@open-everywhere/core 0.1.0

package/dist/agent/spend/checkpoint.js

@@ -0,0 +1,559 @@
+// SESSION COST CHECKPOINT (OPE-62) — a SOFT cost control, deliberately distinct from the
+// HARD monthly cap in spend/spend.ts (checkCap/scopeOverBudget).
+//
+//   HARD cap  (spend.ts): a per-scope monthly budget. When a scope is over budget the NEXT
+//              unit of work is DECLINED outright — no reply, no reads (Slack inbound drops
+//              the mention, the routine dispatcher skips the fire). Pre-flight, per unit of
+//              work, on EVERY surface — DMs included since OPE-267, where an org admin's own
+//              turn is the one thing that still gets through (spend/bypass.ts, attended
+//              ingress only, audited).
+//   SOFT gate (this file): a per-SESSION cost circuit-breaker. When a long/expensive session
+//              crosses a configured threshold (tokens / model-calls / est-$) it PAUSES only
+//              CONSEQUENTIAL actions and asks a human "keep going?". Reads and replies are
+//              NEVER blocked — the agent stays conversational while its effectful hands are
+//              held until someone confirms. Uncapped by default (no behaviour change unless
+//              an operator configures a threshold).
+//
+// ── THE SPIKE (the issue's open question: where can OE actually PAUSE and ask?) ─────────────
+// Verdict: the ONLY place OE can pause a live session and redirect the model mid-turn is a
+// TOOL-EXECUTE boundary that throws a RECOVERABLE tool-error — the AI SDK feeds the error back
+// as a tool result and the model takes another step, which is the seam stall/guard.ts uses.
+// (An earlier draft cited the eve patch's `__oeForceContinue` as evidence here. That was wrong
+// twice: force-continue never pushed off a tool error — it appended a synthetic user message at
+// the turn-END decision — and it was gated on an env var set nowhere, so it never ran. It was
+// removed in OPE-172. The tool-error seam stands on stall/guard.ts, which is live and tested.)
+// Every other candidate was ruled OUT in code:
+//   • eve HOOKS (spend hook, hooks/spend.ts) are OBSERVE-ONLY — eve exposes no turn-abort API
+//     (stall/guard.ts header; verified in OPE-51). A hook can DETECT the crossing but cannot
+//     pause the loop. So the spend-hook plumbing that already accumulates tokens is not the seam.
+//   • The WAKE GATE (spend/check.ts scopeOverBudget) is PRE-FLIGHT per unit of work — it can't
+//     fire mid-session on a threshold crossing (a turn's cost isn't known before it runs).
+//   • The AI-SDK toolset patch (access/untrusted-projection.ts projectToolSet) sees every tool
+//     but its execute receives AI-SDK options, NOT OE's ToolContext — no session/partition/
+//     binding to resolve cost or post a card. Out.
+//   • eve's ambient session context keys (SessionIdKey/ContinuationTokenKey) are NOT public
+//     exports; reaching them is exactly the eve-internals fragility OPE-71 hardened against.
+// So the gate is threaded EXPLICITLY through OE's ToolContext at the consequential tools'
+// execute(), via requireSessionContinuation() below — the same "recoverable throw redirects the
+// model" mechanism withStallGuard proves, applied as a shape-agnostic guard call at execute-top
+// (the 8 gate:member tools have three different export shapes — windowGated / defineTool /
+// defineDynamic — so a single wrapper can't wrap them uniformly; a guard call can).
+//
+// ── THE ASK (durable "keep going?") ─────────────────────────────────────────────────────────
+// A new `session.checkpoint` ActionKind (approvals/session-checkpoint.ts) on the EXISTING
+// approvals plane: a code-rendered card, a verified member click, approve → a session-continue
+// MEMO written; the model retries and sails through. The memo keys off the bare WINDOW token
+// (mirrors pr_session_approval / OPE-53), so a window rotation kills it naturally — the same
+// "memo dies with the session" property. requestApproval's frozen-args dedup posts the card ONCE
+// while it's awaiting; an "asked" marker memo prevents a re-post after a decline (deny keeps the
+// soft-block, no per-call card spam).
+//
+// ── THE UNATTENDED ASK (OPE-253) ────────────────────────────────────────────────────────────────
+// Everything above assumes somebody is in the room to answer. On a ROUTINE FIRE nobody is, by
+// construction — and a DURABLE JOB makes that permanent rather than momentary, because its fires
+// resume ONE eve session, so `sessionUsage` accumulates monotonically across every fire: once such a
+// session crosses a threshold it is crossed for good, and every later fire is blocked again.
+//
+// A routine fire's GRANT therefore carries no expiry and rebases the threshold on the moment of
+// approval (OPE-261, the block in evaluateCheckpoint below) — approving a job's checkpoint is a
+// decision, not a 24-hour reprieve. Its "asked" marker keeps the TTL: that is what lets a DECLINED
+// job be asked again rather than being paused for good with no way back.
+//
+// The stop is still the right DIRECTION; what was wrong is that it was invisible. So the block path
+// below records the stall on the routine's own row and writes a `routine.stalled` forensic row, and
+// routines/stall.ts retires the job after three blocked fires with a host-composed notice naming the
+// checkpoint as the cause. THIS FILE STILL POSTS THE CARD, unchanged: whether an unattended fire
+// should card at all is a doctrine question about the approvals plane, not a visibility fix.
+//
+// EXCLUSIONS (documented, not oversights):
+//   • gate:ADMIN tools (set_spend_limit, clear_spend_limit, revoke_connector, clear_connector_
+//     override) are NOT checkpoint-gated: an admin control action is exactly what would RAISE
+//     the limits / clear the very controls that unblock a session — soft-blocking it would
+//     dead-lock the operator out of their own escape hatch.
+//   • connector-op WRITES are eve-injected (no OE execute to guard) and ride their own per-op
+//     approval plane (access/consequence.ts classifyConnectorOp) — out of scope for v1, same
+//     honest bound as the connector caveat in consequence.ts.
+import { bindFrom, currentWindowToken } from "../identity/binding.js";
+import { principalIdOf } from "../access/request.js";
+import { domainKeyOf, resolvePartition } from "../memory/partition.js";
+import { bareTokenFromEveContext } from "../channels/window-key.js";
+import { getOperationalStore } from "../operational/provider.js";
+import { usageForSession } from "./usage-events.js";
+import { resolveAssumedModel, rowCostUsd } from "./reporting.js";
+import { getConfig } from "../access/config.js";
+import { domainNameForScope } from "./caps.js";
+import { auditToolAction } from "../audit/tool-action.js";
+import { requestApproval, postedToSurfaceKey, cardPostFailureReason } from "../approvals/flow.js";
+import { friendlyScopeLabel } from "../approvals/scope-label.js";
+import { approvalPostDeps, hasApprovalCardPath } from "../tools/set_spend_limit.js";
+import { routineMarker } from "../routines/routine.js";
+import { recordCheckpointStall } from "../routines/outcome-fold.js";
+// Side effect: register the `session.checkpoint` ActionKind so requestApproval below resolves it
+// and a click can execute it. Imported here — the module that PROPOSES the card — mirroring how
+// each propose path guarantees its own kind is registered.
+import "../approvals/session-checkpoint.js";
+import { CHECKPOINT_KIND, CHECKPOINT_GRANT_MEMO, CHECKPOINT_ASK_MEMO, DURABLE_GRANT_DISCLOSURE, checkpointTtlHours } from "../approvals/session-checkpoint.js";
+import { ROUTINE_PERMISSION_NO_EXPIRY } from "../routines/declared-permissions.js";
+/** Identity helper for readability + type inference, matching defineSpendBudgets. */
+export function defineSpendCheckpoints(checkpoints) {
+    return checkpoints;
+}
+const CHECKPOINT_FIELDS = ["sessionTokens", "sessionModelCalls", "sessionUsd"];
+function assertCheckpointShape(cp, where) {
+    for (const key of Object.keys(cp)) {
+        if (!CHECKPOINT_FIELDS.includes(key)) {
+            throw new Error(`spend checkpoint ${where} has unknown field "${key}" (valid: ${CHECKPOINT_FIELDS.join(", ")})`);
+        }
+    }
+    if (CHECKPOINT_FIELDS.every((f) => cp[f] == null)) {
+        throw new Error(`spend checkpoint ${where} sets no threshold at all — remove the entry or set at least one of ${CHECKPOINT_FIELDS.join(", ")}`);
+    }
+    for (const f of CHECKPOINT_FIELDS) {
+        const v = cp[f];
+        if (v == null)
+            continue;
+        if (typeof v !== "number" || !Number.isFinite(v) || v <= 0) {
+            throw new Error(`spend checkpoint ${where}.${f} must be a finite number > 0, got ${JSON.stringify(v)}`);
+        }
+        if ((f === "sessionTokens" || f === "sessionModelCalls") && !Number.isInteger(v)) {
+            throw new Error(`spend checkpoint ${where}.${f} must be an integer count, got ${v}`);
+        }
+    }
+}
+/**
+ * Validate the checkpoint registry at load (fail loud, same posture as assertSpendBudgetsValid):
+ * well-formed scope keys, no unknown fields, every amount positive+finite. An empty registry is
+ * valid — empty means uncapped (Open Everywhere never invents a threshold).
+ */
+export function assertSpendCheckpointsValid(checkpoints) {
+    if (checkpoints.default)
+        assertCheckpointShape(checkpoints.default, "default");
+    for (const [key, cp] of Object.entries(checkpoints.perWorkspace ?? {})) {
+        const parts = key.split("/");
+        if (parts.length !== 2 || parts.some((p) => !p)) {
+            throw new Error(`spend checkpoint perWorkspace key must be "platform/workspace", got ${JSON.stringify(key)}`);
+        }
+        assertCheckpointShape(cp, `perWorkspace["${key}"]`);
+    }
+    for (const [key, cp] of Object.entries(checkpoints.perDomain ?? {})) {
+        if (!key.trim()) {
+            throw new Error(`spend checkpoint perDomain key must be a non-empty domain name, got ${JSON.stringify(key)}`);
+        }
+        assertCheckpointShape(cp, `perDomain["${key}"]`);
+    }
+    for (const [key, cp] of Object.entries(checkpoints.perSurface ?? {})) {
+        const parts = key.split("/");
+        if (parts.length !== 3 || parts.some((p) => !p)) {
+            throw new Error(`spend checkpoint perSurface key must be "platform/workspace/surface", got ${JSON.stringify(key)}`);
+        }
+        assertCheckpointShape(cp, `perSurface["${key}"]`);
+    }
+}
+// --- resolver over the config-as-code registry (mirrors spend/caps.ts resolveCaps) ---------
+function loadCheckpoints() {
+    try {
+        return getConfig().loadSpendCheckpoints?.() ?? {};
+    }
+    catch {
+        return {}; // no app config registered (standalone ops tooling) → no checkpoints
+    }
+}
+/** Effective checkpoint for a scope: surface entry → domain entry → workspace entry → default.
+ *  Narrowest configured ENTRY wins wholesale; `{}` when nothing is configured (uncapped). */
+export function resolveCheckpoint(workspaceKey, surfaceKey, domainName) {
+    const cfg = loadCheckpoints();
+    return (cfg.perSurface?.[surfaceKey] ??
+        (domainName !== undefined ? cfg.perDomain?.[domainName] : undefined) ??
+        cfg.perWorkspace?.[workspaceKey] ??
+        cfg.default ??
+        {});
+}
+/** The reason clause of an ordinary crossing — the WHOLE session against the threshold. */
+const WHOLE_SESSION_SUBJECT = "this session reached its cost checkpoint";
+/** The reason clause of a REBASED crossing (OPE-261) — the spend since a member said "keep going",
+ *  against the SAME threshold. A member who approved once is being told what changed since, which
+ *  is the only question they can answer; "this session reached its checkpoint" would restate a
+ *  total they already approved. */
+const SINCE_APPROVAL_SUBJECT = "this session spent another checkpoint's worth since a member approved it";
+/** Has this session crossed any configured checkpoint component? Pure; the most-restrictive
+ *  (first-listed: tokens → model-calls → $) component that trips is returned with a reason.
+ *  An unconfigured or all-null checkpoint never crosses. `subject` names WHAT the numbers measure —
+ *  the whole session by default, or the spend since an approval on the rebased path. */
+export function checkCheckpoint(usage, cp, subject = WHOLE_SESSION_SUBJECT) {
+    if (cp.sessionTokens != null && usage.tokens >= cp.sessionTokens) {
+        return { crossed: true, reason: `${subject} (${usage.tokens.toLocaleString()} / ${cp.sessionTokens.toLocaleString()} tokens)` };
+    }
+    if (cp.sessionModelCalls != null && usage.modelCalls >= cp.sessionModelCalls) {
+        return { crossed: true, reason: `${subject} (${usage.modelCalls.toLocaleString()} / ${cp.sessionModelCalls.toLocaleString()} model calls)` };
+    }
+    if (cp.sessionUsd != null && (usage.usd ?? 0) >= cp.sessionUsd) {
+        return { crossed: true, reason: `${subject} (~$${(usage.usd ?? 0).toFixed(2)} of $${cp.sessionUsd.toFixed(2)})` };
+    }
+    return { crossed: false };
+}
+/** True iff a checkpoint has at least one component configured (a fast "should we even look?"). */
+export function checkpointConfigured(cp) {
+    return CHECKPOINT_FIELDS.some((f) => cp[f] != null);
+}
+// --- runtime cost read ---------------------------------------------------------------------
+/** Sum this session's non-sandbox usage-event rows into the checkpoint denominations. Priced
+ *  per-row (a session can carry several models) — the SAME estimate session_cost/spend_report
+ *  show, so the number the gate enforces matches the number an admin reads.
+ *
+ *  `sinceIso` REBASES the sum on an instant (OPE-261): rows stamped at or before it are skipped, so
+ *  the caller gets the spend that happened AFTER a member approved this session's checkpoint. The
+ *  default (absent) is the whole session, which is what every pre-OPE-261 caller asks for. */
+export async function sessionUsage(org, sessionId, sinceIso) {
+    const rows = await usageForSession(org, sessionId);
+    const assumed = resolveAssumedModel();
+    // Parsed ONCE, and compared as instants rather than as strings: `ts` may carry a different
+    // ISO-8601 precision from the memo's `createdAt`, and a lexical compare would then mis-order two
+    // instants that are seconds apart. An unparseable bound counts every row — the wide, safe answer.
+    const sinceMs = sinceIso !== undefined ? Date.parse(sinceIso) : Number.NaN;
+    const bounded = Number.isFinite(sinceMs);
+    let tokens = 0;
+    let modelCalls = 0;
+    let usd;
+    for (const r of rows) {
+        if (bounded) {
+            const at = Date.parse(r.ts);
+            // An unparseable row timestamp is COUNTED, never dropped: dropping it would under-report the
+            // spend a rebased checkpoint is meant to catch.
+            if (Number.isFinite(at) && at <= sinceMs)
+                continue;
+        }
+        // A zero-token sandbox line is runtime, not model spend — excluded from this
+        // per-SESSION soft checkpoint by design (its rowCostUsd is undefined anyway).
+        // Runtime $ is NOT invisible to controls: the hard monthly USD cap sees it via
+        // the spend ledger's usd_micros (OPE-266, sandbox/vercel-lifecycle.ts).
+        if (r.kind === "sandbox")
+            continue;
+        modelCalls++;
+        tokens += r.inputTokens + r.outputTokens;
+        // "one-call": `r` is a raw usage_events row — the `modelCalls++` above counts it as exactly one
+        // model call — so a long-context tier applies to its own prompt (OPE-2055). This number is what
+        // the checkpoint gate reads, so withholding the tier here would under-read a genuinely long
+        // session and let it run past the bound an admin set.
+        const cost = rowCostUsd(r, assumed, "one-call");
+        if (cost !== undefined)
+            usd = (usd ?? 0) + cost;
+    }
+    return { tokens, modelCalls, ...(usd !== undefined ? { usd } : {}) };
+}
+// --- the guard (the seam consequential tools call at execute-top) --------------------------
+/** The eve session id the usage-event rows are stamped with (hooks/spend.ts writes ctx.session.id)
+ *  — the key session cost rolls up under. */
+function sessionEventKey(ctx) {
+    const id = ctx.session?.id;
+    return id != null ? String(id) : undefined;
+}
+/** The bare session/window token this turn runs under — the key the continue/asked memos are
+ *  stored under (mirrors open_pull_request's proposingSessionId, OPE-53). Prefers the live
+ *  continuation token (namespace-stripped), falling back to the per-wake window-token stamp,
+ *  then the raw eve session id. */
+function windowMemoKey(ctx) {
+    const raw = ctx.channel?.continuationToken;
+    return bareTokenFromEveContext(raw) ?? currentWindowToken(ctx) ?? sessionEventKey(ctx);
+}
+/** The routine a fire belongs to, or undefined on a live human turn. `current ?? initiator` is the
+ *  SAME read complete_job / hooks/routine-outcome.ts / bindFrom's own authOf take — one spelling of
+ *  "whose bag is this turn running under", never a fourth. */
+function routineIdOf(ctx) {
+    const fireAuth = ctx.session?.auth;
+    return routineMarker(fireAuth?.current?.attributes ?? fireAuth?.initiator?.attributes)?.id;
+}
+async function evaluateCheckpoint(ctx) {
+    const p = resolvePartition(ctx);
+    const scopeKey = domainKeyOf(p); // spend grain — the key thresholds are declared on (Discord thread → parent)
+    const binding = bindFrom(ctx);
+    const domainName = domainNameForScope(scopeKey, binding.mode, binding.trust);
+    const cp = resolveCheckpoint(p.workspaceKey, scopeKey, domainName);
+    if (!checkpointConfigured(cp))
+        return { decision: "proceed" }; // uncapped — no-op (default)
+    const memoKey = windowMemoKey(ctx);
+    const eventKey = sessionEventKey(ctx);
+    if (!memoKey || !eventKey)
+        return { decision: "proceed" }; // no session identity — can't key a memo; fail-open
+    const routineId = routineIdOf(ctx);
+    const store = getOperationalStore();
+    const now = new Date().toISOString();
+    // An APPROVED continue grant lasts the session (dies on rotation with the memoKey).
+    const grant = await store.getSessionApproval(p.org, memoKey, CHECKPOINT_GRANT_MEMO, now).catch(() => null);
+    // ── APPROVAL IS A HIGH-WATER MARK ON A DURABLE SESSION (OPE-261) ─────────────────────────────
+    // A LIVE session's grant is unconditional, exactly as before: its memoKey is the window token, so
+    // the grant dies when the window rotates and "the rest of this session" is a bounded promise.
+    //
+    // A DURABLE JOB has no such bound. Its fires resume ONE eve session behind a pinned thread anchor,
+    // so the memoKey is byte-identical across fires and `sessionUsage` only ever accumulates. Under
+    // the old rule the grant's TTL was the only thing that ended it — which made approving a job's
+    // checkpoint a 24-HOUR REPRIEVE, not a decision: the memo expired, the job blocked again on a
+    // total that was now strictly higher, and it did that once a day forever. Nothing a member could
+    // click ever settled it.
+    //
+    // So a grant written for a durable session REBASES the threshold on the moment of approval: the
+    // spend BEFORE it is the approved mark, and the next card fires only when the spend SINCE it
+    // crosses a fresh increment of the same threshold. The control keeps its teeth (an unbounded run
+    // still cards, on its next increment) and the member's click now means something durable (no new
+    // spend ⇒ no new card, whatever the clock says).
+    //
+    // 🔴 THE BRANCH ASKS THE GRANT, NOT THE TURN, and that is load-bearing. A job pins a real thread
+    // as its anchor, and a HUMAN message in that same thread resolves the SAME continuation token —
+    // so that turn carries no routine marker while reading the job's own memo. Branching on the turn
+    // would hand such a session the unconditional path over a memo that now has no TTL, which is
+    // strictly more than the 24 hours it used to get: the very posture widening this ticket's
+    // "fragile point" warns about. The no-expiry sentinel is written by this feature and by nothing
+    // else, so it is an exact "this memo belongs to a durable session" test.
+    const durableGrant = grant?.expiresAt === ROUTINE_PERMISSION_NO_EXPIRY;
+    if (grant && !durableGrant)
+        return { decision: "proceed" };
+    const since = grant?.createdAt;
+    const usage = await sessionUsage(p.org, eventKey, since);
+    const verdict = checkCheckpoint(usage, cp, since !== undefined ? SINCE_APPROVAL_SUBJECT : WHOLE_SESSION_SUBJECT);
+    if (!verdict.crossed)
+        return { decision: "proceed" };
+    return {
+        decision: "block",
+        org: p.org,
+        surfaceKey: p.surfaceKey,
+        workspaceKey: p.workspaceKey,
+        domain: domainName ?? null,
+        memoKey,
+        usage,
+        checkpoint: cp,
+        reason: verdict.reason ?? WHOLE_SESSION_SUBJECT,
+        // DURABLE once durable: a re-card raised by a human turn on the job's own anchor must not write
+        // back a TTL'd grant, or the click that answers it quietly restores the daily re-block.
+        durable: routineId !== undefined || durableGrant,
+        ...(since !== undefined ? { approvedAt: since } : {}),
+    };
+}
+/**
+ * Live display lines for the card body (never persisted, don't affect dedup) — the cost so far vs.
+ * the configured components.
+ *
+ * COPY RULE (Tommy, 2026-09-08): a card is user-facing product copy, so it reads as plain sentences
+ * and shows the room's NAME (`scopeLabel`, resolved at propose time) rather than a raw scope key.
+ * The key is the fail-open fallback only, exactly as set_spend_limit.ts renders it.
+ *
+ * On a REBASED crossing (OPE-261) the numbers are the spend SINCE the approval, so the lines say
+ * that: telling a member who already approved "this session has used 500,000 tokens" restates a
+ * total they accepted, and hides the only new fact — what it spent since.
+ */
+export function checkpointCardLines(plan, scopeLabel) {
+    const cp = plan.checkpoint;
+    const rebased = plan.approvedAt !== undefined;
+    const spent = `${plan.usage.tokens.toLocaleString()} tokens, ${plan.usage.modelCalls.toLocaleString()} model calls${plan.usage.usd !== undefined ? `, about $${plan.usage.usd.toFixed(2)}` : ""}`;
+    const lines = [
+        rebased ? "Keep this session going past its cost checkpoint again?" : "Keep this session going past its cost checkpoint?",
+        `In ${scopeLabel ?? plan.surfaceKey}.`,
+        rebased ? `Since a member approved this, it has used ${spent}.` : `So far this session: ${spent}.`,
+    ];
+    const limits = [];
+    if (cp.sessionTokens != null)
+        limits.push(`${cp.sessionTokens.toLocaleString()} tokens`);
+    if (cp.sessionModelCalls != null)
+        limits.push(`${cp.sessionModelCalls.toLocaleString()} model calls`);
+    if (cp.sessionUsd != null)
+        limits.push(`$${cp.sessionUsd.toFixed(2)}`);
+    if (limits.length)
+        lines.push(rebased ? `The checkpoint is another ${limits.join(" or ")}.` : `The checkpoint is ${limits.join(" or ")}.`);
+    lines.push("Approve to let the agent do consequential work again — pull requests, memory writes and the like. Decline to keep that paused. Reading and replying carry on either way.");
+    // 🔴 THE DISCLOSURE IS GATED ON `durable`, NOT ON `rebased`. A durable session's FIRST crossing is
+    // rebased=false and durable=true, so gating on `rebased` would show a member copy identical to a
+    // live session's card — and their click would then write a grant that never expires. Nobody may
+    // grant something the card did not describe.
+    if (plan.durable)
+        lines.push(DURABLE_GRANT_DISCLOSURE);
+    return lines;
+}
+/**
+ * The reason CLASS of a failed card post, as one registered phrase — never the transport's raw text.
+ * It is what the member-facing message names, so it is deliberately a small closed vocabulary: a
+ * reason string can carry a channel name, a workspace id or a response body, and this sentence is
+ * read in the room.
+ * 🔴 IT READS THE REASON, NOT THE SENTENCE. `cardPostFailureReason` (approvals/flow.ts) carries the
+ * transport's own refusal code as a property of the thrown error. The MESSAGE also interpolates the
+ * kind and the scope key, so classifying it would let a room called `404` read as an unreachable
+ * room. An error carrying no reason falls back to the message, which is the honest degrade for a
+ * throw from somewhere other than the card post.
+ */
+export function checkpointCardFailureClass(err) {
+    const text = (cardPostFailureReason(err) ?? (err instanceof Error ? err.message : String(err))).toLowerCase();
+    // The composite string: the bridge cannot tell an unconfigured credential from a swallowed
+    // network error, so this class names both rather than picking one and sending an operator to
+    // rotate a token that is fine.
+    if (/no bot token is configured/.test(text))
+        return "no credential is configured, or the surface could not be reached";
+    if (/rate.?limit|ratelimited|too many requests|slow down/.test(text))
+        return "rate limited";
+    if (/invalid_auth|not_authed|token_revoked|token_expired|account_inactive|unauthorized|forbidden/.test(text))
+        return "the credential was refused";
+    if (/channel_not_found|is_archived|not_in_channel|channel_is_archived|no surface message transport/.test(text))
+        return "the room is unreachable";
+    if (/named no message id/.test(text))
+        return "the surface accepted the post but named no card";
+    return "the surface reported no reason this deployment recognises";
+}
+/**
+ * The recoverable tool-error the model reads and continues from (a per-ACTION failure, never a
+ * turn abort — same mechanism as stall/guard.ts's nudge and reply.ts's unresolved-target throw).
+ * 🔴 THE SENTENCE MUST MATCH THE ROOM. The agent relays this to the room, so a claim that a card
+ * was posted sends the member looking for an object that does not exist — and a member who waits
+ * for the agent rather than prompting it again waits forever, because nothing re-posts until the
+ * next consequential attempt. `failureClass` is required on `post-failed` and ignored otherwise.
+ */
+export function checkpointBlockMessage(reason, toolName, card, failureClass) {
+    const head = `Paused: ${reason}. Running \`${toolName}\` is a consequential action, so it's held until a member `;
+    const tail = `You can still read and reply in the meantime — do that, or tell the user you're waiting on a "keep going?" confirmation. Do NOT retry \`${toolName}\` until someone approves.`;
+    if (card === "post-failed") {
+        return (`${head}confirms continuing for this session. The confirmation card could NOT be posted to this room ` +
+            `(${failureClass ?? "reason not reported by the surface"}), so nobody has been shown one — tell the user that, and ask them to ` +
+            `confirm directly instead of looking for a card. The card is posted again on the next consequential attempt. ${tail}`);
+    }
+    return `${head}${card === "posted" ? "confirms on the card just posted" : "confirms continuing"} for this session. ${tail}`;
+}
+/**
+ * The GATE consequential tools call at the TOP of their execute(). If the session has crossed a
+ * configured cost checkpoint (and holds no continue grant), it posts a confirmation card ONCE and
+ * THROWS a recoverable tool-error — pausing this ONE consequential action while leaving reads/replies
+ * untouched. No configured threshold, under threshold, or an existing grant → returns silently (the
+ * tool runs). Fail-OPEN on any internal error (a broken checkpoint must never brick a tool).
+ */
+export async function requireSessionContinuation(ctx, toolName) {
+    let plan;
+    try {
+        plan = await evaluateCheckpoint(ctx);
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:checkpoint] evaluate skipped for "${toolName}": ${String(err)}`);
+        return; // fail-open
+    }
+    if (plan.decision === "proceed")
+        return;
+    // ── THE UNATTENDED CASE (OPE-253) ──────────────────────────────────────────────────────────────
+    // This block is about to happen. If the refused session is a ROUTINE FIRE, that block stalls
+    // SILENTLY, and silently is the whole defect: nobody is in the room at the hour a cron fire lands,
+    // so the card below gates nothing — it sits, and the job sits with it. Until this call, a stalled
+    // fire wrote NOTHING that any reader could join to the routine after the first one, because the
+    // `checkpoint.trip` row is written once per session (the ask-marker suppresses the rest) and a
+    // durable job resumes ONE session across every fire.
+    //
+    // 🔴 IT RECORDS; IT DOES NOT DECIDE. The card still posts, exactly as before — whether an unattended
+    // fire should card AT ALL is a doctrine question about when approvals are posted for unattended
+    // sessions ("the approval guards the model, not the member"), and it is not this fix's to answer.
+    // What this closes is that the stall was invisible and unreapable, not that it happened.
+    //
+    // 🔴 IT IS RECORDED BELOW THE FAIL-OPEN BRANCH AND ABOVE THE CARD, and BOTH halves of that position
+    // are load-bearing:
+    //   • BELOW `canAsk`, because that branch fails OPEN — the tool RUNS. A fire that got its hands is
+    //     not a stalled fire, and recording one there would count a stall on every fire of every routine
+    //     on a surface with no approval-card path, retiring healthy jobs after three fires.
+    //   • ABOVE the card, because the routine row is the durable record and the card post is the leg most
+    //     likely to fail (a dead token, a 429, an archived channel). Recording after it would lose the
+    //     stall in exactly the deployment where the notice matters most.
+    // Fail-soft and idempotent per fire (routines/outcome-fold.ts recordCheckpointStall), so a live human
+    // session — which carries no routine marker — takes a byte-identical path through one cheap read of
+    // an auth bag it has already resolved.
+    const binding = bindFrom(ctx);
+    const channelId = typeof binding.target?.channelId === "string" ? binding.target.channelId : undefined;
+    const requestedBy = principalIdOf(ctx);
+    const canAsk = hasApprovalCardPath(binding.platform) && !!channelId && !!requestedBy;
+    if (!canAsk) {
+        // No way to ask a human here (no card path / no verified sender / no channel id). A soft
+        // control with no unblock path must not dead-end a consequential action — fail OPEN, but
+        // record the crossing so it's visible. (The HARD monthly cap still binds independently.)
+        await auditToolAction(ctx, "checkpoint.trip", { tool: toolName, carded: false, allowed: true, reason: plan.reason, note: "no approval-card path — allowed" });
+        return;
+    }
+    // `current ?? initiator` is the SAME read complete_job / hooks/routine-outcome.ts / bindFrom's own
+    // authOf take — one spelling of "whose bag is this turn running under", never a fourth.
+    const fireAuth = ctx.session?.auth;
+    const marker = routineMarker(fireAuth?.current?.attributes ?? fireAuth?.initiator?.attributes);
+    if (marker)
+        await recordCheckpointStall({ marker, tool: toolName, reason: plan.reason });
+    const store = getOperationalStore();
+    const now = new Date();
+    const nowIso = now.toISOString();
+    const expiresAt = new Date(now.getTime() + checkpointTtlHours() * 3_600_000).toISOString();
+    // Card ONCE: an "asked" marker (written the first time we card this session) survives a DECLINE,
+    // so a rejected checkpoint keeps the soft-block WITHOUT re-posting a card on every later attempt.
+    // While the card is still awaiting a decision, requestApproval's frozen-args dedup also collapses
+    // repeats — belt and braces.
+    const askRow = await store.getSessionApproval(plan.org, plan.memoKey, CHECKPOINT_ASK_MEMO, nowIso).catch(() => null);
+    // 🔴 AN ASK MARKER OLDER THAN THE LAST APPROVAL IS SPENT (OPE-261). A member answered THAT card,
+    // and this block is a FRESH crossing since. Honouring the old marker here would suppress the new
+    // card while still throwing the block, so the job would stop with nothing on any surface to
+    // explain it — the silent stall OPE-253 exists to prevent. Comparing instants (not strings)
+    // because the two rows' ISO precision need not match.
+    const askedAfterApproval = askRow !== null && (plan.approvedAt === undefined || Date.parse(askRow.createdAt) > Date.parse(plan.approvedAt));
+    const alreadyAsked = askedAfterApproval ? askRow : null;
+    // Friendly display label for the card ("#proj-chat" instead of the raw id key) — resolved once
+    // here and FROZEN with the args so the pending and decided renders agree, exactly as
+    // set_spend_limit.ts does it. Fail-open: unresolvable → the card shows the raw scope key.
+    const scopeLabel = alreadyAsked ? undefined : await friendlyScopeLabel(plan.surfaceKey);
+    // WHAT THE ROOM HOLDS, tracked rather than re-derived at the throw. `alreadyAsked` answers only
+    // "had we carded before this turn?", which is why the catch path below used to be announced as a
+    // posted card (OPE-1861).
+    // 🔴 IT STARTS AT `post-failed` AND IS PROMOTED BY THE POST ITSELF. The `try` below also covers the
+    // ask-marker write and its audit row, so a flag set before the post and cleared in the catch would
+    // call a card that really landed "not posted" — the same defect inverted. Only the line after
+    // `requestApproval` returns may say the room holds a card.
+    let cardState = alreadyAsked ? "already-asked" : "post-failed";
+    let failureClass;
+    if (!alreadyAsked) {
+        try {
+            // approval-chain: exempt — `session.checkpoint` is a NON_TOOL_ACTION_KIND, so
+            // `toolForActionKind` returns undefined and requestApproval never builds a chain request for
+            // it (approvals/flow.ts). An attendedness signal here would be inert AND misleading: the
+            // unattended transform cannot run, which is why an unattended fire's checkpoint still cards
+            // into an empty room. That is pinned as deliberate at checkpoint-test.ts, and re-opening it
+            // is a decision for whatever arc gives the non-tool kinds tool-shaped requests (OPE-440).
+            await requestApproval({
+                org: plan.org,
+                kind: CHECKPOINT_KIND,
+                // Dedup-stable frozen args (no live usage — that would change every call and break dedup);
+                // sessionId is the memoKey the click's grant is written under. `durableSession` is a
+                // property of that memo key, not of the turn, so it is stable across fires and tells
+                // execute() which death rule the grant takes (OPE-261); `scopeLabel` is display-only and
+                // resolved from the same stable scope key.
+                args: { org: plan.org, scopeKey: plan.surfaceKey, sessionId: plan.memoKey, ...(plan.durable ? { durableSession: true } : {}), ...(scopeLabel ? { scopeLabel } : {}) },
+                scopeKey: plan.surfaceKey,
+                domain: plan.domain,
+                requestedBy: requestedBy,
+                channelId: channelId,
+                threadTs: binding.threadTs ?? null,
+                postedTo: postedToSurfaceKey(binding, channelId),
+                summaryLines: checkpointCardLines(plan, scopeLabel),
+            }, approvalPostDeps(binding.platform, ctx));
+            // THE ONE LINE THAT MAY SAY THE ROOM HOLDS A CARD — see the `cardState` note above. Everything
+            // below it can throw AFTER a card has really landed.
+            cardState = "posted";
+            await store.setSessionApproval({ org: plan.org, sessionId: plan.memoKey, kind: CHECKPOINT_ASK_MEMO, grantedBy: requestedBy, createdAt: nowIso, expiresAt });
+            await auditToolAction(ctx, "checkpoint.trip", { tool: toolName, carded: true, reason: plan.reason });
+        }
+        catch (err) {
+            // Either way the marker is NOT set, so a later attempt cards again, and this action is still
+            // blocked (the checkpoint is crossed) with the model getting the recoverable error.
+            if (cardState === "posted") {
+                // The CARD LANDED and the ask-marker write threw. The room really does hold a card, so the
+                // message keeps pointing at it; what is lost is the once-per-session suppression, which
+                // costs a duplicate card on the next attempt and never a missing one.
+                console.warn(`[open-everywhere:checkpoint] posted the checkpoint card for "${toolName}" but did not record the ask marker: ${String(err)}`);
+                await auditToolAction(ctx, "checkpoint.trip", { tool: toolName, carded: true, reason: plan.reason, note: "ask marker not recorded" });
+            }
+            else {
+                // The card never reached the room.
+                // 🔴 AND THE MESSAGE MUST SAY SO. The row below has always recorded `carded: false`; the
+                // thrown sentence claimed a posted card until OPE-1861, so the record and the copy disagreed
+                // on the one path where a member is left waiting on nothing.
+                failureClass = checkpointCardFailureClass(err);
+                console.warn(`[open-everywhere:checkpoint] could not post checkpoint card for "${toolName}": ${String(err)}`);
+                // `reasonClass` is the SAME closed vocabulary the thrown sentence names, so a reader joining
+                // this row to what the room was told sees one answer rather than two.
+                await auditToolAction(ctx, "checkpoint.trip", { tool: toolName, carded: false, reason: plan.reason, note: "card post failed", reasonClass: failureClass });
+            }
+        }
+    }
+    throw new Error(checkpointBlockMessage(plan.reason, toolName, cardState, failureClass));
+}
+//# sourceMappingURL=checkpoint.js.map

package/dist/agent/spend/checkpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint.js","sourceRoot":"","sources":["../../../agent/spend/checkpoint.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,iEAAiE;AACjE,EAAE;AACF,2FAA2F;AAC3F,2FAA2F;AAC3F,4FAA4F;AAC5F,6FAA6F;AAC7F,wFAAwF;AACxF,uCAAuC;AACvC,6FAA6F;AAC7F,4FAA4F;AAC5F,2FAA2F;AAC3F,4FAA4F;AAC5F,4FAA4F;AAC5F,oDAAoD;AACpD,EAAE;AACF,+FAA+F;AAC/F,2FAA2F;AAC3F,+FAA+F;AAC/F,4FAA4F;AAC5F,+FAA+F;AAC/F,gGAAgG;AAChG,8FAA8F;AAC9F,+FAA+F;AAC/F,+CAA+C;AAC/C,8FAA8F;AAC9F,6FAA6F;AAC7F,kGAAkG;AAClG,+FAA+F;AAC/F,2FAA2F;AAC3F,+FAA+F;AAC/F,4FAA4F;AAC5F,mDAAmD;AACnD,4FAA4F;AAC5F,6FAA6F;AAC7F,0FAA0F;AAC1F,gGAAgG;AAChG,gGAAgG;AAChG,2FAA2F;AAC3F,oFAAoF;AACpF,EAAE;AACF,+FAA+F;AAC/F,0FAA0F;AAC1F,+FAA+F;AAC/F,6FAA6F;AAC7F,6FAA6F;AAC7F,iGAAiG;AACjG,iGAAiG;AACjG,sCAAsC;AACtC,EAAE;AACF,mGAAmG;AACnG,8FAA8F;AAC9F,iGAAiG;AACjG,qGAAqG;AACrG,6FAA6F;AAC7F,EAAE;AACF,gGAAgG;AAChG,gGAAgG;AAChG,mGAAmG;AACnG,yEAAyE;AACzE,EAAE;AACF,oGAAoG;AACpG,oGAAoG;AACpG,qGAAqG;AACrG,iGAAiG;AACjG,6FAA6F;AAC7F,EAAE;AACF,2CAA2C;AAC3C,+FAA+F;AAC/F,8FAA8F;AAC9F,2FAA2F;AAC3F,4DAA4D;AAC5D,8FAA8F;AAC9F,6FAA6F;AAC7F,8DAA8D;AAG9D,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAkB,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,iGAAiG;AACjG,gGAAgG;AAChG,2DAA2D;AAC3D,OAAO,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC/J,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AA4CnF,qFAAqF;AACrF,MAAM,UAAU,sBAAsB,CAAC,WAA6B;IAClE,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,eAAe,EAAE,mBAAmB,EAAE,YAAY,CAAU,CAAC;AAExF,SAAS,qBAAqB,CAAC,EAAc,EAAE,KAAa;IAC1D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAClC,IAAI,CAAE,iBAAuC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,uBAAuB,GAAG,aAAa,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IACD,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,uEAAuE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,IAAI,IAAI;YAAE,SAAS;QACxB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,IAAI,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,IAAI,CAAC,kCAAkC,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAA6B;IACvE,IAAI,WAAW,CAAC,OAAO;QAAE,qBAAqB,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/E,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,uEAAuE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;QACD,qBAAqB,CAAC,EAAE,EAAE,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,uEAAuE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;QACD,qBAAqB,CAAC,EAAE,EAAE,cAAc,GAAG,IAAI,CAAC,CAAC;IACnD,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,6EAA6E,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,qBAAqB,CAAC,EAAE,EAAE,eAAe,GAAG,IAAI,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,8FAA8F;AAE9F,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,qEAAqE;IAClF,CAAC;AACH,CAAC;AAED;6FAC6F;AAC7F,MAAM,UAAU,iBAAiB,CAAC,YAAoB,EAAE,UAAkB,EAAE,UAAmB;IAC7F,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,OAAO,CACL,GAAG,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC;QAC5B,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,GAAG,CAAC,YAAY,EAAE,CAAC,YAAY,CAAC;QAChC,GAAG,CAAC,OAAO;QACX,EAAE,CACH,CAAC;AACJ,CAAC;AAkBD,2FAA2F;AAC3F,MAAM,qBAAqB,GAAG,0CAA0C,CAAC;AACzE;;;mCAGmC;AACnC,MAAM,sBAAsB,GAAG,0EAA0E,CAAC;AAE1G;;;wFAGwF;AACxF,MAAM,UAAU,eAAe,CAAC,KAAmB,EAAE,EAAc,EAAE,OAAO,GAAW,qBAAqB;IAC1G,IAAI,EAAE,CAAC,aAAa,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;IAClI,CAAC;IACD,IAAI,EAAE,CAAC,iBAAiB,IAAI,IAAI,IAAI,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC,iBAAiB,CAAC,cAAc,EAAE,eAAe,EAAE,CAAC;IAC/I,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACpH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,oBAAoB,CAAC,EAAc;IACjD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,8FAA8F;AAE9F;;;;;;8FAM8F;AAC9F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,SAAiB,EAAE,QAAiB;IAClF,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,2FAA2F;IAC3F,iGAAiG;IACjG,kGAAkG;IAClG,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,GAAuB,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5B,6FAA6F;YAC7F,gDAAgD;YAChD,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,OAAO;gBAAE,SAAS;QACrD,CAAC;QACD,6EAA6E;QAC7E,8EAA8E;QAC9E,+EAA+E;QAC/E,wEAAwE;QACxE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACnC,UAAU,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC;QACzC,gGAAgG;QAChG,gGAAgG;QAChG,4FAA4F;QAC5F,sDAAsD;QACtD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,SAAS;YAAE,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,8FAA8F;AAE9F;6CAC6C;AAC7C,SAAS,eAAe,CAAC,GAAoB;IAC3C,MAAM,EAAE,GAAI,GAAsC,CAAC,OAAO,EAAE,EAAE,CAAC;IAC/D,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED;;;mCAGmC;AACnC,SAAS,aAAa,CAAC,GAAoB;IACzC,MAAM,GAAG,GAAI,GAAqD,CAAC,OAAO,EAAE,iBAAiB,CAAC;IAC9F,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;AACzF,CAAC;AA4BD;;8DAE8D;AAC9D,SAAS,WAAW,CAAC,GAAoB;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;IACnC,OAAO,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,IAAI,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAoB;IACpD,MAAM,CAAC,GAAc,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,6EAA6E;IAC9G,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACnE,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,6BAA6B;IAE5F,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,oDAAoD;IAE/G,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,oFAAoF;IACpF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE3G,gGAAgG;IAChG,kGAAkG;IAClG,8FAA8F;IAC9F,EAAE;IACF,mGAAmG;IACnG,gGAAgG;IAChG,+FAA+F;IAC/F,8FAA8F;IAC9F,iGAAiG;IACjG,yBAAyB;IACzB,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,iGAAiG;IACjG,iGAAiG;IACjG,iDAAiD;IACjD,EAAE;IACF,iGAAiG;IACjG,gGAAgG;IAChG,iGAAiG;IACjG,6FAA6F;IAC7F,0FAA0F;IAC1F,gGAAgG;IAChG,yEAAyE;IACzE,MAAM,YAAY,GAAG,KAAK,EAAE,SAAS,KAAK,4BAA4B,CAAC;IACvE,IAAI,KAAK,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAE3D,MAAM,KAAK,GAAG,KAAK,EAAE,SAAS,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;IACjH,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAErD,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,MAAM,EAAE,UAAU,IAAI,IAAI;QAC1B,OAAO;QACP,KAAK;QACL,UAAU,EAAE,EAAE;QACd,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,qBAAqB;QAC/C,gGAAgG;QAChG,wFAAwF;QACxF,OAAO,EAAE,SAAS,KAAK,SAAS,IAAI,YAAY;QAChD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAoD,EAAE,UAAmB;IAC3G,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,EAAE,eAAe,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClM,MAAM,KAAK,GAAG;QACZ,OAAO,CAAC,CAAC,CAAC,yDAAyD,CAAC,CAAC,CAAC,mDAAmD;QACzH,MAAM,UAAU,IAAI,IAAI,CAAC,UAAU,GAAG;QACtC,OAAO,CAAC,CAAC,CAAC,6CAA6C,KAAK,GAAG,CAAC,CAAC,CAAC,wBAAwB,KAAK,GAAG;KACnG,CAAC;IACF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,EAAE,CAAC,aAAa,IAAI,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACzF,IAAI,EAAE,CAAC,iBAAiB,IAAI,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACtG,IAAI,EAAE,CAAC,UAAU,IAAI,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3I,KAAK,CAAC,IAAI,CAAC,0KAA0K,CAAC,CAAC;IACvL,mGAAmG;IACnG,iGAAiG;IACjG,gGAAgG;IAChG,6CAA6C;IAC7C,IAAI,IAAI,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAkBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAY;IACrD,MAAM,IAAI,GAAG,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9G,2FAA2F;IAC3F,6FAA6F;IAC7F,+BAA+B;IAC/B,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,kEAAkE,CAAC;IACvH,IAAI,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,cAAc,CAAC;IAC5F,IAAI,6FAA6F,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,4BAA4B,CAAC;IAClJ,IAAI,+FAA+F,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,yBAAyB,CAAC;IACjJ,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,iDAAiD,CAAC;IAC/F,OAAO,2DAA2D,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,QAAgB,EAAE,IAAyB,EAAE,YAAqB;IACvH,MAAM,IAAI,GAAG,WAAW,MAAM,eAAe,QAAQ,4DAA4D,CAAC;IAClH,MAAM,IAAI,GAAG,2IAA2I,QAAQ,4BAA4B,CAAC;IAC7L,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,OAAO,CACL,GAAG,IAAI,+FAA+F;YACtG,IAAI,YAAY,IAAI,oCAAoC,wEAAwE;YAChI,+GAA+G,IAAI,EAAE,CACtH,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,qBAAqB,sBAAsB,IAAI,EAAE,CAAC;AAC9H,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,GAAoB,EAAE,QAAgB;IACrF,IAAI,IAAoB,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,sDAAsD,QAAQ,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,YAAY;IACtB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO;IAExC,kGAAkG;IAClG,6FAA6F;IAC7F,mGAAmG;IACnG,kGAAkG;IAClG,gGAAgG;IAChG,+FAA+F;IAC/F,qDAAqD;IACrD,EAAE;IACF,qGAAqG;IACrG,gGAAgG;IAChG,kGAAkG;IAClG,yFAAyF;IACzF,EAAE;IACF,oGAAoG;IACpG,oBAAoB;IACpB,mGAAmG;IACnG,qGAAqG;IACrG,wFAAwF;IACxF,sGAAsG;IACtG,mGAAmG;IACnG,qEAAqE;IACrE,sGAAsG;IACtG,oGAAoG;IACpG,uCAAuC;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC;IAErF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,yFAAyF;QACzF,yFAAyF;QACzF,yFAAyF;QACzF,MAAM,eAAe,CAAC,GAAG,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9J,OAAO;IACT,CAAC;IAED,mGAAmG;IACnG,wFAAwF;IACxF,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,IAAI,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAC/F,IAAI,MAAM;QAAE,MAAM,qBAAqB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAEzF,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,kBAAkB,EAAE,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAE3F,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,6BAA6B;IAC7B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACrH,iGAAiG;IACjG,iGAAiG;IACjG,4FAA4F;IAC5F,4FAA4F;IAC5F,sDAAsD;IACtD,MAAM,kBAAkB,GAAG,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5I,MAAM,YAAY,GAAG,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,+FAA+F;IAC/F,qFAAqF;IACrF,0FAA0F;IAC1F,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxF,gGAAgG;IAChG,iGAAiG;IACjG,0BAA0B;IAC1B,oGAAoG;IACpG,mGAAmG;IACnG,8FAA8F;IAC9F,2DAA2D;IAC3D,IAAI,SAAS,GAAwB,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC;IACpF,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,8EAA8E;YAC9E,6FAA6F;YAC7F,yFAAyF;YACzF,4FAA4F;YAC5F,4FAA4F;YAC5F,0FAA0F;YAC1F,MAAM,eAAe,CACnB;gBACE,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,IAAI,EAAE,eAAe;gBACrB,2FAA2F;gBAC3F,qFAAqF;gBACrF,qFAAqF;gBACrF,yFAAyF;gBACzF,2CAA2C;gBAC3C,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBAC9K,QAAQ,EAAE,IAAI,CAAC,UAAU;gBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,WAAY;gBACzB,SAAS,EAAE,SAAU;gBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;gBAClC,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE,SAAU,CAAC;gBACjD,YAAY,EAAE,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC;aACpD,EACD,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CACxC,CAAC;YACF,+FAA+F;YAC/F,qDAAqD;YACrD,SAAS,GAAG,QAAQ,CAAC;YACrB,MAAM,KAAK,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,WAAY,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7J,MAAM,eAAe,CAAC,GAAG,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACvG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6FAA6F;YAC7F,oFAAoF;YACpF,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3B,2FAA2F;gBAC3F,wFAAwF;gBACxF,sEAAsE;gBACtE,OAAO,CAAC,IAAI,CAAC,gEAAgE,QAAQ,wCAAwC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5I,MAAM,eAAe,CAAC,GAAG,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACxI,CAAC;iBAAM,CAAC;gBACN,mCAAmC;gBACnC,yFAAyF;gBACzF,6FAA6F;gBAC7F,6DAA6D;gBAC7D,YAAY,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC,oEAAoE,QAAQ,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9G,6FAA6F;gBAC7F,sEAAsE;gBACtE,MAAM,eAAe,CAAC,GAAG,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YAC7J,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAC1F,CAAC"}