@opengeni/config 0.12.1 → 0.16.1

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\n  BillingMode,\n  CAPABILITY_DESCRIPTORS,\n  Entitlements,\n  EntitlementsMode,\n  LatencyMode,\n  MAX_NESTED_AGENT_DEPTH,\n  ProductAccessMode,\n  ReasoningEffort,\n  SandboxBackend,\n  SessionMcpApprovalPolicy,\n  StaticUsageLimits,\n  TurnExecutionPolicyV1,\n  UsageLimitsMode,\n  type TurnExecutionLatencyModeSourceV1,\n  type TurnExecutionModelSourceV1,\n  type TurnExecutionReasoningSourceV1,\n} from \"@opengeni/contracts\";\nimport { CODEX_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS } from \"@opengeni/codex\";\nimport {\n  CODEX_FALLBACK_MODEL_SLUGS,\n  CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT,\n  CODEX_MODEL_CONTEXT_WINDOW_TOKENS,\n  CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,\n  CODEX_MODEL_ID_PREFIX,\n  CODEX_PROVIDER_BASE_URL,\n  CODEX_PROVIDER_ID,\n} from \"@opengeni/codex/constants\";\nimport { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\nconst envName = /^[A-Za-z_][A-Za-z0-9_]*$/;\nconst registryId = /^[A-Za-z0-9_-]+$/;\nconst EnvBoolean = z.preprocess((value) => {\n  if (typeof value !== \"string\") {\n    return value;\n  }\n  const normalized = value.trim().toLowerCase();\n  if ([\"true\", \"1\", \"yes\", \"y\", \"on\"].includes(normalized)) {\n    return true;\n  }\n  if ([\"false\", \"0\", \"no\", \"n\", \"off\"].includes(normalized)) {\n    return false;\n  }\n  return value;\n}, z.boolean());\n\nexport const sandboxPreparationProfiles: Record<string, { env: string[]; hooks: string[] }> = {\n  none: {\n    env: [],\n    hooks: [],\n  },\n  azure: {\n    env: [\n      \"ARM_CLIENT_ID\",\n      \"ARM_CLIENT_SECRET\",\n      \"ARM_TENANT_ID\",\n      \"ARM_SUBSCRIPTION_ID\",\n      \"AZURE_CLIENT_ID\",\n      \"AZURE_CLIENT_SECRET\",\n      \"AZURE_TENANT_ID\",\n      \"AZURE_SUBSCRIPTION_ID\",\n      \"AZURE_AUTHORITY_HOST\",\n    ],\n    hooks: [\"azure-cli-login\"],\n  },\n  github: {\n    env: [\n      \"GH_TOKEN\",\n      \"GITHUB_TOKEN\",\n      \"GIT_AUTHOR_NAME\",\n      \"GIT_AUTHOR_EMAIL\",\n      \"GIT_COMMITTER_NAME\",\n      \"GIT_COMMITTER_EMAIL\",\n    ],\n    hooks: [],\n  },\n};\n\n/**\n * Placeholder token inside an agent-instructions persona template. The runtime\n * substitutes the non-bypassable CORE (goal-loop ownership + the dynamic\n * workspace-environment block) at this marker. A template that omits the\n * marker still gets the CORE appended after it (a non-bypassable fail-safe),\n * so a white-labelled persona can never drop the goal-loop contract or the\n * environment metadata the agent depends on.\n */\nexport const AGENT_INSTRUCTIONS_CORE_PLACEHOLDER = \"{{core}}\";\n\n/**\n * Default per-workspace agent persona template. This is the BRAND + tool-usage\n * opinion (the white-labellable surface): the \"You are an OpenGeni workspace\n * agent.\" identity line, the framing/opinion lines, and the mount-path facts.\n *\n * The CORE that MUST survive any override — the goal-loop ownership line (which\n * names the opengeni__goal_* tools) and the dynamic workspace-environment block\n * — is injected at AGENT_INSTRUCTIONS_CORE_PLACEHOLDER by the runtime, never\n * baked into this overridable string.\n *\n * INVARIANT: with no per-workspace override and an empty environment, the\n * runtime's composed instructions are byte-for-byte pinned by a runtime test.\n * The template below is joined by \" \", followed by \" \" + the placeholder.\n * Changing a single character here changes that default; update the pin\n * intentionally.\n */\nexport const DEFAULT_AGENT_INSTRUCTIONS = [\n  \"You are an OpenGeni workspace agent.\",\n  \"Follow the user's task and any enabled pack or skill instructions for the current role.\",\n  \"Work inside the sandbox workspace and use filesystem and shell tools when useful.\",\n  \"Repository resources are mounted under repos/<host>/<owner>/<repo> unless the session specifies another collision-free mount path.\",\n  \"File resources are mounted under .opengeni/files/<file-id>/ unless the session specifies another mount path.\",\n  \"Attached files are mounted read-only; copy them before modifying.\",\n  \"Bundled skills are under .agents/ and can include infrastructure, marketing, or other role-specific guidance.\",\n  \"Use Checkov, Terraform, Azure CLI, git provider CLIs, and repository tools when relevant; gh, glab, and az repos are pre-authenticated when the host brokers matching git credentials.\",\n  \"When the Azure sandbox preparation profile is enabled and service-principal variables are present, the sandbox is pre-authenticated with normal Azure CLI before work starts.\",\n  \"Treat code-changing work as GitOps work: create a focused branch/commit/PR when git provider credentials are available; otherwise report exact commands and blockers.\",\n  \"Return concise, factual summaries with files changed, commands run, and remaining blockers.\",\n  AGENT_INSTRUCTIONS_CORE_PLACEHOLDER,\n].join(\" \");\n\nexport const McpServerConnectionRefSchema = z\n  .object({\n    // Standalone ids are UUIDs; embedded hosts may use any stable opaque id.\n    connectionId: z.string().min(1).optional(),\n    provider: z.string().min(1).max(128).optional(),\n    providerDomain: z.string().min(1),\n    kind: z.enum([\"oauth2\", \"api_key\", \"app_install\", \"delegated\"]).optional(),\n    scopes: z.array(z.string().min(1)).optional(),\n    resource: z.string().min(1).optional(),\n    selectedResources: z\n      .array(\n        z\n          .object({\n            id: z.string().min(1).max(512),\n            kind: z.literal(\"repository\"),\n          })\n          .strict(),\n      )\n      .min(1)\n      .max(256)\n      .superRefine((resources, context) => {\n        const seen = new Set<string>();\n        for (const [index, resource] of resources.entries()) {\n          const key = `${resource.kind}\\0${resource.id}`;\n          if (seen.has(key)) {\n            context.addIssue({\n              code: \"custom\",\n              message: \"selectedResources must not contain duplicates\",\n              path: [index],\n            });\n          }\n          seen.add(key);\n        }\n      })\n      .optional(),\n    subjectScope: z.enum([\"workspace\", \"subject\"]).optional(),\n  })\n  .strict()\n  .superRefine((reference, context) => {\n    if (!reference.selectedResources) return;\n    if (!reference.connectionId) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"selectedResources requires connectionId\",\n        path: [\"connectionId\"],\n      });\n    }\n    if (!reference.provider) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"selectedResources requires provider\",\n        path: [\"provider\"],\n      });\n    }\n  });\nexport type McpServerConnectionRef = z.infer<typeof McpServerConnectionRefSchema>;\n\nconst SettingsSchema = z.object({\n  serviceName: z.string().default(\"opengeni\"),\n  environment: z.string().default(\"local\"),\n  deploymentRevision: z.string().default(\"dev\"),\n  // The release-train version baked into official images (OPENGENI_SERVER_VERSION).\n  // Absent on dev/source builds — consumers must treat it as optional.\n  serverVersion: z.string().optional(),\n  databaseUrl: z.string().default(\"postgres://opengeni:opengeni@127.0.0.1:5432/opengeni\"),\n  // Step I (§7.8 runtime half). Dedicated Postgres schema for the EMBEDDED\n  // topology. Default \"\" → standalone: no search_path scoping, server default\n  // (`public`). When set (e.g. \"opengeni\"), the db handle + the managed-auth\n  // pool send `search_path = \"<dbSchema>\",\"opengeni_private\",\"public\"` so every\n  // query resolves into the dedicated schema with NO query rewrite (schema-isolation contract F1).\n  dbSchema: z.string().default(\"\"),\n  // Step I (§7.7). RLS posture. \"force\" (default) = today's FORCE-RLS via the\n  // non-owner `opengeni_app` role. \"scoped\" = the embedded owner-role path (the\n  // GUC is still emitted defensively, so the query path is identical).\n  rlsStrategy: z.enum([\"force\", \"scoped\"]).default(\"force\"),\n  // Exact PostgreSQL login identity required by the standalone FORCE-RLS\n  // startup/readiness assertion. Embedded `scoped` hosts own their role model\n  // and are deliberately not constrained to this name.\n  runtimeDatabaseRole: z.string().min(1).default(\"opengeni_app\"),\n  natsUrl: z.string().default(\"nats://127.0.0.1:4222\"),\n  temporalHost: z.string().default(\"127.0.0.1:7233\"),\n  temporalNamespace: z.string().default(\"default\"),\n  temporalTaskQueue: z.string().default(\"opengeni-runs-ts\"),\n  temporalTlsEnabled: EnvBoolean.default(false),\n  temporalApiKey: z.string().optional(),\n  temporalTlsServerName: z.string().optional(),\n  temporalTlsRootCaCertificateBase64: z.string().optional(),\n  temporalTlsClientCertificateBase64: z.string().optional(),\n  temporalTlsClientPrivateKeyBase64: z.string().optional(),\n  startupDependencyRetryAttempts: z.coerce.number().int().positive().default(30),\n  startupDependencyRetryInitialDelayMs: z.coerce.number().int().positive().default(1000),\n  startupDependencyRetryMaxDelayMs: z.coerce.number().int().positive().default(5000),\n  turnWorkerConcurrencyMode: z.enum([\"fixed\", \"resource-based\"]).default(\"fixed\"),\n  turnWorkerMaxConcurrentTurns: z.coerce.number().int().positive().max(2_000).default(16),\n  turnWorkerTargetCpuUsage: z.coerce.number().positive().max(1).default(0.8),\n  turnWorkerTargetMemoryUsage: z.coerce.number().positive().max(0.8).default(0.75),\n  observabilityStructuredLogs: EnvBoolean.default(false),\n  observabilityMetricsEnabled: EnvBoolean.default(true),\n  observabilityOtlpEndpoint: z.string().url().optional(),\n  observabilityOtlpHeaders: z.string().default(\"\"),\n  analyticsEnabled: EnvBoolean.default(false),\n  analyticsConsentRequired: EnvBoolean.default(true),\n  analyticsReoClientId: z\n    .string()\n    .max(128)\n    .regex(/^[A-Za-z0-9_-]+$/u)\n    .optional(),\n  analyticsPosthogProjectKey: z.string().min(1).max(256).optional(),\n  analyticsPosthogHost: z.string().url().max(2_048).optional(),\n  analyticsGa4MeasurementId: z\n    .string()\n    .max(32)\n    .regex(/^G-[A-Z0-9]+$/u)\n    .optional(),\n  publicBaseUrl: z.string().url().optional(),\n  // Browser origin when the web app and API use separate origins in local\n  // development. Production normally leaves this unset and uses publicBaseUrl.\n  webBaseUrl: z.string().url().optional(),\n  // Base URL for the bring-your-own-compute agent release assets the get.<domain>\n  // install routes redirect to. Defaults to this repo's GitHub Releases. The route\n  // appends `/download/agent-v<ver>/<asset>`.\n  agentReleasesBaseUrl: z\n    .string()\n    .url()\n    .default(\"https://github.com/Cloudgeni-ai/opengeni/releases\"),\n  // Explicit operator-controlled promotion pointer for `/agent/latest/*`.\n  // Versioned agent releases are immutable; changing this setting promotes or\n  // rolls back the stable channel without moving or deleting a provider tag.\n  agentStableVersion: z\n    .string()\n    .regex(/^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$/u)\n    .default(\"0.1.12\"),\n  // Optional independent beta-channel pointer. When unset, the beta update\n  // manifest route is unavailable rather than silently serving stable.\n  agentBetaVersion: z\n    .string()\n    .regex(/^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$/u)\n    .optional(),\n  productAccessMode: ProductAccessMode.default(\"local\"),\n  billingMode: BillingMode.default(\"disabled\"),\n  entitlementsMode: EntitlementsMode.default(\"none\"),\n  usageLimitsMode: UsageLimitsMode.default(\"none\"),\n  staticEntitlementsJson: z.string().default(\"{}\"),\n  staticUsageLimitsJson: z.string().default(\"{}\"),\n  delegationSecret: z.string().optional(),\n  // sandbox workspace scoped stream-token HMAC secret (sandbox contract §C.3 / stream-token availability contract).\n  // When unset, the API falls back to `delegationSecret` (the same HMAC envelope\n  // family, `ogs_` vs `ogd_` prefix). REQUIRED-WHEN-DESKTOP, but the absence of\n  // BOTH while sandboxDesktopEnabled=true is a GRACEFUL DEGRADE (DesktopStream\n  // transport:null + a loud boot warning), NOT a hard boot-fail (stream-token availability contract).\n  streamTokenSecret: z.string().optional(),\n  // The desktop input plane (raw stream:control writes) is OFF in v1: even a\n  // holder of stream:control gets 403 until this flips. Keeps stream:control a\n  // declared-but-inert permission so later hardening is a flag flip.\n  streamControlEnabled: EnvBoolean.default(false),\n  toolspaceEnabled: EnvBoolean.default(false),\n  toolspaceMaxCallsPerTurn: z.coerce.number().int().positive().default(200),\n  // Optional release-coherent bootstrap hint for custom rigs/connected machines\n  // that do not carry the stock-image ogtool binary. Exact stable versions only:\n  // the agent must never guess a tag or silently install `latest`.\n  ogtoolPackageSpec: z\n    .string()\n    .regex(/^@opengeni\\/ogtool@(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$/u)\n    .optional(),\n  environmentsEncryptionKey: z.string().optional(),\n  integrationsEnabled: EnvBoolean.default(false),\n  integrationsStateSecret: z.string().optional(),\n  integrationsAllowPrivateNetworkTargets: EnvBoolean.default(false),\n  integrationsOauthClientsJson: z.string().default(\"{}\"),\n  slackClientId: z.string().optional(),\n  slackClientSecret: z.string().optional(),\n  slackSigningSecret: z.string().optional(),\n  googleDriveClientId: z.string().optional(),\n  googleDriveClientSecret: z.string().optional(),\n  // Undefined is meaningful: the migration boundary persists the product\n  // default of 3 when no deployment override is supplied.\n  maxNestedAgentDepth: z.coerce.number().int().nonnegative().max(MAX_NESTED_AGENT_DEPTH).optional(),\n  // Operator OAuth apps for first-party social connectors, keyed by provider\n  // id (\"x\", \"reddit\"): {\"x\":{\"clientId\":\"...\",\"clientSecret\":\"...\"}}.\n  socialOauthClientsJson: z.string().default(\"{}\"),\n  // Session goal guard rails. Goals are designed for runs that legitimately\n  // span days, so length is bounded by pathology detection (no-progress\n  // streaks, budget exhaustion), never by count. goalMaxAutoContinuations is\n  // therefore UNSET by default (no cap); deployments may configure one, and\n  // it then acts as a hard ceiling that per-goal overrides can only lower.\n  goalMaxAutoContinuations: z.coerce.number().int().positive().optional(),\n  goalNoProgressLimit: z.coerce.number().int().positive().default(3),\n  // Per-segment ceiling on agent loop turns (model calls) within a single\n  // session turn. Effectively unbounded by default for the same reason as\n  // above; the graceful max-turns valve (idle + goal continuation, never a\n  // session failure) remains as inert safety should a deployment set a cap.\n  agentMaxModelCallsPerTurn: z.coerce.number().int().positive().default(1_000_000),\n  // The model family's real context window in tokens. OpenGeni always performs\n  // one durable, portable plaintext compaction transition; there is no\n  // provider/server/off mode ladder.\n  contextWindowTokens: z.coerce.number().int().positive().default(1_050_000),\n  // Optional model-catalog effective input ceiling. Codex models expose this as\n  // raw context_window * effective_context_window_percent; when absent, retain\n  // the deployment-level window-minus-reserved-output behavior.\n  contextEffectiveWindowTokens: z.coerce.number().int().positive().optional(),\n  // Proactive compaction threshold as a ratio of the model context window.\n  // Defaults to 90%: compact as late as possible — retained context beats early\n  // headroom now that per-model windows are declared honestly (input-effective,\n  // empirically measured), and the fail-closed reactive compact-on-reject path\n  // absorbs any overshoot as one retried call rather than a dead session.\n  // Clamped to [0.3, 0.9] so deployments can tune the trigger without\n  // accidentally disabling compaction.\n  contextCompactionThresholdRatio: z.coerce\n    .number()\n    .default(0.9)\n    .transform((value) => {\n      if (!Number.isFinite(value)) {\n        return 0.9;\n      }\n      return Math.min(0.9, Math.max(0.3, value));\n    }),\n  // Tokens reserved for model output; subtracted from the window to get the\n  // usable input budget B = contextWindowTokens - contextReservedOutputTokens.\n  contextReservedOutputTokens: z.coerce.number().int().nonnegative().default(128_000),\n  // Model-catalog auto-compact limit. When present it is clamped to\n  // 90% of the raw window, matching Codex core's auto_compact_token_limit().\n  contextAutoCompactThresholdTokens: z.coerce.number().int().positive().optional(),\n  // Provider-neutral fallback for canonical model-facing tool-result text.\n  // The current stable Codex catalog policy is 10k tokens; the truncator adds\n  // Codex's 1.2x JSON serialization allowance when applying it.\n  modelToolOutputTruncationTokens: z.coerce.number().int().positive().default(10_000),\n  authRequired: EnvBoolean.default(false),\n  accessKey: z.string().optional(),\n  authAllowHealth: EnvBoolean.default(true),\n  authAllowMetrics: EnvBoolean.default(false),\n  apiHost: z.string().default(\"0.0.0.0\"),\n  apiPort: z.coerce.number().int().positive().default(8000),\n  workerHttpPort: z.coerce.number().int().positive().default(8001),\n  opengeniMcpUrl: z.string().url().optional(),\n  // Origins allowed to send browser cookies cross-origin. Other origins may\n  // call the public API with bearer credentials, but never receive credentialed\n  // CORS responses.\n  corsAllowOriginRegex: z.string().default(String.raw`^https?://(localhost|127\\.0\\.0\\.1)(:\\d+)?$`),\n  openaiProvider: z.enum([\"openai\", \"azure\"]).default(\"openai\"),\n  openaiApiKey: z.string().optional(),\n  openaiBaseUrl: z.string().optional(),\n  openaiModel: z.string().default(\"gpt-5.6-sol\"),\n  openaiAllowedModels: z.string().default(\"gpt-5.6-sol,gpt-5.6-terra,gpt-5.6-luna\"),\n  // OpenGeni-managed Vercel AI Gateway. When configured, the two reviewed\n  // Gateway models below are added to the managed-credit catalog. Workspace\n  // Gateway keys use the encrypted connection broker and never this secret.\n  vercelAiGatewayApiKey: z.string().optional(),\n  // Native composer voice input (browser MediaRecorder → API transcription).\n  // Provider credentials stay server-side; ClientConfig only projects availability\n  // and hard ceilings. Selection happens once before audio is sent — never retry\n  // the same clip across vendors after an upstream request may have started.\n  voiceInputMaxDurationSeconds: z.coerce.number().int().positive().max(600).default(60),\n  voiceInputMaxSizeBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(25 * 1024 * 1024)\n    .default(25 * 1024 * 1024),\n  // Durable long-form capture uploads bounded chunks to object storage, then\n  // normalizes them into provider-safe segments. It is advertised only when\n  // object storage and the configured ffmpeg executable are both available.\n  voiceInputResumableEnabled: EnvBoolean.default(true),\n  voiceInputResumableMaxDurationSeconds: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(8 * 60 * 60)\n    .default(2 * 60 * 60),\n  voiceInputResumableMaxSizeBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(512 * 1024 * 1024)\n    .default(512 * 1024 * 1024),\n  voiceInputResumableMaxChunkSizeBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(25 * 1024 * 1024)\n    .default(8 * 1024 * 1024),\n  voiceInputResumableRetentionSeconds: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(7 * 24 * 60 * 60)\n    .default(24 * 60 * 60),\n  voiceInputFfmpegPath: z.string().trim().min(1).max(1024).default(\"ffmpeg\"),\n  // Preferred provider order (comma-separated ids). First configured+ready wins.\n  // Codex subscription STT is preferred by default when subscription routing is\n  // enabled; operators can put openai/azure-openai first explicitly.\n  // Supported: openai, azure-openai, codex-subscription.\n  voiceInputProviderOrder: z.string().default(\"codex-subscription,openai,azure-openai\"),\n  // OpenAI public /v1/audio/transcriptions path. Reuses OPENGENI_OPENAI_API_KEY\n  // when voiceInputOpenaiApiKey is unset. Default model is gpt-transcribe.\n  voiceInputOpenaiEnabled: EnvBoolean.default(true),\n  voiceInputOpenaiApiKey: z.string().optional(),\n  voiceInputOpenaiBaseUrl: z.string().optional(),\n  voiceInputOpenaiModel: z.string().default(\"gpt-transcribe\"),\n  // Azure OpenAI deployment-scoped audio transcriptions. Reuses the turn-model\n  // Azure endpoint/key/AD token when voice-specific overrides are unset.\n  voiceInputAzureEnabled: EnvBoolean.default(true),\n  voiceInputAzureEndpoint: z.string().optional(),\n  voiceInputAzureDeployment: z.string().optional(),\n  voiceInputAzureApiVersion: z.string().optional(),\n  voiceInputAzureApiKey: z.string().optional(),\n  voiceInputAzureAdToken: z.string().optional(),\n  // Legacy opt-in for undocumented ChatGPT /backend-api/transcribe. When\n  // OPENGENI_CODEX_SUBSCRIPTION_ENABLED is true, Codex STT is included without\n  // this flag. Set false and omit codex-subscription from PROVIDER_ORDER to\n  // keep subscription model routing while disabling Codex voice input.\n  voiceInputCodexExperimentalEnabled: EnvBoolean.default(false),\n  modelPricingJson: z.string().default(\"{}\"),\n  // Extra (non-built-in) model providers, declared by the host as a JSON\n  // provider registry. Each entry carries its own base URL, API key, wire API\n  // (\"responses\" | \"chat\") and the models it exposes. The models a client may\n  // use are the UNION of the built-in provider's allowed models and every\n  // registry provider's models. validateSettings parses this at boot so a\n  // malformed registry / unresolvable key / id collision fails fast.\n  modelProvidersJson: z.string().default(\"[]\"),\n  // Codex (ChatGPT) subscription: when enabled, a per-workspace connected\n  // subscription is injected as a synthetic \"codex-subscription\" registry\n  // provider whose models route through the ChatGPT backend (@opengeni/codex).\n  codexSubscriptionEnabled: EnvBoolean.default(false), // OPENGENI_CODEX_SUBSCRIPTION_ENABLED\n  // Expose the connected apps attached to a Codex subscription through the\n  // synthetic codex_apps MCP server. Independent from subscription routing so\n  // operators can use Codex models without exposing ChatGPT connectors.\n  codexConnectedAppsEnabled: EnvBoolean.default(false), // OPENGENI_CODEX_CONNECTED_APPS_ENABLED\n  codexProductSku: z.string().optional(), // OPENGENI_CODEX_PRODUCT_SKU (X-OpenAI-Product-Sku, apps only)\n  // Progressive MCP disclosure (Codex-CLI-style tool_search): on a codex turn,\n  // flag non-mandatory selected MCP tools `defer_loading:true` (dropping their\n  // schemas from model context) and add one client-executed tool_search tool\n  // that BM25-discloses bounded matches. The mandatory OpenGeni tools stay\n  // eager. Default ON so selected connector catalogues do not consume every\n  // Codex turn's context. Operators may explicitly disable it for emergency\n  // compatibility diagnosis.\n  // OPENGENI_CODEX_TOOL_SEARCH_ENABLED\n  codexToolSearchEnabled: EnvBoolean.default(true),\n  // credential allocator atomic, workspace-local credential allocation. Default OFF is a\n  // deliberate rolling-deploy fence: migrate + roll every worker first, then\n  // enable. Turning it off restores the legacy sticky selector without a schema\n  // rollback; the additive lease table/cursor columns become inert.\n  codexCredentialLeasingEnabled: EnvBoolean.default(false),\n  // Decision-observability fence. When enabled, the worker emits one\n  // bounded, metadata-only adaptive-policy replay record alongside the unchanged\n  // sticky-sharded decision. It never changes placement/admission/failover.\n  codexFleetPolicyShadowEnabled: EnvBoolean.default(false),\n  // Multi-account P3 (auto-rotation): an account is \"near exhaustion\" — ineligible to be\n  // rotated TO — when EITHER usage window (5h/weekly) is at/over this percent. Default 90 to\n  // match the UI danger flip (UsageBar danger at pct >= 90). OPENGENI_CODEX_ROTATION_NEAR_EXHAUSTION_PCT.\n  codexRotationNearExhaustionPct: z.coerce.number().int().min(1).max(100).default(90),\n  openaiReasoningEffort: ReasoningEffort.default(\"low\"),\n  openaiAllowedReasoningEfforts: z.string().default(\"low,medium,high,xhigh,max\"),\n  openaiResponsesTransport: z.enum([\"http\", \"websocket\"]).default(\"http\"),\n  // Provider-assigned item ids (rs_/msg_/fc_…) in Responses API input are\n  // resolved against the provider's server-side response store. That store is\n  // not durable enough to anchor long runs on: a response that streamed fine\n  // can be missing from the store on the very next model call, which then\n  // fails with 400 \"Item with id ... not found\". \"strip\" removes the ids from\n  // every model-call input so requests are self-contained — conversation\n  // truth already lives client-side in session_history_items. \"preserve\"\n  // keeps the SDK's pass-through behavior.\n  openaiProviderItemIds: z.enum([\"strip\", \"preserve\"]).default(\"strip\"),\n  // With ids stripped the provider cannot resolve prior reasoning server-side,\n  // so request reasoning.encrypted_content and send it back with each call:\n  // reasoning continuity without depending on provider-side storage.\n  openaiReasoningEncryptedContent: EnvBoolean.default(true),\n  // Model-call retry budget for transient provider failures (429s and friends).\n  // The openai client default of 2 retries is too small for sustained TPM\n  // backpressure during long autonomous runs.\n  openaiMaxRetries: z.coerce.number().int().nonnegative().default(5),\n  // Native hosted web search. The live Azure Responses path executes the\n  // hosted web_search tool, so this is provider-unconditional: ON by default\n  // on every provider, exposed only so operators can disable it. When true,\n  // buildOpenGeniAgent attaches webSearchTool() to the agent's tools — it is\n  // merged with the MCP-server tools (getAllTools = [...mcpTools, ...tools])\n  // and the sandbox capability tools, never replacing them.\n  webSearchEnabled: EnvBoolean.default(true),\n  // Deployment-default agent persona template (the white-label surface). The\n  // runtime resolves the effective template per turn as\n  // per-session-override > per-workspace override > this default, substitutes\n  // the non-bypassable CORE at AGENT_INSTRUCTIONS_CORE_PLACEHOLDER (or appends\n  // it when the template omits the marker), and uses the result as the agent's\n  // instructions. Defaulting to DEFAULT_AGENT_INSTRUCTIONS keeps the composed\n  // default pinned by runtime tests.\n  agentInstructionsTemplate: z.string().default(DEFAULT_AGENT_INSTRUCTIONS),\n  azureOpenaiBaseUrl: z.string().optional(),\n  azureOpenaiEndpoint: z.string().optional(),\n  azureOpenaiDeployment: z.string().optional(),\n  azureOpenaiApiVersion: z.string().optional(),\n  azureOpenaiApiKey: z.string().optional(),\n  azureOpenaiAdToken: z.string().optional(),\n  disableOpenaiTracing: EnvBoolean.default(false),\n  sandboxBackend: SandboxBackend.default(\"docker\"),\n  dockerImage: z.string().default(\"opengeni-sandbox:local\"),\n  dockerExposedPorts: z.string().default(\"\"),\n  dockerNetwork: z.string().optional(),\n  // When the worker itself runs in a container and talks to a host Docker daemon,\n  // this directory must be bind-mounted at the exact same absolute path on both\n  // sides. The Agents SDK materializes the workspace here before bind-mounting it\n  // into the sandbox container.\n  dockerWorkspaceBaseDir: z.string().min(1).optional(),\n  modalAppName: z.string().default(\"opengeni-sandbox\"),\n  modalImageRef: z.string().optional(),\n  // Provider-native immutable Modal image ID for the exact logical\n  // `modalImageRef`. When set, the runtime uses ModalImageSelector.fromId and\n  // never asks Modal to parse or import the registry ref. The logical ref is\n  // still persisted on the sandbox lease for provenance and conflict fencing;\n  // the Modal session envelope persists the actual image ID.\n  modalImageId: z\n    .string()\n    .regex(/^im-[A-Za-z0-9]{22}$/)\n    .optional(),\n  // Name of a Modal Secret (containing REGISTRY_USERNAME + REGISTRY_PASSWORD) used\n  // to authenticate the pull of `modalImageRef` from a PRIVATE registry. When UNSET\n  // (the default), the sandbox image is pulled UNAUTHENTICATED — i.e. it must be a\n  // PUBLIC registry tag, which is the only shape the Agents-extension Modal backend\n  // supports out of the box (`Image.fromRegistry(tag)` with no secret). Set this to\n  // run a private image (e.g. a cloud-hosted ACR/ECR/GCR digest): the runtime resolves\n  // the named Secret and builds the image via `fromRegistry(tag, secret)` before the\n  // first sandbox is created. Knob: OPENGENI_MODAL_IMAGE_REGISTRY_SECRET.\n  modalImageRegistrySecret: z.string().optional(),\n  // Modal's hard sandbox lifetime (timeoutMs = this * 1000), counted from box\n  // creation. A resume-by-id does NOT reset that provider clock. It is the\n  // BACKSTOP that reclaims a box if the reaper/worker is down, NOT the warm-window\n  // controller (that's sandboxIdleGraceMs). It must comfortably exceed\n  // reaperPeriod + idleGrace so the reaper terminates a genuinely-idle box FIRST;\n  // the boot invariant below enforces that. Default 24h, Modal's documented\n  // maximum, to reduce premature active-box loss and leave headroom for the\n  // deadline-aware snapshot/rematerialization transition. The transition—not a\n  // larger timeout—is what lets a session outlive one finite provider box.\n  // Knob: OPENGENI_MODAL_TIMEOUT_SECONDS.\n  modalTimeoutSeconds: z.coerce.number().int().positive().max(86_400).default(86_400),\n  modalTokenId: z.string().optional(),\n  modalTokenSecret: z.string().optional(),\n  modalEnvironment: z.string().optional(),\n  // modal gap-fill: idleTimeoutMs + workspacePersistence were unmapped (module 03 §4.1).\n  //\n  // CRITICAL (sandbox-file-persistence): when this is UNSET the Modal SDK sends\n  // idleTimeoutSecs=undefined, so Modal applies its OWN short server-default idle\n  // timeout (~minutes) — and a box between turns sits with NO active connection,\n  // so that idle clock runs and Modal idle-reaps the box LONG before OpenGeni's\n  // own reaper waits out sandboxIdleGraceMs (15min) to resume+persist+terminate\n  // it. The observed failure: every drain logs \"drainable box already gone\n  // (NotFound on resume)\", persistWorkspace() never fires, /workspace is lost.\n  // Modal's idle-reap is a SECOND reaper racing OpenGeni's — and it wins. The fix:\n  // OpenGeni OWNS box lifecycle via its reaper + the hard modalTimeoutSeconds\n  // backstop, so the Modal idle-reap must NOT fire first. We default the effective\n  // idle timeout to the hard lifetime (effectiveModalIdleTimeoutSeconds), making\n  // the box survive its full warm window so the reaper can snapshot it. Set this\n  // explicitly (OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS) only to deliberately idle-reap\n  // SOONER than the hard lifetime; the boot invariant forbids a value that would\n  // reap before reaperPeriod + idleGrace elapses.\n  modalIdleTimeoutSeconds: z.coerce.number().int().positive().optional(),\n  // /workspace FILE PERSISTENCE across warm/cold cycles. Defaults to\n  // `snapshot_filesystem` so EVERY box is created persistence-capable: the reaper\n  // snapshots the live box before it terminates a drained group, and a later\n  // cold-restore hydrates a fresh box from that snapshot (sandbox-file-persistence).\n  // `snapshot_filesystem` requires the manifest declare NO ephemeralPersistencePaths\n  // (buildManifest never sets entry.ephemeral, so it never downgrades to tar). Set\n  // OPENGENI_MODAL_WORKSPACE_PERSISTENCE=tar to opt back out (no native snapshot;\n  // the reaper persists a tar archive — same store+hydrate plumbing, slower).\n  modalWorkspacePersistence: z\n    .enum([\"tar\", \"snapshot_filesystem\", \"snapshot_directory\"])\n    .default(\"snapshot_filesystem\"),\n  // Shared desktop toggle: this module reads it for the 6080 port-merge; the\n  // owner module (P4.x) acts on it to launch the display stack.\n  sandboxDesktopEnabled: EnvBoolean.default(false),\n  // Human take-control toggle: when ON (default) the negotiated DesktopStream\n  // cell advertises mode \"interactive\" — the noVNC viewer can drive mouse+keyboard\n  // into :0 (x11vnc runs without -viewonly). Turn it OFF for a genuinely read-only\n  // deployment: the cell reports mode \"read-only\" and the client disables the\n  // \"Take control\" affordance. Independent of computerUseReadOnly (the AGENT\n  // driver); this gates the HUMAN viewer plane.\n  sandboxDesktopInteractive: EnvBoolean.default(true),\n  // REAL PTY terminal toggle (P5.t): gates the ttyd pty-ws plane (7681) the API\n  // mints over the SAME tunnel as the desktop. Defaults ON — the interactive\n  // terminal is a baseline structured-service surface (unlike the heavier desktop\n  // pixel plane); a deployment can turn it off to fall back to the read-only\n  // sse-events command firehose. The 7681 port-merge tracks sandboxDesktopEnabled\n  // (a desktop-capable image is the one that bakes ttyd).\n  sandboxTerminalEnabled: EnvBoolean.default(true),\n  // The desktop framebuffer geometry the pixel plane advertises + launches the\n  // display stack with (P4.2). v1 has no live RANDR resize; a change is a full\n  // down→up restart. Defaults match the proven spike geometry (1280x800).\n  streamResolutionWidth: z.coerce.number().int().positive().default(1280),\n  streamResolutionHeight: z.coerce.number().int().positive().default(800),\n  // P4.3 computer-use: the agent drives the SAME :0 humans watch (xdotool/XTEST +\n  // scrot). Gated by sandboxDesktopEnabled + a desktop-capable backend in\n  // buildAgentCapabilities; computerUseReadOnly:false is the agent-driver default\n  // (it must click/type — the human viewer plane is the read-only one).\n  computerUseEnabled: EnvBoolean.default(true),\n  computerUseReadOnly: EnvBoolean.default(false),\n  // P4.3 recording loop: ffmpeg x11grab of :0 → mp4/webm → @opengeni/storage.\n  // recordingMaxBytes caps the in-memory finalize buffer (≤ storage single-PUT);\n  // recordingMaxSeconds is the ffmpeg -t hard ceiling (bounds a multi-day turn).\n  recordingEnabled: EnvBoolean.default(true),\n  recordingDefaultCodec: z.enum([\"h264-mp4\", \"vp9-webm\"]).default(\"h264-mp4\"),\n  // Workbench v2 turn-end workspace capture. When on, the turn\n  // activity probes the box's changed files off the live box at turn end and\n  // persists a capture revision (blobs in @opengeni/storage) so the workbench\n  // paints cold/offline sessions with zero machine round-trips. Best-effort and\n  // fully behind this flag: off ⇒ capture is skipped and reads fall back to the\n  // live/wake path (status-quo behavior). Default on; explicit per environment.\n  workspaceCaptureEnabled: EnvBoolean.default(true),\n  recordingFramerate: z.coerce.number().int().positive().default(15),\n  recordingMaxSeconds: z.coerce.number().int().positive().default(600),\n  recordingMaxBytes: z.coerce.number().int().positive().default(268_435_456), // 256 MB\n  // --- daytona ---\n  daytonaApiKey: z.string().optional(),\n  daytonaApiUrl: z.string().url().optional(),\n  daytonaTarget: z.string().optional(),\n  daytonaImage: z.string().optional(),\n  daytonaSnapshotName: z.string().optional(),\n  daytonaAutoStopInterval: z.coerce.number().int().nonnegative().optional(), // 0 disables idle-kill\n  daytonaTimeoutSeconds: z.coerce.number().int().positive().optional(),\n  daytonaExposedPortUrlTtlSeconds: z.coerce.number().int().positive().optional(),\n  // --- runloop ---\n  runloopApiKey: z.string().optional(),\n  runloopBaseUrl: z.string().url().optional(),\n  runloopBlueprintName: z.string().optional(),\n  runloopBlueprintId: z.string().optional(),\n  runloopTunnel: EnvBoolean.default(true),\n  runloopKeepAliveSeconds: z.coerce.number().int().positive().optional(),\n  // --- e2b (SDK reads E2B_API_KEY from env; mirrored for validation + forwarding) ---\n  e2bApiKey: z.string().optional(),\n  e2bTemplate: z.string().optional(),\n  e2bTimeoutSeconds: z.coerce.number().int().positive().optional(),\n  e2bTimeoutAction: z.enum([\"pause\", \"kill\"]).optional(),\n  e2bAllowInternetAccess: EnvBoolean.optional(),\n  e2bAutoResume: EnvBoolean.optional(),\n  e2bWorkspacePersistence: z.enum([\"tar\", \"snapshot\"]).optional(),\n  // --- blaxel ---\n  blaxelApiKey: z.string().optional(),\n  blaxelImage: z.string().optional(),\n  blaxelRegion: z.string().optional(),\n  blaxelExposedPortPublic: EnvBoolean.optional(), // public vs bl_preview_token\n  blaxelExposedPortUrlTtlSeconds: z.coerce.number().int().positive().optional(),\n  blaxelMemoryMb: z.coerce.number().int().positive().optional(),\n  blaxelTtl: z.string().optional(),\n  // --- cloudflare (headless) ---\n  cloudflareWorkerUrl: z.string().url().optional(),\n  cloudflareApiKey: z.string().optional(),\n  // --- vercel (headless) ---\n  vercelToken: z.string().optional(),\n  vercelProjectId: z.string().optional(),\n  vercelTeamId: z.string().optional(),\n  vercelRuntime: z.string().optional(),\n  // --- sandbox ownership inversion (P1.2 rollout flag, default OFF) ---\n  // The keystone flag for the stateless resume-by-id model. When FALSE the\n  // agent-turn path is BYTE-FOR-BYTE today's build-and-discard behavior (no\n  // lease acquire, no resume-by-id, no non-owned injection). When TRUE the turn\n  // activity acquires the group lease, resumes the one box by id from the lease\n  // envelope, injects it as a NON-OWNED RunConfig session (the SDK never reaps\n  // it — the proven keystone), and releases the holder in finally. Uses\n  // EnvBoolean (NOT z.coerce.boolean(), which would coerce \"false\" -> true and\n  // turn the flag ON the moment anyone set the env var to disable it).\n  sandboxOwnershipEnabled: EnvBoolean.default(false),\n  // --- standalone rig-verifier ownership rollout flag, default OFF ---\n  // Rig verification creates a throwaway provider sandbox outside the normal\n  // session-turn path. When enabled, that sandbox must first acquire the same\n  // durable lease lifecycle used by session boxes so the global orphan sweep\n  // recognizes its exact provider instance. Keep this separate from the general\n  // sandboxOwnershipEnabled rollout: every reaper worker must understand verifier\n  // leases before dispatch is enabled. When false the verifier fails closed before\n  // provider create; it never falls back to the legacy unowned path.\n  rigVerificationLeaseOwnershipEnabled: EnvBoolean.default(false),\n  // --- lazy sandbox provisioning rollout flag, default OFF ---\n  // Only effective when sandboxOwnershipEnabled is ALSO on (lazy provisioning is a\n  // property of the owned path — the SDK never creates/resumes an injected session,\n  // so we control when the box is established). When TRUE, a turn does NOT provision\n  // its box at turn start: the lease acquire + resume-by-id + hooks + downloads +\n  // heartbeat + recording are deferred to an in-process single-flight provisioner\n  // that runs the FIRST time a sandbox op is dispatched (via the routing proxy's\n  // resolveActiveBackend). A turn whose model never calls a sandbox-backed tool ends\n  // with NO lease row and ZERO warm-seconds. When FALSE (or ownership off) the turn\n  // provisions eagerly exactly as today — byte-for-byte. EnvBoolean (NOT\n  // z.coerce.boolean(), which coerces \"false\" -> true and would turn the flag ON the\n  // moment anyone set the env var to disable it).\n  sandboxLazyProvisionEnabled: EnvBoolean.default(false),\n  // --- bring-your-own-compute (selfhosted 11th backend) rollout flag, default OFF ---\n  // The keystone flag for the whole selfhosted feature (the enrollment device-flow,\n  // the NATS control plane, the relay stream tier). When FALSE the enrollment routes\n  // 404 (invisible — the surface does not exist for this deployment) and the\n  // selfhosted backend is inert; boot is unaffected. EnvBoolean (NOT\n  // z.coerce.boolean(), which coerces \"false\" -> true). Flipped per-environment via\n  // the deploy-staging IaC secret/configmap pattern.\n  sandboxSelfhostedEnabled: EnvBoolean.default(false),\n  // Gates the op-stream (streaming exec) transport to Connected Machines. The\n  // runner must ALSO advertise Capabilities.op_stream. Streaming is the default\n  // because it is the only transport that can keep a command alive without an\n  // arbitrary request/reply wall while still supporting replay and cancellation.\n  // Older runners remain usable when an explicit positive exec timeout is set.\n  // EnvBoolean (NOT\n  // z.coerce.boolean(), which coerces \"false\" -> true).\n  agentOpStreamEnabled: EnvBoolean.default(true),\n  // The HMAC secret the control plane signs the enrollment bearer credential with\n  // (the `oge_` envelope the agent presents back to the control plane). Optional:\n  // when ABSENT and sandboxSelfhostedEnabled is on, the poll route reports the\n  // credential plane disabled (graceful degrade, mirrors streamTokenSecret). NEVER\n  // logged. Lives in the opengeni-runtime secret (Helm-clobbered configmap avoided).\n  enrollmentSigningSecret: z.string().optional(),\n  // Connect-info the EnrollmentCredentials hand the agent: the NATS server URL(s)\n  // the agent dials for the control plane, and the relay edge base URL for streams.\n  // The per-workspace NATS Account creds binding is infra-deferred (M4/relay\n  // milestone) — the poll returns these endpoints + a placeholder creds field.\n  selfhostedNatsUrl: z.string().optional(),\n  selfhostedRelayUrl: z.string().optional(),\n  // The HMAC secret the control plane signs the agent's relay PRODUCER token with\n  // (the `ogr_` envelope threaded into EnrollmentCredentials.relayToken; M8b/design\n  // §10.5). The relay verifies the producer token with the SAME secret. Optional:\n  // when ABSENT the poll returns an empty relayToken (graceful degrade — the stream\n  // plane is simply unavailable until configured). Falls back to streamTokenSecret /\n  // delegationSecret (same HMAC family) so a deployment with a stream-token secret\n  // needs no second one. NEVER logged. Lives in the opengeni-runtime secret.\n  selfhostedRelayTokenSecret: z.string().optional(),\n  // The minisign PUBLIC key the agent pins for self-update verification (handed to\n  // the agent in EnrollmentCredentials; the SECRET key lives only in CI).\n  agentUpdatePublicKey: z.string().optional(),\n  // --- NATS auth-callout tenancy boundary (bring-your-own-compute M-AUTH; design\n  //     §10.1 NATS Accounts per workspace + §17 the isolation smoke) -------------\n  // nats-server is configured with AUTH CALLOUT: an external agent connects\n  // presenting its `oge_` enrollment bearer as the connect auth-token; the server\n  // issues an authorization request on $SYS.REQ.USER.AUTH to our responder, which\n  // validates the bearer and returns a SIGNED NATS user JWT scoped to pub/sub ONLY\n  // `agent.<ws>.>` (+ `_INBOX.>`). That per-subject scope IS the per-workspace\n  // isolation. These are deployment-level secrets in the opengeni-runtime secret\n  // (Helm-clobbered configmap avoided), all OPTIONAL: when the callout plane is not\n  // configured the responder simply does not start (selfhosted agents cannot\n  // connect — graceful, never a boot-fail).\n  //\n  // The callout account SIGNING SEED (`SA...`). Both the user JWT and the\n  // authorization-response JWT are signed by this account key; its public key\n  // (`A...`) is the `auth_callout.issuer` in the server config. NEVER logged.\n  selfhostedNatsCalloutAccountSeed: z.string().optional(),\n  // The TARGET ACCOUNT NAME the minted user is placed into (the server-config-mode\n  // `auth_callout.account`, e.g. \"APP\"). The responder writes it as the minted user\n  // JWT `aud` so nats-server binds the agent to this account — the SAME account the\n  // privileged control plane connects into, so `agent.<ws>.<id>.rpc` request/reply\n  // routes. Optional; resolveNatsCalloutConfig defaults it to \"APP\".\n  selfhostedNatsCalloutAccountName: z.string().optional(),\n  // The callout RESPONDER's own NATS login (one of the `auth_callout.auth_users`\n  // in the AUTH account) — the responder connects with this to subscribe\n  // $SYS.REQ.USER.AUTH. Username/password.\n  selfhostedNatsCalloutUser: z.string().optional(),\n  selfhostedNatsCalloutPassword: z.string().optional(),\n  // The PRIVILEGED control-plane login (api/worker): a static account user that may\n  // request `agent.*.rpc` + receive its inbox replies. The event bus + the\n  // selfhosted control RPC ride THIS connection. Username/password; when unset the\n  // bus connects anonymously (local dev / a NATS with no auth_callout).\n  selfhostedNatsControlUser: z.string().optional(),\n  selfhostedNatsControlPassword: z.string().optional(),\n  // --- selfhosted (Connected Machine) control/exec op deadlines ---------------\n  // CONTROL ops (ping / fs / git / desktop / pty) keep a short request timeout so\n  // liveness failures surface promptly. EXEC duration is a different concern: by\n  // default it is unbounded (0), exactly like a command launched by an unrestricted\n  // local agent. The op-stream transport keeps control liveness, replay, and explicit\n  // cancellation independent of command duration. A deployment may opt into a hard\n  // process deadline by setting a positive value; 0 never schedules a process kill.\n  // Knobs: OPENGENI_SANDBOX_SELFHOSTED_EXEC_TIMEOUT_MS (default 0 = none) and\n  // OPENGENI_SANDBOX_SELFHOSTED_CONTROL_TIMEOUT_MS (default 30s).\n  sandboxSelfhostedExecTimeoutMs: z.coerce.number().int().nonnegative().default(0),\n  sandboxSelfhostedControlTimeoutMs: z.coerce.number().int().positive().default(30_000),\n  // --- sandbox lease cadences (cadence invariant validated at boot below) ---\n  // reaperPeriod < viewerHolderTTL, and reaperPeriod + idleGrace < the EFFECTIVE\n  // box idle timeout (effectiveModalIdleTimeoutSeconds, which defaults to the hard\n  // modalTimeoutSeconds). No keep-alive loop: between turns the box survives on its\n  // idle timeout — which we pin high enough (via the idle-timeout default) that\n  // OpenGeni's reaper, not Modal's idle-reap, governs teardown so /workspace is\n  // snapshotted before the box dies (sandbox-file-persistence).\n  sandboxLeaseReaperPeriodMs: z.coerce.number().int().positive().default(30_000),\n  sandboxViewerHolderTtlMs: z.coerce.number().int().positive().default(90_000),\n  // The DRAIN grace: how long a refcount-0 (draining) lease stays WARM before the\n  // reaper resume-by-ids the box and terminates it. This is the cost-vs-snappiness\n  // dial — when the user navigates away the box keeps refcount 0, but it survives\n  // this whole window so a \"glanced away then came back\" re-arms the SAME warm box\n  // (acquireLease re-arms draining->warm; the reaper's BEFORE-terminate re-read\n  // skips a re-armed box). Default 15min so a brief detour never cold-creates a\n  // fresh EMPTY box; lower it to trade warm cost for a snappier reclaim.\n  // getSettings caps the default at half a shorter configured Modal lifetime so\n  // the entire reaper window always fits. Knob: OPENGENI_SANDBOX_IDLE_GRACE_MS.\n  sandboxIdleGraceMs: z.coerce.number().int().positive().default(900_000),\n  // MID-SESSION /workspace snapshot cadence (sandbox-file-persistence). The\n  // reaper's drain-persist only protects boxes the reaper itself kills; a box\n  // that dies any other way (Modal's hard creation-time timeout on a session\n  // busy past it, provider OOM/infra death) loses everything since the last\n  // clean drain. While a turn holds the box, the turn heartbeat and turn-end\n  // both take a snapshot when at least this interval has passed since the last\n  // one (same epoch-fenced fold-onto-lease seam as the drain), bounding the\n  // worst-case loss of ANY unclean box death to this window. 0 disables.\n  // Knob: OPENGENI_SANDBOX_SNAPSHOT_INTERVAL_MS. Default 15min.\n  sandboxSnapshotIntervalMs: z.coerce.number().int().min(0).default(900_000),\n  // Maximum time a best-effort /workspace snapshot capture may hold turn/reaper\n  // cleanup. A hung provider snapshot must never pin a lease holder, block\n  // graceful shutdown, or become permission to GC an older archive. Timeout is\n  // treated exactly like a failed best-effort snapshot. Knob:\n  // OPENGENI_SANDBOX_SNAPSHOT_TIMEOUT_MS. Default 60s.\n  sandboxSnapshotTimeoutMs: z.coerce.number().int().positive().default(60_000),\n  // Begin a controlled snapshot/quiesce/drain/rematerialize transition this far\n  // ahead of a finite provider deadline. Modal's 24h creation clock cannot be\n  // extended; the logical sandbox outlives it by moving to one successor box.\n  // getSettings derives the actual default as min(1h, half the configured\n  // provider lifetime) so short-lived test/canary boxes remain bootable without\n  // an extra coupled environment override. An explicit value may be larger when\n  // an operator deliberately wants more rotation headroom; the boot invariant\n  // still requires it to remain below the provider lifetime.\n  sandboxRotationLeadMs: z.coerce.number().int().positive().default(3_600_000),\n  // Bound each global reaper pass so a rollout that discovers many legacy boxes\n  // with unknown creation clocks cannot create a provider/API thundering herd.\n  // One is the safe admission default: the reaper services provider transitions\n  // sequentially, so claiming a wider batch would fence boxes before the same\n  // sweep can service them. Larger fleets may raise this only as an explicit,\n  // observed deployment choice.\n  sandboxRotationBatchSize: z.coerce.number().int().positive().max(500).default(1),\n  // expires_at refresh window for a held lease (>> the turn 10s heartbeat so a\n  // single missed heartbeat never TTL-reaps a live turn). The warming TTL is the\n  // window a cold->warming spawner has to commit warm before a reaper resets it.\n  sandboxLeaseTtlMs: z.coerce.number().int().positive().default(90_000),\n  sandboxLeaseWarmingTtlMs: z.coerce.number().int().positive().default(120_000),\n  // Overall user-facing budget for warming a sandbox lease. Unlike the lease TTL\n  // (a liveness/reaper cadence), this bounds how long one turn waits for capacity\n  // or provider creation before surfacing a clear turn.failed error.\n  sandboxWarmingTimeoutMs: z.coerce.number().int().positive().default(600_000),\n  // Rig setup-script budget (M3): the wall-clock timeout the rig-setup lifecycle\n  // hook runs its script under, distinct from the 120s per-command lifecycle\n  // default (a rig may compile/install heavy tooling on first cold create).\n  // Env: OPENGENI_RIG_SETUP_TIMEOUT_MS. Default 10min.\n  rigSetupTimeoutMs: z.coerce.number().int().positive().default(600_000),\n  // --- sandbox warm-time billing (P2.1) ---\n  // Per-backend warm rate (usd_micros/sec), like modelPricingJson: an empty {}\n  // means warm-cost is not debited (warm-seconds are still metered for audit).\n  // Shape: { \"modal\": 5, \"runloop\": 4, ... }. Backends absent here meter\n  // warm-seconds but accrue NO warm_cost / debit (rate 0).\n  sandboxWarmRateMicrosPerSecondJson: z.string().default(\"{}\"),\n  // Per-workspace warm cap (cumulative warm-seconds since the start of the UTC\n  // month, summed over sandbox.warm_seconds). 0 = unbounded. A workspace over the\n  // cap force-drains its VIEWER-ONLY boxes (guarded AND turn_holders=0 — a paying\n  // turn is never killed); the reaper then stop()s at refcount 0.\n  sandboxMaxWarmSecondsPerWorkspace: z.coerce.number().int().nonnegative().default(0),\n  sandboxPreparationProfiles: z.string().default(\"none\"),\n  sandboxEnvAllowlist: z.string().default(\"\"),\n  objectStorageEndpoint: z.string().url().optional(),\n  objectStorageInternalEndpoint: z.string().url().optional(),\n  objectStorageSandboxEndpoint: z.string().url().optional(),\n  objectStorageBackend: z\n    .enum([\"s3-compatible\", \"aws-s3\", \"azure-blob\", \"gcs\"])\n    .default(\"s3-compatible\"),\n  objectStorageBucket: z.string().min(1).default(\"opengeni-files\"),\n  objectStorageRegion: z.string().min(1).default(\"us-east-1\"),\n  objectStorageS3Provider: z.string().min(1).default(\"Minio\"),\n  objectStorageAccessKeyId: z.string().optional(),\n  objectStorageSecretAccessKey: z.string().optional(),\n  objectStorageForcePathStyle: EnvBoolean.default(true),\n  objectStorageAzureConnectionString: z.string().optional(),\n  objectStorageAzureAccountName: z.string().optional(),\n  objectStorageAzureAccountKey: z.string().optional(),\n  objectStorageAzureEndpoint: z.string().url().optional(),\n  objectStorageGcsProjectId: z.string().optional(),\n  objectStorageGcsCredentialsJson: z.string().optional(),\n  objectStorageGcsKeyFilename: z.string().optional(),\n  objectStorageGcsApiEndpoint: z.string().url().optional(),\n  documentParser: z.string().min(1).default(\"liteparse\"),\n  documentChunkSize: z.coerce.number().int().positive().default(1200),\n  documentChunkOverlap: z.coerce.number().int().nonnegative().default(160),\n  documentEmbeddingProvider: z.enum([\"openai\", \"deterministic\"]).default(\"openai\"),\n  documentEmbeddingModel: z.string().min(1).default(\"text-embedding-3-large\"),\n  documentEmbeddingDimensions: z.coerce.number().int().positive().default(3072),\n  documentEmbeddingApiKey: z.string().optional(),\n  documentEmbeddingBaseUrl: z.string().url().optional(),\n  documentCurationProvider: z.enum([\"openai\", \"heuristic\", \"none\"]).default(\"openai\"),\n  documentCurationModel: z.string().min(1).default(\"gpt-4o-mini\"),\n  documentCurationApiKey: z.string().optional(),\n  documentCurationBaseUrl: z.string().url().optional(),\n  gitAuthorName: z.string().optional(),\n  gitAuthorEmail: z.string().optional(),\n  gitCommitterName: z.string().optional(),\n  gitCommitterEmail: z.string().optional(),\n  githubAppManifestBaseUrl: z.string().optional(),\n  githubAppManifestStateSecret: z.string().optional(),\n  githubAppId: z.string().optional(),\n  githubClientId: z.string().optional(),\n  githubClientSecret: z.string().optional(),\n  githubAppSlug: z.string().optional(),\n  githubWebhookSecret: z.string().optional(),\n  githubAppPrivateKey: z.string().optional(),\n  betterAuthSecret: z.string().optional(),\n  betterAuthAllowedHosts: z.string().default(\"\"),\n  betterAuthCookieDomain: z.string().optional(),\n  betterAuthTrustedOrigins: z.string().default(\"\"),\n  resendApiKey: z.string().optional(),\n  emailFrom: z.string().default(\"OpenGeni <auth@mail.opengeni.ai>\"),\n  stripeSecretKey: z.string().optional(),\n  stripePublishableKey: z.string().optional(),\n  stripeWebhookSecret: z.string().optional(),\n  stripeCreditsProductId: z.string().optional(),\n  mcpServers: z\n    .array(\n      z.object({\n        id: z.string().min(1).regex(registryId),\n        name: z.string().min(1).optional(),\n        url: z.string().url(),\n        allowedTools: z.array(z.string().min(1)).optional(),\n        timeoutMs: z.number().int().positive().optional(),\n        cacheToolsList: z.boolean().default(false),\n        /** Runtime approval policy, overlaid from an attempt-frozen session snapshot. */\n        requireApproval: SessionMcpApprovalPolicy.optional(),\n        /**\n         * Extra request headers sent to this MCP server (credential injection\n         * for workspace-enabled capability MCPs). Populated at runtime from\n         * encrypted capability-installation credentials; do not put secrets in\n         * OPENGENI_MCP_SERVERS.\n         */\n        headers: z.record(z.string(), z.string()).optional(),\n        connectionRef: McpServerConnectionRefSchema.optional(),\n      }),\n    )\n    .default([]),\n});\n\nexport type Settings = z.infer<typeof SettingsSchema>;\nexport type McpServerConfig = Settings[\"mcpServers\"][number];\n\n/** Declarative voice-input transcription provider ids. */\nexport type VoiceInputProviderId = \"openai\" | \"azure-openai\" | \"codex-subscription\";\n\nexport type VoiceInputProviderConfig =\n  | {\n      id: \"openai\";\n      kind: \"openai\";\n      apiKey: string;\n      baseUrl: string;\n      model: string;\n    }\n  | {\n      id: \"azure-openai\";\n      kind: \"azure-openai\";\n      endpoint: string;\n      deployment: string;\n      apiVersion: string;\n      apiKey: string | null;\n      adToken: string | null;\n    }\n  | {\n      id: \"codex-subscription\";\n      kind: \"codex-subscription\";\n      experimental: true;\n    };\n\n/**\n * Reject empty / template secrets so `.env.example` placeholders like\n * `your-key` cannot advertise voice input as available and then 401 upstream.\n */\nexport function isUsableVoiceInputSecret(value: string | null | undefined): value is string {\n  if (value == null) return false;\n  const trimmed = value.trim();\n  if (!trimmed) return false;\n  const normalized = trimmed.toLowerCase();\n  if (\n    normalized === \"your-key\" ||\n    normalized === \"your_key\" ||\n    normalized === \"changeme\" ||\n    normalized === \"replace-me\" ||\n    normalized === \"xxx\" ||\n    normalized.startsWith(\"your-\") ||\n    normalized.startsWith(\"your_\")\n  ) {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Resolve the configured voice-input provider registry in selection order.\n * Credentials stay in this server-side structure; ClientConfig only projects\n * whether at least one non-experimental (or probed experimental) provider exists.\n */\nexport function resolveVoiceInputProviderRegistry(settings: Settings): VoiceInputProviderConfig[] {\n  const order = settings.voiceInputProviderOrder\n    .split(\",\")\n    .map((part) => part.trim())\n    .filter(\n      (part): part is VoiceInputProviderId =>\n        part === \"openai\" || part === \"azure-openai\" || part === \"codex-subscription\",\n    );\n  const seen = new Set<VoiceInputProviderId>();\n  const providers: VoiceInputProviderConfig[] = [];\n  for (const id of order) {\n    if (seen.has(id)) continue;\n    seen.add(id);\n    if (id === \"openai\") {\n      if (!settings.voiceInputOpenaiEnabled) continue;\n      const apiKey = settings.voiceInputOpenaiApiKey ?? settings.openaiApiKey;\n      if (!isUsableVoiceInputSecret(apiKey)) continue;\n      // When the turn provider is Azure-only and no voice-specific OpenAI key/URL\n      // was set, do not silently reuse a leftover OPENAI_API_KEY for voice.\n      if (\n        settings.openaiProvider === \"azure\" &&\n        !settings.voiceInputOpenaiApiKey &&\n        !settings.voiceInputOpenaiBaseUrl\n      ) {\n        continue;\n      }\n      providers.push({\n        id: \"openai\",\n        kind: \"openai\",\n        apiKey,\n        baseUrl: (\n          settings.voiceInputOpenaiBaseUrl ??\n          settings.openaiBaseUrl ??\n          \"https://api.openai.com/v1\"\n        ).replace(/\\/+$/, \"\"),\n        model: settings.voiceInputOpenaiModel,\n      });\n      continue;\n    }\n    if (id === \"azure-openai\") {\n      if (!settings.voiceInputAzureEnabled) continue;\n      const endpoint = (\n        settings.voiceInputAzureEndpoint ??\n        settings.azureOpenaiEndpoint ??\n        \"\"\n      ).replace(/\\/+$/, \"\");\n      const deployment = settings.voiceInputAzureDeployment ?? settings.azureOpenaiDeployment ?? \"\";\n      const apiVersion =\n        settings.voiceInputAzureApiVersion ??\n        settings.azureOpenaiApiVersion ??\n        \"2025-04-01-preview\";\n      const apiKey = settings.voiceInputAzureApiKey ?? settings.azureOpenaiApiKey ?? null;\n      const adToken = settings.voiceInputAzureAdToken ?? settings.azureOpenaiAdToken ?? null;\n      if (\n        !endpoint ||\n        !deployment ||\n        (!isUsableVoiceInputSecret(apiKey) && !isUsableVoiceInputSecret(adToken))\n      ) {\n        continue;\n      }\n      // When turn provider is OpenAI-only and no voice-specific Azure settings\n      // were provided, skip ambient Azure leftovers.\n      if (\n        settings.openaiProvider !== \"azure\" &&\n        !settings.voiceInputAzureEndpoint &&\n        !settings.voiceInputAzureDeployment &&\n        !settings.voiceInputAzureApiKey &&\n        !settings.voiceInputAzureAdToken\n      ) {\n        continue;\n      }\n      providers.push({\n        id: \"azure-openai\",\n        kind: \"azure-openai\",\n        endpoint,\n        deployment,\n        apiVersion,\n        apiKey: isUsableVoiceInputSecret(apiKey) ? apiKey : null,\n        adToken: isUsableVoiceInputSecret(adToken) ? adToken : null,\n      });\n      continue;\n    }\n    if (id === \"codex-subscription\") {\n      // Prefer Codex STT whenever subscription model routing is enabled.\n      // Operators who want OpenAI/Azure first should set PROVIDER_ORDER; omit\n      // `codex-subscription` from the order to disable Codex voice while keeping\n      // subscription turns. VOICE_INPUT_CODEX_EXPERIMENTAL is retained for\n      // back-compat docs/env but no longer gates inclusion.\n      if (!settings.codexSubscriptionEnabled) continue;\n      providers.push({\n        id: \"codex-subscription\",\n        kind: \"codex-subscription\",\n        experimental: true,\n      });\n    }\n  }\n  return providers;\n}\n\n/** True when the deployment has at least one supported (non-experimental) provider. */\nexport function voiceInputDeploymentConfigured(settings: Settings): boolean {\n  return resolveVoiceInputProviderRegistry(settings).some(\n    (provider) => provider.kind !== \"codex-subscription\",\n  );\n}\n\nexport type TemporalTlsConnectionConfig = {\n  serverNameOverride?: string;\n  serverRootCACertificate?: Uint8Array;\n  clientCertPair?: {\n    crt: Uint8Array;\n    key: Uint8Array;\n  };\n};\nexport type TemporalConnectionOptions = {\n  address: string;\n  tls?: true | TemporalTlsConnectionConfig;\n  apiKey?: string;\n};\nexport type ModelPricing = {\n  inputMicrosPerMillionTokens: number;\n  cachedInputMicrosPerMillionTokens?: number | undefined;\n  outputMicrosPerMillionTokens: number;\n  marginBps?: number | undefined;\n};\nexport type ModelPricingScheduleV1 = {\n  default: ModelPricing;\n  inputTokenTiers?:\n    | Array<{\n        minimumInputTokens: number;\n        pricing: ModelPricing;\n      }>\n    | undefined;\n};\nexport type ModelUsageInput = {\n  inputTokens?: number | undefined;\n  outputTokens?: number | undefined;\n  totalTokens?: number | undefined;\n  inputTokensDetails?: Record<string, number> | Array<Record<string, number>> | undefined;\n  requestUsageEntries?: ModelUsageInput[] | undefined;\n};\n\nexport type StaticUsageLimitsConfig = StaticUsageLimits;\nexport type EntitlementsConfig = Entitlements;\n\nconst ModelPricingSchema = z.object({\n  inputMicrosPerMillionTokens: z.number().int().nonnegative(),\n  cachedInputMicrosPerMillionTokens: z.number().int().nonnegative().optional(),\n  outputMicrosPerMillionTokens: z.number().int().nonnegative(),\n  marginBps: z.number().int().min(0).max(100_000).optional(),\n});\n\nconst ModelPricingScheduleSchema = z\n  .object({\n    default: ModelPricingSchema,\n    inputTokenTiers: z\n      .array(\n        z.object({\n          minimumInputTokens: z.number().int().nonnegative(),\n          pricing: ModelPricingSchema,\n        }),\n      )\n      .optional(),\n  })\n  .superRefine((schedule, ctx) => {\n    let previous = -1;\n    for (const [index, tier] of (schedule.inputTokenTiers ?? []).entries()) {\n      if (tier.minimumInputTokens <= previous) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"inputTokenTiers\", index, \"minimumInputTokens\"],\n          message: \"input-token tier thresholds must be strictly increasing\",\n        });\n      }\n      previous = tier.minimumInputTokens;\n    }\n  });\n\nexport const CapabilitySupportV1 = z.enum([\"supported\", \"unsupported\", \"unknown\"]);\nexport type CapabilitySupportV1 = z.infer<typeof CapabilitySupportV1>;\n\nexport const CapabilityStateV1Schema = z\n  .object({\n    upstream: CapabilitySupportV1,\n    runnable: z.boolean(),\n  })\n  .superRefine((state, ctx) => {\n    if (state.upstream === \"unsupported\" && state.runnable) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"runnable\"],\n        message: \"an upstream-unsupported capability cannot be runnable\",\n      });\n    }\n  });\nexport type CapabilityStateV1 = z.infer<typeof CapabilityStateV1Schema>;\n\nconst ModelModalityV1 = z.enum([\"text\", \"image\", \"audio\"]);\nconst ModelLatencyModeV1 = z.enum([\"standard\", \"priority\", \"fast\"]);\n\nexport const ModelCapabilitiesV1Schema = z\n  .object({\n    reasoning: CapabilityStateV1Schema.extend({\n      efforts: z.array(ReasoningEffort),\n      defaultEffort: ReasoningEffort.nullable(),\n      required: z.boolean(),\n    }),\n    functionCalling: CapabilityStateV1Schema,\n    structuredOutput: CapabilityStateV1Schema,\n    hostedTools: z.object({\n      webSearch: CapabilityStateV1Schema,\n      xSearch: CapabilityStateV1Schema,\n      codeExecution: CapabilityStateV1Schema,\n    }),\n    inputModalities: z.array(ModelModalityV1).min(1),\n    /** Exact MIME types accepted as typed `input_file`; `text/*` is allowed. */\n    inputFileMediaTypes: z.array(z.string()).default([]),\n    outputModalities: z.array(ModelModalityV1).min(1),\n    transports: z.object({\n      sse: CapabilityStateV1Schema,\n      responsesWebSocket: CapabilityStateV1Schema,\n      realtimeAudio: CapabilityStateV1Schema,\n    }),\n    promptCaching: CapabilityStateV1Schema.extend({\n      mode: z.enum([\"implicit\", \"automatic\", \"none\"]),\n    }).optional(),\n    latencyModes: z\n      .array(\n        z.object({\n          id: ModelLatencyModeV1,\n          upstream: CapabilitySupportV1,\n          runnable: z.boolean(),\n          billingMultiplierBps: z.number().int().positive().optional(),\n        }),\n      )\n      .min(1),\n  })\n  .superRefine((capabilities, ctx) => {\n    const efforts = new Set(capabilities.reasoning.efforts);\n    if (efforts.size !== capabilities.reasoning.efforts.length) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reasoning\", \"efforts\"],\n        message: \"reasoning efforts must be unique\",\n      });\n    }\n    if (\n      capabilities.reasoning.defaultEffort !== null &&\n      !efforts.has(capabilities.reasoning.defaultEffort)\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reasoning\", \"defaultEffort\"],\n        message: \"the default reasoning effort must be one of the supported efforts\",\n      });\n    }\n    if (capabilities.reasoning.runnable && capabilities.reasoning.efforts.length === 0) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reasoning\", \"efforts\"],\n        message: \"a runnable reasoning capability must declare at least one effort\",\n      });\n    }\n    for (const field of [\"inputModalities\", \"outputModalities\"] as const) {\n      if (new Set(capabilities[field]).size !== capabilities[field].length) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [field],\n          message: `${field} must be unique`,\n        });\n      }\n    }\n    const latencyIds = new Set<string>();\n    for (const [index, mode] of capabilities.latencyModes.entries()) {\n      if (latencyIds.has(mode.id)) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"latencyModes\", index, \"id\"],\n          message: \"latency mode ids must be unique\",\n        });\n      }\n      latencyIds.add(mode.id);\n      if (mode.upstream === \"unsupported\" && mode.runnable) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"latencyModes\", index, \"runnable\"],\n          message: \"an upstream-unsupported latency mode cannot be runnable\",\n        });\n      }\n    }\n  });\nexport type ModelCapabilitiesV1 = z.infer<typeof ModelCapabilitiesV1Schema>;\n\nexport type ModelDeploymentV1 = {\n  upstreamModelId: string;\n  wireApi: ModelProviderApi;\n};\n\nexport type ModelExecutionLimitsV1 = {\n  contextWindowTokens: number | null;\n  effectiveContextWindowTokens: number | null;\n  autoCompactTokenLimit: number | null;\n  toolOutputTruncationTokens: number | null;\n};\n\nexport type CredentialSourceV1 =\n  | { kind: \"deployment\"; mechanism: \"api_key\" | \"azure_ad_bearer\" }\n  | { kind: \"connected_subscription\"; provider: \"codex\" }\n  | { kind: \"workspace_connection\"; mechanism: \"api_key\" };\n\nexport type BillingAttributionV1 = {\n  upstreamPayer: \"deployment\" | \"workspace\" | \"connected_subscription\";\n  metering: \"opengeni_credits\" | \"external\";\n};\n\n/**\n * Wire API a provider speaks. The built-in OpenAI/Azure provider always uses\n * \"responses\" (the OpenAI Responses API). Extra registry providers default to\n * \"chat\" (the broadly compatible /v1/chat/completions surface); Fireworks is\n * wired as \"chat\" because its beta Responses endpoint echoes input back and\n * silently no-ops hosted tools (see docs/model-providers.md).\n */\nexport const ModelProviderApi = z.enum([\"responses\", \"chat\"]);\nexport type ModelProviderApi = z.infer<typeof ModelProviderApi>;\n\n/**\n * Registry provider kind. \"api-key\" providers carry their own static key/headers;\n * \"codex-subscription\" providers authenticate per-request with a ChatGPT/Codex\n * subscription token resolved at call time (no static key) — see @opengeni/codex.\n */\nexport const RegistryProviderKind = z.enum([\n  \"api-key\",\n  \"codex-subscription\",\n  \"vercel-gateway-managed\",\n  \"vercel-gateway-workspace\",\n]);\nexport type RegistryProviderKind = z.infer<typeof RegistryProviderKind>;\n\n/** A single model exposed by a registry provider. */\nconst RegistryModelSchema = z\n  .object({\n    id: z.string().min(1), // canonical OpenGeni product id\n    upstreamModelId: z.string().min(1).optional(), // exact provider slug; defaults to id\n    aliases: z.array(z.string().min(1)).optional(), // accepted input only; never sent upstream\n    label: z.string().min(1).optional(), // display name; defaults to id\n    shortLabel: z.string().min(1).max(64).optional(), // compact UI label; optional\n    contextWindowTokens: z.number().int().positive().optional(),\n    effectiveContextWindowTokens: z.number().int().positive().optional(),\n    autoCompactTokenLimit: z.number().int().positive().optional(),\n    // Canonical model-facing function/tool-result policy. The runtime applies\n    // the same 1.2x serialization allowance as Codex when materializing output.\n    toolOutputTruncationTokens: z.number().int().positive().optional(),\n    reasoningEffort: z.boolean().optional(), // legacy compatibility input/projection\n    hostedWebSearch: z.boolean().optional(), // legacy compatibility input/projection\n    capabilities: ModelCapabilitiesV1Schema.optional(),\n    pricing: z.union([ModelPricingSchema, ModelPricingScheduleSchema]).optional(),\n    // Reserved normalized contracts are derived by OpenGeni in V1. Generic\n    // registry JSON must not opt itself into workspace BYOK or reattribute cost.\n    credentialSource: z.never().optional(),\n    billing: z.never().optional(),\n  })\n  .superRefine((model, ctx) => {\n    if (\n      model.capabilities &&\n      model.reasoningEffort !== undefined &&\n      model.reasoningEffort !== model.capabilities.reasoning.runnable\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reasoningEffort\"],\n        message: \"legacy reasoningEffort must agree with capabilities.reasoning.runnable\",\n      });\n    }\n    if (\n      model.capabilities &&\n      model.hostedWebSearch !== undefined &&\n      model.hostedWebSearch !== model.capabilities.hostedTools.webSearch.runnable\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"hostedWebSearch\"],\n        message:\n          \"legacy hostedWebSearch must agree with capabilities.hostedTools.webSearch.runnable\",\n      });\n    }\n  });\n\n/** A non-built-in provider declared by the host via OPENGENI_MODEL_PROVIDERS_JSON. */\nconst RegistryProviderSchema = z.object({\n  kind: RegistryProviderKind.default(\"api-key\"),\n  id: z.string().min(1).regex(registryId), // stable provider id, e.g. \"fireworks\"\n  label: z.string().min(1).optional(),\n  api: ModelProviderApi.default(\"chat\"),\n  baseUrl: z.string().url(),\n  apiKey: z.string().optional(), // inline key (pragmatic) ...\n  apiKeyEnv: z.string().optional(), // ... OR name of the env var holding the key (preferred)\n  defaultQuery: z.record(z.string(), z.string()).optional(),\n  defaultHeaders: z.record(z.string(), z.string()).optional(),\n  publicDefaultQueryNames: z.array(z.string().min(1)).optional(),\n  publicDefaultHeaderNames: z.array(z.string().min(1)).optional(),\n  // V1 derives these from provider kind. Workspace BYOK is deliberately not a\n  // registry switch and requires a separately reviewed encrypted broker.\n  credentialSource: z.never().optional(),\n  billing: z.never().optional(),\n  models: z.array(RegistryModelSchema).min(1),\n});\nexport type RegistryProvider = z.infer<typeof RegistryProviderSchema>;\n\nexport const IntegrationOAuthClientConfigSchema = z.object({\n  clientId: z.string().min(1),\n  clientSecret: z.string().min(1).optional(),\n  tokenEndpointAuthMethod: z\n    .enum([\"none\", \"client_secret_post\", \"client_secret_basic\"])\n    .default(\"none\"),\n});\nexport type IntegrationOAuthClientConfig = z.infer<typeof IntegrationOAuthClientConfigSchema>;\n\n/**\n * Runtime-resolved provider (built-in or registry), client-construction-ready.\n * The built-in OpenAI/Azure provider is always present and always \"responses\";\n * registry providers carry their own base URL / key / wire API. Compaction is\n * not a provider capability: all providers use the same durable plaintext\n * replacement.\n */\nexport interface ResolvedModelProvider {\n  id: string; // \"openai\" | \"azure\" | registry id\n  label: string;\n  kind: RegistryProviderKind; // \"api-key\" (built-ins + most registry) | \"codex-subscription\"\n  api: ModelProviderApi;\n  builtin: boolean;\n  baseUrl?: string | undefined;\n  apiKey?: string | undefined;\n  defaultQuery?: Record<string, string> | undefined;\n  defaultHeaders?: Record<string, string> | undefined;\n  publicDefaultQueryNames?: string[] | undefined;\n  publicDefaultHeaderNames?: string[] | undefined;\n  credentialSource: CredentialSourceV1;\n  billing: BillingAttributionV1;\n}\n\n/** A single exposed model + the provider that serves it. */\nexport interface ConfiguredModel {\n  schemaVersion: 1;\n  id: string;\n  aliases: string[];\n  label: string;\n  /** Optional curated compact label for dense UI (e.g. mobile composer). */\n  shortLabel?: string | undefined;\n  providerId: string;\n  providerLabel: string;\n  api: ModelProviderApi;\n  upstreamModelId: string;\n  deployment: ModelDeploymentV1;\n  executionLimits: ModelExecutionLimitsV1;\n  credentialSource: CredentialSourceV1;\n  billing: BillingAttributionV1;\n  capabilities: ModelCapabilitiesV1;\n  requestPolicy?: {\n    gateway: {\n      only: [string, ...string[]];\n      caching: \"auto\" | \"none\";\n    };\n  };\n  pricing?: ModelPricingScheduleV1 | undefined;\n  definitionVersion: string;\n  contextWindowTokens?: number | undefined;\n  effectiveContextWindowTokens?: number | undefined;\n  autoCompactTokenLimit?: number | undefined;\n  toolOutputTruncationTokens?: number | undefined;\n  reasoningEffort: boolean;\n  hostedWebSearch: boolean;\n}\n\nexport const VERCEL_AI_GATEWAY_BASE_URL = \"https://ai-gateway.vercel.sh/v1\" as const;\nexport const VERCEL_AI_GATEWAY_AI_SDK_BASE_URL = \"https://ai-gateway.vercel.sh/v4/ai\" as const;\nexport const OPENGENI_GATEWAY_PROVIDER_ID = \"opengeni-gateway\" as const;\nexport const WORKSPACE_GATEWAY_PROVIDER_ID = \"workspace-gateway\" as const;\nexport const WORKSPACE_GATEWAY_MODEL_ID_PREFIX = \"workspace-gateway/\" as const;\nexport const VERCEL_AI_GATEWAY_CONNECTION_DOMAIN = \"ai-gateway.vercel.sh\" as const;\nexport const VERCEL_AI_GATEWAY_CONNECTION_ROLE = \"vercel_ai_gateway\" as const;\n\nexport const CODEX_REALTIME_MODEL_ID = \"gpt-live-1-boulder-alpha\" as const;\nexport const OPENGENI_REALTIME_MODEL_ID_PREFIX = \"opengeni-gateway/\" as const;\nexport const WORKSPACE_REALTIME_MODEL_ID_PREFIX = \"workspace-gateway/\" as const;\n\n/** Curated voice models exposed through AI Gateway's normalized realtime API. */\nexport const AI_GATEWAY_REALTIME_MODELS = {\n  openaiRealtime21: {\n    upstreamModelId: \"openai/gpt-realtime-2.1\",\n    managedModelId: `${OPENGENI_REALTIME_MODEL_ID_PREFIX}openai/gpt-realtime-2.1`,\n    workspaceModelId: `${WORKSPACE_REALTIME_MODEL_ID_PREFIX}openai/gpt-realtime-2.1`,\n    label: \"GPT Realtime 2.1\",\n    description: \"Best overall voice intelligence\",\n  },\n  openaiRealtimeMini: {\n    upstreamModelId: \"openai/gpt-realtime-mini\",\n    managedModelId: `${OPENGENI_REALTIME_MODEL_ID_PREFIX}openai/gpt-realtime-mini`,\n    workspaceModelId: `${WORKSPACE_REALTIME_MODEL_ID_PREFIX}openai/gpt-realtime-mini`,\n    label: \"GPT Realtime Mini\",\n    description: \"Faster, lighter live voice\",\n  },\n  grokVoiceThinkFast20: {\n    upstreamModelId: \"xai/grok-voice-think-fast-2.0\",\n    managedModelId: `${OPENGENI_REALTIME_MODEL_ID_PREFIX}xai/grok-voice-think-fast-2.0`,\n    workspaceModelId: `${WORKSPACE_REALTIME_MODEL_ID_PREFIX}xai/grok-voice-think-fast-2.0`,\n    label: \"Grok Voice Think Fast 2.0\",\n    description: \"Fast, natural xAI voice\",\n  },\n} as const;\n\nexport type AiGatewayRealtimeModel =\n  (typeof AI_GATEWAY_REALTIME_MODELS)[keyof typeof AI_GATEWAY_REALTIME_MODELS];\n\nexport function resolveAiGatewayRealtimeModel(\n  modelId: string,\n): { source: \"managed\" | \"workspace\"; upstreamModelId: string } | null {\n  for (const model of Object.values(AI_GATEWAY_REALTIME_MODELS)) {\n    if (model.managedModelId === modelId) {\n      return { source: \"managed\", upstreamModelId: model.upstreamModelId };\n    }\n    if (model.workspaceModelId === modelId) {\n      return { source: \"workspace\", upstreamModelId: model.upstreamModelId };\n    }\n  }\n  return null;\n}\n\nexport const OPENGENI_GATEWAY_MODELS = {\n  deepseek: {\n    productId: \"deepseek-v4-flash-0731\",\n    workspaceProductId: `${WORKSPACE_GATEWAY_MODEL_ID_PREFIX}deepseek-v4-flash-0731`,\n    upstreamModelId: \"deepseek/deepseek-v4-flash-0731\",\n    label: \"DeepSeek V4 Flash 0731\",\n    shortLabel: \"V4 Flash\",\n    providers: [\"baseten\", \"novita\", \"deepinfra\"],\n    implicitCaching: true,\n  },\n  kimi: {\n    productId: \"kimi-k3\",\n    workspaceProductId: `${WORKSPACE_GATEWAY_MODEL_ID_PREFIX}kimi-k3`,\n    upstreamModelId: \"moonshotai/kimi-k3\",\n    label: \"Kimi K3\",\n    shortLabel: \"Kimi K3\",\n    providers: [\"baseten\", \"fireworks\"],\n    implicitCaching: true,\n  },\n} as const;\n\n/**\n * Built-in OpenGeni credit pricing schedules.\n *\n * Rates are provider list prices in USD micros per 1M tokens. Debit applies\n * `marginBps` (2_500 = +25%) on top. Long-context tiers follow OpenAI's\n * \">272K input tokens\" rule (threshold exclusive of 272_000).\n *\n * GPT-5.4 and older families are intentionally omitted — they are no longer\n * offered. Codex / connected-subscription turns use `metering: external` and\n * never consult this map.\n *\n * When adding or changing a billed model, run `bun run check:model-pricing`\n * (see docs/model-providers.md § Price audit). That compares this map to\n * llm-prices.com as a ground-truth canary; it does not generate this table.\n */\nexport const defaultModelPricing: Record<string, ModelPricingScheduleV1> = {\n  \"gpt-5.6-sol\": {\n    default: {\n      inputMicrosPerMillionTokens: 5_000_000,\n      cachedInputMicrosPerMillionTokens: 500_000,\n      outputMicrosPerMillionTokens: 30_000_000,\n      marginBps: 2_500,\n    },\n    inputTokenTiers: [\n      {\n        // OpenAI: prompts with >272K input tokens use the long-context rate.\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 10_000_000,\n          cachedInputMicrosPerMillionTokens: 1_000_000,\n          outputMicrosPerMillionTokens: 45_000_000,\n          marginBps: 2_500,\n        },\n      },\n    ],\n  },\n  \"gpt-5.6-terra\": {\n    default: {\n      inputMicrosPerMillionTokens: 2_000_000,\n      cachedInputMicrosPerMillionTokens: 200_000,\n      outputMicrosPerMillionTokens: 12_000_000,\n      marginBps: 2_500,\n    },\n    inputTokenTiers: [\n      {\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 4_000_000,\n          cachedInputMicrosPerMillionTokens: 400_000,\n          outputMicrosPerMillionTokens: 18_000_000,\n          marginBps: 2_500,\n        },\n      },\n    ],\n  },\n  \"gpt-5.6-luna\": {\n    default: {\n      inputMicrosPerMillionTokens: 200_000,\n      cachedInputMicrosPerMillionTokens: 20_000,\n      outputMicrosPerMillionTokens: 1_200_000,\n      marginBps: 2_500,\n    },\n    inputTokenTiers: [\n      {\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 400_000,\n          cachedInputMicrosPerMillionTokens: 40_000,\n          outputMicrosPerMillionTokens: 1_800_000,\n          marginBps: 2_500,\n        },\n      },\n    ],\n  },\n  // Conservative Vercel AI Gateway fallback prices. Normal managed Gateway\n  // billing uses the exact response Gateway `cost` / `inferenceCost` and applies\n  // the same margin. These token rates are used only if that\n  // metadata is absent. DeepSeek therefore carries the highest approved route\n  // (Novita); both approved Kimi routes have the same list price.\n  [OPENGENI_GATEWAY_MODELS.deepseek.productId]: {\n    default: {\n      inputMicrosPerMillionTokens: 140_000,\n      cachedInputMicrosPerMillionTokens: 28_000,\n      outputMicrosPerMillionTokens: 280_000,\n      marginBps: 2_500,\n    },\n  },\n  [OPENGENI_GATEWAY_MODELS.kimi.productId]: {\n    default: {\n      inputMicrosPerMillionTokens: 3_000_000,\n      cachedInputMicrosPerMillionTokens: 300_000,\n      outputMicrosPerMillionTokens: 15_000_000,\n      marginBps: 2_500,\n    },\n  },\n  // Fireworks AI / GLM 5.2 — the first shipped non-OpenAI registry model. A\n  // built-in default pricing entry makes managed billing work out of the box\n  // for hosts that expose this model via OPENGENI_MODEL_PROVIDERS_JSON without\n  // also setting OPENGENI_MODEL_PRICING_JSON.\n  \"accounts/fireworks/models/glm-5p2\": {\n    default: {\n      inputMicrosPerMillionTokens: 1_400_000,\n      cachedInputMicrosPerMillionTokens: 140_000,\n      outputMicrosPerMillionTokens: 4_400_000,\n      marginBps: 2_500,\n    },\n  },\n};\n\n// --- backend-gated required-credential table (the single source of truth) ---\n// Each sandbox backend declares ONLY its own required credentials: a deployment\n// configured for `sandboxBackend=modal` must carry the Modal token, but a\n// daytona/e2b/local/none deployment must NOT be forced to set Modal creds (and\n// vice versa). validateSettings() iterates this table for the *active* backend\n// only — so the cred a backend doesn't use is never a boot blocker — and the\n// deployment package mirrors the same table to drive its env-render + the\n// required-env manifest (one table, two consumers).\n//\n// `field` is the parsed Settings key (boot validation reads the typed value);\n// `env` is the OPENGENI_* variable name (deployment renders/requires it). The\n// modal token is a both-or-neither pair handled by an extra refine in\n// validateSettings — this table holds the hard \"must be present when active\"\n// requirements.\nexport type SandboxRequiredEnv = {\n  field: keyof Settings;\n  env: string;\n};\n\nexport const SANDBOX_REQUIRED_ENV: Record<\n  z.infer<typeof SandboxBackend>,\n  readonly SandboxRequiredEnv[]\n> = {\n  // docker/local/none need no credentials (local dev container / in-process / off).\n  docker: [],\n  local: [],\n  none: [],\n  modal: [\n    { field: \"modalAppName\", env: \"OPENGENI_MODAL_APP_NAME\" },\n    { field: \"modalTokenId\", env: \"OPENGENI_MODAL_TOKEN_ID\" },\n    { field: \"modalTokenSecret\", env: \"OPENGENI_MODAL_TOKEN_SECRET\" },\n  ],\n  daytona: [{ field: \"daytonaApiKey\", env: \"OPENGENI_DAYTONA_API_KEY\" }],\n  runloop: [{ field: \"runloopApiKey\", env: \"OPENGENI_RUNLOOP_API_KEY\" }],\n  e2b: [{ field: \"e2bApiKey\", env: \"OPENGENI_E2B_API_KEY\" }],\n  blaxel: [{ field: \"blaxelApiKey\", env: \"OPENGENI_BLAXEL_API_KEY\" }],\n  cloudflare: [{ field: \"cloudflareWorkerUrl\", env: \"OPENGENI_CLOUDFLARE_WORKER_URL\" }],\n  vercel: [\n    { field: \"vercelToken\", env: \"OPENGENI_VERCEL_TOKEN\" },\n    { field: \"vercelProjectId\", env: \"OPENGENI_VERCEL_PROJECT_ID\" },\n  ],\n  // selfhosted needs NO per-box credentials: it is the user's own machine reached\n  // over the agent's own enrollment. The enrollment-signing + relay-token secrets\n  // are deployment-level (a single runtime secret, not per-active-backend creds),\n  // wired in the connectivity/enrollment milestones (M4/M5), not here.\n  selfhosted: [],\n};\n\n/** The required OPENGENI_* env var names for a backend (for the deployment manifest). */\nexport function requiredSandboxEnvForBackend(backend: z.infer<typeof SandboxBackend>): string[] {\n  return (SANDBOX_REQUIRED_ENV[backend] ?? []).map((entry) => entry.env);\n}\n\nfunction optional(name: string): string | undefined {\n  const value = process.env[name];\n  return value && value.trim().length > 0 ? value : undefined;\n}\n\nexport function getSettings(): Settings {\n  const raw = {\n    serviceName: optional(\"OPENGENI_SERVICE_NAME\"),\n    environment: optional(\"OPENGENI_ENVIRONMENT\"),\n    deploymentRevision:\n      optional(\"OPENGENI_DEPLOYMENT_REVISION\") ??\n      optional(\"SOURCE_VERSION\") ??\n      optional(\"GITHUB_SHA\"),\n    serverVersion: optional(\"OPENGENI_SERVER_VERSION\"),\n    databaseUrl: optional(\"OPENGENI_DATABASE_URL\"),\n    dbSchema: optional(\"OPENGENI_DB_SCHEMA\"),\n    rlsStrategy: optional(\"OPENGENI_RLS_STRATEGY\"),\n    runtimeDatabaseRole: optional(\"OPENGENI_RUNTIME_DATABASE_ROLE\"),\n    natsUrl: optional(\"OPENGENI_NATS_URL\"),\n    temporalHost: optional(\"OPENGENI_TEMPORAL_HOST\"),\n    temporalNamespace: optional(\"OPENGENI_TEMPORAL_NAMESPACE\"),\n    temporalTaskQueue: optional(\"OPENGENI_TEMPORAL_TASK_QUEUE\"),\n    temporalTlsEnabled: optional(\"OPENGENI_TEMPORAL_TLS_ENABLED\"),\n    temporalApiKey: optional(\"OPENGENI_TEMPORAL_API_KEY\"),\n    temporalTlsServerName: optional(\"OPENGENI_TEMPORAL_TLS_SERVER_NAME\"),\n    temporalTlsRootCaCertificateBase64: optional(\n      \"OPENGENI_TEMPORAL_TLS_ROOT_CA_CERTIFICATE_BASE64\",\n    ),\n    temporalTlsClientCertificateBase64: optional(\"OPENGENI_TEMPORAL_TLS_CLIENT_CERTIFICATE_BASE64\"),\n    temporalTlsClientPrivateKeyBase64: optional(\"OPENGENI_TEMPORAL_TLS_CLIENT_PRIVATE_KEY_BASE64\"),\n    startupDependencyRetryAttempts: optional(\"OPENGENI_STARTUP_DEPENDENCY_RETRY_ATTEMPTS\"),\n    startupDependencyRetryInitialDelayMs: optional(\n      \"OPENGENI_STARTUP_DEPENDENCY_RETRY_INITIAL_DELAY_MS\",\n    ),\n    startupDependencyRetryMaxDelayMs: optional(\"OPENGENI_STARTUP_DEPENDENCY_RETRY_MAX_DELAY_MS\"),\n    turnWorkerConcurrencyMode: optional(\"OPENGENI_TURN_WORKER_CONCURRENCY_MODE\"),\n    turnWorkerMaxConcurrentTurns: optional(\"OPENGENI_TURN_WORKER_MAX_CONCURRENT_TURNS\"),\n    turnWorkerTargetCpuUsage: optional(\"OPENGENI_TURN_WORKER_TARGET_CPU_USAGE\"),\n    turnWorkerTargetMemoryUsage: optional(\"OPENGENI_TURN_WORKER_TARGET_MEMORY_USAGE\"),\n    observabilityStructuredLogs: optional(\"OPENGENI_OBSERVABILITY_STRUCTURED_LOGS\"),\n    observabilityMetricsEnabled: optional(\"OPENGENI_OBSERVABILITY_METRICS_ENABLED\"),\n    observabilityOtlpEndpoint:\n      optional(\"OPENGENI_OTEL_EXPORTER_OTLP_ENDPOINT\") ?? optional(\"OTEL_EXPORTER_OTLP_ENDPOINT\"),\n    observabilityOtlpHeaders:\n      optional(\"OPENGENI_OTEL_EXPORTER_OTLP_HEADERS\") ?? optional(\"OTEL_EXPORTER_OTLP_HEADERS\"),\n    analyticsEnabled: optional(\"OPENGENI_ANALYTICS_ENABLED\"),\n    analyticsConsentRequired: optional(\"OPENGENI_ANALYTICS_CONSENT_REQUIRED\"),\n    analyticsReoClientId: optional(\"OPENGENI_ANALYTICS_REO_CLIENT_ID\"),\n    analyticsPosthogProjectKey: optional(\"OPENGENI_ANALYTICS_POSTHOG_PROJECT_KEY\"),\n    analyticsPosthogHost: optional(\"OPENGENI_ANALYTICS_POSTHOG_HOST\"),\n    analyticsGa4MeasurementId: optional(\"OPENGENI_ANALYTICS_GA4_MEASUREMENT_ID\"),\n    publicBaseUrl: optional(\"OPENGENI_PUBLIC_BASE_URL\"),\n    webBaseUrl: optional(\"OPENGENI_WEB_BASE_URL\"),\n    agentReleasesBaseUrl: optional(\"OPENGENI_AGENT_RELEASES_BASE_URL\"),\n    agentStableVersion: optional(\"OPENGENI_AGENT_STABLE_VERSION\"),\n    agentBetaVersion: optional(\"OPENGENI_AGENT_BETA_VERSION\"),\n    productAccessMode: optional(\"OPENGENI_PRODUCT_ACCESS_MODE\"),\n    billingMode: optional(\"OPENGENI_BILLING_MODE\"),\n    entitlementsMode: optional(\"OPENGENI_ENTITLEMENTS_MODE\"),\n    usageLimitsMode: optional(\"OPENGENI_USAGE_LIMITS_MODE\"),\n    staticEntitlementsJson: optional(\"OPENGENI_STATIC_ENTITLEMENTS_JSON\"),\n    staticUsageLimitsJson: optional(\"OPENGENI_STATIC_USAGE_LIMITS_JSON\"),\n    delegationSecret: optional(\"OPENGENI_DELEGATION_SECRET\"),\n    streamTokenSecret: optional(\"OPENGENI_STREAM_TOKEN_SECRET\"),\n    streamControlEnabled: optional(\"OPENGENI_STREAM_CONTROL_ENABLED\"),\n    toolspaceEnabled: optional(\"OPENGENI_TOOLSPACE_ENABLED\"),\n    toolspaceMaxCallsPerTurn: optional(\"OPENGENI_TOOLSPACE_MAX_CALLS_PER_TURN\"),\n    ogtoolPackageSpec: optional(\"OPENGENI_OGTOOL_PACKAGE_SPEC\"),\n    environmentsEncryptionKey: optional(\"OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY\"),\n    integrationsEnabled: optional(\"OPENGENI_INTEGRATIONS_ENABLED\"),\n    integrationsStateSecret: optional(\"OPENGENI_INTEGRATIONS_STATE_SECRET\"),\n    integrationsAllowPrivateNetworkTargets: optional(\n      \"OPENGENI_INTEGRATIONS_ALLOW_PRIVATE_NETWORK_TARGETS\",\n    ),\n    integrationsOauthClientsJson: optional(\"OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON\"),\n    slackClientId: optional(\"OPENGENI_SLACK_CLIENT_ID\"),\n    slackClientSecret: optional(\"OPENGENI_SLACK_CLIENT_SECRET\"),\n    slackSigningSecret: optional(\"OPENGENI_SLACK_SIGNING_SECRET\"),\n    googleDriveClientId: optional(\"OPENGENI_GOOGLE_DRIVE_CLIENT_ID\"),\n    googleDriveClientSecret: optional(\"OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET\"),\n    maxNestedAgentDepth: optional(\"OPENGENI_MAX_NESTED_AGENT_DEPTH\"),\n    socialOauthClientsJson: optional(\"OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON\"),\n    goalMaxAutoContinuations: optional(\"OPENGENI_GOAL_MAX_AUTO_CONTINUATIONS\"),\n    goalNoProgressLimit: optional(\"OPENGENI_GOAL_NO_PROGRESS_LIMIT\"),\n    agentMaxModelCallsPerTurn: optional(\"OPENGENI_AGENT_MAX_MODEL_CALLS_PER_TURN\"),\n    contextWindowTokens: optional(\"OPENGENI_CONTEXT_WINDOW_TOKENS\"),\n    contextEffectiveWindowTokens: optional(\"OPENGENI_CONTEXT_EFFECTIVE_WINDOW_TOKENS\"),\n    contextCompactionThresholdRatio: optional(\"OPENGENI_COMPACTION_THRESHOLD_RATIO\"),\n    contextReservedOutputTokens: optional(\"OPENGENI_CONTEXT_RESERVED_OUTPUT_TOKENS\"),\n    contextAutoCompactThresholdTokens: optional(\"OPENGENI_CONTEXT_AUTO_COMPACT_THRESHOLD_TOKENS\"),\n    modelToolOutputTruncationTokens: optional(\"OPENGENI_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS\"),\n    authRequired: optional(\"OPENGENI_AUTH_REQUIRED\"),\n    accessKey: optional(\"OPENGENI_ACCESS_KEY\"),\n    authAllowHealth: optional(\"OPENGENI_AUTH_ALLOW_HEALTH\"),\n    authAllowMetrics: optional(\"OPENGENI_AUTH_ALLOW_METRICS\"),\n    apiHost: optional(\"OPENGENI_API_HOST\"),\n    apiPort: optional(\"OPENGENI_API_PORT\"),\n    workerHttpPort: optional(\"OPENGENI_WORKER_HTTP_PORT\"),\n    opengeniMcpUrl: optional(\"OPENGENI_MCP_URL\"),\n    corsAllowOriginRegex: optional(\"OPENGENI_CORS_ALLOW_ORIGIN_REGEX\"),\n    openaiProvider: optional(\"OPENGENI_OPENAI_PROVIDER\"),\n    openaiApiKey: optional(\"OPENGENI_OPENAI_API_KEY\") ?? optional(\"OPENAI_API_KEY\"),\n    openaiBaseUrl: optional(\"OPENGENI_OPENAI_BASE_URL\") ?? optional(\"OPENAI_BASE_URL\"),\n    openaiModel: optional(\"OPENGENI_OPENAI_MODEL\"),\n    openaiAllowedModels: optional(\"OPENGENI_OPENAI_ALLOWED_MODELS\"),\n    vercelAiGatewayApiKey: optional(\"OPENGENI_VERCEL_AI_GATEWAY_API_KEY\"),\n    voiceInputMaxDurationSeconds: optional(\"OPENGENI_VOICE_INPUT_MAX_DURATION_SECONDS\"),\n    voiceInputMaxSizeBytes: optional(\"OPENGENI_VOICE_INPUT_MAX_SIZE_BYTES\"),\n    voiceInputResumableEnabled: optional(\"OPENGENI_VOICE_INPUT_RESUMABLE_ENABLED\"),\n    voiceInputResumableMaxDurationSeconds: optional(\n      \"OPENGENI_VOICE_INPUT_RESUMABLE_MAX_DURATION_SECONDS\",\n    ),\n    voiceInputResumableMaxSizeBytes: optional(\"OPENGENI_VOICE_INPUT_RESUMABLE_MAX_SIZE_BYTES\"),\n    voiceInputResumableMaxChunkSizeBytes: optional(\n      \"OPENGENI_VOICE_INPUT_RESUMABLE_MAX_CHUNK_SIZE_BYTES\",\n    ),\n    voiceInputResumableRetentionSeconds: optional(\n      \"OPENGENI_VOICE_INPUT_RESUMABLE_RETENTION_SECONDS\",\n    ),\n    voiceInputFfmpegPath: optional(\"OPENGENI_VOICE_INPUT_FFMPEG_PATH\"),\n    voiceInputProviderOrder: optional(\"OPENGENI_VOICE_INPUT_PROVIDER_ORDER\"),\n    voiceInputOpenaiEnabled: optional(\"OPENGENI_VOICE_INPUT_OPENAI_ENABLED\"),\n    voiceInputOpenaiApiKey: optional(\"OPENGENI_VOICE_INPUT_OPENAI_API_KEY\"),\n    voiceInputOpenaiBaseUrl: optional(\"OPENGENI_VOICE_INPUT_OPENAI_BASE_URL\"),\n    voiceInputOpenaiModel: optional(\"OPENGENI_VOICE_INPUT_OPENAI_MODEL\"),\n    voiceInputAzureEnabled: optional(\"OPENGENI_VOICE_INPUT_AZURE_ENABLED\"),\n    voiceInputAzureEndpoint: optional(\"OPENGENI_VOICE_INPUT_AZURE_ENDPOINT\"),\n    voiceInputAzureDeployment: optional(\"OPENGENI_VOICE_INPUT_AZURE_DEPLOYMENT\"),\n    voiceInputAzureApiVersion: optional(\"OPENGENI_VOICE_INPUT_AZURE_API_VERSION\"),\n    voiceInputAzureApiKey: optional(\"OPENGENI_VOICE_INPUT_AZURE_API_KEY\"),\n    voiceInputAzureAdToken: optional(\"OPENGENI_VOICE_INPUT_AZURE_AD_TOKEN\"),\n    voiceInputCodexExperimentalEnabled: optional(\"OPENGENI_VOICE_INPUT_CODEX_EXPERIMENTAL\"),\n    modelPricingJson: optional(\"OPENGENI_MODEL_PRICING_JSON\"),\n    modelProvidersJson: optional(\"OPENGENI_MODEL_PROVIDERS_JSON\"),\n    codexSubscriptionEnabled: optional(\"OPENGENI_CODEX_SUBSCRIPTION_ENABLED\"),\n    codexConnectedAppsEnabled: optional(\"OPENGENI_CODEX_CONNECTED_APPS_ENABLED\"),\n    codexToolSearchEnabled: optional(\"OPENGENI_CODEX_TOOL_SEARCH_ENABLED\"),\n    codexCredentialLeasingEnabled: optional(\"OPENGENI_CODEX_CREDENTIAL_LEASING_ENABLED\"),\n    codexFleetPolicyShadowEnabled: optional(\"OPENGENI_CODEX_FLEET_POLICY_SHADOW_ENABLED\"),\n    codexProductSku: optional(\"OPENGENI_CODEX_PRODUCT_SKU\"),\n    openaiReasoningEffort: optional(\"OPENGENI_OPENAI_REASONING_EFFORT\"),\n    openaiAllowedReasoningEfforts: optional(\"OPENGENI_OPENAI_ALLOWED_REASONING_EFFORTS\"),\n    openaiResponsesTransport: optional(\"OPENGENI_OPENAI_RESPONSES_TRANSPORT\"),\n    openaiProviderItemIds: optional(\"OPENGENI_OPENAI_PROVIDER_ITEM_IDS\"),\n    openaiReasoningEncryptedContent: optional(\"OPENGENI_OPENAI_REASONING_ENCRYPTED_CONTENT\"),\n    openaiMaxRetries: optional(\"OPENGENI_OPENAI_MAX_RETRIES\"),\n    webSearchEnabled: optional(\"OPENGENI_WEB_SEARCH_ENABLED\"),\n    agentInstructionsTemplate: optional(\"OPENGENI_AGENT_INSTRUCTIONS_TEMPLATE\"),\n    azureOpenaiBaseUrl: optional(\"OPENGENI_AZURE_OPENAI_BASE_URL\"),\n    azureOpenaiEndpoint: optional(\"OPENGENI_AZURE_OPENAI_ENDPOINT\"),\n    azureOpenaiDeployment: optional(\"OPENGENI_AZURE_OPENAI_DEPLOYMENT\"),\n    azureOpenaiApiVersion: optional(\"OPENGENI_AZURE_OPENAI_API_VERSION\"),\n    azureOpenaiApiKey: optional(\"OPENGENI_AZURE_OPENAI_API_KEY\"),\n    azureOpenaiAdToken: optional(\"OPENGENI_AZURE_OPENAI_AD_TOKEN\"),\n    disableOpenaiTracing: optional(\"OPENGENI_DISABLE_OPENAI_TRACING\"),\n    sandboxBackend: optional(\"OPENGENI_SANDBOX_BACKEND\"),\n    dockerImage: optional(\"OPENGENI_DOCKER_IMAGE\"),\n    dockerExposedPorts: optional(\"OPENGENI_DOCKER_EXPOSED_PORTS\"),\n    dockerNetwork: optional(\"OPENGENI_DOCKER_NETWORK\"),\n    dockerWorkspaceBaseDir: optional(\"OPENGENI_DOCKER_WORKSPACE_BASE_DIR\"),\n    modalAppName: optional(\"OPENGENI_MODAL_APP_NAME\"),\n    modalImageRef: optional(\"OPENGENI_MODAL_IMAGE_REF\"),\n    modalImageId: optional(\"OPENGENI_MODAL_IMAGE_ID\"),\n    modalImageRegistrySecret: optional(\"OPENGENI_MODAL_IMAGE_REGISTRY_SECRET\"),\n    modalTimeoutSeconds: optional(\"OPENGENI_MODAL_TIMEOUT_SECONDS\"),\n    modalTokenId: optional(\"OPENGENI_MODAL_TOKEN_ID\"),\n    modalTokenSecret: optional(\"OPENGENI_MODAL_TOKEN_SECRET\"),\n    modalEnvironment: optional(\"OPENGENI_MODAL_ENVIRONMENT\"),\n    modalIdleTimeoutSeconds: optional(\"OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS\"),\n    modalWorkspacePersistence: optional(\"OPENGENI_MODAL_WORKSPACE_PERSISTENCE\"),\n    sandboxDesktopEnabled: optional(\"OPENGENI_SANDBOX_DESKTOP_ENABLED\"),\n    sandboxDesktopInteractive: optional(\"OPENGENI_SANDBOX_DESKTOP_INTERACTIVE\"),\n    sandboxTerminalEnabled: optional(\"OPENGENI_SANDBOX_TERMINAL_ENABLED\"),\n    streamResolutionWidth: optional(\"OPENGENI_STREAM_RESOLUTION_WIDTH\"),\n    streamResolutionHeight: optional(\"OPENGENI_STREAM_RESOLUTION_HEIGHT\"),\n    computerUseEnabled: optional(\"OPENGENI_COMPUTER_USE_ENABLED\"),\n    computerUseReadOnly: optional(\"OPENGENI_COMPUTER_USE_READONLY\"),\n    recordingEnabled: optional(\"OPENGENI_RECORDING_ENABLED\"),\n    workspaceCaptureEnabled: optional(\"OPENGENI_WORKSPACE_CAPTURE\"),\n    recordingDefaultCodec: optional(\"OPENGENI_RECORDING_DEFAULT_CODEC\"),\n    recordingFramerate: optional(\"OPENGENI_RECORDING_FRAMERATE\"),\n    recordingMaxSeconds: optional(\"OPENGENI_RECORDING_MAX_SECONDS\"),\n    recordingMaxBytes: optional(\"OPENGENI_RECORDING_MAX_BYTES\"),\n    daytonaApiKey: optional(\"OPENGENI_DAYTONA_API_KEY\"),\n    daytonaApiUrl: optional(\"OPENGENI_DAYTONA_API_URL\"),\n    daytonaTarget: optional(\"OPENGENI_DAYTONA_TARGET\"),\n    daytonaImage: optional(\"OPENGENI_DAYTONA_IMAGE\"),\n    daytonaSnapshotName: optional(\"OPENGENI_DAYTONA_SNAPSHOT_NAME\"),\n    daytonaAutoStopInterval: optional(\"OPENGENI_DAYTONA_AUTO_STOP_INTERVAL\"),\n    daytonaTimeoutSeconds: optional(\"OPENGENI_DAYTONA_TIMEOUT_SECONDS\"),\n    daytonaExposedPortUrlTtlSeconds: optional(\"OPENGENI_DAYTONA_EXPOSED_PORT_URL_TTL_SECONDS\"),\n    runloopApiKey: optional(\"OPENGENI_RUNLOOP_API_KEY\"),\n    runloopBaseUrl: optional(\"OPENGENI_RUNLOOP_BASE_URL\"),\n    runloopBlueprintName: optional(\"OPENGENI_RUNLOOP_BLUEPRINT_NAME\"),\n    runloopBlueprintId: optional(\"OPENGENI_RUNLOOP_BLUEPRINT_ID\"),\n    runloopTunnel: optional(\"OPENGENI_RUNLOOP_TUNNEL\"),\n    runloopKeepAliveSeconds: optional(\"OPENGENI_RUNLOOP_KEEP_ALIVE_SECONDS\"),\n    e2bApiKey: optional(\"OPENGENI_E2B_API_KEY\"),\n    e2bTemplate: optional(\"OPENGENI_E2B_TEMPLATE\"),\n    e2bTimeoutSeconds: optional(\"OPENGENI_E2B_TIMEOUT_SECONDS\"),\n    e2bTimeoutAction: optional(\"OPENGENI_E2B_TIMEOUT_ACTION\"),\n    e2bAllowInternetAccess: optional(\"OPENGENI_E2B_ALLOW_INTERNET_ACCESS\"),\n    e2bAutoResume: optional(\"OPENGENI_E2B_AUTO_RESUME\"),\n    e2bWorkspacePersistence: optional(\"OPENGENI_E2B_WORKSPACE_PERSISTENCE\"),\n    blaxelApiKey: optional(\"OPENGENI_BLAXEL_API_KEY\"),\n    blaxelImage: optional(\"OPENGENI_BLAXEL_IMAGE\"),\n    blaxelRegion: optional(\"OPENGENI_BLAXEL_REGION\"),\n    blaxelExposedPortPublic: optional(\"OPENGENI_BLAXEL_EXPOSED_PORT_PUBLIC\"),\n    blaxelExposedPortUrlTtlSeconds: optional(\"OPENGENI_BLAXEL_EXPOSED_PORT_URL_TTL_SECONDS\"),\n    blaxelMemoryMb: optional(\"OPENGENI_BLAXEL_MEMORY_MB\"),\n    blaxelTtl: optional(\"OPENGENI_BLAXEL_TTL\"),\n    cloudflareWorkerUrl: optional(\"OPENGENI_CLOUDFLARE_WORKER_URL\"),\n    cloudflareApiKey: optional(\"OPENGENI_CLOUDFLARE_API_KEY\"),\n    vercelToken: optional(\"OPENGENI_VERCEL_TOKEN\"),\n    vercelProjectId: optional(\"OPENGENI_VERCEL_PROJECT_ID\"),\n    vercelTeamId: optional(\"OPENGENI_VERCEL_TEAM_ID\"),\n    vercelRuntime: optional(\"OPENGENI_VERCEL_RUNTIME\"),\n    sandboxOwnershipEnabled: optional(\"OPENGENI_SANDBOX_OWNERSHIP_ENABLED\"),\n    rigVerificationLeaseOwnershipEnabled: optional(\n      \"OPENGENI_RIG_VERIFICATION_LEASE_OWNERSHIP_ENABLED\",\n    ),\n    sandboxLazyProvisionEnabled: optional(\"OPENGENI_SANDBOX_LAZY_PROVISION\"),\n    sandboxSelfhostedEnabled: optional(\"OPENGENI_SANDBOX_SELFHOSTED_ENABLED\"),\n    agentOpStreamEnabled: optional(\"OPENGENI_AGENT_OP_STREAM_ENABLED\"),\n    enrollmentSigningSecret: optional(\"OPENGENI_ENROLLMENT_SIGNING_SECRET\"),\n    selfhostedNatsUrl: optional(\"OPENGENI_SELFHOSTED_NATS_URL\"),\n    selfhostedRelayUrl: optional(\"OPENGENI_SELFHOSTED_RELAY_URL\"),\n    selfhostedRelayTokenSecret: optional(\"OPENGENI_SELFHOSTED_RELAY_TOKEN_SECRET\"),\n    agentUpdatePublicKey: optional(\"OPENGENI_AGENT_UPDATE_PUBLIC_KEY\"),\n    selfhostedNatsCalloutAccountSeed: optional(\"OPENGENI_SELFHOSTED_NATS_CALLOUT_ACCOUNT_SEED\"),\n    selfhostedNatsCalloutAccountName: optional(\"OPENGENI_SELFHOSTED_NATS_CALLOUT_ACCOUNT_NAME\"),\n    selfhostedNatsCalloutUser: optional(\"OPENGENI_SELFHOSTED_NATS_CALLOUT_USER\"),\n    selfhostedNatsCalloutPassword: optional(\"OPENGENI_SELFHOSTED_NATS_CALLOUT_PASSWORD\"),\n    selfhostedNatsControlUser: optional(\"OPENGENI_SELFHOSTED_NATS_CONTROL_USER\"),\n    selfhostedNatsControlPassword: optional(\"OPENGENI_SELFHOSTED_NATS_CONTROL_PASSWORD\"),\n    sandboxSelfhostedExecTimeoutMs: optional(\"OPENGENI_SANDBOX_SELFHOSTED_EXEC_TIMEOUT_MS\"),\n    sandboxSelfhostedControlTimeoutMs: optional(\"OPENGENI_SANDBOX_SELFHOSTED_CONTROL_TIMEOUT_MS\"),\n    sandboxLeaseReaperPeriodMs: optional(\"OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS\"),\n    sandboxViewerHolderTtlMs: optional(\"OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS\"),\n    sandboxIdleGraceMs: optional(\"OPENGENI_SANDBOX_IDLE_GRACE_MS\"),\n    sandboxSnapshotIntervalMs: optional(\"OPENGENI_SANDBOX_SNAPSHOT_INTERVAL_MS\"),\n    sandboxSnapshotTimeoutMs: optional(\"OPENGENI_SANDBOX_SNAPSHOT_TIMEOUT_MS\"),\n    sandboxRotationLeadMs: optional(\"OPENGENI_SANDBOX_ROTATION_LEAD_MS\"),\n    sandboxRotationBatchSize: optional(\"OPENGENI_SANDBOX_ROTATION_BATCH_SIZE\"),\n    sandboxLeaseTtlMs: optional(\"OPENGENI_SANDBOX_LEASE_TTL_MS\"),\n    sandboxLeaseWarmingTtlMs: optional(\"OPENGENI_SANDBOX_LEASE_WARMING_TTL_MS\"),\n    sandboxWarmingTimeoutMs: optional(\"OPENGENI_SANDBOX_WARMING_TIMEOUT_MS\"),\n    rigSetupTimeoutMs: optional(\"OPENGENI_RIG_SETUP_TIMEOUT_MS\"),\n    sandboxWarmRateMicrosPerSecondJson: optional(\n      \"OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON\",\n    ),\n    sandboxMaxWarmSecondsPerWorkspace: optional(\"OPENGENI_SANDBOX_MAX_WARM_SECONDS_PER_WORKSPACE\"),\n    sandboxPreparationProfiles: optional(\"OPENGENI_SANDBOX_PREPARATION_PROFILES\"),\n    sandboxEnvAllowlist: optional(\"OPENGENI_SANDBOX_ENV_ALLOWLIST\"),\n    objectStorageEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_ENDPOINT\"),\n    objectStorageInternalEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_INTERNAL_ENDPOINT\"),\n    objectStorageSandboxEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_SANDBOX_ENDPOINT\"),\n    objectStorageBackend: optional(\"OPENGENI_OBJECT_STORAGE_BACKEND\"),\n    objectStorageBucket: optional(\"OPENGENI_OBJECT_STORAGE_BUCKET\"),\n    objectStorageRegion: optional(\"OPENGENI_OBJECT_STORAGE_REGION\"),\n    objectStorageS3Provider: optional(\"OPENGENI_OBJECT_STORAGE_S3_PROVIDER\"),\n    objectStorageAccessKeyId: optional(\"OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID\"),\n    objectStorageSecretAccessKey: optional(\"OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY\"),\n    objectStorageForcePathStyle: optional(\"OPENGENI_OBJECT_STORAGE_FORCE_PATH_STYLE\"),\n    objectStorageAzureConnectionString: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_CONNECTION_STRING\"),\n    objectStorageAzureAccountName: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_NAME\"),\n    objectStorageAzureAccountKey: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_KEY\"),\n    objectStorageAzureEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ENDPOINT\"),\n    objectStorageGcsProjectId: optional(\"OPENGENI_OBJECT_STORAGE_GCS_PROJECT_ID\"),\n    objectStorageGcsCredentialsJson: optional(\"OPENGENI_OBJECT_STORAGE_GCS_CREDENTIALS_JSON\"),\n    objectStorageGcsKeyFilename: optional(\"OPENGENI_OBJECT_STORAGE_GCS_KEY_FILENAME\"),\n    objectStorageGcsApiEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_GCS_API_ENDPOINT\"),\n    documentParser: optional(\"OPENGENI_DOCUMENT_PARSER\"),\n    documentChunkSize: optional(\"OPENGENI_DOCUMENT_CHUNK_SIZE\"),\n    documentChunkOverlap: optional(\"OPENGENI_DOCUMENT_CHUNK_OVERLAP\"),\n    documentEmbeddingProvider: optional(\"OPENGENI_DOCUMENT_EMBEDDING_PROVIDER\"),\n    documentEmbeddingModel: optional(\"OPENGENI_DOCUMENT_EMBEDDING_MODEL\"),\n    documentEmbeddingDimensions: optional(\"OPENGENI_DOCUMENT_EMBEDDING_DIMENSIONS\"),\n    documentEmbeddingApiKey: optional(\"OPENGENI_DOCUMENT_EMBEDDING_API_KEY\"),\n    documentEmbeddingBaseUrl: optional(\"OPENGENI_DOCUMENT_EMBEDDING_BASE_URL\"),\n    documentCurationProvider: optional(\"OPENGENI_DOCUMENT_CURATION_PROVIDER\"),\n    documentCurationModel: optional(\"OPENGENI_DOCUMENT_CURATION_MODEL\"),\n    documentCurationApiKey: optional(\"OPENGENI_DOCUMENT_CURATION_API_KEY\"),\n    documentCurationBaseUrl: optional(\"OPENGENI_DOCUMENT_CURATION_BASE_URL\"),\n    gitAuthorName: optional(\"OPENGENI_GIT_AUTHOR_NAME\"),\n    gitAuthorEmail: optional(\"OPENGENI_GIT_AUTHOR_EMAIL\"),\n    gitCommitterName: optional(\"OPENGENI_GIT_COMMITTER_NAME\"),\n    gitCommitterEmail: optional(\"OPENGENI_GIT_COMMITTER_EMAIL\"),\n    githubAppManifestBaseUrl: optional(\"OPENGENI_GITHUB_APP_MANIFEST_BASE_URL\"),\n    githubAppManifestStateSecret: optional(\"OPENGENI_GITHUB_APP_MANIFEST_STATE_SECRET\"),\n    githubAppId: optional(\"OPENGENI_GITHUB_APP_ID\"),\n    githubClientId: optional(\"OPENGENI_GITHUB_CLIENT_ID\"),\n    githubClientSecret: optional(\"OPENGENI_GITHUB_CLIENT_SECRET\"),\n    githubAppSlug: optional(\"OPENGENI_GITHUB_APP_SLUG\"),\n    githubWebhookSecret: optional(\"OPENGENI_GITHUB_WEBHOOK_SECRET\"),\n    githubAppPrivateKey: optional(\"OPENGENI_GITHUB_APP_PRIVATE_KEY\"),\n    betterAuthSecret: optional(\"OPENGENI_BETTER_AUTH_SECRET\"),\n    betterAuthAllowedHosts: optional(\"OPENGENI_BETTER_AUTH_ALLOWED_HOSTS\"),\n    betterAuthCookieDomain: optional(\"OPENGENI_BETTER_AUTH_COOKIE_DOMAIN\"),\n    betterAuthTrustedOrigins: optional(\"OPENGENI_BETTER_AUTH_TRUSTED_ORIGINS\"),\n    resendApiKey: optional(\"OPENGENI_RESEND_API_KEY\"),\n    emailFrom: optional(\"OPENGENI_EMAIL_FROM\"),\n    stripeSecretKey: optional(\"OPENGENI_STRIPE_SECRET_KEY\"),\n    stripePublishableKey: optional(\"OPENGENI_STRIPE_PUBLISHABLE_KEY\"),\n    stripeWebhookSecret: optional(\"OPENGENI_STRIPE_WEBHOOK_SECRET\"),\n    stripeCreditsProductId: optional(\"OPENGENI_STRIPE_CREDITS_PRODUCT_ID\"),\n    mcpServers: parseMcpServers(optional(\"OPENGENI_MCP_SERVERS\")),\n  };\n  const parsed = SettingsSchema.parse(raw);\n  const settings = {\n    ...parsed,\n    sandboxIdleGraceMs:\n      raw.sandboxIdleGraceMs === undefined\n        ? Math.min(900_000, Math.floor((parsed.modalTimeoutSeconds * 1000) / 2))\n        : parsed.sandboxIdleGraceMs,\n    sandboxRotationLeadMs:\n      raw.sandboxRotationLeadMs === undefined\n        ? Math.min(3_600_000, Math.floor((parsed.modalTimeoutSeconds * 1000) / 2))\n        : parsed.sandboxRotationLeadMs,\n    mcpServers: ensureBuiltInMcpServers(parsed),\n  };\n  validateSettings(settings);\n  return settings;\n}\n\nconst LOCAL_FIRST_PARTY_DELEGATION_SECRET = \"opengeni-local-first-party-delegation-secret-v1\";\n\n/**\n * First-party session tools need a shared HMAC identity even in the unauthenticated\n * local product mode. A fixed local-only value is no broader than that mode's\n * existing access boundary, while configured and managed deployments continue to\n * require an operator-provided secret.\n */\nexport function resolveFirstPartyDelegationSecret(settings: Settings): string | undefined {\n  const explicit = settings.delegationSecret?.trim();\n  if (explicit) return explicit;\n  return settings.productAccessMode === \"local\" &&\n    (settings.environment === \"local\" || settings.environment === \"test\")\n    ? LOCAL_FIRST_PARTY_DELEGATION_SECRET\n    : undefined;\n}\n\n/**\n * The Modal sandbox idle timeout (seconds) the provider actually passes as\n * idleTimeoutMs (sandbox-file-persistence). When the operator did not pin\n * OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS we DEFAULT it to the hard lifetime\n * (modalTimeoutSeconds): OpenGeni's reaper owns box lifecycle, so Modal's\n * built-in idle-reap (which would otherwise fire on its short server default and\n * kill the box BEFORE the reaper can snapshot /workspace) is pushed out to the\n * hard backstop. An explicit smaller value is honoured (the boot invariant keeps\n * it above reaperPeriod + idleGrace so a drained box still survives long enough\n * to be persisted).\n */\nexport function effectiveModalIdleTimeoutSeconds(settings: Settings): number {\n  return settings.modalIdleTimeoutSeconds ?? settings.modalTimeoutSeconds;\n}\n\n/**\n * One shared upper bound for the durable provider-capture claim and for command\n * admission waiting behind it. The SDK request itself is bounded by\n * sandboxSnapshotTimeoutMs; the extra window lets a non-cancellable provider\n * response settle and release its exact claim without turning a normal\n * checkpoint into a visible command failure. Database validation caps both\n * consumers at one hour.\n */\nexport function sandboxArchiveCaptureTimeoutMs(\n  settings: Pick<Settings, \"sandboxSnapshotTimeoutMs\">,\n): number {\n  return Math.min(\n    60 * 60_000,\n    Math.max(settings.sandboxSnapshotTimeoutMs + 30_000, settings.sandboxSnapshotTimeoutMs * 2),\n  );\n}\n\nexport function collectSandboxEnvironment(\n  settings: Settings,\n  source: NodeJS.ProcessEnv = process.env,\n): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const name of sandboxEnvironmentVariableNames(settings)) {\n    const value = source[name];\n    if (value) {\n      out[name] = value;\n    }\n  }\n  return out;\n}\n\n/**\n * Resolved API key for a registry provider: the inline `apiKey` when present,\n * else the value of the env var named by `apiKeyEnv`. The preferred form is\n * `apiKeyEnv` (the secret stays out of OPENGENI_MODEL_PROVIDERS_JSON). Reads\n * from `source` (defaults to process.env) so callers can resolve against an\n * explicit environment in tests.\n */\nexport function resolveProviderApiKey(\n  provider: Pick<RegistryProvider, \"apiKey\" | \"apiKeyEnv\">,\n  source: NodeJS.ProcessEnv = process.env,\n): string | undefined {\n  if (provider.apiKey) {\n    return provider.apiKey;\n  }\n  if (provider.apiKeyEnv) {\n    const value = source[provider.apiKeyEnv];\n    return value && value.trim().length > 0 ? value : undefined;\n  }\n  return undefined;\n}\n\nconst HTTP_FIELD_NAME = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\nconst CREDENTIAL_LIKE_NAME_PARTS = new Set([\n  \"apikey\",\n  \"auth\",\n  \"authorization\",\n  \"bearer\",\n  \"credential\",\n  \"cookie\",\n  \"key\",\n  \"password\",\n  \"secret\",\n  \"session\",\n  \"signature\",\n  \"token\",\n]);\nconst REASONING_EFFORT_ORDER = new Map(\n  ReasoningEffort.options.map((effort, index) => [effort, index]),\n);\nconst MODALITY_ORDER = new Map([\"text\", \"image\", \"audio\"].map((value, index) => [value, index]));\nconst LATENCY_MODE_ORDER = new Map(\n  [\"standard\", \"priority\", \"fast\"].map((value, index) => [value, index]),\n);\n\nfunction normalizeRegistryBaseUrl(value: string, providerId: string): string {\n  const url = new URL(value);\n  if (url.username || url.password) {\n    throw new Error(`provider ${providerId} baseUrl must not contain userinfo`);\n  }\n  if (url.search) {\n    throw new Error(\n      `provider ${providerId} baseUrl must not contain a query; move query entries to defaultQuery`,\n    );\n  }\n  if (url.hash) {\n    throw new Error(`provider ${providerId} baseUrl must not contain a fragment`);\n  }\n  return url.toString();\n}\n\nfunction isCredentialLikeMetadataName(name: string): boolean {\n  return name\n    .toLowerCase()\n    .split(/[-_.]/u)\n    .some((part) => CREDENTIAL_LIKE_NAME_PARTS.has(part));\n}\n\nfunction normalizeHeaderMap(\n  providerId: string,\n  headers: Record<string, string> | undefined,\n): Record<string, string> | undefined {\n  if (!headers) {\n    return undefined;\n  }\n  const normalized: Record<string, string> = {};\n  const rawByNormalized = new Map<string, string>();\n  for (const [rawName, value] of Object.entries(headers)) {\n    if (!HTTP_FIELD_NAME.test(rawName)) {\n      throw new Error(\n        `provider ${providerId} defaultHeaders contains invalid HTTP field name ${JSON.stringify(rawName)}`,\n      );\n    }\n    const name = rawName.toLowerCase();\n    const previous = rawByNormalized.get(name);\n    if (previous !== undefined) {\n      throw new Error(\n        `provider ${providerId} defaultHeaders names ${JSON.stringify(previous)} and ${JSON.stringify(rawName)} collide after lowercase normalization`,\n      );\n    }\n    if (name === \"authorization\") {\n      throw new Error(\n        `provider ${providerId} defaultHeaders must not override SDK-managed Authorization`,\n      );\n    }\n    rawByNormalized.set(name, rawName);\n    normalized[name] = value;\n  }\n  return normalized;\n}\n\nfunction normalizePublicHeaderNames(\n  providerId: string,\n  names: string[] | undefined,\n  headers: Record<string, string> | undefined,\n): string[] | undefined {\n  if (!names) {\n    return undefined;\n  }\n  const normalized: string[] = [];\n  const seen = new Set<string>();\n  for (const rawName of names) {\n    if (!HTTP_FIELD_NAME.test(rawName)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultHeaderNames contains invalid HTTP field name ${JSON.stringify(rawName)}`,\n      );\n    }\n    const name = rawName.toLowerCase();\n    if (seen.has(name)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultHeaderNames contains duplicate normalized name ${JSON.stringify(name)}`,\n      );\n    }\n    if (!(name in (headers ?? {}))) {\n      throw new Error(\n        `provider ${providerId} publicDefaultHeaderNames declares absent defaultHeaders entry ${JSON.stringify(name)}`,\n      );\n    }\n    if (isCredentialLikeMetadataName(name)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultHeaderNames cannot classify credential-like name ${JSON.stringify(name)} as public`,\n      );\n    }\n    seen.add(name);\n    normalized.push(name);\n  }\n  return normalized;\n}\n\nfunction normalizeQueryMap(\n  providerId: string,\n  query: Record<string, string> | undefined,\n): Record<string, string> | undefined {\n  if (!query) {\n    return undefined;\n  }\n  for (const name of Object.keys(query)) {\n    if (!name) {\n      throw new Error(`provider ${providerId} defaultQuery contains an empty name`);\n    }\n  }\n  return { ...query };\n}\n\nfunction normalizePublicQueryNames(\n  providerId: string,\n  names: string[] | undefined,\n  query: Record<string, string> | undefined,\n): string[] | undefined {\n  if (!names) {\n    return undefined;\n  }\n  const seen = new Set<string>();\n  for (const name of names) {\n    if (seen.has(name)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultQueryNames contains duplicate name ${JSON.stringify(name)}`,\n      );\n    }\n    if (!(name in (query ?? {}))) {\n      throw new Error(\n        `provider ${providerId} publicDefaultQueryNames declares absent defaultQuery entry ${JSON.stringify(name)}`,\n      );\n    }\n    if (isCredentialLikeMetadataName(name)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultQueryNames cannot classify credential-like name ${JSON.stringify(name)} as public`,\n      );\n    }\n    seen.add(name);\n  }\n  return [...names];\n}\n\nfunction normalizeRegistryProvider(provider: RegistryProvider): RegistryProvider {\n  const defaultHeaders = normalizeHeaderMap(provider.id, provider.defaultHeaders);\n  const defaultQuery = normalizeQueryMap(provider.id, provider.defaultQuery);\n  return {\n    ...provider,\n    baseUrl: normalizeRegistryBaseUrl(provider.baseUrl, provider.id),\n    ...(defaultHeaders === undefined ? {} : { defaultHeaders }),\n    ...(defaultQuery === undefined ? {} : { defaultQuery }),\n    ...(provider.publicDefaultHeaderNames === undefined\n      ? {}\n      : {\n          publicDefaultHeaderNames: normalizePublicHeaderNames(\n            provider.id,\n            provider.publicDefaultHeaderNames,\n            defaultHeaders,\n          ),\n        }),\n    ...(provider.publicDefaultQueryNames === undefined\n      ? {}\n      : {\n          publicDefaultQueryNames: normalizePublicQueryNames(\n            provider.id,\n            provider.publicDefaultQueryNames,\n            defaultQuery,\n          ),\n        }),\n  };\n}\n\nfunction normalizeModelPricingSchedule(\n  pricing: ModelPricing | ModelPricingScheduleV1,\n): ModelPricingScheduleV1 {\n  return \"default\" in pricing ? pricing : { default: pricing };\n}\n\nfunction normalizeCapabilities(capabilities: ModelCapabilitiesV1): ModelCapabilitiesV1 {\n  const parsed = ModelCapabilitiesV1Schema.parse(capabilities);\n  return {\n    ...parsed,\n    reasoning: {\n      ...parsed.reasoning,\n      efforts: [...parsed.reasoning.efforts].sort(\n        (left, right) =>\n          (REASONING_EFFORT_ORDER.get(left) ?? 0) - (REASONING_EFFORT_ORDER.get(right) ?? 0),\n      ),\n    },\n    inputModalities: [...parsed.inputModalities].sort(\n      (left, right) => (MODALITY_ORDER.get(left) ?? 0) - (MODALITY_ORDER.get(right) ?? 0),\n    ),\n    inputFileMediaTypes: [...new Set(parsed.inputFileMediaTypes)].sort(),\n    outputModalities: [...parsed.outputModalities].sort(\n      (left, right) => (MODALITY_ORDER.get(left) ?? 0) - (MODALITY_ORDER.get(right) ?? 0),\n    ),\n    latencyModes: [...parsed.latencyModes].sort(\n      (left, right) =>\n        (LATENCY_MODE_ORDER.get(left.id) ?? 0) - (LATENCY_MODE_ORDER.get(right.id) ?? 0),\n    ),\n  };\n}\n\nfunction legacyModelCapabilities(\n  settings: Settings,\n  input: { reasoningEffort: boolean; hostedWebSearch: boolean; vision?: boolean },\n): ModelCapabilitiesV1 {\n  const reasoningEfforts = input.reasoningEffort ? configuredAllowedReasoningEfforts(settings) : [];\n  return normalizeCapabilities({\n    reasoning: {\n      upstream: input.reasoningEffort ? \"supported\" : \"unknown\",\n      runnable: input.reasoningEffort,\n      efforts: reasoningEfforts,\n      defaultEffort: input.reasoningEffort ? settings.openaiReasoningEffort : null,\n      required: false,\n    },\n    functionCalling: { upstream: \"unknown\", runnable: true },\n    structuredOutput: { upstream: \"unknown\", runnable: false },\n    hostedTools: {\n      webSearch: {\n        upstream: input.hostedWebSearch ? \"supported\" : \"unknown\",\n        runnable: input.hostedWebSearch,\n      },\n      xSearch: { upstream: \"unknown\", runnable: false },\n      codeExecution: { upstream: \"unknown\", runnable: false },\n    },\n    inputModalities: input.vision ? [\"text\", \"image\"] : [\"text\"],\n    inputFileMediaTypes: [\n      \"application/json\",\n      \"application/pdf\",\n      \"application/x-yaml\",\n      \"application/yaml\",\n      \"text/*\",\n    ],\n    outputModalities: [\"text\"],\n    transports: {\n      sse: { upstream: \"unknown\", runnable: true },\n      responsesWebSocket: { upstream: \"unknown\", runnable: false },\n      realtimeAudio: { upstream: \"unknown\", runnable: false },\n    },\n    latencyModes: [{ id: \"standard\", upstream: \"unknown\", runnable: true }],\n  });\n}\n\nexport function gatewayRequestPolicyForUpstreamModel(\n  upstreamModelId: string,\n): ConfiguredModel[\"requestPolicy\"] {\n  const model = Object.values(OPENGENI_GATEWAY_MODELS).find(\n    (candidate) => candidate.upstreamModelId === upstreamModelId,\n  );\n  if (!model) {\n    return undefined;\n  }\n  return {\n    gateway: {\n      only: [...model.providers] as [string, ...string[]],\n      caching: model.implicitCaching ? \"auto\" : \"none\",\n    },\n  };\n}\n\nfunction gatewayModelCapabilities(\n  settings: Settings,\n  input: { implicitCaching: boolean; vision: boolean; inputFileMediaTypes?: string[] },\n): ModelCapabilitiesV1 {\n  const legacy = legacyModelCapabilities(settings, {\n    reasoningEffort: true,\n    hostedWebSearch: false,\n  });\n  return normalizeCapabilities({\n    ...legacy,\n    functionCalling: { upstream: \"supported\", runnable: true },\n    inputModalities: input.vision ? [\"text\", \"image\"] : [\"text\"],\n    inputFileMediaTypes: input.inputFileMediaTypes ?? [],\n    transports: {\n      ...legacy.transports,\n      sse: { upstream: \"supported\", runnable: true },\n    },\n    promptCaching: input.implicitCaching\n      ? { upstream: \"supported\", runnable: true, mode: \"implicit\" }\n      : { upstream: \"unsupported\", runnable: false, mode: \"none\" },\n    // Both Gateway products expose one reviewed route policy and no separately\n    // billed latency mode.\n    latencyModes: [{ id: \"standard\", upstream: \"supported\", runnable: true }],\n  });\n}\n\nfunction gatewayRegistryProvider(\n  settings: Settings,\n  input:\n    | { kind: \"vercel-gateway-managed\"; apiKey: string }\n    | { kind: \"vercel-gateway-workspace\"; apiKey?: string },\n): RegistryProvider {\n  const workspace = input.kind === \"vercel-gateway-workspace\";\n  const models = [OPENGENI_GATEWAY_MODELS.deepseek, OPENGENI_GATEWAY_MODELS.kimi].map((model) => {\n    const kimi = model === OPENGENI_GATEWAY_MODELS.kimi;\n    return {\n      id: workspace ? model.workspaceProductId : model.productId,\n      upstreamModelId: model.upstreamModelId,\n      label: model.label,\n      shortLabel: model.shortLabel,\n      capabilities: gatewayModelCapabilities(settings, {\n        implicitCaching: model.implicitCaching,\n        vision: kimi,\n        inputFileMediaTypes: kimi ? [\"application/pdf\"] : [],\n      }),\n      contextWindowTokens: 1_000_000,\n      effectiveContextWindowTokens: 900_000,\n      autoCompactTokenLimit: 850_000,\n      toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n    };\n  });\n  return {\n    kind: input.kind,\n    id: workspace ? WORKSPACE_GATEWAY_PROVIDER_ID : OPENGENI_GATEWAY_PROVIDER_ID,\n    label: workspace ? \"Your Gateway\" : \"OpenGeni\",\n    // Responses preserves vision, reasoning items, and provider-native usage.\n    // Model-specific compatibility stays at the reviewed request fence rather\n    // than downgrading the whole provider wire.\n    api: \"responses\",\n    baseUrl: VERCEL_AI_GATEWAY_BASE_URL,\n    ...(input.apiKey ? { apiKey: input.apiKey } : {}),\n    models,\n  };\n}\n\nfunction configuredRegistryProviders(settings: Settings): RegistryProvider[] {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  if (!settings.vercelAiGatewayApiKey) {\n    return providers;\n  }\n  if (providers.some((provider) => provider.id === OPENGENI_GATEWAY_PROVIDER_ID)) {\n    throw new Error(\n      `${OPENGENI_GATEWAY_PROVIDER_ID} is reserved for OPENGENI_VERCEL_AI_GATEWAY_API_KEY`,\n    );\n  }\n  return [\n    ...providers,\n    gatewayRegistryProvider(settings, {\n      kind: \"vercel-gateway-managed\",\n      apiKey: settings.vercelAiGatewayApiKey,\n    }),\n  ];\n}\n\n/** Static catalog overlay; it contains no concrete workspace credential. */\nexport function withWorkspaceGatewayCatalogProvider(settings: Settings): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  if (providers.some((provider) => provider.id === WORKSPACE_GATEWAY_PROVIDER_ID)) {\n    return settings;\n  }\n  return {\n    ...settings,\n    modelProvidersJson: JSON.stringify([\n      ...providers,\n      gatewayRegistryProvider(settings, { kind: \"vercel-gateway-workspace\" }),\n    ]),\n  };\n}\n\n/** Runtime overlay after the worker resolves the workspace's encrypted key. */\nexport function withWorkspaceGatewayCredential(settings: Settings, apiKey: string): Settings {\n  if (!apiKey.trim()) {\n    throw new Error(\"workspace AI Gateway credential is empty\");\n  }\n  const catalogSettings = withWorkspaceGatewayCatalogProvider(settings);\n  const providers = parseModelProvidersJson(catalogSettings.modelProvidersJson).map((provider) =>\n    provider.id === WORKSPACE_GATEWAY_PROVIDER_ID ? { ...provider, apiKey } : provider,\n  );\n  return { ...catalogSettings, modelProvidersJson: JSON.stringify(providers) };\n}\n\n/** OpenAI GPT-5.6 Fast mode is 2× Standard list rates (service_tier fast/priority). */\nconst GPT56_FAST_BILLING_MULTIPLIER_BPS = 20_000;\n\n/**\n * Product display label for catalog/picker UI.\n * Same string for OpenAI and Codex copies of a slug (`gpt-5.6-luna` and\n * `codex/gpt-5.6-luna` → `GPT-5.6 Luna`). Non-gpt ids pass through unchanged.\n */\nexport function productLabelForModelId(modelId: string): string {\n  const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX)\n    ? modelId.slice(CODEX_MODEL_ID_PREFIX.length)\n    : modelId;\n  const match = /^(gpt-\\d+(?:\\.\\d+)?)(?:-(.+))?$/i.exec(slug);\n  if (!match) {\n    return slug;\n  }\n  const family = match[1]!.replace(/^gpt/i, \"GPT\");\n  const rest = match[2];\n  if (!rest) {\n    return family;\n  }\n  const suffix = rest\n    .split(\"-\")\n    .filter((part) => part.length > 0)\n    .map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase())\n    .join(\" \");\n  return suffix.length > 0 ? `${family} ${suffix}` : family;\n}\n\n/**\n * Curated compact product labels for dense UI. Only known GPT family slugs;\n * everything else returns null so callers fall back to the full `label`.\n */\nexport function productShortLabelForModelId(modelId: string): string | null {\n  const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX)\n    ? modelId.slice(CODEX_MODEL_ID_PREFIX.length)\n    : modelId;\n  switch (slug) {\n    case \"gpt-5.6-sol\":\n      return \"5.6 Sol\";\n    case \"gpt-5.6-terra\":\n      return \"5.6 Terra\";\n    case \"gpt-5.6-luna\":\n      return \"5.6 Luna\";\n    default:\n      return null;\n  }\n}\n\nfunction builtinLatencyModesForModel(modelId: string): Array<{\n  id: z.infer<typeof ModelLatencyModeV1>;\n  upstream: \"supported\" | \"unsupported\" | \"unknown\";\n  runnable: boolean;\n  billingMultiplierBps?: number;\n}> {\n  if (\n    modelId === \"gpt-5.6-sol\" ||\n    modelId === \"gpt-5.6-terra\" ||\n    modelId === \"gpt-5.6-luna\" ||\n    modelId.startsWith(\"codex/gpt-5.6-\")\n  ) {\n    return [\n      { id: \"standard\", upstream: \"supported\", runnable: true },\n      {\n        id: \"fast\",\n        upstream: \"supported\",\n        runnable: true,\n        billingMultiplierBps: GPT56_FAST_BILLING_MULTIPLIER_BPS,\n      },\n    ];\n  }\n  return [{ id: \"standard\", upstream: \"unknown\", runnable: true }];\n}\n\nfunction builtinPromptCachingForModel(\n  modelId: string,\n): NonNullable<ModelCapabilitiesV1[\"promptCaching\"]> | undefined {\n  const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX)\n    ? modelId.slice(CODEX_MODEL_ID_PREFIX.length)\n    : modelId;\n  return slug.startsWith(\"gpt-5.6-\")\n    ? { upstream: \"supported\", runnable: true, mode: \"implicit\" }\n    : undefined;\n}\n\n/**\n * Map OpenGeni latency mode to the provider `service_tier` wire value.\n * Azure and Codex ChatGPT accept `priority`; OpenAI API accepts `fast` (alias of priority).\n * Standard omits the field.\n */\nexport function serviceTierForLatencyMode(\n  providerId: string,\n  latencyMode: LatencyMode,\n): \"fast\" | \"priority\" | undefined {\n  if (latencyMode === \"standard\") {\n    return undefined;\n  }\n  if (providerId === \"azure\" || providerId === CODEX_PROVIDER_ID) {\n    return \"priority\";\n  }\n  return \"fast\";\n}\n\n/** True when the response tier fulfills a non-standard Fast/priority request. */\nexport function responseSatisfiesLatencyMode(\n  requested: LatencyMode,\n  responseServiceTier: string | null | undefined,\n): boolean {\n  if (requested === \"standard\") {\n    return true;\n  }\n  return responseServiceTier === \"priority\" || responseServiceTier === \"fast\";\n}\n\nexport function runnableLatencyModesForModel(settings: Settings, modelId: string): LatencyMode[] {\n  const resolved = resolveModelProvider(\n    settingsForTurnExecutionPolicy(settings, modelId),\n    canonicalizeConfiguredModelId(settings, modelId),\n  );\n  if (!resolved) {\n    return [\"standard\"];\n  }\n  return resolved.model.capabilities.latencyModes\n    .filter((mode) => mode.runnable)\n    .map((mode) => LatencyMode.parse(mode.id));\n}\n\nfunction assertLatencyModeRunnable(\n  settings: Settings,\n  modelId: string,\n  latencyMode: LatencyMode,\n): void {\n  const runnable = runnableLatencyModesForModel(settings, modelId);\n  if (!runnable.includes(latencyMode)) {\n    throw new Error(\n      `latency mode ${latencyMode} is not runnable for model ${modelId} (allowed: ${runnable.join(\", \")})`,\n    );\n  }\n}\n\nfunction registryCredentialSource(provider: RegistryProvider): CredentialSourceV1 {\n  if (provider.kind === \"codex-subscription\") {\n    return { kind: \"connected_subscription\", provider: \"codex\" };\n  }\n  if (provider.kind === \"vercel-gateway-workspace\") {\n    return { kind: \"workspace_connection\", mechanism: \"api_key\" };\n  }\n  return { kind: \"deployment\", mechanism: \"api_key\" };\n}\n\nfunction registryBilling(provider: RegistryProvider): BillingAttributionV1 {\n  if (provider.kind === \"codex-subscription\") {\n    return { upstreamPayer: \"connected_subscription\", metering: \"external\" };\n  }\n  if (provider.kind === \"vercel-gateway-workspace\") {\n    return { upstreamPayer: \"workspace\", metering: \"external\" };\n  }\n  return { upstreamPayer: \"deployment\", metering: \"opengeni_credits\" };\n}\n\nfunction builtinCredentialSource(settings: Settings): CredentialSourceV1 {\n  if (settings.openaiProvider === \"azure\" && !settings.azureOpenaiApiKey) {\n    return { kind: \"deployment\", mechanism: \"azure_ad_bearer\" };\n  }\n  return { kind: \"deployment\", mechanism: \"api_key\" };\n}\n\nfunction staticRequestMetadataForDigest(provider: ResolvedModelProvider): {\n  headers: Array<{\n    name: string;\n    classification: \"public\" | \"secret\";\n    value?: string;\n  }>;\n  query: Array<{\n    name: string;\n    classification: \"public\" | \"secret\";\n    value?: string;\n  }>;\n} {\n  const publicHeaders = new Set(provider.publicDefaultHeaderNames ?? []);\n  const publicQuery = new Set(provider.publicDefaultQueryNames ?? []);\n  return {\n    headers: Object.entries(provider.defaultHeaders ?? {})\n      .sort(([left], [right]) => left.localeCompare(right))\n      .map(([name, value]) =>\n        publicHeaders.has(name)\n          ? { name, classification: \"public\" as const, value }\n          : { name, classification: \"secret\" as const },\n      ),\n    query: Object.entries(provider.defaultQuery ?? {})\n      .sort(([left], [right]) => left.localeCompare(right))\n      .map(([name, value]) =>\n        publicQuery.has(name)\n          ? { name, classification: \"public\" as const, value }\n          : { name, classification: \"secret\" as const },\n      ),\n  };\n}\n\nfunction canonicalJson(value: unknown): string {\n  const normalize = (input: unknown): unknown => {\n    if (Array.isArray(input)) {\n      return input.map((entry) => normalize(entry));\n    }\n    if (input && typeof input === \"object\") {\n      const out: Record<string, unknown> = {};\n      for (const key of Object.keys(input).sort()) {\n        const child = (input as Record<string, unknown>)[key];\n        if (child !== undefined) {\n          out[key] = normalize(child);\n        }\n      }\n      return out;\n    }\n    return input;\n  };\n  return JSON.stringify(normalize(value));\n}\n\nfunction definitionVersionFor(\n  model: Omit<ConfiguredModel, \"definitionVersion\">,\n  provider: ResolvedModelProvider,\n): string {\n  const requestMetadata = staticRequestMetadataForDigest(provider);\n  const digestInput = canonicalJson({\n    schemaVersion: model.schemaVersion,\n    id: model.id,\n    providerId: model.providerId,\n    deployment: model.deployment,\n    provider: {\n      adapterKind: provider.kind,\n      wireApi: provider.api,\n      baseUrl: provider.baseUrl ?? null,\n      defaultHeaders: requestMetadata.headers,\n      defaultQuery: requestMetadata.query,\n    },\n    credentialSource: model.credentialSource,\n    billing: model.billing,\n    executionLimits: model.executionLimits,\n    capabilities: model.capabilities,\n    ...(model.requestPolicy ? { requestPolicy: model.requestPolicy } : {}),\n    pricing: model.pricing ?? null,\n  });\n  return `sha256:${createHash(\"sha256\")\n    .update(\"opengeni:model-definition:v1\\n\", \"utf8\")\n    .update(digestInput, \"utf8\")\n    .digest(\"hex\")}`;\n}\n\n/**\n * The built-in provider's stable id: \"openai\" on the OpenAI platform, \"azure\"\n * on Azure. Exported because the workspace model-policy gate must attribute\n * the legacy resolveTurnModel-null fallback (which routes to this built-in\n * client) to the SAME identity the router uses — otherwise a policy blocking\n * the built-in could be bypassed through the null-resolution path.\n */\nexport function builtinProviderId(settings: Pick<Settings, \"openaiProvider\">): string {\n  return settings.openaiProvider === \"azure\" ? \"azure\" : \"openai\";\n}\n\nfunction builtinProviderLabel(settings: Pick<Settings, \"openaiProvider\">): string {\n  return settings.openaiProvider === \"azure\" ? \"Azure OpenAI\" : \"OpenAI\";\n}\n\n/**\n * Every provider a client may route to: the built-in OpenAI/Azure provider\n * first (id \"openai\"/\"azure\", always \"responses\"), then each registry provider\n * in declaration order. Client-construction inputs are filled from\n * the existing flat openai/azure settings for the built-in, and from the\n * registry entry for the rest. Registry ids may not collide with the built-in\n * id — validateSettings rejects that at boot.\n */\nexport function configuredProviders(settings: Settings): ResolvedModelProvider[] {\n  const credentialSource = builtinCredentialSource(settings);\n  const builtin: ResolvedModelProvider = {\n    id: builtinProviderId(settings),\n    label: builtinProviderLabel(settings),\n    kind: \"api-key\",\n    api: \"responses\",\n    builtin: true,\n    credentialSource,\n    billing: { upstreamPayer: \"deployment\", metering: \"opengeni_credits\" },\n  };\n  if (settings.openaiProvider === \"azure\") {\n    const baseUrl = settings.azureOpenaiBaseUrl ?? settings.azureOpenaiEndpoint;\n    builtin.baseUrl = baseUrl ? normalizeRegistryBaseUrl(baseUrl, builtin.id) : undefined;\n    builtin.apiKey = settings.azureOpenaiApiKey ?? settings.azureOpenaiAdToken;\n  } else {\n    builtin.baseUrl = settings.openaiBaseUrl\n      ? normalizeRegistryBaseUrl(settings.openaiBaseUrl, builtin.id)\n      : undefined;\n    builtin.apiKey = settings.openaiApiKey;\n  }\n  const registry = configuredRegistryProviders(settings).map(\n    (provider): ResolvedModelProvider => ({\n      id: provider.id,\n      label: provider.label ?? provider.id,\n      kind: provider.kind,\n      api: provider.api,\n      builtin: false,\n      baseUrl: provider.baseUrl,\n      apiKey: resolveProviderApiKey(provider),\n      defaultQuery: provider.defaultQuery,\n      defaultHeaders: provider.defaultHeaders,\n      publicDefaultQueryNames: provider.publicDefaultQueryNames,\n      publicDefaultHeaderNames: provider.publicDefaultHeaderNames,\n      credentialSource: registryCredentialSource(provider),\n      billing: registryBilling(provider),\n    }),\n  );\n  return [builtin, ...registry];\n}\n\n/**\n * Pure catalog overlay for a workspace whose existing Codex connection seam\n * reports ready. This describes product/provider identity only; it does not\n * select, lease, refresh, or expose a concrete credential; those runtime\n * operations remain owned by the credential allocator.\n */\nexport function withCodexCatalogProvider(settings: Settings): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  if (providers.some((provider) => provider.id === CODEX_PROVIDER_ID)) {\n    return settings;\n  }\n  const provider: RegistryProvider = {\n    kind: \"codex-subscription\",\n    id: CODEX_PROVIDER_ID,\n    label: \"Codex (ChatGPT subscription)\",\n    api: \"responses\",\n    baseUrl: CODEX_PROVIDER_BASE_URL,\n    models: CODEX_FALLBACK_MODEL_SLUGS.map((slug) => {\n      const capabilities = {\n        ...legacyModelCapabilities(settings, {\n          reasoningEffort: true,\n          hostedWebSearch: true,\n          vision: slug.startsWith(\"gpt-5.6-\"),\n        }),\n        ...(builtinPromptCachingForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`)\n          ? {\n              promptCaching: builtinPromptCachingForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`)!,\n            }\n          : {}),\n        latencyModes: builtinLatencyModesForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`),\n      };\n      return {\n        id: `${CODEX_MODEL_ID_PREFIX}${slug}`,\n        upstreamModelId: slug,\n        label: productLabelForModelId(slug),\n        ...(productShortLabelForModelId(slug)\n          ? { shortLabel: productShortLabelForModelId(slug)! }\n          : {}),\n        reasoningEffort: true,\n        // The ChatGPT/Codex Responses backend accepts the native web_search\n        // hosted tool (unlike hosted apply_patch/computer transports). Declaring\n        // this here makes provider resolution truthful; the worker still applies\n        // the durable session/turn policy gate before attaching it.\n        hostedWebSearch: true,\n        capabilities,\n        contextWindowTokens: CODEX_MODEL_CONTEXT_WINDOW_TOKENS,\n        effectiveContextWindowTokens: CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,\n        autoCompactTokenLimit: CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT,\n        toolOutputTruncationTokens: CODEX_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS,\n      };\n    }),\n  };\n  return {\n    ...settings,\n    modelProvidersJson: JSON.stringify([...providers, provider]),\n  };\n}\n\n/**\n * The provider identity a model id resolves to, for workspace model-policy\n * evaluation — MUST agree with the real router (resolveTurnModel /\n * MultiProviderModelProvider) on every case:\n *   - `codex/<slug>` → the codex-subscription provider id, ALWAYS. With no\n *     active subscription the router fails loud (CodexSubscriptionUnavailableError),\n *     never the built-in — so attributing by prefix is exact even against BASE\n *     settings where the overlay provider is not injected.\n *   - a configured model id → its configuredModels providerId (registry or built-in).\n *   - anything else → the built-in id: an unknown id is the legacy\n *     resolveTurnModel-null fallback, which the built-in OpenAI/Azure client\n *     serves. A policy blocking the built-in must block this path too.\n */\nexport function policyProviderIdForModel(settings: Settings, modelId: string): string {\n  const canonicalModelId = canonicalizeConfiguredModelId(settings, modelId);\n  if (canonicalModelId.startsWith(CODEX_MODEL_ID_PREFIX)) {\n    return CODEX_PROVIDER_ID;\n  }\n  if (canonicalModelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {\n    return WORKSPACE_GATEWAY_PROVIDER_ID;\n  }\n  const configured = configuredModels(settings).find((model) => model.id === canonicalModelId);\n  return configured?.providerId ?? builtinProviderId(settings);\n}\n\nfunction resolvedExecutionLimits(\n  settings: Settings,\n  model: {\n    contextWindowTokens?: number | undefined;\n    effectiveContextWindowTokens?: number | undefined;\n    autoCompactTokenLimit?: number | undefined;\n    toolOutputTruncationTokens?: number | undefined;\n  },\n): ModelExecutionLimitsV1 {\n  return {\n    contextWindowTokens: model.contextWindowTokens ?? settings.contextWindowTokens,\n    effectiveContextWindowTokens:\n      model.effectiveContextWindowTokens ?? settings.contextEffectiveWindowTokens ?? null,\n    autoCompactTokenLimit:\n      model.autoCompactTokenLimit ?? settings.contextAutoCompactThresholdTokens ?? null,\n    toolOutputTruncationTokens:\n      model.toolOutputTruncationTokens ?? settings.modelToolOutputTruncationTokens ?? null,\n  };\n}\n\nfunction finalizeConfiguredModel(\n  settings: Settings,\n  provider: ResolvedModelProvider,\n  input: Omit<ConfiguredModel, \"schemaVersion\" | \"definitionVersion\" | \"executionLimits\">,\n): ConfiguredModel {\n  const requestPolicy =\n    provider.kind === \"vercel-gateway-managed\" || provider.kind === \"vercel-gateway-workspace\"\n      ? gatewayRequestPolicyForUpstreamModel(input.upstreamModelId)\n      : undefined;\n  const modelWithoutVersion: Omit<ConfiguredModel, \"definitionVersion\"> = {\n    schemaVersion: 1,\n    ...input,\n    ...(requestPolicy ? { requestPolicy } : {}),\n    executionLimits: resolvedExecutionLimits(settings, input),\n  };\n  return {\n    ...modelWithoutVersion,\n    definitionVersion: definitionVersionFor(modelWithoutVersion, provider),\n  };\n}\n\nfunction assertUniqueModelIdentities(models: ConfiguredModel[]): void {\n  const canonicalOwners = new Map<string, string>();\n  for (const model of models) {\n    const previous = canonicalOwners.get(model.id);\n    if (previous !== undefined) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON model id ${JSON.stringify(model.id)} is declared by both ${previous} and ${model.providerId}`,\n      );\n    }\n    canonicalOwners.set(model.id, model.providerId);\n  }\n\n  const acceptedInputs = new Map(canonicalOwners);\n  for (const model of models) {\n    const ownAliases = new Set<string>();\n    for (const alias of model.aliases) {\n      if (ownAliases.has(alias)) {\n        throw new Error(\n          `OPENGENI_MODEL_PROVIDERS_JSON model ${JSON.stringify(model.id)} contains duplicate alias ${JSON.stringify(alias)}`,\n        );\n      }\n      ownAliases.add(alias);\n      const previous = acceptedInputs.get(alias);\n      if (previous !== undefined) {\n        throw new Error(\n          `OPENGENI_MODEL_PROVIDERS_JSON alias ${JSON.stringify(alias)} for model ${JSON.stringify(model.id)} collides with model/provider ${previous}`,\n        );\n      }\n      acceptedInputs.set(alias, model.id);\n    }\n  }\n}\n\n/**\n * Every model a client may use, the built-in provider's models first\n * (configuredAllowedModels-from-openai, mapped to \"responses\" with\n * hostedWebSearch/contextWindow/reasoningEffort from the flat settings), then\n * each registry provider's models (label→id, hostedWebSearch/reasoningEffort\n * default false). De-duplicated by id (first wins) so the default model stays\n * first and the built-in allow-list takes precedence over registry entries.\n */\nexport function configuredModels(settings: Settings): ConfiguredModel[] {\n  const builtinId = builtinProviderId(settings);\n  const builtinLabel = builtinProviderLabel(settings);\n  const providers = configuredProviders(settings);\n  const providerById = new Map(providers.map((provider) => [provider.id, provider]));\n  const pricingSchedules = configuredModelPricingSchedules(settings);\n  // The built-in (OpenAI/Azure) provider must NEVER claim a registry-namespaced\n  // model id. The worker overwrites settings.openaiModel with the turn's model\n  // (apps/worker agent-turn runSettings) — including a `codex/<slug>` id, or a\n  // registry id like \"accounts/fireworks/models/glm-5p2\" — so without this\n  // filter the built-in allow-list would emit a `{ id, providerId: <azure> }`\n  // entry that, by the first-wins de-dup below, shadows the real registry /\n  // codex-subscription provider and ships the id to Azure as a deployment name\n  // (opaque DeploymentNotFound 404). A `<provider>/<model>`-namespaced id (it\n  // contains \"/\") that a registry actually owns is never a valid Azure/OpenAI\n  // deployment name, and a `codex/`-prefixed id never is either — exclude both\n  // from the built-in list. A BARE id a registry merely redeclares (e.g.\n  // \"gpt-5.6-sol\") is left in place so the built-in still wins it via the first-wins\n  // de-dup below (preserving the documented built-in-precedence contract). When\n  // a codex/ id has NO codex provider injected (no active subscription) it then\n  // resolves to nothing and getModel fails loud with\n  // CodexSubscriptionUnavailableError instead of mis-routing to Azure.\n  const parsedRegistry = configuredRegistryProviders(settings);\n  const registryOwnedIds = new Set(\n    parsedRegistry.flatMap((provider) => provider.models.map((model) => model.id)),\n  );\n  const registryAliases = new Set(\n    parsedRegistry.flatMap((provider) => provider.models.flatMap((model) => model.aliases ?? [])),\n  );\n  const isRegistryNamespaced = (id: string): boolean =>\n    id.startsWith(CODEX_MODEL_ID_PREFIX) ||\n    registryAliases.has(id) ||\n    (id.includes(\"/\") && registryOwnedIds.has(id));\n  const builtinProvider = providerById.get(builtinId);\n  if (!builtinProvider) {\n    throw new Error(`Built-in model provider ${builtinId} is not configured`);\n  }\n  const out: ConfiguredModel[] = uniqueValues([\n    settings.openaiModel,\n    ...splitCsv(settings.openaiAllowedModels),\n  ])\n    .filter((id) => !isRegistryNamespaced(id))\n    .map((id) => {\n      const capabilities = {\n        ...legacyModelCapabilities(settings, {\n          reasoningEffort: true,\n          hostedWebSearch: settings.webSearchEnabled,\n          vision: id.startsWith(\"gpt-5.6-\"),\n        }),\n        ...(builtinPromptCachingForModel(id)\n          ? { promptCaching: builtinPromptCachingForModel(id)! }\n          : {}),\n        latencyModes: builtinLatencyModesForModel(id),\n      };\n      return finalizeConfiguredModel(settings, builtinProvider, {\n        id,\n        aliases: [],\n        label: productLabelForModelId(id),\n        ...(productShortLabelForModelId(id)\n          ? { shortLabel: productShortLabelForModelId(id)! }\n          : {}),\n        providerId: builtinId,\n        providerLabel: builtinLabel,\n        api: \"responses\" as const,\n        upstreamModelId: id,\n        deployment: { upstreamModelId: id, wireApi: \"responses\" },\n        credentialSource: builtinProvider.credentialSource,\n        billing: builtinProvider.billing,\n        capabilities,\n        ...(pricingSchedules[id] === undefined ? {} : { pricing: pricingSchedules[id] }),\n        contextWindowTokens: settings.contextWindowTokens,\n        toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n        reasoningEffort: capabilities.reasoning.runnable,\n        hostedWebSearch: capabilities.hostedTools.webSearch.runnable,\n      });\n    });\n  for (const provider of parsedRegistry) {\n    const providerLabel = provider.label ?? provider.id;\n    const resolvedProvider = providerById.get(provider.id);\n    if (!resolvedProvider) {\n      throw new Error(`Registry model provider ${provider.id} is not configured`);\n    }\n    for (const model of provider.models) {\n      const capabilities = model.capabilities\n        ? normalizeCapabilities(model.capabilities)\n        : legacyModelCapabilities(settings, {\n            reasoningEffort: model.reasoningEffort ?? false,\n            hostedWebSearch: model.hostedWebSearch ?? false,\n          });\n      const upstreamModelId = model.upstreamModelId ?? model.id;\n      out.push(\n        finalizeConfiguredModel(settings, resolvedProvider, {\n          id: model.id,\n          aliases: [...(model.aliases ?? [])],\n          label: model.label ?? productLabelForModelId(model.id),\n          ...(model.shortLabel\n            ? { shortLabel: model.shortLabel }\n            : productShortLabelForModelId(model.id)\n              ? { shortLabel: productShortLabelForModelId(model.id)! }\n              : {}),\n          providerId: provider.id,\n          providerLabel,\n          api: provider.api,\n          upstreamModelId,\n          deployment: { upstreamModelId, wireApi: provider.api },\n          credentialSource: resolvedProvider.credentialSource,\n          billing: resolvedProvider.billing,\n          capabilities,\n          ...(pricingSchedules[model.id] === undefined\n            ? {}\n            : { pricing: pricingSchedules[model.id] }),\n          ...(model.contextWindowTokens === undefined\n            ? {}\n            : { contextWindowTokens: model.contextWindowTokens }),\n          ...(model.effectiveContextWindowTokens === undefined\n            ? {}\n            : {\n                effectiveContextWindowTokens: model.effectiveContextWindowTokens,\n              }),\n          ...(model.autoCompactTokenLimit === undefined\n            ? {}\n            : { autoCompactTokenLimit: model.autoCompactTokenLimit }),\n          ...(model.toolOutputTruncationTokens === undefined\n            ? {}\n            : { toolOutputTruncationTokens: model.toolOutputTruncationTokens }),\n          reasoningEffort: capabilities.reasoning.runnable,\n          hostedWebSearch: capabilities.hostedTools.webSearch.runnable,\n        }),\n      );\n    }\n  }\n  assertUniqueModelIdentities(out);\n  return out;\n}\n\n/** Resolve a known canonical id or alias. Unknown strings are returned unchanged. */\nexport function canonicalizeConfiguredModelId(settings: Settings, modelId: string): string {\n  const models = configuredModels(settings);\n  const canonical = models.find((model) => model.id === modelId);\n  if (canonical) {\n    return canonical.id;\n  }\n  return models.find((model) => model.aliases.includes(modelId))?.id ?? modelId;\n}\n\n/**\n * Allowed model ids in selection order. Reimplemented on top of\n * configuredModels so it is the union of the built-in allow-list and every\n * registry provider's ids, de-duplicated. INVARIANT (existing callers + tests\n * depend on it): settings.openaiModel is always first, then the rest of the\n * openai allow-list, then registry ids.\n */\nexport function configuredAllowedModels(settings: Settings): string[] {\n  return configuredModels(settings).map((model) => model.id);\n}\n\n/**\n * Resolve a model string to the provider that serves it and its configured\n * shape. Returns undefined when the id is not exposed (built-in allow-list nor\n * any registry provider), so the runtime can fall back to the legacy global\n * client path.\n */\nexport function resolveModelProvider(\n  settings: Settings,\n  modelId: string,\n): { provider: ResolvedModelProvider; model: ConfiguredModel } | undefined {\n  const canonicalModelId = canonicalizeConfiguredModelId(settings, modelId);\n  const model = configuredModels(settings).find((candidate) => candidate.id === canonicalModelId);\n  if (!model) {\n    return undefined;\n  }\n  const provider = configuredProviders(settings).find(\n    (candidate) => candidate.id === model.providerId,\n  );\n  if (!provider) {\n    return undefined;\n  }\n  return { provider, model };\n}\n\nexport type ResolveTurnExecutionPolicyV1Input = {\n  /** Effective persisted turn model. Aliases are accepted and canonicalized. */\n  modelId: string;\n  /** Exact caller-supplied input before canonicalization, only for explicit switches. */\n  requestedModelId: string | null;\n  modelSource: TurnExecutionModelSourceV1;\n  reasoningEffort: Settings[\"openaiReasoningEffort\"];\n  reasoningSource: TurnExecutionReasoningSourceV1;\n  latencyMode?: LatencyMode;\n  latencyModeSource?: TurnExecutionLatencyModeSourceV1;\n};\n\nfunction settingsForTurnExecutionPolicy(settings: Settings, modelId: string): Settings {\n  if (settings.codexSubscriptionEnabled && modelId.startsWith(CODEX_MODEL_ID_PREFIX)) {\n    return withCodexCatalogProvider(settings);\n  }\n  if (modelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {\n    return withWorkspaceGatewayCatalogProvider(settings);\n  }\n  return settings;\n}\n\n/**\n * Build a trusted, secret-safe execution policy from the normalized catalog.\n * The Codex overlay here contains static product/provider identity only; it\n * neither proves readiness nor chooses, decrypts, leases, or exposes an account.\n */\nexport function resolveTurnExecutionPolicyV1(\n  settings: Settings,\n  input: ResolveTurnExecutionPolicyV1Input,\n): TurnExecutionPolicyV1 {\n  const catalogSettings = settingsForTurnExecutionPolicy(settings, input.modelId);\n  const productModelId = canonicalizeConfiguredModelId(catalogSettings, input.modelId);\n  const resolved = resolveModelProvider(catalogSettings, productModelId);\n  if (!resolved) {\n    throw new Error(\"Turn execution policy model is not present in the configured catalog\");\n  }\n  if (\n    input.requestedModelId !== null &&\n    canonicalizeConfiguredModelId(catalogSettings, input.requestedModelId) !== productModelId\n  ) {\n    throw new Error(\"Turn execution policy requested model does not canonicalize to its product\");\n  }\n  const latencyMode = LatencyMode.parse(input.latencyMode ?? \"standard\");\n  const latencyModeSource = input.latencyModeSource ?? \"deployment\";\n  assertLatencyModeRunnable(catalogSettings, productModelId, latencyMode);\n  return TurnExecutionPolicyV1.parse({\n    schemaVersion: 1,\n    productModelId,\n    requestedModelId: input.requestedModelId,\n    modelSource: input.modelSource,\n    reasoningEffort: input.reasoningEffort,\n    reasoningSource: input.reasoningSource,\n    latencyMode,\n    latencyModeSource,\n    providerId: resolved.provider.id,\n    upstreamModelId: resolved.model.upstreamModelId,\n    wireApi: resolved.model.api,\n    credentialSource: resolved.model.credentialSource,\n    billing: resolved.model.billing,\n    definitionVersion: resolved.model.definitionVersion,\n  });\n}\n\n/**\n * Parse-time validation lives in @opengeni/contracts; this verifier binds a\n * present snapshot to the current executable definition and exact turn row.\n * Any deployment/provider drift fails before a provider or compaction call.\n */\nexport function assertTurnExecutionPolicyMatchesConfigV1(\n  settings: Settings,\n  policy: TurnExecutionPolicyV1,\n  expected: {\n    modelId: string;\n    reasoningEffort: Settings[\"openaiReasoningEffort\"];\n    latencyMode?: LatencyMode;\n  },\n): {\n  policy: TurnExecutionPolicyV1;\n  provider: ResolvedModelProvider;\n  model: ConfiguredModel;\n} {\n  const parsed = TurnExecutionPolicyV1.parse(policy);\n  const catalogSettings = settingsForTurnExecutionPolicy(settings, parsed.productModelId);\n  const canonicalExpectedModel = canonicalizeConfiguredModelId(catalogSettings, expected.modelId);\n  const expectedLatencyMode = expected.latencyMode ?? parsed.latencyMode;\n  if (\n    parsed.productModelId !== canonicalExpectedModel ||\n    parsed.reasoningEffort !== expected.reasoningEffort ||\n    parsed.latencyMode !== expectedLatencyMode\n  ) {\n    throw new Error(\n      \"Turn execution policy does not match the accepted turn model/reasoning/latency\",\n    );\n  }\n  assertLatencyModeRunnable(catalogSettings, parsed.productModelId, parsed.latencyMode);\n  if (\n    parsed.requestedModelId !== null &&\n    canonicalizeConfiguredModelId(catalogSettings, parsed.requestedModelId) !==\n      parsed.productModelId\n  ) {\n    throw new Error(\"Turn execution policy requested model does not match its product model\");\n  }\n  const resolved = resolveModelProvider(catalogSettings, parsed.productModelId);\n  if (!resolved) {\n    throw new Error(\"Turn execution policy model is no longer configured\");\n  }\n  const mismatched =\n    parsed.providerId !== resolved.provider.id ||\n    parsed.upstreamModelId !== resolved.model.upstreamModelId ||\n    parsed.wireApi !== resolved.model.api ||\n    parsed.definitionVersion !== resolved.model.definitionVersion ||\n    canonicalJson(parsed.credentialSource) !== canonicalJson(resolved.model.credentialSource) ||\n    canonicalJson(parsed.billing) !== canonicalJson(resolved.model.billing);\n  if (mismatched) {\n    throw new Error(\"Turn execution policy does not match the current provider definition\");\n  }\n  return { policy: parsed, provider: resolved.provider, model: resolved.model };\n}\n\n/**\n * Effective per-model pricing schedules. Merge order (later wins): built-in\n * flat defaults → registry model flat/scheduled pricing → explicit legacy flat\n * OPENGENI_MODEL_PRICING_JSON. The explicit legacy map intentionally replaces\n * a registry schedule with one flat default so its historical precedence stays\n * exact.\n */\nexport function configuredModelPricingSchedules(\n  settings: Settings,\n): Record<string, ModelPricingScheduleV1> {\n  const defaults = Object.fromEntries(\n    Object.entries(defaultModelPricing).map(([model, pricing]) => [\n      model,\n      normalizeModelPricingSchedule(pricing),\n    ]),\n  );\n  const registry: Record<string, ModelPricingScheduleV1> = {};\n  for (const provider of configuredRegistryProviders(settings)) {\n    for (const model of provider.models) {\n      if (model.pricing) {\n        registry[model.id] = normalizeModelPricingSchedule(model.pricing);\n      }\n    }\n  }\n  const configured = Object.fromEntries(\n    Object.entries(parseModelPricingJson(settings.modelPricingJson)).map(([model, pricing]) => [\n      model,\n      { default: pricing },\n    ]),\n  );\n  return {\n    ...defaults,\n    ...registry,\n    ...configured,\n  };\n}\n\n/** Legacy flat projection: returns the default/below-threshold price. */\nexport function configuredModelPricing(settings: Settings): Record<string, ModelPricing> {\n  return Object.fromEntries(\n    Object.entries(configuredModelPricingSchedules(settings)).map(([model, schedule]) => [\n      model,\n      schedule.default,\n    ]),\n  );\n}\n\n/** Select the per-provider-request price at an exact input-token threshold. */\nexport function selectModelPricing(\n  schedule: ModelPricingScheduleV1,\n  inputTokens: number,\n): ModelPricing {\n  const normalizedInputTokens = Math.max(0, Math.floor(inputTokens));\n  let selected = schedule.default;\n  for (const tier of schedule.inputTokenTiers ?? []) {\n    if (normalizedInputTokens < tier.minimumInputTokens) {\n      break;\n    }\n    selected = tier.pricing;\n  }\n  return selected;\n}\n\n/**\n * Usable input-token budget: an explicit model-catalog effective window when\n * available, otherwise the deployment window minus its output reserve.\n */\nexport function contextInputBudgetTokens(\n  settings: Pick<\n    Settings,\n    \"contextWindowTokens\" | \"contextEffectiveWindowTokens\" | \"contextReservedOutputTokens\"\n  >,\n): number {\n  if (settings.contextEffectiveWindowTokens !== undefined) {\n    return Math.min(settings.contextWindowTokens, settings.contextEffectiveWindowTokens);\n  }\n  return Math.max(0, settings.contextWindowTokens - settings.contextReservedOutputTokens);\n}\n\n/**\n * Apply the resolved provider/model's context policy to one turn. Registry\n * metadata is authoritative when present; deployment defaults remain the\n * fallback for models that do not declare their own limits.\n */\nexport function settingsWithResolvedModelContext(\n  settings: Settings,\n  model: Pick<\n    ConfiguredModel,\n    | \"contextWindowTokens\"\n    | \"effectiveContextWindowTokens\"\n    | \"autoCompactTokenLimit\"\n    | \"toolOutputTruncationTokens\"\n  >,\n): Settings {\n  const contextWindowTokens = model.contextWindowTokens ?? settings.contextWindowTokens;\n  return {\n    ...settings,\n    contextWindowTokens,\n    ...(model.effectiveContextWindowTokens === undefined\n      ? {}\n      : {\n          contextEffectiveWindowTokens: Math.min(\n            contextWindowTokens,\n            model.effectiveContextWindowTokens,\n          ),\n        }),\n    ...(model.autoCompactTokenLimit === undefined\n      ? {}\n      : { contextAutoCompactThresholdTokens: model.autoCompactTokenLimit }),\n    ...(model.toolOutputTruncationTokens === undefined\n      ? {}\n      : { modelToolOutputTruncationTokens: model.toolOutputTruncationTokens }),\n  };\n}\n\nexport function configuredStaticUsageLimits(settings: Settings): StaticUsageLimitsConfig {\n  return parseStaticUsageLimitsJson(settings.staticUsageLimitsJson);\n}\n\nexport function configuredEntitlements(settings: Settings): EntitlementsConfig {\n  if (settings.entitlementsMode === \"none\") {\n    return {};\n  }\n  const configured = parseStaticEntitlementsJson(settings.staticEntitlementsJson);\n  if (settings.entitlementsMode === \"static\") {\n    return configured;\n  }\n  return {\n    \"managed.auth.email_password\": true,\n    \"managed.billing.prepaid_credits\": settings.billingMode === \"stripe\",\n    \"managed.api_keys\": true,\n    \"managed.workspaces\": true,\n    \"managed.github_app\": Boolean(settings.githubAppId && settings.githubAppPrivateKey),\n    ...configured,\n  };\n}\n\nexport function calculateModelUsageCostMicros(\n  settings: Settings,\n  model: string,\n  usage: ModelUsageInput,\n  options?: { latencyMode?: LatencyMode },\n): number {\n  const schedule = configuredModelPricingSchedules(settings)[model];\n  if (!schedule) {\n    throw new Error(`Missing model pricing for ${model}`);\n  }\n  const entries =\n    usage.requestUsageEntries && usage.requestUsageEntries.length > 0\n      ? usage.requestUsageEntries\n      : [usage];\n  const rawCostByPricing = new Map<ModelPricing, number>();\n  for (const entry of entries) {\n    const pricing = selectModelPricing(schedule, positiveInt(entry.inputTokens));\n    rawCostByPricing.set(\n      pricing,\n      (rawCostByPricing.get(pricing) ?? 0) + calculateEntryCostMicros(pricing, entry),\n    );\n  }\n  let total = 0;\n  for (const [pricing, rawCost] of rawCostByPricing) {\n    const marginBps = pricing.marginBps ?? 0;\n    total += Math.ceil((rawCost * (10_000 + marginBps)) / 10_000);\n  }\n  const latencyMode = options?.latencyMode ?? \"standard\";\n  if (latencyMode !== \"standard\") {\n    const catalogSettings = settingsForTurnExecutionPolicy(settings, model);\n    const resolved = resolveModelProvider(\n      catalogSettings,\n      canonicalizeConfiguredModelId(catalogSettings, model),\n    );\n    const multiplierBps = resolved?.model.capabilities.latencyModes.find(\n      (mode) => mode.id === latencyMode && mode.runnable,\n    )?.billingMultiplierBps;\n    if (multiplierBps && multiplierBps > 0) {\n      total = Math.ceil((total * multiplierBps) / 10_000);\n    }\n  }\n  return total;\n}\n\n/**\n * Convert AI Gateway's exact USD inference cost to OpenGeni credit micros and\n * apply the configured model margin. Decimal arithmetic is integer-only so a\n * sub-micro provider charge cannot be lost to floating-point rounding.\n */\nexport function calculateGatewayReportedCostMicros(\n  settings: Settings,\n  model: string,\n  inferenceCostUsd: string,\n  options?: { inputTokens?: number },\n): number {\n  const schedule = configuredModelPricingSchedules(settings)[model];\n  if (!schedule) {\n    throw new Error(`Missing model pricing for ${model}`);\n  }\n  const pricing = selectModelPricing(schedule, positiveInt(options?.inputTokens));\n  const match = /^(0|[1-9]\\d*)(?:\\.(\\d{1,18}))?$/.exec(inferenceCostUsd);\n  if (!match) {\n    throw new Error(\"Invalid AI Gateway inference cost\");\n  }\n  const fraction = match[2] ?? \"\";\n  const decimalDigits = BigInt(`${match[1]}${fraction}`);\n  const decimalScale = 10n ** BigInt(fraction.length);\n  const marginBps = BigInt(10_000 + (pricing.marginBps ?? 0));\n  const numerator = decimalDigits * 1_000_000n * marginBps;\n  const denominator = decimalScale * 10_000n;\n  const micros = (numerator + denominator - 1n) / denominator;\n  if (micros > BigInt(Number.MAX_SAFE_INTEGER)) {\n    throw new Error(\"AI Gateway inference cost exceeds the supported billing range\");\n  }\n  return Number(micros);\n}\n\nexport function configuredAllowedReasoningEfforts(\n  settings: Settings,\n): Array<z.infer<typeof ReasoningEffort>> {\n  return uniqueValues([\n    settings.openaiReasoningEffort,\n    ...splitCsv(settings.openaiAllowedReasoningEfforts),\n  ]).map((value) => ReasoningEffort.parse(value));\n}\n\n/**\n * Decodes OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY (base64, exactly 32 bytes) for\n * AES-256-GCM workspace environment value encryption. Returns null when unset.\n * Throws naming only the env var, never echoing its value.\n */\nexport function environmentsEncryptionKeyBytes(settings: Settings): Uint8Array | null {\n  if (!settings.environmentsEncryptionKey) {\n    return null;\n  }\n  const decoded = Buffer.from(settings.environmentsEncryptionKey, \"base64\");\n  if (decoded.length !== 32) {\n    throw new Error(\n      \"OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY must be base64 for exactly 32 bytes (generate with: openssl rand -base64 32)\",\n    );\n  }\n  return new Uint8Array(decoded);\n}\n\n/**\n * Build one structurally compatible connection policy for both\n * `@temporalio/client` and `@temporalio/worker`. An API key or any custom TLS\n * material enables TLS automatically; the explicit flag covers server-auth TLS\n * without credentials. Secret values are never included in validation errors.\n */\nexport function temporalConnectionOptions(settings: Settings): TemporalConnectionOptions {\n  const apiKey = settings.temporalApiKey?.trim() || undefined;\n  const serverNameOverride = settings.temporalTlsServerName?.trim() || undefined;\n  const rootCa = decodeTemporalTlsMaterial(\n    settings.temporalTlsRootCaCertificateBase64,\n    \"OPENGENI_TEMPORAL_TLS_ROOT_CA_CERTIFICATE_BASE64\",\n  );\n  const clientCertificate = decodeTemporalTlsMaterial(\n    settings.temporalTlsClientCertificateBase64,\n    \"OPENGENI_TEMPORAL_TLS_CLIENT_CERTIFICATE_BASE64\",\n  );\n  const clientPrivateKey = decodeTemporalTlsMaterial(\n    settings.temporalTlsClientPrivateKeyBase64,\n    \"OPENGENI_TEMPORAL_TLS_CLIENT_PRIVATE_KEY_BASE64\",\n  );\n\n  if (Boolean(clientCertificate) !== Boolean(clientPrivateKey)) {\n    throw new Error(\n      \"OPENGENI_TEMPORAL_TLS_CLIENT_CERTIFICATE_BASE64 and \" +\n        \"OPENGENI_TEMPORAL_TLS_CLIENT_PRIVATE_KEY_BASE64 must both be set or both omitted\",\n    );\n  }\n\n  const tls: TemporalTlsConnectionConfig = {};\n  if (serverNameOverride) {\n    tls.serverNameOverride = serverNameOverride;\n  }\n  if (rootCa) {\n    tls.serverRootCACertificate = rootCa;\n  }\n  if (clientCertificate && clientPrivateKey) {\n    tls.clientCertPair = { crt: clientCertificate, key: clientPrivateKey };\n  }\n  const hasCustomTls = Object.keys(tls).length > 0;\n  const tlsEnabled = settings.temporalTlsEnabled || Boolean(apiKey) || hasCustomTls;\n\n  return {\n    address: settings.temporalHost,\n    ...(tlsEnabled ? { tls: hasCustomTls ? tls : true } : {}),\n    ...(apiKey ? { apiKey } : {}),\n  };\n}\n\nfunction decodeTemporalTlsMaterial(\n  value: string | undefined,\n  settingName: string,\n): Uint8Array | undefined {\n  // RFC 2045 base64 commonly arrives wrapped at 76 columns. Kubernetes\n  // stringData and external secret stores preserve those line breaks, so\n  // normalize whitespace before applying the strict alphabet/canonical check.\n  const encoded = value?.replace(/\\s/g, \"\");\n  if (!encoded) {\n    return undefined;\n  }\n  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded) || encoded.length % 4 === 1) {\n    throw new Error(`${settingName} must contain valid base64`);\n  }\n  const decoded = Buffer.from(encoded, \"base64\");\n  const canonical = decoded.toString(\"base64\").replace(/=+$/, \"\");\n  if (decoded.length === 0 || canonical !== encoded.replace(/=+$/, \"\")) {\n    throw new Error(`${settingName} must contain valid base64`);\n  }\n  return new Uint8Array(decoded);\n}\n\n/**\n * The connection `search_path` for OpenGeni's db handles + the managed-auth pool\n * (Step I, §7.8 runtime half). Returns `undefined` when `dbSchema` is unset\n * (standalone) so no `search_path` startup parameter is sent and the server\n * default (`public`) applies — byte-for-byte today's behavior. When `dbSchema`\n * is set (embedded), returns `\"<schema>,opengeni_private,public\"` — `public`\n * stays LAST so `gen_random_uuid()` (pgcrypto) and the `vector` type still\n * resolve (the schema-isolation contract live footgun). `opengeni_private` is on the path so the\n * RLS GUC-reader helpers resolve when referenced unqualified.\n */\nexport function dbSearchPath(settings: Pick<Settings, \"dbSchema\">): string | undefined {\n  const schema = settings.dbSchema?.trim();\n  if (!schema) {\n    return undefined;\n  }\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(schema)) {\n    throw new Error(`OPENGENI_DB_SCHEMA is not a valid Postgres identifier: ${schema}`);\n  }\n  return `${schema},opengeni_private,public`;\n}\n\nexport function collectGitIdentityEnvironment(settings: Settings): Record<string, string> {\n  return Object.fromEntries(\n    Object.entries({\n      GIT_AUTHOR_NAME: settings.gitAuthorName,\n      GIT_AUTHOR_EMAIL: settings.gitAuthorEmail,\n      GIT_COMMITTER_NAME: settings.gitCommitterName ?? settings.gitAuthorName,\n      GIT_COMMITTER_EMAIL: settings.gitCommitterEmail ?? settings.gitAuthorEmail,\n    }).filter(\n      (entry): entry is [string, string] =>\n        typeof entry[1] === \"string\" && entry[1].trim().length > 0,\n    ),\n  );\n}\n\nconst DEFAULT_SANDBOX_PATH = \"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\";\n\nfunction prependPathEntry(pathValue: string | undefined, entry: string): string {\n  const parts = (pathValue ?? DEFAULT_SANDBOX_PATH).split(\":\").filter(Boolean);\n  return [entry, ...parts.filter((part) => part !== entry)].join(\":\");\n}\n\n/**\n * The STABLE run-scoped sandbox environment: the subset of a run's box-manifest\n * environment that is IDENTICAL whether the box is first warmed by the worker\n * TURN or by an API-direct ATTACH (viewer / Channel-A / desktop / terminal). It\n * is the layered base every cold box must be created with so a later turn's\n * agent-manifest apply finds an EMPTY environment delta in the SDK's\n * `validateNoEnvironmentDelta` (which throws \"Live sandbox sessions cannot change\n * manifest environment variables\" on ANY key the agent declares that the box's\n * manifest lacks or carries a different value for).\n *\n * Precedence (lowest → highest): deployment allowlist (`collectSandboxEnvironment`)\n * < git identity (`collectGitIdentityEnvironment`) < the session's attached\n * workspace environment < the backend-aware HOME default. Reserved-name validation\n * at write time keeps workspace values from colliding with platform entries.\n *\n * DELIBERATELY EXCLUDES the per-run, ROTATING git provider token VALUES that\n * `sandboxEnvironmentForRun` mints when a repository resource is\n * attached: that token is minted FRESH per call, so it is not a stable, attach-\n * reproducible value and must not be part of the shared base. Under the token-\n * broker (B1) token VALUES never ride the manifest at all — they are seeded to\n * FILES inside the box and git/provider CLI auth reads those files. What IS stable\n * and lives here for provisioned boxes are the token directory / GitHub alias\n * FILE PATH and wrapper PATH entries: constants derived from HOME, so they\n * appear IDENTICALLY on BOTH the turn AND every attach manifest (the SDK's\n * per-turn provided-session env delta stays empty even as tokens rotate). These\n * helper pointers are deliberately not added for selfhosted/local/none because\n * the platform never mints or seeds git provider tokens there. The attach\n * surfaces have only the `Session` (no repo resources) and so never seed a token,\n * but unwritten files simply yield no auth; the BLOCKING attach-vs-turn error\n * this helper fixes is for the common (no-repo) and workspace-environment-attached\n * provisioned-box cases.\n */\nexport function stableSandboxEnvironmentForRun(\n  settings: Settings,\n  workspaceEnvironment: Record<string, string> = {},\n  options: { workspaceId?: string } = {},\n): Record<string, string> {\n  const environment: Record<string, string> = {\n    ...collectSandboxEnvironment(settings),\n    ...collectGitIdentityEnvironment(settings),\n    ...workspaceEnvironment,\n  };\n  // Backend-aware HOME: a provisioned box (docker + every cloud provider) runs the\n  // agent under the descriptor's workspaceRoot. `local` runs in-process as the host\n  // unix user (keep its real $HOME); `selfhosted` runs on a user's machine and must\n  // likewise preserve that machine's real HOME; `none` has no box.\n  const descriptor = CAPABILITY_DESCRIPTORS[settings.sandboxBackend];\n  if (\n    settings.sandboxBackend !== \"none\" &&\n    settings.sandboxBackend !== \"local\" &&\n    settings.sandboxBackend !== \"selfhosted\"\n  ) {\n    environment.HOME ??= descriptor.workspaceRoot;\n  }\n  // TOKEN-BROKER (B1): the STABLE credential FILE PATHS and CLI wrapper PATH for\n  // provisioned boxes only. Constants derived from the resolved HOME (falling\n  // back to the descriptor workspaceRoot), so they are parity-safe — they join\n  // the shared base and therefore appear IDENTICALLY on BOTH the worker-turn\n  // manifest AND every API-direct attach manifest. Only PATHS are stable; token\n  // VALUES live exclusively in files that runtime seeds off-manifest.\n  const provisionedGitHelperBackend =\n    settings.sandboxBackend !== \"none\" &&\n    settings.sandboxBackend !== \"local\" &&\n    settings.sandboxBackend !== \"selfhosted\";\n  if (provisionedGitHelperBackend) {\n    const home = environment.HOME ?? descriptor.workspaceRoot;\n    environment.OPENGENI_GIT_CREDENTIALS_DIR ??= `${home}/.opengeni/git-credentials`;\n    environment.OPENGENI_GIT_TOKEN_FILE ??= `${home}/.opengeni/git-token`;\n    environment.OPENGENI_GIT_CLI_WRAPPER_DIR ??= `${home}/.opengeni/bin`;\n    environment.PATH = prependPathEntry(environment.PATH, environment.OPENGENI_GIT_CLI_WRAPPER_DIR);\n  }\n  if (settings.toolspaceEnabled && settings.sandboxBackend !== \"selfhosted\") {\n    environment.OPENGENI_TOOLSPACE_TOKEN_FILE ??= `${environment.HOME ?? descriptor.workspaceRoot}/.opengeni/toolspace-token`;\n    if (settings.ogtoolPackageSpec) {\n      environment.OPENGENI_OGTOOL_PACKAGE_SPEC ??= settings.ogtoolPackageSpec;\n    }\n    if (options.workspaceId) {\n      environment.OPENGENI_TOOLSPACE_URL ??= firstPartyMcpWorkspaceUrl(\n        settings,\n        options.workspaceId,\n      );\n    }\n  }\n  return environment;\n}\n\n/**\n * Whether a resource set carries a GitHub-App-connected repository (installation\n * + repository ids present) — the SAME predicate the worker turn uses to decide\n * whether it declares the stable git-auth pointers. Attach surfaces call this so\n * an attach-warmed cold box carries the IDENTICAL manifest env a later repo turn\n * declares (env parity — see applyGitAuthPointerEnvironment).\n */\nexport function hasGitHubRepositorySelection(\n  resources: ReadonlyArray<{\n    kind: string;\n    provider?: unknown;\n    installationId?: unknown;\n    repositoryId?: unknown;\n    githubInstallationId?: unknown;\n    githubRepositoryId?: unknown;\n  }>,\n): boolean {\n  const positive = (value: unknown): boolean =>\n    (typeof value === \"number\" && Number.isInteger(value) && value > 0) ||\n    (typeof value === \"string\" && /^\\d+$/.test(value) && Number(value) > 0);\n  return resources.some(\n    (resource) =>\n      resource.kind === \"repository\" &&\n      ((positive(resource.githubInstallationId) && positive(resource.githubRepositoryId)) ||\n        (resource.provider === \"github\" &&\n          positive(resource.installationId) &&\n          positive(resource.repositoryId))),\n  );\n}\n\nexport function hasGitCredentialRepositorySelection(\n  resources: ReadonlyArray<{\n    kind: string;\n    provider?: unknown;\n    githubInstallationId?: unknown;\n    githubRepositoryId?: unknown;\n  }>,\n): boolean {\n  return resources.some(\n    (resource) =>\n      resource.kind === \"repository\" &&\n      (resource.provider === \"github\" ||\n        resource.provider === \"gitlab\" ||\n        resource.provider === \"azure_devops\" ||\n        hasGitHubRepositorySelection([resource])),\n  );\n}\n\n/**\n * TOKEN-BROKER (B1) parity: the STABLE git-auth POINTER environment a\n * repo-attached run declares — GIT_ASKPASS (a fixed path under HOME; the script\n * itself is provisioned at box setup), GIT_TERMINAL_PROMPT, and the GitHub-App\n * bot identity fallbacks. NO rotating value rides here (the token lives in the\n * file behind the askpass), so the layer is attach-reproducible and MUST be\n * applied identically by the worker turn (sandboxEnvironmentForRun) AND every\n * API-direct attach surface that can cold-create the box (viewer attach,\n * channel-A ops). A box cold-created WITHOUT this layer kills the next repo\n * turn: the turn's manifest declares these keys, the box's env lacks them, and\n * the SDK's provided-session guard throws \"Live sandbox sessions cannot change\n * manifest environment variables\" (observed live: an open session page's viewer\n * attach won the cold-create race and the first turn died).\n *\n * Mutates and returns `environment`. Identity fallbacks preserve values already\n * present (the deployment git-identity allowlist wins over the bot identity).\n */\nexport function applyGitAuthPointerEnvironment(\n  environment: Record<string, string>,\n  identity: { name: string; email: string } | null,\n): Record<string, string> {\n  environment.GIT_ASKPASS = `${environment.HOME ?? \"/workspace\"}/.opengeni/askpass`;\n  environment.GIT_TERMINAL_PROMPT = \"0\";\n  if (identity) {\n    environment.GIT_AUTHOR_NAME = environment.GIT_AUTHOR_NAME || identity.name;\n    environment.GIT_AUTHOR_EMAIL = environment.GIT_AUTHOR_EMAIL || identity.email;\n    environment.GIT_COMMITTER_NAME = environment.GIT_COMMITTER_NAME || identity.name;\n    environment.GIT_COMMITTER_EMAIL = environment.GIT_COMMITTER_EMAIL || identity.email;\n  }\n  return environment;\n}\n\nexport type StartupRetryOptions = {\n  attempts?: number;\n  initialDelayMs?: number;\n  maxDelayMs?: number;\n  onRetry?: (event: {\n    label: string;\n    attempt: number;\n    attempts: number;\n    delayMs: number;\n    error: unknown;\n  }) => void;\n};\n\nexport function startupRetryOptions(\n  settings: Settings,\n): Required<Omit<StartupRetryOptions, \"onRetry\">> {\n  return {\n    attempts: settings.startupDependencyRetryAttempts,\n    initialDelayMs: settings.startupDependencyRetryInitialDelayMs,\n    maxDelayMs: settings.startupDependencyRetryMaxDelayMs,\n  };\n}\n\nexport async function retryStartupDependency<T>(\n  label: string,\n  operation: () => Promise<T>,\n  options: StartupRetryOptions = {},\n): Promise<T> {\n  const attempts = Math.max(1, Math.floor(options.attempts ?? 30));\n  const initialDelayMs = Math.max(0, Math.floor(options.initialDelayMs ?? 1000));\n  const maxDelayMs = Math.max(initialDelayMs, Math.floor(options.maxDelayMs ?? 5000));\n  for (let attempt = 1; attempt <= attempts; attempt += 1) {\n    try {\n      return await operation();\n    } catch (error) {\n      if (attempt >= attempts) {\n        throw error;\n      }\n      const delayMs = Math.min(maxDelayMs, initialDelayMs * 2 ** (attempt - 1));\n      options.onRetry?.({ label, attempt, attempts, delayMs, error });\n      await delay(delayMs);\n    }\n  }\n  throw new Error(`unreachable startup retry state for ${label}`);\n}\n\nexport function sandboxEnvironmentVariableNames(settings: Settings): string[] {\n  const profiles = sandboxPreparationProfileNames(settings);\n  const names: string[] = [];\n  for (const profile of profiles) {\n    names.push(...sandboxPreparationProfiles[profile]!.env);\n  }\n  names.push(...splitCsv(settings.sandboxEnvAllowlist));\n  return uniqueEnvNames(names, \"sandbox env\");\n}\n\nexport function sandboxLifecycleHookIds(settings: Settings): string[] {\n  const ids: string[] = [];\n  for (const profile of sandboxPreparationProfileNames(settings)) {\n    ids.push(...sandboxPreparationProfiles[profile]!.hooks);\n  }\n  return uniqueValues(ids);\n}\n\nfunction sandboxPreparationProfileNames(settings: Settings): string[] {\n  const profiles = splitCsv(settings.sandboxPreparationProfiles).map((value) =>\n    value.toLowerCase(),\n  );\n  if (profiles.includes(\"none\")) {\n    if (profiles.length > 1) {\n      throw new Error(\n        \"OPENGENI_SANDBOX_PREPARATION_PROFILES cannot combine none with other profiles\",\n      );\n    }\n    return [\"none\"];\n  }\n  for (const profile of profiles) {\n    if (!sandboxPreparationProfiles[profile]) {\n      throw new Error(`Unknown sandbox preparation profile ${profile}`);\n    }\n  }\n  return profiles;\n}\n\nexport function parseExposedPorts(raw: string): number[] {\n  return splitCsv(raw).map((value) => {\n    const port = Number(value);\n    if (!Number.isInteger(port) || port < 1 || port > 65535) {\n      throw new Error(\"OPENGENI_DOCKER_EXPOSED_PORTS must contain TCP port numbers\");\n    }\n    return port;\n  });\n}\n\nexport function parseMcpServers(raw: string | undefined): unknown[] | undefined {\n  if (!raw) {\n    return undefined;\n  }\n  try {\n    const parsed = JSON.parse(raw);\n    if (!Array.isArray(parsed)) {\n      throw new Error(\"value must be a JSON array\");\n    }\n    return parsed;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_MCP_SERVERS must be a JSON array: ${message}`, {\n      cause: error,\n    });\n  }\n}\n\nexport function parseModelPricingJson(raw: string): Record<string, ModelPricing> {\n  if (!raw.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_MODEL_PRICING_JSON must be valid JSON: ${message}`, { cause: error });\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\"OPENGENI_MODEL_PRICING_JSON must be a JSON object keyed by model name\");\n  }\n  const out: Record<string, ModelPricing> = {};\n  for (const [model, value] of Object.entries(parsed)) {\n    if (!model.trim()) {\n      throw new Error(\"OPENGENI_MODEL_PRICING_JSON contains an empty model name\");\n    }\n    out[model] = ModelPricingSchema.parse(value);\n  }\n  return out;\n}\n\n// --- sandbox warm-rate table (P2.1) ---\n// Per-backend usd_micros/sec, parsed from sandboxWarmRateMicrosPerSecondJson the\n// same way model pricing is. An empty {} (the default) means no warm-cost is\n// debited — warm-seconds are still metered for audit, just at rate 0.\nexport function parseSandboxWarmRateJson(raw: string): Record<string, number> {\n  if (!raw.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(\n      `OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON must be valid JSON: ${message}`,\n      { cause: error },\n    );\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\n      \"OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON must be a JSON object keyed by backend name\",\n    );\n  }\n  const out: Record<string, number> = {};\n  for (const [backend, value] of Object.entries(parsed)) {\n    if (!backend.trim()) {\n      throw new Error(\n        \"OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON contains an empty backend name\",\n      );\n    }\n    const rate = typeof value === \"number\" ? value : Number(value);\n    if (!Number.isFinite(rate) || rate < 0) {\n      throw new Error(\n        `OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON rate for ${backend} must be a non-negative number`,\n      );\n    }\n    out[backend] = rate;\n  }\n  return out;\n}\n\n// Resolve the warm rate (usd_micros/sec) for a backend; 0 when the backend has no\n// configured rate (the box is metered in seconds but not cost-debited).\nexport function sandboxWarmRateMicrosPerSecond(settings: Settings, backend: string): number {\n  const table = parseSandboxWarmRateJson(settings.sandboxWarmRateMicrosPerSecondJson);\n  return table[backend] ?? 0;\n}\n\n/**\n * Parse + validate the extra-provider registry JSON. `[]` (or empty/whitespace)\n * yields an empty list. Surfaces JSON and zod errors prefixed with the env-var\n * name so a malformed registry fails fast at boot (validateSettings calls this).\n */\nexport function parseModelProvidersJson(raw: string): RegistryProvider[] {\n  if (!raw.trim() || raw.trim() === \"[]\") {\n    return [];\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_MODEL_PROVIDERS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  if (!Array.isArray(parsed)) {\n    throw new Error(\"OPENGENI_MODEL_PROVIDERS_JSON must be a JSON array of providers\");\n  }\n  return parsed.map((entry, index) => {\n    const result = RegistryProviderSchema.safeParse(entry);\n    if (!result.success) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider[${index}] is invalid: ${result.error.message}`,\n      );\n    }\n    try {\n      return normalizeRegistryProvider(result.data);\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error);\n      throw new Error(`OPENGENI_MODEL_PROVIDERS_JSON provider[${index}] is invalid: ${message}`, {\n        cause: error,\n      });\n    }\n  });\n}\n\nexport function parseIntegrationsOauthClientsJson(\n  raw: string | undefined,\n): Record<string, IntegrationOAuthClientConfig> {\n  if (!raw?.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\n      \"OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON must be a JSON object keyed by authorization-server issuer or URL\",\n    );\n  }\n  const out: Record<string, IntegrationOAuthClientConfig> = {};\n  for (const [key, value] of Object.entries(parsed)) {\n    if (!key.trim()) {\n      throw new Error(\"OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON contains an empty issuer key\");\n    }\n    const result = IntegrationOAuthClientConfigSchema.safeParse(value);\n    if (!result.success) {\n      throw new Error(\n        `OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON client for ${key} is invalid: ${result.error.message}`,\n      );\n    }\n    out[key] = result.data;\n  }\n  return out;\n}\n\nexport const SocialOAuthClientConfigSchema = z.object({\n  clientId: z.string().min(1),\n  clientSecret: z.string().min(1).optional(),\n});\nexport type SocialOAuthClientConfig = z.infer<typeof SocialOAuthClientConfigSchema>;\n\nconst SOCIAL_OAUTH_PROVIDER_IDS = [\"x\", \"reddit\"] as const;\n\nexport function parseSocialOauthClientsJson(\n  raw: string | undefined,\n): Partial<Record<(typeof SOCIAL_OAUTH_PROVIDER_IDS)[number], SocialOAuthClientConfig>> {\n  if (!raw?.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\n      \"OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON must be a JSON object keyed by social provider id\",\n    );\n  }\n  const out: Partial<Record<(typeof SOCIAL_OAUTH_PROVIDER_IDS)[number], SocialOAuthClientConfig>> =\n    {};\n  for (const [key, value] of Object.entries(parsed)) {\n    if (!SOCIAL_OAUTH_PROVIDER_IDS.includes(key as (typeof SOCIAL_OAUTH_PROVIDER_IDS)[number])) {\n      throw new Error(\n        `OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON provider ${key} is not supported (expected: ${SOCIAL_OAUTH_PROVIDER_IDS.join(\", \")})`,\n      );\n    }\n    const result = SocialOAuthClientConfigSchema.safeParse(value);\n    if (!result.success) {\n      throw new Error(\n        `OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON client for ${key} is invalid: ${result.error.message}`,\n      );\n    }\n    out[key as (typeof SOCIAL_OAUTH_PROVIDER_IDS)[number]] = result.data;\n  }\n  return out;\n}\n\nexport function parseStaticUsageLimitsJson(raw: string): StaticUsageLimitsConfig {\n  if (!raw.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_STATIC_USAGE_LIMITS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  return StaticUsageLimits.parse(parsed);\n}\n\nexport function parseStaticEntitlementsJson(raw: string): EntitlementsConfig {\n  if (!raw.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_STATIC_ENTITLEMENTS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  return Entitlements.parse(parsed);\n}\n\nfunction calculateEntryCostMicros(pricing: ModelPricing, entry: ModelUsageInput): number {\n  const inputTokens = positiveInt(entry.inputTokens);\n  const outputTokens = positiveInt(entry.outputTokens);\n  const cachedTokens = Math.min(inputTokens, cachedInputTokens(entry));\n  const uncachedInputTokens = Math.max(0, inputTokens - cachedTokens);\n  const cachedInputRate =\n    pricing.cachedInputMicrosPerMillionTokens ?? pricing.inputMicrosPerMillionTokens;\n  return (\n    Math.ceil((uncachedInputTokens * pricing.inputMicrosPerMillionTokens) / 1_000_000) +\n    Math.ceil((cachedTokens * cachedInputRate) / 1_000_000) +\n    Math.ceil((outputTokens * pricing.outputMicrosPerMillionTokens) / 1_000_000)\n  );\n}\n\nfunction cachedInputTokens(entry: ModelUsageInput): number {\n  const details = Array.isArray(entry.inputTokensDetails)\n    ? entry.inputTokensDetails\n    : entry.inputTokensDetails\n      ? [entry.inputTokensDetails]\n      : [];\n  let total = 0;\n  for (const detail of details) {\n    total +=\n      positiveInt(detail.cached_tokens) +\n      positiveInt(detail.cachedInputTokens) +\n      positiveInt(detail.cached_input_tokens);\n  }\n  return total;\n}\n\nfunction positiveInt(value: unknown): number {\n  return typeof value === \"number\" && Number.isFinite(value) && value > 0 ? Math.floor(value) : 0;\n}\n\nfunction ensureBuiltInMcpServers(settings: Settings): Settings[\"mcpServers\"] {\n  const existing = settings.mcpServers.filter((server) => server.id !== \"opengeni\");\n  const firstPartyMcpUrl = firstPartyMcpServerUrl(settings);\n  const firstPartyFilesMcpUrl = firstPartyFilesMcpServerUrl(firstPartyMcpUrl);\n  const firstPartyDocsMcpUrl = firstPartyDocumentsMcpServerUrl(firstPartyMcpUrl);\n  const hasFiles = existing.some((server) => server.id === \"files\");\n  const hasDocs = existing.some((server) => server.id === \"docs\");\n  return [\n    {\n      id: \"opengeni\",\n      name: \"OpenGeni\",\n      url: firstPartyMcpUrl,\n      // The opengeni server's tools/list response is permission-scoped: it\n      // varies by the calling session's delegated grant (e.g. a manager\n      // session sees sessions_*/environment_* tools that a worker session\n      // does not). The OpenAI Agents SDK caches tools/list in a process-global\n      // map keyed only by the MCP server name, which is identical for every\n      // session in the worker process. Caching here would let the first\n      // session to warm the cache dictate what every later session sees,\n      // regardless of permissions. tools/list is a cheap per-turn call, so we\n      // never cache it. (The files server pins allowedTools to a single\n      // permission-invariant tool and docs is already uncached, so both stay\n      // safe to cache / leave as-is.)\n      cacheToolsList: false,\n    },\n    ...(hasFiles\n      ? []\n      : [\n          {\n            id: \"files\",\n            name: \"Files\",\n            url: firstPartyFilesMcpUrl,\n            allowedTools: [\"files_get_download_url\"],\n            cacheToolsList: true,\n          },\n        ]),\n    ...(hasDocs\n      ? []\n      : [\n          {\n            id: \"docs\",\n            name: \"Document Search\",\n            url: firstPartyDocsMcpUrl,\n            allowedTools: [\n              \"search_documents\",\n              \"fetch_document_chunk\",\n              \"list_document_bases\",\n              \"knowledge_search\",\n              \"knowledge_fetch\",\n              \"memory_search\",\n              \"memory_propose\",\n            ],\n            cacheToolsList: false,\n          },\n        ]),\n    ...existing,\n  ];\n}\n\n/**\n * The base URL of OpenGeni's own first-party MCP endpoint, as a `{workspaceId}`\n * template — the SINGLE source of truth for the `opengeniMcpUrl`-or-loopback\n * decision. Every site that needs the first-party MCP base (config's tool\n * registry here, and the worker-side `firstPartyMcpServerUrlForRun` /\n * `firstPartyMcpUrls` in @opengeni/runtime) MUST route through this so the\n * default lives in exactly one place.\n *\n * BINDING CONTRACT (`opengeniMcpUrl`):\n *   - STANDALONE (unset): falls back to the loopback default\n *     `http://127.0.0.1:${apiPort}/v1/workspaces/{workspaceId}/mcp` — the worker\n *     and API are in/next to the same host:port, so loopback resolves the\n *     workspace-scoped MCP. Byte-for-byte today's behavior.\n *   - EMBEDDED / MOUNTED (must set): when OpenGeni's API is mounted as a host\n *     sub-app under a prefix (e.g. `https://host/og/v1/...`), the loopback\n *     default is WRONG — the worker runs in the host process and `127.0.0.1:\n *     ${apiPort}` is not where the mounted, sandbox-routable MCP lives. The host\n *     MUST set `OPENGENI_MCP_URL` to the externally/sandbox-routable base (a\n *     `{workspaceId}` template, or a concrete base that gets re-scoped). This is\n *     the one binding a mounted embed cannot leave unset.\n */\nexport function firstPartyMcpBaseUrl(settings: Settings): string {\n  return (\n    settings.opengeniMcpUrl ??\n    `http://127.0.0.1:${settings.apiPort}/v1/workspaces/{workspaceId}/mcp`\n  );\n}\n\nexport function firstPartyMcpWorkspaceUrl(settings: Settings, workspaceId: string): string {\n  const raw = firstPartyMcpBaseUrl(settings);\n  if (raw.includes(\"{workspaceId}\")) {\n    return raw.replaceAll(\"{workspaceId}\", workspaceId);\n  }\n  const url = new URL(raw);\n  url.pathname = `/v1/workspaces/${workspaceId}/mcp`;\n  url.search = \"\";\n  url.hash = \"\";\n  return url.toString();\n}\n\nfunction firstPartyMcpServerUrl(settings: Settings): string {\n  return firstPartyMcpBaseUrl(settings);\n}\n\nfunction firstPartyDocumentsMcpServerUrl(mcpUrl: string): string {\n  return `${mcpUrl.replace(/\\/+$/, \"\")}/docs`;\n}\n\nfunction firstPartyFilesMcpServerUrl(mcpUrl: string): string {\n  return `${mcpUrl.replace(/\\/+$/, \"\")}/files`;\n}\n\nfunction validateSettings(settings: Settings): void {\n  temporalConnectionOptions(settings);\n  if (settings.toolspaceEnabled && !settings.delegationSecret) {\n    throw new Error(\"OPENGENI_DELEGATION_SECRET is required when OPENGENI_TOOLSPACE_ENABLED=true\");\n  }\n  if (settings.productAccessMode === \"managed\") {\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    if (!settings.betterAuthSecret) {\n      throw new Error(\n        \"OPENGENI_BETTER_AUTH_SECRET is required when OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    if (!settings.delegationSecret) {\n      throw new Error(\n        \"OPENGENI_DELEGATION_SECRET is required when OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    if (![\"local\", \"test\"].includes(settings.environment) && !settings.resendApiKey) {\n      throw new Error(\"OPENGENI_RESEND_API_KEY is required for managed mode outside local/test\");\n    }\n    if (![\"local\", \"test\"].includes(settings.environment) && !settings.environmentsEncryptionKey) {\n      throw new Error(\n        \"OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is required for managed mode outside local/test\",\n      );\n    }\n  }\n  environmentsEncryptionKeyBytes(settings);\n  if (settings.integrationsEnabled) {\n    if (settings.productAccessMode === \"managed\" && !settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when OPENGENI_INTEGRATIONS_ENABLED=true and OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    if (\n      settings.publicBaseUrl &&\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when OPENGENI_INTEGRATIONS_ENABLED=true outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret && ![\"local\", \"test\"].includes(settings.environment)) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when OPENGENI_INTEGRATIONS_ENABLED=true outside local/test\",\n      );\n    }\n  }\n  if (Boolean(settings.slackClientId) !== Boolean(settings.slackClientSecret)) {\n    throw new Error(\n      \"OPENGENI_SLACK_CLIENT_ID and OPENGENI_SLACK_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (settings.slackClientId) {\n    if (!settings.slackSigningSecret) {\n      throw new Error(\n        \"OPENGENI_SLACK_SIGNING_SECRET is required when the OpenGeni Slack app is configured\",\n      );\n    }\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when the OpenGeni Slack app is configured\",\n      );\n    }\n    if (\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when the OpenGeni Slack app is configured outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when the OpenGeni Slack app is configured\",\n      );\n    }\n  }\n  if (Boolean(settings.googleDriveClientId) !== Boolean(settings.googleDriveClientSecret)) {\n    throw new Error(\n      \"OPENGENI_GOOGLE_DRIVE_CLIENT_ID and OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (settings.googleDriveClientId) {\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when the Google Drive integration is configured\",\n      );\n    }\n    if (\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when the Google Drive integration is configured outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when the Google Drive integration is configured\",\n      );\n    }\n  }\n  parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);\n  parseSocialOauthClientsJson(settings.socialOauthClientsJson);\n  if (\n    settings.productAccessMode === \"configured\" &&\n    ![\"local\", \"test\"].includes(settings.environment) &&\n    !settings.delegationSecret &&\n    !settings.authRequired\n  ) {\n    throw new Error(\n      \"OPENGENI_PRODUCT_ACCESS_MODE=configured requires OPENGENI_DELEGATION_SECRET or OPENGENI_AUTH_REQUIRED=true outside local/test\",\n    );\n  }\n  if (settings.billingMode === \"stripe\") {\n    if (!settings.stripeSecretKey || !settings.stripeWebhookSecret) {\n      throw new Error(\n        \"OPENGENI_STRIPE_SECRET_KEY and OPENGENI_STRIPE_WEBHOOK_SECRET are required when OPENGENI_BILLING_MODE=stripe\",\n      );\n    }\n  }\n  if (settings.productAccessMode !== \"managed\" && settings.billingMode === \"stripe\") {\n    throw new Error(\"OPENGENI_BILLING_MODE=stripe requires OPENGENI_PRODUCT_ACCESS_MODE=managed\");\n  }\n  if (settings.billingMode === \"stripe\" || settings.usageLimitsMode === \"managed\") {\n    const pricing = configuredModelPricing(settings);\n    const missing = configuredAllowedModels(settings).filter((model) => !pricing[model]);\n    if (missing.length > 0) {\n      throw new Error(\n        `Missing model pricing for managed billing model(s): ${missing.join(\", \")}. Set OPENGENI_MODEL_PRICING_JSON.`,\n      );\n    }\n  }\n  if (settings.usageLimitsMode === \"static\") {\n    const limits = configuredStaticUsageLimits(settings);\n    if (Object.keys(limits).length === 0) {\n      throw new Error(\n        \"OPENGENI_STATIC_USAGE_LIMITS_JSON must define at least one cap when OPENGENI_USAGE_LIMITS_MODE=static\",\n      );\n    }\n  } else {\n    parseStaticUsageLimitsJson(settings.staticUsageLimitsJson);\n  }\n  if (settings.entitlementsMode === \"static\") {\n    const entitlements = parseStaticEntitlementsJson(settings.staticEntitlementsJson);\n    if (Object.keys(entitlements).length === 0) {\n      throw new Error(\n        \"OPENGENI_STATIC_ENTITLEMENTS_JSON must define at least one feature when OPENGENI_ENTITLEMENTS_MODE=static\",\n      );\n    }\n  } else {\n    parseStaticEntitlementsJson(settings.staticEntitlementsJson);\n  }\n  if (settings.authRequired && !settings.accessKey) {\n    throw new Error(\"OPENGENI_ACCESS_KEY is required when OPENGENI_AUTH_REQUIRED=true\");\n  }\n  if (settings.openaiProvider === \"azure\") {\n    if (!settings.azureOpenaiBaseUrl && !settings.azureOpenaiEndpoint) {\n      throw new Error(\n        \"Azure OpenAI requires OPENGENI_AZURE_OPENAI_BASE_URL or OPENGENI_AZURE_OPENAI_ENDPOINT\",\n      );\n    }\n    if (!settings.azureOpenaiBaseUrl && !settings.azureOpenaiDeployment) {\n      throw new Error(\"Azure OpenAI endpoint mode requires OPENGENI_AZURE_OPENAI_DEPLOYMENT\");\n    }\n    if (!settings.azureOpenaiBaseUrl && !settings.azureOpenaiApiVersion) {\n      throw new Error(\"Azure OpenAI endpoint mode requires OPENGENI_AZURE_OPENAI_API_VERSION\");\n    }\n    if (!settings.azureOpenaiApiKey && !settings.azureOpenaiAdToken) {\n      throw new Error(\"Azure OpenAI requires an API key or AD token\");\n    }\n  }\n  // The Modal token is a both-or-neither pair regardless of the active backend\n  // (a half-configured token is always a misconfiguration). This is orthogonal\n  // to the backend-gated required-cred sweep below.\n  if (Boolean(settings.modalTokenId) !== Boolean(settings.modalTokenSecret)) {\n    throw new Error(\n      \"OPENGENI_MODAL_TOKEN_ID and OPENGENI_MODAL_TOKEN_SECRET must both be set or both omitted\",\n    );\n  }\n  // Backend-gated required credentials: only the *active* backend's creds are\n  // required. A modal deployment must carry the Modal token; a daytona/e2b/none\n  // deployment must NOT be forced to (and is not). Drives off the single\n  // SANDBOX_REQUIRED_ENV table that the deployment package also mirrors.\n  for (const required of SANDBOX_REQUIRED_ENV[settings.sandboxBackend] ?? []) {\n    const value = settings[required.field];\n    if (\n      value === undefined ||\n      value === null ||\n      (typeof value === \"string\" && value.trim().length === 0)\n    ) {\n      throw new Error(\n        `${required.env} is required when OPENGENI_SANDBOX_BACKEND=${settings.sandboxBackend}`,\n      );\n    }\n  }\n  if (\n    settings.objectStorageBackend === \"s3-compatible\" ||\n    settings.objectStorageBackend === \"aws-s3\"\n  ) {\n    if (\n      Boolean(settings.objectStorageAccessKeyId) !== Boolean(settings.objectStorageSecretAccessKey)\n    ) {\n      throw new Error(\n        \"OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID and OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY must both be set or both omitted\",\n      );\n    }\n    if (\n      settings.objectStorageBackend === \"s3-compatible\" &&\n      (settings.objectStorageEndpoint ||\n        settings.objectStorageInternalEndpoint ||\n        settings.objectStorageSandboxEndpoint) &&\n      (!settings.objectStorageAccessKeyId || !settings.objectStorageSecretAccessKey)\n    ) {\n      throw new Error(\n        \"S3-compatible object storage endpoints require OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID and OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY\",\n      );\n    }\n    if (\n      settings.objectStorageAzureConnectionString ||\n      settings.objectStorageAzureAccountName ||\n      settings.objectStorageAzureAccountKey ||\n      settings.objectStorageAzureEndpoint\n    ) {\n      throw new Error(\n        \"S3 object storage uses OPENGENI_OBJECT_STORAGE_* S3 settings, not OPENGENI_OBJECT_STORAGE_AZURE_* settings\",\n      );\n    }\n    if (\n      settings.objectStorageGcsProjectId ||\n      settings.objectStorageGcsCredentialsJson ||\n      settings.objectStorageGcsKeyFilename ||\n      settings.objectStorageGcsApiEndpoint\n    ) {\n      throw new Error(\n        \"S3 object storage uses OPENGENI_OBJECT_STORAGE_* S3 settings, not OPENGENI_OBJECT_STORAGE_GCS_* settings\",\n      );\n    }\n  } else if (settings.objectStorageBackend === \"azure-blob\") {\n    if (\n      settings.objectStorageEndpoint ||\n      settings.objectStorageInternalEndpoint ||\n      settings.objectStorageSandboxEndpoint ||\n      settings.objectStorageAccessKeyId ||\n      settings.objectStorageSecretAccessKey\n    ) {\n      throw new Error(\n        \"Azure Blob storage uses OPENGENI_OBJECT_STORAGE_AZURE_* settings, not S3-compatible object storage settings\",\n      );\n    }\n    if (\n      settings.objectStorageGcsProjectId ||\n      settings.objectStorageGcsCredentialsJson ||\n      settings.objectStorageGcsKeyFilename ||\n      settings.objectStorageGcsApiEndpoint\n    ) {\n      throw new Error(\n        \"Azure Blob storage uses OPENGENI_OBJECT_STORAGE_AZURE_* settings, not OPENGENI_OBJECT_STORAGE_GCS_* settings\",\n      );\n    }\n    const hasConnectionString = Boolean(settings.objectStorageAzureConnectionString);\n    const hasSharedKey =\n      Boolean(settings.objectStorageAzureAccountName) &&\n      Boolean(settings.objectStorageAzureAccountKey);\n    if (!hasConnectionString && !hasSharedKey) {\n      throw new Error(\n        \"Azure Blob storage requires OPENGENI_OBJECT_STORAGE_AZURE_CONNECTION_STRING or OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_NAME plus OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_KEY\",\n      );\n    }\n  } else {\n    if (\n      settings.objectStorageEndpoint ||\n      settings.objectStorageInternalEndpoint ||\n      settings.objectStorageSandboxEndpoint ||\n      settings.objectStorageAccessKeyId ||\n      settings.objectStorageSecretAccessKey\n    ) {\n      throw new Error(\n        \"GCS object storage uses OPENGENI_OBJECT_STORAGE_GCS_* settings, not S3-compatible object storage settings\",\n      );\n    }\n    if (\n      settings.objectStorageAzureConnectionString ||\n      settings.objectStorageAzureAccountName ||\n      settings.objectStorageAzureAccountKey ||\n      settings.objectStorageAzureEndpoint\n    ) {\n      throw new Error(\n        \"GCS object storage uses OPENGENI_OBJECT_STORAGE_GCS_* settings, not OPENGENI_OBJECT_STORAGE_AZURE_* settings\",\n      );\n    }\n    if (settings.objectStorageGcsCredentialsJson) {\n      parseGcsCredentialsJson(settings.objectStorageGcsCredentialsJson);\n    }\n  }\n  if (settings.documentChunkOverlap >= settings.documentChunkSize) {\n    throw new Error(\n      \"OPENGENI_DOCUMENT_CHUNK_OVERLAP must be smaller than OPENGENI_DOCUMENT_CHUNK_SIZE\",\n    );\n  }\n  parseExposedPorts(settings.dockerExposedPorts);\n  sandboxEnvironmentVariableNames(settings);\n  sandboxLifecycleHookIds(settings);\n  // Fail fast on a malformed warm-rate table (P2.1).\n  parseSandboxWarmRateJson(settings.sandboxWarmRateMicrosPerSecondJson);\n  const serverIds = new Set<string>();\n  for (const server of settings.mcpServers) {\n    if (serverIds.has(server.id)) {\n      throw new Error(`OPENGENI_MCP_SERVERS contains duplicate id ${server.id}`);\n    }\n    serverIds.add(server.id);\n  }\n  // --- sandbox lease cadence invariant (fail fast at boot) ---\n  // reaperPeriod (30s) < viewerHolderTTL (90s), and reaperPeriod + idleGrace must\n  // be strictly less than the provider lifetime (modalTimeoutSeconds*1000):\n  //   - the reaper must run more often than the TTL it polices; and\n  //   - the reaper must terminate a genuinely-idle box (after the full drain grace,\n  //     observed on the NEXT sweep) BEFORE the provider's hard lifetime reclaims it\n  //     out from under us — the provider lifetime is the backstop, not the\n  //     warm-window controller. idleGrace counts from the user's last release;\n  //     the provider clock counts from the preceding resume, so we leave the\n  //     active-turn headroom in modalTimeoutSeconds (default 86400s).\n  {\n    const reaperPeriod = settings.sandboxLeaseReaperPeriodMs;\n    const viewerTtl = settings.sandboxViewerHolderTtlMs;\n    const idleGraceMs = settings.sandboxIdleGraceMs;\n    const providerLifetimeMs = settings.modalTimeoutSeconds * 1000;\n    const rotationLeadMs = settings.sandboxRotationLeadMs;\n    // The EFFECTIVE box lifetime when it sits idle between turns is the Modal IDLE\n    // timeout, NOT the hard lifetime (sandbox-file-persistence): a box with no\n    // active connection is idle-reaped at idleTimeout. effectiveModalIdleTimeout\n    // defaults to the hard lifetime (so the idle-reap never beats the OpenGeni\n    // reaper), but an operator can pin it shorter — the invariants below bind the\n    // reaper cadence + drain grace to the idle timeout (the REAL ceiling), so a\n    // drained box always survives long enough for the reaper to snapshot it.\n    const idleTimeoutMs = effectiveModalIdleTimeoutSeconds(settings) * 1000;\n    if (!(reaperPeriod < viewerTtl)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS (${reaperPeriod}) must be strictly less than ` +\n          `OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS (${viewerTtl}): the reaper must run more often ` +\n          `than the TTL it polices, or stale viewer holders outlive a full reaper period.`,\n      );\n    }\n    if (!(idleTimeoutMs <= providerLifetimeMs)) {\n      throw new Error(\n        `OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS*1000 (${idleTimeoutMs}) must not exceed the hard provider ` +\n          `lifetime (OPENGENI_MODAL_TIMEOUT_SECONDS*1000 = ${providerLifetimeMs}): the idle timeout is a ` +\n          `floor under the hard lifetime, not above it.`,\n      );\n    }\n    if (!(rotationLeadMs < providerLifetimeMs)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must be strictly less than ` +\n          `OPENGENI_MODAL_TIMEOUT_SECONDS*1000 (${providerLifetimeMs}).`,\n      );\n    }\n    if (!(rotationLeadMs > settings.sandboxSnapshotTimeoutMs + 2 * reaperPeriod)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must exceed the snapshot timeout ` +\n          `plus two reaper periods (${settings.sandboxSnapshotTimeoutMs + 2 * reaperPeriod}).`,\n      );\n    }\n    if (!(viewerTtl < idleTimeoutMs)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS (${viewerTtl}) must be strictly less than the effective box ` +\n          `idle timeout (${idleTimeoutMs}): a viewer holder must be reapable before the box idles out from ` +\n          `under it (the provider idle-timeout is the backstop).`,\n      );\n    }\n    if (!(reaperPeriod + idleGraceMs < idleTimeoutMs)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS + OPENGENI_SANDBOX_IDLE_GRACE_MS ` +\n          `(${reaperPeriod} + ${idleGraceMs} = ${reaperPeriod + idleGraceMs}) must be strictly less than the ` +\n          `effective box idle timeout (${idleTimeoutMs}): a drained box must SURVIVE its full warm window so ` +\n          `the reaper can resume + snapshot /workspace + terminate it on the sweep AFTER the drain grace ` +\n          `elapses — Modal's idle-reap must NOT fire first (or /workspace is lost). Raise ` +\n          `OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS (defaults to OPENGENI_MODAL_TIMEOUT_SECONDS) or lower ` +\n          `OPENGENI_SANDBOX_IDLE_GRACE_MS.`,\n      );\n    }\n  }\n  // --- stream-token secret: required-when-desktop, but GRACEFULLY DEGRADE (stream-token availability contract) ---\n  // The desktop pixel plane needs an HMAC secret to mint scoped stream tokens.\n  // It is REQUIRED when desktop is enabled — but per OD-8 a missing secret is NOT\n  // a hard boot-fail: we emit a LOUD warning and the deployment ships with\n  // DesktopStream.transport:null (resolveStreamTokenSecret returns undefined ->\n  // negotiateCapabilities degrades the desktop cell). This keeps a desktop-\n  // configured deployment bootable (headless + Channel-A still work) instead of\n  // crashing the whole API on a missing secret.\n  if (settings.sandboxDesktopEnabled && resolveStreamTokenSecret(settings) === undefined) {\n    console.warn(\n      \"[opengeni] OPENGENI_SANDBOX_DESKTOP_ENABLED=true but neither OPENGENI_STREAM_TOKEN_SECRET nor \" +\n        \"OPENGENI_DELEGATION_SECRET is set: the desktop pixel plane will GRACEFULLY DEGRADE \" +\n        \"(DesktopStream.transport=null — no scoped stream tokens can be minted). Set \" +\n        \"OPENGENI_STREAM_TOKEN_SECRET to enable the live desktop stream.\",\n    );\n  }\n  // Model provider registry: parse it here so JSON/zod errors surface at boot,\n  // reject a registry id colliding with the built-in provider id (it would\n  // shadow the built-in in configuredProviders), reject duplicate registry\n  // ids, and require a resolvable API key for every registry provider (a\n  // provider with no usable key can never serve a turn). Registry models flow\n  // through configuredAllowedModels, so the managed-billing pricing check above\n  // already covers them.\n  const registryProviders = parseModelProvidersJson(settings.modelProvidersJson);\n  const builtinId = builtinProviderId(settings);\n  const providerIds = new Set<string>();\n  for (const provider of registryProviders) {\n    if (\n      provider.kind === \"vercel-gateway-managed\" ||\n      provider.kind === \"vercel-gateway-workspace\"\n    ) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider kind ${provider.kind} is reserved for the reviewed AI Gateway broker`,\n      );\n    }\n    if (provider.id === builtinId) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider id ${provider.id} collides with the built-in provider id`,\n      );\n    }\n    if (providerIds.has(provider.id)) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON contains duplicate provider id ${provider.id}`,\n      );\n    }\n    providerIds.add(provider.id);\n    if (provider.kind !== \"codex-subscription\" && !resolveProviderApiKey(provider)) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider ${provider.id} requires a resolvable API key (set apiKey or apiKeyEnv)`,\n      );\n    }\n  }\n  // Materialize the normalized catalog at boot so canonical product ids,\n  // aliases, definition digests, and capability/pricing normalization are\n  // validated even when managed billing is disabled.\n  configuredModels(settings);\n}\n\n/**\n * Resolve the secret used to sign/verify scoped stream tokens (sandbox contract\n * §C.3). Falls back to `delegationSecret` (the same HMAC envelope family —\n * `ogs_` vs `ogd_` prefix) so a deployment that already carries a delegation\n * secret does not need a second one. Returns undefined when neither is set,\n * which drives the graceful-degrade (DesktopStream.transport:null).\n */\nexport function resolveStreamTokenSecret(settings: Settings): string | undefined {\n  const explicit = settings.streamTokenSecret?.trim();\n  if (explicit) {\n    return explicit;\n  }\n  const delegation = settings.delegationSecret?.trim();\n  return delegation ? delegation : undefined;\n}\n\n/**\n * True iff the desktop pixel plane must GRACEFULLY DEGRADE because desktop is\n * enabled but no stream-token secret is resolvable (stream-token availability contract). When true,\n * negotiateCapabilities forces DesktopStream.transport:null.\n */\nexport function streamTokenDegraded(settings: Settings): boolean {\n  return settings.sandboxDesktopEnabled && resolveStreamTokenSecret(settings) === undefined;\n}\n\n/**\n * Resolve the secret the control plane signs the enrollment bearer credential\n * with (the `oge_` envelope the agent presents back — M5). Falls\n * back to `delegationSecret` (the same HMAC envelope family) so a deployment that\n * already carries a delegation secret needs no second one. Returns undefined when\n * neither is set; when selfhosted is enabled but this is undefined, the poll route\n * reports the credential plane disabled (graceful degrade, never a 500). NEVER log\n * the returned value.\n */\nexport function resolveEnrollmentSigningSecret(settings: Settings): string | undefined {\n  const explicit = settings.enrollmentSigningSecret?.trim();\n  if (explicit) {\n    return explicit;\n  }\n  const delegation = settings.delegationSecret?.trim();\n  return delegation ? delegation : undefined;\n}\n\n/**\n * Resolve the HMAC secret the control plane signs the agent's relay PRODUCER token\n * with (the `ogr_` envelope; M8b). The RELAY verifies the producer\n * token with the SAME secret (injected into the relay via env). Prefers an explicit\n * `selfhostedRelayTokenSecret`, then the `streamTokenSecret` (the relay already\n * needs that one to verify the viewer's `ogs_` token, so a single secret can back\n * both planes), then `delegationSecret` (same HMAC family). Returns undefined when\n * none is set — the enrollment poll then returns an empty relayToken (graceful\n * degrade; the stream plane is unavailable until configured). NEVER log the value.\n */\nexport function resolveRelayTokenSecret(settings: Settings): string | undefined {\n  const explicit = settings.selfhostedRelayTokenSecret?.trim();\n  if (explicit) {\n    return explicit;\n  }\n  const stream = settings.streamTokenSecret?.trim();\n  if (stream) {\n    return stream;\n  }\n  const delegation = settings.delegationSecret?.trim();\n  return delegation ? delegation : undefined;\n}\n\n/**\n * The resolved NATS auth-callout responder config (M-AUTH). Present only when the\n * callout plane is FULLY configured: the account signing seed + the responder's own\n * login. When any piece is missing this returns null and the responder does not\n * start (selfhosted agents cannot connect — a graceful disabled state, never a boot\n * crash). The returned `accountSeed` is a secret; NEVER log it.\n */\nexport interface NatsCalloutConfig {\n  /** The callout account SIGNING seed (`SA...`) — signs the user + response JWTs. */\n  accountSeed: string;\n  /** The target account NAME the user is placed into (the response `aud`). */\n  accountName: string;\n  /** The responder's NATS login (an `auth_callout.auth_users` user). */\n  user: string;\n  password: string;\n}\n\nexport function resolveNatsCalloutConfig(settings: Settings): NatsCalloutConfig | null {\n  const accountSeed = settings.selfhostedNatsCalloutAccountSeed?.trim();\n  const accountName = settings.selfhostedNatsCalloutAccountName?.trim() || \"APP\";\n  const user = settings.selfhostedNatsCalloutUser?.trim();\n  const password = settings.selfhostedNatsCalloutPassword?.trim();\n  if (!accountSeed || !user || !password) {\n    return null;\n  }\n  return { accountSeed, accountName, user, password };\n}\n\n/**\n * The PRIVILEGED control-plane NATS login (api/worker). Present only when BOTH a\n * user and password are set; otherwise null and the bus connects anonymously (local\n * dev / a NATS without auth_callout). When the callout plane is on, this is the\n * static account user permitted to request `agent.*.rpc`.\n */\nexport interface NatsControlPlaneAuth {\n  user: string;\n  password: string;\n}\n\nexport function resolveNatsControlPlaneAuth(settings: Settings): NatsControlPlaneAuth | null {\n  const user = settings.selfhostedNatsControlUser?.trim();\n  const password = settings.selfhostedNatsControlPassword?.trim();\n  if (!user || !password) {\n    return null;\n  }\n  return { user, password };\n}\n\nfunction splitCsv(raw: string): string[] {\n  return raw\n    .split(\",\")\n    .map((value) => value.trim())\n    .filter(Boolean);\n}\n\nfunction uniqueEnvNames(raw: string[], fieldName: string): string[] {\n  const seen = new Set<string>();\n  const out: string[] = [];\n  for (const name of raw) {\n    if (!envName.test(name)) {\n      throw new Error(`${fieldName} contains invalid variable name ${name}`);\n    }\n    if (!seen.has(name)) {\n      seen.add(name);\n      out.push(name);\n    }\n  }\n  return out;\n}\n\nfunction uniqueValues(raw: string[]): string[] {\n  return [...new Set(raw.filter(Boolean))];\n}\n\nfunction parseGcsCredentialsJson(raw: string): unknown {\n  try {\n    return JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_OBJECT_STORAGE_GCS_CREDENTIALS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n}\n\nfunction delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP,SAAS,iDAAiD;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAElB,IAAM,UAAU;AAChB,IAAM,aAAa;AACnB,IAAM,aAAa,EAAE,WAAW,CAAC,UAAU;AACzC,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,MAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,IAAI,EAAE,SAAS,UAAU,GAAG;AACxD,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAS,KAAK,MAAM,KAAK,KAAK,EAAE,SAAS,UAAU,GAAG;AACzD,WAAO;AAAA,EACT;AACA,SAAO;AACT,GAAG,EAAE,QAAQ,CAAC;AAEP,IAAM,6BAAiF;AAAA,EAC5F,MAAM;AAAA,IACJ,KAAK,CAAC;AAAA,IACN,OAAO,CAAC;AAAA,EACV;AAAA,EACA,OAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,OAAO,CAAC,iBAAiB;AAAA,EAC3B;AAAA,EACA,QAAQ;AAAA,IACN,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,OAAO,CAAC;AAAA,EACV;AACF;AAUO,IAAM,sCAAsC;AAkB5C,IAAM,6BAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,GAAG;AAEH,IAAM,+BAA+B,EACzC,OAAO;AAAA;AAAA,EAEN,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC9C,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAChC,MAAM,EAAE,KAAK,CAAC,UAAU,WAAW,eAAe,WAAW,CAAC,EAAE,SAAS;AAAA,EACzE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC5C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,mBAAmB,EAChB;AAAA,IACC,EACG,OAAO;AAAA,MACN,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,MAC7B,MAAM,EAAE,QAAQ,YAAY;AAAA,IAC9B,CAAC,EACA,OAAO;AAAA,EACZ,EACC,IAAI,CAAC,EACL,IAAI,GAAG,EACP,YAAY,CAAC,WAAW,YAAY;AACnC,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,CAAC,OAAO,QAAQ,KAAK,UAAU,QAAQ,GAAG;AACnD,YAAM,MAAM,GAAG,SAAS,IAAI,KAAK,SAAS,EAAE;AAC5C,UAAI,KAAK,IAAI,GAAG,GAAG;AACjB,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM,CAAC,KAAK;AAAA,QACd,CAAC;AAAA,MACH;AACA,WAAK,IAAI,GAAG;AAAA,IACd;AAAA,EACF,CAAC,EACA,SAAS;AAAA,EACZ,cAAc,EAAE,KAAK,CAAC,aAAa,SAAS,CAAC,EAAE,SAAS;AAC1D,CAAC,EACA,OAAO,EACP,YAAY,CAAC,WAAW,YAAY;AACnC,MAAI,CAAC,UAAU,kBAAmB;AAClC,MAAI,CAAC,UAAU,cAAc;AAC3B,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM,CAAC,cAAc;AAAA,IACvB,CAAC;AAAA,EACH;AACA,MAAI,CAAC,UAAU,UAAU;AACvB,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM,CAAC,UAAU;AAAA,IACnB,CAAC;AAAA,EACH;AACF,CAAC;AAGH,IAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,aAAa,EAAE,OAAO,EAAE,QAAQ,UAAU;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,QAAQ,OAAO;AAAA,EACvC,oBAAoB,EAAE,OAAO,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA,EAG5C,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,QAAQ,sDAAsD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtF,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA,EAI/B,aAAa,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC,EAAE,QAAQ,OAAO;AAAA;AAAA;AAAA;AAAA,EAIxD,qBAAqB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,cAAc;AAAA,EAC7D,SAAS,EAAE,OAAO,EAAE,QAAQ,uBAAuB;AAAA,EACnD,cAAc,EAAE,OAAO,EAAE,QAAQ,gBAAgB;AAAA,EACjD,mBAAmB,EAAE,OAAO,EAAE,QAAQ,SAAS;AAAA,EAC/C,mBAAmB,EAAE,OAAO,EAAE,QAAQ,kBAAkB;AAAA,EACxD,oBAAoB,WAAW,QAAQ,KAAK;AAAA,EAC5C,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,oCAAoC,EAAE,OAAO,EAAE,SAAS;AAAA,EACxD,oCAAoC,EAAE,OAAO,EAAE,SAAS;AAAA,EACxD,mCAAmC,EAAE,OAAO,EAAE,SAAS;AAAA,EACvD,gCAAgC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EAC7E,sCAAsC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA,EACrF,kCAAkC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA,EACjF,2BAA2B,EAAE,KAAK,CAAC,SAAS,gBAAgB,CAAC,EAAE,QAAQ,OAAO;AAAA,EAC9E,8BAA8B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAK,EAAE,QAAQ,EAAE;AAAA,EACtF,0BAA0B,EAAE,OAAO,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA,EACzE,6BAA6B,EAAE,OAAO,OAAO,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,IAAI;AAAA,EAC/E,6BAA6B,WAAW,QAAQ,KAAK;AAAA,EACrD,6BAA6B,WAAW,QAAQ,IAAI;AAAA,EACpD,2BAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrD,0BAA0B,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC/C,kBAAkB,WAAW,QAAQ,KAAK;AAAA,EAC1C,0BAA0B,WAAW,QAAQ,IAAI;AAAA,EACjD,sBAAsB,EACnB,OAAO,EACP,IAAI,GAAG,EACP,MAAM,mBAAmB,EACzB,SAAS;AAAA,EACZ,4BAA4B,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAChE,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAK,EAAE,SAAS;AAAA,EAC3D,2BAA2B,EACxB,OAAO,EACP,IAAI,EAAE,EACN,MAAM,gBAAgB,EACtB,SAAS;AAAA,EACZ,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAGzC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAItC,sBAAsB,EACnB,OAAO,EACP,IAAI,EACJ,QAAQ,mDAAmD;AAAA;AAAA;AAAA;AAAA,EAI9D,oBAAoB,EACjB,OAAO,EACP,MAAM,mDAAmD,EACzD,QAAQ,QAAQ;AAAA;AAAA;AAAA,EAGnB,kBAAkB,EACf,OAAO,EACP,MAAM,mDAAmD,EACzD,SAAS;AAAA,EACZ,mBAAmB,kBAAkB,QAAQ,OAAO;AAAA,EACpD,aAAa,YAAY,QAAQ,UAAU;AAAA,EAC3C,kBAAkB,iBAAiB,QAAQ,MAAM;AAAA,EACjD,iBAAiB,gBAAgB,QAAQ,MAAM;AAAA,EAC/C,wBAAwB,EAAE,OAAO,EAAE,QAAQ,IAAI;AAAA,EAC/C,uBAAuB,EAAE,OAAO,EAAE,QAAQ,IAAI;AAAA,EAC9C,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIvC,sBAAsB,WAAW,QAAQ,KAAK;AAAA,EAC9C,kBAAkB,WAAW,QAAQ,KAAK;AAAA,EAC1C,0BAA0B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA;AAAA;AAAA;AAAA,EAIxE,mBAAmB,EAChB,OAAO,EACP,MAAM,qEAAqE,EAC3E,SAAS;AAAA,EACZ,2BAA2B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,qBAAqB,WAAW,QAAQ,KAAK;AAAA,EAC7C,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,wCAAwC,WAAW,QAAQ,KAAK;AAAA,EAChE,8BAA8B,EAAE,OAAO,EAAE,QAAQ,IAAI;AAAA,EACrD,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAG7C,qBAAqB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,sBAAsB,EAAE,SAAS;AAAA;AAAA;AAAA,EAGhG,wBAAwB,EAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/C,0BAA0B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACtE,qBAAqB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKjE,2BAA2B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAS;AAAA;AAAA;AAAA;AAAA,EAI/E,qBAAqB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,KAAS;AAAA;AAAA;AAAA;AAAA,EAIzE,8BAA8B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ1E,iCAAiC,EAAE,OAChC,OAAO,EACP,QAAQ,GAAG,EACX,UAAU,CAAC,UAAU;AACpB,QAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,aAAO;AAAA,IACT;AACA,WAAO,KAAK,IAAI,KAAK,KAAK,IAAI,KAAK,KAAK,CAAC;AAAA,EAC3C,CAAC;AAAA;AAAA;AAAA,EAGH,6BAA6B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,KAAO;AAAA;AAAA;AAAA,EAGlF,mCAAmC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI/E,iCAAiC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EAClF,cAAc,WAAW,QAAQ,KAAK;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,iBAAiB,WAAW,QAAQ,IAAI;AAAA,EACxC,kBAAkB,WAAW,QAAQ,KAAK;AAAA,EAC1C,SAAS,EAAE,OAAO,EAAE,QAAQ,SAAS;AAAA,EACrC,SAAS,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA,EACxD,gBAAgB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC/D,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI1C,sBAAsB,EAAE,OAAO,EAAE,QAAQ,OAAO,+CAA+C;AAAA,EAC/F,gBAAgB,EAAE,KAAK,CAAC,UAAU,OAAO,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC5D,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,QAAQ,aAAa;AAAA,EAC7C,qBAAqB,EAAE,OAAO,EAAE,QAAQ,wCAAwC;AAAA;AAAA;AAAA;AAAA,EAIhF,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3C,8BAA8B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACpF,wBAAwB,EAAE,OACvB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,OAAO,IAAI,EACpB,QAAQ,KAAK,OAAO,IAAI;AAAA;AAAA;AAAA;AAAA,EAI3B,4BAA4B,WAAW,QAAQ,IAAI;AAAA,EACnD,uCAAuC,EAAE,OACtC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,IAAI,KAAK,EAAE,EACf,QAAQ,IAAI,KAAK,EAAE;AAAA,EACtB,iCAAiC,EAAE,OAChC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,MAAM,OAAO,IAAI,EACrB,QAAQ,MAAM,OAAO,IAAI;AAAA,EAC5B,sCAAsC,EAAE,OACrC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,OAAO,IAAI,EACpB,QAAQ,IAAI,OAAO,IAAI;AAAA,EAC1B,qCAAqC,EAAE,OACpC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,IAAI,KAAK,KAAK,EAAE,EACpB,QAAQ,KAAK,KAAK,EAAE;AAAA,EACvB,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzE,yBAAyB,EAAE,OAAO,EAAE,QAAQ,wCAAwC;AAAA;AAAA;AAAA,EAGpF,yBAAyB,WAAW,QAAQ,IAAI;AAAA,EAChD,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,uBAAuB,EAAE,OAAO,EAAE,QAAQ,gBAAgB;AAAA;AAAA;AAAA,EAG1D,wBAAwB,WAAW,QAAQ,IAAI;AAAA,EAC/C,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,2BAA2B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,2BAA2B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK5C,oCAAoC,WAAW,QAAQ,KAAK;AAAA,EAC5D,kBAAkB,EAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOzC,oBAAoB,EAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAI3C,0BAA0B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAIlD,2BAA2B,WAAW,QAAQ,KAAK;AAAA;AAAA,EACnD,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASrC,wBAAwB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/C,+BAA+B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAIvD,+BAA+B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAIvD,gCAAgC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EAClF,uBAAuB,gBAAgB,QAAQ,KAAK;AAAA,EACpD,+BAA+B,EAAE,OAAO,EAAE,QAAQ,2BAA2B;AAAA,EAC7E,0BAA0B,EAAE,KAAK,CAAC,QAAQ,WAAW,CAAC,EAAE,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAStE,uBAAuB,EAAE,KAAK,CAAC,SAAS,UAAU,CAAC,EAAE,QAAQ,OAAO;AAAA;AAAA;AAAA;AAAA,EAIpE,iCAAiC,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAIxD,kBAAkB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjE,kBAAkB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQzC,2BAA2B,EAAE,OAAO,EAAE,QAAQ,0BAA0B;AAAA,EACxE,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,sBAAsB,WAAW,QAAQ,KAAK;AAAA,EAC9C,gBAAgB,eAAe,QAAQ,QAAQ;AAAA,EAC/C,aAAa,EAAE,OAAO,EAAE,QAAQ,wBAAwB;AAAA,EACxD,oBAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EACzC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKnC,wBAAwB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,cAAc,EAAE,OAAO,EAAE,QAAQ,kBAAkB;AAAA,EACnD,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMnC,cAAc,EACX,OAAO,EACP,MAAM,sBAAsB,EAC5B,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASZ,0BAA0B,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9C,qBAAqB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAM,EAAE,QAAQ,KAAM;AAAA,EAClF,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBtC,yBAAyB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASrE,2BAA2B,EACxB,KAAK,CAAC,OAAO,uBAAuB,oBAAoB,CAAC,EACzD,QAAQ,qBAAqB;AAAA;AAAA;AAAA,EAGhC,uBAAuB,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO/C,2BAA2B,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOlD,wBAAwB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAI/C,uBAAuB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACtE,wBAAwB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtE,oBAAoB,WAAW,QAAQ,IAAI;AAAA,EAC3C,qBAAqB,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI7C,kBAAkB,WAAW,QAAQ,IAAI;AAAA,EACzC,uBAAuB,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC,EAAE,QAAQ,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO1E,yBAAyB,WAAW,QAAQ,IAAI;AAAA,EAChD,oBAAoB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EACjE,qBAAqB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EACnE,mBAAmB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,SAAW;AAAA;AAAA;AAAA,EAEzE,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,yBAAyB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA,EACxE,uBAAuB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,iCAAiC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE7E,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC1C,sBAAsB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1C,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,eAAe,WAAW,QAAQ,IAAI;AAAA,EACtC,yBAAyB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErE,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,mBAAmB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,kBAAkB,EAAE,KAAK,CAAC,SAAS,MAAM,CAAC,EAAE,SAAS;AAAA,EACrD,wBAAwB,WAAW,SAAS;AAAA,EAC5C,eAAe,WAAW,SAAS;AAAA,EACnC,yBAAyB,EAAE,KAAK,CAAC,OAAO,UAAU,CAAC,EAAE,SAAS;AAAA;AAAA,EAE9D,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,yBAAyB,WAAW,SAAS;AAAA;AAAA,EAC7C,gCAAgC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5E,gBAAgB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEtC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUnC,yBAAyB,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASjD,sCAAsC,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAa9D,6BAA6B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQrD,0BAA0B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQlD,sBAAsB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM7C,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7C,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQxC,4BAA4B,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAGhD,sBAAsB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgB1C,kCAAkC,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtD,kCAAkC,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAItD,2BAA2B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,+BAA+B,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKnD,2BAA2B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,+BAA+B,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUnD,gCAAgC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC/E,mCAAmC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQpF,4BAA4B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EAC7E,0BAA0B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAU3E,oBAAoB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUtE,2BAA2B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMzE,0BAA0B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS3E,uBAAuB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO3E,0BAA0B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA,EAI/E,mBAAmB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EACpE,0BAA0B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAO;AAAA;AAAA;AAAA;AAAA,EAI5E,yBAAyB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3E,mBAAmB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMrE,oCAAoC,EAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3D,mCAAmC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAClF,4BAA4B,EAAE,OAAO,EAAE,QAAQ,MAAM;AAAA,EACrD,qBAAqB,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC1C,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjD,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzD,8BAA8B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACxD,sBAAsB,EACnB,KAAK,CAAC,iBAAiB,UAAU,cAAc,KAAK,CAAC,EACrD,QAAQ,eAAe;AAAA,EAC1B,qBAAqB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,gBAAgB;AAAA,EAC/D,qBAAqB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,WAAW;AAAA,EAC1D,yBAAyB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,OAAO;AAAA,EAC1D,0BAA0B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9C,8BAA8B,EAAE,OAAO,EAAE,SAAS;AAAA,EAClD,6BAA6B,WAAW,QAAQ,IAAI;AAAA,EACpD,oCAAoC,EAAE,OAAO,EAAE,SAAS;AAAA,EACxD,+BAA+B,EAAE,OAAO,EAAE,SAAS;AAAA,EACnD,8BAA8B,EAAE,OAAO,EAAE,SAAS;AAAA,EAClD,4BAA4B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtD,2BAA2B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,iCAAiC,EAAE,OAAO,EAAE,SAAS;AAAA,EACrD,6BAA6B,EAAE,OAAO,EAAE,SAAS;AAAA,EACjD,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,WAAW;AAAA,EACrD,mBAAmB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAClE,sBAAsB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,GAAG;AAAA,EACvE,2BAA2B,EAAE,KAAK,CAAC,UAAU,eAAe,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC/E,wBAAwB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,wBAAwB;AAAA,EAC1E,6BAA6B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC5E,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpD,0BAA0B,EAAE,KAAK,CAAC,UAAU,aAAa,MAAM,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAClF,uBAAuB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,aAAa;AAAA,EAC9D,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,yBAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnD,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,0BAA0B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9C,8BAA8B,EAAE,OAAO,EAAE,SAAS;AAAA,EAClD,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,wBAAwB,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC7C,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,0BAA0B,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC/C,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,QAAQ,kCAAkC;AAAA,EAChE,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,sBAAsB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1C,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,YAAY,EACT;AAAA,IACC,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,UAAU;AAAA,MACtC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACjC,KAAK,EAAE,OAAO,EAAE,IAAI;AAAA,MACpB,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,MAClD,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,MAChD,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,MAEzC,iBAAiB,yBAAyB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOnD,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACnD,eAAe,6BAA6B,SAAS;AAAA,IACvD,CAAC;AAAA,EACH,EACC,QAAQ,CAAC,CAAC;AACf,CAAC;AAmCM,SAAS,yBAAyB,OAAmD;AAC1F,MAAI,SAAS,KAAM,QAAO;AAC1B,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,aAAa,QAAQ,YAAY;AACvC,MACE,eAAe,cACf,eAAe,cACf,eAAe,cACf,eAAe,gBACf,eAAe,SACf,WAAW,WAAW,OAAO,KAC7B,WAAW,WAAW,OAAO,GAC7B;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOO,SAAS,kCAAkC,UAAgD;AAChG,QAAM,QAAQ,SAAS,wBACpB,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB;AAAA,IACC,CAAC,SACC,SAAS,YAAY,SAAS,kBAAkB,SAAS;AAAA,EAC7D;AACF,QAAM,OAAO,oBAAI,IAA0B;AAC3C,QAAM,YAAwC,CAAC;AAC/C,aAAW,MAAM,OAAO;AACtB,QAAI,KAAK,IAAI,EAAE,EAAG;AAClB,SAAK,IAAI,EAAE;AACX,QAAI,OAAO,UAAU;AACnB,UAAI,CAAC,SAAS,wBAAyB;AACvC,YAAM,SAAS,SAAS,0BAA0B,SAAS;AAC3D,UAAI,CAAC,yBAAyB,MAAM,EAAG;AAGvC,UACE,SAAS,mBAAmB,WAC5B,CAAC,SAAS,0BACV,CAAC,SAAS,yBACV;AACA;AAAA,MACF;AACA,gBAAU,KAAK;AAAA,QACb,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA,UACE,SAAS,2BACT,SAAS,iBACT,6BACA,QAAQ,QAAQ,EAAE;AAAA,QACpB,OAAO,SAAS;AAAA,MAClB,CAAC;AACD;AAAA,IACF;AACA,QAAI,OAAO,gBAAgB;AACzB,UAAI,CAAC,SAAS,uBAAwB;AACtC,YAAM,YACJ,SAAS,2BACT,SAAS,uBACT,IACA,QAAQ,QAAQ,EAAE;AACpB,YAAM,aAAa,SAAS,6BAA6B,SAAS,yBAAyB;AAC3F,YAAM,aACJ,SAAS,6BACT,SAAS,yBACT;AACF,YAAM,SAAS,SAAS,yBAAyB,SAAS,qBAAqB;AAC/E,YAAM,UAAU,SAAS,0BAA0B,SAAS,sBAAsB;AAClF,UACE,CAAC,YACD,CAAC,cACA,CAAC,yBAAyB,MAAM,KAAK,CAAC,yBAAyB,OAAO,GACvE;AACA;AAAA,MACF;AAGA,UACE,SAAS,mBAAmB,WAC5B,CAAC,SAAS,2BACV,CAAC,SAAS,6BACV,CAAC,SAAS,yBACV,CAAC,SAAS,wBACV;AACA;AAAA,MACF;AACA,gBAAU,KAAK;AAAA,QACb,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ,yBAAyB,MAAM,IAAI,SAAS;AAAA,QACpD,SAAS,yBAAyB,OAAO,IAAI,UAAU;AAAA,MACzD,CAAC;AACD;AAAA,IACF;AACA,QAAI,OAAO,sBAAsB;AAM/B,UAAI,CAAC,SAAS,yBAA0B;AACxC,gBAAU,KAAK;AAAA,QACb,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,+BAA+B,UAA6B;AAC1E,SAAO,kCAAkC,QAAQ,EAAE;AAAA,IACjD,CAAC,aAAa,SAAS,SAAS;AAAA,EAClC;AACF;AAyCA,IAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,mCAAmC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC3E,8BAA8B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC3D,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO,EAAE,SAAS;AAC3D,CAAC;AAED,IAAM,6BAA6B,EAChC,OAAO;AAAA,EACN,SAAS;AAAA,EACT,iBAAiB,EACd;AAAA,IACC,EAAE,OAAO;AAAA,MACP,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MACjD,SAAS;AAAA,IACX,CAAC;AAAA,EACH,EACC,SAAS;AACd,CAAC,EACA,YAAY,CAAC,UAAU,QAAQ;AAC9B,MAAI,WAAW;AACf,aAAW,CAAC,OAAO,IAAI,MAAM,SAAS,mBAAmB,CAAC,GAAG,QAAQ,GAAG;AACtE,QAAI,KAAK,sBAAsB,UAAU;AACvC,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,mBAAmB,OAAO,oBAAoB;AAAA,QACrD,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,eAAW,KAAK;AAAA,EAClB;AACF,CAAC;AAEI,IAAM,sBAAsB,EAAE,KAAK,CAAC,aAAa,eAAe,SAAS,CAAC;AAG1E,IAAM,0BAA0B,EACpC,OAAO;AAAA,EACN,UAAU;AAAA,EACV,UAAU,EAAE,QAAQ;AACtB,CAAC,EACA,YAAY,CAAC,OAAO,QAAQ;AAC3B,MAAI,MAAM,aAAa,iBAAiB,MAAM,UAAU;AACtD,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,UAAU;AAAA,MACjB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGH,IAAM,kBAAkB,EAAE,KAAK,CAAC,QAAQ,SAAS,OAAO,CAAC;AACzD,IAAM,qBAAqB,EAAE,KAAK,CAAC,YAAY,YAAY,MAAM,CAAC;AAE3D,IAAM,4BAA4B,EACtC,OAAO;AAAA,EACN,WAAW,wBAAwB,OAAO;AAAA,IACxC,SAAS,EAAE,MAAM,eAAe;AAAA,IAChC,eAAe,gBAAgB,SAAS;AAAA,IACxC,UAAU,EAAE,QAAQ;AAAA,EACtB,CAAC;AAAA,EACD,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,aAAa,EAAE,OAAO;AAAA,IACpB,WAAW;AAAA,IACX,SAAS;AAAA,IACT,eAAe;AAAA,EACjB,CAAC;AAAA,EACD,iBAAiB,EAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AAAA;AAAA,EAE/C,qBAAqB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACnD,kBAAkB,EAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AAAA,EAChD,YAAY,EAAE,OAAO;AAAA,IACnB,KAAK;AAAA,IACL,oBAAoB;AAAA,IACpB,eAAe;AAAA,EACjB,CAAC;AAAA,EACD,eAAe,wBAAwB,OAAO;AAAA,IAC5C,MAAM,EAAE,KAAK,CAAC,YAAY,aAAa,MAAM,CAAC;AAAA,EAChD,CAAC,EAAE,SAAS;AAAA,EACZ,cAAc,EACX;AAAA,IACC,EAAE,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,UAAU,EAAE,QAAQ;AAAA,MACpB,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IAC7D,CAAC;AAAA,EACH,EACC,IAAI,CAAC;AACV,CAAC,EACA,YAAY,CAAC,cAAc,QAAQ;AAClC,QAAM,UAAU,IAAI,IAAI,aAAa,UAAU,OAAO;AACtD,MAAI,QAAQ,SAAS,aAAa,UAAU,QAAQ,QAAQ;AAC1D,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,aAAa,SAAS;AAAA,MAC7B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,aAAa,UAAU,kBAAkB,QACzC,CAAC,QAAQ,IAAI,aAAa,UAAU,aAAa,GACjD;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,aAAa,eAAe;AAAA,MACnC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,aAAa,UAAU,YAAY,aAAa,UAAU,QAAQ,WAAW,GAAG;AAClF,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,aAAa,SAAS;AAAA,MAC7B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,aAAW,SAAS,CAAC,mBAAmB,kBAAkB,GAAY;AACpE,QAAI,IAAI,IAAI,aAAa,KAAK,CAAC,EAAE,SAAS,aAAa,KAAK,EAAE,QAAQ;AACpE,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,GAAG,KAAK;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,aAAa,oBAAI,IAAY;AACnC,aAAW,CAAC,OAAO,IAAI,KAAK,aAAa,aAAa,QAAQ,GAAG;AAC/D,QAAI,WAAW,IAAI,KAAK,EAAE,GAAG;AAC3B,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,IAAI;AAAA,QAClC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,eAAW,IAAI,KAAK,EAAE;AACtB,QAAI,KAAK,aAAa,iBAAiB,KAAK,UAAU;AACpD,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,UAAU;AAAA,QACxC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAgCI,IAAM,mBAAmB,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAQrD,IAAM,uBAAuB,EAAE,KAAK;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAID,IAAM,sBAAsB,EACzB,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EACpB,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAC5C,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA,EAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAClC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA,EAC/C,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,8BAA8B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAG5D,4BAA4B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjE,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EACtC,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EACtC,cAAc,0BAA0B,SAAS;AAAA,EACjD,SAAS,EAAE,MAAM,CAAC,oBAAoB,0BAA0B,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAG5E,kBAAkB,EAAE,MAAM,EAAE,SAAS;AAAA,EACrC,SAAS,EAAE,MAAM,EAAE,SAAS;AAC9B,CAAC,EACA,YAAY,CAAC,OAAO,QAAQ;AAC3B,MACE,MAAM,gBACN,MAAM,oBAAoB,UAC1B,MAAM,oBAAoB,MAAM,aAAa,UAAU,UACvD;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,gBACN,MAAM,oBAAoB,UAC1B,MAAM,oBAAoB,MAAM,aAAa,YAAY,UAAU,UACnE;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACF,CAAC;AAGH,IAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,MAAM,qBAAqB,QAAQ,SAAS;AAAA,EAC5C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,UAAU;AAAA;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,KAAK,iBAAiB,QAAQ,MAAM;AAAA,EACpC,SAAS,EAAE,OAAO,EAAE,IAAI;AAAA,EACxB,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC5B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC/B,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACxD,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC1D,yBAAyB,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC7D,0BAA0B,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAG9D,kBAAkB,EAAE,MAAM,EAAE,SAAS;AAAA,EACrC,SAAS,EAAE,MAAM,EAAE,SAAS;AAAA,EAC5B,QAAQ,EAAE,MAAM,mBAAmB,EAAE,IAAI,CAAC;AAC5C,CAAC;AAGM,IAAM,qCAAqC,EAAE,OAAO;AAAA,EACzD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,yBAAyB,EACtB,KAAK,CAAC,QAAQ,sBAAsB,qBAAqB,CAAC,EAC1D,QAAQ,MAAM;AACnB,CAAC;AA2DM,IAAM,6BAA6B;AACnC,IAAM,oCAAoC;AAC1C,IAAM,+BAA+B;AACrC,IAAM,gCAAgC;AACtC,IAAM,oCAAoC;AAC1C,IAAM,sCAAsC;AAC5C,IAAM,oCAAoC;AAE1C,IAAM,0BAA0B;AAChC,IAAM,oCAAoC;AAC1C,IAAM,qCAAqC;AAG3C,IAAM,6BAA6B;AAAA,EACxC,kBAAkB;AAAA,IAChB,iBAAiB;AAAA,IACjB,gBAAgB,GAAG,iCAAiC;AAAA,IACpD,kBAAkB,GAAG,kCAAkC;AAAA,IACvD,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA,oBAAoB;AAAA,IAClB,iBAAiB;AAAA,IACjB,gBAAgB,GAAG,iCAAiC;AAAA,IACpD,kBAAkB,GAAG,kCAAkC;AAAA,IACvD,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA,sBAAsB;AAAA,IACpB,iBAAiB;AAAA,IACjB,gBAAgB,GAAG,iCAAiC;AAAA,IACpD,kBAAkB,GAAG,kCAAkC;AAAA,IACvD,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AACF;AAKO,SAAS,8BACd,SACqE;AACrE,aAAW,SAAS,OAAO,OAAO,0BAA0B,GAAG;AAC7D,QAAI,MAAM,mBAAmB,SAAS;AACpC,aAAO,EAAE,QAAQ,WAAW,iBAAiB,MAAM,gBAAgB;AAAA,IACrE;AACA,QAAI,MAAM,qBAAqB,SAAS;AACtC,aAAO,EAAE,QAAQ,aAAa,iBAAiB,MAAM,gBAAgB;AAAA,IACvE;AAAA,EACF;AACA,SAAO;AACT;AAEO,IAAM,0BAA0B;AAAA,EACrC,UAAU;AAAA,IACR,WAAW;AAAA,IACX,oBAAoB,GAAG,iCAAiC;AAAA,IACxD,iBAAiB;AAAA,IACjB,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,WAAW,CAAC,WAAW,UAAU,WAAW;AAAA,IAC5C,iBAAiB;AAAA,EACnB;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,oBAAoB,GAAG,iCAAiC;AAAA,IACxD,iBAAiB;AAAA,IACjB,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,WAAW,CAAC,WAAW,WAAW;AAAA,IAClC,iBAAiB;AAAA,EACnB;AACF;AAiBO,IAAM,sBAA8D;AAAA,EACzE,eAAe;AAAA,IACb,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA;AAAA,QAEE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,gBAAgB;AAAA,IACd,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,CAAC,wBAAwB,SAAS,SAAS,GAAG;AAAA,IAC5C,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,EACF;AAAA,EACA,CAAC,wBAAwB,KAAK,SAAS,GAAG;AAAA,IACxC,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,qCAAqC;AAAA,IACnC,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,EACF;AACF;AAqBO,IAAM,uBAGT;AAAA;AAAA,EAEF,QAAQ,CAAC;AAAA,EACT,OAAO,CAAC;AAAA,EACR,MAAM,CAAC;AAAA,EACP,OAAO;AAAA,IACL,EAAE,OAAO,gBAAgB,KAAK,0BAA0B;AAAA,IACxD,EAAE,OAAO,gBAAgB,KAAK,0BAA0B;AAAA,IACxD,EAAE,OAAO,oBAAoB,KAAK,8BAA8B;AAAA,EAClE;AAAA,EACA,SAAS,CAAC,EAAE,OAAO,iBAAiB,KAAK,2BAA2B,CAAC;AAAA,EACrE,SAAS,CAAC,EAAE,OAAO,iBAAiB,KAAK,2BAA2B,CAAC;AAAA,EACrE,KAAK,CAAC,EAAE,OAAO,aAAa,KAAK,uBAAuB,CAAC;AAAA,EACzD,QAAQ,CAAC,EAAE,OAAO,gBAAgB,KAAK,0BAA0B,CAAC;AAAA,EAClE,YAAY,CAAC,EAAE,OAAO,uBAAuB,KAAK,iCAAiC,CAAC;AAAA,EACpF,QAAQ;AAAA,IACN,EAAE,OAAO,eAAe,KAAK,wBAAwB;AAAA,IACrD,EAAE,OAAO,mBAAmB,KAAK,6BAA6B;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,YAAY,CAAC;AACf;AAGO,SAAS,6BAA6B,SAAmD;AAC9F,UAAQ,qBAAqB,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,MAAM,GAAG;AACvE;AAEA,SAAS,SAAS,MAAkC;AAClD,QAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,SAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AACpD;AAEO,SAAS,cAAwB;AACtC,QAAM,MAAM;AAAA,IACV,aAAa,SAAS,uBAAuB;AAAA,IAC7C,aAAa,SAAS,sBAAsB;AAAA,IAC5C,oBACE,SAAS,8BAA8B,KACvC,SAAS,gBAAgB,KACzB,SAAS,YAAY;AAAA,IACvB,eAAe,SAAS,yBAAyB;AAAA,IACjD,aAAa,SAAS,uBAAuB;AAAA,IAC7C,UAAU,SAAS,oBAAoB;AAAA,IACvC,aAAa,SAAS,uBAAuB;AAAA,IAC7C,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,SAAS,SAAS,mBAAmB;AAAA,IACrC,cAAc,SAAS,wBAAwB;AAAA,IAC/C,mBAAmB,SAAS,6BAA6B;AAAA,IACzD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,oCAAoC;AAAA,MAClC;AAAA,IACF;AAAA,IACA,oCAAoC,SAAS,iDAAiD;AAAA,IAC9F,mCAAmC,SAAS,iDAAiD;AAAA,IAC7F,gCAAgC,SAAS,4CAA4C;AAAA,IACrF,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,kCAAkC,SAAS,gDAAgD;AAAA,IAC3F,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,2BACE,SAAS,sCAAsC,KAAK,SAAS,6BAA6B;AAAA,IAC5F,0BACE,SAAS,qCAAqC,KAAK,SAAS,4BAA4B;AAAA,IAC1F,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,eAAe,SAAS,0BAA0B;AAAA,IAClD,YAAY,SAAS,uBAAuB;AAAA,IAC5C,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,aAAa,SAAS,uBAAuB;AAAA,IAC7C,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,qBAAqB,SAAS,+BAA+B;AAAA,IAC7D,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,wCAAwC;AAAA,MACtC;AAAA,IACF;AAAA,IACA,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,eAAe,SAAS,0BAA0B;AAAA,IAClD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,2BAA2B,SAAS,yCAAyC;AAAA,IAC7E,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,iCAAiC,SAAS,qCAAqC;AAAA,IAC/E,6BAA6B,SAAS,yCAAyC;AAAA,IAC/E,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,iCAAiC,SAAS,8CAA8C;AAAA,IACxF,cAAc,SAAS,wBAAwB;AAAA,IAC/C,WAAW,SAAS,qBAAqB;AAAA,IACzC,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,SAAS,SAAS,mBAAmB;AAAA,IACrC,SAAS,SAAS,mBAAmB;AAAA,IACrC,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,gBAAgB,SAAS,kBAAkB;AAAA,IAC3C,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,gBAAgB,SAAS,0BAA0B;AAAA,IACnD,cAAc,SAAS,yBAAyB,KAAK,SAAS,gBAAgB;AAAA,IAC9E,eAAe,SAAS,0BAA0B,KAAK,SAAS,iBAAiB;AAAA,IACjF,aAAa,SAAS,uBAAuB;AAAA,IAC7C,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,uBAAuB,SAAS,oCAAoC;AAAA,IACpE,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,uCAAuC;AAAA,MACrC;AAAA,IACF;AAAA,IACA,iCAAiC,SAAS,+CAA+C;AAAA,IACzF,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,yBAAyB,SAAS,sCAAsC;AAAA,IACxE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,uBAAuB,SAAS,oCAAoC;AAAA,IACpE,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,oCAAoC,SAAS,yCAAyC;AAAA,IACtF,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,iCAAiC,SAAS,6CAA6C;AAAA,IACvF,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,oBAAoB,SAAS,gCAAgC;AAAA,IAC7D,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,oBAAoB,SAAS,gCAAgC;AAAA,IAC7D,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,gBAAgB,SAAS,0BAA0B;AAAA,IACnD,aAAa,SAAS,uBAAuB;AAAA,IAC7C,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,eAAe,SAAS,yBAAyB;AAAA,IACjD,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,cAAc,SAAS,yBAAyB;AAAA,IAChD,eAAe,SAAS,0BAA0B;AAAA,IAClD,cAAc,SAAS,yBAAyB;AAAA,IAChD,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,cAAc,SAAS,yBAAyB;AAAA,IAChD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,yBAAyB,SAAS,4BAA4B;AAAA,IAC9D,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,oBAAoB,SAAS,8BAA8B;AAAA,IAC3D,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,eAAe,SAAS,0BAA0B;AAAA,IAClD,eAAe,SAAS,0BAA0B;AAAA,IAClD,eAAe,SAAS,yBAAyB;AAAA,IACjD,cAAc,SAAS,wBAAwB;AAAA,IAC/C,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,iCAAiC,SAAS,+CAA+C;AAAA,IACzF,eAAe,SAAS,0BAA0B;AAAA,IAClD,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,eAAe,SAAS,yBAAyB;AAAA,IACjD,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,WAAW,SAAS,sBAAsB;AAAA,IAC1C,aAAa,SAAS,uBAAuB;AAAA,IAC7C,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,eAAe,SAAS,0BAA0B;AAAA,IAClD,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,cAAc,SAAS,yBAAyB;AAAA,IAChD,aAAa,SAAS,uBAAuB;AAAA,IAC7C,cAAc,SAAS,wBAAwB;AAAA,IAC/C,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,gCAAgC,SAAS,8CAA8C;AAAA,IACvF,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,WAAW,SAAS,qBAAqB;AAAA,IACzC,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,aAAa,SAAS,uBAAuB;AAAA,IAC7C,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,cAAc,SAAS,yBAAyB;AAAA,IAChD,eAAe,SAAS,yBAAyB;AAAA,IACjD,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,6BAA6B,SAAS,iCAAiC;AAAA,IACvE,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,kCAAkC,SAAS,+CAA+C;AAAA,IAC1F,kCAAkC,SAAS,+CAA+C;AAAA,IAC1F,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,gCAAgC,SAAS,6CAA6C;AAAA,IACtF,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,4BAA4B,SAAS,yCAAyC;AAAA,IAC9E,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,oBAAoB,SAAS,gCAAgC;AAAA,IAC7D,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,oCAAoC;AAAA,MAClC;AAAA,IACF;AAAA,IACA,mCAAmC,SAAS,iDAAiD;AAAA,IAC7F,4BAA4B,SAAS,uCAAuC;AAAA,IAC5E,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,oCAAoC,SAAS,iDAAiD;AAAA,IAC9F,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,iCAAiC,SAAS,8CAA8C;AAAA,IACxF,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,gBAAgB,SAAS,0BAA0B;AAAA,IACnD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,eAAe,SAAS,0BAA0B;AAAA,IAClD,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,aAAa,SAAS,wBAAwB;AAAA,IAC9C,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,eAAe,SAAS,0BAA0B;AAAA,IAClD,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,cAAc,SAAS,yBAAyB;AAAA,IAChD,WAAW,SAAS,qBAAqB;AAAA,IACzC,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,YAAY,gBAAgB,SAAS,sBAAsB,CAAC;AAAA,EAC9D;AACA,QAAM,SAAS,eAAe,MAAM,GAAG;AACvC,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH,oBACE,IAAI,uBAAuB,SACvB,KAAK,IAAI,KAAS,KAAK,MAAO,OAAO,sBAAsB,MAAQ,CAAC,CAAC,IACrE,OAAO;AAAA,IACb,uBACE,IAAI,0BAA0B,SAC1B,KAAK,IAAI,MAAW,KAAK,MAAO,OAAO,sBAAsB,MAAQ,CAAC,CAAC,IACvE,OAAO;AAAA,IACb,YAAY,wBAAwB,MAAM;AAAA,EAC5C;AACA,mBAAiB,QAAQ;AACzB,SAAO;AACT;AAEA,IAAM,sCAAsC;AAQrC,SAAS,kCAAkC,UAAwC;AACxF,QAAM,WAAW,SAAS,kBAAkB,KAAK;AACjD,MAAI,SAAU,QAAO;AACrB,SAAO,SAAS,sBAAsB,YACnC,SAAS,gBAAgB,WAAW,SAAS,gBAAgB,UAC5D,sCACA;AACN;AAaO,SAAS,iCAAiC,UAA4B;AAC3E,SAAO,SAAS,2BAA2B,SAAS;AACtD;AAUO,SAAS,+BACd,UACQ;AACR,SAAO,KAAK;AAAA,IACV,KAAK;AAAA,IACL,KAAK,IAAI,SAAS,2BAA2B,KAAQ,SAAS,2BAA2B,CAAC;AAAA,EAC5F;AACF;AAEO,SAAS,0BACd,UACA,SAA4B,QAAQ,KACZ;AACxB,QAAM,MAA8B,CAAC;AACrC,aAAW,QAAQ,gCAAgC,QAAQ,GAAG;AAC5D,UAAM,QAAQ,OAAO,IAAI;AACzB,QAAI,OAAO;AACT,UAAI,IAAI,IAAI;AAAA,IACd;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,sBACd,UACA,SAA4B,QAAQ,KAChB;AACpB,MAAI,SAAS,QAAQ;AACnB,WAAO,SAAS;AAAA,EAClB;AACA,MAAI,SAAS,WAAW;AACtB,UAAM,QAAQ,OAAO,SAAS,SAAS;AACvC,WAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AAAA,EACpD;AACA,SAAO;AACT;AAEA,IAAM,kBAAkB;AACxB,IAAM,6BAA6B,oBAAI,IAAI;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,yBAAyB,IAAI;AAAA,EACjC,gBAAgB,QAAQ,IAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,KAAK,CAAC;AAChE;AACA,IAAM,iBAAiB,IAAI,IAAI,CAAC,QAAQ,SAAS,OAAO,EAAE,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AAC/F,IAAM,qBAAqB,IAAI;AAAA,EAC7B,CAAC,YAAY,YAAY,MAAM,EAAE,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,KAAK,CAAC;AACvE;AAEA,SAAS,yBAAyB,OAAe,YAA4B;AAC3E,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,UAAM,IAAI,MAAM,YAAY,UAAU,oCAAoC;AAAA,EAC5E;AACA,MAAI,IAAI,QAAQ;AACd,UAAM,IAAI;AAAA,MACR,YAAY,UAAU;AAAA,IACxB;AAAA,EACF;AACA,MAAI,IAAI,MAAM;AACZ,UAAM,IAAI,MAAM,YAAY,UAAU,sCAAsC;AAAA,EAC9E;AACA,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,6BAA6B,MAAuB;AAC3D,SAAO,KACJ,YAAY,EACZ,MAAM,QAAQ,EACd,KAAK,CAAC,SAAS,2BAA2B,IAAI,IAAI,CAAC;AACxD;AAEA,SAAS,mBACP,YACA,SACoC;AACpC,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,QAAM,aAAqC,CAAC;AAC5C,QAAM,kBAAkB,oBAAI,IAAoB;AAChD,aAAW,CAAC,SAAS,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AACtD,QAAI,CAAC,gBAAgB,KAAK,OAAO,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,oDAAoD,KAAK,UAAU,OAAO,CAAC;AAAA,MACnG;AAAA,IACF;AACA,UAAM,OAAO,QAAQ,YAAY;AACjC,UAAM,WAAW,gBAAgB,IAAI,IAAI;AACzC,QAAI,aAAa,QAAW;AAC1B,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,yBAAyB,KAAK,UAAU,QAAQ,CAAC,QAAQ,KAAK,UAAU,OAAO,CAAC;AAAA,MACxG;AAAA,IACF;AACA,QAAI,SAAS,iBAAiB;AAC5B,YAAM,IAAI;AAAA,QACR,YAAY,UAAU;AAAA,MACxB;AAAA,IACF;AACA,oBAAgB,IAAI,MAAM,OAAO;AACjC,eAAW,IAAI,IAAI;AAAA,EACrB;AACA,SAAO;AACT;AAEA,SAAS,2BACP,YACA,OACA,SACsB;AACtB,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,aAAuB,CAAC;AAC9B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,WAAW,OAAO;AAC3B,QAAI,CAAC,gBAAgB,KAAK,OAAO,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,8DAA8D,KAAK,UAAU,OAAO,CAAC;AAAA,MAC7G;AAAA,IACF;AACA,UAAM,OAAO,QAAQ,YAAY;AACjC,QAAI,KAAK,IAAI,IAAI,GAAG;AAClB,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,gEAAgE,KAAK,UAAU,IAAI,CAAC;AAAA,MAC5G;AAAA,IACF;AACA,QAAI,EAAE,SAAS,WAAW,CAAC,KAAK;AAC9B,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,kEAAkE,KAAK,UAAU,IAAI,CAAC;AAAA,MAC9G;AAAA,IACF;AACA,QAAI,6BAA6B,IAAI,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,kEAAkE,KAAK,UAAU,IAAI,CAAC;AAAA,MAC9G;AAAA,IACF;AACA,SAAK,IAAI,IAAI;AACb,eAAW,KAAK,IAAI;AAAA,EACtB;AACA,SAAO;AACT;AAEA,SAAS,kBACP,YACA,OACoC;AACpC,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,aAAW,QAAQ,OAAO,KAAK,KAAK,GAAG;AACrC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,YAAY,UAAU,sCAAsC;AAAA,IAC9E;AAAA,EACF;AACA,SAAO,EAAE,GAAG,MAAM;AACpB;AAEA,SAAS,0BACP,YACA,OACA,OACsB;AACtB,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,IAAI,IAAI,GAAG;AAClB,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,oDAAoD,KAAK,UAAU,IAAI,CAAC;AAAA,MAChG;AAAA,IACF;AACA,QAAI,EAAE,SAAS,SAAS,CAAC,KAAK;AAC5B,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,+DAA+D,KAAK,UAAU,IAAI,CAAC;AAAA,MAC3G;AAAA,IACF;AACA,QAAI,6BAA6B,IAAI,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,iEAAiE,KAAK,UAAU,IAAI,CAAC;AAAA,MAC7G;AAAA,IACF;AACA,SAAK,IAAI,IAAI;AAAA,EACf;AACA,SAAO,CAAC,GAAG,KAAK;AAClB;AAEA,SAAS,0BAA0B,UAA8C;AAC/E,QAAM,iBAAiB,mBAAmB,SAAS,IAAI,SAAS,cAAc;AAC9E,QAAM,eAAe,kBAAkB,SAAS,IAAI,SAAS,YAAY;AACzE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,yBAAyB,SAAS,SAAS,SAAS,EAAE;AAAA,IAC/D,GAAI,mBAAmB,SAAY,CAAC,IAAI,EAAE,eAAe;AAAA,IACzD,GAAI,iBAAiB,SAAY,CAAC,IAAI,EAAE,aAAa;AAAA,IACrD,GAAI,SAAS,6BAA6B,SACtC,CAAC,IACD;AAAA,MACE,0BAA0B;AAAA,QACxB,SAAS;AAAA,QACT,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,IACJ,GAAI,SAAS,4BAA4B,SACrC,CAAC,IACD;AAAA,MACE,yBAAyB;AAAA,QACvB,SAAS;AAAA,QACT,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACN;AACF;AAEA,SAAS,8BACP,SACwB;AACxB,SAAO,aAAa,UAAU,UAAU,EAAE,SAAS,QAAQ;AAC7D;AAEA,SAAS,sBAAsB,cAAwD;AACrF,QAAM,SAAS,0BAA0B,MAAM,YAAY;AAC3D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW;AAAA,MACT,GAAG,OAAO;AAAA,MACV,SAAS,CAAC,GAAG,OAAO,UAAU,OAAO,EAAE;AAAA,QACrC,CAAC,MAAM,WACJ,uBAAuB,IAAI,IAAI,KAAK,MAAM,uBAAuB,IAAI,KAAK,KAAK;AAAA,MACpF;AAAA,IACF;AAAA,IACA,iBAAiB,CAAC,GAAG,OAAO,eAAe,EAAE;AAAA,MAC3C,CAAC,MAAM,WAAW,eAAe,IAAI,IAAI,KAAK,MAAM,eAAe,IAAI,KAAK,KAAK;AAAA,IACnF;AAAA,IACA,qBAAqB,CAAC,GAAG,IAAI,IAAI,OAAO,mBAAmB,CAAC,EAAE,KAAK;AAAA,IACnE,kBAAkB,CAAC,GAAG,OAAO,gBAAgB,EAAE;AAAA,MAC7C,CAAC,MAAM,WAAW,eAAe,IAAI,IAAI,KAAK,MAAM,eAAe,IAAI,KAAK,KAAK;AAAA,IACnF;AAAA,IACA,cAAc,CAAC,GAAG,OAAO,YAAY,EAAE;AAAA,MACrC,CAAC,MAAM,WACJ,mBAAmB,IAAI,KAAK,EAAE,KAAK,MAAM,mBAAmB,IAAI,MAAM,EAAE,KAAK;AAAA,IAClF;AAAA,EACF;AACF;AAEA,SAAS,wBACP,UACA,OACqB;AACrB,QAAM,mBAAmB,MAAM,kBAAkB,kCAAkC,QAAQ,IAAI,CAAC;AAChG,SAAO,sBAAsB;AAAA,IAC3B,WAAW;AAAA,MACT,UAAU,MAAM,kBAAkB,cAAc;AAAA,MAChD,UAAU,MAAM;AAAA,MAChB,SAAS;AAAA,MACT,eAAe,MAAM,kBAAkB,SAAS,wBAAwB;AAAA,MACxE,UAAU;AAAA,IACZ;AAAA,IACA,iBAAiB,EAAE,UAAU,WAAW,UAAU,KAAK;AAAA,IACvD,kBAAkB,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,IACzD,aAAa;AAAA,MACX,WAAW;AAAA,QACT,UAAU,MAAM,kBAAkB,cAAc;AAAA,QAChD,UAAU,MAAM;AAAA,MAClB;AAAA,MACA,SAAS,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MAChD,eAAe,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,IACxD;AAAA,IACA,iBAAiB,MAAM,SAAS,CAAC,QAAQ,OAAO,IAAI,CAAC,MAAM;AAAA,IAC3D,qBAAqB;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,kBAAkB,CAAC,MAAM;AAAA,IACzB,YAAY;AAAA,MACV,KAAK,EAAE,UAAU,WAAW,UAAU,KAAK;AAAA,MAC3C,oBAAoB,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MAC3D,eAAe,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,IACxD;AAAA,IACA,cAAc,CAAC,EAAE,IAAI,YAAY,UAAU,WAAW,UAAU,KAAK,CAAC;AAAA,EACxE,CAAC;AACH;AAEO,SAAS,qCACd,iBACkC;AAClC,QAAM,QAAQ,OAAO,OAAO,uBAAuB,EAAE;AAAA,IACnD,CAAC,cAAc,UAAU,oBAAoB;AAAA,EAC/C;AACA,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,SAAS;AAAA,MACP,MAAM,CAAC,GAAG,MAAM,SAAS;AAAA,MACzB,SAAS,MAAM,kBAAkB,SAAS;AAAA,IAC5C;AAAA,EACF;AACF;AAEA,SAAS,yBACP,UACA,OACqB;AACrB,QAAM,SAAS,wBAAwB,UAAU;AAAA,IAC/C,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,EACnB,CAAC;AACD,SAAO,sBAAsB;AAAA,IAC3B,GAAG;AAAA,IACH,iBAAiB,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,IACzD,iBAAiB,MAAM,SAAS,CAAC,QAAQ,OAAO,IAAI,CAAC,MAAM;AAAA,IAC3D,qBAAqB,MAAM,uBAAuB,CAAC;AAAA,IACnD,YAAY;AAAA,MACV,GAAG,OAAO;AAAA,MACV,KAAK,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,IAC/C;AAAA,IACA,eAAe,MAAM,kBACjB,EAAE,UAAU,aAAa,UAAU,MAAM,MAAM,WAAW,IAC1D,EAAE,UAAU,eAAe,UAAU,OAAO,MAAM,OAAO;AAAA;AAAA;AAAA,IAG7D,cAAc,CAAC,EAAE,IAAI,YAAY,UAAU,aAAa,UAAU,KAAK,CAAC;AAAA,EAC1E,CAAC;AACH;AAEA,SAAS,wBACP,UACA,OAGkB;AAClB,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,SAAS,CAAC,wBAAwB,UAAU,wBAAwB,IAAI,EAAE,IAAI,CAAC,UAAU;AAC7F,UAAM,OAAO,UAAU,wBAAwB;AAC/C,WAAO;AAAA,MACL,IAAI,YAAY,MAAM,qBAAqB,MAAM;AAAA,MACjD,iBAAiB,MAAM;AAAA,MACvB,OAAO,MAAM;AAAA,MACb,YAAY,MAAM;AAAA,MAClB,cAAc,yBAAyB,UAAU;AAAA,QAC/C,iBAAiB,MAAM;AAAA,QACvB,QAAQ;AAAA,QACR,qBAAqB,OAAO,CAAC,iBAAiB,IAAI,CAAC;AAAA,MACrD,CAAC;AAAA,MACD,qBAAqB;AAAA,MACrB,8BAA8B;AAAA,MAC9B,uBAAuB;AAAA,MACvB,4BAA4B,SAAS;AAAA,IACvC;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,IAAI,YAAY,gCAAgC;AAAA,IAChD,OAAO,YAAY,iBAAiB;AAAA;AAAA;AAAA;AAAA,IAIpC,KAAK;AAAA,IACL,SAAS;AAAA,IACT,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC/C;AAAA,EACF;AACF;AAEA,SAAS,4BAA4B,UAAwC;AAC3E,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,MAAI,CAAC,SAAS,uBAAuB;AACnC,WAAO;AAAA,EACT;AACA,MAAI,UAAU,KAAK,CAAC,aAAa,SAAS,OAAO,4BAA4B,GAAG;AAC9E,UAAM,IAAI;AAAA,MACR,GAAG,4BAA4B;AAAA,IACjC;AAAA,EACF;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,wBAAwB,UAAU;AAAA,MAChC,MAAM;AAAA,MACN,QAAQ,SAAS;AAAA,IACnB,CAAC;AAAA,EACH;AACF;AAGO,SAAS,oCAAoC,UAA8B;AAChF,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,MAAI,UAAU,KAAK,CAAC,aAAa,SAAS,OAAO,6BAA6B,GAAG;AAC/E,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB,KAAK,UAAU;AAAA,MACjC,GAAG;AAAA,MACH,wBAAwB,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAAA,IACxE,CAAC;AAAA,EACH;AACF;AAGO,SAAS,+BAA+B,UAAoB,QAA0B;AAC3F,MAAI,CAAC,OAAO,KAAK,GAAG;AAClB,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,QAAM,kBAAkB,oCAAoC,QAAQ;AACpE,QAAM,YAAY,wBAAwB,gBAAgB,kBAAkB,EAAE;AAAA,IAAI,CAAC,aACjF,SAAS,OAAO,gCAAgC,EAAE,GAAG,UAAU,OAAO,IAAI;AAAA,EAC5E;AACA,SAAO,EAAE,GAAG,iBAAiB,oBAAoB,KAAK,UAAU,SAAS,EAAE;AAC7E;AAGA,IAAM,oCAAoC;AAOnC,SAAS,uBAAuB,SAAyB;AAC9D,QAAM,OAAO,QAAQ,WAAW,qBAAqB,IACjD,QAAQ,MAAM,sBAAsB,MAAM,IAC1C;AACJ,QAAM,QAAQ,mCAAmC,KAAK,IAAI;AAC1D,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,SAAS,MAAM,CAAC,EAAG,QAAQ,SAAS,KAAK;AAC/C,QAAM,OAAO,MAAM,CAAC;AACpB,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KACZ,MAAM,GAAG,EACT,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,EAChC,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,YAAY,IAAI,KAAK,MAAM,CAAC,EAAE,YAAY,CAAC,EACxE,KAAK,GAAG;AACX,SAAO,OAAO,SAAS,IAAI,GAAG,MAAM,IAAI,MAAM,KAAK;AACrD;AAMO,SAAS,4BAA4B,SAAgC;AAC1E,QAAM,OAAO,QAAQ,WAAW,qBAAqB,IACjD,QAAQ,MAAM,sBAAsB,MAAM,IAC1C;AACJ,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,4BAA4B,SAKlC;AACD,MACE,YAAY,iBACZ,YAAY,mBACZ,YAAY,kBACZ,QAAQ,WAAW,gBAAgB,GACnC;AACA,WAAO;AAAA,MACL,EAAE,IAAI,YAAY,UAAU,aAAa,UAAU,KAAK;AAAA,MACxD;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,UAAU;AAAA,QACV,sBAAsB;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AACA,SAAO,CAAC,EAAE,IAAI,YAAY,UAAU,WAAW,UAAU,KAAK,CAAC;AACjE;AAEA,SAAS,6BACP,SAC+D;AAC/D,QAAM,OAAO,QAAQ,WAAW,qBAAqB,IACjD,QAAQ,MAAM,sBAAsB,MAAM,IAC1C;AACJ,SAAO,KAAK,WAAW,UAAU,IAC7B,EAAE,UAAU,aAAa,UAAU,MAAM,MAAM,WAAW,IAC1D;AACN;AAOO,SAAS,0BACd,YACA,aACiC;AACjC,MAAI,gBAAgB,YAAY;AAC9B,WAAO;AAAA,EACT;AACA,MAAI,eAAe,WAAW,eAAe,mBAAmB;AAC9D,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,6BACd,WACA,qBACS;AACT,MAAI,cAAc,YAAY;AAC5B,WAAO;AAAA,EACT;AACA,SAAO,wBAAwB,cAAc,wBAAwB;AACvE;AAEO,SAAS,6BAA6B,UAAoB,SAAgC;AAC/F,QAAM,WAAW;AAAA,IACf,+BAA+B,UAAU,OAAO;AAAA,IAChD,8BAA8B,UAAU,OAAO;AAAA,EACjD;AACA,MAAI,CAAC,UAAU;AACb,WAAO,CAAC,UAAU;AAAA,EACpB;AACA,SAAO,SAAS,MAAM,aAAa,aAChC,OAAO,CAAC,SAAS,KAAK,QAAQ,EAC9B,IAAI,CAAC,SAAS,YAAY,MAAM,KAAK,EAAE,CAAC;AAC7C;AAEA,SAAS,0BACP,UACA,SACA,aACM;AACN,QAAM,WAAW,6BAA6B,UAAU,OAAO;AAC/D,MAAI,CAAC,SAAS,SAAS,WAAW,GAAG;AACnC,UAAM,IAAI;AAAA,MACR,gBAAgB,WAAW,8BAA8B,OAAO,cAAc,SAAS,KAAK,IAAI,CAAC;AAAA,IACnG;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,UAAgD;AAChF,MAAI,SAAS,SAAS,sBAAsB;AAC1C,WAAO,EAAE,MAAM,0BAA0B,UAAU,QAAQ;AAAA,EAC7D;AACA,MAAI,SAAS,SAAS,4BAA4B;AAChD,WAAO,EAAE,MAAM,wBAAwB,WAAW,UAAU;AAAA,EAC9D;AACA,SAAO,EAAE,MAAM,cAAc,WAAW,UAAU;AACpD;AAEA,SAAS,gBAAgB,UAAkD;AACzE,MAAI,SAAS,SAAS,sBAAsB;AAC1C,WAAO,EAAE,eAAe,0BAA0B,UAAU,WAAW;AAAA,EACzE;AACA,MAAI,SAAS,SAAS,4BAA4B;AAChD,WAAO,EAAE,eAAe,aAAa,UAAU,WAAW;AAAA,EAC5D;AACA,SAAO,EAAE,eAAe,cAAc,UAAU,mBAAmB;AACrE;AAEA,SAAS,wBAAwB,UAAwC;AACvE,MAAI,SAAS,mBAAmB,WAAW,CAAC,SAAS,mBAAmB;AACtE,WAAO,EAAE,MAAM,cAAc,WAAW,kBAAkB;AAAA,EAC5D;AACA,SAAO,EAAE,MAAM,cAAc,WAAW,UAAU;AACpD;AAEA,SAAS,+BAA+B,UAWtC;AACA,QAAM,gBAAgB,IAAI,IAAI,SAAS,4BAA4B,CAAC,CAAC;AACrE,QAAM,cAAc,IAAI,IAAI,SAAS,2BAA2B,CAAC,CAAC;AAClE,SAAO;AAAA,IACL,SAAS,OAAO,QAAQ,SAAS,kBAAkB,CAAC,CAAC,EAClD,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD;AAAA,MAAI,CAAC,CAAC,MAAM,KAAK,MAChB,cAAc,IAAI,IAAI,IAClB,EAAE,MAAM,gBAAgB,UAAmB,MAAM,IACjD,EAAE,MAAM,gBAAgB,SAAkB;AAAA,IAChD;AAAA,IACF,OAAO,OAAO,QAAQ,SAAS,gBAAgB,CAAC,CAAC,EAC9C,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD;AAAA,MAAI,CAAC,CAAC,MAAM,KAAK,MAChB,YAAY,IAAI,IAAI,IAChB,EAAE,MAAM,gBAAgB,UAAmB,MAAM,IACjD,EAAE,MAAM,gBAAgB,SAAkB;AAAA,IAChD;AAAA,EACJ;AACF;AAEA,SAAS,cAAc,OAAwB;AAC7C,QAAM,YAAY,CAAC,UAA4B;AAC7C,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,aAAO,MAAM,IAAI,CAAC,UAAU,UAAU,KAAK,CAAC;AAAA,IAC9C;AACA,QAAI,SAAS,OAAO,UAAU,UAAU;AACtC,YAAM,MAA+B,CAAC;AACtC,iBAAW,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK,GAAG;AAC3C,cAAM,QAAS,MAAkC,GAAG;AACpD,YAAI,UAAU,QAAW;AACvB,cAAI,GAAG,IAAI,UAAU,KAAK;AAAA,QAC5B;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,UAAU,UAAU,KAAK,CAAC;AACxC;AAEA,SAAS,qBACP,OACA,UACQ;AACR,QAAM,kBAAkB,+BAA+B,QAAQ;AAC/D,QAAM,cAAc,cAAc;AAAA,IAChC,eAAe,MAAM;AAAA,IACrB,IAAI,MAAM;AAAA,IACV,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM;AAAA,IAClB,UAAU;AAAA,MACR,aAAa,SAAS;AAAA,MACtB,SAAS,SAAS;AAAA,MAClB,SAAS,SAAS,WAAW;AAAA,MAC7B,gBAAgB,gBAAgB;AAAA,MAChC,cAAc,gBAAgB;AAAA,IAChC;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB,SAAS,MAAM;AAAA,IACf,iBAAiB,MAAM;AAAA,IACvB,cAAc,MAAM;AAAA,IACpB,GAAI,MAAM,gBAAgB,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,IACpE,SAAS,MAAM,WAAW;AAAA,EAC5B,CAAC;AACD,SAAO,UAAU,WAAW,QAAQ,EACjC,OAAO,kCAAkC,MAAM,EAC/C,OAAO,aAAa,MAAM,EAC1B,OAAO,KAAK,CAAC;AAClB;AASO,SAAS,kBAAkB,UAAoD;AACpF,SAAO,SAAS,mBAAmB,UAAU,UAAU;AACzD;AAEA,SAAS,qBAAqB,UAAoD;AAChF,SAAO,SAAS,mBAAmB,UAAU,iBAAiB;AAChE;AAUO,SAAS,oBAAoB,UAA6C;AAC/E,QAAM,mBAAmB,wBAAwB,QAAQ;AACzD,QAAM,UAAiC;AAAA,IACrC,IAAI,kBAAkB,QAAQ;AAAA,IAC9B,OAAO,qBAAqB,QAAQ;AAAA,IACpC,MAAM;AAAA,IACN,KAAK;AAAA,IACL,SAAS;AAAA,IACT;AAAA,IACA,SAAS,EAAE,eAAe,cAAc,UAAU,mBAAmB;AAAA,EACvE;AACA,MAAI,SAAS,mBAAmB,SAAS;AACvC,UAAM,UAAU,SAAS,sBAAsB,SAAS;AACxD,YAAQ,UAAU,UAAU,yBAAyB,SAAS,QAAQ,EAAE,IAAI;AAC5E,YAAQ,SAAS,SAAS,qBAAqB,SAAS;AAAA,EAC1D,OAAO;AACL,YAAQ,UAAU,SAAS,gBACvB,yBAAyB,SAAS,eAAe,QAAQ,EAAE,IAC3D;AACJ,YAAQ,SAAS,SAAS;AAAA,EAC5B;AACA,QAAM,WAAW,4BAA4B,QAAQ,EAAE;AAAA,IACrD,CAAC,cAAqC;AAAA,MACpC,IAAI,SAAS;AAAA,MACb,OAAO,SAAS,SAAS,SAAS;AAAA,MAClC,MAAM,SAAS;AAAA,MACf,KAAK,SAAS;AAAA,MACd,SAAS;AAAA,MACT,SAAS,SAAS;AAAA,MAClB,QAAQ,sBAAsB,QAAQ;AAAA,MACtC,cAAc,SAAS;AAAA,MACvB,gBAAgB,SAAS;AAAA,MACzB,yBAAyB,SAAS;AAAA,MAClC,0BAA0B,SAAS;AAAA,MACnC,kBAAkB,yBAAyB,QAAQ;AAAA,MACnD,SAAS,gBAAgB,QAAQ;AAAA,IACnC;AAAA,EACF;AACA,SAAO,CAAC,SAAS,GAAG,QAAQ;AAC9B;AAQO,SAAS,yBAAyB,UAA8B;AACrE,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,MAAI,UAAU,KAAK,CAACA,cAAaA,UAAS,OAAO,iBAAiB,GAAG;AACnE,WAAO;AAAA,EACT;AACA,QAAM,WAA6B;AAAA,IACjC,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,KAAK;AAAA,IACL,SAAS;AAAA,IACT,QAAQ,2BAA2B,IAAI,CAAC,SAAS;AAC/C,YAAM,eAAe;AAAA,QACnB,GAAG,wBAAwB,UAAU;AAAA,UACnC,iBAAiB;AAAA,UACjB,iBAAiB;AAAA,UACjB,QAAQ,KAAK,WAAW,UAAU;AAAA,QACpC,CAAC;AAAA,QACD,GAAI,6BAA6B,GAAG,qBAAqB,GAAG,IAAI,EAAE,IAC9D;AAAA,UACE,eAAe,6BAA6B,GAAG,qBAAqB,GAAG,IAAI,EAAE;AAAA,QAC/E,IACA,CAAC;AAAA,QACL,cAAc,4BAA4B,GAAG,qBAAqB,GAAG,IAAI,EAAE;AAAA,MAC7E;AACA,aAAO;AAAA,QACL,IAAI,GAAG,qBAAqB,GAAG,IAAI;AAAA,QACnC,iBAAiB;AAAA,QACjB,OAAO,uBAAuB,IAAI;AAAA,QAClC,GAAI,4BAA4B,IAAI,IAChC,EAAE,YAAY,4BAA4B,IAAI,EAAG,IACjD,CAAC;AAAA,QACL,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA,QAKjB,iBAAiB;AAAA,QACjB;AAAA,QACA,qBAAqB;AAAA,QACrB,8BAA8B;AAAA,QAC9B,uBAAuB;AAAA,QACvB,4BAA4B;AAAA,MAC9B;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB,KAAK,UAAU,CAAC,GAAG,WAAW,QAAQ,CAAC;AAAA,EAC7D;AACF;AAeO,SAAS,yBAAyB,UAAoB,SAAyB;AACpF,QAAM,mBAAmB,8BAA8B,UAAU,OAAO;AACxE,MAAI,iBAAiB,WAAW,qBAAqB,GAAG;AACtD,WAAO;AAAA,EACT;AACA,MAAI,iBAAiB,WAAW,iCAAiC,GAAG;AAClE,WAAO;AAAA,EACT;AACA,QAAM,aAAa,iBAAiB,QAAQ,EAAE,KAAK,CAAC,UAAU,MAAM,OAAO,gBAAgB;AAC3F,SAAO,YAAY,cAAc,kBAAkB,QAAQ;AAC7D;AAEA,SAAS,wBACP,UACA,OAMwB;AACxB,SAAO;AAAA,IACL,qBAAqB,MAAM,uBAAuB,SAAS;AAAA,IAC3D,8BACE,MAAM,gCAAgC,SAAS,gCAAgC;AAAA,IACjF,uBACE,MAAM,yBAAyB,SAAS,qCAAqC;AAAA,IAC/E,4BACE,MAAM,8BAA8B,SAAS,mCAAmC;AAAA,EACpF;AACF;AAEA,SAAS,wBACP,UACA,UACA,OACiB;AACjB,QAAM,gBACJ,SAAS,SAAS,4BAA4B,SAAS,SAAS,6BAC5D,qCAAqC,MAAM,eAAe,IAC1D;AACN,QAAM,sBAAkE;AAAA,IACtE,eAAe;AAAA,IACf,GAAG;AAAA,IACH,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA,IACzC,iBAAiB,wBAAwB,UAAU,KAAK;AAAA,EAC1D;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,mBAAmB,qBAAqB,qBAAqB,QAAQ;AAAA,EACvE;AACF;AAEA,SAAS,4BAA4B,QAAiC;AACpE,QAAM,kBAAkB,oBAAI,IAAoB;AAChD,aAAW,SAAS,QAAQ;AAC1B,UAAM,WAAW,gBAAgB,IAAI,MAAM,EAAE;AAC7C,QAAI,aAAa,QAAW;AAC1B,YAAM,IAAI;AAAA,QACR,0CAA0C,KAAK,UAAU,MAAM,EAAE,CAAC,wBAAwB,QAAQ,QAAQ,MAAM,UAAU;AAAA,MAC5H;AAAA,IACF;AACA,oBAAgB,IAAI,MAAM,IAAI,MAAM,UAAU;AAAA,EAChD;AAEA,QAAM,iBAAiB,IAAI,IAAI,eAAe;AAC9C,aAAW,SAAS,QAAQ;AAC1B,UAAM,aAAa,oBAAI,IAAY;AACnC,eAAW,SAAS,MAAM,SAAS;AACjC,UAAI,WAAW,IAAI,KAAK,GAAG;AACzB,cAAM,IAAI;AAAA,UACR,uCAAuC,KAAK,UAAU,MAAM,EAAE,CAAC,6BAA6B,KAAK,UAAU,KAAK,CAAC;AAAA,QACnH;AAAA,MACF;AACA,iBAAW,IAAI,KAAK;AACpB,YAAM,WAAW,eAAe,IAAI,KAAK;AACzC,UAAI,aAAa,QAAW;AAC1B,cAAM,IAAI;AAAA,UACR,uCAAuC,KAAK,UAAU,KAAK,CAAC,cAAc,KAAK,UAAU,MAAM,EAAE,CAAC,iCAAiC,QAAQ;AAAA,QAC7I;AAAA,MACF;AACA,qBAAe,IAAI,OAAO,MAAM,EAAE;AAAA,IACpC;AAAA,EACF;AACF;AAUO,SAAS,iBAAiB,UAAuC;AACtE,QAAM,YAAY,kBAAkB,QAAQ;AAC5C,QAAM,eAAe,qBAAqB,QAAQ;AAClD,QAAM,YAAY,oBAAoB,QAAQ;AAC9C,QAAM,eAAe,IAAI,IAAI,UAAU,IAAI,CAAC,aAAa,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;AACjF,QAAM,mBAAmB,gCAAgC,QAAQ;AAiBjE,QAAM,iBAAiB,4BAA4B,QAAQ;AAC3D,QAAM,mBAAmB,IAAI;AAAA,IAC3B,eAAe,QAAQ,CAAC,aAAa,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC;AAAA,EAC/E;AACA,QAAM,kBAAkB,IAAI;AAAA,IAC1B,eAAe,QAAQ,CAAC,aAAa,SAAS,OAAO,QAAQ,CAAC,UAAU,MAAM,WAAW,CAAC,CAAC,CAAC;AAAA,EAC9F;AACA,QAAM,uBAAuB,CAAC,OAC5B,GAAG,WAAW,qBAAqB,KACnC,gBAAgB,IAAI,EAAE,KACrB,GAAG,SAAS,GAAG,KAAK,iBAAiB,IAAI,EAAE;AAC9C,QAAM,kBAAkB,aAAa,IAAI,SAAS;AAClD,MAAI,CAAC,iBAAiB;AACpB,UAAM,IAAI,MAAM,2BAA2B,SAAS,oBAAoB;AAAA,EAC1E;AACA,QAAM,MAAyB,aAAa;AAAA,IAC1C,SAAS;AAAA,IACT,GAAG,SAAS,SAAS,mBAAmB;AAAA,EAC1C,CAAC,EACE,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,EACxC,IAAI,CAAC,OAAO;AACX,UAAM,eAAe;AAAA,MACnB,GAAG,wBAAwB,UAAU;AAAA,QACnC,iBAAiB;AAAA,QACjB,iBAAiB,SAAS;AAAA,QAC1B,QAAQ,GAAG,WAAW,UAAU;AAAA,MAClC,CAAC;AAAA,MACD,GAAI,6BAA6B,EAAE,IAC/B,EAAE,eAAe,6BAA6B,EAAE,EAAG,IACnD,CAAC;AAAA,MACL,cAAc,4BAA4B,EAAE;AAAA,IAC9C;AACA,WAAO,wBAAwB,UAAU,iBAAiB;AAAA,MACxD;AAAA,MACA,SAAS,CAAC;AAAA,MACV,OAAO,uBAAuB,EAAE;AAAA,MAChC,GAAI,4BAA4B,EAAE,IAC9B,EAAE,YAAY,4BAA4B,EAAE,EAAG,IAC/C,CAAC;AAAA,MACL,YAAY;AAAA,MACZ,eAAe;AAAA,MACf,KAAK;AAAA,MACL,iBAAiB;AAAA,MACjB,YAAY,EAAE,iBAAiB,IAAI,SAAS,YAAY;AAAA,MACxD,kBAAkB,gBAAgB;AAAA,MAClC,SAAS,gBAAgB;AAAA,MACzB;AAAA,MACA,GAAI,iBAAiB,EAAE,MAAM,SAAY,CAAC,IAAI,EAAE,SAAS,iBAAiB,EAAE,EAAE;AAAA,MAC9E,qBAAqB,SAAS;AAAA,MAC9B,4BAA4B,SAAS;AAAA,MACrC,iBAAiB,aAAa,UAAU;AAAA,MACxC,iBAAiB,aAAa,YAAY,UAAU;AAAA,IACtD,CAAC;AAAA,EACH,CAAC;AACH,aAAW,YAAY,gBAAgB;AACrC,UAAM,gBAAgB,SAAS,SAAS,SAAS;AACjD,UAAM,mBAAmB,aAAa,IAAI,SAAS,EAAE;AACrD,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,MAAM,2BAA2B,SAAS,EAAE,oBAAoB;AAAA,IAC5E;AACA,eAAW,SAAS,SAAS,QAAQ;AACnC,YAAM,eAAe,MAAM,eACvB,sBAAsB,MAAM,YAAY,IACxC,wBAAwB,UAAU;AAAA,QAChC,iBAAiB,MAAM,mBAAmB;AAAA,QAC1C,iBAAiB,MAAM,mBAAmB;AAAA,MAC5C,CAAC;AACL,YAAM,kBAAkB,MAAM,mBAAmB,MAAM;AACvD,UAAI;AAAA,QACF,wBAAwB,UAAU,kBAAkB;AAAA,UAClD,IAAI,MAAM;AAAA,UACV,SAAS,CAAC,GAAI,MAAM,WAAW,CAAC,CAAE;AAAA,UAClC,OAAO,MAAM,SAAS,uBAAuB,MAAM,EAAE;AAAA,UACrD,GAAI,MAAM,aACN,EAAE,YAAY,MAAM,WAAW,IAC/B,4BAA4B,MAAM,EAAE,IAClC,EAAE,YAAY,4BAA4B,MAAM,EAAE,EAAG,IACrD,CAAC;AAAA,UACP,YAAY,SAAS;AAAA,UACrB;AAAA,UACA,KAAK,SAAS;AAAA,UACd;AAAA,UACA,YAAY,EAAE,iBAAiB,SAAS,SAAS,IAAI;AAAA,UACrD,kBAAkB,iBAAiB;AAAA,UACnC,SAAS,iBAAiB;AAAA,UAC1B;AAAA,UACA,GAAI,iBAAiB,MAAM,EAAE,MAAM,SAC/B,CAAC,IACD,EAAE,SAAS,iBAAiB,MAAM,EAAE,EAAE;AAAA,UAC1C,GAAI,MAAM,wBAAwB,SAC9B,CAAC,IACD,EAAE,qBAAqB,MAAM,oBAAoB;AAAA,UACrD,GAAI,MAAM,iCAAiC,SACvC,CAAC,IACD;AAAA,YACE,8BAA8B,MAAM;AAAA,UACtC;AAAA,UACJ,GAAI,MAAM,0BAA0B,SAChC,CAAC,IACD,EAAE,uBAAuB,MAAM,sBAAsB;AAAA,UACzD,GAAI,MAAM,+BAA+B,SACrC,CAAC,IACD,EAAE,4BAA4B,MAAM,2BAA2B;AAAA,UACnE,iBAAiB,aAAa,UAAU;AAAA,UACxC,iBAAiB,aAAa,YAAY,UAAU;AAAA,QACtD,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,8BAA4B,GAAG;AAC/B,SAAO;AACT;AAGO,SAAS,8BAA8B,UAAoB,SAAyB;AACzF,QAAM,SAAS,iBAAiB,QAAQ;AACxC,QAAM,YAAY,OAAO,KAAK,CAAC,UAAU,MAAM,OAAO,OAAO;AAC7D,MAAI,WAAW;AACb,WAAO,UAAU;AAAA,EACnB;AACA,SAAO,OAAO,KAAK,CAAC,UAAU,MAAM,QAAQ,SAAS,OAAO,CAAC,GAAG,MAAM;AACxE;AASO,SAAS,wBAAwB,UAA8B;AACpE,SAAO,iBAAiB,QAAQ,EAAE,IAAI,CAAC,UAAU,MAAM,EAAE;AAC3D;AAQO,SAAS,qBACd,UACA,SACyE;AACzE,QAAM,mBAAmB,8BAA8B,UAAU,OAAO;AACxE,QAAM,QAAQ,iBAAiB,QAAQ,EAAE,KAAK,CAAC,cAAc,UAAU,OAAO,gBAAgB;AAC9F,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,WAAW,oBAAoB,QAAQ,EAAE;AAAA,IAC7C,CAAC,cAAc,UAAU,OAAO,MAAM;AAAA,EACxC;AACA,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AACA,SAAO,EAAE,UAAU,MAAM;AAC3B;AAcA,SAAS,+BAA+B,UAAoB,SAA2B;AACrF,MAAI,SAAS,4BAA4B,QAAQ,WAAW,qBAAqB,GAAG;AAClF,WAAO,yBAAyB,QAAQ;AAAA,EAC1C;AACA,MAAI,QAAQ,WAAW,iCAAiC,GAAG;AACzD,WAAO,oCAAoC,QAAQ;AAAA,EACrD;AACA,SAAO;AACT;AAOO,SAAS,6BACd,UACA,OACuB;AACvB,QAAM,kBAAkB,+BAA+B,UAAU,MAAM,OAAO;AAC9E,QAAM,iBAAiB,8BAA8B,iBAAiB,MAAM,OAAO;AACnF,QAAM,WAAW,qBAAqB,iBAAiB,cAAc;AACrE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,MACE,MAAM,qBAAqB,QAC3B,8BAA8B,iBAAiB,MAAM,gBAAgB,MAAM,gBAC3E;AACA,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,cAAc,YAAY,MAAM,MAAM,eAAe,UAAU;AACrE,QAAM,oBAAoB,MAAM,qBAAqB;AACrD,4BAA0B,iBAAiB,gBAAgB,WAAW;AACtE,SAAO,sBAAsB,MAAM;AAAA,IACjC,eAAe;AAAA,IACf;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB,aAAa,MAAM;AAAA,IACnB,iBAAiB,MAAM;AAAA,IACvB,iBAAiB,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,IACA,YAAY,SAAS,SAAS;AAAA,IAC9B,iBAAiB,SAAS,MAAM;AAAA,IAChC,SAAS,SAAS,MAAM;AAAA,IACxB,kBAAkB,SAAS,MAAM;AAAA,IACjC,SAAS,SAAS,MAAM;AAAA,IACxB,mBAAmB,SAAS,MAAM;AAAA,EACpC,CAAC;AACH;AAOO,SAAS,yCACd,UACA,QACA,UASA;AACA,QAAM,SAAS,sBAAsB,MAAM,MAAM;AACjD,QAAM,kBAAkB,+BAA+B,UAAU,OAAO,cAAc;AACtF,QAAM,yBAAyB,8BAA8B,iBAAiB,SAAS,OAAO;AAC9F,QAAM,sBAAsB,SAAS,eAAe,OAAO;AAC3D,MACE,OAAO,mBAAmB,0BAC1B,OAAO,oBAAoB,SAAS,mBACpC,OAAO,gBAAgB,qBACvB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,4BAA0B,iBAAiB,OAAO,gBAAgB,OAAO,WAAW;AACpF,MACE,OAAO,qBAAqB,QAC5B,8BAA8B,iBAAiB,OAAO,gBAAgB,MACpE,OAAO,gBACT;AACA,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,QAAM,WAAW,qBAAqB,iBAAiB,OAAO,cAAc;AAC5E,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,QAAM,aACJ,OAAO,eAAe,SAAS,SAAS,MACxC,OAAO,oBAAoB,SAAS,MAAM,mBAC1C,OAAO,YAAY,SAAS,MAAM,OAClC,OAAO,sBAAsB,SAAS,MAAM,qBAC5C,cAAc,OAAO,gBAAgB,MAAM,cAAc,SAAS,MAAM,gBAAgB,KACxF,cAAc,OAAO,OAAO,MAAM,cAAc,SAAS,MAAM,OAAO;AACxE,MAAI,YAAY;AACd,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,SAAO,EAAE,QAAQ,QAAQ,UAAU,SAAS,UAAU,OAAO,SAAS,MAAM;AAC9E;AASO,SAAS,gCACd,UACwC;AACxC,QAAM,WAAW,OAAO;AAAA,IACtB,OAAO,QAAQ,mBAAmB,EAAE,IAAI,CAAC,CAAC,OAAO,OAAO,MAAM;AAAA,MAC5D;AAAA,MACA,8BAA8B,OAAO;AAAA,IACvC,CAAC;AAAA,EACH;AACA,QAAM,WAAmD,CAAC;AAC1D,aAAW,YAAY,4BAA4B,QAAQ,GAAG;AAC5D,eAAW,SAAS,SAAS,QAAQ;AACnC,UAAI,MAAM,SAAS;AACjB,iBAAS,MAAM,EAAE,IAAI,8BAA8B,MAAM,OAAO;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,OAAO;AAAA,IACxB,OAAO,QAAQ,sBAAsB,SAAS,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,OAAO,MAAM;AAAA,MACzF;AAAA,MACA,EAAE,SAAS,QAAQ;AAAA,IACrB,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AACF;AAGO,SAAS,uBAAuB,UAAkD;AACvF,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,gCAAgC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,QAAQ,MAAM;AAAA,MACnF;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAGO,SAAS,mBACd,UACA,aACc;AACd,QAAM,wBAAwB,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,CAAC;AACjE,MAAI,WAAW,SAAS;AACxB,aAAW,QAAQ,SAAS,mBAAmB,CAAC,GAAG;AACjD,QAAI,wBAAwB,KAAK,oBAAoB;AACnD;AAAA,IACF;AACA,eAAW,KAAK;AAAA,EAClB;AACA,SAAO;AACT;AAMO,SAAS,yBACd,UAIQ;AACR,MAAI,SAAS,iCAAiC,QAAW;AACvD,WAAO,KAAK,IAAI,SAAS,qBAAqB,SAAS,4BAA4B;AAAA,EACrF;AACA,SAAO,KAAK,IAAI,GAAG,SAAS,sBAAsB,SAAS,2BAA2B;AACxF;AAOO,SAAS,iCACd,UACA,OAOU;AACV,QAAM,sBAAsB,MAAM,uBAAuB,SAAS;AAClE,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,GAAI,MAAM,iCAAiC,SACvC,CAAC,IACD;AAAA,MACE,8BAA8B,KAAK;AAAA,QACjC;AAAA,QACA,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACJ,GAAI,MAAM,0BAA0B,SAChC,CAAC,IACD,EAAE,mCAAmC,MAAM,sBAAsB;AAAA,IACrE,GAAI,MAAM,+BAA+B,SACrC,CAAC,IACD,EAAE,iCAAiC,MAAM,2BAA2B;AAAA,EAC1E;AACF;AAEO,SAAS,4BAA4B,UAA6C;AACvF,SAAO,2BAA2B,SAAS,qBAAqB;AAClE;AAEO,SAAS,uBAAuB,UAAwC;AAC7E,MAAI,SAAS,qBAAqB,QAAQ;AACxC,WAAO,CAAC;AAAA,EACV;AACA,QAAM,aAAa,4BAA4B,SAAS,sBAAsB;AAC9E,MAAI,SAAS,qBAAqB,UAAU;AAC1C,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,+BAA+B;AAAA,IAC/B,mCAAmC,SAAS,gBAAgB;AAAA,IAC5D,oBAAoB;AAAA,IACpB,sBAAsB;AAAA,IACtB,sBAAsB,QAAQ,SAAS,eAAe,SAAS,mBAAmB;AAAA,IAClF,GAAG;AAAA,EACL;AACF;AAEO,SAAS,8BACd,UACA,OACA,OACA,SACQ;AACR,QAAM,WAAW,gCAAgC,QAAQ,EAAE,KAAK;AAChE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,6BAA6B,KAAK,EAAE;AAAA,EACtD;AACA,QAAM,UACJ,MAAM,uBAAuB,MAAM,oBAAoB,SAAS,IAC5D,MAAM,sBACN,CAAC,KAAK;AACZ,QAAM,mBAAmB,oBAAI,IAA0B;AACvD,aAAW,SAAS,SAAS;AAC3B,UAAM,UAAU,mBAAmB,UAAU,YAAY,MAAM,WAAW,CAAC;AAC3E,qBAAiB;AAAA,MACf;AAAA,OACC,iBAAiB,IAAI,OAAO,KAAK,KAAK,yBAAyB,SAAS,KAAK;AAAA,IAChF;AAAA,EACF;AACA,MAAI,QAAQ;AACZ,aAAW,CAAC,SAAS,OAAO,KAAK,kBAAkB;AACjD,UAAM,YAAY,QAAQ,aAAa;AACvC,aAAS,KAAK,KAAM,WAAW,MAAS,aAAc,GAAM;AAAA,EAC9D;AACA,QAAM,cAAc,SAAS,eAAe;AAC5C,MAAI,gBAAgB,YAAY;AAC9B,UAAM,kBAAkB,+BAA+B,UAAU,KAAK;AACtE,UAAM,WAAW;AAAA,MACf;AAAA,MACA,8BAA8B,iBAAiB,KAAK;AAAA,IACtD;AACA,UAAM,gBAAgB,UAAU,MAAM,aAAa,aAAa;AAAA,MAC9D,CAAC,SAAS,KAAK,OAAO,eAAe,KAAK;AAAA,IAC5C,GAAG;AACH,QAAI,iBAAiB,gBAAgB,GAAG;AACtC,cAAQ,KAAK,KAAM,QAAQ,gBAAiB,GAAM;AAAA,IACpD;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,mCACd,UACA,OACA,kBACA,SACQ;AACR,QAAM,WAAW,gCAAgC,QAAQ,EAAE,KAAK;AAChE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,6BAA6B,KAAK,EAAE;AAAA,EACtD;AACA,QAAM,UAAU,mBAAmB,UAAU,YAAY,SAAS,WAAW,CAAC;AAC9E,QAAM,QAAQ,kCAAkC,KAAK,gBAAgB;AACrE,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AACA,QAAM,WAAW,MAAM,CAAC,KAAK;AAC7B,QAAM,gBAAgB,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,QAAQ,EAAE;AACrD,QAAM,eAAe,OAAO,OAAO,SAAS,MAAM;AAClD,QAAM,YAAY,OAAO,OAAU,QAAQ,aAAa,EAAE;AAC1D,QAAM,YAAY,gBAAgB,WAAa;AAC/C,QAAM,cAAc,eAAe;AACnC,QAAM,UAAU,YAAY,cAAc,MAAM;AAChD,MAAI,SAAS,OAAO,OAAO,gBAAgB,GAAG;AAC5C,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO,OAAO,MAAM;AACtB;AAEO,SAAS,kCACd,UACwC;AACxC,SAAO,aAAa;AAAA,IAClB,SAAS;AAAA,IACT,GAAG,SAAS,SAAS,6BAA6B;AAAA,EACpD,CAAC,EAAE,IAAI,CAAC,UAAU,gBAAgB,MAAM,KAAK,CAAC;AAChD;AAOO,SAAS,+BAA+B,UAAuC;AACpF,MAAI,CAAC,SAAS,2BAA2B;AACvC,WAAO;AAAA,EACT;AACA,QAAM,UAAU,OAAO,KAAK,SAAS,2BAA2B,QAAQ;AACxE,MAAI,QAAQ,WAAW,IAAI;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,IAAI,WAAW,OAAO;AAC/B;AAQO,SAAS,0BAA0B,UAA+C;AACvF,QAAM,SAAS,SAAS,gBAAgB,KAAK,KAAK;AAClD,QAAM,qBAAqB,SAAS,uBAAuB,KAAK,KAAK;AACrE,QAAM,SAAS;AAAA,IACb,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,oBAAoB;AAAA,IACxB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,mBAAmB;AAAA,IACvB,SAAS;AAAA,IACT;AAAA,EACF;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ,gBAAgB,GAAG;AAC5D,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,MAAmC,CAAC;AAC1C,MAAI,oBAAoB;AACtB,QAAI,qBAAqB;AAAA,EAC3B;AACA,MAAI,QAAQ;AACV,QAAI,0BAA0B;AAAA,EAChC;AACA,MAAI,qBAAqB,kBAAkB;AACzC,QAAI,iBAAiB,EAAE,KAAK,mBAAmB,KAAK,iBAAiB;AAAA,EACvE;AACA,QAAM,eAAe,OAAO,KAAK,GAAG,EAAE,SAAS;AAC/C,QAAM,aAAa,SAAS,sBAAsB,QAAQ,MAAM,KAAK;AAErE,SAAO;AAAA,IACL,SAAS,SAAS;AAAA,IAClB,GAAI,aAAa,EAAE,KAAK,eAAe,MAAM,KAAK,IAAI,CAAC;AAAA,IACvD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,EAC7B;AACF;AAEA,SAAS,0BACP,OACA,aACwB;AAIxB,QAAM,UAAU,OAAO,QAAQ,OAAO,EAAE;AACxC,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,MAAI,CAAC,yBAAyB,KAAK,OAAO,KAAK,QAAQ,SAAS,MAAM,GAAG;AACvE,UAAM,IAAI,MAAM,GAAG,WAAW,4BAA4B;AAAA,EAC5D;AACA,QAAM,UAAU,OAAO,KAAK,SAAS,QAAQ;AAC7C,QAAM,YAAY,QAAQ,SAAS,QAAQ,EAAE,QAAQ,OAAO,EAAE;AAC9D,MAAI,QAAQ,WAAW,KAAK,cAAc,QAAQ,QAAQ,OAAO,EAAE,GAAG;AACpE,UAAM,IAAI,MAAM,GAAG,WAAW,4BAA4B;AAAA,EAC5D;AACA,SAAO,IAAI,WAAW,OAAO;AAC/B;AAYO,SAAS,aAAa,UAA0D;AACrF,QAAM,SAAS,SAAS,UAAU,KAAK;AACvC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AACA,MAAI,CAAC,2BAA2B,KAAK,MAAM,GAAG;AAC5C,UAAM,IAAI,MAAM,0DAA0D,MAAM,EAAE;AAAA,EACpF;AACA,SAAO,GAAG,MAAM;AAClB;AAEO,SAAS,8BAA8B,UAA4C;AACxF,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ;AAAA,MACb,iBAAiB,SAAS;AAAA,MAC1B,kBAAkB,SAAS;AAAA,MAC3B,oBAAoB,SAAS,oBAAoB,SAAS;AAAA,MAC1D,qBAAqB,SAAS,qBAAqB,SAAS;AAAA,IAC9D,CAAC,EAAE;AAAA,MACD,CAAC,UACC,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS;AAAA,IAC7D;AAAA,EACF;AACF;AAEA,IAAM,uBAAuB;AAE7B,SAAS,iBAAiB,WAA+B,OAAuB;AAC9E,QAAM,SAAS,aAAa,sBAAsB,MAAM,GAAG,EAAE,OAAO,OAAO;AAC3E,SAAO,CAAC,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,SAAS,KAAK,CAAC,EAAE,KAAK,GAAG;AACpE;AAkCO,SAAS,+BACd,UACA,uBAA+C,CAAC,GAChD,UAAoC,CAAC,GACb;AACxB,QAAM,cAAsC;AAAA,IAC1C,GAAG,0BAA0B,QAAQ;AAAA,IACrC,GAAG,8BAA8B,QAAQ;AAAA,IACzC,GAAG;AAAA,EACL;AAKA,QAAM,aAAa,uBAAuB,SAAS,cAAc;AACjE,MACE,SAAS,mBAAmB,UAC5B,SAAS,mBAAmB,WAC5B,SAAS,mBAAmB,cAC5B;AACA,gBAAY,SAAS,WAAW;AAAA,EAClC;AAOA,QAAM,8BACJ,SAAS,mBAAmB,UAC5B,SAAS,mBAAmB,WAC5B,SAAS,mBAAmB;AAC9B,MAAI,6BAA6B;AAC/B,UAAM,OAAO,YAAY,QAAQ,WAAW;AAC5C,gBAAY,iCAAiC,GAAG,IAAI;AACpD,gBAAY,4BAA4B,GAAG,IAAI;AAC/C,gBAAY,iCAAiC,GAAG,IAAI;AACpD,gBAAY,OAAO,iBAAiB,YAAY,MAAM,YAAY,4BAA4B;AAAA,EAChG;AACA,MAAI,SAAS,oBAAoB,SAAS,mBAAmB,cAAc;AACzE,gBAAY,kCAAkC,GAAG,YAAY,QAAQ,WAAW,aAAa;AAC7F,QAAI,SAAS,mBAAmB;AAC9B,kBAAY,iCAAiC,SAAS;AAAA,IACxD;AACA,QAAI,QAAQ,aAAa;AACvB,kBAAY,2BAA2B;AAAA,QACrC;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,6BACd,WAQS;AACT,QAAM,WAAW,CAAC,UACf,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,KAAK,QAAQ,KAChE,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,KAAK,OAAO,KAAK,IAAI;AACvE,SAAO,UAAU;AAAA,IACf,CAAC,aACC,SAAS,SAAS,iBAChB,SAAS,SAAS,oBAAoB,KAAK,SAAS,SAAS,kBAAkB,KAC9E,SAAS,aAAa,YACrB,SAAS,SAAS,cAAc,KAChC,SAAS,SAAS,YAAY;AAAA,EACtC;AACF;AAEO,SAAS,oCACd,WAMS;AACT,SAAO,UAAU;AAAA,IACf,CAAC,aACC,SAAS,SAAS,iBACjB,SAAS,aAAa,YACrB,SAAS,aAAa,YACtB,SAAS,aAAa,kBACtB,6BAA6B,CAAC,QAAQ,CAAC;AAAA,EAC7C;AACF;AAmBO,SAAS,+BACd,aACA,UACwB;AACxB,cAAY,cAAc,GAAG,YAAY,QAAQ,YAAY;AAC7D,cAAY,sBAAsB;AAClC,MAAI,UAAU;AACZ,gBAAY,kBAAkB,YAAY,mBAAmB,SAAS;AACtE,gBAAY,mBAAmB,YAAY,oBAAoB,SAAS;AACxE,gBAAY,qBAAqB,YAAY,sBAAsB,SAAS;AAC5E,gBAAY,sBAAsB,YAAY,uBAAuB,SAAS;AAAA,EAChF;AACA,SAAO;AACT;AAeO,SAAS,oBACd,UACgD;AAChD,SAAO;AAAA,IACL,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,IACzB,YAAY,SAAS;AAAA,EACvB;AACF;AAEA,eAAsB,uBACpB,OACA,WACA,UAA+B,CAAC,GACpB;AACZ,QAAM,WAAW,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,YAAY,EAAE,CAAC;AAC/D,QAAM,iBAAiB,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,kBAAkB,GAAI,CAAC;AAC7E,QAAM,aAAa,KAAK,IAAI,gBAAgB,KAAK,MAAM,QAAQ,cAAc,GAAI,CAAC;AAClF,WAAS,UAAU,GAAG,WAAW,UAAU,WAAW,GAAG;AACvD,QAAI;AACF,aAAO,MAAM,UAAU;AAAA,IACzB,SAAS,OAAO;AACd,UAAI,WAAW,UAAU;AACvB,cAAM;AAAA,MACR;AACA,YAAM,UAAU,KAAK,IAAI,YAAY,iBAAiB,MAAM,UAAU,EAAE;AACxE,cAAQ,UAAU,EAAE,OAAO,SAAS,UAAU,SAAS,MAAM,CAAC;AAC9D,YAAM,MAAM,OAAO;AAAA,IACrB;AAAA,EACF;AACA,QAAM,IAAI,MAAM,uCAAuC,KAAK,EAAE;AAChE;AAEO,SAAS,gCAAgC,UAA8B;AAC5E,QAAM,WAAW,+BAA+B,QAAQ;AACxD,QAAM,QAAkB,CAAC;AACzB,aAAW,WAAW,UAAU;AAC9B,UAAM,KAAK,GAAG,2BAA2B,OAAO,EAAG,GAAG;AAAA,EACxD;AACA,QAAM,KAAK,GAAG,SAAS,SAAS,mBAAmB,CAAC;AACpD,SAAO,eAAe,OAAO,aAAa;AAC5C;AAEO,SAAS,wBAAwB,UAA8B;AACpE,QAAM,MAAgB,CAAC;AACvB,aAAW,WAAW,+BAA+B,QAAQ,GAAG;AAC9D,QAAI,KAAK,GAAG,2BAA2B,OAAO,EAAG,KAAK;AAAA,EACxD;AACA,SAAO,aAAa,GAAG;AACzB;AAEA,SAAS,+BAA+B,UAA8B;AACpE,QAAM,WAAW,SAAS,SAAS,0BAA0B,EAAE;AAAA,IAAI,CAAC,UAClE,MAAM,YAAY;AAAA,EACpB;AACA,MAAI,SAAS,SAAS,MAAM,GAAG;AAC7B,QAAI,SAAS,SAAS,GAAG;AACvB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,CAAC,MAAM;AAAA,EAChB;AACA,aAAW,WAAW,UAAU;AAC9B,QAAI,CAAC,2BAA2B,OAAO,GAAG;AACxC,YAAM,IAAI,MAAM,uCAAuC,OAAO,EAAE;AAAA,IAClE;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,kBAAkB,KAAuB;AACvD,SAAO,SAAS,GAAG,EAAE,IAAI,CAAC,UAAU;AAClC,UAAM,OAAO,OAAO,KAAK;AACzB,QAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,OAAO;AACvD,YAAM,IAAI,MAAM,6DAA6D;AAAA,IAC/E;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAEO,SAAS,gBAAgB,KAAgD;AAC9E,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC1B,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,8CAA8C,OAAO,IAAI;AAAA,MACvE,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEO,SAAS,sBAAsB,KAA2C;AAC/E,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,mDAAmD,OAAO,IAAI,EAAE,OAAO,MAAM,CAAC;AAAA,EAChG;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,MAAM,uEAAuE;AAAA,EACzF;AACA,QAAM,MAAoC,CAAC;AAC3C,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,QAAI,CAAC,MAAM,KAAK,GAAG;AACjB,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AACA,QAAI,KAAK,IAAI,mBAAmB,MAAM,KAAK;AAAA,EAC7C;AACA,SAAO;AACT;AAMO,SAAS,yBAAyB,KAAqC;AAC5E,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI;AAAA,MACR,yEAAyE,OAAO;AAAA,MAChF,EAAE,OAAO,MAAM;AAAA,IACjB;AAAA,EACF;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,SAAS,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACrD,QAAI,CAAC,QAAQ,KAAK,GAAG;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,OAAO,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK;AAC7D,QAAI,CAAC,OAAO,SAAS,IAAI,KAAK,OAAO,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,8DAA8D,OAAO;AAAA,MACvE;AAAA,IACF;AACA,QAAI,OAAO,IAAI;AAAA,EACjB;AACA,SAAO;AACT;AAIO,SAAS,+BAA+B,UAAoB,SAAyB;AAC1F,QAAM,QAAQ,yBAAyB,SAAS,kCAAkC;AAClF,SAAO,MAAM,OAAO,KAAK;AAC3B;AAOO,SAAS,wBAAwB,KAAiC;AACvE,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,qDAAqD,OAAO,IAAI;AAAA,MAC9E,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC1B,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,SAAO,OAAO,IAAI,CAAC,OAAO,UAAU;AAClC,UAAM,SAAS,uBAAuB,UAAU,KAAK;AACrD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR,0CAA0C,KAAK,iBAAiB,OAAO,MAAM,OAAO;AAAA,MACtF;AAAA,IACF;AACA,QAAI;AACF,aAAO,0BAA0B,OAAO,IAAI;AAAA,IAC9C,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,YAAM,IAAI,MAAM,0CAA0C,KAAK,iBAAiB,OAAO,IAAI;AAAA,QACzF,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,SAAS,kCACd,KAC8C;AAC9C,MAAI,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACvC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,gEAAgE,OAAO,IAAI;AAAA,MACzF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAoD,CAAC;AAC3D,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,CAAC,IAAI,KAAK,GAAG;AACf,YAAM,IAAI,MAAM,uEAAuE;AAAA,IACzF;AACA,UAAM,SAAS,mCAAmC,UAAU,KAAK;AACjE,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR,uDAAuD,GAAG,gBAAgB,OAAO,MAAM,OAAO;AAAA,MAChG;AAAA,IACF;AACA,QAAI,GAAG,IAAI,OAAO;AAAA,EACpB;AACA,SAAO;AACT;AAEO,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAC3C,CAAC;AAGD,IAAM,4BAA4B,CAAC,KAAK,QAAQ;AAEzC,SAAS,4BACd,KACsF;AACtF,MAAI,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACvC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,0DAA0D,OAAO,IAAI;AAAA,MACnF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MACJ,CAAC;AACH,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,CAAC,0BAA0B,SAAS,GAAiD,GAAG;AAC1F,YAAM,IAAI;AAAA,QACR,+CAA+C,GAAG,gCAAgC,0BAA0B,KAAK,IAAI,CAAC;AAAA,MACxH;AAAA,IACF;AACA,UAAM,SAAS,8BAA8B,UAAU,KAAK;AAC5D,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR,iDAAiD,GAAG,gBAAgB,OAAO,MAAM,OAAO;AAAA,MAC1F;AAAA,IACF;AACA,QAAI,GAAiD,IAAI,OAAO;AAAA,EAClE;AACA,SAAO;AACT;AAEO,SAAS,2BAA2B,KAAsC;AAC/E,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,yDAAyD,OAAO,IAAI;AAAA,MAClF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,kBAAkB,MAAM,MAAM;AACvC;AAEO,SAAS,4BAA4B,KAAiC;AAC3E,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,yDAAyD,OAAO,IAAI;AAAA,MAClF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,aAAa,MAAM,MAAM;AAClC;AAEA,SAAS,yBAAyB,SAAuB,OAAgC;AACvF,QAAM,cAAc,YAAY,MAAM,WAAW;AACjD,QAAM,eAAe,YAAY,MAAM,YAAY;AACnD,QAAM,eAAe,KAAK,IAAI,aAAa,kBAAkB,KAAK,CAAC;AACnE,QAAM,sBAAsB,KAAK,IAAI,GAAG,cAAc,YAAY;AAClE,QAAM,kBACJ,QAAQ,qCAAqC,QAAQ;AACvD,SACE,KAAK,KAAM,sBAAsB,QAAQ,8BAA+B,GAAS,IACjF,KAAK,KAAM,eAAe,kBAAmB,GAAS,IACtD,KAAK,KAAM,eAAe,QAAQ,+BAAgC,GAAS;AAE/E;AAEA,SAAS,kBAAkB,OAAgC;AACzD,QAAM,UAAU,MAAM,QAAQ,MAAM,kBAAkB,IAClD,MAAM,qBACN,MAAM,qBACJ,CAAC,MAAM,kBAAkB,IACzB,CAAC;AACP,MAAI,QAAQ;AACZ,aAAW,UAAU,SAAS;AAC5B,aACE,YAAY,OAAO,aAAa,IAChC,YAAY,OAAO,iBAAiB,IACpC,YAAY,OAAO,mBAAmB;AAAA,EAC1C;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAwB;AAC3C,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,QAAQ,IAAI,KAAK,MAAM,KAAK,IAAI;AAChG;AAEA,SAAS,wBAAwB,UAA4C;AAC3E,QAAM,WAAW,SAAS,WAAW,OAAO,CAAC,WAAW,OAAO,OAAO,UAAU;AAChF,QAAM,mBAAmB,uBAAuB,QAAQ;AACxD,QAAM,wBAAwB,4BAA4B,gBAAgB;AAC1E,QAAM,uBAAuB,gCAAgC,gBAAgB;AAC7E,QAAM,WAAW,SAAS,KAAK,CAAC,WAAW,OAAO,OAAO,OAAO;AAChE,QAAM,UAAU,SAAS,KAAK,CAAC,WAAW,OAAO,OAAO,MAAM;AAC9D,SAAO;AAAA,IACL;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAYL,gBAAgB;AAAA,IAClB;AAAA,IACA,GAAI,WACA,CAAC,IACD;AAAA,MACE;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,KAAK;AAAA,QACL,cAAc,CAAC,wBAAwB;AAAA,QACvC,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,IACJ,GAAI,UACA,CAAC,IACD;AAAA,MACE;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,KAAK;AAAA,QACL,cAAc;AAAA,UACZ;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,IACJ,GAAG;AAAA,EACL;AACF;AAuBO,SAAS,qBAAqB,UAA4B;AAC/D,SACE,SAAS,kBACT,oBAAoB,SAAS,OAAO;AAExC;AAEO,SAAS,0BAA0B,UAAoB,aAA6B;AACzF,QAAM,MAAM,qBAAqB,QAAQ;AACzC,MAAI,IAAI,SAAS,eAAe,GAAG;AACjC,WAAO,IAAI,WAAW,iBAAiB,WAAW;AAAA,EACpD;AACA,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,MAAI,WAAW,kBAAkB,WAAW;AAC5C,MAAI,SAAS;AACb,MAAI,OAAO;AACX,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,uBAAuB,UAA4B;AAC1D,SAAO,qBAAqB,QAAQ;AACtC;AAEA,SAAS,gCAAgC,QAAwB;AAC/D,SAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC;AACtC;AAEA,SAAS,4BAA4B,QAAwB;AAC3D,SAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC;AACtC;AAEA,SAAS,iBAAiB,UAA0B;AAClD,4BAA0B,QAAQ;AAClC,MAAI,SAAS,oBAAoB,CAAC,SAAS,kBAAkB;AAC3D,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AACA,MAAI,SAAS,sBAAsB,WAAW;AAC5C,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,kBAAkB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,kBAAkB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAAK,CAAC,SAAS,cAAc;AAC/E,YAAM,IAAI,MAAM,yEAAyE;AAAA,IAC3F;AACA,QAAI,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAAK,CAAC,SAAS,2BAA2B;AAC5F,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,iCAA+B,QAAQ;AACvC,MAAI,SAAS,qBAAqB;AAChC,QAAI,SAAS,sBAAsB,aAAa,CAAC,SAAS,eAAe;AACvE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,iBACT,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,2BAA2B,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAAG;AAC1F,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,aAAa,MAAM,QAAQ,SAAS,iBAAiB,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,eAAe;AAC1B,QAAI,CAAC,SAAS,oBAAoB;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,yBAAyB;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,mBAAmB,MAAM,QAAQ,SAAS,uBAAuB,GAAG;AACvF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,qBAAqB;AAChC,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,yBAAyB;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,oCAAkC,SAAS,4BAA4B;AACvE,8BAA4B,SAAS,sBAAsB;AAC3D,MACE,SAAS,sBAAsB,gBAC/B,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAChD,CAAC,SAAS,oBACV,CAAC,SAAS,cACV;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,gBAAgB,UAAU;AACrC,QAAI,CAAC,SAAS,mBAAmB,CAAC,SAAS,qBAAqB;AAC9D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,sBAAsB,aAAa,SAAS,gBAAgB,UAAU;AACjF,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,MAAI,SAAS,gBAAgB,YAAY,SAAS,oBAAoB,WAAW;AAC/E,UAAM,UAAU,uBAAuB,QAAQ;AAC/C,UAAM,UAAU,wBAAwB,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,KAAK,CAAC;AACnF,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,uDAAuD,QAAQ,KAAK,IAAI,CAAC;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,oBAAoB,UAAU;AACzC,UAAM,SAAS,4BAA4B,QAAQ;AACnD,QAAI,OAAO,KAAK,MAAM,EAAE,WAAW,GAAG;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,OAAO;AACL,+BAA2B,SAAS,qBAAqB;AAAA,EAC3D;AACA,MAAI,SAAS,qBAAqB,UAAU;AAC1C,UAAM,eAAe,4BAA4B,SAAS,sBAAsB;AAChF,QAAI,OAAO,KAAK,YAAY,EAAE,WAAW,GAAG;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,OAAO;AACL,gCAA4B,SAAS,sBAAsB;AAAA,EAC7D;AACA,MAAI,SAAS,gBAAgB,CAAC,SAAS,WAAW;AAChD,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,SAAS,mBAAmB,SAAS;AACvC,QAAI,CAAC,SAAS,sBAAsB,CAAC,SAAS,qBAAqB;AACjE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,sBAAsB,CAAC,SAAS,uBAAuB;AACnE,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AACA,QAAI,CAAC,SAAS,sBAAsB,CAAC,SAAS,uBAAuB;AACnE,YAAM,IAAI,MAAM,uEAAuE;AAAA,IACzF;AACA,QAAI,CAAC,SAAS,qBAAqB,CAAC,SAAS,oBAAoB;AAC/D,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAAA,EACF;AAIA,MAAI,QAAQ,SAAS,YAAY,MAAM,QAAQ,SAAS,gBAAgB,GAAG;AACzE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAKA,aAAW,YAAY,qBAAqB,SAAS,cAAc,KAAK,CAAC,GAAG;AAC1E,UAAM,QAAQ,SAAS,SAAS,KAAK;AACrC,QACE,UAAU,UACV,UAAU,QACT,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GACtD;AACA,YAAM,IAAI;AAAA,QACR,GAAG,SAAS,GAAG,8CAA8C,SAAS,cAAc;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACA,MACE,SAAS,yBAAyB,mBAClC,SAAS,yBAAyB,UAClC;AACA,QACE,QAAQ,SAAS,wBAAwB,MAAM,QAAQ,SAAS,4BAA4B,GAC5F;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,yBAAyB,oBACjC,SAAS,yBACR,SAAS,iCACT,SAAS,kCACV,CAAC,SAAS,4BAA4B,CAAC,SAAS,+BACjD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,sCACT,SAAS,iCACT,SAAS,gCACT,SAAS,4BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,6BACT,SAAS,mCACT,SAAS,+BACT,SAAS,6BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,WAAW,SAAS,yBAAyB,cAAc;AACzD,QACE,SAAS,yBACT,SAAS,iCACT,SAAS,gCACT,SAAS,4BACT,SAAS,8BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,6BACT,SAAS,mCACT,SAAS,+BACT,SAAS,6BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,sBAAsB,QAAQ,SAAS,kCAAkC;AAC/E,UAAM,eACJ,QAAQ,SAAS,6BAA6B,KAC9C,QAAQ,SAAS,4BAA4B;AAC/C,QAAI,CAAC,uBAAuB,CAAC,cAAc;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,OAAO;AACL,QACE,SAAS,yBACT,SAAS,iCACT,SAAS,gCACT,SAAS,4BACT,SAAS,8BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,sCACT,SAAS,iCACT,SAAS,gCACT,SAAS,4BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,iCAAiC;AAC5C,8BAAwB,SAAS,+BAA+B;AAAA,IAClE;AAAA,EACF;AACA,MAAI,SAAS,wBAAwB,SAAS,mBAAmB;AAC/D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,oBAAkB,SAAS,kBAAkB;AAC7C,kCAAgC,QAAQ;AACxC,0BAAwB,QAAQ;AAEhC,2BAAyB,SAAS,kCAAkC;AACpE,QAAM,YAAY,oBAAI,IAAY;AAClC,aAAW,UAAU,SAAS,YAAY;AACxC,QAAI,UAAU,IAAI,OAAO,EAAE,GAAG;AAC5B,YAAM,IAAI,MAAM,8CAA8C,OAAO,EAAE,EAAE;AAAA,IAC3E;AACA,cAAU,IAAI,OAAO,EAAE;AAAA,EACzB;AAWA;AACE,UAAM,eAAe,SAAS;AAC9B,UAAM,YAAY,SAAS;AAC3B,UAAM,cAAc,SAAS;AAC7B,UAAM,qBAAqB,SAAS,sBAAsB;AAC1D,UAAM,iBAAiB,SAAS;AAQhC,UAAM,gBAAgB,iCAAiC,QAAQ,IAAI;AACnE,QAAI,EAAE,eAAe,YAAY;AAC/B,YAAM,IAAI;AAAA,QACR,4CAA4C,YAAY,uEACZ,SAAS;AAAA,MAEvD;AAAA,IACF;AACA,QAAI,EAAE,iBAAiB,qBAAqB;AAC1C,YAAM,IAAI;AAAA,QACR,6CAA6C,aAAa,uFACL,kBAAkB;AAAA,MAEzE;AAAA,IACF;AACA,QAAI,EAAE,iBAAiB,qBAAqB;AAC1C,YAAM,IAAI;AAAA,QACR,sCAAsC,cAAc,qEACV,kBAAkB;AAAA,MAC9D;AAAA,IACF;AACA,QAAI,EAAE,iBAAiB,SAAS,2BAA2B,IAAI,eAAe;AAC5E,YAAM,IAAI;AAAA,QACR,sCAAsC,cAAc,+DACtB,SAAS,2BAA2B,IAAI,YAAY;AAAA,MACpF;AAAA,IACF;AACA,QAAI,EAAE,YAAY,gBAAgB;AAChC,YAAM,IAAI;AAAA,QACR,0CAA0C,SAAS,gEAChC,aAAa;AAAA,MAElC;AAAA,IACF;AACA,QAAI,EAAE,eAAe,cAAc,gBAAgB;AACjD,YAAM,IAAI;AAAA,QACR,6EACM,YAAY,MAAM,WAAW,MAAM,eAAe,WAAW,gEAClC,aAAa;AAAA,MAKhD;AAAA,IACF;AAAA,EACF;AASA,MAAI,SAAS,yBAAyB,yBAAyB,QAAQ,MAAM,QAAW;AACtF,YAAQ;AAAA,MACN;AAAA,IAIF;AAAA,EACF;AAQA,QAAM,oBAAoB,wBAAwB,SAAS,kBAAkB;AAC7E,QAAM,YAAY,kBAAkB,QAAQ;AAC5C,QAAM,cAAc,oBAAI,IAAY;AACpC,aAAW,YAAY,mBAAmB;AACxC,QACE,SAAS,SAAS,4BAClB,SAAS,SAAS,4BAClB;AACA,YAAM,IAAI;AAAA,QACR,+CAA+C,SAAS,IAAI;AAAA,MAC9D;AAAA,IACF;AACA,QAAI,SAAS,OAAO,WAAW;AAC7B,YAAM,IAAI;AAAA,QACR,6CAA6C,SAAS,EAAE;AAAA,MAC1D;AAAA,IACF;AACA,QAAI,YAAY,IAAI,SAAS,EAAE,GAAG;AAChC,YAAM,IAAI;AAAA,QACR,gEAAgE,SAAS,EAAE;AAAA,MAC7E;AAAA,IACF;AACA,gBAAY,IAAI,SAAS,EAAE;AAC3B,QAAI,SAAS,SAAS,wBAAwB,CAAC,sBAAsB,QAAQ,GAAG;AAC9E,YAAM,IAAI;AAAA,QACR,0CAA0C,SAAS,EAAE;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AAIA,mBAAiB,QAAQ;AAC3B;AASO,SAAS,yBAAyB,UAAwC;AAC/E,QAAM,WAAW,SAAS,mBAAmB,KAAK;AAClD,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AACA,QAAM,aAAa,SAAS,kBAAkB,KAAK;AACnD,SAAO,aAAa,aAAa;AACnC;AAOO,SAAS,oBAAoB,UAA6B;AAC/D,SAAO,SAAS,yBAAyB,yBAAyB,QAAQ,MAAM;AAClF;AAWO,SAAS,+BAA+B,UAAwC;AACrF,QAAM,WAAW,SAAS,yBAAyB,KAAK;AACxD,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AACA,QAAM,aAAa,SAAS,kBAAkB,KAAK;AACnD,SAAO,aAAa,aAAa;AACnC;AAYO,SAAS,wBAAwB,UAAwC;AAC9E,QAAM,WAAW,SAAS,4BAA4B,KAAK;AAC3D,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AACA,QAAM,SAAS,SAAS,mBAAmB,KAAK;AAChD,MAAI,QAAQ;AACV,WAAO;AAAA,EACT;AACA,QAAM,aAAa,SAAS,kBAAkB,KAAK;AACnD,SAAO,aAAa,aAAa;AACnC;AAmBO,SAAS,yBAAyB,UAA8C;AACrF,QAAM,cAAc,SAAS,kCAAkC,KAAK;AACpE,QAAM,cAAc,SAAS,kCAAkC,KAAK,KAAK;AACzE,QAAM,OAAO,SAAS,2BAA2B,KAAK;AACtD,QAAM,WAAW,SAAS,+BAA+B,KAAK;AAC9D,MAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU;AACtC,WAAO;AAAA,EACT;AACA,SAAO,EAAE,aAAa,aAAa,MAAM,SAAS;AACpD;AAaO,SAAS,4BAA4B,UAAiD;AAC3F,QAAM,OAAO,SAAS,2BAA2B,KAAK;AACtD,QAAM,WAAW,SAAS,+BAA+B,KAAK;AAC9D,MAAI,CAAC,QAAQ,CAAC,UAAU;AACtB,WAAO;AAAA,EACT;AACA,SAAO,EAAE,MAAM,SAAS;AAC1B;AAEA,SAAS,SAAS,KAAuB;AACvC,SAAO,IACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACnB;AAEA,SAAS,eAAe,KAAe,WAA6B;AAClE,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAgB,CAAC;AACvB,aAAW,QAAQ,KAAK;AACtB,QAAI,CAAC,QAAQ,KAAK,IAAI,GAAG;AACvB,YAAM,IAAI,MAAM,GAAG,SAAS,mCAAmC,IAAI,EAAE;AAAA,IACvE;AACA,QAAI,CAAC,KAAK,IAAI,IAAI,GAAG;AACnB,WAAK,IAAI,IAAI;AACb,UAAI,KAAK,IAAI;AAAA,IACf;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,KAAyB;AAC7C,SAAO,CAAC,GAAG,IAAI,IAAI,IAAI,OAAO,OAAO,CAAC,CAAC;AACzC;AAEA,SAAS,wBAAwB,KAAsB;AACrD,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,oEAAoE,OAAO,IAAI;AAAA,MAC7F,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;","names":["provider"]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\n  BillingMode,\n  CAPABILITY_DESCRIPTORS,\n  DEFAULT_FIRST_PARTY_MCP_TOOLS,\n  Entitlements,\n  EntitlementsMode,\n  LatencyMode,\n  MAX_NESTED_AGENT_DEPTH,\n  ProductAccessMode,\n  ReasoningEffort,\n  FIRST_PARTY_MCP_TOOL_NAMES,\n  FirstPartyMcpToolName,\n  SandboxBackend,\n  SessionMcpApprovalPolicy,\n  SEEDANCE_2_5_MODEL_ID,\n  StaticUsageLimits,\n  TurnExecutionPolicyV1,\n  UsageLimitsMode,\n  type TurnExecutionLatencyModeSourceV1,\n  type TurnExecutionModelSourceV1,\n  type TurnExecutionReasoningSourceV1,\n  type VideoGenerationResolution,\n  type FirstPartyMcpToolName as FirstPartyMcpToolNameType,\n} from \"@opengeni/contracts\";\nimport { CODEX_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS } from \"@opengeni/codex\";\nimport {\n  CODEX_FALLBACK_MODEL_SLUGS,\n  CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT,\n  CODEX_MODEL_CONTEXT_WINDOW_TOKENS,\n  CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,\n  CODEX_MODEL_ID_PREFIX,\n  CODEX_PROVIDER_BASE_URL,\n  CODEX_PROVIDER_ID,\n} from \"@opengeni/codex/constants\";\nimport {\n  XAI_SUBSCRIPTION_MODEL_SLUGS,\n  XAI_SUBSCRIPTION_MODEL_AUTO_COMPACT_TOKEN_LIMIT,\n  XAI_SUBSCRIPTION_MODEL_CONTEXT_WINDOW_TOKENS,\n  XAI_SUBSCRIPTION_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,\n  XAI_SUBSCRIPTION_MODEL_ID_PREFIX,\n  XAI_SUBSCRIPTION_PROVIDER_ID,\n  XAI_SUBSCRIPTION_PROXY_BASE_URL,\n} from \"@opengeni/xai-subscription\";\nexport { XAI_SUBSCRIPTION_MODEL_ID_PREFIX } from \"@opengeni/xai-subscription\";\nimport { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\nconst envName = /^[A-Za-z_][A-Za-z0-9_]*$/;\nconst registryId = /^[A-Za-z0-9_-]+$/;\n\n// Archive capture claims are also the admission/teardown fence around a\n// provider snapshot. Keep a real settlement window after the provider request;\n// a configured request timeout may never consume the entire durable claim.\nexport const SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS = 60 * 60_000;\nexport const SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS = 10_000;\nexport const SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS =\n  SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS - SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS;\n// Admission waits are observational: successful capture/teardown returns as\n// soon as the DB fence clears. This ceiling only covers the unhealthy path. It\n// allows one scheduled inventory and one complete successor claim without\n// turning a recoverable lifecycle transition into a visible caller error. A\n// dead holder's TTL is deliberately NOT included: admission cannot accelerate\n// that proof, and the turn moves to durable recovery if holder quiescence takes\n// longer than this observational wait. The outer cap remains an explicit\n// request-resource boundary; successful transitions return immediately.\nexport const SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS = 60 * 60_000;\nexport const SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS = 10_000;\nconst EnvBoolean = z.preprocess((value) => {\n  if (typeof value !== \"string\") {\n    return value;\n  }\n  const normalized = value.trim().toLowerCase();\n  if ([\"true\", \"1\", \"yes\", \"y\", \"on\"].includes(normalized)) {\n    return true;\n  }\n  if ([\"false\", \"0\", \"no\", \"n\", \"off\"].includes(normalized)) {\n    return false;\n  }\n  return value;\n}, z.boolean());\n\nconst EnvFirstPartyMcpTools = z.preprocess(\n  (value) => {\n    if (typeof value !== \"string\") return value;\n    const source = value.trim();\n    if (!source) return undefined;\n    if (source.startsWith(\"[\")) {\n      try {\n        return JSON.parse(source);\n      } catch {\n        return value;\n      }\n    }\n    return source.split(\",\").map((entry) => entry.trim());\n  },\n  z\n    .array(FirstPartyMcpToolName)\n    .superRefine((tools, context) => {\n      const seen = new Set<FirstPartyMcpToolNameType>();\n      for (const [index, tool] of tools.entries()) {\n        if (seen.has(tool)) {\n          context.addIssue({\n            code: \"custom\",\n            message: \"first-party MCP tool lists must not contain duplicates\",\n            path: [index],\n          });\n        }\n        seen.add(tool);\n      }\n    })\n    .optional(),\n);\n\nexport const sandboxPreparationProfiles: Record<string, { env: string[]; hooks: string[] }> = {\n  none: {\n    env: [],\n    hooks: [],\n  },\n  azure: {\n    env: [\n      \"ARM_CLIENT_ID\",\n      \"ARM_CLIENT_SECRET\",\n      \"ARM_TENANT_ID\",\n      \"ARM_SUBSCRIPTION_ID\",\n      \"AZURE_CLIENT_ID\",\n      \"AZURE_CLIENT_SECRET\",\n      \"AZURE_TENANT_ID\",\n      \"AZURE_SUBSCRIPTION_ID\",\n      \"AZURE_AUTHORITY_HOST\",\n    ],\n    hooks: [\"azure-cli-login\"],\n  },\n  github: {\n    env: [\n      \"GH_TOKEN\",\n      \"GITHUB_TOKEN\",\n      \"GIT_AUTHOR_NAME\",\n      \"GIT_AUTHOR_EMAIL\",\n      \"GIT_COMMITTER_NAME\",\n      \"GIT_COMMITTER_EMAIL\",\n    ],\n    hooks: [],\n  },\n};\n\n/**\n * Placeholder token inside an agent-instructions persona template. The runtime\n * substitutes the non-bypassable CORE (goal-loop ownership + the dynamic\n * workspace-environment block) at this marker. A template that omits the\n * marker still gets the CORE appended after it (a non-bypassable fail-safe),\n * so a white-labelled persona can never drop the goal-loop contract or the\n * environment metadata the agent depends on.\n */\nexport const AGENT_INSTRUCTIONS_CORE_PLACEHOLDER = \"{{core}}\";\n\n/**\n * Default per-workspace agent persona template. This is the BRAND + tool-usage\n * opinion (the white-labellable surface): the \"You are an OpenGeni workspace\n * agent.\" identity line, the framing/opinion lines, and the mount-path facts.\n *\n * The CORE that MUST survive any override — the goal-loop ownership line (which\n * names the opengeni__goal_* tools) and the dynamic workspace-environment block\n * — is injected at AGENT_INSTRUCTIONS_CORE_PLACEHOLDER by the runtime, never\n * baked into this overridable string.\n *\n * INVARIANT: with no per-workspace override and an empty environment, the\n * runtime's composed instructions are byte-for-byte pinned by a runtime test.\n * The template below is joined by \" \", followed by \" \" + the placeholder.\n * Changing a single character here changes that default; update the pin\n * intentionally.\n */\nexport const DEFAULT_AGENT_INSTRUCTIONS = [\n  \"You are an OpenGeni workspace agent.\",\n  \"Follow the user's task and any enabled pack or skill instructions for the current role.\",\n  \"Work inside the sandbox workspace and use filesystem and shell tools when useful.\",\n  \"Repository resources are mounted under repos/<host>/<owner>/<repo> unless the session specifies another collision-free mount path.\",\n  \"File resources are mounted under .opengeni/files/<file-id>/ unless the session specifies another mount path.\",\n  \"Attached files are mounted read-only; copy them before modifying.\",\n  \"Installed and selected Skills are indexed under .agents/ and may include role-specific guidance.\",\n  \"Use Checkov, Terraform, Azure CLI, git provider CLIs, and repository tools when relevant; gh, glab, and az repos are pre-authenticated when the host brokers matching git credentials.\",\n  \"When the Azure sandbox preparation profile is enabled and service-principal variables are present, the sandbox is pre-authenticated with normal Azure CLI before work starts.\",\n  \"Treat code-changing work as GitOps work: create a focused branch/commit/PR when git provider credentials are available; otherwise report exact commands and blockers.\",\n  \"Return concise, factual summaries with files changed, commands run, and remaining blockers.\",\n  AGENT_INSTRUCTIONS_CORE_PLACEHOLDER,\n].join(\" \");\n\nexport const McpServerConnectionRefSchema = z\n  .object({\n    // Standalone ids are UUIDs; embedded hosts may use any stable opaque id.\n    connectionId: z.string().min(1).optional(),\n    provider: z.string().min(1).max(128).optional(),\n    providerDomain: z.string().min(1),\n    kind: z.enum([\"oauth2\", \"api_key\", \"app_install\", \"delegated\"]).optional(),\n    scopes: z.array(z.string().min(1)).optional(),\n    resource: z.string().min(1).optional(),\n    selectedResources: z\n      .array(\n        z\n          .object({\n            id: z.string().min(1).max(512),\n            kind: z.literal(\"repository\"),\n          })\n          .strict(),\n      )\n      .min(1)\n      .max(256)\n      .superRefine((resources, context) => {\n        const seen = new Set<string>();\n        for (const [index, resource] of resources.entries()) {\n          const key = `${resource.kind}\\0${resource.id}`;\n          if (seen.has(key)) {\n            context.addIssue({\n              code: \"custom\",\n              message: \"selectedResources must not contain duplicates\",\n              path: [index],\n            });\n          }\n          seen.add(key);\n        }\n      })\n      .optional(),\n    subjectScope: z.enum([\"workspace\", \"subject\"]).optional(),\n  })\n  .strict()\n  .superRefine((reference, context) => {\n    if (!reference.selectedResources) return;\n    if (!reference.connectionId) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"selectedResources requires connectionId\",\n        path: [\"connectionId\"],\n      });\n    }\n    if (!reference.provider) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"selectedResources requires provider\",\n        path: [\"provider\"],\n      });\n    }\n  });\nexport type McpServerConnectionRef = z.infer<typeof McpServerConnectionRefSchema>;\n\nconst SettingsSchema = z.object({\n  serviceName: z.string().default(\"opengeni\"),\n  environment: z.string().default(\"local\"),\n  deploymentRevision: z.string().default(\"dev\"),\n  // The release-train version baked into official images (OPENGENI_SERVER_VERSION).\n  // Absent on dev/source builds — consumers must treat it as optional.\n  serverVersion: z.string().optional(),\n  databaseUrl: z.string().default(\"postgres://opengeni:opengeni@127.0.0.1:5432/opengeni\"),\n  // Step I (§7.8 runtime half). Dedicated Postgres schema for the EMBEDDED\n  // topology. Default \"\" → standalone: no search_path scoping, server default\n  // (`public`). When set (e.g. \"opengeni\"), the db handle + the managed-auth\n  // pool send `search_path = \"<dbSchema>\",\"opengeni_private\",\"public\"` so every\n  // query resolves into the dedicated schema with NO query rewrite (schema-isolation contract F1).\n  dbSchema: z.string().default(\"\"),\n  // Step I (§7.7). RLS posture. \"force\" (default) = today's FORCE-RLS via the\n  // non-owner `opengeni_app` role. \"scoped\" = the embedded owner-role path (the\n  // GUC is still emitted defensively, so the query path is identical).\n  rlsStrategy: z.enum([\"force\", \"scoped\"]).default(\"force\"),\n  // Exact PostgreSQL login identity required by the standalone FORCE-RLS\n  // startup/readiness assertion. Embedded `scoped` hosts own their role model\n  // and are deliberately not constrained to this name.\n  runtimeDatabaseRole: z.string().min(1).default(\"opengeni_app\"),\n  natsUrl: z.string().default(\"nats://127.0.0.1:4222\"),\n  temporalHost: z.string().default(\"127.0.0.1:7233\"),\n  temporalNamespace: z.string().default(\"default\"),\n  temporalTaskQueue: z.string().default(\"opengeni-runs-ts\"),\n  temporalTlsEnabled: EnvBoolean.default(false),\n  temporalApiKey: z.string().optional(),\n  temporalTlsServerName: z.string().optional(),\n  temporalTlsRootCaCertificateBase64: z.string().optional(),\n  temporalTlsClientCertificateBase64: z.string().optional(),\n  temporalTlsClientPrivateKeyBase64: z.string().optional(),\n  startupDependencyRetryAttempts: z.coerce.number().int().positive().default(30),\n  startupDependencyRetryInitialDelayMs: z.coerce.number().int().positive().default(1000),\n  startupDependencyRetryMaxDelayMs: z.coerce.number().int().positive().default(5000),\n  turnWorkerConcurrencyMode: z.enum([\"fixed\", \"resource-based\"]).default(\"fixed\"),\n  turnWorkerMaxConcurrentTurns: z.coerce.number().int().positive().max(2_000).default(16),\n  turnWorkerTargetCpuUsage: z.coerce.number().positive().max(1).default(0.8),\n  turnWorkerTargetMemoryUsage: z.coerce.number().positive().max(0.8).default(0.75),\n  // Admission and emergency recovery are deliberately separate control loops.\n  // The Temporal tuner stops polling at the lower target; only genuine danger\n  // may invoke the disruptive graceful-drain fallback.\n  turnWorkerEmergencyMemoryUsage: z.coerce.number().min(0.85).max(0.95).default(0.9),\n  turnWorkerMemoryGuardIntervalMs: z.coerce.number().int().min(1_000).max(60_000).default(5_000),\n  turnWorkerMemoryGuardSustainMs: z.coerce.number().int().min(5_000).max(300_000).default(30_000),\n  observabilityStructuredLogs: EnvBoolean.default(false),\n  observabilityMetricsEnabled: EnvBoolean.default(true),\n  observabilityOtlpEndpoint: z.string().url().optional(),\n  observabilityOtlpHeaders: z.string().default(\"\"),\n  analyticsEnabled: EnvBoolean.default(false),\n  analyticsConsentRequired: EnvBoolean.default(true),\n  analyticsReoClientId: z\n    .string()\n    .max(128)\n    .regex(/^[A-Za-z0-9_-]+$/u)\n    .optional(),\n  analyticsPosthogProjectKey: z.string().min(1).max(256).optional(),\n  analyticsPosthogHost: z.string().url().max(2_048).optional(),\n  analyticsGa4MeasurementId: z\n    .string()\n    .max(32)\n    .regex(/^G-[A-Z0-9]+$/u)\n    .optional(),\n  publicBaseUrl: z.string().url().optional(),\n  // Browser origin when the web app and API use separate origins in local\n  // development. Production normally leaves this unset and uses publicBaseUrl.\n  webBaseUrl: z.string().url().optional(),\n  // Base URL for the bring-your-own-compute agent release assets the get.<domain>\n  // install routes redirect to. Defaults to this repo's GitHub Releases. The route\n  // appends `/download/agent-v<ver>/<asset>`.\n  agentReleasesBaseUrl: z\n    .string()\n    .url()\n    .default(\"https://github.com/Cloudgeni-ai/opengeni/releases\"),\n  // Explicit operator-controlled promotion pointer for `/agent/latest/*`.\n  // Versioned agent releases are immutable; changing this setting promotes or\n  // rolls back the stable channel without moving or deleting a provider tag.\n  agentStableVersion: z\n    .string()\n    .regex(/^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$/u)\n    .default(\"0.1.14\"),\n  // Optional independent beta-channel pointer. When unset, the beta update\n  // manifest route is unavailable rather than silently serving stable.\n  agentBetaVersion: z\n    .string()\n    .regex(/^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$/u)\n    .optional(),\n  productAccessMode: ProductAccessMode.default(\"local\"),\n  billingMode: BillingMode.default(\"disabled\"),\n  entitlementsMode: EntitlementsMode.default(\"none\"),\n  usageLimitsMode: UsageLimitsMode.default(\"none\"),\n  staticEntitlementsJson: z.string().default(\"{}\"),\n  staticUsageLimitsJson: z.string().default(\"{}\"),\n  delegationSecret: z.string().optional(),\n  defaultFirstPartyMcpTools: EnvFirstPartyMcpTools,\n  allowedFirstPartyMcpTools: EnvFirstPartyMcpTools,\n  // sandbox workspace scoped stream-token HMAC secret (sandbox contract §C.3 / stream-token availability contract).\n  // When unset, the API falls back to `delegationSecret` (the same HMAC envelope\n  // family, `ogs_` vs `ogd_` prefix). REQUIRED-WHEN-DESKTOP, but the absence of\n  // BOTH while sandboxDesktopEnabled=true is a GRACEFUL DEGRADE (DesktopStream\n  // transport:null + a loud boot warning), NOT a hard boot-fail (stream-token availability contract).\n  streamTokenSecret: z.string().optional(),\n  // The desktop input plane (raw stream:control writes) is OFF in v1: even a\n  // holder of stream:control gets 403 until this flips. Keeps stream:control a\n  // declared-but-inert permission so later hardening is a flag flip.\n  streamControlEnabled: EnvBoolean.default(false),\n  codemodeMaxCallsPerTurn: z.coerce.number().int().positive().default(200),\n  // Optional release-coherent bootstrap hint for custom rigs/connected machines\n  // that do not carry the stock-image ogtool binary. Exact stable versions only:\n  // the agent must never guess a tag or silently install `latest`.\n  ogtoolPackageSpec: z\n    .string()\n    .regex(/^@opengeni\\/ogtool@(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$/u)\n    .optional(),\n  environmentsEncryptionKey: z.string().optional(),\n  integrationsEnabled: EnvBoolean.default(false),\n  integrationsStateSecret: z.string().optional(),\n  integrationsAllowPrivateNetworkTargets: EnvBoolean.default(false),\n  integrationsOauthClientsJson: z.string().default(\"{}\"),\n  gmailRestAdapterEnabled: EnvBoolean.default(false),\n  slackClientId: z.string().optional(),\n  slackClientSecret: z.string().optional(),\n  slackSigningSecret: z.string().optional(),\n  googleDriveClientId: z.string().optional(),\n  googleDriveClientSecret: z.string().optional(),\n  fikenClientId: z.string().optional(),\n  fikenClientSecret: z.string().optional(),\n  googleDriveWorkspaceEventsEnabled: EnvBoolean.optional(),\n  atlassianClientId: z.string().optional(),\n  atlassianClientSecret: z.string().optional(),\n  // Undefined is meaningful: the migration boundary persists the product\n  // default of 3 when no deployment override is supplied.\n  maxNestedAgentDepth: z.coerce.number().int().nonnegative().max(MAX_NESTED_AGENT_DEPTH).optional(),\n  // Operator OAuth apps for first-party social connectors, keyed by provider\n  // id (\"x\", \"reddit\"): {\"x\":{\"clientId\":\"...\",\"clientSecret\":\"...\"}}.\n  socialOauthClientsJson: z.string().default(\"{}\"),\n  // Session goal guard rails. Goals are designed for runs that legitimately\n  // span days, so length is bounded by pathology detection (no-progress\n  // streaks, budget exhaustion), never by count. goalMaxAutoContinuations is\n  // therefore UNSET by default (no cap); deployments may configure one, and\n  // it then acts as a hard ceiling that per-goal overrides can only lower.\n  goalMaxAutoContinuations: z.coerce.number().int().positive().optional(),\n  goalNoProgressLimit: z.coerce.number().int().positive().default(3),\n  // Per-segment ceiling on agent loop turns (model calls) within a single\n  // session turn. Effectively unbounded by default for the same reason as\n  // above; the graceful max-turns valve (idle + goal continuation, never a\n  // session failure) remains as inert safety should a deployment set a cap.\n  agentMaxModelCallsPerTurn: z.coerce.number().int().positive().default(1_000_000),\n  // The model family's real context window in tokens. OpenGeni always performs\n  // one durable, portable plaintext compaction transition; there is no\n  // provider/server/off mode ladder.\n  contextWindowTokens: z.coerce.number().int().positive().default(1_050_000),\n  // Optional model-catalog effective input ceiling. Codex models expose this as\n  // raw context_window * effective_context_window_percent; when absent, retain\n  // the deployment-level window-minus-reserved-output behavior.\n  contextEffectiveWindowTokens: z.coerce.number().int().positive().optional(),\n  // Proactive compaction threshold as a ratio of the model context window.\n  // Defaults to 90%: compact as late as possible — retained context beats early\n  // headroom now that per-model windows are declared honestly (input-effective,\n  // empirically measured), and the fail-closed reactive compact-on-reject path\n  // absorbs any overshoot as one retried call rather than a dead session.\n  // Clamped to [0.3, 0.9] so deployments can tune the trigger without\n  // accidentally disabling compaction.\n  contextCompactionThresholdRatio: z.coerce\n    .number()\n    .default(0.9)\n    .transform((value) => {\n      if (!Number.isFinite(value)) {\n        return 0.9;\n      }\n      return Math.min(0.9, Math.max(0.3, value));\n    }),\n  // Tokens reserved for model output; subtracted from the window to get the\n  // usable input budget B = contextWindowTokens - contextReservedOutputTokens.\n  contextReservedOutputTokens: z.coerce.number().int().nonnegative().default(128_000),\n  // Model-catalog auto-compact limit. When present it is clamped to\n  // 90% of the raw window, matching Codex core's auto_compact_token_limit().\n  contextAutoCompactThresholdTokens: z.coerce.number().int().positive().optional(),\n  // Provider-neutral fallback for canonical model-facing tool-result text.\n  // The current stable Codex catalog policy is 10k tokens; the truncator adds\n  // Codex's 1.2x JSON serialization allowance when applying it.\n  modelToolOutputTruncationTokens: z.coerce.number().int().positive().default(10_000),\n  authRequired: EnvBoolean.default(false),\n  accessKey: z.string().optional(),\n  authAllowHealth: EnvBoolean.default(true),\n  authAllowMetrics: EnvBoolean.default(false),\n  apiHost: z.string().default(\"0.0.0.0\"),\n  apiPort: z.coerce.number().int().positive().default(8000),\n  workerHttpPort: z.coerce.number().int().positive().default(8001),\n  opengeniMcpUrl: z.string().url().optional(),\n  // Origins allowed to send browser cookies cross-origin. Other origins may\n  // call the public API with bearer credentials, but never receive credentialed\n  // CORS responses.\n  corsAllowOriginRegex: z.string().default(String.raw`^https?://(localhost|127\\.0\\.0\\.1)(:\\d+)?$`),\n  openaiProvider: z.enum([\"openai\", \"azure\"]).default(\"openai\"),\n  openaiApiKey: z.string().optional(),\n  openaiBaseUrl: z.string().optional(),\n  openaiModel: z.string().default(\"gpt-5.6-sol\"),\n  openaiAllowedModels: z.string().default(\"gpt-5.6-sol,gpt-5.6-terra,gpt-5.6-luna\"),\n  // OpenGeni-managed Vercel AI Gateway. When configured, the two reviewed\n  // Gateway models below are added to the managed-credit catalog. Workspace\n  // Gateway keys use the encrypted connection broker and never this secret.\n  vercelAiGatewayApiKey: z.string().optional(),\n  /** Image adapter route; native hosted providers ignore this model. */\n  imageGenerationModel: z.string().trim().min(1).max(256).default(\"openai/gpt-image-2\"),\n  /** Durable video generation uses the workspace-owned Gateway credential. */\n  videoGenerationPollIntervalMs: z.coerce.number().int().min(1_000).max(60_000).default(5_000),\n  videoGenerationRecoveryDeadlineMs: z.coerce\n    .number()\n    .int()\n    .min(60_000)\n    .max(24 * 60 * 60_000)\n    .default(2 * 60 * 60_000),\n  videoGenerationReferenceUrlTtlSeconds: z.coerce\n    .number()\n    .int()\n    .min(300)\n    .max(6 * 60 * 60)\n    .default(60 * 60),\n  videoGenerationMaxConcurrentPerWorkspace: z.coerce.number().int().min(1).max(16).default(2),\n  videoGenerationWorkspaceQuotaBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(Number.MAX_SAFE_INTEGER)\n    .default(20 * 1024 * 1024 * 1024),\n  videoGenerationTempDirectory: z.string().trim().min(1).max(1_024).default(\"/tmp/opengeni-video\"),\n  videoGenerationFfprobePath: z.string().trim().min(1).max(1_024).default(\"ffprobe\"),\n  // OpenGeni's customer price, not a claim about the provider's delayed cost report.\n  // The durable operation freezes the exact resulting price before provider submit.\n  videoGenerationCredit480pMicrosPerSecond: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(10_000_000)\n    .default(155_000),\n  videoGenerationCredit720pMicrosPerSecond: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(10_000_000)\n    .default(350_000),\n  // Native composer voice input (browser MediaRecorder → API transcription).\n  // Provider credentials stay server-side; ClientConfig only projects availability\n  // and hard ceilings. Selection happens once before audio is sent — never retry\n  // the same clip across vendors after an upstream request may have started.\n  voiceInputMaxDurationSeconds: z.coerce.number().int().positive().max(600).default(60),\n  voiceInputMaxSizeBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(25 * 1024 * 1024)\n    .default(25 * 1024 * 1024),\n  // Durable long-form capture uploads bounded chunks to object storage, then\n  // normalizes them into provider-safe segments. It is advertised only when\n  // object storage and the configured ffmpeg executable are both available.\n  voiceInputResumableEnabled: EnvBoolean.default(true),\n  voiceInputResumableMaxDurationSeconds: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(8 * 60 * 60)\n    .default(2 * 60 * 60),\n  voiceInputResumableMaxSizeBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(512 * 1024 * 1024)\n    .default(512 * 1024 * 1024),\n  voiceInputResumableMaxChunkSizeBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(25 * 1024 * 1024)\n    .default(8 * 1024 * 1024),\n  voiceInputResumableRetentionSeconds: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(7 * 24 * 60 * 60)\n    .default(24 * 60 * 60),\n  voiceInputFfmpegPath: z.string().trim().min(1).max(1024).default(\"ffmpeg\"),\n  // Preferred provider order (comma-separated ids). First configured+ready wins.\n  // Connected subscription STT is preferred by default; operators can put\n  // openai/azure-openai first explicitly.\n  // Supported: supergrok-subscription, codex-subscription, openai, azure-openai.\n  voiceInputProviderOrder: z\n    .string()\n    .default(\"supergrok-subscription,codex-subscription,openai,azure-openai\"),\n  // OpenAI public /v1/audio/transcriptions path. Reuses OPENGENI_OPENAI_API_KEY\n  // when voiceInputOpenaiApiKey is unset. Default model is gpt-transcribe.\n  voiceInputOpenaiEnabled: EnvBoolean.default(true),\n  voiceInputOpenaiApiKey: z.string().optional(),\n  voiceInputOpenaiBaseUrl: z.string().optional(),\n  voiceInputOpenaiModel: z.string().default(\"gpt-transcribe\"),\n  // Azure OpenAI deployment-scoped audio transcriptions. Reuses the turn-model\n  // Azure endpoint/key/AD token when voice-specific overrides are unset.\n  voiceInputAzureEnabled: EnvBoolean.default(true),\n  voiceInputAzureEndpoint: z.string().optional(),\n  voiceInputAzureDeployment: z.string().optional(),\n  voiceInputAzureApiVersion: z.string().optional(),\n  voiceInputAzureApiKey: z.string().optional(),\n  voiceInputAzureAdToken: z.string().optional(),\n  // Legacy opt-in for undocumented ChatGPT /backend-api/transcribe. When\n  // OPENGENI_CODEX_SUBSCRIPTION_ENABLED is true, Codex STT is included without\n  // this flag. Set false and omit codex-subscription from PROVIDER_ORDER to\n  // keep subscription model routing while disabling Codex voice input.\n  voiceInputCodexExperimentalEnabled: EnvBoolean.default(false),\n  modelPricingJson: z.string().default(\"{}\"),\n  // Extra (non-built-in) model providers, declared by the host as a JSON\n  // provider registry. Each entry carries its own base URL, API key, wire API\n  // (\"responses\" | \"chat\") and the models it exposes. The models a client may\n  // use are the UNION of the built-in provider's allowed models and every\n  // registry provider's models. validateSettings parses this at boot so a\n  // malformed registry / unresolvable key / id collision fails fast.\n  modelProvidersJson: z.string().default(\"[]\"),\n  // Codex (ChatGPT) subscription: when enabled, a per-workspace connected\n  // subscription is injected as a synthetic \"codex-subscription\" registry\n  // provider whose models route through the ChatGPT backend (@opengeni/codex).\n  codexSubscriptionEnabled: EnvBoolean.default(false), // OPENGENI_CODEX_SUBSCRIPTION_ENABLED\n  // SuperGrok/xAI connected subscription. This is a workspace-scoped OAuth\n  // account pool and a distinct rail from the existing xai/* API-key provider.\n  supergrokSubscriptionEnabled: EnvBoolean.default(false), // OPENGENI_SUPERGROK_SUBSCRIPTION_ENABLED\n  // Expose the connected apps attached to a Codex subscription through the\n  // synthetic codex_apps MCP server. Independent from subscription routing so\n  // operators can use Codex models without exposing ChatGPT connectors.\n  codexConnectedAppsEnabled: EnvBoolean.default(false), // OPENGENI_CODEX_CONNECTED_APPS_ENABLED\n  codexProductSku: z.string().optional(), // OPENGENI_CODEX_PRODUCT_SKU (X-OpenAI-Product-Sku, apps only)\n  // Progressive MCP disclosure (Codex-CLI-style tool_search): on a codex turn,\n  // flag non-mandatory selected MCP tools `defer_loading:true` (dropping their\n  // schemas from model context) and add one client-executed tool_search tool\n  // that BM25-discloses bounded matches. The mandatory OpenGeni tools stay\n  // eager. Default ON so selected connector catalogues do not consume every\n  // Codex turn's context. Operators may explicitly disable it for emergency\n  // compatibility diagnosis.\n  // OPENGENI_CODEX_TOOL_SEARCH_ENABLED\n  codexToolSearchEnabled: EnvBoolean.default(true),\n  // Provider-neutral progressive disclosure for direct OpenAI/Azure native\n  // client search and ordinary-function generic dispatch. Kept separate from\n  // the Codex rollout so an emergency Codex opt-out cannot disable every model.\n  // OPENGENI_LAZY_TOOL_SEARCH_ENABLED\n  lazyToolSearchEnabled: EnvBoolean.default(true),\n  // credential allocator atomic, workspace-local credential allocation. Default OFF is a\n  // deliberate rolling-deploy fence: migrate + roll every worker first, then\n  // enable. Turning it off restores the legacy sticky selector without a schema\n  // rollback; the additive lease table/cursor columns become inert.\n  codexCredentialLeasingEnabled: EnvBoolean.default(false),\n  // Decision-observability fence. When enabled, the worker emits one\n  // bounded, metadata-only adaptive-policy replay record alongside the unchanged\n  // sticky-sharded decision. It never changes placement/admission/failover.\n  codexFleetPolicyShadowEnabled: EnvBoolean.default(false),\n  // Multi-account P3 (auto-rotation): an account is \"near exhaustion\" — ineligible to be\n  // rotated TO — when EITHER usage window (5h/weekly) is at/over this percent. Default 90 to\n  // match the UI danger flip (UsageBar danger at pct >= 90). OPENGENI_CODEX_ROTATION_NEAR_EXHAUSTION_PCT.\n  codexRotationNearExhaustionPct: z.coerce.number().int().min(1).max(100).default(90),\n  openaiReasoningEffort: ReasoningEffort.default(\"low\"),\n  openaiAllowedReasoningEfforts: z.string().default(\"low,medium,high,xhigh,max\"),\n  openaiResponsesTransport: z.enum([\"http\", \"websocket\"]).default(\"http\"),\n  // Provider-assigned item ids (rs_/msg_/fc_…) in Responses API input are\n  // resolved against the provider's server-side response store. That store is\n  // not durable enough to anchor long runs on: a response that streamed fine\n  // can be missing from the store on the very next model call, which then\n  // fails with 400 \"Item with id ... not found\". \"strip\" removes the ids from\n  // every model-call input so requests are self-contained — conversation\n  // truth already lives client-side in session_history_items. \"preserve\"\n  // keeps the SDK's pass-through behavior.\n  openaiProviderItemIds: z.enum([\"strip\", \"preserve\"]).default(\"strip\"),\n  // With ids stripped the provider cannot resolve prior reasoning server-side,\n  // so request reasoning.encrypted_content and send it back with each call:\n  // reasoning continuity without depending on provider-side storage.\n  openaiReasoningEncryptedContent: EnvBoolean.default(true),\n  // Model-call retry budget for transient provider failures (429s and friends).\n  // The openai client default of 2 retries is too small for sustained TPM\n  // backpressure during long autonomous runs.\n  openaiMaxRetries: z.coerce.number().int().nonnegative().default(5),\n  // Native hosted web search. The live Azure Responses path executes the\n  // hosted web_search tool, so this is provider-unconditional: ON by default\n  // on every provider, exposed only so operators can disable it. When true,\n  // buildOpenGeniAgent attaches webSearchTool() to the agent's tools — it is\n  // merged with the MCP-server tools (getAllTools = [...mcpTools, ...tools])\n  // and the sandbox capability tools, never replacing them.\n  webSearchEnabled: EnvBoolean.default(true),\n  // Deployment-default agent persona template (the white-label surface). The\n  // runtime resolves the effective template per turn as\n  // per-session-override > per-workspace override > this default, substitutes\n  // the non-bypassable CORE at AGENT_INSTRUCTIONS_CORE_PLACEHOLDER (or appends\n  // it when the template omits the marker), and uses the result as the agent's\n  // instructions. Defaulting to DEFAULT_AGENT_INSTRUCTIONS keeps the composed\n  // default pinned by runtime tests.\n  agentInstructionsTemplate: z.string().default(DEFAULT_AGENT_INSTRUCTIONS),\n  azureOpenaiBaseUrl: z.string().optional(),\n  azureOpenaiEndpoint: z.string().optional(),\n  azureOpenaiDeployment: z.string().optional(),\n  azureOpenaiApiVersion: z.string().optional(),\n  azureOpenaiApiKey: z.string().optional(),\n  azureOpenaiAdToken: z.string().optional(),\n  disableOpenaiTracing: EnvBoolean.default(false),\n  sandboxBackend: SandboxBackend.default(\"docker\"),\n  dockerImage: z.string().default(\"opengeni-sandbox:local\"),\n  // Explicit deployment contract: the configured base sandbox image contains\n  // the verified, self-contained native artifact runtime at its fixed image\n  // paths. Disabled by default so arbitrary/custom provider images never make\n  // document/spreadsheet/presentation skills appear when their runtime is\n  // absent. Per-pack/per-rig image overrides fail closed in the worker even\n  // when this base-image contract is enabled.\n  sandboxArtifactRuntimeEnabled: EnvBoolean.default(false),\n  dockerExposedPorts: z.string().default(\"\"),\n  dockerNetwork: z.string().optional(),\n  // When the worker itself runs in a container and talks to a host Docker daemon,\n  // this directory must be bind-mounted at the exact same absolute path on both\n  // sides. The Agents SDK materializes the workspace here before bind-mounting it\n  // into the sandbox container.\n  dockerWorkspaceBaseDir: z.string().min(1).optional(),\n  modalAppName: z.string().default(\"opengeni-sandbox\"),\n  modalImageRef: z.string().optional(),\n  // Provider-native immutable Modal image ID for the exact logical\n  // `modalImageRef`. When set, the runtime uses ModalImageSelector.fromId and\n  // never asks Modal to parse or import the registry ref. The logical ref is\n  // still persisted on the sandbox lease for provenance and conflict fencing;\n  // the Modal session envelope persists the actual image ID.\n  modalImageId: z\n    .string()\n    // Modal image IDs are provider-opaque. Older builds use a 22-character\n    // random suffix while current filesystem snapshots use a 26-character\n    // ULID suffix. Validate the stable namespace/safe alphabet and let Modal\n    // remain authoritative over current/future suffix lengths.\n    .min(4)\n    .max(128)\n    .regex(/^im-[A-Za-z0-9]+$/)\n    .optional(),\n  // Name of a Modal Secret (containing REGISTRY_USERNAME + REGISTRY_PASSWORD) used\n  // to authenticate the pull of `modalImageRef` from a PRIVATE registry. When UNSET\n  // (the default), the sandbox image is pulled UNAUTHENTICATED — i.e. it must be a\n  // PUBLIC registry tag, which is the only shape the Agents-extension Modal backend\n  // supports out of the box (`Image.fromRegistry(tag)` with no secret). Set this to\n  // run a private image (e.g. a cloud-hosted ACR/ECR/GCR digest): the runtime resolves\n  // the named Secret and builds the image via `fromRegistry(tag, secret)` before the\n  // first sandbox is created. Knob: OPENGENI_MODAL_IMAGE_REGISTRY_SECRET.\n  modalImageRegistrySecret: z.string().optional(),\n  // Modal's hard sandbox lifetime (timeoutMs = this * 1000), counted from box\n  // creation. A resume-by-id does NOT reset that provider clock. It is the\n  // BACKSTOP that reclaims a box if the reaper/worker is down, NOT the warm-window\n  // controller (that's sandboxIdleGraceMs). It must comfortably exceed\n  // reaperPeriod + idleGrace so the reaper terminates a genuinely-idle box FIRST;\n  // the boot invariant below enforces that. Default 24h, Modal's documented\n  // maximum, to reduce premature active-box loss and leave headroom for the\n  // deadline-aware snapshot/rematerialization transition. The transition—not a\n  // larger timeout—is what lets a session outlive one finite provider box.\n  // Knob: OPENGENI_MODAL_TIMEOUT_SECONDS.\n  modalTimeoutSeconds: z.coerce.number().int().positive().max(86_400).default(86_400),\n  modalTokenId: z.string().optional(),\n  modalTokenSecret: z.string().optional(),\n  modalEnvironment: z.string().optional(),\n  // modal gap-fill: idleTimeoutMs + workspacePersistence were unmapped (module 03 §4.1).\n  //\n  // CRITICAL (sandbox-file-persistence): when this is UNSET the Modal SDK sends\n  // idleTimeoutSecs=undefined, so Modal applies its OWN short server-default idle\n  // timeout (~minutes) — and a box between turns sits with NO active connection,\n  // so that idle clock runs and Modal idle-reaps the box LONG before OpenGeni's\n  // own reaper waits out sandboxIdleGraceMs (15min) to resume+persist+terminate\n  // it. The observed failure: every drain logs \"drainable box already gone\n  // (NotFound on resume)\", persistWorkspace() never fires, /workspace is lost.\n  // Modal's idle-reap is a SECOND reaper racing OpenGeni's — and it wins. The fix:\n  // OpenGeni OWNS box lifecycle via its reaper + the hard modalTimeoutSeconds\n  // backstop, so the Modal idle-reap must NOT fire first. We default the effective\n  // idle timeout to the hard lifetime (effectiveModalIdleTimeoutSeconds), making\n  // the box survive its full warm window so the reaper can snapshot it. Set this\n  // explicitly (OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS) only to deliberately idle-reap\n  // SOONER than the hard lifetime; the boot invariant forbids a value that would\n  // reap before reaperPeriod + idleGrace elapses.\n  modalIdleTimeoutSeconds: z.coerce.number().int().positive().optional(),\n  // /workspace FILE PERSISTENCE across warm/cold cycles. Directory snapshots\n  // preserve only the durable user workspace, so provider recovery does not\n  // restore an entire machine image or replace the selected rig/base image.\n  // Cold restore derives the mode from its verified native artifact, so existing\n  // serialized sessions remain recoverable; this default governs archive-free\n  // Modal creations only.\n  // `snapshot_filesystem` remains available for explicit compatibility and\n  // immutable rig-image materialization. `tar` is the portable fallback.\n  modalWorkspacePersistence: z\n    .enum([\"tar\", \"snapshot_filesystem\", \"snapshot_directory\"])\n    .default(\"snapshot_directory\"),\n  // Shared desktop toggle: this module reads it for the 6080 port-merge; the\n  // owner module (P4.x) acts on it to launch the display stack.\n  sandboxDesktopEnabled: EnvBoolean.default(false),\n  // Human take-control toggle: when ON (default) the negotiated DesktopStream\n  // cell advertises mode \"interactive\" — the noVNC viewer can drive mouse+keyboard\n  // into :0 (x11vnc runs without -viewonly). Turn it OFF for a genuinely read-only\n  // deployment: the cell reports mode \"read-only\" and the client disables the\n  // \"Take control\" affordance. Independent of computerUseReadOnly (the AGENT\n  // driver); this gates the HUMAN viewer plane.\n  sandboxDesktopInteractive: EnvBoolean.default(true),\n  // REAL PTY terminal toggle (P5.t): gates the ttyd pty-ws plane (7681) the API\n  // mints over the SAME tunnel as the desktop. Defaults ON — the interactive\n  // terminal is a baseline structured-service surface (unlike the heavier desktop\n  // pixel plane); a deployment can turn it off to fall back to the read-only\n  // sse-events command firehose. The 7681 port-merge tracks sandboxDesktopEnabled\n  // (a desktop-capable image is the one that bakes ttyd).\n  sandboxTerminalEnabled: EnvBoolean.default(true),\n  // The desktop framebuffer geometry the pixel plane advertises + launches the\n  // display stack with (P4.2). v1 has no live RANDR resize; a change is a full\n  // down→up restart. Defaults match the proven spike geometry (1280x800).\n  streamResolutionWidth: z.coerce.number().int().positive().default(1280),\n  streamResolutionHeight: z.coerce.number().int().positive().default(800),\n  // P4.3 computer-use: the agent drives the SAME :0 humans watch (xdotool/XTEST +\n  // scrot). Gated by sandboxDesktopEnabled + a desktop-capable backend in\n  // buildAgentCapabilities; computerUseReadOnly:false is the agent-driver default\n  // (it must click/type — the human viewer plane is the read-only one).\n  computerUseEnabled: EnvBoolean.default(true),\n  computerUseReadOnly: EnvBoolean.default(false),\n  // P4.3 recording loop: ffmpeg x11grab of :0 → mp4/webm → @opengeni/storage.\n  // recordingMaxBytes caps the in-memory finalize buffer (≤ storage single-PUT);\n  // recordingMaxSeconds is the ffmpeg -t hard ceiling (bounds a multi-day turn).\n  recordingEnabled: EnvBoolean.default(true),\n  recordingDefaultCodec: z.enum([\"h264-mp4\", \"vp9-webm\"]).default(\"h264-mp4\"),\n  // Workbench v2 turn-end workspace capture. When on, the turn\n  // activity probes the box's changed files off the live box at turn end and\n  // persists a capture revision (blobs in @opengeni/storage) so the workbench\n  // paints cold/offline sessions with zero machine round-trips. Best-effort and\n  // fully behind this flag: off ⇒ capture is skipped and reads fall back to the\n  // live/wake path (status-quo behavior). Default on; explicit per environment.\n  workspaceCaptureEnabled: EnvBoolean.default(true),\n  recordingFramerate: z.coerce.number().int().positive().default(15),\n  recordingMaxSeconds: z.coerce.number().int().positive().default(600),\n  recordingMaxBytes: z.coerce.number().int().positive().default(268_435_456), // 256 MB\n  // --- daytona ---\n  daytonaApiKey: z.string().optional(),\n  daytonaApiUrl: z.string().url().optional(),\n  daytonaTarget: z.string().optional(),\n  daytonaImage: z.string().optional(),\n  daytonaSnapshotName: z.string().optional(),\n  daytonaAutoStopInterval: z.coerce.number().int().nonnegative().optional(), // 0 disables idle-kill\n  daytonaTimeoutSeconds: z.coerce.number().int().positive().optional(),\n  daytonaExposedPortUrlTtlSeconds: z.coerce.number().int().positive().optional(),\n  // --- runloop ---\n  runloopApiKey: z.string().optional(),\n  runloopBaseUrl: z.string().url().optional(),\n  runloopBlueprintName: z.string().optional(),\n  runloopBlueprintId: z.string().optional(),\n  runloopTunnel: EnvBoolean.default(true),\n  runloopKeepAliveSeconds: z.coerce.number().int().positive().optional(),\n  // --- e2b (SDK reads E2B_API_KEY from env; mirrored for validation + forwarding) ---\n  e2bApiKey: z.string().optional(),\n  e2bTemplate: z.string().optional(),\n  e2bTimeoutSeconds: z.coerce.number().int().positive().optional(),\n  e2bTimeoutAction: z.enum([\"pause\", \"kill\"]).optional(),\n  e2bAllowInternetAccess: EnvBoolean.optional(),\n  e2bAutoResume: EnvBoolean.optional(),\n  e2bWorkspacePersistence: z.enum([\"tar\", \"snapshot\"]).optional(),\n  // --- blaxel ---\n  blaxelApiKey: z.string().optional(),\n  blaxelImage: z.string().optional(),\n  blaxelRegion: z.string().optional(),\n  blaxelExposedPortPublic: EnvBoolean.optional(), // public vs bl_preview_token\n  blaxelExposedPortUrlTtlSeconds: z.coerce.number().int().positive().optional(),\n  blaxelMemoryMb: z.coerce.number().int().positive().optional(),\n  blaxelTtl: z.string().optional(),\n  // --- cloudflare (headless) ---\n  cloudflareWorkerUrl: z.string().url().optional(),\n  cloudflareApiKey: z.string().optional(),\n  // --- remote browser placements ---\n  // Provider credentials are injected only into the placement-resident\n  // browserd launch. They never enter session contracts, journals, or sandboxes.\n  browserbaseApiKey: z.string().min(1).max(8192).optional(),\n  kernelApiKey: z.string().min(1).max(8192).optional(),\n  kernelEndpoint: z.string().url().optional(),\n  kernelBrowserTimeoutSeconds: z.coerce.number().int().positive().max(86_400).default(3_600),\n  kernelBrowserStealth: EnvBoolean.default(false),\n  // --- vercel (headless) ---\n  vercelToken: z.string().optional(),\n  vercelProjectId: z.string().optional(),\n  vercelTeamId: z.string().optional(),\n  vercelRuntime: z.string().optional(),\n  // --- sandbox ownership inversion (P1.2 rollout flag, default OFF) ---\n  // The keystone flag for the stateless resume-by-id model. When FALSE the\n  // agent-turn path is BYTE-FOR-BYTE today's build-and-discard behavior (no\n  // lease acquire, no resume-by-id, no non-owned injection). When TRUE the turn\n  // activity acquires the group lease, resumes the one box by id from the lease\n  // envelope, injects it as a NON-OWNED RunConfig session (the SDK never reaps\n  // it — the proven keystone), and releases the holder in finally. Uses\n  // EnvBoolean (NOT z.coerce.boolean(), which would coerce \"false\" -> true and\n  // turn the flag ON the moment anyone set the env var to disable it).\n  sandboxOwnershipEnabled: EnvBoolean.default(false),\n  // --- standalone rig-verifier ownership rollout flag, default OFF ---\n  // Rig verification creates a throwaway provider sandbox outside the normal\n  // session-turn path. When enabled, that sandbox must first acquire the same\n  // durable lease lifecycle used by session boxes so the global orphan sweep\n  // recognizes its exact provider instance. Keep this separate from the general\n  // sandboxOwnershipEnabled rollout: every reaper worker must understand verifier\n  // leases before dispatch is enabled. When false the verifier fails closed before\n  // provider create; it never falls back to the legacy unowned path.\n  rigVerificationLeaseOwnershipEnabled: EnvBoolean.default(false),\n  // --- lazy sandbox provisioning rollout flag, default OFF ---\n  // Only effective when sandboxOwnershipEnabled is ALSO on (lazy provisioning is a\n  // property of the owned path — the SDK never creates/resumes an injected session,\n  // so we control when the box is established). When TRUE, a turn does NOT provision\n  // its box at turn start: the lease acquire + resume-by-id + hooks + downloads +\n  // heartbeat + recording are deferred to an in-process single-flight provisioner\n  // that runs the FIRST time a sandbox op is dispatched (via the routing proxy's\n  // resolveActiveBackend). A turn whose model never calls a sandbox-backed tool ends\n  // with NO lease row and ZERO warm-seconds. When FALSE (or ownership off) the turn\n  // provisions eagerly exactly as today — byte-for-byte. EnvBoolean (NOT\n  // z.coerce.boolean(), which coerces \"false\" -> true and would turn the flag ON the\n  // moment anyone set the env var to disable it).\n  sandboxLazyProvisionEnabled: EnvBoolean.default(false),\n  // --- bring-your-own-compute (selfhosted 11th backend) rollout flag, default OFF ---\n  // The keystone flag for the whole selfhosted feature (the enrollment device-flow,\n  // the NATS control plane, the relay stream tier). When FALSE the enrollment routes\n  // 404 (invisible — the surface does not exist for this deployment) and the\n  // selfhosted backend is inert; boot is unaffected. EnvBoolean (NOT\n  // z.coerce.boolean(), which coerces \"false\" -> true). Flipped per-environment via\n  // the deploy-staging IaC secret/configmap pattern.\n  sandboxSelfhostedEnabled: EnvBoolean.default(false),\n  // Gates the op-stream (streaming exec) transport to Connected Machines. The\n  // runner must ALSO advertise Capabilities.op_stream. Streaming is the default\n  // because it is the only transport that can keep a command alive without an\n  // arbitrary request/reply wall while still supporting replay and cancellation.\n  // Older runners remain usable when an explicit positive exec timeout is set.\n  // EnvBoolean (NOT\n  // z.coerce.boolean(), which coerces \"false\" -> true).\n  agentOpStreamEnabled: EnvBoolean.default(true),\n  // The HMAC secret the control plane signs the enrollment bearer credential with\n  // (the `oge_` envelope the agent presents back to the control plane). Optional:\n  // when ABSENT and sandboxSelfhostedEnabled is on, the poll route reports the\n  // credential plane disabled (graceful degrade, mirrors streamTokenSecret). NEVER\n  // logged. Lives in the opengeni-runtime secret (Helm-clobbered configmap avoided).\n  enrollmentSigningSecret: z.string().optional(),\n  // Connect-info the EnrollmentCredentials hand the agent: the NATS server URL(s)\n  // the agent dials for the control plane, and the relay edge base URL for streams.\n  // The per-workspace NATS Account creds binding is infra-deferred (M4/relay\n  // milestone) — the poll returns these endpoints + a placeholder creds field.\n  selfhostedNatsUrl: z.string().optional(),\n  selfhostedRelayUrl: z.string().optional(),\n  // The HMAC secret the control plane signs the agent's relay PRODUCER token with\n  // (the `ogr_` envelope threaded into EnrollmentCredentials.relayToken; M8b/design\n  // §10.5). The relay verifies the producer token with the SAME secret. Optional:\n  // when ABSENT the poll returns an empty relayToken (graceful degrade — the stream\n  // plane is simply unavailable until configured). Falls back to streamTokenSecret /\n  // delegationSecret (same HMAC family) so a deployment with a stream-token secret\n  // needs no second one. NEVER logged. Lives in the opengeni-runtime secret.\n  selfhostedRelayTokenSecret: z.string().optional(),\n  // The minisign PUBLIC key the agent pins for self-update verification (handed to\n  // the agent in EnrollmentCredentials; the SECRET key lives only in CI).\n  agentUpdatePublicKey: z.string().optional(),\n  // --- NATS auth-callout tenancy boundary (bring-your-own-compute M-AUTH; design\n  //     §10.1 NATS Accounts per workspace + §17 the isolation smoke) -------------\n  // nats-server is configured with AUTH CALLOUT: an external agent connects\n  // presenting its `oge_` enrollment bearer as the connect auth-token; the server\n  // issues an authorization request on $SYS.REQ.USER.AUTH to our responder, which\n  // validates the bearer and returns a SIGNED NATS user JWT scoped to pub/sub ONLY\n  // `agent.<ws>.>` (+ `_INBOX.>`). That per-subject scope IS the per-workspace\n  // isolation. These are deployment-level secrets in the opengeni-runtime secret\n  // (Helm-clobbered configmap avoided), all OPTIONAL: when the callout plane is not\n  // configured the responder simply does not start (selfhosted agents cannot\n  // connect — graceful, never a boot-fail).\n  //\n  // The callout account SIGNING SEED (`SA...`). Both the user JWT and the\n  // authorization-response JWT are signed by this account key; its public key\n  // (`A...`) is the `auth_callout.issuer` in the server config. NEVER logged.\n  selfhostedNatsCalloutAccountSeed: z.string().optional(),\n  // The TARGET ACCOUNT NAME the minted user is placed into (the server-config-mode\n  // `auth_callout.account`, e.g. \"APP\"). The responder writes it as the minted user\n  // JWT `aud` so nats-server binds the agent to this account — the SAME account the\n  // privileged control plane connects into, so `agent.<ws>.<id>.rpc` request/reply\n  // routes. Optional; resolveNatsCalloutConfig defaults it to \"APP\".\n  selfhostedNatsCalloutAccountName: z.string().optional(),\n  // The callout RESPONDER's own NATS login (one of the `auth_callout.auth_users`\n  // in the AUTH account) — the responder connects with this to subscribe\n  // $SYS.REQ.USER.AUTH. Username/password.\n  selfhostedNatsCalloutUser: z.string().optional(),\n  selfhostedNatsCalloutPassword: z.string().optional(),\n  // The PRIVILEGED control-plane login (api/worker): a static account user that may\n  // request `agent.*.rpc` + receive its inbox replies. The event bus + the\n  // selfhosted control RPC ride THIS connection. Username/password; when unset the\n  // bus connects anonymously (local dev / a NATS with no auth_callout).\n  selfhostedNatsControlUser: z.string().optional(),\n  selfhostedNatsControlPassword: z.string().optional(),\n  // --- selfhosted (Connected Machine) control/exec op deadlines ---------------\n  // CONTROL ops (ping / fs / git / desktop / pty) keep a short request timeout so\n  // liveness failures surface promptly. EXEC duration is a different concern: by\n  // default it is unbounded (0), exactly like a command launched by an unrestricted\n  // local agent. The op-stream transport keeps control liveness, replay, and explicit\n  // cancellation independent of command duration. A deployment may opt into a hard\n  // process deadline by setting a positive value; 0 never schedules a process kill.\n  // Knobs: OPENGENI_SANDBOX_SELFHOSTED_EXEC_TIMEOUT_MS (default 0 = none) and\n  // OPENGENI_SANDBOX_SELFHOSTED_CONTROL_TIMEOUT_MS (default 30s).\n  sandboxSelfhostedExecTimeoutMs: z.coerce.number().int().nonnegative().default(0),\n  sandboxSelfhostedControlTimeoutMs: z.coerce.number().int().positive().default(30_000),\n  // --- sandbox lease cadences (cadence invariant validated at boot below) ---\n  // reaperPeriod < viewerHolderTTL, and reaperPeriod + idleGrace < the EFFECTIVE\n  // box idle timeout (effectiveModalIdleTimeoutSeconds, which defaults to the hard\n  // modalTimeoutSeconds). No keep-alive loop: between turns the box survives on its\n  // idle timeout — which we pin high enough (via the idle-timeout default) that\n  // OpenGeni's reaper, not Modal's idle-reap, governs teardown so /workspace is\n  // snapshotted before the box dies (sandbox-file-persistence).\n  sandboxLeaseReaperPeriodMs: z.coerce.number().int().positive().default(30_000),\n  sandboxViewerHolderTtlMs: z.coerce.number().int().positive().default(90_000),\n  // A BrowserSession controller refreshes its durable resource and exact\n  // interaction lease holder together. This longer crash horizon tolerates API\n  // replacement while still releasing a placement whose controller died.\n  sandboxInteractionHolderTtlMs: z.coerce.number().int().positive().default(180_000),\n  // The DRAIN grace: how long a refcount-0 (draining) lease stays WARM before the\n  // reaper resume-by-ids the box and terminates it. This is the cost-vs-snappiness\n  // dial — when the user navigates away the box keeps refcount 0, but it survives\n  // this whole window so a \"glanced away then came back\" re-arms the SAME warm box\n  // (acquireLease re-arms draining->warm; the reaper's BEFORE-terminate re-read\n  // skips a re-armed box). Default 15min so a brief detour never cold-creates a\n  // fresh EMPTY box; lower it to trade warm cost for a snappier reclaim.\n  // getSettings caps the default at half a shorter configured Modal lifetime so\n  // the entire reaper window always fits. Knob: OPENGENI_SANDBOX_IDLE_GRACE_MS.\n  sandboxIdleGraceMs: z.coerce.number().int().positive().default(900_000),\n  // MID-SESSION /workspace snapshot cadence (sandbox-file-persistence). The\n  // reaper's drain-persist only protects boxes the reaper itself kills; a box\n  // that dies any other way (Modal's hard creation-time timeout on a session\n  // busy past it, provider OOM/infra death) loses everything since the last\n  // clean drain. While a turn holds the box, the turn heartbeat and turn-end\n  // both take a snapshot when at least this interval has passed since the last\n  // one (same epoch-fenced fold-onto-lease seam as the drain), bounding the\n  // worst-case loss of ANY unclean box death to this window. 0 disables.\n  // Knob: OPENGENI_SANDBOX_SNAPSHOT_INTERVAL_MS. Default 15min.\n  sandboxSnapshotIntervalMs: z.coerce.number().int().min(0).default(900_000),\n  // Maximum time a best-effort /workspace snapshot capture may hold turn/reaper\n  // cleanup. A hung provider snapshot must never pin a lease holder, block\n  // graceful shutdown, or become permission to GC an older archive. Timeout is\n  // treated exactly like a failed best-effort snapshot. Knob:\n  // OPENGENI_SANDBOX_SNAPSHOT_TIMEOUT_MS. Default 60s.\n  sandboxSnapshotTimeoutMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS)\n    .default(60_000),\n  // Begin a controlled snapshot/quiesce/drain/rematerialize transition this far\n  // ahead of a finite provider deadline. Modal's 24h creation clock cannot be\n  // extended; the logical sandbox outlives it by moving to one successor box.\n  // getSettings derives the actual default as min(1h, half the configured\n  // provider lifetime) so short-lived test/canary boxes remain bootable without\n  // an extra coupled environment override. An explicit value may be larger when\n  // an operator deliberately wants more rotation headroom; the boot invariant\n  // still requires it to remain below the provider lifetime.\n  sandboxRotationLeadMs: z.coerce.number().int().positive().default(3_600_000),\n  // Bound provider-deadline rotation admission independently of execution.\n  // Every admitted box receives its own durable drain child; the control worker\n  // limits provider I/O to 32 concurrent activities. Matching that bound avoids\n  // both the old one-box-per-tick deadline backlog and an unbounded provider/API\n  // burst. Operators may tune this for a differently-sized worker pool.\n  sandboxRotationBatchSize: z.coerce.number().int().positive().max(500).default(32),\n  // expires_at refresh window for a held lease (>> the turn 10s heartbeat so a\n  // single missed heartbeat never TTL-reaps a live turn). The warming TTL is the\n  // window a cold->warming spawner has to commit warm before a reaper resets it.\n  sandboxLeaseTtlMs: z.coerce.number().int().positive().default(90_000),\n  sandboxLeaseWarmingTtlMs: z.coerce.number().int().positive().default(120_000),\n  // Overall user-facing budget for warming a sandbox lease. Unlike the lease TTL\n  // (a liveness/reaper cadence), this bounds how long one turn waits for capacity\n  // or provider creation before surfacing a clear turn.failed error.\n  sandboxWarmingTimeoutMs: z.coerce.number().int().positive().default(600_000),\n  // Rig setup-script budget (M3): the wall-clock timeout the rig-setup lifecycle\n  // hook runs its script under, distinct from the 120s per-command lifecycle\n  // default (a rig may compile/install heavy tooling on first cold create).\n  // Env: OPENGENI_RIG_SETUP_TIMEOUT_MS. Default 10min.\n  rigSetupTimeoutMs: z.coerce.number().int().positive().default(600_000),\n  // --- sandbox warm-time billing (P2.1) ---\n  // Per-backend warm rate (usd_micros/sec), like modelPricingJson: an empty {}\n  // means warm-cost is not debited (warm-seconds are still metered for audit).\n  // Shape: { \"modal\": 5, \"runloop\": 4, ... }. Backends absent here meter\n  // warm-seconds but accrue NO warm_cost / debit (rate 0).\n  sandboxWarmRateMicrosPerSecondJson: z.string().default(\"{}\"),\n  // Per-workspace warm cap (cumulative warm-seconds since the start of the UTC\n  // month, summed over sandbox.warm_seconds). 0 = unbounded. A workspace over the\n  // cap force-drains its VIEWER-ONLY boxes (guarded AND turn_holders=0 — a paying\n  // turn is never killed); the reaper then stop()s at refcount 0.\n  sandboxMaxWarmSecondsPerWorkspace: z.coerce.number().int().nonnegative().default(0),\n  sandboxPreparationProfiles: z.string().default(\"none\"),\n  sandboxEnvAllowlist: z.string().default(\"\"),\n  objectStorageEndpoint: z.string().url().optional(),\n  objectStorageInternalEndpoint: z.string().url().optional(),\n  objectStorageSandboxEndpoint: z.string().url().optional(),\n  objectStorageBackend: z\n    .enum([\"s3-compatible\", \"aws-s3\", \"azure-blob\", \"gcs\"])\n    .default(\"s3-compatible\"),\n  objectStorageBucket: z.string().min(1).default(\"opengeni-files\"),\n  objectStorageRegion: z.string().min(1).default(\"us-east-1\"),\n  objectStorageS3Provider: z.string().min(1).default(\"Minio\"),\n  objectStorageAccessKeyId: z.string().optional(),\n  objectStorageSecretAccessKey: z.string().optional(),\n  objectStorageForcePathStyle: EnvBoolean.default(true),\n  objectStorageAzureConnectionString: z.string().optional(),\n  objectStorageAzureAccountName: z.string().optional(),\n  objectStorageAzureAccountKey: z.string().optional(),\n  objectStorageAzureEndpoint: z.string().url().optional(),\n  objectStorageGcsProjectId: z.string().optional(),\n  objectStorageGcsCredentialsJson: z.string().optional(),\n  objectStorageGcsKeyFilename: z.string().optional(),\n  objectStorageGcsApiEndpoint: z.string().url().optional(),\n  documentParser: z.string().min(1).default(\"liteparse\"),\n  documentChunkSize: z.coerce.number().int().positive().default(1200),\n  documentChunkOverlap: z.coerce.number().int().nonnegative().default(160),\n  documentEmbeddingProvider: z.enum([\"openai\", \"deterministic\"]).default(\"openai\"),\n  documentEmbeddingModel: z.string().min(1).default(\"text-embedding-3-large\"),\n  documentEmbeddingDimensions: z.coerce.number().int().positive().default(3072),\n  documentEmbeddingApiKey: z.string().optional(),\n  documentEmbeddingBaseUrl: z.string().url().optional(),\n  documentCurationProvider: z.enum([\"openai\", \"heuristic\", \"none\"]).default(\"openai\"),\n  documentCurationModel: z.string().min(1).default(\"gpt-4o-mini\"),\n  documentCurationApiKey: z.string().optional(),\n  documentCurationBaseUrl: z.string().url().optional(),\n  gitAuthorName: z.string().optional(),\n  gitAuthorEmail: z.string().optional(),\n  gitCommitterName: z.string().optional(),\n  gitCommitterEmail: z.string().optional(),\n  githubAppManifestBaseUrl: z.string().optional(),\n  githubAppManifestStateSecret: z.string().optional(),\n  githubAppId: z.string().optional(),\n  githubClientId: z.string().optional(),\n  githubClientSecret: z.string().optional(),\n  githubAppSlug: z.string().optional(),\n  githubWebhookSecret: z.string().optional(),\n  githubAppPrivateKey: z.string().optional(),\n  betterAuthSecret: z.string().optional(),\n  betterAuthAllowedHosts: z.string().default(\"\"),\n  betterAuthCookieDomain: z.string().optional(),\n  betterAuthTrustedOrigins: z.string().default(\"\"),\n  resendApiKey: z.string().optional(),\n  emailFrom: z.string().default(\"OpenGeni <auth@mail.opengeni.ai>\"),\n  stripeSecretKey: z.string().optional(),\n  stripePublishableKey: z.string().optional(),\n  stripeWebhookSecret: z.string().optional(),\n  stripeCreditsProductId: z.string().optional(),\n  mcpServers: z\n    .array(\n      z.object({\n        id: z.string().min(1).regex(registryId),\n        name: z.string().min(1).optional(),\n        url: z.string().url(),\n        allowedTools: z.array(z.string().min(1)).optional(),\n        timeoutMs: z.number().int().positive().optional(),\n        cacheToolsList: z.boolean().default(false),\n        /** Runtime approval policy, overlaid from an attempt-frozen session snapshot. */\n        requireApproval: SessionMcpApprovalPolicy.optional(),\n        /**\n         * Extra request headers sent to this MCP server (credential injection\n         * for workspace-enabled capability MCPs). Populated at runtime from\n         * encrypted capability-installation credentials; do not put secrets in\n         * OPENGENI_MCP_SERVERS.\n         */\n        headers: z.record(z.string(), z.string()).optional(),\n        connectionRef: McpServerConnectionRefSchema.optional(),\n      }),\n    )\n    .default([]),\n});\n\nexport type Settings = z.infer<typeof SettingsSchema>;\nexport type McpServerConfig = Settings[\"mcpServers\"][number];\n\n/** Declarative voice-input transcription provider ids. */\nexport type VoiceInputProviderId =\n  | \"openai\"\n  | \"azure-openai\"\n  | \"codex-subscription\"\n  | \"supergrok-subscription\";\n\nexport type VoiceInputProviderConfig =\n  | {\n      id: \"openai\";\n      kind: \"openai\";\n      apiKey: string;\n      baseUrl: string;\n      model: string;\n    }\n  | {\n      id: \"azure-openai\";\n      kind: \"azure-openai\";\n      endpoint: string;\n      deployment: string;\n      apiVersion: string;\n      apiKey: string | null;\n      adToken: string | null;\n    }\n  | {\n      id: \"codex-subscription\";\n      kind: \"codex-subscription\";\n      experimental: true;\n    }\n  | {\n      id: \"supergrok-subscription\";\n      kind: \"supergrok-subscription\";\n      experimental: true;\n    };\n\n/**\n * Reject empty / template secrets so `.env.example` placeholders like\n * `your-key` cannot advertise voice input as available and then 401 upstream.\n */\nexport function isUsableVoiceInputSecret(value: string | null | undefined): value is string {\n  if (value == null) return false;\n  const trimmed = value.trim();\n  if (!trimmed) return false;\n  const normalized = trimmed.toLowerCase();\n  if (\n    normalized === \"your-key\" ||\n    normalized === \"your_key\" ||\n    normalized === \"changeme\" ||\n    normalized === \"replace-me\" ||\n    normalized === \"xxx\" ||\n    normalized.startsWith(\"your-\") ||\n    normalized.startsWith(\"your_\")\n  ) {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Resolve the configured voice-input provider registry in selection order.\n * Credentials stay in this server-side structure; ClientConfig only projects\n * whether at least one non-experimental (or probed experimental) provider exists.\n */\nexport function resolveVoiceInputProviderRegistry(settings: Settings): VoiceInputProviderConfig[] {\n  const order = settings.voiceInputProviderOrder\n    .split(\",\")\n    .map((part) => part.trim())\n    .filter(\n      (part): part is VoiceInputProviderId =>\n        part === \"openai\" ||\n        part === \"azure-openai\" ||\n        part === \"codex-subscription\" ||\n        part === \"supergrok-subscription\",\n    );\n  const seen = new Set<VoiceInputProviderId>();\n  const providers: VoiceInputProviderConfig[] = [];\n  for (const id of order) {\n    if (seen.has(id)) continue;\n    seen.add(id);\n    if (id === \"openai\") {\n      if (!settings.voiceInputOpenaiEnabled) continue;\n      const apiKey = settings.voiceInputOpenaiApiKey ?? settings.openaiApiKey;\n      if (!isUsableVoiceInputSecret(apiKey)) continue;\n      // When the turn provider is Azure-only and no voice-specific OpenAI key/URL\n      // was set, do not silently reuse a leftover OPENAI_API_KEY for voice.\n      if (\n        settings.openaiProvider === \"azure\" &&\n        !settings.voiceInputOpenaiApiKey &&\n        !settings.voiceInputOpenaiBaseUrl\n      ) {\n        continue;\n      }\n      providers.push({\n        id: \"openai\",\n        kind: \"openai\",\n        apiKey,\n        baseUrl: (\n          settings.voiceInputOpenaiBaseUrl ??\n          settings.openaiBaseUrl ??\n          \"https://api.openai.com/v1\"\n        ).replace(/\\/+$/, \"\"),\n        model: settings.voiceInputOpenaiModel,\n      });\n      continue;\n    }\n    if (id === \"azure-openai\") {\n      if (!settings.voiceInputAzureEnabled) continue;\n      const endpoint = (\n        settings.voiceInputAzureEndpoint ??\n        settings.azureOpenaiEndpoint ??\n        \"\"\n      ).replace(/\\/+$/, \"\");\n      const deployment = settings.voiceInputAzureDeployment ?? settings.azureOpenaiDeployment ?? \"\";\n      const apiVersion =\n        settings.voiceInputAzureApiVersion ??\n        settings.azureOpenaiApiVersion ??\n        \"2025-04-01-preview\";\n      const apiKey = settings.voiceInputAzureApiKey ?? settings.azureOpenaiApiKey ?? null;\n      const adToken = settings.voiceInputAzureAdToken ?? settings.azureOpenaiAdToken ?? null;\n      if (\n        !endpoint ||\n        !deployment ||\n        (!isUsableVoiceInputSecret(apiKey) && !isUsableVoiceInputSecret(adToken))\n      ) {\n        continue;\n      }\n      // When turn provider is OpenAI-only and no voice-specific Azure settings\n      // were provided, skip ambient Azure leftovers.\n      if (\n        settings.openaiProvider !== \"azure\" &&\n        !settings.voiceInputAzureEndpoint &&\n        !settings.voiceInputAzureDeployment &&\n        !settings.voiceInputAzureApiKey &&\n        !settings.voiceInputAzureAdToken\n      ) {\n        continue;\n      }\n      providers.push({\n        id: \"azure-openai\",\n        kind: \"azure-openai\",\n        endpoint,\n        deployment,\n        apiVersion,\n        apiKey: isUsableVoiceInputSecret(apiKey) ? apiKey : null,\n        adToken: isUsableVoiceInputSecret(adToken) ? adToken : null,\n      });\n      continue;\n    }\n    if (id === \"codex-subscription\") {\n      // Prefer Codex STT whenever subscription model routing is enabled.\n      // Operators who want OpenAI/Azure first should set PROVIDER_ORDER; omit\n      // `codex-subscription` from the order to disable Codex voice while keeping\n      // subscription turns. VOICE_INPUT_CODEX_EXPERIMENTAL is retained for\n      // back-compat docs/env but no longer gates inclusion.\n      if (!settings.codexSubscriptionEnabled) continue;\n      providers.push({\n        id: \"codex-subscription\",\n        kind: \"codex-subscription\",\n        experimental: true,\n      });\n      continue;\n    }\n    if (id === \"supergrok-subscription\") {\n      if (!settings.supergrokSubscriptionEnabled) continue;\n      providers.push({\n        id: \"supergrok-subscription\",\n        kind: \"supergrok-subscription\",\n        experimental: true,\n      });\n    }\n  }\n  return providers;\n}\n\n/** True when the deployment has at least one supported (non-experimental) provider. */\nexport function voiceInputDeploymentConfigured(settings: Settings): boolean {\n  return resolveVoiceInputProviderRegistry(settings).some(\n    (provider) =>\n      provider.kind !== \"codex-subscription\" && provider.kind !== \"supergrok-subscription\",\n  );\n}\n\nexport type TemporalTlsConnectionConfig = {\n  serverNameOverride?: string;\n  serverRootCACertificate?: Uint8Array;\n  clientCertPair?: {\n    crt: Uint8Array;\n    key: Uint8Array;\n  };\n};\nexport type TemporalConnectionOptions = {\n  address: string;\n  tls?: true | TemporalTlsConnectionConfig;\n  apiKey?: string;\n};\nexport type ModelPricing = {\n  inputMicrosPerMillionTokens: number;\n  cachedInputMicrosPerMillionTokens?: number | undefined;\n  outputMicrosPerMillionTokens: number;\n  marginBps?: number | undefined;\n};\nexport type ModelPricingScheduleV1 = {\n  default: ModelPricing;\n  inputTokenTiers?:\n    | Array<{\n        minimumInputTokens: number;\n        pricing: ModelPricing;\n      }>\n    | undefined;\n};\nexport type ModelUsageInput = {\n  inputTokens?: number | undefined;\n  outputTokens?: number | undefined;\n  totalTokens?: number | undefined;\n  inputTokensDetails?: Record<string, number> | Array<Record<string, number>> | undefined;\n  requestUsageEntries?: ModelUsageInput[] | undefined;\n};\n\nexport type ModelUsageCostBreakdown = {\n  /** Provider-rate cost basis for the exact usage, before OpenGeni margin. */\n  providerCostMicros: number;\n  /** OpenGeni credit price after configured margin and latency-mode multiplier. */\n  creditCostMicros: number;\n};\n\nexport type StaticUsageLimitsConfig = StaticUsageLimits;\nexport type EntitlementsConfig = Entitlements;\n\nconst ModelPricingSchema = z.object({\n  inputMicrosPerMillionTokens: z.number().int().nonnegative(),\n  cachedInputMicrosPerMillionTokens: z.number().int().nonnegative().optional(),\n  outputMicrosPerMillionTokens: z.number().int().nonnegative(),\n  marginBps: z.number().int().min(0).max(100_000).optional(),\n});\n\nconst ModelPricingScheduleSchema = z\n  .object({\n    default: ModelPricingSchema,\n    inputTokenTiers: z\n      .array(\n        z.object({\n          minimumInputTokens: z.number().int().nonnegative(),\n          pricing: ModelPricingSchema,\n        }),\n      )\n      .optional(),\n  })\n  .superRefine((schedule, ctx) => {\n    let previous = -1;\n    for (const [index, tier] of (schedule.inputTokenTiers ?? []).entries()) {\n      if (tier.minimumInputTokens <= previous) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"inputTokenTiers\", index, \"minimumInputTokens\"],\n          message: \"input-token tier thresholds must be strictly increasing\",\n        });\n      }\n      previous = tier.minimumInputTokens;\n    }\n  });\n\nexport const CapabilitySupportV1 = z.enum([\"supported\", \"unsupported\", \"unknown\"]);\nexport type CapabilitySupportV1 = z.infer<typeof CapabilitySupportV1>;\n\nexport const CapabilityStateV1Schema = z\n  .object({\n    upstream: CapabilitySupportV1,\n    runnable: z.boolean(),\n  })\n  .superRefine((state, ctx) => {\n    if (state.upstream === \"unsupported\" && state.runnable) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"runnable\"],\n        message: \"an upstream-unsupported capability cannot be runnable\",\n      });\n    }\n  });\nexport type CapabilityStateV1 = z.infer<typeof CapabilityStateV1Schema>;\n\nconst ModelModalityV1 = z.enum([\"text\", \"image\", \"audio\"]);\nconst ModelLatencyModeV1 = z.enum([\"standard\", \"priority\", \"fast\"]);\n\nexport const ModelCapabilitiesV1Schema = z\n  .object({\n    reasoning: CapabilityStateV1Schema.extend({\n      efforts: z.array(ReasoningEffort),\n      defaultEffort: ReasoningEffort.nullable(),\n      required: z.boolean(),\n    }),\n    functionCalling: CapabilityStateV1Schema,\n    structuredOutput: CapabilityStateV1Schema,\n    hostedTools: z.object({\n      webSearch: CapabilityStateV1Schema,\n      xSearch: CapabilityStateV1Schema,\n      codeExecution: CapabilityStateV1Schema,\n      imageGeneration: CapabilityStateV1Schema.default({\n        upstream: \"unknown\",\n        runnable: false,\n      }),\n    }),\n    inputModalities: z.array(ModelModalityV1).min(1),\n    /** Exact MIME types accepted as typed `input_file`; `text/*` is allowed. */\n    inputFileMediaTypes: z.array(z.string()).default([]),\n    outputModalities: z.array(ModelModalityV1).min(1),\n    transports: z.object({\n      sse: CapabilityStateV1Schema,\n      responsesWebSocket: CapabilityStateV1Schema,\n      realtimeAudio: CapabilityStateV1Schema,\n    }),\n    promptCaching: CapabilityStateV1Schema.extend({\n      mode: z.enum([\"implicit\", \"automatic\", \"none\"]),\n    }).optional(),\n    latencyModes: z\n      .array(\n        z.object({\n          id: ModelLatencyModeV1,\n          upstream: CapabilitySupportV1,\n          runnable: z.boolean(),\n          billingMultiplierBps: z.number().int().positive().optional(),\n        }),\n      )\n      .min(1),\n  })\n  .superRefine((capabilities, ctx) => {\n    const efforts = new Set(capabilities.reasoning.efforts);\n    if (efforts.size !== capabilities.reasoning.efforts.length) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reasoning\", \"efforts\"],\n        message: \"reasoning efforts must be unique\",\n      });\n    }\n    if (\n      capabilities.reasoning.defaultEffort !== null &&\n      !efforts.has(capabilities.reasoning.defaultEffort)\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reasoning\", \"defaultEffort\"],\n        message: \"the default reasoning effort must be one of the supported efforts\",\n      });\n    }\n    if (capabilities.reasoning.runnable && capabilities.reasoning.efforts.length === 0) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reasoning\", \"efforts\"],\n        message: \"a runnable reasoning capability must declare at least one effort\",\n      });\n    }\n    for (const field of [\"inputModalities\", \"outputModalities\"] as const) {\n      if (new Set(capabilities[field]).size !== capabilities[field].length) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [field],\n          message: `${field} must be unique`,\n        });\n      }\n    }\n    const latencyIds = new Set<string>();\n    for (const [index, mode] of capabilities.latencyModes.entries()) {\n      if (latencyIds.has(mode.id)) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"latencyModes\", index, \"id\"],\n          message: \"latency mode ids must be unique\",\n        });\n      }\n      latencyIds.add(mode.id);\n      if (mode.upstream === \"unsupported\" && mode.runnable) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"latencyModes\", index, \"runnable\"],\n          message: \"an upstream-unsupported latency mode cannot be runnable\",\n        });\n      }\n    }\n  });\nexport type ModelCapabilitiesV1 = z.infer<typeof ModelCapabilitiesV1Schema>;\n\nexport type ModelDeploymentV1 = {\n  upstreamModelId: string;\n  wireApi: ModelProviderApi;\n};\n\nexport type ModelExecutionLimitsV1 = {\n  contextWindowTokens: number | null;\n  effectiveContextWindowTokens: number | null;\n  autoCompactTokenLimit: number | null;\n  toolOutputTruncationTokens: number | null;\n};\n\nexport type CredentialSourceV1 =\n  | { kind: \"deployment\"; mechanism: \"api_key\" | \"azure_ad_bearer\" }\n  | { kind: \"connected_subscription\"; provider: \"codex\" | \"xai\" }\n  | { kind: \"workspace_connection\"; mechanism: \"api_key\" };\n\nexport type BillingAttributionV1 = {\n  upstreamPayer: \"deployment\" | \"workspace\" | \"connected_subscription\";\n  metering: \"opengeni_credits\" | \"external\";\n};\n\n/**\n * Wire API a provider speaks. The built-in OpenAI/Azure provider always uses\n * \"responses\" (the OpenAI Responses API). Extra registry providers default to\n * \"chat\" (the broadly compatible /v1/chat/completions surface); Fireworks is\n * wired as \"chat\" because its beta Responses endpoint echoes input back and\n * silently no-ops hosted tools (see docs/model-providers.md).\n */\nexport const ModelProviderApi = z.enum([\"responses\", \"chat\"]);\nexport type ModelProviderApi = z.infer<typeof ModelProviderApi>;\n\n/**\n * Registry provider kind. \"api-key\" providers carry their own static key/headers;\n * connected-subscription providers resolve a workspace account token at call\n * time and never carry a static key in the registry definition.\n */\nexport const RegistryProviderKind = z.enum([\n  \"api-key\",\n  \"codex-subscription\",\n  \"xai-subscription\",\n  \"vercel-gateway-managed\",\n  \"vercel-gateway-workspace\",\n]);\nexport type RegistryProviderKind = z.infer<typeof RegistryProviderKind>;\n\n/** A single model exposed by a registry provider. */\nconst RegistryModelSchema = z\n  .object({\n    id: z.string().min(1), // canonical OpenGeni product id\n    upstreamModelId: z.string().min(1).optional(), // exact provider slug; defaults to id\n    aliases: z.array(z.string().min(1)).optional(), // accepted input only; never sent upstream\n    label: z.string().min(1).optional(), // display name; defaults to id\n    shortLabel: z.string().min(1).max(64).optional(), // compact UI label; optional\n    contextWindowTokens: z.number().int().positive().optional(),\n    effectiveContextWindowTokens: z.number().int().positive().optional(),\n    autoCompactTokenLimit: z.number().int().positive().optional(),\n    // Canonical model-facing function/tool-result policy. The runtime applies\n    // the same 1.2x serialization allowance as Codex when materializing output.\n    toolOutputTruncationTokens: z.number().int().positive().optional(),\n    reasoningEffort: z.boolean().optional(), // legacy compatibility input/projection\n    hostedWebSearch: z.boolean().optional(), // legacy compatibility input/projection\n    capabilities: ModelCapabilitiesV1Schema.optional(),\n    pricing: z.union([ModelPricingSchema, ModelPricingScheduleSchema]).optional(),\n    // Reserved normalized contracts are derived by OpenGeni in V1. Generic\n    // registry JSON must not opt itself into workspace BYOK or reattribute cost.\n    credentialSource: z.never().optional(),\n    billing: z.never().optional(),\n  })\n  .superRefine((model, ctx) => {\n    if (\n      model.capabilities &&\n      model.reasoningEffort !== undefined &&\n      model.reasoningEffort !== model.capabilities.reasoning.runnable\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reasoningEffort\"],\n        message: \"legacy reasoningEffort must agree with capabilities.reasoning.runnable\",\n      });\n    }\n    if (\n      model.capabilities &&\n      model.hostedWebSearch !== undefined &&\n      model.hostedWebSearch !== model.capabilities.hostedTools.webSearch.runnable\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"hostedWebSearch\"],\n        message:\n          \"legacy hostedWebSearch must agree with capabilities.hostedTools.webSearch.runnable\",\n      });\n    }\n  });\n\n/** A non-built-in provider declared by the host via OPENGENI_MODEL_PROVIDERS_JSON. */\nconst RegistryProviderSchema = z.object({\n  kind: RegistryProviderKind.default(\"api-key\"),\n  id: z.string().min(1).regex(registryId), // stable provider id, e.g. \"fireworks\"\n  label: z.string().min(1).optional(),\n  api: ModelProviderApi.default(\"chat\"),\n  baseUrl: z.string().url(),\n  apiKey: z.string().optional(), // inline key (pragmatic) ...\n  apiKeyEnv: z.string().optional(), // ... OR name of the env var holding the key (preferred)\n  defaultQuery: z.record(z.string(), z.string()).optional(),\n  defaultHeaders: z.record(z.string(), z.string()).optional(),\n  publicDefaultQueryNames: z.array(z.string().min(1)).optional(),\n  publicDefaultHeaderNames: z.array(z.string().min(1)).optional(),\n  // V1 derives these from provider kind. Workspace BYOK is deliberately not a\n  // registry switch and requires a separately reviewed encrypted broker.\n  credentialSource: z.never().optional(),\n  billing: z.never().optional(),\n  models: z.array(RegistryModelSchema).min(1),\n});\nexport type RegistryProvider = z.infer<typeof RegistryProviderSchema>;\n\nexport const IntegrationOAuthClientConfigSchema = z.object({\n  clientId: z.string().min(1),\n  clientSecret: z.string().min(1).optional(),\n  tokenEndpointAuthMethod: z\n    .enum([\"none\", \"client_secret_post\", \"client_secret_basic\"])\n    .default(\"none\"),\n});\nexport type IntegrationOAuthClientConfig = z.infer<typeof IntegrationOAuthClientConfigSchema>;\n\n/**\n * Runtime-resolved provider (built-in or registry), client-construction-ready.\n * The built-in OpenAI/Azure provider is always present and always \"responses\";\n * registry providers carry their own base URL / key / wire API. Compaction is\n * not a provider capability: all providers use the same durable plaintext\n * replacement.\n */\nexport interface ResolvedModelProvider {\n  id: string; // \"openai\" | \"azure\" | registry id\n  label: string;\n  kind: RegistryProviderKind; // \"api-key\" (built-ins + most registry) | \"codex-subscription\"\n  api: ModelProviderApi;\n  builtin: boolean;\n  baseUrl?: string | undefined;\n  apiKey?: string | undefined;\n  defaultQuery?: Record<string, string> | undefined;\n  defaultHeaders?: Record<string, string> | undefined;\n  publicDefaultQueryNames?: string[] | undefined;\n  publicDefaultHeaderNames?: string[] | undefined;\n  credentialSource: CredentialSourceV1;\n  billing: BillingAttributionV1;\n}\n\n/** A single exposed model + the provider that serves it. */\nexport interface ConfiguredModel {\n  schemaVersion: 1;\n  id: string;\n  aliases: string[];\n  label: string;\n  /** Optional curated compact label for dense UI (e.g. mobile composer). */\n  shortLabel?: string | undefined;\n  providerId: string;\n  providerLabel: string;\n  api: ModelProviderApi;\n  upstreamModelId: string;\n  deployment: ModelDeploymentV1;\n  executionLimits: ModelExecutionLimitsV1;\n  credentialSource: CredentialSourceV1;\n  billing: BillingAttributionV1;\n  capabilities: ModelCapabilitiesV1;\n  requestPolicy?: {\n    gateway: {\n      only: [string, ...string[]];\n      caching: \"auto\" | \"none\";\n    };\n  };\n  pricing?: ModelPricingScheduleV1 | undefined;\n  definitionVersion: string;\n  contextWindowTokens?: number | undefined;\n  effectiveContextWindowTokens?: number | undefined;\n  autoCompactTokenLimit?: number | undefined;\n  toolOutputTruncationTokens?: number | undefined;\n  reasoningEffort: boolean;\n  hostedWebSearch: boolean;\n}\n\nexport const VERCEL_AI_GATEWAY_BASE_URL = \"https://ai-gateway.vercel.sh/v1\" as const;\nexport const VERCEL_AI_GATEWAY_AI_SDK_BASE_URL = \"https://ai-gateway.vercel.sh/v4/ai\" as const;\nexport const OPENGENI_GATEWAY_PROVIDER_ID = \"opengeni-gateway\" as const;\nexport const WORKSPACE_GATEWAY_PROVIDER_ID = \"workspace-gateway\" as const;\nexport const WORKSPACE_GATEWAY_MODEL_ID_PREFIX = \"workspace-gateway/\" as const;\nexport const VERCEL_AI_GATEWAY_CONNECTION_DOMAIN = \"ai-gateway.vercel.sh\" as const;\nexport const VERCEL_AI_GATEWAY_CONNECTION_ROLE = \"vercel_ai_gateway\" as const;\n\nexport const CODEX_REALTIME_MODEL_ID = \"gpt-live-1-boulder-alpha\" as const;\nexport const SUPERGROK_REALTIME_MODEL_ID = \"supergrok/grok-voice-think-fast-2.0\" as const;\nexport const OPENGENI_REALTIME_MODEL_ID_PREFIX = \"opengeni-gateway/\" as const;\nexport const WORKSPACE_REALTIME_MODEL_ID_PREFIX = \"workspace-gateway/\" as const;\n\n/** Curated voice models exposed through AI Gateway's normalized realtime API. */\nexport const AI_GATEWAY_REALTIME_MODELS = {\n  openaiRealtime21: {\n    upstreamModelId: \"openai/gpt-realtime-2.1\",\n    managedModelId: `${OPENGENI_REALTIME_MODEL_ID_PREFIX}openai/gpt-realtime-2.1`,\n    workspaceModelId: `${WORKSPACE_REALTIME_MODEL_ID_PREFIX}openai/gpt-realtime-2.1`,\n    label: \"GPT Realtime 2.1\",\n    description: \"Best overall voice intelligence\",\n  },\n  openaiRealtimeMini: {\n    upstreamModelId: \"openai/gpt-realtime-mini\",\n    managedModelId: `${OPENGENI_REALTIME_MODEL_ID_PREFIX}openai/gpt-realtime-mini`,\n    workspaceModelId: `${WORKSPACE_REALTIME_MODEL_ID_PREFIX}openai/gpt-realtime-mini`,\n    label: \"GPT Realtime Mini\",\n    description: \"Faster, lighter live voice\",\n  },\n  grokVoiceThinkFast20: {\n    upstreamModelId: \"xai/grok-voice-think-fast-2.0\",\n    managedModelId: `${OPENGENI_REALTIME_MODEL_ID_PREFIX}xai/grok-voice-think-fast-2.0`,\n    workspaceModelId: `${WORKSPACE_REALTIME_MODEL_ID_PREFIX}xai/grok-voice-think-fast-2.0`,\n    label: \"Grok Voice Think Fast 2.0\",\n    description: \"Fast, natural xAI voice\",\n  },\n} as const;\n\nexport type AiGatewayRealtimeModel =\n  (typeof AI_GATEWAY_REALTIME_MODELS)[keyof typeof AI_GATEWAY_REALTIME_MODELS];\n\nexport function resolveAiGatewayRealtimeModel(\n  modelId: string,\n): { source: \"managed\" | \"workspace\"; upstreamModelId: string } | null {\n  for (const model of Object.values(AI_GATEWAY_REALTIME_MODELS)) {\n    if (model.managedModelId === modelId) {\n      return { source: \"managed\", upstreamModelId: model.upstreamModelId };\n    }\n    if (model.workspaceModelId === modelId) {\n      return { source: \"workspace\", upstreamModelId: model.upstreamModelId };\n    }\n  }\n  return null;\n}\n\nexport const OPENGENI_GATEWAY_MODELS = {\n  deepseek: {\n    productId: \"deepseek-v4-flash-0731\",\n    workspaceProductId: `${WORKSPACE_GATEWAY_MODEL_ID_PREFIX}deepseek-v4-flash-0731`,\n    upstreamModelId: \"deepseek/deepseek-v4-flash-0731\",\n    label: \"DeepSeek V4 Flash 0731\",\n    shortLabel: \"V4 Flash\",\n    providers: [\"baseten\", \"novita\", \"deepinfra\"],\n    implicitCaching: true,\n  },\n  kimi: {\n    productId: \"kimi-k3\",\n    workspaceProductId: `${WORKSPACE_GATEWAY_MODEL_ID_PREFIX}kimi-k3`,\n    upstreamModelId: \"moonshotai/kimi-k3\",\n    label: \"Kimi K3\",\n    shortLabel: \"Kimi K3\",\n    providers: [\"baseten\", \"fireworks\"],\n    implicitCaching: true,\n  },\n} as const;\n\n/**\n * Built-in OpenGeni credit pricing schedules.\n *\n * Rates are provider list prices in USD micros per 1M tokens. Debit applies\n * `marginBps` (2_500 = +25%) on top. Long-context tiers follow OpenAI's\n * \">272K input tokens\" rule (threshold exclusive of 272_000).\n *\n * GPT-5.4 and older families are intentionally omitted — they are no longer\n * offered. Codex / connected-subscription turns use `metering: external` and\n * never consult this map.\n *\n * When adding or changing a billed model, run `bun run check:model-pricing`\n * (see docs/model-providers.md § Price audit). That compares this map to\n * llm-prices.com as a ground-truth canary; it does not generate this table.\n */\nexport const defaultModelPricing: Record<string, ModelPricingScheduleV1> = {\n  \"gpt-5.6-sol\": {\n    default: {\n      inputMicrosPerMillionTokens: 5_000_000,\n      cachedInputMicrosPerMillionTokens: 500_000,\n      outputMicrosPerMillionTokens: 30_000_000,\n      marginBps: 2_500,\n    },\n    inputTokenTiers: [\n      {\n        // OpenAI: prompts with >272K input tokens use the long-context rate.\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 10_000_000,\n          cachedInputMicrosPerMillionTokens: 1_000_000,\n          outputMicrosPerMillionTokens: 45_000_000,\n          marginBps: 2_500,\n        },\n      },\n    ],\n  },\n  \"gpt-5.6-terra\": {\n    default: {\n      inputMicrosPerMillionTokens: 2_000_000,\n      cachedInputMicrosPerMillionTokens: 200_000,\n      outputMicrosPerMillionTokens: 12_000_000,\n      marginBps: 2_500,\n    },\n    inputTokenTiers: [\n      {\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 4_000_000,\n          cachedInputMicrosPerMillionTokens: 400_000,\n          outputMicrosPerMillionTokens: 18_000_000,\n          marginBps: 2_500,\n        },\n      },\n    ],\n  },\n  \"gpt-5.6-luna\": {\n    default: {\n      inputMicrosPerMillionTokens: 200_000,\n      cachedInputMicrosPerMillionTokens: 20_000,\n      outputMicrosPerMillionTokens: 1_200_000,\n      marginBps: 2_500,\n    },\n    inputTokenTiers: [\n      {\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 400_000,\n          cachedInputMicrosPerMillionTokens: 40_000,\n          outputMicrosPerMillionTokens: 1_800_000,\n          marginBps: 2_500,\n        },\n      },\n    ],\n  },\n  // Conservative Vercel AI Gateway fallback prices. Normal managed Gateway\n  // billing uses the exact response Gateway `cost` / `inferenceCost` and applies\n  // the same margin. These token rates are used only if that\n  // metadata is absent. DeepSeek therefore carries the highest approved route\n  // (Novita); both approved Kimi routes have the same list price.\n  [OPENGENI_GATEWAY_MODELS.deepseek.productId]: {\n    default: {\n      inputMicrosPerMillionTokens: 140_000,\n      cachedInputMicrosPerMillionTokens: 28_000,\n      outputMicrosPerMillionTokens: 280_000,\n      marginBps: 2_500,\n    },\n  },\n  [OPENGENI_GATEWAY_MODELS.kimi.productId]: {\n    default: {\n      inputMicrosPerMillionTokens: 3_000_000,\n      cachedInputMicrosPerMillionTokens: 300_000,\n      outputMicrosPerMillionTokens: 15_000_000,\n      marginBps: 2_500,\n    },\n  },\n  // Fireworks AI / GLM 5.2 — the first shipped non-OpenAI registry model. A\n  // built-in default pricing entry makes managed billing work out of the box\n  // for hosts that expose this model via OPENGENI_MODEL_PROVIDERS_JSON without\n  // also setting OPENGENI_MODEL_PRICING_JSON.\n  \"accounts/fireworks/models/glm-5p2\": {\n    default: {\n      inputMicrosPerMillionTokens: 1_400_000,\n      cachedInputMicrosPerMillionTokens: 140_000,\n      outputMicrosPerMillionTokens: 4_400_000,\n      marginBps: 2_500,\n    },\n  },\n};\n\n// --- backend-gated required-credential table (the single source of truth) ---\n// Each sandbox backend declares ONLY its own required credentials: a deployment\n// configured for `sandboxBackend=modal` must carry the Modal token, but a\n// daytona/e2b/local/none deployment must NOT be forced to set Modal creds (and\n// vice versa). validateSettings() iterates this table for the *active* backend\n// only — so the cred a backend doesn't use is never a boot blocker — and the\n// deployment package mirrors the same table to drive its env-render + the\n// required-env manifest (one table, two consumers).\n//\n// `field` is the parsed Settings key (boot validation reads the typed value);\n// `env` is the OPENGENI_* variable name (deployment renders/requires it). The\n// modal token is a both-or-neither pair handled by an extra refine in\n// validateSettings — this table holds the hard \"must be present when active\"\n// requirements.\nexport type SandboxRequiredEnv = {\n  field: keyof Settings;\n  env: string;\n};\n\nexport const SANDBOX_REQUIRED_ENV: Record<\n  z.infer<typeof SandboxBackend>,\n  readonly SandboxRequiredEnv[]\n> = {\n  // docker/local/none need no credentials (local dev container / in-process / off).\n  docker: [],\n  local: [],\n  none: [],\n  modal: [\n    { field: \"modalAppName\", env: \"OPENGENI_MODAL_APP_NAME\" },\n    { field: \"modalTokenId\", env: \"OPENGENI_MODAL_TOKEN_ID\" },\n    { field: \"modalTokenSecret\", env: \"OPENGENI_MODAL_TOKEN_SECRET\" },\n  ],\n  daytona: [{ field: \"daytonaApiKey\", env: \"OPENGENI_DAYTONA_API_KEY\" }],\n  runloop: [{ field: \"runloopApiKey\", env: \"OPENGENI_RUNLOOP_API_KEY\" }],\n  e2b: [{ field: \"e2bApiKey\", env: \"OPENGENI_E2B_API_KEY\" }],\n  blaxel: [{ field: \"blaxelApiKey\", env: \"OPENGENI_BLAXEL_API_KEY\" }],\n  cloudflare: [{ field: \"cloudflareWorkerUrl\", env: \"OPENGENI_CLOUDFLARE_WORKER_URL\" }],\n  vercel: [\n    { field: \"vercelToken\", env: \"OPENGENI_VERCEL_TOKEN\" },\n    { field: \"vercelProjectId\", env: \"OPENGENI_VERCEL_PROJECT_ID\" },\n  ],\n  // selfhosted needs NO per-box credentials: it is the user's own machine reached\n  // over the agent's own enrollment. The enrollment-signing + relay-token secrets\n  // are deployment-level (a single runtime secret, not per-active-backend creds),\n  // wired in the connectivity/enrollment milestones (M4/M5), not here.\n  selfhosted: [],\n};\n\n/** The required OPENGENI_* env var names for a backend (for the deployment manifest). */\nexport function requiredSandboxEnvForBackend(backend: z.infer<typeof SandboxBackend>): string[] {\n  return (SANDBOX_REQUIRED_ENV[backend] ?? []).map((entry) => entry.env);\n}\n\nfunction optional(name: string): string | undefined {\n  const value = process.env[name];\n  return value && value.trim().length > 0 ? value : undefined;\n}\n\nexport function getSettings(): Settings {\n  const raw = {\n    serviceName: optional(\"OPENGENI_SERVICE_NAME\"),\n    environment: optional(\"OPENGENI_ENVIRONMENT\"),\n    deploymentRevision:\n      optional(\"OPENGENI_DEPLOYMENT_REVISION\") ??\n      optional(\"SOURCE_VERSION\") ??\n      optional(\"GITHUB_SHA\"),\n    serverVersion: optional(\"OPENGENI_SERVER_VERSION\"),\n    databaseUrl: optional(\"OPENGENI_DATABASE_URL\"),\n    dbSchema: optional(\"OPENGENI_DB_SCHEMA\"),\n    rlsStrategy: optional(\"OPENGENI_RLS_STRATEGY\"),\n    runtimeDatabaseRole: optional(\"OPENGENI_RUNTIME_DATABASE_ROLE\"),\n    natsUrl: optional(\"OPENGENI_NATS_URL\"),\n    temporalHost: optional(\"OPENGENI_TEMPORAL_HOST\"),\n    temporalNamespace: optional(\"OPENGENI_TEMPORAL_NAMESPACE\"),\n    temporalTaskQueue: optional(\"OPENGENI_TEMPORAL_TASK_QUEUE\"),\n    temporalTlsEnabled: optional(\"OPENGENI_TEMPORAL_TLS_ENABLED\"),\n    temporalApiKey: optional(\"OPENGENI_TEMPORAL_API_KEY\"),\n    temporalTlsServerName: optional(\"OPENGENI_TEMPORAL_TLS_SERVER_NAME\"),\n    temporalTlsRootCaCertificateBase64: optional(\n      \"OPENGENI_TEMPORAL_TLS_ROOT_CA_CERTIFICATE_BASE64\",\n    ),\n    temporalTlsClientCertificateBase64: optional(\"OPENGENI_TEMPORAL_TLS_CLIENT_CERTIFICATE_BASE64\"),\n    temporalTlsClientPrivateKeyBase64: optional(\"OPENGENI_TEMPORAL_TLS_CLIENT_PRIVATE_KEY_BASE64\"),\n    startupDependencyRetryAttempts: optional(\"OPENGENI_STARTUP_DEPENDENCY_RETRY_ATTEMPTS\"),\n    startupDependencyRetryInitialDelayMs: optional(\n      \"OPENGENI_STARTUP_DEPENDENCY_RETRY_INITIAL_DELAY_MS\",\n    ),\n    startupDependencyRetryMaxDelayMs: optional(\"OPENGENI_STARTUP_DEPENDENCY_RETRY_MAX_DELAY_MS\"),\n    turnWorkerConcurrencyMode: optional(\"OPENGENI_TURN_WORKER_CONCURRENCY_MODE\"),\n    turnWorkerMaxConcurrentTurns: optional(\"OPENGENI_TURN_WORKER_MAX_CONCURRENT_TURNS\"),\n    turnWorkerTargetCpuUsage: optional(\"OPENGENI_TURN_WORKER_TARGET_CPU_USAGE\"),\n    turnWorkerTargetMemoryUsage: optional(\"OPENGENI_TURN_WORKER_TARGET_MEMORY_USAGE\"),\n    turnWorkerEmergencyMemoryUsage: optional(\"OPENGENI_TURN_WORKER_EMERGENCY_MEMORY_USAGE\"),\n    turnWorkerMemoryGuardIntervalMs: optional(\"OPENGENI_TURN_WORKER_MEMORY_GUARD_INTERVAL_MS\"),\n    turnWorkerMemoryGuardSustainMs: optional(\"OPENGENI_TURN_WORKER_MEMORY_GUARD_SUSTAIN_MS\"),\n    observabilityStructuredLogs: optional(\"OPENGENI_OBSERVABILITY_STRUCTURED_LOGS\"),\n    observabilityMetricsEnabled: optional(\"OPENGENI_OBSERVABILITY_METRICS_ENABLED\"),\n    observabilityOtlpEndpoint:\n      optional(\"OPENGENI_OTEL_EXPORTER_OTLP_ENDPOINT\") ?? optional(\"OTEL_EXPORTER_OTLP_ENDPOINT\"),\n    observabilityOtlpHeaders:\n      optional(\"OPENGENI_OTEL_EXPORTER_OTLP_HEADERS\") ?? optional(\"OTEL_EXPORTER_OTLP_HEADERS\"),\n    analyticsEnabled: optional(\"OPENGENI_ANALYTICS_ENABLED\"),\n    analyticsConsentRequired: optional(\"OPENGENI_ANALYTICS_CONSENT_REQUIRED\"),\n    analyticsReoClientId: optional(\"OPENGENI_ANALYTICS_REO_CLIENT_ID\"),\n    analyticsPosthogProjectKey: optional(\"OPENGENI_ANALYTICS_POSTHOG_PROJECT_KEY\"),\n    analyticsPosthogHost: optional(\"OPENGENI_ANALYTICS_POSTHOG_HOST\"),\n    analyticsGa4MeasurementId: optional(\"OPENGENI_ANALYTICS_GA4_MEASUREMENT_ID\"),\n    publicBaseUrl: optional(\"OPENGENI_PUBLIC_BASE_URL\"),\n    webBaseUrl: optional(\"OPENGENI_WEB_BASE_URL\"),\n    agentReleasesBaseUrl: optional(\"OPENGENI_AGENT_RELEASES_BASE_URL\"),\n    agentStableVersion: optional(\"OPENGENI_AGENT_STABLE_VERSION\"),\n    agentBetaVersion: optional(\"OPENGENI_AGENT_BETA_VERSION\"),\n    productAccessMode: optional(\"OPENGENI_PRODUCT_ACCESS_MODE\"),\n    billingMode: optional(\"OPENGENI_BILLING_MODE\"),\n    entitlementsMode: optional(\"OPENGENI_ENTITLEMENTS_MODE\"),\n    usageLimitsMode: optional(\"OPENGENI_USAGE_LIMITS_MODE\"),\n    staticEntitlementsJson: optional(\"OPENGENI_STATIC_ENTITLEMENTS_JSON\"),\n    staticUsageLimitsJson: optional(\"OPENGENI_STATIC_USAGE_LIMITS_JSON\"),\n    delegationSecret: optional(\"OPENGENI_DELEGATION_SECRET\"),\n    defaultFirstPartyMcpTools: optional(\"OPENGENI_DEFAULT_FIRST_PARTY_MCP_TOOLS\"),\n    allowedFirstPartyMcpTools: optional(\"OPENGENI_ALLOWED_FIRST_PARTY_MCP_TOOLS\"),\n    streamTokenSecret: optional(\"OPENGENI_STREAM_TOKEN_SECRET\"),\n    streamControlEnabled: optional(\"OPENGENI_STREAM_CONTROL_ENABLED\"),\n    codemodeMaxCallsPerTurn: optional(\"OPENGENI_CODEMODE_MAX_CALLS_PER_TURN\"),\n    ogtoolPackageSpec: optional(\"OPENGENI_OGTOOL_PACKAGE_SPEC\"),\n    environmentsEncryptionKey: optional(\"OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY\"),\n    integrationsEnabled: optional(\"OPENGENI_INTEGRATIONS_ENABLED\"),\n    integrationsStateSecret: optional(\"OPENGENI_INTEGRATIONS_STATE_SECRET\"),\n    integrationsAllowPrivateNetworkTargets: optional(\n      \"OPENGENI_INTEGRATIONS_ALLOW_PRIVATE_NETWORK_TARGETS\",\n    ),\n    integrationsOauthClientsJson: optional(\"OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON\"),\n    gmailRestAdapterEnabled: optional(\"OPENGENI_GMAIL_REST_ADAPTER_ENABLED\"),\n    slackClientId: optional(\"OPENGENI_SLACK_CLIENT_ID\"),\n    slackClientSecret: optional(\"OPENGENI_SLACK_CLIENT_SECRET\"),\n    slackSigningSecret: optional(\"OPENGENI_SLACK_SIGNING_SECRET\"),\n    googleDriveClientId: optional(\"OPENGENI_GOOGLE_DRIVE_CLIENT_ID\"),\n    googleDriveClientSecret: optional(\"OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET\"),\n    fikenClientId: optional(\"OPENGENI_FIKEN_OAUTH_CLIENT_ID\"),\n    fikenClientSecret: optional(\"OPENGENI_FIKEN_OAUTH_CLIENT_SECRET\"),\n    googleDriveWorkspaceEventsEnabled: optional(\"OPENGENI_GOOGLE_DRIVE_WORKSPACE_EVENTS_ENABLED\"),\n    atlassianClientId: optional(\"OPENGENI_ATLASSIAN_CLIENT_ID\"),\n    atlassianClientSecret: optional(\"OPENGENI_ATLASSIAN_CLIENT_SECRET\"),\n    maxNestedAgentDepth: optional(\"OPENGENI_MAX_NESTED_AGENT_DEPTH\"),\n    socialOauthClientsJson: optional(\"OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON\"),\n    goalMaxAutoContinuations: optional(\"OPENGENI_GOAL_MAX_AUTO_CONTINUATIONS\"),\n    goalNoProgressLimit: optional(\"OPENGENI_GOAL_NO_PROGRESS_LIMIT\"),\n    agentMaxModelCallsPerTurn: optional(\"OPENGENI_AGENT_MAX_MODEL_CALLS_PER_TURN\"),\n    contextWindowTokens: optional(\"OPENGENI_CONTEXT_WINDOW_TOKENS\"),\n    contextEffectiveWindowTokens: optional(\"OPENGENI_CONTEXT_EFFECTIVE_WINDOW_TOKENS\"),\n    contextCompactionThresholdRatio: optional(\"OPENGENI_COMPACTION_THRESHOLD_RATIO\"),\n    contextReservedOutputTokens: optional(\"OPENGENI_CONTEXT_RESERVED_OUTPUT_TOKENS\"),\n    contextAutoCompactThresholdTokens: optional(\"OPENGENI_CONTEXT_AUTO_COMPACT_THRESHOLD_TOKENS\"),\n    modelToolOutputTruncationTokens: optional(\"OPENGENI_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS\"),\n    authRequired: optional(\"OPENGENI_AUTH_REQUIRED\"),\n    accessKey: optional(\"OPENGENI_ACCESS_KEY\"),\n    authAllowHealth: optional(\"OPENGENI_AUTH_ALLOW_HEALTH\"),\n    authAllowMetrics: optional(\"OPENGENI_AUTH_ALLOW_METRICS\"),\n    apiHost: optional(\"OPENGENI_API_HOST\"),\n    apiPort: optional(\"OPENGENI_API_PORT\"),\n    workerHttpPort: optional(\"OPENGENI_WORKER_HTTP_PORT\"),\n    opengeniMcpUrl: optional(\"OPENGENI_MCP_URL\"),\n    corsAllowOriginRegex: optional(\"OPENGENI_CORS_ALLOW_ORIGIN_REGEX\"),\n    openaiProvider: optional(\"OPENGENI_OPENAI_PROVIDER\"),\n    openaiApiKey: optional(\"OPENGENI_OPENAI_API_KEY\") ?? optional(\"OPENAI_API_KEY\"),\n    openaiBaseUrl: optional(\"OPENGENI_OPENAI_BASE_URL\") ?? optional(\"OPENAI_BASE_URL\"),\n    openaiModel: optional(\"OPENGENI_OPENAI_MODEL\"),\n    openaiAllowedModels: optional(\"OPENGENI_OPENAI_ALLOWED_MODELS\"),\n    vercelAiGatewayApiKey: optional(\"OPENGENI_VERCEL_AI_GATEWAY_API_KEY\"),\n    imageGenerationModel: optional(\"OPENGENI_IMAGE_GENERATION_MODEL\"),\n    videoGenerationPollIntervalMs: optional(\"OPENGENI_VIDEO_GENERATION_POLL_INTERVAL_MS\"),\n    videoGenerationRecoveryDeadlineMs: optional(\"OPENGENI_VIDEO_GENERATION_RECOVERY_DEADLINE_MS\"),\n    videoGenerationReferenceUrlTtlSeconds: optional(\n      \"OPENGENI_VIDEO_GENERATION_REFERENCE_URL_TTL_SECONDS\",\n    ),\n    videoGenerationMaxConcurrentPerWorkspace: optional(\n      \"OPENGENI_VIDEO_GENERATION_MAX_CONCURRENT_PER_WORKSPACE\",\n    ),\n    videoGenerationWorkspaceQuotaBytes: optional(\"OPENGENI_VIDEO_GENERATION_WORKSPACE_QUOTA_BYTES\"),\n    videoGenerationTempDirectory: optional(\"OPENGENI_VIDEO_GENERATION_TEMP_DIRECTORY\"),\n    videoGenerationFfprobePath: optional(\"OPENGENI_VIDEO_GENERATION_FFPROBE_PATH\"),\n    videoGenerationCredit480pMicrosPerSecond: optional(\n      \"OPENGENI_VIDEO_GENERATION_CREDIT_480P_MICROS_PER_SECOND\",\n    ),\n    videoGenerationCredit720pMicrosPerSecond: optional(\n      \"OPENGENI_VIDEO_GENERATION_CREDIT_720P_MICROS_PER_SECOND\",\n    ),\n    voiceInputMaxDurationSeconds: optional(\"OPENGENI_VOICE_INPUT_MAX_DURATION_SECONDS\"),\n    voiceInputMaxSizeBytes: optional(\"OPENGENI_VOICE_INPUT_MAX_SIZE_BYTES\"),\n    voiceInputResumableEnabled: optional(\"OPENGENI_VOICE_INPUT_RESUMABLE_ENABLED\"),\n    voiceInputResumableMaxDurationSeconds: optional(\n      \"OPENGENI_VOICE_INPUT_RESUMABLE_MAX_DURATION_SECONDS\",\n    ),\n    voiceInputResumableMaxSizeBytes: optional(\"OPENGENI_VOICE_INPUT_RESUMABLE_MAX_SIZE_BYTES\"),\n    voiceInputResumableMaxChunkSizeBytes: optional(\n      \"OPENGENI_VOICE_INPUT_RESUMABLE_MAX_CHUNK_SIZE_BYTES\",\n    ),\n    voiceInputResumableRetentionSeconds: optional(\n      \"OPENGENI_VOICE_INPUT_RESUMABLE_RETENTION_SECONDS\",\n    ),\n    voiceInputFfmpegPath: optional(\"OPENGENI_VOICE_INPUT_FFMPEG_PATH\"),\n    voiceInputProviderOrder: optional(\"OPENGENI_VOICE_INPUT_PROVIDER_ORDER\"),\n    voiceInputOpenaiEnabled: optional(\"OPENGENI_VOICE_INPUT_OPENAI_ENABLED\"),\n    voiceInputOpenaiApiKey: optional(\"OPENGENI_VOICE_INPUT_OPENAI_API_KEY\"),\n    voiceInputOpenaiBaseUrl: optional(\"OPENGENI_VOICE_INPUT_OPENAI_BASE_URL\"),\n    voiceInputOpenaiModel: optional(\"OPENGENI_VOICE_INPUT_OPENAI_MODEL\"),\n    voiceInputAzureEnabled: optional(\"OPENGENI_VOICE_INPUT_AZURE_ENABLED\"),\n    voiceInputAzureEndpoint: optional(\"OPENGENI_VOICE_INPUT_AZURE_ENDPOINT\"),\n    voiceInputAzureDeployment: optional(\"OPENGENI_VOICE_INPUT_AZURE_DEPLOYMENT\"),\n    voiceInputAzureApiVersion: optional(\"OPENGENI_VOICE_INPUT_AZURE_API_VERSION\"),\n    voiceInputAzureApiKey: optional(\"OPENGENI_VOICE_INPUT_AZURE_API_KEY\"),\n    voiceInputAzureAdToken: optional(\"OPENGENI_VOICE_INPUT_AZURE_AD_TOKEN\"),\n    voiceInputCodexExperimentalEnabled: optional(\"OPENGENI_VOICE_INPUT_CODEX_EXPERIMENTAL\"),\n    modelPricingJson: optional(\"OPENGENI_MODEL_PRICING_JSON\"),\n    modelProvidersJson: optional(\"OPENGENI_MODEL_PROVIDERS_JSON\"),\n    codexSubscriptionEnabled: optional(\"OPENGENI_CODEX_SUBSCRIPTION_ENABLED\"),\n    supergrokSubscriptionEnabled: optional(\"OPENGENI_SUPERGROK_SUBSCRIPTION_ENABLED\"),\n    codexConnectedAppsEnabled: optional(\"OPENGENI_CODEX_CONNECTED_APPS_ENABLED\"),\n    codexToolSearchEnabled: optional(\"OPENGENI_CODEX_TOOL_SEARCH_ENABLED\"),\n    lazyToolSearchEnabled: optional(\"OPENGENI_LAZY_TOOL_SEARCH_ENABLED\"),\n    codexCredentialLeasingEnabled: optional(\"OPENGENI_CODEX_CREDENTIAL_LEASING_ENABLED\"),\n    codexFleetPolicyShadowEnabled: optional(\"OPENGENI_CODEX_FLEET_POLICY_SHADOW_ENABLED\"),\n    codexProductSku: optional(\"OPENGENI_CODEX_PRODUCT_SKU\"),\n    openaiReasoningEffort: optional(\"OPENGENI_OPENAI_REASONING_EFFORT\"),\n    openaiAllowedReasoningEfforts: optional(\"OPENGENI_OPENAI_ALLOWED_REASONING_EFFORTS\"),\n    openaiResponsesTransport: optional(\"OPENGENI_OPENAI_RESPONSES_TRANSPORT\"),\n    openaiProviderItemIds: optional(\"OPENGENI_OPENAI_PROVIDER_ITEM_IDS\"),\n    openaiReasoningEncryptedContent: optional(\"OPENGENI_OPENAI_REASONING_ENCRYPTED_CONTENT\"),\n    openaiMaxRetries: optional(\"OPENGENI_OPENAI_MAX_RETRIES\"),\n    webSearchEnabled: optional(\"OPENGENI_WEB_SEARCH_ENABLED\"),\n    agentInstructionsTemplate: optional(\"OPENGENI_AGENT_INSTRUCTIONS_TEMPLATE\"),\n    azureOpenaiBaseUrl: optional(\"OPENGENI_AZURE_OPENAI_BASE_URL\"),\n    azureOpenaiEndpoint: optional(\"OPENGENI_AZURE_OPENAI_ENDPOINT\"),\n    azureOpenaiDeployment: optional(\"OPENGENI_AZURE_OPENAI_DEPLOYMENT\"),\n    azureOpenaiApiVersion: optional(\"OPENGENI_AZURE_OPENAI_API_VERSION\"),\n    azureOpenaiApiKey: optional(\"OPENGENI_AZURE_OPENAI_API_KEY\"),\n    azureOpenaiAdToken: optional(\"OPENGENI_AZURE_OPENAI_AD_TOKEN\"),\n    disableOpenaiTracing: optional(\"OPENGENI_DISABLE_OPENAI_TRACING\"),\n    sandboxBackend: optional(\"OPENGENI_SANDBOX_BACKEND\"),\n    dockerImage: optional(\"OPENGENI_DOCKER_IMAGE\"),\n    sandboxArtifactRuntimeEnabled: optional(\"OPENGENI_SANDBOX_ARTIFACT_RUNTIME_ENABLED\"),\n    dockerExposedPorts: optional(\"OPENGENI_DOCKER_EXPOSED_PORTS\"),\n    dockerNetwork: optional(\"OPENGENI_DOCKER_NETWORK\"),\n    dockerWorkspaceBaseDir: optional(\"OPENGENI_DOCKER_WORKSPACE_BASE_DIR\"),\n    modalAppName: optional(\"OPENGENI_MODAL_APP_NAME\"),\n    modalImageRef: optional(\"OPENGENI_MODAL_IMAGE_REF\"),\n    modalImageId: optional(\"OPENGENI_MODAL_IMAGE_ID\"),\n    modalImageRegistrySecret: optional(\"OPENGENI_MODAL_IMAGE_REGISTRY_SECRET\"),\n    modalTimeoutSeconds: optional(\"OPENGENI_MODAL_TIMEOUT_SECONDS\"),\n    modalTokenId: optional(\"OPENGENI_MODAL_TOKEN_ID\"),\n    modalTokenSecret: optional(\"OPENGENI_MODAL_TOKEN_SECRET\"),\n    modalEnvironment: optional(\"OPENGENI_MODAL_ENVIRONMENT\"),\n    modalIdleTimeoutSeconds: optional(\"OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS\"),\n    modalWorkspacePersistence: optional(\"OPENGENI_MODAL_WORKSPACE_PERSISTENCE\"),\n    sandboxDesktopEnabled: optional(\"OPENGENI_SANDBOX_DESKTOP_ENABLED\"),\n    sandboxDesktopInteractive: optional(\"OPENGENI_SANDBOX_DESKTOP_INTERACTIVE\"),\n    sandboxTerminalEnabled: optional(\"OPENGENI_SANDBOX_TERMINAL_ENABLED\"),\n    streamResolutionWidth: optional(\"OPENGENI_STREAM_RESOLUTION_WIDTH\"),\n    streamResolutionHeight: optional(\"OPENGENI_STREAM_RESOLUTION_HEIGHT\"),\n    computerUseEnabled: optional(\"OPENGENI_COMPUTER_USE_ENABLED\"),\n    computerUseReadOnly: optional(\"OPENGENI_COMPUTER_USE_READONLY\"),\n    recordingEnabled: optional(\"OPENGENI_RECORDING_ENABLED\"),\n    workspaceCaptureEnabled: optional(\"OPENGENI_WORKSPACE_CAPTURE\"),\n    recordingDefaultCodec: optional(\"OPENGENI_RECORDING_DEFAULT_CODEC\"),\n    recordingFramerate: optional(\"OPENGENI_RECORDING_FRAMERATE\"),\n    recordingMaxSeconds: optional(\"OPENGENI_RECORDING_MAX_SECONDS\"),\n    recordingMaxBytes: optional(\"OPENGENI_RECORDING_MAX_BYTES\"),\n    daytonaApiKey: optional(\"OPENGENI_DAYTONA_API_KEY\"),\n    daytonaApiUrl: optional(\"OPENGENI_DAYTONA_API_URL\"),\n    daytonaTarget: optional(\"OPENGENI_DAYTONA_TARGET\"),\n    daytonaImage: optional(\"OPENGENI_DAYTONA_IMAGE\"),\n    daytonaSnapshotName: optional(\"OPENGENI_DAYTONA_SNAPSHOT_NAME\"),\n    daytonaAutoStopInterval: optional(\"OPENGENI_DAYTONA_AUTO_STOP_INTERVAL\"),\n    daytonaTimeoutSeconds: optional(\"OPENGENI_DAYTONA_TIMEOUT_SECONDS\"),\n    daytonaExposedPortUrlTtlSeconds: optional(\"OPENGENI_DAYTONA_EXPOSED_PORT_URL_TTL_SECONDS\"),\n    runloopApiKey: optional(\"OPENGENI_RUNLOOP_API_KEY\"),\n    runloopBaseUrl: optional(\"OPENGENI_RUNLOOP_BASE_URL\"),\n    runloopBlueprintName: optional(\"OPENGENI_RUNLOOP_BLUEPRINT_NAME\"),\n    runloopBlueprintId: optional(\"OPENGENI_RUNLOOP_BLUEPRINT_ID\"),\n    runloopTunnel: optional(\"OPENGENI_RUNLOOP_TUNNEL\"),\n    runloopKeepAliveSeconds: optional(\"OPENGENI_RUNLOOP_KEEP_ALIVE_SECONDS\"),\n    e2bApiKey: optional(\"OPENGENI_E2B_API_KEY\"),\n    e2bTemplate: optional(\"OPENGENI_E2B_TEMPLATE\"),\n    e2bTimeoutSeconds: optional(\"OPENGENI_E2B_TIMEOUT_SECONDS\"),\n    e2bTimeoutAction: optional(\"OPENGENI_E2B_TIMEOUT_ACTION\"),\n    e2bAllowInternetAccess: optional(\"OPENGENI_E2B_ALLOW_INTERNET_ACCESS\"),\n    e2bAutoResume: optional(\"OPENGENI_E2B_AUTO_RESUME\"),\n    e2bWorkspacePersistence: optional(\"OPENGENI_E2B_WORKSPACE_PERSISTENCE\"),\n    blaxelApiKey: optional(\"OPENGENI_BLAXEL_API_KEY\"),\n    blaxelImage: optional(\"OPENGENI_BLAXEL_IMAGE\"),\n    blaxelRegion: optional(\"OPENGENI_BLAXEL_REGION\"),\n    blaxelExposedPortPublic: optional(\"OPENGENI_BLAXEL_EXPOSED_PORT_PUBLIC\"),\n    blaxelExposedPortUrlTtlSeconds: optional(\"OPENGENI_BLAXEL_EXPOSED_PORT_URL_TTL_SECONDS\"),\n    blaxelMemoryMb: optional(\"OPENGENI_BLAXEL_MEMORY_MB\"),\n    blaxelTtl: optional(\"OPENGENI_BLAXEL_TTL\"),\n    cloudflareWorkerUrl: optional(\"OPENGENI_CLOUDFLARE_WORKER_URL\"),\n    cloudflareApiKey: optional(\"OPENGENI_CLOUDFLARE_API_KEY\"),\n    browserbaseApiKey: optional(\"OPENGENI_BROWSERBASE_API_KEY\"),\n    kernelApiKey: optional(\"OPENGENI_KERNEL_API_KEY\"),\n    kernelEndpoint: optional(\"OPENGENI_KERNEL_ENDPOINT\"),\n    kernelBrowserTimeoutSeconds: optional(\"OPENGENI_KERNEL_BROWSER_TIMEOUT_SECONDS\"),\n    kernelBrowserStealth: optional(\"OPENGENI_KERNEL_BROWSER_STEALTH\"),\n    vercelToken: optional(\"OPENGENI_VERCEL_TOKEN\"),\n    vercelProjectId: optional(\"OPENGENI_VERCEL_PROJECT_ID\"),\n    vercelTeamId: optional(\"OPENGENI_VERCEL_TEAM_ID\"),\n    vercelRuntime: optional(\"OPENGENI_VERCEL_RUNTIME\"),\n    sandboxOwnershipEnabled: optional(\"OPENGENI_SANDBOX_OWNERSHIP_ENABLED\"),\n    rigVerificationLeaseOwnershipEnabled: optional(\n      \"OPENGENI_RIG_VERIFICATION_LEASE_OWNERSHIP_ENABLED\",\n    ),\n    sandboxLazyProvisionEnabled: optional(\"OPENGENI_SANDBOX_LAZY_PROVISION\"),\n    sandboxSelfhostedEnabled: optional(\"OPENGENI_SANDBOX_SELFHOSTED_ENABLED\"),\n    agentOpStreamEnabled: optional(\"OPENGENI_AGENT_OP_STREAM_ENABLED\"),\n    enrollmentSigningSecret: optional(\"OPENGENI_ENROLLMENT_SIGNING_SECRET\"),\n    selfhostedNatsUrl: optional(\"OPENGENI_SELFHOSTED_NATS_URL\"),\n    selfhostedRelayUrl: optional(\"OPENGENI_SELFHOSTED_RELAY_URL\"),\n    selfhostedRelayTokenSecret: optional(\"OPENGENI_SELFHOSTED_RELAY_TOKEN_SECRET\"),\n    agentUpdatePublicKey: optional(\"OPENGENI_AGENT_UPDATE_PUBLIC_KEY\"),\n    selfhostedNatsCalloutAccountSeed: optional(\"OPENGENI_SELFHOSTED_NATS_CALLOUT_ACCOUNT_SEED\"),\n    selfhostedNatsCalloutAccountName: optional(\"OPENGENI_SELFHOSTED_NATS_CALLOUT_ACCOUNT_NAME\"),\n    selfhostedNatsCalloutUser: optional(\"OPENGENI_SELFHOSTED_NATS_CALLOUT_USER\"),\n    selfhostedNatsCalloutPassword: optional(\"OPENGENI_SELFHOSTED_NATS_CALLOUT_PASSWORD\"),\n    selfhostedNatsControlUser: optional(\"OPENGENI_SELFHOSTED_NATS_CONTROL_USER\"),\n    selfhostedNatsControlPassword: optional(\"OPENGENI_SELFHOSTED_NATS_CONTROL_PASSWORD\"),\n    sandboxSelfhostedExecTimeoutMs: optional(\"OPENGENI_SANDBOX_SELFHOSTED_EXEC_TIMEOUT_MS\"),\n    sandboxSelfhostedControlTimeoutMs: optional(\"OPENGENI_SANDBOX_SELFHOSTED_CONTROL_TIMEOUT_MS\"),\n    sandboxLeaseReaperPeriodMs: optional(\"OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS\"),\n    sandboxViewerHolderTtlMs: optional(\"OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS\"),\n    sandboxInteractionHolderTtlMs: optional(\"OPENGENI_SANDBOX_INTERACTION_HOLDER_TTL_MS\"),\n    sandboxIdleGraceMs: optional(\"OPENGENI_SANDBOX_IDLE_GRACE_MS\"),\n    sandboxSnapshotIntervalMs: optional(\"OPENGENI_SANDBOX_SNAPSHOT_INTERVAL_MS\"),\n    sandboxSnapshotTimeoutMs: optional(\"OPENGENI_SANDBOX_SNAPSHOT_TIMEOUT_MS\"),\n    sandboxRotationLeadMs: optional(\"OPENGENI_SANDBOX_ROTATION_LEAD_MS\"),\n    sandboxRotationBatchSize: optional(\"OPENGENI_SANDBOX_ROTATION_BATCH_SIZE\"),\n    sandboxLeaseTtlMs: optional(\"OPENGENI_SANDBOX_LEASE_TTL_MS\"),\n    sandboxLeaseWarmingTtlMs: optional(\"OPENGENI_SANDBOX_LEASE_WARMING_TTL_MS\"),\n    sandboxWarmingTimeoutMs: optional(\"OPENGENI_SANDBOX_WARMING_TIMEOUT_MS\"),\n    rigSetupTimeoutMs: optional(\"OPENGENI_RIG_SETUP_TIMEOUT_MS\"),\n    sandboxWarmRateMicrosPerSecondJson: optional(\n      \"OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON\",\n    ),\n    sandboxMaxWarmSecondsPerWorkspace: optional(\"OPENGENI_SANDBOX_MAX_WARM_SECONDS_PER_WORKSPACE\"),\n    sandboxPreparationProfiles: optional(\"OPENGENI_SANDBOX_PREPARATION_PROFILES\"),\n    sandboxEnvAllowlist: optional(\"OPENGENI_SANDBOX_ENV_ALLOWLIST\"),\n    objectStorageEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_ENDPOINT\"),\n    objectStorageInternalEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_INTERNAL_ENDPOINT\"),\n    objectStorageSandboxEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_SANDBOX_ENDPOINT\"),\n    objectStorageBackend: optional(\"OPENGENI_OBJECT_STORAGE_BACKEND\"),\n    objectStorageBucket: optional(\"OPENGENI_OBJECT_STORAGE_BUCKET\"),\n    objectStorageRegion: optional(\"OPENGENI_OBJECT_STORAGE_REGION\"),\n    objectStorageS3Provider: optional(\"OPENGENI_OBJECT_STORAGE_S3_PROVIDER\"),\n    objectStorageAccessKeyId: optional(\"OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID\"),\n    objectStorageSecretAccessKey: optional(\"OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY\"),\n    objectStorageForcePathStyle: optional(\"OPENGENI_OBJECT_STORAGE_FORCE_PATH_STYLE\"),\n    objectStorageAzureConnectionString: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_CONNECTION_STRING\"),\n    objectStorageAzureAccountName: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_NAME\"),\n    objectStorageAzureAccountKey: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_KEY\"),\n    objectStorageAzureEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ENDPOINT\"),\n    objectStorageGcsProjectId: optional(\"OPENGENI_OBJECT_STORAGE_GCS_PROJECT_ID\"),\n    objectStorageGcsCredentialsJson: optional(\"OPENGENI_OBJECT_STORAGE_GCS_CREDENTIALS_JSON\"),\n    objectStorageGcsKeyFilename: optional(\"OPENGENI_OBJECT_STORAGE_GCS_KEY_FILENAME\"),\n    objectStorageGcsApiEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_GCS_API_ENDPOINT\"),\n    documentParser: optional(\"OPENGENI_DOCUMENT_PARSER\"),\n    documentChunkSize: optional(\"OPENGENI_DOCUMENT_CHUNK_SIZE\"),\n    documentChunkOverlap: optional(\"OPENGENI_DOCUMENT_CHUNK_OVERLAP\"),\n    documentEmbeddingProvider: optional(\"OPENGENI_DOCUMENT_EMBEDDING_PROVIDER\"),\n    documentEmbeddingModel: optional(\"OPENGENI_DOCUMENT_EMBEDDING_MODEL\"),\n    documentEmbeddingDimensions: optional(\"OPENGENI_DOCUMENT_EMBEDDING_DIMENSIONS\"),\n    documentEmbeddingApiKey: optional(\"OPENGENI_DOCUMENT_EMBEDDING_API_KEY\"),\n    documentEmbeddingBaseUrl: optional(\"OPENGENI_DOCUMENT_EMBEDDING_BASE_URL\"),\n    documentCurationProvider: optional(\"OPENGENI_DOCUMENT_CURATION_PROVIDER\"),\n    documentCurationModel: optional(\"OPENGENI_DOCUMENT_CURATION_MODEL\"),\n    documentCurationApiKey: optional(\"OPENGENI_DOCUMENT_CURATION_API_KEY\"),\n    documentCurationBaseUrl: optional(\"OPENGENI_DOCUMENT_CURATION_BASE_URL\"),\n    gitAuthorName: optional(\"OPENGENI_GIT_AUTHOR_NAME\"),\n    gitAuthorEmail: optional(\"OPENGENI_GIT_AUTHOR_EMAIL\"),\n    gitCommitterName: optional(\"OPENGENI_GIT_COMMITTER_NAME\"),\n    gitCommitterEmail: optional(\"OPENGENI_GIT_COMMITTER_EMAIL\"),\n    githubAppManifestBaseUrl: optional(\"OPENGENI_GITHUB_APP_MANIFEST_BASE_URL\"),\n    githubAppManifestStateSecret: optional(\"OPENGENI_GITHUB_APP_MANIFEST_STATE_SECRET\"),\n    githubAppId: optional(\"OPENGENI_GITHUB_APP_ID\"),\n    githubClientId: optional(\"OPENGENI_GITHUB_CLIENT_ID\"),\n    githubClientSecret: optional(\"OPENGENI_GITHUB_CLIENT_SECRET\"),\n    githubAppSlug: optional(\"OPENGENI_GITHUB_APP_SLUG\"),\n    githubWebhookSecret: optional(\"OPENGENI_GITHUB_WEBHOOK_SECRET\"),\n    githubAppPrivateKey: optional(\"OPENGENI_GITHUB_APP_PRIVATE_KEY\"),\n    betterAuthSecret: optional(\"OPENGENI_BETTER_AUTH_SECRET\"),\n    betterAuthAllowedHosts: optional(\"OPENGENI_BETTER_AUTH_ALLOWED_HOSTS\"),\n    betterAuthCookieDomain: optional(\"OPENGENI_BETTER_AUTH_COOKIE_DOMAIN\"),\n    betterAuthTrustedOrigins: optional(\"OPENGENI_BETTER_AUTH_TRUSTED_ORIGINS\"),\n    resendApiKey: optional(\"OPENGENI_RESEND_API_KEY\"),\n    emailFrom: optional(\"OPENGENI_EMAIL_FROM\"),\n    stripeSecretKey: optional(\"OPENGENI_STRIPE_SECRET_KEY\"),\n    stripePublishableKey: optional(\"OPENGENI_STRIPE_PUBLISHABLE_KEY\"),\n    stripeWebhookSecret: optional(\"OPENGENI_STRIPE_WEBHOOK_SECRET\"),\n    stripeCreditsProductId: optional(\"OPENGENI_STRIPE_CREDITS_PRODUCT_ID\"),\n    mcpServers: parseMcpServers(optional(\"OPENGENI_MCP_SERVERS\")),\n  };\n  const parsed = SettingsSchema.parse(raw);\n  const settings = {\n    ...parsed,\n    sandboxIdleGraceMs:\n      raw.sandboxIdleGraceMs === undefined\n        ? Math.min(900_000, Math.floor((parsed.modalTimeoutSeconds * 1000) / 2))\n        : parsed.sandboxIdleGraceMs,\n    sandboxRotationLeadMs:\n      raw.sandboxRotationLeadMs === undefined\n        ? Math.min(3_600_000, Math.floor((parsed.modalTimeoutSeconds * 1000) / 2))\n        : parsed.sandboxRotationLeadMs,\n    mcpServers: ensureBuiltInMcpServers(parsed),\n  };\n  validateSettings(settings);\n  return settings;\n}\n\nconst LOCAL_FIRST_PARTY_DELEGATION_SECRET = \"opengeni-local-first-party-delegation-secret-v1\";\n\n/**\n * First-party session tools need a shared HMAC identity even in the unauthenticated\n * local product mode. A fixed local-only value is no broader than that mode's\n * existing access boundary, while configured and managed deployments continue to\n * require an operator-provided secret.\n */\nexport function resolveFirstPartyDelegationSecret(settings: Settings): string | undefined {\n  const explicit = settings.delegationSecret?.trim();\n  if (explicit) return explicit;\n  const configuredAccessKey = settings.accessKey?.trim();\n  if (settings.productAccessMode === \"configured\" && settings.authRequired && configuredAccessKey) {\n    return configuredAccessKey;\n  }\n  return settings.productAccessMode === \"local\" &&\n    (settings.environment === \"local\" || settings.environment === \"test\")\n    ? LOCAL_FIRST_PARTY_DELEGATION_SECRET\n    : undefined;\n}\n\nexport type FirstPartyMcpToolPolicy = {\n  default: FirstPartyMcpToolNameType[];\n  allowed: FirstPartyMcpToolNameType[];\n};\n\n/** Resolve the deployment's session-tool defaults and hard execution ceiling. */\nexport function resolveFirstPartyMcpToolPolicy(\n  settings: Pick<Settings, \"defaultFirstPartyMcpTools\" | \"allowedFirstPartyMcpTools\">,\n): FirstPartyMcpToolPolicy {\n  const allowed = settings.allowedFirstPartyMcpTools ?? [...FIRST_PARTY_MCP_TOOL_NAMES];\n  const allowedSet = new Set(allowed);\n  const defaults = settings.defaultFirstPartyMcpTools ?? [...DEFAULT_FIRST_PARTY_MCP_TOOLS];\n  return {\n    default: defaults.filter((tool) => allowedSet.has(tool)),\n    allowed: [...allowed],\n  };\n}\n\n/** Apply the deployment ceiling to an existing durable session selection. */\nexport function allowedFirstPartyMcpToolsForSession(\n  settings: Pick<Settings, \"defaultFirstPartyMcpTools\" | \"allowedFirstPartyMcpTools\">,\n  selected: readonly FirstPartyMcpToolNameType[] | null | undefined,\n): FirstPartyMcpToolNameType[] {\n  const policy = resolveFirstPartyMcpToolPolicy(settings);\n  const allowed = new Set(policy.allowed);\n  return [...(selected ?? policy.default)].filter((tool) => allowed.has(tool));\n}\n\n/**\n * The Modal sandbox idle timeout (seconds) the provider actually passes as\n * idleTimeoutMs (sandbox-file-persistence). When the operator did not pin\n * OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS we DEFAULT it to the hard lifetime\n * (modalTimeoutSeconds): OpenGeni's reaper owns box lifecycle, so Modal's\n * built-in idle-reap (which would otherwise fire on its short server default and\n * kill the box BEFORE the reaper can snapshot /workspace) is pushed out to the\n * hard backstop. An explicit smaller value is honoured (the boot invariant keeps\n * it above reaperPeriod + idleGrace so a drained box still survives long enough\n * to be persisted).\n */\nexport function effectiveModalIdleTimeoutSeconds(settings: Settings): number {\n  return settings.modalIdleTimeoutSeconds ?? settings.modalTimeoutSeconds;\n}\n\n/**\n * One shared upper bound for the durable provider-capture claim and for command\n * admission waiting behind it. The SDK request itself is bounded by\n * sandboxSnapshotTimeoutMs; the extra window lets a non-cancellable provider\n * response settle and release its exact claim without turning a normal\n * checkpoint into a visible command failure. Database validation caps both\n * consumers at one hour.\n */\nexport function sandboxArchiveCaptureTimeoutMs(\n  settings: Pick<Settings, \"sandboxSnapshotTimeoutMs\">,\n): number {\n  return Math.min(\n    SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS,\n    settings.sandboxSnapshotTimeoutMs + SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS,\n  );\n}\n\nexport function sandboxLifecycleTransitionWaitMs(\n  settings: Pick<Settings, \"sandboxSnapshotTimeoutMs\" | \"sandboxLeaseReaperPeriodMs\">,\n): number {\n  const captureTimeoutMs = sandboxArchiveCaptureTimeoutMs(settings);\n  return Math.min(\n    SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS,\n    settings.sandboxLeaseReaperPeriodMs +\n      captureTimeoutMs +\n      SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS,\n  );\n}\n\nexport function collectSandboxEnvironment(\n  settings: Settings,\n  source: NodeJS.ProcessEnv = process.env,\n): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const name of sandboxEnvironmentVariableNames(settings)) {\n    const value = source[name];\n    if (value) {\n      out[name] = value;\n    }\n  }\n  return out;\n}\n\n/**\n * Resolved API key for a registry provider: the inline `apiKey` when present,\n * else the value of the env var named by `apiKeyEnv`. The preferred form is\n * `apiKeyEnv` (the secret stays out of OPENGENI_MODEL_PROVIDERS_JSON). Reads\n * from `source` (defaults to process.env) so callers can resolve against an\n * explicit environment in tests.\n */\nexport function resolveProviderApiKey(\n  provider: Pick<RegistryProvider, \"apiKey\" | \"apiKeyEnv\">,\n  source: NodeJS.ProcessEnv = process.env,\n): string | undefined {\n  if (provider.apiKey) {\n    return provider.apiKey;\n  }\n  if (provider.apiKeyEnv) {\n    const value = source[provider.apiKeyEnv];\n    return value && value.trim().length > 0 ? value : undefined;\n  }\n  return undefined;\n}\n\nconst HTTP_FIELD_NAME = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\nconst CREDENTIAL_LIKE_NAME_PARTS = new Set([\n  \"apikey\",\n  \"auth\",\n  \"authorization\",\n  \"bearer\",\n  \"credential\",\n  \"cookie\",\n  \"key\",\n  \"password\",\n  \"secret\",\n  \"session\",\n  \"signature\",\n  \"token\",\n]);\nconst REASONING_EFFORT_ORDER = new Map(\n  ReasoningEffort.options.map((effort, index) => [effort, index]),\n);\nconst MODALITY_ORDER = new Map([\"text\", \"image\", \"audio\"].map((value, index) => [value, index]));\nconst LATENCY_MODE_ORDER = new Map(\n  [\"standard\", \"priority\", \"fast\"].map((value, index) => [value, index]),\n);\n\nfunction normalizeRegistryBaseUrl(value: string, providerId: string): string {\n  const url = new URL(value);\n  if (url.username || url.password) {\n    throw new Error(`provider ${providerId} baseUrl must not contain userinfo`);\n  }\n  if (url.search) {\n    throw new Error(\n      `provider ${providerId} baseUrl must not contain a query; move query entries to defaultQuery`,\n    );\n  }\n  if (url.hash) {\n    throw new Error(`provider ${providerId} baseUrl must not contain a fragment`);\n  }\n  return url.toString();\n}\n\nfunction isCredentialLikeMetadataName(name: string): boolean {\n  return name\n    .toLowerCase()\n    .split(/[-_.]/u)\n    .some((part) => CREDENTIAL_LIKE_NAME_PARTS.has(part));\n}\n\nfunction normalizeHeaderMap(\n  providerId: string,\n  headers: Record<string, string> | undefined,\n): Record<string, string> | undefined {\n  if (!headers) {\n    return undefined;\n  }\n  const normalized: Record<string, string> = {};\n  const rawByNormalized = new Map<string, string>();\n  for (const [rawName, value] of Object.entries(headers)) {\n    if (!HTTP_FIELD_NAME.test(rawName)) {\n      throw new Error(\n        `provider ${providerId} defaultHeaders contains invalid HTTP field name ${JSON.stringify(rawName)}`,\n      );\n    }\n    const name = rawName.toLowerCase();\n    const previous = rawByNormalized.get(name);\n    if (previous !== undefined) {\n      throw new Error(\n        `provider ${providerId} defaultHeaders names ${JSON.stringify(previous)} and ${JSON.stringify(rawName)} collide after lowercase normalization`,\n      );\n    }\n    if (name === \"authorization\") {\n      throw new Error(\n        `provider ${providerId} defaultHeaders must not override SDK-managed Authorization`,\n      );\n    }\n    rawByNormalized.set(name, rawName);\n    normalized[name] = value;\n  }\n  return normalized;\n}\n\nfunction normalizePublicHeaderNames(\n  providerId: string,\n  names: string[] | undefined,\n  headers: Record<string, string> | undefined,\n): string[] | undefined {\n  if (!names) {\n    return undefined;\n  }\n  const normalized: string[] = [];\n  const seen = new Set<string>();\n  for (const rawName of names) {\n    if (!HTTP_FIELD_NAME.test(rawName)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultHeaderNames contains invalid HTTP field name ${JSON.stringify(rawName)}`,\n      );\n    }\n    const name = rawName.toLowerCase();\n    if (seen.has(name)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultHeaderNames contains duplicate normalized name ${JSON.stringify(name)}`,\n      );\n    }\n    if (!(name in (headers ?? {}))) {\n      throw new Error(\n        `provider ${providerId} publicDefaultHeaderNames declares absent defaultHeaders entry ${JSON.stringify(name)}`,\n      );\n    }\n    if (isCredentialLikeMetadataName(name)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultHeaderNames cannot classify credential-like name ${JSON.stringify(name)} as public`,\n      );\n    }\n    seen.add(name);\n    normalized.push(name);\n  }\n  return normalized;\n}\n\nfunction normalizeQueryMap(\n  providerId: string,\n  query: Record<string, string> | undefined,\n): Record<string, string> | undefined {\n  if (!query) {\n    return undefined;\n  }\n  for (const name of Object.keys(query)) {\n    if (!name) {\n      throw new Error(`provider ${providerId} defaultQuery contains an empty name`);\n    }\n  }\n  return { ...query };\n}\n\nfunction normalizePublicQueryNames(\n  providerId: string,\n  names: string[] | undefined,\n  query: Record<string, string> | undefined,\n): string[] | undefined {\n  if (!names) {\n    return undefined;\n  }\n  const seen = new Set<string>();\n  for (const name of names) {\n    if (seen.has(name)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultQueryNames contains duplicate name ${JSON.stringify(name)}`,\n      );\n    }\n    if (!(name in (query ?? {}))) {\n      throw new Error(\n        `provider ${providerId} publicDefaultQueryNames declares absent defaultQuery entry ${JSON.stringify(name)}`,\n      );\n    }\n    if (isCredentialLikeMetadataName(name)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultQueryNames cannot classify credential-like name ${JSON.stringify(name)} as public`,\n      );\n    }\n    seen.add(name);\n  }\n  return [...names];\n}\n\nfunction normalizeRegistryProvider(provider: RegistryProvider): RegistryProvider {\n  const defaultHeaders = normalizeHeaderMap(provider.id, provider.defaultHeaders);\n  const defaultQuery = normalizeQueryMap(provider.id, provider.defaultQuery);\n  return {\n    ...provider,\n    baseUrl: normalizeRegistryBaseUrl(provider.baseUrl, provider.id),\n    ...(defaultHeaders === undefined ? {} : { defaultHeaders }),\n    ...(defaultQuery === undefined ? {} : { defaultQuery }),\n    ...(provider.publicDefaultHeaderNames === undefined\n      ? {}\n      : {\n          publicDefaultHeaderNames: normalizePublicHeaderNames(\n            provider.id,\n            provider.publicDefaultHeaderNames,\n            defaultHeaders,\n          ),\n        }),\n    ...(provider.publicDefaultQueryNames === undefined\n      ? {}\n      : {\n          publicDefaultQueryNames: normalizePublicQueryNames(\n            provider.id,\n            provider.publicDefaultQueryNames,\n            defaultQuery,\n          ),\n        }),\n  };\n}\n\nfunction normalizeModelPricingSchedule(\n  pricing: ModelPricing | ModelPricingScheduleV1,\n): ModelPricingScheduleV1 {\n  return \"default\" in pricing ? pricing : { default: pricing };\n}\n\nfunction normalizeCapabilities(capabilities: ModelCapabilitiesV1): ModelCapabilitiesV1 {\n  const parsed = ModelCapabilitiesV1Schema.parse(capabilities);\n  return {\n    ...parsed,\n    reasoning: {\n      ...parsed.reasoning,\n      efforts: [...parsed.reasoning.efforts].sort(\n        (left, right) =>\n          (REASONING_EFFORT_ORDER.get(left) ?? 0) - (REASONING_EFFORT_ORDER.get(right) ?? 0),\n      ),\n    },\n    inputModalities: [...parsed.inputModalities].sort(\n      (left, right) => (MODALITY_ORDER.get(left) ?? 0) - (MODALITY_ORDER.get(right) ?? 0),\n    ),\n    inputFileMediaTypes: [...new Set(parsed.inputFileMediaTypes)].sort(),\n    outputModalities: [...parsed.outputModalities].sort(\n      (left, right) => (MODALITY_ORDER.get(left) ?? 0) - (MODALITY_ORDER.get(right) ?? 0),\n    ),\n    latencyModes: [...parsed.latencyModes].sort(\n      (left, right) =>\n        (LATENCY_MODE_ORDER.get(left.id) ?? 0) - (LATENCY_MODE_ORDER.get(right.id) ?? 0),\n    ),\n  };\n}\n\nfunction legacyModelCapabilities(\n  settings: Settings,\n  input: {\n    reasoningEffort: boolean;\n    hostedWebSearch: boolean;\n    hostedImageGeneration?: boolean;\n    vision?: boolean;\n  },\n): ModelCapabilitiesV1 {\n  const reasoningEfforts = input.reasoningEffort ? configuredAllowedReasoningEfforts(settings) : [];\n  return normalizeCapabilities({\n    reasoning: {\n      upstream: input.reasoningEffort ? \"supported\" : \"unknown\",\n      runnable: input.reasoningEffort,\n      efforts: reasoningEfforts,\n      defaultEffort: input.reasoningEffort ? settings.openaiReasoningEffort : null,\n      required: false,\n    },\n    functionCalling: { upstream: \"unknown\", runnable: true },\n    structuredOutput: { upstream: \"unknown\", runnable: false },\n    hostedTools: {\n      webSearch: {\n        upstream: input.hostedWebSearch ? \"supported\" : \"unknown\",\n        runnable: input.hostedWebSearch,\n      },\n      xSearch: { upstream: \"unknown\", runnable: false },\n      codeExecution: { upstream: \"unknown\", runnable: false },\n      imageGeneration: {\n        upstream: input.hostedImageGeneration ? \"supported\" : \"unknown\",\n        runnable: input.hostedImageGeneration ?? false,\n      },\n    },\n    inputModalities: input.vision ? [\"text\", \"image\"] : [\"text\"],\n    inputFileMediaTypes: [\n      \"application/json\",\n      \"application/pdf\",\n      \"application/x-yaml\",\n      \"application/yaml\",\n      \"text/*\",\n    ],\n    outputModalities: [\"text\"],\n    transports: {\n      sse: { upstream: \"unknown\", runnable: true },\n      responsesWebSocket: { upstream: \"unknown\", runnable: false },\n      realtimeAudio: { upstream: \"unknown\", runnable: false },\n    },\n    latencyModes: [{ id: \"standard\", upstream: \"unknown\", runnable: true }],\n  });\n}\n\nexport function gatewayRequestPolicyForUpstreamModel(\n  upstreamModelId: string,\n): ConfiguredModel[\"requestPolicy\"] {\n  const model = Object.values(OPENGENI_GATEWAY_MODELS).find(\n    (candidate) => candidate.upstreamModelId === upstreamModelId,\n  );\n  if (!model) {\n    return undefined;\n  }\n  return {\n    gateway: {\n      only: [...model.providers] as [string, ...string[]],\n      caching: model.implicitCaching ? \"auto\" : \"none\",\n    },\n  };\n}\n\nfunction gatewayModelCapabilities(\n  settings: Settings,\n  input: { implicitCaching: boolean; vision: boolean; inputFileMediaTypes?: string[] },\n): ModelCapabilitiesV1 {\n  const legacy = legacyModelCapabilities(settings, {\n    reasoningEffort: true,\n    hostedWebSearch: false,\n  });\n  return normalizeCapabilities({\n    ...legacy,\n    functionCalling: { upstream: \"supported\", runnable: true },\n    inputModalities: input.vision ? [\"text\", \"image\"] : [\"text\"],\n    inputFileMediaTypes: input.inputFileMediaTypes ?? [],\n    transports: {\n      ...legacy.transports,\n      sse: { upstream: \"supported\", runnable: true },\n    },\n    promptCaching: input.implicitCaching\n      ? { upstream: \"supported\", runnable: true, mode: \"implicit\" }\n      : { upstream: \"unsupported\", runnable: false, mode: \"none\" },\n    // Both Gateway products expose one reviewed route policy and no separately\n    // billed latency mode.\n    latencyModes: [{ id: \"standard\", upstream: \"supported\", runnable: true }],\n  });\n}\n\nfunction gatewayRegistryProvider(\n  settings: Settings,\n  input:\n    | { kind: \"vercel-gateway-managed\"; apiKey: string }\n    | { kind: \"vercel-gateway-workspace\"; apiKey?: string },\n): RegistryProvider {\n  const workspace = input.kind === \"vercel-gateway-workspace\";\n  const models = [OPENGENI_GATEWAY_MODELS.deepseek, OPENGENI_GATEWAY_MODELS.kimi].map((model) => {\n    const kimi = model === OPENGENI_GATEWAY_MODELS.kimi;\n    return {\n      id: workspace ? model.workspaceProductId : model.productId,\n      upstreamModelId: model.upstreamModelId,\n      label: model.label,\n      shortLabel: model.shortLabel,\n      capabilities: gatewayModelCapabilities(settings, {\n        implicitCaching: model.implicitCaching,\n        vision: kimi,\n        inputFileMediaTypes: kimi ? [\"application/pdf\"] : [],\n      }),\n      contextWindowTokens: 1_000_000,\n      effectiveContextWindowTokens: 900_000,\n      autoCompactTokenLimit: 850_000,\n      toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n    };\n  });\n  return {\n    kind: input.kind,\n    id: workspace ? WORKSPACE_GATEWAY_PROVIDER_ID : OPENGENI_GATEWAY_PROVIDER_ID,\n    label: workspace ? \"Your Gateway\" : \"OpenGeni\",\n    // Responses preserves vision, reasoning items, and provider-native usage.\n    // Model-specific compatibility stays at the reviewed request fence rather\n    // than downgrading the whole provider wire.\n    api: \"responses\",\n    baseUrl: VERCEL_AI_GATEWAY_BASE_URL,\n    ...(input.apiKey ? { apiKey: input.apiKey } : {}),\n    models,\n  };\n}\n\nfunction configuredRegistryProviders(settings: Settings): RegistryProvider[] {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  if (!settings.vercelAiGatewayApiKey) {\n    return providers;\n  }\n  if (providers.some((provider) => provider.id === OPENGENI_GATEWAY_PROVIDER_ID)) {\n    throw new Error(\n      `${OPENGENI_GATEWAY_PROVIDER_ID} is reserved for OPENGENI_VERCEL_AI_GATEWAY_API_KEY`,\n    );\n  }\n  return [\n    ...providers,\n    gatewayRegistryProvider(settings, {\n      kind: \"vercel-gateway-managed\",\n      apiKey: settings.vercelAiGatewayApiKey,\n    }),\n  ];\n}\n\n/** Static catalog overlay; it contains no concrete workspace credential. */\nexport function withWorkspaceGatewayCatalogProvider(settings: Settings): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  if (providers.some((provider) => provider.id === WORKSPACE_GATEWAY_PROVIDER_ID)) {\n    return settings;\n  }\n  return {\n    ...settings,\n    modelProvidersJson: JSON.stringify([\n      ...providers,\n      gatewayRegistryProvider(settings, { kind: \"vercel-gateway-workspace\" }),\n    ]),\n  };\n}\n\n/** Runtime overlay after the worker resolves the workspace's encrypted key. */\nexport function withWorkspaceGatewayCredential(settings: Settings, apiKey: string): Settings {\n  if (!apiKey.trim()) {\n    throw new Error(\"workspace AI Gateway credential is empty\");\n  }\n  const catalogSettings = withWorkspaceGatewayCatalogProvider(settings);\n  const providers = parseModelProvidersJson(catalogSettings.modelProvidersJson).map((provider) =>\n    provider.id === WORKSPACE_GATEWAY_PROVIDER_ID ? { ...provider, apiKey } : provider,\n  );\n  return { ...catalogSettings, modelProvidersJson: JSON.stringify(providers) };\n}\n\n/** OpenAI GPT-5.6 Fast mode is 2× Standard list rates (service_tier fast/priority). */\nconst GPT56_FAST_BILLING_MULTIPLIER_BPS = 20_000;\n\n/**\n * Product display label for catalog/picker UI.\n * Same string for OpenAI and Codex copies of a slug (`gpt-5.6-luna` and\n * `codex/gpt-5.6-luna` → `GPT-5.6 Luna`). Curated Grok slugs receive the same\n * product casing; other ids pass through unchanged.\n */\nexport function productLabelForModelId(modelId: string): string {\n  const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX)\n    ? modelId.slice(CODEX_MODEL_ID_PREFIX.length)\n    : modelId;\n  const grokMatch = /^grok-(\\d+(?:\\.\\d+)?)$/i.exec(slug);\n  if (grokMatch) {\n    return `Grok ${grokMatch[1]}`;\n  }\n  const match = /^(gpt-\\d+(?:\\.\\d+)?)(?:-(.+))?$/i.exec(slug);\n  if (!match) {\n    return slug;\n  }\n  const family = match[1]!.replace(/^gpt/i, \"GPT\");\n  const rest = match[2];\n  if (!rest) {\n    return family;\n  }\n  const suffix = rest\n    .split(\"-\")\n    .filter((part) => part.length > 0)\n    .map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase())\n    .join(\" \");\n  return suffix.length > 0 ? `${family} ${suffix}` : family;\n}\n\n/**\n * Curated compact product labels for dense UI. Unknown model slugs return null\n * so callers fall back to the full `label`.\n */\nexport function productShortLabelForModelId(modelId: string): string | null {\n  const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX)\n    ? modelId.slice(CODEX_MODEL_ID_PREFIX.length)\n    : modelId;\n  switch (slug) {\n    case \"grok-4.6\":\n      return \"4.6\";\n    case \"gpt-5.6-sol\":\n      return \"5.6 Sol\";\n    case \"gpt-5.6-terra\":\n      return \"5.6 Terra\";\n    case \"gpt-5.6-luna\":\n      return \"5.6 Luna\";\n    default:\n      return null;\n  }\n}\n\nfunction builtinLatencyModesForModel(modelId: string): Array<{\n  id: z.infer<typeof ModelLatencyModeV1>;\n  upstream: \"supported\" | \"unsupported\" | \"unknown\";\n  runnable: boolean;\n  billingMultiplierBps?: number;\n}> {\n  if (\n    modelId === \"gpt-5.6-sol\" ||\n    modelId === \"gpt-5.6-terra\" ||\n    modelId === \"gpt-5.6-luna\" ||\n    modelId.startsWith(\"codex/gpt-5.6-\")\n  ) {\n    return [\n      { id: \"standard\", upstream: \"supported\", runnable: true },\n      {\n        id: \"fast\",\n        upstream: \"supported\",\n        runnable: true,\n        billingMultiplierBps: GPT56_FAST_BILLING_MULTIPLIER_BPS,\n      },\n    ];\n  }\n  return [{ id: \"standard\", upstream: \"unknown\", runnable: true }];\n}\n\nfunction builtinPromptCachingForModel(\n  modelId: string,\n): NonNullable<ModelCapabilitiesV1[\"promptCaching\"]> | undefined {\n  const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX)\n    ? modelId.slice(CODEX_MODEL_ID_PREFIX.length)\n    : modelId;\n  return slug.startsWith(\"gpt-5.6-\")\n    ? { upstream: \"supported\", runnable: true, mode: \"implicit\" }\n    : undefined;\n}\n\n/** Reviewed direct-OpenAI text models that accept the hosted image tool. */\nfunction builtinHostedImageGenerationForModel(settings: Settings, modelId: string): boolean {\n  return (\n    settings.openaiProvider === \"openai\" &&\n    isDirectOpenAiApiBaseUrl(settings.openaiBaseUrl) &&\n    [\"gpt-5.6-sol\", \"gpt-5.6-terra\", \"gpt-5.6-luna\"].includes(modelId)\n  );\n}\n\n/** Undefined and the exact public OpenAI v1 endpoint are the same direct route. */\nexport function isDirectOpenAiApiBaseUrl(baseUrl: string | undefined): boolean {\n  if (baseUrl === undefined) return true;\n  try {\n    const parsed = new URL(baseUrl);\n    return (\n      parsed.protocol === \"https:\" &&\n      parsed.hostname === \"api.openai.com\" &&\n      parsed.port === \"\" &&\n      parsed.username === \"\" &&\n      parsed.password === \"\" &&\n      parsed.search === \"\" &&\n      parsed.hash === \"\" &&\n      parsed.pathname.replace(/\\/+$/, \"\") === \"/v1\"\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Map OpenGeni latency mode to the provider `service_tier` wire value.\n * Azure, Codex ChatGPT, and xAI accept `priority`; OpenAI API accepts `fast`.\n * Standard omits the field.\n */\nexport function serviceTierForLatencyMode(\n  providerId: string,\n  latencyMode: LatencyMode,\n): \"fast\" | \"priority\" | undefined {\n  if (latencyMode === \"standard\") {\n    return undefined;\n  }\n  if (\n    providerId === \"azure\" ||\n    providerId === CODEX_PROVIDER_ID ||\n    providerId === XAI_SUBSCRIPTION_PROVIDER_ID\n  ) {\n    return \"priority\";\n  }\n  return \"fast\";\n}\n\n/** True when the response tier fulfills a non-standard Fast/priority request. */\nexport function responseSatisfiesLatencyMode(\n  requested: LatencyMode,\n  responseServiceTier: string | null | undefined,\n): boolean {\n  if (requested === \"standard\") {\n    return true;\n  }\n  return responseServiceTier === \"priority\" || responseServiceTier === \"fast\";\n}\n\nexport function runnableLatencyModesForModel(settings: Settings, modelId: string): LatencyMode[] {\n  const resolved = resolveModelProvider(\n    settingsForTurnExecutionPolicy(settings, modelId),\n    canonicalizeConfiguredModelId(settings, modelId),\n  );\n  if (!resolved) {\n    return [\"standard\"];\n  }\n  return resolved.model.capabilities.latencyModes\n    .filter((mode) => mode.runnable)\n    .map((mode) => LatencyMode.parse(mode.id));\n}\n\nfunction assertLatencyModeRunnable(\n  settings: Settings,\n  modelId: string,\n  latencyMode: LatencyMode,\n): void {\n  const runnable = runnableLatencyModesForModel(settings, modelId);\n  if (!runnable.includes(latencyMode)) {\n    throw new Error(\n      `latency mode ${latencyMode} is not runnable for model ${modelId} (allowed: ${runnable.join(\", \")})`,\n    );\n  }\n}\n\nfunction registryCredentialSource(provider: RegistryProvider): CredentialSourceV1 {\n  if (provider.kind === \"codex-subscription\") {\n    return { kind: \"connected_subscription\", provider: \"codex\" };\n  }\n  if (provider.kind === \"xai-subscription\") {\n    return { kind: \"connected_subscription\", provider: \"xai\" };\n  }\n  if (provider.kind === \"vercel-gateway-workspace\") {\n    return { kind: \"workspace_connection\", mechanism: \"api_key\" };\n  }\n  return { kind: \"deployment\", mechanism: \"api_key\" };\n}\n\nfunction registryBilling(provider: RegistryProvider): BillingAttributionV1 {\n  if (provider.kind === \"codex-subscription\" || provider.kind === \"xai-subscription\") {\n    return { upstreamPayer: \"connected_subscription\", metering: \"external\" };\n  }\n  if (provider.kind === \"vercel-gateway-workspace\") {\n    return { upstreamPayer: \"workspace\", metering: \"external\" };\n  }\n  return { upstreamPayer: \"deployment\", metering: \"opengeni_credits\" };\n}\n\nfunction builtinCredentialSource(settings: Settings): CredentialSourceV1 {\n  if (settings.openaiProvider === \"azure\" && !settings.azureOpenaiApiKey) {\n    return { kind: \"deployment\", mechanism: \"azure_ad_bearer\" };\n  }\n  return { kind: \"deployment\", mechanism: \"api_key\" };\n}\n\nfunction staticRequestMetadataForDigest(provider: ResolvedModelProvider): {\n  headers: Array<{\n    name: string;\n    classification: \"public\" | \"secret\";\n    value?: string;\n  }>;\n  query: Array<{\n    name: string;\n    classification: \"public\" | \"secret\";\n    value?: string;\n  }>;\n} {\n  const publicHeaders = new Set(provider.publicDefaultHeaderNames ?? []);\n  const publicQuery = new Set(provider.publicDefaultQueryNames ?? []);\n  return {\n    headers: Object.entries(provider.defaultHeaders ?? {})\n      .sort(([left], [right]) => left.localeCompare(right))\n      .map(([name, value]) =>\n        publicHeaders.has(name)\n          ? { name, classification: \"public\" as const, value }\n          : { name, classification: \"secret\" as const },\n      ),\n    query: Object.entries(provider.defaultQuery ?? {})\n      .sort(([left], [right]) => left.localeCompare(right))\n      .map(([name, value]) =>\n        publicQuery.has(name)\n          ? { name, classification: \"public\" as const, value }\n          : { name, classification: \"secret\" as const },\n      ),\n  };\n}\n\nfunction canonicalJson(value: unknown): string {\n  const normalize = (input: unknown): unknown => {\n    if (Array.isArray(input)) {\n      return input.map((entry) => normalize(entry));\n    }\n    if (input && typeof input === \"object\") {\n      const out: Record<string, unknown> = {};\n      for (const key of Object.keys(input).sort()) {\n        const child = (input as Record<string, unknown>)[key];\n        if (child !== undefined) {\n          out[key] = normalize(child);\n        }\n      }\n      return out;\n    }\n    return input;\n  };\n  return JSON.stringify(normalize(value));\n}\n\nfunction definitionVersionFor(\n  model: Omit<ConfiguredModel, \"definitionVersion\">,\n  provider: ResolvedModelProvider,\n): string {\n  const requestMetadata = staticRequestMetadataForDigest(provider);\n  const digestInput = canonicalJson({\n    schemaVersion: model.schemaVersion,\n    id: model.id,\n    providerId: model.providerId,\n    deployment: model.deployment,\n    provider: {\n      adapterKind: provider.kind,\n      wireApi: provider.api,\n      baseUrl: provider.baseUrl ?? null,\n      defaultHeaders: requestMetadata.headers,\n      defaultQuery: requestMetadata.query,\n    },\n    credentialSource: model.credentialSource,\n    billing: model.billing,\n    executionLimits: model.executionLimits,\n    capabilities: model.capabilities,\n    ...(model.requestPolicy ? { requestPolicy: model.requestPolicy } : {}),\n    pricing: model.pricing ?? null,\n  });\n  return `sha256:${createHash(\"sha256\")\n    .update(\"opengeni:model-definition:v1\\n\", \"utf8\")\n    .update(digestInput, \"utf8\")\n    .digest(\"hex\")}`;\n}\n\n/**\n * The built-in provider's stable id: \"openai\" on the OpenAI platform, \"azure\"\n * on Azure. Exported because the workspace model-policy gate must attribute\n * the legacy resolveTurnModel-null fallback (which routes to this built-in\n * client) to the SAME identity the router uses — otherwise a policy blocking\n * the built-in could be bypassed through the null-resolution path.\n */\nexport function builtinProviderId(settings: Pick<Settings, \"openaiProvider\">): string {\n  return settings.openaiProvider === \"azure\" ? \"azure\" : \"openai\";\n}\n\nfunction builtinProviderLabel(settings: Pick<Settings, \"openaiProvider\">): string {\n  return settings.openaiProvider === \"azure\" ? \"Azure OpenAI\" : \"OpenAI\";\n}\n\n/**\n * Every provider a client may route to: the built-in OpenAI/Azure provider\n * first (id \"openai\"/\"azure\", always \"responses\"), then each registry provider\n * in declaration order. Client-construction inputs are filled from\n * the existing flat openai/azure settings for the built-in, and from the\n * registry entry for the rest. Registry ids may not collide with the built-in\n * id — validateSettings rejects that at boot.\n */\nexport function configuredProviders(settings: Settings): ResolvedModelProvider[] {\n  const credentialSource = builtinCredentialSource(settings);\n  const builtin: ResolvedModelProvider = {\n    id: builtinProviderId(settings),\n    label: builtinProviderLabel(settings),\n    kind: \"api-key\",\n    api: \"responses\",\n    builtin: true,\n    credentialSource,\n    billing: { upstreamPayer: \"deployment\", metering: \"opengeni_credits\" },\n  };\n  if (settings.openaiProvider === \"azure\") {\n    const baseUrl = settings.azureOpenaiBaseUrl ?? settings.azureOpenaiEndpoint;\n    builtin.baseUrl = baseUrl ? normalizeRegistryBaseUrl(baseUrl, builtin.id) : undefined;\n    builtin.apiKey = settings.azureOpenaiApiKey ?? settings.azureOpenaiAdToken;\n  } else {\n    builtin.baseUrl = settings.openaiBaseUrl\n      ? normalizeRegistryBaseUrl(settings.openaiBaseUrl, builtin.id)\n      : undefined;\n    builtin.apiKey = settings.openaiApiKey;\n  }\n  const registry = configuredRegistryProviders(settings).map(\n    (provider): ResolvedModelProvider => ({\n      id: provider.id,\n      label: provider.label ?? provider.id,\n      kind: provider.kind,\n      api: provider.api,\n      builtin: false,\n      baseUrl: provider.baseUrl,\n      apiKey: resolveProviderApiKey(provider),\n      defaultQuery: provider.defaultQuery,\n      defaultHeaders: provider.defaultHeaders,\n      publicDefaultQueryNames: provider.publicDefaultQueryNames,\n      publicDefaultHeaderNames: provider.publicDefaultHeaderNames,\n      credentialSource: registryCredentialSource(provider),\n      billing: registryBilling(provider),\n    }),\n  );\n  return [builtin, ...registry];\n}\n\n/**\n * Pure catalog overlay for a workspace whose existing Codex connection seam\n * reports ready. This describes product/provider identity only; it does not\n * select, lease, refresh, or expose a concrete credential; those runtime\n * operations remain owned by the credential allocator.\n */\nexport function withCodexCatalogProvider(settings: Settings): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  if (providers.some((provider) => provider.id === CODEX_PROVIDER_ID)) {\n    return settings;\n  }\n  const provider: RegistryProvider = {\n    kind: \"codex-subscription\",\n    id: CODEX_PROVIDER_ID,\n    label: \"Codex (ChatGPT subscription)\",\n    api: \"responses\",\n    baseUrl: CODEX_PROVIDER_BASE_URL,\n    models: CODEX_FALLBACK_MODEL_SLUGS.map((slug) => {\n      const capabilities = {\n        ...legacyModelCapabilities(settings, {\n          reasoningEffort: true,\n          hostedWebSearch: true,\n          vision: slug.startsWith(\"gpt-5.6-\"),\n        }),\n        ...(builtinPromptCachingForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`)\n          ? {\n              promptCaching: builtinPromptCachingForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`)!,\n            }\n          : {}),\n        latencyModes: builtinLatencyModesForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`),\n      };\n      return {\n        id: `${CODEX_MODEL_ID_PREFIX}${slug}`,\n        upstreamModelId: slug,\n        label: productLabelForModelId(slug),\n        ...(productShortLabelForModelId(slug)\n          ? { shortLabel: productShortLabelForModelId(slug)! }\n          : {}),\n        reasoningEffort: true,\n        // The ChatGPT/Codex Responses backend accepts the native web_search\n        // hosted tool (unlike hosted apply_patch/computer transports). Declaring\n        // this here makes provider resolution truthful; the worker still applies\n        // the durable session/turn policy gate before attaching it.\n        hostedWebSearch: true,\n        capabilities,\n        contextWindowTokens: CODEX_MODEL_CONTEXT_WINDOW_TOKENS,\n        effectiveContextWindowTokens: CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,\n        autoCompactTokenLimit: CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT,\n        toolOutputTruncationTokens: CODEX_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS,\n      };\n    }),\n  };\n  return {\n    ...settings,\n    modelProvidersJson: JSON.stringify([...providers, provider]),\n  };\n}\n\n/**\n * Static SuperGrok product catalogue, matching the Codex subscription seam.\n * The overlay never contains a concrete account id or bearer; selection and\n * per-turn credential freeze remain worker/DB responsibilities.\n */\nexport function withXaiSubscriptionCatalogProvider(settings: Settings): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  if (providers.some((provider) => provider.id === XAI_SUBSCRIPTION_PROVIDER_ID)) {\n    return settings;\n  }\n  const provider: RegistryProvider = {\n    kind: \"xai-subscription\",\n    id: XAI_SUBSCRIPTION_PROVIDER_ID,\n    label: \"SuperGrok (xAI subscription)\",\n    api: \"responses\",\n    baseUrl: XAI_SUBSCRIPTION_PROXY_BASE_URL,\n    models: XAI_SUBSCRIPTION_MODEL_SLUGS.map((slug) => {\n      const capabilities = legacyModelCapabilities(settings, {\n        reasoningEffort: true,\n        hostedWebSearch: true,\n      });\n      capabilities.reasoning.efforts = [\"low\", \"medium\", \"high\", \"xhigh\"];\n      capabilities.reasoning.defaultEffort = \"high\";\n      capabilities.latencyModes = [\n        { id: \"standard\", upstream: \"supported\", runnable: true },\n        { id: \"fast\", upstream: \"supported\", runnable: true },\n      ];\n      capabilities.hostedTools.xSearch = { upstream: \"supported\", runnable: true };\n      capabilities.hostedTools.imageGeneration = { upstream: \"supported\", runnable: true };\n      return {\n        id: `${XAI_SUBSCRIPTION_MODEL_ID_PREFIX}${slug}`,\n        upstreamModelId: slug,\n        label: productLabelForModelId(slug),\n        ...(productShortLabelForModelId(slug)\n          ? { shortLabel: productShortLabelForModelId(slug)! }\n          : {}),\n        reasoningEffort: true,\n        hostedWebSearch: true,\n        capabilities,\n        contextWindowTokens: XAI_SUBSCRIPTION_MODEL_CONTEXT_WINDOW_TOKENS,\n        effectiveContextWindowTokens: XAI_SUBSCRIPTION_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,\n        autoCompactTokenLimit: XAI_SUBSCRIPTION_MODEL_AUTO_COMPACT_TOKEN_LIMIT,\n        toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n      };\n    }),\n  };\n  return { ...settings, modelProvidersJson: JSON.stringify([...providers, provider]) };\n}\n\n/**\n * The provider identity a model id resolves to, for workspace model-policy\n * evaluation — MUST agree with the real router (resolveTurnModel /\n * MultiProviderModelProvider) on every case:\n *   - `codex/<slug>` → the codex-subscription provider id, ALWAYS. With no\n *     active subscription the router fails loud (CodexSubscriptionUnavailableError),\n *     never the built-in — so attributing by prefix is exact even against BASE\n *     settings where the overlay provider is not injected.\n *   - a configured model id → its configuredModels providerId (registry or built-in).\n *   - anything else → the built-in id: an unknown id is the legacy\n *     resolveTurnModel-null fallback, which the built-in OpenAI/Azure client\n *     serves. A policy blocking the built-in must block this path too.\n */\nexport function policyProviderIdForModel(settings: Settings, modelId: string): string {\n  const canonicalModelId = canonicalizeConfiguredModelId(settings, modelId);\n  if (canonicalModelId.startsWith(CODEX_MODEL_ID_PREFIX)) {\n    return CODEX_PROVIDER_ID;\n  }\n  if (canonicalModelId.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX)) {\n    return XAI_SUBSCRIPTION_PROVIDER_ID;\n  }\n  if (canonicalModelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {\n    return WORKSPACE_GATEWAY_PROVIDER_ID;\n  }\n  const configured = configuredModels(settings).find((model) => model.id === canonicalModelId);\n  return configured?.providerId ?? builtinProviderId(settings);\n}\n\nfunction resolvedExecutionLimits(\n  settings: Settings,\n  model: {\n    contextWindowTokens?: number | undefined;\n    effectiveContextWindowTokens?: number | undefined;\n    autoCompactTokenLimit?: number | undefined;\n    toolOutputTruncationTokens?: number | undefined;\n  },\n): ModelExecutionLimitsV1 {\n  return {\n    contextWindowTokens: model.contextWindowTokens ?? settings.contextWindowTokens,\n    effectiveContextWindowTokens:\n      model.effectiveContextWindowTokens ?? settings.contextEffectiveWindowTokens ?? null,\n    autoCompactTokenLimit:\n      model.autoCompactTokenLimit ?? settings.contextAutoCompactThresholdTokens ?? null,\n    toolOutputTruncationTokens:\n      model.toolOutputTruncationTokens ?? settings.modelToolOutputTruncationTokens ?? null,\n  };\n}\n\nfunction finalizeConfiguredModel(\n  settings: Settings,\n  provider: ResolvedModelProvider,\n  input: Omit<ConfiguredModel, \"schemaVersion\" | \"definitionVersion\" | \"executionLimits\">,\n): ConfiguredModel {\n  const requestPolicy =\n    provider.kind === \"vercel-gateway-managed\" || provider.kind === \"vercel-gateway-workspace\"\n      ? gatewayRequestPolicyForUpstreamModel(input.upstreamModelId)\n      : undefined;\n  const modelWithoutVersion: Omit<ConfiguredModel, \"definitionVersion\"> = {\n    schemaVersion: 1,\n    ...input,\n    ...(requestPolicy ? { requestPolicy } : {}),\n    executionLimits: resolvedExecutionLimits(settings, input),\n  };\n  return {\n    ...modelWithoutVersion,\n    definitionVersion: definitionVersionFor(modelWithoutVersion, provider),\n  };\n}\n\nfunction assertUniqueModelIdentities(models: ConfiguredModel[]): void {\n  const canonicalOwners = new Map<string, string>();\n  for (const model of models) {\n    const previous = canonicalOwners.get(model.id);\n    if (previous !== undefined) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON model id ${JSON.stringify(model.id)} is declared by both ${previous} and ${model.providerId}`,\n      );\n    }\n    canonicalOwners.set(model.id, model.providerId);\n  }\n\n  const acceptedInputs = new Map(canonicalOwners);\n  for (const model of models) {\n    const ownAliases = new Set<string>();\n    for (const alias of model.aliases) {\n      if (ownAliases.has(alias)) {\n        throw new Error(\n          `OPENGENI_MODEL_PROVIDERS_JSON model ${JSON.stringify(model.id)} contains duplicate alias ${JSON.stringify(alias)}`,\n        );\n      }\n      ownAliases.add(alias);\n      const previous = acceptedInputs.get(alias);\n      if (previous !== undefined) {\n        throw new Error(\n          `OPENGENI_MODEL_PROVIDERS_JSON alias ${JSON.stringify(alias)} for model ${JSON.stringify(model.id)} collides with model/provider ${previous}`,\n        );\n      }\n      acceptedInputs.set(alias, model.id);\n    }\n  }\n}\n\n/**\n * Every model a client may use, the built-in provider's models first\n * (configuredAllowedModels-from-openai, mapped to \"responses\" with\n * hostedWebSearch/contextWindow/reasoningEffort from the flat settings), then\n * each registry provider's models (label→id, hostedWebSearch/reasoningEffort\n * default false). De-duplicated by id (first wins) so the default model stays\n * first and the built-in allow-list takes precedence over registry entries.\n */\nexport function configuredModels(settings: Settings): ConfiguredModel[] {\n  const builtinId = builtinProviderId(settings);\n  const builtinLabel = builtinProviderLabel(settings);\n  const providers = configuredProviders(settings);\n  const providerById = new Map(providers.map((provider) => [provider.id, provider]));\n  const pricingSchedules = configuredModelPricingSchedules(settings);\n  // The built-in (OpenAI/Azure) provider must NEVER claim a registry-namespaced\n  // model id. The worker overwrites settings.openaiModel with the turn's model\n  // (apps/worker agent-turn runSettings) — including a `codex/<slug>` id, or a\n  // registry id like \"accounts/fireworks/models/glm-5p2\" — so without this\n  // filter the built-in allow-list would emit a `{ id, providerId: <azure> }`\n  // entry that, by the first-wins de-dup below, shadows the real registry /\n  // codex-subscription provider and ships the id to Azure as a deployment name\n  // (opaque DeploymentNotFound 404). A `<provider>/<model>`-namespaced id (it\n  // contains \"/\") that a registry actually owns is never a valid Azure/OpenAI\n  // deployment name, and a `codex/`-prefixed id never is either — exclude both\n  // from the built-in list. A BARE id a registry merely redeclares (e.g.\n  // \"gpt-5.6-sol\") is left in place so the built-in still wins it via the first-wins\n  // de-dup below (preserving the documented built-in-precedence contract). When\n  // a codex/ id has NO codex provider injected (no active subscription) it then\n  // resolves to nothing and getModel fails loud with\n  // CodexSubscriptionUnavailableError instead of mis-routing to Azure.\n  const parsedRegistry = configuredRegistryProviders(settings);\n  const registryOwnedIds = new Set(\n    parsedRegistry.flatMap((provider) => provider.models.map((model) => model.id)),\n  );\n  const registryAliases = new Set(\n    parsedRegistry.flatMap((provider) => provider.models.flatMap((model) => model.aliases ?? [])),\n  );\n  const isRegistryNamespaced = (id: string): boolean =>\n    id.startsWith(CODEX_MODEL_ID_PREFIX) ||\n    id.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX) ||\n    registryAliases.has(id) ||\n    (id.includes(\"/\") && registryOwnedIds.has(id));\n  const builtinProvider = providerById.get(builtinId);\n  if (!builtinProvider) {\n    throw new Error(`Built-in model provider ${builtinId} is not configured`);\n  }\n  const out: ConfiguredModel[] = uniqueValues([\n    settings.openaiModel,\n    ...splitCsv(settings.openaiAllowedModels),\n  ])\n    .filter((id) => !isRegistryNamespaced(id))\n    .map((id) => {\n      const capabilities = {\n        ...legacyModelCapabilities(settings, {\n          reasoningEffort: true,\n          hostedWebSearch: settings.webSearchEnabled,\n          hostedImageGeneration: builtinHostedImageGenerationForModel(settings, id),\n          vision: id.startsWith(\"gpt-5.6-\"),\n        }),\n        ...(builtinPromptCachingForModel(id)\n          ? { promptCaching: builtinPromptCachingForModel(id)! }\n          : {}),\n        latencyModes: builtinLatencyModesForModel(id),\n      };\n      return finalizeConfiguredModel(settings, builtinProvider, {\n        id,\n        aliases: [],\n        label: productLabelForModelId(id),\n        ...(productShortLabelForModelId(id)\n          ? { shortLabel: productShortLabelForModelId(id)! }\n          : {}),\n        providerId: builtinId,\n        providerLabel: builtinLabel,\n        api: \"responses\" as const,\n        upstreamModelId: id,\n        deployment: { upstreamModelId: id, wireApi: \"responses\" },\n        credentialSource: builtinProvider.credentialSource,\n        billing: builtinProvider.billing,\n        capabilities,\n        ...(pricingSchedules[id] === undefined ? {} : { pricing: pricingSchedules[id] }),\n        contextWindowTokens: settings.contextWindowTokens,\n        toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n        reasoningEffort: capabilities.reasoning.runnable,\n        hostedWebSearch: capabilities.hostedTools.webSearch.runnable,\n      });\n    });\n  for (const provider of parsedRegistry) {\n    const providerLabel = provider.label ?? provider.id;\n    const resolvedProvider = providerById.get(provider.id);\n    if (!resolvedProvider) {\n      throw new Error(`Registry model provider ${provider.id} is not configured`);\n    }\n    for (const model of provider.models) {\n      const capabilities = model.capabilities\n        ? normalizeCapabilities(model.capabilities)\n        : legacyModelCapabilities(settings, {\n            reasoningEffort: model.reasoningEffort ?? false,\n            hostedWebSearch: model.hostedWebSearch ?? false,\n          });\n      const upstreamModelId = model.upstreamModelId ?? model.id;\n      out.push(\n        finalizeConfiguredModel(settings, resolvedProvider, {\n          id: model.id,\n          aliases: [...(model.aliases ?? [])],\n          label: model.label ?? productLabelForModelId(model.id),\n          ...(model.shortLabel\n            ? { shortLabel: model.shortLabel }\n            : productShortLabelForModelId(model.id)\n              ? { shortLabel: productShortLabelForModelId(model.id)! }\n              : {}),\n          providerId: provider.id,\n          providerLabel,\n          api: provider.api,\n          upstreamModelId,\n          deployment: { upstreamModelId, wireApi: provider.api },\n          credentialSource: resolvedProvider.credentialSource,\n          billing: resolvedProvider.billing,\n          capabilities,\n          ...(pricingSchedules[model.id] === undefined\n            ? {}\n            : { pricing: pricingSchedules[model.id] }),\n          ...(model.contextWindowTokens === undefined\n            ? {}\n            : { contextWindowTokens: model.contextWindowTokens }),\n          ...(model.effectiveContextWindowTokens === undefined\n            ? {}\n            : {\n                effectiveContextWindowTokens: model.effectiveContextWindowTokens,\n              }),\n          ...(model.autoCompactTokenLimit === undefined\n            ? {}\n            : { autoCompactTokenLimit: model.autoCompactTokenLimit }),\n          ...(model.toolOutputTruncationTokens === undefined\n            ? {}\n            : { toolOutputTruncationTokens: model.toolOutputTruncationTokens }),\n          reasoningEffort: capabilities.reasoning.runnable,\n          hostedWebSearch: capabilities.hostedTools.webSearch.runnable,\n        }),\n      );\n    }\n  }\n  assertUniqueModelIdentities(out);\n  return out;\n}\n\n/** Resolve a known canonical id or alias. Unknown strings are returned unchanged. */\nexport function canonicalizeConfiguredModelId(settings: Settings, modelId: string): string {\n  const models = configuredModels(settings);\n  const canonical = models.find((model) => model.id === modelId);\n  if (canonical) {\n    return canonical.id;\n  }\n  return models.find((model) => model.aliases.includes(modelId))?.id ?? modelId;\n}\n\n/**\n * Allowed model ids in selection order. Reimplemented on top of\n * configuredModels so it is the union of the built-in allow-list and every\n * registry provider's ids, de-duplicated. INVARIANT (existing callers + tests\n * depend on it): settings.openaiModel is always first, then the rest of the\n * openai allow-list, then registry ids.\n */\nexport function configuredAllowedModels(settings: Settings): string[] {\n  return configuredModels(settings).map((model) => model.id);\n}\n\n/**\n * Resolve a model string to the provider that serves it and its configured\n * shape. Returns undefined when the id is not exposed (built-in allow-list nor\n * any registry provider), so the runtime can fall back to the legacy global\n * client path.\n */\nexport function resolveModelProvider(\n  settings: Settings,\n  modelId: string,\n): { provider: ResolvedModelProvider; model: ConfiguredModel } | undefined {\n  const canonicalModelId = canonicalizeConfiguredModelId(settings, modelId);\n  const model = configuredModels(settings).find((candidate) => candidate.id === canonicalModelId);\n  if (!model) {\n    return undefined;\n  }\n  const provider = configuredProviders(settings).find(\n    (candidate) => candidate.id === model.providerId,\n  );\n  if (!provider) {\n    return undefined;\n  }\n  return { provider, model };\n}\n\nexport type ResolveTurnExecutionPolicyV1Input = {\n  /** Effective persisted turn model. Aliases are accepted and canonicalized. */\n  modelId: string;\n  /** Exact caller-supplied input before canonicalization, only for explicit switches. */\n  requestedModelId: string | null;\n  modelSource: TurnExecutionModelSourceV1;\n  reasoningEffort: Settings[\"openaiReasoningEffort\"];\n  reasoningSource: TurnExecutionReasoningSourceV1;\n  latencyMode?: LatencyMode;\n  latencyModeSource?: TurnExecutionLatencyModeSourceV1;\n};\n\nfunction settingsForTurnExecutionPolicy(settings: Settings, modelId: string): Settings {\n  if (settings.codexSubscriptionEnabled && modelId.startsWith(CODEX_MODEL_ID_PREFIX)) {\n    return withCodexCatalogProvider(settings);\n  }\n  if (\n    settings.supergrokSubscriptionEnabled &&\n    modelId.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX)\n  ) {\n    return withXaiSubscriptionCatalogProvider(settings);\n  }\n  if (modelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {\n    return withWorkspaceGatewayCatalogProvider(settings);\n  }\n  return settings;\n}\n\n/**\n * Build a trusted, secret-safe execution policy from the normalized catalog.\n * The Codex overlay here contains static product/provider identity only; it\n * neither proves readiness nor chooses, decrypts, leases, or exposes an account.\n */\nexport function resolveTurnExecutionPolicyV1(\n  settings: Settings,\n  input: ResolveTurnExecutionPolicyV1Input,\n): TurnExecutionPolicyV1 {\n  const catalogSettings = settingsForTurnExecutionPolicy(settings, input.modelId);\n  const productModelId = canonicalizeConfiguredModelId(catalogSettings, input.modelId);\n  const resolved = resolveModelProvider(catalogSettings, productModelId);\n  if (!resolved) {\n    throw new Error(\"Turn execution policy model is not present in the configured catalog\");\n  }\n  if (\n    input.requestedModelId !== null &&\n    canonicalizeConfiguredModelId(catalogSettings, input.requestedModelId) !== productModelId\n  ) {\n    throw new Error(\"Turn execution policy requested model does not canonicalize to its product\");\n  }\n  const latencyMode = LatencyMode.parse(input.latencyMode ?? \"standard\");\n  const latencyModeSource = input.latencyModeSource ?? \"deployment\";\n  assertLatencyModeRunnable(catalogSettings, productModelId, latencyMode);\n  return TurnExecutionPolicyV1.parse({\n    schemaVersion: 1,\n    productModelId,\n    requestedModelId: input.requestedModelId,\n    modelSource: input.modelSource,\n    reasoningEffort: input.reasoningEffort,\n    reasoningSource: input.reasoningSource,\n    latencyMode,\n    latencyModeSource,\n    providerId: resolved.provider.id,\n    upstreamModelId: resolved.model.upstreamModelId,\n    wireApi: resolved.model.api,\n    credentialSource: resolved.model.credentialSource,\n    billing: resolved.model.billing,\n    definitionVersion: resolved.model.definitionVersion,\n  });\n}\n\n/**\n * Parse-time validation lives in @opengeni/contracts; this verifier binds a\n * present snapshot to the current executable definition and exact turn row.\n * Any deployment/provider drift fails before a provider or compaction call.\n */\nexport function assertTurnExecutionPolicyMatchesConfigV1(\n  settings: Settings,\n  policy: TurnExecutionPolicyV1,\n  expected: {\n    modelId: string;\n    reasoningEffort: Settings[\"openaiReasoningEffort\"];\n    latencyMode?: LatencyMode;\n  },\n): {\n  policy: TurnExecutionPolicyV1;\n  provider: ResolvedModelProvider;\n  model: ConfiguredModel;\n} {\n  const parsed = TurnExecutionPolicyV1.parse(policy);\n  const catalogSettings = settingsForTurnExecutionPolicy(settings, parsed.productModelId);\n  const canonicalExpectedModel = canonicalizeConfiguredModelId(catalogSettings, expected.modelId);\n  const expectedLatencyMode = expected.latencyMode ?? parsed.latencyMode;\n  if (\n    parsed.productModelId !== canonicalExpectedModel ||\n    parsed.reasoningEffort !== expected.reasoningEffort ||\n    parsed.latencyMode !== expectedLatencyMode\n  ) {\n    throw new Error(\n      \"Turn execution policy does not match the accepted turn model/reasoning/latency\",\n    );\n  }\n  assertLatencyModeRunnable(catalogSettings, parsed.productModelId, parsed.latencyMode);\n  if (\n    parsed.requestedModelId !== null &&\n    canonicalizeConfiguredModelId(catalogSettings, parsed.requestedModelId) !==\n      parsed.productModelId\n  ) {\n    throw new Error(\"Turn execution policy requested model does not match its product model\");\n  }\n  const resolved = resolveModelProvider(catalogSettings, parsed.productModelId);\n  if (!resolved) {\n    throw new Error(\"Turn execution policy model is no longer configured\");\n  }\n  const mismatched =\n    parsed.providerId !== resolved.provider.id ||\n    parsed.upstreamModelId !== resolved.model.upstreamModelId ||\n    parsed.wireApi !== resolved.model.api ||\n    parsed.definitionVersion !== resolved.model.definitionVersion ||\n    canonicalJson(parsed.credentialSource) !== canonicalJson(resolved.model.credentialSource) ||\n    canonicalJson(parsed.billing) !== canonicalJson(resolved.model.billing);\n  if (mismatched) {\n    throw new Error(\"Turn execution policy does not match the current provider definition\");\n  }\n  return { policy: parsed, provider: resolved.provider, model: resolved.model };\n}\n\n/**\n * Effective per-model pricing schedules. Merge order (later wins): built-in\n * flat defaults → registry model flat/scheduled pricing → explicit legacy flat\n * OPENGENI_MODEL_PRICING_JSON. The explicit legacy map intentionally replaces\n * a registry schedule with one flat default so its historical precedence stays\n * exact.\n */\nexport function configuredModelPricingSchedules(\n  settings: Settings,\n): Record<string, ModelPricingScheduleV1> {\n  const defaults = Object.fromEntries(\n    Object.entries(defaultModelPricing).map(([model, pricing]) => [\n      model,\n      normalizeModelPricingSchedule(pricing),\n    ]),\n  );\n  const registry: Record<string, ModelPricingScheduleV1> = {};\n  for (const provider of configuredRegistryProviders(settings)) {\n    for (const model of provider.models) {\n      if (model.pricing) {\n        registry[model.id] = normalizeModelPricingSchedule(model.pricing);\n      }\n    }\n  }\n  const configured = Object.fromEntries(\n    Object.entries(parseModelPricingJson(settings.modelPricingJson)).map(([model, pricing]) => [\n      model,\n      { default: pricing },\n    ]),\n  );\n  return {\n    ...defaults,\n    ...registry,\n    ...configured,\n  };\n}\n\n/** Legacy flat projection: returns the default/below-threshold price. */\nexport function configuredModelPricing(settings: Settings): Record<string, ModelPricing> {\n  return Object.fromEntries(\n    Object.entries(configuredModelPricingSchedules(settings)).map(([model, schedule]) => [\n      model,\n      schedule.default,\n    ]),\n  );\n}\n\n/** Select the per-provider-request price at an exact input-token threshold. */\nexport function selectModelPricing(\n  schedule: ModelPricingScheduleV1,\n  inputTokens: number,\n): ModelPricing {\n  const normalizedInputTokens = Math.max(0, Math.floor(inputTokens));\n  let selected = schedule.default;\n  for (const tier of schedule.inputTokenTiers ?? []) {\n    if (normalizedInputTokens < tier.minimumInputTokens) {\n      break;\n    }\n    selected = tier.pricing;\n  }\n  return selected;\n}\n\n/**\n * Usable input-token budget: an explicit model-catalog effective window when\n * available, otherwise the deployment window minus its output reserve.\n */\nexport function contextInputBudgetTokens(\n  settings: Pick<\n    Settings,\n    \"contextWindowTokens\" | \"contextEffectiveWindowTokens\" | \"contextReservedOutputTokens\"\n  >,\n): number {\n  if (settings.contextEffectiveWindowTokens !== undefined) {\n    return Math.min(settings.contextWindowTokens, settings.contextEffectiveWindowTokens);\n  }\n  return Math.max(0, settings.contextWindowTokens - settings.contextReservedOutputTokens);\n}\n\n/**\n * Apply the resolved provider/model's context policy to one turn. Registry\n * metadata is authoritative when present; deployment defaults remain the\n * fallback for models that do not declare their own limits.\n */\nexport function settingsWithResolvedModelContext(\n  settings: Settings,\n  model: Pick<\n    ConfiguredModel,\n    | \"contextWindowTokens\"\n    | \"effectiveContextWindowTokens\"\n    | \"autoCompactTokenLimit\"\n    | \"toolOutputTruncationTokens\"\n  >,\n): Settings {\n  const contextWindowTokens = model.contextWindowTokens ?? settings.contextWindowTokens;\n  return {\n    ...settings,\n    contextWindowTokens,\n    ...(model.effectiveContextWindowTokens === undefined\n      ? {}\n      : {\n          contextEffectiveWindowTokens: Math.min(\n            contextWindowTokens,\n            model.effectiveContextWindowTokens,\n          ),\n        }),\n    ...(model.autoCompactTokenLimit === undefined\n      ? {}\n      : { contextAutoCompactThresholdTokens: model.autoCompactTokenLimit }),\n    ...(model.toolOutputTruncationTokens === undefined\n      ? {}\n      : { modelToolOutputTruncationTokens: model.toolOutputTruncationTokens }),\n  };\n}\n\nexport function configuredStaticUsageLimits(settings: Settings): StaticUsageLimitsConfig {\n  return parseStaticUsageLimitsJson(settings.staticUsageLimitsJson);\n}\n\nexport function configuredEntitlements(settings: Settings): EntitlementsConfig {\n  if (settings.entitlementsMode === \"none\") {\n    return {};\n  }\n  const configured = parseStaticEntitlementsJson(settings.staticEntitlementsJson);\n  if (settings.entitlementsMode === \"static\") {\n    return configured;\n  }\n  return {\n    \"managed.auth.email_password\": true,\n    \"managed.billing.prepaid_credits\": settings.billingMode === \"stripe\",\n    \"managed.api_keys\": true,\n    \"managed.workspaces\": true,\n    \"managed.github_app\": Boolean(settings.githubAppId && settings.githubAppPrivateKey),\n    ...configured,\n  };\n}\n\nexport function calculateModelUsageCostMicros(\n  settings: Settings,\n  model: string,\n  usage: ModelUsageInput,\n  options?: { latencyMode?: LatencyMode },\n): number {\n  return calculateModelUsageCostBreakdown(settings, model, usage, options).creditCostMicros;\n}\n\nexport function calculateModelUsageCostBreakdown(\n  settings: Settings,\n  model: string,\n  usage: ModelUsageInput,\n  options?: { latencyMode?: LatencyMode },\n): ModelUsageCostBreakdown {\n  const schedule = configuredModelPricingSchedules(settings)[model];\n  if (!schedule) {\n    throw new Error(`Missing model pricing for ${model}`);\n  }\n  const entries =\n    usage.requestUsageEntries && usage.requestUsageEntries.length > 0\n      ? usage.requestUsageEntries\n      : [usage];\n  const rawCostByPricing = new Map<ModelPricing, number>();\n  for (const entry of entries) {\n    const pricing = selectModelPricing(schedule, positiveInt(entry.inputTokens));\n    rawCostByPricing.set(\n      pricing,\n      (rawCostByPricing.get(pricing) ?? 0) + calculateEntryCostMicros(pricing, entry),\n    );\n  }\n  let providerCostMicros = 0;\n  let creditCostMicros = 0;\n  for (const [pricing, rawCost] of rawCostByPricing) {\n    const marginBps = pricing.marginBps ?? 0;\n    providerCostMicros += rawCost;\n    creditCostMicros += Math.ceil((rawCost * (10_000 + marginBps)) / 10_000);\n  }\n  const latencyMode = options?.latencyMode ?? \"standard\";\n  if (latencyMode !== \"standard\") {\n    const catalogSettings = settingsForTurnExecutionPolicy(settings, model);\n    const resolved = resolveModelProvider(\n      catalogSettings,\n      canonicalizeConfiguredModelId(catalogSettings, model),\n    );\n    const multiplierBps = resolved?.model.capabilities.latencyModes.find(\n      (mode) => mode.id === latencyMode && mode.runnable,\n    )?.billingMultiplierBps;\n    if (multiplierBps && multiplierBps > 0) {\n      providerCostMicros = Math.ceil((providerCostMicros * multiplierBps) / 10_000);\n      creditCostMicros = Math.ceil((creditCostMicros * multiplierBps) / 10_000);\n    }\n  }\n  return { providerCostMicros, creditCostMicros };\n}\n\n/**\n * Convert AI Gateway's exact USD inference cost to OpenGeni credit micros and\n * apply the configured model margin. Decimal arithmetic is integer-only so a\n * sub-micro provider charge cannot be lost to floating-point rounding.\n */\nexport function calculateGatewayReportedCostMicros(\n  settings: Settings,\n  model: string,\n  inferenceCostUsd: string,\n  options?: { inputTokens?: number },\n): number {\n  return calculateGatewayReportedCostBreakdown(settings, model, inferenceCostUsd, options)\n    .creditCostMicros;\n}\n\nexport function calculateGatewayReportedCostBreakdown(\n  settings: Settings,\n  model: string,\n  inferenceCostUsd: string,\n  options?: { inputTokens?: number },\n): ModelUsageCostBreakdown {\n  const schedule = configuredModelPricingSchedules(settings)[model];\n  if (!schedule) {\n    throw new Error(`Missing model pricing for ${model}`);\n  }\n  const pricing = selectModelPricing(schedule, positiveInt(options?.inputTokens));\n  const match = /^(0|[1-9]\\d*)(?:\\.(\\d{1,18}))?$/.exec(inferenceCostUsd);\n  if (!match) {\n    throw new Error(\"Invalid AI Gateway inference cost\");\n  }\n  const fraction = match[2] ?? \"\";\n  const decimalDigits = BigInt(`${match[1]}${fraction}`);\n  const decimalScale = 10n ** BigInt(fraction.length);\n  const providerNumerator = decimalDigits * 1_000_000n;\n  const providerMicros = (providerNumerator + decimalScale - 1n) / decimalScale;\n  const marginBps = BigInt(10_000 + (pricing.marginBps ?? 0));\n  const numerator = providerNumerator * marginBps;\n  const denominator = decimalScale * 10_000n;\n  const creditMicros = (numerator + denominator - 1n) / denominator;\n  if (\n    providerMicros > BigInt(Number.MAX_SAFE_INTEGER) ||\n    creditMicros > BigInt(Number.MAX_SAFE_INTEGER)\n  ) {\n    throw new Error(\"AI Gateway inference cost exceeds the supported billing range\");\n  }\n  return {\n    providerCostMicros: Number(providerMicros),\n    creditCostMicros: Number(creditMicros),\n  };\n}\n\n/**\n * Exact OpenGeni product price frozen before a managed video request starts.\n * Gateway reporting is delayed for asynchronous video, so this deliberately\n * does not masquerade as provider-reported cost.\n */\nexport function calculateVideoGenerationCreditCostMicros(\n  settings: Settings,\n  input: {\n    modelId: string;\n    resolution: VideoGenerationResolution;\n    durationSeconds: number;\n  },\n): number {\n  if (input.modelId !== SEEDANCE_2_5_MODEL_ID) {\n    throw new Error(`Missing video generation credit pricing for ${input.modelId}`);\n  }\n  if (!Number.isSafeInteger(input.durationSeconds) || input.durationSeconds < 1) {\n    throw new Error(\"Video generation duration is invalid for credit pricing\");\n  }\n  const rate =\n    input.resolution === \"480p\"\n      ? settings.videoGenerationCredit480pMicrosPerSecond\n      : settings.videoGenerationCredit720pMicrosPerSecond;\n  const cost = rate * input.durationSeconds;\n  if (!Number.isSafeInteger(cost) || cost <= 0 || cost > 1_000_000_000) {\n    throw new Error(\"Video generation credit price exceeds the supported range\");\n  }\n  return cost;\n}\n\nexport function configuredAllowedReasoningEfforts(\n  settings: Settings,\n): Array<z.infer<typeof ReasoningEffort>> {\n  return uniqueValues([\n    settings.openaiReasoningEffort,\n    ...splitCsv(settings.openaiAllowedReasoningEfforts),\n  ]).map((value) => ReasoningEffort.parse(value));\n}\n\n/**\n * Decodes OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY (base64, exactly 32 bytes) for\n * AES-256-GCM workspace environment value encryption. Returns null when unset.\n * Throws naming only the env var, never echoing its value.\n */\nexport function environmentsEncryptionKeyBytes(settings: Settings): Uint8Array | null {\n  if (!settings.environmentsEncryptionKey) {\n    return null;\n  }\n  const decoded = Buffer.from(settings.environmentsEncryptionKey, \"base64\");\n  if (decoded.length !== 32) {\n    throw new Error(\n      \"OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY must be base64 for exactly 32 bytes (generate with: openssl rand -base64 32)\",\n    );\n  }\n  return new Uint8Array(decoded);\n}\n\n/**\n * Build one structurally compatible connection policy for both\n * `@temporalio/client` and `@temporalio/worker`. An API key or any custom TLS\n * material enables TLS automatically; the explicit flag covers server-auth TLS\n * without credentials. Secret values are never included in validation errors.\n */\nexport function temporalConnectionOptions(settings: Settings): TemporalConnectionOptions {\n  const apiKey = settings.temporalApiKey?.trim() || undefined;\n  const serverNameOverride = settings.temporalTlsServerName?.trim() || undefined;\n  const rootCa = decodeTemporalTlsMaterial(\n    settings.temporalTlsRootCaCertificateBase64,\n    \"OPENGENI_TEMPORAL_TLS_ROOT_CA_CERTIFICATE_BASE64\",\n  );\n  const clientCertificate = decodeTemporalTlsMaterial(\n    settings.temporalTlsClientCertificateBase64,\n    \"OPENGENI_TEMPORAL_TLS_CLIENT_CERTIFICATE_BASE64\",\n  );\n  const clientPrivateKey = decodeTemporalTlsMaterial(\n    settings.temporalTlsClientPrivateKeyBase64,\n    \"OPENGENI_TEMPORAL_TLS_CLIENT_PRIVATE_KEY_BASE64\",\n  );\n\n  if (Boolean(clientCertificate) !== Boolean(clientPrivateKey)) {\n    throw new Error(\n      \"OPENGENI_TEMPORAL_TLS_CLIENT_CERTIFICATE_BASE64 and \" +\n        \"OPENGENI_TEMPORAL_TLS_CLIENT_PRIVATE_KEY_BASE64 must both be set or both omitted\",\n    );\n  }\n\n  const tls: TemporalTlsConnectionConfig = {};\n  if (serverNameOverride) {\n    tls.serverNameOverride = serverNameOverride;\n  }\n  if (rootCa) {\n    tls.serverRootCACertificate = rootCa;\n  }\n  if (clientCertificate && clientPrivateKey) {\n    tls.clientCertPair = { crt: clientCertificate, key: clientPrivateKey };\n  }\n  const hasCustomTls = Object.keys(tls).length > 0;\n  const tlsEnabled = settings.temporalTlsEnabled || Boolean(apiKey) || hasCustomTls;\n\n  return {\n    address: settings.temporalHost,\n    ...(tlsEnabled ? { tls: hasCustomTls ? tls : true } : {}),\n    ...(apiKey ? { apiKey } : {}),\n  };\n}\n\nfunction decodeTemporalTlsMaterial(\n  value: string | undefined,\n  settingName: string,\n): Uint8Array | undefined {\n  // RFC 2045 base64 commonly arrives wrapped at 76 columns. Kubernetes\n  // stringData and external secret stores preserve those line breaks, so\n  // normalize whitespace before applying the strict alphabet/canonical check.\n  const encoded = value?.replace(/\\s/g, \"\");\n  if (!encoded) {\n    return undefined;\n  }\n  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded) || encoded.length % 4 === 1) {\n    throw new Error(`${settingName} must contain valid base64`);\n  }\n  const decoded = Buffer.from(encoded, \"base64\");\n  const canonical = decoded.toString(\"base64\").replace(/=+$/, \"\");\n  if (decoded.length === 0 || canonical !== encoded.replace(/=+$/, \"\")) {\n    throw new Error(`${settingName} must contain valid base64`);\n  }\n  return new Uint8Array(decoded);\n}\n\n/**\n * The connection `search_path` for OpenGeni's db handles + the managed-auth pool\n * (Step I, §7.8 runtime half). Returns `undefined` when `dbSchema` is unset\n * (standalone) so no `search_path` startup parameter is sent and the server\n * default (`public`) applies — byte-for-byte today's behavior. When `dbSchema`\n * is set (embedded), returns `\"<schema>,opengeni_private,public\"` — `public`\n * stays LAST so `gen_random_uuid()` (pgcrypto) and the `vector` type still\n * resolve (the schema-isolation contract live footgun). `opengeni_private` is on the path so the\n * RLS GUC-reader helpers resolve when referenced unqualified.\n */\nexport function dbSearchPath(settings: Pick<Settings, \"dbSchema\">): string | undefined {\n  const schema = settings.dbSchema?.trim();\n  if (!schema) {\n    return undefined;\n  }\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(schema)) {\n    throw new Error(`OPENGENI_DB_SCHEMA is not a valid Postgres identifier: ${schema}`);\n  }\n  return `${schema},opengeni_private,public`;\n}\n\nexport function collectGitIdentityEnvironment(settings: Settings): Record<string, string> {\n  return Object.fromEntries(\n    Object.entries({\n      GIT_AUTHOR_NAME: settings.gitAuthorName,\n      GIT_AUTHOR_EMAIL: settings.gitAuthorEmail,\n      GIT_COMMITTER_NAME: settings.gitCommitterName ?? settings.gitAuthorName,\n      GIT_COMMITTER_EMAIL: settings.gitCommitterEmail ?? settings.gitAuthorEmail,\n    }).filter(\n      (entry): entry is [string, string] =>\n        typeof entry[1] === \"string\" && entry[1].trim().length > 0,\n    ),\n  );\n}\n\nconst DEFAULT_SANDBOX_PATH = \"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\";\n\nfunction prependPathEntry(pathValue: string | undefined, entry: string): string {\n  const parts = (pathValue ?? DEFAULT_SANDBOX_PATH).split(\":\").filter(Boolean);\n  return [entry, ...parts.filter((part) => part !== entry)].join(\":\");\n}\n\n/**\n * The STABLE run-scoped sandbox environment: the subset of a run's box-manifest\n * environment that is IDENTICAL whether the box is first warmed by the worker\n * TURN or by an API-direct ATTACH (viewer / Channel-A / desktop / terminal). It\n * is the layered base every cold box must be created with so a later turn's\n * agent-manifest apply finds an EMPTY environment delta in the SDK's\n * `validateNoEnvironmentDelta` (which throws \"Live sandbox sessions cannot change\n * manifest environment variables\" on ANY key the agent declares that the box's\n * manifest lacks or carries a different value for).\n *\n * Precedence (lowest → highest): deployment allowlist (`collectSandboxEnvironment`)\n * < git identity (`collectGitIdentityEnvironment`) < the session's attached\n * workspace environment < the backend-aware HOME default. Reserved-name validation\n * at write time keeps workspace values from colliding with platform entries.\n *\n * DELIBERATELY EXCLUDES the per-run, ROTATING git provider token VALUES that\n * `sandboxEnvironmentForRun` mints when a repository resource is\n * attached: that token is minted FRESH per call, so it is not a stable, attach-\n * reproducible value and must not be part of the shared base. Under the token-\n * broker (B1) token VALUES never ride the manifest at all — they are seeded to\n * FILES inside the box and git/provider CLI auth reads those files. What IS stable\n * and lives here for provisioned boxes are the token directory / GitHub alias\n * FILE PATH and wrapper PATH entries: constants derived from HOME, so they\n * appear IDENTICALLY on BOTH the turn AND every attach manifest (the SDK's\n * per-turn provided-session env delta stays empty even as tokens rotate). These\n * helper pointers are deliberately not added for selfhosted/local/none because\n * the platform never mints or seeds git provider tokens there. The attach\n * surfaces have only the `Session` (no repo resources) and so never seed a token,\n * but unwritten files simply yield no auth; the BLOCKING attach-vs-turn error\n * this helper fixes is for the common (no-repo) and workspace-environment-attached\n * provisioned-box cases.\n */\nexport function stableSandboxEnvironmentForRun(\n  settings: Settings,\n  workspaceEnvironment: Record<string, string> = {},\n  options: { workspaceId?: string } = {},\n): Record<string, string> {\n  const environment: Record<string, string> = {\n    ...collectSandboxEnvironment(settings),\n    ...collectGitIdentityEnvironment(settings),\n    ...workspaceEnvironment,\n  };\n  // Backend-aware HOME: a provisioned box (docker + every cloud provider) runs the\n  // agent under the descriptor's workspaceRoot. `local` runs in-process as the host\n  // unix user (keep its real $HOME); `selfhosted` runs on a user's machine and must\n  // likewise preserve that machine's real HOME; `none` has no box.\n  const descriptor = CAPABILITY_DESCRIPTORS[settings.sandboxBackend];\n  if (\n    settings.sandboxBackend !== \"none\" &&\n    settings.sandboxBackend !== \"local\" &&\n    settings.sandboxBackend !== \"selfhosted\"\n  ) {\n    environment.HOME ??= descriptor.workspaceRoot;\n  }\n  // TOKEN-BROKER (B1): the STABLE credential FILE PATHS and CLI wrapper PATH for\n  // provisioned boxes only. Constants derived from the resolved HOME (falling\n  // back to the descriptor workspaceRoot), so they are parity-safe — they join\n  // the shared base and therefore appear IDENTICALLY on BOTH the worker-turn\n  // manifest AND every API-direct attach manifest. Only PATHS are stable; token\n  // VALUES live exclusively in files that runtime seeds off-manifest.\n  const provisionedGitHelperBackend =\n    settings.sandboxBackend !== \"none\" &&\n    settings.sandboxBackend !== \"local\" &&\n    settings.sandboxBackend !== \"selfhosted\";\n  if (provisionedGitHelperBackend) {\n    const home = environment.HOME ?? descriptor.workspaceRoot;\n    environment.OPENGENI_GIT_CREDENTIALS_DIR ??= `${home}/.opengeni/git-credentials`;\n    environment.OPENGENI_GIT_TOKEN_FILE ??= `${home}/.opengeni/git-token`;\n    environment.OPENGENI_GIT_CLI_WRAPPER_DIR ??= `${home}/.opengeni/bin`;\n    environment.PATH = prependPathEntry(environment.PATH, environment.OPENGENI_GIT_CLI_WRAPPER_DIR);\n  }\n  if (settings.sandboxBackend !== \"selfhosted\" && resolveFirstPartyDelegationSecret(settings)) {\n    environment.OPENGENI_CODEMODE_TOKEN_FILE ??= `${environment.HOME ?? descriptor.workspaceRoot}/.opengeni/codemode-token`;\n    if (settings.ogtoolPackageSpec) {\n      environment.OPENGENI_OGTOOL_PACKAGE_SPEC ??= settings.ogtoolPackageSpec;\n    }\n    if (options.workspaceId) {\n      environment.OPENGENI_CODEMODE_URL ??= codemodeWorkspaceUrl(settings, options.workspaceId);\n    }\n  }\n  return environment;\n}\n\n/**\n * Whether a resource set carries a GitHub-App-connected repository (installation\n * + repository ids present) — the SAME predicate the worker turn uses to decide\n * whether it declares the stable git-auth pointers. Attach surfaces call this so\n * an attach-warmed cold box carries the IDENTICAL manifest env a later repo turn\n * declares (env parity — see applyGitAuthPointerEnvironment).\n */\nexport function hasGitHubRepositorySelection(\n  resources: ReadonlyArray<{\n    kind: string;\n    provider?: unknown;\n    installationId?: unknown;\n    repositoryId?: unknown;\n    githubInstallationId?: unknown;\n    githubRepositoryId?: unknown;\n  }>,\n): boolean {\n  const positive = (value: unknown): boolean =>\n    (typeof value === \"number\" && Number.isInteger(value) && value > 0) ||\n    (typeof value === \"string\" && /^\\d+$/.test(value) && Number(value) > 0);\n  return resources.some(\n    (resource) =>\n      resource.kind === \"repository\" &&\n      ((positive(resource.githubInstallationId) && positive(resource.githubRepositoryId)) ||\n        (resource.provider === \"github\" &&\n          positive(resource.installationId) &&\n          positive(resource.repositoryId))),\n  );\n}\n\nexport function hasGitCredentialRepositorySelection(\n  resources: ReadonlyArray<{\n    kind: string;\n    provider?: unknown;\n    githubInstallationId?: unknown;\n    githubRepositoryId?: unknown;\n  }>,\n): boolean {\n  return resources.some(\n    (resource) =>\n      resource.kind === \"repository\" &&\n      (resource.provider === \"github\" ||\n        resource.provider === \"gitlab\" ||\n        resource.provider === \"azure_devops\" ||\n        hasGitHubRepositorySelection([resource])),\n  );\n}\n\n/**\n * TOKEN-BROKER (B1) parity: the STABLE git-auth POINTER environment a\n * repo-attached run declares — GIT_ASKPASS (a fixed path under HOME; the script\n * itself is provisioned at box setup), GIT_TERMINAL_PROMPT, and the GitHub-App\n * bot identity fallbacks. NO rotating value rides here (the token lives in the\n * file behind the askpass), so the layer is attach-reproducible and MUST be\n * applied identically by the worker turn (sandboxEnvironmentForRun) AND every\n * API-direct attach surface that can cold-create the box (viewer attach,\n * channel-A ops). A box cold-created WITHOUT this layer kills the next repo\n * turn: the turn's manifest declares these keys, the box's env lacks them, and\n * the SDK's provided-session guard throws \"Live sandbox sessions cannot change\n * manifest environment variables\" (observed live: an open session page's viewer\n * attach won the cold-create race and the first turn died).\n *\n * Mutates and returns `environment`. Identity fallbacks preserve values already\n * present (the deployment git-identity allowlist wins over the bot identity).\n */\nexport function applyGitAuthPointerEnvironment(\n  environment: Record<string, string>,\n  identity: { name: string; email: string } | null,\n): Record<string, string> {\n  environment.GIT_ASKPASS = `${environment.HOME ?? \"/workspace\"}/.opengeni/askpass`;\n  environment.GIT_TERMINAL_PROMPT = \"0\";\n  if (identity) {\n    environment.GIT_AUTHOR_NAME = environment.GIT_AUTHOR_NAME || identity.name;\n    environment.GIT_AUTHOR_EMAIL = environment.GIT_AUTHOR_EMAIL || identity.email;\n    environment.GIT_COMMITTER_NAME = environment.GIT_COMMITTER_NAME || identity.name;\n    environment.GIT_COMMITTER_EMAIL = environment.GIT_COMMITTER_EMAIL || identity.email;\n  }\n  return environment;\n}\n\nexport type StartupRetryOptions = {\n  attempts?: number;\n  initialDelayMs?: number;\n  maxDelayMs?: number;\n  onRetry?: (event: {\n    label: string;\n    attempt: number;\n    attempts: number;\n    delayMs: number;\n    error: unknown;\n  }) => void;\n};\n\nexport function startupRetryOptions(\n  settings: Settings,\n): Required<Omit<StartupRetryOptions, \"onRetry\">> {\n  return {\n    attempts: settings.startupDependencyRetryAttempts,\n    initialDelayMs: settings.startupDependencyRetryInitialDelayMs,\n    maxDelayMs: settings.startupDependencyRetryMaxDelayMs,\n  };\n}\n\nexport async function retryStartupDependency<T>(\n  label: string,\n  operation: () => Promise<T>,\n  options: StartupRetryOptions = {},\n): Promise<T> {\n  const attempts = Math.max(1, Math.floor(options.attempts ?? 30));\n  const initialDelayMs = Math.max(0, Math.floor(options.initialDelayMs ?? 1000));\n  const maxDelayMs = Math.max(initialDelayMs, Math.floor(options.maxDelayMs ?? 5000));\n  for (let attempt = 1; attempt <= attempts; attempt += 1) {\n    try {\n      return await operation();\n    } catch (error) {\n      if (attempt >= attempts) {\n        throw error;\n      }\n      const delayMs = Math.min(maxDelayMs, initialDelayMs * 2 ** (attempt - 1));\n      options.onRetry?.({ label, attempt, attempts, delayMs, error });\n      await delay(delayMs);\n    }\n  }\n  throw new Error(`unreachable startup retry state for ${label}`);\n}\n\nexport function sandboxEnvironmentVariableNames(settings: Settings): string[] {\n  const profiles = sandboxPreparationProfileNames(settings);\n  const names: string[] = [];\n  for (const profile of profiles) {\n    names.push(...sandboxPreparationProfiles[profile]!.env);\n  }\n  names.push(...splitCsv(settings.sandboxEnvAllowlist));\n  return uniqueEnvNames(names, \"sandbox env\");\n}\n\nexport function sandboxLifecycleHookIds(settings: Settings): string[] {\n  const ids: string[] = [];\n  for (const profile of sandboxPreparationProfileNames(settings)) {\n    ids.push(...sandboxPreparationProfiles[profile]!.hooks);\n  }\n  return uniqueValues(ids);\n}\n\nfunction sandboxPreparationProfileNames(settings: Settings): string[] {\n  const profiles = splitCsv(settings.sandboxPreparationProfiles).map((value) =>\n    value.toLowerCase(),\n  );\n  if (profiles.includes(\"none\")) {\n    if (profiles.length > 1) {\n      throw new Error(\n        \"OPENGENI_SANDBOX_PREPARATION_PROFILES cannot combine none with other profiles\",\n      );\n    }\n    return [\"none\"];\n  }\n  for (const profile of profiles) {\n    if (!sandboxPreparationProfiles[profile]) {\n      throw new Error(`Unknown sandbox preparation profile ${profile}`);\n    }\n  }\n  return profiles;\n}\n\nexport function parseExposedPorts(raw: string): number[] {\n  return splitCsv(raw).map((value) => {\n    const port = Number(value);\n    if (!Number.isInteger(port) || port < 1 || port > 65535) {\n      throw new Error(\"OPENGENI_DOCKER_EXPOSED_PORTS must contain TCP port numbers\");\n    }\n    return port;\n  });\n}\n\nexport function parseMcpServers(raw: string | undefined): unknown[] | undefined {\n  if (!raw) {\n    return undefined;\n  }\n  try {\n    const parsed = JSON.parse(raw);\n    if (!Array.isArray(parsed)) {\n      throw new Error(\"value must be a JSON array\");\n    }\n    return parsed;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_MCP_SERVERS must be a JSON array: ${message}`, {\n      cause: error,\n    });\n  }\n}\n\nexport function parseModelPricingJson(raw: string): Record<string, ModelPricing> {\n  if (!raw.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_MODEL_PRICING_JSON must be valid JSON: ${message}`, { cause: error });\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\"OPENGENI_MODEL_PRICING_JSON must be a JSON object keyed by model name\");\n  }\n  const out: Record<string, ModelPricing> = {};\n  for (const [model, value] of Object.entries(parsed)) {\n    if (!model.trim()) {\n      throw new Error(\"OPENGENI_MODEL_PRICING_JSON contains an empty model name\");\n    }\n    out[model] = ModelPricingSchema.parse(value);\n  }\n  return out;\n}\n\n// --- sandbox warm-rate table (P2.1) ---\n// Per-backend usd_micros/sec, parsed from sandboxWarmRateMicrosPerSecondJson the\n// same way model pricing is. An empty {} (the default) means no warm-cost is\n// debited — warm-seconds are still metered for audit, just at rate 0.\nexport function parseSandboxWarmRateJson(raw: string): Record<string, number> {\n  if (!raw.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(\n      `OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON must be valid JSON: ${message}`,\n      { cause: error },\n    );\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\n      \"OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON must be a JSON object keyed by backend name\",\n    );\n  }\n  const out: Record<string, number> = {};\n  for (const [backend, value] of Object.entries(parsed)) {\n    if (!backend.trim()) {\n      throw new Error(\n        \"OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON contains an empty backend name\",\n      );\n    }\n    const rate = typeof value === \"number\" ? value : Number(value);\n    if (!Number.isFinite(rate) || rate < 0) {\n      throw new Error(\n        `OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON rate for ${backend} must be a non-negative number`,\n      );\n    }\n    out[backend] = rate;\n  }\n  return out;\n}\n\n// Resolve the warm rate (usd_micros/sec) for a backend; 0 when the backend has no\n// configured rate (the box is metered in seconds but not cost-debited).\nexport function sandboxWarmRateMicrosPerSecond(settings: Settings, backend: string): number {\n  const table = parseSandboxWarmRateJson(settings.sandboxWarmRateMicrosPerSecondJson);\n  return table[backend] ?? 0;\n}\n\n/**\n * Parse + validate the extra-provider registry JSON. `[]` (or empty/whitespace)\n * yields an empty list. Surfaces JSON and zod errors prefixed with the env-var\n * name so a malformed registry fails fast at boot (validateSettings calls this).\n */\nexport function parseModelProvidersJson(raw: string): RegistryProvider[] {\n  if (!raw.trim() || raw.trim() === \"[]\") {\n    return [];\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_MODEL_PROVIDERS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  if (!Array.isArray(parsed)) {\n    throw new Error(\"OPENGENI_MODEL_PROVIDERS_JSON must be a JSON array of providers\");\n  }\n  return parsed.map((entry, index) => {\n    const result = RegistryProviderSchema.safeParse(entry);\n    if (!result.success) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider[${index}] is invalid: ${result.error.message}`,\n      );\n    }\n    try {\n      return normalizeRegistryProvider(result.data);\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error);\n      throw new Error(`OPENGENI_MODEL_PROVIDERS_JSON provider[${index}] is invalid: ${message}`, {\n        cause: error,\n      });\n    }\n  });\n}\n\nexport function parseIntegrationsOauthClientsJson(\n  raw: string | undefined,\n): Record<string, IntegrationOAuthClientConfig> {\n  if (!raw?.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\n      \"OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON must be a JSON object keyed by authorization-server issuer or URL\",\n    );\n  }\n  const out: Record<string, IntegrationOAuthClientConfig> = {};\n  for (const [key, value] of Object.entries(parsed)) {\n    if (!key.trim()) {\n      throw new Error(\"OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON contains an empty issuer key\");\n    }\n    const result = IntegrationOAuthClientConfigSchema.safeParse(value);\n    if (!result.success) {\n      throw new Error(\n        `OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON client for ${key} is invalid: ${result.error.message}`,\n      );\n    }\n    out[key] = result.data;\n  }\n  return out;\n}\n\nexport const SocialOAuthClientConfigSchema = z.object({\n  clientId: z.string().min(1),\n  clientSecret: z.string().min(1).optional(),\n});\nexport type SocialOAuthClientConfig = z.infer<typeof SocialOAuthClientConfigSchema>;\n\nconst SOCIAL_OAUTH_PROVIDER_IDS = [\"x\", \"reddit\"] as const;\n\nexport function parseSocialOauthClientsJson(\n  raw: string | undefined,\n): Partial<Record<(typeof SOCIAL_OAUTH_PROVIDER_IDS)[number], SocialOAuthClientConfig>> {\n  if (!raw?.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\n      \"OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON must be a JSON object keyed by social provider id\",\n    );\n  }\n  const out: Partial<Record<(typeof SOCIAL_OAUTH_PROVIDER_IDS)[number], SocialOAuthClientConfig>> =\n    {};\n  for (const [key, value] of Object.entries(parsed)) {\n    if (!SOCIAL_OAUTH_PROVIDER_IDS.includes(key as (typeof SOCIAL_OAUTH_PROVIDER_IDS)[number])) {\n      throw new Error(\n        `OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON provider ${key} is not supported (expected: ${SOCIAL_OAUTH_PROVIDER_IDS.join(\", \")})`,\n      );\n    }\n    const result = SocialOAuthClientConfigSchema.safeParse(value);\n    if (!result.success) {\n      throw new Error(\n        `OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON client for ${key} is invalid: ${result.error.message}`,\n      );\n    }\n    out[key as (typeof SOCIAL_OAUTH_PROVIDER_IDS)[number]] = result.data;\n  }\n  return out;\n}\n\nexport function parseStaticUsageLimitsJson(raw: string): StaticUsageLimitsConfig {\n  if (!raw.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_STATIC_USAGE_LIMITS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  return StaticUsageLimits.parse(parsed);\n}\n\nexport function parseStaticEntitlementsJson(raw: string): EntitlementsConfig {\n  if (!raw.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_STATIC_ENTITLEMENTS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  return Entitlements.parse(parsed);\n}\n\nfunction calculateEntryCostMicros(pricing: ModelPricing, entry: ModelUsageInput): number {\n  const inputTokens = positiveInt(entry.inputTokens);\n  const outputTokens = positiveInt(entry.outputTokens);\n  const cachedTokens = Math.min(inputTokens, cachedInputTokens(entry));\n  const uncachedInputTokens = Math.max(0, inputTokens - cachedTokens);\n  const cachedInputRate =\n    pricing.cachedInputMicrosPerMillionTokens ?? pricing.inputMicrosPerMillionTokens;\n  return (\n    Math.ceil((uncachedInputTokens * pricing.inputMicrosPerMillionTokens) / 1_000_000) +\n    Math.ceil((cachedTokens * cachedInputRate) / 1_000_000) +\n    Math.ceil((outputTokens * pricing.outputMicrosPerMillionTokens) / 1_000_000)\n  );\n}\n\nfunction cachedInputTokens(entry: ModelUsageInput): number {\n  const details = Array.isArray(entry.inputTokensDetails)\n    ? entry.inputTokensDetails\n    : entry.inputTokensDetails\n      ? [entry.inputTokensDetails]\n      : [];\n  let total = 0;\n  for (const detail of details) {\n    total +=\n      positiveInt(detail.cached_tokens) +\n      positiveInt(detail.cachedInputTokens) +\n      positiveInt(detail.cached_input_tokens);\n  }\n  return total;\n}\n\nfunction positiveInt(value: unknown): number {\n  return typeof value === \"number\" && Number.isFinite(value) && value > 0 ? Math.floor(value) : 0;\n}\n\nfunction ensureBuiltInMcpServers(settings: Settings): Settings[\"mcpServers\"] {\n  const existing = settings.mcpServers.filter((server) => server.id !== \"opengeni\");\n  const firstPartyMcpUrl = firstPartyMcpServerUrl(settings);\n  const firstPartyFilesMcpUrl = firstPartyFilesMcpServerUrl(firstPartyMcpUrl);\n  const firstPartyDocsMcpUrl = firstPartyDocumentsMcpServerUrl(firstPartyMcpUrl);\n  const hasFiles = existing.some((server) => server.id === \"files\");\n  const hasDocs = existing.some((server) => server.id === \"docs\");\n  return [\n    {\n      id: \"opengeni\",\n      name: \"OpenGeni\",\n      url: firstPartyMcpUrl,\n      // The opengeni server's tools/list response is permission-scoped: it\n      // varies by the calling session's delegated grant (e.g. a manager\n      // session sees sessions_*/environment_* tools that a worker session\n      // does not). The OpenAI Agents SDK caches tools/list in a process-global\n      // map keyed only by the MCP server name, which is identical for every\n      // session in the worker process. Caching here would let the first\n      // session to warm the cache dictate what every later session sees,\n      // regardless of permissions. tools/list is a cheap per-turn call, so we\n      // never cache it. (The files server pins allowedTools to a single\n      // permission-invariant tool and docs is already uncached, so both stay\n      // safe to cache / leave as-is.)\n      cacheToolsList: false,\n    },\n    ...(hasFiles\n      ? []\n      : [\n          {\n            id: \"files\",\n            name: \"Files\",\n            url: firstPartyFilesMcpUrl,\n            allowedTools: [\"files_get_download_url\"],\n            cacheToolsList: true,\n          },\n        ]),\n    ...(hasDocs\n      ? []\n      : [\n          {\n            id: \"docs\",\n            name: \"Document Search\",\n            url: firstPartyDocsMcpUrl,\n            allowedTools: [\n              \"search_documents\",\n              \"fetch_document_chunk\",\n              \"list_document_bases\",\n              \"list_indexed_documents\",\n              \"knowledge_search\",\n              \"knowledge_get\",\n              \"knowledge_browse\",\n              \"knowledge_fetch\",\n              \"memory_search\",\n              \"memory_propose\",\n            ],\n            cacheToolsList: false,\n          },\n        ]),\n    ...existing,\n  ];\n}\n\n/**\n * The base URL of OpenGeni's own first-party MCP endpoint, as a `{workspaceId}`\n * template — the SINGLE source of truth for the `opengeniMcpUrl`-or-loopback\n * decision. Every site that needs the first-party MCP base (config's tool\n * registry here, and the worker-side `firstPartyMcpServerUrlForRun` /\n * `firstPartyMcpUrls` in @opengeni/runtime) MUST route through this so the\n * default lives in exactly one place.\n *\n * BINDING CONTRACT (`opengeniMcpUrl`):\n *   - STANDALONE (unset): falls back to the loopback default\n *     `http://127.0.0.1:${apiPort}/v1/workspaces/{workspaceId}/mcp` — the worker\n *     and API are in/next to the same host:port, so loopback resolves the\n *     workspace-scoped MCP. Byte-for-byte today's behavior.\n *   - EMBEDDED / MOUNTED (must set): when OpenGeni's API is mounted as a host\n *     sub-app under a prefix (e.g. `https://host/og/v1/...`), the loopback\n *     default is WRONG — the worker runs in the host process and `127.0.0.1:\n *     ${apiPort}` is not where the mounted, sandbox-routable MCP lives. The host\n *     MUST set `OPENGENI_MCP_URL` to the externally/sandbox-routable base (a\n *     `{workspaceId}` template, or a concrete base that gets re-scoped). This is\n *     the one binding a mounted embed cannot leave unset.\n */\nexport function firstPartyMcpBaseUrl(settings: Settings): string {\n  return (\n    settings.opengeniMcpUrl ??\n    `http://127.0.0.1:${settings.apiPort}/v1/workspaces/{workspaceId}/mcp`\n  );\n}\n\nexport function firstPartyMcpWorkspaceUrl(settings: Settings, workspaceId: string): string {\n  const raw = firstPartyMcpBaseUrl(settings);\n  if (raw.includes(\"{workspaceId}\")) {\n    return raw.replaceAll(\"{workspaceId}\", workspaceId);\n  }\n  const url = new URL(raw);\n  url.pathname = `/v1/workspaces/${workspaceId}/mcp`;\n  url.search = \"\";\n  url.hash = \"\";\n  return url.toString();\n}\n\nexport function codemodeWorkspaceUrl(settings: Settings, workspaceId: string): string {\n  if (settings.opengeniMcpUrl) {\n    const url = new URL(firstPartyMcpWorkspaceUrl(settings, workspaceId));\n    if (!url.pathname.endsWith(\"/mcp\")) {\n      throw new Error(\"First-party MCP URL cannot be projected to the Codemode endpoint\");\n    }\n    url.pathname = `${url.pathname.slice(0, -4)}/codemode`;\n    return url.toString();\n  }\n\n  // Codemode executes inside the selected placement, not beside the worker.\n  // Local Docker reaches the host through Docker's canonical host alias; an\n  // in-process local sandbox uses loopback; remote managed providers use the\n  // deployment's public origin. `OPENGENI_MCP_URL` above remains the explicit\n  // escape hatch for mounted deployments and local remote-provider tunnels.\n  const executionOrigin =\n    settings.sandboxBackend === \"docker\"\n      ? `http://host.docker.internal:${settings.apiPort}`\n      : settings.sandboxBackend === \"local\"\n        ? `http://127.0.0.1:${settings.apiPort}`\n        : (settings.publicBaseUrl ?? `http://127.0.0.1:${settings.apiPort}`);\n  const url = new URL(executionOrigin);\n  url.pathname = `${url.pathname.replace(/\\/+$/u, \"\")}/v1/workspaces/${workspaceId}/codemode`;\n  url.search = \"\";\n  url.hash = \"\";\n  return url.toString();\n}\n\nfunction firstPartyMcpServerUrl(settings: Settings): string {\n  return firstPartyMcpBaseUrl(settings);\n}\n\nfunction firstPartyDocumentsMcpServerUrl(mcpUrl: string): string {\n  return `${mcpUrl.replace(/\\/+$/, \"\")}/docs`;\n}\n\nfunction firstPartyFilesMcpServerUrl(mcpUrl: string): string {\n  return `${mcpUrl.replace(/\\/+$/, \"\")}/files`;\n}\n\nfunction validateSettings(settings: Settings): void {\n  temporalConnectionOptions(settings);\n  const allowedFirstPartyMcpTools = new Set(\n    settings.allowedFirstPartyMcpTools ?? FIRST_PARTY_MCP_TOOL_NAMES,\n  );\n  const disallowedDefaults = (settings.defaultFirstPartyMcpTools ?? []).filter(\n    (tool) => !allowedFirstPartyMcpTools.has(tool),\n  );\n  if (disallowedDefaults.length > 0) {\n    throw new Error(\n      `OPENGENI_DEFAULT_FIRST_PARTY_MCP_TOOLS must be a subset of OPENGENI_ALLOWED_FIRST_PARTY_MCP_TOOLS: ${disallowedDefaults.join(\", \")}`,\n    );\n  }\n  if (settings.productAccessMode === \"managed\") {\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    if (!settings.betterAuthSecret) {\n      throw new Error(\n        \"OPENGENI_BETTER_AUTH_SECRET is required when OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    if (!settings.delegationSecret) {\n      throw new Error(\n        \"OPENGENI_DELEGATION_SECRET is required when OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    if (![\"local\", \"test\"].includes(settings.environment) && !settings.resendApiKey) {\n      throw new Error(\"OPENGENI_RESEND_API_KEY is required for managed mode outside local/test\");\n    }\n    if (![\"local\", \"test\"].includes(settings.environment) && !settings.environmentsEncryptionKey) {\n      throw new Error(\n        \"OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is required for managed mode outside local/test\",\n      );\n    }\n  }\n  environmentsEncryptionKeyBytes(settings);\n  if (settings.integrationsEnabled) {\n    if (settings.productAccessMode === \"managed\" && !settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when OPENGENI_INTEGRATIONS_ENABLED=true and OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    if (\n      settings.publicBaseUrl &&\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when OPENGENI_INTEGRATIONS_ENABLED=true outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret && ![\"local\", \"test\"].includes(settings.environment)) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when OPENGENI_INTEGRATIONS_ENABLED=true outside local/test\",\n      );\n    }\n  }\n  if (Boolean(settings.slackClientId) !== Boolean(settings.slackClientSecret)) {\n    throw new Error(\n      \"OPENGENI_SLACK_CLIENT_ID and OPENGENI_SLACK_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (settings.slackClientId) {\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when the OpenGeni Slack app is configured\",\n      );\n    }\n    if (\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when the OpenGeni Slack app is configured outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when the OpenGeni Slack app is configured\",\n      );\n    }\n  }\n  if (Boolean(settings.googleDriveClientId) !== Boolean(settings.googleDriveClientSecret)) {\n    throw new Error(\n      \"OPENGENI_GOOGLE_DRIVE_CLIENT_ID and OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (Boolean(settings.fikenClientId) !== Boolean(settings.fikenClientSecret)) {\n    throw new Error(\n      \"OPENGENI_FIKEN_OAUTH_CLIENT_ID and OPENGENI_FIKEN_OAUTH_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (settings.fikenClientId) {\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when the Fiken OAuth integration is configured\",\n      );\n    }\n    if (\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when the Fiken OAuth integration is configured outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when the Fiken OAuth integration is configured\",\n      );\n    }\n  }\n  if (settings.googleDriveClientId) {\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when the Google Drive integration is configured\",\n      );\n    }\n    if (\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when the Google Drive integration is configured outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when the Google Drive integration is configured\",\n      );\n    }\n  }\n  if (Boolean(settings.atlassianClientId) !== Boolean(settings.atlassianClientSecret)) {\n    throw new Error(\n      \"OPENGENI_ATLASSIAN_CLIENT_ID and OPENGENI_ATLASSIAN_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (settings.atlassianClientId) {\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when the Atlassian integration is configured\",\n      );\n    }\n    if (\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when the Atlassian integration is configured outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when the Atlassian integration is configured\",\n      );\n    }\n  }\n  parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);\n  parseSocialOauthClientsJson(settings.socialOauthClientsJson);\n  if (\n    settings.productAccessMode === \"configured\" &&\n    ![\"local\", \"test\"].includes(settings.environment) &&\n    !settings.delegationSecret &&\n    !settings.authRequired\n  ) {\n    throw new Error(\n      \"OPENGENI_PRODUCT_ACCESS_MODE=configured requires OPENGENI_DELEGATION_SECRET or OPENGENI_AUTH_REQUIRED=true outside local/test\",\n    );\n  }\n  if (settings.billingMode === \"stripe\") {\n    if (!settings.stripeSecretKey || !settings.stripeWebhookSecret) {\n      throw new Error(\n        \"OPENGENI_STRIPE_SECRET_KEY and OPENGENI_STRIPE_WEBHOOK_SECRET are required when OPENGENI_BILLING_MODE=stripe\",\n      );\n    }\n  }\n  if (settings.productAccessMode !== \"managed\" && settings.billingMode === \"stripe\") {\n    throw new Error(\"OPENGENI_BILLING_MODE=stripe requires OPENGENI_PRODUCT_ACCESS_MODE=managed\");\n  }\n  if (settings.billingMode === \"stripe\" || settings.usageLimitsMode === \"managed\") {\n    const pricing = configuredModelPricing(settings);\n    const missing = configuredAllowedModels(settings).filter((model) => !pricing[model]);\n    if (missing.length > 0) {\n      throw new Error(\n        `Missing model pricing for managed billing model(s): ${missing.join(\", \")}. Set OPENGENI_MODEL_PRICING_JSON.`,\n      );\n    }\n  }\n  if (settings.usageLimitsMode === \"static\") {\n    const limits = configuredStaticUsageLimits(settings);\n    if (Object.keys(limits).length === 0) {\n      throw new Error(\n        \"OPENGENI_STATIC_USAGE_LIMITS_JSON must define at least one cap when OPENGENI_USAGE_LIMITS_MODE=static\",\n      );\n    }\n  } else {\n    parseStaticUsageLimitsJson(settings.staticUsageLimitsJson);\n  }\n  if (settings.entitlementsMode === \"static\") {\n    const entitlements = parseStaticEntitlementsJson(settings.staticEntitlementsJson);\n    if (Object.keys(entitlements).length === 0) {\n      throw new Error(\n        \"OPENGENI_STATIC_ENTITLEMENTS_JSON must define at least one feature when OPENGENI_ENTITLEMENTS_MODE=static\",\n      );\n    }\n  } else {\n    parseStaticEntitlementsJson(settings.staticEntitlementsJson);\n  }\n  if (settings.authRequired && !settings.accessKey) {\n    throw new Error(\"OPENGENI_ACCESS_KEY is required when OPENGENI_AUTH_REQUIRED=true\");\n  }\n  if (settings.openaiProvider === \"azure\") {\n    if (!settings.azureOpenaiBaseUrl && !settings.azureOpenaiEndpoint) {\n      throw new Error(\n        \"Azure OpenAI requires OPENGENI_AZURE_OPENAI_BASE_URL or OPENGENI_AZURE_OPENAI_ENDPOINT\",\n      );\n    }\n    if (!settings.azureOpenaiBaseUrl && !settings.azureOpenaiDeployment) {\n      throw new Error(\"Azure OpenAI endpoint mode requires OPENGENI_AZURE_OPENAI_DEPLOYMENT\");\n    }\n    if (!settings.azureOpenaiBaseUrl && !settings.azureOpenaiApiVersion) {\n      throw new Error(\"Azure OpenAI endpoint mode requires OPENGENI_AZURE_OPENAI_API_VERSION\");\n    }\n    if (!settings.azureOpenaiApiKey && !settings.azureOpenaiAdToken) {\n      throw new Error(\"Azure OpenAI requires an API key or AD token\");\n    }\n  }\n  // The Modal token is a both-or-neither pair regardless of the active backend\n  // (a half-configured token is always a misconfiguration). This is orthogonal\n  // to the backend-gated required-cred sweep below.\n  if (Boolean(settings.modalTokenId) !== Boolean(settings.modalTokenSecret)) {\n    throw new Error(\n      \"OPENGENI_MODAL_TOKEN_ID and OPENGENI_MODAL_TOKEN_SECRET must both be set or both omitted\",\n    );\n  }\n  // Backend-gated required credentials: only the *active* backend's creds are\n  // required. A modal deployment must carry the Modal token; a daytona/e2b/none\n  // deployment must NOT be forced to (and is not). Drives off the single\n  // SANDBOX_REQUIRED_ENV table that the deployment package also mirrors.\n  for (const required of SANDBOX_REQUIRED_ENV[settings.sandboxBackend] ?? []) {\n    const value = settings[required.field];\n    if (\n      value === undefined ||\n      value === null ||\n      (typeof value === \"string\" && value.trim().length === 0)\n    ) {\n      throw new Error(\n        `${required.env} is required when OPENGENI_SANDBOX_BACKEND=${settings.sandboxBackend}`,\n      );\n    }\n  }\n  if (\n    settings.objectStorageBackend === \"s3-compatible\" ||\n    settings.objectStorageBackend === \"aws-s3\"\n  ) {\n    if (\n      Boolean(settings.objectStorageAccessKeyId) !== Boolean(settings.objectStorageSecretAccessKey)\n    ) {\n      throw new Error(\n        \"OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID and OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY must both be set or both omitted\",\n      );\n    }\n    if (\n      settings.objectStorageBackend === \"s3-compatible\" &&\n      (settings.objectStorageEndpoint ||\n        settings.objectStorageInternalEndpoint ||\n        settings.objectStorageSandboxEndpoint) &&\n      (!settings.objectStorageAccessKeyId || !settings.objectStorageSecretAccessKey)\n    ) {\n      throw new Error(\n        \"S3-compatible object storage endpoints require OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID and OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY\",\n      );\n    }\n    if (\n      settings.objectStorageAzureConnectionString ||\n      settings.objectStorageAzureAccountName ||\n      settings.objectStorageAzureAccountKey ||\n      settings.objectStorageAzureEndpoint\n    ) {\n      throw new Error(\n        \"S3 object storage uses OPENGENI_OBJECT_STORAGE_* S3 settings, not OPENGENI_OBJECT_STORAGE_AZURE_* settings\",\n      );\n    }\n    if (\n      settings.objectStorageGcsProjectId ||\n      settings.objectStorageGcsCredentialsJson ||\n      settings.objectStorageGcsKeyFilename ||\n      settings.objectStorageGcsApiEndpoint\n    ) {\n      throw new Error(\n        \"S3 object storage uses OPENGENI_OBJECT_STORAGE_* S3 settings, not OPENGENI_OBJECT_STORAGE_GCS_* settings\",\n      );\n    }\n  } else if (settings.objectStorageBackend === \"azure-blob\") {\n    if (\n      settings.objectStorageEndpoint ||\n      settings.objectStorageInternalEndpoint ||\n      settings.objectStorageSandboxEndpoint ||\n      settings.objectStorageAccessKeyId ||\n      settings.objectStorageSecretAccessKey\n    ) {\n      throw new Error(\n        \"Azure Blob storage uses OPENGENI_OBJECT_STORAGE_AZURE_* settings, not S3-compatible object storage settings\",\n      );\n    }\n    if (\n      settings.objectStorageGcsProjectId ||\n      settings.objectStorageGcsCredentialsJson ||\n      settings.objectStorageGcsKeyFilename ||\n      settings.objectStorageGcsApiEndpoint\n    ) {\n      throw new Error(\n        \"Azure Blob storage uses OPENGENI_OBJECT_STORAGE_AZURE_* settings, not OPENGENI_OBJECT_STORAGE_GCS_* settings\",\n      );\n    }\n    const hasConnectionString = Boolean(settings.objectStorageAzureConnectionString);\n    const hasSharedKey =\n      Boolean(settings.objectStorageAzureAccountName) &&\n      Boolean(settings.objectStorageAzureAccountKey);\n    if (!hasConnectionString && !hasSharedKey) {\n      throw new Error(\n        \"Azure Blob storage requires OPENGENI_OBJECT_STORAGE_AZURE_CONNECTION_STRING or OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_NAME plus OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_KEY\",\n      );\n    }\n  } else {\n    if (\n      settings.objectStorageEndpoint ||\n      settings.objectStorageInternalEndpoint ||\n      settings.objectStorageSandboxEndpoint ||\n      settings.objectStorageAccessKeyId ||\n      settings.objectStorageSecretAccessKey\n    ) {\n      throw new Error(\n        \"GCS object storage uses OPENGENI_OBJECT_STORAGE_GCS_* settings, not S3-compatible object storage settings\",\n      );\n    }\n    if (\n      settings.objectStorageAzureConnectionString ||\n      settings.objectStorageAzureAccountName ||\n      settings.objectStorageAzureAccountKey ||\n      settings.objectStorageAzureEndpoint\n    ) {\n      throw new Error(\n        \"GCS object storage uses OPENGENI_OBJECT_STORAGE_GCS_* settings, not OPENGENI_OBJECT_STORAGE_AZURE_* settings\",\n      );\n    }\n    if (settings.objectStorageGcsCredentialsJson) {\n      parseGcsCredentialsJson(settings.objectStorageGcsCredentialsJson);\n    }\n  }\n  if (settings.documentChunkOverlap >= settings.documentChunkSize) {\n    throw new Error(\n      \"OPENGENI_DOCUMENT_CHUNK_OVERLAP must be smaller than OPENGENI_DOCUMENT_CHUNK_SIZE\",\n    );\n  }\n  parseExposedPorts(settings.dockerExposedPorts);\n  sandboxEnvironmentVariableNames(settings);\n  sandboxLifecycleHookIds(settings);\n  // Fail fast on a malformed warm-rate table (P2.1).\n  parseSandboxWarmRateJson(settings.sandboxWarmRateMicrosPerSecondJson);\n  const serverIds = new Set<string>();\n  for (const server of settings.mcpServers) {\n    if (serverIds.has(server.id)) {\n      throw new Error(`OPENGENI_MCP_SERVERS contains duplicate id ${server.id}`);\n    }\n    serverIds.add(server.id);\n  }\n  // --- sandbox lease cadence invariant (fail fast at boot) ---\n  // reaperPeriod (30s) < viewerHolderTTL (90s), and reaperPeriod + idleGrace must\n  // be strictly less than the provider lifetime (modalTimeoutSeconds*1000):\n  //   - the reaper must run more often than the TTL it polices; and\n  //   - the reaper must terminate a genuinely-idle box (after the full drain grace,\n  //     observed on the NEXT sweep) BEFORE the provider's hard lifetime reclaims it\n  //     out from under us — the provider lifetime is the backstop, not the\n  //     warm-window controller. idleGrace counts from the user's last release;\n  //     the provider clock counts from the preceding resume, so we leave the\n  //     active-turn headroom in modalTimeoutSeconds (default 86400s).\n  {\n    const reaperPeriod = settings.sandboxLeaseReaperPeriodMs;\n    const viewerTtl = settings.sandboxViewerHolderTtlMs;\n    const interactionTtl = settings.sandboxInteractionHolderTtlMs;\n    const idleGraceMs = settings.sandboxIdleGraceMs;\n    const providerLifetimeMs = settings.modalTimeoutSeconds * 1000;\n    const rotationLeadMs = settings.sandboxRotationLeadMs;\n    // The EFFECTIVE box lifetime when it sits idle between turns is the Modal IDLE\n    // timeout, NOT the hard lifetime (sandbox-file-persistence): a box with no\n    // active connection is idle-reaped at idleTimeout. effectiveModalIdleTimeout\n    // defaults to the hard lifetime (so the idle-reap never beats the OpenGeni\n    // reaper), but an operator can pin it shorter — the invariants below bind the\n    // reaper cadence + drain grace to the idle timeout (the REAL ceiling), so a\n    // drained box always survives long enough for the reaper to snapshot it.\n    const idleTimeoutMs = effectiveModalIdleTimeoutSeconds(settings) * 1000;\n    if (!(reaperPeriod < viewerTtl)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS (${reaperPeriod}) must be strictly less than ` +\n          `OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS (${viewerTtl}): the reaper must run more often ` +\n          `than the TTL it polices, or stale viewer holders outlive a full reaper period.`,\n      );\n    }\n    if (!(reaperPeriod < interactionTtl)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS (${reaperPeriod}) must be strictly less than ` +\n          `OPENGENI_SANDBOX_INTERACTION_HOLDER_TTL_MS (${interactionTtl}): the reaper must run ` +\n          `more often than the controller-heartbeat horizon.`,\n      );\n    }\n    if (!(idleTimeoutMs <= providerLifetimeMs)) {\n      throw new Error(\n        `OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS*1000 (${idleTimeoutMs}) must not exceed the hard provider ` +\n          `lifetime (OPENGENI_MODAL_TIMEOUT_SECONDS*1000 = ${providerLifetimeMs}): the idle timeout is a ` +\n          `floor under the hard lifetime, not above it.`,\n      );\n    }\n    if (!(rotationLeadMs < providerLifetimeMs)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must be strictly less than ` +\n          `OPENGENI_MODAL_TIMEOUT_SECONDS*1000 (${providerLifetimeMs}).`,\n      );\n    }\n    // This is provider-hard-deadline headroom, not a retry delay. Rotation is\n    // admitted immediately before the same sweep's drain inventory, so only the\n    // worst-case time until that sweep plus the complete durable capture window\n    // is required. No second schedule period belongs in the availability path.\n    const captureTimeoutMs = sandboxArchiveCaptureTimeoutMs(settings);\n    if (!(rotationLeadMs > captureTimeoutMs + reaperPeriod)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must exceed the durable capture ` +\n          `timeout plus one reaper period (${captureTimeoutMs + reaperPeriod}).`,\n      );\n    }\n    if (!(viewerTtl < idleTimeoutMs)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS (${viewerTtl}) must be strictly less than the effective box ` +\n          `idle timeout (${idleTimeoutMs}): a viewer holder must be reapable before the box idles out from ` +\n          `under it (the provider idle-timeout is the backstop).`,\n      );\n    }\n    if (!(interactionTtl < idleTimeoutMs)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_INTERACTION_HOLDER_TTL_MS (${interactionTtl}) must be strictly less than ` +\n          `the effective box idle timeout (${idleTimeoutMs}): a dead browser controller must be ` +\n          `reapable before the provider reclaims its placement.`,\n      );\n    }\n    if (!(reaperPeriod + idleGraceMs < idleTimeoutMs)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS + OPENGENI_SANDBOX_IDLE_GRACE_MS ` +\n          `(${reaperPeriod} + ${idleGraceMs} = ${reaperPeriod + idleGraceMs}) must be strictly less than the ` +\n          `effective box idle timeout (${idleTimeoutMs}): a drained box must SURVIVE its full warm window so ` +\n          `the reaper can resume + snapshot /workspace + terminate it on the sweep AFTER the drain grace ` +\n          `elapses — Modal's idle-reap must NOT fire first (or /workspace is lost). Raise ` +\n          `OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS (defaults to OPENGENI_MODAL_TIMEOUT_SECONDS) or lower ` +\n          `OPENGENI_SANDBOX_IDLE_GRACE_MS.`,\n      );\n    }\n  }\n  // --- stream-token secret: required-when-desktop, but GRACEFULLY DEGRADE (stream-token availability contract) ---\n  // The desktop pixel plane needs an HMAC secret to mint scoped stream tokens.\n  // It is REQUIRED when desktop is enabled — but per OD-8 a missing secret is NOT\n  // a hard boot-fail: we emit a LOUD warning and the deployment ships with\n  // DesktopStream.transport:null (resolveStreamTokenSecret returns undefined ->\n  // negotiateCapabilities degrades the desktop cell). This keeps a desktop-\n  // configured deployment bootable (headless + Channel-A still work) instead of\n  // crashing the whole API on a missing secret.\n  if (settings.sandboxDesktopEnabled && resolveStreamTokenSecret(settings) === undefined) {\n    console.warn(\n      \"[opengeni] OPENGENI_SANDBOX_DESKTOP_ENABLED=true but neither OPENGENI_STREAM_TOKEN_SECRET nor \" +\n        \"OPENGENI_DELEGATION_SECRET is set: the desktop pixel plane will GRACEFULLY DEGRADE \" +\n        \"(DesktopStream.transport=null — no scoped stream tokens can be minted). Set \" +\n        \"OPENGENI_STREAM_TOKEN_SECRET to enable the live desktop stream.\",\n    );\n  }\n  // Model provider registry: parse it here so JSON/zod errors surface at boot,\n  // reject a registry id colliding with the built-in provider id (it would\n  // shadow the built-in in configuredProviders), reject duplicate registry\n  // ids, and require a resolvable API key for every registry provider (a\n  // provider with no usable key can never serve a turn). Registry models flow\n  // through configuredAllowedModels, so the managed-billing pricing check above\n  // already covers them.\n  const registryProviders = parseModelProvidersJson(settings.modelProvidersJson);\n  const builtinId = builtinProviderId(settings);\n  const providerIds = new Set<string>();\n  for (const provider of registryProviders) {\n    if (\n      provider.kind === \"vercel-gateway-managed\" ||\n      provider.kind === \"vercel-gateway-workspace\" ||\n      provider.kind === \"xai-subscription\"\n    ) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider kind ${provider.kind} is reserved for a reviewed OpenGeni credential broker`,\n      );\n    }\n    if (provider.id === builtinId) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider id ${provider.id} collides with the built-in provider id`,\n      );\n    }\n    if (providerIds.has(provider.id)) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON contains duplicate provider id ${provider.id}`,\n      );\n    }\n    providerIds.add(provider.id);\n    if (provider.kind !== \"codex-subscription\" && !resolveProviderApiKey(provider)) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider ${provider.id} requires a resolvable API key (set apiKey or apiKeyEnv)`,\n      );\n    }\n  }\n  // Materialize the normalized catalog at boot so canonical product ids,\n  // aliases, definition digests, and capability/pricing normalization are\n  // validated even when managed billing is disabled.\n  configuredModels(settings);\n}\n\n/**\n * Resolve the secret used to sign/verify scoped stream tokens (sandbox contract\n * §C.3). Falls back to `delegationSecret` (the same HMAC envelope family —\n * `ogs_` vs `ogd_` prefix) so a deployment that already carries a delegation\n * secret does not need a second one. Returns undefined when neither is set,\n * which drives the graceful-degrade (DesktopStream.transport:null).\n */\nexport function resolveStreamTokenSecret(settings: Settings): string | undefined {\n  const explicit = settings.streamTokenSecret?.trim();\n  if (explicit) {\n    return explicit;\n  }\n  const delegation = settings.delegationSecret?.trim();\n  return delegation ? delegation : undefined;\n}\n\n/**\n * True iff the desktop pixel plane must GRACEFULLY DEGRADE because desktop is\n * enabled but no stream-token secret is resolvable (stream-token availability contract). When true,\n * negotiateCapabilities forces DesktopStream.transport:null.\n */\nexport function streamTokenDegraded(settings: Settings): boolean {\n  return settings.sandboxDesktopEnabled && resolveStreamTokenSecret(settings) === undefined;\n}\n\n/**\n * Resolve the secret the control plane signs the enrollment bearer credential\n * with (the `oge_` envelope the agent presents back — M5). Falls\n * back to `delegationSecret` (the same HMAC envelope family) so a deployment that\n * already carries a delegation secret needs no second one. Returns undefined when\n * neither is set; when selfhosted is enabled but this is undefined, the poll route\n * reports the credential plane disabled (graceful degrade, never a 500). NEVER log\n * the returned value.\n */\nexport function resolveEnrollmentSigningSecret(settings: Settings): string | undefined {\n  const explicit = settings.enrollmentSigningSecret?.trim();\n  if (explicit) {\n    return explicit;\n  }\n  const delegation = settings.delegationSecret?.trim();\n  return delegation ? delegation : undefined;\n}\n\n/**\n * Resolve the HMAC secret the control plane signs the agent's relay PRODUCER token\n * with (the `ogr_` envelope; M8b). The RELAY verifies the producer\n * token with the SAME secret (injected into the relay via env). Prefers an explicit\n * `selfhostedRelayTokenSecret`, then the `streamTokenSecret` (the relay already\n * needs that one to verify the viewer's `ogs_` token, so a single secret can back\n * both planes), then `delegationSecret` (same HMAC family). Returns undefined when\n * none is set — the enrollment poll then returns an empty relayToken (graceful\n * degrade; the stream plane is unavailable until configured). NEVER log the value.\n */\nexport function resolveRelayTokenSecret(settings: Settings): string | undefined {\n  const explicit = settings.selfhostedRelayTokenSecret?.trim();\n  if (explicit) {\n    return explicit;\n  }\n  const stream = settings.streamTokenSecret?.trim();\n  if (stream) {\n    return stream;\n  }\n  const delegation = settings.delegationSecret?.trim();\n  return delegation ? delegation : undefined;\n}\n\n/**\n * The resolved NATS auth-callout responder config (M-AUTH). Present only when the\n * callout plane is FULLY configured: the account signing seed + the responder's own\n * login. When any piece is missing this returns null and the responder does not\n * start (selfhosted agents cannot connect — a graceful disabled state, never a boot\n * crash). The returned `accountSeed` is a secret; NEVER log it.\n */\nexport interface NatsCalloutConfig {\n  /** The callout account SIGNING seed (`SA...`) — signs the user + response JWTs. */\n  accountSeed: string;\n  /** The target account NAME the user is placed into (the response `aud`). */\n  accountName: string;\n  /** The responder's NATS login (an `auth_callout.auth_users` user). */\n  user: string;\n  password: string;\n}\n\nexport function resolveNatsCalloutConfig(settings: Settings): NatsCalloutConfig | null {\n  const accountSeed = settings.selfhostedNatsCalloutAccountSeed?.trim();\n  const accountName = settings.selfhostedNatsCalloutAccountName?.trim() || \"APP\";\n  const user = settings.selfhostedNatsCalloutUser?.trim();\n  const password = settings.selfhostedNatsCalloutPassword?.trim();\n  if (!accountSeed || !user || !password) {\n    return null;\n  }\n  return { accountSeed, accountName, user, password };\n}\n\n/**\n * The PRIVILEGED control-plane NATS login (api/worker). Present only when BOTH a\n * user and password are set; otherwise null and the bus connects anonymously (local\n * dev / a NATS without auth_callout). When the callout plane is on, this is the\n * static account user permitted to request `agent.*.rpc`.\n */\nexport interface NatsControlPlaneAuth {\n  user: string;\n  password: string;\n}\n\nexport function resolveNatsControlPlaneAuth(settings: Settings): NatsControlPlaneAuth | null {\n  const user = settings.selfhostedNatsControlUser?.trim();\n  const password = settings.selfhostedNatsControlPassword?.trim();\n  if (!user || !password) {\n    return null;\n  }\n  return { user, password };\n}\n\nfunction splitCsv(raw: string): string[] {\n  return raw\n    .split(\",\")\n    .map((value) => value.trim())\n    .filter(Boolean);\n}\n\nfunction uniqueEnvNames(raw: string[], fieldName: string): string[] {\n  const seen = new Set<string>();\n  const out: string[] = [];\n  for (const name of raw) {\n    if (!envName.test(name)) {\n      throw new Error(`${fieldName} contains invalid variable name ${name}`);\n    }\n    if (!seen.has(name)) {\n      seen.add(name);\n      out.push(name);\n    }\n  }\n  return out;\n}\n\nfunction uniqueValues(raw: string[]): string[] {\n  return [...new Set(raw.filter(Boolean))];\n}\n\nfunction parseGcsCredentialsJson(raw: string): unknown {\n  try {\n    return JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_OBJECT_STORAGE_GCS_CREDENTIALS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n}\n\nfunction delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAMK;AACP,SAAS,iDAAiD;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAAA,yCAAwC;AACjD,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAElB,IAAM,UAAU;AAChB,IAAM,aAAa;AAKZ,IAAM,yCAAyC,KAAK;AACpD,IAAM,8CAA8C;AACpD,IAAM,kCACX,yCAAyC;AASpC,IAAM,2CAA2C,KAAK;AACtD,IAAM,2CAA2C;AACxD,IAAM,aAAa,EAAE,WAAW,CAAC,UAAU;AACzC,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,MAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,IAAI,EAAE,SAAS,UAAU,GAAG;AACxD,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAS,KAAK,MAAM,KAAK,KAAK,EAAE,SAAS,UAAU,GAAG;AACzD,WAAO;AAAA,EACT;AACA,SAAO;AACT,GAAG,EAAE,QAAQ,CAAC;AAEd,IAAM,wBAAwB,EAAE;AAAA,EAC9B,CAAC,UAAU;AACT,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,SAAS,MAAM,KAAK;AAC1B,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,OAAO,WAAW,GAAG,GAAG;AAC1B,UAAI;AACF,eAAO,KAAK,MAAM,MAAM;AAAA,MAC1B,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO,OAAO,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAAA,EACtD;AAAA,EACA,EACG,MAAM,qBAAqB,EAC3B,YAAY,CAAC,OAAO,YAAY;AAC/B,UAAM,OAAO,oBAAI,IAA+B;AAChD,eAAW,CAAC,OAAO,IAAI,KAAK,MAAM,QAAQ,GAAG;AAC3C,UAAI,KAAK,IAAI,IAAI,GAAG;AAClB,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM,CAAC,KAAK;AAAA,QACd,CAAC;AAAA,MACH;AACA,WAAK,IAAI,IAAI;AAAA,IACf;AAAA,EACF,CAAC,EACA,SAAS;AACd;AAEO,IAAM,6BAAiF;AAAA,EAC5F,MAAM;AAAA,IACJ,KAAK,CAAC;AAAA,IACN,OAAO,CAAC;AAAA,EACV;AAAA,EACA,OAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,OAAO,CAAC,iBAAiB;AAAA,EAC3B;AAAA,EACA,QAAQ;AAAA,IACN,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,OAAO,CAAC;AAAA,EACV;AACF;AAUO,IAAM,sCAAsC;AAkB5C,IAAM,6BAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,GAAG;AAEH,IAAM,+BAA+B,EACzC,OAAO;AAAA;AAAA,EAEN,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC9C,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAChC,MAAM,EAAE,KAAK,CAAC,UAAU,WAAW,eAAe,WAAW,CAAC,EAAE,SAAS;AAAA,EACzE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC5C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,mBAAmB,EAChB;AAAA,IACC,EACG,OAAO;AAAA,MACN,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,MAC7B,MAAM,EAAE,QAAQ,YAAY;AAAA,IAC9B,CAAC,EACA,OAAO;AAAA,EACZ,EACC,IAAI,CAAC,EACL,IAAI,GAAG,EACP,YAAY,CAAC,WAAW,YAAY;AACnC,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,CAAC,OAAO,QAAQ,KAAK,UAAU,QAAQ,GAAG;AACnD,YAAM,MAAM,GAAG,SAAS,IAAI,KAAK,SAAS,EAAE;AAC5C,UAAI,KAAK,IAAI,GAAG,GAAG;AACjB,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM,CAAC,KAAK;AAAA,QACd,CAAC;AAAA,MACH;AACA,WAAK,IAAI,GAAG;AAAA,IACd;AAAA,EACF,CAAC,EACA,SAAS;AAAA,EACZ,cAAc,EAAE,KAAK,CAAC,aAAa,SAAS,CAAC,EAAE,SAAS;AAC1D,CAAC,EACA,OAAO,EACP,YAAY,CAAC,WAAW,YAAY;AACnC,MAAI,CAAC,UAAU,kBAAmB;AAClC,MAAI,CAAC,UAAU,cAAc;AAC3B,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM,CAAC,cAAc;AAAA,IACvB,CAAC;AAAA,EACH;AACA,MAAI,CAAC,UAAU,UAAU;AACvB,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM,CAAC,UAAU;AAAA,IACnB,CAAC;AAAA,EACH;AACF,CAAC;AAGH,IAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,aAAa,EAAE,OAAO,EAAE,QAAQ,UAAU;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,QAAQ,OAAO;AAAA,EACvC,oBAAoB,EAAE,OAAO,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA,EAG5C,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,QAAQ,sDAAsD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtF,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA,EAI/B,aAAa,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC,EAAE,QAAQ,OAAO;AAAA;AAAA;AAAA;AAAA,EAIxD,qBAAqB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,cAAc;AAAA,EAC7D,SAAS,EAAE,OAAO,EAAE,QAAQ,uBAAuB;AAAA,EACnD,cAAc,EAAE,OAAO,EAAE,QAAQ,gBAAgB;AAAA,EACjD,mBAAmB,EAAE,OAAO,EAAE,QAAQ,SAAS;AAAA,EAC/C,mBAAmB,EAAE,OAAO,EAAE,QAAQ,kBAAkB;AAAA,EACxD,oBAAoB,WAAW,QAAQ,KAAK;AAAA,EAC5C,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,oCAAoC,EAAE,OAAO,EAAE,SAAS;AAAA,EACxD,oCAAoC,EAAE,OAAO,EAAE,SAAS;AAAA,EACxD,mCAAmC,EAAE,OAAO,EAAE,SAAS;AAAA,EACvD,gCAAgC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EAC7E,sCAAsC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA,EACrF,kCAAkC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA,EACjF,2BAA2B,EAAE,KAAK,CAAC,SAAS,gBAAgB,CAAC,EAAE,QAAQ,OAAO;AAAA,EAC9E,8BAA8B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAK,EAAE,QAAQ,EAAE;AAAA,EACtF,0BAA0B,EAAE,OAAO,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA,EACzE,6BAA6B,EAAE,OAAO,OAAO,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAI/E,gCAAgC,EAAE,OAAO,OAAO,EAAE,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,QAAQ,GAAG;AAAA,EACjF,iCAAiC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAK;AAAA,EAC7F,gCAAgC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,IAAI,GAAO,EAAE,QAAQ,GAAM;AAAA,EAC9F,6BAA6B,WAAW,QAAQ,KAAK;AAAA,EACrD,6BAA6B,WAAW,QAAQ,IAAI;AAAA,EACpD,2BAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrD,0BAA0B,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC/C,kBAAkB,WAAW,QAAQ,KAAK;AAAA,EAC1C,0BAA0B,WAAW,QAAQ,IAAI;AAAA,EACjD,sBAAsB,EACnB,OAAO,EACP,IAAI,GAAG,EACP,MAAM,mBAAmB,EACzB,SAAS;AAAA,EACZ,4BAA4B,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAChE,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAK,EAAE,SAAS;AAAA,EAC3D,2BAA2B,EACxB,OAAO,EACP,IAAI,EAAE,EACN,MAAM,gBAAgB,EACtB,SAAS;AAAA,EACZ,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAGzC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAItC,sBAAsB,EACnB,OAAO,EACP,IAAI,EACJ,QAAQ,mDAAmD;AAAA;AAAA;AAAA;AAAA,EAI9D,oBAAoB,EACjB,OAAO,EACP,MAAM,mDAAmD,EACzD,QAAQ,QAAQ;AAAA;AAAA;AAAA,EAGnB,kBAAkB,EACf,OAAO,EACP,MAAM,mDAAmD,EACzD,SAAS;AAAA,EACZ,mBAAmB,kBAAkB,QAAQ,OAAO;AAAA,EACpD,aAAa,YAAY,QAAQ,UAAU;AAAA,EAC3C,kBAAkB,iBAAiB,QAAQ,MAAM;AAAA,EACjD,iBAAiB,gBAAgB,QAAQ,MAAM;AAAA,EAC/C,wBAAwB,EAAE,OAAO,EAAE,QAAQ,IAAI;AAAA,EAC/C,uBAAuB,EAAE,OAAO,EAAE,QAAQ,IAAI;AAAA,EAC9C,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,2BAA2B;AAAA,EAC3B,2BAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM3B,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIvC,sBAAsB,WAAW,QAAQ,KAAK;AAAA,EAC9C,yBAAyB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA;AAAA;AAAA;AAAA,EAIvE,mBAAmB,EAChB,OAAO,EACP,MAAM,qEAAqE,EAC3E,SAAS;AAAA,EACZ,2BAA2B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,qBAAqB,WAAW,QAAQ,KAAK;AAAA,EAC7C,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,wCAAwC,WAAW,QAAQ,KAAK;AAAA,EAChE,8BAA8B,EAAE,OAAO,EAAE,QAAQ,IAAI;AAAA,EACrD,yBAAyB,WAAW,QAAQ,KAAK;AAAA,EACjD,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,mCAAmC,WAAW,SAAS;AAAA,EACvD,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAG3C,qBAAqB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,sBAAsB,EAAE,SAAS;AAAA;AAAA;AAAA,EAGhG,wBAAwB,EAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/C,0BAA0B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACtE,qBAAqB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKjE,2BAA2B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAS;AAAA;AAAA;AAAA;AAAA,EAI/E,qBAAqB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,KAAS;AAAA;AAAA;AAAA;AAAA,EAIzE,8BAA8B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ1E,iCAAiC,EAAE,OAChC,OAAO,EACP,QAAQ,GAAG,EACX,UAAU,CAAC,UAAU;AACpB,QAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,aAAO;AAAA,IACT;AACA,WAAO,KAAK,IAAI,KAAK,KAAK,IAAI,KAAK,KAAK,CAAC;AAAA,EAC3C,CAAC;AAAA;AAAA;AAAA,EAGH,6BAA6B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,KAAO;AAAA;AAAA;AAAA,EAGlF,mCAAmC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI/E,iCAAiC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EAClF,cAAc,WAAW,QAAQ,KAAK;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,iBAAiB,WAAW,QAAQ,IAAI;AAAA,EACxC,kBAAkB,WAAW,QAAQ,KAAK;AAAA,EAC1C,SAAS,EAAE,OAAO,EAAE,QAAQ,SAAS;AAAA,EACrC,SAAS,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA,EACxD,gBAAgB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC/D,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI1C,sBAAsB,EAAE,OAAO,EAAE,QAAQ,OAAO,+CAA+C;AAAA,EAC/F,gBAAgB,EAAE,KAAK,CAAC,UAAU,OAAO,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC5D,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,QAAQ,aAAa;AAAA,EAC7C,qBAAqB,EAAE,OAAO,EAAE,QAAQ,wCAAwC;AAAA;AAAA;AAAA;AAAA,EAIhF,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3C,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,oBAAoB;AAAA;AAAA,EAEpF,+BAA+B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAK;AAAA,EAC3F,mCAAmC,EAAE,OAClC,OAAO,EACP,IAAI,EACJ,IAAI,GAAM,EACV,IAAI,KAAK,KAAK,GAAM,EACpB,QAAQ,IAAI,KAAK,GAAM;AAAA,EAC1B,uCAAuC,EAAE,OACtC,OAAO,EACP,IAAI,EACJ,IAAI,GAAG,EACP,IAAI,IAAI,KAAK,EAAE,EACf,QAAQ,KAAK,EAAE;AAAA,EAClB,0CAA0C,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EAC1F,oCAAoC,EAAE,OACnC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,OAAO,gBAAgB,EAC3B,QAAQ,KAAK,OAAO,OAAO,IAAI;AAAA,EAClC,8BAA8B,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK,EAAE,QAAQ,qBAAqB;AAAA,EAC/F,4BAA4B,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK,EAAE,QAAQ,SAAS;AAAA;AAAA;AAAA,EAGjF,0CAA0C,EAAE,OACzC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,GAAU,EACd,QAAQ,KAAO;AAAA,EAClB,0CAA0C,EAAE,OACzC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,GAAU,EACd,QAAQ,IAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlB,8BAA8B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACpF,wBAAwB,EAAE,OACvB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,OAAO,IAAI,EACpB,QAAQ,KAAK,OAAO,IAAI;AAAA;AAAA;AAAA;AAAA,EAI3B,4BAA4B,WAAW,QAAQ,IAAI;AAAA,EACnD,uCAAuC,EAAE,OACtC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,IAAI,KAAK,EAAE,EACf,QAAQ,IAAI,KAAK,EAAE;AAAA,EACtB,iCAAiC,EAAE,OAChC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,MAAM,OAAO,IAAI,EACrB,QAAQ,MAAM,OAAO,IAAI;AAAA,EAC5B,sCAAsC,EAAE,OACrC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,OAAO,IAAI,EACpB,QAAQ,IAAI,OAAO,IAAI;AAAA,EAC1B,qCAAqC,EAAE,OACpC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,IAAI,KAAK,KAAK,EAAE,EACpB,QAAQ,KAAK,KAAK,EAAE;AAAA,EACvB,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzE,yBAAyB,EACtB,OAAO,EACP,QAAQ,+DAA+D;AAAA;AAAA;AAAA,EAG1E,yBAAyB,WAAW,QAAQ,IAAI;AAAA,EAChD,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,uBAAuB,EAAE,OAAO,EAAE,QAAQ,gBAAgB;AAAA;AAAA;AAAA,EAG1D,wBAAwB,WAAW,QAAQ,IAAI;AAAA,EAC/C,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,2BAA2B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,2BAA2B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK5C,oCAAoC,WAAW,QAAQ,KAAK;AAAA,EAC5D,kBAAkB,EAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOzC,oBAAoB,EAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAI3C,0BAA0B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAGlD,8BAA8B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAItD,2BAA2B,WAAW,QAAQ,KAAK;AAAA;AAAA,EACnD,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASrC,wBAAwB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/C,uBAAuB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9C,+BAA+B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAIvD,+BAA+B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAIvD,gCAAgC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EAClF,uBAAuB,gBAAgB,QAAQ,KAAK;AAAA,EACpD,+BAA+B,EAAE,OAAO,EAAE,QAAQ,2BAA2B;AAAA,EAC7E,0BAA0B,EAAE,KAAK,CAAC,QAAQ,WAAW,CAAC,EAAE,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAStE,uBAAuB,EAAE,KAAK,CAAC,SAAS,UAAU,CAAC,EAAE,QAAQ,OAAO;AAAA;AAAA;AAAA;AAAA,EAIpE,iCAAiC,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAIxD,kBAAkB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjE,kBAAkB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQzC,2BAA2B,EAAE,OAAO,EAAE,QAAQ,0BAA0B;AAAA,EACxE,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,sBAAsB,WAAW,QAAQ,KAAK;AAAA,EAC9C,gBAAgB,eAAe,QAAQ,QAAQ;AAAA,EAC/C,aAAa,EAAE,OAAO,EAAE,QAAQ,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOxD,+BAA+B,WAAW,QAAQ,KAAK;AAAA,EACvD,oBAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EACzC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKnC,wBAAwB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,cAAc,EAAE,OAAO,EAAE,QAAQ,kBAAkB;AAAA,EACnD,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMnC,cAAc,EACX,OAAO,EAKP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,mBAAmB,EACzB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASZ,0BAA0B,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9C,qBAAqB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAM,EAAE,QAAQ,KAAM;AAAA,EAClF,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBtC,yBAAyB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASrE,2BAA2B,EACxB,KAAK,CAAC,OAAO,uBAAuB,oBAAoB,CAAC,EACzD,QAAQ,oBAAoB;AAAA;AAAA;AAAA,EAG/B,uBAAuB,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO/C,2BAA2B,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOlD,wBAAwB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAI/C,uBAAuB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACtE,wBAAwB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtE,oBAAoB,WAAW,QAAQ,IAAI;AAAA,EAC3C,qBAAqB,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI7C,kBAAkB,WAAW,QAAQ,IAAI;AAAA,EACzC,uBAAuB,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC,EAAE,QAAQ,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO1E,yBAAyB,WAAW,QAAQ,IAAI;AAAA,EAChD,oBAAoB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EACjE,qBAAqB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EACnE,mBAAmB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,SAAW;AAAA;AAAA;AAAA,EAEzE,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,yBAAyB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA,EACxE,uBAAuB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,iCAAiC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE7E,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC1C,sBAAsB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1C,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,eAAe,WAAW,QAAQ,IAAI;AAAA,EACtC,yBAAyB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErE,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,mBAAmB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,kBAAkB,EAAE,KAAK,CAAC,SAAS,MAAM,CAAC,EAAE,SAAS;AAAA,EACrD,wBAAwB,WAAW,SAAS;AAAA,EAC5C,eAAe,WAAW,SAAS;AAAA,EACnC,yBAAyB,EAAE,KAAK,CAAC,OAAO,UAAU,CAAC,EAAE,SAAS;AAAA;AAAA,EAE9D,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,yBAAyB,WAAW,SAAS;AAAA;AAAA,EAC7C,gCAAgC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5E,gBAAgB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAItC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACxD,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACnD,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC1C,6BAA6B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAM,EAAE,QAAQ,IAAK;AAAA,EACzF,sBAAsB,WAAW,QAAQ,KAAK;AAAA;AAAA,EAE9C,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUnC,yBAAyB,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASjD,sCAAsC,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAa9D,6BAA6B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQrD,0BAA0B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQlD,sBAAsB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM7C,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7C,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQxC,4BAA4B,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAGhD,sBAAsB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgB1C,kCAAkC,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtD,kCAAkC,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAItD,2BAA2B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,+BAA+B,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKnD,2BAA2B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,+BAA+B,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUnD,gCAAgC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC/E,mCAAmC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQpF,4BAA4B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EAC7E,0BAA0B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA,EAI3E,+BAA+B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUjF,oBAAoB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUtE,2BAA2B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMzE,0BAA0B,EAAE,OACzB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,+BAA+B,EACnC,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASjB,uBAAuB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM3E,0BAA0B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA,EAIhF,mBAAmB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EACpE,0BAA0B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAO;AAAA;AAAA;AAAA;AAAA,EAI5E,yBAAyB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3E,mBAAmB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMrE,oCAAoC,EAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3D,mCAAmC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAClF,4BAA4B,EAAE,OAAO,EAAE,QAAQ,MAAM;AAAA,EACrD,qBAAqB,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC1C,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjD,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzD,8BAA8B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACxD,sBAAsB,EACnB,KAAK,CAAC,iBAAiB,UAAU,cAAc,KAAK,CAAC,EACrD,QAAQ,eAAe;AAAA,EAC1B,qBAAqB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,gBAAgB;AAAA,EAC/D,qBAAqB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,WAAW;AAAA,EAC1D,yBAAyB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,OAAO;AAAA,EAC1D,0BAA0B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9C,8BAA8B,EAAE,OAAO,EAAE,SAAS;AAAA,EAClD,6BAA6B,WAAW,QAAQ,IAAI;AAAA,EACpD,oCAAoC,EAAE,OAAO,EAAE,SAAS;AAAA,EACxD,+BAA+B,EAAE,OAAO,EAAE,SAAS;AAAA,EACnD,8BAA8B,EAAE,OAAO,EAAE,SAAS;AAAA,EAClD,4BAA4B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtD,2BAA2B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,iCAAiC,EAAE,OAAO,EAAE,SAAS;AAAA,EACrD,6BAA6B,EAAE,OAAO,EAAE,SAAS;AAAA,EACjD,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,WAAW;AAAA,EACrD,mBAAmB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAClE,sBAAsB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,GAAG;AAAA,EACvE,2BAA2B,EAAE,KAAK,CAAC,UAAU,eAAe,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC/E,wBAAwB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,wBAAwB;AAAA,EAC1E,6BAA6B,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC5E,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpD,0BAA0B,EAAE,KAAK,CAAC,UAAU,aAAa,MAAM,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAClF,uBAAuB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,aAAa;AAAA,EAC9D,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,yBAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnD,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,0BAA0B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9C,8BAA8B,EAAE,OAAO,EAAE,SAAS;AAAA,EAClD,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,wBAAwB,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC7C,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,0BAA0B,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC/C,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,QAAQ,kCAAkC;AAAA,EAChE,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,sBAAsB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1C,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,YAAY,EACT;AAAA,IACC,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,UAAU;AAAA,MACtC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACjC,KAAK,EAAE,OAAO,EAAE,IAAI;AAAA,MACpB,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,MAClD,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,MAChD,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,MAEzC,iBAAiB,yBAAyB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOnD,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACnD,eAAe,6BAA6B,SAAS;AAAA,IACvD,CAAC;AAAA,EACH,EACC,QAAQ,CAAC,CAAC;AACf,CAAC;AA4CM,SAAS,yBAAyB,OAAmD;AAC1F,MAAI,SAAS,KAAM,QAAO;AAC1B,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,aAAa,QAAQ,YAAY;AACvC,MACE,eAAe,cACf,eAAe,cACf,eAAe,cACf,eAAe,gBACf,eAAe,SACf,WAAW,WAAW,OAAO,KAC7B,WAAW,WAAW,OAAO,GAC7B;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOO,SAAS,kCAAkC,UAAgD;AAChG,QAAM,QAAQ,SAAS,wBACpB,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB;AAAA,IACC,CAAC,SACC,SAAS,YACT,SAAS,kBACT,SAAS,wBACT,SAAS;AAAA,EACb;AACF,QAAM,OAAO,oBAAI,IAA0B;AAC3C,QAAM,YAAwC,CAAC;AAC/C,aAAW,MAAM,OAAO;AACtB,QAAI,KAAK,IAAI,EAAE,EAAG;AAClB,SAAK,IAAI,EAAE;AACX,QAAI,OAAO,UAAU;AACnB,UAAI,CAAC,SAAS,wBAAyB;AACvC,YAAM,SAAS,SAAS,0BAA0B,SAAS;AAC3D,UAAI,CAAC,yBAAyB,MAAM,EAAG;AAGvC,UACE,SAAS,mBAAmB,WAC5B,CAAC,SAAS,0BACV,CAAC,SAAS,yBACV;AACA;AAAA,MACF;AACA,gBAAU,KAAK;AAAA,QACb,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA,UACE,SAAS,2BACT,SAAS,iBACT,6BACA,QAAQ,QAAQ,EAAE;AAAA,QACpB,OAAO,SAAS;AAAA,MAClB,CAAC;AACD;AAAA,IACF;AACA,QAAI,OAAO,gBAAgB;AACzB,UAAI,CAAC,SAAS,uBAAwB;AACtC,YAAM,YACJ,SAAS,2BACT,SAAS,uBACT,IACA,QAAQ,QAAQ,EAAE;AACpB,YAAM,aAAa,SAAS,6BAA6B,SAAS,yBAAyB;AAC3F,YAAM,aACJ,SAAS,6BACT,SAAS,yBACT;AACF,YAAM,SAAS,SAAS,yBAAyB,SAAS,qBAAqB;AAC/E,YAAM,UAAU,SAAS,0BAA0B,SAAS,sBAAsB;AAClF,UACE,CAAC,YACD,CAAC,cACA,CAAC,yBAAyB,MAAM,KAAK,CAAC,yBAAyB,OAAO,GACvE;AACA;AAAA,MACF;AAGA,UACE,SAAS,mBAAmB,WAC5B,CAAC,SAAS,2BACV,CAAC,SAAS,6BACV,CAAC,SAAS,yBACV,CAAC,SAAS,wBACV;AACA;AAAA,MACF;AACA,gBAAU,KAAK;AAAA,QACb,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ,yBAAyB,MAAM,IAAI,SAAS;AAAA,QACpD,SAAS,yBAAyB,OAAO,IAAI,UAAU;AAAA,MACzD,CAAC;AACD;AAAA,IACF;AACA,QAAI,OAAO,sBAAsB;AAM/B,UAAI,CAAC,SAAS,yBAA0B;AACxC,gBAAU,KAAK;AAAA,QACb,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,cAAc;AAAA,MAChB,CAAC;AACD;AAAA,IACF;AACA,QAAI,OAAO,0BAA0B;AACnC,UAAI,CAAC,SAAS,6BAA8B;AAC5C,gBAAU,KAAK;AAAA,QACb,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,+BAA+B,UAA6B;AAC1E,SAAO,kCAAkC,QAAQ,EAAE;AAAA,IACjD,CAAC,aACC,SAAS,SAAS,wBAAwB,SAAS,SAAS;AAAA,EAChE;AACF;AAgDA,IAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,mCAAmC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC3E,8BAA8B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC3D,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO,EAAE,SAAS;AAC3D,CAAC;AAED,IAAM,6BAA6B,EAChC,OAAO;AAAA,EACN,SAAS;AAAA,EACT,iBAAiB,EACd;AAAA,IACC,EAAE,OAAO;AAAA,MACP,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MACjD,SAAS;AAAA,IACX,CAAC;AAAA,EACH,EACC,SAAS;AACd,CAAC,EACA,YAAY,CAAC,UAAU,QAAQ;AAC9B,MAAI,WAAW;AACf,aAAW,CAAC,OAAO,IAAI,MAAM,SAAS,mBAAmB,CAAC,GAAG,QAAQ,GAAG;AACtE,QAAI,KAAK,sBAAsB,UAAU;AACvC,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,mBAAmB,OAAO,oBAAoB;AAAA,QACrD,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,eAAW,KAAK;AAAA,EAClB;AACF,CAAC;AAEI,IAAM,sBAAsB,EAAE,KAAK,CAAC,aAAa,eAAe,SAAS,CAAC;AAG1E,IAAM,0BAA0B,EACpC,OAAO;AAAA,EACN,UAAU;AAAA,EACV,UAAU,EAAE,QAAQ;AACtB,CAAC,EACA,YAAY,CAAC,OAAO,QAAQ;AAC3B,MAAI,MAAM,aAAa,iBAAiB,MAAM,UAAU;AACtD,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,UAAU;AAAA,MACjB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGH,IAAM,kBAAkB,EAAE,KAAK,CAAC,QAAQ,SAAS,OAAO,CAAC;AACzD,IAAM,qBAAqB,EAAE,KAAK,CAAC,YAAY,YAAY,MAAM,CAAC;AAE3D,IAAM,4BAA4B,EACtC,OAAO;AAAA,EACN,WAAW,wBAAwB,OAAO;AAAA,IACxC,SAAS,EAAE,MAAM,eAAe;AAAA,IAChC,eAAe,gBAAgB,SAAS;AAAA,IACxC,UAAU,EAAE,QAAQ;AAAA,EACtB,CAAC;AAAA,EACD,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,aAAa,EAAE,OAAO;AAAA,IACpB,WAAW;AAAA,IACX,SAAS;AAAA,IACT,eAAe;AAAA,IACf,iBAAiB,wBAAwB,QAAQ;AAAA,MAC/C,UAAU;AAAA,MACV,UAAU;AAAA,IACZ,CAAC;AAAA,EACH,CAAC;AAAA,EACD,iBAAiB,EAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AAAA;AAAA,EAE/C,qBAAqB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACnD,kBAAkB,EAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AAAA,EAChD,YAAY,EAAE,OAAO;AAAA,IACnB,KAAK;AAAA,IACL,oBAAoB;AAAA,IACpB,eAAe;AAAA,EACjB,CAAC;AAAA,EACD,eAAe,wBAAwB,OAAO;AAAA,IAC5C,MAAM,EAAE,KAAK,CAAC,YAAY,aAAa,MAAM,CAAC;AAAA,EAChD,CAAC,EAAE,SAAS;AAAA,EACZ,cAAc,EACX;AAAA,IACC,EAAE,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,UAAU,EAAE,QAAQ;AAAA,MACpB,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IAC7D,CAAC;AAAA,EACH,EACC,IAAI,CAAC;AACV,CAAC,EACA,YAAY,CAAC,cAAc,QAAQ;AAClC,QAAM,UAAU,IAAI,IAAI,aAAa,UAAU,OAAO;AACtD,MAAI,QAAQ,SAAS,aAAa,UAAU,QAAQ,QAAQ;AAC1D,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,aAAa,SAAS;AAAA,MAC7B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,aAAa,UAAU,kBAAkB,QACzC,CAAC,QAAQ,IAAI,aAAa,UAAU,aAAa,GACjD;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,aAAa,eAAe;AAAA,MACnC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,aAAa,UAAU,YAAY,aAAa,UAAU,QAAQ,WAAW,GAAG;AAClF,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,aAAa,SAAS;AAAA,MAC7B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,aAAW,SAAS,CAAC,mBAAmB,kBAAkB,GAAY;AACpE,QAAI,IAAI,IAAI,aAAa,KAAK,CAAC,EAAE,SAAS,aAAa,KAAK,EAAE,QAAQ;AACpE,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,GAAG,KAAK;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,aAAa,oBAAI,IAAY;AACnC,aAAW,CAAC,OAAO,IAAI,KAAK,aAAa,aAAa,QAAQ,GAAG;AAC/D,QAAI,WAAW,IAAI,KAAK,EAAE,GAAG;AAC3B,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,IAAI;AAAA,QAClC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,eAAW,IAAI,KAAK,EAAE;AACtB,QAAI,KAAK,aAAa,iBAAiB,KAAK,UAAU;AACpD,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,UAAU;AAAA,QACxC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAgCI,IAAM,mBAAmB,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAQrD,IAAM,uBAAuB,EAAE,KAAK;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAID,IAAM,sBAAsB,EACzB,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EACpB,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAC5C,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA,EAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAClC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA,EAC/C,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,8BAA8B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAG5D,4BAA4B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjE,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EACtC,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EACtC,cAAc,0BAA0B,SAAS;AAAA,EACjD,SAAS,EAAE,MAAM,CAAC,oBAAoB,0BAA0B,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAG5E,kBAAkB,EAAE,MAAM,EAAE,SAAS;AAAA,EACrC,SAAS,EAAE,MAAM,EAAE,SAAS;AAC9B,CAAC,EACA,YAAY,CAAC,OAAO,QAAQ;AAC3B,MACE,MAAM,gBACN,MAAM,oBAAoB,UAC1B,MAAM,oBAAoB,MAAM,aAAa,UAAU,UACvD;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,gBACN,MAAM,oBAAoB,UAC1B,MAAM,oBAAoB,MAAM,aAAa,YAAY,UAAU,UACnE;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACF,CAAC;AAGH,IAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,MAAM,qBAAqB,QAAQ,SAAS;AAAA,EAC5C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,UAAU;AAAA;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,KAAK,iBAAiB,QAAQ,MAAM;AAAA,EACpC,SAAS,EAAE,OAAO,EAAE,IAAI;AAAA,EACxB,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC5B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC/B,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACxD,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC1D,yBAAyB,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC7D,0BAA0B,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAG9D,kBAAkB,EAAE,MAAM,EAAE,SAAS;AAAA,EACrC,SAAS,EAAE,MAAM,EAAE,SAAS;AAAA,EAC5B,QAAQ,EAAE,MAAM,mBAAmB,EAAE,IAAI,CAAC;AAC5C,CAAC;AAGM,IAAM,qCAAqC,EAAE,OAAO;AAAA,EACzD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,yBAAyB,EACtB,KAAK,CAAC,QAAQ,sBAAsB,qBAAqB,CAAC,EAC1D,QAAQ,MAAM;AACnB,CAAC;AA2DM,IAAM,6BAA6B;AACnC,IAAM,oCAAoC;AAC1C,IAAM,+BAA+B;AACrC,IAAM,gCAAgC;AACtC,IAAM,oCAAoC;AAC1C,IAAM,sCAAsC;AAC5C,IAAM,oCAAoC;AAE1C,IAAM,0BAA0B;AAChC,IAAM,8BAA8B;AACpC,IAAM,oCAAoC;AAC1C,IAAM,qCAAqC;AAG3C,IAAM,6BAA6B;AAAA,EACxC,kBAAkB;AAAA,IAChB,iBAAiB;AAAA,IACjB,gBAAgB,GAAG,iCAAiC;AAAA,IACpD,kBAAkB,GAAG,kCAAkC;AAAA,IACvD,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA,oBAAoB;AAAA,IAClB,iBAAiB;AAAA,IACjB,gBAAgB,GAAG,iCAAiC;AAAA,IACpD,kBAAkB,GAAG,kCAAkC;AAAA,IACvD,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA,sBAAsB;AAAA,IACpB,iBAAiB;AAAA,IACjB,gBAAgB,GAAG,iCAAiC;AAAA,IACpD,kBAAkB,GAAG,kCAAkC;AAAA,IACvD,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AACF;AAKO,SAAS,8BACd,SACqE;AACrE,aAAW,SAAS,OAAO,OAAO,0BAA0B,GAAG;AAC7D,QAAI,MAAM,mBAAmB,SAAS;AACpC,aAAO,EAAE,QAAQ,WAAW,iBAAiB,MAAM,gBAAgB;AAAA,IACrE;AACA,QAAI,MAAM,qBAAqB,SAAS;AACtC,aAAO,EAAE,QAAQ,aAAa,iBAAiB,MAAM,gBAAgB;AAAA,IACvE;AAAA,EACF;AACA,SAAO;AACT;AAEO,IAAM,0BAA0B;AAAA,EACrC,UAAU;AAAA,IACR,WAAW;AAAA,IACX,oBAAoB,GAAG,iCAAiC;AAAA,IACxD,iBAAiB;AAAA,IACjB,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,WAAW,CAAC,WAAW,UAAU,WAAW;AAAA,IAC5C,iBAAiB;AAAA,EACnB;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,oBAAoB,GAAG,iCAAiC;AAAA,IACxD,iBAAiB;AAAA,IACjB,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,WAAW,CAAC,WAAW,WAAW;AAAA,IAClC,iBAAiB;AAAA,EACnB;AACF;AAiBO,IAAM,sBAA8D;AAAA,EACzE,eAAe;AAAA,IACb,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA;AAAA,QAEE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,gBAAgB;AAAA,IACd,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,CAAC,wBAAwB,SAAS,SAAS,GAAG;AAAA,IAC5C,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,EACF;AAAA,EACA,CAAC,wBAAwB,KAAK,SAAS,GAAG;AAAA,IACxC,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,qCAAqC;AAAA,IACnC,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,EACF;AACF;AAqBO,IAAM,uBAGT;AAAA;AAAA,EAEF,QAAQ,CAAC;AAAA,EACT,OAAO,CAAC;AAAA,EACR,MAAM,CAAC;AAAA,EACP,OAAO;AAAA,IACL,EAAE,OAAO,gBAAgB,KAAK,0BAA0B;AAAA,IACxD,EAAE,OAAO,gBAAgB,KAAK,0BAA0B;AAAA,IACxD,EAAE,OAAO,oBAAoB,KAAK,8BAA8B;AAAA,EAClE;AAAA,EACA,SAAS,CAAC,EAAE,OAAO,iBAAiB,KAAK,2BAA2B,CAAC;AAAA,EACrE,SAAS,CAAC,EAAE,OAAO,iBAAiB,KAAK,2BAA2B,CAAC;AAAA,EACrE,KAAK,CAAC,EAAE,OAAO,aAAa,KAAK,uBAAuB,CAAC;AAAA,EACzD,QAAQ,CAAC,EAAE,OAAO,gBAAgB,KAAK,0BAA0B,CAAC;AAAA,EAClE,YAAY,CAAC,EAAE,OAAO,uBAAuB,KAAK,iCAAiC,CAAC;AAAA,EACpF,QAAQ;AAAA,IACN,EAAE,OAAO,eAAe,KAAK,wBAAwB;AAAA,IACrD,EAAE,OAAO,mBAAmB,KAAK,6BAA6B;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,YAAY,CAAC;AACf;AAGO,SAAS,6BAA6B,SAAmD;AAC9F,UAAQ,qBAAqB,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,MAAM,GAAG;AACvE;AAEA,SAAS,SAAS,MAAkC;AAClD,QAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,SAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AACpD;AAEO,SAAS,cAAwB;AACtC,QAAM,MAAM;AAAA,IACV,aAAa,SAAS,uBAAuB;AAAA,IAC7C,aAAa,SAAS,sBAAsB;AAAA,IAC5C,oBACE,SAAS,8BAA8B,KACvC,SAAS,gBAAgB,KACzB,SAAS,YAAY;AAAA,IACvB,eAAe,SAAS,yBAAyB;AAAA,IACjD,aAAa,SAAS,uBAAuB;AAAA,IAC7C,UAAU,SAAS,oBAAoB;AAAA,IACvC,aAAa,SAAS,uBAAuB;AAAA,IAC7C,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,SAAS,SAAS,mBAAmB;AAAA,IACrC,cAAc,SAAS,wBAAwB;AAAA,IAC/C,mBAAmB,SAAS,6BAA6B;AAAA,IACzD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,oCAAoC;AAAA,MAClC;AAAA,IACF;AAAA,IACA,oCAAoC,SAAS,iDAAiD;AAAA,IAC9F,mCAAmC,SAAS,iDAAiD;AAAA,IAC7F,gCAAgC,SAAS,4CAA4C;AAAA,IACrF,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,kCAAkC,SAAS,gDAAgD;AAAA,IAC3F,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,gCAAgC,SAAS,6CAA6C;AAAA,IACtF,iCAAiC,SAAS,+CAA+C;AAAA,IACzF,gCAAgC,SAAS,8CAA8C;AAAA,IACvF,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,2BACE,SAAS,sCAAsC,KAAK,SAAS,6BAA6B;AAAA,IAC5F,0BACE,SAAS,qCAAqC,KAAK,SAAS,4BAA4B;AAAA,IAC1F,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,eAAe,SAAS,0BAA0B;AAAA,IAClD,YAAY,SAAS,uBAAuB;AAAA,IAC5C,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,aAAa,SAAS,uBAAuB;AAAA,IAC7C,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,yBAAyB,SAAS,sCAAsC;AAAA,IACxE,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,qBAAqB,SAAS,+BAA+B;AAAA,IAC7D,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,wCAAwC;AAAA,MACtC;AAAA,IACF;AAAA,IACA,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,eAAe,SAAS,0BAA0B;AAAA,IAClD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,eAAe,SAAS,gCAAgC;AAAA,IACxD,mBAAmB,SAAS,oCAAoC;AAAA,IAChE,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,2BAA2B,SAAS,yCAAyC;AAAA,IAC7E,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,iCAAiC,SAAS,qCAAqC;AAAA,IAC/E,6BAA6B,SAAS,yCAAyC;AAAA,IAC/E,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,iCAAiC,SAAS,8CAA8C;AAAA,IACxF,cAAc,SAAS,wBAAwB;AAAA,IAC/C,WAAW,SAAS,qBAAqB;AAAA,IACzC,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,SAAS,SAAS,mBAAmB;AAAA,IACrC,SAAS,SAAS,mBAAmB;AAAA,IACrC,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,gBAAgB,SAAS,kBAAkB;AAAA,IAC3C,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,gBAAgB,SAAS,0BAA0B;AAAA,IACnD,cAAc,SAAS,yBAAyB,KAAK,SAAS,gBAAgB;AAAA,IAC9E,eAAe,SAAS,0BAA0B,KAAK,SAAS,iBAAiB;AAAA,IACjF,aAAa,SAAS,uBAAuB;AAAA,IAC7C,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,uBAAuB,SAAS,oCAAoC;AAAA,IACpE,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,uCAAuC;AAAA,MACrC;AAAA,IACF;AAAA,IACA,0CAA0C;AAAA,MACxC;AAAA,IACF;AAAA,IACA,oCAAoC,SAAS,iDAAiD;AAAA,IAC9F,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,0CAA0C;AAAA,MACxC;AAAA,IACF;AAAA,IACA,0CAA0C;AAAA,MACxC;AAAA,IACF;AAAA,IACA,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,uCAAuC;AAAA,MACrC;AAAA,IACF;AAAA,IACA,iCAAiC,SAAS,+CAA+C;AAAA,IACzF,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,yBAAyB,SAAS,sCAAsC;AAAA,IACxE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,uBAAuB,SAAS,oCAAoC;AAAA,IACpE,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,oCAAoC,SAAS,yCAAyC;AAAA,IACtF,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,8BAA8B,SAAS,yCAAyC;AAAA,IAChF,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,iCAAiC,SAAS,6CAA6C;AAAA,IACvF,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,oBAAoB,SAAS,gCAAgC;AAAA,IAC7D,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,oBAAoB,SAAS,gCAAgC;AAAA,IAC7D,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,gBAAgB,SAAS,0BAA0B;AAAA,IACnD,aAAa,SAAS,uBAAuB;AAAA,IAC7C,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,eAAe,SAAS,yBAAyB;AAAA,IACjD,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,cAAc,SAAS,yBAAyB;AAAA,IAChD,eAAe,SAAS,0BAA0B;AAAA,IAClD,cAAc,SAAS,yBAAyB;AAAA,IAChD,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,cAAc,SAAS,yBAAyB;AAAA,IAChD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,yBAAyB,SAAS,4BAA4B;AAAA,IAC9D,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,oBAAoB,SAAS,8BAA8B;AAAA,IAC3D,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,eAAe,SAAS,0BAA0B;AAAA,IAClD,eAAe,SAAS,0BAA0B;AAAA,IAClD,eAAe,SAAS,yBAAyB;AAAA,IACjD,cAAc,SAAS,wBAAwB;AAAA,IAC/C,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,iCAAiC,SAAS,+CAA+C;AAAA,IACzF,eAAe,SAAS,0BAA0B;AAAA,IAClD,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,eAAe,SAAS,yBAAyB;AAAA,IACjD,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,WAAW,SAAS,sBAAsB;AAAA,IAC1C,aAAa,SAAS,uBAAuB;AAAA,IAC7C,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,eAAe,SAAS,0BAA0B;AAAA,IAClD,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,cAAc,SAAS,yBAAyB;AAAA,IAChD,aAAa,SAAS,uBAAuB;AAAA,IAC7C,cAAc,SAAS,wBAAwB;AAAA,IAC/C,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,gCAAgC,SAAS,8CAA8C;AAAA,IACvF,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,WAAW,SAAS,qBAAqB;AAAA,IACzC,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,cAAc,SAAS,yBAAyB;AAAA,IAChD,gBAAgB,SAAS,0BAA0B;AAAA,IACnD,6BAA6B,SAAS,yCAAyC;AAAA,IAC/E,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,aAAa,SAAS,uBAAuB;AAAA,IAC7C,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,cAAc,SAAS,yBAAyB;AAAA,IAChD,eAAe,SAAS,yBAAyB;AAAA,IACjD,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,6BAA6B,SAAS,iCAAiC;AAAA,IACvE,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,kCAAkC,SAAS,+CAA+C;AAAA,IAC1F,kCAAkC,SAAS,+CAA+C;AAAA,IAC1F,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,gCAAgC,SAAS,6CAA6C;AAAA,IACtF,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,4BAA4B,SAAS,yCAAyC;AAAA,IAC9E,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,oBAAoB,SAAS,gCAAgC;AAAA,IAC7D,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,oCAAoC;AAAA,MAClC;AAAA,IACF;AAAA,IACA,mCAAmC,SAAS,iDAAiD;AAAA,IAC7F,4BAA4B,SAAS,uCAAuC;AAAA,IAC5E,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,oCAAoC,SAAS,iDAAiD;AAAA,IAC9F,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,iCAAiC,SAAS,8CAA8C;AAAA,IACxF,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,gBAAgB,SAAS,0BAA0B;AAAA,IACnD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,eAAe,SAAS,0BAA0B;AAAA,IAClD,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,aAAa,SAAS,wBAAwB;AAAA,IAC9C,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,eAAe,SAAS,0BAA0B;AAAA,IAClD,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,cAAc,SAAS,yBAAyB;AAAA,IAChD,WAAW,SAAS,qBAAqB;AAAA,IACzC,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,YAAY,gBAAgB,SAAS,sBAAsB,CAAC;AAAA,EAC9D;AACA,QAAM,SAAS,eAAe,MAAM,GAAG;AACvC,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH,oBACE,IAAI,uBAAuB,SACvB,KAAK,IAAI,KAAS,KAAK,MAAO,OAAO,sBAAsB,MAAQ,CAAC,CAAC,IACrE,OAAO;AAAA,IACb,uBACE,IAAI,0BAA0B,SAC1B,KAAK,IAAI,MAAW,KAAK,MAAO,OAAO,sBAAsB,MAAQ,CAAC,CAAC,IACvE,OAAO;AAAA,IACb,YAAY,wBAAwB,MAAM;AAAA,EAC5C;AACA,mBAAiB,QAAQ;AACzB,SAAO;AACT;AAEA,IAAM,sCAAsC;AAQrC,SAAS,kCAAkC,UAAwC;AACxF,QAAM,WAAW,SAAS,kBAAkB,KAAK;AACjD,MAAI,SAAU,QAAO;AACrB,QAAM,sBAAsB,SAAS,WAAW,KAAK;AACrD,MAAI,SAAS,sBAAsB,gBAAgB,SAAS,gBAAgB,qBAAqB;AAC/F,WAAO;AAAA,EACT;AACA,SAAO,SAAS,sBAAsB,YACnC,SAAS,gBAAgB,WAAW,SAAS,gBAAgB,UAC5D,sCACA;AACN;AAQO,SAAS,+BACd,UACyB;AACzB,QAAM,UAAU,SAAS,6BAA6B,CAAC,GAAG,0BAA0B;AACpF,QAAM,aAAa,IAAI,IAAI,OAAO;AAClC,QAAM,WAAW,SAAS,6BAA6B,CAAC,GAAG,6BAA6B;AACxF,SAAO;AAAA,IACL,SAAS,SAAS,OAAO,CAAC,SAAS,WAAW,IAAI,IAAI,CAAC;AAAA,IACvD,SAAS,CAAC,GAAG,OAAO;AAAA,EACtB;AACF;AAGO,SAAS,oCACd,UACA,UAC6B;AAC7B,QAAM,SAAS,+BAA+B,QAAQ;AACtD,QAAM,UAAU,IAAI,IAAI,OAAO,OAAO;AACtC,SAAO,CAAC,GAAI,YAAY,OAAO,OAAQ,EAAE,OAAO,CAAC,SAAS,QAAQ,IAAI,IAAI,CAAC;AAC7E;AAaO,SAAS,iCAAiC,UAA4B;AAC3E,SAAO,SAAS,2BAA2B,SAAS;AACtD;AAUO,SAAS,+BACd,UACQ;AACR,SAAO,KAAK;AAAA,IACV;AAAA,IACA,SAAS,2BAA2B;AAAA,EACtC;AACF;AAEO,SAAS,iCACd,UACQ;AACR,QAAM,mBAAmB,+BAA+B,QAAQ;AAChE,SAAO,KAAK;AAAA,IACV;AAAA,IACA,SAAS,6BACP,mBACA;AAAA,EACJ;AACF;AAEO,SAAS,0BACd,UACA,SAA4B,QAAQ,KACZ;AACxB,QAAM,MAA8B,CAAC;AACrC,aAAW,QAAQ,gCAAgC,QAAQ,GAAG;AAC5D,UAAM,QAAQ,OAAO,IAAI;AACzB,QAAI,OAAO;AACT,UAAI,IAAI,IAAI;AAAA,IACd;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,sBACd,UACA,SAA4B,QAAQ,KAChB;AACpB,MAAI,SAAS,QAAQ;AACnB,WAAO,SAAS;AAAA,EAClB;AACA,MAAI,SAAS,WAAW;AACtB,UAAM,QAAQ,OAAO,SAAS,SAAS;AACvC,WAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AAAA,EACpD;AACA,SAAO;AACT;AAEA,IAAM,kBAAkB;AACxB,IAAM,6BAA6B,oBAAI,IAAI;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,yBAAyB,IAAI;AAAA,EACjC,gBAAgB,QAAQ,IAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,KAAK,CAAC;AAChE;AACA,IAAM,iBAAiB,IAAI,IAAI,CAAC,QAAQ,SAAS,OAAO,EAAE,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AAC/F,IAAM,qBAAqB,IAAI;AAAA,EAC7B,CAAC,YAAY,YAAY,MAAM,EAAE,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,KAAK,CAAC;AACvE;AAEA,SAAS,yBAAyB,OAAe,YAA4B;AAC3E,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,UAAM,IAAI,MAAM,YAAY,UAAU,oCAAoC;AAAA,EAC5E;AACA,MAAI,IAAI,QAAQ;AACd,UAAM,IAAI;AAAA,MACR,YAAY,UAAU;AAAA,IACxB;AAAA,EACF;AACA,MAAI,IAAI,MAAM;AACZ,UAAM,IAAI,MAAM,YAAY,UAAU,sCAAsC;AAAA,EAC9E;AACA,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,6BAA6B,MAAuB;AAC3D,SAAO,KACJ,YAAY,EACZ,MAAM,QAAQ,EACd,KAAK,CAAC,SAAS,2BAA2B,IAAI,IAAI,CAAC;AACxD;AAEA,SAAS,mBACP,YACA,SACoC;AACpC,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,QAAM,aAAqC,CAAC;AAC5C,QAAM,kBAAkB,oBAAI,IAAoB;AAChD,aAAW,CAAC,SAAS,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AACtD,QAAI,CAAC,gBAAgB,KAAK,OAAO,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,oDAAoD,KAAK,UAAU,OAAO,CAAC;AAAA,MACnG;AAAA,IACF;AACA,UAAM,OAAO,QAAQ,YAAY;AACjC,UAAM,WAAW,gBAAgB,IAAI,IAAI;AACzC,QAAI,aAAa,QAAW;AAC1B,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,yBAAyB,KAAK,UAAU,QAAQ,CAAC,QAAQ,KAAK,UAAU,OAAO,CAAC;AAAA,MACxG;AAAA,IACF;AACA,QAAI,SAAS,iBAAiB;AAC5B,YAAM,IAAI;AAAA,QACR,YAAY,UAAU;AAAA,MACxB;AAAA,IACF;AACA,oBAAgB,IAAI,MAAM,OAAO;AACjC,eAAW,IAAI,IAAI;AAAA,EACrB;AACA,SAAO;AACT;AAEA,SAAS,2BACP,YACA,OACA,SACsB;AACtB,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,aAAuB,CAAC;AAC9B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,WAAW,OAAO;AAC3B,QAAI,CAAC,gBAAgB,KAAK,OAAO,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,8DAA8D,KAAK,UAAU,OAAO,CAAC;AAAA,MAC7G;AAAA,IACF;AACA,UAAM,OAAO,QAAQ,YAAY;AACjC,QAAI,KAAK,IAAI,IAAI,GAAG;AAClB,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,gEAAgE,KAAK,UAAU,IAAI,CAAC;AAAA,MAC5G;AAAA,IACF;AACA,QAAI,EAAE,SAAS,WAAW,CAAC,KAAK;AAC9B,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,kEAAkE,KAAK,UAAU,IAAI,CAAC;AAAA,MAC9G;AAAA,IACF;AACA,QAAI,6BAA6B,IAAI,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,kEAAkE,KAAK,UAAU,IAAI,CAAC;AAAA,MAC9G;AAAA,IACF;AACA,SAAK,IAAI,IAAI;AACb,eAAW,KAAK,IAAI;AAAA,EACtB;AACA,SAAO;AACT;AAEA,SAAS,kBACP,YACA,OACoC;AACpC,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,aAAW,QAAQ,OAAO,KAAK,KAAK,GAAG;AACrC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,YAAY,UAAU,sCAAsC;AAAA,IAC9E;AAAA,EACF;AACA,SAAO,EAAE,GAAG,MAAM;AACpB;AAEA,SAAS,0BACP,YACA,OACA,OACsB;AACtB,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,IAAI,IAAI,GAAG;AAClB,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,oDAAoD,KAAK,UAAU,IAAI,CAAC;AAAA,MAChG;AAAA,IACF;AACA,QAAI,EAAE,SAAS,SAAS,CAAC,KAAK;AAC5B,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,+DAA+D,KAAK,UAAU,IAAI,CAAC;AAAA,MAC3G;AAAA,IACF;AACA,QAAI,6BAA6B,IAAI,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,iEAAiE,KAAK,UAAU,IAAI,CAAC;AAAA,MAC7G;AAAA,IACF;AACA,SAAK,IAAI,IAAI;AAAA,EACf;AACA,SAAO,CAAC,GAAG,KAAK;AAClB;AAEA,SAAS,0BAA0B,UAA8C;AAC/E,QAAM,iBAAiB,mBAAmB,SAAS,IAAI,SAAS,cAAc;AAC9E,QAAM,eAAe,kBAAkB,SAAS,IAAI,SAAS,YAAY;AACzE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,yBAAyB,SAAS,SAAS,SAAS,EAAE;AAAA,IAC/D,GAAI,mBAAmB,SAAY,CAAC,IAAI,EAAE,eAAe;AAAA,IACzD,GAAI,iBAAiB,SAAY,CAAC,IAAI,EAAE,aAAa;AAAA,IACrD,GAAI,SAAS,6BAA6B,SACtC,CAAC,IACD;AAAA,MACE,0BAA0B;AAAA,QACxB,SAAS;AAAA,QACT,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,IACJ,GAAI,SAAS,4BAA4B,SACrC,CAAC,IACD;AAAA,MACE,yBAAyB;AAAA,QACvB,SAAS;AAAA,QACT,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACN;AACF;AAEA,SAAS,8BACP,SACwB;AACxB,SAAO,aAAa,UAAU,UAAU,EAAE,SAAS,QAAQ;AAC7D;AAEA,SAAS,sBAAsB,cAAwD;AACrF,QAAM,SAAS,0BAA0B,MAAM,YAAY;AAC3D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW;AAAA,MACT,GAAG,OAAO;AAAA,MACV,SAAS,CAAC,GAAG,OAAO,UAAU,OAAO,EAAE;AAAA,QACrC,CAAC,MAAM,WACJ,uBAAuB,IAAI,IAAI,KAAK,MAAM,uBAAuB,IAAI,KAAK,KAAK;AAAA,MACpF;AAAA,IACF;AAAA,IACA,iBAAiB,CAAC,GAAG,OAAO,eAAe,EAAE;AAAA,MAC3C,CAAC,MAAM,WAAW,eAAe,IAAI,IAAI,KAAK,MAAM,eAAe,IAAI,KAAK,KAAK;AAAA,IACnF;AAAA,IACA,qBAAqB,CAAC,GAAG,IAAI,IAAI,OAAO,mBAAmB,CAAC,EAAE,KAAK;AAAA,IACnE,kBAAkB,CAAC,GAAG,OAAO,gBAAgB,EAAE;AAAA,MAC7C,CAAC,MAAM,WAAW,eAAe,IAAI,IAAI,KAAK,MAAM,eAAe,IAAI,KAAK,KAAK;AAAA,IACnF;AAAA,IACA,cAAc,CAAC,GAAG,OAAO,YAAY,EAAE;AAAA,MACrC,CAAC,MAAM,WACJ,mBAAmB,IAAI,KAAK,EAAE,KAAK,MAAM,mBAAmB,IAAI,MAAM,EAAE,KAAK;AAAA,IAClF;AAAA,EACF;AACF;AAEA,SAAS,wBACP,UACA,OAMqB;AACrB,QAAM,mBAAmB,MAAM,kBAAkB,kCAAkC,QAAQ,IAAI,CAAC;AAChG,SAAO,sBAAsB;AAAA,IAC3B,WAAW;AAAA,MACT,UAAU,MAAM,kBAAkB,cAAc;AAAA,MAChD,UAAU,MAAM;AAAA,MAChB,SAAS;AAAA,MACT,eAAe,MAAM,kBAAkB,SAAS,wBAAwB;AAAA,MACxE,UAAU;AAAA,IACZ;AAAA,IACA,iBAAiB,EAAE,UAAU,WAAW,UAAU,KAAK;AAAA,IACvD,kBAAkB,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,IACzD,aAAa;AAAA,MACX,WAAW;AAAA,QACT,UAAU,MAAM,kBAAkB,cAAc;AAAA,QAChD,UAAU,MAAM;AAAA,MAClB;AAAA,MACA,SAAS,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MAChD,eAAe,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MACtD,iBAAiB;AAAA,QACf,UAAU,MAAM,wBAAwB,cAAc;AAAA,QACtD,UAAU,MAAM,yBAAyB;AAAA,MAC3C;AAAA,IACF;AAAA,IACA,iBAAiB,MAAM,SAAS,CAAC,QAAQ,OAAO,IAAI,CAAC,MAAM;AAAA,IAC3D,qBAAqB;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,kBAAkB,CAAC,MAAM;AAAA,IACzB,YAAY;AAAA,MACV,KAAK,EAAE,UAAU,WAAW,UAAU,KAAK;AAAA,MAC3C,oBAAoB,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MAC3D,eAAe,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,IACxD;AAAA,IACA,cAAc,CAAC,EAAE,IAAI,YAAY,UAAU,WAAW,UAAU,KAAK,CAAC;AAAA,EACxE,CAAC;AACH;AAEO,SAAS,qCACd,iBACkC;AAClC,QAAM,QAAQ,OAAO,OAAO,uBAAuB,EAAE;AAAA,IACnD,CAAC,cAAc,UAAU,oBAAoB;AAAA,EAC/C;AACA,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,SAAS;AAAA,MACP,MAAM,CAAC,GAAG,MAAM,SAAS;AAAA,MACzB,SAAS,MAAM,kBAAkB,SAAS;AAAA,IAC5C;AAAA,EACF;AACF;AAEA,SAAS,yBACP,UACA,OACqB;AACrB,QAAM,SAAS,wBAAwB,UAAU;AAAA,IAC/C,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,EACnB,CAAC;AACD,SAAO,sBAAsB;AAAA,IAC3B,GAAG;AAAA,IACH,iBAAiB,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,IACzD,iBAAiB,MAAM,SAAS,CAAC,QAAQ,OAAO,IAAI,CAAC,MAAM;AAAA,IAC3D,qBAAqB,MAAM,uBAAuB,CAAC;AAAA,IACnD,YAAY;AAAA,MACV,GAAG,OAAO;AAAA,MACV,KAAK,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,IAC/C;AAAA,IACA,eAAe,MAAM,kBACjB,EAAE,UAAU,aAAa,UAAU,MAAM,MAAM,WAAW,IAC1D,EAAE,UAAU,eAAe,UAAU,OAAO,MAAM,OAAO;AAAA;AAAA;AAAA,IAG7D,cAAc,CAAC,EAAE,IAAI,YAAY,UAAU,aAAa,UAAU,KAAK,CAAC;AAAA,EAC1E,CAAC;AACH;AAEA,SAAS,wBACP,UACA,OAGkB;AAClB,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,SAAS,CAAC,wBAAwB,UAAU,wBAAwB,IAAI,EAAE,IAAI,CAAC,UAAU;AAC7F,UAAM,OAAO,UAAU,wBAAwB;AAC/C,WAAO;AAAA,MACL,IAAI,YAAY,MAAM,qBAAqB,MAAM;AAAA,MACjD,iBAAiB,MAAM;AAAA,MACvB,OAAO,MAAM;AAAA,MACb,YAAY,MAAM;AAAA,MAClB,cAAc,yBAAyB,UAAU;AAAA,QAC/C,iBAAiB,MAAM;AAAA,QACvB,QAAQ;AAAA,QACR,qBAAqB,OAAO,CAAC,iBAAiB,IAAI,CAAC;AAAA,MACrD,CAAC;AAAA,MACD,qBAAqB;AAAA,MACrB,8BAA8B;AAAA,MAC9B,uBAAuB;AAAA,MACvB,4BAA4B,SAAS;AAAA,IACvC;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,IAAI,YAAY,gCAAgC;AAAA,IAChD,OAAO,YAAY,iBAAiB;AAAA;AAAA;AAAA;AAAA,IAIpC,KAAK;AAAA,IACL,SAAS;AAAA,IACT,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC/C;AAAA,EACF;AACF;AAEA,SAAS,4BAA4B,UAAwC;AAC3E,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,MAAI,CAAC,SAAS,uBAAuB;AACnC,WAAO;AAAA,EACT;AACA,MAAI,UAAU,KAAK,CAAC,aAAa,SAAS,OAAO,4BAA4B,GAAG;AAC9E,UAAM,IAAI;AAAA,MACR,GAAG,4BAA4B;AAAA,IACjC;AAAA,EACF;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,wBAAwB,UAAU;AAAA,MAChC,MAAM;AAAA,MACN,QAAQ,SAAS;AAAA,IACnB,CAAC;AAAA,EACH;AACF;AAGO,SAAS,oCAAoC,UAA8B;AAChF,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,MAAI,UAAU,KAAK,CAAC,aAAa,SAAS,OAAO,6BAA6B,GAAG;AAC/E,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB,KAAK,UAAU;AAAA,MACjC,GAAG;AAAA,MACH,wBAAwB,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAAA,IACxE,CAAC;AAAA,EACH;AACF;AAGO,SAAS,+BAA+B,UAAoB,QAA0B;AAC3F,MAAI,CAAC,OAAO,KAAK,GAAG;AAClB,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,QAAM,kBAAkB,oCAAoC,QAAQ;AACpE,QAAM,YAAY,wBAAwB,gBAAgB,kBAAkB,EAAE;AAAA,IAAI,CAAC,aACjF,SAAS,OAAO,gCAAgC,EAAE,GAAG,UAAU,OAAO,IAAI;AAAA,EAC5E;AACA,SAAO,EAAE,GAAG,iBAAiB,oBAAoB,KAAK,UAAU,SAAS,EAAE;AAC7E;AAGA,IAAM,oCAAoC;AAQnC,SAAS,uBAAuB,SAAyB;AAC9D,QAAM,OAAO,QAAQ,WAAW,qBAAqB,IACjD,QAAQ,MAAM,sBAAsB,MAAM,IAC1C;AACJ,QAAM,YAAY,0BAA0B,KAAK,IAAI;AACrD,MAAI,WAAW;AACb,WAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,EAC7B;AACA,QAAM,QAAQ,mCAAmC,KAAK,IAAI;AAC1D,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,SAAS,MAAM,CAAC,EAAG,QAAQ,SAAS,KAAK;AAC/C,QAAM,OAAO,MAAM,CAAC;AACpB,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KACZ,MAAM,GAAG,EACT,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,EAChC,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,YAAY,IAAI,KAAK,MAAM,CAAC,EAAE,YAAY,CAAC,EACxE,KAAK,GAAG;AACX,SAAO,OAAO,SAAS,IAAI,GAAG,MAAM,IAAI,MAAM,KAAK;AACrD;AAMO,SAAS,4BAA4B,SAAgC;AAC1E,QAAM,OAAO,QAAQ,WAAW,qBAAqB,IACjD,QAAQ,MAAM,sBAAsB,MAAM,IAC1C;AACJ,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,4BAA4B,SAKlC;AACD,MACE,YAAY,iBACZ,YAAY,mBACZ,YAAY,kBACZ,QAAQ,WAAW,gBAAgB,GACnC;AACA,WAAO;AAAA,MACL,EAAE,IAAI,YAAY,UAAU,aAAa,UAAU,KAAK;AAAA,MACxD;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,UAAU;AAAA,QACV,sBAAsB;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AACA,SAAO,CAAC,EAAE,IAAI,YAAY,UAAU,WAAW,UAAU,KAAK,CAAC;AACjE;AAEA,SAAS,6BACP,SAC+D;AAC/D,QAAM,OAAO,QAAQ,WAAW,qBAAqB,IACjD,QAAQ,MAAM,sBAAsB,MAAM,IAC1C;AACJ,SAAO,KAAK,WAAW,UAAU,IAC7B,EAAE,UAAU,aAAa,UAAU,MAAM,MAAM,WAAW,IAC1D;AACN;AAGA,SAAS,qCAAqC,UAAoB,SAA0B;AAC1F,SACE,SAAS,mBAAmB,YAC5B,yBAAyB,SAAS,aAAa,KAC/C,CAAC,eAAe,iBAAiB,cAAc,EAAE,SAAS,OAAO;AAErE;AAGO,SAAS,yBAAyB,SAAsC;AAC7E,MAAI,YAAY,OAAW,QAAO;AAClC,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,OAAO;AAC9B,WACE,OAAO,aAAa,YACpB,OAAO,aAAa,oBACpB,OAAO,SAAS,MAChB,OAAO,aAAa,MACpB,OAAO,aAAa,MACpB,OAAO,WAAW,MAClB,OAAO,SAAS,MAChB,OAAO,SAAS,QAAQ,QAAQ,EAAE,MAAM;AAAA,EAE5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,0BACd,YACA,aACiC;AACjC,MAAI,gBAAgB,YAAY;AAC9B,WAAO;AAAA,EACT;AACA,MACE,eAAe,WACf,eAAe,qBACf,eAAe,8BACf;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,6BACd,WACA,qBACS;AACT,MAAI,cAAc,YAAY;AAC5B,WAAO;AAAA,EACT;AACA,SAAO,wBAAwB,cAAc,wBAAwB;AACvE;AAEO,SAAS,6BAA6B,UAAoB,SAAgC;AAC/F,QAAM,WAAW;AAAA,IACf,+BAA+B,UAAU,OAAO;AAAA,IAChD,8BAA8B,UAAU,OAAO;AAAA,EACjD;AACA,MAAI,CAAC,UAAU;AACb,WAAO,CAAC,UAAU;AAAA,EACpB;AACA,SAAO,SAAS,MAAM,aAAa,aAChC,OAAO,CAAC,SAAS,KAAK,QAAQ,EAC9B,IAAI,CAAC,SAAS,YAAY,MAAM,KAAK,EAAE,CAAC;AAC7C;AAEA,SAAS,0BACP,UACA,SACA,aACM;AACN,QAAM,WAAW,6BAA6B,UAAU,OAAO;AAC/D,MAAI,CAAC,SAAS,SAAS,WAAW,GAAG;AACnC,UAAM,IAAI;AAAA,MACR,gBAAgB,WAAW,8BAA8B,OAAO,cAAc,SAAS,KAAK,IAAI,CAAC;AAAA,IACnG;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,UAAgD;AAChF,MAAI,SAAS,SAAS,sBAAsB;AAC1C,WAAO,EAAE,MAAM,0BAA0B,UAAU,QAAQ;AAAA,EAC7D;AACA,MAAI,SAAS,SAAS,oBAAoB;AACxC,WAAO,EAAE,MAAM,0BAA0B,UAAU,MAAM;AAAA,EAC3D;AACA,MAAI,SAAS,SAAS,4BAA4B;AAChD,WAAO,EAAE,MAAM,wBAAwB,WAAW,UAAU;AAAA,EAC9D;AACA,SAAO,EAAE,MAAM,cAAc,WAAW,UAAU;AACpD;AAEA,SAAS,gBAAgB,UAAkD;AACzE,MAAI,SAAS,SAAS,wBAAwB,SAAS,SAAS,oBAAoB;AAClF,WAAO,EAAE,eAAe,0BAA0B,UAAU,WAAW;AAAA,EACzE;AACA,MAAI,SAAS,SAAS,4BAA4B;AAChD,WAAO,EAAE,eAAe,aAAa,UAAU,WAAW;AAAA,EAC5D;AACA,SAAO,EAAE,eAAe,cAAc,UAAU,mBAAmB;AACrE;AAEA,SAAS,wBAAwB,UAAwC;AACvE,MAAI,SAAS,mBAAmB,WAAW,CAAC,SAAS,mBAAmB;AACtE,WAAO,EAAE,MAAM,cAAc,WAAW,kBAAkB;AAAA,EAC5D;AACA,SAAO,EAAE,MAAM,cAAc,WAAW,UAAU;AACpD;AAEA,SAAS,+BAA+B,UAWtC;AACA,QAAM,gBAAgB,IAAI,IAAI,SAAS,4BAA4B,CAAC,CAAC;AACrE,QAAM,cAAc,IAAI,IAAI,SAAS,2BAA2B,CAAC,CAAC;AAClE,SAAO;AAAA,IACL,SAAS,OAAO,QAAQ,SAAS,kBAAkB,CAAC,CAAC,EAClD,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD;AAAA,MAAI,CAAC,CAAC,MAAM,KAAK,MAChB,cAAc,IAAI,IAAI,IAClB,EAAE,MAAM,gBAAgB,UAAmB,MAAM,IACjD,EAAE,MAAM,gBAAgB,SAAkB;AAAA,IAChD;AAAA,IACF,OAAO,OAAO,QAAQ,SAAS,gBAAgB,CAAC,CAAC,EAC9C,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD;AAAA,MAAI,CAAC,CAAC,MAAM,KAAK,MAChB,YAAY,IAAI,IAAI,IAChB,EAAE,MAAM,gBAAgB,UAAmB,MAAM,IACjD,EAAE,MAAM,gBAAgB,SAAkB;AAAA,IAChD;AAAA,EACJ;AACF;AAEA,SAAS,cAAc,OAAwB;AAC7C,QAAM,YAAY,CAAC,UAA4B;AAC7C,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,aAAO,MAAM,IAAI,CAAC,UAAU,UAAU,KAAK,CAAC;AAAA,IAC9C;AACA,QAAI,SAAS,OAAO,UAAU,UAAU;AACtC,YAAM,MAA+B,CAAC;AACtC,iBAAW,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK,GAAG;AAC3C,cAAM,QAAS,MAAkC,GAAG;AACpD,YAAI,UAAU,QAAW;AACvB,cAAI,GAAG,IAAI,UAAU,KAAK;AAAA,QAC5B;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,UAAU,UAAU,KAAK,CAAC;AACxC;AAEA,SAAS,qBACP,OACA,UACQ;AACR,QAAM,kBAAkB,+BAA+B,QAAQ;AAC/D,QAAM,cAAc,cAAc;AAAA,IAChC,eAAe,MAAM;AAAA,IACrB,IAAI,MAAM;AAAA,IACV,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM;AAAA,IAClB,UAAU;AAAA,MACR,aAAa,SAAS;AAAA,MACtB,SAAS,SAAS;AAAA,MAClB,SAAS,SAAS,WAAW;AAAA,MAC7B,gBAAgB,gBAAgB;AAAA,MAChC,cAAc,gBAAgB;AAAA,IAChC;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB,SAAS,MAAM;AAAA,IACf,iBAAiB,MAAM;AAAA,IACvB,cAAc,MAAM;AAAA,IACpB,GAAI,MAAM,gBAAgB,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,IACpE,SAAS,MAAM,WAAW;AAAA,EAC5B,CAAC;AACD,SAAO,UAAU,WAAW,QAAQ,EACjC,OAAO,kCAAkC,MAAM,EAC/C,OAAO,aAAa,MAAM,EAC1B,OAAO,KAAK,CAAC;AAClB;AASO,SAAS,kBAAkB,UAAoD;AACpF,SAAO,SAAS,mBAAmB,UAAU,UAAU;AACzD;AAEA,SAAS,qBAAqB,UAAoD;AAChF,SAAO,SAAS,mBAAmB,UAAU,iBAAiB;AAChE;AAUO,SAAS,oBAAoB,UAA6C;AAC/E,QAAM,mBAAmB,wBAAwB,QAAQ;AACzD,QAAM,UAAiC;AAAA,IACrC,IAAI,kBAAkB,QAAQ;AAAA,IAC9B,OAAO,qBAAqB,QAAQ;AAAA,IACpC,MAAM;AAAA,IACN,KAAK;AAAA,IACL,SAAS;AAAA,IACT;AAAA,IACA,SAAS,EAAE,eAAe,cAAc,UAAU,mBAAmB;AAAA,EACvE;AACA,MAAI,SAAS,mBAAmB,SAAS;AACvC,UAAM,UAAU,SAAS,sBAAsB,SAAS;AACxD,YAAQ,UAAU,UAAU,yBAAyB,SAAS,QAAQ,EAAE,IAAI;AAC5E,YAAQ,SAAS,SAAS,qBAAqB,SAAS;AAAA,EAC1D,OAAO;AACL,YAAQ,UAAU,SAAS,gBACvB,yBAAyB,SAAS,eAAe,QAAQ,EAAE,IAC3D;AACJ,YAAQ,SAAS,SAAS;AAAA,EAC5B;AACA,QAAM,WAAW,4BAA4B,QAAQ,EAAE;AAAA,IACrD,CAAC,cAAqC;AAAA,MACpC,IAAI,SAAS;AAAA,MACb,OAAO,SAAS,SAAS,SAAS;AAAA,MAClC,MAAM,SAAS;AAAA,MACf,KAAK,SAAS;AAAA,MACd,SAAS;AAAA,MACT,SAAS,SAAS;AAAA,MAClB,QAAQ,sBAAsB,QAAQ;AAAA,MACtC,cAAc,SAAS;AAAA,MACvB,gBAAgB,SAAS;AAAA,MACzB,yBAAyB,SAAS;AAAA,MAClC,0BAA0B,SAAS;AAAA,MACnC,kBAAkB,yBAAyB,QAAQ;AAAA,MACnD,SAAS,gBAAgB,QAAQ;AAAA,IACnC;AAAA,EACF;AACA,SAAO,CAAC,SAAS,GAAG,QAAQ;AAC9B;AAQO,SAAS,yBAAyB,UAA8B;AACrE,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,MAAI,UAAU,KAAK,CAACC,cAAaA,UAAS,OAAO,iBAAiB,GAAG;AACnE,WAAO;AAAA,EACT;AACA,QAAM,WAA6B;AAAA,IACjC,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,KAAK;AAAA,IACL,SAAS;AAAA,IACT,QAAQ,2BAA2B,IAAI,CAAC,SAAS;AAC/C,YAAM,eAAe;AAAA,QACnB,GAAG,wBAAwB,UAAU;AAAA,UACnC,iBAAiB;AAAA,UACjB,iBAAiB;AAAA,UACjB,QAAQ,KAAK,WAAW,UAAU;AAAA,QACpC,CAAC;AAAA,QACD,GAAI,6BAA6B,GAAG,qBAAqB,GAAG,IAAI,EAAE,IAC9D;AAAA,UACE,eAAe,6BAA6B,GAAG,qBAAqB,GAAG,IAAI,EAAE;AAAA,QAC/E,IACA,CAAC;AAAA,QACL,cAAc,4BAA4B,GAAG,qBAAqB,GAAG,IAAI,EAAE;AAAA,MAC7E;AACA,aAAO;AAAA,QACL,IAAI,GAAG,qBAAqB,GAAG,IAAI;AAAA,QACnC,iBAAiB;AAAA,QACjB,OAAO,uBAAuB,IAAI;AAAA,QAClC,GAAI,4BAA4B,IAAI,IAChC,EAAE,YAAY,4BAA4B,IAAI,EAAG,IACjD,CAAC;AAAA,QACL,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA,QAKjB,iBAAiB;AAAA,QACjB;AAAA,QACA,qBAAqB;AAAA,QACrB,8BAA8B;AAAA,QAC9B,uBAAuB;AAAA,QACvB,4BAA4B;AAAA,MAC9B;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB,KAAK,UAAU,CAAC,GAAG,WAAW,QAAQ,CAAC;AAAA,EAC7D;AACF;AAOO,SAAS,mCAAmC,UAA8B;AAC/E,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,MAAI,UAAU,KAAK,CAACA,cAAaA,UAAS,OAAO,4BAA4B,GAAG;AAC9E,WAAO;AAAA,EACT;AACA,QAAM,WAA6B;AAAA,IACjC,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,KAAK;AAAA,IACL,SAAS;AAAA,IACT,QAAQ,6BAA6B,IAAI,CAAC,SAAS;AACjD,YAAM,eAAe,wBAAwB,UAAU;AAAA,QACrD,iBAAiB;AAAA,QACjB,iBAAiB;AAAA,MACnB,CAAC;AACD,mBAAa,UAAU,UAAU,CAAC,OAAO,UAAU,QAAQ,OAAO;AAClE,mBAAa,UAAU,gBAAgB;AACvC,mBAAa,eAAe;AAAA,QAC1B,EAAE,IAAI,YAAY,UAAU,aAAa,UAAU,KAAK;AAAA,QACxD,EAAE,IAAI,QAAQ,UAAU,aAAa,UAAU,KAAK;AAAA,MACtD;AACA,mBAAa,YAAY,UAAU,EAAE,UAAU,aAAa,UAAU,KAAK;AAC3E,mBAAa,YAAY,kBAAkB,EAAE,UAAU,aAAa,UAAU,KAAK;AACnF,aAAO;AAAA,QACL,IAAI,GAAG,gCAAgC,GAAG,IAAI;AAAA,QAC9C,iBAAiB;AAAA,QACjB,OAAO,uBAAuB,IAAI;AAAA,QAClC,GAAI,4BAA4B,IAAI,IAChC,EAAE,YAAY,4BAA4B,IAAI,EAAG,IACjD,CAAC;AAAA,QACL,iBAAiB;AAAA,QACjB,iBAAiB;AAAA,QACjB;AAAA,QACA,qBAAqB;AAAA,QACrB,8BAA8B;AAAA,QAC9B,uBAAuB;AAAA,QACvB,4BAA4B,SAAS;AAAA,MACvC;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,EAAE,GAAG,UAAU,oBAAoB,KAAK,UAAU,CAAC,GAAG,WAAW,QAAQ,CAAC,EAAE;AACrF;AAeO,SAAS,yBAAyB,UAAoB,SAAyB;AACpF,QAAM,mBAAmB,8BAA8B,UAAU,OAAO;AACxE,MAAI,iBAAiB,WAAW,qBAAqB,GAAG;AACtD,WAAO;AAAA,EACT;AACA,MAAI,iBAAiB,WAAW,gCAAgC,GAAG;AACjE,WAAO;AAAA,EACT;AACA,MAAI,iBAAiB,WAAW,iCAAiC,GAAG;AAClE,WAAO;AAAA,EACT;AACA,QAAM,aAAa,iBAAiB,QAAQ,EAAE,KAAK,CAAC,UAAU,MAAM,OAAO,gBAAgB;AAC3F,SAAO,YAAY,cAAc,kBAAkB,QAAQ;AAC7D;AAEA,SAAS,wBACP,UACA,OAMwB;AACxB,SAAO;AAAA,IACL,qBAAqB,MAAM,uBAAuB,SAAS;AAAA,IAC3D,8BACE,MAAM,gCAAgC,SAAS,gCAAgC;AAAA,IACjF,uBACE,MAAM,yBAAyB,SAAS,qCAAqC;AAAA,IAC/E,4BACE,MAAM,8BAA8B,SAAS,mCAAmC;AAAA,EACpF;AACF;AAEA,SAAS,wBACP,UACA,UACA,OACiB;AACjB,QAAM,gBACJ,SAAS,SAAS,4BAA4B,SAAS,SAAS,6BAC5D,qCAAqC,MAAM,eAAe,IAC1D;AACN,QAAM,sBAAkE;AAAA,IACtE,eAAe;AAAA,IACf,GAAG;AAAA,IACH,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA,IACzC,iBAAiB,wBAAwB,UAAU,KAAK;AAAA,EAC1D;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,mBAAmB,qBAAqB,qBAAqB,QAAQ;AAAA,EACvE;AACF;AAEA,SAAS,4BAA4B,QAAiC;AACpE,QAAM,kBAAkB,oBAAI,IAAoB;AAChD,aAAW,SAAS,QAAQ;AAC1B,UAAM,WAAW,gBAAgB,IAAI,MAAM,EAAE;AAC7C,QAAI,aAAa,QAAW;AAC1B,YAAM,IAAI;AAAA,QACR,0CAA0C,KAAK,UAAU,MAAM,EAAE,CAAC,wBAAwB,QAAQ,QAAQ,MAAM,UAAU;AAAA,MAC5H;AAAA,IACF;AACA,oBAAgB,IAAI,MAAM,IAAI,MAAM,UAAU;AAAA,EAChD;AAEA,QAAM,iBAAiB,IAAI,IAAI,eAAe;AAC9C,aAAW,SAAS,QAAQ;AAC1B,UAAM,aAAa,oBAAI,IAAY;AACnC,eAAW,SAAS,MAAM,SAAS;AACjC,UAAI,WAAW,IAAI,KAAK,GAAG;AACzB,cAAM,IAAI;AAAA,UACR,uCAAuC,KAAK,UAAU,MAAM,EAAE,CAAC,6BAA6B,KAAK,UAAU,KAAK,CAAC;AAAA,QACnH;AAAA,MACF;AACA,iBAAW,IAAI,KAAK;AACpB,YAAM,WAAW,eAAe,IAAI,KAAK;AACzC,UAAI,aAAa,QAAW;AAC1B,cAAM,IAAI;AAAA,UACR,uCAAuC,KAAK,UAAU,KAAK,CAAC,cAAc,KAAK,UAAU,MAAM,EAAE,CAAC,iCAAiC,QAAQ;AAAA,QAC7I;AAAA,MACF;AACA,qBAAe,IAAI,OAAO,MAAM,EAAE;AAAA,IACpC;AAAA,EACF;AACF;AAUO,SAAS,iBAAiB,UAAuC;AACtE,QAAM,YAAY,kBAAkB,QAAQ;AAC5C,QAAM,eAAe,qBAAqB,QAAQ;AAClD,QAAM,YAAY,oBAAoB,QAAQ;AAC9C,QAAM,eAAe,IAAI,IAAI,UAAU,IAAI,CAAC,aAAa,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;AACjF,QAAM,mBAAmB,gCAAgC,QAAQ;AAiBjE,QAAM,iBAAiB,4BAA4B,QAAQ;AAC3D,QAAM,mBAAmB,IAAI;AAAA,IAC3B,eAAe,QAAQ,CAAC,aAAa,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC;AAAA,EAC/E;AACA,QAAM,kBAAkB,IAAI;AAAA,IAC1B,eAAe,QAAQ,CAAC,aAAa,SAAS,OAAO,QAAQ,CAAC,UAAU,MAAM,WAAW,CAAC,CAAC,CAAC;AAAA,EAC9F;AACA,QAAM,uBAAuB,CAAC,OAC5B,GAAG,WAAW,qBAAqB,KACnC,GAAG,WAAW,gCAAgC,KAC9C,gBAAgB,IAAI,EAAE,KACrB,GAAG,SAAS,GAAG,KAAK,iBAAiB,IAAI,EAAE;AAC9C,QAAM,kBAAkB,aAAa,IAAI,SAAS;AAClD,MAAI,CAAC,iBAAiB;AACpB,UAAM,IAAI,MAAM,2BAA2B,SAAS,oBAAoB;AAAA,EAC1E;AACA,QAAM,MAAyB,aAAa;AAAA,IAC1C,SAAS;AAAA,IACT,GAAG,SAAS,SAAS,mBAAmB;AAAA,EAC1C,CAAC,EACE,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,EACxC,IAAI,CAAC,OAAO;AACX,UAAM,eAAe;AAAA,MACnB,GAAG,wBAAwB,UAAU;AAAA,QACnC,iBAAiB;AAAA,QACjB,iBAAiB,SAAS;AAAA,QAC1B,uBAAuB,qCAAqC,UAAU,EAAE;AAAA,QACxE,QAAQ,GAAG,WAAW,UAAU;AAAA,MAClC,CAAC;AAAA,MACD,GAAI,6BAA6B,EAAE,IAC/B,EAAE,eAAe,6BAA6B,EAAE,EAAG,IACnD,CAAC;AAAA,MACL,cAAc,4BAA4B,EAAE;AAAA,IAC9C;AACA,WAAO,wBAAwB,UAAU,iBAAiB;AAAA,MACxD;AAAA,MACA,SAAS,CAAC;AAAA,MACV,OAAO,uBAAuB,EAAE;AAAA,MAChC,GAAI,4BAA4B,EAAE,IAC9B,EAAE,YAAY,4BAA4B,EAAE,EAAG,IAC/C,CAAC;AAAA,MACL,YAAY;AAAA,MACZ,eAAe;AAAA,MACf,KAAK;AAAA,MACL,iBAAiB;AAAA,MACjB,YAAY,EAAE,iBAAiB,IAAI,SAAS,YAAY;AAAA,MACxD,kBAAkB,gBAAgB;AAAA,MAClC,SAAS,gBAAgB;AAAA,MACzB;AAAA,MACA,GAAI,iBAAiB,EAAE,MAAM,SAAY,CAAC,IAAI,EAAE,SAAS,iBAAiB,EAAE,EAAE;AAAA,MAC9E,qBAAqB,SAAS;AAAA,MAC9B,4BAA4B,SAAS;AAAA,MACrC,iBAAiB,aAAa,UAAU;AAAA,MACxC,iBAAiB,aAAa,YAAY,UAAU;AAAA,IACtD,CAAC;AAAA,EACH,CAAC;AACH,aAAW,YAAY,gBAAgB;AACrC,UAAM,gBAAgB,SAAS,SAAS,SAAS;AACjD,UAAM,mBAAmB,aAAa,IAAI,SAAS,EAAE;AACrD,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,MAAM,2BAA2B,SAAS,EAAE,oBAAoB;AAAA,IAC5E;AACA,eAAW,SAAS,SAAS,QAAQ;AACnC,YAAM,eAAe,MAAM,eACvB,sBAAsB,MAAM,YAAY,IACxC,wBAAwB,UAAU;AAAA,QAChC,iBAAiB,MAAM,mBAAmB;AAAA,QAC1C,iBAAiB,MAAM,mBAAmB;AAAA,MAC5C,CAAC;AACL,YAAM,kBAAkB,MAAM,mBAAmB,MAAM;AACvD,UAAI;AAAA,QACF,wBAAwB,UAAU,kBAAkB;AAAA,UAClD,IAAI,MAAM;AAAA,UACV,SAAS,CAAC,GAAI,MAAM,WAAW,CAAC,CAAE;AAAA,UAClC,OAAO,MAAM,SAAS,uBAAuB,MAAM,EAAE;AAAA,UACrD,GAAI,MAAM,aACN,EAAE,YAAY,MAAM,WAAW,IAC/B,4BAA4B,MAAM,EAAE,IAClC,EAAE,YAAY,4BAA4B,MAAM,EAAE,EAAG,IACrD,CAAC;AAAA,UACP,YAAY,SAAS;AAAA,UACrB;AAAA,UACA,KAAK,SAAS;AAAA,UACd;AAAA,UACA,YAAY,EAAE,iBAAiB,SAAS,SAAS,IAAI;AAAA,UACrD,kBAAkB,iBAAiB;AAAA,UACnC,SAAS,iBAAiB;AAAA,UAC1B;AAAA,UACA,GAAI,iBAAiB,MAAM,EAAE,MAAM,SAC/B,CAAC,IACD,EAAE,SAAS,iBAAiB,MAAM,EAAE,EAAE;AAAA,UAC1C,GAAI,MAAM,wBAAwB,SAC9B,CAAC,IACD,EAAE,qBAAqB,MAAM,oBAAoB;AAAA,UACrD,GAAI,MAAM,iCAAiC,SACvC,CAAC,IACD;AAAA,YACE,8BAA8B,MAAM;AAAA,UACtC;AAAA,UACJ,GAAI,MAAM,0BAA0B,SAChC,CAAC,IACD,EAAE,uBAAuB,MAAM,sBAAsB;AAAA,UACzD,GAAI,MAAM,+BAA+B,SACrC,CAAC,IACD,EAAE,4BAA4B,MAAM,2BAA2B;AAAA,UACnE,iBAAiB,aAAa,UAAU;AAAA,UACxC,iBAAiB,aAAa,YAAY,UAAU;AAAA,QACtD,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,8BAA4B,GAAG;AAC/B,SAAO;AACT;AAGO,SAAS,8BAA8B,UAAoB,SAAyB;AACzF,QAAM,SAAS,iBAAiB,QAAQ;AACxC,QAAM,YAAY,OAAO,KAAK,CAAC,UAAU,MAAM,OAAO,OAAO;AAC7D,MAAI,WAAW;AACb,WAAO,UAAU;AAAA,EACnB;AACA,SAAO,OAAO,KAAK,CAAC,UAAU,MAAM,QAAQ,SAAS,OAAO,CAAC,GAAG,MAAM;AACxE;AASO,SAAS,wBAAwB,UAA8B;AACpE,SAAO,iBAAiB,QAAQ,EAAE,IAAI,CAAC,UAAU,MAAM,EAAE;AAC3D;AAQO,SAAS,qBACd,UACA,SACyE;AACzE,QAAM,mBAAmB,8BAA8B,UAAU,OAAO;AACxE,QAAM,QAAQ,iBAAiB,QAAQ,EAAE,KAAK,CAAC,cAAc,UAAU,OAAO,gBAAgB;AAC9F,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,WAAW,oBAAoB,QAAQ,EAAE;AAAA,IAC7C,CAAC,cAAc,UAAU,OAAO,MAAM;AAAA,EACxC;AACA,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AACA,SAAO,EAAE,UAAU,MAAM;AAC3B;AAcA,SAAS,+BAA+B,UAAoB,SAA2B;AACrF,MAAI,SAAS,4BAA4B,QAAQ,WAAW,qBAAqB,GAAG;AAClF,WAAO,yBAAyB,QAAQ;AAAA,EAC1C;AACA,MACE,SAAS,gCACT,QAAQ,WAAW,gCAAgC,GACnD;AACA,WAAO,mCAAmC,QAAQ;AAAA,EACpD;AACA,MAAI,QAAQ,WAAW,iCAAiC,GAAG;AACzD,WAAO,oCAAoC,QAAQ;AAAA,EACrD;AACA,SAAO;AACT;AAOO,SAAS,6BACd,UACA,OACuB;AACvB,QAAM,kBAAkB,+BAA+B,UAAU,MAAM,OAAO;AAC9E,QAAM,iBAAiB,8BAA8B,iBAAiB,MAAM,OAAO;AACnF,QAAM,WAAW,qBAAqB,iBAAiB,cAAc;AACrE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,MACE,MAAM,qBAAqB,QAC3B,8BAA8B,iBAAiB,MAAM,gBAAgB,MAAM,gBAC3E;AACA,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,cAAc,YAAY,MAAM,MAAM,eAAe,UAAU;AACrE,QAAM,oBAAoB,MAAM,qBAAqB;AACrD,4BAA0B,iBAAiB,gBAAgB,WAAW;AACtE,SAAO,sBAAsB,MAAM;AAAA,IACjC,eAAe;AAAA,IACf;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB,aAAa,MAAM;AAAA,IACnB,iBAAiB,MAAM;AAAA,IACvB,iBAAiB,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,IACA,YAAY,SAAS,SAAS;AAAA,IAC9B,iBAAiB,SAAS,MAAM;AAAA,IAChC,SAAS,SAAS,MAAM;AAAA,IACxB,kBAAkB,SAAS,MAAM;AAAA,IACjC,SAAS,SAAS,MAAM;AAAA,IACxB,mBAAmB,SAAS,MAAM;AAAA,EACpC,CAAC;AACH;AAOO,SAAS,yCACd,UACA,QACA,UASA;AACA,QAAM,SAAS,sBAAsB,MAAM,MAAM;AACjD,QAAM,kBAAkB,+BAA+B,UAAU,OAAO,cAAc;AACtF,QAAM,yBAAyB,8BAA8B,iBAAiB,SAAS,OAAO;AAC9F,QAAM,sBAAsB,SAAS,eAAe,OAAO;AAC3D,MACE,OAAO,mBAAmB,0BAC1B,OAAO,oBAAoB,SAAS,mBACpC,OAAO,gBAAgB,qBACvB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,4BAA0B,iBAAiB,OAAO,gBAAgB,OAAO,WAAW;AACpF,MACE,OAAO,qBAAqB,QAC5B,8BAA8B,iBAAiB,OAAO,gBAAgB,MACpE,OAAO,gBACT;AACA,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,QAAM,WAAW,qBAAqB,iBAAiB,OAAO,cAAc;AAC5E,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,QAAM,aACJ,OAAO,eAAe,SAAS,SAAS,MACxC,OAAO,oBAAoB,SAAS,MAAM,mBAC1C,OAAO,YAAY,SAAS,MAAM,OAClC,OAAO,sBAAsB,SAAS,MAAM,qBAC5C,cAAc,OAAO,gBAAgB,MAAM,cAAc,SAAS,MAAM,gBAAgB,KACxF,cAAc,OAAO,OAAO,MAAM,cAAc,SAAS,MAAM,OAAO;AACxE,MAAI,YAAY;AACd,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,SAAO,EAAE,QAAQ,QAAQ,UAAU,SAAS,UAAU,OAAO,SAAS,MAAM;AAC9E;AASO,SAAS,gCACd,UACwC;AACxC,QAAM,WAAW,OAAO;AAAA,IACtB,OAAO,QAAQ,mBAAmB,EAAE,IAAI,CAAC,CAAC,OAAO,OAAO,MAAM;AAAA,MAC5D;AAAA,MACA,8BAA8B,OAAO;AAAA,IACvC,CAAC;AAAA,EACH;AACA,QAAM,WAAmD,CAAC;AAC1D,aAAW,YAAY,4BAA4B,QAAQ,GAAG;AAC5D,eAAW,SAAS,SAAS,QAAQ;AACnC,UAAI,MAAM,SAAS;AACjB,iBAAS,MAAM,EAAE,IAAI,8BAA8B,MAAM,OAAO;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,OAAO;AAAA,IACxB,OAAO,QAAQ,sBAAsB,SAAS,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,OAAO,MAAM;AAAA,MACzF;AAAA,MACA,EAAE,SAAS,QAAQ;AAAA,IACrB,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AACF;AAGO,SAAS,uBAAuB,UAAkD;AACvF,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,gCAAgC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,QAAQ,MAAM;AAAA,MACnF;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAGO,SAAS,mBACd,UACA,aACc;AACd,QAAM,wBAAwB,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,CAAC;AACjE,MAAI,WAAW,SAAS;AACxB,aAAW,QAAQ,SAAS,mBAAmB,CAAC,GAAG;AACjD,QAAI,wBAAwB,KAAK,oBAAoB;AACnD;AAAA,IACF;AACA,eAAW,KAAK;AAAA,EAClB;AACA,SAAO;AACT;AAMO,SAAS,yBACd,UAIQ;AACR,MAAI,SAAS,iCAAiC,QAAW;AACvD,WAAO,KAAK,IAAI,SAAS,qBAAqB,SAAS,4BAA4B;AAAA,EACrF;AACA,SAAO,KAAK,IAAI,GAAG,SAAS,sBAAsB,SAAS,2BAA2B;AACxF;AAOO,SAAS,iCACd,UACA,OAOU;AACV,QAAM,sBAAsB,MAAM,uBAAuB,SAAS;AAClE,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,GAAI,MAAM,iCAAiC,SACvC,CAAC,IACD;AAAA,MACE,8BAA8B,KAAK;AAAA,QACjC;AAAA,QACA,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACJ,GAAI,MAAM,0BAA0B,SAChC,CAAC,IACD,EAAE,mCAAmC,MAAM,sBAAsB;AAAA,IACrE,GAAI,MAAM,+BAA+B,SACrC,CAAC,IACD,EAAE,iCAAiC,MAAM,2BAA2B;AAAA,EAC1E;AACF;AAEO,SAAS,4BAA4B,UAA6C;AACvF,SAAO,2BAA2B,SAAS,qBAAqB;AAClE;AAEO,SAAS,uBAAuB,UAAwC;AAC7E,MAAI,SAAS,qBAAqB,QAAQ;AACxC,WAAO,CAAC;AAAA,EACV;AACA,QAAM,aAAa,4BAA4B,SAAS,sBAAsB;AAC9E,MAAI,SAAS,qBAAqB,UAAU;AAC1C,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,+BAA+B;AAAA,IAC/B,mCAAmC,SAAS,gBAAgB;AAAA,IAC5D,oBAAoB;AAAA,IACpB,sBAAsB;AAAA,IACtB,sBAAsB,QAAQ,SAAS,eAAe,SAAS,mBAAmB;AAAA,IAClF,GAAG;AAAA,EACL;AACF;AAEO,SAAS,8BACd,UACA,OACA,OACA,SACQ;AACR,SAAO,iCAAiC,UAAU,OAAO,OAAO,OAAO,EAAE;AAC3E;AAEO,SAAS,iCACd,UACA,OACA,OACA,SACyB;AACzB,QAAM,WAAW,gCAAgC,QAAQ,EAAE,KAAK;AAChE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,6BAA6B,KAAK,EAAE;AAAA,EACtD;AACA,QAAM,UACJ,MAAM,uBAAuB,MAAM,oBAAoB,SAAS,IAC5D,MAAM,sBACN,CAAC,KAAK;AACZ,QAAM,mBAAmB,oBAAI,IAA0B;AACvD,aAAW,SAAS,SAAS;AAC3B,UAAM,UAAU,mBAAmB,UAAU,YAAY,MAAM,WAAW,CAAC;AAC3E,qBAAiB;AAAA,MACf;AAAA,OACC,iBAAiB,IAAI,OAAO,KAAK,KAAK,yBAAyB,SAAS,KAAK;AAAA,IAChF;AAAA,EACF;AACA,MAAI,qBAAqB;AACzB,MAAI,mBAAmB;AACvB,aAAW,CAAC,SAAS,OAAO,KAAK,kBAAkB;AACjD,UAAM,YAAY,QAAQ,aAAa;AACvC,0BAAsB;AACtB,wBAAoB,KAAK,KAAM,WAAW,MAAS,aAAc,GAAM;AAAA,EACzE;AACA,QAAM,cAAc,SAAS,eAAe;AAC5C,MAAI,gBAAgB,YAAY;AAC9B,UAAM,kBAAkB,+BAA+B,UAAU,KAAK;AACtE,UAAM,WAAW;AAAA,MACf;AAAA,MACA,8BAA8B,iBAAiB,KAAK;AAAA,IACtD;AACA,UAAM,gBAAgB,UAAU,MAAM,aAAa,aAAa;AAAA,MAC9D,CAAC,SAAS,KAAK,OAAO,eAAe,KAAK;AAAA,IAC5C,GAAG;AACH,QAAI,iBAAiB,gBAAgB,GAAG;AACtC,2BAAqB,KAAK,KAAM,qBAAqB,gBAAiB,GAAM;AAC5E,yBAAmB,KAAK,KAAM,mBAAmB,gBAAiB,GAAM;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,EAAE,oBAAoB,iBAAiB;AAChD;AAOO,SAAS,mCACd,UACA,OACA,kBACA,SACQ;AACR,SAAO,sCAAsC,UAAU,OAAO,kBAAkB,OAAO,EACpF;AACL;AAEO,SAAS,sCACd,UACA,OACA,kBACA,SACyB;AACzB,QAAM,WAAW,gCAAgC,QAAQ,EAAE,KAAK;AAChE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,6BAA6B,KAAK,EAAE;AAAA,EACtD;AACA,QAAM,UAAU,mBAAmB,UAAU,YAAY,SAAS,WAAW,CAAC;AAC9E,QAAM,QAAQ,kCAAkC,KAAK,gBAAgB;AACrE,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AACA,QAAM,WAAW,MAAM,CAAC,KAAK;AAC7B,QAAM,gBAAgB,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,QAAQ,EAAE;AACrD,QAAM,eAAe,OAAO,OAAO,SAAS,MAAM;AAClD,QAAM,oBAAoB,gBAAgB;AAC1C,QAAM,kBAAkB,oBAAoB,eAAe,MAAM;AACjE,QAAM,YAAY,OAAO,OAAU,QAAQ,aAAa,EAAE;AAC1D,QAAM,YAAY,oBAAoB;AACtC,QAAM,cAAc,eAAe;AACnC,QAAM,gBAAgB,YAAY,cAAc,MAAM;AACtD,MACE,iBAAiB,OAAO,OAAO,gBAAgB,KAC/C,eAAe,OAAO,OAAO,gBAAgB,GAC7C;AACA,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO;AAAA,IACL,oBAAoB,OAAO,cAAc;AAAA,IACzC,kBAAkB,OAAO,YAAY;AAAA,EACvC;AACF;AAOO,SAAS,yCACd,UACA,OAKQ;AACR,MAAI,MAAM,YAAY,uBAAuB;AAC3C,UAAM,IAAI,MAAM,+CAA+C,MAAM,OAAO,EAAE;AAAA,EAChF;AACA,MAAI,CAAC,OAAO,cAAc,MAAM,eAAe,KAAK,MAAM,kBAAkB,GAAG;AAC7E,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,OACJ,MAAM,eAAe,SACjB,SAAS,2CACT,SAAS;AACf,QAAM,OAAO,OAAO,MAAM;AAC1B,MAAI,CAAC,OAAO,cAAc,IAAI,KAAK,QAAQ,KAAK,OAAO,KAAe;AACpE,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO;AACT;AAEO,SAAS,kCACd,UACwC;AACxC,SAAO,aAAa;AAAA,IAClB,SAAS;AAAA,IACT,GAAG,SAAS,SAAS,6BAA6B;AAAA,EACpD,CAAC,EAAE,IAAI,CAAC,UAAU,gBAAgB,MAAM,KAAK,CAAC;AAChD;AAOO,SAAS,+BAA+B,UAAuC;AACpF,MAAI,CAAC,SAAS,2BAA2B;AACvC,WAAO;AAAA,EACT;AACA,QAAM,UAAU,OAAO,KAAK,SAAS,2BAA2B,QAAQ;AACxE,MAAI,QAAQ,WAAW,IAAI;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,IAAI,WAAW,OAAO;AAC/B;AAQO,SAAS,0BAA0B,UAA+C;AACvF,QAAM,SAAS,SAAS,gBAAgB,KAAK,KAAK;AAClD,QAAM,qBAAqB,SAAS,uBAAuB,KAAK,KAAK;AACrE,QAAM,SAAS;AAAA,IACb,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,oBAAoB;AAAA,IACxB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,mBAAmB;AAAA,IACvB,SAAS;AAAA,IACT;AAAA,EACF;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ,gBAAgB,GAAG;AAC5D,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,MAAmC,CAAC;AAC1C,MAAI,oBAAoB;AACtB,QAAI,qBAAqB;AAAA,EAC3B;AACA,MAAI,QAAQ;AACV,QAAI,0BAA0B;AAAA,EAChC;AACA,MAAI,qBAAqB,kBAAkB;AACzC,QAAI,iBAAiB,EAAE,KAAK,mBAAmB,KAAK,iBAAiB;AAAA,EACvE;AACA,QAAM,eAAe,OAAO,KAAK,GAAG,EAAE,SAAS;AAC/C,QAAM,aAAa,SAAS,sBAAsB,QAAQ,MAAM,KAAK;AAErE,SAAO;AAAA,IACL,SAAS,SAAS;AAAA,IAClB,GAAI,aAAa,EAAE,KAAK,eAAe,MAAM,KAAK,IAAI,CAAC;AAAA,IACvD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,EAC7B;AACF;AAEA,SAAS,0BACP,OACA,aACwB;AAIxB,QAAM,UAAU,OAAO,QAAQ,OAAO,EAAE;AACxC,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,MAAI,CAAC,yBAAyB,KAAK,OAAO,KAAK,QAAQ,SAAS,MAAM,GAAG;AACvE,UAAM,IAAI,MAAM,GAAG,WAAW,4BAA4B;AAAA,EAC5D;AACA,QAAM,UAAU,OAAO,KAAK,SAAS,QAAQ;AAC7C,QAAM,YAAY,QAAQ,SAAS,QAAQ,EAAE,QAAQ,OAAO,EAAE;AAC9D,MAAI,QAAQ,WAAW,KAAK,cAAc,QAAQ,QAAQ,OAAO,EAAE,GAAG;AACpE,UAAM,IAAI,MAAM,GAAG,WAAW,4BAA4B;AAAA,EAC5D;AACA,SAAO,IAAI,WAAW,OAAO;AAC/B;AAYO,SAAS,aAAa,UAA0D;AACrF,QAAM,SAAS,SAAS,UAAU,KAAK;AACvC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AACA,MAAI,CAAC,2BAA2B,KAAK,MAAM,GAAG;AAC5C,UAAM,IAAI,MAAM,0DAA0D,MAAM,EAAE;AAAA,EACpF;AACA,SAAO,GAAG,MAAM;AAClB;AAEO,SAAS,8BAA8B,UAA4C;AACxF,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ;AAAA,MACb,iBAAiB,SAAS;AAAA,MAC1B,kBAAkB,SAAS;AAAA,MAC3B,oBAAoB,SAAS,oBAAoB,SAAS;AAAA,MAC1D,qBAAqB,SAAS,qBAAqB,SAAS;AAAA,IAC9D,CAAC,EAAE;AAAA,MACD,CAAC,UACC,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS;AAAA,IAC7D;AAAA,EACF;AACF;AAEA,IAAM,uBAAuB;AAE7B,SAAS,iBAAiB,WAA+B,OAAuB;AAC9E,QAAM,SAAS,aAAa,sBAAsB,MAAM,GAAG,EAAE,OAAO,OAAO;AAC3E,SAAO,CAAC,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,SAAS,KAAK,CAAC,EAAE,KAAK,GAAG;AACpE;AAkCO,SAAS,+BACd,UACA,uBAA+C,CAAC,GAChD,UAAoC,CAAC,GACb;AACxB,QAAM,cAAsC;AAAA,IAC1C,GAAG,0BAA0B,QAAQ;AAAA,IACrC,GAAG,8BAA8B,QAAQ;AAAA,IACzC,GAAG;AAAA,EACL;AAKA,QAAM,aAAa,uBAAuB,SAAS,cAAc;AACjE,MACE,SAAS,mBAAmB,UAC5B,SAAS,mBAAmB,WAC5B,SAAS,mBAAmB,cAC5B;AACA,gBAAY,SAAS,WAAW;AAAA,EAClC;AAOA,QAAM,8BACJ,SAAS,mBAAmB,UAC5B,SAAS,mBAAmB,WAC5B,SAAS,mBAAmB;AAC9B,MAAI,6BAA6B;AAC/B,UAAM,OAAO,YAAY,QAAQ,WAAW;AAC5C,gBAAY,iCAAiC,GAAG,IAAI;AACpD,gBAAY,4BAA4B,GAAG,IAAI;AAC/C,gBAAY,iCAAiC,GAAG,IAAI;AACpD,gBAAY,OAAO,iBAAiB,YAAY,MAAM,YAAY,4BAA4B;AAAA,EAChG;AACA,MAAI,SAAS,mBAAmB,gBAAgB,kCAAkC,QAAQ,GAAG;AAC3F,gBAAY,iCAAiC,GAAG,YAAY,QAAQ,WAAW,aAAa;AAC5F,QAAI,SAAS,mBAAmB;AAC9B,kBAAY,iCAAiC,SAAS;AAAA,IACxD;AACA,QAAI,QAAQ,aAAa;AACvB,kBAAY,0BAA0B,qBAAqB,UAAU,QAAQ,WAAW;AAAA,IAC1F;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,6BACd,WAQS;AACT,QAAM,WAAW,CAAC,UACf,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,KAAK,QAAQ,KAChE,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,KAAK,OAAO,KAAK,IAAI;AACvE,SAAO,UAAU;AAAA,IACf,CAAC,aACC,SAAS,SAAS,iBAChB,SAAS,SAAS,oBAAoB,KAAK,SAAS,SAAS,kBAAkB,KAC9E,SAAS,aAAa,YACrB,SAAS,SAAS,cAAc,KAChC,SAAS,SAAS,YAAY;AAAA,EACtC;AACF;AAEO,SAAS,oCACd,WAMS;AACT,SAAO,UAAU;AAAA,IACf,CAAC,aACC,SAAS,SAAS,iBACjB,SAAS,aAAa,YACrB,SAAS,aAAa,YACtB,SAAS,aAAa,kBACtB,6BAA6B,CAAC,QAAQ,CAAC;AAAA,EAC7C;AACF;AAmBO,SAAS,+BACd,aACA,UACwB;AACxB,cAAY,cAAc,GAAG,YAAY,QAAQ,YAAY;AAC7D,cAAY,sBAAsB;AAClC,MAAI,UAAU;AACZ,gBAAY,kBAAkB,YAAY,mBAAmB,SAAS;AACtE,gBAAY,mBAAmB,YAAY,oBAAoB,SAAS;AACxE,gBAAY,qBAAqB,YAAY,sBAAsB,SAAS;AAC5E,gBAAY,sBAAsB,YAAY,uBAAuB,SAAS;AAAA,EAChF;AACA,SAAO;AACT;AAeO,SAAS,oBACd,UACgD;AAChD,SAAO;AAAA,IACL,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,IACzB,YAAY,SAAS;AAAA,EACvB;AACF;AAEA,eAAsB,uBACpB,OACA,WACA,UAA+B,CAAC,GACpB;AACZ,QAAM,WAAW,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,YAAY,EAAE,CAAC;AAC/D,QAAM,iBAAiB,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,kBAAkB,GAAI,CAAC;AAC7E,QAAM,aAAa,KAAK,IAAI,gBAAgB,KAAK,MAAM,QAAQ,cAAc,GAAI,CAAC;AAClF,WAAS,UAAU,GAAG,WAAW,UAAU,WAAW,GAAG;AACvD,QAAI;AACF,aAAO,MAAM,UAAU;AAAA,IACzB,SAAS,OAAO;AACd,UAAI,WAAW,UAAU;AACvB,cAAM;AAAA,MACR;AACA,YAAM,UAAU,KAAK,IAAI,YAAY,iBAAiB,MAAM,UAAU,EAAE;AACxE,cAAQ,UAAU,EAAE,OAAO,SAAS,UAAU,SAAS,MAAM,CAAC;AAC9D,YAAM,MAAM,OAAO;AAAA,IACrB;AAAA,EACF;AACA,QAAM,IAAI,MAAM,uCAAuC,KAAK,EAAE;AAChE;AAEO,SAAS,gCAAgC,UAA8B;AAC5E,QAAM,WAAW,+BAA+B,QAAQ;AACxD,QAAM,QAAkB,CAAC;AACzB,aAAW,WAAW,UAAU;AAC9B,UAAM,KAAK,GAAG,2BAA2B,OAAO,EAAG,GAAG;AAAA,EACxD;AACA,QAAM,KAAK,GAAG,SAAS,SAAS,mBAAmB,CAAC;AACpD,SAAO,eAAe,OAAO,aAAa;AAC5C;AAEO,SAAS,wBAAwB,UAA8B;AACpE,QAAM,MAAgB,CAAC;AACvB,aAAW,WAAW,+BAA+B,QAAQ,GAAG;AAC9D,QAAI,KAAK,GAAG,2BAA2B,OAAO,EAAG,KAAK;AAAA,EACxD;AACA,SAAO,aAAa,GAAG;AACzB;AAEA,SAAS,+BAA+B,UAA8B;AACpE,QAAM,WAAW,SAAS,SAAS,0BAA0B,EAAE;AAAA,IAAI,CAAC,UAClE,MAAM,YAAY;AAAA,EACpB;AACA,MAAI,SAAS,SAAS,MAAM,GAAG;AAC7B,QAAI,SAAS,SAAS,GAAG;AACvB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,CAAC,MAAM;AAAA,EAChB;AACA,aAAW,WAAW,UAAU;AAC9B,QAAI,CAAC,2BAA2B,OAAO,GAAG;AACxC,YAAM,IAAI,MAAM,uCAAuC,OAAO,EAAE;AAAA,IAClE;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,kBAAkB,KAAuB;AACvD,SAAO,SAAS,GAAG,EAAE,IAAI,CAAC,UAAU;AAClC,UAAM,OAAO,OAAO,KAAK;AACzB,QAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,OAAO;AACvD,YAAM,IAAI,MAAM,6DAA6D;AAAA,IAC/E;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAEO,SAAS,gBAAgB,KAAgD;AAC9E,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC1B,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,8CAA8C,OAAO,IAAI;AAAA,MACvE,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEO,SAAS,sBAAsB,KAA2C;AAC/E,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,mDAAmD,OAAO,IAAI,EAAE,OAAO,MAAM,CAAC;AAAA,EAChG;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,MAAM,uEAAuE;AAAA,EACzF;AACA,QAAM,MAAoC,CAAC;AAC3C,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,QAAI,CAAC,MAAM,KAAK,GAAG;AACjB,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AACA,QAAI,KAAK,IAAI,mBAAmB,MAAM,KAAK;AAAA,EAC7C;AACA,SAAO;AACT;AAMO,SAAS,yBAAyB,KAAqC;AAC5E,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI;AAAA,MACR,yEAAyE,OAAO;AAAA,MAChF,EAAE,OAAO,MAAM;AAAA,IACjB;AAAA,EACF;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,SAAS,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACrD,QAAI,CAAC,QAAQ,KAAK,GAAG;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,OAAO,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK;AAC7D,QAAI,CAAC,OAAO,SAAS,IAAI,KAAK,OAAO,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,8DAA8D,OAAO;AAAA,MACvE;AAAA,IACF;AACA,QAAI,OAAO,IAAI;AAAA,EACjB;AACA,SAAO;AACT;AAIO,SAAS,+BAA+B,UAAoB,SAAyB;AAC1F,QAAM,QAAQ,yBAAyB,SAAS,kCAAkC;AAClF,SAAO,MAAM,OAAO,KAAK;AAC3B;AAOO,SAAS,wBAAwB,KAAiC;AACvE,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,qDAAqD,OAAO,IAAI;AAAA,MAC9E,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC1B,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,SAAO,OAAO,IAAI,CAAC,OAAO,UAAU;AAClC,UAAM,SAAS,uBAAuB,UAAU,KAAK;AACrD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR,0CAA0C,KAAK,iBAAiB,OAAO,MAAM,OAAO;AAAA,MACtF;AAAA,IACF;AACA,QAAI;AACF,aAAO,0BAA0B,OAAO,IAAI;AAAA,IAC9C,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,YAAM,IAAI,MAAM,0CAA0C,KAAK,iBAAiB,OAAO,IAAI;AAAA,QACzF,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,SAAS,kCACd,KAC8C;AAC9C,MAAI,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACvC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,gEAAgE,OAAO,IAAI;AAAA,MACzF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAoD,CAAC;AAC3D,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,CAAC,IAAI,KAAK,GAAG;AACf,YAAM,IAAI,MAAM,uEAAuE;AAAA,IACzF;AACA,UAAM,SAAS,mCAAmC,UAAU,KAAK;AACjE,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR,uDAAuD,GAAG,gBAAgB,OAAO,MAAM,OAAO;AAAA,MAChG;AAAA,IACF;AACA,QAAI,GAAG,IAAI,OAAO;AAAA,EACpB;AACA,SAAO;AACT;AAEO,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAC3C,CAAC;AAGD,IAAM,4BAA4B,CAAC,KAAK,QAAQ;AAEzC,SAAS,4BACd,KACsF;AACtF,MAAI,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACvC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,0DAA0D,OAAO,IAAI;AAAA,MACnF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MACJ,CAAC;AACH,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,CAAC,0BAA0B,SAAS,GAAiD,GAAG;AAC1F,YAAM,IAAI;AAAA,QACR,+CAA+C,GAAG,gCAAgC,0BAA0B,KAAK,IAAI,CAAC;AAAA,MACxH;AAAA,IACF;AACA,UAAM,SAAS,8BAA8B,UAAU,KAAK;AAC5D,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR,iDAAiD,GAAG,gBAAgB,OAAO,MAAM,OAAO;AAAA,MAC1F;AAAA,IACF;AACA,QAAI,GAAiD,IAAI,OAAO;AAAA,EAClE;AACA,SAAO;AACT;AAEO,SAAS,2BAA2B,KAAsC;AAC/E,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,yDAAyD,OAAO,IAAI;AAAA,MAClF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,kBAAkB,MAAM,MAAM;AACvC;AAEO,SAAS,4BAA4B,KAAiC;AAC3E,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,yDAAyD,OAAO,IAAI;AAAA,MAClF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,aAAa,MAAM,MAAM;AAClC;AAEA,SAAS,yBAAyB,SAAuB,OAAgC;AACvF,QAAM,cAAc,YAAY,MAAM,WAAW;AACjD,QAAM,eAAe,YAAY,MAAM,YAAY;AACnD,QAAM,eAAe,KAAK,IAAI,aAAa,kBAAkB,KAAK,CAAC;AACnE,QAAM,sBAAsB,KAAK,IAAI,GAAG,cAAc,YAAY;AAClE,QAAM,kBACJ,QAAQ,qCAAqC,QAAQ;AACvD,SACE,KAAK,KAAM,sBAAsB,QAAQ,8BAA+B,GAAS,IACjF,KAAK,KAAM,eAAe,kBAAmB,GAAS,IACtD,KAAK,KAAM,eAAe,QAAQ,+BAAgC,GAAS;AAE/E;AAEA,SAAS,kBAAkB,OAAgC;AACzD,QAAM,UAAU,MAAM,QAAQ,MAAM,kBAAkB,IAClD,MAAM,qBACN,MAAM,qBACJ,CAAC,MAAM,kBAAkB,IACzB,CAAC;AACP,MAAI,QAAQ;AACZ,aAAW,UAAU,SAAS;AAC5B,aACE,YAAY,OAAO,aAAa,IAChC,YAAY,OAAO,iBAAiB,IACpC,YAAY,OAAO,mBAAmB;AAAA,EAC1C;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAwB;AAC3C,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,QAAQ,IAAI,KAAK,MAAM,KAAK,IAAI;AAChG;AAEA,SAAS,wBAAwB,UAA4C;AAC3E,QAAM,WAAW,SAAS,WAAW,OAAO,CAAC,WAAW,OAAO,OAAO,UAAU;AAChF,QAAM,mBAAmB,uBAAuB,QAAQ;AACxD,QAAM,wBAAwB,4BAA4B,gBAAgB;AAC1E,QAAM,uBAAuB,gCAAgC,gBAAgB;AAC7E,QAAM,WAAW,SAAS,KAAK,CAAC,WAAW,OAAO,OAAO,OAAO;AAChE,QAAM,UAAU,SAAS,KAAK,CAAC,WAAW,OAAO,OAAO,MAAM;AAC9D,SAAO;AAAA,IACL;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAYL,gBAAgB;AAAA,IAClB;AAAA,IACA,GAAI,WACA,CAAC,IACD;AAAA,MACE;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,KAAK;AAAA,QACL,cAAc,CAAC,wBAAwB;AAAA,QACvC,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,IACJ,GAAI,UACA,CAAC,IACD;AAAA,MACE;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,KAAK;AAAA,QACL,cAAc;AAAA,UACZ;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,QACA,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,IACJ,GAAG;AAAA,EACL;AACF;AAuBO,SAAS,qBAAqB,UAA4B;AAC/D,SACE,SAAS,kBACT,oBAAoB,SAAS,OAAO;AAExC;AAEO,SAAS,0BAA0B,UAAoB,aAA6B;AACzF,QAAM,MAAM,qBAAqB,QAAQ;AACzC,MAAI,IAAI,SAAS,eAAe,GAAG;AACjC,WAAO,IAAI,WAAW,iBAAiB,WAAW;AAAA,EACpD;AACA,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,MAAI,WAAW,kBAAkB,WAAW;AAC5C,MAAI,SAAS;AACb,MAAI,OAAO;AACX,SAAO,IAAI,SAAS;AACtB;AAEO,SAAS,qBAAqB,UAAoB,aAA6B;AACpF,MAAI,SAAS,gBAAgB;AAC3B,UAAMC,OAAM,IAAI,IAAI,0BAA0B,UAAU,WAAW,CAAC;AACpE,QAAI,CAACA,KAAI,SAAS,SAAS,MAAM,GAAG;AAClC,YAAM,IAAI,MAAM,kEAAkE;AAAA,IACpF;AACA,IAAAA,KAAI,WAAW,GAAGA,KAAI,SAAS,MAAM,GAAG,EAAE,CAAC;AAC3C,WAAOA,KAAI,SAAS;AAAA,EACtB;AAOA,QAAM,kBACJ,SAAS,mBAAmB,WACxB,+BAA+B,SAAS,OAAO,KAC/C,SAAS,mBAAmB,UAC1B,oBAAoB,SAAS,OAAO,KACnC,SAAS,iBAAiB,oBAAoB,SAAS,OAAO;AACvE,QAAM,MAAM,IAAI,IAAI,eAAe;AACnC,MAAI,WAAW,GAAG,IAAI,SAAS,QAAQ,SAAS,EAAE,CAAC,kBAAkB,WAAW;AAChF,MAAI,SAAS;AACb,MAAI,OAAO;AACX,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,uBAAuB,UAA4B;AAC1D,SAAO,qBAAqB,QAAQ;AACtC;AAEA,SAAS,gCAAgC,QAAwB;AAC/D,SAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC;AACtC;AAEA,SAAS,4BAA4B,QAAwB;AAC3D,SAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC;AACtC;AAEA,SAAS,iBAAiB,UAA0B;AAClD,4BAA0B,QAAQ;AAClC,QAAM,4BAA4B,IAAI;AAAA,IACpC,SAAS,6BAA6B;AAAA,EACxC;AACA,QAAM,sBAAsB,SAAS,6BAA6B,CAAC,GAAG;AAAA,IACpE,CAAC,SAAS,CAAC,0BAA0B,IAAI,IAAI;AAAA,EAC/C;AACA,MAAI,mBAAmB,SAAS,GAAG;AACjC,UAAM,IAAI;AAAA,MACR,sGAAsG,mBAAmB,KAAK,IAAI,CAAC;AAAA,IACrI;AAAA,EACF;AACA,MAAI,SAAS,sBAAsB,WAAW;AAC5C,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,kBAAkB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,kBAAkB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAAK,CAAC,SAAS,cAAc;AAC/E,YAAM,IAAI,MAAM,yEAAyE;AAAA,IAC3F;AACA,QAAI,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAAK,CAAC,SAAS,2BAA2B;AAC5F,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,iCAA+B,QAAQ;AACvC,MAAI,SAAS,qBAAqB;AAChC,QAAI,SAAS,sBAAsB,aAAa,CAAC,SAAS,eAAe;AACvE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,iBACT,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,2BAA2B,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAAG;AAC1F,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,aAAa,MAAM,QAAQ,SAAS,iBAAiB,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,eAAe;AAC1B,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,yBAAyB;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,mBAAmB,MAAM,QAAQ,SAAS,uBAAuB,GAAG;AACvF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,aAAa,MAAM,QAAQ,SAAS,iBAAiB,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,eAAe;AAC1B,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,yBAAyB;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,qBAAqB;AAChC,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,yBAAyB;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,iBAAiB,MAAM,QAAQ,SAAS,qBAAqB,GAAG;AACnF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,mBAAmB;AAC9B,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,yBAAyB;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,oCAAkC,SAAS,4BAA4B;AACvE,8BAA4B,SAAS,sBAAsB;AAC3D,MACE,SAAS,sBAAsB,gBAC/B,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAChD,CAAC,SAAS,oBACV,CAAC,SAAS,cACV;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,gBAAgB,UAAU;AACrC,QAAI,CAAC,SAAS,mBAAmB,CAAC,SAAS,qBAAqB;AAC9D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,sBAAsB,aAAa,SAAS,gBAAgB,UAAU;AACjF,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,MAAI,SAAS,gBAAgB,YAAY,SAAS,oBAAoB,WAAW;AAC/E,UAAM,UAAU,uBAAuB,QAAQ;AAC/C,UAAM,UAAU,wBAAwB,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,KAAK,CAAC;AACnF,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,uDAAuD,QAAQ,KAAK,IAAI,CAAC;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,oBAAoB,UAAU;AACzC,UAAM,SAAS,4BAA4B,QAAQ;AACnD,QAAI,OAAO,KAAK,MAAM,EAAE,WAAW,GAAG;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,OAAO;AACL,+BAA2B,SAAS,qBAAqB;AAAA,EAC3D;AACA,MAAI,SAAS,qBAAqB,UAAU;AAC1C,UAAM,eAAe,4BAA4B,SAAS,sBAAsB;AAChF,QAAI,OAAO,KAAK,YAAY,EAAE,WAAW,GAAG;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,OAAO;AACL,gCAA4B,SAAS,sBAAsB;AAAA,EAC7D;AACA,MAAI,SAAS,gBAAgB,CAAC,SAAS,WAAW;AAChD,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,SAAS,mBAAmB,SAAS;AACvC,QAAI,CAAC,SAAS,sBAAsB,CAAC,SAAS,qBAAqB;AACjE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,sBAAsB,CAAC,SAAS,uBAAuB;AACnE,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AACA,QAAI,CAAC,SAAS,sBAAsB,CAAC,SAAS,uBAAuB;AACnE,YAAM,IAAI,MAAM,uEAAuE;AAAA,IACzF;AACA,QAAI,CAAC,SAAS,qBAAqB,CAAC,SAAS,oBAAoB;AAC/D,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAAA,EACF;AAIA,MAAI,QAAQ,SAAS,YAAY,MAAM,QAAQ,SAAS,gBAAgB,GAAG;AACzE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAKA,aAAW,YAAY,qBAAqB,SAAS,cAAc,KAAK,CAAC,GAAG;AAC1E,UAAM,QAAQ,SAAS,SAAS,KAAK;AACrC,QACE,UAAU,UACV,UAAU,QACT,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GACtD;AACA,YAAM,IAAI;AAAA,QACR,GAAG,SAAS,GAAG,8CAA8C,SAAS,cAAc;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACA,MACE,SAAS,yBAAyB,mBAClC,SAAS,yBAAyB,UAClC;AACA,QACE,QAAQ,SAAS,wBAAwB,MAAM,QAAQ,SAAS,4BAA4B,GAC5F;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,yBAAyB,oBACjC,SAAS,yBACR,SAAS,iCACT,SAAS,kCACV,CAAC,SAAS,4BAA4B,CAAC,SAAS,+BACjD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,sCACT,SAAS,iCACT,SAAS,gCACT,SAAS,4BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,6BACT,SAAS,mCACT,SAAS,+BACT,SAAS,6BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,WAAW,SAAS,yBAAyB,cAAc;AACzD,QACE,SAAS,yBACT,SAAS,iCACT,SAAS,gCACT,SAAS,4BACT,SAAS,8BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,6BACT,SAAS,mCACT,SAAS,+BACT,SAAS,6BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,sBAAsB,QAAQ,SAAS,kCAAkC;AAC/E,UAAM,eACJ,QAAQ,SAAS,6BAA6B,KAC9C,QAAQ,SAAS,4BAA4B;AAC/C,QAAI,CAAC,uBAAuB,CAAC,cAAc;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,OAAO;AACL,QACE,SAAS,yBACT,SAAS,iCACT,SAAS,gCACT,SAAS,4BACT,SAAS,8BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,sCACT,SAAS,iCACT,SAAS,gCACT,SAAS,4BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,iCAAiC;AAC5C,8BAAwB,SAAS,+BAA+B;AAAA,IAClE;AAAA,EACF;AACA,MAAI,SAAS,wBAAwB,SAAS,mBAAmB;AAC/D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,oBAAkB,SAAS,kBAAkB;AAC7C,kCAAgC,QAAQ;AACxC,0BAAwB,QAAQ;AAEhC,2BAAyB,SAAS,kCAAkC;AACpE,QAAM,YAAY,oBAAI,IAAY;AAClC,aAAW,UAAU,SAAS,YAAY;AACxC,QAAI,UAAU,IAAI,OAAO,EAAE,GAAG;AAC5B,YAAM,IAAI,MAAM,8CAA8C,OAAO,EAAE,EAAE;AAAA,IAC3E;AACA,cAAU,IAAI,OAAO,EAAE;AAAA,EACzB;AAWA;AACE,UAAM,eAAe,SAAS;AAC9B,UAAM,YAAY,SAAS;AAC3B,UAAM,iBAAiB,SAAS;AAChC,UAAM,cAAc,SAAS;AAC7B,UAAM,qBAAqB,SAAS,sBAAsB;AAC1D,UAAM,iBAAiB,SAAS;AAQhC,UAAM,gBAAgB,iCAAiC,QAAQ,IAAI;AACnE,QAAI,EAAE,eAAe,YAAY;AAC/B,YAAM,IAAI;AAAA,QACR,4CAA4C,YAAY,uEACZ,SAAS;AAAA,MAEvD;AAAA,IACF;AACA,QAAI,EAAE,eAAe,iBAAiB;AACpC,YAAM,IAAI;AAAA,QACR,4CAA4C,YAAY,4EACP,cAAc;AAAA,MAEjE;AAAA,IACF;AACA,QAAI,EAAE,iBAAiB,qBAAqB;AAC1C,YAAM,IAAI;AAAA,QACR,6CAA6C,aAAa,uFACL,kBAAkB;AAAA,MAEzE;AAAA,IACF;AACA,QAAI,EAAE,iBAAiB,qBAAqB;AAC1C,YAAM,IAAI;AAAA,QACR,sCAAsC,cAAc,qEACV,kBAAkB;AAAA,MAC9D;AAAA,IACF;AAKA,UAAM,mBAAmB,+BAA+B,QAAQ;AAChE,QAAI,EAAE,iBAAiB,mBAAmB,eAAe;AACvD,YAAM,IAAI;AAAA,QACR,sCAAsC,cAAc,qEACf,mBAAmB,YAAY;AAAA,MACtE;AAAA,IACF;AACA,QAAI,EAAE,YAAY,gBAAgB;AAChC,YAAM,IAAI;AAAA,QACR,0CAA0C,SAAS,gEAChC,aAAa;AAAA,MAElC;AAAA,IACF;AACA,QAAI,EAAE,iBAAiB,gBAAgB;AACrC,YAAM,IAAI;AAAA,QACR,+CAA+C,cAAc,gEACxB,aAAa;AAAA,MAEpD;AAAA,IACF;AACA,QAAI,EAAE,eAAe,cAAc,gBAAgB;AACjD,YAAM,IAAI;AAAA,QACR,6EACM,YAAY,MAAM,WAAW,MAAM,eAAe,WAAW,gEAClC,aAAa;AAAA,MAKhD;AAAA,IACF;AAAA,EACF;AASA,MAAI,SAAS,yBAAyB,yBAAyB,QAAQ,MAAM,QAAW;AACtF,YAAQ;AAAA,MACN;AAAA,IAIF;AAAA,EACF;AAQA,QAAM,oBAAoB,wBAAwB,SAAS,kBAAkB;AAC7E,QAAM,YAAY,kBAAkB,QAAQ;AAC5C,QAAM,cAAc,oBAAI,IAAY;AACpC,aAAW,YAAY,mBAAmB;AACxC,QACE,SAAS,SAAS,4BAClB,SAAS,SAAS,8BAClB,SAAS,SAAS,oBAClB;AACA,YAAM,IAAI;AAAA,QACR,+CAA+C,SAAS,IAAI;AAAA,MAC9D;AAAA,IACF;AACA,QAAI,SAAS,OAAO,WAAW;AAC7B,YAAM,IAAI;AAAA,QACR,6CAA6C,SAAS,EAAE;AAAA,MAC1D;AAAA,IACF;AACA,QAAI,YAAY,IAAI,SAAS,EAAE,GAAG;AAChC,YAAM,IAAI;AAAA,QACR,gEAAgE,SAAS,EAAE;AAAA,MAC7E;AAAA,IACF;AACA,gBAAY,IAAI,SAAS,EAAE;AAC3B,QAAI,SAAS,SAAS,wBAAwB,CAAC,sBAAsB,QAAQ,GAAG;AAC9E,YAAM,IAAI;AAAA,QACR,0CAA0C,SAAS,EAAE;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AAIA,mBAAiB,QAAQ;AAC3B;AASO,SAAS,yBAAyB,UAAwC;AAC/E,QAAM,WAAW,SAAS,mBAAmB,KAAK;AAClD,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AACA,QAAM,aAAa,SAAS,kBAAkB,KAAK;AACnD,SAAO,aAAa,aAAa;AACnC;AAOO,SAAS,oBAAoB,UAA6B;AAC/D,SAAO,SAAS,yBAAyB,yBAAyB,QAAQ,MAAM;AAClF;AAWO,SAAS,+BAA+B,UAAwC;AACrF,QAAM,WAAW,SAAS,yBAAyB,KAAK;AACxD,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AACA,QAAM,aAAa,SAAS,kBAAkB,KAAK;AACnD,SAAO,aAAa,aAAa;AACnC;AAYO,SAAS,wBAAwB,UAAwC;AAC9E,QAAM,WAAW,SAAS,4BAA4B,KAAK;AAC3D,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AACA,QAAM,SAAS,SAAS,mBAAmB,KAAK;AAChD,MAAI,QAAQ;AACV,WAAO;AAAA,EACT;AACA,QAAM,aAAa,SAAS,kBAAkB,KAAK;AACnD,SAAO,aAAa,aAAa;AACnC;AAmBO,SAAS,yBAAyB,UAA8C;AACrF,QAAM,cAAc,SAAS,kCAAkC,KAAK;AACpE,QAAM,cAAc,SAAS,kCAAkC,KAAK,KAAK;AACzE,QAAM,OAAO,SAAS,2BAA2B,KAAK;AACtD,QAAM,WAAW,SAAS,+BAA+B,KAAK;AAC9D,MAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU;AACtC,WAAO;AAAA,EACT;AACA,SAAO,EAAE,aAAa,aAAa,MAAM,SAAS;AACpD;AAaO,SAAS,4BAA4B,UAAiD;AAC3F,QAAM,OAAO,SAAS,2BAA2B,KAAK;AACtD,QAAM,WAAW,SAAS,+BAA+B,KAAK;AAC9D,MAAI,CAAC,QAAQ,CAAC,UAAU;AACtB,WAAO;AAAA,EACT;AACA,SAAO,EAAE,MAAM,SAAS;AAC1B;AAEA,SAAS,SAAS,KAAuB;AACvC,SAAO,IACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACnB;AAEA,SAAS,eAAe,KAAe,WAA6B;AAClE,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAgB,CAAC;AACvB,aAAW,QAAQ,KAAK;AACtB,QAAI,CAAC,QAAQ,KAAK,IAAI,GAAG;AACvB,YAAM,IAAI,MAAM,GAAG,SAAS,mCAAmC,IAAI,EAAE;AAAA,IACvE;AACA,QAAI,CAAC,KAAK,IAAI,IAAI,GAAG;AACnB,WAAK,IAAI,IAAI;AACb,UAAI,KAAK,IAAI;AAAA,IACf;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,KAAyB;AAC7C,SAAO,CAAC,GAAG,IAAI,IAAI,IAAI,OAAO,OAAO,CAAC,CAAC;AACzC;AAEA,SAAS,wBAAwB,KAAsB;AACrD,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,oEAAoE,OAAO,IAAI;AAAA,MAC7F,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;","names":["XAI_SUBSCRIPTION_MODEL_ID_PREFIX","provider","url"]}