@opengeni/api-router 3.1.3-canary.38890816741001 → 3.2.2

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/observability.ts","../src/sandbox/auth-callout.ts","../src/sandbox/connection-authority.ts","../src/sandbox/metrics-ingestion.ts","../src/memory-slack-delivery.ts","../src/scheduled-task-lifecycle.ts","../src/scheduled-task-blockers.ts","../src/temporal-schedule-sync.ts","../src/native-push-dispatch.ts","../src/workspace-webhook-dispatch.ts","../src/editable-artifact-websocket.ts","../src/editable-artifact-source-session.ts","../src/http/websocket-upgrade-dispatch.ts","../src/editable-artifact-production.ts","../src/editable-artifact-live-hints.ts","../src/editable-artifact-native-kernel.ts","../src/editable-artifact-office-import.ts","../src/editable-artifact-workspace-files.ts","../src/fatal-process-boundary.ts"],"sourcesContent":["import { scheduledTaskKnowledgeSource } from \"@opengeni/contracts\";\nimport {\n  dbSearchPath,\n  getSettings,\n  resolveFirstPartyDelegationSecret,\n  resolveNatsCalloutConfig,\n  resolveNatsControlPlaneAuth,\n  retryStartupDependency,\n  startupRetryOptions,\n  temporalConnectionOptions,\n} from \"@opengeni/config\";\nimport type {\n  ScheduledTask,\n  ScheduledTaskOverlapPolicy,\n  ScheduledTaskScheduleSpec,\n} from \"@opengeni/contracts\";\nimport {\n  assertRuntimeDatabasePosture,\n  isRetryableRuntimeDatabaseStartupError,\n  createDb,\n  markSessionWorkflowWakeDelivered,\n  runtimeDatabaseReadyCheck,\n  type Database,\n} from \"@opengeni/db\";\nimport { createNatsEventBus, type ResponderConnection } from \"@opengeni/events\";\nimport {\n  createObservability,\n  logStartupDependencyRetry,\n  type Observability,\n} from \"@opengeni/observability\";\nimport { createObjectStorage } from \"@opengeni/storage\";\nimport { isArtifactRuntimeConfigured } from \"@opengeni/artifact-tool/runtime/development\";\nimport {\n  resolveCatalogSettings,\n  SESSION_WORKFLOW_WAKE_DISPATCH_REQUESTED_SIGNAL,\n  SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_ID,\n  SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE,\n} from \"@opengeni/core\";\nimport {\n  Connection,\n  Client as TemporalClient,\n  ScheduleNotFoundError,\n  ScheduleOverlapPolicy,\n  WorkflowExecutionAlreadyStartedError,\n} from \"@temporalio/client\";\nimport type { ScheduleOptions, ScheduleSpec, ScheduleUpdateOptions } from \"@temporalio/client\";\nimport { createAppComposition, type DocumentIndexClient, type SessionWorkflowClient } from \"./app\";\nimport { observabilityEventBusOptions } from \"./observability\";\nimport { startAuthCalloutResponder } from \"./sandbox/auth-callout\";\nimport { startHelloIngestion, startMetricsIngestion } from \"./sandbox/metrics-ingestion\";\nimport { createAutomaticAgentUpdater } from \"./sandbox/agent-update\";\nimport { startSlackInteractionPump } from \"./integrations/slack-interactions\";\nimport { startMemorySlackPublicationPump } from \"./memory-slack-delivery\";\nimport { startTemporalScheduleCleanupPump } from \"./temporal-schedule-cleanup\";\nimport { startScheduledTaskLifecyclePump } from \"./scheduled-task-lifecycle\";\nimport { createTemporalScheduleSynchronizer } from \"./temporal-schedule-sync\";\nimport { startNativePushDispatchPump } from \"./native-push-dispatch\";\nimport { startWorkspaceWebhookDispatchPump } from \"./workspace-webhook-dispatch\";\nimport { cleanupScheduledTaskConnectorAuthorization } from \"./scheduled-task-deletion\";\nimport {\n  EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES,\n  EditableArtifactWebSocketTransport,\n} from \"./editable-artifact-websocket\";\nimport { editableArtifactSourceSessionAuthorizer } from \"./editable-artifact-source-session\";\nimport type { ApiWebSocketConnection } from \"./api-websocket\";\nimport { InteractionFrameProxyTransport } from \"./interaction-frame-proxy\";\nimport { apiRequestBindingsForTransportPeer } from \"./http/request-source\";\nimport { startApiMetricsListener } from \"./http/metrics-listener\";\nimport { createLocalBrowserBoundary } from \"./http/local-browser-boundary\";\nimport { dispatchApiWebSocketUpgrade } from \"./http/websocket-upgrade-dispatch\";\nimport {\n  createStandaloneEditableArtifactApplication,\n  type StandaloneEditableArtifactApplication,\n} from \"./editable-artifact-production\";\nimport { installApiFatalProcessBoundary } from \"./fatal-process-boundary\";\n\n/**\n * A REJECT_DUPLICATE start collides on the deterministic workflowId when the\n * same manual trigger token fires twice. Temporal surfaces that as\n * WorkflowExecutionAlreadyStartedError; the caller treats it as an idempotent\n * no-op rather than a failure.\n */\nfunction isWorkflowAlreadyStarted(error: unknown): boolean {\n  return error instanceof WorkflowExecutionAlreadyStartedError;\n}\n\nconst TEMPORAL_MONTHS = [\n  \"JANUARY\",\n  \"FEBRUARY\",\n  \"MARCH\",\n  \"APRIL\",\n  \"MAY\",\n  \"JUNE\",\n  \"JULY\",\n  \"AUGUST\",\n  \"SEPTEMBER\",\n  \"OCTOBER\",\n  \"NOVEMBER\",\n  \"DECEMBER\",\n] as const;\n\nexport async function createTemporalWorkflowClient(\n  settings: ReturnType<typeof getSettings>,\n  db: Database,\n): Promise<{\n  client: SessionWorkflowClient;\n  documentIndexer: DocumentIndexClient;\n  close: () => Promise<void>;\n}> {\n  const connection = await Connection.connect(temporalConnectionOptions(settings));\n  const temporal = new TemporalClient({\n    connection,\n    namespace: settings.temporalNamespace,\n  });\n  const scheduledTasks = createTemporalScheduleSynchronizer({\n    db,\n    withDeadline: (deadline, work) => temporal.withDeadline(deadline, work),\n    upsert: async (task) => {\n      const options = temporalScheduleOptions(task, settings.temporalTaskQueue);\n      try {\n        await temporal.schedule\n          .getHandle(task.temporalScheduleId)\n          .update(() => temporalScheduleUpdateOptions(options));\n      } catch (error) {\n        if (!shouldCreateScheduleAfterUpdateError(error)) throw error;\n        await temporal.schedule.create(options);\n      }\n    },\n    remove: async (temporalScheduleId) => {\n      try {\n        await temporal.schedule.getHandle(temporalScheduleId).delete();\n      } catch (error) {\n        if (!(error instanceof ScheduleNotFoundError)) throw error;\n      }\n    },\n  });\n  const client: SessionWorkflowClient = {\n    triggerAutomationRun: async ({ accountId, workspaceId, runId }) => {\n      try {\n        await temporal.workflow.start(\"automationRunWorkflow\", {\n          taskQueue: settings.temporalTaskQueue,\n          workflowId: `automation-run:${runId}`,\n          workflowIdReusePolicy: \"REJECT_DUPLICATE\",\n          args: [{ accountId, workspaceId, runId }],\n        });\n      } catch (error) {\n        if (isWorkflowAlreadyStarted(error)) return;\n        throw error;\n      }\n    },\n    signalUserMessage: async ({ eventId, workflowId }) => {\n      await temporal.workflow.getHandle(workflowId).signal(\"userMessage\", eventId);\n    },\n    wakeSessionWorkflow: async ({\n      accountId,\n      workspaceId,\n      sessionId,\n      workflowId,\n      wakeRevision,\n      interruptionRequested,\n      onSignalAccepted,\n    }) => {\n      await temporal.workflow.signalWithStart(\"sessionWorkflow\", {\n        taskQueue: settings.temporalTaskQueue,\n        workflowId,\n        workflowIdReusePolicy: \"ALLOW_DUPLICATE\",\n        args: [{ accountId, workspaceId, sessionId }],\n        signal: interruptionRequested ? \"sessionControl\" : \"queueChanged\",\n      });\n      onSignalAccepted?.();\n      return await markSessionWorkflowWakeDelivered(db, {\n        accountId,\n        workspaceId,\n        sessionId,\n        temporalWorkflowId: workflowId,\n        wakeRevision,\n      });\n    },\n    requestSessionWorkflowWakeDispatch: async () => {\n      await temporal.workflow.signalWithStart(SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE, {\n        taskQueue: settings.temporalTaskQueue,\n        workflowId: SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_ID,\n        workflowIdReusePolicy: \"ALLOW_DUPLICATE\",\n        args: [],\n        signal: SESSION_WORKFLOW_WAKE_DISPATCH_REQUESTED_SIGNAL,\n      });\n    },\n    signalCodexCapacity: async ({\n      accountId,\n      workspaceId,\n      sessionId,\n      workflowId,\n      wakeRevision,\n      workflowWakeRevision,\n    }) => {\n      await temporal.workflow.signalWithStart(\"sessionWorkflow\", {\n        taskQueue: settings.temporalTaskQueue,\n        workflowId,\n        workflowIdReusePolicy: \"ALLOW_DUPLICATE\",\n        args: [{ accountId, workspaceId, sessionId }],\n        signal: \"codexCapacityChanged\",\n        signalArgs: [wakeRevision],\n      });\n      await markSessionWorkflowWakeDelivered(db, {\n        accountId,\n        workspaceId,\n        sessionId,\n        temporalWorkflowId: workflowId,\n        wakeRevision: workflowWakeRevision,\n      });\n    },\n    signalApprovalDecision: async ({\n      accountId,\n      workspaceId,\n      sessionId,\n      eventId,\n      workflowId,\n      workflowWakeRevision,\n    }) => {\n      await temporal.workflow.signalWithStart(\"sessionWorkflow\", {\n        taskQueue: settings.temporalTaskQueue,\n        workflowId,\n        workflowIdReusePolicy: \"ALLOW_DUPLICATE\",\n        args: [{ accountId, workspaceId, sessionId }],\n        signal: \"approvalDecision\",\n        signalArgs: [eventId],\n      });\n      await markSessionWorkflowWakeDelivered(db, {\n        accountId,\n        workspaceId,\n        sessionId,\n        temporalWorkflowId: workflowId,\n        wakeRevision: workflowWakeRevision,\n      });\n    },\n    syncScheduledTask: async ({ task, onFailure }) => scheduledTasks.sync(task, onFailure),\n    deleteScheduledTaskSchedule: async ({ temporalScheduleId }) =>\n      scheduledTasks.remove(temporalScheduleId),\n    triggerScheduledTask: async ({\n      task,\n      agentRunUsageIdempotencyKey,\n      triggerWorkflowId,\n      initiator,\n      credentialRestriction,\n      triggerType = \"manual\",\n    }) => {\n      // Deterministic workflowId (derived from the trigger token by the\n      // caller) + REJECT_DUPLICATE makes a retried manual trigger idempotent:\n      // the second start collides on the id and is rejected instead of\n      // spawning a second run. The shared idempotency key dedupes the charge.\n      const workflowId = triggerWorkflowId;\n      try {\n        await temporal.workflow.start(\"scheduledTaskFireWorkflow\", {\n          taskQueue: settings.temporalTaskQueue,\n          workflowId,\n          workflowIdReusePolicy: \"REJECT_DUPLICATE\",\n          args: [\n            {\n              accountId: task.accountId,\n              workspaceId: task.workspaceId,\n              taskId: task.id,\n              triggerType,\n              agentRunUsageIdempotencyKey,\n              initiator,\n              ...(credentialRestriction ? { credentialRestriction } : {}),\n            },\n          ],\n        });\n      } catch (error) {\n        // A duplicate trigger token started this run already; treat the retry\n        // as a no-op so the (idempotent) usage charge stays the only effect.\n        if (isWorkflowAlreadyStarted(error)) {\n          return;\n        }\n        throw error;\n      }\n    },\n    startRigVerification: async ({ workspaceId, changeId, versionId, workflowId }) => {\n      const targetId = changeId ?? versionId;\n      if (!targetId) {\n        throw new Error(\"sandbox environment verification requires changeId or versionId\");\n      }\n      try {\n        await temporal.workflow.start(\"rigVerificationWorkflow\", {\n          taskQueue: settings.temporalTaskQueue,\n          workflowId: workflowId ?? `rig-verification-${targetId}-${crypto.randomUUID()}`,\n          workflowIdReusePolicy: \"REJECT_DUPLICATE\",\n          args: [\n            {\n              workspaceId,\n              ...(changeId ? { changeId } : {}),\n              ...(versionId ? { versionId } : {}),\n            },\n          ],\n        });\n      } catch (error) {\n        // A lost start acknowledgement is indistinguishable from a retry. The\n        // caller-owned workflow id makes both cases the same successful start.\n        if (isWorkflowAlreadyStarted(error)) return;\n        throw error;\n      }\n    },\n    check: async () => {\n      await connection.workflowService.getSystemInfo({});\n    },\n  };\n  const documentIndexer: DocumentIndexClient = {\n    indexDocument: async (input) => {\n      const { documentId } = input;\n      const workflowId = `document-index-${documentId}-${crypto.randomUUID()}`;\n      await temporal.workflow.start(\"documentIndexWorkflow\", {\n        taskQueue: settings.temporalTaskQueue,\n        workflowId,\n        args: [input],\n      });\n    },\n  };\n  return {\n    client,\n    documentIndexer,\n    close: async () => {\n      await connection.close();\n    },\n  };\n}\n\nexport async function startApi(\n  options: {\n    settings?: ReturnType<typeof getSettings>;\n    observability?: Observability;\n  } = {},\n) {\n  const settings = options.settings ?? getSettings();\n  const observability =\n    options.observability ?? createObservability(settings, { component: \"api\" });\n  // Step I: standalone → dbSchema unset → searchPath undefined → today's plain\n  // handle (public). Embedded → scoped to the dedicated schema + the host's RLS\n  // strategy.\n  const searchPath = dbSearchPath(settings);\n  const dbClient = createDb(settings.databaseUrl, {\n    max: settings.apiDatabasePoolMax,\n    ...(searchPath ? { searchPath } : {}),\n    rlsStrategy: settings.rlsStrategy,\n  });\n  let bus: Awaited<ReturnType<typeof createNatsEventBus>> | undefined;\n  let workflowClient: Awaited<ReturnType<typeof createTemporalWorkflowClient>> | undefined;\n  const retryOptions = startupRetryOptions(settings);\n  const onRetry = (event: Parameters<typeof logStartupDependencyRetry>[1]) =>\n    logStartupDependencyRetry(observability, event);\n  const databasePosture = {\n    rlsStrategy: settings.rlsStrategy,\n    expectedRole: settings.runtimeDatabaseRole,\n    targetSchema: settings.dbSchema.trim() || \"public\",\n  } as const;\n  // The PRIVILEGED control-plane NATS login (M-AUTH): when the server runs with\n  // auth_callout, api/worker authenticate as a static account user permitted to\n  // request exact generation-fenced agent RPC subjects. Null in local dev\n  // (anonymous connect — the bus default).\n  const controlPlaneAuth = resolveNatsControlPlaneAuth(settings);\n  try {\n    // Browser, Computer, Terminal, and Files can cold-create the home sandbox\n    // directly from this API process. Resolve the same private-registry Modal\n    // image before the API becomes reachable so the first human interaction\n    // does not pay the provider import/build latency. This mirrors the turn\n    // worker's startup boundary and is a no-op for provider-native image IDs,\n    // public images, and non-Modal backends.\n    const { ensureModalRegistryImage } = await import(\"@opengeni/runtime/sandbox\");\n    await retryStartupDependency(\n      \"Modal private-registry image\",\n      () => ensureModalRegistryImage(settings),\n      { ...retryOptions, onRetry },\n    );\n    await retryStartupDependency(\n      \"PostgreSQL runtime posture\",\n      () => assertRuntimeDatabasePosture(dbClient.db, databasePosture),\n      { ...retryOptions, onRetry, shouldRetry: isRetryableRuntimeDatabaseStartupError },\n    );\n    const resolvedCatalog = await retryStartupDependency(\n      \"model catalog\",\n      () => resolveCatalogSettings(dbClient.db, settings),\n      { ...retryOptions, onRetry },\n    );\n    observability.info(\"Opengeni model catalog resolved\", {\n      catalogSource: resolvedCatalog.source,\n      catalogVersion: resolvedCatalog.version,\n    });\n    bus = await retryStartupDependency(\n      \"NATS\",\n      () =>\n        createNatsEventBus(\n          settings.natsUrl,\n          controlPlaneAuth\n            ? { user: controlPlaneAuth.user, pass: controlPlaneAuth.password }\n            : undefined,\n          observabilityEventBusOptions(observability),\n        ),\n      {\n        ...retryOptions,\n        onRetry,\n      },\n    );\n    workflowClient = await retryStartupDependency(\n      \"Temporal\",\n      () => createTemporalWorkflowClient(settings, dbClient.db),\n      {\n        ...retryOptions,\n        onRetry,\n      },\n    );\n  } catch (error) {\n    await Promise.allSettled([bus?.close(), workflowClient?.close(), dbClient.close()]);\n    throw error;\n  }\n  if (!bus || !workflowClient) {\n    await dbClient.close();\n    throw new Error(\"Opengeni API startup dependencies were not initialized\");\n  }\n  const objectStorage = createObjectStorage(settings);\n  let editableArtifactComposition: StandaloneEditableArtifactApplication | undefined;\n  if (objectStorage && isArtifactRuntimeConfigured()) {\n    try {\n      editableArtifactComposition = await createStandaloneEditableArtifactApplication({\n        db: dbClient.db,\n        bus,\n        objectStorage,\n      });\n    } catch (error) {\n      await Promise.allSettled([bus.close(), workflowClient.close(), dbClient.close()]);\n      throw error;\n    }\n  }\n  const { app, routeDeps } = createAppComposition({\n    settings,\n    db: dbClient.db,\n    bus,\n    workflowClient: workflowClient.client,\n    documentIndexer: workflowClient.documentIndexer,\n    objectStorage,\n    ...(editableArtifactComposition\n      ? {\n          editableArtifacts: editableArtifactComposition.application,\n          editableArtifactExports: editableArtifactComposition.durableExports,\n          editableArtifactAgent: editableArtifactComposition.agent,\n          editableArtifactOfficeImports: editableArtifactComposition.officeImports,\n        }\n      : {}),\n    observability,\n    readinessChecks: {\n      db: runtimeDatabaseReadyCheck(dbClient.db, databasePosture),\n    },\n  });\n  if (!routeDeps.editableArtifacts) {\n    observability.warn(\"editable artifact engine is not composed\", {\n      subsystem: \"editable_artifacts\",\n      behavior: \"http_and_websocket_fail_closed\",\n    });\n  }\n  const artifactWebSockets = new EditableArtifactWebSocketTransport(\n    routeDeps.editableArtifacts,\n    editableArtifactSourceSessionAuthorizer(routeDeps),\n  );\n  const interactionFrameProxies = new InteractionFrameProxyTransport(\n    resolveFirstPartyDelegationSecret(settings),\n  );\n  // WebSocket upgrades bypass the Hono app, so the local-mode browser boundary\n  // (http/local-browser-boundary.ts) is applied to them in the dispatcher;\n  // every other request meets it in the Hono middleware.\n  const localBrowserBoundary = createLocalBrowserBoundary(settings, {\n    warn: (message, attributes) => observability.warn(message, attributes),\n  });\n  const webSocketUpgrades = [interactionFrameProxies, artifactWebSockets];\n  const server = Bun.serve<ApiWebSocketConnection>({\n    hostname: settings.apiHost,\n    port: settings.apiPort,\n    idleTimeout: 255,\n    fetch: (request, bunServer) => {\n      const upgrade = dispatchApiWebSocketUpgrade(\n        request,\n        bunServer,\n        webSocketUpgrades,\n        localBrowserBoundary,\n      );\n      if (upgrade.handled) return upgrade.response;\n      return app.fetch(\n        request,\n        apiRequestBindingsForTransportPeer(bunServer.requestIP(request)?.address),\n      );\n    },\n    websocket: {\n      maxPayloadLength: EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES,\n      backpressureLimit: 16 * 1024 * 1024,\n      closeOnBackpressureLimit: true,\n      open: (socket) => socket.data.attach(socket),\n      message: (socket, message) => socket.data.receive(message),\n      close: (socket) => socket.data.transportClosed(),\n    },\n  });\n  const metricsServer = startApiMetricsListener(settings, observability);\n  const stopSlackInteractionPump = settings.slackSigningSecret\n    ? startSlackInteractionPump(routeDeps)\n    : undefined;\n  const stopMemorySlackPublicationPump = startMemorySlackPublicationPump(routeDeps);\n  const stopWorkspaceWebhookDispatchPump = startWorkspaceWebhookDispatchPump({\n    db: dbClient.db,\n    settings,\n    observability,\n  });\n  const stopNativePushDispatchPump = startNativePushDispatchPump({\n    db: dbClient.db,\n    settings,\n    observability,\n  });\n  const stopTemporalScheduleCleanupPump = startTemporalScheduleCleanupPump({\n    db: dbClient.db,\n    cleanupConnectorAuthorization: async (claim) =>\n      await cleanupScheduledTaskConnectorAuthorization(routeDeps, claim),\n    deleteSchedule: async (temporalScheduleId) => {\n      await workflowClient.client.deleteScheduledTaskSchedule({ temporalScheduleId });\n    },\n    observability,\n  });\n  const stopScheduledTaskLifecyclePump = startScheduledTaskLifecyclePump({\n    db: dbClient.db,\n    sync: (task) => workflowClient.client.syncScheduledTask({ task }),\n    bus,\n    observability,\n  });\n  // M10 — start the metrics-ingestion consumer (agent heartbeats → DB last-sample\n  // + downsampled series), gated on the selfhosted flag. A no-op when disabled.\n  let stopMetricsIngestion: (() => void) | undefined;\n  // Reconcile enrollments.has_display to the LIVE capability the agent reports in\n  // its connect Hello (has_display was frozen at the enroll-time snapshot). Gated\n  // on the same selfhosted flag.\n  let stopHelloIngestion: (() => void) | undefined;\n  // M-AUTH — start the NATS auth-callout responder (the tenancy boundary): it\n  // validates an agent's enrollment bearer presented at NATS connect and mints a\n  // workspace-scoped user JWT. Gated on the selfhosted flag + a resolvable callout\n  // config; without the callout plane it never starts (selfhosted agents simply\n  // cannot connect — graceful). It runs on its OWN connection (the callout auth\n  // user), separate from the privileged control-plane bus.\n  let authCalloutResponder: ResponderConnection | undefined;\n  if (settings.sandboxSelfhostedEnabled) {\n    stopMetricsIngestion = startMetricsIngestion({\n      db: dbClient.db,\n      bus,\n      observability,\n      agentUpdates: createAutomaticAgentUpdater({\n        db: dbClient.db,\n        bus,\n        settings,\n        observability,\n      }),\n    });\n    stopHelloIngestion = startHelloIngestion({\n      db: dbClient.db,\n      bus,\n      observability,\n    });\n    observability.info(\"Opengeni machine-metrics + hello ingestion consumers started\", {});\n\n    const callout = resolveNatsCalloutConfig(settings);\n    if (callout) {\n      try {\n        authCalloutResponder = await startAuthCalloutResponder(\n          { db: dbClient.db, settings, callout, observability },\n          settings.natsUrl,\n        );\n      } catch {\n        // A responder start failure must not crash the API (other planes work); log\n        // loudly — selfhosted agents will fail to connect until it is up.\n        observability.error(\"Opengeni NATS auth-callout responder failed to start\", {\n          errorClass: \"NatsAuthCalloutOperationError\",\n          errorCode: \"nats_auth_callout_start_failed\",\n          origin: \"api\",\n        });\n      }\n    } else {\n      observability.warn(\n        \"Opengeni selfhosted enabled but the NATS auth-callout plane is not configured; selfhosted agents cannot connect\",\n        {},\n      );\n    }\n  }\n  observability.info(\"Opengeni API listening\", {\n    host: settings.apiHost,\n    port: settings.apiPort,\n    ...(metricsServer ? { metricsPort: settings.apiMetricsPort } : {}),\n  });\n  return {\n    server,\n    close: async () => {\n      server.stop(true);\n      metricsServer?.stop(true);\n      stopSlackInteractionPump?.();\n      await stopMemorySlackPublicationPump();\n      stopMetricsIngestion?.();\n      stopHelloIngestion?.();\n      await stopTemporalScheduleCleanupPump();\n      await stopScheduledTaskLifecyclePump();\n      await stopWorkspaceWebhookDispatchPump();\n      await stopNativePushDispatchPump();\n      // Write queued presence before the database pool closes.\n      await routeDeps.userPresence?.close().catch(() => undefined);\n      await Promise.allSettled([\n        Promise.resolve(editableArtifactComposition?.close()),\n        authCalloutResponder?.close(),\n        bus.close(),\n        workflowClient.close(),\n        dbClient.close(),\n      ]);\n    },\n  };\n}\n\nif (import.meta.main) {\n  const fatalBoundary = installApiFatalProcessBoundary();\n  try {\n    const settings = getSettings();\n    const observability = createObservability(settings, { component: \"api\" });\n    fatalBoundary.attachObservability(observability);\n    await startApi({ settings, observability });\n    fatalBoundary.markRunning();\n  } catch (error) {\n    await fatalBoundary.reportStartupFailure(error);\n  }\n}\n\nexport function temporalOverlapPolicy(policy: ScheduledTaskOverlapPolicy): ScheduleOverlapPolicy {\n  if (policy === \"skip\") {\n    return ScheduleOverlapPolicy.SKIP;\n  }\n  if (policy === \"buffer_one\") {\n    return ScheduleOverlapPolicy.BUFFER_ONE;\n  }\n  return ScheduleOverlapPolicy.ALLOW_ALL;\n}\n\nexport function shouldCreateScheduleAfterUpdateError(error: unknown): boolean {\n  return error instanceof ScheduleNotFoundError;\n}\n\nexport function temporalScheduleSpec(schedule: ScheduledTaskScheduleSpec): ScheduleSpec {\n  if (schedule.type === \"manual\") {\n    throw new Error(\"manual scheduled tasks do not have a Temporal Schedule spec\");\n  }\n  if (schedule.type === \"interval\") {\n    return {\n      intervals: [temporalIntervalSpec(schedule)],\n      ...(schedule.startAt ? { startAt: new Date(schedule.startAt) } : {}),\n      ...(schedule.endAt ? { endAt: new Date(schedule.endAt) } : {}),\n    };\n  }\n  if (schedule.type === \"calendar\") {\n    return {\n      calendars: [\n        {\n          hour: schedule.hour,\n          minute: schedule.minute,\n          second: 0,\n          ...(schedule.daysOfWeek ? { dayOfWeek: schedule.daysOfWeek } : {}),\n        },\n      ],\n      timezone: schedule.timeZone,\n    };\n  }\n  const runAt = new Date(schedule.runAt);\n  return {\n    calendars: [\n      {\n        year: runAt.getUTCFullYear(),\n        month: temporalMonth(runAt.getUTCMonth()),\n        dayOfMonth: runAt.getUTCDate(),\n        hour: runAt.getUTCHours(),\n        minute: runAt.getUTCMinutes(),\n        second: runAt.getUTCSeconds(),\n      },\n    ],\n    timezone: \"UTC\",\n  };\n}\n\nfunction temporalIntervalSpec(\n  schedule: Extract<ScheduledTaskScheduleSpec, { type: \"interval\" }>,\n): NonNullable<ScheduleSpec[\"intervals\"]>[number] {\n  const every = `${schedule.everySeconds}s` as `${number}s`;\n  if (!schedule.startAt) {\n    return { every };\n  }\n\n  // Temporal interval schedules match Epoch + (n * every) + offset. Its\n  // top-level startAt only filters matching times before that boundary, so it\n  // does not itself anchor the cadence. Derive the phase from startAt to make\n  // the stored Opengeni timestamp the first interval boundary rather than the\n  // next epoch-aligned match.\n  const everyMilliseconds = BigInt(schedule.everySeconds) * 1_000n;\n  const startMilliseconds = BigInt(new Date(schedule.startAt).getTime());\n  const offsetMilliseconds =\n    ((startMilliseconds % everyMilliseconds) + everyMilliseconds) % everyMilliseconds;\n  return {\n    every,\n    ...(offsetMilliseconds === 0n ? {} : { offset: `${offsetMilliseconds}ms` as `${number}ms` }),\n  };\n}\n\nfunction temporalMonth(monthIndex: number) {\n  return TEMPORAL_MONTHS[monthIndex]!;\n}\n\nfunction temporalScheduleOptions(task: ScheduledTask, taskQueue: string): ScheduleOptions {\n  return {\n    scheduleId: task.temporalScheduleId,\n    spec: temporalScheduleSpec(task.schedule),\n    action: {\n      type: \"startWorkflow\",\n      workflowType: \"scheduledTaskFireWorkflow\",\n      taskQueue,\n      args: [\n        {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          taskId: task.id,\n          triggerType: \"scheduled\",\n        },\n      ],\n    },\n    policies: {\n      overlap: temporalOverlapPolicy(task.overlapPolicy),\n      catchupWindow: \"24h\",\n      pauseOnFailure: false,\n    },\n    state: {\n      paused: scheduledTaskEffectivelyPaused(task),\n      ...(task.schedule.type === \"once\" ? { remainingActions: 1 } : {}),\n    },\n    memo: {\n      accountId: task.accountId,\n      workspaceId: task.workspaceId,\n      scheduledTaskId: task.id,\n      name: task.name,\n    },\n  };\n}\n\nfunction scheduledTaskEffectivelyPaused(task: ScheduledTask): boolean {\n  if (task.status === \"paused\") return true;\n  if (!scheduledTaskKnowledgeSource(task)) return false;\n  const control = task.metadata.knowledgeSourceSync;\n  if (!control || typeof control !== \"object\") return false;\n  const record = control as Record<string, unknown>;\n  return record.sourceEnabled === false || record.connectionPaused === true;\n}\n\nfunction temporalScheduleUpdateOptions(options: ScheduleOptions): ScheduleUpdateOptions {\n  return {\n    spec: options.spec,\n    action: options.action,\n    ...(options.policies ? { policies: options.policies } : {}),\n    state: options.state ?? {},\n    ...(options.searchAttributes ? { searchAttributes: options.searchAttributes } : {}),\n    ...(options.typedSearchAttributes\n      ? { typedSearchAttributes: options.typedSearchAttributes }\n      : {}),\n  };\n}\n","import {\n  natsSubscriptionTerminationCounter,\n  type EventBusOptions,\n  type EventLogger,\n} from \"@opengeni/events\";\nimport type { Attributes, AttributeValue, Observability } from \"@opengeni/observability\";\n\n/** Logger plus the closed-label subscription-termination counter for NATS connections. */\nexport function observabilityEventBusOptions(\n  observability: Observability,\n): Pick<EventBusOptions, \"logger\" | \"onSubscriptionTerminated\"> {\n  return {\n    logger: observabilityEventLogger(observability),\n    onSubscriptionTerminated: natsSubscriptionTerminationCounter(observability),\n  };\n}\n\nexport function observabilityEventLogger(observability: Observability): EventLogger {\n  return {\n    debug: (message, attributes) => observability.debug(message, eventAttributes(attributes)),\n    warn: (message, attributes) => observability.warn(message, eventAttributes(attributes)),\n  };\n}\n\nfunction eventAttributes(attributes: Record<string, unknown> | undefined): Attributes | undefined {\n  if (!attributes) {\n    return undefined;\n  }\n  const projected: Attributes = {};\n  for (const [key, value] of Object.entries(attributes)) {\n    projected[key] = eventAttributeValue(value);\n  }\n  return projected;\n}\n\nfunction eventAttributeValue(value: unknown): AttributeValue {\n  if (\n    value === null ||\n    value === undefined ||\n    typeof value === \"string\" ||\n    typeof value === \"number\" ||\n    typeof value === \"boolean\"\n  ) {\n    return value;\n  }\n  try {\n    return JSON.stringify(value);\n  } catch {\n    return String(value);\n  }\n}\n","// apps/api/src/sandbox/auth-callout.ts — the NATS AUTH-CALLOUT responder (the\n// bring-your-own-compute M-AUTH tenancy boundary; NATS Accounts per\n// workspace + §17 the isolation smoke + §19 the NATS-Accounts-misconfig leak risk).\n//\n// THE BOUNDARY THIS CLOSES: an external agent connects to NATS presenting its\n// `oge_` enrollment bearer as the connect auth-token. nats-server (configured with\n// `auth_callout`) issues an authorization request on $SYS.REQ.USER.AUTH. THIS\n// responder:\n//   1. decodes the authorization request (the `user_nkey` the response must scope\n//      to, the `server_id` for the response `aud`, and the presented `auth_token`);\n//   2. VALIDATES the bearer with verifyEnrollmentBearer (HMAC, via\n//      resolveEnrollmentSigningSecret) — an invalid/expired/forged bearer is denied;\n//   3. confirms the enrollment is still ACTIVE in the DB at the exact credential\n//      generation (a revoked or re-enrolled machine denies an old bearer);\n//   4. atomically claims the daemon instance named in CONNECT;\n//   5. signs a NATS user JWT granting pub/sub ONLY that exact process subtree +\n//      `_INBOX.>` (deny-all-else by an allow-list) and returns it inside a signed\n//      authorization-response JWT.\n//\n// That exact scope is both the tenancy boundary and routing fence: workspace A\n// cannot reach B, and an old/duplicate process cannot subscribe to its successor's\n// work. nats-server enforces the signed permission set; the boundary does not rely\n// on naming alone.\n//\n// SECURITY (§18): the bearer value + the account signing seed are NEVER logged. A\n// validation failure → a DENIAL response (the server refuses the connection); a\n// responder error → the request is left UNANSWERED (fail-closed; the server denies\n// on its callout timeout). The bearer's `exp` caps the minted credential's life so a\n// revoked/expired enrollment cannot outlive its bearer.\n\nimport { createHash } from \"node:crypto\";\nimport { createLogThrottle, type LogThrottle } from \"@opengeni/observability\";\nimport {\n  resolveEnrollmentSigningSecret,\n  type NatsCalloutConfig,\n  type Settings,\n} from \"@opengeni/config\";\nimport { verifyEnrollmentBearer } from \"@opengeni/contracts\";\nimport { claimEnrollmentConnection, getEnrollment, type Database } from \"@opengeni/db\";\nimport {\n  createResponderConnection,\n  decodeAuthRequest,\n  mintAuthResponse,\n  mintUserJwt,\n  parseAgentConnectionName,\n  workspaceAgentPermissions,\n  type ResponderConnection,\n} from \"@opengeni/events\";\nimport type { Observability } from \"@opengeni/observability\";\nimport { observabilityEventBusOptions } from \"../observability\";\nimport { AGENT_CONNECTION_LEASE_MS } from \"./connection-authority\";\n\n/** The NATS subject nats-server publishes authorization requests on (ADR-26). */\nexport const AUTH_CALLOUT_SUBJECT = \"$SYS.REQ.USER.AUTH\";\n/** Keep live NATS credentials short-lived while never outliving the bearer. */\nexport const NATS_USER_JWT_TTL_SECONDS = 5 * 60;\nexport interface AuthCalloutDeps {\n  db: Database;\n  settings: Settings;\n  callout: NatsCalloutConfig;\n  observability?: Observability;\n  /** Bounds repeated denial warnings; defaults to one process-wide throttle. */\n  denialWarningThrottle?: LogThrottle;\n}\n\n/** A stale or revoked machine re-dials on its reconnect backoff forever, so an\n * unthrottled denial warning repeats every few seconds per machine. Log each\n * distinct machine's first denial, then at most once per interval with the\n * count of denials it hid. The denial decision itself is never throttled. */\nexport const AUTH_CALLOUT_DENIAL_WARNING_INTERVAL_MS = 60_000;\nconst processDenialWarningThrottle = createLogThrottle({\n  intervalMs: AUTH_CALLOUT_DENIAL_WARNING_INTERVAL_MS,\n  maxKeys: 1_024,\n});\n\n/** Closed denial vocabulary. The public log projection drops identifiers, so\n * `reason` is what tells an operator which throttle key a count belongs to. */\ntype AuthCalloutDenialReason = \"invalid_bearer\" | \"inactive_enrollment\" | \"duplicate_runner\";\n\nfunction warnDenial(\n  deps: AuthCalloutDeps,\n  key: string,\n  reason: AuthCalloutDenialReason,\n  message: string,\n  attributes: Record<string, string | number> = {},\n): void {\n  const admission = (deps.denialWarningThrottle ?? processDenialWarningThrottle).admit(key);\n  if (!admission) return;\n  deps.observability?.warn?.(message, {\n    ...attributes,\n    reason,\n    ...(admission.suppressedCount > 0 ? { suppressedCount: admission.suppressedCount } : {}),\n  });\n}\n\n/** Closed reasons a Connected Machine agent's NATS connect is refused. */\ntype MachineConnectDenialReason =\n  | \"undecodable\"\n  | \"missing_bearer\"\n  | \"plane_disabled\"\n  | \"invalid_bearer\"\n  | \"inactive_enrollment\"\n  | \"identity_mismatch\"\n  | \"generation_mismatch\"\n  | \"invalid_instance\"\n  | \"duplicate_runner\";\n\n/** Count every machine connect decision; identifiers never become labels. */\nfunction recordMachineConnect(\n  deps: AuthCalloutDeps,\n  outcome: \"granted\" | \"denied\",\n  reason: MachineConnectDenialReason | \"none\",\n): void {\n  try {\n    deps.observability?.incrementCounter({\n      name: \"opengeni_machine_connect_total\",\n      help: \"Connected Machine agent NATS connect decisions (auth callout) by outcome and closed denial reason.\",\n      labels: { outcome, reason },\n    });\n  } catch {\n    // Telemetry never changes the signed connect decision.\n  }\n}\n\n/** A process-local dedupe key for a rejected bearer. The digest is never\n * logged, and the bearer value never leaves this function. */\nfunction rejectedBearerKey(bearer: string): string {\n  return `invalid-bearer:${createHash(\"sha256\").update(bearer).digest(\"hex\").slice(0, 32)}`;\n}\n\n/**\n * The pure validate→scoped-JWT decision, isolated from the NATS transport so it is\n * unit-testable. Given the raw authorization-request JWT bytes, returns the signed\n * authorization-response JWT bytes to reply with — a GRANT (embedding a scoped user\n * JWT) on success, a DENIAL (carrying `nats.error`, no user JWT) otherwise. NEVER\n * throws on a bad/invalid request: every failure becomes a signed denial (the\n * server then refuses the connection cleanly).\n */\nexport async function handleAuthorizationRequest(\n  deps: AuthCalloutDeps,\n  requestBytes: Uint8Array,\n): Promise<Uint8Array> {\n  const requestJwt = Buffer.from(requestBytes).toString(\"utf8\");\n  const decoded = decodeAuthRequest(requestJwt);\n  if (!decoded) {\n    // A malformed request we cannot even read the user_nkey/server_id from — there\n    // is nothing to scope a response to. Leave it for the server's timeout by\n    // throwing (the transport leaves it unanswered, fail-closed).\n    deps.observability?.warn?.(\"auth-callout: undecodable authorization request\", {});\n    recordMachineConnect(deps, \"denied\", \"undecodable\");\n    throw new Error(\"undecodable authorization request\");\n  }\n\n  const deny = (code: MachineConnectDenialReason, reason: string): Uint8Array => {\n    recordMachineConnect(deps, \"denied\", code);\n    // A SIGNED denial: the server reads `nats.error` and refuses the connection.\n    const response = mintAuthResponse({\n      userPublicKey: decoded.userNkey,\n      serverId: decoded.serverId,\n      accountSeed: deps.callout.accountSeed,\n      error: reason,\n    });\n    return Buffer.from(response, \"utf8\");\n  };\n\n  const bearer = decoded.authToken;\n  if (!bearer) {\n    return deny(\"missing_bearer\", \"missing enrollment bearer\");\n  }\n\n  const secret = resolveEnrollmentSigningSecret(deps.settings);\n  if (!secret) {\n    // The credential plane is off for this deployment — deny rather than mint an\n    // unscoped credential. (The responder should not even be running in this case,\n    // but fail-closed regardless.)\n    return deny(\"plane_disabled\", \"enrollment credential plane disabled\");\n  }\n\n  const claims = await verifyEnrollmentBearer(secret, bearer);\n  if (!claims) {\n    // Invalid signature / malformed / expired bearer. NEVER log the bearer value.\n    warnDenial(\n      deps,\n      rejectedBearerKey(bearer),\n      \"invalid_bearer\",\n      \"auth-callout: rejected an invalid enrollment bearer\",\n    );\n    return deny(\"invalid_bearer\", \"invalid or expired enrollment bearer\");\n  }\n\n  // Confirm the enrollment is still ACTIVE — a revoked machine is denied even with a\n  // still-unexpired bearer (the revoke path flips status; this re-checks at connect).\n  const enrollment = await getEnrollment(deps.db, claims.workspaceId, claims.enrollmentId);\n  if (!enrollment || enrollment.status !== \"active\") {\n    warnDenial(\n      deps,\n      `inactive:${claims.workspaceId}:${claims.agentId}`,\n      \"inactive_enrollment\",\n      \"auth-callout: denied a revoked or unknown enrollment\",\n      { workspaceId: claims.workspaceId, agentId: claims.agentId },\n    );\n    return deny(\"inactive_enrollment\", \"enrollment is not active\");\n  }\n\n  // Belt-and-braces: the bearer's agentId/enrollmentId must match the row we found.\n  // (verifyEnrollmentBearer already binds them; this guards a future schema where\n  // agentId != enrollmentId.)\n  if (\n    enrollment.workspaceId !== claims.workspaceId ||\n    enrollment.id !== claims.enrollmentId ||\n    enrollment.id !== claims.agentId ||\n    claims.agentId !== claims.enrollmentId ||\n    claims.subjectPrefix !== `agent.${claims.workspaceId}.${claims.agentId}`\n  ) {\n    return deny(\"identity_mismatch\", \"enrollment identity mismatch\");\n  }\n  if (enrollment.credentialGeneration !== claims.credentialGeneration) {\n    return deny(\"generation_mismatch\", \"enrollment credential generation mismatch\");\n  }\n\n  const connectionInstanceId = parseAgentConnectionName(decoded.name);\n  if (!connectionInstanceId) {\n    return deny(\"invalid_instance\", \"missing or invalid agent connection instance\");\n  }\n  const claim = await claimEnrollmentConnection(deps.db, {\n    workspaceId: claims.workspaceId,\n    enrollmentId: claims.enrollmentId,\n    credentialGeneration: claims.credentialGeneration,\n    connectionInstanceId,\n    leaseMs: AGENT_CONNECTION_LEASE_MS,\n  });\n  if (!claim.claimed) {\n    warnDenial(\n      deps,\n      `duplicate:${claims.workspaceId}:${claims.agentId}`,\n      \"duplicate_runner\",\n      \"auth-callout: denied a duplicate live runner\",\n      { workspaceId: claims.workspaceId, agentId: claims.agentId },\n    );\n    return deny(\"duplicate_runner\", \"another runner instance currently owns this enrollment\");\n  }\n\n  // GRANT: the operational subject includes the exact claimed process instance.\n  // A previous socket may remain open until its short JWT expires, but no control\n  // request is routed to its old subject after a successor claims authority.\n  const permissions = workspaceAgentPermissions(\n    claims.workspaceId,\n    claims.agentId,\n    connectionInstanceId,\n  );\n  const nowSeconds = Math.floor(Date.now() / 1000);\n  const userJwt = mintUserJwt({\n    userPublicKey: decoded.userNkey,\n    accountSeed: deps.callout.accountSeed,\n    name: claims.agentId,\n    permissions,\n    // Server-config-mode placement: the embedded user JWT's `aud` is the account\n    // the user binds to (the configured `auth_callout.account`). All agents +\n    // the privileged control plane share this account so subjects route; the\n    // per-workspace isolation is carried by the subject permissions above.\n    audienceAccount: deps.callout.accountName,\n    // Tie the credential's life to the bearer's remaining life: a revoked/expired\n    // enrollment cannot outlive its bearer at the NATS layer either.\n    expiresAtSeconds: Math.min(claims.exp, nowSeconds + NATS_USER_JWT_TTL_SECONDS),\n  });\n  const response = mintAuthResponse({\n    userPublicKey: decoded.userNkey,\n    serverId: decoded.serverId,\n    accountSeed: deps.callout.accountSeed,\n    userJwt,\n  });\n  recordMachineConnect(deps, \"granted\", \"none\");\n  deps.observability?.info?.(\"auth-callout: granted a workspace-scoped NATS credential\", {\n    workspaceId: claims.workspaceId,\n    agentId: claims.agentId,\n    connectionGeneration: claim.connectionGeneration,\n  });\n  return Buffer.from(response, \"utf8\");\n}\n\n/**\n * Start the auth-callout responder: open a SEPARATE NATS connection authenticated\n * as the callout `auth_users` user, subscribe $SYS.REQ.USER.AUTH, and answer every\n * authorization request via {@link handleAuthorizationRequest}. Returns a handle\n * whose `close()` drains the connection. Gated by the caller (sandboxSelfhostedEnabled\n * + a resolvable callout config); a deployment without the callout plane never starts\n * it.\n */\nexport async function startAuthCalloutResponder(\n  deps: AuthCalloutDeps,\n  natsUrl: string,\n): Promise<ResponderConnection> {\n  const connection = await createResponderConnection(\n    natsUrl,\n    { kind: \"user-password\", user: deps.callout.user, pass: deps.callout.password },\n    AUTH_CALLOUT_SUBJECT,\n    (bytes) => handleAuthorizationRequest(deps, bytes),\n    {\n      name: \"opengeni-auth-callout\",\n      ...(deps.observability ? observabilityEventBusOptions(deps.observability) : {}),\n    },\n  );\n  deps.observability?.info?.(\"Opengeni NATS auth-callout responder started\", {\n    subject: AUTH_CALLOUT_SUBJECT,\n  });\n  return connection;\n}\n","/** Five-second heartbeats get four missed intervals before another daemon may\n * claim the enrollment. Server time is authoritative. */\nexport const AGENT_CONNECTION_LEASE_MS = 20_000;\n","// apps/api/src/sandbox/metrics-ingestion.ts — the M10 metrics INGESTION consumer\n// + the connect-Hello DISPLAY-REFRESH consumer. The\n// enrolled agent piggybacks a `MetricsSample` on its ~5s heartbeat (an\n// `AgentEvent` published one-way on the exact process events subject) and publishes a\n// `Hello` (its live self-description) on the exact process hello subject on every connect\n// /reconnect. This module owns the two agent→control-plane inbound consumers:\n//\n//   `agent.*.*.connection.*.events` (heartbeat) →\n//     1. touchEnrollmentLastSeen  — the liveness cursor (online/reconnecting/offline\n//        derivation + the M3 probe disambiguation).\n//     2. ingestMachineMetricsSample — UPSERT machine_metrics_latest (the \"now\" row)\n//        + APPEND a machine_metrics_series row downsampled to ~1/min.\n//     A GOING-OFFLINE event is not a metrics point — liveness flips via the lease/\n//     probe path; we skip it here (no-op).\n//\n//   `agent.*.*.connection.*.hello` (connect) →\n//     refreshEnrollmentDisplay — reconcile `enrollments.has_display` to the LIVE\n//     capability the Hello reports. `has_display` was previously FROZEN at the\n//     enroll-time offer snapshot; a machine that GAINS a display later (a Mac that\n//     grants Screen Recording, a box whose Xvfb starts) or LOSES one never\n//     re-surfaced. Consuming the Hello's `capabilities.desktop` / `display` makes\n//     `has_display` track reality (both directions), which the desktop-capability\n//     gate (packages/runtime capabilities.ts) keys off.\n//     refreshEnrollmentOpStream — reconcile `enrollments.op_stream` to the LIVE\n//     runner capability the Hello reports. Exec is unavailable unless the runner\n//     advertises the streaming engine.\n//\n// Both consumers are BEST-EFFORT and fail-soft: a decode/DB error for one message\n// is logged + swallowed (the bus subscription already swallows handler throws) so\n// a metrics blip / a display-refresh write failure never tears down the consumer,\n// back-pressures the agent, or breaks its connect. Event ingestion drains the NATS\n// subscription immediately into exact-subject queues: different runner connections\n// progress concurrently, one runner's ordering is preserved, and consecutive queued\n// heartbeats collapse latest-wins. A delayed heartbeat backlog therefore cannot keep\n// renewing a dead runner's short connection lease one stale message at a time.\n\nimport {\n  clearEnrollmentWentOffline,\n  disconnectAttachedBrowserDevices,\n  advanceEnrollmentAgentUpdate,\n  enrollmentMacPermissionCapabilities,\n  enrollmentMacPermissions,\n  getEnrollment,\n  getLiveEnrollmentConnection,\n  ingestMachineMetricsSample,\n  reconcileAttachedBrowserInventory,\n  releaseEnrollmentConnection,\n  renewEnrollmentConnection,\n  sessionsWithActiveOpOnEnrollment,\n  setEnrollmentDisplayState,\n  setEnrollmentAgentRuntime,\n  setEnrollmentOpStreamState,\n  type AppendEventInput,\n  type Database,\n  type EnrollmentMacPermissions,\n  type MachineMetricsSample,\n} from \"@opengeni/db\";\nimport {\n  AttachedBrowserConnectionEnd as AttachedBrowserConnectionEndContract,\n  AttachedBrowserInventorySnapshot as AttachedBrowserInventoryContract,\n  type AttachedBrowserInventorySnapshot as AttachedBrowserInventoryContractValue,\n  type AttachedBrowserConnectionEnd as AttachedBrowserConnectionEndValue,\n} from \"@opengeni/contracts\";\nimport { appendAndPublishEvents, type EventBus } from \"@opengeni/events\";\nimport type { Observability } from \"@opengeni/observability\";\nimport { normalizeConnectedMachineWorkspaceRoot } from \"@opengeni/runtime/sandbox\";\nimport type { AutomaticAgentUpdater } from \"./agent-update\";\nimport {\n  AgentEvent,\n  AgentUpdateStage,\n  Arch,\n  AttachedBrowserConnectionEndReason as WireConnectionEndReason,\n  GoingOfflineReason,\n  Hello,\n  Os,\n  goingOfflineReasonToJSON,\n  type AttachedBrowserConnectionEnd as WireAttachedBrowserConnectionEnd,\n  type AttachedBrowserInventorySnapshot as WireAttachedBrowserInventorySnapshot,\n  type MetricsSample,\n} from \"@opengeni/agent-proto\";\nimport { AGENT_CONNECTION_LEASE_MS } from \"./connection-authority\";\nimport { reconcileScreenControlOnHello } from \"./screen-control\";\n\n/** The wildcard subject the agent event plane publishes heartbeats on. */\nexport const AGENT_EVENTS_SUBJECT = \"agent.*.*.connection.*.events\";\n\n/** The wildcard subject the agent publishes its connect Hello on. */\nexport const AGENT_HELLO_SUBJECT = \"agent.*.*.connection.*.hello\";\n\ntype QueuedAgentEvent = {\n  payload: Uint8Array;\n  subject: string;\n  heartbeat: boolean;\n};\n\ntype AgentEventQueueState = {\n  scheduled: boolean;\n  pending: QueuedAgentEvent[];\n};\n\ntype ScheduledAgentEventQueue = {\n  subject: string;\n  state: AgentEventQueueState;\n};\n\nexport type AgentEventIngestionScheduler = {\n  enqueue: (payload: Uint8Array, subject: string) => void;\n  whenIdle: () => Promise<void>;\n  close: () => void;\n};\n\nfunction payloadIsHeartbeat(payload: Uint8Array): boolean {\n  try {\n    return AgentEvent.decode(payload).event?.$case === \"heartbeat\";\n  } catch {\n    // Preserve the normal decoder/logging path for malformed events. They are\n    // barriers rather than heartbeat-coalescing candidates.\n    return false;\n  }\n}\n\n/**\n * Drain agent events without making every Connected Machine wait behind one\n * deployment-wide serial DB queue. Each exact process subject retains FIFO order;\n * separate subjects drain concurrently. Consecutive pending heartbeats for one\n * subject are latest-wins because they are point-in-time liveness/metrics samples,\n * while GoingOffline and update-progress events remain ordered barriers.\n */\nexport function createAgentEventIngestionScheduler(\n  handler: (payload: Uint8Array, subject: string) => void | Promise<void>,\n  options: { maxConcurrentSubjects?: number; onHeartbeatCoalesced?: () => void } = {},\n): AgentEventIngestionScheduler {\n  const maxConcurrentSubjects = options.maxConcurrentSubjects ?? 32;\n  if (!Number.isSafeInteger(maxConcurrentSubjects) || maxConcurrentSubjects <= 0) {\n    throw new RangeError(\"maxConcurrentSubjects must be a positive safe integer\");\n  }\n\n  const states = new Map<string, AgentEventQueueState>();\n  const readySubjects: ScheduledAgentEventQueue[] = [];\n  const idleWaiters = new Set<() => void>();\n  let accepting = true;\n  let activeSubjects = 0;\n\n  const resolveIdleWaiters = (): void => {\n    if (states.size !== 0) return;\n    for (const resolve of idleWaiters) resolve();\n    idleWaiters.clear();\n  };\n\n  async function drain(subject: string, state: AgentEventQueueState): Promise<void> {\n    while (true) {\n      const event = state.pending.shift();\n      if (!event) break;\n      try {\n        await handler(event.payload, event.subject);\n      } catch {\n        // Agent-event ingestion is best-effort. One bad event must not strand the\n        // exact-subject queue or prevent later heartbeats from restoring liveness.\n      }\n    }\n\n    activeSubjects -= 1;\n    state.scheduled = false;\n    if (state.pending.length > 0) {\n      schedule(subject, state);\n    } else {\n      if (states.get(subject) === state) states.delete(subject);\n      resolveIdleWaiters();\n    }\n    pump();\n  }\n\n  function pump(): void {\n    while (activeSubjects < maxConcurrentSubjects) {\n      const next = readySubjects.shift();\n      if (!next) return;\n      if (states.get(next.subject) !== next.state || !next.state.scheduled) continue;\n      activeSubjects += 1;\n      void drain(next.subject, next.state);\n    }\n  }\n\n  function schedule(subject: string, state: AgentEventQueueState): void {\n    if (state.scheduled) return;\n    state.scheduled = true;\n    readySubjects.push({ subject, state });\n    pump();\n  }\n\n  return {\n    enqueue(payload, subject) {\n      if (!accepting) return;\n      const heartbeat = payloadIsHeartbeat(payload);\n      let state = states.get(subject);\n      if (!state) {\n        state = { scheduled: false, pending: [] };\n        states.set(subject, state);\n      }\n\n      const queued = { payload, subject, heartbeat };\n      const lastIndex = state.pending.length - 1;\n      if (heartbeat && lastIndex >= 0 && state.pending[lastIndex]!.heartbeat) {\n        state.pending[lastIndex] = queued;\n        options.onHeartbeatCoalesced?.();\n      } else {\n        state.pending.push(queued);\n      }\n\n      schedule(subject, state);\n    },\n    async whenIdle() {\n      if (states.size === 0) return;\n      await new Promise<void>((resolve) => idleWaiters.add(resolve));\n    },\n    close() {\n      accepting = false;\n      for (const state of states.values()) {\n        state.pending.length = 0;\n      }\n      resolveIdleWaiters();\n    },\n  };\n}\n\n/**\n * Parse `agent.<ws>.<id>.connection.<instance>.<tail>` into its exact authority,\n * expected tail token. Returns null for a subject that does not match the shape\n * (defensive — the subscription pattern already constrains it).\n */\nfunction parseAgentSubject(\n  subject: string,\n  tail: \"events\" | \"hello\",\n): { workspaceId: string; agentId: string; connectionInstanceId: string } | null {\n  const parts = subject.split(\".\");\n  if (\n    parts.length !== 6 ||\n    parts[0] !== \"agent\" ||\n    parts[3] !== \"connection\" ||\n    !parts[4] ||\n    parts[5] !== tail\n  ) {\n    return null;\n  }\n  return {\n    workspaceId: parts[1]!,\n    agentId: parts[2]!,\n    connectionInstanceId: parts[4]!,\n  };\n}\n\n/** Parse the exact process events subject (heartbeat plane). */\nexport function parseAgentEventSubject(\n  subject: string,\n): { workspaceId: string; agentId: string; connectionInstanceId: string } | null {\n  return parseAgentSubject(subject, \"events\");\n}\n\n/** Parse the exact process hello subject (connect plane). */\nexport function parseAgentHelloSubject(\n  subject: string,\n): { workspaceId: string; agentId: string; connectionInstanceId: string } | null {\n  return parseAgentSubject(subject, \"hello\");\n}\n\n/**\n * Project a wire `MetricsSample` (proto, ms-stamped, GPU as a repeated list) to\n * the DB `MachineMetricsSample`. The proto byte/count fields are protobuf-encoded\n * as decimal strings (uint64) on the TS side (ts-proto `string`); coerce to\n * numbers. The DB carries a single `gpuUtilPercent` + `gpuMemUsedBytes`/Total —\n * we take the FIRST GPU (the dashboard surfaces the primary accelerator); absent\n * GPUs stay null (the not-reported contract). A zero on a non-GPU field is the\n * agent's \"not reported\" (we keep it null-friendly via `nullIfZero` only for the\n * GPU plane; cpu/mem/disk 0 is a legitimate reading the dashboard shows as 0).\n */\nexport function wireSampleToDbSample(wire: MetricsSample): MachineMetricsSample {\n  const num = (v: string | number): number => (typeof v === \"number\" ? v : Number(v));\n  const firstGpu = wire.gpus[0];\n  return {\n    cpuPercent: wire.cpuPercent,\n    load1: wire.load1,\n    load5: wire.load5,\n    load15: wire.load15,\n    memUsedBytes: num(wire.memUsedBytes),\n    memTotalBytes: num(wire.memTotalBytes),\n    diskUsedBytes: num(wire.diskUsedBytes),\n    diskTotalBytes: num(wire.diskTotalBytes),\n    gpuUtilPercent: firstGpu ? firstGpu.utilPercent : null,\n    gpuMemUsedBytes: firstGpu ? num(firstGpu.memUsedBytes) : null,\n    gpuMemTotalBytes: firstGpu ? num(firstGpu.memTotalBytes) : null,\n    contention: wire.runQueue,\n    // The sample carries its own wall-clock stamp (epoch ms); fall back to now on\n    // a missing/zero stamp so a series row is never NULL-dated.\n    sampledAt:\n      wire.sampledAtMs && Number(wire.sampledAtMs) > 0\n        ? new Date(Number(wire.sampledAtMs))\n        : new Date(),\n  };\n}\n\n/** Validate and project one wire inventory before it reaches durable browser\n *  discovery. Unknown enum values and unsafe uint64 counters reject the whole\n *  authoritative snapshot instead of partially disconnecting good endpoints. */\nexport function wireAttachedBrowserInventoryToContract(\n  wire: WireAttachedBrowserInventorySnapshot,\n): AttachedBrowserInventoryContractValue {\n  return AttachedBrowserInventoryContract.parse({\n    bridgeGeneration: wire.bridgeGeneration,\n    revision: safeWireInteger(wire.revision, \"browser inventory revision\"),\n    devices: wire.devices.map((device) => ({\n      id: device.id,\n      name: device.name,\n      profileLabel: device.profileLabel.trim() || null,\n      browserName: device.browserName,\n      browserVersion: device.browserVersion,\n      extensionVersion: device.extensionVersion,\n      platform: wireBrowserPlatform(device.platform),\n      architecture: wireBrowserArchitecture(device.arch),\n      connectionGeneration: device.connectionGeneration,\n      inventoryRevision: safeWireInteger(\n        device.inventoryRevision,\n        \"attached browser inventory revision\",\n      ),\n      tabCount: safeWireInteger(device.tabCount, \"attached browser tab count\"),\n      capabilities: device.capabilities,\n    })),\n    connectionEnds: (wire.connectionEnds ?? []).flatMap(wireConnectionEndToContract),\n  });\n}\n\nconst WIRE_CONNECTION_END_REASONS = new Map<\n  WireConnectionEndReason,\n  AttachedBrowserConnectionEndValue[\"reason\"]\n>([\n  [\n    WireConnectionEndReason.ATTACHED_BROWSER_CONNECTION_END_REASON_BROWSER_CLOSED_PORT,\n    \"browser_closed_port\",\n  ],\n  [\n    WireConnectionEndReason.ATTACHED_BROWSER_CONNECTION_END_REASON_BROWSER_MESSAGE_INVALID,\n    \"browser_message_invalid\",\n  ],\n  [\n    WireConnectionEndReason.ATTACHED_BROWSER_CONNECTION_END_REASON_BROWSER_OUTPUT_FAILED,\n    \"browser_output_failed\",\n  ],\n  [\n    WireConnectionEndReason.ATTACHED_BROWSER_CONNECTION_END_REASON_NATIVE_HOST_LOST,\n    \"native_host_lost\",\n  ],\n  [WireConnectionEndReason.ATTACHED_BROWSER_CONNECTION_END_REASON_AGENT_REJECTED, \"agent_rejected\"],\n]);\n\n/** Connection ends are diagnostics. One the contract cannot hold (a future\n *  reason, or the generation of a hello the bridge rejected as malformed) is\n *  dropped instead of rejecting the authoritative device inventory. */\nfunction wireConnectionEndToContract(\n  wire: WireAttachedBrowserConnectionEnd,\n): AttachedBrowserConnectionEndValue[] {\n  const reason = WIRE_CONNECTION_END_REASONS.get(wire.reason);\n  const endedAtMs = Number(wire.endedAtUnixMs);\n  if (!reason || !Number.isSafeInteger(endedAtMs) || endedAtMs <= 0) return [];\n  const parsed = AttachedBrowserConnectionEndContract.safeParse({\n    deviceId: wire.deviceId,\n    connectionGeneration: wire.connectionGeneration,\n    reason,\n    detail: wire.detail.slice(0, 512) || null,\n    endedAt: new Date(endedAtMs).toISOString(),\n    connectedMs: Math.min(Number(wire.connectedMs) || 0, Number.MAX_SAFE_INTEGER),\n  });\n  return parsed.success ? [parsed.data] : [];\n}\n\nfunction safeWireInteger(value: string | number, label: string): number {\n  let parsed: bigint;\n  try {\n    parsed = BigInt(value);\n  } catch {\n    throw new Error(`${label} is not an integer`);\n  }\n  if (parsed < 0n || parsed > BigInt(Number.MAX_SAFE_INTEGER)) {\n    throw new Error(`${label} is outside the safe integer range`);\n  }\n  return Number(parsed);\n}\n\nfunction wireBrowserPlatform(platform: Os): \"linux\" | \"macos\" | \"windows\" {\n  switch (platform) {\n    case Os.OS_LINUX:\n      return \"linux\";\n    case Os.OS_MACOS:\n      return \"macos\";\n    case Os.OS_WINDOWS:\n      return \"windows\";\n    default:\n      throw new Error(\"attached browser platform is unspecified or unsupported\");\n  }\n}\n\nfunction wireBrowserArchitecture(architecture: Arch): \"x64\" | \"arm64\" {\n  switch (architecture) {\n    case Arch.ARCH_X86_64:\n      return \"x64\";\n    case Arch.ARCH_AARCH64:\n      return \"arm64\";\n    default:\n      throw new Error(\"attached browser architecture is unspecified or unsupported\");\n  }\n}\n\nasync function ingestAttachedBrowserInventory(\n  db: Database,\n  input: {\n    workspaceId: string;\n    agentId: string;\n    inventory: WireAttachedBrowserInventorySnapshot;\n  },\n): Promise<void> {\n  const enrollment = await getEnrollment(db, input.workspaceId, input.agentId);\n  if (!enrollment) return;\n  await reconcileAttachedBrowserInventory(db, {\n    accountId: enrollment.accountId,\n    workspaceId: input.workspaceId,\n    enrollmentId: input.agentId,\n    snapshot: wireAttachedBrowserInventoryToContract(input.inventory),\n  });\n}\n\n/**\n * Ingest the OPTIONAL metrics sample carried by an already-authorized heartbeat.\n * Connection renewal is deliberately owned by the outer event handler and runs\n * before optional telemetry/inventory work, so telemetry absence or failure can\n * never make a healthy runner lose authority.\n */\nasync function ingestHeartbeatMetrics(\n  db: Database,\n  input: {\n    accountId: string;\n    workspaceId: string;\n    agentId: string;\n    sample: MetricsSample;\n  },\n): Promise<{ ingested: boolean; seriesAppended: boolean }> {\n  const sample = wireSampleToDbSample(input.sample);\n  const result = await ingestMachineMetricsSample(db, {\n    accountId: input.accountId,\n    workspaceId: input.workspaceId,\n    enrollmentId: input.agentId,\n    sample,\n  });\n  return { ingested: true, seriesAppended: result.seriesAppended };\n}\n\n/**\n * Fan out one or more machine-LINK session events to the sessions that had an\n * active op running on the machine when its control link changed (per\n * `sessionsWithActiveOpOnEnrollment`) — the announce-only failure-visibility\n * plane. Each session's events are stamped on its OWN active turn. No matching\n * session ⇒ nothing is emitted (an idle-machine blip must never spam idle /\n * historical sessions). Called best-effort inside the handlers' fail-soft blocks.\n *\n * Each session's emission is ISOLATED: one session's append failing (a\n * session-specific constraint like a sequence collision from a racing writer, a\n * transient write error) is logged with that sessionId and skipped, never\n * aborting the fan-out — one session's failure must never cost the OTHER matching\n * sessions their events. A partial fan-out stays visible per-session in the logs.\n */\nasync function fanOutMachineLinkEvents(\n  db: Database,\n  bus: EventBus,\n  observability: Observability | undefined,\n  workspaceId: string,\n  enrollmentId: string,\n  build: (activeTurnId: string) => AppendEventInput[],\n): Promise<void> {\n  const sessions = await sessionsWithActiveOpOnEnrollment(db, { workspaceId, enrollmentId });\n  for (const session of sessions) {\n    try {\n      await appendAndPublishEvents(\n        db,\n        bus,\n        workspaceId,\n        session.sessionId,\n        build(session.activeTurnId),\n      );\n    } catch (error) {\n      observability?.warn?.(\"Failed to fan out a machine-link event to a session\", {\n        workspaceId,\n        sessionId: session.sessionId,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n}\n\n/**\n * Decode a raw `AgentEvent` payload + ingest it (the per-message handler). A\n * heartbeat carrying a metrics sample is ingested; a going-offline records the\n * machine-plane marker + fans out the link-plane session events. Decode failures\n * are reported + swallowed. `bus` (when present) enables the session-event\n * fan-out; the live consumer always supplies it, pure unit tests may omit it.\n */\nexport async function handleAgentEventPayload(\n  db: Database,\n  observability: Observability | undefined,\n  payload: Uint8Array,\n  subject: string,\n  bus?: EventBus,\n  agentUpdates?: AutomaticAgentUpdater | null,\n): Promise<void> {\n  const ids = parseAgentEventSubject(subject);\n  if (!ids) {\n    return;\n  }\n  let event: AgentEvent;\n  try {\n    event = AgentEvent.decode(payload);\n  } catch (error) {\n    observability?.warn?.(\"Failed to decode an agent event for metrics ingestion\", {\n      subject,\n      error: error instanceof Error ? error.message : String(error),\n    });\n    return;\n  }\n  // A clean GoingOffline is the machine-plane's typed shutdown signal. Two things\n  // happen, in this order:\n  //   1. Record it ALWAYS on the machine plane (a Prometheus counter keyed by the\n  //      typed reason) so a fleet operator can see clean stops / self-updates /\n  //      host shutdowns. This fires unconditionally, independent of the DB.\n  //   2. Stamp the enrollment's clean going-offline marker so the liveness\n  //      derivation reads the machine OFFLINE immediately instead of waiting out\n  //      the last_seen dead-detect window. Best-effort + fail-soft (like the rest\n  //      of this module): an unknown enrollment is a no-op and a DB error is\n  //      swallowed so a bad write never tears down the consumer. Deliberately does\n  //      NOT touch last-seen (a shutdown must not look \"more recently alive\").\n  if (event.event?.$case === \"goingOffline\") {\n    const reason = goingOfflineReasonToJSON(event.event.goingOffline.reason);\n    observability?.incrementCounter({\n      name: \"opengeni_machine_going_offline_total\",\n      help: \"Total Connected Machine clean GoingOffline signals by typed reason.\",\n      labels: { reason },\n    });\n    try {\n      const enrollment = await getEnrollment(db, ids.workspaceId, ids.agentId);\n      if (enrollment) {\n        const released = await releaseEnrollmentConnection(db, {\n          accountId: enrollment.accountId,\n          workspaceId: ids.workspaceId,\n          enrollmentId: ids.agentId,\n          connectionInstanceId: ids.connectionInstanceId,\n          reason,\n        });\n        // A late goodbye from a superseded process is not the current machine\n        // going offline. It must not disconnect browsers or fan out link loss.\n        if (!released.released) return;\n        try {\n          await disconnectAttachedBrowserDevices(db, {\n            accountId: enrollment.accountId,\n            workspaceId: ids.workspaceId,\n            enrollmentId: ids.agentId,\n          });\n        } catch (error) {\n          observability?.warn?.(\"Failed to disconnect attached browsers with their machine\", {\n            subject,\n            error: error instanceof Error ? error.message : String(error),\n          });\n        }\n        // Fan out the link-plane events to the sessions with an active op on this\n        // machine: machine.link.lost (its control link is going away) for every\n        // clean going-offline, PLUS machine.runner.restarted when the reason is a\n        // self-update restart specifically (link.lost fires for it too; this\n        // distinguishes a restart from a plain stop / host shutdown).\n        if (bus) {\n          const isSelfUpdate =\n            event.event.goingOffline.reason === GoingOfflineReason.GOING_OFFLINE_REASON_UPDATE;\n          await fanOutMachineLinkEvents(\n            db,\n            bus,\n            observability,\n            ids.workspaceId,\n            ids.agentId,\n            (activeTurnId) => {\n              const events: AppendEventInput[] = [\n                { type: \"machine.link.lost\", turnId: activeTurnId, payload: { reason } },\n              ];\n              if (isSelfUpdate) {\n                events.push({\n                  type: \"machine.runner.restarted\",\n                  turnId: activeTurnId,\n                  payload: {},\n                });\n              }\n              return events;\n            },\n          );\n        }\n      }\n    } catch (error) {\n      observability?.warn?.(\"Failed to record a machine clean going-offline\", {\n        subject,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n    return;\n  }\n  if (event.event?.$case === \"agentUpdateProgress\") {\n    const enrollment = await getEnrollment(db, ids.workspaceId, ids.agentId).catch(() => null);\n    if (!enrollment || enrollment.connectionInstanceId !== ids.connectionInstanceId) return;\n    const progress = event.event.agentUpdateProgress;\n    const status = (() => {\n      switch (progress.stage) {\n        case AgentUpdateStage.AGENT_UPDATE_STAGE_ACCEPTED:\n          return \"accepted\" as const;\n        case AgentUpdateStage.AGENT_UPDATE_STAGE_WAITING_FOR_IDLE:\n          return \"waiting_for_idle\" as const;\n        case AgentUpdateStage.AGENT_UPDATE_STAGE_DOWNLOADING:\n          return \"downloading\" as const;\n        case AgentUpdateStage.AGENT_UPDATE_STAGE_VERIFYING:\n          return \"verifying\" as const;\n        case AgentUpdateStage.AGENT_UPDATE_STAGE_APPLYING:\n          return \"applying\" as const;\n        case AgentUpdateStage.AGENT_UPDATE_STAGE_RESTARTING:\n          return \"restarting\" as const;\n        case AgentUpdateStage.AGENT_UPDATE_STAGE_FAILED:\n          return \"failed\" as const;\n        default:\n          return null;\n      }\n    })();\n    if (!status) return;\n    try {\n      await advanceEnrollmentAgentUpdate(db, {\n        accountId: enrollment.accountId,\n        workspaceId: ids.workspaceId,\n        enrollmentId: ids.agentId,\n        connectionInstanceId: ids.connectionInstanceId,\n        connectionGeneration: enrollment.connectionGeneration,\n        operationId: progress.operationId,\n        status,\n        expectedBinarySha256: /^[0-9a-f]{64}$/.test(progress.expectedBinarySha256)\n          ? progress.expectedBinarySha256\n          : null,\n        errorCode: progress.errorCode || null,\n        retryable: progress.retryable,\n        rolledBack: progress.rolledBack,\n      });\n    } catch (error) {\n      observability?.warn?.(\"Failed to ingest a machine self-update progress event\", {\n        subject,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n    return;\n  }\n  if (event.event?.$case !== \"heartbeat\") {\n    return; // an unknown event kind → not a metrics point.\n  }\n  const heartbeat = event.event.heartbeat;\n  const enrollment = await getEnrollment(db, ids.workspaceId, ids.agentId).catch(() => null);\n  if (!enrollment || enrollment.connectionInstanceId !== ids.connectionInstanceId) return;\n  try {\n    const renewed = await renewEnrollmentConnection(db, {\n      accountId: enrollment.accountId,\n      workspaceId: ids.workspaceId,\n      enrollmentId: ids.agentId,\n      connectionInstanceId: ids.connectionInstanceId,\n      leaseMs: AGENT_CONNECTION_LEASE_MS,\n    });\n    if (!renewed.renewed) return;\n  } catch (error) {\n    observability?.warn?.(\"Failed to renew a machine connection heartbeat\", {\n      subject,\n      error: error instanceof Error ? error.message : String(error),\n    });\n    return;\n  }\n  // A live machine behind its promoted build is asked to update; the decision\n  // reads only this enrollment, and a request never blocks heartbeat ingestion.\n  agentUpdates?.consider(enrollment);\n  if (heartbeat.attachedBrowserInventory) {\n    try {\n      await ingestAttachedBrowserInventory(db, {\n        workspaceId: ids.workspaceId,\n        agentId: ids.agentId,\n        inventory: heartbeat.attachedBrowserInventory,\n      });\n    } catch (error) {\n      observability?.warn?.(\"Failed to ingest an attached-browser inventory\", {\n        subject,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  if (heartbeat.desktopStatus) {\n    try {\n      const status = heartbeat.desktopStatus;\n      const available = status.available && !status.unavailableReason;\n      const reason = status.unavailableReason || null;\n      const macPermissions = status.macPermissions;\n      const stored = enrollmentMacPermissions(enrollment.agentCapabilities);\n      // The heartbeat already read the exact enrollment. Steady state adds no\n      // extra query; the change path re-reads and fences its eventual write.\n      if (\n        enrollment.hasDisplay !== available ||\n        (enrollment.desktopUnavailableReason ?? null) !== reason ||\n        enrollment.agentCapabilities?.desktop !== available ||\n        (macPermissions !== undefined &&\n          (stored?.screenRecording !== macPermissions.screenRecording ||\n            stored?.accessibility !== macPermissions.accessibility ||\n            stored?.inputMonitoring !== macPermissions.inputMonitoring))\n      ) {\n        await refreshEnrollmentDisplay(db, {\n          workspaceId: ids.workspaceId,\n          agentId: ids.agentId,\n          hasDisplay: available,\n          desktopUnavailableReason: reason,\n          runtimeDesktop: available,\n          ...(macPermissions ? { macPermissions } : {}),\n          connectionInstanceId: ids.connectionInstanceId,\n        });\n      }\n    } catch (error) {\n      observability?.warn?.(\"Failed to refresh a machine desktop heartbeat\", {\n        subject,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  const metrics = heartbeat.metrics;\n  if (!metrics) return;\n  try {\n    await ingestHeartbeatMetrics(db, {\n      accountId: enrollment.accountId,\n      workspaceId: ids.workspaceId,\n      agentId: ids.agentId,\n      sample: metrics,\n    });\n  } catch (error) {\n    observability?.warn?.(\"Failed to ingest a machine metrics heartbeat\", {\n      subject,\n      error: error instanceof Error ? error.message : String(error),\n    });\n  }\n}\n\n/**\n * Start the metrics-ingestion consumer: subscribe exact process events and ingest\n * every heartbeat. Gated by sandboxSelfhostedEnabled (the caller checks the flag;\n * a disabled deployment never starts the consumer). Returns the unsubscribe fn.\n */\nexport function startMetricsIngestion(deps: {\n  db: Database;\n  bus: EventBus;\n  observability?: Observability;\n  agentUpdates?: AutomaticAgentUpdater | null;\n}): () => void {\n  const scheduler = createAgentEventIngestionScheduler(\n    (payload, subject) =>\n      handleAgentEventPayload(\n        deps.db,\n        deps.observability,\n        payload,\n        subject,\n        deps.bus,\n        deps.agentUpdates,\n      ),\n    {\n      onHeartbeatCoalesced: () =>\n        deps.observability?.incrementCounter({\n          name: \"opengeni_machine_heartbeat_coalesced_total\",\n          help: \"Connected Machine heartbeats collapsed while an exact runner event queue was busy.\",\n        }),\n    },\n  );\n  const unsubscribe = deps.bus.subscribeAgentEvents(AGENT_EVENTS_SUBJECT, (payload, subject) => {\n    scheduler.enqueue(payload, subject);\n  });\n  return () => {\n    unsubscribe();\n    scheduler.close();\n  };\n}\n\n// ── Connect-Hello display refresh ─────────────────────────────────────────────\n\n/**\n * The LIVE display presence the agent's Hello reports: a desktop framebuffer is\n * available (`capabilities.desktop`, which the agent sets true only when a display\n * probes AND it can stream it) OR a `Display` detail is present. An unset\n * Capabilities (or a headless machine) → false. This is what `has_display` should\n * track, replacing the enroll-time snapshot.\n */\nexport function helloReportsDisplay(hello: Hello): boolean {\n  const caps = hello.capabilities;\n  if (!caps) {\n    return false;\n  }\n  // A CAPTURE-BLOCKED display is NOT a usable display: a Mac reports a display but\n  // withholds `desktop` and sets `desktopUnavailableReason` when Screen Recording\n  // (TCC) is not granted. Treating it as \"has display\" is exactly how the 0.1.3\n  // incident hid — the machine claimed a desktop it could not capture, so it was\n  // offered for computer-use and the model saw a blank. Gate it out here (the single\n  // source of truth for `has_display`, consumed by both the machine state and the\n  // capability negotiation). The `display`-present fallback is preserved for every\n  // other case (e.g. a relay-less agent that reports a display but not `desktop`).\n  if (caps.desktopUnavailableReason) {\n    return false;\n  }\n  return caps.desktop === true || caps.display != null;\n}\n\n/**\n * The human, actionable reason a display is present but UNUSABLE (macOS Screen\n * Recording / TCC not granted), or null when capture is permitted / the machine is\n * headless. Normalizes the proto's non-optional \"\" empty string to null so the DB\n * carries a clean tri-state (a real reason vs. no reason) — the Machines dashboard\n * shows \"display: capture not granted\" only when this is non-null.\n */\nexport function helloDesktopUnavailableReason(hello: Hello): string | null {\n  const reason = hello.capabilities?.desktopUnavailableReason;\n  return reason ? reason : null;\n}\n\n/** Whether the runner's current Hello advertises the op-stream engine. */\nexport function helloReportsOpStream(hello: Hello): boolean {\n  return hello.capabilities?.opStream === true;\n}\n\nexport function helloRuntimeCapabilities(hello: Hello): Record<string, boolean> {\n  const caps = hello.capabilities;\n  // Absence is an older-agent/unknown signal, not a fabricated set of false claims.\n  // Keep the durable cursor empty so reconnects from legacy agents remain a\n  // no-op and future capability additions do not get silently fabricated.\n  if (!caps) return {};\n  return {\n    exec: caps.exec === true,\n    filesystem: caps.filesystem === true,\n    git: caps.git === true,\n    pty: caps.pty === true,\n    desktop: caps.desktop === true,\n    opStream: caps.opStream === true,\n    browserBridge: caps.browserBridge === true,\n    operationResourcePolicy: caps.operationResourcePolicy === true,\n    operationCpuQuota: caps.operationCpuQuota === true,\n    transactionalFsWrite: caps.transactionalFsWrite === true,\n    credentialRenew: caps.credentialRenew === true,\n    screenControl: caps.consentedScreenControl === true,\n    ...(caps.macPermissions ? enrollmentMacPermissionCapabilities(caps.macPermissions) : {}),\n  };\n}\n\nfunction helloCompletedUpdate(hello: Hello): {\n  operationId: string;\n  targetVersion: string;\n  binarySha256: string;\n} | null {\n  if (\n    !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(\n      hello.completedUpdateOperationId,\n    ) ||\n    !/^(?:v)?\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/.test(hello.completedUpdateTargetVersion) ||\n    !/^[0-9a-f]{64}$/.test(hello.completedUpdateBinarySha256)\n  ) {\n    return null;\n  }\n  return {\n    operationId: hello.completedUpdateOperationId,\n    targetVersion: hello.completedUpdateTargetVersion,\n    binarySha256: hello.completedUpdateBinarySha256,\n  };\n}\n\n/**\n * Reconcile `enrollments.has_display` (+ the capture-blocked reason) to what a Hello\n * reports. Resolves the enrollment (the accountId is the RLS principal + the\n * existence check + the current values). A no-change Hello short-circuits BEFORE\n * issuing any write (and the DB writer is itself change-guarded on BOTH fields as a\n * backstop), so a steady state never churns. An unknown/cross-workspace agentId is a\n * no-op.\n */\nexport async function refreshEnrollmentDisplay(\n  db: Database,\n  input: {\n    workspaceId: string;\n    agentId: string;\n    hasDisplay: boolean;\n    desktopUnavailableReason?: string | null;\n    runtimeDesktop?: boolean;\n    macPermissions?: EnrollmentMacPermissions;\n    connectionInstanceId?: string;\n  },\n): Promise<{ updated: boolean }> {\n  const desktopUnavailableReason = input.desktopUnavailableReason ?? null;\n  const enrollment = await getEnrollment(db, input.workspaceId, input.agentId);\n  if (!enrollment) {\n    return { updated: false };\n  }\n  if (\n    enrollment.hasDisplay === input.hasDisplay &&\n    (enrollment.desktopUnavailableReason ?? null) === desktopUnavailableReason &&\n    (input.runtimeDesktop === undefined ||\n      enrollment.agentCapabilities?.desktop === input.runtimeDesktop) &&\n    (input.macPermissions === undefined ||\n      JSON.stringify(enrollmentMacPermissions(enrollment.agentCapabilities)) ===\n        JSON.stringify({\n          screenRecording: input.macPermissions.screenRecording,\n          accessibility: input.macPermissions.accessibility,\n          inputMonitoring: input.macPermissions.inputMonitoring,\n        }))\n  ) {\n    // Both fields unchanged — do not even issue the UPDATE (no churn on a\n    // steady-state Hello).\n    return { updated: false };\n  }\n  return await setEnrollmentDisplayState(db, {\n    accountId: enrollment.accountId,\n    workspaceId: input.workspaceId,\n    enrollmentId: input.agentId,\n    hasDisplay: input.hasDisplay,\n    desktopUnavailableReason,\n    ...(input.runtimeDesktop !== undefined ? { runtimeDesktop: input.runtimeDesktop } : {}),\n    ...(input.macPermissions ? { macPermissions: input.macPermissions } : {}),\n    ...(input.connectionInstanceId ? { connectionInstanceId: input.connectionInstanceId } : {}),\n  });\n}\n\n/**\n * Reconcile `enrollments.op_stream` to what a Hello reports. Resolves the\n * enrollment first so the accountId remains the RLS principal and so a no-change\n * Hello short-circuits BEFORE issuing any write (the DB writer is itself\n * change-guarded as a backstop). An unknown/cross-workspace agentId is a no-op.\n */\nexport async function refreshEnrollmentOpStream(\n  db: Database,\n  input: {\n    workspaceId: string;\n    agentId: string;\n    opStream: boolean;\n    connectionInstanceId?: string;\n  },\n): Promise<{ updated: boolean }> {\n  const enrollment = await getEnrollment(db, input.workspaceId, input.agentId);\n  if (!enrollment) {\n    return { updated: false };\n  }\n  if (enrollment.opStream === input.opStream) {\n    // The capability is unchanged — do not even issue the UPDATE (no churn on a\n    // steady-state Hello).\n    return { updated: false };\n  }\n  return await setEnrollmentOpStreamState(db, {\n    accountId: enrollment.accountId,\n    workspaceId: input.workspaceId,\n    enrollmentId: input.agentId,\n    opStream: input.opStream,\n    ...(input.connectionInstanceId ? { connectionInstanceId: input.connectionInstanceId } : {}),\n  });\n}\n\n/**\n * Decode a raw `Hello` payload + refresh the enrollment's display cursor + clear\n * any pending clean going-offline marker and, when the reconnect actually cleared\n * one, fan out machine.link.restored to the sessions with an active op on the\n * machine (the per-message handler for the hello plane). Decode failures + write\n * failures are reported + swallowed — a Hello must NEVER break the agent's connect.\n * `bus` (when present) enables the link.restored fan-out.\n */\nexport async function handleHelloPayload(\n  db: Database,\n  observability: Observability | undefined,\n  payload: Uint8Array,\n  subject: string,\n  bus?: EventBus,\n): Promise<void> {\n  const ids = parseAgentHelloSubject(subject);\n  if (!ids) {\n    return;\n  }\n  let hello: Hello;\n  try {\n    hello = Hello.decode(payload);\n  } catch (error) {\n    observability?.warn?.(\"Failed to decode an agent Hello for display refresh\", {\n      subject,\n      error: error instanceof Error ? error.message : String(error),\n    });\n    return;\n  }\n  const authority = await getLiveEnrollmentConnection(db, ids.workspaceId, ids.agentId).catch(\n    () => null,\n  );\n  if (!authority || authority.connectionInstanceId !== ids.connectionInstanceId) {\n    observability?.warn?.(\"Ignored a Hello from a superseded runner instance\", {\n      workspaceId: ids.workspaceId,\n      agentId: ids.agentId,\n    });\n    return;\n  }\n  let workspaceRoot: string | undefined;\n  if (hello.workspaceRoot.length > 0) {\n    try {\n      workspaceRoot = normalizeConnectedMachineWorkspaceRoot(hello.workspaceRoot, authority.os);\n    } catch (error) {\n      observability?.warn?.(\"Ignored an invalid Connected Machine workspace root\", {\n        workspaceId: ids.workspaceId,\n        agentId: ids.agentId,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  try {\n    await refreshEnrollmentDisplay(db, {\n      workspaceId: ids.workspaceId,\n      agentId: ids.agentId,\n      hasDisplay: helloReportsDisplay(hello),\n      desktopUnavailableReason: helloDesktopUnavailableReason(hello),\n      connectionInstanceId: ids.connectionInstanceId,\n    });\n    await refreshEnrollmentOpStream(db, {\n      workspaceId: ids.workspaceId,\n      agentId: ids.agentId,\n      opStream: helloReportsOpStream(hello),\n      connectionInstanceId: ids.connectionInstanceId,\n    });\n    await setEnrollmentAgentRuntime(db, {\n      accountId: authority.accountId,\n      workspaceId: ids.workspaceId,\n      enrollmentId: ids.agentId,\n      connectionInstanceId: ids.connectionInstanceId,\n      agentVersion: hello.agentVersion.trim() || null,\n      binarySha256: /^[0-9a-f]{64}$/.test(hello.binarySha256) ? hello.binarySha256 : null,\n      updateChannel:\n        hello.updateChannel === \"stable\" || hello.updateChannel === \"beta\"\n          ? hello.updateChannel\n          : null,\n      capabilities: helloRuntimeCapabilities(hello),\n      ...(workspaceRoot !== undefined ? { workspaceRoot } : {}),\n      completedUpdate: helloCompletedUpdate(hello),\n    });\n  } catch (error) {\n    observability?.warn?.(\"Failed to refresh an enrollment's capabilities from a Hello\", {\n      subject,\n      error: error instanceof Error ? error.message : String(error),\n    });\n  }\n  // Screen control allowed while this machine was offline (or before its agent\n  // could renew on request) applies now. Detached: it waits for the agent to\n  // subscribe and must not hold up Hello ingestion.\n  void reconcileScreenControlOnHello(\n    { bus, observability },\n    {\n      authority,\n      hello,\n      target: {\n        workspaceId: ids.workspaceId,\n        enrollmentId: ids.agentId,\n        connectionInstanceId: ids.connectionInstanceId,\n      },\n    },\n  );\n  // A reconnect Hello re-announces the machine, so any pending clean going-offline\n  // marker no longer holds — clear it so the liveness derivation stops reading the\n  // machine offline. Best-effort + fail-soft, and change-guarded in the DB (a\n  // steady-state Hello with no marker writes nothing), so this never breaks the\n  // agent's connect and never churns. When a marker was ACTUALLY cleared (the\n  // machine had been reported link.lost), fan out machine.link.restored to the\n  // sessions with an active op on it — a restored only ever pairs a prior lost, so\n  // a routine connect Hello (no marker) emits nothing.\n  try {\n    const { cleared } = await clearEnrollmentWentOffline(db, {\n      accountId: authority.accountId,\n      workspaceId: ids.workspaceId,\n      enrollmentId: ids.agentId,\n      connectionInstanceId: ids.connectionInstanceId,\n    });\n    if (cleared && bus) {\n      await fanOutMachineLinkEvents(\n        db,\n        bus,\n        observability,\n        ids.workspaceId,\n        ids.agentId,\n        (activeTurnId) => [{ type: \"machine.link.restored\", turnId: activeTurnId, payload: {} }],\n      );\n    }\n  } catch (error) {\n    observability?.warn?.(\"Failed to clear a machine going-offline marker on a Hello\", {\n      subject,\n      error: error instanceof Error ? error.message : String(error),\n    });\n  }\n}\n\n/**\n * Start the Hello display-refresh consumer: subscribe exact process hellos and\n * reconcile `has_display` to the live capability the agent reports on every\n * connect. Gated by sandboxSelfhostedEnabled (the caller checks the flag). Returns\n * the unsubscribe fn.\n */\nexport function startHelloIngestion(deps: {\n  db: Database;\n  bus: EventBus;\n  observability?: Observability;\n}): () => void {\n  return deps.bus.subscribeAgentEvents(AGENT_HELLO_SUBJECT, (payload, subject) =>\n    handleHelloPayload(deps.db, deps.observability, payload, subject, deps.bus),\n  );\n}\n","import {\n  claimMemorySlackPublication,\n  completeMemorySlackPublication,\n  currentMemorySlackConfigurationMatches,\n  deferMemorySlackPublication,\n  failMemorySlackPublication,\n  type ClaimedMemorySlackPublication,\n} from \"@opengeni/db\";\nimport { sanitizeSlackPublicationText, type ApiRouteDeps } from \"@opengeni/core\";\nimport {\n  createOpenGeniSlackBotInteractionClient,\n  SlackBotProviderError,\n} from \"./integrations/slack-bot\";\n\nconst DELIVERY_LEASE_MS = 30_000;\nconst MAX_DELIVERY_ATTEMPTS = 8;\nconst MAX_DELIVERY_RETRY_MS = 5 * 60_000;\nconst MAX_SLACK_MESSAGE_CHARS = 3_500;\n\nexport async function drainMemorySlackPublicationsOnce(deps: ApiRouteDeps): Promise<boolean> {\n  const claimHolderId = crypto.randomUUID();\n  const publication = await claimMemorySlackPublication(deps.db, claimHolderId, DELIVERY_LEASE_MS);\n  if (!publication) return false;\n\n  try {\n    if (!(await currentMemorySlackConfigurationMatches(deps.db, publication))) {\n      await failMemorySlackPublication(deps.db, {\n        publication,\n        claimHolderId,\n        errorCode: \"configuration_changed\",\n        cancelled: true,\n      });\n      return true;\n    }\n    const client = await createOpenGeniSlackBotInteractionClient(deps, {\n      accountId: publication.accountId,\n      workspaceId: publication.workspaceId,\n      connectionId: publication.connectionId,\n      subjectId: publication.initiatorSubjectId,\n      sessionId: publication.sessionId,\n    });\n    const result = await client.postMessage({\n      operationId: publication.operationId,\n      channelId: publication.slackChannelId,\n      text: formatMemorySlackPublicationMessage(deps, publication),\n      requireActiveNonSharedChannel: true,\n    });\n    const completed = await completeMemorySlackPublication(deps.db, {\n      publication,\n      claimHolderId,\n      slackChannelId: result.channelId,\n      slackMessageTimestamp: result.timestamp,\n    });\n    if (!completed) throw new Error(\"Memory Slack publication lost its durable claim\");\n  } catch (error) {\n    const errorCode = deliveryErrorCode(error);\n    if (memorySlackDestinationDrift(error)) {\n      await failMemorySlackPublication(deps.db, {\n        publication,\n        claimHolderId,\n        errorCode,\n        cancelled: true,\n      }).catch(() => undefined);\n    } else if (publication.attemptCount >= MAX_DELIVERY_ATTEMPTS || permanentDeliveryError(error)) {\n      await failMemorySlackPublication(deps.db, {\n        publication,\n        claimHolderId,\n        errorCode,\n      }).catch(() => undefined);\n    } else {\n      await deferMemorySlackPublication(deps.db, {\n        publication,\n        claimHolderId,\n        errorCode,\n        retryAt: new Date(Date.now() + deliveryRetryMs(error, publication.attemptCount)),\n      }).catch(() => undefined);\n    }\n  }\n  return true;\n}\n\nexport function startMemorySlackPublicationPump(\n  deps: ApiRouteDeps,\n  options: { intervalMs?: number; maxPerTick?: number } = {},\n): () => Promise<void> {\n  let stopped = false;\n  let running: Promise<void> | undefined;\n  const intervalMs = Math.max(250, options.intervalMs ?? 1_000);\n  const maxPerTick = Math.max(1, Math.min(50, options.maxPerTick ?? 10));\n  const tick = () => {\n    if (stopped || running) return;\n    running = (async () => {\n      for (let index = 0; index < maxPerTick; index += 1) {\n        if (!(await drainMemorySlackPublicationsOnce(deps))) break;\n      }\n    })()\n      .catch((error) => {\n        deps.observability?.error(\"Memory Slack publication claim failed\", {\n          errorClass: error instanceof Error ? error.name : \"MemorySlackPublicationPumpError\",\n          errorCode: deliveryErrorCode(error),\n          origin: \"api\",\n        });\n      })\n      .finally(() => {\n        running = undefined;\n      });\n  };\n  const timer = setInterval(tick, intervalMs);\n  queueMicrotask(tick);\n  return async () => {\n    stopped = true;\n    clearInterval(timer);\n    await running;\n  };\n}\n\nexport function formatMemorySlackPublicationMessage(\n  deps: Pick<ApiRouteDeps, \"settings\">,\n  publication: ClaimedMemorySlackPublication,\n): string {\n  const projection = publication.projection;\n  const summary = boundedProjectionString(projection[\"summary\"], 512) || \"Important change\";\n  const owner = boundedProjectionString(projection[\"ownerLabel\"], 96);\n  const occurredAt = boundedProjectionString(projection[\"occurredAt\"], 64);\n  const changeKind = boundedProjectionString(projection[\"changeKind\"], 32);\n  const destination = boundedProjectionString(projection[\"destination\"], 64);\n  const outcome = boundedProjectionString(projection[\"outcome\"], 64);\n  const heading =\n    publication.sourceType === \"workspace_memory\"\n      ? `Workspace Memory ${changeKind || \"change\"}`\n      : `Governed learning ${outcome || \"change\"}`;\n  const details = [\n    `Importance: ${publication.importance}`,\n    ...(destination ? [`Surface: ${destination}`] : []),\n    ...(owner ? [`Owner: ${owner}`] : []),\n    ...(occurredAt ? [`Recorded: ${occurredAt}`] : []),\n  ];\n  const path =\n    publication.sourceType === \"workspace_memory\"\n      ? `/workspaces/${publication.workspaceId}/memory?memoryId=${encodeURIComponent(publication.sourceId)}`\n      : `/workspaces/${publication.workspaceId}/workspace-state`;\n  const base = deps.settings.webBaseUrl ?? deps.settings.publicBaseUrl;\n  const link = base ? new URL(path, base).toString() : null;\n  const text = `*${heading}*\\n${summary}\\n\\n${details.join(\" · \")}${link ? `\\n${link}` : \"\"}`;\n  return text.length <= MAX_SLACK_MESSAGE_CHARS\n    ? text\n    : `${text.slice(0, MAX_SLACK_MESSAGE_CHARS - 20)}\\n… message truncated`;\n}\n\nconst PERMANENT_DELIVERY_CODES = new Set([\n  \"account_inactive\",\n  \"channel_not_found\",\n  \"invalid_auth\",\n  \"is_archived\",\n  \"not_authed\",\n  \"not_in_channel\",\n  \"token_expired\",\n  \"token_revoked\",\n]);\n\nconst MEMORY_SLACK_DESTINATION_DRIFT_CODES = new Set([\n  \"channel_not_found\",\n  \"is_archived\",\n  \"not_in_channel\",\n  \"slack_connect_unsupported\",\n]);\n\nexport function memorySlackDestinationDrift(error: unknown) {\n  return (\n    error instanceof SlackBotProviderError && MEMORY_SLACK_DESTINATION_DRIFT_CODES.has(error.code)\n  );\n}\n\nfunction permanentDeliveryError(error: unknown) {\n  if (!(error instanceof SlackBotProviderError)) return false;\n  if (PERMANENT_DELIVERY_CODES.has(error.code)) return true;\n  const status = /^http_(\\d{3})$/.exec(error.code)?.[1];\n  return status\n    ? Number(status) >= 400 && Number(status) < 500 && status !== \"408\" && status !== \"429\"\n    : false;\n}\n\nfunction deliveryRetryMs(error: unknown, attemptCount: number) {\n  if (error instanceof SlackBotProviderError && error.retryAfterMs) {\n    return Math.min(Math.max(error.retryAfterMs, 1_000), MAX_DELIVERY_RETRY_MS);\n  }\n  return Math.min(1_000 * 2 ** Math.max(0, attemptCount - 1), MAX_DELIVERY_RETRY_MS);\n}\n\nfunction deliveryErrorCode(error: unknown) {\n  if (error instanceof SlackBotProviderError) return error.code.slice(0, 128);\n  const raw = error instanceof Error ? error.name : \"memory_slack_delivery_error\";\n  return (\n    raw\n      .toLowerCase()\n      .replace(/[^a-z0-9_-]/g, \"_\")\n      .slice(0, 128) || \"error\"\n  );\n}\n\nfunction boundedProjectionString(value: unknown, maxChars: number) {\n  return typeof value === \"string\"\n    ? escapeSlackText(sanitizeSlackPublicationText(value).slice(0, maxChars))\n    : \"\";\n}\n\nfunction escapeSlackText(value: string) {\n  return value.replaceAll(\"&\", \"&amp;\").replaceAll(\"<\", \"&lt;\").replaceAll(\">\", \"&gt;\");\n}\n","import {\n  acknowledgeScheduledTaskScheduleReconciliation,\n  deferScheduledTaskScheduleReconciliation,\n  listExhaustedScheduledTasks,\n  listScheduledTaskScheduleReconciliations,\n  retireExhaustedScheduledTask,\n  type Database,\n} from \"@opengeni/db\";\nimport type { ScheduledTask } from \"@opengeni/contracts\";\nimport type { EventBus } from \"@opengeni/events\";\nimport type { Observability } from \"@opengeni/observability\";\nimport { reviewScheduledTaskBlockerInventory } from \"./scheduled-task-blockers\";\n\ntype Dependencies = {\n  db: Database;\n  sync(task: Pick<ScheduledTask, \"id\" | \"workspaceId\" | \"temporalScheduleId\">): Promise<void>;\n  /** Enables blocked-schedule review: self-pause and the owner notice it posts. */\n  bus?: EventBus;\n  observability?: Pick<Observability, \"error\">;\n};\n\nexport async function reconcileExhaustedScheduledTasks(deps: Dependencies): Promise<void> {\n  for (const candidate of await listExhaustedScheduledTasks(deps.db)) {\n    await retireExhaustedScheduledTask(deps.db, candidate.workspace_id, candidate.id);\n  }\n  // Before Temporal reconciliation, so a schedule that paused itself stops\n  // firing in the same pass.\n  if (deps.bus) {\n    await reviewScheduledTaskBlockerInventory({\n      db: deps.db,\n      bus: deps.bus,\n      observability: deps.observability,\n    });\n  }\n  for (const pending of await listScheduledTaskScheduleReconciliations(deps.db)) {\n    try {\n      // The synchronizer takes the shared external-write lock and rereads the\n      // current task, including edits/deletion committed since retirement.\n      await deps.sync({\n        id: pending.task_id,\n        workspaceId: pending.workspace_id,\n        temporalScheduleId: pending.temporal_schedule_id,\n      });\n      await acknowledgeScheduledTaskScheduleReconciliation(\n        deps.db,\n        pending.workspace_id,\n        pending.id,\n      );\n    } catch (error) {\n      await deferScheduledTaskScheduleReconciliation(deps.db, pending.workspace_id, pending.id);\n      deps.observability?.error(\"Exhausted schedule reconciliation will retry\", {\n        taskId: pending.task_id,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n}\n\nexport function startScheduledTaskLifecyclePump(\n  deps: Dependencies,\n  intervalMs = 30_000,\n): () => Promise<void> {\n  let stopped = false;\n  let running: Promise<void> | undefined;\n  const tick = () => {\n    if (stopped || running) return;\n    running = reconcileExhaustedScheduledTasks(deps)\n      .catch((error: unknown) => {\n        deps.observability?.error(\"Exhausted schedule inventory failed\", {\n          error: error instanceof Error ? error.message : String(error),\n        });\n      })\n      .finally(() => {\n        running = undefined;\n      });\n  };\n  const timer = setInterval(tick, intervalMs);\n  queueMicrotask(tick);\n  return async () => {\n    stopped = true;\n    clearInterval(timer);\n    await running;\n  };\n}\n","import {\n  NOTIFICATION_SUBTITLE_MAX_CHARS,\n  SessionNotificationPostedPayload,\n  SessionNotificationWithdrawnPayload,\n} from \"@opengeni/contracts\";\nimport {\n  getPendingScheduledTaskBlockerNotice,\n  listScheduledTaskBlockerReviews,\n  reviewScheduledTaskBlockers,\n  settleScheduledTaskBlockerNotice,\n  type Database,\n  type ScheduledTaskBlockerDecision,\n  type ScheduledTaskBlockerFacts,\n  type ScheduledTaskBlockerRun,\n} from \"@opengeni/db\";\nimport { appendAndPublishEvents, type EventBus } from \"@opengeni/events\";\nimport type { Observability } from \"@opengeni/observability\";\n\n/**\n * A schedule must never stay stuck without its owner knowing. After each\n * settled scheduled run:\n *\n * - When the platform knows no later run can start until a person acts (its\n *   chat is paused or gone, a pinned account or other resource it needs is\n *   unavailable, or it was refused as non-retryable), the schedule pauses\n *   itself with that reason and its owner is told once.\n * - When runs keep failing or being skipped for a reason that may clear by\n *   itself, the owner is told once, after {@link SCHEDULED_TASK_BLOCKER_STREAK}\n *   in a row; the schedule keeps running. A single skip or failure is normal.\n *\n * The notice is withdrawn when a later run succeeds or a person resumes,\n * pauses or deletes the schedule. Only scheduled (not manual) runs count, and\n * only runs since the schedule was last edited or resumed.\n */\nexport const SCHEDULED_TASK_BLOCKER_STREAK = 3;\n\nconst SETTLED = new Set([\"succeeded\", \"failed\", \"skipped\"]);\n\ntype Blocker = { reason: string; text: string };\n\nconst RESUME = \"then resume the schedule.\";\n\nconst NON_RETRYABLE_REFUSAL_TEXT: Record<string, string> = {\n  scheduled_authority_unavailable: `The access it was set up with is no longer valid. Refresh the schedule's access, ${RESUME}`,\n  machine_target_unavailable: `The machine it runs on is no longer available. Choose another machine or reconnect this one, ${RESUME}`,\n  machine_enrollment_inactive: `The machine it runs on is disconnected from Opengeni. Reconnect the machine, ${RESUME}`,\n  variable_set_unavailable: `A variable set it uses no longer exists or can't be used. Edit the schedule, ${RESUME}`,\n  rig_version_unavailable: `Its rig has no usable version. Publish a rig version or edit the schedule, ${RESUME}`,\n  scheduled_model_unavailable: `Its model is no longer available. Edit the schedule to choose another model, ${RESUME}`,\n};\n\nconst RETRYABLE_REFUSAL_TEXT: Record<string, string> = {\n  machine_enrollment_inactive: \"the machine it runs on is disconnected\",\n  insufficient_credits: \"the workspace is out of credits\",\n  allowance_exhausted: \"the usage allowance is used up\",\n  monthly_model_cost_limit: \"the monthly model cost limit was reached\",\n  monthly_agent_run_limit: \"the monthly run limit was reached\",\n  session_usage_limit: \"the schedule reached its usage limit\",\n};\n\n/** A blocker no later run can get past until a person acts, or null. */\nexport function scheduledRunHardBlocker(\n  task: Pick<ScheduledTaskBlockerFacts[\"task\"], \"runMode\">,\n  run: ScheduledTaskBlockerRun,\n): Blocker | null {\n  if (run.admissionDiagnostic) {\n    return {\n      reason: \"connection_account_unavailable\",\n      text: `A connected account it needs can no longer be used. Reconnect that account or refresh the schedule's access, ${RESUME}`,\n    };\n  }\n  if (run.admissionRefusal && !run.admissionRefusal.retryable) {\n    const reason = run.admissionRefusal.reason;\n    return {\n      reason,\n      text:\n        NON_RETRYABLE_REFUSAL_TEXT[reason] ??\n        `Every run is refused before it starts (${reason}). Fix that, ${RESUME}`,\n    };\n  }\n  switch (run.error) {\n    case \"scheduled_session_paused\":\n      return {\n        reason: run.error,\n        text: `Its chat is paused, so no run can start there. Resume the chat, ${RESUME}`,\n      };\n    case \"session_cancelled\":\n      // A run that starts a new chat each time is not blocked by one ended chat.\n      return task.runMode === \"new_session_per_run\"\n        ? null\n        : {\n            reason: run.error,\n            text: `The chat it runs in has ended, so no run can start there. Point the schedule at another chat or let it start a new chat each run, ${RESUME}`,\n          };\n    case \"scheduled_target_session_unavailable\":\n      return {\n        reason: run.error,\n        text: `The chat it runs in no longer exists. Point the schedule at another chat or let it start a new chat each run, ${RESUME}`,\n      };\n    case \"scheduled_model_unavailable\":\n      return { reason: run.error, text: NON_RETRYABLE_REFUSAL_TEXT.scheduled_model_unavailable! };\n    default:\n      return null;\n  }\n}\n\nfunction streakBlocker(streak: readonly ScheduledTaskBlockerRun[]): Blocker {\n  const count = streak.length;\n  if (streak.every((run) => run.error === \"scheduled_session_not_idle\")) {\n    return {\n      reason: \"scheduled_session_not_idle\",\n      text: `The last ${count} scheduled runs were skipped because its chat was still busy with earlier work. Check whether that chat is stuck. The schedule keeps trying.`,\n    };\n  }\n  const refusal = streak[0]?.admissionRefusal;\n  if (\n    refusal?.retryable &&\n    streak.every(\n      (run) => run.admissionRefusal?.retryable && run.admissionRefusal.reason === refusal.reason,\n    )\n  ) {\n    return {\n      reason: refusal.reason,\n      text: `The last ${count} scheduled runs were skipped because ${\n        RETRYABLE_REFUSAL_TEXT[refusal.reason] ?? `they were refused (${refusal.reason})`\n      }. Runs start again once that clears.`,\n    };\n  }\n  const latest = streak[0]!;\n  return {\n    reason: latest.error ?? latest.status,\n    text: `The last ${count} scheduled runs failed or were skipped. Open the latest run to see why. The schedule keeps trying.`,\n  };\n}\n\nexport function scheduledTaskBlockerNoticeKey(taskId: string): string {\n  return `schedule-${taskId}`;\n}\n\nfunction clip(text: string, max: number): string {\n  return text.length <= max ? text : `${text.slice(0, max - 1).trimEnd()}…`;\n}\n\nfunction notice(\n  facts: ScheduledTaskBlockerFacts,\n  run: ScheduledTaskBlockerRun,\n  state: \"notified\" | \"paused\",\n  blocker: Blocker,\n): Extract<ScheduledTaskBlockerDecision, { kind: \"block\" }>[\"notice\"] {\n  // The chat the owner opens from the notice: the blocked run's own, else the\n  // chat the schedule runs in, else the most recent run's.\n  const sessionId =\n    run.sessionId ??\n    facts.task.reusableSessionId ??\n    facts.runs.find((candidate) => candidate.sessionId !== null)?.sessionId ??\n    null;\n  if (!sessionId) return null;\n  const key = scheduledTaskBlockerNoticeKey(facts.task.id);\n  const payload = SessionNotificationPostedPayload.parse({\n    key,\n    title: state === \"paused\" ? \"Schedule paused itself\" : \"Schedule needs attention\",\n    subtitle: clip(facts.task.name.trim() || \"Scheduled task\", NOTIFICATION_SUBTITLE_MAX_CHARS),\n    body:\n      state === \"paused\"\n        ? `${blocker.text} It stays paused until someone resumes it.`\n        : blocker.text,\n    urgency: \"normal\",\n    replaced: false,\n  });\n  return { sessionId, key, payload };\n}\n\n/** The pure review of one schedule's newest settled scheduled run. */\nexport function decideScheduledTaskBlocker(\n  facts: ScheduledTaskBlockerFacts,\n): ScheduledTaskBlockerDecision {\n  const { task, review, runs } = facts;\n  const blocked = review !== null && review.state !== \"clear\";\n  // A person acted: resumed a self-paused schedule, or paused or deleted one\n  // they were told about. Keep the reviewed run; a new one is reviewed next.\n  if (task.deleted) return blocked ? { kind: \"clear\", reviewedRunId: null } : none(null);\n  if (review?.state === \"paused\" && task.status === \"active\") {\n    return { kind: \"clear\", reviewedRunId: null };\n  }\n  if (review?.state === \"notified\" && task.status !== \"active\") {\n    return { kind: \"clear\", reviewedRunId: null };\n  }\n  if (task.status !== \"active\") return none(null);\n  const latest = runs[0];\n  if (!latest || !SETTLED.has(latest.status) || latest.id === review?.reviewedRunId) {\n    return none(null);\n  }\n  if (latest.status === \"succeeded\") {\n    return review?.state === \"notified\"\n      ? { kind: \"clear\", reviewedRunId: latest.id }\n      : none(latest.id);\n  }\n  // Runs before the last edit or resume say nothing about the schedule now.\n  const current = (run: ScheduledTaskBlockerRun) => run.createdAt >= task.updatedAt;\n  const hard = current(latest) ? scheduledRunHardBlocker(task, latest) : null;\n  if (hard) {\n    return {\n      kind: \"block\",\n      state: \"paused\",\n      reason: hard.reason,\n      message: hard.text,\n      blockedRunId: latest.id,\n      blockedSince: latest.createdAt,\n      reviewedRunId: latest.id,\n      notice: notice(facts, latest, \"paused\", hard),\n    };\n  }\n  if (review?.state === \"notified\") return none(latest.id);\n  const streak: ScheduledTaskBlockerRun[] = [];\n  for (const run of runs) {\n    if (!SETTLED.has(run.status) || run.status === \"succeeded\" || !current(run)) break;\n    streak.push(run);\n  }\n  if (streak.length < SCHEDULED_TASK_BLOCKER_STREAK) return none(latest.id);\n  const soft = streakBlocker(streak);\n  const first = streak.at(-1)!;\n  return {\n    kind: \"block\",\n    state: \"notified\",\n    reason: soft.reason,\n    message: soft.text,\n    blockedRunId: first.id,\n    blockedSince: first.createdAt,\n    reviewedRunId: latest.id,\n    notice: notice(facts, latest, \"notified\", soft),\n  };\n}\n\nfunction none(reviewedRunId: string | null): ScheduledTaskBlockerDecision {\n  return { kind: \"none\", reviewedRunId };\n}\n\ntype Dependencies = {\n  db: Database;\n  bus: EventBus;\n  observability?: Pick<Observability, \"error\"> | undefined;\n};\n\nfunction sessionMissing(error: unknown): boolean {\n  return error instanceof Error && /^Session not found: /u.test(error.message);\n}\n\n/** Post or withdraw the owner notice a review left pending. */\nexport async function deliverScheduledTaskBlockerNotice(\n  deps: Dependencies,\n  workspaceId: string,\n  taskId: string,\n): Promise<void> {\n  const pending = await getPendingScheduledTaskBlockerNotice(deps.db, workspaceId, taskId);\n  if (!pending) return;\n  try {\n    await appendAndPublishEvents(deps.db, deps.bus, workspaceId, pending.sessionId, [\n      pending.pending === \"post\"\n        ? {\n            type: \"session.notification.posted\",\n            payload: SessionNotificationPostedPayload.parse(pending.payload),\n          }\n        : {\n            type: \"session.notification.withdrawn\",\n            payload: SessionNotificationWithdrawnPayload.parse({ key: pending.key }),\n          },\n    ] as Parameters<typeof appendAndPublishEvents>[4]);\n  } catch (error) {\n    // A deleted chat cannot carry the notice; the schedule page still shows why.\n    if (!sessionMissing(error)) throw error;\n  }\n  await settleScheduledTaskBlockerNotice(deps.db, workspaceId, taskId, pending);\n}\n\n/** One bounded pass over schedules with a run to review or a notice to deliver. */\nexport async function reviewScheduledTaskBlockerInventory(deps: Dependencies): Promise<void> {\n  for (const candidate of await listScheduledTaskBlockerReviews(deps.db)) {\n    try {\n      await reviewScheduledTaskBlockers(\n        deps.db,\n        candidate.workspace_id,\n        candidate.id,\n        decideScheduledTaskBlocker,\n      );\n      await deliverScheduledTaskBlockerNotice(deps, candidate.workspace_id, candidate.id);\n    } catch (error) {\n      deps.observability?.error(\"Scheduled task blocker review will retry\", {\n        taskId: candidate.id,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n}\n","import type { ScheduledTask } from \"@opengeni/contracts\";\nimport { getScheduledTaskIncludingDeleted, type Database } from \"@opengeni/db\";\nimport { sql } from \"drizzle-orm\";\n\nconst LOCK_TIMEOUT = \"5s\";\nconst WRITE_TIMEOUT_MS = 5_000;\n\ntype TemporalScheduleSyncDependencies = {\n  db: Database;\n  withDeadline<T>(deadline: number, work: () => Promise<T>): Promise<T>;\n  upsert(task: ScheduledTask): Promise<void>;\n  /** Idempotent: an absent Temporal schedule is already removed. */\n  remove(temporalScheduleId: string): Promise<void>;\n};\n\n/**\n * Serialize external writes across API replicas, independently of task edits.\n * A queued sync rereads the newest committed row after acquiring this lock;\n * input snapshots never become desired state. Cleanup uses the same key, so\n * an in-flight upsert finishes before its tombstone's external deletion.\n * Failure compensation commits before releasing the lock, so a queued writer\n * cannot read the row being restored and then publish that failed edit.\n *\n * Deadlines bound both lock admission and network occupancy. A thrown network\n * error retains its unknown-outcome semantics; this is not durable recovery\n * for a process crash or a lost Temporal acknowledgement.\n */\nexport function createTemporalScheduleSynchronizer(deps: TemporalScheduleSyncDependencies) {\n  const write = async <T>(\n    temporalScheduleId: string,\n    work: (tx: Database) => Promise<T>,\n  ): Promise<T> =>\n    deps.db.transaction(async (tx) => {\n      await tx.execute(sql`select set_config('lock_timeout', ${LOCK_TIMEOUT}, true)`);\n      await tx.execute(sql`select pg_advisory_xact_lock(\n        hashtextextended(${`scheduled-task-temporal:${temporalScheduleId}`}, 0)\n      )`);\n      return await work(tx);\n    });\n\n  return {\n    async sync(\n      task: Pick<ScheduledTask, \"id\" | \"workspaceId\" | \"temporalScheduleId\">,\n      onFailure?: (tx: Database, error: unknown) => Promise<Error>,\n    ) {\n      const result = await write(task.temporalScheduleId, async (tx) => {\n        try {\n          await deps.withDeadline(Date.now() + WRITE_TIMEOUT_MS, async () => {\n            const current = await getScheduledTaskIncludingDeleted(tx, task.workspaceId, task.id);\n            if (current && current.temporalScheduleId !== task.temporalScheduleId)\n              throw new Error(\"Scheduled task Temporal identity changed\");\n            if (!current || current.deletedAt !== null || current.schedule.type === \"manual\") {\n              await deps.remove(task.temporalScheduleId);\n              return;\n            }\n            const { deletedAt: _deletedAt, ...latest } = current;\n            await deps.upsert(latest);\n          });\n          return { ok: true as const };\n        } catch (error) {\n          return { ok: false as const, error: onFailure ? await onFailure(tx, error) : error };\n        }\n      });\n      // Throw after commit: throwing inside the transaction would also undo a\n      // successful compensation. A failed commit cannot claim that receipt.\n      if (!result.ok) throw result.error;\n    },\n    async remove(temporalScheduleId: string) {\n      await write(temporalScheduleId, async () =>\n        deps.withDeadline(Date.now() + WRITE_TIMEOUT_MS, () => deps.remove(temporalScheduleId)),\n      );\n    },\n  };\n}\n","import { createSign, randomUUID } from \"node:crypto\";\nimport { connect, type ClientHttp2Session } from \"node:http2\";\nimport type { Settings } from \"@opengeni/config\";\nimport {\n  claimNativePushDeliveries,\n  listSessionHumanInputRequests,\n  pruneNativePushDeliveries,\n  settleNativePushDelivery,\n  type ClaimedNativePushDelivery,\n  type Database,\n  type NativePushOutcome,\n} from \"@opengeni/db\";\nimport type { Observability } from \"@opengeni/observability\";\n\n// Sends queued native app pushes (0638) through APNs (token auth over HTTP/2)\n// and FCM HTTP v1. At-least-once: a delivery is settled only after the\n// provider answered; an unknown token removes the registration.\n\nconst POLL_INTERVAL_MS = 1_000;\nconst CLAIM_SECONDS = 60;\nconst MAX_ATTEMPTS = 6;\nconst PRUNE_EVERY_TICKS = 600;\n\nexport type NativePushSendResult = { outcome: NativePushOutcome; error?: string };\n\nexport type NativePushSender = (\n  delivery: ClaimedNativePushDelivery,\n) => Promise<NativePushSendResult>;\n\n/** A claimed payload, marked when its question asks for a secret. */\nexport type NativePushPayload = ClaimedNativePushDelivery[\"payload\"] & { secretQuestion?: boolean };\n\nconst SECRET_QUESTION_PUSH_BODY = \"Open Opengeni to answer. The answer is saved to a vault.\";\n\n/**\n * Mark question pushes whose pending request asks for a secret, so they carry\n * no inline answer action and point to the app instead.\n */\nasync function markSecretQuestionDeliveries(\n  db: Database,\n  deliveries: ClaimedNativePushDelivery[],\n): Promise<ClaimedNativePushDelivery[]> {\n  const secretSessions = new Map<string, Promise<boolean>>();\n  return await Promise.all(\n    deliveries.map(async (delivery) => {\n      if (delivery.payload.eventType !== \"session.humanInput.requested\") return delivery;\n      const key = `${delivery.payload.workspaceId}:${delivery.payload.sessionId}`;\n      let lookup = secretSessions.get(key);\n      if (!lookup) {\n        lookup = listSessionHumanInputRequests(\n          db,\n          delivery.payload.workspaceId,\n          delivery.payload.sessionId,\n          { status: \"pending\", limit: 20 },\n        )\n          .then((requests) =>\n            requests.some((request) =>\n              request.questions.some((question) => question.kind === \"secret\"),\n            ),\n          )\n          .catch(() => false);\n        secretSessions.set(key, lookup);\n      }\n      if (!(await lookup)) return delivery;\n      const payload: NativePushPayload = { ...delivery.payload, secretQuestion: true };\n      return { ...delivery, payload };\n    }),\n  );\n}\n\nexport type NativePushDispatchDeps = {\n  db: Database;\n  settings: Settings;\n  observability?: Pick<Observability, \"info\" | \"warn\" | \"error\">;\n  senders?: Partial<Record<\"ios\" | \"android\", NativePushSender>>;\n};\n\n/**\n * A notification message as plain text for the lock screen: links keep their\n * text, emphasis and code marks go, and \"- \" bullets become \"•\".\n */\nexport function plainNotificationText(markdown: string): string {\n  return markdown\n    .replace(/\\[([^\\]]+)\\]\\((?:[^)]+)\\)/gu, \"$1\")\n    .replace(/(\\*\\*|__)(.+?)\\1/gu, \"$2\")\n    .replace(/`([^`]+)`/gu, \"$1\")\n    .replace(/^[ \\t]*[-*][ \\t]+/gmu, \"• \")\n    .replace(/\\n{3,}/gu, \"\\n\\n\")\n    .trim();\n}\n\n/** The visible text of a push: title, optional subtitle, and the message with its facts. */\nexport function nativePushAlert(payload: NativePushPayload): {\n  title: string;\n  subtitle?: string;\n  body?: string;\n} {\n  if (payload.secretQuestion) {\n    // A secret is answered only in the app's secure card (AC-5): no inline reply.\n    return { title: payload.title ?? \"The agent needs a secret\", body: SECRET_QUESTION_PUSH_BODY };\n  }\n  const fallback =\n    payload.rule === \"needs_input\"\n      ? \"The agent needs you\"\n      : payload.rule === \"failed\"\n        ? \"A turn failed\"\n        : payload.rule === \"reply_ready\"\n          ? \"Reply ready\"\n          : \"Opengeni\";\n  const facts = (payload.facts ?? [])\n    .slice(0, 4)\n    .map((fact) => `${fact.label}: ${fact.value}`)\n    .join(\"\\n\");\n  const message = payload.body ? plainNotificationText(payload.body) : \"\";\n  // A notification with no message of its own carries its title as the body;\n  // show the title once.\n  const lines = [message === payload.title ? \"\" : message, facts].filter(Boolean);\n  const body = lines.join(\"\\n\\n\");\n  return {\n    title: payload.title ?? fallback,\n    ...(payload.subtitle ? { subtitle: payload.subtitle } : {}),\n    ...(body || payload.rule !== \"agent\" ? { body: body || fallback } : {}),\n  };\n}\n\n/**\n * What breaks through Focus: an agent notification the agent marked\n * time-sensitive, and questions and approvals for a person who asked for them\n * to (their setting puts the urgency on the delivery). Everything else, and\n * replies and failures always, arrive as ordinary alerts, so Focus and the\n * person's own notification settings decide when they show.\n */\nexport function nativePushInterruptionLevel(\n  payload: ClaimedNativePushDelivery[\"payload\"],\n): \"time-sensitive\" | \"active\" {\n  if (\n    (payload.rule === \"agent\" || payload.rule === \"needs_input\") &&\n    payload.urgency === \"time_sensitive\"\n  ) {\n    return \"time-sensitive\";\n  }\n  return \"active\";\n}\n\n/** What the app reads on tap: enough to open the session in the right account. */\nexport function nativePushData(payload: ClaimedNativePushDelivery[\"payload\"]) {\n  return {\n    sessionId: payload.sessionId,\n    workspaceId: payload.workspaceId,\n    subjectId: payload.subjectId,\n    rule: payload.rule,\n    ...(payload.eventType ? { eventType: payload.eventType } : {}),\n    ...(payload.sequence ? { sequence: payload.sequence } : {}),\n  };\n}\n\n/**\n * The notification category the app registers actions for: an approval can be\n * approved (behind device unlock) or denied, a question answered inline.\n */\nexport function nativePushCategory(\n  payload: NativePushPayload,\n): \"og.approval\" | \"og.question\" | undefined {\n  if (payload.secretQuestion) return undefined;\n  if (payload.eventType === \"session.requiresAction\") return \"og.approval\";\n  if (payload.eventType === \"session.humanInput.requested\") return \"og.question\";\n  return undefined;\n}\n\nfunction base64Url(input: Buffer | string): string {\n  return Buffer.from(input).toString(\"base64url\");\n}\n\nfunction signJwt(\n  header: Record<string, string>,\n  claims: Record<string, unknown>,\n  privateKey: string,\n  algorithm: \"ES256\" | \"RS256\",\n): string {\n  const unsigned = `${base64Url(JSON.stringify(header))}.${base64Url(JSON.stringify(claims))}`;\n  const signer = createSign(\"SHA256\");\n  signer.update(unsigned);\n  const signature =\n    algorithm === \"ES256\"\n      ? signer.sign({ key: privateKey, dsaEncoding: \"ieee-p1363\" })\n      : signer.sign(privateKey);\n  return `${unsigned}.${base64Url(signature)}`;\n}\n\nfunction pem(value: string): string {\n  return value.includes(\"\\\\n\") ? value.replace(/\\\\n/gu, \"\\n\") : value;\n}\n\n/** APNs with a token-based (.p8) key; one HTTP/2 connection per environment. */\nexport function createApnsSender(input: {\n  keyId: string;\n  teamId: string;\n  privateKey: string;\n}): NativePushSender {\n  const key = pem(input.privateKey);\n  let token: { value: string; issuedAt: number } | null = null;\n  const sessions = new Map<string, ClientHttp2Session>();\n  const bearer = () => {\n    const now = Math.floor(Date.now() / 1000);\n    // Apple accepts a provider token for an hour and rejects refreshes more\n    // often than every 20 minutes.\n    if (!token || now - token.issuedAt > 40 * 60) {\n      token = {\n        value: signJwt(\n          { alg: \"ES256\", kid: input.keyId },\n          { iss: input.teamId, iat: now },\n          key,\n          \"ES256\",\n        ),\n        issuedAt: now,\n      };\n    }\n    return token.value;\n  };\n  const session = (host: string) => {\n    const existing = sessions.get(host);\n    if (existing && !existing.closed && !existing.destroyed) return existing;\n    const created = connect(`https://${host}`);\n    created.on(\"error\", () => sessions.delete(host));\n    created.on(\"close\", () => sessions.delete(host));\n    sessions.set(host, created);\n    return created;\n  };\n  return async (delivery) => {\n    const host =\n      delivery.environment === \"development\" ? \"api.sandbox.push.apple.com\" : \"api.push.apple.com\";\n    const alert = nativePushAlert(delivery.payload);\n    const category = nativePushCategory(delivery.payload);\n    const body = JSON.stringify({\n      aps: {\n        alert,\n        sound: \"default\",\n        \"thread-id\": delivery.payload.sessionId,\n        \"interruption-level\": nativePushInterruptionLevel(delivery.payload),\n        ...(category ? { category } : {}),\n      },\n      body: nativePushData(delivery.payload),\n    });\n    return await new Promise<NativePushSendResult>((resolve) => {\n      const request = session(host).request({\n        \":method\": \"POST\",\n        \":path\": `/3/device/${delivery.token}`,\n        authorization: `bearer ${bearer()}`,\n        \"apns-topic\": delivery.appId,\n        \"apns-push-type\": \"alert\",\n        \"apns-priority\": \"10\",\n        \"apns-collapse-id\": `${delivery.payload.sessionId}:${delivery.payload.rule}`.slice(0, 64),\n        \"content-type\": \"application/json\",\n      });\n      let status = 0;\n      let text = \"\";\n      request.setTimeout(10_000, () => request.close());\n      request.on(\"response\", (headers) => {\n        status = Number(headers[\":status\"] ?? 0);\n      });\n      request.on(\"data\", (chunk: Buffer) => {\n        text += chunk.toString(\"utf8\");\n      });\n      request.on(\"error\", (error) => resolve({ outcome: \"retry\", error: String(error) }));\n      request.on(\"close\", () => {\n        if (status === 200) return resolve({ outcome: \"delivered\" });\n        const reason = (() => {\n          try {\n            return (JSON.parse(text) as { reason?: string }).reason ?? text;\n          } catch {\n            return text || `status ${status}`;\n          }\n        })();\n        if (status === 410 || reason === \"BadDeviceToken\" || reason === \"Unregistered\") {\n          return resolve({ outcome: \"unregistered\", error: `${status} ${reason}` });\n        }\n        resolve({\n          outcome: status === 429 || status >= 500 || status === 0 ? \"retry\" : \"failed\",\n          error: `${status} ${reason}`,\n        });\n      });\n      request.end(body);\n    });\n  };\n}\n\n/** FCM HTTP v1 with a service account; data-only, so the app presents it. */\nexport function createFcmSender(input: {\n  serviceAccountJson: string;\n  fetch?: typeof fetch;\n}): NativePushSender {\n  const account = JSON.parse(input.serviceAccountJson) as {\n    project_id: string;\n    client_email: string;\n    private_key: string;\n    token_uri?: string;\n  };\n  const http = input.fetch ?? fetch;\n  let access: { token: string; expiresAt: number } | null = null;\n  const accessToken = async () => {\n    if (access && access.expiresAt - 60_000 > Date.now()) return access.token;\n    const now = Math.floor(Date.now() / 1000);\n    const tokenUri = account.token_uri ?? \"https://oauth2.googleapis.com/token\";\n    const assertion = signJwt(\n      { alg: \"RS256\", typ: \"JWT\" },\n      {\n        iss: account.client_email,\n        scope: \"https://www.googleapis.com/auth/firebase.messaging\",\n        aud: tokenUri,\n        iat: now,\n        exp: now + 3600,\n      },\n      pem(account.private_key),\n      \"RS256\",\n    );\n    const response = await http(tokenUri, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:jwt-bearer\",\n        assertion,\n      }),\n    });\n    if (!response.ok) throw new Error(`FCM token exchange failed: ${response.status}`);\n    const json = (await response.json()) as { access_token: string; expires_in: number };\n    access = { token: json.access_token, expiresAt: Date.now() + json.expires_in * 1000 };\n    return access.token;\n  };\n  return async (delivery) => {\n    try {\n      const alert = nativePushAlert(delivery.payload);\n      const response = await http(\n        `https://fcm.googleapis.com/v1/projects/${account.project_id}/messages:send`,\n        {\n          method: \"POST\",\n          headers: {\n            authorization: `Bearer ${await accessToken()}`,\n            \"content-type\": \"application/json\",\n          },\n          body: JSON.stringify({\n            message: {\n              token: delivery.token,\n              android: { priority: \"HIGH\", collapse_key: delivery.payload.sessionId },\n              data: {\n                title: alert.title,\n                message: [alert.subtitle, alert.body].filter(Boolean).join(\"\\n\") || alert.title,\n                body: JSON.stringify(nativePushData(delivery.payload)),\n              },\n            },\n          }),\n          signal: AbortSignal.timeout(10_000),\n        },\n      );\n      if (response.ok) return { outcome: \"delivered\" };\n      const text = await response.text();\n      if (response.status === 404 || text.includes(\"UNREGISTERED\")) {\n        return { outcome: \"unregistered\", error: `${response.status} ${text.slice(0, 200)}` };\n      }\n      return {\n        outcome: response.status === 429 || response.status >= 500 ? \"retry\" : \"failed\",\n        error: `${response.status} ${text.slice(0, 200)}`,\n      };\n    } catch (error) {\n      return { outcome: \"retry\", error: String(error).slice(0, 300) };\n    }\n  };\n}\n\n/** The senders this deployment has credentials for. */\nexport function configuredNativePushSenders(\n  settings: Settings,\n): Partial<Record<\"ios\" | \"android\", NativePushSender>> {\n  const senders: Partial<Record<\"ios\" | \"android\", NativePushSender>> = {};\n  if (settings.apnsKeyId && settings.apnsTeamId && settings.apnsPrivateKey) {\n    senders.ios = createApnsSender({\n      keyId: settings.apnsKeyId,\n      teamId: settings.apnsTeamId,\n      privateKey: settings.apnsPrivateKey,\n    });\n  }\n  if (settings.fcmServiceAccountJson) {\n    senders.android = createFcmSender({ serviceAccountJson: settings.fcmServiceAccountJson });\n  }\n  return senders;\n}\n\nexport async function drainNativePushDeliveries(\n  deps: NativePushDispatchDeps,\n): Promise<{ claimed: number; delivered: number }> {\n  const senders = deps.senders ?? configuredNativePushSenders(deps.settings);\n  const claimId = randomUUID();\n  const claimed = await markSecretQuestionDeliveries(\n    deps.db,\n    await claimNativePushDeliveries(deps.db, {\n      claimId,\n      limit: 32,\n      claimSeconds: CLAIM_SECONDS,\n    }),\n  );\n  let delivered = 0;\n  await Promise.all(\n    claimed.map(async (delivery) => {\n      const sender = senders[delivery.platform];\n      const result: NativePushSendResult = sender\n        ? await sender(delivery).catch((error: unknown) => ({\n            outcome: \"retry\" as const,\n            error: String(error),\n          }))\n        : { outcome: \"failed\", error: `No ${delivery.platform} push credentials configured` };\n      const outcome =\n        result.outcome === \"retry\" && delivery.attempts >= MAX_ATTEMPTS ? \"failed\" : result.outcome;\n      if (outcome === \"delivered\") delivered += 1;\n      else\n        deps.observability?.warn(\"Native push not delivered\", {\n          platform: delivery.platform,\n          outcome,\n          error: result.error,\n        });\n      await settleNativePushDelivery(deps.db, {\n        claimId,\n        deliveryId: delivery.deliveryId,\n        outcome,\n        error: result.error ?? null,\n        retrySeconds: Math.min(3600, 5 * 2 ** delivery.attempts),\n      });\n    }),\n  );\n  return { claimed: claimed.length, delivered };\n}\n\nexport function startNativePushDispatchPump(deps: NativePushDispatchDeps): () => Promise<void> {\n  const senders = deps.senders ?? configuredNativePushSenders(deps.settings);\n  let stopped = false;\n  let ticks = 0;\n  let running: Promise<void> | null = null;\n  const tick = async () => {\n    ticks += 1;\n    try {\n      const { claimed } = await drainNativePushDeliveries({ ...deps, senders });\n      if (claimed > 0) deps.observability?.info(\"Native push batch\", { claimed });\n      if (ticks % PRUNE_EVERY_TICKS === 0) await pruneNativePushDeliveries(deps.db);\n    } catch (error) {\n      deps.observability?.error(\"Native push dispatch failed\", { error: String(error) });\n    }\n  };\n  const timer = setInterval(() => {\n    if (stopped || running) return;\n    running = tick().finally(() => {\n      running = null;\n    });\n  }, POLL_INTERVAL_MS);\n  return async () => {\n    stopped = true;\n    clearInterval(timer);\n    await running;\n  };\n}\n","import { randomUUID } from \"node:crypto\";\nimport { environmentsEncryptionKeyBytes, type Settings } from \"@opengeni/config\";\nimport {\n  OPENGENI_DELIVERY_ID_HEADER,\n  OPENGENI_EVENT_ID_HEADER,\n  OPENGENI_SIGNATURE_HEADER,\n  signOpenGeniPayload,\n} from \"@opengeni/contracts\";\nimport {\n  claimWorkspaceWebhookDeliveries,\n  claimOrganizationWebhookDeliveries,\n  decryptEnvironmentValue,\n  maintainSessionUsageLimits,\n  maintainWorkspaceAllowances,\n  pruneOrganizationWebhookDeliveries,\n  pruneWorkspaceWebhookDeliveries,\n  settleOrganizationWebhookDelivery,\n  settleWorkspaceWebhookDelivery,\n  type ClaimedWorkspaceWebhookDelivery,\n  type Database,\n} from \"@opengeni/db\";\nimport { pinnedFetch } from \"@opengeni/network\";\nimport type { Observability } from \"@opengeni/observability\";\nimport { recordSessionUsageLimitEvent } from \"@opengeni/core\";\n\nexport const WORKSPACE_WEBHOOK_DISPATCH_BATCH_SIZE = 32;\nconst CLAIM_SECONDS = 60;\nconst POLL_INTERVAL_MS = 2_000;\nconst DELIVERY_TIMEOUT_MS = 10_000;\nconst PRUNE_EVERY_TICKS = 300;\n\nexport type WorkspaceWebhookDispatchDeps = {\n  db: Database;\n  settings: Settings;\n  observability?: Pick<Observability, \"info\" | \"warn\" | \"error\"> &\n    Partial<Pick<Observability, \"incrementCounter\">>;\n  fetch?: typeof pinnedFetch;\n};\n\nexport type WorkspaceWebhookBatchResult = { claimed: number; delivered: number; failed: number };\n\nfunction errorText(error: unknown): string {\n  if (error instanceof Error) {\n    if (error.name === \"TimeoutError\" || error.name === \"AbortError\") return \"timeout\";\n    return `${error.name}: ${error.message}`.slice(0, 500);\n  }\n  return String(error).slice(0, 500);\n}\n\nasync function deliverOne(\n  deps: WorkspaceWebhookDispatchDeps,\n  key: Uint8Array,\n  claimId: string,\n  delivery: ClaimedWorkspaceWebhookDelivery,\n  organization = false,\n): Promise<\"delivered\" | \"failed\"> {\n  let status: number | null = null;\n  let error: string | null = null;\n  try {\n    const body = JSON.stringify(delivery.payload);\n    const secret = decryptEnvironmentValue(key, delivery.secretEncrypted);\n    const response = await (deps.fetch ?? pinnedFetch)(\n      delivery.url,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n          \"user-agent\": \"OpenGeni-Webhooks/1\",\n          [OPENGENI_SIGNATURE_HEADER]: await signOpenGeniPayload(secret, body),\n          [OPENGENI_EVENT_ID_HEADER]: delivery.eventId,\n          [OPENGENI_DELIVERY_ID_HEADER]: delivery.deliveryId,\n        },\n        body,\n        signal: AbortSignal.timeout(DELIVERY_TIMEOUT_MS),\n      },\n      deps.settings,\n      {\n        label: organization ? \"Organization webhook\" : \"Workspace webhook\",\n        requireHttpsOutsideLocalTest: true,\n      },\n    );\n    status = response.status;\n    await response.body?.cancel().catch(() => undefined);\n    if (status < 200 || status >= 300) error = `HTTP ${status}`;\n  } catch (caught) {\n    error = errorText(caught);\n  }\n  await (organization ? settleOrganizationWebhookDelivery : settleWorkspaceWebhookDelivery)(\n    deps.db,\n    {\n      deliveryId: delivery.deliveryId,\n      claimId,\n      status,\n      error,\n    },\n  );\n  return error === null ? \"delivered\" : \"failed\";\n}\n\n/**\n * One bounded, resumable page of the per-task usage limit legacy import.\n * Roots created before the feature stay `preparing` (never shown or\n * admitted as $0 for a write) until this converges them. A failure is retried\n * on a later tick (per-root exponential backoff with its SQLSTATE kept) and\n * never blocks webhook delivery. The same pass discloses lost single-call\n * custody markers as unpriced so a crashed process cannot block a task forever.\n */\nasync function importLegacySessionUsage(deps: WorkspaceWebhookDispatchDeps): Promise<void> {\n  const sink = deps.observability?.incrementCounter ? deps.observability : null;\n  const metrics = sink as Pick<Observability, \"incrementCounter\"> | null;\n  try {\n    const result = await maintainSessionUsageLimits(deps.db);\n    recordSessionUsageLimitEvent(metrics, \"import\", \"imported\", result.processed);\n    recordSessionUsageLimitEvent(metrics, \"import\", \"import_failed\", result.failed);\n    recordSessionUsageLimitEvent(metrics, \"single_call\", \"lost_resolved\", result.resolvedLost);\n    if (result.failed > 0) {\n      deps.observability?.warn(\"Session usage limit import pages failed\", {\n        failed: result.failed,\n        sqlstates: JSON.stringify(result.errors),\n      });\n    }\n  } catch (error) {\n    recordSessionUsageLimitEvent(metrics, \"import\", \"import_failed\");\n    deps.observability?.warn(\"Session usage limit import failed\", { error: errorText(error) });\n  }\n}\n\n/** Claim and deliver one globally bounded batch. At-least-once: receivers dedupe on event id. */\nexport async function drainWorkspaceWebhookDeliveries(\n  deps: WorkspaceWebhookDispatchDeps,\n): Promise<WorkspaceWebhookBatchResult> {\n  // Usage-limit maintenance contains its own failures, so it runs first: a\n  // failing allowance pass cannot keep lost custody markers (and the tasks\n  // they park) unresolved.\n  await importLegacySessionUsage(deps);\n  // Allowance rollover/expiry does not depend on webhook secrets, usage\n  // readers, inference or having any pending delivery.\n  await maintainWorkspaceAllowances(deps.db);\n  const key = environmentsEncryptionKeyBytes(deps.settings);\n  if (!key) return { claimed: 0, delivered: 0, failed: 0 };\n  const claimId = randomUUID();\n  const claims = await claimWorkspaceWebhookDeliveries(deps.db, {\n    claimId,\n    limit: WORKSPACE_WEBHOOK_DISPATCH_BATCH_SIZE,\n    claimSeconds: CLAIM_SECONDS,\n  });\n  // Each lane is bounded; the shared pump does not starve organization queues\n  // behind a sustained workspace backlog.\n  const organizationClaims = await claimOrganizationWebhookDeliveries(deps.db, {\n    claimId,\n    limit: WORKSPACE_WEBHOOK_DISPATCH_BATCH_SIZE,\n    claimSeconds: CLAIM_SECONDS,\n  });\n  const outcomes = await Promise.all(\n    [\n      ...claims.map((delivery) => ({ delivery, organization: false })),\n      ...organizationClaims.map((delivery) => ({ delivery, organization: true })),\n    ].map(async ({ delivery, organization }) => {\n      try {\n        return await deliverOne(deps, key, claimId, delivery, organization);\n      } catch (error) {\n        deps.observability?.warn(\"Workspace webhook settlement failed\", {\n          deliveryId: delivery.deliveryId,\n          error: errorText(error),\n        });\n        return \"failed\" as const;\n      }\n    }),\n  );\n  return {\n    claimed: claims.length + organizationClaims.length,\n    delivered: outcomes.filter((outcome) => outcome === \"delivered\").length,\n    failed: outcomes.filter((outcome) => outcome === \"failed\").length,\n  };\n}\n\n/**\n * One non-overlapping loop per API replica. PostgreSQL claims coordinate\n * replicas; a crash only delays a delivery until its claim expires.\n */\nexport function startWorkspaceWebhookDispatchPump(\n  deps: WorkspaceWebhookDispatchDeps,\n  options: {\n    intervalMs?: number;\n    drain?: (deps: WorkspaceWebhookDispatchDeps) => Promise<WorkspaceWebhookBatchResult>;\n  } = {},\n): () => Promise<void> {\n  const intervalMs = Math.max(100, options.intervalMs ?? POLL_INTERVAL_MS);\n  const drain = options.drain ?? drainWorkspaceWebhookDeliveries;\n  let stopped = false;\n  let running: Promise<void> | undefined;\n  let ticks = 0;\n\n  const tick = (): void => {\n    if (stopped || running) return;\n    ticks += 1;\n    // A full batch means a backlog: drain it now instead of one batch per interval.\n    let backlog = false;\n    running = (async () => {\n      const result = await drain(deps);\n      backlog = result.claimed >= WORKSPACE_WEBHOOK_DISPATCH_BATCH_SIZE;\n      if (result.claimed > 0) deps.observability?.info(\"Workspace webhook batch settled\", result);\n      if (ticks % PRUNE_EVERY_TICKS === 0) {\n        await pruneWorkspaceWebhookDeliveries(deps.db);\n        await pruneOrganizationWebhookDeliveries(deps.db);\n      }\n    })()\n      .catch((error: unknown) => {\n        deps.observability?.error(\"Workspace webhook dispatch failed\", { error: errorText(error) });\n      })\n      .finally(() => {\n        running = undefined;\n        if (backlog && !stopped) queueMicrotask(tick);\n      });\n  };\n\n  const timer = setInterval(tick, intervalMs);\n  queueMicrotask(tick);\n\n  return async () => {\n    stopped = true;\n    clearInterval(timer);\n    await running;\n  };\n}\n","import {\n  EditableArtifactDomainError,\n  EditableArtifactLiveError,\n  decodeEditableArtifactLiveClientWireFrame,\n  encodeEditableArtifactLiveServerWireFrame,\n  type EditableArtifactApplicationPort,\n  type EditableArtifactLiveClose,\n  type EditableArtifactLiveServerFrame,\n  type EditableArtifactLiveSession,\n  type EditableArtifactLiveSinkPort,\n  type OpenEditableArtifactLiveInput,\n} from \"@opengeni/core\";\nimport type {\n  ApiWebSocketConnection,\n  ApiWebSocketLike,\n  ApiWebSocketUpgradeServer,\n} from \"./api-websocket\";\n\nexport const EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PATH = \"/v1/editable-artifacts/live\";\nexport const EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PROTOCOL = \"opengeni-artifact-v2\";\nexport const EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES = 8 * 1024 * 1024 + 64 * 1024;\n\nconst MAX_QUEUED_MESSAGES = 64;\nconst MAX_QUEUED_BYTES = 12 * 1024 * 1024;\n\nexport type EditableArtifactWebSocketLike = ApiWebSocketLike;\n\nexport type EditableArtifactWebSocketUpgradeServer = ApiWebSocketUpgradeServer;\n\nexport type EditableArtifactWebSocketHandler = Readonly<{\n  open(socket: EditableArtifactWebSocketLike): void;\n  message(socket: EditableArtifactWebSocketLike, message: string | Uint8Array | ArrayBuffer): void;\n  close(socket: EditableArtifactWebSocketLike): void;\n}>;\n\nexport class EditableArtifactWebSocketTransport {\n  readonly websocket: EditableArtifactWebSocketHandler;\n\n  constructor(\n    private readonly application: EditableArtifactApplicationPort | undefined,\n    private readonly authorizeSourceSession?: OpenEditableArtifactLiveInput[\"authorizeSourceSession\"],\n  ) {\n    this.websocket = Object.freeze({\n      open: (socket) => socket.data.attach(socket),\n      message: (socket, message) => socket.data.receive(message),\n      close: (socket) => socket.data.transportClosed(),\n    });\n  }\n\n  handles(request: Request): boolean {\n    return new URL(request.url).pathname === EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PATH;\n  }\n\n  upgrade(request: Request, server: EditableArtifactWebSocketUpgradeServer): Response | undefined {\n    const url = new URL(request.url);\n    if (url.pathname !== EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PATH) return undefined;\n    if (request.method !== \"GET\") {\n      return new Response(\"Method Not Allowed\", {\n        status: 405,\n        headers: { allow: \"GET\" },\n      });\n    }\n    if (!this.application) return new Response(\"Service Unavailable\", { status: 503 });\n    if (!offeredProtocol(request.headers.get(\"sec-websocket-protocol\"))) {\n      return new Response(\"WebSocket protocol required\", { status: 426 });\n    }\n    const connection = new EditableArtifactWebSocketConnection(\n      this.application,\n      this.authorizeSourceSession,\n    );\n    const upgraded = server.upgrade(request, {\n      data: connection,\n      headers: {\n        \"sec-websocket-protocol\": EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PROTOCOL,\n      },\n    });\n    return upgraded ? undefined : new Response(\"Bad Request\", { status: 400 });\n  }\n}\n\n/** One socket, one consumed ticket, one stream epoch. */\nexport class EditableArtifactWebSocketConnection\n  implements EditableArtifactLiveSinkPort, ApiWebSocketConnection\n{\n  private socket: EditableArtifactWebSocketLike | null = null;\n  private session: EditableArtifactLiveSession | null = null;\n  private work: Promise<void> = Promise.resolve();\n  private queuedMessages = 0;\n  private queuedBytes = 0;\n  private terminal = false;\n\n  constructor(\n    private readonly application: EditableArtifactApplicationPort,\n    private readonly authorizeSourceSession?: OpenEditableArtifactLiveInput[\"authorizeSourceSession\"],\n  ) {}\n\n  attach(socket: EditableArtifactWebSocketLike): void {\n    if (this.socket || this.terminal) {\n      socket.close(4400, \"invalid connection state\");\n      return;\n    }\n    this.socket = socket;\n  }\n\n  receive(message: string | Uint8Array | ArrayBuffer): void {\n    if (this.terminal) return;\n    if (typeof message === \"string\") {\n      void this.fail(\"invalid_frame\");\n      return;\n    }\n    const byteLength = message.byteLength;\n    if (\n      byteLength === 0 ||\n      byteLength > EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES ||\n      this.queuedMessages + 1 > MAX_QUEUED_MESSAGES ||\n      this.queuedBytes + byteLength > MAX_QUEUED_BYTES\n    ) {\n      void this.fail(\n        byteLength > EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES\n          ? \"oversized_frame\"\n          : \"slow_client\",\n      );\n      return;\n    }\n    const bytes =\n      message instanceof Uint8Array ? Uint8Array.from(message) : new Uint8Array(message).slice();\n    this.queuedMessages += 1;\n    this.queuedBytes += bytes.byteLength;\n    const run = this.work.then(async () => {\n      try {\n        await this.process(bytes);\n      } finally {\n        this.queuedMessages -= 1;\n        this.queuedBytes -= bytes.byteLength;\n      }\n    });\n    this.work = run.catch(async (error: unknown) => {\n      await this.handleFailure(error);\n    });\n  }\n\n  async send(frame: EditableArtifactLiveServerFrame): Promise<void> {\n    if (this.terminal || !this.socket) {\n      throw new EditableArtifactLiveError(\"closed\", \"Editable artifact socket is closed\");\n    }\n    const bytes = encodeEditableArtifactLiveServerWireFrame(frame);\n    if (bytes.byteLength > EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES) {\n      throw new EditableArtifactLiveError(\n        \"oversized_frame\",\n        \"Editable artifact server frame exceeds socket limit\",\n        { requiresSnapshot: true },\n      );\n    }\n    const accepted = this.socket.send(bytes, false);\n    if (!Number.isSafeInteger(accepted) || accepted <= 0) {\n      throw new EditableArtifactLiveError(\"closed\", \"Editable artifact socket rejected frame\");\n    }\n  }\n\n  bufferedBytes(): number {\n    const buffered = this.socket?.getBufferedAmount?.() ?? this.socket?.bufferedAmount ?? 0;\n    return Number.isSafeInteger(buffered) && buffered >= 0 ? buffered : Number.MAX_SAFE_INTEGER;\n  }\n\n  close(close: EditableArtifactLiveClose): void {\n    if (this.terminal) return;\n    this.terminal = true;\n    this.socket?.close(closeCode(close.reason), close.reason);\n  }\n\n  transportClosed(): void {\n    if (this.terminal) return;\n    this.terminal = true;\n    void this.session?.close(\"transport_error\");\n  }\n\n  private async process(bytes: Uint8Array): Promise<void> {\n    if (this.terminal) return;\n    const frame = decodeEditableArtifactLiveClientWireFrame(bytes);\n    if (!this.session) {\n      if (frame.type !== \"open\") {\n        throw new EditableArtifactLiveError(\"invalid_frame\", \"First socket frame must be open\");\n      }\n      const session = await this.application.openLive({\n        token: frame.token,\n        artifactId: frame.artifactId,\n        protocolVersion: frame.protocolVersion,\n        resume: frame.resume,\n        sink: this,\n        ...(this.authorizeSourceSession\n          ? { authorizeSourceSession: this.authorizeSourceSession }\n          : {}),\n      });\n      if (this.terminal) {\n        await session.close(\"transport_error\");\n        return;\n      }\n      this.session = session;\n      void session.closed.then(() => {\n        if (!this.terminal)\n          this.close({\n            reason: \"closed\",\n            retryable: false,\n            requiresSnapshot: false,\n          });\n      });\n      return;\n    }\n    if (frame.type === \"open\") {\n      throw new EditableArtifactLiveError(\"invalid_frame\", \"Socket is already open\");\n    }\n    if (\n      frame.artifactId !== this.session.artifactId ||\n      frame.streamEpoch !== this.session.streamEpoch\n    ) {\n      throw new EditableArtifactLiveError(\"stale_epoch\", \"Socket frame belongs to another stream\");\n    }\n    if (frame.type === \"applied\") {\n      await this.session.acknowledge(frame);\n      return;\n    }\n    let receipt: Awaited<ReturnType<EditableArtifactLiveSession[\"submitIntent\"]>>;\n    try {\n      receipt = await this.session.submitIntent(frame);\n    } catch (error) {\n      await this.send({\n        type: \"mutationRejected\",\n        protocolVersion: frame.protocolVersion,\n        artifactId: frame.artifactId,\n        streamEpoch: frame.streamEpoch,\n        requestHash: frame.requestHash,\n        ...mutationFailure(error),\n      });\n      return;\n    }\n    // Always return the exact durable canonical transaction evidence (OGACO\n    // or OGAST) on this request's socket, including idempotent unknown-outcome\n    // retries whose original fanout was already replayed and ACKed. Transaction\n    // first, mapping second: acceptance is never exposed without settle bytes.\n    await this.send({\n      type: \"transaction\",\n      protocolVersion: frame.protocolVersion,\n      artifactId: frame.artifactId,\n      streamEpoch: frame.streamEpoch,\n      transaction: receipt.transaction,\n    });\n    await this.send({\n      type: \"mutationAccepted\",\n      protocolVersion: frame.protocolVersion,\n      artifactId: frame.artifactId,\n      streamEpoch: frame.streamEpoch,\n      requestHash: receipt.requestHash,\n      clientTransactionId: receipt.clientTransactionId,\n      transactionId: receipt.transaction.transactionId,\n      startSequence: receipt.transaction.startSequence,\n      endSequence: receipt.transaction.endSequence,\n      stateHash: receipt.transaction.stateHash,\n    });\n  }\n\n  private async handleFailure(error: unknown): Promise<void> {\n    if (this.terminal) return;\n    if (error instanceof EditableArtifactLiveError) {\n      await this.fail(error.code === \"invalid_ticket\" ? \"transport_error\" : error.code);\n      return;\n    }\n    await this.fail(\"transport_error\");\n  }\n\n  private async fail(reason: Parameters<EditableArtifactLiveSession[\"close\"]>[0]): Promise<void> {\n    if (this.terminal) return;\n    this.terminal = true;\n    await this.session?.close(reason).catch(() => undefined);\n    this.socket?.close(closeCode(reason ?? \"transport_error\"), reason ?? \"transport_error\");\n  }\n}\n\nfunction mutationFailure(error: unknown): Readonly<{\n  code: \"invalid_request\" | \"forbidden\" | \"conflict\" | \"unsupported\" | \"unavailable\";\n  retryable: boolean;\n}> {\n  if (error instanceof EditableArtifactDomainError) {\n    if (error.code === \"forbidden\") return { code: \"forbidden\", retryable: false };\n    if ([\"invalid_request\", \"request_hash_mismatch\", \"invalid_undo_target\"].includes(error.code)) {\n      return { code: \"invalid_request\", retryable: false };\n    }\n    if (error.code === \"kernel_contract_violation\") {\n      return { code: \"unsupported\", retryable: false };\n    }\n    if ([\"retryable_conflict\", \"outbox_lease_conflict\"].includes(error.code)) {\n      return { code: \"conflict\", retryable: true };\n    }\n    return { code: \"conflict\", retryable: false };\n  }\n  if (error instanceof EditableArtifactLiveError && error.code === \"permission_changed\") {\n    return { code: \"forbidden\", retryable: false };\n  }\n  return { code: \"unavailable\", retryable: true };\n}\n\nfunction offeredProtocol(value: string | null): boolean {\n  return (\n    value\n      ?.split(\",\")\n      .map((part) => part.trim())\n      .includes(EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PROTOCOL) ?? false\n  );\n}\n\nfunction closeCode(reason: string): number {\n  if (reason === \"permission_changed\") return 4403;\n  if (reason === \"ticket_expired\" || reason === \"ticket_replayed\") return 4401;\n  if (reason === \"protocol_mismatch\") return 4406;\n  if (reason === \"slow_client\" || reason === \"oversized_frame\") return 4409;\n  if (reason === \"closed\") return 1000;\n  return 4400;\n}\n","import {\n  hasPermission,\n  requireExternalContinuationAuthority,\n  requireSessionAuthorization,\n  type ApiRouteDeps,\n  type OpenEditableArtifactLiveInput,\n} from \"@opengeni/core\";\nimport {\n  findActiveWorkspaceApiKeyById,\n  getSession,\n  getWorkspaceGrant,\n  hasEditableArtifactSessionLink,\n  lockExternalWorkspaceMembershipLifecycle,\n  withRlsContext,\n} from \"@opengeni/db\";\nimport { withAccessGrantSessionRlsContext } from \"./access-grant-rls\";\nimport { sql } from \"drizzle-orm\";\n\n/** Supplied by the API adapter, so mounted hosts use their canonical live port. */\nexport function editableArtifactSourceSessionAuthorizer(\n  deps: ApiRouteDeps,\n): NonNullable<OpenEditableArtifactLiveInput[\"authorizeSourceSession\"]> {\n  return async (ticket, permission, transaction, signal) => {\n    signal?.throwIfAborted();\n    const authority = ticket.sourceSessionAuthority;\n    if (!authority) return true;\n    const { grant } = authority;\n    const required = permission === \"edit\" ? \"artifacts:publish\" : \"artifacts:read\";\n    if (\n      !hasPermission(grant.permissions, required) ||\n      !hasPermission(grant.permissions, \"sessions:read\")\n    ) {\n      return false;\n    }\n    // An external audit shape without the verified continuation is not authority.\n    if (grant.metadata?.externalActor && !authority.externalContinuation) return false;\n    try {\n      const scopedDeps = transaction ? { ...deps, db: transaction } : deps;\n      // Source-bound stores invoke us before their tenancy/aggregate locks.\n      // Match lifecycle writers' organization -> tenancy -> session prefix.\n      if (transaction) {\n        await lockExternalWorkspaceMembershipLifecycle(transaction, ticket.scope.accountId);\n        signal?.throwIfAborted();\n        // Tenancy writers acquire this fence before source session rows.\n        await transaction.execute(sql`select pg_advisory_xact_lock_shared(\n          hashtextextended(${`session-tenancy:${ticket.scope.workspaceId}`}, 0))`);\n        signal?.throwIfAborted();\n      }\n      return await withAccessGrantSessionRlsContext(scopedDeps, grant, async () => {\n        return await withRlsContext(scopedDeps.db, ticket.scope, async (tx) => {\n          if (authority.externalContinuation) {\n            await requireExternalContinuationAuthority(\n              tx,\n              authority.externalContinuation,\n              { ...ticket.scope, subjectId: grant.subjectId },\n              [\"sessions:read\", required],\n            );\n            signal?.throwIfAborted();\n          } else if (transaction) {\n            // The authenticated ticket grant is a ceiling, not proof that\n            // source-read permission still exists at the commit boundary.\n            const actor = ticket.actor;\n            if (\n              actor.kind === \"human\" ||\n              (actor.kind === \"service\" && actor.service === \"configured_key\")\n            ) {\n              await tx.execute(sql`select subject_id from workspace_memberships\n                where account_id = ${ticket.scope.accountId}::uuid\n                  and workspace_id = ${ticket.scope.workspaceId}::uuid\n                  and subject_id = ${grant.subjectId} for share`);\n              const live = await getWorkspaceGrant(tx, grant.subjectId, ticket.scope.workspaceId);\n              if (!live || !hasPermission(live.permissions, \"sessions:read\")) return false;\n            } else if (actor.kind === \"service\" && actor.service === \"api_key\") {\n              await tx.execute(sql`select id from api_keys\n                where account_id = ${ticket.scope.accountId}::uuid\n                  and id::text = ${grant.subjectId.slice(\"api_key:\".length)}\n                for share`);\n              const live = await findActiveWorkspaceApiKeyById(tx, {\n                ...ticket.scope,\n                apiKeyId: grant.subjectId.slice(\"api_key:\".length),\n              });\n              if (!live || !hasPermission(live.permissions, \"sessions:read\")) return false;\n            } else if (actor.kind === \"agent\") {\n              const live = await getSession(tx, ticket.scope.workspaceId, actor.sessionId);\n              if (\n                !live ||\n                (live.firstPartyMcpPermissions !== null &&\n                  !hasPermission(live.firstPartyMcpPermissions, \"sessions:read\"))\n              ) {\n                return false;\n              }\n            } else {\n              return false;\n            }\n            signal?.throwIfAborted();\n          }\n          // Locks protect visibility and removal of the exact association\n          // until the enclosing mutation transaction commits.\n          const linked = await hasEditableArtifactSessionLink(\n            tx,\n            ticket.scope,\n            authority.sessionId,\n            ticket.artifactId,\n            { lockForCommit: transaction !== undefined },\n          );\n          signal?.throwIfAborted();\n          if (!linked) return false;\n          await requireSessionAuthorization({ ...scopedDeps, db: tx }, grant, {\n            sessionId: authority.sessionId,\n            operation: \"session.read\",\n            surface: \"http\",\n          });\n          signal?.throwIfAborted();\n          return true;\n        });\n      });\n    } catch {\n      // Denial or an unavailable authority must stop data/writes, never fall\n      // back to artifact-only scope. The live loop closes denied readers.\n      return false;\n    }\n  };\n}\n","import { localBrowserBoundaryResponse, type LocalBrowserBoundary } from \"./local-browser-boundary\";\n\nexport type ApiWebSocketUpgradeRoute<Server> = {\n  handles(request: Request): boolean;\n  upgrade(request: Request, server: Server): Response | undefined;\n};\n\nexport type ApiWebSocketUpgradeDispatch =\n  | { handled: false }\n  | { handled: true; response: Response | undefined };\n\n/**\n * WebSocket upgrades bypass the Hono app, so the local-mode browser boundary\n * (./local-browser-boundary.ts) is applied here before a transport upgrades.\n * Returns `{ handled: false }` when no transport claims the request, so the\n * caller dispatches it to the app, where the boundary runs as middleware.\n */\nexport function dispatchApiWebSocketUpgrade<Server>(\n  request: Request,\n  server: Server,\n  routes: ReadonlyArray<ApiWebSocketUpgradeRoute<Server>>,\n  localBrowserBoundary: LocalBrowserBoundary | null,\n): ApiWebSocketUpgradeDispatch {\n  const route = routes.find((candidate) => candidate.handles(request));\n  if (!route) return { handled: false };\n  const rejection = localBrowserBoundary?.rejection(request);\n  if (rejection) return { handled: true, response: localBrowserBoundaryResponse(rejection) };\n  return { handled: true, response: route.upgrade(request, server) };\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport {\n  editableArtifactMaterializerCapabilitiesForRuntime,\n  type EditableArtifactNativeMaterializerCapabilities,\n} from \"@opengeni/artifact-tool/runtime/materializer\";\nimport {\n  EditableArtifactDurableExportService,\n  EditableArtifactAgentApplication,\n  EDITABLE_ARTIFACT_EXPORT_FORMATS,\n  EDITABLE_ARTIFACT_EXPORT_MAX_DOWNLOAD_BYTES,\n  EditableArtifactCompactionPipeline,\n  EditableArtifactGenesisPipeline,\n  EditableArtifactService,\n  MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,\n  ProductionEditableArtifactSnapshotVerifier,\n  SystemEditableArtifactClock,\n  editableArtifactLiveReadPortFromPostgres,\n  editableArtifactLiveTicketStorePortFromPostgres,\n  editableArtifactStorePortFromPostgres,\n  editableArtifactDurableExportStorePortFromPostgres,\n  ogatxEditableArtifactMutationIntentCodec,\n  editableArtifactId,\n  type EditableArtifactAuthorizationDecision,\n  type EditableArtifactAuthorizationPort,\n  type EditableArtifactAuthorizationRequest,\n  type EditableArtifactStableIdFactoryPort,\n  type EditableArtifactStableIdKind,\n  type EditableArtifactDurableExportIdFactoryPort,\n  type EditableArtifactExactSnapshotPort,\n  type EditableArtifactAgentAssociationPort,\n  type EditableArtifactMaterializationProfilePort,\n} from \"@opengeni/core/editable-artifacts\";\nimport {\n  EditableArtifactApplication,\n  EditableArtifactCompatibilityError,\n  EditableArtifactLiveServer,\n  SystemEditableArtifactLiveClock,\n  SystemEditableArtifactLiveScheduler,\n  WebCryptoEditableArtifactLiveTokens,\n  type EditableArtifactApplicationPort,\n  type EditableArtifactLiveAuthorizationInvalidationPort,\n  type EditableArtifactLiveCompatibilityPort,\n} from \"@opengeni/core/editable-artifact-live\";\nimport { currentEditableArtifactCompatibility } from \"@opengeni/contracts/editable-artifacts\";\nimport {\n  PostgresEditableArtifactLiveReadStore,\n  PostgresEditableArtifactLiveTicketStore,\n  PostgresEditableArtifactStore,\n  listEditableArtifactIdsForSession,\n  touchEditableArtifactSessionLink,\n  recordNativeDocumentInspection,\n  dbSql,\n  withRlsContext,\n  type Database,\n  type PersistedEditableArtifactSnapshotBytesPort,\n  type PersistedEditableArtifactSnapshotMetadata,\n} from \"@opengeni/db\";\nimport { PostgresEditableArtifactDurableExportStore } from \"@opengeni/db/editable-artifact-durable-export\";\nimport type { EventBus } from \"@opengeni/events\";\nimport {\n  MAX_BOUNDED_OBJECT_CHUNK_BYTES,\n  createObjectStorageBoundedPorts,\n  type BoundedObjectReadPort,\n  type ObjectStorage,\n} from \"@opengeni/storage\";\nimport { EventBusEditableArtifactLiveHints } from \"./editable-artifact-live-hints\";\nimport {\n  NativeEditableArtifactKernelAdapter,\n  loadVerifiedNativeArtifactRuntimeBinding,\n} from \"./editable-artifact-native-kernel\";\nimport { EditableArtifactOfficeImportAdapter } from \"./editable-artifact-office-import\";\nimport { EditableArtifactWorkspaceFileAdapter } from \"./editable-artifact-workspace-files\";\n\nconst INVALIDATION_POLL_MS = 1_000;\nconst TICKET_CLEANUP_MS = 30_000;\n\nexport type StandaloneEditableArtifactApplication = Readonly<{\n  application: EditableArtifactApplicationPort;\n  durableExports: EditableArtifactDurableExportService;\n  agent: EditableArtifactAgentApplication;\n  officeImports: EditableArtifactOfficeImportAdapter;\n  kernelVersion: string;\n  close(): void;\n}>;\n\n/**\n * Standalone production composition. Every authority is durable: PostgreSQL\n * owns admission/authorization/history, object storage owns immutable model\n * bytes, and NATS carries wake-up hints only.\n */\nexport async function createStandaloneEditableArtifactApplication(input: {\n  db: Database;\n  bus: EventBus;\n  objectStorage: ObjectStorage;\n}): Promise<StandaloneEditableArtifactApplication> {\n  const boundedObjects = createObjectStorageBoundedPorts(input.objectStorage);\n  const materializationObjects = createObjectStorageBoundedPorts(input.objectStorage, {\n    keyPrefix: \"editable-artifacts/materializations/v1/sha256/\",\n  });\n  const importSourceObjects = createObjectStorageBoundedPorts(input.objectStorage, {\n    keyPrefix: \"editable-artifacts/imports/v1/sha256/\",\n  });\n  const runtimeBinding = await loadVerifiedNativeArtifactRuntimeBinding();\n  const runtime = runtimeBinding.runtime;\n  const kernel = new NativeEditableArtifactKernelAdapter(runtime, boundedObjects.read);\n  const persistedStore = new PostgresEditableArtifactStore(input.db);\n  const store = editableArtifactStorePortFromPostgres(persistedStore);\n  const authorization = new PostgresEditableArtifactAuthorization(input.db);\n  const ids = new RandomEditableArtifactStableIds();\n  const clock = new SystemEditableArtifactClock();\n  const snapshotVerifier = new ProductionEditableArtifactSnapshotVerifier({\n    objects: boundedObjects.read,\n    kernel,\n  });\n  const genesis = new EditableArtifactGenesisPipeline({\n    kernel,\n    objects: boundedObjects.write,\n    now: () => clock.now(),\n  });\n  const compaction = new EditableArtifactCompactionPipeline({\n    kernel,\n    objects: boundedObjects.write,\n    now: () => clock.now(),\n  });\n  const domain = new EditableArtifactService({\n    authorization,\n    kernel,\n    store,\n    intentCodec: ogatxEditableArtifactMutationIntentCodec,\n    clock,\n    ids,\n    snapshotVerifier,\n    genesis,\n    compaction,\n  });\n  const materializerCapabilities = editableArtifactMaterializerCapabilitiesForRuntime(\n    runtime,\n    runtimeBinding.location.artifactTool.packageVersion,\n  );\n  const durableExports = new EditableArtifactDurableExportService({\n    authorization,\n    exactSnapshots: Object.freeze({\n      ensure: async (request: Parameters<EditableArtifactExactSnapshotPort[\"ensure\"]>[0]) =>\n        await domain.compactCurrentHead(request),\n    }),\n    store: editableArtifactDurableExportStorePortFromPostgres(\n      new PostgresEditableArtifactDurableExportStore(input.db),\n    ),\n    ids: new RandomEditableArtifactDurableExportIds(),\n    profiles: materializationProfiles(materializerCapabilities),\n    materializationObjects: materializationObjects.read,\n  });\n  const officeImports = new EditableArtifactOfficeImportAdapter({\n    db: input.db,\n    objectStorage: input.objectStorage,\n    runtime: runtimeBinding,\n    sourceObjects: importSourceObjects.write,\n    snapshotObjects: boundedObjects.write,\n  });\n  const agent = new EditableArtifactAgentApplication({\n    domain,\n    exports: durableExports,\n    associations: Object.freeze({\n      listArtifactIds: async ({ scope, sessionId, limit }) =>\n        (await listEditableArtifactIdsForSession(input.db, scope, sessionId, limit)).map(\n          editableArtifactId,\n        ),\n      touch: async ({ scope, sessionId, artifactId }) =>\n        await touchEditableArtifactSessionLink(input.db, scope, sessionId, artifactId),\n    } satisfies EditableArtifactAgentAssociationPort),\n    inspector: kernel,\n    recordInspection: async (inspection) => {\n      if (inspection.actor.kind !== \"agent\")\n        throw new Error(\"Inspection proof requires an agent attempt\");\n      return recordNativeDocumentInspection(input.db, { ...inspection, actor: inspection.actor });\n    },\n    officeImports,\n    workspaceFiles: new EditableArtifactWorkspaceFileAdapter({\n      db: input.db,\n      objectStorage: input.objectStorage,\n      durableExports,\n    }),\n  });\n  const ticketStore = new PostgresEditableArtifactLiveTicketStore(input.db);\n  const liveRead = new PostgresEditableArtifactLiveReadStore(input.db, {\n    snapshotBytes: snapshotBytesPort(boundedObjects.read),\n  });\n  const invalidations = new PollingEditableArtifactAuthorizationInvalidations(authorization);\n  const live = new EditableArtifactLiveServer({\n    authorization,\n    domain,\n    tickets: editableArtifactLiveTicketStorePortFromPostgres(ticketStore),\n    tokens: new WebCryptoEditableArtifactLiveTokens(),\n    clock: new SystemEditableArtifactLiveClock(),\n    scheduler: new SystemEditableArtifactLiveScheduler(),\n    read: editableArtifactLiveReadPortFromPostgres(liveRead),\n    hints: new EventBusEditableArtifactLiveHints(input.bus),\n    invalidations,\n  });\n  const compatibility: EditableArtifactLiveCompatibilityPort = Object.freeze({\n    assertCompatible(\n      request: Parameters<EditableArtifactLiveCompatibilityPort[\"assertCompatible\"]>[0],\n    ) {\n      const current = currentEditableArtifactCompatibility(request.artifact.modality);\n      if (\n        request.modality !== request.artifact.modality ||\n        request.liveProtocolVersion !== current.liveProtocolVersion ||\n        request.modelSchemaVersion !== current.modelSchemaVersion ||\n        request.snapshotVersion !== current.snapshotVersion ||\n        request.commandProtocolVersion !== current.commandProtocolVersion ||\n        request.committedTransactionProtocolVersion !== current.committedTransactionProtocolVersion\n      ) {\n        throw new EditableArtifactCompatibilityError();\n      }\n    },\n  });\n  const application = new EditableArtifactApplication({\n    domain,\n    live,\n    compatibility,\n  });\n  const cleanup = setInterval(() => {\n    void ticketStore.cleanupExpired().catch(() => undefined);\n  }, TICKET_CLEANUP_MS);\n  cleanup.unref?.();\n  return Object.freeze({\n    application,\n    durableExports,\n    agent,\n    officeImports,\n    kernelVersion: runtime.buildIdentity,\n    close() {\n      clearInterval(cleanup);\n      invalidations.close();\n    },\n  });\n}\n\nexport class PostgresEditableArtifactAuthorization implements EditableArtifactAuthorizationPort {\n  constructor(private readonly db: Database) {}\n\n  async authorize(\n    request: EditableArtifactAuthorizationRequest,\n  ): Promise<EditableArtifactAuthorizationDecision> {\n    const actor = request.actor;\n    const rows = await withRlsContext(this.db, request.scope, async (tx) =>\n      rawRows<{ allowed: boolean; authorization_revision: number | string | bigint }>(\n        await tx.execute(dbSql`select *\n          from opengeni_private.authorize_editable_artifact_actor(\n            ${request.scope.accountId}::uuid,\n            ${request.scope.workspaceId}::uuid,\n            ${request.artifactId},\n            ${actor.kind},\n            ${actor.subjectId},\n            ${actor.kind === \"agent\" ? actor.sessionId : null},\n            ${actor.kind === \"agent\" ? actor.turnId : null},\n            ${actor.kind === \"agent\" ? actor.attemptId : null},\n            ${actor.kind === \"agent\" ? actor.generation : null},\n            ${actor.kind === \"service\" ? actor.service : null},\n            ${request.permission},\n            current_schema()\n          )`),\n      ),\n    );\n    if (rows.length !== 1) throw new Error(\"Editable artifact authorization returned no decision\");\n    const revision = Number(rows[0]!.authorization_revision);\n    if (!Number.isSafeInteger(revision) || revision < 1) {\n      throw new Error(\"Editable artifact authorization returned an invalid revision\");\n    }\n    return Object.freeze({ allowed: rows[0]!.allowed === true, revision });\n  }\n}\n\nclass PollingEditableArtifactAuthorizationInvalidations implements EditableArtifactLiveAuthorizationInvalidationPort {\n  private readonly stops = new Set<() => void>();\n\n  constructor(private readonly authorization: EditableArtifactAuthorizationPort) {}\n\n  async subscribe(\n    input: Parameters<EditableArtifactLiveAuthorizationInvalidationPort[\"subscribe\"]>[0],\n  ): Promise<() => void> {\n    let active = true;\n    let polling = false;\n    let baseline = await this.read(input);\n    const timer = setInterval(() => {\n      if (!active || polling) return;\n      polling = true;\n      void this.read(input)\n        .then((next) => {\n          if (!active) return;\n          if (next !== baseline) {\n            baseline = next;\n            input.onInvalidated();\n          }\n        })\n        .catch(() => {\n          if (active) input.onInvalidated();\n        })\n        .finally(() => {\n          polling = false;\n        });\n    }, INVALIDATION_POLL_MS);\n    timer.unref?.();\n    const stop = () => {\n      if (!active) return;\n      active = false;\n      clearInterval(timer);\n      this.stops.delete(stop);\n    };\n    this.stops.add(stop);\n    return stop;\n  }\n\n  close(): void {\n    for (const stop of [...this.stops]) stop();\n  }\n\n  private async read(\n    input: Parameters<EditableArtifactLiveAuthorizationInvalidationPort[\"subscribe\"]>[0],\n  ): Promise<string> {\n    const decision = await this.authorization.authorize({\n      scope: input.scope,\n      artifactId: input.artifactId,\n      actor: input.actor,\n      permission: \"read\",\n    });\n    return `${decision.allowed ? 1 : 0}:${decision.revision}`;\n  }\n}\n\nclass RandomEditableArtifactStableIds implements EditableArtifactStableIdFactoryPort {\n  next(_kind: EditableArtifactStableIdKind) {\n    return randomUUID().replaceAll(\"-\", \"\") as ReturnType<\n      EditableArtifactStableIdFactoryPort[\"next\"]\n    >;\n  }\n}\n\nclass RandomEditableArtifactDurableExportIds implements EditableArtifactDurableExportIdFactoryPort {\n  next(_kind: \"version\" | \"materialization_job\" | \"receipt\"): string {\n    return randomUUID().replaceAll(\"-\", \"\");\n  }\n}\n\nfunction materializationProfiles(\n  capabilities: EditableArtifactNativeMaterializerCapabilities,\n): EditableArtifactMaterializationProfilePort {\n  const spreadsheetCompatibility = currentEditableArtifactCompatibility(\"spreadsheet\");\n  if (\n    capabilities.protocol !== \"OGAMC001\" ||\n    capabilities.runtimeKind !== \"native\" ||\n    capabilities.maxOutputBytes !== EDITABLE_ARTIFACT_EXPORT_MAX_DOWNLOAD_BYTES ||\n    capabilities.codecVersions[\"opengeni.xlsx\"] === undefined ||\n    capabilities.supportedModelSchemaVersions[0] !== spreadsheetCompatibility.modelSchemaVersion ||\n    capabilities.supportedOperationProtocolVersions[0] !==\n      spreadsheetCompatibility.committedTransactionProtocolVersion ||\n    capabilities.supportedSnapshotProtocolVersions[0] !== spreadsheetCompatibility.snapshotVersion\n  ) {\n    throw new Error(\"Verified artifact materializer profile is incompatible\");\n  }\n  const codecVersion = capabilities.codecVersions[\"opengeni.xlsx\"];\n  return Object.freeze({\n    supportedFormats: EDITABLE_ARTIFACT_EXPORT_FORMATS,\n    async resolve(input: Parameters<EditableArtifactMaterializationProfilePort[\"resolve\"]>[0]) {\n      // EDITABLE_ARTIFACT_EXPORT_FORMATS is what agents are told exists.\n      if (\n        input.modality !== \"spreadsheet\" ||\n        input.format !== \"xlsx\" ||\n        !EDITABLE_ARTIFACT_EXPORT_FORMATS[input.modality].includes(input.format) ||\n        Object.keys(input.options).length !== 0\n      ) {\n        return null;\n      }\n      return Object.freeze({\n        modality: \"spreadsheet\" as const,\n        format: \"xlsx\" as const,\n        codecId: \"opengeni.xlsx\",\n        codecVersion,\n        kernelVersion: capabilities.kernelVersion,\n        fontRegistryHash: capabilities.fontRegistryHash,\n        policyHash: capabilities.policyHash,\n        normalizedOptions: \"{}\",\n      });\n    },\n  });\n}\n\nfunction snapshotBytesPort(\n  objects: BoundedObjectReadPort,\n): PersistedEditableArtifactSnapshotBytesPort {\n  return Object.freeze({\n    async readSnapshotBytes(snapshot: PersistedEditableArtifactSnapshotMetadata) {\n      const object = await objects.open({\n        opaqueReference: snapshot.blobReference,\n        maxBytes: MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,\n        expectedByteSize: snapshot.byteSize,\n      });\n      try {\n        if (object.contentType !== undefined && object.contentType !== snapshot.mimeType) {\n          throw new Error(\"Editable artifact snapshot content type mismatch\");\n        }\n        const bytes = new Uint8Array(snapshot.byteSize);\n        const digest = createHash(\"sha256\");\n        let offset = 0;\n        for await (const chunk of object.chunks({\n          chunkBytes: MAX_BOUNDED_OBJECT_CHUNK_BYTES,\n        })) {\n          if (offset + chunk.byteLength > bytes.byteLength) {\n            throw new Error(\"Editable artifact snapshot exceeds its declared size\");\n          }\n          bytes.set(chunk, offset);\n          digest.update(chunk);\n          offset += chunk.byteLength;\n        }\n        if (\n          offset !== bytes.byteLength ||\n          `sha256:${digest.digest(\"hex\")}` !== snapshot.contentHash\n        ) {\n          throw new Error(\"Editable artifact snapshot digest or size mismatch\");\n        }\n        await object.assertUnchanged();\n        return bytes;\n      } finally {\n        await object.close();\n      }\n    },\n  });\n}\n\nfunction rawRows<T extends Record<string, unknown>>(result: unknown): T[] {\n  if (Array.isArray(result)) return result as T[];\n  const rows = (result as { rows?: unknown } | null)?.rows;\n  if (Array.isArray(rows)) return rows as T[];\n  throw new Error(\"Unsupported database execute result shape\");\n}\n","import {\n  decodeEditableArtifactBrokerHint,\n  editableArtifactLiveHintSubject,\n  type EditableArtifactLiveHintPort,\n} from \"@opengeni/core\";\nimport type { EventBus, OpStreamConnection } from \"@opengeni/events\";\n\n/**\n * Uses the API's existing resilient NATS connection. Hints carry no operation\n * bytes; every callback causes a durable DB head read and contiguous gap-fill.\n */\nexport class EventBusEditableArtifactLiveHints implements EditableArtifactLiveHintPort {\n  constructor(private readonly bus: Pick<EventBus, \"getOpStreamConnection\">) {}\n\n  async subscribe(\n    input: Parameters<EditableArtifactLiveHintPort[\"subscribe\"]>[0],\n  ): Promise<() => void> {\n    const connection = this.bus.getOpStreamConnection?.();\n    if (!connection) throw new Error(\"Event bus has no artifact hint subscription transport\");\n    const subject = editableArtifactLiveHintSubject(input.scope, input.artifactId);\n    const subscription = connection.subscribe(subject);\n    let active = true;\n    try {\n      await requireFlushBarrier(connection);\n    } catch (error) {\n      subscription.unsubscribe();\n      throw error;\n    }\n    void (async () => {\n      try {\n        for await (const message of subscription) {\n          if (!active) return;\n          try {\n            const hint = decodeEditableArtifactBrokerHint(message.data, {\n              scope: input.scope,\n              artifactId: input.artifactId,\n            });\n            input.onHint({\n              artifactId: input.artifactId,\n              headSequence: hint.headSequence,\n            });\n          } catch {\n            // Broker input is advisory and untrusted. Drop poison; periodic\n            // durable reconciliation remains authoritative.\n          }\n        }\n      } catch {\n        if (active) input.onReconnect();\n      }\n    })();\n    return () => {\n      if (!active) return;\n      active = false;\n      subscription.unsubscribe();\n    };\n  }\n}\n\nasync function requireFlushBarrier(connection: OpStreamConnection): Promise<void> {\n  if (!connection.flush) {\n    throw new Error(\"Artifact hint subscription transport lacks a flush barrier\");\n  }\n  await connection.flush();\n}\n","import { createHash } from \"node:crypto\";\nimport { pathToFileURL } from \"node:url\";\nimport {\n  createNativeArtifactSession,\n  openNativeArtifactSession,\n  type NativeArtifactSession,\n  type NativeSpreadsheetSession,\n} from \"@opengeni/artifact-tool/native\";\nimport type { ArtifactKernelRuntime } from \"@opengeni/artifact-tool/runtime\";\nimport {\n  doctorConfiguredArtifactRuntime,\n  type ConfiguredArtifactRuntimeLocation,\n} from \"@opengeni/artifact-tool/runtime/development\";\nimport {\n  decodeEditableArtifactCausalFrontier,\n  encodeEditableArtifactCausalFrontier,\n} from \"@opengeni/contracts/editable-artifact-causal-frontier\";\nimport { decodeEditableArtifactSerializedCommit } from \"@opengeni/contracts/editable-artifact-serialized-commit\";\nimport { decodeEditableArtifactMutationIntent } from \"@opengeni/contracts/editable-artifacts\";\nimport {\n  COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n  DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION,\n  PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION,\n  SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n  SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n} from \"@opengeni/contracts/editable-artifact-versions\";\nimport {\n  MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,\n  causalFrontiersEqual,\n  editableArtifactCausalFrontier,\n  editableArtifactContentHash,\n  editableArtifactReplicaId,\n  editableArtifactStateHash,\n  type ApplyAuthoritativeEditableArtifactKernelRequest,\n  type ApplyAuthoritativeEditableArtifactKernelResult,\n  type AuthoritativeEditableArtifactCompactionKernelPort,\n  type AuthoritativeEditableArtifactCompactionKernelResult,\n  type AuthoritativeEditableArtifactGenesisKernelPort,\n  type AuthoritativeEditableArtifactGenesisKernelResult,\n  type AuthoritativeEditableArtifactKernelPort,\n  type EditableArtifactAgentInspectionKernelPort,\n  type EditableArtifactKernelState,\n  type EditableArtifactSnapshotReplayPlan,\n  type IsolatedEditableArtifactSnapshotKernelPort,\n  type IsolatedEditableArtifactSnapshotKernelResult,\n} from \"@opengeni/core\";\nimport type { BoundedObjectReadPort } from \"@opengeni/storage\";\n\nconst SNAPSHOT_CHUNK_BYTES = 1024 * 1024;\n\ntype RuntimeFacadeModule = Readonly<{\n  getConfiguredArtifactRuntime?: () => unknown;\n}> &\n  Readonly<Record<string, unknown>>;\n\nexport type VerifiedNativeArtifactRuntimeBinding = Readonly<{\n  runtime: ArtifactKernelRuntime;\n  location: ConfiguredArtifactRuntimeLocation;\n  facade: RuntimeFacadeModule;\n}>;\n\n/** Loads only the manifest-pinned, byte-verified native runtime. */\nexport async function loadVerifiedNativeArtifactRuntime(): Promise<ArtifactKernelRuntime> {\n  return (await loadVerifiedNativeArtifactRuntimeBinding()).runtime;\n}\n\n/** Same verified load plus the pinned package identity used by export profiles. */\nexport async function loadVerifiedNativeArtifactRuntimeBinding(): Promise<VerifiedNativeArtifactRuntimeBinding> {\n  const location = await doctorConfiguredArtifactRuntime();\n  const module = (await import(\n    /* @vite-ignore */ pathToFileURL(location.skillFacadeEntrypoint).href\n  )) as RuntimeFacadeModule;\n  const candidate = module.getConfiguredArtifactRuntime?.();\n  assertRuntime(candidate, location);\n  return Object.freeze({ runtime: candidate, location, facade: module });\n}\n\n/** Exact native authority shared by mutation, genesis, and snapshot verification. */\nexport class NativeEditableArtifactKernelAdapter\n  implements\n    AuthoritativeEditableArtifactKernelPort,\n    AuthoritativeEditableArtifactGenesisKernelPort,\n    AuthoritativeEditableArtifactCompactionKernelPort,\n    IsolatedEditableArtifactSnapshotKernelPort,\n    EditableArtifactAgentInspectionKernelPort\n{\n  constructor(\n    readonly runtime: ArtifactKernelRuntime,\n    private readonly objects: BoundedObjectReadPort,\n  ) {\n    if (runtime.kind !== \"native\" || runtime.target === \"wasm-web\") {\n      throw new Error(\"Editable artifact authority requires a native kernel\");\n    }\n  }\n\n  async applyTransaction(\n    request: ApplyAuthoritativeEditableArtifactKernelRequest,\n  ): Promise<ApplyAuthoritativeEditableArtifactKernelResult> {\n    const session = await this.openCurrentState(request.state);\n    try {\n      if (request.modality === \"spreadsheet\") {\n        if (session.modality !== \"spreadsheet\") throw new Error(\"Native modality mismatch\");\n        const committedTransactionBytes = session.authorTransaction(\n          request.intentBytes,\n          encodeEditableArtifactCausalFrontier(request.resolvedCausalBase),\n        );\n        return Object.freeze({\n          modality: \"spreadsheet\" as const,\n          committedTransactionBytes,\n          kernelVersion: this.runtime.buildIdentity,\n          modelSchemaVersion: SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n        });\n      }\n      if (session.modality !== request.modality) {\n        throw new Error(\"Native modality mismatch\");\n      }\n      const nativeReceiptBytes = session.applyCommands(request.intent.commandBytes);\n      return Object.freeze({\n        modality: request.modality,\n        nativeReceiptBytes,\n        resultingStateHash: editableArtifactStateHash(session.stateHash()),\n        kernelVersion: this.runtime.buildIdentity,\n        modelSchemaVersion: modelSchemaVersionFor(request.modality),\n      });\n    } finally {\n      session.dispose();\n    }\n  }\n\n  async query(\n    input: Parameters<EditableArtifactAgentInspectionKernelPort[\"query\"]>[0],\n  ): ReturnType<EditableArtifactAgentInspectionKernelPort[\"query\"]> {\n    const session = await this.openCurrentState(input.state);\n    try {\n      return Uint8Array.from(session.query(input.queryBytes));\n    } finally {\n      session.dispose();\n    }\n  }\n\n  private async openCurrentState(\n    state: EditableArtifactKernelState,\n  ): Promise<NativeArtifactSession> {\n    const snapshot = state.snapshot;\n    if (!snapshot) throw new Error(\"Editable artifact has no verified replay snapshot\");\n    const snapshotBytes = await readVerifiedSnapshot(this.objects, snapshot);\n    const session = openNativeArtifactSession(this.runtime, {\n      modality: state.modality,\n      snapshot: snapshotBytes,\n    });\n    try {\n      verifySnapshotBoundary(session, state);\n      replayKernelTail(session, state);\n      verifyDurableHead(session, state);\n      return session;\n    } catch (error) {\n      session.dispose();\n      throw error;\n    }\n  }\n\n  async createCanonicalEmptySnapshot(input: {\n    scope: Parameters<\n      AuthoritativeEditableArtifactGenesisKernelPort[\"createCanonicalEmptySnapshot\"]\n    >[0][\"scope\"];\n    artifactId: Parameters<\n      AuthoritativeEditableArtifactGenesisKernelPort[\"createCanonicalEmptySnapshot\"]\n    >[0][\"artifactId\"];\n    modality: Parameters<\n      AuthoritativeEditableArtifactGenesisKernelPort[\"createCanonicalEmptySnapshot\"]\n    >[0][\"modality\"];\n    signal?: AbortSignal;\n  }): Promise<AuthoritativeEditableArtifactGenesisKernelResult> {\n    throwIfAborted(input.signal);\n    const session = createNativeArtifactSession(this.runtime, {\n      modality: input.modality,\n      replicaNamespace: namespaceForArtifact(input.artifactId),\n    });\n    try {\n      const snapshot = session.snapshot();\n      throwIfAborted(input.signal);\n      const revision = safeRevision(session.revision());\n      if (revision !== 0) throw new Error(\"Native genesis revision is not zero\");\n      const common = {\n        scope: input.scope,\n        artifactId: input.artifactId,\n        modality: input.modality,\n        canonicalChunks: fixedChunks(snapshot, input.signal),\n        canonicalByteSize: snapshot.byteLength,\n        canonicalContentHash: editableArtifactContentHash(\n          `sha256:${createHash(\"sha256\").update(snapshot).digest(\"hex\")}`,\n        ),\n        stateHash: editableArtifactStateHash(session.stateHash()),\n        coveredHeadSequence: 0 as const,\n        modelSchemaVersion: modelSchemaVersionFor(input.modality),\n        kernelVersion: this.runtime.buildIdentity,\n      };\n      if (session.modality === \"spreadsheet\") {\n        return Object.freeze({\n          ...common,\n          modality: \"spreadsheet\" as const,\n          coveredCausalFrontier: domainFrontier(session.frontier()),\n          operationProtocolVersion: COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n          crdtStateVersion: SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n        });\n      }\n      return Object.freeze({\n        ...common,\n        modality: session.modality,\n        nativeRevision: 0 as const,\n      });\n    } finally {\n      session.dispose();\n    }\n  }\n\n  async createCanonicalSnapshot(input: {\n    state: EditableArtifactKernelState;\n    signal?: AbortSignal;\n  }): Promise<AuthoritativeEditableArtifactCompactionKernelResult> {\n    throwIfAborted(input.signal);\n    const snapshot = input.state.snapshot;\n    if (!snapshot) throw new Error(\"Editable artifact has no verified replay snapshot\");\n    const snapshotBytes = await readVerifiedSnapshot(this.objects, snapshot, input.signal);\n    const session = openNativeArtifactSession(this.runtime, {\n      modality: input.state.modality,\n      snapshot: snapshotBytes,\n    });\n    try {\n      verifySnapshotBoundary(session, input.state);\n      replayKernelTail(session, input.state);\n      verifyDurableHead(session, input.state);\n      throwIfAborted(input.signal);\n      const canonical = session.snapshot();\n      const common = {\n        scope: input.state.artifact.scope,\n        artifactId: input.state.artifact.id,\n        modality: input.state.modality,\n        canonicalChunks: fixedChunks(canonical, input.signal),\n        canonicalByteSize: canonical.byteLength,\n        canonicalContentHash: editableArtifactContentHash(\n          `sha256:${createHash(\"sha256\").update(canonical).digest(\"hex\")}`,\n        ),\n        stateHash: editableArtifactStateHash(session.stateHash()),\n        coveredHeadSequence: input.state.artifact.headSequence,\n        modelSchemaVersion: modelSchemaVersionFor(input.state.modality),\n        kernelVersion: this.runtime.buildIdentity,\n      } as const;\n      if (session.modality === \"spreadsheet\") {\n        if (input.state.modality !== \"spreadsheet\") throw new Error(\"Native modality mismatch\");\n        return Object.freeze({\n          ...common,\n          modality: session.modality,\n          coveredCausalFrontier: domainFrontier(session.frontier()),\n          operationProtocolVersion: COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n          crdtStateVersion: SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n        });\n      }\n      if (session.modality !== input.state.modality) throw new Error(\"Native modality mismatch\");\n      return Object.freeze({\n        ...common,\n        modality: session.modality,\n        nativeRevision: safeRevision(session.revision()),\n      });\n    } finally {\n      session.dispose();\n    }\n  }\n\n  async verifyAndReconstruct(\n    input: Parameters<IsolatedEditableArtifactSnapshotKernelPort[\"verifyAndReconstruct\"]>[0],\n  ): Promise<IsolatedEditableArtifactSnapshotKernelResult> {\n    throwIfAborted(input.signal);\n    const bytes = await collectExact(\n      input.snapshotChunks,\n      input.expectedSnapshotByteSize,\n      input.signal,\n    );\n    const session = openNativeArtifactSession(this.runtime, {\n      modality: input.modality,\n      snapshot: bytes,\n    });\n    try {\n      const canonical = session.snapshot();\n      if (!equalBytes(canonical, bytes)) throw new Error(\"Native snapshot is not canonical\");\n      const expected = input.expectedSnapshot;\n      if (expected.modality !== session.modality) throw new Error(\"Snapshot modality mismatch\");\n      const coveredHeadSequence = expected.coveredHeadSequence;\n      const stateHash = editableArtifactStateHash(session.stateHash());\n      if (stateHash !== expected.stateHash) throw new Error(\"Snapshot state hash mismatch\");\n      const canonicalContentHash = editableArtifactContentHash(\n        `sha256:${createHash(\"sha256\").update(canonical).digest(\"hex\")}`,\n      );\n      if (session.modality === \"spreadsheet\") {\n        const coveredCausalFrontier = domainFrontier(session.frontier());\n        if (\n          expected.modality !== \"spreadsheet\" ||\n          !causalFrontiersEqual(coveredCausalFrontier, expected.coveredCausalFrontier)\n        ) {\n          throw new Error(\"Snapshot causal coverage mismatch\");\n        }\n        if (input.replayPlan && input.replayPlan.modality !== \"spreadsheet\") {\n          throw new Error(\"Replay modality mismatch\");\n        }\n        const replayedTarget = input.replayPlan\n          ? await replaySpreadsheetPlan(session, input.replayPlan, input.signal)\n          : undefined;\n        return Object.freeze({\n          modality: \"spreadsheet\" as const,\n          canonicalReencodeVerified: true as const,\n          scope: input.scope,\n          artifactId: input.artifactId,\n          canonicalByteSize: canonical.byteLength,\n          canonicalContentHash,\n          coveredHeadSequence,\n          stateHash,\n          modelSchemaVersion: SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n          kernelVersion: this.runtime.buildIdentity,\n          fullCrdtStateVerified: true as const,\n          coveredCausalFrontier,\n          operationProtocolVersion: COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n          crdtStateVersion: SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n          ...(replayedTarget ? { replayedTarget } : {}),\n        });\n      }\n      if (expected.modality === \"spreadsheet\") throw new Error(\"Snapshot modality mismatch\");\n      const nativeRevision = safeRevision(session.revision());\n      if (nativeRevision !== expected.nativeRevision) {\n        throw new Error(\"Snapshot native revision mismatch\");\n      }\n      if (input.replayPlan && input.replayPlan.modality === \"spreadsheet\") {\n        throw new Error(\"Replay modality mismatch\");\n      }\n      const replayedTarget = input.replayPlan\n        ? await replaySerializedPlan(session, input.replayPlan, input.signal)\n        : undefined;\n      return Object.freeze({\n        modality: session.modality,\n        canonicalReencodeVerified: true as const,\n        scope: input.scope,\n        artifactId: input.artifactId,\n        canonicalByteSize: canonical.byteLength,\n        canonicalContentHash,\n        coveredHeadSequence,\n        stateHash,\n        modelSchemaVersion: modelSchemaVersionFor(session.modality),\n        kernelVersion: this.runtime.buildIdentity,\n        nativeRevision,\n        ...(replayedTarget ? { replayedTarget } : {}),\n      });\n    } finally {\n      session.dispose();\n    }\n  }\n}\n\nfunction modelSchemaVersionFor(modality: \"spreadsheet\" | \"document\" | \"presentation\"): 1 | 2 {\n  if (modality === \"spreadsheet\") return SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION;\n  return modality === \"document\"\n    ? DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION\n    : PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION;\n}\n\nfunction assertRuntime(\n  candidate: unknown,\n  location: ConfiguredArtifactRuntimeLocation,\n): asserts candidate is ArtifactKernelRuntime {\n  if (typeof candidate !== \"object\" || candidate === null) {\n    throw new Error(\"Verified artifact facade returned no runtime\");\n  }\n  const runtime = candidate as Partial<ArtifactKernelRuntime>;\n  if (\n    runtime.kind !== \"native\" ||\n    runtime.target === \"wasm-web\" ||\n    runtime.target !== location.target ||\n    runtime.buildIdentity !== location.kernel.buildIdentity ||\n    typeof runtime.createCollaborationSession !== \"function\" ||\n    typeof runtime.openCollaborationSession !== \"function\" ||\n    typeof runtime.createDocumentSession !== \"function\" ||\n    typeof runtime.openDocumentSession !== \"function\" ||\n    typeof runtime.createPresentationSession !== \"function\" ||\n    typeof runtime.openPresentationSession !== \"function\"\n  ) {\n    throw new Error(\"Verified artifact facade returned an incompatible runtime\");\n  }\n}\n\nfunction verifySnapshotBoundary(\n  session: NativeArtifactSession,\n  state: EditableArtifactKernelState,\n): void {\n  const snapshot = state.snapshot;\n  if (!snapshot || session.modality !== state.modality)\n    throw new Error(\"Snapshot modality mismatch\");\n  if (session.stateHash() !== snapshot.stateHash) {\n    throw new Error(\"Native snapshot boundary does not match durable metadata\");\n  }\n  if (state.modality === \"spreadsheet\") {\n    if (\n      session.modality !== \"spreadsheet\" ||\n      snapshot.modality !== \"spreadsheet\" ||\n      !causalFrontiersEqual(domainFrontier(session.frontier()), snapshot.coveredCausalFrontier)\n    ) {\n      throw new Error(\"Native snapshot frontier does not match durable metadata\");\n    }\n  } else if (\n    session.modality === \"spreadsheet\" ||\n    snapshot.modality === \"spreadsheet\" ||\n    safeRevision(session.revision()) !== snapshot.nativeRevision ||\n    state.baseNativeRevision !== snapshot.nativeRevision\n  ) {\n    throw new Error(\"Native snapshot revision does not match durable metadata\");\n  }\n}\n\nfunction replayKernelTail(\n  session: NativeArtifactSession,\n  state: EditableArtifactKernelState,\n): void {\n  if (state.modality === \"spreadsheet\") {\n    if (session.modality !== \"spreadsheet\") throw new Error(\"Native modality mismatch\");\n    for (const transaction of state.committedTransactionTail) {\n      const priorNativeRevision = safeRevision(session.revision());\n      if (session.stateHash() !== transaction.priorStateHash) {\n        throw new Error(\"Spreadsheet replay prior state mismatch\");\n      }\n      session.applyCommitted(transaction.committedTransactionBytes);\n      if (\n        safeRevision(session.revision()) !== priorNativeRevision + 1 ||\n        session.stateHash() !== transaction.stateHash ||\n        !causalFrontiersEqual(\n          domainFrontier(session.frontier()),\n          transaction.resultingCausalFrontier,\n        )\n      ) {\n        throw new Error(\"Spreadsheet replay result mismatch\");\n      }\n    }\n    return;\n  }\n  if (session.modality !== state.modality) {\n    throw new Error(\"Native modality mismatch\");\n  }\n  for (const transaction of state.committedTransactionTail) {\n    if (\n      session.stateHash() !== transaction.priorStateHash ||\n      safeRevision(session.revision()) !== transaction.priorNativeRevision\n    ) {\n      throw new Error(\"Serialized replay prior state mismatch\");\n    }\n    const commit = decodeEditableArtifactSerializedCommit(\n      transaction.committedTransactionBytes,\n      state.modality,\n    );\n    const intent = decodeEditableArtifactMutationIntent(commit.intentBytes);\n    const receipt = session.applyCommands(intent.commandBytes);\n    if (\n      !equalBytes(receipt, commit.nativeReceiptBytes) ||\n      !equalBytes(receipt, transaction.nativeReceiptBytes) ||\n      safeRevision(session.revision()) !== transaction.nativeRevision ||\n      session.stateHash() !== transaction.stateHash\n    ) {\n      throw new Error(\"Serialized replay result mismatch\");\n    }\n  }\n}\n\nfunction verifyDurableHead(\n  session: NativeArtifactSession,\n  state: EditableArtifactKernelState,\n): void {\n  const snapshot = state.snapshot;\n  if (!snapshot) throw new Error(\"Editable artifact has no replay snapshot\");\n  let durableSequence = snapshot.coveredHeadSequence;\n  for (const transaction of state.committedTransactionTail) {\n    if (transaction.sequenceStart !== durableSequence + 1) {\n      throw new Error(\"Durable transaction tail contains a sequence gap\");\n    }\n    durableSequence = transaction.sequenceEnd;\n  }\n  if (\n    session.modality !== state.modality ||\n    durableSequence !== state.artifact.headSequence ||\n    session.stateHash() !== state.artifact.stateHash\n  ) {\n    throw new Error(\"Reconstructed native state does not match the durable head\");\n  }\n  if (\n    state.modality === \"spreadsheet\" &&\n    (session.modality !== \"spreadsheet\" ||\n      !causalFrontiersEqual(domainFrontier(session.frontier()), state.artifact.causalFrontier))\n  ) {\n    throw new Error(\"Reconstructed native frontier does not match the durable head\");\n  }\n  if (state.modality !== \"spreadsheet\") {\n    const expectedNativeRevision =\n      state.committedTransactionTail.at(-1)?.nativeRevision ?? state.baseNativeRevision;\n    if (safeRevision(session.revision()) !== expectedNativeRevision) {\n      throw new Error(\"Reconstructed native revision does not match the serialized tail\");\n    }\n  }\n}\n\nasync function replaySpreadsheetPlan(\n  session: NativeSpreadsheetSession,\n  plan: Extract<EditableArtifactSnapshotReplayPlan, { modality: \"spreadsheet\" }>,\n  signal: AbortSignal | undefined,\n): Promise<\n  Readonly<{\n    headSequence: number;\n    causalFrontier: ReturnType<typeof editableArtifactCausalFrontier>;\n    stateHash: ReturnType<typeof editableArtifactStateHash>;\n  }>\n> {\n  let sequence = plan.baseHeadSequence;\n  for await (const segment of plan.segments) {\n    throwIfAborted(signal);\n    if (segment.sequenceStart !== sequence + 1) throw new Error(\"Replay sequence gap\");\n    if (segment.modality !== \"spreadsheet\") throw new Error(\"Replay segment modality mismatch\");\n    session.applyCommitted(segment.bytes);\n    sequence = segment.sequenceEnd;\n  }\n  if (sequence !== plan.targetHeadSequence || session.stateHash() !== plan.targetStateHash) {\n    throw new Error(\"Replay target mismatch\");\n  }\n  const causalFrontier = domainFrontier(session.frontier());\n  if (!causalFrontiersEqual(causalFrontier, plan.targetCausalFrontier)) {\n    throw new Error(\"Replay frontier mismatch\");\n  }\n  return Object.freeze({\n    headSequence: sequence,\n    causalFrontier,\n    stateHash: editableArtifactStateHash(session.stateHash()),\n  });\n}\n\nasync function replaySerializedPlan(\n  session: Exclude<NativeArtifactSession, NativeSpreadsheetSession>,\n  plan: Exclude<EditableArtifactSnapshotReplayPlan, { modality: \"spreadsheet\" }>,\n  signal: AbortSignal | undefined,\n): Promise<\n  Readonly<{\n    headSequence: number;\n    nativeRevision: number;\n    stateHash: ReturnType<typeof editableArtifactStateHash>;\n  }>\n> {\n  if (session.modality !== plan.modality) throw new Error(\"Replay modality mismatch\");\n  let sequence = plan.baseHeadSequence;\n  for await (const segment of plan.segments) {\n    throwIfAborted(signal);\n    if (segment.sequenceStart !== sequence + 1 || segment.modality !== session.modality) {\n      throw new Error(\"Replay sequence or modality mismatch\");\n    }\n    const commit = decodeEditableArtifactSerializedCommit(segment.bytes, session.modality);\n    const intent = decodeEditableArtifactMutationIntent(commit.intentBytes);\n    const receipt = session.applyCommands(intent.commandBytes);\n    if (!equalBytes(receipt, commit.nativeReceiptBytes)) throw new Error(\"Replay receipt mismatch\");\n    sequence = segment.sequenceEnd;\n  }\n  if (sequence !== plan.targetHeadSequence || session.stateHash() !== plan.targetStateHash) {\n    throw new Error(\"Replay target mismatch\");\n  }\n  if (safeRevision(session.revision()) !== plan.targetNativeRevision) {\n    throw new Error(\"Replay native revision mismatch\");\n  }\n  return Object.freeze({\n    headSequence: sequence,\n    nativeRevision: plan.targetNativeRevision,\n    stateHash: editableArtifactStateHash(session.stateHash()),\n  });\n}\n\nfunction domainFrontier(bytes: Uint8Array): ReturnType<typeof editableArtifactCausalFrontier> {\n  return editableArtifactCausalFrontier(\n    decodeEditableArtifactCausalFrontier(bytes).map((entry) => ({\n      replicaId: editableArtifactReplicaId(entry.replicaId),\n      counter: entry.counter,\n    })),\n  );\n}\n\nasync function readVerifiedSnapshot(\n  objects: BoundedObjectReadPort,\n  snapshot: NonNullable<EditableArtifactKernelState[\"snapshot\"]>,\n  signal?: AbortSignal,\n): Promise<Uint8Array> {\n  const object = await objects.open({\n    opaqueReference: snapshot.blobReference,\n    maxBytes: MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,\n    expectedByteSize: snapshot.byteSize,\n    ...(signal ? { signal } : {}),\n  });\n  try {\n    if (object.contentType !== undefined && object.contentType !== snapshot.mimeType) {\n      throw new Error(\"Snapshot content type mismatch\");\n    }\n    const bytes = await collectExact(\n      object.chunks(signal ? { signal } : {}),\n      snapshot.byteSize,\n      signal,\n    );\n    const contentHash = `sha256:${createHash(\"sha256\").update(bytes).digest(\"hex\")}`;\n    if (contentHash !== snapshot.contentHash) throw new Error(\"Snapshot content hash mismatch\");\n    await object.assertUnchanged(signal);\n    return bytes;\n  } finally {\n    await object.close();\n  }\n}\n\nasync function collectExact(\n  chunks: AsyncIterable<Uint8Array>,\n  expectedBytes: number,\n  signal?: AbortSignal,\n): Promise<Uint8Array> {\n  if (!Number.isSafeInteger(expectedBytes) || expectedBytes <= 0) {\n    throw new Error(\"Snapshot byte size is invalid\");\n  }\n  const result = new Uint8Array(expectedBytes);\n  let offset = 0;\n  for await (const chunk of chunks) {\n    throwIfAborted(signal);\n    if (!(chunk instanceof Uint8Array) || chunk.byteLength === 0) {\n      throw new Error(\"Snapshot stream is truncated\");\n    }\n    if (offset + chunk.byteLength > result.byteLength) {\n      throw new Error(\"Snapshot stream exceeds its declared size\");\n    }\n    result.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  throwIfAborted(signal);\n  if (offset !== result.byteLength) throw new Error(\"Snapshot stream is truncated\");\n  return result;\n}\n\nasync function* fixedChunks(bytes: Uint8Array, signal?: AbortSignal): AsyncIterable<Uint8Array> {\n  for (let offset = 0; offset < bytes.byteLength; offset += SNAPSHOT_CHUNK_BYTES) {\n    throwIfAborted(signal);\n    yield bytes.subarray(offset, Math.min(bytes.byteLength, offset + SNAPSHOT_CHUNK_BYTES));\n  }\n}\n\nfunction namespaceForArtifact(artifactId: string): bigint {\n  const digest = createHash(\"sha256\").update(artifactId).digest();\n  let value = 0n;\n  for (let index = 0; index < 8; index += 1) value = (value << 8n) | BigInt(digest[index]!);\n  return value === 0n ? 1n : value;\n}\n\nfunction safeRevision(value: bigint): number {\n  if (value < 0n || value > BigInt(Number.MAX_SAFE_INTEGER)) {\n    throw new Error(\"Native revision exceeds the safe integer range\");\n  }\n  return Number(value);\n}\n\nfunction equalBytes(left: Uint8Array, right: Uint8Array): boolean {\n  if (left.byteLength !== right.byteLength) return false;\n  let difference = 0;\n  for (let index = 0; index < left.byteLength; index += 1) {\n    difference |= left[index]! ^ right[index]!;\n  }\n  return difference === 0;\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted) throw new Error(\"Editable artifact native operation was cancelled\");\n}\n","import { createHash } from \"node:crypto\";\nimport {\n  ArtifactOfficeSourceUnsupportedError,\n  prepareArtifactOfficeImport,\n  type ArtifactOfficeMimeType,\n} from \"@opengeni/artifact-tool/office-import\";\nimport {\n  MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,\n  EDITABLE_ARTIFACT_ORIGINAL_IMPORT_MAX_BYTES,\n  editableArtifactCausalFrontier,\n  editableArtifactContentHash,\n  editableArtifactReplicaId,\n  editableArtifactStateHash,\n  EditableArtifactOfficeImportError,\n  type EditableArtifactActor,\n  type EditableArtifactOfficeImportPort,\n  type EditableArtifactModality,\n  type EditableArtifactScope,\n} from \"@opengeni/core/editable-artifacts\";\nimport { requireLiveAgentAttemptAuthorization } from \"@opengeni/core\";\nimport { getFilesForSubject } from \"@opengeni/db\";\nimport {\n  MAX_BOUNDED_OBJECT_CHUNK_BYTES,\n  type BoundedImmutableObjectWritePort,\n  retryWhileMissing,\n  type ObjectStorage,\n} from \"@opengeni/storage\";\nimport type { Database } from \"@opengeni/db\";\nimport type { VerifiedNativeArtifactRuntimeBinding } from \"./editable-artifact-native-kernel\";\n\nconst SNAPSHOT_MIME = \"application/vnd.opengeni.editable-artifact-snapshot\" as const;\n\nexport type EditableArtifactOfficeImportAdapterDependencies = Readonly<{\n  db: Database;\n  objectStorage: ObjectStorage;\n  runtime: VerifiedNativeArtifactRuntimeBinding;\n  sourceObjects: BoundedImmutableObjectWritePort;\n  snapshotObjects: BoundedImmutableObjectWritePort;\n  readFiles?: typeof getFilesForSubject;\n  resolveFileAuthoritySubjectId?: typeof editableArtifactFileAuthoritySubjectId;\n  prepareOffice?: typeof prepareArtifactOfficeImport;\n}>;\n\n/** Trusted import boundary from one ready workspace file into native sequence-zero state. */\nexport class EditableArtifactOfficeImportAdapter implements EditableArtifactOfficeImportPort {\n  private readonly readFiles: typeof getFilesForSubject;\n  private readonly resolveFileAuthoritySubjectId: typeof editableArtifactFileAuthoritySubjectId;\n\n  constructor(private readonly dependencies: EditableArtifactOfficeImportAdapterDependencies) {\n    this.readFiles = dependencies.readFiles ?? getFilesForSubject;\n    this.resolveFileAuthoritySubjectId =\n      dependencies.resolveFileAuthoritySubjectId ?? editableArtifactFileAuthoritySubjectId;\n  }\n\n  async prepare(\n    input: Parameters<EditableArtifactOfficeImportPort[\"prepare\"]>[0],\n  ): ReturnType<EditableArtifactOfficeImportPort[\"prepare\"]> {\n    throwIfAborted(input.signal);\n    const subjectId = await this.resolveFileAuthoritySubjectId(\n      this.dependencies.db,\n      input.scope,\n      input.actor,\n    );\n    const [file] = await this.readFiles(this.dependencies.db, {\n      accountId: input.scope.accountId,\n      workspaceId: input.scope.workspaceId,\n      subjectId,\n      fileIds: [input.fileId],\n    });\n    if (!file || file.status !== \"ready\") {\n      throw new EditableArtifactOfficeImportError(\"invalid_source\");\n    }\n    const expectedMimeType = officeMimeType(input.modality);\n    if (\n      file.contentType !== expectedMimeType ||\n      !officeFilenameMatches(file.filename, input.modality) ||\n      !Number.isSafeInteger(file.sizeBytes) ||\n      file.sizeBytes < 1 ||\n      file.sizeBytes > EDITABLE_ARTIFACT_ORIGINAL_IMPORT_MAX_BYTES ||\n      typeof file.sha256 !== \"string\" ||\n      !/^[0-9a-f]{64}$/u.test(file.sha256)\n    ) {\n      throw new EditableArtifactOfficeImportError(\"invalid_source\");\n    }\n    const sourceBytes = await readVerifiedWorkspaceFile(\n      this.dependencies.objectStorage,\n      file,\n      input.signal,\n    );\n    const prepared = await prepareOfficeImport({\n      runtime: this.dependencies.runtime,\n      modality: input.modality,\n      filename: file.filename,\n      mimeType: expectedMimeType,\n      bytes: sourceBytes,\n      prepare: this.dependencies.prepareOffice ?? prepareArtifactOfficeImport,\n    });\n    const retainedSource = await this.dependencies.sourceObjects.write({\n      chunks: byteChunks(sourceBytes),\n      contentType: expectedMimeType,\n      maxBytes: EDITABLE_ARTIFACT_ORIGINAL_IMPORT_MAX_BYTES,\n      expectedByteSize: prepared.source.byteSize,\n      expectedContentHash: prepared.source.contentHash,\n      ...(input.signal ? { signal: input.signal } : {}),\n    });\n    const retainedSnapshot = await this.dependencies.snapshotObjects.write({\n      chunks: byteChunks(prepared.snapshot.bytes),\n      contentType: SNAPSHOT_MIME,\n      maxBytes: MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,\n      expectedByteSize: prepared.snapshot.byteSize,\n      expectedContentHash: prepared.snapshot.contentHash,\n      ...(input.signal ? { signal: input.signal } : {}),\n    });\n    const common = {\n      modality: prepared.snapshot.modality,\n      blobReference: retainedSnapshot.opaqueReference,\n      byteSize: prepared.snapshot.byteSize,\n      contentHash: editableArtifactContentHash(prepared.snapshot.contentHash),\n      mimeType: SNAPSHOT_MIME,\n      coveredHeadSequence: 0 as const,\n      stateHash: editableArtifactStateHash(prepared.snapshot.stateHash),\n      modelSchemaVersion: prepared.snapshot.modelSchemaVersion,\n      kernelVersion: prepared.snapshot.kernelVersion,\n    };\n    return Object.freeze({\n      originalImport: Object.freeze({\n        fileId: file.id,\n        blobReference: retainedSource.opaqueReference,\n        byteSize: prepared.source.byteSize,\n        contentHash: editableArtifactContentHash(prepared.source.contentHash),\n        mimeType: expectedMimeType,\n      }),\n      snapshot:\n        prepared.snapshot.modality === \"spreadsheet\"\n          ? Object.freeze({\n              ...common,\n              modality: \"spreadsheet\" as const,\n              coveredCausalFrontier: editableArtifactCausalFrontier(\n                prepared.snapshot.coveredCausalFrontier.map((entry) => ({\n                  replicaId: editableArtifactReplicaId(entry.replicaId),\n                  counter: entry.counter,\n                })),\n              ),\n              operationProtocolVersion: prepared.snapshot.operationProtocolVersion,\n              crdtStateVersion: prepared.snapshot.crdtStateVersion,\n            })\n          : Object.freeze({\n              ...common,\n              modality: prepared.snapshot.modality,\n              nativeRevision: prepared.snapshot.nativeRevision,\n            }),\n    });\n  }\n}\n\nasync function prepareOfficeImport(input: {\n  runtime: VerifiedNativeArtifactRuntimeBinding;\n  modality: EditableArtifactModality;\n  filename: string;\n  mimeType: ArtifactOfficeMimeType;\n  bytes: Uint8Array;\n  prepare: typeof prepareArtifactOfficeImport;\n}) {\n  try {\n    return await input.prepare({\n      facade: input.runtime.facade,\n      modality: input.modality,\n      filename: input.filename,\n      mimeType: input.mimeType,\n      bytes: input.bytes,\n      expectedRuntimeTarget: input.runtime.location.target,\n      expectedKernelVersion: input.runtime.runtime.buildIdentity,\n    });\n  } catch (error) {\n    if (error instanceof ArtifactOfficeSourceUnsupportedError) {\n      throw new EditableArtifactOfficeImportError(\"unsupported_content\");\n    }\n    throw error;\n  }\n}\n\nfunction officeMimeType(modality: EditableArtifactModality): ArtifactOfficeMimeType {\n  if (modality === \"spreadsheet\") {\n    return \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\";\n  }\n  if (modality === \"document\") {\n    return \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\";\n  }\n  return \"application/vnd.openxmlformats-officedocument.presentationml.presentation\";\n}\n\nfunction officeFilenameMatches(filename: string, modality: EditableArtifactModality): boolean {\n  const extension =\n    modality === \"spreadsheet\" ? \".xlsx\" : modality === \"document\" ? \".docx\" : \".pptx\";\n  return filename.toLowerCase().endsWith(extension);\n}\n\nasync function readVerifiedWorkspaceFile(\n  storage: ObjectStorage,\n  file: NonNullable<Awaited<ReturnType<typeof getFilesForSubject>>>[number],\n  signal?: AbortSignal,\n): Promise<Uint8Array> {\n  throwIfAborted(signal);\n  const before = await retryWhileMissing(async () => {\n    try {\n      return await storage.headFile(file);\n    } catch (error) {\n      if (typeof storage.fileExists === \"function\" && !(await storage.fileExists(file))) {\n        return null;\n      }\n      throw error;\n    }\n  });\n  if (!before) {\n    throw new EditableArtifactOfficeImportError(\"source_changed\");\n  }\n  if (\n    before.ContentLength !== file.sizeBytes ||\n    before.ContentType !== file.contentType ||\n    before.Metadata?.sha256 !== file.sha256 ||\n    typeof before.VersionToken !== \"string\" ||\n    before.VersionToken.length < 1\n  ) {\n    throw new EditableArtifactOfficeImportError(\"source_changed\");\n  }\n  const bytes = new Uint8Array(file.sizeBytes);\n  const digest = createHash(\"sha256\");\n  for (let start = 0; start < file.sizeBytes; start += MAX_BOUNDED_OBJECT_CHUNK_BYTES) {\n    throwIfAborted(signal);\n    const end = Math.min(file.sizeBytes, start + MAX_BOUNDED_OBJECT_CHUNK_BYTES) - 1;\n    const chunk = await retryWhileMissing(async () => storage.getFileRange(file, { start, end }));\n    if (!chunk || chunk.byteLength !== end - start + 1) {\n      throw new EditableArtifactOfficeImportError(\"source_changed\");\n    }\n    bytes.set(chunk, start);\n    digest.update(chunk);\n  }\n  const after = await retryWhileMissing(async () => {\n    try {\n      return await storage.headFile(file);\n    } catch (error) {\n      if (typeof storage.fileExists === \"function\" && !(await storage.fileExists(file))) {\n        return null;\n      }\n      throw error;\n    }\n  });\n  if (!after) {\n    throw new EditableArtifactOfficeImportError(\"source_changed\");\n  }\n  const sha256 = digest.digest(\"hex\");\n  if (\n    after.ContentLength !== before.ContentLength ||\n    after.ContentType !== before.ContentType ||\n    after.Metadata?.sha256 !== before.Metadata?.sha256 ||\n    after.VersionToken !== before.VersionToken ||\n    sha256 !== file.sha256\n  ) {\n    throw new EditableArtifactOfficeImportError(\"source_changed\");\n  }\n  return bytes;\n}\n\nexport async function editableArtifactFileAuthoritySubjectId(\n  db: Database,\n  scope: EditableArtifactScope,\n  actor: EditableArtifactActor,\n): Promise<string | null> {\n  if (actor.kind !== \"agent\") return actor.subjectId;\n  const authorization = await requireLiveAgentAttemptAuthorization(\n    db,\n    {\n      accountId: scope.accountId,\n      workspaceId: scope.workspaceId,\n      subjectId: actor.subjectId,\n      permissions: [],\n      principalKind: \"agent_attempt\",\n      metadata: {\n        sessionId: actor.sessionId,\n        turnId: actor.turnId,\n        attemptId: actor.attemptId,\n        executionGeneration: actor.generation,\n      },\n    },\n    actor.sessionId,\n  );\n  return authorization.initiatingHumanSubjectId;\n}\n\nasync function* byteChunks(bytes: Uint8Array): AsyncIterable<Uint8Array> {\n  for (let offset = 0; offset < bytes.byteLength; offset += MAX_BOUNDED_OBJECT_CHUNK_BYTES) {\n    yield bytes.subarray(offset, offset + MAX_BOUNDED_OBJECT_CHUNK_BYTES);\n  }\n}\n\nfunction throwIfAborted(signal?: AbortSignal): void {\n  if (signal?.aborted) throw signal.reason ?? new Error(\"Artifact import aborted\");\n}\n","import { createHash } from \"node:crypto\";\n\nimport {\n  type EditableArtifactAgentWorkspaceFilePort,\n  type EditableArtifactDurableExportService,\n} from \"@opengeni/core/editable-artifacts\";\nimport { completeFileUpload, prepareGeneratedWorkspaceFile, type Database } from \"@opengeni/db\";\nimport { retryWhileMissing, type ObjectHead, type ObjectStorage } from \"@opengeni/storage\";\n\nconst UPLOAD_INTENT_TTL_MS = 60 * 60_000;\nconst UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;\n\nexport type EditableArtifactWorkspaceFileAdapterDependencies = Readonly<{\n  db: Database;\n  objectStorage: ObjectStorage;\n  durableExports: EditableArtifactDurableExportService;\n  now?: () => Date;\n  prepareFile?: typeof prepareGeneratedWorkspaceFile;\n  completeFile?: typeof completeFileUpload;\n}>;\n\n/**\n * Promotes one immutable materialization into the normal workspace-file domain.\n * The returned file ID is the only artifact export handle exposed to agents.\n */\nexport class EditableArtifactWorkspaceFileAdapter implements EditableArtifactAgentWorkspaceFilePort {\n  private readonly now: () => Date;\n  private readonly prepareFile: typeof prepareGeneratedWorkspaceFile;\n  private readonly completeFile: typeof completeFileUpload;\n\n  constructor(private readonly dependencies: EditableArtifactWorkspaceFileAdapterDependencies) {\n    this.now = dependencies.now ?? (() => new Date());\n    this.prepareFile = dependencies.prepareFile ?? prepareGeneratedWorkspaceFile;\n    this.completeFile = dependencies.completeFile ?? completeFileUpload;\n  }\n\n  async ensureMaterializationFile(\n    input: Parameters<EditableArtifactAgentWorkspaceFilePort[\"ensureMaterializationFile\"]>[0],\n  ): ReturnType<EditableArtifactAgentWorkspaceFilePort[\"ensureMaterializationFile\"]> {\n    throwIfAborted(input.signal);\n    const storage = this.dependencies.objectStorage;\n    if (!storage.headObject || !storage.putObjectStreamIfAbsent) {\n      throw new Error(\"Object storage lacks immutable streaming upload support\");\n    }\n    const download = await this.dependencies.durableExports.openMaterializationDownload({\n      scope: input.scope,\n      actor: input.actor,\n      artifactId: input.artifact.id,\n      jobId: input.jobId,\n      ...(input.signal ? { signal: input.signal } : {}),\n    });\n    try {\n      const sha256 = plainSha256(download.contentHash);\n      const filename = exportFilename(input.filename, download.format);\n      const fileId = deterministicUuid(\n        `editable-artifact-export:file:${input.scope.workspaceId}:${input.artifact.id}:${input.versionId}:${input.jobId}`,\n      );\n      const uploadId = deterministicUuid(\n        `editable-artifact-export:upload:${input.scope.workspaceId}:${input.artifact.id}:${input.versionId}:${input.jobId}`,\n      );\n      const safeFilename = `artifact-${input.artifact.id}-${input.jobId}.${download.format}`;\n      const objectKey = `workspaces/${input.scope.workspaceId}/files/${fileId}/artifact-exports/${safeFilename}`;\n      const prepared = await this.prepareFile(this.dependencies.db, {\n        accountId: input.scope.accountId,\n        workspaceId: input.scope.workspaceId,\n        fileId,\n        uploadId,\n        filename,\n        safeFilename,\n        contentType: download.mimeType,\n        sizeBytes: download.byteSize,\n        sha256,\n        bucket: storage.bucket,\n        objectKey,\n        expiresAt: new Date(this.now().getTime() + UPLOAD_INTENT_TTL_MS),\n      });\n\n      let file = prepared.file;\n      if (file.status !== \"ready\") {\n        const existing = await storage.headObject(objectKey);\n        if (existing) {\n          assertStoredExport(existing, download.byteSize, download.mimeType, sha256);\n        } else {\n          const created = await storage.putObjectStreamIfAbsent({\n            key: objectKey,\n            contentType: download.mimeType,\n            chunks: download.chunks(input.signal ? { signal: input.signal } : {}),\n            byteSize: download.byteSize,\n            sha256,\n            ...(input.signal ? { signal: input.signal } : {}),\n          });\n          if (!created) {\n            await assertVisibleExport(\n              storage,\n              objectKey,\n              download.byteSize,\n              download.mimeType,\n              sha256,\n              input.signal,\n            );\n          }\n        }\n        await download.assertUnchanged(input.signal);\n        throwIfAborted(input.signal);\n        file = await this.completeFile(this.dependencies.db, input.scope.workspaceId, uploadId);\n      } else {\n        await assertVisibleExport(\n          storage,\n          objectKey,\n          download.byteSize,\n          download.mimeType,\n          sha256,\n          input.signal,\n        );\n        await download.assertUnchanged(input.signal);\n      }\n      if (\n        file.id !== fileId ||\n        file.status !== \"ready\" ||\n        file.filename !== filename ||\n        file.contentType !== download.mimeType ||\n        file.sizeBytes !== download.byteSize ||\n        file.sha256 !== sha256\n      ) {\n        throw new Error(\"Generated workspace file differs from its immutable export\");\n      }\n\n      return Object.freeze({\n        fileId: file.id,\n        filename: file.filename,\n        contentType: file.contentType,\n        sizeBytes: file.sizeBytes,\n        sha256,\n        artifactId: input.artifact.id,\n        versionId: input.versionId,\n        materializationJobId: input.jobId,\n        sourceHeadSequence: input.sourceHeadSequence,\n        sourceStateHash: input.sourceStateHash,\n      });\n    } finally {\n      await download.close();\n    }\n  }\n}\n\nasync function assertVisibleExport(\n  storage: ObjectStorage,\n  objectKey: string,\n  byteSize: number,\n  contentType: string,\n  sha256: string,\n  signal?: AbortSignal,\n): Promise<void> {\n  const head = await retryWhileMissing(\n    async () => await storage.headObject!(objectKey),\n    signal ? { signal } : {},\n  );\n  assertStoredExport(head, byteSize, contentType, sha256);\n}\n\nfunction assertStoredExport(\n  head: ObjectHead | null,\n  byteSize: number,\n  contentType: string,\n  sha256: string,\n): void {\n  if (\n    !head ||\n    head.ContentLength !== byteSize ||\n    head.ContentType !== contentType ||\n    head.Metadata?.sha256 !== sha256 ||\n    typeof head.VersionToken !== \"string\" ||\n    head.VersionToken.length < 1\n  ) {\n    throw new Error(\"Workspace export object differs from its durable materialization\");\n  }\n}\n\nfunction exportFilename(value: string, format: string): string {\n  const expectedExtension = `.${format}`;\n  const normalized = value\n    .normalize(\"NFKC\")\n    .replace(/[\\\\/:*?\"<>|\\u0000-\\u001f\\u007f]+/gu, \"-\")\n    .replace(/\\s+/gu, \" \")\n    .trim()\n    .slice(0, 200);\n  const stem = normalized.toLowerCase().endsWith(expectedExtension)\n    ? normalized.slice(0, -expectedExtension.length)\n    : normalized;\n  return `${stem.replace(/[. ]+$/u, \"\").slice(0, 190) || \"artifact\"}${expectedExtension}`;\n}\n\nfunction plainSha256(value: string): string {\n  const match = /^sha256:([0-9a-f]{64})$/u.exec(value);\n  if (!match) throw new Error(\"Materialized artifact content hash is invalid\");\n  return match[1]!;\n}\n\nfunction deterministicUuid(seed: string): string {\n  const bytes = createHash(\"sha256\").update(seed, \"utf8\").digest().subarray(0, 16);\n  bytes[6] = ((bytes[6] ?? 0) & 0x0f) | 0x50;\n  bytes[8] = ((bytes[8] ?? 0) & 0x3f) | 0x80;\n  const hex = bytes.toString(\"hex\");\n  const value = `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n  if (!UUID_PATTERN.test(value)) throw new Error(\"Generated workspace file identity is invalid\");\n  return value;\n}\n\nfunction throwIfAborted(signal?: AbortSignal): void {\n  if (signal?.aborted) throw signal.reason ?? new Error(\"Artifact export aborted\");\n}\n","import { randomUUID } from \"node:crypto\";\nimport { isDatabaseConnectionLoss } from \"@opengeni/db\";\nimport type { Attributes, Observability, Span } from \"@opengeni/observability\";\n\nexport type ApiFatalEvent = \"startup_failure\" | \"unhandled_rejection\" | \"uncaught_exception\";\nexport type ApiFatalPhase = \"startup\" | \"running\";\nexport type ApiFatalReasonKind =\n  | \"bigint\"\n  | \"boolean\"\n  | \"error\"\n  | \"function\"\n  | \"null\"\n  | \"number\"\n  | \"object\"\n  | \"string\"\n  | \"symbol\"\n  | \"undefined\";\n\ntype ApiFatalObservability = Pick<Observability, \"error\" | \"flush\" | \"startSpan\"> &\n  Partial<Pick<Observability, \"recordFailureDiagnostic\" | \"warn\" | \"incrementCounter\">>;\n\ntype ApiFatalProcess = {\n  on: (\n    event: \"unhandledRejection\" | \"uncaughtException\",\n    listener: (reason: unknown) => void,\n  ) => void;\n  off: (\n    event: \"unhandledRejection\" | \"uncaughtException\",\n    listener: (reason: unknown) => void,\n  ) => void;\n  exit: (code: number) => void;\n};\n\nexport type ApiFatalProcessBoundaryOptions = {\n  process?: ApiFatalProcess;\n  observability?: ApiFatalObservability;\n  flushTimeoutMs?: number;\n  correlationId?: () => string;\n  fallbackLog?: (message: string) => void;\n  /**\n   * Classifies an unhandled rejection that leaves no process state behind and\n   * is therefore survivable once the API is serving. Defaults to a lost\n   * database connection (deploy drain, failover, restart): the rejected query\n   * held only a pooled connection the driver has already discarded, and every\n   * durable loop retries its claim on the next tick.\n   */\n  isRecoverableRejection?: (reason: unknown) => boolean;\n};\n\nexport type ApiFatalProcessBoundary = {\n  attachObservability: (observability: ApiFatalObservability) => void;\n  markRunning: () => void;\n  reportStartupFailure: (reason: unknown) => Promise<void>;\n  dispose: () => void;\n};\n\nconst API_FATAL_FLUSH_TIMEOUT_MS = 1_000;\nconst API_FATAL_CORRELATION_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;\n\nconst FATAL_ERROR_CODES = {\n  startup_failure: \"api_startup_failed\",\n  unhandled_rejection: \"api_unhandled_rejection\",\n  uncaught_exception: \"api_uncaught_exception\",\n} as const;\n\nexport function installApiFatalProcessBoundary(\n  options: ApiFatalProcessBoundaryOptions = {},\n): ApiFatalProcessBoundary {\n  const runtimeProcess = options.process ?? defaultProcessBoundary();\n  const flushTimeoutMs = options.flushTimeoutMs ?? API_FATAL_FLUSH_TIMEOUT_MS;\n  const correlationId = options.correlationId ?? (() => `api-fatal.${randomUUID()}`);\n  const fallbackLog = options.fallbackLog ?? ((message: string) => console.error(message));\n  const isRecoverableRejection = options.isRecoverableRejection ?? isDatabaseConnectionLoss;\n  let observability = options.observability;\n  let phase: ApiFatalPhase = \"startup\";\n  let reporting = false;\n\n  const recover = (reason: unknown): boolean => {\n    if (phase !== \"running\" || reporting) return false;\n    let recoverable = false;\n    try {\n      recoverable = isRecoverableRejection(reason);\n    } catch {\n      return false;\n    }\n    if (!recoverable) return false;\n    const attributes = {\n      errorClass: \"ApiRecoveredRejection\",\n      errorCode: \"api_unhandled_database_connection_loss\",\n      origin: \"api\",\n      reasonKind: apiFatalReasonKind(reason),\n    };\n    try {\n      if (observability?.warn) {\n        observability.warn(\n          \"Opengeni API recovered an unhandled database connection loss\",\n          attributes,\n        );\n      } else {\n        safeFallbackLog(\n          fallbackLog,\n          \"Opengeni API recovered an unhandled database connection loss (api_unhandled_database_connection_loss)\",\n        );\n      }\n      observability?.incrementCounter?.({\n        name: \"opengeni_api_recovered_rejections_total\",\n        help: \"Unhandled rejections the API survived because they only reported a lost database connection.\",\n        labels: { code: \"api_unhandled_database_connection_loss\" },\n      });\n    } catch {\n      // Recovery never depends on the observer.\n    }\n    return true;\n  };\n\n  const report = async (event: ApiFatalEvent, reason: unknown): Promise<void> => {\n    if (reporting) return;\n    reporting = true;\n\n    const diagnostic = apiFatalDiagnostic(event, phase, reason, correlationId);\n    let message = apiFatalMessage(diagnostic);\n    const activeObservability = observability;\n    try {\n      if (activeObservability) {\n        try {\n          const diagnosticId = activeObservability.recordFailureDiagnostic?.({\n            code: FATAL_ERROR_CODES[event],\n            stage: phase,\n            retryDecision: \"not_retryable\",\n            error: reason,\n          });\n          if (diagnosticId) {\n            diagnostic.correlationId = diagnosticId;\n            message = apiFatalMessage(diagnostic);\n          }\n        } catch {\n          // Never replace the required fatal exit with an observer failure.\n        }\n        let logged = false;\n        try {\n          activeObservability.error(message, diagnostic);\n          logged = true;\n        } catch {\n          // The fatal boundary must still report and terminate if logging is unhealthy.\n        }\n        if (!logged) {\n          safeFallbackLog(fallbackLog, message);\n        }\n        try {\n          const span: Span = activeObservability.startSpan(\"api.process.fatal\", diagnostic);\n          span.end({ error: true });\n        } catch {\n          // The synchronous log remains authoritative when span creation fails.\n        }\n        await flushWithin(activeObservability, flushTimeoutMs);\n      } else {\n        safeFallbackLog(fallbackLog, message);\n      }\n    } finally {\n      runtimeProcess.exit(1);\n    }\n  };\n\n  const onUnhandledRejection = (reason: unknown): void => {\n    if (recover(reason)) return;\n    void report(\"unhandled_rejection\", reason);\n  };\n  const onUncaughtException = (reason: unknown): void => {\n    void report(\"uncaught_exception\", reason);\n  };\n  runtimeProcess.on(\"unhandledRejection\", onUnhandledRejection);\n  runtimeProcess.on(\"uncaughtException\", onUncaughtException);\n\n  return {\n    attachObservability: (value) => {\n      observability = value;\n    },\n    markRunning: () => {\n      phase = \"running\";\n    },\n    reportStartupFailure: async (reason) => {\n      await report(\"startup_failure\", reason);\n    },\n    dispose: () => {\n      runtimeProcess.off(\"unhandledRejection\", onUnhandledRejection);\n      runtimeProcess.off(\"uncaughtException\", onUncaughtException);\n    },\n  };\n}\n\nfunction apiFatalDiagnostic(\n  event: ApiFatalEvent,\n  phase: ApiFatalPhase,\n  reason: unknown,\n  correlationId: () => string,\n): Attributes & {\n  errorClass: \"ApiFatalOperationError\";\n  errorCode: (typeof FATAL_ERROR_CODES)[ApiFatalEvent];\n  origin: \"api\";\n  phase: ApiFatalPhase;\n  reasonKind: ApiFatalReasonKind;\n  correlationId: string;\n} {\n  let safeCorrelationId = \"api-fatal.fallback\";\n  try {\n    const candidate = correlationId();\n    if (API_FATAL_CORRELATION_ID_PATTERN.test(candidate)) {\n      safeCorrelationId = candidate;\n    }\n  } catch {\n    // A fixed valid fallback preserves the fatal report and nonzero exit.\n  }\n  return {\n    errorClass: \"ApiFatalOperationError\",\n    errorCode: FATAL_ERROR_CODES[event],\n    origin: \"api\",\n    phase,\n    reasonKind: apiFatalReasonKind(reason),\n    correlationId: safeCorrelationId,\n  };\n}\n\nfunction apiFatalReasonKind(reason: unknown): ApiFatalReasonKind {\n  if (reason === null) return \"null\";\n  const kind = typeof reason;\n  if (kind !== \"object\") return kind;\n  try {\n    return reason instanceof Error ? \"error\" : \"object\";\n  } catch {\n    return \"object\";\n  }\n}\n\nfunction apiFatalMessage(diagnostic: ReturnType<typeof apiFatalDiagnostic>): string {\n  return (\n    `Opengeni API fatal process failure (${diagnostic.errorCode}; ` +\n    `phase=${diagnostic.phase}; reason_kind=${diagnostic.reasonKind}; ` +\n    `correlation_id=${diagnostic.correlationId})`\n  );\n}\n\nasync function flushWithin(\n  observability: Pick<Observability, \"flush\">,\n  timeoutMs: number,\n): Promise<void> {\n  let flush: Promise<void>;\n  try {\n    flush = Promise.resolve(observability.flush()).catch(() => undefined);\n  } catch {\n    return;\n  }\n  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return;\n\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  try {\n    await Promise.race([\n      flush,\n      new Promise<void>((resolve) => {\n        timeout = setTimeout(resolve, timeoutMs);\n      }),\n    ]);\n  } finally {\n    if (timeout !== undefined) clearTimeout(timeout);\n  }\n}\n\nfunction safeFallbackLog(fallbackLog: (message: string) => void, message: string): void {\n  try {\n    fallbackLog(message);\n  } catch {\n    // Process termination remains mandatory even when every diagnostic sink fails.\n  }\n}\n\nfunction defaultProcessBoundary(): ApiFatalProcess {\n  return {\n    on: (event, listener) => {\n      if (event === \"unhandledRejection\") {\n        process.on(\"unhandledRejection\", listener);\n      } else {\n        process.on(\"uncaughtException\", listener);\n      }\n    },\n    off: (event, listener) => {\n      if (event === \"unhandledRejection\") {\n        process.off(\"unhandledRejection\", listener);\n      } else {\n        process.off(\"uncaughtException\", listener);\n      }\n    },\n    exit: (code) => {\n      process.exit(code);\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,0BAAoD;AAC7D;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,2BAA2B;AACpC,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA,UAAU;AAAA,EACV;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;AC5CP;AAAA,EACE;AAAA,OAGK;AAIA,SAAS,6BACd,eAC8D;AAC9D,SAAO;AAAA,IACL,QAAQ,yBAAyB,aAAa;AAAA,IAC9C,0BAA0B,mCAAmC,aAAa;AAAA,EAC5E;AACF;AAEO,SAAS,yBAAyB,eAA2C;AAClF,SAAO;AAAA,IACL,OAAO,CAAC,SAAS,eAAe,cAAc,MAAM,SAAS,gBAAgB,UAAU,CAAC;AAAA,IACxF,MAAM,CAAC,SAAS,eAAe,cAAc,KAAK,SAAS,gBAAgB,UAAU,CAAC;AAAA,EACxF;AACF;AAEA,SAAS,gBAAgB,YAAyE;AAChG,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,EACT;AACA,QAAM,YAAwB,CAAC;AAC/B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,cAAU,GAAG,IAAI,oBAAoB,KAAK;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAgC;AAC3D,MACE,UAAU,QACV,UAAU,UACV,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU,WACjB;AACA,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B,QAAQ;AACN,WAAO,OAAO,KAAK;AAAA,EACrB;AACF;;;ACpBA,SAAS,kBAAkB;AAC3B,SAAS,yBAA2C;AACpD;AAAA,EACE;AAAA,OAGK;AACP,SAAS,8BAA8B;AACvC,SAAS,2BAA2B,qBAAoC;AACxE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;;;AC7CA,IAAM,4BAA4B;;;ADmDlC,IAAM,uBAAuB;AAE7B,IAAM,4BAA4B,IAAI;AActC,IAAM,0CAA0C;AACvD,IAAM,+BAA+B,kBAAkB;AAAA,EACrD,YAAY;AAAA,EACZ,SAAS;AACX,CAAC;AAMD,SAAS,WACP,MACA,KACA,QACA,SACA,aAA8C,CAAC,GACzC;AACN,QAAM,aAAa,KAAK,yBAAyB,8BAA8B,MAAM,GAAG;AACxF,MAAI,CAAC,UAAW;AAChB,OAAK,eAAe,OAAO,SAAS;AAAA,IAClC,GAAG;AAAA,IACH;AAAA,IACA,GAAI,UAAU,kBAAkB,IAAI,EAAE,iBAAiB,UAAU,gBAAgB,IAAI,CAAC;AAAA,EACxF,CAAC;AACH;AAeA,SAAS,qBACP,MACA,SACA,QACM;AACN,MAAI;AACF,SAAK,eAAe,iBAAiB;AAAA,MACnC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ,EAAE,SAAS,OAAO;AAAA,IAC5B,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAIA,SAAS,kBAAkB,QAAwB;AACjD,SAAO,kBAAkB,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC;AACzF;AAUA,eAAsB,2BACpB,MACA,cACqB;AACrB,QAAM,aAAa,OAAO,KAAK,YAAY,EAAE,SAAS,MAAM;AAC5D,QAAM,UAAU,kBAAkB,UAAU;AAC5C,MAAI,CAAC,SAAS;AAIZ,SAAK,eAAe,OAAO,mDAAmD,CAAC,CAAC;AAChF,yBAAqB,MAAM,UAAU,aAAa;AAClD,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AAEA,QAAM,OAAO,CAAC,MAAkC,WAA+B;AAC7E,yBAAqB,MAAM,UAAU,IAAI;AAEzC,UAAMA,YAAW,iBAAiB;AAAA,MAChC,eAAe,QAAQ;AAAA,MACvB,UAAU,QAAQ;AAAA,MAClB,aAAa,KAAK,QAAQ;AAAA,MAC1B,OAAO;AAAA,IACT,CAAC;AACD,WAAO,OAAO,KAAKA,WAAU,MAAM;AAAA,EACrC;AAEA,QAAM,SAAS,QAAQ;AACvB,MAAI,CAAC,QAAQ;AACX,WAAO,KAAK,kBAAkB,2BAA2B;AAAA,EAC3D;AAEA,QAAM,SAAS,+BAA+B,KAAK,QAAQ;AAC3D,MAAI,CAAC,QAAQ;AAIX,WAAO,KAAK,kBAAkB,sCAAsC;AAAA,EACtE;AAEA,QAAM,SAAS,MAAM,uBAAuB,QAAQ,MAAM;AAC1D,MAAI,CAAC,QAAQ;AAEX;AAAA,MACE;AAAA,MACA,kBAAkB,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,IACF;AACA,WAAO,KAAK,kBAAkB,sCAAsC;AAAA,EACtE;AAIA,QAAM,aAAa,MAAM,cAAc,KAAK,IAAI,OAAO,aAAa,OAAO,YAAY;AACvF,MAAI,CAAC,cAAc,WAAW,WAAW,UAAU;AACjD;AAAA,MACE;AAAA,MACA,YAAY,OAAO,WAAW,IAAI,OAAO,OAAO;AAAA,MAChD;AAAA,MACA;AAAA,MACA,EAAE,aAAa,OAAO,aAAa,SAAS,OAAO,QAAQ;AAAA,IAC7D;AACA,WAAO,KAAK,uBAAuB,0BAA0B;AAAA,EAC/D;AAKA,MACE,WAAW,gBAAgB,OAAO,eAClC,WAAW,OAAO,OAAO,gBACzB,WAAW,OAAO,OAAO,WACzB,OAAO,YAAY,OAAO,gBAC1B,OAAO,kBAAkB,SAAS,OAAO,WAAW,IAAI,OAAO,OAAO,IACtE;AACA,WAAO,KAAK,qBAAqB,8BAA8B;AAAA,EACjE;AACA,MAAI,WAAW,yBAAyB,OAAO,sBAAsB;AACnE,WAAO,KAAK,uBAAuB,2CAA2C;AAAA,EAChF;AAEA,QAAM,uBAAuB,yBAAyB,QAAQ,IAAI;AAClE,MAAI,CAAC,sBAAsB;AACzB,WAAO,KAAK,oBAAoB,8CAA8C;AAAA,EAChF;AACA,QAAM,QAAQ,MAAM,0BAA0B,KAAK,IAAI;AAAA,IACrD,aAAa,OAAO;AAAA,IACpB,cAAc,OAAO;AAAA,IACrB,sBAAsB,OAAO;AAAA,IAC7B;AAAA,IACA,SAAS;AAAA,EACX,CAAC;AACD,MAAI,CAAC,MAAM,SAAS;AAClB;AAAA,MACE;AAAA,MACA,aAAa,OAAO,WAAW,IAAI,OAAO,OAAO;AAAA,MACjD;AAAA,MACA;AAAA,MACA,EAAE,aAAa,OAAO,aAAa,SAAS,OAAO,QAAQ;AAAA,IAC7D;AACA,WAAO,KAAK,oBAAoB,wDAAwD;AAAA,EAC1F;AAKA,QAAM,cAAc;AAAA,IAClB,OAAO;AAAA,IACP,OAAO;AAAA,IACP;AAAA,EACF;AACA,QAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC/C,QAAM,UAAU,YAAY;AAAA,IAC1B,eAAe,QAAQ;AAAA,IACvB,aAAa,KAAK,QAAQ;AAAA,IAC1B,MAAM,OAAO;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,iBAAiB,KAAK,QAAQ;AAAA;AAAA;AAAA,IAG9B,kBAAkB,KAAK,IAAI,OAAO,KAAK,aAAa,yBAAyB;AAAA,EAC/E,CAAC;AACD,QAAM,WAAW,iBAAiB;AAAA,IAChC,eAAe,QAAQ;AAAA,IACvB,UAAU,QAAQ;AAAA,IAClB,aAAa,KAAK,QAAQ;AAAA,IAC1B;AAAA,EACF,CAAC;AACD,uBAAqB,MAAM,WAAW,MAAM;AAC5C,OAAK,eAAe,OAAO,4DAA4D;AAAA,IACrF,aAAa,OAAO;AAAA,IACpB,SAAS,OAAO;AAAA,IAChB,sBAAsB,MAAM;AAAA,EAC9B,CAAC;AACD,SAAO,OAAO,KAAK,UAAU,MAAM;AACrC;AAUA,eAAsB,0BACpB,MACA,SAC8B;AAC9B,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA,EAAE,MAAM,iBAAiB,MAAM,KAAK,QAAQ,MAAM,MAAM,KAAK,QAAQ,SAAS;AAAA,IAC9E;AAAA,IACA,CAAC,UAAU,2BAA2B,MAAM,KAAK;AAAA,IACjD;AAAA,MACE,MAAM;AAAA,MACN,GAAI,KAAK,gBAAgB,6BAA6B,KAAK,aAAa,IAAI,CAAC;AAAA,IAC/E;AAAA,EACF;AACA,OAAK,eAAe,OAAO,gDAAgD;AAAA,IACzE,SAAS;AAAA,EACX,CAAC;AACD,SAAO;AACT;;;AE9QA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,iBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP;AAAA,EACE,gCAAgC;AAAA,EAChC,oCAAoC;AAAA,OAG/B;AACP,SAAS,8BAA6C;AAEtD,SAAS,8CAA8C;AAEvD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,sCAAsC;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAKA,IAAM,uBAAuB;AAG7B,IAAM,sBAAsB;AAwBnC,SAAS,mBAAmB,SAA8B;AACxD,MAAI;AACF,WAAO,WAAW,OAAO,OAAO,EAAE,OAAO,UAAU;AAAA,EACrD,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AASO,SAAS,mCACd,SACA,UAAiF,CAAC,GACpD;AAC9B,QAAM,wBAAwB,QAAQ,yBAAyB;AAC/D,MAAI,CAAC,OAAO,cAAc,qBAAqB,KAAK,yBAAyB,GAAG;AAC9E,UAAM,IAAI,WAAW,uDAAuD;AAAA,EAC9E;AAEA,QAAM,SAAS,oBAAI,IAAkC;AACrD,QAAM,gBAA4C,CAAC;AACnD,QAAM,cAAc,oBAAI,IAAgB;AACxC,MAAI,YAAY;AAChB,MAAI,iBAAiB;AAErB,QAAM,qBAAqB,MAAY;AACrC,QAAI,OAAO,SAAS,EAAG;AACvB,eAAW,WAAW,YAAa,SAAQ;AAC3C,gBAAY,MAAM;AAAA,EACpB;AAEA,iBAAe,MAAM,SAAiB,OAA4C;AAChF,WAAO,MAAM;AACX,YAAM,QAAQ,MAAM,QAAQ,MAAM;AAClC,UAAI,CAAC,MAAO;AACZ,UAAI;AACF,cAAM,QAAQ,MAAM,SAAS,MAAM,OAAO;AAAA,MAC5C,QAAQ;AAAA,MAGR;AAAA,IACF;AAEA,sBAAkB;AAClB,UAAM,YAAY;AAClB,QAAI,MAAM,QAAQ,SAAS,GAAG;AAC5B,eAAS,SAAS,KAAK;AAAA,IACzB,OAAO;AACL,UAAI,OAAO,IAAI,OAAO,MAAM,MAAO,QAAO,OAAO,OAAO;AACxD,yBAAmB;AAAA,IACrB;AACA,SAAK;AAAA,EACP;AAEA,WAAS,OAAa;AACpB,WAAO,iBAAiB,uBAAuB;AAC7C,YAAM,OAAO,cAAc,MAAM;AACjC,UAAI,CAAC,KAAM;AACX,UAAI,OAAO,IAAI,KAAK,OAAO,MAAM,KAAK,SAAS,CAAC,KAAK,MAAM,UAAW;AACtE,wBAAkB;AAClB,WAAK,MAAM,KAAK,SAAS,KAAK,KAAK;AAAA,IACrC;AAAA,EACF;AAEA,WAAS,SAAS,SAAiB,OAAmC;AACpE,QAAI,MAAM,UAAW;AACrB,UAAM,YAAY;AAClB,kBAAc,KAAK,EAAE,SAAS,MAAM,CAAC;AACrC,SAAK;AAAA,EACP;AAEA,SAAO;AAAA,IACL,QAAQ,SAAS,SAAS;AACxB,UAAI,CAAC,UAAW;AAChB,YAAM,YAAY,mBAAmB,OAAO;AAC5C,UAAI,QAAQ,OAAO,IAAI,OAAO;AAC9B,UAAI,CAAC,OAAO;AACV,gBAAQ,EAAE,WAAW,OAAO,SAAS,CAAC,EAAE;AACxC,eAAO,IAAI,SAAS,KAAK;AAAA,MAC3B;AAEA,YAAM,SAAS,EAAE,SAAS,SAAS,UAAU;AAC7C,YAAM,YAAY,MAAM,QAAQ,SAAS;AACzC,UAAI,aAAa,aAAa,KAAK,MAAM,QAAQ,SAAS,EAAG,WAAW;AACtE,cAAM,QAAQ,SAAS,IAAI;AAC3B,gBAAQ,uBAAuB;AAAA,MACjC,OAAO;AACL,cAAM,QAAQ,KAAK,MAAM;AAAA,MAC3B;AAEA,eAAS,SAAS,KAAK;AAAA,IACzB;AAAA,IACA,MAAM,WAAW;AACf,UAAI,OAAO,SAAS,EAAG;AACvB,YAAM,IAAI,QAAc,CAAC,YAAY,YAAY,IAAI,OAAO,CAAC;AAAA,IAC/D;AAAA,IACA,QAAQ;AACN,kBAAY;AACZ,iBAAW,SAAS,OAAO,OAAO,GAAG;AACnC,cAAM,QAAQ,SAAS;AAAA,MACzB;AACA,yBAAmB;AAAA,IACrB;AAAA,EACF;AACF;AAOA,SAAS,kBACP,SACA,MAC+E;AAC/E,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,MACE,MAAM,WAAW,KACjB,MAAM,CAAC,MAAM,WACb,MAAM,CAAC,MAAM,gBACb,CAAC,MAAM,CAAC,KACR,MAAM,CAAC,MAAM,MACb;AACA,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,aAAa,MAAM,CAAC;AAAA,IACpB,SAAS,MAAM,CAAC;AAAA,IAChB,sBAAsB,MAAM,CAAC;AAAA,EAC/B;AACF;AAGO,SAAS,uBACd,SAC+E;AAC/E,SAAO,kBAAkB,SAAS,QAAQ;AAC5C;AAGO,SAAS,uBACd,SAC+E;AAC/E,SAAO,kBAAkB,SAAS,OAAO;AAC3C;AAYO,SAAS,qBAAqB,MAA2C;AAC9E,QAAM,MAAM,CAAC,MAAgC,OAAO,MAAM,WAAW,IAAI,OAAO,CAAC;AACjF,QAAM,WAAW,KAAK,KAAK,CAAC;AAC5B,SAAO;AAAA,IACL,YAAY,KAAK;AAAA,IACjB,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK;AAAA,IACZ,QAAQ,KAAK;AAAA,IACb,cAAc,IAAI,KAAK,YAAY;AAAA,IACnC,eAAe,IAAI,KAAK,aAAa;AAAA,IACrC,eAAe,IAAI,KAAK,aAAa;AAAA,IACrC,gBAAgB,IAAI,KAAK,cAAc;AAAA,IACvC,gBAAgB,WAAW,SAAS,cAAc;AAAA,IAClD,iBAAiB,WAAW,IAAI,SAAS,YAAY,IAAI;AAAA,IACzD,kBAAkB,WAAW,IAAI,SAAS,aAAa,IAAI;AAAA,IAC3D,YAAY,KAAK;AAAA;AAAA;AAAA,IAGjB,WACE,KAAK,eAAe,OAAO,KAAK,WAAW,IAAI,IAC3C,IAAI,KAAK,OAAO,KAAK,WAAW,CAAC,IACjC,oBAAI,KAAK;AAAA,EACjB;AACF;AAKO,SAAS,uCACd,MACuC;AACvC,SAAO,iCAAiC,MAAM;AAAA,IAC5C,kBAAkB,KAAK;AAAA,IACvB,UAAU,gBAAgB,KAAK,UAAU,4BAA4B;AAAA,IACrE,SAAS,KAAK,QAAQ,IAAI,CAAC,YAAY;AAAA,MACrC,IAAI,OAAO;AAAA,MACX,MAAM,OAAO;AAAA,MACb,cAAc,OAAO,aAAa,KAAK,KAAK;AAAA,MAC5C,aAAa,OAAO;AAAA,MACpB,gBAAgB,OAAO;AAAA,MACvB,kBAAkB,OAAO;AAAA,MACzB,UAAU,oBAAoB,OAAO,QAAQ;AAAA,MAC7C,cAAc,wBAAwB,OAAO,IAAI;AAAA,MACjD,sBAAsB,OAAO;AAAA,MAC7B,mBAAmB;AAAA,QACjB,OAAO;AAAA,QACP;AAAA,MACF;AAAA,MACA,UAAU,gBAAgB,OAAO,UAAU,4BAA4B;AAAA,MACvE,cAAc,OAAO;AAAA,IACvB,EAAE;AAAA,IACF,iBAAiB,KAAK,kBAAkB,CAAC,GAAG,QAAQ,2BAA2B;AAAA,EACjF,CAAC;AACH;AAEA,IAAM,8BAA8B,oBAAI,IAGtC;AAAA,EACA;AAAA,IACE,wBAAwB;AAAA,IACxB;AAAA,EACF;AAAA,EACA;AAAA,IACE,wBAAwB;AAAA,IACxB;AAAA,EACF;AAAA,EACA;AAAA,IACE,wBAAwB;AAAA,IACxB;AAAA,EACF;AAAA,EACA;AAAA,IACE,wBAAwB;AAAA,IACxB;AAAA,EACF;AAAA,EACA,CAAC,wBAAwB,uDAAuD,gBAAgB;AAClG,CAAC;AAKD,SAAS,4BACP,MACqC;AACrC,QAAM,SAAS,4BAA4B,IAAI,KAAK,MAAM;AAC1D,QAAM,YAAY,OAAO,KAAK,aAAa;AAC3C,MAAI,CAAC,UAAU,CAAC,OAAO,cAAc,SAAS,KAAK,aAAa,EAAG,QAAO,CAAC;AAC3E,QAAM,SAAS,qCAAqC,UAAU;AAAA,IAC5D,UAAU,KAAK;AAAA,IACf,sBAAsB,KAAK;AAAA,IAC3B;AAAA,IACA,QAAQ,KAAK,OAAO,MAAM,GAAG,GAAG,KAAK;AAAA,IACrC,SAAS,IAAI,KAAK,SAAS,EAAE,YAAY;AAAA,IACzC,aAAa,KAAK,IAAI,OAAO,KAAK,WAAW,KAAK,GAAG,OAAO,gBAAgB;AAAA,EAC9E,CAAC;AACD,SAAO,OAAO,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC;AAC3C;AAEA,SAAS,gBAAgB,OAAwB,OAAuB;AACtE,MAAI;AACJ,MAAI;AACF,aAAS,OAAO,KAAK;AAAA,EACvB,QAAQ;AACN,UAAM,IAAI,MAAM,GAAG,KAAK,oBAAoB;AAAA,EAC9C;AACA,MAAI,SAAS,MAAM,SAAS,OAAO,OAAO,gBAAgB,GAAG;AAC3D,UAAM,IAAI,MAAM,GAAG,KAAK,oCAAoC;AAAA,EAC9D;AACA,SAAO,OAAO,MAAM;AACtB;AAEA,SAAS,oBAAoB,UAA6C;AACxE,UAAQ,UAAU;AAAA,IAChB,KAAK,GAAG;AACN,aAAO;AAAA,IACT,KAAK,GAAG;AACN,aAAO;AAAA,IACT,KAAK,GAAG;AACN,aAAO;AAAA,IACT;AACE,YAAM,IAAI,MAAM,yDAAyD;AAAA,EAC7E;AACF;AAEA,SAAS,wBAAwB,cAAqC;AACpE,UAAQ,cAAc;AAAA,IACpB,KAAK,KAAK;AACR,aAAO;AAAA,IACT,KAAK,KAAK;AACR,aAAO;AAAA,IACT;AACE,YAAM,IAAI,MAAM,6DAA6D;AAAA,EACjF;AACF;AAEA,eAAe,+BACb,IACA,OAKe;AACf,QAAM,aAAa,MAAMC,eAAc,IAAI,MAAM,aAAa,MAAM,OAAO;AAC3E,MAAI,CAAC,WAAY;AACjB,QAAM,kCAAkC,IAAI;AAAA,IAC1C,WAAW,WAAW;AAAA,IACtB,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB,UAAU,uCAAuC,MAAM,SAAS;AAAA,EAClE,CAAC;AACH;AAQA,eAAe,uBACb,IACA,OAMyD;AACzD,QAAM,SAAS,qBAAqB,MAAM,MAAM;AAChD,QAAM,SAAS,MAAM,2BAA2B,IAAI;AAAA,IAClD,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB;AAAA,EACF,CAAC;AACD,SAAO,EAAE,UAAU,MAAM,gBAAgB,OAAO,eAAe;AACjE;AAgBA,eAAe,wBACb,IACA,KACA,eACA,aACA,cACA,OACe;AACf,QAAM,WAAW,MAAM,iCAAiC,IAAI,EAAE,aAAa,aAAa,CAAC;AACzF,aAAW,WAAW,UAAU;AAC9B,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,MAAM,QAAQ,YAAY;AAAA,MAC5B;AAAA,IACF,SAAS,OAAO;AACd,qBAAe,OAAO,uDAAuD;AAAA,QAC3E;AAAA,QACA,WAAW,QAAQ;AAAA,QACnB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AACF;AASA,eAAsB,wBACpB,IACA,eACA,SACA,SACA,KACA,cACe;AACf,QAAM,MAAM,uBAAuB,OAAO;AAC1C,MAAI,CAAC,KAAK;AACR;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,WAAW,OAAO,OAAO;AAAA,EACnC,SAAS,OAAO;AACd,mBAAe,OAAO,yDAAyD;AAAA,MAC7E;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AACD;AAAA,EACF;AAYA,MAAI,MAAM,OAAO,UAAU,gBAAgB;AACzC,UAAM,SAAS,yBAAyB,MAAM,MAAM,aAAa,MAAM;AACvE,mBAAe,iBAAiB;AAAA,MAC9B,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ,EAAE,OAAO;AAAA,IACnB,CAAC;AACD,QAAI;AACF,YAAMC,cAAa,MAAMD,eAAc,IAAI,IAAI,aAAa,IAAI,OAAO;AACvE,UAAIC,aAAY;AACd,cAAM,WAAW,MAAM,4BAA4B,IAAI;AAAA,UACrD,WAAWA,YAAW;AAAA,UACtB,aAAa,IAAI;AAAA,UACjB,cAAc,IAAI;AAAA,UAClB,sBAAsB,IAAI;AAAA,UAC1B;AAAA,QACF,CAAC;AAGD,YAAI,CAAC,SAAS,SAAU;AACxB,YAAI;AACF,gBAAM,iCAAiC,IAAI;AAAA,YACzC,WAAWA,YAAW;AAAA,YACtB,aAAa,IAAI;AAAA,YACjB,cAAc,IAAI;AAAA,UACpB,CAAC;AAAA,QACH,SAAS,OAAO;AACd,yBAAe,OAAO,6DAA6D;AAAA,YACjF;AAAA,YACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,UAC9D,CAAC;AAAA,QACH;AAMA,YAAI,KAAK;AACP,gBAAM,eACJ,MAAM,MAAM,aAAa,WAAW,mBAAmB;AACzD,gBAAM;AAAA,YACJ;AAAA,YACA;AAAA,YACA;AAAA,YACA,IAAI;AAAA,YACJ,IAAI;AAAA,YACJ,CAAC,iBAAiB;AAChB,oBAAM,SAA6B;AAAA,gBACjC,EAAE,MAAM,qBAAqB,QAAQ,cAAc,SAAS,EAAE,OAAO,EAAE;AAAA,cACzE;AACA,kBAAI,cAAc;AAChB,uBAAO,KAAK;AAAA,kBACV,MAAM;AAAA,kBACN,QAAQ;AAAA,kBACR,SAAS,CAAC;AAAA,gBACZ,CAAC;AAAA,cACH;AACA,qBAAO;AAAA,YACT;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,qBAAe,OAAO,kDAAkD;AAAA,QACtE;AAAA,QACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AACA;AAAA,EACF;AACA,MAAI,MAAM,OAAO,UAAU,uBAAuB;AAChD,UAAMA,cAAa,MAAMD,eAAc,IAAI,IAAI,aAAa,IAAI,OAAO,EAAE,MAAM,MAAM,IAAI;AACzF,QAAI,CAACC,eAAcA,YAAW,yBAAyB,IAAI,qBAAsB;AACjF,UAAM,WAAW,MAAM,MAAM;AAC7B,UAAM,UAAU,MAAM;AACpB,cAAQ,SAAS,OAAO;AAAA,QACtB,KAAK,iBAAiB;AACpB,iBAAO;AAAA,QACT,KAAK,iBAAiB;AACpB,iBAAO;AAAA,QACT,KAAK,iBAAiB;AACpB,iBAAO;AAAA,QACT,KAAK,iBAAiB;AACpB,iBAAO;AAAA,QACT,KAAK,iBAAiB;AACpB,iBAAO;AAAA,QACT,KAAK,iBAAiB;AACpB,iBAAO;AAAA,QACT,KAAK,iBAAiB;AACpB,iBAAO;AAAA,QACT;AACE,iBAAO;AAAA,MACX;AAAA,IACF,GAAG;AACH,QAAI,CAAC,OAAQ;AACb,QAAI;AACF,YAAM,6BAA6B,IAAI;AAAA,QACrC,WAAWA,YAAW;AAAA,QACtB,aAAa,IAAI;AAAA,QACjB,cAAc,IAAI;AAAA,QAClB,sBAAsB,IAAI;AAAA,QAC1B,sBAAsBA,YAAW;AAAA,QACjC,aAAa,SAAS;AAAA,QACtB;AAAA,QACA,sBAAsB,iBAAiB,KAAK,SAAS,oBAAoB,IACrE,SAAS,uBACT;AAAA,QACJ,WAAW,SAAS,aAAa;AAAA,QACjC,WAAW,SAAS;AAAA,QACpB,YAAY,SAAS;AAAA,MACvB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,qBAAe,OAAO,yDAAyD;AAAA,QAC7E;AAAA,QACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AACA;AAAA,EACF;AACA,MAAI,MAAM,OAAO,UAAU,aAAa;AACtC;AAAA,EACF;AACA,QAAM,YAAY,MAAM,MAAM;AAC9B,QAAM,aAAa,MAAMD,eAAc,IAAI,IAAI,aAAa,IAAI,OAAO,EAAE,MAAM,MAAM,IAAI;AACzF,MAAI,CAAC,cAAc,WAAW,yBAAyB,IAAI,qBAAsB;AACjF,MAAI;AACF,UAAM,UAAU,MAAM,0BAA0B,IAAI;AAAA,MAClD,WAAW,WAAW;AAAA,MACtB,aAAa,IAAI;AAAA,MACjB,cAAc,IAAI;AAAA,MAClB,sBAAsB,IAAI;AAAA,MAC1B,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,QAAQ,QAAS;AAAA,EACxB,SAAS,OAAO;AACd,mBAAe,OAAO,kDAAkD;AAAA,MACtE;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AACD;AAAA,EACF;AAGA,gBAAc,SAAS,UAAU;AACjC,MAAI,UAAU,0BAA0B;AACtC,QAAI;AACF,YAAM,+BAA+B,IAAI;AAAA,QACvC,aAAa,IAAI;AAAA,QACjB,SAAS,IAAI;AAAA,QACb,WAAW,UAAU;AAAA,MACvB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,qBAAe,OAAO,kDAAkD;AAAA,QACtE;AAAA,QACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,UAAU,eAAe;AAC3B,QAAI;AACF,YAAM,SAAS,UAAU;AACzB,YAAM,YAAY,OAAO,aAAa,CAAC,OAAO;AAC9C,YAAM,SAAS,OAAO,qBAAqB;AAC3C,YAAM,iBAAiB,OAAO;AAC9B,YAAM,SAAS,yBAAyB,WAAW,iBAAiB;AAGpE,UACE,WAAW,eAAe,cACzB,WAAW,4BAA4B,UAAU,UAClD,WAAW,mBAAmB,YAAY,aACzC,mBAAmB,WACjB,QAAQ,oBAAoB,eAAe,mBAC1C,QAAQ,kBAAkB,eAAe,iBACzC,QAAQ,oBAAoB,eAAe,kBAC/C;AACA,cAAM,yBAAyB,IAAI;AAAA,UACjC,aAAa,IAAI;AAAA,UACjB,SAAS,IAAI;AAAA,UACb,YAAY;AAAA,UACZ,0BAA0B;AAAA,UAC1B,gBAAgB;AAAA,UAChB,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,UAC3C,sBAAsB,IAAI;AAAA,QAC5B,CAAC;AAAA,MACH;AAAA,IACF,SAAS,OAAO;AACd,qBAAe,OAAO,iDAAiD;AAAA,QACrE;AAAA,QACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,UAAU,UAAU;AAC1B,MAAI,CAAC,QAAS;AACd,MAAI;AACF,UAAM,uBAAuB,IAAI;AAAA,MAC/B,WAAW,WAAW;AAAA,MACtB,aAAa,IAAI;AAAA,MACjB,SAAS,IAAI;AAAA,MACb,QAAQ;AAAA,IACV,CAAC;AAAA,EACH,SAAS,OAAO;AACd,mBAAe,OAAO,gDAAgD;AAAA,MACpE;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AAAA,EACH;AACF;AAOO,SAAS,sBAAsB,MAKvB;AACb,QAAM,YAAY;AAAA,IAChB,CAAC,SAAS,YACR;AAAA,MACE,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,IACF;AAAA,MACE,sBAAsB,MACpB,KAAK,eAAe,iBAAiB;AAAA,QACnC,MAAM;AAAA,QACN,MAAM;AAAA,MACR,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,cAAc,KAAK,IAAI,qBAAqB,sBAAsB,CAAC,SAAS,YAAY;AAC5F,cAAU,QAAQ,SAAS,OAAO;AAAA,EACpC,CAAC;AACD,SAAO,MAAM;AACX,gBAAY;AACZ,cAAU,MAAM;AAAA,EAClB;AACF;AAWO,SAAS,oBAAoB,OAAuB;AACzD,QAAM,OAAO,MAAM;AACnB,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AASA,MAAI,KAAK,0BAA0B;AACjC,WAAO;AAAA,EACT;AACA,SAAO,KAAK,YAAY,QAAQ,KAAK,WAAW;AAClD;AASO,SAAS,8BAA8B,OAA6B;AACzE,QAAM,SAAS,MAAM,cAAc;AACnC,SAAO,SAAS,SAAS;AAC3B;AAGO,SAAS,qBAAqB,OAAuB;AAC1D,SAAO,MAAM,cAAc,aAAa;AAC1C;AAEO,SAAS,yBAAyB,OAAuC;AAC9E,QAAM,OAAO,MAAM;AAInB,MAAI,CAAC,KAAM,QAAO,CAAC;AACnB,SAAO;AAAA,IACL,MAAM,KAAK,SAAS;AAAA,IACpB,YAAY,KAAK,eAAe;AAAA,IAChC,KAAK,KAAK,QAAQ;AAAA,IAClB,KAAK,KAAK,QAAQ;AAAA,IAClB,SAAS,KAAK,YAAY;AAAA,IAC1B,UAAU,KAAK,aAAa;AAAA,IAC5B,eAAe,KAAK,kBAAkB;AAAA,IACtC,yBAAyB,KAAK,4BAA4B;AAAA,IAC1D,mBAAmB,KAAK,sBAAsB;AAAA,IAC9C,sBAAsB,KAAK,yBAAyB;AAAA,IACpD,iBAAiB,KAAK,oBAAoB;AAAA,IAC1C,eAAe,KAAK,2BAA2B;AAAA,IAC/C,GAAI,KAAK,iBAAiB,oCAAoC,KAAK,cAAc,IAAI,CAAC;AAAA,EACxF;AACF;AAEA,SAAS,qBAAqB,OAIrB;AACP,MACE,CAAC,6EAA6E;AAAA,IAC5E,MAAM;AAAA,EACR,KACA,CAAC,4CAA4C,KAAK,MAAM,4BAA4B,KACpF,CAAC,iBAAiB,KAAK,MAAM,2BAA2B,GACxD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,aAAa,MAAM;AAAA,IACnB,eAAe,MAAM;AAAA,IACrB,cAAc,MAAM;AAAA,EACtB;AACF;AAUA,eAAsB,yBACpB,IACA,OAS+B;AAC/B,QAAM,2BAA2B,MAAM,4BAA4B;AACnE,QAAM,aAAa,MAAMA,eAAc,IAAI,MAAM,aAAa,MAAM,OAAO;AAC3E,MAAI,CAAC,YAAY;AACf,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACA,MACE,WAAW,eAAe,MAAM,eAC/B,WAAW,4BAA4B,UAAU,6BACjD,MAAM,mBAAmB,UACxB,WAAW,mBAAmB,YAAY,MAAM,oBACjD,MAAM,mBAAmB,UACxB,KAAK,UAAU,yBAAyB,WAAW,iBAAiB,CAAC,MACnE,KAAK,UAAU;AAAA,IACb,iBAAiB,MAAM,eAAe;AAAA,IACtC,eAAe,MAAM,eAAe;AAAA,IACpC,iBAAiB,MAAM,eAAe;AAAA,EACxC,CAAC,IACL;AAGA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACA,SAAO,MAAM,0BAA0B,IAAI;AAAA,IACzC,WAAW,WAAW;AAAA,IACtB,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB,YAAY,MAAM;AAAA,IAClB;AAAA,IACA,GAAI,MAAM,mBAAmB,SAAY,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,IACrF,GAAI,MAAM,iBAAiB,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,IACvE,GAAI,MAAM,uBAAuB,EAAE,sBAAsB,MAAM,qBAAqB,IAAI,CAAC;AAAA,EAC3F,CAAC;AACH;AAQA,eAAsB,0BACpB,IACA,OAM+B;AAC/B,QAAM,aAAa,MAAMA,eAAc,IAAI,MAAM,aAAa,MAAM,OAAO;AAC3E,MAAI,CAAC,YAAY;AACf,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACA,MAAI,WAAW,aAAa,MAAM,UAAU;AAG1C,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACA,SAAO,MAAM,2BAA2B,IAAI;AAAA,IAC1C,WAAW,WAAW;AAAA,IACtB,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB,UAAU,MAAM;AAAA,IAChB,GAAI,MAAM,uBAAuB,EAAE,sBAAsB,MAAM,qBAAqB,IAAI,CAAC;AAAA,EAC3F,CAAC;AACH;AAUA,eAAsB,mBACpB,IACA,eACA,SACA,SACA,KACe;AACf,QAAM,MAAM,uBAAuB,OAAO;AAC1C,MAAI,CAAC,KAAK;AACR;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,OAAO,OAAO;AAAA,EAC9B,SAAS,OAAO;AACd,mBAAe,OAAO,uDAAuD;AAAA,MAC3E;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AACD;AAAA,EACF;AACA,QAAM,YAAY,MAAM,4BAA4B,IAAI,IAAI,aAAa,IAAI,OAAO,EAAE;AAAA,IACpF,MAAM;AAAA,EACR;AACA,MAAI,CAAC,aAAa,UAAU,yBAAyB,IAAI,sBAAsB;AAC7E,mBAAe,OAAO,qDAAqD;AAAA,MACzE,aAAa,IAAI;AAAA,MACjB,SAAS,IAAI;AAAA,IACf,CAAC;AACD;AAAA,EACF;AACA,MAAI;AACJ,MAAI,MAAM,cAAc,SAAS,GAAG;AAClC,QAAI;AACF,sBAAgB,uCAAuC,MAAM,eAAe,UAAU,EAAE;AAAA,IAC1F,SAAS,OAAO;AACd,qBAAe,OAAO,uDAAuD;AAAA,QAC3E,aAAa,IAAI;AAAA,QACjB,SAAS,IAAI;AAAA,QACb,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI;AACF,UAAM,yBAAyB,IAAI;AAAA,MACjC,aAAa,IAAI;AAAA,MACjB,SAAS,IAAI;AAAA,MACb,YAAY,oBAAoB,KAAK;AAAA,MACrC,0BAA0B,8BAA8B,KAAK;AAAA,MAC7D,sBAAsB,IAAI;AAAA,IAC5B,CAAC;AACD,UAAM,0BAA0B,IAAI;AAAA,MAClC,aAAa,IAAI;AAAA,MACjB,SAAS,IAAI;AAAA,MACb,UAAU,qBAAqB,KAAK;AAAA,MACpC,sBAAsB,IAAI;AAAA,IAC5B,CAAC;AACD,UAAM,0BAA0B,IAAI;AAAA,MAClC,WAAW,UAAU;AAAA,MACrB,aAAa,IAAI;AAAA,MACjB,cAAc,IAAI;AAAA,MAClB,sBAAsB,IAAI;AAAA,MAC1B,cAAc,MAAM,aAAa,KAAK,KAAK;AAAA,MAC3C,cAAc,iBAAiB,KAAK,MAAM,YAAY,IAAI,MAAM,eAAe;AAAA,MAC/E,eACE,MAAM,kBAAkB,YAAY,MAAM,kBAAkB,SACxD,MAAM,gBACN;AAAA,MACN,cAAc,yBAAyB,KAAK;AAAA,MAC5C,GAAI,kBAAkB,SAAY,EAAE,cAAc,IAAI,CAAC;AAAA,MACvD,iBAAiB,qBAAqB,KAAK;AAAA,IAC7C,CAAC;AAAA,EACH,SAAS,OAAO;AACd,mBAAe,OAAO,+DAA+D;AAAA,MACnF;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AAAA,EACH;AAIA,OAAK;AAAA,IACH,EAAE,KAAK,cAAc;AAAA,IACrB;AAAA,MACE;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,QACN,aAAa,IAAI;AAAA,QACjB,cAAc,IAAI;AAAA,QAClB,sBAAsB,IAAI;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AASA,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,2BAA2B,IAAI;AAAA,MACvD,WAAW,UAAU;AAAA,MACrB,aAAa,IAAI;AAAA,MACjB,cAAc,IAAI;AAAA,MAClB,sBAAsB,IAAI;AAAA,IAC5B,CAAC;AACD,QAAI,WAAW,KAAK;AAClB,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,QACA,IAAI;AAAA,QACJ,IAAI;AAAA,QACJ,CAAC,iBAAiB,CAAC,EAAE,MAAM,yBAAyB,QAAQ,cAAc,SAAS,CAAC,EAAE,CAAC;AAAA,MACzF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,mBAAe,OAAO,6DAA6D;AAAA,MACjF;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AAAA,EACH;AACF;AAQO,SAAS,oBAAoB,MAIrB;AACb,SAAO,KAAK,IAAI;AAAA,IAAqB;AAAA,IAAqB,CAAC,SAAS,YAClE,mBAAmB,KAAK,IAAI,KAAK,eAAe,SAAS,SAAS,KAAK,GAAG;AAAA,EAC5E;AACF;;;ACllCA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oCAAuD;AAMhE,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB;AAC9B,IAAM,wBAAwB,IAAI;AAClC,IAAM,0BAA0B;AAEhC,eAAsB,iCAAiC,MAAsC;AAC3F,QAAM,gBAAgB,OAAO,WAAW;AACxC,QAAM,cAAc,MAAM,4BAA4B,KAAK,IAAI,eAAe,iBAAiB;AAC/F,MAAI,CAAC,YAAa,QAAO;AAEzB,MAAI;AACF,QAAI,CAAE,MAAM,uCAAuC,KAAK,IAAI,WAAW,GAAI;AACzE,YAAM,2BAA2B,KAAK,IAAI;AAAA,QACxC;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,WAAW;AAAA,MACb,CAAC;AACD,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM,wCAAwC,MAAM;AAAA,MACjE,WAAW,YAAY;AAAA,MACvB,aAAa,YAAY;AAAA,MACzB,cAAc,YAAY;AAAA,MAC1B,WAAW,YAAY;AAAA,MACvB,WAAW,YAAY;AAAA,IACzB,CAAC;AACD,UAAM,SAAS,MAAM,OAAO,YAAY;AAAA,MACtC,aAAa,YAAY;AAAA,MACzB,WAAW,YAAY;AAAA,MACvB,MAAM,oCAAoC,MAAM,WAAW;AAAA,MAC3D,+BAA+B;AAAA,IACjC,CAAC;AACD,UAAM,YAAY,MAAM,+BAA+B,KAAK,IAAI;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,gBAAgB,OAAO;AAAA,MACvB,uBAAuB,OAAO;AAAA,IAChC,CAAC;AACD,QAAI,CAAC,UAAW,OAAM,IAAI,MAAM,iDAAiD;AAAA,EACnF,SAAS,OAAO;AACd,UAAM,YAAY,kBAAkB,KAAK;AACzC,QAAI,4BAA4B,KAAK,GAAG;AACtC,YAAM,2BAA2B,KAAK,IAAI;AAAA,QACxC;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW;AAAA,MACb,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IAC1B,WAAW,YAAY,gBAAgB,yBAAyB,uBAAuB,KAAK,GAAG;AAC7F,YAAM,2BAA2B,KAAK,IAAI;AAAA,QACxC;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IAC1B,OAAO;AACL,YAAM,4BAA4B,KAAK,IAAI;AAAA,QACzC;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,gBAAgB,OAAO,YAAY,YAAY,CAAC;AAAA,MACjF,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IAC1B;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,gCACd,MACA,UAAwD,CAAC,GACpC;AACrB,MAAI,UAAU;AACd,MAAI;AACJ,QAAM,aAAa,KAAK,IAAI,KAAK,QAAQ,cAAc,GAAK;AAC5D,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,QAAQ,cAAc,EAAE,CAAC;AACrE,QAAM,OAAO,MAAM;AACjB,QAAI,WAAW,QAAS;AACxB,eAAW,YAAY;AACrB,eAAS,QAAQ,GAAG,QAAQ,YAAY,SAAS,GAAG;AAClD,YAAI,CAAE,MAAM,iCAAiC,IAAI,EAAI;AAAA,MACvD;AAAA,IACF,GAAG,EACA,MAAM,CAAC,UAAU;AAChB,WAAK,eAAe,MAAM,yCAAyC;AAAA,QACjE,YAAY,iBAAiB,QAAQ,MAAM,OAAO;AAAA,QAClD,WAAW,kBAAkB,KAAK;AAAA,QAClC,QAAQ;AAAA,MACV,CAAC;AAAA,IACH,CAAC,EACA,QAAQ,MAAM;AACb,gBAAU;AAAA,IACZ,CAAC;AAAA,EACL;AACA,QAAM,QAAQ,YAAY,MAAM,UAAU;AAC1C,iBAAe,IAAI;AACnB,SAAO,YAAY;AACjB,cAAU;AACV,kBAAc,KAAK;AACnB,UAAM;AAAA,EACR;AACF;AAEO,SAAS,oCACd,MACA,aACQ;AACR,QAAM,aAAa,YAAY;AAC/B,QAAM,UAAU,wBAAwB,WAAW,SAAS,GAAG,GAAG,KAAK;AACvE,QAAM,QAAQ,wBAAwB,WAAW,YAAY,GAAG,EAAE;AAClE,QAAM,aAAa,wBAAwB,WAAW,YAAY,GAAG,EAAE;AACvE,QAAM,aAAa,wBAAwB,WAAW,YAAY,GAAG,EAAE;AACvE,QAAM,cAAc,wBAAwB,WAAW,aAAa,GAAG,EAAE;AACzE,QAAM,UAAU,wBAAwB,WAAW,SAAS,GAAG,EAAE;AACjE,QAAM,UACJ,YAAY,eAAe,qBACvB,oBAAoB,cAAc,QAAQ,KAC1C,qBAAqB,WAAW,QAAQ;AAC9C,QAAM,UAAU;AAAA,IACd,eAAe,YAAY,UAAU;AAAA,IACrC,GAAI,cAAc,CAAC,YAAY,WAAW,EAAE,IAAI,CAAC;AAAA,IACjD,GAAI,QAAQ,CAAC,UAAU,KAAK,EAAE,IAAI,CAAC;AAAA,IACnC,GAAI,aAAa,CAAC,aAAa,UAAU,EAAE,IAAI,CAAC;AAAA,EAClD;AACA,QAAM,OACJ,YAAY,eAAe,qBACvB,eAAe,YAAY,WAAW,oBAAoB,mBAAmB,YAAY,QAAQ,CAAC,KAClG,eAAe,YAAY,WAAW;AAC5C,QAAM,OAAO,KAAK,SAAS,cAAc,KAAK,SAAS;AACvD,QAAM,OAAO,OAAO,IAAI,IAAI,MAAM,IAAI,EAAE,SAAS,IAAI;AACrD,QAAM,OAAO,IAAI,OAAO;AAAA,EAAM,OAAO;AAAA;AAAA,EAAO,QAAQ,KAAK,QAAK,CAAC,GAAG,OAAO;AAAA,EAAK,IAAI,KAAK,EAAE;AACzF,SAAO,KAAK,UAAU,0BAClB,OACA,GAAG,KAAK,MAAM,GAAG,0BAA0B,EAAE,CAAC;AAAA;AACpD;AAEA,IAAM,2BAA2B,oBAAI,IAAI;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,uCAAuC,oBAAI,IAAI;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,SAAS,4BAA4B,OAAgB;AAC1D,SACE,iBAAiB,yBAAyB,qCAAqC,IAAI,MAAM,IAAI;AAEjG;AAEA,SAAS,uBAAuB,OAAgB;AAC9C,MAAI,EAAE,iBAAiB,uBAAwB,QAAO;AACtD,MAAI,yBAAyB,IAAI,MAAM,IAAI,EAAG,QAAO;AACrD,QAAM,SAAS,iBAAiB,KAAK,MAAM,IAAI,IAAI,CAAC;AACpD,SAAO,SACH,OAAO,MAAM,KAAK,OAAO,OAAO,MAAM,IAAI,OAAO,WAAW,SAAS,WAAW,QAChF;AACN;AAEA,SAAS,gBAAgB,OAAgB,cAAsB;AAC7D,MAAI,iBAAiB,yBAAyB,MAAM,cAAc;AAChE,WAAO,KAAK,IAAI,KAAK,IAAI,MAAM,cAAc,GAAK,GAAG,qBAAqB;AAAA,EAC5E;AACA,SAAO,KAAK,IAAI,MAAQ,KAAK,KAAK,IAAI,GAAG,eAAe,CAAC,GAAG,qBAAqB;AACnF;AAEA,SAAS,kBAAkB,OAAgB;AACzC,MAAI,iBAAiB,sBAAuB,QAAO,MAAM,KAAK,MAAM,GAAG,GAAG;AAC1E,QAAM,MAAM,iBAAiB,QAAQ,MAAM,OAAO;AAClD,SACE,IACG,YAAY,EACZ,QAAQ,gBAAgB,GAAG,EAC3B,MAAM,GAAG,GAAG,KAAK;AAExB;AAEA,SAAS,wBAAwB,OAAgB,UAAkB;AACjE,SAAO,OAAO,UAAU,WACpB,gBAAgB,6BAA6B,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC,IACtE;AACN;AAEA,SAAS,gBAAgB,OAAe;AACtC,SAAO,MAAM,WAAW,KAAK,OAAO,EAAE,WAAW,KAAK,MAAM,EAAE,WAAW,KAAK,MAAM;AACtF;;;AChNA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;;;ACPP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP,SAAS,0BAAAE,+BAA6C;AAmB/C,IAAM,gCAAgC;AAE7C,IAAM,UAAU,oBAAI,IAAI,CAAC,aAAa,UAAU,SAAS,CAAC;AAI1D,IAAM,SAAS;AAEf,IAAM,6BAAqD;AAAA,EACzD,iCAAiC,oFAAoF,MAAM;AAAA,EAC3H,4BAA4B,gGAAgG,MAAM;AAAA,EAClI,6BAA6B,gFAAgF,MAAM;AAAA,EACnH,0BAA0B,gFAAgF,MAAM;AAAA,EAChH,yBAAyB,8EAA8E,MAAM;AAAA,EAC7G,6BAA6B,gFAAgF,MAAM;AACrH;AAEA,IAAM,yBAAiD;AAAA,EACrD,6BAA6B;AAAA,EAC7B,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,0BAA0B;AAAA,EAC1B,yBAAyB;AAAA,EACzB,qBAAqB;AACvB;AAGO,SAAS,wBACd,MACA,KACgB;AAChB,MAAI,IAAI,qBAAqB;AAC3B,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM,gHAAgH,MAAM;AAAA,IAC9H;AAAA,EACF;AACA,MAAI,IAAI,oBAAoB,CAAC,IAAI,iBAAiB,WAAW;AAC3D,UAAM,SAAS,IAAI,iBAAiB;AACpC,WAAO;AAAA,MACL;AAAA,MACA,MACE,2BAA2B,MAAM,KACjC,0CAA0C,MAAM,gBAAgB,MAAM;AAAA,IAC1E;AAAA,EACF;AACA,UAAQ,IAAI,OAAO;AAAA,IACjB,KAAK;AACH,aAAO;AAAA,QACL,QAAQ,IAAI;AAAA,QACZ,MAAM,mEAAmE,MAAM;AAAA,MACjF;AAAA,IACF,KAAK;AAEH,aAAO,KAAK,YAAY,wBACpB,OACA;AAAA,QACE,QAAQ,IAAI;AAAA,QACZ,MAAM,qIAAqI,MAAM;AAAA,MACnJ;AAAA,IACN,KAAK;AACH,aAAO;AAAA,QACL,QAAQ,IAAI;AAAA,QACZ,MAAM,iHAAiH,MAAM;AAAA,MAC/H;AAAA,IACF,KAAK;AACH,aAAO,EAAE,QAAQ,IAAI,OAAO,MAAM,2BAA2B,4BAA6B;AAAA,IAC5F;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,cAAc,QAAqD;AAC1E,QAAM,QAAQ,OAAO;AACrB,MAAI,OAAO,MAAM,CAAC,QAAQ,IAAI,UAAU,4BAA4B,GAAG;AACrE,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM,YAAY,KAAK;AAAA,IACzB;AAAA,EACF;AACA,QAAM,UAAU,OAAO,CAAC,GAAG;AAC3B,MACE,SAAS,aACT,OAAO;AAAA,IACL,CAAC,QAAQ,IAAI,kBAAkB,aAAa,IAAI,iBAAiB,WAAW,QAAQ;AAAA,EACtF,GACA;AACA,WAAO;AAAA,MACL,QAAQ,QAAQ;AAAA,MAChB,MAAM,YAAY,KAAK,wCACrB,uBAAuB,QAAQ,MAAM,KAAK,sBAAsB,QAAQ,MAAM,GAChF;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,OAAO,CAAC;AACvB,SAAO;AAAA,IACL,QAAQ,OAAO,SAAS,OAAO;AAAA,IAC/B,MAAM,YAAY,KAAK;AAAA,EACzB;AACF;AAEO,SAAS,8BAA8B,QAAwB;AACpE,SAAO,YAAY,MAAM;AAC3B;AAEA,SAAS,KAAK,MAAc,KAAqB;AAC/C,SAAO,KAAK,UAAU,MAAM,OAAO,GAAG,KAAK,MAAM,GAAG,MAAM,CAAC,EAAE,QAAQ,CAAC;AACxE;AAEA,SAAS,OACP,OACA,KACA,OACA,SACoE;AAGpE,QAAM,YACJ,IAAI,aACJ,MAAM,KAAK,qBACX,MAAM,KAAK,KAAK,CAAC,cAAc,UAAU,cAAc,IAAI,GAAG,aAC9D;AACF,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,MAAM,8BAA8B,MAAM,KAAK,EAAE;AACvD,QAAM,UAAU,iCAAiC,MAAM;AAAA,IACrD;AAAA,IACA,OAAO,UAAU,WAAW,2BAA2B;AAAA,IACvD,UAAU,KAAK,MAAM,KAAK,KAAK,KAAK,KAAK,kBAAkB,+BAA+B;AAAA,IAC1F,MACE,UAAU,WACN,GAAG,QAAQ,IAAI,+CACf,QAAQ;AAAA,IACd,SAAS;AAAA,IACT,UAAU;AAAA,EACZ,CAAC;AACD,SAAO,EAAE,WAAW,KAAK,QAAQ;AACnC;AAGO,SAAS,2BACd,OAC8B;AAC9B,QAAM,EAAE,MAAM,QAAQ,KAAK,IAAI;AAC/B,QAAM,UAAU,WAAW,QAAQ,OAAO,UAAU;AAGpD,MAAI,KAAK,QAAS,QAAO,UAAU,EAAE,MAAM,SAAS,eAAe,KAAK,IAAI,KAAK,IAAI;AACrF,MAAI,QAAQ,UAAU,YAAY,KAAK,WAAW,UAAU;AAC1D,WAAO,EAAE,MAAM,SAAS,eAAe,KAAK;AAAA,EAC9C;AACA,MAAI,QAAQ,UAAU,cAAc,KAAK,WAAW,UAAU;AAC5D,WAAO,EAAE,MAAM,SAAS,eAAe,KAAK;AAAA,EAC9C;AACA,MAAI,KAAK,WAAW,SAAU,QAAO,KAAK,IAAI;AAC9C,QAAM,SAAS,KAAK,CAAC;AACrB,MAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,OAAO,MAAM,KAAK,OAAO,OAAO,QAAQ,eAAe;AACjF,WAAO,KAAK,IAAI;AAAA,EAClB;AACA,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,QAAQ,UAAU,aACrB,EAAE,MAAM,SAAS,eAAe,OAAO,GAAG,IAC1C,KAAK,OAAO,EAAE;AAAA,EACpB;AAEA,QAAM,UAAU,CAAC,QAAiC,IAAI,aAAa,KAAK;AACxE,QAAM,OAAO,QAAQ,MAAM,IAAI,wBAAwB,MAAM,MAAM,IAAI;AACvE,MAAI,MAAM;AACR,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,cAAc,OAAO;AAAA,MACrB,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,QAAQ,OAAO,OAAO,QAAQ,UAAU,IAAI;AAAA,IAC9C;AAAA,EACF;AACA,MAAI,QAAQ,UAAU,WAAY,QAAO,KAAK,OAAO,EAAE;AACvD,QAAM,SAAoC,CAAC;AAC3C,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,QAAQ,IAAI,IAAI,MAAM,KAAK,IAAI,WAAW,eAAe,CAAC,QAAQ,GAAG,EAAG;AAC7E,WAAO,KAAK,GAAG;AAAA,EACjB;AACA,MAAI,OAAO,SAAS,8BAA+B,QAAO,KAAK,OAAO,EAAE;AACxE,QAAM,OAAO,cAAc,MAAM;AACjC,QAAM,QAAQ,OAAO,GAAG,EAAE;AAC1B,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,cAAc,MAAM;AAAA,IACpB,cAAc,MAAM;AAAA,IACpB,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO,OAAO,QAAQ,YAAY,IAAI;AAAA,EAChD;AACF;AAEA,SAAS,KAAK,eAA4D;AACxE,SAAO,EAAE,MAAM,QAAQ,cAAc;AACvC;AAQA,SAAS,eAAe,OAAyB;AAC/C,SAAO,iBAAiB,SAAS,wBAAwB,KAAK,MAAM,OAAO;AAC7E;AAGA,eAAsB,kCACpB,MACA,aACA,QACe;AACf,QAAM,UAAU,MAAM,qCAAqC,KAAK,IAAI,aAAa,MAAM;AACvF,MAAI,CAAC,QAAS;AACd,MAAI;AACF,UAAMA,wBAAuB,KAAK,IAAI,KAAK,KAAK,aAAa,QAAQ,WAAW;AAAA,MAC9E,QAAQ,YAAY,SAChB;AAAA,QACE,MAAM;AAAA,QACN,SAAS,iCAAiC,MAAM,QAAQ,OAAO;AAAA,MACjE,IACA;AAAA,QACE,MAAM;AAAA,QACN,SAAS,oCAAoC,MAAM,EAAE,KAAK,QAAQ,IAAI,CAAC;AAAA,MACzE;AAAA,IACN,CAAiD;AAAA,EACnD,SAAS,OAAO;AAEd,QAAI,CAAC,eAAe,KAAK,EAAG,OAAM;AAAA,EACpC;AACA,QAAM,iCAAiC,KAAK,IAAI,aAAa,QAAQ,OAAO;AAC9E;AAGA,eAAsB,oCAAoC,MAAmC;AAC3F,aAAW,aAAa,MAAM,gCAAgC,KAAK,EAAE,GAAG;AACtE,QAAI;AACF,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,UAAU;AAAA,QACV,UAAU;AAAA,QACV;AAAA,MACF;AACA,YAAM,kCAAkC,MAAM,UAAU,cAAc,UAAU,EAAE;AAAA,IACpF,SAAS,OAAO;AACd,WAAK,eAAe,MAAM,4CAA4C;AAAA,QACpE,QAAQ,UAAU;AAAA,QAClB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;AD/QA,eAAsB,iCAAiC,MAAmC;AACxF,aAAW,aAAa,MAAM,4BAA4B,KAAK,EAAE,GAAG;AAClE,UAAM,6BAA6B,KAAK,IAAI,UAAU,cAAc,UAAU,EAAE;AAAA,EAClF;AAGA,MAAI,KAAK,KAAK;AACZ,UAAM,oCAAoC;AAAA,MACxC,IAAI,KAAK;AAAA,MACT,KAAK,KAAK;AAAA,MACV,eAAe,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AACA,aAAW,WAAW,MAAM,yCAAyC,KAAK,EAAE,GAAG;AAC7E,QAAI;AAGF,YAAM,KAAK,KAAK;AAAA,QACd,IAAI,QAAQ;AAAA,QACZ,aAAa,QAAQ;AAAA,QACrB,oBAAoB,QAAQ;AAAA,MAC9B,CAAC;AACD,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,IACF,SAAS,OAAO;AACd,YAAM,yCAAyC,KAAK,IAAI,QAAQ,cAAc,QAAQ,EAAE;AACxF,WAAK,eAAe,MAAM,gDAAgD;AAAA,QACxE,QAAQ,QAAQ;AAAA,QAChB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,SAAS,gCACd,MACA,aAAa,KACQ;AACrB,MAAI,UAAU;AACd,MAAI;AACJ,QAAM,OAAO,MAAM;AACjB,QAAI,WAAW,QAAS;AACxB,cAAU,iCAAiC,IAAI,EAC5C,MAAM,CAAC,UAAmB;AACzB,WAAK,eAAe,MAAM,uCAAuC;AAAA,QAC/D,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH,CAAC,EACA,QAAQ,MAAM;AACb,gBAAU;AAAA,IACZ,CAAC;AAAA,EACL;AACA,QAAM,QAAQ,YAAY,MAAM,UAAU;AAC1C,iBAAe,IAAI;AACnB,SAAO,YAAY;AACjB,cAAU;AACV,kBAAc,KAAK;AACnB,UAAM;AAAA,EACR;AACF;;;AElFA,SAAS,wCAAuD;AAGhE,IAAM,eAAe;AACrB,IAAM,mBAAmB;AAsBlB,SAAS,mCAAmC,MAAwC;AACzF,QAAM,QAAQ,OACZ,oBACA,SAEA,KAAK,GAAG,YAAY,OAAO,OAAO;AAChC,UAAM,GAAG,QAAQ,wCAAwC,YAAY,SAAS;AAC9E,UAAM,GAAG,QAAQ;AAAA,2BACI,2BAA2B,kBAAkB,EAAE;AAAA,QAClE;AACF,WAAO,MAAM,KAAK,EAAE;AAAA,EACtB,CAAC;AAEH,SAAO;AAAA,IACL,MAAM,KACJ,MACA,WACA;AACA,YAAM,SAAS,MAAM,MAAM,KAAK,oBAAoB,OAAO,OAAO;AAChE,YAAI;AACF,gBAAM,KAAK,aAAa,KAAK,IAAI,IAAI,kBAAkB,YAAY;AACjE,kBAAM,UAAU,MAAM,iCAAiC,IAAI,KAAK,aAAa,KAAK,EAAE;AACpF,gBAAI,WAAW,QAAQ,uBAAuB,KAAK;AACjD,oBAAM,IAAI,MAAM,0CAA0C;AAC5D,gBAAI,CAAC,WAAW,QAAQ,cAAc,QAAQ,QAAQ,SAAS,SAAS,UAAU;AAChF,oBAAM,KAAK,OAAO,KAAK,kBAAkB;AACzC;AAAA,YACF;AACA,kBAAM,EAAE,WAAW,YAAY,GAAG,OAAO,IAAI;AAC7C,kBAAM,KAAK,OAAO,MAAM;AAAA,UAC1B,CAAC;AACD,iBAAO,EAAE,IAAI,KAAc;AAAA,QAC7B,SAAS,OAAO;AACd,iBAAO,EAAE,IAAI,OAAgB,OAAO,YAAY,MAAM,UAAU,IAAI,KAAK,IAAI,MAAM;AAAA,QACrF;AAAA,MACF,CAAC;AAGD,UAAI,CAAC,OAAO,GAAI,OAAM,OAAO;AAAA,IAC/B;AAAA,IACA,MAAM,OAAO,oBAA4B;AACvC,YAAM;AAAA,QAAM;AAAA,QAAoB,YAC9B,KAAK,aAAa,KAAK,IAAI,IAAI,kBAAkB,MAAM,KAAK,OAAO,kBAAkB,CAAC;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;;;ACzEA,SAAS,YAAY,kBAAkB;AACvC,SAAS,eAAwC;AAEjD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAOP,IAAM,mBAAmB;AACzB,IAAM,gBAAgB;AACtB,IAAM,eAAe;AACrB,IAAM,oBAAoB;AAW1B,IAAM,4BAA4B;AAMlC,eAAe,6BACb,IACA,YACsC;AACtC,QAAM,iBAAiB,oBAAI,IAA8B;AACzD,SAAO,MAAM,QAAQ;AAAA,IACnB,WAAW,IAAI,OAAO,aAAa;AACjC,UAAI,SAAS,QAAQ,cAAc,+BAAgC,QAAO;AAC1E,YAAM,MAAM,GAAG,SAAS,QAAQ,WAAW,IAAI,SAAS,QAAQ,SAAS;AACzE,UAAI,SAAS,eAAe,IAAI,GAAG;AACnC,UAAI,CAAC,QAAQ;AACX,iBAAS;AAAA,UACP;AAAA,UACA,SAAS,QAAQ;AAAA,UACjB,SAAS,QAAQ;AAAA,UACjB,EAAE,QAAQ,WAAW,OAAO,GAAG;AAAA,QACjC,EACG;AAAA,UAAK,CAAC,aACL,SAAS;AAAA,YAAK,CAAC,YACb,QAAQ,UAAU,KAAK,CAAC,aAAa,SAAS,SAAS,QAAQ;AAAA,UACjE;AAAA,QACF,EACC,MAAM,MAAM,KAAK;AACpB,uBAAe,IAAI,KAAK,MAAM;AAAA,MAChC;AACA,UAAI,CAAE,MAAM,OAAS,QAAO;AAC5B,YAAM,UAA6B,EAAE,GAAG,SAAS,SAAS,gBAAgB,KAAK;AAC/E,aAAO,EAAE,GAAG,UAAU,QAAQ;AAAA,IAChC,CAAC;AAAA,EACH;AACF;AAaO,SAAS,sBAAsB,UAA0B;AAC9D,SAAO,SACJ,QAAQ,+BAA+B,IAAI,EAC3C,QAAQ,sBAAsB,IAAI,EAClC,QAAQ,eAAe,IAAI,EAC3B,QAAQ,wBAAwB,SAAI,EACpC,QAAQ,YAAY,MAAM,EAC1B,KAAK;AACV;AAGO,SAAS,gBAAgB,SAI9B;AACA,MAAI,QAAQ,gBAAgB;AAE1B,WAAO,EAAE,OAAO,QAAQ,SAAS,4BAA4B,MAAM,0BAA0B;AAAA,EAC/F;AACA,QAAM,WACJ,QAAQ,SAAS,gBACb,wBACA,QAAQ,SAAS,WACf,kBACA,QAAQ,SAAS,gBACf,gBACA;AACV,QAAM,SAAS,QAAQ,SAAS,CAAC,GAC9B,MAAM,GAAG,CAAC,EACV,IAAI,CAAC,SAAS,GAAG,KAAK,KAAK,KAAK,KAAK,KAAK,EAAE,EAC5C,KAAK,IAAI;AACZ,QAAM,UAAU,QAAQ,OAAO,sBAAsB,QAAQ,IAAI,IAAI;AAGrE,QAAM,QAAQ,CAAC,YAAY,QAAQ,QAAQ,KAAK,SAAS,KAAK,EAAE,OAAO,OAAO;AAC9E,QAAM,OAAO,MAAM,KAAK,MAAM;AAC9B,SAAO;AAAA,IACL,OAAO,QAAQ,SAAS;AAAA,IACxB,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD,GAAI,QAAQ,QAAQ,SAAS,UAAU,EAAE,MAAM,QAAQ,SAAS,IAAI,CAAC;AAAA,EACvE;AACF;AASO,SAAS,4BACd,SAC6B;AAC7B,OACG,QAAQ,SAAS,WAAW,QAAQ,SAAS,kBAC9C,QAAQ,YAAY,kBACpB;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,eAAe,SAA+C;AAC5E,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,WAAW,QAAQ;AAAA,IACnB,MAAM,QAAQ;AAAA,IACd,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,IAC5D,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,EAC3D;AACF;AAMO,SAAS,mBACd,SAC2C;AAC3C,MAAI,QAAQ,eAAgB,QAAO;AACnC,MAAI,QAAQ,cAAc,yBAA0B,QAAO;AAC3D,MAAI,QAAQ,cAAc,+BAAgC,QAAO;AACjE,SAAO;AACT;AAEA,SAAS,UAAU,OAAgC;AACjD,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,WAAW;AAChD;AAEA,SAAS,QACP,QACA,QACA,YACA,WACQ;AACR,QAAM,WAAW,GAAG,UAAU,KAAK,UAAU,MAAM,CAAC,CAAC,IAAI,UAAU,KAAK,UAAU,MAAM,CAAC,CAAC;AAC1F,QAAM,SAAS,WAAW,QAAQ;AAClC,SAAO,OAAO,QAAQ;AACtB,QAAM,YACJ,cAAc,UACV,OAAO,KAAK,EAAE,KAAK,YAAY,aAAa,aAAa,CAAC,IAC1D,OAAO,KAAK,UAAU;AAC5B,SAAO,GAAG,QAAQ,IAAI,UAAU,SAAS,CAAC;AAC5C;AAEA,SAAS,IAAI,OAAuB;AAClC,SAAO,MAAM,SAAS,KAAK,IAAI,MAAM,QAAQ,SAAS,IAAI,IAAI;AAChE;AAGO,SAAS,iBAAiB,OAIZ;AACnB,QAAM,MAAM,IAAI,MAAM,UAAU;AAChC,MAAI,QAAoD;AACxD,QAAM,WAAW,oBAAI,IAAgC;AACrD,QAAM,SAAS,MAAM;AACnB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,QAAI,CAAC,SAAS,MAAM,MAAM,WAAW,KAAK,IAAI;AAC5C,cAAQ;AAAA,QACN,OAAO;AAAA,UACL,EAAE,KAAK,SAAS,KAAK,MAAM,MAAM;AAAA,UACjC,EAAE,KAAK,MAAM,QAAQ,KAAK,IAAI;AAAA,UAC9B;AAAA,UACA;AAAA,QACF;AAAA,QACA,UAAU;AAAA,MACZ;AAAA,IACF;AACA,WAAO,MAAM;AAAA,EACf;AACA,QAAM,UAAU,CAAC,SAAiB;AAChC,UAAM,WAAW,SAAS,IAAI,IAAI;AAClC,QAAI,YAAY,CAAC,SAAS,UAAU,CAAC,SAAS,UAAW,QAAO;AAChE,UAAM,UAAU,QAAQ,WAAW,IAAI,EAAE;AACzC,YAAQ,GAAG,SAAS,MAAM,SAAS,OAAO,IAAI,CAAC;AAC/C,YAAQ,GAAG,SAAS,MAAM,SAAS,OAAO,IAAI,CAAC;AAC/C,aAAS,IAAI,MAAM,OAAO;AAC1B,WAAO;AAAA,EACT;AACA,SAAO,OAAO,aAAa;AACzB,UAAM,OACJ,SAAS,gBAAgB,gBAAgB,+BAA+B;AAC1E,UAAM,QAAQ,gBAAgB,SAAS,OAAO;AAC9C,UAAM,WAAW,mBAAmB,SAAS,OAAO;AACpD,UAAM,OAAO,KAAK,UAAU;AAAA,MAC1B,KAAK;AAAA,QACH;AAAA,QACA,OAAO;AAAA,QACP,aAAa,SAAS,QAAQ;AAAA,QAC9B,sBAAsB,4BAA4B,SAAS,OAAO;AAAA,QAClE,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACjC;AAAA,MACA,MAAM,eAAe,SAAS,OAAO;AAAA,IACvC,CAAC;AACD,WAAO,MAAM,IAAI,QAA8B,CAAC,YAAY;AAC1D,YAAM,UAAU,QAAQ,IAAI,EAAE,QAAQ;AAAA,QACpC,WAAW;AAAA,QACX,SAAS,aAAa,SAAS,KAAK;AAAA,QACpC,eAAe,UAAU,OAAO,CAAC;AAAA,QACjC,cAAc,SAAS;AAAA,QACvB,kBAAkB;AAAA,QAClB,iBAAiB;AAAA,QACjB,oBAAoB,GAAG,SAAS,QAAQ,SAAS,IAAI,SAAS,QAAQ,IAAI,GAAG,MAAM,GAAG,EAAE;AAAA,QACxF,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,SAAS;AACb,UAAI,OAAO;AACX,cAAQ,WAAW,KAAQ,MAAM,QAAQ,MAAM,CAAC;AAChD,cAAQ,GAAG,YAAY,CAAC,YAAY;AAClC,iBAAS,OAAO,QAAQ,SAAS,KAAK,CAAC;AAAA,MACzC,CAAC;AACD,cAAQ,GAAG,QAAQ,CAAC,UAAkB;AACpC,gBAAQ,MAAM,SAAS,MAAM;AAAA,MAC/B,CAAC;AACD,cAAQ,GAAG,SAAS,CAAC,UAAU,QAAQ,EAAE,SAAS,SAAS,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC;AAClF,cAAQ,GAAG,SAAS,MAAM;AACxB,YAAI,WAAW,IAAK,QAAO,QAAQ,EAAE,SAAS,YAAY,CAAC;AAC3D,cAAM,UAAU,MAAM;AACpB,cAAI;AACF,mBAAQ,KAAK,MAAM,IAAI,EAA0B,UAAU;AAAA,UAC7D,QAAQ;AACN,mBAAO,QAAQ,UAAU,MAAM;AAAA,UACjC;AAAA,QACF,GAAG;AACH,YAAI,WAAW,OAAO,WAAW,oBAAoB,WAAW,gBAAgB;AAC9E,iBAAO,QAAQ,EAAE,SAAS,gBAAgB,OAAO,GAAG,MAAM,IAAI,MAAM,GAAG,CAAC;AAAA,QAC1E;AACA,gBAAQ;AAAA,UACN,SAAS,WAAW,OAAO,UAAU,OAAO,WAAW,IAAI,UAAU;AAAA,UACrE,OAAO,GAAG,MAAM,IAAI,MAAM;AAAA,QAC5B,CAAC;AAAA,MACH,CAAC;AACD,cAAQ,IAAI,IAAI;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAGO,SAAS,gBAAgB,OAGX;AACnB,QAAM,UAAU,KAAK,MAAM,MAAM,kBAAkB;AAMnD,QAAM,OAAO,MAAM,SAAS;AAC5B,MAAI,SAAsD;AAC1D,QAAM,cAAc,YAAY;AAC9B,QAAI,UAAU,OAAO,YAAY,MAAS,KAAK,IAAI,EAAG,QAAO,OAAO;AACpE,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,UAAM,WAAW,QAAQ,aAAa;AACtC,UAAM,YAAY;AAAA,MAChB,EAAE,KAAK,SAAS,KAAK,MAAM;AAAA,MAC3B;AAAA,QACE,KAAK,QAAQ;AAAA,QACb,OAAO;AAAA,QACP,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK,MAAM;AAAA,MACb;AAAA,MACA,IAAI,QAAQ,WAAW;AAAA,MACvB;AAAA,IACF;AACA,UAAM,WAAW,MAAM,KAAK,UAAU;AAAA,MACpC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,8BAA8B,SAAS,MAAM,EAAE;AACjF,UAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,aAAS,EAAE,OAAO,KAAK,cAAc,WAAW,KAAK,IAAI,IAAI,KAAK,aAAa,IAAK;AACpF,WAAO,OAAO;AAAA,EAChB;AACA,SAAO,OAAO,aAAa;AACzB,QAAI;AACF,YAAM,QAAQ,gBAAgB,SAAS,OAAO;AAC9C,YAAM,WAAW,MAAM;AAAA,QACrB,0CAA0C,QAAQ,UAAU;AAAA,QAC5D;AAAA,UACE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,eAAe,UAAU,MAAM,YAAY,CAAC;AAAA,YAC5C,gBAAgB;AAAA,UAClB;AAAA,UACA,MAAM,KAAK,UAAU;AAAA,YACnB,SAAS;AAAA,cACP,OAAO,SAAS;AAAA,cAChB,SAAS,EAAE,UAAU,QAAQ,cAAc,SAAS,QAAQ,UAAU;AAAA,cACtE,MAAM;AAAA,gBACJ,OAAO,MAAM;AAAA,gBACb,SAAS,CAAC,MAAM,UAAU,MAAM,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI,KAAK,MAAM;AAAA,gBAC1E,MAAM,KAAK,UAAU,eAAe,SAAS,OAAO,CAAC;AAAA,cACvD;AAAA,YACF;AAAA,UACF,CAAC;AAAA,UACD,QAAQ,YAAY,QAAQ,GAAM;AAAA,QACpC;AAAA,MACF;AACA,UAAI,SAAS,GAAI,QAAO,EAAE,SAAS,YAAY;AAC/C,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAI,SAAS,WAAW,OAAO,KAAK,SAAS,cAAc,GAAG;AAC5D,eAAO,EAAE,SAAS,gBAAgB,OAAO,GAAG,SAAS,MAAM,IAAI,KAAK,MAAM,GAAG,GAAG,CAAC,GAAG;AAAA,MACtF;AACA,aAAO;AAAA,QACL,SAAS,SAAS,WAAW,OAAO,SAAS,UAAU,MAAM,UAAU;AAAA,QACvE,OAAO,GAAG,SAAS,MAAM,IAAI,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,MACjD;AAAA,IACF,SAAS,OAAO;AACd,aAAO,EAAE,SAAS,SAAS,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE;AAAA,IAChE;AAAA,EACF;AACF;AAGO,SAAS,4BACd,UACsD;AACtD,QAAM,UAAgE,CAAC;AACvE,MAAI,SAAS,aAAa,SAAS,cAAc,SAAS,gBAAgB;AACxE,YAAQ,MAAM,iBAAiB;AAAA,MAC7B,OAAO,SAAS;AAAA,MAChB,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS;AAAA,IACvB,CAAC;AAAA,EACH;AACA,MAAI,SAAS,uBAAuB;AAClC,YAAQ,UAAU,gBAAgB,EAAE,oBAAoB,SAAS,sBAAsB,CAAC;AAAA,EAC1F;AACA,SAAO;AACT;AAEA,eAAsB,0BACpB,MACiD;AACjD,QAAM,UAAU,KAAK,WAAW,4BAA4B,KAAK,QAAQ;AACzE,QAAM,UAAU,WAAW;AAC3B,QAAM,UAAU,MAAM;AAAA,IACpB,KAAK;AAAA,IACL,MAAM,0BAA0B,KAAK,IAAI;AAAA,MACvC;AAAA,MACA,OAAO;AAAA,MACP,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AACA,MAAI,YAAY;AAChB,QAAM,QAAQ;AAAA,IACZ,QAAQ,IAAI,OAAO,aAAa;AAC9B,YAAM,SAAS,QAAQ,SAAS,QAAQ;AACxC,YAAM,SAA+B,SACjC,MAAM,OAAO,QAAQ,EAAE,MAAM,CAAC,WAAoB;AAAA,QAChD,SAAS;AAAA,QACT,OAAO,OAAO,KAAK;AAAA,MACrB,EAAE,IACF,EAAE,SAAS,UAAU,OAAO,MAAM,SAAS,QAAQ,+BAA+B;AACtF,YAAM,UACJ,OAAO,YAAY,WAAW,SAAS,YAAY,eAAe,WAAW,OAAO;AACtF,UAAI,YAAY,YAAa,cAAa;AAAA;AAExC,aAAK,eAAe,KAAK,6BAA6B;AAAA,UACpD,UAAU,SAAS;AAAA,UACnB;AAAA,UACA,OAAO,OAAO;AAAA,QAChB,CAAC;AACH,YAAM,yBAAyB,KAAK,IAAI;AAAA,QACtC;AAAA,QACA,YAAY,SAAS;AAAA,QACrB;AAAA,QACA,OAAO,OAAO,SAAS;AAAA,QACvB,cAAc,KAAK,IAAI,MAAM,IAAI,KAAK,SAAS,QAAQ;AAAA,MACzD,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AACA,SAAO,EAAE,SAAS,QAAQ,QAAQ,UAAU;AAC9C;AAEO,SAAS,4BAA4B,MAAmD;AAC7F,QAAM,UAAU,KAAK,WAAW,4BAA4B,KAAK,QAAQ;AACzE,MAAI,UAAU;AACd,MAAI,QAAQ;AACZ,MAAI,UAAgC;AACpC,QAAM,OAAO,YAAY;AACvB,aAAS;AACT,QAAI;AACF,YAAM,EAAE,QAAQ,IAAI,MAAM,0BAA0B,EAAE,GAAG,MAAM,QAAQ,CAAC;AACxE,UAAI,UAAU,EAAG,MAAK,eAAe,KAAK,qBAAqB,EAAE,QAAQ,CAAC;AAC1E,UAAI,QAAQ,sBAAsB,EAAG,OAAM,0BAA0B,KAAK,EAAE;AAAA,IAC9E,SAAS,OAAO;AACd,WAAK,eAAe,MAAM,+BAA+B,EAAE,OAAO,OAAO,KAAK,EAAE,CAAC;AAAA,IACnF;AAAA,EACF;AACA,QAAM,QAAQ,YAAY,MAAM;AAC9B,QAAI,WAAW,QAAS;AACxB,cAAU,KAAK,EAAE,QAAQ,MAAM;AAC7B,gBAAU;AAAA,IACZ,CAAC;AAAA,EACH,GAAG,gBAAgB;AACnB,SAAO,YAAY;AACjB,cAAU;AACV,kBAAc,KAAK;AACnB,UAAM;AAAA,EACR;AACF;;;ACxcA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,sCAAqD;AAC9D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,mBAAmB;AAE5B,SAAS,oCAAoC;AAEtC,IAAM,wCAAwC;AACrD,IAAMC,iBAAgB;AACtB,IAAMC,oBAAmB;AACzB,IAAM,sBAAsB;AAC5B,IAAMC,qBAAoB;AAY1B,SAAS,UAAU,OAAwB;AACzC,MAAI,iBAAiB,OAAO;AAC1B,QAAI,MAAM,SAAS,kBAAkB,MAAM,SAAS,aAAc,QAAO;AACzE,WAAO,GAAG,MAAM,IAAI,KAAK,MAAM,OAAO,GAAG,MAAM,GAAG,GAAG;AAAA,EACvD;AACA,SAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG;AACnC;AAEA,eAAe,WACb,MACA,KACA,SACA,UACA,eAAe,OACkB;AACjC,MAAI,SAAwB;AAC5B,MAAI,QAAuB;AAC3B,MAAI;AACF,UAAM,OAAO,KAAK,UAAU,SAAS,OAAO;AAC5C,UAAM,SAAS,wBAAwB,KAAK,SAAS,eAAe;AACpE,UAAM,WAAW,OAAO,KAAK,SAAS;AAAA,MACpC,SAAS;AAAA,MACT;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,cAAc;AAAA,UACd,CAAC,yBAAyB,GAAG,MAAM,oBAAoB,QAAQ,IAAI;AAAA,UACnE,CAAC,wBAAwB,GAAG,SAAS;AAAA,UACrC,CAAC,2BAA2B,GAAG,SAAS;AAAA,QAC1C;AAAA,QACA;AAAA,QACA,QAAQ,YAAY,QAAQ,mBAAmB;AAAA,MACjD;AAAA,MACA,KAAK;AAAA,MACL;AAAA,QACE,OAAO,eAAe,yBAAyB;AAAA,QAC/C,8BAA8B;AAAA,MAChC;AAAA,IACF;AACA,aAAS,SAAS;AAClB,UAAM,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AACnD,QAAI,SAAS,OAAO,UAAU,IAAK,SAAQ,QAAQ,MAAM;AAAA,EAC3D,SAAS,QAAQ;AACf,YAAQ,UAAU,MAAM;AAAA,EAC1B;AACA,SAAO,eAAe,oCAAoC;AAAA,IACxD,KAAK;AAAA,IACL;AAAA,MACE,YAAY,SAAS;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,UAAU,OAAO,cAAc;AACxC;AAUA,eAAe,yBAAyB,MAAmD;AACzF,QAAM,OAAO,KAAK,eAAe,mBAAmB,KAAK,gBAAgB;AACzE,QAAM,UAAU;AAChB,MAAI;AACF,UAAM,SAAS,MAAM,2BAA2B,KAAK,EAAE;AACvD,iCAA6B,SAAS,UAAU,YAAY,OAAO,SAAS;AAC5E,iCAA6B,SAAS,UAAU,iBAAiB,OAAO,MAAM;AAC9E,iCAA6B,SAAS,eAAe,iBAAiB,OAAO,YAAY;AACzF,QAAI,OAAO,SAAS,GAAG;AACrB,WAAK,eAAe,KAAK,2CAA2C;AAAA,QAClE,QAAQ,OAAO;AAAA,QACf,WAAW,KAAK,UAAU,OAAO,MAAM;AAAA,MACzC,CAAC;AAAA,IACH;AAAA,EACF,SAAS,OAAO;AACd,iCAA6B,SAAS,UAAU,eAAe;AAC/D,SAAK,eAAe,KAAK,qCAAqC,EAAE,OAAO,UAAU,KAAK,EAAE,CAAC;AAAA,EAC3F;AACF;AAGA,eAAsB,gCACpB,MACsC;AAItC,QAAM,yBAAyB,IAAI;AAGnC,QAAM,4BAA4B,KAAK,EAAE;AACzC,QAAM,MAAM,+BAA+B,KAAK,QAAQ;AACxD,MAAI,CAAC,IAAK,QAAO,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,EAAE;AACvD,QAAM,UAAUH,YAAW;AAC3B,QAAM,SAAS,MAAM,gCAAgC,KAAK,IAAI;AAAA,IAC5D;AAAA,IACA,OAAO;AAAA,IACP,cAAcC;AAAA,EAChB,CAAC;AAGD,QAAM,qBAAqB,MAAM,mCAAmC,KAAK,IAAI;AAAA,IAC3E;AAAA,IACA,OAAO;AAAA,IACP,cAAcA;AAAA,EAChB,CAAC;AACD,QAAM,WAAW,MAAM,QAAQ;AAAA,IAC7B;AAAA,MACE,GAAG,OAAO,IAAI,CAAC,cAAc,EAAE,UAAU,cAAc,MAAM,EAAE;AAAA,MAC/D,GAAG,mBAAmB,IAAI,CAAC,cAAc,EAAE,UAAU,cAAc,KAAK,EAAE;AAAA,IAC5E,EAAE,IAAI,OAAO,EAAE,UAAU,aAAa,MAAM;AAC1C,UAAI;AACF,eAAO,MAAM,WAAW,MAAM,KAAK,SAAS,UAAU,YAAY;AAAA,MACpE,SAAS,OAAO;AACd,aAAK,eAAe,KAAK,uCAAuC;AAAA,UAC9D,YAAY,SAAS;AAAA,UACrB,OAAO,UAAU,KAAK;AAAA,QACxB,CAAC;AACD,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,SAAS,OAAO,SAAS,mBAAmB;AAAA,IAC5C,WAAW,SAAS,OAAO,CAAC,YAAY,YAAY,WAAW,EAAE;AAAA,IACjE,QAAQ,SAAS,OAAO,CAAC,YAAY,YAAY,QAAQ,EAAE;AAAA,EAC7D;AACF;AAMO,SAAS,kCACd,MACA,UAGI,CAAC,GACgB;AACrB,QAAM,aAAa,KAAK,IAAI,KAAK,QAAQ,cAAcC,iBAAgB;AACvE,QAAM,QAAQ,QAAQ,SAAS;AAC/B,MAAI,UAAU;AACd,MAAI;AACJ,MAAI,QAAQ;AAEZ,QAAM,OAAO,MAAY;AACvB,QAAI,WAAW,QAAS;AACxB,aAAS;AAET,QAAI,UAAU;AACd,eAAW,YAAY;AACrB,YAAM,SAAS,MAAM,MAAM,IAAI;AAC/B,gBAAU,OAAO,WAAW;AAC5B,UAAI,OAAO,UAAU,EAAG,MAAK,eAAe,KAAK,mCAAmC,MAAM;AAC1F,UAAI,QAAQC,uBAAsB,GAAG;AACnC,cAAM,gCAAgC,KAAK,EAAE;AAC7C,cAAM,mCAAmC,KAAK,EAAE;AAAA,MAClD;AAAA,IACF,GAAG,EACA,MAAM,CAAC,UAAmB;AACzB,WAAK,eAAe,MAAM,qCAAqC,EAAE,OAAO,UAAU,KAAK,EAAE,CAAC;AAAA,IAC5F,CAAC,EACA,QAAQ,MAAM;AACb,gBAAU;AACV,UAAI,WAAW,CAAC,QAAS,gBAAe,IAAI;AAAA,IAC9C,CAAC;AAAA,EACL;AAEA,QAAM,QAAQ,YAAY,MAAM,UAAU;AAC1C,iBAAe,IAAI;AAEnB,SAAO,YAAY;AACjB,cAAU;AACV,kBAAc,KAAK;AACnB,UAAM;AAAA,EACR;AACF;;;AChOA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAOK;AAOA,IAAM,wCAAwC;AAC9C,IAAM,4CAA4C;AAClD,IAAM,qDAAqD,IAAI,OAAO,OAAO,KAAK;AAEzF,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB,KAAK,OAAO;AAY9B,IAAM,qCAAN,MAAyC;AAAA,EAG9C,YACmB,aACA,wBACjB;AAFiB;AACA;AAEjB,SAAK,YAAY,OAAO,OAAO;AAAA,MAC7B,MAAM,CAAC,WAAW,OAAO,KAAK,OAAO,MAAM;AAAA,MAC3C,SAAS,CAAC,QAAQ,YAAY,OAAO,KAAK,QAAQ,OAAO;AAAA,MACzD,OAAO,CAAC,WAAW,OAAO,KAAK,gBAAgB;AAAA,IACjD,CAAC;AAAA,EACH;AAAA,EAXS;AAAA,EAaT,QAAQ,SAA2B;AACjC,WAAO,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa;AAAA,EAC3C;AAAA,EAEA,QAAQ,SAAkB,QAAsE;AAC9F,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAI,IAAI,aAAa,sCAAuC,QAAO;AACnE,QAAI,QAAQ,WAAW,OAAO;AAC5B,aAAO,IAAI,SAAS,sBAAsB;AAAA,QACxC,QAAQ;AAAA,QACR,SAAS,EAAE,OAAO,MAAM;AAAA,MAC1B,CAAC;AAAA,IACH;AACA,QAAI,CAAC,KAAK,YAAa,QAAO,IAAI,SAAS,uBAAuB,EAAE,QAAQ,IAAI,CAAC;AACjF,QAAI,CAAC,gBAAgB,QAAQ,QAAQ,IAAI,wBAAwB,CAAC,GAAG;AACnE,aAAO,IAAI,SAAS,+BAA+B,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpE;AACA,UAAM,aAAa,IAAI;AAAA,MACrB,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AACA,UAAM,WAAW,OAAO,QAAQ,SAAS;AAAA,MACvC,MAAM;AAAA,MACN,SAAS;AAAA,QACP,0BAA0B;AAAA,MAC5B;AAAA,IACF,CAAC;AACD,WAAO,WAAW,SAAY,IAAI,SAAS,eAAe,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AACF;AAGO,IAAM,sCAAN,MAEP;AAAA,EAQE,YACmB,aACA,wBACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAVK,SAA+C;AAAA,EAC/C,UAA8C;AAAA,EAC9C,OAAsB,QAAQ,QAAQ;AAAA,EACtC,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,WAAW;AAAA,EAOnB,OAAO,QAA6C;AAClD,QAAI,KAAK,UAAU,KAAK,UAAU;AAChC,aAAO,MAAM,MAAM,0BAA0B;AAC7C;AAAA,IACF;AACA,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,QAAQ,SAAkD;AACxD,QAAI,KAAK,SAAU;AACnB,QAAI,OAAO,YAAY,UAAU;AAC/B,WAAK,KAAK,KAAK,eAAe;AAC9B;AAAA,IACF;AACA,UAAM,aAAa,QAAQ;AAC3B,QACE,eAAe,KACf,aAAa,sDACb,KAAK,iBAAiB,IAAI,uBAC1B,KAAK,cAAc,aAAa,kBAChC;AACA,WAAK,KAAK;AAAA,QACR,aAAa,qDACT,oBACA;AAAA,MACN;AACA;AAAA,IACF;AACA,UAAM,QACJ,mBAAmB,aAAa,WAAW,KAAK,OAAO,IAAI,IAAI,WAAW,OAAO,EAAE,MAAM;AAC3F,SAAK,kBAAkB;AACvB,SAAK,eAAe,MAAM;AAC1B,UAAM,MAAM,KAAK,KAAK,KAAK,YAAY;AACrC,UAAI;AACF,cAAM,KAAK,QAAQ,KAAK;AAAA,MAC1B,UAAE;AACA,aAAK,kBAAkB;AACvB,aAAK,eAAe,MAAM;AAAA,MAC5B;AAAA,IACF,CAAC;AACD,SAAK,OAAO,IAAI,MAAM,OAAO,UAAmB;AAC9C,YAAM,KAAK,cAAc,KAAK;AAAA,IAChC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,KAAK,OAAuD;AAChE,QAAI,KAAK,YAAY,CAAC,KAAK,QAAQ;AACjC,YAAM,IAAI,0BAA0B,UAAU,oCAAoC;AAAA,IACpF;AACA,UAAM,QAAQ,0CAA0C,KAAK;AAC7D,QAAI,MAAM,aAAa,oDAAoD;AACzE,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,EAAE,kBAAkB,KAAK;AAAA,MAC3B;AAAA,IACF;AACA,UAAM,WAAW,KAAK,OAAO,KAAK,OAAO,KAAK;AAC9C,QAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,YAAY,GAAG;AACpD,YAAM,IAAI,0BAA0B,UAAU,yCAAyC;AAAA,IACzF;AAAA,EACF;AAAA,EAEA,gBAAwB;AACtB,UAAM,WAAW,KAAK,QAAQ,oBAAoB,KAAK,KAAK,QAAQ,kBAAkB;AACtF,WAAO,OAAO,cAAc,QAAQ,KAAK,YAAY,IAAI,WAAW,OAAO;AAAA,EAC7E;AAAA,EAEA,MAAM,OAAwC;AAC5C,QAAI,KAAK,SAAU;AACnB,SAAK,WAAW;AAChB,SAAK,QAAQ,MAAM,UAAU,MAAM,MAAM,GAAG,MAAM,MAAM;AAAA,EAC1D;AAAA,EAEA,kBAAwB;AACtB,QAAI,KAAK,SAAU;AACnB,SAAK,WAAW;AAChB,SAAK,KAAK,SAAS,MAAM,iBAAiB;AAAA,EAC5C;AAAA,EAEA,MAAc,QAAQ,OAAkC;AACtD,QAAI,KAAK,SAAU;AACnB,UAAM,QAAQ,0CAA0C,KAAK;AAC7D,QAAI,CAAC,KAAK,SAAS;AACjB,UAAI,MAAM,SAAS,QAAQ;AACzB,cAAM,IAAI,0BAA0B,iBAAiB,iCAAiC;AAAA,MACxF;AACA,YAAM,UAAU,MAAM,KAAK,YAAY,SAAS;AAAA,QAC9C,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB,iBAAiB,MAAM;AAAA,QACvB,QAAQ,MAAM;AAAA,QACd,MAAM;AAAA,QACN,GAAI,KAAK,yBACL,EAAE,wBAAwB,KAAK,uBAAuB,IACtD,CAAC;AAAA,MACP,CAAC;AACD,UAAI,KAAK,UAAU;AACjB,cAAM,QAAQ,MAAM,iBAAiB;AACrC;AAAA,MACF;AACA,WAAK,UAAU;AACf,WAAK,QAAQ,OAAO,KAAK,MAAM;AAC7B,YAAI,CAAC,KAAK;AACR,eAAK,MAAM;AAAA,YACT,QAAQ;AAAA,YACR,WAAW;AAAA,YACX,kBAAkB;AAAA,UACpB,CAAC;AAAA,MACL,CAAC;AACD;AAAA,IACF;AACA,QAAI,MAAM,SAAS,QAAQ;AACzB,YAAM,IAAI,0BAA0B,iBAAiB,wBAAwB;AAAA,IAC/E;AACA,QACE,MAAM,eAAe,KAAK,QAAQ,cAClC,MAAM,gBAAgB,KAAK,QAAQ,aACnC;AACA,YAAM,IAAI,0BAA0B,eAAe,wCAAwC;AAAA,IAC7F;AACA,QAAI,MAAM,SAAS,WAAW;AAC5B,YAAM,KAAK,QAAQ,YAAY,KAAK;AACpC;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,QAAQ,aAAa,KAAK;AAAA,IACjD,SAAS,OAAO;AACd,YAAM,KAAK,KAAK;AAAA,QACd,MAAM;AAAA,QACN,iBAAiB,MAAM;AAAA,QACvB,YAAY,MAAM;AAAA,QAClB,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB,GAAG,gBAAgB,KAAK;AAAA,MAC1B,CAAC;AACD;AAAA,IACF;AAKA,UAAM,KAAK,KAAK;AAAA,MACd,MAAM;AAAA,MACN,iBAAiB,MAAM;AAAA,MACvB,YAAY,MAAM;AAAA,MAClB,aAAa,MAAM;AAAA,MACnB,aAAa,QAAQ;AAAA,IACvB,CAAC;AACD,UAAM,KAAK,KAAK;AAAA,MACd,MAAM;AAAA,MACN,iBAAiB,MAAM;AAAA,MACvB,YAAY,MAAM;AAAA,MAClB,aAAa,MAAM;AAAA,MACnB,aAAa,QAAQ;AAAA,MACrB,qBAAqB,QAAQ;AAAA,MAC7B,eAAe,QAAQ,YAAY;AAAA,MACnC,eAAe,QAAQ,YAAY;AAAA,MACnC,aAAa,QAAQ,YAAY;AAAA,MACjC,WAAW,QAAQ,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,cAAc,OAA+B;AACzD,QAAI,KAAK,SAAU;AACnB,QAAI,iBAAiB,2BAA2B;AAC9C,YAAM,KAAK,KAAK,MAAM,SAAS,mBAAmB,oBAAoB,MAAM,IAAI;AAChF;AAAA,IACF;AACA,UAAM,KAAK,KAAK,iBAAiB;AAAA,EACnC;AAAA,EAEA,MAAc,KAAK,QAA4E;AAC7F,QAAI,KAAK,SAAU;AACnB,SAAK,WAAW;AAChB,UAAM,KAAK,SAAS,MAAM,MAAM,EAAE,MAAM,MAAM,MAAS;AACvD,SAAK,QAAQ,MAAM,UAAU,UAAU,iBAAiB,GAAG,UAAU,iBAAiB;AAAA,EACxF;AACF;AAEA,SAAS,gBAAgB,OAGtB;AACD,MAAI,iBAAiB,6BAA6B;AAChD,QAAI,MAAM,SAAS,YAAa,QAAO,EAAE,MAAM,aAAa,WAAW,MAAM;AAC7E,QAAI,CAAC,mBAAmB,yBAAyB,qBAAqB,EAAE,SAAS,MAAM,IAAI,GAAG;AAC5F,aAAO,EAAE,MAAM,mBAAmB,WAAW,MAAM;AAAA,IACrD;AACA,QAAI,MAAM,SAAS,6BAA6B;AAC9C,aAAO,EAAE,MAAM,eAAe,WAAW,MAAM;AAAA,IACjD;AACA,QAAI,CAAC,sBAAsB,uBAAuB,EAAE,SAAS,MAAM,IAAI,GAAG;AACxE,aAAO,EAAE,MAAM,YAAY,WAAW,KAAK;AAAA,IAC7C;AACA,WAAO,EAAE,MAAM,YAAY,WAAW,MAAM;AAAA,EAC9C;AACA,MAAI,iBAAiB,6BAA6B,MAAM,SAAS,sBAAsB;AACrF,WAAO,EAAE,MAAM,aAAa,WAAW,MAAM;AAAA,EAC/C;AACA,SAAO,EAAE,MAAM,eAAe,WAAW,KAAK;AAChD;AAEA,SAAS,gBAAgB,OAA+B;AACtD,SACE,OACI,MAAM,GAAG,EACV,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,SAAS,yCAAyC,KAAK;AAE9D;AAEA,SAAS,UAAU,QAAwB;AACzC,MAAI,WAAW,qBAAsB,QAAO;AAC5C,MAAI,WAAW,oBAAoB,WAAW,kBAAmB,QAAO;AACxE,MAAI,WAAW,oBAAqB,QAAO;AAC3C,MAAI,WAAW,iBAAiB,WAAW,kBAAmB,QAAO;AACrE,MAAI,WAAW,SAAU,QAAO;AAChC,SAAO;AACT;;;AC5TA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKA,SAAS,wCACd,MACsE;AACtE,SAAO,OAAO,QAAQ,YAAY,aAAa,WAAW;AACxD,YAAQ,eAAe;AACvB,UAAM,YAAY,OAAO;AACzB,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,EAAE,MAAM,IAAI;AAClB,UAAM,WAAW,eAAe,SAAS,sBAAsB;AAC/D,QACE,CAAC,cAAc,MAAM,aAAa,QAAQ,KAC1C,CAAC,cAAc,MAAM,aAAa,eAAe,GACjD;AACA,aAAO;AAAA,IACT;AAEA,QAAI,MAAM,UAAU,iBAAiB,CAAC,UAAU,qBAAsB,QAAO;AAC7E,QAAI;AACF,YAAM,aAAa,cAAc,EAAE,GAAG,MAAM,IAAI,YAAY,IAAI;AAGhE,UAAI,aAAa;AACf,cAAM,yCAAyC,aAAa,OAAO,MAAM,SAAS;AAClF,gBAAQ,eAAe;AAEvB,cAAM,YAAY,QAAQ;AAAA,6BACL,mBAAmB,OAAO,MAAM,WAAW,EAAE,OAAO;AACzE,gBAAQ,eAAe;AAAA,MACzB;AACA,aAAO,MAAM,iCAAiC,YAAY,OAAO,YAAY;AAC3E,eAAO,MAAM,eAAe,WAAW,IAAI,OAAO,OAAO,OAAO,OAAO;AACrE,cAAI,UAAU,sBAAsB;AAClC,kBAAM;AAAA,cACJ;AAAA,cACA,UAAU;AAAA,cACV,EAAE,GAAG,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,cAC9C,CAAC,iBAAiB,QAAQ;AAAA,YAC5B;AACA,oBAAQ,eAAe;AAAA,UACzB,WAAW,aAAa;AAGtB,kBAAM,QAAQ,OAAO;AACrB,gBACE,MAAM,SAAS,WACd,MAAM,SAAS,aAAa,MAAM,YAAY,kBAC/C;AACA,oBAAM,GAAG,QAAQ;AAAA,qCACM,OAAO,MAAM,SAAS;AAAA,uCACpB,OAAO,MAAM,WAAW;AAAA,qCAC1B,MAAM,SAAS,YAAY;AAClD,oBAAM,OAAO,MAAM,kBAAkB,IAAI,MAAM,WAAW,OAAO,MAAM,WAAW;AAClF,kBAAI,CAAC,QAAQ,CAAC,cAAc,KAAK,aAAa,eAAe,EAAG,QAAO;AAAA,YACzE,WAAW,MAAM,SAAS,aAAa,MAAM,YAAY,WAAW;AAClE,oBAAM,GAAG,QAAQ;AAAA,qCACM,OAAO,MAAM,SAAS;AAAA,mCACxB,MAAM,UAAU,MAAM,WAAW,MAAM,CAAC;AAAA,0BACjD;AACZ,oBAAM,OAAO,MAAM,8BAA8B,IAAI;AAAA,gBACnD,GAAG,OAAO;AAAA,gBACV,UAAU,MAAM,UAAU,MAAM,WAAW,MAAM;AAAA,cACnD,CAAC;AACD,kBAAI,CAAC,QAAQ,CAAC,cAAc,KAAK,aAAa,eAAe,EAAG,QAAO;AAAA,YACzE,WAAW,MAAM,SAAS,SAAS;AACjC,oBAAM,OAAO,MAAM,WAAW,IAAI,OAAO,MAAM,aAAa,MAAM,SAAS;AAC3E,kBACE,CAAC,QACA,KAAK,6BAA6B,QACjC,CAAC,cAAc,KAAK,0BAA0B,eAAe,GAC/D;AACA,uBAAO;AAAA,cACT;AAAA,YACF,OAAO;AACL,qBAAO;AAAA,YACT;AACA,oBAAQ,eAAe;AAAA,UACzB;AAGA,gBAAM,SAAS,MAAM;AAAA,YACnB;AAAA,YACA,OAAO;AAAA,YACP,UAAU;AAAA,YACV,OAAO;AAAA,YACP,EAAE,eAAe,gBAAgB,OAAU;AAAA,UAC7C;AACA,kBAAQ,eAAe;AACvB,cAAI,CAAC,OAAQ,QAAO;AACpB,gBAAM,4BAA4B,EAAE,GAAG,YAAY,IAAI,GAAG,GAAG,OAAO;AAAA,YAClE,WAAW,UAAU;AAAA,YACrB,WAAW;AAAA,YACX,SAAS;AAAA,UACX,CAAC;AACD,kBAAQ,eAAe;AACvB,iBAAO;AAAA,QACT,CAAC;AAAA,MACH,CAAC;AAAA,IACH,QAAQ;AAGN,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACzGO,SAAS,4BACd,SACA,QACA,QACA,sBAC6B;AAC7B,QAAM,QAAQ,OAAO,KAAK,CAAC,cAAc,UAAU,QAAQ,OAAO,CAAC;AACnE,MAAI,CAAC,MAAO,QAAO,EAAE,SAAS,MAAM;AACpC,QAAM,YAAY,sBAAsB,UAAU,OAAO;AACzD,MAAI,UAAW,QAAO,EAAE,SAAS,MAAM,UAAU,6BAA6B,SAAS,EAAE;AACzF,SAAO,EAAE,SAAS,MAAM,UAAU,MAAM,QAAQ,SAAS,MAAM,EAAE;AACnE;;;AC5BA,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AACvC;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,wCAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAUK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP,SAAS,4CAA4C;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,kBAAAC;AAAA,OAIK;AACP,SAAS,kDAAkD;AAE3D;AAAA,EACE,kCAAAC;AAAA,EACA;AAAA,OAGK;;;AChEP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAOA,IAAM,oCAAN,MAAgF;AAAA,EACrF,YAA6B,KAA8C;AAA9C;AAAA,EAA+C;AAAA,EAE5E,MAAM,UACJ,OACqB;AACrB,UAAM,aAAa,KAAK,IAAI,wBAAwB;AACpD,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,uDAAuD;AACxF,UAAM,UAAU,gCAAgC,MAAM,OAAO,MAAM,UAAU;AAC7E,UAAM,eAAe,WAAW,UAAU,OAAO;AACjD,QAAI,SAAS;AACb,QAAI;AACF,YAAM,oBAAoB,UAAU;AAAA,IACtC,SAAS,OAAO;AACd,mBAAa,YAAY;AACzB,YAAM;AAAA,IACR;AACA,UAAM,YAAY;AAChB,UAAI;AACF,yBAAiB,WAAW,cAAc;AACxC,cAAI,CAAC,OAAQ;AACb,cAAI;AACF,kBAAM,OAAO,iCAAiC,QAAQ,MAAM;AAAA,cAC1D,OAAO,MAAM;AAAA,cACb,YAAY,MAAM;AAAA,YACpB,CAAC;AACD,kBAAM,OAAO;AAAA,cACX,YAAY,MAAM;AAAA,cAClB,cAAc,KAAK;AAAA,YACrB,CAAC;AAAA,UACH,QAAQ;AAAA,UAGR;AAAA,QACF;AAAA,MACF,QAAQ;AACN,YAAI,OAAQ,OAAM,YAAY;AAAA,MAChC;AAAA,IACF,GAAG;AACH,WAAO,MAAM;AACX,UAAI,CAAC,OAAQ;AACb,eAAS;AACT,mBAAa,YAAY;AAAA,IAC3B;AAAA,EACF;AACF;AAEA,eAAe,oBAAoB,YAA+C;AAChF,MAAI,CAAC,WAAW,OAAO;AACrB,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,QAAM,WAAW,MAAM;AACzB;;;AC/DA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAEP;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,8CAA8C;AACvD,SAAS,4CAA4C;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAaK;AAGP,IAAM,uBAAuB,OAAO;AAmBpC,eAAsB,2CAA0F;AAC9G,QAAM,WAAW,MAAM,gCAAgC;AACvD,QAAM,SAAU,MAAM;AAAA;AAAA,IACD,cAAc,SAAS,qBAAqB,EAAE;AAAA;AAEnE,QAAM,YAAY,OAAO,+BAA+B;AACxD,gBAAc,WAAW,QAAQ;AACjC,SAAO,OAAO,OAAO,EAAE,SAAS,WAAW,UAAU,QAAQ,OAAO,CAAC;AACvE;AAGO,IAAM,sCAAN,MAOP;AAAA,EACE,YACW,SACQ,SACjB;AAFS;AACQ;AAEjB,QAAI,QAAQ,SAAS,YAAY,QAAQ,WAAW,YAAY;AAC9D,YAAM,IAAI,MAAM,sDAAsD;AAAA,IACxE;AAAA,EACF;AAAA,EAEA,MAAM,iBACJ,SACyD;AACzD,UAAM,UAAU,MAAM,KAAK,iBAAiB,QAAQ,KAAK;AACzD,QAAI;AACF,UAAI,QAAQ,aAAa,eAAe;AACtC,YAAI,QAAQ,aAAa,cAAe,OAAM,IAAI,MAAM,0BAA0B;AAClF,cAAM,4BAA4B,QAAQ;AAAA,UACxC,QAAQ;AAAA,UACR,qCAAqC,QAAQ,kBAAkB;AAAA,QACjE;AACA,eAAO,OAAO,OAAO;AAAA,UACnB,UAAU;AAAA,UACV;AAAA,UACA,eAAe,KAAK,QAAQ;AAAA,UAC5B,oBAAoB;AAAA,QACtB,CAAC;AAAA,MACH;AACA,UAAI,QAAQ,aAAa,QAAQ,UAAU;AACzC,cAAM,IAAI,MAAM,0BAA0B;AAAA,MAC5C;AACA,YAAM,qBAAqB,QAAQ,cAAc,QAAQ,OAAO,YAAY;AAC5E,aAAO,OAAO,OAAO;AAAA,QACnB,UAAU,QAAQ;AAAA,QAClB;AAAA,QACA,oBAAoB,0BAA0B,QAAQ,UAAU,CAAC;AAAA,QACjE,eAAe,KAAK,QAAQ;AAAA,QAC5B,oBAAoB,sBAAsB,QAAQ,QAAQ;AAAA,MAC5D,CAAC;AAAA,IACH,UAAE;AACA,cAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AAAA,EAEA,MAAM,MACJ,OACgE;AAChE,UAAM,UAAU,MAAM,KAAK,iBAAiB,MAAM,KAAK;AACvD,QAAI;AACF,aAAO,WAAW,KAAK,QAAQ,MAAM,MAAM,UAAU,CAAC;AAAA,IACxD,UAAE;AACA,cAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AAAA,EAEA,MAAc,iBACZ,OACgC;AAChC,UAAM,WAAW,MAAM;AACvB,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,mDAAmD;AAClF,UAAM,gBAAgB,MAAM,qBAAqB,KAAK,SAAS,QAAQ;AACvE,UAAM,UAAU,0BAA0B,KAAK,SAAS;AAAA,MACtD,UAAU,MAAM;AAAA,MAChB,UAAU;AAAA,IACZ,CAAC;AACD,QAAI;AACF,6BAAuB,SAAS,KAAK;AACrC,uBAAiB,SAAS,KAAK;AAC/B,wBAAkB,SAAS,KAAK;AAChC,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ,QAAQ;AAChB,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,6BAA6B,OAW2B;AAC5D,mBAAe,MAAM,MAAM;AAC3B,UAAM,UAAU,4BAA4B,KAAK,SAAS;AAAA,MACxD,UAAU,MAAM;AAAA,MAChB,kBAAkB,qBAAqB,MAAM,UAAU;AAAA,IACzD,CAAC;AACD,QAAI;AACF,YAAM,WAAW,QAAQ,SAAS;AAClC,qBAAe,MAAM,MAAM;AAC3B,YAAM,WAAW,aAAa,QAAQ,SAAS,CAAC;AAChD,UAAI,aAAa,EAAG,OAAM,IAAI,MAAM,qCAAqC;AACzE,YAAM,SAAS;AAAA,QACb,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB,UAAU,MAAM;AAAA,QAChB,iBAAiB,YAAY,UAAU,MAAM,MAAM;AAAA,QACnD,mBAAmB,SAAS;AAAA,QAC5B,sBAAsB;AAAA,UACpB,UAAUC,YAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK,CAAC;AAAA,QAC/D;AAAA,QACA,WAAW,0BAA0B,QAAQ,UAAU,CAAC;AAAA,QACxD,qBAAqB;AAAA,QACrB,oBAAoB,sBAAsB,MAAM,QAAQ;AAAA,QACxD,eAAe,KAAK,QAAQ;AAAA,MAC9B;AACA,UAAI,QAAQ,aAAa,eAAe;AACtC,eAAO,OAAO,OAAO;AAAA,UACnB,GAAG;AAAA,UACH,UAAU;AAAA,UACV,uBAAuB,eAAe,QAAQ,SAAS,CAAC;AAAA,UACxD,0BAA0B;AAAA,UAC1B,kBAAkB;AAAA,QACpB,CAAC;AAAA,MACH;AACA,aAAO,OAAO,OAAO;AAAA,QACnB,GAAG;AAAA,QACH,UAAU,QAAQ;AAAA,QAClB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH,UAAE;AACA,cAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AAAA,EAEA,MAAM,wBAAwB,OAGmC;AAC/D,mBAAe,MAAM,MAAM;AAC3B,UAAM,WAAW,MAAM,MAAM;AAC7B,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,mDAAmD;AAClF,UAAM,gBAAgB,MAAM,qBAAqB,KAAK,SAAS,UAAU,MAAM,MAAM;AACrF,UAAM,UAAU,0BAA0B,KAAK,SAAS;AAAA,MACtD,UAAU,MAAM,MAAM;AAAA,MACtB,UAAU;AAAA,IACZ,CAAC;AACD,QAAI;AACF,6BAAuB,SAAS,MAAM,KAAK;AAC3C,uBAAiB,SAAS,MAAM,KAAK;AACrC,wBAAkB,SAAS,MAAM,KAAK;AACtC,qBAAe,MAAM,MAAM;AAC3B,YAAM,YAAY,QAAQ,SAAS;AACnC,YAAM,SAAS;AAAA,QACb,OAAO,MAAM,MAAM,SAAS;AAAA,QAC5B,YAAY,MAAM,MAAM,SAAS;AAAA,QACjC,UAAU,MAAM,MAAM;AAAA,QACtB,iBAAiB,YAAY,WAAW,MAAM,MAAM;AAAA,QACpD,mBAAmB,UAAU;AAAA,QAC7B,sBAAsB;AAAA,UACpB,UAAUA,YAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK,CAAC;AAAA,QAChE;AAAA,QACA,WAAW,0BAA0B,QAAQ,UAAU,CAAC;AAAA,QACxD,qBAAqB,MAAM,MAAM,SAAS;AAAA,QAC1C,oBAAoB,sBAAsB,MAAM,MAAM,QAAQ;AAAA,QAC9D,eAAe,KAAK,QAAQ;AAAA,MAC9B;AACA,UAAI,QAAQ,aAAa,eAAe;AACtC,YAAI,MAAM,MAAM,aAAa,cAAe,OAAM,IAAI,MAAM,0BAA0B;AACtF,eAAO,OAAO,OAAO;AAAA,UACnB,GAAG;AAAA,UACH,UAAU,QAAQ;AAAA,UAClB,uBAAuB,eAAe,QAAQ,SAAS,CAAC;AAAA,UACxD,0BAA0B;AAAA,UAC1B,kBAAkB;AAAA,QACpB,CAAC;AAAA,MACH;AACA,UAAI,QAAQ,aAAa,MAAM,MAAM,SAAU,OAAM,IAAI,MAAM,0BAA0B;AACzF,aAAO,OAAO,OAAO;AAAA,QACnB,GAAG;AAAA,QACH,UAAU,QAAQ;AAAA,QAClB,gBAAgB,aAAa,QAAQ,SAAS,CAAC;AAAA,MACjD,CAAC;AAAA,IACH,UAAE;AACA,cAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AAAA,EAEA,MAAM,qBACJ,OACuD;AACvD,mBAAe,MAAM,MAAM;AAC3B,UAAM,QAAQ,MAAM;AAAA,MAClB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,UAAM,UAAU,0BAA0B,KAAK,SAAS;AAAA,MACtD,UAAU,MAAM;AAAA,MAChB,UAAU;AAAA,IACZ,CAAC;AACD,QAAI;AACF,YAAM,YAAY,QAAQ,SAAS;AACnC,UAAI,CAAC,WAAW,WAAW,KAAK,EAAG,OAAM,IAAI,MAAM,kCAAkC;AACrF,YAAM,WAAW,MAAM;AACvB,UAAI,SAAS,aAAa,QAAQ,SAAU,OAAM,IAAI,MAAM,4BAA4B;AACxF,YAAM,sBAAsB,SAAS;AACrC,YAAM,YAAY,0BAA0B,QAAQ,UAAU,CAAC;AAC/D,UAAI,cAAc,SAAS,UAAW,OAAM,IAAI,MAAM,8BAA8B;AACpF,YAAM,uBAAuB;AAAA,QAC3B,UAAUA,YAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK,CAAC;AAAA,MAChE;AACA,UAAI,QAAQ,aAAa,eAAe;AACtC,cAAM,wBAAwB,eAAe,QAAQ,SAAS,CAAC;AAC/D,YACE,SAAS,aAAa,iBACtB,CAAC,qBAAqB,uBAAuB,SAAS,qBAAqB,GAC3E;AACA,gBAAM,IAAI,MAAM,mCAAmC;AAAA,QACrD;AACA,YAAI,MAAM,cAAc,MAAM,WAAW,aAAa,eAAe;AACnE,gBAAM,IAAI,MAAM,0BAA0B;AAAA,QAC5C;AACA,cAAMC,kBAAiB,MAAM,aACzB,MAAM,sBAAsB,SAAS,MAAM,YAAY,MAAM,MAAM,IACnE;AACJ,eAAO,OAAO,OAAO;AAAA,UACnB,UAAU;AAAA,UACV,2BAA2B;AAAA,UAC3B,OAAO,MAAM;AAAA,UACb,YAAY,MAAM;AAAA,UAClB,mBAAmB,UAAU;AAAA,UAC7B;AAAA,UACA;AAAA,UACA;AAAA,UACA,oBAAoB;AAAA,UACpB,eAAe,KAAK,QAAQ;AAAA,UAC5B,uBAAuB;AAAA,UACvB;AAAA,UACA,0BAA0B;AAAA,UAC1B,kBAAkB;AAAA,UAClB,GAAIA,kBAAiB,EAAE,gBAAAA,gBAAe,IAAI,CAAC;AAAA,QAC7C,CAAC;AAAA,MACH;AACA,UAAI,SAAS,aAAa,cAAe,OAAM,IAAI,MAAM,4BAA4B;AACrF,YAAM,iBAAiB,aAAa,QAAQ,SAAS,CAAC;AACtD,UAAI,mBAAmB,SAAS,gBAAgB;AAC9C,cAAM,IAAI,MAAM,mCAAmC;AAAA,MACrD;AACA,UAAI,MAAM,cAAc,MAAM,WAAW,aAAa,eAAe;AACnE,cAAM,IAAI,MAAM,0BAA0B;AAAA,MAC5C;AACA,YAAM,iBAAiB,MAAM,aACzB,MAAM,qBAAqB,SAAS,MAAM,YAAY,MAAM,MAAM,IAClE;AACJ,aAAO,OAAO,OAAO;AAAA,QACnB,UAAU,QAAQ;AAAA,QAClB,2BAA2B;AAAA,QAC3B,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB,mBAAmB,UAAU;AAAA,QAC7B;AAAA,QACA;AAAA,QACA;AAAA,QACA,oBAAoB,sBAAsB,QAAQ,QAAQ;AAAA,QAC1D,eAAe,KAAK,QAAQ;AAAA,QAC5B;AAAA,QACA,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,MAC7C,CAAC;AAAA,IACH,UAAE;AACA,cAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,UAA8D;AAC3F,MAAI,aAAa,cAAe,QAAO;AACvC,SAAO,aAAa,aAChB,yCACA;AACN;AAEA,SAAS,cACP,WACA,UAC4C;AAC5C,MAAI,OAAO,cAAc,YAAY,cAAc,MAAM;AACvD,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,QAAM,UAAU;AAChB,MACE,QAAQ,SAAS,YACjB,QAAQ,WAAW,cACnB,QAAQ,WAAW,SAAS,UAC5B,QAAQ,kBAAkB,SAAS,OAAO,iBAC1C,OAAO,QAAQ,+BAA+B,cAC9C,OAAO,QAAQ,6BAA6B,cAC5C,OAAO,QAAQ,0BAA0B,cACzC,OAAO,QAAQ,wBAAwB,cACvC,OAAO,QAAQ,8BAA8B,cAC7C,OAAO,QAAQ,4BAA4B,YAC3C;AACA,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACF;AAEA,SAAS,uBACP,SACA,OACM;AACN,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,YAAY,QAAQ,aAAa,MAAM;AAC1C,UAAM,IAAI,MAAM,4BAA4B;AAC9C,MAAI,QAAQ,UAAU,MAAM,SAAS,WAAW;AAC9C,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,MAAI,MAAM,aAAa,eAAe;AACpC,QACE,QAAQ,aAAa,iBACrB,SAAS,aAAa,iBACtB,CAAC,qBAAqB,eAAe,QAAQ,SAAS,CAAC,GAAG,SAAS,qBAAqB,GACxF;AACA,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AAAA,EACF,WACE,QAAQ,aAAa,iBACrB,SAAS,aAAa,iBACtB,aAAa,QAAQ,SAAS,CAAC,MAAM,SAAS,kBAC9C,MAAM,uBAAuB,SAAS,gBACtC;AACA,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACF;AAEA,SAAS,iBACP,SACA,OACM;AACN,MAAI,MAAM,aAAa,eAAe;AACpC,QAAI,QAAQ,aAAa,cAAe,OAAM,IAAI,MAAM,0BAA0B;AAClF,eAAW,eAAe,MAAM,0BAA0B;AACxD,YAAM,sBAAsB,aAAa,QAAQ,SAAS,CAAC;AAC3D,UAAI,QAAQ,UAAU,MAAM,YAAY,gBAAgB;AACtD,cAAM,IAAI,MAAM,yCAAyC;AAAA,MAC3D;AACA,cAAQ,eAAe,YAAY,yBAAyB;AAC5D,UACE,aAAa,QAAQ,SAAS,CAAC,MAAM,sBAAsB,KAC3D,QAAQ,UAAU,MAAM,YAAY,aACpC,CAAC;AAAA,QACC,eAAe,QAAQ,SAAS,CAAC;AAAA,QACjC,YAAY;AAAA,MACd,GACA;AACA,cAAM,IAAI,MAAM,oCAAoC;AAAA,MACtD;AAAA,IACF;AACA;AAAA,EACF;AACA,MAAI,QAAQ,aAAa,MAAM,UAAU;AACvC,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AACA,aAAW,eAAe,MAAM,0BAA0B;AACxD,QACE,QAAQ,UAAU,MAAM,YAAY,kBACpC,aAAa,QAAQ,SAAS,CAAC,MAAM,YAAY,qBACjD;AACA,YAAM,IAAI,MAAM,wCAAwC;AAAA,IAC1D;AACA,UAAM,SAAS;AAAA,MACb,YAAY;AAAA,MACZ,MAAM;AAAA,IACR;AACA,UAAM,SAAS,qCAAqC,OAAO,WAAW;AACtE,UAAM,UAAU,QAAQ,cAAc,OAAO,YAAY;AACzD,QACE,CAAC,WAAW,SAAS,OAAO,kBAAkB,KAC9C,CAAC,WAAW,SAAS,YAAY,kBAAkB,KACnD,aAAa,QAAQ,SAAS,CAAC,MAAM,YAAY,kBACjD,QAAQ,UAAU,MAAM,YAAY,WACpC;AACA,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAAA,EACF;AACF;AAEA,SAAS,kBACP,SACA,OACM;AACN,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,0CAA0C;AACzE,MAAI,kBAAkB,SAAS;AAC/B,aAAW,eAAe,MAAM,0BAA0B;AACxD,QAAI,YAAY,kBAAkB,kBAAkB,GAAG;AACrD,YAAM,IAAI,MAAM,kDAAkD;AAAA,IACpE;AACA,sBAAkB,YAAY;AAAA,EAChC;AACA,MACE,QAAQ,aAAa,MAAM,YAC3B,oBAAoB,MAAM,SAAS,gBACnC,QAAQ,UAAU,MAAM,MAAM,SAAS,WACvC;AACA,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,MACE,MAAM,aAAa,kBAClB,QAAQ,aAAa,iBACpB,CAAC,qBAAqB,eAAe,QAAQ,SAAS,CAAC,GAAG,MAAM,SAAS,cAAc,IACzF;AACA,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,MAAI,MAAM,aAAa,eAAe;AACpC,UAAM,yBACJ,MAAM,yBAAyB,GAAG,EAAE,GAAG,kBAAkB,MAAM;AACjE,QAAI,aAAa,QAAQ,SAAS,CAAC,MAAM,wBAAwB;AAC/D,YAAM,IAAI,MAAM,kEAAkE;AAAA,IACpF;AAAA,EACF;AACF;AAEA,eAAe,sBACb,SACA,MACA,QAOA;AACA,MAAI,WAAW,KAAK;AACpB,mBAAiB,WAAW,KAAK,UAAU;AACzC,mBAAe,MAAM;AACrB,QAAI,QAAQ,kBAAkB,WAAW,EAAG,OAAM,IAAI,MAAM,qBAAqB;AACjF,QAAI,QAAQ,aAAa,cAAe,OAAM,IAAI,MAAM,kCAAkC;AAC1F,YAAQ,eAAe,QAAQ,KAAK;AACpC,eAAW,QAAQ;AAAA,EACrB;AACA,MAAI,aAAa,KAAK,sBAAsB,QAAQ,UAAU,MAAM,KAAK,iBAAiB;AACxF,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AACA,QAAM,iBAAiB,eAAe,QAAQ,SAAS,CAAC;AACxD,MAAI,CAAC,qBAAqB,gBAAgB,KAAK,oBAAoB,GAAG;AACpE,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AACA,SAAO,OAAO,OAAO;AAAA,IACnB,cAAc;AAAA,IACd;AAAA,IACA,WAAW,0BAA0B,QAAQ,UAAU,CAAC;AAAA,EAC1D,CAAC;AACH;AAEA,eAAe,qBACb,SACA,MACA,QAOA;AACA,MAAI,QAAQ,aAAa,KAAK,SAAU,OAAM,IAAI,MAAM,0BAA0B;AAClF,MAAI,WAAW,KAAK;AACpB,mBAAiB,WAAW,KAAK,UAAU;AACzC,mBAAe,MAAM;AACrB,QAAI,QAAQ,kBAAkB,WAAW,KAAK,QAAQ,aAAa,QAAQ,UAAU;AACnF,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,UAAM,SAAS,uCAAuC,QAAQ,OAAO,QAAQ,QAAQ;AACrF,UAAM,SAAS,qCAAqC,OAAO,WAAW;AACtE,UAAM,UAAU,QAAQ,cAAc,OAAO,YAAY;AACzD,QAAI,CAAC,WAAW,SAAS,OAAO,kBAAkB,EAAG,OAAM,IAAI,MAAM,yBAAyB;AAC9F,eAAW,QAAQ;AAAA,EACrB;AACA,MAAI,aAAa,KAAK,sBAAsB,QAAQ,UAAU,MAAM,KAAK,iBAAiB;AACxF,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AACA,MAAI,aAAa,QAAQ,SAAS,CAAC,MAAM,KAAK,sBAAsB;AAClE,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,SAAO,OAAO,OAAO;AAAA,IACnB,cAAc;AAAA,IACd,gBAAgB,KAAK;AAAA,IACrB,WAAW,0BAA0B,QAAQ,UAAU,CAAC;AAAA,EAC1D,CAAC;AACH;AAEA,SAAS,eAAe,OAAsE;AAC5F,SAAO;AAAA,IACL,qCAAqC,KAAK,EAAE,IAAI,CAAC,WAAW;AAAA,MAC1D,WAAW,0BAA0B,MAAM,SAAS;AAAA,MACpD,SAAS,MAAM;AAAA,IACjB,EAAE;AAAA,EACJ;AACF;AAEA,eAAe,qBACb,SACA,UACA,QACqB;AACrB,QAAM,SAAS,MAAM,QAAQ,KAAK;AAAA,IAChC,iBAAiB,SAAS;AAAA,IAC1B,UAAU;AAAA,IACV,kBAAkB,SAAS;AAAA,IAC3B,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,EAC7B,CAAC;AACD,MAAI;AACF,QAAI,OAAO,gBAAgB,UAAa,OAAO,gBAAgB,SAAS,UAAU;AAChF,YAAM,IAAI,MAAM,gCAAgC;AAAA,IAClD;AACA,UAAM,QAAQ,MAAM;AAAA,MAClB,OAAO,OAAO,SAAS,EAAE,OAAO,IAAI,CAAC,CAAC;AAAA,MACtC,SAAS;AAAA,MACT;AAAA,IACF;AACA,UAAM,cAAc,UAAUD,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AAC9E,QAAI,gBAAgB,SAAS,YAAa,OAAM,IAAI,MAAM,gCAAgC;AAC1F,UAAM,OAAO,gBAAgB,MAAM;AACnC,WAAO;AAAA,EACT,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,eAAe,aACb,QACA,eACA,QACqB;AACrB,MAAI,CAAC,OAAO,cAAc,aAAa,KAAK,iBAAiB,GAAG;AAC9D,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,QAAM,SAAS,IAAI,WAAW,aAAa;AAC3C,MAAI,SAAS;AACb,mBAAiB,SAAS,QAAQ;AAChC,mBAAe,MAAM;AACrB,QAAI,EAAE,iBAAiB,eAAe,MAAM,eAAe,GAAG;AAC5D,YAAM,IAAI,MAAM,8BAA8B;AAAA,IAChD;AACA,QAAI,SAAS,MAAM,aAAa,OAAO,YAAY;AACjD,YAAM,IAAI,MAAM,2CAA2C;AAAA,IAC7D;AACA,WAAO,IAAI,OAAO,MAAM;AACxB,cAAU,MAAM;AAAA,EAClB;AACA,iBAAe,MAAM;AACrB,MAAI,WAAW,OAAO,WAAY,OAAM,IAAI,MAAM,8BAA8B;AAChF,SAAO;AACT;AAEA,gBAAgB,YAAY,OAAmB,QAAiD;AAC9F,WAAS,SAAS,GAAG,SAAS,MAAM,YAAY,UAAU,sBAAsB;AAC9E,mBAAe,MAAM;AACrB,UAAM,MAAM,SAAS,QAAQ,KAAK,IAAI,MAAM,YAAY,SAAS,oBAAoB,CAAC;AAAA,EACxF;AACF;AAEA,SAAS,qBAAqB,YAA4B;AACxD,QAAM,SAASA,YAAW,QAAQ,EAAE,OAAO,UAAU,EAAE,OAAO;AAC9D,MAAI,QAAQ;AACZ,WAAS,QAAQ,GAAG,QAAQ,GAAG,SAAS,EAAG,SAAS,SAAS,KAAM,OAAO,OAAO,KAAK,CAAE;AACxF,SAAO,UAAU,KAAK,KAAK;AAC7B;AAEA,SAAS,aAAa,OAAuB;AAC3C,MAAI,QAAQ,MAAM,QAAQ,OAAO,OAAO,gBAAgB,GAAG;AACzD,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,WAAW,MAAkB,OAA4B;AAChE,MAAI,KAAK,eAAe,MAAM,WAAY,QAAO;AACjD,MAAI,aAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,KAAK,YAAY,SAAS,GAAG;AACvD,kBAAc,KAAK,KAAK,IAAK,MAAM,KAAK;AAAA,EAC1C;AACA,SAAO,eAAe;AACxB;AAEA,SAAS,eAAe,QAAuC;AAC7D,MAAI,QAAQ,QAAS,OAAM,IAAI,MAAM,kDAAkD;AACzF;;;AC7pBA,SAAS,cAAAE,mBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE,wCAAAC;AAAA,EACA;AAAA,EACA,kCAAAC;AAAA,EACA,+BAAAC;AAAA,EACA,6BAAAC;AAAA,EACA,6BAAAC;AAAA,EACA;AAAA,OAKK;AACP,SAAS,4CAA4C;AACrD,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EAEA;AAAA,OAEK;AAIP,IAAM,gBAAgB;AAcf,IAAM,sCAAN,MAAsF;AAAA,EAI3F,YAA6B,cAA+D;AAA/D;AAC3B,SAAK,YAAY,aAAa,aAAa;AAC3C,SAAK,gCACH,aAAa,iCAAiC;AAAA,EAClD;AAAA,EAPiB;AAAA,EACA;AAAA,EAQjB,MAAM,QACJ,OACyD;AACzD,IAAAC,gBAAe,MAAM,MAAM;AAC3B,UAAM,YAAY,MAAM,KAAK;AAAA,MAC3B,KAAK,aAAa;AAAA,MAClB,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,UAAM,CAAC,IAAI,IAAI,MAAM,KAAK,UAAU,KAAK,aAAa,IAAI;AAAA,MACxD,WAAW,MAAM,MAAM;AAAA,MACvB,aAAa,MAAM,MAAM;AAAA,MACzB;AAAA,MACA,SAAS,CAAC,MAAM,MAAM;AAAA,IACxB,CAAC;AACD,QAAI,CAAC,QAAQ,KAAK,WAAW,SAAS;AACpC,YAAM,IAAI,kCAAkC,gBAAgB;AAAA,IAC9D;AACA,UAAM,mBAAmB,eAAe,MAAM,QAAQ;AACtD,QACE,KAAK,gBAAgB,oBACrB,CAAC,sBAAsB,KAAK,UAAU,MAAM,QAAQ,KACpD,CAAC,OAAO,cAAc,KAAK,SAAS,KACpC,KAAK,YAAY,KACjB,KAAK,YAAY,+CACjB,OAAO,KAAK,WAAW,YACvB,CAAC,kBAAkB,KAAK,KAAK,MAAM,GACnC;AACA,YAAM,IAAI,kCAAkC,gBAAgB;AAAA,IAC9D;AACA,UAAM,cAAc,MAAM;AAAA,MACxB,KAAK,aAAa;AAAA,MAClB;AAAA,MACA,MAAM;AAAA,IACR;AACA,UAAM,WAAW,MAAM,oBAAoB;AAAA,MACzC,SAAS,KAAK,aAAa;AAAA,MAC3B,UAAU,MAAM;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,UAAU;AAAA,MACV,OAAO;AAAA,MACP,SAAS,KAAK,aAAa,iBAAiB;AAAA,IAC9C,CAAC;AACD,UAAM,iBAAiB,MAAM,KAAK,aAAa,cAAc,MAAM;AAAA,MACjE,QAAQ,WAAW,WAAW;AAAA,MAC9B,aAAa;AAAA,MACb,UAAU;AAAA,MACV,kBAAkB,SAAS,OAAO;AAAA,MAClC,qBAAqB,SAAS,OAAO;AAAA,MACrC,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IACjD,CAAC;AACD,UAAM,mBAAmB,MAAM,KAAK,aAAa,gBAAgB,MAAM;AAAA,MACrE,QAAQ,WAAW,SAAS,SAAS,KAAK;AAAA,MAC1C,aAAa;AAAA,MACb,UAAUL;AAAA,MACV,kBAAkB,SAAS,SAAS;AAAA,MACpC,qBAAqB,SAAS,SAAS;AAAA,MACvC,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IACjD,CAAC;AACD,UAAM,SAAS;AAAA,MACb,UAAU,SAAS,SAAS;AAAA,MAC5B,eAAe,iBAAiB;AAAA,MAChC,UAAU,SAAS,SAAS;AAAA,MAC5B,aAAaE,6BAA4B,SAAS,SAAS,WAAW;AAAA,MACtE,UAAU;AAAA,MACV,qBAAqB;AAAA,MACrB,WAAWE,2BAA0B,SAAS,SAAS,SAAS;AAAA,MAChE,oBAAoB,SAAS,SAAS;AAAA,MACtC,eAAe,SAAS,SAAS;AAAA,IACnC;AACA,WAAO,OAAO,OAAO;AAAA,MACnB,gBAAgB,OAAO,OAAO;AAAA,QAC5B,QAAQ,KAAK;AAAA,QACb,eAAe,eAAe;AAAA,QAC9B,UAAU,SAAS,OAAO;AAAA,QAC1B,aAAaF,6BAA4B,SAAS,OAAO,WAAW;AAAA,QACpE,UAAU;AAAA,MACZ,CAAC;AAAA,MACD,UACE,SAAS,SAAS,aAAa,gBAC3B,OAAO,OAAO;AAAA,QACZ,GAAG;AAAA,QACH,UAAU;AAAA,QACV,uBAAuBD;AAAA,UACrB,SAAS,SAAS,sBAAsB,IAAI,CAAC,WAAW;AAAA,YACtD,WAAWE,2BAA0B,MAAM,SAAS;AAAA,YACpD,SAAS,MAAM;AAAA,UACjB,EAAE;AAAA,QACJ;AAAA,QACA,0BAA0B,SAAS,SAAS;AAAA,QAC5C,kBAAkB,SAAS,SAAS;AAAA,MACtC,CAAC,IACD,OAAO,OAAO;AAAA,QACZ,GAAG;AAAA,QACH,UAAU,SAAS,SAAS;AAAA,QAC5B,gBAAgB,SAAS,SAAS;AAAA,MACpC,CAAC;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,eAAe,oBAAoB,OAOhC;AACD,MAAI;AACF,WAAO,MAAM,MAAM,QAAQ;AAAA,MACzB,QAAQ,MAAM,QAAQ;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM;AAAA,MAChB,OAAO,MAAM;AAAA,MACb,uBAAuB,MAAM,QAAQ,SAAS;AAAA,MAC9C,uBAAuB,MAAM,QAAQ,QAAQ;AAAA,IAC/C,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,sCAAsC;AACzD,YAAM,IAAI,kCAAkC,qBAAqB;AAAA,IACnE;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,eAAe,UAA4D;AAClF,MAAI,aAAa,eAAe;AAC9B,WAAO;AAAA,EACT;AACA,MAAI,aAAa,YAAY;AAC3B,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,UAAkB,UAA6C;AAC5F,QAAM,YACJ,aAAa,gBAAgB,UAAU,aAAa,aAAa,UAAU;AAC7E,SAAO,SAAS,YAAY,EAAE,SAAS,SAAS;AAClD;AAEA,eAAe,0BACb,SACA,MACA,QACqB;AACrB,EAAAE,gBAAe,MAAM;AACrB,QAAM,SAAS,MAAM,kBAAkB,YAAY;AACjD,QAAI;AACF,aAAO,MAAM,QAAQ,SAAS,IAAI;AAAA,IACpC,SAAS,OAAO;AACd,UAAI,OAAO,QAAQ,eAAe,cAAc,CAAE,MAAM,QAAQ,WAAW,IAAI,GAAI;AACjF,eAAO;AAAA,MACT;AACA,YAAM;AAAA,IACR;AAAA,EACF,CAAC;AACD,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,kCAAkC,gBAAgB;AAAA,EAC9D;AACA,MACE,OAAO,kBAAkB,KAAK,aAC9B,OAAO,gBAAgB,KAAK,eAC5B,OAAO,UAAU,WAAW,KAAK,UACjC,OAAO,OAAO,iBAAiB,YAC/B,OAAO,aAAa,SAAS,GAC7B;AACA,UAAM,IAAI,kCAAkC,gBAAgB;AAAA,EAC9D;AACA,QAAM,QAAQ,IAAI,WAAW,KAAK,SAAS;AAC3C,QAAM,SAASN,YAAW,QAAQ;AAClC,WAAS,QAAQ,GAAG,QAAQ,KAAK,WAAW,SAAS,gCAAgC;AACnF,IAAAM,gBAAe,MAAM;AACrB,UAAM,MAAM,KAAK,IAAI,KAAK,WAAW,QAAQ,8BAA8B,IAAI;AAC/E,UAAM,QAAQ,MAAM,kBAAkB,YAAY,QAAQ,aAAa,MAAM,EAAE,OAAO,IAAI,CAAC,CAAC;AAC5F,QAAI,CAAC,SAAS,MAAM,eAAe,MAAM,QAAQ,GAAG;AAClD,YAAM,IAAI,kCAAkC,gBAAgB;AAAA,IAC9D;AACA,UAAM,IAAI,OAAO,KAAK;AACtB,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,QAAM,QAAQ,MAAM,kBAAkB,YAAY;AAChD,QAAI;AACF,aAAO,MAAM,QAAQ,SAAS,IAAI;AAAA,IACpC,SAAS,OAAO;AACd,UAAI,OAAO,QAAQ,eAAe,cAAc,CAAE,MAAM,QAAQ,WAAW,IAAI,GAAI;AACjF,eAAO;AAAA,MACT;AACA,YAAM;AAAA,IACR;AAAA,EACF,CAAC;AACD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,kCAAkC,gBAAgB;AAAA,EAC9D;AACA,QAAM,SAAS,OAAO,OAAO,KAAK;AAClC,MACE,MAAM,kBAAkB,OAAO,iBAC/B,MAAM,gBAAgB,OAAO,eAC7B,MAAM,UAAU,WAAW,OAAO,UAAU,UAC5C,MAAM,iBAAiB,OAAO,gBAC9B,WAAW,KAAK,QAChB;AACA,UAAM,IAAI,kCAAkC,gBAAgB;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,eAAsB,uCACpB,IACA,OACA,OACwB;AACxB,MAAI,MAAM,SAAS,QAAS,QAAO,MAAM;AACzC,QAAM,gBAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,MACE,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,aAAa,CAAC;AAAA,MACd,eAAe;AAAA,MACf,UAAU;AAAA,QACR,WAAW,MAAM;AAAA,QACjB,QAAQ,MAAM;AAAA,QACd,WAAW,MAAM;AAAA,QACjB,qBAAqB,MAAM;AAAA,MAC7B;AAAA,IACF;AAAA,IACA,MAAM;AAAA,EACR;AACA,SAAO,cAAc;AACvB;AAEA,gBAAgB,WAAW,OAA8C;AACvE,WAAS,SAAS,GAAG,SAAS,MAAM,YAAY,UAAU,gCAAgC;AACxF,UAAM,MAAM,SAAS,QAAQ,SAAS,8BAA8B;AAAA,EACtE;AACF;AAEA,SAASA,gBAAe,QAA4B;AAClD,MAAI,QAAQ,QAAS,OAAM,OAAO,UAAU,IAAI,MAAM,yBAAyB;AACjF;;;ACzSA,SAAS,cAAAC,mBAAkB;AAM3B,SAAS,oBAAoB,qCAAoD;AACjF,SAAS,qBAAAC,0BAA8D;AAEvE,IAAM,uBAAuB,KAAK;AAClC,IAAM,eAAe;AAed,IAAM,uCAAN,MAA6F;AAAA,EAKlG,YAA6B,cAAgE;AAAhE;AAC3B,SAAK,MAAM,aAAa,QAAQ,MAAM,oBAAI,KAAK;AAC/C,SAAK,cAAc,aAAa,eAAe;AAC/C,SAAK,eAAe,aAAa,gBAAgB;AAAA,EACnD;AAAA,EARiB;AAAA,EACA;AAAA,EACA;AAAA,EAQjB,MAAM,0BACJ,OACiF;AACjF,IAAAC,gBAAe,MAAM,MAAM;AAC3B,UAAM,UAAU,KAAK,aAAa;AAClC,QAAI,CAAC,QAAQ,cAAc,CAAC,QAAQ,yBAAyB;AAC3D,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,UAAM,WAAW,MAAM,KAAK,aAAa,eAAe,4BAA4B;AAAA,MAClF,OAAO,MAAM;AAAA,MACb,OAAO,MAAM;AAAA,MACb,YAAY,MAAM,SAAS;AAAA,MAC3B,OAAO,MAAM;AAAA,MACb,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IACjD,CAAC;AACD,QAAI;AACF,YAAM,SAAS,YAAY,SAAS,WAAW;AAC/C,YAAM,WAAW,eAAe,MAAM,UAAU,SAAS,MAAM;AAC/D,YAAM,SAAS;AAAA,QACb,iCAAiC,MAAM,MAAM,WAAW,IAAI,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,IAAI,MAAM,KAAK;AAAA,MACjH;AACA,YAAM,WAAW;AAAA,QACf,mCAAmC,MAAM,MAAM,WAAW,IAAI,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,IAAI,MAAM,KAAK;AAAA,MACnH;AACA,YAAM,eAAe,YAAY,MAAM,SAAS,EAAE,IAAI,MAAM,KAAK,IAAI,SAAS,MAAM;AACpF,YAAM,YAAY,cAAc,MAAM,MAAM,WAAW,UAAU,MAAM,qBAAqB,YAAY;AACxG,YAAM,WAAW,MAAM,KAAK,YAAY,KAAK,aAAa,IAAI;AAAA,QAC5D,WAAW,MAAM,MAAM;AAAA,QACvB,aAAa,MAAM,MAAM;AAAA,QACzB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,SAAS;AAAA,QACtB,WAAW,SAAS;AAAA,QACpB;AAAA,QACA,QAAQ,QAAQ;AAAA,QAChB;AAAA,QACA,WAAW,IAAI,KAAK,KAAK,IAAI,EAAE,QAAQ,IAAI,oBAAoB;AAAA,MACjE,CAAC;AAED,UAAI,OAAO,SAAS;AACpB,UAAI,KAAK,WAAW,SAAS;AAC3B,cAAM,WAAW,MAAM,QAAQ,WAAW,SAAS;AACnD,YAAI,UAAU;AACZ,6BAAmB,UAAU,SAAS,UAAU,SAAS,UAAU,MAAM;AAAA,QAC3E,OAAO;AACL,gBAAM,UAAU,MAAM,QAAQ,wBAAwB;AAAA,YACpD,KAAK;AAAA,YACL,aAAa,SAAS;AAAA,YACtB,QAAQ,SAAS,OAAO,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC,CAAC;AAAA,YACpE,UAAU,SAAS;AAAA,YACnB;AAAA,YACA,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,UACjD,CAAC;AACD,cAAI,CAAC,SAAS;AACZ,kBAAM;AAAA,cACJ;AAAA,cACA;AAAA,cACA,SAAS;AAAA,cACT,SAAS;AAAA,cACT;AAAA,cACA,MAAM;AAAA,YACR;AAAA,UACF;AAAA,QACF;AACA,cAAM,SAAS,gBAAgB,MAAM,MAAM;AAC3C,QAAAA,gBAAe,MAAM,MAAM;AAC3B,eAAO,MAAM,KAAK,aAAa,KAAK,aAAa,IAAI,MAAM,MAAM,aAAa,QAAQ;AAAA,MACxF,OAAO;AACL,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,SAAS;AAAA,UACT;AAAA,UACA,MAAM;AAAA,QACR;AACA,cAAM,SAAS,gBAAgB,MAAM,MAAM;AAAA,MAC7C;AACA,UACE,KAAK,OAAO,UACZ,KAAK,WAAW,WAChB,KAAK,aAAa,YAClB,KAAK,gBAAgB,SAAS,YAC9B,KAAK,cAAc,SAAS,YAC5B,KAAK,WAAW,QAChB;AACA,cAAM,IAAI,MAAM,4DAA4D;AAAA,MAC9E;AAEA,aAAO,OAAO,OAAO;AAAA,QACnB,QAAQ,KAAK;AAAA,QACb,UAAU,KAAK;AAAA,QACf,aAAa,KAAK;AAAA,QAClB,WAAW,KAAK;AAAA,QAChB;AAAA,QACA,YAAY,MAAM,SAAS;AAAA,QAC3B,WAAW,MAAM;AAAA,QACjB,sBAAsB,MAAM;AAAA,QAC5B,oBAAoB,MAAM;AAAA,QAC1B,iBAAiB,MAAM;AAAA,MACzB,CAAC;AAAA,IACH,UAAE;AACA,YAAM,SAAS,MAAM;AAAA,IACvB;AAAA,EACF;AACF;AAEA,eAAe,oBACb,SACA,WACA,UACA,aACA,QACA,QACe;AACf,QAAM,OAAO,MAAMD;AAAA,IACjB,YAAY,MAAM,QAAQ,WAAY,SAAS;AAAA,IAC/C,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,EACzB;AACA,qBAAmB,MAAM,UAAU,aAAa,MAAM;AACxD;AAEA,SAAS,mBACP,MACA,UACA,aACA,QACM;AACN,MACE,CAAC,QACD,KAAK,kBAAkB,YACvB,KAAK,gBAAgB,eACrB,KAAK,UAAU,WAAW,UAC1B,OAAO,KAAK,iBAAiB,YAC7B,KAAK,aAAa,SAAS,GAC3B;AACA,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACF;AAEA,SAAS,eAAe,OAAe,QAAwB;AAC7D,QAAM,oBAAoB,IAAI,MAAM;AACpC,QAAM,aAAa,MAChB,UAAU,MAAM,EAChB,QAAQ,sCAAsC,GAAG,EACjD,QAAQ,SAAS,GAAG,EACpB,KAAK,EACL,MAAM,GAAG,GAAG;AACf,QAAM,OAAO,WAAW,YAAY,EAAE,SAAS,iBAAiB,IAC5D,WAAW,MAAM,GAAG,CAAC,kBAAkB,MAAM,IAC7C;AACJ,SAAO,GAAG,KAAK,QAAQ,WAAW,EAAE,EAAE,MAAM,GAAG,GAAG,KAAK,UAAU,GAAG,iBAAiB;AACvF;AAEA,SAAS,YAAY,OAAuB;AAC1C,QAAM,QAAQ,2BAA2B,KAAK,KAAK;AACnD,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,+CAA+C;AAC3E,SAAO,MAAM,CAAC;AAChB;AAEA,SAAS,kBAAkB,MAAsB;AAC/C,QAAM,QAAQD,YAAW,QAAQ,EAAE,OAAO,MAAM,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE;AAC/E,QAAM,CAAC,KAAM,MAAM,CAAC,KAAK,KAAK,KAAQ;AACtC,QAAM,CAAC,KAAM,MAAM,CAAC,KAAK,KAAK,KAAQ;AACtC,QAAM,MAAM,MAAM,SAAS,KAAK;AAChC,QAAM,QAAQ,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AAC/G,MAAI,CAAC,aAAa,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,8CAA8C;AAC7F,SAAO;AACT;AAEA,SAASE,gBAAe,QAA4B;AAClD,MAAI,QAAQ,QAAS,OAAM,OAAO,UAAU,IAAI,MAAM,yBAAyB;AACjF;;;AJzIA,IAAM,uBAAuB;AAC7B,IAAM,oBAAoB;AAgB1B,eAAsB,4CAA4C,OAIf;AACjD,QAAM,iBAAiB,gCAAgC,MAAM,aAAa;AAC1E,QAAM,yBAAyB,gCAAgC,MAAM,eAAe;AAAA,IAClF,WAAW;AAAA,EACb,CAAC;AACD,QAAM,sBAAsB,gCAAgC,MAAM,eAAe;AAAA,IAC/E,WAAW;AAAA,EACb,CAAC;AACD,QAAM,iBAAiB,MAAM,yCAAyC;AACtE,QAAM,UAAU,eAAe;AAC/B,QAAM,SAAS,IAAI,oCAAoC,SAAS,eAAe,IAAI;AACnF,QAAM,iBAAiB,IAAI,8BAA8B,MAAM,EAAE;AACjE,QAAM,QAAQ,sCAAsC,cAAc;AAClE,QAAM,gBAAgB,IAAI,sCAAsC,MAAM,EAAE;AACxE,QAAM,MAAM,IAAI,gCAAgC;AAChD,QAAM,QAAQ,IAAI,4BAA4B;AAC9C,QAAM,mBAAmB,IAAI,2CAA2C;AAAA,IACtE,SAAS,eAAe;AAAA,IACxB;AAAA,EACF,CAAC;AACD,QAAM,UAAU,IAAI,gCAAgC;AAAA,IAClD;AAAA,IACA,SAAS,eAAe;AAAA,IACxB,KAAK,MAAM,MAAM,IAAI;AAAA,EACvB,CAAC;AACD,QAAM,aAAa,IAAI,mCAAmC;AAAA,IACxD;AAAA,IACA,SAAS,eAAe;AAAA,IACxB,KAAK,MAAM,MAAM,IAAI;AAAA,EACvB,CAAC;AACD,QAAM,SAAS,IAAI,wBAAwB;AAAA,IACzC;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,2BAA2B;AAAA,IAC/B;AAAA,IACA,eAAe,SAAS,aAAa;AAAA,EACvC;AACA,QAAM,iBAAiB,IAAI,qCAAqC;AAAA,IAC9D;AAAA,IACA,gBAAgB,OAAO,OAAO;AAAA,MAC5B,QAAQ,OAAO,YACb,MAAM,OAAO,mBAAmB,OAAO;AAAA,IAC3C,CAAC;AAAA,IACD,OAAO;AAAA,MACL,IAAI,2CAA2C,MAAM,EAAE;AAAA,IACzD;AAAA,IACA,KAAK,IAAI,uCAAuC;AAAA,IAChD,UAAU,wBAAwB,wBAAwB;AAAA,IAC1D,wBAAwB,uBAAuB;AAAA,EACjD,CAAC;AACD,QAAM,gBAAgB,IAAI,oCAAoC;AAAA,IAC5D,IAAI,MAAM;AAAA,IACV,eAAe,MAAM;AAAA,IACrB,SAAS;AAAA,IACT,eAAe,oBAAoB;AAAA,IACnC,iBAAiB,eAAe;AAAA,EAClC,CAAC;AACD,QAAM,QAAQ,IAAI,iCAAiC;AAAA,IACjD;AAAA,IACA,SAAS;AAAA,IACT,cAAc,OAAO,OAAO;AAAA,MAC1B,iBAAiB,OAAO,EAAE,OAAO,WAAW,MAAM,OAC/C,MAAM,kCAAkC,MAAM,IAAI,OAAO,WAAW,KAAK,GAAG;AAAA,QAC3E;AAAA,MACF;AAAA,MACF,OAAO,OAAO,EAAE,OAAO,WAAW,WAAW,MAC3C,MAAM,iCAAiC,MAAM,IAAI,OAAO,WAAW,UAAU;AAAA,IACjF,CAAgD;AAAA,IAChD,WAAW;AAAA,IACX,kBAAkB,OAAO,eAAe;AACtC,UAAI,WAAW,MAAM,SAAS;AAC5B,cAAM,IAAI,MAAM,4CAA4C;AAC9D,aAAO,+BAA+B,MAAM,IAAI,EAAE,GAAG,YAAY,OAAO,WAAW,MAAM,CAAC;AAAA,IAC5F;AAAA,IACA;AAAA,IACA,gBAAgB,IAAI,qCAAqC;AAAA,MACvD,IAAI,MAAM;AAAA,MACV,eAAe,MAAM;AAAA,MACrB;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,QAAM,cAAc,IAAI,wCAAwC,MAAM,EAAE;AACxE,QAAM,WAAW,IAAI,sCAAsC,MAAM,IAAI;AAAA,IACnE,eAAe,kBAAkB,eAAe,IAAI;AAAA,EACtD,CAAC;AACD,QAAM,gBAAgB,IAAI,kDAAkD,aAAa;AACzF,QAAM,OAAO,IAAI,2BAA2B;AAAA,IAC1C;AAAA,IACA;AAAA,IACA,SAAS,gDAAgD,WAAW;AAAA,IACpE,QAAQ,IAAI,oCAAoC;AAAA,IAChD,OAAO,IAAI,gCAAgC;AAAA,IAC3C,WAAW,IAAI,oCAAoC;AAAA,IACnD,MAAM,yCAAyC,QAAQ;AAAA,IACvD,OAAO,IAAI,kCAAkC,MAAM,GAAG;AAAA,IACtD;AAAA,EACF,CAAC;AACD,QAAM,gBAAuD,OAAO,OAAO;AAAA,IACzE,iBACE,SACA;AACA,YAAM,UAAU,qCAAqC,QAAQ,SAAS,QAAQ;AAC9E,UACE,QAAQ,aAAa,QAAQ,SAAS,YACtC,QAAQ,wBAAwB,QAAQ,uBACxC,QAAQ,uBAAuB,QAAQ,sBACvC,QAAQ,oBAAoB,QAAQ,mBACpC,QAAQ,2BAA2B,QAAQ,0BAC3C,QAAQ,wCAAwC,QAAQ,qCACxD;AACA,cAAM,IAAI,mCAAmC;AAAA,MAC/C;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,cAAc,IAAI,4BAA4B;AAAA,IAClD;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,UAAU,YAAY,MAAM;AAChC,SAAK,YAAY,eAAe,EAAE,MAAM,MAAM,MAAS;AAAA,EACzD,GAAG,iBAAiB;AACpB,UAAQ,QAAQ;AAChB,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,eAAe,QAAQ;AAAA,IACvB,QAAQ;AACN,oBAAc,OAAO;AACrB,oBAAc,MAAM;AAAA,IACtB;AAAA,EACF,CAAC;AACH;AAEO,IAAM,wCAAN,MAAyF;AAAA,EAC9F,YAA6B,IAAc;AAAd;AAAA,EAAe;AAAA,EAE5C,MAAM,UACJ,SACgD;AAChD,UAAM,QAAQ,QAAQ;AACtB,UAAM,OAAO,MAAMC;AAAA,MAAe,KAAK;AAAA,MAAI,QAAQ;AAAA,MAAO,OAAO,OAC/D;AAAA,QACE,MAAM,GAAG,QAAQ;AAAA;AAAA,cAEX,QAAQ,MAAM,SAAS;AAAA,cACvB,QAAQ,MAAM,WAAW;AAAA,cACzB,QAAQ,UAAU;AAAA,cAClB,MAAM,IAAI;AAAA,cACV,MAAM,SAAS;AAAA,cACf,MAAM,SAAS,UAAU,MAAM,YAAY,IAAI;AAAA,cAC/C,MAAM,SAAS,UAAU,MAAM,SAAS,IAAI;AAAA,cAC5C,MAAM,SAAS,UAAU,MAAM,YAAY,IAAI;AAAA,cAC/C,MAAM,SAAS,UAAU,MAAM,aAAa,IAAI;AAAA,cAChD,MAAM,SAAS,YAAY,MAAM,UAAU,IAAI;AAAA,cAC/C,QAAQ,UAAU;AAAA;AAAA,YAEpB;AAAA,MACN;AAAA,IACF;AACA,QAAI,KAAK,WAAW,EAAG,OAAM,IAAI,MAAM,sDAAsD;AAC7F,UAAM,WAAW,OAAO,KAAK,CAAC,EAAG,sBAAsB;AACvD,QAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,GAAG;AACnD,YAAM,IAAI,MAAM,8DAA8D;AAAA,IAChF;AACA,WAAO,OAAO,OAAO,EAAE,SAAS,KAAK,CAAC,EAAG,YAAY,MAAM,SAAS,CAAC;AAAA,EACvE;AACF;AAEA,IAAM,oDAAN,MAAqH;AAAA,EAGnH,YAA6B,eAAkD;AAAlD;AAAA,EAAmD;AAAA,EAF/D,QAAQ,oBAAI,IAAgB;AAAA,EAI7C,MAAM,UACJ,OACqB;AACrB,QAAI,SAAS;AACb,QAAI,UAAU;AACd,QAAI,WAAW,MAAM,KAAK,KAAK,KAAK;AACpC,UAAM,QAAQ,YAAY,MAAM;AAC9B,UAAI,CAAC,UAAU,QAAS;AACxB,gBAAU;AACV,WAAK,KAAK,KAAK,KAAK,EACjB,KAAK,CAAC,SAAS;AACd,YAAI,CAAC,OAAQ;AACb,YAAI,SAAS,UAAU;AACrB,qBAAW;AACX,gBAAM,cAAc;AAAA,QACtB;AAAA,MACF,CAAC,EACA,MAAM,MAAM;AACX,YAAI,OAAQ,OAAM,cAAc;AAAA,MAClC,CAAC,EACA,QAAQ,MAAM;AACb,kBAAU;AAAA,MACZ,CAAC;AAAA,IACL,GAAG,oBAAoB;AACvB,UAAM,QAAQ;AACd,UAAM,OAAO,MAAM;AACjB,UAAI,CAAC,OAAQ;AACb,eAAS;AACT,oBAAc,KAAK;AACnB,WAAK,MAAM,OAAO,IAAI;AAAA,IACxB;AACA,SAAK,MAAM,IAAI,IAAI;AACnB,WAAO;AAAA,EACT;AAAA,EAEA,QAAc;AACZ,eAAW,QAAQ,CAAC,GAAG,KAAK,KAAK,EAAG,MAAK;AAAA,EAC3C;AAAA,EAEA,MAAc,KACZ,OACiB;AACjB,UAAM,WAAW,MAAM,KAAK,cAAc,UAAU;AAAA,MAClD,OAAO,MAAM;AAAA,MACb,YAAY,MAAM;AAAA,MAClB,OAAO,MAAM;AAAA,MACb,YAAY;AAAA,IACd,CAAC;AACD,WAAO,GAAG,SAAS,UAAU,IAAI,CAAC,IAAI,SAAS,QAAQ;AAAA,EACzD;AACF;AAEA,IAAM,kCAAN,MAAqF;AAAA,EACnF,KAAK,OAAqC;AACxC,WAAOC,YAAW,EAAE,WAAW,KAAK,EAAE;AAAA,EAGxC;AACF;AAEA,IAAM,yCAAN,MAAmG;AAAA,EACjG,KAAK,OAA8D;AACjE,WAAOA,YAAW,EAAE,WAAW,KAAK,EAAE;AAAA,EACxC;AACF;AAEA,SAAS,wBACP,cAC4C;AAC5C,QAAM,2BAA2B,qCAAqC,aAAa;AACnF,MACE,aAAa,aAAa,cAC1B,aAAa,gBAAgB,YAC7B,aAAa,mBAAmB,+CAChC,aAAa,cAAc,eAAe,MAAM,UAChD,aAAa,6BAA6B,CAAC,MAAM,yBAAyB,sBAC1E,aAAa,mCAAmC,CAAC,MAC/C,yBAAyB,uCAC3B,aAAa,kCAAkC,CAAC,MAAM,yBAAyB,iBAC/E;AACA,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,QAAM,eAAe,aAAa,cAAc,eAAe;AAC/D,SAAO,OAAO,OAAO;AAAA,IACnB,kBAAkB;AAAA,IAClB,MAAM,QAAQ,OAA6E;AAEzF,UACE,MAAM,aAAa,iBACnB,MAAM,WAAW,UACjB,CAAC,iCAAiC,MAAM,QAAQ,EAAE,SAAS,MAAM,MAAM,KACvE,OAAO,KAAK,MAAM,OAAO,EAAE,WAAW,GACtC;AACA,eAAO;AAAA,MACT;AACA,aAAO,OAAO,OAAO;AAAA,QACnB,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,SAAS;AAAA,QACT;AAAA,QACA,eAAe,aAAa;AAAA,QAC5B,kBAAkB,aAAa;AAAA,QAC/B,YAAY,aAAa;AAAA,QACzB,mBAAmB;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEA,SAAS,kBACP,SAC4C;AAC5C,SAAO,OAAO,OAAO;AAAA,IACnB,MAAM,kBAAkB,UAAqD;AAC3E,YAAM,SAAS,MAAM,QAAQ,KAAK;AAAA,QAChC,iBAAiB,SAAS;AAAA,QAC1B,UAAUC;AAAA,QACV,kBAAkB,SAAS;AAAA,MAC7B,CAAC;AACD,UAAI;AACF,YAAI,OAAO,gBAAgB,UAAa,OAAO,gBAAgB,SAAS,UAAU;AAChF,gBAAM,IAAI,MAAM,kDAAkD;AAAA,QACpE;AACA,cAAM,QAAQ,IAAI,WAAW,SAAS,QAAQ;AAC9C,cAAM,SAASC,YAAW,QAAQ;AAClC,YAAI,SAAS;AACb,yBAAiB,SAAS,OAAO,OAAO;AAAA,UACtC,YAAYC;AAAA,QACd,CAAC,GAAG;AACF,cAAI,SAAS,MAAM,aAAa,MAAM,YAAY;AAChD,kBAAM,IAAI,MAAM,sDAAsD;AAAA,UACxE;AACA,gBAAM,IAAI,OAAO,MAAM;AACvB,iBAAO,OAAO,KAAK;AACnB,oBAAU,MAAM;AAAA,QAClB;AACA,YACE,WAAW,MAAM,cACjB,UAAU,OAAO,OAAO,KAAK,CAAC,OAAO,SAAS,aAC9C;AACA,gBAAM,IAAI,MAAM,oDAAoD;AAAA,QACtE;AACA,cAAM,OAAO,gBAAgB;AAC7B,eAAO;AAAA,MACT,UAAE;AACA,cAAM,OAAO,MAAM;AAAA,MACrB;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,QAA2C,QAAsB;AACxE,MAAI,MAAM,QAAQ,MAAM,EAAG,QAAO;AAClC,QAAM,OAAQ,QAAsC;AACpD,MAAI,MAAM,QAAQ,IAAI,EAAG,QAAO;AAChC,QAAM,IAAI,MAAM,2CAA2C;AAC7D;;;AKlbA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,gCAAgC;AAuDzC,IAAM,6BAA6B;AACnC,IAAM,mCAAmC;AAEzC,IAAM,oBAAoB;AAAA,EACxB,iBAAiB;AAAA,EACjB,qBAAqB;AAAA,EACrB,oBAAoB;AACtB;AAEO,SAAS,+BACd,UAA0C,CAAC,GAClB;AACzB,QAAM,iBAAiB,QAAQ,WAAW,uBAAuB;AACjE,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,gBAAgB,QAAQ,kBAAkB,MAAM,aAAaA,YAAW,CAAC;AAC/E,QAAM,cAAc,QAAQ,gBAAgB,CAAC,YAAoB,QAAQ,MAAM,OAAO;AACtF,QAAM,yBAAyB,QAAQ,0BAA0B;AACjE,MAAI,gBAAgB,QAAQ;AAC5B,MAAI,QAAuB;AAC3B,MAAI,YAAY;AAEhB,QAAM,UAAU,CAAC,WAA6B;AAC5C,QAAI,UAAU,aAAa,UAAW,QAAO;AAC7C,QAAI,cAAc;AAClB,QAAI;AACF,oBAAc,uBAAuB,MAAM;AAAA,IAC7C,QAAQ;AACN,aAAO;AAAA,IACT;AACA,QAAI,CAAC,YAAa,QAAO;AACzB,UAAM,aAAa;AAAA,MACjB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,YAAY,mBAAmB,MAAM;AAAA,IACvC;AACA,QAAI;AACF,UAAI,eAAe,MAAM;AACvB,sBAAc;AAAA,UACZ;AAAA,UACA;AAAA,QACF;AAAA,MACF,OAAO;AACL;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,qBAAe,mBAAmB;AAAA,QAChC,MAAM;AAAA,QACN,MAAM;AAAA,QACN,QAAQ,EAAE,MAAM,yCAAyC;AAAA,MAC3D,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AACA,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,OAAO,OAAsB,WAAmC;AAC7E,QAAI,UAAW;AACf,gBAAY;AAEZ,UAAM,aAAa,mBAAmB,OAAO,OAAO,QAAQ,aAAa;AACzE,QAAI,UAAU,gBAAgB,UAAU;AACxC,UAAM,sBAAsB;AAC5B,QAAI;AACF,UAAI,qBAAqB;AACvB,YAAI;AACF,gBAAM,eAAe,oBAAoB,0BAA0B;AAAA,YACjE,MAAM,kBAAkB,KAAK;AAAA,YAC7B,OAAO;AAAA,YACP,eAAe;AAAA,YACf,OAAO;AAAA,UACT,CAAC;AACD,cAAI,cAAc;AAChB,uBAAW,gBAAgB;AAC3B,sBAAU,gBAAgB,UAAU;AAAA,UACtC;AAAA,QACF,QAAQ;AAAA,QAER;AACA,YAAI,SAAS;AACb,YAAI;AACF,8BAAoB,MAAM,SAAS,UAAU;AAC7C,mBAAS;AAAA,QACX,QAAQ;AAAA,QAER;AACA,YAAI,CAAC,QAAQ;AACX,0BAAgB,aAAa,OAAO;AAAA,QACtC;AACA,YAAI;AACF,gBAAM,OAAa,oBAAoB,UAAU,qBAAqB,UAAU;AAChF,eAAK,IAAI,EAAE,OAAO,KAAK,CAAC;AAAA,QAC1B,QAAQ;AAAA,QAER;AACA,cAAM,YAAY,qBAAqB,cAAc;AAAA,MACvD,OAAO;AACL,wBAAgB,aAAa,OAAO;AAAA,MACtC;AAAA,IACF,UAAE;AACA,qBAAe,KAAK,CAAC;AAAA,IACvB;AAAA,EACF;AAEA,QAAM,uBAAuB,CAAC,WAA0B;AACtD,QAAI,QAAQ,MAAM,EAAG;AACrB,SAAK,OAAO,uBAAuB,MAAM;AAAA,EAC3C;AACA,QAAM,sBAAsB,CAAC,WAA0B;AACrD,SAAK,OAAO,sBAAsB,MAAM;AAAA,EAC1C;AACA,iBAAe,GAAG,sBAAsB,oBAAoB;AAC5D,iBAAe,GAAG,qBAAqB,mBAAmB;AAE1D,SAAO;AAAA,IACL,qBAAqB,CAAC,UAAU;AAC9B,sBAAgB;AAAA,IAClB;AAAA,IACA,aAAa,MAAM;AACjB,cAAQ;AAAA,IACV;AAAA,IACA,sBAAsB,OAAO,WAAW;AACtC,YAAM,OAAO,mBAAmB,MAAM;AAAA,IACxC;AAAA,IACA,SAAS,MAAM;AACb,qBAAe,IAAI,sBAAsB,oBAAoB;AAC7D,qBAAe,IAAI,qBAAqB,mBAAmB;AAAA,IAC7D;AAAA,EACF;AACF;AAEA,SAAS,mBACP,OACA,OACA,QACA,eAQA;AACA,MAAI,oBAAoB;AACxB,MAAI;AACF,UAAM,YAAY,cAAc;AAChC,QAAI,iCAAiC,KAAK,SAAS,GAAG;AACpD,0BAAoB;AAAA,IACtB;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,WAAW,kBAAkB,KAAK;AAAA,IAClC,QAAQ;AAAA,IACR;AAAA,IACA,YAAY,mBAAmB,MAAM;AAAA,IACrC,eAAe;AAAA,EACjB;AACF;AAEA,SAAS,mBAAmB,QAAqC;AAC/D,MAAI,WAAW,KAAM,QAAO;AAC5B,QAAM,OAAO,OAAO;AACpB,MAAI,SAAS,SAAU,QAAO;AAC9B,MAAI;AACF,WAAO,kBAAkB,QAAQ,UAAU;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,YAA2D;AAClF,SACE,uCAAuC,WAAW,SAAS,WAClD,WAAW,KAAK,iBAAiB,WAAW,UAAU,oBAC7C,WAAW,aAAa;AAE9C;AAEA,eAAe,YACb,eACA,WACe;AACf,MAAI;AACJ,MAAI;AACF,YAAQ,QAAQ,QAAQ,cAAc,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EACtE,QAAQ;AACN;AAAA,EACF;AACA,MAAI,CAAC,OAAO,SAAS,SAAS,KAAK,aAAa,EAAG;AAEnD,MAAI;AACJ,MAAI;AACF,UAAM,QAAQ,KAAK;AAAA,MACjB;AAAA,MACA,IAAI,QAAc,CAAC,YAAY;AAC7B,kBAAU,WAAW,SAAS,SAAS;AAAA,MACzC,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,QAAI,YAAY,OAAW,cAAa,OAAO;AAAA,EACjD;AACF;AAEA,SAAS,gBAAgB,aAAwC,SAAuB;AACtF,MAAI;AACF,gBAAY,OAAO;AAAA,EACrB,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,yBAA0C;AACjD,SAAO;AAAA,IACL,IAAI,CAAC,OAAO,aAAa;AACvB,UAAI,UAAU,sBAAsB;AAClC,gBAAQ,GAAG,sBAAsB,QAAQ;AAAA,MAC3C,OAAO;AACL,gBAAQ,GAAG,qBAAqB,QAAQ;AAAA,MAC1C;AAAA,IACF;AAAA,IACA,KAAK,CAAC,OAAO,aAAa;AACxB,UAAI,UAAU,sBAAsB;AAClC,gBAAQ,IAAI,sBAAsB,QAAQ;AAAA,MAC5C,OAAO;AACL,gBAAQ,IAAI,qBAAqB,QAAQ;AAAA,MAC3C;AAAA,IACF;AAAA,IACA,MAAM,CAAC,SAAS;AACd,cAAQ,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACF;;;AnBpNA,SAAS,yBAAyB,OAAyB;AACzD,SAAO,iBAAiB;AAC1B;AAEA,IAAM,kBAAkB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,eAAsB,6BACpB,UACA,IAKC;AACD,QAAM,aAAa,MAAM,WAAW,QAAQ,0BAA0B,QAAQ,CAAC;AAC/E,QAAM,WAAW,IAAI,eAAe;AAAA,IAClC;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AACD,QAAM,iBAAiB,mCAAmC;AAAA,IACxD;AAAA,IACA,cAAc,CAAC,UAAU,SAAS,SAAS,aAAa,UAAU,IAAI;AAAA,IACtE,QAAQ,OAAO,SAAS;AACtB,YAAM,UAAU,wBAAwB,MAAM,SAAS,iBAAiB;AACxE,UAAI;AACF,cAAM,SAAS,SACZ,UAAU,KAAK,kBAAkB,EACjC,OAAO,MAAM,8BAA8B,OAAO,CAAC;AAAA,MACxD,SAAS,OAAO;AACd,YAAI,CAAC,qCAAqC,KAAK,EAAG,OAAM;AACxD,cAAM,SAAS,SAAS,OAAO,OAAO;AAAA,MACxC;AAAA,IACF;AAAA,IACA,QAAQ,OAAO,uBAAuB;AACpC,UAAI;AACF,cAAM,SAAS,SAAS,UAAU,kBAAkB,EAAE,OAAO;AAAA,MAC/D,SAAS,OAAO;AACd,YAAI,EAAE,iBAAiB,uBAAwB,OAAM;AAAA,MACvD;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,SAAgC;AAAA,IACpC,sBAAsB,OAAO,EAAE,WAAW,aAAa,MAAM,MAAM;AACjE,UAAI;AACF,cAAM,SAAS,SAAS,MAAM,yBAAyB;AAAA,UACrD,WAAW,SAAS;AAAA,UACpB,YAAY,kBAAkB,KAAK;AAAA,UACnC,uBAAuB;AAAA,UACvB,MAAM,CAAC,EAAE,WAAW,aAAa,MAAM,CAAC;AAAA,QAC1C,CAAC;AAAA,MACH,SAAS,OAAO;AACd,YAAI,yBAAyB,KAAK,EAAG;AACrC,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,mBAAmB,OAAO,EAAE,SAAS,WAAW,MAAM;AACpD,YAAM,SAAS,SAAS,UAAU,UAAU,EAAE,OAAO,eAAe,OAAO;AAAA,IAC7E;AAAA,IACA,qBAAqB,OAAO;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,MAAM;AACJ,YAAM,SAAS,SAAS,gBAAgB,mBAAmB;AAAA,QACzD,WAAW,SAAS;AAAA,QACpB;AAAA,QACA,uBAAuB;AAAA,QACvB,MAAM,CAAC,EAAE,WAAW,aAAa,UAAU,CAAC;AAAA,QAC5C,QAAQ,wBAAwB,mBAAmB;AAAA,MACrD,CAAC;AACD,yBAAmB;AACnB,aAAO,MAAM,iCAAiC,IAAI;AAAA,QAChD;AAAA,QACA;AAAA,QACA;AAAA,QACA,oBAAoB;AAAA,QACpB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,oCAAoC,YAAY;AAC9C,YAAM,SAAS,SAAS,gBAAgB,gDAAgD;AAAA,QACtF,WAAW,SAAS;AAAA,QACpB,YAAY;AAAA,QACZ,uBAAuB;AAAA,QACvB,MAAM,CAAC;AAAA,QACP,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,qBAAqB,OAAO;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,MAAM;AACJ,YAAM,SAAS,SAAS,gBAAgB,mBAAmB;AAAA,QACzD,WAAW,SAAS;AAAA,QACpB;AAAA,QACA,uBAAuB;AAAA,QACvB,MAAM,CAAC,EAAE,WAAW,aAAa,UAAU,CAAC;AAAA,QAC5C,QAAQ;AAAA,QACR,YAAY,CAAC,YAAY;AAAA,MAC3B,CAAC;AACD,YAAM,iCAAiC,IAAI;AAAA,QACzC;AAAA,QACA;AAAA,QACA;AAAA,QACA,oBAAoB;AAAA,QACpB,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,IACA,wBAAwB,OAAO;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,MAAM;AACJ,YAAM,SAAS,SAAS,gBAAgB,mBAAmB;AAAA,QACzD,WAAW,SAAS;AAAA,QACpB;AAAA,QACA,uBAAuB;AAAA,QACvB,MAAM,CAAC,EAAE,WAAW,aAAa,UAAU,CAAC;AAAA,QAC5C,QAAQ;AAAA,QACR,YAAY,CAAC,OAAO;AAAA,MACtB,CAAC;AACD,YAAM,iCAAiC,IAAI;AAAA,QACzC;AAAA,QACA;AAAA,QACA;AAAA,QACA,oBAAoB;AAAA,QACpB,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,IACA,mBAAmB,OAAO,EAAE,MAAM,UAAU,MAAM,eAAe,KAAK,MAAM,SAAS;AAAA,IACrF,6BAA6B,OAAO,EAAE,mBAAmB,MACvD,eAAe,OAAO,kBAAkB;AAAA,IAC1C,sBAAsB,OAAO;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,IAChB,MAAM;AAKJ,YAAM,aAAa;AACnB,UAAI;AACF,cAAM,SAAS,SAAS,MAAM,6BAA6B;AAAA,UACzD,WAAW,SAAS;AAAA,UACpB;AAAA,UACA,uBAAuB;AAAA,UACvB,MAAM;AAAA,YACJ;AAAA,cACE,WAAW,KAAK;AAAA,cAChB,aAAa,KAAK;AAAA,cAClB,QAAQ,KAAK;AAAA,cACb;AAAA,cACA;AAAA,cACA;AAAA,cACA,GAAI,wBAAwB,EAAE,sBAAsB,IAAI,CAAC;AAAA,YAC3D;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH,SAAS,OAAO;AAGd,YAAI,yBAAyB,KAAK,GAAG;AACnC;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,sBAAsB,OAAO,EAAE,aAAa,UAAU,WAAW,WAAW,MAAM;AAChF,YAAM,WAAW,YAAY;AAC7B,UAAI,CAAC,UAAU;AACb,cAAM,IAAI,MAAM,iEAAiE;AAAA,MACnF;AACA,UAAI;AACF,cAAM,SAAS,SAAS,MAAM,2BAA2B;AAAA,UACvD,WAAW,SAAS;AAAA,UACpB,YAAY,cAAc,oBAAoB,QAAQ,IAAI,OAAO,WAAW,CAAC;AAAA,UAC7E,uBAAuB;AAAA,UACvB,MAAM;AAAA,YACJ;AAAA,cACE;AAAA,cACA,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,cAC/B,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,YACnC;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH,SAAS,OAAO;AAGd,YAAI,yBAAyB,KAAK,EAAG;AACrC,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,OAAO,YAAY;AACjB,YAAM,WAAW,gBAAgB,cAAc,CAAC,CAAC;AAAA,IACnD;AAAA,EACF;AACA,QAAM,kBAAuC;AAAA,IAC3C,eAAe,OAAO,UAAU;AAC9B,YAAM,EAAE,WAAW,IAAI;AACvB,YAAM,aAAa,kBAAkB,UAAU,IAAI,OAAO,WAAW,CAAC;AACtE,YAAM,SAAS,SAAS,MAAM,yBAAyB;AAAA,QACrD,WAAW,SAAS;AAAA,QACpB;AAAA,QACA,MAAM,CAAC,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,YAAY;AACjB,YAAM,WAAW,MAAM;AAAA,IACzB;AAAA,EACF;AACF;AAEA,eAAsB,SACpB,UAGI,CAAC,GACL;AACA,QAAM,WAAW,QAAQ,YAAY,YAAY;AACjD,QAAM,gBACJ,QAAQ,iBAAiB,oBAAoB,UAAU,EAAE,WAAW,MAAM,CAAC;AAI7E,QAAM,aAAa,aAAa,QAAQ;AACxC,QAAM,WAAW,SAAS,SAAS,aAAa;AAAA,IAC9C,KAAK,SAAS;AAAA,IACd,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,IACnC,aAAa,SAAS;AAAA,EACxB,CAAC;AACD,MAAI;AACJ,MAAI;AACJ,QAAM,eAAe,oBAAoB,QAAQ;AACjD,QAAM,UAAU,CAAC,UACf,0BAA0B,eAAe,KAAK;AAChD,QAAM,kBAAkB;AAAA,IACtB,aAAa,SAAS;AAAA,IACtB,cAAc,SAAS;AAAA,IACvB,cAAc,SAAS,SAAS,KAAK,KAAK;AAAA,EAC5C;AAKA,QAAM,mBAAmB,4BAA4B,QAAQ;AAC7D,MAAI;AAOF,UAAM,EAAE,yBAAyB,IAAI,MAAM,OAAO,2BAA2B;AAC7E,UAAM;AAAA,MACJ;AAAA,MACA,MAAM,yBAAyB,QAAQ;AAAA,MACvC,EAAE,GAAG,cAAc,QAAQ;AAAA,IAC7B;AACA,UAAM;AAAA,MACJ;AAAA,MACA,MAAM,6BAA6B,SAAS,IAAI,eAAe;AAAA,MAC/D,EAAE,GAAG,cAAc,SAAS,aAAa,uCAAuC;AAAA,IAClF;AACA,UAAM,kBAAkB,MAAM;AAAA,MAC5B;AAAA,MACA,MAAM,uBAAuB,SAAS,IAAI,QAAQ;AAAA,MAClD,EAAE,GAAG,cAAc,QAAQ;AAAA,IAC7B;AACA,kBAAc,KAAK,mCAAmC;AAAA,MACpD,eAAe,gBAAgB;AAAA,MAC/B,gBAAgB,gBAAgB;AAAA,IAClC,CAAC;AACD,UAAM,MAAM;AAAA,MACV;AAAA,MACA,MACE;AAAA,QACE,SAAS;AAAA,QACT,mBACI,EAAE,MAAM,iBAAiB,MAAM,MAAM,iBAAiB,SAAS,IAC/D;AAAA,QACJ,6BAA6B,aAAa;AAAA,MAC5C;AAAA,MACF;AAAA,QACE,GAAG;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,qBAAiB,MAAM;AAAA,MACrB;AAAA,MACA,MAAM,6BAA6B,UAAU,SAAS,EAAE;AAAA,MACxD;AAAA,QACE,GAAG;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,QAAQ,WAAW,CAAC,KAAK,MAAM,GAAG,gBAAgB,MAAM,GAAG,SAAS,MAAM,CAAC,CAAC;AAClF,UAAM;AAAA,EACR;AACA,MAAI,CAAC,OAAO,CAAC,gBAAgB;AAC3B,UAAM,SAAS,MAAM;AACrB,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,QAAM,gBAAgB,oBAAoB,QAAQ;AAClD,MAAI;AACJ,MAAI,iBAAiB,4BAA4B,GAAG;AAClD,QAAI;AACF,oCAA8B,MAAM,4CAA4C;AAAA,QAC9E,IAAI,SAAS;AAAA,QACb;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,QAAQ,WAAW,CAAC,IAAI,MAAM,GAAG,eAAe,MAAM,GAAG,SAAS,MAAM,CAAC,CAAC;AAChF,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,EAAE,KAAK,UAAU,IAAI,qBAAqB;AAAA,IAC9C;AAAA,IACA,IAAI,SAAS;AAAA,IACb;AAAA,IACA,gBAAgB,eAAe;AAAA,IAC/B,iBAAiB,eAAe;AAAA,IAChC;AAAA,IACA,GAAI,8BACA;AAAA,MACE,mBAAmB,4BAA4B;AAAA,MAC/C,yBAAyB,4BAA4B;AAAA,MACrD,uBAAuB,4BAA4B;AAAA,MACnD,+BAA+B,4BAA4B;AAAA,IAC7D,IACA,CAAC;AAAA,IACL;AAAA,IACA,iBAAiB;AAAA,MACf,IAAI,0BAA0B,SAAS,IAAI,eAAe;AAAA,IAC5D;AAAA,EACF,CAAC;AACD,MAAI,CAAC,UAAU,mBAAmB;AAChC,kBAAc,KAAK,4CAA4C;AAAA,MAC7D,WAAW;AAAA,MACX,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,QAAM,qBAAqB,IAAI;AAAA,IAC7B,UAAU;AAAA,IACV,wCAAwC,SAAS;AAAA,EACnD;AACA,QAAM,0BAA0B,IAAI;AAAA,IAClC,kCAAkC,QAAQ;AAAA,EAC5C;AAIA,QAAM,uBAAuB,2BAA2B,UAAU;AAAA,IAChE,MAAM,CAAC,SAAS,eAAe,cAAc,KAAK,SAAS,UAAU;AAAA,EACvE,CAAC;AACD,QAAM,oBAAoB,CAAC,yBAAyB,kBAAkB;AACtE,QAAM,SAAS,IAAI,MAA8B;AAAA,IAC/C,UAAU,SAAS;AAAA,IACnB,MAAM,SAAS;AAAA,IACf,aAAa;AAAA,IACb,OAAO,CAAC,SAAS,cAAc;AAC7B,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,UAAI,QAAQ,QAAS,QAAO,QAAQ;AACpC,aAAO,IAAI;AAAA,QACT;AAAA,QACA,mCAAmC,UAAU,UAAU,OAAO,GAAG,OAAO;AAAA,MAC1E;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,kBAAkB;AAAA,MAClB,mBAAmB,KAAK,OAAO;AAAA,MAC/B,0BAA0B;AAAA,MAC1B,MAAM,CAAC,WAAW,OAAO,KAAK,OAAO,MAAM;AAAA,MAC3C,SAAS,CAAC,QAAQ,YAAY,OAAO,KAAK,QAAQ,OAAO;AAAA,MACzD,OAAO,CAAC,WAAW,OAAO,KAAK,gBAAgB;AAAA,IACjD;AAAA,EACF,CAAC;AACD,QAAM,gBAAgB,wBAAwB,UAAU,aAAa;AACrE,QAAM,2BAA2B,SAAS,qBACtC,0BAA0B,SAAS,IACnC;AACJ,QAAM,iCAAiC,gCAAgC,SAAS;AAChF,QAAM,mCAAmC,kCAAkC;AAAA,IACzE,IAAI,SAAS;AAAA,IACb;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,6BAA6B,4BAA4B;AAAA,IAC7D,IAAI,SAAS;AAAA,IACb;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,kCAAkC,iCAAiC;AAAA,IACvE,IAAI,SAAS;AAAA,IACb,+BAA+B,OAAO,UACpC,MAAM,2CAA2C,WAAW,KAAK;AAAA,IACnE,gBAAgB,OAAO,uBAAuB;AAC5C,YAAM,eAAe,OAAO,4BAA4B,EAAE,mBAAmB,CAAC;AAAA,IAChF;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,iCAAiC,gCAAgC;AAAA,IACrE,IAAI,SAAS;AAAA,IACb,MAAM,CAAC,SAAS,eAAe,OAAO,kBAAkB,EAAE,KAAK,CAAC;AAAA,IAChE;AAAA,IACA;AAAA,EACF,CAAC;AAGD,MAAI;AAIJ,MAAI;AAOJ,MAAI;AACJ,MAAI,SAAS,0BAA0B;AACrC,2BAAuB,sBAAsB;AAAA,MAC3C,IAAI,SAAS;AAAA,MACb;AAAA,MACA;AAAA,MACA,cAAc,4BAA4B;AAAA,QACxC,IAAI,SAAS;AAAA,QACb;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AACD,yBAAqB,oBAAoB;AAAA,MACvC,IAAI,SAAS;AAAA,MACb;AAAA,MACA;AAAA,IACF,CAAC;AACD,kBAAc,KAAK,gEAAgE,CAAC,CAAC;AAErF,UAAM,UAAU,yBAAyB,QAAQ;AACjD,QAAI,SAAS;AACX,UAAI;AACF,+BAAuB,MAAM;AAAA,UAC3B,EAAE,IAAI,SAAS,IAAI,UAAU,SAAS,cAAc;AAAA,UACpD,SAAS;AAAA,QACX;AAAA,MACF,QAAQ;AAGN,sBAAc,MAAM,wDAAwD;AAAA,UAC1E,YAAY;AAAA,UACZ,WAAW;AAAA,UACX,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF,OAAO;AACL,oBAAc;AAAA,QACZ;AAAA,QACA,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,gBAAc,KAAK,0BAA0B;AAAA,IAC3C,MAAM,SAAS;AAAA,IACf,MAAM,SAAS;AAAA,IACf,GAAI,gBAAgB,EAAE,aAAa,SAAS,eAAe,IAAI,CAAC;AAAA,EAClE,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA,OAAO,YAAY;AACjB,aAAO,KAAK,IAAI;AAChB,qBAAe,KAAK,IAAI;AACxB,iCAA2B;AAC3B,YAAM,+BAA+B;AACrC,6BAAuB;AACvB,2BAAqB;AACrB,YAAM,gCAAgC;AACtC,YAAM,+BAA+B;AACrC,YAAM,iCAAiC;AACvC,YAAM,2BAA2B;AAEjC,YAAM,UAAU,cAAc,MAAM,EAAE,MAAM,MAAM,MAAS;AAC3D,YAAM,QAAQ,WAAW;AAAA,QACvB,QAAQ,QAAQ,6BAA6B,MAAM,CAAC;AAAA,QACpD,sBAAsB,MAAM;AAAA,QAC5B,IAAI,MAAM;AAAA,QACV,eAAe,MAAM;AAAA,QACrB,SAAS,MAAM;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,IAAI,YAAY,MAAM;AACpB,QAAM,gBAAgB,+BAA+B;AACrD,MAAI;AACF,UAAM,WAAW,YAAY;AAC7B,UAAM,gBAAgB,oBAAoB,UAAU,EAAE,WAAW,MAAM,CAAC;AACxE,kBAAc,oBAAoB,aAAa;AAC/C,UAAM,SAAS,EAAE,UAAU,cAAc,CAAC;AAC1C,kBAAc,YAAY;AAAA,EAC5B,SAAS,OAAO;AACd,UAAM,cAAc,qBAAqB,KAAK;AAAA,EAChD;AACF;AAEO,SAAS,sBAAsB,QAA2D;AAC/F,MAAI,WAAW,QAAQ;AACrB,WAAO,sBAAsB;AAAA,EAC/B;AACA,MAAI,WAAW,cAAc;AAC3B,WAAO,sBAAsB;AAAA,EAC/B;AACA,SAAO,sBAAsB;AAC/B;AAEO,SAAS,qCAAqC,OAAyB;AAC5E,SAAO,iBAAiB;AAC1B;AAEO,SAAS,qBAAqB,UAAmD;AACtF,MAAI,SAAS,SAAS,UAAU;AAC9B,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,MAAI,SAAS,SAAS,YAAY;AAChC,WAAO;AAAA,MACL,WAAW,CAAC,qBAAqB,QAAQ,CAAC;AAAA,MAC1C,GAAI,SAAS,UAAU,EAAE,SAAS,IAAI,KAAK,SAAS,OAAO,EAAE,IAAI,CAAC;AAAA,MAClE,GAAI,SAAS,QAAQ,EAAE,OAAO,IAAI,KAAK,SAAS,KAAK,EAAE,IAAI,CAAC;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,SAAS,SAAS,YAAY;AAChC,WAAO;AAAA,MACL,WAAW;AAAA,QACT;AAAA,UACE,MAAM,SAAS;AAAA,UACf,QAAQ,SAAS;AAAA,UACjB,QAAQ;AAAA,UACR,GAAI,SAAS,aAAa,EAAE,WAAW,SAAS,WAAW,IAAI,CAAC;AAAA,QAClE;AAAA,MACF;AAAA,MACA,UAAU,SAAS;AAAA,IACrB;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,KAAK,SAAS,KAAK;AACrC,SAAO;AAAA,IACL,WAAW;AAAA,MACT;AAAA,QACE,MAAM,MAAM,eAAe;AAAA,QAC3B,OAAO,cAAc,MAAM,YAAY,CAAC;AAAA,QACxC,YAAY,MAAM,WAAW;AAAA,QAC7B,MAAM,MAAM,YAAY;AAAA,QACxB,QAAQ,MAAM,cAAc;AAAA,QAC5B,QAAQ,MAAM,cAAc;AAAA,MAC9B;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AACF;AAEA,SAAS,qBACP,UACgD;AAChD,QAAM,QAAQ,GAAG,SAAS,YAAY;AACtC,MAAI,CAAC,SAAS,SAAS;AACrB,WAAO,EAAE,MAAM;AAAA,EACjB;AAOA,QAAM,oBAAoB,OAAO,SAAS,YAAY,IAAI;AAC1D,QAAM,oBAAoB,OAAO,IAAI,KAAK,SAAS,OAAO,EAAE,QAAQ,CAAC;AACrE,QAAM,sBACF,oBAAoB,oBAAqB,qBAAqB;AAClE,SAAO;AAAA,IACL;AAAA,IACA,GAAI,uBAAuB,KAAK,CAAC,IAAI,EAAE,QAAQ,GAAG,kBAAkB,KAAsB;AAAA,EAC5F;AACF;AAEA,SAAS,cAAc,YAAoB;AACzC,SAAO,gBAAgB,UAAU;AACnC;AAEA,SAAS,wBAAwB,MAAqB,WAAoC;AACxF,SAAO;AAAA,IACL,YAAY,KAAK;AAAA,IACjB,MAAM,qBAAqB,KAAK,QAAQ;AAAA,IACxC,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,cAAc;AAAA,MACd;AAAA,MACA,MAAM;AAAA,QACJ;AAAA,UACE,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,QAAQ,KAAK;AAAA,UACb,aAAa;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR,SAAS,sBAAsB,KAAK,aAAa;AAAA,MACjD,eAAe;AAAA,MACf,gBAAgB;AAAA,IAClB;AAAA,IACA,OAAO;AAAA,MACL,QAAQ,+BAA+B,IAAI;AAAA,MAC3C,GAAI,KAAK,SAAS,SAAS,SAAS,EAAE,kBAAkB,EAAE,IAAI,CAAC;AAAA,IACjE;AAAA,IACA,MAAM;AAAA,MACJ,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,iBAAiB,KAAK;AAAA,MACtB,MAAM,KAAK;AAAA,IACb;AAAA,EACF;AACF;AAEA,SAAS,+BAA+B,MAA8B;AACpE,MAAI,KAAK,WAAW,SAAU,QAAO;AACrC,MAAI,CAAC,6BAA6B,IAAI,EAAG,QAAO;AAChD,QAAM,UAAU,KAAK,SAAS;AAC9B,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,QAAM,SAAS;AACf,SAAO,OAAO,kBAAkB,SAAS,OAAO,qBAAqB;AACvE;AAEA,SAAS,8BAA8B,SAAiD;AACtF,SAAO;AAAA,IACL,MAAM,QAAQ;AAAA,IACd,QAAQ,QAAQ;AAAA,IAChB,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD,OAAO,QAAQ,SAAS,CAAC;AAAA,IACzB,GAAI,QAAQ,mBAAmB,EAAE,kBAAkB,QAAQ,iBAAiB,IAAI,CAAC;AAAA,IACjF,GAAI,QAAQ,wBACR,EAAE,uBAAuB,QAAQ,sBAAsB,IACvD,CAAC;AAAA,EACP;AACF;","names":["response","getEnrollment","getEnrollment","enrollment","appendAndPublishEvents","randomUUID","CLAIM_SECONDS","POLL_INTERVAL_MS","PRUNE_EVERY_TICKS","createHash","randomUUID","MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES","withRlsContext","MAX_BOUNDED_OBJECT_CHUNK_BYTES","createHash","createHash","replayedTarget","createHash","MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES","editableArtifactCausalFrontier","editableArtifactContentHash","editableArtifactReplicaId","editableArtifactStateHash","throwIfAborted","createHash","retryWhileMissing","throwIfAborted","withRlsContext","randomUUID","MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES","createHash","MAX_BOUNDED_OBJECT_CHUNK_BYTES","randomUUID"]}
+{"version":3,"sources":["../src/index.ts","../src/observability.ts","../src/sandbox/auth-callout.ts","../src/sandbox/connection-authority.ts","../src/sandbox/metrics-ingestion.ts","../src/memory-slack-delivery.ts","../src/scheduled-task-lifecycle.ts","../src/scheduled-task-blockers.ts","../src/temporal-schedule-sync.ts","../src/native-push-dispatch.ts","../src/workspace-webhook-dispatch.ts","../src/editable-artifact-websocket.ts","../src/editable-artifact-source-session.ts","../src/http/websocket-upgrade-dispatch.ts","../src/editable-artifact-production.ts","../src/editable-artifact-live-hints.ts","../src/editable-artifact-native-kernel.ts","../src/editable-artifact-office-import.ts","../src/editable-artifact-workspace-files.ts","../src/fatal-process-boundary.ts","../src/shutdown.ts"],"sourcesContent":["import { scheduledTaskKnowledgeSource } from \"@opengeni/contracts\";\nimport {\n  dbSearchPath,\n  getSettings,\n  resolveFirstPartyDelegationSecret,\n  resolveNatsCalloutConfig,\n  resolveNatsControlPlaneAuth,\n  retryStartupDependency,\n  startupRetryOptions,\n  temporalConnectionOptions,\n} from \"@opengeni/config\";\nimport type {\n  ScheduledTask,\n  ScheduledTaskOverlapPolicy,\n  ScheduledTaskScheduleSpec,\n} from \"@opengeni/contracts\";\nimport {\n  assertRuntimeDatabasePosture,\n  isRetryableRuntimeDatabaseStartupError,\n  createDb,\n  markSessionWorkflowWakeDelivered,\n  runtimeDatabaseReadyCheck,\n  type Database,\n} from \"@opengeni/db\";\nimport { createNatsEventBus, type ResponderConnection } from \"@opengeni/events\";\nimport {\n  createObservability,\n  logStartupDependencyRetry,\n  type Observability,\n} from \"@opengeni/observability\";\nimport { createObjectStorage } from \"@opengeni/storage\";\nimport { isArtifactRuntimeConfigured } from \"@opengeni/artifact-tool/runtime/development\";\nimport {\n  resolveCatalogSettings,\n  SESSION_WORKFLOW_WAKE_DISPATCH_REQUESTED_SIGNAL,\n  SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_ID,\n  SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE,\n} from \"@opengeni/core\";\nimport {\n  Connection,\n  Client as TemporalClient,\n  ScheduleNotFoundError,\n  ScheduleOverlapPolicy,\n  WorkflowExecutionAlreadyStartedError,\n} from \"@temporalio/client\";\nimport type { ScheduleOptions, ScheduleSpec, ScheduleUpdateOptions } from \"@temporalio/client\";\nimport { createAppComposition, type DocumentIndexClient, type SessionWorkflowClient } from \"./app\";\nimport { observabilityEventBusOptions } from \"./observability\";\nimport { startAuthCalloutResponder } from \"./sandbox/auth-callout\";\nimport { startHelloIngestion, startMetricsIngestion } from \"./sandbox/metrics-ingestion\";\nimport { createAutomaticAgentUpdater } from \"./sandbox/agent-update\";\nimport { startSlackInteractionPump } from \"./integrations/slack-interactions\";\nimport { startMemorySlackPublicationPump } from \"./memory-slack-delivery\";\nimport { startTemporalScheduleCleanupPump } from \"./temporal-schedule-cleanup\";\nimport { closeNativeExternalVaultProviders } from \"./integrations/external-vault-providers\";\nimport { startScheduledTaskLifecyclePump } from \"./scheduled-task-lifecycle\";\nimport { createTemporalScheduleSynchronizer } from \"./temporal-schedule-sync\";\nimport { startNativePushDispatchPump } from \"./native-push-dispatch\";\nimport { startWorkspaceWebhookDispatchPump } from \"./workspace-webhook-dispatch\";\nimport { cleanupScheduledTaskConnectorAuthorization } from \"./scheduled-task-deletion\";\nimport {\n  EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES,\n  EditableArtifactWebSocketTransport,\n} from \"./editable-artifact-websocket\";\nimport { editableArtifactSourceSessionAuthorizer } from \"./editable-artifact-source-session\";\nimport type { ApiWebSocketConnection } from \"./api-websocket\";\nimport { InteractionFrameProxyTransport } from \"./interaction-frame-proxy\";\nimport { apiRequestBindingsForTransportPeer } from \"./http/request-source\";\nimport { startApiMetricsListener } from \"./http/metrics-listener\";\nimport { createLocalBrowserBoundary } from \"./http/local-browser-boundary\";\nimport { dispatchApiWebSocketUpgrade } from \"./http/websocket-upgrade-dispatch\";\nimport {\n  createStandaloneEditableArtifactApplication,\n  type StandaloneEditableArtifactApplication,\n} from \"./editable-artifact-production\";\nimport { installApiFatalProcessBoundary } from \"./fatal-process-boundary\";\nimport { installApiShutdownHandlers } from \"./shutdown\";\n\n/**\n * A REJECT_DUPLICATE start collides on the deterministic workflowId when the\n * same manual trigger token fires twice. Temporal surfaces that as\n * WorkflowExecutionAlreadyStartedError; the caller treats it as an idempotent\n * no-op rather than a failure.\n */\nfunction isWorkflowAlreadyStarted(error: unknown): boolean {\n  return error instanceof WorkflowExecutionAlreadyStartedError;\n}\n\nconst TEMPORAL_MONTHS = [\n  \"JANUARY\",\n  \"FEBRUARY\",\n  \"MARCH\",\n  \"APRIL\",\n  \"MAY\",\n  \"JUNE\",\n  \"JULY\",\n  \"AUGUST\",\n  \"SEPTEMBER\",\n  \"OCTOBER\",\n  \"NOVEMBER\",\n  \"DECEMBER\",\n] as const;\n\nexport async function createTemporalWorkflowClient(\n  settings: ReturnType<typeof getSettings>,\n  db: Database,\n): Promise<{\n  client: SessionWorkflowClient;\n  documentIndexer: DocumentIndexClient;\n  close: () => Promise<void>;\n}> {\n  const connection = await Connection.connect(temporalConnectionOptions(settings));\n  const temporal = new TemporalClient({\n    connection,\n    namespace: settings.temporalNamespace,\n  });\n  const scheduledTasks = createTemporalScheduleSynchronizer({\n    db,\n    withDeadline: (deadline, work) => temporal.withDeadline(deadline, work),\n    upsert: async (task) => {\n      const options = temporalScheduleOptions(task, settings.temporalTaskQueue);\n      try {\n        await temporal.schedule\n          .getHandle(task.temporalScheduleId)\n          .update(() => temporalScheduleUpdateOptions(options));\n      } catch (error) {\n        if (!shouldCreateScheduleAfterUpdateError(error)) throw error;\n        await temporal.schedule.create(options);\n      }\n    },\n    remove: async (temporalScheduleId) => {\n      try {\n        await temporal.schedule.getHandle(temporalScheduleId).delete();\n      } catch (error) {\n        if (!(error instanceof ScheduleNotFoundError)) throw error;\n      }\n    },\n  });\n  const client: SessionWorkflowClient = {\n    triggerAutomationRun: async ({ accountId, workspaceId, runId }) => {\n      try {\n        await temporal.workflow.start(\"automationRunWorkflow\", {\n          taskQueue: settings.temporalTaskQueue,\n          workflowId: `automation-run:${runId}`,\n          workflowIdReusePolicy: \"REJECT_DUPLICATE\",\n          args: [{ accountId, workspaceId, runId }],\n        });\n      } catch (error) {\n        if (isWorkflowAlreadyStarted(error)) return;\n        throw error;\n      }\n    },\n    signalUserMessage: async ({ eventId, workflowId }) => {\n      await temporal.workflow.getHandle(workflowId).signal(\"userMessage\", eventId);\n    },\n    wakeSessionWorkflow: async ({\n      accountId,\n      workspaceId,\n      sessionId,\n      workflowId,\n      wakeRevision,\n      interruptionRequested,\n      onSignalAccepted,\n    }) => {\n      await temporal.workflow.signalWithStart(\"sessionWorkflow\", {\n        taskQueue: settings.temporalTaskQueue,\n        workflowId,\n        workflowIdReusePolicy: \"ALLOW_DUPLICATE\",\n        args: [{ accountId, workspaceId, sessionId }],\n        signal: interruptionRequested ? \"sessionControl\" : \"queueChanged\",\n      });\n      onSignalAccepted?.();\n      return await markSessionWorkflowWakeDelivered(db, {\n        accountId,\n        workspaceId,\n        sessionId,\n        temporalWorkflowId: workflowId,\n        wakeRevision,\n      });\n    },\n    requestSessionWorkflowWakeDispatch: async () => {\n      await temporal.workflow.signalWithStart(SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE, {\n        taskQueue: settings.temporalTaskQueue,\n        workflowId: SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_ID,\n        workflowIdReusePolicy: \"ALLOW_DUPLICATE\",\n        args: [],\n        signal: SESSION_WORKFLOW_WAKE_DISPATCH_REQUESTED_SIGNAL,\n      });\n    },\n    signalCodexCapacity: async ({\n      accountId,\n      workspaceId,\n      sessionId,\n      workflowId,\n      wakeRevision,\n      workflowWakeRevision,\n    }) => {\n      await temporal.workflow.signalWithStart(\"sessionWorkflow\", {\n        taskQueue: settings.temporalTaskQueue,\n        workflowId,\n        workflowIdReusePolicy: \"ALLOW_DUPLICATE\",\n        args: [{ accountId, workspaceId, sessionId }],\n        signal: \"codexCapacityChanged\",\n        signalArgs: [wakeRevision],\n      });\n      await markSessionWorkflowWakeDelivered(db, {\n        accountId,\n        workspaceId,\n        sessionId,\n        temporalWorkflowId: workflowId,\n        wakeRevision: workflowWakeRevision,\n      });\n    },\n    signalApprovalDecision: async ({\n      accountId,\n      workspaceId,\n      sessionId,\n      eventId,\n      workflowId,\n      workflowWakeRevision,\n    }) => {\n      await temporal.workflow.signalWithStart(\"sessionWorkflow\", {\n        taskQueue: settings.temporalTaskQueue,\n        workflowId,\n        workflowIdReusePolicy: \"ALLOW_DUPLICATE\",\n        args: [{ accountId, workspaceId, sessionId }],\n        signal: \"approvalDecision\",\n        signalArgs: [eventId],\n      });\n      await markSessionWorkflowWakeDelivered(db, {\n        accountId,\n        workspaceId,\n        sessionId,\n        temporalWorkflowId: workflowId,\n        wakeRevision: workflowWakeRevision,\n      });\n    },\n    syncScheduledTask: async ({ task, onFailure }) => scheduledTasks.sync(task, onFailure),\n    deleteScheduledTaskSchedule: async ({ temporalScheduleId }) =>\n      scheduledTasks.remove(temporalScheduleId),\n    triggerScheduledTask: async ({\n      task,\n      agentRunUsageIdempotencyKey,\n      triggerWorkflowId,\n      initiator,\n      credentialRestriction,\n      triggerType = \"manual\",\n    }) => {\n      // Deterministic workflowId (derived from the trigger token by the\n      // caller) + REJECT_DUPLICATE makes a retried manual trigger idempotent:\n      // the second start collides on the id and is rejected instead of\n      // spawning a second run. The shared idempotency key dedupes the charge.\n      const workflowId = triggerWorkflowId;\n      try {\n        await temporal.workflow.start(\"scheduledTaskFireWorkflow\", {\n          taskQueue: settings.temporalTaskQueue,\n          workflowId,\n          workflowIdReusePolicy: \"REJECT_DUPLICATE\",\n          args: [\n            {\n              accountId: task.accountId,\n              workspaceId: task.workspaceId,\n              taskId: task.id,\n              triggerType,\n              agentRunUsageIdempotencyKey,\n              initiator,\n              ...(credentialRestriction ? { credentialRestriction } : {}),\n            },\n          ],\n        });\n      } catch (error) {\n        // A duplicate trigger token started this run already; treat the retry\n        // as a no-op so the (idempotent) usage charge stays the only effect.\n        if (isWorkflowAlreadyStarted(error)) {\n          return;\n        }\n        throw error;\n      }\n    },\n    startRigVerification: async ({ workspaceId, changeId, versionId, workflowId }) => {\n      const targetId = changeId ?? versionId;\n      if (!targetId) {\n        throw new Error(\"sandbox environment verification requires changeId or versionId\");\n      }\n      try {\n        await temporal.workflow.start(\"rigVerificationWorkflow\", {\n          taskQueue: settings.temporalTaskQueue,\n          workflowId: workflowId ?? `rig-verification-${targetId}-${crypto.randomUUID()}`,\n          workflowIdReusePolicy: \"REJECT_DUPLICATE\",\n          args: [\n            {\n              workspaceId,\n              ...(changeId ? { changeId } : {}),\n              ...(versionId ? { versionId } : {}),\n            },\n          ],\n        });\n      } catch (error) {\n        // A lost start acknowledgement is indistinguishable from a retry. The\n        // caller-owned workflow id makes both cases the same successful start.\n        if (isWorkflowAlreadyStarted(error)) return;\n        throw error;\n      }\n    },\n    check: async () => {\n      await connection.workflowService.getSystemInfo({});\n    },\n  };\n  const documentIndexer: DocumentIndexClient = {\n    indexDocument: async (input) => {\n      const { documentId } = input;\n      const workflowId = `document-index-${documentId}-${crypto.randomUUID()}`;\n      await temporal.workflow.start(\"documentIndexWorkflow\", {\n        taskQueue: settings.temporalTaskQueue,\n        workflowId,\n        args: [input],\n      });\n    },\n  };\n  return {\n    client,\n    documentIndexer,\n    close: async () => {\n      await connection.close();\n    },\n  };\n}\n\nexport async function startApi(\n  options: {\n    settings?: ReturnType<typeof getSettings>;\n    observability?: Observability;\n  } = {},\n) {\n  const settings = options.settings ?? getSettings();\n  const observability =\n    options.observability ?? createObservability(settings, { component: \"api\" });\n  // Step I: standalone → dbSchema unset → searchPath undefined → today's plain\n  // handle (public). Embedded → scoped to the dedicated schema + the host's RLS\n  // strategy.\n  const searchPath = dbSearchPath(settings);\n  const dbClient = createDb(settings.databaseUrl, {\n    max: settings.apiDatabasePoolMax,\n    ...(searchPath ? { searchPath } : {}),\n    rlsStrategy: settings.rlsStrategy,\n  });\n  let bus: Awaited<ReturnType<typeof createNatsEventBus>> | undefined;\n  let workflowClient: Awaited<ReturnType<typeof createTemporalWorkflowClient>> | undefined;\n  const retryOptions = startupRetryOptions(settings);\n  const onRetry = (event: Parameters<typeof logStartupDependencyRetry>[1]) =>\n    logStartupDependencyRetry(observability, event);\n  const databasePosture = {\n    rlsStrategy: settings.rlsStrategy,\n    expectedRole: settings.runtimeDatabaseRole,\n    targetSchema: settings.dbSchema.trim() || \"public\",\n  } as const;\n  // The PRIVILEGED control-plane NATS login (M-AUTH): when the server runs with\n  // auth_callout, api/worker authenticate as a static account user permitted to\n  // request exact generation-fenced agent RPC subjects. Null in local dev\n  // (anonymous connect — the bus default).\n  const controlPlaneAuth = resolveNatsControlPlaneAuth(settings);\n  try {\n    // Browser, Computer, Terminal, and Files can cold-create the home sandbox\n    // directly from this API process. Resolve the same private-registry Modal\n    // image before the API becomes reachable so the first human interaction\n    // does not pay the provider import/build latency. This mirrors the turn\n    // worker's startup boundary and is a no-op for provider-native image IDs,\n    // public images, and non-Modal backends.\n    const { ensureModalRegistryImage } = await import(\"@opengeni/runtime/sandbox\");\n    await retryStartupDependency(\n      \"Modal private-registry image\",\n      () => ensureModalRegistryImage(settings),\n      { ...retryOptions, onRetry },\n    );\n    await retryStartupDependency(\n      \"PostgreSQL runtime posture\",\n      () => assertRuntimeDatabasePosture(dbClient.db, databasePosture),\n      { ...retryOptions, onRetry, shouldRetry: isRetryableRuntimeDatabaseStartupError },\n    );\n    const resolvedCatalog = await retryStartupDependency(\n      \"model catalog\",\n      () => resolveCatalogSettings(dbClient.db, settings),\n      { ...retryOptions, onRetry },\n    );\n    observability.info(\"Opengeni model catalog resolved\", {\n      catalogSource: resolvedCatalog.source,\n      catalogVersion: resolvedCatalog.version,\n    });\n    bus = await retryStartupDependency(\n      \"NATS\",\n      () =>\n        createNatsEventBus(\n          settings.natsUrl,\n          controlPlaneAuth\n            ? { user: controlPlaneAuth.user, pass: controlPlaneAuth.password }\n            : undefined,\n          observabilityEventBusOptions(observability),\n        ),\n      {\n        ...retryOptions,\n        onRetry,\n      },\n    );\n    workflowClient = await retryStartupDependency(\n      \"Temporal\",\n      () => createTemporalWorkflowClient(settings, dbClient.db),\n      {\n        ...retryOptions,\n        onRetry,\n      },\n    );\n  } catch (error) {\n    await Promise.allSettled([bus?.close(), workflowClient?.close(), dbClient.close()]);\n    throw error;\n  }\n  if (!bus || !workflowClient) {\n    await dbClient.close();\n    throw new Error(\"Opengeni API startup dependencies were not initialized\");\n  }\n  const objectStorage = createObjectStorage(settings);\n  let editableArtifactComposition: StandaloneEditableArtifactApplication | undefined;\n  if (objectStorage && isArtifactRuntimeConfigured()) {\n    try {\n      editableArtifactComposition = await createStandaloneEditableArtifactApplication({\n        db: dbClient.db,\n        bus,\n        objectStorage,\n      });\n    } catch (error) {\n      await Promise.allSettled([bus.close(), workflowClient.close(), dbClient.close()]);\n      throw error;\n    }\n  }\n  const { app, routeDeps } = createAppComposition({\n    settings,\n    db: dbClient.db,\n    bus,\n    workflowClient: workflowClient.client,\n    documentIndexer: workflowClient.documentIndexer,\n    objectStorage,\n    ...(editableArtifactComposition\n      ? {\n          editableArtifacts: editableArtifactComposition.application,\n          editableArtifactExports: editableArtifactComposition.durableExports,\n          editableArtifactAgent: editableArtifactComposition.agent,\n          editableArtifactOfficeImports: editableArtifactComposition.officeImports,\n        }\n      : {}),\n    observability,\n    readinessChecks: {\n      db: runtimeDatabaseReadyCheck(dbClient.db, databasePosture),\n    },\n  });\n  if (!routeDeps.editableArtifacts) {\n    observability.warn(\"editable artifact engine is not composed\", {\n      subsystem: \"editable_artifacts\",\n      behavior: \"http_and_websocket_fail_closed\",\n    });\n  }\n  const artifactWebSockets = new EditableArtifactWebSocketTransport(\n    routeDeps.editableArtifacts,\n    editableArtifactSourceSessionAuthorizer(routeDeps),\n  );\n  const interactionFrameProxies = new InteractionFrameProxyTransport(\n    resolveFirstPartyDelegationSecret(settings),\n  );\n  // WebSocket upgrades bypass the Hono app, so the local-mode browser boundary\n  // (http/local-browser-boundary.ts) is applied to them in the dispatcher;\n  // every other request meets it in the Hono middleware.\n  const localBrowserBoundary = createLocalBrowserBoundary(settings, {\n    warn: (message, attributes) => observability.warn(message, attributes),\n  });\n  const webSocketUpgrades = [interactionFrameProxies, artifactWebSockets];\n  const server = Bun.serve<ApiWebSocketConnection>({\n    hostname: settings.apiHost,\n    port: settings.apiPort,\n    idleTimeout: 255,\n    fetch: (request, bunServer) => {\n      const upgrade = dispatchApiWebSocketUpgrade(\n        request,\n        bunServer,\n        webSocketUpgrades,\n        localBrowserBoundary,\n      );\n      if (upgrade.handled) return upgrade.response;\n      return app.fetch(\n        request,\n        apiRequestBindingsForTransportPeer(bunServer.requestIP(request)?.address),\n      );\n    },\n    websocket: {\n      maxPayloadLength: EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES,\n      backpressureLimit: 16 * 1024 * 1024,\n      closeOnBackpressureLimit: true,\n      open: (socket) => socket.data.attach(socket),\n      message: (socket, message) => socket.data.receive(message),\n      close: (socket) => socket.data.transportClosed(),\n    },\n  });\n  const metricsServer = startApiMetricsListener(settings, observability);\n  const stopSlackInteractionPump = settings.slackSigningSecret\n    ? startSlackInteractionPump(routeDeps)\n    : undefined;\n  const stopMemorySlackPublicationPump = startMemorySlackPublicationPump(routeDeps);\n  const stopWorkspaceWebhookDispatchPump = startWorkspaceWebhookDispatchPump({\n    db: dbClient.db,\n    settings,\n    observability,\n  });\n  const stopNativePushDispatchPump = startNativePushDispatchPump({\n    db: dbClient.db,\n    settings,\n    observability,\n  });\n  const stopTemporalScheduleCleanupPump = startTemporalScheduleCleanupPump({\n    db: dbClient.db,\n    cleanupConnectorAuthorization: async (claim) =>\n      await cleanupScheduledTaskConnectorAuthorization(routeDeps, claim),\n    deleteSchedule: async (temporalScheduleId) => {\n      await workflowClient.client.deleteScheduledTaskSchedule({ temporalScheduleId });\n    },\n    observability,\n  });\n  const stopScheduledTaskLifecyclePump = startScheduledTaskLifecyclePump({\n    db: dbClient.db,\n    sync: (task) => workflowClient.client.syncScheduledTask({ task }),\n    bus,\n    observability,\n  });\n  // M10 — start the metrics-ingestion consumer (agent heartbeats → DB last-sample\n  // + downsampled series), gated on the selfhosted flag. A no-op when disabled.\n  let stopMetricsIngestion: (() => void) | undefined;\n  // Reconcile enrollments.has_display to the LIVE capability the agent reports in\n  // its connect Hello (has_display was frozen at the enroll-time snapshot). Gated\n  // on the same selfhosted flag.\n  let stopHelloIngestion: (() => void) | undefined;\n  // M-AUTH — start the NATS auth-callout responder (the tenancy boundary): it\n  // validates an agent's enrollment bearer presented at NATS connect and mints a\n  // workspace-scoped user JWT. Gated on the selfhosted flag + a resolvable callout\n  // config; without the callout plane it never starts (selfhosted agents simply\n  // cannot connect — graceful). It runs on its OWN connection (the callout auth\n  // user), separate from the privileged control-plane bus.\n  let authCalloutResponder: ResponderConnection | undefined;\n  if (settings.sandboxSelfhostedEnabled) {\n    stopMetricsIngestion = startMetricsIngestion({\n      db: dbClient.db,\n      bus,\n      observability,\n      agentUpdates: createAutomaticAgentUpdater({\n        db: dbClient.db,\n        bus,\n        settings,\n        observability,\n      }),\n    });\n    stopHelloIngestion = startHelloIngestion({\n      db: dbClient.db,\n      bus,\n      observability,\n    });\n    observability.info(\"Opengeni machine-metrics + hello ingestion consumers started\", {});\n\n    const callout = resolveNatsCalloutConfig(settings);\n    if (callout) {\n      try {\n        authCalloutResponder = await startAuthCalloutResponder(\n          { db: dbClient.db, settings, callout, observability },\n          settings.natsUrl,\n        );\n      } catch {\n        // A responder start failure must not crash the API (other planes work); log\n        // loudly — selfhosted agents will fail to connect until it is up.\n        observability.error(\"Opengeni NATS auth-callout responder failed to start\", {\n          errorClass: \"NatsAuthCalloutOperationError\",\n          errorCode: \"nats_auth_callout_start_failed\",\n          origin: \"api\",\n        });\n      }\n    } else {\n      observability.warn(\n        \"Opengeni selfhosted enabled but the NATS auth-callout plane is not configured; selfhosted agents cannot connect\",\n        {},\n      );\n    }\n  }\n  observability.info(\"Opengeni API listening\", {\n    host: settings.apiHost,\n    port: settings.apiPort,\n    ...(metricsServer ? { metricsPort: settings.apiMetricsPort } : {}),\n  });\n  return {\n    server,\n    close: async () => {\n      server.stop(true);\n      // Start private CLI session cleanup even if another service's drain stalls.\n      const vaultProvidersClosed = closeNativeExternalVaultProviders().catch(() => undefined);\n      metricsServer?.stop(true);\n      stopSlackInteractionPump?.();\n      await stopMemorySlackPublicationPump();\n      stopMetricsIngestion?.();\n      stopHelloIngestion?.();\n      await stopTemporalScheduleCleanupPump();\n      await stopScheduledTaskLifecyclePump();\n      await stopWorkspaceWebhookDispatchPump();\n      await stopNativePushDispatchPump();\n      // Write queued presence before the database pool closes.\n      await routeDeps.userPresence?.close().catch(() => undefined);\n      await Promise.allSettled([\n        vaultProvidersClosed,\n        Promise.resolve(editableArtifactComposition?.close()),\n        authCalloutResponder?.close(),\n        bus.close(),\n        workflowClient.close(),\n        dbClient.close(),\n      ]);\n    },\n  };\n}\n\nif (import.meta.main) {\n  const fatalBoundary = installApiFatalProcessBoundary();\n  try {\n    const settings = getSettings();\n    const observability = createObservability(settings, { component: \"api\" });\n    fatalBoundary.attachObservability(observability);\n    const api = await startApi({ settings, observability });\n    installApiShutdownHandlers({\n      close: api.close,\n      onFailure: () =>\n        observability.warn(\"Opengeni API shutdown did not finish cleanly\", {\n          errorCode: \"api_shutdown_failed\",\n        }),\n    });\n    fatalBoundary.markRunning();\n  } catch (error) {\n    await fatalBoundary.reportStartupFailure(error);\n  }\n}\n\nexport function temporalOverlapPolicy(policy: ScheduledTaskOverlapPolicy): ScheduleOverlapPolicy {\n  if (policy === \"skip\") {\n    return ScheduleOverlapPolicy.SKIP;\n  }\n  if (policy === \"buffer_one\") {\n    return ScheduleOverlapPolicy.BUFFER_ONE;\n  }\n  return ScheduleOverlapPolicy.ALLOW_ALL;\n}\n\nexport function shouldCreateScheduleAfterUpdateError(error: unknown): boolean {\n  return error instanceof ScheduleNotFoundError;\n}\n\nexport function temporalScheduleSpec(schedule: ScheduledTaskScheduleSpec): ScheduleSpec {\n  if (schedule.type === \"manual\") {\n    throw new Error(\"manual scheduled tasks do not have a Temporal Schedule spec\");\n  }\n  if (schedule.type === \"interval\") {\n    return {\n      intervals: [temporalIntervalSpec(schedule)],\n      ...(schedule.startAt ? { startAt: new Date(schedule.startAt) } : {}),\n      ...(schedule.endAt ? { endAt: new Date(schedule.endAt) } : {}),\n    };\n  }\n  if (schedule.type === \"calendar\") {\n    return {\n      calendars: [\n        {\n          hour: schedule.hour,\n          minute: schedule.minute,\n          second: 0,\n          ...(schedule.daysOfWeek ? { dayOfWeek: schedule.daysOfWeek } : {}),\n        },\n      ],\n      timezone: schedule.timeZone,\n    };\n  }\n  const runAt = new Date(schedule.runAt);\n  return {\n    calendars: [\n      {\n        year: runAt.getUTCFullYear(),\n        month: temporalMonth(runAt.getUTCMonth()),\n        dayOfMonth: runAt.getUTCDate(),\n        hour: runAt.getUTCHours(),\n        minute: runAt.getUTCMinutes(),\n        second: runAt.getUTCSeconds(),\n      },\n    ],\n    timezone: \"UTC\",\n  };\n}\n\nfunction temporalIntervalSpec(\n  schedule: Extract<ScheduledTaskScheduleSpec, { type: \"interval\" }>,\n): NonNullable<ScheduleSpec[\"intervals\"]>[number] {\n  const every = `${schedule.everySeconds}s` as `${number}s`;\n  if (!schedule.startAt) {\n    return { every };\n  }\n\n  // Temporal interval schedules match Epoch + (n * every) + offset. Its\n  // top-level startAt only filters matching times before that boundary, so it\n  // does not itself anchor the cadence. Derive the phase from startAt to make\n  // the stored Opengeni timestamp the first interval boundary rather than the\n  // next epoch-aligned match.\n  const everyMilliseconds = BigInt(schedule.everySeconds) * 1_000n;\n  const startMilliseconds = BigInt(new Date(schedule.startAt).getTime());\n  const offsetMilliseconds =\n    ((startMilliseconds % everyMilliseconds) + everyMilliseconds) % everyMilliseconds;\n  return {\n    every,\n    ...(offsetMilliseconds === 0n ? {} : { offset: `${offsetMilliseconds}ms` as `${number}ms` }),\n  };\n}\n\nfunction temporalMonth(monthIndex: number) {\n  return TEMPORAL_MONTHS[monthIndex]!;\n}\n\nfunction temporalScheduleOptions(task: ScheduledTask, taskQueue: string): ScheduleOptions {\n  return {\n    scheduleId: task.temporalScheduleId,\n    spec: temporalScheduleSpec(task.schedule),\n    action: {\n      type: \"startWorkflow\",\n      workflowType: \"scheduledTaskFireWorkflow\",\n      taskQueue,\n      args: [\n        {\n          accountId: task.accountId,\n          workspaceId: task.workspaceId,\n          taskId: task.id,\n          triggerType: \"scheduled\",\n        },\n      ],\n    },\n    policies: {\n      overlap: temporalOverlapPolicy(task.overlapPolicy),\n      catchupWindow: \"24h\",\n      pauseOnFailure: false,\n    },\n    state: {\n      paused: scheduledTaskEffectivelyPaused(task),\n      ...(task.schedule.type === \"once\" ? { remainingActions: 1 } : {}),\n    },\n    memo: {\n      accountId: task.accountId,\n      workspaceId: task.workspaceId,\n      scheduledTaskId: task.id,\n      name: task.name,\n    },\n  };\n}\n\nfunction scheduledTaskEffectivelyPaused(task: ScheduledTask): boolean {\n  if (task.status === \"paused\") return true;\n  if (!scheduledTaskKnowledgeSource(task)) return false;\n  const control = task.metadata.knowledgeSourceSync;\n  if (!control || typeof control !== \"object\") return false;\n  const record = control as Record<string, unknown>;\n  return record.sourceEnabled === false || record.connectionPaused === true;\n}\n\nfunction temporalScheduleUpdateOptions(options: ScheduleOptions): ScheduleUpdateOptions {\n  return {\n    spec: options.spec,\n    action: options.action,\n    ...(options.policies ? { policies: options.policies } : {}),\n    state: options.state ?? {},\n    ...(options.searchAttributes ? { searchAttributes: options.searchAttributes } : {}),\n    ...(options.typedSearchAttributes\n      ? { typedSearchAttributes: options.typedSearchAttributes }\n      : {}),\n  };\n}\n","import {\n  natsSubscriptionTerminationCounter,\n  type EventBusOptions,\n  type EventLogger,\n} from \"@opengeni/events\";\nimport type { Attributes, AttributeValue, Observability } from \"@opengeni/observability\";\n\n/** Logger plus the closed-label subscription-termination counter for NATS connections. */\nexport function observabilityEventBusOptions(\n  observability: Observability,\n): Pick<EventBusOptions, \"logger\" | \"onSubscriptionTerminated\"> {\n  return {\n    logger: observabilityEventLogger(observability),\n    onSubscriptionTerminated: natsSubscriptionTerminationCounter(observability),\n  };\n}\n\nexport function observabilityEventLogger(observability: Observability): EventLogger {\n  return {\n    debug: (message, attributes) => observability.debug(message, eventAttributes(attributes)),\n    warn: (message, attributes) => observability.warn(message, eventAttributes(attributes)),\n  };\n}\n\nfunction eventAttributes(attributes: Record<string, unknown> | undefined): Attributes | undefined {\n  if (!attributes) {\n    return undefined;\n  }\n  const projected: Attributes = {};\n  for (const [key, value] of Object.entries(attributes)) {\n    projected[key] = eventAttributeValue(value);\n  }\n  return projected;\n}\n\nfunction eventAttributeValue(value: unknown): AttributeValue {\n  if (\n    value === null ||\n    value === undefined ||\n    typeof value === \"string\" ||\n    typeof value === \"number\" ||\n    typeof value === \"boolean\"\n  ) {\n    return value;\n  }\n  try {\n    return JSON.stringify(value);\n  } catch {\n    return String(value);\n  }\n}\n","// apps/api/src/sandbox/auth-callout.ts — the NATS AUTH-CALLOUT responder (the\n// bring-your-own-compute M-AUTH tenancy boundary; NATS Accounts per\n// workspace + §17 the isolation smoke + §19 the NATS-Accounts-misconfig leak risk).\n//\n// THE BOUNDARY THIS CLOSES: an external agent connects to NATS presenting its\n// `oge_` enrollment bearer as the connect auth-token. nats-server (configured with\n// `auth_callout`) issues an authorization request on $SYS.REQ.USER.AUTH. THIS\n// responder:\n//   1. decodes the authorization request (the `user_nkey` the response must scope\n//      to, the `server_id` for the response `aud`, and the presented `auth_token`);\n//   2. VALIDATES the bearer with verifyEnrollmentBearer (HMAC, via\n//      resolveEnrollmentSigningSecret) — an invalid/expired/forged bearer is denied;\n//   3. confirms the enrollment is still ACTIVE in the DB at the exact credential\n//      generation (a revoked or re-enrolled machine denies an old bearer);\n//   4. atomically claims the daemon instance named in CONNECT;\n//   5. signs a NATS user JWT granting pub/sub ONLY that exact process subtree +\n//      `_INBOX.>` (deny-all-else by an allow-list) and returns it inside a signed\n//      authorization-response JWT.\n//\n// That exact scope is both the tenancy boundary and routing fence: workspace A\n// cannot reach B, and an old/duplicate process cannot subscribe to its successor's\n// work. nats-server enforces the signed permission set; the boundary does not rely\n// on naming alone.\n//\n// SECURITY (§18): the bearer value + the account signing seed are NEVER logged. A\n// validation failure → a DENIAL response (the server refuses the connection); a\n// responder error → the request is left UNANSWERED (fail-closed; the server denies\n// on its callout timeout). The bearer's `exp` caps the minted credential's life so a\n// revoked/expired enrollment cannot outlive its bearer.\n\nimport { createHash } from \"node:crypto\";\nimport { createLogThrottle, type LogThrottle } from \"@opengeni/observability\";\nimport {\n  resolveEnrollmentSigningSecret,\n  type NatsCalloutConfig,\n  type Settings,\n} from \"@opengeni/config\";\nimport { verifyEnrollmentBearer } from \"@opengeni/contracts\";\nimport { claimEnrollmentConnection, getEnrollment, type Database } from \"@opengeni/db\";\nimport {\n  createResponderConnection,\n  decodeAuthRequest,\n  mintAuthResponse,\n  mintUserJwt,\n  parseAgentConnectionName,\n  workspaceAgentPermissions,\n  type ResponderConnection,\n} from \"@opengeni/events\";\nimport type { Observability } from \"@opengeni/observability\";\nimport { observabilityEventBusOptions } from \"../observability\";\nimport { AGENT_CONNECTION_LEASE_MS } from \"./connection-authority\";\n\n/** The NATS subject nats-server publishes authorization requests on (ADR-26). */\nexport const AUTH_CALLOUT_SUBJECT = \"$SYS.REQ.USER.AUTH\";\n/** Keep live NATS credentials short-lived while never outliving the bearer. */\nexport const NATS_USER_JWT_TTL_SECONDS = 5 * 60;\nexport interface AuthCalloutDeps {\n  db: Database;\n  settings: Settings;\n  callout: NatsCalloutConfig;\n  observability?: Observability;\n  /** Bounds repeated denial warnings; defaults to one process-wide throttle. */\n  denialWarningThrottle?: LogThrottle;\n}\n\n/** A stale or revoked machine re-dials on its reconnect backoff forever, so an\n * unthrottled denial warning repeats every few seconds per machine. Log each\n * distinct machine's first denial, then at most once per interval with the\n * count of denials it hid. The denial decision itself is never throttled. */\nexport const AUTH_CALLOUT_DENIAL_WARNING_INTERVAL_MS = 60_000;\nconst processDenialWarningThrottle = createLogThrottle({\n  intervalMs: AUTH_CALLOUT_DENIAL_WARNING_INTERVAL_MS,\n  maxKeys: 1_024,\n});\n\n/** Closed denial vocabulary. The public log projection drops identifiers, so\n * `reason` is what tells an operator which throttle key a count belongs to. */\ntype AuthCalloutDenialReason = \"invalid_bearer\" | \"inactive_enrollment\" | \"duplicate_runner\";\n\nfunction warnDenial(\n  deps: AuthCalloutDeps,\n  key: string,\n  reason: AuthCalloutDenialReason,\n  message: string,\n  attributes: Record<string, string | number> = {},\n): void {\n  const admission = (deps.denialWarningThrottle ?? processDenialWarningThrottle).admit(key);\n  if (!admission) return;\n  deps.observability?.warn?.(message, {\n    ...attributes,\n    reason,\n    ...(admission.suppressedCount > 0 ? { suppressedCount: admission.suppressedCount } : {}),\n  });\n}\n\n/** Closed reasons a Connected Machine agent's NATS connect is refused. */\ntype MachineConnectDenialReason =\n  | \"undecodable\"\n  | \"missing_bearer\"\n  | \"plane_disabled\"\n  | \"invalid_bearer\"\n  | \"inactive_enrollment\"\n  | \"identity_mismatch\"\n  | \"generation_mismatch\"\n  | \"invalid_instance\"\n  | \"duplicate_runner\";\n\n/** Count every machine connect decision; identifiers never become labels. */\nfunction recordMachineConnect(\n  deps: AuthCalloutDeps,\n  outcome: \"granted\" | \"denied\",\n  reason: MachineConnectDenialReason | \"none\",\n): void {\n  try {\n    deps.observability?.incrementCounter({\n      name: \"opengeni_machine_connect_total\",\n      help: \"Connected Machine agent NATS connect decisions (auth callout) by outcome and closed denial reason.\",\n      labels: { outcome, reason },\n    });\n  } catch {\n    // Telemetry never changes the signed connect decision.\n  }\n}\n\n/** A process-local dedupe key for a rejected bearer. The digest is never\n * logged, and the bearer value never leaves this function. */\nfunction rejectedBearerKey(bearer: string): string {\n  return `invalid-bearer:${createHash(\"sha256\").update(bearer).digest(\"hex\").slice(0, 32)}`;\n}\n\n/**\n * The pure validate→scoped-JWT decision, isolated from the NATS transport so it is\n * unit-testable. Given the raw authorization-request JWT bytes, returns the signed\n * authorization-response JWT bytes to reply with — a GRANT (embedding a scoped user\n * JWT) on success, a DENIAL (carrying `nats.error`, no user JWT) otherwise. NEVER\n * throws on a bad/invalid request: every failure becomes a signed denial (the\n * server then refuses the connection cleanly).\n */\nexport async function handleAuthorizationRequest(\n  deps: AuthCalloutDeps,\n  requestBytes: Uint8Array,\n): Promise<Uint8Array> {\n  const requestJwt = Buffer.from(requestBytes).toString(\"utf8\");\n  const decoded = decodeAuthRequest(requestJwt);\n  if (!decoded) {\n    // A malformed request we cannot even read the user_nkey/server_id from — there\n    // is nothing to scope a response to. Leave it for the server's timeout by\n    // throwing (the transport leaves it unanswered, fail-closed).\n    deps.observability?.warn?.(\"auth-callout: undecodable authorization request\", {});\n    recordMachineConnect(deps, \"denied\", \"undecodable\");\n    throw new Error(\"undecodable authorization request\");\n  }\n\n  const deny = (code: MachineConnectDenialReason, reason: string): Uint8Array => {\n    recordMachineConnect(deps, \"denied\", code);\n    // A SIGNED denial: the server reads `nats.error` and refuses the connection.\n    const response = mintAuthResponse({\n      userPublicKey: decoded.userNkey,\n      serverId: decoded.serverId,\n      accountSeed: deps.callout.accountSeed,\n      error: reason,\n    });\n    return Buffer.from(response, \"utf8\");\n  };\n\n  const bearer = decoded.authToken;\n  if (!bearer) {\n    return deny(\"missing_bearer\", \"missing enrollment bearer\");\n  }\n\n  const secret = resolveEnrollmentSigningSecret(deps.settings);\n  if (!secret) {\n    // The credential plane is off for this deployment — deny rather than mint an\n    // unscoped credential. (The responder should not even be running in this case,\n    // but fail-closed regardless.)\n    return deny(\"plane_disabled\", \"enrollment credential plane disabled\");\n  }\n\n  const claims = await verifyEnrollmentBearer(secret, bearer);\n  if (!claims) {\n    // Invalid signature / malformed / expired bearer. NEVER log the bearer value.\n    warnDenial(\n      deps,\n      rejectedBearerKey(bearer),\n      \"invalid_bearer\",\n      \"auth-callout: rejected an invalid enrollment bearer\",\n    );\n    return deny(\"invalid_bearer\", \"invalid or expired enrollment bearer\");\n  }\n\n  // Confirm the enrollment is still ACTIVE — a revoked machine is denied even with a\n  // still-unexpired bearer (the revoke path flips status; this re-checks at connect).\n  const enrollment = await getEnrollment(deps.db, claims.workspaceId, claims.enrollmentId);\n  if (!enrollment || enrollment.status !== \"active\") {\n    warnDenial(\n      deps,\n      `inactive:${claims.workspaceId}:${claims.agentId}`,\n      \"inactive_enrollment\",\n      \"auth-callout: denied a revoked or unknown enrollment\",\n      { workspaceId: claims.workspaceId, agentId: claims.agentId },\n    );\n    return deny(\"inactive_enrollment\", \"enrollment is not active\");\n  }\n\n  // Belt-and-braces: the bearer's agentId/enrollmentId must match the row we found.\n  // (verifyEnrollmentBearer already binds them; this guards a future schema where\n  // agentId != enrollmentId.)\n  if (\n    enrollment.workspaceId !== claims.workspaceId ||\n    enrollment.id !== claims.enrollmentId ||\n    enrollment.id !== claims.agentId ||\n    claims.agentId !== claims.enrollmentId ||\n    claims.subjectPrefix !== `agent.${claims.workspaceId}.${claims.agentId}`\n  ) {\n    return deny(\"identity_mismatch\", \"enrollment identity mismatch\");\n  }\n  if (enrollment.credentialGeneration !== claims.credentialGeneration) {\n    return deny(\"generation_mismatch\", \"enrollment credential generation mismatch\");\n  }\n\n  const connectionInstanceId = parseAgentConnectionName(decoded.name);\n  if (!connectionInstanceId) {\n    return deny(\"invalid_instance\", \"missing or invalid agent connection instance\");\n  }\n  const claim = await claimEnrollmentConnection(deps.db, {\n    workspaceId: claims.workspaceId,\n    enrollmentId: claims.enrollmentId,\n    credentialGeneration: claims.credentialGeneration,\n    connectionInstanceId,\n    leaseMs: AGENT_CONNECTION_LEASE_MS,\n  });\n  if (!claim.claimed) {\n    warnDenial(\n      deps,\n      `duplicate:${claims.workspaceId}:${claims.agentId}`,\n      \"duplicate_runner\",\n      \"auth-callout: denied a duplicate live runner\",\n      { workspaceId: claims.workspaceId, agentId: claims.agentId },\n    );\n    return deny(\"duplicate_runner\", \"another runner instance currently owns this enrollment\");\n  }\n\n  // GRANT: the operational subject includes the exact claimed process instance.\n  // A previous socket may remain open until its short JWT expires, but no control\n  // request is routed to its old subject after a successor claims authority.\n  const permissions = workspaceAgentPermissions(\n    claims.workspaceId,\n    claims.agentId,\n    connectionInstanceId,\n  );\n  const nowSeconds = Math.floor(Date.now() / 1000);\n  const userJwt = mintUserJwt({\n    userPublicKey: decoded.userNkey,\n    accountSeed: deps.callout.accountSeed,\n    name: claims.agentId,\n    permissions,\n    // Server-config-mode placement: the embedded user JWT's `aud` is the account\n    // the user binds to (the configured `auth_callout.account`). All agents +\n    // the privileged control plane share this account so subjects route; the\n    // per-workspace isolation is carried by the subject permissions above.\n    audienceAccount: deps.callout.accountName,\n    // Tie the credential's life to the bearer's remaining life: a revoked/expired\n    // enrollment cannot outlive its bearer at the NATS layer either.\n    expiresAtSeconds: Math.min(claims.exp, nowSeconds + NATS_USER_JWT_TTL_SECONDS),\n  });\n  const response = mintAuthResponse({\n    userPublicKey: decoded.userNkey,\n    serverId: decoded.serverId,\n    accountSeed: deps.callout.accountSeed,\n    userJwt,\n  });\n  recordMachineConnect(deps, \"granted\", \"none\");\n  deps.observability?.info?.(\"auth-callout: granted a workspace-scoped NATS credential\", {\n    workspaceId: claims.workspaceId,\n    agentId: claims.agentId,\n    connectionGeneration: claim.connectionGeneration,\n  });\n  return Buffer.from(response, \"utf8\");\n}\n\n/**\n * Start the auth-callout responder: open a SEPARATE NATS connection authenticated\n * as the callout `auth_users` user, subscribe $SYS.REQ.USER.AUTH, and answer every\n * authorization request via {@link handleAuthorizationRequest}. Returns a handle\n * whose `close()` drains the connection. Gated by the caller (sandboxSelfhostedEnabled\n * + a resolvable callout config); a deployment without the callout plane never starts\n * it.\n */\nexport async function startAuthCalloutResponder(\n  deps: AuthCalloutDeps,\n  natsUrl: string,\n): Promise<ResponderConnection> {\n  const connection = await createResponderConnection(\n    natsUrl,\n    { kind: \"user-password\", user: deps.callout.user, pass: deps.callout.password },\n    AUTH_CALLOUT_SUBJECT,\n    (bytes) => handleAuthorizationRequest(deps, bytes),\n    {\n      name: \"opengeni-auth-callout\",\n      ...(deps.observability ? observabilityEventBusOptions(deps.observability) : {}),\n    },\n  );\n  deps.observability?.info?.(\"Opengeni NATS auth-callout responder started\", {\n    subject: AUTH_CALLOUT_SUBJECT,\n  });\n  return connection;\n}\n","/** Five-second heartbeats get four missed intervals before another daemon may\n * claim the enrollment. Server time is authoritative. */\nexport const AGENT_CONNECTION_LEASE_MS = 20_000;\n","// apps/api/src/sandbox/metrics-ingestion.ts — the M10 metrics INGESTION consumer\n// + the connect-Hello DISPLAY-REFRESH consumer. The\n// enrolled agent piggybacks a `MetricsSample` on its ~5s heartbeat (an\n// `AgentEvent` published one-way on the exact process events subject) and publishes a\n// `Hello` (its live self-description) on the exact process hello subject on every connect\n// /reconnect. This module owns the two agent→control-plane inbound consumers:\n//\n//   `agent.*.*.connection.*.events` (heartbeat) →\n//     1. touchEnrollmentLastSeen  — the liveness cursor (online/reconnecting/offline\n//        derivation + the M3 probe disambiguation).\n//     2. ingestMachineMetricsSample — UPSERT machine_metrics_latest (the \"now\" row)\n//        + APPEND a machine_metrics_series row downsampled to ~1/min.\n//     A GOING-OFFLINE event is not a metrics point — liveness flips via the lease/\n//     probe path; we skip it here (no-op).\n//\n//   `agent.*.*.connection.*.hello` (connect) →\n//     refreshEnrollmentDisplay — reconcile `enrollments.has_display` to the LIVE\n//     capability the Hello reports. `has_display` was previously FROZEN at the\n//     enroll-time offer snapshot; a machine that GAINS a display later (a Mac that\n//     grants Screen Recording, a box whose Xvfb starts) or LOSES one never\n//     re-surfaced. Consuming the Hello's `capabilities.desktop` / `display` makes\n//     `has_display` track reality (both directions), which the desktop-capability\n//     gate (packages/runtime capabilities.ts) keys off.\n//     refreshEnrollmentOpStream — reconcile `enrollments.op_stream` to the LIVE\n//     runner capability the Hello reports. Exec is unavailable unless the runner\n//     advertises the streaming engine.\n//\n// Both consumers are BEST-EFFORT and fail-soft: a decode/DB error for one message\n// is logged + swallowed (the bus subscription already swallows handler throws) so\n// a metrics blip / a display-refresh write failure never tears down the consumer,\n// back-pressures the agent, or breaks its connect. Event ingestion drains the NATS\n// subscription immediately into exact-subject queues: different runner connections\n// progress concurrently, one runner's ordering is preserved, and consecutive queued\n// heartbeats collapse latest-wins. A delayed heartbeat backlog therefore cannot keep\n// renewing a dead runner's short connection lease one stale message at a time.\n\nimport {\n  clearEnrollmentWentOffline,\n  disconnectAttachedBrowserDevices,\n  advanceEnrollmentAgentUpdate,\n  enrollmentMacPermissionCapabilities,\n  enrollmentMacPermissions,\n  getEnrollment,\n  getLiveEnrollmentConnection,\n  ingestMachineMetricsSample,\n  reconcileAttachedBrowserInventory,\n  releaseEnrollmentConnection,\n  renewEnrollmentConnection,\n  sessionsWithActiveOpOnEnrollment,\n  setEnrollmentDisplayState,\n  setEnrollmentAgentRuntime,\n  setEnrollmentOpStreamState,\n  type AppendEventInput,\n  type Database,\n  type EnrollmentMacPermissions,\n  type MachineMetricsSample,\n} from \"@opengeni/db\";\nimport {\n  AttachedBrowserConnectionEnd as AttachedBrowserConnectionEndContract,\n  AttachedBrowserInventorySnapshot as AttachedBrowserInventoryContract,\n  type AttachedBrowserInventorySnapshot as AttachedBrowserInventoryContractValue,\n  type AttachedBrowserConnectionEnd as AttachedBrowserConnectionEndValue,\n} from \"@opengeni/contracts\";\nimport { appendAndPublishEvents, type EventBus } from \"@opengeni/events\";\nimport type { Observability } from \"@opengeni/observability\";\nimport { normalizeConnectedMachineWorkspaceRoot } from \"@opengeni/runtime/sandbox\";\nimport type { AutomaticAgentUpdater } from \"./agent-update\";\nimport {\n  AgentEvent,\n  AgentUpdateStage,\n  Arch,\n  AttachedBrowserConnectionEndReason as WireConnectionEndReason,\n  GoingOfflineReason,\n  Hello,\n  Os,\n  goingOfflineReasonToJSON,\n  type AttachedBrowserConnectionEnd as WireAttachedBrowserConnectionEnd,\n  type AttachedBrowserInventorySnapshot as WireAttachedBrowserInventorySnapshot,\n  type MetricsSample,\n} from \"@opengeni/agent-proto\";\nimport { AGENT_CONNECTION_LEASE_MS } from \"./connection-authority\";\nimport { reconcileScreenControlOnHello } from \"./screen-control\";\n\n/** The wildcard subject the agent event plane publishes heartbeats on. */\nexport const AGENT_EVENTS_SUBJECT = \"agent.*.*.connection.*.events\";\n\n/** The wildcard subject the agent publishes its connect Hello on. */\nexport const AGENT_HELLO_SUBJECT = \"agent.*.*.connection.*.hello\";\n\ntype QueuedAgentEvent = {\n  payload: Uint8Array;\n  subject: string;\n  heartbeat: boolean;\n};\n\ntype AgentEventQueueState = {\n  scheduled: boolean;\n  pending: QueuedAgentEvent[];\n};\n\ntype ScheduledAgentEventQueue = {\n  subject: string;\n  state: AgentEventQueueState;\n};\n\nexport type AgentEventIngestionScheduler = {\n  enqueue: (payload: Uint8Array, subject: string) => void;\n  whenIdle: () => Promise<void>;\n  close: () => void;\n};\n\nfunction payloadIsHeartbeat(payload: Uint8Array): boolean {\n  try {\n    return AgentEvent.decode(payload).event?.$case === \"heartbeat\";\n  } catch {\n    // Preserve the normal decoder/logging path for malformed events. They are\n    // barriers rather than heartbeat-coalescing candidates.\n    return false;\n  }\n}\n\n/**\n * Drain agent events without making every Connected Machine wait behind one\n * deployment-wide serial DB queue. Each exact process subject retains FIFO order;\n * separate subjects drain concurrently. Consecutive pending heartbeats for one\n * subject are latest-wins because they are point-in-time liveness/metrics samples,\n * while GoingOffline and update-progress events remain ordered barriers.\n */\nexport function createAgentEventIngestionScheduler(\n  handler: (payload: Uint8Array, subject: string) => void | Promise<void>,\n  options: { maxConcurrentSubjects?: number; onHeartbeatCoalesced?: () => void } = {},\n): AgentEventIngestionScheduler {\n  const maxConcurrentSubjects = options.maxConcurrentSubjects ?? 32;\n  if (!Number.isSafeInteger(maxConcurrentSubjects) || maxConcurrentSubjects <= 0) {\n    throw new RangeError(\"maxConcurrentSubjects must be a positive safe integer\");\n  }\n\n  const states = new Map<string, AgentEventQueueState>();\n  const readySubjects: ScheduledAgentEventQueue[] = [];\n  const idleWaiters = new Set<() => void>();\n  let accepting = true;\n  let activeSubjects = 0;\n\n  const resolveIdleWaiters = (): void => {\n    if (states.size !== 0) return;\n    for (const resolve of idleWaiters) resolve();\n    idleWaiters.clear();\n  };\n\n  async function drain(subject: string, state: AgentEventQueueState): Promise<void> {\n    while (true) {\n      const event = state.pending.shift();\n      if (!event) break;\n      try {\n        await handler(event.payload, event.subject);\n      } catch {\n        // Agent-event ingestion is best-effort. One bad event must not strand the\n        // exact-subject queue or prevent later heartbeats from restoring liveness.\n      }\n    }\n\n    activeSubjects -= 1;\n    state.scheduled = false;\n    if (state.pending.length > 0) {\n      schedule(subject, state);\n    } else {\n      if (states.get(subject) === state) states.delete(subject);\n      resolveIdleWaiters();\n    }\n    pump();\n  }\n\n  function pump(): void {\n    while (activeSubjects < maxConcurrentSubjects) {\n      const next = readySubjects.shift();\n      if (!next) return;\n      if (states.get(next.subject) !== next.state || !next.state.scheduled) continue;\n      activeSubjects += 1;\n      void drain(next.subject, next.state);\n    }\n  }\n\n  function schedule(subject: string, state: AgentEventQueueState): void {\n    if (state.scheduled) return;\n    state.scheduled = true;\n    readySubjects.push({ subject, state });\n    pump();\n  }\n\n  return {\n    enqueue(payload, subject) {\n      if (!accepting) return;\n      const heartbeat = payloadIsHeartbeat(payload);\n      let state = states.get(subject);\n      if (!state) {\n        state = { scheduled: false, pending: [] };\n        states.set(subject, state);\n      }\n\n      const queued = { payload, subject, heartbeat };\n      const lastIndex = state.pending.length - 1;\n      if (heartbeat && lastIndex >= 0 && state.pending[lastIndex]!.heartbeat) {\n        state.pending[lastIndex] = queued;\n        options.onHeartbeatCoalesced?.();\n      } else {\n        state.pending.push(queued);\n      }\n\n      schedule(subject, state);\n    },\n    async whenIdle() {\n      if (states.size === 0) return;\n      await new Promise<void>((resolve) => idleWaiters.add(resolve));\n    },\n    close() {\n      accepting = false;\n      for (const state of states.values()) {\n        state.pending.length = 0;\n      }\n      resolveIdleWaiters();\n    },\n  };\n}\n\n/**\n * Parse `agent.<ws>.<id>.connection.<instance>.<tail>` into its exact authority,\n * expected tail token. Returns null for a subject that does not match the shape\n * (defensive — the subscription pattern already constrains it).\n */\nfunction parseAgentSubject(\n  subject: string,\n  tail: \"events\" | \"hello\",\n): { workspaceId: string; agentId: string; connectionInstanceId: string } | null {\n  const parts = subject.split(\".\");\n  if (\n    parts.length !== 6 ||\n    parts[0] !== \"agent\" ||\n    parts[3] !== \"connection\" ||\n    !parts[4] ||\n    parts[5] !== tail\n  ) {\n    return null;\n  }\n  return {\n    workspaceId: parts[1]!,\n    agentId: parts[2]!,\n    connectionInstanceId: parts[4]!,\n  };\n}\n\n/** Parse the exact process events subject (heartbeat plane). */\nexport function parseAgentEventSubject(\n  subject: string,\n): { workspaceId: string; agentId: string; connectionInstanceId: string } | null {\n  return parseAgentSubject(subject, \"events\");\n}\n\n/** Parse the exact process hello subject (connect plane). */\nexport function parseAgentHelloSubject(\n  subject: string,\n): { workspaceId: string; agentId: string; connectionInstanceId: string } | null {\n  return parseAgentSubject(subject, \"hello\");\n}\n\n/**\n * Project a wire `MetricsSample` (proto, ms-stamped, GPU as a repeated list) to\n * the DB `MachineMetricsSample`. The proto byte/count fields are protobuf-encoded\n * as decimal strings (uint64) on the TS side (ts-proto `string`); coerce to\n * numbers. The DB carries a single `gpuUtilPercent` + `gpuMemUsedBytes`/Total —\n * we take the FIRST GPU (the dashboard surfaces the primary accelerator); absent\n * GPUs stay null (the not-reported contract). A zero on a non-GPU field is the\n * agent's \"not reported\" (we keep it null-friendly via `nullIfZero` only for the\n * GPU plane; cpu/mem/disk 0 is a legitimate reading the dashboard shows as 0).\n */\nexport function wireSampleToDbSample(wire: MetricsSample): MachineMetricsSample {\n  const num = (v: string | number): number => (typeof v === \"number\" ? v : Number(v));\n  const firstGpu = wire.gpus[0];\n  return {\n    cpuPercent: wire.cpuPercent,\n    load1: wire.load1,\n    load5: wire.load5,\n    load15: wire.load15,\n    memUsedBytes: num(wire.memUsedBytes),\n    memTotalBytes: num(wire.memTotalBytes),\n    diskUsedBytes: num(wire.diskUsedBytes),\n    diskTotalBytes: num(wire.diskTotalBytes),\n    gpuUtilPercent: firstGpu ? firstGpu.utilPercent : null,\n    gpuMemUsedBytes: firstGpu ? num(firstGpu.memUsedBytes) : null,\n    gpuMemTotalBytes: firstGpu ? num(firstGpu.memTotalBytes) : null,\n    contention: wire.runQueue,\n    // The sample carries its own wall-clock stamp (epoch ms); fall back to now on\n    // a missing/zero stamp so a series row is never NULL-dated.\n    sampledAt:\n      wire.sampledAtMs && Number(wire.sampledAtMs) > 0\n        ? new Date(Number(wire.sampledAtMs))\n        : new Date(),\n  };\n}\n\n/** Validate and project one wire inventory before it reaches durable browser\n *  discovery. Unknown enum values and unsafe uint64 counters reject the whole\n *  authoritative snapshot instead of partially disconnecting good endpoints. */\nexport function wireAttachedBrowserInventoryToContract(\n  wire: WireAttachedBrowserInventorySnapshot,\n): AttachedBrowserInventoryContractValue {\n  return AttachedBrowserInventoryContract.parse({\n    bridgeGeneration: wire.bridgeGeneration,\n    revision: safeWireInteger(wire.revision, \"browser inventory revision\"),\n    devices: wire.devices.map((device) => ({\n      id: device.id,\n      name: device.name,\n      profileLabel: device.profileLabel.trim() || null,\n      browserName: device.browserName,\n      browserVersion: device.browserVersion,\n      extensionVersion: device.extensionVersion,\n      platform: wireBrowserPlatform(device.platform),\n      architecture: wireBrowserArchitecture(device.arch),\n      connectionGeneration: device.connectionGeneration,\n      inventoryRevision: safeWireInteger(\n        device.inventoryRevision,\n        \"attached browser inventory revision\",\n      ),\n      tabCount: safeWireInteger(device.tabCount, \"attached browser tab count\"),\n      capabilities: device.capabilities,\n    })),\n    connectionEnds: (wire.connectionEnds ?? []).flatMap(wireConnectionEndToContract),\n  });\n}\n\nconst WIRE_CONNECTION_END_REASONS = new Map<\n  WireConnectionEndReason,\n  AttachedBrowserConnectionEndValue[\"reason\"]\n>([\n  [\n    WireConnectionEndReason.ATTACHED_BROWSER_CONNECTION_END_REASON_BROWSER_CLOSED_PORT,\n    \"browser_closed_port\",\n  ],\n  [\n    WireConnectionEndReason.ATTACHED_BROWSER_CONNECTION_END_REASON_BROWSER_MESSAGE_INVALID,\n    \"browser_message_invalid\",\n  ],\n  [\n    WireConnectionEndReason.ATTACHED_BROWSER_CONNECTION_END_REASON_BROWSER_OUTPUT_FAILED,\n    \"browser_output_failed\",\n  ],\n  [\n    WireConnectionEndReason.ATTACHED_BROWSER_CONNECTION_END_REASON_NATIVE_HOST_LOST,\n    \"native_host_lost\",\n  ],\n  [WireConnectionEndReason.ATTACHED_BROWSER_CONNECTION_END_REASON_AGENT_REJECTED, \"agent_rejected\"],\n]);\n\n/** Connection ends are diagnostics. One the contract cannot hold (a future\n *  reason, or the generation of a hello the bridge rejected as malformed) is\n *  dropped instead of rejecting the authoritative device inventory. */\nfunction wireConnectionEndToContract(\n  wire: WireAttachedBrowserConnectionEnd,\n): AttachedBrowserConnectionEndValue[] {\n  const reason = WIRE_CONNECTION_END_REASONS.get(wire.reason);\n  const endedAtMs = Number(wire.endedAtUnixMs);\n  if (!reason || !Number.isSafeInteger(endedAtMs) || endedAtMs <= 0) return [];\n  const parsed = AttachedBrowserConnectionEndContract.safeParse({\n    deviceId: wire.deviceId,\n    connectionGeneration: wire.connectionGeneration,\n    reason,\n    detail: wire.detail.slice(0, 512) || null,\n    endedAt: new Date(endedAtMs).toISOString(),\n    connectedMs: Math.min(Number(wire.connectedMs) || 0, Number.MAX_SAFE_INTEGER),\n  });\n  return parsed.success ? [parsed.data] : [];\n}\n\nfunction safeWireInteger(value: string | number, label: string): number {\n  let parsed: bigint;\n  try {\n    parsed = BigInt(value);\n  } catch {\n    throw new Error(`${label} is not an integer`);\n  }\n  if (parsed < 0n || parsed > BigInt(Number.MAX_SAFE_INTEGER)) {\n    throw new Error(`${label} is outside the safe integer range`);\n  }\n  return Number(parsed);\n}\n\nfunction wireBrowserPlatform(platform: Os): \"linux\" | \"macos\" | \"windows\" {\n  switch (platform) {\n    case Os.OS_LINUX:\n      return \"linux\";\n    case Os.OS_MACOS:\n      return \"macos\";\n    case Os.OS_WINDOWS:\n      return \"windows\";\n    default:\n      throw new Error(\"attached browser platform is unspecified or unsupported\");\n  }\n}\n\nfunction wireBrowserArchitecture(architecture: Arch): \"x64\" | \"arm64\" {\n  switch (architecture) {\n    case Arch.ARCH_X86_64:\n      return \"x64\";\n    case Arch.ARCH_AARCH64:\n      return \"arm64\";\n    default:\n      throw new Error(\"attached browser architecture is unspecified or unsupported\");\n  }\n}\n\nasync function ingestAttachedBrowserInventory(\n  db: Database,\n  input: {\n    workspaceId: string;\n    agentId: string;\n    inventory: WireAttachedBrowserInventorySnapshot;\n  },\n): Promise<void> {\n  const enrollment = await getEnrollment(db, input.workspaceId, input.agentId);\n  if (!enrollment) return;\n  await reconcileAttachedBrowserInventory(db, {\n    accountId: enrollment.accountId,\n    workspaceId: input.workspaceId,\n    enrollmentId: input.agentId,\n    snapshot: wireAttachedBrowserInventoryToContract(input.inventory),\n  });\n}\n\n/**\n * Ingest the OPTIONAL metrics sample carried by an already-authorized heartbeat.\n * Connection renewal is deliberately owned by the outer event handler and runs\n * before optional telemetry/inventory work, so telemetry absence or failure can\n * never make a healthy runner lose authority.\n */\nasync function ingestHeartbeatMetrics(\n  db: Database,\n  input: {\n    accountId: string;\n    workspaceId: string;\n    agentId: string;\n    sample: MetricsSample;\n  },\n): Promise<{ ingested: boolean; seriesAppended: boolean }> {\n  const sample = wireSampleToDbSample(input.sample);\n  const result = await ingestMachineMetricsSample(db, {\n    accountId: input.accountId,\n    workspaceId: input.workspaceId,\n    enrollmentId: input.agentId,\n    sample,\n  });\n  return { ingested: true, seriesAppended: result.seriesAppended };\n}\n\n/**\n * Fan out one or more machine-LINK session events to the sessions that had an\n * active op running on the machine when its control link changed (per\n * `sessionsWithActiveOpOnEnrollment`) — the announce-only failure-visibility\n * plane. Each session's events are stamped on its OWN active turn. No matching\n * session ⇒ nothing is emitted (an idle-machine blip must never spam idle /\n * historical sessions). Called best-effort inside the handlers' fail-soft blocks.\n *\n * Each session's emission is ISOLATED: one session's append failing (a\n * session-specific constraint like a sequence collision from a racing writer, a\n * transient write error) is logged with that sessionId and skipped, never\n * aborting the fan-out — one session's failure must never cost the OTHER matching\n * sessions their events. A partial fan-out stays visible per-session in the logs.\n */\nasync function fanOutMachineLinkEvents(\n  db: Database,\n  bus: EventBus,\n  observability: Observability | undefined,\n  workspaceId: string,\n  enrollmentId: string,\n  build: (activeTurnId: string) => AppendEventInput[],\n): Promise<void> {\n  const sessions = await sessionsWithActiveOpOnEnrollment(db, { workspaceId, enrollmentId });\n  for (const session of sessions) {\n    try {\n      await appendAndPublishEvents(\n        db,\n        bus,\n        workspaceId,\n        session.sessionId,\n        build(session.activeTurnId),\n      );\n    } catch (error) {\n      observability?.warn?.(\"Failed to fan out a machine-link event to a session\", {\n        workspaceId,\n        sessionId: session.sessionId,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n}\n\n/**\n * Decode a raw `AgentEvent` payload + ingest it (the per-message handler). A\n * heartbeat carrying a metrics sample is ingested; a going-offline records the\n * machine-plane marker + fans out the link-plane session events. Decode failures\n * are reported + swallowed. `bus` (when present) enables the session-event\n * fan-out; the live consumer always supplies it, pure unit tests may omit it.\n */\nexport async function handleAgentEventPayload(\n  db: Database,\n  observability: Observability | undefined,\n  payload: Uint8Array,\n  subject: string,\n  bus?: EventBus,\n  agentUpdates?: AutomaticAgentUpdater | null,\n): Promise<void> {\n  const ids = parseAgentEventSubject(subject);\n  if (!ids) {\n    return;\n  }\n  let event: AgentEvent;\n  try {\n    event = AgentEvent.decode(payload);\n  } catch (error) {\n    observability?.warn?.(\"Failed to decode an agent event for metrics ingestion\", {\n      subject,\n      error: error instanceof Error ? error.message : String(error),\n    });\n    return;\n  }\n  // A clean GoingOffline is the machine-plane's typed shutdown signal. Two things\n  // happen, in this order:\n  //   1. Record it ALWAYS on the machine plane (a Prometheus counter keyed by the\n  //      typed reason) so a fleet operator can see clean stops / self-updates /\n  //      host shutdowns. This fires unconditionally, independent of the DB.\n  //   2. Stamp the enrollment's clean going-offline marker so the liveness\n  //      derivation reads the machine OFFLINE immediately instead of waiting out\n  //      the last_seen dead-detect window. Best-effort + fail-soft (like the rest\n  //      of this module): an unknown enrollment is a no-op and a DB error is\n  //      swallowed so a bad write never tears down the consumer. Deliberately does\n  //      NOT touch last-seen (a shutdown must not look \"more recently alive\").\n  if (event.event?.$case === \"goingOffline\") {\n    const reason = goingOfflineReasonToJSON(event.event.goingOffline.reason);\n    observability?.incrementCounter({\n      name: \"opengeni_machine_going_offline_total\",\n      help: \"Total Connected Machine clean GoingOffline signals by typed reason.\",\n      labels: { reason },\n    });\n    try {\n      const enrollment = await getEnrollment(db, ids.workspaceId, ids.agentId);\n      if (enrollment) {\n        const released = await releaseEnrollmentConnection(db, {\n          accountId: enrollment.accountId,\n          workspaceId: ids.workspaceId,\n          enrollmentId: ids.agentId,\n          connectionInstanceId: ids.connectionInstanceId,\n          reason,\n        });\n        // A late goodbye from a superseded process is not the current machine\n        // going offline. It must not disconnect browsers or fan out link loss.\n        if (!released.released) return;\n        try {\n          await disconnectAttachedBrowserDevices(db, {\n            accountId: enrollment.accountId,\n            workspaceId: ids.workspaceId,\n            enrollmentId: ids.agentId,\n          });\n        } catch (error) {\n          observability?.warn?.(\"Failed to disconnect attached browsers with their machine\", {\n            subject,\n            error: error instanceof Error ? error.message : String(error),\n          });\n        }\n        // Fan out the link-plane events to the sessions with an active op on this\n        // machine: machine.link.lost (its control link is going away) for every\n        // clean going-offline, PLUS machine.runner.restarted when the reason is a\n        // self-update restart specifically (link.lost fires for it too; this\n        // distinguishes a restart from a plain stop / host shutdown).\n        if (bus) {\n          const isSelfUpdate =\n            event.event.goingOffline.reason === GoingOfflineReason.GOING_OFFLINE_REASON_UPDATE;\n          await fanOutMachineLinkEvents(\n            db,\n            bus,\n            observability,\n            ids.workspaceId,\n            ids.agentId,\n            (activeTurnId) => {\n              const events: AppendEventInput[] = [\n                { type: \"machine.link.lost\", turnId: activeTurnId, payload: { reason } },\n              ];\n              if (isSelfUpdate) {\n                events.push({\n                  type: \"machine.runner.restarted\",\n                  turnId: activeTurnId,\n                  payload: {},\n                });\n              }\n              return events;\n            },\n          );\n        }\n      }\n    } catch (error) {\n      observability?.warn?.(\"Failed to record a machine clean going-offline\", {\n        subject,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n    return;\n  }\n  if (event.event?.$case === \"agentUpdateProgress\") {\n    const enrollment = await getEnrollment(db, ids.workspaceId, ids.agentId).catch(() => null);\n    if (!enrollment || enrollment.connectionInstanceId !== ids.connectionInstanceId) return;\n    const progress = event.event.agentUpdateProgress;\n    const status = (() => {\n      switch (progress.stage) {\n        case AgentUpdateStage.AGENT_UPDATE_STAGE_ACCEPTED:\n          return \"accepted\" as const;\n        case AgentUpdateStage.AGENT_UPDATE_STAGE_WAITING_FOR_IDLE:\n          return \"waiting_for_idle\" as const;\n        case AgentUpdateStage.AGENT_UPDATE_STAGE_DOWNLOADING:\n          return \"downloading\" as const;\n        case AgentUpdateStage.AGENT_UPDATE_STAGE_VERIFYING:\n          return \"verifying\" as const;\n        case AgentUpdateStage.AGENT_UPDATE_STAGE_APPLYING:\n          return \"applying\" as const;\n        case AgentUpdateStage.AGENT_UPDATE_STAGE_RESTARTING:\n          return \"restarting\" as const;\n        case AgentUpdateStage.AGENT_UPDATE_STAGE_FAILED:\n          return \"failed\" as const;\n        default:\n          return null;\n      }\n    })();\n    if (!status) return;\n    try {\n      await advanceEnrollmentAgentUpdate(db, {\n        accountId: enrollment.accountId,\n        workspaceId: ids.workspaceId,\n        enrollmentId: ids.agentId,\n        connectionInstanceId: ids.connectionInstanceId,\n        connectionGeneration: enrollment.connectionGeneration,\n        operationId: progress.operationId,\n        status,\n        expectedBinarySha256: /^[0-9a-f]{64}$/.test(progress.expectedBinarySha256)\n          ? progress.expectedBinarySha256\n          : null,\n        errorCode: progress.errorCode || null,\n        retryable: progress.retryable,\n        rolledBack: progress.rolledBack,\n      });\n    } catch (error) {\n      observability?.warn?.(\"Failed to ingest a machine self-update progress event\", {\n        subject,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n    return;\n  }\n  if (event.event?.$case !== \"heartbeat\") {\n    return; // an unknown event kind → not a metrics point.\n  }\n  const heartbeat = event.event.heartbeat;\n  const enrollment = await getEnrollment(db, ids.workspaceId, ids.agentId).catch(() => null);\n  if (!enrollment || enrollment.connectionInstanceId !== ids.connectionInstanceId) return;\n  try {\n    const renewed = await renewEnrollmentConnection(db, {\n      accountId: enrollment.accountId,\n      workspaceId: ids.workspaceId,\n      enrollmentId: ids.agentId,\n      connectionInstanceId: ids.connectionInstanceId,\n      leaseMs: AGENT_CONNECTION_LEASE_MS,\n    });\n    if (!renewed.renewed) return;\n  } catch (error) {\n    observability?.warn?.(\"Failed to renew a machine connection heartbeat\", {\n      subject,\n      error: error instanceof Error ? error.message : String(error),\n    });\n    return;\n  }\n  // A live machine behind its promoted build is asked to update; the decision\n  // reads only this enrollment, and a request never blocks heartbeat ingestion.\n  agentUpdates?.consider(enrollment);\n  if (heartbeat.attachedBrowserInventory) {\n    try {\n      await ingestAttachedBrowserInventory(db, {\n        workspaceId: ids.workspaceId,\n        agentId: ids.agentId,\n        inventory: heartbeat.attachedBrowserInventory,\n      });\n    } catch (error) {\n      observability?.warn?.(\"Failed to ingest an attached-browser inventory\", {\n        subject,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  if (heartbeat.desktopStatus) {\n    try {\n      const status = heartbeat.desktopStatus;\n      const available = status.available && !status.unavailableReason;\n      const reason = status.unavailableReason || null;\n      const macPermissions = status.macPermissions;\n      const stored = enrollmentMacPermissions(enrollment.agentCapabilities);\n      // The heartbeat already read the exact enrollment. Steady state adds no\n      // extra query; the change path re-reads and fences its eventual write.\n      if (\n        enrollment.hasDisplay !== available ||\n        (enrollment.desktopUnavailableReason ?? null) !== reason ||\n        enrollment.agentCapabilities?.desktop !== available ||\n        (macPermissions !== undefined &&\n          (stored?.screenRecording !== macPermissions.screenRecording ||\n            stored?.accessibility !== macPermissions.accessibility ||\n            stored?.inputMonitoring !== macPermissions.inputMonitoring))\n      ) {\n        await refreshEnrollmentDisplay(db, {\n          workspaceId: ids.workspaceId,\n          agentId: ids.agentId,\n          hasDisplay: available,\n          desktopUnavailableReason: reason,\n          runtimeDesktop: available,\n          ...(macPermissions ? { macPermissions } : {}),\n          connectionInstanceId: ids.connectionInstanceId,\n        });\n      }\n    } catch (error) {\n      observability?.warn?.(\"Failed to refresh a machine desktop heartbeat\", {\n        subject,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  const metrics = heartbeat.metrics;\n  if (!metrics) return;\n  try {\n    await ingestHeartbeatMetrics(db, {\n      accountId: enrollment.accountId,\n      workspaceId: ids.workspaceId,\n      agentId: ids.agentId,\n      sample: metrics,\n    });\n  } catch (error) {\n    observability?.warn?.(\"Failed to ingest a machine metrics heartbeat\", {\n      subject,\n      error: error instanceof Error ? error.message : String(error),\n    });\n  }\n}\n\n/**\n * Start the metrics-ingestion consumer: subscribe exact process events and ingest\n * every heartbeat. Gated by sandboxSelfhostedEnabled (the caller checks the flag;\n * a disabled deployment never starts the consumer). Returns the unsubscribe fn.\n */\nexport function startMetricsIngestion(deps: {\n  db: Database;\n  bus: EventBus;\n  observability?: Observability;\n  agentUpdates?: AutomaticAgentUpdater | null;\n}): () => void {\n  const scheduler = createAgentEventIngestionScheduler(\n    (payload, subject) =>\n      handleAgentEventPayload(\n        deps.db,\n        deps.observability,\n        payload,\n        subject,\n        deps.bus,\n        deps.agentUpdates,\n      ),\n    {\n      onHeartbeatCoalesced: () =>\n        deps.observability?.incrementCounter({\n          name: \"opengeni_machine_heartbeat_coalesced_total\",\n          help: \"Connected Machine heartbeats collapsed while an exact runner event queue was busy.\",\n        }),\n    },\n  );\n  const unsubscribe = deps.bus.subscribeAgentEvents(AGENT_EVENTS_SUBJECT, (payload, subject) => {\n    scheduler.enqueue(payload, subject);\n  });\n  return () => {\n    unsubscribe();\n    scheduler.close();\n  };\n}\n\n// ── Connect-Hello display refresh ─────────────────────────────────────────────\n\n/**\n * The LIVE display presence the agent's Hello reports: a desktop framebuffer is\n * available (`capabilities.desktop`, which the agent sets true only when a display\n * probes AND it can stream it) OR a `Display` detail is present. An unset\n * Capabilities (or a headless machine) → false. This is what `has_display` should\n * track, replacing the enroll-time snapshot.\n */\nexport function helloReportsDisplay(hello: Hello): boolean {\n  const caps = hello.capabilities;\n  if (!caps) {\n    return false;\n  }\n  // A CAPTURE-BLOCKED display is NOT a usable display: a Mac reports a display but\n  // withholds `desktop` and sets `desktopUnavailableReason` when Screen Recording\n  // (TCC) is not granted. Treating it as \"has display\" is exactly how the 0.1.3\n  // incident hid — the machine claimed a desktop it could not capture, so it was\n  // offered for computer-use and the model saw a blank. Gate it out here (the single\n  // source of truth for `has_display`, consumed by both the machine state and the\n  // capability negotiation). The `display`-present fallback is preserved for every\n  // other case (e.g. a relay-less agent that reports a display but not `desktop`).\n  if (caps.desktopUnavailableReason) {\n    return false;\n  }\n  return caps.desktop === true || caps.display != null;\n}\n\n/**\n * The human, actionable reason a display is present but UNUSABLE (macOS Screen\n * Recording / TCC not granted), or null when capture is permitted / the machine is\n * headless. Normalizes the proto's non-optional \"\" empty string to null so the DB\n * carries a clean tri-state (a real reason vs. no reason) — the Machines dashboard\n * shows \"display: capture not granted\" only when this is non-null.\n */\nexport function helloDesktopUnavailableReason(hello: Hello): string | null {\n  const reason = hello.capabilities?.desktopUnavailableReason;\n  return reason ? reason : null;\n}\n\n/** Whether the runner's current Hello advertises the op-stream engine. */\nexport function helloReportsOpStream(hello: Hello): boolean {\n  return hello.capabilities?.opStream === true;\n}\n\nexport function helloRuntimeCapabilities(hello: Hello): Record<string, boolean> {\n  const caps = hello.capabilities;\n  // Absence is an older-agent/unknown signal, not a fabricated set of false claims.\n  // Keep the durable cursor empty so reconnects from legacy agents remain a\n  // no-op and future capability additions do not get silently fabricated.\n  if (!caps) return {};\n  return {\n    exec: caps.exec === true,\n    filesystem: caps.filesystem === true,\n    git: caps.git === true,\n    pty: caps.pty === true,\n    desktop: caps.desktop === true,\n    opStream: caps.opStream === true,\n    browserBridge: caps.browserBridge === true,\n    operationResourcePolicy: caps.operationResourcePolicy === true,\n    operationCpuQuota: caps.operationCpuQuota === true,\n    transactionalFsWrite: caps.transactionalFsWrite === true,\n    credentialRenew: caps.credentialRenew === true,\n    screenControl: caps.consentedScreenControl === true,\n    ...(caps.macPermissions ? enrollmentMacPermissionCapabilities(caps.macPermissions) : {}),\n  };\n}\n\nfunction helloCompletedUpdate(hello: Hello): {\n  operationId: string;\n  targetVersion: string;\n  binarySha256: string;\n} | null {\n  if (\n    !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(\n      hello.completedUpdateOperationId,\n    ) ||\n    !/^(?:v)?\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/.test(hello.completedUpdateTargetVersion) ||\n    !/^[0-9a-f]{64}$/.test(hello.completedUpdateBinarySha256)\n  ) {\n    return null;\n  }\n  return {\n    operationId: hello.completedUpdateOperationId,\n    targetVersion: hello.completedUpdateTargetVersion,\n    binarySha256: hello.completedUpdateBinarySha256,\n  };\n}\n\n/**\n * Reconcile `enrollments.has_display` (+ the capture-blocked reason) to what a Hello\n * reports. Resolves the enrollment (the accountId is the RLS principal + the\n * existence check + the current values). A no-change Hello short-circuits BEFORE\n * issuing any write (and the DB writer is itself change-guarded on BOTH fields as a\n * backstop), so a steady state never churns. An unknown/cross-workspace agentId is a\n * no-op.\n */\nexport async function refreshEnrollmentDisplay(\n  db: Database,\n  input: {\n    workspaceId: string;\n    agentId: string;\n    hasDisplay: boolean;\n    desktopUnavailableReason?: string | null;\n    runtimeDesktop?: boolean;\n    macPermissions?: EnrollmentMacPermissions;\n    connectionInstanceId?: string;\n  },\n): Promise<{ updated: boolean }> {\n  const desktopUnavailableReason = input.desktopUnavailableReason ?? null;\n  const enrollment = await getEnrollment(db, input.workspaceId, input.agentId);\n  if (!enrollment) {\n    return { updated: false };\n  }\n  if (\n    enrollment.hasDisplay === input.hasDisplay &&\n    (enrollment.desktopUnavailableReason ?? null) === desktopUnavailableReason &&\n    (input.runtimeDesktop === undefined ||\n      enrollment.agentCapabilities?.desktop === input.runtimeDesktop) &&\n    (input.macPermissions === undefined ||\n      JSON.stringify(enrollmentMacPermissions(enrollment.agentCapabilities)) ===\n        JSON.stringify({\n          screenRecording: input.macPermissions.screenRecording,\n          accessibility: input.macPermissions.accessibility,\n          inputMonitoring: input.macPermissions.inputMonitoring,\n        }))\n  ) {\n    // Both fields unchanged — do not even issue the UPDATE (no churn on a\n    // steady-state Hello).\n    return { updated: false };\n  }\n  return await setEnrollmentDisplayState(db, {\n    accountId: enrollment.accountId,\n    workspaceId: input.workspaceId,\n    enrollmentId: input.agentId,\n    hasDisplay: input.hasDisplay,\n    desktopUnavailableReason,\n    ...(input.runtimeDesktop !== undefined ? { runtimeDesktop: input.runtimeDesktop } : {}),\n    ...(input.macPermissions ? { macPermissions: input.macPermissions } : {}),\n    ...(input.connectionInstanceId ? { connectionInstanceId: input.connectionInstanceId } : {}),\n  });\n}\n\n/**\n * Reconcile `enrollments.op_stream` to what a Hello reports. Resolves the\n * enrollment first so the accountId remains the RLS principal and so a no-change\n * Hello short-circuits BEFORE issuing any write (the DB writer is itself\n * change-guarded as a backstop). An unknown/cross-workspace agentId is a no-op.\n */\nexport async function refreshEnrollmentOpStream(\n  db: Database,\n  input: {\n    workspaceId: string;\n    agentId: string;\n    opStream: boolean;\n    connectionInstanceId?: string;\n  },\n): Promise<{ updated: boolean }> {\n  const enrollment = await getEnrollment(db, input.workspaceId, input.agentId);\n  if (!enrollment) {\n    return { updated: false };\n  }\n  if (enrollment.opStream === input.opStream) {\n    // The capability is unchanged — do not even issue the UPDATE (no churn on a\n    // steady-state Hello).\n    return { updated: false };\n  }\n  return await setEnrollmentOpStreamState(db, {\n    accountId: enrollment.accountId,\n    workspaceId: input.workspaceId,\n    enrollmentId: input.agentId,\n    opStream: input.opStream,\n    ...(input.connectionInstanceId ? { connectionInstanceId: input.connectionInstanceId } : {}),\n  });\n}\n\n/**\n * Decode a raw `Hello` payload + refresh the enrollment's display cursor + clear\n * any pending clean going-offline marker and, when the reconnect actually cleared\n * one, fan out machine.link.restored to the sessions with an active op on the\n * machine (the per-message handler for the hello plane). Decode failures + write\n * failures are reported + swallowed — a Hello must NEVER break the agent's connect.\n * `bus` (when present) enables the link.restored fan-out.\n */\nexport async function handleHelloPayload(\n  db: Database,\n  observability: Observability | undefined,\n  payload: Uint8Array,\n  subject: string,\n  bus?: EventBus,\n): Promise<void> {\n  const ids = parseAgentHelloSubject(subject);\n  if (!ids) {\n    return;\n  }\n  let hello: Hello;\n  try {\n    hello = Hello.decode(payload);\n  } catch (error) {\n    observability?.warn?.(\"Failed to decode an agent Hello for display refresh\", {\n      subject,\n      error: error instanceof Error ? error.message : String(error),\n    });\n    return;\n  }\n  const authority = await getLiveEnrollmentConnection(db, ids.workspaceId, ids.agentId).catch(\n    () => null,\n  );\n  if (!authority || authority.connectionInstanceId !== ids.connectionInstanceId) {\n    observability?.warn?.(\"Ignored a Hello from a superseded runner instance\", {\n      workspaceId: ids.workspaceId,\n      agentId: ids.agentId,\n    });\n    return;\n  }\n  let workspaceRoot: string | undefined;\n  if (hello.workspaceRoot.length > 0) {\n    try {\n      workspaceRoot = normalizeConnectedMachineWorkspaceRoot(hello.workspaceRoot, authority.os);\n    } catch (error) {\n      observability?.warn?.(\"Ignored an invalid Connected Machine workspace root\", {\n        workspaceId: ids.workspaceId,\n        agentId: ids.agentId,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  try {\n    await refreshEnrollmentDisplay(db, {\n      workspaceId: ids.workspaceId,\n      agentId: ids.agentId,\n      hasDisplay: helloReportsDisplay(hello),\n      desktopUnavailableReason: helloDesktopUnavailableReason(hello),\n      connectionInstanceId: ids.connectionInstanceId,\n    });\n    await refreshEnrollmentOpStream(db, {\n      workspaceId: ids.workspaceId,\n      agentId: ids.agentId,\n      opStream: helloReportsOpStream(hello),\n      connectionInstanceId: ids.connectionInstanceId,\n    });\n    await setEnrollmentAgentRuntime(db, {\n      accountId: authority.accountId,\n      workspaceId: ids.workspaceId,\n      enrollmentId: ids.agentId,\n      connectionInstanceId: ids.connectionInstanceId,\n      agentVersion: hello.agentVersion.trim() || null,\n      binarySha256: /^[0-9a-f]{64}$/.test(hello.binarySha256) ? hello.binarySha256 : null,\n      updateChannel:\n        hello.updateChannel === \"stable\" || hello.updateChannel === \"beta\"\n          ? hello.updateChannel\n          : null,\n      capabilities: helloRuntimeCapabilities(hello),\n      ...(workspaceRoot !== undefined ? { workspaceRoot } : {}),\n      completedUpdate: helloCompletedUpdate(hello),\n    });\n  } catch (error) {\n    observability?.warn?.(\"Failed to refresh an enrollment's capabilities from a Hello\", {\n      subject,\n      error: error instanceof Error ? error.message : String(error),\n    });\n  }\n  // Screen control allowed while this machine was offline (or before its agent\n  // could renew on request) applies now. Detached: it waits for the agent to\n  // subscribe and must not hold up Hello ingestion.\n  void reconcileScreenControlOnHello(\n    { bus, observability },\n    {\n      authority,\n      hello,\n      target: {\n        workspaceId: ids.workspaceId,\n        enrollmentId: ids.agentId,\n        connectionInstanceId: ids.connectionInstanceId,\n      },\n    },\n  );\n  // A reconnect Hello re-announces the machine, so any pending clean going-offline\n  // marker no longer holds — clear it so the liveness derivation stops reading the\n  // machine offline. Best-effort + fail-soft, and change-guarded in the DB (a\n  // steady-state Hello with no marker writes nothing), so this never breaks the\n  // agent's connect and never churns. When a marker was ACTUALLY cleared (the\n  // machine had been reported link.lost), fan out machine.link.restored to the\n  // sessions with an active op on it — a restored only ever pairs a prior lost, so\n  // a routine connect Hello (no marker) emits nothing.\n  try {\n    const { cleared } = await clearEnrollmentWentOffline(db, {\n      accountId: authority.accountId,\n      workspaceId: ids.workspaceId,\n      enrollmentId: ids.agentId,\n      connectionInstanceId: ids.connectionInstanceId,\n    });\n    if (cleared && bus) {\n      await fanOutMachineLinkEvents(\n        db,\n        bus,\n        observability,\n        ids.workspaceId,\n        ids.agentId,\n        (activeTurnId) => [{ type: \"machine.link.restored\", turnId: activeTurnId, payload: {} }],\n      );\n    }\n  } catch (error) {\n    observability?.warn?.(\"Failed to clear a machine going-offline marker on a Hello\", {\n      subject,\n      error: error instanceof Error ? error.message : String(error),\n    });\n  }\n}\n\n/**\n * Start the Hello display-refresh consumer: subscribe exact process hellos and\n * reconcile `has_display` to the live capability the agent reports on every\n * connect. Gated by sandboxSelfhostedEnabled (the caller checks the flag). Returns\n * the unsubscribe fn.\n */\nexport function startHelloIngestion(deps: {\n  db: Database;\n  bus: EventBus;\n  observability?: Observability;\n}): () => void {\n  return deps.bus.subscribeAgentEvents(AGENT_HELLO_SUBJECT, (payload, subject) =>\n    handleHelloPayload(deps.db, deps.observability, payload, subject, deps.bus),\n  );\n}\n","import {\n  claimMemorySlackPublication,\n  completeMemorySlackPublication,\n  currentMemorySlackConfigurationMatches,\n  deferMemorySlackPublication,\n  failMemorySlackPublication,\n  type ClaimedMemorySlackPublication,\n} from \"@opengeni/db\";\nimport { sanitizeSlackPublicationText, type ApiRouteDeps } from \"@opengeni/core\";\nimport {\n  createOpenGeniSlackBotInteractionClient,\n  SlackBotProviderError,\n} from \"./integrations/slack-bot\";\n\nconst DELIVERY_LEASE_MS = 30_000;\nconst MAX_DELIVERY_ATTEMPTS = 8;\nconst MAX_DELIVERY_RETRY_MS = 5 * 60_000;\nconst MAX_SLACK_MESSAGE_CHARS = 3_500;\n\nexport async function drainMemorySlackPublicationsOnce(deps: ApiRouteDeps): Promise<boolean> {\n  const claimHolderId = crypto.randomUUID();\n  const publication = await claimMemorySlackPublication(deps.db, claimHolderId, DELIVERY_LEASE_MS);\n  if (!publication) return false;\n\n  try {\n    if (!(await currentMemorySlackConfigurationMatches(deps.db, publication))) {\n      await failMemorySlackPublication(deps.db, {\n        publication,\n        claimHolderId,\n        errorCode: \"configuration_changed\",\n        cancelled: true,\n      });\n      return true;\n    }\n    const client = await createOpenGeniSlackBotInteractionClient(deps, {\n      accountId: publication.accountId,\n      workspaceId: publication.workspaceId,\n      connectionId: publication.connectionId,\n      subjectId: publication.initiatorSubjectId,\n      sessionId: publication.sessionId,\n    });\n    const result = await client.postMessage({\n      operationId: publication.operationId,\n      channelId: publication.slackChannelId,\n      text: formatMemorySlackPublicationMessage(deps, publication),\n      requireActiveNonSharedChannel: true,\n    });\n    const completed = await completeMemorySlackPublication(deps.db, {\n      publication,\n      claimHolderId,\n      slackChannelId: result.channelId,\n      slackMessageTimestamp: result.timestamp,\n    });\n    if (!completed) throw new Error(\"Memory Slack publication lost its durable claim\");\n  } catch (error) {\n    const errorCode = deliveryErrorCode(error);\n    if (memorySlackDestinationDrift(error)) {\n      await failMemorySlackPublication(deps.db, {\n        publication,\n        claimHolderId,\n        errorCode,\n        cancelled: true,\n      }).catch(() => undefined);\n    } else if (publication.attemptCount >= MAX_DELIVERY_ATTEMPTS || permanentDeliveryError(error)) {\n      await failMemorySlackPublication(deps.db, {\n        publication,\n        claimHolderId,\n        errorCode,\n      }).catch(() => undefined);\n    } else {\n      await deferMemorySlackPublication(deps.db, {\n        publication,\n        claimHolderId,\n        errorCode,\n        retryAt: new Date(Date.now() + deliveryRetryMs(error, publication.attemptCount)),\n      }).catch(() => undefined);\n    }\n  }\n  return true;\n}\n\nexport function startMemorySlackPublicationPump(\n  deps: ApiRouteDeps,\n  options: { intervalMs?: number; maxPerTick?: number } = {},\n): () => Promise<void> {\n  let stopped = false;\n  let running: Promise<void> | undefined;\n  const intervalMs = Math.max(250, options.intervalMs ?? 1_000);\n  const maxPerTick = Math.max(1, Math.min(50, options.maxPerTick ?? 10));\n  const tick = () => {\n    if (stopped || running) return;\n    running = (async () => {\n      for (let index = 0; index < maxPerTick; index += 1) {\n        if (!(await drainMemorySlackPublicationsOnce(deps))) break;\n      }\n    })()\n      .catch((error) => {\n        deps.observability?.error(\"Memory Slack publication claim failed\", {\n          errorClass: error instanceof Error ? error.name : \"MemorySlackPublicationPumpError\",\n          errorCode: deliveryErrorCode(error),\n          origin: \"api\",\n        });\n      })\n      .finally(() => {\n        running = undefined;\n      });\n  };\n  const timer = setInterval(tick, intervalMs);\n  queueMicrotask(tick);\n  return async () => {\n    stopped = true;\n    clearInterval(timer);\n    await running;\n  };\n}\n\nexport function formatMemorySlackPublicationMessage(\n  deps: Pick<ApiRouteDeps, \"settings\">,\n  publication: ClaimedMemorySlackPublication,\n): string {\n  const projection = publication.projection;\n  const summary = boundedProjectionString(projection[\"summary\"], 512) || \"Important change\";\n  const owner = boundedProjectionString(projection[\"ownerLabel\"], 96);\n  const occurredAt = boundedProjectionString(projection[\"occurredAt\"], 64);\n  const changeKind = boundedProjectionString(projection[\"changeKind\"], 32);\n  const destination = boundedProjectionString(projection[\"destination\"], 64);\n  const outcome = boundedProjectionString(projection[\"outcome\"], 64);\n  const heading =\n    publication.sourceType === \"workspace_memory\"\n      ? `Workspace Memory ${changeKind || \"change\"}`\n      : `Governed learning ${outcome || \"change\"}`;\n  const details = [\n    `Importance: ${publication.importance}`,\n    ...(destination ? [`Surface: ${destination}`] : []),\n    ...(owner ? [`Owner: ${owner}`] : []),\n    ...(occurredAt ? [`Recorded: ${occurredAt}`] : []),\n  ];\n  const path =\n    publication.sourceType === \"workspace_memory\"\n      ? `/workspaces/${publication.workspaceId}/memory?memoryId=${encodeURIComponent(publication.sourceId)}`\n      : `/workspaces/${publication.workspaceId}/workspace-state`;\n  const base = deps.settings.webBaseUrl ?? deps.settings.publicBaseUrl;\n  const link = base ? new URL(path, base).toString() : null;\n  const text = `*${heading}*\\n${summary}\\n\\n${details.join(\" · \")}${link ? `\\n${link}` : \"\"}`;\n  return text.length <= MAX_SLACK_MESSAGE_CHARS\n    ? text\n    : `${text.slice(0, MAX_SLACK_MESSAGE_CHARS - 20)}\\n… message truncated`;\n}\n\nconst PERMANENT_DELIVERY_CODES = new Set([\n  \"account_inactive\",\n  \"channel_not_found\",\n  \"invalid_auth\",\n  \"is_archived\",\n  \"not_authed\",\n  \"not_in_channel\",\n  \"token_expired\",\n  \"token_revoked\",\n]);\n\nconst MEMORY_SLACK_DESTINATION_DRIFT_CODES = new Set([\n  \"channel_not_found\",\n  \"is_archived\",\n  \"not_in_channel\",\n  \"slack_connect_unsupported\",\n]);\n\nexport function memorySlackDestinationDrift(error: unknown) {\n  return (\n    error instanceof SlackBotProviderError && MEMORY_SLACK_DESTINATION_DRIFT_CODES.has(error.code)\n  );\n}\n\nfunction permanentDeliveryError(error: unknown) {\n  if (!(error instanceof SlackBotProviderError)) return false;\n  if (PERMANENT_DELIVERY_CODES.has(error.code)) return true;\n  const status = /^http_(\\d{3})$/.exec(error.code)?.[1];\n  return status\n    ? Number(status) >= 400 && Number(status) < 500 && status !== \"408\" && status !== \"429\"\n    : false;\n}\n\nfunction deliveryRetryMs(error: unknown, attemptCount: number) {\n  if (error instanceof SlackBotProviderError && error.retryAfterMs) {\n    return Math.min(Math.max(error.retryAfterMs, 1_000), MAX_DELIVERY_RETRY_MS);\n  }\n  return Math.min(1_000 * 2 ** Math.max(0, attemptCount - 1), MAX_DELIVERY_RETRY_MS);\n}\n\nfunction deliveryErrorCode(error: unknown) {\n  if (error instanceof SlackBotProviderError) return error.code.slice(0, 128);\n  const raw = error instanceof Error ? error.name : \"memory_slack_delivery_error\";\n  return (\n    raw\n      .toLowerCase()\n      .replace(/[^a-z0-9_-]/g, \"_\")\n      .slice(0, 128) || \"error\"\n  );\n}\n\nfunction boundedProjectionString(value: unknown, maxChars: number) {\n  return typeof value === \"string\"\n    ? escapeSlackText(sanitizeSlackPublicationText(value).slice(0, maxChars))\n    : \"\";\n}\n\nfunction escapeSlackText(value: string) {\n  return value.replaceAll(\"&\", \"&amp;\").replaceAll(\"<\", \"&lt;\").replaceAll(\">\", \"&gt;\");\n}\n","import {\n  acknowledgeScheduledTaskScheduleReconciliation,\n  deferScheduledTaskScheduleReconciliation,\n  listExhaustedScheduledTasks,\n  listScheduledTaskScheduleReconciliations,\n  retireExhaustedScheduledTask,\n  type Database,\n} from \"@opengeni/db\";\nimport type { ScheduledTask } from \"@opengeni/contracts\";\nimport type { EventBus } from \"@opengeni/events\";\nimport type { Observability } from \"@opengeni/observability\";\nimport { reviewScheduledTaskBlockerInventory } from \"./scheduled-task-blockers\";\n\ntype Dependencies = {\n  db: Database;\n  sync(task: Pick<ScheduledTask, \"id\" | \"workspaceId\" | \"temporalScheduleId\">): Promise<void>;\n  /** Enables blocked-schedule review: self-pause and the owner notice it posts. */\n  bus?: EventBus;\n  observability?: Pick<Observability, \"error\">;\n};\n\nexport async function reconcileExhaustedScheduledTasks(deps: Dependencies): Promise<void> {\n  for (const candidate of await listExhaustedScheduledTasks(deps.db)) {\n    await retireExhaustedScheduledTask(deps.db, candidate.workspace_id, candidate.id);\n  }\n  // Before Temporal reconciliation, so a schedule that paused itself stops\n  // firing in the same pass.\n  if (deps.bus) {\n    await reviewScheduledTaskBlockerInventory({\n      db: deps.db,\n      bus: deps.bus,\n      observability: deps.observability,\n    });\n  }\n  for (const pending of await listScheduledTaskScheduleReconciliations(deps.db)) {\n    try {\n      // The synchronizer takes the shared external-write lock and rereads the\n      // current task, including edits/deletion committed since retirement.\n      await deps.sync({\n        id: pending.task_id,\n        workspaceId: pending.workspace_id,\n        temporalScheduleId: pending.temporal_schedule_id,\n      });\n      await acknowledgeScheduledTaskScheduleReconciliation(\n        deps.db,\n        pending.workspace_id,\n        pending.id,\n      );\n    } catch (error) {\n      await deferScheduledTaskScheduleReconciliation(deps.db, pending.workspace_id, pending.id);\n      deps.observability?.error(\"Exhausted schedule reconciliation will retry\", {\n        taskId: pending.task_id,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n}\n\nexport function startScheduledTaskLifecyclePump(\n  deps: Dependencies,\n  intervalMs = 30_000,\n): () => Promise<void> {\n  let stopped = false;\n  let running: Promise<void> | undefined;\n  const tick = () => {\n    if (stopped || running) return;\n    running = reconcileExhaustedScheduledTasks(deps)\n      .catch((error: unknown) => {\n        deps.observability?.error(\"Exhausted schedule inventory failed\", {\n          error: error instanceof Error ? error.message : String(error),\n        });\n      })\n      .finally(() => {\n        running = undefined;\n      });\n  };\n  const timer = setInterval(tick, intervalMs);\n  queueMicrotask(tick);\n  return async () => {\n    stopped = true;\n    clearInterval(timer);\n    await running;\n  };\n}\n","import {\n  NOTIFICATION_SUBTITLE_MAX_CHARS,\n  SessionNotificationPostedPayload,\n  SessionNotificationWithdrawnPayload,\n} from \"@opengeni/contracts\";\nimport {\n  getPendingScheduledTaskBlockerNotice,\n  listScheduledTaskBlockerReviews,\n  reviewScheduledTaskBlockers,\n  settleScheduledTaskBlockerNotice,\n  type Database,\n  type ScheduledTaskBlockerDecision,\n  type ScheduledTaskBlockerFacts,\n  type ScheduledTaskBlockerRun,\n} from \"@opengeni/db\";\nimport { appendAndPublishEvents, type EventBus } from \"@opengeni/events\";\nimport type { Observability } from \"@opengeni/observability\";\n\n/**\n * A schedule must never stay stuck without its owner knowing. After each\n * settled scheduled run:\n *\n * - When the platform knows no later run can start until a person acts (its\n *   chat is paused or gone, a pinned account or other resource it needs is\n *   unavailable, or it was refused as non-retryable), the schedule pauses\n *   itself with that reason and its owner is told once.\n * - When runs keep failing or being skipped for a reason that may clear by\n *   itself, the owner is told once, after {@link SCHEDULED_TASK_BLOCKER_STREAK}\n *   in a row; the schedule keeps running. A single skip or failure is normal.\n *\n * The notice is withdrawn when a later run succeeds or a person resumes,\n * pauses or deletes the schedule. Only scheduled (not manual) runs count, and\n * only runs since the schedule was last edited or resumed.\n */\nexport const SCHEDULED_TASK_BLOCKER_STREAK = 3;\n\nconst SETTLED = new Set([\"succeeded\", \"failed\", \"skipped\"]);\n\ntype Blocker = { reason: string; text: string };\n\nconst RESUME = \"then resume the schedule.\";\n\nconst NON_RETRYABLE_REFUSAL_TEXT: Record<string, string> = {\n  scheduled_authority_unavailable: `The access it was set up with is no longer valid. Refresh the schedule's access, ${RESUME}`,\n  machine_target_unavailable: `The machine it runs on is no longer available. Choose another machine or reconnect this one, ${RESUME}`,\n  machine_enrollment_inactive: `The machine it runs on is disconnected from Opengeni. Reconnect the machine, ${RESUME}`,\n  variable_set_unavailable: `A variable set it uses no longer exists or can't be used. Edit the schedule, ${RESUME}`,\n  rig_version_unavailable: `Its rig has no usable version. Publish a rig version or edit the schedule, ${RESUME}`,\n  scheduled_model_unavailable: `Its model is no longer available. Edit the schedule to choose another model, ${RESUME}`,\n};\n\nconst RETRYABLE_REFUSAL_TEXT: Record<string, string> = {\n  machine_enrollment_inactive: \"the machine it runs on is disconnected\",\n  insufficient_credits: \"the workspace is out of credits\",\n  allowance_exhausted: \"the usage allowance is used up\",\n  monthly_model_cost_limit: \"the monthly model cost limit was reached\",\n  monthly_agent_run_limit: \"the monthly run limit was reached\",\n  session_usage_limit: \"the schedule reached its usage limit\",\n};\n\n/** A blocker no later run can get past until a person acts, or null. */\nexport function scheduledRunHardBlocker(\n  task: Pick<ScheduledTaskBlockerFacts[\"task\"], \"runMode\">,\n  run: ScheduledTaskBlockerRun,\n): Blocker | null {\n  if (run.admissionDiagnostic) {\n    return {\n      reason: \"connection_account_unavailable\",\n      text: `A connected account it needs can no longer be used. Reconnect that account or refresh the schedule's access, ${RESUME}`,\n    };\n  }\n  if (run.admissionRefusal && !run.admissionRefusal.retryable) {\n    const reason = run.admissionRefusal.reason;\n    return {\n      reason,\n      text:\n        NON_RETRYABLE_REFUSAL_TEXT[reason] ??\n        `Every run is refused before it starts (${reason}). Fix that, ${RESUME}`,\n    };\n  }\n  switch (run.error) {\n    case \"scheduled_session_paused\":\n      return {\n        reason: run.error,\n        text: `Its chat is paused, so no run can start there. Resume the chat, ${RESUME}`,\n      };\n    case \"session_cancelled\":\n      // A run that starts a new chat each time is not blocked by one ended chat.\n      return task.runMode === \"new_session_per_run\"\n        ? null\n        : {\n            reason: run.error,\n            text: `The chat it runs in has ended, so no run can start there. Point the schedule at another chat or let it start a new chat each run, ${RESUME}`,\n          };\n    case \"scheduled_target_session_unavailable\":\n      return {\n        reason: run.error,\n        text: `The chat it runs in no longer exists. Point the schedule at another chat or let it start a new chat each run, ${RESUME}`,\n      };\n    case \"scheduled_model_unavailable\":\n      return { reason: run.error, text: NON_RETRYABLE_REFUSAL_TEXT.scheduled_model_unavailable! };\n    default:\n      return null;\n  }\n}\n\nfunction streakBlocker(streak: readonly ScheduledTaskBlockerRun[]): Blocker {\n  const count = streak.length;\n  if (streak.every((run) => run.error === \"scheduled_session_not_idle\")) {\n    return {\n      reason: \"scheduled_session_not_idle\",\n      text: `The last ${count} scheduled runs were skipped because its chat was still busy with earlier work. Check whether that chat is stuck. The schedule keeps trying.`,\n    };\n  }\n  const refusal = streak[0]?.admissionRefusal;\n  if (\n    refusal?.retryable &&\n    streak.every(\n      (run) => run.admissionRefusal?.retryable && run.admissionRefusal.reason === refusal.reason,\n    )\n  ) {\n    return {\n      reason: refusal.reason,\n      text: `The last ${count} scheduled runs were skipped because ${\n        RETRYABLE_REFUSAL_TEXT[refusal.reason] ?? `they were refused (${refusal.reason})`\n      }. Runs start again once that clears.`,\n    };\n  }\n  const latest = streak[0]!;\n  return {\n    reason: latest.error ?? latest.status,\n    text: `The last ${count} scheduled runs failed or were skipped. Open the latest run to see why. The schedule keeps trying.`,\n  };\n}\n\nexport function scheduledTaskBlockerNoticeKey(taskId: string): string {\n  return `schedule-${taskId}`;\n}\n\nfunction clip(text: string, max: number): string {\n  return text.length <= max ? text : `${text.slice(0, max - 1).trimEnd()}…`;\n}\n\nfunction notice(\n  facts: ScheduledTaskBlockerFacts,\n  run: ScheduledTaskBlockerRun,\n  state: \"notified\" | \"paused\",\n  blocker: Blocker,\n): Extract<ScheduledTaskBlockerDecision, { kind: \"block\" }>[\"notice\"] {\n  // The chat the owner opens from the notice: the blocked run's own, else the\n  // chat the schedule runs in, else the most recent run's.\n  const sessionId =\n    run.sessionId ??\n    facts.task.reusableSessionId ??\n    facts.runs.find((candidate) => candidate.sessionId !== null)?.sessionId ??\n    null;\n  if (!sessionId) return null;\n  const key = scheduledTaskBlockerNoticeKey(facts.task.id);\n  const payload = SessionNotificationPostedPayload.parse({\n    key,\n    title: state === \"paused\" ? \"Schedule paused itself\" : \"Schedule needs attention\",\n    subtitle: clip(facts.task.name.trim() || \"Scheduled task\", NOTIFICATION_SUBTITLE_MAX_CHARS),\n    body:\n      state === \"paused\"\n        ? `${blocker.text} It stays paused until someone resumes it.`\n        : blocker.text,\n    urgency: \"normal\",\n    replaced: false,\n  });\n  return { sessionId, key, payload };\n}\n\n/** The pure review of one schedule's newest settled scheduled run. */\nexport function decideScheduledTaskBlocker(\n  facts: ScheduledTaskBlockerFacts,\n): ScheduledTaskBlockerDecision {\n  const { task, review, runs } = facts;\n  const blocked = review !== null && review.state !== \"clear\";\n  // A person acted: resumed a self-paused schedule, or paused or deleted one\n  // they were told about. Keep the reviewed run; a new one is reviewed next.\n  if (task.deleted) return blocked ? { kind: \"clear\", reviewedRunId: null } : none(null);\n  if (review?.state === \"paused\" && task.status === \"active\") {\n    return { kind: \"clear\", reviewedRunId: null };\n  }\n  if (review?.state === \"notified\" && task.status !== \"active\") {\n    return { kind: \"clear\", reviewedRunId: null };\n  }\n  if (task.status !== \"active\") return none(null);\n  const latest = runs[0];\n  if (!latest || !SETTLED.has(latest.status) || latest.id === review?.reviewedRunId) {\n    return none(null);\n  }\n  if (latest.status === \"succeeded\") {\n    return review?.state === \"notified\"\n      ? { kind: \"clear\", reviewedRunId: latest.id }\n      : none(latest.id);\n  }\n  // Runs before the last edit or resume say nothing about the schedule now.\n  const current = (run: ScheduledTaskBlockerRun) => run.createdAt >= task.updatedAt;\n  const hard = current(latest) ? scheduledRunHardBlocker(task, latest) : null;\n  if (hard) {\n    return {\n      kind: \"block\",\n      state: \"paused\",\n      reason: hard.reason,\n      message: hard.text,\n      blockedRunId: latest.id,\n      blockedSince: latest.createdAt,\n      reviewedRunId: latest.id,\n      notice: notice(facts, latest, \"paused\", hard),\n    };\n  }\n  if (review?.state === \"notified\") return none(latest.id);\n  const streak: ScheduledTaskBlockerRun[] = [];\n  for (const run of runs) {\n    if (!SETTLED.has(run.status) || run.status === \"succeeded\" || !current(run)) break;\n    streak.push(run);\n  }\n  if (streak.length < SCHEDULED_TASK_BLOCKER_STREAK) return none(latest.id);\n  const soft = streakBlocker(streak);\n  const first = streak.at(-1)!;\n  return {\n    kind: \"block\",\n    state: \"notified\",\n    reason: soft.reason,\n    message: soft.text,\n    blockedRunId: first.id,\n    blockedSince: first.createdAt,\n    reviewedRunId: latest.id,\n    notice: notice(facts, latest, \"notified\", soft),\n  };\n}\n\nfunction none(reviewedRunId: string | null): ScheduledTaskBlockerDecision {\n  return { kind: \"none\", reviewedRunId };\n}\n\ntype Dependencies = {\n  db: Database;\n  bus: EventBus;\n  observability?: Pick<Observability, \"error\"> | undefined;\n};\n\nfunction sessionMissing(error: unknown): boolean {\n  return error instanceof Error && /^Session not found: /u.test(error.message);\n}\n\n/** Post or withdraw the owner notice a review left pending. */\nexport async function deliverScheduledTaskBlockerNotice(\n  deps: Dependencies,\n  workspaceId: string,\n  taskId: string,\n): Promise<void> {\n  const pending = await getPendingScheduledTaskBlockerNotice(deps.db, workspaceId, taskId);\n  if (!pending) return;\n  try {\n    await appendAndPublishEvents(deps.db, deps.bus, workspaceId, pending.sessionId, [\n      pending.pending === \"post\"\n        ? {\n            type: \"session.notification.posted\",\n            payload: SessionNotificationPostedPayload.parse(pending.payload),\n          }\n        : {\n            type: \"session.notification.withdrawn\",\n            payload: SessionNotificationWithdrawnPayload.parse({ key: pending.key }),\n          },\n    ] as Parameters<typeof appendAndPublishEvents>[4]);\n  } catch (error) {\n    // A deleted chat cannot carry the notice; the schedule page still shows why.\n    if (!sessionMissing(error)) throw error;\n  }\n  await settleScheduledTaskBlockerNotice(deps.db, workspaceId, taskId, pending);\n}\n\n/** One bounded pass over schedules with a run to review or a notice to deliver. */\nexport async function reviewScheduledTaskBlockerInventory(deps: Dependencies): Promise<void> {\n  for (const candidate of await listScheduledTaskBlockerReviews(deps.db)) {\n    try {\n      await reviewScheduledTaskBlockers(\n        deps.db,\n        candidate.workspace_id,\n        candidate.id,\n        decideScheduledTaskBlocker,\n      );\n      await deliverScheduledTaskBlockerNotice(deps, candidate.workspace_id, candidate.id);\n    } catch (error) {\n      deps.observability?.error(\"Scheduled task blocker review will retry\", {\n        taskId: candidate.id,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n}\n","import type { ScheduledTask } from \"@opengeni/contracts\";\nimport { getScheduledTaskIncludingDeleted, type Database } from \"@opengeni/db\";\nimport { sql } from \"drizzle-orm\";\n\nconst LOCK_TIMEOUT = \"5s\";\nconst WRITE_TIMEOUT_MS = 5_000;\n\ntype TemporalScheduleSyncDependencies = {\n  db: Database;\n  withDeadline<T>(deadline: number, work: () => Promise<T>): Promise<T>;\n  upsert(task: ScheduledTask): Promise<void>;\n  /** Idempotent: an absent Temporal schedule is already removed. */\n  remove(temporalScheduleId: string): Promise<void>;\n};\n\n/**\n * Serialize external writes across API replicas, independently of task edits.\n * A queued sync rereads the newest committed row after acquiring this lock;\n * input snapshots never become desired state. Cleanup uses the same key, so\n * an in-flight upsert finishes before its tombstone's external deletion.\n * Failure compensation commits before releasing the lock, so a queued writer\n * cannot read the row being restored and then publish that failed edit.\n *\n * Deadlines bound both lock admission and network occupancy. A thrown network\n * error retains its unknown-outcome semantics; this is not durable recovery\n * for a process crash or a lost Temporal acknowledgement.\n */\nexport function createTemporalScheduleSynchronizer(deps: TemporalScheduleSyncDependencies) {\n  const write = async <T>(\n    temporalScheduleId: string,\n    work: (tx: Database) => Promise<T>,\n  ): Promise<T> =>\n    deps.db.transaction(async (tx) => {\n      await tx.execute(sql`select set_config('lock_timeout', ${LOCK_TIMEOUT}, true)`);\n      await tx.execute(sql`select pg_advisory_xact_lock(\n        hashtextextended(${`scheduled-task-temporal:${temporalScheduleId}`}, 0)\n      )`);\n      return await work(tx);\n    });\n\n  return {\n    async sync(\n      task: Pick<ScheduledTask, \"id\" | \"workspaceId\" | \"temporalScheduleId\">,\n      onFailure?: (tx: Database, error: unknown) => Promise<Error>,\n    ) {\n      const result = await write(task.temporalScheduleId, async (tx) => {\n        try {\n          await deps.withDeadline(Date.now() + WRITE_TIMEOUT_MS, async () => {\n            const current = await getScheduledTaskIncludingDeleted(tx, task.workspaceId, task.id);\n            if (current && current.temporalScheduleId !== task.temporalScheduleId)\n              throw new Error(\"Scheduled task Temporal identity changed\");\n            if (!current || current.deletedAt !== null || current.schedule.type === \"manual\") {\n              await deps.remove(task.temporalScheduleId);\n              return;\n            }\n            const { deletedAt: _deletedAt, ...latest } = current;\n            await deps.upsert(latest);\n          });\n          return { ok: true as const };\n        } catch (error) {\n          return { ok: false as const, error: onFailure ? await onFailure(tx, error) : error };\n        }\n      });\n      // Throw after commit: throwing inside the transaction would also undo a\n      // successful compensation. A failed commit cannot claim that receipt.\n      if (!result.ok) throw result.error;\n    },\n    async remove(temporalScheduleId: string) {\n      await write(temporalScheduleId, async () =>\n        deps.withDeadline(Date.now() + WRITE_TIMEOUT_MS, () => deps.remove(temporalScheduleId)),\n      );\n    },\n  };\n}\n","import { createSign, randomUUID } from \"node:crypto\";\nimport { connect, type ClientHttp2Session } from \"node:http2\";\nimport type { Settings } from \"@opengeni/config\";\nimport {\n  claimNativePushDeliveries,\n  listSessionHumanInputRequests,\n  pruneNativePushDeliveries,\n  settleNativePushDelivery,\n  type ClaimedNativePushDelivery,\n  type Database,\n  type NativePushOutcome,\n} from \"@opengeni/db\";\nimport type { Observability } from \"@opengeni/observability\";\n\n// Sends queued native app pushes (0638) through APNs (token auth over HTTP/2)\n// and FCM HTTP v1. At-least-once: a delivery is settled only after the\n// provider answered; an unknown token removes the registration.\n\nconst POLL_INTERVAL_MS = 1_000;\nconst CLAIM_SECONDS = 60;\nconst MAX_ATTEMPTS = 6;\nconst PRUNE_EVERY_TICKS = 600;\n\nexport type NativePushSendResult = { outcome: NativePushOutcome; error?: string };\n\nexport type NativePushSender = (\n  delivery: ClaimedNativePushDelivery,\n) => Promise<NativePushSendResult>;\n\n/** A claimed payload, marked when its question asks for a secret. */\nexport type NativePushPayload = ClaimedNativePushDelivery[\"payload\"] & { secretQuestion?: boolean };\n\nconst SECRET_QUESTION_PUSH_BODY = \"Open Opengeni to answer. The answer is saved to a vault.\";\n\n/**\n * Mark question pushes whose pending request asks for a secret, so they carry\n * no inline answer action and point to the app instead.\n */\nasync function markSecretQuestionDeliveries(\n  db: Database,\n  deliveries: ClaimedNativePushDelivery[],\n): Promise<ClaimedNativePushDelivery[]> {\n  const secretSessions = new Map<string, Promise<boolean>>();\n  return await Promise.all(\n    deliveries.map(async (delivery) => {\n      if (delivery.payload.eventType !== \"session.humanInput.requested\") return delivery;\n      const key = `${delivery.payload.workspaceId}:${delivery.payload.sessionId}`;\n      let lookup = secretSessions.get(key);\n      if (!lookup) {\n        lookup = listSessionHumanInputRequests(\n          db,\n          delivery.payload.workspaceId,\n          delivery.payload.sessionId,\n          { status: \"pending\", limit: 20 },\n        )\n          .then((requests) =>\n            requests.some((request) =>\n              request.questions.some((question) => question.kind === \"secret\"),\n            ),\n          )\n          .catch(() => false);\n        secretSessions.set(key, lookup);\n      }\n      if (!(await lookup)) return delivery;\n      const payload: NativePushPayload = { ...delivery.payload, secretQuestion: true };\n      return { ...delivery, payload };\n    }),\n  );\n}\n\nexport type NativePushDispatchDeps = {\n  db: Database;\n  settings: Settings;\n  observability?: Pick<Observability, \"info\" | \"warn\" | \"error\">;\n  senders?: Partial<Record<\"ios\" | \"android\", NativePushSender>>;\n};\n\n/**\n * A notification message as plain text for the lock screen: links keep their\n * text, emphasis and code marks go, and \"- \" bullets become \"•\".\n */\nexport function plainNotificationText(markdown: string): string {\n  return markdown\n    .replace(/\\[([^\\]]+)\\]\\((?:[^)]+)\\)/gu, \"$1\")\n    .replace(/(\\*\\*|__)(.+?)\\1/gu, \"$2\")\n    .replace(/`([^`]+)`/gu, \"$1\")\n    .replace(/^[ \\t]*[-*][ \\t]+/gmu, \"• \")\n    .replace(/\\n{3,}/gu, \"\\n\\n\")\n    .trim();\n}\n\n/** The visible text of a push: title, optional subtitle, and the message with its facts. */\nexport function nativePushAlert(payload: NativePushPayload): {\n  title: string;\n  subtitle?: string;\n  body?: string;\n} {\n  if (payload.secretQuestion) {\n    // A secret is answered only in the app's secure card (AC-5): no inline reply.\n    return { title: payload.title ?? \"The agent needs a secret\", body: SECRET_QUESTION_PUSH_BODY };\n  }\n  const fallback =\n    payload.rule === \"needs_input\"\n      ? \"The agent needs you\"\n      : payload.rule === \"failed\"\n        ? \"A turn failed\"\n        : payload.rule === \"reply_ready\"\n          ? \"Reply ready\"\n          : \"Opengeni\";\n  const facts = (payload.facts ?? [])\n    .slice(0, 4)\n    .map((fact) => `${fact.label}: ${fact.value}`)\n    .join(\"\\n\");\n  const message = payload.body ? plainNotificationText(payload.body) : \"\";\n  // A notification with no message of its own carries its title as the body;\n  // show the title once.\n  const lines = [message === payload.title ? \"\" : message, facts].filter(Boolean);\n  const body = lines.join(\"\\n\\n\");\n  return {\n    title: payload.title ?? fallback,\n    ...(payload.subtitle ? { subtitle: payload.subtitle } : {}),\n    ...(body || payload.rule !== \"agent\" ? { body: body || fallback } : {}),\n  };\n}\n\n/**\n * What breaks through Focus: an agent notification the agent marked\n * time-sensitive, and questions and approvals for a person who asked for them\n * to (their setting puts the urgency on the delivery). Everything else, and\n * replies and failures always, arrive as ordinary alerts, so Focus and the\n * person's own notification settings decide when they show.\n */\nexport function nativePushInterruptionLevel(\n  payload: ClaimedNativePushDelivery[\"payload\"],\n): \"time-sensitive\" | \"active\" {\n  if (\n    (payload.rule === \"agent\" || payload.rule === \"needs_input\") &&\n    payload.urgency === \"time_sensitive\"\n  ) {\n    return \"time-sensitive\";\n  }\n  return \"active\";\n}\n\n/** What the app reads on tap: enough to open the session in the right account. */\nexport function nativePushData(payload: ClaimedNativePushDelivery[\"payload\"]) {\n  return {\n    sessionId: payload.sessionId,\n    workspaceId: payload.workspaceId,\n    subjectId: payload.subjectId,\n    rule: payload.rule,\n    ...(payload.eventType ? { eventType: payload.eventType } : {}),\n    ...(payload.sequence ? { sequence: payload.sequence } : {}),\n  };\n}\n\n/**\n * The notification category the app registers actions for: an approval can be\n * approved (behind device unlock) or denied, a question answered inline.\n */\nexport function nativePushCategory(\n  payload: NativePushPayload,\n): \"og.approval\" | \"og.question\" | undefined {\n  if (payload.secretQuestion) return undefined;\n  if (payload.eventType === \"session.requiresAction\") return \"og.approval\";\n  if (payload.eventType === \"session.humanInput.requested\") return \"og.question\";\n  return undefined;\n}\n\nfunction base64Url(input: Buffer | string): string {\n  return Buffer.from(input).toString(\"base64url\");\n}\n\nfunction signJwt(\n  header: Record<string, string>,\n  claims: Record<string, unknown>,\n  privateKey: string,\n  algorithm: \"ES256\" | \"RS256\",\n): string {\n  const unsigned = `${base64Url(JSON.stringify(header))}.${base64Url(JSON.stringify(claims))}`;\n  const signer = createSign(\"SHA256\");\n  signer.update(unsigned);\n  const signature =\n    algorithm === \"ES256\"\n      ? signer.sign({ key: privateKey, dsaEncoding: \"ieee-p1363\" })\n      : signer.sign(privateKey);\n  return `${unsigned}.${base64Url(signature)}`;\n}\n\nfunction pem(value: string): string {\n  return value.includes(\"\\\\n\") ? value.replace(/\\\\n/gu, \"\\n\") : value;\n}\n\n/** APNs with a token-based (.p8) key; one HTTP/2 connection per environment. */\nexport function createApnsSender(input: {\n  keyId: string;\n  teamId: string;\n  privateKey: string;\n}): NativePushSender {\n  const key = pem(input.privateKey);\n  let token: { value: string; issuedAt: number } | null = null;\n  const sessions = new Map<string, ClientHttp2Session>();\n  const bearer = () => {\n    const now = Math.floor(Date.now() / 1000);\n    // Apple accepts a provider token for an hour and rejects refreshes more\n    // often than every 20 minutes.\n    if (!token || now - token.issuedAt > 40 * 60) {\n      token = {\n        value: signJwt(\n          { alg: \"ES256\", kid: input.keyId },\n          { iss: input.teamId, iat: now },\n          key,\n          \"ES256\",\n        ),\n        issuedAt: now,\n      };\n    }\n    return token.value;\n  };\n  const session = (host: string) => {\n    const existing = sessions.get(host);\n    if (existing && !existing.closed && !existing.destroyed) return existing;\n    const created = connect(`https://${host}`);\n    created.on(\"error\", () => sessions.delete(host));\n    created.on(\"close\", () => sessions.delete(host));\n    sessions.set(host, created);\n    return created;\n  };\n  return async (delivery) => {\n    const host =\n      delivery.environment === \"development\" ? \"api.sandbox.push.apple.com\" : \"api.push.apple.com\";\n    const alert = nativePushAlert(delivery.payload);\n    const category = nativePushCategory(delivery.payload);\n    const body = JSON.stringify({\n      aps: {\n        alert,\n        sound: \"default\",\n        \"thread-id\": delivery.payload.sessionId,\n        \"interruption-level\": nativePushInterruptionLevel(delivery.payload),\n        ...(category ? { category } : {}),\n      },\n      body: nativePushData(delivery.payload),\n    });\n    return await new Promise<NativePushSendResult>((resolve) => {\n      const request = session(host).request({\n        \":method\": \"POST\",\n        \":path\": `/3/device/${delivery.token}`,\n        authorization: `bearer ${bearer()}`,\n        \"apns-topic\": delivery.appId,\n        \"apns-push-type\": \"alert\",\n        \"apns-priority\": \"10\",\n        \"apns-collapse-id\": `${delivery.payload.sessionId}:${delivery.payload.rule}`.slice(0, 64),\n        \"content-type\": \"application/json\",\n      });\n      let status = 0;\n      let text = \"\";\n      request.setTimeout(10_000, () => request.close());\n      request.on(\"response\", (headers) => {\n        status = Number(headers[\":status\"] ?? 0);\n      });\n      request.on(\"data\", (chunk: Buffer) => {\n        text += chunk.toString(\"utf8\");\n      });\n      request.on(\"error\", (error) => resolve({ outcome: \"retry\", error: String(error) }));\n      request.on(\"close\", () => {\n        if (status === 200) return resolve({ outcome: \"delivered\" });\n        const reason = (() => {\n          try {\n            return (JSON.parse(text) as { reason?: string }).reason ?? text;\n          } catch {\n            return text || `status ${status}`;\n          }\n        })();\n        if (status === 410 || reason === \"BadDeviceToken\" || reason === \"Unregistered\") {\n          return resolve({ outcome: \"unregistered\", error: `${status} ${reason}` });\n        }\n        resolve({\n          outcome: status === 429 || status >= 500 || status === 0 ? \"retry\" : \"failed\",\n          error: `${status} ${reason}`,\n        });\n      });\n      request.end(body);\n    });\n  };\n}\n\n/** FCM HTTP v1 with a service account; data-only, so the app presents it. */\nexport function createFcmSender(input: {\n  serviceAccountJson: string;\n  fetch?: typeof fetch;\n}): NativePushSender {\n  const account = JSON.parse(input.serviceAccountJson) as {\n    project_id: string;\n    client_email: string;\n    private_key: string;\n    token_uri?: string;\n  };\n  const http = input.fetch ?? fetch;\n  let access: { token: string; expiresAt: number } | null = null;\n  const accessToken = async () => {\n    if (access && access.expiresAt - 60_000 > Date.now()) return access.token;\n    const now = Math.floor(Date.now() / 1000);\n    const tokenUri = account.token_uri ?? \"https://oauth2.googleapis.com/token\";\n    const assertion = signJwt(\n      { alg: \"RS256\", typ: \"JWT\" },\n      {\n        iss: account.client_email,\n        scope: \"https://www.googleapis.com/auth/firebase.messaging\",\n        aud: tokenUri,\n        iat: now,\n        exp: now + 3600,\n      },\n      pem(account.private_key),\n      \"RS256\",\n    );\n    const response = await http(tokenUri, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:jwt-bearer\",\n        assertion,\n      }),\n    });\n    if (!response.ok) throw new Error(`FCM token exchange failed: ${response.status}`);\n    const json = (await response.json()) as { access_token: string; expires_in: number };\n    access = { token: json.access_token, expiresAt: Date.now() + json.expires_in * 1000 };\n    return access.token;\n  };\n  return async (delivery) => {\n    try {\n      const alert = nativePushAlert(delivery.payload);\n      const response = await http(\n        `https://fcm.googleapis.com/v1/projects/${account.project_id}/messages:send`,\n        {\n          method: \"POST\",\n          headers: {\n            authorization: `Bearer ${await accessToken()}`,\n            \"content-type\": \"application/json\",\n          },\n          body: JSON.stringify({\n            message: {\n              token: delivery.token,\n              android: { priority: \"HIGH\", collapse_key: delivery.payload.sessionId },\n              data: {\n                title: alert.title,\n                message: [alert.subtitle, alert.body].filter(Boolean).join(\"\\n\") || alert.title,\n                body: JSON.stringify(nativePushData(delivery.payload)),\n              },\n            },\n          }),\n          signal: AbortSignal.timeout(10_000),\n        },\n      );\n      if (response.ok) return { outcome: \"delivered\" };\n      const text = await response.text();\n      if (response.status === 404 || text.includes(\"UNREGISTERED\")) {\n        return { outcome: \"unregistered\", error: `${response.status} ${text.slice(0, 200)}` };\n      }\n      return {\n        outcome: response.status === 429 || response.status >= 500 ? \"retry\" : \"failed\",\n        error: `${response.status} ${text.slice(0, 200)}`,\n      };\n    } catch (error) {\n      return { outcome: \"retry\", error: String(error).slice(0, 300) };\n    }\n  };\n}\n\n/** The senders this deployment has credentials for. */\nexport function configuredNativePushSenders(\n  settings: Settings,\n): Partial<Record<\"ios\" | \"android\", NativePushSender>> {\n  const senders: Partial<Record<\"ios\" | \"android\", NativePushSender>> = {};\n  if (settings.apnsKeyId && settings.apnsTeamId && settings.apnsPrivateKey) {\n    senders.ios = createApnsSender({\n      keyId: settings.apnsKeyId,\n      teamId: settings.apnsTeamId,\n      privateKey: settings.apnsPrivateKey,\n    });\n  }\n  if (settings.fcmServiceAccountJson) {\n    senders.android = createFcmSender({ serviceAccountJson: settings.fcmServiceAccountJson });\n  }\n  return senders;\n}\n\nexport async function drainNativePushDeliveries(\n  deps: NativePushDispatchDeps,\n): Promise<{ claimed: number; delivered: number }> {\n  const senders = deps.senders ?? configuredNativePushSenders(deps.settings);\n  const claimId = randomUUID();\n  const claimed = await markSecretQuestionDeliveries(\n    deps.db,\n    await claimNativePushDeliveries(deps.db, {\n      claimId,\n      limit: 32,\n      claimSeconds: CLAIM_SECONDS,\n    }),\n  );\n  let delivered = 0;\n  await Promise.all(\n    claimed.map(async (delivery) => {\n      const sender = senders[delivery.platform];\n      const result: NativePushSendResult = sender\n        ? await sender(delivery).catch((error: unknown) => ({\n            outcome: \"retry\" as const,\n            error: String(error),\n          }))\n        : { outcome: \"failed\", error: `No ${delivery.platform} push credentials configured` };\n      const outcome =\n        result.outcome === \"retry\" && delivery.attempts >= MAX_ATTEMPTS ? \"failed\" : result.outcome;\n      if (outcome === \"delivered\") delivered += 1;\n      else\n        deps.observability?.warn(\"Native push not delivered\", {\n          platform: delivery.platform,\n          outcome,\n          error: result.error,\n        });\n      await settleNativePushDelivery(deps.db, {\n        claimId,\n        deliveryId: delivery.deliveryId,\n        outcome,\n        error: result.error ?? null,\n        retrySeconds: Math.min(3600, 5 * 2 ** delivery.attempts),\n      });\n    }),\n  );\n  return { claimed: claimed.length, delivered };\n}\n\nexport function startNativePushDispatchPump(deps: NativePushDispatchDeps): () => Promise<void> {\n  const senders = deps.senders ?? configuredNativePushSenders(deps.settings);\n  let stopped = false;\n  let ticks = 0;\n  let running: Promise<void> | null = null;\n  const tick = async () => {\n    ticks += 1;\n    try {\n      const { claimed } = await drainNativePushDeliveries({ ...deps, senders });\n      if (claimed > 0) deps.observability?.info(\"Native push batch\", { claimed });\n      if (ticks % PRUNE_EVERY_TICKS === 0) await pruneNativePushDeliveries(deps.db);\n    } catch (error) {\n      deps.observability?.error(\"Native push dispatch failed\", { error: String(error) });\n    }\n  };\n  const timer = setInterval(() => {\n    if (stopped || running) return;\n    running = tick().finally(() => {\n      running = null;\n    });\n  }, POLL_INTERVAL_MS);\n  return async () => {\n    stopped = true;\n    clearInterval(timer);\n    await running;\n  };\n}\n","import { randomUUID } from \"node:crypto\";\nimport { environmentsEncryptionKeyBytes, type Settings } from \"@opengeni/config\";\nimport {\n  OPENGENI_DELIVERY_ID_HEADER,\n  OPENGENI_EVENT_ID_HEADER,\n  OPENGENI_SIGNATURE_HEADER,\n  signOpenGeniPayload,\n} from \"@opengeni/contracts\";\nimport {\n  claimWorkspaceWebhookDeliveries,\n  claimOrganizationWebhookDeliveries,\n  decryptEnvironmentValue,\n  maintainSessionUsageLimits,\n  maintainWorkspaceAllowances,\n  pruneOrganizationWebhookDeliveries,\n  pruneWorkspaceWebhookDeliveries,\n  settleOrganizationWebhookDelivery,\n  settleWorkspaceWebhookDelivery,\n  type ClaimedWorkspaceWebhookDelivery,\n  type Database,\n} from \"@opengeni/db\";\nimport { pinnedFetch } from \"@opengeni/network\";\nimport type { Observability } from \"@opengeni/observability\";\nimport { recordSessionUsageLimitEvent } from \"@opengeni/core\";\n\nexport const WORKSPACE_WEBHOOK_DISPATCH_BATCH_SIZE = 32;\nconst CLAIM_SECONDS = 60;\nconst POLL_INTERVAL_MS = 2_000;\nconst DELIVERY_TIMEOUT_MS = 10_000;\nconst PRUNE_EVERY_TICKS = 300;\n\nexport type WorkspaceWebhookDispatchDeps = {\n  db: Database;\n  settings: Settings;\n  observability?: Pick<Observability, \"info\" | \"warn\" | \"error\"> &\n    Partial<Pick<Observability, \"incrementCounter\">>;\n  fetch?: typeof pinnedFetch;\n};\n\nexport type WorkspaceWebhookBatchResult = { claimed: number; delivered: number; failed: number };\n\nfunction errorText(error: unknown): string {\n  if (error instanceof Error) {\n    if (error.name === \"TimeoutError\" || error.name === \"AbortError\") return \"timeout\";\n    return `${error.name}: ${error.message}`.slice(0, 500);\n  }\n  return String(error).slice(0, 500);\n}\n\nasync function deliverOne(\n  deps: WorkspaceWebhookDispatchDeps,\n  key: Uint8Array,\n  claimId: string,\n  delivery: ClaimedWorkspaceWebhookDelivery,\n  organization = false,\n): Promise<\"delivered\" | \"failed\"> {\n  let status: number | null = null;\n  let error: string | null = null;\n  try {\n    const body = JSON.stringify(delivery.payload);\n    const secret = decryptEnvironmentValue(key, delivery.secretEncrypted);\n    const response = await (deps.fetch ?? pinnedFetch)(\n      delivery.url,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n          \"user-agent\": \"OpenGeni-Webhooks/1\",\n          [OPENGENI_SIGNATURE_HEADER]: await signOpenGeniPayload(secret, body),\n          [OPENGENI_EVENT_ID_HEADER]: delivery.eventId,\n          [OPENGENI_DELIVERY_ID_HEADER]: delivery.deliveryId,\n        },\n        body,\n        signal: AbortSignal.timeout(DELIVERY_TIMEOUT_MS),\n      },\n      deps.settings,\n      {\n        label: organization ? \"Organization webhook\" : \"Workspace webhook\",\n        requireHttpsOutsideLocalTest: true,\n      },\n    );\n    status = response.status;\n    await response.body?.cancel().catch(() => undefined);\n    if (status < 200 || status >= 300) error = `HTTP ${status}`;\n  } catch (caught) {\n    error = errorText(caught);\n  }\n  await (organization ? settleOrganizationWebhookDelivery : settleWorkspaceWebhookDelivery)(\n    deps.db,\n    {\n      deliveryId: delivery.deliveryId,\n      claimId,\n      status,\n      error,\n    },\n  );\n  return error === null ? \"delivered\" : \"failed\";\n}\n\n/**\n * One bounded, resumable page of the per-task usage limit legacy import.\n * Roots created before the feature stay `preparing` (never shown or\n * admitted as $0 for a write) until this converges them. A failure is retried\n * on a later tick (per-root exponential backoff with its SQLSTATE kept) and\n * never blocks webhook delivery. The same pass discloses lost single-call\n * custody markers as unpriced so a crashed process cannot block a task forever.\n */\nasync function importLegacySessionUsage(deps: WorkspaceWebhookDispatchDeps): Promise<void> {\n  const sink = deps.observability?.incrementCounter ? deps.observability : null;\n  const metrics = sink as Pick<Observability, \"incrementCounter\"> | null;\n  try {\n    const result = await maintainSessionUsageLimits(deps.db);\n    recordSessionUsageLimitEvent(metrics, \"import\", \"imported\", result.processed);\n    recordSessionUsageLimitEvent(metrics, \"import\", \"import_failed\", result.failed);\n    recordSessionUsageLimitEvent(metrics, \"single_call\", \"lost_resolved\", result.resolvedLost);\n    if (result.failed > 0) {\n      deps.observability?.warn(\"Session usage limit import pages failed\", {\n        failed: result.failed,\n        sqlstates: JSON.stringify(result.errors),\n      });\n    }\n  } catch (error) {\n    recordSessionUsageLimitEvent(metrics, \"import\", \"import_failed\");\n    deps.observability?.warn(\"Session usage limit import failed\", { error: errorText(error) });\n  }\n}\n\n/** Claim and deliver one globally bounded batch. At-least-once: receivers dedupe on event id. */\nexport async function drainWorkspaceWebhookDeliveries(\n  deps: WorkspaceWebhookDispatchDeps,\n): Promise<WorkspaceWebhookBatchResult> {\n  // Usage-limit maintenance contains its own failures, so it runs first: a\n  // failing allowance pass cannot keep lost custody markers (and the tasks\n  // they park) unresolved.\n  await importLegacySessionUsage(deps);\n  // Allowance rollover/expiry does not depend on webhook secrets, usage\n  // readers, inference or having any pending delivery.\n  await maintainWorkspaceAllowances(deps.db);\n  const key = environmentsEncryptionKeyBytes(deps.settings);\n  if (!key) return { claimed: 0, delivered: 0, failed: 0 };\n  const claimId = randomUUID();\n  const claims = await claimWorkspaceWebhookDeliveries(deps.db, {\n    claimId,\n    limit: WORKSPACE_WEBHOOK_DISPATCH_BATCH_SIZE,\n    claimSeconds: CLAIM_SECONDS,\n  });\n  // Each lane is bounded; the shared pump does not starve organization queues\n  // behind a sustained workspace backlog.\n  const organizationClaims = await claimOrganizationWebhookDeliveries(deps.db, {\n    claimId,\n    limit: WORKSPACE_WEBHOOK_DISPATCH_BATCH_SIZE,\n    claimSeconds: CLAIM_SECONDS,\n  });\n  const outcomes = await Promise.all(\n    [\n      ...claims.map((delivery) => ({ delivery, organization: false })),\n      ...organizationClaims.map((delivery) => ({ delivery, organization: true })),\n    ].map(async ({ delivery, organization }) => {\n      try {\n        return await deliverOne(deps, key, claimId, delivery, organization);\n      } catch (error) {\n        deps.observability?.warn(\"Workspace webhook settlement failed\", {\n          deliveryId: delivery.deliveryId,\n          error: errorText(error),\n        });\n        return \"failed\" as const;\n      }\n    }),\n  );\n  return {\n    claimed: claims.length + organizationClaims.length,\n    delivered: outcomes.filter((outcome) => outcome === \"delivered\").length,\n    failed: outcomes.filter((outcome) => outcome === \"failed\").length,\n  };\n}\n\n/**\n * One non-overlapping loop per API replica. PostgreSQL claims coordinate\n * replicas; a crash only delays a delivery until its claim expires.\n */\nexport function startWorkspaceWebhookDispatchPump(\n  deps: WorkspaceWebhookDispatchDeps,\n  options: {\n    intervalMs?: number;\n    drain?: (deps: WorkspaceWebhookDispatchDeps) => Promise<WorkspaceWebhookBatchResult>;\n  } = {},\n): () => Promise<void> {\n  const intervalMs = Math.max(100, options.intervalMs ?? POLL_INTERVAL_MS);\n  const drain = options.drain ?? drainWorkspaceWebhookDeliveries;\n  let stopped = false;\n  let running: Promise<void> | undefined;\n  let ticks = 0;\n\n  const tick = (): void => {\n    if (stopped || running) return;\n    ticks += 1;\n    // A full batch means a backlog: drain it now instead of one batch per interval.\n    let backlog = false;\n    running = (async () => {\n      const result = await drain(deps);\n      backlog = result.claimed >= WORKSPACE_WEBHOOK_DISPATCH_BATCH_SIZE;\n      if (result.claimed > 0) deps.observability?.info(\"Workspace webhook batch settled\", result);\n      if (ticks % PRUNE_EVERY_TICKS === 0) {\n        await pruneWorkspaceWebhookDeliveries(deps.db);\n        await pruneOrganizationWebhookDeliveries(deps.db);\n      }\n    })()\n      .catch((error: unknown) => {\n        deps.observability?.error(\"Workspace webhook dispatch failed\", { error: errorText(error) });\n      })\n      .finally(() => {\n        running = undefined;\n        if (backlog && !stopped) queueMicrotask(tick);\n      });\n  };\n\n  const timer = setInterval(tick, intervalMs);\n  queueMicrotask(tick);\n\n  return async () => {\n    stopped = true;\n    clearInterval(timer);\n    await running;\n  };\n}\n","import {\n  EditableArtifactDomainError,\n  EditableArtifactLiveError,\n  decodeEditableArtifactLiveClientWireFrame,\n  encodeEditableArtifactLiveServerWireFrame,\n  type EditableArtifactApplicationPort,\n  type EditableArtifactLiveClose,\n  type EditableArtifactLiveServerFrame,\n  type EditableArtifactLiveSession,\n  type EditableArtifactLiveSinkPort,\n  type OpenEditableArtifactLiveInput,\n} from \"@opengeni/core\";\nimport type {\n  ApiWebSocketConnection,\n  ApiWebSocketLike,\n  ApiWebSocketUpgradeServer,\n} from \"./api-websocket\";\n\nexport const EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PATH = \"/v1/editable-artifacts/live\";\nexport const EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PROTOCOL = \"opengeni-artifact-v2\";\nexport const EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES = 8 * 1024 * 1024 + 64 * 1024;\n\nconst MAX_QUEUED_MESSAGES = 64;\nconst MAX_QUEUED_BYTES = 12 * 1024 * 1024;\n\nexport type EditableArtifactWebSocketLike = ApiWebSocketLike;\n\nexport type EditableArtifactWebSocketUpgradeServer = ApiWebSocketUpgradeServer;\n\nexport type EditableArtifactWebSocketHandler = Readonly<{\n  open(socket: EditableArtifactWebSocketLike): void;\n  message(socket: EditableArtifactWebSocketLike, message: string | Uint8Array | ArrayBuffer): void;\n  close(socket: EditableArtifactWebSocketLike): void;\n}>;\n\nexport class EditableArtifactWebSocketTransport {\n  readonly websocket: EditableArtifactWebSocketHandler;\n\n  constructor(\n    private readonly application: EditableArtifactApplicationPort | undefined,\n    private readonly authorizeSourceSession?: OpenEditableArtifactLiveInput[\"authorizeSourceSession\"],\n  ) {\n    this.websocket = Object.freeze({\n      open: (socket) => socket.data.attach(socket),\n      message: (socket, message) => socket.data.receive(message),\n      close: (socket) => socket.data.transportClosed(),\n    });\n  }\n\n  handles(request: Request): boolean {\n    return new URL(request.url).pathname === EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PATH;\n  }\n\n  upgrade(request: Request, server: EditableArtifactWebSocketUpgradeServer): Response | undefined {\n    const url = new URL(request.url);\n    if (url.pathname !== EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PATH) return undefined;\n    if (request.method !== \"GET\") {\n      return new Response(\"Method Not Allowed\", {\n        status: 405,\n        headers: { allow: \"GET\" },\n      });\n    }\n    if (!this.application) return new Response(\"Service Unavailable\", { status: 503 });\n    if (!offeredProtocol(request.headers.get(\"sec-websocket-protocol\"))) {\n      return new Response(\"WebSocket protocol required\", { status: 426 });\n    }\n    const connection = new EditableArtifactWebSocketConnection(\n      this.application,\n      this.authorizeSourceSession,\n    );\n    const upgraded = server.upgrade(request, {\n      data: connection,\n      headers: {\n        \"sec-websocket-protocol\": EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PROTOCOL,\n      },\n    });\n    return upgraded ? undefined : new Response(\"Bad Request\", { status: 400 });\n  }\n}\n\n/** One socket, one consumed ticket, one stream epoch. */\nexport class EditableArtifactWebSocketConnection\n  implements EditableArtifactLiveSinkPort, ApiWebSocketConnection\n{\n  private socket: EditableArtifactWebSocketLike | null = null;\n  private session: EditableArtifactLiveSession | null = null;\n  private work: Promise<void> = Promise.resolve();\n  private queuedMessages = 0;\n  private queuedBytes = 0;\n  private terminal = false;\n\n  constructor(\n    private readonly application: EditableArtifactApplicationPort,\n    private readonly authorizeSourceSession?: OpenEditableArtifactLiveInput[\"authorizeSourceSession\"],\n  ) {}\n\n  attach(socket: EditableArtifactWebSocketLike): void {\n    if (this.socket || this.terminal) {\n      socket.close(4400, \"invalid connection state\");\n      return;\n    }\n    this.socket = socket;\n  }\n\n  receive(message: string | Uint8Array | ArrayBuffer): void {\n    if (this.terminal) return;\n    if (typeof message === \"string\") {\n      void this.fail(\"invalid_frame\");\n      return;\n    }\n    const byteLength = message.byteLength;\n    if (\n      byteLength === 0 ||\n      byteLength > EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES ||\n      this.queuedMessages + 1 > MAX_QUEUED_MESSAGES ||\n      this.queuedBytes + byteLength > MAX_QUEUED_BYTES\n    ) {\n      void this.fail(\n        byteLength > EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES\n          ? \"oversized_frame\"\n          : \"slow_client\",\n      );\n      return;\n    }\n    const bytes =\n      message instanceof Uint8Array ? Uint8Array.from(message) : new Uint8Array(message).slice();\n    this.queuedMessages += 1;\n    this.queuedBytes += bytes.byteLength;\n    const run = this.work.then(async () => {\n      try {\n        await this.process(bytes);\n      } finally {\n        this.queuedMessages -= 1;\n        this.queuedBytes -= bytes.byteLength;\n      }\n    });\n    this.work = run.catch(async (error: unknown) => {\n      await this.handleFailure(error);\n    });\n  }\n\n  async send(frame: EditableArtifactLiveServerFrame): Promise<void> {\n    if (this.terminal || !this.socket) {\n      throw new EditableArtifactLiveError(\"closed\", \"Editable artifact socket is closed\");\n    }\n    const bytes = encodeEditableArtifactLiveServerWireFrame(frame);\n    if (bytes.byteLength > EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES) {\n      throw new EditableArtifactLiveError(\n        \"oversized_frame\",\n        \"Editable artifact server frame exceeds socket limit\",\n        { requiresSnapshot: true },\n      );\n    }\n    const accepted = this.socket.send(bytes, false);\n    if (!Number.isSafeInteger(accepted) || accepted <= 0) {\n      throw new EditableArtifactLiveError(\"closed\", \"Editable artifact socket rejected frame\");\n    }\n  }\n\n  bufferedBytes(): number {\n    const buffered = this.socket?.getBufferedAmount?.() ?? this.socket?.bufferedAmount ?? 0;\n    return Number.isSafeInteger(buffered) && buffered >= 0 ? buffered : Number.MAX_SAFE_INTEGER;\n  }\n\n  close(close: EditableArtifactLiveClose): void {\n    if (this.terminal) return;\n    this.terminal = true;\n    this.socket?.close(closeCode(close.reason), close.reason);\n  }\n\n  transportClosed(): void {\n    if (this.terminal) return;\n    this.terminal = true;\n    void this.session?.close(\"transport_error\");\n  }\n\n  private async process(bytes: Uint8Array): Promise<void> {\n    if (this.terminal) return;\n    const frame = decodeEditableArtifactLiveClientWireFrame(bytes);\n    if (!this.session) {\n      if (frame.type !== \"open\") {\n        throw new EditableArtifactLiveError(\"invalid_frame\", \"First socket frame must be open\");\n      }\n      const session = await this.application.openLive({\n        token: frame.token,\n        artifactId: frame.artifactId,\n        protocolVersion: frame.protocolVersion,\n        resume: frame.resume,\n        sink: this,\n        ...(this.authorizeSourceSession\n          ? { authorizeSourceSession: this.authorizeSourceSession }\n          : {}),\n      });\n      if (this.terminal) {\n        await session.close(\"transport_error\");\n        return;\n      }\n      this.session = session;\n      void session.closed.then(() => {\n        if (!this.terminal)\n          this.close({\n            reason: \"closed\",\n            retryable: false,\n            requiresSnapshot: false,\n          });\n      });\n      return;\n    }\n    if (frame.type === \"open\") {\n      throw new EditableArtifactLiveError(\"invalid_frame\", \"Socket is already open\");\n    }\n    if (\n      frame.artifactId !== this.session.artifactId ||\n      frame.streamEpoch !== this.session.streamEpoch\n    ) {\n      throw new EditableArtifactLiveError(\"stale_epoch\", \"Socket frame belongs to another stream\");\n    }\n    if (frame.type === \"applied\") {\n      await this.session.acknowledge(frame);\n      return;\n    }\n    let receipt: Awaited<ReturnType<EditableArtifactLiveSession[\"submitIntent\"]>>;\n    try {\n      receipt = await this.session.submitIntent(frame);\n    } catch (error) {\n      await this.send({\n        type: \"mutationRejected\",\n        protocolVersion: frame.protocolVersion,\n        artifactId: frame.artifactId,\n        streamEpoch: frame.streamEpoch,\n        requestHash: frame.requestHash,\n        ...mutationFailure(error),\n      });\n      return;\n    }\n    // Always return the exact durable canonical transaction evidence (OGACO\n    // or OGAST) on this request's socket, including idempotent unknown-outcome\n    // retries whose original fanout was already replayed and ACKed. Transaction\n    // first, mapping second: acceptance is never exposed without settle bytes.\n    await this.send({\n      type: \"transaction\",\n      protocolVersion: frame.protocolVersion,\n      artifactId: frame.artifactId,\n      streamEpoch: frame.streamEpoch,\n      transaction: receipt.transaction,\n    });\n    await this.send({\n      type: \"mutationAccepted\",\n      protocolVersion: frame.protocolVersion,\n      artifactId: frame.artifactId,\n      streamEpoch: frame.streamEpoch,\n      requestHash: receipt.requestHash,\n      clientTransactionId: receipt.clientTransactionId,\n      transactionId: receipt.transaction.transactionId,\n      startSequence: receipt.transaction.startSequence,\n      endSequence: receipt.transaction.endSequence,\n      stateHash: receipt.transaction.stateHash,\n    });\n  }\n\n  private async handleFailure(error: unknown): Promise<void> {\n    if (this.terminal) return;\n    if (error instanceof EditableArtifactLiveError) {\n      await this.fail(error.code === \"invalid_ticket\" ? \"transport_error\" : error.code);\n      return;\n    }\n    await this.fail(\"transport_error\");\n  }\n\n  private async fail(reason: Parameters<EditableArtifactLiveSession[\"close\"]>[0]): Promise<void> {\n    if (this.terminal) return;\n    this.terminal = true;\n    await this.session?.close(reason).catch(() => undefined);\n    this.socket?.close(closeCode(reason ?? \"transport_error\"), reason ?? \"transport_error\");\n  }\n}\n\nfunction mutationFailure(error: unknown): Readonly<{\n  code: \"invalid_request\" | \"forbidden\" | \"conflict\" | \"unsupported\" | \"unavailable\";\n  retryable: boolean;\n}> {\n  if (error instanceof EditableArtifactDomainError) {\n    if (error.code === \"forbidden\") return { code: \"forbidden\", retryable: false };\n    if ([\"invalid_request\", \"request_hash_mismatch\", \"invalid_undo_target\"].includes(error.code)) {\n      return { code: \"invalid_request\", retryable: false };\n    }\n    if (error.code === \"kernel_contract_violation\") {\n      return { code: \"unsupported\", retryable: false };\n    }\n    if ([\"retryable_conflict\", \"outbox_lease_conflict\"].includes(error.code)) {\n      return { code: \"conflict\", retryable: true };\n    }\n    return { code: \"conflict\", retryable: false };\n  }\n  if (error instanceof EditableArtifactLiveError && error.code === \"permission_changed\") {\n    return { code: \"forbidden\", retryable: false };\n  }\n  return { code: \"unavailable\", retryable: true };\n}\n\nfunction offeredProtocol(value: string | null): boolean {\n  return (\n    value\n      ?.split(\",\")\n      .map((part) => part.trim())\n      .includes(EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PROTOCOL) ?? false\n  );\n}\n\nfunction closeCode(reason: string): number {\n  if (reason === \"permission_changed\") return 4403;\n  if (reason === \"ticket_expired\" || reason === \"ticket_replayed\") return 4401;\n  if (reason === \"protocol_mismatch\") return 4406;\n  if (reason === \"slow_client\" || reason === \"oversized_frame\") return 4409;\n  if (reason === \"closed\") return 1000;\n  return 4400;\n}\n","import {\n  hasPermission,\n  requireExternalContinuationAuthority,\n  requireSessionAuthorization,\n  type ApiRouteDeps,\n  type OpenEditableArtifactLiveInput,\n} from \"@opengeni/core\";\nimport {\n  findActiveWorkspaceApiKeyById,\n  getSession,\n  getWorkspaceGrant,\n  hasEditableArtifactSessionLink,\n  lockExternalWorkspaceMembershipLifecycle,\n  withRlsContext,\n} from \"@opengeni/db\";\nimport { withAccessGrantSessionRlsContext } from \"./access-grant-rls\";\nimport { sql } from \"drizzle-orm\";\n\n/** Supplied by the API adapter, so mounted hosts use their canonical live port. */\nexport function editableArtifactSourceSessionAuthorizer(\n  deps: ApiRouteDeps,\n): NonNullable<OpenEditableArtifactLiveInput[\"authorizeSourceSession\"]> {\n  return async (ticket, permission, transaction, signal) => {\n    signal?.throwIfAborted();\n    const authority = ticket.sourceSessionAuthority;\n    if (!authority) return true;\n    const { grant } = authority;\n    const required = permission === \"edit\" ? \"artifacts:publish\" : \"artifacts:read\";\n    if (\n      !hasPermission(grant.permissions, required) ||\n      !hasPermission(grant.permissions, \"sessions:read\")\n    ) {\n      return false;\n    }\n    // An external audit shape without the verified continuation is not authority.\n    if (grant.metadata?.externalActor && !authority.externalContinuation) return false;\n    try {\n      const scopedDeps = transaction ? { ...deps, db: transaction } : deps;\n      // Source-bound stores invoke us before their tenancy/aggregate locks.\n      // Match lifecycle writers' organization -> tenancy -> session prefix.\n      if (transaction) {\n        await lockExternalWorkspaceMembershipLifecycle(transaction, ticket.scope.accountId);\n        signal?.throwIfAborted();\n        // Tenancy writers acquire this fence before source session rows.\n        await transaction.execute(sql`select pg_advisory_xact_lock_shared(\n          hashtextextended(${`session-tenancy:${ticket.scope.workspaceId}`}, 0))`);\n        signal?.throwIfAborted();\n      }\n      return await withAccessGrantSessionRlsContext(scopedDeps, grant, async () => {\n        return await withRlsContext(scopedDeps.db, ticket.scope, async (tx) => {\n          if (authority.externalContinuation) {\n            await requireExternalContinuationAuthority(\n              tx,\n              authority.externalContinuation,\n              { ...ticket.scope, subjectId: grant.subjectId },\n              [\"sessions:read\", required],\n            );\n            signal?.throwIfAborted();\n          } else if (transaction) {\n            // The authenticated ticket grant is a ceiling, not proof that\n            // source-read permission still exists at the commit boundary.\n            const actor = ticket.actor;\n            if (\n              actor.kind === \"human\" ||\n              (actor.kind === \"service\" && actor.service === \"configured_key\")\n            ) {\n              await tx.execute(sql`select subject_id from workspace_memberships\n                where account_id = ${ticket.scope.accountId}::uuid\n                  and workspace_id = ${ticket.scope.workspaceId}::uuid\n                  and subject_id = ${grant.subjectId} for share`);\n              const live = await getWorkspaceGrant(tx, grant.subjectId, ticket.scope.workspaceId);\n              if (!live || !hasPermission(live.permissions, \"sessions:read\")) return false;\n            } else if (actor.kind === \"service\" && actor.service === \"api_key\") {\n              await tx.execute(sql`select id from api_keys\n                where account_id = ${ticket.scope.accountId}::uuid\n                  and id::text = ${grant.subjectId.slice(\"api_key:\".length)}\n                for share`);\n              const live = await findActiveWorkspaceApiKeyById(tx, {\n                ...ticket.scope,\n                apiKeyId: grant.subjectId.slice(\"api_key:\".length),\n              });\n              if (!live || !hasPermission(live.permissions, \"sessions:read\")) return false;\n            } else if (actor.kind === \"agent\") {\n              const live = await getSession(tx, ticket.scope.workspaceId, actor.sessionId);\n              if (\n                !live ||\n                (live.firstPartyMcpPermissions !== null &&\n                  !hasPermission(live.firstPartyMcpPermissions, \"sessions:read\"))\n              ) {\n                return false;\n              }\n            } else {\n              return false;\n            }\n            signal?.throwIfAborted();\n          }\n          // Locks protect visibility and removal of the exact association\n          // until the enclosing mutation transaction commits.\n          const linked = await hasEditableArtifactSessionLink(\n            tx,\n            ticket.scope,\n            authority.sessionId,\n            ticket.artifactId,\n            { lockForCommit: transaction !== undefined },\n          );\n          signal?.throwIfAborted();\n          if (!linked) return false;\n          await requireSessionAuthorization({ ...scopedDeps, db: tx }, grant, {\n            sessionId: authority.sessionId,\n            operation: \"session.read\",\n            surface: \"http\",\n          });\n          signal?.throwIfAborted();\n          return true;\n        });\n      });\n    } catch {\n      // Denial or an unavailable authority must stop data/writes, never fall\n      // back to artifact-only scope. The live loop closes denied readers.\n      return false;\n    }\n  };\n}\n","import { localBrowserBoundaryResponse, type LocalBrowserBoundary } from \"./local-browser-boundary\";\n\nexport type ApiWebSocketUpgradeRoute<Server> = {\n  handles(request: Request): boolean;\n  upgrade(request: Request, server: Server): Response | undefined;\n};\n\nexport type ApiWebSocketUpgradeDispatch =\n  | { handled: false }\n  | { handled: true; response: Response | undefined };\n\n/**\n * WebSocket upgrades bypass the Hono app, so the local-mode browser boundary\n * (./local-browser-boundary.ts) is applied here before a transport upgrades.\n * Returns `{ handled: false }` when no transport claims the request, so the\n * caller dispatches it to the app, where the boundary runs as middleware.\n */\nexport function dispatchApiWebSocketUpgrade<Server>(\n  request: Request,\n  server: Server,\n  routes: ReadonlyArray<ApiWebSocketUpgradeRoute<Server>>,\n  localBrowserBoundary: LocalBrowserBoundary | null,\n): ApiWebSocketUpgradeDispatch {\n  const route = routes.find((candidate) => candidate.handles(request));\n  if (!route) return { handled: false };\n  const rejection = localBrowserBoundary?.rejection(request);\n  if (rejection) return { handled: true, response: localBrowserBoundaryResponse(rejection) };\n  return { handled: true, response: route.upgrade(request, server) };\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport {\n  editableArtifactMaterializerCapabilitiesForRuntime,\n  type EditableArtifactNativeMaterializerCapabilities,\n} from \"@opengeni/artifact-tool/runtime/materializer\";\nimport {\n  EditableArtifactDurableExportService,\n  EditableArtifactAgentApplication,\n  EDITABLE_ARTIFACT_EXPORT_FORMATS,\n  EDITABLE_ARTIFACT_EXPORT_MAX_DOWNLOAD_BYTES,\n  EditableArtifactCompactionPipeline,\n  EditableArtifactGenesisPipeline,\n  EditableArtifactService,\n  MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,\n  ProductionEditableArtifactSnapshotVerifier,\n  SystemEditableArtifactClock,\n  editableArtifactLiveReadPortFromPostgres,\n  editableArtifactLiveTicketStorePortFromPostgres,\n  editableArtifactStorePortFromPostgres,\n  editableArtifactDurableExportStorePortFromPostgres,\n  ogatxEditableArtifactMutationIntentCodec,\n  editableArtifactId,\n  type EditableArtifactAuthorizationDecision,\n  type EditableArtifactAuthorizationPort,\n  type EditableArtifactAuthorizationRequest,\n  type EditableArtifactStableIdFactoryPort,\n  type EditableArtifactStableIdKind,\n  type EditableArtifactDurableExportIdFactoryPort,\n  type EditableArtifactExactSnapshotPort,\n  type EditableArtifactAgentAssociationPort,\n  type EditableArtifactMaterializationProfilePort,\n} from \"@opengeni/core/editable-artifacts\";\nimport {\n  EditableArtifactApplication,\n  EditableArtifactCompatibilityError,\n  EditableArtifactLiveServer,\n  SystemEditableArtifactLiveClock,\n  SystemEditableArtifactLiveScheduler,\n  WebCryptoEditableArtifactLiveTokens,\n  type EditableArtifactApplicationPort,\n  type EditableArtifactLiveAuthorizationInvalidationPort,\n  type EditableArtifactLiveCompatibilityPort,\n} from \"@opengeni/core/editable-artifact-live\";\nimport { currentEditableArtifactCompatibility } from \"@opengeni/contracts/editable-artifacts\";\nimport {\n  PostgresEditableArtifactLiveReadStore,\n  PostgresEditableArtifactLiveTicketStore,\n  PostgresEditableArtifactStore,\n  listEditableArtifactIdsForSession,\n  touchEditableArtifactSessionLink,\n  recordNativeDocumentInspection,\n  dbSql,\n  withRlsContext,\n  type Database,\n  type PersistedEditableArtifactSnapshotBytesPort,\n  type PersistedEditableArtifactSnapshotMetadata,\n} from \"@opengeni/db\";\nimport { PostgresEditableArtifactDurableExportStore } from \"@opengeni/db/editable-artifact-durable-export\";\nimport type { EventBus } from \"@opengeni/events\";\nimport {\n  MAX_BOUNDED_OBJECT_CHUNK_BYTES,\n  createObjectStorageBoundedPorts,\n  type BoundedObjectReadPort,\n  type ObjectStorage,\n} from \"@opengeni/storage\";\nimport { EventBusEditableArtifactLiveHints } from \"./editable-artifact-live-hints\";\nimport {\n  NativeEditableArtifactKernelAdapter,\n  loadVerifiedNativeArtifactRuntimeBinding,\n} from \"./editable-artifact-native-kernel\";\nimport { EditableArtifactOfficeImportAdapter } from \"./editable-artifact-office-import\";\nimport { EditableArtifactWorkspaceFileAdapter } from \"./editable-artifact-workspace-files\";\n\nconst INVALIDATION_POLL_MS = 1_000;\nconst TICKET_CLEANUP_MS = 30_000;\n\nexport type StandaloneEditableArtifactApplication = Readonly<{\n  application: EditableArtifactApplicationPort;\n  durableExports: EditableArtifactDurableExportService;\n  agent: EditableArtifactAgentApplication;\n  officeImports: EditableArtifactOfficeImportAdapter;\n  kernelVersion: string;\n  close(): void;\n}>;\n\n/**\n * Standalone production composition. Every authority is durable: PostgreSQL\n * owns admission/authorization/history, object storage owns immutable model\n * bytes, and NATS carries wake-up hints only.\n */\nexport async function createStandaloneEditableArtifactApplication(input: {\n  db: Database;\n  bus: EventBus;\n  objectStorage: ObjectStorage;\n}): Promise<StandaloneEditableArtifactApplication> {\n  const boundedObjects = createObjectStorageBoundedPorts(input.objectStorage);\n  const materializationObjects = createObjectStorageBoundedPorts(input.objectStorage, {\n    keyPrefix: \"editable-artifacts/materializations/v1/sha256/\",\n  });\n  const importSourceObjects = createObjectStorageBoundedPorts(input.objectStorage, {\n    keyPrefix: \"editable-artifacts/imports/v1/sha256/\",\n  });\n  const runtimeBinding = await loadVerifiedNativeArtifactRuntimeBinding();\n  const runtime = runtimeBinding.runtime;\n  const kernel = new NativeEditableArtifactKernelAdapter(runtime, boundedObjects.read);\n  const persistedStore = new PostgresEditableArtifactStore(input.db);\n  const store = editableArtifactStorePortFromPostgres(persistedStore);\n  const authorization = new PostgresEditableArtifactAuthorization(input.db);\n  const ids = new RandomEditableArtifactStableIds();\n  const clock = new SystemEditableArtifactClock();\n  const snapshotVerifier = new ProductionEditableArtifactSnapshotVerifier({\n    objects: boundedObjects.read,\n    kernel,\n  });\n  const genesis = new EditableArtifactGenesisPipeline({\n    kernel,\n    objects: boundedObjects.write,\n    now: () => clock.now(),\n  });\n  const compaction = new EditableArtifactCompactionPipeline({\n    kernel,\n    objects: boundedObjects.write,\n    now: () => clock.now(),\n  });\n  const domain = new EditableArtifactService({\n    authorization,\n    kernel,\n    store,\n    intentCodec: ogatxEditableArtifactMutationIntentCodec,\n    clock,\n    ids,\n    snapshotVerifier,\n    genesis,\n    compaction,\n  });\n  const materializerCapabilities = editableArtifactMaterializerCapabilitiesForRuntime(\n    runtime,\n    runtimeBinding.location.artifactTool.packageVersion,\n  );\n  const durableExports = new EditableArtifactDurableExportService({\n    authorization,\n    exactSnapshots: Object.freeze({\n      ensure: async (request: Parameters<EditableArtifactExactSnapshotPort[\"ensure\"]>[0]) =>\n        await domain.compactCurrentHead(request),\n    }),\n    store: editableArtifactDurableExportStorePortFromPostgres(\n      new PostgresEditableArtifactDurableExportStore(input.db),\n    ),\n    ids: new RandomEditableArtifactDurableExportIds(),\n    profiles: materializationProfiles(materializerCapabilities),\n    materializationObjects: materializationObjects.read,\n  });\n  const officeImports = new EditableArtifactOfficeImportAdapter({\n    db: input.db,\n    objectStorage: input.objectStorage,\n    runtime: runtimeBinding,\n    sourceObjects: importSourceObjects.write,\n    snapshotObjects: boundedObjects.write,\n  });\n  const agent = new EditableArtifactAgentApplication({\n    domain,\n    exports: durableExports,\n    associations: Object.freeze({\n      listArtifactIds: async ({ scope, sessionId, limit }) =>\n        (await listEditableArtifactIdsForSession(input.db, scope, sessionId, limit)).map(\n          editableArtifactId,\n        ),\n      touch: async ({ scope, sessionId, artifactId }) =>\n        await touchEditableArtifactSessionLink(input.db, scope, sessionId, artifactId),\n    } satisfies EditableArtifactAgentAssociationPort),\n    inspector: kernel,\n    recordInspection: async (inspection) => {\n      if (inspection.actor.kind !== \"agent\")\n        throw new Error(\"Inspection proof requires an agent attempt\");\n      return recordNativeDocumentInspection(input.db, { ...inspection, actor: inspection.actor });\n    },\n    officeImports,\n    workspaceFiles: new EditableArtifactWorkspaceFileAdapter({\n      db: input.db,\n      objectStorage: input.objectStorage,\n      durableExports,\n    }),\n  });\n  const ticketStore = new PostgresEditableArtifactLiveTicketStore(input.db);\n  const liveRead = new PostgresEditableArtifactLiveReadStore(input.db, {\n    snapshotBytes: snapshotBytesPort(boundedObjects.read),\n  });\n  const invalidations = new PollingEditableArtifactAuthorizationInvalidations(authorization);\n  const live = new EditableArtifactLiveServer({\n    authorization,\n    domain,\n    tickets: editableArtifactLiveTicketStorePortFromPostgres(ticketStore),\n    tokens: new WebCryptoEditableArtifactLiveTokens(),\n    clock: new SystemEditableArtifactLiveClock(),\n    scheduler: new SystemEditableArtifactLiveScheduler(),\n    read: editableArtifactLiveReadPortFromPostgres(liveRead),\n    hints: new EventBusEditableArtifactLiveHints(input.bus),\n    invalidations,\n  });\n  const compatibility: EditableArtifactLiveCompatibilityPort = Object.freeze({\n    assertCompatible(\n      request: Parameters<EditableArtifactLiveCompatibilityPort[\"assertCompatible\"]>[0],\n    ) {\n      const current = currentEditableArtifactCompatibility(request.artifact.modality);\n      if (\n        request.modality !== request.artifact.modality ||\n        request.liveProtocolVersion !== current.liveProtocolVersion ||\n        request.modelSchemaVersion !== current.modelSchemaVersion ||\n        request.snapshotVersion !== current.snapshotVersion ||\n        request.commandProtocolVersion !== current.commandProtocolVersion ||\n        request.committedTransactionProtocolVersion !== current.committedTransactionProtocolVersion\n      ) {\n        throw new EditableArtifactCompatibilityError();\n      }\n    },\n  });\n  const application = new EditableArtifactApplication({\n    domain,\n    live,\n    compatibility,\n  });\n  const cleanup = setInterval(() => {\n    void ticketStore.cleanupExpired().catch(() => undefined);\n  }, TICKET_CLEANUP_MS);\n  cleanup.unref?.();\n  return Object.freeze({\n    application,\n    durableExports,\n    agent,\n    officeImports,\n    kernelVersion: runtime.buildIdentity,\n    close() {\n      clearInterval(cleanup);\n      invalidations.close();\n    },\n  });\n}\n\nexport class PostgresEditableArtifactAuthorization implements EditableArtifactAuthorizationPort {\n  constructor(private readonly db: Database) {}\n\n  async authorize(\n    request: EditableArtifactAuthorizationRequest,\n  ): Promise<EditableArtifactAuthorizationDecision> {\n    const actor = request.actor;\n    const rows = await withRlsContext(this.db, request.scope, async (tx) =>\n      rawRows<{ allowed: boolean; authorization_revision: number | string | bigint }>(\n        await tx.execute(dbSql`select *\n          from opengeni_private.authorize_editable_artifact_actor(\n            ${request.scope.accountId}::uuid,\n            ${request.scope.workspaceId}::uuid,\n            ${request.artifactId},\n            ${actor.kind},\n            ${actor.subjectId},\n            ${actor.kind === \"agent\" ? actor.sessionId : null},\n            ${actor.kind === \"agent\" ? actor.turnId : null},\n            ${actor.kind === \"agent\" ? actor.attemptId : null},\n            ${actor.kind === \"agent\" ? actor.generation : null},\n            ${actor.kind === \"service\" ? actor.service : null},\n            ${request.permission},\n            current_schema()\n          )`),\n      ),\n    );\n    if (rows.length !== 1) throw new Error(\"Editable artifact authorization returned no decision\");\n    const revision = Number(rows[0]!.authorization_revision);\n    if (!Number.isSafeInteger(revision) || revision < 1) {\n      throw new Error(\"Editable artifact authorization returned an invalid revision\");\n    }\n    return Object.freeze({ allowed: rows[0]!.allowed === true, revision });\n  }\n}\n\nclass PollingEditableArtifactAuthorizationInvalidations implements EditableArtifactLiveAuthorizationInvalidationPort {\n  private readonly stops = new Set<() => void>();\n\n  constructor(private readonly authorization: EditableArtifactAuthorizationPort) {}\n\n  async subscribe(\n    input: Parameters<EditableArtifactLiveAuthorizationInvalidationPort[\"subscribe\"]>[0],\n  ): Promise<() => void> {\n    let active = true;\n    let polling = false;\n    let baseline = await this.read(input);\n    const timer = setInterval(() => {\n      if (!active || polling) return;\n      polling = true;\n      void this.read(input)\n        .then((next) => {\n          if (!active) return;\n          if (next !== baseline) {\n            baseline = next;\n            input.onInvalidated();\n          }\n        })\n        .catch(() => {\n          if (active) input.onInvalidated();\n        })\n        .finally(() => {\n          polling = false;\n        });\n    }, INVALIDATION_POLL_MS);\n    timer.unref?.();\n    const stop = () => {\n      if (!active) return;\n      active = false;\n      clearInterval(timer);\n      this.stops.delete(stop);\n    };\n    this.stops.add(stop);\n    return stop;\n  }\n\n  close(): void {\n    for (const stop of [...this.stops]) stop();\n  }\n\n  private async read(\n    input: Parameters<EditableArtifactLiveAuthorizationInvalidationPort[\"subscribe\"]>[0],\n  ): Promise<string> {\n    const decision = await this.authorization.authorize({\n      scope: input.scope,\n      artifactId: input.artifactId,\n      actor: input.actor,\n      permission: \"read\",\n    });\n    return `${decision.allowed ? 1 : 0}:${decision.revision}`;\n  }\n}\n\nclass RandomEditableArtifactStableIds implements EditableArtifactStableIdFactoryPort {\n  next(_kind: EditableArtifactStableIdKind) {\n    return randomUUID().replaceAll(\"-\", \"\") as ReturnType<\n      EditableArtifactStableIdFactoryPort[\"next\"]\n    >;\n  }\n}\n\nclass RandomEditableArtifactDurableExportIds implements EditableArtifactDurableExportIdFactoryPort {\n  next(_kind: \"version\" | \"materialization_job\" | \"receipt\"): string {\n    return randomUUID().replaceAll(\"-\", \"\");\n  }\n}\n\nfunction materializationProfiles(\n  capabilities: EditableArtifactNativeMaterializerCapabilities,\n): EditableArtifactMaterializationProfilePort {\n  const spreadsheetCompatibility = currentEditableArtifactCompatibility(\"spreadsheet\");\n  if (\n    capabilities.protocol !== \"OGAMC001\" ||\n    capabilities.runtimeKind !== \"native\" ||\n    capabilities.maxOutputBytes !== EDITABLE_ARTIFACT_EXPORT_MAX_DOWNLOAD_BYTES ||\n    capabilities.codecVersions[\"opengeni.xlsx\"] === undefined ||\n    capabilities.supportedModelSchemaVersions[0] !== spreadsheetCompatibility.modelSchemaVersion ||\n    capabilities.supportedOperationProtocolVersions[0] !==\n      spreadsheetCompatibility.committedTransactionProtocolVersion ||\n    capabilities.supportedSnapshotProtocolVersions[0] !== spreadsheetCompatibility.snapshotVersion\n  ) {\n    throw new Error(\"Verified artifact materializer profile is incompatible\");\n  }\n  const codecVersion = capabilities.codecVersions[\"opengeni.xlsx\"];\n  return Object.freeze({\n    supportedFormats: EDITABLE_ARTIFACT_EXPORT_FORMATS,\n    async resolve(input: Parameters<EditableArtifactMaterializationProfilePort[\"resolve\"]>[0]) {\n      // EDITABLE_ARTIFACT_EXPORT_FORMATS is what agents are told exists.\n      if (\n        input.modality !== \"spreadsheet\" ||\n        input.format !== \"xlsx\" ||\n        !EDITABLE_ARTIFACT_EXPORT_FORMATS[input.modality].includes(input.format) ||\n        Object.keys(input.options).length !== 0\n      ) {\n        return null;\n      }\n      return Object.freeze({\n        modality: \"spreadsheet\" as const,\n        format: \"xlsx\" as const,\n        codecId: \"opengeni.xlsx\",\n        codecVersion,\n        kernelVersion: capabilities.kernelVersion,\n        fontRegistryHash: capabilities.fontRegistryHash,\n        policyHash: capabilities.policyHash,\n        normalizedOptions: \"{}\",\n      });\n    },\n  });\n}\n\nfunction snapshotBytesPort(\n  objects: BoundedObjectReadPort,\n): PersistedEditableArtifactSnapshotBytesPort {\n  return Object.freeze({\n    async readSnapshotBytes(snapshot: PersistedEditableArtifactSnapshotMetadata) {\n      const object = await objects.open({\n        opaqueReference: snapshot.blobReference,\n        maxBytes: MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,\n        expectedByteSize: snapshot.byteSize,\n      });\n      try {\n        if (object.contentType !== undefined && object.contentType !== snapshot.mimeType) {\n          throw new Error(\"Editable artifact snapshot content type mismatch\");\n        }\n        const bytes = new Uint8Array(snapshot.byteSize);\n        const digest = createHash(\"sha256\");\n        let offset = 0;\n        for await (const chunk of object.chunks({\n          chunkBytes: MAX_BOUNDED_OBJECT_CHUNK_BYTES,\n        })) {\n          if (offset + chunk.byteLength > bytes.byteLength) {\n            throw new Error(\"Editable artifact snapshot exceeds its declared size\");\n          }\n          bytes.set(chunk, offset);\n          digest.update(chunk);\n          offset += chunk.byteLength;\n        }\n        if (\n          offset !== bytes.byteLength ||\n          `sha256:${digest.digest(\"hex\")}` !== snapshot.contentHash\n        ) {\n          throw new Error(\"Editable artifact snapshot digest or size mismatch\");\n        }\n        await object.assertUnchanged();\n        return bytes;\n      } finally {\n        await object.close();\n      }\n    },\n  });\n}\n\nfunction rawRows<T extends Record<string, unknown>>(result: unknown): T[] {\n  if (Array.isArray(result)) return result as T[];\n  const rows = (result as { rows?: unknown } | null)?.rows;\n  if (Array.isArray(rows)) return rows as T[];\n  throw new Error(\"Unsupported database execute result shape\");\n}\n","import {\n  decodeEditableArtifactBrokerHint,\n  editableArtifactLiveHintSubject,\n  type EditableArtifactLiveHintPort,\n} from \"@opengeni/core\";\nimport type { EventBus, OpStreamConnection } from \"@opengeni/events\";\n\n/**\n * Uses the API's existing resilient NATS connection. Hints carry no operation\n * bytes; every callback causes a durable DB head read and contiguous gap-fill.\n */\nexport class EventBusEditableArtifactLiveHints implements EditableArtifactLiveHintPort {\n  constructor(private readonly bus: Pick<EventBus, \"getOpStreamConnection\">) {}\n\n  async subscribe(\n    input: Parameters<EditableArtifactLiveHintPort[\"subscribe\"]>[0],\n  ): Promise<() => void> {\n    const connection = this.bus.getOpStreamConnection?.();\n    if (!connection) throw new Error(\"Event bus has no artifact hint subscription transport\");\n    const subject = editableArtifactLiveHintSubject(input.scope, input.artifactId);\n    const subscription = connection.subscribe(subject);\n    let active = true;\n    try {\n      await requireFlushBarrier(connection);\n    } catch (error) {\n      subscription.unsubscribe();\n      throw error;\n    }\n    void (async () => {\n      try {\n        for await (const message of subscription) {\n          if (!active) return;\n          try {\n            const hint = decodeEditableArtifactBrokerHint(message.data, {\n              scope: input.scope,\n              artifactId: input.artifactId,\n            });\n            input.onHint({\n              artifactId: input.artifactId,\n              headSequence: hint.headSequence,\n            });\n          } catch {\n            // Broker input is advisory and untrusted. Drop poison; periodic\n            // durable reconciliation remains authoritative.\n          }\n        }\n      } catch {\n        if (active) input.onReconnect();\n      }\n    })();\n    return () => {\n      if (!active) return;\n      active = false;\n      subscription.unsubscribe();\n    };\n  }\n}\n\nasync function requireFlushBarrier(connection: OpStreamConnection): Promise<void> {\n  if (!connection.flush) {\n    throw new Error(\"Artifact hint subscription transport lacks a flush barrier\");\n  }\n  await connection.flush();\n}\n","import { createHash } from \"node:crypto\";\nimport { pathToFileURL } from \"node:url\";\nimport {\n  createNativeArtifactSession,\n  openNativeArtifactSession,\n  type NativeArtifactSession,\n  type NativeSpreadsheetSession,\n} from \"@opengeni/artifact-tool/native\";\nimport type { ArtifactKernelRuntime } from \"@opengeni/artifact-tool/runtime\";\nimport {\n  doctorConfiguredArtifactRuntime,\n  type ConfiguredArtifactRuntimeLocation,\n} from \"@opengeni/artifact-tool/runtime/development\";\nimport {\n  decodeEditableArtifactCausalFrontier,\n  encodeEditableArtifactCausalFrontier,\n} from \"@opengeni/contracts/editable-artifact-causal-frontier\";\nimport { decodeEditableArtifactSerializedCommit } from \"@opengeni/contracts/editable-artifact-serialized-commit\";\nimport { decodeEditableArtifactMutationIntent } from \"@opengeni/contracts/editable-artifacts\";\nimport {\n  COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n  DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION,\n  PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION,\n  SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n  SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n} from \"@opengeni/contracts/editable-artifact-versions\";\nimport {\n  MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,\n  causalFrontiersEqual,\n  editableArtifactCausalFrontier,\n  editableArtifactContentHash,\n  editableArtifactReplicaId,\n  editableArtifactStateHash,\n  type ApplyAuthoritativeEditableArtifactKernelRequest,\n  type ApplyAuthoritativeEditableArtifactKernelResult,\n  type AuthoritativeEditableArtifactCompactionKernelPort,\n  type AuthoritativeEditableArtifactCompactionKernelResult,\n  type AuthoritativeEditableArtifactGenesisKernelPort,\n  type AuthoritativeEditableArtifactGenesisKernelResult,\n  type AuthoritativeEditableArtifactKernelPort,\n  type EditableArtifactAgentInspectionKernelPort,\n  type EditableArtifactKernelState,\n  type EditableArtifactSnapshotReplayPlan,\n  type IsolatedEditableArtifactSnapshotKernelPort,\n  type IsolatedEditableArtifactSnapshotKernelResult,\n} from \"@opengeni/core\";\nimport type { BoundedObjectReadPort } from \"@opengeni/storage\";\n\nconst SNAPSHOT_CHUNK_BYTES = 1024 * 1024;\n\ntype RuntimeFacadeModule = Readonly<{\n  getConfiguredArtifactRuntime?: () => unknown;\n}> &\n  Readonly<Record<string, unknown>>;\n\nexport type VerifiedNativeArtifactRuntimeBinding = Readonly<{\n  runtime: ArtifactKernelRuntime;\n  location: ConfiguredArtifactRuntimeLocation;\n  facade: RuntimeFacadeModule;\n}>;\n\n/** Loads only the manifest-pinned, byte-verified native runtime. */\nexport async function loadVerifiedNativeArtifactRuntime(): Promise<ArtifactKernelRuntime> {\n  return (await loadVerifiedNativeArtifactRuntimeBinding()).runtime;\n}\n\n/** Same verified load plus the pinned package identity used by export profiles. */\nexport async function loadVerifiedNativeArtifactRuntimeBinding(): Promise<VerifiedNativeArtifactRuntimeBinding> {\n  const location = await doctorConfiguredArtifactRuntime();\n  const module = (await import(\n    /* @vite-ignore */ pathToFileURL(location.skillFacadeEntrypoint).href\n  )) as RuntimeFacadeModule;\n  const candidate = module.getConfiguredArtifactRuntime?.();\n  assertRuntime(candidate, location);\n  return Object.freeze({ runtime: candidate, location, facade: module });\n}\n\n/** Exact native authority shared by mutation, genesis, and snapshot verification. */\nexport class NativeEditableArtifactKernelAdapter\n  implements\n    AuthoritativeEditableArtifactKernelPort,\n    AuthoritativeEditableArtifactGenesisKernelPort,\n    AuthoritativeEditableArtifactCompactionKernelPort,\n    IsolatedEditableArtifactSnapshotKernelPort,\n    EditableArtifactAgentInspectionKernelPort\n{\n  constructor(\n    readonly runtime: ArtifactKernelRuntime,\n    private readonly objects: BoundedObjectReadPort,\n  ) {\n    if (runtime.kind !== \"native\" || runtime.target === \"wasm-web\") {\n      throw new Error(\"Editable artifact authority requires a native kernel\");\n    }\n  }\n\n  async applyTransaction(\n    request: ApplyAuthoritativeEditableArtifactKernelRequest,\n  ): Promise<ApplyAuthoritativeEditableArtifactKernelResult> {\n    const session = await this.openCurrentState(request.state);\n    try {\n      if (request.modality === \"spreadsheet\") {\n        if (session.modality !== \"spreadsheet\") throw new Error(\"Native modality mismatch\");\n        const committedTransactionBytes = session.authorTransaction(\n          request.intentBytes,\n          encodeEditableArtifactCausalFrontier(request.resolvedCausalBase),\n        );\n        return Object.freeze({\n          modality: \"spreadsheet\" as const,\n          committedTransactionBytes,\n          kernelVersion: this.runtime.buildIdentity,\n          modelSchemaVersion: SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n        });\n      }\n      if (session.modality !== request.modality) {\n        throw new Error(\"Native modality mismatch\");\n      }\n      const nativeReceiptBytes = session.applyCommands(request.intent.commandBytes);\n      return Object.freeze({\n        modality: request.modality,\n        nativeReceiptBytes,\n        resultingStateHash: editableArtifactStateHash(session.stateHash()),\n        kernelVersion: this.runtime.buildIdentity,\n        modelSchemaVersion: modelSchemaVersionFor(request.modality),\n      });\n    } finally {\n      session.dispose();\n    }\n  }\n\n  async query(\n    input: Parameters<EditableArtifactAgentInspectionKernelPort[\"query\"]>[0],\n  ): ReturnType<EditableArtifactAgentInspectionKernelPort[\"query\"]> {\n    const session = await this.openCurrentState(input.state);\n    try {\n      return Uint8Array.from(session.query(input.queryBytes));\n    } finally {\n      session.dispose();\n    }\n  }\n\n  private async openCurrentState(\n    state: EditableArtifactKernelState,\n  ): Promise<NativeArtifactSession> {\n    const snapshot = state.snapshot;\n    if (!snapshot) throw new Error(\"Editable artifact has no verified replay snapshot\");\n    const snapshotBytes = await readVerifiedSnapshot(this.objects, snapshot);\n    const session = openNativeArtifactSession(this.runtime, {\n      modality: state.modality,\n      snapshot: snapshotBytes,\n    });\n    try {\n      verifySnapshotBoundary(session, state);\n      replayKernelTail(session, state);\n      verifyDurableHead(session, state);\n      return session;\n    } catch (error) {\n      session.dispose();\n      throw error;\n    }\n  }\n\n  async createCanonicalEmptySnapshot(input: {\n    scope: Parameters<\n      AuthoritativeEditableArtifactGenesisKernelPort[\"createCanonicalEmptySnapshot\"]\n    >[0][\"scope\"];\n    artifactId: Parameters<\n      AuthoritativeEditableArtifactGenesisKernelPort[\"createCanonicalEmptySnapshot\"]\n    >[0][\"artifactId\"];\n    modality: Parameters<\n      AuthoritativeEditableArtifactGenesisKernelPort[\"createCanonicalEmptySnapshot\"]\n    >[0][\"modality\"];\n    signal?: AbortSignal;\n  }): Promise<AuthoritativeEditableArtifactGenesisKernelResult> {\n    throwIfAborted(input.signal);\n    const session = createNativeArtifactSession(this.runtime, {\n      modality: input.modality,\n      replicaNamespace: namespaceForArtifact(input.artifactId),\n    });\n    try {\n      const snapshot = session.snapshot();\n      throwIfAborted(input.signal);\n      const revision = safeRevision(session.revision());\n      if (revision !== 0) throw new Error(\"Native genesis revision is not zero\");\n      const common = {\n        scope: input.scope,\n        artifactId: input.artifactId,\n        modality: input.modality,\n        canonicalChunks: fixedChunks(snapshot, input.signal),\n        canonicalByteSize: snapshot.byteLength,\n        canonicalContentHash: editableArtifactContentHash(\n          `sha256:${createHash(\"sha256\").update(snapshot).digest(\"hex\")}`,\n        ),\n        stateHash: editableArtifactStateHash(session.stateHash()),\n        coveredHeadSequence: 0 as const,\n        modelSchemaVersion: modelSchemaVersionFor(input.modality),\n        kernelVersion: this.runtime.buildIdentity,\n      };\n      if (session.modality === \"spreadsheet\") {\n        return Object.freeze({\n          ...common,\n          modality: \"spreadsheet\" as const,\n          coveredCausalFrontier: domainFrontier(session.frontier()),\n          operationProtocolVersion: COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n          crdtStateVersion: SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n        });\n      }\n      return Object.freeze({\n        ...common,\n        modality: session.modality,\n        nativeRevision: 0 as const,\n      });\n    } finally {\n      session.dispose();\n    }\n  }\n\n  async createCanonicalSnapshot(input: {\n    state: EditableArtifactKernelState;\n    signal?: AbortSignal;\n  }): Promise<AuthoritativeEditableArtifactCompactionKernelResult> {\n    throwIfAborted(input.signal);\n    const snapshot = input.state.snapshot;\n    if (!snapshot) throw new Error(\"Editable artifact has no verified replay snapshot\");\n    const snapshotBytes = await readVerifiedSnapshot(this.objects, snapshot, input.signal);\n    const session = openNativeArtifactSession(this.runtime, {\n      modality: input.state.modality,\n      snapshot: snapshotBytes,\n    });\n    try {\n      verifySnapshotBoundary(session, input.state);\n      replayKernelTail(session, input.state);\n      verifyDurableHead(session, input.state);\n      throwIfAborted(input.signal);\n      const canonical = session.snapshot();\n      const common = {\n        scope: input.state.artifact.scope,\n        artifactId: input.state.artifact.id,\n        modality: input.state.modality,\n        canonicalChunks: fixedChunks(canonical, input.signal),\n        canonicalByteSize: canonical.byteLength,\n        canonicalContentHash: editableArtifactContentHash(\n          `sha256:${createHash(\"sha256\").update(canonical).digest(\"hex\")}`,\n        ),\n        stateHash: editableArtifactStateHash(session.stateHash()),\n        coveredHeadSequence: input.state.artifact.headSequence,\n        modelSchemaVersion: modelSchemaVersionFor(input.state.modality),\n        kernelVersion: this.runtime.buildIdentity,\n      } as const;\n      if (session.modality === \"spreadsheet\") {\n        if (input.state.modality !== \"spreadsheet\") throw new Error(\"Native modality mismatch\");\n        return Object.freeze({\n          ...common,\n          modality: session.modality,\n          coveredCausalFrontier: domainFrontier(session.frontier()),\n          operationProtocolVersion: COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n          crdtStateVersion: SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n        });\n      }\n      if (session.modality !== input.state.modality) throw new Error(\"Native modality mismatch\");\n      return Object.freeze({\n        ...common,\n        modality: session.modality,\n        nativeRevision: safeRevision(session.revision()),\n      });\n    } finally {\n      session.dispose();\n    }\n  }\n\n  async verifyAndReconstruct(\n    input: Parameters<IsolatedEditableArtifactSnapshotKernelPort[\"verifyAndReconstruct\"]>[0],\n  ): Promise<IsolatedEditableArtifactSnapshotKernelResult> {\n    throwIfAborted(input.signal);\n    const bytes = await collectExact(\n      input.snapshotChunks,\n      input.expectedSnapshotByteSize,\n      input.signal,\n    );\n    const session = openNativeArtifactSession(this.runtime, {\n      modality: input.modality,\n      snapshot: bytes,\n    });\n    try {\n      const canonical = session.snapshot();\n      if (!equalBytes(canonical, bytes)) throw new Error(\"Native snapshot is not canonical\");\n      const expected = input.expectedSnapshot;\n      if (expected.modality !== session.modality) throw new Error(\"Snapshot modality mismatch\");\n      const coveredHeadSequence = expected.coveredHeadSequence;\n      const stateHash = editableArtifactStateHash(session.stateHash());\n      if (stateHash !== expected.stateHash) throw new Error(\"Snapshot state hash mismatch\");\n      const canonicalContentHash = editableArtifactContentHash(\n        `sha256:${createHash(\"sha256\").update(canonical).digest(\"hex\")}`,\n      );\n      if (session.modality === \"spreadsheet\") {\n        const coveredCausalFrontier = domainFrontier(session.frontier());\n        if (\n          expected.modality !== \"spreadsheet\" ||\n          !causalFrontiersEqual(coveredCausalFrontier, expected.coveredCausalFrontier)\n        ) {\n          throw new Error(\"Snapshot causal coverage mismatch\");\n        }\n        if (input.replayPlan && input.replayPlan.modality !== \"spreadsheet\") {\n          throw new Error(\"Replay modality mismatch\");\n        }\n        const replayedTarget = input.replayPlan\n          ? await replaySpreadsheetPlan(session, input.replayPlan, input.signal)\n          : undefined;\n        return Object.freeze({\n          modality: \"spreadsheet\" as const,\n          canonicalReencodeVerified: true as const,\n          scope: input.scope,\n          artifactId: input.artifactId,\n          canonicalByteSize: canonical.byteLength,\n          canonicalContentHash,\n          coveredHeadSequence,\n          stateHash,\n          modelSchemaVersion: SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n          kernelVersion: this.runtime.buildIdentity,\n          fullCrdtStateVerified: true as const,\n          coveredCausalFrontier,\n          operationProtocolVersion: COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n          crdtStateVersion: SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n          ...(replayedTarget ? { replayedTarget } : {}),\n        });\n      }\n      if (expected.modality === \"spreadsheet\") throw new Error(\"Snapshot modality mismatch\");\n      const nativeRevision = safeRevision(session.revision());\n      if (nativeRevision !== expected.nativeRevision) {\n        throw new Error(\"Snapshot native revision mismatch\");\n      }\n      if (input.replayPlan && input.replayPlan.modality === \"spreadsheet\") {\n        throw new Error(\"Replay modality mismatch\");\n      }\n      const replayedTarget = input.replayPlan\n        ? await replaySerializedPlan(session, input.replayPlan, input.signal)\n        : undefined;\n      return Object.freeze({\n        modality: session.modality,\n        canonicalReencodeVerified: true as const,\n        scope: input.scope,\n        artifactId: input.artifactId,\n        canonicalByteSize: canonical.byteLength,\n        canonicalContentHash,\n        coveredHeadSequence,\n        stateHash,\n        modelSchemaVersion: modelSchemaVersionFor(session.modality),\n        kernelVersion: this.runtime.buildIdentity,\n        nativeRevision,\n        ...(replayedTarget ? { replayedTarget } : {}),\n      });\n    } finally {\n      session.dispose();\n    }\n  }\n}\n\nfunction modelSchemaVersionFor(modality: \"spreadsheet\" | \"document\" | \"presentation\"): 1 | 2 {\n  if (modality === \"spreadsheet\") return SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION;\n  return modality === \"document\"\n    ? DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION\n    : PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION;\n}\n\nfunction assertRuntime(\n  candidate: unknown,\n  location: ConfiguredArtifactRuntimeLocation,\n): asserts candidate is ArtifactKernelRuntime {\n  if (typeof candidate !== \"object\" || candidate === null) {\n    throw new Error(\"Verified artifact facade returned no runtime\");\n  }\n  const runtime = candidate as Partial<ArtifactKernelRuntime>;\n  if (\n    runtime.kind !== \"native\" ||\n    runtime.target === \"wasm-web\" ||\n    runtime.target !== location.target ||\n    runtime.buildIdentity !== location.kernel.buildIdentity ||\n    typeof runtime.createCollaborationSession !== \"function\" ||\n    typeof runtime.openCollaborationSession !== \"function\" ||\n    typeof runtime.createDocumentSession !== \"function\" ||\n    typeof runtime.openDocumentSession !== \"function\" ||\n    typeof runtime.createPresentationSession !== \"function\" ||\n    typeof runtime.openPresentationSession !== \"function\"\n  ) {\n    throw new Error(\"Verified artifact facade returned an incompatible runtime\");\n  }\n}\n\nfunction verifySnapshotBoundary(\n  session: NativeArtifactSession,\n  state: EditableArtifactKernelState,\n): void {\n  const snapshot = state.snapshot;\n  if (!snapshot || session.modality !== state.modality)\n    throw new Error(\"Snapshot modality mismatch\");\n  if (session.stateHash() !== snapshot.stateHash) {\n    throw new Error(\"Native snapshot boundary does not match durable metadata\");\n  }\n  if (state.modality === \"spreadsheet\") {\n    if (\n      session.modality !== \"spreadsheet\" ||\n      snapshot.modality !== \"spreadsheet\" ||\n      !causalFrontiersEqual(domainFrontier(session.frontier()), snapshot.coveredCausalFrontier)\n    ) {\n      throw new Error(\"Native snapshot frontier does not match durable metadata\");\n    }\n  } else if (\n    session.modality === \"spreadsheet\" ||\n    snapshot.modality === \"spreadsheet\" ||\n    safeRevision(session.revision()) !== snapshot.nativeRevision ||\n    state.baseNativeRevision !== snapshot.nativeRevision\n  ) {\n    throw new Error(\"Native snapshot revision does not match durable metadata\");\n  }\n}\n\nfunction replayKernelTail(\n  session: NativeArtifactSession,\n  state: EditableArtifactKernelState,\n): void {\n  if (state.modality === \"spreadsheet\") {\n    if (session.modality !== \"spreadsheet\") throw new Error(\"Native modality mismatch\");\n    for (const transaction of state.committedTransactionTail) {\n      const priorNativeRevision = safeRevision(session.revision());\n      if (session.stateHash() !== transaction.priorStateHash) {\n        throw new Error(\"Spreadsheet replay prior state mismatch\");\n      }\n      session.applyCommitted(transaction.committedTransactionBytes);\n      if (\n        safeRevision(session.revision()) !== priorNativeRevision + 1 ||\n        session.stateHash() !== transaction.stateHash ||\n        !causalFrontiersEqual(\n          domainFrontier(session.frontier()),\n          transaction.resultingCausalFrontier,\n        )\n      ) {\n        throw new Error(\"Spreadsheet replay result mismatch\");\n      }\n    }\n    return;\n  }\n  if (session.modality !== state.modality) {\n    throw new Error(\"Native modality mismatch\");\n  }\n  for (const transaction of state.committedTransactionTail) {\n    if (\n      session.stateHash() !== transaction.priorStateHash ||\n      safeRevision(session.revision()) !== transaction.priorNativeRevision\n    ) {\n      throw new Error(\"Serialized replay prior state mismatch\");\n    }\n    const commit = decodeEditableArtifactSerializedCommit(\n      transaction.committedTransactionBytes,\n      state.modality,\n    );\n    const intent = decodeEditableArtifactMutationIntent(commit.intentBytes);\n    const receipt = session.applyCommands(intent.commandBytes);\n    if (\n      !equalBytes(receipt, commit.nativeReceiptBytes) ||\n      !equalBytes(receipt, transaction.nativeReceiptBytes) ||\n      safeRevision(session.revision()) !== transaction.nativeRevision ||\n      session.stateHash() !== transaction.stateHash\n    ) {\n      throw new Error(\"Serialized replay result mismatch\");\n    }\n  }\n}\n\nfunction verifyDurableHead(\n  session: NativeArtifactSession,\n  state: EditableArtifactKernelState,\n): void {\n  const snapshot = state.snapshot;\n  if (!snapshot) throw new Error(\"Editable artifact has no replay snapshot\");\n  let durableSequence = snapshot.coveredHeadSequence;\n  for (const transaction of state.committedTransactionTail) {\n    if (transaction.sequenceStart !== durableSequence + 1) {\n      throw new Error(\"Durable transaction tail contains a sequence gap\");\n    }\n    durableSequence = transaction.sequenceEnd;\n  }\n  if (\n    session.modality !== state.modality ||\n    durableSequence !== state.artifact.headSequence ||\n    session.stateHash() !== state.artifact.stateHash\n  ) {\n    throw new Error(\"Reconstructed native state does not match the durable head\");\n  }\n  if (\n    state.modality === \"spreadsheet\" &&\n    (session.modality !== \"spreadsheet\" ||\n      !causalFrontiersEqual(domainFrontier(session.frontier()), state.artifact.causalFrontier))\n  ) {\n    throw new Error(\"Reconstructed native frontier does not match the durable head\");\n  }\n  if (state.modality !== \"spreadsheet\") {\n    const expectedNativeRevision =\n      state.committedTransactionTail.at(-1)?.nativeRevision ?? state.baseNativeRevision;\n    if (safeRevision(session.revision()) !== expectedNativeRevision) {\n      throw new Error(\"Reconstructed native revision does not match the serialized tail\");\n    }\n  }\n}\n\nasync function replaySpreadsheetPlan(\n  session: NativeSpreadsheetSession,\n  plan: Extract<EditableArtifactSnapshotReplayPlan, { modality: \"spreadsheet\" }>,\n  signal: AbortSignal | undefined,\n): Promise<\n  Readonly<{\n    headSequence: number;\n    causalFrontier: ReturnType<typeof editableArtifactCausalFrontier>;\n    stateHash: ReturnType<typeof editableArtifactStateHash>;\n  }>\n> {\n  let sequence = plan.baseHeadSequence;\n  for await (const segment of plan.segments) {\n    throwIfAborted(signal);\n    if (segment.sequenceStart !== sequence + 1) throw new Error(\"Replay sequence gap\");\n    if (segment.modality !== \"spreadsheet\") throw new Error(\"Replay segment modality mismatch\");\n    session.applyCommitted(segment.bytes);\n    sequence = segment.sequenceEnd;\n  }\n  if (sequence !== plan.targetHeadSequence || session.stateHash() !== plan.targetStateHash) {\n    throw new Error(\"Replay target mismatch\");\n  }\n  const causalFrontier = domainFrontier(session.frontier());\n  if (!causalFrontiersEqual(causalFrontier, plan.targetCausalFrontier)) {\n    throw new Error(\"Replay frontier mismatch\");\n  }\n  return Object.freeze({\n    headSequence: sequence,\n    causalFrontier,\n    stateHash: editableArtifactStateHash(session.stateHash()),\n  });\n}\n\nasync function replaySerializedPlan(\n  session: Exclude<NativeArtifactSession, NativeSpreadsheetSession>,\n  plan: Exclude<EditableArtifactSnapshotReplayPlan, { modality: \"spreadsheet\" }>,\n  signal: AbortSignal | undefined,\n): Promise<\n  Readonly<{\n    headSequence: number;\n    nativeRevision: number;\n    stateHash: ReturnType<typeof editableArtifactStateHash>;\n  }>\n> {\n  if (session.modality !== plan.modality) throw new Error(\"Replay modality mismatch\");\n  let sequence = plan.baseHeadSequence;\n  for await (const segment of plan.segments) {\n    throwIfAborted(signal);\n    if (segment.sequenceStart !== sequence + 1 || segment.modality !== session.modality) {\n      throw new Error(\"Replay sequence or modality mismatch\");\n    }\n    const commit = decodeEditableArtifactSerializedCommit(segment.bytes, session.modality);\n    const intent = decodeEditableArtifactMutationIntent(commit.intentBytes);\n    const receipt = session.applyCommands(intent.commandBytes);\n    if (!equalBytes(receipt, commit.nativeReceiptBytes)) throw new Error(\"Replay receipt mismatch\");\n    sequence = segment.sequenceEnd;\n  }\n  if (sequence !== plan.targetHeadSequence || session.stateHash() !== plan.targetStateHash) {\n    throw new Error(\"Replay target mismatch\");\n  }\n  if (safeRevision(session.revision()) !== plan.targetNativeRevision) {\n    throw new Error(\"Replay native revision mismatch\");\n  }\n  return Object.freeze({\n    headSequence: sequence,\n    nativeRevision: plan.targetNativeRevision,\n    stateHash: editableArtifactStateHash(session.stateHash()),\n  });\n}\n\nfunction domainFrontier(bytes: Uint8Array): ReturnType<typeof editableArtifactCausalFrontier> {\n  return editableArtifactCausalFrontier(\n    decodeEditableArtifactCausalFrontier(bytes).map((entry) => ({\n      replicaId: editableArtifactReplicaId(entry.replicaId),\n      counter: entry.counter,\n    })),\n  );\n}\n\nasync function readVerifiedSnapshot(\n  objects: BoundedObjectReadPort,\n  snapshot: NonNullable<EditableArtifactKernelState[\"snapshot\"]>,\n  signal?: AbortSignal,\n): Promise<Uint8Array> {\n  const object = await objects.open({\n    opaqueReference: snapshot.blobReference,\n    maxBytes: MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,\n    expectedByteSize: snapshot.byteSize,\n    ...(signal ? { signal } : {}),\n  });\n  try {\n    if (object.contentType !== undefined && object.contentType !== snapshot.mimeType) {\n      throw new Error(\"Snapshot content type mismatch\");\n    }\n    const bytes = await collectExact(\n      object.chunks(signal ? { signal } : {}),\n      snapshot.byteSize,\n      signal,\n    );\n    const contentHash = `sha256:${createHash(\"sha256\").update(bytes).digest(\"hex\")}`;\n    if (contentHash !== snapshot.contentHash) throw new Error(\"Snapshot content hash mismatch\");\n    await object.assertUnchanged(signal);\n    return bytes;\n  } finally {\n    await object.close();\n  }\n}\n\nasync function collectExact(\n  chunks: AsyncIterable<Uint8Array>,\n  expectedBytes: number,\n  signal?: AbortSignal,\n): Promise<Uint8Array> {\n  if (!Number.isSafeInteger(expectedBytes) || expectedBytes <= 0) {\n    throw new Error(\"Snapshot byte size is invalid\");\n  }\n  const result = new Uint8Array(expectedBytes);\n  let offset = 0;\n  for await (const chunk of chunks) {\n    throwIfAborted(signal);\n    if (!(chunk instanceof Uint8Array) || chunk.byteLength === 0) {\n      throw new Error(\"Snapshot stream is truncated\");\n    }\n    if (offset + chunk.byteLength > result.byteLength) {\n      throw new Error(\"Snapshot stream exceeds its declared size\");\n    }\n    result.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  throwIfAborted(signal);\n  if (offset !== result.byteLength) throw new Error(\"Snapshot stream is truncated\");\n  return result;\n}\n\nasync function* fixedChunks(bytes: Uint8Array, signal?: AbortSignal): AsyncIterable<Uint8Array> {\n  for (let offset = 0; offset < bytes.byteLength; offset += SNAPSHOT_CHUNK_BYTES) {\n    throwIfAborted(signal);\n    yield bytes.subarray(offset, Math.min(bytes.byteLength, offset + SNAPSHOT_CHUNK_BYTES));\n  }\n}\n\nfunction namespaceForArtifact(artifactId: string): bigint {\n  const digest = createHash(\"sha256\").update(artifactId).digest();\n  let value = 0n;\n  for (let index = 0; index < 8; index += 1) value = (value << 8n) | BigInt(digest[index]!);\n  return value === 0n ? 1n : value;\n}\n\nfunction safeRevision(value: bigint): number {\n  if (value < 0n || value > BigInt(Number.MAX_SAFE_INTEGER)) {\n    throw new Error(\"Native revision exceeds the safe integer range\");\n  }\n  return Number(value);\n}\n\nfunction equalBytes(left: Uint8Array, right: Uint8Array): boolean {\n  if (left.byteLength !== right.byteLength) return false;\n  let difference = 0;\n  for (let index = 0; index < left.byteLength; index += 1) {\n    difference |= left[index]! ^ right[index]!;\n  }\n  return difference === 0;\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted) throw new Error(\"Editable artifact native operation was cancelled\");\n}\n","import { createHash } from \"node:crypto\";\nimport {\n  ArtifactOfficeSourceUnsupportedError,\n  prepareArtifactOfficeImport,\n  type ArtifactOfficeMimeType,\n} from \"@opengeni/artifact-tool/office-import\";\nimport {\n  MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,\n  EDITABLE_ARTIFACT_ORIGINAL_IMPORT_MAX_BYTES,\n  editableArtifactCausalFrontier,\n  editableArtifactContentHash,\n  editableArtifactReplicaId,\n  editableArtifactStateHash,\n  EditableArtifactOfficeImportError,\n  type EditableArtifactActor,\n  type EditableArtifactOfficeImportPort,\n  type EditableArtifactModality,\n  type EditableArtifactScope,\n} from \"@opengeni/core/editable-artifacts\";\nimport { requireLiveAgentAttemptAuthorization } from \"@opengeni/core\";\nimport { getFilesForSubject } from \"@opengeni/db\";\nimport {\n  MAX_BOUNDED_OBJECT_CHUNK_BYTES,\n  type BoundedImmutableObjectWritePort,\n  retryWhileMissing,\n  type ObjectStorage,\n} from \"@opengeni/storage\";\nimport type { Database } from \"@opengeni/db\";\nimport type { VerifiedNativeArtifactRuntimeBinding } from \"./editable-artifact-native-kernel\";\n\nconst SNAPSHOT_MIME = \"application/vnd.opengeni.editable-artifact-snapshot\" as const;\n\nexport type EditableArtifactOfficeImportAdapterDependencies = Readonly<{\n  db: Database;\n  objectStorage: ObjectStorage;\n  runtime: VerifiedNativeArtifactRuntimeBinding;\n  sourceObjects: BoundedImmutableObjectWritePort;\n  snapshotObjects: BoundedImmutableObjectWritePort;\n  readFiles?: typeof getFilesForSubject;\n  resolveFileAuthoritySubjectId?: typeof editableArtifactFileAuthoritySubjectId;\n  prepareOffice?: typeof prepareArtifactOfficeImport;\n}>;\n\n/** Trusted import boundary from one ready workspace file into native sequence-zero state. */\nexport class EditableArtifactOfficeImportAdapter implements EditableArtifactOfficeImportPort {\n  private readonly readFiles: typeof getFilesForSubject;\n  private readonly resolveFileAuthoritySubjectId: typeof editableArtifactFileAuthoritySubjectId;\n\n  constructor(private readonly dependencies: EditableArtifactOfficeImportAdapterDependencies) {\n    this.readFiles = dependencies.readFiles ?? getFilesForSubject;\n    this.resolveFileAuthoritySubjectId =\n      dependencies.resolveFileAuthoritySubjectId ?? editableArtifactFileAuthoritySubjectId;\n  }\n\n  async prepare(\n    input: Parameters<EditableArtifactOfficeImportPort[\"prepare\"]>[0],\n  ): ReturnType<EditableArtifactOfficeImportPort[\"prepare\"]> {\n    throwIfAborted(input.signal);\n    const subjectId = await this.resolveFileAuthoritySubjectId(\n      this.dependencies.db,\n      input.scope,\n      input.actor,\n    );\n    const [file] = await this.readFiles(this.dependencies.db, {\n      accountId: input.scope.accountId,\n      workspaceId: input.scope.workspaceId,\n      subjectId,\n      fileIds: [input.fileId],\n    });\n    if (!file || file.status !== \"ready\") {\n      throw new EditableArtifactOfficeImportError(\"invalid_source\");\n    }\n    const expectedMimeType = officeMimeType(input.modality);\n    if (\n      file.contentType !== expectedMimeType ||\n      !officeFilenameMatches(file.filename, input.modality) ||\n      !Number.isSafeInteger(file.sizeBytes) ||\n      file.sizeBytes < 1 ||\n      file.sizeBytes > EDITABLE_ARTIFACT_ORIGINAL_IMPORT_MAX_BYTES ||\n      typeof file.sha256 !== \"string\" ||\n      !/^[0-9a-f]{64}$/u.test(file.sha256)\n    ) {\n      throw new EditableArtifactOfficeImportError(\"invalid_source\");\n    }\n    const sourceBytes = await readVerifiedWorkspaceFile(\n      this.dependencies.objectStorage,\n      file,\n      input.signal,\n    );\n    const prepared = await prepareOfficeImport({\n      runtime: this.dependencies.runtime,\n      modality: input.modality,\n      filename: file.filename,\n      mimeType: expectedMimeType,\n      bytes: sourceBytes,\n      prepare: this.dependencies.prepareOffice ?? prepareArtifactOfficeImport,\n    });\n    const retainedSource = await this.dependencies.sourceObjects.write({\n      chunks: byteChunks(sourceBytes),\n      contentType: expectedMimeType,\n      maxBytes: EDITABLE_ARTIFACT_ORIGINAL_IMPORT_MAX_BYTES,\n      expectedByteSize: prepared.source.byteSize,\n      expectedContentHash: prepared.source.contentHash,\n      ...(input.signal ? { signal: input.signal } : {}),\n    });\n    const retainedSnapshot = await this.dependencies.snapshotObjects.write({\n      chunks: byteChunks(prepared.snapshot.bytes),\n      contentType: SNAPSHOT_MIME,\n      maxBytes: MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,\n      expectedByteSize: prepared.snapshot.byteSize,\n      expectedContentHash: prepared.snapshot.contentHash,\n      ...(input.signal ? { signal: input.signal } : {}),\n    });\n    const common = {\n      modality: prepared.snapshot.modality,\n      blobReference: retainedSnapshot.opaqueReference,\n      byteSize: prepared.snapshot.byteSize,\n      contentHash: editableArtifactContentHash(prepared.snapshot.contentHash),\n      mimeType: SNAPSHOT_MIME,\n      coveredHeadSequence: 0 as const,\n      stateHash: editableArtifactStateHash(prepared.snapshot.stateHash),\n      modelSchemaVersion: prepared.snapshot.modelSchemaVersion,\n      kernelVersion: prepared.snapshot.kernelVersion,\n    };\n    return Object.freeze({\n      originalImport: Object.freeze({\n        fileId: file.id,\n        blobReference: retainedSource.opaqueReference,\n        byteSize: prepared.source.byteSize,\n        contentHash: editableArtifactContentHash(prepared.source.contentHash),\n        mimeType: expectedMimeType,\n      }),\n      snapshot:\n        prepared.snapshot.modality === \"spreadsheet\"\n          ? Object.freeze({\n              ...common,\n              modality: \"spreadsheet\" as const,\n              coveredCausalFrontier: editableArtifactCausalFrontier(\n                prepared.snapshot.coveredCausalFrontier.map((entry) => ({\n                  replicaId: editableArtifactReplicaId(entry.replicaId),\n                  counter: entry.counter,\n                })),\n              ),\n              operationProtocolVersion: prepared.snapshot.operationProtocolVersion,\n              crdtStateVersion: prepared.snapshot.crdtStateVersion,\n            })\n          : Object.freeze({\n              ...common,\n              modality: prepared.snapshot.modality,\n              nativeRevision: prepared.snapshot.nativeRevision,\n            }),\n    });\n  }\n}\n\nasync function prepareOfficeImport(input: {\n  runtime: VerifiedNativeArtifactRuntimeBinding;\n  modality: EditableArtifactModality;\n  filename: string;\n  mimeType: ArtifactOfficeMimeType;\n  bytes: Uint8Array;\n  prepare: typeof prepareArtifactOfficeImport;\n}) {\n  try {\n    return await input.prepare({\n      facade: input.runtime.facade,\n      modality: input.modality,\n      filename: input.filename,\n      mimeType: input.mimeType,\n      bytes: input.bytes,\n      expectedRuntimeTarget: input.runtime.location.target,\n      expectedKernelVersion: input.runtime.runtime.buildIdentity,\n    });\n  } catch (error) {\n    if (error instanceof ArtifactOfficeSourceUnsupportedError) {\n      throw new EditableArtifactOfficeImportError(\"unsupported_content\");\n    }\n    throw error;\n  }\n}\n\nfunction officeMimeType(modality: EditableArtifactModality): ArtifactOfficeMimeType {\n  if (modality === \"spreadsheet\") {\n    return \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\";\n  }\n  if (modality === \"document\") {\n    return \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\";\n  }\n  return \"application/vnd.openxmlformats-officedocument.presentationml.presentation\";\n}\n\nfunction officeFilenameMatches(filename: string, modality: EditableArtifactModality): boolean {\n  const extension =\n    modality === \"spreadsheet\" ? \".xlsx\" : modality === \"document\" ? \".docx\" : \".pptx\";\n  return filename.toLowerCase().endsWith(extension);\n}\n\nasync function readVerifiedWorkspaceFile(\n  storage: ObjectStorage,\n  file: NonNullable<Awaited<ReturnType<typeof getFilesForSubject>>>[number],\n  signal?: AbortSignal,\n): Promise<Uint8Array> {\n  throwIfAborted(signal);\n  const before = await retryWhileMissing(async () => {\n    try {\n      return await storage.headFile(file);\n    } catch (error) {\n      if (typeof storage.fileExists === \"function\" && !(await storage.fileExists(file))) {\n        return null;\n      }\n      throw error;\n    }\n  });\n  if (!before) {\n    throw new EditableArtifactOfficeImportError(\"source_changed\");\n  }\n  if (\n    before.ContentLength !== file.sizeBytes ||\n    before.ContentType !== file.contentType ||\n    before.Metadata?.sha256 !== file.sha256 ||\n    typeof before.VersionToken !== \"string\" ||\n    before.VersionToken.length < 1\n  ) {\n    throw new EditableArtifactOfficeImportError(\"source_changed\");\n  }\n  const bytes = new Uint8Array(file.sizeBytes);\n  const digest = createHash(\"sha256\");\n  for (let start = 0; start < file.sizeBytes; start += MAX_BOUNDED_OBJECT_CHUNK_BYTES) {\n    throwIfAborted(signal);\n    const end = Math.min(file.sizeBytes, start + MAX_BOUNDED_OBJECT_CHUNK_BYTES) - 1;\n    const chunk = await retryWhileMissing(async () => storage.getFileRange(file, { start, end }));\n    if (!chunk || chunk.byteLength !== end - start + 1) {\n      throw new EditableArtifactOfficeImportError(\"source_changed\");\n    }\n    bytes.set(chunk, start);\n    digest.update(chunk);\n  }\n  const after = await retryWhileMissing(async () => {\n    try {\n      return await storage.headFile(file);\n    } catch (error) {\n      if (typeof storage.fileExists === \"function\" && !(await storage.fileExists(file))) {\n        return null;\n      }\n      throw error;\n    }\n  });\n  if (!after) {\n    throw new EditableArtifactOfficeImportError(\"source_changed\");\n  }\n  const sha256 = digest.digest(\"hex\");\n  if (\n    after.ContentLength !== before.ContentLength ||\n    after.ContentType !== before.ContentType ||\n    after.Metadata?.sha256 !== before.Metadata?.sha256 ||\n    after.VersionToken !== before.VersionToken ||\n    sha256 !== file.sha256\n  ) {\n    throw new EditableArtifactOfficeImportError(\"source_changed\");\n  }\n  return bytes;\n}\n\nexport async function editableArtifactFileAuthoritySubjectId(\n  db: Database,\n  scope: EditableArtifactScope,\n  actor: EditableArtifactActor,\n): Promise<string | null> {\n  if (actor.kind !== \"agent\") return actor.subjectId;\n  const authorization = await requireLiveAgentAttemptAuthorization(\n    db,\n    {\n      accountId: scope.accountId,\n      workspaceId: scope.workspaceId,\n      subjectId: actor.subjectId,\n      permissions: [],\n      principalKind: \"agent_attempt\",\n      metadata: {\n        sessionId: actor.sessionId,\n        turnId: actor.turnId,\n        attemptId: actor.attemptId,\n        executionGeneration: actor.generation,\n      },\n    },\n    actor.sessionId,\n  );\n  return authorization.initiatingHumanSubjectId;\n}\n\nasync function* byteChunks(bytes: Uint8Array): AsyncIterable<Uint8Array> {\n  for (let offset = 0; offset < bytes.byteLength; offset += MAX_BOUNDED_OBJECT_CHUNK_BYTES) {\n    yield bytes.subarray(offset, offset + MAX_BOUNDED_OBJECT_CHUNK_BYTES);\n  }\n}\n\nfunction throwIfAborted(signal?: AbortSignal): void {\n  if (signal?.aborted) throw signal.reason ?? new Error(\"Artifact import aborted\");\n}\n","import { createHash } from \"node:crypto\";\n\nimport {\n  type EditableArtifactAgentWorkspaceFilePort,\n  type EditableArtifactDurableExportService,\n} from \"@opengeni/core/editable-artifacts\";\nimport { completeFileUpload, prepareGeneratedWorkspaceFile, type Database } from \"@opengeni/db\";\nimport { retryWhileMissing, type ObjectHead, type ObjectStorage } from \"@opengeni/storage\";\n\nconst UPLOAD_INTENT_TTL_MS = 60 * 60_000;\nconst UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;\n\nexport type EditableArtifactWorkspaceFileAdapterDependencies = Readonly<{\n  db: Database;\n  objectStorage: ObjectStorage;\n  durableExports: EditableArtifactDurableExportService;\n  now?: () => Date;\n  prepareFile?: typeof prepareGeneratedWorkspaceFile;\n  completeFile?: typeof completeFileUpload;\n}>;\n\n/**\n * Promotes one immutable materialization into the normal workspace-file domain.\n * The returned file ID is the only artifact export handle exposed to agents.\n */\nexport class EditableArtifactWorkspaceFileAdapter implements EditableArtifactAgentWorkspaceFilePort {\n  private readonly now: () => Date;\n  private readonly prepareFile: typeof prepareGeneratedWorkspaceFile;\n  private readonly completeFile: typeof completeFileUpload;\n\n  constructor(private readonly dependencies: EditableArtifactWorkspaceFileAdapterDependencies) {\n    this.now = dependencies.now ?? (() => new Date());\n    this.prepareFile = dependencies.prepareFile ?? prepareGeneratedWorkspaceFile;\n    this.completeFile = dependencies.completeFile ?? completeFileUpload;\n  }\n\n  async ensureMaterializationFile(\n    input: Parameters<EditableArtifactAgentWorkspaceFilePort[\"ensureMaterializationFile\"]>[0],\n  ): ReturnType<EditableArtifactAgentWorkspaceFilePort[\"ensureMaterializationFile\"]> {\n    throwIfAborted(input.signal);\n    const storage = this.dependencies.objectStorage;\n    if (!storage.headObject || !storage.putObjectStreamIfAbsent) {\n      throw new Error(\"Object storage lacks immutable streaming upload support\");\n    }\n    const download = await this.dependencies.durableExports.openMaterializationDownload({\n      scope: input.scope,\n      actor: input.actor,\n      artifactId: input.artifact.id,\n      jobId: input.jobId,\n      ...(input.signal ? { signal: input.signal } : {}),\n    });\n    try {\n      const sha256 = plainSha256(download.contentHash);\n      const filename = exportFilename(input.filename, download.format);\n      const fileId = deterministicUuid(\n        `editable-artifact-export:file:${input.scope.workspaceId}:${input.artifact.id}:${input.versionId}:${input.jobId}`,\n      );\n      const uploadId = deterministicUuid(\n        `editable-artifact-export:upload:${input.scope.workspaceId}:${input.artifact.id}:${input.versionId}:${input.jobId}`,\n      );\n      const safeFilename = `artifact-${input.artifact.id}-${input.jobId}.${download.format}`;\n      const objectKey = `workspaces/${input.scope.workspaceId}/files/${fileId}/artifact-exports/${safeFilename}`;\n      const prepared = await this.prepareFile(this.dependencies.db, {\n        accountId: input.scope.accountId,\n        workspaceId: input.scope.workspaceId,\n        fileId,\n        uploadId,\n        filename,\n        safeFilename,\n        contentType: download.mimeType,\n        sizeBytes: download.byteSize,\n        sha256,\n        bucket: storage.bucket,\n        objectKey,\n        expiresAt: new Date(this.now().getTime() + UPLOAD_INTENT_TTL_MS),\n      });\n\n      let file = prepared.file;\n      if (file.status !== \"ready\") {\n        const existing = await storage.headObject(objectKey);\n        if (existing) {\n          assertStoredExport(existing, download.byteSize, download.mimeType, sha256);\n        } else {\n          const created = await storage.putObjectStreamIfAbsent({\n            key: objectKey,\n            contentType: download.mimeType,\n            chunks: download.chunks(input.signal ? { signal: input.signal } : {}),\n            byteSize: download.byteSize,\n            sha256,\n            ...(input.signal ? { signal: input.signal } : {}),\n          });\n          if (!created) {\n            await assertVisibleExport(\n              storage,\n              objectKey,\n              download.byteSize,\n              download.mimeType,\n              sha256,\n              input.signal,\n            );\n          }\n        }\n        await download.assertUnchanged(input.signal);\n        throwIfAborted(input.signal);\n        file = await this.completeFile(this.dependencies.db, input.scope.workspaceId, uploadId);\n      } else {\n        await assertVisibleExport(\n          storage,\n          objectKey,\n          download.byteSize,\n          download.mimeType,\n          sha256,\n          input.signal,\n        );\n        await download.assertUnchanged(input.signal);\n      }\n      if (\n        file.id !== fileId ||\n        file.status !== \"ready\" ||\n        file.filename !== filename ||\n        file.contentType !== download.mimeType ||\n        file.sizeBytes !== download.byteSize ||\n        file.sha256 !== sha256\n      ) {\n        throw new Error(\"Generated workspace file differs from its immutable export\");\n      }\n\n      return Object.freeze({\n        fileId: file.id,\n        filename: file.filename,\n        contentType: file.contentType,\n        sizeBytes: file.sizeBytes,\n        sha256,\n        artifactId: input.artifact.id,\n        versionId: input.versionId,\n        materializationJobId: input.jobId,\n        sourceHeadSequence: input.sourceHeadSequence,\n        sourceStateHash: input.sourceStateHash,\n      });\n    } finally {\n      await download.close();\n    }\n  }\n}\n\nasync function assertVisibleExport(\n  storage: ObjectStorage,\n  objectKey: string,\n  byteSize: number,\n  contentType: string,\n  sha256: string,\n  signal?: AbortSignal,\n): Promise<void> {\n  const head = await retryWhileMissing(\n    async () => await storage.headObject!(objectKey),\n    signal ? { signal } : {},\n  );\n  assertStoredExport(head, byteSize, contentType, sha256);\n}\n\nfunction assertStoredExport(\n  head: ObjectHead | null,\n  byteSize: number,\n  contentType: string,\n  sha256: string,\n): void {\n  if (\n    !head ||\n    head.ContentLength !== byteSize ||\n    head.ContentType !== contentType ||\n    head.Metadata?.sha256 !== sha256 ||\n    typeof head.VersionToken !== \"string\" ||\n    head.VersionToken.length < 1\n  ) {\n    throw new Error(\"Workspace export object differs from its durable materialization\");\n  }\n}\n\nfunction exportFilename(value: string, format: string): string {\n  const expectedExtension = `.${format}`;\n  const normalized = value\n    .normalize(\"NFKC\")\n    .replace(/[\\\\/:*?\"<>|\\u0000-\\u001f\\u007f]+/gu, \"-\")\n    .replace(/\\s+/gu, \" \")\n    .trim()\n    .slice(0, 200);\n  const stem = normalized.toLowerCase().endsWith(expectedExtension)\n    ? normalized.slice(0, -expectedExtension.length)\n    : normalized;\n  return `${stem.replace(/[. ]+$/u, \"\").slice(0, 190) || \"artifact\"}${expectedExtension}`;\n}\n\nfunction plainSha256(value: string): string {\n  const match = /^sha256:([0-9a-f]{64})$/u.exec(value);\n  if (!match) throw new Error(\"Materialized artifact content hash is invalid\");\n  return match[1]!;\n}\n\nfunction deterministicUuid(seed: string): string {\n  const bytes = createHash(\"sha256\").update(seed, \"utf8\").digest().subarray(0, 16);\n  bytes[6] = ((bytes[6] ?? 0) & 0x0f) | 0x50;\n  bytes[8] = ((bytes[8] ?? 0) & 0x3f) | 0x80;\n  const hex = bytes.toString(\"hex\");\n  const value = `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n  if (!UUID_PATTERN.test(value)) throw new Error(\"Generated workspace file identity is invalid\");\n  return value;\n}\n\nfunction throwIfAborted(signal?: AbortSignal): void {\n  if (signal?.aborted) throw signal.reason ?? new Error(\"Artifact export aborted\");\n}\n","import { randomUUID } from \"node:crypto\";\nimport { isDatabaseConnectionLoss } from \"@opengeni/db\";\nimport type { Attributes, Observability, Span } from \"@opengeni/observability\";\n\nexport type ApiFatalEvent = \"startup_failure\" | \"unhandled_rejection\" | \"uncaught_exception\";\nexport type ApiFatalPhase = \"startup\" | \"running\";\nexport type ApiFatalReasonKind =\n  | \"bigint\"\n  | \"boolean\"\n  | \"error\"\n  | \"function\"\n  | \"null\"\n  | \"number\"\n  | \"object\"\n  | \"string\"\n  | \"symbol\"\n  | \"undefined\";\n\ntype ApiFatalObservability = Pick<Observability, \"error\" | \"flush\" | \"startSpan\"> &\n  Partial<Pick<Observability, \"recordFailureDiagnostic\" | \"warn\" | \"incrementCounter\">>;\n\ntype ApiFatalProcess = {\n  on: (\n    event: \"unhandledRejection\" | \"uncaughtException\",\n    listener: (reason: unknown) => void,\n  ) => void;\n  off: (\n    event: \"unhandledRejection\" | \"uncaughtException\",\n    listener: (reason: unknown) => void,\n  ) => void;\n  exit: (code: number) => void;\n};\n\nexport type ApiFatalProcessBoundaryOptions = {\n  process?: ApiFatalProcess;\n  observability?: ApiFatalObservability;\n  flushTimeoutMs?: number;\n  correlationId?: () => string;\n  fallbackLog?: (message: string) => void;\n  /**\n   * Classifies an unhandled rejection that leaves no process state behind and\n   * is therefore survivable once the API is serving. Defaults to a lost\n   * database connection (deploy drain, failover, restart): the rejected query\n   * held only a pooled connection the driver has already discarded, and every\n   * durable loop retries its claim on the next tick.\n   */\n  isRecoverableRejection?: (reason: unknown) => boolean;\n};\n\nexport type ApiFatalProcessBoundary = {\n  attachObservability: (observability: ApiFatalObservability) => void;\n  markRunning: () => void;\n  reportStartupFailure: (reason: unknown) => Promise<void>;\n  dispose: () => void;\n};\n\nconst API_FATAL_FLUSH_TIMEOUT_MS = 1_000;\nconst API_FATAL_CORRELATION_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;\n\nconst FATAL_ERROR_CODES = {\n  startup_failure: \"api_startup_failed\",\n  unhandled_rejection: \"api_unhandled_rejection\",\n  uncaught_exception: \"api_uncaught_exception\",\n} as const;\n\nexport function installApiFatalProcessBoundary(\n  options: ApiFatalProcessBoundaryOptions = {},\n): ApiFatalProcessBoundary {\n  const runtimeProcess = options.process ?? defaultProcessBoundary();\n  const flushTimeoutMs = options.flushTimeoutMs ?? API_FATAL_FLUSH_TIMEOUT_MS;\n  const correlationId = options.correlationId ?? (() => `api-fatal.${randomUUID()}`);\n  const fallbackLog = options.fallbackLog ?? ((message: string) => console.error(message));\n  const isRecoverableRejection = options.isRecoverableRejection ?? isDatabaseConnectionLoss;\n  let observability = options.observability;\n  let phase: ApiFatalPhase = \"startup\";\n  let reporting = false;\n\n  const recover = (reason: unknown): boolean => {\n    if (phase !== \"running\" || reporting) return false;\n    let recoverable = false;\n    try {\n      recoverable = isRecoverableRejection(reason);\n    } catch {\n      return false;\n    }\n    if (!recoverable) return false;\n    const attributes = {\n      errorClass: \"ApiRecoveredRejection\",\n      errorCode: \"api_unhandled_database_connection_loss\",\n      origin: \"api\",\n      reasonKind: apiFatalReasonKind(reason),\n    };\n    try {\n      if (observability?.warn) {\n        observability.warn(\n          \"Opengeni API recovered an unhandled database connection loss\",\n          attributes,\n        );\n      } else {\n        safeFallbackLog(\n          fallbackLog,\n          \"Opengeni API recovered an unhandled database connection loss (api_unhandled_database_connection_loss)\",\n        );\n      }\n      observability?.incrementCounter?.({\n        name: \"opengeni_api_recovered_rejections_total\",\n        help: \"Unhandled rejections the API survived because they only reported a lost database connection.\",\n        labels: { code: \"api_unhandled_database_connection_loss\" },\n      });\n    } catch {\n      // Recovery never depends on the observer.\n    }\n    return true;\n  };\n\n  const report = async (event: ApiFatalEvent, reason: unknown): Promise<void> => {\n    if (reporting) return;\n    reporting = true;\n\n    const diagnostic = apiFatalDiagnostic(event, phase, reason, correlationId);\n    let message = apiFatalMessage(diagnostic);\n    const activeObservability = observability;\n    try {\n      if (activeObservability) {\n        try {\n          const diagnosticId = activeObservability.recordFailureDiagnostic?.({\n            code: FATAL_ERROR_CODES[event],\n            stage: phase,\n            retryDecision: \"not_retryable\",\n            error: reason,\n          });\n          if (diagnosticId) {\n            diagnostic.correlationId = diagnosticId;\n            message = apiFatalMessage(diagnostic);\n          }\n        } catch {\n          // Never replace the required fatal exit with an observer failure.\n        }\n        let logged = false;\n        try {\n          activeObservability.error(message, diagnostic);\n          logged = true;\n        } catch {\n          // The fatal boundary must still report and terminate if logging is unhealthy.\n        }\n        if (!logged) {\n          safeFallbackLog(fallbackLog, message);\n        }\n        try {\n          const span: Span = activeObservability.startSpan(\"api.process.fatal\", diagnostic);\n          span.end({ error: true });\n        } catch {\n          // The synchronous log remains authoritative when span creation fails.\n        }\n        await flushWithin(activeObservability, flushTimeoutMs);\n      } else {\n        safeFallbackLog(fallbackLog, message);\n      }\n    } finally {\n      runtimeProcess.exit(1);\n    }\n  };\n\n  const onUnhandledRejection = (reason: unknown): void => {\n    if (recover(reason)) return;\n    void report(\"unhandled_rejection\", reason);\n  };\n  const onUncaughtException = (reason: unknown): void => {\n    void report(\"uncaught_exception\", reason);\n  };\n  runtimeProcess.on(\"unhandledRejection\", onUnhandledRejection);\n  runtimeProcess.on(\"uncaughtException\", onUncaughtException);\n\n  return {\n    attachObservability: (value) => {\n      observability = value;\n    },\n    markRunning: () => {\n      phase = \"running\";\n    },\n    reportStartupFailure: async (reason) => {\n      await report(\"startup_failure\", reason);\n    },\n    dispose: () => {\n      runtimeProcess.off(\"unhandledRejection\", onUnhandledRejection);\n      runtimeProcess.off(\"uncaughtException\", onUncaughtException);\n    },\n  };\n}\n\nfunction apiFatalDiagnostic(\n  event: ApiFatalEvent,\n  phase: ApiFatalPhase,\n  reason: unknown,\n  correlationId: () => string,\n): Attributes & {\n  errorClass: \"ApiFatalOperationError\";\n  errorCode: (typeof FATAL_ERROR_CODES)[ApiFatalEvent];\n  origin: \"api\";\n  phase: ApiFatalPhase;\n  reasonKind: ApiFatalReasonKind;\n  correlationId: string;\n} {\n  let safeCorrelationId = \"api-fatal.fallback\";\n  try {\n    const candidate = correlationId();\n    if (API_FATAL_CORRELATION_ID_PATTERN.test(candidate)) {\n      safeCorrelationId = candidate;\n    }\n  } catch {\n    // A fixed valid fallback preserves the fatal report and nonzero exit.\n  }\n  return {\n    errorClass: \"ApiFatalOperationError\",\n    errorCode: FATAL_ERROR_CODES[event],\n    origin: \"api\",\n    phase,\n    reasonKind: apiFatalReasonKind(reason),\n    correlationId: safeCorrelationId,\n  };\n}\n\nfunction apiFatalReasonKind(reason: unknown): ApiFatalReasonKind {\n  if (reason === null) return \"null\";\n  const kind = typeof reason;\n  if (kind !== \"object\") return kind;\n  try {\n    return reason instanceof Error ? \"error\" : \"object\";\n  } catch {\n    return \"object\";\n  }\n}\n\nfunction apiFatalMessage(diagnostic: ReturnType<typeof apiFatalDiagnostic>): string {\n  return (\n    `Opengeni API fatal process failure (${diagnostic.errorCode}; ` +\n    `phase=${diagnostic.phase}; reason_kind=${diagnostic.reasonKind}; ` +\n    `correlation_id=${diagnostic.correlationId})`\n  );\n}\n\nasync function flushWithin(\n  observability: Pick<Observability, \"flush\">,\n  timeoutMs: number,\n): Promise<void> {\n  let flush: Promise<void>;\n  try {\n    flush = Promise.resolve(observability.flush()).catch(() => undefined);\n  } catch {\n    return;\n  }\n  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return;\n\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  try {\n    await Promise.race([\n      flush,\n      new Promise<void>((resolve) => {\n        timeout = setTimeout(resolve, timeoutMs);\n      }),\n    ]);\n  } finally {\n    if (timeout !== undefined) clearTimeout(timeout);\n  }\n}\n\nfunction safeFallbackLog(fallbackLog: (message: string) => void, message: string): void {\n  try {\n    fallbackLog(message);\n  } catch {\n    // Process termination remains mandatory even when every diagnostic sink fails.\n  }\n}\n\nfunction defaultProcessBoundary(): ApiFatalProcess {\n  return {\n    on: (event, listener) => {\n      if (event === \"unhandledRejection\") {\n        process.on(\"unhandledRejection\", listener);\n      } else {\n        process.on(\"uncaughtException\", listener);\n      }\n    },\n    off: (event, listener) => {\n      if (event === \"unhandledRejection\") {\n        process.off(\"unhandledRejection\", listener);\n      } else {\n        process.off(\"uncaughtException\", listener);\n      }\n    },\n    exit: (code) => {\n      process.exit(code);\n    },\n  };\n}\n","type ShutdownSignal = \"SIGINT\" | \"SIGTERM\";\ntype ShutdownProcess = {\n  on(signal: ShutdownSignal, handler: () => void): unknown;\n  off(signal: ShutdownSignal, handler: () => void): unknown;\n  exit(code: number): void;\n};\n\n/** Standalone process boundary; embedded hosts keep owning their explicit close(). */\nexport function installApiShutdownHandlers(input: {\n  close: () => Promise<void>;\n  process?: ShutdownProcess;\n  timeoutMs?: number;\n  onFailure?: () => void;\n}): () => void {\n  const runtime = input.process ?? process;\n  let started = false;\n  let finished = false;\n  let deadline: ReturnType<typeof setTimeout> | undefined;\n  const dispose = () => {\n    runtime.off(\"SIGINT\", shutdown);\n    runtime.off(\"SIGTERM\", shutdown);\n  };\n  const finish = (code: number) => {\n    if (finished) return;\n    finished = true;\n    clearTimeout(deadline);\n    dispose();\n    if (code !== 0) {\n      try {\n        input.onFailure?.();\n      } catch {\n        /* Observability cannot prevent exit. */\n      }\n    }\n    runtime.exit(code);\n  };\n  function shutdown() {\n    if (started) return;\n    started = true;\n    deadline = setTimeout(() => finish(1), input.timeoutMs ?? 30_000);\n    deadline.unref?.();\n    // Catch synchronous close failures as well. Duplicate signals never start a\n    // second logout or race the connection pool's credential/session cleanup.\n    void Promise.resolve()\n      .then(input.close)\n      .then(\n        () => finish(0),\n        () => finish(1),\n      );\n  }\n  runtime.on(\"SIGINT\", shutdown);\n  runtime.on(\"SIGTERM\", shutdown);\n  return dispose;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,0BAAoD;AAC7D;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,2BAA2B;AACpC,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA,UAAU;AAAA,EACV;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;AC5CP;AAAA,EACE;AAAA,OAGK;AAIA,SAAS,6BACd,eAC8D;AAC9D,SAAO;AAAA,IACL,QAAQ,yBAAyB,aAAa;AAAA,IAC9C,0BAA0B,mCAAmC,aAAa;AAAA,EAC5E;AACF;AAEO,SAAS,yBAAyB,eAA2C;AAClF,SAAO;AAAA,IACL,OAAO,CAAC,SAAS,eAAe,cAAc,MAAM,SAAS,gBAAgB,UAAU,CAAC;AAAA,IACxF,MAAM,CAAC,SAAS,eAAe,cAAc,KAAK,SAAS,gBAAgB,UAAU,CAAC;AAAA,EACxF;AACF;AAEA,SAAS,gBAAgB,YAAyE;AAChG,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,EACT;AACA,QAAM,YAAwB,CAAC;AAC/B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,cAAU,GAAG,IAAI,oBAAoB,KAAK;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAgC;AAC3D,MACE,UAAU,QACV,UAAU,UACV,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU,WACjB;AACA,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B,QAAQ;AACN,WAAO,OAAO,KAAK;AAAA,EACrB;AACF;;;ACpBA,SAAS,kBAAkB;AAC3B,SAAS,yBAA2C;AACpD;AAAA,EACE;AAAA,OAGK;AACP,SAAS,8BAA8B;AACvC,SAAS,2BAA2B,qBAAoC;AACxE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;;;AC7CA,IAAM,4BAA4B;;;ADmDlC,IAAM,uBAAuB;AAE7B,IAAM,4BAA4B,IAAI;AActC,IAAM,0CAA0C;AACvD,IAAM,+BAA+B,kBAAkB;AAAA,EACrD,YAAY;AAAA,EACZ,SAAS;AACX,CAAC;AAMD,SAAS,WACP,MACA,KACA,QACA,SACA,aAA8C,CAAC,GACzC;AACN,QAAM,aAAa,KAAK,yBAAyB,8BAA8B,MAAM,GAAG;AACxF,MAAI,CAAC,UAAW;AAChB,OAAK,eAAe,OAAO,SAAS;AAAA,IAClC,GAAG;AAAA,IACH;AAAA,IACA,GAAI,UAAU,kBAAkB,IAAI,EAAE,iBAAiB,UAAU,gBAAgB,IAAI,CAAC;AAAA,EACxF,CAAC;AACH;AAeA,SAAS,qBACP,MACA,SACA,QACM;AACN,MAAI;AACF,SAAK,eAAe,iBAAiB;AAAA,MACnC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ,EAAE,SAAS,OAAO;AAAA,IAC5B,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAIA,SAAS,kBAAkB,QAAwB;AACjD,SAAO,kBAAkB,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC;AACzF;AAUA,eAAsB,2BACpB,MACA,cACqB;AACrB,QAAM,aAAa,OAAO,KAAK,YAAY,EAAE,SAAS,MAAM;AAC5D,QAAM,UAAU,kBAAkB,UAAU;AAC5C,MAAI,CAAC,SAAS;AAIZ,SAAK,eAAe,OAAO,mDAAmD,CAAC,CAAC;AAChF,yBAAqB,MAAM,UAAU,aAAa;AAClD,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AAEA,QAAM,OAAO,CAAC,MAAkC,WAA+B;AAC7E,yBAAqB,MAAM,UAAU,IAAI;AAEzC,UAAMA,YAAW,iBAAiB;AAAA,MAChC,eAAe,QAAQ;AAAA,MACvB,UAAU,QAAQ;AAAA,MAClB,aAAa,KAAK,QAAQ;AAAA,MAC1B,OAAO;AAAA,IACT,CAAC;AACD,WAAO,OAAO,KAAKA,WAAU,MAAM;AAAA,EACrC;AAEA,QAAM,SAAS,QAAQ;AACvB,MAAI,CAAC,QAAQ;AACX,WAAO,KAAK,kBAAkB,2BAA2B;AAAA,EAC3D;AAEA,QAAM,SAAS,+BAA+B,KAAK,QAAQ;AAC3D,MAAI,CAAC,QAAQ;AAIX,WAAO,KAAK,kBAAkB,sCAAsC;AAAA,EACtE;AAEA,QAAM,SAAS,MAAM,uBAAuB,QAAQ,MAAM;AAC1D,MAAI,CAAC,QAAQ;AAEX;AAAA,MACE;AAAA,MACA,kBAAkB,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,IACF;AACA,WAAO,KAAK,kBAAkB,sCAAsC;AAAA,EACtE;AAIA,QAAM,aAAa,MAAM,cAAc,KAAK,IAAI,OAAO,aAAa,OAAO,YAAY;AACvF,MAAI,CAAC,cAAc,WAAW,WAAW,UAAU;AACjD;AAAA,MACE;AAAA,MACA,YAAY,OAAO,WAAW,IAAI,OAAO,OAAO;AAAA,MAChD;AAAA,MACA;AAAA,MACA,EAAE,aAAa,OAAO,aAAa,SAAS,OAAO,QAAQ;AAAA,IAC7D;AACA,WAAO,KAAK,uBAAuB,0BAA0B;AAAA,EAC/D;AAKA,MACE,WAAW,gBAAgB,OAAO,eAClC,WAAW,OAAO,OAAO,gBACzB,WAAW,OAAO,OAAO,WACzB,OAAO,YAAY,OAAO,gBAC1B,OAAO,kBAAkB,SAAS,OAAO,WAAW,IAAI,OAAO,OAAO,IACtE;AACA,WAAO,KAAK,qBAAqB,8BAA8B;AAAA,EACjE;AACA,MAAI,WAAW,yBAAyB,OAAO,sBAAsB;AACnE,WAAO,KAAK,uBAAuB,2CAA2C;AAAA,EAChF;AAEA,QAAM,uBAAuB,yBAAyB,QAAQ,IAAI;AAClE,MAAI,CAAC,sBAAsB;AACzB,WAAO,KAAK,oBAAoB,8CAA8C;AAAA,EAChF;AACA,QAAM,QAAQ,MAAM,0BAA0B,KAAK,IAAI;AAAA,IACrD,aAAa,OAAO;AAAA,IACpB,cAAc,OAAO;AAAA,IACrB,sBAAsB,OAAO;AAAA,IAC7B;AAAA,IACA,SAAS;AAAA,EACX,CAAC;AACD,MAAI,CAAC,MAAM,SAAS;AAClB;AAAA,MACE;AAAA,MACA,aAAa,OAAO,WAAW,IAAI,OAAO,OAAO;AAAA,MACjD;AAAA,MACA;AAAA,MACA,EAAE,aAAa,OAAO,aAAa,SAAS,OAAO,QAAQ;AAAA,IAC7D;AACA,WAAO,KAAK,oBAAoB,wDAAwD;AAAA,EAC1F;AAKA,QAAM,cAAc;AAAA,IAClB,OAAO;AAAA,IACP,OAAO;AAAA,IACP;AAAA,EACF;AACA,QAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC/C,QAAM,UAAU,YAAY;AAAA,IAC1B,eAAe,QAAQ;AAAA,IACvB,aAAa,KAAK,QAAQ;AAAA,IAC1B,MAAM,OAAO;AAAA,IACb;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,iBAAiB,KAAK,QAAQ;AAAA;AAAA;AAAA,IAG9B,kBAAkB,KAAK,IAAI,OAAO,KAAK,aAAa,yBAAyB;AAAA,EAC/E,CAAC;AACD,QAAM,WAAW,iBAAiB;AAAA,IAChC,eAAe,QAAQ;AAAA,IACvB,UAAU,QAAQ;AAAA,IAClB,aAAa,KAAK,QAAQ;AAAA,IAC1B;AAAA,EACF,CAAC;AACD,uBAAqB,MAAM,WAAW,MAAM;AAC5C,OAAK,eAAe,OAAO,4DAA4D;AAAA,IACrF,aAAa,OAAO;AAAA,IACpB,SAAS,OAAO;AAAA,IAChB,sBAAsB,MAAM;AAAA,EAC9B,CAAC;AACD,SAAO,OAAO,KAAK,UAAU,MAAM;AACrC;AAUA,eAAsB,0BACpB,MACA,SAC8B;AAC9B,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA,EAAE,MAAM,iBAAiB,MAAM,KAAK,QAAQ,MAAM,MAAM,KAAK,QAAQ,SAAS;AAAA,IAC9E;AAAA,IACA,CAAC,UAAU,2BAA2B,MAAM,KAAK;AAAA,IACjD;AAAA,MACE,MAAM;AAAA,MACN,GAAI,KAAK,gBAAgB,6BAA6B,KAAK,aAAa,IAAI,CAAC;AAAA,IAC/E;AAAA,EACF;AACA,OAAK,eAAe,OAAO,gDAAgD;AAAA,IACzE,SAAS;AAAA,EACX,CAAC;AACD,SAAO;AACT;;;AE9QA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,iBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP;AAAA,EACE,gCAAgC;AAAA,EAChC,oCAAoC;AAAA,OAG/B;AACP,SAAS,8BAA6C;AAEtD,SAAS,8CAA8C;AAEvD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,sCAAsC;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAKA,IAAM,uBAAuB;AAG7B,IAAM,sBAAsB;AAwBnC,SAAS,mBAAmB,SAA8B;AACxD,MAAI;AACF,WAAO,WAAW,OAAO,OAAO,EAAE,OAAO,UAAU;AAAA,EACrD,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AASO,SAAS,mCACd,SACA,UAAiF,CAAC,GACpD;AAC9B,QAAM,wBAAwB,QAAQ,yBAAyB;AAC/D,MAAI,CAAC,OAAO,cAAc,qBAAqB,KAAK,yBAAyB,GAAG;AAC9E,UAAM,IAAI,WAAW,uDAAuD;AAAA,EAC9E;AAEA,QAAM,SAAS,oBAAI,IAAkC;AACrD,QAAM,gBAA4C,CAAC;AACnD,QAAM,cAAc,oBAAI,IAAgB;AACxC,MAAI,YAAY;AAChB,MAAI,iBAAiB;AAErB,QAAM,qBAAqB,MAAY;AACrC,QAAI,OAAO,SAAS,EAAG;AACvB,eAAW,WAAW,YAAa,SAAQ;AAC3C,gBAAY,MAAM;AAAA,EACpB;AAEA,iBAAe,MAAM,SAAiB,OAA4C;AAChF,WAAO,MAAM;AACX,YAAM,QAAQ,MAAM,QAAQ,MAAM;AAClC,UAAI,CAAC,MAAO;AACZ,UAAI;AACF,cAAM,QAAQ,MAAM,SAAS,MAAM,OAAO;AAAA,MAC5C,QAAQ;AAAA,MAGR;AAAA,IACF;AAEA,sBAAkB;AAClB,UAAM,YAAY;AAClB,QAAI,MAAM,QAAQ,SAAS,GAAG;AAC5B,eAAS,SAAS,KAAK;AAAA,IACzB,OAAO;AACL,UAAI,OAAO,IAAI,OAAO,MAAM,MAAO,QAAO,OAAO,OAAO;AACxD,yBAAmB;AAAA,IACrB;AACA,SAAK;AAAA,EACP;AAEA,WAAS,OAAa;AACpB,WAAO,iBAAiB,uBAAuB;AAC7C,YAAM,OAAO,cAAc,MAAM;AACjC,UAAI,CAAC,KAAM;AACX,UAAI,OAAO,IAAI,KAAK,OAAO,MAAM,KAAK,SAAS,CAAC,KAAK,MAAM,UAAW;AACtE,wBAAkB;AAClB,WAAK,MAAM,KAAK,SAAS,KAAK,KAAK;AAAA,IACrC;AAAA,EACF;AAEA,WAAS,SAAS,SAAiB,OAAmC;AACpE,QAAI,MAAM,UAAW;AACrB,UAAM,YAAY;AAClB,kBAAc,KAAK,EAAE,SAAS,MAAM,CAAC;AACrC,SAAK;AAAA,EACP;AAEA,SAAO;AAAA,IACL,QAAQ,SAAS,SAAS;AACxB,UAAI,CAAC,UAAW;AAChB,YAAM,YAAY,mBAAmB,OAAO;AAC5C,UAAI,QAAQ,OAAO,IAAI,OAAO;AAC9B,UAAI,CAAC,OAAO;AACV,gBAAQ,EAAE,WAAW,OAAO,SAAS,CAAC,EAAE;AACxC,eAAO,IAAI,SAAS,KAAK;AAAA,MAC3B;AAEA,YAAM,SAAS,EAAE,SAAS,SAAS,UAAU;AAC7C,YAAM,YAAY,MAAM,QAAQ,SAAS;AACzC,UAAI,aAAa,aAAa,KAAK,MAAM,QAAQ,SAAS,EAAG,WAAW;AACtE,cAAM,QAAQ,SAAS,IAAI;AAC3B,gBAAQ,uBAAuB;AAAA,MACjC,OAAO;AACL,cAAM,QAAQ,KAAK,MAAM;AAAA,MAC3B;AAEA,eAAS,SAAS,KAAK;AAAA,IACzB;AAAA,IACA,MAAM,WAAW;AACf,UAAI,OAAO,SAAS,EAAG;AACvB,YAAM,IAAI,QAAc,CAAC,YAAY,YAAY,IAAI,OAAO,CAAC;AAAA,IAC/D;AAAA,IACA,QAAQ;AACN,kBAAY;AACZ,iBAAW,SAAS,OAAO,OAAO,GAAG;AACnC,cAAM,QAAQ,SAAS;AAAA,MACzB;AACA,yBAAmB;AAAA,IACrB;AAAA,EACF;AACF;AAOA,SAAS,kBACP,SACA,MAC+E;AAC/E,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,MACE,MAAM,WAAW,KACjB,MAAM,CAAC,MAAM,WACb,MAAM,CAAC,MAAM,gBACb,CAAC,MAAM,CAAC,KACR,MAAM,CAAC,MAAM,MACb;AACA,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,aAAa,MAAM,CAAC;AAAA,IACpB,SAAS,MAAM,CAAC;AAAA,IAChB,sBAAsB,MAAM,CAAC;AAAA,EAC/B;AACF;AAGO,SAAS,uBACd,SAC+E;AAC/E,SAAO,kBAAkB,SAAS,QAAQ;AAC5C;AAGO,SAAS,uBACd,SAC+E;AAC/E,SAAO,kBAAkB,SAAS,OAAO;AAC3C;AAYO,SAAS,qBAAqB,MAA2C;AAC9E,QAAM,MAAM,CAAC,MAAgC,OAAO,MAAM,WAAW,IAAI,OAAO,CAAC;AACjF,QAAM,WAAW,KAAK,KAAK,CAAC;AAC5B,SAAO;AAAA,IACL,YAAY,KAAK;AAAA,IACjB,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK;AAAA,IACZ,QAAQ,KAAK;AAAA,IACb,cAAc,IAAI,KAAK,YAAY;AAAA,IACnC,eAAe,IAAI,KAAK,aAAa;AAAA,IACrC,eAAe,IAAI,KAAK,aAAa;AAAA,IACrC,gBAAgB,IAAI,KAAK,cAAc;AAAA,IACvC,gBAAgB,WAAW,SAAS,cAAc;AAAA,IAClD,iBAAiB,WAAW,IAAI,SAAS,YAAY,IAAI;AAAA,IACzD,kBAAkB,WAAW,IAAI,SAAS,aAAa,IAAI;AAAA,IAC3D,YAAY,KAAK;AAAA;AAAA;AAAA,IAGjB,WACE,KAAK,eAAe,OAAO,KAAK,WAAW,IAAI,IAC3C,IAAI,KAAK,OAAO,KAAK,WAAW,CAAC,IACjC,oBAAI,KAAK;AAAA,EACjB;AACF;AAKO,SAAS,uCACd,MACuC;AACvC,SAAO,iCAAiC,MAAM;AAAA,IAC5C,kBAAkB,KAAK;AAAA,IACvB,UAAU,gBAAgB,KAAK,UAAU,4BAA4B;AAAA,IACrE,SAAS,KAAK,QAAQ,IAAI,CAAC,YAAY;AAAA,MACrC,IAAI,OAAO;AAAA,MACX,MAAM,OAAO;AAAA,MACb,cAAc,OAAO,aAAa,KAAK,KAAK;AAAA,MAC5C,aAAa,OAAO;AAAA,MACpB,gBAAgB,OAAO;AAAA,MACvB,kBAAkB,OAAO;AAAA,MACzB,UAAU,oBAAoB,OAAO,QAAQ;AAAA,MAC7C,cAAc,wBAAwB,OAAO,IAAI;AAAA,MACjD,sBAAsB,OAAO;AAAA,MAC7B,mBAAmB;AAAA,QACjB,OAAO;AAAA,QACP;AAAA,MACF;AAAA,MACA,UAAU,gBAAgB,OAAO,UAAU,4BAA4B;AAAA,MACvE,cAAc,OAAO;AAAA,IACvB,EAAE;AAAA,IACF,iBAAiB,KAAK,kBAAkB,CAAC,GAAG,QAAQ,2BAA2B;AAAA,EACjF,CAAC;AACH;AAEA,IAAM,8BAA8B,oBAAI,IAGtC;AAAA,EACA;AAAA,IACE,wBAAwB;AAAA,IACxB;AAAA,EACF;AAAA,EACA;AAAA,IACE,wBAAwB;AAAA,IACxB;AAAA,EACF;AAAA,EACA;AAAA,IACE,wBAAwB;AAAA,IACxB;AAAA,EACF;AAAA,EACA;AAAA,IACE,wBAAwB;AAAA,IACxB;AAAA,EACF;AAAA,EACA,CAAC,wBAAwB,uDAAuD,gBAAgB;AAClG,CAAC;AAKD,SAAS,4BACP,MACqC;AACrC,QAAM,SAAS,4BAA4B,IAAI,KAAK,MAAM;AAC1D,QAAM,YAAY,OAAO,KAAK,aAAa;AAC3C,MAAI,CAAC,UAAU,CAAC,OAAO,cAAc,SAAS,KAAK,aAAa,EAAG,QAAO,CAAC;AAC3E,QAAM,SAAS,qCAAqC,UAAU;AAAA,IAC5D,UAAU,KAAK;AAAA,IACf,sBAAsB,KAAK;AAAA,IAC3B;AAAA,IACA,QAAQ,KAAK,OAAO,MAAM,GAAG,GAAG,KAAK;AAAA,IACrC,SAAS,IAAI,KAAK,SAAS,EAAE,YAAY;AAAA,IACzC,aAAa,KAAK,IAAI,OAAO,KAAK,WAAW,KAAK,GAAG,OAAO,gBAAgB;AAAA,EAC9E,CAAC;AACD,SAAO,OAAO,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC;AAC3C;AAEA,SAAS,gBAAgB,OAAwB,OAAuB;AACtE,MAAI;AACJ,MAAI;AACF,aAAS,OAAO,KAAK;AAAA,EACvB,QAAQ;AACN,UAAM,IAAI,MAAM,GAAG,KAAK,oBAAoB;AAAA,EAC9C;AACA,MAAI,SAAS,MAAM,SAAS,OAAO,OAAO,gBAAgB,GAAG;AAC3D,UAAM,IAAI,MAAM,GAAG,KAAK,oCAAoC;AAAA,EAC9D;AACA,SAAO,OAAO,MAAM;AACtB;AAEA,SAAS,oBAAoB,UAA6C;AACxE,UAAQ,UAAU;AAAA,IAChB,KAAK,GAAG;AACN,aAAO;AAAA,IACT,KAAK,GAAG;AACN,aAAO;AAAA,IACT,KAAK,GAAG;AACN,aAAO;AAAA,IACT;AACE,YAAM,IAAI,MAAM,yDAAyD;AAAA,EAC7E;AACF;AAEA,SAAS,wBAAwB,cAAqC;AACpE,UAAQ,cAAc;AAAA,IACpB,KAAK,KAAK;AACR,aAAO;AAAA,IACT,KAAK,KAAK;AACR,aAAO;AAAA,IACT;AACE,YAAM,IAAI,MAAM,6DAA6D;AAAA,EACjF;AACF;AAEA,eAAe,+BACb,IACA,OAKe;AACf,QAAM,aAAa,MAAMC,eAAc,IAAI,MAAM,aAAa,MAAM,OAAO;AAC3E,MAAI,CAAC,WAAY;AACjB,QAAM,kCAAkC,IAAI;AAAA,IAC1C,WAAW,WAAW;AAAA,IACtB,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB,UAAU,uCAAuC,MAAM,SAAS;AAAA,EAClE,CAAC;AACH;AAQA,eAAe,uBACb,IACA,OAMyD;AACzD,QAAM,SAAS,qBAAqB,MAAM,MAAM;AAChD,QAAM,SAAS,MAAM,2BAA2B,IAAI;AAAA,IAClD,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB;AAAA,EACF,CAAC;AACD,SAAO,EAAE,UAAU,MAAM,gBAAgB,OAAO,eAAe;AACjE;AAgBA,eAAe,wBACb,IACA,KACA,eACA,aACA,cACA,OACe;AACf,QAAM,WAAW,MAAM,iCAAiC,IAAI,EAAE,aAAa,aAAa,CAAC;AACzF,aAAW,WAAW,UAAU;AAC9B,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,MAAM,QAAQ,YAAY;AAAA,MAC5B;AAAA,IACF,SAAS,OAAO;AACd,qBAAe,OAAO,uDAAuD;AAAA,QAC3E;AAAA,QACA,WAAW,QAAQ;AAAA,QACnB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AACF;AASA,eAAsB,wBACpB,IACA,eACA,SACA,SACA,KACA,cACe;AACf,QAAM,MAAM,uBAAuB,OAAO;AAC1C,MAAI,CAAC,KAAK;AACR;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,WAAW,OAAO,OAAO;AAAA,EACnC,SAAS,OAAO;AACd,mBAAe,OAAO,yDAAyD;AAAA,MAC7E;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AACD;AAAA,EACF;AAYA,MAAI,MAAM,OAAO,UAAU,gBAAgB;AACzC,UAAM,SAAS,yBAAyB,MAAM,MAAM,aAAa,MAAM;AACvE,mBAAe,iBAAiB;AAAA,MAC9B,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ,EAAE,OAAO;AAAA,IACnB,CAAC;AACD,QAAI;AACF,YAAMC,cAAa,MAAMD,eAAc,IAAI,IAAI,aAAa,IAAI,OAAO;AACvE,UAAIC,aAAY;AACd,cAAM,WAAW,MAAM,4BAA4B,IAAI;AAAA,UACrD,WAAWA,YAAW;AAAA,UACtB,aAAa,IAAI;AAAA,UACjB,cAAc,IAAI;AAAA,UAClB,sBAAsB,IAAI;AAAA,UAC1B;AAAA,QACF,CAAC;AAGD,YAAI,CAAC,SAAS,SAAU;AACxB,YAAI;AACF,gBAAM,iCAAiC,IAAI;AAAA,YACzC,WAAWA,YAAW;AAAA,YACtB,aAAa,IAAI;AAAA,YACjB,cAAc,IAAI;AAAA,UACpB,CAAC;AAAA,QACH,SAAS,OAAO;AACd,yBAAe,OAAO,6DAA6D;AAAA,YACjF;AAAA,YACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,UAC9D,CAAC;AAAA,QACH;AAMA,YAAI,KAAK;AACP,gBAAM,eACJ,MAAM,MAAM,aAAa,WAAW,mBAAmB;AACzD,gBAAM;AAAA,YACJ;AAAA,YACA;AAAA,YACA;AAAA,YACA,IAAI;AAAA,YACJ,IAAI;AAAA,YACJ,CAAC,iBAAiB;AAChB,oBAAM,SAA6B;AAAA,gBACjC,EAAE,MAAM,qBAAqB,QAAQ,cAAc,SAAS,EAAE,OAAO,EAAE;AAAA,cACzE;AACA,kBAAI,cAAc;AAChB,uBAAO,KAAK;AAAA,kBACV,MAAM;AAAA,kBACN,QAAQ;AAAA,kBACR,SAAS,CAAC;AAAA,gBACZ,CAAC;AAAA,cACH;AACA,qBAAO;AAAA,YACT;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,qBAAe,OAAO,kDAAkD;AAAA,QACtE;AAAA,QACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AACA;AAAA,EACF;AACA,MAAI,MAAM,OAAO,UAAU,uBAAuB;AAChD,UAAMA,cAAa,MAAMD,eAAc,IAAI,IAAI,aAAa,IAAI,OAAO,EAAE,MAAM,MAAM,IAAI;AACzF,QAAI,CAACC,eAAcA,YAAW,yBAAyB,IAAI,qBAAsB;AACjF,UAAM,WAAW,MAAM,MAAM;AAC7B,UAAM,UAAU,MAAM;AACpB,cAAQ,SAAS,OAAO;AAAA,QACtB,KAAK,iBAAiB;AACpB,iBAAO;AAAA,QACT,KAAK,iBAAiB;AACpB,iBAAO;AAAA,QACT,KAAK,iBAAiB;AACpB,iBAAO;AAAA,QACT,KAAK,iBAAiB;AACpB,iBAAO;AAAA,QACT,KAAK,iBAAiB;AACpB,iBAAO;AAAA,QACT,KAAK,iBAAiB;AACpB,iBAAO;AAAA,QACT,KAAK,iBAAiB;AACpB,iBAAO;AAAA,QACT;AACE,iBAAO;AAAA,MACX;AAAA,IACF,GAAG;AACH,QAAI,CAAC,OAAQ;AACb,QAAI;AACF,YAAM,6BAA6B,IAAI;AAAA,QACrC,WAAWA,YAAW;AAAA,QACtB,aAAa,IAAI;AAAA,QACjB,cAAc,IAAI;AAAA,QAClB,sBAAsB,IAAI;AAAA,QAC1B,sBAAsBA,YAAW;AAAA,QACjC,aAAa,SAAS;AAAA,QACtB;AAAA,QACA,sBAAsB,iBAAiB,KAAK,SAAS,oBAAoB,IACrE,SAAS,uBACT;AAAA,QACJ,WAAW,SAAS,aAAa;AAAA,QACjC,WAAW,SAAS;AAAA,QACpB,YAAY,SAAS;AAAA,MACvB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,qBAAe,OAAO,yDAAyD;AAAA,QAC7E;AAAA,QACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AACA;AAAA,EACF;AACA,MAAI,MAAM,OAAO,UAAU,aAAa;AACtC;AAAA,EACF;AACA,QAAM,YAAY,MAAM,MAAM;AAC9B,QAAM,aAAa,MAAMD,eAAc,IAAI,IAAI,aAAa,IAAI,OAAO,EAAE,MAAM,MAAM,IAAI;AACzF,MAAI,CAAC,cAAc,WAAW,yBAAyB,IAAI,qBAAsB;AACjF,MAAI;AACF,UAAM,UAAU,MAAM,0BAA0B,IAAI;AAAA,MAClD,WAAW,WAAW;AAAA,MACtB,aAAa,IAAI;AAAA,MACjB,cAAc,IAAI;AAAA,MAClB,sBAAsB,IAAI;AAAA,MAC1B,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,QAAQ,QAAS;AAAA,EACxB,SAAS,OAAO;AACd,mBAAe,OAAO,kDAAkD;AAAA,MACtE;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AACD;AAAA,EACF;AAGA,gBAAc,SAAS,UAAU;AACjC,MAAI,UAAU,0BAA0B;AACtC,QAAI;AACF,YAAM,+BAA+B,IAAI;AAAA,QACvC,aAAa,IAAI;AAAA,QACjB,SAAS,IAAI;AAAA,QACb,WAAW,UAAU;AAAA,MACvB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,qBAAe,OAAO,kDAAkD;AAAA,QACtE;AAAA,QACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,UAAU,eAAe;AAC3B,QAAI;AACF,YAAM,SAAS,UAAU;AACzB,YAAM,YAAY,OAAO,aAAa,CAAC,OAAO;AAC9C,YAAM,SAAS,OAAO,qBAAqB;AAC3C,YAAM,iBAAiB,OAAO;AAC9B,YAAM,SAAS,yBAAyB,WAAW,iBAAiB;AAGpE,UACE,WAAW,eAAe,cACzB,WAAW,4BAA4B,UAAU,UAClD,WAAW,mBAAmB,YAAY,aACzC,mBAAmB,WACjB,QAAQ,oBAAoB,eAAe,mBAC1C,QAAQ,kBAAkB,eAAe,iBACzC,QAAQ,oBAAoB,eAAe,kBAC/C;AACA,cAAM,yBAAyB,IAAI;AAAA,UACjC,aAAa,IAAI;AAAA,UACjB,SAAS,IAAI;AAAA,UACb,YAAY;AAAA,UACZ,0BAA0B;AAAA,UAC1B,gBAAgB;AAAA,UAChB,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,UAC3C,sBAAsB,IAAI;AAAA,QAC5B,CAAC;AAAA,MACH;AAAA,IACF,SAAS,OAAO;AACd,qBAAe,OAAO,iDAAiD;AAAA,QACrE;AAAA,QACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,UAAU,UAAU;AAC1B,MAAI,CAAC,QAAS;AACd,MAAI;AACF,UAAM,uBAAuB,IAAI;AAAA,MAC/B,WAAW,WAAW;AAAA,MACtB,aAAa,IAAI;AAAA,MACjB,SAAS,IAAI;AAAA,MACb,QAAQ;AAAA,IACV,CAAC;AAAA,EACH,SAAS,OAAO;AACd,mBAAe,OAAO,gDAAgD;AAAA,MACpE;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AAAA,EACH;AACF;AAOO,SAAS,sBAAsB,MAKvB;AACb,QAAM,YAAY;AAAA,IAChB,CAAC,SAAS,YACR;AAAA,MACE,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,IACF;AAAA,MACE,sBAAsB,MACpB,KAAK,eAAe,iBAAiB;AAAA,QACnC,MAAM;AAAA,QACN,MAAM;AAAA,MACR,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,cAAc,KAAK,IAAI,qBAAqB,sBAAsB,CAAC,SAAS,YAAY;AAC5F,cAAU,QAAQ,SAAS,OAAO;AAAA,EACpC,CAAC;AACD,SAAO,MAAM;AACX,gBAAY;AACZ,cAAU,MAAM;AAAA,EAClB;AACF;AAWO,SAAS,oBAAoB,OAAuB;AACzD,QAAM,OAAO,MAAM;AACnB,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AASA,MAAI,KAAK,0BAA0B;AACjC,WAAO;AAAA,EACT;AACA,SAAO,KAAK,YAAY,QAAQ,KAAK,WAAW;AAClD;AASO,SAAS,8BAA8B,OAA6B;AACzE,QAAM,SAAS,MAAM,cAAc;AACnC,SAAO,SAAS,SAAS;AAC3B;AAGO,SAAS,qBAAqB,OAAuB;AAC1D,SAAO,MAAM,cAAc,aAAa;AAC1C;AAEO,SAAS,yBAAyB,OAAuC;AAC9E,QAAM,OAAO,MAAM;AAInB,MAAI,CAAC,KAAM,QAAO,CAAC;AACnB,SAAO;AAAA,IACL,MAAM,KAAK,SAAS;AAAA,IACpB,YAAY,KAAK,eAAe;AAAA,IAChC,KAAK,KAAK,QAAQ;AAAA,IAClB,KAAK,KAAK,QAAQ;AAAA,IAClB,SAAS,KAAK,YAAY;AAAA,IAC1B,UAAU,KAAK,aAAa;AAAA,IAC5B,eAAe,KAAK,kBAAkB;AAAA,IACtC,yBAAyB,KAAK,4BAA4B;AAAA,IAC1D,mBAAmB,KAAK,sBAAsB;AAAA,IAC9C,sBAAsB,KAAK,yBAAyB;AAAA,IACpD,iBAAiB,KAAK,oBAAoB;AAAA,IAC1C,eAAe,KAAK,2BAA2B;AAAA,IAC/C,GAAI,KAAK,iBAAiB,oCAAoC,KAAK,cAAc,IAAI,CAAC;AAAA,EACxF;AACF;AAEA,SAAS,qBAAqB,OAIrB;AACP,MACE,CAAC,6EAA6E;AAAA,IAC5E,MAAM;AAAA,EACR,KACA,CAAC,4CAA4C,KAAK,MAAM,4BAA4B,KACpF,CAAC,iBAAiB,KAAK,MAAM,2BAA2B,GACxD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,aAAa,MAAM;AAAA,IACnB,eAAe,MAAM;AAAA,IACrB,cAAc,MAAM;AAAA,EACtB;AACF;AAUA,eAAsB,yBACpB,IACA,OAS+B;AAC/B,QAAM,2BAA2B,MAAM,4BAA4B;AACnE,QAAM,aAAa,MAAMA,eAAc,IAAI,MAAM,aAAa,MAAM,OAAO;AAC3E,MAAI,CAAC,YAAY;AACf,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACA,MACE,WAAW,eAAe,MAAM,eAC/B,WAAW,4BAA4B,UAAU,6BACjD,MAAM,mBAAmB,UACxB,WAAW,mBAAmB,YAAY,MAAM,oBACjD,MAAM,mBAAmB,UACxB,KAAK,UAAU,yBAAyB,WAAW,iBAAiB,CAAC,MACnE,KAAK,UAAU;AAAA,IACb,iBAAiB,MAAM,eAAe;AAAA,IACtC,eAAe,MAAM,eAAe;AAAA,IACpC,iBAAiB,MAAM,eAAe;AAAA,EACxC,CAAC,IACL;AAGA,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACA,SAAO,MAAM,0BAA0B,IAAI;AAAA,IACzC,WAAW,WAAW;AAAA,IACtB,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB,YAAY,MAAM;AAAA,IAClB;AAAA,IACA,GAAI,MAAM,mBAAmB,SAAY,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,IACrF,GAAI,MAAM,iBAAiB,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,IACvE,GAAI,MAAM,uBAAuB,EAAE,sBAAsB,MAAM,qBAAqB,IAAI,CAAC;AAAA,EAC3F,CAAC;AACH;AAQA,eAAsB,0BACpB,IACA,OAM+B;AAC/B,QAAM,aAAa,MAAMA,eAAc,IAAI,MAAM,aAAa,MAAM,OAAO;AAC3E,MAAI,CAAC,YAAY;AACf,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACA,MAAI,WAAW,aAAa,MAAM,UAAU;AAG1C,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACA,SAAO,MAAM,2BAA2B,IAAI;AAAA,IAC1C,WAAW,WAAW;AAAA,IACtB,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB,UAAU,MAAM;AAAA,IAChB,GAAI,MAAM,uBAAuB,EAAE,sBAAsB,MAAM,qBAAqB,IAAI,CAAC;AAAA,EAC3F,CAAC;AACH;AAUA,eAAsB,mBACpB,IACA,eACA,SACA,SACA,KACe;AACf,QAAM,MAAM,uBAAuB,OAAO;AAC1C,MAAI,CAAC,KAAK;AACR;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,OAAO,OAAO;AAAA,EAC9B,SAAS,OAAO;AACd,mBAAe,OAAO,uDAAuD;AAAA,MAC3E;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AACD;AAAA,EACF;AACA,QAAM,YAAY,MAAM,4BAA4B,IAAI,IAAI,aAAa,IAAI,OAAO,EAAE;AAAA,IACpF,MAAM;AAAA,EACR;AACA,MAAI,CAAC,aAAa,UAAU,yBAAyB,IAAI,sBAAsB;AAC7E,mBAAe,OAAO,qDAAqD;AAAA,MACzE,aAAa,IAAI;AAAA,MACjB,SAAS,IAAI;AAAA,IACf,CAAC;AACD;AAAA,EACF;AACA,MAAI;AACJ,MAAI,MAAM,cAAc,SAAS,GAAG;AAClC,QAAI;AACF,sBAAgB,uCAAuC,MAAM,eAAe,UAAU,EAAE;AAAA,IAC1F,SAAS,OAAO;AACd,qBAAe,OAAO,uDAAuD;AAAA,QAC3E,aAAa,IAAI;AAAA,QACjB,SAAS,IAAI;AAAA,QACb,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI;AACF,UAAM,yBAAyB,IAAI;AAAA,MACjC,aAAa,IAAI;AAAA,MACjB,SAAS,IAAI;AAAA,MACb,YAAY,oBAAoB,KAAK;AAAA,MACrC,0BAA0B,8BAA8B,KAAK;AAAA,MAC7D,sBAAsB,IAAI;AAAA,IAC5B,CAAC;AACD,UAAM,0BAA0B,IAAI;AAAA,MAClC,aAAa,IAAI;AAAA,MACjB,SAAS,IAAI;AAAA,MACb,UAAU,qBAAqB,KAAK;AAAA,MACpC,sBAAsB,IAAI;AAAA,IAC5B,CAAC;AACD,UAAM,0BAA0B,IAAI;AAAA,MAClC,WAAW,UAAU;AAAA,MACrB,aAAa,IAAI;AAAA,MACjB,cAAc,IAAI;AAAA,MAClB,sBAAsB,IAAI;AAAA,MAC1B,cAAc,MAAM,aAAa,KAAK,KAAK;AAAA,MAC3C,cAAc,iBAAiB,KAAK,MAAM,YAAY,IAAI,MAAM,eAAe;AAAA,MAC/E,eACE,MAAM,kBAAkB,YAAY,MAAM,kBAAkB,SACxD,MAAM,gBACN;AAAA,MACN,cAAc,yBAAyB,KAAK;AAAA,MAC5C,GAAI,kBAAkB,SAAY,EAAE,cAAc,IAAI,CAAC;AAAA,MACvD,iBAAiB,qBAAqB,KAAK;AAAA,IAC7C,CAAC;AAAA,EACH,SAAS,OAAO;AACd,mBAAe,OAAO,+DAA+D;AAAA,MACnF;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AAAA,EACH;AAIA,OAAK;AAAA,IACH,EAAE,KAAK,cAAc;AAAA,IACrB;AAAA,MACE;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,QACN,aAAa,IAAI;AAAA,QACjB,cAAc,IAAI;AAAA,QAClB,sBAAsB,IAAI;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AASA,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,2BAA2B,IAAI;AAAA,MACvD,WAAW,UAAU;AAAA,MACrB,aAAa,IAAI;AAAA,MACjB,cAAc,IAAI;AAAA,MAClB,sBAAsB,IAAI;AAAA,IAC5B,CAAC;AACD,QAAI,WAAW,KAAK;AAClB,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,QACA,IAAI;AAAA,QACJ,IAAI;AAAA,QACJ,CAAC,iBAAiB,CAAC,EAAE,MAAM,yBAAyB,QAAQ,cAAc,SAAS,CAAC,EAAE,CAAC;AAAA,MACzF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,mBAAe,OAAO,6DAA6D;AAAA,MACjF;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AAAA,EACH;AACF;AAQO,SAAS,oBAAoB,MAIrB;AACb,SAAO,KAAK,IAAI;AAAA,IAAqB;AAAA,IAAqB,CAAC,SAAS,YAClE,mBAAmB,KAAK,IAAI,KAAK,eAAe,SAAS,SAAS,KAAK,GAAG;AAAA,EAC5E;AACF;;;ACllCA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oCAAuD;AAMhE,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB;AAC9B,IAAM,wBAAwB,IAAI;AAClC,IAAM,0BAA0B;AAEhC,eAAsB,iCAAiC,MAAsC;AAC3F,QAAM,gBAAgB,OAAO,WAAW;AACxC,QAAM,cAAc,MAAM,4BAA4B,KAAK,IAAI,eAAe,iBAAiB;AAC/F,MAAI,CAAC,YAAa,QAAO;AAEzB,MAAI;AACF,QAAI,CAAE,MAAM,uCAAuC,KAAK,IAAI,WAAW,GAAI;AACzE,YAAM,2BAA2B,KAAK,IAAI;AAAA,QACxC;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,WAAW;AAAA,MACb,CAAC;AACD,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM,wCAAwC,MAAM;AAAA,MACjE,WAAW,YAAY;AAAA,MACvB,aAAa,YAAY;AAAA,MACzB,cAAc,YAAY;AAAA,MAC1B,WAAW,YAAY;AAAA,MACvB,WAAW,YAAY;AAAA,IACzB,CAAC;AACD,UAAM,SAAS,MAAM,OAAO,YAAY;AAAA,MACtC,aAAa,YAAY;AAAA,MACzB,WAAW,YAAY;AAAA,MACvB,MAAM,oCAAoC,MAAM,WAAW;AAAA,MAC3D,+BAA+B;AAAA,IACjC,CAAC;AACD,UAAM,YAAY,MAAM,+BAA+B,KAAK,IAAI;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,gBAAgB,OAAO;AAAA,MACvB,uBAAuB,OAAO;AAAA,IAChC,CAAC;AACD,QAAI,CAAC,UAAW,OAAM,IAAI,MAAM,iDAAiD;AAAA,EACnF,SAAS,OAAO;AACd,UAAM,YAAY,kBAAkB,KAAK;AACzC,QAAI,4BAA4B,KAAK,GAAG;AACtC,YAAM,2BAA2B,KAAK,IAAI;AAAA,QACxC;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW;AAAA,MACb,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IAC1B,WAAW,YAAY,gBAAgB,yBAAyB,uBAAuB,KAAK,GAAG;AAC7F,YAAM,2BAA2B,KAAK,IAAI;AAAA,QACxC;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IAC1B,OAAO;AACL,YAAM,4BAA4B,KAAK,IAAI;AAAA,QACzC;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,gBAAgB,OAAO,YAAY,YAAY,CAAC;AAAA,MACjF,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IAC1B;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,gCACd,MACA,UAAwD,CAAC,GACpC;AACrB,MAAI,UAAU;AACd,MAAI;AACJ,QAAM,aAAa,KAAK,IAAI,KAAK,QAAQ,cAAc,GAAK;AAC5D,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,QAAQ,cAAc,EAAE,CAAC;AACrE,QAAM,OAAO,MAAM;AACjB,QAAI,WAAW,QAAS;AACxB,eAAW,YAAY;AACrB,eAAS,QAAQ,GAAG,QAAQ,YAAY,SAAS,GAAG;AAClD,YAAI,CAAE,MAAM,iCAAiC,IAAI,EAAI;AAAA,MACvD;AAAA,IACF,GAAG,EACA,MAAM,CAAC,UAAU;AAChB,WAAK,eAAe,MAAM,yCAAyC;AAAA,QACjE,YAAY,iBAAiB,QAAQ,MAAM,OAAO;AAAA,QAClD,WAAW,kBAAkB,KAAK;AAAA,QAClC,QAAQ;AAAA,MACV,CAAC;AAAA,IACH,CAAC,EACA,QAAQ,MAAM;AACb,gBAAU;AAAA,IACZ,CAAC;AAAA,EACL;AACA,QAAM,QAAQ,YAAY,MAAM,UAAU;AAC1C,iBAAe,IAAI;AACnB,SAAO,YAAY;AACjB,cAAU;AACV,kBAAc,KAAK;AACnB,UAAM;AAAA,EACR;AACF;AAEO,SAAS,oCACd,MACA,aACQ;AACR,QAAM,aAAa,YAAY;AAC/B,QAAM,UAAU,wBAAwB,WAAW,SAAS,GAAG,GAAG,KAAK;AACvE,QAAM,QAAQ,wBAAwB,WAAW,YAAY,GAAG,EAAE;AAClE,QAAM,aAAa,wBAAwB,WAAW,YAAY,GAAG,EAAE;AACvE,QAAM,aAAa,wBAAwB,WAAW,YAAY,GAAG,EAAE;AACvE,QAAM,cAAc,wBAAwB,WAAW,aAAa,GAAG,EAAE;AACzE,QAAM,UAAU,wBAAwB,WAAW,SAAS,GAAG,EAAE;AACjE,QAAM,UACJ,YAAY,eAAe,qBACvB,oBAAoB,cAAc,QAAQ,KAC1C,qBAAqB,WAAW,QAAQ;AAC9C,QAAM,UAAU;AAAA,IACd,eAAe,YAAY,UAAU;AAAA,IACrC,GAAI,cAAc,CAAC,YAAY,WAAW,EAAE,IAAI,CAAC;AAAA,IACjD,GAAI,QAAQ,CAAC,UAAU,KAAK,EAAE,IAAI,CAAC;AAAA,IACnC,GAAI,aAAa,CAAC,aAAa,UAAU,EAAE,IAAI,CAAC;AAAA,EAClD;AACA,QAAM,OACJ,YAAY,eAAe,qBACvB,eAAe,YAAY,WAAW,oBAAoB,mBAAmB,YAAY,QAAQ,CAAC,KAClG,eAAe,YAAY,WAAW;AAC5C,QAAM,OAAO,KAAK,SAAS,cAAc,KAAK,SAAS;AACvD,QAAM,OAAO,OAAO,IAAI,IAAI,MAAM,IAAI,EAAE,SAAS,IAAI;AACrD,QAAM,OAAO,IAAI,OAAO;AAAA,EAAM,OAAO;AAAA;AAAA,EAAO,QAAQ,KAAK,QAAK,CAAC,GAAG,OAAO;AAAA,EAAK,IAAI,KAAK,EAAE;AACzF,SAAO,KAAK,UAAU,0BAClB,OACA,GAAG,KAAK,MAAM,GAAG,0BAA0B,EAAE,CAAC;AAAA;AACpD;AAEA,IAAM,2BAA2B,oBAAI,IAAI;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,uCAAuC,oBAAI,IAAI;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,SAAS,4BAA4B,OAAgB;AAC1D,SACE,iBAAiB,yBAAyB,qCAAqC,IAAI,MAAM,IAAI;AAEjG;AAEA,SAAS,uBAAuB,OAAgB;AAC9C,MAAI,EAAE,iBAAiB,uBAAwB,QAAO;AACtD,MAAI,yBAAyB,IAAI,MAAM,IAAI,EAAG,QAAO;AACrD,QAAM,SAAS,iBAAiB,KAAK,MAAM,IAAI,IAAI,CAAC;AACpD,SAAO,SACH,OAAO,MAAM,KAAK,OAAO,OAAO,MAAM,IAAI,OAAO,WAAW,SAAS,WAAW,QAChF;AACN;AAEA,SAAS,gBAAgB,OAAgB,cAAsB;AAC7D,MAAI,iBAAiB,yBAAyB,MAAM,cAAc;AAChE,WAAO,KAAK,IAAI,KAAK,IAAI,MAAM,cAAc,GAAK,GAAG,qBAAqB;AAAA,EAC5E;AACA,SAAO,KAAK,IAAI,MAAQ,KAAK,KAAK,IAAI,GAAG,eAAe,CAAC,GAAG,qBAAqB;AACnF;AAEA,SAAS,kBAAkB,OAAgB;AACzC,MAAI,iBAAiB,sBAAuB,QAAO,MAAM,KAAK,MAAM,GAAG,GAAG;AAC1E,QAAM,MAAM,iBAAiB,QAAQ,MAAM,OAAO;AAClD,SACE,IACG,YAAY,EACZ,QAAQ,gBAAgB,GAAG,EAC3B,MAAM,GAAG,GAAG,KAAK;AAExB;AAEA,SAAS,wBAAwB,OAAgB,UAAkB;AACjE,SAAO,OAAO,UAAU,WACpB,gBAAgB,6BAA6B,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC,IACtE;AACN;AAEA,SAAS,gBAAgB,OAAe;AACtC,SAAO,MAAM,WAAW,KAAK,OAAO,EAAE,WAAW,KAAK,MAAM,EAAE,WAAW,KAAK,MAAM;AACtF;;;AChNA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;;;ACPP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP,SAAS,0BAAAE,+BAA6C;AAmB/C,IAAM,gCAAgC;AAE7C,IAAM,UAAU,oBAAI,IAAI,CAAC,aAAa,UAAU,SAAS,CAAC;AAI1D,IAAM,SAAS;AAEf,IAAM,6BAAqD;AAAA,EACzD,iCAAiC,oFAAoF,MAAM;AAAA,EAC3H,4BAA4B,gGAAgG,MAAM;AAAA,EAClI,6BAA6B,gFAAgF,MAAM;AAAA,EACnH,0BAA0B,gFAAgF,MAAM;AAAA,EAChH,yBAAyB,8EAA8E,MAAM;AAAA,EAC7G,6BAA6B,gFAAgF,MAAM;AACrH;AAEA,IAAM,yBAAiD;AAAA,EACrD,6BAA6B;AAAA,EAC7B,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,0BAA0B;AAAA,EAC1B,yBAAyB;AAAA,EACzB,qBAAqB;AACvB;AAGO,SAAS,wBACd,MACA,KACgB;AAChB,MAAI,IAAI,qBAAqB;AAC3B,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM,gHAAgH,MAAM;AAAA,IAC9H;AAAA,EACF;AACA,MAAI,IAAI,oBAAoB,CAAC,IAAI,iBAAiB,WAAW;AAC3D,UAAM,SAAS,IAAI,iBAAiB;AACpC,WAAO;AAAA,MACL;AAAA,MACA,MACE,2BAA2B,MAAM,KACjC,0CAA0C,MAAM,gBAAgB,MAAM;AAAA,IAC1E;AAAA,EACF;AACA,UAAQ,IAAI,OAAO;AAAA,IACjB,KAAK;AACH,aAAO;AAAA,QACL,QAAQ,IAAI;AAAA,QACZ,MAAM,mEAAmE,MAAM;AAAA,MACjF;AAAA,IACF,KAAK;AAEH,aAAO,KAAK,YAAY,wBACpB,OACA;AAAA,QACE,QAAQ,IAAI;AAAA,QACZ,MAAM,qIAAqI,MAAM;AAAA,MACnJ;AAAA,IACN,KAAK;AACH,aAAO;AAAA,QACL,QAAQ,IAAI;AAAA,QACZ,MAAM,iHAAiH,MAAM;AAAA,MAC/H;AAAA,IACF,KAAK;AACH,aAAO,EAAE,QAAQ,IAAI,OAAO,MAAM,2BAA2B,4BAA6B;AAAA,IAC5F;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,cAAc,QAAqD;AAC1E,QAAM,QAAQ,OAAO;AACrB,MAAI,OAAO,MAAM,CAAC,QAAQ,IAAI,UAAU,4BAA4B,GAAG;AACrE,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM,YAAY,KAAK;AAAA,IACzB;AAAA,EACF;AACA,QAAM,UAAU,OAAO,CAAC,GAAG;AAC3B,MACE,SAAS,aACT,OAAO;AAAA,IACL,CAAC,QAAQ,IAAI,kBAAkB,aAAa,IAAI,iBAAiB,WAAW,QAAQ;AAAA,EACtF,GACA;AACA,WAAO;AAAA,MACL,QAAQ,QAAQ;AAAA,MAChB,MAAM,YAAY,KAAK,wCACrB,uBAAuB,QAAQ,MAAM,KAAK,sBAAsB,QAAQ,MAAM,GAChF;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,OAAO,CAAC;AACvB,SAAO;AAAA,IACL,QAAQ,OAAO,SAAS,OAAO;AAAA,IAC/B,MAAM,YAAY,KAAK;AAAA,EACzB;AACF;AAEO,SAAS,8BAA8B,QAAwB;AACpE,SAAO,YAAY,MAAM;AAC3B;AAEA,SAAS,KAAK,MAAc,KAAqB;AAC/C,SAAO,KAAK,UAAU,MAAM,OAAO,GAAG,KAAK,MAAM,GAAG,MAAM,CAAC,EAAE,QAAQ,CAAC;AACxE;AAEA,SAAS,OACP,OACA,KACA,OACA,SACoE;AAGpE,QAAM,YACJ,IAAI,aACJ,MAAM,KAAK,qBACX,MAAM,KAAK,KAAK,CAAC,cAAc,UAAU,cAAc,IAAI,GAAG,aAC9D;AACF,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,MAAM,8BAA8B,MAAM,KAAK,EAAE;AACvD,QAAM,UAAU,iCAAiC,MAAM;AAAA,IACrD;AAAA,IACA,OAAO,UAAU,WAAW,2BAA2B;AAAA,IACvD,UAAU,KAAK,MAAM,KAAK,KAAK,KAAK,KAAK,kBAAkB,+BAA+B;AAAA,IAC1F,MACE,UAAU,WACN,GAAG,QAAQ,IAAI,+CACf,QAAQ;AAAA,IACd,SAAS;AAAA,IACT,UAAU;AAAA,EACZ,CAAC;AACD,SAAO,EAAE,WAAW,KAAK,QAAQ;AACnC;AAGO,SAAS,2BACd,OAC8B;AAC9B,QAAM,EAAE,MAAM,QAAQ,KAAK,IAAI;AAC/B,QAAM,UAAU,WAAW,QAAQ,OAAO,UAAU;AAGpD,MAAI,KAAK,QAAS,QAAO,UAAU,EAAE,MAAM,SAAS,eAAe,KAAK,IAAI,KAAK,IAAI;AACrF,MAAI,QAAQ,UAAU,YAAY,KAAK,WAAW,UAAU;AAC1D,WAAO,EAAE,MAAM,SAAS,eAAe,KAAK;AAAA,EAC9C;AACA,MAAI,QAAQ,UAAU,cAAc,KAAK,WAAW,UAAU;AAC5D,WAAO,EAAE,MAAM,SAAS,eAAe,KAAK;AAAA,EAC9C;AACA,MAAI,KAAK,WAAW,SAAU,QAAO,KAAK,IAAI;AAC9C,QAAM,SAAS,KAAK,CAAC;AACrB,MAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,OAAO,MAAM,KAAK,OAAO,OAAO,QAAQ,eAAe;AACjF,WAAO,KAAK,IAAI;AAAA,EAClB;AACA,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,QAAQ,UAAU,aACrB,EAAE,MAAM,SAAS,eAAe,OAAO,GAAG,IAC1C,KAAK,OAAO,EAAE;AAAA,EACpB;AAEA,QAAM,UAAU,CAAC,QAAiC,IAAI,aAAa,KAAK;AACxE,QAAM,OAAO,QAAQ,MAAM,IAAI,wBAAwB,MAAM,MAAM,IAAI;AACvE,MAAI,MAAM;AACR,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,cAAc,OAAO;AAAA,MACrB,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,QAAQ,OAAO,OAAO,QAAQ,UAAU,IAAI;AAAA,IAC9C;AAAA,EACF;AACA,MAAI,QAAQ,UAAU,WAAY,QAAO,KAAK,OAAO,EAAE;AACvD,QAAM,SAAoC,CAAC;AAC3C,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,QAAQ,IAAI,IAAI,MAAM,KAAK,IAAI,WAAW,eAAe,CAAC,QAAQ,GAAG,EAAG;AAC7E,WAAO,KAAK,GAAG;AAAA,EACjB;AACA,MAAI,OAAO,SAAS,8BAA+B,QAAO,KAAK,OAAO,EAAE;AACxE,QAAM,OAAO,cAAc,MAAM;AACjC,QAAM,QAAQ,OAAO,GAAG,EAAE;AAC1B,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,cAAc,MAAM;AAAA,IACpB,cAAc,MAAM;AAAA,IACpB,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO,OAAO,QAAQ,YAAY,IAAI;AAAA,EAChD;AACF;AAEA,SAAS,KAAK,eAA4D;AACxE,SAAO,EAAE,MAAM,QAAQ,cAAc;AACvC;AAQA,SAAS,eAAe,OAAyB;AAC/C,SAAO,iBAAiB,SAAS,wBAAwB,KAAK,MAAM,OAAO;AAC7E;AAGA,eAAsB,kCACpB,MACA,aACA,QACe;AACf,QAAM,UAAU,MAAM,qCAAqC,KAAK,IAAI,aAAa,MAAM;AACvF,MAAI,CAAC,QAAS;AACd,MAAI;AACF,UAAMA,wBAAuB,KAAK,IAAI,KAAK,KAAK,aAAa,QAAQ,WAAW;AAAA,MAC9E,QAAQ,YAAY,SAChB;AAAA,QACE,MAAM;AAAA,QACN,SAAS,iCAAiC,MAAM,QAAQ,OAAO;AAAA,MACjE,IACA;AAAA,QACE,MAAM;AAAA,QACN,SAAS,oCAAoC,MAAM,EAAE,KAAK,QAAQ,IAAI,CAAC;AAAA,MACzE;AAAA,IACN,CAAiD;AAAA,EACnD,SAAS,OAAO;AAEd,QAAI,CAAC,eAAe,KAAK,EAAG,OAAM;AAAA,EACpC;AACA,QAAM,iCAAiC,KAAK,IAAI,aAAa,QAAQ,OAAO;AAC9E;AAGA,eAAsB,oCAAoC,MAAmC;AAC3F,aAAW,aAAa,MAAM,gCAAgC,KAAK,EAAE,GAAG;AACtE,QAAI;AACF,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,UAAU;AAAA,QACV,UAAU;AAAA,QACV;AAAA,MACF;AACA,YAAM,kCAAkC,MAAM,UAAU,cAAc,UAAU,EAAE;AAAA,IACpF,SAAS,OAAO;AACd,WAAK,eAAe,MAAM,4CAA4C;AAAA,QACpE,QAAQ,UAAU;AAAA,QAClB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;AD/QA,eAAsB,iCAAiC,MAAmC;AACxF,aAAW,aAAa,MAAM,4BAA4B,KAAK,EAAE,GAAG;AAClE,UAAM,6BAA6B,KAAK,IAAI,UAAU,cAAc,UAAU,EAAE;AAAA,EAClF;AAGA,MAAI,KAAK,KAAK;AACZ,UAAM,oCAAoC;AAAA,MACxC,IAAI,KAAK;AAAA,MACT,KAAK,KAAK;AAAA,MACV,eAAe,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AACA,aAAW,WAAW,MAAM,yCAAyC,KAAK,EAAE,GAAG;AAC7E,QAAI;AAGF,YAAM,KAAK,KAAK;AAAA,QACd,IAAI,QAAQ;AAAA,QACZ,aAAa,QAAQ;AAAA,QACrB,oBAAoB,QAAQ;AAAA,MAC9B,CAAC;AACD,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,IACF,SAAS,OAAO;AACd,YAAM,yCAAyC,KAAK,IAAI,QAAQ,cAAc,QAAQ,EAAE;AACxF,WAAK,eAAe,MAAM,gDAAgD;AAAA,QACxE,QAAQ,QAAQ;AAAA,QAChB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,SAAS,gCACd,MACA,aAAa,KACQ;AACrB,MAAI,UAAU;AACd,MAAI;AACJ,QAAM,OAAO,MAAM;AACjB,QAAI,WAAW,QAAS;AACxB,cAAU,iCAAiC,IAAI,EAC5C,MAAM,CAAC,UAAmB;AACzB,WAAK,eAAe,MAAM,uCAAuC;AAAA,QAC/D,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH,CAAC,EACA,QAAQ,MAAM;AACb,gBAAU;AAAA,IACZ,CAAC;AAAA,EACL;AACA,QAAM,QAAQ,YAAY,MAAM,UAAU;AAC1C,iBAAe,IAAI;AACnB,SAAO,YAAY;AACjB,cAAU;AACV,kBAAc,KAAK;AACnB,UAAM;AAAA,EACR;AACF;;;AElFA,SAAS,wCAAuD;AAGhE,IAAM,eAAe;AACrB,IAAM,mBAAmB;AAsBlB,SAAS,mCAAmC,MAAwC;AACzF,QAAM,QAAQ,OACZ,oBACA,SAEA,KAAK,GAAG,YAAY,OAAO,OAAO;AAChC,UAAM,GAAG,QAAQ,wCAAwC,YAAY,SAAS;AAC9E,UAAM,GAAG,QAAQ;AAAA,2BACI,2BAA2B,kBAAkB,EAAE;AAAA,QAClE;AACF,WAAO,MAAM,KAAK,EAAE;AAAA,EACtB,CAAC;AAEH,SAAO;AAAA,IACL,MAAM,KACJ,MACA,WACA;AACA,YAAM,SAAS,MAAM,MAAM,KAAK,oBAAoB,OAAO,OAAO;AAChE,YAAI;AACF,gBAAM,KAAK,aAAa,KAAK,IAAI,IAAI,kBAAkB,YAAY;AACjE,kBAAM,UAAU,MAAM,iCAAiC,IAAI,KAAK,aAAa,KAAK,EAAE;AACpF,gBAAI,WAAW,QAAQ,uBAAuB,KAAK;AACjD,oBAAM,IAAI,MAAM,0CAA0C;AAC5D,gBAAI,CAAC,WAAW,QAAQ,cAAc,QAAQ,QAAQ,SAAS,SAAS,UAAU;AAChF,oBAAM,KAAK,OAAO,KAAK,kBAAkB;AACzC;AAAA,YACF;AACA,kBAAM,EAAE,WAAW,YAAY,GAAG,OAAO,IAAI;AAC7C,kBAAM,KAAK,OAAO,MAAM;AAAA,UAC1B,CAAC;AACD,iBAAO,EAAE,IAAI,KAAc;AAAA,QAC7B,SAAS,OAAO;AACd,iBAAO,EAAE,IAAI,OAAgB,OAAO,YAAY,MAAM,UAAU,IAAI,KAAK,IAAI,MAAM;AAAA,QACrF;AAAA,MACF,CAAC;AAGD,UAAI,CAAC,OAAO,GAAI,OAAM,OAAO;AAAA,IAC/B;AAAA,IACA,MAAM,OAAO,oBAA4B;AACvC,YAAM;AAAA,QAAM;AAAA,QAAoB,YAC9B,KAAK,aAAa,KAAK,IAAI,IAAI,kBAAkB,MAAM,KAAK,OAAO,kBAAkB,CAAC;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;;;ACzEA,SAAS,YAAY,kBAAkB;AACvC,SAAS,eAAwC;AAEjD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAOP,IAAM,mBAAmB;AACzB,IAAM,gBAAgB;AACtB,IAAM,eAAe;AACrB,IAAM,oBAAoB;AAW1B,IAAM,4BAA4B;AAMlC,eAAe,6BACb,IACA,YACsC;AACtC,QAAM,iBAAiB,oBAAI,IAA8B;AACzD,SAAO,MAAM,QAAQ;AAAA,IACnB,WAAW,IAAI,OAAO,aAAa;AACjC,UAAI,SAAS,QAAQ,cAAc,+BAAgC,QAAO;AAC1E,YAAM,MAAM,GAAG,SAAS,QAAQ,WAAW,IAAI,SAAS,QAAQ,SAAS;AACzE,UAAI,SAAS,eAAe,IAAI,GAAG;AACnC,UAAI,CAAC,QAAQ;AACX,iBAAS;AAAA,UACP;AAAA,UACA,SAAS,QAAQ;AAAA,UACjB,SAAS,QAAQ;AAAA,UACjB,EAAE,QAAQ,WAAW,OAAO,GAAG;AAAA,QACjC,EACG;AAAA,UAAK,CAAC,aACL,SAAS;AAAA,YAAK,CAAC,YACb,QAAQ,UAAU,KAAK,CAAC,aAAa,SAAS,SAAS,QAAQ;AAAA,UACjE;AAAA,QACF,EACC,MAAM,MAAM,KAAK;AACpB,uBAAe,IAAI,KAAK,MAAM;AAAA,MAChC;AACA,UAAI,CAAE,MAAM,OAAS,QAAO;AAC5B,YAAM,UAA6B,EAAE,GAAG,SAAS,SAAS,gBAAgB,KAAK;AAC/E,aAAO,EAAE,GAAG,UAAU,QAAQ;AAAA,IAChC,CAAC;AAAA,EACH;AACF;AAaO,SAAS,sBAAsB,UAA0B;AAC9D,SAAO,SACJ,QAAQ,+BAA+B,IAAI,EAC3C,QAAQ,sBAAsB,IAAI,EAClC,QAAQ,eAAe,IAAI,EAC3B,QAAQ,wBAAwB,SAAI,EACpC,QAAQ,YAAY,MAAM,EAC1B,KAAK;AACV;AAGO,SAAS,gBAAgB,SAI9B;AACA,MAAI,QAAQ,gBAAgB;AAE1B,WAAO,EAAE,OAAO,QAAQ,SAAS,4BAA4B,MAAM,0BAA0B;AAAA,EAC/F;AACA,QAAM,WACJ,QAAQ,SAAS,gBACb,wBACA,QAAQ,SAAS,WACf,kBACA,QAAQ,SAAS,gBACf,gBACA;AACV,QAAM,SAAS,QAAQ,SAAS,CAAC,GAC9B,MAAM,GAAG,CAAC,EACV,IAAI,CAAC,SAAS,GAAG,KAAK,KAAK,KAAK,KAAK,KAAK,EAAE,EAC5C,KAAK,IAAI;AACZ,QAAM,UAAU,QAAQ,OAAO,sBAAsB,QAAQ,IAAI,IAAI;AAGrE,QAAM,QAAQ,CAAC,YAAY,QAAQ,QAAQ,KAAK,SAAS,KAAK,EAAE,OAAO,OAAO;AAC9E,QAAM,OAAO,MAAM,KAAK,MAAM;AAC9B,SAAO;AAAA,IACL,OAAO,QAAQ,SAAS;AAAA,IACxB,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD,GAAI,QAAQ,QAAQ,SAAS,UAAU,EAAE,MAAM,QAAQ,SAAS,IAAI,CAAC;AAAA,EACvE;AACF;AASO,SAAS,4BACd,SAC6B;AAC7B,OACG,QAAQ,SAAS,WAAW,QAAQ,SAAS,kBAC9C,QAAQ,YAAY,kBACpB;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,eAAe,SAA+C;AAC5E,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,WAAW,QAAQ;AAAA,IACnB,MAAM,QAAQ;AAAA,IACd,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,IAC5D,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,EAC3D;AACF;AAMO,SAAS,mBACd,SAC2C;AAC3C,MAAI,QAAQ,eAAgB,QAAO;AACnC,MAAI,QAAQ,cAAc,yBAA0B,QAAO;AAC3D,MAAI,QAAQ,cAAc,+BAAgC,QAAO;AACjE,SAAO;AACT;AAEA,SAAS,UAAU,OAAgC;AACjD,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,WAAW;AAChD;AAEA,SAAS,QACP,QACA,QACA,YACA,WACQ;AACR,QAAM,WAAW,GAAG,UAAU,KAAK,UAAU,MAAM,CAAC,CAAC,IAAI,UAAU,KAAK,UAAU,MAAM,CAAC,CAAC;AAC1F,QAAM,SAAS,WAAW,QAAQ;AAClC,SAAO,OAAO,QAAQ;AACtB,QAAM,YACJ,cAAc,UACV,OAAO,KAAK,EAAE,KAAK,YAAY,aAAa,aAAa,CAAC,IAC1D,OAAO,KAAK,UAAU;AAC5B,SAAO,GAAG,QAAQ,IAAI,UAAU,SAAS,CAAC;AAC5C;AAEA,SAAS,IAAI,OAAuB;AAClC,SAAO,MAAM,SAAS,KAAK,IAAI,MAAM,QAAQ,SAAS,IAAI,IAAI;AAChE;AAGO,SAAS,iBAAiB,OAIZ;AACnB,QAAM,MAAM,IAAI,MAAM,UAAU;AAChC,MAAI,QAAoD;AACxD,QAAM,WAAW,oBAAI,IAAgC;AACrD,QAAM,SAAS,MAAM;AACnB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,QAAI,CAAC,SAAS,MAAM,MAAM,WAAW,KAAK,IAAI;AAC5C,cAAQ;AAAA,QACN,OAAO;AAAA,UACL,EAAE,KAAK,SAAS,KAAK,MAAM,MAAM;AAAA,UACjC,EAAE,KAAK,MAAM,QAAQ,KAAK,IAAI;AAAA,UAC9B;AAAA,UACA;AAAA,QACF;AAAA,QACA,UAAU;AAAA,MACZ;AAAA,IACF;AACA,WAAO,MAAM;AAAA,EACf;AACA,QAAM,UAAU,CAAC,SAAiB;AAChC,UAAM,WAAW,SAAS,IAAI,IAAI;AAClC,QAAI,YAAY,CAAC,SAAS,UAAU,CAAC,SAAS,UAAW,QAAO;AAChE,UAAM,UAAU,QAAQ,WAAW,IAAI,EAAE;AACzC,YAAQ,GAAG,SAAS,MAAM,SAAS,OAAO,IAAI,CAAC;AAC/C,YAAQ,GAAG,SAAS,MAAM,SAAS,OAAO,IAAI,CAAC;AAC/C,aAAS,IAAI,MAAM,OAAO;AAC1B,WAAO;AAAA,EACT;AACA,SAAO,OAAO,aAAa;AACzB,UAAM,OACJ,SAAS,gBAAgB,gBAAgB,+BAA+B;AAC1E,UAAM,QAAQ,gBAAgB,SAAS,OAAO;AAC9C,UAAM,WAAW,mBAAmB,SAAS,OAAO;AACpD,UAAM,OAAO,KAAK,UAAU;AAAA,MAC1B,KAAK;AAAA,QACH;AAAA,QACA,OAAO;AAAA,QACP,aAAa,SAAS,QAAQ;AAAA,QAC9B,sBAAsB,4BAA4B,SAAS,OAAO;AAAA,QAClE,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACjC;AAAA,MACA,MAAM,eAAe,SAAS,OAAO;AAAA,IACvC,CAAC;AACD,WAAO,MAAM,IAAI,QAA8B,CAAC,YAAY;AAC1D,YAAM,UAAU,QAAQ,IAAI,EAAE,QAAQ;AAAA,QACpC,WAAW;AAAA,QACX,SAAS,aAAa,SAAS,KAAK;AAAA,QACpC,eAAe,UAAU,OAAO,CAAC;AAAA,QACjC,cAAc,SAAS;AAAA,QACvB,kBAAkB;AAAA,QAClB,iBAAiB;AAAA,QACjB,oBAAoB,GAAG,SAAS,QAAQ,SAAS,IAAI,SAAS,QAAQ,IAAI,GAAG,MAAM,GAAG,EAAE;AAAA,QACxF,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,SAAS;AACb,UAAI,OAAO;AACX,cAAQ,WAAW,KAAQ,MAAM,QAAQ,MAAM,CAAC;AAChD,cAAQ,GAAG,YAAY,CAAC,YAAY;AAClC,iBAAS,OAAO,QAAQ,SAAS,KAAK,CAAC;AAAA,MACzC,CAAC;AACD,cAAQ,GAAG,QAAQ,CAAC,UAAkB;AACpC,gBAAQ,MAAM,SAAS,MAAM;AAAA,MAC/B,CAAC;AACD,cAAQ,GAAG,SAAS,CAAC,UAAU,QAAQ,EAAE,SAAS,SAAS,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC;AAClF,cAAQ,GAAG,SAAS,MAAM;AACxB,YAAI,WAAW,IAAK,QAAO,QAAQ,EAAE,SAAS,YAAY,CAAC;AAC3D,cAAM,UAAU,MAAM;AACpB,cAAI;AACF,mBAAQ,KAAK,MAAM,IAAI,EAA0B,UAAU;AAAA,UAC7D,QAAQ;AACN,mBAAO,QAAQ,UAAU,MAAM;AAAA,UACjC;AAAA,QACF,GAAG;AACH,YAAI,WAAW,OAAO,WAAW,oBAAoB,WAAW,gBAAgB;AAC9E,iBAAO,QAAQ,EAAE,SAAS,gBAAgB,OAAO,GAAG,MAAM,IAAI,MAAM,GAAG,CAAC;AAAA,QAC1E;AACA,gBAAQ;AAAA,UACN,SAAS,WAAW,OAAO,UAAU,OAAO,WAAW,IAAI,UAAU;AAAA,UACrE,OAAO,GAAG,MAAM,IAAI,MAAM;AAAA,QAC5B,CAAC;AAAA,MACH,CAAC;AACD,cAAQ,IAAI,IAAI;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAGO,SAAS,gBAAgB,OAGX;AACnB,QAAM,UAAU,KAAK,MAAM,MAAM,kBAAkB;AAMnD,QAAM,OAAO,MAAM,SAAS;AAC5B,MAAI,SAAsD;AAC1D,QAAM,cAAc,YAAY;AAC9B,QAAI,UAAU,OAAO,YAAY,MAAS,KAAK,IAAI,EAAG,QAAO,OAAO;AACpE,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,UAAM,WAAW,QAAQ,aAAa;AACtC,UAAM,YAAY;AAAA,MAChB,EAAE,KAAK,SAAS,KAAK,MAAM;AAAA,MAC3B;AAAA,QACE,KAAK,QAAQ;AAAA,QACb,OAAO;AAAA,QACP,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK,MAAM;AAAA,MACb;AAAA,MACA,IAAI,QAAQ,WAAW;AAAA,MACvB;AAAA,IACF;AACA,UAAM,WAAW,MAAM,KAAK,UAAU;AAAA,MACpC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,8BAA8B,SAAS,MAAM,EAAE;AACjF,UAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,aAAS,EAAE,OAAO,KAAK,cAAc,WAAW,KAAK,IAAI,IAAI,KAAK,aAAa,IAAK;AACpF,WAAO,OAAO;AAAA,EAChB;AACA,SAAO,OAAO,aAAa;AACzB,QAAI;AACF,YAAM,QAAQ,gBAAgB,SAAS,OAAO;AAC9C,YAAM,WAAW,MAAM;AAAA,QACrB,0CAA0C,QAAQ,UAAU;AAAA,QAC5D;AAAA,UACE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,eAAe,UAAU,MAAM,YAAY,CAAC;AAAA,YAC5C,gBAAgB;AAAA,UAClB;AAAA,UACA,MAAM,KAAK,UAAU;AAAA,YACnB,SAAS;AAAA,cACP,OAAO,SAAS;AAAA,cAChB,SAAS,EAAE,UAAU,QAAQ,cAAc,SAAS,QAAQ,UAAU;AAAA,cACtE,MAAM;AAAA,gBACJ,OAAO,MAAM;AAAA,gBACb,SAAS,CAAC,MAAM,UAAU,MAAM,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI,KAAK,MAAM;AAAA,gBAC1E,MAAM,KAAK,UAAU,eAAe,SAAS,OAAO,CAAC;AAAA,cACvD;AAAA,YACF;AAAA,UACF,CAAC;AAAA,UACD,QAAQ,YAAY,QAAQ,GAAM;AAAA,QACpC;AAAA,MACF;AACA,UAAI,SAAS,GAAI,QAAO,EAAE,SAAS,YAAY;AAC/C,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAI,SAAS,WAAW,OAAO,KAAK,SAAS,cAAc,GAAG;AAC5D,eAAO,EAAE,SAAS,gBAAgB,OAAO,GAAG,SAAS,MAAM,IAAI,KAAK,MAAM,GAAG,GAAG,CAAC,GAAG;AAAA,MACtF;AACA,aAAO;AAAA,QACL,SAAS,SAAS,WAAW,OAAO,SAAS,UAAU,MAAM,UAAU;AAAA,QACvE,OAAO,GAAG,SAAS,MAAM,IAAI,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,MACjD;AAAA,IACF,SAAS,OAAO;AACd,aAAO,EAAE,SAAS,SAAS,OAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE;AAAA,IAChE;AAAA,EACF;AACF;AAGO,SAAS,4BACd,UACsD;AACtD,QAAM,UAAgE,CAAC;AACvE,MAAI,SAAS,aAAa,SAAS,cAAc,SAAS,gBAAgB;AACxE,YAAQ,MAAM,iBAAiB;AAAA,MAC7B,OAAO,SAAS;AAAA,MAChB,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS;AAAA,IACvB,CAAC;AAAA,EACH;AACA,MAAI,SAAS,uBAAuB;AAClC,YAAQ,UAAU,gBAAgB,EAAE,oBAAoB,SAAS,sBAAsB,CAAC;AAAA,EAC1F;AACA,SAAO;AACT;AAEA,eAAsB,0BACpB,MACiD;AACjD,QAAM,UAAU,KAAK,WAAW,4BAA4B,KAAK,QAAQ;AACzE,QAAM,UAAU,WAAW;AAC3B,QAAM,UAAU,MAAM;AAAA,IACpB,KAAK;AAAA,IACL,MAAM,0BAA0B,KAAK,IAAI;AAAA,MACvC;AAAA,MACA,OAAO;AAAA,MACP,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AACA,MAAI,YAAY;AAChB,QAAM,QAAQ;AAAA,IACZ,QAAQ,IAAI,OAAO,aAAa;AAC9B,YAAM,SAAS,QAAQ,SAAS,QAAQ;AACxC,YAAM,SAA+B,SACjC,MAAM,OAAO,QAAQ,EAAE,MAAM,CAAC,WAAoB;AAAA,QAChD,SAAS;AAAA,QACT,OAAO,OAAO,KAAK;AAAA,MACrB,EAAE,IACF,EAAE,SAAS,UAAU,OAAO,MAAM,SAAS,QAAQ,+BAA+B;AACtF,YAAM,UACJ,OAAO,YAAY,WAAW,SAAS,YAAY,eAAe,WAAW,OAAO;AACtF,UAAI,YAAY,YAAa,cAAa;AAAA;AAExC,aAAK,eAAe,KAAK,6BAA6B;AAAA,UACpD,UAAU,SAAS;AAAA,UACnB;AAAA,UACA,OAAO,OAAO;AAAA,QAChB,CAAC;AACH,YAAM,yBAAyB,KAAK,IAAI;AAAA,QACtC;AAAA,QACA,YAAY,SAAS;AAAA,QACrB;AAAA,QACA,OAAO,OAAO,SAAS;AAAA,QACvB,cAAc,KAAK,IAAI,MAAM,IAAI,KAAK,SAAS,QAAQ;AAAA,MACzD,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AACA,SAAO,EAAE,SAAS,QAAQ,QAAQ,UAAU;AAC9C;AAEO,SAAS,4BAA4B,MAAmD;AAC7F,QAAM,UAAU,KAAK,WAAW,4BAA4B,KAAK,QAAQ;AACzE,MAAI,UAAU;AACd,MAAI,QAAQ;AACZ,MAAI,UAAgC;AACpC,QAAM,OAAO,YAAY;AACvB,aAAS;AACT,QAAI;AACF,YAAM,EAAE,QAAQ,IAAI,MAAM,0BAA0B,EAAE,GAAG,MAAM,QAAQ,CAAC;AACxE,UAAI,UAAU,EAAG,MAAK,eAAe,KAAK,qBAAqB,EAAE,QAAQ,CAAC;AAC1E,UAAI,QAAQ,sBAAsB,EAAG,OAAM,0BAA0B,KAAK,EAAE;AAAA,IAC9E,SAAS,OAAO;AACd,WAAK,eAAe,MAAM,+BAA+B,EAAE,OAAO,OAAO,KAAK,EAAE,CAAC;AAAA,IACnF;AAAA,EACF;AACA,QAAM,QAAQ,YAAY,MAAM;AAC9B,QAAI,WAAW,QAAS;AACxB,cAAU,KAAK,EAAE,QAAQ,MAAM;AAC7B,gBAAU;AAAA,IACZ,CAAC;AAAA,EACH,GAAG,gBAAgB;AACnB,SAAO,YAAY;AACjB,cAAU;AACV,kBAAc,KAAK;AACnB,UAAM;AAAA,EACR;AACF;;;ACxcA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,sCAAqD;AAC9D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,mBAAmB;AAE5B,SAAS,oCAAoC;AAEtC,IAAM,wCAAwC;AACrD,IAAMC,iBAAgB;AACtB,IAAMC,oBAAmB;AACzB,IAAM,sBAAsB;AAC5B,IAAMC,qBAAoB;AAY1B,SAAS,UAAU,OAAwB;AACzC,MAAI,iBAAiB,OAAO;AAC1B,QAAI,MAAM,SAAS,kBAAkB,MAAM,SAAS,aAAc,QAAO;AACzE,WAAO,GAAG,MAAM,IAAI,KAAK,MAAM,OAAO,GAAG,MAAM,GAAG,GAAG;AAAA,EACvD;AACA,SAAO,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG;AACnC;AAEA,eAAe,WACb,MACA,KACA,SACA,UACA,eAAe,OACkB;AACjC,MAAI,SAAwB;AAC5B,MAAI,QAAuB;AAC3B,MAAI;AACF,UAAM,OAAO,KAAK,UAAU,SAAS,OAAO;AAC5C,UAAM,SAAS,wBAAwB,KAAK,SAAS,eAAe;AACpE,UAAM,WAAW,OAAO,KAAK,SAAS;AAAA,MACpC,SAAS;AAAA,MACT;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,cAAc;AAAA,UACd,CAAC,yBAAyB,GAAG,MAAM,oBAAoB,QAAQ,IAAI;AAAA,UACnE,CAAC,wBAAwB,GAAG,SAAS;AAAA,UACrC,CAAC,2BAA2B,GAAG,SAAS;AAAA,QAC1C;AAAA,QACA;AAAA,QACA,QAAQ,YAAY,QAAQ,mBAAmB;AAAA,MACjD;AAAA,MACA,KAAK;AAAA,MACL;AAAA,QACE,OAAO,eAAe,yBAAyB;AAAA,QAC/C,8BAA8B;AAAA,MAChC;AAAA,IACF;AACA,aAAS,SAAS;AAClB,UAAM,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AACnD,QAAI,SAAS,OAAO,UAAU,IAAK,SAAQ,QAAQ,MAAM;AAAA,EAC3D,SAAS,QAAQ;AACf,YAAQ,UAAU,MAAM;AAAA,EAC1B;AACA,SAAO,eAAe,oCAAoC;AAAA,IACxD,KAAK;AAAA,IACL;AAAA,MACE,YAAY,SAAS;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,UAAU,OAAO,cAAc;AACxC;AAUA,eAAe,yBAAyB,MAAmD;AACzF,QAAM,OAAO,KAAK,eAAe,mBAAmB,KAAK,gBAAgB;AACzE,QAAM,UAAU;AAChB,MAAI;AACF,UAAM,SAAS,MAAM,2BAA2B,KAAK,EAAE;AACvD,iCAA6B,SAAS,UAAU,YAAY,OAAO,SAAS;AAC5E,iCAA6B,SAAS,UAAU,iBAAiB,OAAO,MAAM;AAC9E,iCAA6B,SAAS,eAAe,iBAAiB,OAAO,YAAY;AACzF,QAAI,OAAO,SAAS,GAAG;AACrB,WAAK,eAAe,KAAK,2CAA2C;AAAA,QAClE,QAAQ,OAAO;AAAA,QACf,WAAW,KAAK,UAAU,OAAO,MAAM;AAAA,MACzC,CAAC;AAAA,IACH;AAAA,EACF,SAAS,OAAO;AACd,iCAA6B,SAAS,UAAU,eAAe;AAC/D,SAAK,eAAe,KAAK,qCAAqC,EAAE,OAAO,UAAU,KAAK,EAAE,CAAC;AAAA,EAC3F;AACF;AAGA,eAAsB,gCACpB,MACsC;AAItC,QAAM,yBAAyB,IAAI;AAGnC,QAAM,4BAA4B,KAAK,EAAE;AACzC,QAAM,MAAM,+BAA+B,KAAK,QAAQ;AACxD,MAAI,CAAC,IAAK,QAAO,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,EAAE;AACvD,QAAM,UAAUH,YAAW;AAC3B,QAAM,SAAS,MAAM,gCAAgC,KAAK,IAAI;AAAA,IAC5D;AAAA,IACA,OAAO;AAAA,IACP,cAAcC;AAAA,EAChB,CAAC;AAGD,QAAM,qBAAqB,MAAM,mCAAmC,KAAK,IAAI;AAAA,IAC3E;AAAA,IACA,OAAO;AAAA,IACP,cAAcA;AAAA,EAChB,CAAC;AACD,QAAM,WAAW,MAAM,QAAQ;AAAA,IAC7B;AAAA,MACE,GAAG,OAAO,IAAI,CAAC,cAAc,EAAE,UAAU,cAAc,MAAM,EAAE;AAAA,MAC/D,GAAG,mBAAmB,IAAI,CAAC,cAAc,EAAE,UAAU,cAAc,KAAK,EAAE;AAAA,IAC5E,EAAE,IAAI,OAAO,EAAE,UAAU,aAAa,MAAM;AAC1C,UAAI;AACF,eAAO,MAAM,WAAW,MAAM,KAAK,SAAS,UAAU,YAAY;AAAA,MACpE,SAAS,OAAO;AACd,aAAK,eAAe,KAAK,uCAAuC;AAAA,UAC9D,YAAY,SAAS;AAAA,UACrB,OAAO,UAAU,KAAK;AAAA,QACxB,CAAC;AACD,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,SAAS,OAAO,SAAS,mBAAmB;AAAA,IAC5C,WAAW,SAAS,OAAO,CAAC,YAAY,YAAY,WAAW,EAAE;AAAA,IACjE,QAAQ,SAAS,OAAO,CAAC,YAAY,YAAY,QAAQ,EAAE;AAAA,EAC7D;AACF;AAMO,SAAS,kCACd,MACA,UAGI,CAAC,GACgB;AACrB,QAAM,aAAa,KAAK,IAAI,KAAK,QAAQ,cAAcC,iBAAgB;AACvE,QAAM,QAAQ,QAAQ,SAAS;AAC/B,MAAI,UAAU;AACd,MAAI;AACJ,MAAI,QAAQ;AAEZ,QAAM,OAAO,MAAY;AACvB,QAAI,WAAW,QAAS;AACxB,aAAS;AAET,QAAI,UAAU;AACd,eAAW,YAAY;AACrB,YAAM,SAAS,MAAM,MAAM,IAAI;AAC/B,gBAAU,OAAO,WAAW;AAC5B,UAAI,OAAO,UAAU,EAAG,MAAK,eAAe,KAAK,mCAAmC,MAAM;AAC1F,UAAI,QAAQC,uBAAsB,GAAG;AACnC,cAAM,gCAAgC,KAAK,EAAE;AAC7C,cAAM,mCAAmC,KAAK,EAAE;AAAA,MAClD;AAAA,IACF,GAAG,EACA,MAAM,CAAC,UAAmB;AACzB,WAAK,eAAe,MAAM,qCAAqC,EAAE,OAAO,UAAU,KAAK,EAAE,CAAC;AAAA,IAC5F,CAAC,EACA,QAAQ,MAAM;AACb,gBAAU;AACV,UAAI,WAAW,CAAC,QAAS,gBAAe,IAAI;AAAA,IAC9C,CAAC;AAAA,EACL;AAEA,QAAM,QAAQ,YAAY,MAAM,UAAU;AAC1C,iBAAe,IAAI;AAEnB,SAAO,YAAY;AACjB,cAAU;AACV,kBAAc,KAAK;AACnB,UAAM;AAAA,EACR;AACF;;;AChOA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAOK;AAOA,IAAM,wCAAwC;AAC9C,IAAM,4CAA4C;AAClD,IAAM,qDAAqD,IAAI,OAAO,OAAO,KAAK;AAEzF,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB,KAAK,OAAO;AAY9B,IAAM,qCAAN,MAAyC;AAAA,EAG9C,YACmB,aACA,wBACjB;AAFiB;AACA;AAEjB,SAAK,YAAY,OAAO,OAAO;AAAA,MAC7B,MAAM,CAAC,WAAW,OAAO,KAAK,OAAO,MAAM;AAAA,MAC3C,SAAS,CAAC,QAAQ,YAAY,OAAO,KAAK,QAAQ,OAAO;AAAA,MACzD,OAAO,CAAC,WAAW,OAAO,KAAK,gBAAgB;AAAA,IACjD,CAAC;AAAA,EACH;AAAA,EAXS;AAAA,EAaT,QAAQ,SAA2B;AACjC,WAAO,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa;AAAA,EAC3C;AAAA,EAEA,QAAQ,SAAkB,QAAsE;AAC9F,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAI,IAAI,aAAa,sCAAuC,QAAO;AACnE,QAAI,QAAQ,WAAW,OAAO;AAC5B,aAAO,IAAI,SAAS,sBAAsB;AAAA,QACxC,QAAQ;AAAA,QACR,SAAS,EAAE,OAAO,MAAM;AAAA,MAC1B,CAAC;AAAA,IACH;AACA,QAAI,CAAC,KAAK,YAAa,QAAO,IAAI,SAAS,uBAAuB,EAAE,QAAQ,IAAI,CAAC;AACjF,QAAI,CAAC,gBAAgB,QAAQ,QAAQ,IAAI,wBAAwB,CAAC,GAAG;AACnE,aAAO,IAAI,SAAS,+BAA+B,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpE;AACA,UAAM,aAAa,IAAI;AAAA,MACrB,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AACA,UAAM,WAAW,OAAO,QAAQ,SAAS;AAAA,MACvC,MAAM;AAAA,MACN,SAAS;AAAA,QACP,0BAA0B;AAAA,MAC5B;AAAA,IACF,CAAC;AACD,WAAO,WAAW,SAAY,IAAI,SAAS,eAAe,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AACF;AAGO,IAAM,sCAAN,MAEP;AAAA,EAQE,YACmB,aACA,wBACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAVK,SAA+C;AAAA,EAC/C,UAA8C;AAAA,EAC9C,OAAsB,QAAQ,QAAQ;AAAA,EACtC,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,WAAW;AAAA,EAOnB,OAAO,QAA6C;AAClD,QAAI,KAAK,UAAU,KAAK,UAAU;AAChC,aAAO,MAAM,MAAM,0BAA0B;AAC7C;AAAA,IACF;AACA,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,QAAQ,SAAkD;AACxD,QAAI,KAAK,SAAU;AACnB,QAAI,OAAO,YAAY,UAAU;AAC/B,WAAK,KAAK,KAAK,eAAe;AAC9B;AAAA,IACF;AACA,UAAM,aAAa,QAAQ;AAC3B,QACE,eAAe,KACf,aAAa,sDACb,KAAK,iBAAiB,IAAI,uBAC1B,KAAK,cAAc,aAAa,kBAChC;AACA,WAAK,KAAK;AAAA,QACR,aAAa,qDACT,oBACA;AAAA,MACN;AACA;AAAA,IACF;AACA,UAAM,QACJ,mBAAmB,aAAa,WAAW,KAAK,OAAO,IAAI,IAAI,WAAW,OAAO,EAAE,MAAM;AAC3F,SAAK,kBAAkB;AACvB,SAAK,eAAe,MAAM;AAC1B,UAAM,MAAM,KAAK,KAAK,KAAK,YAAY;AACrC,UAAI;AACF,cAAM,KAAK,QAAQ,KAAK;AAAA,MAC1B,UAAE;AACA,aAAK,kBAAkB;AACvB,aAAK,eAAe,MAAM;AAAA,MAC5B;AAAA,IACF,CAAC;AACD,SAAK,OAAO,IAAI,MAAM,OAAO,UAAmB;AAC9C,YAAM,KAAK,cAAc,KAAK;AAAA,IAChC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,KAAK,OAAuD;AAChE,QAAI,KAAK,YAAY,CAAC,KAAK,QAAQ;AACjC,YAAM,IAAI,0BAA0B,UAAU,oCAAoC;AAAA,IACpF;AACA,UAAM,QAAQ,0CAA0C,KAAK;AAC7D,QAAI,MAAM,aAAa,oDAAoD;AACzE,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,EAAE,kBAAkB,KAAK;AAAA,MAC3B;AAAA,IACF;AACA,UAAM,WAAW,KAAK,OAAO,KAAK,OAAO,KAAK;AAC9C,QAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,YAAY,GAAG;AACpD,YAAM,IAAI,0BAA0B,UAAU,yCAAyC;AAAA,IACzF;AAAA,EACF;AAAA,EAEA,gBAAwB;AACtB,UAAM,WAAW,KAAK,QAAQ,oBAAoB,KAAK,KAAK,QAAQ,kBAAkB;AACtF,WAAO,OAAO,cAAc,QAAQ,KAAK,YAAY,IAAI,WAAW,OAAO;AAAA,EAC7E;AAAA,EAEA,MAAM,OAAwC;AAC5C,QAAI,KAAK,SAAU;AACnB,SAAK,WAAW;AAChB,SAAK,QAAQ,MAAM,UAAU,MAAM,MAAM,GAAG,MAAM,MAAM;AAAA,EAC1D;AAAA,EAEA,kBAAwB;AACtB,QAAI,KAAK,SAAU;AACnB,SAAK,WAAW;AAChB,SAAK,KAAK,SAAS,MAAM,iBAAiB;AAAA,EAC5C;AAAA,EAEA,MAAc,QAAQ,OAAkC;AACtD,QAAI,KAAK,SAAU;AACnB,UAAM,QAAQ,0CAA0C,KAAK;AAC7D,QAAI,CAAC,KAAK,SAAS;AACjB,UAAI,MAAM,SAAS,QAAQ;AACzB,cAAM,IAAI,0BAA0B,iBAAiB,iCAAiC;AAAA,MACxF;AACA,YAAM,UAAU,MAAM,KAAK,YAAY,SAAS;AAAA,QAC9C,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB,iBAAiB,MAAM;AAAA,QACvB,QAAQ,MAAM;AAAA,QACd,MAAM;AAAA,QACN,GAAI,KAAK,yBACL,EAAE,wBAAwB,KAAK,uBAAuB,IACtD,CAAC;AAAA,MACP,CAAC;AACD,UAAI,KAAK,UAAU;AACjB,cAAM,QAAQ,MAAM,iBAAiB;AACrC;AAAA,MACF;AACA,WAAK,UAAU;AACf,WAAK,QAAQ,OAAO,KAAK,MAAM;AAC7B,YAAI,CAAC,KAAK;AACR,eAAK,MAAM;AAAA,YACT,QAAQ;AAAA,YACR,WAAW;AAAA,YACX,kBAAkB;AAAA,UACpB,CAAC;AAAA,MACL,CAAC;AACD;AAAA,IACF;AACA,QAAI,MAAM,SAAS,QAAQ;AACzB,YAAM,IAAI,0BAA0B,iBAAiB,wBAAwB;AAAA,IAC/E;AACA,QACE,MAAM,eAAe,KAAK,QAAQ,cAClC,MAAM,gBAAgB,KAAK,QAAQ,aACnC;AACA,YAAM,IAAI,0BAA0B,eAAe,wCAAwC;AAAA,IAC7F;AACA,QAAI,MAAM,SAAS,WAAW;AAC5B,YAAM,KAAK,QAAQ,YAAY,KAAK;AACpC;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,QAAQ,aAAa,KAAK;AAAA,IACjD,SAAS,OAAO;AACd,YAAM,KAAK,KAAK;AAAA,QACd,MAAM;AAAA,QACN,iBAAiB,MAAM;AAAA,QACvB,YAAY,MAAM;AAAA,QAClB,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB,GAAG,gBAAgB,KAAK;AAAA,MAC1B,CAAC;AACD;AAAA,IACF;AAKA,UAAM,KAAK,KAAK;AAAA,MACd,MAAM;AAAA,MACN,iBAAiB,MAAM;AAAA,MACvB,YAAY,MAAM;AAAA,MAClB,aAAa,MAAM;AAAA,MACnB,aAAa,QAAQ;AAAA,IACvB,CAAC;AACD,UAAM,KAAK,KAAK;AAAA,MACd,MAAM;AAAA,MACN,iBAAiB,MAAM;AAAA,MACvB,YAAY,MAAM;AAAA,MAClB,aAAa,MAAM;AAAA,MACnB,aAAa,QAAQ;AAAA,MACrB,qBAAqB,QAAQ;AAAA,MAC7B,eAAe,QAAQ,YAAY;AAAA,MACnC,eAAe,QAAQ,YAAY;AAAA,MACnC,aAAa,QAAQ,YAAY;AAAA,MACjC,WAAW,QAAQ,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,cAAc,OAA+B;AACzD,QAAI,KAAK,SAAU;AACnB,QAAI,iBAAiB,2BAA2B;AAC9C,YAAM,KAAK,KAAK,MAAM,SAAS,mBAAmB,oBAAoB,MAAM,IAAI;AAChF;AAAA,IACF;AACA,UAAM,KAAK,KAAK,iBAAiB;AAAA,EACnC;AAAA,EAEA,MAAc,KAAK,QAA4E;AAC7F,QAAI,KAAK,SAAU;AACnB,SAAK,WAAW;AAChB,UAAM,KAAK,SAAS,MAAM,MAAM,EAAE,MAAM,MAAM,MAAS;AACvD,SAAK,QAAQ,MAAM,UAAU,UAAU,iBAAiB,GAAG,UAAU,iBAAiB;AAAA,EACxF;AACF;AAEA,SAAS,gBAAgB,OAGtB;AACD,MAAI,iBAAiB,6BAA6B;AAChD,QAAI,MAAM,SAAS,YAAa,QAAO,EAAE,MAAM,aAAa,WAAW,MAAM;AAC7E,QAAI,CAAC,mBAAmB,yBAAyB,qBAAqB,EAAE,SAAS,MAAM,IAAI,GAAG;AAC5F,aAAO,EAAE,MAAM,mBAAmB,WAAW,MAAM;AAAA,IACrD;AACA,QAAI,MAAM,SAAS,6BAA6B;AAC9C,aAAO,EAAE,MAAM,eAAe,WAAW,MAAM;AAAA,IACjD;AACA,QAAI,CAAC,sBAAsB,uBAAuB,EAAE,SAAS,MAAM,IAAI,GAAG;AACxE,aAAO,EAAE,MAAM,YAAY,WAAW,KAAK;AAAA,IAC7C;AACA,WAAO,EAAE,MAAM,YAAY,WAAW,MAAM;AAAA,EAC9C;AACA,MAAI,iBAAiB,6BAA6B,MAAM,SAAS,sBAAsB;AACrF,WAAO,EAAE,MAAM,aAAa,WAAW,MAAM;AAAA,EAC/C;AACA,SAAO,EAAE,MAAM,eAAe,WAAW,KAAK;AAChD;AAEA,SAAS,gBAAgB,OAA+B;AACtD,SACE,OACI,MAAM,GAAG,EACV,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,SAAS,yCAAyC,KAAK;AAE9D;AAEA,SAAS,UAAU,QAAwB;AACzC,MAAI,WAAW,qBAAsB,QAAO;AAC5C,MAAI,WAAW,oBAAoB,WAAW,kBAAmB,QAAO;AACxE,MAAI,WAAW,oBAAqB,QAAO;AAC3C,MAAI,WAAW,iBAAiB,WAAW,kBAAmB,QAAO;AACrE,MAAI,WAAW,SAAU,QAAO;AAChC,SAAO;AACT;;;AC5TA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKA,SAAS,wCACd,MACsE;AACtE,SAAO,OAAO,QAAQ,YAAY,aAAa,WAAW;AACxD,YAAQ,eAAe;AACvB,UAAM,YAAY,OAAO;AACzB,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,EAAE,MAAM,IAAI;AAClB,UAAM,WAAW,eAAe,SAAS,sBAAsB;AAC/D,QACE,CAAC,cAAc,MAAM,aAAa,QAAQ,KAC1C,CAAC,cAAc,MAAM,aAAa,eAAe,GACjD;AACA,aAAO;AAAA,IACT;AAEA,QAAI,MAAM,UAAU,iBAAiB,CAAC,UAAU,qBAAsB,QAAO;AAC7E,QAAI;AACF,YAAM,aAAa,cAAc,EAAE,GAAG,MAAM,IAAI,YAAY,IAAI;AAGhE,UAAI,aAAa;AACf,cAAM,yCAAyC,aAAa,OAAO,MAAM,SAAS;AAClF,gBAAQ,eAAe;AAEvB,cAAM,YAAY,QAAQ;AAAA,6BACL,mBAAmB,OAAO,MAAM,WAAW,EAAE,OAAO;AACzE,gBAAQ,eAAe;AAAA,MACzB;AACA,aAAO,MAAM,iCAAiC,YAAY,OAAO,YAAY;AAC3E,eAAO,MAAM,eAAe,WAAW,IAAI,OAAO,OAAO,OAAO,OAAO;AACrE,cAAI,UAAU,sBAAsB;AAClC,kBAAM;AAAA,cACJ;AAAA,cACA,UAAU;AAAA,cACV,EAAE,GAAG,OAAO,OAAO,WAAW,MAAM,UAAU;AAAA,cAC9C,CAAC,iBAAiB,QAAQ;AAAA,YAC5B;AACA,oBAAQ,eAAe;AAAA,UACzB,WAAW,aAAa;AAGtB,kBAAM,QAAQ,OAAO;AACrB,gBACE,MAAM,SAAS,WACd,MAAM,SAAS,aAAa,MAAM,YAAY,kBAC/C;AACA,oBAAM,GAAG,QAAQ;AAAA,qCACM,OAAO,MAAM,SAAS;AAAA,uCACpB,OAAO,MAAM,WAAW;AAAA,qCAC1B,MAAM,SAAS,YAAY;AAClD,oBAAM,OAAO,MAAM,kBAAkB,IAAI,MAAM,WAAW,OAAO,MAAM,WAAW;AAClF,kBAAI,CAAC,QAAQ,CAAC,cAAc,KAAK,aAAa,eAAe,EAAG,QAAO;AAAA,YACzE,WAAW,MAAM,SAAS,aAAa,MAAM,YAAY,WAAW;AAClE,oBAAM,GAAG,QAAQ;AAAA,qCACM,OAAO,MAAM,SAAS;AAAA,mCACxB,MAAM,UAAU,MAAM,WAAW,MAAM,CAAC;AAAA,0BACjD;AACZ,oBAAM,OAAO,MAAM,8BAA8B,IAAI;AAAA,gBACnD,GAAG,OAAO;AAAA,gBACV,UAAU,MAAM,UAAU,MAAM,WAAW,MAAM;AAAA,cACnD,CAAC;AACD,kBAAI,CAAC,QAAQ,CAAC,cAAc,KAAK,aAAa,eAAe,EAAG,QAAO;AAAA,YACzE,WAAW,MAAM,SAAS,SAAS;AACjC,oBAAM,OAAO,MAAM,WAAW,IAAI,OAAO,MAAM,aAAa,MAAM,SAAS;AAC3E,kBACE,CAAC,QACA,KAAK,6BAA6B,QACjC,CAAC,cAAc,KAAK,0BAA0B,eAAe,GAC/D;AACA,uBAAO;AAAA,cACT;AAAA,YACF,OAAO;AACL,qBAAO;AAAA,YACT;AACA,oBAAQ,eAAe;AAAA,UACzB;AAGA,gBAAM,SAAS,MAAM;AAAA,YACnB;AAAA,YACA,OAAO;AAAA,YACP,UAAU;AAAA,YACV,OAAO;AAAA,YACP,EAAE,eAAe,gBAAgB,OAAU;AAAA,UAC7C;AACA,kBAAQ,eAAe;AACvB,cAAI,CAAC,OAAQ,QAAO;AACpB,gBAAM,4BAA4B,EAAE,GAAG,YAAY,IAAI,GAAG,GAAG,OAAO;AAAA,YAClE,WAAW,UAAU;AAAA,YACrB,WAAW;AAAA,YACX,SAAS;AAAA,UACX,CAAC;AACD,kBAAQ,eAAe;AACvB,iBAAO;AAAA,QACT,CAAC;AAAA,MACH,CAAC;AAAA,IACH,QAAQ;AAGN,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACzGO,SAAS,4BACd,SACA,QACA,QACA,sBAC6B;AAC7B,QAAM,QAAQ,OAAO,KAAK,CAAC,cAAc,UAAU,QAAQ,OAAO,CAAC;AACnE,MAAI,CAAC,MAAO,QAAO,EAAE,SAAS,MAAM;AACpC,QAAM,YAAY,sBAAsB,UAAU,OAAO;AACzD,MAAI,UAAW,QAAO,EAAE,SAAS,MAAM,UAAU,6BAA6B,SAAS,EAAE;AACzF,SAAO,EAAE,SAAS,MAAM,UAAU,MAAM,QAAQ,SAAS,MAAM,EAAE;AACnE;;;AC5BA,SAAS,cAAAC,aAAY,cAAAC,mBAAkB;AACvC;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,wCAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAUK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP,SAAS,4CAA4C;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,kBAAAC;AAAA,OAIK;AACP,SAAS,kDAAkD;AAE3D;AAAA,EACE,kCAAAC;AAAA,EACA;AAAA,OAGK;;;AChEP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAOA,IAAM,oCAAN,MAAgF;AAAA,EACrF,YAA6B,KAA8C;AAA9C;AAAA,EAA+C;AAAA,EAE5E,MAAM,UACJ,OACqB;AACrB,UAAM,aAAa,KAAK,IAAI,wBAAwB;AACpD,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,uDAAuD;AACxF,UAAM,UAAU,gCAAgC,MAAM,OAAO,MAAM,UAAU;AAC7E,UAAM,eAAe,WAAW,UAAU,OAAO;AACjD,QAAI,SAAS;AACb,QAAI;AACF,YAAM,oBAAoB,UAAU;AAAA,IACtC,SAAS,OAAO;AACd,mBAAa,YAAY;AACzB,YAAM;AAAA,IACR;AACA,UAAM,YAAY;AAChB,UAAI;AACF,yBAAiB,WAAW,cAAc;AACxC,cAAI,CAAC,OAAQ;AACb,cAAI;AACF,kBAAM,OAAO,iCAAiC,QAAQ,MAAM;AAAA,cAC1D,OAAO,MAAM;AAAA,cACb,YAAY,MAAM;AAAA,YACpB,CAAC;AACD,kBAAM,OAAO;AAAA,cACX,YAAY,MAAM;AAAA,cAClB,cAAc,KAAK;AAAA,YACrB,CAAC;AAAA,UACH,QAAQ;AAAA,UAGR;AAAA,QACF;AAAA,MACF,QAAQ;AACN,YAAI,OAAQ,OAAM,YAAY;AAAA,MAChC;AAAA,IACF,GAAG;AACH,WAAO,MAAM;AACX,UAAI,CAAC,OAAQ;AACb,eAAS;AACT,mBAAa,YAAY;AAAA,IAC3B;AAAA,EACF;AACF;AAEA,eAAe,oBAAoB,YAA+C;AAChF,MAAI,CAAC,WAAW,OAAO;AACrB,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,QAAM,WAAW,MAAM;AACzB;;;AC/DA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAEP;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,8CAA8C;AACvD,SAAS,4CAA4C;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAaK;AAGP,IAAM,uBAAuB,OAAO;AAmBpC,eAAsB,2CAA0F;AAC9G,QAAM,WAAW,MAAM,gCAAgC;AACvD,QAAM,SAAU,MAAM;AAAA;AAAA,IACD,cAAc,SAAS,qBAAqB,EAAE;AAAA;AAEnE,QAAM,YAAY,OAAO,+BAA+B;AACxD,gBAAc,WAAW,QAAQ;AACjC,SAAO,OAAO,OAAO,EAAE,SAAS,WAAW,UAAU,QAAQ,OAAO,CAAC;AACvE;AAGO,IAAM,sCAAN,MAOP;AAAA,EACE,YACW,SACQ,SACjB;AAFS;AACQ;AAEjB,QAAI,QAAQ,SAAS,YAAY,QAAQ,WAAW,YAAY;AAC9D,YAAM,IAAI,MAAM,sDAAsD;AAAA,IACxE;AAAA,EACF;AAAA,EAEA,MAAM,iBACJ,SACyD;AACzD,UAAM,UAAU,MAAM,KAAK,iBAAiB,QAAQ,KAAK;AACzD,QAAI;AACF,UAAI,QAAQ,aAAa,eAAe;AACtC,YAAI,QAAQ,aAAa,cAAe,OAAM,IAAI,MAAM,0BAA0B;AAClF,cAAM,4BAA4B,QAAQ;AAAA,UACxC,QAAQ;AAAA,UACR,qCAAqC,QAAQ,kBAAkB;AAAA,QACjE;AACA,eAAO,OAAO,OAAO;AAAA,UACnB,UAAU;AAAA,UACV;AAAA,UACA,eAAe,KAAK,QAAQ;AAAA,UAC5B,oBAAoB;AAAA,QACtB,CAAC;AAAA,MACH;AACA,UAAI,QAAQ,aAAa,QAAQ,UAAU;AACzC,cAAM,IAAI,MAAM,0BAA0B;AAAA,MAC5C;AACA,YAAM,qBAAqB,QAAQ,cAAc,QAAQ,OAAO,YAAY;AAC5E,aAAO,OAAO,OAAO;AAAA,QACnB,UAAU,QAAQ;AAAA,QAClB;AAAA,QACA,oBAAoB,0BAA0B,QAAQ,UAAU,CAAC;AAAA,QACjE,eAAe,KAAK,QAAQ;AAAA,QAC5B,oBAAoB,sBAAsB,QAAQ,QAAQ;AAAA,MAC5D,CAAC;AAAA,IACH,UAAE;AACA,cAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AAAA,EAEA,MAAM,MACJ,OACgE;AAChE,UAAM,UAAU,MAAM,KAAK,iBAAiB,MAAM,KAAK;AACvD,QAAI;AACF,aAAO,WAAW,KAAK,QAAQ,MAAM,MAAM,UAAU,CAAC;AAAA,IACxD,UAAE;AACA,cAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AAAA,EAEA,MAAc,iBACZ,OACgC;AAChC,UAAM,WAAW,MAAM;AACvB,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,mDAAmD;AAClF,UAAM,gBAAgB,MAAM,qBAAqB,KAAK,SAAS,QAAQ;AACvE,UAAM,UAAU,0BAA0B,KAAK,SAAS;AAAA,MACtD,UAAU,MAAM;AAAA,MAChB,UAAU;AAAA,IACZ,CAAC;AACD,QAAI;AACF,6BAAuB,SAAS,KAAK;AACrC,uBAAiB,SAAS,KAAK;AAC/B,wBAAkB,SAAS,KAAK;AAChC,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ,QAAQ;AAChB,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,6BAA6B,OAW2B;AAC5D,mBAAe,MAAM,MAAM;AAC3B,UAAM,UAAU,4BAA4B,KAAK,SAAS;AAAA,MACxD,UAAU,MAAM;AAAA,MAChB,kBAAkB,qBAAqB,MAAM,UAAU;AAAA,IACzD,CAAC;AACD,QAAI;AACF,YAAM,WAAW,QAAQ,SAAS;AAClC,qBAAe,MAAM,MAAM;AAC3B,YAAM,WAAW,aAAa,QAAQ,SAAS,CAAC;AAChD,UAAI,aAAa,EAAG,OAAM,IAAI,MAAM,qCAAqC;AACzE,YAAM,SAAS;AAAA,QACb,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB,UAAU,MAAM;AAAA,QAChB,iBAAiB,YAAY,UAAU,MAAM,MAAM;AAAA,QACnD,mBAAmB,SAAS;AAAA,QAC5B,sBAAsB;AAAA,UACpB,UAAUC,YAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK,CAAC;AAAA,QAC/D;AAAA,QACA,WAAW,0BAA0B,QAAQ,UAAU,CAAC;AAAA,QACxD,qBAAqB;AAAA,QACrB,oBAAoB,sBAAsB,MAAM,QAAQ;AAAA,QACxD,eAAe,KAAK,QAAQ;AAAA,MAC9B;AACA,UAAI,QAAQ,aAAa,eAAe;AACtC,eAAO,OAAO,OAAO;AAAA,UACnB,GAAG;AAAA,UACH,UAAU;AAAA,UACV,uBAAuB,eAAe,QAAQ,SAAS,CAAC;AAAA,UACxD,0BAA0B;AAAA,UAC1B,kBAAkB;AAAA,QACpB,CAAC;AAAA,MACH;AACA,aAAO,OAAO,OAAO;AAAA,QACnB,GAAG;AAAA,QACH,UAAU,QAAQ;AAAA,QAClB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH,UAAE;AACA,cAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AAAA,EAEA,MAAM,wBAAwB,OAGmC;AAC/D,mBAAe,MAAM,MAAM;AAC3B,UAAM,WAAW,MAAM,MAAM;AAC7B,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,mDAAmD;AAClF,UAAM,gBAAgB,MAAM,qBAAqB,KAAK,SAAS,UAAU,MAAM,MAAM;AACrF,UAAM,UAAU,0BAA0B,KAAK,SAAS;AAAA,MACtD,UAAU,MAAM,MAAM;AAAA,MACtB,UAAU;AAAA,IACZ,CAAC;AACD,QAAI;AACF,6BAAuB,SAAS,MAAM,KAAK;AAC3C,uBAAiB,SAAS,MAAM,KAAK;AACrC,wBAAkB,SAAS,MAAM,KAAK;AACtC,qBAAe,MAAM,MAAM;AAC3B,YAAM,YAAY,QAAQ,SAAS;AACnC,YAAM,SAAS;AAAA,QACb,OAAO,MAAM,MAAM,SAAS;AAAA,QAC5B,YAAY,MAAM,MAAM,SAAS;AAAA,QACjC,UAAU,MAAM,MAAM;AAAA,QACtB,iBAAiB,YAAY,WAAW,MAAM,MAAM;AAAA,QACpD,mBAAmB,UAAU;AAAA,QAC7B,sBAAsB;AAAA,UACpB,UAAUA,YAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK,CAAC;AAAA,QAChE;AAAA,QACA,WAAW,0BAA0B,QAAQ,UAAU,CAAC;AAAA,QACxD,qBAAqB,MAAM,MAAM,SAAS;AAAA,QAC1C,oBAAoB,sBAAsB,MAAM,MAAM,QAAQ;AAAA,QAC9D,eAAe,KAAK,QAAQ;AAAA,MAC9B;AACA,UAAI,QAAQ,aAAa,eAAe;AACtC,YAAI,MAAM,MAAM,aAAa,cAAe,OAAM,IAAI,MAAM,0BAA0B;AACtF,eAAO,OAAO,OAAO;AAAA,UACnB,GAAG;AAAA,UACH,UAAU,QAAQ;AAAA,UAClB,uBAAuB,eAAe,QAAQ,SAAS,CAAC;AAAA,UACxD,0BAA0B;AAAA,UAC1B,kBAAkB;AAAA,QACpB,CAAC;AAAA,MACH;AACA,UAAI,QAAQ,aAAa,MAAM,MAAM,SAAU,OAAM,IAAI,MAAM,0BAA0B;AACzF,aAAO,OAAO,OAAO;AAAA,QACnB,GAAG;AAAA,QACH,UAAU,QAAQ;AAAA,QAClB,gBAAgB,aAAa,QAAQ,SAAS,CAAC;AAAA,MACjD,CAAC;AAAA,IACH,UAAE;AACA,cAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AAAA,EAEA,MAAM,qBACJ,OACuD;AACvD,mBAAe,MAAM,MAAM;AAC3B,UAAM,QAAQ,MAAM;AAAA,MAClB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,UAAM,UAAU,0BAA0B,KAAK,SAAS;AAAA,MACtD,UAAU,MAAM;AAAA,MAChB,UAAU;AAAA,IACZ,CAAC;AACD,QAAI;AACF,YAAM,YAAY,QAAQ,SAAS;AACnC,UAAI,CAAC,WAAW,WAAW,KAAK,EAAG,OAAM,IAAI,MAAM,kCAAkC;AACrF,YAAM,WAAW,MAAM;AACvB,UAAI,SAAS,aAAa,QAAQ,SAAU,OAAM,IAAI,MAAM,4BAA4B;AACxF,YAAM,sBAAsB,SAAS;AACrC,YAAM,YAAY,0BAA0B,QAAQ,UAAU,CAAC;AAC/D,UAAI,cAAc,SAAS,UAAW,OAAM,IAAI,MAAM,8BAA8B;AACpF,YAAM,uBAAuB;AAAA,QAC3B,UAAUA,YAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK,CAAC;AAAA,MAChE;AACA,UAAI,QAAQ,aAAa,eAAe;AACtC,cAAM,wBAAwB,eAAe,QAAQ,SAAS,CAAC;AAC/D,YACE,SAAS,aAAa,iBACtB,CAAC,qBAAqB,uBAAuB,SAAS,qBAAqB,GAC3E;AACA,gBAAM,IAAI,MAAM,mCAAmC;AAAA,QACrD;AACA,YAAI,MAAM,cAAc,MAAM,WAAW,aAAa,eAAe;AACnE,gBAAM,IAAI,MAAM,0BAA0B;AAAA,QAC5C;AACA,cAAMC,kBAAiB,MAAM,aACzB,MAAM,sBAAsB,SAAS,MAAM,YAAY,MAAM,MAAM,IACnE;AACJ,eAAO,OAAO,OAAO;AAAA,UACnB,UAAU;AAAA,UACV,2BAA2B;AAAA,UAC3B,OAAO,MAAM;AAAA,UACb,YAAY,MAAM;AAAA,UAClB,mBAAmB,UAAU;AAAA,UAC7B;AAAA,UACA;AAAA,UACA;AAAA,UACA,oBAAoB;AAAA,UACpB,eAAe,KAAK,QAAQ;AAAA,UAC5B,uBAAuB;AAAA,UACvB;AAAA,UACA,0BAA0B;AAAA,UAC1B,kBAAkB;AAAA,UAClB,GAAIA,kBAAiB,EAAE,gBAAAA,gBAAe,IAAI,CAAC;AAAA,QAC7C,CAAC;AAAA,MACH;AACA,UAAI,SAAS,aAAa,cAAe,OAAM,IAAI,MAAM,4BAA4B;AACrF,YAAM,iBAAiB,aAAa,QAAQ,SAAS,CAAC;AACtD,UAAI,mBAAmB,SAAS,gBAAgB;AAC9C,cAAM,IAAI,MAAM,mCAAmC;AAAA,MACrD;AACA,UAAI,MAAM,cAAc,MAAM,WAAW,aAAa,eAAe;AACnE,cAAM,IAAI,MAAM,0BAA0B;AAAA,MAC5C;AACA,YAAM,iBAAiB,MAAM,aACzB,MAAM,qBAAqB,SAAS,MAAM,YAAY,MAAM,MAAM,IAClE;AACJ,aAAO,OAAO,OAAO;AAAA,QACnB,UAAU,QAAQ;AAAA,QAClB,2BAA2B;AAAA,QAC3B,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB,mBAAmB,UAAU;AAAA,QAC7B;AAAA,QACA;AAAA,QACA;AAAA,QACA,oBAAoB,sBAAsB,QAAQ,QAAQ;AAAA,QAC1D,eAAe,KAAK,QAAQ;AAAA,QAC5B;AAAA,QACA,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,MAC7C,CAAC;AAAA,IACH,UAAE;AACA,cAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,UAA8D;AAC3F,MAAI,aAAa,cAAe,QAAO;AACvC,SAAO,aAAa,aAChB,yCACA;AACN;AAEA,SAAS,cACP,WACA,UAC4C;AAC5C,MAAI,OAAO,cAAc,YAAY,cAAc,MAAM;AACvD,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,QAAM,UAAU;AAChB,MACE,QAAQ,SAAS,YACjB,QAAQ,WAAW,cACnB,QAAQ,WAAW,SAAS,UAC5B,QAAQ,kBAAkB,SAAS,OAAO,iBAC1C,OAAO,QAAQ,+BAA+B,cAC9C,OAAO,QAAQ,6BAA6B,cAC5C,OAAO,QAAQ,0BAA0B,cACzC,OAAO,QAAQ,wBAAwB,cACvC,OAAO,QAAQ,8BAA8B,cAC7C,OAAO,QAAQ,4BAA4B,YAC3C;AACA,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACF;AAEA,SAAS,uBACP,SACA,OACM;AACN,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,YAAY,QAAQ,aAAa,MAAM;AAC1C,UAAM,IAAI,MAAM,4BAA4B;AAC9C,MAAI,QAAQ,UAAU,MAAM,SAAS,WAAW;AAC9C,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,MAAI,MAAM,aAAa,eAAe;AACpC,QACE,QAAQ,aAAa,iBACrB,SAAS,aAAa,iBACtB,CAAC,qBAAqB,eAAe,QAAQ,SAAS,CAAC,GAAG,SAAS,qBAAqB,GACxF;AACA,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AAAA,EACF,WACE,QAAQ,aAAa,iBACrB,SAAS,aAAa,iBACtB,aAAa,QAAQ,SAAS,CAAC,MAAM,SAAS,kBAC9C,MAAM,uBAAuB,SAAS,gBACtC;AACA,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACF;AAEA,SAAS,iBACP,SACA,OACM;AACN,MAAI,MAAM,aAAa,eAAe;AACpC,QAAI,QAAQ,aAAa,cAAe,OAAM,IAAI,MAAM,0BAA0B;AAClF,eAAW,eAAe,MAAM,0BAA0B;AACxD,YAAM,sBAAsB,aAAa,QAAQ,SAAS,CAAC;AAC3D,UAAI,QAAQ,UAAU,MAAM,YAAY,gBAAgB;AACtD,cAAM,IAAI,MAAM,yCAAyC;AAAA,MAC3D;AACA,cAAQ,eAAe,YAAY,yBAAyB;AAC5D,UACE,aAAa,QAAQ,SAAS,CAAC,MAAM,sBAAsB,KAC3D,QAAQ,UAAU,MAAM,YAAY,aACpC,CAAC;AAAA,QACC,eAAe,QAAQ,SAAS,CAAC;AAAA,QACjC,YAAY;AAAA,MACd,GACA;AACA,cAAM,IAAI,MAAM,oCAAoC;AAAA,MACtD;AAAA,IACF;AACA;AAAA,EACF;AACA,MAAI,QAAQ,aAAa,MAAM,UAAU;AACvC,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AACA,aAAW,eAAe,MAAM,0BAA0B;AACxD,QACE,QAAQ,UAAU,MAAM,YAAY,kBACpC,aAAa,QAAQ,SAAS,CAAC,MAAM,YAAY,qBACjD;AACA,YAAM,IAAI,MAAM,wCAAwC;AAAA,IAC1D;AACA,UAAM,SAAS;AAAA,MACb,YAAY;AAAA,MACZ,MAAM;AAAA,IACR;AACA,UAAM,SAAS,qCAAqC,OAAO,WAAW;AACtE,UAAM,UAAU,QAAQ,cAAc,OAAO,YAAY;AACzD,QACE,CAAC,WAAW,SAAS,OAAO,kBAAkB,KAC9C,CAAC,WAAW,SAAS,YAAY,kBAAkB,KACnD,aAAa,QAAQ,SAAS,CAAC,MAAM,YAAY,kBACjD,QAAQ,UAAU,MAAM,YAAY,WACpC;AACA,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAAA,EACF;AACF;AAEA,SAAS,kBACP,SACA,OACM;AACN,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,0CAA0C;AACzE,MAAI,kBAAkB,SAAS;AAC/B,aAAW,eAAe,MAAM,0BAA0B;AACxD,QAAI,YAAY,kBAAkB,kBAAkB,GAAG;AACrD,YAAM,IAAI,MAAM,kDAAkD;AAAA,IACpE;AACA,sBAAkB,YAAY;AAAA,EAChC;AACA,MACE,QAAQ,aAAa,MAAM,YAC3B,oBAAoB,MAAM,SAAS,gBACnC,QAAQ,UAAU,MAAM,MAAM,SAAS,WACvC;AACA,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,MACE,MAAM,aAAa,kBAClB,QAAQ,aAAa,iBACpB,CAAC,qBAAqB,eAAe,QAAQ,SAAS,CAAC,GAAG,MAAM,SAAS,cAAc,IACzF;AACA,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,MAAI,MAAM,aAAa,eAAe;AACpC,UAAM,yBACJ,MAAM,yBAAyB,GAAG,EAAE,GAAG,kBAAkB,MAAM;AACjE,QAAI,aAAa,QAAQ,SAAS,CAAC,MAAM,wBAAwB;AAC/D,YAAM,IAAI,MAAM,kEAAkE;AAAA,IACpF;AAAA,EACF;AACF;AAEA,eAAe,sBACb,SACA,MACA,QAOA;AACA,MAAI,WAAW,KAAK;AACpB,mBAAiB,WAAW,KAAK,UAAU;AACzC,mBAAe,MAAM;AACrB,QAAI,QAAQ,kBAAkB,WAAW,EAAG,OAAM,IAAI,MAAM,qBAAqB;AACjF,QAAI,QAAQ,aAAa,cAAe,OAAM,IAAI,MAAM,kCAAkC;AAC1F,YAAQ,eAAe,QAAQ,KAAK;AACpC,eAAW,QAAQ;AAAA,EACrB;AACA,MAAI,aAAa,KAAK,sBAAsB,QAAQ,UAAU,MAAM,KAAK,iBAAiB;AACxF,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AACA,QAAM,iBAAiB,eAAe,QAAQ,SAAS,CAAC;AACxD,MAAI,CAAC,qBAAqB,gBAAgB,KAAK,oBAAoB,GAAG;AACpE,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AACA,SAAO,OAAO,OAAO;AAAA,IACnB,cAAc;AAAA,IACd;AAAA,IACA,WAAW,0BAA0B,QAAQ,UAAU,CAAC;AAAA,EAC1D,CAAC;AACH;AAEA,eAAe,qBACb,SACA,MACA,QAOA;AACA,MAAI,QAAQ,aAAa,KAAK,SAAU,OAAM,IAAI,MAAM,0BAA0B;AAClF,MAAI,WAAW,KAAK;AACpB,mBAAiB,WAAW,KAAK,UAAU;AACzC,mBAAe,MAAM;AACrB,QAAI,QAAQ,kBAAkB,WAAW,KAAK,QAAQ,aAAa,QAAQ,UAAU;AACnF,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,UAAM,SAAS,uCAAuC,QAAQ,OAAO,QAAQ,QAAQ;AACrF,UAAM,SAAS,qCAAqC,OAAO,WAAW;AACtE,UAAM,UAAU,QAAQ,cAAc,OAAO,YAAY;AACzD,QAAI,CAAC,WAAW,SAAS,OAAO,kBAAkB,EAAG,OAAM,IAAI,MAAM,yBAAyB;AAC9F,eAAW,QAAQ;AAAA,EACrB;AACA,MAAI,aAAa,KAAK,sBAAsB,QAAQ,UAAU,MAAM,KAAK,iBAAiB;AACxF,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AACA,MAAI,aAAa,QAAQ,SAAS,CAAC,MAAM,KAAK,sBAAsB;AAClE,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,SAAO,OAAO,OAAO;AAAA,IACnB,cAAc;AAAA,IACd,gBAAgB,KAAK;AAAA,IACrB,WAAW,0BAA0B,QAAQ,UAAU,CAAC;AAAA,EAC1D,CAAC;AACH;AAEA,SAAS,eAAe,OAAsE;AAC5F,SAAO;AAAA,IACL,qCAAqC,KAAK,EAAE,IAAI,CAAC,WAAW;AAAA,MAC1D,WAAW,0BAA0B,MAAM,SAAS;AAAA,MACpD,SAAS,MAAM;AAAA,IACjB,EAAE;AAAA,EACJ;AACF;AAEA,eAAe,qBACb,SACA,UACA,QACqB;AACrB,QAAM,SAAS,MAAM,QAAQ,KAAK;AAAA,IAChC,iBAAiB,SAAS;AAAA,IAC1B,UAAU;AAAA,IACV,kBAAkB,SAAS;AAAA,IAC3B,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,EAC7B,CAAC;AACD,MAAI;AACF,QAAI,OAAO,gBAAgB,UAAa,OAAO,gBAAgB,SAAS,UAAU;AAChF,YAAM,IAAI,MAAM,gCAAgC;AAAA,IAClD;AACA,UAAM,QAAQ,MAAM;AAAA,MAClB,OAAO,OAAO,SAAS,EAAE,OAAO,IAAI,CAAC,CAAC;AAAA,MACtC,SAAS;AAAA,MACT;AAAA,IACF;AACA,UAAM,cAAc,UAAUD,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AAC9E,QAAI,gBAAgB,SAAS,YAAa,OAAM,IAAI,MAAM,gCAAgC;AAC1F,UAAM,OAAO,gBAAgB,MAAM;AACnC,WAAO;AAAA,EACT,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAEA,eAAe,aACb,QACA,eACA,QACqB;AACrB,MAAI,CAAC,OAAO,cAAc,aAAa,KAAK,iBAAiB,GAAG;AAC9D,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,QAAM,SAAS,IAAI,WAAW,aAAa;AAC3C,MAAI,SAAS;AACb,mBAAiB,SAAS,QAAQ;AAChC,mBAAe,MAAM;AACrB,QAAI,EAAE,iBAAiB,eAAe,MAAM,eAAe,GAAG;AAC5D,YAAM,IAAI,MAAM,8BAA8B;AAAA,IAChD;AACA,QAAI,SAAS,MAAM,aAAa,OAAO,YAAY;AACjD,YAAM,IAAI,MAAM,2CAA2C;AAAA,IAC7D;AACA,WAAO,IAAI,OAAO,MAAM;AACxB,cAAU,MAAM;AAAA,EAClB;AACA,iBAAe,MAAM;AACrB,MAAI,WAAW,OAAO,WAAY,OAAM,IAAI,MAAM,8BAA8B;AAChF,SAAO;AACT;AAEA,gBAAgB,YAAY,OAAmB,QAAiD;AAC9F,WAAS,SAAS,GAAG,SAAS,MAAM,YAAY,UAAU,sBAAsB;AAC9E,mBAAe,MAAM;AACrB,UAAM,MAAM,SAAS,QAAQ,KAAK,IAAI,MAAM,YAAY,SAAS,oBAAoB,CAAC;AAAA,EACxF;AACF;AAEA,SAAS,qBAAqB,YAA4B;AACxD,QAAM,SAASA,YAAW,QAAQ,EAAE,OAAO,UAAU,EAAE,OAAO;AAC9D,MAAI,QAAQ;AACZ,WAAS,QAAQ,GAAG,QAAQ,GAAG,SAAS,EAAG,SAAS,SAAS,KAAM,OAAO,OAAO,KAAK,CAAE;AACxF,SAAO,UAAU,KAAK,KAAK;AAC7B;AAEA,SAAS,aAAa,OAAuB;AAC3C,MAAI,QAAQ,MAAM,QAAQ,OAAO,OAAO,gBAAgB,GAAG;AACzD,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,WAAW,MAAkB,OAA4B;AAChE,MAAI,KAAK,eAAe,MAAM,WAAY,QAAO;AACjD,MAAI,aAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,KAAK,YAAY,SAAS,GAAG;AACvD,kBAAc,KAAK,KAAK,IAAK,MAAM,KAAK;AAAA,EAC1C;AACA,SAAO,eAAe;AACxB;AAEA,SAAS,eAAe,QAAuC;AAC7D,MAAI,QAAQ,QAAS,OAAM,IAAI,MAAM,kDAAkD;AACzF;;;AC7pBA,SAAS,cAAAE,mBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE,wCAAAC;AAAA,EACA;AAAA,EACA,kCAAAC;AAAA,EACA,+BAAAC;AAAA,EACA,6BAAAC;AAAA,EACA,6BAAAC;AAAA,EACA;AAAA,OAKK;AACP,SAAS,4CAA4C;AACrD,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EAEA;AAAA,OAEK;AAIP,IAAM,gBAAgB;AAcf,IAAM,sCAAN,MAAsF;AAAA,EAI3F,YAA6B,cAA+D;AAA/D;AAC3B,SAAK,YAAY,aAAa,aAAa;AAC3C,SAAK,gCACH,aAAa,iCAAiC;AAAA,EAClD;AAAA,EAPiB;AAAA,EACA;AAAA,EAQjB,MAAM,QACJ,OACyD;AACzD,IAAAC,gBAAe,MAAM,MAAM;AAC3B,UAAM,YAAY,MAAM,KAAK;AAAA,MAC3B,KAAK,aAAa;AAAA,MAClB,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,UAAM,CAAC,IAAI,IAAI,MAAM,KAAK,UAAU,KAAK,aAAa,IAAI;AAAA,MACxD,WAAW,MAAM,MAAM;AAAA,MACvB,aAAa,MAAM,MAAM;AAAA,MACzB;AAAA,MACA,SAAS,CAAC,MAAM,MAAM;AAAA,IACxB,CAAC;AACD,QAAI,CAAC,QAAQ,KAAK,WAAW,SAAS;AACpC,YAAM,IAAI,kCAAkC,gBAAgB;AAAA,IAC9D;AACA,UAAM,mBAAmB,eAAe,MAAM,QAAQ;AACtD,QACE,KAAK,gBAAgB,oBACrB,CAAC,sBAAsB,KAAK,UAAU,MAAM,QAAQ,KACpD,CAAC,OAAO,cAAc,KAAK,SAAS,KACpC,KAAK,YAAY,KACjB,KAAK,YAAY,+CACjB,OAAO,KAAK,WAAW,YACvB,CAAC,kBAAkB,KAAK,KAAK,MAAM,GACnC;AACA,YAAM,IAAI,kCAAkC,gBAAgB;AAAA,IAC9D;AACA,UAAM,cAAc,MAAM;AAAA,MACxB,KAAK,aAAa;AAAA,MAClB;AAAA,MACA,MAAM;AAAA,IACR;AACA,UAAM,WAAW,MAAM,oBAAoB;AAAA,MACzC,SAAS,KAAK,aAAa;AAAA,MAC3B,UAAU,MAAM;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,UAAU;AAAA,MACV,OAAO;AAAA,MACP,SAAS,KAAK,aAAa,iBAAiB;AAAA,IAC9C,CAAC;AACD,UAAM,iBAAiB,MAAM,KAAK,aAAa,cAAc,MAAM;AAAA,MACjE,QAAQ,WAAW,WAAW;AAAA,MAC9B,aAAa;AAAA,MACb,UAAU;AAAA,MACV,kBAAkB,SAAS,OAAO;AAAA,MAClC,qBAAqB,SAAS,OAAO;AAAA,MACrC,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IACjD,CAAC;AACD,UAAM,mBAAmB,MAAM,KAAK,aAAa,gBAAgB,MAAM;AAAA,MACrE,QAAQ,WAAW,SAAS,SAAS,KAAK;AAAA,MAC1C,aAAa;AAAA,MACb,UAAUL;AAAA,MACV,kBAAkB,SAAS,SAAS;AAAA,MACpC,qBAAqB,SAAS,SAAS;AAAA,MACvC,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IACjD,CAAC;AACD,UAAM,SAAS;AAAA,MACb,UAAU,SAAS,SAAS;AAAA,MAC5B,eAAe,iBAAiB;AAAA,MAChC,UAAU,SAAS,SAAS;AAAA,MAC5B,aAAaE,6BAA4B,SAAS,SAAS,WAAW;AAAA,MACtE,UAAU;AAAA,MACV,qBAAqB;AAAA,MACrB,WAAWE,2BAA0B,SAAS,SAAS,SAAS;AAAA,MAChE,oBAAoB,SAAS,SAAS;AAAA,MACtC,eAAe,SAAS,SAAS;AAAA,IACnC;AACA,WAAO,OAAO,OAAO;AAAA,MACnB,gBAAgB,OAAO,OAAO;AAAA,QAC5B,QAAQ,KAAK;AAAA,QACb,eAAe,eAAe;AAAA,QAC9B,UAAU,SAAS,OAAO;AAAA,QAC1B,aAAaF,6BAA4B,SAAS,OAAO,WAAW;AAAA,QACpE,UAAU;AAAA,MACZ,CAAC;AAAA,MACD,UACE,SAAS,SAAS,aAAa,gBAC3B,OAAO,OAAO;AAAA,QACZ,GAAG;AAAA,QACH,UAAU;AAAA,QACV,uBAAuBD;AAAA,UACrB,SAAS,SAAS,sBAAsB,IAAI,CAAC,WAAW;AAAA,YACtD,WAAWE,2BAA0B,MAAM,SAAS;AAAA,YACpD,SAAS,MAAM;AAAA,UACjB,EAAE;AAAA,QACJ;AAAA,QACA,0BAA0B,SAAS,SAAS;AAAA,QAC5C,kBAAkB,SAAS,SAAS;AAAA,MACtC,CAAC,IACD,OAAO,OAAO;AAAA,QACZ,GAAG;AAAA,QACH,UAAU,SAAS,SAAS;AAAA,QAC5B,gBAAgB,SAAS,SAAS;AAAA,MACpC,CAAC;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,eAAe,oBAAoB,OAOhC;AACD,MAAI;AACF,WAAO,MAAM,MAAM,QAAQ;AAAA,MACzB,QAAQ,MAAM,QAAQ;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM;AAAA,MAChB,OAAO,MAAM;AAAA,MACb,uBAAuB,MAAM,QAAQ,SAAS;AAAA,MAC9C,uBAAuB,MAAM,QAAQ,QAAQ;AAAA,IAC/C,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,sCAAsC;AACzD,YAAM,IAAI,kCAAkC,qBAAqB;AAAA,IACnE;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,eAAe,UAA4D;AAClF,MAAI,aAAa,eAAe;AAC9B,WAAO;AAAA,EACT;AACA,MAAI,aAAa,YAAY;AAC3B,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,UAAkB,UAA6C;AAC5F,QAAM,YACJ,aAAa,gBAAgB,UAAU,aAAa,aAAa,UAAU;AAC7E,SAAO,SAAS,YAAY,EAAE,SAAS,SAAS;AAClD;AAEA,eAAe,0BACb,SACA,MACA,QACqB;AACrB,EAAAE,gBAAe,MAAM;AACrB,QAAM,SAAS,MAAM,kBAAkB,YAAY;AACjD,QAAI;AACF,aAAO,MAAM,QAAQ,SAAS,IAAI;AAAA,IACpC,SAAS,OAAO;AACd,UAAI,OAAO,QAAQ,eAAe,cAAc,CAAE,MAAM,QAAQ,WAAW,IAAI,GAAI;AACjF,eAAO;AAAA,MACT;AACA,YAAM;AAAA,IACR;AAAA,EACF,CAAC;AACD,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,kCAAkC,gBAAgB;AAAA,EAC9D;AACA,MACE,OAAO,kBAAkB,KAAK,aAC9B,OAAO,gBAAgB,KAAK,eAC5B,OAAO,UAAU,WAAW,KAAK,UACjC,OAAO,OAAO,iBAAiB,YAC/B,OAAO,aAAa,SAAS,GAC7B;AACA,UAAM,IAAI,kCAAkC,gBAAgB;AAAA,EAC9D;AACA,QAAM,QAAQ,IAAI,WAAW,KAAK,SAAS;AAC3C,QAAM,SAASN,YAAW,QAAQ;AAClC,WAAS,QAAQ,GAAG,QAAQ,KAAK,WAAW,SAAS,gCAAgC;AACnF,IAAAM,gBAAe,MAAM;AACrB,UAAM,MAAM,KAAK,IAAI,KAAK,WAAW,QAAQ,8BAA8B,IAAI;AAC/E,UAAM,QAAQ,MAAM,kBAAkB,YAAY,QAAQ,aAAa,MAAM,EAAE,OAAO,IAAI,CAAC,CAAC;AAC5F,QAAI,CAAC,SAAS,MAAM,eAAe,MAAM,QAAQ,GAAG;AAClD,YAAM,IAAI,kCAAkC,gBAAgB;AAAA,IAC9D;AACA,UAAM,IAAI,OAAO,KAAK;AACtB,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,QAAM,QAAQ,MAAM,kBAAkB,YAAY;AAChD,QAAI;AACF,aAAO,MAAM,QAAQ,SAAS,IAAI;AAAA,IACpC,SAAS,OAAO;AACd,UAAI,OAAO,QAAQ,eAAe,cAAc,CAAE,MAAM,QAAQ,WAAW,IAAI,GAAI;AACjF,eAAO;AAAA,MACT;AACA,YAAM;AAAA,IACR;AAAA,EACF,CAAC;AACD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,kCAAkC,gBAAgB;AAAA,EAC9D;AACA,QAAM,SAAS,OAAO,OAAO,KAAK;AAClC,MACE,MAAM,kBAAkB,OAAO,iBAC/B,MAAM,gBAAgB,OAAO,eAC7B,MAAM,UAAU,WAAW,OAAO,UAAU,UAC5C,MAAM,iBAAiB,OAAO,gBAC9B,WAAW,KAAK,QAChB;AACA,UAAM,IAAI,kCAAkC,gBAAgB;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,eAAsB,uCACpB,IACA,OACA,OACwB;AACxB,MAAI,MAAM,SAAS,QAAS,QAAO,MAAM;AACzC,QAAM,gBAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,MACE,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,aAAa,CAAC;AAAA,MACd,eAAe;AAAA,MACf,UAAU;AAAA,QACR,WAAW,MAAM;AAAA,QACjB,QAAQ,MAAM;AAAA,QACd,WAAW,MAAM;AAAA,QACjB,qBAAqB,MAAM;AAAA,MAC7B;AAAA,IACF;AAAA,IACA,MAAM;AAAA,EACR;AACA,SAAO,cAAc;AACvB;AAEA,gBAAgB,WAAW,OAA8C;AACvE,WAAS,SAAS,GAAG,SAAS,MAAM,YAAY,UAAU,gCAAgC;AACxF,UAAM,MAAM,SAAS,QAAQ,SAAS,8BAA8B;AAAA,EACtE;AACF;AAEA,SAASA,gBAAe,QAA4B;AAClD,MAAI,QAAQ,QAAS,OAAM,OAAO,UAAU,IAAI,MAAM,yBAAyB;AACjF;;;ACzSA,SAAS,cAAAC,mBAAkB;AAM3B,SAAS,oBAAoB,qCAAoD;AACjF,SAAS,qBAAAC,0BAA8D;AAEvE,IAAM,uBAAuB,KAAK;AAClC,IAAM,eAAe;AAed,IAAM,uCAAN,MAA6F;AAAA,EAKlG,YAA6B,cAAgE;AAAhE;AAC3B,SAAK,MAAM,aAAa,QAAQ,MAAM,oBAAI,KAAK;AAC/C,SAAK,cAAc,aAAa,eAAe;AAC/C,SAAK,eAAe,aAAa,gBAAgB;AAAA,EACnD;AAAA,EARiB;AAAA,EACA;AAAA,EACA;AAAA,EAQjB,MAAM,0BACJ,OACiF;AACjF,IAAAC,gBAAe,MAAM,MAAM;AAC3B,UAAM,UAAU,KAAK,aAAa;AAClC,QAAI,CAAC,QAAQ,cAAc,CAAC,QAAQ,yBAAyB;AAC3D,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,UAAM,WAAW,MAAM,KAAK,aAAa,eAAe,4BAA4B;AAAA,MAClF,OAAO,MAAM;AAAA,MACb,OAAO,MAAM;AAAA,MACb,YAAY,MAAM,SAAS;AAAA,MAC3B,OAAO,MAAM;AAAA,MACb,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IACjD,CAAC;AACD,QAAI;AACF,YAAM,SAAS,YAAY,SAAS,WAAW;AAC/C,YAAM,WAAW,eAAe,MAAM,UAAU,SAAS,MAAM;AAC/D,YAAM,SAAS;AAAA,QACb,iCAAiC,MAAM,MAAM,WAAW,IAAI,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,IAAI,MAAM,KAAK;AAAA,MACjH;AACA,YAAM,WAAW;AAAA,QACf,mCAAmC,MAAM,MAAM,WAAW,IAAI,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,IAAI,MAAM,KAAK;AAAA,MACnH;AACA,YAAM,eAAe,YAAY,MAAM,SAAS,EAAE,IAAI,MAAM,KAAK,IAAI,SAAS,MAAM;AACpF,YAAM,YAAY,cAAc,MAAM,MAAM,WAAW,UAAU,MAAM,qBAAqB,YAAY;AACxG,YAAM,WAAW,MAAM,KAAK,YAAY,KAAK,aAAa,IAAI;AAAA,QAC5D,WAAW,MAAM,MAAM;AAAA,QACvB,aAAa,MAAM,MAAM;AAAA,QACzB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,SAAS;AAAA,QACtB,WAAW,SAAS;AAAA,QACpB;AAAA,QACA,QAAQ,QAAQ;AAAA,QAChB;AAAA,QACA,WAAW,IAAI,KAAK,KAAK,IAAI,EAAE,QAAQ,IAAI,oBAAoB;AAAA,MACjE,CAAC;AAED,UAAI,OAAO,SAAS;AACpB,UAAI,KAAK,WAAW,SAAS;AAC3B,cAAM,WAAW,MAAM,QAAQ,WAAW,SAAS;AACnD,YAAI,UAAU;AACZ,6BAAmB,UAAU,SAAS,UAAU,SAAS,UAAU,MAAM;AAAA,QAC3E,OAAO;AACL,gBAAM,UAAU,MAAM,QAAQ,wBAAwB;AAAA,YACpD,KAAK;AAAA,YACL,aAAa,SAAS;AAAA,YACtB,QAAQ,SAAS,OAAO,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC,CAAC;AAAA,YACpE,UAAU,SAAS;AAAA,YACnB;AAAA,YACA,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,UACjD,CAAC;AACD,cAAI,CAAC,SAAS;AACZ,kBAAM;AAAA,cACJ;AAAA,cACA;AAAA,cACA,SAAS;AAAA,cACT,SAAS;AAAA,cACT;AAAA,cACA,MAAM;AAAA,YACR;AAAA,UACF;AAAA,QACF;AACA,cAAM,SAAS,gBAAgB,MAAM,MAAM;AAC3C,QAAAA,gBAAe,MAAM,MAAM;AAC3B,eAAO,MAAM,KAAK,aAAa,KAAK,aAAa,IAAI,MAAM,MAAM,aAAa,QAAQ;AAAA,MACxF,OAAO;AACL,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,SAAS;AAAA,UACT;AAAA,UACA,MAAM;AAAA,QACR;AACA,cAAM,SAAS,gBAAgB,MAAM,MAAM;AAAA,MAC7C;AACA,UACE,KAAK,OAAO,UACZ,KAAK,WAAW,WAChB,KAAK,aAAa,YAClB,KAAK,gBAAgB,SAAS,YAC9B,KAAK,cAAc,SAAS,YAC5B,KAAK,WAAW,QAChB;AACA,cAAM,IAAI,MAAM,4DAA4D;AAAA,MAC9E;AAEA,aAAO,OAAO,OAAO;AAAA,QACnB,QAAQ,KAAK;AAAA,QACb,UAAU,KAAK;AAAA,QACf,aAAa,KAAK;AAAA,QAClB,WAAW,KAAK;AAAA,QAChB;AAAA,QACA,YAAY,MAAM,SAAS;AAAA,QAC3B,WAAW,MAAM;AAAA,QACjB,sBAAsB,MAAM;AAAA,QAC5B,oBAAoB,MAAM;AAAA,QAC1B,iBAAiB,MAAM;AAAA,MACzB,CAAC;AAAA,IACH,UAAE;AACA,YAAM,SAAS,MAAM;AAAA,IACvB;AAAA,EACF;AACF;AAEA,eAAe,oBACb,SACA,WACA,UACA,aACA,QACA,QACe;AACf,QAAM,OAAO,MAAMD;AAAA,IACjB,YAAY,MAAM,QAAQ,WAAY,SAAS;AAAA,IAC/C,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,EACzB;AACA,qBAAmB,MAAM,UAAU,aAAa,MAAM;AACxD;AAEA,SAAS,mBACP,MACA,UACA,aACA,QACM;AACN,MACE,CAAC,QACD,KAAK,kBAAkB,YACvB,KAAK,gBAAgB,eACrB,KAAK,UAAU,WAAW,UAC1B,OAAO,KAAK,iBAAiB,YAC7B,KAAK,aAAa,SAAS,GAC3B;AACA,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACF;AAEA,SAAS,eAAe,OAAe,QAAwB;AAC7D,QAAM,oBAAoB,IAAI,MAAM;AACpC,QAAM,aAAa,MAChB,UAAU,MAAM,EAChB,QAAQ,sCAAsC,GAAG,EACjD,QAAQ,SAAS,GAAG,EACpB,KAAK,EACL,MAAM,GAAG,GAAG;AACf,QAAM,OAAO,WAAW,YAAY,EAAE,SAAS,iBAAiB,IAC5D,WAAW,MAAM,GAAG,CAAC,kBAAkB,MAAM,IAC7C;AACJ,SAAO,GAAG,KAAK,QAAQ,WAAW,EAAE,EAAE,MAAM,GAAG,GAAG,KAAK,UAAU,GAAG,iBAAiB;AACvF;AAEA,SAAS,YAAY,OAAuB;AAC1C,QAAM,QAAQ,2BAA2B,KAAK,KAAK;AACnD,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,+CAA+C;AAC3E,SAAO,MAAM,CAAC;AAChB;AAEA,SAAS,kBAAkB,MAAsB;AAC/C,QAAM,QAAQD,YAAW,QAAQ,EAAE,OAAO,MAAM,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE;AAC/E,QAAM,CAAC,KAAM,MAAM,CAAC,KAAK,KAAK,KAAQ;AACtC,QAAM,CAAC,KAAM,MAAM,CAAC,KAAK,KAAK,KAAQ;AACtC,QAAM,MAAM,MAAM,SAAS,KAAK;AAChC,QAAM,QAAQ,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AAC/G,MAAI,CAAC,aAAa,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,8CAA8C;AAC7F,SAAO;AACT;AAEA,SAASE,gBAAe,QAA4B;AAClD,MAAI,QAAQ,QAAS,OAAM,OAAO,UAAU,IAAI,MAAM,yBAAyB;AACjF;;;AJzIA,IAAM,uBAAuB;AAC7B,IAAM,oBAAoB;AAgB1B,eAAsB,4CAA4C,OAIf;AACjD,QAAM,iBAAiB,gCAAgC,MAAM,aAAa;AAC1E,QAAM,yBAAyB,gCAAgC,MAAM,eAAe;AAAA,IAClF,WAAW;AAAA,EACb,CAAC;AACD,QAAM,sBAAsB,gCAAgC,MAAM,eAAe;AAAA,IAC/E,WAAW;AAAA,EACb,CAAC;AACD,QAAM,iBAAiB,MAAM,yCAAyC;AACtE,QAAM,UAAU,eAAe;AAC/B,QAAM,SAAS,IAAI,oCAAoC,SAAS,eAAe,IAAI;AACnF,QAAM,iBAAiB,IAAI,8BAA8B,MAAM,EAAE;AACjE,QAAM,QAAQ,sCAAsC,cAAc;AAClE,QAAM,gBAAgB,IAAI,sCAAsC,MAAM,EAAE;AACxE,QAAM,MAAM,IAAI,gCAAgC;AAChD,QAAM,QAAQ,IAAI,4BAA4B;AAC9C,QAAM,mBAAmB,IAAI,2CAA2C;AAAA,IACtE,SAAS,eAAe;AAAA,IACxB;AAAA,EACF,CAAC;AACD,QAAM,UAAU,IAAI,gCAAgC;AAAA,IAClD;AAAA,IACA,SAAS,eAAe;AAAA,IACxB,KAAK,MAAM,MAAM,IAAI;AAAA,EACvB,CAAC;AACD,QAAM,aAAa,IAAI,mCAAmC;AAAA,IACxD;AAAA,IACA,SAAS,eAAe;AAAA,IACxB,KAAK,MAAM,MAAM,IAAI;AAAA,EACvB,CAAC;AACD,QAAM,SAAS,IAAI,wBAAwB;AAAA,IACzC;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,2BAA2B;AAAA,IAC/B;AAAA,IACA,eAAe,SAAS,aAAa;AAAA,EACvC;AACA,QAAM,iBAAiB,IAAI,qCAAqC;AAAA,IAC9D;AAAA,IACA,gBAAgB,OAAO,OAAO;AAAA,MAC5B,QAAQ,OAAO,YACb,MAAM,OAAO,mBAAmB,OAAO;AAAA,IAC3C,CAAC;AAAA,IACD,OAAO;AAAA,MACL,IAAI,2CAA2C,MAAM,EAAE;AAAA,IACzD;AAAA,IACA,KAAK,IAAI,uCAAuC;AAAA,IAChD,UAAU,wBAAwB,wBAAwB;AAAA,IAC1D,wBAAwB,uBAAuB;AAAA,EACjD,CAAC;AACD,QAAM,gBAAgB,IAAI,oCAAoC;AAAA,IAC5D,IAAI,MAAM;AAAA,IACV,eAAe,MAAM;AAAA,IACrB,SAAS;AAAA,IACT,eAAe,oBAAoB;AAAA,IACnC,iBAAiB,eAAe;AAAA,EAClC,CAAC;AACD,QAAM,QAAQ,IAAI,iCAAiC;AAAA,IACjD;AAAA,IACA,SAAS;AAAA,IACT,cAAc,OAAO,OAAO;AAAA,MAC1B,iBAAiB,OAAO,EAAE,OAAO,WAAW,MAAM,OAC/C,MAAM,kCAAkC,MAAM,IAAI,OAAO,WAAW,KAAK,GAAG;AAAA,QAC3E;AAAA,MACF;AAAA,MACF,OAAO,OAAO,EAAE,OAAO,WAAW,WAAW,MAC3C,MAAM,iCAAiC,MAAM,IAAI,OAAO,WAAW,UAAU;AAAA,IACjF,CAAgD;AAAA,IAChD,WAAW;AAAA,IACX,kBAAkB,OAAO,eAAe;AACtC,UAAI,WAAW,MAAM,SAAS;AAC5B,cAAM,IAAI,MAAM,4CAA4C;AAC9D,aAAO,+BAA+B,MAAM,IAAI,EAAE,GAAG,YAAY,OAAO,WAAW,MAAM,CAAC;AAAA,IAC5F;AAAA,IACA;AAAA,IACA,gBAAgB,IAAI,qCAAqC;AAAA,MACvD,IAAI,MAAM;AAAA,MACV,eAAe,MAAM;AAAA,MACrB;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,QAAM,cAAc,IAAI,wCAAwC,MAAM,EAAE;AACxE,QAAM,WAAW,IAAI,sCAAsC,MAAM,IAAI;AAAA,IACnE,eAAe,kBAAkB,eAAe,IAAI;AAAA,EACtD,CAAC;AACD,QAAM,gBAAgB,IAAI,kDAAkD,aAAa;AACzF,QAAM,OAAO,IAAI,2BAA2B;AAAA,IAC1C;AAAA,IACA;AAAA,IACA,SAAS,gDAAgD,WAAW;AAAA,IACpE,QAAQ,IAAI,oCAAoC;AAAA,IAChD,OAAO,IAAI,gCAAgC;AAAA,IAC3C,WAAW,IAAI,oCAAoC;AAAA,IACnD,MAAM,yCAAyC,QAAQ;AAAA,IACvD,OAAO,IAAI,kCAAkC,MAAM,GAAG;AAAA,IACtD;AAAA,EACF,CAAC;AACD,QAAM,gBAAuD,OAAO,OAAO;AAAA,IACzE,iBACE,SACA;AACA,YAAM,UAAU,qCAAqC,QAAQ,SAAS,QAAQ;AAC9E,UACE,QAAQ,aAAa,QAAQ,SAAS,YACtC,QAAQ,wBAAwB,QAAQ,uBACxC,QAAQ,uBAAuB,QAAQ,sBACvC,QAAQ,oBAAoB,QAAQ,mBACpC,QAAQ,2BAA2B,QAAQ,0BAC3C,QAAQ,wCAAwC,QAAQ,qCACxD;AACA,cAAM,IAAI,mCAAmC;AAAA,MAC/C;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,cAAc,IAAI,4BAA4B;AAAA,IAClD;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,UAAU,YAAY,MAAM;AAChC,SAAK,YAAY,eAAe,EAAE,MAAM,MAAM,MAAS;AAAA,EACzD,GAAG,iBAAiB;AACpB,UAAQ,QAAQ;AAChB,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,eAAe,QAAQ;AAAA,IACvB,QAAQ;AACN,oBAAc,OAAO;AACrB,oBAAc,MAAM;AAAA,IACtB;AAAA,EACF,CAAC;AACH;AAEO,IAAM,wCAAN,MAAyF;AAAA,EAC9F,YAA6B,IAAc;AAAd;AAAA,EAAe;AAAA,EAE5C,MAAM,UACJ,SACgD;AAChD,UAAM,QAAQ,QAAQ;AACtB,UAAM,OAAO,MAAMC;AAAA,MAAe,KAAK;AAAA,MAAI,QAAQ;AAAA,MAAO,OAAO,OAC/D;AAAA,QACE,MAAM,GAAG,QAAQ;AAAA;AAAA,cAEX,QAAQ,MAAM,SAAS;AAAA,cACvB,QAAQ,MAAM,WAAW;AAAA,cACzB,QAAQ,UAAU;AAAA,cAClB,MAAM,IAAI;AAAA,cACV,MAAM,SAAS;AAAA,cACf,MAAM,SAAS,UAAU,MAAM,YAAY,IAAI;AAAA,cAC/C,MAAM,SAAS,UAAU,MAAM,SAAS,IAAI;AAAA,cAC5C,MAAM,SAAS,UAAU,MAAM,YAAY,IAAI;AAAA,cAC/C,MAAM,SAAS,UAAU,MAAM,aAAa,IAAI;AAAA,cAChD,MAAM,SAAS,YAAY,MAAM,UAAU,IAAI;AAAA,cAC/C,QAAQ,UAAU;AAAA;AAAA,YAEpB;AAAA,MACN;AAAA,IACF;AACA,QAAI,KAAK,WAAW,EAAG,OAAM,IAAI,MAAM,sDAAsD;AAC7F,UAAM,WAAW,OAAO,KAAK,CAAC,EAAG,sBAAsB;AACvD,QAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,GAAG;AACnD,YAAM,IAAI,MAAM,8DAA8D;AAAA,IAChF;AACA,WAAO,OAAO,OAAO,EAAE,SAAS,KAAK,CAAC,EAAG,YAAY,MAAM,SAAS,CAAC;AAAA,EACvE;AACF;AAEA,IAAM,oDAAN,MAAqH;AAAA,EAGnH,YAA6B,eAAkD;AAAlD;AAAA,EAAmD;AAAA,EAF/D,QAAQ,oBAAI,IAAgB;AAAA,EAI7C,MAAM,UACJ,OACqB;AACrB,QAAI,SAAS;AACb,QAAI,UAAU;AACd,QAAI,WAAW,MAAM,KAAK,KAAK,KAAK;AACpC,UAAM,QAAQ,YAAY,MAAM;AAC9B,UAAI,CAAC,UAAU,QAAS;AACxB,gBAAU;AACV,WAAK,KAAK,KAAK,KAAK,EACjB,KAAK,CAAC,SAAS;AACd,YAAI,CAAC,OAAQ;AACb,YAAI,SAAS,UAAU;AACrB,qBAAW;AACX,gBAAM,cAAc;AAAA,QACtB;AAAA,MACF,CAAC,EACA,MAAM,MAAM;AACX,YAAI,OAAQ,OAAM,cAAc;AAAA,MAClC,CAAC,EACA,QAAQ,MAAM;AACb,kBAAU;AAAA,MACZ,CAAC;AAAA,IACL,GAAG,oBAAoB;AACvB,UAAM,QAAQ;AACd,UAAM,OAAO,MAAM;AACjB,UAAI,CAAC,OAAQ;AACb,eAAS;AACT,oBAAc,KAAK;AACnB,WAAK,MAAM,OAAO,IAAI;AAAA,IACxB;AACA,SAAK,MAAM,IAAI,IAAI;AACnB,WAAO;AAAA,EACT;AAAA,EAEA,QAAc;AACZ,eAAW,QAAQ,CAAC,GAAG,KAAK,KAAK,EAAG,MAAK;AAAA,EAC3C;AAAA,EAEA,MAAc,KACZ,OACiB;AACjB,UAAM,WAAW,MAAM,KAAK,cAAc,UAAU;AAAA,MAClD,OAAO,MAAM;AAAA,MACb,YAAY,MAAM;AAAA,MAClB,OAAO,MAAM;AAAA,MACb,YAAY;AAAA,IACd,CAAC;AACD,WAAO,GAAG,SAAS,UAAU,IAAI,CAAC,IAAI,SAAS,QAAQ;AAAA,EACzD;AACF;AAEA,IAAM,kCAAN,MAAqF;AAAA,EACnF,KAAK,OAAqC;AACxC,WAAOC,YAAW,EAAE,WAAW,KAAK,EAAE;AAAA,EAGxC;AACF;AAEA,IAAM,yCAAN,MAAmG;AAAA,EACjG,KAAK,OAA8D;AACjE,WAAOA,YAAW,EAAE,WAAW,KAAK,EAAE;AAAA,EACxC;AACF;AAEA,SAAS,wBACP,cAC4C;AAC5C,QAAM,2BAA2B,qCAAqC,aAAa;AACnF,MACE,aAAa,aAAa,cAC1B,aAAa,gBAAgB,YAC7B,aAAa,mBAAmB,+CAChC,aAAa,cAAc,eAAe,MAAM,UAChD,aAAa,6BAA6B,CAAC,MAAM,yBAAyB,sBAC1E,aAAa,mCAAmC,CAAC,MAC/C,yBAAyB,uCAC3B,aAAa,kCAAkC,CAAC,MAAM,yBAAyB,iBAC/E;AACA,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,QAAM,eAAe,aAAa,cAAc,eAAe;AAC/D,SAAO,OAAO,OAAO;AAAA,IACnB,kBAAkB;AAAA,IAClB,MAAM,QAAQ,OAA6E;AAEzF,UACE,MAAM,aAAa,iBACnB,MAAM,WAAW,UACjB,CAAC,iCAAiC,MAAM,QAAQ,EAAE,SAAS,MAAM,MAAM,KACvE,OAAO,KAAK,MAAM,OAAO,EAAE,WAAW,GACtC;AACA,eAAO;AAAA,MACT;AACA,aAAO,OAAO,OAAO;AAAA,QACnB,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,SAAS;AAAA,QACT;AAAA,QACA,eAAe,aAAa;AAAA,QAC5B,kBAAkB,aAAa;AAAA,QAC/B,YAAY,aAAa;AAAA,QACzB,mBAAmB;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEA,SAAS,kBACP,SAC4C;AAC5C,SAAO,OAAO,OAAO;AAAA,IACnB,MAAM,kBAAkB,UAAqD;AAC3E,YAAM,SAAS,MAAM,QAAQ,KAAK;AAAA,QAChC,iBAAiB,SAAS;AAAA,QAC1B,UAAUC;AAAA,QACV,kBAAkB,SAAS;AAAA,MAC7B,CAAC;AACD,UAAI;AACF,YAAI,OAAO,gBAAgB,UAAa,OAAO,gBAAgB,SAAS,UAAU;AAChF,gBAAM,IAAI,MAAM,kDAAkD;AAAA,QACpE;AACA,cAAM,QAAQ,IAAI,WAAW,SAAS,QAAQ;AAC9C,cAAM,SAASC,YAAW,QAAQ;AAClC,YAAI,SAAS;AACb,yBAAiB,SAAS,OAAO,OAAO;AAAA,UACtC,YAAYC;AAAA,QACd,CAAC,GAAG;AACF,cAAI,SAAS,MAAM,aAAa,MAAM,YAAY;AAChD,kBAAM,IAAI,MAAM,sDAAsD;AAAA,UACxE;AACA,gBAAM,IAAI,OAAO,MAAM;AACvB,iBAAO,OAAO,KAAK;AACnB,oBAAU,MAAM;AAAA,QAClB;AACA,YACE,WAAW,MAAM,cACjB,UAAU,OAAO,OAAO,KAAK,CAAC,OAAO,SAAS,aAC9C;AACA,gBAAM,IAAI,MAAM,oDAAoD;AAAA,QACtE;AACA,cAAM,OAAO,gBAAgB;AAC7B,eAAO;AAAA,MACT,UAAE;AACA,cAAM,OAAO,MAAM;AAAA,MACrB;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,QAA2C,QAAsB;AACxE,MAAI,MAAM,QAAQ,MAAM,EAAG,QAAO;AAClC,QAAM,OAAQ,QAAsC;AACpD,MAAI,MAAM,QAAQ,IAAI,EAAG,QAAO;AAChC,QAAM,IAAI,MAAM,2CAA2C;AAC7D;;;AKlbA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,gCAAgC;AAuDzC,IAAM,6BAA6B;AACnC,IAAM,mCAAmC;AAEzC,IAAM,oBAAoB;AAAA,EACxB,iBAAiB;AAAA,EACjB,qBAAqB;AAAA,EACrB,oBAAoB;AACtB;AAEO,SAAS,+BACd,UAA0C,CAAC,GAClB;AACzB,QAAM,iBAAiB,QAAQ,WAAW,uBAAuB;AACjE,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,gBAAgB,QAAQ,kBAAkB,MAAM,aAAaA,YAAW,CAAC;AAC/E,QAAM,cAAc,QAAQ,gBAAgB,CAAC,YAAoB,QAAQ,MAAM,OAAO;AACtF,QAAM,yBAAyB,QAAQ,0BAA0B;AACjE,MAAI,gBAAgB,QAAQ;AAC5B,MAAI,QAAuB;AAC3B,MAAI,YAAY;AAEhB,QAAM,UAAU,CAAC,WAA6B;AAC5C,QAAI,UAAU,aAAa,UAAW,QAAO;AAC7C,QAAI,cAAc;AAClB,QAAI;AACF,oBAAc,uBAAuB,MAAM;AAAA,IAC7C,QAAQ;AACN,aAAO;AAAA,IACT;AACA,QAAI,CAAC,YAAa,QAAO;AACzB,UAAM,aAAa;AAAA,MACjB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,YAAY,mBAAmB,MAAM;AAAA,IACvC;AACA,QAAI;AACF,UAAI,eAAe,MAAM;AACvB,sBAAc;AAAA,UACZ;AAAA,UACA;AAAA,QACF;AAAA,MACF,OAAO;AACL;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,qBAAe,mBAAmB;AAAA,QAChC,MAAM;AAAA,QACN,MAAM;AAAA,QACN,QAAQ,EAAE,MAAM,yCAAyC;AAAA,MAC3D,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AACA,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,OAAO,OAAsB,WAAmC;AAC7E,QAAI,UAAW;AACf,gBAAY;AAEZ,UAAM,aAAa,mBAAmB,OAAO,OAAO,QAAQ,aAAa;AACzE,QAAI,UAAU,gBAAgB,UAAU;AACxC,UAAM,sBAAsB;AAC5B,QAAI;AACF,UAAI,qBAAqB;AACvB,YAAI;AACF,gBAAM,eAAe,oBAAoB,0BAA0B;AAAA,YACjE,MAAM,kBAAkB,KAAK;AAAA,YAC7B,OAAO;AAAA,YACP,eAAe;AAAA,YACf,OAAO;AAAA,UACT,CAAC;AACD,cAAI,cAAc;AAChB,uBAAW,gBAAgB;AAC3B,sBAAU,gBAAgB,UAAU;AAAA,UACtC;AAAA,QACF,QAAQ;AAAA,QAER;AACA,YAAI,SAAS;AACb,YAAI;AACF,8BAAoB,MAAM,SAAS,UAAU;AAC7C,mBAAS;AAAA,QACX,QAAQ;AAAA,QAER;AACA,YAAI,CAAC,QAAQ;AACX,0BAAgB,aAAa,OAAO;AAAA,QACtC;AACA,YAAI;AACF,gBAAM,OAAa,oBAAoB,UAAU,qBAAqB,UAAU;AAChF,eAAK,IAAI,EAAE,OAAO,KAAK,CAAC;AAAA,QAC1B,QAAQ;AAAA,QAER;AACA,cAAM,YAAY,qBAAqB,cAAc;AAAA,MACvD,OAAO;AACL,wBAAgB,aAAa,OAAO;AAAA,MACtC;AAAA,IACF,UAAE;AACA,qBAAe,KAAK,CAAC;AAAA,IACvB;AAAA,EACF;AAEA,QAAM,uBAAuB,CAAC,WAA0B;AACtD,QAAI,QAAQ,MAAM,EAAG;AACrB,SAAK,OAAO,uBAAuB,MAAM;AAAA,EAC3C;AACA,QAAM,sBAAsB,CAAC,WAA0B;AACrD,SAAK,OAAO,sBAAsB,MAAM;AAAA,EAC1C;AACA,iBAAe,GAAG,sBAAsB,oBAAoB;AAC5D,iBAAe,GAAG,qBAAqB,mBAAmB;AAE1D,SAAO;AAAA,IACL,qBAAqB,CAAC,UAAU;AAC9B,sBAAgB;AAAA,IAClB;AAAA,IACA,aAAa,MAAM;AACjB,cAAQ;AAAA,IACV;AAAA,IACA,sBAAsB,OAAO,WAAW;AACtC,YAAM,OAAO,mBAAmB,MAAM;AAAA,IACxC;AAAA,IACA,SAAS,MAAM;AACb,qBAAe,IAAI,sBAAsB,oBAAoB;AAC7D,qBAAe,IAAI,qBAAqB,mBAAmB;AAAA,IAC7D;AAAA,EACF;AACF;AAEA,SAAS,mBACP,OACA,OACA,QACA,eAQA;AACA,MAAI,oBAAoB;AACxB,MAAI;AACF,UAAM,YAAY,cAAc;AAChC,QAAI,iCAAiC,KAAK,SAAS,GAAG;AACpD,0BAAoB;AAAA,IACtB;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,WAAW,kBAAkB,KAAK;AAAA,IAClC,QAAQ;AAAA,IACR;AAAA,IACA,YAAY,mBAAmB,MAAM;AAAA,IACrC,eAAe;AAAA,EACjB;AACF;AAEA,SAAS,mBAAmB,QAAqC;AAC/D,MAAI,WAAW,KAAM,QAAO;AAC5B,QAAM,OAAO,OAAO;AACpB,MAAI,SAAS,SAAU,QAAO;AAC9B,MAAI;AACF,WAAO,kBAAkB,QAAQ,UAAU;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB,YAA2D;AAClF,SACE,uCAAuC,WAAW,SAAS,WAClD,WAAW,KAAK,iBAAiB,WAAW,UAAU,oBAC7C,WAAW,aAAa;AAE9C;AAEA,eAAe,YACb,eACA,WACe;AACf,MAAI;AACJ,MAAI;AACF,YAAQ,QAAQ,QAAQ,cAAc,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EACtE,QAAQ;AACN;AAAA,EACF;AACA,MAAI,CAAC,OAAO,SAAS,SAAS,KAAK,aAAa,EAAG;AAEnD,MAAI;AACJ,MAAI;AACF,UAAM,QAAQ,KAAK;AAAA,MACjB;AAAA,MACA,IAAI,QAAc,CAAC,YAAY;AAC7B,kBAAU,WAAW,SAAS,SAAS;AAAA,MACzC,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,QAAI,YAAY,OAAW,cAAa,OAAO;AAAA,EACjD;AACF;AAEA,SAAS,gBAAgB,aAAwC,SAAuB;AACtF,MAAI;AACF,gBAAY,OAAO;AAAA,EACrB,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,yBAA0C;AACjD,SAAO;AAAA,IACL,IAAI,CAAC,OAAO,aAAa;AACvB,UAAI,UAAU,sBAAsB;AAClC,gBAAQ,GAAG,sBAAsB,QAAQ;AAAA,MAC3C,OAAO;AACL,gBAAQ,GAAG,qBAAqB,QAAQ;AAAA,MAC1C;AAAA,IACF;AAAA,IACA,KAAK,CAAC,OAAO,aAAa;AACxB,UAAI,UAAU,sBAAsB;AAClC,gBAAQ,IAAI,sBAAsB,QAAQ;AAAA,MAC5C,OAAO;AACL,gBAAQ,IAAI,qBAAqB,QAAQ;AAAA,MAC3C;AAAA,IACF;AAAA,IACA,MAAM,CAAC,SAAS;AACd,cAAQ,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACF;;;AC9RO,SAAS,2BAA2B,OAK5B;AACb,QAAM,UAAU,MAAM,WAAW;AACjC,MAAI,UAAU;AACd,MAAI,WAAW;AACf,MAAI;AACJ,QAAM,UAAU,MAAM;AACpB,YAAQ,IAAI,UAAU,QAAQ;AAC9B,YAAQ,IAAI,WAAW,QAAQ;AAAA,EACjC;AACA,QAAM,SAAS,CAAC,SAAiB;AAC/B,QAAI,SAAU;AACd,eAAW;AACX,iBAAa,QAAQ;AACrB,YAAQ;AACR,QAAI,SAAS,GAAG;AACd,UAAI;AACF,cAAM,YAAY;AAAA,MACpB,QAAQ;AAAA,MAER;AAAA,IACF;AACA,YAAQ,KAAK,IAAI;AAAA,EACnB;AACA,WAAS,WAAW;AAClB,QAAI,QAAS;AACb,cAAU;AACV,eAAW,WAAW,MAAM,OAAO,CAAC,GAAG,MAAM,aAAa,GAAM;AAChE,aAAS,QAAQ;AAGjB,SAAK,QAAQ,QAAQ,EAClB,KAAK,MAAM,KAAK,EAChB;AAAA,MACC,MAAM,OAAO,CAAC;AAAA,MACd,MAAM,OAAO,CAAC;AAAA,IAChB;AAAA,EACJ;AACA,UAAQ,GAAG,UAAU,QAAQ;AAC7B,UAAQ,GAAG,WAAW,QAAQ;AAC9B,SAAO;AACT;;;ApB+BA,SAAS,yBAAyB,OAAyB;AACzD,SAAO,iBAAiB;AAC1B;AAEA,IAAM,kBAAkB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,eAAsB,6BACpB,UACA,IAKC;AACD,QAAM,aAAa,MAAM,WAAW,QAAQ,0BAA0B,QAAQ,CAAC;AAC/E,QAAM,WAAW,IAAI,eAAe;AAAA,IAClC;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AACD,QAAM,iBAAiB,mCAAmC;AAAA,IACxD;AAAA,IACA,cAAc,CAAC,UAAU,SAAS,SAAS,aAAa,UAAU,IAAI;AAAA,IACtE,QAAQ,OAAO,SAAS;AACtB,YAAM,UAAU,wBAAwB,MAAM,SAAS,iBAAiB;AACxE,UAAI;AACF,cAAM,SAAS,SACZ,UAAU,KAAK,kBAAkB,EACjC,OAAO,MAAM,8BAA8B,OAAO,CAAC;AAAA,MACxD,SAAS,OAAO;AACd,YAAI,CAAC,qCAAqC,KAAK,EAAG,OAAM;AACxD,cAAM,SAAS,SAAS,OAAO,OAAO;AAAA,MACxC;AAAA,IACF;AAAA,IACA,QAAQ,OAAO,uBAAuB;AACpC,UAAI;AACF,cAAM,SAAS,SAAS,UAAU,kBAAkB,EAAE,OAAO;AAAA,MAC/D,SAAS,OAAO;AACd,YAAI,EAAE,iBAAiB,uBAAwB,OAAM;AAAA,MACvD;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,SAAgC;AAAA,IACpC,sBAAsB,OAAO,EAAE,WAAW,aAAa,MAAM,MAAM;AACjE,UAAI;AACF,cAAM,SAAS,SAAS,MAAM,yBAAyB;AAAA,UACrD,WAAW,SAAS;AAAA,UACpB,YAAY,kBAAkB,KAAK;AAAA,UACnC,uBAAuB;AAAA,UACvB,MAAM,CAAC,EAAE,WAAW,aAAa,MAAM,CAAC;AAAA,QAC1C,CAAC;AAAA,MACH,SAAS,OAAO;AACd,YAAI,yBAAyB,KAAK,EAAG;AACrC,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,mBAAmB,OAAO,EAAE,SAAS,WAAW,MAAM;AACpD,YAAM,SAAS,SAAS,UAAU,UAAU,EAAE,OAAO,eAAe,OAAO;AAAA,IAC7E;AAAA,IACA,qBAAqB,OAAO;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,MAAM;AACJ,YAAM,SAAS,SAAS,gBAAgB,mBAAmB;AAAA,QACzD,WAAW,SAAS;AAAA,QACpB;AAAA,QACA,uBAAuB;AAAA,QACvB,MAAM,CAAC,EAAE,WAAW,aAAa,UAAU,CAAC;AAAA,QAC5C,QAAQ,wBAAwB,mBAAmB;AAAA,MACrD,CAAC;AACD,yBAAmB;AACnB,aAAO,MAAM,iCAAiC,IAAI;AAAA,QAChD;AAAA,QACA;AAAA,QACA;AAAA,QACA,oBAAoB;AAAA,QACpB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,oCAAoC,YAAY;AAC9C,YAAM,SAAS,SAAS,gBAAgB,gDAAgD;AAAA,QACtF,WAAW,SAAS;AAAA,QACpB,YAAY;AAAA,QACZ,uBAAuB;AAAA,QACvB,MAAM,CAAC;AAAA,QACP,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IACA,qBAAqB,OAAO;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,MAAM;AACJ,YAAM,SAAS,SAAS,gBAAgB,mBAAmB;AAAA,QACzD,WAAW,SAAS;AAAA,QACpB;AAAA,QACA,uBAAuB;AAAA,QACvB,MAAM,CAAC,EAAE,WAAW,aAAa,UAAU,CAAC;AAAA,QAC5C,QAAQ;AAAA,QACR,YAAY,CAAC,YAAY;AAAA,MAC3B,CAAC;AACD,YAAM,iCAAiC,IAAI;AAAA,QACzC;AAAA,QACA;AAAA,QACA;AAAA,QACA,oBAAoB;AAAA,QACpB,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,IACA,wBAAwB,OAAO;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,MAAM;AACJ,YAAM,SAAS,SAAS,gBAAgB,mBAAmB;AAAA,QACzD,WAAW,SAAS;AAAA,QACpB;AAAA,QACA,uBAAuB;AAAA,QACvB,MAAM,CAAC,EAAE,WAAW,aAAa,UAAU,CAAC;AAAA,QAC5C,QAAQ;AAAA,QACR,YAAY,CAAC,OAAO;AAAA,MACtB,CAAC;AACD,YAAM,iCAAiC,IAAI;AAAA,QACzC;AAAA,QACA;AAAA,QACA;AAAA,QACA,oBAAoB;AAAA,QACpB,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,IACA,mBAAmB,OAAO,EAAE,MAAM,UAAU,MAAM,eAAe,KAAK,MAAM,SAAS;AAAA,IACrF,6BAA6B,OAAO,EAAE,mBAAmB,MACvD,eAAe,OAAO,kBAAkB;AAAA,IAC1C,sBAAsB,OAAO;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,IAChB,MAAM;AAKJ,YAAM,aAAa;AACnB,UAAI;AACF,cAAM,SAAS,SAAS,MAAM,6BAA6B;AAAA,UACzD,WAAW,SAAS;AAAA,UACpB;AAAA,UACA,uBAAuB;AAAA,UACvB,MAAM;AAAA,YACJ;AAAA,cACE,WAAW,KAAK;AAAA,cAChB,aAAa,KAAK;AAAA,cAClB,QAAQ,KAAK;AAAA,cACb;AAAA,cACA;AAAA,cACA;AAAA,cACA,GAAI,wBAAwB,EAAE,sBAAsB,IAAI,CAAC;AAAA,YAC3D;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH,SAAS,OAAO;AAGd,YAAI,yBAAyB,KAAK,GAAG;AACnC;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,sBAAsB,OAAO,EAAE,aAAa,UAAU,WAAW,WAAW,MAAM;AAChF,YAAM,WAAW,YAAY;AAC7B,UAAI,CAAC,UAAU;AACb,cAAM,IAAI,MAAM,iEAAiE;AAAA,MACnF;AACA,UAAI;AACF,cAAM,SAAS,SAAS,MAAM,2BAA2B;AAAA,UACvD,WAAW,SAAS;AAAA,UACpB,YAAY,cAAc,oBAAoB,QAAQ,IAAI,OAAO,WAAW,CAAC;AAAA,UAC7E,uBAAuB;AAAA,UACvB,MAAM;AAAA,YACJ;AAAA,cACE;AAAA,cACA,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,cAC/B,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,YACnC;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH,SAAS,OAAO;AAGd,YAAI,yBAAyB,KAAK,EAAG;AACrC,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,OAAO,YAAY;AACjB,YAAM,WAAW,gBAAgB,cAAc,CAAC,CAAC;AAAA,IACnD;AAAA,EACF;AACA,QAAM,kBAAuC;AAAA,IAC3C,eAAe,OAAO,UAAU;AAC9B,YAAM,EAAE,WAAW,IAAI;AACvB,YAAM,aAAa,kBAAkB,UAAU,IAAI,OAAO,WAAW,CAAC;AACtE,YAAM,SAAS,SAAS,MAAM,yBAAyB;AAAA,QACrD,WAAW,SAAS;AAAA,QACpB;AAAA,QACA,MAAM,CAAC,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,YAAY;AACjB,YAAM,WAAW,MAAM;AAAA,IACzB;AAAA,EACF;AACF;AAEA,eAAsB,SACpB,UAGI,CAAC,GACL;AACA,QAAM,WAAW,QAAQ,YAAY,YAAY;AACjD,QAAM,gBACJ,QAAQ,iBAAiB,oBAAoB,UAAU,EAAE,WAAW,MAAM,CAAC;AAI7E,QAAM,aAAa,aAAa,QAAQ;AACxC,QAAM,WAAW,SAAS,SAAS,aAAa;AAAA,IAC9C,KAAK,SAAS;AAAA,IACd,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,IACnC,aAAa,SAAS;AAAA,EACxB,CAAC;AACD,MAAI;AACJ,MAAI;AACJ,QAAM,eAAe,oBAAoB,QAAQ;AACjD,QAAM,UAAU,CAAC,UACf,0BAA0B,eAAe,KAAK;AAChD,QAAM,kBAAkB;AAAA,IACtB,aAAa,SAAS;AAAA,IACtB,cAAc,SAAS;AAAA,IACvB,cAAc,SAAS,SAAS,KAAK,KAAK;AAAA,EAC5C;AAKA,QAAM,mBAAmB,4BAA4B,QAAQ;AAC7D,MAAI;AAOF,UAAM,EAAE,yBAAyB,IAAI,MAAM,OAAO,2BAA2B;AAC7E,UAAM;AAAA,MACJ;AAAA,MACA,MAAM,yBAAyB,QAAQ;AAAA,MACvC,EAAE,GAAG,cAAc,QAAQ;AAAA,IAC7B;AACA,UAAM;AAAA,MACJ;AAAA,MACA,MAAM,6BAA6B,SAAS,IAAI,eAAe;AAAA,MAC/D,EAAE,GAAG,cAAc,SAAS,aAAa,uCAAuC;AAAA,IAClF;AACA,UAAM,kBAAkB,MAAM;AAAA,MAC5B;AAAA,MACA,MAAM,uBAAuB,SAAS,IAAI,QAAQ;AAAA,MAClD,EAAE,GAAG,cAAc,QAAQ;AAAA,IAC7B;AACA,kBAAc,KAAK,mCAAmC;AAAA,MACpD,eAAe,gBAAgB;AAAA,MAC/B,gBAAgB,gBAAgB;AAAA,IAClC,CAAC;AACD,UAAM,MAAM;AAAA,MACV;AAAA,MACA,MACE;AAAA,QACE,SAAS;AAAA,QACT,mBACI,EAAE,MAAM,iBAAiB,MAAM,MAAM,iBAAiB,SAAS,IAC/D;AAAA,QACJ,6BAA6B,aAAa;AAAA,MAC5C;AAAA,MACF;AAAA,QACE,GAAG;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,qBAAiB,MAAM;AAAA,MACrB;AAAA,MACA,MAAM,6BAA6B,UAAU,SAAS,EAAE;AAAA,MACxD;AAAA,QACE,GAAG;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,QAAQ,WAAW,CAAC,KAAK,MAAM,GAAG,gBAAgB,MAAM,GAAG,SAAS,MAAM,CAAC,CAAC;AAClF,UAAM;AAAA,EACR;AACA,MAAI,CAAC,OAAO,CAAC,gBAAgB;AAC3B,UAAM,SAAS,MAAM;AACrB,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,QAAM,gBAAgB,oBAAoB,QAAQ;AAClD,MAAI;AACJ,MAAI,iBAAiB,4BAA4B,GAAG;AAClD,QAAI;AACF,oCAA8B,MAAM,4CAA4C;AAAA,QAC9E,IAAI,SAAS;AAAA,QACb;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,QAAQ,WAAW,CAAC,IAAI,MAAM,GAAG,eAAe,MAAM,GAAG,SAAS,MAAM,CAAC,CAAC;AAChF,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,EAAE,KAAK,UAAU,IAAI,qBAAqB;AAAA,IAC9C;AAAA,IACA,IAAI,SAAS;AAAA,IACb;AAAA,IACA,gBAAgB,eAAe;AAAA,IAC/B,iBAAiB,eAAe;AAAA,IAChC;AAAA,IACA,GAAI,8BACA;AAAA,MACE,mBAAmB,4BAA4B;AAAA,MAC/C,yBAAyB,4BAA4B;AAAA,MACrD,uBAAuB,4BAA4B;AAAA,MACnD,+BAA+B,4BAA4B;AAAA,IAC7D,IACA,CAAC;AAAA,IACL;AAAA,IACA,iBAAiB;AAAA,MACf,IAAI,0BAA0B,SAAS,IAAI,eAAe;AAAA,IAC5D;AAAA,EACF,CAAC;AACD,MAAI,CAAC,UAAU,mBAAmB;AAChC,kBAAc,KAAK,4CAA4C;AAAA,MAC7D,WAAW;AAAA,MACX,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,QAAM,qBAAqB,IAAI;AAAA,IAC7B,UAAU;AAAA,IACV,wCAAwC,SAAS;AAAA,EACnD;AACA,QAAM,0BAA0B,IAAI;AAAA,IAClC,kCAAkC,QAAQ;AAAA,EAC5C;AAIA,QAAM,uBAAuB,2BAA2B,UAAU;AAAA,IAChE,MAAM,CAAC,SAAS,eAAe,cAAc,KAAK,SAAS,UAAU;AAAA,EACvE,CAAC;AACD,QAAM,oBAAoB,CAAC,yBAAyB,kBAAkB;AACtE,QAAM,SAAS,IAAI,MAA8B;AAAA,IAC/C,UAAU,SAAS;AAAA,IACnB,MAAM,SAAS;AAAA,IACf,aAAa;AAAA,IACb,OAAO,CAAC,SAAS,cAAc;AAC7B,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,UAAI,QAAQ,QAAS,QAAO,QAAQ;AACpC,aAAO,IAAI;AAAA,QACT;AAAA,QACA,mCAAmC,UAAU,UAAU,OAAO,GAAG,OAAO;AAAA,MAC1E;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,kBAAkB;AAAA,MAClB,mBAAmB,KAAK,OAAO;AAAA,MAC/B,0BAA0B;AAAA,MAC1B,MAAM,CAAC,WAAW,OAAO,KAAK,OAAO,MAAM;AAAA,MAC3C,SAAS,CAAC,QAAQ,YAAY,OAAO,KAAK,QAAQ,OAAO;AAAA,MACzD,OAAO,CAAC,WAAW,OAAO,KAAK,gBAAgB;AAAA,IACjD;AAAA,EACF,CAAC;AACD,QAAM,gBAAgB,wBAAwB,UAAU,aAAa;AACrE,QAAM,2BAA2B,SAAS,qBACtC,0BAA0B,SAAS,IACnC;AACJ,QAAM,iCAAiC,gCAAgC,SAAS;AAChF,QAAM,mCAAmC,kCAAkC;AAAA,IACzE,IAAI,SAAS;AAAA,IACb;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,6BAA6B,4BAA4B;AAAA,IAC7D,IAAI,SAAS;AAAA,IACb;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,kCAAkC,iCAAiC;AAAA,IACvE,IAAI,SAAS;AAAA,IACb,+BAA+B,OAAO,UACpC,MAAM,2CAA2C,WAAW,KAAK;AAAA,IACnE,gBAAgB,OAAO,uBAAuB;AAC5C,YAAM,eAAe,OAAO,4BAA4B,EAAE,mBAAmB,CAAC;AAAA,IAChF;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,iCAAiC,gCAAgC;AAAA,IACrE,IAAI,SAAS;AAAA,IACb,MAAM,CAAC,SAAS,eAAe,OAAO,kBAAkB,EAAE,KAAK,CAAC;AAAA,IAChE;AAAA,IACA;AAAA,EACF,CAAC;AAGD,MAAI;AAIJ,MAAI;AAOJ,MAAI;AACJ,MAAI,SAAS,0BAA0B;AACrC,2BAAuB,sBAAsB;AAAA,MAC3C,IAAI,SAAS;AAAA,MACb;AAAA,MACA;AAAA,MACA,cAAc,4BAA4B;AAAA,QACxC,IAAI,SAAS;AAAA,QACb;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AACD,yBAAqB,oBAAoB;AAAA,MACvC,IAAI,SAAS;AAAA,MACb;AAAA,MACA;AAAA,IACF,CAAC;AACD,kBAAc,KAAK,gEAAgE,CAAC,CAAC;AAErF,UAAM,UAAU,yBAAyB,QAAQ;AACjD,QAAI,SAAS;AACX,UAAI;AACF,+BAAuB,MAAM;AAAA,UAC3B,EAAE,IAAI,SAAS,IAAI,UAAU,SAAS,cAAc;AAAA,UACpD,SAAS;AAAA,QACX;AAAA,MACF,QAAQ;AAGN,sBAAc,MAAM,wDAAwD;AAAA,UAC1E,YAAY;AAAA,UACZ,WAAW;AAAA,UACX,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF,OAAO;AACL,oBAAc;AAAA,QACZ;AAAA,QACA,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,gBAAc,KAAK,0BAA0B;AAAA,IAC3C,MAAM,SAAS;AAAA,IACf,MAAM,SAAS;AAAA,IACf,GAAI,gBAAgB,EAAE,aAAa,SAAS,eAAe,IAAI,CAAC;AAAA,EAClE,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA,OAAO,YAAY;AACjB,aAAO,KAAK,IAAI;AAEhB,YAAM,uBAAuB,kCAAkC,EAAE,MAAM,MAAM,MAAS;AACtF,qBAAe,KAAK,IAAI;AACxB,iCAA2B;AAC3B,YAAM,+BAA+B;AACrC,6BAAuB;AACvB,2BAAqB;AACrB,YAAM,gCAAgC;AACtC,YAAM,+BAA+B;AACrC,YAAM,iCAAiC;AACvC,YAAM,2BAA2B;AAEjC,YAAM,UAAU,cAAc,MAAM,EAAE,MAAM,MAAM,MAAS;AAC3D,YAAM,QAAQ,WAAW;AAAA,QACvB;AAAA,QACA,QAAQ,QAAQ,6BAA6B,MAAM,CAAC;AAAA,QACpD,sBAAsB,MAAM;AAAA,QAC5B,IAAI,MAAM;AAAA,QACV,eAAe,MAAM;AAAA,QACrB,SAAS,MAAM;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,IAAI,YAAY,MAAM;AACpB,QAAM,gBAAgB,+BAA+B;AACrD,MAAI;AACF,UAAM,WAAW,YAAY;AAC7B,UAAM,gBAAgB,oBAAoB,UAAU,EAAE,WAAW,MAAM,CAAC;AACxE,kBAAc,oBAAoB,aAAa;AAC/C,UAAM,MAAM,MAAM,SAAS,EAAE,UAAU,cAAc,CAAC;AACtD,+BAA2B;AAAA,MACzB,OAAO,IAAI;AAAA,MACX,WAAW,MACT,cAAc,KAAK,gDAAgD;AAAA,QACjE,WAAW;AAAA,MACb,CAAC;AAAA,IACL,CAAC;AACD,kBAAc,YAAY;AAAA,EAC5B,SAAS,OAAO;AACd,UAAM,cAAc,qBAAqB,KAAK;AAAA,EAChD;AACF;AAEO,SAAS,sBAAsB,QAA2D;AAC/F,MAAI,WAAW,QAAQ;AACrB,WAAO,sBAAsB;AAAA,EAC/B;AACA,MAAI,WAAW,cAAc;AAC3B,WAAO,sBAAsB;AAAA,EAC/B;AACA,SAAO,sBAAsB;AAC/B;AAEO,SAAS,qCAAqC,OAAyB;AAC5E,SAAO,iBAAiB;AAC1B;AAEO,SAAS,qBAAqB,UAAmD;AACtF,MAAI,SAAS,SAAS,UAAU;AAC9B,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,MAAI,SAAS,SAAS,YAAY;AAChC,WAAO;AAAA,MACL,WAAW,CAAC,qBAAqB,QAAQ,CAAC;AAAA,MAC1C,GAAI,SAAS,UAAU,EAAE,SAAS,IAAI,KAAK,SAAS,OAAO,EAAE,IAAI,CAAC;AAAA,MAClE,GAAI,SAAS,QAAQ,EAAE,OAAO,IAAI,KAAK,SAAS,KAAK,EAAE,IAAI,CAAC;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,SAAS,SAAS,YAAY;AAChC,WAAO;AAAA,MACL,WAAW;AAAA,QACT;AAAA,UACE,MAAM,SAAS;AAAA,UACf,QAAQ,SAAS;AAAA,UACjB,QAAQ;AAAA,UACR,GAAI,SAAS,aAAa,EAAE,WAAW,SAAS,WAAW,IAAI,CAAC;AAAA,QAClE;AAAA,MACF;AAAA,MACA,UAAU,SAAS;AAAA,IACrB;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,KAAK,SAAS,KAAK;AACrC,SAAO;AAAA,IACL,WAAW;AAAA,MACT;AAAA,QACE,MAAM,MAAM,eAAe;AAAA,QAC3B,OAAO,cAAc,MAAM,YAAY,CAAC;AAAA,QACxC,YAAY,MAAM,WAAW;AAAA,QAC7B,MAAM,MAAM,YAAY;AAAA,QACxB,QAAQ,MAAM,cAAc;AAAA,QAC5B,QAAQ,MAAM,cAAc;AAAA,MAC9B;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AACF;AAEA,SAAS,qBACP,UACgD;AAChD,QAAM,QAAQ,GAAG,SAAS,YAAY;AACtC,MAAI,CAAC,SAAS,SAAS;AACrB,WAAO,EAAE,MAAM;AAAA,EACjB;AAOA,QAAM,oBAAoB,OAAO,SAAS,YAAY,IAAI;AAC1D,QAAM,oBAAoB,OAAO,IAAI,KAAK,SAAS,OAAO,EAAE,QAAQ,CAAC;AACrE,QAAM,sBACF,oBAAoB,oBAAqB,qBAAqB;AAClE,SAAO;AAAA,IACL;AAAA,IACA,GAAI,uBAAuB,KAAK,CAAC,IAAI,EAAE,QAAQ,GAAG,kBAAkB,KAAsB;AAAA,EAC5F;AACF;AAEA,SAAS,cAAc,YAAoB;AACzC,SAAO,gBAAgB,UAAU;AACnC;AAEA,SAAS,wBAAwB,MAAqB,WAAoC;AACxF,SAAO;AAAA,IACL,YAAY,KAAK;AAAA,IACjB,MAAM,qBAAqB,KAAK,QAAQ;AAAA,IACxC,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,cAAc;AAAA,MACd;AAAA,MACA,MAAM;AAAA,QACJ;AAAA,UACE,WAAW,KAAK;AAAA,UAChB,aAAa,KAAK;AAAA,UAClB,QAAQ,KAAK;AAAA,UACb,aAAa;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR,SAAS,sBAAsB,KAAK,aAAa;AAAA,MACjD,eAAe;AAAA,MACf,gBAAgB;AAAA,IAClB;AAAA,IACA,OAAO;AAAA,MACL,QAAQ,+BAA+B,IAAI;AAAA,MAC3C,GAAI,KAAK,SAAS,SAAS,SAAS,EAAE,kBAAkB,EAAE,IAAI,CAAC;AAAA,IACjE;AAAA,IACA,MAAM;AAAA,MACJ,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,iBAAiB,KAAK;AAAA,MACtB,MAAM,KAAK;AAAA,IACb;AAAA,EACF;AACF;AAEA,SAAS,+BAA+B,MAA8B;AACpE,MAAI,KAAK,WAAW,SAAU,QAAO;AACrC,MAAI,CAAC,6BAA6B,IAAI,EAAG,QAAO;AAChD,QAAM,UAAU,KAAK,SAAS;AAC9B,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,QAAM,SAAS;AACf,SAAO,OAAO,kBAAkB,SAAS,OAAO,qBAAqB;AACvE;AAEA,SAAS,8BAA8B,SAAiD;AACtF,SAAO;AAAA,IACL,MAAM,QAAQ;AAAA,IACd,QAAQ,QAAQ;AAAA,IAChB,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD,OAAO,QAAQ,SAAS,CAAC;AAAA,IACzB,GAAI,QAAQ,mBAAmB,EAAE,kBAAkB,QAAQ,iBAAiB,IAAI,CAAC;AAAA,IACjF,GAAI,QAAQ,wBACR,EAAE,uBAAuB,QAAQ,sBAAsB,IACvD,CAAC;AAAA,EACP;AACF;","names":["response","getEnrollment","getEnrollment","enrollment","appendAndPublishEvents","randomUUID","CLAIM_SECONDS","POLL_INTERVAL_MS","PRUNE_EVERY_TICKS","createHash","randomUUID","MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES","withRlsContext","MAX_BOUNDED_OBJECT_CHUNK_BYTES","createHash","createHash","replayedTarget","createHash","MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES","editableArtifactCausalFrontier","editableArtifactContentHash","editableArtifactReplicaId","editableArtifactStateHash","throwIfAborted","createHash","retryWhileMissing","throwIfAborted","withRlsContext","randomUUID","MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES","createHash","MAX_BOUNDED_OBJECT_CHUNK_BYTES","randomUUID"]}