identical pre-merged entries are accepted for migration; conflicting\n * namespaces, links, or rules fail before any network mutation. */\nexport async function resolveDatabaseConfig(\n  cfg: LoadedProjectConfig,\n  options: { validateSeeds?: boolean } = {},\n): Promise<ResolvedDatabaseConfig> {\n  const integrations = cfg.integrations ?? [];\n  if (!cfg.services.includes(\"db\")) return { schema: undefined, rules: undefined, integrations };\n\n  const authoredSchema = await resolveDataExport<unknown>(cfg, cfg.db?.schema, [\"schema\", \"SCHEMA\"]);\n  const schema = mergeSchemas(authoredSchema, integrations);\n  if (options.validateSeeds !== false) assertSeedContracts(integrations, schema);\n  const configuredRules = await resolveDataExport<AppRules>(cfg, cfg.db?.rules, [\"rules\", \"RULES\"]);\n  const explicitRules = mergeRules(configuredRules, integrations);\n  const rules = configuredRules === undefined && schema && cfg.db?.defaultRules !== false\n    ? { ...rulesFromSchema(schema), ...(explicitRules ?? {}) }\n    : explicitRules;\n  return { schema, rules, integrations };\n}\n\n/** Offline integration checks shared by doctor and tests. */\nexport function integrationWarnings(\n  integrations: readonly OdlaIntegration[],\n  schema: unknown,\n  rules: AppRules | undefined,\n): string[] {\n  const warnings: string[] = [];\n  const entities = new Set(serializedEntities(schema));\n  for (const integration of integrations) {\n    const namespaces = Object.keys(integration.schema?.entities ?? {});\n    for (const ns of namespaces) {\n      if (!entities.has(ns)) warnings.push(`integration \"${integration.id}\" schema namespace \"${ns}\" is missing`);\n      const rule = rules?.[ns];\n      if (!rule) {\n        warnings.push(`integration \"${integration.id}\" has no rules for \"${ns}\"`);\n        continue;\n      }\n      for (const action of [\"view\", \"create\", \"update\", \"delete\"] as const) {\n        if (rule[action] === undefined) warnings.push(`integration \"${integration.id}\" rule \"${ns}.${action}\" is missing`);\n      }\n    }\n    for (const seed of integration.seeds ?? []) {\n      if (!entities.has(seed.ns)) {\n        warnings.push(`integration \"${integration.id}\" seed \"${seed.id}\" targets unknown namespace \"${seed.ns}\"`);\n      } else if (!isUniqueAttr(schema, seed.ns, seed.key.attr)) {\n        warnings.push(`integration \"${integration.id}\" seed \"${seed.id}\" key \"${seed.ns}.${seed.key.attr}\" is not declared unique`);\n      }\n    }\n  }\n  return warnings;\n}\n\nfunction mergeSchemas(base: unknown, integrations: readonly OdlaIntegration[]): unknown {\n  const fragments = integrations.filter((integration) => integration.schema);\n  if (fragments.length === 0) return base;\n  const merged = normalizeSchema(base);\n  for (const integration of fragments) {\n    const fragment = normalizeSchema(integration.schema);\n    mergeMap(merged.entities, fragment.entities, `integration \"${integration.id}\" schema namespace`);\n    mergeMap(merged.links, fragment.links, `integration \"${integration.id}\" schema link`);\n  }\n  return merged;\n}\n\nfunction mergeRules(base: AppRules | undefined, integrations: readonly OdlaIntegration[]): AppRules | undefined {\n  const fragments = integrations.filter((integration) => integration.rules);\n  if (fragments.length === 0) return base;\n  const merged: AppRules = { ...(base ?? {}) };\n  for (const integration of fragments) {\n    mergeMap(merged, integration.rules ?? {}, `integration \"${integration.id}\" rule namespace`);\n  }\n  return merged;\n}\n\nfunction assertSeedContracts(integrations: readonly OdlaIntegration[], schema: unknown): void {\n  const entities = new Set(serializedEntities(schema));\n  for (const integration of integrations) {\n    for (const seed of integration.seeds ?? []) {\n      if (!entities.has(seed.ns)) {\n        throw new Error(`integration \"${integration.id}\" seed \"${seed.id}\" targets unknown namespace \"${seed.ns}\"`);\n      }\n      if (!isUniqueAttr(schema, seed.ns, seed.key.attr)) {\n        throw new Error(`integration \"${integration.id}\" seed \"${seed.id}\" key \"${seed.ns}.${seed.key.attr}\" must be declared unique`);\n      }\n    }\n  }\n}\n\nfunction isUniqueAttr(schema: unknown, ns: string, attr: string): boolean {\n  if (!isRecord(schema) || !isRecord(schema.entities)) return false;\n  const entity = schema.entities[ns];\n  if (!isRecord(entity) || !isRecord(entity.attrs)) return false;\n  const definition = entity.attrs[attr];\n  return isRecord(definition) && definition.unique === true;\n}\n\nfunction normalizeSchema(value: unknown): SerializedSchema {\n  if (value === undefined || value === null) return { entities: {}, links: {} };\n  if (!isRecord(value) || !isRecord(value.entities)) {\n    throw new Error(\"db schema must be a serialized schema object with an entities map\");\n  }\n  if (value.links !== undefined && !isRecord(value.links)) throw new Error(\"db schema links must be an object\");\n  return {\n    entities: { ...value.entities },\n    links: { ...(value.links ?? {}) },\n  };\n}\n\nfunction mergeMap(target: Record<string, unknown>, fragment: Record<string, unknown>, label: string): void {\n  for (const [name, value] of Object.entries(fragment)) {\n    if (Object.hasOwn(target, name) && !isDeepStrictEqual(target[name], value)) {\n      throw new Error(`${label} \"${name}\" conflicts with an existing definition`);\n    }\n    target[name] = value;\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n","import { buildPlan, calendarBookingPageUrl, calendarServiceConfig, loadProjectConfig, serializedEntities } from \"./config\";\nimport { calendarProjectWarnings, lintRules, o11yProjectWarnings, trackedSecretFiles, wranglerWarnings } from \"./doctor-checks\";\nimport { printRunbooks, runbookPointers } from \"./doctor-runbooks\";\nimport { integrationWarnings, resolveDatabaseConfig } from \"./integrations\";\nimport { readCredentials } from \"./local\";\n\nexport interface DoctorOptions {\n  configPath: string;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/**\n * Validate and summarize an odla project config entirely offline — no network\n * calls and no file writes. Loads `configPath`, builds the provision plan, and\n * resolves and collision-checks app plus integration schema/rules (synthesizing\n * deny-all rules when `db.rules` is omitted and `db.defaultRules` isn't\n * `false`), then prints the app, envs, services, integrations, schema entity\n * count, rules namespace count, and AI provider.\n *\n * It then collects warnings for the mistakes provision can't fix silently: a\n * schema with no entities, a rules namespace with no matching entity, an\n * integration with incomplete rules or a seed targeting an unknown namespace, the `ai`\n * service enabled without an `ai.provider`, `auth.clerk` entries that reference\n * an unset env var (`$FOO`), an `ai.keyEnv` that isn't set (provider key upload\n * will be skipped), and — when `o11y` is enabled — any env whose local\n * credentials lack an ingest token. It also folds in the shared rule linter,\n * git-tracked secret-shaped files, and wrangler config warnings. Prints `ok`\n * when clean, otherwise the warning list. Purely advisory: never throws on\n * warnings and never mutates anything.\n *\n * @param options.configPath Path to the `odla.config.mjs` to inspect.\n * @param options.stdout Optional console-like sink (defaults to `console`).\n */\nexport async function doctor(options: DoctorOptions): Promise<void> {\n  const out = options.stdout ?? console;\n  const cfg = await loadProjectConfig(options.configPath);\n  const plan = buildPlan(cfg);\n  const database = await resolveDatabaseConfig(cfg, { validateSeeds: false });\n  const { schema, rules } = database;\n  const entities = serializedEntities(schema);\n\n  out.log(`config: ${cfg.configPath}`);\n  out.log(`app:    ${plan.appName} (${plan.appId})`);\n  out.log(`envs:   ${plan.envs.join(\", \")}`);\n  out.log(`svc:    ${plan.services.join(\", \")}`);\n  out.log(`integrations: ${plan.integrations.length ? plan.integrations.join(\", \") : \"none\"}`);\n  out.log(`schema: ${schema ? `${entities.length} entities` : \"none\"}`);\n  out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : \"none\"}`);\n  out.log(`ai:     ${cfg.services.includes(\"ai\") ? (cfg.ai?.provider ?? \"not configured\") : \"not enabled\"}`);\n  if (cfg.services.includes(\"calendar\")) {\n    const calendar = cfg.envs\n      .map((env) => {\n        const resolved = calendarServiceConfig(cfg, env);\n        return `${env}:${resolved.bookingCalendarId}+${resolved.availabilityCalendars.length}`;\n      })\n      .join(\", \");\n    out.log(`calendar: google/booking (${calendar})`);\n    const pages = cfg.envs.map((env) => `${env}:${calendarBookingPageUrl(cfg, env) ?? \"none\"}`).join(\", \");\n    out.log(`booking pages: ${pages}`);\n  } else {\n    out.log(\"calendar: not enabled\");\n  }\n\n  printRunbooks(out, runbookPointers(database.integrations));\n\n  const warnings: string[] = [];\n  if (schema && entities.length === 0) warnings.push(\"schema has no entities\");\n  if (rules) {\n    for (const ns of Object.keys(rules)) {\n      if (entities.length > 0 && !entities.includes(ns)) warnings.push(`rules include \"${ns}\" but schema has no matching entity`);\n    }\n  }\n  warnings.push(...integrationWarnings(database.integrations, schema, rules));\n  if (cfg.services.includes(\"ai\") && !cfg.ai?.provider) warnings.push(\"ai service is enabled but ai.provider is not set\");\n  if (cfg.auth?.clerk) {\n    for (const [env, value] of Object.entries(cfg.auth.clerk)) {\n      if (typeof value === \"string\" && value.startsWith(\"$\") && !process.env[value.slice(1)]) {\n        warnings.push(`auth.clerk.${env} references unset env var ${value}`);\n      }\n    }\n  }\n  if (cfg.services.includes(\"ai\") && cfg.ai?.keyEnv && !process.env[cfg.ai.keyEnv]) {\n    warnings.push(`${cfg.ai.keyEnv} is not set; provision will skip provider key storage`);\n  }\n  if (cfg.services.includes(\"o11y\")) {\n    // o11y enabled but no ingest token = telemetry silently rejected. Provision mints one.\n    const credentials = readCredentials(cfg.local.credentialsFile);\n    for (const env of cfg.envs) {\n      if (!credentials?.envs[env]?.o11yToken) {\n        warnings.push(`o11y is enabled but env \"${env}\" has no ingest token — run \"odla-ai provision\" to mint one`);\n      }\n    }\n    warnings.push(...o11yProjectWarnings(cfg.rootDir));\n  }\n  if (cfg.services.includes(\"calendar\")) warnings.push(...calendarProjectWarnings(cfg.rootDir));\n  else if (cfg.calendar) warnings.push('calendar config is present but \"calendar\" is not in services');\n  warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));\n  warnings.push(...trackedSecretFiles(cfg.rootDir, undefined, [\n    cfg.local.tokenFile,\n    cfg.local.credentialsFile,\n    cfg.local.devVarsFile,\n  ]));\n  warnings.push(...wranglerWarnings(cfg.rootDir));\n\n  if (warnings.length) {\n    out.log(\"\");\n    out.log(\"warnings:\");\n    for (const warning of warnings) out.log(`  - ${warning}`);\n  } else {\n    out.log(\"ok\");\n  }\n}\n","import { existsSync, mkdirSync, writeFileSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { ensureGitignore } from \"./local\";\n\nexport interface InitOptions {\n  rootDir?: string;\n  configPath?: string;\n  appId: string;\n  name: string;\n  envs?: string[];\n  services?: string[];\n  aiProvider?: string;\n  force?: boolean;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/**\n * Scaffold a new odla project into `rootDir` (default: cwd). Writes an\n * `odla.config.mjs` (default name, overridable via `configPath`) plus starter\n * `src/odla/schema.mjs` (a single `notes` entity) and `src/odla/rules.mjs`\n * (deny-all), and creates the `src/odla` and `.odla` directories. Also runs\n * `ensureGitignore` so the local token/credentials paths are ignored.\n *\n * Fully local and synchronous — no network calls. The config file is only\n * written when it doesn't already exist unless `force` is set (otherwise it\n * throws); the schema/rules files are written only when missing (never\n * overwritten, even with `force`). `appId` must match `^[a-z0-9][a-z0-9-]*$` or\n * it throws. Defaults: `envs` → `[\"dev\"]`, `services` → `[\"db\",\"ai\"]`,\n * `aiProvider` → `\"anthropic\"` (which also picks the `keyEnv`, e.g.\n * `ANTHROPIC_API_KEY`/`OPENAI_API_KEY`/`GOOGLE_API_KEY`).\n *\n * @param options.appId Slug for the app (lowercase alphanumerics and hyphens).\n * @param options.name Human-readable app name embedded in the config.\n * @param options.rootDir Project root (defaults to `process.cwd()`).\n * @param options.configPath Config filename relative to root (default `odla.config.mjs`).\n * @param options.envs Environment names (default `[\"dev\"]`; production is an explicit opt-in).\n * @param options.services Enabled services (default `[\"db\",\"ai\"]`).\n * @param options.aiProvider AI provider slug (default `\"anthropic\"`).\n * @param options.force Overwrite an existing config file instead of throwing.\n * @param options.stdout Optional console-like sink (defaults to `console`).\n */\nexport function initProject(options: InitOptions): void {\n  const out = options.stdout ?? console;\n  const rootDir = resolve(options.rootDir ?? process.cwd());\n  const configPath = resolve(rootDir, options.configPath ?? \"odla.config.mjs\");\n  if (existsSync(configPath) && !options.force) {\n    throw new Error(`${configPath} already exists. Pass --force to overwrite.`);\n  }\n  if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {\n    throw new Error(\"--app-id must be lowercase letters, numbers, and hyphens\");\n  }\n  // Production is an explicit opt-in. This prevents an unattended `init` +\n  // `provision` flow from mutating the live environment by default.\n  const envs = options.envs?.length ? options.envs : [\"dev\"];\n  const services = options.services?.length ? options.services : [\"db\", \"ai\"];\n  if (services.includes(\"calendar\") && !services.includes(\"db\")) throw new Error(\"--services calendar requires db\");\n  const aiProvider = options.aiProvider ?? \"anthropic\";\n\n  mkdirSync(dirname(configPath), { recursive: true });\n  mkdirSync(resolve(rootDir, \"src/odla\"), { recursive: true });\n  mkdirSync(resolve(rootDir, \".odla\"), { recursive: true });\n\n  writeFileSync(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));\n  writeIfMissing(resolve(rootDir, \"src/odla/schema.mjs\"), schemaTemplate());\n  writeIfMissing(resolve(rootDir, \"src/odla/rules.mjs\"), rulesTemplate());\n  ensureGitignore(rootDir);\n\n  out.log(`created ${relativeDisplay(configPath, rootDir)}`);\n  out.log(\"created src/odla/schema.mjs and src/odla/rules.mjs\");\n  out.log(\"updated .gitignore for local odla credentials\");\n}\n\nfunction writeIfMissing(path: string, text: string): void {\n  if (existsSync(path)) return;\n  writeFileSync(path, text);\n}\n\nfunction configTemplate(input: { appId: string; name: string; envs: string[]; services: string[]; aiProvider: string }): string {\n  const calendar = input.services.includes(\"calendar\")\n    ? `  calendar: {\n    google: {\n      // Calendars consulted for availability; bookings land on bookingCalendar\n      // (defaults to the first availability calendar). Google consent happens\n      // in the browser during provision; bookings write live through odla.ai.\n      availabilityCalendars: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, [\"primary\"]])))},\n      bookingPageUrl: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, null])))},\n    },\n  },\n`\n    : \"\";\n  return `export default {\n  platformUrl: process.env.ODLA_PLATFORM_URL ?? \"https://odla.ai\",\n  dbEndpoint: process.env.ODLA_ENDPOINT ?? process.env.ODLA_DB_ENDPOINT ?? \"https://db.odla.ai\",\n  app: {\n    id: \"${input.appId}\",\n    name: \"${input.name.replace(/\"/g, '\\\\\"')}\",\n  },\n  envs: ${JSON.stringify(input.envs)},\n  services: ${JSON.stringify(input.services)},\n  // App capabilities are npm modules, not hosted services. Import their\n  // data-only descriptor and add it here (for example createCrmIntegration()).\n  integrations: [],\n  db: {\n    schema: \"./src/odla/schema.mjs\",\n    rules: \"./src/odla/rules.mjs\",\n    // When rules is omitted, the CLI generates deny-all rules from schema.\n    defaultRules: \"deny\",\n  },\n  ai: {\n    provider: process.env.ODLA_AI_PROVIDER ?? \"${input.aiProvider}\",\n    // Optional: set this env var while running provision to store the provider\n    // key in the platform vault for each tenant.\n    keyEnv: \"${defaultKeyEnv(input.aiProvider)}\",\n  },\n${calendar}\n  auth: {\n    clerk: {\n      // dev: \"$CLERK_PUBLISHABLE_KEY\",\n      // prod: \"$CLERK_PUBLISHABLE_KEY\",\n    },\n  },\n  // Add \"o11y\" to services to enable observability; provision then mints the\n  // ingest token and scaffolds the ODLA_O11Y_* vars into .dev.vars.\n  // o11y: {\n  //   service: \"${input.appId}\",   // defaults to the app id\n  //   // endpoint: \"https://o11y.odla.ai\",\n  // },\n  links: {\n    // dev: \"https://dev.example.com\",\n    // prod: \"https://example.com\",\n  },\n  local: {\n    tokenFile: \".odla/dev-token.json\",\n    credentialsFile: \".odla/credentials.local.json\",\n    devVarsFile: \".dev.vars\",\n  },\n};\n`;\n}\n\nfunction schemaTemplate(): string {\n  return `// Replace this starter schema with your app's odla-db schema.\n// Knowledge-graph projects can export @odla-ai/kg's toSerializedSchema(ontology).\nexport const schema = {\n  entities: {\n    notes: {\n      attrs: {\n        id: { type: \"string\", unique: true, indexed: true, optional: false },\n        text: { type: \"string\", unique: false, indexed: false, optional: false },\n        createdAt: { type: \"number\", unique: false, indexed: true, optional: false },\n      },\n    },\n  },\n  links: {},\n};\n`;\n}\n\nfunction rulesTemplate(): string {\n  return `// odla-db is default-deny. The starter keeps runtime data backend-only.\nexport const rules = {\n  notes: {\n    view: \"false\",\n    create: \"false\",\n    update: \"false\",\n    delete: \"false\",\n  },\n};\n`;\n}\n\nfunction defaultKeyEnv(provider: string): string {\n  if (provider === \"openai\") return \"OPENAI_API_KEY\";\n  if (provider === \"google\") return \"GOOGLE_API_KEY\";\n  return \"ANTHROPIC_API_KEY\";\n}\n\nfunction relativeDisplay(path: string, rootDir: string): string {\n  return path.startsWith(rootDir) ? path.slice(rootDir.length + 1) : path;\n}\n","import { loadProjectConfig } from \"./config\";\nimport { displayPath, readCredentials } from \"./local\";\nimport { redactSecrets } from \"./redact\";\nimport type { LoadedProjectConfig } from \"./types\";\nimport { defaultRunner, findWranglerConfig, wranglerLoggedIn, wranglerPutSecret } from \"./wrangler\";\nimport type { CommandRunner } from \"./wrangler\";\n\n/** Moves locally stored configured service credentials to one Wrangler environment over stdin. */\nexport interface SecretsPushOptions {\n  configPath: string;\n  env: string;\n  dryRun?: boolean;\n  /** Required to push to a prod-named env; the visible consent token in agent transcripts. */\n  yes?: boolean;\n  runner?: CommandRunner;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\nexport interface SecretsPreflightOptions {\n  configPath: string;\n  runner?: CommandRunner;\n}\n\nconst PROD_ENV_NAMES = new Set([\"prod\", \"production\"]);\n\n/**\n * Moves the env's configured db and/or o11y credentials from the private local\n * credentials file into the Worker, piping values over stdin so they never\n * appear on argv, in output, or in the conversation transcript.\n */\nexport async function secretsPush(options: SecretsPushOptions): Promise<void> {\n  await secretsPushImpl(options, true);\n}\n\n/** @internal Push after the caller has completed `preflightSecretsPush`. */\nexport async function secretsPushAfterPreflight(options: SecretsPushOptions): Promise<void> {\n  await secretsPushImpl(options, false);\n}\n\nasync function secretsPushImpl(options: SecretsPushOptions, preflight: boolean): Promise<void> {\n  const out = options.stdout ?? console;\n  const cfg = await loadProjectConfig(options.configPath);\n  const env = options.env;\n\n  if (!cfg.envs.includes(env)) {\n    throw new Error(`env \"${env}\" is not in config envs (${cfg.envs.join(\", \")})`);\n  }\n  if (PROD_ENV_NAMES.has(env) && !options.yes) {\n    throw new Error(`refusing to push a secret to \"${env}\" without --yes`);\n  }\n\n  const credentialsPath = displayPath(cfg.local.credentialsFile, cfg.rootDir);\n  const credentials = readCredentials(cfg.local.credentialsFile);\n  if (!credentials) throw new Error(`no credentials at ${credentialsPath} — run \"odla-ai provision\" first`);\n  if (credentials.appId !== cfg.app.id) {\n    throw new Error(`credentials at ${credentialsPath} are for \"${credentials.appId}\", not \"${cfg.app.id}\"`);\n  }\n  const entry = credentials.envs[env];\n  if (!entry) throw new Error(`no credentials for env \"${env}\" in ${credentialsPath} — run \"odla-ai provision\" first`);\n\n  const secrets: Array<{ name: string; value: string }> = [];\n  if (cfg.services.includes(\"o11y\")) {\n    if (!entry.o11yToken) throw new Error(`no o11y token for env \"${env}\" in ${credentialsPath} — run \"odla-ai provision\" first`);\n    secrets.push({ name: \"ODLA_O11Y_TOKEN\", value: entry.o11yToken });\n  }\n  if (cfg.services.includes(\"db\")) {\n    if (!entry.dbKey) throw new Error(`no db key for env \"${env}\" in ${credentialsPath} — run \"odla-ai provision\" first`);\n    secrets.push({ name: \"ODLA_API_KEY\", value: entry.dbKey });\n  }\n  if (secrets.length === 0) {\n    out.log(`${env}: no configured Worker secrets to push`);\n    return;\n  }\n\n  // Convention from the reference apps: the top-level wrangler config is prod;\n  // every other env is a named `env.<name>` block.\n  const wranglerEnv = PROD_ENV_NAMES.has(env) ? undefined : env;\n  const target = wranglerEnv ? `wrangler env \"${wranglerEnv}\"` : \"the top-level (prod) wrangler env\";\n\n  if (options.dryRun) {\n    assertWranglerConfig(cfg);\n    for (const s of secrets) out.log(`dry run: would push ${s.name} (${redactSecrets(s.value)}) to ${target}`);\n    return;\n  }\n\n  const run = options.runner ?? defaultRunner;\n  if (preflight) await preflightLoadedConfig(cfg, run);\n\n  for (const s of secrets) {\n    const result = await wranglerPutSecret(run, { name: s.name, value: s.value, env: wranglerEnv, cwd: cfg.rootDir });\n    if (result.code !== 0) {\n      throw new Error(`wrangler secret put ${s.name} failed (exit ${result.code}): ${redactSecrets(`${result.stderr || result.stdout}`.trim())}`);\n    }\n    out.log(`${s.name} pushed to ${target} (value read from ${credentialsPath}, never echoed)`);\n  }\n}\n\n/** Check Wrangler config and login before provisioning issues or rotates secrets. */\nexport async function preflightSecretsPush(options: SecretsPreflightOptions): Promise<void> {\n  const cfg = await loadProjectConfig(options.configPath);\n  if (!cfg.services.some((service) => service === \"db\" || service === \"o11y\")) return;\n  await preflightLoadedConfig(cfg, options.runner ?? defaultRunner);\n}\n\nasync function preflightLoadedConfig(cfg: LoadedProjectConfig, run: CommandRunner): Promise<void> {\n  assertWranglerConfig(cfg);\n  if (!(await wranglerLoggedIn(run, cfg.rootDir))) {\n    throw new Error(`wrangler is not logged in — run \"wrangler login\" (a browser step for the human)`);\n  }\n}\n\nfunction assertWranglerConfig(cfg: LoadedProjectConfig): void {\n  if (!findWranglerConfig(cfg.rootDir)) {\n    throw new Error(`no wrangler config found in ${cfg.rootDir} (wrangler.jsonc, wrangler.json, or wrangler.toml)`);\n  }\n}\n","import { putSecret } from \"@odla-ai/ai\";\nimport { tenantIdFor } from \"@odla-ai/apps\";\nimport { loadProjectConfig } from \"./config\";\nimport { redactSecrets } from \"./redact\";\nimport { secretInputValue } from \"./secret-input\";\nimport { getDeveloperToken } from \"./token\";\nimport type { LoadedProjectConfig } from \"./types\";\n\n/**\n * Inputs for one write-only tenant-vault transfer (`secrets set` /\n * `secrets set-clerk-key`). Values may come only from a named environment\n * variable or stdin, so a producer command can be piped straight into the\n * vault without the secret ever being displayed or stored on disk.\n */\nexport interface SecretsSetOptions {\n  configPath: string;\n  env: string;\n  /** Vault secret name (`secrets set` only; `$`-prefixed names are reserved). */\n  name?: string;\n  fromEnv?: string;\n  stdin?: boolean;\n  /** Explicit consent for a prod-named env (and for sk_live_ into a non-prod env). */\n  yes?: boolean;\n  /** Developer token override; defaults to $ODLA_DEV_TOKEN, the cached token, or a device handshake. */\n  token?: string;\n  /** Existing odla account email used only when a fresh handshake is required. */\n  email?: string;\n  open?: boolean;\n  openApprovalUrl?: (url: string) => Promise<void>;\n  fetch?: typeof fetch;\n  readStdin?: () => Promise<string>;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\nconst PROD_ENV_NAMES = new Set([\"prod\", \"production\"]);\n\n/**\n * Store one named secret in the env's tenant vault (the same write-only slot\n * Studio's Secrets panel fills), e.g. `clerk_webhook_secret` for synced auth.\n * The value is encrypted at rest and can be read back only by that tenant's\n * app API key — never by this CLI, Studio, or the developer token.\n */\nexport async function secretsSet(options: SecretsSetOptions): Promise<void> {\n  const name = (options.name ?? \"\").trim();\n  if (!name) throw new Error('secret name is required, e.g. \"odla-ai secrets set clerk_webhook_secret --env dev --stdin\"');\n  if (name.startsWith(\"$\")) {\n    throw new Error('\"$\"-prefixed vault names are platform-reserved; for the Clerk secret key use \"odla-ai secrets set-clerk-key\"');\n  }\n  const { cfg, tenantId, value, doFetch, out } = await resolveVaultWrite(options);\n  const token = await getDeveloperToken(cfg, options, doFetch, out);\n  try {\n    await putSecret({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value);\n  } catch (err) {\n    throw new Error(scrubValue(err instanceof Error ? err.message : String(err), value));\n  }\n  out.log(`${name} stored in the ${tenantId} vault (write-only; the value was never echoed and cannot be read back here)`);\n}\n\n/**\n * Store the app's Clerk secret key under the reserved `$clerk_secret` slot so\n * odla-db can resolve the app's users (invites, member lookups). Reserved\n * secrets are never readable by app keys; the dedicated endpoint is the only\n * way to set one. Guards against instance/env mismatches: an sk_test_ key\n * never belongs in a prod-named env, and an sk_live_ key entering a non-prod\n * env requires `--yes` (live users would sync into a non-prod tenant).\n */\nexport async function secretsSetClerkKey(options: SecretsSetOptions): Promise<void> {\n  const { cfg, tenantId, value, doFetch, out } = await resolveVaultWrite(options);\n  if (!value.startsWith(\"sk_\")) throw new Error(\"the Clerk secret key must start with sk_ (sk_test_… or sk_live_…)\");\n  if (value.startsWith(\"sk_test_\") && PROD_ENV_NAMES.has(options.env)) {\n    throw new Error(`refusing to store an sk_test_ Clerk key for \"${options.env}\" — use the production instance's sk_live_ key`);\n  }\n  if (value.startsWith(\"sk_live_\") && !PROD_ENV_NAMES.has(options.env) && !options.yes) {\n    throw new Error(`refusing to store an sk_live_ Clerk key for \"${options.env}\" without --yes (live users would sync into a non-prod tenant)`);\n  }\n  const token = await getDeveloperToken(cfg, options, doFetch, out);\n  const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/clerk-secret`, {\n    method: \"POST\",\n    headers: { authorization: `Bearer ${token}`, \"content-type\": \"application/json\" },\n    body: JSON.stringify({ value }),\n  });\n  if (!res.ok) {\n    const text = scrubValue((await res.text().catch(() => \"\")).slice(0, 300), value);\n    throw new Error(`store Clerk secret key failed (${res.status}): ${text || \"request failed\"}`);\n  }\n  out.log(`Clerk secret key stored for ${tenantId} ($clerk_secret, reserved + write-only; the value was never echoed)`);\n}\n\n/** No error text may carry the transferred value, even when a misbehaving\n * endpoint echoes it back in a shape the pattern redactor doesn't know. */\nfunction scrubValue(text: string, value: string): string {\n  return redactSecrets(text).split(value).join(\"[value redacted]\");\n}\n\ninterface VaultWrite {\n  cfg: LoadedProjectConfig;\n  tenantId: string;\n  value: string;\n  doFetch: typeof fetch;\n  out: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/** Shared preamble: config, env + prod consent, value ingestion. Every value\n * check runs before the caller acquires a token, so a bad invocation fails\n * fast instead of sending the user through a device handshake first. */\nasync function resolveVaultWrite(options: SecretsSetOptions): Promise<VaultWrite> {\n  const out = options.stdout ?? console;\n  const doFetch = options.fetch ?? fetch;\n  const cfg = await loadProjectConfig(options.configPath);\n  if (!cfg.envs.includes(options.env)) {\n    throw new Error(`env \"${options.env}\" is not in config envs (${cfg.envs.join(\", \")})`);\n  }\n  if (PROD_ENV_NAMES.has(options.env) && !options.yes) {\n    throw new Error(`refusing to store a secret for \"${options.env}\" without --yes`);\n  }\n  const value = await secretInputValue(options, \"secret\");\n  return { cfg, tenantId: tenantIdFor(cfg.app.id, options.env), value, doFetch, out };\n}\n","import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, isAbsolute, join, relative, resolve, sep } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { claudeAdapter, CURSOR_RULE, PROJECT_INSTRUCTIONS } from \"./skill-adapters\";\n\n/** Agent harnesses with a first-class local adapter. */\nexport const AGENT_HARNESSES = [\"claude\", \"codex\", \"cursor\", \"copilot\", \"gemini\", \"agents\"] as const;\n\n/** A supported coding-agent harness. `agents` is the portable `AGENTS.md` adapter. */\nexport type AgentHarness = (typeof AGENT_HARNESSES)[number];\n\n/** A harness name accepted by setup; `all` expands to every project-local adapter. */\nexport type AgentHarnessSelector = AgentHarness | \"all\";\n\n/** Controls project-local or global installation of the bundled agent runbooks. */\nexport interface SkillInstallOptions {\n  /** Project directory receiving the shared runbooks and harness adapters. Defaults to cwd. */\n  dir?: string;\n  /** Install user-wide Claude and/or Codex skills instead of project adapters. */\n  global?: boolean;\n  /** Harnesses to install. The programmatic compatibility default is `claude`; the CLI passes `all`. */\n  harnesses?: AgentHarnessSelector[];\n  /** Overwrite locally modified odla-managed files or managed instruction sections. */\n  force?: boolean;\n  /** Test/embedding override for the home directory. */\n  homeDir?: string;\n  /** Test/embedding override for `$CODEX_HOME`. */\n  codexHomeDir?: string;\n  /** Test/embedding override for the bundled skills directory. */\n  sourceDir?: string;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/** One harness adapter and the directories or files through which it discovers odla. */\nexport interface HarnessInstallResult {\n  harness: AgentHarness;\n  targets: string[];\n}\n\n/** Files written or left unchanged by an idempotent agent-runbook installation. */\nexport interface SkillInstallResult {\n  /** Primary native skill directory, retained for compatibility with earlier callers. */\n  targetDir: string;\n  /** Files changed directly under `targetDir`, relative to that directory. */\n  written: string[];\n  /** Files already current directly under `targetDir`, relative to that directory. */\n  unchanged: string[];\n  /** Absolute paths of every changed shared-runbook or adapter file. */\n  writtenPaths: string[];\n  /** Absolute paths of every already-current shared-runbook or adapter file. */\n  unchangedPaths: string[];\n  harnesses: HarnessInstallResult[];\n}\n\ninterface PlannedFile {\n  target: string;\n  content: string;\n  boundary: string;\n  managedMerge?: boolean;\n}\n\n/**\n * Installs one shared offline runbook tree plus thin native adapters for the\n * selected coding-agent harnesses. Project installs use `.agents/skills/` as\n * the canonical bundle; Claude Code, Cursor, Copilot, Gemini, and generic\n * `AGENTS.md` adapters point to it. Global installs support the native Claude\n * and Codex skill roots only.\n *\n * Installation is idempotent and planned before any write: an odla-managed\n * file changed by the user aborts the whole operation unless `force` is set.\n * Existing `AGENTS.md`, `GEMINI.md`, and Copilot instructions are preserved;\n * only the bounded odla-managed section is appended or replaced.\n */\nexport function installSkill(options: SkillInstallOptions = {}): SkillInstallResult {\n  const out = options.stdout ?? console;\n  const sourceDir = options.sourceDir ?? fileURLToPath(new URL(\"../skills\", import.meta.url));\n  const files = listFiles(sourceDir);\n  if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);\n\n  const harnesses = normalizeHarnesses(options.harnesses, options.global === true);\n  const root = resolve(options.dir ?? process.cwd());\n  const home = resolve(options.homeDir ?? homedir());\n  const plans = new Map<string, PlannedFile>();\n  const targets = new Map<AgentHarness, Set<string>>();\n\n  const rememberTarget = (harness: AgentHarness, target: string): void => {\n    const current = targets.get(harness) ?? new Set<string>();\n    current.add(target);\n    targets.set(harness, current);\n  };\n  const plan = (target: string, content: string, managedMerge = false, boundary = root): void => {\n    const existing = plans.get(target);\n    if (existing && existing.content !== content) throw new Error(`internal agent setup conflict for ${target}`);\n    plans.set(target, { target, content, boundary, managedMerge });\n  };\n  const planSkillTree = (targetDir: string, boundary = root): void => {\n    for (const rel of files) plan(join(targetDir, rel), readFileSync(join(sourceDir, rel), \"utf8\"), false, boundary);\n  };\n\n  let targetDir: string;\n  if (options.global) {\n    const claudeRoot = join(home, \".claude\", \"skills\");\n    const codexRoot = resolve(options.codexHomeDir ?? process.env.CODEX_HOME ?? join(home, \".codex\"), \"skills\");\n    targetDir = harnesses[0] === \"codex\" ? codexRoot : claudeRoot;\n    for (const harness of harnesses) {\n      const skillRoot = harness === \"claude\" ? claudeRoot : codexRoot;\n      planSkillTree(skillRoot, harness === \"claude\" ? home : dirname(dirname(codexRoot)));\n      rememberTarget(harness, skillRoot);\n    }\n  } else {\n    const sharedRoot = join(root, \".agents\", \"skills\");\n    planSkillTree(sharedRoot);\n\n    const claudeRoot = join(root, \".claude\", \"skills\");\n    targetDir = harnesses.includes(\"claude\") ? claudeRoot : sharedRoot;\n    for (const harness of harnesses) rememberTarget(harness, sharedRoot);\n\n    if (harnesses.includes(\"claude\")) {\n      for (const skill of skillNames(files)) {\n        const canonical = readFileSync(join(sourceDir, skill, \"SKILL.md\"), \"utf8\");\n        plan(join(claudeRoot, skill, \"SKILL.md\"), claudeAdapter(skill, canonical));\n      }\n      rememberTarget(\"claude\", claudeRoot);\n    }\n    if (harnesses.includes(\"cursor\")) {\n      const cursorRule = join(root, \".cursor\", \"rules\", \"odla.mdc\");\n      plan(cursorRule, CURSOR_RULE);\n      rememberTarget(\"cursor\", cursorRule);\n    }\n    if (harnesses.includes(\"agents\")) {\n      const agentsFile = join(root, \"AGENTS.md\");\n      plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);\n      rememberTarget(\"agents\", agentsFile);\n    }\n    if (harnesses.includes(\"copilot\")) {\n      const copilotFile = join(root, \".github\", \"copilot-instructions.md\");\n      plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);\n      rememberTarget(\"copilot\", copilotFile);\n    }\n    if (harnesses.includes(\"gemini\")) {\n      const geminiFile = join(root, \"GEMINI.md\");\n      plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);\n      rememberTarget(\"gemini\", geminiFile);\n    }\n  }\n\n  const writtenPaths = new Set<string>();\n  const unchangedPaths = new Set<string>();\n  const conflicts: string[] = [];\n  for (const file of plans.values()) {\n    const symlink = symlinkedComponent(file.boundary, file.target);\n    if (symlink) {\n      conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);\n      continue;\n    }\n    if (!existsSync(file.target)) {\n      writtenPaths.add(file.target);\n      continue;\n    }\n    const current = readFileSync(file.target, \"utf8\");\n    if (current === file.content) {\n      unchangedPaths.add(file.target);\n    } else if (file.managedMerge || options.force) {\n      writtenPaths.add(file.target);\n      unchangedPaths.delete(file.target);\n    } else {\n      conflicts.push(file.target);\n    }\n  }\n\n  if (conflicts.length > 0) {\n    throw new Error(\n      `agent setup files modified locally (re-run with --force to replace only odla-managed content):\\n${conflicts.map((f) => `  - ${f}`).join(\"\\n\")}`,\n    );\n  }\n\n  for (const file of plans.values()) {\n    if (!existsSync(file.target) || readFileSync(file.target, \"utf8\") !== file.content) {\n      mkdirSync(dirname(file.target), { recursive: true });\n      writeFileSync(file.target, file.content);\n    }\n  }\n\n  const skills = skillNames(files);\n  const installations = harnesses.map((harness) => ({ harness, targets: [...(targets.get(harness) ?? [])] }));\n  out.log(`agent harnesses: ${harnesses.join(\", \")}`);\n  out.log(`offline skills: ${skills.join(\", \")}`);\n  for (const installation of installations) out.log(`${installation.harness}: ${installation.targets.join(\", \")}`);\n  out.log(`installed ${writtenPaths.size} managed file(s)${unchangedPaths.size ? ` (${unchangedPaths.size} unchanged)` : \"\"}`);\n  return {\n    targetDir,\n    written: pathsUnder(targetDir, writtenPaths),\n    unchanged: pathsUnder(targetDir, unchangedPaths),\n    writtenPaths: [...writtenPaths].sort(),\n    unchangedPaths: [...unchangedPaths].sort(),\n    harnesses: installations,\n  };\n}\n\nfunction pathsUnder(root: string, paths: Set<string>): string[] {\n  return [...paths]\n    .map((path) => relative(root, path))\n    .filter((path) => path !== \"..\" && !path.startsWith(`..${sep}`) && !isAbsolute(path))\n    .sort();\n}\n\nfunction normalizeHarnesses(values: AgentHarnessSelector[] | undefined, global: boolean): AgentHarness[] {\n  const requested: string[] = values?.length ? values : [\"claude\"];\n  const allowed = new Set<string>([...AGENT_HARNESSES, \"all\"]);\n  for (const harness of requested) {\n    if (!allowed.has(harness)) {\n      throw new Error(`unknown agent harness \"${harness}\"; choose all, ${AGENT_HARNESSES.join(\", \")}`);\n    }\n  }\n  const expanded: AgentHarness[] = requested.includes(\"all\")\n    ? global ? [\"claude\", \"codex\"] : [...AGENT_HARNESSES]\n    : [...new Set(requested)] as AgentHarness[];\n  if (global) {\n    const unsupported = expanded.filter((harness) => harness !== \"claude\" && harness !== \"codex\");\n    if (unsupported.length) {\n      throw new Error(`--global supports claude and codex only; ${unsupported.join(\", \")} require a project-local adapter`);\n    }\n  }\n  return expanded;\n}\n\nfunction managedFileContent(path: string, block: string, force: boolean, boundary: string): string {\n  const symlink = symlinkedComponent(boundary, path);\n  if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);\n  if (!existsSync(path)) return `${block}\\n`;\n  const current = readFileSync(path, \"utf8\");\n  const start = \"<!-- odla-ai agent setup:start -->\";\n  const end = \"<!-- odla-ai agent setup:end -->\";\n  const startAt = current.indexOf(start);\n  const endAt = current.indexOf(end);\n  if ((startAt === -1) !== (endAt === -1) || (startAt !== -1 && endAt < startAt)) {\n    throw new Error(`malformed odla-managed section in ${path}`);\n  }\n  if (startAt === -1) {\n    const separator = current.length === 0 || current.endsWith(\"\\n\\n\") ? \"\" : current.endsWith(\"\\n\") ? \"\\n\" : \"\\n\\n\";\n    return `${current}${separator}${block}\\n`;\n  }\n  const afterEnd = endAt + end.length;\n  const existing = current.slice(startAt, afterEnd);\n  if (existing !== block && !force) {\n    throw new Error(`odla-managed section modified locally in ${path}; re-run with --force to replace that section`);\n  }\n  return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;\n}\n\nfunction symlinkedComponent(boundary: string, target: string): string | undefined {\n  const rel = relative(boundary, target);\n  if (rel === \"..\" || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {\n    throw new Error(`agent setup target escapes its install root: ${target}`);\n  }\n  let current = boundary;\n  for (const part of rel.split(sep).filter(Boolean)) {\n    current = join(current, part);\n    try {\n      if (lstatSync(current).isSymbolicLink()) return current;\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== \"ENOENT\") throw error;\n    }\n  }\n  return undefined;\n}\n\nfunction skillNames(files: string[]): string[] {\n  return [...new Set(files.filter((file) => /(^|[\\\\/])SKILL\\.md$/.test(file)).map((file) => file.split(/[\\\\/]/)[0]!))].sort();\n}\n\nfunction listFiles(dir: string): string[] {\n  if (!existsSync(dir)) return [];\n  const results: string[] = [];\n  const walk = (current: string): void => {\n    for (const entry of readdirSync(current, { withFileTypes: true })) {\n      const path = join(current, entry.name);\n      if (entry.isDirectory()) walk(path);\n      else results.push(relative(dir, path));\n    }\n  };\n  walk(dir);\n  return results.sort();\n}\n","/** Shared instruction block inserted into harness-native project files. */\nexport const PROJECT_INSTRUCTIONS = `<!-- odla-ai agent setup:start -->\n## odla agent workflow\n\nFor work that creates an odla app or adds odla services, read and follow\n\\`.agents/skills/odla/SKILL.md\\`. It dispatches an existing static site to\n\\`.agents/skills/odla-migrate/SKILL.md\\`. For production telemetry triage, use\n\\`.agents/skills/odla-o11y-debug/SKILL.md\\`.\n\nTrack the work in odla's PM as you go — record decisions when you make them, file\nbugs when you notice them, and move tasks when the work moves\n(\\`npx @odla-ai/cli pm task list\\`). The conventions and the full command set are\nin \\`.agents/skills/odla/references/pm.md\\`.\n\nThe setup runbooks and their references are installed in this repository, pinned\nto this CLI version. Use them as your setup context.\n\nOperational procedures — releasing, backups, database and code-runtime\noperations — are **not** in this bundle. They live in the odla database and\nchange without a CLI release, so ask them at the moment you begin the work.\nWhen this repository has an \\`appId\\`, pass it: app-scoped discovery includes\nthat project's instructions plus the shared platform procedures.\n\n\\`\\`\\`\nnpx odla-ai runbook ask \"<what you are about to do>\" --app <appId>\nnpx odla-ai runbook list\nnpx odla-ai runbook get <slug>\n\\`\\`\\`\n\nNever scrape odla.ai HTML for any of this. The CLI reads the same content\ndirectly, authenticated and current; a scraped page is neither.\n<!-- odla-ai agent setup:end -->`;\n\n/** Cursor's native rule wrapper around the shared project instructions. */\nexport const CURSOR_RULE = `---\ndescription: Build, migrate, provision, secure, or debug an odla app using the locally installed odla runbooks\nglobs:\nalwaysApply: false\n---\n\n${PROJECT_INSTRUCTIONS}\n`;\n\n/** Build a thin Claude skill that delegates to the canonical offline bundle. */\nexport function claudeAdapter(skill: string, canonical: string): string {\n  const match = canonical.match(/^---\\r?\\n([\\s\\S]*?)\\r?\\n---/);\n  if (!match) throw new Error(`bundled skill ${skill} has no YAML frontmatter`);\n  const lines = match[1]!.split(/\\r?\\n/);\n  const frontmatter: string[] = [];\n  let keepIndented = false;\n  for (const line of lines) {\n    if (line.startsWith(\"name:\") || line.startsWith(\"description:\")) {\n      frontmatter.push(line);\n      keepIndented = line.startsWith(\"description:\");\n    } else if (keepIndented && /^\\s+/.test(line)) {\n      frontmatter.push(line);\n    } else {\n      keepIndented = false;\n    }\n  }\n  return `---\n${frontmatter.join(\"\\n\")}\n---\n\n# ${skill} (odla adapter)\n\nRead \\`../../../.agents/skills/${skill}/SKILL.md\\` completely and follow it. That\ncanonical local skill owns every reference path and contains the full offline\nrunbook. Do not substitute a remote documentation page for the installed copy.\n`;\n}\n","import { calendarServiceConfig, GOOGLE_CALENDAR_EVENTS_SCOPE, loadProjectConfig, serializedEntities } from \"./config\";\nimport { readCalendarStatus } from \"./calendar-http\";\nimport { displayPath, readCredentials } from \"./local\";\nimport { resolveDatabaseConfig } from \"./integrations\";\nimport { redactSecrets } from \"./redact\";\nimport { getDeveloperToken } from \"./token\";\nimport type { SmokeOptions } from \"./types\";\n\ntype FetchLike = typeof fetch;\n\n/**\n * Verify a live, already-provisioned environment end-to-end. Resolves the target\n * env (`options.env`, else `dev`, else the first declared env) and requires it to\n * be declared in the config. Reads the local credentials file and checks that it\n * belongs to this app and holds the credentials required by the enabled\n * services — otherwise it throws pointing the user at\n * `odla-ai provision --write-dev-vars`.\n *\n * It then makes service-aware network calls: fetches the registry public-config\n * (and, when `ai.provider` is configured, asserts the live provider matches);\n * when db is enabled, fetches the live schema, checks composed entities, and\n * runs a `count` aggregate; when calendar is enabled, checks its owner-visible\n * booking health; and checks integration route probes anonymously against\n * `links.<env>`. Progress lines are printed and it ends with `ok`.\n * Read-only — it writes nothing and throws on the first mismatch or failed\n * request.\n *\n * @param options.configPath Path to the `odla.config.mjs`.\n * @param options.env Env to check (default `dev`, else the first declared env).\n * @param options.fetch Injectable `fetch` (for tests/embedding).\n * @param options.stdout Optional console-like sink (defaults to `console`).\n */\nexport async function smoke(options: SmokeOptions): Promise<void> {\n  const out = options.stdout ?? console;\n  const cfg = await loadProjectConfig(options.configPath);\n  const env = options.env ?? (cfg.envs.includes(\"dev\") ? \"dev\" : (cfg.envs[0] ?? \"prod\"));\n  if (!cfg.envs.includes(env)) throw new Error(`env \"${env}\" is not declared in ${displayPath(cfg.configPath, cfg.rootDir)}`);\n\n  const credentials = readCredentials(cfg.local.credentialsFile);\n  if (!credentials) {\n    throw new Error(`local credentials missing: ${displayPath(cfg.local.credentialsFile, cfg.rootDir)}. Run \"odla-ai provision --write-dev-vars\".`);\n  }\n  if (credentials.appId !== cfg.app.id) {\n    throw new Error(`local credentials are for app \"${credentials.appId}\", but config app is \"${cfg.app.id}\"`);\n  }\n\n  const entry = credentials.envs[env];\n  if (!entry?.tenantId) {\n    throw new Error(`local credentials have no tenant for env \"${env}\". Run \"odla-ai provision --write-dev-vars\".`);\n  }\n  const hasDb = cfg.services.includes(\"db\");\n  const hasO11y = cfg.services.includes(\"o11y\");\n  if (hasDb && !entry.dbKey) {\n    throw new Error(`local credentials have no db key for env \"${env}\". Run \"odla-ai provision --write-dev-vars\".`);\n  }\n  if (hasO11y && !entry.o11yToken) {\n    throw new Error(`local credentials have no o11y token for env \"${env}\". Run \"odla-ai provision --write-dev-vars\".`);\n  }\n\n  const doFetch = options.fetch ?? fetch;\n  out.log(`smoke: ${cfg.app.id}/${env}`);\n  out.log(`  tenant: ${entry.tenantId}`);\n\n  const publicConfig = await getJson(doFetch, publicConfigUrl(cfg.platformUrl, cfg.app.id, env), undefined);\n  out.log(`  public-config: ok`);\n\n  if (cfg.ai?.provider) {\n    const provider = ((publicConfig as { ai?: { provider?: unknown } | null }).ai?.provider ?? null) as string | null;\n    if (provider !== cfg.ai.provider) {\n      throw new Error(`ai provider mismatch: expected \"${cfg.ai.provider}\", public-config has \"${provider ?? \"none\"}\"`);\n    }\n    out.log(`  ai: ${provider}`);\n  }\n  if (hasO11y) out.log(`  o11y: credentials present`);\n\n  if (cfg.services.includes(\"calendar\")) {\n    const token = await getDeveloperToken(\n      cfg,\n      {\n        configPath: cfg.configPath,\n        token: options.token,\n        email: options.email,\n        open: options.open,\n        openApprovalUrl: options.openApprovalUrl,\n      },\n      doFetch,\n      out,\n    );\n    const status = await readCalendarStatus({ platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch });\n    assertCalendarHealthy(status, calendarServiceConfig(cfg, env));\n    out.log(`  calendar: ${status.status}, bookable (booking → ${status.bookingCalendarId ?? \"primary\"})`);\n  }\n\n  const database = await resolveDatabaseConfig(cfg);\n  if (hasDb) {\n    const expectedSchema = database.schema;\n    const expectedEntities = serializedEntities(expectedSchema);\n    const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);\n    const liveSchema = (liveSchemaPayload as { schema?: unknown }).schema ?? liveSchemaPayload;\n    const liveEntities = serializedEntities(liveSchema);\n    if (expectedEntities.length) {\n      const missing = expectedEntities.filter((entity) => !liveEntities.includes(entity));\n      if (missing.length) throw new Error(`live schema is missing expected entities: ${missing.join(\", \")}`);\n    }\n    out.log(`  schema: ${liveEntities.length} entities`);\n\n    const aggregateEntity = expectedEntities[0] ?? liveEntities[0];\n    if (aggregateEntity) {\n      const aggregate = await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey!, {\n        ns: aggregateEntity,\n        aggregate: { count: true },\n      });\n      const count = (aggregate as { aggregate?: { count?: unknown } }).aggregate?.count;\n      out.log(`  aggregate: ${aggregateEntity}.count=${String(count ?? \"ok\")}`);\n    } else {\n      out.log(`  aggregate: skipped (schema has no entities)`);\n    }\n  } else {\n    out.log(`  db: skipped (not enabled)`);\n  }\n  const probes = database.integrations.flatMap((integration) =>\n    (integration.probes ?? []).map((probe) => ({ integration: integration.id, probe })),\n  );\n  if (probes.length) {\n    const link = cfg.links?.[env];\n    if (!link) throw new Error(`integration smoke probes require links.${env} in odla.config.mjs`);\n    for (const { integration, probe } of probes) {\n      const probeUrl = new URL(probe.path, link).toString();\n      const res = await doFetch(probeUrl, { redirect: \"manual\" });\n      if (res.status !== probe.expectedStatus) {\n        throw new Error(`integration \"${integration}\" probe ${probe.path} returned ${res.status}; expected ${probe.expectedStatus}`);\n      }\n      out.log(`  integration.${integration}: ${probe.path} → ${res.status}`);\n    }\n  }\n  // Live-booking calendar keeps no mirror in odla-db — connection health\n  // (checked above) is the whole calendar smoke.\n  out.log(\"ok\");\n}\n\nfunction assertCalendarHealthy(\n  status: Awaited<ReturnType<typeof readCalendarStatus>>,\n  expected: ReturnType<typeof calendarServiceConfig>,\n): void {\n  if (!status.enabled || status.provider !== \"google\") throw new Error(\"calendar is not enabled with the Google provider\");\n  if (status.status !== \"healthy\") {\n    throw new Error(`calendar connection is ${status.status}${status.error?.message ? `: ${status.error.message}` : \"\"}`);\n  }\n  if (!status.writable) throw new Error('calendar grant does not cover booking writes; run \"odla-ai calendar connect\" to re-consent');\n  const hasEventsScope = status.grantedScopes.some((scope) => scope === GOOGLE_CALENDAR_EVENTS_SCOPE);\n  if (!hasEventsScope) throw new Error(\"calendar connection is missing calendar.events consent\");\n  const missing = expected.availabilityCalendars.filter((id) => !status.calendars.includes(id));\n  if (missing.length) throw new Error(`calendar connection is missing configured calendars: ${missing.join(\", \")}`);\n}\n\nasync function getJson(doFetch: FetchLike, url: string, bearer: string | undefined): Promise<unknown> {\n  const res = await doFetch(url, {\n    headers: bearer ? { authorization: `Bearer ${bearer}` } : undefined,\n  });\n  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText(res)}`);\n  return res.json();\n}\n\nasync function postJson(doFetch: FetchLike, url: string, bearer: string, body: unknown): Promise<unknown> {\n  const res = await doFetch(url, {\n    method: \"POST\",\n    headers: { authorization: `Bearer ${bearer}`, \"content-type\": \"application/json\" },\n    body: JSON.stringify(body),\n  });\n  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText(res)}`);\n  return res.json();\n}\n\nfunction publicConfigUrl(platformUrl: string, appId: string, env: string): string {\n  const url = new URL(`/registry/apps/${encodeURIComponent(appId)}/public-config`, platformUrl);\n  url.searchParams.set(\"env\", env);\n  return url.toString();\n}\n\nasync function safeText(res: Response): Promise<string> {\n  try {\n    return redactSecrets((await res.text()).slice(0, 500));\n  } catch {\n    return \"\";\n  }\n}\n","import { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\nimport { openUrl } from \"./open\";\nimport {\n  githubRepositoryName,\n  hostedIdentifier,\n  hostedPollInterval,\n  hostedPollTimeout,\n  requestHostedSecurityJson,\n  trustedGitHubInstallUrl,\n  waitForHostedPoll,\n} from \"./security-hosted-request\";\nimport type {\n  ConnectGitHubSecuritySourceOptions,\n  DisconnectGitHubSecuritySourceOptions,\n  GitHubConnectionAttempt,\n  GitHubConnectionStatus,\n  GitHubSecuritySource,\n  ListGitHubSecuritySourcesOptions,\n} from \"./security-hosted-types\";\n\n/** Begin GitHub App installation, launch its server-issued GitHub URL, and\n * poll the exact attempt until the callback has connected a source. */\nexport async function connectGitHubSecuritySource(\n  options: ConnectGitHubSecuritySourceOptions,\n): Promise<GitHubConnectionStatus> {\n  const out = options.stdout ?? console;\n  const repository = options.repository === undefined ? undefined : githubRepositoryName(options.repository);\n  const attempt = await requestHostedSecurityJson<GitHubConnectionAttempt>(\n    options,\n    \"/registry/github/connect\",\n    {\n      method: \"POST\",\n      body: JSON.stringify({\n        appId: hostedIdentifier(options.appId, \"appId\"),\n        env: hostedIdentifier(options.env, \"env\"),\n        ...(repository === undefined ? {} : { repository }),\n      }),\n    },\n    \"start GitHub connection\",\n  );\n  const serverExpiry = Date.parse(attempt?.expiresAt ?? \"\");\n  if (!attempt?.attemptId || !attempt.installUrl || !Number.isFinite(serverExpiry)) {\n    throw new Error(\"odla.ai returned an invalid GitHub connection attempt\");\n  }\n  const installUrl = trustedGitHubInstallUrl(attempt.installUrl);\n  out.log(`GitHub approval: ${installUrl}`);\n  if (options.open !== false) {\n    await (options.openInstallUrl ?? openUrl)(installUrl);\n    out.log(\"github: opened installation approval in your browser\");\n  }\n  const interval = hostedPollInterval(options.pollIntervalMs);\n  const now = options.now ?? Date.now;\n  const deadline = Math.min(serverExpiry, now() + hostedPollTimeout(options.pollTimeoutMs));\n  const wait = options.wait ?? waitForHostedPoll;\n  while (true) {\n    const state = await requestHostedSecurityJson<GitHubConnectionStatus>(\n      options,\n      `/registry/github/connect/${encodeURIComponent(attempt.attemptId)}`,\n      {},\n      \"check GitHub connection\",\n    );\n    if (state.status !== \"pending\") {\n      if (state.status === \"connected\") return state;\n      throw new Error(`GitHub connection ${state.status}${state.failureCode ? `: ${state.failureCode}` : \"\"}`);\n    }\n    if (now() >= deadline) throw new Error(\"GitHub connection approval timed out\");\n    await wait(Math.min(interval, Math.max(0, deadline - now())), options.signal);\n  }\n}\n\n/** List repository sources the current app owner connected for one environment. */\nexport async function listGitHubSecuritySources(\n  options: ListGitHubSecuritySourcesOptions,\n): Promise<GitHubSecuritySource[]> {\n  const appId = hostedIdentifier(options.appId, \"appId\");\n  const env = hostedIdentifier(options.env, \"env\");\n  const body = await requestHostedSecurityJson<{ sources: GitHubSecuritySource[] }>(\n    options,\n    `/registry/apps/${encodeURIComponent(appId)}/github/sources?env=${encodeURIComponent(env)}`,\n    {},\n    \"list GitHub security sources\",\n  );\n  return Array.isArray(body.sources) ? body.sources : [];\n}\n\n/** Revoke odla's use of one saved source without requiring a GitHub-side App\n * uninstall. The server marks the source deleted and rejects new jobs. */\nexport async function disconnectGitHubSecuritySource(\n  options: DisconnectGitHubSecuritySourceOptions,\n): Promise<void> {\n  const appId = hostedIdentifier(options.appId, \"appId\");\n  const sourceId = hostedIdentifier(options.sourceId, \"sourceId\");\n  await requestHostedSecurityJson<{ ok: true }>(\n    options,\n    `/registry/apps/${encodeURIComponent(appId)}/github/sources/${encodeURIComponent(sourceId)}`,\n    { method: \"DELETE\" },\n    \"disconnect GitHub security source\",\n  );\n}\n\n/** Parse an HTTPS, ssh://, or git@github.com origin without retaining embedded\n * credentials. Only github.com owner/name remotes are accepted. */\nexport function repositoryFromGitRemote(remoteInput: string): string {\n  const remote = remoteInput.trim();\n  const scp = /^git@github\\.com:([^/\\s]+)\\/([^/\\s]+?)\\/?$/.exec(remote);\n  if (scp) return githubRepositoryName(`${scp[1]}/${scp[2]!.replace(/\\.git$/, \"\")}`);\n  let url: URL;\n  try {\n    url = new URL(remote);\n  } catch {\n    throw new Error(\"origin must be a github.com HTTPS or SSH repository URL\");\n  }\n  if (url.hostname !== \"github.com\" || (url.protocol !== \"https:\" && url.protocol !== \"ssh:\")) {\n    throw new Error(\"origin must be a github.com HTTPS or SSH repository URL\");\n  }\n  if (url.password || (url.protocol === \"https:\" && url.username) || url.search || url.hash) {\n    throw new Error(\"credential-bearing GitHub origin URLs are not accepted\");\n  }\n  const parts = url.pathname.replace(/^\\/+|\\/+$/g, \"\").split(\"/\");\n  if (parts.length !== 2) {\n    throw new Error(\"origin must identify one GitHub owner/name repository\");\n  }\n  return githubRepositoryName(`${parts[0]}/${parts[1]!.replace(/\\.git$/, \"\")}`);\n}\n\n/** Read the current repository's origin without invoking a shell. */\nexport async function inferGitHubRepository(\n  cwd = process.cwd(),\n  readOrigin: (cwd: string) => Promise<string> = defaultReadOrigin,\n): Promise<string> {\n  let remote: string;\n  try {\n    remote = await readOrigin(cwd);\n  } catch {\n    throw new Error(\"Could not read git origin; pass --repo owner/name\");\n  }\n  return repositoryFromGitRemote(remote);\n}\n\nasync function defaultReadOrigin(cwd: string): Promise<string> {\n  const result = await promisify(execFile)(\n    \"git\",\n    [\"remote\", \"get-url\", \"origin\"],\n    { cwd, encoding: \"utf8\" },\n  );\n  return result.stdout;\n}\n","import { platformAudience } from \"./token\";\nimport type {\n  HostedSecurityPlan,\n  HostedSecurityPlanRoute,\n  HostedSecurityRequestOptions,\n} from \"./security-hosted-types\";\n\nexport async function requestHostedSecurityJson<T>(\n  options: HostedSecurityRequestOptions,\n  path: string,\n  init: RequestInit,\n  action: string,\n): Promise<T> {\n  const platform = platformAudience(options.platform);\n  const token = hostedSecurityCredential(options.token);\n  const requestInit = {\n    ...init,\n    redirect: \"error\",\n    credentials: \"omit\",\n    cache: \"no-store\",\n    signal: options.signal,\n    headers: {\n      authorization: `Bearer ${token}`,\n      \"content-type\": \"application/json\",\n      ...init.headers,\n    },\n  } as RequestInit;\n  const response = await (options.fetch ?? fetch)(new URL(path, platform), requestInit);\n  const body = await response.json().catch(() => ({})) as T & {\n    error?: { code?: string; message?: string };\n  };\n  if (!response.ok) {\n    const code = optionalHostedText(body.error?.code, \"error code\", 128);\n    const message = optionalHostedText(body.error?.message, \"error message\", 300);\n    throw new Error(`${action} failed (${response.status})${code ? ` ${code}` : \"\"}${message ? `: ${message}` : \"\"}`);\n  }\n  return body;\n}\n\nexport function hostedIdentifier(value: string, name: string): string {\n  const result = optionalHostedText(value, name, 180);\n  if (!result || !/^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(result)) {\n    throw new Error(`${name} is invalid`);\n  }\n  return result;\n}\n\nexport function positivePolicyVersion(value: unknown, name: string): number {\n  if (!Number.isSafeInteger(value) || (value as number) < 1) {\n    throw new Error(`${name} is invalid`);\n  }\n  return value as number;\n}\n\nexport function optionalHostedText(\n  value: unknown,\n  name: string,\n  maxLength: number,\n): string | undefined {\n  if (value === undefined || value === null || value === \"\") return undefined;\n  if (typeof value !== \"string\" || value.length > maxLength || /[\\u0000-\\u001f\\u007f]/.test(value)) {\n    throw new Error(`${name} is invalid`);\n  }\n  return value;\n}\n\nexport function githubRepositoryName(value: string): string {\n  if (typeof value !== \"string\" || value.length > 201) {\n    throw new Error(\"repository must be owner/name\");\n  }\n  const parts = value.split(\"/\");\n  const owner = parts[0] ?? \"\";\n  const name = (parts[1] ?? \"\").replace(/\\.git$/i, \"\");\n  if (parts.length !== 2\n    || !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,98}[A-Za-z0-9])?$/.test(owner)\n    || !/^[A-Za-z0-9_.-]{1,100}$/.test(name)\n    || name === \".\" || name === \"..\") {\n    throw new Error(\"repository must be owner/name\");\n  }\n  return `${owner}/${name}`;\n}\n\nexport function trustedGitHubInstallUrl(value: string): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(\"odla.ai returned an invalid GitHub installation URL\");\n  }\n  if (url.protocol !== \"https:\" || url.hostname !== \"github.com\" || url.username || url.password) {\n    throw new Error(\"odla.ai returned an untrusted GitHub installation URL\");\n  }\n  return url.toString();\n}\n\nexport function hostedPollInterval(value = 2_000): number {\n  if (!Number.isSafeInteger(value) || value < 100 || value > 30_000) {\n    throw new Error(\"poll interval must be 100-30000ms\");\n  }\n  return value;\n}\n\nexport function hostedPollTimeout(value = 10 * 60_000): number {\n  if (!Number.isSafeInteger(value) || value < 1_000 || value > 60 * 60_000) {\n    throw new Error(\"poll timeout must be 1000-3600000ms\");\n  }\n  return value;\n}\n\nexport async function waitForHostedPoll(\n  milliseconds: number,\n  signal?: AbortSignal,\n): Promise<void> {\n  if (signal?.aborted) throw signal.reason ?? new DOMException(\"aborted\", \"AbortError\");\n  await new Promise<void>((resolve, reject) => {\n    const timer = setTimeout(resolve, milliseconds);\n    signal?.addEventListener(\"abort\", () => {\n      clearTimeout(timer);\n      reject(signal.reason ?? new DOMException(\"aborted\", \"AbortError\"));\n    }, { once: true });\n  });\n}\n\nexport function isValidHostedSecurityPlan(\n  value: HostedSecurityPlan,\n  env: string,\n): boolean {\n  if (!value || value.env !== env || !/^sha256:[a-f0-9]{64}$/.test(value.planDigest)\n    || value.consentContract !== \"odla.hosted-security-consent.v1\"\n    || value.reportProjection !== \"odla.hosted-security-report.v1\"\n    || value.redactionContract !== \"odla.best-effort-credential-pattern-redaction.v1\"\n    || typeof value.promptBundle !== \"string\" || value.promptBundle.length < 1 || value.promptBundle.length > 100\n    || typeof value.ready !== \"boolean\"\n    || typeof value.independent !== \"boolean\" || value.sourceDisclosure !== \"redacted\"\n    || value.targetExecution !== false || !Number.isSafeInteger(value.reportRetentionDays)\n    || value.reportRetentionDays < 1) return false;\n  const validRoute = (\n    route: HostedSecurityPlanRoute | undefined,\n    purpose: HostedSecurityPlanRoute[\"purpose\"],\n  ) => !!route\n    && route.purpose === purpose\n    && typeof route.enabled === \"boolean\"\n    && typeof route.credentialReady === \"boolean\"\n    && typeof route.provider === \"string\" && route.provider.length > 0 && route.provider.length <= 100\n    && typeof route.model === \"string\" && route.model.length > 0 && route.model.length <= 200\n    && Number.isSafeInteger(route.policyVersion) && route.policyVersion >= 1\n    && Number.isSafeInteger(route.maxCallsPerRun) && route.maxCallsPerRun >= 1\n    && Number.isSafeInteger(route.maxInputBytes) && route.maxInputBytes >= 1\n    && Number.isSafeInteger(route.maxOutputTokens) && route.maxOutputTokens >= 1;\n  return validRoute(value.routes?.discovery, \"security.discovery\")\n    && validRoute(value.routes?.validation, \"security.validation\");\n}\n\nfunction hostedSecurityCredential(value: string): string {\n  if (typeof value !== \"string\" || value.length < 8 || value.length > 8_192\n    || /\\s|[\\u0000-\\u001f\\u007f]/.test(value)) {\n    throw new Error(\"Hosted security requires an injected odla developer token\");\n  }\n  return value;\n}\n","/** Release-owned Pi adapter bundled into the CLI. `prepareCodeImages` hashes\n * the exact bundle and builds a content-addressed local image; no registry\n * credential enters the terminal connection. */\nexport const CODE_PI_IMAGE = \"odla-ai/pi-agent:embedded\";\n\n/** Public, digest-pinned base used for both the embedded Pi adapter and the\n * initial dependency-free dogfood recipe. */\nexport const CODE_NODE_IMAGE = \"node:24-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd\";\n\n/** Immutable CaMeL-registered build recipe available to an agent container. */\nexport interface CodeBuildRule {\n  id: string; image: string; command: readonly string[]; timeoutMs: number; maxOutputBytes: number;\n  cpus?: number; memory?: string; pids?: number; tmpfsBytes?: number;\n}\n\n/** Initial dependency-free dogfood recipe. App-registered catalogs can replace\n * this once their owner-visible registration contract exists. */\nexport const CODE_BUILD_RECIPES: readonly CodeBuildRule[] = Object.freeze([{\n  id: \"odla-code-contracts\",\n  image: CODE_NODE_IMAGE,\n  command: [\n    \"node\",\n    // The clean source mount deliberately has no node_modules. Reuse the\n    // semver copy inside this digest-pinned npm image without network access.\n    \"--import=data:text/javascript,import%20Module%20from%20%22node%3Amodule%22%3Bprocess.env.NODE_PATH%3D%22%2Fusr%2Flocal%2Flib%2Fnode_modules%2Fnpm%2Fnode_modules%22%3BModule._initPaths%28%29\",\n    \"--test\",\n    \"scripts/lib/directories.test.mjs\",\n    \"scripts/lib/internal-deps.test.mjs\",\n    \"scripts/lib/npm-audit.test.mjs\",\n    \"scripts/lib/npm-release-contract.test.mjs\",\n    \"scripts/lib/release-surfaces.test.mjs\",\n  ],\n  timeoutMs: 120_000,\n  maxOutputBytes: 1024 * 1024,\n  cpus: 1,\n  memory: \"512m\",\n  pids: 128,\n}]);\n","import { spawn } from \"node:child_process\";\nimport { createHash } from \"node:crypto\";\nimport { copyFile, mkdtemp, readFile, rm, writeFile } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { CodeContainerEngine } from \"./code-connect\";\nimport { CODE_NODE_IMAGE, CODE_PI_IMAGE } from \"./code-runtime-config\";\n\nexport type CodeImageCommandRunner = (\n  command: string,\n  args: readonly string[],\n  stdio: \"inherit\" | \"ignore\",\n) => Promise<void>;\n\nexport type EmbeddedPiImageBuilder = (\n  engine: CodeContainerEngine,\n  image: string,\n  run: CodeImageCommandRunner,\n) => Promise<void>;\n\nexport type EmbeddedPiImageNamer = () => Promise<string>;\n\nconst runCodeImageCommand: CodeImageCommandRunner = (command, args, stdio) => new Promise((accept, reject) => {\n  const child = spawn(command, [...args], { shell: false, stdio });\n  child.once(\"error\", reject);\n  child.once(\"exit\", (code, signal) => {\n    if (code === 0) accept();\n    else reject(new Error(`${command} ${args.join(\" \")} exited ${code ?? signal ?? \"without a status\"}`));\n  });\n});\n\n/** Build the CLI-embedded Pi adapter and pull each immutable recipe image\n * before an owner is asked to approve the terminal. Runtime attempts never\n * pull, and fail closed if a prepared image disappears. */\nexport async function prepareCodeImages(\n  engine: CodeContainerEngine,\n  images: readonly string[],\n  run: CodeImageCommandRunner = runCodeImageCommand,\n  buildEmbedded: EmbeddedPiImageBuilder = buildEmbeddedPiImage,\n  nameEmbedded: EmbeddedPiImageNamer = embeddedPiImageName,\n): Promise<readonly string[]> {\n  if (engine === \"container\") {\n    try {\n      // Idempotent when already running. Inherited stdio lets Apple's first-run\n      // kernel consent happen in the same foreground terminal as code connect.\n      await run(engine, [\"system\", \"start\"], \"inherit\");\n    } catch {\n      throw new Error(\"Apple container could not start; run `container system start` once to complete its lightweight VM setup, then retry\");\n    }\n  }\n  const prepared: string[] = [];\n  for (const image of images) {\n    const runtimeImage = image === CODE_PI_IMAGE ? await nameEmbedded() : image;\n    const inspectArgs = [\"image\", \"inspect\", runtimeImage];\n    try {\n      await run(engine, inspectArgs, \"ignore\");\n      prepared.push(runtimeImage);\n      continue;\n    } catch { /* pull the immutable image when it is not already present */ }\n    if (image === CODE_PI_IMAGE) {\n      try { await buildEmbedded(engine, runtimeImage, run); }\n      catch (error) {\n        const detail = error instanceof Error && error.message ? `: ${error.message}` : \"\";\n        throw new Error(`could not prepare CLI-embedded Code image${detail}`);\n      }\n      prepared.push(runtimeImage);\n      continue;\n    }\n    const args = engine === \"container\" ? [\"image\", \"pull\", image] : [\"pull\", image];\n    try { await run(engine, args, \"inherit\"); }\n    catch (error) {\n      const detail = error instanceof Error && error.message ? `: ${error.message}` : \"\";\n      throw new Error(`could not prepare pinned Code image ${image}${detail}`);\n    }\n    prepared.push(image);\n  }\n  return prepared;\n}\n\nfunction embeddedPiAssetPath(): string {\n  return fileURLToPath(new URL(\"./runtime/pi-agent.js\", import.meta.url));\n}\n\nasync function embeddedPiImageName(): Promise<string> {\n  const bundle = await readFile(embeddedPiAssetPath()).catch(() => {\n    throw new Error(\"CLI-embedded Pi runtime is missing; reinstall this exact @odla-ai/cli version\");\n  });\n  return `odla-ai/pi-agent:embedded-sha256-${createHash(\"sha256\").update(bundle).digest(\"hex\")}`;\n}\n\nasync function buildEmbeddedPiImage(\n  engine: CodeContainerEngine,\n  image: string,\n  run: CodeImageCommandRunner,\n): Promise<void> {\n  const context = await mkdtemp(join(tmpdir(), \"odla-code-pi-\"));\n  try {\n    await copyFile(embeddedPiAssetPath(), join(context, \"pi-agent.js\"));\n    await writeFile(join(context, \"Dockerfile\"), [\n      `FROM ${CODE_NODE_IMAGE}`,\n      \"COPY pi-agent.js /opt/odla/pi-agent.js\",\n      \"WORKDIR /workspace\",\n      'ENTRYPOINT [\"node\", \"/opt/odla/pi-agent.js\"]',\n      \"\",\n    ].join(\"\\n\"), { mode: 0o600 });\n    await run(engine, [\"build\", \"--tag\", image, context], \"inherit\");\n  } finally {\n    await rm(context, { recursive: true, force: true });\n  }\n}\n","import { existsSync } from \"node:fs\";\nimport { cpus, hostname, totalmem } from \"node:os\";\nimport { resolve } from \"node:path\";\nimport {\n  CODE_RUNTIME_PROTOCOL_VERSION,\n  CodePiRuntimeEngine,\n  CodeRuntimeReconciler,\n  createCodeRuntimeControlClient,\n  runCodeRuntimeHeartbeatLoop,\n  selectContainerEngine,\n} from \"@odla-ai/harness/node\";\nimport { getScopedPlatformToken } from \"./admin-ai-auth\";\nimport { loadProjectConfig } from \"./config\";\nimport { cliVersion } from \"./help\";\nimport { inferGitHubRepository } from \"./security-hosted-github\";\nimport { prepareCodeLocalSource } from \"./code-local-source\";\nimport { prepareCodeImages } from \"./code-images\";\nimport { CODE_BUILD_RECIPES, CODE_PI_IMAGE } from \"./code-runtime-config\";\nimport type { CodeLocalSourceDescriptor } from \"./code-source-types\";\nexport { CODE_BUILD_RECIPES, CODE_PI_IMAGE } from \"./code-runtime-config\";\nexport type { CodeBuildRule } from \"./code-runtime-config\";\nexport type { CodeLocalSourceDescriptor } from \"./code-source-types\";\nexport { prepareCodeImages } from \"./code-images\";\n\n/** Supported local isolation engines for an odla Code host runtime. */\nexport type CodeContainerEngine = \"container\" | \"podman\" | \"docker\";\n\n/** Bounded host facts reported on each outbound Code control-plane heartbeat. */\nexport interface CodeHostCapabilities {\n  protocolVersion: 1; platform: \"macos\" | \"linux\"; arch: string;\n  engines: CodeContainerEngine[]; cpuCount: number; memoryBytes: number;\n  source: CodeLocalSourceDescriptor;\n  images: { ready: true; pi: string; piSource: \"cli_embedded\"; recipes: Array<{ id: string; image: string }> };\n}\n\ntype Output = Pick<typeof console, \"log\" | \"error\">;\n\n/** Inputs for enrolling the current checkout and running its foreground Pi host. */\nexport interface CodeConnectOptions {\n  configPath: string;\n  /** Repository root. Defaults to the current directory. */\n  cwd?: string;\n  env?: string;\n  /** Explicit Studio control-plane origin; overrides config and environment. */\n  platform?: string;\n  /** Explicit app target; useful before or without odla.config.mjs. */\n  appId?: string;\n  email?: string;\n  open?: boolean;\n  name?: string;\n  slots?: number;\n  engine?: CodeContainerEngine | \"auto\";\n  heartbeatMs?: number;\n  /** Enroll and prove one heartbeat without waiting for sessions. */\n  once?: boolean;\n  fetch?: typeof fetch;\n  stdout?: Output;\n  openApprovalUrl?: (url: string) => Promise<void>;\n  signal?: AbortSignal;\n  /** Test/embedding boundaries. */\n  getToken?: typeof getScopedPlatformToken;\n  selectEngine?: (requested: CodeContainerEngine | \"auto\") => Promise<CodeContainerEngine>;\n  runRuntime?: (input: CodeRuntimeInput) => Promise<void>;\n  readGitOrigin?: (cwd: string) => Promise<string>;\n  readGitHead?: (cwd: string) => Promise<string>;\n  prepareImages?: (engine: CodeContainerEngine, images: readonly string[]) => Promise<readonly string[]>;\n  prepareLocalSource?: typeof prepareCodeLocalSource;\n}\n\n/** Authority and runtime boundaries used after a Code host enrollment succeeds. */\nexport interface CodeRuntimeInput {\n  endpoint: string;\n  token: string;\n  engine: CodeContainerEngine;\n  capabilities: CodeHostCapabilities;\n  heartbeatMs: number;\n  once: boolean;\n  signal?: AbortSignal;\n  stdout: Output;\n  fetch?: typeof fetch;\n  localSource?: { descriptor: CodeLocalSourceDescriptor; trustedBaseDir: string; sourceDir: string }; piImage?: string;\n}\n\ninterface ConnectionResponse {\n  token: string;\n  resumed: boolean;\n  host: { hostId: string; name: string };\n  offer: { slots: number };\n  binding: { appId: string; env: \"dev\" | \"prod\"; generation: number };\n}\n\n/** Enroll this machine from an odla project and keep the embedded Pi runtime\n * online. Both the approval grant and host credential hashes are stored in\n * odla-ai/db; plaintext host authority exists only in this running process. */\nexport async function codeConnect(options: CodeConnectOptions): Promise<void> {\n  const cwd = options.cwd ?? process.cwd();\n  const configPath = resolve(cwd, options.configPath);\n  const cfg = existsSync(configPath) ? await loadProjectConfig(configPath) : null;\n  const requestedAppId = options.appId?.trim();\n  if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {\n    throw new Error(\"--app-id must be a valid odla app id\");\n  }\n  if (requestedAppId && cfg && requestedAppId !== cfg.app.id) {\n    throw new Error(`--app-id ${requestedAppId} does not match ${options.configPath} (${cfg.app.id})`);\n  }\n  const appId = requestedAppId ?? cfg?.app.id;\n  const platform = (options.platform ?? cfg?.platformUrl ?? process.env.ODLA_PLATFORM_URL ?? \"https://odla.ai\").replace(/\\/+$/, \"\");\n  // Without a config there are no declared envs to choose from, so require\n  // --env rather than binding one silently: a silent \"dev\" default is how the\n  // odla-ai app's Code sessions all landed in its dev environment.\n  const appEnv = options.env ?? (cfg ? (cfg.envs.includes(\"dev\") ? \"dev\" : cfg.envs[0]) : undefined);\n  if ((appEnv !== \"dev\" && appEnv !== \"prod\") || (cfg && !cfg.envs.includes(appEnv))) {\n    throw new Error(cfg\n      ? `Code env \"${appEnv ?? \"\"}\" must be dev or prod and declared in ${options.configPath}`\n      : `Code env \"${appEnv ?? \"\"}\" must be dev or prod; pass --env explicitly when there is no ${options.configPath}`);\n  }\n  if (process.platform !== \"darwin\" && process.platform !== \"linux\") {\n    throw new Error(\"odla Code hosts require macOS or Linux\");\n  }\n  const slots = options.slots ?? 1;\n  if (!Number.isSafeInteger(slots) || slots < 1 || slots > 64) {\n    throw new Error(\"--slots must be an integer from 1 to 64\");\n  }\n  const heartbeatMs = options.heartbeatMs ?? 15_000;\n  if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 1_000 || heartbeatMs > 300_000) {\n    throw new Error(\"--heartbeat-ms must be an integer from 1000 to 300000\");\n  }\n  const out = options.stdout ?? console;\n  const doFetch = options.fetch ?? fetch;\n  // Prove the isolation prerequisite before asking a human to approve a mutation.\n  const engine = await (options.selectEngine ?? selectContainerEngine)(options.engine ?? \"auto\");\n  const [piImage] = await (options.prepareImages ?? prepareCodeImages)(engine,\n    [CODE_PI_IMAGE, ...new Set(CODE_BUILD_RECIPES.map((recipe) => recipe.image))]);\n  if (!piImage || !/^odla-ai\\/pi-agent:embedded-sha256-[0-9a-f]{64}$/.test(piImage)) throw new Error(\"Code image preflight did not produce the content-addressed embedded Pi runtime\");\n  const hostPlatform = process.platform === \"darwin\" ? \"macos\" : \"linux\";\n  const hostName = (options.name ?? hostname()).trim();\n  if (!hostName || hostName.length > 120) throw new Error(\"--name must contain 1 to 120 characters\");\n  const repository = await inferGitHubRepository(cwd, options.readGitOrigin);\n  const localSource = await (options.prepareLocalSource ?? prepareCodeLocalSource)(\n    cwd, repository, options.readGitHead,\n  );\n  try {\n    const descriptor = localSource.descriptor;\n    const approval = await (options.getToken ?? getScopedPlatformToken)({\n      platform,\n      scope: \"app:code:host:connect\",\n      email: options.email,\n      open: options.open,\n      fetch: doFetch,\n      stdout: out,\n      openApprovalUrl: options.openApprovalUrl,\n      cache: false,\n      label: `Terminal connection for ${appId ?? repository}/${appEnv}`,\n    });\n    const target = appId ? { appId } : { repository };\n    const response = await doFetch(`${platform}/registry/code/hosts/connect`, {\n      method: \"POST\",\n      headers: { authorization: `Bearer ${approval}`, \"content-type\": \"application/json\" },\n      body: JSON.stringify({ ...target, env: appEnv, name: hostName, platform: hostPlatform, slots }),\n      redirect: \"error\",\n      signal: options.signal,\n    });\n    const raw = await response.json().catch(() => null);\n    if (!response.ok) throw new Error(apiFailure(\"connect Code host\", response.status, raw));\n    const connection = parseConnection(raw, appId, appEnv);\n    const capabilities: CodeHostCapabilities = {\n      protocolVersion: CODE_RUNTIME_PROTOCOL_VERSION,\n      platform: hostPlatform,\n      arch: process.arch,\n      engines: [engine],\n      cpuCount: cpus().length,\n      memoryBytes: totalmem(),\n      source: descriptor,\n      images: {\n        ready: true, pi: piImage, piSource: \"cli_embedded\",\n        recipes: CODE_BUILD_RECIPES.map((recipe) => ({ id: recipe.id, image: recipe.image })),\n      },\n    };\n    out.log(`${connection.resumed ? \"reconnected\" : \"enrolled\"}: ${connection.host.name} (${connection.host.hostId})`);\n    out.log(`binding: ${connection.binding.appId}/${connection.binding.env} · ${connection.offer.slots} slot(s) · ${engine}`);\n    out.log(`source: local checkout · ${descriptor.headCommitSha.slice(0, 10)} · ${descriptor.fileCount} files · staged copy`);\n    out.log(\"credentials: stored in odla-ai/db; host plaintext is memory-only\");\n    out.log(`Studio: ${platform}/studio/apps/${encodeURIComponent(connection.binding.appId)}/${connection.binding.env}/code/sessions`);\n    await (options.runRuntime ?? runCodeRuntime)({\n      endpoint: platform,\n      token: connection.token,\n      engine,\n      capabilities,\n      localSource,\n      piImage,\n      heartbeatMs,\n      once: options.once === true,\n      signal: options.signal,\n      stdout: out,\n      fetch: doFetch,\n    });\n  } finally {\n    await localSource.cleanup();\n  }\n}\n\n/** Run outbound presence and fenced Pi commands without opening a listener. */\nexport async function runCodeRuntime(input: CodeRuntimeInput): Promise<void> {\n  const controller = new AbortController();\n  const abort = () => controller.abort(input.signal?.reason ?? \"runtime_shutdown\");\n  input.signal?.addEventListener(\"abort\", abort, { once: true });\n  const signal = input.signal ? AbortSignal.any([input.signal, controller.signal]) : controller.signal;\n  const handlers = ([\"SIGINT\", \"SIGTERM\"] as const).map((name) => {\n    const handler = () => controller.abort(name);\n    process.once(name, handler);\n    return [name, handler] as const;\n  });\n  const control = createCodeRuntimeControlClient({\n    endpoint: input.endpoint, token: input.token, signal, fetch: input.fetch,\n  });\n  const commandEngine = new CodePiRuntimeEngine({\n    control,\n    engine: input.engine,\n    image: input.piImage ?? input.capabilities.images.pi,\n    imageAuthorization: \"cli_embedded\",\n    recipes: CODE_BUILD_RECIPES,\n    recipeAuthorization: \"registered_recipe\",\n    localSource: input.localSource,\n    onDiagnostic: (message) => input.stdout.error(`Pi runtime failed · ${message}`),\n  });\n  const reconciler = new CodeRuntimeReconciler(control, commandEngine);\n  try {\n    await runCodeRuntimeHeartbeatLoop({\n      control,\n      runtimeVersion: `odla-ai-cli/${cliVersion()}`,\n      capabilities: input.capabilities,\n      heartbeatMs: input.heartbeatMs,\n      once: input.once,\n      signal,\n      onSnapshot: async (snapshot) => {\n        input.stdout.log(\n          `online: ${snapshot.host.hostId} · ${snapshot.bindings.length} binding(s) · ${snapshot.commands.length} command(s)`,\n        );\n        if (input.once && snapshot.commands.length) {\n          throw new Error(\"--once is diagnostic-only and refuses pending Code commands; run without --once\");\n        }\n        await reconciler.reconcile(snapshot);\n      },\n      onRetry: (error, delayMs) => input.stdout.error(\n        `Code control plane unavailable; retrying in ${delayMs}ms · ${error instanceof Error ? error.message : String(error)}`,\n      ),\n    });\n  } finally {\n    await commandEngine.close();\n    input.signal?.removeEventListener(\"abort\", abort);\n    for (const [name, handler] of handlers) process.removeListener(name, handler);\n  }\n}\n\nfunction parseConnection(value: unknown, appId: string | undefined, appEnv: \"dev\" | \"prod\"): ConnectionResponse {\n  const root = record(value);\n  const host = record(root?.host);\n  const offer = record(root?.offer);\n  const binding = record(root?.binding);\n  if (!root || typeof root.token !== \"string\" || !/^odla_code_host_[0-9a-f]{64}$/.test(root.token)\n    || typeof root.resumed !== \"boolean\" || !host || !/^chost_[0-9a-f]{32}$/.test(String(host.hostId))\n    || typeof host.name !== \"string\" || !offer || !Number.isSafeInteger(offer.slots)\n    || !binding || typeof binding.appId !== \"string\" || !binding.appId || (appId && binding.appId !== appId)\n    || binding.env !== appEnv\n    || !Number.isSafeInteger(binding.generation)) {\n    throw new Error(\"connect Code host returned an invalid response\");\n  }\n  return root as unknown as ConnectionResponse;\n}\n\nfunction apiFailure(action: string, status: number, value: unknown): string {\n  const message = record(record(value)?.error)?.message;\n  return `${action} failed (${status})${typeof message === \"string\" ? `: ${message}` : \"\"}`;\n}\n\nfunction record(value: unknown): Record<string, unknown> | null {\n  return value && typeof value === \"object\" && !Array.isArray(value) ? value as Record<string, unknown> : null;\n}\n","import type { ChatInput, OracleResponse } from \"@odla-ai/ai\";\n\n/** Current JSONL protocol version exchanged between a runner and an agent container. */\nexport const HARNESS_PROTOCOL_VERSION = 1 as const;\n\n/** Default control-plane route used for model inference requested by coding agents. */\nexport const DEFAULT_AI_ROUTE = \"coding\" as const;\n\n/** Lifecycle state reported for a harness task and its active attempt. */\nexport type HarnessTaskStatus =\n  | \"queued\"\n  | \"running\"\n  | \"cancel_requested\"\n  | \"completed\"\n  | \"failed\"\n  | \"cancelled\";\n\n/** Lifecycle state of one execution attempt for a task. */\nexport type HarnessAttemptStatus = HarnessTaskStatus;\n\n/** Trusted or untrusted participant that emitted a harness event. */\nexport type HarnessActor = \"operator\" | \"runner\" | \"agent\" | \"model\" | \"system\";\n\n/** Resource and isolation limits enforced while an untrusted task executes. */\nexport interface HarnessPolicy {\n  network: \"none\";\n  timeoutMs: number;\n  maxOutputBytes: number;\n  maxPatchBytes: number;\n}\n\n/** Immutable task instructions and execution policy delivered with a lease. */\nexport interface HarnessTaskSpec {\n  taskId: string;\n  attemptId: string;\n  title: string;\n  prompt: string;\n  workspace: string;\n  aiRoute: string;\n  policy: HarnessPolicy;\n  parentAttemptId?: string | null;\n  checkpointSeq?: number | null;\n}\n\n/** Time-bound assignment authorizing a runner to execute one task attempt. */\nexport interface HarnessLease {\n  protocolVersion: typeof HARNESS_PROTOCOL_VERSION;\n  leaseId: string;\n  generation: number;\n  expiresAt: number;\n  task: HarnessTaskSpec;\n}\n\n/** Runner-supplied event before the control plane assigns sequence and task metadata. */\nexport interface HarnessEventInput {\n  eventId: string;\n  kind: string;\n  actor: HarnessActor;\n  payload: unknown;\n  createdAt: number;\n}\n\n/** Persisted, ordered event associated with a specific task attempt. */\nexport interface HarnessEvent extends HarnessEventInput {\n  seq: number;\n  taskId: string;\n  attemptId: string;\n}\n\n/** List-view metadata for a task and its current attempt. */\nexport interface HarnessTaskSummary {\n  taskId: string;\n  attemptId: string;\n  appId: string;\n  env: string;\n  title: string;\n  prompt: string;\n  workspace: string;\n  aiRoute: string;\n  status: HarnessTaskStatus;\n  parentAttemptId: string | null;\n  checkpointSeq: number | null;\n  runnerId: string | null;\n  generation: number;\n  createdAt: number;\n  updatedAt: number;\n}\n\n/** List-view metadata for one attempt, including retry ancestry and runner ownership. */\nexport interface HarnessAttemptSummary {\n  attemptId: string;\n  taskId: string;\n  parentAttemptId: string | null;\n  checkpointSeq: number | null;\n  status: HarnessAttemptStatus;\n  runnerId: string | null;\n  generation: number;\n  createdAt: number;\n  updatedAt: number;\n}\n\n/** Complete task view including attempts, events, result, and generated patch. */\nexport interface HarnessTaskDetail extends HarnessTaskSummary {\n  attempts: HarnessAttemptSummary[];\n  events: HarnessEvent[];\n  patch: string | null;\n  result: unknown;\n}\n\n/** Public control-plane view of a registered harness runner. */\nexport interface HarnessRunnerView {\n  runnerId: string;\n  appId: string;\n  env: string;\n  name: string;\n  createdAt: number;\n  lastSeenAt: number | null;\n  revokedAt: number | null;\n}\n\n/** Credential-free normalized model request sent from an agent through the runner. */\nexport interface HarnessInferenceRequest {\n  requestId: string;\n  /** Exact initial, follow-up, or resume command whose budget this call consumes. */\n  interactionId?: string;\n  call: ChatInput;\n}\n\n/** Normalized model response plus auditable provider, policy, and token metadata. */\nexport interface HarnessInferenceResponse {\n  requestId: string;\n  response: OracleResponse;\n  receipt: {\n    provider: string;\n    model: string;\n    policyVersion: number;\n    inputTokens: number;\n    outputTokens: number;\n  };\n}\n\n/** Bounded, content-free session activity emitted by a Code runtime. Message\n * bodies are projected separately into the app's owner-private odla-db chat. */\nexport type CodeSessionEventData =\n  | { type: \"message\"; actor: \"agent\" | \"system\"; body: string }\n  | { type: \"diagnostic\"; level: \"error\"; message: string }\n  | { type: \"thinking\"; available: true; durationMs: number }\n  | { type: \"tool\"; phase: \"started\"; tool: HarnessToolName }\n  | { type: \"tool\"; phase: \"completed\"; tool: HarnessToolName; ok: boolean; durationMs: number }\n  | {\n      type: \"usage\"; provider: string; model: string;\n      inputTokens: number; outputTokens: number; durationMs: number;\n      interactionId?: string; interactionTokens?: number; interactionMaxTokens?: number;\n    }\n  | {\n      type: \"status\"; status: \"running\" | \"idle\" | \"failed\" | \"checkpointed\";\n      durationMs?: number;\n    };\n\n/** Registry-assigned cursor and timestamp for an owner-visible Code event. */\nexport type CodeSessionEvent = CodeSessionEventData & {\n  eventId: string; sequence: number; createdAt: number;\n};\n\n/** Closed set of effects an agent container may request from its trusted broker. */\nexport type HarnessToolName = \"sandbox.read\" | \"sandbox.apply_patch\" | \"sandbox.run_recipe\";\n/** Correlated, structured tool request emitted by an untrusted agent container. */\nexport interface HarnessToolRequest {\n  requestId: string;\n  tool: HarnessToolName;\n  input: Record<string, unknown>;\n}\n/** Bounded tool result returned to an agent after trusted policy evaluation. */\nexport interface HarnessToolResponse {\n  requestId: string;\n  ok: boolean;\n  content: string;\n  details?: Record<string, unknown>;\n}\n\n/** Validated JSONL message emitted by an untrusted agent container. */\nexport type HarnessAgentOutput =\n  | {\n      protocolVersion: typeof HARNESS_PROTOCOL_VERSION;\n      type: \"event\";\n      kind: string;\n      payload?: unknown;\n    }\n  | {\n      protocolVersion: typeof HARNESS_PROTOCOL_VERSION;\n      type: \"inference.request\";\n      requestId: string;\n      call: ChatInput;\n    }\n  | ({ protocolVersion: typeof HARNESS_PROTOCOL_VERSION; type: \"tool.request\" } & HarnessToolRequest)\n  | {\n      protocolVersion: typeof HARNESS_PROTOCOL_VERSION;\n      type: \"attempt.complete\";\n      status: \"completed\" | \"failed\" | \"cancelled\";\n      result?: unknown;\n    };\n\n/** JSONL command or inference result written by the trusted runner to an agent. */\nexport type HarnessAgentInput =\n  | {\n      protocolVersion: typeof HARNESS_PROTOCOL_VERSION;\n      type: \"task.start\";\n      task: HarnessTaskSpec;\n    }\n  | {\n      protocolVersion: typeof HARNESS_PROTOCOL_VERSION;\n      type: \"inference.response\";\n      requestId: string;\n      response: OracleResponse;\n    }\n  | ({ protocolVersion: typeof HARNESS_PROTOCOL_VERSION; type: \"tool.response\" } & HarnessToolResponse)\n  | {\n      protocolVersion: typeof HARNESS_PROTOCOL_VERSION;\n      type: \"attempt.cancel\";\n      reason: string;\n    };\n\n/** Terminal attempt report submitted by a runner to the control plane. */\nexport interface HarnessCompletion {\n  status: \"completed\" | \"failed\" | \"cancelled\";\n  result?: unknown;\n  patch?: string;\n  error?: string;\n}\n\n/** Operations a credentialed runner may perform against the harness control plane. */\nexport interface HarnessControlPlane {\n  lease(workspaces: string[]): Promise<HarnessLease | null>;\n  heartbeat(attemptId: string, leaseId: string): Promise<{ cancelRequested: boolean; expiresAt: number }>;\n  appendEvents(attemptId: string, leaseId: string, events: HarnessEventInput[]): Promise<void>;\n  infer(attemptId: string, leaseId: string, request: HarnessInferenceRequest): Promise<HarnessInferenceResponse>;\n  complete(attemptId: string, leaseId: string, completion: HarnessCompletion): Promise<void>;\n}\n\n/** Trusted inference bridge used to keep model credentials outside agent containers. */\nexport interface HarnessAiConnection {\n  infer(request: HarnessInferenceRequest): Promise<HarnessInferenceResponse>;\n}\n\n/** Trusted tool boundary. Implementations must evaluate CaMeL policy before effects. */\nexport interface HarnessToolBroker {\n  execute(\n    context: { lease: HarnessLease; workspaceDir: string; signal?: AbortSignal },\n    request: HarnessToolRequest,\n  ): Promise<HarnessToolResponse>;\n}\n","import type { ChatInput } from \"@odla-ai/ai\";\nimport {\n  HARNESS_PROTOCOL_VERSION,\n  type HarnessAgentInput,\n  type HarnessAgentOutput,\n  type HarnessEventInput,\n} from \"./types\";\n\nconst CONTROL = /[\\u0000-\\u0008\\u000b\\u000c\\u000e-\\u001f\\u007f]/;\n\n/** Error raised when an agent emits malformed, oversized, or unsupported protocol data. */\nexport class HarnessProtocolError extends Error {\n  override readonly name = \"HarnessProtocolError\";\n}\n\nfunction record(value: unknown): Record<string, unknown> | null {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value)\n    ? value as Record<string, unknown>\n    : null;\n}\n\nfunction boundedText(value: unknown, label: string, max: number): string {\n  if (typeof value !== \"string\" || !value || value.length > max || CONTROL.test(value)) {\n    throw new HarnessProtocolError(`${label} must be a non-empty string of at most ${max} characters`);\n  }\n  return value;\n}\n\n/** Parse and validate one newline-delimited message emitted by an agent container. */\nexport function parseAgentOutput(line: string): HarnessAgentOutput {\n  if (Buffer.byteLength(line, \"utf8\") > 1_000_000) throw new HarnessProtocolError(\"agent message exceeds 1 MB\");\n  let value: unknown;\n  try { value = JSON.parse(line); } catch { throw new HarnessProtocolError(\"agent emitted invalid JSON\"); }\n  const message = record(value);\n  if (!message || message.protocolVersion !== HARNESS_PROTOCOL_VERSION) {\n    throw new HarnessProtocolError(`agent protocolVersion must be ${HARNESS_PROTOCOL_VERSION}`);\n  }\n  if (message.type === \"event\") {\n    return {\n      protocolVersion: HARNESS_PROTOCOL_VERSION,\n      type: \"event\",\n      kind: boundedText(message.kind, \"event.kind\", 120),\n      ...(message.payload === undefined ? {} : { payload: message.payload }),\n    };\n  }\n  if (message.type === \"inference.request\") {\n    const call = record(message.call);\n    if (!call || !Array.isArray(call.messages) || !Number.isSafeInteger(call.maxTokens)) {\n      throw new HarnessProtocolError(\"inference.request.call requires messages and maxTokens\");\n    }\n    return {\n      protocolVersion: HARNESS_PROTOCOL_VERSION,\n      type: \"inference.request\",\n      requestId: boundedText(message.requestId, \"requestId\", 180),\n      call: call as unknown as ChatInput,\n    };\n  }\n  if (message.type === \"tool.request\") {\n    const input = record(message.input);\n    const tool = String(message.tool);\n    if (!input || ![\"sandbox.read\", \"sandbox.apply_patch\", \"sandbox.run_recipe\"].includes(tool)) {\n      throw new HarnessProtocolError(\"tool.request requires a registered tool and object input\");\n    }\n    return {\n      protocolVersion: HARNESS_PROTOCOL_VERSION,\n      type: \"tool.request\",\n      requestId: boundedText(message.requestId, \"requestId\", 180),\n      tool: tool as \"sandbox.read\" | \"sandbox.apply_patch\" | \"sandbox.run_recipe\",\n      input,\n    };\n  }\n  if (message.type === \"attempt.complete\") {\n    if (!new Set([\"completed\", \"failed\", \"cancelled\"]).has(String(message.status))) {\n      throw new HarnessProtocolError(\"attempt.complete.status is invalid\");\n    }\n    return {\n      protocolVersion: HARNESS_PROTOCOL_VERSION,\n      type: \"attempt.complete\",\n      status: message.status as \"completed\" | \"failed\" | \"cancelled\",\n      ...(message.result === undefined ? {} : { result: message.result }),\n    };\n  }\n  throw new HarnessProtocolError(\"agent message type is unsupported\");\n}\n\n/** Serialize one trusted runner message as a newline-terminated JSONL record. */\nexport function encodeAgentInput(message: HarnessAgentInput): string {\n  return `${JSON.stringify(message)}\\n`;\n}\n\n/** Create a timestamped, uniquely identified event for control-plane submission. */\nexport function makeHarnessEvent(\n  kind: string,\n  actor: HarnessEventInput[\"actor\"],\n  payload: unknown,\n  now = Date.now(),\n  id = crypto.randomUUID(),\n): HarnessEventInput {\n  boundedText(kind, \"event.kind\", 120);\n  return { eventId: id, kind, actor, payload, createdAt: now };\n}\n","import { execFile, spawn } from \"node:child_process\";\nimport { constants } from \"node:fs\";\nimport { access } from \"node:fs/promises\";\nimport { delimiter, join } from \"node:path\";\nimport { getgid, getuid } from \"node:process\";\nimport { encodeAgentInput, parseAgentOutput } from \"./protocol\";\nimport {\n  HARNESS_PROTOCOL_VERSION,\n  type HarnessAgentInput,\n  type HarnessAgentOutput,\n  type HarnessTaskSpec,\n} from \"./types\";\n\nconst DIGEST_IMAGE = /^[a-z0-9][a-z0-9._/-]*(?::[a-zA-Z0-9._-]+)?@sha256:[0-9a-f]{64}$/;\n\n/** Supported command-line container engines for isolated harness attempts. */\nexport type ContainerEngine = \"container\" | \"podman\" | \"docker\";\n\n/** Host facts and executable probe used while selecting a safe container engine. */\nexport interface ContainerEngineSelectionOptions {\n  platform?: NodeJS.Platform;\n  arch?: string;\n  uid?: number;\n  available?: (engine: ContainerEngine) => Promise<boolean>;\n}\n\n/** Host facts and rootless probe used to verify the selected engine boundary. */\nexport interface ContainerEngineVerificationOptions {\n  platform?: NodeJS.Platform;\n  arch?: string;\n  uid?: number;\n  podmanRootless?: () => Promise<boolean>;\n}\n\n/** Optional CPU, memory, process, and temporary-filesystem limits for an attempt. */\nexport interface ContainerLimits {\n  cpus?: number;\n  memory?: string;\n  pids?: number;\n  tmpfsBytes?: number;\n}\n\n/** Container, task, callback, and cancellation settings for one agent attempt. */\nexport interface ContainerRunOptions {\n  engine: ContainerEngine;\n  image: string;\n  workspaceDir: string;\n  workspaceAccess?: \"read-write\" | \"read-only\" | \"none\";\n  task: HarnessTaskSpec;\n  limits?: ContainerLimits;\n  allowUnpinnedImage?: boolean;\n  signal?: AbortSignal;\n  onMessage(message: HarnessAgentOutput): Promise<HarnessAgentInput | void>;\n  onStderr?(text: string): Promise<void> | void;\n}\n\n/** Terminal container outcome and bounded diagnostic output returned to the runner. */\nexport interface ContainerRunResult {\n  exitCode: number;\n  status: \"completed\" | \"failed\" | \"cancelled\";\n  result?: unknown;\n  stderr: string;\n}\n\n/** Require an immutable OCI image reference pinned to a SHA-256 digest. */\nexport function assertPinnedImage(image: string): void {\n  if (!DIGEST_IMAGE.test(image)) throw new TypeError(\"container image must be pinned by sha256 digest\");\n}\n\nasync function commandAvailable(engine: ContainerEngine): Promise<boolean> {\n  for (const directory of (process.env.PATH ?? \"\").split(delimiter).filter(Boolean)) {\n    try { await access(join(directory, engine), constants.X_OK); return true; } catch { /* try the next PATH entry */ }\n  }\n  return false;\n}\n\n/** Choose the strongest installed local default without silently selecting a\n * rootful Linux daemon. Apple container is a per-container VM boundary;\n * rootless Podman is the Linux default; Docker remains explicit. */\nexport async function selectContainerEngine(\n  requested: ContainerEngine | \"auto\" = \"auto\",\n  options: ContainerEngineSelectionOptions = {},\n): Promise<ContainerEngine> {\n  const platform = options.platform ?? process.platform;\n  const arch = options.arch ?? process.arch;\n  const uid = options.uid ?? (typeof getuid === \"function\" ? getuid() : 1000);\n  const available = options.available ?? commandAvailable;\n  const validate = async (engine: ContainerEngine): Promise<ContainerEngine> => {\n    if (engine === \"container\" && (platform !== \"darwin\" || arch !== \"arm64\")) {\n      throw new TypeError(\"Apple container requires Apple Silicon macOS\");\n    }\n    if (engine === \"podman\" && platform === \"linux\" && uid === 0) {\n      throw new TypeError(\"the Linux harness requires rootless Podman; do not run the runner as root\");\n    }\n    if (!(await available(engine))) throw new TypeError(`${engine} is not installed or executable`);\n    return engine;\n  };\n  if (requested !== \"auto\") return validate(requested);\n  const candidates: ContainerEngine[] = platform === \"darwin\"\n    ? arch === \"arm64\" ? [\"container\", \"podman\"] : [\"podman\"]\n    : platform === \"linux\" ? [\"podman\"] : [];\n  for (const engine of candidates) {\n    if (await available(engine)) return validate(engine);\n  }\n  if (platform === \"linux\") {\n    throw new TypeError(\"no rootless Podman found; install Podman or explicitly choose --engine docker after reviewing its daemon boundary\");\n  }\n  if (platform === \"darwin\") {\n    throw new TypeError(\"Apple container is not installed; on Apple Silicon macOS 26 run `brew install container`, then retry (Podman Machine is the fallback)\");\n  }\n  throw new TypeError(\"no supported container engine found\");\n}\n\nfunction inspectRootlessPodman(): Promise<boolean> {\n  return new Promise((resolve, reject) => {\n    execFile(\n      \"podman\",\n      [\"info\", \"--format\", \"{{.Host.Security.Rootless}}\"],\n      { encoding: \"utf8\", maxBuffer: 16 * 1024, timeout: 10_000 },\n      (error, stdout) => {\n        if (error) {\n          reject(new TypeError(\"could not verify that the active Podman service is rootless\"));\n          return;\n        }\n        resolve(stdout.trim() === \"true\");\n      },\n    );\n  });\n}\n\n/** Fail closed if the selected engine cannot provide the promised host\n * boundary. This is checked for every attempt so a changed Podman connection\n * cannot silently turn a rootless Linux runner into a rootful one. */\nexport async function verifyContainerEngineBoundary(\n  engine: ContainerEngine,\n  options: ContainerEngineVerificationOptions = {},\n): Promise<void> {\n  const platform = options.platform ?? process.platform;\n  const arch = options.arch ?? process.arch;\n  const uid = options.uid ?? (typeof getuid === \"function\" ? getuid() : 1000);\n  if (engine === \"container\" && (platform !== \"darwin\" || arch !== \"arm64\")) {\n    throw new TypeError(\"Apple container requires Apple Silicon macOS\");\n  }\n  if (engine !== \"podman\" || platform !== \"linux\") return;\n  if (uid === 0) throw new TypeError(\"the Linux harness requires rootless Podman; do not run the runner as root\");\n  const rootless = await (options.podmanRootless ?? inspectRootlessPodman)();\n  if (!rootless) throw new TypeError(\"the active Podman service is not rootless; refusing to run the harness\");\n}\n\n/** Build hardened, networkless engine arguments without starting the container. */\nexport function buildContainerRunArgs(options: Omit<ContainerRunOptions, \"onMessage\" | \"onStderr\" | \"signal\">): string[] {\n  if (!options.allowUnpinnedImage) assertPinnedImage(options.image);\n  if (/[,\\r\\n]/.test(options.workspaceDir)) throw new TypeError(\"workspace path contains unsupported mount characters\");\n  const uid = typeof getuid === \"function\" ? getuid() : 1000;\n  const gid = typeof getgid === \"function\" ? getgid() : 1000;\n  const safeAttempt = options.task.attemptId.toLowerCase().replace(/[^a-z0-9_.-]/g, \"-\").slice(0, 40);\n  const name = `odla-harness-${safeAttempt}-${crypto.randomUUID().slice(0, 8)}`;\n  const limits = options.limits ?? {};\n  const access = options.workspaceAccess ?? \"read-write\";\n  const appleMount = access === \"none\" ? [] : [`--mount=type=bind,source=${options.workspaceDir},target=/workspace${access === \"read-only\" ? \",readonly\" : \"\"}`];\n  const ociMount = access === \"none\" ? [] : [`--mount=type=bind,src=${options.workspaceDir},dst=/workspace${access === \"read-only\" ? \",readonly\" : \"\"}`];\n  if (options.engine === \"container\") {\n    return [\n      \"run\", \"--rm\", \"--interactive\", `--name=${name}`,\n      \"--network=none\", \"--read-only\", \"--cap-drop=ALL\",\n      `--memory=${limits.memory ?? \"1g\"}`, `--cpus=${limits.cpus ?? 1}`,\n      `--user=${uid}:${gid}`, \"--tmpfs=/tmp\",\n      ...appleMount,\n      \"--workdir=/workspace\", `--env=ODLA_HARNESS_PROTOCOL=${HARNESS_PROTOCOL_VERSION}`,\n      `--label=ai.odla.harness.attempt=${options.task.attemptId}`,\n      options.image,\n    ];\n  }\n  return [\n    \"run\", \"--rm\", \"--interactive\", `--name=${name}`, \"--pull=never\",\n    \"--network=none\", \"--read-only\", \"--cap-drop=ALL\",\n    \"--security-opt=no-new-privileges\", `--pids-limit=${limits.pids ?? 256}`,\n    `--memory=${limits.memory ?? \"1g\"}`, `--cpus=${limits.cpus ?? 1}`,\n    `--user=${uid}:${gid}`,\n    `--tmpfs=/tmp:rw,noexec,nosuid,nodev,size=${limits.tmpfsBytes ?? 64 * 1024 * 1024}`,\n    ...ociMount,\n    \"--workdir=/workspace\", `--env=ODLA_HARNESS_PROTOCOL=${HARNESS_PROTOCOL_VERSION}`,\n    `--label=ai.odla.harness.attempt=${options.task.attemptId}`,\n    options.image,\n  ];\n}\n\nfunction containerName(args: string[]): string {\n  return args.find((arg) => arg.startsWith(\"--name=\"))!.slice(\"--name=\".length);\n}\n\n/** Execute one JSONL agent inside a hardened Apple container, Podman, or Docker\n * boundary. The\n * container has no network and receives no credentials; inference requests are\n * bridged over stdin/stdout to the trusted runner process. */\nexport async function runContainerAttempt(options: ContainerRunOptions): Promise<ContainerRunResult> {\n  if (options.signal?.aborted) return { exitCode: 1, status: \"cancelled\", stderr: \"\" };\n  await verifyContainerEngineBoundary(options.engine);\n  const args = buildContainerRunArgs(options);\n  const name = containerName(args);\n  const child = spawn(options.engine, args, { stdio: [\"pipe\", \"pipe\", \"pipe\"], shell: false });\n  let stderr = \"\";\n  let outputBytes = 0;\n  let complete: Extract<HarnessAgentOutput, { type: \"attempt.complete\" }> | null = null;\n  let stopped = false;\n  let exited = false;\n\n  child.stderr.setEncoding(\"utf8\");\n  child.stderr.on(\"data\", (text: string) => {\n    if (stderr.length < 64 * 1024) stderr += text.slice(0, 64 * 1024 - stderr.length);\n  });\n\n  const stop = (reason: string) => {\n    if (stopped || exited) return;\n    stopped = true;\n    if (!child.stdin.destroyed) {\n      const cancel: HarnessAgentInput = { protocolVersion: HARNESS_PROTOCOL_VERSION, type: \"attempt.cancel\", reason };\n      child.stdin.write(encodeAgentInput(cancel));\n    }\n    const removeArgs = options.engine === \"container\" ? [\"delete\", \"--force\", name] : [\"rm\", \"-f\", name];\n    const killer = spawn(options.engine, removeArgs, { stdio: \"ignore\", shell: false });\n    killer.unref();\n  };\n  const abort = () => stop(\"runner_cancelled\");\n  options.signal?.addEventListener(\"abort\", abort, { once: true });\n\n  const timeout = setTimeout(() => stop(\"timeout\"), options.task.policy.timeoutMs);\n  const start: HarnessAgentInput = { protocolVersion: HARNESS_PROTOCOL_VERSION, type: \"task.start\", task: options.task };\n  if (!stopped && !options.signal?.aborted) child.stdin.write(encodeAgentInput(start));\n\n  const consume = (async () => {\n    let pending = Buffer.alloc(0);\n    const handleLine = async (raw: Buffer) => {\n      const bytes = raw.at(-1) === 13 ? raw.subarray(0, -1) : raw;\n      if (bytes.byteLength > 1_000_000) throw new Error(\"agent message exceeds 1 MB\");\n      const line = bytes.toString(\"utf8\");\n      if (!line.trim()) return;\n      const message = parseAgentOutput(line);\n      if (message.type === \"attempt.complete\") complete = message;\n      const response = await options.onMessage(message);\n      if (response && !child.stdin.destroyed) child.stdin.write(encodeAgentInput(response));\n    };\n    try {\n      for await (const raw of child.stdout) {\n        const chunk = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);\n        outputBytes += chunk.byteLength;\n        if (outputBytes > options.task.policy.maxOutputBytes) {\n          throw new Error(`agent output exceeds ${options.task.policy.maxOutputBytes} bytes`);\n        }\n        pending = Buffer.concat([pending, chunk]);\n        let newline = pending.indexOf(10);\n        while (newline >= 0) {\n          await handleLine(pending.subarray(0, newline));\n          pending = pending.subarray(newline + 1);\n          newline = pending.indexOf(10);\n        }\n        if (pending.byteLength > 1_000_000) throw new Error(\"agent message exceeds 1 MB\");\n      }\n      if (pending.byteLength) await handleLine(pending);\n    } catch (error) {\n      stop(\"protocol_error\");\n      throw error;\n    }\n  })();\n\n  const exit = new Promise<number>((accept, reject) => {\n    child.once(\"error\", reject);\n    child.once(\"exit\", (code) => { exited = true; accept(code ?? 1); });\n  });\n  try {\n    const [exitCode] = await Promise.all([exit, consume]);\n    if (stderr && options.onStderr) await options.onStderr(stderr);\n    if (options.signal?.aborted) return { exitCode, status: \"cancelled\", stderr };\n    const terminal = complete as Extract<HarnessAgentOutput, { type: \"attempt.complete\" }> | null;\n    if (!terminal) return { exitCode, status: \"failed\", result: { error: \"agent exited without completion\" }, stderr };\n    return { exitCode, status: exitCode === 0 ? terminal.status : \"failed\", result: terminal.result, stderr };\n  } catch (error) {\n    stop(\"runner_error\");\n    await exit.catch(() => 1);\n    throw error;\n  } finally {\n    clearTimeout(timeout);\n    options.signal?.removeEventListener(\"abort\", abort);\n  }\n}\n","import { mkdir, mkdtemp, realpath, rm, writeFile } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join, resolve, sep } from \"node:path\";\nimport { spawn } from \"node:child_process\";\nimport { allowedWorkspacePath } from \"./workspace-policy\";\nimport type { StageWorkspaceOptions } from \"./workspace\";\n\n/** Disposable, filtered materialization of one committed Git tree. */\nexport interface MaterializedGitTree {\n  root: string;\n  sourceDir: string;\n  fileCount: number;\n  byteCount: number;\n  cleanup(): Promise<void>;\n}\n\nasync function gitOutput(cwd: string, args: string[], maxBytes: number): Promise<Buffer> {\n  const child = spawn(\"git\", args, { cwd, stdio: [\"ignore\", \"pipe\", \"pipe\"], shell: false });\n  const stdout: Buffer[] = [];\n  const stderr: Buffer[] = [];\n  let bytes = 0;\n  child.stdout.on(\"data\", (chunk: Buffer) => {\n    bytes += chunk.byteLength;\n    if (bytes > maxBytes) child.kill(\"SIGKILL\");\n    else stdout.push(chunk);\n  });\n  child.stderr.on(\"data\", (chunk: Buffer) => {\n    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16_384) stderr.push(chunk);\n  });\n  const code = await new Promise<number | null>((accept, reject) => {\n    child.once(\"error\", reject);\n    child.once(\"exit\", accept);\n  });\n  if (bytes > maxBytes) throw new Error(`git output exceeds ${maxBytes} bytes`);\n  if (code !== 0) throw new Error(`git command failed: ${Buffer.concat(stderr).toString(\"utf8\").slice(0, 1_000)}`);\n  return Buffer.concat(stdout);\n}\n\nasync function gitBlobs(cwd: string, entries: Array<{ hash: string }>, maxBytes: number): Promise<Buffer[]> {\n  const child = spawn(\"git\", [\"cat-file\", \"--batch\"], { cwd, stdio: [\"pipe\", \"pipe\", \"pipe\"], shell: false });\n  const stdout: Buffer[] = [];\n  const stderr: Buffer[] = [];\n  let bytes = 0;\n  child.stdout.on(\"data\", (chunk: Buffer) => {\n    bytes += chunk.byteLength;\n    if (bytes > maxBytes + entries.length * 100) child.kill(\"SIGKILL\");\n    else stdout.push(chunk);\n  });\n  child.stderr.on(\"data\", (chunk: Buffer) => {\n    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16_384) stderr.push(chunk);\n  });\n  child.stdin.end(`${entries.map((entry) => entry.hash).join(\"\\n\")}\\n`);\n  const code = await new Promise<number | null>((accept, reject) => {\n    child.once(\"error\", reject);\n    child.once(\"exit\", accept);\n  });\n  if (bytes > maxBytes + entries.length * 100) throw new Error(`Git tree exceeds ${maxBytes} bytes`);\n  if (code !== 0) throw new Error(`git object read failed: ${Buffer.concat(stderr).toString(\"utf8\").slice(0, 1_000)}`);\n  const output = Buffer.concat(stdout);\n  const blobs: Buffer[] = [];\n  let offset = 0;\n  let total = 0;\n  for (const entry of entries) {\n    const newline = output.indexOf(0x0a, offset);\n    if (newline < 0) throw new Error(\"git object output is truncated\");\n    const match = /^([0-9a-f]{40,64}) blob ([0-9]+)$/.exec(output.subarray(offset, newline).toString(\"utf8\"));\n    if (!match || match[1] !== entry.hash) throw new Error(\"git object output does not match its inventory\");\n    const length = Number(match[2]);\n    if (!Number.isSafeInteger(length) || length < 0 || newline + 1 + length >= output.length) {\n      throw new Error(\"git object output has an invalid length\");\n    }\n    const content = output.subarray(newline + 1, newline + 1 + length);\n    if (output[newline + 1 + length] !== 0x0a) throw new Error(\"git object output is malformed\");\n    total += content.byteLength;\n    if (total > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);\n    blobs.push(content);\n    offset = newline + 1 + length + 1;\n  }\n  return blobs;\n}\n\n/** Materialize ordinary files from an exact commit without copying secrets,\n * symlinks, ignored local files, or Git metadata. */\nexport async function materializeGitTree(\n  source: string, commitSha: string,\n  options: Pick<StageWorkspaceOptions, \"maxFiles\" | \"maxBytes\" | \"tempRoot\"> = {},\n): Promise<MaterializedGitTree> {\n  if (!/^[0-9a-f]{40}$/.test(commitSha)) throw new TypeError(\"Git tree requires an exact commit SHA\");\n  const sourceDir = await realpath(resolve(source));\n  const maxFiles = options.maxFiles ?? 20_000;\n  const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;\n  const inventory = (await gitOutput(sourceDir, [\"ls-tree\", \"-rz\", commitSha], 16 * 1024 * 1024))\n    .toString(\"utf8\").split(\"\\0\").filter(Boolean);\n  const entries = inventory.flatMap((record) => {\n    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\\t([\\s\\S]+)$/.exec(record);\n    return match && allowedWorkspacePath(match[3]!)\n      ? [{ mode: match[1]!, hash: match[2]!, path: match[3]! }]\n      : [];\n  });\n  if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);\n  const root = await mkdtemp(join(options.tempRoot ?? tmpdir(), \"odla-git-tree-\"));\n  const targetRoot = join(root, \"source\");\n  await mkdir(targetRoot);\n  let byteCount = 0;\n  try {\n    const blobs = await gitBlobs(sourceDir, entries, maxBytes);\n    for (const [index, entry] of entries.entries()) {\n      const content = blobs[index]!;\n      byteCount += content.byteLength;\n      if (byteCount > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);\n      const target = resolve(targetRoot, entry.path);\n      if (!target.startsWith(`${resolve(targetRoot)}${sep}`)) throw new TypeError(\"Git tree path escapes workspace\");\n      await mkdir(resolve(target, \"..\"), { recursive: true });\n      await writeFile(target, content, { flag: \"wx\", mode: entry.mode === \"100755\" ? 0o755 : 0o644 });\n    }\n    return { root, sourceDir: targetRoot, fileCount: entries.length, byteCount,\n      cleanup: () => rm(root, { recursive: true, force: true }) };\n  } catch (error) {\n    await rm(root, { recursive: true, force: true });\n    throw error;\n  }\n}\n","import { isAbsolute } from \"node:path\";\n\nexport const SKIP_WORKSPACE_DIRS = new Set([\n  \".git\", \".odla\", \".wrangler\", \"node_modules\", \"dist\", \"coverage\",\n]);\nexport const SECRET_WORKSPACE_FILE = /^(?:\\.env(?:\\..+)?|\\.dev\\.vars|\\.dev-token(?:\\..+)?|credentials(?:\\..+)?\\.json|dev-token(?:\\..+)?(?:\\.json)?)$/i;\n\n/** Reject paths that are unsafe or reserved at either the local or Git-tree boundary. */\nexport function allowedWorkspacePath(relativePath: string): boolean {\n  const parts = relativePath.split(\"/\");\n  return !isAbsolute(relativePath) && !relativePath.includes(\"\\\\\") && !relativePath.includes(\"\\0\")\n    && !parts.some((part) => !part || part === \".\" || part === \"..\" || SKIP_WORKSPACE_DIRS.has(part))\n    && !SECRET_WORKSPACE_FILE.test(parts.at(-1) ?? \"\");\n}\n","import { chmod, copyFile, lstat, mkdir, mkdtemp, readdir, realpath, rm, stat } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { basename, join, relative, resolve, sep } from \"node:path\";\nimport { spawn } from \"node:child_process\";\nimport { allowedWorkspacePath, SECRET_WORKSPACE_FILE, SKIP_WORKSPACE_DIRS } from \"./workspace-policy\";\nexport { materializeGitTree, type MaterializedGitTree } from \"./workspace-git-tree\";\n\n/** File, byte, and temporary-directory limits applied while staging a workspace. */\nexport interface StageWorkspaceOptions {\n  maxFiles?: number;\n  maxBytes?: number;\n  tempRoot?: string;\n  /** Stage tracked files plus non-ignored untracked files from a Git checkout. */\n  gitTrackedAndUnignored?: boolean;\n}\n\n/** Disposable baseline and mutable workspace copy used to generate a bounded patch. */\nexport interface StagedWorkspace {\n  root: string;\n  baselineDir: string;\n  workspaceDir: string;\n  fileCount: number;\n  byteCount: number;\n  patch(maxBytes: number): Promise<string>;\n  cleanup(): Promise<void>;\n}\n\ninterface SourceFile {\n  source: string;\n  relativePath: string;\n  mode: number;\n  bytes: number;\n}\n\nasync function sourceFiles(sourceDir: string, maxFiles: number, maxBytes: number): Promise<SourceFile[]> {\n  const files: SourceFile[] = [];\n  let bytes = 0;\n  const walk = async (dir: string): Promise<void> => {\n    for (const entry of await readdir(dir, { withFileTypes: true })) {\n      if (entry.isDirectory() && SKIP_WORKSPACE_DIRS.has(entry.name)) continue;\n      if (!entry.isDirectory() && SECRET_WORKSPACE_FILE.test(entry.name)) continue;\n      const path = join(dir, entry.name);\n      if (entry.isSymbolicLink()) continue;\n      if (entry.isDirectory()) {\n        await walk(path);\n        continue;\n      }\n      if (!entry.isFile()) continue;\n      const metadata = await stat(path);\n      bytes += metadata.size;\n      if (files.length + 1 > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);\n      if (bytes > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);\n      files.push({\n        source: path,\n        relativePath: relative(sourceDir, path),\n        mode: metadata.mode & 0o777,\n        bytes: metadata.size,\n      });\n    }\n  };\n  await walk(sourceDir);\n  return files.sort((left, right) => left.relativePath.localeCompare(right.relativePath));\n}\n\nasync function gitSourceFiles(sourceDir: string, maxFiles: number, maxBytes: number): Promise<SourceFile[]> {\n  const child = spawn(\"git\", [\"ls-files\", \"-z\", \"--cached\", \"--others\", \"--exclude-standard\"], {\n    cwd: sourceDir, stdio: [\"ignore\", \"pipe\", \"pipe\"], shell: false,\n  });\n  const stdout: Buffer[] = [];\n  const stderr: Buffer[] = [];\n  let outputBytes = 0;\n  child.stdout.on(\"data\", (chunk: Buffer) => {\n    outputBytes += chunk.byteLength;\n    if (outputBytes > 8 * 1024 * 1024) child.kill(\"SIGKILL\");\n    else stdout.push(chunk);\n  });\n  child.stderr.on(\"data\", (chunk: Buffer) => {\n    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16_384) stderr.push(chunk);\n  });\n  const code = await new Promise<number | null>((accept, reject) => {\n    child.once(\"error\", reject);\n    child.once(\"exit\", accept);\n  });\n  if (outputBytes > 8 * 1024 * 1024) throw new Error(\"git file inventory exceeds 8 MiB\");\n  if (code !== 0) throw new Error(`git file inventory failed: ${Buffer.concat(stderr).toString(\"utf8\").slice(0, 1_000)}`);\n  const paths = Buffer.concat(stdout).toString(\"utf8\").split(\"\\0\").filter(Boolean).sort();\n  if (paths.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);\n  const root = resolve(sourceDir);\n  const files: SourceFile[] = [];\n  let bytes = 0;\n  for (const relativePath of paths) {\n    if (!allowedWorkspacePath(relativePath)) continue;\n    const source = resolve(root, relativePath);\n    if (!source.startsWith(`${root}${sep}`)) throw new TypeError(\"git file path escapes workspace\");\n    let metadata;\n    try { metadata = await lstat(source); }\n    catch (error) {\n      if ((error as NodeJS.ErrnoException).code === \"ENOENT\") continue;\n      throw error;\n    }\n    if (metadata.isSymbolicLink() || !metadata.isFile()) continue;\n    bytes += metadata.size;\n    if (bytes > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);\n    files.push({ source, relativePath, mode: metadata.mode & 0o777, bytes: metadata.size });\n  }\n  return files;\n}\n\nasync function copyTree(files: SourceFile[], destination: string): Promise<void> {\n  for (const file of files) {\n    const target = join(destination, file.relativePath);\n    await mkdir(resolve(target, \"..\"), { recursive: true });\n    await copyFile(file.source, target);\n    await chmod(target, file.mode);\n  }\n}\n\nasync function captureGitDiff(root: string, maxBytes: number): Promise<string> {\n  const child = spawn(\"git\", [\n    \"diff\", \"--no-index\", \"--binary\", \"--no-ext-diff\",\n    \"--src-prefix=a/\", \"--dst-prefix=b/\", \"--\", \"baseline\", \"workspace\",\n  ], { cwd: root, stdio: [\"ignore\", \"pipe\", \"pipe\"], shell: false });\n  const stdout: Buffer[] = [];\n  const stderr: Buffer[] = [];\n  let bytes = 0;\n  child.stdout.on(\"data\", (chunk: Buffer) => {\n    bytes += chunk.byteLength;\n    if (bytes > maxBytes) child.kill(\"SIGKILL\");\n    else stdout.push(chunk);\n  });\n  child.stderr.on(\"data\", (chunk: Buffer) => {\n    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16_384) stderr.push(chunk);\n  });\n  const code = await new Promise<number | null>((accept, reject) => {\n    child.once(\"error\", reject);\n    child.once(\"exit\", accept);\n  });\n  if (bytes > maxBytes) throw new Error(`patch exceeds ${maxBytes} bytes`);\n  if (code !== 0 && code !== 1) {\n    throw new Error(`git diff failed: ${Buffer.concat(stderr).toString(\"utf8\").slice(0, 1_000)}`);\n  }\n  return Buffer.concat(stdout).toString(\"utf8\")\n    .replaceAll(\"a/baseline/\", \"a/\")\n    .replaceAll(\"a/workspace/\", \"a/\")\n    .replaceAll(\"b/baseline/\", \"b/\")\n    .replaceAll(\"b/workspace/\", \"b/\")\n    .replaceAll(\"--- a/baseline\", \"--- a\")\n    .replaceAll(\"+++ b/workspace\", \"+++ b\");\n}\n\n/** Copy a bounded, secret-filtered workspace twice: one immutable baseline and\n * one disposable directory mounted into the container. The developer checkout\n * itself is never mounted. */\nexport async function stageWorkspace(source: string, options: StageWorkspaceOptions = {}): Promise<StagedWorkspace> {\n  const sourceDir = await realpath(resolve(source));\n  const sourceStat = await stat(sourceDir);\n  if (!sourceStat.isDirectory()) throw new TypeError(\"workspace source must be a directory\");\n  const root = await mkdtemp(join(options.tempRoot ?? tmpdir(), \"odla-harness-\"));\n  const baselineDir = join(root, \"baseline\");\n  const workspaceDir = join(root, \"workspace\");\n  await Promise.all([mkdir(baselineDir), mkdir(workspaceDir)]);\n  try {\n    const maxFiles = options.maxFiles ?? 20_000;\n    const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;\n    const files = options.gitTrackedAndUnignored\n      ? await gitSourceFiles(sourceDir, maxFiles, maxBytes)\n      : await sourceFiles(sourceDir, maxFiles, maxBytes);\n    await Promise.all([copyTree(files, baselineDir), copyTree(files, workspaceDir)]);\n    return {\n      root,\n      baselineDir,\n      workspaceDir,\n      fileCount: files.length,\n      byteCount: files.reduce((sum, file) => sum + file.bytes, 0),\n      patch: (maxBytes) => captureGitDiff(root, maxBytes),\n      cleanup: () => rm(root, { recursive: true, force: true }),\n    };\n  } catch (error) {\n    await rm(root, { recursive: true, force: true });\n    throw error;\n  }\n}\n\n/** Create a disposable workspace whose diff base and initial editable tree\n * intentionally come from different already-filtered sources. */\nexport async function stageWorkspacePair(\n  baselineSource: string, workspaceSource: string, options: StageWorkspaceOptions = {},\n): Promise<StagedWorkspace> {\n  const baselineDirSource = await realpath(resolve(baselineSource));\n  const workspaceDirSource = await realpath(resolve(workspaceSource));\n  const maxFiles = options.maxFiles ?? 20_000;\n  const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;\n  const [baselineFiles, workspaceFiles] = await Promise.all([\n    sourceFiles(baselineDirSource, maxFiles, maxBytes),\n    sourceFiles(workspaceDirSource, maxFiles, maxBytes),\n  ]);\n  const root = await mkdtemp(join(options.tempRoot ?? tmpdir(), \"odla-harness-\"));\n  const baselineDir = join(root, \"baseline\");\n  const workspaceDir = join(root, \"workspace\");\n  await Promise.all([mkdir(baselineDir), mkdir(workspaceDir)]);\n  try {\n    await Promise.all([copyTree(baselineFiles, baselineDir), copyTree(workspaceFiles, workspaceDir)]);\n    return {\n      root, baselineDir, workspaceDir,\n      fileCount: workspaceFiles.length,\n      byteCount: workspaceFiles.reduce((sum, file) => sum + file.bytes, 0),\n      patch: (maxPatchBytes) => captureGitDiff(root, maxPatchBytes),\n      cleanup: () => rm(root, { recursive: true, force: true }),\n    };\n  } catch (error) {\n    await rm(root, { recursive: true, force: true });\n    throw error;\n  }\n}\n\n/** Convert a path-like value into a bounded lowercase label safe for runner metadata. */\nexport function safeWorkspaceLabel(value: string): string {\n  const label = basename(value).toLowerCase().replace(/[^a-z0-9_-]+/g, \"-\").replace(/^-+|-+$/g, \"\");\n  if (!label) throw new TypeError(\"workspace label is empty\");\n  return label.slice(0, 80);\n}\n","import { createHash } from \"node:crypto\";\nimport { readFile, readdir } from \"node:fs/promises\";\nimport { relative, resolve } from \"node:path\";\n\n/** Digest every regular path and byte in a staged workspace under fixed bounds. */\nexport async function digestStagedWorkspace(\n  root: string,\n  limits: { maxFiles: number; maxBytes: number },\n): Promise<`sha256:${string}`> {\n  const files: Array<{ path: string; target: string }> = [];\n  const walk = async (directory: string): Promise<void> => {\n    const entries = await readdir(directory, { withFileTypes: true });\n    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {\n      if (entry.isSymbolicLink()) throw new TypeError(\"workspace digest refuses symbolic links\");\n      const target = resolve(directory, entry.name);\n      if (entry.isDirectory()) await walk(target);\n      else if (entry.isFile()) {\n        files.push({ path: relative(root, target).split(\"\\\\\").join(\"/\"), target });\n        if (files.length > limits.maxFiles) throw new TypeError(\"workspace digest exceeds its file bound\");\n      }\n    }\n  };\n  await walk(resolve(root));\n  const hash = createHash(\"sha256\");\n  let bytes = 0;\n  for (const file of files.sort((left, right) => left.path.localeCompare(right.path))) {\n    const content = await readFile(file.target);\n    bytes += Buffer.byteLength(file.path) + content.byteLength;\n    if (bytes > limits.maxBytes) throw new TypeError(\"workspace digest exceeds its byte bound\");\n    hash.update(`${Buffer.byteLength(file.path)}:${file.path}:${content.byteLength}:`);\n    hash.update(content);\n  }\n  return `sha256:${hash.digest(\"hex\")}`;\n}\n","import { digestCodeRepositorySnapshot } from \"@odla-ai/camel/code\";\nimport {\n  CODE_RUNTIME_PROTOCOL_VERSION, type CodeRuntimeAgentControlPlane, type CodeRuntimeBinding,\n  type CodeRuntimeCandidateResponse, type CodeRuntimeCapabilities, type CodeRuntimeCommand, type CodeRuntimeSnapshot,\n  type CodeRuntimeReviewResponse, type CodeRuntimeSourceSnapshot,\n} from \"./code-runtime\";\nimport type { HarnessInferenceResponse } from \"./types\";\n\n/** Stable HTTP and transport error returned by the remote Code control plane. */\nexport class CodeRuntimeControlError extends Error {\n  override readonly name = \"CodeRuntimeControlError\";\n  constructor(message: string, readonly status: number, readonly code = \"control_error\") { super(message); }\n}\n\n/** Endpoint, host credential, timeout, and cancellation settings for a Code runtime client. */\nexport interface CodeRuntimeClientOptions {\n  endpoint: string; token: string; fetch?: typeof fetch;\n  /** Timeout for short control-plane operations such as heartbeats and events. */\n  requestTimeoutMs?: number;\n  /** Timeout for provider-backed inference and review calls. */\n  modelRequestTimeoutMs?: number;\n  signal?: AbortSignal;\n}\n\n/** Create the credentialed, outbound-only Code host control client. */\nexport function createCodeRuntimeControlClient(options: CodeRuntimeClientOptions): CodeRuntimeAgentControlPlane {\n  const endpoint = validatedEndpoint(options.endpoint);\n  if (!/^odla_code_host_[0-9a-f]{64}$/.test(options.token)) throw new TypeError(\"invalid Code host credential\");\n  const requestTimeoutMs = options.requestTimeoutMs ?? 30_000;\n  if (!Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 1_000 || requestTimeoutMs > 120_000) {\n    throw new TypeError(\"requestTimeoutMs must be an integer from 1000 to 120000\");\n  }\n  const modelRequestTimeoutMs = options.modelRequestTimeoutMs ?? 15 * 60_000;\n  if (!Number.isSafeInteger(modelRequestTimeoutMs)\n    || modelRequestTimeoutMs < 30_000 || modelRequestTimeoutMs > 30 * 60_000) {\n    throw new TypeError(\"modelRequestTimeoutMs must be an integer from 30000 to 1800000\");\n  }\n  const request = options.fetch ?? fetch;\n  const call = async (path: string, body: unknown, timeoutMs = requestTimeoutMs): Promise<unknown> => {\n    const timeout = AbortSignal.timeout(timeoutMs);\n    const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;\n    let response: Response;\n    try {\n      response = await request(`${endpoint}${path}`, {\n        method: \"POST\", headers: { authorization: `Bearer ${options.token}`, \"content-type\": \"application/json\" },\n        body: JSON.stringify(body), redirect: \"error\", signal,\n      });\n    } catch (cause) {\n      if (options.signal?.aborted) throw cause;\n      throw new CodeRuntimeControlError(\"Code runtime control plane is unavailable\", 503, \"transport_unavailable\");\n    }\n    const value = await response.json().catch(() => null);\n    if (!response.ok) {\n      const problem = record(record(value)?.error);\n      throw new CodeRuntimeControlError(\n        typeof problem?.message === \"string\" ? problem.message : `Code runtime request failed (${response.status})`,\n        response.status, typeof problem?.code === \"string\" ? problem.code : undefined,\n      );\n    }\n    return value;\n  };\n  return {\n    heartbeat: async (version, capabilities) => {\n      validateHeartbeat(version, capabilities);\n      return parseSnapshot(await call(\"/registry/code/runtime/heartbeat\", { runtimeVersion: version, capabilities }));\n    },\n    acknowledge: async (commandId, result) => {\n      if (!/^ccmd_[0-9a-f]{32}$/.test(commandId)) throw new TypeError(\"invalid Code runtime command id\");\n      await call(`/registry/code/runtime/commands/${commandId}/ack`, result);\n    },\n    source: async (sessionId) => parseSource(\n      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/source`, {}),\n    ),\n    infer: async (sessionId, inference) => {\n      const value = record(await call(\n        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/inference`, inference, modelRequestTimeoutMs,\n      ));\n      if (!value || value.requestId !== inference.requestId || !record(value.response) || !record(value.receipt)) {\n        throw new CodeRuntimeControlError(\"invalid Code inference response\", 502, \"invalid_response\");\n      }\n      return value as unknown as HarnessInferenceResponse;\n    },\n    review: async (sessionId, review) => parseReview(\n      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/review`, review, modelRequestTimeoutMs),\n    ),\n    submitCandidate: async (sessionId, checkpointId, verification) => {\n      if (!/^cpoint_[0-9a-f]{32}$/.test(checkpointId)) throw new TypeError(\"invalid Code checkpoint id\");\n      return parseCandidate(await call(\n        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/candidates`,\n        { checkpointId, verification },\n      ));\n    },\n    appendSessionEvent: async (sessionId, eventId, event) => {\n      const serialized = JSON.stringify(event);\n      if (!/^[A-Za-z0-9._:-]{1,120}$/.test(eventId) || !event || typeof event !== \"object\"\n        || new TextEncoder().encode(serialized).byteLength > 24_000) {\n        throw new TypeError(\"invalid Code session event\");\n      }\n      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/chat/events`, { eventId, event });\n    },\n    reportSessionFailure: async (sessionId, message) => {\n      if (!message.trim() || message.length > 2_000) throw new TypeError(\"invalid Code session failure\");\n      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message });\n    },\n  };\n}\n\nfunction validatedEndpoint(value: string): string {\n  const endpoint = value.replace(/\\/+$/, \"\");\n  let url: URL;\n  try { url = new URL(endpoint); } catch { throw new TypeError(\"endpoint must be an HTTPS URL\"); }\n  const loopback = url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\" || url.hostname === \"[::1]\";\n  if (url.username || url.password || (url.protocol !== \"https:\" && !(loopback && url.protocol === \"http:\"))) {\n    throw new TypeError(\"endpoint must use HTTPS (HTTP is allowed only for loopback testing)\");\n  }\n  return endpoint;\n}\n\nfunction validSessionId(value: string): string {\n  if (!/^csess_[0-9a-f]{32}$/.test(value)) throw new TypeError(\"invalid Code session id\");\n  return value;\n}\n\nfunction validateHeartbeat(version: string, capabilities: CodeRuntimeCapabilities): void {\n  if (!version.trim() || version.length > 80) throw new TypeError(\"runtimeVersion is required and at most 80 characters\");\n  if (capabilities.protocolVersion !== CODE_RUNTIME_PROTOCOL_VERSION) throw new TypeError(\"unsupported Code runtime protocol version\");\n  if (capabilities.platform !== \"macos\" && capabilities.platform !== \"linux\") throw new TypeError(\"invalid runtime platform\");\n  if (!capabilities.arch || !capabilities.engines.length\n    || !capabilities.engines.every((engine) => [\"container\", \"podman\", \"docker\"].includes(engine))) {\n    throw new TypeError(\"runtime arch and supported engine are required\");\n  }\n  if (!Number.isSafeInteger(capabilities.cpuCount) || capabilities.cpuCount < 1\n    || !Number.isSafeInteger(capabilities.memoryBytes) || capabilities.memoryBytes < 1) {\n    throw new TypeError(\"runtime resources must be positive integers\");\n  }\n}\n\nfunction parseSnapshot(value: unknown): CodeRuntimeSnapshot {\n  const root = record(value);\n  const host = record(root?.host);\n  if (!host || typeof host.hostId !== \"string\" || typeof host.runtimeVersion !== \"string\"\n    || !Number.isSafeInteger(host.lastSeenAt) || host.revokedAt !== null\n    || !Array.isArray(root?.bindings) || root.bindings.length > 1_024\n    || !Array.isArray(root?.commands) || root.commands.length > 64) throw invalid(\"heartbeat\");\n  const bindingIds = new Set<string>();\n  const bindings = root.bindings.map((item) => {\n    const binding = record(item);\n    if (!binding || typeof binding.bindingId !== \"string\" || typeof binding.appId !== \"string\"\n      || (binding.env !== \"dev\" && binding.env !== \"prod\")\n      || typeof binding.offerId !== \"string\" || binding.hostId !== host.hostId\n      || !Number.isSafeInteger(binding.generation) || Number(binding.generation) < 1 || binding.revokedAt !== null\n      || bindingIds.has(binding.bindingId)) {\n      throw invalid(\"binding\");\n    }\n    bindingIds.add(binding.bindingId);\n    return binding as unknown as CodeRuntimeBinding;\n  });\n  const commandIds = new Set<string>();\n  const commandSequences = new Set<string>();\n  const commands = root.commands.map((item) => {\n    const command = record(item);\n    const binding = bindings.find((candidate) => candidate.bindingId === command?.bindingId);\n    const sequenceKey = `${String(command?.instanceId)}:${String(command?.sequence)}`;\n    if (!command || typeof command.commandId !== \"string\" || !/^ccmd_[0-9a-f]{32}$/.test(command.commandId)\n      || typeof command.instanceId !== \"string\" || typeof command.sessionId !== \"string\"\n      || !/^csess_[0-9a-f]{32}$/.test(command.sessionId)\n      || typeof command.appId !== \"string\" || (command.env !== \"dev\" && command.env !== \"prod\")\n      || command.hostId !== host.hostId || !binding || binding.appId !== command.appId\n      || binding.generation !== command.bindingGeneration || !Number.isSafeInteger(command.sequence)\n      || Number(command.sequence) < 1 || commandIds.has(command.commandId) || commandSequences.has(sequenceKey)\n      || ![\"start\", \"prompt\", \"checkpoint_stop\", \"resume\"].includes(String(command.kind))\n      || !record(command.payload) || !Number.isSafeInteger(command.createdAt)) throw invalid(\"command\");\n    commandIds.add(command.commandId);\n    commandSequences.add(sequenceKey);\n    return command as unknown as CodeRuntimeCommand;\n  });\n  return { host: host as unknown as CodeRuntimeSnapshot[\"host\"], bindings, commands };\n}\n\nasync function parseSource(value: unknown): Promise<CodeRuntimeSourceSnapshot> {\n  const snapshot = record(record(value)?.snapshot);\n  if (!snapshot || typeof snapshot.repository !== \"string\" || typeof snapshot.commitSha !== \"string\"\n    || typeof snapshot.treeDigest !== \"string\" || !Array.isArray(snapshot.files)) throw invalid(\"source\");\n  const files = snapshot.files.map((value) => {\n    const file = record(value);\n    if (!file || typeof file.path !== \"string\" || typeof file.content !== \"string\") throw invalid(\"source file\");\n    return { path: file.path, content: file.content };\n  });\n  const referencesValue = snapshot.references === undefined ? [] : snapshot.references;\n  if (!Array.isArray(referencesValue) || referencesValue.length > 5) throw invalid(\"reference sources\");\n  const aliases = new Set<string>();\n  const references = [];\n  for (const item of referencesValue) {\n    const reference = record(item);\n    if (!reference || typeof reference.alias !== \"string\" || !/^[a-z][a-z0-9-]{0,39}$/.test(reference.alias)\n      || aliases.has(reference.alias) || reference.alias === \"primary\"\n      || typeof reference.repository !== \"string\" || typeof reference.commitSha !== \"string\"\n      || typeof reference.treeDigest !== \"string\" || !Array.isArray(reference.files)) throw invalid(\"reference source\");\n    aliases.add(reference.alias);\n    const referenceFiles = reference.files.map((entry) => {\n      const file = record(entry);\n      if (!file || typeof file.path !== \"string\" || typeof file.content !== \"string\") throw invalid(\"reference source file\");\n      return { path: file.path, content: file.content };\n    });\n    const source = { repository: reference.repository, commitSha: reference.commitSha, files: referenceFiles };\n    const referenceDigest = await digestCodeRepositorySnapshot(source, { maximumFiles: 10_000, maximumBytes: 16 * 1024 * 1024 });\n    if (referenceDigest !== reference.treeDigest) throw invalid(\"reference source digest\");\n    references.push({ alias: reference.alias, ...source, treeDigest: referenceDigest });\n  }\n  const source = { repository: snapshot.repository, commitSha: snapshot.commitSha, files };\n  const digest = await digestCodeRepositorySnapshot(source, { maximumFiles: 10_000, maximumBytes: 16 * 1024 * 1024 });\n  if (digest !== snapshot.treeDigest) throw invalid(\"source digest\");\n  return { ...source, treeDigest: digest, ...(references.length ? { references } : {}) };\n}\n\nfunction parseReview(value: unknown): CodeRuntimeReviewResponse {\n  const review = record(record(value)?.review);\n  if (!review || ![\"approved\", \"rejected\"].includes(String(review.verdict))\n    || typeof review.reviewDigest !== \"string\" || !/^sha256:[0-9a-f]{64}$/.test(review.reviewDigest)\n    || typeof review.provider !== \"string\" || !review.provider\n    || typeof review.model !== \"string\" || !review.model\n    || !Number.isSafeInteger(review.policyVersion) || Number(review.policyVersion) < 1) throw invalid(\"review\");\n  return review as unknown as CodeRuntimeReviewResponse;\n}\n\nfunction parseCandidate(value: unknown): CodeRuntimeCandidateResponse {\n  const candidate = record(record(value)?.candidate);\n  if (!candidate || typeof candidate.candidateId !== \"string\" || !/^ccand_[0-9a-f]{32}$/.test(candidate.candidateId)\n    || ![\"submitted\", \"approved\", \"published\", \"failed\"].includes(String(candidate.status))) {\n    throw invalid(\"candidate\");\n  }\n  return { candidateId: candidate.candidateId, status: candidate.status as CodeRuntimeCandidateResponse[\"status\"] };\n}\n\nconst record = (value: unknown): Record<string, unknown> | null => value && typeof value === \"object\" && !Array.isArray(value)\n  ? value as Record<string, unknown> : null;\nconst invalid = (part: string) => new CodeRuntimeControlError(`invalid Code runtime ${part} response`, 502, \"invalid_response\");\n","import type { CodePortableCheckpoint, CodeSourceFile, CodeVerificationReceipt } from \"@odla-ai/camel/code\";\nimport type { CodeSessionEventData, HarnessInferenceRequest, HarnessInferenceResponse } from \"./types\";\n\n/** Version of the outbound Code host heartbeat contract. */\nexport const CODE_RUNTIME_PROTOCOL_VERSION = 1 as const;\n\n/** Frozen, secret-filtered view of the checkout from which a terminal connected. */\nexport interface CodeLocalSourceDescriptor {\n  kind: \"local_checkout\";\n  repository: string;\n  headCommitSha: string;\n  trustedBaseDigest: `sha256:${string}`;\n  developerPatchDigest: `sha256:${string}`;\n  snapshotDigest: `sha256:${string}`;\n  modified: boolean;\n  fileCount: number;\n  byteCount: number;\n  capturedAt: number;\n}\n\n/** Host resources and supported isolation engines advertised on heartbeat. */\nexport interface CodeRuntimeCapabilities {\n  protocolVersion: typeof CODE_RUNTIME_PROTOCOL_VERSION;\n  platform: \"macos\" | \"linux\";\n  arch: string;\n  engines: Array<\"container\" | \"podman\" | \"docker\">;\n  cpuCount: number;\n  memoryBytes: number;\n  source?: CodeLocalSourceDescriptor;\n  images?: { ready: boolean; pi: string; recipes: Array<{ id: string; image: string }> };\n}\n\n/** A generation-fenced assignment of one app environment to one Code host. */\nexport interface CodeRuntimeBinding {\n  bindingId: string;\n  appId: string;\n  env: \"dev\" | \"prod\";\n  offerId: string;\n  hostId: string;\n  generation: number;\n  revokedAt: number | null;\n}\n\n/** Authoritative heartbeat response for a live host and its pending work. */\nexport interface CodeRuntimeSnapshot {\n  host: {\n    hostId: string;\n    runtimeVersion: string;\n    lastSeenAt: number;\n    revokedAt: null;\n  };\n  bindings: CodeRuntimeBinding[];\n  commands: CodeRuntimeCommand[];\n}\n\n/** Commands accepted by the outbound Code runtime. */\nexport type CodeRuntimeCommandKind = \"start\" | \"prompt\" | \"checkpoint_stop\" | \"resume\";\n/** One sequenced command fenced to an exact host-binding generation. */\nexport interface CodeRuntimeCommand {\n  commandId: string; instanceId: string; sessionId: string; appId: string; env: \"dev\" | \"prod\";\n  bindingId: string; hostId: string; bindingGeneration: number; sequence: number;\n  kind: CodeRuntimeCommandKind; payload: Record<string, unknown>; createdAt: number;\n}\n\n/** Terminal or continuing state acknowledged for a runtime command. */\nexport interface CodeRuntimeCommandResult {\n  status: \"running\" | \"checkpointed\" | \"failed\";\n  checkpoint?: CodePortableCheckpoint;\n  message?: string;\n}\n\n/** Minimal control-plane operations used by an outbound Code host. */\nexport interface CodeRuntimeControlPlane {\n  heartbeat(runtimeVersion: string, capabilities: CodeRuntimeCapabilities): Promise<CodeRuntimeSnapshot>;\n  acknowledge(commandId: string, result: CodeRuntimeCommandResult): Promise<void>;\n}\n\n/** Credentialless agent operations brokered over the same outbound host identity. */\nexport interface CodeRuntimeAgentControlPlane extends CodeRuntimeControlPlane {\n  source(sessionId: string): Promise<CodeRuntimeSourceSnapshot>;\n  infer(sessionId: string, request: HarnessInferenceRequest): Promise<HarnessInferenceResponse>;\n  review(sessionId: string, request: CodeRuntimeReviewRequest): Promise<CodeRuntimeReviewResponse>;\n  submitCandidate(\n    sessionId: string, checkpointId: string, verification: CodeVerificationReceipt,\n  ): Promise<CodeRuntimeCandidateResponse>;\n  appendSessionEvent(\n    sessionId: string, eventId: string, event: CodeSessionEventData,\n  ): Promise<void>;\n  reportSessionFailure(sessionId: string, message: string): Promise<void>;\n}\n\n/** Untrusted candidate material available only to the independent review route. */\nexport interface CodeRuntimeReviewRequest {\n  patch: string;\n  verification: CodeVerificationReceipt;\n}\n\n/** Closed review result. Only an exact approved verdict can enter a reviewed checkpoint. */\nexport interface CodeRuntimeReviewResponse {\n  verdict: \"approved\" | \"rejected\";\n  reviewDigest: `sha256:${string}`;\n  provider: string;\n  model: string;\n  policyVersion: number;\n}\n\n/** Owner-private candidate admitted after checkpoint, verifier, and review evidence agree. */\nexport interface CodeRuntimeCandidateResponse {\n  candidateId: string;\n  status: \"submitted\" | \"approved\" | \"published\" | \"failed\";\n}\n\n/** Exact, attestation-matched GitHub source returned to one assigned runtime. */\nexport interface CodeRuntimeSourceSnapshot {\n  repository: string;\n  commitSha: string;\n  treeDigest: `sha256:${string}`;\n  files: CodeSourceFile[];\n  references?: Array<{\n    alias: string; repository: string; commitSha: string;\n    treeDigest: `sha256:${string}`; files: CodeSourceFile[];\n  }>;\n}\n\nexport {\n  CodeRuntimeControlError, createCodeRuntimeControlClient,\n  type CodeRuntimeClientOptions,\n} from \"./code-runtime-client\";\n\n/** Presence-loop settings and an optional callback for each heartbeat snapshot. */\nexport interface CodeRuntimeLoopOptions {\n  control: CodeRuntimeControlPlane;\n  runtimeVersion: string;\n  capabilities: CodeRuntimeCapabilities;\n  heartbeatMs?: number;\n  once?: boolean;\n  signal?: AbortSignal;\n  onSnapshot?(snapshot: CodeRuntimeSnapshot): Promise<void> | void;\n  onRetry?(error: unknown, delayMs: number): Promise<void> | void;\n}\n\n/** Maintain presence without opening a listener or accepting inbound traffic. */\nexport async function runCodeRuntimeHeartbeatLoop(options: CodeRuntimeLoopOptions): Promise<void> {\n  const heartbeatMs = options.heartbeatMs ?? 15_000;\n  if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 1_000 || heartbeatMs > 300_000) {\n    throw new TypeError(\"heartbeatMs must be an integer from 1000 to 300000\");\n  }\n  let retryMs = 1_000;\n  do {\n    if (options.signal?.aborted) return;\n    try {\n      const snapshot = await options.control.heartbeat(options.runtimeVersion, options.capabilities);\n      await options.onSnapshot?.(snapshot);\n      retryMs = 1_000;\n      if (options.once) return;\n      await wait(heartbeatMs, options.signal);\n    } catch (error) {\n      if (options.signal?.aborted) return;\n      if (options.once || !retryableControlFailure(error)) throw error;\n      await options.onRetry?.(error, retryMs);\n      await wait(retryMs, options.signal);\n      retryMs = Math.min(retryMs * 2, 30_000);\n    }\n  } while (!options.signal?.aborted);\n}\n\n/** Executes one fenced runtime command and returns its acknowledgement payload. */\nexport interface CodeRuntimeCommandEngine {\n  execute(command: CodeRuntimeCommand): Promise<CodeRuntimeCommandResult>;\n  acknowledged?(command: CodeRuntimeCommand, result: CodeRuntimeCommandResult): Promise<void> | void;\n}\n\n/** Executes each command id at most once in-process and safely retries only its\n * acknowledgement after a transient control-plane failure. */\nexport class CodeRuntimeReconciler {\n  private readonly results = new Map<string, { result: CodeRuntimeCommandResult; notified: boolean }>();\n  constructor(private readonly control: CodeRuntimeControlPlane, private readonly engine: CodeRuntimeCommandEngine) {}\n\n  async reconcile(snapshot: CodeRuntimeSnapshot): Promise<void> {\n    for (const command of snapshot.commands) {\n      let completed = this.results.get(command.commandId);\n      if (!completed) {\n        let result: CodeRuntimeCommandResult;\n        try { result = await this.engine.execute(command); }\n        catch (error) {\n          result = { status: \"failed\", message: (error instanceof Error ? error.message : String(error)).slice(0, 2_000) };\n        }\n        completed = { result, notified: false };\n        this.results.set(command.commandId, completed);\n        if (this.results.size > 1_024) this.results.delete(this.results.keys().next().value!);\n      }\n      await this.control.acknowledge(command.commandId, completed.result);\n      if (!completed.notified) {\n        await this.engine.acknowledged?.(command, completed.result);\n        completed.notified = true;\n      }\n    }\n  }\n}\n\nfunction retryableControlFailure(value: unknown): boolean {\n  if (!value || typeof value !== \"object\") return false;\n  const failure = value as { status?: unknown; code?: unknown };\n  if (failure.code === \"invalid_response\" || typeof failure.status !== \"number\") return false;\n  return failure.status === 408 || failure.status === 425 || failure.status === 429 || failure.status >= 500;\n}\n\nfunction wait(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve) => {\n    if (signal?.aborted) return resolve();\n    const timer = setTimeout(resolve, ms);\n    signal?.addEventListener(\"abort\", () => { clearTimeout(timer); resolve(); }, { once: true });\n  });\n}\n","import {\n  createCodePortableCheckpoint,\n  verifyCodePortableCheckpoint,\n  type CodeCheckpointState,\n  type CodePortableCheckpoint,\n} from \"@odla-ai/camel/code\";\nimport { applyCodePatch, validateCodePatch } from \"./code-patch\";\nimport { stageWorkspace, type StagedWorkspace, type StageWorkspaceOptions } from \"./workspace\";\n\n/** Inputs for capturing one running staged workspace as a portable checkpoint. */\nexport interface CreateCodeWorkspaceCheckpointInput {\n  workspace: StagedWorkspace;\n  baseCommitSha: string;\n  state: CodeCheckpointState;\n  maximumPatchBytes?: number;\n}\n\n/** Inputs for reconstructing a checkpoint on any compatible bound host. */\nexport interface RestoreCodeWorkspaceCheckpointInput {\n  trustedBaseDir: string;\n  trustedBaseCommitSha: string;\n  checkpoint: unknown;\n  stage?: StageWorkspaceOptions;\n}\n\n/** Fresh staged workspace plus its verified portable checkpoint state. */\nexport interface RestoredCodeWorkspaceCheckpoint {\n  workspace: StagedWorkspace;\n  checkpoint: CodePortableCheckpoint;\n}\n\n/** Capture a bounded, text-only candidate patch and closed resume state. */\nexport async function createCodeWorkspaceCheckpoint(\n  input: CreateCodeWorkspaceCheckpointInput,\n): Promise<CodePortableCheckpoint> {\n  const maximum = input.maximumPatchBytes ?? 256 * 1024;\n  if (!Number.isSafeInteger(maximum) || maximum < 1 || maximum > 256 * 1024) {\n    throw new TypeError(\"checkpoint patch bound must be from 1 to 262144 bytes\");\n  }\n  const patch = await input.workspace.patch(maximum);\n  if (patch) validateCodePatch(patch, maximum);\n  return createCodePortableCheckpoint({ baseCommitSha: input.baseCommitSha, patch, state: input.state });\n}\n\n/** Reconstruct a verified candidate from a fresh copy of its exact trusted base. */\nexport async function restoreCodeWorkspaceCheckpoint(\n  input: RestoreCodeWorkspaceCheckpointInput,\n): Promise<RestoredCodeWorkspaceCheckpoint> {\n  const checkpoint = await verifyCodePortableCheckpoint(input.checkpoint);\n  if (checkpoint.baseCommitSha !== input.trustedBaseCommitSha) {\n    throw new TypeError(\"checkpoint trusted base does not match the fetched commit\");\n  }\n  const workspace = await stageWorkspace(input.trustedBaseDir, input.stage);\n  try {\n    if (checkpoint.patch) {\n      const paths = validateCodePatch(checkpoint.patch, 256 * 1024);\n      await applyCodePatch(workspace.workspaceDir, checkpoint.patch, paths);\n    }\n    return { workspace, checkpoint };\n  } catch (error) {\n    await workspace.cleanup();\n    throw error;\n  }\n}\n\n/** Return whether the exact effect already completed; reject an ID rebound to another action. */\nexport function isCheckpointEffectCompleted(\n  checkpoint: CodePortableCheckpoint,\n  effectId: string,\n  actionDigest: `sha256:${string}`,\n): boolean {\n  const completed = checkpoint.state.completedEffects.find((effect) => effect.effectId === effectId);\n  if (!completed) return false;\n  if (completed.actionDigest !== actionDigest) throw new TypeError(\"completed checkpoint effect id has another action digest\");\n  return true;\n}\n","import { spawn } from \"node:child_process\";\nimport { lstat } from \"node:fs/promises\";\nimport { resolve, sep } from \"node:path\";\n\nconst RESERVED = new Set([\".git\", \".odla\", \".wrangler\", \"node_modules\", \"dist\", \"coverage\"]);\nconst SECRET = /^(?:\\.env(?:\\..+)?|\\.dev\\.vars|credentials(?:\\..+)?\\.json|dev-token(?:\\..+)?\\.json)$/i;\nconst PATH = /^[A-Za-z0-9_@+.,-]+(?:\\/[A-Za-z0-9_@+.,-]+)*$/;\nconst FORBIDDEN = /^(?:GIT binary patch|Binary files |rename (?:from|to) |copy (?:from|to) |similarity index |old mode |new mode |deleted file mode 160000|new file mode 160000)/m;\n\n/** Validate a text-only, same-path unified patch and return every affected path. */\nexport function validateCodePatch(patch: string, maxBytes: number): string[] {\n  if (!patch || Buffer.byteLength(patch) > maxBytes || patch.includes(\"\\0\") || patch.includes(\"\\r\")) {\n    throw new TypeError(\"patch is empty, malformed, or exceeds its byte limit\");\n  }\n  if (FORBIDDEN.test(patch) || /(?:old|new)(?: file)? mode 120000/.test(patch)) {\n    throw new TypeError(\"patch uses a forbidden binary, link, mode, rename, or copy operation\");\n  }\n  const paths: string[] = [];\n  const lines = patch.split(\"\\n\");\n  for (let index = 0; index < lines.length; index += 1) {\n    const line = lines[index]!;\n    if (!line.startsWith(\"diff --git \")) continue;\n    const match = /^diff --git a\\/(\\S+) b\\/(\\S+)$/.exec(line);\n    const path = match?.[1];\n    if (!path || !match?.[2] || path !== match[2]) throw new TypeError(\"patch must use one unquoted relative path per diff\");\n    validateRelativePath(path);\n    const header = lines.slice(index + 1).findIndex((candidate) => candidate.startsWith(\"diff --git \"));\n    const section = lines.slice(index + 1, header < 0 ? lines.length : index + 1 + header);\n    const oldPath = section.find((candidate) => candidate.startsWith(\"--- \"))?.slice(4);\n    const newPath = section.find((candidate) => candidate.startsWith(\"+++ \"))?.slice(4);\n    if (!validHeaderPath(oldPath, path, \"a\") || !validHeaderPath(newPath, path, \"b\")) {\n      throw new TypeError(\"patch file headers do not match the declared path\");\n    }\n    paths.push(path);\n  }\n  if (!paths.length || new Set(paths).size !== paths.length) throw new TypeError(\"patch has no diffs or repeats a path\");\n  return paths;\n}\n\nfunction validHeaderPath(value: string | undefined, path: string, prefix: \"a\" | \"b\"): boolean {\n  return value === \"/dev/null\" || value === `${prefix}/${path}`;\n}\n\n/** Restrict Code tool paths to ordinary files outside filtered/secret trees. */\nexport function validateRelativePath(path: string): void {\n  const parts = path.split(\"/\");\n  if (!PATH.test(path) || parts.some((part) => part === \".\" || part === \"..\" || RESERVED.has(part))\n    || parts.some((part) => SECRET.test(part))) {\n    throw new TypeError(\"path is outside the allowed staged source tree\");\n  }\n}\n\n/** Resolve a validated relative path without permitting a root escape. */\nexport function resolveCodePath(workspaceDir: string, path: string): string {\n  validateRelativePath(path);\n  const root = resolve(workspaceDir);\n  const target = resolve(root, path);\n  if (target !== root && !target.startsWith(`${root}${sep}`)) throw new TypeError(\"path escapes the staged workspace\");\n  return target;\n}\n\n/** Apply a previously validated patch without invoking a shell or repository hooks. */\nexport async function applyCodePatch(workspaceDir: string, patch: string, paths: readonly string[]): Promise<void> {\n  await gitApply(workspaceDir, patch, true);\n  await gitApply(workspaceDir, patch, false);\n  for (const path of paths) {\n    try {\n      const info = await lstat(resolveCodePath(workspaceDir, path));\n      if (info.isSymbolicLink() || (!info.isFile() && !info.isDirectory())) {\n        throw new TypeError(\"patch created a non-regular workspace entry\");\n      }\n    } catch (reason) {\n      if ((reason as NodeJS.ErrnoException).code !== \"ENOENT\") throw reason;\n    }\n  }\n}\n\nfunction gitApply(cwd: string, patch: string, check: boolean): Promise<void> {\n  return new Promise((accept, reject) => {\n    const args = [\"apply\", \"--recount\", \"--whitespace=nowarn\", ...(check ? [\"--check\"] : []), \"-\"];\n    const child = spawn(\"git\", args, {\n      cwd, shell: false, stdio: [\"pipe\", \"ignore\", \"pipe\"],\n      env: { PATH: process.env.PATH ?? \"\", GIT_CONFIG_NOSYSTEM: \"1\", GIT_CONFIG_GLOBAL: \"/dev/null\" },\n    });\n    let stderr = \"\";\n    child.stderr.setEncoding(\"utf8\");\n    child.stderr.on(\"data\", (text: string) => { if (stderr.length < 4_000) stderr += text.slice(0, 4_000); });\n    child.once(\"error\", reject);\n    child.once(\"exit\", (code) => code === 0 ? accept() : reject(new TypeError(`patch did not apply: ${stderr.trim().slice(0, 500)}`)));\n    child.stdin.end(patch);\n  });\n}\n","import { spawn } from \"node:child_process\";\nimport { getgid, getuid } from \"node:process\";\nimport { randomUUID } from \"node:crypto\";\nimport { assertPinnedImage, verifyContainerEngineBoundary, type ContainerEngine } from \"./container\";\nimport type { CodeBuildRecipe, CodeRecipeExecutor, CodeRecipeResult } from \"./code-tool-types\";\n\nconst ARTIFACT_PATH = /^[A-Za-z0-9_@+.,-]+(?:\\/[A-Za-z0-9_@+.,-]+)*$/;\nconst PRIVATE_ARTIFACT_PART = /^(?:\\.git|\\.odla|\\.wrangler|\\.env(?:\\..+)?|\\.dev\\.vars|credentials(?:\\..+)?\\.json)$/i;\n\n/** Build a trusted, fixed command for an isolated and networkless recipe container. */\nexport function buildRecipeContainerArgs(\n  engine: ContainerEngine,\n  workspaceDir: string,\n  recipe: CodeBuildRecipe,\n  name = `odla-recipe-${randomUUID().slice(0, 12)}`,\n): string[] {\n  assertCodeBuildRecipe(recipe);\n  if (/[,\\r\\n]/.test(workspaceDir)) throw new TypeError(\"workspace path contains unsupported mount characters\");\n  const uid = typeof getuid === \"function\" ? getuid() : 1000;\n  const gid = typeof getgid === \"function\" ? getgid() : 1000;\n  const limits = {\n    cpus: recipe.cpus ?? 1,\n    memory: recipe.memory ?? \"1g\",\n    pids: recipe.pids ?? 256,\n    tmpfs: recipe.tmpfsBytes ?? 64 * 1024 * 1024,\n  };\n  if (engine === \"container\") {\n    return [\n      \"run\", \"--rm\", `--name=${name}`, \"--network=none\", \"--read-only\", \"--cap-drop=ALL\",\n      `--memory=${limits.memory}`, `--cpus=${limits.cpus}`, `--user=${uid}:${gid}`, \"--tmpfs=/tmp\",\n      `--mount=type=bind,source=${workspaceDir},target=/workspace`, \"--workdir=/workspace\",\n      \"--env=CI=1\", recipe.image, ...recipe.command,\n    ];\n  }\n  return [\n    \"run\", \"--rm\", `--name=${name}`, \"--pull=never\", \"--network=none\", \"--read-only\", \"--cap-drop=ALL\",\n    \"--security-opt=no-new-privileges\", `--pids-limit=${limits.pids}`,\n    `--memory=${limits.memory}`, `--cpus=${limits.cpus}`, `--user=${uid}:${gid}`,\n    `--tmpfs=/tmp:rw,noexec,nosuid,nodev,size=${limits.tmpfs}`,\n    `--mount=type=bind,src=${workspaceDir},dst=/workspace`, \"--workdir=/workspace\",\n    \"--env=CI=1\", recipe.image, ...recipe.command,\n  ];\n}\n\n/** Create a recipe executor that never invokes a shell and never mounts credentials. */\nexport function createContainerRecipeExecutor(engine: ContainerEngine): CodeRecipeExecutor {\n  return {\n    async run(input): Promise<CodeRecipeResult> {\n      await verifyContainerEngineBoundary(engine);\n      const name = `odla-recipe-${randomUUID().slice(0, 12)}`;\n      const args = buildRecipeContainerArgs(engine, input.workspaceDir, input.recipe, name);\n      return execute(engine, args, name, input.recipe, input.signal);\n    },\n  };\n}\n\n/** Validate immutable recipe identity, digest image, command, and resource bounds. */\nexport function assertCodeBuildRecipe(recipe: CodeBuildRecipe): void {\n  const memoryBytes = parseMemory(recipe.memory ?? \"1g\");\n  const tmpfsBytes = recipe.tmpfsBytes ?? 64 * 1024 * 1024;\n  const artifacts = recipe.expectedArtifacts ?? [];\n  assertPinnedImage(recipe.image);\n  if (!/^[A-Za-z0-9._:-]{1,120}$/.test(recipe.id) || recipe.command.length < 1\n    || recipe.command.length > 64 || recipe.command.some((part) => !part || part.length > 4_096 || /[\\0\\r\\n]/.test(part))\n    || !Number.isSafeInteger(recipe.timeoutMs) || recipe.timeoutMs < 1 || recipe.timeoutMs > 30 * 60_000\n    || !Number.isSafeInteger(recipe.maxOutputBytes) || recipe.maxOutputBytes < 1 || recipe.maxOutputBytes > 16 * 1024 * 1024\n    || !Number.isFinite(recipe.cpus ?? 1) || (recipe.cpus ?? 1) < 0.1 || (recipe.cpus ?? 1) > 32\n    || memoryBytes < 64 * 1024 * 1024 || memoryBytes > 32 * 1024 * 1024 * 1024\n    || !Number.isSafeInteger(recipe.pids ?? 256) || (recipe.pids ?? 256) < 16 || (recipe.pids ?? 256) > 4_096\n    || !Number.isSafeInteger(tmpfsBytes)\n    || tmpfsBytes < 1024 * 1024 || tmpfsBytes > 1024 * 1024 * 1024\n    || artifacts.length > 64 || new Set(artifacts.map((item) => item.id)).size !== artifacts.length\n    || artifacts.some((item) => !/^[A-Za-z0-9._:-]{1,120}$/.test(item.id)\n      || !ARTIFACT_PATH.test(item.path) || item.path.split(\"/\").some((part) => PRIVATE_ARTIFACT_PART.test(part))\n      || !Number.isSafeInteger(item.maximumBytes) || item.maximumBytes < 1\n      || item.maximumBytes > 512 * 1024 * 1024)) {\n    throw new TypeError(\"build recipe is malformed or exceeds its control bounds\");\n  }\n}\n\nfunction parseMemory(value: string): number {\n  const match = /^([1-9][0-9]{0,4})([kmg])$/.exec(value.toLowerCase());\n  if (!match?.[1] || !match[2]) return 0;\n  const scale = match[2] === \"k\" ? 1024 : match[2] === \"m\" ? 1024 ** 2 : 1024 ** 3;\n  return Number(match[1]) * scale;\n}\n\nfunction execute(\n  engine: ContainerEngine,\n  args: string[],\n  name: string,\n  recipe: CodeBuildRecipe,\n  signal?: AbortSignal,\n): Promise<CodeRecipeResult> {\n  return new Promise((accept, reject) => {\n    const started = Date.now();\n    const child = spawn(engine, args, { shell: false, stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n    const stdout: Buffer[] = [];\n    const stderr: Buffer[] = [];\n    let bytes = 0;\n    let outputLimitExceeded = false;\n    let timedOut = false;\n    let stopping = false;\n    const stop = (reason: \"timeout\" | \"output\" | \"abort\") => {\n      if (stopping) return;\n      stopping = true;\n      timedOut = reason === \"timeout\";\n      outputLimitExceeded = reason === \"output\";\n      const remove = engine === \"container\" ? [\"delete\", \"--force\", name] : [\"rm\", \"-f\", name];\n      const killer = spawn(engine, remove, { shell: false, stdio: \"ignore\" });\n      killer.unref();\n      child.kill(\"SIGTERM\");\n    };\n    const collect = (target: Buffer[]) => (chunk: Buffer) => {\n      bytes += chunk.byteLength;\n      if (bytes > recipe.maxOutputBytes) stop(\"output\");\n      else target.push(chunk);\n    };\n    child.stdout.on(\"data\", collect(stdout));\n    child.stderr.on(\"data\", collect(stderr));\n    const abort = () => stop(\"abort\");\n    signal?.addEventListener(\"abort\", abort, { once: true });\n    if (signal?.aborted) abort();\n    const timer = setTimeout(() => stop(\"timeout\"), recipe.timeoutMs);\n    child.once(\"error\", (error) => {\n      clearTimeout(timer);\n      signal?.removeEventListener(\"abort\", abort);\n      reject(error);\n    });\n    child.once(\"exit\", (code) => {\n      clearTimeout(timer);\n      signal?.removeEventListener(\"abort\", abort);\n      accept({\n        exitCode: code ?? 1,\n        stdout: Buffer.concat(stdout).toString(\"utf8\"), stderr: Buffer.concat(stderr).toString(\"utf8\"),\n        durationMs: Date.now() - started, outputLimitExceeded, timedOut,\n      });\n    });\n  });\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { createReadStream } from \"node:fs\";\nimport { lstat } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport {\n  digestCodeVerificationReceipt,\n  type CodeVerificationArtifactReceipt,\n  type CodeVerificationRecipeReceipt,\n} from \"@odla-ai/camel/code\";\nimport { applyCodePatch, validateCodePatch } from \"./code-patch\";\nimport { assertCodeBuildRecipe } from \"./recipe-container\";\nimport { stageWorkspace } from \"./workspace\";\nimport { digestStagedWorkspace } from \"./workspace-digest\";\nimport type { CodeBuildRecipe, CodeRecipeResult } from \"./code-tool-types\";\nimport type {\n  CodeVerificationEvidence, CodeVerificationPolicy, VerifyCodeCandidateInput,\n} from \"./code-verifier-types\";\n\nexport type {\n  CodeVerificationEvidence, CodeVerificationLog, CodeVerificationPolicy, VerifyCodeCandidateInput,\n} from \"./code-verifier-types\";\n\nconst SHA = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;\nconst DIGEST = /^sha256:[0-9a-f]{64}$/;\nconst ID = /^[A-Za-z0-9._:-]{1,160}$/;\nconst RULE = /^[A-Za-z0-9_@+.,/-]{1,160}$/;\nconst DEFAULT_PREFIXES = [\"test/\", \"tests/\", \"__tests__/\"];\nconst DEFAULT_SUFFIXES = [\".test.js\", \".test.ts\", \".test.tsx\", \".spec.js\", \".spec.ts\", \".spec.tsx\"];\n\n/** Rebuild a candidate from an exact trusted base and emit a prose-free clean-verifier receipt. */\nexport async function verifyCodeCandidate(input: VerifyCodeCandidateInput): Promise<CodeVerificationEvidence> {\n  const policy = validate(input);\n  const limits = { maxFiles: policy.maximumFiles, maxBytes: policy.maximumBytes };\n  const staged = await stageWorkspace(input.trustedBaseDir, limits);\n  try {\n    const baseDigest = await digestStagedWorkspace(staged.workspaceDir, limits);\n    if (baseDigest !== input.trustedBaseDigest) throw new TypeError(\"trusted base does not match its registered digest\");\n    const paths = validateCodePatch(input.candidatePatch, policy.maximumPatchBytes);\n    await applyCodePatch(staged.workspaceDir, input.candidatePatch, paths);\n    const sourceDigest = await digestStagedWorkspace(staged.workspaceDir, limits);\n    const policyDigest = digestPolicy(policy);\n    const patchDigest = digestBytes(input.candidatePatch);\n    const candidateDigest = digestJson({\n      trustedBaseCommitSha: input.trustedBaseCommitSha,\n      trustedBaseDigest: input.trustedBaseDigest,\n      patchDigest,\n    });\n    const changedTests = changedTestPaths(paths, policy);\n    if (changedTests.length > policy.maximumChangedTests) throw new TypeError(\"candidate changes too many test files\");\n    const recipes: CodeVerificationRecipeReceipt[] = [];\n    const logs: CodeVerificationEvidence[\"logs\"][number][] = [];\n    for (const recipe of policy.recipes) {\n      const clean = await stageWorkspace(staged.workspaceDir, limits);\n      try {\n        if (await digestStagedWorkspace(clean.workspaceDir, limits) !== sourceDigest) {\n          throw new TypeError(\"clean verifier source changed before execution\");\n        }\n        const result = checkedResult(await input.recipeExecutor.run({\n          workspaceDir: clean.workspaceDir, recipe, signal: input.signal,\n        }), recipe.maxOutputBytes);\n        const artifacts = await inspectArtifacts(clean.workspaceDir, recipe);\n        recipes.push(recipeReceipt(recipe, result, artifacts));\n        logs.push({ recipeId: recipe.id, ...boundedLogs(result, recipe.maxOutputBytes) });\n      } finally {\n        await clean.cleanup();\n      }\n    }\n    const fields = {\n      schemaVersion: 1 as const,\n      verificationId: input.verificationId ?? `verify-${randomUUID()}`,\n      trustedBaseCommitSha: input.trustedBaseCommitSha,\n      trustedBaseDigest: input.trustedBaseDigest,\n      patchDigest,\n      candidateDigest,\n      sourceDigest,\n      policyDigest,\n      recipes,\n      changedTestCount: changedTests.length,\n      changedTestSetDigest: digestJson(changedTests),\n      changedTestsRequireReview: changedTests.length > 0,\n      outcome: recipes.every((recipe) => recipe.status === \"passed\") ? \"passed\" as const : \"failed\" as const,\n    };\n    return {\n      receipt: { ...fields, receiptDigest: await digestCodeVerificationReceipt(fields) },\n      changedTests: Object.freeze(changedTests),\n      logs: Object.freeze(logs),\n    };\n  } finally {\n    await staged.cleanup();\n  }\n}\n\nfunction validate(input: VerifyCodeCandidateInput): Required<CodeVerificationPolicy> {\n  const policy = input.policy;\n  if (!SHA.test(input.trustedBaseCommitSha) || !DIGEST.test(input.trustedBaseDigest)\n    || !ID.test(input.verificationId ?? \"verify-generated\") || !ID.test(policy.policyId)\n    || policy.recipes.length < 1 || policy.recipes.length > 64\n    || new Set(policy.recipes.map((recipe) => recipe.id)).size !== policy.recipes.length) {\n    throw new TypeError(\"clean verification input is malformed\");\n  }\n  for (const recipe of policy.recipes) assertCodeBuildRecipe(recipe);\n  const result: Required<CodeVerificationPolicy> = {\n    policyId: policy.policyId,\n    recipes: policy.recipes,\n    testPathPrefixes: policy.testPathPrefixes ?? DEFAULT_PREFIXES,\n    testPathSuffixes: policy.testPathSuffixes ?? DEFAULT_SUFFIXES,\n    maximumChangedTests: policy.maximumChangedTests ?? 1_000,\n    maximumPatchBytes: policy.maximumPatchBytes ?? 256 * 1024,\n    maximumFiles: policy.maximumFiles ?? 20_000,\n    maximumBytes: policy.maximumBytes ?? 512 * 1024 * 1024,\n  };\n  if ([...result.testPathPrefixes, ...result.testPathSuffixes].some((rule) => !RULE.test(rule))\n    || !integer(result.maximumChangedTests, 0, 10_000)\n    || !integer(result.maximumPatchBytes, 1, 4 * 1024 * 1024)\n    || !integer(result.maximumFiles, 1, 100_000)\n    || !integer(result.maximumBytes, 1, 2 * 1024 * 1024 * 1024)) {\n    throw new TypeError(\"clean verification policy exceeds its bounds\");\n  }\n  return result;\n}\n\nfunction changedTestPaths(paths: readonly string[], policy: Required<CodeVerificationPolicy>): string[] {\n  return paths.filter((path) => policy.testPathSuffixes.some((suffix) => path.endsWith(suffix))\n    || policy.testPathPrefixes.some((prefix) => path.startsWith(prefix) || path.includes(`/${prefix}`))).sort();\n}\n\nfunction recipeReceipt(\n  recipe: CodeBuildRecipe,\n  result: CodeRecipeResult,\n  artifacts: readonly CodeVerificationArtifactReceipt[],\n): CodeVerificationRecipeReceipt {\n  const status = result.timedOut ? \"timed_out\" : result.outputLimitExceeded ? \"output_limited\"\n    : result.exitCode === 0 && artifacts.every((item) => item.status === \"verified\") ? \"passed\" : \"failed\";\n  return {\n    recipeId: recipe.id,\n    recipeDigest: digestRecipe(recipe),\n    status,\n    exitCode: result.exitCode,\n    durationMs: result.durationMs,\n    artifacts,\n  };\n}\n\nasync function inspectArtifacts(\n  workspaceDir: string,\n  recipe: CodeBuildRecipe,\n): Promise<CodeVerificationArtifactReceipt[]> {\n  const receipts: CodeVerificationArtifactReceipt[] = [];\n  for (const artifact of recipe.expectedArtifacts ?? []) {\n    try {\n      const path = join(workspaceDir, artifact.path);\n      const info = await lstat(path);\n      if (!info.isFile() || info.isSymbolicLink()) {\n        receipts.push({ artifactId: artifact.id, status: \"invalid\", bytes: null, digest: null });\n      } else if (info.size > artifact.maximumBytes) {\n        receipts.push({ artifactId: artifact.id, status: \"too_large\", bytes: info.size, digest: null });\n      } else {\n        receipts.push({ artifactId: artifact.id, status: \"verified\", bytes: info.size, digest: await hashFile(path) });\n      }\n    } catch (reason) {\n      if ((reason as NodeJS.ErrnoException).code !== \"ENOENT\") throw reason;\n      receipts.push({ artifactId: artifact.id, status: \"missing\", bytes: null, digest: null });\n    }\n  }\n  return receipts;\n}\n\nfunction hashFile(path: string): Promise<`sha256:${string}`> {\n  return new Promise((accept, reject) => {\n    const hash = createHash(\"sha256\");\n    const stream = createReadStream(path);\n    stream.on(\"data\", (chunk) => { hash.update(chunk); });\n    stream.once(\"error\", reject);\n    stream.once(\"end\", () => accept(`sha256:${hash.digest(\"hex\")}`));\n  });\n}\n\nfunction checkedResult(result: CodeRecipeResult, maximumOutputBytes: number): CodeRecipeResult {\n  if (!integer(result.exitCode, 0, 255) || !integer(result.durationMs, 0, 30 * 60_000)\n    || typeof result.stdout !== \"string\" || typeof result.stderr !== \"string\"\n    || typeof result.outputLimitExceeded !== \"boolean\" || typeof result.timedOut !== \"boolean\") {\n    throw new TypeError(\"recipe executor returned an invalid result\");\n  }\n  const bytes = Buffer.byteLength(result.stdout) + Buffer.byteLength(result.stderr);\n  return bytes > maximumOutputBytes ? { ...result, outputLimitExceeded: true } : result;\n}\n\nfunction boundedLogs(result: CodeRecipeResult, maximum: number): { stdout: string; stderr: string } {\n  const stdout = Buffer.from(result.stdout);\n  const stderr = Buffer.from(result.stderr);\n  const first = stdout.subarray(0, maximum);\n  return {\n    stdout: first.toString(\"utf8\"),\n    stderr: stderr.subarray(0, Math.max(0, maximum - first.byteLength)).toString(\"utf8\"),\n  };\n}\n\nfunction digestPolicy(policy: Required<CodeVerificationPolicy>): `sha256:${string}` {\n  return digestJson({\n    policyId: policy.policyId,\n    recipes: policy.recipes.map((recipe) => normalizedRecipe(recipe)),\n    testPathPrefixes: [...policy.testPathPrefixes].sort(),\n    testPathSuffixes: [...policy.testPathSuffixes].sort(),\n    maximumChangedTests: policy.maximumChangedTests,\n    maximumPatchBytes: policy.maximumPatchBytes,\n    maximumFiles: policy.maximumFiles,\n    maximumBytes: policy.maximumBytes,\n  });\n}\n\nfunction digestRecipe(recipe: CodeBuildRecipe): `sha256:${string}` {\n  return digestJson(normalizedRecipe(recipe));\n}\n\nfunction normalizedRecipe(recipe: CodeBuildRecipe) {\n  return {\n    id: recipe.id, image: recipe.image, command: [...recipe.command], timeoutMs: recipe.timeoutMs,\n    maxOutputBytes: recipe.maxOutputBytes, cpus: recipe.cpus ?? 1, memory: recipe.memory ?? \"1g\",\n    pids: recipe.pids ?? 256, tmpfsBytes: recipe.tmpfsBytes ?? 64 * 1024 * 1024,\n    expectedArtifacts: [...(recipe.expectedArtifacts ?? [])]\n      .sort((left, right) => left.id.localeCompare(right.id))\n      .map((artifact) => ({ id: artifact.id, path: artifact.path, maximumBytes: artifact.maximumBytes })),\n  };\n}\n\nfunction digestJson(value: unknown): `sha256:${string}` {\n  return digestBytes(JSON.stringify(value));\n}\n\nfunction digestBytes(value: string): `sha256:${string}` {\n  return `sha256:${createHash(\"sha256\").update(value).digest(\"hex\")}`;\n}\n\nfunction integer(value: number, minimum: number, maximum: number): boolean {\n  return Number.isSafeInteger(value) && value >= minimum && value <= maximum;\n}\n","import type { CodeVerificationReceipt } from \"@odla-ai/camel/code\";\nimport { createCodeWorkspaceCheckpoint } from \"./code-checkpoint\";\nimport type { CodeRuntimeReviewResponse } from \"./code-runtime\";\nimport type { CodeBuildRecipe, CodeRecipeExecutor } from \"./code-tool-types\";\nimport { verifyCodeCandidate } from \"./code-verifier\";\nimport type { StagedWorkspace } from \"./workspace\";\n\n/** Trusted session state, verification policy, and review callback used to stop at a portable checkpoint. */\nexport interface PrepareRuntimeCheckpointInput {\n  sessionId: string; role: \"coding\" | \"review\"; workspace: StagedWorkspace;\n  baseCommitSha: string; trustedBaseDigest: `sha256:${string}`;\n  planningInputDigest: `sha256:${string}`; conversationRefs: readonly string[];\n  fallbackPolicyDigest: `sha256:${string}`; recipes: readonly CodeBuildRecipe[];\n  recipeExecutor: CodeRecipeExecutor;\n  review(patch: string, verification: CodeVerificationReceipt): Promise<CodeRuntimeReviewResponse>;\n}\n\n/** Portable checkpoint plus the optional clean-build and independent-review evidence that produced it. */\nexport interface PreparedRuntimeCheckpoint {\n  checkpoint: Awaited<ReturnType<typeof createCodeWorkspaceCheckpoint>>;\n  verification: CodeVerificationReceipt | null;\n  review: CodeRuntimeReviewResponse | null;\n  note: string;\n}\n\n/** Verify and independently review a stopped workspace without exposing raw build output to planning. */\nexport async function prepareRuntimeCheckpoint(\n  input: PrepareRuntimeCheckpointInput,\n): Promise<PreparedRuntimeCheckpoint> {\n  const patch = await input.workspace.patch(256 * 1024);\n  let verification: CodeVerificationReceipt | null = null;\n  let review: CodeRuntimeReviewResponse | null = null;\n  let note = patch ? \"Candidate remains untrusted\" : \"Checkpoint has no source changes\";\n  if (patch && input.role === \"coding\") {\n    try {\n      const evidence = await verifyCodeCandidate({\n        verificationId: `verify-${input.sessionId.slice(\"csess_\".length)}`,\n        trustedBaseDir: input.workspace.baselineDir, trustedBaseCommitSha: input.baseCommitSha,\n        trustedBaseDigest: input.trustedBaseDigest, candidatePatch: patch,\n        policy: { policyId: \"code.runtime\", recipes: input.recipes,\n          maximumFiles: 20_000, maximumBytes: 512 * 1024 * 1024 },\n        recipeExecutor: input.recipeExecutor,\n      });\n      if (evidence.receipt.outcome === \"passed\") {\n        verification = evidence.receipt;\n        review = await input.review(patch, verification);\n        note = review.verdict === \"approved\" ? \"Clean verification and independent review passed\"\n          : \"Clean verification passed; independent review rejected the candidate\";\n      } else {\n        note = `Clean verification failed: ${evidence.receipt.recipes\n          .filter((recipe) => recipe.status !== \"passed\").map((recipe) => `${recipe.recipeId}=${recipe.status}`).join(\", \")}`;\n      }\n    } catch (cause) {\n      note = `Candidate verification or review failed closed: ${message(cause)}`;\n    }\n  }\n  const reviewed = verification && review?.verdict === \"approved\";\n  const checkpoint = await createCodeWorkspaceCheckpoint({\n    workspace: input.workspace, baseCommitSha: input.baseCommitSha,\n    state: { planCursor: null, conversationRefs: input.conversationRefs,\n      planningInputDigest: input.planningInputDigest,\n      buildPolicyDigest: verification?.policyDigest ?? input.fallbackPolicyDigest,\n      dependencyLayerDigest: null, verificationDigest: verification?.receiptDigest ?? null,\n      reviewDigest: reviewed && review ? review.reviewDigest : null,\n      completedEffects: [], unresolvedApprovals: [],\n      trustStatus: reviewed ? \"reviewed\" : verification ? \"verified\" : \"candidate_untrusted\" },\n  });\n  return { checkpoint, verification, review, note };\n}\n\nconst message = (value: unknown): string => (value instanceof Error ? value.message : String(value)).slice(0, 500);\n","import type { CodeVerificationReceipt } from \"@odla-ai/camel/code\";\nimport { prepareRuntimeCheckpoint } from \"./code-runtime-checkpoint\";\nimport type {\n  CodeRuntimeAgentControlPlane, CodeRuntimeCommand, CodeRuntimeCommandResult,\n} from \"./code-runtime\";\nimport type { CodeBuildRecipe, CodeRecipeExecutor } from \"./code-tool-types\";\nimport type { ContainerRunResult } from \"./container\";\nimport type { CodeSessionEventData } from \"./types\";\nimport type { StagedWorkspace } from \"./workspace\";\n\n/** Active isolated workspace state required to prepare and publish a Code checkpoint candidate. */\nexport interface RuntimeCheckpointSession {\n  workspace: StagedWorkspace; done: Promise<ContainerRunResult | null>; abort: AbortController;\n  baseCommitSha: string; trustedBaseDigest: `sha256:${string}`; planningInputDigest: `sha256:${string}`;\n  conversationRefs: string[]; role: \"coding\" | \"review\";\n}\n\ninterface Options {\n  control: CodeRuntimeAgentControlPlane; recipes: readonly CodeBuildRecipe[];\n  recipeExecutor: CodeRecipeExecutor; fallbackPolicyDigest: `sha256:${string}`;\n  event(command: CodeRuntimeCommand, event: CodeSessionEventData, refs: string[]): Promise<void>;\n}\n\n/** Own checkpoint evidence and candidate admission retries outside the Pi process lifecycle. */\nexport class CodeRuntimeCheckpointManager {\n  readonly #pending = new Map<string, { verification: CodeVerificationReceipt; refs: string[] }>();\n  constructor(private readonly options: Options) {}\n\n  async prepare(command: CodeRuntimeCommand, active: RuntimeCheckpointSession): Promise<CodeRuntimeCommandResult> {\n    active.abort.abort(\"checkpoint_stop\");\n    await active.done;\n    const prepared = await prepareRuntimeCheckpoint({\n      sessionId: command.sessionId, role: active.role, workspace: active.workspace,\n      baseCommitSha: active.baseCommitSha, trustedBaseDigest: active.trustedBaseDigest,\n      planningInputDigest: active.planningInputDigest, conversationRefs: active.conversationRefs,\n      fallbackPolicyDigest: this.options.fallbackPolicyDigest, recipes: this.options.recipes,\n      recipeExecutor: this.options.recipeExecutor,\n      review: (patch, verification) => this.options.control.review(command.sessionId, { patch, verification }),\n    });\n    if (prepared.review?.verdict === \"approved\" && prepared.verification) {\n      this.#pending.set(command.commandId, { verification: prepared.verification, refs: active.conversationRefs });\n    }\n    await this.options.event(command, { type: \"message\", actor: \"system\", body: prepared.note }, active.conversationRefs)\n      .catch(() => undefined);\n    await active.workspace.cleanup();\n    await this.options.event(command, { type: \"status\", status: \"checkpointed\" }, active.conversationRefs)\n      .catch(() => undefined);\n    return { status: \"checkpointed\", checkpoint: prepared.checkpoint, message: \"Pi stopped at a portable checkpoint\" };\n  }\n\n  async acknowledged(command: CodeRuntimeCommand, result: CodeRuntimeCommandResult): Promise<boolean> {\n    if (command.kind !== \"checkpoint_stop\" || result.status !== \"checkpointed\") return false;\n    const pending = this.#pending.get(command.commandId);\n    if (!pending) return true;\n    const checkpointId = `cpoint_${command.commandId.slice(\"ccmd_\".length)}`;\n    const candidate = await this.options.control.submitCandidate(command.sessionId, checkpointId, pending.verification);\n    await this.options.event(command, { type: \"message\", actor: \"system\",\n      body: command.payload.sourceSet\n        ? `Candidate ${candidate.candidateId} was verified and delivered to the session PR branch`\n        : `Candidate ${candidate.candidateId} is ready for legacy owner publication approval` }, pending.refs);\n    this.#pending.delete(command.commandId);\n    return true;\n  }\n}\n","import type { CodeRuntimeSourceSnapshot } from \"./code-runtime\";\nimport type { StagedWorkspace } from \"./workspace\";\nimport { mkdir, mkdtemp, rm, writeFile } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { dirname, join, resolve, sep } from \"node:path\";\n\nconst RESERVED = new Set([\".git\", \".odla\", \".wrangler\", \"node_modules\", \"dist\", \"coverage\"]);\nconst SECRET = /^(?:\\.env(?:\\..+)?|\\.dev\\.vars|credentials(?:\\..+)?\\.json|dev-token(?:\\..+)?\\.json)$/i;\n\n/** Disposable local source tree materialized from an exact, validated Code snapshot. */\nexport interface MaterializedCodeSource {\n  sourceDir: string;\n  cleanup(): Promise<void>;\n}\n\n/** Materialize only ordinary, relative snapshot files into a disposable source tree. */\nexport async function materializeCodeRuntimeSource(\n  snapshot: CodeRuntimeSourceSnapshot, tempRoot = tmpdir(),\n): Promise<MaterializedCodeSource> {\n  if (!snapshot.files.length || snapshot.files.length > 10_000) throw new TypeError(\"Code source file count is invalid\");\n  const root = await mkdtemp(join(tempRoot, \"odla-code-source-\"));\n  const sourceDir = join(root, \"source\");\n  await mkdir(sourceDir);\n  const seen = new Set<string>();\n  let bytes = 0;\n  try {\n    for (const file of snapshot.files) {\n      validatePath(file.path);\n      if (seen.has(file.path)) throw new TypeError(\"Code source repeats a path\");\n      seen.add(file.path);\n      bytes += Buffer.byteLength(file.path) + Buffer.byteLength(file.content);\n      if (bytes > 16 * 1024 * 1024) throw new TypeError(\"Code source exceeds its byte bound\");\n      const target = resolve(sourceDir, file.path);\n      if (!target.startsWith(`${resolve(sourceDir)}${sep}`)) throw new TypeError(\"Code source path escapes its root\");\n      await mkdir(dirname(target), { recursive: true });\n      await writeFile(target, file.content, { flag: \"wx\", mode: 0o644 });\n    }\n    for (const reference of snapshot.references ?? []) {\n      validateAlias(reference.alias);\n      if (!reference.files.length || reference.files.length > 10_000) throw new TypeError(\"Code reference file count is invalid\");\n      for (const file of reference.files) {\n        validatePath(file.path);\n        const path = `.odla-references/${reference.alias}/${file.path}`;\n        if (seen.has(path)) throw new TypeError(\"Code reference repeats a path\");\n        seen.add(path);\n        bytes += Buffer.byteLength(path) + Buffer.byteLength(file.content);\n        if (bytes > 80 * 1024 * 1024) throw new TypeError(\"Code source set exceeds its byte bound\");\n        const target = resolve(sourceDir, path);\n        if (!target.startsWith(`${resolve(sourceDir)}${sep}`)) throw new TypeError(\"Code reference path escapes its root\");\n        await mkdir(dirname(target), { recursive: true });\n        await writeFile(target, file.content, { flag: \"wx\", mode: 0o444 });\n      }\n    }\n    return { sourceDir, cleanup: () => rm(root, { recursive: true, force: true }) };\n  } catch (cause) {\n    await rm(root, { recursive: true, force: true });\n    throw cause;\n  }\n}\n\nfunction validateAlias(alias: string): void {\n  if (!/^[a-z][a-z0-9-]{0,39}$/.test(alias) || alias === \"primary\") {\n    throw new TypeError(\"Code reference alias is invalid\");\n  }\n}\n\n/** Add server-resolved reference trees to both sides of a staged local\n * checkout. They remain outside the candidate diff and the tool broker denies\n * every write beneath the reference root. */\nexport async function attachCodeRuntimeReferences(\n  workspace: StagedWorkspace, references: NonNullable<CodeRuntimeSourceSnapshot[\"references\"]>,\n): Promise<void> {\n  let bytes = 0;\n  for (const reference of references) {\n    validateAlias(reference.alias);\n    for (const file of reference.files) {\n      validatePath(file.path);\n      const path = `.odla-references/${reference.alias}/${file.path}`;\n      bytes += Buffer.byteLength(path) + Buffer.byteLength(file.content);\n      if (bytes > 64 * 1024 * 1024) throw new TypeError(\"Code reference set exceeds its byte bound\");\n      for (const root of [workspace.baselineDir, workspace.workspaceDir]) {\n        const target = resolve(root, path);\n        if (!target.startsWith(`${resolve(root)}${sep}`)) throw new TypeError(\"Code reference path escapes its root\");\n        await mkdir(dirname(target), { recursive: true });\n        await writeFile(target, file.content, { flag: \"wx\", mode: 0o444 });\n      }\n    }\n  }\n}\n\nfunction validatePath(path: string): void {\n  const parts = path.split(\"/\");\n  if (!path || path.startsWith(\"/\") || path.includes(\"\\\\\") || path.includes(\"\\0\")\n    || parts.some((part) => !part || part === \".\" || part === \"..\" || RESERVED.has(part) || SECRET.test(part))) {\n    throw new TypeError(\"Code source contains an unsafe path\");\n  }\n}\n","import { readFile, readdir, stat } from \"node:fs/promises\";\nimport { relative, resolve } from \"node:path\";\nimport { createCodePolicyGate } from \"./code-tool-policy\";\nimport { applyCodePatch, resolveCodePath, validateCodePatch, validateRelativePath } from \"./code-patch\";\nimport { stageWorkspace } from \"./workspace\";\nimport { assertCodeBuildRecipe } from \"./recipe-container\";\nimport { digestStagedWorkspace } from \"./workspace-digest\";\nimport type { HarnessToolBroker, HarnessToolRequest, HarnessToolResponse } from \"./types\";\nimport type { CodeBuildRecipe, CodeToolBrokerOptions } from \"./code-tool-types\";\n\nexport type {\n  CodeBuildRecipe,\n  CodeRecipeExecutor,\n  CodeRecipeResult,\n  CodeToolBrokerOptions,\n  CodeToolDecision,\n} from \"./code-tool-types\";\n\n/** Create the trusted CaMeL boundary for all Pi filesystem and build effects. */\nexport function createCodeToolBroker(options: CodeToolBrokerOptions): HarnessToolBroker {\n  validateOptions(options);\n  const recipes = new Map(options.recipes.map((recipe) => [recipe.id, recipe]));\n  const policy = createCodePolicyGate(options);\n  let tail = Promise.resolve();\n  return {\n    execute(context, request) {\n      const result = tail.then(() => route(context, request, options, recipes, policy));\n      tail = result.then(() => undefined, () => undefined);\n      return result;\n    },\n  };\n}\n\nasync function route(\n  context: Parameters<HarnessToolBroker[\"execute\"]>[0],\n  request: HarnessToolRequest,\n  options: CodeToolBrokerOptions,\n  recipes: ReadonlyMap<string, CodeBuildRecipe>,\n  policy: ReturnType<typeof createCodePolicyGate>,\n): Promise<HarnessToolResponse> {\n  try {\n    if (context.signal?.aborted) throw new TypeError(\"tool request was cancelled\");\n    if (request.tool === \"sandbox.read\") return await read(context, request, options, policy);\n    if (request.tool === \"sandbox.apply_patch\") return await patch(context, request, options, policy);\n    return await recipe(context, request, options, recipes, policy);\n  } catch (reason) {\n    return response(request, false, reason instanceof TypeError ? reason.message : \"tool failed closed\");\n  }\n}\n\nasync function read(\n  context: Parameters<HarnessToolBroker[\"execute\"]>[0],\n  request: HarnessToolRequest,\n  options: CodeToolBrokerOptions,\n  policy: ReturnType<typeof createCodePolicyGate>,\n): Promise<HarnessToolResponse> {\n  exactKeys(request.input, [\"path\", \"startLine\", \"endLine\"]);\n  const path = stringField(request.input, \"path\");\n  const startLine = optionalInteger(request.input.startLine) ?? 1;\n  const endLine = optionalInteger(request.input.endLine) ?? startLine + (options.maxReadLines ?? 2_000) - 1;\n  if (endLine < startLine || endLine - startLine + 1 > (options.maxReadLines ?? 2_000)) {\n    throw new TypeError(\"requested line range exceeds its bound\");\n  }\n  const paths = await registeredFiles(context.workspaceDir, 20_000);\n  const allowed = await policy.read(policyContext(context, request, options, { paths, path, startLine, endLine }));\n  if (!allowed) return response(request, false, \"tool denied by CaMeL policy\");\n  const target = resolveCodePath(context.workspaceDir, path);\n  const info = await stat(target);\n  if (!info.isFile() || info.size > Math.max(options.maxReadBytes ?? 128 * 1024, 2 * 1024 * 1024)) {\n    throw new TypeError(\"file is not a bounded regular source file\");\n  }\n  const source = await readFile(target);\n  if (source.includes(0)) throw new TypeError(\"binary files are not readable through this tool\");\n  const lines = source.toString(\"utf8\").split(\"\\n\");\n  const content = lines.slice(startLine - 1, endLine).join(\"\\n\");\n  if (Buffer.byteLength(content) > (options.maxReadBytes ?? 128 * 1024)) {\n    throw new TypeError(\"read result exceeds its byte bound\");\n  }\n  return response(request, true, content, { path, startLine, endLine: Math.min(endLine, lines.length) });\n}\n\nasync function patch(\n  context: Parameters<HarnessToolBroker[\"execute\"]>[0],\n  request: HarnessToolRequest,\n  options: CodeToolBrokerOptions,\n  policy: ReturnType<typeof createCodePolicyGate>,\n): Promise<HarnessToolResponse> {\n  exactKeys(request.input, [\"patch\"]);\n  const value = stringField(request.input, \"patch\");\n  const paths = validateCodePatch(value, options.maxPatchBytes ?? 256 * 1024);\n  if (paths.some((path) => options.readOnlyPrefixes?.some((prefix) => path === prefix || path.startsWith(`${prefix}/`)))) {\n    throw new TypeError(\"patch targets a read-only reference source\");\n  }\n  const allowed = await policy.patch(policyContext(context, request, options, { patch: value }));\n  if (!allowed) return response(request, false, \"tool denied by CaMeL policy\");\n  await applyCodePatch(context.workspaceDir, value, paths);\n  return response(request, true, `Applied patch to ${paths.length} file(s).`, { paths });\n}\n\nasync function recipe(\n  context: Parameters<HarnessToolBroker[\"execute\"]>[0],\n  request: HarnessToolRequest,\n  options: CodeToolBrokerOptions,\n  recipes: ReadonlyMap<string, CodeBuildRecipe>,\n  policy: ReturnType<typeof createCodePolicyGate>,\n): Promise<HarnessToolResponse> {\n  exactKeys(request.input, [\"recipeId\"]);\n  const recipeId = stringField(request.input, \"recipeId\");\n  const digestLimits = {\n    maxFiles: options.maxRecipeWorkspaceFiles ?? 20_000,\n    maxBytes: options.maxRecipeWorkspaceBytes ?? 512 * 1024 * 1024,\n  };\n  const sourceDigest = await digestStagedWorkspace(context.workspaceDir, digestLimits);\n  const allowed = await policy.recipe(policyContext(context, request, options, {\n    recipeIds: [...recipes.keys()].sort(), recipeId, sourceDigest,\n  }));\n  if (!allowed) return response(request, false, \"tool denied by CaMeL policy\");\n  const selected = recipes.get(recipeId);\n  if (!selected) return response(request, false, \"build recipe is not registered\");\n  const staged = await stageWorkspace(context.workspaceDir, {\n    maxFiles: digestLimits.maxFiles,\n    maxBytes: digestLimits.maxBytes,\n  });\n  try {\n    if (await digestStagedWorkspace(staged.workspaceDir, digestLimits) !== sourceDigest) {\n      throw new TypeError(\"workspace changed after recipe authorization\");\n    }\n    const result = await options.recipeExecutor.run({\n      workspaceDir: staged.workspaceDir, recipe: selected, signal: context.signal,\n    });\n    const output = [result.stdout, result.stderr].filter(Boolean).join(\"\\n\");\n    const ok = result.exitCode === 0 && !result.outputLimitExceeded && !result.timedOut;\n    const status = result.timedOut ? \"timed out\" : result.outputLimitExceeded ? \"exceeded output limit\"\n      : ok ? \"passed\" : `failed with exit ${result.exitCode}`;\n    return response(request, ok, `Recipe ${recipeId} ${status}.${output ? `\\n${output}` : \"\"}`, {\n      recipeId, exitCode: result.exitCode, durationMs: result.durationMs,\n      outputLimitExceeded: result.outputLimitExceeded, timedOut: result.timedOut,\n    });\n  } finally {\n    await staged.cleanup();\n  }\n}\n\nfunction policyContext<T extends object>(\n  context: Parameters<HarnessToolBroker[\"execute\"]>[0],\n  request: HarnessToolRequest,\n  options: CodeToolBrokerOptions,\n  extra: T,\n) {\n  return {\n    lease: context.lease, request, workspaceId: `workspace:${context.lease.task.attemptId}`,\n    readers: { kind: \"principals\", principalIds: [options.readerId] } as const, ...extra,\n  };\n}\n\nasync function registeredFiles(root: string, limit: number): Promise<string[]> {\n  const paths: string[] = [];\n  const walk = async (directory: string): Promise<void> => {\n    for (const entry of await readdir(directory, { withFileTypes: true })) {\n      if (entry.isSymbolicLink()) throw new TypeError(\"workspace contains a symbolic link\");\n      const target = resolve(directory, entry.name);\n      if (entry.isDirectory()) await walk(target);\n      else if (entry.isFile()) {\n        const path = relative(root, target).split(\"\\\\\").join(\"/\");\n        try { validateRelativePath(path); } catch { continue; }\n        paths.push(path);\n        if (paths.length > limit) throw new TypeError(\"workspace file registry exceeds its bound\");\n      }\n    }\n  };\n  await walk(resolve(root));\n  return paths.sort();\n}\n\nfunction validateOptions(options: CodeToolBrokerOptions): void {\n  if (!options.readerId || !options.recipes.length || new Set(options.recipes.map((item) => item.id)).size !== options.recipes.length) {\n    throw new TypeError(\"Code tool broker requires a reader and unique registered recipes\");\n  }\n  for (const recipe of options.recipes) assertCodeBuildRecipe(recipe);\n  if (options.readOnlyPrefixes?.some((prefix) => !/^[A-Za-z0-9_.-]+$/.test(prefix) || prefix === \".\" || prefix === \"..\")) {\n    throw new TypeError(\"Code tool broker read-only prefix is invalid\");\n  }\n}\n\nfunction exactKeys(input: Record<string, unknown>, allowed: readonly string[]): void {\n  if (Object.keys(input).some((key) => !allowed.includes(key))) throw new TypeError(\"tool input contains an unsupported field\");\n}\n\nfunction stringField(input: Record<string, unknown>, name: string): string {\n  const value = input[name];\n  if (typeof value !== \"string\" || !value) throw new TypeError(`${name} must be a non-empty string`);\n  return value;\n}\n\nfunction optionalInteger(value: unknown): number | undefined {\n  if (value === undefined) return undefined;\n  if (!Number.isSafeInteger(value) || (value as number) < 1) throw new TypeError(\"line bounds must be positive integers\");\n  return value as number;\n}\n\nfunction response(\n  request: HarnessToolRequest,\n  ok: boolean,\n  content: string,\n  details?: Record<string, unknown>,\n): HarnessToolResponse {\n  return { requestId: request.requestId, ok, content, ...(details ? { details } : {}) };\n}\n","import {\n  conversionPolicyDigest,\n  createCamelIngress,\n  createConversionRegistry,\n  registeredIdRegistryDigest,\n  type ReaderSet,\n  type SafeConversionPolicy,\n  type SafeConversionSpec,\n} from \"@odla-ai/camel\";\nimport {\n  createEffectPolicy,\n  destinationRegistryDigest,\n  type EffectClass,\n  type PolicyInput,\n  type PolicyOutcome,\n  type ToolArgument,\n  type ToolDescriptor,\n} from \"@odla-ai/camel/policy\";\nimport type { HarnessLease, HarnessToolRequest } from \"./types\";\nimport type { CodeToolBrokerOptions, CodeToolDecision } from \"./code-tool-types\";\n\nconst DESTINATIONS = \"code-workspaces.v1\";\nconst READ: ToolDescriptor = descriptor(\"sandbox.read\", \"scoped_data_read\", {\n  workspace: \"destination\", authority: \"authority\", path: \"selector\",\n  startLine: \"selector\", endLine: \"selector\",\n});\nconst PATCH: ToolDescriptor = descriptor(\"sandbox.apply_patch\", \"reversible_mutation\", {\n  workspace: \"destination\", authority: \"authority\", patch: \"payload\",\n});\nconst RECIPE: ToolDescriptor = descriptor(\"sandbox.run_recipe\", \"code_execution\", {\n  workspace: \"destination\", authority: \"authority\", recipeId: \"selector\", sourceDigest: \"payload\",\n});\n\ninterface PolicyContext {\n  lease: HarnessLease;\n  request: HarnessToolRequest;\n  workspaceId: string;\n  readers: ReaderSet;\n}\n\nexport interface CodePolicyGate {\n  read(input: PolicyContext & { paths: readonly string[]; path: string; startLine: number; endLine: number }): Promise<boolean>;\n  patch(input: PolicyContext & { patch: string }): Promise<boolean>;\n  recipe(input: PolicyContext & { recipeIds: readonly string[]; recipeId: string; sourceDigest: string }): Promise<boolean>;\n}\n\n/** Create CaMeL argument labelling and effect authorization for Code tools. */\nexport function createCodePolicyGate(options: CodeToolBrokerOptions): CodePolicyGate {\n  return {\n    read: async (input) => {\n      const base = await environment(input, options, \"sandbox.read\");\n      const conversions = await conversionRegistry([\n        await registeredPolicy(\"code.path.v1\", \"code.paths.v1\", input.paths),\n        await conversionPolicy(\"code.line.v1\", { kind: \"integer\", minimum: 1, maximum: 1_000_000 }),\n      ], { \"code.paths.v1\": input.paths });\n      const path = await conversions.operations.registeredId(unsafe(base, input.path, \"path\"), \"code.path.v1\");\n      const start = await conversions.operations.integer(unsafe(base, input.startLine, \"start\"), \"code.line.v1\");\n      const end = await conversions.operations.integer(unsafe(base, input.endLine, \"end\"), \"code.line.v1\");\n      if (end.value < start.value) return false;\n      return authorize(input, options, base, READ, {\n        ...base.fixedArgs,\n        path: { role: \"selector\", value: path },\n        startLine: { role: \"selector\", value: start },\n        endLine: { role: \"selector\", value: end },\n      }, [path, start, end]);\n    },\n    patch: async (input) => {\n      const base = await environment(input, options, \"sandbox.apply_patch\");\n      const patch = unsafe(base, input.patch, \"patch\");\n      return authorize(input, options, base, PATCH, {\n        ...base.fixedArgs, patch: { role: \"payload\", value: patch },\n      }, []);\n    },\n    recipe: async (input) => {\n      const base = await environment(input, options, \"sandbox.run_recipe\");\n      const conversions = await conversionRegistry([\n        await registeredPolicy(\"code.recipe.v1\", \"code.recipes.v1\", input.recipeIds),\n      ], { \"code.recipes.v1\": input.recipeIds });\n      const recipe = await conversions.operations.registeredId(unsafe(base, input.recipeId, \"recipe\"), \"code.recipe.v1\");\n      const source = unsafe(base, input.sourceDigest, \"source\");\n      return authorize(input, options, base, RECIPE, {\n        ...base.fixedArgs, recipeId: { role: \"selector\", value: recipe },\n        sourceDigest: { role: \"payload\", value: source },\n      }, [recipe]);\n    },\n  };\n}\n\nfunction descriptor(name: string, effect: EffectClass, argumentRoles: ToolDescriptor[\"argumentRoles\"]): ToolDescriptor {\n  return { name, version: 1, effect, inputSchema: { type: \"object\" }, argumentRoles, policyId: `odla.code.${name}.v1` };\n}\n\nasync function conversionPolicy(id: string, output: SafeConversionSpec): Promise<SafeConversionPolicy> {\n  const definition = {\n    conversionId: id, version: 1, output, maximumSourceBytes: 1_000_000,\n    maximumOutputsPerArtifact: 4, presentation: \"json_scalar\" as const,\n  };\n  return { ...definition, digest: await conversionPolicyDigest(definition) };\n}\n\nasync function registeredPolicy(id: string, registryId: string, values: readonly string[]) {\n  const mapping = Object.fromEntries(values.map((value) => [value, value]));\n  return conversionPolicy(id, {\n    kind: \"registered_id\", registryId, registryDigest: await registeredIdRegistryDigest(mapping),\n  });\n}\n\nasync function conversionRegistry(policies: SafeConversionPolicy[], values: Record<string, readonly string[]>) {\n  const registeredIds = Object.fromEntries(await Promise.all(Object.entries(values).map(async ([id, entries]) => {\n    const mapping = Object.fromEntries(entries.map((value) => [value, value]));\n    return [id, { values: mapping, digest: await registeredIdRegistryDigest(mapping) }];\n  })));\n  return createConversionRegistry({ policies, registeredIds });\n}\n\nasync function environment(input: PolicyContext, options: CodeToolBrokerOptions, tool: string) {\n  const ingress = createCamelIngress([\n    { id: \"workspace\", value: input.workspaceId, readers: input.readers },\n    { id: \"authority\", value: `lease:${input.lease.leaseId}`, readers: input.readers },\n    { id: \"reader\", value: options.readerId, readers: input.readers },\n  ] as const);\n  const digest = await destinationRegistryDigest([input.workspaceId]);\n  const approvals: EffectClass[] = [\"irreversible_mutation\", \"external_send\", \"financial\", \"secret_read\"];\n  if (options.recipeAuthorization === \"exact_approval\") approvals.push(\"code_execution\");\n  const policy = createEffectPolicy({\n    destinationRegistries: { [DESTINATIONS]: { digest, values: [input.workspaceId] } },\n    approvalEffects: approvals,\n  });\n  const fixedArgs: Record<string, ToolArgument> = {\n    workspace: { role: \"destination\", value: ingress.control(\"workspace\"), registryId: DESTINATIONS, registryDigest: digest },\n    authority: { role: \"authority\", value: ingress.control(\"authority\") },\n  };\n  return { ingress, policy, fixedArgs, reader: ingress.control(\"reader\"), runId: `${input.request.requestId}:${tool}` };\n}\n\nfunction unsafe(base: Awaited<ReturnType<typeof environment>>, value: unknown, field: string) {\n  return base.ingress.quarantinedOutput(value, {\n    readers: base.reader.label.readers, runId: `${base.runId}:${field}`,\n  });\n}\n\nasync function authorize(\n  input: PolicyContext,\n  options: CodeToolBrokerOptions,\n  base: Awaited<ReturnType<typeof environment>>,\n  tool: ToolDescriptor,\n  args: Record<string, ToolArgument>,\n  controlDependencies: PolicyInput[\"controlDependencies\"],\n): Promise<boolean> {\n  const policy = await base.policy.evaluate({\n    planId: input.lease.task.taskId, tool, args, controlDependencies,\n    intendedReaderIds: [base.reader],\n  });\n  let approvalConsumed = false;\n  if (policy.outcome === \"require_approval\" && options.consumeApproval) {\n    approvalConsumed = await options.consumeApproval(decision(input, policy, false, tool.name, policy.actionDigest));\n  }\n  await options.onDecision?.(decision(input, policy, approvalConsumed, tool.name));\n  return policy.outcome === \"allow\" || approvalConsumed;\n}\n\nfunction decision(\n  input: PolicyContext,\n  policy: PolicyOutcome,\n  approvalConsumed: boolean,\n  tool: string,\n  actionDigest?: string,\n): CodeToolDecision & { actionDigest: string } {\n  return {\n    lease: input.lease, request: input.request, tool: tool as CodeToolDecision[\"tool\"],\n    policy, approvalConsumed, actionDigest: actionDigest ?? (policy.outcome === \"require_approval\" ? policy.actionDigest : \"\"),\n  };\n}\n","import type { CodePortableCheckpoint } from \"@odla-ai/camel/code\";\nimport type { CodeLocalSourceDescriptor, CodeRuntimeCommand } from \"./code-runtime\";\nimport { HARNESS_PROTOCOL_VERSION, type HarnessLease } from \"./types\";\n\nexport interface CodeCommandMetadata {\n  role: \"coding\" | \"review\"; title: string; prompt: string;\n  maxTokensPerInteraction: number;\n  planningInputDigest: `sha256:${string}` | null; attestationDigest: string;\n  repository: string; baseCommitSha: string; sourceTreeDigest: `sha256:${string}`;\n}\n\nexport function codeCommandMetadata(payload: Record<string, unknown>, resume: boolean): CodeCommandMetadata {\n  const trusted = record(payload.trustedBase);\n  const role = payload.role;\n  const title = payload.title;\n  const prompt = payload.prompt;\n  const maxTokensPerInteraction = payload.maxTokensPerInteraction ?? 32_000;\n  if ((role !== \"coding\" && role !== \"review\") || typeof title !== \"string\" || typeof prompt !== \"string\") {\n    throw new TypeError(`invalid Code ${resume ? \"resume\" : \"start\"} metadata`);\n  }\n  const planning = trusted?.planningInputDigest;\n  const attestation = trusted?.attestationDigest;\n  const repository = trusted?.repository;\n  const baseCommitSha = trusted?.commitSha;\n  const sourceTreeDigest = trusted?.treeDigest;\n  if (typeof repository !== \"string\" || !repository.includes(\"/\")\n    || typeof baseCommitSha !== \"string\" || !/^[0-9a-f]{40}$/.test(baseCommitSha)\n    || typeof sourceTreeDigest !== \"string\" || !/^sha256:[0-9a-f]{64}$/.test(sourceTreeDigest)) {\n    throw new TypeError(`invalid Code ${resume ? \"resume\" : \"start\"} trusted base`);\n  }\n  if (!Number.isSafeInteger(maxTokensPerInteraction) || Number(maxTokensPerInteraction) < 4_000\n    || Number(maxTokensPerInteraction) > 200_000) {\n    throw new TypeError(`invalid Code ${resume ? \"resume\" : \"start\"} interaction token limit`);\n  }\n  return { role, title, prompt,\n    maxTokensPerInteraction: Number(maxTokensPerInteraction),\n    planningInputDigest: typeof planning === \"string\" && /^sha256:[0-9a-f]{64}$/.test(planning)\n      ? planning as `sha256:${string}` : null,\n    attestationDigest: typeof attestation === \"string\" ? attestation : \"resume\",\n    repository, baseCommitSha, sourceTreeDigest: sourceTreeDigest as `sha256:${string}` };\n}\n\nexport function codeLocalSource(payload: Record<string, unknown>): CodeLocalSourceDescriptor | null {\n  const source = record(payload.source);\n  if (!source) return null;\n  if (source.kind !== \"local_checkout\" || typeof source.repository !== \"string\"\n    || typeof source.headCommitSha !== \"string\" || !/^[0-9a-f]{40}$/.test(source.headCommitSha)\n    || typeof source.trustedBaseDigest !== \"string\" || !/^sha256:[0-9a-f]{64}$/.test(source.trustedBaseDigest)\n    || typeof source.developerPatchDigest !== \"string\" || !/^sha256:[0-9a-f]{64}$/.test(source.developerPatchDigest)\n    || typeof source.snapshotDigest !== \"string\" || !/^sha256:[0-9a-f]{64}$/.test(source.snapshotDigest)\n    || typeof source.modified !== \"boolean\"\n    || !Number.isSafeInteger(source.fileCount) || Number(source.fileCount) < 1 || Number(source.fileCount) > 20_000\n    || !Number.isSafeInteger(source.byteCount) || Number(source.byteCount) < 1 || Number(source.byteCount) > 512 * 1024 * 1024\n    || !Number.isSafeInteger(source.capturedAt) || Number(source.capturedAt) < 1) {\n    throw new TypeError(\"invalid local checkout source descriptor\");\n  }\n  return source as unknown as CodeLocalSourceDescriptor;\n}\n\nexport function codeCheckpointPayload(payload: Record<string, unknown>): CodePortableCheckpoint {\n  const value = payload.checkpoint;\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new TypeError(\"resume checkpoint is missing\");\n  return value as CodePortableCheckpoint;\n}\n\nexport function fakeCodeLease(command: CodeRuntimeCommand, metadata: CodeCommandMetadata): HarnessLease {\n  return { protocolVersion: HARNESS_PROTOCOL_VERSION, leaseId: `code:${command.commandId}`,\n    generation: command.bindingGeneration, expiresAt: Date.now() + 24 * 60 * 60_000,\n    task: { taskId: command.sessionId, attemptId: command.instanceId, title: metadata.title,\n      prompt: metadata.prompt, workspace: command.appId, aiRoute: metadata.role,\n      policy: { network: \"none\", timeoutMs: 30 * 60_000, maxOutputBytes: 4 * 1024 * 1024,\n        maxPatchBytes: 256 * 1024 } } };\n}\n\nconst record = (value: unknown) => value && typeof value === \"object\" && !Array.isArray(value)\n  ? value as Record<string, unknown> : null;\n","import { restoreCodeWorkspaceCheckpoint } from \"./code-checkpoint\";\nimport type { CodeLocalSourceDescriptor, CodeRuntimeCommand } from \"./code-runtime\";\nimport { codeCheckpointPayload } from \"./code-runtime-task\";\nimport { stageWorkspacePair, type StagedWorkspace } from \"./workspace\";\nimport { digestStagedWorkspace } from \"./workspace-digest\";\n\nconst SOURCE_LIMITS = { maxFiles: 20_000, maxBytes: 512 * 1024 * 1024 } as const;\n\nexport interface FrozenCodeLocalSource {\n  descriptor: CodeLocalSourceDescriptor;\n  trustedBaseDir: string;\n  sourceDir: string;\n}\n\n/** Reconstruct a fenced local session only from its frozen terminal-held\n * source and exact Git base. */\nexport async function prepareRuntimeLocalSource(input: {\n  command: CodeRuntimeCommand;\n  descriptor: CodeLocalSourceDescriptor;\n  available?: FrozenCodeLocalSource;\n  repository: string;\n  baseCommitSha: string;\n  resume: boolean;\n}): Promise<{ workspace: StagedWorkspace; sourceDigest: `sha256:${string}`; trustedBaseDigest: `sha256:${string}` }> {\n  const { command, descriptor, available, repository, baseCommitSha, resume } = input;\n  if (!available || JSON.stringify(available.descriptor) !== JSON.stringify(descriptor)\n    || descriptor.repository.toLowerCase() !== repository.toLowerCase()\n    || descriptor.headCommitSha !== baseCommitSha) {\n    throw new TypeError(\"the session's local checkout snapshot is not available on this terminal\");\n  }\n  const workspace = resume\n    ? (await restoreCodeWorkspaceCheckpoint({\n      trustedBaseDir: available.trustedBaseDir, trustedBaseCommitSha: baseCommitSha,\n      checkpoint: codeCheckpointPayload(command.payload),\n    })).workspace\n    : await stageWorkspacePair(available.trustedBaseDir, available.sourceDir, SOURCE_LIMITS);\n  const trustedBaseDigest = await digestStagedWorkspace(workspace.baselineDir, SOURCE_LIMITS);\n  if (trustedBaseDigest !== descriptor.trustedBaseDigest) {\n    await workspace.cleanup();\n    throw new TypeError(\"trusted Git base digest changed after connection\");\n  }\n  if (!resume && await digestStagedWorkspace(workspace.workspaceDir, SOURCE_LIMITS) !== descriptor.snapshotDigest) {\n    await workspace.cleanup();\n    throw new TypeError(\"local checkout snapshot digest changed after connection\");\n  }\n  return { workspace, sourceDigest: descriptor.snapshotDigest, trustedBaseDigest };\n}\n","import { createCodeToolBroker } from \"./code-tool-broker\";\nimport type { CodeBuildRecipe } from \"./code-tool-types\";\nimport type { ContainerEngine } from \"./container\";\nimport { createContainerRecipeExecutor } from \"./recipe-container\";\nimport type { HarnessLease, HarnessToolBroker } from \"./types\";\n\n/** Build the role-limited broker for one Pi attempt. */\nexport function createCodeRuntimeToolBroker(\n  input: {\n    recipes: readonly CodeBuildRecipe[];\n    engine: ContainerEngine;\n    recipeAuthorization?: \"registered_recipe\" | \"exact_approval\";\n  },\n  lease: HarnessLease,\n  role: \"coding\" | \"review\",\n): HarnessToolBroker {\n  const broker = createCodeToolBroker({\n    recipes: input.recipes, recipeExecutor: createContainerRecipeExecutor(input.engine),\n    recipeAuthorization: input.recipeAuthorization ?? \"registered_recipe\",\n    readerId: `code-session:${lease.task.taskId}`,\n    readOnlyPrefixes: [\".odla-references\"],\n  });\n  return role === \"coding\" ? broker : { execute: (context, request) => request.tool === \"sandbox.read\"\n    ? broker.execute(context, request)\n    : Promise.resolve({ requestId: request.requestId, ok: false, content: \"review sessions are read-only\" }) };\n}\n","import type { CodeRuntimeAgentControlPlane, CodeRuntimeCommand } from \"./code-runtime\";\nimport type { CodeCommandMetadata } from \"./code-runtime-task\";\nimport {\n  HARNESS_PROTOCOL_VERSION, type CodeSessionEventData, type HarnessAgentInput, type HarnessAgentOutput,\n} from \"./types\";\n\ntype InferenceRequest = Extract<HarnessAgentOutput, { type: \"inference.request\" }>;\nexport interface CodeInteractionBudgetState { tokens: number; noticeEmitted: boolean }\n\n/** Broker one model call while keeping per-owner-interaction accounting and\n * graceful pause behavior out of the main container lifecycle engine. */\nexport async function handleCodeRuntimeInference(input: {\n  command: CodeRuntimeCommand; metadata: CodeCommandMetadata; request: InferenceRequest;\n  state: CodeInteractionBudgetState; control: CodeRuntimeAgentControlPlane;\n  event(value: CodeSessionEventData): Promise<void>;\n}): Promise<HarnessAgentInput> {\n  const { command, metadata, request, state } = input;\n  if (state.tokens >= metadata.maxTokensPerInteraction) {\n    if (!state.noticeEmitted) {\n      state.noticeEmitted = true;\n      await input.event({ type: \"message\", actor: \"system\",\n        body: `Pi paused at the ${metadata.maxTokensPerInteraction.toLocaleString(\"en-US\")}-token per-interaction limit. Send a new instruction to continue.`,\n      }).catch(() => undefined);\n    }\n    return { protocolVersion: HARNESS_PROTOCOL_VERSION, type: \"inference.response\",\n      requestId: request.requestId, response: {\n        id: `budget:${command.commandId}`, provider: \"openai\", model: \"interaction-budget\",\n        role: \"assistant\", content: [{ type: \"text\", text: \"Pause now. The owner-set token limit for this interaction has been reached.\" }],\n        stopReason: \"end_turn\", usage: { inputTokens: 0, outputTokens: 0 },\n      } };\n  }\n  const startedAt = Date.now();\n  const response = await input.control.infer(command.sessionId, {\n    requestId: request.requestId, interactionId: command.commandId, call: request.call,\n  });\n  state.tokens += response.receipt.inputTokens + response.receipt.outputTokens;\n  await input.event({ type: \"usage\", provider: response.receipt.provider,\n    model: response.receipt.model, inputTokens: response.receipt.inputTokens,\n    outputTokens: response.receipt.outputTokens, durationMs: Date.now() - startedAt,\n    interactionId: command.commandId, interactionTokens: state.tokens,\n    interactionMaxTokens: metadata.maxTokensPerInteraction,\n  }).catch(() => undefined);\n  return { protocolVersion: HARNESS_PROTOCOL_VERSION, type: \"inference.response\",\n    requestId: request.requestId, response: response.response };\n}\n","import { createHash } from \"node:crypto\";\nimport type { CodeRuntimeAgentControlPlane, CodeRuntimeCommand } from \"./code-runtime\";\nimport type { CodeSessionEventData } from \"./types\";\n\nexport async function appendCodeRuntimeEvent(\n  control: CodeRuntimeAgentControlPlane, command: CodeRuntimeCommand,\n  event: CodeSessionEventData, refs: string[],\n): Promise<void> {\n  const eventId = `${command.commandId.slice(0, 45)}:${refs.length + 1}`;\n  refs.push(eventId);\n  const bounded = event.type === \"message\"\n    ? { ...event, body: event.body.trim().slice(0, 20_000) || `${event.actor} event` }\n    : event;\n  await control.appendSessionEvent(command.sessionId, eventId, bounded);\n}\n\nexport const digestRuntimeValue = (value: string): `sha256:${string}` =>\n  `sha256:${createHash(\"sha256\").update(value).digest(\"hex\")}`;\nexport const runtimeErrorMessage = (value: unknown): string => value instanceof Error ? value.message : String(value);\nexport const runtimeRecord = (value: unknown): Record<string, unknown> | null =>\n  value && typeof value === \"object\" && !Array.isArray(value) ? value as Record<string, unknown> : null;\nexport const safeRuntimeJson = (value: unknown): string => {\n  try { return JSON.stringify(value).slice(0, 10_000); } catch { return \"[event]\"; }\n};\nexport function runtimeResultText(value: unknown): string | null {\n  const record = runtimeRecord(value);\n  if (record && typeof record.text === \"string\") return record.text.slice(0, 20_000);\n  if (record && typeof record.error === \"string\") return `Pi failed: ${record.error.slice(0, 19_989)}`;\n  return null;\n}\n\nexport function runtimeResultError(value: unknown): string | null {\n  const record = runtimeRecord(value);\n  return record && typeof record.error === \"string\" && record.error.trim()\n    ? record.error.trim().slice(0, 2_000) : null;\n}\n","import { restoreCodeWorkspaceCheckpoint } from \"./code-checkpoint\";\nimport { CodeRuntimeCheckpointManager } from \"./code-runtime-checkpoint-manager\";\nimport { attachCodeRuntimeReferences, materializeCodeRuntimeSource } from \"./code-runtime-source\";\nimport { type CodeRuntimeCommand, type CodeRuntimeCommandEngine, type CodeRuntimeCommandResult } from \"./code-runtime\";\nimport type { ActiveCodeRuntimeSession as ActiveSession, CodePiRuntimeEngineOptions } from \"./code-runtime-engine-types\";\nexport type { CodePiRuntimeEngineOptions } from \"./code-runtime-engine-types\";\nimport {\n  codeCheckpointPayload, codeCommandMetadata, codeLocalSource, fakeCodeLease, type CodeCommandMetadata,\n} from \"./code-runtime-task\";\nimport { runContainerAttempt, type ContainerRunOptions, type ContainerRunResult } from \"./container\";\nimport { createContainerRecipeExecutor } from \"./recipe-container\";\nimport { prepareRuntimeLocalSource } from \"./code-runtime-local-source\";\nimport { HARNESS_PROTOCOL_VERSION, type CodeSessionEventData } from \"./types\";\nimport { stageWorkspace, type StagedWorkspace } from \"./workspace\";\nimport { digestStagedWorkspace } from \"./workspace-digest\";\nimport { createCodeRuntimeToolBroker } from \"./code-runtime-broker\";\nimport { handleCodeRuntimeInference } from \"./code-runtime-inference\";\nimport { appendCodeRuntimeEvent, digestRuntimeValue as digest, runtimeErrorMessage as message,\n  runtimeRecord as object, runtimeResultError as resultError, runtimeResultText as resultText,\n  safeRuntimeJson as json } from \"./code-runtime-events\";\n\n/** Execute fenced Code commands with real Pi in a credentialless, networkless container. */\nexport class CodePiRuntimeEngine implements CodeRuntimeCommandEngine {\n  readonly #active = new Map<string, ActiveSession>();\n  readonly #run: (options: ContainerRunOptions) => Promise<ContainerRunResult>;\n  readonly #buildPolicyDigest: `sha256:${string}`;\n  readonly #checkpoints: CodeRuntimeCheckpointManager;\n\n  constructor(private readonly options: CodePiRuntimeEngineOptions) {\n    if (options.imageAuthorization === \"cli_embedded\" && !/^odla-ai\\/pi-agent:embedded-sha256-[0-9a-f]{64}$/.test(options.image)) throw new TypeError(\"CLI-embedded Pi image must use its content-addressed local tag\");\n    this.#run = options.runAttempt ?? runContainerAttempt; this.#buildPolicyDigest = digest(JSON.stringify(options.recipes));\n    this.#checkpoints = new CodeRuntimeCheckpointManager({\n      control: options.control, recipes: options.recipes,\n      recipeExecutor: options.recipeExecutor ?? createContainerRecipeExecutor(options.engine),\n      fallbackPolicyDigest: this.#buildPolicyDigest,\n      event: (command, event, refs) => this.#event(command, event, refs),\n    });\n  }\n\n  execute(command: CodeRuntimeCommand): Promise<CodeRuntimeCommandResult> {\n    if (command.kind === \"checkpoint_stop\") return this.#checkpoint(command);\n    if (command.kind === \"prompt\") return this.#prompt(command);\n    return this.#start(command, command.kind === \"resume\");\n  }\n\n  async acknowledged(command: CodeRuntimeCommand, result: CodeRuntimeCommandResult): Promise<void> {\n    if (await this.#checkpoints.acknowledged(command, result)) return;\n    const active = this.#active.get(command.sessionId);\n    if (!active || result.status !== \"running\") return;\n    active.acknowledged = true;\n    if (active.failure) await this.options.control.reportSessionFailure(command.sessionId, active.failure).catch(() => undefined);\n  }\n\n  async close(): Promise<void> {\n    const sessions = [...this.#active.values()];\n    for (const session of sessions) session.abort.abort(\"runtime_shutdown\");\n    await Promise.allSettled(sessions.map((session) => session.done));\n    await Promise.allSettled(sessions.map((session) => session.workspace.cleanup()));\n    this.#active.clear();\n  }\n\n  async #start(command: CodeRuntimeCommand, resume: boolean): Promise<CodeRuntimeCommandResult> {\n    if (this.#active.has(command.sessionId)) throw new TypeError(\"Code session is already active on this runtime\");\n    const metadata = codeCommandMetadata(command.payload, resume);\n    const requestedLocal = codeLocalSource(command.payload);\n    let workspace: StagedWorkspace;\n    let sourceDigest: `sha256:${string}`;\n    let localTrustedBaseDigest: `sha256:${string}` | undefined;\n    if (requestedLocal) {\n      const prepared = await prepareRuntimeLocalSource({\n        command, descriptor: requestedLocal, available: this.options.localSource,\n        repository: metadata.repository, baseCommitSha: metadata.baseCommitSha, resume,\n      });\n      ({ workspace, sourceDigest, trustedBaseDigest: localTrustedBaseDigest } = prepared);\n      if (command.payload.sourceSet) {\n        const selected = await this.options.control.source(command.sessionId);\n        if (selected.repository !== metadata.repository || selected.commitSha !== metadata.baseCommitSha\n          || selected.treeDigest !== metadata.sourceTreeDigest) {\n          await workspace.cleanup();\n          throw new TypeError(\"Code local source does not match the selected GitHub primary source\");\n        }\n        await attachCodeRuntimeReferences(workspace, selected.references ?? []);\n      }\n    } else {\n      const source = await this.options.control.source(command.sessionId);\n      const materialized = await materializeCodeRuntimeSource(source);\n      try {\n        workspace = resume\n          ? (await restoreCodeWorkspaceCheckpoint({\n            trustedBaseDir: materialized.sourceDir, trustedBaseCommitSha: source.commitSha,\n            checkpoint: codeCheckpointPayload(command.payload),\n          })).workspace\n          : await stageWorkspace(materialized.sourceDir);\n      } finally { await materialized.cleanup(); }\n      sourceDigest = source.treeDigest;\n    }\n    const abort = new AbortController();\n    const conversationRefs: string[] = [];\n    const active: ActiveSession = {\n      workspace, abort, conversationRefs, acknowledged: false, role: metadata.role, title: metadata.title,\n      maxTokensPerInteraction: metadata.maxTokensPerInteraction,\n      baseCommitSha: metadata.baseCommitSha, repository: metadata.repository, sourceTreeDigest: metadata.sourceTreeDigest,\n      trustedBaseDigest: requestedLocal ? localTrustedBaseDigest! : await digestStagedWorkspace(workspace.baselineDir, {\n        maxFiles: 20_000, maxBytes: 512 * 1024 * 1024,\n      }),\n      planningInputDigest: metadata.planningInputDigest ?? digest(\n        JSON.stringify({ attestation: metadata.attestationDigest, prompt: metadata.prompt, tree: sourceDigest }),\n      ),\n      done: Promise.resolve(null),\n    };\n    this.#active.set(command.sessionId, active);\n    if (requestedLocal) {\n      await this.#event(command, {\n        type: \"message\", actor: \"system\",\n        body: `Source snapshot: local checkout ${requestedLocal.snapshotDigest} · ${requestedLocal.modified ? \"modified\" : \"clean\"} · Git ${requestedLocal.headCommitSha}`,\n      }, conversationRefs);\n    }\n    active.done = this.#runAttempt(command, metadata, active).catch(async (cause) => {\n      const detail = message(cause);\n      await this.#event(command, { type: \"message\", actor: \"system\", body: `Pi failed: ${detail}` }, conversationRefs).catch(() => undefined);\n      await this.#diagnostic(command, active, detail);\n      await this.#event(command, { type: \"status\", status: \"failed\" }, conversationRefs).catch(() => undefined);\n      await this.#failure(command, active, detail);\n      return null;\n    });\n    return { status: \"running\", message: resume ? \"Pi resumed from a portable checkpoint\" : \"Pi started\" };\n  }\n\n  async #prompt(command: CodeRuntimeCommand): Promise<CodeRuntimeCommandResult> {\n    const active = this.#active.get(command.sessionId);\n    const prompt = command.payload.prompt;\n    if (!active || typeof prompt !== \"string\" || !prompt.trim() || prompt.length > 20_000) {\n      throw new TypeError(\"prompt requires an active Code session and bounded text\");\n    }\n    const requestedLimit = command.payload.maxTokensPerInteraction ?? active.maxTokensPerInteraction;\n    if (!Number.isSafeInteger(requestedLimit) || Number(requestedLimit) < 4_000 || Number(requestedLimit) > 200_000) {\n      throw new TypeError(\"prompt requires a valid interaction token limit\");\n    }\n    active.maxTokensPerInteraction = Number(requestedLimit);\n    await active.done;\n    active.abort = new AbortController();\n    active.acknowledged = false;\n    active.failure = undefined;\n    active.done = this.#runAttempt(command, {\n      role: active.role, title: active.title, prompt,\n      maxTokensPerInteraction: active.maxTokensPerInteraction,\n      planningInputDigest: active.planningInputDigest, attestationDigest: \"follow-up\",\n      repository: active.repository, baseCommitSha: active.baseCommitSha, sourceTreeDigest: active.sourceTreeDigest,\n    }, active).catch(async (cause) => {\n      const detail = message(cause);\n      await this.#event(command, { type: \"message\", actor: \"system\", body: `Pi failed: ${detail}` },\n        active.conversationRefs).catch(() => undefined);\n      await this.#diagnostic(command, active, detail);\n      await this.#event(command, { type: \"status\", status: \"failed\" }, active.conversationRefs).catch(() => undefined);\n      await this.#failure(command, active, detail);\n      return null;\n    });\n    return { status: \"running\", message: \"Pi accepted the owner prompt\" };\n  }\n\n  async #runAttempt(\n    command: CodeRuntimeCommand, metadata: CodeCommandMetadata, active: ActiveSession,\n  ): Promise<ContainerRunResult> {\n    const lease = fakeCodeLease(command, metadata);\n    const broker = createCodeRuntimeToolBroker({\n      recipes: this.options.recipes, engine: this.options.engine,\n      recipeAuthorization: this.options.recipeAuthorization,\n    }, lease, metadata.role);\n    const startedAt = Date.now();\n    let completionSeen = false;\n    const interaction = { tokens: 0, noticeEmitted: false };\n    const result = await this.#run({\n      engine: this.options.engine, image: this.options.image, allowUnpinnedImage: this.options.imageAuthorization === \"cli_embedded\", workspaceDir: active.workspace.workspaceDir,\n      workspaceAccess: \"none\", task: lease.task, limits: this.options.limits, signal: active.abort.signal,\n      onStderr: (text) => this.#event(command, {\n        type: \"message\", actor: \"system\", body: text.slice(0, 4_000),\n      }, active.conversationRefs),\n      onMessage: async (output) => {\n        if (output.type === \"inference.request\") {\n          return handleCodeRuntimeInference({ command, metadata, request: output, state: interaction,\n            control: this.options.control, event: (event) => this.#event(\n              command, event, active.conversationRefs,\n            ),\n          });\n        }\n        if (output.type === \"tool.request\") {\n          const toolStarted = Date.now();\n          await this.#event(command, { type: \"tool\", phase: \"started\", tool: output.tool },\n            active.conversationRefs).catch(() => undefined);\n          const response = await broker.execute({\n            lease, workspaceDir: active.workspace.workspaceDir, signal: active.abort.signal,\n          }, output);\n          await this.#event(command, { type: \"tool\", phase: \"completed\", tool: output.tool,\n            ok: response.ok, durationMs: Date.now() - toolStarted,\n          }, active.conversationRefs).catch(() => undefined);\n          return { protocolVersion: HARNESS_PROTOCOL_VERSION, type: \"tool.response\" as const, ...response };\n        }\n        if (output.type === \"event\") {\n          const payload = object(output.payload);\n          if (output.kind === \"pi.started\") {\n            await this.#event(command, { type: \"status\", status: \"running\" }, active.conversationRefs);\n          } else if (output.kind === \"pi.thinking\" && payload?.available === true\n            && Number.isSafeInteger(payload.durationMs) && Number(payload.durationMs) >= 0) {\n            await this.#event(command, { type: \"thinking\", available: true,\n              durationMs: Math.min(Number(payload.durationMs), 86_400_000),\n            }, active.conversationRefs);\n          } else {\n            await this.#event(command, { type: \"message\", actor: \"system\",\n              body: `${output.kind}${output.payload === undefined ? \"\" : ` ${json(output.payload)}`}`,\n            }, active.conversationRefs);\n          }\n        } else if (output.type === \"attempt.complete\") {\n          completionSeen = true;\n          const body = resultText(output.result) ?? `Pi ${output.status}.`;\n          await this.#event(command, { type: \"message\",\n            actor: output.status === \"completed\" ? \"agent\" : \"system\", body,\n          }, active.conversationRefs);\n          await this.#event(command, { type: \"status\", status: output.status === \"completed\" ? \"idle\" : \"failed\",\n            durationMs: Date.now() - startedAt,\n          }, active.conversationRefs);\n        }\n      },\n    });\n    if (result.status === \"failed\" && result.stderr) {\n      await this.#event(command, { type: \"message\", actor: \"system\", body: result.stderr.slice(0, 4_000) }, active.conversationRefs);\n    }\n    if (!completionSeen) await this.#event(command, { type: \"status\",\n      status: result.status === \"completed\" ? \"idle\" : \"failed\", durationMs: Date.now() - startedAt,\n    }, active.conversationRefs).catch(() => undefined);\n    if (result.status === \"failed\") {\n      const detail = (resultError(result.result) ?? result.stderr.trim()) || \"Pi container failed\";\n      await this.#diagnostic(command, active, detail);\n      await this.#failure(command, active, detail);\n    }\n    return result;\n  }\n\n  async #checkpoint(command: CodeRuntimeCommand): Promise<CodeRuntimeCommandResult> {\n    const active = this.#active.get(command.sessionId);\n    if (!active) throw new TypeError(\"Code session workspace is not active on this runtime\");\n    const result = await this.#checkpoints.prepare(command, active);\n    this.#active.delete(command.sessionId);\n    return result;\n  }\n\n  async #failure(command: CodeRuntimeCommand, active: ActiveSession, value: string): Promise<void> {\n    active.failure = value.slice(0, 2_000);\n    if (active.acknowledged) {\n      await this.options.control.reportSessionFailure(command.sessionId, active.failure).catch(() => undefined);\n    }\n  }\n\n  async #diagnostic(command: CodeRuntimeCommand, active: ActiveSession, value: string): Promise<void> {\n    const detail = value.trim().slice(0, 2_000) || \"Pi runtime failed\";\n    this.options.onDiagnostic?.(detail);\n    await this.#event(command, { type: \"diagnostic\", level: \"error\", message: detail },\n      active.conversationRefs).catch(() => undefined);\n  }\n\n  async #event(command: CodeRuntimeCommand, event: CodeSessionEventData, refs: string[]): Promise<void> {\n    await appendCodeRuntimeEvent(this.options.control, command, event, refs);\n  }\n}\n","/** Stable Camel failure codes. Dynamic Unsafe text never belongs in these values. */\nexport type CamelErrorCode =\n  | \"role_attestation_failed\"\n  | \"permission_denied\"\n  | \"unsafe_privileged_flow\"\n  | \"unsafe_instruction_argument\"\n  | \"unsafe_authority_argument\"\n  | \"unsafe_selector_not_confined\"\n  | \"destination_not_registered\"\n  | \"reader_mismatch\"\n  | \"conversion_rejected\"\n  | \"policy_denied\"\n  | \"approval_required\"\n  | \"approval_mismatch\"\n  | \"no_reentry_required\"\n  | \"not_enough_information\"\n  | \"artifact_revoked\"\n  | \"safe_datum_revoked\"\n  | \"limit_exceeded\"\n  | \"state_conflict\";\n\n/** An error whose code and message are package-owned and prompt-injection Safe. */\nexport class CamelError extends Error {\n  readonly code: CamelErrorCode;\n  readonly safeMessage: string;\n\n  constructor(code: CamelErrorCode, safeMessage: string, options?: { cause?: unknown }) {\n    super(safeMessage, options);\n    this.name = \"CamelError\";\n    this.code = code;\n    this.safeMessage = safeMessage;\n  }\n}\n","import { CamelError } from \"./errors\";\n\nexport function canonicalJson(value: unknown): string {\n  return JSON.stringify(normalize(value));\n}\n\nexport async function sha256Hex(value: string | Uint8Array): Promise<string> {\n  const bytes = typeof value === \"string\" ? new TextEncoder().encode(value) : value;\n  const digest = await crypto.subtle.digest(\"SHA-256\", Uint8Array.from(bytes).buffer);\n  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport function utf8Length(value: unknown): number {\n  if (typeof value === \"string\") return new TextEncoder().encode(value).byteLength;\n  if (value instanceof Uint8Array) return value.byteLength;\n  try {\n    return new TextEncoder().encode(canonicalJson(value)).byteLength;\n  } catch {\n    throw new CamelError(\"conversion_rejected\", \"Unsafe input could not be canonically measured.\");\n  }\n}\n\nfunction normalize(value: unknown): unknown {\n  if (value === null || typeof value === \"string\" || typeof value === \"boolean\") return value;\n  if (typeof value === \"number\") {\n    if (!Number.isFinite(value)) throw new CamelError(\"state_conflict\", \"Canonical JSON rejects non-finite numbers.\");\n    return value;\n  }\n  if (Array.isArray(value)) return value.map(normalize);\n  if (value instanceof Uint8Array) return { $bytes: [...value] };\n  if (typeof value === \"object\") {\n    const record = value as Record<string, unknown>;\n    return Object.fromEntries(Object.keys(record).filter((key) => record[key] !== undefined).sort().map((key) => [key, normalize(record[key])]));\n  }\n  throw new CamelError(\"state_conflict\", \"Canonical JSON rejects unsupported values.\");\n}\n","import { CamelError } from \"./errors\";\nimport type { CamelValue, DependencyRef, ProvenanceRef, ReaderSet } from \"./value\";\n\n/** Intersect reader capabilities across every dependency. */\nexport function intersectReaders(values: readonly ReaderSet[]): ReaderSet {\n  if (values.length === 0 || values.every((value) => value.kind === \"public\")) return { kind: \"public\" };\n  const restricted = values.filter((value): value is Extract<ReaderSet, { kind: \"principals\" }> => value.kind === \"principals\");\n  let ids = new Set(restricted[0]?.principalIds ?? []);\n  for (const readers of restricted.slice(1)) ids = new Set(readers.principalIds.filter((id) => ids.has(id)));\n  return { kind: \"principals\", principalIds: [...ids].sort() };\n}\n\n/** Return whether an exact model, provider, principal, or isolate may read a value. */\nexport function canRead(readers: ReaderSet, readerId: string): boolean {\n  return readers.kind === \"public\" || readers.principalIds.includes(readerId);\n}\n\n/** Throw a fixed Safe error when a selected reader lacks capability. */\nexport function assertReader(value: CamelValue<unknown, \"safe\" | \"unsafe\">, readerId: string): void {\n  if (!canRead(value.label.readers, readerId)) throw new CamelError(\"reader_mismatch\", \"The selected reader is not authorized for this value.\");\n}\n\n/** Deduplicate provenance from labelled inputs without copying their values. */\nexport function mergeProvenance(values: readonly CamelValue<unknown>[]): readonly ProvenanceRef[] {\n  const refs = new Map<string, ProvenanceRef>();\n  for (const value of values) {\n    for (const ref of value.label.provenance) refs.set(`${ref.kind}\\u0000${ref.id}\\u0000${ref.digest ?? \"\"}`, ref);\n  }\n  return [...refs.values()];\n}\n\n/** Materialize immutable dependency records for labelled inputs. */\nexport function dependenciesOf(values: readonly CamelValue<unknown>[], influence: \"data\" | \"control\" = \"data\"): readonly DependencyRef[] {\n  const result: DependencyRef[] = [];\n  for (const value of values) {\n    result.push(...value.label.dependencies);\n    for (const ref of value.label.provenance) {\n      result.push({ ref, influence, promptSafetyAtUse: value.label.promptSafety });\n    }\n  }\n  const unique = new Map<string, DependencyRef>();\n  for (const dep of result) unique.set(`${dep.ref.kind}\\u0000${dep.ref.id}\\u0000${dep.influence}\\u0000${dep.promptSafetyAtUse}`, dep);\n  return [...unique.values()];\n}\n","import { CamelError } from \"./errors\";\n\n/** Whether a value may enter the privileged model context for prompt-injection purposes. */\nexport type PromptSafety = \"safe\" | \"unsafe\";\n/** Control-owned reason a value is prompt-injection Safe. */\nexport type SafeBasis =\n  | \"user_instruction\"\n  | \"system_policy\"\n  | \"harness_constant\"\n  | \"atomic_conversion\"\n  | \"safe_operation\"\n  | \"privileged_generation\"\n  | \"trusted_artifact\";\n\n/** Capability set allowed to receive a value, independent from prompt safety. */\nexport type ReaderSet =\n  | { readonly kind: \"public\" }\n  | { readonly kind: \"principals\"; readonly principalIds: readonly string[] };\n\n/** Opaque, non-content-bearing reference to a value's origin. */\nexport interface ProvenanceRef {\n  readonly kind:\n    | \"user_instruction\"\n    | \"system_policy\"\n    | \"harness\"\n    | \"tool\"\n    | \"artifact\"\n    | \"quarantined_llm\"\n    | \"converter\"\n    | \"human_review\";\n  readonly id: string;\n  readonly digest?: string;\n}\n\n/** Data or control influence retained across derivation and conversion. */\nexport interface DependencyRef {\n  readonly ref: ProvenanceRef;\n  readonly influence: \"data\" | \"control\";\n  readonly promptSafetyAtUse: PromptSafety;\n}\n\ninterface CamelLabelBase {\n  readonly schemaVersion: 1;\n  readonly readers: ReaderSet;\n  readonly provenance: readonly ProvenanceRef[];\n  readonly dependencies: readonly DependencyRef[];\n}\n\n/** Immutable prompt-safety, reader, provenance, and dependency metadata. */\nexport type CamelLabel<S extends PromptSafety = PromptSafety> = CamelLabelBase &\n  (S extends \"safe\"\n    ? { readonly promptSafety: \"safe\"; readonly safeBasis: SafeBasis }\n    : { readonly promptSafety: \"unsafe\"; readonly safeBasis?: never });\n\nconst camelValueBrand: unique symbol = Symbol(\"@odla-ai/camel/value\");\nconst authenticCamelValues = new WeakSet<object>();\n\n/** Privately branded value paired with its immutable Camel label. */\nexport interface CamelValue<T, S extends PromptSafety = PromptSafety> {\n  readonly value: T;\n  readonly label: CamelLabel<S>;\n  readonly [camelValueBrand]: S;\n}\n\n/** Prompt-injection Safe for privileged-model context; not necessarily true or authorized. */\nexport type Safe<T> = CamelValue<T, \"safe\">;\n/** May carry instructions and must stay out of privileged-model context. */\nexport type Unsafe<T> = CamelValue<T, \"unsafe\">;\n\n/** Metadata required at an explicit labelled ingress boundary. */\nexport interface LabelMetadata {\n  readonly readers: ReaderSet;\n  readonly provenance: readonly ProvenanceRef[];\n  readonly dependencies?: readonly DependencyRef[];\n}\n\n/** Return whether a runtime value carries the private Camel brand. */\nexport function isCamelValue(value: unknown): value is CamelValue<unknown> {\n  return typeof value === \"object\" && value !== null && authenticCamelValues.has(value);\n}\n\n/** Narrow a labelled value to prompt-injection Safe. */\nexport function isSafe<T>(value: CamelValue<T>): value is Safe<T> {\n  return isCamelValue(value) && value.label.promptSafety === \"safe\";\n}\n\n/** Narrow a labelled value to Prompt-Unsafe. */\nexport function isUnsafe<T>(value: CamelValue<T>): value is Unsafe<T> {\n  return isCamelValue(value) && value.label.promptSafety === \"unsafe\";\n}\n\n/** Throw a fixed Safe error unless a labelled value may enter privileged context. */\nexport function assertPromptSafe<T>(value: CamelValue<T>): asserts value is Safe<T> {\n  if (!isSafe(value)) throw new CamelError(\"unsafe_privileged_flow\", \"Prompt-Unsafe data cannot enter privileged context.\");\n}\n\nexport function createSafeInternal<T>(value: T, safeBasis: SafeBasis, metadata: LabelMetadata): Safe<T> {\n  return createValue(value, {\n    schemaVersion: 1,\n    promptSafety: \"safe\",\n    safeBasis,\n    ...copyMetadata(metadata),\n  });\n}\n\nexport function createUnsafeInternal<T>(value: T, metadata: LabelMetadata): Unsafe<T> {\n  return createValue(value, {\n    schemaVersion: 1,\n    promptSafety: \"unsafe\",\n    ...copyMetadata(metadata),\n  });\n}\n\nfunction createValue<T, S extends PromptSafety>(value: T, label: CamelLabel<S>): CamelValue<T, S> {\n  const result = { value, label: Object.freeze(label) } as CamelValue<T, S>;\n  Object.defineProperty(result, camelValueBrand, { value: label.promptSafety, enumerable: false });\n  authenticCamelValues.add(result);\n  return Object.freeze(result);\n}\n\nfunction copyMetadata(metadata: LabelMetadata): Omit<CamelLabelBase, \"schemaVersion\"> {\n  if (metadata.provenance.length === 0) throw new CamelError(\"state_conflict\", \"Label provenance must be non-empty.\");\n  const provenance = metadata.provenance.map(copyRef);\n  const dependencies = (metadata.dependencies ?? []).map((dependency) => Object.freeze({\n    ref: copyRef(dependency.ref),\n    influence: dependency.influence,\n    promptSafetyAtUse: dependency.promptSafetyAtUse,\n  }));\n  return {\n    readers: normalizeReaders(metadata.readers),\n    provenance: Object.freeze(provenance),\n    dependencies: Object.freeze(dependencies),\n  };\n}\n\nfunction copyRef(ref: ProvenanceRef): ProvenanceRef {\n  if (!ref.id || (ref.digest !== undefined && !ref.digest)) throw new CamelError(\"state_conflict\", \"Provenance references must have non-empty identities.\");\n  return Object.freeze({ kind: ref.kind, id: ref.id, ...(ref.digest === undefined ? {} : { digest: ref.digest }) });\n}\n\nfunction normalizeReaders(readers: ReaderSet): ReaderSet {\n  if (readers.kind === \"public\") return Object.freeze({ kind: \"public\" });\n  const principalIds = [...new Set(readers.principalIds)].sort();\n  if (principalIds.some((id) => !id)) throw new CamelError(\"reader_mismatch\", \"Reader principal IDs must be non-empty.\");\n  return Object.freeze({ kind: \"principals\", principalIds: Object.freeze(principalIds) });\n}\n","import { CamelError } from \"./errors\";\nimport { canonicalJson, sha256Hex } from \"./hash\";\nimport { createSafeInternal, type ReaderSet, type Safe } from \"./value\";\n\n/** Closed outcome for one registered artifact. Its source path is deliberately absent. */\nexport interface CodeVerificationArtifactReceipt {\n  readonly artifactId: string;\n  readonly status: \"verified\" | \"missing\" | \"invalid\" | \"too_large\";\n  readonly bytes: number | null;\n  readonly digest: `sha256:${string}` | null;\n}\n\n/** Closed outcome for one registered recipe. Raw build output is deliberately absent. */\nexport interface CodeVerificationRecipeReceipt {\n  readonly recipeId: string;\n  readonly recipeDigest: `sha256:${string}`;\n  readonly status: \"passed\" | \"failed\" | \"timed_out\" | \"output_limited\";\n  readonly exitCode: number;\n  readonly durationMs: number;\n  readonly artifacts: readonly CodeVerificationArtifactReceipt[];\n}\n\n/** Authority-neutral verifier facts that may be digested into a closed receipt. */\nexport interface CodeVerificationReceiptFields {\n  readonly schemaVersion: 1;\n  readonly verificationId: string;\n  readonly trustedBaseCommitSha: string;\n  readonly trustedBaseDigest: `sha256:${string}`;\n  readonly patchDigest: `sha256:${string}`;\n  readonly candidateDigest: `sha256:${string}`;\n  readonly sourceDigest: `sha256:${string}`;\n  readonly policyDigest: `sha256:${string}`;\n  readonly recipes: readonly CodeVerificationRecipeReceipt[];\n  readonly changedTestCount: number;\n  readonly changedTestSetDigest: `sha256:${string}`;\n  readonly changedTestsRequireReview: boolean;\n  readonly outcome: \"passed\" | \"failed\";\n}\n\n/** Digest-authenticated clean-verifier receipt with no repository or log prose. */\nexport interface CodeVerificationReceipt extends CodeVerificationReceiptFields {\n  readonly receiptDigest: `sha256:${string}`;\n}\n\nconst DIGEST = /^sha256:[0-9a-f]{64}$/;\nconst SHA = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;\nconst ID = /^[A-Za-z0-9._:-]{1,160}$/;\n\n/** Digest every closed verifier field in canonical order. */\nexport async function digestCodeVerificationReceipt(\n  fields: CodeVerificationReceiptFields,\n): Promise<`sha256:${string}`> {\n  validate(fields);\n  const canonical: CodeVerificationReceiptFields = {\n    schemaVersion: fields.schemaVersion,\n    verificationId: fields.verificationId,\n    trustedBaseCommitSha: fields.trustedBaseCommitSha,\n    trustedBaseDigest: fields.trustedBaseDigest,\n    patchDigest: fields.patchDigest,\n    candidateDigest: fields.candidateDigest,\n    sourceDigest: fields.sourceDigest,\n    policyDigest: fields.policyDigest,\n    recipes: fields.recipes.map((recipe) => ({\n      recipeId: recipe.recipeId, recipeDigest: recipe.recipeDigest, status: recipe.status,\n      exitCode: recipe.exitCode, durationMs: recipe.durationMs,\n      artifacts: recipe.artifacts.map((artifact) => ({\n        artifactId: artifact.artifactId, status: artifact.status,\n        bytes: artifact.bytes, digest: artifact.digest,\n      })),\n    })),\n    changedTestCount: fields.changedTestCount,\n    changedTestSetDigest: fields.changedTestSetDigest,\n    changedTestsRequireReview: fields.changedTestsRequireReview,\n    outcome: fields.outcome,\n  };\n  return `sha256:${await sha256Hex(canonicalJson(canonical))}`;\n}\n\n/** Promote only an authentic closed receipt—not logs or changed paths—to planning Safe. */\nexport async function createTrustedCodeVerificationReceipt(\n  receipt: CodeVerificationReceipt,\n  readers: ReaderSet,\n): Promise<Safe<CodeVerificationReceipt>> {\n  const value = await verifyCodeVerificationReceipt(receipt);\n  const digest = value.receiptDigest;\n  const artifact = { kind: \"artifact\" as const, id: value.verificationId, digest };\n  const policy = { kind: \"system_policy\" as const, id: \"code.verification\", digest: value.policyDigest };\n  return createSafeInternal(value, \"trusted_artifact\", {\n    readers,\n    provenance: [artifact, policy],\n    dependencies: [\n      { ref: artifact, influence: \"data\", promptSafetyAtUse: \"safe\" },\n      { ref: policy, influence: \"control\", promptSafetyAtUse: \"safe\" },\n    ],\n  });\n}\n\n/** Reject unknown fields and verify the digest before accepting a verifier receipt. */\nexport async function verifyCodeVerificationReceipt(value: unknown): Promise<CodeVerificationReceipt> {\n  const input = record(value, \"receipt\");\n  exact(input, [\n    \"schemaVersion\", \"verificationId\", \"trustedBaseCommitSha\", \"trustedBaseDigest\", \"patchDigest\",\n    \"candidateDigest\", \"sourceDigest\", \"policyDigest\", \"recipes\", \"changedTestCount\",\n    \"changedTestSetDigest\", \"changedTestsRequireReview\", \"outcome\", \"receiptDigest\",\n  ]);\n  if (!Array.isArray(input.recipes) || typeof input.receiptDigest !== \"string\") {\n    throw invalid(\"Code verification receipt is malformed or outside its bounds.\");\n  }\n  const fields = {\n    schemaVersion: input.schemaVersion,\n    verificationId: input.verificationId,\n    trustedBaseCommitSha: input.trustedBaseCommitSha,\n    trustedBaseDigest: input.trustedBaseDigest,\n    patchDigest: input.patchDigest,\n    candidateDigest: input.candidateDigest,\n    sourceDigest: input.sourceDigest,\n    policyDigest: input.policyDigest,\n    recipes: input.recipes.map(normalizeRecipe),\n    changedTestCount: input.changedTestCount,\n    changedTestSetDigest: input.changedTestSetDigest,\n    changedTestsRequireReview: input.changedTestsRequireReview,\n    outcome: input.outcome,\n  } as CodeVerificationReceiptFields;\n  const receiptDigest = input.receiptDigest as `sha256:${string}`;\n  if (await digestCodeVerificationReceipt(fields) !== receiptDigest) {\n    throw new CamelError(\"unsafe_privileged_flow\", \"Code verification receipt digest does not match its fields.\");\n  }\n  return Object.freeze({\n    ...fields,\n    recipes: Object.freeze(fields.recipes.map((recipe) => Object.freeze({\n      ...recipe, artifacts: Object.freeze(recipe.artifacts.map((artifact) => Object.freeze({ ...artifact }))),\n    }))),\n    receiptDigest,\n  });\n}\n\nfunction validate(fields: CodeVerificationReceiptFields): void {\n  if (fields.schemaVersion !== 1 || typeof fields.verificationId !== \"string\" || !ID.test(fields.verificationId)\n    || typeof fields.trustedBaseCommitSha !== \"string\" || !SHA.test(fields.trustedBaseCommitSha)\n    || !DIGEST.test(fields.trustedBaseDigest) || !DIGEST.test(fields.patchDigest) || !DIGEST.test(fields.candidateDigest)\n    || !DIGEST.test(fields.sourceDigest) || !DIGEST.test(fields.policyDigest)\n    || !DIGEST.test(fields.changedTestSetDigest)\n    || !Number.isSafeInteger(fields.changedTestCount) || fields.changedTestCount < 0\n    || fields.changedTestCount > 10_000 || fields.changedTestsRequireReview !== (fields.changedTestCount > 0)\n    || fields.recipes.length < 1 || fields.recipes.length > 64) {\n    throw new CamelError(\"state_conflict\", \"Code verification receipt is malformed or outside its bounds.\");\n  }\n  const ids = new Set<string>();\n  for (const recipe of fields.recipes) {\n    if (typeof recipe.recipeId !== \"string\" || !ID.test(recipe.recipeId)\n      || ids.has(recipe.recipeId) || typeof recipe.recipeDigest !== \"string\" || !DIGEST.test(recipe.recipeDigest)\n      || ![\"passed\", \"failed\", \"timed_out\", \"output_limited\"].includes(recipe.status)\n      || !Number.isSafeInteger(recipe.exitCode) || recipe.exitCode < 0 || recipe.exitCode > 255\n      || !Number.isSafeInteger(recipe.durationMs) || recipe.durationMs < 0 || recipe.durationMs > 30 * 60_000) {\n      throw new CamelError(\"state_conflict\", \"Code verification recipe receipt is malformed or outside its bounds.\");\n    }\n    const artifactIds = new Set<string>();\n    if (recipe.artifacts.length > 64) throw new CamelError(\"state_conflict\", \"Code verification has too many artifacts.\");\n    for (const artifact of recipe.artifacts) {\n      if (typeof artifact.artifactId !== \"string\" || !ID.test(artifact.artifactId) || artifactIds.has(artifact.artifactId)\n        || ![\"verified\", \"missing\", \"invalid\", \"too_large\"].includes(artifact.status)\n        || (artifact.bytes !== null && (!Number.isSafeInteger(artifact.bytes) || artifact.bytes < 0))\n        || (artifact.digest !== null && !DIGEST.test(artifact.digest))\n        || (artifact.status === \"verified\") !== (artifact.bytes !== null && artifact.digest !== null)\n        || ([\"missing\", \"invalid\"].includes(artifact.status) && (artifact.bytes !== null || artifact.digest !== null))\n        || (artifact.status === \"too_large\" && (artifact.bytes === null || artifact.digest !== null))) {\n        throw new CamelError(\"state_conflict\", \"Code verification artifact receipt is malformed.\");\n      }\n      artifactIds.add(artifact.artifactId);\n    }\n    if (recipe.status === \"passed\"\n      && (recipe.exitCode !== 0 || recipe.artifacts.some((artifact) => artifact.status !== \"verified\"))) {\n      throw new CamelError(\"state_conflict\", \"A passing recipe must verify every registered artifact.\");\n    }\n    ids.add(recipe.recipeId);\n  }\n  const passed = fields.recipes.every((recipe) => recipe.status === \"passed\");\n  if ((fields.outcome === \"passed\") !== passed) {\n    throw new CamelError(\"state_conflict\", \"Code verification outcome does not match its recipe receipts.\");\n  }\n}\n\nfunction normalizeRecipe(value: unknown): CodeVerificationRecipeReceipt {\n  const recipe = record(value, \"recipe\");\n  exact(recipe, [\"recipeId\", \"recipeDigest\", \"status\", \"exitCode\", \"durationMs\", \"artifacts\"]);\n  if (!Array.isArray(recipe.artifacts)) throw invalid(\"Code verification recipe receipt is malformed or outside its bounds.\");\n  return {\n    recipeId: recipe.recipeId as string,\n    recipeDigest: recipe.recipeDigest as `sha256:${string}`,\n    status: recipe.status as CodeVerificationRecipeReceipt[\"status\"],\n    exitCode: recipe.exitCode as number,\n    durationMs: recipe.durationMs as number,\n    artifacts: recipe.artifacts.map((value) => {\n      const artifact = record(value, \"artifact\");\n      exact(artifact, [\"artifactId\", \"status\", \"bytes\", \"digest\"]);\n      return {\n        artifactId: artifact.artifactId as string,\n        status: artifact.status as CodeVerificationArtifactReceipt[\"status\"],\n        bytes: artifact.bytes as number | null,\n        digest: artifact.digest as `sha256:${string}` | null,\n      };\n    }),\n  };\n}\n\nfunction record(value: unknown, name: string): Record<string, unknown> {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) throw invalid(`Code verification ${name} must be an object.`);\n  return value as Record<string, unknown>;\n}\n\nfunction exact(value: Record<string, unknown>, keys: readonly string[]): void {\n  if (Object.keys(value).some((key) => !keys.includes(key)) || keys.some((key) => !(key in value))) {\n    throw invalid(\"Code verification receipt contains missing or unsupported fields.\");\n  }\n}\n\nfunction invalid(message: string): CamelError {\n  return new CamelError(\"state_conflict\", message);\n}\n","import { CamelError } from \"./errors\";\nimport { canonicalJson, sha256Hex, utf8Length } from \"./hash\";\n\n/** Closed receipt reference for an effect completed before a checkpoint. */\nexport interface CodeCheckpointEffectReceipt {\n  readonly effectId: string;\n  readonly actionDigest: `sha256:${string}`;\n  readonly receiptDigest: `sha256:${string}`;\n}\n\n/** Portable non-filesystem state required to resume without replaying effects. */\nexport interface CodeCheckpointState {\n  readonly planCursor: string | null;\n  readonly conversationRefs: readonly string[];\n  readonly planningInputDigest: `sha256:${string}`;\n  readonly buildPolicyDigest: `sha256:${string}`;\n  readonly dependencyLayerDigest: `sha256:${string}` | null;\n  readonly verificationDigest: `sha256:${string}` | null;\n  readonly reviewDigest: `sha256:${string}` | null;\n  readonly completedEffects: readonly CodeCheckpointEffectReceipt[];\n  readonly unresolvedApprovals: readonly `sha256:${string}`[];\n  readonly trustStatus: \"candidate_untrusted\" | \"verified\" | \"reviewed\";\n}\n\n/** Exact candidate patch and closed state needed to reconstruct a fresh session. */\nexport interface CodePortableCheckpoint {\n  readonly schemaVersion: 1;\n  readonly baseCommitSha: string;\n  readonly patch: string;\n  readonly patchDigest: `sha256:${string}`;\n  readonly state: CodeCheckpointState;\n  readonly stateDigest: `sha256:${string}`;\n  readonly checkpointDigest: `sha256:${string}`;\n}\n\n/** Inputs accepted by the trusted checkpoint creator before digests are computed. */\nexport interface CreateCodePortableCheckpointInput {\n  readonly baseCommitSha: string;\n  readonly patch: string;\n  readonly state: CodeCheckpointState;\n}\n\nconst SHA = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;\nconst DIGEST = /^sha256:[0-9a-f]{64}$/;\nconst ID = /^[A-Za-z0-9._:-]{1,180}$/;\nconst MAX_PATCH_BYTES = 256 * 1024;\nconst MAX_STATE_BYTES = 64 * 1024;\n\n/** Create a bounded, digest-bound portable checkpoint from trusted runtime state. */\nexport async function createCodePortableCheckpoint(\n  input: CreateCodePortableCheckpointInput,\n): Promise<CodePortableCheckpoint> {\n  const state = normalizeState(input.state);\n  validateBaseAndPatch(input.baseCommitSha, input.patch);\n  const patchDigest = `sha256:${await sha256Hex(input.patch)}` as const;\n  const stateDigest = `sha256:${await sha256Hex(canonicalJson(state))}` as const;\n  const fields = { schemaVersion: 1 as const, baseCommitSha: input.baseCommitSha, patchDigest, state, stateDigest };\n  const checkpointDigest = `sha256:${await sha256Hex(canonicalJson(fields))}` as const;\n  return freeze({ ...fields, patch: input.patch, checkpointDigest });\n}\n\n/** Verify and normalize every field and digest before storage or reconstruction. */\nexport async function verifyCodePortableCheckpoint(value: unknown): Promise<CodePortableCheckpoint> {\n  const input = object(value, \"checkpoint\");\n  exact(input, [\"schemaVersion\", \"baseCommitSha\", \"patch\", \"patchDigest\", \"state\", \"stateDigest\", \"checkpointDigest\"]);\n  if (input.schemaVersion !== 1 || typeof input.baseCommitSha !== \"string\" || typeof input.patch !== \"string\"\n    || typeof input.patchDigest !== \"string\" || typeof input.stateDigest !== \"string\"\n    || typeof input.checkpointDigest !== \"string\") {\n    throw invalid(\"Portable checkpoint fields are malformed.\");\n  }\n  const created = await createCodePortableCheckpoint({\n    baseCommitSha: input.baseCommitSha,\n    patch: input.patch,\n    state: normalizeState(input.state),\n  });\n  if (created.patchDigest !== input.patchDigest || created.stateDigest !== input.stateDigest\n    || created.checkpointDigest !== input.checkpointDigest) {\n    throw invalid(\"Portable checkpoint digest does not match its content.\");\n  }\n  return created;\n}\n\nfunction normalizeState(value: unknown): CodeCheckpointState {\n  const state = object(value, \"state\");\n  exact(state, [\n    \"planCursor\", \"conversationRefs\", \"planningInputDigest\", \"buildPolicyDigest\", \"dependencyLayerDigest\",\n    \"verificationDigest\", \"reviewDigest\", \"completedEffects\", \"unresolvedApprovals\", \"trustStatus\",\n  ]);\n  const planCursor = state.planCursor;\n  const conversations = strings(state.conversationRefs, \"conversationRefs\", ID, 256, false);\n  const approvals = strings(state.unresolvedApprovals, \"unresolvedApprovals\", DIGEST, 256, true) as `sha256:${string}`[];\n  if ((planCursor !== null && (typeof planCursor !== \"string\" || !ID.test(planCursor)))\n    || typeof state.planningInputDigest !== \"string\" || !DIGEST.test(state.planningInputDigest)\n    || typeof state.buildPolicyDigest !== \"string\" || !DIGEST.test(state.buildPolicyDigest)\n    || (state.dependencyLayerDigest !== null\n      && (typeof state.dependencyLayerDigest !== \"string\" || !DIGEST.test(state.dependencyLayerDigest)))\n    || (state.verificationDigest !== null\n      && (typeof state.verificationDigest !== \"string\" || !DIGEST.test(state.verificationDigest)))\n    || (state.reviewDigest !== null\n      && (typeof state.reviewDigest !== \"string\" || !DIGEST.test(state.reviewDigest)))\n    || ![\"candidate_untrusted\", \"verified\", \"reviewed\"].includes(String(state.trustStatus))\n    || !Array.isArray(state.completedEffects) || state.completedEffects.length > 256) {\n    throw invalid(\"Portable checkpoint state is malformed or outside its bounds.\");\n  }\n  const effects = state.completedEffects.map((item) => {\n    const effect = object(item, \"completed effect\");\n    exact(effect, [\"effectId\", \"actionDigest\", \"receiptDigest\"]);\n    if (typeof effect.effectId !== \"string\" || !ID.test(effect.effectId)\n      || typeof effect.actionDigest !== \"string\" || !DIGEST.test(effect.actionDigest)\n      || typeof effect.receiptDigest !== \"string\" || !DIGEST.test(effect.receiptDigest)) {\n      throw invalid(\"Portable checkpoint effect receipt is malformed.\");\n    }\n    return { effectId: effect.effectId, actionDigest: effect.actionDigest as `sha256:${string}`,\n      receiptDigest: effect.receiptDigest as `sha256:${string}` };\n  });\n  if (new Set(effects.map((item) => item.effectId)).size !== effects.length) {\n    throw invalid(\"Portable checkpoint repeats a completed effect.\");\n  }\n  const trustStatus = state.trustStatus as CodeCheckpointState[\"trustStatus\"];\n  if ((trustStatus === \"candidate_untrusted\" && (state.verificationDigest !== null || state.reviewDigest !== null))\n    || (trustStatus === \"verified\" && (state.verificationDigest === null || state.reviewDigest !== null))\n    || (trustStatus === \"reviewed\" && (state.verificationDigest === null || state.reviewDigest === null))) {\n    throw invalid(\"Portable checkpoint trust status does not match its evidence digests.\");\n  }\n  const normalized: CodeCheckpointState = {\n    planCursor: planCursor as string | null,\n    conversationRefs: conversations,\n    planningInputDigest: state.planningInputDigest as `sha256:${string}`,\n    buildPolicyDigest: state.buildPolicyDigest as `sha256:${string}`,\n    dependencyLayerDigest: state.dependencyLayerDigest as `sha256:${string}` | null,\n    verificationDigest: state.verificationDigest as `sha256:${string}` | null,\n    reviewDigest: state.reviewDigest as `sha256:${string}` | null,\n    completedEffects: effects,\n    unresolvedApprovals: approvals,\n    trustStatus,\n  };\n  if (utf8Length(normalized) > MAX_STATE_BYTES) throw invalid(\"Portable checkpoint state exceeds 64 KB.\");\n  return normalized;\n}\n\nfunction validateBaseAndPatch(baseCommitSha: string, patch: string): void {\n  if (!SHA.test(baseCommitSha) || utf8Length(patch) > MAX_PATCH_BYTES || patch.includes(\"\\0\")) {\n    throw invalid(\"Portable checkpoint base or patch is malformed or outside its bounds.\");\n  }\n}\n\nfunction strings(value: unknown, name: string, pattern: RegExp, maximum: number, sort: boolean): string[] {\n  if (!Array.isArray(value) || value.length > maximum\n    || value.some((item) => typeof item !== \"string\" || !pattern.test(item))\n    || new Set(value).size !== value.length) {\n    throw invalid(`Portable checkpoint ${name} is malformed or outside its bounds.`);\n  }\n  const result = [...value] as string[];\n  return sort ? result.sort() : result;\n}\n\nfunction object(value: unknown, name: string): Record<string, unknown> {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) throw invalid(`Portable ${name} must be an object.`);\n  return value as Record<string, unknown>;\n}\n\nfunction exact(value: Record<string, unknown>, keys: readonly string[]): void {\n  if (Object.keys(value).some((key) => !keys.includes(key)) || keys.some((key) => !(key in value))) {\n    throw invalid(\"Portable checkpoint contains missing or unsupported fields.\");\n  }\n}\n\nfunction freeze(value: Omit<CodePortableCheckpoint, \"state\"> & { state: CodeCheckpointState }): CodePortableCheckpoint {\n  return Object.freeze({\n    ...value,\n    state: Object.freeze({\n      ...value.state,\n      conversationRefs: Object.freeze([...value.state.conversationRefs]),\n      completedEffects: Object.freeze(value.state.completedEffects.map((item) => Object.freeze({ ...item }))),\n      unresolvedApprovals: Object.freeze([...value.state.unresolvedApprovals]),\n    }),\n  });\n}\n\nfunction invalid(message: string): CamelError {\n  return new CamelError(\"state_conflict\", message);\n}\n","import { canonicalJson, sha256Hex } from \"./hash\";\n\n/** Exact trusted source, policy, recipe, builder, and artifact claims produced by one passing deployment build. */\nexport interface CodeDeploymentArtifactReceiptFields {\n  readonly schemaVersion: 1;\n  readonly buildId: string;\n  readonly commitSha: string;\n  readonly sourceTreeDigest: `sha256:${string}`;\n  readonly artifactDigest: `sha256:${string}`;\n  readonly configDigest: `sha256:${string}`;\n  readonly buildPolicyDigest: `sha256:${string}`;\n  readonly recipeDigest: `sha256:${string}`;\n  readonly builderImageDigest: `sha256:${string}`;\n  readonly outcome: \"passed\";\n  readonly builtAt: number;\n}\n\n/** Closed, self-authenticating receipt for an artifact built from an exact trusted commit. */\nexport interface CodeDeploymentArtifactReceipt extends CodeDeploymentArtifactReceiptFields {\n  readonly receiptDigest: `sha256:${string}`;\n}\n\nconst DIGEST = /^sha256:[0-9a-f]{64}$/;\nconst SHA = /^[0-9a-f]{40}$/;\nconst BUILD_ID = /^[A-Za-z0-9._:-]{1,120}$/;\nconst KEYS = [\n  \"schemaVersion\", \"buildId\", \"commitSha\", \"sourceTreeDigest\", \"artifactDigest\",\n  \"configDigest\", \"buildPolicyDigest\", \"recipeDigest\", \"builderImageDigest\", \"outcome\", \"builtAt\",\n] as const;\n\n/** Validate and hash the canonical fields of a passing Code deployment artifact receipt. */\nexport async function digestCodeDeploymentArtifactReceipt(\n  fields: CodeDeploymentArtifactReceiptFields,\n): Promise<`sha256:${string}`> {\n  validate(fields);\n  const canonical: CodeDeploymentArtifactReceiptFields = {\n    schemaVersion: 1, buildId: fields.buildId, commitSha: fields.commitSha,\n    sourceTreeDigest: fields.sourceTreeDigest, artifactDigest: fields.artifactDigest,\n    configDigest: fields.configDigest, buildPolicyDigest: fields.buildPolicyDigest,\n    recipeDigest: fields.recipeDigest, builderImageDigest: fields.builderImageDigest,\n    outcome: \"passed\", builtAt: fields.builtAt,\n  };\n  return `sha256:${await sha256Hex(canonicalJson(canonical))}`;\n}\n\n/** Parse a closed Code deployment artifact receipt and verify its canonical digest. */\nexport async function parseCodeDeploymentArtifactReceipt(value: unknown): Promise<CodeDeploymentArtifactReceipt> {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) throw new TypeError(\"closed deployment build receipt required\");\n  const record = value as Record<string, unknown>;\n  const keys = Object.keys(record).sort();\n  const expected = [...KEYS, \"receiptDigest\"].sort();\n  if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])) {\n    throw new TypeError(\"deployment build receipt has unknown or missing fields\");\n  }\n  const fields = Object.fromEntries(KEYS.map((key) => [key, record[key]])) as unknown as CodeDeploymentArtifactReceiptFields;\n  validate(fields);\n  if (typeof record.receiptDigest !== \"string\" || !DIGEST.test(record.receiptDigest)) throw new TypeError(\"invalid deployment receipt digest\");\n  const receiptDigest = await digestCodeDeploymentArtifactReceipt(fields);\n  if (record.receiptDigest !== receiptDigest) throw new TypeError(\"deployment build receipt digest mismatch\");\n  return { ...fields, receiptDigest };\n}\n\nfunction validate(fields: CodeDeploymentArtifactReceiptFields): void {\n  if (fields.schemaVersion !== 1 || !BUILD_ID.test(fields.buildId) || !SHA.test(fields.commitSha)\n    || ![fields.sourceTreeDigest, fields.artifactDigest, fields.configDigest, fields.buildPolicyDigest,\n      fields.recipeDigest, fields.builderImageDigest].every((value) => typeof value === \"string\" && DIGEST.test(value))\n    || fields.outcome !== \"passed\" || !Number.isSafeInteger(fields.builtAt) || fields.builtAt <= 0) {\n    throw new TypeError(\"invalid deployment build receipt\");\n  }\n}\n","import { CamelError } from \"./errors\";\nimport { canonicalJson, sha256Hex, utf8Length } from \"./hash\";\nimport { assertReader } from \"./readers\";\nimport {\n  createSafeInternal, isCamelValue, isSafe,\n  type CamelValue, type ReaderSet, type Safe,\n} from \"./value\";\n\nexport * from \"./code-verification\";\nexport * from \"./code-checkpoint\";\nexport * from \"./code-deployment\";\n\n/** One repository-relative source file in an exact planning snapshot. */\nexport interface CodeSourceFile {\n  readonly path: string;\n  readonly content: string;\n}\n\n/** Immutable source input pinned to a repository and commit. */\nexport interface CodeRepositorySnapshot {\n  readonly repository: string;\n  readonly commitSha: string;\n  readonly files: readonly CodeSourceFile[];\n}\n\n/** Authority-bearing fields included in a Code trust-attestation digest. */\nexport interface CodeTrustAttestationFields {\n  readonly schemaVersion: 1;\n  readonly attestationId: string;\n  readonly kind: \"trust_root\" | \"landed_candidate\";\n  readonly appId: string;\n  readonly env: string;\n  readonly repository: string;\n  readonly commitSha: string;\n  readonly treeDigest: `sha256:${string}`;\n  readonly parentAttestationId: string | null;\n  readonly planningInputDigest: `sha256:${string}` | null;\n  readonly candidateDigest: `sha256:${string}` | null;\n  readonly verificationDigest: `sha256:${string}` | null;\n  readonly reviewDigest: `sha256:${string}` | null;\n  readonly approvedBy: string;\n  readonly approvedAt: number;\n}\n\n/** A verified trust record plus the digest covering all of its fields. */\nexport interface CodeTrustAttestation extends CodeTrustAttestationFields {\n  readonly attestationDigest: `sha256:${string}`;\n}\n\n/** Prompt-Safe inputs admitted to one privileged Code planning request. */\nexport interface CodePlanningContext {\n  readonly task: Safe<string>;\n  readonly repository: Safe<CodeRepositorySnapshot>;\n  readonly policies: readonly Safe<unknown>[];\n  readonly priorPlans: readonly Safe<unknown>[];\n}\n\n/** File-count and aggregate UTF-8 byte ceilings for a source snapshot. */\nexport interface CodeSnapshotLimits {\n  readonly maximumFiles: number;\n  readonly maximumBytes: number;\n}\n\nconst SHA = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;\nconst DIGEST = /^sha256:[0-9a-f]{64}$/;\nconst REPOSITORY = /^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$/;\nconst DEFAULT_LIMITS = { maximumFiles: 4_000, maximumBytes: 2 * 1024 * 1024 };\n\n/** Digest the exact path/content snapshot supplied to planning. */\nexport async function digestCodeRepositorySnapshot(\n  snapshot: CodeRepositorySnapshot,\n  limits: CodeSnapshotLimits = DEFAULT_LIMITS,\n): Promise<`sha256:${string}`> {\n  validateSnapshot(snapshot, limits);\n  const normalized = {\n    repository: snapshot.repository,\n    commitSha: snapshot.commitSha,\n    files: [...snapshot.files]\n      .map((file) => ({ path: file.path, content: file.content }))\n      .sort((left, right) => left.path.localeCompare(right.path)),\n  };\n  return `sha256:${await sha256Hex(canonicalJson(normalized))}`;\n}\n\n/** Digest every authority-bearing attestation field. */\nexport async function digestCodeTrustAttestation(\n  fields: CodeTrustAttestationFields,\n): Promise<`sha256:${string}`> {\n  validateAttestationFields(fields);\n  const canonical: CodeTrustAttestationFields = {\n    schemaVersion: fields.schemaVersion,\n    attestationId: fields.attestationId,\n    kind: fields.kind,\n    appId: fields.appId,\n    env: fields.env,\n    repository: fields.repository,\n    commitSha: fields.commitSha,\n    treeDigest: fields.treeDigest,\n    parentAttestationId: fields.parentAttestationId,\n    planningInputDigest: fields.planningInputDigest,\n    candidateDigest: fields.candidateDigest,\n    verificationDigest: fields.verificationDigest,\n    reviewDigest: fields.reviewDigest,\n    approvedBy: fields.approvedBy,\n    approvedAt: fields.approvedAt,\n  };\n  return `sha256:${await sha256Hex(canonicalJson(canonical))}`;\n}\n\n/** Promote an exact, attested source snapshot to Prompt-Safe planning input. */\nexport async function createTrustedCodeSnapshot(\n  snapshot: CodeRepositorySnapshot,\n  attestation: CodeTrustAttestation,\n  readers: ReaderSet,\n  limits: CodeSnapshotLimits = DEFAULT_LIMITS,\n): Promise<Safe<CodeRepositorySnapshot>> {\n  const treeDigest = await digestCodeRepositorySnapshot(snapshot, limits);\n  const attestationDigest = await digestCodeTrustAttestation(attestation);\n  if (snapshot.repository !== attestation.repository\n    || snapshot.commitSha !== attestation.commitSha\n    || treeDigest !== attestation.treeDigest\n    || attestationDigest !== attestation.attestationDigest) {\n    throw new CamelError(\"unsafe_privileged_flow\", \"Code snapshot does not match its trust attestation.\");\n  }\n  const artifact = { kind: \"artifact\" as const, id: snapshot.commitSha, digest: treeDigest };\n  const approval = {\n    kind: \"human_review\" as const,\n    id: attestation.attestationId,\n    digest: attestation.attestationDigest,\n  };\n  return createSafeInternal(Object.freeze({\n    repository: snapshot.repository,\n    commitSha: snapshot.commitSha,\n    files: Object.freeze(snapshot.files.map((file) => Object.freeze({ ...file }))),\n  }), \"trusted_artifact\", {\n    readers,\n    provenance: [artifact, approval],\n    dependencies: [\n      { ref: artifact, influence: \"data\", promptSafetyAtUse: \"unsafe\" },\n      { ref: approval, influence: \"control\", promptSafetyAtUse: \"safe\" },\n    ],\n  });\n}\n\n/** Fail closed immediately before dispatching the privileged planning model. */\nexport function assertCodePlanningContext(context: CodePlanningContext, readerId: string): void {\n  const values = [context.task, context.repository, ...context.policies, ...context.priorPlans];\n  for (const value of values) {\n    if (!isCamelValue(value) || !isSafe(value)) {\n      throw new CamelError(\"unsafe_privileged_flow\", \"Code planning accepts only authentic Prompt-Safe inputs.\");\n    }\n    assertReader(value, readerId);\n  }\n  if (context.repository.label.safeBasis !== \"trusted_artifact\"\n    || !context.repository.label.provenance.some((ref) => ref.kind === \"artifact\")\n    || !context.repository.label.provenance.some((ref) => ref.kind === \"human_review\")) {\n    throw new CamelError(\"unsafe_privileged_flow\", \"Code planning requires an attested trusted repository snapshot.\");\n  }\n  assertNoUnsafeDeep(context);\n}\n\nfunction validateSnapshot(snapshot: CodeRepositorySnapshot, limits: CodeSnapshotLimits): void {\n  if (!REPOSITORY.test(snapshot.repository) || !SHA.test(snapshot.commitSha)) {\n    throw new CamelError(\"state_conflict\", \"Code snapshot repository or commit is invalid.\");\n  }\n  if (!Number.isSafeInteger(limits.maximumFiles) || limits.maximumFiles < 1\n    || !Number.isSafeInteger(limits.maximumBytes) || limits.maximumBytes < 1\n    || snapshot.files.length > limits.maximumFiles) {\n    throw new CamelError(\"limit_exceeded\", \"Code snapshot exceeds its registered limits.\");\n  }\n  const paths = new Set<string>();\n  let bytes = 0;\n  for (const file of snapshot.files) {\n    if (!file.path || file.path.startsWith(\"/\") || file.path.includes(\"\\\\\")\n      || file.path.split(\"/\").some((part) => !part || part === \".\" || part === \"..\")\n      || paths.has(file.path) || typeof file.content !== \"string\") {\n      throw new CamelError(\"state_conflict\", \"Code snapshot contains an invalid or duplicate path.\");\n    }\n    paths.add(file.path);\n    bytes += utf8Length(file.path) + utf8Length(file.content);\n  }\n  if (bytes > limits.maximumBytes) {\n    throw new CamelError(\"limit_exceeded\", \"Code snapshot exceeds its registered limits.\");\n  }\n}\n\nfunction validateAttestationFields(fields: CodeTrustAttestationFields): void {\n  const required = [fields.attestationId, fields.appId, fields.env, fields.approvedBy];\n  if (fields.schemaVersion !== 1 || required.some((value) => !value)\n    || !REPOSITORY.test(fields.repository) || !SHA.test(fields.commitSha)\n    || !DIGEST.test(fields.treeDigest) || !Number.isSafeInteger(fields.approvedAt) || fields.approvedAt < 1) {\n    throw new CamelError(\"state_conflict\", \"Code trust attestation is invalid.\");\n  }\n  const evidence = [fields.planningInputDigest, fields.candidateDigest, fields.verificationDigest, fields.reviewDigest];\n  if (evidence.some((value) => value !== null && !DIGEST.test(value))) {\n    throw new CamelError(\"state_conflict\", \"Code trust evidence digest is invalid.\");\n  }\n  if (fields.kind === \"trust_root\") {\n    if (fields.parentAttestationId !== null || evidence.some((value) => value !== null)) {\n      throw new CamelError(\"state_conflict\", \"Trust roots cannot claim candidate evidence.\");\n    }\n  } else if (!fields.parentAttestationId || evidence.some((value) => value === null)) {\n    throw new CamelError(\"state_conflict\", \"Landed candidates require complete provenance and evidence.\");\n  }\n}\n\nfunction assertNoUnsafeDeep(root: unknown): void {\n  const visit = (value: unknown, seen: WeakSet<object>): void => {\n    if (typeof value !== \"object\" || value === null || seen.has(value)) return;\n    seen.add(value);\n    if (isCamelValue(value) && !isSafe(value as CamelValue<unknown>)) {\n      throw new CamelError(\"unsafe_privileged_flow\", \"Prompt-Unsafe data cannot enter Code planning.\");\n    }\n    for (const child of Object.values(value)) visit(child, seen);\n  };\n  visit(root, new WeakSet());\n}\n","import { CamelError } from \"./errors\";\nimport { canonicalJson, sha256Hex, utf8Length } from \"./hash\";\nimport { dependenciesOf } from \"./readers\";\nimport { createSafeInternal, type Safe, type Unsafe } from \"./value\";\n\n/** Restricted atomic value kinds allowed in privileged context after conversion. */\nexport type SafeDatumKind = \"boolean\" | \"integer\" | \"finite_number\" | \"enum\" | \"date\" | \"registered_id\" | \"digest\";\n/** Scalar output language available to closed conversions and Safe operations. */\nexport type SafeScalar = boolean | number | string;\n\n/** Persistable Safe atomic datum bound to its immutable conversion record. */\nexport interface SafeDatum<T extends SafeScalar = SafeScalar> extends Safe<T> {\n  readonly datumId: string;\n  readonly kind: SafeDatumKind;\n  readonly conversionId: string;\n  readonly conversionDigest: string;\n  readonly conversionRecordId: string;\n}\n\n/** Closed output language and bounds for one conversion family. */\nexport type SafeConversionSpec =\n  | { readonly kind: \"boolean\" }\n  | { readonly kind: \"integer\"; readonly minimum: number; readonly maximum: number }\n  | { readonly kind: \"finite_number\"; readonly minimum: number; readonly maximum: number; readonly maximumDecimalPlaces: number }\n  | { readonly kind: \"enum\"; readonly values: readonly string[]; readonly caseSensitive: boolean }\n  | { readonly kind: \"date\"; readonly format: \"date\" | \"rfc3339\"; readonly earliest?: string; readonly latest?: string }\n  | { readonly kind: \"registered_id\"; readonly registryId: string; readonly registryDigest: string }\n  | { readonly kind: \"digest\"; readonly algorithm: \"sha256\" };\n\n/** Versioned, digest-bound control definition for one Unsafe-to-Safe conversion. */\nexport interface SafeConversionPolicy {\n  readonly conversionId: string;\n  readonly version: number;\n  readonly digest: string;\n  readonly output: SafeConversionSpec;\n  readonly maximumSourceBytes: number;\n  readonly maximumOutputsPerArtifact: number;\n  readonly presentation: \"json_scalar\" | \"fixed_field\";\n}\n\n/** Declarative predicate whose boolean result is the only output crossing the boundary. */\nexport type SafePredicateSpec =\n  | { readonly kind: \"has_fields\"; readonly fields: readonly string[] }\n  | { readonly kind: \"value_type\"; readonly valueType: \"null\" | \"boolean\" | \"number\" | \"string\" | \"array\" | \"object\" }\n  | { readonly kind: \"registered_id\"; readonly registryId: string };\n\n/** Digest-bound control registry mapping Unsafe candidates to opaque Safe identifiers. */\nexport interface RegisteredIdRegistry {\n  readonly digest: string;\n  readonly values: Readonly<Record<string, string>>;\n}\n\n/** Control-owned policies, identifier registries, and declarative predicates. */\nexport interface ConversionRegistryConfig {\n  readonly policies: readonly SafeConversionPolicy[];\n  readonly registeredIds?: Readonly<Record<string, RegisteredIdRegistry>>;\n  readonly predicates?: Readonly<Record<string, SafePredicateSpec>>;\n}\n\n/** Restricted-output operations that intentionally cross Unsafe to Safe. */\nexport interface UnsafeToSafeOperations {\n  boolean(value: Unsafe<unknown>, conversionId: string): Promise<Safe<boolean>>;\n  integer(value: Unsafe<unknown>, conversionId: string): Promise<Safe<number>>;\n  finiteNumber(value: Unsafe<unknown>, conversionId: string): Promise<Safe<number>>;\n  enum(value: Unsafe<unknown>, conversionId: string): Promise<Safe<string>>;\n  date(value: Unsafe<unknown>, conversionId: string): Promise<Safe<string>>;\n  registeredId(value: Unsafe<unknown>, conversionId: string): Promise<Safe<string>>;\n  digest(value: Unsafe<Uint8Array>, conversionId: string): Promise<Safe<string>>;\n  measure(value: Unsafe<string | Uint8Array | readonly unknown[]>, metric: \"byte_length\" | \"codepoint_length\" | \"item_count\", conversionId: string): Promise<Safe<number>>;\n  test(value: Unsafe<unknown>, predicateId: string, conversionId: string): Promise<Safe<boolean>>;\n}\n\n/** Digest-verified conversion registry and its closed operation set. */\nexport interface ConversionRegistry {\n  readonly operations: UnsafeToSafeOperations;\n  policy(conversionId: string): SafeConversionPolicy;\n}\n\n/** Compute the digest that binds a conversion policy's control-owned definition. */\nexport function conversionPolicyDigest(policy: Omit<SafeConversionPolicy, \"digest\">): Promise<string> {\n  return sha256Hex(canonicalJson(policy));\n}\n\n/** Compute the digest binding a registered-ID registry's exact candidate mapping. */\nexport function registeredIdRegistryDigest(values: RegisteredIdRegistry[\"values\"]): Promise<string> {\n  return sha256Hex(canonicalJson(values));\n}\n\n/** Create a digest-verified, closed Unsafe-to-Safe conversion registry. */\nexport async function createConversionRegistry(config: ConversionRegistryConfig): Promise<ConversionRegistry> {\n  const policies = new Map<string, SafeConversionPolicy>();\n  for (const policy of config.policies) {\n    validatePolicyShape(policy);\n    if (policies.has(policy.conversionId)) throw new CamelError(\"state_conflict\", \"Conversion IDs must be unique.\");\n    const { digest: _digest, ...definition } = policy;\n    if (await conversionPolicyDigest(definition) !== policy.digest) throw new CamelError(\"state_conflict\", \"Conversion policy digest mismatch.\");\n    if (policy.output.kind === \"registered_id\") {\n      const registry = config.registeredIds?.[policy.output.registryId];\n      const validValues = registry && Object.entries(registry.values).every(([candidate, id]) => candidate.length > 0 && typeof id === \"string\" && id.length > 0);\n      if (!registry || !validValues || registry.digest !== policy.output.registryDigest || await registeredIdRegistryDigest(registry.values) !== registry.digest) {\n        throw new CamelError(\"state_conflict\", \"Registered-ID registry digest mismatch.\");\n      }\n    }\n    policies.set(policy.conversionId, Object.freeze(policy));\n  }\n  const outputCounts = new Map<string, number>();\n  type PolicyOf<K extends SafeDatumKind> = Omit<SafeConversionPolicy, \"output\"> & { readonly output: Extract<SafeConversionSpec, { readonly kind: K }> };\n  const get = <K extends SafeDatumKind>(id: string, kind: K): PolicyOf<K> => {\n    const policy = policies.get(id);\n    if (!policy || policy.output.kind !== kind) throw new CamelError(\"conversion_rejected\", \"Conversion policy is missing or has the wrong output kind.\");\n    return policy as PolicyOf<K>;\n  };\n  const checked = <K extends SafeDatumKind>(source: Unsafe<unknown>, id: string, kind: K): PolicyOf<K> => {\n    const policy = get(id, kind);\n    if (utf8Length(source.value) > policy.maximumSourceBytes) throw new CamelError(\"limit_exceeded\", \"Unsafe conversion input exceeds its byte bound.\");\n    return policy;\n  };\n  const emit = <T>(source: Unsafe<unknown>, policy: SafeConversionPolicy, value: T) => convert(source, policy, value, outputCounts);\n  const operations: UnsafeToSafeOperations = Object.freeze({\n    boolean: async (value: Unsafe<unknown>, id: string) => { const policy = checked(value, id, \"boolean\"); return emit(value, policy, requireBoolean(value.value)); },\n    integer: async (value: Unsafe<unknown>, id: string) => { const policy = checked(value, id, \"integer\"); return emit(value, policy, boundedInteger(value.value, policy.output)); },\n    finiteNumber: async (value: Unsafe<unknown>, id: string) => { const policy = checked(value, id, \"finite_number\"); return emit(value, policy, boundedNumber(value.value, policy.output)); },\n    enum: async (value: Unsafe<unknown>, id: string) => {\n      const policy = checked(value, id, \"enum\");\n      return emit(value, policy, enumMember(value.value, policy.output));\n    },\n    date: async (value: Unsafe<unknown>, id: string) => {\n      const policy = checked(value, id, \"date\");\n      return emit(value, policy, canonicalDate(value.value, policy.output));\n    },\n    registeredId: async (value: Unsafe<unknown>, id: string) => {\n      const policy = checked(value, id, \"registered_id\");\n      const registry = config.registeredIds?.[policy.output.registryId];\n      const output = typeof value.value === \"string\" ? registry?.values[value.value] : undefined;\n      if (!output) throw new CamelError(\"conversion_rejected\", \"Registered-ID conversion rejected the candidate.\");\n      return emit(value, policy, output);\n    },\n    digest: async (value: Unsafe<Uint8Array>, id: string) => {\n      const policy = checked(value, id, \"digest\");\n      if (!(value.value instanceof Uint8Array)) throw new CamelError(\"conversion_rejected\", \"Digest conversion requires bytes.\");\n      return emit(value, policy, await sha256Hex(value.value));\n    },\n    measure: async (value: Unsafe<string | Uint8Array | readonly unknown[]>, metric: \"byte_length\" | \"codepoint_length\" | \"item_count\", id: string) => {\n      const policy = checked(value, id, \"integer\");\n      const measured = measure(value.value, metric);\n      return emit(value, policy, boundedInteger(measured, policy.output));\n    },\n    test: async (value: Unsafe<unknown>, predicateId: string, id: string) => {\n      const policy = checked(value, id, \"boolean\");\n      const predicate = config.predicates?.[predicateId];\n      if (!predicate) throw new CamelError(\"conversion_rejected\", \"Predicate is not registered.\");\n      return emit(value, policy, evaluatePredicate(value.value, predicate, config.registeredIds));\n    },\n  });\n  return Object.freeze({ operations, policy: (id: string) => policies.get(id) ?? missingPolicy() });\n}\n\nasync function convert<T>(source: Unsafe<unknown>, policy: SafeConversionPolicy, value: T, counts: Map<string, number>): Promise<Safe<T>> {\n  const sourceKey = sourceIdentity(source);\n  const countKey = `${policy.conversionId}\\u0000${sourceKey}`;\n  const count = counts.get(countKey) ?? 0;\n  if (count >= policy.maximumOutputsPerArtifact) throw new CamelError(\"limit_exceeded\", \"Conversion output count exceeds its per-source bound.\");\n  counts.set(countKey, count + 1);\n  return createSafeInternal(value, \"atomic_conversion\", {\n    readers: source.label.readers,\n    provenance: [...source.label.provenance, { kind: \"converter\", id: policy.conversionId, digest: policy.digest }],\n    dependencies: dependenciesOf([source]),\n  });\n}\n\nfunction validatePolicyShape(policy: SafeConversionPolicy): void {\n  if (!policy.conversionId || !Number.isSafeInteger(policy.version) || policy.version < 1 || !policy.digest) throw new CamelError(\"state_conflict\", \"Conversion policy identity is invalid.\");\n  if (!Number.isSafeInteger(policy.maximumSourceBytes) || policy.maximumSourceBytes < 0 || !Number.isSafeInteger(policy.maximumOutputsPerArtifact) || policy.maximumOutputsPerArtifact < 1) throw new CamelError(\"state_conflict\", \"Conversion policy bounds are invalid.\");\n  const output = policy.output;\n  if ((output.kind === \"integer\" || output.kind === \"finite_number\") && (!Number.isFinite(output.minimum) || !Number.isFinite(output.maximum) || output.minimum > output.maximum)) throw new CamelError(\"state_conflict\", \"Numeric conversion bounds are invalid.\");\n  if (output.kind === \"finite_number\" && (!Number.isSafeInteger(output.maximumDecimalPlaces) || output.maximumDecimalPlaces < 0 || output.maximumDecimalPlaces > 15)) throw new CamelError(\"state_conflict\", \"Decimal-place bound is invalid.\");\n  if (output.kind === \"enum\" && (output.values.length === 0 || output.values.some((value) => typeof value !== \"string\" || !value) || new Set(output.values).size !== output.values.length)) throw new CamelError(\"state_conflict\", \"Enum conversion members must be unique and non-empty.\");\n  if (output.kind === \"registered_id\" && (!output.registryId || !output.registryDigest)) throw new CamelError(\"state_conflict\", \"Registered-ID conversion identity is invalid.\");\n  if (output.kind === \"date\" && output.format !== \"date\" && output.format !== \"rfc3339\") throw new CamelError(\"state_conflict\", \"Date conversion format is invalid.\");\n  if (output.kind === \"digest\" && output.algorithm !== \"sha256\") throw new CamelError(\"state_conflict\", \"Digest conversion algorithm is invalid.\");\n}\n\nfunction requireBoolean(value: unknown): boolean {\n  if (typeof value !== \"boolean\") throw new CamelError(\"conversion_rejected\", \"Boolean conversion requires a structured boolean.\");\n  return value;\n}\n\nfunction boundedInteger(value: unknown, spec: SafeConversionSpec): number {\n  if (spec.kind !== \"integer\" || typeof value !== \"number\" || !Number.isSafeInteger(value) || value < spec.minimum || value > spec.maximum) throw new CamelError(\"conversion_rejected\", \"Integer conversion rejected the structured value.\");\n  return value;\n}\n\nfunction boundedNumber(value: unknown, spec: SafeConversionSpec): number {\n  if (spec.kind !== \"finite_number\" || typeof value !== \"number\" || !Number.isFinite(value) || value < spec.minimum || value > spec.maximum) throw new CamelError(\"conversion_rejected\", \"Finite-number conversion rejected the structured value.\");\n  const text = String(value);\n  if (/e/i.test(text) || (text.split(\".\")[1]?.length ?? 0) > spec.maximumDecimalPlaces) throw new CamelError(\"conversion_rejected\", \"Finite-number conversion rejected a non-canonical decimal.\");\n  return value;\n}\n\nfunction enumMember(value: unknown, spec: SafeConversionSpec): string {\n  if (spec.kind !== \"enum\" || typeof value !== \"string\") throw new CamelError(\"conversion_rejected\", \"Enum conversion requires a structured string member.\");\n  const member = spec.caseSensitive ? spec.values.find((item) => item === value) : spec.values.find((item) => item.toLocaleLowerCase(\"en-US\") === value.toLocaleLowerCase(\"en-US\"));\n  if (member === undefined) throw new CamelError(\"conversion_rejected\", \"Enum conversion rejected a non-member.\");\n  return member;\n}\n\nfunction canonicalDate(value: unknown, spec: SafeConversionSpec): string {\n  if (spec.kind !== \"date\" || typeof value !== \"string\") throw new CamelError(\"conversion_rejected\", \"Date conversion requires a canonical structured string.\");\n  const pattern = spec.format === \"date\" ? /^\\d{4}-\\d{2}-\\d{2}$/ : /^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{1,3})?(?:Z|[+-]\\d{2}:\\d{2})$/;\n  const instant = Date.parse(spec.format === \"date\" ? `${value}T00:00:00Z` : value);\n  if (!pattern.test(value) || !Number.isFinite(instant) || (spec.format === \"date\" && new Date(instant).toISOString().slice(0, 10) !== value)) throw new CamelError(\"conversion_rejected\", \"Date conversion rejected a non-canonical value.\");\n  if (spec.earliest && value < spec.earliest || spec.latest && value > spec.latest) throw new CamelError(\"conversion_rejected\", \"Date conversion rejected an out-of-range value.\");\n  return value;\n}\n\nfunction measure(value: string | Uint8Array | readonly unknown[], metric: \"byte_length\" | \"codepoint_length\" | \"item_count\"): number {\n  if (metric === \"byte_length\" && (typeof value === \"string\" || value instanceof Uint8Array)) return utf8Length(value);\n  if (metric === \"codepoint_length\" && typeof value === \"string\") return [...value].length;\n  if (metric === \"item_count\" && Array.isArray(value)) return value.length;\n  throw new CamelError(\"conversion_rejected\", \"Measurement input does not match the registered metric.\");\n}\n\nfunction evaluatePredicate(value: unknown, predicate: SafePredicateSpec, registries: ConversionRegistryConfig[\"registeredIds\"]): boolean {\n  if (predicate.kind === \"has_fields\") return typeof value === \"object\" && value !== null && !Array.isArray(value) && predicate.fields.every((field) => Object.hasOwn(value, field));\n  if (predicate.kind === \"registered_id\") return typeof value === \"string\" && registries?.[predicate.registryId]?.values[value] !== undefined;\n  const actual = value === null ? \"null\" : Array.isArray(value) ? \"array\" : typeof value;\n  return actual === predicate.valueType;\n}\n\nfunction sourceIdentity(source: Unsafe<unknown>): string {\n  const artifact = [...source.label.provenance, ...source.label.dependencies.map((dependency) => dependency.ref)].find((ref) => ref.kind === \"artifact\");\n  const fallback = source.label.provenance[0];\n  if (!artifact && !fallback) throw new CamelError(\"conversion_rejected\", \"Conversion source has no immutable provenance.\");\n  const ref = artifact ?? fallback!;\n  return `${ref.kind}:${ref.id}:${ref.digest ?? \"\"}`;\n}\n\nfunction missingPolicy(): never {\n  throw new CamelError(\"conversion_rejected\", \"Conversion policy is not registered.\");\n}\n","import { CamelError } from \"./errors\";\nimport { createSafeInternal, createUnsafeInternal, isCamelValue, isUnsafe, type LabelMetadata, type ReaderSet, type Safe, type Unsafe } from \"./value\";\n\n/** One control-owned constant registered before agent execution. */\nexport interface ControlConstant<T = unknown> {\n  readonly id: string;\n  readonly value: T;\n  readonly readers: ReaderSet;\n}\n\ntype ControlValue<C extends readonly ControlConstant[], I extends C[number][\"id\"]> = Extract<C[number], { readonly id: I }> extends ControlConstant<infer T> ? T : unknown;\n\n/** Explicit Safe-control and Unsafe-data ingress operations. */\nexport interface CamelIngress<C extends readonly ControlConstant[] = readonly ControlConstant[]> {\n  userInstruction(value: string, input: { readonly id: string; readonly readers: ReaderSet }): Safe<string>;\n  systemPolicy(value: string, input: { readonly id: string; readonly readers: ReaderSet }): Safe<string>;\n  control<I extends C[number][\"id\"]>(id: I): Safe<ControlValue<C, I>>;\n  external<T>(value: T, metadata: LabelMetadata): Unsafe<T>;\n  quarantinedOutput<T>(value: T, metadata: Omit<LabelMetadata, \"provenance\"> & { readonly runId: string; readonly digest?: string }): Unsafe<T>;\n}\n\n/** Create explicit trusted-control and untrusted ingress boundaries. */\nexport function createCamelIngress<const C extends readonly ControlConstant[]>(constants: C): CamelIngress<C>;\nexport function createCamelIngress(): CamelIngress<readonly []>;\nexport function createCamelIngress(constants: readonly ControlConstant[] = []): CamelIngress {\n  const byId = new Map<string, ControlConstant>();\n  for (const item of constants) {\n    if (!item.id || byId.has(item.id)) throw new CamelError(\"state_conflict\", \"Control constant IDs must be unique and non-empty.\");\n    assertNoUnsafeConstant(item.value);\n    byId.set(item.id, item);\n  }\n  const ingress = {\n    userInstruction: (value: string, input: { readonly id: string; readonly readers: ReaderSet }) => createSafeInternal(value, \"user_instruction\", metadata(\"user_instruction\", input.id, input.readers)),\n    systemPolicy: (value: string, input: { readonly id: string; readonly readers: ReaderSet }) => createSafeInternal(value, \"system_policy\", metadata(\"system_policy\", input.id, input.readers)),\n    control: (id: string) => {\n      const item = byId.get(id);\n      if (!item) throw new CamelError(\"permission_denied\", \"Unknown control constant.\");\n      return createSafeInternal(item.value, \"harness_constant\", metadata(\"harness\", id, item.readers));\n    },\n    external: <T>(value: T, label: LabelMetadata) => createUnsafeInternal(value, label),\n    quarantinedOutput: <T>(value: T, input: Omit<LabelMetadata, \"provenance\"> & { runId: string; digest?: string }) => {\n      if (!input.runId) throw new CamelError(\"state_conflict\", \"Quarantined run IDs must be non-empty.\");\n      return createUnsafeInternal(value, {\n        readers: input.readers,\n        dependencies: input.dependencies,\n        provenance: [{ kind: \"quarantined_llm\", id: input.runId, digest: input.digest }],\n      });\n    },\n  };\n  return Object.freeze(ingress) as CamelIngress;\n}\n\nfunction assertNoUnsafeConstant(value: unknown, seen = new WeakSet<object>()): void {\n  if (typeof value !== \"object\" || value === null || seen.has(value)) return;\n  seen.add(value);\n  if (isCamelValue(value)) {\n    if (isUnsafe(value)) throw new CamelError(\"unsafe_privileged_flow\", \"Control constants cannot contain Prompt-Unsafe values.\");\n    assertNoUnsafeConstant(value.value, seen);\n    return;\n  }\n  for (const child of Object.values(value)) assertNoUnsafeConstant(child, seen);\n}\n\nfunction metadata(kind: \"user_instruction\" | \"system_policy\" | \"harness\", id: string, readers: ReaderSet): LabelMetadata {\n  if (!id) throw new CamelError(\"state_conflict\", \"Provenance IDs must be non-empty.\");\n  return { readers, provenance: [{ kind, id }] };\n}\n","import { CamelError } from \"./errors\";\nimport { canonicalJson, sha256Hex, utf8Length } from \"./hash\";\nimport { canRead } from \"./readers\";\nimport { isSafe, type CamelValue, type PromptSafety, type Safe } from \"./value\";\n\nexport { conversionPolicyDigest, createConversionRegistry } from \"./conversions\";\nexport type {\n  ConversionRegistry,\n  ConversionRegistryConfig,\n  RegisteredIdRegistry,\n  SafeConversionPolicy,\n  SafeConversionSpec,\n  SafePredicateSpec,\n  UnsafeToSafeOperations,\n} from \"./conversions\";\n\n/** Security-relevant effect category used independently from prompt safety. */\nexport type EffectClass =\n  | \"pure\"\n  | \"no_reentry_display\"\n  | \"public_network_read\"\n  | \"scoped_data_read\"\n  | \"append_only_observation\"\n  | \"reversible_mutation\"\n  | \"irreversible_mutation\"\n  | \"external_send\"\n  | \"financial\"\n  | \"secret_read\"\n  | \"code_execution\";\n\n/** How one tool argument participates in interpretation, authority, disclosure, or selection. */\nexport type ToolArgumentRole = \"instruction\" | \"authority\" | \"destination\" | \"selector\" | \"payload\";\n\n/** Fixed-provider, fixed-destination bounds for the narrow Unsafe-selector exception. */\nexport interface ConfinedUnsafeSelectorPolicy {\n  readonly policyId: string;\n  readonly policyDigest: string;\n  readonly effect: \"public_network_read\" | \"append_only_observation\";\n  readonly selectorPaths: readonly string[];\n  readonly fixedProviderIds: readonly string[];\n  readonly maximumCalls: number;\n  readonly maximumResultsPerCall: number;\n  readonly maximumOutputBytes: number;\n  readonly maximumSelectorBytes: number;\n  readonly fixedDestination: true;\n  readonly unsafeOutput: true;\n}\n\n/** Labelled argument annotated with the role enforced before a tool effect. */\nexport type ToolArgument =\n  | { readonly role: \"instruction\"; readonly value: Safe<unknown> }\n  | { readonly role: \"authority\"; readonly value: Safe<unknown> }\n  | { readonly role: \"destination\"; readonly value: Safe<string>; readonly registryId: string; readonly registryDigest: string }\n  | { readonly role: \"selector\"; readonly value: CamelValue<unknown, PromptSafety> }\n  | { readonly role: \"payload\"; readonly value: CamelValue<unknown, PromptSafety> };\n\n/** Versioned tool shape, effect class, argument roles, and policy identity. */\nexport interface ToolDescriptor {\n  readonly name: string;\n  readonly version: number;\n  readonly effect: EffectClass;\n  readonly inputSchema: Readonly<Record<string, unknown>>;\n  readonly argumentRoles: Readonly<Record<string, ToolArgumentRole>>;\n  readonly policyId: string;\n  readonly unsafeSelectorPolicy?: ConfinedUnsafeSelectorPolicy;\n}\n\n/** Exact plan, tool, arguments, dependencies, and readers evaluated for one effect. */\nexport interface PolicyInput {\n  readonly planId: string;\n  readonly tool: ToolDescriptor;\n  readonly args: Readonly<Record<string, ToolArgument>>;\n  readonly controlDependencies: readonly CamelValue<unknown, PromptSafety>[];\n  readonly intendedReaderIds?: readonly Safe<string>[];\n}\n\n/** Closed authorization decision: allow, deny, or exact-action approval. */\nexport type PolicyOutcome =\n  | { readonly outcome: \"allow\"; readonly decisionId: string }\n  | { readonly outcome: \"deny\"; readonly decisionId: string; readonly reasonCode: string }\n  | { readonly outcome: \"require_approval\"; readonly decisionId: string; readonly reasonCode: string; readonly actionDigest: string };\n\n/** Control-owned destination registries and effects requiring approval. */\nexport interface DestinationRegistry {\n  readonly digest: string;\n  readonly values: readonly string[];\n}\n\n/** Control-owned destination registries and effects requiring approval. */\nexport interface EffectPolicyConfig {\n  readonly destinationRegistries?: Readonly<Record<string, DestinationRegistry>>;\n  readonly approvalEffects?: readonly EffectClass[];\n}\n\n/** Effect authorization gate that remains independent from Safe/Unsafe conversion. */\nexport interface EffectPolicy {\n  evaluate(input: PolicyInput): Promise<PolicyOutcome>;\n}\n\n/** Create an effect gate independent from prompt-safety conversion. */\nexport function createEffectPolicy(config: EffectPolicyConfig = {}): EffectPolicy {\n  const approvalEffects = new Set<EffectClass>(config.approvalEffects ?? [\"irreversible_mutation\", \"external_send\", \"financial\", \"secret_read\", \"code_execution\"]);\n  const registries = copyRegistries(config.destinationRegistries ?? {});\n  return Object.freeze({ evaluate: (input: PolicyInput) => evaluate(input, registries, approvalEffects) });\n}\n\n/** Compute the digest binding an exact set of registered effect destinations. */\nexport function destinationRegistryDigest(values: readonly string[]): Promise<string> {\n  return sha256Hex(canonicalJson([...values].sort()));\n}\n\nasync function evaluate(input: PolicyInput, registries: Readonly<Record<string, DestinationRegistry>>, approvals: ReadonlySet<EffectClass>): Promise<PolicyOutcome> {\n  const actionDigest = await sha256Hex(canonicalJson(input));\n  const decisionId = `decision_${actionDigest.slice(0, 24)}`;\n  const deny = (reasonCode: string): PolicyOutcome => ({ outcome: \"deny\", decisionId, reasonCode });\n  if (!input.planId || !input.tool.name || !input.tool.policyId || !Number.isSafeInteger(input.tool.version)) return deny(\"invalid_descriptor\");\n  const expectedPaths = Object.keys(input.tool.argumentRoles).sort();\n  const actualPaths = Object.keys(input.args).sort();\n  if (expectedPaths.length !== actualPaths.length || expectedPaths.some((path, index) => path !== actualPaths[index])) return deny(\"argument_shape_mismatch\");\n\n  const confined = new Set<CamelValue<unknown>>();\n  for (const [path, arg] of Object.entries(input.args)) {\n    if (arg.role !== input.tool.argumentRoles[path]) return deny(\"argument_role_mismatch\");\n    const invalid = await validateArgument(path, arg, input.tool, registries);\n    if (invalid) return deny(invalid);\n    if (arg.role === \"selector\" && !isSafe(arg.value)) confined.add(arg.value);\n  }\n  if (input.controlDependencies.some((value) => !isSafe(value) && !confined.has(value))) return deny(\"unsafe_control_dependency\");\n  if (confined.size > 0) {\n    const fixed = input.tool.unsafeSelectorPolicy?.fixedProviderIds ?? [];\n    const destinations = Object.values(input.args).filter((arg): arg is Extract<ToolArgument, { role: \"destination\" }> => arg.role === \"destination\");\n    if (destinations.length === 0 || destinations.some((arg) => !fixed.includes(arg.value.value))) return deny(\"unsafe_selector_provider_mismatch\");\n  }\n\n  const readerValues = input.intendedReaderIds ?? [];\n  if (readerValues.some((reader) => !isSafe(reader) || typeof reader.value !== \"string\" || !reader.value || !isControlOwned(reader))) return deny(\"invalid_reader\");\n  const readers = readerValues.map((reader) => reader.value);\n  for (const arg of Object.values(input.args)) {\n    if (readers.some((reader) => !canRead(arg.value.label.readers, reader))) return deny(\"reader_mismatch\");\n  }\n  const hasUnsafePayload = Object.values(input.args).some((arg) => arg.role === \"payload\" && !isSafe(arg.value));\n  if (hasUnsafePayload && input.tool.effect === \"external_send\" && readers.length === 0) return deny(\"reader_required\");\n\n  if (approvals.has(input.tool.effect)) return { outcome: \"require_approval\", decisionId, reasonCode: \"effect_requires_approval\", actionDigest };\n  return { outcome: \"allow\", decisionId };\n}\n\nasync function validateArgument(path: string, arg: ToolArgument, tool: ToolDescriptor, registries: Readonly<Record<string, DestinationRegistry>>): Promise<string | undefined> {\n  if (arg.role === \"instruction\" && !isSafe(arg.value)) return \"unsafe_instruction_argument\";\n  if (arg.role === \"authority\") {\n    if (!isSafe(arg.value)) return \"unsafe_authority_argument\";\n    if (!isControlOwned(arg.value)) return \"authority_not_control_owned\";\n  }\n  if (arg.role === \"destination\") {\n    if (!isSafe(arg.value)) return \"unsafe_destination_argument\";\n    if (!isControlOwned(arg.value)) return \"destination_not_control_owned\";\n    const registry = registries[arg.registryId];\n    const validValues = registry && registry.values.length > 0 && registry.values.every((value) => typeof value === \"string\" && value.length > 0) && new Set(registry.values).size === registry.values.length;\n    if (!registry || !validValues || registry.digest !== arg.registryDigest || await destinationRegistryDigest(registry.values) !== registry.digest || !registry.values.includes(arg.value.value)) return \"destination_not_registered\";\n  }\n  if (arg.role === \"selector\" && !isSafe(arg.value)) return validateUnsafeSelector(path, arg.value, tool);\n  return undefined;\n}\n\nfunction isControlOwned(value: Safe<unknown>): boolean {\n  return value.label.safeBasis === \"system_policy\" || value.label.safeBasis === \"harness_constant\";\n}\n\nfunction copyRegistries(registries: Readonly<Record<string, DestinationRegistry>>): Readonly<Record<string, DestinationRegistry>> {\n  return Object.freeze(Object.fromEntries(Object.entries(registries).map(([id, registry]) => [id, Object.freeze({ digest: registry.digest, values: Object.freeze([...registry.values]) })])));\n}\n\nfunction validateUnsafeSelector(path: string, value: CamelValue<unknown>, tool: ToolDescriptor): string | undefined {\n  const policy = tool.unsafeSelectorPolicy;\n  if (!policy || policy.effect !== tool.effect || !policy.selectorPaths.includes(path)) return \"unsafe_selector_not_confined\";\n  if (!policy.fixedDestination || !policy.unsafeOutput || policy.fixedProviderIds.length === 0) return \"unsafe_selector_not_confined\";\n  if (![policy.maximumCalls, policy.maximumResultsPerCall, policy.maximumOutputBytes, policy.maximumSelectorBytes].every((bound) => Number.isSafeInteger(bound) && bound > 0)) return \"unsafe_selector_not_confined\";\n  if (utf8Length(value.value) > policy.maximumSelectorBytes) return \"unsafe_selector_too_large\";\n  if (typeof value.value === \"string\" && looksLikeDestination(value.value)) return \"unsafe_selector_is_destination\";\n  return undefined;\n}\n\nfunction looksLikeDestination(value: string): boolean {\n  const text = value.trim();\n  return /^(?:[a-z][a-z0-9+.-]*:\\/\\/|\\/|\\\\\\\\)/i.test(text) || /^[\\w.-]+\\.[a-z]{2,}(?:[/:]|$)/i.test(text);\n}\n\n/** Throw when policy did not allow an effect; useful immediately before a handler call. */\nexport function assertPolicyAllowed(outcome: PolicyOutcome): asserts outcome is Extract<PolicyOutcome, { outcome: \"allow\" }> {\n  if (outcome.outcome !== \"allow\") throw new CamelError(outcome.outcome === \"deny\" ? \"policy_denied\" : \"approval_required\", \"Tool effect was not authorized.\");\n}\n","import { readFileSync } from \"node:fs\";\n\nexport function cliVersion(): string {\n  const pkg = JSON.parse(readFileSync(new URL(\"../package.json\", import.meta.url), \"utf8\")) as { version?: string };\n  return pkg.version ?? \"unknown\";\n}\n\nexport function printHelp(output: Pick<typeof console, \"log\"> = console): void {\n  output.log(`odla-ai\n\nStart here:\n  odla-ai runbook ask \"<question>\"   The current procedure, from odla's own\n                                     runbooks. Ask BEFORE searching the web or\n                                     working from memory: runbooks are edited\n                                     live, so your training data is out of date\n                                     and this is not.\n  odla-ai runbook impact             After a change: which runbooks describe the\n                                     code you just touched, so you can fix any\n                                     step it made wrong.\n\nUsage:\n  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]\n  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]\n  odla-ai doctor [--config odla.config.mjs]\n  odla-ai calendar status [--env dev] [--email <odla-account>] [--json]\n  odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]\n  odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]\n  odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes\n  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes\n  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]\n  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]\n  odla-ai app import <file|-> [--env dev] [--ns <namespace>] [--id-field <f>|--key <attr>|--generate-ids] [--dry-run] [--json] --yes\n  odla-ai app refresh-sandbox [--include-identity] [--include-files] [--dry-run] [--json] --yes\n  odla-ai app go-live         [--include-identity] [--include-files] [--dry-run] [--json] --yes\n  odla-ai app promote         [--dry-run] [--json] --yes\n  odla-ai app rename <name> [--config odla.config.mjs] [--email <odla-account>] [--json]\n  odla-ai app owners list [--config odla.config.mjs] [--email <odla-account>] [--json]\n  odla-ai app owners add <email> [--email <odla-account>] [--json]\n  odla-ai app owners remove <email> [--email <odla-account>] [--json]\n  odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]\n  odla-ai pm task list [--app <id>] [--column <c>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]\n  odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]\n  odla-ai pm bug list [--app <id>] [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]\n  odla-ai pm goal add --app <id> --title <t> [--status <s>] [--proof <text>] [--target <pct>] [--mutation-id <id>] [--json]\n  odla-ai pm task add --app <id> --title <t> [--column <c>] [--goal <id>] [--assignee <id>] [--description <text>|--body <text>] [--due <epoch-ms>] [--mutation-id <id>] [--json]\n  odla-ai pm decision add --app <id> --title <t> --body <text> [--status <s>] [--mutation-id <id>] [--json]\n  odla-ai pm bug add --app <id> --title <t> (--description <text>|--body <text>) [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--mutation-id <id>] [--json]\n  odla-ai pm <goal|task|decision|bug> get <id> [--json]\n  odla-ai pm goal set <id> [--title <t>|--status <s>|--proof <text>|--no-proof|--target <pct>|--no-target] [--mutation-id <id>] [--json]\n  odla-ai pm task set <id> [--title <t>|--column <c>|--rank <n>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--description <text>|--body <text>|--due <epoch-ms>|--no-due] [--mutation-id <id>] [--json]\n  odla-ai pm decision set <id> [--title <t>|--status <s>|--body <text>] [--mutation-id <id>] [--json]\n  odla-ai pm bug set <id> [--title <t>|--status <s>|--severity <s>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--decision <id>|--no-decision|--description <text>|--body <text>] [--mutation-id <id>] [--json]\n  odla-ai pm <goal|task|decision> done <id> [--mutation-id <id>]\n  odla-ai pm bug done <id> [--decision <accepted-decision-id>] [--mutation-id <id>]\n  odla-ai pm <goal|task|decision|bug> comment <id> --body \"...\" [--mutation-id <id>]\n  odla-ai pm <goal|task|decision|bug> comments <id> [--json]\n  odla-ai pm <goal|task|decision|bug> rm <id>\n  odla-ai pm handoff --app <id> [--json]\n  odla-ai discuss groups [--json]\n  odla-ai discuss list [--app <id>] [--q <text>] [--state open|resolved|all] [--json]\n  odla-ai discuss read <topic> [--limit <n> --offset <n>] [--json]\n  odla-ai discuss post --app <id> --subject \"...\" --body \"...\" [--markup \"... @[Label](kind/id)\"] [--mutation-id <id>]\n  odla-ai discuss reply <topic> --body \"...\" [--markup \"...\"] [--mutation-id <id>]\n  odla-ai discuss resolve <topic> [--reopen] [--mutation-id <id>]\n  odla-ai discuss who --q <text> [--app <id>] [--kinds user,pm:task] [--json]\n  odla-ai discuss watch [<topic>] [--cursor <cursor>] [--by <authorId>] [--self <authorId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]\n  odla-ai agent jobs [--env dev] [--state pending|running|succeeded|dead_letter] [--limit 50] [--email <email>] [--json]\n  odla-ai agent retry <job-id> [--env dev] [--email <email>] [--json]\n  odla-ai context show [--context <name>] [--platform https://odla.ai] [--app <id>] [--env prod] [--json]\n  odla-ai context list [--json]\n  odla-ai context save <name> [--platform <url>] [--app <id>] [--env <name>] [--json]\n  odla-ai context remove <name> --yes [--json]\n  odla-ai o11y status [--app <id>] [--context <name>] [--platform https://odla.ai] [--env prod] [--minutes 60] [--json]\n  odla-ai whoami [--context <name>] [--platform https://odla.ai] [--json]\n  odla-ai runbook ask \"<question>\" [--app <id>] [--all] [--json]\n  odla-ai runbook search \"<question>\" [--app <id>] [--all] [--limit <n>] [--json]\n  odla-ai runbook impact [--base origin/main] [--app <id>] [--all] [--limit <n>] [--json]\n  odla-ai runbook lint [--app <id>] [--all] [--json]\n  odla-ai runbook list [--app <id>] [--all] [--q <text>] [--json]\n  odla-ai runbook comment <slug> --body \"...\" [--app <id>]\n  odla-ai runbook get <slug> [--app <id>]\n  odla-ai runbook new <slug> --title <t> --file <path|-> [--summary <s>] [--requires <specs>] [--app <id>]\n  odla-ai runbook edit <slug> [--file <path|->|--body \"...\"] [--note <why>] [--requires <specs>] [--app <id>]\n  odla-ai runbook import <dir> [--visibility operator|admin] [--dry-run] [--app <id>]\n  odla-ai runbook publish <slug> [--app <id>]\n  odla-ai runbook visibility <slug> <operator|admin> [--app <id>]\n  odla-ai runbook archive <slug> [--app <id>]\n  odla-ai runbook history <slug> [--app <id>] [--json]\n  odla-ai runbook revert <slug> --version <n> [--app <id>]\n  odla-ai runbook rm <slug> [--app <id>]\n  odla-ai capabilities [--json]\n  odla-ai code connect [--env dev|prod] [--email <odla-account>] [--engine auto|container|podman|docker] [--slots <1-64>] [--once]\n  odla-ai admin ai show [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]\n  odla-ai admin ai models [--context <name>] [--provider <id>] [--json]\n  odla-ai admin ai set <purpose> [--context <name>] [--provider <id>] [--model <id>] [--enabled|--no-enabled]\n    [--max-input-bytes <n>] [--max-output-tokens <n>] [--max-calls-per-run <n>] [--json]\n  odla-ai admin ai set security [--context <name>] --discovery-provider <id> --discovery-model <id>\n    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled] [--json]\n  odla-ai admin ai credentials [--context <name>] [--json]\n  odla-ai admin ai credential set <provider> [--context <name>] (--from-env <NAME>|--stdin)\n  odla-ai admin ai usage [--context <name>] [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]\n  odla-ai admin ai audit [--context <name>] [--limit <1-200>] [--json]\n  odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]\n  odla-ai security github disconnect --source <id> [--env dev] [--yes]\n  odla-ai security plan [--env dev] [--json]\n  odla-ai security sources [--env dev] [--json]\n  odla-ai security run --source <id> --plan-digest <sha256:...> --ack-redacted-source [--ref <branch|tag|sha>] [--env dev] [--no-follow]\n  odla-ai security status <job-id> [--follow] [--json]\n  odla-ai security report <job-id> [--json]\n  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]\n  odla-ai security run [target] --self --ack-redacted-source\n  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]\n  odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]\n  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]\n  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]\n  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]\n  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]\n  odla-ai version\n\nCommands:\n  agent        Inspect durable agent wakeups and explicitly requeue a\n               dead-lettered job; JSON output is stable for remote operators.\n  runbook      odla's operational procedures, stored in the database and read at\n               the moment they are followed. \"ask\" gives a written, cited answer;\n               \"search\" the passages behind it; \"get\" the whole document.\n               \"impact\" diffs your working tree against a base ref and names the\n               runbooks that describe what you changed — run it after touching a\n               package's exported API or JSDoc, or a Studio surface. \"lint\"\n               checks the corpus the other way: every odla-ai command the\n               runbooks name is held against this CLI's real command surface,\n               and against the minimum versions each runbook declares. A wrong step\n               is fixed with \"edit\", which takes effect immediately: a runbook is\n               a row, not a release. Runbooks describe PROCEDURE; what an export\n               does and what it guarantees is JSDoc, rendered per package at\n               https://odla.ai/docs and shipped in the installed .d.ts. Answering\n               a question usually needs both.\n  whoami       Report who this terminal is authenticated as, and whether it holds\n               platform admin. A handshake-minted device token is never admin,\n               however the human who approved it is configured.\n  context      Explain selected config, platform, app, environment, and\n               developer-token provenance without printing credentials or\n               starting a device handshake. Operator work can run outside a\n               project checkout with explicit flags or ODLA_* environment\n               variables.\n  setup        Install offline odla runbooks for common coding-agent harnesses.\n  init         Create a generic odla.config.mjs plus starter schema/rules files.\n  doctor       Validate and summarize the project config without network calls.\n  calendar     Inspect, connect, or disconnect the live Google booking connection.\n  app          Archive (suspend, data retained), restore, export, import, or\n               manage the co-owners of the app. Archiving takes every\n               environment's data plane down until restored; permanent deletion\n               has NO CLI — it requires a signed-in owner in Studio, and no\n               machine or agent credential can purge. \"app export\" downloads a\n               portable gzipped-JSONL snapshot of one database (--fresh takes a\n               new snapshot first) — your data is always yours to take.\n               \"app import\" upserts rows back in from JSON, JSONL, or a\n               {namespace: rows} map (the shape a query returns); it writes only\n               with --yes, so the bare command is a dry run, and it refuses to\n               guess an id mode that would duplicate rows on a re-run.\n               \"app refresh-sandbox\" replaces the sandbox with a copy of live\n               (the routine dev loop); \"app go-live\" copies the sandbox into an\n               EMPTY live database, once, at launch; \"app promote\" pushes only\n               schema, rules and gates up afterwards, leaving live's rows alone.\n               Each prints its plan and writes nothing without --yes, so the\n               bare command is the dry run. Clerk config, triggers, allowlists,\n               secrets and API keys never travel; identity rows stay behind\n               unless --include-identity.\n               \"app rename <name>\" changes only the display name humans read;\n               the app id is permanent (tenants, URLs and keys embed it), so a\n               rename never re-provisions anything or invalidates a credential.\n               \"app owners add <email>\" grants a signed-up odla member the SAME\n               full access as you; they then run their own \"provision\" to mint\n               their own credentials for the shared db (the live one included)\n               — no secret is ever copied between people.\n  capabilities Show what the CLI automates vs agent edits and human checkpoints.\n  code         Enroll this Mac/Linux host for the current Studio-connected repository and run Pi.\n  admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.\n  security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.\n  pm           Project management (via @odla-ai/pm) shared across the apps you\n               co-own: conformance goals, kanban tasks, decisions, and bugs. With\n               no --app, \"list\" spans every co-owned project (the cross-project\n               view); with --app it scopes to one. Same device-grant auth as\n               \"app\". Entities: goal (alias conformance), task (alias kanban),\n               decision, bug. Status changes and comments post to each item's\n               @odla-ai/chat discussion thread.\n  discuss      Group discussions (via @odla-ai/chat) for the apps you co-own:\n               one group per project, topics with replies, @-mentions of people,\n               agents, PM items, and projects. Built for unattended use — post a\n               question, then \"watch\" it until someone answers. \"watch\" exits 75\n               (not 1) when it times out with nothing new, so a script can tell\n               \"no answer yet\" from a failure and just rerun. Use \"who\" to look\n               up the exact @[Label](kind/id) markup for a mention.\n  o11y         Read one stable status envelope for application RED, current\n               live-sync load/freshness, the protected commit-to-visible\n               canary, collector ingest/scheduler trust, Cloudflare-owned\n               runtime metrics, and a machine verdict.\n               --json keeps auth progress on stderr for unattended agents.\n  provision    Register services, compose integrations, persist credentials, optionally push secrets.\n  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.\n  skill        Same installer; --agent accepts all, claude, codex, cursor,\n               copilot, gemini, or agents (repeatable or comma-separated).\n  secrets      Push configured db/o11y secrets into the Worker via wrangler\n               stdin; set stores a tenant-vault secret and set-clerk-key the\n               reserved Clerk secret key, write-only from stdin or an env var.\n  version      Print the CLI version.\n\nSafety:\n  Every app has two databases on odla.ai: a sandbox (env \"dev\", tenant\n  <appId>--dev) and a live one (env \"prod\", tenant <appId>). Both are served by\n  production odla.ai — there is no separate odla to point at. New projects get\n  the sandbox only. Add \"prod\" explicitly to odla.config.mjs and pass --yes to\n  provision the live database; use --dry-run first to inspect the resolved plan.\n  Provision caches the approved developer token and service credentials under\n  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push\n  preflights Wrangler before any shown-once issuance or destructive rotation.\n  Projectless PM, Discussions, o11y, runbook, and identity commands use\n  --platform/--app/--env, ODLA_PLATFORM_URL/ODLA_APP_ID/ODLA_ENV, and\n  ODLA_DEV_TOKEN. Save non-secret scope metadata with \"context save\", then\n  select it explicitly with --context or ODLA_CONTEXT. Each named context gets\n  isolated developer and scoped-token caches. Override their locations with\n  ODLA_DEV_TOKEN_FILE and ODLA_ADMIN_TOKEN_FILE; ODLA_CONTEXT_FILE relocates\n  the metadata file. Flags and specific ODLA_* scope variables beat a selected\n  context, which beats project config. There is no ambient current context.\n  \"context show\" reports only provenance and cache state and never authenticates.\n  Provision opens the approval page in your browser automatically whenever the\n  machine can show one, including agent-driven runs; only CI, SSH, and\n  display-less hosts skip it. Use --open to force or --no-open to suppress.\n  Browser launch is best-effort: the printed approval URL is authoritative and\n  agents must relay it to the human verbatim. A started handshake is persisted\n  under .odla/, so a command killed mid-wait loses nothing — rerunning resumes\n  the same code. Outside an interactive terminal the wait is capped (90s by\n  default, --wait <seconds> to change); a still-pending handshake then exits\n  with code 75: relay the URL, wait for approval, and re-run to collect.\n  A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.\n  The email is a non-secret identity hint: never provide a password or session\n  token. The matching account must already exist, be signed in, explicitly\n  review the exact code, and finish any current request before claiming another.\n  Run Code from a GitHub checkout already connected to an app in Studio; an\n  odla.config.mjs may select the app explicitly but is not required. Code host\n  approval and credential hashes live in odla-ai/db. The host\n  credential is never written under .odla/; it exists only in the foreground\n  \"code connect\" process and is rotated by the next approved connection.\n  Calendar setup has a second human checkpoint: odla issues a state-bound Google consent URL;\n  OAuth codes and refresh tokens never enter the CLI, repo, chat, or app.\n  GitHub security uses source-read-only access plus optional metadata-only Checks write: the CLI never asks\n  for a PAT or provider key. GitHub read access is separate from the explicit\n  --ack-redacted-source consent and the exact --plan-digest printed by security\n  plan are required before bounded snippets reach System AI.\n  Run security plan first to inspect the admin-selected providers, models,\n  per-route bounds, credential readiness, retention, no-execution boundary,\n  and digest that binds consent to that exact plan.\n`);\n}\n","import { execFile } from \"node:child_process\";\nimport { createHash } from \"node:crypto\";\nimport {\n  digestStagedWorkspace, materializeGitTree, stageWorkspace, stageWorkspacePair,\n  type MaterializedGitTree,\n} from \"@odla-ai/harness/node\";\nimport type { CodeLocalSourceDescriptor } from \"./code-source-types\";\n\nconst SOURCE_LIMITS = { maxFiles: 20_000, maxBytes: 512 * 1024 * 1024 } as const;\n\nexport interface PreparedCodeLocalSource {\n  descriptor: CodeLocalSourceDescriptor;\n  trustedBaseDir: string;\n  sourceDir: string;\n  cleanup(): Promise<void>;\n}\n\n/** Freeze the local Git tree and exact commit base before any approval request. */\nexport async function prepareCodeLocalSource(\n  cwd: string, repository: string, readHead: (cwd: string) => Promise<string> = readGitHead,\n): Promise<PreparedCodeLocalSource> {\n  const headCommitSha = await readHead(cwd);\n  const staged = await stageWorkspace(cwd, { ...SOURCE_LIMITS, gitTrackedAndUnignored: true });\n  let trusted: MaterializedGitTree | undefined;\n  try {\n    trusted = await materializeGitTree(cwd, headCommitSha, SOURCE_LIMITS);\n    const comparison = await stageWorkspacePair(trusted.sourceDir, staged.baselineDir, SOURCE_LIMITS);\n    let developerPatch: string;\n    try { developerPatch = await comparison.patch(4 * 1024 * 1024); }\n    finally { await comparison.cleanup(); }\n    const descriptor: CodeLocalSourceDescriptor = {\n      kind: \"local_checkout\", repository, headCommitSha,\n      trustedBaseDigest: await digestStagedWorkspace(trusted.sourceDir, SOURCE_LIMITS),\n      developerPatchDigest: digestText(developerPatch),\n      snapshotDigest: await digestStagedWorkspace(staged.baselineDir, SOURCE_LIMITS),\n      modified: developerPatch.length > 0,\n      fileCount: staged.fileCount, byteCount: staged.byteCount, capturedAt: Date.now(),\n    };\n    return {\n      descriptor, trustedBaseDir: trusted.sourceDir, sourceDir: staged.baselineDir,\n      cleanup: async () => { await Promise.all([staged.cleanup(), trusted!.cleanup()]); },\n    };\n  } catch (error) {\n    await Promise.all([staged.cleanup(), trusted?.cleanup()]);\n    throw error;\n  }\n}\n\nasync function readGitHead(cwd: string): Promise<string> {\n  const value = await new Promise<string>((accept, reject) => {\n    execFile(\"git\", [\"rev-parse\", \"HEAD\"], { cwd, encoding: \"utf8\", maxBuffer: 16_384 }, (error, stdout) => {\n      if (error) reject(new Error(\"code connect requires a Git checkout with an initial commit\"));\n      else accept(stdout.trim());\n    });\n  });\n  if (!/^[0-9a-f]{40}$/.test(value)) throw new Error(\"code connect could not resolve the checkout HEAD commit\");\n  return value;\n}\n\nfunction digestText(value: string): `sha256:${string}` {\n  return `sha256:${createHash(\"sha256\").update(value).digest(\"hex\")}`;\n}\n","import { createAppsClient, tenantIdFor } from \"@odla-ai/apps\";\nimport { putSecret } from \"@odla-ai/ai\";\nimport process from \"node:process\";\nimport type { ProvisionOptions } from \"./types\";\nimport { buildPlan, calendarBookingPageUrl, calendarServiceConfig, GOOGLE_CALENDAR_EVENTS_SCOPE, loadProjectConfig } from \"./config\";\nimport { applyCalendarBookingPage, ensureCalendarConnected } from \"./calendar\";\nimport { isCalendarPlatformNotReady } from \"./calendar-errors\";\nimport { handshakeFile } from \"./handshake-state\";\nimport { provisionIntegrationSeeds } from \"./integration-provision\";\nimport { resolveDatabaseConfig } from \"./integrations\";\nimport { getDeveloperToken } from \"./token\";\nimport {\n  displayPath, ensureGitignore, gitignoreEntry, o11yDevVars, readCredentials, resolveWriteDevVarsTarget, writeDevVars,\n} from \"./local\";\nimport { provisionEnvCredentials } from \"./provision-credentials\";\nimport {\n  assertTenantAdminAccess, defaultSecretName, normalizeClerkConfig, postJson, serviceRank,\n} from \"./provision-helpers\";\nimport { preflightSecretsPush, secretsPushAfterPreflight } from \"./secrets\";\n\n/**\n * Provision an app end-to-end from its config — the primary deploy path, and\n * (apart from key rotation) idempotent, so re-running is safe. Obtains a\n * developer token, creates the registry app when absent, enables each service\n * per env (AI also gets `setAi` with the configured provider/model), configures\n * Clerk auth and links, then per env mints or reuses credentials only for the\n * configured services, collision-checks and merges integration schema/rules,\n * pushes the composed schema with the db key and rules with the developer\n * token, creates natural-key integration seeds only when absent, and stores the provider key in the tenant\n * vault when `ai.keyEnv` is set and present. Writes the credentials file\n * (mode 0600, gitignored) and, when requested, `.dev.vars`. Google Calendar\n * consent runs last, per env; when the platform connector itself is not yet\n * configured (`calendar_*_not_configured`), provision prints a resume hint\n * (`odla-ai calendar connect`) instead of aborting.\n *\n * The developer token comes from (in order) `options.token`, `$ODLA_DEV_TOKEN`,\n * the cached `.odla` token, or a fresh email-bound device handshake — which\n * prints a user code for the same signed-in account to review and auto-opens\n * the browser whenever this machine can show one — including scripted and\n * agent-driven runs; only CI, SSH, and display-less hosts skip it\n * (`open: true`/`false` forces/suppresses it). Network error bodies pass through\n * `redactSecrets` before display.\n *\n * @param options.dryRun Print the resolved plan and return before any network call/write.\n * @param options.rotateKeys Rotate db keys and o11y tokens.\n * @param options.rotateO11yToken Rotate only the o11y token.\n * @param options.email Existing odla account email for a fresh handshake;\n * this is an identity hint, never a password or session credential.\n * @param options.pushSecrets Preflight Wrangler, then push each env's configured\n *   Worker secrets immediately after credential provisioning.\n * @param options.writeDevVars `true`/a path writes `.dev.vars`; `writeCredentials: false` skips the creds file.\n * @param options.yes Required for a non-dry-run plan containing `prod` or\n *   `production`; callers must show and review `dryRun` output first.\n * @throws When a production plan is executed without `yes`, configuration is\n *   invalid, authorization fails, or a provisioning operation fails.\n */\nexport async function provision(options: ProvisionOptions): Promise<void> {\n  const out = options.stdout ?? console;\n  const cfg = await loadProjectConfig(options.configPath);\n  const plan = buildPlan(cfg);\n  const hasDb = cfg.services.includes(\"db\");\n  const hasO11y = cfg.services.includes(\"o11y\");\n\n  if (options.rotateO11yToken && !hasO11y) {\n    throw new Error(\"--rotate-o11y-token requires the o11y service in odla.config.mjs\");\n  }\n  if (options.pushSecrets && options.writeCredentials === false) {\n    throw new Error(\"--push-secrets cannot be combined with --no-write-credentials\");\n  }\n\n  out.log(`odla-ai: ${plan.appName} (${plan.appId})`);\n  out.log(`  platform: ${plan.platformUrl}`);\n  out.log(`  db:       ${plan.dbEndpoint}`);\n  out.log(`  envs:     ${plan.envs.join(\", \")}`);\n  out.log(`  services: ${plan.services.join(\", \")}`);\n  out.log(`  integrations: ${plan.integrations.length ? plan.integrations.join(\", \") : \"none\"}`);\n\n  const productionEnvs = plan.envs.filter((env) => env === \"prod\" || env === \"production\");\n  if (!options.dryRun && productionEnvs.length > 0 && !options.yes) {\n    throw new Error(\n      `refusing to provision the live database (env ${productionEnvs.join(\", \")}) without --yes; run --dry-run first`,\n    );\n  }\n\n  const database = await resolveDatabaseConfig(cfg);\n  const { schema, rules } = database;\n\n  if (options.dryRun) {\n    out.log(\"dry run: no network calls or file writes\");\n    out.log(`  schema: ${schema ? \"yes\" : \"no\"}`);\n    out.log(`  rules:  ${rules ? Object.keys(rules).length : 0} namespaces`);\n    for (const integration of database.integrations) {\n      const namespaces = Object.keys(integration.schema?.entities ?? {}).length;\n      out.log(`  integration.${integration.id}: ${namespaces} namespaces, ${integration.seeds?.length ?? 0} seeds, ${integration.probes?.length ?? 0} smoke probes`);\n    }\n    out.log(`  ai:     ${cfg.services.includes(\"ai\") ? (cfg.ai?.provider ?? \"not configured\") : \"not enabled\"}`);\n    if (cfg.services.includes(\"calendar\")) {\n      for (const env of cfg.envs) {\n        const calendar = calendarServiceConfig(cfg, env);\n        out.log(`  calendar.${env}: google/book → ${calendar.bookingCalendarId}; availability ${calendar.availabilityCalendars.join(\", \")} (${GOOGLE_CALENDAR_EVENTS_SCOPE})`);\n        const bookingPage = calendarBookingPageUrl(cfg, env);\n        out.log(`  calendar.${env}.bookingPageUrl: ${bookingPage === undefined ? \"unchanged\" : bookingPage ?? \"clear\"}`);\n      }\n    }\n    out.log(`  secrets: ${options.pushSecrets ? \"push configured Worker secrets\" : \"local only\"}`);\n    return;\n  }\n\n  let credentials = readCredentials(cfg.local.credentialsFile);\n  if (credentials && credentials.appId !== cfg.app.id) {\n    throw new Error(\n      `credentials at ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} are for \"${credentials.appId}\", not \"${cfg.app.id}\"`,\n    );\n  }\n  const rotatesO11y = !!(options.rotateKeys || options.rotateO11yToken);\n  const missingO11y = cfg.envs.some((env) => !credentials?.envs[env]?.o11yToken);\n  const missingDb = cfg.envs.some((env) => !credentials?.envs[env]?.dbKey);\n  const losesShownOnceCredential = (hasDb && (!!options.rotateKeys || missingDb)) || (hasO11y && (rotatesO11y || missingO11y));\n  if (options.writeCredentials === false && losesShownOnceCredential) {\n    throw new Error(\"credential issuance/rotation requires the private credentials file; remove --no-write-credentials\");\n  }\n  const devVarsTarget = resolveWriteDevVarsTarget(cfg, options.writeDevVars);\n  if (cfg.local.gitignore) {\n    ensureGitignore(cfg.rootDir, [cfg.local.tokenFile, handshakeFile(cfg), cfg.local.credentialsFile, ...(devVarsTarget ? [devVarsTarget] : [])]);\n  }\n  if (options.pushSecrets) {\n    await preflightSecretsPush({ configPath: cfg.configPath, runner: options.secretRunner });\n    out.log(\"secrets: Wrangler config and login preflight passed\");\n  }\n\n  const doFetch = options.fetch ?? fetch;\n  const token = await getDeveloperToken(cfg, options, doFetch, out);\n  const apps = createAppsClient({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });\n\n  const existing = await apps.resolveApp(cfg.app.id);\n  if (existing) {\n    out.log(`app: ${cfg.app.id} already exists`);\n  } else {\n    await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });\n    out.log(`app: created ${cfg.app.id}`);\n  }\n\n  // Authz fail-fast: prove this operator may admin every env's tenant BEFORE\n  // anything is enabled, minted, or persisted (local file, vault, or Worker).\n  // Without this, an ownership 403 on a later step (e.g. the rules push) aborts\n  // the run with a live shown-once key already written to disk.\n  for (const env of cfg.envs) {\n    await assertTenantAdminAccess(doFetch, cfg, env, token);\n  }\n\n  const serviceOrder = [...cfg.services].sort((a, b) => serviceRank(a) - serviceRank(b));\n  for (const env of cfg.envs) {\n    for (const service of serviceOrder) {\n      if (service === \"ai\") {\n        if (cfg.ai?.provider) {\n          await apps.setAi(cfg.app.id, env, { provider: cfg.ai.provider, ...(cfg.ai.model ? { model: cfg.ai.model } : {}) });\n          out.log(`${env}: ai configured (${cfg.ai.provider}${cfg.ai.model ? `/${cfg.ai.model}` : \"\"})`);\n        } else {\n          await apps.setService(cfg.app.id, \"ai\", true, { env });\n          out.log(`${env}: ai enabled`);\n        }\n      } else {\n        const config = service === \"calendar\" ? calendarServiceConfig(cfg, env) : undefined;\n        await apps.setService(cfg.app.id, service, true, { env, ...(config ? { config } : {}) });\n        out.log(`${env}: ${service} enabled`);\n      }\n    }\n\n    const authConfig = normalizeClerkConfig(cfg.auth?.clerk?.[env]);\n    if (authConfig?.publishableKey) {\n      await apps.setAuth(cfg.app.id, env, authConfig);\n      out.log(`${env}: auth configured (clerk ${authConfig.mode ?? \"client\"})`);\n    }\n\n    const link = cfg.links?.[env];\n    if (link !== undefined) {\n      await apps.setLink(cfg.app.id, env, link ?? null);\n      out.log(`${env}: link ${link ? \"set\" : \"cleared\"}`);\n    }\n\n    if (cfg.services.includes(\"calendar\")) {\n      const calendarCtx = { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch };\n      await applyCalendarBookingPage(calendarCtx, calendarBookingPageUrl(cfg, env), out);\n    }\n  }\n\n  for (const env of cfg.envs) {\n    const tenantId = tenantIdFor(cfg.app.id, env);\n    credentials = await provisionEnvCredentials({\n      cfg,\n      env,\n      developerToken: token,\n      credentials,\n      rotateDb: !!options.rotateKeys,\n      rotateO11y: rotatesO11y,\n      write: options.writeCredentials !== false,\n      fetch: doFetch,\n      stdout: out,\n    });\n    const dbKey = credentials.envs[env]?.dbKey;\n\n    if (options.pushSecrets) {\n      try {\n        await secretsPushAfterPreflight({\n          configPath: cfg.configPath,\n          env,\n          yes: options.yes,\n          runner: options.secretRunner,\n          stdout: out,\n        });\n      } catch (error) {\n        const message = error instanceof Error ? error.message : String(error);\n        const consent = env === \"prod\" || env === \"production\" ? \" --yes\" : \"\";\n        throw new Error(\n          `${message}\\n${env}: credentials are already saved; retry ` +\n          `\"odla-ai secrets push --env ${env}${consent}\" without issuing or rotating again`,\n          { cause: error },\n        );\n      }\n    }\n\n    if (schema && dbKey) {\n      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });\n      out.log(`${env}: schema pushed`);\n    }\n    if (rules) {\n      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);\n      out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);\n    }\n    if (dbKey) {\n      await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);\n    }\n\n    if (cfg.services.includes(\"ai\") && cfg.ai?.provider && cfg.ai.keyEnv) {\n      const key = process.env[cfg.ai.keyEnv];\n      if (key) {\n        const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);\n        await putSecret({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);\n        out.log(`${env}: ${cfg.ai.provider} key stored in vault (${secretName})`);\n      } else {\n        out.log(`${env}: ${cfg.ai.keyEnv} not set; skipped provider key storage`);\n      }\n    }\n\n  }\n\n  if (options.writeCredentials !== false && credentials) {\n    const ignored = cfg.local.gitignore && gitignoreEntry(cfg.rootDir, cfg.local.credentialsFile);\n    out.log(`credentials: wrote ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} (0600${ignored ? \", gitignored\" : \"\"})`);\n  }\n\n  if (devVarsTarget && credentials) {\n    const env = cfg.envs.includes(\"dev\") ? \"dev\" : (cfg.envs[0] ?? \"prod\");\n    writeDevVars(devVarsTarget, credentials, env, o11yDevVars(cfg));\n    out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);\n  }\n\n  // Google consent runs last: the only human checkpoint never blocks\n  // credentials, schema, rules, or local artifacts.\n  if (cfg.services.includes(\"calendar\")) {\n    for (const env of cfg.envs) {\n      try {\n        await ensureCalendarConnected(\n          { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch },\n          {\n            open: options.open,\n            openConsentUrl: options.openApprovalUrl,\n            wait: options.calendarPollWait,\n            pollTimeoutMs: options.calendarPollTimeoutMs,\n            stdout: out,\n          },\n        );\n      } catch (error) {\n        if (!isCalendarPlatformNotReady(error)) throw error;\n        out.log(`${env}: calendar consent skipped (${error.code}); resume with \"odla-ai calendar connect --env ${env}\" once the platform is configured`);\n      }\n    }\n  }\n}\n","import { uuidv7 } from \"@odla-ai/db\";\nimport type { OdlaIntegration } from \"./types\";\nimport { redactSecrets } from \"./redact\";\n\ntype FetchLike = typeof fetch;\n\n/** Create integration seeds only after a natural-key query proves them absent. */\nexport async function provisionIntegrationSeeds(\n  doFetch: FetchLike,\n  endpoint: string,\n  tenantId: string,\n  dbKey: string,\n  integrations: readonly OdlaIntegration[],\n  env: string,\n  out: Pick<typeof console, \"log\" | \"error\">,\n): Promise<void> {\n  const base = `${endpoint}/app/${encodeURIComponent(tenantId)}`;\n  for (const integration of integrations) {\n    for (const seed of integration.seeds ?? []) {\n      const payload = await postJson(doFetch, `${base}/query`, dbKey, {\n        query: { [seed.ns]: { $: { where: { [seed.key.attr]: seed.key.value }, limit: 1 } } },\n      });\n      const rows = isRecord(payload) && isRecord(payload.result) ? payload.result[seed.ns] : undefined;\n      if (!Array.isArray(rows)) {\n        throw new Error(`${env}: integration ${integration.id} seed ${seed.id} query returned an invalid response`);\n      }\n      if (rows.length > 0) {\n        out.log(`${env}: integration ${integration.id} seed ${seed.id} already exists`);\n        continue;\n      }\n      await postJson(doFetch, `${base}/transact`, dbKey, {\n        mutationId: `integration:${integration.id}:seed:${seed.id}`,\n        ops: [{\n          t: \"update\",\n          ns: seed.ns,\n          // A fresh id plus the declared-unique natural key is create-only: a\n          // concurrent creator gets a unique violation instead of being overwritten.\n          id: uuidv7(),\n          attrs: { ...seed.attrs, [seed.key.attr]: seed.key.value },\n        }],\n      });\n      out.log(`${env}: integration ${integration.id} seed ${seed.id} created`);\n    }\n  }\n}\n\nasync function postJson(doFetch: FetchLike, url: string, bearer: string, body: unknown): Promise<unknown> {\n  const res = await doFetch(url, {\n    method: \"POST\",\n    headers: { authorization: `Bearer ${bearer}`, \"content-type\": \"application/json\" },\n    body: JSON.stringify(body),\n  });\n  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await responseText(res)}`);\n  return res.json().catch(() => ({}));\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nasync function responseText(res: Response): Promise<string> {\n  try {\n    return redactSecrets((await res.text()).slice(0, 500));\n  } catch {\n    return \"\";\n  }\n}\n","import { tenantIdFor } from \"@odla-ai/apps\";\nimport type { LoadedProjectConfig, LocalCredentials } from \"./types\";\nimport { mergeCredential, writePrivateJson } from \"./local\";\nimport { redactSecrets } from \"./redact\";\n\ntype FetchLike = typeof fetch;\n\ninterface ProvisionEnvCredentialsOptions {\n  cfg: LoadedProjectConfig;\n  env: string;\n  developerToken: string;\n  credentials: LocalCredentials | null;\n  rotateDb: boolean;\n  rotateO11y: boolean;\n  write: boolean;\n  fetch: FetchLike;\n  stdout: Pick<typeof console, \"log\">;\n}\n\n/** Mint/reuse only the credentials required by configured services. */\nexport async function provisionEnvCredentials(opts: ProvisionEnvCredentialsOptions): Promise<LocalCredentials> {\n  const tenantId = tenantIdFor(opts.cfg.app.id, opts.env);\n  const prior = opts.credentials?.envs[opts.env];\n  let credentials = opts.credentials;\n  let dbKey = opts.cfg.services.includes(\"db\") && !opts.rotateDb ? prior?.dbKey : undefined;\n  let o11yToken = opts.cfg.services.includes(\"o11y\") && !opts.rotateO11y ? prior?.o11yToken : undefined;\n\n  if (opts.cfg.services.includes(\"db\")) {\n    if (dbKey) {\n      opts.stdout.log(`${opts.env}: reusing local db key for ${tenantId}`);\n    } else {\n      dbKey = await mintDbKey(opts, tenantId);\n      credentials = save(opts, credentials, tenantId, { dbKey });\n      opts.stdout.log(`${opts.env}: minted db key for ${tenantId}`);\n    }\n  }\n\n  if (opts.cfg.services.includes(\"o11y\")) {\n    if (o11yToken) {\n      opts.stdout.log(`${opts.env}: reusing local o11y ingest token`);\n    } else {\n      o11yToken = await issueO11yToken(opts);\n      credentials = save(opts, credentials, tenantId, { ...(dbKey ? { dbKey } : {}), o11yToken });\n      opts.stdout.log(`${opts.env}: ${opts.rotateO11y ? \"rotated\" : \"issued\"} o11y ingest token`);\n    }\n  }\n\n  return save(opts, credentials, tenantId, {\n    ...(dbKey ? { dbKey } : {}),\n    ...(o11yToken ? { o11yToken } : {}),\n  });\n}\n\nfunction save(\n  opts: ProvisionEnvCredentialsOptions,\n  current: LocalCredentials | null,\n  tenantId: string,\n  values: { dbKey?: string; o11yToken?: string },\n): LocalCredentials {\n  const next = mergeCredential(current, {\n    appId: opts.cfg.app.id,\n    platformUrl: opts.cfg.platformUrl,\n    dbEndpoint: opts.cfg.dbEndpoint,\n    env: opts.env,\n    tenantId,\n    ...values,\n  });\n  if (opts.write) writePrivateJson(opts.cfg.local.credentialsFile, next);\n  return next;\n}\n\nasync function mintDbKey(opts: ProvisionEnvCredentialsOptions, tenantId: string): Promise<string> {\n  const headers = { authorization: `Bearer ${opts.developerToken}`, \"content-type\": \"application/json\" };\n  let res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {\n    method: \"POST\",\n    headers,\n    body: \"{}\",\n  });\n  if (res.status === 404) {\n    const created = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify({\n        name: opts.env === \"prod\" ? opts.cfg.app.name : `${opts.cfg.app.name} (${opts.env})`,\n        appId: tenantId,\n      }),\n    });\n    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText(created)}`);\n    res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {\n      method: \"POST\",\n      headers,\n      body: \"{}\",\n    });\n  }\n  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText(res)}`);\n  const body = (await res.json()) as { key?: string };\n  if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);\n  return body.key;\n}\n\nasync function issueO11yToken(opts: ProvisionEnvCredentialsOptions): Promise<string> {\n  const suffix = opts.rotateO11y ? \"/rotate\" : \"\";\n  const res = await opts.fetch(\n    `${opts.cfg.platformUrl}/o11y/${encodeURIComponent(opts.cfg.app.id)}/token${suffix}?env=${encodeURIComponent(opts.env)}`,\n    { method: \"POST\", headers: { authorization: `Bearer ${opts.developerToken}` } },\n  );\n  if (res.status === 409 && !opts.rotateO11y) {\n    throw new Error(\n      `o11y token already exists for env \"${opts.env}\", but its shown-once value is not in the local credentials file; ` +\n      `run \"odla-ai provision --rotate-o11y-token --push-secrets\" to replace it explicitly`,\n    );\n  }\n  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? \"rotation\" : \"issue\"} (${opts.env}) failed: ${res.status} ${await safeText(res)}`);\n  const body = (await res.json()) as { token?: string };\n  if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? \"rotation\" : \"issue\"} (${opts.env}) returned no token`);\n  return body.token;\n}\n\nasync function safeText(res: Response): Promise<string> {\n  try {\n    return redactSecrets((await res.text()).slice(0, 500));\n  } catch {\n    return \"\";\n  }\n}\n","import { DEFAULT_SECRET_NAMES } from \"@odla-ai/ai\";\nimport { tenantIdFor } from \"@odla-ai/apps\";\nimport { envValue } from \"./config\";\nimport { redactSecrets } from \"./redact\";\nimport type { LoadedProjectConfig } from \"./types\";\n\ntype FetchLike = typeof fetch;\n\n/** Deterministic dependency order for platform service enablement. */\nexport function serviceRank(service: string): number {\n  if (service === \"db\") return 0;\n  if (service === \"calendar\") return 2;\n  return 1;\n}\n\n/** Provider vault name, including the stable fallback for custom providers. */\nexport function defaultSecretName(provider: string): string {\n  const names = DEFAULT_SECRET_NAMES as Record<string, string>;\n  return names[provider] ?? `${provider}_api_key`;\n}\n\n/** One cheap ownership-gated db read per tenant. 404 passes — the tenant does\n * not exist yet, and creating it makes the caller its owner. */\nexport async function assertTenantAdminAccess(doFetch: FetchLike, cfg: LoadedProjectConfig, env: string, token: string): Promise<void> {\n  const tenantId = tenantIdFor(cfg.app.id, env);\n  const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/entitlements`, {\n    headers: { authorization: `Bearer ${token}` },\n  });\n  if (res.ok || res.status === 404) return;\n  if (res.status === 403) {\n    throw new Error(\n      `${env}: you are not an owner of \"${cfg.app.id}\" (tenant ${tenantId}) — nothing was minted or written; ` +\n      `ask an existing owner to run \"odla-ai app owners add <your-email>\", then re-run provision`,\n    );\n  }\n  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText(res)}`);\n}\n\nexport async function postJson(doFetch: FetchLike, url: string, bearer: string, body: unknown): Promise<void> {\n  const res = await doFetch(url, {\n    method: \"POST\",\n    headers: { authorization: `Bearer ${bearer}`, \"content-type\": \"application/json\" },\n    body: JSON.stringify(body),\n  });\n  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText(res)}`);\n}\n\n/** Resolve the config's clerk block ($ENV indirection included) or null. */\nexport function normalizeClerkConfig(value: unknown): { publishableKey: string; audience?: string; mode?: \"client\" | \"full\" } | null {\n  if (!value) return null;\n  if (typeof value === \"string\") {\n    const publishableKey = envValue(value);\n    return publishableKey ? { publishableKey } : null;\n  }\n  if (typeof value !== \"object\") return null;\n  const cfg = value as { publishableKey?: string; audience?: string; mode?: \"client\" | \"full\" };\n  const publishableKey = envValue(cfg.publishableKey);\n  return publishableKey ? { publishableKey, ...(cfg.audience ? { audience: cfg.audience } : {}), ...(cfg.mode ? { mode: cfg.mode } : {}) } : null;\n}\n\nasync function safeText(res: Response): Promise<string> {\n  try {\n    return redactSecrets((await res.text()).slice(0, 500));\n  } catch {\n    return \"\";\n  }\n}\n","// What this CLI actually accepts, declared once.\n//\n// Two very different readers need this. Prose — a README, a skill, a runbook —\n// says \"run `odla-ai runbook impact`\", and something has to be able to answer\n// whether that invocation is real. And the dispatchers themselves need to tell a\n// caller what they DO accept when one is not. Deriving either from the other by\n// regex was the status quo, and it only ever validated the first word: every\n// sub-action in the CLI went unchecked, so `runbook imapct` in a runbook read\n// exactly like `runbook impact` to every gate that looked.\n//\n// The dispatch code stays the authority on BEHAVIOUR; this is the authority on\n// the SHAPE, and a test drives every path declared here through the real\n// dispatcher so the two cannot drift apart silently.\n\n/** A node in the invocation tree. An empty node is a leaf: everything after it\n * is arguments, not sub-actions, and is not validated here. */\nexport interface SurfaceNode {\n  readonly [word: string]: SurfaceNode;\n}\n\n/** Actions every PM entity accepts, including the aliases. */\nconst PM_ACTIONS: SurfaceNode = {\n  list: {}, add: {}, create: {}, get: {}, set: {}, update: {}, status: {},\n  move: {}, done: {}, comment: {}, comments: {}, rm: {}, delete: {},\n};\n\n/** The PM entities, each dispatching the same action set. */\nconst PM_ENTITIES: SurfaceNode = Object.fromEntries(\n  [\"goal\", \"conformance\", \"task\", \"kanban\", \"decision\", \"bug\"].map((entity) => [entity, PM_ACTIONS]),\n);\n\n/**\n * Every invocation the CLI dispatches, as a tree of words.\n *\n * Keyed by the word at that position; the value is what may follow it. A leaf\n * (`{}`) means the command takes arguments from there on, so `odla-ai runbook\n * get release` validates `runbook get` and leaves `release` alone.\n */\nexport const COMMAND_SURFACE: SurfaceNode = {\n  agent: { jobs: {}, retry: {} },\n  admin: {\n    ai: {\n      show: {}, set: {}, credentials: {}, models: {}, usage: {}, audit: {},\n      credential: { set: {} },\n    },\n  },\n  app: {\n    archive: {}, restore: {}, export: {}, import: {}, rename: {},\n    \"refresh-sandbox\": {}, \"go-live\": {}, promote: {},\n    owners: { list: {}, add: {}, remove: {} },\n  },\n  calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },\n  capabilities: {},\n  code: { connect: {} },\n  context: { show: {}, list: {}, save: {}, remove: {} },\n  // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.\n  discuss: {\n    groups: {}, list: {}, topics: {}, read: {}, post: {}, reply: {},\n    resolve: {}, who: {}, watch: {},\n  },\n  doctor: {},\n  help: {},\n  init: {},\n  o11y: { status: {} },\n  pm: {\n    ...PM_ENTITIES,\n    handoff: {},\n  },\n  provision: {},\n  runbook: {\n    ask: {}, search: {}, impact: {}, list: {}, get: {}, cat: {}, new: {},\n    edit: {}, comment: {}, import: {}, visibility: {}, publish: {},\n    archive: {}, history: {}, revert: {}, rm: {}, lint: {},\n  },\n  secrets: { push: {}, set: {}, \"set-clerk-key\": {} },\n  security: {\n    plan: {}, sources: {}, run: {}, status: {}, report: {},\n    github: { connect: {}, disconnect: {} },\n  },\n  setup: {},\n  skill: { install: {} },\n  smoke: {},\n  version: {},\n  whoami: {},\n};\n\n/** The words accepted at a path, sorted for stable messages. */\nexport function acceptedAfter(path: readonly string[]): string[] {\n  let node: SurfaceNode | undefined = COMMAND_SURFACE;\n  for (const word of path) {\n    node = node?.[word];\n    if (!node) return [];\n  }\n  return Object.keys(node).sort();\n}\n\n/** One rejected invocation: where it went wrong and what was accepted there. */\nexport interface InvocationProblem {\n  /** The words that were valid, joined — `runbook` for `runbook imapct`. */\n  validPrefix: string;\n  /** The word that was not accepted. */\n  word: string;\n  /** What could have appeared instead. */\n  accepted: string[];\n}\n\n/**\n * Check an invocation's words against the surface.\n *\n * Returns null when the words name a real command path. Validation stops at the\n * first leaf — arguments are not sub-actions — so an unknown *argument* is never\n * reported as an unknown command.\n */\nexport function validateInvocation(words: readonly string[]): InvocationProblem | null {\n  let node: SurfaceNode = COMMAND_SURFACE;\n  const walked: string[] = [];\n  for (const word of words) {\n    if (Object.keys(node).length === 0) return null;\n    const next = node[word];\n    if (!next) return { validPrefix: walked.join(\" \"), word, accepted: Object.keys(node).sort() };\n    walked.push(word);\n    node = next;\n  }\n  return null;\n}\n\n/** Render a problem as the sentence a dispatcher throws, so the message a user\n * sees and the message a gate prints come from the same place. */\nexport function describeProblem(problem: InvocationProblem): string {\n  const where = problem.validPrefix ? `after \"${problem.validPrefix}\"` : \"as a command\";\n  return `\"${problem.word}\" is not accepted ${where} — try: ${problem.accepted.join(\", \")}`;\n}\n\n/**\n * The words of an argv that NAME the command, stopping at the first leaf.\n *\n * `[\"runbook\", \"get\", \"release\"]` → `[\"runbook\", \"get\"]`, because `release` is a\n * slug rather than a sub-action. This is what lets the recorder log which\n * command ran without knowing anything about that command's arguments.\n */\nexport function invocationPath(words: readonly string[]): string[] {\n  let node: SurfaceNode = COMMAND_SURFACE;\n  const path: string[] = [];\n  for (const word of words) {\n    const next: SurfaceNode | undefined = node[word];\n    if (!next) break;\n    path.push(word);\n    node = next;\n    if (Object.keys(node).length === 0) break;\n  }\n  return path;\n}\n\n/** Every complete path through the surface, as word arrays. Used by the test\n * that drives each one through the real dispatcher, and by the published-surface\n * gate to know what a version is expected to carry. */\nexport function surfacePaths(node: SurfaceNode = COMMAND_SURFACE, prefix: readonly string[] = []): string[][] {\n  const paths: string[][] = [];\n  for (const [word, child] of Object.entries(node)) {\n    const path = [...prefix, word];\n    paths.push(path);\n    paths.push(...surfacePaths(child, path));\n  }\n  return paths;\n}\n","import { isAbsolute, relative, resolve, sep } from \"node:path\";\nimport {\n  cloudflareAppProfile,\n  createPlatformSecurityReasoners,\n  createSecurityHarness,\n  genericProfile,\n  odlaProfile,\n  securityFingerprint,\n  type PlatformSecurityRun,\n  type SecurityProfile,\n  type SecurityReport,\n  type SecurityRoleCallBudgetUsage,\n} from \"@odla-ai/security\";\nimport { FileRunStore, snapshotDirectory, writeSecurityArtifacts } from \"@odla-ai/security/node\";\nimport { loadProjectConfig } from \"./config\";\n\n/** Built-in security coverage profile selected for a hosted reasoning run. */\nexport type HostedSecurityProfile = \"odla\" | \"cloudflare-app\" | \"generic\";\n\n/** Exact attribution and authorization need supplied to a lazy token callback. */\nexport interface HostedSecurityTokenRequest {\n  platform: string;\n  appId: string;\n  env: string;\n  selfAudit: boolean;\n  /** Self-audit asks the caller for an explicitly scoped platform credential. */\n  /** Ordinary app runs use owner authority and therefore request no platform scope. */\n  scope: \"platform:security:self\" | null;\n}\n\n/** Local snapshot/orchestration controls for an app-attributed hosted security\n * run. The platform supplies model routes and provider credentials. */\nexport interface RunHostedSecurityOptions {\n  /** Project config; loaded for customer-app runs and ignored for self-audit. */\n  configPath?: string;\n  /** Scan odla itself under the protected odla-ai/prod identity. */\n  selfAudit?: boolean;\n  /** Repository directory to snapshot. Defaults to the config root or cwd for self-audit. */\n  target?: string;\n  /** Private artifact directory. Defaults to `<target>/.odla/security/hosted`. */\n  out?: string;\n  /** Customer environment. Must be declared in config. Self-audit always uses prod. */\n  env?: string;\n  profile?: HostedSecurityProfile;\n  maxHuntTasks?: number;\n  /** Exact acknowledgement required before any source capture or network call. */\n  sourceDisclosureAck?: \"redacted\";\n  /** Optional client correlation id; the platform returns the authoritative run id. */\n  runId?: string;\n  /** Platform override. Customer runs otherwise use config.platformUrl. */\n  platform?: string;\n  /** Injected app credential; for self-audit this must be explicitly scoped by the caller. */\n  token?: string;\n  /** Lazy token acquisition. Receives the exact app/env and required scope. */\n  getToken?: (request: HostedSecurityTokenRequest) => string | Promise<string>;\n  fetch?: typeof fetch;\n  signal?: AbortSignal;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/** Completed local report, public platform run metadata, and private artifact path. */\nexport interface HostedSecurityResult {\n  report: SecurityReport;\n  run: Readonly<PlatformSecurityRun>;\n  output: string;\n}\n\n/**\n * Run the hosted, redacted-source security harness for an odla app or odla's\n * protected self-audit identity. Provider/model selection and provider secrets\n * remain platform-owned; this function accepts only an app/scoped bearer and\n * the opaque role grants remain inside @odla-ai/security's reasoner closures.\n */\nexport async function runHostedSecurity(options: RunHostedSecurityOptions): Promise<HostedSecurityResult> {\n  if (options.sourceDisclosureAck !== \"redacted\") {\n    throw new Error(\"Hosted security requires sourceDisclosureAck=redacted before repository source may leave this process\");\n  }\n\n  const selfAudit = options.selfAudit === true;\n  const cfg = selfAudit ? undefined : await loadProjectConfig(options.configPath ?? \"odla.config.mjs\");\n  const appId = selfAudit ? \"odla-ai\" : cfg!.app.id;\n  const env = selfAudit ? \"prod\" : selectEnv(options.env, cfg!.envs, cfg!.configPath, cfg!.rootDir);\n  const platform = options.platform ?? cfg?.platformUrl ?? \"https://odla.ai\";\n  const target = resolve(options.target ?? cfg?.rootDir ?? \".\");\n  const output = resolve(options.out ?? resolve(target, \".odla/security/hosted\"));\n  const outputRelative = relative(target, output).split(sep).join(\"/\");\n  if (!outputRelative) throw new Error(\"Hosted security output cannot be the repository root\");\n  // This is the desired first-pass ceiling. The hosted reasoner's immutable\n  // call budget automatically reserves recon, caps hunts, then funds retries.\n  const profile = profileFor(options.profile ?? \"odla\", options.maxHuntTasks ?? 12);\n\n  const tokenRequest: HostedSecurityTokenRequest = {\n    platform,\n    appId,\n    env,\n    selfAudit,\n    scope: selfAudit ? \"platform:security:self\" : null,\n  };\n  const token = await injectedToken(options, tokenRequest);\n  const snapshot = await snapshotDirectory(target, {\n    exclude: !outputRelative.startsWith(\"../\") && !isAbsolute(outputRelative) ? [outputRelative] : [],\n  });\n  const hosted = await createPlatformSecurityReasoners({\n    platform,\n    token,\n    appId,\n    env,\n    repository: snapshot.repository,\n    revision: snapshot.revision,\n    snapshotDigest: snapshot.digest,\n    sourceDisclosure: \"redacted\",\n    clientRunId: options.runId ?? crypto.randomUUID(),\n    ...(selfAudit ? { selfAudit: { enabled: true as const, subject: \"service:odla-security-self-audit\" } } : {}),\n    fetch: options.fetch,\n    signal: options.signal,\n  });\n  const harness = createSecurityHarness({\n    profile,\n    store: new FileRunStore(resolve(output, \"state\")),\n    discoveryReasoner: hosted.discoveryReasoner,\n    validationReasoner: hosted.validationReasoner,\n    policy: {\n      modelSourceDisclosure: \"redacted\",\n      active: false,\n      allowNetwork: false,\n    },\n  });\n  const report = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });\n  await writeSecurityArtifacts(output, report);\n  const reportDigest = await securityFingerprint(report);\n  await hosted.complete({\n    reportDigest,\n    coverageStatus: report.coverageStatus,\n    confirmed: report.metrics.confirmed,\n    candidates: report.metrics.candidates,\n  }, { signal: options.signal });\n  printSummary(options.stdout ?? console, appId, env, hosted.run, report, output);\n  return Object.freeze({ report, run: hosted.run, output });\n}\n\nfunction selectEnv(requested: string | undefined, declared: string[], configPath: string, rootDir: string): string {\n  const env = requested ?? (declared.includes(\"dev\") ? \"dev\" : declared[0]);\n  if (!env || !declared.includes(env)) {\n    const shown = relative(rootDir, configPath) || configPath;\n    throw new Error(`env \"${env ?? \"\"}\" is not declared in ${shown}`);\n  }\n  return env;\n}\n\nasync function injectedToken(options: RunHostedSecurityOptions, request: HostedSecurityTokenRequest): Promise<string> {\n  const value = options.token ?? await options.getToken?.(Object.freeze({ ...request }));\n  if (typeof value !== \"string\" || value.length < 8 || value.length > 8_192 || /\\s|[\\u0000-\\u001f\\u007f]/.test(value)) {\n    throw new Error(\n      request.selfAudit\n        ? \"Self-audit requires an injected, scoped platform security token\"\n        : \"Hosted security requires an injected app developer token or getToken callback\",\n    );\n  }\n  return value;\n}\n\nfunction profileFor(name: HostedSecurityProfile, maxHuntTasks: number | undefined): SecurityProfile {\n  const profile = name === \"odla\"\n    ? odlaProfile()\n    : name === \"cloudflare-app\"\n      ? cloudflareAppProfile()\n      : name === \"generic\"\n        ? genericProfile()\n        : undefined;\n  if (!profile) throw new Error(`unknown security profile \"${String(name)}\"`);\n  if (maxHuntTasks === undefined) return profile;\n  if (!Number.isSafeInteger(maxHuntTasks) || maxHuntTasks < 1) throw new Error(\"maxHuntTasks must be a positive integer\");\n  return { ...profile, maxHuntTasks };\n}\n\nfunction printSummary(\n  out: Pick<typeof console, \"log\" | \"error\">,\n  appId: string,\n  env: string,\n  run: Readonly<PlatformSecurityRun>,\n  report: SecurityReport,\n  output: string,\n): void {\n  const complete = report.coverage.filter((cell) => cell.state === \"complete\").length;\n  out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);\n  out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);\n  out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);\n  out.log(`  coverage: ${report.coverageStatus} ${complete}/${report.coverage.length} blocked=${report.metrics.blockedCells} shallow=${report.metrics.shallowCells} unscheduled=${report.metrics.unscheduledCells} budget_exhausted=${report.metrics.budgetExhaustedCells}`);\n  if (report.callBudget) out.log(`  calls: discovery=${formatBudget(report.callBudget.discovery)} validation=${formatBudget(report.callBudget.validation)}`);\n  out.log(`  findings: confirmed=${report.metrics.confirmed} needs_reproduction=${report.metrics.needsReproduction} candidates=${report.metrics.candidates}`);\n  out.log(`  report: ${resolve(output, \"REPORT.md\")}`);\n}\n\nfunction formatBudget(usage: SecurityRoleCallBudgetUsage | undefined): string {\n  return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : \"caller-managed\";\n}\n","import {\n  hostedIdentifier,\n  isValidHostedSecurityPlan,\n  optionalHostedText,\n  requestHostedSecurityJson,\n} from \"./security-hosted-request\";\nimport type {\n  GetHostedSecurityIntentOptions,\n  HostedSecurityIntent,\n  HostedSecurityIntentResponse,\n} from \"./security-hosted-types\";\n\n/** Fetch the atomic processing-plan and source/ref/profile execution preview. */\nexport async function getHostedSecurityIntent(\n  options: GetHostedSecurityIntentOptions,\n): Promise<HostedSecurityIntentResponse> {\n  const appId = hostedIdentifier(options.appId, \"appId\");\n  const env = hostedIdentifier(options.env, \"env\");\n  const sourceId = hostedIdentifier(options.sourceId, \"sourceId\");\n  const ref = optionalHostedText(options.ref, \"ref\", 255);\n  const query = new URLSearchParams({ env, sourceId });\n  if (ref) query.set(\"ref\", ref);\n  if (options.profile) query.set(\"profile\", options.profile);\n  const response = await requestHostedSecurityJson<HostedSecurityIntentResponse>(\n    options,\n    `/registry/apps/${encodeURIComponent(appId)}/security/intent?${query.toString()}`,\n    {},\n    \"read hosted security execution intent\",\n  );\n  if (!isValidHostedSecurityPlan(response.plan, env)\n      || !isValidIntent(response.intent, { appId, env, sourceId })) {\n    throw new Error(\"odla.ai returned an invalid hosted security execution intent\");\n  }\n  if (response.intent.planDigest !== response.plan.planDigest) {\n    throw new Error(\"odla.ai returned a hosted security intent for a different processing plan\");\n  }\n  return response;\n}\n\nfunction isValidIntent(\n  value: HostedSecurityIntent | undefined,\n  expected: { appId: string; env: string; sourceId: string },\n): value is HostedSecurityIntent {\n  return !!value\n    && value.executionContract === \"odla.hosted-security-execution-consent.v1\"\n    && /^sha256:[a-f0-9]{64}$/.test(value.executionDigest)\n    && /^sha256:[a-f0-9]{64}$/.test(value.planDigest)\n    && value.appId === expected.appId && value.env === expected.env && value.sourceId === expected.sourceId\n    && typeof value.repository === \"string\" && value.repository.length > 2 && value.repository.length <= 201\n    && typeof value.defaultBranch === \"string\" && value.defaultBranch.length > 0 && value.defaultBranch.length <= 255\n    && typeof value.requestedRef === \"string\" && value.requestedRef.length > 0\n    && value.requestedRef.length <= 255 && !/[\\u0000-\\u001f\\u007f]/.test(value.requestedRef)\n    && [\"odla\", \"cloudflare-app\", \"generic\"].includes(value.profile)\n    && value.sourceDisclosure === \"redacted\";\n}\n","import {\n  hostedIdentifier,\n  hostedPollInterval,\n  hostedPollTimeout,\n  isValidHostedSecurityPlan,\n  optionalHostedText,\n  positivePolicyVersion,\n  requestHostedSecurityJson,\n  waitForHostedPoll,\n} from \"./security-hosted-request\";\nimport type {\n  FollowHostedSecurityJobOptions,\n  GetHostedSecurityJobOptions,\n  HostedSecurityJob,\n  HostedSecurityJobStatus,\n  HostedSecurityPlan,\n  HostedSecurityReport,\n  ListGitHubSecuritySourcesOptions,\n  ListHostedSecurityJobsOptions,\n  StartHostedSecurityJobOptions,\n} from \"./security-hosted-types\";\n\n/** Read the admin-selected routes, budgets, readiness, disclosure boundary,\n * and digest that must be acknowledged when a hosted review is enqueued. */\nexport async function getHostedSecurityPlan(\n  options: ListGitHubSecuritySourcesOptions,\n): Promise<HostedSecurityPlan> {\n  const appId = hostedIdentifier(options.appId, \"appId\");\n  const env = hostedIdentifier(options.env, \"env\");\n  const plan = await requestHostedSecurityJson<HostedSecurityPlan>(\n    options,\n    `/registry/apps/${encodeURIComponent(appId)}/security/plan?env=${encodeURIComponent(env)}`,\n    {},\n    \"read hosted security disclosure plan\",\n  );\n  if (!isValidHostedSecurityPlan(plan, env)) {\n    throw new Error(\"odla.ai returned an invalid hosted security disclosure plan\");\n  }\n  return plan;\n}\n\n/** Enqueue a commit-pinned server-side review. The server resolves sourceId to\n * its saved GitHub App installation; clients cannot choose an installation or\n * pass a PAT. */\nexport async function startHostedSecurityJob(\n  options: StartHostedSecurityJobOptions,\n): Promise<HostedSecurityJob> {\n  if (options.sourceDisclosureAck !== \"redacted\") {\n    throw new Error(\"Hosted GitHub security requires sourceDisclosureAck=redacted; repository access alone is not disclosure consent\");\n  }\n  const appId = hostedIdentifier(options.appId, \"appId\");\n  const env = hostedIdentifier(options.env, \"env\");\n  const sourceId = hostedIdentifier(options.sourceId, \"sourceId\");\n  const ref = optionalHostedText(options.ref, \"ref\", 255);\n  const expectedPlanDigest = securityPlanDigest(options.expectedPlanDigest);\n  const expectedExecutionDigest = securityExecutionDigest(options.expectedExecutionDigest);\n  const expectedPolicyVersions = {\n    discovery: positivePolicyVersion(\n      options.expectedPolicyVersions?.discovery,\n      \"expected discovery policy version\",\n    ),\n    validation: positivePolicyVersion(\n      options.expectedPolicyVersions?.validation,\n      \"expected validation policy version\",\n    ),\n  };\n  let body: { job: HostedSecurityJob };\n  try {\n    body = await requestHostedSecurityJson<{ job: HostedSecurityJob }>(\n      options,\n      `/registry/apps/${encodeURIComponent(appId)}/security/jobs`,\n      {\n        method: \"POST\",\n        body: JSON.stringify({\n          env,\n          sourceId,\n          ...(ref ? { ref } : {}),\n          ...(options.profile ? { profile: options.profile } : {}),\n          ...(options.clientRequestId\n            ? { clientRequestId: hostedIdentifier(options.clientRequestId, \"clientRequestId\") }\n            : {}),\n          sourceDisclosure: \"redacted\",\n          expectedPlanDigest,\n          expectedExecutionDigest,\n          expectedPolicyVersions,\n        }),\n      },\n      \"start hosted security job\",\n    );\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    if (/\\b(?:plan_conflict|policy_conflict|intent_conflict|security_ai_not_ready)\\b/.test(message)) {\n      throw new Error(\"Hosted security plan or execution intent changed or became unavailable after review; fetch a fresh intent and explicitly acknowledge its digest before enqueueing again\", { cause: error });\n    }\n    throw error;\n  }\n  if (!body.job?.jobId) {\n    throw new Error(\"odla.ai returned an invalid hosted security job\");\n  }\n  return body.job;\n}\n\n/** Read one bounded hosted job status without an archive or explicit source excerpt. */\nexport async function getHostedSecurityJob(\n  options: GetHostedSecurityJobOptions,\n): Promise<HostedSecurityJob> {\n  const body = await requestHostedSecurityJson<{ job: HostedSecurityJob }>(\n    options,\n    hostedJobPath(options.appId, options.jobId),\n    {},\n    \"read hosted security job\",\n  );\n  if (!body.job?.jobId) throw new Error(\"odla.ai returned an invalid hosted security job\");\n  return body.job;\n}\n\n/** List bounded, newest-first job metadata for an app environment. */\nexport async function listHostedSecurityJobs(\n  options: ListHostedSecurityJobsOptions,\n): Promise<HostedSecurityJob[]> {\n  const appId = hostedIdentifier(options.appId, \"appId\");\n  const env = hostedIdentifier(options.env, \"env\");\n  const body = await requestHostedSecurityJson<{ jobs: HostedSecurityJob[] }>(\n    options,\n    `/registry/apps/${encodeURIComponent(appId)}/security/jobs?env=${encodeURIComponent(env)}`,\n    {},\n    \"list hosted security jobs\",\n  );\n  return Array.isArray(body.jobs) ? body.jobs : [];\n}\n\n/** Poll one exact job until it reaches a terminal state. */\nexport async function followHostedSecurityJob(\n  options: FollowHostedSecurityJobOptions,\n): Promise<HostedSecurityJob> {\n  const interval = hostedPollInterval(options.pollIntervalMs);\n  const now = options.now ?? Date.now;\n  const deadline = now() + hostedPollTimeout(options.pollTimeoutMs ?? 60 * 60_000);\n  const wait = options.wait ?? waitForHostedPoll;\n  let prior = \"\";\n  while (true) {\n    const job = await getHostedSecurityJob(options);\n    const fingerprint = `${job.status}:${job.updatedAt}`;\n    if (fingerprint !== prior) options.onUpdate?.(Object.freeze({ ...job }));\n    prior = fingerprint;\n    if (isTerminalHostedSecurityStatus(job.status)) return job;\n    if (now() >= deadline) {\n      throw new Error(`Hosted security job ${job.jobId} did not finish before the polling deadline`);\n    }\n    await wait(Math.min(interval, Math.max(0, deadline - now())), options.signal);\n  }\n}\n\n/** Fetch the bounded normalized report projection for a completed hosted job. */\nexport async function getHostedSecurityReport(\n  options: GetHostedSecurityJobOptions,\n): Promise<HostedSecurityReport> {\n  return requestHostedSecurityJson<HostedSecurityReport>(\n    options,\n    `${hostedJobPath(options.appId, options.jobId)}/report`,\n    {},\n    \"read hosted security report\",\n  );\n}\n\n/** Return whether a hosted job status can no longer transition. */\nexport function isTerminalHostedSecurityStatus(\n  status: HostedSecurityJobStatus,\n): boolean {\n  return status === \"completed\" || status === \"failed\" || status === \"cancelled\";\n}\n\nfunction hostedJobPath(appIdInput: string, jobIdInput: string): string {\n  const appId = hostedIdentifier(appIdInput, \"appId\");\n  const jobId = hostedIdentifier(jobIdInput, \"jobId\");\n  return `/registry/apps/${encodeURIComponent(appId)}/security/jobs/${encodeURIComponent(jobId)}`;\n}\n\nfunction securityPlanDigest(value: string): `sha256:${string}` {\n  if (!/^sha256:[a-f0-9]{64}$/.test(value)) {\n    throw new Error(\"expected plan digest must be a sha256 digest from security plan\");\n  }\n  return value as `sha256:${string}`;\n}\n\nfunction securityExecutionDigest(value: string): `sha256:${string}` {\n  if (!/^sha256:[a-f0-9]{64}$/.test(value)) {\n    throw new Error(\"expected execution digest must be a sha256 digest from security intent\");\n  }\n  return value as `sha256:${string}`;\n}\n","export type OptionValue = string | boolean | string[];\n\nexport interface ParsedArgv {\n  positionals: string[];\n  options: Record<string, OptionValue>;\n}\n\n/** Parse the small, dependency-free option grammar shared by every CLI command. */\nexport function parseArgv(argv: string[]): ParsedArgv {\n  const positionals: string[] = [];\n  const options: Record<string, OptionValue> = {};\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i]!;\n    if (!arg.startsWith(\"--\")) {\n      positionals.push(arg);\n      continue;\n    }\n    const eq = arg.indexOf(\"=\");\n    const rawName = arg.slice(2, eq === -1 ? undefined : eq);\n    if (!rawName) continue;\n    if (rawName.startsWith(\"no-\")) {\n      options[rawName.slice(3)] = false;\n      continue;\n    }\n    if (eq !== -1) {\n      addOption(options, rawName, arg.slice(eq + 1));\n      continue;\n    }\n    const value = argv[i + 1];\n    if (value !== undefined && !value.startsWith(\"--\")) {\n      i++;\n      addOption(options, rawName, value);\n    } else {\n      addOption(options, rawName, true);\n    }\n  }\n  return { positionals, options };\n}\n\nexport function assertArgs(parsed: ParsedArgv, allowedOptions: string[], maxPositionals: number): void {\n  const allowed = new Set(allowedOptions);\n  for (const name of Object.keys(parsed.options)) {\n    if (!allowed.has(name)) throw new Error(`unknown option \"--${name}\"; run \"odla-ai help\" for supported options`);\n  }\n  if (parsed.positionals.length > maxPositionals) {\n    throw new Error(`unexpected argument \"${parsed.positionals[maxPositionals]}\"; run \"odla-ai help\"`);\n  }\n}\n\nexport function requiredString(value: OptionValue | undefined, name: string): string {\n  const result = stringOpt(value);\n  if (!result) throw new Error(`${name} is required`);\n  return result;\n}\n\nexport function stringOpt(value: OptionValue | undefined): string | undefined {\n  if (typeof value === \"string\") return value;\n  if (Array.isArray(value)) return value[value.length - 1];\n  return undefined;\n}\n\nexport function listOpt(value: OptionValue | undefined): string[] | undefined {\n  if (value === undefined || typeof value === \"boolean\") return undefined;\n  const values = Array.isArray(value) ? value : [value];\n  return values.flatMap((item) => item.split(\",\")).map((item) => item.trim()).filter(Boolean);\n}\n\nexport function boolOpt(value: OptionValue | undefined): boolean | undefined {\n  if (typeof value === \"boolean\") return value;\n  if (typeof value === \"string\" && (value === \"true\" || value === \"false\")) return value === \"true\";\n  if (value === undefined) return undefined;\n  throw new Error(\"boolean option must be true or false\");\n}\n\nexport function numberOpt(value: OptionValue | undefined, flag: string): number | undefined {\n  if (value === undefined) return undefined;\n  const raw = stringOpt(value);\n  const parsed = raw === undefined ? Number.NaN : Number(raw);\n  if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${flag} requires a positive integer`);\n  return parsed;\n}\n\nfunction addOption(options: Record<string, OptionValue>, name: string, value: string | boolean): void {\n  const current = options[name];\n  if (current === undefined) options[name] = value;\n  else if (Array.isArray(current)) current.push(String(value));\n  else options[name] = [String(current), String(value)];\n}\n","import { existsSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport process from \"node:process\";\nimport { stringOpt, type ParsedArgv } from \"./argv\";\nimport { loadProjectConfig } from \"./config\";\nimport {\n  assertOperatorName,\n  operatorCredentialFiles,\n  resolveOperatorProfile,\n} from \"./operator-profiles\";\nimport { platformAudience } from \"./token\";\nimport type { LoadedProjectConfig } from \"./types\";\n\nconst DEFAULT_PLATFORM = \"https://odla.ai\";\n\nexport type ContextSource =\n  | \"flag\"\n  | \"environment\"\n  | \"profile\"\n  | \"config\"\n  | \"default\"\n  | \"unresolved\";\n\nexport interface ResolvedOperatorContext {\n  cfg: LoadedProjectConfig;\n  profile: {\n    name: string | null;\n    source: \"flag\" | \"environment\" | \"unresolved\";\n    file: string;\n  };\n  config: {\n    path: string;\n    status: \"loaded\" | \"absent\";\n    explicit: boolean;\n  };\n  platform: {\n    value: string;\n    source: Exclude<ContextSource, \"unresolved\">;\n  };\n  app: {\n    value: string | null;\n    source: ContextSource;\n  };\n  environment: {\n    value: string | null;\n    source: ContextSource;\n  };\n  credentials: {\n    developerTokenFile: string;\n    scopedTokenFile: string;\n  };\n}\n\ninterface ResolveOperatorContextOptions {\n  /** Permit an operator read to run without a project config. */\n  allowMissingConfig?: boolean;\n  /** Command-specific environment default; omitted when the command is global. */\n  defaultEnvironment?: string;\n  /** Refuse an unresolved app instead of silently selecting one. */\n  requireApp?: boolean;\n}\n\n/**\n * Resolve operator command context without using authentication as discovery.\n *\n * Explicit flags and matching ODLA_* variables win, followed by an explicitly\n * selected non-secret profile and then project config. Profiles never become\n * ambient defaults and have isolated private credential caches. The returned\n * provenance powers `context show`; this function never starts a handshake.\n */\nexport async function resolveOperatorContext(\n  parsed: ParsedArgv,\n  options: ResolveOperatorContextOptions = {},\n): Promise<ResolvedOperatorContext> {\n  const profile = resolveOperatorProfile(parsed);\n  const configArgument =\n    stringOpt(parsed.options.config) ?? \"odla.config.mjs\";\n  const configPath = resolve(configArgument);\n  const explicitConfig = parsed.options.config !== undefined;\n  const hasConfig = existsSync(configPath);\n  if (!hasConfig && (!options.allowMissingConfig || explicitConfig)) {\n    await loadProjectConfig(configArgument);\n  }\n  const loaded = hasConfig\n    ? await loadProjectConfig(configArgument)\n    : undefined;\n\n  const platformFlag = clean(stringOpt(parsed.options.platform));\n  const platformEnvironment = clean(process.env.ODLA_PLATFORM_URL);\n  const platformValue = platformAudience(\n    platformFlag ??\n      platformEnvironment ??\n      profile.value?.platform ??\n      loaded?.platformUrl ??\n      DEFAULT_PLATFORM,\n  );\n  const platformSource: ResolvedOperatorContext[\"platform\"][\"source\"] =\n    platformFlag\n      ? \"flag\"\n      : platformEnvironment\n        ? \"environment\"\n        : profile.value\n          ? \"profile\"\n          : loaded\n            ? \"config\"\n            : \"default\";\n\n  const appFlag = clean(stringOpt(parsed.options.app));\n  const appEnvironment = clean(process.env.ODLA_APP_ID);\n  const appValue =\n    appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;\n  const appSource: ContextSource = appFlag\n    ? \"flag\"\n    : appEnvironment\n      ? \"environment\"\n      : profile.value?.app\n        ? \"profile\"\n        : loaded\n          ? \"config\"\n          : \"unresolved\";\n  if (appValue) assertOperatorName(appValue, \"app\");\n  if (options.requireApp && !appValue) {\n    throw new Error(\n      'app context is unresolved; pass --app <id>, set ODLA_APP_ID, select --context <name>, or run inside a project with odla.config.mjs',\n    );\n  }\n\n  const envFlag = clean(stringOpt(parsed.options.env));\n  const envEnvironment = clean(process.env.ODLA_ENV);\n  const environmentValue =\n    envFlag ??\n    envEnvironment ??\n    profile.value?.environment ??\n    options.defaultEnvironment ??\n    null;\n  const environmentSource: ContextSource = envFlag\n    ? \"flag\"\n    : envEnvironment\n      ? \"environment\"\n      : profile.value?.environment\n        ? \"profile\"\n        : options.defaultEnvironment\n          ? \"default\"\n          : \"unresolved\";\n  if (environmentValue) {\n    assertOperatorName(environmentValue, \"environment\");\n  }\n\n  const rootDir = loaded?.rootDir ?? process.cwd();\n  const profileCredentials = operatorCredentialFiles(profile);\n  const tokenFile = clean(process.env.ODLA_DEV_TOKEN_FILE)\n    ? resolve(process.env.ODLA_DEV_TOKEN_FILE!)\n    : profile.name\n      ? profileCredentials.developer\n      : loaded?.local.tokenFile ?? profileCredentials.developer;\n  const scopedTokenFile = clean(process.env.ODLA_ADMIN_TOKEN_FILE)\n    ? resolve(process.env.ODLA_ADMIN_TOKEN_FILE!)\n    : profile.name\n      ? profileCredentials.scoped\n      : loaded\n        ? join(loaded.rootDir, \".odla\", \"admin-token.local.json\")\n        : profileCredentials.scoped;\n  const cfg: LoadedProjectConfig =\n    loaded\n      ? {\n          ...loaded,\n          platformUrl: platformValue,\n          app: appValue\n            ? {\n                id: appValue,\n                name:\n                  appValue === loaded.app.id ? loaded.app.name : appValue,\n              }\n            : loaded.app,\n          local: { ...loaded.local, tokenFile },\n        }\n      : {\n          configPath,\n          rootDir,\n          platformUrl: platformValue,\n          dbEndpoint: platformValue,\n          app: {\n            id: appValue ?? \"operator\",\n            name: appValue ?? \"Operator\",\n          },\n          envs: environmentValue ? [environmentValue] : [],\n          services: [],\n          local: {\n            tokenFile,\n            credentialsFile: join(rootDir, \".odla\", \"credentials.local.json\"),\n            devVarsFile: join(rootDir, \".dev.vars\"),\n            gitignore: true,\n          },\n        };\n\n  return {\n    cfg,\n    profile: {\n      name: profile.name,\n      source: profile.source,\n      file: profile.file,\n    },\n    config: {\n      path: configPath,\n      status: loaded ? \"loaded\" : \"absent\",\n      explicit: explicitConfig,\n    },\n    platform: { value: platformValue, source: platformSource },\n    app: { value: appValue, source: appSource },\n    environment: {\n      value: environmentValue,\n      source: environmentSource,\n    },\n    credentials: {\n      developerTokenFile: tokenFile,\n      scopedTokenFile,\n    },\n  };\n}\n\nfunction clean(value: string | undefined): string | undefined {\n  const normalized = value?.trim();\n  return normalized || undefined;\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join, resolve } from \"node:path\";\nimport process from \"node:process\";\nimport { stringOpt, type ParsedArgv } from \"./argv\";\nimport { writePrivateJson } from \"./local\";\nimport { platformAudience } from \"./token\";\n\nexport interface OperatorProfile {\n  platform: string;\n  app?: string;\n  environment?: string;\n}\n\nexport interface OperatorProfileSelection {\n  name: string | null;\n  source: \"flag\" | \"environment\" | \"unresolved\";\n  file: string;\n  value: OperatorProfile | null;\n}\n\ninterface OperatorProfileFile {\n  schemaVersion: 1;\n  profiles: Record<string, OperatorProfile>;\n}\n\n/** Resolve the non-secret operator-profile file without reading credentials. */\nexport function operatorProfileFile(): string {\n  return resolve(\n    clean(process.env.ODLA_CONTEXT_FILE) ??\n      join(homedir(), \".odla\", \"contexts.json\"),\n  );\n}\n\n/** Resolve an explicitly selected named profile, failing closed when absent. */\nexport function resolveOperatorProfile(\n  parsed: ParsedArgv,\n): OperatorProfileSelection {\n  const fromFlag = clean(stringOpt(parsed.options.context));\n  const fromEnvironment = clean(process.env.ODLA_CONTEXT);\n  const name = fromFlag ?? fromEnvironment ?? null;\n  const file = operatorProfileFile();\n  if (!name) {\n    return { name: null, source: \"unresolved\", file, value: null };\n  }\n  assertOperatorName(name, \"context\");\n  const profiles = readOperatorProfiles(file);\n  const value = Object.hasOwn(profiles, name) ? profiles[name]! : undefined;\n  if (!value) {\n    throw new Error(\n      `operator context \"${name}\" not found in ${file}; run \"odla-ai context list\" or save it first`,\n    );\n  }\n  return {\n    name,\n    source: fromFlag ? \"flag\" : \"environment\",\n    file,\n    value,\n  };\n}\n\n/** List validated named profiles in deterministic name order. */\nexport function listOperatorProfiles(\n  file = operatorProfileFile(),\n): Array<{ name: string } & OperatorProfile> {\n  return Object.entries(readOperatorProfiles(file))\n    .sort(([a], [b]) => a.localeCompare(b))\n    .map(([name, profile]) => ({ name, ...profile }));\n}\n\n/** Save one non-secret named profile in a mode-0600 metadata file. */\nexport function saveOperatorProfile(\n  name: string,\n  profile: OperatorProfile,\n  file = operatorProfileFile(),\n): void {\n  assertOperatorName(name, \"context\");\n  const normalized = validateProfile(profile, `operator context \"${name}\"`);\n  const profiles = readOperatorProfiles(file);\n  profiles[name] = normalized;\n  writePrivateJson(file, { schemaVersion: 1, profiles });\n}\n\n/** Remove one named profile; credential caches remain separately revocable. */\nexport function removeOperatorProfile(\n  name: string,\n  file = operatorProfileFile(),\n): boolean {\n  assertOperatorName(name, \"context\");\n  const profiles = readOperatorProfiles(file);\n  if (!Object.hasOwn(profiles, name)) return false;\n  delete profiles[name];\n  writePrivateJson(file, { schemaVersion: 1, profiles });\n  return true;\n}\n\n/** Private cache paths isolated by selected profile, or global by default. */\nexport function operatorCredentialFiles(\n  selection: OperatorProfileSelection,\n): { developer: string; scoped: string } {\n  const base = selection.name\n    ? join(dirname(selection.file), \"profiles\", selection.name)\n    : join(homedir(), \".odla\");\n  return {\n    developer: join(base, \"dev-token.json\"),\n    scoped: join(base, \"admin-token.local.json\"),\n  };\n}\n\nexport function assertOperatorName(value: string, label: string): void {\n  if (!/^[a-z0-9][a-z0-9-]*$/.test(value)) {\n    throw new Error(\n      `${label} must contain lowercase letters, numbers, and hyphens`,\n    );\n  }\n}\n\nfunction readOperatorProfiles(file: string): Record<string, OperatorProfile> {\n  if (!existsSync(file)) return emptyProfiles();\n  let raw: unknown;\n  try {\n    raw = JSON.parse(readFileSync(file, \"utf8\"));\n  } catch {\n    throw new Error(`operator context file ${file} is not valid JSON`);\n  }\n  if (\n    !raw ||\n    typeof raw !== \"object\" ||\n    (raw as Partial<OperatorProfileFile>).schemaVersion !== 1 ||\n    !(raw as Partial<OperatorProfileFile>).profiles ||\n    typeof (raw as Partial<OperatorProfileFile>).profiles !== \"object\" ||\n    Array.isArray((raw as Partial<OperatorProfileFile>).profiles)\n  ) {\n    throw new Error(`operator context file ${file} has an invalid shape`);\n  }\n  const unknown = Object.keys(raw).filter(\n    (key) => ![\"schemaVersion\", \"profiles\"].includes(key),\n  );\n  if (unknown.length > 0) {\n    throw new Error(\n      `operator context file ${file} contains unsupported field(s): ${unknown.sort().join(\", \")}`,\n    );\n  }\n  const profiles = emptyProfiles();\n  for (const [name, value] of Object.entries(\n    (raw as OperatorProfileFile).profiles,\n  )) {\n    assertOperatorName(name, \"context\");\n    profiles[name] = validateProfile(value, `operator context \"${name}\"`);\n  }\n  return profiles;\n}\n\nfunction emptyProfiles(): Record<string, OperatorProfile> {\n  return Object.create(null) as Record<string, OperatorProfile>;\n}\n\nfunction validateProfile(value: unknown, label: string): OperatorProfile {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new Error(`${label} has an invalid shape`);\n  }\n  const unknown = Object.keys(value).filter(\n    (key) => ![\"platform\", \"app\", \"environment\"].includes(key),\n  );\n  if (unknown.length > 0) {\n    throw new Error(\n      `${label} contains unsupported field(s): ${unknown.sort().join(\", \")}; contexts store scope metadata only, never credentials`,\n    );\n  }\n  const candidate = value as Partial<OperatorProfile>;\n  if (typeof candidate.platform !== \"string\") {\n    throw new Error(`${label} needs an absolute platform URL`);\n  }\n  const platform = platformAudience(candidate.platform);\n  const app = clean(candidate.app);\n  const environment = clean(candidate.environment);\n  if (app) assertOperatorName(app, \"app\");\n  if (environment) assertOperatorName(environment, \"environment\");\n  return {\n    platform,\n    ...(app ? { app } : {}),\n    ...(environment ? { environment } : {}),\n  };\n}\n\nfunction clean(value: string | undefined): string | undefined {\n  const normalized = value?.trim();\n  return normalized || undefined;\n}\n","import { adminAi } from \"./admin-ai\";\nimport {\n  assertArgs,\n  boolOpt,\n  numberOpt,\n  stringOpt,\n  type ParsedArgv,\n} from \"./argv\";\nimport { resolveOperatorContext } from \"./operator-context\";\n\nexport interface AdminCommandDeps {\n  fetch?: typeof fetch;\n  openUrl?: (url: string) => Promise<void>;\n  readStdin?: () => Promise<string>;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\nconst CONTEXT_OPTIONS = [\"platform\", \"config\", \"context\", \"token\", \"open\", \"email\"];\nconst JSON_OPTIONS = [...CONTEXT_OPTIONS, \"json\"];\nconst SET_OPTIONS = [\n  ...JSON_OPTIONS,\n  \"provider\", \"model\", \"enabled\",\n  \"max-input-bytes\", \"max-output-tokens\", \"max-calls-per-run\",\n  \"discovery-provider\", \"discovery-model\", \"validation-provider\", \"validation-model\",\n];\n\nexport async function adminCommand(parsed: ParsedArgv, deps: AdminCommandDeps = {}): Promise<void> {\n  const area = parsed.positionals[1];\n  const action = parsed.positionals[2];\n  const credentialSet = action === \"credential\" && parsed.positionals[3] === \"set\";\n  const credentials = action === \"credentials\";\n  const models = action === \"models\";\n  const usage = action === \"usage\";\n  const audit = action === \"audit\";\n  if (area !== \"ai\" || (action !== \"show\" && action !== \"set\"\n    && !credentialSet && !credentials && !models && !usage && !audit)) {\n    throw new Error('unknown admin command. Try \"odla-ai admin ai show\".');\n  }\n  const allowed = credentialSet\n    ? [...CONTEXT_OPTIONS, \"from-env\", \"stdin\"]\n    : action === \"set\"\n      ? SET_OPTIONS\n      : models\n        ? [...JSON_OPTIONS, \"provider\"]\n        : usage\n          ? [...JSON_OPTIONS, \"app-id\", \"env\", \"run-id\", \"limit\"]\n          : audit\n            ? [...JSON_OPTIONS, \"limit\"]\n            : JSON_OPTIONS;\n  assertArgs(parsed, allowed, credentialSet ? 5 : action === \"set\" ? 4 : 3);\n  const context = await resolveOperatorContext(parsed, { allowMissingConfig: true });\n  await adminAi({\n    action: credentialSet\n      ? \"credential-set\"\n      : credentials ? \"credentials\"\n      : models ? \"models\"\n      : usage ? \"usage\"\n      : audit ? \"audit\"\n      : action as \"show\" | \"set\",\n    purpose: action === \"set\" ? parsed.positionals[3] : undefined,\n    provider: stringOpt(parsed.options.provider),\n    model: stringOpt(parsed.options.model),\n    enabled: boolOpt(parsed.options.enabled),\n    maxInputBytes: numberOpt(parsed.options[\"max-input-bytes\"], \"--max-input-bytes\"),\n    maxOutputTokens: numberOpt(parsed.options[\"max-output-tokens\"], \"--max-output-tokens\"),\n    maxCallsPerRun: numberOpt(parsed.options[\"max-calls-per-run\"], \"--max-calls-per-run\"),\n    platform: context.platform.value,\n    token: stringOpt(parsed.options.token),\n    tokenFile: context.credentials.scopedTokenFile,\n    email: stringOpt(parsed.options.email),\n    json: parsed.options.json === true,\n    open: parsed.options.open === false\n      ? false\n      : parsed.options.open === true ? true : undefined,\n    credentialProvider: credentialSet ? parsed.positionals[4] : undefined,\n    fromEnv: stringOpt(parsed.options[\"from-env\"]),\n    stdin: parsed.options.stdin === true,\n    readStdin: deps.readStdin,\n    discoveryProvider: stringOpt(parsed.options[\"discovery-provider\"]),\n    discoveryModel: stringOpt(parsed.options[\"discovery-model\"]),\n    validationProvider: stringOpt(parsed.options[\"validation-provider\"]),\n    validationModel: stringOpt(parsed.options[\"validation-model\"]),\n    appId: stringOpt(parsed.options[\"app-id\"]),\n    env: stringOpt(parsed.options.env),\n    runId: stringOpt(parsed.options[\"run-id\"]),\n    limit: numberOpt(parsed.options.limit, \"--limit\"),\n    fetch: deps.fetch,\n    stdout: deps.stdout,\n    openApprovalUrl: deps.openUrl,\n  });\n}\n","// Env → tenant resolution for the CLI. Two facts live here so no command has to\n// re-derive them: which environment an unqualified command defaults to, and how\n// an env name becomes the service tenant id that addresses its database.\n//\n// `tenantIdFor` is the shared spelling from @odla-ai/apps — every service keys\n// ALL storage and credentials by its output, so re-deriving the `--<env>` suffix\n// inline (as app-export once did) risks the two drifting apart. Import it; never\n// spell the suffix rule again.\nimport { tenantIdFor } from \"@odla-ai/apps\";\nimport type { LoadedProjectConfig } from \"./types\";\n\n/** Sandbox-first: an unqualified command targets `dev` when the project declares\n * it, because that is the database a developer should reach by accident. Falls\n * back to the first declared env for projects that opted out of a sandbox. */\nexport function resolveEnv(cfg: LoadedProjectConfig, requested?: string): string {\n  const env = requested ?? (cfg.envs.includes(\"dev\") ? \"dev\" : cfg.envs[0]);\n  if (!env || !cfg.envs.includes(env)) {\n    throw new Error(`env \"${env ?? \"\"}\" is not declared in ${cfg.configPath}`);\n  }\n  return env;\n}\n\n/** The resolved env paired with the tenant id addressing its database. */\nexport function resolveTenant(cfg: LoadedProjectConfig, requested?: string): { env: string; tenant: string } {\n  const env = resolveEnv(cfg, requested);\n  return { env, tenant: tenantIdFor(cfg.app.id, env) };\n}\n\n/** Both sides of a sandbox↔live transfer. Refuses a project that has not opted\n * into `prod`: a transfer against an unprovisioned live database would otherwise\n * fail much later, at the server, with a far less actionable message. */\nexport function bothTenants(cfg: LoadedProjectConfig): { sandbox: string; live: string } {\n  for (const env of [\"dev\", \"prod\"]) {\n    if (!cfg.envs.includes(env)) {\n      throw new Error(\n        `env \"${env}\" is not declared in ${cfg.configPath} — add it to \\`envs\\` and run ` +\n          \"`odla-ai provision --yes` before transferring data between environments\",\n      );\n    }\n  }\n  return { sandbox: tenantIdFor(cfg.app.id, \"dev\"), live: tenantIdFor(cfg.app.id, \"prod\") };\n}\n","// `odla-ai agent jobs|retry` — content-free inspection and recovery for the\n// durable commit-trigger queue. Uses the env's scoped db credential by default,\n// so unattended operators do not need a browser/device handshake.\nimport { assertArgs, numberOpt, stringOpt } from \"./argv\";\nimport type { ParsedArgv } from \"./argv\";\nimport { loadProjectConfig } from \"./config\";\nimport { resolveTenant } from \"./tenant\";\nimport { getDeveloperToken } from \"./token\";\nimport type { CliDependencies } from \"./cli\";\n\ntype AgentJobState = \"pending\" | \"running\" | \"succeeded\" | \"dead_letter\";\n\ninterface AgentJob {\n  id: string;\n  triggerId: string;\n  entityNs: string;\n  entityId: string;\n  state: AgentJobState;\n  attempts: number;\n  createdAt: number;\n  updatedAt: number;\n  nextAttemptAt: number | null;\n  leaseUntil: number | null;\n  finishedAt: number | null;\n  lastErrorCode: string | null;\n  lastHttpStatus: number | null;\n}\n\ninterface JobsResponse {\n  jobs: AgentJob[];\n  summary: {\n    pending: number;\n    running: number;\n    succeeded: number;\n    deadLetter: number;\n    oldestPendingAt: number | null;\n  };\n}\n\nexport async function agentCommand(parsed: ParsedArgv, deps: CliDependencies = {}): Promise<void> {\n  const action = parsed.positionals[1];\n  if (action !== \"jobs\" && action !== \"retry\") {\n    throw new Error(`unknown agent action \"${action ?? \"\"}\". Try \"odla-ai agent jobs --json\".`);\n  }\n  assertArgs(parsed, [\"config\", \"env\", \"state\", \"limit\", \"json\", \"token\", \"email\"], action === \"jobs\" ? 2 : 3);\n  if (action === \"retry\" && (parsed.options.state !== undefined || parsed.options.limit !== undefined)) {\n    throw new Error('--state and --limit are supported only by \"agent jobs\"');\n  }\n\n  const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? \"odla.config.mjs\");\n  const { env, tenant } = resolveTenant(cfg, stringOpt(parsed.options.env));\n  const doFetch = deps.fetch ?? fetch;\n  const out = deps.stdout ?? console;\n  const credential = await getDeveloperToken(\n    cfg,\n    {\n      configPath: cfg.configPath,\n      token: stringOpt(parsed.options.token),\n      email: stringOpt(parsed.options.email),\n      open: false,\n    },\n    doFetch,\n    out,\n  );\n  const base = `${cfg.dbEndpoint}/app/${encodeURIComponent(tenant)}/admin/agent-jobs`;\n  const headers = { authorization: `Bearer ${credential}` };\n\n  if (action === \"retry\") {\n    const id = parsed.positionals[2]!;\n    const res = await doFetch(`${base}/${encodeURIComponent(id)}/retry`, { method: \"POST\", headers });\n    const body = await readJson(res);\n    if (!res.ok) throw new Error(`agent retry failed (${res.status}): ${errorMessage(body)}`);\n    const result = { v: 1, appId: cfg.app.id, env, tenant, ...body };\n    if (parsed.options.json === true) out.log(JSON.stringify(result, null, 2));\n    else out.log(`${tenant}: requeued ${id}`);\n    return;\n  }\n\n  const state = stringOpt(parsed.options.state);\n  const allowed: AgentJobState[] = [\"pending\", \"running\", \"succeeded\", \"dead_letter\"];\n  if (state && !allowed.includes(state as AgentJobState)) {\n    throw new Error(`--state must be one of ${allowed.join(\", \")}`);\n  }\n  const url = new URL(base);\n  if (state) url.searchParams.set(\"state\", state);\n  const limit = numberOpt(parsed.options.limit, \"--limit\");\n  if (limit) url.searchParams.set(\"limit\", String(limit));\n  const res = await doFetch(url, { headers });\n  const body = (await readJson(res)) as Partial<JobsResponse> & Record<string, unknown>;\n  if (!res.ok) throw new Error(`agent jobs failed (${res.status}): ${errorMessage(body)}`);\n  const result = { v: 1, appId: cfg.app.id, env, tenant, jobs: body.jobs ?? [], summary: body.summary };\n  if (parsed.options.json === true) {\n    out.log(JSON.stringify(result, null, 2));\n    return;\n  }\n  const summary = body.summary;\n  out.log(\n    `${tenant}: ${summary?.pending ?? 0} pending, ${summary?.running ?? 0} running, ` +\n      `${summary?.deadLetter ?? 0} dead-letter, ${summary?.succeeded ?? 0} succeeded`,\n  );\n  for (const job of body.jobs ?? []) {\n    out.log(\n      [job.state, job.id, job.triggerId, `${job.entityNs}/${job.entityId}`, `attempts=${job.attempts}`, job.lastErrorCode ?? \"\"]\n        .filter(Boolean)\n        .join(\"\\t\"),\n    );\n  }\n}\n\nasync function readJson(res: Response): Promise<Record<string, unknown>> {\n  try {\n    return (await res.json()) as Record<string, unknown>;\n  } catch {\n    return {};\n  }\n}\n\nfunction errorMessage(body: Record<string, unknown>): string {\n  const error = body.error;\n  if (typeof error === \"string\") return error;\n  if (error && typeof error === \"object\" && typeof (error as { message?: unknown }).message === \"string\") {\n    return (error as { message: string }).message;\n  }\n  return \"request failed\";\n}\n","// `odla-ai app export` — download a portable snapshot of the configured app's\n// database (gzipped JSONL: schema registry, config, every row). The data-\n// portability half of the backup system: any developer credential that owns\n// the app can pull its data out at any time.\nimport { createWriteStream } from \"node:fs\";\nimport { Readable } from \"node:stream\";\nimport { pipeline } from \"node:stream/promises\";\nimport { loadProjectConfig } from \"./config\";\nimport { resolveTenant } from \"./tenant\";\nimport { getDeveloperToken } from \"./token\";\n\nexport interface AppExportOptions {\n  configPath: string;\n  env?: string;\n  token?: string;\n  email?: string;\n  /** Take a fresh snapshot first instead of downloading the newest existing one. */\n  fresh?: boolean;\n  /** Output path; defaults to `{tenant}-{date}-tx{n}.jsonl.gz` in cwd. */\n  out?: string;\n  json?: boolean;\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\ninterface BackupRow {\n  id: string;\n  key: string;\n  kind: string;\n  max_tx: number;\n  bytes: number;\n  sha256: string;\n  created_at: number;\n}\n\nexport async function appExport(options: AppExportOptions): Promise<{ file: string; backup: BackupRow }> {\n  const cfg = await loadProjectConfig(options.configPath);\n  const out = options.stdout ?? console;\n  const doFetch = options.fetch ?? fetch;\n  const { tenant } = resolveTenant(cfg, options.env);\n  const token = await getDeveloperToken(\n    cfg,\n    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },\n    doFetch,\n    out,\n  );\n  const auth = { authorization: `Bearer ${token}` };\n  const base = `${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenant)}`;\n\n  if (options.fresh) {\n    const res = await doFetch(`${base}/export`, { method: \"POST\", headers: auth });\n    const body = (await res.json().catch(() => ({}))) as { error?: { code?: string; message?: string } };\n    if (!res.ok) throw new Error(`export failed${body.error?.code ? ` (${body.error.code})` : \"\"}: ${body.error?.message ?? res.status}`);\n  }\n\n  const list = await doFetch(`${base}/backups`, { headers: auth });\n  if (!list.ok) throw new Error(`couldn't list backups (${list.status})`);\n  const { backups } = (await list.json()) as { backups: BackupRow[] };\n  const newest = backups[0];\n  if (!newest) {\n    throw new Error(\n      `${tenant} has no backups yet — run \\`odla-ai app export --fresh\\` to take one now (nightly snapshots appear after the first day with writes)`,\n    );\n  }\n\n  const download = await doFetch(`${base}/backups/${newest.id}/download`, { headers: auth });\n  if (!download.ok || !download.body) throw new Error(`download failed (${download.status})`);\n  const file = options.out ?? `${tenant}-${new Date(newest.created_at).toISOString().slice(0, 10)}-tx${newest.max_tx}.jsonl.gz`;\n  await pipeline(Readable.fromWeb(download.body as never), createWriteStream(file));\n\n  if (options.json) out.log(JSON.stringify({ file, backup: newest }, null, 2));\n  else {\n    out.log(`${tenant}: wrote ${file} (${newest.bytes} bytes, ${newest.kind} snapshot at tx ${newest.max_tx})`);\n    out.log(`sha256 ${download.headers.get(\"x-odla-sha256\") ?? newest.sha256}`);\n  }\n  return { file, backup: newest };\n}\n","// `odla-ai app import` — bulk-load rows into one app database from JSON, JSONL,\n// or a {namespace: rows} map. The write half of `app export`.\n//\n// Two deliberate refusals make this safe to run non-interactively: it never\n// guesses an id mode that could duplicate rows (a bare re-run must be a no-op,\n// not a second copy), and it never writes without --yes, so the bare invocation\n// IS the dry run. Chunks commit sequentially and stop at the first failure —\n// later rows may link to earlier ones, so continuing past a break would turn one\n// bad chunk into an unknown blast radius.\nimport { readFileSync } from \"node:fs\";\n// The planner is shared with Studio's import panel, so there is one copy of the\n// chunking and retry-identity rules. tsup marks @odla-ai/db external, so this\n// subpath resolves from the INSTALLED db at runtime: @odla-ai/db must be\n// released with `./import` before a CLI that imports it, or the published\n// binary throws ERR_PACKAGE_PATH_NOT_EXPORTED. `release:prepare --package\n// @odla-ai/db` fans the bump here and widens this package's range.\nimport {\n  buildImportOps,\n  importMutationId,\n  parseImport,\n  planImportChunks,\n  type ImportIdMode,\n  type ImportOptions,\n} from \"@odla-ai/db/import\";\nimport { loadProjectConfig } from \"./config\";\nimport { resolveTenant } from \"./tenant\";\nimport { getDeveloperToken } from \"./token\";\n\nexport interface AppImportOptions {\n  configPath: string;\n  /** Input path, or \"-\" for stdin. */\n  file: string;\n  env?: string;\n  ns?: string;\n  idField?: string;\n  key?: string;\n  generateIds?: boolean;\n  dryRun?: boolean;\n  yes?: boolean;\n  json?: boolean;\n  token?: string;\n  email?: string;\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n  readStdin?: () => string;\n}\n\nexport interface AppImportResult {\n  tenant: string;\n  rows: number;\n  chunks: number;\n  committed: number;\n  duplicate: number;\n  txIds: number[];\n  ignored: string[];\n}\n\nfunction chooseIdMode(options: AppImportOptions, rows: Array<Record<string, unknown>>): { idMode: ImportIdMode; idField?: string } {\n  const chosen = [options.idField && \"field\", options.key && \"key\", options.generateIds && \"generate\"].filter(Boolean);\n  if (chosen.length > 1) throw new Error(\"choose one of --id-field, --key, or --generate-ids\");\n  if (options.key) return { idMode: \"key\" };\n  if (options.generateIds) return { idMode: \"generate\" };\n  if (options.idField) return { idMode: \"field\", idField: options.idField };\n  // Default only when it is unambiguous AND idempotent. Falling back to\n  // generated ids would silently duplicate every row on a re-run.\n  if (rows.length > 0 && rows.every((row) => typeof row?.id === \"string\" && row.id)) return { idMode: \"field\" };\n  throw new Error(\n    \"rows have no usable `id` — pass --id-field <field> to name the id column, --key <unique-attr> to match on a \" +\n      \"unique attribute, or --generate-ids to mint new ids (which is NOT idempotent: re-running duplicates rows)\",\n  );\n}\n\nexport async function appImport(options: AppImportOptions): Promise<AppImportResult> {\n  const cfg = await loadProjectConfig(options.configPath);\n  const out = options.stdout ?? console;\n  // With --json, stdout carries the result and nothing else; the narration goes\n  // to stderr so the payload survives a pipe. See app-transfer.ts for the same\n  // rule, and token.ts for the bug that taught it.\n  const say = options.json ? (line?: unknown) => out.error(line) : (line?: unknown) => out.log(line);\n  const doFetch = options.fetch ?? fetch;\n  const { tenant } = resolveTenant(cfg, options.env);\n\n  const text = options.file === \"-\"\n    ? (options.readStdin ?? (() => readFileSync(0, \"utf8\")))()\n    : readFileSync(options.file, \"utf8\");\n  const { format, sources } = parseImport(text, options.ns);\n  if (format === \"namespace-map\" && options.ns) {\n    throw new Error(\"--ns cannot be combined with a {namespace: rows} file — the file already names each namespace\");\n  }\n  if (format !== \"namespace-map\" && !options.ns) throw new Error(\"--ns is required unless the file is a {namespace: rows} map\");\n  if (sources.length === 0) throw new Error(`${options.file} contains no rows`);\n\n  const mode = chooseIdMode(options, sources.map((s) => s.row));\n  const build: ImportOptions = { ...mode, keyAttr: options.key };\n  const { ops, rejected, ignored } = buildImportOps(sources, build);\n  if (rejected.length > 0) {\n    const detail = rejected.slice(0, 10).map((r) => `  row ${r.index}: ${r.reason}`).join(\"\\n\");\n    const more = rejected.length > 10 ? `\\n  …and ${rejected.length - 10} more` : \"\";\n    throw new Error(`${rejected.length} row(s) cannot be imported — fix the input and re-run:\\n${detail}${more}`);\n  }\n  const chunks = planImportChunks(ops);\n  const result: AppImportResult = { tenant, rows: ops.length, chunks: chunks.length, committed: 0, duplicate: 0, txIds: [], ignored };\n\n  if (ignored.length > 0) say(`ignoring server-maintained field(s): ${ignored.join(\", \")} — odla-db stamps these on write`);\n  if (options.dryRun || options.yes !== true) {\n    const why = options.dryRun ? \"--dry-run\" : \"no --yes\";\n    say(`${tenant}: would upsert ${ops.length} row(s) across ${chunks.length} transaction(s) — nothing written (${why})`);\n    if (options.json) out.log(JSON.stringify(result, null, 2));\n    return result;\n  }\n\n  const token = await getDeveloperToken(\n    cfg,\n    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },\n    doFetch,\n    out,\n  );\n  // One run id for the whole import, reused across retries: tx_log is\n  // UNIQUE(client_id, mutation_id), so a committed chunk re-sent under the same\n  // id is skipped rather than double-applied.\n  const runId = crypto.randomUUID();\n  const url = `${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenant)}/transact`;\n  for (const chunk of chunks) {\n    const res = await doFetch(url, {\n      method: \"POST\",\n      headers: { authorization: `Bearer ${token}`, \"content-type\": \"application/json\" },\n      body: JSON.stringify({ mutationId: importMutationId(runId, chunk.index), ops: chunk.ops }),\n    });\n    const body = (await res.json().catch(() => ({}))) as { txId?: number; duplicate?: boolean; error?: { code?: string; message?: string } };\n    if (!res.ok) {\n      const code = body.error?.code ? ` (${body.error.code})` : \"\";\n      throw new Error(\n        `chunk ${chunk.index + 1} of ${chunks.length} failed${code}: ${body.error?.message ?? res.status}. ` +\n          `${result.committed} row(s) already committed; fix the input and re-run to import the rest.`,\n      );\n    }\n    result.committed += chunk.ops.length;\n    if (typeof body.txId === \"number\") result.txIds.push(body.txId);\n    if (body.duplicate) result.duplicate++;\n  }\n\n  if (options.json) out.log(JSON.stringify(result, null, 2));\n  else {\n    const dup = result.duplicate > 0 ? ` (${result.duplicate} chunk(s) were already applied)` : \"\";\n    out.log(`${tenant}: upserted ${result.committed} row(s) in ${chunks.length} transaction(s)${dup}`);\n  }\n  return result;\n}\n","// `odla-ai app owners <list | add <email> | remove <email>>` — manage an app's\n// co-owners from the CLI (previously Studio-only). A co-owner has the SAME full\n// access as the primary owner: once added, they run their own `odla-ai provision`\n// to mint their OWN ODLA_API_KEY for the shared tenant and deploy — no secret is\n// ever copied between people. Multiple co-owners therefore operate one shared db\n// (including production, where every env's tenant is the same across owners).\nimport { assertArgs, type ParsedArgv, stringOpt } from \"./argv\";\nimport { loadProjectConfig } from \"./config\";\nimport { getDeveloperToken } from \"./token\";\n\nexport interface AppOwnersOptions {\n  configPath: string;\n  token?: string;\n  email?: string;\n  json?: boolean;\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\ninterface AppOwner {\n  ownerId: string;\n  email: string | null;\n  primary: boolean;\n}\ninterface OwnersResponse {\n  owners?: AppOwner[];\n  error?: { code?: string; message?: string };\n}\n\nconst sink = (options: AppOwnersOptions): Pick<typeof console, \"log\" | \"error\"> => options.stdout ?? console;\n\n/** One request to `/registry/apps/:id/owners[...]`, authed with the device grant. */\nasync function ownersRequest(\n  method: string,\n  suffix: string,\n  options: AppOwnersOptions,\n  body?: unknown,\n): Promise<AppOwner[]> {\n  const cfg = await loadProjectConfig(options.configPath);\n  const doFetch = options.fetch ?? fetch;\n  const token = await getDeveloperToken(\n    cfg,\n    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },\n    doFetch,\n    sink(options),\n  );\n  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/owners${suffix}`, {\n    method,\n    headers: { authorization: `Bearer ${token}`, \"content-type\": \"application/json\" },\n    body: body === undefined ? undefined : JSON.stringify(body),\n  });\n  const data = (await res.json().catch(() => ({}))) as OwnersResponse;\n  if (!res.ok) {\n    throw new Error(\n      `owners ${method} failed${data.error?.code ? ` (${data.error.code})` : \"\"}: ` +\n        (data.error?.message ?? `registry returned ${res.status}`),\n    );\n  }\n  return data.owners ?? [];\n}\n\nfunction report(options: AppOwnersOptions, owners: AppOwner[], headline?: string): void {\n  const out = sink(options);\n  if (options.json === true) {\n    out.log(JSON.stringify(owners, null, 2));\n    return;\n  }\n  if (headline) out.log(headline);\n  out.log(`owners (${owners.length}):`);\n  for (const o of owners) {\n    out.log(`  ${o.primary ? \"★\" : \"·\"} ${o.email ?? o.ownerId}${o.primary ? \" (primary)\" : \"\"}`);\n  }\n}\n\n/** `app owners list` — show the primary owner and every co-owner. */\nexport async function ownersList(options: AppOwnersOptions): Promise<void> {\n  report(options, await ownersRequest(\"GET\", \"\", options));\n}\n\n/** `app owners add <email>` — grant a signed-up odla member co-owner access. */\nexport async function ownersAdd(email: string, options: AppOwnersOptions): Promise<void> {\n  const owners = await ownersRequest(\"POST\", \"\", options, { email });\n  report(\n    options,\n    owners,\n    `added ${email} as a co-owner — they share full access. They can now run ` +\n      \"`odla-ai provision` to mint their own credentials (no secret sharing).\",\n  );\n}\n\n/** `app owners remove <email|ownerId>` — revoke a co-owner. An email is resolved\n * to its Clerk sub first (the DELETE route keys on the sub). */\nexport async function ownersRemove(target: string, options: AppOwnersOptions): Promise<void> {\n  let ownerId = target;\n  if (target.includes(\"@\")) {\n    const owners = await ownersRequest(\"GET\", \"\", options);\n    const match = owners.find((o) => o.email?.toLowerCase() === target.toLowerCase());\n    if (!match) throw new Error(`no co-owner with email ${target}`);\n    if (match.primary) throw new Error(\"can't remove the primary owner\");\n    ownerId = match.ownerId;\n  }\n  const owners = await ownersRequest(\"DELETE\", `/${encodeURIComponent(ownerId)}`, options);\n  report(options, owners, `removed ${target}`);\n}\n\n/** Dispatch `odla-ai app owners <list|add|remove>` from the parsed argv. */\nexport async function appOwnersCommand(\n  parsed: ParsedArgv,\n  dependencies: { fetch?: typeof fetch; stdout?: Pick<typeof console, \"log\" | \"error\"> } = {},\n): Promise<void> {\n  const sub = parsed.positionals[2] ?? \"list\";\n  const options: AppOwnersOptions = {\n    configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n    token: stringOpt(parsed.options.token),\n    email: stringOpt(parsed.options.email),\n    json: parsed.options.json === true,\n    fetch: dependencies.fetch,\n    stdout: dependencies.stdout,\n  };\n  const allowed = [\"config\", \"token\", \"email\", \"json\"];\n  if (sub === \"list\") {\n    assertArgs(parsed, allowed, 3);\n    await ownersList(options);\n    return;\n  }\n  if (sub === \"add\" || sub === \"remove\") {\n    assertArgs(parsed, allowed, 4);\n    const email = parsed.positionals[3];\n    if (!email) throw new Error(`\"app owners ${sub}\" needs an email — try \"odla-ai app owners ${sub} teammate@example.com\".`);\n    await (sub === \"add\" ? ownersAdd(email, options) : ownersRemove(email, options));\n    return;\n  }\n  throw new Error(\n    `unknown app owners subcommand \"${sub}\". Try \"odla-ai app owners list\", ` +\n      '\"odla-ai app owners add <email>\", or \"odla-ai app owners remove <email>\".',\n  );\n}\n","// `odla-ai app rename <new name>` — change the app's human-readable display\n// name. Only the label changes: the `app_id` is the durable key (tenant ids,\n// URLs, saved config, GitHub Checks links all embed it) and stays fixed, so a\n// rename needs no re-provisioning and breaks no existing credential.\nimport { assertArgs, type ParsedArgv, stringOpt } from \"./argv\";\nimport { loadProjectConfig } from \"./config\";\nimport { getDeveloperToken } from \"./token\";\n\nexport interface AppRenameOptions {\n  configPath: string;\n  token?: string;\n  email?: string;\n  json?: boolean;\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\ninterface RenameResponse {\n  app?: { appId: string; name: string };\n  error?: { code?: string; message?: string };\n}\n\n/** `app rename <name>` — PUT the new display name and report the result. */\nexport async function appRename(name: string, options: AppRenameOptions): Promise<void> {\n  const out = options.stdout ?? console;\n  const trimmed = name.trim();\n  if (!trimmed) throw new Error('\"app rename\" needs a name — try `odla-ai app rename \"Acme Storefront\"`.');\n  const cfg = await loadProjectConfig(options.configPath);\n  const doFetch = options.fetch ?? fetch;\n  const token = await getDeveloperToken(\n    cfg,\n    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },\n    doFetch,\n    out,\n  );\n  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/name`, {\n    method: \"PUT\",\n    headers: { authorization: `Bearer ${token}`, \"content-type\": \"application/json\" },\n    body: JSON.stringify({ name: trimmed }),\n  });\n  const data = (await res.json().catch(() => ({}))) as RenameResponse;\n  if (!res.ok || !data.app) {\n    throw new Error(\n      `rename failed${data.error?.code ? ` (${data.error.code})` : \"\"}: ` +\n        (data.error?.message ?? `registry returned ${res.status}`),\n    );\n  }\n  if (options.json === true) {\n    out.log(JSON.stringify(data.app, null, 2));\n    return;\n  }\n  out.log(`renamed ${data.app.appId} → \"${data.app.name}\"`);\n  out.log(\"The app id is unchanged, so credentials, tenants, and URLs keep working.\");\n  out.log(`Update the \"name\" in ${cfg.configPath} to match.`);\n}\n\n/** Dispatch `odla-ai app rename <name>` from the parsed argv. */\nexport async function appRenameCommand(\n  parsed: ParsedArgv,\n  dependencies: { fetch?: typeof fetch; stdout?: Pick<typeof console, \"log\" | \"error\"> } = {},\n): Promise<void> {\n  // Only the options are constrained: every positional after `rename` is part of\n  // the name, so an unquoted `app rename Acme Storefront` works as typed.\n  assertArgs(parsed, [\"config\", \"token\", \"email\", \"json\"], parsed.positionals.length);\n  const name = parsed.positionals.slice(2).join(\" \");\n  await appRename(name, {\n    configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n    token: stringOpt(parsed.options.token),\n    email: stringOpt(parsed.options.email),\n    json: parsed.options.json === true,\n    fetch: dependencies.fetch,\n    stdout: dependencies.stdout,\n  });\n}\n","// `odla-ai app refresh-sandbox | go-live | promote` — moving data and\n// definitions between an app's two databases.\n//\n// The verbs are deliberately ASYMMETRIC. A single `app copy --from X --to Y`\n// would make the two most dangerous operations in the CLI look identical, so a\n// transposed flag pair would silently destroy the wrong database. Here the verb\n// carries the direction and there are no direction flags to transpose.\n//\n// None of them accept --env either: they operate on BOTH environments by\n// definition, so an --env would imply it selects a side. And each one prints its\n// pre-flight and writes nothing without --yes, which makes the bare invocation\n// the dry run.\nimport { loadProjectConfig } from \"./config\";\nimport { bothTenants } from \"./tenant\";\nimport { getDeveloperToken } from \"./token\";\nimport type { LoadedProjectConfig } from \"./types\";\n\nexport type TransferVerb = \"refresh-sandbox\" | \"go-live\" | \"promote\";\n\nexport interface AppTransferOptions {\n  configPath: string;\n  verb: TransferVerb;\n  includeIdentity?: boolean;\n  includeFiles?: boolean;\n  dryRun?: boolean;\n  yes?: boolean;\n  json?: boolean;\n  token?: string;\n  email?: string;\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\ninterface Side {\n  tenant: string;\n  exists: boolean;\n  maxTx: number;\n  triples: number;\n  namespaces: string[];\n  identityRows: number;\n  hasSchema: boolean;\n  hasRules: boolean;\n}\n\ninterface Preflight {\n  source: Side;\n  target: Side;\n  targetEmpty: boolean;\n  staysPut: string[];\n  excluded: string[];\n  blockers: Array<{ code: string; message: string }>;\n  error?: { code?: string; message?: string };\n}\n\n/** Which database each verb reads and which it writes. */\nfunction endpointsFor(verb: TransferVerb, tenants: { sandbox: string; live: string }) {\n  const up = { source: tenants.sandbox, target: tenants.live, from: \"dev\" };\n  const down = { source: tenants.live, target: tenants.sandbox, from: \"prod\" };\n  if (verb === \"refresh-sandbox\") return { ...down, mode: \"refresh\" as const };\n  return { ...up, mode: \"cutover\" as const };\n}\n\nasync function api<T>(\n  cfg: LoadedProjectConfig,\n  token: string,\n  path: string,\n  init: RequestInit | undefined,\n  doFetch: typeof fetch,\n): Promise<{ status: number; body: T }> {\n  const res = await doFetch(`${cfg.dbEndpoint}${path}`, {\n    ...init,\n    headers: { authorization: `Bearer ${token}`, \"content-type\": \"application/json\", ...(init?.headers as Record<string, string>) },\n  });\n  return { status: res.status, body: (await res.json().catch(() => ({}))) as T };\n}\n\nfunction describe(side: Side): string {\n  if (!side.exists) return \"not provisioned\";\n  if (side.maxTx === 0) return \"empty — never written\";\n  const ns = side.namespaces.length === 1 ? \"1 namespace\" : `${side.namespaces.length} namespaces`;\n  const identity = side.identityRows > 0 ? `, ${side.identityRows} identity row(s)` : \"\";\n  return `${ns} · ${side.triples} value(s) · tx ${side.maxTx}${identity}`;\n}\n\nfunction printPlan(out: Pick<typeof console, \"log\">, verb: TransferVerb, pre: Preflight, opts: AppTransferOptions): void {\n  const arrow = verb === \"refresh-sandbox\" ? \"live → sandbox\" : \"sandbox → live\";\n  out.log(`${verb} (${arrow})`);\n  out.log(`  from  ${pre.source.tenant}  ${describe(pre.source)}`);\n  out.log(`  to    ${pre.target.tenant}  ${describe(pre.target)}`);\n  if (verb === \"promote\") {\n    out.log(\"  moves schema, rules and gates only — no rows are copied or removed\");\n  } else {\n    out.log(`  ${pre.target.tenant} is REPLACED by ${pre.source.tenant}`);\n    out.log(`  stays put: ${pre.staysPut.join(\", \")}`);\n    const identity = opts.includeIdentity ? \"INCLUDED (--include-identity)\" : `left behind: ${pre.excluded.join(\", \")}`;\n    out.log(`  identity: ${identity}`);\n    out.log(`  files: ${opts.includeFiles ? \"copied (--include-files)\" : \"not copied\"}`);\n  }\n  for (const blocker of pre.blockers) out.log(`  ✖ ${blocker.code}: ${blocker.message}`);\n}\n\nexport async function appTransfer(options: AppTransferOptions): Promise<{ ok: boolean; plan: Preflight | null; result?: unknown }> {\n  const cfg = await loadProjectConfig(options.configPath);\n  const out = options.stdout ?? console;\n  // With --json, stdout is the RESULT and nothing else: the plan narration and\n  // the progress lines move to stderr so the payload stays parseable. Printing\n  // both to stdout meant `app promote --json | jq` choked on the prose above it —\n  // the same failure that made every other --json output in this CLI unreadable.\n  const say = options.json ? (line?: unknown) => out.error(line) : (line?: unknown) => out.log(line);\n  const doFetch = options.fetch ?? fetch;\n  const tenants = bothTenants(cfg);\n  const route = endpointsFor(options.verb, tenants);\n  const token = await getDeveloperToken(\n    cfg,\n    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },\n    doFetch,\n    out,\n  );\n\n  const pre = await api<Preflight>(\n    cfg,\n    token,\n    `/admin/apps/${encodeURIComponent(route.target)}/copy-preflight?from=${route.from}`,\n    undefined,\n    doFetch,\n  );\n  if (pre.status !== 200) {\n    throw new Error(`pre-flight failed${pre.body.error?.code ? ` (${pre.body.error.code})` : \"\"}: ${pre.body.error?.message ?? pre.status}`);\n  }\n  const plan = pre.body;\n  printPlan({ log: say }, options.verb, plan, options);\n\n  // go-live is one-time by design; say so before the server has to.\n  if (options.verb === \"go-live\" && !plan.targetEmpty) {\n    throw new Error(\n      `${route.target} already has data — go-live has already happened. Use \\`odla-ai app promote --yes\\` to push schema and rules, ` +\n        \"or `odla-ai app refresh-sandbox --yes` to pull live back down.\",\n    );\n  }\n  if (plan.blockers.length > 0) throw new Error(`cannot ${options.verb}: ${plan.blockers.map((b) => b.message).join(\"; \")}`);\n\n  if (options.dryRun || options.yes !== true) {\n    say(`nothing written (${options.dryRun ? \"--dry-run\" : \"no --yes\"})`);\n    if (options.json) out.log(JSON.stringify(plan, null, 2));\n    return { ok: true, plan };\n  }\n\n  if (options.verb === \"promote\") {\n    const res = await api<{ applied?: string[]; error?: { code?: string; message?: string } }>(\n      cfg,\n      token,\n      `/admin/apps/${encodeURIComponent(route.target)}/promote-definitions`,\n      { method: \"POST\", body: JSON.stringify({ from: \"dev\" }) },\n      doFetch,\n    );\n    if (res.status !== 200) throw new Error(`promote failed${res.body.error?.code ? ` (${res.body.error.code})` : \"\"}: ${res.body.error?.message ?? res.status}`);\n    if (options.json) out.log(JSON.stringify(res.body, null, 2));\n    else say(`${route.target}: promoted ${(res.body.applied ?? []).join(\", \")}`);\n    return { ok: true, plan, result: res.body };\n  }\n\n  const res = await api<{ destination?: { maxTx: number; epoch: number }; counts?: Record<string, number>; error?: { code?: string; message?: string } }>(\n    cfg,\n    token,\n    `/admin/apps/${encodeURIComponent(route.target)}/copy-db`,\n    {\n      method: \"POST\",\n      body: JSON.stringify({\n        from: route.from,\n        mode: route.mode,\n        ...(options.includeIdentity ? { includeUsers: true } : {}),\n        ...(options.includeFiles ? { includeFiles: true } : {}),\n      }),\n    },\n    doFetch,\n  );\n  if (res.status !== 200) throw new Error(`${options.verb} failed${res.body.error?.code ? ` (${res.body.error.code})` : \"\"}: ${res.body.error?.message ?? res.status}`);\n  say(`${route.target}: replaced from ${route.source} (tx ${res.body.destination?.maxTx}, epoch ${res.body.destination?.epoch}) — connected clients resync automatically`);\n\n  if (options.includeFiles) await copyFiles(cfg, token, route, doFetch, out);\n  if (options.json) out.log(JSON.stringify(res.body, null, 2));\n  return { ok: true, plan, result: res.body };\n}\n\n/** The file leg is bounded per request and resumes where it left off, so a 503\n * is a \"call me again\", not a failure. */\nasync function copyFiles(\n  cfg: LoadedProjectConfig,\n  token: string,\n  route: { target: string; from: string },\n  doFetch: typeof fetch,\n  out: Pick<typeof console, \"log\">,\n): Promise<void> {\n  for (let attempt = 1; attempt <= 20; attempt++) {\n    const res = await api<{ error?: { code?: string; message?: string; retry?: boolean } }>(\n      cfg,\n      token,\n      `/admin/apps/${encodeURIComponent(route.target)}/copy-files`,\n      { method: \"POST\", body: JSON.stringify({ from: route.from }) },\n      doFetch,\n    );\n    if (res.status === 200) {\n      out.log(`${route.target}: files copied`);\n      return;\n    }\n    if (!res.body.error?.retry) {\n      throw new Error(`file copy failed${res.body.error?.code ? ` (${res.body.error.code})` : \"\"}: ${res.body.error?.message ?? res.status}`);\n    }\n    out.log(`  files: bounded at attempt ${attempt}, resuming…`);\n  }\n  throw new Error(\"file copy did not finish within 20 rounds — re-run to continue where it left off\");\n}\n","// `odla-ai app archive|restore` — the CLI half of the platform's archive\n// lifecycle. Archive suspends every environment's data plane (keys refused,\n// requests rejected) while retaining ALL data; restore reverses it exactly.\n// There is deliberately NO purge subcommand and the server refuses machine +\n// developer credentials for purge anyway: permanent deletion is a signed-in\n// human's Studio action only.\nimport { appExport } from \"./app-export\";\nimport { appImport } from \"./app-import\";\nimport { appOwnersCommand } from \"./app-owners\";\nimport { appRenameCommand } from \"./app-rename\";\nimport { appTransfer } from \"./app-transfer\";\nimport { assertArgs, stringOpt, type ParsedArgv } from \"./argv\";\nimport { loadProjectConfig } from \"./config\";\nimport { getDeveloperToken } from \"./token\";\n\nexport interface AppLifecycleOptions {\n  configPath: string;\n  token?: string;\n  email?: string;\n  yes?: boolean;\n  json?: boolean;\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\ninterface LifecycleResponse {\n  ok?: boolean;\n  app?: { appId: string; archivedAt: number | null };\n  operation?: { state: string };\n  error?: { code?: string; message?: string };\n}\n\nasync function lifecycleCall(action: \"archive\" | \"restore\", options: AppLifecycleOptions): Promise<LifecycleResponse> {\n  const cfg = await loadProjectConfig(options.configPath);\n  const out = options.stdout ?? console;\n  const doFetch = options.fetch ?? fetch;\n  const token = await getDeveloperToken(\n    cfg,\n    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },\n    doFetch,\n    out,\n  );\n  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/${action}`, {\n    method: \"POST\",\n    headers: { authorization: `Bearer ${token}`, \"content-type\": \"application/json\" },\n  });\n  const body = (await res.json().catch(() => ({}))) as LifecycleResponse;\n  if (!res.ok || !body.ok) {\n    throw new Error(`${action} failed${body.error?.code ? ` (${body.error.code})` : \"\"}: ${body.error?.message ?? `registry returned ${res.status}`}`);\n  }\n  return body;\n}\n\n/** Archive the configured app. Refuses to run without --yes: this takes every\n * environment's data plane down at once (all data retained, restorable). */\nexport async function appArchive(options: AppLifecycleOptions): Promise<void> {\n  if (options.yes !== true) {\n    throw new Error(\n      \"app archive suspends EVERY environment: API keys stop working and all services refuse requests until restored. \" +\n        \"All data is retained. Pass --yes to proceed.\",\n    );\n  }\n  const out = options.stdout ?? console;\n  const body = await lifecycleCall(\"archive\", options);\n  if (options.json) out.log(JSON.stringify(body, null, 2));\n  else if (body.operation?.state === \"noop\") out.log(`${body.app?.appId}: already archived`);\n  else out.log(`${body.app?.appId}: archived — data retained; run \\`odla-ai app restore\\` (or use Studio) to bring it back`);\n}\n\n/** Restore (un-archive) the configured app. Idempotent — safe to re-run. */\nexport async function appRestore(options: AppLifecycleOptions): Promise<void> {\n  const out = options.stdout ?? console;\n  const body = await lifecycleCall(\"restore\", options);\n  if (options.json) out.log(JSON.stringify(body, null, 2));\n  else if (body.operation?.state === \"noop\") out.log(`${body.app?.appId}: already active`);\n  else out.log(`${body.app?.appId}: restored — every service's data plane is live again`);\n}\n\n/** Dispatch `odla-ai app <archive|restore|export>` from the parsed argv. */\nexport async function appCommand(\n  parsed: ParsedArgv,\n  dependencies: { fetch?: typeof fetch; stdout?: Pick<typeof console, \"log\" | \"error\"> } = {},\n): Promise<void> {\n  const sub = parsed.positionals[1];\n  if (sub === \"owners\") {\n    await appOwnersCommand(parsed, dependencies);\n    return;\n  }\n  if (sub === \"rename\") {\n    await appRenameCommand(parsed, dependencies);\n    return;\n  }\n  if (sub === \"export\") {\n    assertArgs(parsed, [\"config\", \"env\", \"token\", \"email\", \"fresh\", \"out\", \"json\"], 2);\n    await appExport({\n      configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n      env: stringOpt(parsed.options.env),\n      token: stringOpt(parsed.options.token),\n      email: stringOpt(parsed.options.email),\n      fresh: parsed.options.fresh === true,\n      out: stringOpt(parsed.options.out),\n      json: parsed.options.json === true,\n      fetch: dependencies.fetch,\n      stdout: dependencies.stdout,\n    });\n    return;\n  }\n  if (sub === \"refresh-sandbox\" || sub === \"go-live\" || sub === \"promote\") {\n    assertArgs(parsed, [\"config\", \"include-identity\", \"include-files\", \"dry-run\", \"yes\", \"token\", \"email\", \"json\"], 2);\n    await appTransfer({\n      configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n      verb: sub,\n      includeIdentity: parsed.options[\"include-identity\"] === true,\n      includeFiles: parsed.options[\"include-files\"] === true,\n      dryRun: parsed.options[\"dry-run\"] === true,\n      yes: parsed.options.yes === true,\n      token: stringOpt(parsed.options.token),\n      email: stringOpt(parsed.options.email),\n      json: parsed.options.json === true,\n      fetch: dependencies.fetch,\n      stdout: dependencies.stdout,\n    });\n    return;\n  }\n  if (sub === \"import\") {\n    assertArgs(parsed, [\"config\", \"env\", \"ns\", \"id-field\", \"key\", \"generate-ids\", \"dry-run\", \"yes\", \"token\", \"email\", \"json\"], 3);\n    const file = parsed.positionals[2];\n    if (!file) throw new Error('app import needs a file: \"odla-ai app import rows.json --ns todos --yes\" (or \"-\" for stdin)');\n    await appImport({\n      configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n      file,\n      env: stringOpt(parsed.options.env),\n      ns: stringOpt(parsed.options.ns),\n      idField: stringOpt(parsed.options[\"id-field\"]),\n      key: stringOpt(parsed.options.key),\n      generateIds: parsed.options[\"generate-ids\"] === true,\n      dryRun: parsed.options[\"dry-run\"] === true,\n      yes: parsed.options.yes === true,\n      token: stringOpt(parsed.options.token),\n      email: stringOpt(parsed.options.email),\n      json: parsed.options.json === true,\n      fetch: dependencies.fetch,\n      stdout: dependencies.stdout,\n    });\n    return;\n  }\n  if (sub !== \"archive\" && sub !== \"restore\") {\n    throw new Error(\n      `unknown app subcommand \"${sub ?? \"\"}\". Try \"odla-ai app archive --yes\", \"odla-ai app restore\", ` +\n        '\"odla-ai app export\", \"odla-ai app import <file>\", \"odla-ai app refresh-sandbox\", ' +\n        '\"odla-ai app go-live\", \"odla-ai app promote\", \"odla-ai app rename <name>\", ' +\n        'or \"odla-ai app owners <list|add|remove>\". ' +\n        \"(Permanent deletion has no CLI: it requires a signed-in owner in Studio.)\",\n    );\n  }\n  assertArgs(parsed, [\"config\", \"token\", \"email\", \"yes\", \"json\"], 2);\n  const options: AppLifecycleOptions = {\n    configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n    token: stringOpt(parsed.options.token),\n    email: stringOpt(parsed.options.email),\n    yes: parsed.options.yes === true,\n    json: parsed.options.json === true,\n    fetch: dependencies.fetch,\n    stdout: dependencies.stdout,\n  };\n  if (sub === \"archive\") await appArchive(options);\n  else await appRestore(options);\n}\n","import type { ParsedArgv } from \"./argv\";\nimport type { AgentHarnessSelector } from \"./skill\";\n\nexport function harnessList(parsed: ParsedArgv): AgentHarnessSelector[] {\n  const selected = [\n    ...harnessOption(parsed.options.agent, \"--agent\"),\n    ...harnessOption(parsed.options.harness, \"--harness\"),\n  ];\n  return (selected.length ? selected : [\"all\"]) as AgentHarnessSelector[];\n}\n\nfunction harnessOption(\n  value: string | boolean | string[] | undefined,\n  flag: string,\n): string[] {\n  if (value === undefined) return [];\n  if (typeof value === \"boolean\") throw new Error(`${flag} requires a harness name`);\n  const raw = Array.isArray(value) ? value : [value];\n  const parts = raw.flatMap((item) => item.split(\",\"));\n  if (parts.some((item) => !item.trim())) {\n    throw new Error(`${flag} requires a harness name`);\n  }\n  return parts.map((item) => item.trim());\n}\n","// The commands that act on a local project directory — `odla.config.mjs`, the\n// installed agent runbooks, a project's secrets — as opposed to the ones that\n// delegate to a control-plane command module. Split out of `cli.ts` so the\n// dispatcher stays a dispatcher; these seven were the only commands still\n// carrying their argument handling inline.\nimport { assertArgs, listOpt, parseArgv, requiredString, stringOpt } from \"./argv\";\nimport { printCapabilities } from \"./capabilities\";\nimport { doctor } from \"./doctor\";\nimport { harnessList } from \"./harness-options\";\nimport { initProject } from \"./init\";\nimport { secretsPush } from \"./secrets\";\nimport { secretsSet, secretsSetClerkKey } from \"./secrets-set\";\nimport { installSkill } from \"./skill\";\nimport { smoke } from \"./smoke\";\n\n/** The side-effect overrides these commands accept (a structural subset of\n * `CliDependencies`, so `cli.ts` can pass its own object straight through). */\nexport interface ProjectCommandDeps {\n  fetch?: typeof fetch;\n  openUrl?: (url: string) => Promise<void>;\n  readStdin?: () => Promise<string>;\n  homeDir?: string;\n  codexHomeDir?: string;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\ntype Parsed = ReturnType<typeof parseArgv>;\n\nconst SKILL_OPTS = [\"dir\", \"global\", \"force\", \"agent\", \"harness\"];\n\nfunction install(parsed: Parsed, positionals: number, deps: ProjectCommandDeps): void {\n  assertArgs(parsed, SKILL_OPTS, positionals);\n  installSkill({\n    dir: stringOpt(parsed.options.dir),\n    global: parsed.options.global === true,\n    harnesses: harnessList(parsed),\n    force: parsed.options.force === true,\n    homeDir: deps.homeDir,\n    codexHomeDir: deps.codexHomeDir,\n    stdout: deps.stdout,\n  });\n}\n\nasync function secretsCommand(parsed: Parsed, deps: ProjectCommandDeps): Promise<void> {\n  const sub = parsed.positionals[1];\n  if (sub === \"set\" || sub === \"set-clerk-key\") {\n    assertArgs(parsed, [\"config\", \"env\", \"from-env\", \"stdin\", \"token\", \"email\", \"yes\"], sub === \"set\" ? 3 : 2);\n    const options = {\n      configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n      name: parsed.positionals[2],\n      env: requiredString(parsed.options.env, \"--env\"),\n      fromEnv: stringOpt(parsed.options[\"from-env\"]),\n      stdin: parsed.options.stdin === true,\n      token: stringOpt(parsed.options.token),\n      email: stringOpt(parsed.options.email),\n      yes: parsed.options.yes === true,\n      readStdin: deps.readStdin,\n      fetch: deps.fetch,\n      stdout: deps.stdout,\n    };\n    await (sub === \"set\" ? secretsSet(options) : secretsSetClerkKey(options));\n    return;\n  }\n  if (sub !== \"push\") {\n    throw new Error(\n      `unknown secrets subcommand \"${sub ?? \"\"}\". Try \"odla-ai secrets push --env dev\", ` +\n        `\"odla-ai secrets set <name> --env dev --stdin\", or \"odla-ai secrets set-clerk-key --env dev --stdin\".`,\n    );\n  }\n  assertArgs(parsed, [\"config\", \"env\", \"dry-run\", \"yes\"], 2);\n  await secretsPush({\n    configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n    env: requiredString(parsed.options.env, \"--env\"),\n    dryRun: parsed.options[\"dry-run\"] === true,\n    yes: parsed.options.yes === true,\n  });\n}\n\n/**\n * Run `command` if it is one of the project-local commands.\n *\n * @returns `true` when the command was recognised and has run, `false` when the\n * caller should keep looking — so the dispatcher stays a flat chain rather than\n * this module having to know what comes after it.\n */\nexport async function projectCommand(command: string, parsed: Parsed, deps: ProjectCommandDeps): Promise<boolean> {\n  if (command === \"init\") {\n    assertArgs(parsed, [\"app-id\", \"name\", \"config\", \"env\", \"services\", \"ai-provider\", \"force\"], 1);\n    initProject({\n      appId: requiredString(parsed.options[\"app-id\"], \"--app-id\"),\n      name: requiredString(parsed.options.name, \"--name\"),\n      configPath: stringOpt(parsed.options.config),\n      envs: listOpt(parsed.options.env),\n      services: listOpt(parsed.options.services),\n      aiProvider: stringOpt(parsed.options[\"ai-provider\"]),\n      force: parsed.options.force === true,\n    });\n    return true;\n  }\n  if (command === \"doctor\") {\n    assertArgs(parsed, [\"config\"], 1);\n    await doctor({ configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\" });\n    return true;\n  }\n  if (command === \"capabilities\") {\n    assertArgs(parsed, [\"json\"], 1);\n    printCapabilities(parsed.options.json === true);\n    return true;\n  }\n  if (command === \"smoke\") {\n    assertArgs(parsed, [\"config\", \"env\", \"token\", \"email\", \"open\"], 1);\n    await smoke({\n      configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n      env: stringOpt(parsed.options.env),\n      token: stringOpt(parsed.options.token),\n      email: stringOpt(parsed.options.email),\n      open: parsed.options.open === false ? false : parsed.options.open === true ? true : undefined,\n      openApprovalUrl: deps.openUrl,\n      fetch: deps.fetch,\n      stdout: deps.stdout,\n    });\n    return true;\n  }\n  if (command === \"setup\") {\n    install(parsed, 1, deps);\n    (deps.stdout ?? console).log(\n      \"\\nOffline runbooks installed. Open this repo in your coding agent and ask it to set up odla.\\n\" +\n        \"Its native adapter finds the local `odla` skill, chooses build or migration, and drives the CLI.\",\n    );\n    return true;\n  }\n  if (command === \"skill\") {\n    const sub = parsed.positionals[1];\n    if (sub !== \"install\") throw new Error(`unknown skill subcommand \"${sub ?? \"\"}\". Try \"odla-ai skill install\".`);\n    install(parsed, 2, deps);\n    return true;\n  }\n  if (command === \"secrets\") {\n    await secretsCommand(parsed, deps);\n    return true;\n  }\n  return false;\n}\n","import { assertArgs, numberOpt, stringOpt, type ParsedArgv } from \"./argv\";\nimport { codeConnect, type CodeContainerEngine } from \"./code-connect\";\nimport type { CliDependencies } from \"./cli\";\n\nexport async function codeCommand(parsed: ParsedArgv, dependencies: CliDependencies): Promise<void> {\n  const sub = parsed.positionals[1];\n  if (sub !== \"connect\") {\n    throw new Error(`unknown code subcommand \"${sub ?? \"\"}\". Try \"odla-ai code connect --env dev\".`);\n  }\n  assertArgs(parsed, [\n    \"config\", \"env\", \"platform\", \"app-id\", \"email\", \"open\", \"name\", \"slots\", \"engine\", \"heartbeat-ms\", \"once\",\n  ], 2);\n  const engine = stringOpt(parsed.options.engine) ?? \"auto\";\n  if (!([\"auto\", \"container\", \"podman\", \"docker\"] as string[]).includes(engine)) {\n    throw new Error(\"--engine must be auto, container, podman, or docker\");\n  }\n  await (dependencies.codeConnect ?? codeConnect)({\n    configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n    env: stringOpt(parsed.options.env),\n    platform: stringOpt(parsed.options.platform),\n    appId: stringOpt(parsed.options[\"app-id\"]),\n    email: stringOpt(parsed.options.email),\n    open: parsed.options.open === false ? false : parsed.options.open === true ? true : undefined,\n    name: stringOpt(parsed.options.name),\n    slots: numberOpt(parsed.options.slots, \"--slots\"),\n    engine: engine as CodeContainerEngine | \"auto\",\n    heartbeatMs: numberOpt(parsed.options[\"heartbeat-ms\"], \"--heartbeat-ms\"),\n    once: parsed.options.once === true,\n    fetch: dependencies.fetch,\n    stdout: dependencies.stdout,\n    openApprovalUrl: dependencies.openUrl,\n    readGitOrigin: dependencies.readGitOrigin,\n  });\n}\n","import process from \"node:process\";\nimport { stringOpt, type ParsedArgv } from \"./argv\";\nimport { readJsonFile } from \"./local\";\nimport type { ResolvedOperatorContext } from \"./operator-context\";\n\nexport type DeveloperTokenSource =\n  | \"flag\"\n  | \"environment\"\n  | \"cache\"\n  | \"missing\";\n\nexport interface DeveloperTokenStatus {\n  source: DeveloperTokenSource;\n  cacheFile: string;\n  cacheStatus: \"valid\" | \"expired\" | \"other-platform\" | \"missing\";\n}\n\n/** Metadata-only token discovery. Never returns credential plaintext. */\nexport function developerTokenStatus(\n  context: ResolvedOperatorContext,\n  parsed: ParsedArgv,\n  now = Date.now(),\n): DeveloperTokenStatus {\n  const cached = readJsonFile<{\n    token?: string;\n    platform?: string;\n    expiresAt?: number;\n  }>(context.cfg.local.tokenFile);\n  const cacheStatus: DeveloperTokenStatus[\"cacheStatus\"] = !cached?.token\n    ? \"missing\"\n    : cached.platform !== context.platform.value\n      ? \"other-platform\"\n      : (cached.expiresAt ?? 0) <= now + 60_000\n        ? \"expired\"\n        : \"valid\";\n  const source: DeveloperTokenSource = clean(\n    stringOpt(parsed.options.token),\n  )\n    ? \"flag\"\n    : clean(process.env.ODLA_DEV_TOKEN)\n      ? \"environment\"\n      : cacheStatus === \"valid\"\n        ? \"cache\"\n        : \"missing\";\n  return {\n    source,\n    cacheFile: context.cfg.local.tokenFile,\n    cacheStatus,\n  };\n}\n\nfunction clean(value: string | undefined): string | undefined {\n  const normalized = value?.trim();\n  return normalized || undefined;\n}\n","import { assertArgs, type ParsedArgv } from \"./argv\";\nimport { developerTokenStatus } from \"./operator-credentials\";\nimport { resolveOperatorContext } from \"./operator-context\";\nimport {\n  listOperatorProfiles,\n  removeOperatorProfile,\n  saveOperatorProfile,\n} from \"./operator-profiles\";\n\ninterface ContextDeps {\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/** Explain local operator context and credential provenance without auth. */\nexport async function contextCommand(\n  parsed: ParsedArgv,\n  deps: ContextDeps = {},\n): Promise<void> {\n  assertArgs(\n    parsed,\n    [\n      \"config\",\n      \"context\",\n      \"platform\",\n      \"app\",\n      \"env\",\n      \"token\",\n      \"json\",\n      \"yes\",\n    ],\n    3,\n  );\n  const action = parsed.positionals[1];\n  const out = deps.stdout ?? console;\n  if (action === \"list\") {\n    const profiles = listOperatorProfiles();\n    if (parsed.options.json === true) {\n      out.log(JSON.stringify({ schemaVersion: 1, profiles }, null, 2));\n      return;\n    }\n    if (profiles.length === 0) {\n      out.log(\"No named operator contexts.\");\n      return;\n    }\n    out.log(\"name\\tplatform\\tapp\\tenvironment\");\n    for (const profile of profiles) {\n      out.log(\n        `${profile.name}\\t${profile.platform}\\t${profile.app ?? \"\"}\\t${profile.environment ?? \"\"}`,\n      );\n    }\n    return;\n  }\n  if (action === \"save\") {\n    if (parsed.options.token !== undefined) {\n      throw new Error(\n        \"context save does not accept --token; contexts store scope metadata only\",\n      );\n    }\n    const name = requireName(parsed);\n    const context = await resolveOperatorContext(parsed, {\n      allowMissingConfig: true,\n    });\n    const profile = {\n      platform: context.platform.value,\n      ...(context.app.value ? { app: context.app.value } : {}),\n      ...(context.environment.value\n        ? { environment: context.environment.value }\n        : {}),\n    };\n    saveOperatorProfile(name, profile, context.profile.file);\n    if (parsed.options.json === true) {\n      out.log(JSON.stringify({ schemaVersion: 1, name, ...profile }, null, 2));\n    } else {\n      out.log(`saved operator context \"${name}\" (${profile.platform})`);\n    }\n    return;\n  }\n  if (action === \"remove\") {\n    const name = requireName(parsed);\n    if (parsed.options.yes !== true) {\n      throw new Error(`context remove \"${name}\" requires --yes`);\n    }\n    const removed = removeOperatorProfile(name);\n    const result = {\n      schemaVersion: 1,\n      name,\n      removed,\n      credentialCachesRemoved: false,\n      grantsRevoked: false,\n    };\n    if (parsed.options.json === true) out.log(JSON.stringify(result, null, 2));\n    else {\n      const status = removed\n        ? `removed operator context \"${name}\"`\n        : `operator context \"${name}\" was already absent`;\n      out.log(`${status}; credential caches were not deleted or revoked`);\n    }\n    return;\n  }\n  if (action !== \"show\") {\n    throw new Error(\n      `unknown context action \"${action ?? \"\"}\". Try show|list|save|remove.`,\n    );\n  }\n  const context = await resolveOperatorContext(parsed, {\n    allowMissingConfig: true,\n    defaultEnvironment: \"prod\",\n  });\n  const token = developerTokenStatus(context, parsed);\n  const result = {\n    schemaVersion: 1,\n    profile: context.profile,\n    config: context.config,\n    platform: context.platform,\n    app: context.app,\n    environment: context.environment,\n    authentication: {\n      developerToken: token,\n      scopedTokenCacheFile: context.credentials.scopedTokenFile,\n      handshakeStarted: false,\n    },\n  };\n  if (parsed.options.json === true) {\n    out.log(JSON.stringify(result, null, 2));\n    return;\n  }\n  out.log(`config:    ${context.config.status} (${context.config.path})`);\n  out.log(\n    `context:   ${context.profile.name ?? \"(none)\"} (${context.profile.source}; ${context.profile.file})`,\n  );\n  out.log(\n    `platform:  ${context.platform.value} (${context.platform.source})`,\n  );\n  out.log(\n    `app:       ${context.app.value ?? \"(unresolved)\"} (${context.app.source})`,\n  );\n  out.log(\n    `env:       ${context.environment.value ?? \"(unresolved)\"} (${context.environment.source})`,\n  );\n  out.log(\n    `auth:      ${token.source} (cache ${token.cacheStatus}: ${token.cacheFile})`,\n  );\n  out.log(\"handshake: not started\");\n}\n\nfunction requireName(parsed: ParsedArgv): string {\n  const name = parsed.positionals[2]?.trim();\n  if (!name) {\n    throw new Error(`context ${parsed.positionals[1]} needs a profile name`);\n  }\n  return name;\n}\n","// Action handlers for `odla-ai discuss ...` — thin REST calls to the registry's\n// `/registry/discuss/...` routes, authed with the developer device grant (the\n// same pattern as `pm`). Output is a tab-separated table, or `--json`.\n//\n// This is the surface a LOCAL agent uses: it opens a topic to ask a question,\n// then polls for the answer. So every command is non-interactive, `--json` is a\n// first-class shape, and `watch` exits with a distinct code when nothing arrived\n// rather than blocking a session forever.\nimport { stringOpt, type ParsedArgv } from \"./argv\";\n\n/** Exit code for `discuss watch` timing out with nothing new — distinct from a\n * failure, so a script can tell \"no answer yet\" from \"the call broke\". */\nexport const WATCH_TIMEOUT_EXIT = 75;\n\nexport interface DiscussContext {\n  platformUrl: string;\n  token: string;\n  doFetch: typeof fetch;\n  out: Pick<typeof console, \"log\" | \"error\">;\n  json: boolean;\n  /** Optional projectless app scope supplied by ODLA_APP_ID. */\n  appId?: string;\n  /** Injected so tests do not sleep in real time. */\n  sleep?: (ms: number) => Promise<void>;\n  now?: () => number;\n}\n\nexport interface TopicRow {\n  id: string;\n  appId?: string;\n  subject: string;\n  authorId: string;\n  authorKind?: string;\n  createdAt: number;\n  lastActivityAt: number;\n  replyCount: number;\n  resolved?: boolean;\n  resolvedAt?: number;\n  pinned?: boolean;\n}\n\ninterface PostRow {\n  id: string;\n  authorId: string;\n  authorKind?: string;\n  body: string;\n  createdAt: number;\n  refs?: Array<{ kind: string; id: string; label: string; start: number; end: number }>;\n  attachments?: Array<{ name: string; size: number }>;\n}\n\ninterface TopicPostPage {\n  limit: number;\n  offset: number;\n  hasMore: boolean;\n  nextOffset: number | null;\n}\n\ninterface TopicPage {\n  topics: TopicRow[];\n  total: number;\n  limit: number;\n  offset: number;\n}\n\nconst writeMutationId = (parsed: ParsedArgv): string =>\n  stringOpt(parsed.options[\"mutation-id\"]) ?? crypto.randomUUID();\n\nasync function request<T>(ctx: DiscussContext, method: string, path: string, body?: unknown): Promise<T> {\n  const res = await ctx.doFetch(`${ctx.platformUrl}/registry/discuss${path}`, {\n    method,\n    headers: { authorization: `Bearer ${ctx.token}`, \"content-type\": \"application/json\" },\n    body: body === undefined ? undefined : JSON.stringify(body),\n  });\n  const data = (await res.json().catch(() => ({}))) as { error?: string } & Record<string, unknown>;\n  if (!res.ok)\n    throw new Error(`discuss ${method} ${path} failed: ${data.error ?? `registry returned ${res.status}`}`);\n  return data as T;\n}\n\n/** Emit `value` as pretty JSON under `--json`, else run the human formatter. */\nfunction emit(ctx: DiscussContext, value: unknown, human: () => void): void {\n  if (ctx.json) ctx.out.log(JSON.stringify(value, null, 2));\n  else human();\n}\n\n// `resolved` is the boolean truth; resolvedAt only records when. A date\n// attr seeded to 0 reads back as the epoch STRING, which is truthy.\nconst state = (topic: TopicRow): string => (topic.resolved ? \"resolved\" : \"open\");\n\n/** The post body an agent should read: prose with its links restored as\n * `@[Label](kind/id)` markup, so a reply can copy and reuse them. */\nfunction bodyWithRefs(post: PostRow): string {\n  if (!post.refs || post.refs.length === 0) return post.body;\n  let out = \"\";\n  let cursor = 0;\n  for (const ref of [...post.refs].sort((a, b) => a.start - b.start)) {\n    if (ref.start < cursor || ref.end > post.body.length) continue;\n    out += post.body.slice(cursor, ref.start) + `@[${ref.label}](${ref.kind}/${ref.id})`;\n    cursor = ref.end;\n  }\n  return out + post.body.slice(cursor);\n}\n\n/** The content flags shared by `post` and `reply`. `--body` is plain prose;\n * `--markup` additionally carries `@[Label](kind/id)` mentions. */\nfunction content(parsed: ParsedArgv): { body?: string; markup?: string } {\n  const markup = stringOpt(parsed.options.markup);\n  if (markup) return { markup };\n  const body = stringOpt(parsed.options.body);\n  if (!body) throw new Error(\"needs --body \\\"…\\\" (or --markup with @[Label](kind/id) mentions)\");\n  return { body };\n}\n\n/** `discuss groups` — the projects you can post in. */\nexport async function discussGroups(ctx: DiscussContext): Promise<void> {\n  const result = await request<{ groups: Array<{ appId: string; name: string; channelId: string | null }> }>(\n    ctx,\n    \"GET\",\n    \"/groups\",\n  );\n  emit(ctx, result, () => {\n    ctx.out.log(\"app\\tname\\tstarted\");\n    for (const group of result.groups) {\n      ctx.out.log(`${group.appId}\\t${group.name}\\t${group.channelId ? \"yes\" : \"no\"}`);\n    }\n  });\n}\n\n/** `discuss list` — the inbox, across your projects or scoped to one. */\nexport async function discussList(ctx: DiscussContext, parsed: ParsedArgv): Promise<void> {\n  const query = new URLSearchParams();\n  const app = stringOpt(parsed.options.app) ?? ctx.appId;\n  if (app) query.set(\"app\", app);\n  for (const [flag, param] of [\n    [\"q\", \"q\"],\n    [\"state\", \"state\"],\n    [\"limit\", \"limit\"],\n    [\"offset\", \"offset\"],\n  ] as const) {\n    const value = stringOpt(parsed.options[flag]);\n    if (value) query.set(param, value);\n  }\n  const qs = query.toString();\n  const page = await request<TopicPage>(ctx, \"GET\", `/topics${qs ? `?${qs}` : \"\"}`);\n  emit(ctx, page, () => {\n    ctx.out.log(`topics — ${page.topics.length} of ${page.total}`);\n    ctx.out.log(\"id\\tstate\\tapp\\treplies\\tsubject\");\n    for (const topic of page.topics) {\n      ctx.out.log(\n        `${topic.id}\\t${state(topic)}\\t${topic.appId ?? \"\"}\\t${topic.replyCount}\\t${topic.subject}`,\n      );\n    }\n  });\n}\n\n/** `discuss read <id>` — one whole conversation. */\nexport async function discussRead(ctx: DiscussContext, id: string, parsed: ParsedArgv): Promise<void> {\n  type ReadPage = { topic: TopicRow; posts: PostRow[]; page?: TopicPostPage };\n  const requestedLimit = stringOpt(parsed.options.limit);\n  const requestedOffset = stringOpt(parsed.options.offset);\n  if (requestedLimit !== undefined || requestedOffset !== undefined) {\n    const query = new URLSearchParams({\n      limit: requestedLimit ?? \"200\",\n      offset: requestedOffset ?? \"0\",\n    });\n    const page = await request<ReadPage>(ctx, \"GET\", `/topics/${encodeURIComponent(id)}?${query}`);\n    emit(ctx, page, () => renderRead(ctx, page.topic, page.posts));\n    return;\n  }\n\n  for (let scan = 0; scan < 3; scan++) {\n    const posts = new Map<string, PostRow>();\n    let topic: TopicRow | null = null;\n    let offset = 0;\n    for (;;) {\n      const page = await request<ReadPage>(\n        ctx,\n        \"GET\",\n        `/topics/${encodeURIComponent(id)}?limit=200&offset=${offset}`,\n      );\n      topic = page.topic;\n      for (const post of page.posts) posts.set(post.id, post);\n      if (posts.size > 10_000) throw new Error(\"discuss read failed: conversation exceeds 10000 posts\");\n      if (!page.page?.hasMore) break;\n      if (page.page.nextOffset === null || page.page.nextOffset <= offset) {\n        throw new Error(\"discuss read failed: registry returned a non-advancing post page\");\n      }\n      offset = page.page.nextOffset;\n    }\n    const ordered = [...posts.values()].sort(\n      (a, b) => a.createdAt - b.createdAt || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0),\n    );\n    const expected = Number.isInteger(topic!.replyCount) ? topic!.replyCount + 1 : ordered.length;\n    if (ordered.length === expected) {\n      const result = { topic: topic!, posts: ordered };\n      emit(ctx, result, () => renderRead(ctx, result.topic, result.posts));\n      return;\n    }\n    if (offset === 0) throw new Error(\"discuss read failed: registry did not provide forward post pages\");\n  }\n  throw new Error(\"discuss read failed: conversation changed during every complete-read attempt\");\n}\n\nfunction renderRead(ctx: DiscussContext, topic: TopicRow, posts: PostRow[]): void {\n  ctx.out.log(`${topic.subject}  [${state(topic)}]  ${topic.appId ?? \"\"}`);\n  for (const post of posts) {\n    const who = post.authorKind === \"bot\" ? `${post.authorId} (agent)` : post.authorId;\n    ctx.out.log(`\\n— ${who}`);\n    ctx.out.log(bodyWithRefs(post));\n    for (const file of post.attachments ?? []) ctx.out.log(`  [attachment] ${file.name} (${file.size} bytes)`);\n  }\n}\n\n/** `discuss post` — open a topic. */\nexport async function discussPost(ctx: DiscussContext, parsed: ParsedArgv): Promise<void> {\n  const appId = stringOpt(parsed.options.app) ?? ctx.appId;\n  if (!appId) throw new Error(\"discuss post needs --app <appId>\");\n  const subject = stringOpt(parsed.options.subject);\n  if (!subject) throw new Error('discuss post needs --subject \"…\"');\n  const created = await request<{ id: string }>(ctx, \"POST\", \"/topics\", {\n    appId,\n    subject,\n    ...content(parsed),\n    mutationId: writeMutationId(parsed),\n  });\n  emit(ctx, created, () => ctx.out.log(`opened topic ${created.id}`));\n}\n\n/** `discuss reply <id>` — add to a conversation. */\nexport async function discussReply(ctx: DiscussContext, id: string, parsed: ParsedArgv): Promise<void> {\n  const created = await request<{ id: string }>(\n    ctx,\n    \"POST\",\n    `/topics/${encodeURIComponent(id)}/replies`,\n    { ...content(parsed), mutationId: writeMutationId(parsed) },\n  );\n  emit(ctx, created, () => ctx.out.log(`replied ${created.id}`));\n}\n\n/** `discuss resolve <id>` / `--reopen`. */\nexport async function discussResolve(\n  ctx: DiscussContext,\n  id: string,\n  resolved: boolean,\n  parsed: ParsedArgv,\n): Promise<void> {\n  const result = await request<{ id: string; changed: boolean }>(\n    ctx,\n    \"PATCH\",\n    `/topics/${encodeURIComponent(id)}`,\n    { resolved, mutationId: writeMutationId(parsed) },\n  );\n  emit(ctx, result, () => ctx.out.log(`${resolved ? \"resolved\" : \"reopened\"} ${result.id}`));\n}\n\n/** `discuss who <query>` — what `@` would find, so an agent can spell a mention\n * correctly before posting it. */\nexport async function discussWho(ctx: DiscussContext, parsed: ParsedArgv): Promise<void> {\n  const query = new URLSearchParams({ q: stringOpt(parsed.options.q) ?? \"\" });\n  const app = stringOpt(parsed.options.app) ?? ctx.appId;\n  if (app) query.set(\"app\", app);\n  const kinds = stringOpt(parsed.options.kinds);\n  if (kinds) query.set(\"kinds\", kinds);\n  const found = await request<{\n    items: Array<{ kind: string; id: string; label: string; hint?: string }>;\n    failed: string[];\n  }>(ctx, \"GET\", `/mentionables?${query.toString()}`);\n  emit(ctx, found, () => {\n    ctx.out.log(\"mention\\tkind\\thint\");\n    for (const item of found.items) {\n      ctx.out.log(`@[${item.label}](${item.kind}/${item.id})\\t${item.kind}\\t${item.hint ?? \"\"}`);\n    }\n    if (found.failed.length > 0) ctx.out.error(`(no results from: ${found.failed.join(\", \")})`);\n  });\n}\n","// HTTP protocol boundary for `discuss watch`. Keeping transport failures and\n// wire shapes separate leaves the polling loop focused on cursor progression.\nimport type { DiscussContext, TopicRow } from \"./discuss-actions\";\n\nexport interface WatchPost {\n  id: string;\n  authorId: string;\n  authorKind?: string;\n  body: string;\n  createdAt: number;\n}\n\nexport interface WatchEvent {\n  id: string;\n  cursor: string;\n  type: \"message\" | \"activity\";\n  action: \"created\" | \"updated\";\n  createdAt: number;\n  actor: { kind: \"user\" | \"agent\"; id: string };\n  payload: WatchPost | TopicRow;\n}\n\nexport interface WatchPage {\n  streamId: string;\n  cursor: string;\n  events: WatchEvent[];\n  hasMore: boolean;\n  serverTime: number;\n}\n\ninterface WatchErrorBody {\n  error?: string;\n  code?: string;\n  cursor?: string;\n  streamId?: string;\n}\n\nexport class WatchRequestError extends Error {\n  constructor(\n    message: string,\n    readonly retryable: boolean,\n    readonly status?: number,\n    readonly code?: string,\n  ) {\n    super(message);\n    this.name = \"WatchRequestError\";\n  }\n}\n\n/** Explicit server signal that restore/truncation invalidated the cursor. */\nexport class WatchCheckpointError extends Error {\n  readonly code = \"checkpoint_required\";\n  constructor(\n    readonly cursor?: string,\n    readonly streamId?: string,\n  ) {\n    super(\"discussion cursor requires a new checkpoint\");\n    this.name = \"WatchCheckpointError\";\n  }\n}\n\n/** Retryable dependency failure after bounded in-process recovery. */\nexport class WatchRemoteError extends Error {\n  readonly code = \"remote_unavailable\";\n  constructor(\n    readonly cursor: string | undefined,\n    cause: unknown,\n  ) {\n    super(\"discussion watch dependency remained unavailable\", { cause });\n    this.name = \"WatchRemoteError\";\n  }\n}\n\n/** Thrown when an explicitly bounded watch ends with nothing new. */\nexport class WatchTimeoutError extends Error {\n  readonly code = \"watch_timeout\";\n  constructor(readonly cursor?: string) {\n    super(\"nothing new before the timeout\");\n    this.name = \"WatchTimeoutError\";\n  }\n}\n\nexport function requestPath(topicId: string | undefined, app: string | undefined, cursor: string | undefined): string {\n  const params = new URLSearchParams();\n  if (topicId) params.set(\"topic\", topicId);\n  if (app) params.set(\"app\", app);\n  if (cursor) params.set(\"cursor\", cursor);\n  return `/watch?${params}`;\n}\n\nexport async function getWatchPage(ctx: DiscussContext, path: string): Promise<WatchPage> {\n  let res: Response;\n  try {\n    res = await ctx.doFetch(`${ctx.platformUrl}/registry/discuss${path}`, {\n      headers: { authorization: `Bearer ${ctx.token}` },\n    });\n  } catch (error) {\n    throw new WatchRequestError(\n      `discuss watch request failed: ${error instanceof Error ? error.message : String(error)}`,\n      true,\n    );\n  }\n  const data = (await res.json().catch(() => ({}))) as WatchErrorBody & Record<string, unknown>;\n  if (res.status === 409 && data.code === \"checkpoint_required\") {\n    throw new WatchCheckpointError(data.cursor, data.streamId);\n  }\n  if (!res.ok) {\n    throw new WatchRequestError(\n      `discuss watch failed: ${data.error ?? `registry returned ${res.status}`}`,\n      res.status === 429 || res.status >= 500,\n      res.status,\n      data.code ?? (res.status === 401 || res.status === 403 ? \"auth_failed\" : undefined),\n    );\n  }\n  return data as unknown as WatchPage;\n}\n","// `odla-ai discuss watch` — consume the server-issued discussion cursor until\n// matching activity arrives. The cursor, not client time or a bounded topic\n// snapshot, is the source of truth: retries never advance it, restore/truncation\n// is explicit, and JSONL consumers can persist an event cursor mid-page.\nimport { stringOpt, type ParsedArgv } from \"./argv\";\nimport { type DiscussContext, type TopicRow } from \"./discuss-actions\";\nimport {\n  getWatchPage,\n  requestPath,\n  WatchCheckpointError,\n  WatchRemoteError,\n  WatchRequestError,\n  WatchTimeoutError,\n  type WatchEvent,\n  type WatchPage,\n  type WatchPost,\n} from \"./discuss-watch-http\";\n\nexport { WatchCheckpointError, WatchRemoteError, WatchTimeoutError } from \"./discuss-watch-http\";\n\nconst DEFAULT_INTERVAL_MS = 15_000;\nconst MAX_CONSECUTIVE_FAILURES = 5;\nconst MAX_BACKOFF_MS = 30_000;\n\nfunction numberOpt(parsed: ParsedArgv, flag: string, fallback?: number): number | undefined {\n  const raw = stringOpt(parsed.options[flag]);\n  const value = raw == null ? NaN : Number(raw);\n  return Number.isFinite(value) && value > 0 ? value : fallback;\n}\n\n/** What a completed watch reports. */\nexport interface WatchResult {\n  /** True when matching activity arrived; false on an explicit timeout. */\n  found: boolean;\n  /** Server cursor after everything in this result has been consumed. */\n  cursor: string;\n  /** Stable, versioned events for structured callers. */\n  events?: WatchEvent[];\n  /** New posts in the watched topic, oldest first. */\n  posts?: WatchPost[];\n  /** Topics with new activity, when watching the inbox. */\n  topics?: TopicRow[];\n}\n\nfunction jsonl(ctx: DiscussContext, parsed: ParsedArgv, value: Record<string, unknown>): void {\n  if (parsed.options.jsonl === true) ctx.out.log(JSON.stringify({ v: 1, ...value }));\n}\n\n/**\n * Watch one topic or the cross-project inbox from a resumable server cursor.\n *\n * Without `--cursor`, the first request establishes a checkpoint and does not\n * replay old activity. `--timeout` is optional; without it the watch is\n * intentionally unbounded. `--jsonl` emits checkpoint, event, heartbeat, and\n * degraded-status records suitable for a remote agent supervisor.\n */\nexport async function discussWatch(\n  ctx: DiscussContext,\n  topicId: string | undefined,\n  parsed: ParsedArgv,\n): Promise<WatchResult> {\n  if (ctx.json && parsed.options.jsonl === true) throw new Error(\"--json and --jsonl cannot be combined\");\n  const sleep = ctx.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));\n  const now = ctx.now ?? Date.now;\n  const intervalMs = (numberOpt(parsed, \"interval\", DEFAULT_INTERVAL_MS / 1000) ?? DEFAULT_INTERVAL_MS / 1000) * 1000;\n  const timeoutSeconds = numberOpt(parsed, \"timeout\");\n  const deadline = timeoutSeconds === undefined ? undefined : now() + timeoutSeconds * 1000;\n  const by = stringOpt(parsed.options.by);\n  const self = stringOpt(parsed.options.self);\n  const app = stringOpt(parsed.options.app) ?? ctx.appId;\n  let cursor = stringOpt(parsed.options.cursor);\n  let firstSuccess = true;\n  let consecutiveFailures = 0;\n\n  for (;;) {\n    let page: WatchPage;\n    try {\n      page = await getWatchPage(ctx, requestPath(topicId, app, cursor));\n      consecutiveFailures = 0;\n    } catch (error) {\n      if (!(error instanceof WatchRequestError) || !error.retryable) {\n        if (error instanceof WatchCheckpointError) {\n          jsonl(ctx, parsed, {\n            type: \"status\",\n            state: \"checkpoint_required\",\n            retryable: false,\n            ...(error.cursor ? { cursor: error.cursor } : {}),\n            ...(error.streamId ? { streamId: error.streamId } : {}),\n          });\n        }\n        throw error;\n      }\n      consecutiveFailures++;\n      jsonl(ctx, parsed, {\n        type: \"status\",\n        state: \"degraded\",\n        retryable: true,\n        attempt: consecutiveFailures,\n        ...(cursor ? { cursor } : {}),\n        ...(error.status ? { status: error.status } : {}),\n      });\n      if (consecutiveFailures >= MAX_CONSECUTIVE_FAILURES) {\n        throw new WatchRemoteError(cursor, error);\n      }\n      if (deadline !== undefined && now() >= deadline) {\n        const result = report(ctx, parsed, { found: false, cursor: cursor ?? \"\" });\n        throw new WatchTimeoutError(result.cursor);\n      }\n      const base = Math.min(intervalMs, 1000);\n      const backoff = Math.min(MAX_BACKOFF_MS, base * 2 ** (consecutiveFailures - 1));\n      await sleep(deadline === undefined ? backoff : Math.min(backoff, Math.max(0, deadline - now())));\n      continue;\n    }\n\n    cursor = page.cursor;\n    const baseline = firstSuccess && page.events.length === 0;\n    if (baseline) {\n      jsonl(ctx, parsed, {\n        type: \"checkpoint\",\n        streamId: page.streamId,\n        cursor,\n        serverTime: page.serverTime,\n      });\n    }\n    firstSuccess = false;\n\n    const matching = page.events.filter((event) => {\n      if (topicId && (event.type !== \"message\" || event.action !== \"created\")) return false;\n      return (!by || event.actor.id === by) && (!self || event.actor.id !== self);\n    });\n    for (const event of matching) {\n      jsonl(ctx, parsed, {\n        type: \"event\",\n        streamId: page.streamId,\n        eventId: event.id,\n        cursor: event.cursor,\n        event,\n      });\n    }\n    if (matching.length > 0) {\n      jsonl(ctx, parsed, {\n        type: \"checkpoint\",\n        streamId: page.streamId,\n        cursor,\n        serverTime: page.serverTime,\n      });\n      const posts = topicId\n        ? matching.filter((event) => event.type === \"message\").map((event) => event.payload as WatchPost)\n        : undefined;\n      const topics = topicId\n        ? undefined\n        : matching.filter((event) => event.type === \"activity\").map((event) => event.payload as TopicRow);\n      return report(ctx, parsed, {\n        found: true,\n        cursor,\n        events: matching,\n        ...(posts && posts.length > 0 ? { posts } : {}),\n        ...(topics && topics.length > 0 ? { topics } : {}),\n      });\n    }\n\n    if (page.events.length > 0) {\n      // Filtered events were still consumed. Persist the page checkpoint so a\n      // restart does not replay them forever.\n      jsonl(ctx, parsed, {\n        type: \"checkpoint\",\n        streamId: page.streamId,\n        cursor,\n        serverTime: page.serverTime,\n      });\n    } else if (!baseline) {\n      jsonl(ctx, parsed, {\n        type: \"heartbeat\",\n        streamId: page.streamId,\n        cursor,\n        serverTime: page.serverTime,\n      });\n    }\n\n    // Drain a server backlog immediately; sleep only at the live edge.\n    if (page.hasMore) continue;\n    if (deadline !== undefined && now() >= deadline) {\n      return report(ctx, parsed, { found: false, cursor });\n    }\n    const wait = deadline === undefined ? intervalMs : Math.min(intervalMs, Math.max(0, deadline - now()));\n    await sleep(wait);\n  }\n}\n\nfunction report(ctx: DiscussContext, parsed: ParsedArgv, result: WatchResult): WatchResult {\n  if (ctx.json) {\n    ctx.out.log(JSON.stringify(result, null, 2));\n  } else if (parsed.options.jsonl !== true && result.found) {\n    for (const post of result.posts ?? []) {\n      const who = post.authorKind === \"bot\" ? `${post.authorId} (agent)` : post.authorId;\n      ctx.out.log(`— ${who}\\n${post.body}`);\n    }\n    for (const topic of result.topics ?? []) {\n      ctx.out.log(`${topic.id}\\t${topic.appId ?? \"\"}\\t${topic.subject}`);\n    }\n  }\n  return result;\n}\n","// `odla-ai discuss <action>` — read and write a project's group discussion from\n// a terminal or a local agent. A thin front-end over the registry's\n// /registry/discuss routes; auth is the developer device grant (same as `pm`).\n//\n// With no --app, reads span every project you co-own; with --app they scope to\n// one. `watch` is the piece that makes this usable unattended: post a question,\n// watch for the answer, continue.\nimport { assertArgs, type ParsedArgv, stringOpt } from \"./argv\";\nimport { resolveOperatorContext } from \"./operator-context\";\nimport {\n  discussGroups,\n  discussList,\n  discussPost,\n  discussRead,\n  discussReply,\n  discussResolve,\n  discussWho,\n  type DiscussContext,\n} from \"./discuss-actions\";\nimport { discussWatch, WatchTimeoutError } from \"./discuss-watch\";\nimport { getDeveloperToken } from \"./token\";\n\nconst ALLOWED = [\n  \"config\", \"token\", \"email\", \"json\", \"app\", \"subject\", \"body\", \"markup\",\n  \"state\", \"q\", \"kinds\", \"limit\", \"offset\", \"reopen\", \"by\", \"self\",\n  \"interval\", \"timeout\", \"cursor\", \"jsonl\",\n  \"mutation-id\", \"platform\", \"context\",\n];\n\ninterface DiscussDeps {\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\nfunction requireId(id: string | undefined, action: string): string {\n  if (!id) throw new Error(`\"discuss ${action}\" needs a topic id`);\n  return id;\n}\n\nasync function buildContext(parsed: ParsedArgv, deps: DiscussDeps): Promise<DiscussContext> {\n  const context = await resolveOperatorContext(parsed, {\n    allowMissingConfig: true,\n  });\n  const { cfg } = context;\n  const doFetch = deps.fetch ?? fetch;\n  const out = deps.stdout ?? console;\n  const token = await getDeveloperToken(\n    cfg,\n    {\n      configPath: cfg.configPath,\n      token: stringOpt(parsed.options.token),\n      email: stringOpt(parsed.options.email),\n      open: false,\n    },\n    doFetch,\n    out,\n  );\n  return {\n    platformUrl: cfg.platformUrl,\n    token,\n    doFetch,\n    out,\n    json: parsed.options.json === true,\n    // Preserve Discussions' existing cross-project default for config-backed\n    // use while allowing remote agents to scope via ODLA_APP_ID or a profile.\n    appId:\n      context.app.source === \"environment\" || context.app.source === \"profile\"\n        ? context.app.value ?? undefined\n        : undefined,\n  };\n}\n\n/**\n * Run one `discuss` action.\n *\n * `watch` throws {@link WatchTimeoutError} when nothing arrived, which the CLI's\n * `exitCodeFor` maps to 75 (EX_TEMPFAIL) — so a script can tell \"no answer yet\"\n * from \"that failed\", and rerunning simply keeps waiting.\n */\nexport async function discussCommand(parsed: ParsedArgv, deps: DiscussDeps = {}): Promise<void> {\n  // `discuss <action> [<topic>]` — three positionals at most.\n  assertArgs(parsed, ALLOWED, 3);\n  const action = parsed.positionals[1];\n  const id = parsed.positionals[2];\n  if (!action) throw new Error('\"discuss\" needs an action. Run \"odla-ai help\".');\n  const ctx = await buildContext(parsed, deps);\n\n  switch (action) {\n    case \"groups\":\n      return discussGroups(ctx);\n    case \"list\":\n    case \"topics\":\n      return discussList(ctx, parsed);\n    case \"read\":\n      return discussRead(ctx, requireId(id, \"read\"), parsed);\n    case \"post\":\n      return discussPost(ctx, parsed);\n    case \"reply\":\n      return discussReply(ctx, requireId(id, \"reply\"), parsed);\n    case \"resolve\":\n      // `--reopen` is the inverse of the same PATCH, so one action covers both\n      // directions rather than two verbs that can drift apart.\n      return discussResolve(ctx, requireId(id, \"resolve\"), parsed.options.reopen !== true, parsed);\n    case \"who\":\n      return discussWho(ctx, parsed);\n    case \"watch\": {\n      const result = await discussWatch(ctx, id, parsed);\n      if (!result.found) throw new WatchTimeoutError(result.cursor);\n      return;\n    }\n    default:\n      throw new Error(`unknown discuss action \"${action}\". Run \"odla-ai help\".`);\n  }\n}\n","// Action handlers for `odla-ai pm <entity> <action>` — thin REST calls to the\n// registry's `/registry/pm/...` routes, authed with the developer device grant\n// (the same pattern as `app owners`). Output is a tab-separated table, or `--json`.\nimport { stringOpt, type ParsedArgv } from \"./argv\";\n\nexport type PmEntity = \"goal\" | \"task\" | \"decision\" | \"bug\";\n\nexport interface PmContext {\n  platformUrl: string;\n  token: string;\n  doFetch: typeof fetch;\n  out: Pick<typeof console, \"log\" | \"error\">;\n  json: boolean;\n  /** Optional projectless app scope supplied by ODLA_APP_ID. */\n  appId?: string;\n}\n\ninterface PmRecord {\n  id: string;\n  appId: string;\n  title?: string;\n  status?: string;\n  severity?: string;\n  column?: string;\n  decisionId?: string;\n  [key: string]: unknown;\n}\ninterface PmPage {\n  records: PmRecord[];\n  total: number;\n  limit: number;\n  offset: number;\n}\n\nconst writeMutationId = (parsed: ParsedArgv): string =>\n  stringOpt(parsed.options[\"mutation-id\"]) ?? crypto.randomUUID();\n\n// CLI flag → PM input/patch field. Filter params reuse the same field names.\nconst FIELD_MAP: Record<string, { key: string; num?: boolean }> = {\n  title: { key: \"title\" },\n  status: { key: \"status\" },\n  severity: { key: \"severity\" },\n  column: { key: \"column\" },\n  rank: { key: \"rank\", num: true },\n  goal: { key: \"goalId\" },\n  decision: { key: \"decisionId\" },\n  assignee: { key: \"assigneeId\" },\n  due: { key: \"dueAt\", num: true },\n  proof: { key: \"proof\" },\n  body: { key: \"body\" },\n  target: { key: \"targetPct\", num: true },\n  description: { key: \"description\" },\n  desc: { key: \"description\" },\n};\n\nconst DONE: Record<PmEntity, Record<string, unknown>> = {\n  goal: { status: \"met\", currentPct: 100 },\n  task: { column: \"done\" },\n  decision: { status: \"accepted\" },\n  bug: { status: \"fixed\" },\n};\n\nasync function pmRequest<T>(ctx: PmContext, method: string, path: string, body?: unknown): Promise<T> {\n  const res = await ctx.doFetch(`${ctx.platformUrl}/registry/pm${path}`, {\n    method,\n    headers: { authorization: `Bearer ${ctx.token}`, \"content-type\": \"application/json\" },\n    body: body === undefined ? undefined : JSON.stringify(body),\n  });\n  const data = (await res.json().catch(() => ({}))) as { error?: string } & Record<string, unknown>;\n  if (!res.ok) throw new Error(`pm ${method} ${path} failed: ${data.error ?? `registry returned ${res.status}`}`);\n  return data as T;\n}\n\n/** Build an input/patch from field flags. `--no-<field>` clears (null) when\n * `allowClear` (set only); a bare value writes it; a number field is coerced. */\nfunction collectFields(parsed: ParsedArgv, allowClear: boolean): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const [flag, spec] of Object.entries(FIELD_MAP)) {\n    const value = parsed.options[flag];\n    if (value === undefined || value === true) continue;\n    if (value === false) {\n      if (allowClear) out[spec.key] = null;\n      continue;\n    }\n    const text = stringOpt(value)!;\n    out[spec.key] = spec.num ? Number(text) : text;\n  }\n  return out;\n}\n\n/** Map the CLI's prose flags onto each entity's real stored field. `--body` is\n * retained as a convenient alias for task/bug descriptions. */\nfunction collectEntityFields(\n  entity: PmEntity,\n  parsed: ParsedArgv,\n  allowClear: boolean,\n): Record<string, unknown> {\n  const fields = collectFields(parsed, allowClear);\n  if ((entity === \"task\" || entity === \"bug\") && fields.body !== undefined) {\n    if (fields.description === undefined) fields.description = fields.body;\n    delete fields.body;\n  }\n  return fields;\n}\n\nfunction statusCol(entity: PmEntity, r: PmRecord): string {\n  if (entity === \"bug\") return `${r.status ?? \"\"}/${r.severity ?? \"\"}`;\n  if (entity === \"task\") return String(r.column ?? \"\");\n  return String(r.status ?? \"\");\n}\n\nfunction printRecord(ctx: PmContext, entity: PmEntity, r: PmRecord): void {\n  ctx.out.log(`${r.id}\\t[${statusCol(entity, r)}]\\t${r.appId}\\t${r.title ?? \"\"}`);\n}\n\n/** Emit `value` as pretty JSON under `--json`, else run the human formatter — the\n * single place the json/human branch lives. */\nfunction emit(ctx: PmContext, value: unknown, human: () => void): void {\n  if (ctx.json) ctx.out.log(JSON.stringify(value, null, 2));\n  else human();\n}\n\nexport async function pmList(ctx: PmContext, entity: PmEntity, parsed: ParsedArgv): Promise<void> {\n  const q = new URLSearchParams();\n  const filters: Record<string, string> = {\n    status: \"status\",\n    severity: \"severity\",\n    column: \"column\",\n    goal: \"goalId\",\n    assignee: \"assigneeId\",\n    decision: \"decisionId\",\n  };\n  const app = stringOpt(parsed.options.app) ?? ctx.appId;\n  if (app) q.set(\"app\", app);\n  for (const [flag, param] of Object.entries(filters)) {\n    const v = stringOpt(parsed.options[flag]);\n    if (v) q.set(param, v);\n  }\n  for (const opt of [\"q\", \"limit\", \"offset\"]) {\n    const v = stringOpt(parsed.options[opt]);\n    if (v) q.set(opt, v);\n  }\n  const qs = q.toString();\n  const page = await pmRequest<PmPage>(ctx, \"GET\", `/${entity}${qs ? `?${qs}` : \"\"}`);\n  emit(ctx, page, () => {\n    ctx.out.log(`${entity} — ${page.records.length} of ${page.total}`);\n    ctx.out.log(\"id\\tstate\\tapp\\ttitle\");\n    for (const r of page.records) printRecord(ctx, entity, r);\n  });\n}\n\nexport async function pmAdd(ctx: PmContext, entity: PmEntity, parsed: ParsedArgv): Promise<void> {\n  const appId = stringOpt(parsed.options.app) ?? ctx.appId;\n  if (!appId) throw new Error(\"pm add needs --app <appId>\");\n  const input = collectEntityFields(entity, parsed, false);\n  if (!input.title) throw new Error(\"pm add needs --title <title>\");\n  if (entity === \"bug\" && !input.description)\n    throw new Error(\"pm bug add needs --description <context> (or --body <context>)\");\n  const res = await pmRequest<{ id: string; duplicate: boolean }>(ctx, \"POST\", `/${entity}`, {\n    appId,\n    input,\n    mutationId: writeMutationId(parsed),\n  });\n  emit(ctx, res, () => ctx.out.log(`created ${entity} ${res.id}`));\n}\n\nexport async function pmGet(ctx: PmContext, entity: PmEntity, id: string): Promise<void> {\n  const { record } = await pmRequest<{ record: PmRecord }>(ctx, \"GET\", `/${entity}/${encodeURIComponent(id)}`);\n  emit(ctx, record, () => printRecord(ctx, entity, record));\n}\n\nexport async function pmSet(ctx: PmContext, entity: PmEntity, id: string, parsed: ParsedArgv): Promise<void> {\n  const patch = collectEntityFields(entity, parsed, true);\n  if (Object.keys(patch).length === 0)\n    throw new Error(\"pm set needs at least one field flag (e.g. --status doing, --assignee me, --no-assignee)\");\n  const res = await pmRequest<{ record: PmRecord | null }>(ctx, \"PATCH\", `/${entity}/${encodeURIComponent(id)}`, {\n    patch,\n    mutationId: writeMutationId(parsed),\n  });\n  emit(ctx, res, () => ctx.out.log(res.record ? `${res.record.id}\\t[${statusCol(entity, res.record)}]\\t${res.record.appId}\\t${res.record.title ?? \"\"}` : `updated ${entity} ${id}`));\n}\n\nexport async function pmDone(\n  ctx: PmContext,\n  entity: PmEntity,\n  id: string,\n  parsed: ParsedArgv,\n): Promise<void> {\n  const decisionId = stringOpt(parsed.options.decision);\n  if (decisionId && entity !== \"bug\") throw new Error(\"--decision is only valid when completing a bug\");\n  const patch = { ...DONE[entity], ...(decisionId ? { decisionId } : {}) };\n  const res = await pmRequest(ctx, \"PATCH\", `/${entity}/${encodeURIComponent(id)}`, {\n    patch,\n    mutationId: writeMutationId(parsed),\n  });\n  emit(ctx, res, () => ctx.out.log(`${entity} ${id} → done`));\n}\n\nasync function allRecords(ctx: PmContext, entity: PmEntity, appId: string): Promise<PmRecord[]> {\n  const records: PmRecord[] = [];\n  for (;;) {\n    const q = new URLSearchParams({\n      app: appId,\n      limit: \"100\",\n      offset: String(records.length),\n    });\n    const page = await pmRequest<PmPage>(ctx, \"GET\", `/${entity}?${q}`);\n    records.push(...page.records);\n    if (records.length >= page.total || page.records.length === 0) return records;\n  }\n}\n\n/** Emit one authoritative handoff assembled from unresolved PM records. */\nexport async function pmHandoff(ctx: PmContext, parsed: ParsedArgv): Promise<void> {\n  const appId = stringOpt(parsed.options.app) ?? ctx.appId;\n  if (!appId) throw new Error(\"pm handoff needs --app <appId>\");\n  const [goals, tasks, bugs] = await Promise.all([\n    allRecords(ctx, \"goal\", appId),\n    allRecords(ctx, \"task\", appId),\n    allRecords(ctx, \"bug\", appId),\n  ]);\n  const handoff = {\n    appId,\n    unmetGoals: goals.filter((record) => record.status !== \"met\"),\n    activeTasks: tasks.filter((record) => record.column !== \"done\"),\n    openBugs: bugs.filter((record) => record.status !== \"fixed\" && record.status !== \"wontfix\"),\n  };\n  const result = {\n    ...handoff,\n    clean: !handoff.unmetGoals.length && !handoff.activeTasks.length && !handoff.openBugs.length,\n  };\n  emit(ctx, result, () => {\n    if (result.clean) {\n      ctx.out.log(`${appId}: no unresolved PM work`);\n      return;\n    }\n    ctx.out.log(`${appId}: authoritative PM handoff`);\n    for (const [label, records] of [\n      [\"unmet goals\", result.unmetGoals],\n      [\"active tasks\", result.activeTasks],\n      [\"open bugs\", result.openBugs],\n    ] as const) {\n      ctx.out.log(`${label}:`);\n      if (!records.length) ctx.out.log(\"- (none)\");\n      else for (const record of records) printRecord(\n        ctx,\n        label === \"unmet goals\" ? \"goal\" : label === \"active tasks\" ? \"task\" : \"bug\",\n        record,\n      );\n    }\n  });\n}\n\nexport async function pmComment(ctx: PmContext, entity: PmEntity, id: string, parsed: ParsedArgv): Promise<void> {\n  const body = stringOpt(parsed.options.body);\n  if (!body) throw new Error('pm comment needs --body \"...\"');\n  await pmRequest(ctx, \"POST\", `/${entity}/${encodeURIComponent(id)}/comments`, {\n    body,\n    mutationId: writeMutationId(parsed),\n  });\n  ctx.out.log(`commented on ${entity} ${id}`);\n}\n\nexport async function pmComments(ctx: PmContext, entity: PmEntity, id: string): Promise<void> {\n  const { messages } = await pmRequest<{ messages: Array<{ authorId?: string; body?: string }> }>(\n    ctx,\n    \"GET\",\n    `/${entity}/${encodeURIComponent(id)}/comments`,\n  );\n  emit(ctx, messages, () => {\n    if (messages.length === 0) ctx.out.log(\"(no comments)\");\n    else for (const m of messages) ctx.out.log(`[${m.authorId ?? \"?\"}] ${m.body ?? \"\"}`);\n  });\n}\n\nexport async function pmRemove(ctx: PmContext, entity: PmEntity, id: string): Promise<void> {\n  await pmRequest(ctx, \"DELETE\", `/${entity}/${encodeURIComponent(id)}`);\n  ctx.out.log(`deleted ${entity} ${id}`);\n}\n","// `odla-ai pm <goal|task|decision|bug> <action>` — manage a project's conformance\n// goals, kanban tasks, decisions, and bugs, shared across the projects you co-own.\n// A thin front-end over the registry's /registry/pm routes; auth is the developer\n// device grant (same as `app owners`). With no --app, list spans every co-owned\n// project (the cross-project view); with --app it scopes to one.\nimport { assertArgs, type ParsedArgv, stringOpt } from \"./argv\";\nimport { resolveOperatorContext } from \"./operator-context\";\nimport {\n  pmAdd,\n  pmComment,\n  pmComments,\n  pmDone,\n  pmGet,\n  pmHandoff,\n  pmList,\n  pmRemove,\n  pmSet,\n  type PmContext,\n  type PmEntity,\n} from \"./pm-actions\";\nimport { getDeveloperToken } from \"./token\";\n\n/** Accepted entity words → the canonical PM entity. */\nconst ALIASES: Record<string, PmEntity> = {\n  goal: \"goal\",\n  conformance: \"goal\",\n  task: \"task\",\n  kanban: \"task\",\n  decision: \"decision\",\n  bug: \"bug\",\n};\n\nconst COMMON_OPTIONS = [\"config\", \"token\", \"email\", \"json\", \"platform\", \"context\"];\nconst ACTION_OPTIONS = {\n  list: [\"app\", \"q\", \"limit\", \"offset\"],\n  add: [\"app\", \"title\", \"mutation-id\"],\n  get: [],\n  set: [\"mutation-id\"],\n  done: [\"mutation-id\"],\n  comment: [\"body\", \"mutation-id\"],\n  comments: [],\n  rm: [],\n} as const;\ntype PmAction = keyof typeof ACTION_OPTIONS;\n\nconst ENTITY_OPTIONS: Record<\n  PmEntity,\n  Record<\"list\" | \"add\" | \"set\" | \"done\", readonly string[]>\n> = {\n  goal: {\n    list: [\"status\"],\n    add: [\"status\", \"proof\", \"target\"],\n    set: [\"title\", \"status\", \"proof\", \"target\"],\n    done: [],\n  },\n  task: {\n    list: [\"column\", \"goal\", \"assignee\"],\n    add: [\"column\", \"goal\", \"assignee\", \"due\", \"description\", \"desc\", \"body\"],\n    set: [\"title\", \"column\", \"rank\", \"goal\", \"assignee\", \"due\", \"description\", \"desc\", \"body\"],\n    done: [],\n  },\n  decision: {\n    list: [\"status\"],\n    add: [\"status\", \"body\"],\n    set: [\"title\", \"status\", \"body\"],\n    done: [],\n  },\n  bug: {\n    list: [\"status\", \"severity\", \"goal\", \"assignee\", \"decision\"],\n    add: [\"status\", \"severity\", \"goal\", \"assignee\", \"decision\", \"description\", \"desc\", \"body\"],\n    set: [\"title\", \"status\", \"severity\", \"goal\", \"assignee\", \"decision\", \"description\", \"desc\", \"body\"],\n    done: [\"decision\"],\n  },\n};\n\nfunction canonicalAction(action: string): PmAction | null {\n  if (action === \"create\") return \"add\";\n  if (action === \"update\" || action === \"status\" || action === \"move\") return \"set\";\n  if (action === \"delete\") return \"rm\";\n  return action in ACTION_OPTIONS ? action as PmAction : null;\n}\n\nfunction allowedOptions(entity: PmEntity, action: PmAction): string[] {\n  const entityOptions =\n    action === \"list\" || action === \"add\" || action === \"set\" || action === \"done\"\n      ? ENTITY_OPTIONS[entity][action]\n      : [];\n  return [...COMMON_OPTIONS, ...ACTION_OPTIONS[action], ...entityOptions];\n}\n\ninterface PmDeps {\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\nfunction requireId(id: string | undefined, action: string): string {\n  if (!id) throw new Error(`\"pm ... ${action}\" needs an item id`);\n  return id;\n}\n\nasync function buildContext(parsed: ParsedArgv, deps: PmDeps): Promise<PmContext> {\n  const context = await resolveOperatorContext(parsed, {\n    allowMissingConfig: true,\n  });\n  const { cfg } = context;\n  const doFetch = deps.fetch ?? fetch;\n  const out = deps.stdout ?? console;\n  const token = await getDeveloperToken(\n    cfg,\n    { configPath: cfg.configPath, token: stringOpt(parsed.options.token), email: stringOpt(parsed.options.email), open: false },\n    doFetch,\n    out,\n  );\n  return {\n    platformUrl: cfg.platformUrl,\n    token,\n    doFetch,\n    out,\n    json: parsed.options.json === true,\n    // Preserve PM's existing cross-project default when a config is present;\n    // only an explicit remote-agent environment or profile selects an app.\n    appId:\n      context.app.source === \"environment\" || context.app.source === \"profile\"\n        ? context.app.value ?? undefined\n        : undefined,\n  };\n}\n\n/** Dispatch `odla-ai pm <entity> <action> [id]`. */\nexport async function pmCommand(parsed: ParsedArgv, deps: PmDeps = {}): Promise<void> {\n  const word = parsed.positionals[1] ?? \"\";\n  if (word === \"handoff\") {\n    assertArgs(parsed, [...COMMON_OPTIONS, \"app\"], 2);\n    return pmHandoff(await buildContext(parsed, deps), parsed);\n  }\n  const entity = ALIASES[word];\n  if (!entity) throw new Error(`unknown pm entity \"${word}\". Try \"odla-ai pm bug list\" (goal|task|decision|bug).`);\n  const requestedAction = parsed.positionals[2] ?? \"list\";\n  const action = canonicalAction(requestedAction);\n  if (!action) throw new Error(`unknown pm action \"${requestedAction}\". Try list|add|get|set|done|comment|comments|rm.`);\n  assertArgs(parsed, allowedOptions(entity, action), 4);\n  const ctx = await buildContext(parsed, deps);\n  const id = parsed.positionals[3];\n  switch (action) {\n    case \"list\":\n      return pmList(ctx, entity, parsed);\n    case \"add\":\n      return pmAdd(ctx, entity, parsed);\n    case \"get\":\n      return pmGet(ctx, entity, requireId(id, action));\n    case \"set\":\n      return pmSet(ctx, entity, requireId(id, action), parsed);\n    case \"done\":\n      return pmDone(ctx, entity, requireId(id, action), parsed);\n    case \"comment\":\n      return pmComment(ctx, entity, requireId(id, action), parsed);\n    case \"comments\":\n      return pmComments(ctx, entity, requireId(id, action));\n    case \"rm\":\n      return pmRemove(ctx, entity, requireId(id, action));\n  }\n}\n","export interface O11yRead {\n  httpStatus: number;\n  body: Record<string, unknown>;\n}\n\ntype VerdictStatus = \"healthy\" | \"degraded\" | \"unhealthy\";\nexport interface O11yVerdict {\n  status: VerdictStatus;\n  reasons: Array<{\n    source: \"application\" | \"liveSync\" | \"canary\" | \"collector\" | \"provider\";\n    code: string;\n    severity: Exclude<VerdictStatus, \"healthy\">;\n  }>;\n}\n\n/** Derive one bounded machine verdict without inventing latency/error budgets\n * before baselines exist. Explicit journey failure/staleness is unhealthy;\n * missing/partial sources are degraded. */\nexport function statusVerdict(reads: {\n  application: O11yRead;\n  liveSync: O11yRead;\n  canary: O11yRead;\n  collector: O11yRead;\n  provider: O11yRead;\n  providerCapacity?: O11yRead;\n  providerReconciliation: O11yRead;\n  providerHistory: O11yRead;\n}): O11yVerdict {\n  const reasons: O11yVerdict[\"reasons\"] = [];\n  sourceHttp(reasons, \"application\", reads.application);\n  sourceHttp(reasons, \"liveSync\", reads.liveSync);\n  sourceHttp(reasons, \"canary\", reads.canary);\n  sourceHttp(reasons, \"collector\", reads.collector);\n  sourceHttp(reasons, \"provider\", reads.provider);\n  if (reads.providerCapacity) {\n    sourceHttp(\n      reasons,\n      \"provider\",\n      reads.providerCapacity,\n      \"provider_capacity_\",\n    );\n  }\n  sourceHttp(\n    reasons,\n    \"provider\",\n    reads.providerReconciliation,\n    \"provider_reconciliation_\",\n  );\n  sourceHttp(reasons, \"provider\", reads.providerHistory, \"provider_history_\");\n  const liveStatus = String(reads.liveSync.body.status ?? \"\");\n  if (liveStatus === \"partial\") {\n    reasons.push({\n      source: \"liveSync\",\n      code: \"partial_reconciliation\",\n      severity: \"degraded\",\n    });\n  } else if (liveStatus === \"stale\" || liveStatus === \"unavailable\") {\n    reasons.push({\n      source: \"liveSync\",\n      code: `reconciliation_${liveStatus}`,\n      severity: \"degraded\",\n    });\n  }\n  const performance = record(reads.liveSync.body.performance)\n    ? reads.liveSync.body.performance\n    : null;\n  if (performance?.status === \"unavailable\") {\n    reasons.push({\n      source: \"liveSync\",\n      code: \"subscription_metrics_unavailable\",\n      severity: \"degraded\",\n    });\n  }\n  if (numeric(performance?.telemetryDropped) > 0) {\n    reasons.push({\n      source: \"liveSync\",\n      code: \"subscription_telemetry_dropped\",\n      severity: \"degraded\",\n    });\n  }\n  const canaryStatus = String(reads.canary.body.status ?? \"\");\n  if (canaryStatus === \"failing\") {\n    reasons.push({\n      source: \"canary\",\n      code: String(reads.canary.body.errorCode ?? \"journey_failed\"),\n      severity: \"unhealthy\",\n    });\n  } else if (canaryStatus === \"stale\") {\n    reasons.push({\n      source: \"canary\",\n      code: \"journey_stale\",\n      severity: \"unhealthy\",\n    });\n  } else if (\n    canaryStatus === \"pending\" ||\n    canaryStatus === \"not_configured\"\n  ) {\n    reasons.push({\n      source: \"canary\",\n      code: `journey_${canaryStatus}`,\n      severity: \"degraded\",\n    });\n  }\n  const collectorStatus = String(reads.collector.body.status ?? \"\");\n  if (collectorStatus === \"unhealthy\") {\n    reasons.push({\n      source: \"collector\",\n      code: collectorReason(reads.collector, \"collector_unhealthy\"),\n      severity: \"unhealthy\",\n    });\n  } else if (collectorStatus === \"degraded\") {\n    reasons.push({\n      source: \"collector\",\n      code: collectorReason(reads.collector, \"collector_degraded\"),\n      severity: \"degraded\",\n    });\n  }\n  const providerStatus = String(reads.provider.body.status ?? \"\");\n  if (providerStatus && providerStatus !== \"observed\") {\n    reasons.push({\n      source: \"provider\",\n      code: `provider_${providerStatus}`,\n      severity: \"degraded\",\n    });\n  }\n  const reconciliationStatus = String(\n    reads.providerReconciliation.body.status ?? \"\",\n  );\n  if (\n    reads.providerReconciliation.httpStatus >= 200 &&\n    reads.providerReconciliation.httpStatus < 300 &&\n    reconciliationStatus &&\n    reconciliationStatus !== \"within_budget\"\n  ) {\n    const reconciliationReason = reads.providerReconciliation.body.reason;\n    reasons.push({\n      source: \"provider\",\n      code:\n        reconciliationStatus === \"outside_budget\"\n          ? typeof reconciliationReason === \"string\" && reconciliationReason\n            ? reconciliationReason\n            : \"request_coverage_outside_budget\"\n          : `request_reconciliation_${reconciliationStatus}`,\n      severity: \"degraded\",\n    });\n  }\n  const providerHistoryStatus = String(reads.providerHistory.body.status ?? \"\");\n  if (\n    providerHistoryStatus &&\n    providerHistoryStatus !== \"observed\" &&\n    providerHistoryStatus !== \"no_data\"\n  ) {\n    reasons.push({\n      source: \"provider\",\n      code: `provider_history_${providerHistoryStatus}`,\n      severity: \"degraded\",\n    });\n  }\n  return {\n    status: reasons.some((reason) => reason.severity === \"unhealthy\")\n      ? \"unhealthy\"\n      : reasons.length > 0\n        ? \"degraded\"\n        : \"healthy\",\n    reasons,\n  };\n}\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction numeric(value: unknown): number {\n  return typeof value === \"number\" && Number.isFinite(value) ? value : 0;\n}\n\nfunction collectorReason(read: O11yRead, fallback: string): string {\n  const reasons = read.body.reasons;\n  if (!Array.isArray(reasons)) return fallback;\n  const first = reasons.find(\n    (reason): reason is Record<string, unknown> =>\n      Boolean(reason) && typeof reason === \"object\" && !Array.isArray(reason),\n  );\n  return typeof first?.code === \"string\" && first.code ? first.code : fallback;\n}\n\nfunction sourceHttp(\n  reasons: O11yVerdict[\"reasons\"],\n  source: O11yVerdict[\"reasons\"][number][\"source\"],\n  read: O11yRead,\n  prefix = \"\",\n): void {\n  if (read.httpStatus >= 200 && read.httpStatus < 300) return;\n  reasons.push({\n    source,\n    code: `${prefix}http_${read.httpStatus}`,\n    severity:\n      read.httpStatus >= 500 && read.httpStatus !== 501\n        ? \"unhealthy\"\n        : \"degraded\",\n  });\n}\n","import type { O11yRead, O11yVerdict } from \"./o11y-verdict\";\n\ninterface O11yStatusOutput {\n  scope: { appId: string; env: string; minutes: number };\n  application: O11yRead;\n  applicationVersions: O11yRead;\n  liveSync: O11yRead;\n  canary: O11yRead;\n  collector: O11yRead;\n  provider: O11yRead;\n  providerCapacity: O11yRead;\n  providerReconciliation: O11yRead;\n  providerHistory: O11yRead;\n  verdict: O11yVerdict;\n}\n\n/** Render the machine status envelope as stable, tab-delimited human lines. */\nexport function printO11yStatus(\n  status: O11yStatusOutput,\n  out: Pick<typeof console, \"log\" | \"error\">,\n): void {\n  out.log(\n    `o11y status ${status.scope.appId}/${status.scope.env} (${status.scope.minutes}m)`,\n  );\n  const routes = Array.isArray(status.application.body.routes)\n    ? status.application.body.routes.filter(record)\n    : [];\n  const requests = routes.reduce(\n    (total, row) => total + numeric(row.requests),\n    0,\n  );\n  const errors = routes.reduce(\n    (total, row) => total + numeric(row.errors),\n    0,\n  );\n  out.log(\n    `application\\t${status.application.httpStatus}\\t${requests} requests\\t${errors} errors`,\n  );\n  const versions = Array.isArray(status.applicationVersions.body.rows)\n    ? status.applicationVersions.body.rows.filter(record)\n    : [];\n  out.log(\n    `application-versions\\t${status.applicationVersions.httpStatus}\\t${\n      versions.length\n        ? versions\n            .slice(0, 5)\n            .map(\n              (row) =>\n                `${String(row.value || \"(unattributed)\")}:${numeric(row.requests)}`,\n            )\n            .join(\", \")\n        : \"none observed\"\n    }`,\n  );\n  out.log(liveSyncLine(status.liveSync));\n  const canaryDurations = record(status.canary.body.durationsMs)\n    ? status.canary.body.durationsMs\n    : {};\n  out.log(\n    `canary\\t${status.canary.httpStatus}\\t${String(status.canary.body.status ?? status.canary.body.error ?? \"unavailable\")}\\t${optionalNumeric(canaryDurations.publishToVisibleMs)} publish-to-visible`,\n  );\n  const collectorIngest = record(status.collector.body.ingest)\n    ? status.collector.body.ingest\n    : {};\n  const collectorStorage = record(collectorIngest.storage)\n    ? collectorIngest.storage\n    : {};\n  out.log(\n    `collector\\t${status.collector.httpStatus}\\t${String(status.collector.body.status ?? status.collector.body.error ?? \"unavailable\")}\\t${numeric(collectorStorage.affectedPoints)} affected points`,\n  );\n  const providerMetrics = record(status.provider.body.metrics)\n    ? status.provider.body.metrics\n    : {};\n  const providerCapacity = record(status.provider.body.capacity)\n    ? status.provider.body.capacity\n    : {};\n  const workerMemory = record(providerCapacity.memory)\n    ? providerCapacity.memory\n    : {};\n  out.log(\n    `cloudflare\\t${status.provider.httpStatus}\\t${String(status.provider.body.status ?? status.provider.body.error ?? \"unavailable\")}\\t${numeric(providerMetrics.requests)} invocations\\t${numeric(providerMetrics.errors)} runtime errors\\t${optionalBytes(workerMemory.headroomBytes)} isolate memory headroom`,\n  );\n  for (const line of providerCapacityLines(status.providerCapacity)) {\n    out.log(line);\n  }\n  const coverage = record(status.providerReconciliation.body.comparison)\n    ? status.providerReconciliation.body.comparison\n    : {};\n  const coverageCounts = record(status.providerReconciliation.body.counts)\n    ? status.providerReconciliation.body.counts\n    : {};\n  const coverageBudget = record(status.providerReconciliation.body.budget)\n    ? status.providerReconciliation.body.budget\n    : {};\n  out.log(\n    `request-coverage\\t${status.providerReconciliation.httpStatus}\\t${String(status.providerReconciliation.body.status ?? status.providerReconciliation.body.error ?? \"unavailable\")}\\t${optionalPercent(coverage.applicationCoverage)} application/provider\\t${numeric(coverageCounts.applicationRequests)}/${numeric(coverageCounts.providerRequests)} requests\\t±${optionalPercent(coverageBudget.maxRelativeError)} budget`,\n  );\n  const providerPoints = Array.isArray(status.providerHistory.body.points)\n    ? status.providerHistory.body.points.length\n    : 0;\n  const providerFreshness = record(status.providerHistory.body.freshness)\n    ? status.providerHistory.body.freshness\n    : {};\n  out.log(\n    `cloudflare-history\\t${status.providerHistory.httpStatus}\\t${String(status.providerHistory.body.status ?? status.providerHistory.body.error ?? \"unavailable\")}\\t${providerPoints} snapshots\\t${optionalAge(providerFreshness.ageMs)} old`,\n  );\n  out.log(\n    `verdict\\t${status.verdict.status}\\t${status.verdict.reasons.map((reason) => `${reason.source}:${reason.code}`).join(\", \") || \"all required signals healthy\"}`,\n  );\n}\n\nfunction providerCapacityLines(read: O11yRead): string[] {\n  const resources = record(read.body.resources) ? read.body.resources : {};\n  const durableObjects = record(resources.durableObjects)\n    ? resources.durableObjects\n    : {};\n  const periodic = record(durableObjects.periodic)\n    ? durableObjects.periodic\n    : {};\n  const storage = record(durableObjects.sqliteStorage)\n    ? durableObjects.sqliteStorage\n    : {};\n  const d1 = record(resources.d1) ? resources.d1 : {};\n  const d1Activity = record(d1.activity) ? d1.activity : {};\n  const d1Storage = record(d1.storage) ? d1.storage : {};\n  const d1Latency = record(d1Activity.latency)\n    ? d1Activity.latency\n    : {};\n  const r2 = record(resources.r2) ? resources.r2 : {};\n  const r2Operations = record(r2.operations) ? r2.operations : {};\n  const r2Storage = record(r2.storage) ? r2.storage : {};\n  const status = String(\n    read.body.status ?? read.body.error ?? \"unavailable\",\n  );\n  return [\n    `cloudflare-capacity\\t${read.httpStatus}\\t${status}\\t` +\n      `${optionalBytes(storage.storedBytes)} SQLite DO storage\\t` +\n      `${optionalCount(periodic.activeWebsocketConnectionsMax, \"active socket max\")}\\t` +\n      `${optionalAgeSeconds(storage.ageSeconds)} storage evidence age`,\n    `cloudflare-d1\\t${read.httpStatus}\\t${status}\\t` +\n      `${optionalBytes(d1Storage.databaseSizeBytes)} storage\\t` +\n      `${numeric(d1Activity.readQueries) + numeric(d1Activity.writeQueries)} queries\\t` +\n      `${numeric(d1Activity.rowsRead)}/${numeric(d1Activity.rowsWritten)} rows read/written\\t` +\n      `${optionalNumeric(d1Latency.worstDatabaseHourP99Ms)} worst database-hour p99\\t` +\n      `${optionalAgeSeconds(d1Activity.ageSeconds)} activity evidence age`,\n    `cloudflare-r2\\t${read.httpStatus}\\t${status}\\t` +\n      `${optionalBytes(r2Storage.storedBytes)} storage\\t` +\n      `${numeric(r2Storage.objectCount)} objects\\t` +\n      `${numeric(r2Operations.requests)} operations\\t` +\n      `${numeric(r2Operations.userErrorRequests) + numeric(r2Operations.internalErrorRequests)} provider errors\\t` +\n      `${optionalAgeSeconds(r2Operations.ageSeconds)} operation evidence age`,\n  ];\n}\n\nfunction liveSyncLine(read: O11yRead): string {\n  const performance = record(read.body.performance)\n    ? read.body.performance\n    : {};\n  const commitToSend = record(performance.commitToSend)\n    ? performance.commitToSend\n    : {};\n  return (\n    `live-sync\\t${read.httpStatus}\\t` +\n    `${String(read.body.status ?? read.body.error ?? \"unavailable\")}\\t` +\n    `${numeric(read.body.activeConnections)} active\\t` +\n    `${optionalNumeric(commitToSend.p95)} commit-to-send p95\\t` +\n    `${numeric(performance.sendFailures)} send failures`\n  );\n}\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction numeric(value: unknown): number {\n  return typeof value === \"number\" && Number.isFinite(value) ? value : 0;\n}\n\nfunction optionalNumeric(value: unknown): string {\n  return typeof value === \"number\" && Number.isFinite(value)\n    ? `${value} ms`\n    : \"—\";\n}\n\nfunction optionalAge(value: unknown): string {\n  if (typeof value !== \"number\" || !Number.isFinite(value)) return \"unknown\";\n  return `${Math.max(0, Math.round(value / 1000))}s`;\n}\n\nfunction optionalPercent(value: unknown): string {\n  return typeof value === \"number\" && Number.isFinite(value)\n    ? `${Math.round(value * 100)}%`\n    : \"—\";\n}\n\nfunction optionalBytes(value: unknown): string {\n  if (typeof value !== \"number\" || !Number.isFinite(value)) return \"—\";\n  if (value >= 1024 * 1024 * 1024) {\n    return `${(value / (1024 * 1024 * 1024)).toFixed(2)} GiB`;\n  }\n  if (value >= 1024 * 1024) {\n    return `${(value / (1024 * 1024)).toFixed(1)} MiB`;\n  }\n  if (value >= 1024) return `${(value / 1024).toFixed(1)} KiB`;\n  return `${Math.round(value)} B`;\n}\n\nfunction optionalCount(value: unknown, unit: string): string {\n  return typeof value === \"number\" && Number.isFinite(value)\n    ? `${value} ${unit}`\n    : `— ${unit}`;\n}\n\nfunction optionalAgeSeconds(value: unknown): string {\n  return typeof value === \"number\" && Number.isFinite(value)\n    ? `${Math.max(0, Math.round(value))}s`\n    : \"unknown\";\n}\n","import {\n  assertArgs,\n  numberOpt,\n  stringOpt,\n  type ParsedArgv,\n} from \"./argv\";\nimport { resolveOperatorContext } from \"./operator-context\";\nimport {\n  statusVerdict,\n  type O11yRead,\n} from \"./o11y-verdict\";\nimport { printO11yStatus } from \"./o11y-output\";\nimport { getDeveloperToken } from \"./token\";\n\ninterface O11yDeps {\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/** One read-only, machine-stable status envelope spanning application RED,\n * live sync, collector trust, and Cloudflare runtime/data-service evidence. */\nexport async function o11yCommand(\n  parsed: ParsedArgv,\n  deps: O11yDeps = {},\n): Promise<void> {\n  assertArgs(\n    parsed,\n    [\n      \"config\",\n      \"context\",\n      \"platform\",\n      \"token\",\n      \"email\",\n      \"json\",\n      \"app\",\n      \"env\",\n      \"minutes\",\n    ],\n    2,\n  );\n  const action = parsed.positionals[1];\n  if (action !== \"status\") {\n    throw new Error(\n      `unknown o11y action \"${action ?? \"\"}\". Try \"odla-ai o11y status --json\".`,\n    );\n  }\n  const minutes = statusMinutes(\n    numberOpt(parsed.options.minutes, \"--minutes\") ?? 60,\n  );\n  const context = await resolveOperatorContext(parsed, {\n    allowMissingConfig: true,\n    defaultEnvironment: \"prod\",\n    requireApp: true,\n  });\n  const cfg = context.cfg;\n  const doFetch = deps.fetch ?? fetch;\n  const out = deps.stdout ?? console;\n  const token = await getDeveloperToken(\n    cfg,\n    {\n      configPath: cfg.configPath,\n      token: stringOpt(parsed.options.token),\n      email: stringOpt(parsed.options.email),\n      open: false,\n    },\n    doFetch,\n    out,\n  );\n  const appId = context.app.value!;\n  const env = context.environment.value!;\n  const base = `${cfg.platformUrl}/o11y/${encodeURIComponent(appId)}`;\n  const query = new URLSearchParams({ env, minutes: String(minutes) });\n  const headers = { authorization: `Bearer ${token}` };\n  const versionsQuery = new URLSearchParams({\n    env,\n    minutes: String(minutes),\n    dimension: \"version\",\n    metric: \"requests\",\n  });\n  const [\n    application,\n    applicationVersions,\n    liveSync,\n    canary,\n    collector,\n    provider,\n    providerCapacity,\n    providerReconciliation,\n    providerHistory,\n  ] = await Promise.all([\n    read(`${base}/metrics/red?${query}`, headers, doFetch),\n    read(`${base}/explore?${versionsQuery}`, headers, doFetch),\n    read(\n      `${base}/live-sync/health?${query}`,\n      headers,\n      doFetch,\n    ),\n    read(\n      `${base}/live-sync/canary?${new URLSearchParams({ env })}`,\n      headers,\n      doFetch,\n    ),\n    read(`${base}/self-health?${query}`, headers, doFetch),\n    read(`${base}/provider/cloudflare?${query}`, headers, doFetch),\n    appId === \"odla-db\"\n      ? read(`${base}/provider/cloudflare/capacity`, headers, doFetch)\n      : Promise.resolve<O11yRead>({\n          httpStatus: 204,\n          body: {\n            status: \"not_applicable\",\n            scope: \"cloudflare_account\",\n            reason:\n              \"account-scoped Durable Object capacity is exposed only through odla-db\",\n          },\n        }),\n    read(\n      `${base}/provider/cloudflare/reconciliation?${query}`,\n      headers,\n      doFetch,\n    ),\n    read(`${base}/provider/cloudflare/history?${query}`, headers, doFetch),\n  ]);\n  const verdict = statusVerdict({\n    application,\n    liveSync,\n    canary,\n    collector,\n    provider,\n    providerCapacity,\n    providerReconciliation,\n    providerHistory,\n  });\n  const status = {\n    schemaVersion: 9,\n    scope: { appId, env, minutes },\n    observedAt: new Date().toISOString(),\n    verdict,\n    application,\n    applicationVersions,\n    liveSync,\n    canary,\n    collector,\n    provider,\n    providerCapacity,\n    providerReconciliation,\n    providerHistory,\n  };\n  if (parsed.options.json === true) {\n    out.log(JSON.stringify(status, null, 2));\n    return;\n  }\n  printO11yStatus(status, out);\n}\n\nfunction statusMinutes(value: number): number {\n  if (!Number.isSafeInteger(value) || value < 1 || value > 7 * 24 * 60) {\n    throw new Error(\"--minutes must be an integer from 1 to 10080\");\n  }\n  return value;\n}\n\nasync function read(\n  url: string,\n  headers: Record<string, string>,\n  doFetch: typeof fetch,\n): Promise<O11yRead> {\n  const response = await doFetch(url, { headers });\n  const text = await response.text();\n  let body: Record<string, unknown> = {};\n  if (text) {\n    try {\n      const value = JSON.parse(text) as unknown;\n      body =\n        value && typeof value === \"object\" && !Array.isArray(value)\n          ? (value as Record<string, unknown>)\n          : { value };\n    } catch {\n      body = { message: text.slice(0, 300) };\n    }\n  }\n  return { httpStatus: response.status, body };\n}\n","// Which invocations a test run actually drove.\n//\n// odla's standard is that anything `odla-ai help` prints, or a runbook tells\n// someone to run, must have a test that uses it the way its consumer will. That\n// is only checkable if something knows what the tests really ran — and the honest\n// way to know is to watch, rather than to ask each test to declare it. A\n// declaration drifts; an observation cannot.\n//\n// Dormant unless `ODLA_CLI_RECORD` names a file, so this costs an ordinary run\n// one environment-variable read. It records the command PATH and the OPTION\n// NAMES, never their values: option values carry emails, tokens and file paths,\n// and none of that belongs in an artifact a repository check reads.\nimport { appendFileSync } from \"node:fs\";\nimport process from \"node:process\";\nimport { invocationPath } from \"./surface\";\nimport type { ParsedArgv } from \"./argv\";\n\n/** One observed invocation: the command that ran and the flags it was given. */\nexport interface RecordedInvocation {\n  path: string[];\n  options: string[];\n}\n\n/**\n * Append `parsed` to the recording file, if one is configured.\n *\n * Never throws. A recorder that can break a command is worse than no recorder —\n * this exists to observe the CLI, not to become a way for it to fail.\n */\nexport function recordInvocation(parsed: ParsedArgv): void {\n  const file = process.env.ODLA_CLI_RECORD;\n  if (!file) return;\n  try {\n    const entry: RecordedInvocation = {\n      path: invocationPath(parsed.positionals),\n      options: Object.entries(parsed.options)\n        .map(([name, value]) => value === false ? `no-${name}` : name)\n        .sort(),\n    };\n    if (!entry.path.length) return;\n    appendFileSync(file, `${JSON.stringify(entry)}\\n`);\n  } catch {\n    /* observation is best-effort; never fail a command because of it */\n  }\n}\n","// Action handlers for `odla-ai runbook …` — REST calls to the registry's\n// `/registry/pm/runbook` routes. `get` writes the raw markdown to stdout with\n// nothing around it, so an agent can pipe it straight into its context; every\n// other action prints a table or, with --json, the wire body.\nimport { readFileSync } from \"node:fs\";\nimport { cliVersion } from \"./help\";\nimport { describeUnmet, unmetRequirements } from \"./runbook-requires\";\nimport type { Identity } from \"./whoami-command\";\n\n/** The reserved appId holding odla's own operational runbooks. Mirrors\n * `PLATFORM_SCOPE` in @odla-ai/pm; duplicated rather than imported so the CLI\n * keeps no runtime dependency on the pm package. */\nexport const PLATFORM_SCOPE = \"$platform\";\n\nexport interface RunbookContext {\n  platformUrl: string;\n  token: string;\n  doFetch: typeof fetch;\n  out: Pick<typeof console, \"log\" | \"error\">;\n  json: boolean;\n  /** Target project; defaults to the platform scope. */\n  appId: string;\n  /** Resolved lazily, only to explain a 403. */\n  identity?: () => Promise<Identity>;\n}\n\ninterface Runbook {\n  id: string;\n  requires?: string;\n  slug: string;\n  title: string;\n  body: string;\n  status: string;\n  version: number;\n  appId: string;\n  visibility?: string;\n  summary?: string;\n  updatedAt?: number;\n}\ninterface Page<T> {\n  records: T[];\n  total: number;\n}\ninterface Revision {\n  version: number;\n  body: string;\n  note?: string;\n  ownerEmail?: string;\n  createdAt?: number;\n}\n\n/** One authenticated call to the PM runbook routes. Exported so every runbook\n * surface (single edits and bulk import alike) shares the same auth headers and\n * the same 403 explanation. */\nexport async function call<T>(\n  ctx: RunbookContext,\n  method: string,\n  path: string,\n  body?: unknown,\n): Promise<T> {\n  const res = await ctx.doFetch(`${ctx.platformUrl.replace(/\\/$/, \"\")}/registry/pm${path}`, {\n    method,\n    headers: {\n      authorization: `Bearer ${ctx.token}`,\n      ...(body === undefined ? {} : { \"content-type\": \"application/json\" }),\n    },\n    ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n  });\n  const payload = (await res.json().catch(() => ({}))) as Record<string, unknown>;\n  if (res.ok) return payload as T;\n  const message = typeof payload.error === \"string\" ? payload.error : `HTTP ${res.status}`;\n  // A 403 on a write is the expected outcome for a non-admin, and the useful\n  // response is who you are — not the word \"forbidden\".\n  if (res.status === 403 && ctx.identity) {\n    const who = await ctx.identity().catch(() => null);\n    if (who && !who.admin)\n      throw new Error(\n        `${message} — editing ${ctx.appId === PLATFORM_SCOPE ? \"platform\" : ctx.appId} runbooks needs ` +\n          `platform admin, and you are signed in as ${who.email ?? who.developerId} (admin: no).`,\n      );\n  }\n  throw new Error(message);\n}\n\n/** Resolve a slug to its runbook within the context's scope. */\nasync function bySlug(ctx: RunbookContext, slug: string): Promise<Runbook> {\n  const page = await call<Page<Runbook>>(\n    ctx,\n    \"GET\",\n    `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`,\n  );\n  const found = page.records[0];\n  if (!found) throw new Error(`no runbook \"${slug}\" in ${ctx.appId}`);\n  return found;\n}\n\n/** Body text from `--file <path>`, `--file -` (stdin), or an inline `--body`. */\nexport function readBody(file: string | undefined, inline: string | undefined): string {\n  if (inline !== undefined) return inline;\n  if (file === undefined) throw new Error(\"supply the new text with --file <path>, --file - (stdin), or --body\");\n  return readFileSync(file === \"-\" ? 0 : file, \"utf8\");\n}\n\nconst stamp = (ms?: number): string => (ms ? new Date(ms).toISOString().slice(0, 16).replace(\"T\", \" \") : \"\");\n\n/** `runbook list` — every runbook in scope. Unscoped, the registry unions the\n * caller's projects with the platform scope. */\nexport async function runbookList(ctx: RunbookContext, all: boolean, query?: string): Promise<void> {\n  const params = new URLSearchParams();\n  if (!all) params.set(\"app\", ctx.appId);\n  if (query) params.set(\"q\", query);\n  const page = await call<Page<Runbook>>(ctx, \"GET\", `/runbook${params.size ? `?${params}` : \"\"}`);\n  if (ctx.json) return ctx.out.log(JSON.stringify(page, null, 2));\n  if (!page.records.length) return ctx.out.log(\"(no runbooks)\");\n  ctx.out.log([\"SLUG\", \"STATUS\", \"V\", \"SCOPE\", \"UPDATED\", \"TITLE\"].join(\"\\t\"));\n  for (const r of page.records)\n    ctx.out.log(\n      [r.slug, r.status, `v${r.version}`, r.appId === PLATFORM_SCOPE ? \"platform\" : r.appId, stamp(r.updatedAt), r.title].join(\"\\t\"),\n    );\n}\n\n/** `runbook get <slug>` — the raw markdown, nothing else, for piping.\n *\n * A version warning goes to STDERR, never stdout: the whole contract of this\n * command is that its output is the runbook and nothing else, and an agent\n * piping it must not find a warning wedged into the procedure. */\nexport async function runbookGet(ctx: RunbookContext, slug: string): Promise<void> {\n  const runbook = await bySlug(ctx, slug);\n  if (ctx.json) return ctx.out.log(JSON.stringify(runbook, null, 2));\n  const unmet = unmetRequirements(runbook.requires, { \"@odla-ai/cli\": cliVersion() });\n  if (unmet.length) ctx.out.error(describeUnmet(slug, unmet));\n  ctx.out.log(runbook.body);\n}\n\n/** `runbook new <slug>` — author a runbook from a file or stdin. */\nexport async function runbookNew(\n  ctx: RunbookContext,\n  slug: string,\n  title: string,\n  body: string,\n  summary?: string,\n  requires?: string,\n): Promise<void> {\n  const created = await call<{ id: string }>(ctx, \"POST\", \"/runbook\", {\n    appId: ctx.appId,\n    input: { slug, title, body, ...(summary ? { summary } : {}), ...(requires ? { requires } : {}) },\n  });\n  ctx.out.log(ctx.json ? JSON.stringify(created, null, 2) : `created ${slug} (${created.id})`);\n}\n\n/** `runbook edit <slug>` — replace the body; the displaced text becomes a revision. */\nexport async function runbookEdit(\n  ctx: RunbookContext,\n  slug: string,\n  body: string,\n  note?: string,\n  requires?: string,\n): Promise<void> {\n  const runbook = await bySlug(ctx, slug);\n  const result = await call<{ record: Runbook | null }>(ctx, \"PATCH\", `/runbook/${encodeURIComponent(runbook.id)}`, {\n    // An empty --requires clears the declaration; omitting the flag leaves\n    // whatever is there, so an ordinary body edit never drops it.\n    patch: { body, ...(note ? { note } : {}), ...(requires === undefined ? {} : { requires: requires || null }) },\n  });\n  if (ctx.json) return ctx.out.log(JSON.stringify(result, null, 2));\n  ctx.out.log(`${slug} → v${result.record?.version ?? runbook.version + 1}`);\n}\n\n/** `runbook publish|archive|draft <slug>` — move the lifecycle. */\nexport async function runbookStatus(ctx: RunbookContext, slug: string, status: string): Promise<void> {\n  const runbook = await bySlug(ctx, slug);\n  const result = await call<{ record: Runbook | null }>(ctx, \"PATCH\", `/runbook/${encodeURIComponent(runbook.id)}`, {\n    patch: { status },\n  });\n  ctx.out.log(ctx.json ? JSON.stringify(result, null, 2) : `${slug} → ${status}`);\n}\n\n/** `runbook visibility <slug> <operator|admin>` — who may read it. Widening to\n * `operator` exposes the runbook to every signed-in developer, so it is its own\n * verb rather than a flag buried in an edit. */\nexport async function runbookVisibility(ctx: RunbookContext, slug: string, visibility: string): Promise<void> {\n  if (visibility !== \"operator\" && visibility !== \"admin\")\n    throw new Error(`visibility must be \"operator\" or \"admin\", got \"${visibility}\"`);\n  const runbook = await bySlug(ctx, slug);\n  const result = await call<{ record: Runbook | null }>(ctx, \"PATCH\", `/runbook/${encodeURIComponent(runbook.id)}`, {\n    patch: { visibility },\n  });\n  if (ctx.json) return ctx.out.log(JSON.stringify(result, null, 2));\n  ctx.out.log(\n    visibility === \"operator\"\n      ? `${slug} → operator-visible (readable by every signed-in developer)`\n      : `${slug} → admin-only`,\n  );\n}\n\n/** `runbook history <slug>` — the revision list, newest first. */\nexport async function runbookHistory(ctx: RunbookContext, slug: string): Promise<void> {\n  const runbook = await bySlug(ctx, slug);\n  const page = await call<Page<Revision>>(ctx, \"GET\", `/runbook/${encodeURIComponent(runbook.id)}/revisions`);\n  if (ctx.json) return ctx.out.log(JSON.stringify(page, null, 2));\n  ctx.out.log(`${slug} is at v${runbook.version}`);\n  if (!page.records.length) return ctx.out.log(\"(no earlier versions)\");\n  ctx.out.log([\"V\", \"WHEN\", \"BY\", \"NOTE\"].join(\"\\t\"));\n  for (const r of page.records)\n    ctx.out.log([`v${r.version}`, stamp(r.createdAt), r.ownerEmail ?? \"\", r.note ?? \"\"].join(\"\\t\"));\n}\n\n/** `runbook revert <slug> --version N` — restore an earlier body forward. */\nexport async function runbookRevert(ctx: RunbookContext, slug: string, version: number): Promise<void> {\n  const runbook = await bySlug(ctx, slug);\n  const result = await call<{ record: Runbook | null }>(\n    ctx,\n    \"POST\",\n    `/runbook/${encodeURIComponent(runbook.id)}/revert`,\n    { version },\n  );\n  if (ctx.json) return ctx.out.log(JSON.stringify(result, null, 2));\n  ctx.out.log(`${slug} reverted to v${version}, now v${result.record?.version ?? runbook.version + 1}`);\n}\n\n/** `runbook rm <slug>` — delete the runbook and its history. */\nexport async function runbookRemove(ctx: RunbookContext, slug: string): Promise<void> {\n  const runbook = await bySlug(ctx, slug);\n  await call(ctx, \"DELETE\", `/runbook/${encodeURIComponent(runbook.id)}`);\n  ctx.out.log(`removed ${slug}`);\n}\n","// A runbook can be corrected the moment a step is wrong, which means its text\n// routinely runs ahead of the packages a reader has installed: the step is right,\n// and the command it names simply does not exist in their copy yet. `requires`\n// is how a runbook says which version it assumes, so the reader learns that from\n// the runbook instead of from a confusing \"unknown action\" error.\n//\n// Specs are `name@version`, space- or comma-separated, and read as MINIMUMS.\n// Deliberately not semver ranges: the only question worth answering here is\n// \"is what I have new enough\", and a range grammar invites `<` bounds that a\n// runbook has no way to be right about.\n\n/** One package version a runbook assumes. */\nexport interface Requirement {\n  name: string;\n  /** The lowest version whose steps are known to work. */\n  min: string;\n}\n\n/** A requirement the caller does not meet. */\nexport interface UnmetRequirement extends Requirement {\n  /** What is installed, or null when nothing local claims to be this package. */\n  installed: string | null;\n}\n\nconst SPEC = /^(@?[\\w./-]+?)@(\\d+\\.\\d+\\.\\d+(?:[\\w.-]*)?)$/;\n\n/** Parse a `requires` string. Unparseable entries are dropped rather than\n * throwing: a malformed spec must not make a runbook unreadable. */\nexport function parseRequires(value: string | undefined | null): Requirement[] {\n  if (!value) return [];\n  const out: Requirement[] = [];\n  for (const token of value.split(/[\\s,]+/).filter(Boolean)) {\n    const match = SPEC.exec(token);\n    if (match?.[1] && match[2]) out.push({ name: match[1], min: match[2] });\n  }\n  return out;\n}\n\n/** Compare two dotted versions numerically. Pre-release suffixes sort BELOW the\n * release they precede, so `0.18.0-rc.1` does not satisfy `0.18.0`. */\nexport function compareVersions(a: string, b: string): number {\n  const parts = (v: string) => {\n    const [core = \"\", pre = \"\"] = v.split(\"-\", 2);\n    return { nums: core.split(\".\").map((n) => Number.parseInt(n, 10) || 0), pre };\n  };\n  const left = parts(a);\n  const right = parts(b);\n  for (let i = 0; i < Math.max(left.nums.length, right.nums.length); i++) {\n    const diff = (left.nums[i] ?? 0) - (right.nums[i] ?? 0);\n    if (diff) return diff < 0 ? -1 : 1;\n  }\n  if (left.pre === right.pre) return 0;\n  if (!left.pre) return 1;\n  if (!right.pre) return -1;\n  return left.pre < right.pre ? -1 : 1;\n}\n\n/** True when `installed` is at least `min`. */\nexport function satisfies(installed: string, min: string): boolean {\n  return compareVersions(installed, min) >= 0;\n}\n\n/**\n * Which of a runbook's requirements the caller does not meet.\n *\n * `installedVersions` maps a package name to what the caller has. A package the\n * caller knows nothing about is reported with `installed: null` rather than\n * assumed satisfied — silence about an unknown dependency is the failure mode\n * this exists to prevent.\n */\nexport function unmetRequirements(\n  requires: string | undefined | null,\n  installedVersions: Readonly<Record<string, string | undefined>>,\n): UnmetRequirement[] {\n  const unmet: UnmetRequirement[] = [];\n  for (const requirement of parseRequires(requires)) {\n    const installed = installedVersions[requirement.name];\n    if (installed === undefined) {\n      unmet.push({ ...requirement, installed: null });\n    } else if (!satisfies(installed, requirement.min)) {\n      unmet.push({ ...requirement, installed });\n    }\n  }\n  return unmet;\n}\n\n/** The one-line warning shown when a runbook expects more than the caller has. */\nexport function describeUnmet(slug: string, unmet: readonly UnmetRequirement[]): string {\n  const detail = unmet\n    .map((u) => `${u.name}@${u.min}${u.installed ? ` (you have ${u.installed})` : \" (not installed here)\"}`)\n    .join(\", \");\n  return `note: runbook \"${slug}\" expects ${detail} — some steps may name commands your version does not have.`;\n}\n","// Bulk-author runbooks from a directory of markdown files. This is how odla's own\n// corpus is seeded, and how a restored tenant is refilled — but it is an ordinary\n// CLI command rather than a repo script, so an ADMIN can run it with the same\n// approved capability as any other write. Nothing here needs a machine secret.\n//\n// Idempotent by `(appId, slug)`: a slug that already exists is patched rather than\n// re-created, and a patch goes through the normal edit path, so a re-import\n// snapshots whatever was live and can never silently discard a correction someone\n// made in Studio.\nimport { readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { basename, join } from \"node:path\";\nimport { call, type RunbookContext } from \"./runbook-actions\";\n\n/** One parsed markdown file, ready to upsert. */\nexport interface ParsedRunbook extends RunbookMeta {\n  file: string;\n  slug: string;\n  title: string;\n  body: string;\n  words: number;\n}\n\n/** Frontmatter a runbook file may declare above its heading. `summary` and\n * `tags` are what discovery ranks on when the prose never uses the asker's\n * words — \"follower site\" and \"membership\" may appear nowhere in the steps. */\nexport interface RunbookMeta {\n  summary?: string;\n  tags?: string;\n}\n\n/**\n * Split a runbook file into title, body, and optional frontmatter. The leading\n * `# Heading` becomes the title and is dropped from the body — every surface\n * renders the title itself, so leaving it in would double it.\n *\n * Frontmatter is a leading `---` block with `key: value` lines; `tags` accepts a\n * comma-separated list. Everything else in it is ignored rather than rejected, so\n * a file carrying extra keys still imports.\n */\nexport function parseRunbook(text: string, slug: string): { title: string; body: string } & RunbookMeta {\n  let rest = text;\n  const meta: RunbookMeta = {};\n  const fm = /^---\\r?\\n([\\s\\S]*?)\\r?\\n---\\r?\\n?/.exec(text);\n  if (fm) {\n    rest = text.slice(fm[0].length);\n    for (const line of fm[1]!.split(/\\r?\\n/)) {\n      const pair = /^(\\w+)\\s*:\\s*(.+)$/.exec(line.trim());\n      if (!pair) continue;\n      const value = pair[2]!.trim().replace(/^[\"']|[\"']$/g, \"\");\n      if (pair[1] === \"summary\") meta.summary = value;\n      if (pair[1] === \"tags\") meta.tags = value.replace(/^\\[|\\]$/g, \"\").trim();\n    }\n  }\n  const lines = rest.split(\"\\n\");\n  const headingAt = lines.findIndex((l) => /^#\\s+\\S/.test(l));\n  if (headingAt === -1) return { title: slug, body: rest.trim(), ...meta };\n  return {\n    title: lines[headingAt]!.replace(/^#\\s+/, \"\").trim(),\n    body: [...lines.slice(0, headingAt), ...lines.slice(headingAt + 1)].join(\"\\n\").trim(),\n    ...meta,\n  };\n}\n\n/** Read every `*.md` in `dir` as a runbook, slug taken from the filename. */\nexport function readRunbookDir(dir: string): ParsedRunbook[] {\n  if (!statSync(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);\n  const files = readdirSync(dir).filter((f) => f.endsWith(\".md\")).sort();\n  if (!files.length) throw new Error(`no .md files in ${dir}`);\n  return files.map((file) => {\n    const slug = basename(file, \".md\");\n    const parsed = parseRunbook(readFileSync(join(dir, file), \"utf8\"), slug);\n    return { file, slug, ...parsed, words: parsed.body.split(/\\s+/).filter(Boolean).length };\n  });\n}\n\ninterface Runbook {\n  id: string;\n  slug: string;\n  title: string;\n  body: string;\n  version: number;\n  summary?: string;\n}\n\n/** Result of one file's upsert, for the summary line. */\ntype Outcome = \"created\" | \"updated\" | \"unchanged\";\n\n/**\n * Import every markdown file in `dir` into the context's scope.\n *\n * @param visibility Read visibility for records this run CREATES. Existing rows\n * keep whatever visibility they already have — a re-import must not silently\n * re-narrow or re-widen who can read a runbook someone already adjusted.\n */\nexport async function runbookImport(\n  ctx: RunbookContext,\n  dir: string,\n  options: { visibility?: string; dryRun?: boolean } = {},\n): Promise<void> {\n  const parsed = readRunbookDir(dir);\n  if (options.dryRun) {\n    ctx.out.log(`${parsed.length} runbook(s) parsed from ${dir}, nothing written\\n`);\n    for (const r of parsed) ctx.out.log(`  ${r.slug.padEnd(18)} ${String(r.words).padStart(5)} words  ${r.title}`);\n    return;\n  }\n\n  const counts: Record<Outcome, number> = { created: 0, updated: 0, unchanged: 0 };\n  for (const r of parsed) {\n    const outcome = await upsert(ctx, r, options.visibility);\n    counts[outcome] += 1;\n  }\n  ctx.out.log(\n    `\\n${counts.created} created, ${counts.updated} updated, ${counts.unchanged} unchanged` +\n      ` in ${ctx.appId}`,\n  );\n}\n\nasync function upsert(ctx: RunbookContext, r: ParsedRunbook, visibility?: string): Promise<Outcome> {\n  const page = await call<{ records: Runbook[] }>(\n    ctx,\n    \"GET\",\n    `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(r.slug)}&limit=1`,\n  );\n  const found = page.records[0];\n  if (!found) {\n    await call(ctx, \"POST\", \"/runbook\", {\n      appId: ctx.appId,\n      input: {\n        slug: r.slug,\n        title: r.title,\n        body: r.body,\n        status: \"published\",\n        ...(r.summary ? { summary: r.summary } : {}),\n        ...(r.tags ? { tags: r.tags } : {}),\n        ...(visibility ? { visibility } : {}),\n      },\n    });\n    ctx.out.log(`  + ${r.slug} (${r.words} words)`);\n    return \"created\";\n  }\n  if (found.body === r.body && found.title === r.title && (r.summary ?? found.summary) === found.summary) {\n    ctx.out.log(`  = ${r.slug} (already current at v${found.version})`);\n    return \"unchanged\";\n  }\n  const result = await call<{ record: { version?: number } | null }>(\n    ctx,\n    \"PATCH\",\n    `/runbook/${encodeURIComponent(found.id)}`,\n    {\n      patch: {\n        title: r.title,\n        body: r.body,\n        ...(r.summary ? { summary: r.summary } : {}),\n        ...(r.tags ? { tags: r.tags } : {}),\n        note: `imported from ${r.file}`,\n      },\n    },\n  );\n  // Report the version the server actually produced. A patch that changes only\n  // metadata does NOT bump the version — printing `v1 → v2` regardless was a\n  // plain lie, and it sent me hunting for a stale read that never existed.\n  const after = result.record?.version ?? found.version;\n  ctx.out.log(\n    after === found.version\n      ? `  ~ ${r.slug} (v${after}, metadata only)`\n      : `  ~ ${r.slug} (v${found.version} → v${after})`,\n  );\n  return \"updated\";\n}\n","// `odla-ai runbook impact` — the check an agent runs BEFORE it calls a change\n// finished. Runbooks live in odla-pm, so nothing in a repository can diff them;\n// what a repository CAN do is say which procedures describe the code that just\n// moved, and hand back the exact command to read and fix each one.\n//\n// It is deliberately not a CI gate. A gate can only prove structure, and the\n// question here — \"does this written procedure still match the code?\" — is a\n// judgement. So this reports, and the caller (usually a model) decides.\nimport { execFileSync } from \"node:child_process\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { changedSurfaces, type ChangedSurface } from \"./runbook-impact-scan\";\nimport { call, PLATFORM_SCOPE, type RunbookContext } from \"./runbook-actions\";\n\ninterface Hit {\n  slug: string;\n  title: string;\n  version: number;\n  heading: string;\n  anchor: string;\n  command: string;\n}\ninterface SearchResult {\n  hits: Hit[];\n  outcome: \"ranked\" | \"no-sections\" | \"no-match\" | \"empty-corpus\";\n  candidates: Array<{ slug: string; title: string; command: string }>;\n}\n\n/** One surface and the runbooks that describe it. */\nexport interface SurfaceImpact {\n  surface: ChangedSurface;\n  /** Deduped to one entry per runbook: the caller reads a runbook, not a passage. */\n  runbooks: Array<{ slug: string; title: string; version: number; sections: string[]; command: string }>;\n}\n\nexport interface ImpactDeps {\n  /** Injected in tests; runs git in the repository root. */\n  runGit?: (args: string[]) => string;\n  /** Injected in tests; reads a repo-relative file for the untracked scan. */\n  readRepoFile?: (path: string) => string;\n  cwd?: string;\n}\n\n/** Source files are scanned for exported symbols; everything else contributes\n * only its path, so there is no reason to read it. */\nconst SOURCE = /\\.(ts|tsx|js|jsx|mts|cts)$/;\n\nfunction gitRunner(cwd: string) {\n  return (args: string[]): string =>\n    execFileSync(\"git\", args, { cwd, encoding: \"utf8\", maxBuffer: 64 * 1024 * 1024, stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n}\n\n/** The committed diff against `base`, plus everything still uncommitted —\n * modified AND untracked — so an agent gets an answer mid-change rather than\n * only after it commits. */\nexport function collectDiff(\n  runGit: (args: string[]) => string,\n  base: string,\n  read: (path: string) => string,\n): string {\n  let merged = \"\";\n  try {\n    merged += runGit([\"diff\", \"--unified=3\", `${base}...HEAD`]);\n  } catch {\n    throw new Error(\n      `cannot diff against \"${base}\" — fetch it, or pass --base <ref> (e.g. --base HEAD~1) to compare somewhere reachable`,\n    );\n  }\n  // Uncommitted work is best-effort: a detached or fresh checkout with no HEAD\n  // still has a useful committed diff, and failing here would throw that away.\n  try {\n    merged += runGit([\"diff\", \"--unified=3\", \"HEAD\"]);\n  } catch {\n    /* nothing staged or no HEAD; the committed diff above is the answer */\n  }\n  return merged + untrackedDiff(runGit, read);\n}\n\n/**\n * A whole-file diff for every untracked file, so a brand-new module counts.\n *\n * `git diff` cannot see an unstaged new file, which is exactly what an agent\n * mid-change is holding: without this, adding `runbook-impact.ts` and asking\n * what it affected would answer \"nothing\". Only source files are read — every\n * other path contributes its name and nothing else, so there is no reason to\n * pull an image into memory to learn it changed.\n */\nexport function untrackedDiff(runGit: (args: string[]) => string, read: (path: string) => string): string {\n  let listed = \"\";\n  try {\n    listed = runGit([\"ls-files\", \"--others\", \"--exclude-standard\"]);\n  } catch {\n    return \"\";\n  }\n  let out = \"\";\n  for (const path of listed.split(\"\\n\").map((line) => line.trim()).filter(Boolean)) {\n    out += `diff --git a/${path} b/${path}\\n--- /dev/null\\n+++ b/${path}\\n`;\n    if (!SOURCE.test(path)) continue;\n    let body: string;\n    try {\n      body = read(path);\n    } catch {\n      continue;\n    }\n    out += `@@ -0,0 +1,${body.split(\"\\n\").length} @@\\n${body.split(\"\\n\").map((line) => `+${line}`).join(\"\\n\")}\\n`;\n  }\n  return out;\n}\n\n/** Read a workspace's package name so the query says `@odla-ai/db`, not `packages/db`. */\nfunction manifestLabeller(root: string): (workspace: string) => string | undefined {\n  return (workspace) => {\n    const manifest = join(root, workspace, \"package.json\");\n    if (!existsSync(manifest)) return undefined;\n    try {\n      const name = (JSON.parse(readFileSync(manifest, \"utf8\")) as { name?: unknown }).name;\n      return typeof name === \"string\" ? name : undefined;\n    } catch {\n      return undefined;\n    }\n  };\n}\n\n/** Collapse ranked passages into one row per runbook, keeping the sections that\n * matched — those are where a stale step would be. */\nfunction foldHits(hits: Hit[]): SurfaceImpact[\"runbooks\"] {\n  const byslug = new Map<string, SurfaceImpact[\"runbooks\"][number]>();\n  for (const hit of hits) {\n    const found = byslug.get(hit.slug);\n    const section = hit.heading || hit.anchor;\n    if (found) {\n      if (section && !found.sections.includes(section)) found.sections.push(section);\n      continue;\n    }\n    byslug.set(hit.slug, {\n      slug: hit.slug,\n      title: hit.title,\n      version: hit.version,\n      sections: section ? [section] : [],\n      command: hit.command,\n    });\n  }\n  return [...byslug.values()];\n}\n\n/** Ask the runbooks which of them describe each changed surface. */\nexport async function assessImpact(\n  ctx: RunbookContext,\n  surfaces: ChangedSurface[],\n  all: boolean,\n  limit: number,\n): Promise<SurfaceImpact[]> {\n  const out: SurfaceImpact[] = [];\n  for (const surface of surfaces) {\n    const params = new URLSearchParams({ q: surface.query, limit: String(limit) });\n    if (!all) params.set(\"app\", ctx.appId);\n    const result = await call<SearchResult>(ctx, \"GET\", `/runbook/search?${params}`);\n    // `no-sections` means runbooks are ABOUT this but no passage ranked — those\n    // candidates are still exactly what should be reread, so keep them.\n    const runbooks =\n      result.outcome === \"ranked\"\n        ? foldHits(result.hits)\n        : result.candidates.map((c) => ({ ...c, version: 0, sections: [] }));\n    out.push({ surface, runbooks });\n  }\n  return out;\n}\n\nconst editHint = (slug: string, appId: string): string =>\n  `odla-ai runbook edit ${slug}${appId === PLATFORM_SCOPE ? \"\" : ` --app ${appId}`} --note \"<what changed>\"`;\n\nfunction report(ctx: RunbookContext, impacts: SurfaceImpact[]): void {\n  const covered = impacts.filter((i) => i.runbooks.length);\n  ctx.out.log(\n    `${impacts.length} changed surface${impacts.length === 1 ? \"\" : \"s\"}; ` +\n      `${covered.length} covered by a runbook. Reread each one and fix any step this change made wrong.`,\n  );\n  for (const { surface, runbooks } of impacts) {\n    ctx.out.log(\"\");\n    const detail = surface.exports.length ? `; exports changed: ${surface.exports.join(\", \")}` : \"\";\n    ctx.out.log(`${surface.label}  (${surface.paths.length} file${surface.paths.length === 1 ? \"\" : \"s\"}${detail})`);\n    if (!runbooks.length) {\n      ctx.out.log(\"  no runbook describes this — nothing to check\");\n      continue;\n    }\n    for (const book of runbooks) {\n      const where = book.sections.length ? ` § ${book.sections.join(\", \")}` : \"\";\n      const version = book.version ? ` (v${book.version})` : \"\";\n      ctx.out.log(`  ${book.slug}${where}${version} — ${book.title}`);\n      ctx.out.log(`    ${book.command}`);\n    }\n  }\n  if (covered.length) {\n    ctx.out.log(\"\");\n    ctx.out.log(`Wrong step? Fix it where it lives — no release needed:`);\n    ctx.out.log(`  ${editHint(covered[0]!.runbooks[0]!.slug, ctx.appId)}`);\n  }\n}\n\n/** Dispatch `odla-ai runbook impact`. */\nexport async function runbookImpact(\n  ctx: RunbookContext,\n  options: { base: string; all: boolean; limit?: number },\n  deps: ImpactDeps = {},\n): Promise<void> {\n  const cwd = deps.cwd ?? process.cwd();\n  const runGit = deps.runGit ?? gitRunner(cwd);\n  const read = deps.readRepoFile ?? ((path: string) => readFileSync(join(cwd, path), \"utf8\"));\n  const surfaces = changedSurfaces(collectDiff(runGit, options.base, read), manifestLabeller(cwd));\n  if (!surfaces.length) {\n    return ctx.out.log(\n      ctx.json ? JSON.stringify({ base: options.base, impacts: [] }, null, 2) : `no changes against ${options.base}`,\n    );\n  }\n  const impacts = await assessImpact(ctx, surfaces, options.all, options.limit ?? 4);\n  if (ctx.json) return ctx.out.log(JSON.stringify({ base: options.base, impacts }, null, 2));\n  report(ctx, impacts);\n}\n","// Turn a unified diff into the surfaces a change touched, and the words that\n// describe them. Pure — no git, no network — so the classification is testable\n// on its own and the command around it only has to fetch.\n//\n// The point is the JSDoc: a doc comment is the API's documentation, so editing\n// one is exactly the moment a procedure that quotes that API may have gone\n// stale. A changed `/** … */` block is attributed to the export it sits above,\n// so \"you reworded retract's JSDoc\" becomes the query term `retract` rather\n// than the file name, which no runbook has ever mentioned.\n\n/** One area of the repo a change touched, and the question to put to the runbooks. */\nexport interface ChangedSurface {\n  /** What a human calls it: `@odla-ai/db`, `apps/dashboard`, `repo scripts`. */\n  label: string;\n  /** The workspace-relative paths that produced it. */\n  paths: string[];\n  /** Exported names whose declaration or JSDoc changed. */\n  exports: string[];\n  /** The search query — label, sub-areas, and changed export names. */\n  query: string;\n}\n\nconst DECL =\n  /^[+-]\\s*export\\s+(?:declare\\s+)?(?:default\\s+)?(?:abstract\\s+)?(?:async\\s+)?(?:const|let|var|function|class|interface|type|enum)\\s+([A-Za-z_$][\\w$]*)/;\n/** `export { a, b as c }` — the local names are what a runbook would name. */\nconst NAMED = /^[+-]\\s*export\\s*\\{([^}]*)\\}/;\n/** Any export declaration, changed or not — used to attribute a JSDoc edit to\n * the symbol it documents, which is usually a context line below it. */\nconst ANY_DECL =\n  /^.\\s*export\\s+(?:declare\\s+)?(?:default\\s+)?(?:abstract\\s+)?(?:async\\s+)?(?:const|let|var|function|class|interface|type|enum)\\s+([A-Za-z_$][\\w$]*)/;\nconst JSDOC = /^[+-]\\s*(?:\\/\\*\\*|\\*)/;\n\n/** Source worth reading for exported symbols. A test file's exports are\n * fixtures, not API — pulling `defaultRespond` into the query would spend the\n * ranker's attention on a name no runbook can ever mention. The path still\n * counts toward its surface. */\nconst SOURCE = /\\.(ts|tsx|js|jsx|mts|cts)$/;\nconst TEST_PATH = /(^|\\/)(tests?|__tests__|__mocks__)\\/|\\.(test|spec)\\.[jt]sx?$|\\.fixture\\.[jt]sx?$/;\n\n/** Words that say nothing about what changed. */\nconst NOISE = new Set([\n  \"src\", \"test\", \"tests\", \"dist\", \"index\", \"lib\", \"types\", \"utils\", \"helpers\",\n  \"packages\", \"apps\", \"examples\", \"the\", \"and\", \"for\",\n]);\n\n// Two letters is a real term here and a very specific one: `db`, `ui`, `ai`,\n// `pm`, `kg` are entire packages, and dropping them as too short would silently\n// blind the check to the workspaces most likely to be named in a runbook.\nconst words = (value: string): string[] =>\n  value\n    .replace(/^@[\\w-]+\\//, \"\")\n    .split(/[^A-Za-z0-9]+/)\n    .filter((w) => w.length > 1 && !NOISE.has(w.toLowerCase()));\n\n/** Split a `export { a, b as c }` clause into its local names. */\nfunction namedExports(clause: string): string[] {\n  return clause\n    .split(\",\")\n    .map((part) => part.trim().split(/\\s+as\\s+/)[0]?.trim() ?? \"\")\n    .filter((name) => /^[A-Za-z_$][\\w$]*$/.test(name) && name !== \"type\");\n}\n\n/** The workspace a path belongs to, or a bucket for everything outside one. */\nfunction workspaceOf(path: string): string {\n  const parts = path.split(\"/\");\n  if ([\"packages\", \"apps\", \"examples\"].includes(parts[0] ?? \"\") && parts[1]) return `${parts[0]}/${parts[1]}`;\n  if (parts[0] === \"scripts\") return \"scripts\";\n  if (parts[0] === \"docs\") return \"docs\";\n  return \"repo root\";\n}\n\n/** The sub-area inside a workspace, when the path names one — `src/platform` in\n * the dashboard is the Platform area, and that word is what a runbook uses.\n *\n * A DIRECTORY only. `src/help.ts` names a file, and a file name is noise: no\n * runbook has ever said \"help.ts\", so feeding it to the ranker adds a term that\n * can only dilute the ones that mean something. */\nfunction areaOf(path: string): string | null {\n  const parts = path.split(\"/\");\n  const src = parts.indexOf(\"src\");\n  if (src === -1) return null;\n  return parts[src + 2] !== undefined ? (parts[src + 1] ?? null) : null;\n}\n\ninterface FileChange {\n  path: string;\n  exports: Set<string>;\n  /** A manifest changed — version and packaging are release-procedure shaped. */\n  manifest: boolean;\n}\n\n/** Collect the exported names a hunk changed, including those whose only edit\n * was to the JSDoc block above them. */\nfunction scanHunk(lines: string[], into: Set<string>): void {\n  for (const [i, line] of lines.entries()) {\n    const decl = DECL.exec(line);\n    if (decl?.[1]) {\n      into.add(decl[1]);\n      continue;\n    }\n    const named = NAMED.exec(line);\n    if (named?.[1]) {\n      for (const name of namedExports(named[1])) into.add(name);\n      continue;\n    }\n    if (!JSDOC.test(line)) continue;\n    // A doc comment documents whatever follows it. Walk forward — over the rest\n    // of the comment and any decorators — to the first export declaration,\n    // changed or not, and credit the edit to that symbol.\n    for (let j = i + 1; j < lines.length && j < i + 40; j++) {\n      const found = ANY_DECL.exec(lines[j]!);\n      if (found?.[1]) {\n        into.add(found[1]);\n        break;\n      }\n    }\n  }\n}\n\n/** Parse a unified diff into per-file changes. */\nfunction parseDiff(diff: string): FileChange[] {\n  const files = new Map<string, FileChange>();\n  let current: FileChange | null = null;\n  let hunk: string[] = [];\n  const flush = () => {\n    if (current && hunk.length) scanHunk(hunk, current.exports);\n    hunk = [];\n  };\n  for (const line of diff.split(\"\\n\")) {\n    const header = /^diff --git a\\/(\\S+) b\\/(\\S+)/.exec(line);\n    if (header) {\n      flush();\n      const path = header[2] ?? header[1]!;\n      current = files.get(path) ?? { path, exports: new Set(), manifest: /(^|\\/)package\\.json$/.test(path) };\n      files.set(path, current);\n      continue;\n    }\n    if (line.startsWith(\"@@\")) {\n      flush();\n      continue;\n    }\n    if (current && SOURCE.test(current.path) && !TEST_PATH.test(current.path)) hunk.push(line);\n  }\n  flush();\n  return [...files.values()];\n}\n\n/** Build the surfaces a diff touched.\n *\n * `labelFor` names a workspace directory (`packages/db` → `@odla-ai/db`);\n * returning undefined falls back to the directory itself, so the scan still\n * works against a checkout whose manifests cannot be read.\n */\nexport function changedSurfaces(\n  diff: string,\n  labelFor: (workspace: string) => string | undefined = () => undefined,\n): ChangedSurface[] {\n  const grouped = new Map<string, { paths: string[]; exports: Set<string>; areas: Set<string>; manifest: boolean }>();\n  for (const file of parseDiff(diff)) {\n    const workspace = workspaceOf(file.path);\n    const entry = grouped.get(workspace) ?? { paths: [], exports: new Set(), areas: new Set(), manifest: false };\n    entry.paths.push(file.path);\n    for (const name of file.exports) entry.exports.add(name);\n    const area = areaOf(file.path);\n    if (area) entry.areas.add(area);\n    entry.manifest ||= file.manifest;\n    grouped.set(workspace, entry);\n  }\n\n  return [...grouped.entries()]\n    .map(([workspace, entry]) => {\n      const label = labelFor(workspace) ?? workspace;\n      const exports = [...entry.exports].sort();\n      // Export names first: they are the most specific thing a runbook could\n      // quote, and the ranker weights a rarer term higher.\n      const terms = [\n        ...exports,\n        ...words(label),\n        ...[...entry.areas].flatMap(words),\n        ...(entry.manifest ? [\"version\", \"release\", \"publish\"] : []),\n      ];\n      return {\n        label,\n        paths: entry.paths.sort(),\n        exports,\n        query: [...new Set(terms)].slice(0, 12).join(\" \"),\n      };\n    })\n    .filter((surface) => surface.query)\n    .sort((a, b) => b.exports.length - a.exports.length || a.label.localeCompare(b.label));\n}\n","// `odla-ai runbook lint` — hold the live runbook corpus to the same standard as\n// repository markdown.\n//\n// `check:docs` validates the commands named in skills, docs and READMEs. It\n// cannot see a runbook: the text is a row in odla-pm, outside every path the\n// gate globs. That blind spot is not incidental — it is the direct cost of\n// moving the text somewhere it can be corrected without a release, and it is how\n// a runbook came to instruct readers to run `odla-ai runbook impact` months\n// before any published CLI had the command.\n//\n// So the check moves to where the corpus is reachable: a client that already\n// authenticates to read runbooks, and that knows its own command surface exactly.\nimport { call, PLATFORM_SCOPE, type RunbookContext } from \"./runbook-actions\";\nimport { cliVersion } from \"./help\";\nimport { describeProblem, validateInvocation } from \"./surface\";\nimport { describeUnmet, parseRequires, unmetRequirements } from \"./runbook-requires\";\n\ninterface Runbook {\n  slug: string;\n  appId: string;\n  title: string;\n  body: string;\n  requires?: string;\n}\n\n/** One problem found in one runbook. */\nexport interface LintFinding {\n  slug: string;\n  appId: string;\n  /** `command` — an invocation the CLI does not accept. `requires` — the\n   * runbook assumes more than this caller has. `undeclared` — it names a\n   * command this CLI lacks while claiming no minimum version. */\n  kind: \"command\" | \"requires\" | \"undeclared\";\n  detail: string;\n}\n\n/** Every `odla-ai …` invocation a runbook body names, as word arrays.\n *\n * Two rules keep prose out. The invocation must start with `npx` or sit against\n * a backtick, so \"the odla-ai monorepo means you file…\" is read as the sentence\n * it is. And words are collected with HORIZONTAL whitespace only: a newline ends\n * an invocation, or the next line of a code block gets swallowed and its first\n * word reported as a sub-action. */\nexport function invocationsIn(body: string): string[][] {\n  const re = /(`|npx[^\\S\\n]+)?(?:@odla-ai\\/cli(?:@[\\w.-]+)?|odla-ai)((?:[^\\S\\n]+[a-z][\\w-]*)+)/g;\n  const found: string[][] = [];\n  for (const match of body.matchAll(re)) {\n    if (!match[1]) continue;\n    const words = match[2]!.trim().split(/[^\\S\\n]+/);\n    if (words.length) found.push(words);\n  }\n  return found;\n}\n\n/** Check one runbook against this CLI's surface and the caller's versions. */\nexport function lintRunbook(\n  runbook: Runbook,\n  installed: Readonly<Record<string, string | undefined>>,\n): LintFinding[] {\n  const findings: LintFinding[] = [];\n  const at = { slug: runbook.slug, appId: runbook.appId };\n  const declared = parseRequires(runbook.requires);\n\n  const seen = new Set<string>();\n  for (const words of invocationsIn(runbook.body)) {\n    const problem = validateInvocation(words);\n    if (!problem) continue;\n    const key = `${problem.validPrefix}|${problem.word}`;\n    if (seen.has(key)) continue;\n    seen.add(key);\n    // A runbook that names a command this CLI lacks is either wrong, or right\n    // about a newer version — and `requires` is the only way to tell those\n    // apart. Reported as a different KIND so the two get different fixes.\n    findings.push({\n      ...at,\n      kind: declared.length ? \"command\" : \"undeclared\",\n      detail: declared.length\n        ? `\\`odla-ai ${words.join(\" \")}\\`: ${describeProblem(problem)}`\n        : `\\`odla-ai ${words.join(\" \")}\\`: ${describeProblem(problem)}. If a newer package added it, declare that with requires.`,\n    });\n  }\n\n  const unmet = unmetRequirements(runbook.requires, installed);\n  if (unmet.length) findings.push({ ...at, kind: \"requires\", detail: describeUnmet(runbook.slug, unmet) });\n  return findings;\n}\n\n/**\n * Lint every runbook in scope.\n *\n * Throws nothing on findings — it reports them and sets no exit code, matching\n * `runbook impact`: whether a written procedure is wrong is a judgement, and the\n * caller is better placed to make it than a gate is.\n */\nexport async function runbookLint(ctx: RunbookContext, all: boolean): Promise<void> {\n  const params = new URLSearchParams();\n  if (!all) params.set(\"app\", ctx.appId);\n  const page = await call<{ records: Runbook[] }>(ctx, \"GET\", `/runbook${params.size ? `?${params}` : \"\"}`);\n  const installed = { \"@odla-ai/cli\": cliVersion() };\n\n  const findings = page.records.flatMap((runbook) => lintRunbook(runbook, installed));\n  if (ctx.json) return ctx.out.log(JSON.stringify({ checked: page.records.length, findings }, null, 2));\n\n  if (!page.records.length) return ctx.out.log(\"(no runbooks in scope)\");\n  if (!findings.length) {\n    return ctx.out.log(\n      `${page.records.length} runbook${page.records.length === 1 ? \"\" : \"s\"} checked; every command they name is real for @odla-ai/cli ${cliVersion()}.`,\n    );\n  }\n  ctx.out.log(`${findings.length} finding${findings.length === 1 ? \"\" : \"s\"} across ${page.records.length} runbooks:`);\n  for (const finding of findings) {\n    const scope = finding.appId === PLATFORM_SCOPE ? \"\" : ` --app ${finding.appId}`;\n    ctx.out.log(\"\");\n    ctx.out.log(`${finding.slug} [${finding.kind}]`);\n    ctx.out.log(`  ${finding.detail}`);\n    ctx.out.log(`  odla-ai runbook get ${finding.slug}${scope}`);\n  }\n}\n","// `odla-ai runbook search \"<question>\"` — discovery for humans and agents alike.\n//\n// The ranking is NOT done here. It runs server-side and is the same code the\n// `search_runbooks` agent tool and Studio call, so the three cannot drift: a\n// second ranker in the client is a second set of results to explain, and the one\n// that drifts is always the one nobody is looking at.\nimport { call, type RunbookContext } from \"./runbook-actions\";\n\ninterface Hit {\n  slug: string;\n  appId: string;\n  title: string;\n  version: number;\n  heading: string;\n  anchor: string;\n  excerpt: string;\n  score: number;\n  command: string;\n}\ninterface SearchResult {\n  hits: Hit[];\n  outcome: \"ranked\" | \"no-sections\" | \"no-match\" | \"empty-corpus\";\n  candidates: Array<{ slug: string; title: string; command: string }>;\n}\n\n/** Ask the runbooks a question and print the passages that answer it. */\nexport async function runbookSearch(ctx: RunbookContext, query: string, all: boolean, limit?: number): Promise<void> {\n  const params = new URLSearchParams({ q: query });\n  if (!all) params.set(\"app\", ctx.appId);\n  if (limit) params.set(\"limit\", String(limit));\n  const result = await call<SearchResult>(ctx, \"GET\", `/runbook/search?${params}`);\n\n  if (ctx.json) return ctx.out.log(JSON.stringify(result, null, 2));\n\n  if (result.outcome === \"empty-corpus\") return ctx.out.log(\"no runbooks are available to search\");\n  if (result.outcome === \"no-match\") return ctx.out.log(`no runbook mentions \"${query}\"`);\n  if (result.outcome === \"no-sections\") {\n    ctx.out.log(`no section matches \"${query}\" directly. These runbooks are about it:`);\n    for (const c of result.candidates) ctx.out.log(`  ${c.slug} — ${c.title}\\n    ${c.command}`);\n    return;\n  }\n  // Each block is a citable answer: where it came from, and how to get the rest.\n  for (const [i, hit] of result.hits.entries()) {\n    if (i) ctx.out.log(\"\");\n    ctx.out.log(`${hit.slug}${hit.heading ? ` § ${hit.heading}` : \"\"}  (v${hit.version})`);\n    for (const line of hit.excerpt.split(\"\\n\")) ctx.out.log(`  ${line}`);\n    ctx.out.log(`  source: ${hit.slug}${hit.anchor ? `#${hit.anchor}` : \"\"} · ${hit.command}`);\n  }\n}\n\ninterface AskResult extends SearchResult {\n  answer: string | null;\n  unavailable?: \"disabled\" | \"no-key\" | \"no-passages\";\n  model?: string;\n  truncated?: boolean;\n}\n\n/** Runbooks answer \"how do I do this\"; JSDoc answers \"what does this do\". An\n * asker who gets only the first half and does not know there is a second half\n * fills it in from memory, which is the failure this whole surface exists to\n * prevent — so every answer says where the other half is. */\nconst JSDOC_POINTER =\n  \"Runbooks are procedure. For what an export does — arguments, defaults, errors — read its JSDoc: \" +\n  \"the installed package's .d.ts, or its page under https://odla.ai/docs.\";\n\n/** Ask the runbooks a question and get a written, cited answer. */\nexport async function runbookAsk(ctx: RunbookContext, question: string, all: boolean): Promise<void> {\n  const result = await call<AskResult>(ctx, \"POST\", \"/runbook/ask\", {\n    question,\n    ...(all ? {} : { app: ctx.appId }),\n  });\n  if (ctx.json) return ctx.out.log(JSON.stringify(result, null, 2));\n\n  if (result.answer) {\n    ctx.out.log(result.answer);\n    if (result.truncated)\n      ctx.out.log(\n        \"\\n[cut off at the output limit — raise \\\"Output tokens/call\\\" for runbook.answer under\" +\n          \" Platform → AI, and read the sources below meanwhile]\",\n      );\n    ctx.out.log(\"\");\n    ctx.out.log(`sources: ${result.hits.map((h) => `${h.slug}${h.anchor ? `#${h.anchor}` : \"\"}`).join(\", \") || \"none\"}`);\n    ctx.out.log(JSDOC_POINTER);\n    return;\n  }\n  // No answer is a normal state, not a failure: say why, then fall back to the\n  // passages, which are the useful part either way.\n  const why =\n    result.unavailable === \"disabled\"\n      ? \"Runbook answers are off — an admin enables them under Platform → AI → Runbook answers.\"\n      : result.unavailable === \"no-key\"\n        ? \"Runbook answers are on but the provider has no key stored.\"\n        : \"Nothing in the runbooks bears on that.\";\n  ctx.out.log(why);\n  if (result.hits.length) {\n    ctx.out.log(\"\");\n    for (const hit of result.hits) {\n      ctx.out.log(`${hit.slug}${hit.heading ? ` § ${hit.heading}` : \"\"}  (v${hit.version})`);\n      ctx.out.log(`  ${hit.command}`);\n    }\n  }\n  ctx.out.log(\"\");\n  ctx.out.log(JSDOC_POINTER);\n}\n\n/** Report a problem with a runbook onto its own discussion thread. */\nexport async function runbookComment(ctx: RunbookContext, slug: string, body: string): Promise<void> {\n  const page = await call<{ records: Array<{ id: string; version: number }> }>(\n    ctx,\n    \"GET\",\n    `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`,\n  );\n  const found = page.records[0];\n  if (!found) throw new Error(`no runbook \"${slug}\" in ${ctx.appId}`);\n  await call(ctx, \"POST\", `/runbook/${encodeURIComponent(found.id)}/comments`, { body });\n  ctx.out.log(`commented on ${slug} (v${found.version})`);\n}\n","// Open a runbook in the operator's editor. Editing prose from a shell without\n// this means writing the whole body to a file by hand first, which is why\n// `runbook edit` previously demanded `--file`; for a human fixing one wrong step\n// that is the difference between a one-minute correction and a chore.\nimport { spawnSync } from \"node:child_process\";\nimport { mkdtempSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport process from \"node:process\";\n\n/** How the editor was resolved, so a failure can say what to set. */\nexport const EDITOR_ENV = [\"ODLA_EDITOR\", \"VISUAL\", \"EDITOR\"] as const;\n\n/** The editor command, or null when the environment names none. */\nexport function resolveEditor(env: NodeJS.ProcessEnv = process.env): string | null {\n  for (const name of EDITOR_ENV) {\n    const value = env[name];\n    if (value && value.trim()) return value.trim();\n  }\n  return null;\n}\n\n/** Injectable spawn + tty probe, so the round trip is testable without an editor. */\nexport interface EditorDeps {\n  env?: NodeJS.ProcessEnv;\n  /** Run the editor against `path`; returns its exit code. */\n  run?: (command: string, path: string) => number;\n  /** Whether stdin is a terminal — a non-interactive shell has no editor to open. */\n  interactive?: () => boolean;\n}\n\nfunction defaultRun(command: string, path: string): number {\n  // The command may carry arguments (\"code --wait\"), so split on whitespace and\n  // inherit stdio: a terminal editor needs the real tty to draw on.\n  const [bin, ...args] = command.split(/\\s+/);\n  const result = spawnSync(bin!, [...args, path], { stdio: \"inherit\" });\n  if (result.error) throw new Error(`could not start editor \"${command}\": ${result.error.message}`);\n  return result.status ?? 0;\n}\n\n/**\n * Open `initial` in the operator's editor and return what they saved.\n *\n * Returns `null` when the text came back unchanged — an unchanged body is a\n * cancelled edit, and writing it would burn a version and a revision recording\n * that nothing happened.\n *\n * @throws when no editor is configured or the session is not interactive, so the\n * caller can fall back to `--file` rather than hanging on a spawn that cannot draw.\n */\nexport function editText(initial: string, slug: string, deps: EditorDeps = {}): string | null {\n  const env = deps.env ?? process.env;\n  const interactive = deps.interactive ?? (() => Boolean(process.stdin.isTTY));\n  const editor = resolveEditor(env);\n  if (!editor)\n    throw new Error(\n      `no editor configured — set $EDITOR (or $ODLA_EDITOR), or pass --file <path>/--body \"…\" instead`,\n    );\n  if (!interactive())\n    throw new Error(`cannot open an editor without a terminal — pass --file <path> or --body \"…\" instead`);\n\n  const dir = mkdtempSync(join(tmpdir(), \"odla-runbook-\"));\n  // Name it after the slug with a .md suffix so the editor highlights markdown\n  // and the operator can see which runbook they are in.\n  const file = join(dir, `${slug}.md`);\n  try {\n    writeFileSync(file, initial, { mode: 0o600 });\n    const code = defaultRunOrInjected(deps)(editor, file);\n    if (code !== 0) throw new Error(`editor \"${editor}\" exited with ${code}; nothing was written`);\n    const edited = readFileSync(file, \"utf8\");\n    return edited === initial ? null : edited;\n  } finally {\n    rmSync(dir, { recursive: true, force: true });\n  }\n}\n\nconst defaultRunOrInjected = (deps: EditorDeps): ((command: string, path: string) => number) =>\n  deps.run ?? defaultRun;\n","// Fetch a runbook's current text, hand it to the operator's editor, and return\n// what they saved. Kept apart from `runbook-actions` so the editor round trip —\n// the only part of the CLI that shells out to an interactive program — is\n// isolated and injectable.\nimport { call, type RunbookContext } from \"./runbook-actions\";\nimport { editText, type EditorDeps } from \"./runbook-editor\";\n\ninterface Runbook {\n  slug: string;\n  title: string;\n  body: string;\n  version: number;\n}\n\n/**\n * Open `slug`'s current body in the operator's editor.\n *\n * @returns the saved text, or `null` when it came back unchanged — an unchanged\n * body is a cancelled edit, and writing it would burn a version and record a\n * revision saying nothing happened.\n */\nexport async function editRunbook(\n  ctx: RunbookContext,\n  slug: string,\n  deps: EditorDeps = {},\n): Promise<string | null> {\n  const page = await call<{ records: Runbook[] }>(\n    ctx,\n    \"GET\",\n    `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`,\n  );\n  const found = page.records[0];\n  if (!found) throw new Error(`no runbook \"${slug}\" in ${ctx.appId}`);\n  ctx.out.log(`opening ${slug} v${found.version} in your editor…`);\n  return editText(found.body, slug, deps);\n}\n","// `odla-ai whoami` — report the identity this CLI is running as, and in\n// particular whether it carries platform admin. That answer decides what the\n// runbook commands will let you do, and it is not guessable from the local\n// config: a handshake-minted device token is NEVER admin, however the human who\n// approved it is configured, so \"I am an odla admin\" and \"this terminal is\" are\n// different facts.\nimport { assertArgs, stringOpt, type ParsedArgv } from \"./argv\";\nimport { resolveOperatorContext } from \"./operator-context\";\nimport { getDeveloperToken } from \"./token\";\n\n/** The registry's `/registry/me` projection. */\nexport interface Identity {\n  developerId: string;\n  email: string | null;\n  admin: boolean;\n  machine: boolean;\n  scopes: string[];\n}\n\ninterface WhoamiDeps {\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/** Fetch the caller's identity from the registry. Exported so the runbook\n * commands can explain a 403 in terms of who you actually are. */\nexport async function fetchIdentity(\n  platformUrl: string,\n  token: string,\n  doFetch: typeof fetch,\n): Promise<Identity> {\n  const res = await doFetch(`${platformUrl.replace(/\\/$/, \"\")}/registry/me`, {\n    headers: { authorization: `Bearer ${token}` },\n  });\n  if (!res.ok) throw new Error(`could not resolve identity (HTTP ${res.status})`);\n  const body = (await res.json()) as Partial<Identity>;\n  return {\n    developerId: String(body.developerId ?? \"\"),\n    email: body.email ?? null,\n    admin: body.admin === true,\n    machine: body.machine === true,\n    scopes: Array.isArray(body.scopes) ? body.scopes.map(String) : [],\n  };\n}\n\n/** How this credential was obtained, in the terms the platform uses. */\nfunction credentialKind(identity: Identity): string {\n  if (identity.machine) return \"machine (platform admin secret)\";\n  return identity.scopes.length ? \"device token (scoped)\" : \"device token or session\";\n}\n\n/** Print the identity behind the current credential. */\nexport async function whoamiCommand(parsed: ParsedArgv, deps: WhoamiDeps = {}): Promise<void> {\n  assertArgs(\n    parsed,\n    [\"config\", \"context\", \"platform\", \"token\", \"email\", \"json\"],\n    1,\n  );\n  const out = deps.stdout ?? console;\n  const doFetch = deps.fetch ?? fetch;\n  const { cfg } = await resolveOperatorContext(parsed, {\n    allowMissingConfig: true,\n  });\n  const token = await getDeveloperToken(\n    cfg,\n    {\n      configPath: cfg.configPath,\n      token: stringOpt(parsed.options.token),\n      email: stringOpt(parsed.options.email),\n      // As above: never suppress the browser for an ordinary sign-in.\n      open: undefined,\n    },\n    doFetch,\n    out,\n  );\n  const identity = await fetchIdentity(cfg.platformUrl, token, doFetch);\n\n  if (parsed.options.json === true) {\n    out.log(JSON.stringify(identity, null, 2));\n    return;\n  }\n  out.log(`platform:   ${cfg.platformUrl}`);\n  out.log(`developer:  ${identity.developerId}`);\n  out.log(`email:      ${identity.email ?? \"(none)\"}`);\n  out.log(`credential: ${credentialKind(identity)}`);\n  out.log(`admin:      ${identity.admin ? \"yes\" : \"no\"}`);\n  if (identity.scopes.length) out.log(`scopes:     ${identity.scopes.join(\", \")}`);\n  if (!identity.admin) {\n    // The one consequence worth stating without being asked, since it is the\n    // difference between \"the command is broken\" and \"you are not an admin\".\n    out.log(\"\\nYou can read platform runbooks but not edit them. A handshake-minted\");\n    out.log(\"device token never carries admin — sign in to Studio as an admin to edit.\");\n  }\n}\n","// `odla-ai runbook <action>` — read and edit operational runbooks, which live in\n// the odla-pm database rather than in this package. That is the point: the text\n// an agent follows is fetched at the moment it is followed, so correcting a wrong\n// step is a row edit, not a release of this CLI.\n//\n// Reads work for any signed-in developer. Writing odla's own runbooks needs\n// either platform admin or an admin-approved `platform:runbook:write` capability,\n// which this command requests automatically — a plain handshake token is never\n// admin by design. `odla-ai whoami` reports what this terminal holds.\nimport { assertArgs, numberOpt, stringOpt, type ParsedArgv } from \"./argv\";\nimport { resolveOperatorContext } from \"./operator-context\";\nimport {\n  PLATFORM_SCOPE,\n  readBody,\n  runbookEdit,\n  runbookGet,\n  runbookHistory,\n  runbookList,\n  runbookNew,\n  runbookRemove,\n  runbookRevert,\n  runbookStatus,\n  runbookVisibility,\n  type RunbookContext,\n} from \"./runbook-actions\";\nimport { getScopedPlatformToken } from \"./admin-ai-auth\";\nimport { runbookImport } from \"./runbook-import\";\nimport { runbookImpact } from \"./runbook-impact\";\nimport { runbookLint } from \"./runbook-lint\";\nimport { acceptedAfter } from \"./surface\";\nimport { runbookAsk, runbookComment, runbookSearch } from \"./runbook-search-command\";\nimport { editRunbook } from \"./runbook-edit-flow\";\nimport { getDeveloperToken } from \"./token\";\nimport { fetchIdentity } from \"./whoami-command\";\n\nconst ALLOWED = [\n  \"config\", \"token\", \"email\", \"json\", \"app\", \"all\", \"title\", \"summary\",\n  \"file\", \"body\", \"note\", \"version\", \"q\", \"visibility\", \"dry-run\", \"limit\",\n  \"base\", \"requires\", \"platform\", \"context\",\n];\n\ninterface RunbookDeps {\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n  openUrl?: (url: string) => Promise<void>;\n  /** See {@link runbookImpact} — injected so the impact scan can run over a\n   * fixed diff rather than the checkout's own history. */\n  runGit?: (args: string[]) => string;\n}\n\nfunction requireSlug(slug: string | undefined, action: string): string {\n  if (!slug) throw new Error(`\"runbook ${action}\" needs a slug, e.g. \"odla-ai runbook ${action} release\"`);\n  return slug;\n}\n\n/** Actions that write. Platform-scoped writes need an admin-approved capability;\n * reads work with the ordinary developer grant every other command uses. */\nconst WRITES = new Set([\"new\", \"edit\", \"publish\", \"archive\", \"visibility\", \"revert\", \"rm\", \"import\"]);\n\nasync function buildContext(parsed: ParsedArgv, deps: RunbookDeps, action: string): Promise<RunbookContext> {\n  const appIdOption = stringOpt(parsed.options.app);\n  const context = await resolveOperatorContext(parsed, {\n    allowMissingConfig: true,\n  });\n  const { cfg } = context;\n  const doFetch = deps.fetch ?? fetch;\n  const out = deps.stdout ?? console;\n  // Runbooks remain platform-scoped by default, including inside a project.\n  // ODLA_APP_ID is an explicit projectless scope just like --app.\n  const appId =\n    appIdOption ??\n    (context.app.source === \"environment\" || context.app.source === \"profile\"\n      ? context.app.value\n      : null) ??\n    PLATFORM_SCOPE;\n  // Editing odla's own runbooks is admin-gated, and a plain handshake token is\n  // never admin by design. Ask for the exact capability instead — an admin\n  // approves it in Studio and it expires in fifteen minutes — rather than\n  // failing with a 403 the caller can do nothing about. An app's own runbooks\n  // are gated by co-ownership, so they need no capability.\n  // A dry run reads and reports; asking a human to approve a write capability for\n  // it would train everyone to approve grants that were never going to be used.\n  const dryRun = parsed.options[\"dry-run\"] === true;\n  // A dry-run import parses local files and writes nothing, so it needs no\n  // credential at all — making a human authenticate to preview a parse is pure\n  // friction, and it is exactly the command someone runs first.\n  if (action === \"import\" && dryRun) {\n    return {\n      platformUrl: cfg.platformUrl,\n      token: \"\",\n      doFetch,\n      out,\n      json: parsed.options.json === true,\n      appId,\n    };\n  }\n  const needsCapability =\n    WRITES.has(action) && !dryRun && appId === PLATFORM_SCOPE && !stringOpt(parsed.options.token);\n  const token = needsCapability\n    ? await getScopedPlatformToken({\n        platform: cfg.platformUrl,\n        scope: \"platform:runbook:write\",\n        email: stringOpt(parsed.options.email),\n        label: `odla CLI (runbook ${action})`,\n        fetch: doFetch,\n        stdout: out,\n        openApprovalUrl: deps.openUrl,\n        // A project, named context, or the global operator context owns the\n        // exact-scope cache; it never follows an arbitrary shell directory.\n        rootDir: cfg.rootDir,\n        tokenFile: context.credentials.scopedTokenFile,\n      })\n    : await getDeveloperToken(\n        cfg,\n        {\n          configPath: cfg.configPath,\n          token: stringOpt(parsed.options.token),\n          email: stringOpt(parsed.options.email),\n          // Let the normal browser policy decide (it already suppresses tests,\n          // CI and SSH). Hardcoding `false` meant a first-time handshake printed\n          // a link and opened nothing — the one moment a browser is the whole\n          // point.\n          open: undefined,\n        },\n        doFetch,\n        out,\n      );\n  return {\n    platformUrl: cfg.platformUrl,\n    token,\n    doFetch,\n    out,\n    json: parsed.options.json === true,\n    // Runbooks are odla's own by default; --app targets a project's instead.\n    appId,\n    identity: () => fetchIdentity(cfg.platformUrl, token, doFetch),\n  };\n}\n\n/** Dispatch `odla-ai runbook <action> [slug]`. */\nexport async function runbookCommand(parsed: ParsedArgv, deps: RunbookDeps = {}): Promise<void> {\n  const action = parsed.positionals[1] ?? \"list\";\n  // `ask` and `search` take a QUESTION, and both already join their trailing\n  // positionals into one. Capping those at four turned an unquoted question —\n  // the form anyone types first — into \"unexpected argument\", which reads as a\n  // broken command rather than a missing pair of quotes.\n  assertArgs(parsed, ALLOWED, action === \"ask\" || action === \"search\" ? 64 : 4);\n  const ctx = await buildContext(parsed, deps, action);\n  const slug = parsed.positionals[2];\n\n  switch (action) {\n    case \"list\":\n      return runbookList(ctx, parsed.options.all === true, stringOpt(parsed.options.q));\n    case \"ask\": {\n      const question = parsed.positionals.slice(2).join(\" \") || stringOpt(parsed.options.q);\n      if (!question) throw new Error('\"runbook ask\" needs a question, e.g. odla-ai runbook ask \"how do I roll back a publish?\"');\n      return runbookAsk(ctx, question, parsed.options.all === true);\n    }\n    case \"lint\":\n      return runbookLint(ctx, parsed.options.all === true);\n    case \"impact\":\n      return runbookImpact(\n        ctx,\n        {\n          base: stringOpt(parsed.options.base) ?? \"origin/main\",\n          all: parsed.options.all === true,\n          limit: numberOpt(parsed.options.limit, \"--limit\"),\n        },\n        deps.runGit ? { runGit: deps.runGit } : {},\n      );\n    case \"search\": {\n      const query = parsed.positionals.slice(2).join(\" \") || stringOpt(parsed.options.q);\n      if (!query) throw new Error('\"runbook search\" needs a question, e.g. odla-ai runbook search \"roll back a bad publish\"');\n      return runbookSearch(ctx, query, parsed.options.all === true, numberOpt(parsed.options.limit, \"--limit\"));\n    }\n    case \"comment\": {\n      const name = requireSlug(slug, \"comment\");\n      const body = stringOpt(parsed.options.body) ?? readBody(stringOpt(parsed.options.file), undefined);\n      return runbookComment(ctx, name, body);\n    }\n    case \"get\":\n    case \"cat\":\n      return runbookGet(ctx, requireSlug(slug, \"get\"));\n    case \"new\": {\n      const name = requireSlug(slug, \"new\");\n      return runbookNew(\n        ctx,\n        name,\n        stringOpt(parsed.options.title) ?? name,\n        readBody(stringOpt(parsed.options.file), stringOpt(parsed.options.body)),\n        stringOpt(parsed.options.summary),\n        stringOpt(parsed.options.requires),\n      );\n    }\n    case \"edit\": {\n      const name = requireSlug(slug, \"edit\");\n      const file = stringOpt(parsed.options.file);\n      const inline = stringOpt(parsed.options.body);\n      // With neither --file nor --body, open the CURRENT text in $EDITOR. That\n      // is what a human fixing one wrong step reaches for; making them dump the\n      // body to a file first is the difference between a correction and a chore.\n      const body =\n        file === undefined && inline === undefined\n          ? await editRunbook(ctx, name)\n          : readBody(file, inline);\n      if (body === null) return ctx.out.log(`${name} unchanged; nothing written`);\n      return runbookEdit(\n        ctx,\n        name,\n        body,\n        stringOpt(parsed.options.note),\n        parsed.options.requires === undefined ? undefined : (stringOpt(parsed.options.requires) ?? \"\"),\n      );\n    }\n    case \"import\": {\n      const dir = parsed.positionals[2];\n      if (!dir) throw new Error('\"runbook import\" needs a directory, e.g. \"odla-ai runbook import ./runbooks\"');\n      return runbookImport(ctx, dir, {\n        visibility: stringOpt(parsed.options.visibility),\n        dryRun: parsed.options[\"dry-run\"] === true,\n      });\n    }\n    case \"visibility\": {\n      const value = parsed.positionals[3] ?? stringOpt(parsed.options.visibility);\n      if (!value) throw new Error('\"runbook visibility\" needs operator|admin, e.g. \"runbook visibility release operator\"');\n      return runbookVisibility(ctx, requireSlug(slug, \"visibility\"), value);\n    }\n    case \"publish\":\n      return runbookStatus(ctx, requireSlug(slug, \"publish\"), \"published\");\n    case \"archive\":\n      return runbookStatus(ctx, requireSlug(slug, \"archive\"), \"archived\");\n    case \"history\":\n      return runbookHistory(ctx, requireSlug(slug, \"history\"));\n    case \"revert\": {\n      const version = numberOpt(parsed.options.version, \"--version\");\n      if (version === undefined) throw new Error('\"runbook revert\" needs --version <n> (see \"runbook history\")');\n      return runbookRevert(ctx, requireSlug(slug, \"revert\"), version);\n    }\n    case \"rm\":\n      return runbookRemove(ctx, requireSlug(slug, \"rm\"));\n    default:\n      // Generated from the declared surface, so the sentence a user reads and\n      // the set a gate validates against can never disagree.\n      throw new Error(`unknown runbook action \"${action}\". Try ${acceptedAfter([\"runbook\"]).join(\", \")}.`);\n  }\n}\n","import { createInterface } from \"node:readline/promises\";\nimport { stringOpt, type ParsedArgv } from \"./argv\";\nimport { loadProjectConfig } from \"./config\";\nimport type { CliDependencies } from \"./cli\";\nimport type { HostedSecurityProfile } from \"./security\";\nimport { getDeveloperToken, platformAudience } from \"./token\";\n\nexport interface HostedSecurityContext {\n  platform: string;\n  token: string;\n  appId: string;\n  env: string;\n  fetch: typeof fetch;\n  stdout: Pick<typeof console, \"log\" | \"error\">;\n}\n\nexport async function hostedSecurityContext(\n  parsed: ParsedArgv,\n  dependencies: CliDependencies,\n): Promise<HostedSecurityContext> {\n  const configPath = stringOpt(parsed.options.config) ?? \"odla.config.mjs\";\n  const cfg = await loadProjectConfig(configPath);\n  const env = stringOpt(parsed.options.env) ?? (cfg.envs.includes(\"dev\") ? \"dev\" : cfg.envs[0]);\n  if (!env || !cfg.envs.includes(env)) {\n    throw new Error(`env \"${env ?? \"\"}\" is not declared in ${configPath}`);\n  }\n  const platform = platformAudience(stringOpt(parsed.options.platform) ?? cfg.platformUrl);\n  if (platformAudience(cfg.platformUrl) !== platform) {\n    throw new Error(\"--platform cannot reuse a project developer token from another platform; update odla.config.mjs and authenticate there\");\n  }\n  const doFetch = dependencies.fetch ?? fetch;\n  const stdout = dependencies.stdout ?? console;\n  const open = parsed.options.open === false\n    ? false\n    : parsed.options.open === true ? true : undefined;\n  const token = await getDeveloperToken(\n    cfg,\n    { configPath, email: stringOpt(parsed.options.email), open, openApprovalUrl: dependencies.openUrl },\n    doFetch,\n    stdout,\n  );\n  return { platform, token, appId: cfg.app.id, env, fetch: doFetch, stdout };\n}\n\nexport async function interactiveConfirmation(\n  message: string,\n  dependencies: CliDependencies,\n): Promise<boolean> {\n  if (dependencies.confirm) return dependencies.confirm(message);\n  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;\n  const prompt = createInterface({ input: process.stdin, output: process.stdout });\n  try {\n    const answer = await prompt.question(`${message} [y/N] `);\n    return /^y(?:es)?$/i.test(answer.trim());\n  } finally {\n    prompt.close();\n  }\n}\n\nexport function requiredSecurityPositional(\n  parsed: ParsedArgv,\n  index: number,\n  label: string,\n): string {\n  const value = parsed.positionals[index];\n  if (!value) throw new Error(`${label} is required`);\n  return value;\n}\n\nexport function securityProfile(\n  value: string | undefined,\n): HostedSecurityProfile | undefined {\n  if (value === undefined) return undefined;\n  if (value === \"odla\" || value === \"cloudflare-app\" || value === \"generic\") return value;\n  throw new Error(\"--profile must be odla, cloudflare-app, or generic\");\n}\n","import { stringOpt, type ParsedArgv } from \"./argv\";\nimport type {\n  HostedSecurityJob,\n  HostedSecurityIntent,\n  HostedSecurityPlan,\n  HostedSecurityReport,\n  HostedSecurityRoute,\n} from \"./security-hosted\";\n\nexport function printHostedSecurityPlan(\n  out: Pick<typeof console, \"log\">,\n  plan: HostedSecurityPlan,\n  appId: string,\n): void {\n  out.log(`Hosted security plan for ${appId}/${plan.env}: ${plan.ready ? \"ready\" : \"not ready\"}`);\n  out.log(`  plan digest: ${plan.planDigest}`);\n  out.log(`  consent/report/redaction: ${plan.consentContract} · ${plan.reportProjection} · ${plan.redactionContract}`);\n  out.log(`  prompt bundle: ${plan.promptBundle}`);\n  printHostedSecurityPlanRoute(out, \"discovery\", plan.routes.discovery);\n  printHostedSecurityPlanRoute(out, \"validation\", plan.routes.validation);\n  out.log(`  independent validation: ${plan.independent ? \"yes\" : \"no\"}`);\n  out.log(\"  source disclosure: bounded best-effort credential-pattern-redacted snippets may be sent through odla.ai to the selected providers\");\n  out.log(`  retained report: model-derived prose and repository-relative paths for up to ${plan.reportRetentionDays} days; treat it as sensitive`);\n  out.log(\"  target execution: disabled\");\n  out.log(`  to approve this exact plan, run security run --source <id> --plan-digest ${plan.planDigest} --ack-redacted-source`);\n}\n\nexport function printHostedSecurityIntent(\n  out: Pick<typeof console, \"log\">,\n  intent: HostedSecurityIntent,\n): void {\n  out.log(`Hosted security execution intent for ${intent.appId}/${intent.env}:`);\n  out.log(`  execution digest: ${intent.executionDigest}`);\n  out.log(`  contract: ${intent.executionContract}`);\n  out.log(`  source: ${intent.repository} (${intent.sourceId})`);\n  out.log(`  ref: ${intent.requestedRef ?? `default branch (${intent.defaultBranch})`}`);\n  out.log(`  profile: ${intent.profile}`);\n  out.log(`  disclosure: ${intent.sourceDisclosure} · plan ${intent.planDigest}`);\n}\n\nexport function assertHostedSecurityPlanReady(plan: HostedSecurityPlan): void {\n  const reasons: string[] = [];\n  for (const [label, route] of Object.entries(plan.routes)) {\n    if (!route.enabled) reasons.push(`${label} is disabled`);\n    if (!route.credentialReady) reasons.push(`${label} provider credential is unavailable`);\n  }\n  if (!plan.independent) reasons.push(\"discovery and validation are not independently routed\");\n  if (plan.ready && reasons.length === 0) return;\n  if (!plan.ready && reasons.length === 0) reasons.push(\"the platform marked the plan unavailable\");\n  throw new Error(`hosted security is not ready${reasons.length ? `: ${reasons.join(\"; \")}` : \"\"}. Ask a platform admin to update System AI security policy or credentials`);\n}\n\nexport function printHostedJob(\n  out: Pick<typeof console, \"log\">,\n  job: HostedSecurityJob,\n  platform: string,\n  appId: string,\n): void {\n  out.log(`security job ${job.jobId}: ${job.status}`);\n  out.log(`  source: ${job.repository} ${job.requestedRef ?? \"default\"} -> ${job.commitSha ?? \"resolving\"}`);\n  if (job.routes) {\n    out.log(`  discovery: ${routeLabel(job.routes.discovery)}`);\n    out.log(`  validation: ${routeLabel(job.routes.validation)}`);\n  } else {\n    out.log(\"  routes: platform System AI policy (assigned when analysis starts)\");\n  }\n  out.log(`  disclosure: ${job.sourceDisclosure} snippets · metadata retained up to ${job.retentionDays} days`);\n  out.log(`  consent: plan ${job.planDigest} · execution ${job.executionDigest} (${job.executionContract})`);\n  if (job.coverageStatus || job.coverage) printHostedCoverage(out, job);\n  if (job.counts) {\n    out.log(`  findings: confirmed=${job.counts.confirmed} needs_reproduction=${job.counts.needsReproduction} candidates=${job.counts.candidates}`);\n  }\n  if (job.errorCode) out.log(`  failure: ${job.errorCode}`);\n  const url = new URL(`/studio/apps/${encodeURIComponent(appId)}/${encodeURIComponent(job.env)}/security`, platform);\n  url.searchParams.set(\"job\", job.jobId);\n  out.log(`  Studio: ${url.toString()}`);\n}\n\nexport function printHostedReport(\n  out: Pick<typeof console, \"log\">,\n  report: HostedSecurityReport,\n): void {\n  out.log(`security report ${report.jobId}: ${report.repository}@${report.revision}`);\n  out.log(`  coverage: ${report.coverageStatus} cells=${report.metrics.coverageCells} shallow=${report.metrics.shallowCells} blocked=${report.metrics.blockedCells} unscheduled=${report.metrics.unscheduledCells} budget_exhausted=${report.metrics.budgetExhaustedCells}`);\n  out.log(`  findings: confirmed=${report.metrics.confirmed} needs_reproduction=${report.metrics.needsReproduction} candidates=${report.metrics.candidates} rejected=${report.metrics.rejected}`);\n  out.log(`  discovery: ${report.provenance.discovery?.provider ?? \"unknown\"}/${report.provenance.discovery?.model ?? \"unknown\"}`);\n  out.log(`  validation: ${report.provenance.validation?.provider ?? \"unknown\"}/${report.provenance.validation?.model ?? \"unknown\"} independent=${String(report.provenance.independentValidation)}`);\n  for (const finding of report.findings) {\n    const location = finding.locations[0];\n    out.log(`  [${finding.severity}] ${finding.title}${location ? ` (${location.path}:${location.line})` : \"\"} · ${finding.disposition}`);\n  }\n  for (const limitation of report.limitations) out.log(`  limitation: ${limitation}`);\n}\n\nexport function enforceHostedReportGate(\n  report: HostedSecurityReport,\n  parsed: ParsedArgv,\n  out: Pick<typeof console, \"log\">,\n  emitSuccess: boolean,\n): void {\n  const failOn = hostedSeverity(stringOpt(parsed.options[\"fail-on\"]) ?? \"high\", \"--fail-on\");\n  const candidateValue = parsed.options[\"fail-on-candidates\"];\n  const failOnCandidates = candidateValue === false\n    ? undefined\n    : hostedSeverity(stringOpt(candidateValue) ?? \"critical\", \"--fail-on-candidates\");\n  const atOrAbove = (severity: HostedSecurityReport[\"findings\"][number][\"severity\"], threshold: string) =>\n    HOSTED_SEVERITIES.indexOf(severity) >= HOSTED_SEVERITIES.indexOf(threshold as typeof severity);\n  const confirmed = report.findings.filter((finding) =>\n    finding.disposition === \"confirmed\" && atOrAbove(finding.severity, failOn));\n  const leads = failOnCandidates\n    ? report.findings.filter((finding) =>\n        finding.disposition !== \"confirmed\" && atOrAbove(finding.severity, failOnCandidates))\n    : [];\n  // Stricter than the local gate on purpose: a hosted run always schedules AI coverage, so any\n  // status other than \"complete\" — including \"not_run\" — means it silently did not happen, and this\n  // reads coverageStatus off the wire. Fail closed. The local gate deliberately lets \"not_run\" pass\n  // (see enforceLocalGate) because a credential-free passive scan legitimately produces it.\n  const incomplete = report.coverageStatus !== \"complete\"\n    && parsed.options[\"allow-incomplete\"] !== true;\n  if (confirmed.length || leads.length || incomplete) {\n    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? \"disabled\"}${incomplete ? `; coverage ${report.coverageStatus}` : \"\"}`);\n  }\n  if (emitSuccess) {\n    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? \"disabled\"}; coverage ${report.coverageStatus}. This is not proof that the application is secure.`);\n  }\n}\n\nfunction printHostedSecurityPlanRoute(\n  out: Pick<typeof console, \"log\">,\n  label: string,\n  route: HostedSecurityPlan[\"routes\"][\"discovery\"],\n): void {\n  const readiness = route.enabled && route.credentialReady ? \"ready\" : [\n    route.enabled ? undefined : \"disabled\",\n    route.credentialReady ? undefined : \"credential unavailable\",\n  ].filter(Boolean).join(\", \");\n  out.log(`  ${label}: ${route.provider}/${route.model} · policy v${route.policyVersion} · ${readiness}`);\n  out.log(`    bounds: ${route.maxCallsPerRun} calls/run · ${route.maxInputBytes} input bytes/call · ${route.maxOutputTokens} output tokens/call`);\n}\n\nfunction printHostedCoverage(out: Pick<typeof console, \"log\">, job: HostedSecurityJob): void {\n  const coverage = job.coverage;\n  out.log(`  coverage: ${job.coverageStatus ?? \"pending\"}${coverage?.completeCells !== undefined ? ` ${coverage.completeCells}/${coverage.totalCells ?? \"?\"}` : \"\"}${coverage?.shallowCells ? ` shallow=${coverage.shallowCells}` : \"\"}${coverage?.blockedCells ? ` blocked=${coverage.blockedCells}` : \"\"}${coverage?.unscheduledCells ? ` unscheduled=${coverage.unscheduledCells}` : \"\"}${coverage?.budgetExhaustedCells ? ` budget_exhausted=${coverage.budgetExhaustedCells}` : \"\"}`);\n}\n\nfunction routeLabel(route: HostedSecurityRoute): string {\n  return `${route.provider}/${route.model}${route.policyVersion ? ` policy v${route.policyVersion}` : \"\"}`;\n}\n\nconst HOSTED_SEVERITIES = [\"informational\", \"low\", \"medium\", \"high\", \"critical\"] as const;\n\nfunction hostedSeverity(value: string, flag: string): typeof HOSTED_SEVERITIES[number] {\n  if (HOSTED_SEVERITIES.includes(value as typeof HOSTED_SEVERITIES[number])) {\n    return value as typeof HOSTED_SEVERITIES[number];\n  }\n  throw new Error(`${flag} must be informational, low, medium, high, or critical`);\n}\n","import { findingsAtOrAbove, type Severity } from \"@odla-ai/security\";\nimport { getScopedPlatformToken } from \"./admin-ai\";\nimport {\n  assertArgs,\n  numberOpt,\n  requiredString,\n  stringOpt,\n  type ParsedArgv,\n} from \"./argv\";\nimport { loadProjectConfig } from \"./config\";\nimport type { CliDependencies } from \"./cli\";\nimport { hostedSecurityContext, securityProfile } from \"./security-command-context\";\nimport {\n  assertHostedSecurityPlanReady,\n  enforceHostedReportGate,\n  printHostedJob,\n  printHostedReport,\n  printHostedSecurityIntent,\n  printHostedSecurityPlan,\n} from \"./security-command-output\";\nimport { runHostedSecurity } from \"./security\";\nimport {\n  followHostedSecurityJob,\n  getHostedSecurityIntent,\n  getHostedSecurityPlan,\n  getHostedSecurityReport,\n  startHostedSecurityJob,\n} from \"./security-hosted\";\nimport { getDeveloperToken, platformAudience } from \"./token\";\n\nexport async function runSourceSecurityCommand(\n  parsed: ParsedArgv,\n  dependencies: CliDependencies,\n  sourceId: string,\n): Promise<void> {\n  assertArgs(parsed, [\n    \"config\", \"env\", \"profile\", \"platform\", \"source\", \"ref\", \"follow\", \"email\", \"open\", \"json\",\n    \"ack-redacted-source\", \"plan-digest\", \"fail-on\", \"fail-on-candidates\", \"allow-incomplete\",\n  ], 2);\n  const follow = parsed.options.follow !== false;\n  if (!follow && (parsed.options[\"fail-on\"] !== undefined\n    || parsed.options[\"fail-on-candidates\"] !== undefined\n    || parsed.options[\"allow-incomplete\"] !== undefined)) {\n    throw new Error(\"hosted security gate options require following the job; remove --no-follow\");\n  }\n  const acknowledgedDigest = requiredString(parsed.options[\"plan-digest\"], \"--plan-digest\");\n  const context = await hostedSecurityContext(parsed, dependencies);\n  const plan = await getHostedSecurityPlan(context);\n  if (parsed.options.json !== true) printHostedSecurityPlan(context.stdout, plan, context.appId);\n  assertHostedSecurityPlanReady(plan);\n  if (acknowledgedDigest !== plan.planDigest) {\n    throw new Error(`--plan-digest does not match the current hosted security plan (${plan.planDigest}); review and explicitly acknowledge the current digest`);\n  }\n  const requestedRef = stringOpt(parsed.options.ref);\n  const requestedProfile = securityProfile(stringOpt(parsed.options.profile));\n  const preview = await getHostedSecurityIntent({\n    ...context,\n    sourceId,\n    ref: requestedRef,\n    profile: requestedProfile,\n  });\n  if (parsed.options.json !== true) printHostedSecurityIntent(context.stdout, preview.intent);\n  if (preview.plan.planDigest !== plan.planDigest || preview.intent.planDigest !== plan.planDigest) {\n    throw new Error(`hosted security plan changed while previewing execution (${preview.plan.planDigest}); review and explicitly acknowledge the current plan digest`);\n  }\n  const job = await startHostedSecurityJob({\n    ...context,\n    sourceId,\n    ref: requestedRef,\n    profile: requestedProfile,\n    clientRequestId: crypto.randomUUID(),\n    sourceDisclosureAck: parsed.options[\"ack-redacted-source\"] === true ? \"redacted\" : undefined,\n    expectedPlanDigest: plan.planDigest,\n    expectedExecutionDigest: preview.intent.executionDigest,\n    expectedPolicyVersions: {\n      discovery: plan.routes.discovery.policyVersion,\n      validation: plan.routes.validation.policyVersion,\n    },\n  });\n  const result = follow\n    ? await followHostedSecurityJob({\n        ...context,\n        jobId: job.jobId,\n        wait: dependencies.pollWait,\n        onUpdate: parsed.options.json === true\n          ? undefined\n          : (value) => printHostedJob(context.stdout, value, context.platform, context.appId),\n      })\n    : job;\n  if (!follow) {\n    if (parsed.options.json === true) {\n      context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result }, null, 2));\n    } else {\n      printHostedJob(context.stdout, result, context.platform, context.appId);\n    }\n    return;\n  }\n  if (result.status !== \"completed\") {\n    if (parsed.options.json === true) {\n      context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result }, null, 2));\n    }\n    throw new Error(`hosted security job ${result.jobId} ended ${result.status}${result.errorCode ? `: ${result.errorCode}` : \"\"}`);\n  }\n  const report = await getHostedSecurityReport({ ...context, jobId: result.jobId });\n  if (parsed.options.json === true) {\n    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report }, null, 2));\n  } else {\n    printHostedReport(context.stdout, report);\n  }\n  enforceHostedReportGate(report, parsed, context.stdout, parsed.options.json !== true);\n}\n\nexport async function runLocalSecurityCommand(\n  parsed: ParsedArgv,\n  dependencies: CliDependencies,\n): Promise<void> {\n  if (parsed.options.source === true) {\n    throw new Error(\"--source requires a source id; run security sources first\");\n  }\n  assertArgs(parsed, [\n    \"config\", \"env\", \"out\", \"profile\", \"max-hunt-tasks\", \"run-id\", \"platform\",\n    \"self\", \"ack-redacted-source\", \"email\", \"open\", \"fail-on\", \"fail-on-candidates\", \"allow-incomplete\",\n  ], 3);\n  const configPath = stringOpt(parsed.options.config) ?? \"odla.config.mjs\";\n  const selfAudit = parsed.options.self === true;\n  const open = parsed.options.open === false\n    ? false\n    : parsed.options.open === true ? true : undefined;\n  const platform = stringOpt(parsed.options.platform);\n  const doFetch = dependencies.fetch ?? fetch;\n  const out = dependencies.stdout ?? console;\n  const result = await runHostedSecurity({\n    configPath,\n    selfAudit,\n    target: parsed.positionals[2],\n    out: stringOpt(parsed.options.out),\n    env: stringOpt(parsed.options.env),\n    profile: securityProfile(stringOpt(parsed.options.profile)),\n    maxHuntTasks: numberOpt(parsed.options[\"max-hunt-tasks\"], \"--max-hunt-tasks\"),\n    runId: stringOpt(parsed.options[\"run-id\"]),\n    platform,\n    sourceDisclosureAck: parsed.options[\"ack-redacted-source\"] === true ? \"redacted\" : undefined,\n    fetch: doFetch,\n    stdout: out,\n    getToken: async (request) => {\n      if (request.scope === \"platform:security:self\") {\n        // No `rootDir`: a self-audit deliberately runs WITHOUT a project (it\n        // audits odla itself), so the grant cache falls back to the working\n        // directory. Loading a config here would fail the very case this branch\n        // exists to serve.\n        return getScopedPlatformToken({\n          platform: request.platform,\n          scope: request.scope,\n          email: stringOpt(parsed.options.email),\n          open,\n          fetch: doFetch,\n          stdout: out,\n          openApprovalUrl: dependencies.openUrl,\n        });\n      }\n      const cfg = await loadProjectConfig(configPath);\n      if (platformAudience(cfg.platformUrl) !== platformAudience(request.platform)) {\n        throw new Error(\"--platform cannot reuse a project developer token from another platform; update odla.config.mjs and authenticate there\");\n      }\n      return getDeveloperToken(\n        cfg,\n        { configPath, email: stringOpt(parsed.options.email), open, openApprovalUrl: dependencies.openUrl },\n        doFetch,\n        out,\n      );\n    },\n  });\n  enforceLocalGate(result.report, parsed);\n}\n\nfunction enforceLocalGate(\n  report: Parameters<typeof findingsAtOrAbove>[0],\n  parsed: ParsedArgv,\n): void {\n  const failOn = severityOpt(stringOpt(parsed.options[\"fail-on\"]) ?? \"high\", \"--fail-on\");\n  const candidateValue = parsed.options[\"fail-on-candidates\"];\n  const failOnCandidates = candidateValue === false\n    ? undefined\n    : severityOpt(stringOpt(candidateValue) ?? \"critical\", \"--fail-on-candidates\");\n  const confirmed = findingsAtOrAbove(report, failOn);\n  const leads = failOnCandidates\n    ? findingsAtOrAbove(report, failOnCandidates, true)\n        .filter((finding) => finding.disposition !== \"confirmed\")\n    : [];\n  // \"not_run\" must pass: a credential-free passive scan has no discovery reasoner, so coverage.ts\n  // reports not_run, and README advertises exactly that CI recipe without --allow-incomplete.\n  // Gating it here would break every deterministic-only run. The no-false-assurance job belongs to\n  // the reporter, which prints that zero AI coverage cells is not evidence of complete coverage.\n  // The hosted gate is stricter (see enforceHostedReportGate) because there AI always runs.\n  const incomplete = report.coverageStatus === \"incomplete\"\n    && parsed.options[\"allow-incomplete\"] !== true;\n  if (confirmed.length || leads.length || incomplete) {\n    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? \"disabled\"}${incomplete ? \"; coverage incomplete\" : \"\"}`);\n  }\n}\n\nfunction severityOpt(value: string, flag: string): Severity {\n  if ([\"informational\", \"low\", \"medium\", \"high\", \"critical\"].includes(value)) {\n    return value as Severity;\n  }\n  throw new Error(`${flag} must be informational, low, medium, high, or critical`);\n}\n","import {\n  assertArgs,\n  requiredString,\n  stringOpt,\n  type ParsedArgv,\n} from \"./argv\";\nimport type { CliDependencies } from \"./cli\";\nimport {\n  hostedSecurityContext,\n  interactiveConfirmation,\n  requiredSecurityPositional,\n} from \"./security-command-context\";\nimport {\n  printHostedJob,\n  printHostedReport,\n  printHostedSecurityPlan,\n} from \"./security-command-output\";\nimport {\n  runLocalSecurityCommand,\n  runSourceSecurityCommand,\n} from \"./security-run-command\";\nimport {\n  connectGitHubSecuritySource,\n  disconnectGitHubSecuritySource,\n  followHostedSecurityJob,\n  getHostedSecurityJob,\n  getHostedSecurityPlan,\n  getHostedSecurityReport,\n  inferGitHubRepository,\n  listGitHubSecuritySources,\n} from \"./security-hosted\";\nimport { openUrl } from \"./open\";\n\nexport async function securityCommand(\n  parsed: ParsedArgv,\n  dependencies: CliDependencies,\n): Promise<void> {\n  const sub = parsed.positionals[1];\n  if (sub === \"github\") {\n    await githubSecurityCommand(parsed, dependencies);\n    return;\n  }\n  if (sub === \"plan\") {\n    assertArgs(parsed, [\"config\", \"env\", \"platform\", \"email\", \"open\", \"json\"], 2);\n    const context = await hostedSecurityContext(parsed, dependencies);\n    const plan = await getHostedSecurityPlan(context);\n    if (parsed.options.json === true) context.stdout.log(JSON.stringify(plan, null, 2));\n    else printHostedSecurityPlan(context.stdout, plan, context.appId);\n    return;\n  }\n  if (sub === \"sources\") {\n    await listSecuritySources(parsed, dependencies);\n    return;\n  }\n  if (sub === \"status\") {\n    await securityStatus(parsed, dependencies);\n    return;\n  }\n  if (sub === \"report\") {\n    assertArgs(parsed, [\"config\", \"env\", \"platform\", \"email\", \"open\", \"json\"], 3);\n    const jobId = requiredSecurityPositional(parsed, 2, \"job id\");\n    const context = await hostedSecurityContext(parsed, dependencies);\n    const report = await getHostedSecurityReport({ ...context, jobId });\n    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report, null, 2));\n    else printHostedReport(context.stdout, report);\n    return;\n  }\n  if (sub !== \"run\") {\n    throw new Error('unknown security command. Try \"odla-ai security plan\", \"security sources\", or \"security run\".');\n  }\n  const sourceId = stringOpt(parsed.options.source);\n  if (sourceId) await runSourceSecurityCommand(parsed, dependencies, sourceId);\n  else await runLocalSecurityCommand(parsed, dependencies);\n}\n\nasync function githubSecurityCommand(\n  parsed: ParsedArgv,\n  dependencies: CliDependencies,\n): Promise<void> {\n  const action = parsed.positionals[2];\n  if (action === \"disconnect\") {\n    assertArgs(parsed, [\"config\", \"env\", \"platform\", \"source\", \"email\", \"open\", \"yes\"], 3);\n    const context = await hostedSecurityContext(parsed, dependencies);\n    const sourceId = requiredString(parsed.options.source, \"--source\");\n    const confirmed = parsed.options.yes === true || await interactiveConfirmation(\n      `Disconnect GitHub security source ${sourceId} from ${context.appId}/${context.env}?`,\n      dependencies,\n    );\n    if (!confirmed) {\n      throw new Error(\"GitHub source disconnect cancelled; pass --yes in a non-interactive shell\");\n    }\n    await disconnectGitHubSecuritySource({ ...context, sourceId });\n    context.stdout.log(`github: disconnected ${sourceId} from ${context.appId}/${context.env}`);\n    return;\n  }\n  if (action !== \"connect\") {\n    throw new Error('unknown security github command. Try \"odla-ai security github connect\".');\n  }\n  assertArgs(parsed, [\"config\", \"env\", \"platform\", \"repo\", \"email\", \"open\"], 3);\n  const context = await hostedSecurityContext(parsed, dependencies);\n  // The server scans the app's Studio-connected repository. A --repo value or\n  // readable git origin rides along only as a cross-check; neither is required.\n  const repository = stringOpt(parsed.options.repo)\n    ?? await inferGitHubRepository(process.cwd(), dependencies.readGitOrigin).catch(() => undefined);\n  const connection = await connectGitHubSecuritySource({\n    ...context,\n    ...(repository === undefined ? {} : { repository }),\n    open: parsed.options.open !== false,\n    openInstallUrl: dependencies.openUrl ?? openUrl,\n    wait: dependencies.pollWait,\n    stdout: context.stdout,\n  });\n  context.stdout.log(`github: connected ${connection.repository ?? repository ?? \"app repository\"} (${connection.sourceId ?? \"source pending\"})`);\n  context.stdout.log(\"github: odla.ai stores the installation; no PAT or GitHub token is written locally\");\n}\n\nasync function listSecuritySources(\n  parsed: ParsedArgv,\n  dependencies: CliDependencies,\n): Promise<void> {\n  assertArgs(parsed, [\"config\", \"env\", \"platform\", \"email\", \"open\", \"json\"], 2);\n  const context = await hostedSecurityContext(parsed, dependencies);\n  const [plan, sources] = await Promise.all([\n    getHostedSecurityPlan(context),\n    listGitHubSecuritySources(context),\n  ]);\n  if (parsed.options.json === true) {\n    context.stdout.log(JSON.stringify({ plan, sources }, null, 2));\n    return;\n  }\n  printHostedSecurityPlan(context.stdout, plan, context.appId);\n  if (!sources.length) {\n    context.stdout.log(`No GitHub security sources connected for ${context.appId}/${context.env}.`);\n    return;\n  }\n  context.stdout.log(`GitHub security sources for ${context.appId}/${context.env}\\nsource\\trepository\\tdefault ref\\tstatus`);\n  for (const source of sources) {\n    context.stdout.log(`${source.sourceId}\\t${source.repository}\\t${source.defaultBranch}\\t${source.status}`);\n  }\n}\n\nasync function securityStatus(\n  parsed: ParsedArgv,\n  dependencies: CliDependencies,\n): Promise<void> {\n  assertArgs(parsed, [\"config\", \"env\", \"platform\", \"email\", \"open\", \"json\", \"follow\"], 3);\n  const jobId = requiredSecurityPositional(parsed, 2, \"job id\");\n  const context = await hostedSecurityContext(parsed, dependencies);\n  const job = parsed.options.follow === true\n    ? await followHostedSecurityJob({\n        ...context,\n        jobId,\n        wait: dependencies.pollWait,\n        onUpdate: parsed.options.json === true\n          ? undefined\n          : (value) => printHostedJob(context.stdout, value, context.platform, context.appId),\n      })\n    : await getHostedSecurityJob({ ...context, jobId });\n  if (parsed.options.json === true) context.stdout.log(JSON.stringify(job, null, 2));\n  else if (parsed.options.follow !== true) {\n    printHostedJob(context.stdout, job, context.platform, context.appId);\n  }\n}\n","import { adminCommand } from \"./admin-command\";\nimport { agentCommand } from \"./agent-command\";\nimport { appCommand } from \"./app-lifecycle\";\nimport { assertArgs, numberOpt, parseArgv, stringOpt } from \"./argv\";\nimport { calendarCalendars, calendarConnect, calendarDisconnect, calendarStatus } from \"./calendar\";\nimport { projectCommand } from \"./cli-project\";\nimport { codeCommand } from \"./code-command\";\nimport type { CodeConnectOptions } from \"./code-connect\";\nimport { contextCommand } from \"./context-command\";\nimport { cliVersion, printHelp } from \"./help\";\nimport { discussCommand } from \"./discuss-command\";\nimport { pmCommand } from \"./pm-command\";\nimport { o11yCommand } from \"./o11y-command\";\nimport { provision } from \"./provision\";\nimport { recordInvocation } from \"./record\";\nimport { redactingOutput } from \"./redact\";\nimport { runbookCommand } from \"./runbook-command\";\nimport { securityCommand } from \"./security-command\";\nimport { whoamiCommand } from \"./whoami-command\";\nimport type { ProvisionOptions } from \"./types\";\n\n/** Map a CLI failure to its process exit code: 75 (EX_TEMPFAIL) marks work that\n * has not failed but has not finished — a handshake still awaiting human\n * approval (the pending state is persisted, so rerunning resumes it), or a\n * `discuss watch` that timed out before anyone replied. A stale checkpoint is\n * a consistency failure (3); an exhausted remote retry is retryable (6). */\nexport function exitCodeFor(err: unknown): number {\n  const code = (err as { code?: unknown } | null)?.code;\n  if (code === \"handshake_pending\" || code === \"watch_timeout\") return 75;\n  if (code === \"checkpoint_required\") return 3;\n  if (code === \"remote_unavailable\") return 6;\n  if (code === \"auth_failed\") return 5;\n  if (code === \"invalid_cursor\") return 2;\n  return 1;\n}\n\n/** Injectable side-effect boundaries used to run and test the command dispatcher. */\nexport interface CliDependencies {\n  fetch?: typeof fetch;\n  openUrl?: (url: string) => Promise<void>;\n  /** Reads one bounded secret value from stdin; injectable for embedding/tests. */\n  readStdin?: () => Promise<string>;\n  /** User-home override for global agent setup. */\n  homeDir?: string;\n  /** Codex-home override for global Codex skill setup. */\n  codexHomeDir?: string;\n  pollWait?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;\n  readGitOrigin?: (cwd: string) => Promise<string>;\n  confirm?: (message: string) => Promise<boolean>;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n  codeConnect?: (options: CodeConnectOptions) => Promise<void>;\n  /** Runs git in the working directory; injected so `runbook impact` can be\n   * driven over a fixed diff instead of whatever the checkout happens to be. */\n  runGit?: (args: string[]) => string;\n}\n\n/**\n * Parse CLI arguments and dispatch the matching odla command.\n *\n * The dispatcher covers project setup, platform AI administration, hosted and\n * local security, provisioning, smoke checks, skill installation, and secret\n * pushes. It rejects unknown commands, unsupported options, extra positionals,\n * missing values, and errors returned by the selected command.\n *\n * @param argv Argument vector without the node/script prefix.\n * @param dependencies Optional side-effect overrides for embedding and tests.\n */\nexport async function runCli(\n  argv = process.argv.slice(2),\n  dependencies: CliDependencies = {},\n): Promise<void> {\n  const runtime: CliDependencies = {\n    ...dependencies,\n    stdout: redactingOutput(dependencies.stdout ?? console),\n  };\n  const parsed = parseArgv(argv);\n  // Observed here, at the one funnel every command passes through, and BEFORE\n  // dispatch — a command that throws still proves its invocation was reachable,\n  // which is the property `npm run check:e2e` is asking about.\n  recordInvocation(parsed);\n  const command = parsed.positionals[0] ?? \"help\";\n  if (command === \"version\" || command === \"-v\" || parsed.options.version === true) {\n    assertArgs(parsed, [\"version\"], 1);\n    runtime.stdout!.log(cliVersion());\n    return;\n  }\n  if (command === \"help\" || command === \"--help\" || command === \"-h\") {\n    assertArgs(parsed, [\"help\"], 1);\n    printHelp(runtime.stdout);\n    return;\n  }\n  if (command === \"whoami\") {\n    await whoamiCommand(parsed, runtime);\n    return;\n  }\n  if (command === \"context\") {\n    await contextCommand(parsed, runtime);\n    return;\n  }\n  if (command === \"runbook\") {\n    await runbookCommand(parsed, runtime);\n    return;\n  }\n  if (command === \"calendar\") {\n    await calendarCommand(parsed, runtime);\n    return;\n  }\n  if (command === \"code\") {\n    await codeCommand(parsed, runtime);\n    return;\n  }\n  if (command === \"admin\") {\n    await adminCommand(parsed, runtime);\n    return;\n  }\n  if (command === \"agent\") {\n    await agentCommand(parsed, runtime);\n    return;\n  }\n  if (command === \"app\") {\n    await appCommand(parsed, runtime);\n    return;\n  }\n  if (command === \"security\") {\n    await securityCommand(parsed, runtime);\n    return;\n  }\n  if (command === \"pm\") {\n    await pmCommand(parsed, runtime);\n    return;\n  }\n  if (command === \"discuss\") {\n    await discussCommand(parsed, runtime);\n    return;\n  }\n  if (command === \"o11y\") {\n    await o11yCommand(parsed, runtime);\n    return;\n  }\n  if (command === \"provision\") {\n    await provisionCommand(parsed, runtime);\n    return;\n  }\n  if (await projectCommand(command, parsed, runtime)) return;\n  throw new Error(`unknown command \"${command}\". Run \"odla-ai help\".`);\n}\n\nasync function provisionCommand(\n  parsed: ReturnType<typeof parseArgv>,\n  dependencies: CliDependencies,\n): Promise<void> {\n  assertArgs(parsed, [\n    \"config\", \"dry-run\", \"rotate-keys\", \"rotate-o11y-token\", \"push-secrets\",\n    \"write-credentials\", \"write-dev-vars\", \"token\", \"email\", \"open\", \"wait\", \"yes\",\n  ], 1);\n  const writeDevVars = parsed.options[\"write-dev-vars\"];\n  const options: ProvisionOptions = {\n    configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n    dryRun: parsed.options[\"dry-run\"] === true,\n    rotateKeys: parsed.options[\"rotate-keys\"] === true,\n    rotateO11yToken: parsed.options[\"rotate-o11y-token\"] === true,\n    pushSecrets: parsed.options[\"push-secrets\"] === true,\n    writeCredentials: parsed.options[\"write-credentials\"] !== false,\n    writeDevVars: typeof writeDevVars === \"string\" ? writeDevVars : writeDevVars === true,\n    token: stringOpt(parsed.options.token),\n    email: stringOpt(parsed.options.email),\n    open: parsed.options.open === false\n      ? false\n      : parsed.options.open === true ? true : undefined,\n    wait: numberOpt(parsed.options.wait, \"--wait\"),\n    yes: parsed.options.yes === true,\n    fetch: dependencies.fetch,\n    openApprovalUrl: dependencies.openUrl,\n    stdout: dependencies.stdout,\n  };\n  await provision(options);\n}\n\nasync function calendarCommand(parsed: ReturnType<typeof parseArgv>, dependencies: CliDependencies): Promise<void> {\n  const sub = parsed.positionals[1];\n  if (sub !== \"status\" && sub !== \"calendars\" && sub !== \"connect\" && sub !== \"disconnect\") {\n    throw new Error(`unknown calendar subcommand \"${sub ?? \"\"}\". Try \"odla-ai calendar status --env dev\".`);\n  }\n  assertArgs(parsed, [\"config\", \"env\", \"json\", \"token\", \"email\", \"open\", \"yes\"], 2);\n  if (sub !== \"status\" && sub !== \"calendars\" && parsed.options.json !== undefined) throw new Error(`--json is supported only by calendar status/calendars`);\n  if ((sub === \"status\" || sub === \"calendars\") && parsed.options.yes !== undefined) throw new Error(`--yes is not used by \"calendar ${sub}\"`);\n  const options = {\n    configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n    env: stringOpt(parsed.options.env),\n    token: stringOpt(parsed.options.token),\n    email: stringOpt(parsed.options.email),\n    open: parsed.options.open === false ? false : parsed.options.open === true ? true : undefined,\n    yes: parsed.options.yes === true,\n    json: parsed.options.json === true,\n    fetch: dependencies.fetch,\n    stdout: dependencies.stdout,\n    openConsentUrl: dependencies.openUrl,\n  };\n  if (sub === \"status\") await calendarStatus(options);\n  else if (sub === \"calendars\") await calendarCalendars(options);\n  else if (sub === \"connect\") await calendarConnect(options);\n  else await calendarDisconnect(options);\n}\n"],"mappings":";;;AAAA,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,QAAAC,aAAY;AACrB,OAAOC,cAAa;AACpB,SAAS,gBAAAC,qBAAoB;;;ACH7B,SAAS,WAAW,YAAY,WAAW,cAAc,YAAY,qBAAqB;AAC1F,SAAS,SAAS,YAAY,UAAU,eAAe;AAGvD,IAAM,kBAAkB,CAAC,sBAAsB,wBAAwB,WAAW;AAE3E,SAAS,aAAgB,MAAwB;AACtD,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,iBAAiB,MAAc,OAAsB;AACnE,mBAAiB,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,CAAI;AAC9D;AAEO,SAAS,gBAAgB,MAAuC;AACrE,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,EAC/C,QAAQ;AACN,UAAM,IAAI,MAAM,oBAAoB,IAAI,0DAA0D;AAAA,EACpG;AACA,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,OAAQ,MAA2B,UAAU,YACpF,CAAE,MAA2B,QAAQ,OAAQ,MAA2B,SAAS,UAAU;AAC7F,UAAM,IAAI,MAAM,oBAAoB,IAAI,6DAA6D;AAAA,EACvG;AACA,SAAO;AACT;AAEO,SAAS,gBACd,SACA,QACkB;AAClB,QAAM,OAAyB,WAAW;AAAA,IACxC,OAAO,OAAO;AAAA,IACd,aAAa,OAAO;AAAA,IACpB,YAAY,OAAO;AAAA,IACnB,YAAW,oBAAI,KAAK,CAAC,GAAE,YAAY;AAAA,IACnC,MAAM,CAAC;AAAA,EACT;AACA,OAAK,QAAQ,OAAO;AACpB,OAAK,cAAc,OAAO;AAC1B,OAAK,aAAa,OAAO;AACzB,OAAK,aAAY,oBAAI,KAAK,GAAE,YAAY;AACxC,OAAK,KAAK,OAAO,GAAG,IAAI;AAAA,IACtB,GAAI,KAAK,KAAK,OAAO,GAAG,KAAK,CAAC;AAAA,IAC9B,UAAU,OAAO;AAAA,IACjB,GAAI,OAAO,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,IAC9C,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,EAC5D;AACA,SAAO;AACT;AAEO,SAAS,gBAAgB,SAAiB,aAAuB,CAAC,GAAS;AAChF,QAAM,OAAO,QAAQ,SAAS,YAAY;AAC1C,QAAM,WAAW,WAAW,IAAI,IAAI,aAAa,MAAM,MAAM,IAAI;AACjE,QAAM,aAAa,WAAW,IAAI,CAAC,cAAc,eAAe,SAAS,SAAS,CAAC,EAAE,OAAO,CAAC,SAAyB,CAAC,CAAC,IAAI;AAC5H,QAAM,SAAS,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,UAAU,CAAC,CAAC;AAC/D,QAAM,UAAU,OAAO,OAAO,CAAC,SAAS,CAAC,SAAS,MAAM,OAAO,EAAE,SAAS,IAAI,CAAC;AAC/E,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,SAAS,YAAY,CAAC,SAAS,SAAS,IAAI,IAAI,OAAO;AAC7D,gBAAc,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,KAAK,IAAI,CAAC;AAAA,CAAI;AACnE;AAQO,SAAS,YAAY,KAAmD;AAC7E,MAAI,CAAC,IAAI,SAAS,SAAS,MAAM,EAAG,QAAO;AAC3C,SAAO;AAAA,IACL,UAAU,IAAI,MAAM,YAAY;AAAA,IAChC,SAAS,IAAI,MAAM,WAAW,IAAI,IAAI;AAAA,IACtC,GAAI,IAAI,MAAM,UAAU,EAAE,SAAS,IAAI,KAAK,QAAQ,IAAI,CAAC;AAAA,EAC3D;AACF;AAEO,SAAS,0BAA0B,KAA0B,WAAwD;AAC1H,MAAI,CAAC,UAAW,QAAO;AACvB,MAAI,cAAc,KAAM,QAAO,IAAI,MAAM;AACzC,SAAO,QAAQ,QAAQ,IAAI,UAAU,GAAG,SAAS;AACnD;AAEO,SAAS,aAAa,MAAc,aAA+B,KAAa,MAA0B;AAC/G,QAAM,QAAQ,YAAY,KAAK,GAAG;AAClC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2BAA2B,GAAG,QAAQ,IAAI,EAAE;AACxE,QAAM,QAAQ,CAAC,kBAAkB,YAAY,WAAW,GAAG;AAC3D,MAAI,MAAM,MAAO,OAAM,KAAK,kBAAkB,YAAY,UAAU,GAAG;AACvE,QAAM,KAAK,gBAAgB,YAAY,KAAK,KAAK,aAAa,GAAG,KAAK,gBAAgB,MAAM,QAAQ,GAAG;AACvG,MAAI,MAAM,MAAO,OAAM,KAAK,iBAAiB,MAAM,KAAK,GAAG;AAC3D,MAAI,MAAM;AACR,UAAM,KAAK,uBAAuB,KAAK,QAAQ,KAAK,sBAAsB,KAAK,OAAO,GAAG;AACzF,QAAI,KAAK,QAAS,OAAM,KAAK,sBAAsB,KAAK,OAAO,GAAG;AAElE,QAAI,MAAM,UAAW,OAAM,KAAK,oBAAoB,MAAM,SAAS,GAAG;AAAA,EACxE;AACA,QAAM,WAAW,WAAW,IAAI,IAAI,aAAa,MAAM,MAAM,IAAI;AACjE,QAAM,WAAW,SAAS,MAAM,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC;AAChF,SAAO,SAAS,GAAG,EAAE,MAAM,GAAI,UAAS,IAAI;AAC5C,QAAM,SAAS,SAAS,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC;AAAA;AAAA,IAAS;AAChE,mBAAiB,MAAM,GAAG,MAAM,GAAG,MAAM,KAAK,IAAI,CAAC;AAAA,CAAI;AACzD;AAEA,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B;AAAA,EAAiB;AAAA,EAAiB;AAAA,EAAe;AAAA,EAAY;AAAA,EAAe;AAAA,EAC5E;AAAA,EAAsB;AAAA,EAAqB;AAAA,EAAqB;AAClE,CAAC;AAED,SAAS,gBAAgB,MAAuB;AAC9C,QAAM,QAAQ,KAAK,MAAM,yCAAyC;AAClE,SAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,iBAAiB,IAAI,MAAM,CAAC,CAAC;AACtD;AAEA,SAAS,iBAAiB,MAAc,MAAoB;AAC1D,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,QAAM,YAAY,GAAG,IAAI,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAC1D,gBAAc,WAAW,MAAM,EAAE,MAAM,IAAM,CAAC;AAC9C,YAAU,WAAW,GAAK;AAC1B,aAAW,WAAW,IAAI;AAC5B;AAEO,SAAS,eAAe,SAAiB,MAA6B;AAC3E,QAAM,MAAM,SAAS,QAAQ,OAAO,GAAG,QAAQ,IAAI,CAAC;AACpD,MAAI,CAAC,OAAO,QAAQ,QAAQ,IAAI,WAAW,KAAK,QAAQ,aAAa,UAAU,OAAO,GAAG,EAAE,KAAK,WAAW,GAAG,EAAG,QAAO;AACxH,SAAO,IAAI,WAAW,MAAM,GAAG;AACjC;AAEO,SAAS,YAAY,MAAc,UAAU,QAAQ,IAAI,GAAW;AACzE,QAAM,MAAM,SAAS,SAAS,IAAI;AAClC,SAAO,OAAO,CAAC,IAAI,WAAW,IAAI,IAAI,MAAM;AAC9C;;;ACxIA,SAAS,aAAa;AACtB,OAAOC,cAAa;AAOpB,eAAsB,QAAQ,KAAa,UAA0B,CAAC,GAAkB;AACtF,QAAM,UAAU,UAAU,QAAQ,YAAYA,SAAQ,QAAQ;AAC9D,QAAM,UAAU,QAAQ,aAAa;AACrC,QAAM,IAAI,QAAc,CAACC,WAAS,WAAW;AAC3C,UAAM,QAAQ,QAAQ,QAAQ,KAAK,CAAC,GAAG,QAAQ,MAAM,GAAG,GAAG;AAAA,MACzD,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AACD,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,SAAS,MAAM;AACxB,YAAM,MAAM;AACZ,MAAAA,UAAQ;AAAA,IACV,CAAC;AAAA,EACH,CAAC;AACH;AAEO,SAAS,UAAU,UAA4D;AACpF,MAAI,aAAa,SAAU,QAAO,EAAE,KAAK,QAAQ,MAAM,CAAC,EAAE;AAC1D,MAAI,aAAa,QAAS,QAAO,EAAE,KAAK,OAAO,MAAM,CAAC,MAAM,SAAS,EAAE,EAAE;AACzE,SAAO,EAAE,KAAK,YAAY,MAAM,CAAC,EAAE;AACrC;;;ACGO,SAAS,cAAc,QAAkC;AAC9D,QAAM,QAAkB,CAAC,EAAE;AAC3B,QAAM;AAAA,IACJ,kCAA6B,OAAO,UAAU,OAAO,OAAO,OAAO,KAAK,EAAE,gBAAW,OAAO,QAAQ,KAAK,OAAO,WAAW;AAAA,EAC7H;AACA,QAAM,KAAK,EAAE;AAEb,QAAM,KAAK,MAAM,OAAO,WAAW,EAAE;AACrC,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,kFAAkF;AAC7F,QAAM,KAAK,uFAAuF;AAClG,MAAI,OAAO,kBAAkB;AAC3B,UAAM,KAAK,qFAAqF;AAAA,EAClG,WAAW,OAAO,gBAAgB;AAChC,UAAM,KAAK,6BAA6B,OAAO,cAAc,IAAI;AAAA,EACnE;AACA,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,4EAA4E;AACvF,QAAM,KAAK,kFAA6E;AACxF,QAAM,KAAK,EAAE;AACb,SAAO;AACT;AAGO,SAAS,cAAc,KAA4C,QAA8B;AACtG,aAAW,QAAQ,cAAc,MAAM,EAAG,KAAI,MAAM,IAAI;AAC1D;AASO,SAAS,cAAc,QAA8F;AAC1H,SAAO;AAAA,IACL,uCAAuC,OAAO,QAAQ,KAAK,OAAO,WAAW;AAAA,IAC7E,MAAM,OAAO,WAAW;AAAA,EAC1B;AACF;;;ACjEA,SAAS,cAAc,WAAW,oBAAoB;AAEtD,OAAOC,cAAa;;;ACRpB,SAAS,cAAc;AACvB,SAAS,WAAAC,UAAS,YAAY;AAC9B,OAAOC,cAAa;AAwBb,SAAS,cAAc,KAAiD;AAC7E,SAAO,KAAKC,SAAQ,IAAI,MAAM,SAAS,GAAG,sBAAsB;AAClE;AAGA,IAAM,mBAAmB;AAGlB,SAAS,qBAAqB,MAAc,UAAkB,OAAwC;AAC3G,QAAM,UAAU,aAAwC,IAAI;AAC5D,MAAI,CAAC,WAAW,QAAQ,aAAa,YAAY,QAAQ,UAAU,MAAO,QAAO;AACjF,MAAI,OAAO,QAAQ,aAAa,YAAY,OAAO,QAAQ,eAAe,YAAY,OAAO,QAAQ,gBAAgB,SAAU,QAAO;AACtI,MAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,aAAa,KAAK,IAAI,IAAI,iBAAkB,QAAO;AACxG,SAAO,EAAE,UAAU,GAAG,GAAG,QAAQ;AACnC;AAEO,SAAS,sBAAsB,MAAc,SAAiC;AACnF,mBAAiB,MAAM,OAAO;AAChC;AAEO,SAAS,sBAAsB,MAAoB;AACxD,SAAO,MAAM,EAAE,OAAO,KAAK,CAAC;AAC9B;AAGO,SAAS,YAAY,WAA2B;AACrD,SAAO,KAAK,IAAI,GAAG,KAAK,OAAO,YAAY,KAAK,IAAI,KAAK,GAAM,CAAC;AAClE;AAGO,SAAS,aAAa,SAAmF;AAC9G,SAAO,gBAAgB,QAAQ,QAAQ,OAAO,QAAQ,WAAW,KAAK,YAAY,QAAQ,SAAS,CAAC;AACtG;AAKO,SAAS,iBACd,KACA,SACA,WAAW,KACC;AACZ,QAAM,QAAQ,YAAY,MAAM;AAC9B,eAAW,QAAQ,cAAc;AAAA,MAC/B,UAAU,QAAQ;AAAA,MAClB,aAAa,QAAQ;AAAA,MACrB,aAAa,YAAY,QAAQ,SAAS;AAAA,IAC5C,CAAC;AACC,UAAI,IAAI,IAAI;AAAA,EAChB,GAAG,QAAQ;AACX,EAAC,MAA4C,QAAQ;AACrD,SAAO,MAAM,cAAc,KAAK;AAClC;AAOO,SAAS,gBACd,aACA,cAAuBC,SAAQ,OAAO,UAAU,MAC5B;AACpB,MAAI,gBAAgB,OAAW,QAAO,cAAc;AACpD,SAAO,cAAc,SAAY;AACnC;;;AD7DA,eAAsB,kBACpB,KACA,SACA,SACA,KACiB;AACjB,MAAI,QAAQ,MAAO,QAAO,QAAQ;AAClC,QAAM,WAAW,iBAAiB,IAAI,WAAW;AACjD,MAAIC,SAAQ,IAAI,gBAAgB;AAC9B,UAAM,WAAWA,SAAQ,IAAI;AAC7B,QAAI,UAAU;AACZ,UAAI,iBAAiB,QAAQ,MAAM,SAAU,OAAM,IAAI,MAAM,gEAAgE;AAAA,IAC/H,WAAW,aAAa,mBAAmB;AACzC,YAAM,IAAI,MAAM,gEAAgE;AAAA,IAClF;AACA,WAAOA,SAAQ,IAAI;AAAA,EACrB;AAEA,QAAM,SAAS,aAAwF,IAAI,MAAM,SAAS;AAC1H,MAAI,QAAQ,SAAS,OAAO,aAAa,aAAa,OAAO,aAAa,KAAK,KAAK,IAAI,IAAI,KAAQ;AAClG,QAAI,MAAM,uCAAuC,YAAY,IAAI,MAAM,WAAW,IAAI,OAAO,CAAC,GAAG;AACjG,WAAO,OAAO;AAAA,EAChB;AAEA,QAAM,MAAwB;AAAA,IAC5B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,gBAAgB,OAAO;AAAA,IAChC,OAAO,eAAe,QAAQ,OAAO,QAAQ,aAAa,WAAW,OAAO,QAAQ,MAAS;AAAA,IAC7F,aAAa,cAAc,GAAG;AAAA,EAChC;AACA,QAAM,SAAS,gBAAgB,QAAQ,IAAI;AAC3C,QAAM,EAAE,OAAO,UAAU,IAAK,MAAM,uBAAuB,KAAK,MAAM,KAAO,MAAM,eAAe,KAAK,MAAM;AAC7G,wBAAsB,IAAI,WAAW;AACrC,mBAAiB,IAAI,MAAM,WAAW,EAAE,UAAU,UAAU,OAAO,IAAI,OAAO,OAAO,UAAU,CAAC;AAChG,MAAI,MAAM,iCAAiC,YAAY,IAAI,MAAM,WAAW,IAAI,OAAO,CAAC,GAAG;AAC3F,SAAO;AACT;AAeA,eAAe,uBAAuB,KAAuB,QAAyD;AACpH,QAAM,UAAU,qBAAqB,IAAI,aAAa,IAAI,UAAU,IAAI,KAAK;AAC7E,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,IAAI,MAAM,EAAE;AAChB,MAAI,IAAI,MAAM,2CAAsC,aAAa,OAAO,CAAC,EAAE;AAC3E,QAAM,eAAe,KAAK,QAAQ,WAAW;AAC7C,MAAI,IAAI,MAAM,EAAE;AAChB,QAAM,eAAe,iBAAiB,IAAI,KAAK,OAAO;AACtD,MAAI;AACF,WAAO,MAAM,aAAa;AAAA,MACxB,UAAU,IAAI,IAAI;AAAA,MAClB,YAAY,QAAQ;AAAA,MACpB,WAAW,QAAQ;AAAA,MACnB,UAAU,QAAQ;AAAA,MAClB;AAAA,MACA,OAAO,IAAI;AAAA,IACb,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,OAAO,eAAe,YAAY,IAAI,OAAO;AACnD,QAAI,SAAS,oBAAqB,OAAM,aAAa,SAAS,IAAI,KAAK;AACvE,QAAI,SAAS,uBAAuB,SAAS,qBAAqB;AAChE,4BAAsB,IAAI,WAAW;AACrC,UAAI,IAAI,MAAM,iEAAiE;AAC/E,aAAO;AAAA,IACT;AACA,QAAI,SAAS,mBAAoB,uBAAsB,IAAI,WAAW;AACtE,UAAM;AAAA,EACR,UAAE;AACA,iBAAa;AAAA,EACf;AACF;AAEA,eAAe,eAAe,KAAuB,QAAkD;AACrG,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,aAAa;AAAA,MACxB,UAAU,IAAI,IAAI;AAAA,MAClB,OAAO,IAAI;AAAA,MACX,OAAO,GAAG,IAAI,IAAI,IAAI,EAAE;AAAA,MACxB,OAAO,IAAI;AAAA,MACX;AAAA,MACA,QAAQ,OAAO,EAAE,UAAU,YAAY,WAAW,UAAU,wBAAwB,MAAM;AACxF,cAAM,cAAc,2BAA2B,aAAa,IAAI,IAAI,aAAa,QAAQ;AACzF,kBAAU;AAAA,UACR,UAAU,IAAI;AAAA,UACd,OAAO,IAAI;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,WAAW,KAAK,IAAI,IAAI,YAAY;AAAA,QACtC;AACA,8BAAsB,IAAI,aAAa,OAAO;AAC9C,sBAAc,IAAI,KAAK;AAAA,UACrB;AAAA,UACA;AAAA,UACA,aAAa,KAAK,MAAM,YAAY,EAAE;AAAA,UACtC,SAAS,4BAA4B,IAAI,KAAK;AAAA,UAC9C,kBAAkB,IAAI,QAAQ;AAAA,UAC9B,gBAAgB,IAAI,QAAQ;AAAA,QAC9B,CAAC;AACD,cAAM,eAAe,KAAK,WAAW;AACrC,uBAAe,iBAAiB,IAAI,KAAK,OAAO;AAAA,MAClD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,OAAO,eAAe,YAAY,IAAI,OAAO;AACnD,QAAI,SAAS,uBAAuB,QAAS,OAAM,aAAa,SAAS,IAAI,KAAK;AAClF,QAAI,SAAS,sBAAsB,SAAS,uBAAuB,SAAS,qBAAqB;AAC/F,4BAAsB,IAAI,WAAW;AAAA,IACvC;AACA,UAAM;AAAA,EACR,UAAE;AACA,mBAAe;AAAA,EACjB;AACF;AAKA,eAAe,eAAe,KAAuB,aAAoC;AACvF,MAAI,IAAI,QAAQ,MAAM;AACpB,QAAI;AACF,aAAO,IAAI,QAAQ,mBAAmB,SAAS,WAAW;AAC1D,UAAI,IAAI,MAAM,uCAAuC,IAAI,QAAQ,SAAS,SAAS,YAAY,EAAE,+CAA0C;AAAA,IAC7I,SAAS,KAAK;AACZ,UAAI,IAAI,MAAM,iCAAiC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,IACpG;AAAA,EACF,WAAW,IAAI,QAAQ,QAAQ;AAC7B,QAAI,IAAI,MAAM,iCAAiC,IAAI,QAAQ,MAAM,uCAAkC;AAAA,EACrG;AACF;AAIA,SAAS,aAAa,SAA2B,OAA0B;AACzE,SAAO,IAAI;AAAA,IACT;AAAA,IACA,sCAAiC,KAAK,OAAO,aAAa,OAAO,CAAC;AAAA,IAClE,EAAE,WAAW,KAAK;AAAA,EACpB;AACF;AAMO,SAAS,eAAe,OAAgB,QAAyB;AACtE,QAAM,SAAS,SAASA,SAAQ,IAAI,mBAAmB,UAAU,IAAI,KAAK,EAAE,YAAY;AACxF,MAAI,MAAM,SAAS,OAAO,CAAC,6BAA6B,KAAK,KAAK,GAAG;AACnE,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,SAAO;AACT;AAaO,SAAS,gBACd,SACA,OAAoB,CAAC,GACyC;AAC9D,MAAI,QAAQ,SAAS,KAAM,QAAO,EAAE,MAAM,MAAM,MAAM,SAAS;AAC/D,MAAI,QAAQ,SAAS,MAAO,QAAO,EAAE,MAAM,OAAO,QAAQ,wBAAwB;AAClF,QAAM,MAAM,KAAK,OAAOA,SAAQ;AAMhC,MAAI,IAAI,UAAU,IAAI,aAAa,OAAQ,QAAO,EAAE,MAAM,OAAO,QAAQ,mBAAmB;AAC5F,MAAI,IAAI,GAAI,QAAO,EAAE,MAAM,OAAO,QAAQ,iBAAiB;AAC3D,MAAI,IAAI,kBAAkB,IAAI,QAAS,QAAO,EAAE,MAAM,OAAO,QAAQ,oCAAoC;AACzG,QAAM,WAAW,KAAK,YAAYA,SAAQ;AAC1C,MAAI,aAAa,YAAY,aAAa,WAAW,CAAC,IAAI,WAAW,CAAC,IAAI,iBAAiB;AACzF,WAAO,EAAE,MAAM,OAAO,QAAQ,6CAA6C;AAAA,EAC7E;AACA,SAAO,EAAE,MAAM,MAAM,MAAM,OAAO;AACpC;AAGO,SAAS,aAAa,aAAqB,UAA0B;AAC1E,QAAM,MAAM,IAAI,IAAI,WAAW,WAAW;AAC1C,MAAI,aAAa,IAAI,QAAQ,QAAQ;AACrC,SAAO,IAAI,SAAS;AACtB;AAGO,SAAS,iBAAiB,OAAuB;AACtD,MAAI;AACJ,MAAI;AAAE,UAAM,IAAI,IAAI,KAAK;AAAA,EAAG,QAAQ;AAAE,UAAM,IAAI,MAAM,kCAAkC;AAAA,EAAG;AAC3F,QAAM,QAAQ,IAAI,aAAa,eAAe,IAAI,aAAa,eAAe,IAAI,aAAa;AAC/F,MAAI,IAAI,aAAa,YAAY,EAAE,SAAS,IAAI,aAAa,UAAU;AACrE,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,MAAI,IAAI,YAAY,IAAI,YAAY,IAAI,UAAU,IAAI,MAAM;AAC1D,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO,IAAI;AACb;;;AJxMA,eAAsB,uBAAuB,SAAsD;AACjG,SAAO,0BAA0B,OAAO;AAC1C;AAGA,eAAsB,0BAA0B,SAAqD;AACnG,QAAM,WAAW,iBAAiB,QAAQ,QAAQ;AAClD,MAAI,QAAQ,MAAO,QAAO,QAAQ;AAClC,QAAM,UAAUC,SAAQ,IAAI;AAC5B,MAAI,QAAS,QAAO,sBAAsB,SAAS,QAAQ;AAC3D,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA,QAAQ,SAAS;AAAA,IACjB,QAAQ,UAAU;AAAA,EACpB;AACF;AAEA,SAAS,sBAAsB,OAAe,UAA0B;AACtE,QAAM,WAAW,iBAAiB,QAAQ;AAC1C,QAAM,WAAWA,SAAQ,IAAI;AAC7B,MAAI,UAAU;AACZ,QAAI,iBAAiB,QAAQ,MAAM,SAAU,OAAM,IAAI,MAAM,kEAAkE;AAAA,EACjI,WAAW,aAAa,mBAAmB;AACzC,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,SAAO;AACT;AAIA,IAAM,gBAAwC;AAAA,EAC5C,0BAA0B;AAAA,EAC1B,4BAA4B;AAAA,EAC5B,2BAA2B;AAAA,EAC3B,gCAAgC;AAAA,EAChC,+BAA+B;AAAA,EAC/B,0BAA0B;AAAA,EAC1B,0BAA0B;AAAA,EAC1B,yBAAyB;AAAA,EACzB,8BAA8B;AAAA,EAC9B,0BAA0B;AAC5B;AAEA,eAAe,YACb,UACA,OACA,SACA,SACA,KACiB;AACjB,QAAM,WAAW,iBAAiB,QAAQ;AAG1C,QAAM,UAAU,QAAQ,WAAWA,SAAQ,IAAI;AAC/C,QAAM,YAAY,QAAQ,aAAaC,MAAK,SAAS,8BAA8B;AACnF,QAAM,QAAQ,QAAQ,UAAU,QAAQ,OACpC,aAAqH,SAAS;AAClI,QAAM,SAAS,OAAO,aAAa,WAAW,MAAM,SAAS,KAAK,IAAI;AACtE,MAAI,QAAQ,UAAU,OAAO,aAAa,KAAK,KAAK,IAAI,IAAI,KAAQ;AAClE,QAAI,MAAM,sBAAsB,KAAK,WAAW,SAAS,GAAG;AAC5D,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,QAAQ,eAAe,QAAQ,OAAO,OAAO,aAAa,WAAW,MAAM,QAAQ,MAAS;AAClG,QAAM,EAAE,OAAO,UAAU,IAAI,MAAMC,cAAa;AAAA,IAC9C,UAAU;AAAA,IACV;AAAA,IACA,OAAO,QAAQ,SAAS,aAAa,KAAK;AAAA,IAC1C,QAAQ,CAAC,KAAK;AAAA,IACd,OAAO;AAAA,IACP,QAAQ,OAAO,EAAE,UAAU,WAAW,wBAAwB,MAAM;AAClE,YAAM,cAAc,2BAA2B,aAAa,UAAU,QAAQ;AAC9E,YAAM,UAAU,gBAAgB,EAAE,MAAM,QAAQ,KAAK,CAAC;AACtD,oBAAc,KAAK;AAAA,QACjB;AAAA,QACA;AAAA,QACA,aAAa,KAAK,MAAM,YAAY,EAAE;AAAA,QACtC,SAAS,cAAc,KAAK,KAAK,OAAO,KAAK;AAAA,QAC7C,kBAAkB,QAAQ;AAAA,QAC1B,gBAAgB,QAAQ;AAAA,MAC1B,CAAC;AACD,UAAI,QAAQ,MAAM;AAChB,eAAO,QAAQ,mBAAmB,SAAS,WAAW,EAAE,MAAM,MAAM,MAAS;AAAA,MAC/E;AAAA,IACF;AAAA,EACF,CAAC;AACD,MAAI,QAAQ,UAAU,OAAO;AAC3B,UAAM,SAAS,OAAO,aAAa,WAAW,EAAE,GAAI,MAAM,UAAU,CAAC,EAAG,IAAI,CAAC;AAC7E,WAAO,KAAK,IAAI,EAAE,OAAO,UAAU;AACnC,QAAIC,YAAWF,MAAK,SAAS,MAAM,CAAC,EAAG,iBAAgB,SAAS,CAAC,SAAS,CAAC;AAC3E,qBAAiB,WAAW,EAAE,UAAU,UAAU,OAAO,OAAO,CAAC;AACjE,QAAI,MAAM,gBAAgB,KAAK,WAAW,SAAS,cAAc;AAAA,EACnE,OAAO;AACL,QAAI,MAAM,SAAS,KAAK,uEAAuE;AAAA,EACjG;AACA,SAAO;AACT;;;AMrJO,IAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMO,SAAS,uBAAuB,OAA4C;AACjF,MAAI,CAAC,mBAAmB,SAAS,KAAwB,GAAG;AAC1D,UAAM,IAAI,MAAM,2BAA2B,mBAAmB,KAAK,IAAI,CAAC,EAAE;AAAA,EAC5E;AACA,SAAO;AACT;;;ACjBA,OAAOG,cAAa;;;ACApB,OAAOC,cAAa;AAiBpB,IAAM,YAAY,KAAK;AAOvB,eAAsB,iBAAiB,SAA6B,OAAO,cAA+B;AACxG,MAAI,QAAQ,WAAW,QAAQ,MAAO,OAAM,IAAI,MAAM,6CAA6C;AACnG,MAAI;AACJ,MAAI,QAAQ,QAAS,SAAQA,SAAQ,IAAI,QAAQ,OAAO;AAAA,WAC/C,QAAQ,MAAO,SAAQ,OAAO,QAAQ,cAAc,MAAM,iBAAiB,IAAI,IAAI;AAAA,MACvF,OAAM,IAAI,MAAM,GAAG,IAAI,2FAA2F;AACvH,UAAQ,OAAO,QAAQ,YAAY,EAAE;AACrC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,QAAQ,UAAU,wBAAwB,QAAQ,OAAO,uBAAuB,SAAS,IAAI,WAAW;AACpI,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,aAAa,UAAW,OAAM,IAAI,MAAM,GAAG,IAAI,iBAAiB;AACpG,SAAO;AACT;AAGA,eAAsB,iBAAiB,MAAc,SAAiCA,SAAQ,OAAwB;AACpH,MAAI,QAAQ;AACZ,mBAAiB,SAAS,QAAQ;AAChC,aAAS,OAAO,KAAK;AACrB,QAAI,MAAM,SAAS,UAAW,OAAM,IAAI,MAAM,GAAG,IAAI,iBAAiB;AAAA,EACxE;AACA,SAAO;AACT;;;AC7BO,SAAS,kBAAkB,SAAsC;AACtE,MAAI,QAAQ,UAAU,OAAW,QAAO;AACxC,MAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,KAAK,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,KAAK;AACpF,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,SAAO,UAAU,QAAQ,KAAK;AAChC;AAGA,eAAsB,iBAAiBC,UAA6C;AAClF,QAAMC,YAAW,MAAMD,SAAQ,MAAM,GAAGA,SAAQ,QAAQ,8BAA8BA,SAAQ,KAAK,IAAI;AAAA,IACrG,SAASA,SAAQ;AAAA,EACnB,CAAC;AACD,QAAM,OAAO,MAAM,aAAaC,SAAQ;AACxC,MAAI,CAACA,UAAS,GAAI,OAAM,IAAI,MAAM,SAASA,UAAS,QAAQ,IAAI,CAAC;AACjE,MAAID,SAAQ,MAAM;AAChB,IAAAA,SAAQ,OAAO,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAChD;AAAA,EACF;AACA,QAAM,SAAS,SAAS,IAAI,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,KAAK,OAAO,OAAO,QAAQ,IAAI,CAAC;AAC9F,EAAAA,SAAQ,OAAO,IAAI,0CAA8C;AACjE,aAAW,SAAS,QAAQ;AAC1B,UAAM,SAAS,SAAS,MAAM,SAAS,IAAI,MAAM,YAAY;AAC7D,UAAM,QAAQ,SAAS,MAAM,SAAS,IAAI,MAAM,YAAY;AAC5D,UAAME,SAAQ,UAAU,QACpB,GAAG,OAAO,OAAO,QAAQ,CAAC,IAAI,OAAO,OAAO,KAAK,CAAC,KAAK,OAAO,OAAO,OAAO,CAAC,OAAO,OAAO,MAAM,QAAQ,CAAC,IAAI,OAAO,MAAM,KAAK,CAAC,KAAK,OAAO,MAAM,OAAO,CAAC,KAC3J;AACJ,IAAAF,SAAQ,OAAO,IAAI;AAAA,MACjB,UAAU,MAAM,SAAS;AAAA,MAAG,OAAO,MAAM,cAAc,EAAE;AAAA,MACzD,OAAO,MAAM,WAAW,MAAM,YAAY,EAAE;AAAA,MAAGE;AAAA,MAC/C,GAAG,OAAO,MAAM,aAAa,EAAE,CAAC,IAAI,OAAO,MAAM,WAAW,EAAE,CAAC;AAAA,IACjE,EAAE,KAAK,GAAI,CAAC;AAAA,EACd;AACF;AAEA,eAAe,aAAaD,WAAsC;AAChE,QAAM,OAAO,MAAMA,UAAS,KAAK;AACjC,MAAI,CAAC,KAAM,QAAO,CAAC;AACnB,MAAI;AAAE,WAAO,KAAK,MAAM,IAAI;AAAA,EAAc,QAAQ;AAAE,WAAO,EAAE,SAAS,KAAK,MAAM,GAAG,GAAG,EAAE;AAAA,EAAG;AAC9F;AAEA,SAAS,SAAS,QAAgB,MAAuB;AACvD,QAAM,QAAQ,SAAS,IAAI,KAAK,SAAS,KAAK,KAAK,IAAI,KAAK,QAAQ;AACpE,QAAME,WAAU,SAAS,OAAO,MAAM,YAAY,WAC9C,MAAM,UACN,SAAS,IAAI,KAAK,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AACxE,SAAO,wCAAwC,MAAM,MAAMA,QAAO;AACpE;AAEA,SAAS,UAAU,OAAwB;AACzC,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO,OAAO,SAAS,EAAE;AACnF,QAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,SAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI;AAChE;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;ACtDO,SAAS,kBAAkB,SAAsC;AACtE,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,QAAQ,OAAO,KAAK,EAAG,QAAO,IAAI,SAAS,QAAQ,MAAM,KAAK,CAAC;AACnE,MAAI,QAAQ,KAAK,KAAK,EAAG,QAAO,IAAI,OAAO,QAAQ,IAAI,KAAK,CAAC;AAC7D,MAAI,QAAQ,OAAO,KAAK,EAAG,QAAO,IAAI,SAAS,QAAQ,MAAM,KAAK,CAAC;AACnE,MAAI,QAAQ,UAAU,OAAW,QAAO,IAAI,SAAS,OAAO,WAAW,QAAQ,KAAK,CAAC,CAAC;AACtF,QAAM,QAAQ,OAAO,SAAS;AAC9B,SAAO,QAAQ,IAAI,KAAK,KAAK;AAC/B;AAGA,eAAsB,iBAAiBC,UAA6C;AAClF,QAAM,MAAM,MAAMA,SAAQ,MAAM,GAAGA,SAAQ,QAAQ,8BAA8BA,SAAQ,KAAK,IAAI;AAAA,IAChG,SAASA,SAAQ;AAAA,EACnB,CAAC;AACD,QAAM,OAAO,MAAMC,cAAa,GAAG;AACnC,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAMC,UAAS,0BAA0B,IAAI,QAAQ,IAAI,CAAC;AACjF,MAAIF,SAAQ,KAAM,CAAAA,SAAQ,OAAO,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAAA,MAC7D,YAAW,MAAMA,SAAQ,MAAM;AACtC;AAEA,SAAS,WAAW,OAAuB;AACzC,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,KAAK;AAC5D,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,SAAO;AACT;AAEA,SAAS,WAAW,MAAe,KAAkD;AACnF,QAAM,aAAaG,UAAS,IAAI,KAAKA,UAAS,KAAK,UAAU,KAAK,MAAM,QAAQ,KAAK,WAAW,QAAQ,IACpG,KAAK,WAAW,SAAS,OAAOA,SAAQ,IACxC,CAAC;AACL,MAAI,IAAI,qDAAqD,OAAOA,UAAS,IAAI,IAAI,KAAK,iBAAiB,KAAK,EAAE,CAAC;AAAA,4DAAgG;AACnN,aAAW,OAAO,YAAY;AAC5B,QAAI,IAAI;AAAA,MACN,OAAO,IAAI,UAAU,EAAE;AAAA,MAAG,OAAO,IAAI,SAAS,EAAE;AAAA,MAAG,OAAO,IAAI,gBAAgB,EAAE;AAAA,MAChF,OAAO,IAAI,iBAAiB,EAAE;AAAA,MAAG,eAAe,IAAI,aAAa;AAAA,MAAG,OAAO,IAAI,kBAAkB,EAAE;AAAA,IACrG,EAAE,KAAK,GAAI,CAAC;AAAA,EACd;AACA,QAAM,SAASA,UAAS,IAAI,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,KAAK,OAAO,OAAOA,SAAQ,IAAI,CAAC;AAC9F,MAAI,IAAI,UAAU,OAAOA,UAAS,IAAI,IAAI,KAAK,cAAc,OAAO,SAAS,OAAO,MAAM,CAAC;AAAA,sEAAwG;AACnM,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,QAAQ,MAAM,YAAY;AACxC,UAAM,SAAS,QAAQ,MAAM,aAAa;AAC1C,UAAM,SAAS,MAAM,WAAW,QAAQ,MAAM,WAAW;AACzD,QAAI,IAAI;AAAA,MACNC,WAAU,MAAM,UAAU;AAAA,MAAG,GAAG,OAAO,MAAM,UAAU,EAAE,CAAC,IAAI,OAAO,MAAM,OAAO,EAAE,CAAC;AAAA,MACrF,OAAO,MAAM,UAAU,EAAE;AAAA,MAAG,GAAG,OAAO,MAAM,cAAc,EAAE,CAAC,IAAI,OAAO,MAAM,YAAY,EAAE,CAAC;AAAA,MAC7F,GAAG,OAAO,MAAM,WAAW,EAAE,CAAC,IAAI,OAAO,MAAM,QAAQ,EAAE,CAAC;AAAA,MAC1D,GAAG,OAAO,MAAM,YAAY,EAAE,CAAC,IAAI,OAAO,MAAM,SAAS,EAAE,CAAC,KAAK,OAAO,MAAM,kBAAkB,SAAS,CAAC;AAAA,MAAI,OAAO,QAAQ,MAAM;AAAA,MACnI,SAAS,eAAe,MAAM,aAAa,IAAI;AAAA,MAC/C,GAAG,OAAO,MAAM,UAAU,EAAE,CAAC,GAAG,MAAM,aAAa,IAAI,OAAO,MAAM,UAAU,CAAC,KAAK,EAAE;AAAA,IACxF,EAAE,KAAK,GAAI,CAAC;AAAA,EACd;AACF;AAEA,SAAS,QAAQ,OAAwB;AACvC,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ;AACvE;AAEA,SAAS,eAAe,OAAwB;AAC9C,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,KAAK,QAAQ,KAAW,QAAQ,CAAC,CAAC,KAAK;AACtG;AAEA,SAASA,WAAU,OAAwB;AACzC,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO,OAAO,SAAS,EAAE;AACnF,QAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,SAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI;AAChE;AAEA,eAAeH,cAAa,KAAiC;AAC3D,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,CAAC,KAAM,QAAO,CAAC;AACnB,MAAI;AAAE,WAAO,KAAK,MAAM,IAAI;AAAA,EAAc,QAAQ;AAAE,WAAO,EAAE,SAAS,KAAK,MAAM,GAAG,GAAG,EAAE;AAAA,EAAG;AAC9F;AAEA,SAASC,UAAS,QAAgB,QAAgB,MAAuB;AACvE,QAAM,QAAQC,UAAS,IAAI,KAAKA,UAAS,KAAK,KAAK,IAAI,KAAK,QAAQ;AACpE,QAAME,WAAU,SAAS,OAAO,MAAM,YAAY,WAAW,MAAM,UAAUF,UAAS,IAAI,KAAK,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AACjJ,SAAO,GAAG,MAAM,YAAY,MAAM,MAAME,QAAO;AACjD;AAEA,SAASF,UAAS,OAAkD;AAClE,SAAO,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;AH7CA,eAAsB,QAAQ,SAAwC;AACpE,QAAM,WAAW,iBAAiB,QAAQ,YAAYG,SAAQ,IAAI,iBAAiB,iBAAiB;AACpG,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,aAAa,QAAQ,WAAW,UAAU,kBAAkB,OAAO,IAAI;AAC7E,QAAM,aAAa,QAAQ,WAAW,UAAU,kBAAkB,OAAO,IAAI;AAC7E,QAAM,QAA6B,QAAQ,WAAW,QAClD,6BACA,QAAQ,WAAW,mBACjB,iCACA,QAAQ,WAAW,gBACjB,gCACA,QAAQ,WAAW,UACjB,2BACA,QAAQ,WAAW,UACjB,2BACF;AACV,QAAM,QAAQ,MAAM,0BAA0B;AAAA,IAC5C;AAAA,IACA;AAAA,IACA,OAAO,QAAQ;AAAA,IACf,OAAO,QAAQ;AAAA,IACf,MAAM,QAAQ;AAAA,IACd,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,iBAAiB,QAAQ;AAAA,IACzB,WAAW,QAAQ;AAAA,EACrB,CAAC;AACD,QAAM,UAAU,EAAE,eAAe,UAAU,KAAK,IAAI,gBAAgB,mBAAmB;AAEvF,MAAI,QAAQ,WAAW,SAAS;AAC9B,UAAM,iBAAiB,EAAE,UAAU,OAAO,cAAc,IAAI,SAAS,MAAM,QAAQ,MAAM,OAAO,SAAS,QAAQ,IAAI,CAAC;AACtH;AAAA,EACF;AAEA,MAAI,QAAQ,WAAW,SAAS;AAC9B,UAAM,iBAAiB,EAAE,UAAU,OAAO,cAAc,IAAI,SAAS,MAAM,QAAQ,MAAM,OAAO,SAAS,QAAQ,IAAI,CAAC;AACtH;AAAA,EACF;AAEA,MAAI,QAAQ,WAAW,eAAe;AACpC,UAAMC,OAAM,MAAM,QAAQ,GAAG,QAAQ,qCAAqC,EAAE,QAAQ,CAAC;AACrF,UAAMC,QAAO,MAAMC,cAAaF,IAAG;AACnC,QAAI,CAACA,KAAI,GAAI,OAAM,IAAI,MAAMG,UAAS,sCAAsCH,KAAI,QAAQC,KAAI,CAAC;AAC7F,UAAM,cAAcG,UAASH,KAAI,KAAKG,UAASH,MAAK,WAAW,IAAIA,MAAK,cAAcA;AACtF,QAAI,QAAQ,KAAM,KAAI,IAAI,KAAK,UAAU,EAAE,YAAY,GAAG,MAAM,CAAC,CAAC;AAAA,QAC7D,YAAW,CAAC,UAAU,MAAM,KAAK,OAAO,QAAQG,UAAS,WAAW,IAAI,cAAc,CAAC,CAAC,GAAG;AAC9F,YAAM,QAAQA,UAAS,MAAM,KAAK,OAAO,QAAQ,OAC7C,OAAO,aAAa,OAAO,mBAAmB,6BAC9C;AACJ,UAAI,IAAI,GAAG,QAAQ,IAAK,KAAK,EAAE;AAAA,IACjC;AACA;AAAA,EACF;AAEA,MAAI,QAAQ,WAAW,kBAAkB;AACvC,UAAM,WAAW,gBAAgB,QAAQ,kBAAkB;AAC3D,UAAM,QAAQ,MAAM,iBAAiB,OAAO;AAC5C,UAAMJ,OAAM,MAAM,QAAQ,GAAG,QAAQ,qCAAqC,mBAAmB,QAAQ,CAAC,IAAI;AAAA,MACxG,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;AAAA,IAChC,CAAC;AACD,UAAMC,QAAO,MAAMC,cAAaF,IAAG;AACnC,QAAI,CAACA,KAAI,GAAI,OAAM,IAAI,MAAMG,UAAS,SAAS,QAAQ,wBAAwBH,KAAI,QAAQC,KAAI,CAAC;AAChG,QAAI,IAAI,UAAU,QAAQ,2DAA2D;AACrF;AAAA,EACF;AAEA,MAAI,QAAQ,WAAW,UAAU,QAAQ,WAAW,UAAU;AAC5D,UAAMD,OAAM,MAAM,QAAQ,GAAG,QAAQ,kCAAkC,EAAE,QAAQ,CAAC;AAClF,UAAMC,QAAO,MAAMC,cAAaF,IAAG;AACnC,QAAI,CAACA,KAAI,GAAI,OAAM,IAAI,MAAMG,UAAS,6BAA6BH,KAAI,QAAQC,KAAI,CAAC;AACpF,QAAI,QAAQ,WAAW,UAAU;AAC/B,YAAM,SAAS,cAAcA,KAAI,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,YAAY,MAAM,aAAa,QAAQ,QAAQ;AAC7G,UAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,QAAQ,WAAW,0CAA0C,QAAQ,QAAQ,KAAK,uCAAuC;AAC7J,UAAI,QAAQ,KAAM,KAAI,IAAI,KAAK,UAAU,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;AAAA,UACxD,YAAW,SAAS,OAAQ,KAAI,IAAI,GAAG,MAAM,QAAQ,IAAK,MAAM,EAAE,EAAE;AACzE;AAAA,IACF;AACA,UAAM,WAAW,YAAYA,KAAI;AACjC,QAAI,QAAQ,MAAM;AAChB,UAAI,IAAI,KAAK,UAAU,EAAE,UAAU,QAAQ,cAAcA,KAAI,EAAE,GAAG,MAAM,CAAC,CAAC;AAC1E;AAAA,IACF;AACA,QAAI,IAAI,4EAAkF;AAC1F,eAAWI,WAAU,UAAU;AAC7B,UAAI,IAAI;AAAA,QACNA,QAAO;AAAA,QACP,OAAOA,QAAO,OAAO;AAAA,QACrBA,QAAO;AAAA,QACPA,QAAO;AAAA,QACP,OAAOA,QAAO,kBAAkB,EAAE;AAAA,QAClC,OAAOA,QAAO,iBAAiB,EAAE;AAAA,QACjC,OAAOA,QAAO,mBAAmB,EAAE;AAAA,MACrC,EAAE,KAAK,GAAI,CAAC;AAAA,IACd;AACA;AAAA,EACF;AAEA,MAAI,QAAQ,YAAY,YAAY;AAClC,UAAM,kBAAkB,MAAM,QAAQ,GAAG,QAAQ,kCAAkC,EAAE,QAAQ,CAAC;AAC9F,UAAM,cAAc,MAAMH,cAAa,eAAe;AACtD,QAAI,CAAC,gBAAgB,GAAI,OAAM,IAAI,MAAMC,UAAS,qCAAqC,gBAAgB,QAAQ,WAAW,CAAC;AAC3H,UAAM,WAAW,YAAY,WAAW;AACxC,UAAM,YAAY,SAAS,KAAK,CAACE,YAAWA,QAAO,YAAY,oBAAoB;AACnF,UAAM,aAAa,SAAS,KAAK,CAACA,YAAWA,QAAO,YAAY,qBAAqB;AACrF,QAAI,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,cAAc,UAAU,OAAO,KAAK,CAAC,OAAO,cAAc,WAAW,OAAO,GAAG;AACtH,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E;AACA,UAAM,SAAS;AAAA,MACb,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,MACpE,GAAI,QAAQ,kBAAkB,SAAY,CAAC,IAAI,EAAE,eAAe,QAAQ,cAAc;AAAA,MACtF,GAAI,QAAQ,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,QAAQ,gBAAgB;AAAA,MAC5F,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,QAAQ,eAAe;AAAA,IAC3F;AACA,UAAM,kBAAkB;AAAA,MACtB,GAAG;AAAA,MACH,GAAI,QAAQ,mBAAmB,KAAK,IAAI,EAAE,UAAU,QAAQ,kBAAkB,KAAK,EAAE,IAAI,CAAC;AAAA,MAC1F,GAAI,QAAQ,gBAAgB,KAAK,IAAI,EAAE,OAAO,QAAQ,eAAe,KAAK,EAAE,IAAI,CAAC;AAAA,IACnF;AACA,UAAM,mBAAmB;AAAA,MACvB,GAAG;AAAA,MACH,GAAI,QAAQ,oBAAoB,KAAK,IAAI,EAAE,UAAU,QAAQ,mBAAmB,KAAK,EAAE,IAAI,CAAC;AAAA,MAC5F,GAAI,QAAQ,iBAAiB,KAAK,IAAI,EAAE,OAAO,QAAQ,gBAAgB,KAAK,EAAE,IAAI,CAAC;AAAA,IACrF;AACA,QAAI,CAAC,OAAO,KAAK,eAAe,EAAE,UAAU,CAAC,OAAO,KAAK,gBAAgB,EAAE,QAAQ;AACjF,YAAM,IAAI,MAAM,gEAAgE;AAAA,IAClF;AACA,UAAML,OAAM,MAAM,QAAQ,GAAG,QAAQ,2CAA2C;AAAA,MAC9E,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU;AAAA,QACnB,kBAAkB,EAAE,WAAW,UAAU,SAAS,YAAY,WAAW,QAAQ;AAAA,QACjF,WAAW;AAAA,QACX,YAAY;AAAA,MACd,CAAC;AAAA,IACH,CAAC;AACD,UAAMM,YAAW,MAAMJ,cAAaF,IAAG;AACvC,QAAI,CAACA,KAAI,GAAI,OAAM,IAAI,MAAMG,UAAS,iCAAiCH,KAAI,QAAQM,SAAQ,CAAC;AAC5F,QAAI,IAAI,QAAQ,OAAO,KAAK,UAAUA,WAAU,MAAM,CAAC,IAAI,gFAAgF;AAC3I;AAAA,EACF;AAEA,QAAM,UAAU,uBAAuB,QAAQ,OAAO;AACtD,QAAM,OAAO;AAAA,IACX,GAAI,QAAQ,UAAU,KAAK,IAAI,EAAE,UAAU,QAAQ,SAAS,KAAK,EAAE,IAAI,CAAC;AAAA,IACxE,GAAI,QAAQ,OAAO,KAAK,IAAI,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,IAC/D,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,IACpE,GAAI,QAAQ,kBAAkB,SAAY,CAAC,IAAI,EAAE,eAAe,QAAQ,cAAc;AAAA,IACtF,GAAI,QAAQ,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,QAAQ,gBAAgB;AAAA,IAC5F,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,QAAQ,eAAe;AAAA,EAC3F;AACA,MAAI,CAAC,OAAO,KAAK,IAAI,EAAE,OAAQ,OAAM,IAAI,MAAM,iEAAiE;AAChH,QAAM,MAAM,MAAM,QAAQ,GAAG,QAAQ,kCAAkC,mBAAmB,OAAO,CAAC,IAAI;AAAA,IACpG,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,QAAMA,YAAW,MAAMJ,cAAa,GAAG;AACvC,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAMC,UAAS,UAAU,OAAO,IAAI,IAAI,QAAQG,SAAQ,CAAC;AAChF,QAAM,SAAkCF,UAASE,SAAQ,KAAKF,UAASE,UAAS,MAAM,IAClFA,UAAS,SACTF,UAASE,SAAQ,IAAIA,YAAW,CAAC;AACrC,MAAI,IAAI,QAAQ,OAAO,KAAK,UAAU,EAAE,OAAO,GAAG,MAAM,CAAC,IAAI,WAAW,OAAO,KAAK,OAAO,OAAO,YAAY,WAAW,CAAC,IAAI,OAAO,OAAO,SAAS,WAAW,CAAC,EAAE;AACrK;AAEA,SAAS,gBAAgB,OAA8D;AACrF,MAAI,UAAU,eAAe,UAAU,YAAY,UAAU,UAAU;AACrE,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAA+C;AAClE,MAAIF,UAAS,IAAI,KAAK,MAAM,QAAQ,KAAK,QAAQ,EAAG,QAAO,KAAK,SAAS,OAAOA,SAAQ;AACxF,MAAIA,UAAS,IAAI,KAAKA,UAAS,KAAK,QAAQ,EAAG,QAAO,OAAO,OAAO,KAAK,QAAQ,EAAE,OAAOA,SAAQ;AAClG,QAAM,IAAI,MAAM,iDAAiD;AACnE;AAEA,SAAS,cAAc,MAAwD;AAC7E,MAAI,CAACA,UAAS,IAAI,KAAK,CAACA,UAAS,KAAK,OAAO,KAAK,CAAC,MAAM,QAAQ,KAAK,QAAQ,MAAM,GAAG;AACrF,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,SAAO,KAAK,QAAQ,OAAO,OAAO,CAAC,UACjCA,UAAS,KAAK,KAAK,OAAO,MAAM,OAAO,YAAY,OAAO,MAAM,aAAa,QAAQ;AACzF;AAEA,eAAeF,cAAa,KAAiC;AAC3D,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,CAAC,KAAM,QAAO,CAAC;AACnB,MAAI;AAAE,WAAO,KAAK,MAAM,IAAI;AAAA,EAAc,QAAQ;AAAE,WAAO,EAAE,SAAS,KAAK,MAAM,GAAG,GAAG,EAAE;AAAA,EAAG;AAC9F;AAEA,SAASC,UAAS,QAAgB,QAAgB,MAAuB;AACvE,QAAM,QAAQC,UAAS,IAAI,KAAKA,UAAS,KAAK,KAAK,IAAI,KAAK,QAAQ;AACpE,QAAMG,WAAU,SAAS,OAAO,MAAM,YAAY,WAAW,MAAM,UAAUH,UAAS,IAAI,KAAK,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AACjJ,SAAO,GAAG,MAAM,YAAY,MAAM,MAAMG,QAAO;AACjD;AAEA,SAASH,UAAS,OAAkD;AAClE,SAAO,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;AInQA,SAAS,cAAAI,aAAY,gBAAAC,qBAAoB;AACzC,SAAS,WAAAC,UAAS,cAAAC,aAAY,WAAAC,gBAAe;AAC7C,SAAS,qBAAqB;;;ACCvB,SAAS,qBACd,KACA,MACA,iBACM;AACN,MAAI,IAAI,iBAAiB,OAAW;AACpC,MAAI,CAAC,MAAM,QAAQ,IAAI,YAAY,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,iCAAiC;AAC9F,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,CAAC,OAAO,WAAW,KAAK,IAAI,aAAa,QAAQ,GAAG;AAC7D,UAAM,KAAK,GAAG,IAAI,kBAAkB,KAAK;AACzC,QAAI,CAACC,UAAS,WAAW,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE,oBAAoB;AACrE,QAAI,CAAC,QAAQ,YAAY,EAAE,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE,qDAAqD;AACxG,QAAI,IAAI,IAAI,YAAY,EAAE,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,+BAA+B,YAAY,EAAE,GAAG;AACpG,QAAI,IAAI,YAAY,EAAE;AACtB,QAAI,CAAC,SAAS,YAAY,OAAO,GAAG,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE,oBAAoB;AAChF,QAAI,CAAC,SAAS,YAAY,KAAK,GAAG,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE,kBAAkB;AAC5E,QAAI,YAAY,WAAW,WAAc,CAACA,UAAS,YAAY,MAAM,KAAK,CAACA,UAAS,YAAY,OAAO,QAAQ,IAAI;AACjH,YAAM,IAAI,MAAM,GAAG,EAAE,yCAAyC;AAAA,IAChE;AACA,QAAI,YAAY,UAAU,UAAa,CAACA,UAAS,YAAY,KAAK,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE,0BAA0B;AACpH,kBAAc,aAAa,EAAE;AAC7B,mBAAe,aAAa,EAAE;AAAA,EAChC;AACA,QAAM,UAAU,IAAI,aAAa,KAAK,CAAC,gBAAgB,YAAY,UAAU,YAAY,SAAS,YAAY,OAAO,MAAM;AAC3H,QAAM,WAAW,OAAO,IAAI,UAAU,SAAS,IAAI,WAAW,eAAe;AAC7E,MAAI,WAAW,CAAC,SAAS,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,yDAAyD;AAC3H;AAEA,SAAS,cAAc,aAAqE,IAAkB;AAC5G,MAAI,YAAY,UAAU,OAAW;AACrC,MAAI,CAAC,MAAM,QAAQ,YAAY,KAAK,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE,yBAAyB;AACrF,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,CAAC,OAAO,IAAI,KAAK,YAAY,MAAM,QAAQ,GAAG;AACvD,UAAM,MAAM,GAAG,EAAE,UAAU,KAAK;AAChC,QAAI,CAACA,UAAS,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,GAAG,KAAK,CAAC,SAAS,KAAK,IAAI,GAAG,EAAG,OAAM,IAAI,MAAM,GAAG,GAAG,qBAAqB;AACtH,QAAI,IAAI,IAAI,KAAK,EAAE,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE,2BAA2B,KAAK,EAAE,GAAG;AAChF,QAAI,IAAI,KAAK,EAAE;AACf,QAAI,CAACA,UAAS,KAAK,GAAG,KAAK,CAAC,SAAS,KAAK,IAAI,MAAM,GAAG,KAAK,CAAC,SAAS,KAAK,IAAI,OAAO,IAAK,GAAG;AAC5F,YAAM,IAAI,MAAM,GAAG,GAAG,qCAAqC;AAAA,IAC7D;AACA,QAAI,CAACA,UAAS,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,GAAG,GAAG,0BAA0B;AAC3E,QAAI,OAAO,OAAO,KAAK,OAAO,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,OAAO;AAC5F,YAAM,IAAI,MAAM,GAAG,GAAG,UAAU,KAAK,IAAI,IAAI,iCAAiC;AAAA,IAChF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,aAAqE,IAAkB;AAC7G,MAAI,YAAY,WAAW,OAAW;AACtC,MAAI,CAAC,MAAM,QAAQ,YAAY,MAAM,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE,0BAA0B;AACvF,aAAW,CAAC,OAAO,KAAK,KAAK,YAAY,OAAO,QAAQ,GAAG;AACzD,UAAM,MAAM,GAAG,EAAE,WAAW,KAAK;AACjC,QAAI,CAACA,UAAS,KAAK,KAAK,CAAC,cAAc,MAAM,IAAI,EAAG,OAAM,IAAI,MAAM,GAAG,GAAG,0DAA0D;AACpI,QAAI,CAAC,OAAO,UAAU,MAAM,cAAc,KAAK,MAAM,iBAAiB,OAAO,MAAM,iBAAiB,KAAK;AACvG,YAAM,IAAI,MAAM,GAAG,GAAG,wCAAwC;AAAA,IAChE;AAAA,EACF;AACF;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,SAAS,OAAgB,KAA8B;AAC9D,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,KAAK,MAAM,UAAU,OAAO,CAAC,wBAAwB,KAAK,KAAK;AAC3H;AAEA,SAAS,cAAc,OAAiC;AACtD,SAAO,OAAO,UAAU,YAAY,sCAAsC,KAAK,KAAK;AACtF;AAEA,SAAS,QAAQ,OAAiC;AAChD,SAAO,OAAO,UAAU,YAAY,uBAAuB,KAAK,KAAK;AACvE;AAEA,SAAS,OAAO,QAAqC;AACnD,SAAO,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,OAAO,CAAC,CAAC;AAC5C;;;AD1EA,IAAM,mBAAmB;AAEzB,IAAM,eAAe,CAAC,KAAK;AAC3B,IAAM,mBAAmB,CAAC,MAAM,IAAI;AAE7B,IAAM,+BAA+B;AAE5C,eAAsB,kBAAkB,aAAa,mBAAiD;AACpG,QAAM,WAAWC,SAAQ,UAAU;AACnC,MAAI,CAACC,YAAW,QAAQ,GAAG;AACzB,UAAM,IAAI,MAAM,qBAAqB,UAAU,8CAA8C;AAAA,EAC/F;AAEA,QAAM,MAAM,MAAM,iBAAiB,QAAQ;AAC3C,QAAM,UAAUC,SAAQ,QAAQ;AAChC,oBAAkB,KAAK,QAAQ;AAE/B,QAAM,cAAc,UAAU,QAAQ,IAAI,qBAAqB,IAAI,eAAe,gBAAgB;AAClG,QAAM,aAAa,UAAU,QAAQ,IAAI,oBAAoB,IAAI,cAAc,WAAW;AAC1F,QAAM,OAAOC,QAAO,IAAI,MAAM,SAAS,IAAI,OAAO,YAAY;AAC9D,QAAM,WAAWA,QAAO,IAAI,UAAU,SAAS,IAAI,WAAW,gBAAgB;AAC9E,yBAAuB,KAAK,MAAM,UAAU,QAAQ;AACpD,QAAM,QAAQ;AAAA,IACZ,WAAWH,SAAQ,SAAS,IAAI,OAAO,aAAa,sBAAsB;AAAA,IAC1E,iBAAiBA,SAAQ,SAAS,IAAI,OAAO,mBAAmB,8BAA8B;AAAA,IAC9F,aAAaA,SAAQ,SAAS,IAAI,OAAO,eAAe,WAAW;AAAA,IACnE,WAAW,IAAI,OAAO,aAAa;AAAA,EACrC;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,kBACpB,KACA,OACA,OACwB;AACxB,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,MAAO,QAAO;AACrE,MAAI,OAAO,UAAU,SAAU,QAAO;AAEtC,QAAM,SAASI,YAAW,KAAK,IAAI,QAAQJ,SAAQ,IAAI,SAAS,KAAK;AACrE,MAAI,OAAO,SAAS,OAAO,GAAG;AAC5B,WAAO,KAAK,MAAMK,cAAa,QAAQ,MAAM,CAAC;AAAA,EAChD;AACA,QAAM,MAAO,MAAM,OAAO,cAAc,MAAM,EAAE;AAChD,aAAW,QAAQ,OAAO;AACxB,QAAI,IAAI,IAAI,MAAM,OAAW,QAAO,IAAI,IAAI;AAAA,EAC9C;AACA,MAAI,IAAI,YAAY,OAAW,QAAO,IAAI;AAC1C,QAAM,IAAI,MAAM,GAAG,KAAK,mBAAmB,MAAM,KAAK,IAAI,CAAC,aAAa;AAC1E;AAEO,SAAS,UAAU,KAAyC;AACjE,QAAM,oBAAoB,IAAI,cAAc,KAAK,CAAC,gBAAgB,YAAY,MAAM,KAAK;AACzF,QAAM,mBAAmB,IAAI,cAAc,KAAK,CAAC,gBAAgB,YAAY,KAAK,KAAK;AACvF,SAAO;AAAA,IACL,OAAO,IAAI,IAAI;AAAA,IACf,SAAS,IAAI,IAAI;AAAA,IACjB,aAAa,IAAI;AAAA,IACjB,YAAY,IAAI;AAAA,IAChB,MAAM,IAAI;AAAA,IACV,UAAU,IAAI;AAAA,IACd,eAAe,IAAI,gBAAgB,CAAC,GAAG,IAAI,CAAC,gBAAgB,YAAY,EAAE;AAAA,IAC1E,WAAW,CAAC,CAAC,IAAI,IAAI,UAAU;AAAA,IAC/B,UACE,CAAC,CAAC,IAAI,IAAI,SACV,qBACE,CAAC,CAAC,IAAI,IAAI,UAAU,sBAAsB,IAAI,IAAI,iBAAiB;AAAA,IACvE,YAAY,IAAI,IAAI;AAAA,EACtB;AACF;AAGO,SAAS,sBAAsB,KAA0B,KAAoC;AAClG,MAAI,CAAC,IAAI,SAAS,SAAS,UAAU,EAAG,OAAM,IAAI,MAAM,oDAAoD;AAC5G,MAAI,CAAC,IAAI,KAAK,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,iBAAiB,GAAG,kCAAkC;AACnG,QAAM,SAAS,IAAI,UAAU;AAC7B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,kEAAkE;AAC/F,QAAM,eAAeF;AAAA,KAClB,OAAO,wBAAwB,GAAG,KAAK,OAAO,YAAY,GAAG,GAAI,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;AAAA,EACzF;AACA,SAAO;AAAA,IACL,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,mBAAmB,OAAO,kBAAkB,GAAG,GAAG,KAAK,KAAK,aAAa,CAAC;AAAA,IAC1E,uBAAuB;AAAA,EACzB;AACF;AAGO,SAAS,uBAAuB,KAA0B,KAAwC;AACvG,QAAM,QAAQ,IAAI,UAAU,OAAO,iBAAiB,GAAG;AACvD,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,SAAO,IAAI,IAAI,KAAK,EAAE,SAAS;AACjC;AAEO,SAAS,gBAAgB,QAA2B;AACzD,QAAM,WAAW,mBAAmB,MAAM;AAC1C,SAAO,OAAO;AAAA,IACZ,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,SAAS,QAAQ,SAAS,QAAQ,SAAS,QAAQ,QAAQ,CAAC,CAAC;AAAA,EACrG;AACF;AAEO,SAAS,mBAAmB,QAA2B;AAC5D,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO,CAAC;AACnD,QAAM,WAAY,OAAkC;AACpD,MAAI,CAAC,YAAY,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AAClF,SAAO,OAAO,KAAK,QAAQ;AAC7B;AAEO,SAAS,SAAS,OAA+C;AACtE,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,MAAM,WAAW,GAAG,EAAG,QAAO,QAAQ,IAAI,MAAM,MAAM,CAAC,CAAC;AAC5D,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAc,MAAgD;AACvF,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,OAAM,IAAI,MAAM,GAAG,IAAI,wBAAwB;AACpF,QAAM,MAAM;AACZ,MAAI,CAAC,IAAI,OAAO,OAAO,IAAI,QAAQ,SAAU,OAAM,IAAI,MAAM,GAAG,IAAI,sBAAsB;AAC1F,MAAI,CAACG,SAAQ,IAAI,IAAI,EAAE,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,0DAA0D;AAC3G,MAAI,CAAC,IAAI,IAAI,QAAQ,OAAO,IAAI,IAAI,SAAS,SAAU,OAAM,IAAI,MAAM,GAAG,IAAI,wBAAwB;AACtG,MAAI,IAAI,SAAS,WAAc,CAAC,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,KAAK,KAAK,CAAC,QAAQ,OAAO,QAAQ,QAAQ,IAAI;AAC3G,UAAM,IAAI,MAAM,GAAG,IAAI,kCAAkC;AAAA,EAC3D;AACA,MAAI,IAAI,MAAM,KAAK,CAAC,QAAQ,CAACA,SAAQ,GAAG,CAAC,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,6DAA6D;AAChI,MAAI,IAAI,aAAa,WAAc,CAAC,MAAM,QAAQ,IAAI,QAAQ,KAAK,IAAI,SAAS,KAAK,CAAC,YAAY,OAAO,YAAY,YAAY,CAAC,QAAQ,KAAK,CAAC,IAAI;AAClJ,UAAM,IAAI,MAAM,GAAG,IAAI,gDAAgD;AAAA,EACzE;AACA,uBAAqB,KAAK,MAAM,gBAAgB;AAClD;AAEA,SAAS,uBAAuB,KAAwB,MAAgB,UAAoB,MAAoB;AAC9G,QAAM,UAAU,SAAS,SAAS,UAAU;AAC5C,MAAI,CAAC,IAAI,UAAU;AACjB,QAAI,QAAS,OAAM,IAAI,MAAM,GAAG,IAAI,iEAAiE;AACrG;AAAA,EACF;AACA,MAAI,CAACC,UAAS,IAAI,QAAQ,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,8BAA8B;AAClF,aAAW,IAAI,UAAU,CAAC,QAAQ,GAAG,GAAG,IAAI,YAAY;AACxD,MAAI,CAACA,UAAS,IAAI,SAAS,MAAM,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,qCAAqC;AAChG,QAAM,SAAS,IAAI,SAAS;AAC5B;AAAA,IACE;AAAA,IACA,CAAC,yBAAyB,aAAa,mBAAmB,gBAAgB;AAAA,IAC1E,GAAG,IAAI;AAAA,EACT;AAGA,QAAM,kBAAkB,OAAO,0BAA0B,SAAY,0BACjE,OAAO,cAAc,SAAY,cAAc;AACnD,MAAI,CAAC,mBAAoB,OAAO,0BAA0B,UAAa,OAAO,cAAc,QAAY;AACtG,UAAM,IAAI,MAAM,GAAG,IAAI,uFAAuF;AAAA,EAChH;AACA,QAAM,eAAe,OAAO,eAAe;AAC3C,MAAI,CAACA,UAAS,YAAY,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,qBAAqB,eAAe,qCAAqC;AAC7H,QAAM,aAAa,OAAO,KAAK,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,GAAG,CAAC;AAC9E,MAAI,WAAY,OAAM,IAAI,MAAM,GAAG,IAAI,qBAAqB,eAAe,IAAI,UAAU,wBAAwB;AACjH,aAAW,OAAO,MAAM;AACtB,UAAM,MAAM,aAAa,GAAG;AAC5B,QAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,WAAW,GAAG;AAC3C,YAAM,IAAI,MAAM,GAAG,IAAI,qBAAqB,eAAe,IAAI,GAAG,4BAA4B;AAAA,IAChG;AACA,QAAI,IAAI,SAAS,IAAI;AACnB,YAAM,IAAI,MAAM,GAAG,IAAI,qBAAqB,eAAe,IAAI,GAAG,uCAAuC;AAAA,IAC3G;AACA,QAAI,IAAI,KAAK,CAAC,OAAO,CAACC,UAAS,IAAI,IAAK,CAAC,GAAG;AAC1C,YAAM,IAAI,MAAM,GAAG,IAAI,qBAAqB,eAAe,IAAI,GAAG,kCAAkC;AAAA,IACtG;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,QAAW;AACxC,QAAI,CAACD,UAAS,OAAO,eAAe,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,yEAAyE;AACvI,UAAM,oBAAoB,OAAO,KAAK,OAAO,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,GAAG,CAAC;AAC/F,QAAI,kBAAmB,OAAM,IAAI,MAAM,GAAG,IAAI,qCAAqC,iBAAiB,wBAAwB;AAC5H,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,eAAe,GAAG;AACjE,UAAI,CAACC,UAAS,OAAO,IAAK,GAAG;AAC3B,cAAM,IAAI,MAAM,GAAG,IAAI,qCAAqC,GAAG,wBAAwB;AAAA,MACzF;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,mBAAmB,QAAW;AACvC,QAAI,CAACD,UAAS,OAAO,cAAc,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,2EAA2E;AACxI,UAAM,oBAAoB,OAAO,KAAK,OAAO,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,GAAG,CAAC;AAC9F,QAAI,kBAAmB,OAAM,IAAI,MAAM,GAAG,IAAI,oCAAoC,iBAAiB,wBAAwB;AAC3H,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,cAAc,GAAG;AAChE,UAAI,UAAU,QAAQ,CAAC,aAAa,KAAK,GAAG;AAC1C,cAAM,IAAI,MAAM,GAAG,IAAI,oCAAoC,GAAG,uDAAuD;AAAA,MACvH;AAAA,IACF;AAAA,EACF;AACA,MAAI,WAAW,CAAC,SAAS,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,4CAA4C;AAC9G;AAEA,SAAS,WAAW,OAAgC,SAAmB,OAAqB;AAC1F,QAAM,QAAQ,OAAO,KAAK,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,SAAS,GAAG,CAAC;AACrE,MAAI,MAAO,OAAM,IAAI,MAAM,GAAG,KAAK,IAAI,KAAK,mBAAmB;AACjE;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAASC,UAAS,OAAgB,KAA8B;AAC9D,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,KAAK,MAAM,UAAU,OAAO,CAAC,wBAAwB,KAAK,KAAK;AAC3H;AAEA,SAAS,aAAa,OAAiC;AACrD,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAO,QAAO;AAC9D,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,WAAO,IAAI,aAAa,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI;AAAA,EAC7E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAASF,SAAQ,OAAiC;AAChD,SAAO,OAAO,UAAU,YAAY,uBAAuB,KAAK,KAAK;AACvE;AAEA,eAAe,iBAAiB,MAA0C;AACxE,MAAI,KAAK,SAAS,OAAO,EAAG,QAAO,KAAK,MAAMD,cAAa,MAAM,MAAM,CAAC;AACxE,QAAM,MAAO,MAAM,OAAO,GAAG,cAAc,IAAI,EAAE,IAAI,MAAM,KAAK,IAAI,CAAC;AAIrE,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,OAAO,UAAU,WAAY,QAAO,MAAM,MAAM;AACpD,SAAO;AACT;AAEA,SAAS,UAAU,OAAuB;AACxC,SAAO,MAAM,QAAQ,QAAQ,EAAE;AACjC;AAEA,SAASF,QAAO,QAA4B;AAC1C,SAAO,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,OAAO,CAAC,CAAC;AAC5C;;;AEvPA,IAAM,eAAwC;AAAA,EAC5C,CAAC,kCAAkC,oBAAoB;AAAA,EACvD,CAAC,kCAAkC,kBAAkB;AAAA,EACrD,CAAC,yBAAyB,eAAe;AAAA,EACzC,CAAC,4BAA4B,kBAAkB;AAAA,EAC/C,CAAC,wBAAwB,iBAAiB;AAAA,EAC1C,CAAC,yCAAyC,eAAe;AAAA,EACzD,CAAC,wBAAwB,gBAAgB;AAC3C;AAaO,SAAS,cAAc,OAAuB;AACnD,MAAI,SAAS;AACb,aAAW,CAAC,SAAS,WAAW,KAAK,aAAc,UAAS,OAAO,QAAQ,SAAS,WAAW;AAC/F,SAAO;AACT;AAQO,SAAS,gBACd,QACuC;AACvC,QAAM,aAAa,CAAC,SAAoB,KAAK,IAAI,CAAC,UAAU,kBAAkB,OAAO,oBAAI,QAAyB,CAAC,CAAC;AACpH,SAAO;AAAA,IACL,KAAK,IAAI,SAAoB,OAAO,IAAI,GAAG,WAAW,IAAI,CAAC;AAAA,IAC3D,OAAO,IAAI,SAAoB,OAAO,MAAM,GAAG,WAAW,IAAI,CAAC;AAAA,EACjE;AACF;AAEA,SAAS,kBAAkB,OAAgB,MAAyC;AAClF,MAAI,OAAO,UAAU,SAAU,QAAO,cAAc,KAAK;AACzD,MAAI,iBAAiB,OAAO;AAC1B,UAAM,WAAW,IAAI,MAAM,cAAc,MAAM,OAAO,CAAC;AACvD,aAAS,OAAO,MAAM;AACtB,QAAI,MAAM,MAAO,UAAS,QAAQ,cAAc,MAAM,KAAK;AAC3D,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAQ,KAAK,IAAI,KAAK;AAC5B,MAAI,MAAO,QAAO;AAClB,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAMM,QAAkB,CAAC;AACzB,SAAK,IAAI,OAAOA,KAAI;AACpB,eAAW,QAAQ,MAAO,CAAAA,MAAK,KAAK,kBAAkB,MAAM,IAAI,CAAC;AACjE,WAAOA;AAAA,EACT;AACA,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,MAAI,cAAc,OAAO,aAAa,cAAc,KAAM,QAAO;AACjE,QAAM,OAAgC,CAAC;AACvC,OAAK,IAAI,OAAO,IAAI;AACpB,aAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAK,EAAG,MAAK,GAAG,IAAI,kBAAkB,MAAM,IAAI;AACzF,SAAO;AACT;AAGO,SAAS,YAAY,OAAwB;AAClD,SAAO,cAAc,KAAK,MAAM,SAAS,MAAM,SAAS,YAAY;AACtE;;;AC5EA,IAAM,2BAA2B,oBAAI,IAAI;AAAA,EACvC;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AACF,CAAC;AAOM,IAAM,uBAAN,cAAmC,MAAM;AAAA;AAAA,EAErC;AAAA;AAAA,EAEA;AAAA,EAET,YAAYC,UAAiB,QAAgB,MAAe;AAC1D,UAAMA,QAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,QAAI,SAAS,OAAW,MAAK,OAAO;AAAA,EACtC;AACF;AASO,SAAS,2BAA2B,OAAkE;AAC3G,SAAO,iBAAiB,wBAAwB,MAAM,SAAS,UAAa,yBAAyB,IAAI,MAAM,IAAI;AACrH;;;ACjCO,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EAAiB;AAAA,EAAe;AAAA,EAAW;AAAA,EAAY;AAAA,EAAgB;AACzE;AAiDA,eAAsB,mBAAmB,KAAmD;AAC1F,SAAO,oBAAoB,MAAM,aAAa,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG;AACrE;AAEA,eAAsB,wBAAwB,KAA8D;AAC1G,QAAM,MAAM,MAAM,aAAa,KAAK,cAAc,CAAC,CAAC;AACpD,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,CAAC,SAAS,CAAC,MAAM,QAAQ,MAAM,SAAS,EAAG,OAAM,IAAI,MAAM,iDAAiD;AAChH,SAAO,MAAM,UAAU,IAAI,CAAC,MAAM,UAAU;AAC1C,UAAM,WAAW,OAAO,IAAI;AAC5B,UAAM,KAAK,UAAU,UAAU,IAAI,IAAK;AACxC,QAAI,CAAC,YAAY,CAAC,GAAI,OAAM,IAAI,MAAM,4DAA4D,KAAK,EAAE;AACzG,UAAM,OAAO,SAAS;AACtB,QAAI,SAAS,UAAa,SAAS,oBAAoB,SAAS,YAAY,SAAS,YAAY,SAAS,SAAS;AACjH,YAAM,IAAI,MAAM,+DAA+D,KAAK,EAAE;AAAA,IACxF;AACA,WAAO;AAAA,MACL;AAAA,MACA,GAAG,aAAa,WAAW,SAAS,SAAS,GAAG;AAAA,MAChD,GAAI,OAAO,SAAS,YAAY,YAAY,EAAE,SAAS,SAAS,QAAQ,IAAI,CAAC;AAAA,MAC7E,GAAI,OAAO,SAAS,aAAa,YAAY,EAAE,UAAU,SAAS,SAAS,IAAI,CAAC;AAAA,MAChF,GAAI,OAAO,SAAS,WAAW,EAAE,YAAY,KAAK,IAAI,CAAC;AAAA,IACzD;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,sBAAsB,KAA0B,gBAAwD;AAC5H,SAAO,oBAAoB,MAAM,aAAa,KAAK,IAAI,EAAE,QAAQ,OAAO,MAAM,KAAK,UAAU,EAAE,eAAe,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG;AAC9H;AAEA,eAAsB,wBAAwB,KAA8D;AAC1G,QAAM,MAAM,MAAM,aAAa,KAAK,mBAAmB,EAAE,QAAQ,QAAQ,MAAM,KAAK,CAAC;AACrF,QAAM,QAAQ,QAAQ,KAAK,SAAS;AACpC,QAAM,YAAY,UAAU,MAAM,WAAW,GAAG;AAChD,QAAM,aAAa,UAAU,MAAM,YAAY,IAAK;AACpD,QAAM,YAAYC,WAAU,MAAM,SAAS;AAC3C,MAAI,CAAC,aAAa,CAAC,cAAc,cAAc,OAAW,OAAM,IAAI,MAAM,8CAA8C;AACxH,SAAO,EAAE,WAAW,YAAY,UAAU;AAC5C;AAEA,eAAsB,uBAAuB,KAA0B,WAA4C;AACjH,SAAO;AAAA,IACL,MAAM,aAAa,KAAK,mBAAmB,mBAAmB,WAAW,WAAW,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;AAAA,IACvG,IAAI;AAAA,EACN;AACF;AAEA,eAAsB,0BAA0B,KAAmD;AACjG,SAAO;AAAA,IACL,MAAM,aAAa,KAAK,eAAe,EAAE,QAAQ,QAAQ,MAAM,KAAK,UAAU,EAAE,OAAO,MAAM,CAAC,EAAE,CAAC;AAAA,IACjG,IAAI;AAAA,EACN;AACF;AAEO,SAAS,oBAAoB,KAAc,KAA6B;AAC7E,QAAM,QAAQ,QAAQ,KAAK,UAAU;AACrC,QAAM,QAAQ,OAAO,MAAM,OAAO,KAAK,OAAO,MAAM,MAAM,KAAK;AAC/D,QAAM,aAAa,OAAO,MAAM,UAAU,KAAK,CAAC;AAChD,QAAM,SAAS,OAAO,MAAM,MAAM,KAAK,OAAO,MAAM,MAAM,KAAK,CAAC;AAChE,QAAM,eAAe,OAAO,OAAO,MAAM,KAAK;AAC9C,QAAM,aAAa,cAAc,MAAM,UAAU,MAAM,SAAS,WAAW,UAAU,WAAW,KAAK;AACrG,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,QAAM,gBAAgB,MAAM,YAAY,WAAW,YAAY,OAAO,aAAa,OAAO,SAAS,WAAW;AAC9G,MAAI,kBAAkB,UAAa,kBAAkB,QAAQ,kBAAkB,UAAU;AACvF,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AACA,QAAM,cAAc,MAAM,UAAU,WAAW,UAAU,OAAO,UAAU,aAAa;AAEvF,MAAI,gBAAgB,UAAa,gBAAgB,UAAU,gBAAgB,QAAQ;AACjF,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,QAAM,aAAa,OAAO,MAAM,KAAK,KAAK,OAAO,WAAW,KAAK;AACjE,QAAM,YAAY,UAAU,MAAM,eAAe,GAAG;AACpD,QAAM,mBAAmB,OAAO,OAAO,OAAO,gBAAgB,IAC1D,MAAM,iBACN,OAAO,OAAO,QAAQ,gBAAgB,IAAI,OAAO,iBAAiB,aAAa;AACnF,QAAM,YAAY,QAAQ,MAAM,aAAa,WAAW,eAAe,YACnE,QAAQ,MAAM,aAAa,WAAW,SAAS,IAC/C,CAAC,WAAW,UAAU,EAAE,SAAS,UAAU;AAC/C,QAAM,oBAAoB,UAAU,MAAM,qBAAqB,OAAO,mBAAmB,IAAK;AAC9F,SAAO;AAAA,IACL;AAAA,IACA,SAAS,OAAO,MAAM,YAAY,YAAY,MAAM,UAAU;AAAA,IAC9D;AAAA,IACA,UAAU,OAAO,MAAM,aAAa,YAAY,MAAM,WAAW,eAAe;AAAA,IAChF,UAAU,kBAAkB,WAAW,WAAW;AAAA,IAClD,QAAQ;AAAA,IACR,GAAI,gBAAgB,SAAY,EAAE,QAAQ,OAAgB,IAAI,CAAC;AAAA,IAC/D,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;AAAA,IACjD,WAAW;AAAA,MACT,MAAM,yBAAyB,OAAO,yBACnC,MAAM,uBAAuB,MAAM,aAAa,OAAO,aAAa,aAAa;AAAA,IACtF;AAAA,IACA,GAAG,oBAAoB,kBAAkB,gBAAgB;AAAA,IACzD,eAAe,WAAW,MAAM,iBAAiB,WAAW,iBAAiB,WAAW,MAAM;AAAA,IAC9F,GAAG,aAAa,aAAa,MAAM,aAAa,WAAW,WAAW,GAAG;AAAA,IACzE,GAAI,cAAc,YAAY,EAAE,OAAO;AAAA,MACrC,GAAI,UAAU,YAAY,MAAM,GAAG,IAAI,EAAE,MAAM,UAAU,YAAY,MAAM,GAAG,EAAE,IAAI,CAAC;AAAA,MACrF,GAAI,UAAU,YAAY,SAAS,GAAG,IAAI,EAAE,SAAS,UAAU,YAAY,SAAS,GAAG,EAAE,IAAI,CAAC;AAAA,MAC9F,GAAI,CAAC,cAAc,YAAY,EAAE,MAAM,UAAU,IAAI,CAAC;AAAA,IACxD,EAAE,IAAI,CAAC;AAAA,EACT;AACF;AAEA,SAAS,cAAc,OAAgD;AACrE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAK,gBAAsC,SAAS,KAAK,EAAG,QAAO;AACnE,QAAM,SAAkD;AAAA,IACtD,UAAU;AAAA,IACV,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,OAAO;AAAA,IACP,OAAO;AAAA,EACT;AACA,SAAO,OAAO,KAAK,KAAK;AAC1B;AAEA,eAAe,aAAa,KAA0B,QAAgB,MAAqC;AACzG,QAAM,WAAW,iBAAiB,IAAI,QAAQ;AAC9C,QAAM,QAAQ,WAAW,IAAI,OAAO,OAAO;AAC3C,QAAM,MAAM,WAAW,IAAI,KAAK,KAAK;AACrC,QAAM,MAAM,IAAI,IAAI,kBAAkB,mBAAmB,KAAK,CAAC,YAAY,MAAM,IAAI,QAAQ;AAC7F,MAAI,aAAa,IAAI,OAAO,GAAG;AAC/B,QAAM,QAAQ,WAAW,IAAI,KAAK;AAClC,MAAIC;AACJ,MAAI;AACF,IAAAA,YAAW,OAAO,IAAI,SAAS,OAAO,KAAK;AAAA,MACzC,GAAG;AAAA,MACH,UAAU;AAAA,MACV,aAAa;AAAA,MACb,SAAS,EAAE,eAAe,UAAU,KAAK,IAAI,gBAAgB,oBAAoB,GAAG,KAAK,QAAQ;AAAA,IACnG,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,4BAA4B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAAA,EACtG;AACA,QAAM,OAAO,MAAMA,UAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACnD,MAAI,CAACA,UAAS,IAAI;AAChB,UAAM,OAAO,UAAU,KAAK,OAAO,MAAM,GAAG;AAC5C,UAAMC,WAAU,UAAU,KAAK,OAAO,SAAS,GAAG;AAClD,UAAM,SAAS,GAAG,OAAO,IAAI,IAAI,KAAK,EAAE,GAAGA,WAAU,KAAKA,QAAO,KAAK,EAAE;AACxE,UAAM,IAAI,qBAAqB,cAAc,4BAA4BD,UAAS,MAAM,IAAI,MAAM,EAAE,GAAGA,UAAS,QAAQ,IAAI;AAAA,EAC9H;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,KAAc,KAAsC;AACnE,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,uCAAuC;AACnE,SAAO,OAAO,MAAM,GAAG,CAAC,KAAK;AAC/B;AAEA,SAAS,OAAO,OAAgD;AAC9D,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC;AACnH;AAEA,SAAS,UAAU,OAAgB,KAAiC;AAClE,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,UAAU,OAAO,CAAC,wBAAwB,KAAK,KAAK,IAAI,QAAQ;AAChI;AAEA,SAAS,WAAW,OAA0B;AAC5C,SAAO,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG,IAAI,IAAI,MAAM,OAAO,CAAC,SAAyB,CAAC,CAAC,UAAU,MAAM,IAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClH;AAEA,SAAS,YAAY,OAA0B;AAC7C,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,QAAQ,CAAC,SAAS;AACzC,QAAI,OAAO,SAAS,SAAU,QAAO,UAAU,MAAM,IAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AACxE,UAAM,WAAW,OAAO,IAAI;AAC5B,UAAM,KAAK,UAAU,UAAU,IAAI,IAAK;AACxC,WAAO,MAAM,UAAU,aAAa,QAAQ,CAAC,EAAE,IAAI,CAAC;AAAA,EACtD,CAAC,CAAC,CAAC;AACL;AAEA,SAASD,WAAU,OAAoC;AACrD,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,SAAS,EAAG,QAAO;AAC9E,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,QAAI,OAAO,SAAS,MAAM,EAAG,QAAO;AAAA,EACtC;AACA,SAAO;AACT;AAEA,SAAS,aAA+B,KAAQ,OAAgB,KAAoC;AAClG,QAAM,SAAS,UAAU,OAAO,GAAG;AACnC,SAAO,SAAS,EAAE,CAAC,GAAG,GAAG,OAAO,IAA6B,CAAC;AAChE;AAIA,SAAS,oBAAsC,KAAQ,OAA8C;AACnG,MAAI,UAAU,KAAM,QAAO,EAAE,CAAC,GAAG,GAAG,KAAK;AACzC,QAAM,SAAS,UAAU,OAAO,IAAK;AACrC,SAAO,SAAS,EAAE,CAAC,GAAG,GAAG,OAAO,IAAoC,CAAC;AACvE;AAEA,SAAS,WAAW,OAAe,MAAsB;AACvD,MAAI,OAAO,UAAU,YAAY,CAAC,sCAAsC,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,aAAa;AACzH,SAAO;AACT;AAEA,SAAS,WAAW,OAAuB;AACzC,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,SAAS,QAAS,2BAA2B,KAAK,KAAK,GAAG;AACnH,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACA,SAAO;AACT;;;ACxQA,eAAsB,oBAAoB,cAAsB,QAAqC;AACnG,MAAI,QAAQ,QAAS,OAAM,OAAO,UAAU,IAAI,MAAM,6BAA6B;AACnF,QAAM,IAAI,QAAc,CAACG,WAAS,WAAW;AAC3C,UAAM,QAAQ,WAAWA,WAAS,YAAY;AAC9C,YAAQ,iBAAiB,SAAS,MAAM;AACtC,mBAAa,KAAK;AAClB,aAAO,OAAO,UAAU,IAAI,MAAM,6BAA6B,CAAC;AAAA,IAClE,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,EACnB,CAAC;AACH;;;ACsBA,eAAsB,eAAe,SAA4D;AAC/F,QAAM,EAAE,KAAK,IAAI,IAAI,MAAM,iBAAiB,OAAO;AACnD,QAAM,SAAS,MAAM,mBAAmB,GAAG;AAC3C,cAAY,QAAQ,QAAQ,SAAS,MAAM,GAAG;AAC9C,SAAO;AACT;AAGA,eAAsB,kBAAkB,SAAuE;AAC7G,QAAM,EAAE,KAAK,IAAI,IAAI,MAAM,iBAAiB,OAAO;AACnD,QAAM,YAAY,MAAM,wBAAwB,GAAG;AACnD,MAAI,QAAQ,KAAM,KAAI,IAAI,KAAK,UAAU,EAAE,KAAK,IAAI,KAAK,UAAU,GAAG,MAAM,CAAC,CAAC;AAAA,WACrE,UAAU,WAAW,EAAG,KAAI,IAAI,GAAG,IAAI,GAAG,iCAAiC;AAAA,MAC/E,YAAW,YAAY,WAAW;AACrC,QAAI,IAAI,GAAG,SAAS,WAAW,WAAM,SAAS,UAAU,MAAM,GAAG,IAAI,SAAS,EAAE,GAAG,SAAS,UAAU,WAAM,SAAS,OAAO,KAAK,EAAE,GAAG,SAAS,aAAa,KAAK,SAAS,UAAU,MAAM,EAAE,EAAE;AAAA,EAChM;AACA,SAAO;AACT;AAKA,eAAsB,gBAAgB,SAA4D;AAChG,QAAM,EAAE,KAAK,KAAK,IAAI,IAAI,MAAM,iBAAiB,OAAO;AACxD,oBAAkB,IAAI,KAAK,QAAQ,KAAK,kBAAkB;AAC1D,QAAM,OAAO,uBAAuB,KAAK,IAAI,GAAG;AAChD,QAAM,UAAU,SAAS,SAAY,MAAM,mBAAmB,GAAG,IAAI,MAAM,sBAAsB,KAAK,IAAI;AAC1G,QAAM,iBAAiB,kBAAkB,SAAS,GAAG;AACrD,SAAO,MAAM,0BAA0B,KAAK,SAAS,cAAc,KAC9D,mBAAmB,KAAK,cAAc;AAC7C;AAGA,eAAsB,yBACpB,KACA,gBACA,KACgC;AAChC,MAAI,mBAAmB,OAAW,QAAO;AACzC,QAAM,SAAS,MAAM,sBAAsB,KAAK,cAAc;AAC9D,MAAI,IAAI,GAAG,IAAI,GAAG,2BAA2B,iBAAiB,QAAQ,SAAS,EAAE;AACjF,SAAO;AACT;AAKA,eAAsB,mBAAmB,SAA4D;AACnG,MAAI,CAAC,QAAQ,IAAK,OAAM,IAAI,MAAM,oCAAoC;AACtE,QAAM,EAAE,KAAK,IAAI,IAAI,MAAM,iBAAiB,OAAO;AACnD,QAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,MAAI,IAAI,GAAG,IAAI,GAAG,sDAAsD;AACxE,SAAO;AACT;AAGA,eAAsB,wBACpB,KACA,SACyB;AACzB,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,UAAU,MAAM,mBAAmB,GAAG;AAC5C,QAAM,iBAAiB,kBAAkB,SAAS,GAAG;AACrD,SAAO,MAAM,0BAA0B,KAAK,SAAS,cAAc,KAC9D,mBAAmB,KAAK,cAAc;AAC7C;AAEA,eAAe,iBAAiB,SAI7B;AACD,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,MAAI,CAAC,IAAI,SAAS,SAAS,UAAU,EAAG,OAAM,IAAI,MAAM,oDAAoD;AAC5G,QAAM,MAAM,QAAQ,QAAQ,IAAI,KAAK,SAAS,KAAK,IAAI,QAAQ,IAAI,KAAK,CAAC;AACzE,MAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,QAAQ,OAAO,EAAE,wBAAwB,QAAQ,UAAU,EAAE;AAElH,wBAAsB,KAAK,GAAG;AAC9B,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,MACE,YAAY,IAAI;AAAA,MAChB,OAAO,QAAQ;AAAA,MACf,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ;AAAA,MACd,iBAAiB,QAAQ;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,EAAE,KAAK,KAAK,EAAE,UAAU,IAAI,aAAa,OAAO,IAAI,IAAI,IAAI,KAAK,OAAO,OAAO,QAAQ,GAAG,IAAI;AACvG;AAEA,SAAS,kBACP,SACA,KACuB;AACvB,QAAM,UAAU,gBAAgB,EAAE,MAAM,QAAQ,KAAK,CAAC;AACtD,SAAO;AAAA,IACL;AAAA,IACA,MAAM,QAAQ;AAAA,IACd,gBAAgB,QAAQ;AAAA,IACxB,MAAM,QAAQ;AAAA,IACd,eAAe,QAAQ;AAAA,IACvB,KAAK,QAAQ;AAAA,IACb,QAAQ,QAAQ;AAAA,EAClB;AACF;AAgBA,eAAe,0BACb,KACA,SACA,SACgC;AAChC,MAAI,QAAQ,WAAW,WAAW;AAChC,YAAQ,IAAI,IAAI,GAAG,IAAI,GAAG,wCAAwC;AAClE,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,WAAW,YAAY;AACjC,YAAQ,IAAI,IAAI,GAAG,IAAI,GAAG,4EAAuE;AACjG,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,WAAW,YAAY,QAAQ,WAAW;AACpD,UAAM,SAAS,QAAQ,OAAO,WAAW,QAAQ,OAAO;AACxD,UAAM,IAAI,MAAM,6BAA6B,SAAS,KAAK,MAAM,KAAK,EAAE,2CAA2C;AAAA,EACrH;AACA,MAAI,QAAQ,WAAW,cAAe,QAAO;AAG7C,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,WAAW,IAAI,IAAI,YAAY,QAAQ,aAAa;AAC1D,QAAMC,QAAO,QAAQ,QAAQ;AAC7B,MAAI,QAAQ;AACZ,SAAO,IAAI,IAAI,UAAU;AACvB,QAAI,QAAQ,QAAQ,QAAS,OAAM,QAAQ,OAAO,UAAU,IAAI,MAAM,6BAA6B;AACnG,UAAM,SAAS,MAAM,mBAAmB,GAAG;AAC3C,QAAI,OAAO,WAAW,OAAO;AAC3B,cAAQ,IAAI,IAAI,GAAG,IAAI,GAAG,cAAc,OAAO,OAAO,WAAW,KAAK,GAAG,CAAC,EAAE;AAC5E,cAAQ,OAAO;AAAA,IACjB;AACA,QAAI,OAAO,WAAW,UAAW,QAAO;AACxC,QAAI,OAAO,WAAW,WAAY,QAAO;AACzC,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW;AAClD,YAAM,SAAS,OAAO,OAAO,WAAW,OAAO,OAAO;AACtD,YAAM,IAAI,MAAM,6BAA6B,SAAS,KAAK,MAAM,KAAK,EAAE,2CAA2C;AAAA,IACrH;AACA,QAAI,OAAO,WAAW,cAAe,QAAO;AAC5C,UAAMA,MAAK,KAAK,IAAI,KAAO,KAAK,IAAI,GAAG,WAAW,IAAI,CAAC,CAAC,GAAG,QAAQ,MAAM;AAAA,EAC3E;AACA,QAAM,IAAI,MAAM,2FAA2F;AAC7G;AAEA,eAAe,mBAAmB,KAA0B,SAAyD;AACnH,QAAM,UAAU,MAAM,wBAAwB,GAAG;AACjD,QAAM,aAAa,0BAA0B,IAAI,UAAU,QAAQ,UAAU;AAC7E,UAAQ,IAAI,IAAI,GAAG,IAAI,GAAG,8BAA8B,UAAU,EAAE;AACpE,MAAI,QAAQ,MAAM;AAChB,WAAO,QAAQ,kBAAkB,SAAS,UAAU;AACpD,YAAQ,IAAI,IAAI,GAAG,IAAI,GAAG,kDAAkD;AAAA,EAC9E;AACA,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,UAAU,YAAY,QAAQ,aAAa;AACjD,QAAM,WAAW,KAAK,IAAI,QAAQ,WAAW,IAAI,IAAI,OAAO;AAC5D,QAAMA,QAAO,QAAQ,QAAQ;AAC7B,MAAI,QAAQ;AACZ,SAAO,IAAI,IAAI,UAAU;AACvB,QAAI,QAAQ,QAAQ,QAAS,OAAM,QAAQ,OAAO,UAAU,IAAI,MAAM,6BAA6B;AACnG,UAAM,SAAS,MAAM,uBAAuB,KAAK,QAAQ,SAAS;AAClE,QAAI,OAAO,WAAW,OAAO;AAC3B,cAAQ,IAAI,IAAI,GAAG,IAAI,GAAG,cAAc,OAAO,OAAO,WAAW,KAAK,GAAG,CAAC,EAAE;AAC5E,cAAQ,OAAO;AAAA,IACjB;AACA,QAAI,OAAO,WAAW,UAAW,QAAO;AACxC,QAAI,OAAO,WAAW,YAAY;AAChC,YAAM,IAAI,MAAM,qFAAqF;AAAA,IACvG;AACA,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW,kBAAkB,OAAO,WAAW,iBAAiB;AACvG,YAAM,SAAS,OAAO,OAAO,WAAW,OAAO,OAAO;AACtD,YAAM,IAAI,MAAM,uBAAuB,OAAO,MAAM,GAAG,SAAS,KAAK,MAAM,KAAK,EAAE,EAAE;AAAA,IACtF;AACA,UAAMA,MAAK,KAAK,IAAI,KAAO,KAAK,IAAI,GAAG,WAAW,IAAI,CAAC,CAAC,GAAG,QAAQ,MAAM;AAAA,EAC3E;AACA,QAAM,IAAI,MAAM,oFAAoF;AACtG;AAEO,SAAS,0BAA0B,UAAkB,OAAuB;AACjF,QAAM,SAAS,iBAAiB,QAAQ;AACxC,MAAI;AACJ,MAAI;AAAE,UAAM,MAAM,WAAW,GAAG,IAAI,IAAI,IAAI,OAAO,MAAM,IAAI,IAAI,IAAI,KAAK;AAAA,EAAG,QAAQ;AAAE,UAAM,IAAI,MAAM,kDAAkD;AAAA,EAAG;AAC5J,QAAM,eAAe,IAAI,WAAW;AACpC,QAAM,aAAa,IAAI,WAAW,iCAAiC,IAAI,aAAa;AACpF,MAAK,CAAC,gBAAgB,CAAC,cAAe,IAAI,YAAY,IAAI,YAAY,IAAI,MAAM;AAC9E,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,YAAY,QAAQ,KAAK,KAAgB;AAChD,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,OAAS,QAAQ,KAAK,IAAQ,OAAM,IAAI,MAAM,8CAA8C;AACxI,SAAO;AACT;AAIA,SAAS,kBAAkB,KAAa,KAA0B,QAAsB;AACtF,OAAK,QAAQ,UAAU,QAAQ,iBAAiB,CAAC,IAAK,OAAM,IAAI,MAAM,eAAe,MAAM,SAAS,GAAG,iBAAiB;AAC1H;AAEA,SAAS,YAAY,QAAwB,MAAe,KAAwC;AAClG,MAAI,MAAM;AACR,QAAI,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AACvC;AAAA,EACF;AACA,MAAI,IAAI,aAAa,OAAO,YAAY,MAAM,IAAI,OAAO,MAAM,KAAK,OAAO,GAAG,GAAG;AACjF,MAAI,IAAI,eAAe,OAAO,WAAW,QAAQ,OAAO,YAAY,gDAA2C,yBAAoB,EAAE;AACrI,MAAI,OAAO,kBAAmB,KAAI,IAAI,uBAAuB,OAAO,iBAAiB,EAAE;AACvF,MAAI,IAAI,6BAA6B,OAAO,UAAU,SAAS,OAAO,UAAU,KAAK,IAAI,IAAI,MAAM,EAAE;AACrG,MAAI,OAAO,mBAAmB,OAAW,KAAI,IAAI,mBAAmB,OAAO,kBAAkB,gBAAgB,EAAE;AAC/G,MAAI,OAAO,OAAO,QAAQ,OAAO,OAAO,QAAS,KAAI,IAAI,YAAY,OAAO,MAAM,QAAQ,OAAO,GAAG,OAAO,MAAM,UAAU,WAAM,OAAO,MAAM,OAAO,KAAK,EAAE,EAAE;AAChK;;;ACzQO,IAAM,eAAe;AAAA,EAC1B,KAAK;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAKO,SAAS,kBAAkB,OAAO,OAAO,MAAc,SAAe;AAC3E,MAAI,MAAM;AACR,QAAI,IAAI,KAAK,UAAU,cAAc,MAAM,CAAC,CAAC;AAC7C;AAAA,EACF;AACA,MAAI,IAAI,mCAAmC;AAC3C,aAAW,KAAK,iBAAiB,aAAa,GAAG;AACjD,aAAW,KAAK,+BAA+B,aAAa,KAAK;AACjE,aAAW,KAAK,qBAAqB,aAAa,KAAK;AACvD,aAAW,KAAK,UAAU,aAAa,MAAM;AAC/C;AAEA,SAAS,WAAW,KAAa,SAAiB,OAAgC;AAChF,MAAI,IAAI,GAAG,OAAO,GAAG;AACrB,aAAW,QAAQ,MAAO,KAAI,IAAI,OAAO,IAAI,EAAE;AAC/C,MAAI,IAAI,EAAE;AACZ;;;AChEA,SAAS,oBAAoB;AAC7B,SAAS,cAAAC,aAAY,gBAAAC,qBAAoB;AACzC,SAAS,QAAAC,OAAM,WAAAC,gBAAe;;;ACF9B,SAAS,SAAAC,cAAa;AACtB,SAAS,cAAAC,aAAY,gBAAAC,qBAAoB;AACzC,SAAS,QAAAC,aAAY;AAWd,IAAM,gBAA+B,CAAC,KAAK,MAAM,SACtD,IAAI,QAAQ,CAAC,gBAAgB,WAAW;AACtC,QAAM,QAAQH,OAAM,KAAK,MAAM,EAAE,KAAK,MAAM,KAAK,OAAO,CAAC,QAAQ,QAAQ,MAAM,EAAE,CAAC;AAClF,MAAI,SAAS;AACb,MAAI,SAAS;AACb,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAmB,UAAU,MAAM,SAAS,CAAE;AACvE,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAmB,UAAU,MAAM,SAAS,CAAE;AACvE,QAAM,GAAG,SAAS,MAAM;AACxB,QAAM,GAAG,SAAS,CAAC,SAAS,eAAe,EAAE,MAAM,QAAQ,GAAG,QAAQ,OAAO,CAAC,CAAC;AAC/E,QAAM,MAAM,IAAI,MAAM,SAAS,EAAE;AACnC,CAAC;AAEH,IAAM,wBAAwB,CAAC,kBAAkB,iBAAiB,eAAe;AAE1E,SAAS,mBAAmB,SAAgC;AACjE,aAAW,QAAQ,uBAAuB;AACxC,UAAM,OAAOG,MAAK,SAAS,IAAI;AAC/B,QAAIF,YAAW,IAAI,EAAG,QAAO;AAAA,EAC/B;AACA,SAAO;AACT;AAGO,SAAS,mBAAmB,MAA8C;AAC/E,MAAI,KAAK,SAAS,OAAO,EAAG,QAAO;AACnC,MAAI;AACF,WAAO,KAAK,MAAM,kBAAkBC,cAAa,MAAM,MAAM,CAAC,CAAC;AAAA,EACjE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,kBAAkB,MAAsB;AACtD,MAAI,SAAS;AACb,MAAI,WAAW;AACf,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,KAAK,KAAK,CAAC;AACjB,QAAI,UAAU;AACZ,gBAAU;AACV,UAAI,OAAO,MAAM;AACf,kBAAU,KAAK,IAAI,CAAC,KAAK;AACzB;AAAA,MACF,WAAW,OAAO,KAAK;AACrB,mBAAW;AAAA,MACb;AACA;AAAA,IACF;AACA,QAAI,OAAO,KAAK;AACd,iBAAW;AACX,gBAAU;AACV;AAAA,IACF;AACA,QAAI,OAAO,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AACrC,aAAO,IAAI,KAAK,UAAU,KAAK,CAAC,MAAM,KAAM;AAC5C,gBAAU;AACV;AAAA,IACF;AACA,QAAI,OAAO,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AACrC,WAAK;AACL,aAAO,IAAI,KAAK,UAAU,EAAE,KAAK,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAM;AACrE;AACA;AAAA,IACF;AACA,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AAEA,eAAsB,iBAAiB,KAAoB,KAA+B;AACxF,MAAI;AACF,UAAM,SAAS,MAAM,IAAI,OAAO,CAAC,YAAY,QAAQ,GAAG,EAAE,IAAI,CAAC;AAC/D,WAAO,OAAO,SAAS,KAAK,CAAC,qBAAqB,KAAK,GAAG,OAAO,MAAM,GAAG,OAAO,MAAM,EAAE;AAAA,EAC3F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,kBACd,KACA,MACoB;AACpB,QAAM,OAAO,CAAC,YAAY,UAAU,OAAO,KAAK,MAAM,GAAI,KAAK,MAAM,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,CAAE;AAC9F,SAAO,IAAI,OAAO,MAAM,EAAE,OAAO,KAAK,OAAO,KAAK,KAAK,IAAI,CAAC;AAC9D;;;ADrFO,SAAS,UAAU,OAA6B,UAAoB,YAAgC;AACzG,QAAM,WAAqB,CAAC;AAC5B,MAAI,CAAC,MAAO,QAAO;AACnB,aAAW,CAAC,IAAI,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,UAAI,OAAO,SAAS,YAAY,KAAK,KAAK,MAAM,OAAQ;AACxD,UAAI,WAAW,UAAU,WAAW,SAAS,EAAE,EAAG;AAClD,eAAS;AAAA,QACP,WAAW,SACP,SAAS,EAAE,4CAAuC,EAAE,mCACpD,SAAS,EAAE,IAAI,MAAM,oCAA+B,MAAM,IAAI,EAAE;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACA,aAAW,UAAU,UAAU;AAC7B,QAAI,EAAE,UAAU,OAAQ,UAAS,KAAK,kBAAkB,MAAM,iDAAiD;AAAA,EACjH;AACA,SAAO;AACT;AAIA,IAAM,cAAwB,CAAC,KAAK,MAAM,QAAQ,aAAa,KAAK,MAAM,EAAE,KAAK,UAAU,QAAQ,OAAO,CAAC,UAAU,QAAQ,QAAQ,EAAE,CAAC;AAGjI,SAAS,mBAAmB,SAAiB,OAAiB,aAAa,aAAuB,CAAC,GAAa;AACrH,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,WACZ,IAAI,CAAC,SAAS,eAAe,SAAS,IAAI,CAAC,EAC3C,OAAO,CAAC,SAAyB,CAAC,CAAC,IAAI;AAC1C,aAAS,KAAK,OAAO,CAAC,YAAY,MAAM,aAAa,SAAS,GAAG,MAAM,GAAG,OAAO;AAAA,EACnF,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,SAAO,OACJ,MAAM,OAAO,EACb,OAAO,OAAO,EACd,IAAI,CAAC,SAAS,GAAG,IAAI,kDAA6C,IAAI,wCAAwC;AACnH;AAGO,SAAS,iBAAiB,SAA2B;AAC1D,QAAM,aAAa,mBAAmB,OAAO;AAC7C,MAAI,CAAC,WAAY,QAAO,CAAC;AACzB,QAAM,SAAS,mBAAmB,UAAU;AAC5C,MAAI,CAAC,OAAQ,QAAO,CAAC;AAErB,QAAM,WAAqB,CAAC;AAC5B,QAAM,SAAmE,CAAC,EAAE,OAAO,IAAI,OAAO,OAAO,CAAC;AACtG,QAAM,OAAO,OAAO;AACpB,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAC3E,UAAI,SAAS,OAAO,UAAU,SAAU,QAAO,KAAK,EAAE,OAAO,OAAO,IAAI,KAAK,MAAwC,CAAC;AAAA,IACxH;AAAA,EACF;AAEA,aAAW,EAAE,OAAO,MAAM,KAAK,QAAQ;AACrC,UAAM,SAAS,MAAM;AACrB,QAAI,QAAQ,WAAW;AACrB,YAAM,MAAME,SAAQ,SAAS,OAAO,SAAS;AAC7C,UAAI,QAAQA,SAAQ,OAAO,GAAG;AAC5B,iBAAS,KAAK,GAAG,KAAK,uHAAkH;AAAA,MAC1I,WAAWC,YAAWC,MAAK,KAAK,cAAc,CAAC,GAAG;AAChD,iBAAS,KAAK,GAAG,KAAK,oGAA+F;AAAA,MACvH;AAAA,IACF;AACA,UAAM,OAAO,MAAM;AACnB,QAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,iBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAC3E,YAAI,SAAS,kBAAkB,SAAS,qBAAsB,OAAO,UAAU,YAAY,YAAY,KAAK,GAAI;AAC9G,mBAAS,KAAK,YAAY,KAAK,QAAQ,IAAI,0FAAqF;AAAA,QAClI;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,gBAAgB,OAAO;AACnC,MAAI,OAAO,OAAO,IAAI,YAAY,YAAY,IAAI,WAAW,YAAa,IAAI,SAAqC;AACjH,aAAS,KAAK,6FAAwF;AAAA,EACxG;AACA,SAAO;AACT;AAMO,SAAS,oBAAoB,SAA2B;AAC7D,QAAM,WAAqB,CAAC;AAC5B,QAAM,MAAM,gBAAgB,OAAO;AACnC,QAAM,eAAe,KAAK;AAC1B,QAAM,kBAAkB,KAAK;AAC7B,MAAI,CAAC,eAAe,eAAe,GAAG;AACpC,aAAS;AAAA,MACP,kBAAkB,eAAe,IAC7B,gGACA;AAAA,IACN;AAAA,EACF;AAEA,QAAM,aAAa,mBAAmB,OAAO;AAC7C,QAAM,SAAS,aAAa,mBAAmB,UAAU,IAAI;AAC7D,MAAI,CAAC,cAAc,CAAC,QAAQ;AAC1B,aAAS,KAAK,6FAAwF;AACtG,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,OAAO,OAAO,SAAS,WAAWF,SAAQ,SAAS,OAAO,IAAI,IAAI;AAC/E,MAAI,CAAC,QAAQ,CAACC,YAAW,IAAI,GAAG;AAC9B,aAAS,KAAK,yFAAoF;AAAA,EACpG,OAAO;AACL,QAAI,SAAS;AACb,QAAI;AACF,eAASE,cAAa,MAAM,MAAM;AAAA,IACpC,QAAQ;AAAA,IAER;AACA,QAAI,CAAC,wBAAwB,KAAK,MAAM,GAAG;AACzC,eAAS,KAAK,uBAAuB,OAAO,IAAc,uCAAuC;AAAA,IACnG;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,QAAQ,OAAO,mBAAmB,IAAI,OAAO,sBAAsB,CAAC;AACxF,MAAI,CAAC,MAAM,SAAS,eAAe,GAAG;AACpC,aAAS,KAAK,mFAAmF;AAAA,EACnG;AACA,SAAO;AACT;AAGO,SAAS,wBAAwB,SAA2B;AACjE,QAAM,MAAM,gBAAgB,OAAO;AACnC,QAAM,eAAe,KAAK;AAC1B,QAAM,kBAAkB,KAAK;AAC7B,MAAI,eAAe,mBAAmB,EAAG,QAAO,CAAC;AACjD,SAAO;AAAA,IACL,kBAAkB,mBAAmB,IACjC,6GACA;AAAA,EACN;AACF;AAEA,SAAS,gBAAgB,SAAiD;AACxE,MAAI;AACF,WAAO,KAAK,MAAMA,cAAaD,MAAK,SAAS,cAAc,GAAG,MAAM,CAAC;AAAA,EACvE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AExIO,SAAS,gBAAgB,cAAgE;AAC9F,QAAM,WAA6B,CAAC;AACpC,aAAW,eAAe,gBAAgB,CAAC,GAAG;AAC5C,UAAM,QAAS,aAA8B;AAC7C,UAAM,QAAQ,OAAO,OAAO,OAAO,CAAC,MAAM,OAAO,MAAM,YAAY,CAAC,KAAK,CAAC;AAC1E,QAAI,CAAC,OAAO,YAAY,CAAC,MAAM,OAAQ;AACvC,aAAS,KAAK;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM,IAAI,CAAC,SAAS,2BAA2B,IAAI,EAAE;AAAA,IACjE,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAGO,SAAS,cAAc,KAAkC,UAAkC;AAChG,MAAI,CAAC,SAAS,OAAQ;AACtB,MAAI,IAAI,EAAE;AACV,MAAI,IAAI,2BAA2B;AACnC,aAAW,WAAW,UAAU;AAC9B,QAAI,IAAI,KAAK,QAAQ,QAAQ,EAAE;AAE/B,eAAW,WAAW,QAAQ,SAAU,KAAI,IAAI,OAAO,OAAO,EAAE;AAAA,EAClE;AACA,MAAI,IAAI,4EAA8E;AACxF;;;ACnDA,SAAS,yBAAyB;AAkBlC,eAAsB,sBACpB,KACA,UAAuC,CAAC,GACP;AACjC,QAAM,eAAe,IAAI,gBAAgB,CAAC;AAC1C,MAAI,CAAC,IAAI,SAAS,SAAS,IAAI,EAAG,QAAO,EAAE,QAAQ,QAAW,OAAO,QAAW,aAAa;AAE7F,QAAM,iBAAiB,MAAM,kBAA2B,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,QAAQ,CAAC;AACjG,QAAM,SAAS,aAAa,gBAAgB,YAAY;AACxD,MAAI,QAAQ,kBAAkB,MAAO,qBAAoB,cAAc,MAAM;AAC7E,QAAM,kBAAkB,MAAM,kBAA4B,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,OAAO,CAAC;AAChG,QAAM,gBAAgB,WAAW,iBAAiB,YAAY;AAC9D,QAAM,QAAQ,oBAAoB,UAAa,UAAU,IAAI,IAAI,iBAAiB,QAC9E,EAAE,GAAG,gBAAgB,MAAM,GAAG,GAAI,iBAAiB,CAAC,EAAG,IACvD;AACJ,SAAO,EAAE,QAAQ,OAAO,aAAa;AACvC;AAGO,SAAS,oBACd,cACA,QACA,OACU;AACV,QAAM,WAAqB,CAAC;AAC5B,QAAM,WAAW,IAAI,IAAI,mBAAmB,MAAM,CAAC;AACnD,aAAW,eAAe,cAAc;AACtC,UAAM,aAAa,OAAO,KAAK,YAAY,QAAQ,YAAY,CAAC,CAAC;AACjE,eAAW,MAAM,YAAY;AAC3B,UAAI,CAAC,SAAS,IAAI,EAAE,EAAG,UAAS,KAAK,gBAAgB,YAAY,EAAE,uBAAuB,EAAE,cAAc;AAC1G,YAAM,OAAO,QAAQ,EAAE;AACvB,UAAI,CAAC,MAAM;AACT,iBAAS,KAAK,gBAAgB,YAAY,EAAE,uBAAuB,EAAE,GAAG;AACxE;AAAA,MACF;AACA,iBAAW,UAAU,CAAC,QAAQ,UAAU,UAAU,QAAQ,GAAY;AACpE,YAAI,KAAK,MAAM,MAAM,OAAW,UAAS,KAAK,gBAAgB,YAAY,EAAE,WAAW,EAAE,IAAI,MAAM,cAAc;AAAA,MACnH;AAAA,IACF;AACA,eAAW,QAAQ,YAAY,SAAS,CAAC,GAAG;AAC1C,UAAI,CAAC,SAAS,IAAI,KAAK,EAAE,GAAG;AAC1B,iBAAS,KAAK,gBAAgB,YAAY,EAAE,WAAW,KAAK,EAAE,gCAAgC,KAAK,EAAE,GAAG;AAAA,MAC1G,WAAW,CAAC,aAAa,QAAQ,KAAK,IAAI,KAAK,IAAI,IAAI,GAAG;AACxD,iBAAS,KAAK,gBAAgB,YAAY,EAAE,WAAW,KAAK,EAAE,UAAU,KAAK,EAAE,IAAI,KAAK,IAAI,IAAI,0BAA0B;AAAA,MAC5H;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,MAAe,cAAmD;AACtF,QAAM,YAAY,aAAa,OAAO,CAAC,gBAAgB,YAAY,MAAM;AACzE,MAAI,UAAU,WAAW,EAAG,QAAO;AACnC,QAAM,SAAS,gBAAgB,IAAI;AACnC,aAAW,eAAe,WAAW;AACnC,UAAM,WAAW,gBAAgB,YAAY,MAAM;AACnD,aAAS,OAAO,UAAU,SAAS,UAAU,gBAAgB,YAAY,EAAE,oBAAoB;AAC/F,aAAS,OAAO,OAAO,SAAS,OAAO,gBAAgB,YAAY,EAAE,eAAe;AAAA,EACtF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,MAA4B,cAAgE;AAC9G,QAAM,YAAY,aAAa,OAAO,CAAC,gBAAgB,YAAY,KAAK;AACxE,MAAI,UAAU,WAAW,EAAG,QAAO;AACnC,QAAM,SAAmB,EAAE,GAAI,QAAQ,CAAC,EAAG;AAC3C,aAAW,eAAe,WAAW;AACnC,aAAS,QAAQ,YAAY,SAAS,CAAC,GAAG,gBAAgB,YAAY,EAAE,kBAAkB;AAAA,EAC5F;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,cAA0C,QAAuB;AAC5F,QAAM,WAAW,IAAI,IAAI,mBAAmB,MAAM,CAAC;AACnD,aAAW,eAAe,cAAc;AACtC,eAAW,QAAQ,YAAY,SAAS,CAAC,GAAG;AAC1C,UAAI,CAAC,SAAS,IAAI,KAAK,EAAE,GAAG;AAC1B,cAAM,IAAI,MAAM,gBAAgB,YAAY,EAAE,WAAW,KAAK,EAAE,gCAAgC,KAAK,EAAE,GAAG;AAAA,MAC5G;AACA,UAAI,CAAC,aAAa,QAAQ,KAAK,IAAI,KAAK,IAAI,IAAI,GAAG;AACjD,cAAM,IAAI,MAAM,gBAAgB,YAAY,EAAE,WAAW,KAAK,EAAE,UAAU,KAAK,EAAE,IAAI,KAAK,IAAI,IAAI,2BAA2B;AAAA,MAC/H;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,aAAa,QAAiB,IAAY,MAAuB;AACxE,MAAI,CAACE,UAAS,MAAM,KAAK,CAACA,UAAS,OAAO,QAAQ,EAAG,QAAO;AAC5D,QAAM,SAAS,OAAO,SAAS,EAAE;AACjC,MAAI,CAACA,UAAS,MAAM,KAAK,CAACA,UAAS,OAAO,KAAK,EAAG,QAAO;AACzD,QAAM,aAAa,OAAO,MAAM,IAAI;AACpC,SAAOA,UAAS,UAAU,KAAK,WAAW,WAAW;AACvD;AAEA,SAAS,gBAAgB,OAAkC;AACzD,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO,EAAE,UAAU,CAAC,GAAG,OAAO,CAAC,EAAE;AAC5E,MAAI,CAACA,UAAS,KAAK,KAAK,CAACA,UAAS,MAAM,QAAQ,GAAG;AACjD,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,MAAI,MAAM,UAAU,UAAa,CAACA,UAAS,MAAM,KAAK,EAAG,OAAM,IAAI,MAAM,mCAAmC;AAC5G,SAAO;AAAA,IACL,UAAU,EAAE,GAAG,MAAM,SAAS;AAAA,IAC9B,OAAO,EAAE,GAAI,MAAM,SAAS,CAAC,EAAG;AAAA,EAClC;AACF;AAEA,SAAS,SAAS,QAAiC,UAAmC,OAAqB;AACzG,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACpD,QAAI,OAAO,OAAO,QAAQ,IAAI,KAAK,CAAC,kBAAkB,OAAO,IAAI,GAAG,KAAK,GAAG;AAC1E,YAAM,IAAI,MAAM,GAAG,KAAK,KAAK,IAAI,yCAAyC;AAAA,IAC5E;AACA,WAAO,IAAI,IAAI;AAAA,EACjB;AACF;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;ACtGA,eAAsB,OAAO,SAAuC;AAClE,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,OAAO,UAAU,GAAG;AAC1B,QAAM,WAAW,MAAM,sBAAsB,KAAK,EAAE,eAAe,MAAM,CAAC;AAC1E,QAAM,EAAE,QAAQ,MAAM,IAAI;AAC1B,QAAM,WAAW,mBAAmB,MAAM;AAE1C,MAAI,IAAI,WAAW,IAAI,UAAU,EAAE;AACnC,MAAI,IAAI,WAAW,KAAK,OAAO,KAAK,KAAK,KAAK,GAAG;AACjD,MAAI,IAAI,WAAW,KAAK,KAAK,KAAK,IAAI,CAAC,EAAE;AACzC,MAAI,IAAI,WAAW,KAAK,SAAS,KAAK,IAAI,CAAC,EAAE;AAC7C,MAAI,IAAI,iBAAiB,KAAK,aAAa,SAAS,KAAK,aAAa,KAAK,IAAI,IAAI,MAAM,EAAE;AAC3F,MAAI,IAAI,WAAW,SAAS,GAAG,SAAS,MAAM,cAAc,MAAM,EAAE;AACpE,MAAI,IAAI,WAAW,QAAQ,GAAG,OAAO,KAAK,KAAK,EAAE,MAAM,gBAAgB,MAAM,EAAE;AAC/E,MAAI,IAAI,WAAW,IAAI,SAAS,SAAS,IAAI,IAAK,IAAI,IAAI,YAAY,mBAAoB,aAAa,EAAE;AACzG,MAAI,IAAI,SAAS,SAAS,UAAU,GAAG;AACrC,UAAM,WAAW,IAAI,KAClB,IAAI,CAAC,QAAQ;AACZ,YAAM,WAAW,sBAAsB,KAAK,GAAG;AAC/C,aAAO,GAAG,GAAG,IAAI,SAAS,iBAAiB,IAAI,SAAS,sBAAsB,MAAM;AAAA,IACtF,CAAC,EACA,KAAK,IAAI;AACZ,QAAI,IAAI,6BAA6B,QAAQ,GAAG;AAChD,UAAM,QAAQ,IAAI,KAAK,IAAI,CAAC,QAAQ,GAAG,GAAG,IAAI,uBAAuB,KAAK,GAAG,KAAK,MAAM,EAAE,EAAE,KAAK,IAAI;AACrG,QAAI,IAAI,kBAAkB,KAAK,EAAE;AAAA,EACnC,OAAO;AACL,QAAI,IAAI,uBAAuB;AAAA,EACjC;AAEA,gBAAc,KAAK,gBAAgB,SAAS,YAAY,CAAC;AAEzD,QAAM,WAAqB,CAAC;AAC5B,MAAI,UAAU,SAAS,WAAW,EAAG,UAAS,KAAK,wBAAwB;AAC3E,MAAI,OAAO;AACT,eAAW,MAAM,OAAO,KAAK,KAAK,GAAG;AACnC,UAAI,SAAS,SAAS,KAAK,CAAC,SAAS,SAAS,EAAE,EAAG,UAAS,KAAK,kBAAkB,EAAE,qCAAqC;AAAA,IAC5H;AAAA,EACF;AACA,WAAS,KAAK,GAAG,oBAAoB,SAAS,cAAc,QAAQ,KAAK,CAAC;AAC1E,MAAI,IAAI,SAAS,SAAS,IAAI,KAAK,CAAC,IAAI,IAAI,SAAU,UAAS,KAAK,kDAAkD;AACtH,MAAI,IAAI,MAAM,OAAO;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,KAAK,KAAK,GAAG;AACzD,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,IAAI,MAAM,MAAM,CAAC,CAAC,GAAG;AACtF,iBAAS,KAAK,cAAc,GAAG,6BAA6B,KAAK,EAAE;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,SAAS,SAAS,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC,QAAQ,IAAI,IAAI,GAAG,MAAM,GAAG;AAChF,aAAS,KAAK,GAAG,IAAI,GAAG,MAAM,uDAAuD;AAAA,EACvF;AACA,MAAI,IAAI,SAAS,SAAS,MAAM,GAAG;AAEjC,UAAM,cAAc,gBAAgB,IAAI,MAAM,eAAe;AAC7D,eAAW,OAAO,IAAI,MAAM;AAC1B,UAAI,CAAC,aAAa,KAAK,GAAG,GAAG,WAAW;AACtC,iBAAS,KAAK,4BAA4B,GAAG,kEAA6D;AAAA,MAC5G;AAAA,IACF;AACA,aAAS,KAAK,GAAG,oBAAoB,IAAI,OAAO,CAAC;AAAA,EACnD;AACA,MAAI,IAAI,SAAS,SAAS,UAAU,EAAG,UAAS,KAAK,GAAG,wBAAwB,IAAI,OAAO,CAAC;AAAA,WACnF,IAAI,SAAU,UAAS,KAAK,8DAA8D;AACnG,WAAS,KAAK,GAAG,UAAU,OAAO,UAAU,IAAI,IAAI,cAAc,CAAC,CAAC,CAAC;AACrE,WAAS,KAAK,GAAG,mBAAmB,IAAI,SAAS,QAAW;AAAA,IAC1D,IAAI,MAAM;AAAA,IACV,IAAI,MAAM;AAAA,IACV,IAAI,MAAM;AAAA,EACZ,CAAC,CAAC;AACF,WAAS,KAAK,GAAG,iBAAiB,IAAI,OAAO,CAAC;AAE9C,MAAI,SAAS,QAAQ;AACnB,QAAI,IAAI,EAAE;AACV,QAAI,IAAI,WAAW;AACnB,eAAW,WAAW,SAAU,KAAI,IAAI,OAAO,OAAO,EAAE;AAAA,EAC1D,OAAO;AACL,QAAI,IAAI,IAAI;AAAA,EACd;AACF;;;AC/GA,SAAS,cAAAC,aAAY,aAAAC,YAAW,iBAAAC,sBAAqB;AACrD,SAAS,WAAAC,UAAS,WAAAC,gBAAe;AAwC1B,SAAS,YAAY,SAA4B;AACtD,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,UAAUC,SAAQ,QAAQ,WAAW,QAAQ,IAAI,CAAC;AACxD,QAAM,aAAaA,SAAQ,SAAS,QAAQ,cAAc,iBAAiB;AAC3E,MAAIC,YAAW,UAAU,KAAK,CAAC,QAAQ,OAAO;AAC5C,UAAM,IAAI,MAAM,GAAG,UAAU,6CAA6C;AAAA,EAC5E;AACA,MAAI,CAAC,uBAAuB,KAAK,QAAQ,KAAK,GAAG;AAC/C,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAGA,QAAM,OAAO,QAAQ,MAAM,SAAS,QAAQ,OAAO,CAAC,KAAK;AACzD,QAAM,WAAW,QAAQ,UAAU,SAAS,QAAQ,WAAW,CAAC,MAAM,IAAI;AAC1E,MAAI,SAAS,SAAS,UAAU,KAAK,CAAC,SAAS,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,iCAAiC;AAChH,QAAM,aAAa,QAAQ,cAAc;AAEzC,EAAAC,WAAUC,SAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAClD,EAAAD,WAAUF,SAAQ,SAAS,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3D,EAAAE,WAAUF,SAAQ,SAAS,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AAExD,EAAAI,eAAc,YAAY,eAAe,EAAE,OAAO,QAAQ,OAAO,MAAM,QAAQ,MAAM,MAAM,UAAU,WAAW,CAAC,CAAC;AAClH,iBAAeJ,SAAQ,SAAS,qBAAqB,GAAG,eAAe,CAAC;AACxE,iBAAeA,SAAQ,SAAS,oBAAoB,GAAG,cAAc,CAAC;AACtE,kBAAgB,OAAO;AAEvB,MAAI,IAAI,WAAW,gBAAgB,YAAY,OAAO,CAAC,EAAE;AACzD,MAAI,IAAI,oDAAoD;AAC5D,MAAI,IAAI,+CAA+C;AACzD;AAEA,SAAS,eAAe,MAAc,MAAoB;AACxD,MAAIC,YAAW,IAAI,EAAG;AACtB,EAAAG,eAAc,MAAM,IAAI;AAC1B;AAEA,SAAS,eAAe,OAAwG;AAC9H,QAAM,WAAW,MAAM,SAAS,SAAS,UAAU,IAC/C;AAAA;AAAA;AAAA;AAAA;AAAA,+BAKyB,KAAK,UAAU,OAAO,YAAY,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,wBACtF,KAAK,UAAU,OAAO,YAAY,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;AAAA;AAAA;AAAA,IAI1F;AACJ,SAAO;AAAA;AAAA;AAAA;AAAA,WAIE,MAAM,KAAK;AAAA,aACT,MAAM,KAAK,QAAQ,MAAM,KAAK,CAAC;AAAA;AAAA,UAElC,KAAK,UAAU,MAAM,IAAI,CAAC;AAAA,cACtB,KAAK,UAAU,MAAM,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iDAWK,MAAM,UAAU;AAAA;AAAA;AAAA,eAGlD,cAAc,MAAM,UAAU,CAAC;AAAA;AAAA,EAE5C,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAUS,MAAM,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAc9B;AAEA,SAAS,iBAAyB;AAChC,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeT;AAEA,SAAS,gBAAwB;AAC/B,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUT;AAEA,SAAS,cAAc,UAA0B;AAC/C,MAAI,aAAa,SAAU,QAAO;AAClC,MAAI,aAAa,SAAU,QAAO;AAClC,SAAO;AACT;AAEA,SAAS,gBAAgB,MAAc,SAAyB;AAC9D,SAAO,KAAK,WAAW,OAAO,IAAI,KAAK,MAAM,QAAQ,SAAS,CAAC,IAAI;AACrE;;;AC5JA,IAAM,iBAAiB,oBAAI,IAAI,CAAC,QAAQ,YAAY,CAAC;AAOrD,eAAsB,YAAY,SAA4C;AAC5E,QAAM,gBAAgB,SAAS,IAAI;AACrC;AAGA,eAAsB,0BAA0B,SAA4C;AAC1F,QAAM,gBAAgB,SAAS,KAAK;AACtC;AAEA,eAAe,gBAAgB,SAA6B,WAAmC;AAC7F,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,MAAM,QAAQ;AAEpB,MAAI,CAAC,IAAI,KAAK,SAAS,GAAG,GAAG;AAC3B,UAAM,IAAI,MAAM,QAAQ,GAAG,4BAA4B,IAAI,KAAK,KAAK,IAAI,CAAC,GAAG;AAAA,EAC/E;AACA,MAAI,eAAe,IAAI,GAAG,KAAK,CAAC,QAAQ,KAAK;AAC3C,UAAM,IAAI,MAAM,iCAAiC,GAAG,iBAAiB;AAAA,EACvE;AAEA,QAAM,kBAAkB,YAAY,IAAI,MAAM,iBAAiB,IAAI,OAAO;AAC1E,QAAM,cAAc,gBAAgB,IAAI,MAAM,eAAe;AAC7D,MAAI,CAAC,YAAa,OAAM,IAAI,MAAM,qBAAqB,eAAe,uCAAkC;AACxG,MAAI,YAAY,UAAU,IAAI,IAAI,IAAI;AACpC,UAAM,IAAI,MAAM,kBAAkB,eAAe,aAAa,YAAY,KAAK,WAAW,IAAI,IAAI,EAAE,GAAG;AAAA,EACzG;AACA,QAAM,QAAQ,YAAY,KAAK,GAAG;AAClC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2BAA2B,GAAG,QAAQ,eAAe,uCAAkC;AAEnH,QAAM,UAAkD,CAAC;AACzD,MAAI,IAAI,SAAS,SAAS,MAAM,GAAG;AACjC,QAAI,CAAC,MAAM,UAAW,OAAM,IAAI,MAAM,0BAA0B,GAAG,QAAQ,eAAe,uCAAkC;AAC5H,YAAQ,KAAK,EAAE,MAAM,mBAAmB,OAAO,MAAM,UAAU,CAAC;AAAA,EAClE;AACA,MAAI,IAAI,SAAS,SAAS,IAAI,GAAG;AAC/B,QAAI,CAAC,MAAM,MAAO,OAAM,IAAI,MAAM,sBAAsB,GAAG,QAAQ,eAAe,uCAAkC;AACpH,YAAQ,KAAK,EAAE,MAAM,gBAAgB,OAAO,MAAM,MAAM,CAAC;AAAA,EAC3D;AACA,MAAI,QAAQ,WAAW,GAAG;AACxB,QAAI,IAAI,GAAG,GAAG,wCAAwC;AACtD;AAAA,EACF;AAIA,QAAM,cAAc,eAAe,IAAI,GAAG,IAAI,SAAY;AAC1D,QAAM,SAAS,cAAc,iBAAiB,WAAW,MAAM;AAE/D,MAAI,QAAQ,QAAQ;AAClB,yBAAqB,GAAG;AACxB,eAAW,KAAK,QAAS,KAAI,IAAI,uBAAuB,EAAE,IAAI,KAAK,cAAc,EAAE,KAAK,CAAC,QAAQ,MAAM,EAAE;AACzG;AAAA,EACF;AAEA,QAAM,MAAM,QAAQ,UAAU;AAC9B,MAAI,UAAW,OAAM,sBAAsB,KAAK,GAAG;AAEnD,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,MAAM,kBAAkB,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,KAAK,aAAa,KAAK,IAAI,QAAQ,CAAC;AAChH,QAAI,OAAO,SAAS,GAAG;AACrB,YAAM,IAAI,MAAM,uBAAuB,EAAE,IAAI,iBAAiB,OAAO,IAAI,MAAM,cAAc,GAAG,OAAO,UAAU,OAAO,MAAM,GAAG,KAAK,CAAC,CAAC,EAAE;AAAA,IAC5I;AACA,QAAI,IAAI,GAAG,EAAE,IAAI,cAAc,MAAM,qBAAqB,eAAe,iBAAiB;AAAA,EAC5F;AACF;AAGA,eAAsB,qBAAqB,SAAiD;AAC1F,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,MAAI,CAAC,IAAI,SAAS,KAAK,CAAC,YAAY,YAAY,QAAQ,YAAY,MAAM,EAAG;AAC7E,QAAM,sBAAsB,KAAK,QAAQ,UAAU,aAAa;AAClE;AAEA,eAAe,sBAAsB,KAA0B,KAAmC;AAChG,uBAAqB,GAAG;AACxB,MAAI,CAAE,MAAM,iBAAiB,KAAK,IAAI,OAAO,GAAI;AAC/C,UAAM,IAAI,MAAM,sFAAiF;AAAA,EACnG;AACF;AAEA,SAAS,qBAAqB,KAAgC;AAC5D,MAAI,CAAC,mBAAmB,IAAI,OAAO,GAAG;AACpC,UAAM,IAAI,MAAM,+BAA+B,IAAI,OAAO,oDAAoD;AAAA,EAChH;AACF;;;ACnHA,SAAS,iBAAiB;AAC1B,SAAS,mBAAmB;AAiC5B,IAAMC,kBAAiB,oBAAI,IAAI,CAAC,QAAQ,YAAY,CAAC;AAQrD,eAAsB,WAAW,SAA2C;AAC1E,QAAM,QAAQ,QAAQ,QAAQ,IAAI,KAAK;AACvC,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,4FAA4F;AACvH,MAAI,KAAK,WAAW,GAAG,GAAG;AACxB,UAAM,IAAI,MAAM,8GAA8G;AAAA,EAChI;AACA,QAAM,EAAE,KAAK,UAAU,OAAO,SAAS,IAAI,IAAI,MAAM,kBAAkB,OAAO;AAC9E,QAAM,QAAQ,MAAM,kBAAkB,KAAK,SAAS,SAAS,GAAG;AAChE,MAAI;AACF,UAAM,UAAU,EAAE,UAAU,IAAI,YAAY,OAAO,OAAO,QAAQ,GAAG,UAAU,MAAM,KAAK;AAAA,EAC5F,SAAS,KAAK;AACZ,UAAM,IAAI,MAAM,WAAW,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,KAAK,CAAC;AAAA,EACrF;AACA,MAAI,IAAI,GAAG,IAAI,kBAAkB,QAAQ,8EAA8E;AACzH;AAUA,eAAsB,mBAAmB,SAA2C;AAClF,QAAM,EAAE,KAAK,UAAU,OAAO,SAAS,IAAI,IAAI,MAAM,kBAAkB,OAAO;AAC9E,MAAI,CAAC,MAAM,WAAW,KAAK,EAAG,OAAM,IAAI,MAAM,6EAAmE;AACjH,MAAI,MAAM,WAAW,UAAU,KAAKA,gBAAe,IAAI,QAAQ,GAAG,GAAG;AACnE,UAAM,IAAI,MAAM,gDAAgD,QAAQ,GAAG,qDAAgD;AAAA,EAC7H;AACA,MAAI,MAAM,WAAW,UAAU,KAAK,CAACA,gBAAe,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK;AACpF,UAAM,IAAI,MAAM,gDAAgD,QAAQ,GAAG,gEAAgE;AAAA,EAC7I;AACA,QAAM,QAAQ,MAAM,kBAAkB,KAAK,SAAS,SAAS,GAAG;AAChE,QAAM,MAAM,MAAM,QAAQ,GAAG,IAAI,UAAU,eAAe,mBAAmB,QAAQ,CAAC,iBAAiB;AAAA,IACrG,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,KAAK,IAAI,gBAAgB,mBAAmB;AAAA,IAChF,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;AAAA,EAChC,CAAC;AACD,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,OAAO,YAAY,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE,GAAG,MAAM,GAAG,GAAG,GAAG,KAAK;AAC/E,UAAM,IAAI,MAAM,kCAAkC,IAAI,MAAM,MAAM,QAAQ,gBAAgB,EAAE;AAAA,EAC9F;AACA,MAAI,IAAI,+BAA+B,QAAQ,qEAAqE;AACtH;AAIA,SAAS,WAAW,MAAc,OAAuB;AACvD,SAAO,cAAc,IAAI,EAAE,MAAM,KAAK,EAAE,KAAK,kBAAkB;AACjE;AAaA,eAAe,kBAAkB,SAAiD;AAChF,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,MAAI,CAAC,IAAI,KAAK,SAAS,QAAQ,GAAG,GAAG;AACnC,UAAM,IAAI,MAAM,QAAQ,QAAQ,GAAG,4BAA4B,IAAI,KAAK,KAAK,IAAI,CAAC,GAAG;AAAA,EACvF;AACA,MAAIA,gBAAe,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK;AACnD,UAAM,IAAI,MAAM,mCAAmC,QAAQ,GAAG,iBAAiB;AAAA,EACjF;AACA,QAAM,QAAQ,MAAM,iBAAiB,SAAS,QAAQ;AACtD,SAAO,EAAE,KAAK,UAAU,YAAY,IAAI,IAAI,IAAI,QAAQ,GAAG,GAAG,OAAO,SAAS,IAAI;AACpF;;;ACrHA,SAAS,cAAAC,aAAY,WAAW,aAAAC,YAAW,gBAAAC,eAAc,aAAa,iBAAAC,sBAAqB;AAC3F,SAAS,eAAe;AACxB,SAAS,WAAAC,UAAS,cAAAC,aAAY,QAAAC,OAAM,YAAAC,WAAU,WAAAC,UAAS,WAAW;AAClE,SAAS,qBAAqB;;;ACFvB,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiC7B,IAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMzB,oBAAoB;AAAA;AAIf,SAAS,cAAc,OAAe,WAA2B;AACtE,QAAM,QAAQ,UAAU,MAAM,6BAA6B;AAC3D,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,iBAAiB,KAAK,0BAA0B;AAC5E,QAAM,QAAQ,MAAM,CAAC,EAAG,MAAM,OAAO;AACrC,QAAM,cAAwB,CAAC;AAC/B,MAAI,eAAe;AACnB,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,WAAW,OAAO,KAAK,KAAK,WAAW,cAAc,GAAG;AAC/D,kBAAY,KAAK,IAAI;AACrB,qBAAe,KAAK,WAAW,cAAc;AAAA,IAC/C,WAAW,gBAAgB,OAAO,KAAK,IAAI,GAAG;AAC5C,kBAAY,KAAK,IAAI;AAAA,IACvB,OAAO;AACL,qBAAe;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AAAA,EACP,YAAY,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,IAGpB,KAAK;AAAA;AAAA,iCAEwB,KAAK;AAAA;AAAA;AAAA;AAItC;;;AD/DO,IAAM,kBAAkB,CAAC,UAAU,SAAS,UAAU,WAAW,UAAU,QAAQ;AAmEnF,SAAS,aAAa,UAA+B,CAAC,GAAuB;AAClF,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,YAAY,QAAQ,aAAa,cAAc,IAAI,IAAI,aAAa,YAAY,GAAG,CAAC;AAC1F,QAAM,QAAQ,UAAU,SAAS;AACjC,MAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,8BAA8B,SAAS,EAAE;AAEjF,QAAM,YAAY,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI;AAC/E,QAAM,OAAOC,SAAQ,QAAQ,OAAO,QAAQ,IAAI,CAAC;AACjD,QAAM,OAAOA,SAAQ,QAAQ,WAAW,QAAQ,CAAC;AACjD,QAAM,QAAQ,oBAAI,IAAyB;AAC3C,QAAM,UAAU,oBAAI,IAA+B;AAEnD,QAAM,iBAAiB,CAAC,SAAuB,WAAyB;AACtE,UAAM,UAAU,QAAQ,IAAI,OAAO,KAAK,oBAAI,IAAY;AACxD,YAAQ,IAAI,MAAM;AAClB,YAAQ,IAAI,SAAS,OAAO;AAAA,EAC9B;AACA,QAAM,OAAO,CAAC,QAAgBC,UAAiB,eAAe,OAAO,WAAW,SAAe;AAC7F,UAAM,WAAW,MAAM,IAAI,MAAM;AACjC,QAAI,YAAY,SAAS,YAAYA,SAAS,OAAM,IAAI,MAAM,qCAAqC,MAAM,EAAE;AAC3G,UAAM,IAAI,QAAQ,EAAE,QAAQ,SAAAA,UAAS,UAAU,aAAa,CAAC;AAAA,EAC/D;AACA,QAAM,gBAAgB,CAACC,YAAmB,WAAW,SAAe;AAClE,eAAW,OAAO,MAAO,MAAKC,MAAKD,YAAW,GAAG,GAAGE,cAAaD,MAAK,WAAW,GAAG,GAAG,MAAM,GAAG,OAAO,QAAQ;AAAA,EACjH;AAEA,MAAI;AACJ,MAAI,QAAQ,QAAQ;AAClB,UAAM,aAAaA,MAAK,MAAM,WAAW,QAAQ;AACjD,UAAM,YAAYH,SAAQ,QAAQ,gBAAgB,QAAQ,IAAI,cAAcG,MAAK,MAAM,QAAQ,GAAG,QAAQ;AAC1G,gBAAY,UAAU,CAAC,MAAM,UAAU,YAAY;AACnD,eAAW,WAAW,WAAW;AAC/B,YAAM,YAAY,YAAY,WAAW,aAAa;AACtD,oBAAc,WAAW,YAAY,WAAW,OAAOE,SAAQA,SAAQ,SAAS,CAAC,CAAC;AAClF,qBAAe,SAAS,SAAS;AAAA,IACnC;AAAA,EACF,OAAO;AACL,UAAM,aAAaF,MAAK,MAAM,WAAW,QAAQ;AACjD,kBAAc,UAAU;AAExB,UAAM,aAAaA,MAAK,MAAM,WAAW,QAAQ;AACjD,gBAAY,UAAU,SAAS,QAAQ,IAAI,aAAa;AACxD,eAAW,WAAW,UAAW,gBAAe,SAAS,UAAU;AAEnE,QAAI,UAAU,SAAS,QAAQ,GAAG;AAChC,iBAAW,SAAS,WAAW,KAAK,GAAG;AACrC,cAAM,YAAYC,cAAaD,MAAK,WAAW,OAAO,UAAU,GAAG,MAAM;AACzE,aAAKA,MAAK,YAAY,OAAO,UAAU,GAAG,cAAc,OAAO,SAAS,CAAC;AAAA,MAC3E;AACA,qBAAe,UAAU,UAAU;AAAA,IACrC;AACA,QAAI,UAAU,SAAS,QAAQ,GAAG;AAChC,YAAM,aAAaA,MAAK,MAAM,WAAW,SAAS,UAAU;AAC5D,WAAK,YAAY,WAAW;AAC5B,qBAAe,UAAU,UAAU;AAAA,IACrC;AACA,QAAI,UAAU,SAAS,QAAQ,GAAG;AAChC,YAAM,aAAaA,MAAK,MAAM,WAAW;AACzC,WAAK,YAAY,mBAAmB,YAAY,sBAAsB,QAAQ,UAAU,MAAM,IAAI,GAAG,IAAI;AACzG,qBAAe,UAAU,UAAU;AAAA,IACrC;AACA,QAAI,UAAU,SAAS,SAAS,GAAG;AACjC,YAAM,cAAcA,MAAK,MAAM,WAAW,yBAAyB;AACnE,WAAK,aAAa,mBAAmB,aAAa,sBAAsB,QAAQ,UAAU,MAAM,IAAI,GAAG,IAAI;AAC3G,qBAAe,WAAW,WAAW;AAAA,IACvC;AACA,QAAI,UAAU,SAAS,QAAQ,GAAG;AAChC,YAAM,aAAaA,MAAK,MAAM,WAAW;AACzC,WAAK,YAAY,mBAAmB,YAAY,sBAAsB,QAAQ,UAAU,MAAM,IAAI,GAAG,IAAI;AACzG,qBAAe,UAAU,UAAU;AAAA,IACrC;AAAA,EACF;AAEA,QAAM,eAAe,oBAAI,IAAY;AACrC,QAAM,iBAAiB,oBAAI,IAAY;AACvC,QAAM,YAAsB,CAAC;AAC7B,aAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,UAAM,UAAU,mBAAmB,KAAK,UAAU,KAAK,MAAM;AAC7D,QAAI,SAAS;AACX,gBAAU,KAAK,GAAG,KAAK,MAAM,iCAAiC,OAAO,GAAG;AACxE;AAAA,IACF;AACA,QAAI,CAACG,YAAW,KAAK,MAAM,GAAG;AAC5B,mBAAa,IAAI,KAAK,MAAM;AAC5B;AAAA,IACF;AACA,UAAM,UAAUF,cAAa,KAAK,QAAQ,MAAM;AAChD,QAAI,YAAY,KAAK,SAAS;AAC5B,qBAAe,IAAI,KAAK,MAAM;AAAA,IAChC,WAAW,KAAK,gBAAgB,QAAQ,OAAO;AAC7C,mBAAa,IAAI,KAAK,MAAM;AAC5B,qBAAe,OAAO,KAAK,MAAM;AAAA,IACnC,OAAO;AACL,gBAAU,KAAK,KAAK,MAAM;AAAA,IAC5B;AAAA,EACF;AAEA,MAAI,UAAU,SAAS,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,EAAmG,UAAU,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,IAChJ;AAAA,EACF;AAEA,aAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,QAAI,CAACE,YAAW,KAAK,MAAM,KAAKF,cAAa,KAAK,QAAQ,MAAM,MAAM,KAAK,SAAS;AAClF,MAAAG,WAAUF,SAAQ,KAAK,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AACnD,MAAAG,eAAc,KAAK,QAAQ,KAAK,OAAO;AAAA,IACzC;AAAA,EACF;AAEA,QAAM,SAAS,WAAW,KAAK;AAC/B,QAAM,gBAAgB,UAAU,IAAI,CAAC,aAAa,EAAE,SAAS,SAAS,CAAC,GAAI,QAAQ,IAAI,OAAO,KAAK,CAAC,CAAE,EAAE,EAAE;AAC1G,MAAI,IAAI,oBAAoB,UAAU,KAAK,IAAI,CAAC,EAAE;AAClD,MAAI,IAAI,mBAAmB,OAAO,KAAK,IAAI,CAAC,EAAE;AAC9C,aAAW,gBAAgB,cAAe,KAAI,IAAI,GAAG,aAAa,OAAO,KAAK,aAAa,QAAQ,KAAK,IAAI,CAAC,EAAE;AAC/G,MAAI,IAAI,aAAa,aAAa,IAAI,mBAAmB,eAAe,OAAO,KAAK,eAAe,IAAI,gBAAgB,EAAE,EAAE;AAC3H,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW,WAAW,YAAY;AAAA,IAC3C,WAAW,WAAW,WAAW,cAAc;AAAA,IAC/C,cAAc,CAAC,GAAG,YAAY,EAAE,KAAK;AAAA,IACrC,gBAAgB,CAAC,GAAG,cAAc,EAAE,KAAK;AAAA,IACzC,WAAW;AAAA,EACb;AACF;AAEA,SAAS,WAAW,MAAc,OAA8B;AAC9D,SAAO,CAAC,GAAG,KAAK,EACb,IAAI,CAAC,SAASC,UAAS,MAAM,IAAI,CAAC,EAClC,OAAO,CAAC,SAAS,SAAS,QAAQ,CAAC,KAAK,WAAW,KAAK,GAAG,EAAE,KAAK,CAACC,YAAW,IAAI,CAAC,EACnF,KAAK;AACV;AAEA,SAAS,mBAAmB,QAA4C,QAAiC;AACvG,QAAM,YAAsB,QAAQ,SAAS,SAAS,CAAC,QAAQ;AAC/D,QAAM,UAAU,oBAAI,IAAY,CAAC,GAAG,iBAAiB,KAAK,CAAC;AAC3D,aAAW,WAAW,WAAW;AAC/B,QAAI,CAAC,QAAQ,IAAI,OAAO,GAAG;AACzB,YAAM,IAAI,MAAM,0BAA0B,OAAO,kBAAkB,gBAAgB,KAAK,IAAI,CAAC,EAAE;AAAA,IACjG;AAAA,EACF;AACA,QAAM,WAA2B,UAAU,SAAS,KAAK,IACrD,SAAS,CAAC,UAAU,OAAO,IAAI,CAAC,GAAG,eAAe,IAClD,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;AAC1B,MAAI,QAAQ;AACV,UAAM,cAAc,SAAS,OAAO,CAAC,YAAY,YAAY,YAAY,YAAY,OAAO;AAC5F,QAAI,YAAY,QAAQ;AACtB,YAAM,IAAI,MAAM,4CAA4C,YAAY,KAAK,IAAI,CAAC,kCAAkC;AAAA,IACtH;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,MAAc,OAAe,OAAgB,UAA0B;AACjG,QAAM,UAAU,mBAAmB,UAAU,IAAI;AACjD,MAAI,QAAS,OAAM,IAAI,MAAM,sBAAsB,IAAI,6BAA6B,OAAO,EAAE;AAC7F,MAAI,CAACJ,YAAW,IAAI,EAAG,QAAO,GAAG,KAAK;AAAA;AACtC,QAAM,UAAUF,cAAa,MAAM,MAAM;AACzC,QAAM,QAAQ;AACd,QAAM,MAAM;AACZ,QAAM,UAAU,QAAQ,QAAQ,KAAK;AACrC,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAK,YAAY,QAAS,UAAU,OAAQ,YAAY,MAAM,QAAQ,SAAU;AAC9E,UAAM,IAAI,MAAM,qCAAqC,IAAI,EAAE;AAAA,EAC7D;AACA,MAAI,YAAY,IAAI;AAClB,UAAM,YAAY,QAAQ,WAAW,KAAK,QAAQ,SAAS,MAAM,IAAI,KAAK,QAAQ,SAAS,IAAI,IAAI,OAAO;AAC1G,WAAO,GAAG,OAAO,GAAG,SAAS,GAAG,KAAK;AAAA;AAAA,EACvC;AACA,QAAM,WAAW,QAAQ,IAAI;AAC7B,QAAM,WAAW,QAAQ,MAAM,SAAS,QAAQ;AAChD,MAAI,aAAa,SAAS,CAAC,OAAO;AAChC,UAAM,IAAI,MAAM,4CAA4C,IAAI,+CAA+C;AAAA,EACjH;AACA,SAAO,GAAG,QAAQ,MAAM,GAAG,OAAO,CAAC,GAAG,KAAK,GAAG,QAAQ,MAAM,QAAQ,CAAC;AACvE;AAEA,SAAS,mBAAmB,UAAkB,QAAoC;AAChF,QAAM,MAAMK,UAAS,UAAU,MAAM;AACrC,MAAI,QAAQ,QAAQ,IAAI,WAAW,KAAK,GAAG,EAAE,KAAKC,YAAW,GAAG,GAAG;AACjE,UAAM,IAAI,MAAM,gDAAgD,MAAM,EAAE;AAAA,EAC1E;AACA,MAAI,UAAU;AACd,aAAW,QAAQ,IAAI,MAAM,GAAG,EAAE,OAAO,OAAO,GAAG;AACjD,cAAUP,MAAK,SAAS,IAAI;AAC5B,QAAI;AACF,UAAI,UAAU,OAAO,EAAE,eAAe,EAAG,QAAO;AAAA,IAClD,SAAS,OAAO;AACd,UAAK,MAAgC,SAAS,SAAU,OAAM;AAAA,IAChE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAA2B;AAC7C,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,OAAO,CAAC,SAAS,sBAAsB,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,MAAM,OAAO,EAAE,CAAC,CAAE,CAAC,CAAC,EAAE,KAAK;AAC5H;AAEA,SAAS,UAAU,KAAuB;AACxC,MAAI,CAACG,YAAW,GAAG,EAAG,QAAO,CAAC;AAC9B,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,CAAC,YAA0B;AACtC,eAAW,SAAS,YAAY,SAAS,EAAE,eAAe,KAAK,CAAC,GAAG;AACjE,YAAM,OAAOH,MAAK,SAAS,MAAM,IAAI;AACrC,UAAI,MAAM,YAAY,EAAG,MAAK,IAAI;AAAA,UAC7B,SAAQ,KAAKM,UAAS,KAAK,IAAI,CAAC;AAAA,IACvC;AAAA,EACF;AACA,OAAK,GAAG;AACR,SAAO,QAAQ,KAAK;AACtB;;;AE5PA,eAAsB,MAAM,SAAsC;AAChE,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,MAAM,QAAQ,QAAQ,IAAI,KAAK,SAAS,KAAK,IAAI,QAAS,IAAI,KAAK,CAAC,KAAK;AAC/E,MAAI,CAAC,IAAI,KAAK,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,QAAQ,GAAG,wBAAwB,YAAY,IAAI,YAAY,IAAI,OAAO,CAAC,EAAE;AAE1H,QAAM,cAAc,gBAAgB,IAAI,MAAM,eAAe;AAC7D,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,8BAA8B,YAAY,IAAI,MAAM,iBAAiB,IAAI,OAAO,CAAC,6CAA6C;AAAA,EAChJ;AACA,MAAI,YAAY,UAAU,IAAI,IAAI,IAAI;AACpC,UAAM,IAAI,MAAM,kCAAkC,YAAY,KAAK,yBAAyB,IAAI,IAAI,EAAE,GAAG;AAAA,EAC3G;AAEA,QAAM,QAAQ,YAAY,KAAK,GAAG;AAClC,MAAI,CAAC,OAAO,UAAU;AACpB,UAAM,IAAI,MAAM,6CAA6C,GAAG,8CAA8C;AAAA,EAChH;AACA,QAAM,QAAQ,IAAI,SAAS,SAAS,IAAI;AACxC,QAAM,UAAU,IAAI,SAAS,SAAS,MAAM;AAC5C,MAAI,SAAS,CAAC,MAAM,OAAO;AACzB,UAAM,IAAI,MAAM,6CAA6C,GAAG,8CAA8C;AAAA,EAChH;AACA,MAAI,WAAW,CAAC,MAAM,WAAW;AAC/B,UAAM,IAAI,MAAM,iDAAiD,GAAG,8CAA8C;AAAA,EACpH;AAEA,QAAM,UAAU,QAAQ,SAAS;AACjC,MAAI,IAAI,UAAU,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE;AACrC,MAAI,IAAI,aAAa,MAAM,QAAQ,EAAE;AAErC,QAAM,eAAe,MAAM,QAAQ,SAAS,gBAAgB,IAAI,aAAa,IAAI,IAAI,IAAI,GAAG,GAAG,MAAS;AACxG,MAAI,IAAI,qBAAqB;AAE7B,MAAI,IAAI,IAAI,UAAU;AACpB,UAAM,WAAa,aAAwD,IAAI,YAAY;AAC3F,QAAI,aAAa,IAAI,GAAG,UAAU;AAChC,YAAM,IAAI,MAAM,mCAAmC,IAAI,GAAG,QAAQ,yBAAyB,YAAY,MAAM,GAAG;AAAA,IAClH;AACA,QAAI,IAAI,SAAS,QAAQ,EAAE;AAAA,EAC7B;AACA,MAAI,QAAS,KAAI,IAAI,6BAA6B;AAElD,MAAI,IAAI,SAAS,SAAS,UAAU,GAAG;AACrC,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,QACE,YAAY,IAAI;AAAA,QAChB,OAAO,QAAQ;AAAA,QACf,OAAO,QAAQ;AAAA,QACf,MAAM,QAAQ;AAAA,QACd,iBAAiB,QAAQ;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,SAAS,MAAM,mBAAmB,EAAE,UAAU,IAAI,aAAa,OAAO,IAAI,IAAI,IAAI,KAAK,OAAO,OAAO,QAAQ,CAAC;AACpH,0BAAsB,QAAQ,sBAAsB,KAAK,GAAG,CAAC;AAC7D,QAAI,IAAI,eAAe,OAAO,MAAM,8BAAyB,OAAO,qBAAqB,SAAS,GAAG;AAAA,EACvG;AAEA,QAAM,WAAW,MAAM,sBAAsB,GAAG;AAChD,MAAI,OAAO;AACT,UAAM,iBAAiB,SAAS;AAChC,UAAM,mBAAmB,mBAAmB,cAAc;AAC1D,UAAM,oBAAoB,MAAM,QAAQ,SAAS,GAAG,IAAI,UAAU,QAAQ,mBAAmB,MAAM,QAAQ,CAAC,WAAW,MAAM,KAAK;AAClI,UAAM,aAAc,kBAA2C,UAAU;AACzE,UAAM,eAAe,mBAAmB,UAAU;AAClD,QAAI,iBAAiB,QAAQ;AAC3B,YAAM,UAAU,iBAAiB,OAAO,CAAC,WAAW,CAAC,aAAa,SAAS,MAAM,CAAC;AAClF,UAAI,QAAQ,OAAQ,OAAM,IAAI,MAAM,6CAA6C,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,IACvG;AACA,QAAI,IAAI,aAAa,aAAa,MAAM,WAAW;AAEnD,UAAM,kBAAkB,iBAAiB,CAAC,KAAK,aAAa,CAAC;AAC7D,QAAI,iBAAiB;AACnB,YAAM,YAAY,MAAM,SAAS,SAAS,GAAG,IAAI,UAAU,QAAQ,mBAAmB,MAAM,QAAQ,CAAC,cAAc,MAAM,OAAQ;AAAA,QAC/H,IAAI;AAAA,QACJ,WAAW,EAAE,OAAO,KAAK;AAAA,MAC3B,CAAC;AACD,YAAM,QAAS,UAAkD,WAAW;AAC5E,UAAI,IAAI,gBAAgB,eAAe,UAAU,OAAO,SAAS,IAAI,CAAC,EAAE;AAAA,IAC1E,OAAO;AACL,UAAI,IAAI,+CAA+C;AAAA,IACzD;AAAA,EACF,OAAO;AACL,QAAI,IAAI,6BAA6B;AAAA,EACvC;AACA,QAAM,SAAS,SAAS,aAAa;AAAA,IAAQ,CAAC,iBAC3C,YAAY,UAAU,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,YAAY,IAAI,MAAM,EAAE;AAAA,EACpF;AACA,MAAI,OAAO,QAAQ;AACjB,UAAM,OAAO,IAAI,QAAQ,GAAG;AAC5B,QAAI,CAAC,KAAM,OAAM,IAAI,MAAM,0CAA0C,GAAG,qBAAqB;AAC7F,eAAW,EAAE,aAAa,MAAM,KAAK,QAAQ;AAC3C,YAAM,WAAW,IAAI,IAAI,MAAM,MAAM,IAAI,EAAE,SAAS;AACpD,YAAM,MAAM,MAAM,QAAQ,UAAU,EAAE,UAAU,SAAS,CAAC;AAC1D,UAAI,IAAI,WAAW,MAAM,gBAAgB;AACvC,cAAM,IAAI,MAAM,gBAAgB,WAAW,WAAW,MAAM,IAAI,aAAa,IAAI,MAAM,cAAc,MAAM,cAAc,EAAE;AAAA,MAC7H;AACA,UAAI,IAAI,iBAAiB,WAAW,KAAK,MAAM,IAAI,WAAM,IAAI,MAAM,EAAE;AAAA,IACvE;AAAA,EACF;AAGA,MAAI,IAAI,IAAI;AACd;AAEA,SAAS,sBACP,QACA,UACM;AACN,MAAI,CAAC,OAAO,WAAW,OAAO,aAAa,SAAU,OAAM,IAAI,MAAM,kDAAkD;AACvH,MAAI,OAAO,WAAW,WAAW;AAC/B,UAAM,IAAI,MAAM,0BAA0B,OAAO,MAAM,GAAG,OAAO,OAAO,UAAU,KAAK,OAAO,MAAM,OAAO,KAAK,EAAE,EAAE;AAAA,EACtH;AACA,MAAI,CAAC,OAAO,SAAU,OAAM,IAAI,MAAM,4FAA4F;AAClI,QAAM,iBAAiB,OAAO,cAAc,KAAK,CAAC,UAAU,UAAU,4BAA4B;AAClG,MAAI,CAAC,eAAgB,OAAM,IAAI,MAAM,wDAAwD;AAC7F,QAAM,UAAU,SAAS,sBAAsB,OAAO,CAAC,OAAO,CAAC,OAAO,UAAU,SAAS,EAAE,CAAC;AAC5F,MAAI,QAAQ,OAAQ,OAAM,IAAI,MAAM,wDAAwD,QAAQ,KAAK,IAAI,CAAC,EAAE;AAClH;AAEA,eAAe,QAAQ,SAAoB,KAAa,QAA8C;AACpG,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,SAAS,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG,IAAI;AAAA,EAC5D,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,QAAQ,aAAa,IAAI,MAAM,KAAK,MAAME,UAAS,GAAG,CAAC,EAAE;AACtG,SAAO,IAAI,KAAK;AAClB;AAEA,eAAe,SAAS,SAAoB,KAAa,QAAgB,MAAiC;AACxG,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,MAAM,IAAI,gBAAgB,mBAAmB;AAAA,IACjF,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,QAAQ,aAAa,IAAI,MAAM,KAAK,MAAMA,UAAS,GAAG,CAAC,EAAE;AACtG,SAAO,IAAI,KAAK;AAClB;AAEA,SAAS,gBAAgB,aAAqB,OAAe,KAAqB;AAChF,QAAM,MAAM,IAAI,IAAI,kBAAkB,mBAAmB,KAAK,CAAC,kBAAkB,WAAW;AAC5F,MAAI,aAAa,IAAI,OAAO,GAAG;AAC/B,SAAO,IAAI,SAAS;AACtB;AAEA,eAAeA,UAAS,KAAgC;AACtD,MAAI;AACF,WAAO,eAAe,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,GAAG,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACzLA,SAAS,gBAAgB;AACzB,SAAS,iBAAiB;;;ACM1B,eAAsB,0BACpB,SACA,MACA,MACA,QACY;AACZ,QAAM,WAAW,iBAAiB,QAAQ,QAAQ;AAClD,QAAM,QAAQ,yBAAyB,QAAQ,KAAK;AACpD,QAAM,cAAc;AAAA,IAClB,GAAG;AAAA,IACH,UAAU;AAAA,IACV,aAAa;AAAA,IACb,OAAO;AAAA,IACP,QAAQ,QAAQ;AAAA,IAChB,SAAS;AAAA,MACP,eAAe,UAAU,KAAK;AAAA,MAC9B,gBAAgB;AAAA,MAChB,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AACA,QAAMC,YAAW,OAAO,QAAQ,SAAS,OAAO,IAAI,IAAI,MAAM,QAAQ,GAAG,WAAW;AACpF,QAAM,OAAO,MAAMA,UAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAGnD,MAAI,CAACA,UAAS,IAAI;AAChB,UAAM,OAAO,mBAAmB,KAAK,OAAO,MAAM,cAAc,GAAG;AACnE,UAAMC,WAAU,mBAAmB,KAAK,OAAO,SAAS,iBAAiB,GAAG;AAC5E,UAAM,IAAI,MAAM,GAAG,MAAM,YAAYD,UAAS,MAAM,IAAI,OAAO,IAAI,IAAI,KAAK,EAAE,GAAGC,WAAU,KAAKA,QAAO,KAAK,EAAE,EAAE;AAAA,EAClH;AACA,SAAO;AACT;AAEO,SAAS,iBAAiB,OAAe,MAAsB;AACpE,QAAM,SAAS,mBAAmB,OAAO,MAAM,GAAG;AAClD,MAAI,CAAC,UAAU,CAAC,gCAAgC,KAAK,MAAM,GAAG;AAC5D,UAAM,IAAI,MAAM,GAAG,IAAI,aAAa;AAAA,EACtC;AACA,SAAO;AACT;AAEO,SAAS,sBAAsB,OAAgB,MAAsB;AAC1E,MAAI,CAAC,OAAO,cAAc,KAAK,KAAM,QAAmB,GAAG;AACzD,UAAM,IAAI,MAAM,GAAG,IAAI,aAAa;AAAA,EACtC;AACA,SAAO;AACT;AAEO,SAAS,mBACd,OACA,MACA,WACoB;AACpB,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI,QAAO;AAClE,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,aAAa,wBAAwB,KAAK,KAAK,GAAG;AAChG,UAAM,IAAI,MAAM,GAAG,IAAI,aAAa;AAAA,EACtC;AACA,SAAO;AACT;AAEO,SAAS,qBAAqB,OAAuB;AAC1D,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK;AACnD,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAM,QAAQ,MAAM,CAAC,KAAK;AAC1B,QAAM,QAAQ,MAAM,CAAC,KAAK,IAAI,QAAQ,WAAW,EAAE;AACnD,MAAI,MAAM,WAAW,KAChB,CAAC,kDAAkD,KAAK,KAAK,KAC7D,CAAC,0BAA0B,KAAK,IAAI,KACpC,SAAS,OAAO,SAAS,MAAM;AAClC,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,SAAO,GAAG,KAAK,IAAI,IAAI;AACzB;AAEO,SAAS,wBAAwB,OAAuB;AAC7D,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,KAAK;AAAA,EACrB,QAAQ;AACN,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,MAAI,IAAI,aAAa,YAAY,IAAI,aAAa,gBAAgB,IAAI,YAAY,IAAI,UAAU;AAC9F,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,SAAO,IAAI,SAAS;AACtB;AAEO,SAAS,mBAAmB,QAAQ,KAAe;AACxD,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,OAAO,QAAQ,KAAQ;AACjE,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AACA,SAAO;AACT;AAEO,SAAS,kBAAkB,QAAQ,KAAK,KAAgB;AAC7D,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,OAAS,QAAQ,KAAK,KAAQ;AACxE,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AACA,SAAO;AACT;AAEA,eAAsB,kBACpB,cACA,QACe;AACf,MAAI,QAAQ,QAAS,OAAM,OAAO,UAAU,IAAI,aAAa,WAAW,YAAY;AACpF,QAAM,IAAI,QAAc,CAACC,WAAS,WAAW;AAC3C,UAAM,QAAQ,WAAWA,WAAS,YAAY;AAC9C,YAAQ,iBAAiB,SAAS,MAAM;AACtC,mBAAa,KAAK;AAClB,aAAO,OAAO,UAAU,IAAI,aAAa,WAAW,YAAY,CAAC;AAAA,IACnE,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,EACnB,CAAC;AACH;AAEO,SAAS,0BACd,OACA,KACS;AACT,MAAI,CAAC,SAAS,MAAM,QAAQ,OAAO,CAAC,wBAAwB,KAAK,MAAM,UAAU,KAC5E,MAAM,oBAAoB,qCAC1B,MAAM,qBAAqB,oCAC3B,MAAM,sBAAsB,sDAC5B,OAAO,MAAM,iBAAiB,YAAY,MAAM,aAAa,SAAS,KAAK,MAAM,aAAa,SAAS,OACvG,OAAO,MAAM,UAAU,aACvB,OAAO,MAAM,gBAAgB,aAAa,MAAM,qBAAqB,cACrE,MAAM,oBAAoB,SAAS,CAAC,OAAO,cAAc,MAAM,mBAAmB,KAClF,MAAM,sBAAsB,EAAG,QAAO;AAC3C,QAAM,aAAa,CACjBC,QACA,YACG,CAAC,CAACA,UACFA,OAAM,YAAY,WAClB,OAAOA,OAAM,YAAY,aACzB,OAAOA,OAAM,oBAAoB,aACjC,OAAOA,OAAM,aAAa,YAAYA,OAAM,SAAS,SAAS,KAAKA,OAAM,SAAS,UAAU,OAC5F,OAAOA,OAAM,UAAU,YAAYA,OAAM,MAAM,SAAS,KAAKA,OAAM,MAAM,UAAU,OACnF,OAAO,cAAcA,OAAM,aAAa,KAAKA,OAAM,iBAAiB,KACpE,OAAO,cAAcA,OAAM,cAAc,KAAKA,OAAM,kBAAkB,KACtE,OAAO,cAAcA,OAAM,aAAa,KAAKA,OAAM,iBAAiB,KACpE,OAAO,cAAcA,OAAM,eAAe,KAAKA,OAAM,mBAAmB;AAC7E,SAAO,WAAW,MAAM,QAAQ,WAAW,oBAAoB,KAC1D,WAAW,MAAM,QAAQ,YAAY,qBAAqB;AACjE;AAEA,SAAS,yBAAyB,OAAuB;AACvD,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,SAAS,QAC/D,2BAA2B,KAAK,KAAK,GAAG;AAC3C,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO;AACT;;;ADxIA,eAAsB,4BACpB,SACiC;AACjC,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,aAAa,QAAQ,eAAe,SAAY,SAAY,qBAAqB,QAAQ,UAAU;AACzG,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,iBAAiB,QAAQ,OAAO,OAAO;AAAA,QAC9C,KAAK,iBAAiB,QAAQ,KAAK,KAAK;AAAA,QACxC,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,MACnD,CAAC;AAAA,IACH;AAAA,IACA;AAAA,EACF;AACA,QAAM,eAAe,KAAK,MAAM,SAAS,aAAa,EAAE;AACxD,MAAI,CAAC,SAAS,aAAa,CAAC,QAAQ,cAAc,CAAC,OAAO,SAAS,YAAY,GAAG;AAChF,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,QAAM,aAAa,wBAAwB,QAAQ,UAAU;AAC7D,MAAI,IAAI,oBAAoB,UAAU,EAAE;AACxC,MAAI,QAAQ,SAAS,OAAO;AAC1B,WAAO,QAAQ,kBAAkB,SAAS,UAAU;AACpD,QAAI,IAAI,sDAAsD;AAAA,EAChE;AACA,QAAM,WAAW,mBAAmB,QAAQ,cAAc;AAC1D,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,WAAW,KAAK,IAAI,cAAc,IAAI,IAAI,kBAAkB,QAAQ,aAAa,CAAC;AACxF,QAAMC,QAAO,QAAQ,QAAQ;AAC7B,SAAO,MAAM;AACX,UAAMC,SAAQ,MAAM;AAAA,MAClB;AAAA,MACA,4BAA4B,mBAAmB,QAAQ,SAAS,CAAC;AAAA,MACjE,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAIA,OAAM,WAAW,WAAW;AAC9B,UAAIA,OAAM,WAAW,YAAa,QAAOA;AACzC,YAAM,IAAI,MAAM,qBAAqBA,OAAM,MAAM,GAAGA,OAAM,cAAc,KAAKA,OAAM,WAAW,KAAK,EAAE,EAAE;AAAA,IACzG;AACA,QAAI,IAAI,KAAK,SAAU,OAAM,IAAI,MAAM,sCAAsC;AAC7E,UAAMD,MAAK,KAAK,IAAI,UAAU,KAAK,IAAI,GAAG,WAAW,IAAI,CAAC,CAAC,GAAG,QAAQ,MAAM;AAAA,EAC9E;AACF;AAGA,eAAsB,0BACpB,SACiC;AACjC,QAAM,QAAQ,iBAAiB,QAAQ,OAAO,OAAO;AACrD,QAAM,MAAM,iBAAiB,QAAQ,KAAK,KAAK;AAC/C,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA,kBAAkB,mBAAmB,KAAK,CAAC,uBAAuB,mBAAmB,GAAG,CAAC;AAAA,IACzF,CAAC;AAAA,IACD;AAAA,EACF;AACA,SAAO,MAAM,QAAQ,KAAK,OAAO,IAAI,KAAK,UAAU,CAAC;AACvD;AAIA,eAAsB,+BACpB,SACe;AACf,QAAM,QAAQ,iBAAiB,QAAQ,OAAO,OAAO;AACrD,QAAM,WAAW,iBAAiB,QAAQ,UAAU,UAAU;AAC9D,QAAM;AAAA,IACJ;AAAA,IACA,kBAAkB,mBAAmB,KAAK,CAAC,mBAAmB,mBAAmB,QAAQ,CAAC;AAAA,IAC1F,EAAE,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AACF;AAIO,SAAS,wBAAwB,aAA6B;AACnE,QAAM,SAAS,YAAY,KAAK;AAChC,QAAM,MAAM,6CAA6C,KAAK,MAAM;AACpE,MAAI,IAAK,QAAO,qBAAqB,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,EAAG,QAAQ,UAAU,EAAE,CAAC,EAAE;AACjF,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,MAAM;AAAA,EACtB,QAAQ;AACN,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,MAAI,IAAI,aAAa,gBAAiB,IAAI,aAAa,YAAY,IAAI,aAAa,QAAS;AAC3F,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,MAAI,IAAI,YAAa,IAAI,aAAa,YAAY,IAAI,YAAa,IAAI,UAAU,IAAI,MAAM;AACzF,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,QAAM,QAAQ,IAAI,SAAS,QAAQ,cAAc,EAAE,EAAE,MAAM,GAAG;AAC9D,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,SAAO,qBAAqB,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,EAAG,QAAQ,UAAU,EAAE,CAAC,EAAE;AAC9E;AAGA,eAAsB,sBACpB,MAAM,QAAQ,IAAI,GAClB,aAA+C,mBAC9B;AACjB,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,WAAW,GAAG;AAAA,EAC/B,QAAQ;AACN,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,SAAO,wBAAwB,MAAM;AACvC;AAEA,eAAe,kBAAkB,KAA8B;AAC7D,QAAM,SAAS,MAAM,UAAU,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,UAAU,WAAW,QAAQ;AAAA,IAC9B,EAAE,KAAK,UAAU,OAAO;AAAA,EAC1B;AACA,SAAO,OAAO;AAChB;;;AEhJO,IAAM,gBAAgB;AAItB,IAAM,kBAAkB;AAUxB,IAAM,qBAA+C,OAAO,OAAO,CAAC;AAAA,EACzE,IAAI;AAAA,EACJ,OAAO;AAAA,EACP,SAAS;AAAA,IACP;AAAA;AAAA;AAAA,IAGA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,WAAW;AAAA,EACX,gBAAgB,OAAO;AAAA,EACvB,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,MAAM;AACR,CAAC,CAAC;;;ACrCF,SAAS,SAAAE,cAAa;AACtB,SAAS,kBAAkB;AAC3B,SAAS,UAAU,SAAS,UAAU,IAAI,iBAAiB;AAC3D,SAAS,cAAc;AACvB,SAAS,QAAAC,aAAY;AACrB,SAAS,iBAAAC,sBAAqB;AAkB9B,IAAM,sBAA8C,CAAC,SAAS,MAAM,UAAU,IAAI,QAAQ,CAAC,QAAQ,WAAW;AAC5G,QAAM,QAAQC,OAAM,SAAS,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,OAAO,MAAM,CAAC;AAC/D,QAAM,KAAK,SAAS,MAAM;AAC1B,QAAM,KAAK,QAAQ,CAAC,MAAM,WAAW;AACnC,QAAI,SAAS,EAAG,QAAO;AAAA,QAClB,QAAO,IAAI,MAAM,GAAG,OAAO,IAAI,KAAK,KAAK,GAAG,CAAC,WAAW,QAAQ,UAAU,kBAAkB,EAAE,CAAC;AAAA,EACtG,CAAC;AACH,CAAC;AAKD,eAAsB,kBACpB,QACA,QACA,MAA8B,qBAC9B,gBAAwC,sBACxC,eAAqC,qBACT;AAC5B,MAAI,WAAW,aAAa;AAC1B,QAAI;AAGF,YAAM,IAAI,QAAQ,CAAC,UAAU,OAAO,GAAG,SAAS;AAAA,IAClD,QAAQ;AACN,YAAM,IAAI,MAAM,qHAAqH;AAAA,IACvI;AAAA,EACF;AACA,QAAM,WAAqB,CAAC;AAC5B,aAAW,SAAS,QAAQ;AAC1B,UAAM,eAAe,UAAU,gBAAgB,MAAM,aAAa,IAAI;AACtE,UAAM,cAAc,CAAC,SAAS,WAAW,YAAY;AACrD,QAAI;AACF,YAAM,IAAI,QAAQ,aAAa,QAAQ;AACvC,eAAS,KAAK,YAAY;AAC1B;AAAA,IACF,QAAQ;AAAA,IAAgE;AACxE,QAAI,UAAU,eAAe;AAC3B,UAAI;AAAE,cAAM,cAAc,QAAQ,cAAc,GAAG;AAAA,MAAG,SAC/C,OAAO;AACZ,cAAM,SAAS,iBAAiB,SAAS,MAAM,UAAU,KAAK,MAAM,OAAO,KAAK;AAChF,cAAM,IAAI,MAAM,4CAA4C,MAAM,EAAE;AAAA,MACtE;AACA,eAAS,KAAK,YAAY;AAC1B;AAAA,IACF;AACA,UAAM,OAAO,WAAW,cAAc,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC,QAAQ,KAAK;AAC/E,QAAI;AAAE,YAAM,IAAI,QAAQ,MAAM,SAAS;AAAA,IAAG,SACnC,OAAO;AACZ,YAAM,SAAS,iBAAiB,SAAS,MAAM,UAAU,KAAK,MAAM,OAAO,KAAK;AAChF,YAAM,IAAI,MAAM,uCAAuC,KAAK,GAAG,MAAM,EAAE;AAAA,IACzE;AACA,aAAS,KAAK,KAAK;AAAA,EACrB;AACA,SAAO;AACT;AAEA,SAAS,sBAA8B;AACrC,SAAOC,eAAc,IAAI,IAAI,yBAAyB,YAAY,GAAG,CAAC;AACxE;AAEA,eAAe,sBAAuC;AACpD,QAAM,SAAS,MAAM,SAAS,oBAAoB,CAAC,EAAE,MAAM,MAAM;AAC/D,UAAM,IAAI,MAAM,+EAA+E;AAAA,EACjG,CAAC;AACD,SAAO,oCAAoC,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,CAAC;AAC9F;AAEA,eAAe,qBACb,QACA,OACA,KACe;AACf,QAAM,UAAU,MAAM,QAAQC,MAAK,OAAO,GAAG,eAAe,CAAC;AAC7D,MAAI;AACF,UAAM,SAAS,oBAAoB,GAAGA,MAAK,SAAS,aAAa,CAAC;AAClE,UAAM,UAAUA,MAAK,SAAS,YAAY,GAAG;AAAA,MAC3C,QAAQ,eAAe;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI,GAAG,EAAE,MAAM,IAAM,CAAC;AAC7B,UAAM,IAAI,QAAQ,CAAC,SAAS,SAAS,OAAO,OAAO,GAAG,SAAS;AAAA,EACjE,UAAE;AACA,UAAM,GAAG,SAAS,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD;AACF;;;AC9GA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,MAAM,UAAU,gBAAgB;AACzC,SAAS,WAAAC,gBAAe;;;ACCjB,IAAM,2BAA2B;;;ACKxC,IAAM,UAAU;AAGT,IAAM,uBAAN,cAAmC,MAAM;EAC5B,OAAO;AAC3B;AAEA,SAASC,QAAO,OAAgD;AAC9D,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACtE,QACA;AACN;AAEA,SAAS,YAAY,OAAgB,OAAe,KAAqB;AACvE,MAAI,OAAO,UAAU,YAAY,CAAC,SAAS,MAAM,SAAS,OAAO,QAAQ,KAAK,KAAK,GAAG;AACpF,UAAM,IAAI,qBAAqB,GAAG,KAAK,0CAA0C,GAAG,aAAa;EACnG;AACA,SAAO;AACT;AAGO,SAAS,iBAAiB,MAAkC;AACjE,MAAI,OAAO,WAAW,MAAM,MAAM,IAAI,IAAW,OAAM,IAAI,qBAAqB,4BAA4B;AAC5G,MAAI;AACJ,MAAI;AAAE,YAAQ,KAAK,MAAM,IAAI;EAAG,QAAQ;AAAE,UAAM,IAAI,qBAAqB,4BAA4B;EAAG;AACxG,QAAMC,WAAUD,QAAO,KAAK;AAC5B,MAAI,CAACC,YAAWA,SAAQ,oBAAoB,0BAA0B;AACpE,UAAM,IAAI,qBAAqB,iCAAiC,wBAAwB,EAAE;EAC5F;AACA,MAAIA,SAAQ,SAAS,SAAS;AAC5B,WAAO;MACL,iBAAiB;MACjB,MAAM;MACN,MAAM,YAAYA,SAAQ,MAAM,cAAc,GAAG;MACjD,GAAIA,SAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAASA,SAAQ,QAAQ;IACtE;EACF;AACA,MAAIA,SAAQ,SAAS,qBAAqB;AACxC,UAAMC,QAAOF,QAAOC,SAAQ,IAAI;AAChC,QAAI,CAACC,SAAQ,CAAC,MAAM,QAAQA,MAAK,QAAQ,KAAK,CAAC,OAAO,cAAcA,MAAK,SAAS,GAAG;AACnF,YAAM,IAAI,qBAAqB,wDAAwD;IACzF;AACA,WAAO;MACL,iBAAiB;MACjB,MAAM;MACN,WAAW,YAAYD,SAAQ,WAAW,aAAa,GAAG;MAC1D,MAAAC;IACF;EACF;AACA,MAAID,SAAQ,SAAS,gBAAgB;AACnC,UAAM,QAAQD,QAAOC,SAAQ,KAAK;AAClC,UAAM,OAAO,OAAOA,SAAQ,IAAI;AAChC,QAAI,CAAC,SAAS,CAAC,CAAC,gBAAgB,uBAAuB,oBAAoB,EAAE,SAAS,IAAI,GAAG;AAC3F,YAAM,IAAI,qBAAqB,0DAA0D;IAC3F;AACA,WAAO;MACL,iBAAiB;MACjB,MAAM;MACN,WAAW,YAAYA,SAAQ,WAAW,aAAa,GAAG;MAC1D;MACA;IACF;EACF;AACA,MAAIA,SAAQ,SAAS,oBAAoB;AACvC,QAAI,EAAC,oBAAI,IAAI,CAAC,aAAa,UAAU,WAAW,CAAC,GAAE,IAAI,OAAOA,SAAQ,MAAM,CAAC,GAAG;AAC9E,YAAM,IAAI,qBAAqB,oCAAoC;IACrE;AACA,WAAO;MACL,iBAAiB;MACjB,MAAM;MACN,QAAQA,SAAQ;MAChB,GAAIA,SAAQ,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQA,SAAQ,OAAO;IACnE;EACF;AACA,QAAM,IAAI,qBAAqB,mCAAmC;AACpE;AAGO,SAAS,iBAAiBA,UAAoC;AACnE,SAAO,GAAG,KAAK,UAAUA,QAAO,CAAC;;AACnC;;;ACxFA,SAAS,YAAAE,WAAU,SAAAC,cAAa;AAChC,SAAS,iBAAiB;AAC1B,SAAS,cAAc;AACvB,SAAS,WAAW,QAAAC,aAAY;AAChC,SAAS,QAAQ,cAAc;ACJ/B,SAAS,OAAO,WAAAC,UAAS,UAAU,MAAAC,KAAI,aAAAC,kBAAiB;AACxD,SAAS,UAAAC,eAAc;AACvB,SAAS,QAAAJ,QAAM,WAAAK,UAAS,OAAAC,YAAW;AACnC,SAAS,SAAAP,eAAa;ACHtB,SAAS,cAAAQ,mBAAkB;ACA3B,SAAS,OAAO,YAAAC,WAAU,OAAO,SAAAC,QAAO,WAAAR,WAAS,SAAS,YAAAS,WAAU,MAAAR,MAAI,YAAY;AACpF,SAAS,UAAAE,gBAAc;AACvB,SAAS,UAAU,QAAAJ,QAAM,YAAAW,WAAU,WAAAN,WAAS,OAAAC,aAAW;AACvD,SAAS,SAAAP,eAAa;AHUtB,IAAM,eAAe;AAoDd,SAAS,kBAAkB,OAAqB;AACrD,MAAI,CAAC,aAAa,KAAK,KAAK,EAAG,OAAM,IAAI,UAAU,iDAAiD;AACtG;AAEA,eAAe,iBAAiB,QAA2C;AACzE,aAAW,cAAc,QAAQ,IAAI,QAAQ,IAAI,MAAM,SAAS,EAAE,OAAO,OAAO,GAAG;AACjF,QAAI;AAAE,YAAM,OAAOC,MAAK,WAAW,MAAM,GAAG,UAAU,IAAI;AAAG,aAAO;IAAM,QAAQ;IAAgC;EACpH;AACA,SAAO;AACT;AAKA,eAAsB,sBACpB,YAAsC,QACtC,UAA2C,CAAC,GAClB;AAC1B,QAAM,WAAW,QAAQ,YAAY,QAAQ;AAC7C,QAAM,OAAO,QAAQ,QAAQ,QAAQ;AACrC,QAAM,MAAM,QAAQ,QAAQ,OAAO,WAAW,aAAa,OAAO,IAAI;AACtE,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAMY,YAAW,OAAO,WAAsD;AAC5E,QAAI,WAAW,gBAAgB,aAAa,YAAY,SAAS,UAAU;AACzE,YAAM,IAAI,UAAU,8CAA8C;IACpE;AACA,QAAI,WAAW,YAAY,aAAa,WAAW,QAAQ,GAAG;AAC5D,YAAM,IAAI,UAAU,2EAA2E;IACjG;AACA,QAAI,CAAE,MAAM,UAAU,MAAM,EAAI,OAAM,IAAI,UAAU,GAAG,MAAM,iCAAiC;AAC9F,WAAO;EACT;AACA,MAAI,cAAc,OAAQ,QAAOA,UAAS,SAAS;AACnD,QAAM,aAAgC,aAAa,WAC/C,SAAS,UAAU,CAAC,aAAa,QAAQ,IAAI,CAAC,QAAQ,IACtD,aAAa,UAAU,CAAC,QAAQ,IAAI,CAAC;AACzC,aAAW,UAAU,YAAY;AAC/B,QAAI,MAAM,UAAU,MAAM,EAAG,QAAOA,UAAS,MAAM;EACrD;AACA,MAAI,aAAa,SAAS;AACxB,UAAM,IAAI,UAAU,mHAAmH;EACzI;AACA,MAAI,aAAa,UAAU;AACzB,UAAM,IAAI,UAAU,uIAAuI;EAC7J;AACA,QAAM,IAAI,UAAU,qCAAqC;AAC3D;AAEA,SAAS,wBAA0C;AACjD,SAAO,IAAI,QAAQ,CAACP,WAAS,WAAW;AACtC,IAAAP;MACE;MACA,CAAC,QAAQ,YAAY,6BAA6B;MAClD,EAAE,UAAU,QAAQ,WAAW,KAAK,MAAM,SAAS,IAAO;MAC1D,CAAC,OAAO,WAAW;AACjB,YAAI,OAAO;AACT,iBAAO,IAAI,UAAU,6DAA6D,CAAC;AACnF;QACF;AACAO,QAAAA,UAAQ,OAAO,KAAK,MAAM,MAAM;MAClC;IACF;EACF,CAAC;AACH;AAKA,eAAsB,8BACpB,QACA,UAA8C,CAAC,GAChC;AACf,QAAM,WAAW,QAAQ,YAAY,QAAQ;AAC7C,QAAM,OAAO,QAAQ,QAAQ,QAAQ;AACrC,QAAM,MAAM,QAAQ,QAAQ,OAAO,WAAW,aAAa,OAAO,IAAI;AACtE,MAAI,WAAW,gBAAgB,aAAa,YAAY,SAAS,UAAU;AACzE,UAAM,IAAI,UAAU,8CAA8C;EACpE;AACA,MAAI,WAAW,YAAY,aAAa,QAAS;AACjD,MAAI,QAAQ,EAAG,OAAM,IAAI,UAAU,2EAA2E;AAC9G,QAAM,WAAW,OAAO,QAAQ,kBAAkB,uBAAuB;AACzE,MAAI,CAAC,SAAU,OAAM,IAAI,UAAU,wEAAwE;AAC7G;AAGO,SAAS,sBAAsB,SAAmF;AACvH,MAAI,CAAC,QAAQ,mBAAoB,mBAAkB,QAAQ,KAAK;AAChE,MAAI,UAAU,KAAK,QAAQ,YAAY,EAAG,OAAM,IAAI,UAAU,sDAAsD;AACpH,QAAM,MAAM,OAAO,WAAW,aAAa,OAAO,IAAI;AACtD,QAAM,MAAM,OAAO,WAAW,aAAa,OAAO,IAAI;AACtD,QAAM,cAAc,QAAQ,KAAK,UAAU,YAAY,EAAE,QAAQ,iBAAiB,GAAG,EAAE,MAAM,GAAG,EAAE;AAClG,QAAM,OAAO,gBAAgB,WAAW,IAAI,OAAO,WAAW,EAAE,MAAM,GAAG,CAAC,CAAC;AAC3E,QAAM,SAAS,QAAQ,UAAU,CAAC;AAClC,QAAMQ,UAAS,QAAQ,mBAAmB;AAC1C,QAAM,aAAaA,YAAW,SAAS,CAAC,IAAI,CAAC,4BAA4B,QAAQ,YAAY,qBAAqBA,YAAW,cAAc,cAAc,EAAE,EAAE;AAC7J,QAAM,WAAWA,YAAW,SAAS,CAAC,IAAI,CAAC,yBAAyB,QAAQ,YAAY,kBAAkBA,YAAW,cAAc,cAAc,EAAE,EAAE;AACrJ,MAAI,QAAQ,WAAW,aAAa;AAClC,WAAO;MACL;MAAO;MAAQ;MAAiB,UAAU,IAAI;MAC9C;MAAkB;MAAe;MACjC,YAAY,OAAO,UAAU,IAAI;MAAI,UAAU,OAAO,QAAQ,CAAC;MAC/D,UAAU,GAAG,IAAI,GAAG;MAAI;MACxB,GAAG;MACH;MAAwB,+BAA+B,wBAAwB;MAC/E,mCAAmC,QAAQ,KAAK,SAAS;MACzD,QAAQ;IACV;EACF;AACA,SAAO;IACL;IAAO;IAAQ;IAAiB,UAAU,IAAI;IAAI;IAClD;IAAkB;IAAe;IACjC;IAAoC,gBAAgB,OAAO,QAAQ,GAAG;IACtE,YAAY,OAAO,UAAU,IAAI;IAAI,UAAU,OAAO,QAAQ,CAAC;IAC/D,UAAU,GAAG,IAAI,GAAG;IACpB,4CAA4C,OAAO,cAAc,KAAK,OAAO,IAAI;IACjF,GAAG;IACH;IAAwB,+BAA+B,wBAAwB;IAC/E,mCAAmC,QAAQ,KAAK,SAAS;IACzD,QAAQ;EACV;AACF;AAEA,SAAS,cAAc,MAAwB;AAC7C,SAAO,KAAK,KAAK,CAAC,QAAQ,IAAI,WAAW,SAAS,CAAC,EAAG,MAAM,UAAU,MAAM;AAC9E;AAMA,eAAsB,oBAAoB,SAA2D;AACnG,MAAI,QAAQ,QAAQ,QAAS,QAAO,EAAE,UAAU,GAAG,QAAQ,aAAa,QAAQ,GAAG;AACnF,QAAM,8BAA8B,QAAQ,MAAM;AAClD,QAAM,OAAO,sBAAsB,OAAO;AAC1C,QAAM,OAAO,cAAc,IAAI;AAC/B,QAAM,QAAQd,OAAM,QAAQ,QAAQ,MAAM,EAAE,OAAO,CAAC,QAAQ,QAAQ,MAAM,GAAG,OAAO,MAAM,CAAC;AAC3F,MAAI,SAAS;AACb,MAAI,cAAc;AAClB,MAAI,WAA6E;AACjF,MAAI,UAAU;AACd,MAAI,SAAS;AAEb,QAAM,OAAO,YAAY,MAAM;AAC/B,QAAM,OAAO,GAAG,QAAQ,CAAC,SAAiB;AACxC,QAAI,OAAO,SAAS,KAAK,KAAM,WAAU,KAAK,MAAM,GAAG,KAAK,OAAO,OAAO,MAAM;EAClF,CAAC;AAED,QAAM,OAAO,CAAC,WAAmB;AAC/B,QAAI,WAAW,OAAQ;AACvB,cAAU;AACV,QAAI,CAAC,MAAM,MAAM,WAAW;AAC1B,YAAM,SAA4B,EAAE,iBAAiB,0BAA0B,MAAM,kBAAkB,OAAO;AAC9G,YAAM,MAAM,MAAM,iBAAiB,MAAM,CAAC;IAC5C;AACA,UAAM,aAAa,QAAQ,WAAW,cAAc,CAAC,UAAU,WAAW,IAAI,IAAI,CAAC,MAAM,MAAM,IAAI;AACnG,UAAM,SAASA,OAAM,QAAQ,QAAQ,YAAY,EAAE,OAAO,UAAU,OAAO,MAAM,CAAC;AAClF,WAAO,MAAM;EACf;AACA,QAAM,QAAQ,MAAM,KAAK,kBAAkB;AAC3C,UAAQ,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAE/D,QAAM,UAAU,WAAW,MAAM,KAAK,SAAS,GAAG,QAAQ,KAAK,OAAO,SAAS;AAC/E,QAAM,QAA2B,EAAE,iBAAiB,0BAA0B,MAAM,cAAc,MAAM,QAAQ,KAAK;AACrH,MAAI,CAAC,WAAW,CAAC,QAAQ,QAAQ,QAAS,OAAM,MAAM,MAAM,iBAAiB,KAAK,CAAC;AAEnF,QAAM,WAAW,YAAY;AAC3B,QAAI,UAAU,OAAO,MAAM,CAAC;AAC5B,UAAM,aAAa,OAAO,QAAgB;AACxC,YAAM,QAAQ,IAAI,GAAG,EAAE,MAAM,KAAK,IAAI,SAAS,GAAG,EAAE,IAAI;AACxD,UAAI,MAAM,aAAa,IAAW,OAAM,IAAI,MAAM,4BAA4B;AAC9E,YAAM,OAAO,MAAM,SAAS,MAAM;AAClC,UAAI,CAAC,KAAK,KAAK,EAAG;AAClB,YAAMe,WAAU,iBAAiB,IAAI;AACrC,UAAIA,SAAQ,SAAS,mBAAoB,YAAWA;AACpD,YAAMC,YAAW,MAAM,QAAQ,UAAUD,QAAO;AAChD,UAAIC,aAAY,CAAC,MAAM,MAAM,UAAW,OAAM,MAAM,MAAM,iBAAiBA,SAAQ,CAAC;IACtF;AACA,QAAI;AACF,uBAAiB,OAAO,MAAM,QAAQ;AACpC,cAAM,QAAQ,OAAO,SAAS,GAAG,IAAI,MAAM,OAAO,KAAK,GAAG;AAC1D,uBAAe,MAAM;AACrB,YAAI,cAAc,QAAQ,KAAK,OAAO,gBAAgB;AACpD,gBAAM,IAAI,MAAM,wBAAwB,QAAQ,KAAK,OAAO,cAAc,QAAQ;QACpF;AACA,kBAAU,OAAO,OAAO,CAAC,SAAS,KAAK,CAAC;AACxC,YAAI,UAAU,QAAQ,QAAQ,EAAE;AAChC,eAAO,WAAW,GAAG;AACnB,gBAAM,WAAW,QAAQ,SAAS,GAAG,OAAO,CAAC;AAC7C,oBAAU,QAAQ,SAAS,UAAU,CAAC;AACtC,oBAAU,QAAQ,QAAQ,EAAE;QAC9B;AACA,YAAI,QAAQ,aAAa,IAAW,OAAM,IAAI,MAAM,4BAA4B;MAClF;AACA,UAAI,QAAQ,WAAY,OAAM,WAAW,OAAO;IAClD,SAAS,OAAO;AACd,WAAK,gBAAgB;AACrB,YAAM;IACR;EACF,GAAG;AAEH,QAAM,OAAO,IAAI,QAAgB,CAAC,QAAQ,WAAW;AACnD,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,QAAQ,CAAC,SAAS;AAAE,eAAS;AAAM,aAAO,QAAQ,CAAC;IAAG,CAAC;EACpE,CAAC;AACD,MAAI;AACF,UAAM,CAAC,QAAQ,IAAI,MAAM,QAAQ,IAAI,CAAC,MAAM,OAAO,CAAC;AACpD,QAAI,UAAU,QAAQ,SAAU,OAAM,QAAQ,SAAS,MAAM;AAC7D,QAAI,QAAQ,QAAQ,QAAS,QAAO,EAAE,UAAU,QAAQ,aAAa,OAAO;AAC5E,UAAM,WAAW;AACjB,QAAI,CAAC,SAAU,QAAO,EAAE,UAAU,QAAQ,UAAU,QAAQ,EAAE,OAAO,kCAAkC,GAAG,OAAO;AACjH,WAAO,EAAE,UAAU,QAAQ,aAAa,IAAI,SAAS,SAAS,UAAU,QAAQ,SAAS,QAAQ,OAAO;EAC1G,SAAS,OAAO;AACd,SAAK,cAAc;AACnB,UAAM,KAAK,MAAM,MAAM,CAAC;AACxB,UAAM;EACR,UAAA;AACE,iBAAa,OAAO;AACpB,YAAQ,QAAQ,oBAAoB,SAAS,KAAK;EACpD;AACF;AE1RO,IAAM,sBAAsB,oBAAI,IAAI;EACzC;EAAQ;EAAS;EAAa;EAAgB;EAAQ;AACxD,CAAC;AACM,IAAM,wBAAwB;AAG9B,SAAS,qBAAqB,cAA+B;AAClE,QAAM,QAAQ,aAAa,MAAM,GAAG;AACpC,SAAO,CAACR,YAAW,YAAY,KAAK,CAAC,aAAa,SAAS,IAAI,KAAK,CAAC,aAAa,SAAS,IAAI,KAC1F,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,QAAQ,oBAAoB,IAAI,IAAI,CAAC,KAC7F,CAAC,sBAAsB,KAAK,MAAM,GAAG,EAAE,KAAK,EAAE;AACrD;ADGA,eAAe,UAAU,KAAa,MAAgB,UAAmC;AACvF,QAAM,QAAQR,QAAM,OAAO,MAAM,EAAE,KAAK,OAAO,CAAC,UAAU,QAAQ,MAAM,GAAG,OAAO,MAAM,CAAC;AACzF,QAAM,SAAmB,CAAC;AAC1B,QAAM,SAAmB,CAAC;AAC1B,MAAI,QAAQ;AACZ,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,aAAS,MAAM;AACf,QAAI,QAAQ,SAAU,OAAM,KAAK,SAAS;QACrC,QAAO,KAAK,KAAK;EACxB,CAAC;AACD,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,QAAI,OAAO,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,YAAY,CAAC,IAAI,MAAQ,QAAO,KAAK,KAAK;EAC1F,CAAC;AACD,QAAM,OAAO,MAAM,IAAI,QAAuB,CAAC,QAAQ,WAAW;AAChE,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,QAAQ,MAAM;EAC3B,CAAC;AACD,MAAI,QAAQ,SAAU,OAAM,IAAI,MAAM,sBAAsB,QAAQ,QAAQ;AAC5E,MAAI,SAAS,EAAG,OAAM,IAAI,MAAM,uBAAuB,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE,MAAM,GAAG,GAAK,CAAC,EAAE;AAC/G,SAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,eAAe,SAAS,KAAa,SAAkC,UAAqC;AAC1G,QAAM,QAAQA,QAAM,OAAO,CAAC,YAAY,SAAS,GAAG,EAAE,KAAK,OAAO,CAAC,QAAQ,QAAQ,MAAM,GAAG,OAAO,MAAM,CAAC;AAC1G,QAAM,SAAmB,CAAC;AAC1B,QAAM,SAAmB,CAAC;AAC1B,MAAI,QAAQ;AACZ,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,aAAS,MAAM;AACf,QAAI,QAAQ,WAAW,QAAQ,SAAS,IAAK,OAAM,KAAK,SAAS;QAC5D,QAAO,KAAK,KAAK;EACxB,CAAC;AACD,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,QAAI,OAAO,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,YAAY,CAAC,IAAI,MAAQ,QAAO,KAAK,KAAK;EAC1F,CAAC;AACD,QAAM,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,UAAU,MAAM,IAAI,EAAE,KAAK,IAAI,CAAC;CAAI;AACpE,QAAM,OAAO,MAAM,IAAI,QAAuB,CAAC,QAAQ,WAAW;AAChE,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,QAAQ,MAAM;EAC3B,CAAC;AACD,MAAI,QAAQ,WAAW,QAAQ,SAAS,IAAK,OAAM,IAAI,MAAM,oBAAoB,QAAQ,QAAQ;AACjG,MAAI,SAAS,EAAG,OAAM,IAAI,MAAM,2BAA2B,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE,MAAM,GAAG,GAAK,CAAC,EAAE;AACnH,QAAM,SAAS,OAAO,OAAO,MAAM;AACnC,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS;AACb,MAAI,QAAQ;AACZ,aAAW,SAAS,SAAS;AAC3B,UAAM,UAAU,OAAO,QAAQ,IAAM,MAAM;AAC3C,QAAI,UAAU,EAAG,OAAM,IAAI,MAAM,gCAAgC;AACjE,UAAM,QAAQ,oCAAoC,KAAK,OAAO,SAAS,QAAQ,OAAO,EAAE,SAAS,MAAM,CAAC;AACxG,QAAI,CAAC,SAAS,MAAM,CAAC,MAAM,MAAM,KAAM,OAAM,IAAI,MAAM,gDAAgD;AACvG,UAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,KAAK,UAAU,IAAI,UAAU,OAAO,QAAQ;AACxF,YAAM,IAAI,MAAM,yCAAyC;IAC3D;AACA,UAAMiB,WAAU,OAAO,SAAS,UAAU,GAAG,UAAU,IAAI,MAAM;AACjE,QAAI,OAAO,UAAU,IAAI,MAAM,MAAM,GAAM,OAAM,IAAI,MAAM,gCAAgC;AAC3F,aAASA,SAAQ;AACjB,QAAI,QAAQ,SAAU,OAAM,IAAI,MAAM,qBAAqB,QAAQ,QAAQ;AAC3E,UAAM,KAAKA,QAAO;AAClB,aAAS,UAAU,IAAI,SAAS;EAClC;AACA,SAAO;AACT;AAIA,eAAsB,mBACpB,QAAgB,WAChB,UAA6E,CAAC,GAChD;AAC9B,MAAI,CAAC,iBAAiB,KAAK,SAAS,EAAG,OAAM,IAAI,UAAU,uCAAuC;AAClG,QAAM,YAAY,MAAM,SAASX,SAAQ,MAAM,CAAC;AAChD,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,WAAW,QAAQ,YAAY,MAAM,OAAO;AAClD,QAAM,aAAa,MAAM,UAAU,WAAW,CAAC,WAAW,OAAO,SAAS,GAAG,KAAK,OAAO,IAAI,GAC1F,SAAS,MAAM,EAAE,MAAM,IAAI,EAAE,OAAO,OAAO;AAC9C,QAAM,UAAU,UAAU,QAAQ,CAACY,YAAW;AAC5C,UAAM,QAAQ,sDAAsD,KAAKA,OAAM;AAC/E,WAAO,SAAS,qBAAqB,MAAM,CAAC,CAAE,IAC1C,CAAC,EAAE,MAAM,MAAM,CAAC,GAAI,MAAM,MAAM,CAAC,GAAI,MAAM,MAAM,CAAC,EAAG,CAAC,IACtD,CAAC;EACP,CAAC;AACD,MAAI,QAAQ,SAAS,SAAU,OAAM,IAAI,MAAM,qBAAqB,QAAQ,QAAQ;AACpF,QAAM,OAAO,MAAMhB,SAAQD,OAAK,QAAQ,YAAYI,QAAO,GAAG,gBAAgB,CAAC;AAC/E,QAAM,aAAaJ,OAAK,MAAM,QAAQ;AACtC,QAAM,MAAM,UAAU;AACtB,MAAI,YAAY;AAChB,MAAI;AACF,UAAM,QAAQ,MAAM,SAAS,WAAW,SAAS,QAAQ;AACzD,eAAW,CAAC,OAAO,KAAK,KAAK,QAAQ,QAAQ,GAAG;AAC9C,YAAMgB,WAAU,MAAM,KAAK;AAC3B,mBAAaA,SAAQ;AACrB,UAAI,YAAY,SAAU,OAAM,IAAI,MAAM,qBAAqB,QAAQ,QAAQ;AAC/E,YAAM,SAASX,SAAQ,YAAY,MAAM,IAAI;AAC7C,UAAI,CAAC,OAAO,WAAW,GAAGA,SAAQ,UAAU,CAAC,GAAGC,IAAG,EAAE,EAAG,OAAM,IAAI,UAAU,iCAAiC;AAC7G,YAAM,MAAMD,SAAQ,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AACtD,YAAMF,WAAU,QAAQa,UAAS,EAAE,MAAM,MAAM,MAAM,MAAM,SAAS,WAAW,MAAQ,IAAM,CAAC;IAChG;AACA,WAAO;MAAE;MAAM,WAAW;MAAY,WAAW,QAAQ;MAAQ;MAC/D,SAAS,MAAMd,IAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;IAAE;EAC9D,SAAS,OAAO;AACd,UAAMA,IAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/C,UAAM;EACR;AACF;AEvFA,eAAe,YAAY,WAAmB,UAAkB,UAAyC;AACvG,QAAM,QAAsB,CAAC;AAC7B,MAAI,QAAQ;AACZ,QAAM,OAAO,OAAO,QAA+B;AACjD,eAAW,SAAS,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC,GAAG;AAC/D,UAAI,MAAM,YAAY,KAAK,oBAAoB,IAAI,MAAM,IAAI,EAAG;AAChE,UAAI,CAAC,MAAM,YAAY,KAAK,sBAAsB,KAAK,MAAM,IAAI,EAAG;AACpE,YAAM,OAAOF,OAAK,KAAK,MAAM,IAAI;AACjC,UAAI,MAAM,eAAe,EAAG;AAC5B,UAAI,MAAM,YAAY,GAAG;AACvB,cAAM,KAAK,IAAI;AACf;MACF;AACA,UAAI,CAAC,MAAM,OAAO,EAAG;AACrB,YAAMkB,YAAW,MAAM,KAAK,IAAI;AAChC,eAASA,UAAS;AAClB,UAAI,MAAM,SAAS,IAAI,SAAU,OAAM,IAAI,MAAM,qBAAqB,QAAQ,QAAQ;AACtF,UAAI,QAAQ,SAAU,OAAM,IAAI,MAAM,qBAAqB,QAAQ,QAAQ;AAC3E,YAAM,KAAK;QACT,QAAQ;QACR,cAAcP,UAAS,WAAW,IAAI;QACtC,MAAMO,UAAS,OAAO;QACtB,OAAOA,UAAS;MAClB,CAAC;IACH;EACF;AACA,QAAM,KAAK,SAAS;AACpB,SAAO,MAAM,KAAK,CAAC,MAAM,UAAU,KAAK,aAAa,cAAc,MAAM,YAAY,CAAC;AACxF;AAEA,eAAe,eAAe,WAAmB,UAAkB,UAAyC;AAC1G,QAAM,QAAQnB,QAAM,OAAO,CAAC,YAAY,MAAM,YAAY,YAAY,oBAAoB,GAAG;IAC3F,KAAK;IAAW,OAAO,CAAC,UAAU,QAAQ,MAAM;IAAG,OAAO;EAC5D,CAAC;AACD,QAAM,SAAmB,CAAC;AAC1B,QAAM,SAAmB,CAAC;AAC1B,MAAI,cAAc;AAClB,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,mBAAe,MAAM;AACrB,QAAI,cAAc,IAAI,OAAO,KAAM,OAAM,KAAK,SAAS;QAClD,QAAO,KAAK,KAAK;EACxB,CAAC;AACD,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,QAAI,OAAO,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,YAAY,CAAC,IAAI,MAAQ,QAAO,KAAK,KAAK;EAC1F,CAAC;AACD,QAAM,OAAO,MAAM,IAAI,QAAuB,CAAC,QAAQ,WAAW;AAChE,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,QAAQ,MAAM;EAC3B,CAAC;AACD,MAAI,cAAc,IAAI,OAAO,KAAM,OAAM,IAAI,MAAM,kCAAkC;AACrF,MAAI,SAAS,EAAG,OAAM,IAAI,MAAM,8BAA8B,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE,MAAM,GAAG,GAAK,CAAC,EAAE;AACtH,QAAM,QAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE,MAAM,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK;AACtF,MAAI,MAAM,SAAS,SAAU,OAAM,IAAI,MAAM,qBAAqB,QAAQ,QAAQ;AAClF,QAAM,OAAOM,UAAQ,SAAS;AAC9B,QAAM,QAAsB,CAAC;AAC7B,MAAI,QAAQ;AACZ,aAAW,gBAAgB,OAAO;AAChC,QAAI,CAAC,qBAAqB,YAAY,EAAG;AACzC,UAAM,SAASA,UAAQ,MAAM,YAAY;AACzC,QAAI,CAAC,OAAO,WAAW,GAAG,IAAI,GAAGC,KAAG,EAAE,EAAG,OAAM,IAAI,UAAU,iCAAiC;AAC9F,QAAIY;AACJ,QAAI;AAAE,MAAAA,YAAW,MAAM,MAAM,MAAM;IAAG,SAC/B,OAAO;AACZ,UAAK,MAAgC,SAAS,SAAU;AACxD,YAAM;IACR;AACA,QAAIA,UAAS,eAAe,KAAK,CAACA,UAAS,OAAO,EAAG;AACrD,aAASA,UAAS;AAClB,QAAI,QAAQ,SAAU,OAAM,IAAI,MAAM,qBAAqB,QAAQ,QAAQ;AAC3E,UAAM,KAAK,EAAE,QAAQ,cAAc,MAAMA,UAAS,OAAO,KAAO,OAAOA,UAAS,KAAK,CAAC;EACxF;AACA,SAAO;AACT;AAEA,eAAe,SAAS,OAAqB,aAAoC;AAC/E,aAAW,QAAQ,OAAO;AACxB,UAAM,SAASlB,OAAK,aAAa,KAAK,YAAY;AAClD,UAAMS,OAAMJ,UAAQ,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AACtD,UAAMG,UAAS,KAAK,QAAQ,MAAM;AAClC,UAAM,MAAM,QAAQ,KAAK,IAAI;EAC/B;AACF;AAEA,eAAe,eAAe,MAAc,UAAmC;AAC7E,QAAM,QAAQT,QAAM,OAAO;IACzB;IAAQ;IAAc;IAAY;IAClC;IAAmB;IAAmB;IAAM;IAAY;EAC1D,GAAG,EAAE,KAAK,MAAM,OAAO,CAAC,UAAU,QAAQ,MAAM,GAAG,OAAO,MAAM,CAAC;AACjE,QAAM,SAAmB,CAAC;AAC1B,QAAM,SAAmB,CAAC;AAC1B,MAAI,QAAQ;AACZ,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,aAAS,MAAM;AACf,QAAI,QAAQ,SAAU,OAAM,KAAK,SAAS;QACrC,QAAO,KAAK,KAAK;EACxB,CAAC;AACD,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB;AACzC,QAAI,OAAO,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,YAAY,CAAC,IAAI,MAAQ,QAAO,KAAK,KAAK;EAC1F,CAAC;AACD,QAAM,OAAO,MAAM,IAAI,QAAuB,CAAC,QAAQ,WAAW;AAChE,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,QAAQ,MAAM;EAC3B,CAAC;AACD,MAAI,QAAQ,SAAU,OAAM,IAAI,MAAM,iBAAiB,QAAQ,QAAQ;AACvE,MAAI,SAAS,KAAK,SAAS,GAAG;AAC5B,UAAM,IAAI,MAAM,oBAAoB,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE,MAAM,GAAG,GAAK,CAAC,EAAE;EAC9F;AACA,SAAO,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,EACzC,WAAW,eAAe,IAAI,EAC9B,WAAW,gBAAgB,IAAI,EAC/B,WAAW,eAAe,IAAI,EAC9B,WAAW,gBAAgB,IAAI,EAC/B,WAAW,kBAAkB,OAAO,EACpC,WAAW,mBAAmB,OAAO;AAC1C;AAKA,eAAsB,eAAe,QAAgB,UAAiC,CAAC,GAA6B;AAClH,QAAM,YAAY,MAAMW,UAASL,UAAQ,MAAM,CAAC;AAChD,QAAM,aAAa,MAAM,KAAK,SAAS;AACvC,MAAI,CAAC,WAAW,YAAY,EAAG,OAAM,IAAI,UAAU,sCAAsC;AACzF,QAAM,OAAO,MAAMJ,UAAQD,OAAK,QAAQ,YAAYI,SAAO,GAAG,eAAe,CAAC;AAC9E,QAAM,cAAcJ,OAAK,MAAM,UAAU;AACzC,QAAM,eAAeA,OAAK,MAAM,WAAW;AAC3C,QAAM,QAAQ,IAAI,CAACS,OAAM,WAAW,GAAGA,OAAM,YAAY,CAAC,CAAC;AAC3D,MAAI;AACF,UAAM,WAAW,QAAQ,YAAY;AACrC,UAAM,WAAW,QAAQ,YAAY,MAAM,OAAO;AAClD,UAAM,QAAQ,QAAQ,yBAClB,MAAM,eAAe,WAAW,UAAU,QAAQ,IAClD,MAAM,YAAY,WAAW,UAAU,QAAQ;AACnD,UAAM,QAAQ,IAAI,CAAC,SAAS,OAAO,WAAW,GAAG,SAAS,OAAO,YAAY,CAAC,CAAC;AAC/E,WAAO;MACL;MACA;MACA;MACA,WAAW,MAAM;MACjB,WAAW,MAAM,OAAO,CAAC,KAAK,SAAS,MAAM,KAAK,OAAO,CAAC;MAC1D,OAAO,CAACU,cAAa,eAAe,MAAMA,SAAQ;MAClD,SAAS,MAAMjB,KAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;IAC1D;EACF,SAAS,OAAO;AACd,UAAMA,KAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/C,UAAM;EACR;AACF;AAIA,eAAsB,mBACpB,gBAAwB,iBAAyB,UAAiC,CAAC,GACzD;AAC1B,QAAM,oBAAoB,MAAMQ,UAASL,UAAQ,cAAc,CAAC;AAChE,QAAM,qBAAqB,MAAMK,UAASL,UAAQ,eAAe,CAAC;AAClE,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,WAAW,QAAQ,YAAY,MAAM,OAAO;AAClD,QAAM,CAAC,eAAe,cAAc,IAAI,MAAM,QAAQ,IAAI;IACxD,YAAY,mBAAmB,UAAU,QAAQ;IACjD,YAAY,oBAAoB,UAAU,QAAQ;EACpD,CAAC;AACD,QAAM,OAAO,MAAMJ,UAAQD,OAAK,QAAQ,YAAYI,SAAO,GAAG,eAAe,CAAC;AAC9E,QAAM,cAAcJ,OAAK,MAAM,UAAU;AACzC,QAAM,eAAeA,OAAK,MAAM,WAAW;AAC3C,QAAM,QAAQ,IAAI,CAACS,OAAM,WAAW,GAAGA,OAAM,YAAY,CAAC,CAAC;AAC3D,MAAI;AACF,UAAM,QAAQ,IAAI,CAAC,SAAS,eAAe,WAAW,GAAG,SAAS,gBAAgB,YAAY,CAAC,CAAC;AAChG,WAAO;MACL;MAAM;MAAa;MACnB,WAAW,eAAe;MAC1B,WAAW,eAAe,OAAO,CAAC,KAAK,SAAS,MAAM,KAAK,OAAO,CAAC;MACnE,OAAO,CAAC,kBAAkB,eAAe,MAAM,aAAa;MAC5D,SAAS,MAAMP,KAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;IAC1D;EACF,SAAS,OAAO;AACd,UAAMA,KAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/C,UAAM;EACR;AACF;;;ACrNA,SAAS,cAAAkB,mBAAkB;AAC3B,SAAS,YAAAC,WAAU,WAAAC,gBAAe;AAClC,SAAS,YAAAC,WAAU,WAAAC,gBAAe;;;AkBoB3B,IAAM,aAAN,cAAyB,MAAM;EAC3B;EACA;EAET,YAAY,MAAsB,aAAqB,SAA+B;AACpF,UAAM,aAAa,OAAO;AAC1B,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,cAAc;EACrB;AACF;;;AC9BO,SAAS,cAAc,OAAwB;AACpD,SAAO,KAAK,UAAU,UAAU,KAAK,CAAC;AACxC;AAEA,eAAsB,UAAU,OAA6C;AAC3E,QAAM,QAAQ,OAAO,UAAU,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,IAAI;AAC5E,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,WAAW,KAAK,KAAK,EAAE,MAAM;AAClF,SAAO,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC9F;AAEO,SAAS,WAAW,OAAwB;AACjD,MAAI,OAAO,UAAU,SAAU,QAAO,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AACtE,MAAI,iBAAiB,WAAY,QAAO,MAAM;AAC9C,MAAI;AACF,WAAO,IAAI,YAAY,EAAE,OAAO,cAAc,KAAK,CAAC,EAAE;EACxD,QAAQ;AACN,UAAM,IAAI,WAAW,uBAAuB,iDAAiD;EAC/F;AACF;AAEA,SAAS,UAAU,OAAyB;AAC1C,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO;AACtF,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,WAAW,kBAAkB,4CAA4C;AAChH,WAAO;EACT;AACA,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,SAAS;AACpD,MAAI,iBAAiB,WAAY,QAAO,EAAE,QAAQ,CAAC,GAAG,KAAK,EAAE;AAC7D,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAMC,UAAS;AACf,WAAO,OAAO,YAAY,OAAO,KAAKA,OAAM,EAAE,OAAO,CAAC,QAAQA,QAAO,GAAG,MAAM,MAAS,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,UAAUA,QAAO,GAAG,CAAC,CAAC,CAAC,CAAC;EAC7I;AACA,QAAM,IAAI,WAAW,kBAAkB,4CAA4C;AACrF;ACtBO,SAAS,QAAQ,SAAoB,UAA2B;AACrE,SAAO,QAAQ,SAAS,YAAY,QAAQ,aAAa,SAAS,QAAQ;AAC5E;AAiBO,SAAS,eAAe,QAAwC,YAAgC,QAAkC;AACvI,QAAM,SAA0B,CAAC;AACjC,aAAW,SAAS,QAAQ;AAC1B,WAAO,KAAK,GAAG,MAAM,MAAM,YAAY;AACvC,eAAW,OAAO,MAAM,MAAM,YAAY;AACxC,aAAO,KAAK,EAAE,KAAK,WAAW,mBAAmB,MAAM,MAAM,aAAa,CAAC;IAC7E;EACF;AACA,QAAMC,UAAS,oBAAI,IAA2B;AAC9C,aAAW,OAAO,OAAQ,CAAAA,QAAO,IAAI,GAAG,IAAI,IAAI,IAAI,KAAS,IAAI,IAAI,EAAE,KAAS,IAAI,SAAS,KAAS,IAAI,iBAAiB,IAAI,GAAG;AAClI,SAAO,CAAC,GAAGA,QAAO,OAAO,CAAC;AAC5B;;;ACWA,IAAM,kBAAiC,uBAAO,sBAAsB;AACpE,IAAM,uBAAuB,oBAAI,QAAgB;AAsB1C,SAAS,aAAa,OAA8C;AACzE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,qBAAqB,IAAI,KAAK;AACtF;AAGO,SAAS,OAAU,OAAwC;AAChE,SAAO,aAAa,KAAK,KAAK,MAAM,MAAM,iBAAiB;AAC7D;AAGO,SAAS,SAAY,OAA0C;AACpE,SAAO,aAAa,KAAK,KAAK,MAAM,MAAM,iBAAiB;AAC7D;AAOO,SAAS,mBAAsB,OAAU,WAAsBC,WAAkC;AACtG,SAAO,YAAY,OAAO;IACxB,eAAe;IACf,cAAc;IACd;IACA,GAAG,aAAaA,SAAQ;EAC1B,CAAC;AACH;AAEO,SAAS,qBAAwB,OAAUA,WAAoC;AACpF,SAAO,YAAY,OAAO;IACxB,eAAe;IACf,cAAc;IACd,GAAG,aAAaA,SAAQ;EAC1B,CAAC;AACH;AAEA,SAAS,YAAuC,OAAU,OAAwC;AAChG,QAAM,SAAS,EAAE,OAAO,OAAO,OAAO,OAAO,KAAK,EAAE;AACpD,SAAO,eAAe,QAAQ,iBAAiB,EAAE,OAAO,MAAM,cAAc,YAAY,MAAM,CAAC;AAC/F,uBAAqB,IAAI,MAAM;AAC/B,SAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAS,aAAaA,WAAgE;AACpF,MAAIA,UAAS,WAAW,WAAW,EAAG,OAAM,IAAI,WAAW,kBAAkB,qCAAqC;AAClH,QAAM,aAAaA,UAAS,WAAW,IAAI,OAAO;AAClD,QAAM,gBAAgBA,UAAS,gBAAgB,CAAC,GAAG,IAAI,CAAC,eAAe,OAAO,OAAO;IACnF,KAAK,QAAQ,WAAW,GAAG;IAC3B,WAAW,WAAW;IACtB,mBAAmB,WAAW;EAChC,CAAC,CAAC;AACF,SAAO;IACL,SAAS,iBAAiBA,UAAS,OAAO;IAC1C,YAAY,OAAO,OAAO,UAAU;IACpC,cAAc,OAAO,OAAO,YAAY;EAC1C;AACF;AAEA,SAAS,QAAQ,KAAmC;AAClD,MAAI,CAAC,IAAI,MAAO,IAAI,WAAW,UAAa,CAAC,IAAI,OAAS,OAAM,IAAI,WAAW,kBAAkB,uDAAuD;AACxJ,SAAO,OAAO,OAAO,EAAE,MAAM,IAAI,MAAM,IAAI,IAAI,IAAI,GAAI,IAAI,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO,EAAG,CAAC;AAClH;AAEA,SAAS,iBAAiB,SAA+B;AACvD,MAAI,QAAQ,SAAS,SAAU,QAAO,OAAO,OAAO,EAAE,MAAM,SAAS,CAAC;AACtE,QAAM,eAAe,CAAC,GAAG,IAAI,IAAI,QAAQ,YAAY,CAAC,EAAE,KAAK;AAC7D,MAAI,aAAa,KAAK,CAAC,OAAO,CAAC,EAAE,EAAG,OAAM,IAAI,WAAW,mBAAmB,yCAAyC;AACrH,SAAO,OAAO,OAAO,EAAE,MAAM,cAAc,cAAc,OAAO,OAAO,YAAY,EAAE,CAAC;AACxF;;;ACrGA,IAAM,SAAS;AACf,IAAM,MAAM;AACZ,IAAM,KAAK;AAGX,eAAsB,8BACpB,QAC6B;AAC7B,WAAS,MAAM;AACf,QAAM,YAA2C;IAC/C,eAAe,OAAO;IACtB,gBAAgB,OAAO;IACvB,sBAAsB,OAAO;IAC7B,mBAAmB,OAAO;IAC1B,aAAa,OAAO;IACpB,iBAAiB,OAAO;IACxB,cAAc,OAAO;IACrB,cAAc,OAAO;IACrB,SAAS,OAAO,QAAQ,IAAI,CAACC,aAAY;MACvC,UAAUA,QAAO;MAAU,cAAcA,QAAO;MAAc,QAAQA,QAAO;MAC7E,UAAUA,QAAO;MAAU,YAAYA,QAAO;MAC9C,WAAWA,QAAO,UAAU,IAAI,CAAC,cAAc;QAC7C,YAAY,SAAS;QAAY,QAAQ,SAAS;QAClD,OAAO,SAAS;QAAO,QAAQ,SAAS;MAC1C,EAAE;IACJ,EAAE;IACF,kBAAkB,OAAO;IACzB,sBAAsB,OAAO;IAC7B,2BAA2B,OAAO;IAClC,SAAS,OAAO;EAClB;AACA,SAAO,UAAU,MAAM,UAAU,cAAc,SAAS,CAAC,CAAC;AAC5D;AA4DA,SAAS,SAAS,QAA6C;AAC7D,MAAI,OAAO,kBAAkB,KAAK,OAAO,OAAO,mBAAmB,YAAY,CAAC,GAAG,KAAK,OAAO,cAAc,KACxG,OAAO,OAAO,yBAAyB,YAAY,CAAC,IAAI,KAAK,OAAO,oBAAoB,KACxF,CAAC,OAAO,KAAK,OAAO,iBAAiB,KAAK,CAAC,OAAO,KAAK,OAAO,WAAW,KAAK,CAAC,OAAO,KAAK,OAAO,eAAe,KACjH,CAAC,OAAO,KAAK,OAAO,YAAY,KAAK,CAAC,OAAO,KAAK,OAAO,YAAY,KACrE,CAAC,OAAO,KAAK,OAAO,oBAAoB,KACxC,CAAC,OAAO,cAAc,OAAO,gBAAgB,KAAK,OAAO,mBAAmB,KAC5E,OAAO,mBAAmB,OAAU,OAAO,8BAA+B,OAAO,mBAAmB,KACpG,OAAO,QAAQ,SAAS,KAAK,OAAO,QAAQ,SAAS,IAAI;AAC5D,UAAM,IAAI,WAAW,kBAAkB,+DAA+D;EACxG;AACA,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAWC,WAAU,OAAO,SAAS;AACnC,QAAI,OAAOA,QAAO,aAAa,YAAY,CAAC,GAAG,KAAKA,QAAO,QAAQ,KAC9D,IAAI,IAAIA,QAAO,QAAQ,KAAK,OAAOA,QAAO,iBAAiB,YAAY,CAAC,OAAO,KAAKA,QAAO,YAAY,KACvG,CAAC,CAAC,UAAU,UAAU,aAAa,gBAAgB,EAAE,SAASA,QAAO,MAAM,KAC3E,CAAC,OAAO,cAAcA,QAAO,QAAQ,KAAKA,QAAO,WAAW,KAAKA,QAAO,WAAW,OACnF,CAAC,OAAO,cAAcA,QAAO,UAAU,KAAKA,QAAO,aAAa,KAAKA,QAAO,aAAa,KAAK,KAAQ;AACzG,YAAM,IAAI,WAAW,kBAAkB,sEAAsE;IAC/G;AACA,UAAM,cAAc,oBAAI,IAAY;AACpC,QAAIA,QAAO,UAAU,SAAS,GAAI,OAAM,IAAI,WAAW,kBAAkB,2CAA2C;AACpH,eAAW,YAAYA,QAAO,WAAW;AACvC,UAAI,OAAO,SAAS,eAAe,YAAY,CAAC,GAAG,KAAK,SAAS,UAAU,KAAK,YAAY,IAAI,SAAS,UAAU,KAC9G,CAAC,CAAC,YAAY,WAAW,WAAW,WAAW,EAAE,SAAS,SAAS,MAAM,KACxE,SAAS,UAAU,SAAS,CAAC,OAAO,cAAc,SAAS,KAAK,KAAK,SAAS,QAAQ,MACtF,SAAS,WAAW,QAAQ,CAAC,OAAO,KAAK,SAAS,MAAM,KACxD,SAAS,WAAW,gBAAiB,SAAS,UAAU,QAAQ,SAAS,WAAW,SACpF,CAAC,WAAW,SAAS,EAAE,SAAS,SAAS,MAAM,MAAM,SAAS,UAAU,QAAQ,SAAS,WAAW,SACpG,SAAS,WAAW,gBAAgB,SAAS,UAAU,QAAQ,SAAS,WAAW,OAAQ;AAC/F,cAAM,IAAI,WAAW,kBAAkB,kDAAkD;MAC3F;AACA,kBAAY,IAAI,SAAS,UAAU;IACrC;AACA,QAAIA,QAAO,WAAW,aAChBA,QAAO,aAAa,KAAKA,QAAO,UAAU,KAAK,CAAC,aAAa,SAAS,WAAW,UAAU,IAAI;AACnG,YAAM,IAAI,WAAW,kBAAkB,yDAAyD;IAClG;AACA,QAAI,IAAIA,QAAO,QAAQ;EACzB;AACA,QAAM,SAAS,OAAO,QAAQ,MAAM,CAACA,YAAWA,QAAO,WAAW,QAAQ;AAC1E,MAAK,OAAO,YAAY,aAAc,QAAQ;AAC5C,UAAM,IAAI,WAAW,kBAAkB,+DAA+D;EACxG;AACF;AC1IA,IAAMC,OAAM;AACZ,IAAMC,UAAS;AACf,IAAMC,MAAK;AACX,IAAM,kBAAkB,MAAM;AAC9B,IAAM,kBAAkB,KAAK;AAG7B,eAAsB,6BACpB,OACiC;AACjC,QAAMC,SAAQ,eAAe,MAAM,KAAK;AACxC,uBAAqB,MAAM,eAAe,MAAM,KAAK;AACrD,QAAM,cAAc,UAAU,MAAM,UAAU,MAAM,KAAK,CAAC;AAC1D,QAAM,cAAc,UAAU,MAAM,UAAU,cAAcA,MAAK,CAAC,CAAC;AACnE,QAAM,SAAS,EAAE,eAAe,GAAY,eAAe,MAAM,eAAe,aAAa,OAAAA,QAAO,YAAY;AAChH,QAAM,mBAAmB,UAAU,MAAM,UAAU,cAAc,MAAM,CAAC,CAAC;AACzE,SAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,MAAM,OAAO,iBAAiB,CAAC;AACnE;AAGA,eAAsB,6BAA6B,OAAiD;AAClG,QAAM,QAAQ,OAAO,OAAO,YAAY;AACxCC,SAAM,OAAO,CAAC,iBAAiB,iBAAiB,SAAS,eAAe,SAAS,eAAe,kBAAkB,CAAC;AACnH,MAAI,MAAM,kBAAkB,KAAK,OAAO,MAAM,kBAAkB,YAAY,OAAO,MAAM,UAAU,YAC9F,OAAO,MAAM,gBAAgB,YAAY,OAAO,MAAM,gBAAgB,YACtE,OAAO,MAAM,qBAAqB,UAAU;AAC/C,UAAMC,SAAQ,2CAA2C;EAC3D;AACA,QAAM,UAAU,MAAM,6BAA6B;IACjD,eAAe,MAAM;IACrB,OAAO,MAAM;IACb,OAAO,eAAe,MAAM,KAAK;EACnC,CAAC;AACD,MAAI,QAAQ,gBAAgB,MAAM,eAAe,QAAQ,gBAAgB,MAAM,eAC1E,QAAQ,qBAAqB,MAAM,kBAAkB;AACxD,UAAMA,SAAQ,wDAAwD;EACxE;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAqC;AAC3D,QAAMF,SAAQ,OAAO,OAAO,OAAO;AACnCC,SAAMD,QAAO;IACX;IAAc;IAAoB;IAAuB;IAAqB;IAC9E;IAAsB;IAAgB;IAAoB;IAAuB;EACnF,CAAC;AACD,QAAM,aAAaA,OAAM;AACzB,QAAM,gBAAgB,QAAQA,OAAM,kBAAkB,oBAAoBD,KAAI,KAAK,KAAK;AACxF,QAAM,YAAY,QAAQC,OAAM,qBAAqB,uBAAuBF,SAAQ,KAAK,IAAI;AAC7F,MAAK,eAAe,SAAS,OAAO,eAAe,YAAY,CAACC,IAAG,KAAK,UAAU,MAC7E,OAAOC,OAAM,wBAAwB,YAAY,CAACF,QAAO,KAAKE,OAAM,mBAAmB,KACvF,OAAOA,OAAM,sBAAsB,YAAY,CAACF,QAAO,KAAKE,OAAM,iBAAiB,KAClFA,OAAM,0BAA0B,SAC9B,OAAOA,OAAM,0BAA0B,YAAY,CAACF,QAAO,KAAKE,OAAM,qBAAqB,MAC7FA,OAAM,uBAAuB,SAC3B,OAAOA,OAAM,uBAAuB,YAAY,CAACF,QAAO,KAAKE,OAAM,kBAAkB,MACvFA,OAAM,iBAAiB,SACrB,OAAOA,OAAM,iBAAiB,YAAY,CAACF,QAAO,KAAKE,OAAM,YAAY,MAC5E,CAAC,CAAC,uBAAuB,YAAY,UAAU,EAAE,SAAS,OAAOA,OAAM,WAAW,CAAC,KACnF,CAAC,MAAM,QAAQA,OAAM,gBAAgB,KAAKA,OAAM,iBAAiB,SAAS,KAAK;AAClF,UAAME,SAAQ,+DAA+D;EAC/E;AACA,QAAM,UAAUF,OAAM,iBAAiB,IAAI,CAAC,SAAS;AACnD,UAAM,SAAS,OAAO,MAAM,kBAAkB;AAC9CC,WAAM,QAAQ,CAAC,YAAY,gBAAgB,eAAe,CAAC;AAC3D,QAAI,OAAO,OAAO,aAAa,YAAY,CAACF,IAAG,KAAK,OAAO,QAAQ,KAC9D,OAAO,OAAO,iBAAiB,YAAY,CAACD,QAAO,KAAK,OAAO,YAAY,KAC3E,OAAO,OAAO,kBAAkB,YAAY,CAACA,QAAO,KAAK,OAAO,aAAa,GAAG;AACnF,YAAMI,SAAQ,kDAAkD;IAClE;AACA,WAAO;MAAE,UAAU,OAAO;MAAU,cAAc,OAAO;MACvD,eAAe,OAAO;IAAoC;EAC9D,CAAC;AACD,MAAI,IAAI,IAAI,QAAQ,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,EAAE,SAAS,QAAQ,QAAQ;AACzE,UAAMA,SAAQ,iDAAiD;EACjE;AACA,QAAM,cAAcF,OAAM;AAC1B,MAAK,gBAAgB,0BAA0BA,OAAM,uBAAuB,QAAQA,OAAM,iBAAiB,SACrG,gBAAgB,eAAeA,OAAM,uBAAuB,QAAQA,OAAM,iBAAiB,SAC3F,gBAAgB,eAAeA,OAAM,uBAAuB,QAAQA,OAAM,iBAAiB,OAAQ;AACvG,UAAME,SAAQ,uEAAuE;EACvF;AACA,QAAM,aAAkC;IACtC;IACA,kBAAkB;IAClB,qBAAqBF,OAAM;IAC3B,mBAAmBA,OAAM;IACzB,uBAAuBA,OAAM;IAC7B,oBAAoBA,OAAM;IAC1B,cAAcA,OAAM;IACpB,kBAAkB;IAClB,qBAAqB;IACrB;EACF;AACA,MAAI,WAAW,UAAU,IAAI,gBAAiB,OAAME,SAAQ,0CAA0C;AACtG,SAAO;AACT;AAEA,SAAS,qBAAqB,eAAuBC,QAAqB;AACxE,MAAI,CAACN,KAAI,KAAK,aAAa,KAAK,WAAWM,MAAK,IAAI,mBAAmBA,OAAM,SAAS,IAAI,GAAG;AAC3F,UAAMD,SAAQ,uEAAuE;EACvF;AACF;AAEA,SAAS,QAAQ,OAAgB,MAAc,SAAiB,SAAiB,MAAyB;AACxG,MAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,WACvC,MAAM,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,CAAC,QAAQ,KAAK,IAAI,CAAC,KACpE,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM,QAAQ;AACzC,UAAMA,SAAQ,uBAAuB,IAAI,sCAAsC;EACjF;AACA,QAAM,SAAS,CAAC,GAAG,KAAK;AACxB,SAAO,OAAO,OAAO,KAAK,IAAI;AAChC;AAEA,SAAS,OAAO,OAAgB,MAAuC;AACrE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAMA,SAAQ,YAAY,IAAI,qBAAqB;AACpH,SAAO;AACT;AAEA,SAASD,OAAM,OAAgC,MAA+B;AAC5E,MAAI,OAAO,KAAK,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,EAAE,OAAO,MAAM,GAAG;AAChG,UAAMC,SAAQ,6DAA6D;EAC7E;AACF;AAEA,SAAS,OAAO,OAAuG;AACrH,SAAO,OAAO,OAAO;IACnB,GAAG;IACH,OAAO,OAAO,OAAO;MACnB,GAAG,MAAM;MACT,kBAAkB,OAAO,OAAO,CAAC,GAAG,MAAM,MAAM,gBAAgB,CAAC;MACjE,kBAAkB,OAAO,OAAO,MAAM,MAAM,iBAAiB,IAAI,CAAC,SAAS,OAAO,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;MACtG,qBAAqB,OAAO,OAAO,CAAC,GAAG,MAAM,MAAM,mBAAmB,CAAC;IACzE,CAAC;EACH,CAAC;AACH;AAEA,SAASA,SAAQE,UAA6B;AAC5C,SAAO,IAAI,WAAW,kBAAkBA,QAAO;AACjD;AEtHA,IAAMC,OAAM;AAEZ,IAAM,aAAa;AACnB,IAAM,iBAAiB,EAAE,cAAc,KAAO,cAAc,IAAI,OAAO,KAAK;AAG5E,eAAsB,6BACpB,UACA,SAA6B,gBACA;AAC7B,mBAAiB,UAAU,MAAM;AACjC,QAAM,aAAa;IACjB,YAAY,SAAS;IACrB,WAAW,SAAS;IACpB,OAAO,CAAC,GAAG,SAAS,KAAK,EACtB,IAAI,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,QAAQ,EAAE,EAC1D,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;EAC9D;AACA,SAAO,UAAU,MAAM,UAAU,cAAc,UAAU,CAAC,CAAC;AAC7D;AA+EA,SAAS,iBAAiB,UAAkC,QAAkC;AAC5F,MAAI,CAAC,WAAW,KAAK,SAAS,UAAU,KAAK,CAACC,KAAI,KAAK,SAAS,SAAS,GAAG;AAC1E,UAAM,IAAI,WAAW,kBAAkB,gDAAgD;EACzF;AACA,MAAI,CAAC,OAAO,cAAc,OAAO,YAAY,KAAK,OAAO,eAAe,KACnE,CAAC,OAAO,cAAc,OAAO,YAAY,KAAK,OAAO,eAAe,KACpE,SAAS,MAAM,SAAS,OAAO,cAAc;AAChD,UAAM,IAAI,WAAW,kBAAkB,8CAA8C;EACvF;AACA,QAAM,QAAQ,oBAAI,IAAY;AAC9B,MAAI,QAAQ;AACZ,aAAW,QAAQ,SAAS,OAAO;AACjC,QAAI,CAAC,KAAK,QAAQ,KAAK,KAAK,WAAW,GAAG,KAAK,KAAK,KAAK,SAAS,IAAI,KACjE,KAAK,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,KAC1E,MAAM,IAAI,KAAK,IAAI,KAAK,OAAO,KAAK,YAAY,UAAU;AAC7D,YAAM,IAAI,WAAW,kBAAkB,sDAAsD;IAC/F;AACA,UAAM,IAAI,KAAK,IAAI;AACnB,aAAS,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,OAAO;EAC1D;AACA,MAAI,QAAQ,OAAO,cAAc;AAC/B,UAAM,IAAI,WAAW,kBAAkB,8CAA8C;EACvF;AACF;;;ArBxLA,SAAS,SAAAC,cAAa;AACtB,SAAS,SAAAC,cAAa;AACtB,SAAS,WAAAC,WAAS,OAAAC,YAAW;ACF7B,SAAS,SAAAH,eAAa;AACtB,SAAS,UAAAI,SAAQ,UAAAC,eAAc;AAC/B,SAAS,kBAAkB;ACF3B,SAAS,cAAAC,cAAY,cAAAC,mBAAkB;AACvC,SAAS,wBAAwB;AACjC,SAAS,SAAAN,eAAa;AACtB,SAAS,QAAAO,aAAY;AGDrB,SAAS,SAAAC,QAAO,WAAAC,UAAS,MAAAC,KAAI,aAAAC,kBAAiB;AAC9C,SAAS,UAAAC,eAAc;AACvB,SAAS,WAAAC,UAAS,QAAAC,QAAM,WAAAC,WAAS,OAAAC,aAAW;ACJ5C,SAAS,YAAAC,YAAU,WAAAC,WAAS,QAAAC,aAAY;AACxC,SAAS,YAAAC,YAAU,WAAAL,iBAAe;;;AgB8E3B,SAAS,uBAAuB,QAA+D;AACpG,SAAO,UAAU,cAAc,MAAM,CAAC;AACxC;AAGO,SAAS,2BAA2B,QAAyD;AAClG,SAAO,UAAU,cAAc,MAAM,CAAC;AACxC;AAGA,eAAsB,yBAAyB,QAA+D;AAC5G,QAAM,WAAW,oBAAI,IAAkC;AACvD,aAAW,UAAU,OAAO,UAAU;AACpC,wBAAoB,MAAM;AAC1B,QAAI,SAAS,IAAI,OAAO,YAAY,EAAG,OAAM,IAAI,WAAW,kBAAkB,gCAAgC;AAC9G,UAAM,EAAE,QAAQ,SAAS,GAAG,WAAW,IAAI;AAC3C,QAAI,MAAM,uBAAuB,UAAU,MAAM,OAAO,OAAQ,OAAM,IAAI,WAAW,kBAAkB,oCAAoC;AAC3I,QAAI,OAAO,OAAO,SAAS,iBAAiB;AAC1C,YAAM,WAAW,OAAO,gBAAgB,OAAO,OAAO,UAAU;AAChE,YAAM,cAAc,YAAY,OAAO,QAAQ,SAAS,MAAM,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,UAAU,SAAS,KAAK,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AAC1J,UAAI,CAAC,YAAY,CAAC,eAAe,SAAS,WAAW,OAAO,OAAO,kBAAkB,MAAM,2BAA2B,SAAS,MAAM,MAAM,SAAS,QAAQ;AAC1J,cAAM,IAAI,WAAW,kBAAkB,yCAAyC;MAClF;IACF;AACA,aAAS,IAAI,OAAO,cAAc,OAAO,OAAO,MAAM,CAAC;EACzD;AACA,QAAM,eAAe,oBAAI,IAAoB;AAE7C,QAAM,MAAM,CAA0B,IAAY,SAAyB;AACzE,UAAM,SAAS,SAAS,IAAI,EAAE;AAC9B,QAAI,CAAC,UAAU,OAAO,OAAO,SAAS,KAAM,OAAM,IAAI,WAAW,uBAAuB,4DAA4D;AACpJ,WAAO;EACT;AACA,QAAM,UAAU,CAA0B,QAAyB,IAAY,SAAyB;AACtG,UAAM,SAAS,IAAI,IAAI,IAAI;AAC3B,QAAI,WAAW,OAAO,KAAK,IAAI,OAAO,mBAAoB,OAAM,IAAI,WAAW,kBAAkB,iDAAiD;AAClJ,WAAO;EACT;AACA,QAAMM,QAAO,CAAI,QAAyB,QAA8B,UAAa,QAAQ,QAAQ,QAAQ,OAAO,YAAY;AAChI,QAAM,aAAqC,OAAO,OAAO;IACvD,SAAS,OAAO,OAAwB,OAAe;AAAE,YAAM,SAAS,QAAQ,OAAO,IAAI,SAAS;AAAG,aAAOA,MAAK,OAAO,QAAQ,eAAe,MAAM,KAAK,CAAC;IAAG;IAChK,SAAS,OAAO,OAAwB,OAAe;AAAE,YAAM,SAAS,QAAQ,OAAO,IAAI,SAAS;AAAG,aAAOA,MAAK,OAAO,QAAQ,eAAe,MAAM,OAAO,OAAO,MAAM,CAAC;IAAG;IAC/K,cAAc,OAAO,OAAwB,OAAe;AAAE,YAAM,SAAS,QAAQ,OAAO,IAAI,eAAe;AAAG,aAAOA,MAAK,OAAO,QAAQ,cAAc,MAAM,OAAO,OAAO,MAAM,CAAC;IAAG;IACzL,MAAM,OAAO,OAAwB,OAAe;AAClD,YAAM,SAAS,QAAQ,OAAO,IAAI,MAAM;AACxC,aAAOA,MAAK,OAAO,QAAQ,WAAW,MAAM,OAAO,OAAO,MAAM,CAAC;IACnE;IACA,MAAM,OAAO,OAAwB,OAAe;AAClD,YAAM,SAAS,QAAQ,OAAO,IAAI,MAAM;AACxC,aAAOA,MAAK,OAAO,QAAQ,cAAc,MAAM,OAAO,OAAO,MAAM,CAAC;IACtE;IACA,cAAc,OAAO,OAAwB,OAAe;AAC1D,YAAM,SAAS,QAAQ,OAAO,IAAI,eAAe;AACjD,YAAM,WAAW,OAAO,gBAAgB,OAAO,OAAO,UAAU;AAChE,YAAM,SAAS,OAAO,MAAM,UAAU,WAAW,UAAU,OAAO,MAAM,KAAK,IAAI;AACjF,UAAI,CAAC,OAAQ,OAAM,IAAI,WAAW,uBAAuB,kDAAkD;AAC3G,aAAOA,MAAK,OAAO,QAAQ,MAAM;IACnC;IACA,QAAQ,OAAO,OAA2B,OAAe;AACvD,YAAM,SAAS,QAAQ,OAAO,IAAI,QAAQ;AAC1C,UAAI,EAAE,MAAM,iBAAiB,YAAa,OAAM,IAAI,WAAW,uBAAuB,mCAAmC;AACzH,aAAOA,MAAK,OAAO,QAAQ,MAAM,UAAU,MAAM,KAAK,CAAC;IACzD;IACA,SAAS,OAAO,OAAyD,QAA2D,OAAe;AACjJ,YAAM,SAAS,QAAQ,OAAO,IAAI,SAAS;AAC3C,YAAM,WAAW,QAAQ,MAAM,OAAO,MAAM;AAC5C,aAAOA,MAAK,OAAO,QAAQ,eAAe,UAAU,OAAO,MAAM,CAAC;IACpE;IACA,MAAM,OAAO,OAAwB,aAAqB,OAAe;AACvE,YAAM,SAAS,QAAQ,OAAO,IAAI,SAAS;AAC3C,YAAM,YAAY,OAAO,aAAa,WAAW;AACjD,UAAI,CAAC,UAAW,OAAM,IAAI,WAAW,uBAAuB,8BAA8B;AAC1F,aAAOA,MAAK,OAAO,QAAQ,kBAAkB,MAAM,OAAO,WAAW,OAAO,aAAa,CAAC;IAC5F;EACF,CAAC;AACD,SAAO,OAAO,OAAO,EAAE,YAAY,QAAQ,CAAC,OAAe,SAAS,IAAI,EAAE,KAAK,cAAc,EAAE,CAAC;AAClG;AAEA,eAAe,QAAW,QAAyB,QAA8B,OAAU,QAA+C;AACxI,QAAM,YAAY,eAAe,MAAM;AACvC,QAAM,WAAW,GAAG,OAAO,YAAY,KAAS,SAAS;AACzD,QAAM,QAAQ,OAAO,IAAI,QAAQ,KAAK;AACtC,MAAI,SAAS,OAAO,0BAA2B,OAAM,IAAI,WAAW,kBAAkB,uDAAuD;AAC7I,SAAO,IAAI,UAAU,QAAQ,CAAC;AAC9B,SAAO,mBAAmB,OAAO,qBAAqB;IACpD,SAAS,OAAO,MAAM;IACtB,YAAY,CAAC,GAAG,OAAO,MAAM,YAAY,EAAE,MAAM,aAAa,IAAI,OAAO,cAAc,QAAQ,OAAO,OAAO,CAAC;IAC9G,cAAc,eAAe,CAAC,MAAM,CAAC;EACvC,CAAC;AACH;AAEA,SAAS,oBAAoB,QAAoC;AAC/D,MAAI,CAAC,OAAO,gBAAgB,CAAC,OAAO,cAAc,OAAO,OAAO,KAAK,OAAO,UAAU,KAAK,CAAC,OAAO,OAAQ,OAAM,IAAI,WAAW,kBAAkB,wCAAwC;AAC1L,MAAI,CAAC,OAAO,cAAc,OAAO,kBAAkB,KAAK,OAAO,qBAAqB,KAAK,CAAC,OAAO,cAAc,OAAO,yBAAyB,KAAK,OAAO,4BAA4B,EAAG,OAAM,IAAI,WAAW,kBAAkB,uCAAuC;AACxQ,QAAM,SAAS,OAAO;AACtB,OAAK,OAAO,SAAS,aAAa,OAAO,SAAS,qBAAqB,CAAC,OAAO,SAAS,OAAO,OAAO,KAAK,CAAC,OAAO,SAAS,OAAO,OAAO,KAAK,OAAO,UAAU,OAAO,SAAU,OAAM,IAAI,WAAW,kBAAkB,wCAAwC;AAChQ,MAAI,OAAO,SAAS,oBAAoB,CAAC,OAAO,cAAc,OAAO,oBAAoB,KAAK,OAAO,uBAAuB,KAAK,OAAO,uBAAuB,IAAK,OAAM,IAAI,WAAW,kBAAkB,iCAAiC;AAC5O,MAAI,OAAO,SAAS,WAAW,OAAO,OAAO,WAAW,KAAK,OAAO,OAAO,KAAK,CAAC,UAAU,OAAO,UAAU,YAAY,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,MAAM,EAAE,SAAS,OAAO,OAAO,QAAS,OAAM,IAAI,WAAW,kBAAkB,uDAAuD;AACxR,MAAI,OAAO,SAAS,oBAAoB,CAAC,OAAO,cAAc,CAAC,OAAO,gBAAiB,OAAM,IAAI,WAAW,kBAAkB,+CAA+C;AAC7K,MAAI,OAAO,SAAS,UAAU,OAAO,WAAW,UAAU,OAAO,WAAW,UAAW,OAAM,IAAI,WAAW,kBAAkB,oCAAoC;AAClK,MAAI,OAAO,SAAS,YAAY,OAAO,cAAc,SAAU,OAAM,IAAI,WAAW,kBAAkB,yCAAyC;AACjJ;AAEA,SAAS,eAAe,OAAyB;AAC/C,MAAI,OAAO,UAAU,UAAW,OAAM,IAAI,WAAW,uBAAuB,mDAAmD;AAC/H,SAAO;AACT;AAEA,SAAS,eAAe,OAAgB,MAAkC;AACxE,MAAI,KAAK,SAAS,aAAa,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,WAAW,QAAQ,KAAK,QAAS,OAAM,IAAI,WAAW,uBAAuB,mDAAmD;AACzO,SAAO;AACT;AAEA,SAAS,cAAc,OAAgB,MAAkC;AACvE,MAAI,KAAK,SAAS,mBAAmB,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,KAAK,WAAW,QAAQ,KAAK,QAAS,OAAM,IAAI,WAAW,uBAAuB,yDAAyD;AAChP,QAAM,OAAO,OAAO,KAAK;AACzB,MAAI,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC,GAAG,UAAU,KAAK,KAAK,qBAAsB,OAAM,IAAI,WAAW,uBAAuB,4DAA4D;AAC9L,SAAO;AACT;AAEA,SAAS,WAAW,OAAgB,MAAkC;AACpE,MAAI,KAAK,SAAS,UAAU,OAAO,UAAU,SAAU,OAAM,IAAI,WAAW,uBAAuB,sDAAsD;AACzJ,QAAM,SAAS,KAAK,gBAAgB,KAAK,OAAO,KAAK,CAAC,SAAS,SAAS,KAAK,IAAI,KAAK,OAAO,KAAK,CAAC,SAAS,KAAK,kBAAkB,OAAO,MAAM,MAAM,kBAAkB,OAAO,CAAC;AAChL,MAAI,WAAW,OAAW,OAAM,IAAI,WAAW,uBAAuB,wCAAwC;AAC9G,SAAO;AACT;AAEA,SAAS,cAAc,OAAgB,MAAkC;AACvE,MAAI,KAAK,SAAS,UAAU,OAAO,UAAU,SAAU,OAAM,IAAI,WAAW,uBAAuB,yDAAyD;AAC5J,QAAM,UAAU,KAAK,WAAW,SAAS,wBAAwB;AACjE,QAAM,UAAU,KAAK,MAAM,KAAK,WAAW,SAAS,GAAG,KAAK,eAAe,KAAK;AAChF,MAAI,CAAC,QAAQ,KAAK,KAAK,KAAK,CAAC,OAAO,SAAS,OAAO,KAAM,KAAK,WAAW,UAAU,IAAI,KAAK,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE,MAAM,MAAQ,OAAM,IAAI,WAAW,uBAAuB,iDAAiD;AAC1O,MAAI,KAAK,YAAY,QAAQ,KAAK,YAAY,KAAK,UAAU,QAAQ,KAAK,OAAQ,OAAM,IAAI,WAAW,uBAAuB,iDAAiD;AAC/K,SAAO;AACT;AAEA,SAAS,QAAQ,OAAiD,QAAmE;AACnI,MAAI,WAAW,kBAAkB,OAAO,UAAU,YAAY,iBAAiB,YAAa,QAAO,WAAW,KAAK;AACnH,MAAI,WAAW,sBAAsB,OAAO,UAAU,SAAU,QAAO,CAAC,GAAG,KAAK,EAAE;AAClF,MAAI,WAAW,gBAAgB,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM;AAClE,QAAM,IAAI,WAAW,uBAAuB,yDAAyD;AACvG;AAEA,SAAS,kBAAkB,OAAgB,WAA8B,YAAgE;AACvI,MAAI,UAAU,SAAS,aAAc,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,KAAK,UAAU,OAAO,MAAM,CAAC,UAAU,OAAO,OAAO,OAAO,KAAK,CAAC;AACjL,MAAI,UAAU,SAAS,gBAAiB,QAAO,OAAO,UAAU,YAAY,aAAa,UAAU,UAAU,GAAG,OAAO,KAAK,MAAM;AAClI,QAAM,SAAS,UAAU,OAAO,SAAS,MAAM,QAAQ,KAAK,IAAI,UAAU,OAAO;AACjF,SAAO,WAAW,UAAU;AAC9B;AAEA,SAAS,eAAe,QAAiC;AACvD,QAAM,WAAW,CAAC,GAAG,OAAO,MAAM,YAAY,GAAG,OAAO,MAAM,aAAa,IAAI,CAAC,eAAe,WAAW,GAAG,CAAC,EAAE,KAAK,CAACC,SAAQA,KAAI,SAAS,UAAU;AACrJ,QAAM,WAAW,OAAO,MAAM,WAAW,CAAC;AAC1C,MAAI,CAAC,YAAY,CAAC,SAAU,OAAM,IAAI,WAAW,uBAAuB,gDAAgD;AACxH,QAAM,MAAM,YAAY;AACxB,SAAO,GAAG,IAAI,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,UAAU,EAAE;AAClD;AAEA,SAAS,gBAAuB;AAC9B,QAAM,IAAI,WAAW,uBAAuB,sCAAsC;AACpF;;;ACvNO,SAAS,mBAAmBC,aAAwC,CAAC,GAAiB;AAC3F,QAAM,OAAO,oBAAI,IAA6B;AAC9C,aAAW,QAAQA,YAAW;AAC5B,QAAI,CAAC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,EAAG,OAAM,IAAI,WAAW,kBAAkB,oDAAoD;AAC9H,2BAAuB,KAAK,KAAK;AACjC,SAAK,IAAI,KAAK,IAAI,IAAI;EACxB;AACA,QAAM,UAAU;IACd,iBAAiB,CAAC,OAAe,UAAgE,mBAAmB,OAAO,oBAAoB,SAAS,oBAAoB,MAAM,IAAI,MAAM,OAAO,CAAC;IACpM,cAAc,CAAC,OAAe,UAAgE,mBAAmB,OAAO,iBAAiB,SAAS,iBAAiB,MAAM,IAAI,MAAM,OAAO,CAAC;IAC3L,SAAS,CAAC,OAAe;AACvB,YAAM,OAAO,KAAK,IAAI,EAAE;AACxB,UAAI,CAAC,KAAM,OAAM,IAAI,WAAW,qBAAqB,2BAA2B;AAChF,aAAO,mBAAmB,KAAK,OAAO,oBAAoB,SAAS,WAAW,IAAI,KAAK,OAAO,CAAC;IACjG;IACA,UAAU,CAAI,OAAU,UAAyB,qBAAqB,OAAO,KAAK;IAClF,mBAAmB,CAAI,OAAU,UAAkF;AACjH,UAAI,CAAC,MAAM,MAAO,OAAM,IAAI,WAAW,kBAAkB,wCAAwC;AACjG,aAAO,qBAAqB,OAAO;QACjC,SAAS,MAAM;QACf,cAAc,MAAM;QACpB,YAAY,CAAC,EAAE,MAAM,mBAAmB,IAAI,MAAM,OAAO,QAAQ,MAAM,OAAO,CAAC;MACjF,CAAC;IACH;EACF;AACA,SAAO,OAAO,OAAO,OAAO;AAC9B;AAEA,SAAS,uBAAuB,OAAgB,OAAO,oBAAI,QAAgB,GAAS;AAClF,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,KAAK,IAAI,KAAK,EAAG;AACpE,OAAK,IAAI,KAAK;AACd,MAAI,aAAa,KAAK,GAAG;AACvB,QAAI,SAAS,KAAK,EAAG,OAAM,IAAI,WAAW,0BAA0B,wDAAwD;AAC5H,2BAAuB,MAAM,OAAO,IAAI;AACxC;EACF;AACA,aAAW,SAAS,OAAO,OAAO,KAAK,EAAG,wBAAuB,OAAO,IAAI;AAC9E;AAEA,SAAS,SAAS,MAAwD,IAAY,SAAmC;AACvH,MAAI,CAAC,GAAI,OAAM,IAAI,WAAW,kBAAkB,mCAAmC;AACnF,SAAO,EAAE,SAAS,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE;AAC/C;;;ACkCO,SAAS,mBAAmB,SAA6B,CAAC,GAAiB;AAChF,QAAM,kBAAkB,IAAI,IAAiB,OAAO,mBAAmB,CAAC,yBAAyB,iBAAiB,aAAa,eAAe,gBAAgB,CAAC;AAC/J,QAAM,aAAa,eAAe,OAAO,yBAAyB,CAAC,CAAC;AACpE,SAAO,OAAO,OAAO,EAAE,UAAU,CAAC,UAAuB,SAAS,OAAO,YAAY,eAAe,EAAE,CAAC;AACzG;AAGO,SAAS,0BAA0B,QAA4C;AACpF,SAAO,UAAU,cAAc,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,CAAC;AACpD;AAEA,eAAe,SAAS,OAAoB,YAA2D,WAA6D;AAClK,QAAM,eAAe,MAAM,UAAU,cAAc,KAAK,CAAC;AACzD,QAAM,aAAa,YAAY,aAAa,MAAM,GAAG,EAAE,CAAC;AACxD,QAAM,OAAO,CAAC,gBAAuC,EAAE,SAAS,QAAQ,YAAY,WAAW;AAC/F,MAAI,CAAC,MAAM,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,OAAO,cAAc,MAAM,KAAK,OAAO,EAAG,QAAO,KAAK,oBAAoB;AAC5I,QAAM,gBAAgB,OAAO,KAAK,MAAM,KAAK,aAAa,EAAE,KAAK;AACjE,QAAM,cAAc,OAAO,KAAK,MAAM,IAAI,EAAE,KAAK;AACjD,MAAI,cAAc,WAAW,YAAY,UAAU,cAAc,KAAK,CAAC,MAAM,UAAU,SAAS,YAAY,KAAK,CAAC,EAAG,QAAO,KAAK,yBAAyB;AAE1J,QAAM,WAAW,oBAAI,IAAyB;AAC9C,aAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,MAAM,IAAI,GAAG;AACpD,QAAI,IAAI,SAAS,MAAM,KAAK,cAAc,IAAI,EAAG,QAAO,KAAK,wBAAwB;AACrF,UAAMC,WAAU,MAAM,iBAAiB,MAAM,KAAK,MAAM,MAAM,UAAU;AACxE,QAAIA,SAAS,QAAO,KAAKA,QAAO;AAChC,QAAI,IAAI,SAAS,cAAc,CAAC,OAAO,IAAI,KAAK,EAAG,UAAS,IAAI,IAAI,KAAK;EAC3E;AACA,MAAI,MAAM,oBAAoB,KAAK,CAAC,UAAU,CAAC,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,EAAG,QAAO,KAAK,2BAA2B;AAC9H,MAAI,SAAS,OAAO,GAAG;AACrB,UAAM,QAAQ,MAAM,KAAK,sBAAsB,oBAAoB,CAAC;AACpE,UAAM,eAAe,OAAO,OAAO,MAAM,IAAI,EAAE,OAAO,CAAC,QAA+D,IAAI,SAAS,aAAa;AAChJ,QAAI,aAAa,WAAW,KAAK,aAAa,KAAK,CAAC,QAAQ,CAAC,MAAM,SAAS,IAAI,MAAM,KAAK,CAAC,EAAG,QAAO,KAAK,mCAAmC;EAChJ;AAEA,QAAM,eAAe,MAAM,qBAAqB,CAAC;AACjD,MAAI,aAAa,KAAK,CAAC,WAAW,CAAC,OAAO,MAAM,KAAK,OAAO,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,CAAC,eAAe,MAAM,CAAC,EAAG,QAAO,KAAK,gBAAgB;AAChK,QAAM,UAAU,aAAa,IAAI,CAAC,WAAW,OAAO,KAAK;AACzD,aAAW,OAAO,OAAO,OAAO,MAAM,IAAI,GAAG;AAC3C,QAAI,QAAQ,KAAK,CAAC,WAAW,CAAC,QAAQ,IAAI,MAAM,MAAM,SAAS,MAAM,CAAC,EAAG,QAAO,KAAK,iBAAiB;EACxG;AACA,QAAM,mBAAmB,OAAO,OAAO,MAAM,IAAI,EAAE,KAAK,CAAC,QAAQ,IAAI,SAAS,aAAa,CAAC,OAAO,IAAI,KAAK,CAAC;AAC7G,MAAI,oBAAoB,MAAM,KAAK,WAAW,mBAAmB,QAAQ,WAAW,EAAG,QAAO,KAAK,iBAAiB;AAEpH,MAAI,UAAU,IAAI,MAAM,KAAK,MAAM,EAAG,QAAO,EAAE,SAAS,oBAAoB,YAAY,YAAY,4BAA4B,aAAa;AAC7I,SAAO,EAAE,SAAS,SAAS,WAAW;AACxC;AAEA,eAAe,iBAAiB,MAAc,KAAmB,MAAsB,YAAwF;AAC7K,MAAI,IAAI,SAAS,iBAAiB,CAAC,OAAO,IAAI,KAAK,EAAG,QAAO;AAC7D,MAAI,IAAI,SAAS,aAAa;AAC5B,QAAI,CAAC,OAAO,IAAI,KAAK,EAAG,QAAO;AAC/B,QAAI,CAAC,eAAe,IAAI,KAAK,EAAG,QAAO;EACzC;AACA,MAAI,IAAI,SAAS,eAAe;AAC9B,QAAI,CAAC,OAAO,IAAI,KAAK,EAAG,QAAO;AAC/B,QAAI,CAAC,eAAe,IAAI,KAAK,EAAG,QAAO;AACvC,UAAM,WAAW,WAAW,IAAI,UAAU;AAC1C,UAAM,cAAc,YAAY,SAAS,OAAO,SAAS,KAAK,SAAS,OAAO,MAAM,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,KAAK,IAAI,IAAI,SAAS,MAAM,EAAE,SAAS,SAAS,OAAO;AACnM,QAAI,CAAC,YAAY,CAAC,eAAe,SAAS,WAAW,IAAI,kBAAkB,MAAM,0BAA0B,SAAS,MAAM,MAAM,SAAS,UAAU,CAAC,SAAS,OAAO,SAAS,IAAI,MAAM,KAAK,EAAG,QAAO;EACxM;AACA,MAAI,IAAI,SAAS,cAAc,CAAC,OAAO,IAAI,KAAK,EAAG,QAAO,uBAAuB,MAAM,IAAI,OAAO,IAAI;AACtG,SAAO;AACT;AAEA,SAAS,eAAe,OAA+B;AACrD,SAAO,MAAM,MAAM,cAAc,mBAAmB,MAAM,MAAM,cAAc;AAChF;AAEA,SAAS,eAAe,YAA0G;AAChI,SAAO,OAAO,OAAO,OAAO,YAAY,OAAO,QAAQ,UAAU,EAAE,IAAI,CAAC,CAAC,IAAI,QAAQ,MAAM,CAAC,IAAI,OAAO,OAAO,EAAE,QAAQ,SAAS,QAAQ,QAAQ,OAAO,OAAO,CAAC,GAAG,SAAS,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5L;AAEA,SAAS,uBAAuB,MAAc,OAA4B,MAA0C;AAClH,QAAM,SAAS,KAAK;AACpB,MAAI,CAAC,UAAU,OAAO,WAAW,KAAK,UAAU,CAAC,OAAO,cAAc,SAAS,IAAI,EAAG,QAAO;AAC7F,MAAI,CAAC,OAAO,oBAAoB,CAAC,OAAO,gBAAgB,OAAO,iBAAiB,WAAW,EAAG,QAAO;AACrG,MAAI,CAAC,CAAC,OAAO,cAAc,OAAO,uBAAuB,OAAO,oBAAoB,OAAO,oBAAoB,EAAE,MAAM,CAAC,UAAU,OAAO,cAAc,KAAK,KAAK,QAAQ,CAAC,EAAG,QAAO;AACpL,MAAI,WAAW,MAAM,KAAK,IAAI,OAAO,qBAAsB,QAAO;AAClE,MAAI,OAAO,MAAM,UAAU,YAAY,qBAAqB,MAAM,KAAK,EAAG,QAAO;AACjF,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAwB;AACpD,QAAM,OAAO,MAAM,KAAK;AACxB,SAAO,uCAAuC,KAAK,IAAI,KAAK,iCAAiC,KAAK,IAAI;AACxG;;;AZzLA,SAAS,cAAAC,mBAAkB;AhBK3B,eAAsB,sBACpB,MACA,QAC6B;AAC7B,QAAM,QAAiD,CAAC;AACxD,QAAM,OAAO,OAAO,cAAqC;AACvD,UAAM,UAAU,MAAMC,SAAQ,WAAW,EAAE,eAAe,KAAK,CAAC;AAChE,eAAW,SAAS,QAAQ,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC,GAAG;AACtF,UAAI,MAAM,eAAe,EAAG,OAAM,IAAI,UAAU,yCAAyC;AACzF,YAAM,SAASC,SAAQ,WAAW,MAAM,IAAI;AAC5C,UAAI,MAAM,YAAY,EAAG,OAAM,KAAK,MAAM;eACjC,MAAM,OAAO,GAAG;AACvB,cAAM,KAAK,EAAE,MAAMC,UAAS,MAAM,MAAM,EAAE,MAAM,IAAI,EAAE,KAAK,GAAG,GAAG,OAAO,CAAC;AACzE,YAAI,MAAM,SAAS,OAAO,SAAU,OAAM,IAAI,UAAU,yCAAyC;MACnG;IACF;EACF;AACA,QAAM,KAAKD,SAAQ,IAAI,CAAC;AACxB,QAAM,OAAOF,YAAW,QAAQ;AAChC,MAAI,QAAQ;AACZ,aAAW,QAAQ,MAAM,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC,GAAG;AACnF,UAAMI,WAAU,MAAMC,UAAS,KAAK,MAAM;AAC1C,aAAS,OAAO,WAAW,KAAK,IAAI,IAAID,SAAQ;AAChD,QAAI,QAAQ,OAAO,SAAU,OAAM,IAAI,UAAU,yCAAyC;AAC1F,SAAK,OAAO,GAAG,OAAO,WAAW,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,IAAIA,SAAQ,UAAU,GAAG;AACjF,SAAK,OAAOA,QAAO;EACrB;AACA,SAAO,UAAU,KAAK,OAAO,KAAK,CAAC;AACrC;AE7BO,IAAM,gCAAgC;AA0I7C,eAAsB,4BAA4B,SAAgD;AAChG,QAAM,cAAc,QAAQ,eAAe;AAC3C,MAAI,CAAC,OAAO,cAAc,WAAW,KAAK,cAAc,OAAS,cAAc,KAAS;AACtF,UAAM,IAAI,UAAU,oDAAoD;EAC1E;AACA,MAAI,UAAU;AACd,KAAG;AACD,QAAI,QAAQ,QAAQ,QAAS;AAC7B,QAAI;AACF,YAAM,WAAW,MAAM,QAAQ,QAAQ,UAAU,QAAQ,gBAAgB,QAAQ,YAAY;AAC7F,YAAM,QAAQ,aAAa,QAAQ;AACnC,gBAAU;AACV,UAAI,QAAQ,KAAM;AAClB,YAAM,KAAK,aAAa,QAAQ,MAAM;IACxC,SAAS,OAAO;AACd,UAAI,QAAQ,QAAQ,QAAS;AAC7B,UAAI,QAAQ,QAAQ,CAAC,wBAAwB,KAAK,EAAG,OAAM;AAC3D,YAAM,QAAQ,UAAU,OAAO,OAAO;AACtC,YAAM,KAAK,SAAS,QAAQ,MAAM;AAClC,gBAAU,KAAK,IAAI,UAAU,GAAG,GAAM;IACxC;EACF,SAAS,CAAC,QAAQ,QAAQ;AAC5B;AAUO,IAAM,wBAAN,MAA4B;EAEjC,YAA6B,SAAmD,QAAkC;AAArF,SAAA,UAAA;AAAmD,SAAA,SAAA;EAAmC;EAAtF;EAAmD;EAD/D,UAAU,oBAAI,IAAqE;EAGpG,MAAM,UAAU,UAA8C;AAC5D,eAAW,WAAW,SAAS,UAAU;AACvC,UAAI,YAAY,KAAK,QAAQ,IAAI,QAAQ,SAAS;AAClD,UAAI,CAAC,WAAW;AACd,YAAI;AACJ,YAAI;AAAE,mBAAS,MAAM,KAAK,OAAO,QAAQ,OAAO;QAAG,SAC5C,OAAO;AACZ,mBAAS,EAAE,QAAQ,UAAU,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,MAAM,GAAG,GAAK,EAAE;QACjH;AACA,oBAAY,EAAE,QAAQ,UAAU,MAAM;AACtC,aAAK,QAAQ,IAAI,QAAQ,WAAW,SAAS;AAC7C,YAAI,KAAK,QAAQ,OAAO,KAAO,MAAK,QAAQ,OAAO,KAAK,QAAQ,KAAK,EAAE,KAAK,EAAE,KAAM;MACtF;AACA,YAAM,KAAK,QAAQ,YAAY,QAAQ,WAAW,UAAU,MAAM;AAClE,UAAI,CAAC,UAAU,UAAU;AACvB,cAAM,KAAK,OAAO,eAAe,SAAS,UAAU,MAAM;AAC1D,kBAAU,WAAW;MACvB;IACF;EACF;AACF;AAEA,SAAS,wBAAwB,OAAyB;AACxD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,UAAU;AAChB,MAAI,QAAQ,SAAS,sBAAsB,OAAO,QAAQ,WAAW,SAAU,QAAO;AACtF,SAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,OAAO,QAAQ,UAAU;AACzG;AAEA,SAAS,KAAK,IAAY,QAAqC;AAC7D,SAAO,IAAI,QAAQ,CAACF,cAAY;AAC9B,QAAI,QAAQ,QAAS,QAAOA,UAAQ;AACpC,UAAM,QAAQ,WAAWA,WAAS,EAAE;AACpC,YAAQ,iBAAiB,SAAS,MAAM;AAAE,mBAAa,KAAK;AAAGA,MAAAA,UAAQ;IAAG,GAAG,EAAE,MAAM,KAAK,CAAC;EAC7F,CAAC;AACH;AD5MO,IAAM,0BAAN,cAAsC,MAAM;EAEjD,YAAYI,UAA0B,QAAyB,OAAO,iBAAiB;AAAE,UAAMA,QAAO;AAAhE,SAAA,SAAA;AAAyB,SAAA,OAAA;EAA0C;EAAnE;EAAyB;EAD7C,OAAO;AAE3B;AAaO,SAAS,+BAA+B,SAAiE;AAC9G,QAAM,WAAW,kBAAkB,QAAQ,QAAQ;AACnD,MAAI,CAAC,gCAAgC,KAAK,QAAQ,KAAK,EAAG,OAAM,IAAI,UAAU,8BAA8B;AAC5G,QAAM,mBAAmB,QAAQ,oBAAoB;AACrD,MAAI,CAAC,OAAO,cAAc,gBAAgB,KAAK,mBAAmB,OAAS,mBAAmB,MAAS;AACrG,UAAM,IAAI,UAAU,yDAAyD;EAC/E;AACA,QAAM,wBAAwB,QAAQ,yBAAyB,KAAK;AACpE,MAAI,CAAC,OAAO,cAAc,qBAAqB,KAC1C,wBAAwB,OAAU,wBAAwB,KAAK,KAAQ;AAC1E,UAAM,IAAI,UAAU,gEAAgE;EACtF;AACA,QAAMC,WAAU,QAAQ,SAAS;AACjC,QAAMC,QAAO,OAAO,MAAc,MAAe,YAAY,qBAAuC;AAClG,UAAM,UAAU,YAAY,QAAQ,SAAS;AAC7C,UAAM,SAAS,QAAQ,SAAS,YAAY,IAAI,CAAC,QAAQ,QAAQ,OAAO,CAAC,IAAI;AAC7E,QAAIC;AACJ,QAAI;AACFA,kBAAW,MAAMF,SAAQ,GAAG,QAAQ,GAAG,IAAI,IAAI;QAC7C,QAAQ;QAAQ,SAAS,EAAE,eAAe,UAAU,QAAQ,KAAK,IAAI,gBAAgB,mBAAmB;QACxG,MAAM,KAAK,UAAU,IAAI;QAAG,UAAU;QAAS;MACjD,CAAC;IACH,SAAS,OAAO;AACd,UAAI,QAAQ,QAAQ,QAAS,OAAM;AACnC,YAAM,IAAI,wBAAwB,6CAA6C,KAAK,uBAAuB;IAC7G;AACA,UAAM,QAAQ,MAAME,UAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACpD,QAAI,CAACA,UAAS,IAAI;AAChB,YAAM,UAAUC,QAAOA,QAAO,KAAK,GAAG,KAAK;AAC3C,YAAM,IAAI;QACR,OAAO,SAAS,YAAY,WAAW,QAAQ,UAAU,gCAAgCD,UAAS,MAAM;QACxGA,UAAS;QAAQ,OAAO,SAAS,SAAS,WAAW,QAAQ,OAAO;MACtE;IACF;AACA,WAAO;EACT;AACA,SAAO;IACL,WAAW,OAAO,SAAS,iBAAiB;AAC1C,wBAAkB,SAAS,YAAY;AACvC,aAAO,cAAc,MAAMD,MAAK,oCAAoC,EAAE,gBAAgB,SAAS,aAAa,CAAC,CAAC;IAChH;IACA,aAAa,OAAO,WAAW,WAAW;AACxC,UAAI,CAAC,sBAAsB,KAAK,SAAS,EAAG,OAAM,IAAI,UAAU,iCAAiC;AACjG,YAAMA,MAAK,mCAAmC,SAAS,QAAQ,MAAM;IACvE;IACA,QAAQ,OAAO,cAAc;MAC3B,MAAMA,MAAK,mCAAmC,eAAe,SAAS,CAAC,WAAW,CAAC,CAAC;IACtF;IACA,OAAO,OAAO,WAAW,cAAc;AACrC,YAAM,QAAQE,QAAO,MAAMF;QACzB,mCAAmC,eAAe,SAAS,CAAC;QAAc;QAAW;MACvF,CAAC;AACD,UAAI,CAAC,SAAS,MAAM,cAAc,UAAU,aAAa,CAACE,QAAO,MAAM,QAAQ,KAAK,CAACA,QAAO,MAAM,OAAO,GAAG;AAC1G,cAAM,IAAI,wBAAwB,mCAAmC,KAAK,kBAAkB;MAC9F;AACA,aAAO;IACT;IACA,QAAQ,OAAO,WAAW,WAAW;MACnC,MAAMF,MAAK,mCAAmC,eAAe,SAAS,CAAC,WAAW,QAAQ,qBAAqB;IACjH;IACA,iBAAiB,OAAO,WAAW,cAAc,iBAAiB;AAChE,UAAI,CAAC,wBAAwB,KAAK,YAAY,EAAG,OAAM,IAAI,UAAU,4BAA4B;AACjG,aAAO,eAAe,MAAMA;QAC1B,mCAAmC,eAAe,SAAS,CAAC;QAC5D,EAAE,cAAc,aAAa;MAC/B,CAAC;IACH;IACA,oBAAoB,OAAO,WAAW,SAAS,UAAU;AACvD,YAAM,aAAa,KAAK,UAAU,KAAK;AACvC,UAAI,CAAC,2BAA2B,KAAK,OAAO,KAAK,CAAC,SAAS,OAAO,UAAU,YACvE,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,aAAa,MAAQ;AAC7D,cAAM,IAAI,UAAU,4BAA4B;MAClD;AACA,YAAMA,MAAK,mCAAmC,eAAe,SAAS,CAAC,gBAAgB,EAAE,SAAS,MAAM,CAAC;IAC3G;IACA,sBAAsB,OAAO,WAAWF,aAAY;AAClD,UAAI,CAACA,SAAQ,KAAK,KAAKA,SAAQ,SAAS,IAAO,OAAM,IAAI,UAAU,8BAA8B;AACjG,YAAME,MAAK,mCAAmC,eAAe,SAAS,CAAC,YAAY,EAAE,SAAAF,SAAQ,CAAC;IAChG;EACF;AACF;AAEA,SAAS,kBAAkB,OAAuB;AAChD,QAAM,WAAW,MAAM,QAAQ,QAAQ,EAAE;AACzC,MAAI;AACJ,MAAI;AAAE,UAAM,IAAI,IAAI,QAAQ;EAAG,QAAQ;AAAE,UAAM,IAAI,UAAU,+BAA+B;EAAG;AAC/F,QAAM,WAAW,IAAI,aAAa,eAAe,IAAI,aAAa,eAAe,IAAI,aAAa;AAClG,MAAI,IAAI,YAAY,IAAI,YAAa,IAAI,aAAa,YAAY,EAAE,YAAY,IAAI,aAAa,UAAW;AAC1G,UAAM,IAAI,UAAU,qEAAqE;EAC3F;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAuB;AAC7C,MAAI,CAAC,uBAAuB,KAAK,KAAK,EAAG,OAAM,IAAI,UAAU,yBAAyB;AACtF,SAAO;AACT;AAEA,SAAS,kBAAkB,SAAiB,cAA6C;AACvF,MAAI,CAAC,QAAQ,KAAK,KAAK,QAAQ,SAAS,GAAI,OAAM,IAAI,UAAU,sDAAsD;AACtH,MAAI,aAAa,oBAAoB,8BAA+B,OAAM,IAAI,UAAU,2CAA2C;AACnI,MAAI,aAAa,aAAa,WAAW,aAAa,aAAa,QAAS,OAAM,IAAI,UAAU,0BAA0B;AAC1H,MAAI,CAAC,aAAa,QAAQ,CAAC,aAAa,QAAQ,UAC3C,CAAC,aAAa,QAAQ,MAAM,CAAC,WAAW,CAAC,aAAa,UAAU,QAAQ,EAAE,SAAS,MAAM,CAAC,GAAG;AAChG,UAAM,IAAI,UAAU,gDAAgD;EACtE;AACA,MAAI,CAAC,OAAO,cAAc,aAAa,QAAQ,KAAK,aAAa,WAAW,KACvE,CAAC,OAAO,cAAc,aAAa,WAAW,KAAK,aAAa,cAAc,GAAG;AACpF,UAAM,IAAI,UAAU,6CAA6C;EACnE;AACF;AAEA,SAAS,cAAc,OAAqC;AAC1D,QAAM,OAAOI,QAAO,KAAK;AACzB,QAAM,OAAOA,QAAO,MAAM,IAAI;AAC9B,MAAI,CAAC,QAAQ,OAAO,KAAK,WAAW,YAAY,OAAO,KAAK,mBAAmB,YAC1E,CAAC,OAAO,cAAc,KAAK,UAAU,KAAK,KAAK,cAAc,QAC7D,CAAC,MAAM,QAAQ,MAAM,QAAQ,KAAK,KAAK,SAAS,SAAS,QACzD,CAAC,MAAM,QAAQ,MAAM,QAAQ,KAAK,KAAK,SAAS,SAAS,GAAI,OAAM,QAAQ,WAAW;AAC3F,QAAM,aAAa,oBAAI,IAAY;AACnC,QAAM,WAAW,KAAK,SAAS,IAAI,CAAC,SAAS;AAC3C,UAAM,UAAUA,QAAO,IAAI;AAC3B,QAAI,CAAC,WAAW,OAAO,QAAQ,cAAc,YAAY,OAAO,QAAQ,UAAU,YAC5E,QAAQ,QAAQ,SAAS,QAAQ,QAAQ,UAC1C,OAAO,QAAQ,YAAY,YAAY,QAAQ,WAAW,KAAK,UAC/D,CAAC,OAAO,cAAc,QAAQ,UAAU,KAAK,OAAO,QAAQ,UAAU,IAAI,KAAK,QAAQ,cAAc,QACrG,WAAW,IAAI,QAAQ,SAAS,GAAG;AACtC,YAAM,QAAQ,SAAS;IACzB;AACA,eAAW,IAAI,QAAQ,SAAS;AAChC,WAAO;EACT,CAAC;AACD,QAAM,aAAa,oBAAI,IAAY;AACnC,QAAM,mBAAmB,oBAAI,IAAY;AACzC,QAAM,WAAW,KAAK,SAAS,IAAI,CAAC,SAAS;AAC3C,UAAM,UAAUA,QAAO,IAAI;AAC3B,UAAM,UAAU,SAAS,KAAK,CAAC,cAAc,UAAU,cAAc,SAAS,SAAS;AACvF,UAAM,cAAc,GAAG,OAAO,SAAS,UAAU,CAAC,IAAI,OAAO,SAAS,QAAQ,CAAC;AAC/E,QAAI,CAAC,WAAW,OAAO,QAAQ,cAAc,YAAY,CAAC,sBAAsB,KAAK,QAAQ,SAAS,KACjG,OAAO,QAAQ,eAAe,YAAY,OAAO,QAAQ,cAAc,YACvE,CAAC,uBAAuB,KAAK,QAAQ,SAAS,KAC9C,OAAO,QAAQ,UAAU,YAAa,QAAQ,QAAQ,SAAS,QAAQ,QAAQ,UAC/E,QAAQ,WAAW,KAAK,UAAU,CAAC,WAAW,QAAQ,UAAU,QAAQ,SACxE,QAAQ,eAAe,QAAQ,qBAAqB,CAAC,OAAO,cAAc,QAAQ,QAAQ,KAC1F,OAAO,QAAQ,QAAQ,IAAI,KAAK,WAAW,IAAI,QAAQ,SAAS,KAAK,iBAAiB,IAAI,WAAW,KACrG,CAAC,CAAC,SAAS,UAAU,mBAAmB,QAAQ,EAAE,SAAS,OAAO,QAAQ,IAAI,CAAC,KAC/E,CAACA,QAAO,QAAQ,OAAO,KAAK,CAAC,OAAO,cAAc,QAAQ,SAAS,EAAG,OAAM,QAAQ,SAAS;AAClG,eAAW,IAAI,QAAQ,SAAS;AAChC,qBAAiB,IAAI,WAAW;AAChC,WAAO;EACT,CAAC;AACD,SAAO,EAAE,MAAsD,UAAU,SAAS;AACpF;AAEA,eAAe,YAAY,OAAoD;AAC7E,QAAM,WAAWA,QAAOA,QAAO,KAAK,GAAG,QAAQ;AAC/C,MAAI,CAAC,YAAY,OAAO,SAAS,eAAe,YAAY,OAAO,SAAS,cAAc,YACrF,OAAO,SAAS,eAAe,YAAY,CAAC,MAAM,QAAQ,SAAS,KAAK,EAAG,OAAM,QAAQ,QAAQ;AACtG,QAAM,QAAQ,SAAS,MAAM,IAAI,CAACC,WAAU;AAC1C,UAAM,OAAOD,QAAOC,MAAK;AACzB,QAAI,CAAC,QAAQ,OAAO,KAAK,SAAS,YAAY,OAAO,KAAK,YAAY,SAAU,OAAM,QAAQ,aAAa;AAC3G,WAAO,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,QAAQ;EAClD,CAAC;AACD,QAAM,kBAAkB,SAAS,eAAe,SAAY,CAAC,IAAI,SAAS;AAC1E,MAAI,CAAC,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,EAAG,OAAM,QAAQ,mBAAmB;AACpG,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,aAAa,CAAC;AACpB,aAAW,QAAQ,iBAAiB;AAClC,UAAM,YAAYD,QAAO,IAAI;AAC7B,QAAI,CAAC,aAAa,OAAO,UAAU,UAAU,YAAY,CAAC,yBAAyB,KAAK,UAAU,KAAK,KAClG,QAAQ,IAAI,UAAU,KAAK,KAAK,UAAU,UAAU,aACpD,OAAO,UAAU,eAAe,YAAY,OAAO,UAAU,cAAc,YAC3E,OAAO,UAAU,eAAe,YAAY,CAAC,MAAM,QAAQ,UAAU,KAAK,EAAG,OAAM,QAAQ,kBAAkB;AAClH,YAAQ,IAAI,UAAU,KAAK;AAC3B,UAAM,iBAAiB,UAAU,MAAM,IAAI,CAAC,UAAU;AACpD,YAAM,OAAOA,QAAO,KAAK;AACzB,UAAI,CAAC,QAAQ,OAAO,KAAK,SAAS,YAAY,OAAO,KAAK,YAAY,SAAU,OAAM,QAAQ,uBAAuB;AACrH,aAAO,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,QAAQ;IAClD,CAAC;AACD,UAAME,UAAS,EAAE,YAAY,UAAU,YAAY,WAAW,UAAU,WAAW,OAAO,eAAe;AACzG,UAAM,kBAAkB,MAAM,6BAA6BA,SAAQ,EAAE,cAAc,KAAQ,cAAc,KAAK,OAAO,KAAK,CAAC;AAC3H,QAAI,oBAAoB,UAAU,WAAY,OAAM,QAAQ,yBAAyB;AACrF,eAAW,KAAK,EAAE,OAAO,UAAU,OAAO,GAAGA,SAAQ,YAAY,gBAAgB,CAAC;EACpF;AACA,QAAM,SAAS,EAAE,YAAY,SAAS,YAAY,WAAW,SAAS,WAAW,MAAM;AACvF,QAAM,SAAS,MAAM,6BAA6B,QAAQ,EAAE,cAAc,KAAQ,cAAc,KAAK,OAAO,KAAK,CAAC;AAClH,MAAI,WAAW,SAAS,WAAY,OAAM,QAAQ,eAAe;AACjE,SAAO,EAAE,GAAG,QAAQ,YAAY,QAAQ,GAAI,WAAW,SAAS,EAAE,WAAW,IAAI,CAAC,EAAG;AACvF;AAEA,SAAS,YAAY,OAA2C;AAC9D,QAAM,SAASF,QAAOA,QAAO,KAAK,GAAG,MAAM;AAC3C,MAAI,CAAC,UAAU,CAAC,CAAC,YAAY,UAAU,EAAE,SAAS,OAAO,OAAO,OAAO,CAAC,KACnE,OAAO,OAAO,iBAAiB,YAAY,CAAC,wBAAwB,KAAK,OAAO,YAAY,KAC5F,OAAO,OAAO,aAAa,YAAY,CAAC,OAAO,YAC/C,OAAO,OAAO,UAAU,YAAY,CAAC,OAAO,SAC5C,CAAC,OAAO,cAAc,OAAO,aAAa,KAAK,OAAO,OAAO,aAAa,IAAI,EAAG,OAAM,QAAQ,QAAQ;AAC5G,SAAO;AACT;AAEA,SAAS,eAAe,OAA8C;AACpE,QAAM,YAAYA,QAAOA,QAAO,KAAK,GAAG,SAAS;AACjD,MAAI,CAAC,aAAa,OAAO,UAAU,gBAAgB,YAAY,CAAC,uBAAuB,KAAK,UAAU,WAAW,KAC5G,CAAC,CAAC,aAAa,YAAY,aAAa,QAAQ,EAAE,SAAS,OAAO,UAAU,MAAM,CAAC,GAAG;AACzF,UAAM,QAAQ,WAAW;EAC3B;AACA,SAAO,EAAE,aAAa,UAAU,aAAa,QAAQ,UAAU,OAAiD;AAClH;AAEA,IAAMA,UAAS,CAAC,UAAmD,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACzH,QAAmC;AACvC,IAAM,UAAU,CAAC,SAAiB,IAAI,wBAAwB,wBAAwB,IAAI,aAAa,KAAK,kBAAkB;AGxO9H,IAAM,WAAW,oBAAI,IAAI,CAAC,QAAQ,SAAS,aAAa,gBAAgB,QAAQ,UAAU,CAAC;AAC3F,IAAM,SAAS;AACf,IAAM,OAAO;AACb,IAAM,YAAY;AAGX,SAAS,kBAAkBG,QAAe,UAA4B;AAC3E,MAAI,CAACA,UAAS,OAAO,WAAWA,MAAK,IAAI,YAAYA,OAAM,SAAS,IAAI,KAAKA,OAAM,SAAS,IAAI,GAAG;AACjG,UAAM,IAAI,UAAU,sDAAsD;EAC5E;AACA,MAAI,UAAU,KAAKA,MAAK,KAAK,oCAAoC,KAAKA,MAAK,GAAG;AAC5E,UAAM,IAAI,UAAU,sEAAsE;EAC5F;AACA,QAAM,QAAkB,CAAC;AACzB,QAAM,QAAQA,OAAM,MAAM,IAAI;AAC9B,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,OAAO,MAAM,KAAK;AACxB,QAAI,CAAC,KAAK,WAAW,aAAa,EAAG;AACrC,UAAM,QAAQ,iCAAiC,KAAK,IAAI;AACxD,UAAM,OAAO,QAAQ,CAAC;AACtB,QAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,SAAS,MAAM,CAAC,EAAG,OAAM,IAAI,UAAU,oDAAoD;AACvH,yBAAqB,IAAI;AACzB,UAAM,SAAS,MAAM,MAAM,QAAQ,CAAC,EAAE,UAAU,CAAC,cAAc,UAAU,WAAW,aAAa,CAAC;AAClG,UAAM,UAAU,MAAM,MAAM,QAAQ,GAAG,SAAS,IAAI,MAAM,SAAS,QAAQ,IAAI,MAAM;AACrF,UAAM,UAAU,QAAQ,KAAK,CAAC,cAAc,UAAU,WAAW,MAAM,CAAC,GAAG,MAAM,CAAC;AAClF,UAAM,UAAU,QAAQ,KAAK,CAAC,cAAc,UAAU,WAAW,MAAM,CAAC,GAAG,MAAM,CAAC;AAClF,QAAI,CAAC,gBAAgB,SAAS,MAAM,GAAG,KAAK,CAAC,gBAAgB,SAAS,MAAM,GAAG,GAAG;AAChF,YAAM,IAAI,UAAU,mDAAmD;IACzE;AACA,UAAM,KAAK,IAAI;EACjB;AACA,MAAI,CAAC,MAAM,UAAU,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM,OAAQ,OAAM,IAAI,UAAU,sCAAsC;AACrH,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA2B,MAAc,QAA4B;AAC5F,SAAO,UAAU,eAAe,UAAU,GAAG,MAAM,IAAI,IAAI;AAC7D;AAGO,SAAS,qBAAqB,MAAoB;AACvD,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,MAAI,CAAC,KAAK,KAAK,IAAI,KAAK,MAAM,KAAK,CAAC,SAAS,SAAS,OAAO,SAAS,QAAQ,SAAS,IAAI,IAAI,CAAC,KAC3F,MAAM,KAAK,CAAC,SAAS,OAAO,KAAK,IAAI,CAAC,GAAG;AAC5C,UAAM,IAAI,UAAU,gDAAgD;EACtE;AACF;AAGO,SAAS,gBAAgB,cAAsB,MAAsB;AAC1E,uBAAqB,IAAI;AACzB,QAAM,OAAOX,UAAQ,YAAY;AACjC,QAAM,SAASA,UAAQ,MAAM,IAAI;AACjC,MAAI,WAAW,QAAQ,CAAC,OAAO,WAAW,GAAG,IAAI,GAAGY,IAAG,EAAE,EAAG,OAAM,IAAI,UAAU,mCAAmC;AACnH,SAAO;AACT;AAGA,eAAsB,eAAe,cAAsBD,QAAe,OAAyC;AACjH,QAAM,SAAS,cAAcA,QAAO,IAAI;AACxC,QAAM,SAAS,cAAcA,QAAO,KAAK;AACzC,aAAW,QAAQ,OAAO;AACxB,QAAI;AACF,YAAM,OAAO,MAAME,OAAM,gBAAgB,cAAc,IAAI,CAAC;AAC5D,UAAI,KAAK,eAAe,KAAM,CAAC,KAAK,OAAO,KAAK,CAAC,KAAK,YAAY,GAAI;AACpE,cAAM,IAAI,UAAU,6CAA6C;MACnE;IACF,SAAS,QAAQ;AACf,UAAK,OAAiC,SAAS,SAAU,OAAM;IACjE;EACF;AACF;AAEA,SAAS,SAAS,KAAaF,QAAe,OAA+B;AAC3E,SAAO,IAAI,QAAQ,CAAC,QAAQ,WAAW;AACrC,UAAM,OAAO,CAAC,SAAS,aAAa,uBAAuB,GAAI,QAAQ,CAAC,SAAS,IAAI,CAAC,GAAI,GAAG;AAC7F,UAAM,QAAQG,OAAM,OAAO,MAAM;MAC/B;MAAK,OAAO;MAAO,OAAO,CAAC,QAAQ,UAAU,MAAM;MACnD,KAAK,EAAE,MAAM,QAAQ,IAAI,QAAQ,IAAI,qBAAqB,KAAK,mBAAmB,YAAY;IAChG,CAAC;AACD,QAAI,SAAS;AACb,UAAM,OAAO,YAAY,MAAM;AAC/B,UAAM,OAAO,GAAG,QAAQ,CAAC,SAAiB;AAAE,UAAI,OAAO,SAAS,IAAO,WAAU,KAAK,MAAM,GAAG,GAAK;IAAG,CAAC;AACxG,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,QAAQ,CAAC,SAAS,SAAS,IAAI,OAAO,IAAI,OAAO,IAAI,UAAU,wBAAwB,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;AACjI,UAAM,MAAM,IAAIH,MAAK;EACvB,CAAC;AACH;AD3DA,eAAsB,8BACpB,OACiC;AACjC,QAAM,UAAU,MAAM,qBAAqB,MAAM;AACjD,MAAI,CAAC,OAAO,cAAc,OAAO,KAAK,UAAU,KAAK,UAAU,MAAM,MAAM;AACzE,UAAM,IAAI,UAAU,uDAAuD;EAC7E;AACA,QAAMA,SAAQ,MAAM,MAAM,UAAU,MAAM,OAAO;AACjD,MAAIA,OAAO,mBAAkBA,QAAO,OAAO;AAC3C,SAAO,6BAA6B,EAAE,eAAe,MAAM,eAAe,OAAAA,QAAO,OAAO,MAAM,MAAM,CAAC;AACvG;AAGA,eAAsB,+BACpB,OAC0C;AAC1C,QAAM,aAAa,MAAM,6BAA6B,MAAM,UAAU;AACtE,MAAI,WAAW,kBAAkB,MAAM,sBAAsB;AAC3D,UAAM,IAAI,UAAU,2DAA2D;EACjF;AACA,QAAM,YAAY,MAAM,eAAe,MAAM,gBAAgB,MAAM,KAAK;AACxE,MAAI;AACF,QAAI,WAAW,OAAO;AACpB,YAAM,QAAQ,kBAAkB,WAAW,OAAO,MAAM,IAAI;AAC5D,YAAM,eAAe,UAAU,cAAc,WAAW,OAAO,KAAK;IACtE;AACA,WAAO,EAAE,WAAW,WAAW;EACjC,SAAS,OAAO;AACd,UAAM,UAAU,QAAQ;AACxB,UAAM;EACR;AACF;AEzDA,IAAM,gBAAgB;AACtB,IAAM,wBAAwB;AAGvB,SAAS,yBACd,QACA,cACAI,SACA,OAAO,eAAe,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC,IACrC;AACV,wBAAsBA,OAAM;AAC5B,MAAI,UAAU,KAAK,YAAY,EAAG,OAAM,IAAI,UAAU,sDAAsD;AAC5G,QAAM,MAAM,OAAOC,YAAW,aAAaA,QAAO,IAAI;AACtD,QAAM,MAAM,OAAOC,YAAW,aAAaA,QAAO,IAAI;AACtD,QAAM,SAAS;IACb,MAAMF,QAAO,QAAQ;IACrB,QAAQA,QAAO,UAAU;IACzB,MAAMA,QAAO,QAAQ;IACrB,OAAOA,QAAO,cAAc,KAAK,OAAO;EAC1C;AACA,MAAI,WAAW,aAAa;AAC1B,WAAO;MACL;MAAO;MAAQ,UAAU,IAAI;MAAI;MAAkB;MAAe;MAClE,YAAY,OAAO,MAAM;MAAI,UAAU,OAAO,IAAI;MAAI,UAAU,GAAG,IAAI,GAAG;MAAI;MAC9E,4BAA4B,YAAY;MAAsB;MAC9D;MAAcA,QAAO;MAAO,GAAGA,QAAO;IACxC;EACF;AACA,SAAO;IACL;IAAO;IAAQ,UAAU,IAAI;IAAI;IAAgB;IAAkB;IAAe;IAClF;IAAoC,gBAAgB,OAAO,IAAI;IAC/D,YAAY,OAAO,MAAM;IAAI,UAAU,OAAO,IAAI;IAAI,UAAU,GAAG,IAAI,GAAG;IAC1E,4CAA4C,OAAO,KAAK;IACxD,yBAAyB,YAAY;IAAmB;IACxD;IAAcA,QAAO;IAAO,GAAGA,QAAO;EACxC;AACF;AAGO,SAAS,8BAA8B,QAA6C;AACzF,SAAO;IACL,MAAM,IAAI,OAAkC;AAC1C,YAAM,8BAA8B,MAAM;AAC1C,YAAM,OAAO,eAAe,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC;AACrD,YAAM,OAAO,yBAAyB,QAAQ,MAAM,cAAc,MAAM,QAAQ,IAAI;AACpF,aAAO,QAAQ,QAAQ,MAAM,MAAM,MAAM,QAAQ,MAAM,MAAM;IAC/D;EACF;AACF;AAGO,SAAS,sBAAsBA,SAA+B;AACnE,QAAM,cAAc,YAAYA,QAAO,UAAU,IAAI;AACrD,QAAM,aAAaA,QAAO,cAAc,KAAK,OAAO;AACpD,QAAM,YAAYA,QAAO,qBAAqB,CAAC;AAC/C,oBAAkBA,QAAO,KAAK;AAC9B,MAAI,CAAC,2BAA2B,KAAKA,QAAO,EAAE,KAAKA,QAAO,QAAQ,SAAS,KACtEA,QAAO,QAAQ,SAAS,MAAMA,QAAO,QAAQ,KAAK,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,QAAS,WAAW,KAAK,IAAI,CAAC,KACjH,CAAC,OAAO,cAAcA,QAAO,SAAS,KAAKA,QAAO,YAAY,KAAKA,QAAO,YAAY,KAAK,OAC3F,CAAC,OAAO,cAAcA,QAAO,cAAc,KAAKA,QAAO,iBAAiB,KAAKA,QAAO,iBAAiB,KAAK,OAAO,QACjH,CAAC,OAAO,SAASA,QAAO,QAAQ,CAAC,MAAMA,QAAO,QAAQ,KAAK,QAAQA,QAAO,QAAQ,KAAK,MACvF,cAAc,KAAK,OAAO,QAAQ,cAAc,KAAK,OAAO,OAAO,QACnE,CAAC,OAAO,cAAcA,QAAO,QAAQ,GAAG,MAAMA,QAAO,QAAQ,OAAO,OAAOA,QAAO,QAAQ,OAAO,QACjG,CAAC,OAAO,cAAc,UAAU,KAChC,aAAa,OAAO,QAAQ,aAAa,OAAO,OAAO,QACvD,UAAU,SAAS,MAAM,IAAI,IAAI,UAAU,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC,EAAE,SAAS,UAAU,UACtF,UAAU,KAAK,CAAC,SAAS,CAAC,2BAA2B,KAAK,KAAK,EAAE,KAC/D,CAAC,cAAc,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,sBAAsB,KAAK,IAAI,CAAC,KACtG,CAAC,OAAO,cAAc,KAAK,YAAY,KAAK,KAAK,eAAe,KAChE,KAAK,eAAe,MAAM,OAAO,IAAI,GAAG;AAC7C,UAAM,IAAI,UAAU,yDAAyD;EAC/E;AACF;AAEA,SAAS,YAAY,OAAuB;AAC1C,QAAM,QAAQ,6BAA6B,KAAK,MAAM,YAAY,CAAC;AACnE,MAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAG,QAAO;AACrC,QAAM,QAAQ,MAAM,CAAC,MAAM,MAAM,OAAO,MAAM,CAAC,MAAM,MAAM,QAAQ,IAAI,QAAQ;AAC/E,SAAO,OAAO,MAAM,CAAC,CAAC,IAAI;AAC5B;AAEA,SAAS,QACP,QACA,MACA,MACAA,SACA,QAC2B;AAC3B,SAAO,IAAI,QAAQ,CAAC,QAAQ,WAAW;AACrC,UAAM,UAAU,KAAK,IAAI;AACzB,UAAM,QAAQG,QAAM,QAAQ,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AACrF,UAAM,SAAmB,CAAC;AAC1B,UAAM,SAAmB,CAAC;AAC1B,QAAI,QAAQ;AACZ,QAAI,sBAAsB;AAC1B,QAAI,WAAW;AACf,QAAI,WAAW;AACf,UAAM,OAAO,CAAC,WAA2C;AACvD,UAAI,SAAU;AACd,iBAAW;AACX,iBAAW,WAAW;AACtB,4BAAsB,WAAW;AACjC,YAAM,SAAS,WAAW,cAAc,CAAC,UAAU,WAAW,IAAI,IAAI,CAAC,MAAM,MAAM,IAAI;AACvF,YAAM,SAASA,QAAM,QAAQ,QAAQ,EAAE,OAAO,OAAO,OAAO,SAAS,CAAC;AACtE,aAAO,MAAM;AACb,YAAM,KAAK,SAAS;IACtB;AACA,UAAM,UAAU,CAAC,WAAqB,CAAC,UAAkB;AACvD,eAAS,MAAM;AACf,UAAI,QAAQH,QAAO,eAAgB,MAAK,QAAQ;UAC3C,QAAO,KAAK,KAAK;IACxB;AACA,UAAM,OAAO,GAAG,QAAQ,QAAQ,MAAM,CAAC;AACvC,UAAM,OAAO,GAAG,QAAQ,QAAQ,MAAM,CAAC;AACvC,UAAM,QAAQ,MAAM,KAAK,OAAO;AAChC,YAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACvD,QAAI,QAAQ,QAAS,OAAM;AAC3B,UAAM,QAAQ,WAAW,MAAM,KAAK,SAAS,GAAGA,QAAO,SAAS;AAChE,UAAM,KAAK,SAAS,CAAC,UAAU;AAC7B,mBAAa,KAAK;AAClB,cAAQ,oBAAoB,SAAS,KAAK;AAC1C,aAAO,KAAK;IACd,CAAC;AACD,UAAM,KAAK,QAAQ,CAAC,SAAS;AAC3B,mBAAa,KAAK;AAClB,cAAQ,oBAAoB,SAAS,KAAK;AAC1C,aAAO;QACL,UAAU,QAAQ;QAClB,QAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;QAAG,QAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;QAC7F,YAAY,KAAK,IAAI,IAAI;QAAS;QAAqB;MACzD,CAAC;IACH,CAAC;EACH,CAAC;AACH;ACrHA,IAAMI,OAAM;AACZ,IAAMC,UAAS;AACf,IAAMC,MAAK;AACX,IAAM,OAAO;AACb,IAAM,mBAAmB,CAAC,SAAS,UAAU,YAAY;AACzD,IAAM,mBAAmB,CAAC,YAAY,YAAY,aAAa,YAAY,YAAY,WAAW;AAGlG,eAAsB,oBAAoB,OAAoE;AAC5G,QAAM,SAASC,UAAS,KAAK;AAC7B,QAAM,SAAS,EAAE,UAAU,OAAO,cAAc,UAAU,OAAO,aAAa;AAC9E,QAAM,SAAS,MAAM,eAAe,MAAM,gBAAgB,MAAM;AAChE,MAAI;AACF,UAAM,aAAa,MAAM,sBAAsB,OAAO,cAAc,MAAM;AAC1E,QAAI,eAAe,MAAM,kBAAmB,OAAM,IAAI,UAAU,mDAAmD;AACnH,UAAM,QAAQ,kBAAkB,MAAM,gBAAgB,OAAO,iBAAiB;AAC9E,UAAM,eAAe,OAAO,cAAc,MAAM,gBAAgB,KAAK;AACrE,UAAM,eAAe,MAAM,sBAAsB,OAAO,cAAc,MAAM;AAC5E,UAAM,eAAe,aAAa,MAAM;AACxC,UAAM,cAAc,YAAY,MAAM,cAAc;AACpD,UAAM,kBAAkB,WAAW;MACjC,sBAAsB,MAAM;MAC5B,mBAAmB,MAAM;MACzB;IACF,CAAC;AACD,UAAM,eAAe,iBAAiB,OAAO,MAAM;AACnD,QAAI,aAAa,SAAS,OAAO,oBAAqB,OAAM,IAAI,UAAU,uCAAuC;AACjH,UAAM,UAA2C,CAAC;AAClD,UAAM,OAAmD,CAAC;AAC1D,eAAWP,WAAU,OAAO,SAAS;AACnC,YAAMQ,SAAQ,MAAM,eAAe,OAAO,cAAc,MAAM;AAC9D,UAAI;AACF,YAAI,MAAM,sBAAsBA,OAAM,cAAc,MAAM,MAAM,cAAc;AAC5E,gBAAM,IAAI,UAAU,gDAAgD;QACtE;AACA,cAAM,SAAS,cAAc,MAAM,MAAM,eAAe,IAAI;UAC1D,cAAcA,OAAM;UAAc,QAAAR;UAAQ,QAAQ,MAAM;QAC1D,CAAC,GAAGA,QAAO,cAAc;AACzB,cAAM,YAAY,MAAM,iBAAiBQ,OAAM,cAAcR,OAAM;AACnE,gBAAQ,KAAK,cAAcA,SAAQ,QAAQ,SAAS,CAAC;AACrD,aAAK,KAAK,EAAE,UAAUA,QAAO,IAAI,GAAG,YAAY,QAAQA,QAAO,cAAc,EAAE,CAAC;MAClF,UAAA;AACE,cAAMQ,OAAM,QAAQ;MACtB;IACF;AACA,UAAM,SAAS;MACb,eAAe;MACf,gBAAgB,MAAM,kBAAkB,UAAUC,YAAW,CAAC;MAC9D,sBAAsB,MAAM;MAC5B,mBAAmB,MAAM;MACzB;MACA;MACA;MACA;MACA;MACA,kBAAkB,aAAa;MAC/B,sBAAsB,WAAW,YAAY;MAC7C,2BAA2B,aAAa,SAAS;MACjD,SAAS,QAAQ,MAAM,CAACT,YAAWA,QAAO,WAAW,QAAQ,IAAI,WAAoB;IACvF;AACA,WAAO;MACL,SAAS,EAAE,GAAG,QAAQ,eAAe,MAAM,8BAA8B,MAAM,EAAE;MACjF,cAAc,OAAO,OAAO,YAAY;MACxC,MAAM,OAAO,OAAO,IAAI;IAC1B;EACF,UAAA;AACE,UAAM,OAAO,QAAQ;EACvB;AACF;AAEA,SAASO,UAAS,OAAmE;AACnF,QAAM,SAAS,MAAM;AACrB,MAAI,CAACH,KAAI,KAAK,MAAM,oBAAoB,KAAK,CAACC,QAAO,KAAK,MAAM,iBAAiB,KAC5E,CAACC,IAAG,KAAK,MAAM,kBAAkB,kBAAkB,KAAK,CAACA,IAAG,KAAK,OAAO,QAAQ,KAChF,OAAO,QAAQ,SAAS,KAAK,OAAO,QAAQ,SAAS,MACrD,IAAI,IAAI,OAAO,QAAQ,IAAI,CAACN,YAAWA,QAAO,EAAE,CAAC,EAAE,SAAS,OAAO,QAAQ,QAAQ;AACtF,UAAM,IAAI,UAAU,uCAAuC;EAC7D;AACA,aAAWA,WAAU,OAAO,QAAS,uBAAsBA,OAAM;AACjE,QAAM,SAA2C;IAC/C,UAAU,OAAO;IACjB,SAAS,OAAO;IAChB,kBAAkB,OAAO,oBAAoB;IAC7C,kBAAkB,OAAO,oBAAoB;IAC7C,qBAAqB,OAAO,uBAAuB;IACnD,mBAAmB,OAAO,qBAAqB,MAAM;IACrD,cAAc,OAAO,gBAAgB;IACrC,cAAc,OAAO,gBAAgB,MAAM,OAAO;EACpD;AACA,MAAI,CAAC,GAAG,OAAO,kBAAkB,GAAG,OAAO,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,KACvF,CAAC,QAAQ,OAAO,qBAAqB,GAAG,GAAM,KAC9C,CAAC,QAAQ,OAAO,mBAAmB,GAAG,IAAI,OAAO,IAAI,KACrD,CAAC,QAAQ,OAAO,cAAc,GAAG,GAAO,KACxC,CAAC,QAAQ,OAAO,cAAc,GAAG,IAAI,OAAO,OAAO,IAAI,GAAG;AAC7D,UAAM,IAAI,UAAU,8CAA8C;EACpE;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,OAA0B,QAAoD;AACtG,SAAO,MAAM,OAAO,CAAC,SAAS,OAAO,iBAAiB,KAAK,CAAC,WAAW,KAAK,SAAS,MAAM,CAAC,KACvF,OAAO,iBAAiB,KAAK,CAAC,WAAW,KAAK,WAAW,MAAM,KAAK,KAAK,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK;AAC9G;AAEA,SAAS,cACPA,SACA,QACA,WAC+B;AAC/B,QAAM,SAAS,OAAO,WAAW,cAAc,OAAO,sBAAsB,mBACxE,OAAO,aAAa,KAAK,UAAU,MAAM,CAAC,SAAS,KAAK,WAAW,UAAU,IAAI,WAAW;AAChG,SAAO;IACL,UAAUA,QAAO;IACjB,cAAc,aAAaA,OAAM;IACjC;IACA,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB;EACF;AACF;AAEA,eAAe,iBACb,cACAA,SAC4C;AAC5C,QAAM,WAA8C,CAAC;AACrD,aAAW,YAAYA,QAAO,qBAAqB,CAAC,GAAG;AACrD,QAAI;AACF,YAAM,OAAOU,MAAK,cAAc,SAAS,IAAI;AAC7C,YAAM,OAAO,MAAMC,QAAM,IAAI;AAC7B,UAAI,CAAC,KAAK,OAAO,KAAK,KAAK,eAAe,GAAG;AAC3C,iBAAS,KAAK,EAAE,YAAY,SAAS,IAAI,QAAQ,WAAW,OAAO,MAAM,QAAQ,KAAK,CAAC;MACzF,WAAW,KAAK,OAAO,SAAS,cAAc;AAC5C,iBAAS,KAAK,EAAE,YAAY,SAAS,IAAI,QAAQ,aAAa,OAAO,KAAK,MAAM,QAAQ,KAAK,CAAC;MAChG,OAAO;AACL,iBAAS,KAAK,EAAE,YAAY,SAAS,IAAI,QAAQ,YAAY,OAAO,KAAK,MAAM,QAAQ,MAAM,SAAS,IAAI,EAAE,CAAC;MAC/G;IACF,SAAS,QAAQ;AACf,UAAK,OAAiC,SAAS,SAAU,OAAM;AAC/D,eAAS,KAAK,EAAE,YAAY,SAAS,IAAI,QAAQ,WAAW,OAAO,MAAM,QAAQ,KAAK,CAAC;IACzF;EACF;AACA,SAAO;AACT;AAEA,SAAS,SAAS,MAA2C;AAC3D,SAAO,IAAI,QAAQ,CAAC,QAAQ,WAAW;AACrC,UAAM,OAAOC,aAAW,QAAQ;AAChC,UAAM,SAAS,iBAAiB,IAAI;AACpC,WAAO,GAAG,QAAQ,CAAC,UAAU;AAAE,WAAK,OAAO,KAAK;IAAG,CAAC;AACpD,WAAO,KAAK,SAAS,MAAM;AAC3B,WAAO,KAAK,OAAO,MAAM,OAAO,UAAU,KAAK,OAAO,KAAK,CAAC,EAAE,CAAC;EACjE,CAAC;AACH;AAEA,SAAS,cAAc,QAA0B,oBAA8C;AAC7F,MAAI,CAAC,QAAQ,OAAO,UAAU,GAAG,GAAG,KAAK,CAAC,QAAQ,OAAO,YAAY,GAAG,KAAK,GAAM,KAC9E,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,WAAW,YAC9D,OAAO,OAAO,wBAAwB,aAAa,OAAO,OAAO,aAAa,WAAW;AAC5F,UAAM,IAAI,UAAU,4CAA4C;EAClE;AACA,QAAM,QAAQ,OAAO,WAAW,OAAO,MAAM,IAAI,OAAO,WAAW,OAAO,MAAM;AAChF,SAAO,QAAQ,qBAAqB,EAAE,GAAG,QAAQ,qBAAqB,KAAK,IAAI;AACjF;AAEA,SAAS,YAAY,QAA0B,SAAqD;AAClG,QAAM,SAAS,OAAO,KAAK,OAAO,MAAM;AACxC,QAAM,SAAS,OAAO,KAAK,OAAO,MAAM;AACxC,QAAM,QAAQ,OAAO,SAAS,GAAG,OAAO;AACxC,SAAO;IACL,QAAQ,MAAM,SAAS,MAAM;IAC7B,QAAQ,OAAO,SAAS,GAAG,KAAK,IAAI,GAAG,UAAU,MAAM,UAAU,CAAC,EAAE,SAAS,MAAM;EACrF;AACF;AAEA,SAAS,aAAa,QAA8D;AAClF,SAAO,WAAW;IAChB,UAAU,OAAO;IACjB,SAAS,OAAO,QAAQ,IAAI,CAACZ,YAAW,iBAAiBA,OAAM,CAAC;IAChE,kBAAkB,CAAC,GAAG,OAAO,gBAAgB,EAAE,KAAK;IACpD,kBAAkB,CAAC,GAAG,OAAO,gBAAgB,EAAE,KAAK;IACpD,qBAAqB,OAAO;IAC5B,mBAAmB,OAAO;IAC1B,cAAc,OAAO;IACrB,cAAc,OAAO;EACvB,CAAC;AACH;AAEA,SAAS,aAAaA,SAA6C;AACjE,SAAO,WAAW,iBAAiBA,OAAM,CAAC;AAC5C;AAEA,SAAS,iBAAiBA,SAAyB;AACjD,SAAO;IACL,IAAIA,QAAO;IAAI,OAAOA,QAAO;IAAO,SAAS,CAAC,GAAGA,QAAO,OAAO;IAAG,WAAWA,QAAO;IACpF,gBAAgBA,QAAO;IAAgB,MAAMA,QAAO,QAAQ;IAAG,QAAQA,QAAO,UAAU;IACxF,MAAMA,QAAO,QAAQ;IAAK,YAAYA,QAAO,cAAc,KAAK,OAAO;IACvE,mBAAmB,CAAC,GAAIA,QAAO,qBAAqB,CAAC,CAAE,EACpD,KAAK,CAAC,MAAM,UAAU,KAAK,GAAG,cAAc,MAAM,EAAE,CAAC,EACrD,IAAI,CAAC,cAAc,EAAE,IAAI,SAAS,IAAI,MAAM,SAAS,MAAM,cAAc,SAAS,aAAa,EAAE;EACtG;AACF;AAEA,SAAS,WAAW,OAAoC;AACtD,SAAO,YAAY,KAAK,UAAU,KAAK,CAAC;AAC1C;AAEA,SAAS,YAAY,OAAmC;AACtD,SAAO,UAAUY,aAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AACnE;AAEA,SAAS,QAAQ,OAAe,SAAiB,SAA0B;AACzE,SAAO,OAAO,cAAc,KAAK,KAAK,SAAS,WAAW,SAAS;AACrE;ACjNA,eAAsB,yBACpB,OACoC;AACpC,QAAMC,SAAQ,MAAM,MAAM,UAAU,MAAM,MAAM,IAAI;AACpD,MAAI,eAA+C;AACnD,MAAI,SAA2C;AAC/C,MAAI,OAAOA,SAAQ,gCAAgC;AACnD,MAAIA,UAAS,MAAM,SAAS,UAAU;AACpC,QAAI;AACF,YAAM,WAAW,MAAM,oBAAoB;QACzC,gBAAgB,UAAU,MAAM,UAAU,MAAM,SAAS,MAAM,CAAC;QAChE,gBAAgB,MAAM,UAAU;QAAa,sBAAsB,MAAM;QACzE,mBAAmB,MAAM;QAAmB,gBAAgBA;QAC5D,QAAQ;UAAE,UAAU;UAAgB,SAAS,MAAM;UACjD,cAAc;UAAQ,cAAc,MAAM,OAAO;QAAK;QACxD,gBAAgB,MAAM;MACxB,CAAC;AACD,UAAI,SAAS,QAAQ,YAAY,UAAU;AACzC,uBAAe,SAAS;AACxB,iBAAS,MAAM,MAAM,OAAOA,QAAO,YAAY;AAC/C,eAAO,OAAO,YAAY,aAAa,qDACnC;MACN,OAAO;AACL,eAAO,8BAA8B,SAAS,QAAQ,QACnD,OAAO,CAACb,YAAWA,QAAO,WAAW,QAAQ,EAAE,IAAI,CAACA,YAAW,GAAGA,QAAO,QAAQ,IAAIA,QAAO,MAAM,EAAE,EAAE,KAAK,IAAI,CAAC;MACrH;IACF,SAAS,OAAO;AACd,aAAO,mDAAmD,QAAQ,KAAK,CAAC;IAC1E;EACF;AACA,QAAM,WAAW,gBAAgB,QAAQ,YAAY;AACrD,QAAM,aAAa,MAAM,8BAA8B;IACrD,WAAW,MAAM;IAAW,eAAe,MAAM;IACjD,OAAO;MAAE,YAAY;MAAM,kBAAkB,MAAM;MACjD,qBAAqB,MAAM;MAC3B,mBAAmB,cAAc,gBAAgB,MAAM;MACvD,uBAAuB;MAAM,oBAAoB,cAAc,iBAAiB;MAChF,cAAc,YAAY,SAAS,OAAO,eAAe;MACzD,kBAAkB,CAAC;MAAG,qBAAqB,CAAC;MAC5C,aAAa,WAAW,aAAa,eAAe,aAAa;IAAsB;EAC3F,CAAC;AACD,SAAO,EAAE,YAAY,cAAc,QAAQ,KAAK;AAClD;AAEA,IAAM,UAAU,CAAC,WAA4B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,MAAM,GAAG,GAAG;AC9C1G,IAAM,+BAAN,MAAmC;EAExC,YAA6B,SAAkB;AAAlB,SAAA,UAAA;EAAmB;EAAnB;EADpB,WAAW,oBAAI,IAAuE;EAG/F,MAAM,QAAQ,SAA6B,QAAqE;AAC9G,WAAO,MAAM,MAAM,iBAAiB;AACpC,UAAM,OAAO;AACb,UAAM,WAAW,MAAM,yBAAyB;MAC9C,WAAW,QAAQ;MAAW,MAAM,OAAO;MAAM,WAAW,OAAO;MACnE,eAAe,OAAO;MAAe,mBAAmB,OAAO;MAC/D,qBAAqB,OAAO;MAAqB,kBAAkB,OAAO;MAC1E,sBAAsB,KAAK,QAAQ;MAAsB,SAAS,KAAK,QAAQ;MAC/E,gBAAgB,KAAK,QAAQ;MAC7B,QAAQ,CAACa,QAAO,iBAAiB,KAAK,QAAQ,QAAQ,OAAO,QAAQ,WAAW,EAAE,OAAAA,QAAO,aAAa,CAAC;IACzG,CAAC;AACD,QAAI,SAAS,QAAQ,YAAY,cAAc,SAAS,cAAc;AACpE,WAAK,SAAS,IAAI,QAAQ,WAAW,EAAE,cAAc,SAAS,cAAc,MAAM,OAAO,iBAAiB,CAAC;IAC7G;AACA,UAAM,KAAK,QAAQ,MAAM,SAAS,EAAE,MAAM,WAAW,OAAO,UAAU,MAAM,SAAS,KAAK,GAAG,OAAO,gBAAgB,EACjH,MAAM,MAAM,MAAS;AACxB,UAAM,OAAO,UAAU,QAAQ;AAC/B,UAAM,KAAK,QAAQ,MAAM,SAAS,EAAE,MAAM,UAAU,QAAQ,eAAe,GAAG,OAAO,gBAAgB,EAClG,MAAM,MAAM,MAAS;AACxB,WAAO,EAAE,QAAQ,gBAAgB,YAAY,SAAS,YAAY,SAAS,sCAAsC;EACnH;EAEA,MAAM,aAAa,SAA6B,QAAoD;AAClG,QAAI,QAAQ,SAAS,qBAAqB,OAAO,WAAW,eAAgB,QAAO;AACnF,UAAM,UAAU,KAAK,SAAS,IAAI,QAAQ,SAAS;AACnD,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,eAAe,UAAU,QAAQ,UAAU,MAAM,QAAQ,MAAM,CAAC;AACtE,UAAM,YAAY,MAAM,KAAK,QAAQ,QAAQ,gBAAgB,QAAQ,WAAW,cAAc,QAAQ,YAAY;AAClH,UAAM,KAAK,QAAQ,MAAM,SAAS;MAAE,MAAM;MAAW,OAAO;MAC1D,MAAM,QAAQ,QAAQ,YAClB,aAAa,UAAU,WAAW,yDAClC,aAAa,UAAU,WAAW;IAAkD,GAAG,QAAQ,IAAI;AACzG,SAAK,SAAS,OAAO,QAAQ,SAAS;AACtC,WAAO;EACT;AACF;ACzDA,IAAMC,YAAW,oBAAI,IAAI,CAAC,QAAQ,SAAS,aAAa,gBAAgB,QAAQ,UAAU,CAAC;AAC3F,IAAMC,UAAS;AASf,eAAsB,6BACpB,UAAqC,WAAWC,QAAO,GACtB;AACjC,MAAI,CAAC,SAAS,MAAM,UAAU,SAAS,MAAM,SAAS,IAAQ,OAAM,IAAI,UAAU,mCAAmC;AACrH,QAAM,OAAO,MAAMC,SAAQP,OAAK,UAAU,mBAAmB,CAAC;AAC9D,QAAM,YAAYA,OAAK,MAAM,QAAQ;AACrC,QAAMQ,OAAM,SAAS;AACrB,QAAM,OAAO,oBAAI,IAAY;AAC7B,MAAI,QAAQ;AACZ,MAAI;AACF,eAAW,QAAQ,SAAS,OAAO;AACjC,mBAAa,KAAK,IAAI;AACtB,UAAI,KAAK,IAAI,KAAK,IAAI,EAAG,OAAM,IAAI,UAAU,4BAA4B;AACzE,WAAK,IAAI,KAAK,IAAI;AAClB,eAAS,OAAO,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,OAAO;AACtE,UAAI,QAAQ,KAAK,OAAO,KAAM,OAAM,IAAI,UAAU,oCAAoC;AACtF,YAAM,SAASC,UAAQ,WAAW,KAAK,IAAI;AAC3C,UAAI,CAAC,OAAO,WAAW,GAAGA,UAAQ,SAAS,CAAC,GAAGC,KAAG,EAAE,EAAG,OAAM,IAAI,UAAU,mCAAmC;AAC9G,YAAMF,OAAMG,SAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,YAAMC,WAAU,QAAQ,KAAK,SAAS,EAAE,MAAM,MAAM,MAAM,IAAM,CAAC;IACnE;AACA,eAAW,aAAa,SAAS,cAAc,CAAC,GAAG;AACjD,oBAAc,UAAU,KAAK;AAC7B,UAAI,CAAC,UAAU,MAAM,UAAU,UAAU,MAAM,SAAS,IAAQ,OAAM,IAAI,UAAU,sCAAsC;AAC1H,iBAAW,QAAQ,UAAU,OAAO;AAClC,qBAAa,KAAK,IAAI;AACtB,cAAM,OAAO,oBAAoB,UAAU,KAAK,IAAI,KAAK,IAAI;AAC7D,YAAI,KAAK,IAAI,IAAI,EAAG,OAAM,IAAI,UAAU,+BAA+B;AACvE,aAAK,IAAI,IAAI;AACb,iBAAS,OAAO,WAAW,IAAI,IAAI,OAAO,WAAW,KAAK,OAAO;AACjE,YAAI,QAAQ,KAAK,OAAO,KAAM,OAAM,IAAI,UAAU,wCAAwC;AAC1F,cAAM,SAASH,UAAQ,WAAW,IAAI;AACtC,YAAI,CAAC,OAAO,WAAW,GAAGA,UAAQ,SAAS,CAAC,GAAGC,KAAG,EAAE,EAAG,OAAM,IAAI,UAAU,sCAAsC;AACjH,cAAMF,OAAMG,SAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,cAAMC,WAAU,QAAQ,KAAK,SAAS,EAAE,MAAM,MAAM,MAAM,IAAM,CAAC;MACnE;IACF;AACA,WAAO,EAAE,WAAW,SAAS,MAAMC,IAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC,EAAE;EAChF,SAAS,OAAO;AACd,UAAMA,IAAG,MAAM,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/C,UAAM;EACR;AACF;AAEA,SAAS,cAAc,OAAqB;AAC1C,MAAI,CAAC,yBAAyB,KAAK,KAAK,KAAK,UAAU,WAAW;AAChE,UAAM,IAAI,UAAU,iCAAiC;EACvD;AACF;AAKA,eAAsB,4BACpB,WAA4B,YACb;AACf,MAAI,QAAQ;AACZ,aAAW,aAAa,YAAY;AAClC,kBAAc,UAAU,KAAK;AAC7B,eAAW,QAAQ,UAAU,OAAO;AAClC,mBAAa,KAAK,IAAI;AACtB,YAAM,OAAO,oBAAoB,UAAU,KAAK,IAAI,KAAK,IAAI;AAC7D,eAAS,OAAO,WAAW,IAAI,IAAI,OAAO,WAAW,KAAK,OAAO;AACjE,UAAI,QAAQ,KAAK,OAAO,KAAM,OAAM,IAAI,UAAU,2CAA2C;AAC7F,iBAAW,QAAQ,CAAC,UAAU,aAAa,UAAU,YAAY,GAAG;AAClE,cAAM,SAASJ,UAAQ,MAAM,IAAI;AACjC,YAAI,CAAC,OAAO,WAAW,GAAGA,UAAQ,IAAI,CAAC,GAAGC,KAAG,EAAE,EAAG,OAAM,IAAI,UAAU,sCAAsC;AAC5G,cAAMF,OAAMG,SAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,cAAMC,WAAU,QAAQ,KAAK,SAAS,EAAE,MAAM,MAAM,MAAM,IAAM,CAAC;MACnE;IACF;EACF;AACF;AAEA,SAAS,aAAa,MAAoB;AACxC,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,MAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,KACzE,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,QAAQR,UAAS,IAAI,IAAI,KAAKC,QAAO,KAAK,IAAI,CAAC,GAAG;AAC5G,UAAM,IAAI,UAAU,qCAAqC;EAC3D;AACF;AE3EA,IAAM,eAAe;AACrB,IAAM,OAAuB,WAAW,gBAAgB,oBAAoB;EAC1E,WAAW;EAAe,WAAW;EAAa,MAAM;EACxD,WAAW;EAAY,SAAS;AAClC,CAAC;AACD,IAAM,QAAwB,WAAW,uBAAuB,uBAAuB;EACrF,WAAW;EAAe,WAAW;EAAa,OAAO;AAC3D,CAAC;AACD,IAAM,SAAyB,WAAW,sBAAsB,kBAAkB;EAChF,WAAW;EAAe,WAAW;EAAa,UAAU;EAAY,cAAc;AACxF,CAAC;AAgBM,SAAS,qBAAqB,SAAgD;AACnF,SAAO;IACL,MAAM,OAAO,UAAU;AACrB,YAAM,OAAO,MAAM,YAAY,OAAO,SAAS,cAAc;AAC7D,YAAM,cAAc,MAAM,mBAAmB;QAC3C,MAAM,iBAAiB,gBAAgB,iBAAiB,MAAM,KAAK;QACnE,MAAM,iBAAiB,gBAAgB,EAAE,MAAM,WAAW,SAAS,GAAG,SAAS,IAAU,CAAC;MAC5F,GAAG,EAAE,iBAAiB,MAAM,MAAM,CAAC;AACnC,YAAM,OAAO,MAAM,YAAY,WAAW,aAAa,OAAO,MAAM,MAAM,MAAM,MAAM,GAAG,cAAc;AACvG,YAAM,QAAQ,MAAM,YAAY,WAAW,QAAQ,OAAO,MAAM,MAAM,WAAW,OAAO,GAAG,cAAc;AACzG,YAAM,MAAM,MAAM,YAAY,WAAW,QAAQ,OAAO,MAAM,MAAM,SAAS,KAAK,GAAG,cAAc;AACnG,UAAI,IAAI,QAAQ,MAAM,MAAO,QAAO;AACpC,aAAO,UAAU,OAAO,SAAS,MAAM,MAAM;QAC3C,GAAG,KAAK;QACR,MAAM,EAAE,MAAM,YAAY,OAAO,KAAK;QACtC,WAAW,EAAE,MAAM,YAAY,OAAO,MAAM;QAC5C,SAAS,EAAE,MAAM,YAAY,OAAO,IAAI;MAC1C,GAAG,CAAC,MAAM,OAAO,GAAG,CAAC;IACvB;IACA,OAAO,OAAO,UAAU;AACtB,YAAM,OAAO,MAAM,YAAY,OAAO,SAAS,qBAAqB;AACpE,YAAMF,SAAQ,OAAO,MAAM,MAAM,OAAO,OAAO;AAC/C,aAAO,UAAU,OAAO,SAAS,MAAM,OAAO;QAC5C,GAAG,KAAK;QAAW,OAAO,EAAE,MAAM,WAAW,OAAOA,OAAM;MAC5D,GAAG,CAAC,CAAC;IACP;IACA,QAAQ,OAAO,UAAU;AACvB,YAAM,OAAO,MAAM,YAAY,OAAO,SAAS,oBAAoB;AACnE,YAAM,cAAc,MAAM,mBAAmB;QAC3C,MAAM,iBAAiB,kBAAkB,mBAAmB,MAAM,SAAS;MAC7E,GAAG,EAAE,mBAAmB,MAAM,UAAU,CAAC;AACzC,YAAMb,UAAS,MAAM,YAAY,WAAW,aAAa,OAAO,MAAM,MAAM,UAAU,QAAQ,GAAG,gBAAgB;AACjH,YAAM,SAAS,OAAO,MAAM,MAAM,cAAc,QAAQ;AACxD,aAAO,UAAU,OAAO,SAAS,MAAM,QAAQ;QAC7C,GAAG,KAAK;QAAW,UAAU,EAAE,MAAM,YAAY,OAAOA,QAAO;QAC/D,cAAc,EAAE,MAAM,WAAW,OAAO,OAAO;MACjD,GAAG,CAACA,OAAM,CAAC;IACb;EACF;AACF;AAEA,SAAS,WAAW,MAAc,QAAqB,eAAgE;AACrH,SAAO,EAAE,MAAM,SAAS,GAAG,QAAQ,aAAa,EAAE,MAAM,SAAS,GAAG,eAAe,UAAU,aAAa,IAAI,MAAM;AACtH;AAEA,eAAe,iBAAiB,IAAY,QAA2D;AACrG,QAAM,aAAa;IACjB,cAAc;IAAI,SAAS;IAAG;IAAQ,oBAAoB;IAC1D,2BAA2B;IAAG,cAAc;EAC9C;AACA,SAAO,EAAE,GAAG,YAAY,QAAQ,MAAM,uBAAuB,UAAU,EAAE;AAC3E;AAEA,eAAe,iBAAiB,IAAY,YAAoB,QAA2B;AACzF,QAAM,UAAU,OAAO,YAAY,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AACxE,SAAO,iBAAiB,IAAI;IAC1B,MAAM;IAAiB;IAAY,gBAAgB,MAAM,2BAA2B,OAAO;EAC7F,CAAC;AACH;AAEA,eAAe,mBAAmB,UAAkC,QAA2C;AAC7G,QAAM,gBAAgB,OAAO,YAAY,MAAM,QAAQ,IAAI,OAAO,QAAQ,MAAM,EAAE,IAAI,OAAO,CAAC,IAAI,OAAO,MAAM;AAC7G,UAAM,UAAU,OAAO,YAAY,QAAQ,IAAI,CAAC,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AACzE,WAAO,CAAC,IAAI,EAAE,QAAQ,SAAS,QAAQ,MAAM,2BAA2B,OAAO,EAAE,CAAC;EACpF,CAAC,CAAC,CAAC;AACH,SAAO,yBAAyB,EAAE,UAAU,cAAc,CAAC;AAC7D;AAEA,eAAe,YAAY,OAAsB,SAAgC,MAAc;AAC7F,QAAM,UAAU,mBAAmB;IACjC,EAAE,IAAI,aAAa,OAAO,MAAM,aAAa,SAAS,MAAM,QAAQ;IACpE,EAAE,IAAI,aAAa,OAAO,SAAS,MAAM,MAAM,OAAO,IAAI,SAAS,MAAM,QAAQ;IACjF,EAAE,IAAI,UAAU,OAAO,QAAQ,UAAU,SAAS,MAAM,QAAQ;EAClE,CAAU;AACV,QAAM,SAAS,MAAM,0BAA0B,CAAC,MAAM,WAAW,CAAC;AAClE,QAAM,YAA2B,CAAC,yBAAyB,iBAAiB,aAAa,aAAa;AACtG,MAAI,QAAQ,wBAAwB,iBAAkB,WAAU,KAAK,gBAAgB;AACrF,QAAM,SAAS,mBAAmB;IAChC,uBAAuB,EAAE,CAAC,YAAY,GAAG,EAAE,QAAQ,QAAQ,CAAC,MAAM,WAAW,EAAE,EAAE;IACjF,iBAAiB;EACnB,CAAC;AACD,QAAM,YAA0C;IAC9C,WAAW,EAAE,MAAM,eAAe,OAAO,QAAQ,QAAQ,WAAW,GAAG,YAAY,cAAc,gBAAgB,OAAO;IACxH,WAAW,EAAE,MAAM,aAAa,OAAO,QAAQ,QAAQ,WAAW,EAAE;EACtE;AACA,SAAO,EAAE,SAAS,QAAQ,WAAW,QAAQ,QAAQ,QAAQ,QAAQ,GAAG,OAAO,GAAG,MAAM,QAAQ,SAAS,IAAI,IAAI,GAAG;AACtH;AAEA,SAAS,OAAO,MAA+C,OAAgB,OAAe;AAC5F,SAAO,KAAK,QAAQ,kBAAkB,OAAO;IAC3C,SAAS,KAAK,OAAO,MAAM;IAAS,OAAO,GAAG,KAAK,KAAK,IAAI,KAAK;EACnE,CAAC;AACH;AAEA,eAAe,UACb,OACA,SACA,MACA,MACA,MACA,qBACkB;AAClB,QAAM,SAAS,MAAM,KAAK,OAAO,SAAS;IACxC,QAAQ,MAAM,MAAM,KAAK;IAAQ;IAAM;IAAM;IAC7C,mBAAmB,CAAC,KAAK,MAAM;EACjC,CAAC;AACD,MAAI,mBAAmB;AACvB,MAAI,OAAO,YAAY,sBAAsB,QAAQ,iBAAiB;AACpE,uBAAmB,MAAM,QAAQ,gBAAgB,SAAS,OAAO,QAAQ,OAAO,KAAK,MAAM,OAAO,YAAY,CAAC;EACjH;AACA,QAAM,QAAQ,aAAa,SAAS,OAAO,QAAQ,kBAAkB,KAAK,IAAI,CAAC;AAC/E,SAAO,OAAO,YAAY,WAAW;AACvC;AAEA,SAAS,SACP,OACA,QACA,kBACA,MACA,cAC6C;AAC7C,SAAO;IACL,OAAO,MAAM;IAAO,SAAS,MAAM;IAAS;IAC5C;IAAQ;IAAkB,cAAc,iBAAiB,OAAO,YAAY,qBAAqB,OAAO,eAAe;EACzH;AACF;ADzJO,SAAS,qBAAqB,SAAmD;AACtF,kBAAgB,OAAO;AACvB,QAAM,UAAU,IAAI,IAAI,QAAQ,QAAQ,IAAI,CAACA,YAAW,CAACA,QAAO,IAAIA,OAAM,CAAC,CAAC;AAC5E,QAAM,SAAS,qBAAqB,OAAO;AAC3C,MAAI,OAAO,QAAQ,QAAQ;AAC3B,SAAO;IACL,QAAQ,SAASwB,UAAS;AACxB,YAAM,SAAS,KAAK,KAAK,MAAM,MAAM,SAASA,UAAS,SAAS,SAAS,MAAM,CAAC;AAChF,aAAO,OAAO,KAAK,MAAM,QAAW,MAAM,MAAS;AACnD,aAAO;IACT;EACF;AACF;AAEA,eAAe,MACb,SACAA,UACA,SACA,SACA,QAC8B;AAC9B,MAAI;AACF,QAAI,QAAQ,QAAQ,QAAS,OAAM,IAAI,UAAU,4BAA4B;AAC7E,QAAIA,SAAQ,SAAS,eAAgB,QAAO,MAAM,KAAK,SAASA,UAAS,SAAS,MAAM;AACxF,QAAIA,SAAQ,SAAS,sBAAuB,QAAO,MAAM,MAAM,SAASA,UAAS,SAAS,MAAM;AAChG,WAAO,MAAM,OAAO,SAASA,UAAS,SAAS,SAAS,MAAM;EAChE,SAAS,QAAQ;AACf,WAAO,SAASA,UAAS,OAAO,kBAAkB,YAAY,OAAO,UAAU,oBAAoB;EACrG;AACF;AAEA,eAAe,KACb,SACAA,UACA,SACA,QAC8B;AAC9B,YAAUA,SAAQ,OAAO,CAAC,QAAQ,aAAa,SAAS,CAAC;AACzD,QAAM,OAAO,YAAYA,SAAQ,OAAO,MAAM;AAC9C,QAAM,YAAY,gBAAgBA,SAAQ,MAAM,SAAS,KAAK;AAC9D,QAAM,UAAU,gBAAgBA,SAAQ,MAAM,OAAO,KAAK,aAAa,QAAQ,gBAAgB,OAAS;AACxG,MAAI,UAAU,aAAa,UAAU,YAAY,KAAK,QAAQ,gBAAgB,MAAQ;AACpF,UAAM,IAAI,UAAU,wCAAwC;EAC9D;AACA,QAAM,QAAQ,MAAM,gBAAgB,QAAQ,cAAc,GAAM;AAChE,QAAM,UAAU,MAAM,OAAO,KAAK,cAAc,SAASA,UAAS,SAAS,EAAE,OAAO,MAAM,WAAW,QAAQ,CAAC,CAAC;AAC/G,MAAI,CAAC,QAAS,QAAO,SAASA,UAAS,OAAO,6BAA6B;AAC3E,QAAM,SAAS,gBAAgB,QAAQ,cAAc,IAAI;AACzD,QAAM,OAAO,MAAMC,MAAK,MAAM;AAC9B,MAAI,CAAC,KAAK,OAAO,KAAK,KAAK,OAAO,KAAK,IAAI,QAAQ,gBAAgB,MAAM,MAAM,IAAI,OAAO,IAAI,GAAG;AAC/F,UAAM,IAAI,UAAU,2CAA2C;EACjE;AACA,QAAM,SAAS,MAAMC,WAAS,MAAM;AACpC,MAAI,OAAO,SAAS,CAAC,EAAG,OAAM,IAAI,UAAU,iDAAiD;AAC7F,QAAM,QAAQ,OAAO,SAAS,MAAM,EAAE,MAAM,IAAI;AAChD,QAAMC,WAAU,MAAM,MAAM,YAAY,GAAG,OAAO,EAAE,KAAK,IAAI;AAC7D,MAAI,OAAO,WAAWA,QAAO,KAAK,QAAQ,gBAAgB,MAAM,OAAO;AACrE,UAAM,IAAI,UAAU,oCAAoC;EAC1D;AACA,SAAO,SAASH,UAAS,MAAMG,UAAS,EAAE,MAAM,WAAW,SAAS,KAAK,IAAI,SAAS,MAAM,MAAM,EAAE,CAAC;AACvG;AAEA,eAAe,MACb,SACAH,UACA,SACA,QAC8B;AAC9B,YAAUA,SAAQ,OAAO,CAAC,OAAO,CAAC;AAClC,QAAM,QAAQ,YAAYA,SAAQ,OAAO,OAAO;AAChD,QAAM,QAAQ,kBAAkB,OAAO,QAAQ,iBAAiB,MAAM,IAAI;AAC1E,MAAI,MAAM,KAAK,CAAC,SAAS,QAAQ,kBAAkB,KAAK,CAAC,WAAW,SAAS,UAAU,KAAK,WAAW,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG;AACtH,UAAM,IAAI,UAAU,4CAA4C;EAClE;AACA,QAAM,UAAU,MAAM,OAAO,MAAM,cAAc,SAASA,UAAS,SAAS,EAAE,OAAO,MAAM,CAAC,CAAC;AAC7F,MAAI,CAAC,QAAS,QAAO,SAASA,UAAS,OAAO,6BAA6B;AAC3E,QAAM,eAAe,QAAQ,cAAc,OAAO,KAAK;AACvD,SAAO,SAASA,UAAS,MAAM,oBAAoB,MAAM,MAAM,aAAa,EAAE,MAAM,CAAC;AACvF;AAEA,eAAe,OACb,SACAA,UACA,SACA,SACA,QAC8B;AAC9B,YAAUA,SAAQ,OAAO,CAAC,UAAU,CAAC;AACrC,QAAM,WAAW,YAAYA,SAAQ,OAAO,UAAU;AACtD,QAAM,eAAe;IACnB,UAAU,QAAQ,2BAA2B;IAC7C,UAAU,QAAQ,2BAA2B,MAAM,OAAO;EAC5D;AACA,QAAM,eAAe,MAAM,sBAAsB,QAAQ,cAAc,YAAY;AACnF,QAAM,UAAU,MAAM,OAAO,OAAO,cAAc,SAASA,UAAS,SAAS;IAC3E,WAAW,CAAC,GAAG,QAAQ,KAAK,CAAC,EAAE,KAAK;IAAG;IAAU;EACnD,CAAC,CAAC;AACF,MAAI,CAAC,QAAS,QAAO,SAASA,UAAS,OAAO,6BAA6B;AAC3E,QAAM,WAAW,QAAQ,IAAI,QAAQ;AACrC,MAAI,CAAC,SAAU,QAAO,SAASA,UAAS,OAAO,gCAAgC;AAC/E,QAAM,SAAS,MAAM,eAAe,QAAQ,cAAc;IACxD,UAAU,aAAa;IACvB,UAAU,aAAa;EACzB,CAAC;AACD,MAAI;AACF,QAAI,MAAM,sBAAsB,OAAO,cAAc,YAAY,MAAM,cAAc;AACnF,YAAM,IAAI,UAAU,8CAA8C;IACpE;AACA,UAAM,SAAS,MAAM,QAAQ,eAAe,IAAI;MAC9C,cAAc,OAAO;MAAc,QAAQ;MAAU,QAAQ,QAAQ;IACvE,CAAC;AACD,UAAM,SAAS,CAAC,OAAO,QAAQ,OAAO,MAAM,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AACvE,UAAM,KAAK,OAAO,aAAa,KAAK,CAAC,OAAO,uBAAuB,CAAC,OAAO;AAC3E,UAAM,SAAS,OAAO,WAAW,cAAc,OAAO,sBAAsB,0BACxE,KAAK,WAAW,oBAAoB,OAAO,QAAQ;AACvD,WAAO,SAASA,UAAS,IAAI,UAAU,QAAQ,IAAI,MAAM,IAAI,SAAS;EAAK,MAAM,KAAK,EAAE,IAAI;MAC1F;MAAU,UAAU,OAAO;MAAU,YAAY,OAAO;MACxD,qBAAqB,OAAO;MAAqB,UAAU,OAAO;IACpE,CAAC;EACH,UAAA;AACE,UAAM,OAAO,QAAQ;EACvB;AACF;AAEA,SAAS,cACP,SACAA,UACA,SACA,OACA;AACA,SAAO;IACL,OAAO,QAAQ;IAAO,SAAAA;IAAS,aAAa,aAAa,QAAQ,MAAM,KAAK,SAAS;IACrF,SAAS,EAAE,MAAM,cAAc,cAAc,CAAC,QAAQ,QAAQ,EAAE;IAAY,GAAG;EACjF;AACF;AAEA,eAAe,gBAAgB,MAAc,OAAkC;AAC7E,QAAM,QAAkB,CAAC;AACzB,QAAM,OAAO,OAAO,cAAqC;AACvD,eAAW,SAAS,MAAMI,UAAQ,WAAW,EAAE,eAAe,KAAK,CAAC,GAAG;AACrE,UAAI,MAAM,eAAe,EAAG,OAAM,IAAI,UAAU,oCAAoC;AACpF,YAAM,SAAST,UAAQ,WAAW,MAAM,IAAI;AAC5C,UAAI,MAAM,YAAY,EAAG,OAAM,KAAK,MAAM;eACjC,MAAM,OAAO,GAAG;AACvB,cAAM,OAAOU,WAAS,MAAM,MAAM,EAAE,MAAM,IAAI,EAAE,KAAK,GAAG;AACxD,YAAI;AAAE,+BAAqB,IAAI;QAAG,QAAQ;AAAE;QAAU;AACtD,cAAM,KAAK,IAAI;AACf,YAAI,MAAM,SAAS,MAAO,OAAM,IAAI,UAAU,2CAA2C;MAC3F;IACF;EACF;AACA,QAAM,KAAKV,UAAQ,IAAI,CAAC;AACxB,SAAO,MAAM,KAAK;AACpB;AAEA,SAAS,gBAAgB,SAAsC;AAC7D,MAAI,CAAC,QAAQ,YAAY,CAAC,QAAQ,QAAQ,UAAU,IAAI,IAAI,QAAQ,QAAQ,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC,EAAE,SAAS,QAAQ,QAAQ,QAAQ;AACnI,UAAM,IAAI,UAAU,kEAAkE;EACxF;AACA,aAAWnB,WAAU,QAAQ,QAAS,uBAAsBA,OAAM;AAClE,MAAI,QAAQ,kBAAkB,KAAK,CAAC,WAAW,CAAC,oBAAoB,KAAK,MAAM,KAAK,WAAW,OAAO,WAAW,IAAI,GAAG;AACtH,UAAM,IAAI,UAAU,8CAA8C;EACpE;AACF;AAEA,SAAS,UAAU,OAAgC,SAAkC;AACnF,MAAI,OAAO,KAAK,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,SAAS,GAAG,CAAC,EAAG,OAAM,IAAI,UAAU,0CAA0C;AAC9H;AAEA,SAAS,YAAY,OAAgC,MAAsB;AACzE,QAAM,QAAQ,MAAM,IAAI;AACxB,MAAI,OAAO,UAAU,YAAY,CAAC,MAAO,OAAM,IAAI,UAAU,GAAG,IAAI,6BAA6B;AACjG,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAoC;AAC3D,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,CAAC,OAAO,cAAc,KAAK,KAAM,QAAmB,EAAG,OAAM,IAAI,UAAU,uCAAuC;AACtH,SAAO;AACT;AAEA,SAAS,SACPwB,UACA,IACAG,UACA,SACqB;AACrB,SAAO,EAAE,WAAWH,SAAQ,WAAW,IAAI,SAAAG,UAAS,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC,EAAG;AACtF;AEpMO,SAAS,oBAAoB,SAAkC,QAAsC;AAC1G,QAAM,UAAUG,SAAO,QAAQ,WAAW;AAC1C,QAAM,OAAO,QAAQ;AACrB,QAAM,QAAQ,QAAQ;AACtB,QAAM,SAAS,QAAQ;AACvB,QAAM,0BAA0B,QAAQ,2BAA2B;AACnE,MAAK,SAAS,YAAY,SAAS,YAAa,OAAO,UAAU,YAAY,OAAO,WAAW,UAAU;AACvG,UAAM,IAAI,UAAU,gBAAgB,SAAS,WAAW,OAAO,WAAW;EAC5E;AACA,QAAM,WAAW,SAAS;AAC1B,QAAM,cAAc,SAAS;AAC7B,QAAM,aAAa,SAAS;AAC5B,QAAM,gBAAgB,SAAS;AAC/B,QAAM,mBAAmB,SAAS;AAClC,MAAI,OAAO,eAAe,YAAY,CAAC,WAAW,SAAS,GAAG,KACzD,OAAO,kBAAkB,YAAY,CAAC,iBAAiB,KAAK,aAAa,KACzE,OAAO,qBAAqB,YAAY,CAAC,wBAAwB,KAAK,gBAAgB,GAAG;AAC5F,UAAM,IAAI,UAAU,gBAAgB,SAAS,WAAW,OAAO,eAAe;EAChF;AACA,MAAI,CAAC,OAAO,cAAc,uBAAuB,KAAK,OAAO,uBAAuB,IAAI,OACnF,OAAO,uBAAuB,IAAI,KAAS;AAC9C,UAAM,IAAI,UAAU,gBAAgB,SAAS,WAAW,OAAO,0BAA0B;EAC3F;AACA,SAAO;IAAE;IAAM;IAAO;IACpB,yBAAyB,OAAO,uBAAuB;IACvD,qBAAqB,OAAO,aAAa,YAAY,wBAAwB,KAAK,QAAQ,IACtF,WAAiC;IACrC,mBAAmB,OAAO,gBAAgB,WAAW,cAAc;IACnE;IAAY;IAAe;EAAyD;AACxF;AAEO,SAAS,gBAAgB,SAAoE;AAClG,QAAM,SAASA,SAAO,QAAQ,MAAM;AACpC,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,OAAO,SAAS,oBAAoB,OAAO,OAAO,eAAe,YAChE,OAAO,OAAO,kBAAkB,YAAY,CAAC,iBAAiB,KAAK,OAAO,aAAa,KACvF,OAAO,OAAO,sBAAsB,YAAY,CAAC,wBAAwB,KAAK,OAAO,iBAAiB,KACtG,OAAO,OAAO,yBAAyB,YAAY,CAAC,wBAAwB,KAAK,OAAO,oBAAoB,KAC5G,OAAO,OAAO,mBAAmB,YAAY,CAAC,wBAAwB,KAAK,OAAO,cAAc,KAChG,OAAO,OAAO,aAAa,aAC3B,CAAC,OAAO,cAAc,OAAO,SAAS,KAAK,OAAO,OAAO,SAAS,IAAI,KAAK,OAAO,OAAO,SAAS,IAAI,OACtG,CAAC,OAAO,cAAc,OAAO,SAAS,KAAK,OAAO,OAAO,SAAS,IAAI,KAAK,OAAO,OAAO,SAAS,IAAI,MAAM,OAAO,QACnH,CAAC,OAAO,cAAc,OAAO,UAAU,KAAK,OAAO,OAAO,UAAU,IAAI,GAAG;AAC9E,UAAM,IAAI,UAAU,0CAA0C;EAChE;AACA,SAAO;AACT;AAEO,SAAS,sBAAsB,SAA0D;AAC9F,QAAM,QAAQ,QAAQ;AACtB,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,UAAU,8BAA8B;AACnH,SAAO;AACT;AAEO,SAAS,cAAc,SAA6BC,WAA6C;AACtG,SAAO;IAAE,iBAAiB;IAA0B,SAAS,QAAQ,QAAQ,SAAS;IACpF,YAAY,QAAQ;IAAmB,WAAW,KAAK,IAAI,IAAI,KAAK,KAAK;IACzE,MAAM;MAAE,QAAQ,QAAQ;MAAW,WAAW,QAAQ;MAAY,OAAOA,UAAS;MAChF,QAAQA,UAAS;MAAQ,WAAW,QAAQ;MAAO,SAASA,UAAS;MACrE,QAAQ;QAAE,SAAS;QAAQ,WAAW,KAAK;QAAQ,gBAAgB,IAAI,OAAO;QAC5E,eAAe,MAAM;MAAK;IAAE;EAAE;AACtC;AAEA,IAAMD,WAAS,CAAC,UAAmB,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACzF,QAAmC;ACrEvC,IAAM,gBAAgB,EAAE,UAAU,KAAQ,UAAU,MAAM,OAAO,KAAK;AAUtE,eAAsB,0BAA0B,OAOqE;AACnH,QAAM,EAAE,SAAS,YAAAE,aAAY,WAAW,YAAY,eAAe,OAAO,IAAI;AAC9E,MAAI,CAAC,aAAa,KAAK,UAAU,UAAU,UAAU,MAAM,KAAK,UAAUA,WAAU,KAC/EA,YAAW,WAAW,YAAY,MAAM,WAAW,YAAY,KAC/DA,YAAW,kBAAkB,eAAe;AAC/C,UAAM,IAAI,UAAU,yEAAyE;EAC/F;AACA,QAAM,YAAY,UACb,MAAM,+BAA+B;IACtC,gBAAgB,UAAU;IAAgB,sBAAsB;IAChE,YAAY,sBAAsB,QAAQ,OAAO;EACnD,CAAC,GAAG,YACF,MAAM,mBAAmB,UAAU,gBAAgB,UAAU,WAAW,aAAa;AACzF,QAAM,oBAAoB,MAAM,sBAAsB,UAAU,aAAa,aAAa;AAC1F,MAAI,sBAAsBA,YAAW,mBAAmB;AACtD,UAAM,UAAU,QAAQ;AACxB,UAAM,IAAI,UAAU,kDAAkD;EACxE;AACA,MAAI,CAAC,UAAU,MAAM,sBAAsB,UAAU,cAAc,aAAa,MAAMA,YAAW,gBAAgB;AAC/G,UAAM,UAAU,QAAQ;AACxB,UAAM,IAAI,UAAU,yDAAyD;EAC/E;AACA,SAAO,EAAE,WAAW,cAAcA,YAAW,gBAAgB,kBAAkB;AACjF;ACvCO,SAAS,4BACd,OAKA,OACA,MACmB;AACnB,QAAM,SAAS,qBAAqB;IAClC,SAAS,MAAM;IAAS,gBAAgB,8BAA8B,MAAM,MAAM;IAClF,qBAAqB,MAAM,uBAAuB;IAClD,UAAU,gBAAgB,MAAM,KAAK,MAAM;IAC3C,kBAAkB,CAAC,kBAAkB;EACvC,CAAC;AACD,SAAO,SAAS,WAAW,SAAS,EAAE,SAAS,CAAC,SAASR,aAAYA,SAAQ,SAAS,iBAClF,OAAO,QAAQ,SAASA,QAAO,IAC/B,QAAQ,QAAQ,EAAE,WAAWA,SAAQ,WAAW,IAAI,OAAO,SAAS,gCAAgC,CAAC,EAAE;AAC7G;ACdA,eAAsB,2BAA2B,OAIlB;AAC7B,QAAM,EAAE,SAAS,UAAAO,WAAU,SAAAP,UAAS,OAAAS,OAAM,IAAI;AAC9C,MAAIA,OAAM,UAAUF,UAAS,yBAAyB;AACpD,QAAI,CAACE,OAAM,eAAe;AACxB,MAAAA,OAAM,gBAAgB;AACtB,YAAM,MAAM,MAAM;QAAE,MAAM;QAAW,OAAO;QAC1C,MAAM,oBAAoBF,UAAS,wBAAwB,eAAe,OAAO,CAAC;MACpF,CAAC,EAAE,MAAM,MAAM,MAAS;IAC1B;AACA,WAAO;MAAE,iBAAiB;MAA0B,MAAM;MACxD,WAAWP,SAAQ;MAAW,UAAU;QACtC,IAAI,UAAU,QAAQ,SAAS;QAAI,UAAU;QAAU,OAAO;QAC9D,MAAM;QAAa,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,8EAA8E,CAAC;QAClI,YAAY;QAAY,OAAO,EAAE,aAAa,GAAG,cAAc,EAAE;MACnE;IAAE;EACN;AACA,QAAM,YAAY,KAAK,IAAI;AAC3B,QAAMU,YAAW,MAAM,MAAM,QAAQ,MAAM,QAAQ,WAAW;IAC5D,WAAWV,SAAQ;IAAW,eAAe,QAAQ;IAAW,MAAMA,SAAQ;EAChF,CAAC;AACD,EAAAS,OAAM,UAAUC,UAAS,QAAQ,cAAcA,UAAS,QAAQ;AAChE,QAAM,MAAM,MAAM;IAAE,MAAM;IAAS,UAAUA,UAAS,QAAQ;IAC5D,OAAOA,UAAS,QAAQ;IAAO,aAAaA,UAAS,QAAQ;IAC7D,cAAcA,UAAS,QAAQ;IAAc,YAAY,KAAK,IAAI,IAAI;IACtE,eAAe,QAAQ;IAAW,mBAAmBD,OAAM;IAC3D,sBAAsBF,UAAS;EACjC,CAAC,EAAE,MAAM,MAAM,MAAS;AACxB,SAAO;IAAE,iBAAiB;IAA0B,MAAM;IACxD,WAAWP,SAAQ;IAAW,UAAUU,UAAS;EAAS;AAC9D;ACxCA,eAAsB,uBACpB,SAAuC,SACvC,OAA6B,MACd;AACf,QAAM,UAAU,GAAG,QAAQ,UAAU,MAAM,GAAG,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;AACpE,OAAK,KAAK,OAAO;AACjB,QAAM,UAAU,MAAM,SAAS,YAC3B,EAAE,GAAG,OAAO,MAAM,MAAM,KAAK,KAAK,EAAE,MAAM,GAAG,GAAM,KAAK,GAAG,MAAM,KAAK,SAAS,IAC/E;AACJ,QAAM,QAAQ,mBAAmB,QAAQ,WAAW,SAAS,OAAO;AACtE;AAEO,IAAM,qBAAqB,CAAC,UACjC,UAAUtB,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AACrD,IAAM,sBAAsB,CAAC,UAA2B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC7G,IAAM,gBAAgB,CAAC,UAC5B,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC;AAC5F,IAAM,kBAAkB,CAAC,UAA2B;AACzD,MAAI;AAAE,WAAO,KAAK,UAAU,KAAK,EAAE,MAAM,GAAG,GAAM;EAAG,QAAQ;AAAE,WAAO;EAAW;AACnF;AACO,SAAS,kBAAkB,OAA+B;AAC/D,QAAMkB,WAAS,cAAc,KAAK;AAClC,MAAIA,YAAU,OAAOA,SAAO,SAAS,SAAU,QAAOA,SAAO,KAAK,MAAM,GAAG,GAAM;AACjF,MAAIA,YAAU,OAAOA,SAAO,UAAU,SAAU,QAAO,cAAcA,SAAO,MAAM,MAAM,GAAG,KAAM,CAAC;AAClG,SAAO;AACT;AAEO,SAAS,mBAAmB,OAA+B;AAChE,QAAMA,WAAS,cAAc,KAAK;AAClC,SAAOA,YAAU,OAAOA,SAAO,UAAU,YAAYA,SAAO,MAAM,KAAK,IACnEA,SAAO,MAAM,KAAK,EAAE,MAAM,GAAG,GAAK,IAAI;AAC5C;ACbO,IAAM,sBAAN,MAA8D;EAMnE,YAA6B,SAAqC;AAArC,SAAA,UAAA;AAC3B,QAAI,QAAQ,uBAAuB,kBAAkB,CAAC,mDAAmD,KAAK,QAAQ,KAAK,EAAG,OAAM,IAAI,UAAU,gEAAgE;AAClN,SAAK,OAAO,QAAQ,cAAc;AAAqB,SAAK,qBAAqB,mBAAO,KAAK,UAAU,QAAQ,OAAO,CAAC;AACvH,SAAK,eAAe,IAAI,6BAA6B;MACnD,SAAS,QAAQ;MAAS,SAAS,QAAQ;MAC3C,gBAAgB,QAAQ,kBAAkB,8BAA8B,QAAQ,MAAM;MACtF,sBAAsB,KAAK;MAC3B,OAAO,CAAC,SAAS,OAAO,SAAS,KAAK,OAAO,SAAS,OAAO,IAAI;IACnE,CAAC;EACH;EAT6B;EALpB,UAAU,oBAAI,IAA2B;EACzC;EACA;EACA;EAaT,QAAQ,SAAgE;AACtE,QAAI,QAAQ,SAAS,kBAAmB,QAAO,KAAK,YAAY,OAAO;AACvE,QAAI,QAAQ,SAAS,SAAU,QAAO,KAAK,QAAQ,OAAO;AAC1D,WAAO,KAAK,OAAO,SAAS,QAAQ,SAAS,QAAQ;EACvD;EAEA,MAAM,aAAa,SAA6B,QAAiD;AAC/F,QAAI,MAAM,KAAK,aAAa,aAAa,SAAS,MAAM,EAAG;AAC3D,UAAM,SAAS,KAAK,QAAQ,IAAI,QAAQ,SAAS;AACjD,QAAI,CAAC,UAAU,OAAO,WAAW,UAAW;AAC5C,WAAO,eAAe;AACtB,QAAI,OAAO,QAAS,OAAM,KAAK,QAAQ,QAAQ,qBAAqB,QAAQ,WAAW,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;EAC9H;EAEA,MAAM,QAAuB;AAC3B,UAAM,WAAW,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC;AAC1C,eAAW,WAAW,SAAU,SAAQ,MAAM,MAAM,kBAAkB;AACtE,UAAM,QAAQ,WAAW,SAAS,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC;AAChE,UAAM,QAAQ,WAAW,SAAS,IAAI,CAAC,YAAY,QAAQ,UAAU,QAAQ,CAAC,CAAC;AAC/E,SAAK,QAAQ,MAAM;EACrB;EAEA,MAAM,OAAO,SAA6B,QAAoD;AAC5F,QAAI,KAAK,QAAQ,IAAI,QAAQ,SAAS,EAAG,OAAM,IAAI,UAAU,gDAAgD;AAC7G,UAAMC,YAAW,oBAAoB,QAAQ,SAAS,MAAM;AAC5D,UAAM,iBAAiB,gBAAgB,QAAQ,OAAO;AACtD,QAAI;AACJ,QAAI;AACJ,QAAI;AACJ,QAAI,gBAAgB;AAClB,YAAM,WAAW,MAAM,0BAA0B;QAC/C;QAAS,YAAY;QAAgB,WAAW,KAAK,QAAQ;QAC7D,YAAYA,UAAS;QAAY,eAAeA,UAAS;QAAe;MAC1E,CAAC;AACD,OAAC,EAAE,WAAW,cAAc,mBAAmB,uBAAuB,IAAI;AAC1E,UAAI,QAAQ,QAAQ,WAAW;AAC7B,cAAM,WAAW,MAAM,KAAK,QAAQ,QAAQ,OAAO,QAAQ,SAAS;AACpE,YAAI,SAAS,eAAeA,UAAS,cAAc,SAAS,cAAcA,UAAS,iBAC9E,SAAS,eAAeA,UAAS,kBAAkB;AACtD,gBAAM,UAAU,QAAQ;AACxB,gBAAM,IAAI,UAAU,qEAAqE;QAC3F;AACA,cAAM,4BAA4B,WAAW,SAAS,cAAc,CAAC,CAAC;MACxE;IACF,OAAO;AACL,YAAM,SAAS,MAAM,KAAK,QAAQ,QAAQ,OAAO,QAAQ,SAAS;AAClE,YAAM,eAAe,MAAM,6BAA6B,MAAM;AAC9D,UAAI;AACF,oBAAY,UACP,MAAM,+BAA+B;UACtC,gBAAgB,aAAa;UAAW,sBAAsB,OAAO;UACrE,YAAY,sBAAsB,QAAQ,OAAO;QACnD,CAAC,GAAG,YACF,MAAM,eAAe,aAAa,SAAS;MACjD,UAAA;AAAY,cAAM,aAAa,QAAQ;MAAG;AAC1C,qBAAe,OAAO;IACxB;AACA,UAAM,QAAQ,IAAI,gBAAgB;AAClC,UAAM,mBAA6B,CAAC;AACpC,UAAM,SAAwB;MAC5B;MAAW;MAAO;MAAkB,cAAc;MAAO,MAAMA,UAAS;MAAM,OAAOA,UAAS;MAC9F,yBAAyBA,UAAS;MAClC,eAAeA,UAAS;MAAe,YAAYA,UAAS;MAAY,kBAAkBA,UAAS;MACnG,mBAAmB,iBAAiB,yBAA0B,MAAM,sBAAsB,UAAU,aAAa;QAC/G,UAAU;QAAQ,UAAU,MAAM,OAAO;MAC3C,CAAC;MACD,qBAAqBA,UAAS,uBAAuB;QACnD,KAAK,UAAU,EAAE,aAAaA,UAAS,mBAAmB,QAAQA,UAAS,QAAQ,MAAM,aAAa,CAAC;MACzG;MACA,MAAM,QAAQ,QAAQ,IAAI;IAC5B;AACA,SAAK,QAAQ,IAAI,QAAQ,WAAW,MAAM;AAC1C,QAAI,gBAAgB;AAClB,YAAM,KAAK,OAAO,SAAS;QACzB,MAAM;QAAW,OAAO;QACxB,MAAM,mCAAmC,eAAe,cAAc,SAAM,eAAe,WAAW,aAAa,OAAO,aAAU,eAAe,aAAa;MAClK,GAAG,gBAAgB;IACrB;AACA,WAAO,OAAO,KAAK,YAAY,SAASA,WAAU,MAAM,EAAE,MAAM,OAAO,UAAU;AAC/E,YAAM,SAAS,oBAAQ,KAAK;AAC5B,YAAM,KAAK,OAAO,SAAS,EAAE,MAAM,WAAW,OAAO,UAAU,MAAM,cAAc,MAAM,GAAG,GAAG,gBAAgB,EAAE,MAAM,MAAM,MAAS;AACtI,YAAM,KAAK,YAAY,SAAS,QAAQ,MAAM;AAC9C,YAAM,KAAK,OAAO,SAAS,EAAE,MAAM,UAAU,QAAQ,SAAS,GAAG,gBAAgB,EAAE,MAAM,MAAM,MAAS;AACxG,YAAM,KAAK,SAAS,SAAS,QAAQ,MAAM;AAC3C,aAAO;IACT,CAAC;AACD,WAAO,EAAE,QAAQ,WAAW,SAAS,SAAS,0CAA0C,aAAa;EACvG;EAEA,MAAM,QAAQ,SAAgE;AAC5E,UAAM,SAAS,KAAK,QAAQ,IAAI,QAAQ,SAAS;AACjD,UAAM,SAAS,QAAQ,QAAQ;AAC/B,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,CAAC,OAAO,KAAK,KAAK,OAAO,SAAS,KAAQ;AACrF,YAAM,IAAI,UAAU,yDAAyD;IAC/E;AACA,UAAM,iBAAiB,QAAQ,QAAQ,2BAA2B,OAAO;AACzE,QAAI,CAAC,OAAO,cAAc,cAAc,KAAK,OAAO,cAAc,IAAI,OAAS,OAAO,cAAc,IAAI,KAAS;AAC/G,YAAM,IAAI,UAAU,iDAAiD;IACvE;AACA,WAAO,0BAA0B,OAAO,cAAc;AACtD,UAAM,OAAO;AACb,WAAO,QAAQ,IAAI,gBAAgB;AACnC,WAAO,eAAe;AACtB,WAAO,UAAU;AACjB,WAAO,OAAO,KAAK,YAAY,SAAS;MACtC,MAAM,OAAO;MAAM,OAAO,OAAO;MAAO;MACxC,yBAAyB,OAAO;MAChC,qBAAqB,OAAO;MAAqB,mBAAmB;MACpE,YAAY,OAAO;MAAY,eAAe,OAAO;MAAe,kBAAkB,OAAO;IAC/F,GAAG,MAAM,EAAE,MAAM,OAAO,UAAU;AAChC,YAAM,SAAS,oBAAQ,KAAK;AAC5B,YAAM,KAAK;QAAO;QAAS,EAAE,MAAM,WAAW,OAAO,UAAU,MAAM,cAAc,MAAM,GAAG;QAC1F,OAAO;MAAgB,EAAE,MAAM,MAAM,MAAS;AAChD,YAAM,KAAK,YAAY,SAAS,QAAQ,MAAM;AAC9C,YAAM,KAAK,OAAO,SAAS,EAAE,MAAM,UAAU,QAAQ,SAAS,GAAG,OAAO,gBAAgB,EAAE,MAAM,MAAM,MAAS;AAC/G,YAAM,KAAK,SAAS,SAAS,QAAQ,MAAM;AAC3C,aAAO;IACT,CAAC;AACD,WAAO,EAAE,QAAQ,WAAW,SAAS,+BAA+B;EACtE;EAEA,MAAM,YACJ,SAA6BA,WAA+B,QAC/B;AAC7B,UAAM,QAAQ,cAAc,SAASA,SAAQ;AAC7C,UAAM,SAAS,4BAA4B;MACzC,SAAS,KAAK,QAAQ;MAAS,QAAQ,KAAK,QAAQ;MACpD,qBAAqB,KAAK,QAAQ;IACpC,GAAG,OAAOA,UAAS,IAAI;AACvB,UAAM,YAAY,KAAK,IAAI;AAC3B,QAAI,iBAAiB;AACrB,UAAM,cAAc,EAAE,QAAQ,GAAG,eAAe,MAAM;AACtD,UAAM,SAAS,MAAM,KAAK,KAAK;MAC7B,QAAQ,KAAK,QAAQ;MAAQ,OAAO,KAAK,QAAQ;MAAO,oBAAoB,KAAK,QAAQ,uBAAuB;MAAgB,cAAc,OAAO,UAAU;MAC/J,iBAAiB;MAAQ,MAAM,MAAM;MAAM,QAAQ,KAAK,QAAQ;MAAQ,QAAQ,OAAO,MAAM;MAC7F,UAAU,CAAC,SAAS,KAAK,OAAO,SAAS;QACvC,MAAM;QAAW,OAAO;QAAU,MAAM,KAAK,MAAM,GAAG,GAAK;MAC7D,GAAG,OAAO,gBAAgB;MAC1B,WAAW,OAAO,WAAW;AAC3B,YAAI,OAAO,SAAS,qBAAqB;AACvC,iBAAO,2BAA2B;YAAE;YAAS,UAAAA;YAAU,SAAS;YAAQ,OAAO;YAC7E,SAAS,KAAK,QAAQ;YAAS,OAAO,CAAC,UAAU,KAAK;cACpD;cAAS;cAAO,OAAO;YACzB;UACF,CAAC;QACH;AACA,YAAI,OAAO,SAAS,gBAAgB;AAClC,gBAAM,cAAc,KAAK,IAAI;AAC7B,gBAAM,KAAK;YAAO;YAAS,EAAE,MAAM,QAAQ,OAAO,WAAW,MAAM,OAAO,KAAK;YAC7E,OAAO;UAAgB,EAAE,MAAM,MAAM,MAAS;AAChD,gBAAMG,YAAW,MAAM,OAAO,QAAQ;YACpC;YAAO,cAAc,OAAO,UAAU;YAAc,QAAQ,OAAO,MAAM;UAC3E,GAAG,MAAM;AACT,gBAAM,KAAK,OAAO,SAAS;YAAE,MAAM;YAAQ,OAAO;YAAa,MAAM,OAAO;YAC1E,IAAIA,UAAS;YAAI,YAAY,KAAK,IAAI,IAAI;UAC5C,GAAG,OAAO,gBAAgB,EAAE,MAAM,MAAM,MAAS;AACjD,iBAAO,EAAE,iBAAiB,0BAA0B,MAAM,iBAA0B,GAAGA,UAAS;QAClG;AACA,YAAI,OAAO,SAAS,SAAS;AAC3B,gBAAM,UAAU,cAAO,OAAO,OAAO;AACrC,cAAI,OAAO,SAAS,cAAc;AAChC,kBAAM,KAAK,OAAO,SAAS,EAAE,MAAM,UAAU,QAAQ,UAAU,GAAG,OAAO,gBAAgB;UAC3F,WAAW,OAAO,SAAS,iBAAiB,SAAS,cAAc,QAC9D,OAAO,cAAc,QAAQ,UAAU,KAAK,OAAO,QAAQ,UAAU,KAAK,GAAG;AAChF,kBAAM,KAAK,OAAO,SAAS;cAAE,MAAM;cAAY,WAAW;cACxD,YAAY,KAAK,IAAI,OAAO,QAAQ,UAAU,GAAG,KAAU;YAC7D,GAAG,OAAO,gBAAgB;UAC5B,OAAO;AACL,kBAAM,KAAK,OAAO,SAAS;cAAE,MAAM;cAAW,OAAO;cACnD,MAAM,GAAG,OAAO,IAAI,GAAG,OAAO,YAAY,SAAY,KAAK,IAAI,gBAAK,OAAO,OAAO,CAAC,EAAE;YACvF,GAAG,OAAO,gBAAgB;UAC5B;QACF,WAAW,OAAO,SAAS,oBAAoB;AAC7C,2BAAiB;AACjB,gBAAM,OAAO,kBAAW,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM;AAC7D,gBAAM,KAAK,OAAO,SAAS;YAAE,MAAM;YACjC,OAAO,OAAO,WAAW,cAAc,UAAU;YAAU;UAC7D,GAAG,OAAO,gBAAgB;AAC1B,gBAAM,KAAK,OAAO,SAAS;YAAE,MAAM;YAAU,QAAQ,OAAO,WAAW,cAAc,SAAS;YAC5F,YAAY,KAAK,IAAI,IAAI;UAC3B,GAAG,OAAO,gBAAgB;QAC5B;MACF;IACF,CAAC;AACD,QAAI,OAAO,WAAW,YAAY,OAAO,QAAQ;AAC/C,YAAM,KAAK,OAAO,SAAS,EAAE,MAAM,WAAW,OAAO,UAAU,MAAM,OAAO,OAAO,MAAM,GAAG,GAAK,EAAE,GAAG,OAAO,gBAAgB;IAC/H;AACA,QAAI,CAAC,eAAgB,OAAM,KAAK,OAAO,SAAS;MAAE,MAAM;MACtD,QAAQ,OAAO,WAAW,cAAc,SAAS;MAAU,YAAY,KAAK,IAAI,IAAI;IACtF,GAAG,OAAO,gBAAgB,EAAE,MAAM,MAAM,MAAS;AACjD,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,UAAU,mBAAY,OAAO,MAAM,KAAK,OAAO,OAAO,KAAK,MAAM;AACvE,YAAM,KAAK,YAAY,SAAS,QAAQ,MAAM;AAC9C,YAAM,KAAK,SAAS,SAAS,QAAQ,MAAM;IAC7C;AACA,WAAO;EACT;EAEA,MAAM,YAAY,SAAgE;AAChF,UAAM,SAAS,KAAK,QAAQ,IAAI,QAAQ,SAAS;AACjD,QAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,sDAAsD;AACvF,UAAM,SAAS,MAAM,KAAK,aAAa,QAAQ,SAAS,MAAM;AAC9D,SAAK,QAAQ,OAAO,QAAQ,SAAS;AACrC,WAAO;EACT;EAEA,MAAM,SAAS,SAA6B,QAAuB,OAA8B;AAC/F,WAAO,UAAU,MAAM,MAAM,GAAG,GAAK;AACrC,QAAI,OAAO,cAAc;AACvB,YAAM,KAAK,QAAQ,QAAQ,qBAAqB,QAAQ,WAAW,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;IAC1G;EACF;EAEA,MAAM,YAAY,SAA6B,QAAuB,OAA8B;AAClG,UAAM,SAAS,MAAM,KAAK,EAAE,MAAM,GAAG,GAAK,KAAK;AAC/C,SAAK,QAAQ,eAAe,MAAM;AAClC,UAAM,KAAK;MAAO;MAAS,EAAE,MAAM,cAAc,OAAO,SAAS,SAAS,OAAO;MAC/E,OAAO;IAAgB,EAAE,MAAM,MAAM,MAAS;EAClD;EAEA,MAAM,OAAO,SAA6B,OAA6B,MAA+B;AACpG,UAAM,uBAAuB,KAAK,QAAQ,SAAS,SAAS,OAAO,IAAI;EACzE;AACF;;;AYtQA,SAAS,gBAAAC,qBAAoB;AAEtB,SAAS,aAAqB;AACnC,QAAM,MAAM,KAAK,MAAMA,cAAa,IAAI,IAAI,mBAAmB,YAAY,GAAG,GAAG,MAAM,CAAC;AACxF,SAAO,IAAI,WAAW;AACxB;AAEO,SAAS,UAAU,SAAsC,SAAe;AAC7E,SAAO,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAmPZ;AACD;;;AC5PA,SAAS,YAAAC,iBAAgB;AACzB,SAAS,cAAAC,mBAAkB;AAO3B,IAAMC,iBAAgB,EAAE,UAAU,KAAQ,UAAU,MAAM,OAAO,KAAK;AAUtE,eAAsB,uBACpB,KAAa,YAAoB,WAA6C,aAC5C;AAClC,QAAM,gBAAgB,MAAM,SAAS,GAAG;AACxC,QAAM,SAAS,MAAM,eAAe,KAAK,EAAE,GAAGA,gBAAe,wBAAwB,KAAK,CAAC;AAC3F,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,mBAAmB,KAAK,eAAeA,cAAa;AACpE,UAAM,aAAa,MAAM,mBAAmB,QAAQ,WAAW,OAAO,aAAaA,cAAa;AAChG,QAAI;AACJ,QAAI;AAAE,uBAAiB,MAAM,WAAW,MAAM,IAAI,OAAO,IAAI;AAAA,IAAG,UAChE;AAAU,YAAM,WAAW,QAAQ;AAAA,IAAG;AACtC,UAAMC,cAAwC;AAAA,MAC5C,MAAM;AAAA,MAAkB;AAAA,MAAY;AAAA,MACpC,mBAAmB,MAAM,sBAAsB,QAAQ,WAAWD,cAAa;AAAA,MAC/E,sBAAsB,WAAW,cAAc;AAAA,MAC/C,gBAAgB,MAAM,sBAAsB,OAAO,aAAaA,cAAa;AAAA,MAC7E,UAAU,eAAe,SAAS;AAAA,MAClC,WAAW,OAAO;AAAA,MAAW,WAAW,OAAO;AAAA,MAAW,YAAY,KAAK,IAAI;AAAA,IACjF;AACA,WAAO;AAAA,MACL,YAAAC;AAAA,MAAY,gBAAgB,QAAQ;AAAA,MAAW,WAAW,OAAO;AAAA,MACjE,SAAS,YAAY;AAAE,cAAM,QAAQ,IAAI,CAAC,OAAO,QAAQ,GAAG,QAAS,QAAQ,CAAC,CAAC;AAAA,MAAG;AAAA,IACpF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,QAAQ,IAAI,CAAC,OAAO,QAAQ,GAAG,SAAS,QAAQ,CAAC,CAAC;AACxD,UAAM;AAAA,EACR;AACF;AAEA,eAAe,YAAY,KAA8B;AACvD,QAAM,QAAQ,MAAM,IAAI,QAAgB,CAAC,QAAQ,WAAW;AAC1D,IAAAC,UAAS,OAAO,CAAC,aAAa,MAAM,GAAG,EAAE,KAAK,UAAU,QAAQ,WAAW,MAAO,GAAG,CAAC,OAAO,WAAW;AACtG,UAAI,MAAO,QAAO,IAAI,MAAM,6DAA6D,CAAC;AAAA,UACrF,QAAO,OAAO,KAAK,CAAC;AAAA,IAC3B,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,iBAAiB,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,yDAAyD;AAC5G,SAAO;AACT;AAEA,SAAS,WAAW,OAAmC;AACrD,SAAO,UAAUC,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AACnE;;;ArCiCA,eAAsB,YAAY,SAA4C;AAC5E,QAAM,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACvC,QAAM,aAAaC,SAAQ,KAAK,QAAQ,UAAU;AAClD,QAAM,MAAMC,YAAW,UAAU,IAAI,MAAM,kBAAkB,UAAU,IAAI;AAC3E,QAAM,iBAAiB,QAAQ,OAAO,KAAK;AAC3C,MAAI,kBAAkB,CAAC,4BAA4B,KAAK,cAAc,GAAG;AACvE,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AACA,MAAI,kBAAkB,OAAO,mBAAmB,IAAI,IAAI,IAAI;AAC1D,UAAM,IAAI,MAAM,YAAY,cAAc,mBAAmB,QAAQ,UAAU,KAAK,IAAI,IAAI,EAAE,GAAG;AAAA,EACnG;AACA,QAAM,QAAQ,kBAAkB,KAAK,IAAI;AACzC,QAAM,YAAY,QAAQ,YAAY,KAAK,eAAe,QAAQ,IAAI,qBAAqB,mBAAmB,QAAQ,QAAQ,EAAE;AAIhI,QAAM,SAAS,QAAQ,QAAQ,MAAO,IAAI,KAAK,SAAS,KAAK,IAAI,QAAQ,IAAI,KAAK,CAAC,IAAK;AACxF,MAAK,WAAW,SAAS,WAAW,UAAY,OAAO,CAAC,IAAI,KAAK,SAAS,MAAM,GAAI;AAClF,UAAM,IAAI,MAAM,MACZ,aAAa,UAAU,EAAE,yCAAyC,QAAQ,UAAU,KACpF,aAAa,UAAU,EAAE,iEAAiE,QAAQ,UAAU,EAAE;AAAA,EACpH;AACA,MAAI,QAAQ,aAAa,YAAY,QAAQ,aAAa,SAAS;AACjE,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACA,QAAM,QAAQ,QAAQ,SAAS;AAC/B,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,IAAI;AAC3D,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,QAAM,cAAc,QAAQ,eAAe;AAC3C,MAAI,CAAC,OAAO,cAAc,WAAW,KAAK,cAAc,OAAS,cAAc,KAAS;AACtF,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,UAAU,QAAQ,SAAS;AAEjC,QAAM,SAAS,OAAO,QAAQ,gBAAgB,uBAAuB,QAAQ,UAAU,MAAM;AAC7F,QAAM,CAAC,OAAO,IAAI,OAAO,QAAQ,iBAAiB;AAAA,IAAmB;AAAA,IACnE,CAAC,eAAe,GAAG,IAAI,IAAI,mBAAmB,IAAI,CAACC,YAAWA,QAAO,KAAK,CAAC,CAAC;AAAA,EAAC;AAC/E,MAAI,CAAC,WAAW,CAAC,mDAAmD,KAAK,OAAO,EAAG,OAAM,IAAI,MAAM,gFAAgF;AACnL,QAAM,eAAe,QAAQ,aAAa,WAAW,UAAU;AAC/D,QAAM,YAAY,QAAQ,QAAQ,SAAS,GAAG,KAAK;AACnD,MAAI,CAAC,YAAY,SAAS,SAAS,IAAK,OAAM,IAAI,MAAM,yCAAyC;AACjG,QAAM,aAAa,MAAM,sBAAsB,KAAK,QAAQ,aAAa;AACzE,QAAM,cAAc,OAAO,QAAQ,sBAAsB;AAAA,IACvD;AAAA,IAAK;AAAA,IAAY,QAAQ;AAAA,EAC3B;AACA,MAAI;AACF,UAAMC,cAAa,YAAY;AAC/B,UAAM,WAAW,OAAO,QAAQ,YAAY,wBAAwB;AAAA,MAClE;AAAA,MACA,OAAO;AAAA,MACP,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ;AAAA,MACd,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,iBAAiB,QAAQ;AAAA,MACzB,OAAO;AAAA,MACP,OAAO,2BAA2B,SAAS,UAAU,IAAI,MAAM;AAAA,IACjE,CAAC;AACD,UAAM,SAAS,QAAQ,EAAE,MAAM,IAAI,EAAE,WAAW;AAChD,UAAMC,YAAW,MAAM,QAAQ,GAAG,QAAQ,gCAAgC;AAAA,MACxE,QAAQ;AAAA,MACR,SAAS,EAAE,eAAe,UAAU,QAAQ,IAAI,gBAAgB,mBAAmB;AAAA,MACnF,MAAM,KAAK,UAAU,EAAE,GAAG,QAAQ,KAAK,QAAQ,MAAM,UAAU,UAAU,cAAc,MAAM,CAAC;AAAA,MAC9F,UAAU;AAAA,MACV,QAAQ,QAAQ;AAAA,IAClB,CAAC;AACD,UAAM,MAAM,MAAMA,UAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AAClD,QAAI,CAACA,UAAS,GAAI,OAAM,IAAI,MAAM,WAAW,qBAAqBA,UAAS,QAAQ,GAAG,CAAC;AACvF,UAAM,aAAa,gBAAgB,KAAK,OAAO,MAAM;AACrD,UAAM,eAAqC;AAAA,MACzC,iBAAiB;AAAA,MACjB,UAAU;AAAA,MACV,MAAM,QAAQ;AAAA,MACd,SAAS,CAAC,MAAM;AAAA,MAChB,UAAU,KAAK,EAAE;AAAA,MACjB,aAAa,SAAS;AAAA,MACtB,QAAQD;AAAA,MACR,QAAQ;AAAA,QACN,OAAO;AAAA,QAAM,IAAI;AAAA,QAAS,UAAU;AAAA,QACpC,SAAS,mBAAmB,IAAI,CAACD,aAAY,EAAE,IAAIA,QAAO,IAAI,OAAOA,QAAO,MAAM,EAAE;AAAA,MACtF;AAAA,IACF;AACA,QAAI,IAAI,GAAG,WAAW,UAAU,gBAAgB,UAAU,KAAK,WAAW,KAAK,IAAI,KAAK,WAAW,KAAK,MAAM,GAAG;AACjH,QAAI,IAAI,YAAY,WAAW,QAAQ,KAAK,IAAI,WAAW,QAAQ,GAAG,SAAM,WAAW,MAAM,KAAK,iBAAc,MAAM,EAAE;AACxH,QAAI,IAAI,+BAA4BC,YAAW,cAAc,MAAM,GAAG,EAAE,CAAC,SAAMA,YAAW,SAAS,yBAAsB;AACzH,QAAI,IAAI,kEAAkE;AAC1E,QAAI,IAAI,WAAW,QAAQ,gBAAgB,mBAAmB,WAAW,QAAQ,KAAK,CAAC,IAAI,WAAW,QAAQ,GAAG,gBAAgB;AACjI,WAAO,QAAQ,cAAc,gBAAgB;AAAA,MAC3C,UAAU;AAAA,MACV,OAAO,WAAW;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ,SAAS;AAAA,MACvB,QAAQ,QAAQ;AAAA,MAChB,QAAQ;AAAA,MACR,OAAO;AAAA,IACT,CAAC;AAAA,EACH,UAAE;AACA,UAAM,YAAY,QAAQ;AAAA,EAC5B;AACF;AAGA,eAAsB,eAAe,OAAwC;AAC3E,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,MAAM,WAAW,MAAM,MAAM,QAAQ,UAAU,kBAAkB;AAC/E,QAAM,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAC7D,QAAM,SAAS,MAAM,SAAS,YAAY,IAAI,CAAC,MAAM,QAAQ,WAAW,MAAM,CAAC,IAAI,WAAW;AAC9F,QAAM,WAAY,CAAC,UAAU,SAAS,EAAY,IAAI,CAAC,SAAS;AAC9D,UAAM,UAAU,MAAM,WAAW,MAAM,IAAI;AAC3C,YAAQ,KAAK,MAAM,OAAO;AAC1B,WAAO,CAAC,MAAM,OAAO;AAAA,EACvB,CAAC;AACD,QAAM,UAAU,+BAA+B;AAAA,IAC7C,UAAU,MAAM;AAAA,IAAU,OAAO,MAAM;AAAA,IAAO;AAAA,IAAQ,OAAO,MAAM;AAAA,EACrE,CAAC;AACD,QAAM,gBAAgB,IAAI,oBAAoB;AAAA,IAC5C;AAAA,IACA,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM,WAAW,MAAM,aAAa,OAAO;AAAA,IAClD,oBAAoB;AAAA,IACpB,SAAS;AAAA,IACT,qBAAqB;AAAA,IACrB,aAAa,MAAM;AAAA,IACnB,cAAc,CAACE,aAAY,MAAM,OAAO,MAAM,0BAAuBA,QAAO,EAAE;AAAA,EAChF,CAAC;AACD,QAAM,aAAa,IAAI,sBAAsB,SAAS,aAAa;AACnE,MAAI;AACF,UAAM,4BAA4B;AAAA,MAChC;AAAA,MACA,gBAAgB,eAAe,WAAW,CAAC;AAAA,MAC3C,cAAc,MAAM;AAAA,MACpB,aAAa,MAAM;AAAA,MACnB,MAAM,MAAM;AAAA,MACZ;AAAA,MACA,YAAY,OAAO,aAAa;AAC9B,cAAM,OAAO;AAAA,UACX,WAAW,SAAS,KAAK,MAAM,SAAM,SAAS,SAAS,MAAM,oBAAiB,SAAS,SAAS,MAAM;AAAA,QACxG;AACA,YAAI,MAAM,QAAQ,SAAS,SAAS,QAAQ;AAC1C,gBAAM,IAAI,MAAM,iFAAiF;AAAA,QACnG;AACA,cAAM,WAAW,UAAU,QAAQ;AAAA,MACrC;AAAA,MACA,SAAS,CAAC,OAAO,YAAY,MAAM,OAAO;AAAA,QACxC,+CAA+C,OAAO,WAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACtH;AAAA,IACF,CAAC;AAAA,EACH,UAAE;AACA,UAAM,cAAc,MAAM;AAC1B,UAAM,QAAQ,oBAAoB,SAAS,KAAK;AAChD,eAAW,CAAC,MAAM,OAAO,KAAK,SAAU,SAAQ,eAAe,MAAM,OAAO;AAAA,EAC9E;AACF;AAEA,SAAS,gBAAgB,OAAgB,OAA2B,QAA4C;AAC9G,QAAM,OAAOC,QAAO,KAAK;AACzB,QAAM,OAAOA,QAAO,MAAM,IAAI;AAC9B,QAAM,QAAQA,QAAO,MAAM,KAAK;AAChC,QAAM,UAAUA,QAAO,MAAM,OAAO;AACpC,MAAI,CAAC,QAAQ,OAAO,KAAK,UAAU,YAAY,CAAC,gCAAgC,KAAK,KAAK,KAAK,KAC1F,OAAO,KAAK,YAAY,aAAa,CAAC,QAAQ,CAAC,uBAAuB,KAAK,OAAO,KAAK,MAAM,CAAC,KAC9F,OAAO,KAAK,SAAS,YAAY,CAAC,SAAS,CAAC,OAAO,cAAc,MAAM,KAAK,KAC5E,CAAC,WAAW,OAAO,QAAQ,UAAU,YAAY,CAAC,QAAQ,SAAU,SAAS,QAAQ,UAAU,SAC/F,QAAQ,QAAQ,UAChB,CAAC,OAAO,cAAc,QAAQ,UAAU,GAAG;AAC9C,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,SAAO;AACT;AAEA,SAAS,WAAW,QAAgB,QAAgB,OAAwB;AAC1E,QAAMD,WAAUC,QAAOA,QAAO,KAAK,GAAG,KAAK,GAAG;AAC9C,SAAO,GAAG,MAAM,YAAY,MAAM,IAAI,OAAOD,aAAY,WAAW,KAAKA,QAAO,KAAK,EAAE;AACzF;AAEA,SAASC,QAAO,OAAgD;AAC9D,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC;AAC1G;;;AsCrRA,SAAS,kBAAkB,eAAAC,oBAAmB;AAC9C,SAAS,aAAAC,kBAAiB;AAC1B,OAAOC,cAAa;;;ACFpB,SAAS,cAAc;AAOvB,eAAsB,0BACpB,SACA,UACA,UACA,OACA,cACA,KACA,KACe;AACf,QAAM,OAAO,GAAG,QAAQ,QAAQ,mBAAmB,QAAQ,CAAC;AAC5D,aAAW,eAAe,cAAc;AACtC,eAAW,QAAQ,YAAY,SAAS,CAAC,GAAG;AAC1C,YAAM,UAAU,MAAMC,UAAS,SAAS,GAAG,IAAI,UAAU,OAAO;AAAA,QAC9D,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,MAAM,GAAG,OAAO,EAAE,EAAE,EAAE;AAAA,MACtF,CAAC;AACD,YAAM,OAAOC,UAAS,OAAO,KAAKA,UAAS,QAAQ,MAAM,IAAI,QAAQ,OAAO,KAAK,EAAE,IAAI;AACvF,UAAI,CAAC,MAAM,QAAQ,IAAI,GAAG;AACxB,cAAM,IAAI,MAAM,GAAG,GAAG,iBAAiB,YAAY,EAAE,SAAS,KAAK,EAAE,qCAAqC;AAAA,MAC5G;AACA,UAAI,KAAK,SAAS,GAAG;AACnB,YAAI,IAAI,GAAG,GAAG,iBAAiB,YAAY,EAAE,SAAS,KAAK,EAAE,iBAAiB;AAC9E;AAAA,MACF;AACA,YAAMD,UAAS,SAAS,GAAG,IAAI,aAAa,OAAO;AAAA,QACjD,YAAY,eAAe,YAAY,EAAE,SAAS,KAAK,EAAE;AAAA,QACzD,KAAK,CAAC;AAAA,UACJ,GAAG;AAAA,UACH,IAAI,KAAK;AAAA;AAAA;AAAA,UAGT,IAAI,OAAO;AAAA,UACX,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,MAAM;AAAA,QAC1D,CAAC;AAAA,MACH,CAAC;AACD,UAAI,IAAI,GAAG,GAAG,iBAAiB,YAAY,EAAE,SAAS,KAAK,EAAE,UAAU;AAAA,IACzE;AAAA,EACF;AACF;AAEA,eAAeA,UAAS,SAAoB,KAAa,QAAgB,MAAiC;AACxG,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,MAAM,IAAI,gBAAgB,mBAAmB;AAAA,IACjF,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,QAAQ,YAAY,IAAI,MAAM,IAAI,MAAM,aAAa,GAAG,CAAC,EAAE;AACxG,SAAO,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpC;AAEA,SAASC,UAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,eAAe,aAAa,KAAgC;AAC1D,MAAI;AACF,WAAO,eAAe,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,GAAG,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AClEA,SAAS,eAAAC,oBAAmB;AAoB5B,eAAsB,wBAAwB,MAAiE;AAC7G,QAAM,WAAWC,aAAY,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG;AACtD,QAAM,QAAQ,KAAK,aAAa,KAAK,KAAK,GAAG;AAC7C,MAAI,cAAc,KAAK;AACvB,MAAI,QAAQ,KAAK,IAAI,SAAS,SAAS,IAAI,KAAK,CAAC,KAAK,WAAW,OAAO,QAAQ;AAChF,MAAI,YAAY,KAAK,IAAI,SAAS,SAAS,MAAM,KAAK,CAAC,KAAK,aAAa,OAAO,YAAY;AAE5F,MAAI,KAAK,IAAI,SAAS,SAAS,IAAI,GAAG;AACpC,QAAI,OAAO;AACT,WAAK,OAAO,IAAI,GAAG,KAAK,GAAG,8BAA8B,QAAQ,EAAE;AAAA,IACrE,OAAO;AACL,cAAQ,MAAM,UAAU,MAAM,QAAQ;AACtC,oBAAc,KAAK,MAAM,aAAa,UAAU,EAAE,MAAM,CAAC;AACzD,WAAK,OAAO,IAAI,GAAG,KAAK,GAAG,uBAAuB,QAAQ,EAAE;AAAA,IAC9D;AAAA,EACF;AAEA,MAAI,KAAK,IAAI,SAAS,SAAS,MAAM,GAAG;AACtC,QAAI,WAAW;AACb,WAAK,OAAO,IAAI,GAAG,KAAK,GAAG,mCAAmC;AAAA,IAChE,OAAO;AACL,kBAAY,MAAM,eAAe,IAAI;AACrC,oBAAc,KAAK,MAAM,aAAa,UAAU,EAAE,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAI,UAAU,CAAC;AAC1F,WAAK,OAAO,IAAI,GAAG,KAAK,GAAG,KAAK,KAAK,aAAa,YAAY,QAAQ,oBAAoB;AAAA,IAC5F;AAAA,EACF;AAEA,SAAO,KAAK,MAAM,aAAa,UAAU;AAAA,IACvC,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,EACnC,CAAC;AACH;AAEA,SAAS,KACP,MACA,SACA,UACA,QACkB;AAClB,QAAM,OAAO,gBAAgB,SAAS;AAAA,IACpC,OAAO,KAAK,IAAI,IAAI;AAAA,IACpB,aAAa,KAAK,IAAI;AAAA,IACtB,YAAY,KAAK,IAAI;AAAA,IACrB,KAAK,KAAK;AAAA,IACV;AAAA,IACA,GAAG;AAAA,EACL,CAAC;AACD,MAAI,KAAK,MAAO,kBAAiB,KAAK,IAAI,MAAM,iBAAiB,IAAI;AACrE,SAAO;AACT;AAEA,eAAe,UAAU,MAAsC,UAAmC;AAChG,QAAM,UAAU,EAAE,eAAe,UAAU,KAAK,cAAc,IAAI,gBAAgB,mBAAmB;AACrG,MAAI,MAAM,MAAM,KAAK,MAAM,GAAG,KAAK,IAAI,UAAU,eAAe,mBAAmB,QAAQ,CAAC,SAAS;AAAA,IACnG,QAAQ;AAAA,IACR;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,MAAI,IAAI,WAAW,KAAK;AACtB,UAAM,UAAU,MAAM,KAAK,MAAM,GAAG,KAAK,IAAI,UAAU,eAAe;AAAA,MACpE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU;AAAA,QACnB,MAAM,KAAK,QAAQ,SAAS,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,GAAG;AAAA,QACjF,OAAO;AAAA,MACT,CAAC;AAAA,IACH,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,OAAM,IAAI,MAAM,kBAAkB,QAAQ,aAAa,QAAQ,MAAM,IAAI,MAAMC,UAAS,OAAO,CAAC,EAAE;AACnH,UAAM,MAAM,KAAK,MAAM,GAAG,KAAK,IAAI,UAAU,eAAe,mBAAmB,QAAQ,CAAC,SAAS;AAAA,MAC/F,QAAQ;AAAA,MACR;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,gBAAgB,QAAQ,aAAa,IAAI,MAAM,IAAI,MAAMA,UAAS,GAAG,CAAC,EAAE;AACrG,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,CAAC,KAAK,IAAK,OAAM,IAAI,MAAM,gBAAgB,QAAQ,mBAAmB;AAC1E,SAAO,KAAK;AACd;AAEA,eAAe,eAAe,MAAuD;AACnF,QAAM,SAAS,KAAK,aAAa,YAAY;AAC7C,QAAM,MAAM,MAAM,KAAK;AAAA,IACrB,GAAG,KAAK,IAAI,WAAW,SAAS,mBAAmB,KAAK,IAAI,IAAI,EAAE,CAAC,SAAS,MAAM,QAAQ,mBAAmB,KAAK,GAAG,CAAC;AAAA,IACtH,EAAE,QAAQ,QAAQ,SAAS,EAAE,eAAe,UAAU,KAAK,cAAc,GAAG,EAAE;AAAA,EAChF;AACA,MAAI,IAAI,WAAW,OAAO,CAAC,KAAK,YAAY;AAC1C,UAAM,IAAI;AAAA,MACR,sCAAsC,KAAK,GAAG;AAAA,IAEhD;AAAA,EACF;AACA,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,cAAc,KAAK,aAAa,aAAa,OAAO,KAAK,KAAK,GAAG,aAAa,IAAI,MAAM,IAAI,MAAMA,UAAS,GAAG,CAAC,EAAE;AAC9I,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,CAAC,KAAK,MAAO,OAAM,IAAI,MAAM,cAAc,KAAK,aAAa,aAAa,OAAO,KAAK,KAAK,GAAG,qBAAqB;AACvH,SAAO,KAAK;AACd;AAEA,eAAeA,UAAS,KAAgC;AACtD,MAAI;AACF,WAAO,eAAe,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,GAAG,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AC5HA,SAAS,4BAA4B;AACrC,SAAS,eAAAC,oBAAmB;AAQrB,SAAS,YAAY,SAAyB;AACnD,MAAI,YAAY,KAAM,QAAO;AAC7B,MAAI,YAAY,WAAY,QAAO;AACnC,SAAO;AACT;AAGO,SAAS,kBAAkB,UAA0B;AAC1D,QAAM,QAAQ;AACd,SAAO,MAAM,QAAQ,KAAK,GAAG,QAAQ;AACvC;AAIA,eAAsB,wBAAwB,SAAoB,KAA0B,KAAa,OAA8B;AACrI,QAAM,WAAWC,aAAY,IAAI,IAAI,IAAI,GAAG;AAC5C,QAAM,MAAM,MAAM,QAAQ,GAAG,IAAI,UAAU,eAAe,mBAAmB,QAAQ,CAAC,iBAAiB;AAAA,IACrG,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,EAC9C,CAAC;AACD,MAAI,IAAI,MAAM,IAAI,WAAW,IAAK;AAClC,MAAI,IAAI,WAAW,KAAK;AACtB,UAAM,IAAI;AAAA,MACR,GAAG,GAAG,8BAA8B,IAAI,IAAI,EAAE,aAAa,QAAQ;AAAA,IAErE;AAAA,EACF;AACA,QAAM,IAAI,MAAM,GAAG,GAAG,8BAA8B,QAAQ,aAAa,IAAI,MAAM,IAAI,MAAMC,UAAS,GAAG,CAAC,EAAE;AAC9G;AAEA,eAAsBC,UAAS,SAAoB,KAAa,QAAgB,MAA8B;AAC5G,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,MAAM,IAAI,gBAAgB,mBAAmB;AAAA,IACjF,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,QAAQ,YAAY,IAAI,MAAM,IAAI,MAAMD,UAAS,GAAG,CAAC,EAAE;AACtG;AAGO,SAAS,qBAAqB,OAAgG;AACnI,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAME,kBAAiB,SAAS,KAAK;AACrC,WAAOA,kBAAiB,EAAE,gBAAAA,gBAAe,IAAI;AAAA,EAC/C;AACA,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,MAAM;AACZ,QAAM,iBAAiB,SAAS,IAAI,cAAc;AAClD,SAAO,iBAAiB,EAAE,gBAAgB,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC,GAAI,GAAI,IAAI,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC,EAAG,IAAI;AAC7I;AAEA,eAAeF,UAAS,KAAgC;AACtD,MAAI;AACF,WAAO,eAAe,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,GAAG,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AHVA,eAAsB,UAAU,SAA0C;AACxE,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,OAAO,UAAU,GAAG;AAC1B,QAAM,QAAQ,IAAI,SAAS,SAAS,IAAI;AACxC,QAAM,UAAU,IAAI,SAAS,SAAS,MAAM;AAE5C,MAAI,QAAQ,mBAAmB,CAAC,SAAS;AACvC,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,QAAQ,eAAe,QAAQ,qBAAqB,OAAO;AAC7D,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAEA,MAAI,IAAI,YAAY,KAAK,OAAO,KAAK,KAAK,KAAK,GAAG;AAClD,MAAI,IAAI,eAAe,KAAK,WAAW,EAAE;AACzC,MAAI,IAAI,eAAe,KAAK,UAAU,EAAE;AACxC,MAAI,IAAI,eAAe,KAAK,KAAK,KAAK,IAAI,CAAC,EAAE;AAC7C,MAAI,IAAI,eAAe,KAAK,SAAS,KAAK,IAAI,CAAC,EAAE;AACjD,MAAI,IAAI,mBAAmB,KAAK,aAAa,SAAS,KAAK,aAAa,KAAK,IAAI,IAAI,MAAM,EAAE;AAE7F,QAAM,iBAAiB,KAAK,KAAK,OAAO,CAAC,QAAQ,QAAQ,UAAU,QAAQ,YAAY;AACvF,MAAI,CAAC,QAAQ,UAAU,eAAe,SAAS,KAAK,CAAC,QAAQ,KAAK;AAChE,UAAM,IAAI;AAAA,MACR,gDAAgD,eAAe,KAAK,IAAI,CAAC;AAAA,IAC3E;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,sBAAsB,GAAG;AAChD,QAAM,EAAE,QAAQ,MAAM,IAAI;AAE1B,MAAI,QAAQ,QAAQ;AAClB,QAAI,IAAI,0CAA0C;AAClD,QAAI,IAAI,aAAa,SAAS,QAAQ,IAAI,EAAE;AAC5C,QAAI,IAAI,aAAa,QAAQ,OAAO,KAAK,KAAK,EAAE,SAAS,CAAC,aAAa;AACvE,eAAW,eAAe,SAAS,cAAc;AAC/C,YAAM,aAAa,OAAO,KAAK,YAAY,QAAQ,YAAY,CAAC,CAAC,EAAE;AACnE,UAAI,IAAI,iBAAiB,YAAY,EAAE,KAAK,UAAU,gBAAgB,YAAY,OAAO,UAAU,CAAC,WAAW,YAAY,QAAQ,UAAU,CAAC,eAAe;AAAA,IAC/J;AACA,QAAI,IAAI,aAAa,IAAI,SAAS,SAAS,IAAI,IAAK,IAAI,IAAI,YAAY,mBAAoB,aAAa,EAAE;AAC3G,QAAI,IAAI,SAAS,SAAS,UAAU,GAAG;AACrC,iBAAW,OAAO,IAAI,MAAM;AAC1B,cAAM,WAAW,sBAAsB,KAAK,GAAG;AAC/C,YAAI,IAAI,cAAc,GAAG,wBAAmB,SAAS,iBAAiB,kBAAkB,SAAS,sBAAsB,KAAK,IAAI,CAAC,KAAK,4BAA4B,GAAG;AACrK,cAAM,cAAc,uBAAuB,KAAK,GAAG;AACnD,YAAI,IAAI,cAAc,GAAG,oBAAoB,gBAAgB,SAAY,cAAc,eAAe,OAAO,EAAE;AAAA,MACjH;AAAA,IACF;AACA,QAAI,IAAI,cAAc,QAAQ,cAAc,mCAAmC,YAAY,EAAE;AAC7F;AAAA,EACF;AAEA,MAAI,cAAc,gBAAgB,IAAI,MAAM,eAAe;AAC3D,MAAI,eAAe,YAAY,UAAU,IAAI,IAAI,IAAI;AACnD,UAAM,IAAI;AAAA,MACR,kBAAkB,YAAY,IAAI,MAAM,iBAAiB,IAAI,OAAO,CAAC,aAAa,YAAY,KAAK,WAAW,IAAI,IAAI,EAAE;AAAA,IAC1H;AAAA,EACF;AACA,QAAM,cAAc,CAAC,EAAE,QAAQ,cAAc,QAAQ;AACrD,QAAM,cAAc,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,aAAa,KAAK,GAAG,GAAG,SAAS;AAC7E,QAAM,YAAY,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,aAAa,KAAK,GAAG,GAAG,KAAK;AACvE,QAAM,2BAA4B,UAAU,CAAC,CAAC,QAAQ,cAAc,cAAgB,YAAY,eAAe;AAC/G,MAAI,QAAQ,qBAAqB,SAAS,0BAA0B;AAClE,UAAM,IAAI,MAAM,mGAAmG;AAAA,EACrH;AACA,QAAM,gBAAgB,0BAA0B,KAAK,QAAQ,YAAY;AACzE,MAAI,IAAI,MAAM,WAAW;AACvB,oBAAgB,IAAI,SAAS,CAAC,IAAI,MAAM,WAAW,cAAc,GAAG,GAAG,IAAI,MAAM,iBAAiB,GAAI,gBAAgB,CAAC,aAAa,IAAI,CAAC,CAAE,CAAC;AAAA,EAC9I;AACA,MAAI,QAAQ,aAAa;AACvB,UAAM,qBAAqB,EAAE,YAAY,IAAI,YAAY,QAAQ,QAAQ,aAAa,CAAC;AACvF,QAAI,IAAI,qDAAqD;AAAA,EAC/D;AAEA,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,QAAQ,MAAM,kBAAkB,KAAK,SAAS,SAAS,GAAG;AAChE,QAAM,OAAO,iBAAiB,EAAE,UAAU,IAAI,aAAa,OAAO,SAAS,EAAE,OAAO,QAAQ,EAAE,CAAC;AAE/F,QAAM,WAAW,MAAM,KAAK,WAAW,IAAI,IAAI,EAAE;AACjD,MAAI,UAAU;AACZ,QAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,iBAAiB;AAAA,EAC7C,OAAO;AACL,UAAM,KAAK,UAAU,EAAE,MAAM,IAAI,IAAI,MAAM,OAAO,IAAI,IAAI,GAAG,CAAC;AAC9D,QAAI,IAAI,gBAAgB,IAAI,IAAI,EAAE,EAAE;AAAA,EACtC;AAMA,aAAW,OAAO,IAAI,MAAM;AAC1B,UAAM,wBAAwB,SAAS,KAAK,KAAK,KAAK;AAAA,EACxD;AAEA,QAAM,eAAe,CAAC,GAAG,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,IAAI,YAAY,CAAC,CAAC;AACrF,aAAW,OAAO,IAAI,MAAM;AAC1B,eAAW,WAAW,cAAc;AAClC,UAAI,YAAY,MAAM;AACpB,YAAI,IAAI,IAAI,UAAU;AACpB,gBAAM,KAAK,MAAM,IAAI,IAAI,IAAI,KAAK,EAAE,UAAU,IAAI,GAAG,UAAU,GAAI,IAAI,GAAG,QAAQ,EAAE,OAAO,IAAI,GAAG,MAAM,IAAI,CAAC,EAAG,CAAC;AACjH,cAAI,IAAI,GAAG,GAAG,oBAAoB,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,IAAI,IAAI,GAAG,KAAK,KAAK,EAAE,GAAG;AAAA,QAC/F,OAAO;AACL,gBAAM,KAAK,WAAW,IAAI,IAAI,IAAI,MAAM,MAAM,EAAE,IAAI,CAAC;AACrD,cAAI,IAAI,GAAG,GAAG,cAAc;AAAA,QAC9B;AAAA,MACF,OAAO;AACL,cAAM,SAAS,YAAY,aAAa,sBAAsB,KAAK,GAAG,IAAI;AAC1E,cAAM,KAAK,WAAW,IAAI,IAAI,IAAI,SAAS,MAAM,EAAE,KAAK,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC,EAAG,CAAC;AACvF,YAAI,IAAI,GAAG,GAAG,KAAK,OAAO,UAAU;AAAA,MACtC;AAAA,IACF;AAEA,UAAM,aAAa,qBAAqB,IAAI,MAAM,QAAQ,GAAG,CAAC;AAC9D,QAAI,YAAY,gBAAgB;AAC9B,YAAM,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,UAAU;AAC9C,UAAI,IAAI,GAAG,GAAG,4BAA4B,WAAW,QAAQ,QAAQ,GAAG;AAAA,IAC1E;AAEA,UAAM,OAAO,IAAI,QAAQ,GAAG;AAC5B,QAAI,SAAS,QAAW;AACtB,YAAM,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,QAAQ,IAAI;AAChD,UAAI,IAAI,GAAG,GAAG,UAAU,OAAO,QAAQ,SAAS,EAAE;AAAA,IACpD;AAEA,QAAI,IAAI,SAAS,SAAS,UAAU,GAAG;AACrC,YAAM,cAAc,EAAE,UAAU,IAAI,aAAa,OAAO,IAAI,IAAI,IAAI,KAAK,OAAO,OAAO,QAAQ;AAC/F,YAAM,yBAAyB,aAAa,uBAAuB,KAAK,GAAG,GAAG,GAAG;AAAA,IACnF;AAAA,EACF;AAEA,aAAW,OAAO,IAAI,MAAM;AAC1B,UAAM,WAAWG,aAAY,IAAI,IAAI,IAAI,GAAG;AAC5C,kBAAc,MAAM,wBAAwB;AAAA,MAC1C;AAAA,MACA;AAAA,MACA,gBAAgB;AAAA,MAChB;AAAA,MACA,UAAU,CAAC,CAAC,QAAQ;AAAA,MACpB,YAAY;AAAA,MACZ,OAAO,QAAQ,qBAAqB;AAAA,MACpC,OAAO;AAAA,MACP,QAAQ;AAAA,IACV,CAAC;AACD,UAAM,QAAQ,YAAY,KAAK,GAAG,GAAG;AAErC,QAAI,QAAQ,aAAa;AACvB,UAAI;AACF,cAAM,0BAA0B;AAAA,UAC9B,YAAY,IAAI;AAAA,UAChB;AAAA,UACA,KAAK,QAAQ;AAAA,UACb,QAAQ,QAAQ;AAAA,UAChB,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,SAAS,OAAO;AACd,cAAMC,WAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,cAAM,UAAU,QAAQ,UAAU,QAAQ,eAAe,WAAW;AACpE,cAAM,IAAI;AAAA,UACR,GAAGA,QAAO;AAAA,EAAK,GAAG,sEACa,GAAG,GAAG,OAAO;AAAA,UAC5C,EAAE,OAAO,MAAM;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU,OAAO;AACnB,YAAMC,UAAS,SAAS,GAAG,IAAI,UAAU,QAAQ,mBAAmB,QAAQ,CAAC,WAAW,OAAO,EAAE,OAAO,CAAC;AACzG,UAAI,IAAI,GAAG,GAAG,iBAAiB;AAAA,IACjC;AACA,QAAI,OAAO;AACT,YAAMA,UAAS,SAAS,GAAG,IAAI,UAAU,QAAQ,mBAAmB,QAAQ,CAAC,gBAAgB,OAAO,KAAK;AACzG,UAAI,IAAI,GAAG,GAAG,mBAAmB,OAAO,KAAK,KAAK,EAAE,MAAM,cAAc;AAAA,IAC1E;AACA,QAAI,OAAO;AACT,YAAM,0BAA0B,SAAS,IAAI,YAAY,UAAU,OAAO,SAAS,cAAc,KAAK,GAAG;AAAA,IAC3G;AAEA,QAAI,IAAI,SAAS,SAAS,IAAI,KAAK,IAAI,IAAI,YAAY,IAAI,GAAG,QAAQ;AACpE,YAAM,MAAMC,SAAQ,IAAI,IAAI,GAAG,MAAM;AACrC,UAAI,KAAK;AACP,cAAM,aAAa,IAAI,GAAG,cAAc,kBAAkB,IAAI,GAAG,QAAQ;AACzE,cAAMC,WAAU,EAAE,UAAU,IAAI,YAAY,OAAO,OAAO,QAAQ,GAAG,UAAU,YAAY,GAAG;AAC9F,YAAI,IAAI,GAAG,GAAG,KAAK,IAAI,GAAG,QAAQ,yBAAyB,UAAU,GAAG;AAAA,MAC1E,OAAO;AACL,YAAI,IAAI,GAAG,GAAG,KAAK,IAAI,GAAG,MAAM,wCAAwC;AAAA,MAC1E;AAAA,IACF;AAAA,EAEF;AAEA,MAAI,QAAQ,qBAAqB,SAAS,aAAa;AACrD,UAAM,UAAU,IAAI,MAAM,aAAa,eAAe,IAAI,SAAS,IAAI,MAAM,eAAe;AAC5F,QAAI,IAAI,sBAAsB,YAAY,IAAI,MAAM,iBAAiB,IAAI,OAAO,CAAC,SAAS,UAAU,iBAAiB,EAAE,GAAG;AAAA,EAC5H;AAEA,MAAI,iBAAiB,aAAa;AAChC,UAAM,MAAM,IAAI,KAAK,SAAS,KAAK,IAAI,QAAS,IAAI,KAAK,CAAC,KAAK;AAC/D,iBAAa,eAAe,aAAa,KAAK,YAAY,GAAG,CAAC;AAC9D,QAAI,IAAI,mBAAmB,YAAY,eAAe,IAAI,OAAO,CAAC,QAAQ,GAAG,EAAE;AAAA,EACjF;AAIA,MAAI,IAAI,SAAS,SAAS,UAAU,GAAG;AACrC,eAAW,OAAO,IAAI,MAAM;AAC1B,UAAI;AACF,cAAM;AAAA,UACJ,EAAE,UAAU,IAAI,aAAa,OAAO,IAAI,IAAI,IAAI,KAAK,OAAO,OAAO,QAAQ;AAAA,UAC3E;AAAA,YACE,MAAM,QAAQ;AAAA,YACd,gBAAgB,QAAQ;AAAA,YACxB,MAAM,QAAQ;AAAA,YACd,eAAe,QAAQ;AAAA,YACvB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,YAAI,CAAC,2BAA2B,KAAK,EAAG,OAAM;AAC9C,YAAI,IAAI,GAAG,GAAG,+BAA+B,MAAM,IAAI,kDAAkD,GAAG,mCAAmC;AAAA,MACjJ;AAAA,IACF;AAAA,EACF;AACF;;;AIjQA,IAAM,aAA0B;AAAA,EAC9B,MAAM,CAAC;AAAA,EAAG,KAAK,CAAC;AAAA,EAAG,QAAQ,CAAC;AAAA,EAAG,KAAK,CAAC;AAAA,EAAG,KAAK,CAAC;AAAA,EAAG,QAAQ,CAAC;AAAA,EAAG,QAAQ,CAAC;AAAA,EACtE,MAAM,CAAC;AAAA,EAAG,MAAM,CAAC;AAAA,EAAG,SAAS,CAAC;AAAA,EAAG,UAAU,CAAC;AAAA,EAAG,IAAI,CAAC;AAAA,EAAG,QAAQ,CAAC;AAClE;AAGA,IAAM,cAA2B,OAAO;AAAA,EACtC,CAAC,QAAQ,eAAe,QAAQ,UAAU,YAAY,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,UAAU,CAAC;AACnG;AASO,IAAM,kBAA+B;AAAA,EAC1C,OAAO,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE;AAAA,EAC7B,OAAO;AAAA,IACL,IAAI;AAAA,MACF,MAAM,CAAC;AAAA,MAAG,KAAK,CAAC;AAAA,MAAG,aAAa,CAAC;AAAA,MAAG,QAAQ,CAAC;AAAA,MAAG,OAAO,CAAC;AAAA,MAAG,OAAO,CAAC;AAAA,MACnE,YAAY,EAAE,KAAK,CAAC,EAAE;AAAA,IACxB;AAAA,EACF;AAAA,EACA,KAAK;AAAA,IACH,SAAS,CAAC;AAAA,IAAG,SAAS,CAAC;AAAA,IAAG,QAAQ,CAAC;AAAA,IAAG,QAAQ,CAAC;AAAA,IAAG,QAAQ,CAAC;AAAA,IAC3D,mBAAmB,CAAC;AAAA,IAAG,WAAW,CAAC;AAAA,IAAG,SAAS,CAAC;AAAA,IAChD,QAAQ,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,QAAQ,CAAC,EAAE;AAAA,EAC1C;AAAA,EACA,UAAU,EAAE,QAAQ,CAAC,GAAG,WAAW,CAAC,GAAG,SAAS,CAAC,GAAG,YAAY,CAAC,EAAE;AAAA,EACnE,cAAc,CAAC;AAAA,EACf,MAAM,EAAE,SAAS,CAAC,EAAE;AAAA,EACpB,SAAS,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE;AAAA;AAAA,EAEpD,SAAS;AAAA,IACP,QAAQ,CAAC;AAAA,IAAG,MAAM,CAAC;AAAA,IAAG,QAAQ,CAAC;AAAA,IAAG,MAAM,CAAC;AAAA,IAAG,MAAM,CAAC;AAAA,IAAG,OAAO,CAAC;AAAA,IAC9D,SAAS,CAAC;AAAA,IAAG,KAAK,CAAC;AAAA,IAAG,OAAO,CAAC;AAAA,EAChC;AAAA,EACA,QAAQ,CAAC;AAAA,EACT,MAAM,CAAC;AAAA,EACP,MAAM,CAAC;AAAA,EACP,MAAM,EAAE,QAAQ,CAAC,EAAE;AAAA,EACnB,IAAI;AAAA,IACF,GAAG;AAAA,IACH,SAAS,CAAC;AAAA,EACZ;AAAA,EACA,WAAW,CAAC;AAAA,EACZ,SAAS;AAAA,IACP,KAAK,CAAC;AAAA,IAAG,QAAQ,CAAC;AAAA,IAAG,QAAQ,CAAC;AAAA,IAAG,MAAM,CAAC;AAAA,IAAG,KAAK,CAAC;AAAA,IAAG,KAAK,CAAC;AAAA,IAAG,KAAK,CAAC;AAAA,IACnE,MAAM,CAAC;AAAA,IAAG,SAAS,CAAC;AAAA,IAAG,QAAQ,CAAC;AAAA,IAAG,YAAY,CAAC;AAAA,IAAG,SAAS,CAAC;AAAA,IAC7D,SAAS,CAAC;AAAA,IAAG,SAAS,CAAC;AAAA,IAAG,QAAQ,CAAC;AAAA,IAAG,IAAI,CAAC;AAAA,IAAG,MAAM,CAAC;AAAA,EACvD;AAAA,EACA,SAAS,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,iBAAiB,CAAC,EAAE;AAAA,EAClD,UAAU;AAAA,IACR,MAAM,CAAC;AAAA,IAAG,SAAS,CAAC;AAAA,IAAG,KAAK,CAAC;AAAA,IAAG,QAAQ,CAAC;AAAA,IAAG,QAAQ,CAAC;AAAA,IACrD,QAAQ,EAAE,SAAS,CAAC,GAAG,YAAY,CAAC,EAAE;AAAA,EACxC;AAAA,EACA,OAAO,CAAC;AAAA,EACR,OAAO,EAAE,SAAS,CAAC,EAAE;AAAA,EACrB,OAAO,CAAC;AAAA,EACR,SAAS,CAAC;AAAA,EACV,QAAQ,CAAC;AACX;AAGO,SAAS,cAAc,MAAmC;AAC/D,MAAI,OAAgC;AACpC,aAAW,QAAQ,MAAM;AACvB,WAAO,OAAO,IAAI;AAClB,QAAI,CAAC,KAAM,QAAO,CAAC;AAAA,EACrB;AACA,SAAO,OAAO,KAAK,IAAI,EAAE,KAAK;AAChC;AAmBO,SAAS,mBAAmBC,QAAoD;AACrF,MAAI,OAAoB;AACxB,QAAM,SAAmB,CAAC;AAC1B,aAAW,QAAQA,QAAO;AACxB,QAAI,OAAO,KAAK,IAAI,EAAE,WAAW,EAAG,QAAO;AAC3C,UAAM,OAAO,KAAK,IAAI;AACtB,QAAI,CAAC,KAAM,QAAO,EAAE,aAAa,OAAO,KAAK,GAAG,GAAG,MAAM,UAAU,OAAO,KAAK,IAAI,EAAE,KAAK,EAAE;AAC5F,WAAO,KAAK,IAAI;AAChB,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAIO,SAAS,gBAAgB,SAAoC;AAClE,QAAM,QAAQ,QAAQ,cAAc,UAAU,QAAQ,WAAW,MAAM;AACvE,SAAO,IAAI,QAAQ,IAAI,qBAAqB,KAAK,gBAAW,QAAQ,SAAS,KAAK,IAAI,CAAC;AACzF;AASO,SAAS,eAAeA,QAAoC;AACjE,MAAI,OAAoB;AACxB,QAAM,OAAiB,CAAC;AACxB,aAAW,QAAQA,QAAO;AACxB,UAAM,OAAgC,KAAK,IAAI;AAC/C,QAAI,CAAC,KAAM;AACX,SAAK,KAAK,IAAI;AACd,WAAO;AACP,QAAI,OAAO,KAAK,IAAI,EAAE,WAAW,EAAG;AAAA,EACtC;AACA,SAAO;AACT;AAKO,SAAS,aAAa,OAAoB,iBAAiB,SAA4B,CAAC,GAAe;AAC5G,QAAM,QAAoB,CAAC;AAC3B,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG;AAChD,UAAM,OAAO,CAAC,GAAG,QAAQ,IAAI;AAC7B,UAAM,KAAK,IAAI;AACf,UAAM,KAAK,GAAG,aAAa,OAAO,IAAI,CAAC;AAAA,EACzC;AACA,SAAO;AACT;;;ACpKA,SAAS,cAAAC,aAAY,YAAAC,WAAU,WAAAC,UAAS,OAAAC,YAAW;AACnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP,SAAS,cAAc,mBAAmB,8BAA8B;AA4DxE,eAAsB,kBAAkB,SAAkE;AACxG,MAAI,QAAQ,wBAAwB,YAAY;AAC9C,UAAM,IAAI,MAAM,uGAAuG;AAAA,EACzH;AAEA,QAAM,YAAY,QAAQ,cAAc;AACxC,QAAM,MAAM,YAAY,SAAY,MAAM,kBAAkB,QAAQ,cAAc,iBAAiB;AACnG,QAAM,QAAQ,YAAY,YAAY,IAAK,IAAI;AAC/C,QAAM,MAAM,YAAY,SAAS,UAAU,QAAQ,KAAK,IAAK,MAAM,IAAK,YAAY,IAAK,OAAO;AAChG,QAAM,WAAW,QAAQ,YAAY,KAAK,eAAe;AACzD,QAAM,SAASC,SAAQ,QAAQ,UAAU,KAAK,WAAW,GAAG;AAC5D,QAAM,SAASA,SAAQ,QAAQ,OAAOA,SAAQ,QAAQ,uBAAuB,CAAC;AAC9E,QAAM,iBAAiBC,UAAS,QAAQ,MAAM,EAAE,MAAMC,IAAG,EAAE,KAAK,GAAG;AACnE,MAAI,CAAC,eAAgB,OAAM,IAAI,MAAM,sDAAsD;AAG3F,QAAM,UAAU,WAAW,QAAQ,WAAW,QAAQ,QAAQ,gBAAgB,EAAE;AAEhF,QAAM,eAA2C;AAAA,IAC/C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,YAAY,2BAA2B;AAAA,EAChD;AACA,QAAM,QAAQ,MAAM,cAAc,SAAS,YAAY;AACvD,QAAM,WAAW,MAAM,kBAAkB,QAAQ;AAAA,IAC/C,SAAS,CAAC,eAAe,WAAW,KAAK,KAAK,CAACC,YAAW,cAAc,IAAI,CAAC,cAAc,IAAI,CAAC;AAAA,EAClG,CAAC;AACD,QAAM,SAAS,MAAM,gCAAgC;AAAA,IACnD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,SAAS;AAAA,IACrB,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,IACzB,kBAAkB;AAAA,IAClB,aAAa,QAAQ,SAAS,OAAO,WAAW;AAAA,IAChD,GAAI,YAAY,EAAE,WAAW,EAAE,SAAS,MAAe,SAAS,mCAAmC,EAAE,IAAI,CAAC;AAAA,IAC1G,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ;AAAA,EAClB,CAAC;AACD,QAAM,UAAU,sBAAsB;AAAA,IACpC;AAAA,IACA,OAAO,IAAI,aAAaH,SAAQ,QAAQ,OAAO,CAAC;AAAA,IAChD,mBAAmB,OAAO;AAAA,IAC1B,oBAAoB,OAAO;AAAA,IAC3B,QAAQ;AAAA,MACN,uBAAuB;AAAA,MACvB,QAAQ;AAAA,MACR,cAAc;AAAA,IAChB;AAAA,EACF,CAAC;AACD,QAAMI,UAAS,MAAM,QAAQ,IAAI,UAAU,EAAE,OAAO,OAAO,IAAI,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC9F,QAAM,uBAAuB,QAAQA,OAAM;AAC3C,QAAM,eAAe,MAAM,oBAAoBA,OAAM;AACrD,QAAM,OAAO,SAAS;AAAA,IACpB;AAAA,IACA,gBAAgBA,QAAO;AAAA,IACvB,WAAWA,QAAO,QAAQ;AAAA,IAC1B,YAAYA,QAAO,QAAQ;AAAA,EAC7B,GAAG,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAC7B,eAAa,QAAQ,UAAU,SAAS,OAAO,KAAK,OAAO,KAAKA,SAAQ,MAAM;AAC9E,SAAO,OAAO,OAAO,EAAE,QAAAA,SAAQ,KAAK,OAAO,KAAK,OAAO,CAAC;AAC1D;AAEA,SAAS,UAAU,WAA+B,UAAoB,YAAoB,SAAyB;AACjH,QAAM,MAAM,cAAc,SAAS,SAAS,KAAK,IAAI,QAAQ,SAAS,CAAC;AACvE,MAAI,CAAC,OAAO,CAAC,SAAS,SAAS,GAAG,GAAG;AACnC,UAAM,QAAQH,UAAS,SAAS,UAAU,KAAK;AAC/C,UAAM,IAAI,MAAM,QAAQ,OAAO,EAAE,wBAAwB,KAAK,EAAE;AAAA,EAClE;AACA,SAAO;AACT;AAEA,eAAe,cAAc,SAAmCI,UAAsD;AACpH,QAAM,QAAQ,QAAQ,SAAS,MAAM,QAAQ,WAAW,OAAO,OAAO,EAAE,GAAGA,SAAQ,CAAC,CAAC;AACrF,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,SAAS,QAAS,2BAA2B,KAAK,KAAK,GAAG;AACnH,UAAM,IAAI;AAAA,MACRA,SAAQ,YACJ,oEACA;AAAA,IACN;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,MAA6B,cAAmD;AAClG,QAAM,UAAU,SAAS,SACrB,YAAY,IACZ,SAAS,mBACP,qBAAqB,IACrB,SAAS,YACP,eAAe,IACf;AACR,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,6BAA6B,OAAO,IAAI,CAAC,GAAG;AAC1E,MAAI,iBAAiB,OAAW,QAAO;AACvC,MAAI,CAAC,OAAO,cAAc,YAAY,KAAK,eAAe,EAAG,OAAM,IAAI,MAAM,yCAAyC;AACtH,SAAO,EAAE,GAAG,SAAS,aAAa;AACpC;AAEA,SAAS,aACP,KACA,OACA,KACA,KACAD,SACA,QACM;AACN,QAAM,WAAWA,QAAO,SAAS,OAAO,CAAC,SAAS,KAAK,UAAU,UAAU,EAAE;AAC7E,MAAI,IAAI,aAAa,KAAK,IAAI,GAAG,QAAQ,IAAI,KAAK,YAAY,IAAI,cAAc,EAAE;AAClF,MAAI,IAAI,gBAAgB,IAAI,UAAU,SAAS,QAAQ,IAAI,IAAI,UAAU,SAAS,KAAK,EAAE;AACzF,MAAI,IAAI,iBAAiB,IAAI,WAAW,SAAS,QAAQ,IAAI,IAAI,WAAW,SAAS,KAAK,EAAE;AAC5F,MAAI,IAAI,eAAeA,QAAO,cAAc,IAAI,QAAQ,IAAIA,QAAO,SAAS,MAAM,YAAYA,QAAO,QAAQ,YAAY,YAAYA,QAAO,QAAQ,YAAY,gBAAgBA,QAAO,QAAQ,gBAAgB,qBAAqBA,QAAO,QAAQ,oBAAoB,EAAE;AACzQ,MAAIA,QAAO,WAAY,KAAI,IAAI,sBAAsB,aAAaA,QAAO,WAAW,SAAS,CAAC,eAAe,aAAaA,QAAO,WAAW,UAAU,CAAC,EAAE;AACzJ,MAAI,IAAI,yBAAyBA,QAAO,QAAQ,SAAS,uBAAuBA,QAAO,QAAQ,iBAAiB,eAAeA,QAAO,QAAQ,UAAU,EAAE;AAC1J,MAAI,IAAI,aAAaJ,SAAQ,QAAQ,WAAW,CAAC,EAAE;AACrD;AAEA,SAAS,aAAa,OAAwD;AAC5E,SAAO,QAAQ,GAAG,MAAM,SAAS,IAAI,MAAM,QAAQ,YAAY,MAAM,YAAY,KAAK;AACxF;;;ACtLA,eAAsB,wBACpB,SACuC;AACvC,QAAM,QAAQ,iBAAiB,QAAQ,OAAO,OAAO;AACrD,QAAM,MAAM,iBAAiB,QAAQ,KAAK,KAAK;AAC/C,QAAM,WAAW,iBAAiB,QAAQ,UAAU,UAAU;AAC9D,QAAM,MAAM,mBAAmB,QAAQ,KAAK,OAAO,GAAG;AACtD,QAAM,QAAQ,IAAI,gBAAgB,EAAE,KAAK,SAAS,CAAC;AACnD,MAAI,IAAK,OAAM,IAAI,OAAO,GAAG;AAC7B,MAAI,QAAQ,QAAS,OAAM,IAAI,WAAW,QAAQ,OAAO;AACzD,QAAMM,YAAW,MAAM;AAAA,IACrB;AAAA,IACA,kBAAkB,mBAAmB,KAAK,CAAC,oBAAoB,MAAM,SAAS,CAAC;AAAA,IAC/E,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,0BAA0BA,UAAS,MAAM,GAAG,KAC1C,CAAC,cAAcA,UAAS,QAAQ,EAAE,OAAO,KAAK,SAAS,CAAC,GAAG;AAChE,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,MAAIA,UAAS,OAAO,eAAeA,UAAS,KAAK,YAAY;AAC3D,UAAM,IAAI,MAAM,2EAA2E;AAAA,EAC7F;AACA,SAAOA;AACT;AAEA,SAAS,cACP,OACA,UAC+B;AAC/B,SAAO,CAAC,CAAC,SACJ,MAAM,sBAAsB,+CAC5B,wBAAwB,KAAK,MAAM,eAAe,KAClD,wBAAwB,KAAK,MAAM,UAAU,KAC7C,MAAM,UAAU,SAAS,SAAS,MAAM,QAAQ,SAAS,OAAO,MAAM,aAAa,SAAS,YAC5F,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,SAAS,KAAK,MAAM,WAAW,UAAU,OAClG,OAAO,MAAM,kBAAkB,YAAY,MAAM,cAAc,SAAS,KAAK,MAAM,cAAc,UAAU,OAC3G,OAAO,MAAM,iBAAiB,YAAY,MAAM,aAAa,SAAS,KACtE,MAAM,aAAa,UAAU,OAAO,CAAC,wBAAwB,KAAK,MAAM,YAAY,KACpF,CAAC,QAAQ,kBAAkB,SAAS,EAAE,SAAS,MAAM,OAAO,KAC5D,MAAM,qBAAqB;AAClC;;;AC9BA,eAAsB,sBACpB,SAC6B;AAC7B,QAAM,QAAQ,iBAAiB,QAAQ,OAAO,OAAO;AACrD,QAAM,MAAM,iBAAiB,QAAQ,KAAK,KAAK;AAC/C,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA,kBAAkB,mBAAmB,KAAK,CAAC,sBAAsB,mBAAmB,GAAG,CAAC;AAAA,IACxF,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,0BAA0B,MAAM,GAAG,GAAG;AACzC,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,SAAO;AACT;AAKA,eAAsB,uBACpB,SAC4B;AAC5B,MAAI,QAAQ,wBAAwB,YAAY;AAC9C,UAAM,IAAI,MAAM,iHAAiH;AAAA,EACnI;AACA,QAAM,QAAQ,iBAAiB,QAAQ,OAAO,OAAO;AACrD,QAAM,MAAM,iBAAiB,QAAQ,KAAK,KAAK;AAC/C,QAAM,WAAW,iBAAiB,QAAQ,UAAU,UAAU;AAC9D,QAAM,MAAM,mBAAmB,QAAQ,KAAK,OAAO,GAAG;AACtD,QAAM,qBAAqB,mBAAmB,QAAQ,kBAAkB;AACxE,QAAM,0BAA0B,wBAAwB,QAAQ,uBAAuB;AACvF,QAAM,yBAAyB;AAAA,IAC7B,WAAW;AAAA,MACT,QAAQ,wBAAwB;AAAA,MAChC;AAAA,IACF;AAAA,IACA,YAAY;AAAA,MACV,QAAQ,wBAAwB;AAAA,MAChC;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM;AAAA,MACX;AAAA,MACA,kBAAkB,mBAAmB,KAAK,CAAC;AAAA,MAC3C;AAAA,QACE,QAAQ;AAAA,QACR,MAAM,KAAK,UAAU;AAAA,UACnB;AAAA,UACA;AAAA,UACA,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,UACrB,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,UACtD,GAAI,QAAQ,kBACR,EAAE,iBAAiB,iBAAiB,QAAQ,iBAAiB,iBAAiB,EAAE,IAChF,CAAC;AAAA,UACL,kBAAkB;AAAA,UAClB;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAMC,WAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,QAAI,8EAA8E,KAAKA,QAAO,GAAG;AAC/F,YAAM,IAAI,MAAM,2KAA2K,EAAE,OAAO,MAAM,CAAC;AAAA,IAC7M;AACA,UAAM;AAAA,EACR;AACA,MAAI,CAAC,KAAK,KAAK,OAAO;AACpB,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,SAAO,KAAK;AACd;AAGA,eAAsB,qBACpB,SAC4B;AAC5B,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA,cAAc,QAAQ,OAAO,QAAQ,KAAK;AAAA,IAC1C,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,KAAK,KAAK,MAAO,OAAM,IAAI,MAAM,iDAAiD;AACvF,SAAO,KAAK;AACd;AAGA,eAAsB,uBACpB,SAC8B;AAC9B,QAAM,QAAQ,iBAAiB,QAAQ,OAAO,OAAO;AACrD,QAAM,MAAM,iBAAiB,QAAQ,KAAK,KAAK;AAC/C,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA,kBAAkB,mBAAmB,KAAK,CAAC,sBAAsB,mBAAmB,GAAG,CAAC;AAAA,IACxF,CAAC;AAAA,IACD;AAAA,EACF;AACA,SAAO,MAAM,QAAQ,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;AACjD;AAGA,eAAsB,wBACpB,SAC4B;AAC5B,QAAM,WAAW,mBAAmB,QAAQ,cAAc;AAC1D,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,WAAW,IAAI,IAAI,kBAAkB,QAAQ,iBAAiB,KAAK,GAAM;AAC/E,QAAMC,QAAO,QAAQ,QAAQ;AAC7B,MAAI,QAAQ;AACZ,SAAO,MAAM;AACX,UAAM,MAAM,MAAM,qBAAqB,OAAO;AAC9C,UAAM,cAAc,GAAG,IAAI,MAAM,IAAI,IAAI,SAAS;AAClD,QAAI,gBAAgB,MAAO,SAAQ,WAAW,OAAO,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AACvE,YAAQ;AACR,QAAI,+BAA+B,IAAI,MAAM,EAAG,QAAO;AACvD,QAAI,IAAI,KAAK,UAAU;AACrB,YAAM,IAAI,MAAM,uBAAuB,IAAI,KAAK,6CAA6C;AAAA,IAC/F;AACA,UAAMA,MAAK,KAAK,IAAI,UAAU,KAAK,IAAI,GAAG,WAAW,IAAI,CAAC,CAAC,GAAG,QAAQ,MAAM;AAAA,EAC9E;AACF;AAGA,eAAsB,wBACpB,SAC+B;AAC/B,SAAO;AAAA,IACL;AAAA,IACA,GAAG,cAAc,QAAQ,OAAO,QAAQ,KAAK,CAAC;AAAA,IAC9C,CAAC;AAAA,IACD;AAAA,EACF;AACF;AAGO,SAAS,+BACd,QACS;AACT,SAAO,WAAW,eAAe,WAAW,YAAY,WAAW;AACrE;AAEA,SAAS,cAAc,YAAoB,YAA4B;AACrE,QAAM,QAAQ,iBAAiB,YAAY,OAAO;AAClD,QAAM,QAAQ,iBAAiB,YAAY,OAAO;AAClD,SAAO,kBAAkB,mBAAmB,KAAK,CAAC,kBAAkB,mBAAmB,KAAK,CAAC;AAC/F;AAEA,SAAS,mBAAmB,OAAmC;AAC7D,MAAI,CAAC,wBAAwB,KAAK,KAAK,GAAG;AACxC,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,OAAmC;AAClE,MAAI,CAAC,wBAAwB,KAAK,KAAK,GAAG;AACxC,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,SAAO;AACT;;;ACtLO,SAAS,UAAU,MAA4B;AACpD,QAAM,cAAwB,CAAC;AAC/B,QAAM,UAAuC,CAAC;AAC9C,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,CAAC,IAAI,WAAW,IAAI,GAAG;AACzB,kBAAY,KAAK,GAAG;AACpB;AAAA,IACF;AACA,UAAM,KAAK,IAAI,QAAQ,GAAG;AAC1B,UAAM,UAAU,IAAI,MAAM,GAAG,OAAO,KAAK,SAAY,EAAE;AACvD,QAAI,CAAC,QAAS;AACd,QAAI,QAAQ,WAAW,KAAK,GAAG;AAC7B,cAAQ,QAAQ,MAAM,CAAC,CAAC,IAAI;AAC5B;AAAA,IACF;AACA,QAAI,OAAO,IAAI;AACb,gBAAU,SAAS,SAAS,IAAI,MAAM,KAAK,CAAC,CAAC;AAC7C;AAAA,IACF;AACA,UAAM,QAAQ,KAAK,IAAI,CAAC;AACxB,QAAI,UAAU,UAAa,CAAC,MAAM,WAAW,IAAI,GAAG;AAClD;AACA,gBAAU,SAAS,SAAS,KAAK;AAAA,IACnC,OAAO;AACL,gBAAU,SAAS,SAAS,IAAI;AAAA,IAClC;AAAA,EACF;AACA,SAAO,EAAE,aAAa,QAAQ;AAChC;AAEO,SAAS,WAAW,QAAoBC,iBAA0B,gBAA8B;AACrG,QAAM,UAAU,IAAI,IAAIA,eAAc;AACtC,aAAW,QAAQ,OAAO,KAAK,OAAO,OAAO,GAAG;AAC9C,QAAI,CAAC,QAAQ,IAAI,IAAI,EAAG,OAAM,IAAI,MAAM,qBAAqB,IAAI,6CAA6C;AAAA,EAChH;AACA,MAAI,OAAO,YAAY,SAAS,gBAAgB;AAC9C,UAAM,IAAI,MAAM,wBAAwB,OAAO,YAAY,cAAc,CAAC,uBAAuB;AAAA,EACnG;AACF;AAEO,SAAS,eAAe,OAAgC,MAAsB;AACnF,QAAM,SAAS,UAAU,KAAK;AAC9B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,GAAG,IAAI,cAAc;AAClD,SAAO;AACT;AAEO,SAAS,UAAU,OAAoD;AAC5E,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,MAAM,SAAS,CAAC;AACvD,SAAO;AACT;AAEO,SAAS,QAAQ,OAAsD;AAC5E,MAAI,UAAU,UAAa,OAAO,UAAU,UAAW,QAAO;AAC9D,QAAM,SAAS,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AACpD,SAAO,OAAO,QAAQ,CAAC,SAAS,KAAK,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,OAAO;AAC5F;AAEO,SAAS,QAAQ,OAAqD;AAC3E,MAAI,OAAO,UAAU,UAAW,QAAO;AACvC,MAAI,OAAO,UAAU,aAAa,UAAU,UAAU,UAAU,SAAU,QAAO,UAAU;AAC3F,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,MAAM,sCAAsC;AACxD;AAEO,SAAS,UAAU,OAAgC,MAAkC;AAC1F,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,MAAM,UAAU,KAAK;AAC3B,QAAM,SAAS,QAAQ,SAAY,OAAO,MAAM,OAAO,GAAG;AAC1D,MAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,8BAA8B;AACtG,SAAO;AACT;AAEA,SAAS,UAAU,SAAsC,MAAc,OAA+B;AACpG,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,YAAY,OAAW,SAAQ,IAAI,IAAI;AAAA,WAClC,MAAM,QAAQ,OAAO,EAAG,SAAQ,KAAK,OAAO,KAAK,CAAC;AAAA,MACtD,SAAQ,IAAI,IAAI,CAAC,OAAO,OAAO,GAAG,OAAO,KAAK,CAAC;AACtD;;;ACvFA,SAAS,cAAAC,oBAAkB;AAC3B,SAAS,QAAAC,QAAM,WAAAC,iBAAe;AAC9B,OAAOC,eAAa;;;ACFpB,SAAS,cAAAC,aAAY,gBAAAC,qBAAoB;AACzC,SAAS,WAAAC,gBAAe;AACxB,SAAS,WAAAC,UAAS,QAAAC,OAAM,WAAAC,iBAAe;AACvC,OAAOC,cAAa;AAwBb,SAAS,sBAA8B;AAC5C,SAAOC;AAAA,IACL,MAAMC,SAAQ,IAAI,iBAAiB,KACjCC,MAAKC,SAAQ,GAAG,SAAS,eAAe;AAAA,EAC5C;AACF;AAGO,SAAS,uBACd,QAC0B;AAC1B,QAAM,WAAW,MAAM,UAAU,OAAO,QAAQ,OAAO,CAAC;AACxD,QAAM,kBAAkB,MAAMF,SAAQ,IAAI,YAAY;AACtD,QAAM,OAAO,YAAY,mBAAmB;AAC5C,QAAM,OAAO,oBAAoB;AACjC,MAAI,CAAC,MAAM;AACT,WAAO,EAAE,MAAM,MAAM,QAAQ,cAAc,MAAM,OAAO,KAAK;AAAA,EAC/D;AACA,qBAAmB,MAAM,SAAS;AAClC,QAAM,WAAW,qBAAqB,IAAI;AAC1C,QAAM,QAAQ,OAAO,OAAO,UAAU,IAAI,IAAI,SAAS,IAAI,IAAK;AAChE,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,qBAAqB,IAAI,kBAAkB,IAAI;AAAA,IACjD;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,WAAW,SAAS;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACF;AAGO,SAAS,qBACd,OAAO,oBAAoB,GACgB;AAC3C,SAAO,OAAO,QAAQ,qBAAqB,IAAI,CAAC,EAC7C,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EACrC,IAAI,CAAC,CAAC,MAAM,OAAO,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE;AACpD;AAGO,SAAS,oBACd,MACA,SACA,OAAO,oBAAoB,GACrB;AACN,qBAAmB,MAAM,SAAS;AAClC,QAAM,aAAa,gBAAgB,SAAS,qBAAqB,IAAI,GAAG;AACxE,QAAM,WAAW,qBAAqB,IAAI;AAC1C,WAAS,IAAI,IAAI;AACjB,mBAAiB,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;AACvD;AAGO,SAAS,sBACd,MACA,OAAO,oBAAoB,GAClB;AACT,qBAAmB,MAAM,SAAS;AAClC,QAAM,WAAW,qBAAqB,IAAI;AAC1C,MAAI,CAAC,OAAO,OAAO,UAAU,IAAI,EAAG,QAAO;AAC3C,SAAO,SAAS,IAAI;AACpB,mBAAiB,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;AACrD,SAAO;AACT;AAGO,SAAS,wBACd,WACuC;AACvC,QAAM,OAAO,UAAU,OACnBC,MAAKE,SAAQ,UAAU,IAAI,GAAG,YAAY,UAAU,IAAI,IACxDF,MAAKC,SAAQ,GAAG,OAAO;AAC3B,SAAO;AAAA,IACL,WAAWD,MAAK,MAAM,gBAAgB;AAAA,IACtC,QAAQA,MAAK,MAAM,wBAAwB;AAAA,EAC7C;AACF;AAEO,SAAS,mBAAmB,OAAe,OAAqB;AACrE,MAAI,CAAC,uBAAuB,KAAK,KAAK,GAAG;AACvC,UAAM,IAAI;AAAA,MACR,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,MAA+C;AAC3E,MAAI,CAACG,YAAW,IAAI,EAAG,QAAO,cAAc;AAC5C,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAMC,cAAa,MAAM,MAAM,CAAC;AAAA,EAC7C,QAAQ;AACN,UAAM,IAAI,MAAM,yBAAyB,IAAI,oBAAoB;AAAA,EACnE;AACA,MACE,CAAC,OACD,OAAO,QAAQ,YACd,IAAqC,kBAAkB,KACxD,CAAE,IAAqC,YACvC,OAAQ,IAAqC,aAAa,YAC1D,MAAM,QAAS,IAAqC,QAAQ,GAC5D;AACA,UAAM,IAAI,MAAM,yBAAyB,IAAI,uBAAuB;AAAA,EACtE;AACA,QAAM,UAAU,OAAO,KAAK,GAAG,EAAE;AAAA,IAC/B,CAAC,QAAQ,CAAC,CAAC,iBAAiB,UAAU,EAAE,SAAS,GAAG;AAAA,EACtD;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI;AAAA,MACR,yBAAyB,IAAI,mCAAmC,QAAQ,KAAK,EAAE,KAAK,IAAI,CAAC;AAAA,IAC3F;AAAA,EACF;AACA,QAAM,WAAW,cAAc;AAC/B,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO;AAAA,IAChC,IAA4B;AAAA,EAC/B,GAAG;AACD,uBAAmB,MAAM,SAAS;AAClC,aAAS,IAAI,IAAI,gBAAgB,OAAO,qBAAqB,IAAI,GAAG;AAAA,EACtE;AACA,SAAO;AACT;AAEA,SAAS,gBAAiD;AACxD,SAAO,uBAAO,OAAO,IAAI;AAC3B;AAEA,SAAS,gBAAgB,OAAgB,OAAgC;AACvE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,UAAM,IAAI,MAAM,GAAG,KAAK,uBAAuB;AAAA,EACjD;AACA,QAAM,UAAU,OAAO,KAAK,KAAK,EAAE;AAAA,IACjC,CAAC,QAAQ,CAAC,CAAC,YAAY,OAAO,aAAa,EAAE,SAAS,GAAG;AAAA,EAC3D;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI;AAAA,MACR,GAAG,KAAK,mCAAmC,QAAQ,KAAK,EAAE,KAAK,IAAI,CAAC;AAAA,IACtE;AAAA,EACF;AACA,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,aAAa,UAAU;AAC1C,UAAM,IAAI,MAAM,GAAG,KAAK,iCAAiC;AAAA,EAC3D;AACA,QAAM,WAAW,iBAAiB,UAAU,QAAQ;AACpD,QAAM,MAAM,MAAM,UAAU,GAAG;AAC/B,QAAMC,eAAc,MAAM,UAAU,WAAW;AAC/C,MAAI,IAAK,oBAAmB,KAAK,KAAK;AACtC,MAAIA,aAAa,oBAAmBA,cAAa,aAAa;AAC9D,SAAO;AAAA,IACL;AAAA,IACA,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,IACrB,GAAIA,eAAc,EAAE,aAAAA,aAAY,IAAI,CAAC;AAAA,EACvC;AACF;AAEA,SAAS,MAAM,OAA+C;AAC5D,QAAM,aAAa,OAAO,KAAK;AAC/B,SAAO,cAAc;AACvB;;;AD/KA,IAAMC,oBAAmB;AAyDzB,eAAsB,uBACpB,QACA,UAAyC,CAAC,GACR;AAClC,QAAM,UAAU,uBAAuB,MAAM;AAC7C,QAAM,iBACJ,UAAU,OAAO,QAAQ,MAAM,KAAK;AACtC,QAAM,aAAaC,UAAQ,cAAc;AACzC,QAAM,iBAAiB,OAAO,QAAQ,WAAW;AACjD,QAAM,YAAYC,aAAW,UAAU;AACvC,MAAI,CAAC,cAAc,CAAC,QAAQ,sBAAsB,iBAAiB;AACjE,UAAM,kBAAkB,cAAc;AAAA,EACxC;AACA,QAAM,SAAS,YACX,MAAM,kBAAkB,cAAc,IACtC;AAEJ,QAAM,eAAeC,OAAM,UAAU,OAAO,QAAQ,QAAQ,CAAC;AAC7D,QAAM,sBAAsBA,OAAMC,UAAQ,IAAI,iBAAiB;AAC/D,QAAM,gBAAgB;AAAA,IACpB,gBACE,uBACA,QAAQ,OAAO,YACf,QAAQ,eACRJ;AAAA,EACJ;AACA,QAAM,iBACJ,eACI,SACA,sBACE,gBACA,QAAQ,QACN,YACA,SACE,WACA;AAEZ,QAAM,UAAUG,OAAM,UAAU,OAAO,QAAQ,GAAG,CAAC;AACnD,QAAM,iBAAiBA,OAAMC,UAAQ,IAAI,WAAW;AACpD,QAAM,WACJ,WAAW,kBAAkB,QAAQ,OAAO,OAAO,QAAQ,IAAI,MAAM;AACvE,QAAM,YAA2B,UAC7B,SACA,iBACE,gBACA,QAAQ,OAAO,MACb,YACA,SACE,WACA;AACV,MAAI,SAAU,oBAAmB,UAAU,KAAK;AAChD,MAAI,QAAQ,cAAc,CAAC,UAAU;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAUD,OAAM,UAAU,OAAO,QAAQ,GAAG,CAAC;AACnD,QAAM,iBAAiBA,OAAMC,UAAQ,IAAI,QAAQ;AACjD,QAAM,mBACJ,WACA,kBACA,QAAQ,OAAO,eACf,QAAQ,sBACR;AACF,QAAM,oBAAmC,UACrC,SACA,iBACE,gBACA,QAAQ,OAAO,cACb,YACA,QAAQ,qBACN,YACA;AACV,MAAI,kBAAkB;AACpB,uBAAmB,kBAAkB,aAAa;AAAA,EACpD;AAEA,QAAM,UAAU,QAAQ,WAAWA,UAAQ,IAAI;AAC/C,QAAM,qBAAqB,wBAAwB,OAAO;AAC1D,QAAM,YAAYD,OAAMC,UAAQ,IAAI,mBAAmB,IACnDH,UAAQG,UAAQ,IAAI,mBAAoB,IACxC,QAAQ,OACN,mBAAmB,YACnB,QAAQ,MAAM,aAAa,mBAAmB;AACpD,QAAM,kBAAkBD,OAAMC,UAAQ,IAAI,qBAAqB,IAC3DH,UAAQG,UAAQ,IAAI,qBAAsB,IAC1C,QAAQ,OACN,mBAAmB,SACnB,SACEC,OAAK,OAAO,SAAS,SAAS,wBAAwB,IACtD,mBAAmB;AAC3B,QAAM,MACJ,SACI;AAAA,IACE,GAAG;AAAA,IACH,aAAa;AAAA,IACb,KAAK,WACD;AAAA,MACE,IAAI;AAAA,MACJ,MACE,aAAa,OAAO,IAAI,KAAK,OAAO,IAAI,OAAO;AAAA,IACnD,IACA,OAAO;AAAA,IACX,OAAO,EAAE,GAAG,OAAO,OAAO,UAAU;AAAA,EACtC,IACA;AAAA,IACE;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,KAAK;AAAA,MACH,IAAI,YAAY;AAAA,MAChB,MAAM,YAAY;AAAA,IACpB;AAAA,IACA,MAAM,mBAAmB,CAAC,gBAAgB,IAAI,CAAC;AAAA,IAC/C,UAAU,CAAC;AAAA,IACX,OAAO;AAAA,MACL;AAAA,MACA,iBAAiBA,OAAK,SAAS,SAAS,wBAAwB;AAAA,MAChE,aAAaA,OAAK,SAAS,WAAW;AAAA,MACtC,WAAW;AAAA,IACb;AAAA,EACF;AAEN,SAAO;AAAA,IACL;AAAA,IACA,SAAS;AAAA,MACP,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ;AAAA,MAChB,MAAM,QAAQ;AAAA,IAChB;AAAA,IACA,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,QAAQ,SAAS,WAAW;AAAA,MAC5B,UAAU;AAAA,IACZ;AAAA,IACA,UAAU,EAAE,OAAO,eAAe,QAAQ,eAAe;AAAA,IACzD,KAAK,EAAE,OAAO,UAAU,QAAQ,UAAU;AAAA,IAC1C,aAAa;AAAA,MACX,OAAO;AAAA,MACP,QAAQ;AAAA,IACV;AAAA,IACA,aAAa;AAAA,MACX,oBAAoB;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAASF,OAAM,OAA+C;AAC5D,QAAM,aAAa,OAAO,KAAK;AAC/B,SAAO,cAAc;AACvB;;;AE9MA,IAAM,kBAAkB,CAAC,YAAY,UAAU,WAAW,SAAS,QAAQ,OAAO;AAClF,IAAM,eAAe,CAAC,GAAG,iBAAiB,MAAM;AAChD,IAAM,cAAc;AAAA,EAClB,GAAG;AAAA,EACH;AAAA,EAAY;AAAA,EAAS;AAAA,EACrB;AAAA,EAAmB;AAAA,EAAqB;AAAA,EACxC;AAAA,EAAsB;AAAA,EAAmB;AAAA,EAAuB;AAClE;AAEA,eAAsB,aAAa,QAAoB,OAAyB,CAAC,GAAkB;AACjG,QAAM,OAAO,OAAO,YAAY,CAAC;AACjC,QAAM,SAAS,OAAO,YAAY,CAAC;AACnC,QAAM,gBAAgB,WAAW,gBAAgB,OAAO,YAAY,CAAC,MAAM;AAC3E,QAAM,cAAc,WAAW;AAC/B,QAAM,SAAS,WAAW;AAC1B,QAAM,QAAQ,WAAW;AACzB,QAAM,QAAQ,WAAW;AACzB,MAAI,SAAS,QAAS,WAAW,UAAU,WAAW,SACjD,CAAC,iBAAiB,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,OAAQ;AACnE,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,QAAM,UAAU,gBACZ,CAAC,GAAG,iBAAiB,YAAY,OAAO,IACxC,WAAW,QACT,cACA,SACE,CAAC,GAAG,cAAc,UAAU,IAC5B,QACE,CAAC,GAAG,cAAc,UAAU,OAAO,UAAU,OAAO,IACpD,QACE,CAAC,GAAG,cAAc,OAAO,IACzB;AACZ,aAAW,QAAQ,SAAS,gBAAgB,IAAI,WAAW,QAAQ,IAAI,CAAC;AACxE,QAAM,UAAU,MAAM,uBAAuB,QAAQ,EAAE,oBAAoB,KAAK,CAAC;AACjF,QAAM,QAAQ;AAAA,IACZ,QAAQ,gBACJ,mBACA,cAAc,gBACd,SAAS,WACT,QAAQ,UACR,QAAQ,UACR;AAAA,IACJ,SAAS,WAAW,QAAQ,OAAO,YAAY,CAAC,IAAI;AAAA,IACpD,UAAU,UAAU,OAAO,QAAQ,QAAQ;AAAA,IAC3C,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,IACrC,SAAS,QAAQ,OAAO,QAAQ,OAAO;AAAA,IACvC,eAAe,UAAU,OAAO,QAAQ,iBAAiB,GAAG,mBAAmB;AAAA,IAC/E,iBAAiB,UAAU,OAAO,QAAQ,mBAAmB,GAAG,qBAAqB;AAAA,IACrF,gBAAgB,UAAU,OAAO,QAAQ,mBAAmB,GAAG,qBAAqB;AAAA,IACpF,UAAU,QAAQ,SAAS;AAAA,IAC3B,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,IACrC,WAAW,QAAQ,YAAY;AAAA,IAC/B,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,IACrC,MAAM,OAAO,QAAQ,SAAS;AAAA,IAC9B,MAAM,OAAO,QAAQ,SAAS,QAC1B,QACA,OAAO,QAAQ,SAAS,OAAO,OAAO;AAAA,IAC1C,oBAAoB,gBAAgB,OAAO,YAAY,CAAC,IAAI;AAAA,IAC5D,SAAS,UAAU,OAAO,QAAQ,UAAU,CAAC;AAAA,IAC7C,OAAO,OAAO,QAAQ,UAAU;AAAA,IAChC,WAAW,KAAK;AAAA,IAChB,mBAAmB,UAAU,OAAO,QAAQ,oBAAoB,CAAC;AAAA,IACjE,gBAAgB,UAAU,OAAO,QAAQ,iBAAiB,CAAC;AAAA,IAC3D,oBAAoB,UAAU,OAAO,QAAQ,qBAAqB,CAAC;AAAA,IACnE,iBAAiB,UAAU,OAAO,QAAQ,kBAAkB,CAAC;AAAA,IAC7D,OAAO,UAAU,OAAO,QAAQ,QAAQ,CAAC;AAAA,IACzC,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,IACjC,OAAO,UAAU,OAAO,QAAQ,QAAQ,CAAC;AAAA,IACzC,OAAO,UAAU,OAAO,QAAQ,OAAO,SAAS;AAAA,IAChD,OAAO,KAAK;AAAA,IACZ,QAAQ,KAAK;AAAA,IACb,iBAAiB,KAAK;AAAA,EACxB,CAAC;AACH;;;AClFA,SAAS,eAAAG,oBAAmB;AAMrB,SAAS,WAAW,KAA0B,WAA4B;AAC/E,QAAM,MAAM,cAAc,IAAI,KAAK,SAAS,KAAK,IAAI,QAAQ,IAAI,KAAK,CAAC;AACvE,MAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,GAAG,GAAG;AACnC,UAAM,IAAI,MAAM,QAAQ,OAAO,EAAE,wBAAwB,IAAI,UAAU,EAAE;AAAA,EAC3E;AACA,SAAO;AACT;AAGO,SAAS,cAAc,KAA0B,WAAqD;AAC3G,QAAM,MAAM,WAAW,KAAK,SAAS;AACrC,SAAO,EAAE,KAAK,QAAQA,aAAY,IAAI,IAAI,IAAI,GAAG,EAAE;AACrD;AAKO,SAAS,YAAY,KAA6D;AACvF,aAAW,OAAO,CAAC,OAAO,MAAM,GAAG;AACjC,QAAI,CAAC,IAAI,KAAK,SAAS,GAAG,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,QAAQ,GAAG,wBAAwB,IAAI,UAAU;AAAA,MAEnD;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,SAASA,aAAY,IAAI,IAAI,IAAI,KAAK,GAAG,MAAMA,aAAY,IAAI,IAAI,IAAI,MAAM,EAAE;AAC1F;;;ACFA,eAAsB,aAAa,QAAoB,OAAwB,CAAC,GAAkB;AAChG,QAAM,SAAS,OAAO,YAAY,CAAC;AACnC,MAAI,WAAW,UAAU,WAAW,SAAS;AAC3C,UAAM,IAAI,MAAM,yBAAyB,UAAU,EAAE,qCAAqC;AAAA,EAC5F;AACA,aAAW,QAAQ,CAAC,UAAU,OAAO,SAAS,SAAS,QAAQ,SAAS,OAAO,GAAG,WAAW,SAAS,IAAI,CAAC;AAC3G,MAAI,WAAW,YAAY,OAAO,QAAQ,UAAU,UAAa,OAAO,QAAQ,UAAU,SAAY;AACpG,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,QAAM,MAAM,MAAM,kBAAkB,UAAU,OAAO,QAAQ,MAAM,KAAK,iBAAiB;AACzF,QAAM,EAAE,KAAK,OAAO,IAAI,cAAc,KAAK,UAAU,OAAO,QAAQ,GAAG,CAAC;AACxE,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,MAAM,KAAK,UAAU;AAC3B,QAAMC,cAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,MACE,YAAY,IAAI;AAAA,MAChB,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,MAAM;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,OAAO,GAAG,IAAI,UAAU,QAAQ,mBAAmB,MAAM,CAAC;AAChE,QAAM,UAAU,EAAE,eAAe,UAAUA,WAAU,GAAG;AAExD,MAAI,WAAW,SAAS;AACtB,UAAM,KAAK,OAAO,YAAY,CAAC;AAC/B,UAAMC,OAAM,MAAM,QAAQ,GAAG,IAAI,IAAI,mBAAmB,EAAE,CAAC,UAAU,EAAE,QAAQ,QAAQ,QAAQ,CAAC;AAChG,UAAMC,QAAO,MAAM,SAASD,IAAG;AAC/B,QAAI,CAACA,KAAI,GAAI,OAAM,IAAI,MAAM,uBAAuBA,KAAI,MAAM,MAAM,aAAaC,KAAI,CAAC,EAAE;AACxF,UAAMC,UAAS,EAAE,GAAG,GAAG,OAAO,IAAI,IAAI,IAAI,KAAK,QAAQ,GAAGD,MAAK;AAC/D,QAAI,OAAO,QAAQ,SAAS,KAAM,KAAI,IAAI,KAAK,UAAUC,SAAQ,MAAM,CAAC,CAAC;AAAA,QACpE,KAAI,IAAI,GAAG,MAAM,cAAc,EAAE,EAAE;AACxC;AAAA,EACF;AAEA,QAAMC,SAAQ,UAAU,OAAO,QAAQ,KAAK;AAC5C,QAAM,UAA2B,CAAC,WAAW,WAAW,aAAa,aAAa;AAClF,MAAIA,UAAS,CAAC,QAAQ,SAASA,MAAsB,GAAG;AACtD,UAAM,IAAI,MAAM,0BAA0B,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,EAChE;AACA,QAAM,MAAM,IAAI,IAAI,IAAI;AACxB,MAAIA,OAAO,KAAI,aAAa,IAAI,SAASA,MAAK;AAC9C,QAAM,QAAQ,UAAU,OAAO,QAAQ,OAAO,SAAS;AACvD,MAAI,MAAO,KAAI,aAAa,IAAI,SAAS,OAAO,KAAK,CAAC;AACtD,QAAM,MAAM,MAAM,QAAQ,KAAK,EAAE,QAAQ,CAAC;AAC1C,QAAM,OAAQ,MAAM,SAAS,GAAG;AAChC,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,sBAAsB,IAAI,MAAM,MAAM,aAAa,IAAI,CAAC,EAAE;AACvF,QAAM,SAAS,EAAE,GAAG,GAAG,OAAO,IAAI,IAAI,IAAI,KAAK,QAAQ,MAAM,KAAK,QAAQ,CAAC,GAAG,SAAS,KAAK,QAAQ;AACpG,MAAI,OAAO,QAAQ,SAAS,MAAM;AAChC,QAAI,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AACvC;AAAA,EACF;AACA,QAAM,UAAU,KAAK;AACrB,MAAI;AAAA,IACF,GAAG,MAAM,KAAK,SAAS,WAAW,CAAC,aAAa,SAAS,WAAW,CAAC,aAChE,SAAS,cAAc,CAAC,iBAAiB,SAAS,aAAa,CAAC;AAAA,EACvE;AACA,aAAW,OAAO,KAAK,QAAQ,CAAC,GAAG;AACjC,QAAI;AAAA,MACF,CAAC,IAAI,OAAO,IAAI,IAAI,IAAI,WAAW,GAAG,IAAI,QAAQ,IAAI,IAAI,QAAQ,IAAI,YAAY,IAAI,QAAQ,IAAI,IAAI,iBAAiB,EAAE,EACtH,OAAO,OAAO,EACd,KAAK,GAAI;AAAA,IACd;AAAA,EACF;AACF;AAEA,eAAe,SAAS,KAAiD;AACvE,MAAI;AACF,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,aAAa,MAAuC;AAC3D,QAAM,QAAQ,KAAK;AACnB,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,SAAS,OAAO,UAAU,YAAY,OAAQ,MAAgC,YAAY,UAAU;AACtG,WAAQ,MAA8B;AAAA,EACxC;AACA,SAAO;AACT;;;ACxHA,SAAS,yBAAyB;AAClC,SAAS,gBAAgB;AACzB,SAAS,gBAAgB;AA6BzB,eAAsB,UAAU,SAAyE;AACvG,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,EAAE,OAAO,IAAI,cAAc,KAAK,QAAQ,GAAG;AACjD,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA,EAAE,YAAY,IAAI,YAAY,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,MAAM,MAAM;AAAA,IACtF;AAAA,IACA;AAAA,EACF;AACA,QAAM,OAAO,EAAE,eAAe,UAAU,KAAK,GAAG;AAChD,QAAM,OAAO,GAAG,IAAI,UAAU,eAAe,mBAAmB,MAAM,CAAC;AAEvE,MAAI,QAAQ,OAAO;AACjB,UAAM,MAAM,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,QAAQ,QAAQ,SAAS,KAAK,CAAC;AAC7E,UAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,gBAAgB,KAAK,OAAO,OAAO,KAAK,KAAK,MAAM,IAAI,MAAM,EAAE,KAAK,KAAK,OAAO,WAAW,IAAI,MAAM,EAAE;AAAA,EACtI;AAEA,QAAM,OAAO,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,SAAS,KAAK,CAAC;AAC/D,MAAI,CAAC,KAAK,GAAI,OAAM,IAAI,MAAM,0BAA0B,KAAK,MAAM,GAAG;AACtE,QAAM,EAAE,QAAQ,IAAK,MAAM,KAAK,KAAK;AACrC,QAAM,SAAS,QAAQ,CAAC;AACxB,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR,GAAG,MAAM;AAAA,IACX;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,QAAQ,GAAG,IAAI,YAAY,OAAO,EAAE,aAAa,EAAE,SAAS,KAAK,CAAC;AACzF,MAAI,CAAC,SAAS,MAAM,CAAC,SAAS,KAAM,OAAM,IAAI,MAAM,oBAAoB,SAAS,MAAM,GAAG;AAC1F,QAAM,OAAO,QAAQ,OAAO,GAAG,MAAM,IAAI,IAAI,KAAK,OAAO,UAAU,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC,MAAM,OAAO,MAAM;AAClH,QAAM,SAAS,SAAS,QAAQ,SAAS,IAAa,GAAG,kBAAkB,IAAI,CAAC;AAEhF,MAAI,QAAQ,KAAM,KAAI,IAAI,KAAK,UAAU,EAAE,MAAM,QAAQ,OAAO,GAAG,MAAM,CAAC,CAAC;AAAA,OACtE;AACH,QAAI,IAAI,GAAG,MAAM,WAAW,IAAI,KAAK,OAAO,KAAK,WAAW,OAAO,IAAI,mBAAmB,OAAO,MAAM,GAAG;AAC1G,QAAI,IAAI,UAAU,SAAS,QAAQ,IAAI,eAAe,KAAK,OAAO,MAAM,EAAE;AAAA,EAC5E;AACA,SAAO,EAAE,MAAM,QAAQ,OAAO;AAChC;;;ACnEA,SAAS,gBAAAC,qBAAoB;AAO7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAkCP,SAAS,aAAa,SAA2B,MAAkF;AACjI,QAAM,SAAS,CAAC,QAAQ,WAAW,SAAS,QAAQ,OAAO,OAAO,QAAQ,eAAe,UAAU,EAAE,OAAO,OAAO;AACnH,MAAI,OAAO,SAAS,EAAG,OAAM,IAAI,MAAM,oDAAoD;AAC3F,MAAI,QAAQ,IAAK,QAAO,EAAE,QAAQ,MAAM;AACxC,MAAI,QAAQ,YAAa,QAAO,EAAE,QAAQ,WAAW;AACrD,MAAI,QAAQ,QAAS,QAAO,EAAE,QAAQ,SAAS,SAAS,QAAQ,QAAQ;AAGxE,MAAI,KAAK,SAAS,KAAK,KAAK,MAAM,CAAC,QAAQ,OAAO,KAAK,OAAO,YAAY,IAAI,EAAE,EAAG,QAAO,EAAE,QAAQ,QAAQ;AAC5G,QAAM,IAAI;AAAA,IACR;AAAA,EAEF;AACF;AAEA,eAAsB,UAAU,SAAqD;AACnF,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,MAAM,QAAQ,UAAU;AAI9B,QAAM,MAAM,QAAQ,OAAO,CAAC,SAAmB,IAAI,MAAM,IAAI,IAAI,CAAC,SAAmB,IAAI,IAAI,IAAI;AACjG,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,EAAE,OAAO,IAAI,cAAc,KAAK,QAAQ,GAAG;AAEjD,QAAM,OAAO,QAAQ,SAAS,OACzB,QAAQ,cAAc,MAAMC,cAAa,GAAG,MAAM,IAAI,IACvDA,cAAa,QAAQ,MAAM,MAAM;AACrC,QAAM,EAAE,QAAQ,QAAQ,IAAI,YAAY,MAAM,QAAQ,EAAE;AACxD,MAAI,WAAW,mBAAmB,QAAQ,IAAI;AAC5C,UAAM,IAAI,MAAM,oGAA+F;AAAA,EACjH;AACA,MAAI,WAAW,mBAAmB,CAAC,QAAQ,GAAI,OAAM,IAAI,MAAM,6DAA6D;AAC5H,MAAI,QAAQ,WAAW,EAAG,OAAM,IAAI,MAAM,GAAG,QAAQ,IAAI,mBAAmB;AAE5E,QAAM,OAAO,aAAa,SAAS,QAAQ,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;AAC5D,QAAM,QAAuB,EAAE,GAAG,MAAM,SAAS,QAAQ,IAAI;AAC7D,QAAM,EAAE,KAAK,UAAU,QAAQ,IAAI,eAAe,SAAS,KAAK;AAChE,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,SAAS,SAAS,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,SAAS,EAAE,KAAK,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,IAAI;AAC1F,UAAM,OAAO,SAAS,SAAS,KAAK;AAAA,cAAY,SAAS,SAAS,EAAE,UAAU;AAC9E,UAAM,IAAI,MAAM,GAAG,SAAS,MAAM;AAAA,EAA2D,MAAM,GAAG,IAAI,EAAE;AAAA,EAC9G;AACA,QAAM,SAAS,iBAAiB,GAAG;AACnC,QAAM,SAA0B,EAAE,QAAQ,MAAM,IAAI,QAAQ,QAAQ,OAAO,QAAQ,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC,GAAG,QAAQ;AAElI,MAAI,QAAQ,SAAS,EAAG,KAAI,wCAAwC,QAAQ,KAAK,IAAI,CAAC,uCAAkC;AACxH,MAAI,QAAQ,UAAU,QAAQ,QAAQ,MAAM;AAC1C,UAAM,MAAM,QAAQ,SAAS,cAAc;AAC3C,QAAI,GAAG,MAAM,kBAAkB,IAAI,MAAM,kBAAkB,OAAO,MAAM,2CAAsC,GAAG,GAAG;AACpH,QAAI,QAAQ,KAAM,KAAI,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AACzD,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA,EAAE,YAAY,IAAI,YAAY,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,MAAM,MAAM;AAAA,IACtF;AAAA,IACA;AAAA,EACF;AAIA,QAAM,QAAQ,OAAO,WAAW;AAChC,QAAM,MAAM,GAAG,IAAI,UAAU,eAAe,mBAAmB,MAAM,CAAC;AACtE,aAAW,SAAS,QAAQ;AAC1B,UAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,MAC7B,QAAQ;AAAA,MACR,SAAS,EAAE,eAAe,UAAU,KAAK,IAAI,gBAAgB,mBAAmB;AAAA,MAChF,MAAM,KAAK,UAAU,EAAE,YAAY,iBAAiB,OAAO,MAAM,KAAK,GAAG,KAAK,MAAM,IAAI,CAAC;AAAA,IAC3F,CAAC;AACD,UAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,OAAO,KAAK,OAAO,OAAO,KAAK,KAAK,MAAM,IAAI,MAAM;AAC1D,YAAM,IAAI;AAAA,QACR,SAAS,MAAM,QAAQ,CAAC,OAAO,OAAO,MAAM,UAAU,IAAI,KAAK,KAAK,OAAO,WAAW,IAAI,MAAM,KAC3F,OAAO,SAAS;AAAA,MACvB;AAAA,IACF;AACA,WAAO,aAAa,MAAM,IAAI;AAC9B,QAAI,OAAO,KAAK,SAAS,SAAU,QAAO,MAAM,KAAK,KAAK,IAAI;AAC9D,QAAI,KAAK,UAAW,QAAO;AAAA,EAC7B;AAEA,MAAI,QAAQ,KAAM,KAAI,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,OACpD;AACH,UAAM,MAAM,OAAO,YAAY,IAAI,KAAK,OAAO,SAAS,oCAAoC;AAC5F,QAAI,IAAI,GAAG,MAAM,cAAc,OAAO,SAAS,cAAc,OAAO,MAAM,kBAAkB,GAAG,EAAE;AAAA,EACnG;AACA,SAAO;AACT;;;ACtHA,IAAM,OAAO,CAAC,YAAqE,QAAQ,UAAU;AAGrG,eAAe,cACb,QACA,QACA,SACA,MACqB;AACrB,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA,EAAE,YAAY,IAAI,YAAY,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,MAAM,MAAM;AAAA,IACtF;AAAA,IACA,KAAK,OAAO;AAAA,EACd;AACA,QAAM,MAAM,MAAM,QAAQ,GAAG,IAAI,WAAW,kBAAkB,mBAAmB,IAAI,IAAI,EAAE,CAAC,UAAU,MAAM,IAAI;AAAA,IAC9G;AAAA,IACA,SAAS,EAAE,eAAe,UAAU,KAAK,IAAI,gBAAgB,mBAAmB;AAAA,IAChF,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,EAC5D,CAAC;AACD,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI;AAAA,MACR,UAAU,MAAM,UAAU,KAAK,OAAO,OAAO,KAAK,KAAK,MAAM,IAAI,MAAM,EAAE,QACtE,KAAK,OAAO,WAAW,qBAAqB,IAAI,MAAM;AAAA,IAC3D;AAAA,EACF;AACA,SAAO,KAAK,UAAU,CAAC;AACzB;AAEA,SAAS,OAAO,SAA2B,QAAoB,UAAyB;AACtF,QAAM,MAAM,KAAK,OAAO;AACxB,MAAI,QAAQ,SAAS,MAAM;AACzB,QAAI,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AACvC;AAAA,EACF;AACA,MAAI,SAAU,KAAI,IAAI,QAAQ;AAC9B,MAAI,IAAI,WAAW,OAAO,MAAM,IAAI;AACpC,aAAW,KAAK,QAAQ;AACtB,QAAI,IAAI,KAAK,EAAE,UAAU,WAAM,MAAG,IAAI,EAAE,SAAS,EAAE,OAAO,GAAG,EAAE,UAAU,eAAe,EAAE,EAAE;AAAA,EAC9F;AACF;AAGA,eAAsB,WAAW,SAA0C;AACzE,SAAO,SAAS,MAAM,cAAc,OAAO,IAAI,OAAO,CAAC;AACzD;AAGA,eAAsB,UAAU,OAAe,SAA0C;AACvF,QAAM,SAAS,MAAM,cAAc,QAAQ,IAAI,SAAS,EAAE,MAAM,CAAC;AACjE;AAAA,IACE;AAAA,IACA;AAAA,IACA,SAAS,KAAK;AAAA,EAEhB;AACF;AAIA,eAAsB,aAAa,QAAgB,SAA0C;AAC3F,MAAI,UAAU;AACd,MAAI,OAAO,SAAS,GAAG,GAAG;AACxB,UAAMC,UAAS,MAAM,cAAc,OAAO,IAAI,OAAO;AACrD,UAAM,QAAQA,QAAO,KAAK,CAAC,MAAM,EAAE,OAAO,YAAY,MAAM,OAAO,YAAY,CAAC;AAChF,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,0BAA0B,MAAM,EAAE;AAC9D,QAAI,MAAM,QAAS,OAAM,IAAI,MAAM,gCAAgC;AACnE,cAAU,MAAM;AAAA,EAClB;AACA,QAAM,SAAS,MAAM,cAAc,UAAU,IAAI,mBAAmB,OAAO,CAAC,IAAI,OAAO;AACvF,SAAO,SAAS,QAAQ,WAAW,MAAM,EAAE;AAC7C;AAGA,eAAsB,iBACpB,QACA,eAAyF,CAAC,GAC3E;AACf,QAAM,MAAM,OAAO,YAAY,CAAC,KAAK;AACrC,QAAM,UAA4B;AAAA,IAChC,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,IAChD,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,IACrC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,IACrC,MAAM,OAAO,QAAQ,SAAS;AAAA,IAC9B,OAAO,aAAa;AAAA,IACpB,QAAQ,aAAa;AAAA,EACvB;AACA,QAAM,UAAU,CAAC,UAAU,SAAS,SAAS,MAAM;AACnD,MAAI,QAAQ,QAAQ;AAClB,eAAW,QAAQ,SAAS,CAAC;AAC7B,UAAM,WAAW,OAAO;AACxB;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,QAAQ,UAAU;AACrC,eAAW,QAAQ,SAAS,CAAC;AAC7B,UAAM,QAAQ,OAAO,YAAY,CAAC;AAClC,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,eAAe,GAAG,mDAA8C,GAAG,yBAAyB;AACxH,WAAO,QAAQ,QAAQ,UAAU,OAAO,OAAO,IAAI,aAAa,OAAO,OAAO;AAC9E;AAAA,EACF;AACA,QAAM,IAAI;AAAA,IACR,kCAAkC,GAAG;AAAA,EAEvC;AACF;;;ACjHA,eAAsB,UAAU,MAAc,SAA0C;AACtF,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,8EAAyE;AACvG,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA,EAAE,YAAY,IAAI,YAAY,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,MAAM,MAAM;AAAA,IACtF;AAAA,IACA;AAAA,EACF;AACA,QAAM,MAAM,MAAM,QAAQ,GAAG,IAAI,WAAW,kBAAkB,mBAAmB,IAAI,IAAI,EAAE,CAAC,SAAS;AAAA,IACnG,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,KAAK,IAAI,gBAAgB,mBAAmB;AAAA,IAChF,MAAM,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AAAA,EACxC,CAAC;AACD,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,MAAI,CAAC,IAAI,MAAM,CAAC,KAAK,KAAK;AACxB,UAAM,IAAI;AAAA,MACR,gBAAgB,KAAK,OAAO,OAAO,KAAK,KAAK,MAAM,IAAI,MAAM,EAAE,QAC5D,KAAK,OAAO,WAAW,qBAAqB,IAAI,MAAM;AAAA,IAC3D;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,MAAM;AACzB,QAAI,IAAI,KAAK,UAAU,KAAK,KAAK,MAAM,CAAC,CAAC;AACzC;AAAA,EACF;AACA,MAAI,IAAI,WAAW,KAAK,IAAI,KAAK,YAAO,KAAK,IAAI,IAAI,GAAG;AACxD,MAAI,IAAI,0EAA0E;AAClF,MAAI,IAAI,wBAAwB,IAAI,UAAU,YAAY;AAC5D;AAGA,eAAsB,iBACpB,QACA,eAAyF,CAAC,GAC3E;AAGf,aAAW,QAAQ,CAAC,UAAU,SAAS,SAAS,MAAM,GAAG,OAAO,YAAY,MAAM;AAClF,QAAM,OAAO,OAAO,YAAY,MAAM,CAAC,EAAE,KAAK,GAAG;AACjD,QAAM,UAAU,MAAM;AAAA,IACpB,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,IAChD,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,IACrC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,IACrC,MAAM,OAAO,QAAQ,SAAS;AAAA,IAC9B,OAAO,aAAa;AAAA,IACpB,QAAQ,aAAa;AAAA,EACvB,CAAC;AACH;;;AClBA,SAAS,aAAa,MAAoB,SAA4C;AACpF,QAAM,KAAK,EAAE,QAAQ,QAAQ,SAAS,QAAQ,QAAQ,MAAM,MAAM,MAAM;AACxE,QAAM,OAAO,EAAE,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,SAAS,MAAM,OAAO;AAC3E,MAAI,SAAS,kBAAmB,QAAO,EAAE,GAAG,MAAM,MAAM,UAAmB;AAC3E,SAAO,EAAE,GAAG,IAAI,MAAM,UAAmB;AAC3C;AAEA,eAAe,IACb,KACA,OACA,MACA,MACA,SACsC;AACtC,QAAM,MAAM,MAAM,QAAQ,GAAG,IAAI,UAAU,GAAG,IAAI,IAAI;AAAA,IACpD,GAAG;AAAA,IACH,SAAS,EAAE,eAAe,UAAU,KAAK,IAAI,gBAAgB,oBAAoB,GAAI,MAAM,QAAmC;AAAA,EAChI,CAAC;AACD,SAAO,EAAE,QAAQ,IAAI,QAAQ,MAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,EAAQ;AAC/E;AAEA,SAAS,SAAS,MAAoB;AACpC,MAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,MAAI,KAAK,UAAU,EAAG,QAAO;AAC7B,QAAM,KAAK,KAAK,WAAW,WAAW,IAAI,gBAAgB,GAAG,KAAK,WAAW,MAAM;AACnF,QAAM,WAAW,KAAK,eAAe,IAAI,KAAK,KAAK,YAAY,qBAAqB;AACpF,SAAO,GAAG,EAAE,SAAM,KAAK,OAAO,qBAAkB,KAAK,KAAK,GAAG,QAAQ;AACvE;AAEA,SAAS,UAAU,KAAkC,MAAoB,KAAgB,MAAgC;AACvH,QAAM,QAAQ,SAAS,oBAAoB,wBAAmB;AAC9D,MAAI,IAAI,GAAG,IAAI,KAAK,KAAK,GAAG;AAC5B,MAAI,IAAI,WAAW,IAAI,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE;AAC/D,MAAI,IAAI,WAAW,IAAI,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE;AAC/D,MAAI,SAAS,WAAW;AACtB,QAAI,IAAI,2EAAsE;AAAA,EAChF,OAAO;AACL,QAAI,IAAI,KAAK,IAAI,OAAO,MAAM,mBAAmB,IAAI,OAAO,MAAM,EAAE;AACpE,QAAI,IAAI,gBAAgB,IAAI,SAAS,KAAK,IAAI,CAAC,EAAE;AACjD,UAAM,WAAW,KAAK,kBAAkB,kCAAkC,gBAAgB,IAAI,SAAS,KAAK,IAAI,CAAC;AACjH,QAAI,IAAI,eAAe,QAAQ,EAAE;AACjC,QAAI,IAAI,YAAY,KAAK,eAAe,6BAA6B,YAAY,EAAE;AAAA,EACrF;AACA,aAAW,WAAW,IAAI,SAAU,KAAI,IAAI,YAAO,QAAQ,IAAI,KAAK,QAAQ,OAAO,EAAE;AACvF;AAEA,eAAsB,YAAY,SAAiG;AACjI,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,MAAM,QAAQ,UAAU;AAK9B,QAAM,MAAM,QAAQ,OAAO,CAAC,SAAmB,IAAI,MAAM,IAAI,IAAI,CAAC,SAAmB,IAAI,IAAI,IAAI;AACjG,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,UAAU,YAAY,GAAG;AAC/B,QAAMC,SAAQ,aAAa,QAAQ,MAAM,OAAO;AAChD,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA,EAAE,YAAY,IAAI,YAAY,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,MAAM,MAAM;AAAA,IACtF;AAAA,IACA;AAAA,EACF;AAEA,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA,eAAe,mBAAmBA,OAAM,MAAM,CAAC,wBAAwBA,OAAM,IAAI;AAAA,IACjF;AAAA,IACA;AAAA,EACF;AACA,MAAI,IAAI,WAAW,KAAK;AACtB,UAAM,IAAI,MAAM,oBAAoB,IAAI,KAAK,OAAO,OAAO,KAAK,IAAI,KAAK,MAAM,IAAI,MAAM,EAAE,KAAK,IAAI,KAAK,OAAO,WAAW,IAAI,MAAM,EAAE;AAAA,EACzI;AACA,QAAM,OAAO,IAAI;AACjB,YAAU,EAAE,KAAK,IAAI,GAAG,QAAQ,MAAM,MAAM,OAAO;AAGnD,MAAI,QAAQ,SAAS,aAAa,CAAC,KAAK,aAAa;AACnD,UAAM,IAAI;AAAA,MACR,GAAGA,OAAM,MAAM;AAAA,IAEjB;AAAA,EACF;AACA,MAAI,KAAK,SAAS,SAAS,EAAG,OAAM,IAAI,MAAM,UAAU,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC,EAAE;AAEzH,MAAI,QAAQ,UAAU,QAAQ,QAAQ,MAAM;AAC1C,QAAI,oBAAoB,QAAQ,SAAS,cAAc,UAAU,GAAG;AACpE,QAAI,QAAQ,KAAM,KAAI,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AACvD,WAAO,EAAE,IAAI,MAAM,KAAK;AAAA,EAC1B;AAEA,MAAI,QAAQ,SAAS,WAAW;AAC9B,UAAMC,OAAM,MAAM;AAAA,MAChB;AAAA,MACA;AAAA,MACA,eAAe,mBAAmBD,OAAM,MAAM,CAAC;AAAA,MAC/C,EAAE,QAAQ,QAAQ,MAAM,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC,EAAE;AAAA,MACxD;AAAA,IACF;AACA,QAAIC,KAAI,WAAW,IAAK,OAAM,IAAI,MAAM,iBAAiBA,KAAI,KAAK,OAAO,OAAO,KAAKA,KAAI,KAAK,MAAM,IAAI,MAAM,EAAE,KAAKA,KAAI,KAAK,OAAO,WAAWA,KAAI,MAAM,EAAE;AAC5J,QAAI,QAAQ,KAAM,KAAI,IAAI,KAAK,UAAUA,KAAI,MAAM,MAAM,CAAC,CAAC;AAAA,QACtD,KAAI,GAAGD,OAAM,MAAM,eAAeC,KAAI,KAAK,WAAW,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE;AAC3E,WAAO,EAAE,IAAI,MAAM,MAAM,QAAQA,KAAI,KAAK;AAAA,EAC5C;AAEA,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA,eAAe,mBAAmBD,OAAM,MAAM,CAAC;AAAA,IAC/C;AAAA,MACE,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU;AAAA,QACnB,MAAMA,OAAM;AAAA,QACZ,MAAMA,OAAM;AAAA,QACZ,GAAI,QAAQ,kBAAkB,EAAE,cAAc,KAAK,IAAI,CAAC;AAAA,QACxD,GAAI,QAAQ,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;AAAA,MACvD,CAAC;AAAA,IACH;AAAA,IACA;AAAA,EACF;AACA,MAAI,IAAI,WAAW,IAAK,OAAM,IAAI,MAAM,GAAG,QAAQ,IAAI,UAAU,IAAI,KAAK,OAAO,OAAO,KAAK,IAAI,KAAK,MAAM,IAAI,MAAM,EAAE,KAAK,IAAI,KAAK,OAAO,WAAW,IAAI,MAAM,EAAE;AACpK,MAAI,GAAGA,OAAM,MAAM,mBAAmBA,OAAM,MAAM,QAAQ,IAAI,KAAK,aAAa,KAAK,WAAW,IAAI,KAAK,aAAa,KAAK,iDAA4C;AAEvK,MAAI,QAAQ,aAAc,OAAM,UAAU,KAAK,OAAOA,QAAO,SAAS,GAAG;AACzE,MAAI,QAAQ,KAAM,KAAI,IAAI,KAAK,UAAU,IAAI,MAAM,MAAM,CAAC,CAAC;AAC3D,SAAO,EAAE,IAAI,MAAM,MAAM,QAAQ,IAAI,KAAK;AAC5C;AAIA,eAAe,UACb,KACA,OACAA,QACA,SACA,KACe;AACf,WAAS,UAAU,GAAG,WAAW,IAAI,WAAW;AAC9C,UAAM,MAAM,MAAM;AAAA,MAChB;AAAA,MACA;AAAA,MACA,eAAe,mBAAmBA,OAAM,MAAM,CAAC;AAAA,MAC/C,EAAE,QAAQ,QAAQ,MAAM,KAAK,UAAU,EAAE,MAAMA,OAAM,KAAK,CAAC,EAAE;AAAA,MAC7D;AAAA,IACF;AACA,QAAI,IAAI,WAAW,KAAK;AACtB,UAAI,IAAI,GAAGA,OAAM,MAAM,gBAAgB;AACvC;AAAA,IACF;AACA,QAAI,CAAC,IAAI,KAAK,OAAO,OAAO;AAC1B,YAAM,IAAI,MAAM,mBAAmB,IAAI,KAAK,OAAO,OAAO,KAAK,IAAI,KAAK,MAAM,IAAI,MAAM,EAAE,KAAK,IAAI,KAAK,OAAO,WAAW,IAAI,MAAM,EAAE;AAAA,IACxI;AACA,QAAI,IAAI,+BAA+B,OAAO,kBAAa;AAAA,EAC7D;AACA,QAAM,IAAI,MAAM,uFAAkF;AACpG;;;ACnLA,eAAe,cAAc,QAA+B,SAA0D;AACpH,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA,EAAE,YAAY,IAAI,YAAY,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO,MAAM,MAAM;AAAA,IACtF;AAAA,IACA;AAAA,EACF;AACA,QAAM,MAAM,MAAM,QAAQ,GAAG,IAAI,WAAW,kBAAkB,mBAAmB,IAAI,IAAI,EAAE,CAAC,IAAI,MAAM,IAAI;AAAA,IACxG,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,KAAK,IAAI,gBAAgB,mBAAmB;AAAA,EAClF,CAAC;AACD,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,MAAI,CAAC,IAAI,MAAM,CAAC,KAAK,IAAI;AACvB,UAAM,IAAI,MAAM,GAAG,MAAM,UAAU,KAAK,OAAO,OAAO,KAAK,KAAK,MAAM,IAAI,MAAM,EAAE,KAAK,KAAK,OAAO,WAAW,qBAAqB,IAAI,MAAM,EAAE,EAAE;AAAA,EACnJ;AACA,SAAO;AACT;AAIA,eAAsB,WAAW,SAA6C;AAC5E,MAAI,QAAQ,QAAQ,MAAM;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,OAAO,MAAM,cAAc,WAAW,OAAO;AACnD,MAAI,QAAQ,KAAM,KAAI,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAAA,WAC9C,KAAK,WAAW,UAAU,OAAQ,KAAI,IAAI,GAAG,KAAK,KAAK,KAAK,oBAAoB;AAAA,MACpF,KAAI,IAAI,GAAG,KAAK,KAAK,KAAK,+FAA0F;AAC3H;AAGA,eAAsB,WAAW,SAA6C;AAC5E,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,OAAO,MAAM,cAAc,WAAW,OAAO;AACnD,MAAI,QAAQ,KAAM,KAAI,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAAA,WAC9C,KAAK,WAAW,UAAU,OAAQ,KAAI,IAAI,GAAG,KAAK,KAAK,KAAK,kBAAkB;AAAA,MAClF,KAAI,IAAI,GAAG,KAAK,KAAK,KAAK,4DAAuD;AACxF;AAGA,eAAsB,WACpB,QACA,eAAyF,CAAC,GAC3E;AACf,QAAM,MAAM,OAAO,YAAY,CAAC;AAChC,MAAI,QAAQ,UAAU;AACpB,UAAM,iBAAiB,QAAQ,YAAY;AAC3C;AAAA,EACF;AACA,MAAI,QAAQ,UAAU;AACpB,UAAM,iBAAiB,QAAQ,YAAY;AAC3C;AAAA,EACF;AACA,MAAI,QAAQ,UAAU;AACpB,eAAW,QAAQ,CAAC,UAAU,OAAO,SAAS,SAAS,SAAS,OAAO,MAAM,GAAG,CAAC;AACjF,UAAM,UAAU;AAAA,MACd,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,MAChD,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,MACjC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,OAAO,OAAO,QAAQ,UAAU;AAAA,MAChC,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,MACjC,MAAM,OAAO,QAAQ,SAAS;AAAA,MAC9B,OAAO,aAAa;AAAA,MACpB,QAAQ,aAAa;AAAA,IACvB,CAAC;AACD;AAAA,EACF;AACA,MAAI,QAAQ,qBAAqB,QAAQ,aAAa,QAAQ,WAAW;AACvE,eAAW,QAAQ,CAAC,UAAU,oBAAoB,iBAAiB,WAAW,OAAO,SAAS,SAAS,MAAM,GAAG,CAAC;AACjH,UAAM,YAAY;AAAA,MAChB,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,MAChD,MAAM;AAAA,MACN,iBAAiB,OAAO,QAAQ,kBAAkB,MAAM;AAAA,MACxD,cAAc,OAAO,QAAQ,eAAe,MAAM;AAAA,MAClD,QAAQ,OAAO,QAAQ,SAAS,MAAM;AAAA,MACtC,KAAK,OAAO,QAAQ,QAAQ;AAAA,MAC5B,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,MAAM,OAAO,QAAQ,SAAS;AAAA,MAC9B,OAAO,aAAa;AAAA,MACpB,QAAQ,aAAa;AAAA,IACvB,CAAC;AACD;AAAA,EACF;AACA,MAAI,QAAQ,UAAU;AACpB,eAAW,QAAQ,CAAC,UAAU,OAAO,MAAM,YAAY,OAAO,gBAAgB,WAAW,OAAO,SAAS,SAAS,MAAM,GAAG,CAAC;AAC5H,UAAM,OAAO,OAAO,YAAY,CAAC;AACjC,QAAI,CAAC,KAAM,OAAM,IAAI,MAAM,6FAA6F;AACxH,UAAM,UAAU;AAAA,MACd,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,MAChD;AAAA,MACA,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,MACjC,IAAI,UAAU,OAAO,QAAQ,EAAE;AAAA,MAC/B,SAAS,UAAU,OAAO,QAAQ,UAAU,CAAC;AAAA,MAC7C,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,MACjC,aAAa,OAAO,QAAQ,cAAc,MAAM;AAAA,MAChD,QAAQ,OAAO,QAAQ,SAAS,MAAM;AAAA,MACtC,KAAK,OAAO,QAAQ,QAAQ;AAAA,MAC5B,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,MAAM,OAAO,QAAQ,SAAS;AAAA,MAC9B,OAAO,aAAa;AAAA,MACpB,QAAQ,aAAa;AAAA,IACvB,CAAC;AACD;AAAA,EACF;AACA,MAAI,QAAQ,aAAa,QAAQ,WAAW;AAC1C,UAAM,IAAI;AAAA,MACR,2BAA2B,OAAO,EAAE;AAAA,IAKtC;AAAA,EACF;AACA,aAAW,QAAQ,CAAC,UAAU,SAAS,SAAS,OAAO,MAAM,GAAG,CAAC;AACjE,QAAM,UAA+B;AAAA,IACnC,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,IAChD,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,IACrC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,IACrC,KAAK,OAAO,QAAQ,QAAQ;AAAA,IAC5B,MAAM,OAAO,QAAQ,SAAS;AAAA,IAC9B,OAAO,aAAa;AAAA,IACpB,QAAQ,aAAa;AAAA,EACvB;AACA,MAAI,QAAQ,UAAW,OAAM,WAAW,OAAO;AAAA,MAC1C,OAAM,WAAW,OAAO;AAC/B;;;ACpKO,SAAS,YAAY,QAA4C;AACtE,QAAM,WAAW;AAAA,IACf,GAAG,cAAc,OAAO,QAAQ,OAAO,SAAS;AAAA,IAChD,GAAG,cAAc,OAAO,QAAQ,SAAS,WAAW;AAAA,EACtD;AACA,SAAQ,SAAS,SAAS,WAAW,CAAC,KAAK;AAC7C;AAEA,SAAS,cACP,OACA,MACU;AACV,MAAI,UAAU,OAAW,QAAO,CAAC;AACjC,MAAI,OAAO,UAAU,UAAW,OAAM,IAAI,MAAM,GAAG,IAAI,0BAA0B;AACjF,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AACjD,QAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,GAAG,CAAC;AACnD,MAAI,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,GAAG;AACtC,UAAM,IAAI,MAAM,GAAG,IAAI,0BAA0B;AAAA,EACnD;AACA,SAAO,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;AACxC;;;ACKA,IAAM,aAAa,CAAC,OAAO,UAAU,SAAS,SAAS,SAAS;AAEhE,SAAS,QAAQ,QAAgB,aAAqB,MAAgC;AACpF,aAAW,QAAQ,YAAY,WAAW;AAC1C,eAAa;AAAA,IACX,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,IACjC,QAAQ,OAAO,QAAQ,WAAW;AAAA,IAClC,WAAW,YAAY,MAAM;AAAA,IAC7B,OAAO,OAAO,QAAQ,UAAU;AAAA,IAChC,SAAS,KAAK;AAAA,IACd,cAAc,KAAK;AAAA,IACnB,QAAQ,KAAK;AAAA,EACf,CAAC;AACH;AAEA,eAAe,eAAe,QAAgB,MAAyC;AACrF,QAAM,MAAM,OAAO,YAAY,CAAC;AAChC,MAAI,QAAQ,SAAS,QAAQ,iBAAiB;AAC5C,eAAW,QAAQ,CAAC,UAAU,OAAO,YAAY,SAAS,SAAS,SAAS,KAAK,GAAG,QAAQ,QAAQ,IAAI,CAAC;AACzG,UAAM,UAAU;AAAA,MACd,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,MAChD,MAAM,OAAO,YAAY,CAAC;AAAA,MAC1B,KAAK,eAAe,OAAO,QAAQ,KAAK,OAAO;AAAA,MAC/C,SAAS,UAAU,OAAO,QAAQ,UAAU,CAAC;AAAA,MAC7C,OAAO,OAAO,QAAQ,UAAU;AAAA,MAChC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,KAAK,OAAO,QAAQ,QAAQ;AAAA,MAC5B,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK;AAAA,IACf;AACA,WAAO,QAAQ,QAAQ,WAAW,OAAO,IAAI,mBAAmB,OAAO;AACvE;AAAA,EACF;AACA,MAAI,QAAQ,QAAQ;AAClB,UAAM,IAAI;AAAA,MACR,+BAA+B,OAAO,EAAE;AAAA,IAE1C;AAAA,EACF;AACA,aAAW,QAAQ,CAAC,UAAU,OAAO,WAAW,KAAK,GAAG,CAAC;AACzD,QAAM,YAAY;AAAA,IAChB,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,IAChD,KAAK,eAAe,OAAO,QAAQ,KAAK,OAAO;AAAA,IAC/C,QAAQ,OAAO,QAAQ,SAAS,MAAM;AAAA,IACtC,KAAK,OAAO,QAAQ,QAAQ;AAAA,EAC9B,CAAC;AACH;AASA,eAAsB,eAAe,SAAiB,QAAgB,MAA4C;AAChH,MAAI,YAAY,QAAQ;AACtB,eAAW,QAAQ,CAAC,UAAU,QAAQ,UAAU,OAAO,YAAY,eAAe,OAAO,GAAG,CAAC;AAC7F,gBAAY;AAAA,MACV,OAAO,eAAe,OAAO,QAAQ,QAAQ,GAAG,UAAU;AAAA,MAC1D,MAAM,eAAe,OAAO,QAAQ,MAAM,QAAQ;AAAA,MAClD,YAAY,UAAU,OAAO,QAAQ,MAAM;AAAA,MAC3C,MAAM,QAAQ,OAAO,QAAQ,GAAG;AAAA,MAChC,UAAU,QAAQ,OAAO,QAAQ,QAAQ;AAAA,MACzC,YAAY,UAAU,OAAO,QAAQ,aAAa,CAAC;AAAA,MACnD,OAAO,OAAO,QAAQ,UAAU;AAAA,IAClC,CAAC;AACD,WAAO;AAAA,EACT;AACA,MAAI,YAAY,UAAU;AACxB,eAAW,QAAQ,CAAC,QAAQ,GAAG,CAAC;AAChC,UAAM,OAAO,EAAE,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK,kBAAkB,CAAC;AAClF,WAAO;AAAA,EACT;AACA,MAAI,YAAY,gBAAgB;AAC9B,eAAW,QAAQ,CAAC,MAAM,GAAG,CAAC;AAC9B,sBAAkB,OAAO,QAAQ,SAAS,IAAI;AAC9C,WAAO;AAAA,EACT;AACA,MAAI,YAAY,SAAS;AACvB,eAAW,QAAQ,CAAC,UAAU,OAAO,SAAS,SAAS,MAAM,GAAG,CAAC;AACjE,UAAM,MAAM;AAAA,MACV,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,MAChD,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,MACjC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,MAAM,OAAO,QAAQ,SAAS,QAAQ,QAAQ,OAAO,QAAQ,SAAS,OAAO,OAAO;AAAA,MACpF,iBAAiB,KAAK;AAAA,MACtB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK;AAAA,IACf,CAAC;AACD,WAAO;AAAA,EACT;AACA,MAAI,YAAY,SAAS;AACvB,YAAQ,QAAQ,GAAG,IAAI;AACvB,KAAC,KAAK,UAAU,SAAS;AAAA,MACvB;AAAA,IAEF;AACA,WAAO;AAAA,EACT;AACA,MAAI,YAAY,SAAS;AACvB,UAAM,MAAM,OAAO,YAAY,CAAC;AAChC,QAAI,QAAQ,UAAW,OAAM,IAAI,MAAM,6BAA6B,OAAO,EAAE,iCAAiC;AAC9G,YAAQ,QAAQ,GAAG,IAAI;AACvB,WAAO;AAAA,EACT;AACA,MAAI,YAAY,WAAW;AACzB,UAAM,eAAe,QAAQ,IAAI;AACjC,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;AC1IA,eAAsB,YAAY,QAAoB,cAA8C;AAClG,QAAM,MAAM,OAAO,YAAY,CAAC;AAChC,MAAI,QAAQ,WAAW;AACrB,UAAM,IAAI,MAAM,4BAA4B,OAAO,EAAE,0CAA0C;AAAA,EACjG;AACA,aAAW,QAAQ;AAAA,IACjB;AAAA,IAAU;AAAA,IAAO;AAAA,IAAY;AAAA,IAAU;AAAA,IAAS;AAAA,IAAQ;AAAA,IAAQ;AAAA,IAAS;AAAA,IAAU;AAAA,IAAgB;AAAA,EACrG,GAAG,CAAC;AACJ,QAAM,SAAS,UAAU,OAAO,QAAQ,MAAM,KAAK;AACnD,MAAI,CAAE,CAAC,QAAQ,aAAa,UAAU,QAAQ,EAAe,SAAS,MAAM,GAAG;AAC7E,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,SAAO,aAAa,eAAe,aAAa;AAAA,IAC9C,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,IAChD,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,IACjC,UAAU,UAAU,OAAO,QAAQ,QAAQ;AAAA,IAC3C,OAAO,UAAU,OAAO,QAAQ,QAAQ,CAAC;AAAA,IACzC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,IACrC,MAAM,OAAO,QAAQ,SAAS,QAAQ,QAAQ,OAAO,QAAQ,SAAS,OAAO,OAAO;AAAA,IACpF,MAAM,UAAU,OAAO,QAAQ,IAAI;AAAA,IACnC,OAAO,UAAU,OAAO,QAAQ,OAAO,SAAS;AAAA,IAChD;AAAA,IACA,aAAa,UAAU,OAAO,QAAQ,cAAc,GAAG,gBAAgB;AAAA,IACvE,MAAM,OAAO,QAAQ,SAAS;AAAA,IAC9B,OAAO,aAAa;AAAA,IACpB,QAAQ,aAAa;AAAA,IACrB,iBAAiB,aAAa;AAAA,IAC9B,eAAe,aAAa;AAAA,EAC9B,CAAC;AACH;;;ACjCA,OAAOE,eAAa;AAkBb,SAAS,qBACd,SACA,QACA,MAAM,KAAK,IAAI,GACO;AACtB,QAAM,SAAS,aAIZ,QAAQ,IAAI,MAAM,SAAS;AAC9B,QAAM,cAAmD,CAAC,QAAQ,QAC9D,YACA,OAAO,aAAa,QAAQ,SAAS,QACnC,oBACC,OAAO,aAAa,MAAM,MAAM,MAC/B,YACA;AACR,QAAM,SAA+BC;AAAA,IACnC,UAAU,OAAO,QAAQ,KAAK;AAAA,EAChC,IACI,SACAA,OAAMC,UAAQ,IAAI,cAAc,IAC9B,gBACA,gBAAgB,UACd,UACA;AACR,SAAO;AAAA,IACL;AAAA,IACA,WAAW,QAAQ,IAAI,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,SAASD,OAAM,OAA+C;AAC5D,QAAM,aAAa,OAAO,KAAK;AAC/B,SAAO,cAAc;AACvB;;;ACxCA,eAAsB,eACpB,QACA,OAAoB,CAAC,GACN;AACf;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,OAAO,YAAY,CAAC;AACnC,QAAM,MAAM,KAAK,UAAU;AAC3B,MAAI,WAAW,QAAQ;AACrB,UAAM,WAAW,qBAAqB;AACtC,QAAI,OAAO,QAAQ,SAAS,MAAM;AAChC,UAAI,IAAI,KAAK,UAAU,EAAE,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC,CAAC;AAC/D;AAAA,IACF;AACA,QAAI,SAAS,WAAW,GAAG;AACzB,UAAI,IAAI,6BAA6B;AACrC;AAAA,IACF;AACA,QAAI,IAAI,+BAAkC;AAC1C,eAAW,WAAW,UAAU;AAC9B,UAAI;AAAA,QACF,GAAG,QAAQ,IAAI,IAAK,QAAQ,QAAQ,IAAK,QAAQ,OAAO,EAAE,IAAK,QAAQ,eAAe,EAAE;AAAA,MAC1F;AAAA,IACF;AACA;AAAA,EACF;AACA,MAAI,WAAW,QAAQ;AACrB,QAAI,OAAO,QAAQ,UAAU,QAAW;AACtC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,OAAO,YAAY,MAAM;AAC/B,UAAME,WAAU,MAAM,uBAAuB,QAAQ;AAAA,MACnD,oBAAoB;AAAA,IACtB,CAAC;AACD,UAAM,UAAU;AAAA,MACd,UAAUA,SAAQ,SAAS;AAAA,MAC3B,GAAIA,SAAQ,IAAI,QAAQ,EAAE,KAAKA,SAAQ,IAAI,MAAM,IAAI,CAAC;AAAA,MACtD,GAAIA,SAAQ,YAAY,QACpB,EAAE,aAAaA,SAAQ,YAAY,MAAM,IACzC,CAAC;AAAA,IACP;AACA,wBAAoB,MAAM,SAASA,SAAQ,QAAQ,IAAI;AACvD,QAAI,OAAO,QAAQ,SAAS,MAAM;AAChC,UAAI,IAAI,KAAK,UAAU,EAAE,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC,CAAC;AAAA,IACzE,OAAO;AACL,UAAI,IAAI,2BAA2B,IAAI,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAClE;AACA;AAAA,EACF;AACA,MAAI,WAAW,UAAU;AACvB,UAAM,OAAO,YAAY,MAAM;AAC/B,QAAI,OAAO,QAAQ,QAAQ,MAAM;AAC/B,YAAM,IAAI,MAAM,mBAAmB,IAAI,kBAAkB;AAAA,IAC3D;AACA,UAAM,UAAU,sBAAsB,IAAI;AAC1C,UAAMC,UAAS;AAAA,MACb,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA,yBAAyB;AAAA,MACzB,eAAe;AAAA,IACjB;AACA,QAAI,OAAO,QAAQ,SAAS,KAAM,KAAI,IAAI,KAAK,UAAUA,SAAQ,MAAM,CAAC,CAAC;AAAA,SACpE;AACH,YAAM,SAAS,UACX,6BAA6B,IAAI,MACjC,qBAAqB,IAAI;AAC7B,UAAI,IAAI,GAAG,MAAM,iDAAiD;AAAA,IACpE;AACA;AAAA,EACF;AACA,MAAI,WAAW,QAAQ;AACrB,UAAM,IAAI;AAAA,MACR,2BAA2B,UAAU,EAAE;AAAA,IACzC;AAAA,EACF;AACA,QAAM,UAAU,MAAM,uBAAuB,QAAQ;AAAA,IACnD,oBAAoB;AAAA,IACpB,oBAAoB;AAAA,EACtB,CAAC;AACD,QAAM,QAAQ,qBAAqB,SAAS,MAAM;AAClD,QAAM,SAAS;AAAA,IACb,eAAe;AAAA,IACf,SAAS,QAAQ;AAAA,IACjB,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,KAAK,QAAQ;AAAA,IACb,aAAa,QAAQ;AAAA,IACrB,gBAAgB;AAAA,MACd,gBAAgB;AAAA,MAChB,sBAAsB,QAAQ,YAAY;AAAA,MAC1C,kBAAkB;AAAA,IACpB;AAAA,EACF;AACA,MAAI,OAAO,QAAQ,SAAS,MAAM;AAChC,QAAI,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AACvC;AAAA,EACF;AACA,MAAI,IAAI,cAAc,QAAQ,OAAO,MAAM,KAAK,QAAQ,OAAO,IAAI,GAAG;AACtE,MAAI;AAAA,IACF,cAAc,QAAQ,QAAQ,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,MAAM,KAAK,QAAQ,QAAQ,IAAI;AAAA,EACpG;AACA,MAAI;AAAA,IACF,cAAc,QAAQ,SAAS,KAAK,KAAK,QAAQ,SAAS,MAAM;AAAA,EAClE;AACA,MAAI;AAAA,IACF,cAAc,QAAQ,IAAI,SAAS,cAAc,KAAK,QAAQ,IAAI,MAAM;AAAA,EAC1E;AACA,MAAI;AAAA,IACF,cAAc,QAAQ,YAAY,SAAS,cAAc,KAAK,QAAQ,YAAY,MAAM;AAAA,EAC1F;AACA,MAAI;AAAA,IACF,cAAc,MAAM,MAAM,WAAW,MAAM,WAAW,KAAK,MAAM,SAAS;AAAA,EAC5E;AACA,MAAI,IAAI,wBAAwB;AAClC;AAEA,SAAS,YAAY,QAA4B;AAC/C,QAAM,OAAO,OAAO,YAAY,CAAC,GAAG,KAAK;AACzC,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,WAAW,OAAO,YAAY,CAAC,CAAC,uBAAuB;AAAA,EACzE;AACA,SAAO;AACT;;;ACtFA,IAAM,kBAAkB,CAAC,WACvB,UAAU,OAAO,QAAQ,aAAa,CAAC,KAAK,OAAO,WAAW;AAEhE,eAAe,QAAW,KAAqB,QAAgB,MAAc,MAA4B;AACvG,QAAM,MAAM,MAAM,IAAI,QAAQ,GAAG,IAAI,WAAW,oBAAoB,IAAI,IAAI;AAAA,IAC1E;AAAA,IACA,SAAS,EAAE,eAAe,UAAU,IAAI,KAAK,IAAI,gBAAgB,mBAAmB;AAAA,IACpF,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,EAC5D,CAAC;AACD,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,WAAW,MAAM,IAAI,IAAI,YAAY,KAAK,SAAS,qBAAqB,IAAI,MAAM,EAAE,EAAE;AACxG,SAAO;AACT;AAGA,SAAS,KAAK,KAAqB,OAAgB,OAAyB;AAC1E,MAAI,IAAI,KAAM,KAAI,IAAI,IAAI,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,MACnD,OAAM;AACb;AAIA,IAAM,QAAQ,CAAC,UAA6B,MAAM,WAAW,aAAa;AAI1E,SAAS,aAAa,MAAuB;AAC3C,MAAI,CAAC,KAAK,QAAQ,KAAK,KAAK,WAAW,EAAG,QAAO,KAAK;AACtD,MAAI,MAAM;AACV,MAAI,SAAS;AACb,aAAW,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,GAAG;AAClE,QAAI,IAAI,QAAQ,UAAU,IAAI,MAAM,KAAK,KAAK,OAAQ;AACtD,WAAO,KAAK,KAAK,MAAM,QAAQ,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,IAAI,EAAE;AACjF,aAAS,IAAI;AAAA,EACf;AACA,SAAO,MAAM,KAAK,KAAK,MAAM,MAAM;AACrC;AAIA,SAAS,QAAQ,QAAwD;AACvE,QAAM,SAAS,UAAU,OAAO,QAAQ,MAAM;AAC9C,MAAI,OAAQ,QAAO,EAAE,OAAO;AAC5B,QAAM,OAAO,UAAU,OAAO,QAAQ,IAAI;AAC1C,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,qEAAkE;AAC7F,SAAO,EAAE,KAAK;AAChB;AAGA,eAAsB,cAAc,KAAoC;AACtE,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,OAAK,KAAK,QAAQ,MAAM;AACtB,QAAI,IAAI,IAAI,kBAAoB;AAChC,eAAW,SAAS,OAAO,QAAQ;AACjC,UAAI,IAAI,IAAI,GAAG,MAAM,KAAK,IAAK,MAAM,IAAI,IAAK,MAAM,YAAY,QAAQ,IAAI,EAAE;AAAA,IAChF;AAAA,EACF,CAAC;AACH;AAGA,eAAsB,YAAY,KAAqB,QAAmC;AACxF,QAAM,QAAQ,IAAI,gBAAgB;AAClC,QAAM,MAAM,UAAU,OAAO,QAAQ,GAAG,KAAK,IAAI;AACjD,MAAI,IAAK,OAAM,IAAI,OAAO,GAAG;AAC7B,aAAW,CAAC,MAAM,KAAK,KAAK;AAAA,IAC1B,CAAC,KAAK,GAAG;AAAA,IACT,CAAC,SAAS,OAAO;AAAA,IACjB,CAAC,SAAS,OAAO;AAAA,IACjB,CAAC,UAAU,QAAQ;AAAA,EACrB,GAAY;AACV,UAAM,QAAQ,UAAU,OAAO,QAAQ,IAAI,CAAC;AAC5C,QAAI,MAAO,OAAM,IAAI,OAAO,KAAK;AAAA,EACnC;AACA,QAAM,KAAK,MAAM,SAAS;AAC1B,QAAM,OAAO,MAAM,QAAmB,KAAK,OAAO,UAAU,KAAK,IAAI,EAAE,KAAK,EAAE,EAAE;AAChF,OAAK,KAAK,MAAM,MAAM;AACpB,QAAI,IAAI,IAAI,iBAAY,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,EAAE;AAC7D,QAAI,IAAI,IAAI,8BAAkC;AAC9C,eAAW,SAAS,KAAK,QAAQ;AAC/B,UAAI,IAAI;AAAA,QACN,GAAG,MAAM,EAAE,IAAK,MAAM,KAAK,CAAC,IAAK,MAAM,SAAS,EAAE,IAAK,MAAM,UAAU,IAAK,MAAM,OAAO;AAAA,MAC3F;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAGA,eAAsB,YAAY,KAAqB,IAAY,QAAmC;AAEpG,QAAM,iBAAiB,UAAU,OAAO,QAAQ,KAAK;AACrD,QAAM,kBAAkB,UAAU,OAAO,QAAQ,MAAM;AACvD,MAAI,mBAAmB,UAAa,oBAAoB,QAAW;AACjE,UAAM,QAAQ,IAAI,gBAAgB;AAAA,MAChC,OAAO,kBAAkB;AAAA,MACzB,QAAQ,mBAAmB;AAAA,IAC7B,CAAC;AACD,UAAM,OAAO,MAAM,QAAkB,KAAK,OAAO,WAAW,mBAAmB,EAAE,CAAC,IAAI,KAAK,EAAE;AAC7F,SAAK,KAAK,MAAM,MAAM,WAAW,KAAK,KAAK,OAAO,KAAK,KAAK,CAAC;AAC7D;AAAA,EACF;AAEA,WAAS,OAAO,GAAG,OAAO,GAAG,QAAQ;AACnC,UAAM,QAAQ,oBAAI,IAAqB;AACvC,QAAI,QAAyB;AAC7B,QAAI,SAAS;AACb,eAAS;AACP,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,WAAW,mBAAmB,EAAE,CAAC,qBAAqB,MAAM;AAAA,MAC9D;AACA,cAAQ,KAAK;AACb,iBAAW,QAAQ,KAAK,MAAO,OAAM,IAAI,KAAK,IAAI,IAAI;AACtD,UAAI,MAAM,OAAO,IAAQ,OAAM,IAAI,MAAM,uDAAuD;AAChG,UAAI,CAAC,KAAK,MAAM,QAAS;AACzB,UAAI,KAAK,KAAK,eAAe,QAAQ,KAAK,KAAK,cAAc,QAAQ;AACnE,cAAM,IAAI,MAAM,kEAAkE;AAAA,MACpF;AACA,eAAS,KAAK,KAAK;AAAA,IACrB;AACA,UAAM,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;AAAA,MAClC,CAAC,GAAG,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI;AAAA,IAC/E;AACA,UAAM,WAAW,OAAO,UAAU,MAAO,UAAU,IAAI,MAAO,aAAa,IAAI,QAAQ;AACvF,QAAI,QAAQ,WAAW,UAAU;AAC/B,YAAM,SAAS,EAAE,OAAe,OAAO,QAAQ;AAC/C,WAAK,KAAK,QAAQ,MAAM,WAAW,KAAK,OAAO,OAAO,OAAO,KAAK,CAAC;AACnE;AAAA,IACF;AACA,QAAI,WAAW,EAAG,OAAM,IAAI,MAAM,kEAAkE;AAAA,EACtG;AACA,QAAM,IAAI,MAAM,8EAA8E;AAChG;AAEA,SAAS,WAAW,KAAqB,OAAiB,OAAwB;AAChF,MAAI,IAAI,IAAI,GAAG,MAAM,OAAO,MAAM,MAAM,KAAK,CAAC,MAAM,MAAM,SAAS,EAAE,EAAE;AACvE,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAM,KAAK,eAAe,QAAQ,GAAG,KAAK,QAAQ,aAAa,KAAK;AAC1E,QAAI,IAAI,IAAI;AAAA,SAAO,GAAG,EAAE;AACxB,QAAI,IAAI,IAAI,aAAa,IAAI,CAAC;AAC9B,eAAW,QAAQ,KAAK,eAAe,CAAC,EAAG,KAAI,IAAI,IAAI,kBAAkB,KAAK,IAAI,KAAK,KAAK,IAAI,SAAS;AAAA,EAC3G;AACF;AAGA,eAAsB,YAAY,KAAqB,QAAmC;AACxF,QAAM,QAAQ,UAAU,OAAO,QAAQ,GAAG,KAAK,IAAI;AACnD,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,kCAAkC;AAC9D,QAAM,UAAU,UAAU,OAAO,QAAQ,OAAO;AAChD,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,uCAAkC;AAChE,QAAM,UAAU,MAAM,QAAwB,KAAK,QAAQ,WAAW;AAAA,IACpE;AAAA,IACA;AAAA,IACA,GAAG,QAAQ,MAAM;AAAA,IACjB,YAAY,gBAAgB,MAAM;AAAA,EACpC,CAAC;AACD,OAAK,KAAK,SAAS,MAAM,IAAI,IAAI,IAAI,gBAAgB,QAAQ,EAAE,EAAE,CAAC;AACpE;AAGA,eAAsB,aAAa,KAAqB,IAAY,QAAmC;AACrG,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA,WAAW,mBAAmB,EAAE,CAAC;AAAA,IACjC,EAAE,GAAG,QAAQ,MAAM,GAAG,YAAY,gBAAgB,MAAM,EAAE;AAAA,EAC5D;AACA,OAAK,KAAK,SAAS,MAAM,IAAI,IAAI,IAAI,WAAW,QAAQ,EAAE,EAAE,CAAC;AAC/D;AAGA,eAAsB,eACpB,KACA,IACA,UACA,QACe;AACf,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA,WAAW,mBAAmB,EAAE,CAAC;AAAA,IACjC,EAAE,UAAU,YAAY,gBAAgB,MAAM,EAAE;AAAA,EAClD;AACA,OAAK,KAAK,QAAQ,MAAM,IAAI,IAAI,IAAI,GAAG,WAAW,aAAa,UAAU,IAAI,OAAO,EAAE,EAAE,CAAC;AAC3F;AAIA,eAAsB,WAAW,KAAqB,QAAmC;AACvF,QAAM,QAAQ,IAAI,gBAAgB,EAAE,GAAG,UAAU,OAAO,QAAQ,CAAC,KAAK,GAAG,CAAC;AAC1E,QAAM,MAAM,UAAU,OAAO,QAAQ,GAAG,KAAK,IAAI;AACjD,MAAI,IAAK,OAAM,IAAI,OAAO,GAAG;AAC7B,QAAM,QAAQ,UAAU,OAAO,QAAQ,KAAK;AAC5C,MAAI,MAAO,OAAM,IAAI,SAAS,KAAK;AACnC,QAAM,QAAQ,MAAM,QAGjB,KAAK,OAAO,iBAAiB,MAAM,SAAS,CAAC,EAAE;AAClD,OAAK,KAAK,OAAO,MAAM;AACrB,QAAI,IAAI,IAAI,mBAAqB;AACjC,eAAW,QAAQ,MAAM,OAAO;AAC9B,UAAI,IAAI,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,IAAI,KAAK,EAAE,KAAM,KAAK,IAAI,IAAK,KAAK,QAAQ,EAAE,EAAE;AAAA,IAC3F;AACA,QAAI,MAAM,OAAO,SAAS,EAAG,KAAI,IAAI,MAAM,qBAAqB,MAAM,OAAO,KAAK,IAAI,CAAC,GAAG;AAAA,EAC5F,CAAC;AACH;;;AC9OO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YACEC,UACS,WACA,QACA,MACT;AACA,UAAMA,QAAO;AAJJ;AACA;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EANW;AAAA,EACA;AAAA,EACA;AAKb;AAGO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAE9C,YACW,QACA,UACT;AACA,UAAM,6CAA6C;AAH1C;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAAA,EACA;AAAA,EAHF,OAAO;AAQlB;AAGO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAE1C,YACW,QACT,OACA;AACA,UAAM,oDAAoD,EAAE,MAAM,CAAC;AAH1D;AAIT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAAA,EAFF,OAAO;AAQlB;AAGO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAE3C,YAAqB,QAAiB;AACpC,UAAM,gCAAgC;AADnB;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAHqB;AAAA,EADZ,OAAO;AAKlB;AAEO,SAAS,YAAY,SAA6B,KAAyB,QAAoC;AACpH,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,QAAS,QAAO,IAAI,SAAS,OAAO;AACxC,MAAI,IAAK,QAAO,IAAI,OAAO,GAAG;AAC9B,MAAI,OAAQ,QAAO,IAAI,UAAU,MAAM;AACvC,SAAO,UAAU,MAAM;AACzB;AAEA,eAAsB,aAAa,KAAqB,MAAkC;AACxF,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,IAAI,QAAQ,GAAG,IAAI,WAAW,oBAAoB,IAAI,IAAI;AAAA,MACpE,SAAS,EAAE,eAAe,UAAU,IAAI,KAAK,GAAG;AAAA,IAClD,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,iCAAiC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,MAAI,IAAI,WAAW,OAAO,KAAK,SAAS,uBAAuB;AAC7D,UAAM,IAAI,qBAAqB,KAAK,QAAQ,KAAK,QAAQ;AAAA,EAC3D;AACA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI;AAAA,MACR,yBAAyB,KAAK,SAAS,qBAAqB,IAAI,MAAM,EAAE;AAAA,MACxE,IAAI,WAAW,OAAO,IAAI,UAAU;AAAA,MACpC,IAAI;AAAA,MACJ,KAAK,SAAS,IAAI,WAAW,OAAO,IAAI,WAAW,MAAM,gBAAgB;AAAA,IAC3E;AAAA,EACF;AACA,SAAO;AACT;;;AC/FA,IAAM,sBAAsB;AAC5B,IAAM,2BAA2B;AACjC,IAAM,iBAAiB;AAEvB,SAASC,WAAU,QAAoB,MAAc,UAAuC;AAC1F,QAAM,MAAM,UAAU,OAAO,QAAQ,IAAI,CAAC;AAC1C,QAAM,QAAQ,OAAO,OAAO,MAAM,OAAO,GAAG;AAC5C,SAAO,OAAO,SAAS,KAAK,KAAK,QAAQ,IAAI,QAAQ;AACvD;AAgBA,SAAS,MAAM,KAAqB,QAAoB,OAAsC;AAC5F,MAAI,OAAO,QAAQ,UAAU,KAAM,KAAI,IAAI,IAAI,KAAK,UAAU,EAAE,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC;AACnF;AAUA,eAAsB,aACpB,KACA,SACA,QACsB;AACtB,MAAI,IAAI,QAAQ,OAAO,QAAQ,UAAU,KAAM,OAAM,IAAI,MAAM,uCAAuC;AACtG,QAAM,QAAQ,IAAI,UAAU,CAAC,OAAe,IAAI,QAAc,CAACC,cAAY,WAAWA,WAAS,EAAE,CAAC;AAClG,QAAM,MAAM,IAAI,OAAO,KAAK;AAC5B,QAAM,cAAcD,WAAU,QAAQ,YAAY,sBAAsB,GAAI,KAAK,sBAAsB,OAAQ;AAC/G,QAAM,iBAAiBA,WAAU,QAAQ,SAAS;AAClD,QAAM,WAAW,mBAAmB,SAAY,SAAY,IAAI,IAAI,iBAAiB;AACrF,QAAM,KAAK,UAAU,OAAO,QAAQ,EAAE;AACtC,QAAM,OAAO,UAAU,OAAO,QAAQ,IAAI;AAC1C,QAAM,MAAM,UAAU,OAAO,QAAQ,GAAG,KAAK,IAAI;AACjD,MAAI,SAAS,UAAU,OAAO,QAAQ,MAAM;AAC5C,MAAI,eAAe;AACnB,MAAI,sBAAsB;AAE1B,aAAS;AACP,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,aAAa,KAAK,YAAY,SAAS,KAAK,MAAM,CAAC;AAChE,4BAAsB;AAAA,IACxB,SAAS,OAAO;AACd,UAAI,EAAE,iBAAiB,sBAAsB,CAAC,MAAM,WAAW;AAC7D,YAAI,iBAAiB,sBAAsB;AACzC,gBAAM,KAAK,QAAQ;AAAA,YACjB,MAAM;AAAA,YACN,OAAO;AAAA,YACP,WAAW;AAAA,YACX,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,YAC/C,GAAI,MAAM,WAAW,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,UACvD,CAAC;AAAA,QACH;AACA,cAAM;AAAA,MACR;AACA;AACA,YAAM,KAAK,QAAQ;AAAA,QACjB,MAAM;AAAA,QACN,OAAO;AAAA,QACP,WAAW;AAAA,QACX,SAAS;AAAA,QACT,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,QAC3B,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MACjD,CAAC;AACD,UAAI,uBAAuB,0BAA0B;AACnD,cAAM,IAAI,iBAAiB,QAAQ,KAAK;AAAA,MAC1C;AACA,UAAI,aAAa,UAAa,IAAI,KAAK,UAAU;AAC/C,cAAM,SAASE,QAAO,KAAK,QAAQ,EAAE,OAAO,OAAO,QAAQ,UAAU,GAAG,CAAC;AACzE,cAAM,IAAI,kBAAkB,OAAO,MAAM;AAAA,MAC3C;AACA,YAAM,OAAO,KAAK,IAAI,YAAY,GAAI;AACtC,YAAM,UAAU,KAAK,IAAI,gBAAgB,OAAO,MAAM,sBAAsB,EAAE;AAC9E,YAAM,MAAM,aAAa,SAAY,UAAU,KAAK,IAAI,SAAS,KAAK,IAAI,GAAG,WAAW,IAAI,CAAC,CAAC,CAAC;AAC/F;AAAA,IACF;AAEA,aAAS,KAAK;AACd,UAAM,WAAW,gBAAgB,KAAK,OAAO,WAAW;AACxD,QAAI,UAAU;AACZ,YAAM,KAAK,QAAQ;AAAA,QACjB,MAAM;AAAA,QACN,UAAU,KAAK;AAAA,QACf;AAAA,QACA,YAAY,KAAK;AAAA,MACnB,CAAC;AAAA,IACH;AACA,mBAAe;AAEf,UAAM,WAAW,KAAK,OAAO,OAAO,CAAC,UAAU;AAC7C,UAAI,YAAY,MAAM,SAAS,aAAa,MAAM,WAAW,WAAY,QAAO;AAChF,cAAQ,CAAC,MAAM,MAAM,MAAM,OAAO,QAAQ,CAAC,QAAQ,MAAM,MAAM,OAAO;AAAA,IACxE,CAAC;AACD,eAAW,SAAS,UAAU;AAC5B,YAAM,KAAK,QAAQ;AAAA,QACjB,MAAM;AAAA,QACN,UAAU,KAAK;AAAA,QACf,SAAS,MAAM;AAAA,QACf,QAAQ,MAAM;AAAA,QACd;AAAA,MACF,CAAC;AAAA,IACH;AACA,QAAI,SAAS,SAAS,GAAG;AACvB,YAAM,KAAK,QAAQ;AAAA,QACjB,MAAM;AAAA,QACN,UAAU,KAAK;AAAA,QACf;AAAA,QACA,YAAY,KAAK;AAAA,MACnB,CAAC;AACD,YAAM,QAAQ,UACV,SAAS,OAAO,CAAC,UAAU,MAAM,SAAS,SAAS,EAAE,IAAI,CAAC,UAAU,MAAM,OAAoB,IAC9F;AACJ,YAAM,SAAS,UACX,SACA,SAAS,OAAO,CAAC,UAAU,MAAM,SAAS,UAAU,EAAE,IAAI,CAAC,UAAU,MAAM,OAAmB;AAClG,aAAOA,QAAO,KAAK,QAAQ;AAAA,QACzB,OAAO;AAAA,QACP;AAAA,QACA,QAAQ;AAAA,QACR,GAAI,SAAS,MAAM,SAAS,IAAI,EAAE,MAAM,IAAI,CAAC;AAAA,QAC7C,GAAI,UAAU,OAAO,SAAS,IAAI,EAAE,OAAO,IAAI,CAAC;AAAA,MAClD,CAAC;AAAA,IACH;AAEA,QAAI,KAAK,OAAO,SAAS,GAAG;AAG1B,YAAM,KAAK,QAAQ;AAAA,QACjB,MAAM;AAAA,QACN,UAAU,KAAK;AAAA,QACf;AAAA,QACA,YAAY,KAAK;AAAA,MACnB,CAAC;AAAA,IACH,WAAW,CAAC,UAAU;AACpB,YAAM,KAAK,QAAQ;AAAA,QACjB,MAAM;AAAA,QACN,UAAU,KAAK;AAAA,QACf;AAAA,QACA,YAAY,KAAK;AAAA,MACnB,CAAC;AAAA,IACH;AAGA,QAAI,KAAK,QAAS;AAClB,QAAI,aAAa,UAAa,IAAI,KAAK,UAAU;AAC/C,aAAOA,QAAO,KAAK,QAAQ,EAAE,OAAO,OAAO,OAAO,CAAC;AAAA,IACrD;AACA,UAAMC,QAAO,aAAa,SAAY,aAAa,KAAK,IAAI,YAAY,KAAK,IAAI,GAAG,WAAW,IAAI,CAAC,CAAC;AACrG,UAAM,MAAMA,KAAI;AAAA,EAClB;AACF;AAEA,SAASD,QAAO,KAAqB,QAAoB,QAAkC;AACzF,MAAI,IAAI,MAAM;AACZ,QAAI,IAAI,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,EAC7C,WAAW,OAAO,QAAQ,UAAU,QAAQ,OAAO,OAAO;AACxD,eAAW,QAAQ,OAAO,SAAS,CAAC,GAAG;AACrC,YAAM,MAAM,KAAK,eAAe,QAAQ,GAAG,KAAK,QAAQ,aAAa,KAAK;AAC1E,UAAI,IAAI,IAAI,UAAK,GAAG;AAAA,EAAK,KAAK,IAAI,EAAE;AAAA,IACtC;AACA,eAAW,SAAS,OAAO,UAAU,CAAC,GAAG;AACvC,UAAI,IAAI,IAAI,GAAG,MAAM,EAAE,IAAK,MAAM,SAAS,EAAE,IAAK,MAAM,OAAO,EAAE;AAAA,IACnE;AAAA,EACF;AACA,SAAO;AACT;;;ACpLA,IAAM,UAAU;AAAA,EACd;AAAA,EAAU;AAAA,EAAS;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAW;AAAA,EAAQ;AAAA,EAC9D;AAAA,EAAS;AAAA,EAAK;AAAA,EAAS;AAAA,EAAS;AAAA,EAAU;AAAA,EAAU;AAAA,EAAM;AAAA,EAC1D;AAAA,EAAY;AAAA,EAAW;AAAA,EAAU;AAAA,EACjC;AAAA,EAAe;AAAA,EAAY;AAC7B;AAOA,SAAS,UAAU,IAAwB,QAAwB;AACjE,MAAI,CAAC,GAAI,OAAM,IAAI,MAAM,YAAY,MAAM,oBAAoB;AAC/D,SAAO;AACT;AAEA,eAAe,aAAa,QAAoB,MAA4C;AAC1F,QAAM,UAAU,MAAM,uBAAuB,QAAQ;AAAA,IACnD,oBAAoB;AAAA,EACtB,CAAC;AACD,QAAM,EAAE,IAAI,IAAI;AAChB,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,MAAM,KAAK,UAAU;AAC3B,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,MACE,YAAY,IAAI;AAAA,MAChB,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,MAAM;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO;AAAA,IACL,aAAa,IAAI;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ,SAAS;AAAA;AAAA;AAAA,IAG9B,OACE,QAAQ,IAAI,WAAW,iBAAiB,QAAQ,IAAI,WAAW,YAC3D,QAAQ,IAAI,SAAS,SACrB;AAAA,EACR;AACF;AASA,eAAsB,eAAe,QAAoB,OAAoB,CAAC,GAAkB;AAE9F,aAAW,QAAQ,SAAS,CAAC;AAC7B,QAAM,SAAS,OAAO,YAAY,CAAC;AACnC,QAAM,KAAK,OAAO,YAAY,CAAC;AAC/B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,gDAAgD;AAC7E,QAAM,MAAM,MAAM,aAAa,QAAQ,IAAI;AAE3C,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,cAAc,GAAG;AAAA,IAC1B,KAAK;AAAA,IACL,KAAK;AACH,aAAO,YAAY,KAAK,MAAM;AAAA,IAChC,KAAK;AACH,aAAO,YAAY,KAAK,UAAU,IAAI,MAAM,GAAG,MAAM;AAAA,IACvD,KAAK;AACH,aAAO,YAAY,KAAK,MAAM;AAAA,IAChC,KAAK;AACH,aAAO,aAAa,KAAK,UAAU,IAAI,OAAO,GAAG,MAAM;AAAA,IACzD,KAAK;AAGH,aAAO,eAAe,KAAK,UAAU,IAAI,SAAS,GAAG,OAAO,QAAQ,WAAW,MAAM,MAAM;AAAA,IAC7F,KAAK;AACH,aAAO,WAAW,KAAK,MAAM;AAAA,IAC/B,KAAK,SAAS;AACZ,YAAM,SAAS,MAAM,aAAa,KAAK,IAAI,MAAM;AACjD,UAAI,CAAC,OAAO,MAAO,OAAM,IAAI,kBAAkB,OAAO,MAAM;AAC5D;AAAA,IACF;AAAA,IACA;AACE,YAAM,IAAI,MAAM,2BAA2B,MAAM,wBAAwB;AAAA,EAC7E;AACF;;;AC/EA,IAAME,mBAAkB,CAAC,WACvB,UAAU,OAAO,QAAQ,aAAa,CAAC,KAAK,OAAO,WAAW;AAGhE,IAAM,YAA4D;AAAA,EAChE,OAAO,EAAE,KAAK,QAAQ;AAAA,EACtB,QAAQ,EAAE,KAAK,SAAS;AAAA,EACxB,UAAU,EAAE,KAAK,WAAW;AAAA,EAC5B,QAAQ,EAAE,KAAK,SAAS;AAAA,EACxB,MAAM,EAAE,KAAK,QAAQ,KAAK,KAAK;AAAA,EAC/B,MAAM,EAAE,KAAK,SAAS;AAAA,EACtB,UAAU,EAAE,KAAK,aAAa;AAAA,EAC9B,UAAU,EAAE,KAAK,aAAa;AAAA,EAC9B,KAAK,EAAE,KAAK,SAAS,KAAK,KAAK;AAAA,EAC/B,OAAO,EAAE,KAAK,QAAQ;AAAA,EACtB,MAAM,EAAE,KAAK,OAAO;AAAA,EACpB,QAAQ,EAAE,KAAK,aAAa,KAAK,KAAK;AAAA,EACtC,aAAa,EAAE,KAAK,cAAc;AAAA,EAClC,MAAM,EAAE,KAAK,cAAc;AAC7B;AAEA,IAAM,OAAkD;AAAA,EACtD,MAAM,EAAE,QAAQ,OAAO,YAAY,IAAI;AAAA,EACvC,MAAM,EAAE,QAAQ,OAAO;AAAA,EACvB,UAAU,EAAE,QAAQ,WAAW;AAAA,EAC/B,KAAK,EAAE,QAAQ,QAAQ;AACzB;AAEA,eAAe,UAAa,KAAgB,QAAgB,MAAc,MAA4B;AACpG,QAAM,MAAM,MAAM,IAAI,QAAQ,GAAG,IAAI,WAAW,eAAe,IAAI,IAAI;AAAA,IACrE;AAAA,IACA,SAAS,EAAE,eAAe,UAAU,IAAI,KAAK,IAAI,gBAAgB,mBAAmB;AAAA,IACpF,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,EAC5D,CAAC;AACD,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,MAAM,MAAM,IAAI,IAAI,YAAY,KAAK,SAAS,qBAAqB,IAAI,MAAM,EAAE,EAAE;AAC9G,SAAO;AACT;AAIA,SAAS,cAAc,QAAoB,YAA8C;AACvF,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,SAAS,GAAG;AACpD,UAAM,QAAQ,OAAO,QAAQ,IAAI;AACjC,QAAI,UAAU,UAAa,UAAU,KAAM;AAC3C,QAAI,UAAU,OAAO;AACnB,UAAI,WAAY,KAAI,KAAK,GAAG,IAAI;AAChC;AAAA,IACF;AACA,UAAM,OAAO,UAAU,KAAK;AAC5B,QAAI,KAAK,GAAG,IAAI,KAAK,MAAM,OAAO,IAAI,IAAI;AAAA,EAC5C;AACA,SAAO;AACT;AAIA,SAAS,oBACP,QACA,QACA,YACyB;AACzB,QAAM,SAAS,cAAc,QAAQ,UAAU;AAC/C,OAAK,WAAW,UAAU,WAAW,UAAU,OAAO,SAAS,QAAW;AACxE,QAAI,OAAO,gBAAgB,OAAW,QAAO,cAAc,OAAO;AAClE,WAAO,OAAO;AAAA,EAChB;AACA,SAAO;AACT;AAEA,SAAS,UAAU,QAAkB,GAAqB;AACxD,MAAI,WAAW,MAAO,QAAO,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE;AAClE,MAAI,WAAW,OAAQ,QAAO,OAAO,EAAE,UAAU,EAAE;AACnD,SAAO,OAAO,EAAE,UAAU,EAAE;AAC9B;AAEA,SAAS,YAAY,KAAgB,QAAkB,GAAmB;AACxE,MAAI,IAAI,IAAI,GAAG,EAAE,EAAE,KAAM,UAAU,QAAQ,CAAC,CAAC,KAAM,EAAE,KAAK,IAAK,EAAE,SAAS,EAAE,EAAE;AAChF;AAIA,SAASC,MAAK,KAAgB,OAAgB,OAAyB;AACrE,MAAI,IAAI,KAAM,KAAI,IAAI,IAAI,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,MACnD,OAAM;AACb;AAEA,eAAsB,OAAO,KAAgB,QAAkB,QAAmC;AAChG,QAAM,IAAI,IAAI,gBAAgB;AAC9B,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,UAAU;AAAA,IACV,UAAU;AAAA,EACZ;AACA,QAAM,MAAM,UAAU,OAAO,QAAQ,GAAG,KAAK,IAAI;AACjD,MAAI,IAAK,GAAE,IAAI,OAAO,GAAG;AACzB,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AACnD,UAAM,IAAI,UAAU,OAAO,QAAQ,IAAI,CAAC;AACxC,QAAI,EAAG,GAAE,IAAI,OAAO,CAAC;AAAA,EACvB;AACA,aAAW,OAAO,CAAC,KAAK,SAAS,QAAQ,GAAG;AAC1C,UAAM,IAAI,UAAU,OAAO,QAAQ,GAAG,CAAC;AACvC,QAAI,EAAG,GAAE,IAAI,KAAK,CAAC;AAAA,EACrB;AACA,QAAM,KAAK,EAAE,SAAS;AACtB,QAAM,OAAO,MAAM,UAAkB,KAAK,OAAO,IAAI,MAAM,GAAG,KAAK,IAAI,EAAE,KAAK,EAAE,EAAE;AAClF,EAAAA,MAAK,KAAK,MAAM,MAAM;AACpB,QAAI,IAAI,IAAI,GAAG,MAAM,WAAM,KAAK,QAAQ,MAAM,OAAO,KAAK,KAAK,EAAE;AACjE,QAAI,IAAI,IAAI,oBAAuB;AACnC,eAAW,KAAK,KAAK,QAAS,aAAY,KAAK,QAAQ,CAAC;AAAA,EAC1D,CAAC;AACH;AAEA,eAAsB,MAAM,KAAgB,QAAkB,QAAmC;AAC/F,QAAM,QAAQ,UAAU,OAAO,QAAQ,GAAG,KAAK,IAAI;AACnD,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,4BAA4B;AACxD,QAAM,QAAQ,oBAAoB,QAAQ,QAAQ,KAAK;AACvD,MAAI,CAAC,MAAM,MAAO,OAAM,IAAI,MAAM,8BAA8B;AAChE,MAAI,WAAW,SAAS,CAAC,MAAM;AAC7B,UAAM,IAAI,MAAM,gEAAgE;AAClF,QAAM,MAAM,MAAM,UAA8C,KAAK,QAAQ,IAAI,MAAM,IAAI;AAAA,IACzF;AAAA,IACA;AAAA,IACA,YAAYD,iBAAgB,MAAM;AAAA,EACpC,CAAC;AACD,EAAAC,MAAK,KAAK,KAAK,MAAM,IAAI,IAAI,IAAI,WAAW,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;AACjE;AAEA,eAAsB,MAAM,KAAgB,QAAkB,IAA2B;AACvF,QAAM,EAAE,QAAAC,QAAO,IAAI,MAAM,UAAgC,KAAK,OAAO,IAAI,MAAM,IAAI,mBAAmB,EAAE,CAAC,EAAE;AAC3G,EAAAD,MAAK,KAAKC,SAAQ,MAAM,YAAY,KAAK,QAAQA,OAAM,CAAC;AAC1D;AAEA,eAAsB,MAAM,KAAgB,QAAkB,IAAY,QAAmC;AAC3G,QAAMC,SAAQ,oBAAoB,QAAQ,QAAQ,IAAI;AACtD,MAAI,OAAO,KAAKA,MAAK,EAAE,WAAW;AAChC,UAAM,IAAI,MAAM,0FAA0F;AAC5G,QAAM,MAAM,MAAM,UAAuC,KAAK,SAAS,IAAI,MAAM,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC7G,OAAAA;AAAA,IACA,YAAYH,iBAAgB,MAAM;AAAA,EACpC,CAAC;AACD,EAAAC,MAAK,KAAK,KAAK,MAAM,IAAI,IAAI,IAAI,IAAI,SAAS,GAAG,IAAI,OAAO,EAAE,KAAM,UAAU,QAAQ,IAAI,MAAM,CAAC,KAAM,IAAI,OAAO,KAAK,IAAK,IAAI,OAAO,SAAS,EAAE,KAAK,WAAW,MAAM,IAAI,EAAE,EAAE,CAAC;AACnL;AAEA,eAAsB,OACpB,KACA,QACA,IACA,QACe;AACf,QAAM,aAAa,UAAU,OAAO,QAAQ,QAAQ;AACpD,MAAI,cAAc,WAAW,MAAO,OAAM,IAAI,MAAM,gDAAgD;AACpG,QAAME,SAAQ,EAAE,GAAG,KAAK,MAAM,GAAG,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC,EAAG;AACvE,QAAM,MAAM,MAAM,UAAU,KAAK,SAAS,IAAI,MAAM,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAChF,OAAAA;AAAA,IACA,YAAYH,iBAAgB,MAAM;AAAA,EACpC,CAAC;AACD,EAAAC,MAAK,KAAK,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,MAAM,IAAI,EAAE,cAAS,CAAC;AAC5D;AAEA,eAAe,WAAW,KAAgB,QAAkB,OAAoC;AAC9F,QAAM,UAAsB,CAAC;AAC7B,aAAS;AACP,UAAM,IAAI,IAAI,gBAAgB;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO;AAAA,MACP,QAAQ,OAAO,QAAQ,MAAM;AAAA,IAC/B,CAAC;AACD,UAAM,OAAO,MAAM,UAAkB,KAAK,OAAO,IAAI,MAAM,IAAI,CAAC,EAAE;AAClE,YAAQ,KAAK,GAAG,KAAK,OAAO;AAC5B,QAAI,QAAQ,UAAU,KAAK,SAAS,KAAK,QAAQ,WAAW,EAAG,QAAO;AAAA,EACxE;AACF;AAGA,eAAsB,UAAU,KAAgB,QAAmC;AACjF,QAAM,QAAQ,UAAU,OAAO,QAAQ,GAAG,KAAK,IAAI;AACnD,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,gCAAgC;AAC5D,QAAM,CAAC,OAAO,OAAO,IAAI,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC7C,WAAW,KAAK,QAAQ,KAAK;AAAA,IAC7B,WAAW,KAAK,QAAQ,KAAK;AAAA,IAC7B,WAAW,KAAK,OAAO,KAAK;AAAA,EAC9B,CAAC;AACD,QAAM,UAAU;AAAA,IACd;AAAA,IACA,YAAY,MAAM,OAAO,CAACC,YAAWA,QAAO,WAAW,KAAK;AAAA,IAC5D,aAAa,MAAM,OAAO,CAACA,YAAWA,QAAO,WAAW,MAAM;AAAA,IAC9D,UAAU,KAAK,OAAO,CAACA,YAAWA,QAAO,WAAW,WAAWA,QAAO,WAAW,SAAS;AAAA,EAC5F;AACA,QAAM,SAAS;AAAA,IACb,GAAG;AAAA,IACH,OAAO,CAAC,QAAQ,WAAW,UAAU,CAAC,QAAQ,YAAY,UAAU,CAAC,QAAQ,SAAS;AAAA,EACxF;AACA,EAAAD,MAAK,KAAK,QAAQ,MAAM;AACtB,QAAI,OAAO,OAAO;AAChB,UAAI,IAAI,IAAI,GAAG,KAAK,yBAAyB;AAC7C;AAAA,IACF;AACA,QAAI,IAAI,IAAI,GAAG,KAAK,4BAA4B;AAChD,eAAW,CAAC,OAAO,OAAO,KAAK;AAAA,MAC7B,CAAC,eAAe,OAAO,UAAU;AAAA,MACjC,CAAC,gBAAgB,OAAO,WAAW;AAAA,MACnC,CAAC,aAAa,OAAO,QAAQ;AAAA,IAC/B,GAAY;AACV,UAAI,IAAI,IAAI,GAAG,KAAK,GAAG;AACvB,UAAI,CAAC,QAAQ,OAAQ,KAAI,IAAI,IAAI,UAAU;AAAA,UACtC,YAAWC,WAAU,QAAS;AAAA,QACjC;AAAA,QACA,UAAU,gBAAgB,SAAS,UAAU,iBAAiB,SAAS;AAAA,QACvEA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,UAAU,KAAgB,QAAkB,IAAY,QAAmC;AAC/G,QAAM,OAAO,UAAU,OAAO,QAAQ,IAAI;AAC1C,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,+BAA+B;AAC1D,QAAM,UAAU,KAAK,QAAQ,IAAI,MAAM,IAAI,mBAAmB,EAAE,CAAC,aAAa;AAAA,IAC5E;AAAA,IACA,YAAYF,iBAAgB,MAAM;AAAA,EACpC,CAAC;AACD,MAAI,IAAI,IAAI,gBAAgB,MAAM,IAAI,EAAE,EAAE;AAC5C;AAEA,eAAsB,WAAW,KAAgB,QAAkB,IAA2B;AAC5F,QAAM,EAAE,SAAS,IAAI,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,IAAI,MAAM,IAAI,mBAAmB,EAAE,CAAC;AAAA,EACtC;AACA,EAAAC,MAAK,KAAK,UAAU,MAAM;AACxB,QAAI,SAAS,WAAW,EAAG,KAAI,IAAI,IAAI,eAAe;AAAA,QACjD,YAAW,KAAK,SAAU,KAAI,IAAI,IAAI,IAAI,EAAE,YAAY,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE;AAAA,EACrF,CAAC;AACH;AAEA,eAAsB,SAAS,KAAgB,QAAkB,IAA2B;AAC1F,QAAM,UAAU,KAAK,UAAU,IAAI,MAAM,IAAI,mBAAmB,EAAE,CAAC,EAAE;AACrE,MAAI,IAAI,IAAI,WAAW,MAAM,IAAI,EAAE,EAAE;AACvC;;;AC/PA,IAAM,UAAoC;AAAA,EACxC,MAAM;AAAA,EACN,aAAa;AAAA,EACb,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,KAAK;AACP;AAEA,IAAM,iBAAiB,CAAC,UAAU,SAAS,SAAS,QAAQ,YAAY,SAAS;AACjF,IAAM,iBAAiB;AAAA,EACrB,MAAM,CAAC,OAAO,KAAK,SAAS,QAAQ;AAAA,EACpC,KAAK,CAAC,OAAO,SAAS,aAAa;AAAA,EACnC,KAAK,CAAC;AAAA,EACN,KAAK,CAAC,aAAa;AAAA,EACnB,MAAM,CAAC,aAAa;AAAA,EACpB,SAAS,CAAC,QAAQ,aAAa;AAAA,EAC/B,UAAU,CAAC;AAAA,EACX,IAAI,CAAC;AACP;AAGA,IAAM,iBAGF;AAAA,EACF,MAAM;AAAA,IACJ,MAAM,CAAC,QAAQ;AAAA,IACf,KAAK,CAAC,UAAU,SAAS,QAAQ;AAAA,IACjC,KAAK,CAAC,SAAS,UAAU,SAAS,QAAQ;AAAA,IAC1C,MAAM,CAAC;AAAA,EACT;AAAA,EACA,MAAM;AAAA,IACJ,MAAM,CAAC,UAAU,QAAQ,UAAU;AAAA,IACnC,KAAK,CAAC,UAAU,QAAQ,YAAY,OAAO,eAAe,QAAQ,MAAM;AAAA,IACxE,KAAK,CAAC,SAAS,UAAU,QAAQ,QAAQ,YAAY,OAAO,eAAe,QAAQ,MAAM;AAAA,IACzF,MAAM,CAAC;AAAA,EACT;AAAA,EACA,UAAU;AAAA,IACR,MAAM,CAAC,QAAQ;AAAA,IACf,KAAK,CAAC,UAAU,MAAM;AAAA,IACtB,KAAK,CAAC,SAAS,UAAU,MAAM;AAAA,IAC/B,MAAM,CAAC;AAAA,EACT;AAAA,EACA,KAAK;AAAA,IACH,MAAM,CAAC,UAAU,YAAY,QAAQ,YAAY,UAAU;AAAA,IAC3D,KAAK,CAAC,UAAU,YAAY,QAAQ,YAAY,YAAY,eAAe,QAAQ,MAAM;AAAA,IACzF,KAAK,CAAC,SAAS,UAAU,YAAY,QAAQ,YAAY,YAAY,eAAe,QAAQ,MAAM;AAAA,IAClG,MAAM,CAAC,UAAU;AAAA,EACnB;AACF;AAEA,SAAS,gBAAgB,QAAiC;AACxD,MAAI,WAAW,SAAU,QAAO;AAChC,MAAI,WAAW,YAAY,WAAW,YAAY,WAAW,OAAQ,QAAO;AAC5E,MAAI,WAAW,SAAU,QAAO;AAChC,SAAO,UAAU,iBAAiB,SAAqB;AACzD;AAEA,SAAS,eAAe,QAAkB,QAA4B;AACpE,QAAM,gBACJ,WAAW,UAAU,WAAW,SAAS,WAAW,SAAS,WAAW,SACpE,eAAe,MAAM,EAAE,MAAM,IAC7B,CAAC;AACP,SAAO,CAAC,GAAG,gBAAgB,GAAG,eAAe,MAAM,GAAG,GAAG,aAAa;AACxE;AAOA,SAASG,WAAU,IAAwB,QAAwB;AACjE,MAAI,CAAC,GAAI,OAAM,IAAI,MAAM,WAAW,MAAM,oBAAoB;AAC9D,SAAO;AACT;AAEA,eAAeC,cAAa,QAAoB,MAAkC;AAChF,QAAM,UAAU,MAAM,uBAAuB,QAAQ;AAAA,IACnD,oBAAoB;AAAA,EACtB,CAAC;AACD,QAAM,EAAE,IAAI,IAAI;AAChB,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,MAAM,KAAK,UAAU;AAC3B,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA,EAAE,YAAY,IAAI,YAAY,OAAO,UAAU,OAAO,QAAQ,KAAK,GAAG,OAAO,UAAU,OAAO,QAAQ,KAAK,GAAG,MAAM,MAAM;AAAA,IAC1H;AAAA,IACA;AAAA,EACF;AACA,SAAO;AAAA,IACL,aAAa,IAAI;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ,SAAS;AAAA;AAAA;AAAA,IAG9B,OACE,QAAQ,IAAI,WAAW,iBAAiB,QAAQ,IAAI,WAAW,YAC3D,QAAQ,IAAI,SAAS,SACrB;AAAA,EACR;AACF;AAGA,eAAsB,UAAU,QAAoB,OAAe,CAAC,GAAkB;AACpF,QAAM,OAAO,OAAO,YAAY,CAAC,KAAK;AACtC,MAAI,SAAS,WAAW;AACtB,eAAW,QAAQ,CAAC,GAAG,gBAAgB,KAAK,GAAG,CAAC;AAChD,WAAO,UAAU,MAAMA,cAAa,QAAQ,IAAI,GAAG,MAAM;AAAA,EAC3D;AACA,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,sBAAsB,IAAI,wDAAwD;AAC/G,QAAM,kBAAkB,OAAO,YAAY,CAAC,KAAK;AACjD,QAAM,SAAS,gBAAgB,eAAe;AAC9C,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,sBAAsB,eAAe,mDAAmD;AACrH,aAAW,QAAQ,eAAe,QAAQ,MAAM,GAAG,CAAC;AACpD,QAAM,MAAM,MAAMA,cAAa,QAAQ,IAAI;AAC3C,QAAM,KAAK,OAAO,YAAY,CAAC;AAC/B,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,OAAO,KAAK,QAAQ,MAAM;AAAA,IACnC,KAAK;AACH,aAAO,MAAM,KAAK,QAAQ,MAAM;AAAA,IAClC,KAAK;AACH,aAAO,MAAM,KAAK,QAAQD,WAAU,IAAI,MAAM,CAAC;AAAA,IACjD,KAAK;AACH,aAAO,MAAM,KAAK,QAAQA,WAAU,IAAI,MAAM,GAAG,MAAM;AAAA,IACzD,KAAK;AACH,aAAO,OAAO,KAAK,QAAQA,WAAU,IAAI,MAAM,GAAG,MAAM;AAAA,IAC1D,KAAK;AACH,aAAO,UAAU,KAAK,QAAQA,WAAU,IAAI,MAAM,GAAG,MAAM;AAAA,IAC7D,KAAK;AACH,aAAO,WAAW,KAAK,QAAQA,WAAU,IAAI,MAAM,CAAC;AAAA,IACtD,KAAK;AACH,aAAO,SAAS,KAAK,QAAQA,WAAU,IAAI,MAAM,CAAC;AAAA,EACtD;AACF;;;AC/IO,SAAS,cAAc,OASd;AACd,QAAM,UAAkC,CAAC;AACzC,aAAW,SAAS,eAAe,MAAM,WAAW;AACpD,aAAW,SAAS,YAAY,MAAM,QAAQ;AAC9C,aAAW,SAAS,UAAU,MAAM,MAAM;AAC1C,aAAW,SAAS,aAAa,MAAM,SAAS;AAChD,aAAW,SAAS,YAAY,MAAM,QAAQ;AAC9C,MAAI,MAAM,kBAAkB;AAC1B;AAAA,MACE;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN;AAAA,IACF;AAAA,EACF;AACA;AAAA,IACE;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,EACF;AACA,aAAW,SAAS,YAAY,MAAM,iBAAiB,mBAAmB;AAC1E,QAAM,aAAa,OAAO,MAAM,SAAS,KAAK,UAAU,EAAE;AAC1D,MAAI,eAAe,WAAW;AAC5B,YAAQ,KAAK;AAAA,MACX,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,UAAU;AAAA,IACZ,CAAC;AAAA,EACH,WAAW,eAAe,WAAW,eAAe,eAAe;AACjE,YAAQ,KAAK;AAAA,MACX,QAAQ;AAAA,MACR,MAAM,kBAAkB,UAAU;AAAA,MAClC,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,QAAM,cAAcE,QAAO,MAAM,SAAS,KAAK,WAAW,IACtD,MAAM,SAAS,KAAK,cACpB;AACJ,MAAI,aAAa,WAAW,eAAe;AACzC,YAAQ,KAAK;AAAA,MACX,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,MAAIC,SAAQ,aAAa,gBAAgB,IAAI,GAAG;AAC9C,YAAQ,KAAK;AAAA,MACX,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,QAAM,eAAe,OAAO,MAAM,OAAO,KAAK,UAAU,EAAE;AAC1D,MAAI,iBAAiB,WAAW;AAC9B,YAAQ,KAAK;AAAA,MACX,QAAQ;AAAA,MACR,MAAM,OAAO,MAAM,OAAO,KAAK,aAAa,gBAAgB;AAAA,MAC5D,UAAU;AAAA,IACZ,CAAC;AAAA,EACH,WAAW,iBAAiB,SAAS;AACnC,YAAQ,KAAK;AAAA,MACX,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,UAAU;AAAA,IACZ,CAAC;AAAA,EACH,WACE,iBAAiB,aACjB,iBAAiB,kBACjB;AACA,YAAQ,KAAK;AAAA,MACX,QAAQ;AAAA,MACR,MAAM,WAAW,YAAY;AAAA,MAC7B,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,QAAM,kBAAkB,OAAO,MAAM,UAAU,KAAK,UAAU,EAAE;AAChE,MAAI,oBAAoB,aAAa;AACnC,YAAQ,KAAK;AAAA,MACX,QAAQ;AAAA,MACR,MAAM,gBAAgB,MAAM,WAAW,qBAAqB;AAAA,MAC5D,UAAU;AAAA,IACZ,CAAC;AAAA,EACH,WAAW,oBAAoB,YAAY;AACzC,YAAQ,KAAK;AAAA,MACX,QAAQ;AAAA,MACR,MAAM,gBAAgB,MAAM,WAAW,oBAAoB;AAAA,MAC3D,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,QAAM,iBAAiB,OAAO,MAAM,SAAS,KAAK,UAAU,EAAE;AAC9D,MAAI,kBAAkB,mBAAmB,YAAY;AACnD,YAAQ,KAAK;AAAA,MACX,QAAQ;AAAA,MACR,MAAM,YAAY,cAAc;AAAA,MAChC,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,QAAM,uBAAuB;AAAA,IAC3B,MAAM,uBAAuB,KAAK,UAAU;AAAA,EAC9C;AACA,MACE,MAAM,uBAAuB,cAAc,OAC3C,MAAM,uBAAuB,aAAa,OAC1C,wBACA,yBAAyB,iBACzB;AACA,UAAM,uBAAuB,MAAM,uBAAuB,KAAK;AAC/D,YAAQ,KAAK;AAAA,MACX,QAAQ;AAAA,MACR,MACE,yBAAyB,mBACrB,OAAO,yBAAyB,YAAY,uBAC1C,uBACA,oCACF,0BAA0B,oBAAoB;AAAA,MACpD,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,QAAM,wBAAwB,OAAO,MAAM,gBAAgB,KAAK,UAAU,EAAE;AAC5E,MACE,yBACA,0BAA0B,cAC1B,0BAA0B,WAC1B;AACA,YAAQ,KAAK;AAAA,MACX,QAAQ;AAAA,MACR,MAAM,oBAAoB,qBAAqB;AAAA,MAC/C,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,QAAQ,QAAQ,KAAK,CAAC,WAAW,OAAO,aAAa,WAAW,IAC5D,cACA,QAAQ,SAAS,IACf,aACA;AAAA,IACN;AAAA,EACF;AACF;AAEA,SAASD,QAAO,OAAkD;AAChE,SAAO,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAASC,SAAQ,OAAwB;AACvC,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ;AACvE;AAEA,SAAS,gBAAgBC,OAAgB,UAA0B;AACjE,QAAM,UAAUA,MAAK,KAAK;AAC1B,MAAI,CAAC,MAAM,QAAQ,OAAO,EAAG,QAAO;AACpC,QAAM,QAAQ,QAAQ;AAAA,IACpB,CAAC,WACC,QAAQ,MAAM,KAAK,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM;AAAA,EAC1E;AACA,SAAO,OAAO,OAAO,SAAS,YAAY,MAAM,OAAO,MAAM,OAAO;AACtE;AAEA,SAAS,WACP,SACA,QACAA,OACA,SAAS,IACH;AACN,MAAIA,MAAK,cAAc,OAAOA,MAAK,aAAa,IAAK;AACrD,UAAQ,KAAK;AAAA,IACX;AAAA,IACA,MAAM,GAAG,MAAM,QAAQA,MAAK,UAAU;AAAA,IACtC,UACEA,MAAK,cAAc,OAAOA,MAAK,eAAe,MAC1C,cACA;AAAA,EACR,CAAC;AACH;;;ACxLO,SAAS,gBACd,QACA,KACM;AACN,MAAI;AAAA,IACF,eAAe,OAAO,MAAM,KAAK,IAAI,OAAO,MAAM,GAAG,KAAK,OAAO,MAAM,OAAO;AAAA,EAChF;AACA,QAAM,SAAS,MAAM,QAAQ,OAAO,YAAY,KAAK,MAAM,IACvD,OAAO,YAAY,KAAK,OAAO,OAAOC,OAAM,IAC5C,CAAC;AACL,QAAM,WAAW,OAAO;AAAA,IACtB,CAAC,OAAO,QAAQ,QAAQC,SAAQ,IAAI,QAAQ;AAAA,IAC5C;AAAA,EACF;AACA,QAAM,SAAS,OAAO;AAAA,IACpB,CAAC,OAAO,QAAQ,QAAQA,SAAQ,IAAI,MAAM;AAAA,IAC1C;AAAA,EACF;AACA,MAAI;AAAA,IACF,eAAgB,OAAO,YAAY,UAAU,IAAK,QAAQ,aAAc,MAAM;AAAA,EAChF;AACA,QAAM,WAAW,MAAM,QAAQ,OAAO,oBAAoB,KAAK,IAAI,IAC/D,OAAO,oBAAoB,KAAK,KAAK,OAAOD,OAAM,IAClD,CAAC;AACL,MAAI;AAAA,IACF,wBAAyB,OAAO,oBAAoB,UAAU,IAC5D,SAAS,SACL,SACG,MAAM,GAAG,CAAC,EACV;AAAA,MACC,CAAC,QACC,GAAG,OAAO,IAAI,SAAS,gBAAgB,CAAC,IAAIC,SAAQ,IAAI,QAAQ,CAAC;AAAA,IACrE,EACC,KAAK,IAAI,IACZ,eACN;AAAA,EACF;AACA,MAAI,IAAI,aAAa,OAAO,QAAQ,CAAC;AACrC,QAAM,kBAAkBD,QAAO,OAAO,OAAO,KAAK,WAAW,IACzD,OAAO,OAAO,KAAK,cACnB,CAAC;AACL,MAAI;AAAA,IACF,UAAW,OAAO,OAAO,UAAU,IAAK,OAAO,OAAO,OAAO,KAAK,UAAU,OAAO,OAAO,KAAK,SAAS,aAAa,CAAC,IAAK,gBAAgB,gBAAgB,kBAAkB,CAAC;AAAA,EAChL;AACA,QAAM,kBAAkBA,QAAO,OAAO,UAAU,KAAK,MAAM,IACvD,OAAO,UAAU,KAAK,SACtB,CAAC;AACL,QAAM,mBAAmBA,QAAO,gBAAgB,OAAO,IACnD,gBAAgB,UAChB,CAAC;AACL,MAAI;AAAA,IACF,aAAc,OAAO,UAAU,UAAU,IAAK,OAAO,OAAO,UAAU,KAAK,UAAU,OAAO,UAAU,KAAK,SAAS,aAAa,CAAC,IAAKC,SAAQ,iBAAiB,cAAc,CAAC;AAAA,EACjL;AACA,QAAM,kBAAkBD,QAAO,OAAO,SAAS,KAAK,OAAO,IACvD,OAAO,SAAS,KAAK,UACrB,CAAC;AACL,QAAM,mBAAmBA,QAAO,OAAO,SAAS,KAAK,QAAQ,IACzD,OAAO,SAAS,KAAK,WACrB,CAAC;AACL,QAAM,eAAeA,QAAO,iBAAiB,MAAM,IAC/C,iBAAiB,SACjB,CAAC;AACL,MAAI;AAAA,IACF,cAAe,OAAO,SAAS,UAAU,IAAK,OAAO,OAAO,SAAS,KAAK,UAAU,OAAO,SAAS,KAAK,SAAS,aAAa,CAAC,IAAKC,SAAQ,gBAAgB,QAAQ,CAAC,gBAAiBA,SAAQ,gBAAgB,MAAM,CAAC,mBAAoB,cAAc,aAAa,aAAa,CAAC;AAAA,EACrR;AACA,aAAW,QAAQ,sBAAsB,OAAO,gBAAgB,GAAG;AACjE,QAAI,IAAI,IAAI;AAAA,EACd;AACA,QAAM,WAAWD,QAAO,OAAO,uBAAuB,KAAK,UAAU,IACjE,OAAO,uBAAuB,KAAK,aACnC,CAAC;AACL,QAAM,iBAAiBA,QAAO,OAAO,uBAAuB,KAAK,MAAM,IACnE,OAAO,uBAAuB,KAAK,SACnC,CAAC;AACL,QAAM,iBAAiBA,QAAO,OAAO,uBAAuB,KAAK,MAAM,IACnE,OAAO,uBAAuB,KAAK,SACnC,CAAC;AACL,MAAI;AAAA,IACF,oBAAqB,OAAO,uBAAuB,UAAU,IAAK,OAAO,OAAO,uBAAuB,KAAK,UAAU,OAAO,uBAAuB,KAAK,SAAS,aAAa,CAAC,IAAK,gBAAgB,SAAS,mBAAmB,CAAC,yBAA0BC,SAAQ,eAAe,mBAAmB,CAAC,IAAIA,SAAQ,eAAe,gBAAgB,CAAC,iBAAe,gBAAgB,eAAe,gBAAgB,CAAC;AAAA,EACpZ;AACA,QAAM,iBAAiB,MAAM,QAAQ,OAAO,gBAAgB,KAAK,MAAM,IACnE,OAAO,gBAAgB,KAAK,OAAO,SACnC;AACJ,QAAM,oBAAoBD,QAAO,OAAO,gBAAgB,KAAK,SAAS,IAClE,OAAO,gBAAgB,KAAK,YAC5B,CAAC;AACL,MAAI;AAAA,IACF,sBAAuB,OAAO,gBAAgB,UAAU,IAAK,OAAO,OAAO,gBAAgB,KAAK,UAAU,OAAO,gBAAgB,KAAK,SAAS,aAAa,CAAC,IAAK,cAAc,cAAe,YAAY,kBAAkB,KAAK,CAAC;AAAA,EACrO;AACA,MAAI;AAAA,IACF,WAAY,OAAO,QAAQ,MAAM,IAAK,OAAO,QAAQ,QAAQ,IAAI,CAAC,WAAW,GAAG,OAAO,MAAM,IAAI,OAAO,IAAI,EAAE,EAAE,KAAK,IAAI,KAAK,8BAA8B;AAAA,EAC9J;AACF;AAEA,SAAS,sBAAsBE,OAA0B;AACvD,QAAM,YAAYF,QAAOE,MAAK,KAAK,SAAS,IAAIA,MAAK,KAAK,YAAY,CAAC;AACvE,QAAM,iBAAiBF,QAAO,UAAU,cAAc,IAClD,UAAU,iBACV,CAAC;AACL,QAAM,WAAWA,QAAO,eAAe,QAAQ,IAC3C,eAAe,WACf,CAAC;AACL,QAAM,UAAUA,QAAO,eAAe,aAAa,IAC/C,eAAe,gBACf,CAAC;AACL,QAAM,KAAKA,QAAO,UAAU,EAAE,IAAI,UAAU,KAAK,CAAC;AAClD,QAAM,aAAaA,QAAO,GAAG,QAAQ,IAAI,GAAG,WAAW,CAAC;AACxD,QAAM,YAAYA,QAAO,GAAG,OAAO,IAAI,GAAG,UAAU,CAAC;AACrD,QAAM,YAAYA,QAAO,WAAW,OAAO,IACvC,WAAW,UACX,CAAC;AACL,QAAM,KAAKA,QAAO,UAAU,EAAE,IAAI,UAAU,KAAK,CAAC;AAClD,QAAM,eAAeA,QAAO,GAAG,UAAU,IAAI,GAAG,aAAa,CAAC;AAC9D,QAAM,YAAYA,QAAO,GAAG,OAAO,IAAI,GAAG,UAAU,CAAC;AACrD,QAAM,SAAS;AAAA,IACbE,MAAK,KAAK,UAAUA,MAAK,KAAK,SAAS;AAAA,EACzC;AACA,SAAO;AAAA,IACL,uBAAwBA,MAAK,UAAU,IAAK,MAAM,IAC7C,cAAc,QAAQ,WAAW,CAAC,sBAClC,cAAc,SAAS,+BAA+B,mBAAmB,CAAC,IAC1E,mBAAmB,QAAQ,UAAU,CAAC;AAAA,IAC3C,iBAAkBA,MAAK,UAAU,IAAK,MAAM,IACvC,cAAc,UAAU,iBAAiB,CAAC,YAC1CD,SAAQ,WAAW,WAAW,IAAIA,SAAQ,WAAW,YAAY,CAAC,YAClEA,SAAQ,WAAW,QAAQ,CAAC,IAAIA,SAAQ,WAAW,WAAW,CAAC,sBAC/D,gBAAgB,UAAU,sBAAsB,CAAC,4BACjD,mBAAmB,WAAW,UAAU,CAAC;AAAA,IAC9C,iBAAkBC,MAAK,UAAU,IAAK,MAAM,IACvC,cAAc,UAAU,WAAW,CAAC,YACpCD,SAAQ,UAAU,WAAW,CAAC,YAC9BA,SAAQ,aAAa,QAAQ,CAAC,eAC9BA,SAAQ,aAAa,iBAAiB,IAAIA,SAAQ,aAAa,qBAAqB,CAAC,oBACrF,mBAAmB,aAAa,UAAU,CAAC;AAAA,EAClD;AACF;AAEA,SAAS,aAAaC,OAAwB;AAC5C,QAAM,cAAcF,QAAOE,MAAK,KAAK,WAAW,IAC5CA,MAAK,KAAK,cACV,CAAC;AACL,QAAM,eAAeF,QAAO,YAAY,YAAY,IAChD,YAAY,eACZ,CAAC;AACL,SACE,aAAcE,MAAK,UAAU,IAC1B,OAAOA,MAAK,KAAK,UAAUA,MAAK,KAAK,SAAS,aAAa,CAAC,IAC5DD,SAAQC,MAAK,KAAK,iBAAiB,CAAC,WACpC,gBAAgB,aAAa,GAAG,CAAC,uBACjCD,SAAQ,YAAY,YAAY,CAAC;AAExC;AAEA,SAASD,QAAO,OAAkD;AAChE,SAAO,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAASC,SAAQ,OAAwB;AACvC,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ;AACvE;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IACrD,GAAG,KAAK,QACR;AACN;AAEA,SAAS,YAAY,OAAwB;AAC3C,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACjE,SAAO,GAAG,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,GAAI,CAAC,CAAC;AACjD;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IACrD,GAAG,KAAK,MAAM,QAAQ,GAAG,CAAC,MAC1B;AACN;AAEA,SAAS,cAAc,OAAwB;AAC7C,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACjE,MAAI,SAAS,OAAO,OAAO,MAAM;AAC/B,WAAO,IAAI,SAAS,OAAO,OAAO,OAAO,QAAQ,CAAC,CAAC;AAAA,EACrD;AACA,MAAI,SAAS,OAAO,MAAM;AACxB,WAAO,IAAI,SAAS,OAAO,OAAO,QAAQ,CAAC,CAAC;AAAA,EAC9C;AACA,MAAI,SAAS,KAAM,QAAO,IAAI,QAAQ,MAAM,QAAQ,CAAC,CAAC;AACtD,SAAO,GAAG,KAAK,MAAM,KAAK,CAAC;AAC7B;AAEA,SAAS,cAAc,OAAgB,MAAsB;AAC3D,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IACrD,GAAG,KAAK,IAAI,IAAI,KAChB,UAAK,IAAI;AACf;AAEA,SAAS,mBAAmB,OAAwB;AAClD,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IACrD,GAAG,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,CAAC,CAAC,MACjC;AACN;;;ACpMA,eAAsB,YACpB,QACA,OAAiB,CAAC,GACH;AACf;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,OAAO,YAAY,CAAC;AACnC,MAAI,WAAW,UAAU;AACvB,UAAM,IAAI;AAAA,MACR,wBAAwB,UAAU,EAAE;AAAA,IACtC;AAAA,EACF;AACA,QAAM,UAAU;AAAA,IACd,UAAU,OAAO,QAAQ,SAAS,WAAW,KAAK;AAAA,EACpD;AACA,QAAM,UAAU,MAAM,uBAAuB,QAAQ;AAAA,IACnD,oBAAoB;AAAA,IACpB,oBAAoB;AAAA,IACpB,YAAY;AAAA,EACd,CAAC;AACD,QAAM,MAAM,QAAQ;AACpB,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,MAAM,KAAK,UAAU;AAC3B,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,MACE,YAAY,IAAI;AAAA,MAChB,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,MAAM;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,QAAQ,QAAQ,IAAI;AAC1B,QAAM,MAAM,QAAQ,YAAY;AAChC,QAAM,OAAO,GAAG,IAAI,WAAW,SAAS,mBAAmB,KAAK,CAAC;AACjE,QAAM,QAAQ,IAAI,gBAAgB,EAAE,KAAK,SAAS,OAAO,OAAO,EAAE,CAAC;AACnE,QAAM,UAAU,EAAE,eAAe,UAAU,KAAK,GAAG;AACnD,QAAM,gBAAgB,IAAI,gBAAgB;AAAA,IACxC;AAAA,IACA,SAAS,OAAO,OAAO;AAAA,IACvB,WAAW;AAAA,IACX,QAAQ;AAAA,EACV,CAAC;AACD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,MAAM,QAAQ,IAAI;AAAA,IACpBE,MAAK,GAAG,IAAI,gBAAgB,KAAK,IAAI,SAAS,OAAO;AAAA,IACrDA,MAAK,GAAG,IAAI,YAAY,aAAa,IAAI,SAAS,OAAO;AAAA,IACzDA;AAAA,MACE,GAAG,IAAI,qBAAqB,KAAK;AAAA,MACjC;AAAA,MACA;AAAA,IACF;AAAA,IACAA;AAAA,MACE,GAAG,IAAI,qBAAqB,IAAI,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAAA,MACxD;AAAA,MACA;AAAA,IACF;AAAA,IACAA,MAAK,GAAG,IAAI,gBAAgB,KAAK,IAAI,SAAS,OAAO;AAAA,IACrDA,MAAK,GAAG,IAAI,wBAAwB,KAAK,IAAI,SAAS,OAAO;AAAA,IAC7D,UAAU,YACNA,MAAK,GAAG,IAAI,iCAAiC,SAAS,OAAO,IAC7D,QAAQ,QAAkB;AAAA,MACxB,YAAY;AAAA,MACZ,MAAM;AAAA,QACJ,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,QACE;AAAA,MACJ;AAAA,IACF,CAAC;AAAA,IACLA;AAAA,MACE,GAAG,IAAI,uCAAuC,KAAK;AAAA,MACnD;AAAA,MACA;AAAA,IACF;AAAA,IACAA,MAAK,GAAG,IAAI,gCAAgC,KAAK,IAAI,SAAS,OAAO;AAAA,EACvE,CAAC;AACD,QAAM,UAAU,cAAc;AAAA,IAC5B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,SAAS;AAAA,IACb,eAAe;AAAA,IACf,OAAO,EAAE,OAAO,KAAK,QAAQ;AAAA,IAC7B,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,OAAO,QAAQ,SAAS,MAAM;AAChC,QAAI,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AACvC;AAAA,EACF;AACA,kBAAgB,QAAQ,GAAG;AAC7B;AAEA,SAAS,cAAc,OAAuB;AAC5C,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,IAAI,KAAK,IAAI;AACpE,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,SAAO;AACT;AAEA,eAAeA,MACb,KACA,SACA,SACmB;AACnB,QAAMC,YAAW,MAAM,QAAQ,KAAK,EAAE,QAAQ,CAAC;AAC/C,QAAM,OAAO,MAAMA,UAAS,KAAK;AACjC,MAAI,OAAgC,CAAC;AACrC,MAAI,MAAM;AACR,QAAI;AACF,YAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,aACE,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACrD,QACD,EAAE,MAAM;AAAA,IAChB,QAAQ;AACN,aAAO,EAAE,SAAS,KAAK,MAAM,GAAG,GAAG,EAAE;AAAA,IACvC;AAAA,EACF;AACA,SAAO,EAAE,YAAYA,UAAS,QAAQ,KAAK;AAC7C;;;ACzKA,SAAS,sBAAsB;AAC/B,OAAOC,eAAa;AAgBb,SAAS,iBAAiB,QAA0B;AACzD,QAAM,OAAOC,UAAQ,IAAI;AACzB,MAAI,CAAC,KAAM;AACX,MAAI;AACF,UAAM,QAA4B;AAAA,MAChC,MAAM,eAAe,OAAO,WAAW;AAAA,MACvC,SAAS,OAAO,QAAQ,OAAO,OAAO,EACnC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,UAAU,QAAQ,MAAM,IAAI,KAAK,IAAI,EAC5D,KAAK;AAAA,IACV;AACA,QAAI,CAAC,MAAM,KAAK,OAAQ;AACxB,mBAAe,MAAM,GAAG,KAAK,UAAU,KAAK,CAAC;AAAA,CAAI;AAAA,EACnD,QAAQ;AAAA,EAER;AACF;;;ACxCA,SAAS,gBAAAC,qBAAoB;;;ACoB7B,IAAM,OAAO;AAIN,SAAS,cAAc,OAAiD;AAC7E,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,QAAM,MAAqB,CAAC;AAC5B,aAAW,SAAS,MAAM,MAAM,QAAQ,EAAE,OAAO,OAAO,GAAG;AACzD,UAAM,QAAQ,KAAK,KAAK,KAAK;AAC7B,QAAI,QAAQ,CAAC,KAAK,MAAM,CAAC,EAAG,KAAI,KAAK,EAAE,MAAM,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,EAAE,CAAC;AAAA,EACxE;AACA,SAAO;AACT;AAIO,SAAS,gBAAgB,GAAW,GAAmB;AAC5D,QAAM,QAAQ,CAAC,MAAc;AAC3B,UAAM,CAAC,OAAO,IAAI,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAC5C,WAAO,EAAE,MAAM,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,OAAO,SAAS,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI;AAAA,EAC9E;AACA,QAAM,OAAO,MAAM,CAAC;AACpB,QAAM,QAAQ,MAAM,CAAC;AACrB,WAAS,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,KAAK,QAAQ,MAAM,KAAK,MAAM,GAAG,KAAK;AACtE,UAAM,QAAQ,KAAK,KAAK,CAAC,KAAK,MAAM,MAAM,KAAK,CAAC,KAAK;AACrD,QAAI,KAAM,QAAO,OAAO,IAAI,KAAK;AAAA,EACnC;AACA,MAAI,KAAK,QAAQ,MAAM,IAAK,QAAO;AACnC,MAAI,CAAC,KAAK,IAAK,QAAO;AACtB,MAAI,CAAC,MAAM,IAAK,QAAO;AACvB,SAAO,KAAK,MAAM,MAAM,MAAM,KAAK;AACrC;AAGO,SAAS,UAAU,WAAmB,KAAsB;AACjE,SAAO,gBAAgB,WAAW,GAAG,KAAK;AAC5C;AAUO,SAAS,kBACd,UACA,mBACoB;AACpB,QAAM,QAA4B,CAAC;AACnC,aAAW,eAAe,cAAc,QAAQ,GAAG;AACjD,UAAM,YAAY,kBAAkB,YAAY,IAAI;AACpD,QAAI,cAAc,QAAW;AAC3B,YAAM,KAAK,EAAE,GAAG,aAAa,WAAW,KAAK,CAAC;AAAA,IAChD,WAAW,CAAC,UAAU,WAAW,YAAY,GAAG,GAAG;AACjD,YAAM,KAAK,EAAE,GAAG,aAAa,UAAU,CAAC;AAAA,IAC1C;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,cAAc,MAAc,OAA4C;AACtF,QAAM,SAAS,MACZ,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,EAAE,GAAG,GAAG,EAAE,YAAY,cAAc,EAAE,SAAS,MAAM,uBAAuB,EAAE,EACtG,KAAK,IAAI;AACZ,SAAO,kBAAkB,IAAI,aAAa,MAAM;AAClD;;;ADhFO,IAAM,iBAAiB;AA0C9B,eAAsB,KACpB,KACA,QACA,MACA,MACY;AACZ,QAAM,MAAM,MAAM,IAAI,QAAQ,GAAG,IAAI,YAAY,QAAQ,OAAO,EAAE,CAAC,eAAe,IAAI,IAAI;AAAA,IACxF;AAAA,IACA,SAAS;AAAA,MACP,eAAe,UAAU,IAAI,KAAK;AAAA,MAClC,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;AAAA,IACrE;AAAA,IACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;AAAA,EAC7D,CAAC;AACD,QAAM,UAAW,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAClD,MAAI,IAAI,GAAI,QAAO;AACnB,QAAMC,WAAU,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ,QAAQ,IAAI,MAAM;AAGtF,MAAI,IAAI,WAAW,OAAO,IAAI,UAAU;AACtC,UAAM,MAAM,MAAM,IAAI,SAAS,EAAE,MAAM,MAAM,IAAI;AACjD,QAAI,OAAO,CAAC,IAAI;AACd,YAAM,IAAI;AAAA,QACR,GAAGA,QAAO,mBAAc,IAAI,UAAU,iBAAiB,aAAa,IAAI,KAAK,4DAC/B,IAAI,SAAS,IAAI,WAAW;AAAA,MAC5E;AAAA,EACJ;AACA,QAAM,IAAI,MAAMA,QAAO;AACzB;AAGA,eAAe,OAAO,KAAqB,MAAgC;AACzE,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,gBAAgB,mBAAmB,IAAI,KAAK,CAAC,SAAS,mBAAmB,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,QAAQ,KAAK,QAAQ,CAAC;AAC5B,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,eAAe,IAAI,QAAQ,IAAI,KAAK,EAAE;AAClE,SAAO;AACT;AAGO,SAAS,SAAS,MAA0B,QAAoC;AACrF,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI,SAAS,OAAW,OAAM,IAAI,MAAM,qEAAqE;AAC7G,SAAOC,cAAa,SAAS,MAAM,IAAI,MAAM,MAAM;AACrD;AAEA,IAAM,QAAQ,CAAC,OAAyB,KAAK,IAAI,KAAK,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,KAAK,GAAG,IAAI;AAIzG,eAAsB,YAAY,KAAqB,KAAc,OAA+B;AAClG,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,CAAC,IAAK,QAAO,IAAI,OAAO,IAAI,KAAK;AACrC,MAAI,MAAO,QAAO,IAAI,KAAK,KAAK;AAChC,QAAM,OAAO,MAAM,KAAoB,KAAK,OAAO,WAAW,OAAO,OAAO,IAAI,MAAM,KAAK,EAAE,EAAE;AAC/F,MAAI,IAAI,KAAM,QAAO,IAAI,IAAI,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAC9D,MAAI,CAAC,KAAK,QAAQ,OAAQ,QAAO,IAAI,IAAI,IAAI,eAAe;AAC5D,MAAI,IAAI,IAAI,CAAC,QAAQ,UAAU,KAAK,SAAS,WAAW,OAAO,EAAE,KAAK,GAAI,CAAC;AAC3E,aAAW,KAAK,KAAK;AACnB,QAAI,IAAI;AAAA,MACN,CAAC,EAAE,MAAM,EAAE,QAAQ,IAAI,EAAE,OAAO,IAAI,EAAE,UAAU,iBAAiB,aAAa,EAAE,OAAO,MAAM,EAAE,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,GAAI;AAAA,IAC/H;AACJ;AAOA,eAAsB,WAAW,KAAqB,MAA6B;AACjF,QAAM,UAAU,MAAM,OAAO,KAAK,IAAI;AACtC,MAAI,IAAI,KAAM,QAAO,IAAI,IAAI,IAAI,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AACjE,QAAM,QAAQ,kBAAkB,QAAQ,UAAU,EAAE,gBAAgB,WAAW,EAAE,CAAC;AAClF,MAAI,MAAM,OAAQ,KAAI,IAAI,MAAM,cAAc,MAAM,KAAK,CAAC;AAC1D,MAAI,IAAI,IAAI,QAAQ,IAAI;AAC1B;AAGA,eAAsB,WACpB,KACA,MACA,OACA,MACA,SACA,UACe;AACf,QAAM,UAAU,MAAM,KAAqB,KAAK,QAAQ,YAAY;AAAA,IAClE,OAAO,IAAI;AAAA,IACX,OAAO,EAAE,MAAM,OAAO,MAAM,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC,GAAI,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC,EAAG;AAAA,EACjG,CAAC;AACD,MAAI,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,WAAW,IAAI,KAAK,QAAQ,EAAE,GAAG;AAC7F;AAGA,eAAsB,YACpB,KACA,MACA,MACA,MACA,UACe;AACf,QAAM,UAAU,MAAM,OAAO,KAAK,IAAI;AACtC,QAAM,SAAS,MAAM,KAAiC,KAAK,SAAS,YAAY,mBAAmB,QAAQ,EAAE,CAAC,IAAI;AAAA;AAAA;AAAA,IAGhH,OAAO,EAAE,MAAM,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,GAAI,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,YAAY,KAAK,EAAG;AAAA,EAC9G,CAAC;AACD,MAAI,IAAI,KAAM,QAAO,IAAI,IAAI,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAChE,MAAI,IAAI,IAAI,GAAG,IAAI,YAAO,OAAO,QAAQ,WAAW,QAAQ,UAAU,CAAC,EAAE;AAC3E;AAGA,eAAsB,cAAc,KAAqB,MAAc,QAA+B;AACpG,QAAM,UAAU,MAAM,OAAO,KAAK,IAAI;AACtC,QAAM,SAAS,MAAM,KAAiC,KAAK,SAAS,YAAY,mBAAmB,QAAQ,EAAE,CAAC,IAAI;AAAA,IAChH,OAAO,EAAE,OAAO;AAAA,EAClB,CAAC;AACD,MAAI,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,GAAG,IAAI,WAAM,MAAM,EAAE;AAChF;AAKA,eAAsB,kBAAkB,KAAqB,MAAc,YAAmC;AAC5G,MAAI,eAAe,cAAc,eAAe;AAC9C,UAAM,IAAI,MAAM,kDAAkD,UAAU,GAAG;AACjF,QAAM,UAAU,MAAM,OAAO,KAAK,IAAI;AACtC,QAAM,SAAS,MAAM,KAAiC,KAAK,SAAS,YAAY,mBAAmB,QAAQ,EAAE,CAAC,IAAI;AAAA,IAChH,OAAO,EAAE,WAAW;AAAA,EACtB,CAAC;AACD,MAAI,IAAI,KAAM,QAAO,IAAI,IAAI,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAChE,MAAI,IAAI;AAAA,IACN,eAAe,aACX,GAAG,IAAI,qEACP,GAAG,IAAI;AAAA,EACb;AACF;AAGA,eAAsB,eAAe,KAAqB,MAA6B;AACrF,QAAM,UAAU,MAAM,OAAO,KAAK,IAAI;AACtC,QAAM,OAAO,MAAM,KAAqB,KAAK,OAAO,YAAY,mBAAmB,QAAQ,EAAE,CAAC,YAAY;AAC1G,MAAI,IAAI,KAAM,QAAO,IAAI,IAAI,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAC9D,MAAI,IAAI,IAAI,GAAG,IAAI,WAAW,QAAQ,OAAO,EAAE;AAC/C,MAAI,CAAC,KAAK,QAAQ,OAAQ,QAAO,IAAI,IAAI,IAAI,uBAAuB;AACpE,MAAI,IAAI,IAAI,CAAC,KAAK,QAAQ,MAAM,MAAM,EAAE,KAAK,GAAI,CAAC;AAClD,aAAW,KAAK,KAAK;AACnB,QAAI,IAAI,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,EAAE,SAAS,GAAG,EAAE,cAAc,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,GAAI,CAAC;AAClG;AAGA,eAAsB,cAAc,KAAqB,MAAc,SAAgC;AACrG,QAAM,UAAU,MAAM,OAAO,KAAK,IAAI;AACtC,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA,YAAY,mBAAmB,QAAQ,EAAE,CAAC;AAAA,IAC1C,EAAE,QAAQ;AAAA,EACZ;AACA,MAAI,IAAI,KAAM,QAAO,IAAI,IAAI,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAChE,MAAI,IAAI,IAAI,GAAG,IAAI,iBAAiB,OAAO,UAAU,OAAO,QAAQ,WAAW,QAAQ,UAAU,CAAC,EAAE;AACtG;AAGA,eAAsB,cAAc,KAAqB,MAA6B;AACpF,QAAM,UAAU,MAAM,OAAO,KAAK,IAAI;AACtC,QAAM,KAAK,KAAK,UAAU,YAAY,mBAAmB,QAAQ,EAAE,CAAC,EAAE;AACtE,MAAI,IAAI,IAAI,WAAW,IAAI,EAAE;AAC/B;;;AExNA,SAAS,gBAAAC,gBAAc,eAAAC,cAAa,gBAAgB;AACpD,SAAS,YAAAC,WAAU,QAAAC,cAAY;AA6BxB,SAAS,aAAa,MAAc,MAA6D;AACtG,MAAI,OAAO;AACX,QAAM,OAAoB,CAAC;AAC3B,QAAM,KAAK,oCAAoC,KAAK,IAAI;AACxD,MAAI,IAAI;AACN,WAAO,KAAK,MAAM,GAAG,CAAC,EAAE,MAAM;AAC9B,eAAW,QAAQ,GAAG,CAAC,EAAG,MAAM,OAAO,GAAG;AACxC,YAAM,OAAO,qBAAqB,KAAK,KAAK,KAAK,CAAC;AAClD,UAAI,CAAC,KAAM;AACX,YAAM,QAAQ,KAAK,CAAC,EAAG,KAAK,EAAE,QAAQ,gBAAgB,EAAE;AACxD,UAAI,KAAK,CAAC,MAAM,UAAW,MAAK,UAAU;AAC1C,UAAI,KAAK,CAAC,MAAM,OAAQ,MAAK,OAAO,MAAM,QAAQ,YAAY,EAAE,EAAE,KAAK;AAAA,IACzE;AAAA,EACF;AACA,QAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,QAAM,YAAY,MAAM,UAAU,CAAC,MAAM,UAAU,KAAK,CAAC,CAAC;AAC1D,MAAI,cAAc,GAAI,QAAO,EAAE,OAAO,MAAM,MAAM,KAAK,KAAK,GAAG,GAAG,KAAK;AACvE,SAAO;AAAA,IACL,OAAO,MAAM,SAAS,EAAG,QAAQ,SAAS,EAAE,EAAE,KAAK;AAAA,IACnD,MAAM,CAAC,GAAG,MAAM,MAAM,GAAG,SAAS,GAAG,GAAG,MAAM,MAAM,YAAY,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,KAAK;AAAA,IACpF,GAAG;AAAA,EACL;AACF;AAGO,SAAS,eAAe,KAA8B;AAC3D,MAAI,CAAC,SAAS,KAAK,EAAE,gBAAgB,MAAM,CAAC,GAAG,YAAY,EAAG,OAAM,IAAI,MAAM,oBAAoB,GAAG,EAAE;AACvG,QAAM,QAAQC,aAAY,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,CAAC,EAAE,KAAK;AACrE,MAAI,CAAC,MAAM,OAAQ,OAAM,IAAI,MAAM,mBAAmB,GAAG,EAAE;AAC3D,SAAO,MAAM,IAAI,CAAC,SAAS;AACzB,UAAM,OAAOC,UAAS,MAAM,KAAK;AACjC,UAAM,SAAS,aAAaC,eAAaC,OAAK,KAAK,IAAI,GAAG,MAAM,GAAG,IAAI;AACvE,WAAO,EAAE,MAAM,MAAM,GAAG,QAAQ,OAAO,OAAO,KAAK,MAAM,KAAK,EAAE,OAAO,OAAO,EAAE,OAAO;AAAA,EACzF,CAAC;AACH;AAqBA,eAAsB,cACpB,KACA,KACA,UAAqD,CAAC,GACvC;AACf,QAAM,SAAS,eAAe,GAAG;AACjC,MAAI,QAAQ,QAAQ;AAClB,QAAI,IAAI,IAAI,GAAG,OAAO,MAAM,2BAA2B,GAAG;AAAA,CAAqB;AAC/E,eAAW,KAAK,OAAQ,KAAI,IAAI,IAAI,KAAK,EAAE,KAAK,OAAO,EAAE,CAAC,IAAI,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE;AAC7G;AAAA,EACF;AAEA,QAAM,SAAkC,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,EAAE;AAC/E,aAAW,KAAK,QAAQ;AACtB,UAAM,UAAU,MAAM,OAAO,KAAK,GAAG,QAAQ,UAAU;AACvD,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,MAAI,IAAI;AAAA,IACN;AAAA,EAAK,OAAO,OAAO,aAAa,OAAO,OAAO,aAAa,OAAO,SAAS,iBAClE,IAAI,KAAK;AAAA,EACpB;AACF;AAEA,eAAe,OAAO,KAAqB,GAAkB,YAAuC;AAClG,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,gBAAgB,mBAAmB,IAAI,KAAK,CAAC,SAAS,mBAAmB,EAAE,IAAI,CAAC;AAAA,EAClF;AACA,QAAM,QAAQ,KAAK,QAAQ,CAAC;AAC5B,MAAI,CAAC,OAAO;AACV,UAAM,KAAK,KAAK,QAAQ,YAAY;AAAA,MAClC,OAAO,IAAI;AAAA,MACX,OAAO;AAAA,QACL,MAAM,EAAE;AAAA,QACR,OAAO,EAAE;AAAA,QACT,MAAM,EAAE;AAAA,QACR,QAAQ;AAAA,QACR,GAAI,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,QAC1C,GAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,QACjC,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,MACrC;AAAA,IACF,CAAC;AACD,QAAI,IAAI,IAAI,OAAO,EAAE,IAAI,KAAK,EAAE,KAAK,SAAS;AAC9C,WAAO;AAAA,EACT;AACA,MAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,UAAU,EAAE,UAAU,EAAE,WAAW,MAAM,aAAa,MAAM,SAAS;AACtG,QAAI,IAAI,IAAI,OAAO,EAAE,IAAI,yBAAyB,MAAM,OAAO,GAAG;AAClE,WAAO;AAAA,EACT;AACA,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA,YAAY,mBAAmB,MAAM,EAAE,CAAC;AAAA,IACxC;AAAA,MACE,OAAO;AAAA,QACL,OAAO,EAAE;AAAA,QACT,MAAM,EAAE;AAAA,QACR,GAAI,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,QAC1C,GAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,QACjC,MAAM,iBAAiB,EAAE,IAAI;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAIA,QAAM,QAAQ,OAAO,QAAQ,WAAW,MAAM;AAC9C,MAAI,IAAI;AAAA,IACN,UAAU,MAAM,UACZ,OAAO,EAAE,IAAI,MAAM,KAAK,qBACxB,OAAO,EAAE,IAAI,MAAM,MAAM,OAAO,YAAO,KAAK;AAAA,EAClD;AACA,SAAO;AACT;;;AChKA,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,cAAAC,cAAY,gBAAAC,sBAAoB;AACzC,SAAS,QAAAC,cAAY;;;ACYrB,IAAM,OACJ;AAEF,IAAM,QAAQ;AAGd,IAAM,WACJ;AACF,IAAM,QAAQ;AAMd,IAAM,SAAS;AACf,IAAM,YAAY;AAGlB,IAAM,QAAQ,oBAAI,IAAI;AAAA,EACpB;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAO;AAAA,EAAS;AAAA,EAAS;AAAA,EAClE;AAAA,EAAY;AAAA,EAAQ;AAAA,EAAY;AAAA,EAAO;AAAA,EAAO;AAChD,CAAC;AAKD,IAAM,QAAQ,CAAC,UACb,MACG,QAAQ,cAAc,EAAE,EACxB,MAAM,eAAe,EACrB,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,CAAC,MAAM,IAAI,EAAE,YAAY,CAAC,CAAC;AAG9D,SAAS,aAAa,QAA0B;AAC9C,SAAO,OACJ,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,MAAM,UAAU,EAAE,CAAC,GAAG,KAAK,KAAK,EAAE,EAC5D,OAAO,CAAC,SAAS,qBAAqB,KAAK,IAAI,KAAK,SAAS,MAAM;AACxE;AAGA,SAAS,YAAY,MAAsB;AACzC,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,MAAI,CAAC,YAAY,QAAQ,UAAU,EAAE,SAAS,MAAM,CAAC,KAAK,EAAE,KAAK,MAAM,CAAC,EAAG,QAAO,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AACzG,MAAI,MAAM,CAAC,MAAM,UAAW,QAAO;AACnC,MAAI,MAAM,CAAC,MAAM,OAAQ,QAAO;AAChC,SAAO;AACT;AAQA,SAAS,OAAO,MAA6B;AAC3C,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,QAAM,MAAM,MAAM,QAAQ,KAAK;AAC/B,MAAI,QAAQ,GAAI,QAAO;AACvB,SAAO,MAAM,MAAM,CAAC,MAAM,SAAa,MAAM,MAAM,CAAC,KAAK,OAAQ;AACnE;AAWA,SAAS,SAAS,OAAiB,MAAyB;AAC1D,aAAW,CAAC,GAAG,IAAI,KAAK,MAAM,QAAQ,GAAG;AACvC,UAAM,OAAO,KAAK,KAAK,IAAI;AAC3B,QAAI,OAAO,CAAC,GAAG;AACb,WAAK,IAAI,KAAK,CAAC,CAAC;AAChB;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,KAAK,IAAI;AAC7B,QAAI,QAAQ,CAAC,GAAG;AACd,iBAAW,QAAQ,aAAa,MAAM,CAAC,CAAC,EAAG,MAAK,IAAI,IAAI;AACxD;AAAA,IACF;AACA,QAAI,CAAC,MAAM,KAAK,IAAI,EAAG;AAIvB,aAAS,IAAI,IAAI,GAAG,IAAI,MAAM,UAAU,IAAI,IAAI,IAAI,KAAK;AACvD,YAAM,QAAQ,SAAS,KAAK,MAAM,CAAC,CAAE;AACrC,UAAI,QAAQ,CAAC,GAAG;AACd,aAAK,IAAI,MAAM,CAAC,CAAC;AACjB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,UAAU,MAA4B;AAC7C,QAAM,QAAQ,oBAAI,IAAwB;AAC1C,MAAI,UAA6B;AACjC,MAAI,OAAiB,CAAC;AACtB,QAAM,QAAQ,MAAM;AAClB,QAAI,WAAW,KAAK,OAAQ,UAAS,MAAM,QAAQ,OAAO;AAC1D,WAAO,CAAC;AAAA,EACV;AACA,aAAW,QAAQ,KAAK,MAAM,IAAI,GAAG;AACnC,UAAM,SAAS,gCAAgC,KAAK,IAAI;AACxD,QAAI,QAAQ;AACV,YAAM;AACN,YAAM,OAAO,OAAO,CAAC,KAAK,OAAO,CAAC;AAClC,gBAAU,MAAM,IAAI,IAAI,KAAK,EAAE,MAAM,SAAS,oBAAI,IAAI,GAAG,UAAU,uBAAuB,KAAK,IAAI,EAAE;AACrG,YAAM,IAAI,MAAM,OAAO;AACvB;AAAA,IACF;AACA,QAAI,KAAK,WAAW,IAAI,GAAG;AACzB,YAAM;AACN;AAAA,IACF;AACA,QAAI,WAAW,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,EAAG,MAAK,KAAK,IAAI;AAAA,EAC3F;AACA,QAAM;AACN,SAAO,CAAC,GAAG,MAAM,OAAO,CAAC;AAC3B;AAQO,SAAS,gBACd,MACA,WAAsD,MAAM,QAC1C;AAClB,QAAM,UAAU,oBAAI,IAA8F;AAClH,aAAW,QAAQ,UAAU,IAAI,GAAG;AAClC,UAAM,YAAY,YAAY,KAAK,IAAI;AACvC,UAAM,QAAQ,QAAQ,IAAI,SAAS,KAAK,EAAE,OAAO,CAAC,GAAG,SAAS,oBAAI,IAAI,GAAG,OAAO,oBAAI,IAAI,GAAG,UAAU,MAAM;AAC3G,UAAM,MAAM,KAAK,KAAK,IAAI;AAC1B,eAAW,QAAQ,KAAK,QAAS,OAAM,QAAQ,IAAI,IAAI;AACvD,UAAM,OAAO,OAAO,KAAK,IAAI;AAC7B,QAAI,KAAM,OAAM,MAAM,IAAI,IAAI;AAC9B,UAAM,aAAa,KAAK;AACxB,YAAQ,IAAI,WAAW,KAAK;AAAA,EAC9B;AAEA,SAAO,CAAC,GAAG,QAAQ,QAAQ,CAAC,EACzB,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM;AAC3B,UAAM,QAAQ,SAAS,SAAS,KAAK;AACrC,UAAM,UAAU,CAAC,GAAG,MAAM,OAAO,EAAE,KAAK;AAGxC,UAAM,QAAQ;AAAA,MACZ,GAAG;AAAA,MACH,GAAG,MAAM,KAAK;AAAA,MACd,GAAG,CAAC,GAAG,MAAM,KAAK,EAAE,QAAQ,KAAK;AAAA,MACjC,GAAI,MAAM,WAAW,CAAC,WAAW,WAAW,SAAS,IAAI,CAAC;AAAA,IAC5D;AACA,WAAO;AAAA,MACL;AAAA,MACA,OAAO,MAAM,MAAM,KAAK;AAAA,MACxB;AAAA,MACA,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG;AAAA,IAClD;AAAA,EACF,CAAC,EACA,OAAO,CAAC,YAAY,QAAQ,KAAK,EACjC,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,SAAS,EAAE,QAAQ,UAAU,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AACzF;;;ADjJA,IAAMC,UAAS;AAEf,SAAS,UAAU,KAAa;AAC9B,SAAO,CAAC,SACNC,cAAa,OAAO,MAAM,EAAE,KAAK,UAAU,QAAQ,WAAW,KAAK,OAAO,MAAM,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AACvH;AAKO,SAAS,YACd,QACA,MACAC,OACQ;AACR,MAAI,SAAS;AACb,MAAI;AACF,cAAU,OAAO,CAAC,QAAQ,eAAe,GAAG,IAAI,SAAS,CAAC;AAAA,EAC5D,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,wBAAwB,IAAI;AAAA,IAC9B;AAAA,EACF;AAGA,MAAI;AACF,cAAU,OAAO,CAAC,QAAQ,eAAe,MAAM,CAAC;AAAA,EAClD,QAAQ;AAAA,EAER;AACA,SAAO,SAAS,cAAc,QAAQA,KAAI;AAC5C;AAWO,SAAS,cAAc,QAAoCA,OAAwC;AACxG,MAAI,SAAS;AACb,MAAI;AACF,aAAS,OAAO,CAAC,YAAY,YAAY,oBAAoB,CAAC;AAAA,EAChE,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,MAAM;AACV,aAAW,QAAQ,OAAO,MAAM,IAAI,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,OAAO,GAAG;AAChF,WAAO,gBAAgB,IAAI,MAAM,IAAI;AAAA;AAAA,QAA0B,IAAI;AAAA;AACnE,QAAI,CAACF,QAAO,KAAK,IAAI,EAAG;AACxB,QAAI;AACJ,QAAI;AACF,aAAOE,MAAK,IAAI;AAAA,IAClB,QAAQ;AACN;AAAA,IACF;AACA,WAAO,cAAc,KAAK,MAAM,IAAI,EAAE,MAAM;AAAA,EAAQ,KAAK,MAAM,IAAI,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA,EAC3G;AACA,SAAO;AACT;AAGA,SAAS,iBAAiB,MAAyD;AACjF,SAAO,CAAC,cAAc;AACpB,UAAM,WAAWC,OAAK,MAAM,WAAW,cAAc;AACrD,QAAI,CAACC,aAAW,QAAQ,EAAG,QAAO;AAClC,QAAI;AACF,YAAM,OAAQ,KAAK,MAAMC,eAAa,UAAU,MAAM,CAAC,EAAyB;AAChF,aAAO,OAAO,SAAS,WAAW,OAAO;AAAA,IAC3C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAIA,SAAS,SAAS,MAAwC;AACxD,QAAM,SAAS,oBAAI,IAA+C;AAClE,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,IAAI,IAAI,IAAI;AACjC,UAAM,UAAU,IAAI,WAAW,IAAI;AACnC,QAAI,OAAO;AACT,UAAI,WAAW,CAAC,MAAM,SAAS,SAAS,OAAO,EAAG,OAAM,SAAS,KAAK,OAAO;AAC7E;AAAA,IACF;AACA,WAAO,IAAI,IAAI,MAAM;AAAA,MACnB,MAAM,IAAI;AAAA,MACV,OAAO,IAAI;AAAA,MACX,SAAS,IAAI;AAAA,MACb,UAAU,UAAU,CAAC,OAAO,IAAI,CAAC;AAAA,MACjC,SAAS,IAAI;AAAA,IACf,CAAC;AAAA,EACH;AACA,SAAO,CAAC,GAAG,OAAO,OAAO,CAAC;AAC5B;AAGA,eAAsB,aACpB,KACA,UACA,KACA,OAC0B;AAC1B,QAAM,MAAuB,CAAC;AAC9B,aAAW,WAAW,UAAU;AAC9B,UAAM,SAAS,IAAI,gBAAgB,EAAE,GAAG,QAAQ,OAAO,OAAO,OAAO,KAAK,EAAE,CAAC;AAC7E,QAAI,CAAC,IAAK,QAAO,IAAI,OAAO,IAAI,KAAK;AACrC,UAAM,SAAS,MAAM,KAAmB,KAAK,OAAO,mBAAmB,MAAM,EAAE;AAG/E,UAAM,WACJ,OAAO,YAAY,WACf,SAAS,OAAO,IAAI,IACpB,OAAO,WAAW,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,SAAS,GAAG,UAAU,CAAC,EAAE,EAAE;AACvE,QAAI,KAAK,EAAE,SAAS,SAAS,CAAC;AAAA,EAChC;AACA,SAAO;AACT;AAEA,IAAM,WAAW,CAAC,MAAc,UAC9B,wBAAwB,IAAI,GAAG,UAAU,iBAAiB,KAAK,UAAU,KAAK,EAAE;AAElF,SAASC,QAAO,KAAqB,SAAgC;AACnE,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM;AACvD,MAAI,IAAI;AAAA,IACN,GAAG,QAAQ,MAAM,mBAAmB,QAAQ,WAAW,IAAI,KAAK,GAAG,KAC9D,QAAQ,MAAM;AAAA,EACrB;AACA,aAAW,EAAE,SAAS,SAAS,KAAK,SAAS;AAC3C,QAAI,IAAI,IAAI,EAAE;AACd,UAAM,SAAS,QAAQ,QAAQ,SAAS,sBAAsB,QAAQ,QAAQ,KAAK,IAAI,CAAC,KAAK;AAC7F,QAAI,IAAI,IAAI,GAAG,QAAQ,KAAK,MAAM,QAAQ,MAAM,MAAM,QAAQ,QAAQ,MAAM,WAAW,IAAI,KAAK,GAAG,GAAG,MAAM,GAAG;AAC/G,QAAI,CAAC,SAAS,QAAQ;AACpB,UAAI,IAAI,IAAI,qDAAgD;AAC5D;AAAA,IACF;AACA,eAAW,QAAQ,UAAU;AAC3B,YAAM,QAAQ,KAAK,SAAS,SAAS,SAAM,KAAK,SAAS,KAAK,IAAI,CAAC,KAAK;AACxE,YAAM,UAAU,KAAK,UAAU,MAAM,KAAK,OAAO,MAAM;AACvD,UAAI,IAAI,IAAI,KAAK,KAAK,IAAI,GAAG,KAAK,GAAG,OAAO,WAAM,KAAK,KAAK,EAAE;AAC9D,UAAI,IAAI,IAAI,OAAO,KAAK,OAAO,EAAE;AAAA,IACnC;AAAA,EACF;AACA,MAAI,QAAQ,QAAQ;AAClB,QAAI,IAAI,IAAI,EAAE;AACd,QAAI,IAAI,IAAI,6DAAwD;AACpE,QAAI,IAAI,IAAI,KAAK,SAAS,QAAQ,CAAC,EAAG,SAAS,CAAC,EAAG,MAAM,IAAI,KAAK,CAAC,EAAE;AAAA,EACvE;AACF;AAGA,eAAsB,cACpB,KACA,SACA,OAAmB,CAAC,GACL;AACf,QAAM,MAAM,KAAK,OAAO,QAAQ,IAAI;AACpC,QAAM,SAAS,KAAK,UAAU,UAAU,GAAG;AAC3C,QAAMJ,QAAO,KAAK,iBAAiB,CAAC,SAAiBG,eAAaF,OAAK,KAAK,IAAI,GAAG,MAAM;AACzF,QAAM,WAAW,gBAAgB,YAAY,QAAQ,QAAQ,MAAMD,KAAI,GAAG,iBAAiB,GAAG,CAAC;AAC/F,MAAI,CAAC,SAAS,QAAQ;AACpB,WAAO,IAAI,IAAI;AAAA,MACb,IAAI,OAAO,KAAK,UAAU,EAAE,MAAM,QAAQ,MAAM,SAAS,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,sBAAsB,QAAQ,IAAI;AAAA,IAC9G;AAAA,EACF;AACA,QAAM,UAAU,MAAM,aAAa,KAAK,UAAU,QAAQ,KAAK,QAAQ,SAAS,CAAC;AACjF,MAAI,IAAI,KAAM,QAAO,IAAI,IAAI,IAAI,KAAK,UAAU,EAAE,MAAM,QAAQ,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC;AACzF,EAAAI,QAAO,KAAK,OAAO;AACrB;;;AE9KO,SAAS,cAAc,MAA0B;AACtD,QAAM,KAAK;AACX,QAAM,QAAoB,CAAC;AAC3B,aAAW,SAAS,KAAK,SAAS,EAAE,GAAG;AACrC,QAAI,CAAC,MAAM,CAAC,EAAG;AACf,UAAMC,SAAQ,MAAM,CAAC,EAAG,KAAK,EAAE,MAAM,UAAU;AAC/C,QAAIA,OAAM,OAAQ,OAAM,KAAKA,MAAK;AAAA,EACpC;AACA,SAAO;AACT;AAGO,SAAS,YACd,SACA,WACe;AACf,QAAM,WAA0B,CAAC;AACjC,QAAM,KAAK,EAAE,MAAM,QAAQ,MAAM,OAAO,QAAQ,MAAM;AACtD,QAAM,WAAW,cAAc,QAAQ,QAAQ;AAE/C,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAWA,UAAS,cAAc,QAAQ,IAAI,GAAG;AAC/C,UAAM,UAAU,mBAAmBA,MAAK;AACxC,QAAI,CAAC,QAAS;AACd,UAAM,MAAM,GAAG,QAAQ,WAAW,IAAI,QAAQ,IAAI;AAClD,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AAIZ,aAAS,KAAK;AAAA,MACZ,GAAG;AAAA,MACH,MAAM,SAAS,SAAS,YAAY;AAAA,MACpC,QAAQ,SAAS,SACb,aAAaA,OAAM,KAAK,GAAG,CAAC,OAAO,gBAAgB,OAAO,CAAC,KAC3D,aAAaA,OAAM,KAAK,GAAG,CAAC,OAAO,gBAAgB,OAAO,CAAC;AAAA,IACjE,CAAC;AAAA,EACH;AAEA,QAAM,QAAQ,kBAAkB,QAAQ,UAAU,SAAS;AAC3D,MAAI,MAAM,OAAQ,UAAS,KAAK,EAAE,GAAG,IAAI,MAAM,YAAY,QAAQ,cAAc,QAAQ,MAAM,KAAK,EAAE,CAAC;AACvG,SAAO;AACT;AASA,eAAsB,YAAY,KAAqB,KAA6B;AAClF,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,CAAC,IAAK,QAAO,IAAI,OAAO,IAAI,KAAK;AACrC,QAAM,OAAO,MAAM,KAA6B,KAAK,OAAO,WAAW,OAAO,OAAO,IAAI,MAAM,KAAK,EAAE,EAAE;AACxG,QAAM,YAAY,EAAE,gBAAgB,WAAW,EAAE;AAEjD,QAAM,WAAW,KAAK,QAAQ,QAAQ,CAAC,YAAY,YAAY,SAAS,SAAS,CAAC;AAClF,MAAI,IAAI,KAAM,QAAO,IAAI,IAAI,IAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,QAAQ,SAAS,GAAG,MAAM,CAAC,CAAC;AAEpG,MAAI,CAAC,KAAK,QAAQ,OAAQ,QAAO,IAAI,IAAI,IAAI,wBAAwB;AACrE,MAAI,CAAC,SAAS,QAAQ;AACpB,WAAO,IAAI,IAAI;AAAA,MACb,GAAG,KAAK,QAAQ,MAAM,WAAW,KAAK,QAAQ,WAAW,IAAI,KAAK,GAAG,8DAA8D,WAAW,CAAC;AAAA,IACjJ;AAAA,EACF;AACA,MAAI,IAAI,IAAI,GAAG,SAAS,MAAM,WAAW,SAAS,WAAW,IAAI,KAAK,GAAG,WAAW,KAAK,QAAQ,MAAM,YAAY;AACnH,aAAW,WAAW,UAAU;AAC9B,UAAM,QAAQ,QAAQ,UAAU,iBAAiB,KAAK,UAAU,QAAQ,KAAK;AAC7E,QAAI,IAAI,IAAI,EAAE;AACd,QAAI,IAAI,IAAI,GAAG,QAAQ,IAAI,KAAK,QAAQ,IAAI,GAAG;AAC/C,QAAI,IAAI,IAAI,KAAK,QAAQ,MAAM,EAAE;AACjC,QAAI,IAAI,IAAI,yBAAyB,QAAQ,IAAI,GAAG,KAAK,EAAE;AAAA,EAC7D;AACF;;;AC3FA,eAAsB,cAAc,KAAqB,OAAe,KAAc,OAA+B;AACnH,QAAM,SAAS,IAAI,gBAAgB,EAAE,GAAG,MAAM,CAAC;AAC/C,MAAI,CAAC,IAAK,QAAO,IAAI,OAAO,IAAI,KAAK;AACrC,MAAI,MAAO,QAAO,IAAI,SAAS,OAAO,KAAK,CAAC;AAC5C,QAAM,SAAS,MAAM,KAAmB,KAAK,OAAO,mBAAmB,MAAM,EAAE;AAE/E,MAAI,IAAI,KAAM,QAAO,IAAI,IAAI,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAEhE,MAAI,OAAO,YAAY,eAAgB,QAAO,IAAI,IAAI,IAAI,qCAAqC;AAC/F,MAAI,OAAO,YAAY,WAAY,QAAO,IAAI,IAAI,IAAI,wBAAwB,KAAK,GAAG;AACtF,MAAI,OAAO,YAAY,eAAe;AACpC,QAAI,IAAI,IAAI,uBAAuB,KAAK,0CAA0C;AAClF,eAAW,KAAK,OAAO,WAAY,KAAI,IAAI,IAAI,KAAK,EAAE,IAAI,WAAM,EAAE,KAAK;AAAA,MAAS,EAAE,OAAO,EAAE;AAC3F;AAAA,EACF;AAEA,aAAW,CAAC,GAAG,GAAG,KAAK,OAAO,KAAK,QAAQ,GAAG;AAC5C,QAAI,EAAG,KAAI,IAAI,IAAI,EAAE;AACrB,QAAI,IAAI,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,UAAU,SAAM,IAAI,OAAO,KAAK,EAAE,OAAO,IAAI,OAAO,GAAG;AACrF,eAAW,QAAQ,IAAI,QAAQ,MAAM,IAAI,EAAG,KAAI,IAAI,IAAI,KAAK,IAAI,EAAE;AACnE,QAAI,IAAI,IAAI,aAAa,IAAI,IAAI,GAAG,IAAI,SAAS,IAAI,IAAI,MAAM,KAAK,EAAE,SAAM,IAAI,OAAO,EAAE;AAAA,EAC3F;AACF;AAaA,IAAM,gBACJ;AAIF,eAAsB,WAAW,KAAqB,UAAkB,KAA6B;AACnG,QAAM,SAAS,MAAM,KAAgB,KAAK,QAAQ,gBAAgB;AAAA,IAChE;AAAA,IACA,GAAI,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,MAAM;AAAA,EAClC,CAAC;AACD,MAAI,IAAI,KAAM,QAAO,IAAI,IAAI,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAEhE,MAAI,OAAO,QAAQ;AACjB,QAAI,IAAI,IAAI,OAAO,MAAM;AACzB,QAAI,OAAO;AACT,UAAI,IAAI;AAAA,QACN;AAAA,MAEF;AACF,QAAI,IAAI,IAAI,EAAE;AACd,QAAI,IAAI,IAAI,YAAY,OAAO,KAAK,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,GAAG,EAAE,SAAS,IAAI,EAAE,MAAM,KAAK,EAAE,EAAE,EAAE,KAAK,IAAI,KAAK,MAAM,EAAE;AACnH,QAAI,IAAI,IAAI,aAAa;AACzB;AAAA,EACF;AAGA,QAAM,MACJ,OAAO,gBAAgB,aACnB,0GACA,OAAO,gBAAgB,WACrB,+DACA;AACR,MAAI,IAAI,IAAI,GAAG;AACf,MAAI,OAAO,KAAK,QAAQ;AACtB,QAAI,IAAI,IAAI,EAAE;AACd,eAAW,OAAO,OAAO,MAAM;AAC7B,UAAI,IAAI,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,UAAU,SAAM,IAAI,OAAO,KAAK,EAAE,OAAO,IAAI,OAAO,GAAG;AACrF,UAAI,IAAI,IAAI,KAAK,IAAI,OAAO,EAAE;AAAA,IAChC;AAAA,EACF;AACA,MAAI,IAAI,IAAI,EAAE;AACd,MAAI,IAAI,IAAI,aAAa;AAC3B;AAGA,eAAsB,eAAe,KAAqB,MAAc,MAA6B;AACnG,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,gBAAgB,mBAAmB,IAAI,KAAK,CAAC,SAAS,mBAAmB,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,QAAQ,KAAK,QAAQ,CAAC;AAC5B,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,eAAe,IAAI,QAAQ,IAAI,KAAK,EAAE;AAClE,QAAM,KAAK,KAAK,QAAQ,YAAY,mBAAmB,MAAM,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC;AACrF,MAAI,IAAI,IAAI,gBAAgB,IAAI,MAAM,MAAM,OAAO,GAAG;AACxD;;;AChHA,SAAS,iBAAiB;AAC1B,SAAS,aAAa,gBAAAC,gBAAc,UAAAC,SAAQ,iBAAAC,sBAAqB;AACjE,SAAS,UAAAC,eAAc;AACvB,SAAS,QAAAC,cAAY;AACrB,OAAOC,eAAa;AAGb,IAAM,aAAa,CAAC,eAAe,UAAU,QAAQ;AAGrD,SAAS,cAAc,MAAyBA,UAAQ,KAAoB;AACjF,aAAW,QAAQ,YAAY;AAC7B,UAAM,QAAQ,IAAI,IAAI;AACtB,QAAI,SAAS,MAAM,KAAK,EAAG,QAAO,MAAM,KAAK;AAAA,EAC/C;AACA,SAAO;AACT;AAWA,SAAS,WAAW,SAAiB,MAAsB;AAGzD,QAAM,CAAC,KAAK,GAAG,IAAI,IAAI,QAAQ,MAAM,KAAK;AAC1C,QAAM,SAAS,UAAU,KAAM,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,OAAO,UAAU,CAAC;AACpE,MAAI,OAAO,MAAO,OAAM,IAAI,MAAM,2BAA2B,OAAO,MAAM,OAAO,MAAM,OAAO,EAAE;AAChG,SAAO,OAAO,UAAU;AAC1B;AAYO,SAAS,SAAS,SAAiB,MAAc,OAAmB,CAAC,GAAkB;AAC5F,QAAM,MAAM,KAAK,OAAOA,UAAQ;AAChC,QAAM,cAAc,KAAK,gBAAgB,MAAM,QAAQA,UAAQ,MAAM,KAAK;AAC1E,QAAM,SAAS,cAAc,GAAG;AAChC,MAAI,CAAC;AACH,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AACF,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,+FAAqF;AAEvG,QAAM,MAAM,YAAYD,OAAKD,QAAO,GAAG,eAAe,CAAC;AAGvD,QAAM,OAAOC,OAAK,KAAK,GAAG,IAAI,KAAK;AACnC,MAAI;AACF,IAAAF,eAAc,MAAM,SAAS,EAAE,MAAM,IAAM,CAAC;AAC5C,UAAM,OAAO,qBAAqB,IAAI,EAAE,QAAQ,IAAI;AACpD,QAAI,SAAS,EAAG,OAAM,IAAI,MAAM,WAAW,MAAM,iBAAiB,IAAI,uBAAuB;AAC7F,UAAM,SAASF,eAAa,MAAM,MAAM;AACxC,WAAO,WAAW,UAAU,OAAO;AAAA,EACrC,UAAE;AACA,IAAAC,QAAO,KAAK,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EAC9C;AACF;AAEA,IAAM,uBAAuB,CAAC,SAC5B,KAAK,OAAO;;;ACxDd,eAAsB,YACpB,KACA,MACA,OAAmB,CAAC,GACI;AACxB,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,gBAAgB,mBAAmB,IAAI,KAAK,CAAC,SAAS,mBAAmB,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,QAAQ,KAAK,QAAQ,CAAC;AAC5B,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,eAAe,IAAI,QAAQ,IAAI,KAAK,EAAE;AAClE,MAAI,IAAI,IAAI,WAAW,IAAI,KAAK,MAAM,OAAO,uBAAkB;AAC/D,SAAO,SAAS,MAAM,MAAM,MAAM,IAAI;AACxC;;;ACTA,eAAsB,cACpB,aACA,OACA,SACmB;AACnB,QAAM,MAAM,MAAM,QAAQ,GAAG,YAAY,QAAQ,OAAO,EAAE,CAAC,gBAAgB;AAAA,IACzE,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,EAC9C,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,oCAAoC,IAAI,MAAM,GAAG;AAC9E,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO;AAAA,IACL,aAAa,OAAO,KAAK,eAAe,EAAE;AAAA,IAC1C,OAAO,KAAK,SAAS;AAAA,IACrB,OAAO,KAAK,UAAU;AAAA,IACtB,SAAS,KAAK,YAAY;AAAA,IAC1B,QAAQ,MAAM,QAAQ,KAAK,MAAM,IAAI,KAAK,OAAO,IAAI,MAAM,IAAI,CAAC;AAAA,EAClE;AACF;AAGA,SAAS,eAAe,UAA4B;AAClD,MAAI,SAAS,QAAS,QAAO;AAC7B,SAAO,SAAS,OAAO,SAAS,0BAA0B;AAC5D;AAGA,eAAsB,cAAc,QAAoB,OAAmB,CAAC,GAAkB;AAC5F;AAAA,IACE;AAAA,IACA,CAAC,UAAU,WAAW,YAAY,SAAS,SAAS,MAAM;AAAA,IAC1D;AAAA,EACF;AACA,QAAM,MAAM,KAAK,UAAU;AAC3B,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,EAAE,IAAI,IAAI,MAAM,uBAAuB,QAAQ;AAAA,IACnD,oBAAoB;AAAA,EACtB,CAAC;AACD,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,MACE,YAAY,IAAI;AAAA,MAChB,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA;AAAA,MAErC,MAAM;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW,MAAM,cAAc,IAAI,aAAa,OAAO,OAAO;AAEpE,MAAI,OAAO,QAAQ,SAAS,MAAM;AAChC,QAAI,IAAI,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AACzC;AAAA,EACF;AACA,MAAI,IAAI,eAAe,IAAI,WAAW,EAAE;AACxC,MAAI,IAAI,eAAe,SAAS,WAAW,EAAE;AAC7C,MAAI,IAAI,eAAe,SAAS,SAAS,QAAQ,EAAE;AACnD,MAAI,IAAI,eAAe,eAAe,QAAQ,CAAC,EAAE;AACjD,MAAI,IAAI,eAAe,SAAS,QAAQ,QAAQ,IAAI,EAAE;AACtD,MAAI,SAAS,OAAO,OAAQ,KAAI,IAAI,eAAe,SAAS,OAAO,KAAK,IAAI,CAAC,EAAE;AAC/E,MAAI,CAAC,SAAS,OAAO;AAGnB,QAAI,IAAI,wEAAwE;AAChF,QAAI,IAAI,gFAA2E;AAAA,EACrF;AACF;;;AC1DA,IAAMK,WAAU;AAAA,EACd;AAAA,EAAU;AAAA,EAAS;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AAAA,EAAS;AAAA,EAC3D;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAW;AAAA,EAAK;AAAA,EAAc;AAAA,EAAW;AAAA,EACjE;AAAA,EAAQ;AAAA,EAAY;AAAA,EAAY;AAClC;AAWA,SAAS,YAAY,MAA0B,QAAwB;AACrE,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,YAAY,MAAM,yCAAyC,MAAM,WAAW;AACvG,SAAO;AACT;AAIA,IAAM,SAAS,oBAAI,IAAI,CAAC,OAAO,QAAQ,WAAW,WAAW,cAAc,UAAU,MAAM,QAAQ,CAAC;AAEpG,eAAeC,cAAa,QAAoB,MAAmB,QAAyC;AAC1G,QAAM,cAAc,UAAU,OAAO,QAAQ,GAAG;AAChD,QAAM,UAAU,MAAM,uBAAuB,QAAQ;AAAA,IACnD,oBAAoB;AAAA,EACtB,CAAC;AACD,QAAM,EAAE,IAAI,IAAI;AAChB,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,MAAM,KAAK,UAAU;AAG3B,QAAM,QACJ,gBACC,QAAQ,IAAI,WAAW,iBAAiB,QAAQ,IAAI,WAAW,YAC5D,QAAQ,IAAI,QACZ,SACJ;AAQF,QAAM,SAAS,OAAO,QAAQ,SAAS,MAAM;AAI7C,MAAI,WAAW,YAAY,QAAQ;AACjC,WAAO;AAAA,MACL,aAAa,IAAI;AAAA,MACjB,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA,MAAM,OAAO,QAAQ,SAAS;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AACA,QAAM,kBACJ,OAAO,IAAI,MAAM,KAAK,CAAC,UAAU,UAAU,kBAAkB,CAAC,UAAU,OAAO,QAAQ,KAAK;AAC9F,QAAM,QAAQ,kBACV,MAAM,uBAAuB;AAAA,IAC3B,UAAU,IAAI;AAAA,IACd,OAAO;AAAA,IACP,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,IACrC,OAAO,qBAAqB,MAAM;AAAA,IAClC,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,iBAAiB,KAAK;AAAA;AAAA;AAAA,IAGtB,SAAS,IAAI;AAAA,IACb,WAAW,QAAQ,YAAY;AAAA,EACjC,CAAC,IACD,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,YAAY,IAAI;AAAA,MAChB,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,MAKrC,MAAM;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACJ,SAAO;AAAA,IACL,aAAa,IAAI;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ,SAAS;AAAA;AAAA,IAE9B;AAAA,IACA,UAAU,MAAM,cAAc,IAAI,aAAa,OAAO,OAAO;AAAA,EAC/D;AACF;AAGA,eAAsB,eAAe,QAAoB,OAAoB,CAAC,GAAkB;AAC9F,QAAM,SAAS,OAAO,YAAY,CAAC,KAAK;AAKxC,aAAW,QAAQD,UAAS,WAAW,SAAS,WAAW,WAAW,KAAK,CAAC;AAC5E,QAAM,MAAM,MAAMC,cAAa,QAAQ,MAAM,MAAM;AACnD,QAAM,OAAO,OAAO,YAAY,CAAC;AAEjC,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,YAAY,KAAK,OAAO,QAAQ,QAAQ,MAAM,UAAU,OAAO,QAAQ,CAAC,CAAC;AAAA,IAClF,KAAK,OAAO;AACV,YAAM,WAAW,OAAO,YAAY,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,UAAU,OAAO,QAAQ,CAAC;AACpF,UAAI,CAAC,SAAU,OAAM,IAAI,MAAM,0FAA0F;AACzH,aAAO,WAAW,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI;AAAA,IAC9D;AAAA,IACA,KAAK;AACH,aAAO,YAAY,KAAK,OAAO,QAAQ,QAAQ,IAAI;AAAA,IACrD,KAAK;AACH,aAAO;AAAA,QACL;AAAA,QACA;AAAA,UACE,MAAM,UAAU,OAAO,QAAQ,IAAI,KAAK;AAAA,UACxC,KAAK,OAAO,QAAQ,QAAQ;AAAA,UAC5B,OAAO,UAAU,OAAO,QAAQ,OAAO,SAAS;AAAA,QAClD;AAAA,QACA,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,MAC3C;AAAA,IACF,KAAK,UAAU;AACb,YAAM,QAAQ,OAAO,YAAY,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,UAAU,OAAO,QAAQ,CAAC;AACjF,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,0FAA0F;AACtH,aAAO,cAAc,KAAK,OAAO,OAAO,QAAQ,QAAQ,MAAM,UAAU,OAAO,QAAQ,OAAO,SAAS,CAAC;AAAA,IAC1G;AAAA,IACA,KAAK,WAAW;AACd,YAAM,OAAO,YAAY,MAAM,SAAS;AACxC,YAAM,OAAO,UAAU,OAAO,QAAQ,IAAI,KAAK,SAAS,UAAU,OAAO,QAAQ,IAAI,GAAG,MAAS;AACjG,aAAO,eAAe,KAAK,MAAM,IAAI;AAAA,IACvC;AAAA,IACA,KAAK;AAAA,IACL,KAAK;AACH,aAAO,WAAW,KAAK,YAAY,MAAM,KAAK,CAAC;AAAA,IACjD,KAAK,OAAO;AACV,YAAM,OAAO,YAAY,MAAM,KAAK;AACpC,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,UAAU,OAAO,QAAQ,KAAK,KAAK;AAAA,QACnC,SAAS,UAAU,OAAO,QAAQ,IAAI,GAAG,UAAU,OAAO,QAAQ,IAAI,CAAC;AAAA,QACvE,UAAU,OAAO,QAAQ,OAAO;AAAA,QAChC,UAAU,OAAO,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF;AAAA,IACA,KAAK,QAAQ;AACX,YAAM,OAAO,YAAY,MAAM,MAAM;AACrC,YAAM,OAAO,UAAU,OAAO,QAAQ,IAAI;AAC1C,YAAM,SAAS,UAAU,OAAO,QAAQ,IAAI;AAI5C,YAAM,OACJ,SAAS,UAAa,WAAW,SAC7B,MAAM,YAAY,KAAK,IAAI,IAC3B,SAAS,MAAM,MAAM;AAC3B,UAAI,SAAS,KAAM,QAAO,IAAI,IAAI,IAAI,GAAG,IAAI,6BAA6B;AAC1E,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,UAAU,OAAO,QAAQ,IAAI;AAAA,QAC7B,OAAO,QAAQ,aAAa,SAAY,SAAa,UAAU,OAAO,QAAQ,QAAQ,KAAK;AAAA,MAC7F;AAAA,IACF;AAAA,IACA,KAAK,UAAU;AACb,YAAM,MAAM,OAAO,YAAY,CAAC;AAChC,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,8EAA8E;AACxG,aAAO,cAAc,KAAK,KAAK;AAAA,QAC7B,YAAY,UAAU,OAAO,QAAQ,UAAU;AAAA,QAC/C,QAAQ,OAAO,QAAQ,SAAS,MAAM;AAAA,MACxC,CAAC;AAAA,IACH;AAAA,IACA,KAAK,cAAc;AACjB,YAAM,QAAQ,OAAO,YAAY,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU;AAC1E,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,uFAAuF;AACnH,aAAO,kBAAkB,KAAK,YAAY,MAAM,YAAY,GAAG,KAAK;AAAA,IACtE;AAAA,IACA,KAAK;AACH,aAAO,cAAc,KAAK,YAAY,MAAM,SAAS,GAAG,WAAW;AAAA,IACrE,KAAK;AACH,aAAO,cAAc,KAAK,YAAY,MAAM,SAAS,GAAG,UAAU;AAAA,IACpE,KAAK;AACH,aAAO,eAAe,KAAK,YAAY,MAAM,SAAS,CAAC;AAAA,IACzD,KAAK,UAAU;AACb,YAAM,UAAU,UAAU,OAAO,QAAQ,SAAS,WAAW;AAC7D,UAAI,YAAY,OAAW,OAAM,IAAI,MAAM,8DAA8D;AACzG,aAAO,cAAc,KAAK,YAAY,MAAM,QAAQ,GAAG,OAAO;AAAA,IAChE;AAAA,IACA,KAAK;AACH,aAAO,cAAc,KAAK,YAAY,MAAM,IAAI,CAAC;AAAA,IACnD;AAGE,YAAM,IAAI,MAAM,2BAA2B,MAAM,UAAU,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG;AAAA,EACvG;AACF;;;ACrPA,SAAS,uBAAuB;AAgBhC,eAAsB,sBACpB,QACA,cACgC;AAChC,QAAM,aAAa,UAAU,OAAO,QAAQ,MAAM,KAAK;AACvD,QAAM,MAAM,MAAM,kBAAkB,UAAU;AAC9C,QAAM,MAAM,UAAU,OAAO,QAAQ,GAAG,MAAM,IAAI,KAAK,SAAS,KAAK,IAAI,QAAQ,IAAI,KAAK,CAAC;AAC3F,MAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,GAAG,GAAG;AACnC,UAAM,IAAI,MAAM,QAAQ,OAAO,EAAE,wBAAwB,UAAU,EAAE;AAAA,EACvE;AACA,QAAM,WAAW,iBAAiB,UAAU,OAAO,QAAQ,QAAQ,KAAK,IAAI,WAAW;AACvF,MAAI,iBAAiB,IAAI,WAAW,MAAM,UAAU;AAClD,UAAM,IAAI,MAAM,wHAAwH;AAAA,EAC1I;AACA,QAAM,UAAU,aAAa,SAAS;AACtC,QAAM,SAAS,aAAa,UAAU;AACtC,QAAM,OAAO,OAAO,QAAQ,SAAS,QACjC,QACA,OAAO,QAAQ,SAAS,OAAO,OAAO;AAC1C,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA,EAAE,YAAY,OAAO,UAAU,OAAO,QAAQ,KAAK,GAAG,MAAM,iBAAiB,aAAa,QAAQ;AAAA,IAClG;AAAA,IACA;AAAA,EACF;AACA,SAAO,EAAE,UAAU,OAAO,OAAO,IAAI,IAAI,IAAI,KAAK,OAAO,SAAS,OAAO;AAC3E;AAEA,eAAsB,wBACpBC,UACA,cACkB;AAClB,MAAI,aAAa,QAAS,QAAO,aAAa,QAAQA,QAAO;AAC7D,MAAI,CAAC,QAAQ,MAAM,SAAS,CAAC,QAAQ,OAAO,MAAO,QAAO;AAC1D,QAAM,SAAS,gBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC/E,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,SAAS,GAAGA,QAAO,SAAS;AACxD,WAAO,cAAc,KAAK,OAAO,KAAK,CAAC;AAAA,EACzC,UAAE;AACA,WAAO,MAAM;AAAA,EACf;AACF;AAEO,SAAS,2BACd,QACA,OACA,OACQ;AACR,QAAM,QAAQ,OAAO,YAAY,KAAK;AACtC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,GAAG,KAAK,cAAc;AAClD,SAAO;AACT;AAEO,SAAS,gBACd,OACmC;AACnC,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,UAAU,UAAU,UAAU,oBAAoB,UAAU,UAAW,QAAO;AAClF,QAAM,IAAI,MAAM,oDAAoD;AACtE;;;AClEO,SAAS,wBACd,KACA,MACA,OACM;AACN,MAAI,IAAI,4BAA4B,KAAK,IAAI,KAAK,GAAG,KAAK,KAAK,QAAQ,UAAU,WAAW,EAAE;AAC9F,MAAI,IAAI,kBAAkB,KAAK,UAAU,EAAE;AAC3C,MAAI,IAAI,+BAA+B,KAAK,eAAe,SAAM,KAAK,gBAAgB,SAAM,KAAK,iBAAiB,EAAE;AACpH,MAAI,IAAI,oBAAoB,KAAK,YAAY,EAAE;AAC/C,+BAA6B,KAAK,aAAa,KAAK,OAAO,SAAS;AACpE,+BAA6B,KAAK,cAAc,KAAK,OAAO,UAAU;AACtE,MAAI,IAAI,6BAA6B,KAAK,cAAc,QAAQ,IAAI,EAAE;AACtE,MAAI,IAAI,qIAAqI;AAC7I,MAAI,IAAI,kFAAkF,KAAK,mBAAmB,8BAA8B;AAChJ,MAAI,IAAI,8BAA8B;AACtC,MAAI,IAAI,8EAA8E,KAAK,UAAU,wBAAwB;AAC/H;AAEO,SAAS,0BACd,KACA,QACM;AACN,MAAI,IAAI,wCAAwC,OAAO,KAAK,IAAI,OAAO,GAAG,GAAG;AAC7E,MAAI,IAAI,uBAAuB,OAAO,eAAe,EAAE;AACvD,MAAI,IAAI,eAAe,OAAO,iBAAiB,EAAE;AACjD,MAAI,IAAI,aAAa,OAAO,UAAU,KAAK,OAAO,QAAQ,GAAG;AAC7D,MAAI,IAAI,UAAU,OAAO,gBAAgB,mBAAmB,OAAO,aAAa,GAAG,EAAE;AACrF,MAAI,IAAI,cAAc,OAAO,OAAO,EAAE;AACtC,MAAI,IAAI,iBAAiB,OAAO,gBAAgB,cAAW,OAAO,UAAU,EAAE;AAChF;AAEO,SAAS,8BAA8B,MAAgC;AAC5E,QAAM,UAAoB,CAAC;AAC3B,aAAW,CAAC,OAAOC,MAAK,KAAK,OAAO,QAAQ,KAAK,MAAM,GAAG;AACxD,QAAI,CAACA,OAAM,QAAS,SAAQ,KAAK,GAAG,KAAK,cAAc;AACvD,QAAI,CAACA,OAAM,gBAAiB,SAAQ,KAAK,GAAG,KAAK,qCAAqC;AAAA,EACxF;AACA,MAAI,CAAC,KAAK,YAAa,SAAQ,KAAK,uDAAuD;AAC3F,MAAI,KAAK,SAAS,QAAQ,WAAW,EAAG;AACxC,MAAI,CAAC,KAAK,SAAS,QAAQ,WAAW,EAAG,SAAQ,KAAK,0CAA0C;AAChG,QAAM,IAAI,MAAM,+BAA+B,QAAQ,SAAS,KAAK,QAAQ,KAAK,IAAI,CAAC,KAAK,EAAE,2EAA2E;AAC3K;AAEO,SAAS,eACd,KACA,KACA,UACA,OACM;AACN,MAAI,IAAI,gBAAgB,IAAI,KAAK,KAAK,IAAI,MAAM,EAAE;AAClD,MAAI,IAAI,aAAa,IAAI,UAAU,IAAI,IAAI,gBAAgB,SAAS,OAAO,IAAI,aAAa,WAAW,EAAE;AACzG,MAAI,IAAI,QAAQ;AACd,QAAI,IAAI,gBAAgB,WAAW,IAAI,OAAO,SAAS,CAAC,EAAE;AAC1D,QAAI,IAAI,iBAAiB,WAAW,IAAI,OAAO,UAAU,CAAC,EAAE;AAAA,EAC9D,OAAO;AACL,QAAI,IAAI,qEAAqE;AAAA,EAC/E;AACA,MAAI,IAAI,iBAAiB,IAAI,gBAAgB,0CAAuC,IAAI,aAAa,OAAO;AAC5G,MAAI,IAAI,mBAAmB,IAAI,UAAU,mBAAgB,IAAI,eAAe,KAAK,IAAI,iBAAiB,GAAG;AACzG,MAAI,IAAI,kBAAkB,IAAI,SAAU,qBAAoB,KAAK,GAAG;AACpE,MAAI,IAAI,QAAQ;AACd,QAAI,IAAI,yBAAyB,IAAI,OAAO,SAAS,uBAAuB,IAAI,OAAO,iBAAiB,eAAe,IAAI,OAAO,UAAU,EAAE;AAAA,EAChJ;AACA,MAAI,IAAI,UAAW,KAAI,IAAI,cAAc,IAAI,SAAS,EAAE;AACxD,QAAM,MAAM,IAAI,IAAI,gBAAgB,mBAAmB,KAAK,CAAC,IAAI,mBAAmB,IAAI,GAAG,CAAC,aAAa,QAAQ;AACjH,MAAI,aAAa,IAAI,OAAO,IAAI,KAAK;AACrC,MAAI,IAAI,aAAa,IAAI,SAAS,CAAC,EAAE;AACvC;AAEO,SAAS,kBACd,KACAC,SACM;AACN,MAAI,IAAI,mBAAmBA,QAAO,KAAK,KAAKA,QAAO,UAAU,IAAIA,QAAO,QAAQ,EAAE;AAClF,MAAI,IAAI,eAAeA,QAAO,cAAc,UAAUA,QAAO,QAAQ,aAAa,YAAYA,QAAO,QAAQ,YAAY,YAAYA,QAAO,QAAQ,YAAY,gBAAgBA,QAAO,QAAQ,gBAAgB,qBAAqBA,QAAO,QAAQ,oBAAoB,EAAE;AACzQ,MAAI,IAAI,yBAAyBA,QAAO,QAAQ,SAAS,uBAAuBA,QAAO,QAAQ,iBAAiB,eAAeA,QAAO,QAAQ,UAAU,aAAaA,QAAO,QAAQ,QAAQ,EAAE;AAC9L,MAAI,IAAI,gBAAgBA,QAAO,WAAW,WAAW,YAAY,SAAS,IAAIA,QAAO,WAAW,WAAW,SAAS,SAAS,EAAE;AAC/H,MAAI,IAAI,iBAAiBA,QAAO,WAAW,YAAY,YAAY,SAAS,IAAIA,QAAO,WAAW,YAAY,SAAS,SAAS,gBAAgB,OAAOA,QAAO,WAAW,qBAAqB,CAAC,EAAE;AACjM,aAAW,WAAWA,QAAO,UAAU;AACrC,UAAM,WAAW,QAAQ,UAAU,CAAC;AACpC,QAAI,IAAI,MAAM,QAAQ,QAAQ,KAAK,QAAQ,KAAK,GAAG,WAAW,KAAK,SAAS,IAAI,IAAI,SAAS,IAAI,MAAM,EAAE,SAAM,QAAQ,WAAW,EAAE;AAAA,EACtI;AACA,aAAW,cAAcA,QAAO,YAAa,KAAI,IAAI,iBAAiB,UAAU,EAAE;AACpF;AAEO,SAAS,wBACdA,SACA,QACA,KACA,aACM;AACN,QAAM,SAAS,eAAe,UAAU,OAAO,QAAQ,SAAS,CAAC,KAAK,QAAQ,WAAW;AACzF,QAAM,iBAAiB,OAAO,QAAQ,oBAAoB;AAC1D,QAAM,mBAAmB,mBAAmB,QACxC,SACA,eAAe,UAAU,cAAc,KAAK,YAAY,sBAAsB;AAClF,QAAM,YAAY,CAAC,UAAgE,cACjF,kBAAkB,QAAQ,QAAQ,KAAK,kBAAkB,QAAQ,SAA4B;AAC/F,QAAM,YAAYA,QAAO,SAAS,OAAO,CAAC,YACxC,QAAQ,gBAAgB,eAAe,UAAU,QAAQ,UAAU,MAAM,CAAC;AAC5E,QAAM,QAAQ,mBACVA,QAAO,SAAS,OAAO,CAAC,YACtB,QAAQ,gBAAgB,eAAe,UAAU,QAAQ,UAAU,gBAAgB,CAAC,IACtF,CAAC;AAKL,QAAM,aAAaA,QAAO,mBAAmB,cACxC,OAAO,QAAQ,kBAAkB,MAAM;AAC5C,MAAI,UAAU,UAAU,MAAM,UAAU,YAAY;AAClD,UAAM,IAAI,MAAM,gCAAgC,UAAU,MAAM,iBAAiB,MAAM,KAAK,MAAM,MAAM,aAAa,oBAAoB,UAAU,GAAG,aAAa,cAAcA,QAAO,cAAc,KAAK,EAAE,EAAE;AAAA,EACjN;AACA,MAAI,aAAa;AACf,QAAI,IAAI,wCAAwC,MAAM,gBAAgB,oBAAoB,UAAU,cAAcA,QAAO,cAAc,qDAAqD;AAAA,EAC9L;AACF;AAEA,SAAS,6BACP,KACA,OACAD,QACM;AACN,QAAM,YAAYA,OAAM,WAAWA,OAAM,kBAAkB,UAAU;AAAA,IACnEA,OAAM,UAAU,SAAY;AAAA,IAC5BA,OAAM,kBAAkB,SAAY;AAAA,EACtC,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAC3B,MAAI,IAAI,KAAK,KAAK,KAAKA,OAAM,QAAQ,IAAIA,OAAM,KAAK,iBAAcA,OAAM,aAAa,SAAM,SAAS,EAAE;AACtG,MAAI,IAAI,eAAeA,OAAM,cAAc,mBAAgBA,OAAM,aAAa,0BAAuBA,OAAM,eAAe,qBAAqB;AACjJ;AAEA,SAAS,oBAAoB,KAAkC,KAA8B;AAC3F,QAAM,WAAW,IAAI;AACrB,MAAI,IAAI,eAAe,IAAI,kBAAkB,SAAS,GAAG,UAAU,kBAAkB,SAAY,IAAI,SAAS,aAAa,IAAI,SAAS,cAAc,GAAG,KAAK,EAAE,GAAG,UAAU,eAAe,YAAY,SAAS,YAAY,KAAK,EAAE,GAAG,UAAU,eAAe,YAAY,SAAS,YAAY,KAAK,EAAE,GAAG,UAAU,mBAAmB,gBAAgB,SAAS,gBAAgB,KAAK,EAAE,GAAG,UAAU,uBAAuB,qBAAqB,SAAS,oBAAoB,KAAK,EAAE,EAAE;AACzd;AAEA,SAAS,WAAWA,QAAoC;AACtD,SAAO,GAAGA,OAAM,QAAQ,IAAIA,OAAM,KAAK,GAAGA,OAAM,gBAAgB,YAAYA,OAAM,aAAa,KAAK,EAAE;AACxG;AAEA,IAAM,oBAAoB,CAAC,iBAAiB,OAAO,UAAU,QAAQ,UAAU;AAE/E,SAAS,eAAe,OAAe,MAAgD;AACrF,MAAI,kBAAkB,SAAS,KAAyC,GAAG;AACzE,WAAO;AAAA,EACT;AACA,QAAM,IAAI,MAAM,GAAG,IAAI,wDAAwD;AACjF;;;AC5JA,SAAS,yBAAwC;AA8BjD,eAAsB,yBACpB,QACA,cACA,UACe;AACf,aAAW,QAAQ;AAAA,IACjB;AAAA,IAAU;AAAA,IAAO;AAAA,IAAW;AAAA,IAAY;AAAA,IAAU;AAAA,IAAO;AAAA,IAAU;AAAA,IAAS;AAAA,IAAQ;AAAA,IACpF;AAAA,IAAuB;AAAA,IAAe;AAAA,IAAW;AAAA,IAAsB;AAAA,EACzE,GAAG,CAAC;AACJ,QAAM,SAAS,OAAO,QAAQ,WAAW;AACzC,MAAI,CAAC,WAAW,OAAO,QAAQ,SAAS,MAAM,UACzC,OAAO,QAAQ,oBAAoB,MAAM,UACzC,OAAO,QAAQ,kBAAkB,MAAM,SAAY;AACtD,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,qBAAqB,eAAe,OAAO,QAAQ,aAAa,GAAG,eAAe;AACxF,QAAM,UAAU,MAAM,sBAAsB,QAAQ,YAAY;AAChE,QAAM,OAAO,MAAM,sBAAsB,OAAO;AAChD,MAAI,OAAO,QAAQ,SAAS,KAAM,yBAAwB,QAAQ,QAAQ,MAAM,QAAQ,KAAK;AAC7F,gCAA8B,IAAI;AAClC,MAAI,uBAAuB,KAAK,YAAY;AAC1C,UAAM,IAAI,MAAM,kEAAkE,KAAK,UAAU,yDAAyD;AAAA,EAC5J;AACA,QAAM,eAAe,UAAU,OAAO,QAAQ,GAAG;AACjD,QAAM,mBAAmB,gBAAgB,UAAU,OAAO,QAAQ,OAAO,CAAC;AAC1E,QAAM,UAAU,MAAM,wBAAwB;AAAA,IAC5C,GAAG;AAAA,IACH;AAAA,IACA,KAAK;AAAA,IACL,SAAS;AAAA,EACX,CAAC;AACD,MAAI,OAAO,QAAQ,SAAS,KAAM,2BAA0B,QAAQ,QAAQ,QAAQ,MAAM;AAC1F,MAAI,QAAQ,KAAK,eAAe,KAAK,cAAc,QAAQ,OAAO,eAAe,KAAK,YAAY;AAChG,UAAM,IAAI,MAAM,4DAA4D,QAAQ,KAAK,UAAU,8DAA8D;AAAA,EACnK;AACA,QAAM,MAAM,MAAM,uBAAuB;AAAA,IACvC,GAAG;AAAA,IACH;AAAA,IACA,KAAK;AAAA,IACL,SAAS;AAAA,IACT,iBAAiB,OAAO,WAAW;AAAA,IACnC,qBAAqB,OAAO,QAAQ,qBAAqB,MAAM,OAAO,aAAa;AAAA,IACnF,oBAAoB,KAAK;AAAA,IACzB,yBAAyB,QAAQ,OAAO;AAAA,IACxC,wBAAwB;AAAA,MACtB,WAAW,KAAK,OAAO,UAAU;AAAA,MACjC,YAAY,KAAK,OAAO,WAAW;AAAA,IACrC;AAAA,EACF,CAAC;AACD,QAAM,SAAS,SACX,MAAM,wBAAwB;AAAA,IAC5B,GAAG;AAAA,IACH,OAAO,IAAI;AAAA,IACX,MAAM,aAAa;AAAA,IACnB,UAAU,OAAO,QAAQ,SAAS,OAC9B,SACA,CAAC,UAAU,eAAe,QAAQ,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;AAAA,EACtF,CAAC,IACD;AACJ,MAAI,CAAC,QAAQ;AACX,QAAI,OAAO,QAAQ,SAAS,MAAM;AAChC,cAAQ,OAAO,IAAI,KAAK,UAAU,EAAE,MAAM,QAAQ,QAAQ,QAAQ,KAAK,OAAO,GAAG,MAAM,CAAC,CAAC;AAAA,IAC3F,OAAO;AACL,qBAAe,QAAQ,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,KAAK;AAAA,IACxE;AACA;AAAA,EACF;AACA,MAAI,OAAO,WAAW,aAAa;AACjC,QAAI,OAAO,QAAQ,SAAS,MAAM;AAChC,cAAQ,OAAO,IAAI,KAAK,UAAU,EAAE,MAAM,QAAQ,QAAQ,QAAQ,KAAK,OAAO,GAAG,MAAM,CAAC,CAAC;AAAA,IAC3F;AACA,UAAM,IAAI,MAAM,uBAAuB,OAAO,KAAK,UAAU,OAAO,MAAM,GAAG,OAAO,YAAY,KAAK,OAAO,SAAS,KAAK,EAAE,EAAE;AAAA,EAChI;AACA,QAAME,UAAS,MAAM,wBAAwB,EAAE,GAAG,SAAS,OAAO,OAAO,MAAM,CAAC;AAChF,MAAI,OAAO,QAAQ,SAAS,MAAM;AAChC,YAAQ,OAAO,IAAI,KAAK,UAAU,EAAE,MAAM,QAAQ,QAAQ,QAAQ,KAAK,QAAQ,QAAAA,QAAO,GAAG,MAAM,CAAC,CAAC;AAAA,EACnG,OAAO;AACL,sBAAkB,QAAQ,QAAQA,OAAM;AAAA,EAC1C;AACA,0BAAwBA,SAAQ,QAAQ,QAAQ,QAAQ,OAAO,QAAQ,SAAS,IAAI;AACtF;AAEA,eAAsB,wBACpB,QACA,cACe;AACf,MAAI,OAAO,QAAQ,WAAW,MAAM;AAClC,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,aAAW,QAAQ;AAAA,IACjB;AAAA,IAAU;AAAA,IAAO;AAAA,IAAO;AAAA,IAAW;AAAA,IAAkB;AAAA,IAAU;AAAA,IAC/D;AAAA,IAAQ;AAAA,IAAuB;AAAA,IAAS;AAAA,IAAQ;AAAA,IAAW;AAAA,IAAsB;AAAA,EACnF,GAAG,CAAC;AACJ,QAAM,aAAa,UAAU,OAAO,QAAQ,MAAM,KAAK;AACvD,QAAM,YAAY,OAAO,QAAQ,SAAS;AAC1C,QAAM,OAAO,OAAO,QAAQ,SAAS,QACjC,QACA,OAAO,QAAQ,SAAS,OAAO,OAAO;AAC1C,QAAM,WAAW,UAAU,OAAO,QAAQ,QAAQ;AAClD,QAAM,UAAU,aAAa,SAAS;AACtC,QAAM,MAAM,aAAa,UAAU;AACnC,QAAM,SAAS,MAAM,kBAAkB;AAAA,IACrC;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,YAAY,CAAC;AAAA,IAC5B,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,IACjC,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,IACjC,SAAS,gBAAgB,UAAU,OAAO,QAAQ,OAAO,CAAC;AAAA,IAC1D,cAAc,UAAU,OAAO,QAAQ,gBAAgB,GAAG,kBAAkB;AAAA,IAC5E,OAAO,UAAU,OAAO,QAAQ,QAAQ,CAAC;AAAA,IACzC;AAAA,IACA,qBAAqB,OAAO,QAAQ,qBAAqB,MAAM,OAAO,aAAa;AAAA,IACnF,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,UAAU,OAAOC,aAAY;AAC3B,UAAIA,SAAQ,UAAU,0BAA0B;AAK9C,eAAO,uBAAuB;AAAA,UAC5B,UAAUA,SAAQ;AAAA,UAClB,OAAOA,SAAQ;AAAA,UACf,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,UACrC;AAAA,UACA,OAAO;AAAA,UACP,QAAQ;AAAA,UACR,iBAAiB,aAAa;AAAA,QAChC,CAAC;AAAA,MACH;AACA,YAAM,MAAM,MAAM,kBAAkB,UAAU;AAC9C,UAAI,iBAAiB,IAAI,WAAW,MAAM,iBAAiBA,SAAQ,QAAQ,GAAG;AAC5E,cAAM,IAAI,MAAM,wHAAwH;AAAA,MAC1I;AACA,aAAO;AAAA,QACL;AAAA,QACA,EAAE,YAAY,OAAO,UAAU,OAAO,QAAQ,KAAK,GAAG,MAAM,iBAAiB,aAAa,QAAQ;AAAA,QAClG;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACD,mBAAiB,OAAO,QAAQ,MAAM;AACxC;AAEA,SAAS,iBACPD,SACA,QACM;AACN,QAAM,SAAS,YAAY,UAAU,OAAO,QAAQ,SAAS,CAAC,KAAK,QAAQ,WAAW;AACtF,QAAM,iBAAiB,OAAO,QAAQ,oBAAoB;AAC1D,QAAM,mBAAmB,mBAAmB,QACxC,SACA,YAAY,UAAU,cAAc,KAAK,YAAY,sBAAsB;AAC/E,QAAM,YAAY,kBAAkBA,SAAQ,MAAM;AAClD,QAAM,QAAQ,mBACV,kBAAkBA,SAAQ,kBAAkB,IAAI,EAC7C,OAAO,CAAC,YAAY,QAAQ,gBAAgB,WAAW,IAC1D,CAAC;AAML,QAAM,aAAaA,QAAO,mBAAmB,gBACxC,OAAO,QAAQ,kBAAkB,MAAM;AAC5C,MAAI,UAAU,UAAU,MAAM,UAAU,YAAY;AAClD,UAAM,IAAI,MAAM,gCAAgC,UAAU,MAAM,iBAAiB,MAAM,KAAK,MAAM,MAAM,aAAa,oBAAoB,UAAU,GAAG,aAAa,0BAA0B,EAAE,EAAE;AAAA,EACnM;AACF;AAEA,SAAS,YAAY,OAAe,MAAwB;AAC1D,MAAI,CAAC,iBAAiB,OAAO,UAAU,QAAQ,UAAU,EAAE,SAAS,KAAK,GAAG;AAC1E,WAAO;AAAA,EACT;AACA,QAAM,IAAI,MAAM,GAAG,IAAI,wDAAwD;AACjF;;;AC7KA,eAAsB,gBACpB,QACA,cACe;AACf,QAAM,MAAM,OAAO,YAAY,CAAC;AAChC,MAAI,QAAQ,UAAU;AACpB,UAAM,sBAAsB,QAAQ,YAAY;AAChD;AAAA,EACF;AACA,MAAI,QAAQ,QAAQ;AAClB,eAAW,QAAQ,CAAC,UAAU,OAAO,YAAY,SAAS,QAAQ,MAAM,GAAG,CAAC;AAC5E,UAAM,UAAU,MAAM,sBAAsB,QAAQ,YAAY;AAChE,UAAM,OAAO,MAAM,sBAAsB,OAAO;AAChD,QAAI,OAAO,QAAQ,SAAS,KAAM,SAAQ,OAAO,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAAA,QAC7E,yBAAwB,QAAQ,QAAQ,MAAM,QAAQ,KAAK;AAChE;AAAA,EACF;AACA,MAAI,QAAQ,WAAW;AACrB,UAAM,oBAAoB,QAAQ,YAAY;AAC9C;AAAA,EACF;AACA,MAAI,QAAQ,UAAU;AACpB,UAAM,eAAe,QAAQ,YAAY;AACzC;AAAA,EACF;AACA,MAAI,QAAQ,UAAU;AACpB,eAAW,QAAQ,CAAC,UAAU,OAAO,YAAY,SAAS,QAAQ,MAAM,GAAG,CAAC;AAC5E,UAAM,QAAQ,2BAA2B,QAAQ,GAAG,QAAQ;AAC5D,UAAM,UAAU,MAAM,sBAAsB,QAAQ,YAAY;AAChE,UAAME,UAAS,MAAM,wBAAwB,EAAE,GAAG,SAAS,MAAM,CAAC;AAClE,QAAI,OAAO,QAAQ,SAAS,KAAM,SAAQ,OAAO,IAAI,KAAK,UAAUA,SAAQ,MAAM,CAAC,CAAC;AAAA,QAC/E,mBAAkB,QAAQ,QAAQA,OAAM;AAC7C;AAAA,EACF;AACA,MAAI,QAAQ,OAAO;AACjB,UAAM,IAAI,MAAM,+FAA+F;AAAA,EACjH;AACA,QAAM,WAAW,UAAU,OAAO,QAAQ,MAAM;AAChD,MAAI,SAAU,OAAM,yBAAyB,QAAQ,cAAc,QAAQ;AAAA,MACtE,OAAM,wBAAwB,QAAQ,YAAY;AACzD;AAEA,eAAe,sBACb,QACA,cACe;AACf,QAAM,SAAS,OAAO,YAAY,CAAC;AACnC,MAAI,WAAW,cAAc;AAC3B,eAAW,QAAQ,CAAC,UAAU,OAAO,YAAY,UAAU,SAAS,QAAQ,KAAK,GAAG,CAAC;AACrF,UAAMC,WAAU,MAAM,sBAAsB,QAAQ,YAAY;AAChE,UAAM,WAAW,eAAe,OAAO,QAAQ,QAAQ,UAAU;AACjE,UAAM,YAAY,OAAO,QAAQ,QAAQ,QAAQ,MAAM;AAAA,MACrD,qCAAqC,QAAQ,SAASA,SAAQ,KAAK,IAAIA,SAAQ,GAAG;AAAA,MAClF;AAAA,IACF;AACA,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,MAAM,2EAA2E;AAAA,IAC7F;AACA,UAAM,+BAA+B,EAAE,GAAGA,UAAS,SAAS,CAAC;AAC7D,IAAAA,SAAQ,OAAO,IAAI,wBAAwB,QAAQ,SAASA,SAAQ,KAAK,IAAIA,SAAQ,GAAG,EAAE;AAC1F;AAAA,EACF;AACA,MAAI,WAAW,WAAW;AACxB,UAAM,IAAI,MAAM,yEAAyE;AAAA,EAC3F;AACA,aAAW,QAAQ,CAAC,UAAU,OAAO,YAAY,QAAQ,SAAS,MAAM,GAAG,CAAC;AAC5E,QAAM,UAAU,MAAM,sBAAsB,QAAQ,YAAY;AAGhE,QAAM,aAAa,UAAU,OAAO,QAAQ,IAAI,KAC3C,MAAM,sBAAsB,QAAQ,IAAI,GAAG,aAAa,aAAa,EAAE,MAAM,MAAM,MAAS;AACjG,QAAM,aAAa,MAAM,4BAA4B;AAAA,IACnD,GAAG;AAAA,IACH,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,IACjD,MAAM,OAAO,QAAQ,SAAS;AAAA,IAC9B,gBAAgB,aAAa,WAAW;AAAA,IACxC,MAAM,aAAa;AAAA,IACnB,QAAQ,QAAQ;AAAA,EAClB,CAAC;AACD,UAAQ,OAAO,IAAI,qBAAqB,WAAW,cAAc,cAAc,gBAAgB,KAAK,WAAW,YAAY,gBAAgB,GAAG;AAC9I,UAAQ,OAAO,IAAI,oFAAoF;AACzG;AAEA,eAAe,oBACb,QACA,cACe;AACf,aAAW,QAAQ,CAAC,UAAU,OAAO,YAAY,SAAS,QAAQ,MAAM,GAAG,CAAC;AAC5E,QAAM,UAAU,MAAM,sBAAsB,QAAQ,YAAY;AAChE,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,QAAQ,IAAI;AAAA,IACxC,sBAAsB,OAAO;AAAA,IAC7B,0BAA0B,OAAO;AAAA,EACnC,CAAC;AACD,MAAI,OAAO,QAAQ,SAAS,MAAM;AAChC,YAAQ,OAAO,IAAI,KAAK,UAAU,EAAE,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC;AAC7D;AAAA,EACF;AACA,0BAAwB,QAAQ,QAAQ,MAAM,QAAQ,KAAK;AAC3D,MAAI,CAAC,QAAQ,QAAQ;AACnB,YAAQ,OAAO,IAAI,4CAA4C,QAAQ,KAAK,IAAI,QAAQ,GAAG,GAAG;AAC9F;AAAA,EACF;AACA,UAAQ,OAAO,IAAI,+BAA+B,QAAQ,KAAK,IAAI,QAAQ,GAAG;AAAA,qCAA2C;AACzH,aAAW,UAAU,SAAS;AAC5B,YAAQ,OAAO,IAAI,GAAG,OAAO,QAAQ,IAAK,OAAO,UAAU,IAAK,OAAO,aAAa,IAAK,OAAO,MAAM,EAAE;AAAA,EAC1G;AACF;AAEA,eAAe,eACb,QACA,cACe;AACf,aAAW,QAAQ,CAAC,UAAU,OAAO,YAAY,SAAS,QAAQ,QAAQ,QAAQ,GAAG,CAAC;AACtF,QAAM,QAAQ,2BAA2B,QAAQ,GAAG,QAAQ;AAC5D,QAAM,UAAU,MAAM,sBAAsB,QAAQ,YAAY;AAChE,QAAM,MAAM,OAAO,QAAQ,WAAW,OAClC,MAAM,wBAAwB;AAAA,IAC5B,GAAG;AAAA,IACH;AAAA,IACA,MAAM,aAAa;AAAA,IACnB,UAAU,OAAO,QAAQ,SAAS,OAC9B,SACA,CAAC,UAAU,eAAe,QAAQ,QAAQ,OAAO,QAAQ,UAAU,QAAQ,KAAK;AAAA,EACtF,CAAC,IACD,MAAM,qBAAqB,EAAE,GAAG,SAAS,MAAM,CAAC;AACpD,MAAI,OAAO,QAAQ,SAAS,KAAM,SAAQ,OAAO,IAAI,KAAK,UAAU,KAAK,MAAM,CAAC,CAAC;AAAA,WACxE,OAAO,QAAQ,WAAW,MAAM;AACvC,mBAAe,QAAQ,QAAQ,KAAK,QAAQ,UAAU,QAAQ,KAAK;AAAA,EACrE;AACF;;;ACxIO,SAAS,YAAY,KAAsB;AAChD,QAAM,OAAQ,KAAmC;AACjD,MAAI,SAAS,uBAAuB,SAAS,gBAAiB,QAAO;AACrE,MAAI,SAAS,sBAAuB,QAAO;AAC3C,MAAI,SAAS,qBAAsB,QAAO;AAC1C,MAAI,SAAS,cAAe,QAAO;AACnC,MAAI,SAAS,iBAAkB,QAAO;AACtC,SAAO;AACT;AAiCA,eAAsB,OACpB,OAAO,QAAQ,KAAK,MAAM,CAAC,GAC3B,eAAgC,CAAC,GAClB;AACf,QAAM,UAA2B;AAAA,IAC/B,GAAG;AAAA,IACH,QAAQ,gBAAgB,aAAa,UAAU,OAAO;AAAA,EACxD;AACA,QAAM,SAAS,UAAU,IAAI;AAI7B,mBAAiB,MAAM;AACvB,QAAM,UAAU,OAAO,YAAY,CAAC,KAAK;AACzC,MAAI,YAAY,aAAa,YAAY,QAAQ,OAAO,QAAQ,YAAY,MAAM;AAChF,eAAW,QAAQ,CAAC,SAAS,GAAG,CAAC;AACjC,YAAQ,OAAQ,IAAI,WAAW,CAAC;AAChC;AAAA,EACF;AACA,MAAI,YAAY,UAAU,YAAY,YAAY,YAAY,MAAM;AAClE,eAAW,QAAQ,CAAC,MAAM,GAAG,CAAC;AAC9B,cAAU,QAAQ,MAAM;AACxB;AAAA,EACF;AACA,MAAI,YAAY,UAAU;AACxB,UAAM,cAAc,QAAQ,OAAO;AACnC;AAAA,EACF;AACA,MAAI,YAAY,WAAW;AACzB,UAAM,eAAe,QAAQ,OAAO;AACpC;AAAA,EACF;AACA,MAAI,YAAY,WAAW;AACzB,UAAM,eAAe,QAAQ,OAAO;AACpC;AAAA,EACF;AACA,MAAI,YAAY,YAAY;AAC1B,UAAM,gBAAgB,QAAQ,OAAO;AACrC;AAAA,EACF;AACA,MAAI,YAAY,QAAQ;AACtB,UAAM,YAAY,QAAQ,OAAO;AACjC;AAAA,EACF;AACA,MAAI,YAAY,SAAS;AACvB,UAAM,aAAa,QAAQ,OAAO;AAClC;AAAA,EACF;AACA,MAAI,YAAY,SAAS;AACvB,UAAM,aAAa,QAAQ,OAAO;AAClC;AAAA,EACF;AACA,MAAI,YAAY,OAAO;AACrB,UAAM,WAAW,QAAQ,OAAO;AAChC;AAAA,EACF;AACA,MAAI,YAAY,YAAY;AAC1B,UAAM,gBAAgB,QAAQ,OAAO;AACrC;AAAA,EACF;AACA,MAAI,YAAY,MAAM;AACpB,UAAM,UAAU,QAAQ,OAAO;AAC/B;AAAA,EACF;AACA,MAAI,YAAY,WAAW;AACzB,UAAM,eAAe,QAAQ,OAAO;AACpC;AAAA,EACF;AACA,MAAI,YAAY,QAAQ;AACtB,UAAM,YAAY,QAAQ,OAAO;AACjC;AAAA,EACF;AACA,MAAI,YAAY,aAAa;AAC3B,UAAM,iBAAiB,QAAQ,OAAO;AACtC;AAAA,EACF;AACA,MAAI,MAAM,eAAe,SAAS,QAAQ,OAAO,EAAG;AACpD,QAAM,IAAI,MAAM,oBAAoB,OAAO,wBAAwB;AACrE;AAEA,eAAe,iBACb,QACA,cACe;AACf,aAAW,QAAQ;AAAA,IACjB;AAAA,IAAU;AAAA,IAAW;AAAA,IAAe;AAAA,IAAqB;AAAA,IACzD;AAAA,IAAqB;AAAA,IAAkB;AAAA,IAAS;AAAA,IAAS;AAAA,IAAQ;AAAA,IAAQ;AAAA,EAC3E,GAAG,CAAC;AACJ,QAAMC,gBAAe,OAAO,QAAQ,gBAAgB;AACpD,QAAM,UAA4B;AAAA,IAChC,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,IAChD,QAAQ,OAAO,QAAQ,SAAS,MAAM;AAAA,IACtC,YAAY,OAAO,QAAQ,aAAa,MAAM;AAAA,IAC9C,iBAAiB,OAAO,QAAQ,mBAAmB,MAAM;AAAA,IACzD,aAAa,OAAO,QAAQ,cAAc,MAAM;AAAA,IAChD,kBAAkB,OAAO,QAAQ,mBAAmB,MAAM;AAAA,IAC1D,cAAc,OAAOA,kBAAiB,WAAWA,gBAAeA,kBAAiB;AAAA,IACjF,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,IACrC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,IACrC,MAAM,OAAO,QAAQ,SAAS,QAC1B,QACA,OAAO,QAAQ,SAAS,OAAO,OAAO;AAAA,IAC1C,MAAM,UAAU,OAAO,QAAQ,MAAM,QAAQ;AAAA,IAC7C,KAAK,OAAO,QAAQ,QAAQ;AAAA,IAC5B,OAAO,aAAa;AAAA,IACpB,iBAAiB,aAAa;AAAA,IAC9B,QAAQ,aAAa;AAAA,EACvB;AACA,QAAM,UAAU,OAAO;AACzB;AAEA,eAAe,gBAAgB,QAAsC,cAA8C;AACjH,QAAM,MAAM,OAAO,YAAY,CAAC;AAChC,MAAI,QAAQ,YAAY,QAAQ,eAAe,QAAQ,aAAa,QAAQ,cAAc;AACxF,UAAM,IAAI,MAAM,gCAAgC,OAAO,EAAE,6CAA6C;AAAA,EACxG;AACA,aAAW,QAAQ,CAAC,UAAU,OAAO,QAAQ,SAAS,SAAS,QAAQ,KAAK,GAAG,CAAC;AAChF,MAAI,QAAQ,YAAY,QAAQ,eAAe,OAAO,QAAQ,SAAS,OAAW,OAAM,IAAI,MAAM,uDAAuD;AACzJ,OAAK,QAAQ,YAAY,QAAQ,gBAAgB,OAAO,QAAQ,QAAQ,OAAW,OAAM,IAAI,MAAM,kCAAkC,GAAG,GAAG;AAC3I,QAAM,UAAU;AAAA,IACd,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,IAChD,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,IACjC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,IACrC,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,IACrC,MAAM,OAAO,QAAQ,SAAS,QAAQ,QAAQ,OAAO,QAAQ,SAAS,OAAO,OAAO;AAAA,IACpF,KAAK,OAAO,QAAQ,QAAQ;AAAA,IAC5B,MAAM,OAAO,QAAQ,SAAS;AAAA,IAC9B,OAAO,aAAa;AAAA,IACpB,QAAQ,aAAa;AAAA,IACrB,gBAAgB,aAAa;AAAA,EAC/B;AACA,MAAI,QAAQ,SAAU,OAAM,eAAe,OAAO;AAAA,WACzC,QAAQ,YAAa,OAAM,kBAAkB,OAAO;AAAA,WACpD,QAAQ,UAAW,OAAM,gBAAgB,OAAO;AAAA,MACpD,OAAM,mBAAmB,OAAO;AACvC;","names":["existsSync","join","process","requestToken","process","resolve","process","dirname","process","dirname","process","process","process","join","requestToken","existsSync","process","process","request","response","route","message","request","responseBody","apiError","isRecord","timestamp","message","process","res","body","responseBody","apiError","isRecord","policy","response","message","existsSync","readFileSync","dirname","isAbsolute","resolve","isRecord","resolve","existsSync","dirname","unique","isAbsolute","readFileSync","validId","isRecord","safeText","next","message","timestamp","response","message","resolve","wait","existsSync","readFileSync","join","resolve","spawn","existsSync","readFileSync","join","resolve","existsSync","join","readFileSync","isRecord","existsSync","mkdirSync","writeFileSync","dirname","resolve","resolve","existsSync","mkdirSync","dirname","writeFileSync","PROD_ENV_NAMES","existsSync","mkdirSync","readFileSync","writeFileSync","dirname","isAbsolute","join","relative","resolve","resolve","content","targetDir","join","readFileSync","dirname","existsSync","mkdirSync","writeFileSync","relative","isAbsolute","safeText","response","message","resolve","route","wait","state","spawn","join","fileURLToPath","spawn","fileURLToPath","join","existsSync","resolve","record","message","call","execFile","spawn","join","mkdtemp","rm","writeFile","tmpdir","resolve","sep","isAbsolute","copyFile","mkdir","realpath","relative","validate","access","message","response","content","record","metadata","maxBytes","createHash","readFile","readdir","relative","resolve","record","unique","metadata","recipe","recipe","SHA","DIGEST","ID","state","exact","invalid","patch","message","SHA","SHA","spawn","lstat","resolve","sep","getgid","getuid","createHash","randomUUID","join","mkdir","mkdtemp","rm","writeFile","tmpdir","dirname","join","resolve","sep","readFile","readdir","stat","relative","emit","ref","constants","invalid","createHash","readdir","resolve","relative","content","readFile","message","request","call","response","record","value","source","patch","sep","lstat","spawn","recipe","getuid","getgid","spawn","SHA","DIGEST","ID","validate","clean","randomUUID","join","lstat","createHash","patch","RESERVED","SECRET","tmpdir","mkdtemp","mkdir","resolve","sep","dirname","writeFile","rm","request","stat","readFile","content","readdir","relative","record","metadata","descriptor","state","response","readFileSync","execFile","createHash","SOURCE_LIMITS","descriptor","execFile","createHash","resolve","existsSync","recipe","descriptor","response","message","record","tenantIdFor","putSecret","process","postJson","isRecord","tenantIdFor","tenantIdFor","safeText","tenantIdFor","tenantIdFor","safeText","postJson","publishableKey","tenantIdFor","message","postJson","process","putSecret","words","isAbsolute","relative","resolve","sep","resolve","relative","sep","isAbsolute","report","request","response","message","wait","allowedOptions","existsSync","join","resolve","process","existsSync","readFileSync","homedir","dirname","join","resolve","process","resolve","process","join","homedir","dirname","existsSync","readFileSync","environment","DEFAULT_PLATFORM","resolve","existsSync","clean","process","join","tenantIdFor","credential","res","body","result","state","readFileSync","readFileSync","owners","route","res","process","clean","process","context","result","message","numberOpt","resolve","report","wait","writeMutationId","emit","record","patch","requireId","buildContext","record","numeric","read","record","numeric","read","read","response","process","process","readFileSync","message","readFileSync","readFileSync","readdirSync","basename","join","readdirSync","basename","readFileSync","join","execFileSync","existsSync","readFileSync","join","SOURCE","execFileSync","read","join","existsSync","readFileSync","report","words","readFileSync","rmSync","writeFileSync","tmpdir","join","process","ALLOWED","buildContext","message","route","report","report","request","report","context","writeDevVars"]}