@opengeni/config 4.4.1 → 4.5.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/managed-user-admission.ts","../src/realtime-voice-pricing.ts","../src/web-search.ts","../src/credit-promotions.ts","../src/index.ts","../src/claude-subscription-usage.ts","../src/claude-subscription-oauth.ts","../src/subscription-account-selection.ts","../src/claude-subscription-capacity.ts"],"sourcesContent":["/** Deployment admission for native human accounts; never service credentials. */\nexport function managedUserEmailAllowed(\n  allowedUserEmails: readonly string[] | undefined,\n  email: unknown,\n): boolean {\n  return (\n    allowedUserEmails === undefined ||\n    (typeof email === \"string\" &&\n      allowedUserEmails.some((allowed) => allowed.toLowerCase() === email.trim().toLowerCase()))\n  );\n}\n","import { z } from \"zod\";\n\n/**\n * Credit pricing for deployment-funded live (speech-to-speech) voice.\n *\n * Live voice is metered by server-observed connection time, billed per started\n * minute. Prices are deployment configuration, never code defaults: when credit\n * billing is active, a deployment-funded voice model without a configured price\n * is not offered and cannot be started.\n */\nexport type RealtimeVoicePricing = {\n  /** Upstream cost of one minute of live voice, in USD micros. */\n  microsPerMinute: number;\n  /** Opengeni margin in basis points added on top of the upstream cost. */\n  marginBps?: number | undefined;\n};\n\nconst RealtimeVoicePricingSchema = z\n  .object({\n    microsPerMinute: z.number().int().positive().max(100_000_000),\n    marginBps: z.number().int().min(0).max(100_000).optional(),\n  })\n  .strict();\n\n/** Model id of the deployment-hosted Azure GPT Live voice. */\nexport const AZURE_LIVE_REALTIME_MODEL_ID = \"opengeni-azure/gpt-live-1\" as const;\n\nfunction parseJson(raw: string, env: string): unknown {\n  try {\n    return JSON.parse(raw);\n  } catch {\n    throw new Error(`${env} must be valid JSON`);\n  }\n}\n\nfunction issues(error: z.ZodError): string {\n  return error.issues\n    .map((issue) => `${issue.path.join(\".\") || \"(root)\"}: ${issue.message}`)\n    .join(\"; \");\n}\n\n/** One live-voice price, e.g. `{\"microsPerMinute\":50000,\"marginBps\":500}`. */\nexport function parseRealtimeVoicePricingJson(\n  raw: string | undefined,\n  env = \"live voice pricing JSON\",\n): RealtimeVoicePricing | null {\n  if (raw === undefined || raw.trim() === \"\") return null;\n  const result = RealtimeVoicePricingSchema.safeParse(parseJson(raw, env));\n  if (!result.success) throw new Error(`${env} is invalid: ${issues(result.error)}`);\n  return result.data;\n}\n\n/**\n * Prices keyed by upstream AI Gateway realtime model id, e.g.\n * `{\"openai/gpt-realtime-2.1\":{\"microsPerMinute\":120000,\"marginBps\":500}}`.\n */\nexport function parseRealtimeVoicePricingTableJson(\n  raw: string | undefined,\n  env = \"live voice pricing table JSON\",\n): Record<string, RealtimeVoicePricing> {\n  if (raw === undefined || raw.trim() === \"\") return {};\n  const result = z\n    .record(z.string().min(1).max(256), RealtimeVoicePricingSchema)\n    .safeParse(parseJson(raw, env));\n  if (!result.success) throw new Error(`${env} is invalid: ${issues(result.error)}`);\n  return result.data;\n}\n\n/** Credit price of one started minute, after margin, rounded up to whole micros. */\nexport function realtimeVoiceMinuteCreditMicros(\n  pricing: RealtimeVoicePricing,\n  marginBpsOverride?: number,\n): {\n  providerCostMicros: number;\n  creditCostMicros: number;\n} {\n  const provider = BigInt(pricing.microsPerMinute);\n  const credit =\n    (provider * BigInt(10_000 + (marginBpsOverride ?? pricing.marginBps ?? 0)) + 9_999n) / 10_000n;\n  return { providerCostMicros: Number(provider), creditCostMicros: Number(credit) };\n}\n\n/** Billed minutes for a server-observed interval: every started minute, at least one. */\nexport function realtimeVoiceStartedMinutes(startedAt: Date, observedUntil: Date): number {\n  const elapsed = Math.max(0, observedUntil.getTime() - startedAt.getTime());\n  return Math.max(1, Math.ceil(elapsed / 60_000));\n}\n","import { z } from \"zod\";\n\n/**\n * Provider-agnostic web search: the deployment-funded `web_search` and\n * `web_fetch` agent tools.\n *\n * Hosted search (the provider-executed `web_search` tool of the model's own\n * API) follows the model catalog. Provider search is a separate,\n * deployment-configured HTTP provider that Opengeni calls from the worker.\n * Search and page reading are separate slots; each slot holds an ordered\n * list of providers, and a call moves to the next provider when one fails.\n * By default the provider tools are offered only where the turn has no\n * hosted search (`OPENGENI_WEB_SEARCH_PREFER=native`).\n *\n * Adding a provider means one catalog entry here plus one adapter in\n * `@opengeni/runtime/web-search`.\n */\n\nexport const WEB_SEARCH_PROVIDER_IDS = [\n  \"tinyfish\",\n  \"parallel\",\n  \"perplexity\",\n  \"exa\",\n  \"tavily\",\n  \"firecrawl\",\n  \"brave\",\n  \"jina\",\n  \"searxng\",\n] as const;\nexport type WebSearchProviderId = (typeof WEB_SEARCH_PROVIDER_IDS)[number];\n\n/** Used when `OPENGENI_WEB_SEARCH_PROVIDER` is unset: free with an account key. */\nexport const DEFAULT_WEB_SEARCH_PROVIDER: WebSearchProviderId = \"tinyfish\";\n\n/** Model-visible names of the provider tools. */\nexport const WEB_SEARCH_TOOL_NAME = \"web_search\";\nexport const WEB_FETCH_TOOL_NAME = \"web_fetch\";\nexport type WebSearchProviderToolName = typeof WEB_SEARCH_TOOL_NAME | typeof WEB_FETCH_TOOL_NAME;\n\n/**\n * `native` (default): offer provider tools only to turns without hosted\n * search. `provider`: offer them to every turn and withhold the SDK-hosted\n * `web_search` tool. SuperGrok keeps its transport-level native search either\n * way because Opengeni does not attach it as an agent tool.\n */\nexport const WebSearchPreference = z.enum([\"native\", \"provider\"]);\nexport type WebSearchPreference = z.infer<typeof WebSearchPreference>;\n\n/** One operation (search or page fetch) a provider offers. */\nexport type WebSearchProviderOperation = {\n  /** Pay-as-you-go list price of one successful call, in USD micros. */\n  listPriceMicros: number;\n  /** The operation needs an API key; keyless calls are billed as free. */\n  keyRequired: boolean;\n  /** Default API base URL; null when the operator must supply one. */\n  defaultBaseUrl: string | null;\n};\n\nexport type WebSearchProviderCatalogEntry = {\n  id: WebSearchProviderId;\n  label: string;\n  search: WebSearchProviderOperation | null;\n  fetch: WebSearchProviderOperation | null;\n  /** Where the list price comes from (checked 2026-10). */\n  pricingUrl: string;\n};\n\n/**\n * Every supported provider with its capabilities, default endpoints and\n * list prices. A provider response that reports its own dollar cost (Exa\n * `costDollars`, Tavily `usage.credits`) bills that cost instead, and\n * `OPENGENI_WEB_SEARCH_PRICING_JSON` overrides both.\n */\nexport const WEB_SEARCH_PROVIDER_CATALOG: Readonly<\n  Record<WebSearchProviderId, WebSearchProviderCatalogEntry>\n> = {\n  tinyfish: {\n    id: \"tinyfish\",\n    label: \"TinyFish\",\n    // Search and Fetch are free at any wallet balance, within account rate limits.\n    search: {\n      listPriceMicros: 0,\n      keyRequired: true,\n      defaultBaseUrl: \"https://api.search.tinyfish.ai\",\n    },\n    fetch: {\n      listPriceMicros: 0,\n      keyRequired: true,\n      defaultBaseUrl: \"https://api.fetch.tinyfish.ai\",\n    },\n    pricingUrl: \"https://www.tinyfish.ai/pricing\",\n  },\n  parallel: {\n    id: \"parallel\",\n    label: \"Parallel\",\n    // Search in `fast` mode $1/1k requests; Extract $1/1k URLs.\n    search: {\n      listPriceMicros: 1_000,\n      keyRequired: true,\n      defaultBaseUrl: \"https://api.parallel.ai\",\n    },\n    fetch: { listPriceMicros: 1_000, keyRequired: true, defaultBaseUrl: \"https://api.parallel.ai\" },\n    pricingUrl: \"https://parallel.ai/pricing\",\n  },\n  perplexity: {\n    id: \"perplexity\",\n    label: \"Perplexity\",\n    // Search API with `search_type: \"fast\"`: $1/1k requests.\n    search: {\n      listPriceMicros: 1_000,\n      keyRequired: true,\n      defaultBaseUrl: \"https://api.perplexity.ai\",\n    },\n    fetch: null,\n    pricingUrl: \"https://docs.perplexity.ai/getting-started/pricing\",\n  },\n  exa: {\n    id: \"exa\",\n    label: \"Exa\",\n    // Auto search $7/1k + highlights $1/1k; contents text $1/1k pages.\n    search: { listPriceMicros: 8_000, keyRequired: true, defaultBaseUrl: \"https://api.exa.ai\" },\n    fetch: { listPriceMicros: 1_000, keyRequired: true, defaultBaseUrl: \"https://api.exa.ai\" },\n    pricingUrl: \"https://exa.ai/pricing\",\n  },\n  tavily: {\n    id: \"tavily\",\n    label: \"Tavily\",\n    // Basic search 1 credit, basic extract 1 credit per 5 URLs; $0.008/credit.\n    search: { listPriceMicros: 8_000, keyRequired: true, defaultBaseUrl: \"https://api.tavily.com\" },\n    fetch: { listPriceMicros: 1_600, keyRequired: true, defaultBaseUrl: \"https://api.tavily.com\" },\n    pricingUrl: \"https://docs.tavily.com/documentation/api-credits\",\n  },\n  firecrawl: {\n    id: \"firecrawl\",\n    label: \"Firecrawl\",\n    // 2 credits per 10 results, 1 credit per scrape, at Hobby-plan credit cost.\n    search: {\n      listPriceMicros: 6_400,\n      keyRequired: true,\n      defaultBaseUrl: \"https://api.firecrawl.dev\",\n    },\n    fetch: {\n      listPriceMicros: 3_200,\n      keyRequired: true,\n      defaultBaseUrl: \"https://api.firecrawl.dev\",\n    },\n    pricingUrl: \"https://www.firecrawl.dev/pricing\",\n  },\n  brave: {\n    id: \"brave\",\n    label: \"Brave Search\",\n    // $5 per 1k requests.\n    search: {\n      listPriceMicros: 5_000,\n      keyRequired: true,\n      defaultBaseUrl: \"https://api.search.brave.com\",\n    },\n    fetch: null,\n    pricingUrl: \"https://brave.com/search/api/\",\n  },\n  jina: {\n    id: \"jina\",\n    label: \"Jina\",\n    // At least 10k tokens per search at $0.05/1M; the reader works keyless at\n    // a low per-IP rate and can be self-hosted (set its base URL).\n    search: { listPriceMicros: 500, keyRequired: true, defaultBaseUrl: \"https://s.jina.ai\" },\n    fetch: { listPriceMicros: 250, keyRequired: false, defaultBaseUrl: \"https://r.jina.ai\" },\n    pricingUrl: \"https://jina.ai/reader/\",\n  },\n  searxng: {\n    id: \"searxng\",\n    label: \"SearXNG\",\n    // Self-hosted metasearch; needs the operator's base URL.\n    search: { listPriceMicros: 0, keyRequired: false, defaultBaseUrl: null },\n    fetch: null,\n    pricingUrl: \"https://docs.searxng.org/\",\n  },\n};\n\nfunction envProviderName(id: WebSearchProviderId): string {\n  return id.toUpperCase();\n}\n\n/** Per-provider API key variable, e.g. `OPENGENI_WEB_TINYFISH_API_KEY`. */\nexport function webSearchProviderApiKeyEnv(id: WebSearchProviderId): string {\n  return `OPENGENI_WEB_${envProviderName(id)}_API_KEY`;\n}\n\n/** Per-provider base URL variable, e.g. `OPENGENI_WEB_SEARXNG_BASE_URL`. */\nexport function webSearchProviderBaseUrlEnv(id: WebSearchProviderId): string {\n  return `OPENGENI_WEB_${envProviderName(id)}_BASE_URL`;\n}\n\n/** Every environment variable that configures provider web search. */\nexport function webSearchEnvironmentVariables(): string[] {\n  return [\n    \"OPENGENI_WEB_SEARCH_PROVIDER\",\n    \"OPENGENI_WEB_FETCH_PROVIDER\",\n    \"OPENGENI_WEB_SEARCH_PREFER\",\n    \"OPENGENI_WEB_SEARCH_PRICING_JSON\",\n    \"OPENGENI_WEB_SEARCH_REQUEST_TIMEOUT_MS\",\n    ...WEB_SEARCH_PROVIDER_IDS.flatMap((id) => [\n      webSearchProviderApiKeyEnv(id),\n      webSearchProviderBaseUrlEnv(id),\n    ]),\n    // Earlier single-provider names, still honoured.\n    \"OPENGENI_WEB_SEARCH_API_KEY\",\n    \"OPENGENI_WEB_SEARCH_BASE_URL\",\n    \"OPENGENI_WEB_FETCH_API_KEY\",\n    \"OPENGENI_WEB_FETCH_BASE_URL\",\n    \"OPENGENI_WEB_SEARCH_PROVIDER_MODE\",\n  ];\n}\n\nexport type WebSearchProviderCredentials = Partial<\n  Record<string, { apiKey?: string | undefined; baseUrl?: string | undefined }>\n>;\n\nexport const WebSearchProviderCredentialsSchema = z\n  .record(\n    z.string(),\n    z.object({ apiKey: z.string().optional(), baseUrl: z.string().optional() }).strict(),\n  )\n  .default({});\n\n/** Per-provider keys and base URLs from the environment. */\nexport function webSearchProviderCredentialsFromEnv(\n  source: Record<string, string | undefined>,\n): WebSearchProviderCredentials {\n  const credentials: WebSearchProviderCredentials = {};\n  for (const id of WEB_SEARCH_PROVIDER_IDS) {\n    const apiKey = source[webSearchProviderApiKeyEnv(id)]?.trim();\n    const baseUrl = source[webSearchProviderBaseUrlEnv(id)]?.trim();\n    if (apiKey || baseUrl) {\n      credentials[id] = { ...(apiKey ? { apiKey } : {}), ...(baseUrl ? { baseUrl } : {}) };\n    }\n  }\n  return credentials;\n}\n\n/**\n * Upstream price of one call in integer USD micros, plus the Opengeni\n * margin in basis points (500 = +5%, as for model pricing). Credit billing\n * charges `ceil(providerCost * (10000 + marginBps) / 10000)` per call.\n */\nexport type WebSearchPricing = {\n  searchMicros: number;\n  fetchMicros: number;\n  marginBps?: number | undefined;\n};\n\nconst WebSearchPricingSchema = z\n  .object({\n    searchMicros: z.number().int().nonnegative().max(10_000_000),\n    fetchMicros: z.number().int().nonnegative().max(10_000_000),\n    marginBps: z.number().int().min(0).max(100_000).optional(),\n  })\n  .strict();\n\nconst DEFAULT_MARGIN_BPS = 500;\n\n/** Tavily's pay-as-you-go price of one credit, used for reported usage. */\nexport const TAVILY_CREDIT_MICROS = 8_000;\n\nexport type WebSearchProviderEndpoint = {\n  provider: WebSearchProviderId;\n  apiKey: string | null;\n  baseUrl: string | null;\n};\n\nexport type WebSearchProviderConfig = {\n  preference: WebSearchPreference;\n  /** Search providers in failover order; never empty. */\n  search: WebSearchProviderEndpoint[];\n  /** Page readers in failover order; empty when pages cannot be fetched. */\n  fetch: WebSearchProviderEndpoint[];\n  /** Explicit operator prices by provider, overriding list prices. */\n  pricingOverrides: Partial<Record<WebSearchProviderId, WebSearchPricing>>;\n  /** Deployment-wide margin override for provider-rate credit billing. */\n  creditMarginBpsOverride?: number | undefined;\n  timeoutMs: number;\n};\n\nexport type WebSearchSettings = {\n  webSearchEnabled: boolean;\n  webSearchProvider?: string | undefined;\n  webFetchProvider?: string | undefined;\n  webSearchPrefer?: string | undefined;\n  /** Per-provider keys and base URLs (`OPENGENI_WEB_<PROVIDER>_API_KEY` / `_BASE_URL`). */\n  webSearchProviderCredentials?: WebSearchProviderCredentials | undefined;\n  /** Earlier single-provider settings: apply to the first provider of their slot. */\n  webSearchApiKey?: string | undefined;\n  webSearchBaseUrl?: string | undefined;\n  webFetchApiKey?: string | undefined;\n  webFetchBaseUrl?: string | undefined;\n  webSearchProviderMode?: string | undefined;\n  webSearchPricingJson?: string | undefined;\n  webSearchRequestTimeoutMs?: number | undefined;\n  /** Credit billing is active for this deployment (see webSearchCreditBillingActive). */\n  billingMode?: string | undefined;\n  usageLimitsMode?: string | undefined;\n  creditMarginBpsOverride?: number | undefined;\n};\n\nexport type WebSearchProviderResolution =\n  | { status: \"off\" }\n  | { status: \"invalid\"; reason: string }\n  | { status: \"configured\"; config: WebSearchProviderConfig };\n\nfunction usableSecret(value: string | undefined): string | null {\n  const trimmed = value?.trim();\n  if (!trimmed) return null;\n  // `.env.example` placeholders must never advertise a dead tool.\n  if (/^(your[-_ ]|<|changeme|replace[-_ ]?me|xxx)/iu.test(trimmed)) return null;\n  return trimmed;\n}\n\nfunction normalizedBaseUrl(value: string | undefined, name: string): string | null {\n  const trimmed = value?.trim();\n  if (!trimmed) return null;\n  let url: URL;\n  try {\n    url = new URL(trimmed);\n  } catch (error) {\n    throw new Error(`${name} must be an absolute http(s) URL`, { cause: error });\n  }\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(`${name} must be an absolute http(s) URL`);\n  }\n  if (url.username || url.password) throw new Error(`${name} must not embed credentials`);\n  return url.toString().replace(/\\/+$/u, \"\");\n}\n\nfunction providerList(raw: string, variable: string, operation: \"search\" | \"fetch\") {\n  const ids: WebSearchProviderId[] = [];\n  for (const part of raw.split(\",\")) {\n    const normalized = part.trim().toLowerCase();\n    if (!normalized) continue;\n    const capable = WEB_SEARCH_PROVIDER_IDS.filter(\n      (id) => WEB_SEARCH_PROVIDER_CATALOG[id][operation],\n    );\n    if (!(capable as readonly string[]).includes(normalized)) {\n      throw new Error(\n        `${variable} must be none or a comma-separated list of ${capable.join(\", \")}`,\n      );\n    }\n    if (!ids.includes(normalized as WebSearchProviderId))\n      ids.push(normalized as WebSearchProviderId);\n  }\n  if (ids.length === 0) throw new Error(`${variable} names no provider`);\n  return ids;\n}\n\nfunction preference(settings: WebSearchSettings): WebSearchPreference {\n  const prefer = settings.webSearchPrefer?.trim().toLowerCase();\n  if (prefer) {\n    const parsed = WebSearchPreference.safeParse(prefer);\n    if (!parsed.success) throw new Error(\"OPENGENI_WEB_SEARCH_PREFER must be native or provider\");\n    return parsed.data;\n  }\n  const legacy = settings.webSearchProviderMode?.trim().toLowerCase();\n  if (!legacy || legacy === \"fallback\") return \"native\";\n  if (legacy === \"replace\") return \"provider\";\n  throw new Error(\"OPENGENI_WEB_SEARCH_PROVIDER_MODE must be fallback or replace\");\n}\n\nfunction pricingOverrides(raw: string | undefined): WebSearchProviderConfig[\"pricingOverrides\"] {\n  const trimmed = raw?.trim();\n  if (!trimmed) return {};\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(trimmed);\n  } catch (error) {\n    throw new Error(\"OPENGENI_WEB_SEARCH_PRICING_JSON must be valid JSON\", { cause: error });\n  }\n  const describe = (error: z.ZodError) =>\n    `OPENGENI_WEB_SEARCH_PRICING_JSON is invalid: ${error.issues\n      .map((issue) => `${issue.path.join(\".\") || \"(root)\"}: ${issue.message}`)\n      .join(\"; \")}`;\n  // One flat price applies to every configured provider.\n  if (parsed && typeof parsed === \"object\" && \"searchMicros\" in parsed) {\n    const flat = WebSearchPricingSchema.safeParse(parsed);\n    if (!flat.success) throw new Error(describe(flat.error));\n    return Object.fromEntries(WEB_SEARCH_PROVIDER_IDS.map((id) => [id, flat.data]));\n  }\n  const byProvider = z\n    .record(z.string(), WebSearchPricingSchema)\n    .superRefine((value, context) => {\n      for (const key of Object.keys(value)) {\n        if (!(WEB_SEARCH_PROVIDER_IDS as readonly string[]).includes(key)) {\n          context.addIssue({ code: \"custom\", path: [key], message: \"unknown provider\" });\n        }\n      }\n    })\n    .safeParse(parsed);\n  if (!byProvider.success) throw new Error(describe(byProvider.error));\n  return byProvider.data as WebSearchProviderConfig[\"pricingOverrides\"];\n}\n\n/**\n * Resolve the deployment's provider search. `off` applies when\n * `OPENGENI_WEB_SEARCH_ENABLED=false` (the server-wide web search switch),\n * when the provider is `none`, and when the provider is left at its default\n * (TinyFish) without that provider's key. `invalid` means an operator named\n * providers but the configuration cannot work; the tools stay unoffered and\n * the worker logs the reason.\n */\nexport function resolveWebSearchProvider(settings: WebSearchSettings): WebSearchProviderResolution {\n  const named = settings.webSearchProvider?.trim() ?? \"\";\n  if (!settings.webSearchEnabled || named.toLowerCase() === \"none\") return { status: \"off\" };\n  const credentials = settings.webSearchProviderCredentials ?? {};\n  if (named === \"\") {\n    // The default provider turns on only once its own key is set.\n    if (!usableSecret(credentials[DEFAULT_WEB_SEARCH_PROVIDER]?.apiKey)) return { status: \"off\" };\n  }\n  try {\n    const searchIds = providerList(\n      named || DEFAULT_WEB_SEARCH_PROVIDER,\n      \"OPENGENI_WEB_SEARCH_PROVIDER\",\n      \"search\",\n    );\n    const endpoint = (\n      id: WebSearchProviderId,\n      operation: \"search\" | \"fetch\",\n      legacy: { apiKey: string | undefined; baseUrl: string | undefined; name: string } | null,\n      sameProvider: WebSearchProviderEndpoint | undefined,\n    ): WebSearchProviderEndpoint => {\n      const own = credentials[id];\n      const apiKey =\n        usableSecret(own?.apiKey) ??\n        (legacy ? usableSecret(legacy.apiKey) : null) ??\n        sameProvider?.apiKey ??\n        null;\n      const baseUrl =\n        normalizedBaseUrl(own?.baseUrl, webSearchProviderBaseUrlEnv(id)) ??\n        (legacy ? normalizedBaseUrl(legacy.baseUrl, `${legacy.name}_BASE_URL`) : null) ??\n        sameProvider?.baseUrl ??\n        null;\n      const spec = WEB_SEARCH_PROVIDER_CATALOG[id][operation]!;\n      if (spec.keyRequired && !apiKey) {\n        throw new Error(`${id} ${operation} needs ${webSearchProviderApiKeyEnv(id)}`);\n      }\n      if (!spec.defaultBaseUrl && !baseUrl) {\n        throw new Error(`${id} ${operation} needs ${webSearchProviderBaseUrlEnv(id)}`);\n      }\n      return { provider: id, apiKey, baseUrl };\n    };\n    const search = searchIds.map((id, index) =>\n      endpoint(\n        id,\n        \"search\",\n        index === 0 && named\n          ? {\n              apiKey: settings.webSearchApiKey,\n              baseUrl: settings.webSearchBaseUrl,\n              name: \"OPENGENI_WEB_SEARCH\",\n            }\n          : null,\n        undefined,\n      ),\n    );\n\n    const fetchNamed = settings.webFetchProvider?.trim() ?? \"\";\n    let fetch: WebSearchProviderEndpoint[];\n    if (fetchNamed === \"\") {\n      // Search providers that can also read pages do so, in the same order.\n      fetch = search.flatMap((entry) =>\n        WEB_SEARCH_PROVIDER_CATALOG[entry.provider].fetch ? [entry] : [],\n      );\n    } else if (fetchNamed.toLowerCase() === \"none\") {\n      fetch = [];\n    } else {\n      fetch = providerList(fetchNamed, \"OPENGENI_WEB_FETCH_PROVIDER\", \"fetch\").map((id, index) =>\n        endpoint(\n          id,\n          \"fetch\",\n          index === 0\n            ? {\n                apiKey: settings.webFetchApiKey,\n                baseUrl: settings.webFetchBaseUrl,\n                name: \"OPENGENI_WEB_FETCH\",\n              }\n            : null,\n          search.find((entry) => entry.provider === id),\n        ),\n      );\n    }\n    return {\n      status: \"configured\",\n      config: {\n        preference: preference(settings),\n        search,\n        fetch,\n        pricingOverrides: pricingOverrides(settings.webSearchPricingJson),\n        ...(settings.creditMarginBpsOverride !== undefined\n          ? { creditMarginBpsOverride: settings.creditMarginBpsOverride }\n          : {}),\n        timeoutMs: settings.webSearchRequestTimeoutMs ?? 20_000,\n      },\n    };\n  } catch (error) {\n    return { status: \"invalid\", reason: (error as Error).message };\n  }\n}\n\n/** The configured provider, or null when off or invalid. */\nexport function webSearchProviderConfig(\n  settings: WebSearchSettings,\n): WebSearchProviderConfig | null {\n  const resolution = resolveWebSearchProvider(settings);\n  return resolution.status === \"configured\" ? resolution.config : null;\n}\n\n/**\n * The single web-search plan for one turn, shared by the worker (which tools\n * it attaches) and the API's effective-tools projection (what it reports).\n *\n * `hostedWebSearch` is whether the resolved model attaches the SDK-hosted\n * `web_search` tool. `transportHostedSearch` is true for providers whose native\n * search is added by the transport rather than as an agent tool (SuperGrok).\n */\nexport function webSearchToolPlan(\n  settings: WebSearchSettings,\n  turn: {\n    hostedWebSearch: boolean;\n    transportHostedSearch?: boolean;\n    /**\n     * The workspace turned Opengeni credits off: a provider tool is offered\n     * only when one of its providers is free (admission still refuses paid\n     * calls if the switch flips mid-turn).\n     */\n    creditsDisabled?: boolean;\n  },\n): { hostedWebSearch: boolean; providerTools: WebSearchProviderToolName[] } {\n  const config = webSearchProviderConfig(settings);\n  if (!config || turn.transportHostedSearch) {\n    return { hostedWebSearch: turn.hostedWebSearch, providerTools: [] };\n  }\n  if (config.preference === \"native\" && turn.hostedWebSearch) {\n    return { hostedWebSearch: true, providerTools: [] };\n  }\n  const offered: WebSearchProviderToolName[] =\n    config.fetch.length > 0 ? [WEB_SEARCH_TOOL_NAME, WEB_FETCH_TOOL_NAME] : [WEB_SEARCH_TOOL_NAME];\n  const providerTools = turn.creditsDisabled\n    ? offered.filter((tool) => !webSearchToolSpendsCredits(settings, config, tool))\n    : offered;\n  return {\n    // `provider` withholds hosted search only in favour of a provider tool the\n    // turn actually gets.\n    hostedWebSearch: turn.hostedWebSearch && !providerTools.includes(WEB_SEARCH_TOOL_NAME),\n    providerTools,\n  };\n}\n\n/** Whether this deployment bills web search and fetch in Opengeni credits. */\nexport function webSearchCreditBillingActive(\n  settings: Pick<WebSearchSettings, \"billingMode\" | \"usageLimitsMode\">,\n): boolean {\n  return settings.billingMode === \"stripe\" || settings.usageLimitsMode === \"managed\";\n}\n\n/** Whether every provider of this tool would spend Opengeni credits per call. */\nexport function webSearchToolSpendsCredits(\n  settings: WebSearchSettings,\n  config: WebSearchProviderConfig,\n  tool: WebSearchProviderToolName,\n): boolean {\n  const operation = tool === WEB_SEARCH_TOOL_NAME ? \"search\" : \"fetch\";\n  return (\n    webSearchCreditBillingActive(settings) &&\n    config[operation].every(\n      (endpoint) => webSearchCallPricing(config, endpoint, operation).providerMicros > 0,\n    )\n  );\n}\n\n/** Upstream price for one call to one provider, before any provider-reported cost. */\nexport function webSearchCallPricing(\n  config: Pick<WebSearchProviderConfig, \"pricingOverrides\" | \"creditMarginBpsOverride\">,\n  endpoint: WebSearchProviderEndpoint,\n  operation: \"search\" | \"fetch\",\n): { providerMicros: number; marginBps: number; explicit: boolean } {\n  const override = config.pricingOverrides[endpoint.provider];\n  if (override) {\n    return {\n      providerMicros: operation === \"search\" ? override.searchMicros : override.fetchMicros,\n      marginBps: config.creditMarginBpsOverride ?? override.marginBps ?? DEFAULT_MARGIN_BPS,\n      explicit: true,\n    };\n  }\n  const spec = WEB_SEARCH_PROVIDER_CATALOG[endpoint.provider][operation];\n  // A keyless call (Jina reader, self-hosted SearXNG) costs nothing.\n  return {\n    providerMicros: spec && endpoint.apiKey ? spec.listPriceMicros : 0,\n    marginBps: config.creditMarginBpsOverride ?? DEFAULT_MARGIN_BPS,\n    explicit: false,\n  };\n}\n\n/** Credit cost of a provider cost after margin, rounded up to whole micros. */\nexport function webSearchCreditMicros(providerMicros: number, marginBps: number): number {\n  if (!Number.isSafeInteger(providerMicros) || providerMicros < 0) {\n    throw new Error(\"web search provider cost must be a non-negative safe integer\");\n  }\n  return Number((BigInt(providerMicros) * BigInt(10_000 + marginBps) + 9_999n) / 10_000n);\n}\n","import { PromotionalCreditScope } from \"@opengeni/contracts\";\nimport { z } from \"zod\";\n\nconst ModelIds = PromotionalCreditScope.shape.eligibleModelIds.transform((ids) => [\n  ...new Set(ids),\n]);\n\n/** Operator configuration only. Keys are Stripe coupon IDs, never customer account IDs. */\nexport const CreditPromotionPolicy = z\n  .object({\n    defaultModelIds: ModelIds.optional(),\n    signupModelIds: ModelIds.optional(),\n    offers: z\n      .record(\n        z.string().min(1),\n        z\n          .object({\n            label: PromotionalCreditScope.shape.label,\n            eligibleModelIds: ModelIds.optional(),\n          })\n          .strict(),\n      )\n      .default({}),\n  })\n  .strict()\n  .superRefine((policy, ctx) => {\n    for (const [id, offer] of Object.entries(policy.offers)) {\n      if (!offer.eligibleModelIds && !policy.defaultModelIds) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"offers\", id],\n          message: \"Offer requires eligibleModelIds or defaultModelIds\",\n        });\n      }\n    }\n  });\n\nexport const EnvCreditPromotionPolicy = z.preprocess(\n  (value) => {\n    if (typeof value !== \"string\") return value;\n    try {\n      return JSON.parse(value);\n    } catch {\n      return value;\n    }\n  },\n  CreditPromotionPolicy.default({ offers: {} }),\n);\n\nexport function signupCreditModelIds(settings: {\n  creditPromotionPolicy: z.infer<typeof CreditPromotionPolicy>;\n}) {\n  return (\n    settings.creditPromotionPolicy.signupModelIds ?? settings.creditPromotionPolicy.defaultModelIds\n  );\n}\n\nexport function promotionalCreditScope(\n  settings: { creditPromotionPolicy: z.infer<typeof CreditPromotionPolicy> },\n  couponId: string,\n): PromotionalCreditScope | undefined {\n  const policy = settings.creditPromotionPolicy;\n  const offer = policy.offers[couponId];\n  const eligibleModelIds = offer?.eligibleModelIds ?? policy.defaultModelIds;\n  return eligibleModelIds\n    ? { label: offer?.label ?? \"Promotional credits\", eligibleModelIds }\n    : undefined;\n}\n","import {\n  DEFAULT_OPENROUTER_MODEL_ID,\n  DEFAULT_MODEL_COST_POLICY_JSON,\n  DEFAULT_GOAL_IDLE_BACKOFF_MS,\n  DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS,\n  DEFAULT_AGENT_INSTRUCTIONS,\n} from \"./defaults\";\nexport {\n  DEFAULT_OPENROUTER_MODEL_ID,\n  DEFAULT_MODEL_COST_POLICY_JSON,\n  DEFAULT_GOAL_IDLE_BACKOFF_MS,\n  DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS,\n  AGENT_INSTRUCTIONS_CORE_PLACEHOLDER,\n  DEFAULT_AGENT_INSTRUCTIONS,\n} from \"./defaults\";\nexport { managedUserEmailAllowed } from \"./managed-user-admission\";\nexport * from \"./realtime-voice-pricing\";\nexport * from \"./web-search\";\nimport {\n  WebSearchProviderCredentialsSchema,\n  webSearchProviderCredentialsFromEnv,\n} from \"./web-search\";\nimport { EnvCreditPromotionPolicy } from \"./credit-promotions\";\nexport {\n  CreditPromotionPolicy,\n  signupCreditModelIds,\n  promotionalCreditScope,\n} from \"./credit-promotions\";\nimport { isRetiredNativeAtlassianTool } from \"@opengeni/contracts/atlassian-native-retirement\";\nimport { modelLogoUrl } from \"@opengeni/contracts/model-display\";\nimport {\n  directModelConnectionSpec,\n  BillingMode,\n  CAPABILITY_DESCRIPTORS,\n  agentConfigDeploymentLimitsFromAllowlist,\n  agentConfigFirstPartyMcpTools,\n  type AgentConfigDeploymentLimits,\n  DEFAULT_FIRST_PARTY_MCP_TOOLS,\n  DEFAULT_OPENGENI_DOCUMENTATION_URL,\n  currentAgentLearningToolSelection,\n  resolveWorkspaceSessionToolDefaults,\n  workspaceModelCompactionThreshold,\n  organizationModelCompactionThreshold,\n  type OrganizationModelDefaults,\n  type ModelCompactionPolicy,\n  Entitlements,\n  EntitlementsMode,\n  KnowledgeSourceSyncLimits,\n  LatencyMode,\n  MAX_NESTED_AGENT_DEPTH,\n  McpServerConnectionRef as PublicMcpServerConnectionRef,\n  ProductAccessMode,\n  ReasoningEffort,\n  FIRST_PARTY_MCP_TOOL_NAMES,\n  FirstPartyMcpToolName,\n  normalizeSitesDomain,\n  OpenGeniSlackBotDisplayName,\n  SandboxBackend,\n  SessionMcpApprovalPolicy,\n  SEEDANCE_2_5_MODEL_ID,\n  StaticUsageLimits,\n  TurnExecutionPolicyV1,\n  TurnServingPolicyV1,\n  UsageLimitsMode,\n  type TurnExecutionLatencyModeSourceV1,\n  type TurnExecutionModelSourceV1,\n  type TurnExecutionReasoningSourceV1,\n  type VideoGenerationResolution,\n  type FirstPartyMcpToolName as FirstPartyMcpToolNameType,\n  type Session,\n} from \"@opengeni/contracts\";\nimport type { CodeSearchDeploymentPolicy } from \"@opengeni/contracts/code-search\";\nimport { CODEX_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS } from \"@opengeni/codex\";\nimport {\n  CODEX_FALLBACK_MODEL_SLUGS,\n  CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT,\n  CODEX_MODEL_CONTEXT_WINDOW_TOKENS,\n  CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,\n  CODEX_MODEL_ID_PREFIX,\n  CODEX_PROVIDER_BASE_URL,\n  CODEX_PROVIDER_ID,\n} from \"@opengeni/codex/constants\";\nimport {\n  XAI_SUBSCRIPTION_MODEL_SLUGS,\n  XAI_SUBSCRIPTION_MODEL_AUTO_COMPACT_TOKEN_LIMIT,\n  XAI_SUBSCRIPTION_MODEL_CONTEXT_WINDOW_TOKENS,\n  XAI_SUBSCRIPTION_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,\n  XAI_SUBSCRIPTION_MODEL_ID_PREFIX,\n  XAI_SUBSCRIPTION_PROVIDER_ID,\n  XAI_SUBSCRIPTION_PROXY_BASE_URL,\n  XAI_RESPONSE_STREAM_IDLE_TIMEOUT_MS,\n} from \"@opengeni/xai-subscription\";\nexport { XAI_SUBSCRIPTION_MODEL_ID_PREFIX } from \"@opengeni/xai-subscription\";\nimport { createHash } from \"node:crypto\";\nimport { isIP } from \"node:net\";\nimport { z } from \"zod\";\n\n/**\n * Default maximum provider silence on a generic OpenAI-compatible model stream\n * while the worker is waiting for the next chunk. Matches the Codex transport\n * and SuperGrok idle defaults (5 minutes): long enough for a reasoning model's\n * silent thinking gaps, short enough that a wedged stream recovers the same\n * turn instead of hanging until a worker roll.\n */\nexport const DEFAULT_MODEL_STREAM_IDLE_TIMEOUT_MS = 300_000;\n/**\n * Default maximum wait across keepalive-only traffic (SSE comments, `ping` /\n * `keepalive` events, repeated `response.in_progress`) for the next\n * model-progress event on a generic model stream. A provider can keep a\n * connection alive while its generation is wedged; this bounds that case.\n * Ten minutes leaves room for a reasoning model's longest silent thinking\n * window (reasoning summaries stream as progress).\n */\nexport const DEFAULT_MODEL_STREAM_PROGRESS_TIMEOUT_MS = 600_000;\n\nconst envName = /^[A-Za-z_][A-Za-z0-9_]*$/;\nconst registryId = /^[A-Za-z0-9_-]+$/;\n\n// Archive capture claims are also the admission/teardown fence around a\n// provider snapshot. Keep a real settlement window after the provider request;\n// a configured request timeout may never consume the entire durable claim.\nexport const SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS = 60 * 60_000;\nexport const SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS = 10_000;\n// Deadline rotation gives retained legacy commands a bounded stop window\n// before capturing the still-running sandbox's current files.\nexport const SANDBOX_DEADLINE_COMMAND_STOP_GRACE_MS = 120_000;\nexport const SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS =\n  SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS - SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS;\nexport const GOOGLE_DRIVE_PROVIDER_REQUEST_TIMEOUT_MAX_MS = 60_000;\nexport const GOOGLE_DRIVE_PROVIDER_RETRY_DELAY_MAX_MS = 60_000;\n// Admission waits are observational: successful capture/teardown returns as\n// soon as the DB fence clears. This ceiling only covers the unhealthy path. It\n// allows one scheduled inventory and one complete successor claim without\n// turning a recoverable lifecycle transition into a visible caller error. A\n// dead holder's TTL is deliberately NOT included: admission cannot accelerate\n// that proof, and the turn moves to durable recovery if holder quiescence takes\n// longer than this observational wait. The outer cap remains an explicit\n// request-resource boundary; successful transitions return immediately.\nexport const SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS = 60 * 60_000;\nexport const SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS = 10_000;\nconst EnvBoolean = z.preprocess((value) => {\n  if (typeof value !== \"string\") {\n    return value;\n  }\n  const normalized = value.trim().toLowerCase();\n  if ([\"true\", \"1\", \"yes\", \"y\", \"on\"].includes(normalized)) {\n    return true;\n  }\n  if ([\"false\", \"0\", \"no\", \"n\", \"off\"].includes(normalized)) {\n    return false;\n  }\n  return value;\n}, z.boolean());\n\n/** An absolute http(s) URL that is safe to render as a browser link. */\nconst PublicHttpUrl = z\n  .string()\n  .url()\n  .max(2_048)\n  .refine((value) => /^https?:\\/\\//iu.test(value), \"must be an http(s) URL\");\n\nconst EnvGoalIdleBackoffMs = z.preprocess((value) => {\n  if (typeof value !== \"string\") return value;\n  const source = value.trim();\n  if (!source) return undefined;\n  return source.split(\",\").map((entry) => {\n    const trimmed = entry.trim();\n    return trimmed === \"\" ? Number.NaN : Number(trimmed);\n  });\n}, z.array(z.number().int().nonnegative()).min(1, \"OPENGENI_GOAL_IDLE_BACKOFF_MS must list at least one delay in milliseconds\").readonly());\n\n/** Comma-separated Modal region selectors (for example `eu` or\n * `us-east-1,us-west-2`). Blank or unset keeps Modal's own placement. */\nconst EnvModalRegions = z.preprocess(\n  (value) => {\n    if (typeof value !== \"string\") return value;\n    const source = value.trim();\n    if (!source) return undefined;\n    return source.split(\",\").map((entry) => entry.trim().toLowerCase());\n  },\n  z\n    .array(\n      z\n        .string()\n        .regex(\n          /^[a-z][a-z0-9-]{0,62}$/u,\n          \"OPENGENI_MODAL_REGIONS entries must be Modal region names such as eu or us-east-1\",\n        ),\n    )\n    .min(1)\n    .refine((regions) => new Set(regions).size === regions.length, {\n      message: \"OPENGENI_MODAL_REGIONS must not repeat a region\",\n    })\n    .readonly()\n    .optional(),\n);\n\n/** `{\"<workspace id>\": bytes}`: per-workspace retained-image limits. */\nconst EnvRetainedImageWorkspaceQuotaOverrides = z.preprocess(\n  (value) => {\n    if (typeof value !== \"string\") return value;\n    const source = value.trim();\n    if (!source) return undefined;\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(source);\n    } catch {\n      return value;\n    }\n    if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) return parsed;\n    return Object.fromEntries(\n      Object.entries(parsed).map(([workspaceId, bytes]) => [workspaceId.toLowerCase(), bytes]),\n    );\n  },\n  z\n    .record(z.string().uuid(), z.coerce.number().int().positive().max(Number.MAX_SAFE_INTEGER))\n    .default({}),\n);\n\n/** The retained-image byte limit for one workspace: its override, else the deployment default. */\nexport function retainedImageWorkspaceQuotaBytes(\n  settings: Pick<\n    Settings,\n    \"retainedImageWorkspaceQuotaBytes\" | \"retainedImageWorkspaceQuotaOverrides\"\n  >,\n  workspaceId: string,\n): number {\n  return (\n    settings.retainedImageWorkspaceQuotaOverrides[workspaceId.toLowerCase()] ??\n    settings.retainedImageWorkspaceQuotaBytes\n  );\n}\n\nconst EnvFirstPartyMcpTools = z.preprocess(\n  (value) => {\n    if (typeof value !== \"string\") return value;\n    const source = value.trim();\n    if (!source) return undefined;\n    if (source.startsWith(\"[\")) {\n      try {\n        return JSON.parse(source);\n      } catch {\n        return value;\n      }\n    }\n    return source.split(\",\").map((entry) => entry.trim());\n  },\n  z\n    .array(FirstPartyMcpToolName)\n    .superRefine((tools, context) => {\n      const seen = new Set<FirstPartyMcpToolNameType>();\n      for (const [index, tool] of tools.entries()) {\n        if (seen.has(tool)) {\n          context.addIssue({\n            code: \"custom\",\n            message: \"first-party MCP tool lists must not contain duplicates\",\n            path: [index],\n          });\n        }\n        seen.add(tool);\n      }\n    })\n    .optional(),\n);\n\nexport const sandboxPreparationProfiles: Record<string, { env: string[]; hooks: string[] }> = {\n  none: {\n    env: [],\n    hooks: [],\n  },\n  azure: {\n    env: [\n      \"ARM_CLIENT_ID\",\n      \"ARM_CLIENT_SECRET\",\n      \"ARM_TENANT_ID\",\n      \"ARM_SUBSCRIPTION_ID\",\n      \"AZURE_CLIENT_ID\",\n      \"AZURE_CLIENT_SECRET\",\n      \"AZURE_TENANT_ID\",\n      \"AZURE_SUBSCRIPTION_ID\",\n      \"AZURE_AUTHORITY_HOST\",\n    ],\n    hooks: [\"azure-cli-login\"],\n  },\n  github: {\n    env: [\n      \"GH_TOKEN\",\n      \"GITHUB_TOKEN\",\n      \"GIT_AUTHOR_NAME\",\n      \"GIT_AUTHOR_EMAIL\",\n      \"GIT_COMMITTER_NAME\",\n      \"GIT_COMMITTER_EMAIL\",\n    ],\n    hooks: [],\n  },\n};\n\n// Configuration and public session attachments share one authority contract.\nexport const McpServerConnectionRefSchema = PublicMcpServerConnectionRef;\nexport type McpServerConnectionRef = z.infer<typeof McpServerConnectionRefSchema>;\n\n/** Operator-owned protocol binding. Tool annotations cannot establish recovery. */\nexport const McpOperationRecoverySchema = z\n  .record(\n    z.string().min(1).max(512).regex(/^\\S+$/u),\n    z.object({ observerTool: z.string().min(1).max(512).regex(/^\\S+$/u) }).strict(),\n  )\n  .superRefine((bindings, context) => {\n    for (const [originalTool, binding] of Object.entries(bindings)) {\n      if (originalTool === binding.observerTool) {\n        context.addIssue({\n          code: \"custom\",\n          path: [originalTool, \"observerTool\"],\n          message: \"MCP recovery observer must differ from the original tool\",\n        });\n      }\n    }\n  });\n\n/** Public, digest-pinned desktop image used by Modal unless the operator overrides it. */\nexport const DEFAULT_MODAL_IMAGE_REF =\n  \"opengenipublicneuacr.azurecr.io/opengeni-desktop@sha256:5bb54a1a6d0c6e99f058290718e55c13193fde3dcbcb54568ce95ddef0768805\";\n\nconst SettingsSchema = z.object({\n  serviceName: z.string().default(\"opengeni\"),\n  environment: z.string().default(\"local\"),\n  deploymentRevision: z.string().default(\"dev\"),\n  // The release-train version baked into official images (OPENGENI_SERVER_VERSION).\n  // Absent on dev/source builds — consumers must treat it as optional.\n  serverVersion: z.string().optional(),\n  databaseUrl: z.string().default(\"postgres://opengeni:opengeni@127.0.0.1:5432/opengeni\"),\n  // LISTEN needs a session-pinned connection. Direct deployments reuse the\n  // ordinary URL; transaction poolers supply this separate direct endpoint.\n  databaseNotificationUrl: z.string().optional(),\n  // API application pool only. Managed auth owns its separate pool; readiness\n  // reuses the application handle. Keep the historical default for existing\n  // deployments and let operators budget this per process with replica counts.\n  apiDatabasePoolMax: z.coerce.number().int().positive().default(32),\n  // Named prepared statements for the application database pools. Unset → on\n  // for direct connections and off when the URL targets port 6432 (PgBouncer's\n  // port, including Azure Flexible Server's built-in pooler). Set false for any\n  // other transaction-pooling proxy; set true to force them on.\n  databasePreparedStatements: EnvBoolean.optional(),\n  // Step I (§7.8 runtime half). Dedicated Postgres schema for the EMBEDDED\n  // topology. Default \"\" → standalone: no search_path scoping, server default\n  // (`public`). When set (e.g. \"opengeni\"), the db handle + the managed-auth\n  // pool send `search_path = \"<dbSchema>\",\"opengeni_private\",\"public\"` so every\n  // query resolves into the dedicated schema with NO query rewrite (schema-isolation contract F1).\n  dbSchema: z.string().default(\"\"),\n  // Step I (§7.7). RLS posture. \"force\" (default) = today's FORCE-RLS via the\n  // non-owner `opengeni_app` role. \"scoped\" = the embedded owner-role path (the\n  // GUC is still emitted defensively, so the query path is identical).\n  rlsStrategy: z.enum([\"force\", \"scoped\"]).default(\"force\"),\n  // Exact PostgreSQL login identity required by the standalone FORCE-RLS\n  // startup/readiness assertion. Embedded `scoped` hosts own their role model\n  // and are deliberately not constrained to this name.\n  runtimeDatabaseRole: z.string().min(1).default(\"opengeni_app\"),\n  natsUrl: z.string().default(\"nats://127.0.0.1:4222\"),\n  temporalHost: z.string().default(\"127.0.0.1:7233\"),\n  temporalNamespace: z.string().default(\"default\"),\n  temporalTaskQueue: z.string().default(\"opengeni-runs-ts\"),\n  temporalTlsEnabled: EnvBoolean.default(false),\n  temporalApiKey: z.string().optional(),\n  temporalTlsServerName: z.string().optional(),\n  temporalTlsRootCaCertificateBase64: z.string().optional(),\n  temporalTlsClientCertificateBase64: z.string().optional(),\n  temporalTlsClientPrivateKeyBase64: z.string().optional(),\n  startupDependencyRetryAttempts: z.coerce.number().int().positive().default(30),\n  startupDependencyRetryInitialDelayMs: z.coerce.number().int().positive().default(1000),\n  startupDependencyRetryMaxDelayMs: z.coerce.number().int().positive().default(5000),\n  turnWorkerConcurrencyMode: z.enum([\"fixed\", \"resource-based\"]).default(\"fixed\"),\n  turnWorkerMaxConcurrentTurns: z.coerce.number().int().positive().max(2_000).default(16),\n  turnWorkerTargetCpuUsage: z.coerce.number().positive().max(1).default(0.8),\n  turnWorkerTargetMemoryUsage: z.coerce.number().positive().max(0.8).default(0.75),\n  // Admission and emergency recovery are deliberately separate control loops.\n  // The Temporal tuner stops polling at the lower target; only genuine danger\n  // may invoke the disruptive graceful-drain fallback.\n  turnWorkerEmergencyMemoryUsage: z.coerce.number().min(0.85).max(0.95).default(0.9),\n  turnWorkerMemoryGuardIntervalMs: z.coerce.number().int().min(1_000).max(60_000).default(5_000),\n  turnWorkerMemoryGuardSustainMs: z.coerce.number().int().min(5_000).max(300_000).default(30_000),\n  observabilityStructuredLogs: EnvBoolean.default(false),\n  observabilityMetricsEnabled: EnvBoolean.default(true),\n  observabilityOtlpEndpoint: z.string().url().optional(),\n  observabilityOtlpHeaders: z.string().default(\"\"),\n  observabilityDiagnosticsEndpoint: z.string().url().optional(),\n  observabilityDiagnosticsHeaders: z.string().default(\"\"),\n  analyticsEnabled: EnvBoolean.default(false),\n  analyticsConsentRequired: EnvBoolean.default(true),\n  analyticsReoClientId: z\n    .string()\n    .max(128)\n    .regex(/^[A-Za-z0-9_-]+$/u)\n    .optional(),\n  analyticsPosthogProjectKey: z.string().min(1).max(256).optional(),\n  analyticsPosthogHost: z.string().url().max(2_048).optional(),\n  analyticsGa4MeasurementId: z\n    .string()\n    .max(32)\n    .regex(/^G-[A-Z0-9]+$/u)\n    .optional(),\n  // Optional operator-owned legal documents linked from the signed-out console.\n  // Unset by default, so a self-hosted deployment never shows another operator's\n  // policies; the managed service points these at its own published pages.\n  legalPrivacyPolicyUrl: PublicHttpUrl.optional(),\n  legalTermsOfServiceUrl: PublicHttpUrl.optional(),\n  // Optional operator support address, shown as a \"Contact support\" mailto link\n  // on the signed-out page and in the Help menu. Unset by default for the same\n  // reason as the legal links.\n  supportEmail: z.string().trim().email().max(254).optional(),\n  publicBaseUrl: z.string().url().optional(),\n  // Product documentation the web console links from its Help menu. Absent\n  // means the public Opengeni docs; `none` hides the link for deployments that\n  // publish no documentation of their own.\n  documentationUrl: z.preprocess(\n    (value) =>\n      typeof value === \"string\"\n        ? value.trim().toLowerCase() === \"none\"\n          ? null\n          : value.trim()\n        : value,\n    z\n      .url({ protocol: /^https?$/u, error: \"must be an absolute http(s) URL or none\" })\n      .nullable()\n      .default(DEFAULT_OPENGENI_DOCUMENTATION_URL),\n  ),\n  // Standards-based OAuth authorization server for external workspace MCP\n  // clients. Opt-in because it creates a new public authentication surface.\n  mcpOauthEnabled: EnvBoolean.default(false),\n  // Client source address for every API rate limit, abuse quota, and auth\n  // session record (Better Auth, MCP OAuth registration, enrollment, account\n  // setup, login transactions). Forwarded client addresses are ignored by\n  // default so a caller cannot choose its own bucket. Operators may trust an\n  // exact number of proxy hops only when direct access to the API is blocked.\n  apiTrustedProxyHops: z.coerce.number().int().min(0).max(16).default(0),\n  // Optional comma-separated CIDRs (or single addresses) of the proxy that\n  // connects to the API. When set, forwarded client addresses are honored\n  // only for requests whose transport peer is inside one of them.\n  apiTrustedProxyCidrs: z.string().default(\"\"),\n  // Browser origin when the web app and API use separate origins in local\n  // development. Production normally leaves this unset and uses publicBaseUrl.\n  webBaseUrl: z.string().url().optional(),\n  // The Excel add-in people connect workbooks with, as agents name it to them\n  // (\"open the <name> add-in\"), and the page that shows how to add it. A\n  // product that ships its own branded add-in sets both; otherwise agents name\n  // Opengeni's and link this deployment's web app page.\n  officeAddinName: z.string().trim().min(1).max(80).default(\"Opengeni\"),\n  officeAddinInstallUrl: z.string().url().optional(),\n  // Base URL for the bring-your-own-compute agent release assets the get.<domain>\n  // install routes redirect to. Defaults to this repo's GitHub Releases. The route\n  // appends `/download/agent-v<ver>/<asset>`.\n  agentReleasesBaseUrl: z\n    .string()\n    .url()\n    .default(\"https://github.com/Cloudgeni-ai/opengeni/releases\"),\n  // Explicit operator-controlled promotion pointer for `/agent/latest/*`.\n  // Versioned agent releases are immutable; changing this setting promotes or\n  // rolls back the stable channel without moving or deleting a provider tag.\n  agentStableVersion: z\n    .string()\n    .regex(/^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$/u)\n    .default(\"0.1.54\"),\n  // Optional pin for the desktop app served by /desktop/latest/*. When unset,\n  // the newest desktop-v release on the agent release repository is served.\n  desktopStableVersion: z\n    .string()\n    .regex(/^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$/u)\n    .optional(),\n  // Optional independent beta-channel pointer. When unset, the beta update\n  // manifest route is unavailable rather than silently serving stable.\n  agentBetaVersion: z\n    .string()\n    .regex(/^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$/u)\n    .optional(),\n  // Bring every live Connected Machine to its channel's promoted build without\n  // a click. The agent applies an update only at an idle point, so this never\n  // interrupts accepted work; a busy machine is retried until it can apply.\n  agentAutoUpdate: EnvBoolean.default(true),\n  productAccessMode: ProductAccessMode.default(\"local\"),\n  billingMode: BillingMode.default(\"disabled\"),\n  // Explicit launch gate for the one-time $10 verified self-service signup grant.\n  // A migration or deployment alone must not start issuing live credits.\n  // Legacy pre-0845 money switch; current signup eligibility is unconditional\n  // and zero-valued. Kept for compatibility with existing deployment config.\n  verifiedSignupTrialCreditsEnabled: EnvBoolean.default(false),\n  creditPromotionPolicy: EnvCreditPromotionPolicy,\n  entitlementsMode: EntitlementsMode.default(\"none\"),\n  usageLimitsMode: UsageLimitsMode.default(\"none\"),\n  // Gate new allowance policies until every API/worker in the fleet enforces\n  // them. Persisted-policy enforcement and recovery reads/clears stay active.\n  usageAllowancesEnabled: EnvBoolean.default(false),\n  staticEntitlementsJson: z.string().default(\"{}\"),\n  staticUsageLimitsJson: z.string().default(\"{}\"),\n  delegationSecret: z.string().optional(),\n  defaultFirstPartyMcpTools: EnvFirstPartyMcpTools,\n  allowedFirstPartyMcpTools: EnvFirstPartyMcpTools,\n  // Deployment fact: the isolated artifact materializer workload runs and\n  // drains export jobs. Without it an export is queued forever, so the export\n  // tools leave the first-party ceiling. Helm sets this from\n  // artifactMaterializer.enabled.\n  artifactMaterializerDeployed: EnvBoolean.default(false),\n  // sandbox workspace scoped stream-token HMAC secret (sandbox contract §C.3 / stream-token availability contract).\n  // When unset, the API falls back to `delegationSecret` (the same HMAC envelope\n  // family, `ogs_` vs `ogd_` prefix). REQUIRED-WHEN-DESKTOP, but the absence of\n  // BOTH while sandboxDesktopEnabled=true is a GRACEFUL DEGRADE (DesktopStream\n  // transport:null + a loud boot warning), NOT a hard boot-fail (stream-token availability contract).\n  streamTokenSecret: z.string().optional(),\n  // The desktop input plane (raw stream:control writes) is OFF in v1: even a\n  // holder of stream:control gets 403 until this flips. Keeps stream:control a\n  // declared-but-inert permission so later hardening is a flag flip.\n  streamControlEnabled: EnvBoolean.default(false),\n  // Provider-neutral advisory work discovery rollout. Disabling this keeps\n  // ordinary session listings available while rejecting relevance discovery\n  // and omitting claim evidence from their compact projections.\n  workDiscoveryEnabled: EnvBoolean.default(true),\n  // Exact-attempt claim mutations are independently reversible. Turning this\n  // off removes the first-party mutation tools; durable claims and lifecycle\n  // settlement evidence remain readable.\n  workClaimMutationsEnabled: EnvBoolean.default(true),\n  // Human presentation is a separate rollout stage from the read API. The\n  // topology response carries this decision so clients can hide advisory UI\n  // without inventing authorization or ownership semantics.\n  workDiscoveryHumanAdvisoriesEnabled: EnvBoolean.default(true),\n  // Automatic overlap nudges are deliberately unshipped and default OFF until\n  // an evaluated precision threshold and operator runbook approve them.\n  workDiscoveryAutomaticNudgesEnabled: EnvBoolean.default(false),\n  // Optional release-coherent bootstrap hint for custom rigs/connected machines\n  // that do not carry the stock-image ogtool binary. Exact stable versions only:\n  // the agent must never guess a tag or silently install `latest`.\n  ogtoolPackageSpec: z\n    .string()\n    .regex(/^@opengeni\\/ogtool@(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$/u)\n    .optional(),\n  environmentsEncryptionKey: z.string().optional(),\n  // Dev/seed only: accept the `ops_fake_healthy` / `ops_fake_sync_error`\n  // 1Password tokens, backed by the in-memory fake provider. The managed\n  // product posture refuses to start with it set (OP-7).\n  onePasswordFakeTokens: EnvBoolean.default(false),\n  // Operator-installed official pass-cli; never auto-download or resolve an\n  // agent-controlled executable from PATH. The adapter verifies its version.\n  protonPassCliPath: z\n    .string()\n    .trim()\n    .min(1)\n    .max(1_024)\n    .refine(\n      (value) => value.startsWith(\"/\") || /^[a-z]:[\\\\/]/i.test(value),\n      \"Proton Pass CLI path must be absolute\",\n    )\n    .optional(),\n  integrationsEnabled: EnvBoolean.default(false),\n  integrationsStateSecret: z.string().optional(),\n  integrationsAllowPrivateNetworkTargets: EnvBoolean.default(false),\n  // Privacy limits a deployment (for example a product that embeds Opengeni)\n  // sets for every organization. They only narrow what organizations choose:\n  // Only me chats and schedules off in shared workspaces, new chats and\n  // schedules always starting as Workspace, and admins always seeing that\n  // other people's Only me schedules exist.\n  privacyOnlyMeAllowed: EnvBoolean.default(true),\n  privacyWorkspaceDefaultRequired: EnvBoolean.default(false),\n  privacyAdminScheduleSummariesRequired: EnvBoolean.default(false),\n  integrationsOauthClientsJson: z.string().default(\"{}\"),\n  gmailWatchTopicName: z\n    .string()\n    .regex(/^projects\\/[^/]+\\/topics\\/[^/]+$/u)\n    .optional(),\n  slackClientId: z.string().optional(),\n  slackClientSecret: z.string().optional(),\n  slackSigningSecret: z.string().optional(),\n  // Unlisted apps share Slack’s restricted history/replies quota across all tokens.\n  slackAccessMode: z.enum([\"limited\", \"full\"]).default(\"limited\"),\n  slackBotDisplayName: OpenGeniSlackBotDisplayName.default(\"Opengeni\"),\n  slackCommand: z\n    .string()\n    .trim()\n    .regex(/^\\/[a-z0-9_-]{1,31}$/u)\n    .default(\"/opengeni\"),\n  googleDriveClientId: z.string().optional(),\n  googleDriveClientSecret: z.string().optional(),\n  googleDriveSyncMaxItems: z.coerce.number().int().positive().max(10_000).default(500),\n  googleDriveSyncMaxBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(5_000_000_000)\n    .default(500_000_000),\n  googleDriveSyncMaxFileBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(5_000_000_000)\n    .default(100_000_000),\n  googleDriveSyncMaxProviderRequests: z.coerce.number().int().positive().max(10_000).default(1_000),\n  googleDriveSyncMaxElapsedSeconds: z.coerce.number().int().positive().max(3_600).default(300),\n  googleDriveSyncMaxFailureDetails: z.coerce.number().int().positive().max(100).default(25),\n  googleDriveProviderRequestTimeoutMs: z.coerce\n    .number()\n    .int()\n    .min(1_000)\n    .max(GOOGLE_DRIVE_PROVIDER_REQUEST_TIMEOUT_MAX_MS)\n    .default(30_000),\n  googleDriveProviderRetryAttempts: z.coerce.number().int().min(1).max(5).default(3),\n  googleDriveProviderRetryInitialDelayMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(30_000)\n    .default(250),\n  googleDriveProviderRetryMaxDelayMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(GOOGLE_DRIVE_PROVIDER_RETRY_DELAY_MAX_MS)\n    .default(5_000),\n  googleDriveProviderRetryBudgetMs: z.coerce.number().int().positive().max(120_000).default(15_000),\n  fikenClientId: z.string().optional(),\n  fikenClientSecret: z.string().optional(),\n  googleDriveWorkspaceEventsEnabled: EnvBoolean.optional(),\n  atlassianClientId: z.string().optional(),\n  atlassianClientSecret: z.string().optional(),\n  // Undefined is meaningful: the migration boundary persists the product\n  // default of 3 when no deployment override is supplied.\n  maxNestedAgentDepth: z.coerce.number().int().nonnegative().max(MAX_NESTED_AGENT_DEPTH).optional(),\n  // Operator OAuth apps for first-party social connectors, keyed by provider\n  // id (\"x\", \"reddit\"): {\"x\":{\"clientId\":\"...\",\"clientSecret\":\"...\"}}.\n  socialOauthClientsJson: z.string().default(\"{}\"),\n  // Session goal guard rails. Goals are designed for runs that legitimately\n  // span days, so length is bounded by explicit completion/pause and budget\n  // exhaustion, never by count. goalMaxAutoContinuations is therefore UNSET\n  // by default (no cap); deployments may configure one, and it then acts as a\n  // hard ceiling that per-goal overrides can only lower.\n  goalMaxAutoContinuations: z.coerce.number().int().positive().optional(),\n  // Idle backoff between CONSECUTIVE no-input goal continuations. This is\n  // pacing, not a cap: the first continuation after a turn that consumed any\n  // external input is immediate, the n-th consecutive no-input continuation\n  // waits schedule[min(n - 1, last)] ms after the previous one finished, and\n  // any new input (machine input, human/API prompt, Steer) wakes the session\n  // immediately. The delay never exceeds goalIdleBackoffMaxMs.\n  goalIdleBackoffMs: EnvGoalIdleBackoffMs.default(DEFAULT_GOAL_IDLE_BACKOFF_MS),\n  goalIdleBackoffMaxMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .default(DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS),\n  // Child lifecycle notices: a child session's requires_action freeze, its\n  // resolution, a direct Pause, a provider-capacity wait, and goal progress\n  // become typed `session_system_updates` rows for the parent (in addition to\n  // `child_terminal_result`). Rolling hazard: a pre-notice worker throws on an\n  // unknown update kind, so enable only once the whole fleet runs an image\n  // that understands the new kinds. Once the flag has produced rows, a\n  // pre-notice image must never restart while any new-kind row is still\n  // pending (session_system_updates or session_system_update_outbox); turning\n  // the flag back off stops production but does not drain already committed\n  // rows. Default off. The API and both workers install the validated value\n  // into @opengeni/db once at boot.\n  // Env: OPENGENI_CHILD_LIFECYCLE_NOTICES_ENABLED.\n  childLifecycleNoticesEnabled: EnvBoolean.default(false),\n  // Per-task (root session) API-equivalent usage limits: producer\n  // flag only. Off (default) rejects NEW non-null limits on create and on the\n  // usage-limit route and hides the editor; limits already persisted are still\n  // metered and enforced, and clearing stays allowed. Metering and enforcement\n  // never depend on this flag. Enable only after every API, worker, web, SDK\n  // and embedded host consumer runs an image that understands the\n  // `session_usage_limit` stop and goal reason.\n  // Env: OPENGENI_SESSION_USAGE_LIMITS_ENABLED.\n  sessionUsageLimitsEnabled: EnvBoolean.default(false),\n  // Per-channel and per-DM Slack workspace routing. Default ON. A channel does\n  // not count a personal workspace as a candidate, so an organization with one\n  // shared workspace resolves it as the sole candidate and never asks; the\n  // visible change is confined to organizations that genuinely have more than\n  // one - plus one case worth knowing before an upgrade: a person who has lost\n  // live authority now receives a posted refusal where the pre-routing code\n  // failed silently. Set the env var to `false` to restore the short-circuit\n  // to the installation's own workspace.\n  // Env: OPENGENI_SLACK_WORKSPACE_ROUTING_ENABLED.\n  slackWorkspaceRoutingEnabled: EnvBoolean.default(true),\n  // Per-segment ceiling on agent loop turns (model calls) within a single\n  // session turn. Effectively unbounded by default for the same reason as\n  // above; the graceful max-turns valve (idle + goal continuation, never a\n  // session failure) remains as inert safety should a deployment set a cap.\n  agentMaxModelCallsPerTurn: z.coerce.number().int().positive().default(1_000_000),\n  // Deployment fallback for models that do not declare their own window.\n  // Built-in billed GPT-5.6 Sol/Terra/Luna pin Codex's 272k catalog instead.\n  // Opengeni always performs one durable, portable plaintext compaction\n  // transition; there is no provider/server/off mode ladder.\n  contextWindowTokens: z.coerce.number().int().positive().default(1_050_000),\n  // Optional model-catalog effective input ceiling. Codex and billed GPT-5.6\n  // models expose this as raw context_window * effective_context_window_percent;\n  // when absent, retain the deployment-level window-minus-reserved-output\n  // behavior.\n  contextEffectiveWindowTokens: z.coerce.number().int().positive().optional(),\n  // Proactive compaction threshold as a ratio of the model context window.\n  // Defaults to 90%: compact as late as possible — retained context beats early\n  // headroom now that per-model windows are declared honestly (input-effective,\n  // empirically measured), and the fail-closed reactive compact-on-reject path\n  // absorbs any overshoot as one retried call rather than a dead session.\n  // Clamped to [0.3, 0.9] so deployments can tune the trigger without\n  // accidentally disabling compaction.\n  contextCompactionThresholdRatio: z.coerce\n    .number()\n    .default(0.9)\n    .transform((value) => {\n      if (!Number.isFinite(value)) {\n        return 0.9;\n      }\n      return Math.min(0.9, Math.max(0.3, value));\n    }),\n  // Tokens reserved for model output; subtracted from the window to get the\n  // usable input budget B = contextWindowTokens - contextReservedOutputTokens.\n  contextReservedOutputTokens: z.coerce.number().int().nonnegative().default(128_000),\n  // Model-catalog auto-compact limit. When present it is clamped to\n  // 90% of the raw window, matching Codex core's auto_compact_token_limit().\n  contextAutoCompactThresholdTokens: z.coerce.number().int().positive().optional(),\n  // Provider-neutral fallback for canonical model-facing tool-result text.\n  // The current stable Codex catalog policy is 10k tokens; the truncator adds\n  // Codex's 1.2x JSON serialization allowance when applying it.\n  modelToolOutputTruncationTokens: z.coerce.number().int().positive().default(10_000),\n  authRequired: EnvBoolean.default(false),\n  accessKey: z.string().optional(),\n  authAllowHealth: EnvBoolean.default(true),\n  authAllowMetrics: EnvBoolean.default(false),\n  apiHost: z.string().default(\"0.0.0.0\"),\n  apiPort: z.coerce.number().int().positive().default(8000),\n  // When set, GET /metrics is served only on this dedicated internal listener\n  // and never on the public API port that an ingress forwards to.\n  apiMetricsPort: z.coerce.number().int().positive().optional(),\n  workerHttpPort: z.coerce.number().int().positive().default(8001),\n  // Worker-side first-party MCP traffic stays on the deployment's internal\n  // network. OPENGENI_MCP_URL remains the sandbox/external route used by\n  // Codemode and remote placements.\n  opengeniMcpInternalUrl: z.string().url().optional(),\n  opengeniMcpUrl: z.string().url().optional(),\n  // Origins allowed to send browser cookies cross-origin. Other origins may\n  // call the public API with bearer credentials, but never receive credentialed\n  // CORS responses.\n  corsAllowOriginRegex: z.string().default(String.raw`^https?://(localhost|127\\.0\\.0\\.1)(:\\d+)?$`),\n  // Local development only (`local` access mode in the `local` environment):\n  // extra exact browser origins, comma-separated, that may call the\n  // unauthenticated API besides this stack's own web origin. The local browser\n  // boundary ignores `corsAllowOriginRegex`.\n  localAllowedOrigins: z.string().optional(),\n  openaiProvider: z.enum([\"openai\", \"azure\"]).default(\"openai\"),\n  openaiApiKey: z.string().optional(),\n  openaiBaseUrl: z.string().optional(),\n  openaiModel: z.string().default(\"gpt-6-astra\"),\n  openaiAllowedModels: z.string().default(\"gpt-6-astra,gpt-6-sol,gpt-6-luna\"),\n  // Opengeni-managed Vercel AI Gateway. When configured, the two reviewed\n  // Gateway models below are added to the managed-credit catalog. Workspace\n  // Gateway keys use the encrypted connection broker and never this secret.\n  vercelAiGatewayApiKey: z.string().optional(),\n  /** Image adapter route; native hosted providers ignore this model. */\n  imageGenerationModel: z.string().trim().min(1).max(256).default(\"openai/gpt-image-2\"),\n  /** Durable video generation uses the workspace-owned Gateway credential. */\n  videoGenerationPollIntervalMs: z.coerce.number().int().min(1_000).max(60_000).default(5_000),\n  videoGenerationRecoveryDeadlineMs: z.coerce\n    .number()\n    .int()\n    .min(60_000)\n    .max(24 * 60 * 60_000)\n    .default(2 * 60 * 60_000),\n  videoGenerationReferenceUrlTtlSeconds: z.coerce\n    .number()\n    .int()\n    .min(300)\n    .max(6 * 60 * 60)\n    .default(60 * 60),\n  videoGenerationMaxConcurrentPerWorkspace: z.coerce.number().int().min(1).max(16).default(2),\n  videoGenerationWorkspaceQuotaBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(Number.MAX_SAFE_INTEGER)\n    .default(20 * 1024 * 1024 * 1024),\n  // Bytes of retained session images (screenshots, viewed images) a workspace\n  // keeps. When a new image does not fit, the workspace's oldest images are\n  // evicted to make room; a new image is only refused when it is larger than\n  // the whole limit. The overrides map a workspace id to its own limit.\n  retainedImageWorkspaceQuotaBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(Number.MAX_SAFE_INTEGER)\n    .default(5 * 1024 * 1024 * 1024),\n  retainedImageWorkspaceQuotaOverrides: EnvRetainedImageWorkspaceQuotaOverrides,\n  videoGenerationTempDirectory: z.string().trim().min(1).max(1_024).default(\"/tmp/opengeni-video\"),\n  videoGenerationFfprobePath: z.string().trim().min(1).max(1_024).default(\"ffprobe\"),\n  // Opengeni's customer price, not a claim about the provider's delayed cost report.\n  // The durable operation freezes the exact resulting price before provider submit.\n  videoGenerationCredit480pMicrosPerSecond: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(10_000_000)\n    .default(155_000),\n  videoGenerationCredit720pMicrosPerSecond: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(10_000_000)\n    .default(350_000),\n  // Native composer voice input (browser MediaRecorder → API transcription).\n  // Provider credentials stay server-side; ClientConfig only projects availability\n  // and hard ceilings. Selection happens once before audio is sent — never retry\n  // the same clip across vendors after an upstream request may have started.\n  voiceInputMaxDurationSeconds: z.coerce.number().int().positive().max(600).default(60),\n  voiceInputMaxSizeBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(25 * 1024 * 1024)\n    .default(25 * 1024 * 1024),\n  // Durable long-form capture uploads bounded chunks to object storage, then\n  // normalizes them into provider-safe segments. It is advertised only when\n  // object storage and the configured ffmpeg executable are both available.\n  voiceInputResumableEnabled: EnvBoolean.default(true),\n  voiceInputResumableMaxDurationSeconds: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(8 * 60 * 60)\n    .default(2 * 60 * 60),\n  voiceInputResumableMaxSizeBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(512 * 1024 * 1024)\n    .default(512 * 1024 * 1024),\n  voiceInputResumableMaxChunkSizeBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(25 * 1024 * 1024)\n    .default(8 * 1024 * 1024),\n  /**\n   * Move idle sessions' bulky content to object storage (docs/session-storage-lifecycle.md).\n   * On by default; without object storage the worker skips archiving.\n   */\n  sessionArchiveEnabled: EnvBoolean.default(true),\n  /** Days without a new turn before a session becomes eligible for the archive. */\n  sessionArchiveIdleDays: z.coerce.number().int().min(1).max(3650).default(30),\n  voiceInputResumableRetentionSeconds: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(7 * 24 * 60 * 60)\n    .default(24 * 60 * 60),\n  voiceInputFfmpegPath: z.string().trim().min(1).max(1024).default(\"ffmpeg\"),\n  // Preferred provider order (comma-separated ids). First configured+ready wins.\n  // Connected subscription STT is preferred by default; operators can put\n  // openai/azure-openai first explicitly.\n  // Supported: supergrok-subscription, codex-subscription, openai, azure-openai.\n  voiceInputProviderOrder: z\n    .string()\n    .default(\"supergrok-subscription,codex-subscription,openai,azure-openai\"),\n  // OpenAI public /v1/audio/transcriptions path. Reuses OPENGENI_OPENAI_API_KEY\n  // when voiceInputOpenaiApiKey is unset. Default model is gpt-transcribe.\n  voiceInputOpenaiEnabled: EnvBoolean.default(true),\n  voiceInputOpenaiApiKey: z.string().optional(),\n  voiceInputOpenaiBaseUrl: z.string().optional(),\n  voiceInputOpenaiModel: z.string().default(\"gpt-transcribe\"),\n  // Azure OpenAI deployment-scoped audio transcriptions. Reuses the turn-model\n  // Azure endpoint/key/AD token when voice-specific overrides are unset.\n  voiceInputAzureEnabled: EnvBoolean.default(true),\n  voiceInputAzureEndpoint: z.string().optional(),\n  voiceInputAzureDeployment: z.string().optional(),\n  voiceInputAzureApiVersion: z.string().optional(),\n  voiceInputAzureApiKey: z.string().optional(),\n  voiceInputAzureAdToken: z.string().optional(),\n  // Hosted realtime voice is configured independently of dictation.\n  azureLiveEndpoint: z.string().url().optional(),\n  azureLiveApiKey: z.string().optional(),\n  azureLiveDeployment: z.string().default(\"gpt-live-1\"),\n  azureLiveVoice: z.string().default(\"marin\"),\n  // Credit price of deployment-funded live voice (RealtimeVoicePricing JSON).\n  // Required while credit billing is active, otherwise the model is withheld.\n  azureLivePricingJson: z.string().optional(),\n  // Managed AI Gateway live voice prices keyed by upstream model id.\n  aiGatewayRealtimePricingJson: z.string().optional(),\n  // Azure Speech credentials are explicit: a different resource can host MAI.\n  voiceInputMaiEndpoint: z.string().url().optional(),\n  voiceInputMaiApiKey: z.string().optional(),\n  voiceInputMaiApiVersion: z.string().default(\"2025-10-15\"),\n  voiceInputMaiPricingJson: z.string().optional(),\n  voiceInputMaiModel: z.string().default(\"MAI-Transcribe-2\"),\n  // Underlying model of the Azure deployment (for example gpt-4o-transcribe or\n  // whisper). Azure routes by deployment name, so this only selects built-in\n  // pricing and the provider-reported usage shape (Whisper requests\n  // verbose_json so Azure reports the billed audio duration). Defaults to the\n  // deployment name.\n  voiceInputAzureModel: z.string().trim().min(1).max(256).optional(),\n  // Opengeni credit pricing for deployment-funded voice input (`openai`,\n  // `azure-openai`). JSON VoiceInputPricing; overrides the built-in list price\n  // for the configured model. Validated at boot. When credit billing is active\n  // (OPENGENI_BILLING_MODE=stripe or OPENGENI_USAGE_LIMITS_MODE=managed) a\n  // deployment-funded provider without any pricing is not offered at all.\n  voiceInputOpenaiPricingJson: z.string().optional(),\n  voiceInputAzurePricingJson: z.string().optional(),\n  // Legacy opt-in for undocumented ChatGPT /backend-api/transcribe. When\n  // OPENGENI_CODEX_SUBSCRIPTION_ENABLED is true, Codex STT is included without\n  // this flag. Set false and omit codex-subscription from PROVIDER_ORDER to\n  // keep subscription model routing while disabling Codex voice input.\n  voiceInputCodexExperimentalEnabled: EnvBoolean.default(false),\n  /** Deployment-wide override for every credit price calculated from a provider rate. */\n  creditMarginBpsOverride: z.coerce.number().int().min(0).max(10_000).optional(),\n  modelPricingJson: z.string().default(\"{}\"),\n  // Supported-model membership source. Database mode is resolved by the async\n  // core overlay; getSettings remains synchronous and env-only.\n  modelCatalogSource: z.enum([\"code\", \"database\"]).default(\"code\"),\n  // Deployment-owned workspace-facing price policy. This is deliberately\n  // separate from catalog membership and upstream credential ownership.\n  // Shape: { \"product/model-id\": \"free\" | \"credits\" }.\n  modelCostPolicyJson: z.string().default(\"{}\"),\n  // Optional per-product agent guidance. Database mode replaces this with the\n  // singleton document's validated modelNotes map.\n  modelNotesJson: z.string().default(\"{}\"),\n  // Managed OpenRouter credential. The curated model table is injected in\n  // code/catalog-document resolution and never read from host provider JSON.\n  openrouterApiKey: z.string().optional(),\n  // Managed Opper credential. Like OpenRouter, the reviewed Opper model table\n  // is injected by code/catalog-document resolution, never host provider JSON.\n  opperApiKey: z.string().optional(),\n  // Code-mode host override for the managed provider model lists\n  // (OPENGENI_MANAGED_MODELS_JSON): a partial catalog document carrying any of\n  // `gatewayModels`, `openrouterModels`, `opperModels`, each validated by the\n  // exact database catalog document entry schema. A present key replaces that\n  // provider's reviewed code table; an omitted key keeps it. Read only when\n  // modelCatalogSource is \"code\": database mode ignores it so the singleton\n  // document stays the sole membership authority.\n  managedModelsJson: z.string().optional(),\n  // Internal, secret-free catalog overlays populated only by\n  // applyModelCatalogDocument. They intentionally have no OPENGENI_* env\n  // binding so database mode cannot be bypassed with a second source.\n  resolvedGatewayModelsJson: z.string().optional(),\n  resolvedOpenRouterModelsJson: z.string().optional(),\n  resolvedOpperModelsJson: z.string().optional(),\n  resolvedCodexModelsJson: z.string().optional(),\n  // Extra (non-built-in) model providers, declared by the host as a JSON\n  // provider registry. Each entry carries its own base URL, API key, wire API\n  // (\"responses\" | \"chat\") and the models it exposes. The models a client may\n  // use are the UNION of the built-in provider's allowed models and every\n  // registry provider's models. validateSettings parses this at boot so a\n  // malformed registry / unresolvable key / id collision fails fast.\n  modelProvidersJson: z.string().default(\"[]\"),\n  // Codex (ChatGPT) subscription: when enabled, a per-workspace connected\n  // subscription is injected as a synthetic \"codex-subscription\" registry\n  // provider whose models route through the ChatGPT backend (@opengeni/codex).\n  codexSubscriptionEnabled: EnvBoolean.default(false), // OPENGENI_CODEX_SUBSCRIPTION_ENABLED\n  // Cache the session-independent system-prompt prefix (on by default after an A/B\n  // comparison; set false to disable) separately on Anthropic Messages requests.\n  experimentSystemPromptCacheSplit: EnvBoolean.default(true), // OPENGENI_EXPERIMENT_SYSTEM_PROMPT_CACHE_SPLIT\n  // Honor a model-requested foreground shell wait up to 4 minutes instead of 30\n  // seconds, returning early for quiet servers and input prompts (on by default\n  // after an A/B halved command polls; set false to disable).\n  experimentCutPolling: EnvBoolean.default(true), // OPENGENI_EXPERIMENT_CUT_POLLING\n  // Lean non-strict `exec_command` schema: only `cmd` and `max_output_tokens`\n  // are required (on by default after an A/B; set false to disable).\n  experimentOutputCost: EnvBoolean.default(true), // OPENGENI_EXPERIMENT_OUTPUT_COST\n  // Explicit operator opt-in for active turns to continue using provider extra credits.\n  // Default: re-admit each model request against included subscription usage.\n  // SuperGrok/xAI connected subscription. This is a workspace-scoped OAuth\n  // account pool and a distinct rail from the existing xai/* API-key provider.\n  supergrokSubscriptionEnabled: EnvBoolean.default(false), // OPENGENI_SUPERGROK_SUBSCRIPTION_ENABLED\n  claudeSubscriptionEnabled: EnvBoolean.default(false), // OPENGENI_CLAUDE_SUBSCRIPTION_ENABLED\n  // Maximum silence between complete, valid SuperGrok SSE data events. This is\n  // not a request/run duration cap; every valid event resets the timer.\n  supergrokResponseStreamIdleTimeoutMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(24 * 60 * 60_000)\n    .default(XAI_RESPONSE_STREAM_IDLE_TIMEOUT_MS),\n  // Maximum silence between response bytes on a generic OpenAI-compatible\n  // model stream (built-in OpenAI/Azure and registry chat/responses providers).\n  // Not a request/run duration cap: every received byte resets the timer, and\n  // it measures only time spent waiting on the provider for the next chunk. A\n  // stalled stream fails as a retryable provider failure so finite same-turn\n  // recovery replaces it. A registry provider may override it with\n  // `streamIdleTimeoutMs`. Codex, SuperGrok, and Anthropic Messages own their\n  // transport-specific idle timers.\n  modelStreamIdleTimeoutMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(24 * 60 * 60_000)\n    .default(DEFAULT_MODEL_STREAM_IDLE_TIMEOUT_MS),\n  // Maximum wait across keepalive-only stream traffic for the next\n  // model-progress event (registry override: `streamProgressTimeoutMs`).\n  // Never shorter than modelStreamIdleTimeoutMs.\n  modelStreamProgressTimeoutMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(24 * 60 * 60_000)\n    .default(DEFAULT_MODEL_STREAM_PROGRESS_TIMEOUT_MS),\n  // Expose the connected apps attached to a Codex subscription through the\n  // synthetic codex_apps MCP server. Independent from subscription routing so\n  // operators can use Codex models without exposing ChatGPT connectors.\n  codexConnectedAppsEnabled: EnvBoolean.default(false), // OPENGENI_CODEX_CONNECTED_APPS_ENABLED\n  codexProductSku: z.string().optional(), // OPENGENI_CODEX_PRODUCT_SKU (X-OpenAI-Product-Sku, apps only)\n  // Progressive MCP disclosure (Codex-CLI-style tool_search): on a codex turn,\n  // flag non-eager selected MCP tools `defer_loading:true` (dropping their\n  // schemas from model context) and add one client-executed tool_search tool\n  // that BM25-discloses bounded matches. Only an exact session tool ref with\n  // `eager:true` stays on the startup path; mandatory selection alone does not\n  // imply eagerness. Default ON so selected connector catalogues do not consume\n  // every Codex turn's context. Operators may explicitly disable it for\n  // emergency compatibility diagnosis.\n  // OPENGENI_CODEX_TOOL_SEARCH_ENABLED\n  codexToolSearchEnabled: EnvBoolean.default(true),\n  // Carry Codex subscription model requests over the backend's Responses\n  // WebSocket (one warm connection per conversation) instead of a new HTTP\n  // request per step. Requests the socket cannot carry fall back to HTTP.\n  // OPENGENI_CODEX_RESPONSES_WEBSOCKET_ENABLED\n  codexResponsesWebSocketEnabled: EnvBoolean.default(true),\n  // The same transport for the OpenAI API (/v1/responses) and Azure OpenAI's\n  // v1 API (/openai/v1/responses): one connection per conversation, each step\n  // continuing the previous response with only its new input. Other\n  // OpenAI-compatible hosts always use HTTP.\n  // OPENGENI_OPENAI_RESPONSES_WEBSOCKET_ENABLED\n  openaiResponsesWebSocketEnabled: EnvBoolean.default(true),\n  // Provider-neutral progressive disclosure for direct OpenAI/Azure native\n  // client search and ordinary-function generic dispatch. Kept separate from\n  // the Codex rollout so an emergency Codex opt-out cannot disable every model.\n  // OPENGENI_LAZY_TOOL_SEARCH_ENABLED\n  lazyToolSearchEnabled: EnvBoolean.default(true),\n  // Typed decision-model category, separate from conversational models. Explicit\n  // configuration is shared by tool discovery and code search; no account fallback.\n  decisionModelProvider: z.enum([\"jev\", \"openai\", \"openrouter\"]).optional(),\n  decisionModelId: z.string().trim().min(1).optional(),\n  decisionModelApiKey: z.string().optional(),\n  decisionModelBaseUrl: z.string().url().optional(),\n  // Decision-observability fence. When enabled, the worker emits one\n  // bounded, metadata-only adaptive-policy replay record alongside the unchanged\n  // sticky-sharded decision. It never changes placement/admission/failover.\n  codexFleetPolicyShadowEnabled: EnvBoolean.default(false),\n  // Shared subscription core shadow. After the legacy Codex, Claude or\n  // SuperGrok selection, the worker reads a read-only legacy world and records\n  // content-free metrics comparing the core's decision. Fail-open and bounded by\n  // the timeout; it never changes placement.\n  // OPENGENI_SUBSCRIPTION_CORE_SHADOW_ENABLED, OPENGENI_SUBSCRIPTION_CORE_SHADOW_TIMEOUT_MS\n  subscriptionCoreShadowEnabled: EnvBoolean.default(true),\n  // D-43: dormant until the failover hooks and serving-model notice ship.\n  subscriptionCrossProviderFailoverEnabled: EnvBoolean.default(false),\n  subscriptionCoreShadowTimeoutMs: z.coerce.number().int().min(10).max(1_000).default(250),\n  // Multi-account P3 (auto-rotation): an account is \"near exhaustion\" — ineligible to be\n  // rotated TO — when EITHER usage window (5h/weekly) is at/over this percent. Default 90 to\n  // match the UI danger flip (UsageBar danger at pct >= 90). OPENGENI_CODEX_ROTATION_NEAR_EXHAUSTION_PCT.\n  codexRotationNearExhaustionPct: z.coerce.number().int().min(1).max(100).default(90),\n  reasoningConfigurationUpdatesEnabled: EnvBoolean.default(false),\n  openaiReasoningEffort: ReasoningEffort.default(\"low\"),\n  openaiAllowedReasoningEfforts: z.string().default(\"low,medium,high,xhigh,max\"),\n  // Default for new chats and scheduled tasks when the workspace has an\n  // Opengeni credit balance, no saved workspace default, and no usable\n  // connected subscription, and the deployment default is not already a\n  // credits-billed model. Selected only when this model is selectable in the\n  // workspace catalog; otherwise the first selectable credits model is used.\n  // OPENGENI_CREDITS_DEFAULT_MODEL / OPENGENI_CREDITS_DEFAULT_REASONING_EFFORT.\n  creditsDefaultModel: z\n    .string()\n    .trim()\n    .min(1)\n    .max(256)\n    .refine((value) => !/[\\u000A\\u000D|]/u.test(value), {\n      message: \"credits default model must not contain newlines or the | field separator\",\n    })\n    .default(\"gpt-6-luna\"),\n  // Preferred effort for the credits default. Clamped to the highest effort\n  // the selected model supports at or below this value.\n  creditsDefaultReasoningEffort: ReasoningEffort.default(\"xhigh\"),\n  openaiResponsesTransport: z.enum([\"http\", \"websocket\"]).default(\"http\"),\n  // Provider-assigned item ids (rs_/msg_/fc_…) in Responses API input are\n  // resolved against the provider's server-side response store. That store is\n  // not durable enough to anchor long runs on: a response that streamed fine\n  // can be missing from the store on the very next model call, which then\n  // fails with 400 \"Item with id ... not found\". \"strip\" removes the ids from\n  // every model-call input so requests are self-contained — conversation\n  // truth already lives client-side in session_history_items. \"preserve\"\n  // keeps the SDK's pass-through behavior.\n  openaiProviderItemIds: z.enum([\"strip\", \"preserve\"]).default(\"strip\"),\n  // With ids stripped the provider cannot resolve prior reasoning server-side,\n  // so request reasoning.encrypted_content and send it back with each call:\n  // reasoning continuity without depending on provider-side storage.\n  openaiReasoningEncryptedContent: EnvBoolean.default(true),\n  // Model-call retry budget for transient provider failures (429s and friends).\n  // The openai client default of 2 retries is too small for sustained TPM\n  // backpressure during long autonomous runs.\n  openaiMaxRetries: z.coerce.number().int().nonnegative().default(5),\n  // Native hosted web search. The live Azure Responses path executes the\n  // hosted web_search tool, so this is provider-unconditional: ON by default\n  // on every provider, exposed only so operators can disable it. When true,\n  // buildOpenGeniAgent attaches webSearchTool() to the agent's tools — it is\n  // merged with the MCP-server tools (getAllTools = [...mcpTools, ...tools])\n  // and the sandbox capability tools, never replacing them.\n  webSearchEnabled: EnvBoolean.default(true),\n  // Provider-agnostic web search (`web_search` / `web_fetch` agent tools,\n  // see ./web-search.ts). Inert until a provider and its key are set; validated\n  // lazily so a misconfiguration withholds the tools instead of failing boot.\n  webSearchProvider: z.string().optional(),\n  webFetchProvider: z.string().optional(),\n  webSearchPrefer: z.string().optional(),\n  webSearchProviderCredentials: WebSearchProviderCredentialsSchema,\n  // Earlier single-provider settings, applied to the first provider of a slot.\n  webSearchApiKey: z.string().optional(),\n  webSearchBaseUrl: z.string().optional(),\n  webFetchApiKey: z.string().optional(),\n  webFetchBaseUrl: z.string().optional(),\n  webSearchProviderMode: z.string().optional(),\n  webSearchPricingJson: z.string().optional(),\n  webSearchRequestTimeoutMs: z.coerce.number().int().positive().max(120_000).default(20_000),\n  // Jev (TypeSafe's fast judge model) for worker-side agent tools. Without a\n  // usable key every Jev-backed feature is off. The key stays on the server\n  // (API and worker) and never reaches a sandbox or Connected Machine.\n  jevApiKey: z.string().optional(),\n  jevBaseUrl: z.string().url().default(\"https://api.typesafe.ai\"),\n  jevModel: z.string().trim().min(1).max(128).default(\"jev-latest\"),\n  jevRequestTimeoutMs: z.coerce.number().int().positive().max(120_000).default(10_000),\n  // Jev-backed `code_search` agent tool. `off` never offers it, `opt_in` offers\n  // it only where workspace settings enable it, `default_on` offers it\n  // everywhere except workspaces that disable it, and `experiment` gives it to\n  // a fixed half of sessions in workspaces without their own setting, for\n  // comparison. It also needs jevApiKey.\n  codeSearchMode: z.enum([\"off\", \"opt_in\", \"default_on\", \"experiment\"]).default(\"off\"),\n  // Deployment-default agent persona template (the white-label surface). The\n  // runtime resolves the effective template per turn as\n  // per-session-override > per-workspace override > this default, substitutes\n  // the non-bypassable CORE at AGENT_INSTRUCTIONS_CORE_PLACEHOLDER (or appends\n  // it when the template omits the marker), and uses the result as the agent's\n  // instructions. Defaulting to DEFAULT_AGENT_INSTRUCTIONS keeps the composed\n  // default pinned by runtime tests.\n  agentInstructionsTemplate: z.string().default(DEFAULT_AGENT_INSTRUCTIONS),\n  deploymentAgentInstructions: z.string().optional(),\n  // Knowledge retrieval, correction and standing-preference guidance (on by default after the\n  // instruction-following A/B; set false to disable).\n  experimentKnowledgeRetrievalGuidance: EnvBoolean.default(true), // OPENGENI_EXPERIMENT_KNOWLEDGE_RETRIEVAL_GUIDANCE\n  azureOpenaiBaseUrl: z.string().optional(),\n  azureOpenaiEndpoint: z.string().optional(),\n  azureOpenaiDeployment: z.string().optional(),\n  azureOpenaiApiVersion: z.string().optional(),\n  azureOpenaiApiKey: z.string().optional(),\n  azureOpenaiAdToken: z.string().optional(),\n  disableOpenaiTracing: EnvBoolean.default(false),\n  sandboxBackend: SandboxBackend.default(\"docker\"),\n  dockerImage: z.string().default(\"opengeni-sandbox:local\"),\n  // Explicit deployment contract: the configured base sandbox image contains\n  // the verified, self-contained native artifact runtime at its fixed image\n  // paths. Disabled by default so arbitrary/custom provider images never make\n  // document/spreadsheet/presentation skills appear when their runtime is\n\n  // when this base-image contract is enabled.\n  sandboxArtifactRuntimeEnabled: EnvBoolean.default(false),\n  dockerExposedPorts: z.string().default(\"\"),\n  dockerNetwork: z.string().optional(),\n  // When the worker itself runs in a container and talks to a host Docker daemon,\n  // this directory must be bind-mounted at the exact same absolute path on both\n  // sides. The Agents SDK materializes the workspace here before bind-mounting it\n  // into the sandbox container.\n  dockerWorkspaceBaseDir: z.string().min(1).optional(),\n  modalAppName: z.string().default(\"opengeni-sandbox\"),\n  modalImageRef: z.string().optional(),\n  // Activate only after descriptor-aware readers, DB fences and the exact\n  // native image have passed the supervised-command rollout canary.\n  modalCommandSupervisionEnabled: EnvBoolean.default(false),\n  // Provider-native immutable Modal image ID for the exact logical\n  // `modalImageRef`. When set, the runtime uses ModalImageSelector.fromId and\n  // never asks Modal to parse or import the registry ref. The logical ref is\n  // still persisted on the sandbox lease for provenance and conflict fencing;\n  // the Modal session envelope persists the actual image ID.\n  modalImageId: z\n    .string()\n    // Modal image IDs are provider-opaque. Older builds use a 22-character\n    // random suffix while current filesystem snapshots use a 26-character\n    // ULID suffix. Validate the stable namespace/safe alphabet and let Modal\n    // remain authoritative over current/future suffix lengths.\n    .min(4)\n    .max(128)\n    .regex(/^im-[A-Za-z0-9]+$/)\n    .optional(),\n  // Name of a Modal Secret (containing REGISTRY_USERNAME + REGISTRY_PASSWORD) used\n  // to authenticate the pull of `modalImageRef` from a PRIVATE registry. When UNSET\n  // (the default), the sandbox image is pulled UNAUTHENTICATED — i.e. it must be a\n  // PUBLIC registry tag, which is the only shape the Agents-extension Modal backend\n  // supports out of the box (`Image.fromRegistry(tag)` with no secret). Set this to\n  // run a private image (e.g. a cloud-hosted ACR/ECR/GCR digest): the runtime resolves\n  // the named Secret and builds the image via `fromRegistry(tag, secret)` before the\n  // first sandbox is created. Knob: OPENGENI_MODAL_IMAGE_REGISTRY_SECRET.\n  modalImageRegistrySecret: z.string().optional(),\n  // Modal's hard sandbox lifetime (timeoutMs = this * 1000), counted from box\n  // creation. A resume-by-id does NOT reset that provider clock. It is the\n  // BACKSTOP that reclaims a box if the reaper/worker is down, NOT the warm-window\n  // controller (that's sandboxIdleGraceMs). It must comfortably exceed\n  // reaperPeriod + idleGrace so the reaper terminates a genuinely-idle box FIRST;\n  // the boot invariant below enforces that. Default 24h, Modal's documented\n  // maximum, to reduce premature active-box loss and leave headroom for the\n  // deadline-aware snapshot/rematerialization transition. The transition—not a\n  // larger timeout—is what lets a session outlive one finite provider box.\n  // Knob: OPENGENI_MODAL_TIMEOUT_SECONDS.\n  modalTimeoutSeconds: z.coerce.number().int().positive().max(86_400).default(86_400),\n  // Optional provider reservations for every new Modal sandbox. CPU is measured\n  // in physical cores and may be fractional; memory is measured in MiB. Leave\n  // both unset to preserve Modal's provider defaults. The Agents adapter stores\n  // the resolved values in its session state so snapshot replacement and exact\n  // resume cannot silently change the reservation.\n  modalSandboxCpu: z.coerce.number().positive().optional(),\n  modalSandboxMemoryMiB: z.coerce.number().int().positive().optional(),\n  // Optional Modal placement for every new physical box (fresh create and\n  // snapshot restore alike). Every setup step and tool call is a round trip from\n  // the worker to the box, so placing boxes near the workers cuts per-command\n  // latency; Modal bills region selection as a compute multiplier. Existing\n  // boxes keep their placement on resume. Knob: OPENGENI_MODAL_REGIONS.\n  modalRegions: EnvModalRegions,\n  modalTokenId: z.string().optional(),\n  modalTokenSecret: z.string().optional(),\n  modalEnvironment: z.string().optional(),\n  // modal gap-fill: idleTimeoutMs + workspacePersistence were unmapped (module 03 §4.1).\n  //\n  // CRITICAL (sandbox-file-persistence): when this is UNSET the Modal SDK sends\n  // idleTimeoutSecs=undefined, so Modal applies its OWN short server-default idle\n  // timeout (~minutes) — and a box between turns sits with NO active connection,\n  // so that idle clock runs and Modal idle-reaps the box LONG before Opengeni's\n  // own reaper waits out sandboxIdleGraceMs to resume+persist+terminate\n  // it. The observed failure: every drain logs \"drainable box already gone\n  // (NotFound on resume)\", persistWorkspace() never fires, /workspace is lost.\n  // Modal's idle-reap is a SECOND reaper racing Opengeni's — and it wins. The fix:\n  // Opengeni OWNS box lifecycle via its reaper + the hard modalTimeoutSeconds\n  // backstop, so the Modal idle-reap must NOT fire first. We default the effective\n  // idle timeout to the hard lifetime (effectiveModalIdleTimeoutSeconds), making\n  // the box survive its full warm window so the reaper can snapshot it. Set this\n  // explicitly (OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS) only to deliberately idle-reap\n  // SOONER than the hard lifetime; the boot invariant forbids a value that would\n  // reap before reaperPeriod + idleGrace elapses.\n  modalIdleTimeoutSeconds: z.coerce.number().int().positive().optional(),\n  // /workspace FILE PERSISTENCE across warm/cold cycles. Directory snapshots\n  // preserve only the durable user workspace, so provider recovery does not\n  // restore an entire machine image or replace the selected rig/base image.\n  // Cold restore derives the mode from its verified native artifact, so existing\n  // serialized sessions remain recoverable; this default governs archive-free\n  // Modal creations only.\n  // `snapshot_filesystem` remains available for explicit compatibility and\n  // immutable rig-image materialization. `tar` is the portable fallback.\n  modalWorkspacePersistence: z\n    .enum([\"tar\", \"snapshot_filesystem\", \"snapshot_directory\"])\n    .default(\"snapshot_directory\"),\n  // Shared desktop toggle: this module reads it for the 6080 port-merge; the\n  // owner module (P4.x) acts on it to launch the display stack.\n  sandboxDesktopEnabled: EnvBoolean.default(false),\n  // Human sandbox input policy. Canonical ComputerSession attachments reflect\n  // it and /actions enforces it independently of the client. The legacy\n  // DesktopStream adapter also reports read-only when disabled. Agent tools\n  // retain their separate session-control authority.\n  sandboxDesktopInteractive: EnvBoolean.default(true),\n  // REAL PTY terminal toggle (P5.t): gates the ttyd pty-ws plane (7681) the API\n  // mints over the SAME tunnel as the desktop. Defaults ON — the interactive\n  // terminal is a baseline structured-service surface (unlike the heavier desktop\n  // pixel plane); a deployment can turn it off to fall back to the read-only\n  // sse-events command firehose. The 7681 port-merge tracks sandboxDesktopEnabled\n  // (a desktop-capable image is the one that bakes ttyd).\n  sandboxTerminalEnabled: EnvBoolean.default(true),\n  // The desktop framebuffer geometry the pixel plane advertises + launches the\n  // display stack with (P4.2). v1 has no live RANDR resize; a change is a full\n  // down→up restart. Defaults match the proven spike geometry (1280x800).\n  streamResolutionWidth: z.coerce.number().int().positive().default(1280),\n  streamResolutionHeight: z.coerce.number().int().positive().default(800),\n  // Recording loop: ffmpeg x11grab of :0 → mp4/webm → @opengeni/storage.\n  // recordingMaxBytes caps the in-memory finalize buffer (≤ storage single-PUT);\n  // recordingMaxSeconds is the ffmpeg -t hard ceiling (bounds a multi-day turn).\n  recordingEnabled: EnvBoolean.default(true),\n  recordingDefaultCodec: z.enum([\"h264-mp4\", \"vp9-webm\"]).default(\"h264-mp4\"),\n  // Workbench v2 turn-end workspace capture. When on, the turn\n  // activity probes the box's changed files off the live box at turn end and\n  // persists a capture revision (blobs in @opengeni/storage) so the workbench\n  // paints cold/offline sessions with zero machine round-trips. Best-effort and\n  // fully behind this flag: off ⇒ capture is skipped and reads fall back to the\n  // live/wake path (status-quo behavior). Default on; explicit per environment.\n  workspaceCaptureEnabled: EnvBoolean.default(true),\n  recordingFramerate: z.coerce.number().int().positive().default(15),\n  recordingMaxSeconds: z.coerce.number().int().positive().default(600),\n  recordingMaxBytes: z.coerce.number().int().positive().default(268_435_456), // 256 MB\n  // --- daytona ---\n  daytonaApiKey: z.string().optional(),\n  daytonaApiUrl: z.string().url().optional(),\n  daytonaTarget: z.string().optional(),\n  daytonaImage: z.string().optional(),\n  daytonaSnapshotName: z.string().optional(),\n  daytonaAutoStopInterval: z.coerce.number().int().nonnegative().optional(), // 0 disables idle-kill\n  daytonaTimeoutSeconds: z.coerce.number().int().positive().optional(),\n  daytonaExposedPortUrlTtlSeconds: z.coerce.number().int().positive().optional(),\n  // --- runloop ---\n  runloopApiKey: z.string().optional(),\n  runloopBaseUrl: z.string().url().optional(),\n  runloopBlueprintName: z.string().optional(),\n  runloopBlueprintId: z.string().optional(),\n  runloopTunnel: EnvBoolean.default(true),\n  runloopKeepAliveSeconds: z.coerce.number().int().positive().optional(),\n  // --- e2b: E2B's cloud or any E2B-compatible API ---\n  // The key, domain and addresses are handed to the SDK explicitly on every\n  // create and resume; unset ones keep the SDK's defaults (E2B's cloud).\n  e2bApiKey: z.string().optional(),\n  // Sandboxes are reached as `<port>-<sandbox id>.<domain>`; the API is\n  // `https://api.<domain>` unless e2bApiUrl is set.\n  e2bDomain: z\n    .string()\n    .regex(/^[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?(?::\\d{1,5})?$/, {\n      message: \"must be a host name such as sandboxes.example.com, without a scheme or path\",\n    })\n    .optional(),\n  e2bApiUrl: z.string().url().optional(),\n  // One address for all envd traffic, routed by the E2b-Sandbox-Id and\n  // E2b-Sandbox-Port headers, instead of a name per sandbox.\n  e2bSandboxUrl: z.string().url().optional(),\n  e2bTemplate: z.string().optional(),\n  e2bTimeoutSeconds: z.coerce.number().int().positive().optional(),\n  e2bTimeoutAction: z.enum([\"pause\", \"kill\"]).optional(),\n  e2bAllowInternetAccess: EnvBoolean.optional(),\n  e2bAutoResume: EnvBoolean.optional(),\n  e2bWorkspacePersistence: z.enum([\"tar\", \"snapshot\"]).optional(),\n  // --- blaxel ---\n  blaxelApiKey: z.string().optional(),\n  blaxelImage: z.string().optional(),\n  blaxelRegion: z.string().optional(),\n  blaxelExposedPortPublic: EnvBoolean.optional(), // public vs bl_preview_token\n  blaxelExposedPortUrlTtlSeconds: z.coerce.number().int().positive().optional(),\n  blaxelMemoryMb: z.coerce.number().int().positive().optional(),\n  blaxelTtl: z.string().optional(),\n  // --- cloudflare (headless) ---\n  cloudflareWorkerUrl: z.string().url().optional(),\n  cloudflareApiKey: z.string().optional(),\n  experimentalBrowserContextPoolEnabled: EnvBoolean.default(false),\n  // --- remote browser placements ---\n  // Provider credentials are injected only into the placement-resident\n  // browserd launch. They never enter session contracts, journals, or sandboxes.\n  browserbaseApiKey: z.string().min(1).max(8192).optional(),\n  kernelApiKey: z.string().min(1).max(8192).optional(),\n  kernelEndpoint: z.string().url().optional(),\n  kernelBrowserTimeoutSeconds: z.coerce.number().int().positive().max(86_400).default(3_600),\n  kernelBrowserStealth: EnvBoolean.default(false),\n  // --- vercel (headless) ---\n  vercelToken: z.string().optional(),\n  vercelProjectId: z.string().optional(),\n  vercelTeamId: z.string().optional(),\n  vercelRuntime: z.string().optional(),\n  // --- OpenSandbox (optional Kubernetes-native provisioned sandbox) ---\n  openSandboxBaseUrl: z.string().url().optional(),\n  openSandboxApiKey: z.string().min(1).optional(),\n  // Release and preview profiles must provide an immutable OCI digest. The\n  // adapter refuses tag-only references when this backend is active.\n  openSandboxImage: z.string().min(1).optional(),\n  // Renewable provider TTL is a leak/backstop clock, not Opengeni's idle\n  // policy. The pinned server accepts a one-minute minimum; ordinary\n  // deployments default to one hour.\n  openSandboxTtlSeconds: z.coerce.number().int().min(60).max(86_400).default(3_600),\n  openSandboxUseServerProxy: EnvBoolean.default(true),\n  // Channel B (browserd / noVNC / ttyd) uses OSEP-0011 signed URI-mode ingress.\n  // Exec/files stay on the private lifecycle server-proxy regardless of this flag.\n  openSandboxSignedEndpoints: EnvBoolean.default(false),\n  openSandboxSignedEndpointTtlSeconds: z.coerce.number().int().min(60).max(3_600).default(600),\n  openSandboxChannelBPublicBaseUrl: z.string().url().optional(),\n  // Emergency hatch only: force JPEG/RFB through the API frame-proxy even when\n  // signed endpoints are on (M2 subprotocol failure). Unset means OpenSandbox\n  // uses the frame-proxy unless signed endpoints are on.\n  openSandboxInteractionFrameProxy: EnvBoolean.optional(),\n  openSandboxPoolRef: z\n    .string()\n    .regex(/^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/)\n    .optional(),\n  // Optional same-cluster, read-only observability projection. The application\n  // chart sets this only on the control worker and mounts a dedicated projected\n  // service-account token; non-Kubernetes and remote-provider deployments omit it.\n  openSandboxKubernetesInventoryNamespace: z\n    .string()\n    .min(1)\n    .max(63)\n    .regex(/^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/)\n    .optional(),\n  // --- Opengeni compute (optional; Opengeni's own microVM sandboxes) ---\n  // Every compute sandbox runs the Connected Machine agent, reached through\n  // its host's link to this API's agent gateway, so this backend also needs\n  // the relay and the agent op-stream. Nothing here is read unless a session\n  // or the deployment selects `compute`, or the gateway URL is set.\n  computeApiUrl: z.string().url().optional(),\n  computeApiKey: z.string().min(1).max(8192).optional(),\n  // Compute image refs. Omitted, the control service's default image. The desktop image is\n  // used when OPENGENI_SANDBOX_DESKTOP_ENABLED=true and carries the display stack.\n  computeImage: z.string().min(1).max(2048).optional(),\n  computeDesktopImage: z.string().min(1).max(2048).optional(),\n  computeVcpus: z.coerce.number().int().min(1).max(64).default(2),\n  computeMemoryMib: z.coerce.number().int().min(512).max(262_144).default(4096),\n  // Guaranteed shares below the ceilings above; omitted, the whole ceiling.\n  computeMemoryRequestMib: z.coerce.number().int().min(128).max(262_144).optional(),\n  computeCpuRequestMillis: z.coerce.number().int().min(10).max(64_000).optional(),\n  // The agent gateway's public WebSocket URL (wss://). Compute hosts dial it,\n  // and it is the exact audience of their host tokens and sandbox tickets, so\n  // it must equal the URL the control service is configured with for Opengeni's team.\n  // This API serves the gateway at its path.\n  computeLinkUrl: z.string().url().optional(),\n  // How long a create waits for the sandbox's agent to connect, and how long\n  // a request to an unreachable sandbox keeps waking and retrying it.\n  computeAgentReadyTimeoutMs: z.coerce.number().int().min(1_000).max(900_000).default(120_000),\n  // --- sandbox ownership inversion (P1.2 rollout flag, default OFF) ---\n  // The keystone flag for the stateless resume-by-id model. When FALSE the\n  // agent-turn path is BYTE-FOR-BYTE today's build-and-discard behavior (no\n  // lease acquire, no resume-by-id, no non-owned injection). When TRUE the turn\n  // activity acquires the group lease, resumes the one box by id from the lease\n  // envelope, injects it as a NON-OWNED RunConfig session (the SDK never reaps\n  // it — the proven keystone), and releases the holder in finally. Uses\n  // EnvBoolean (NOT z.coerce.boolean(), which would coerce \"false\" -> true and\n  // turn the flag ON the moment anyone set the env var to disable it).\n  sandboxOwnershipEnabled: EnvBoolean.default(false),\n  // --- standalone rig-verifier ownership rollout flag, default OFF ---\n  // Rig verification creates a throwaway provider sandbox outside the normal\n  // session-turn path. When enabled, that sandbox must first acquire the same\n  // durable lease lifecycle used by session boxes so the global orphan sweep\n  // recognizes its exact provider instance. Keep this separate from the general\n  // sandboxOwnershipEnabled rollout: every reaper worker must understand verifier\n  // leases before dispatch is enabled. When false the verifier fails closed before\n  // provider create; it never falls back to the legacy unowned path.\n  rigVerificationLeaseOwnershipEnabled: EnvBoolean.default(false),\n  // --- lazy sandbox provisioning rollout flag, default OFF ---\n  // Only effective when sandboxOwnershipEnabled is ALSO on (lazy provisioning is a\n  // property of the owned path — the SDK never creates/resumes an injected session,\n  // so we control when the box is established). When TRUE, a turn does NOT provision\n  // its box at turn start: the lease acquire + resume-by-id + hooks + downloads +\n  // heartbeat + recording are deferred to an in-process single-flight provisioner\n  // that runs the FIRST time a sandbox op is dispatched (via the routing proxy's\n  // resolveActiveBackend). A turn whose model never calls a sandbox-backed tool ends\n  // with NO lease row and ZERO warm-seconds. When FALSE (or ownership off) the turn\n  // provisions eagerly exactly as today — byte-for-byte. EnvBoolean (NOT\n  // z.coerce.boolean(), which coerces \"false\" -> true and would turn the flag ON the\n  // moment anyone set the env var to disable it).\n  sandboxLazyProvisionEnabled: EnvBoolean.default(false),\n  // --- bring-your-own-compute (selfhosted 11th backend) rollout flag, default OFF ---\n  // The keystone flag for the whole selfhosted feature (the enrollment device-flow,\n  // the NATS control plane, the relay stream tier). When FALSE the enrollment routes\n  // 404 (invisible — the surface does not exist for this deployment) and the\n  // selfhosted backend is inert; boot is unaffected. EnvBoolean (NOT\n  // z.coerce.boolean(), which coerces \"false\" -> true). Flipped per-environment via\n  // the deploy-staging IaC secret/configmap pattern.\n  sandboxSelfhostedEnabled: EnvBoolean.default(false),\n  // Gates the op-stream (streaming exec) transport to Connected Machines. The\n  // runner must ALSO advertise Capabilities.op_stream. Streaming is the default\n  // because it is the only transport that can keep a command alive without an\n  // arbitrary request/reply wall while still supporting replay and cancellation.\n  // Exec fails closed when the deployment or runner does not provide op-stream.\n  // EnvBoolean (NOT\n  // z.coerce.boolean(), which coerces \"false\" -> true).\n  agentOpStreamEnabled: EnvBoolean.default(true),\n  // The HMAC secret the control plane signs the enrollment bearer credential with\n  // (the `oge_` envelope the agent presents back to the control plane). Optional:\n  // when ABSENT and sandboxSelfhostedEnabled is on, the poll route reports the\n  // credential plane disabled (graceful degrade, mirrors streamTokenSecret). NEVER\n  // logged. Lives in the opengeni-runtime secret (Helm-clobbered configmap avoided).\n  enrollmentSigningSecret: z.string().optional(),\n  // Connect-info the EnrollmentCredentials hand the agent: the NATS server URL(s)\n  // the agent dials for the control plane, and the relay edge base URL for streams.\n  // The per-workspace NATS Account creds binding is infra-deferred (M4/relay\n  // milestone) — the poll returns these endpoints + a placeholder creds field.\n  selfhostedNatsUrl: z.string().optional(),\n  selfhostedRelayUrl: z.string().optional(),\n  // The HMAC secret the control plane signs the agent's relay PRODUCER token with\n  // (the `ogr_` envelope threaded into EnrollmentCredentials.relayToken; M8b/design\n  // §10.5). The relay verifies the producer token with the SAME secret. Optional:\n  // when ABSENT the poll returns an empty relayToken (graceful degrade — the stream\n  // plane is simply unavailable until configured). Falls back to streamTokenSecret /\n  // delegationSecret (same HMAC family) so a deployment with a stream-token secret\n  // needs no second one. NEVER logged. Lives in the opengeni-runtime secret.\n  selfhostedRelayTokenSecret: z.string().optional(),\n  // The minisign PUBLIC key the agent pins for self-update verification (handed to\n  // the agent in EnrollmentCredentials; the SECRET key lives only in CI).\n  agentUpdatePublicKey: z.string().optional(),\n  // --- NATS auth-callout tenancy boundary (bring-your-own-compute M-AUTH; design\n  //     §10.1 NATS Accounts per workspace + §17 the isolation smoke) -------------\n  // nats-server is configured with AUTH CALLOUT: an external agent connects\n  // presenting its `oge_` enrollment bearer as the connect auth-token; the server\n  // issues an authorization request on $SYS.REQ.USER.AUTH to our responder, which\n  // validates the bearer, claims one daemon generation, and returns a SIGNED NATS\n  // user JWT scoped to that exact process subtree (+ `_INBOX.>`). The exact scope\n  // provides both workspace isolation and single-daemon routing authority. These\n  // are deployment-level secrets in the opengeni-runtime secret\n  // (Helm-clobbered configmap avoided), all OPTIONAL: when the callout plane is not\n  // configured the responder simply does not start (selfhosted agents cannot\n  // connect — graceful, never a boot-fail).\n  //\n  // The callout account SIGNING SEED (`SA...`). Both the user JWT and the\n  // authorization-response JWT are signed by this account key; its public key\n  // (`A...`) is the `auth_callout.issuer` in the server config. NEVER logged.\n  selfhostedNatsCalloutAccountSeed: z.string().optional(),\n  // The TARGET ACCOUNT NAME the minted user is placed into (the server-config-mode\n  // `auth_callout.account`, e.g. \"APP\"). The responder writes it as the minted user\n  // JWT `aud` so nats-server binds the agent to this account — the SAME account the\n  // privileged control plane connects into, so exact process request/reply\n  // routes. Optional; resolveNatsCalloutConfig defaults it to \"APP\".\n  selfhostedNatsCalloutAccountName: z.string().optional(),\n  // The callout RESPONDER's own NATS login (one of the `auth_callout.auth_users`\n  // in the AUTH account) — the responder connects with this to subscribe\n  // $SYS.REQ.USER.AUTH. Username/password.\n  selfhostedNatsCalloutUser: z.string().optional(),\n  selfhostedNatsCalloutPassword: z.string().optional(),\n  // The PRIVILEGED control-plane login (api/worker): a static account user that may\n  // request exact process RPC subjects + receive their inbox replies. The event bus + the\n  // selfhosted control RPC ride THIS connection. Username/password; when unset the\n  // bus connects anonymously (local dev / a NATS with no auth_callout).\n  selfhostedNatsControlUser: z.string().optional(),\n  selfhostedNatsControlPassword: z.string().optional(),\n  // --- selfhosted (Connected Machine) control/exec op deadlines ---------------\n  // CONTROL ops (ping / fs / git / desktop / pty) keep a short request timeout so\n  // liveness failures surface promptly. EXEC duration is a different concern: by\n  // default it is unbounded (0), exactly like a command launched by an unrestricted\n  // local agent. The op-stream transport keeps control liveness, replay, and explicit\n  // cancellation independent of command duration. A deployment may opt into a hard\n  // process deadline by setting a positive value; 0 never schedules a process kill.\n  // Knobs: OPENGENI_SANDBOX_SELFHOSTED_EXEC_TIMEOUT_MS (default 0 = none) and\n  // OPENGENI_SANDBOX_SELFHOSTED_CONTROL_TIMEOUT_MS (default 30s).\n  sandboxSelfhostedExecTimeoutMs: z.coerce.number().int().nonnegative().default(0),\n  sandboxSelfhostedControlTimeoutMs: z.coerce.number().int().positive().default(30_000),\n  // --- sandbox lease cadences (cadence invariant validated at boot below) ---\n  // reaperPeriod < viewerHolderTTL, and reaperPeriod + idleGrace < the EFFECTIVE\n  // box idle timeout (effectiveModalIdleTimeoutSeconds, which defaults to the hard\n  // modalTimeoutSeconds). No keep-alive loop: between turns the box survives on its\n  // idle timeout — which we pin high enough (via the idle-timeout default) that\n  // Opengeni's reaper, not Modal's idle-reap, governs teardown so /workspace is\n  // snapshotted before the box dies (sandbox-file-persistence).\n  sandboxLeaseReaperPeriodMs: z.coerce.number().int().positive().default(30_000),\n  sandboxViewerHolderTtlMs: z.coerce.number().int().positive().default(90_000),\n  // A BrowserSession controller refreshes its durable resource and exact\n  // interaction lease holder together. This longer crash horizon tolerates API\n  // replacement while still releasing a placement whose controller died.\n  sandboxInteractionHolderTtlMs: z.coerce.number().int().positive().default(180_000),\n  // The DRAIN grace: how long a refcount-0 (draining) lease stays WARM before the\n  // reaper resume-by-ids the box and terminates it. This is the cost-vs-snappiness\n  // dial — when the user navigates away the box keeps refcount 0, but it survives\n  // this whole window so a \"glanced away then came back\" re-arms the SAME warm box\n  // (acquireLease re-arms draining->warm; the reaper's BEFORE-terminate re-read\n  // skips a re-armed box). Default 1min: a box restores from its workspace\n  // snapshot when the next turn comes later, so a long warm tail mostly bills an\n  // idle box. Raise it to trade warm cost for warm resumes after longer pauses.\n  // getSettings caps the default at half a shorter configured Modal lifetime so\n  // the entire reaper window always fits. Knob: OPENGENI_SANDBOX_IDLE_GRACE_MS.\n  sandboxIdleGraceMs: z.coerce.number().int().positive().default(60_000),\n  // Idle command containment. A legacy retained background command (a dev\n  // server, a command whose output is still draining, a stopped command the\n  // provider no longer answers for) keeps its box warm through a non-expiring\n  // process holder, so the zero-holder drain never runs and the box would stay\n  // up until the provider deadline kills it uncaptured. Once every session of\n  // the sandbox group has been unused this long - no open turn or pending\n  // request, no held wait_for_input, no other holder or writer, measured from\n  // durable turn/holder/admission facts - the reaper checkpoints the workspace,\n  // stops the box and settles those commands `lost` with reason\n  // `idle_containment`. Default 30min: well above the idle\n  // grace, so a lease that is only waiting for a \"glanced away\" user is\n  // never contained earlier than an idle lease would drain, and well inside\n  // the 1h provider-deadline rotation lead, so an idle box is saved long before\n  // the deadline path has to act. Set 0 to disable new idle enrollments without\n  // disabling provider-deadline containment or cancelling an enrolled drain.\n  // A positive window must exceed OPENGENI_SANDBOX_IDLE_GRACE_MS;\n  // an explicit positive value must also stay below OPENGENI_SANDBOX_ROTATION_LEAD_MS,\n  // and with an explicit OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS the reaper period\n  // plus this window plus the drain capture budget must fit before it.\n  // getSettings derives the unset default between those two for short-lived\n  // provider lifetimes. Knob: OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS.\n  sandboxIdleCommandContainmentMs: z.coerce\n    .number()\n    .int()\n    .nonnegative()\n    .optional()\n    .transform((value) => (value === 0 ? undefined : value)),\n  // MID-SESSION /workspace snapshot cadence (sandbox-file-persistence). The\n  // reaper's drain-persist only protects boxes the reaper itself kills; a box\n  // that dies any other way (Modal's hard creation-time timeout on a session\n  // busy past it, provider OOM/infra death) loses everything since the last\n  // clean drain. While a turn holds the box, the turn heartbeat and turn-end\n  // both take a snapshot when at least this interval has passed since the last\n  // one (same epoch-fenced fold-onto-lease seam as the drain), bounding the\n  // worst-case loss of ANY unclean box death to this window. 0 disables.\n  // Knob: OPENGENI_SANDBOX_SNAPSHOT_INTERVAL_MS. Default 15min.\n  sandboxSnapshotIntervalMs: z.coerce.number().int().min(0).default(900_000),\n  // Maximum time a best-effort /workspace snapshot capture may hold turn/reaper\n  // cleanup. A hung provider snapshot must never pin a lease holder, block\n  // graceful shutdown, or become permission to GC an older archive. Timeout is\n  // treated exactly like a failed best-effort snapshot. Knob:\n  // OPENGENI_SANDBOX_SNAPSHOT_TIMEOUT_MS. Default 60s.\n  sandboxSnapshotTimeoutMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS)\n    .default(60_000),\n  // A zero-holder drain may need substantially longer than a best-effort\n  // mid-turn/turn-end snapshot for a very large workspace. Keep that provider\n  // budget independent so increasing drain recovery headroom cannot pin an\n  // ordinary turn finalizer for the same duration. Unset preserves the legacy\n  // single-budget behavior. Knob:\n  // OPENGENI_SANDBOX_DRAIN_SNAPSHOT_TIMEOUT_MS.\n  sandboxDrainSnapshotTimeoutMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS)\n    .optional(),\n  // Begin a controlled snapshot/quiesce/drain/rematerialize transition this far\n  // ahead of a finite provider deadline. Modal's 24h creation clock cannot be\n  // extended; the logical sandbox outlives it by moving to one successor box.\n  // getSettings derives the actual default as min(1h, half the configured\n  // provider lifetime) so short-lived test/canary boxes remain bootable without\n  // an extra coupled environment override. An explicit value may be larger when\n  // an operator deliberately wants more rotation headroom; the boot invariant\n  // still requires it to remain below the provider lifetime.\n  sandboxRotationLeadMs: z.coerce.number().int().positive().default(3_600_000),\n  // Bound provider-deadline rotation admission independently of execution.\n  // Every admitted box receives its own durable drain child; the control worker\n  // limits provider I/O to 32 concurrent activities. Matching that bound avoids\n  // both the old one-box-per-tick deadline backlog and an unbounded provider/API\n  // burst. Operators may tune this for a differently-sized worker pool.\n  sandboxRotationBatchSize: z.coerce.number().int().positive().max(500).default(32),\n  // expires_at refresh window for a held lease (>> the turn 10s heartbeat so a\n  // single missed heartbeat never TTL-reaps a live turn). The warming TTL is the\n  // window a cold->warming spawner has to commit warm before a reaper resets it.\n  sandboxLeaseTtlMs: z.coerce.number().int().positive().default(90_000),\n  sandboxLeaseWarmingTtlMs: z.coerce.number().int().positive().default(120_000),\n  // Overall user-facing budget for warming a sandbox lease. Unlike the lease TTL\n  // (a liveness/reaper cadence), this bounds how long one turn waits for capacity\n  // or provider creation before surfacing a clear turn.failed error.\n  sandboxWarmingTimeoutMs: z.coerce.number().int().positive().default(600_000),\n  // Request-scoped workspace control-prefix budget: how long one HTTP-originated\n  // session/workspace mutation (Send, Steer, Pause/Resume/Cancel, queue\n  // move/edit/delete, composer draft, settings narrowing, quiescent tree\n  // deletion) may wait to enter the fair `workspace_inference_controls` prefix\n  // before failing with the retryable 503 `WORKSPACE_CONTROL_BUSY`. Worker\n  // settlement and claims never use it. The API installs the validated value\n  // into @opengeni/db once at app construction; nothing reads the env per\n  // request. Env: OPENGENI_WORKSPACE_CONTROL_LOCK_TIMEOUT_MS. Default 20 s.\n  workspaceControlLockTimeoutMs: z.coerce\n    .number({\n      message: \"OPENGENI_WORKSPACE_CONTROL_LOCK_TIMEOUT_MS must be a positive integer (ms)\",\n    })\n    .int(\"OPENGENI_WORKSPACE_CONTROL_LOCK_TIMEOUT_MS must be a positive integer (ms)\")\n    .positive(\"OPENGENI_WORKSPACE_CONTROL_LOCK_TIMEOUT_MS must be a positive integer (ms)\")\n    .default(20_000),\n  // Rig setup-script budget (M3): the wall-clock timeout the rig-setup lifecycle\n  // hook runs its script under, distinct from the 120s per-command lifecycle\n  // default (a rig may compile/install heavy tooling on first cold create).\n  // Env: OPENGENI_RIG_SETUP_TIMEOUT_MS. Default 10min.\n  rigSetupTimeoutMs: z.coerce.number().int().positive().default(600_000),\n  // --- sandbox warm-time billing (P2.1) ---\n  // Per-backend warm rate (usd_micros/sec), like modelPricingJson: an empty {}\n  // means warm-cost is not debited (warm-seconds are still metered for audit).\n  // Shape: { \"modal\": 5, \"runloop\": 4, ... }. Backends absent here meter\n  // warm-seconds but accrue NO warm_cost / debit (rate 0).\n  sandboxWarmRateMicrosPerSecondJson: z.string().default(\"{}\"),\n  sandboxWarmBillingMode: z.enum([\"usage_only\", \"shadow\", \"credits\"]).default(\"usage_only\"),\n  // Per-workspace warm cap (cumulative warm-seconds since the start of the UTC\n  // month, summed over sandbox.warm_seconds). 0 = unbounded. A workspace over the\n  // cap force-drains its VIEWER-ONLY boxes (guarded AND turn_holders=0 — a paying\n  // turn is never killed); the reaper then stop()s at refcount 0.\n  sandboxMaxWarmSecondsPerWorkspace: z.coerce.number().int().nonnegative().default(0),\n  sandboxPreparationProfiles: z.string().default(\"none\"),\n  sandboxEnvAllowlist: z.string().default(\"\"),\n  // Comma-separated image references a workspace may select as its default\n  // sandbox image. Empty keeps every workspace on the deployment image.\n  sandboxImageAllowlist: z.string().default(\"\"),\n  objectStorageEndpoint: z.string().url().optional(),\n  objectStorageInternalEndpoint: z.string().url().optional(),\n  objectStorageSandboxEndpoint: z.string().url().optional(),\n  objectStorageBackend: z\n    .enum([\"s3-compatible\", \"aws-s3\", \"azure-blob\", \"gcs\"])\n    .default(\"s3-compatible\"),\n  objectStorageBucket: z.string().min(1).default(\"opengeni-files\"),\n  objectStorageRegion: z.string().min(1).default(\"us-east-1\"),\n  objectStorageS3Provider: z.string().min(1).default(\"Minio\"),\n  objectStorageAccessKeyId: z.string().optional(),\n  objectStorageSecretAccessKey: z.string().optional(),\n  objectStorageForcePathStyle: EnvBoolean.default(true),\n  objectStorageAzureConnectionString: z.string().optional(),\n  objectStorageAzureAccountName: z.string().optional(),\n  objectStorageAzureAccountKey: z.string().optional(),\n  objectStorageAzureEndpoint: z.string().url().optional(),\n  objectStorageGcsProjectId: z.string().optional(),\n  objectStorageGcsCredentialsJson: z.string().optional(),\n  objectStorageGcsKeyFilename: z.string().optional(),\n  objectStorageGcsApiEndpoint: z.string().url().optional(),\n  documentParser: z.string().min(1).default(\"liteparse\"),\n  documentChunkSize: z.coerce.number().int().positive().default(1200),\n  documentChunkOverlap: z.coerce.number().int().nonnegative().default(160),\n  documentEmbeddingProvider: z.enum([\"openai\", \"deterministic\"]).default(\"openai\"),\n  documentEmbeddingModel: z.string().min(1).default(\"text-embedding-3-large\"),\n  documentEmbeddingDimensions: z.coerce.number().int().positive().default(3072),\n  documentEmbeddingApiKey: z.string().optional(),\n  documentEmbeddingBaseUrl: z.string().url().optional(),\n  documentEmbeddingBillingMode: z.enum([\"usage_only\", \"shadow\", \"credits\"]).default(\"usage_only\"),\n  // Site SQL: optional per-Site Cloudflare storage (one SQLite Durable Object\n  // per Site, docs/site-data.md). Off unless enabled here, the gateway's\n  // internal origin is set and the published Sites gateway secret is\n  // configured; the API signs its calls to the gateway with that secret.\n  // Usage is recorded in the usage ledger only. Free-profile defaults are strict.\n  sitesCloudflareStorageEnabled: EnvBoolean.default(false),\n  sitesGatewayInternalOrigin: z\n    .string()\n    .url()\n    .refine((value) => {\n      const url = new URL(value);\n      if (url.pathname !== \"/\" || url.search || url.hash || url.username || url.password)\n        return false;\n      if (url.protocol === \"https:\") return true;\n      return url.protocol === \"http:\" && [\"127.0.0.1\", \"localhost\", \"[::1]\"].includes(url.hostname);\n    }, \"must be an https origin (http only on loopback)\")\n    .optional(),\n  // Site SQL storage per Site; defaults to the 5 GiB hard ceiling.\n  sitesSqlFreeStorageBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .default(5 * 1024 * 1024 * 1024),\n  // Optional per-Site monthly row quotas; unset means none (the platform\n  // meters rows per workspace instead; rate and per-call caps still apply).\n  sitesSqlFreeRowsReadPerMonth: z.coerce.number().int().positive().optional(),\n  sitesSqlFreeRowsWrittenPerMonth: z.coerce.number().int().positive().optional(),\n  sitesSqlFreeCallsPerMinutePerViewer: z.coerce.number().int().positive().default(60),\n  sitesSqlFreeCallsPerMinutePerSite: z.coerce.number().int().positive().default(600),\n  sitesSqlMaxRowsPerCall: z.coerce.number().int().min(1).max(5_000).default(1_000),\n  sitesSqlMaxResponseBytes: z.coerce\n    .number()\n    .int()\n    .min(1024)\n    .max(4 * 1024 * 1024)\n    .default(1024 * 1024),\n  sitesSqlTimeoutMs: z.coerce.number().int().min(1_000).max(60_000).default(15_000),\n  // Site Data quotas and write rate limits. Usage is recorded in the\n  // usage ledger only; shadow and paid modes are a later rollout step.\n  siteDataRecordBytesPerSite: z.coerce\n    .number()\n    .int()\n    .positive()\n    .default(100 * 1024 * 1024),\n  siteDataMaxRecordBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .default(256 * 1024),\n  siteDataMaxCollectionsPerSite: z.coerce.number().int().positive().default(50),\n  siteDataFileBytesPerSite: z.coerce\n    .number()\n    .int()\n    .positive()\n    .default(1024 * 1024 * 1024),\n  siteDataMaxFileBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .default(10 * 1024 * 1024),\n  siteDataWorkspaceBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .default(1024 * 1024 * 1024),\n  siteDataViewerWritesPerMinute: z.coerce.number().int().positive().default(120),\n  siteDataSiteWritesPerMinute: z.coerce.number().int().positive().default(600),\n  siteDataViewerReadsPerMinute: z.coerce.number().int().positive().default(600),\n  siteDataManagerWritesPerMinute: z.coerce.number().int().positive().default(6_000),\n  // Schema-validation time one Site may spend per minute.\n  siteDataSiteValidationMsPerMinute: z.coerce.number().int().positive().default(5_000),\n  // Schema-validation time all of a workspace's Sites may spend per minute.\n  siteDataWorkspaceValidationMsPerMinute: z.coerce.number().int().positive().default(20_000),\n  siteDataMaxRecordsPerCollection: z.coerce.number().int().positive().default(100_000),\n  // Published Sites (docs/design/published-sites-2026-10-14.md). Publishing is\n  // off unless sitesDomain names the Sites domain; the site-runtime API also\n  // needs the gateway secret. Defaults are strict.\n  sitesDomain: z.string().trim().min(3).max(200).optional(),\n  sitesGatewaySecret: z.string().min(32).optional(),\n  // Accepted during rotation only; remove once the gateway signs with the new secret.\n  sitesGatewaySecretPrevious: z.string().min(32).optional(),\n  sitesPublicEnabled: EnvBoolean.default(true),\n  sitesPublicAgentsEnabled: EnvBoolean.default(true),\n  // Login-only deployments (staging): public means any signed-in user; no guests.\n  sitesLoginOnly: EnvBoolean.default(false),\n  sitesForceNoindex: EnvBoolean.default(false),\n  // Defaults to abuse@<sites domain>.\n  sitesAbuseEmail: z.string().email().optional(),\n  // Guests start embedded agents only after the gateway verified a bot challenge.\n  sitesGuestAgentHumanCheck: EnvBoolean.default(false),\n  // Rate brakes of every Site limit profile (all access modes).\n  sitesFreeRequestsPerMinutePerVisitor: z.coerce.number().int().positive().default(120),\n  sitesFreeGuestWritesPerMinute: z.coerce.number().int().nonnegative().default(30),\n  // Deprecated (the former free profile): fallbacks for the public and guest\n  // settings below when those are unset.\n  sitesFreeConversationsPerVisitorPerDay: z.coerce.number().int().nonnegative().optional(),\n  sitesFreeConversationsPerSitePerDay: z.coerce.number().int().nonnegative().optional(),\n  sitesFreeTurnsPerConversation: z.coerce.number().int().nonnegative().optional(),\n  sitesFreeAgentMicrosPerConversation: z.coerce.number().int().nonnegative().optional(),\n  sitesFreeAgentMicrosPerVisitorPerDay: z.coerce.number().int().nonnegative().optional(),\n  sitesFreeAgentMicrosPerSitePerMonth: z.coerce.number().int().nonnegative().optional(),\n  // Standard model-spend limits (micro-USD) for people outside the workspace\n  // (invited and public alike). Members are never limited by Site limits:\n  // they use the workspace's normal session limits. Unset: the deprecated\n  // free setting, else $10 per Site per month and no per-person limit.\n  sitesAgentMicrosPerSitePerMonth: z.coerce.number().int().nonnegative().optional(),\n  sitesAgentMicrosPerPersonPerDay: z.coerce.number().int().nonnegative().optional(),\n  // Internal guards for anonymous public visitors (not shown to Site owners). Unset:\n  // the deprecated free setting, else 20, 500, 50 and $1.\n  sitesGuestConversationsPerVisitorPerDay: z.coerce.number().int().nonnegative().optional(),\n  sitesGuestConversationsPerSitePerDay: z.coerce.number().int().nonnegative().optional(),\n  sitesGuestTurnsPerConversation: z.coerce.number().int().nonnegative().optional(),\n  sitesGuestAgentMicrosPerConversation: z.coerce.number().int().nonnegative().optional(),\n  // What each agent turn of someone outside the workspace holds against the\n  // Site's spend limits while it runs (micro-USD; actual spend replaces it\n  // when settled), capped by the conversation's own cap and what is left.\n  sitesAgentReservationMicrosPerTurn: z.coerce.number().int().min(1_000).default(250_000),\n  // The credits profile multiplies the standard spend caps and guest guards.\n  sitesCreditsLimitMultiplier: z.coerce.number().int().min(1).max(1_000).default(10),\n  // Site platform usage (gateway requests, Site SQL rows and storage, Site\n  // Data storage), metered apart from model spend. usage_only records it;\n  // shadow computes the charge without charging; credits charges usage above\n  // the per-workspace monthly allowance.\n  sitesPlatformBillingMode: z.enum([\"usage_only\", \"shadow\", \"credits\"]).default(\"usage_only\"),\n  // Credits mode: false refuses usage past the allowance instead of charging it.\n  sitesPlatformOverageEnabled: EnvBoolean.default(true),\n  sitesPlatformAllowanceRequests: z.coerce.number().int().nonnegative().default(1_000_000),\n  sitesPlatformAllowanceSqlRowsRead: z.coerce.number().int().nonnegative().default(10_000_000),\n  sitesPlatformAllowanceSqlRowsWritten: z.coerce.number().int().nonnegative().default(100_000),\n  sitesPlatformAllowanceStorageBytes: z.coerce.number().int().nonnegative().default(1_000_000_000),\n  // Unit prices in micro-USD: twice the Cloudflare list price (Workers\n  // requests, Durable Object SQLite rows and storage), covering host lookups,\n  // Durable Object requests and duration, and API work.\n  sitesPlatformPriceMicrosPerMillionRequests: z.coerce\n    .number()\n    .int()\n    .nonnegative()\n    .default(600_000),\n  sitesPlatformPriceMicrosPerMillionSqlRowsRead: z.coerce\n    .number()\n    .int()\n    .nonnegative()\n    .default(2_000),\n  sitesPlatformPriceMicrosPerMillionSqlRowsWritten: z.coerce\n    .number()\n    .int()\n    .nonnegative()\n    .default(2_000_000),\n  sitesPlatformPriceMicrosPerGbMonth: z.coerce.number().int().nonnegative().default(400_000),\n  // The Opengeni-wide monthly brake: estimated USD cost of all workspaces'\n  // platform usage at the prices above. 0 turns the brake off.\n  sitesPlatformMonthlyLimitUsd: z.coerce.number().nonnegative().max(100_000_000).default(1_000),\n  sitesPlatformAlertPercent: z.coerce.number().int().min(1).max(100).default(80),\n  sitesReportsPerMinutePerVisitor: z.coerce.number().int().positive().default(5),\n  sitesViewerSessionIdleSeconds: z.coerce\n    .number()\n    .int()\n    .min(60)\n    .default(12 * 60 * 60),\n  sitesViewerSessionAbsoluteSeconds: z.coerce\n    .number()\n    .int()\n    .min(60)\n    .max(30 * 24 * 60 * 60)\n    .default(7 * 24 * 60 * 60),\n  // A released hostname stays held for its workspace at least this long.\n  sitesHostnameHoldDays: z.coerce.number().int().min(30).default(30),\n  // Optional Cloudflare edge sync: KV host map and cache purge. All unset: no-op.\n  sitesCloudflareApiToken: z.string().min(1).optional(),\n  sitesCloudflareAccountId: z.string().min(1).optional(),\n  sitesCloudflareKvNamespaceId: z.string().min(1).optional(),\n  sitesCloudflareZoneId: z.string().min(1).optional(),\n  // KV expiry of host-map entries; bounds staleness if a sync write is missed.\n  sitesHostMapTtlSeconds: z.coerce.number().int().min(60).max(86_400).default(300),\n  // Google Web Risk scanning of URLs in Site HTML on publish; off without a key.\n  sitesWebRiskApiKey: z.string().min(1).optional(),\n  // Explicit commercial cutover. Existing queued revisions remain unpriced;\n  // only jobs created at or after this instant may enter the paid rail.\n  documentEmbeddingCreditsActivatedAt: z.iso.datetime().optional(),\n  // Customer tariff for the exact UTF-8 bytes sent to the embedder. Zero leaves\n  // the paid mode unavailable; no commercial rate is selected by this PR.\n  documentEmbeddingRateMicrosPerMillionBytes: z.coerce.number().int().nonnegative().default(0),\n  documentCurationProvider: z.enum([\"openai\", \"heuristic\", \"none\"]).default(\"openai\"),\n  documentCurationModel: z.string().min(1).default(\"gpt-4o-mini\"),\n  documentCurationApiKey: z.string().optional(),\n  documentCurationBaseUrl: z.string().url().optional(),\n  gitAuthorName: z.string().optional(),\n  gitAuthorEmail: z.string().optional(),\n  gitCommitterName: z.string().optional(),\n  gitCommitterEmail: z.string().optional(),\n  githubAppManifestBaseUrl: z.string().optional(),\n  githubAppManifestStateSecret: z.string().optional(),\n  githubAppId: z.string().optional(),\n  githubClientId: z.string().optional(),\n  githubClientSecret: z.string().optional(),\n  /** Default-off rollout for the in-process GitHub repository API tool surface. */\n  githubRestMcpEnabled: EnvBoolean.default(false),\n  githubPersonalOauthEnabled: EnvBoolean.default(false),\n  githubPersonalOauthClientId: z.string().optional(),\n  githubPersonalOauthClientSecret: z.string().optional(),\n  githubAppSlug: z.string().optional(),\n  githubWebhookSecret: z.string().optional(),\n  githubAppPrivateKey: z.string().optional(),\n  prReviewGithubAppId: z.string().optional(),\n  prReviewGithubClientId: z.string().optional(),\n  prReviewGithubClientSecret: z.string().optional(),\n  prReviewGithubAppSlug: z.string().optional(),\n  prReviewGithubWebhookSecret: z.string().optional(),\n  prReviewGithubAppPrivateKey: z.string().optional(),\n  betterAuthSecret: z.string().optional(),\n  betterAuthAllowedHosts: z.string().default(\"\"),\n  betterAuthCookieDomain: z.string().optional(),\n  betterAuthTrustedOrigins: z.string().default(\"\"),\n  managedAuthGoogleClientId: z.string().optional(),\n  managedAuthGoogleClientSecret: z.string().optional(),\n  managedAuthGithubClientId: z.string().optional(),\n  managedAuthGithubClientSecret: z.string().optional(),\n  // Rolling browser login-slot compatibility. Repository/deployment default is\n  // deliberately legacy; changing to broker is an operator-authorized rollout.\n  allowedUserEmails: z\n    .array(z.email().transform((email) => email.toLowerCase()))\n    .min(1)\n    .optional(),\n  managedAuthSessionSetMode: z.enum([\"legacy\", \"dual\", \"broker\"]).default(\"legacy\"),\n  // URL schemes the native app may receive its sign-in code on\n  // (`<scheme>://auth/callback`). A host shipping its own build of the app\n  // adds its scheme here.\n  nativeAppSchemes: z\n    .array(z.string().regex(/^[a-z][a-z0-9+.-]{1,63}$/u))\n    .min(1)\n    .default([\"opengeni\"]),\n  // Bundle identifiers / package names of native app builds allowed to\n  // register for push, and the provider credentials that push to them. Push\n  // stays off for a platform until its credentials are set.\n  nativeAppIds: z\n    .array(z.string().regex(/^[A-Za-z0-9._-]{1,255}$/u))\n    .min(1)\n    .default([\"ai.opengeni.app\"]),\n  apnsKeyId: z\n    .string()\n    .regex(/^[A-Z0-9]{10}$/u)\n    .optional(),\n  apnsTeamId: z\n    .string()\n    .regex(/^[A-Z0-9]{10}$/u)\n    .optional(),\n  // The APNs auth key (.p8 PEM). Literal \"\\n\" sequences are accepted.\n  apnsPrivateKey: z.string().min(1).optional(),\n  // A Firebase service account JSON with the Cloud Messaging API role.\n  fcmServiceAccountJson: z.string().min(1).optional(),\n  // Deployment ceiling for new managed accounts. When false, managed auth\n  // refuses every new Better Auth account (email/password sign-up and implicit\n  // Google/GitHub sign-up) while existing sign-in, sessions, password reset,\n  // email verification, and invitation-bound account setup keep working. Read\n  // at startup; the 0585 runtime switch pauses sign-ups without a restart.\n  managedAuthNewSignupsEnabled: EnvBoolean.default(true),\n  // Unset retains environment-based verification (required outside local).\n  managedAuthRequireEmailVerification: EnvBoolean.optional(),\n  // Query transport is an explicit second-stage rollout. A pre-compatibility\n  // web image understands only fragment bearers, so API replicas must keep\n  // generating fragment links until the compatible web fleet has converged.\n  organizationUserSetupEmailTokenTransport: z.enum([\"fragment\", \"query\"]).default(\"fragment\"),\n  // Query-bearing setup links may appear in controller/edge error logs even\n  // when access logs and request tracing are disabled. This explicit operator\n  // confirmation keeps query transport fail closed until that separate sink is\n  // proven sanitized.\n  organizationUserSetupQueryEdgeSanitizationConfirmed: EnvBoolean.default(false),\n  // Managed mode sends sign-up verification, organization user setup and sign-in\n  // method notices by email. \"disabled\" is an explicit operator choice for\n  // deployments that provision accounts another way: nothing is ever sent, and\n  // those deliveries settle as failed with errorClass \"delivery_disabled\".\n  managedEmailDelivery: z.enum([\"resend\", \"disabled\"]).default(\"resend\"),\n  resendApiKey: z.string().optional(),\n  emailFrom: z.string().default(\"Opengeni <auth@mail.opengeni.ai>\"),\n  stripeSecretKey: z.string().optional(),\n  stripePublishableKey: z.string().optional(),\n  stripeWebhookSecret: z.string().optional(),\n  stripeCreditsProductId: z.string().optional(),\n  // Enables subscription service paths only; top-up billing remains independent.\n  subscriptionPlansEnabled: EnvBoolean.default(false),\n  mcpServers: z\n    .array(\n      z.object({\n        id: z.string().min(1).regex(registryId),\n        name: z.string().min(1).optional(),\n        url: z.string().url(),\n        allowedTools: z.array(z.string().min(1)).optional(),\n        timeoutMs: z.number().int().positive().optional(),\n        /**\n         * Bound for session setup requests only (initialize and tools/list),\n         * when it should be longer than the client's default. Tool calls keep\n         * `timeoutMs` (or the client default) unchanged.\n         */\n        setupTimeoutMs: z.number().int().positive().optional(),\n        cacheToolsList: z.boolean().default(false),\n        /** Runtime approval policy, overlaid from an attempt-frozen session snapshot. */\n        requireApproval: SessionMcpApprovalPolicy.optional(),\n        /**\n         * Extra request headers sent to this MCP server (credential injection\n         * for workspace-enabled capability MCPs). Populated at runtime from\n         * encrypted capability-installation credentials; do not put secrets in\n         * OPENGENI_MCP_SERVERS.\n         */\n        headers: z.record(z.string(), z.string()).optional(),\n        connectionRef: McpServerConnectionRefSchema.optional(),\n        operationRecovery: McpOperationRecoverySchema.optional(),\n      }),\n    )\n    .default([]),\n});\n\nexport type Settings = z.infer<typeof SettingsSchema>;\n\n// Independently supervised artifact services are not API/agent runtimes. Parse\n// only their actual capabilities, using the same field schemas as getSettings.\nconst ArtifactServiceSettingsSchema = SettingsSchema.pick({\n  serviceName: true,\n  environment: true,\n  deploymentRevision: true,\n  dbSchema: true,\n  rlsStrategy: true,\n  databasePreparedStatements: true,\n  observabilityStructuredLogs: true,\n  observabilityMetricsEnabled: true,\n  observabilityOtlpEndpoint: true,\n  observabilityOtlpHeaders: true,\n});\nconst ArtifactOutboxSettingsSchema = ArtifactServiceSettingsSchema.extend({\n  natsUrl: SettingsSchema.shape.natsUrl,\n  selfhostedNatsControlUser: SettingsSchema.shape.selfhostedNatsControlUser,\n  selfhostedNatsControlPassword: SettingsSchema.shape.selfhostedNatsControlPassword,\n});\nconst ObjectStorageSettingsSchema = SettingsSchema.pick({\n  objectStorageBackend: true,\n  objectStorageEndpoint: true,\n  objectStorageInternalEndpoint: true,\n  objectStorageSandboxEndpoint: true,\n  objectStorageBucket: true,\n  objectStorageRegion: true,\n  objectStorageAccessKeyId: true,\n  objectStorageSecretAccessKey: true,\n  objectStorageForcePathStyle: true,\n  objectStorageAzureConnectionString: true,\n  objectStorageAzureAccountName: true,\n  objectStorageAzureAccountKey: true,\n  objectStorageAzureEndpoint: true,\n  objectStorageGcsProjectId: true,\n  objectStorageGcsCredentialsJson: true,\n  objectStorageGcsKeyFilename: true,\n  objectStorageGcsApiEndpoint: true,\n});\nconst ArtifactMaterializerSettingsSchema = ArtifactServiceSettingsSchema.extend(\n  ObjectStorageSettingsSchema.shape,\n);\nexport type ArtifactOutboxSettings = z.infer<typeof ArtifactOutboxSettingsSchema>;\nexport type ObjectStorageSettings = z.infer<typeof ObjectStorageSettingsSchema>;\nexport type ArtifactMaterializerSettings = z.infer<typeof ArtifactMaterializerSettingsSchema>;\n\nfunction artifactServiceEnvironment(source: NodeJS.ProcessEnv) {\n  const optional = (name: string) => optionalEnvironmentValue(name, source);\n  return {\n    serviceName: optional(\"OPENGENI_SERVICE_NAME\"),\n    environment: optional(\"OPENGENI_ENVIRONMENT\"),\n    deploymentRevision:\n      optional(\"OPENGENI_DEPLOYMENT_REVISION\") ??\n      optional(\"SOURCE_VERSION\") ??\n      optional(\"GITHUB_SHA\"),\n    dbSchema: optional(\"OPENGENI_DB_SCHEMA\"),\n    rlsStrategy: optional(\"OPENGENI_RLS_STRATEGY\"),\n    databasePreparedStatements: optional(\"OPENGENI_DATABASE_PREPARED_STATEMENTS\"),\n    observabilityStructuredLogs: optional(\"OPENGENI_OBSERVABILITY_STRUCTURED_LOGS\"),\n    observabilityMetricsEnabled: optional(\"OPENGENI_OBSERVABILITY_METRICS_ENABLED\"),\n    observabilityOtlpEndpoint:\n      optional(\"OPENGENI_OTEL_EXPORTER_OTLP_ENDPOINT\") ?? optional(\"OTEL_EXPORTER_OTLP_ENDPOINT\"),\n    observabilityOtlpHeaders:\n      optional(\"OPENGENI_OTEL_EXPORTER_OTLP_HEADERS\") ?? optional(\"OTEL_EXPORTER_OTLP_HEADERS\"),\n  };\n}\n\nexport function getArtifactOutboxSettings(\n  source: NodeJS.ProcessEnv = process.env,\n): ArtifactOutboxSettings {\n  const settings = ArtifactOutboxSettingsSchema.parse({\n    ...artifactServiceEnvironment(source),\n    natsUrl: optionalEnvironmentValue(\"OPENGENI_NATS_URL\", source),\n    selfhostedNatsControlUser: optionalEnvironmentValue(\n      \"OPENGENI_SELFHOSTED_NATS_CONTROL_USER\",\n      source,\n    ),\n    selfhostedNatsControlPassword: optionalEnvironmentValue(\n      \"OPENGENI_SELFHOSTED_NATS_CONTROL_PASSWORD\",\n      source,\n    ),\n  });\n  dbSearchPath(settings);\n  if (\n    Boolean(settings.selfhostedNatsControlUser) !== Boolean(settings.selfhostedNatsControlPassword)\n  ) {\n    throw new Error(\"Artifact outbox NATS control user and password must be configured together\");\n  }\n  return settings;\n}\n\nexport function getArtifactMaterializerSettings(\n  source: NodeJS.ProcessEnv = process.env,\n): ArtifactMaterializerSettings {\n  const optional = (name: string) => optionalEnvironmentValue(name, source);\n  const settings = ArtifactMaterializerSettingsSchema.parse({\n    ...artifactServiceEnvironment(source),\n    objectStorageEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_ENDPOINT\"),\n    objectStorageInternalEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_INTERNAL_ENDPOINT\"),\n    objectStorageSandboxEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_SANDBOX_ENDPOINT\"),\n    objectStorageBackend: optional(\"OPENGENI_OBJECT_STORAGE_BACKEND\"),\n    objectStorageBucket: optional(\"OPENGENI_OBJECT_STORAGE_BUCKET\"),\n    objectStorageRegion: optional(\"OPENGENI_OBJECT_STORAGE_REGION\"),\n    objectStorageAccessKeyId: optional(\"OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID\"),\n    objectStorageSecretAccessKey: optional(\"OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY\"),\n    objectStorageForcePathStyle: optional(\"OPENGENI_OBJECT_STORAGE_FORCE_PATH_STYLE\"),\n    objectStorageAzureConnectionString: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_CONNECTION_STRING\"),\n    objectStorageAzureAccountName: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_NAME\"),\n    objectStorageAzureAccountKey: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_KEY\"),\n    objectStorageAzureEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ENDPOINT\"),\n    objectStorageGcsProjectId: optional(\"OPENGENI_OBJECT_STORAGE_GCS_PROJECT_ID\"),\n    objectStorageGcsCredentialsJson: optional(\"OPENGENI_OBJECT_STORAGE_GCS_CREDENTIALS_JSON\"),\n    objectStorageGcsKeyFilename: optional(\"OPENGENI_OBJECT_STORAGE_GCS_KEY_FILENAME\"),\n    objectStorageGcsApiEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_GCS_API_ENDPOINT\"),\n  });\n  dbSearchPath(settings);\n  validateObjectStorageSettings(settings);\n  return settings;\n}\n\nexport type McpServerConfig = Settings[\"mcpServers\"][number];\n\nexport type GoogleDriveProviderRetryOptions = {\n  requestTimeoutMs: number;\n  attempts: number;\n  initialDelayMs: number;\n  maxDelayMs: number;\n  budgetMs: number;\n};\n\n/** Freeze one validated provider-neutral budget into every newly created or\n * updated Google Drive knowledge-source schedule. Existing schedules retain\n * their persisted limits until an authorized source save updates them. */\nexport function configuredGoogleDriveSyncLimits(settings: Settings) {\n  return KnowledgeSourceSyncLimits.parse({\n    maxItems: settings.googleDriveSyncMaxItems,\n    maxBytes: settings.googleDriveSyncMaxBytes,\n    maxFileBytes: settings.googleDriveSyncMaxFileBytes,\n    maxProviderRequests: settings.googleDriveSyncMaxProviderRequests,\n    maxElapsedSeconds: settings.googleDriveSyncMaxElapsedSeconds,\n    maxFailureDetails: settings.googleDriveSyncMaxFailureDetails,\n  });\n}\n\n/** Bounded in-activity retry policy for individual Google Drive requests. The\n * durable sync workflow remains authoritative after this local budget ends. */\nexport function googleDriveProviderRetryOptions(\n  settings: Settings,\n): GoogleDriveProviderRetryOptions {\n  return {\n    requestTimeoutMs: settings.googleDriveProviderRequestTimeoutMs,\n    attempts: settings.googleDriveProviderRetryAttempts,\n    initialDelayMs: settings.googleDriveProviderRetryInitialDelayMs,\n    maxDelayMs: settings.googleDriveProviderRetryMaxDelayMs,\n    budgetMs: settings.googleDriveProviderRetryBudgetMs,\n  };\n}\n\n/** Return only a credential-free HTTP(S) origin. Reject path, user-info, query,\n * and fragment input instead of reflecting it into callbacks or evidence. */\nexport function canonicalPublicOrigin(publicBaseUrl: string | undefined): string | null {\n  if (!publicBaseUrl) return null;\n  let parsed: URL;\n  try {\n    parsed = new URL(publicBaseUrl);\n  } catch {\n    return null;\n  }\n  if (\n    ![\"http:\", \"https:\"].includes(parsed.protocol) ||\n    parsed.username ||\n    parsed.password ||\n    parsed.search ||\n    parsed.hash ||\n    (parsed.pathname !== \"\" && parsed.pathname !== \"/\")\n  ) {\n    return null;\n  }\n  return parsed.origin;\n}\n\nexport function googleDriveOAuthCallbackUrl(publicBaseUrl: string | undefined): string | null {\n  const origin = canonicalPublicOrigin(publicBaseUrl);\n  return origin ? `${origin}/v1/integrations/google-drive/callback` : null;\n}\n\n/** Exact callback registered on the environment-specific personal GitHub OAuth App. */\nexport function personalGitHubOAuthCallbackUrl(publicBaseUrl: string | undefined): string | null {\n  const origin = canonicalPublicOrigin(publicBaseUrl);\n  return origin ? `${origin}/v1/integrations/github-personal/oauth/callback` : null;\n}\n\n/** Declarative voice-input transcription provider ids. */\nexport type VoiceInputProviderId =\n  | \"openai\"\n  | \"azure-openai\"\n  | \"azure-mai\"\n  | \"codex-subscription\"\n  | \"supergrok-subscription\";\n\nexport type VoiceInputProviderConfig =\n  | {\n      id: \"azure-mai\";\n      kind: \"azure-mai\";\n      pricing: VoiceInputPricing | null;\n      endpoint: string;\n      apiKey: string;\n      apiVersion: string;\n      model: string;\n    }\n  | {\n      id: \"openai\";\n      kind: \"openai\";\n      apiKey: string;\n      baseUrl: string;\n      model: string;\n      /** Deployment-funded: Opengeni pays upstream and charges credits. */\n      pricing: VoiceInputPricing | null;\n    }\n  | {\n      id: \"azure-openai\";\n      kind: \"azure-openai\";\n      endpoint: string;\n      deployment: string;\n      apiVersion: string;\n      apiKey: string | null;\n      adToken: string | null;\n      /** Underlying model (pricing + response shape); defaults to the deployment name. */\n      model: string;\n      /** Deployment-funded: Opengeni pays upstream and charges credits. */\n      pricing: VoiceInputPricing | null;\n    }\n  | {\n      id: \"codex-subscription\";\n      kind: \"codex-subscription\";\n      experimental: true;\n    }\n  | {\n      id: \"supergrok-subscription\";\n      kind: \"supergrok-subscription\";\n      experimental: true;\n    };\n\nfunction usableDeploymentSecret(value: string | null | undefined): string | undefined {\n  return isUsableVoiceInputSecret(value) ? value : undefined;\n}\n\n/** The deployment's Jev key, or undefined when it is missing or a placeholder. */\nexport function usableJevApiKey(settings: Pick<Settings, \"jevApiKey\">): string | undefined {\n  return usableDeploymentSecret(settings.jevApiKey);\n}\n\nexport type DecisionModelSettings = Pick<\n  Settings,\n  \"decisionModelProvider\" | \"decisionModelId\" | \"decisionModelApiKey\" | \"decisionModelBaseUrl\"\n>;\n/** Explicit deployment credentials only. Compatibility is code-search-only. */\nexport function decisionModelConfiguration(\n  settings: DecisionModelSettings &\n    Partial<Pick<Settings, \"jevApiKey\" | \"jevModel\" | \"jevBaseUrl\">>,\n  allowLegacyCodeSearch = false,\n):\n  | { provider: \"jev\" | \"openai\" | \"openrouter\"; model: string; apiKey: string; baseUrl?: string }\n  | undefined {\n  const explicit =\n    settings.decisionModelProvider !== undefined ||\n    settings.decisionModelId !== undefined ||\n    settings.decisionModelApiKey !== undefined ||\n    settings.decisionModelBaseUrl !== undefined;\n  if (explicit) {\n    const apiKey = usableDeploymentSecret(settings.decisionModelApiKey);\n    if (!settings.decisionModelProvider || !settings.decisionModelId || !apiKey) return undefined;\n    return {\n      provider: settings.decisionModelProvider,\n      model: settings.decisionModelId,\n      apiKey,\n      ...(settings.decisionModelBaseUrl ? { baseUrl: settings.decisionModelBaseUrl } : {}),\n    };\n  }\n  const apiKey = allowLegacyCodeSearch ? usableJevApiKey(settings) : undefined;\n  return apiKey\n    ? {\n        provider: \"jev\",\n        model: settings.jevModel ?? \"jev-latest\",\n        apiKey,\n        ...(settings.jevBaseUrl ? { baseUrl: settings.jevBaseUrl } : {}),\n      }\n    : undefined;\n}\n\n/** Deployment half of agent configuration: hard capability limits. */\nexport function agentConfigDeploymentPolicy(\n  settings: FirstPartyMcpToolPolicySettings & Pick<Settings, \"webSearchEnabled\">,\n): AgentConfigDeploymentLimits {\n  return agentConfigDeploymentLimitsFromAllowlist(\n    resolveFirstPartyMcpToolPolicy(settings).allowed,\n    settings.webSearchEnabled ? {} : { webSearch: \"web search is turned off on this server\" },\n  );\n}\n\n/**\n * Deployment half of the `code_search` decision. `available` is false when\n * the mode is off or no usable decision model is configured; workspaces then cannot\n * turn it on. `workspaceDefault` applies to workspaces without their own\n * setting.\n */\nexport function codeSearchDeploymentPolicy(\n  settings: Pick<Settings, \"codeSearchMode\" | \"jevApiKey\"> & DecisionModelSettings,\n): CodeSearchDeploymentPolicy {\n  const available =\n    settings.codeSearchMode !== \"off\" && decisionModelConfiguration(settings, true) !== undefined;\n  if (!available) return { available: false, workspaceDefault: \"off\" };\n  const workspaceDefault =\n    settings.codeSearchMode === \"default_on\"\n      ? \"on\"\n      : settings.codeSearchMode === \"experiment\"\n        ? \"split\"\n        : \"off\";\n  return { available, workspaceDefault };\n}\n\n/**\n * Reject empty / template secrets so `.env.example` placeholders like\n * `your-key` cannot advertise voice input as available and then 401 upstream.\n */\nexport function isUsableVoiceInputSecret(value: string | null | undefined): value is string {\n  if (value == null) return false;\n  const trimmed = value.trim();\n  if (!trimmed) return false;\n  const normalized = trimmed.toLowerCase();\n  if (\n    normalized === \"your-key\" ||\n    normalized === \"your_key\" ||\n    normalized === \"changeme\" ||\n    normalized === \"replace-me\" ||\n    normalized === \"xxx\" ||\n    normalized.startsWith(\"your-\") ||\n    normalized.startsWith(\"your_\")\n  ) {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Resolve the configured voice-input provider registry in selection order.\n * Credentials stay in this server-side structure; ClientConfig only projects\n * whether at least one non-experimental (or probed experimental) provider exists.\n */\nexport function resolveVoiceInputProviderRegistry(settings: Settings): VoiceInputProviderConfig[] {\n  return voiceInputProviderRegistryWithIssues(settings).providers;\n}\n\n/** Why a credentialed deployment-funded voice provider is withheld. */\nexport type VoiceInputPricingIssue = {\n  providerId: \"openai\" | \"azure-openai\" | \"azure-mai\";\n  env: string;\n  reason: \"malformed\" | \"unpriced\";\n  message: string;\n};\n\n/**\n * Pricing problems that withhold a credentialed deployment-funded provider.\n * A malformed PRICING_JSON never fails boot (workers share this config and\n * must not crash-loop over a voice-only setting); the API logs each issue\n * once at startup and the provider stays unavailable.\n */\nexport function voiceInputPricingIssues(settings: Settings): VoiceInputPricingIssue[] {\n  return voiceInputProviderRegistryWithIssues(settings).issues;\n}\n\nfunction voiceInputProviderPricing(\n  settings: Settings,\n  issues: VoiceInputPricingIssue[],\n  providerId: VoiceInputPricingIssue[\"providerId\"],\n  env: string,\n  raw: string | undefined,\n  model: string,\n): { usable: true; pricing: VoiceInputPricing | null } | { usable: false } {\n  const resolved = safeResolveVoiceInputPricing(raw, model, env);\n  if (!resolved.ok) {\n    issues.push({ providerId, env, reason: \"malformed\", message: resolved.error });\n    return { usable: false };\n  }\n  if (!resolved.pricing && voiceInputCreditBillingActive(settings)) {\n    // Never serve unpriced deployment-paid audio on a credit-billed deployment.\n    issues.push({\n      providerId,\n      env,\n      reason: \"unpriced\",\n      message: `${env} is required: credit billing is active and model \"${model}\" has no built-in voice price`,\n    });\n    return { usable: false };\n  }\n  return { usable: true, pricing: resolved.pricing };\n}\n\nfunction voiceInputProviderRegistryWithIssues(settings: Settings): {\n  providers: VoiceInputProviderConfig[];\n  issues: VoiceInputPricingIssue[];\n} {\n  const issues: VoiceInputPricingIssue[] = [];\n  const order = settings.voiceInputProviderOrder\n    .split(\",\")\n    .map((part) => part.trim())\n    .filter(\n      (part): part is VoiceInputProviderId =>\n        part === \"openai\" ||\n        part === \"azure-openai\" ||\n        part === \"azure-mai\" ||\n        part === \"codex-subscription\" ||\n        part === \"supergrok-subscription\",\n    );\n  const seen = new Set<VoiceInputProviderId>();\n  const providers: VoiceInputProviderConfig[] = [];\n  for (const id of order) {\n    if (seen.has(id)) continue;\n    seen.add(id);\n    if (id === \"azure-mai\") {\n      if (\n        !settings.voiceInputMaiEndpoint ||\n        !isUsableVoiceInputSecret(settings.voiceInputMaiApiKey)\n      )\n        continue;\n      const priced = voiceInputProviderPricing(\n        settings,\n        issues,\n        \"azure-mai\",\n        \"OPENGENI_VOICE_INPUT_MAI_PRICING_JSON\",\n        settings.voiceInputMaiPricingJson,\n        settings.voiceInputMaiModel,\n      );\n      if (!priced.usable) continue;\n      providers.push({\n        id,\n        kind: \"azure-mai\",\n        pricing: priced.pricing,\n        endpoint: settings.voiceInputMaiEndpoint.replace(/\\/+$/, \"\"),\n        apiKey: settings.voiceInputMaiApiKey,\n        apiVersion: settings.voiceInputMaiApiVersion,\n        model: settings.voiceInputMaiModel,\n      });\n      continue;\n    }\n    if (id === \"openai\") {\n      if (!settings.voiceInputOpenaiEnabled) continue;\n      const apiKey = settings.voiceInputOpenaiApiKey ?? settings.openaiApiKey;\n      if (!isUsableVoiceInputSecret(apiKey)) continue;\n      // When the turn provider is Azure-only and no voice-specific OpenAI key/URL\n      // was set, do not silently reuse a leftover OPENAI_API_KEY for voice.\n      if (\n        settings.openaiProvider === \"azure\" &&\n        !settings.voiceInputOpenaiApiKey &&\n        !settings.voiceInputOpenaiBaseUrl\n      ) {\n        continue;\n      }\n      const priced = voiceInputProviderPricing(\n        settings,\n        issues,\n        \"openai\",\n        \"OPENGENI_VOICE_INPUT_OPENAI_PRICING_JSON\",\n        settings.voiceInputOpenaiPricingJson,\n        settings.voiceInputOpenaiModel,\n      );\n      if (!priced.usable) continue;\n      providers.push({\n        id: \"openai\",\n        kind: \"openai\",\n        pricing: priced.pricing,\n        apiKey,\n        baseUrl: (\n          settings.voiceInputOpenaiBaseUrl ??\n          settings.openaiBaseUrl ??\n          \"https://api.openai.com/v1\"\n        ).replace(/\\/+$/, \"\"),\n        model: settings.voiceInputOpenaiModel,\n      });\n      continue;\n    }\n    if (id === \"azure-openai\") {\n      if (!settings.voiceInputAzureEnabled) continue;\n      const endpoint = (\n        settings.voiceInputAzureEndpoint ??\n        settings.azureOpenaiEndpoint ??\n        \"\"\n      ).replace(/\\/+$/, \"\");\n      const deployment = settings.voiceInputAzureDeployment ?? settings.azureOpenaiDeployment ?? \"\";\n      const apiVersion =\n        settings.voiceInputAzureApiVersion ??\n        settings.azureOpenaiApiVersion ??\n        \"2025-04-01-preview\";\n      const apiKey = settings.voiceInputAzureApiKey ?? settings.azureOpenaiApiKey ?? null;\n      const adToken = settings.voiceInputAzureAdToken ?? settings.azureOpenaiAdToken ?? null;\n      if (\n        !endpoint ||\n        !deployment ||\n        (!isUsableVoiceInputSecret(apiKey) && !isUsableVoiceInputSecret(adToken))\n      ) {\n        continue;\n      }\n      // When turn provider is OpenAI-only and no voice-specific Azure settings\n      // were provided, skip ambient Azure leftovers.\n      if (\n        settings.openaiProvider !== \"azure\" &&\n        !settings.voiceInputAzureEndpoint &&\n        !settings.voiceInputAzureDeployment &&\n        !settings.voiceInputAzureApiKey &&\n        !settings.voiceInputAzureAdToken\n      ) {\n        continue;\n      }\n      const model = settings.voiceInputAzureModel ?? deployment;\n      const priced = voiceInputProviderPricing(\n        settings,\n        issues,\n        \"azure-openai\",\n        \"OPENGENI_VOICE_INPUT_AZURE_PRICING_JSON\",\n        settings.voiceInputAzurePricingJson,\n        model,\n      );\n      if (!priced.usable) continue;\n      const pricing = priced.pricing;\n      providers.push({\n        id: \"azure-openai\",\n        kind: \"azure-openai\",\n        endpoint,\n        deployment,\n        apiVersion,\n        apiKey: isUsableVoiceInputSecret(apiKey) ? apiKey : null,\n        adToken: isUsableVoiceInputSecret(adToken) ? adToken : null,\n        model,\n        pricing,\n      });\n      continue;\n    }\n    if (id === \"codex-subscription\") {\n      // Prefer Codex STT whenever subscription model routing is enabled.\n      // Operators who want OpenAI/Azure first should set PROVIDER_ORDER; omit\n      // `codex-subscription` from the order to disable Codex voice while keeping\n      // subscription turns. VOICE_INPUT_CODEX_EXPERIMENTAL is retained for\n      // back-compat docs/env but no longer gates inclusion.\n      if (!settings.codexSubscriptionEnabled) continue;\n      providers.push({\n        id: \"codex-subscription\",\n        kind: \"codex-subscription\",\n        experimental: true,\n      });\n      continue;\n    }\n    if (id === \"supergrok-subscription\") {\n      if (!settings.supergrokSubscriptionEnabled) continue;\n      providers.push({\n        id: \"supergrok-subscription\",\n        kind: \"supergrok-subscription\",\n        experimental: true,\n      });\n    }\n  }\n  return { providers, issues };\n}\n\n/**\n * Opengeni credit price for one deployment-funded transcription provider.\n * Rates are upstream list prices in integer USD micros; `marginBps` (500 =\n * +5%) is added on top, exactly like model pricing. `microsPerMinute` prices\n * provider-reported audio duration (Whisper, `usage.type: \"duration\"`) and is\n * a server-measured WAV duration when provider usage is absent. Token\n * rates price `usage.type: \"tokens\"` (gpt-4o-transcribe family); `input`\n * covers text input tokens and, unless `audioInput` is set, audio tokens.\n */\nexport type VoiceInputPricing = {\n  microsPerMinute: number;\n  inputMicrosPerMillionTokens?: number | undefined;\n  audioInputMicrosPerMillionTokens?: number | undefined;\n  outputMicrosPerMillionTokens?: number | undefined;\n  marginBps?: number | undefined;\n};\n\nconst VoiceInputPricingSchema = z\n  .object({\n    microsPerMinute: z.number().int().positive().max(100_000_000),\n    inputMicrosPerMillionTokens: z.number().int().nonnegative().max(1_000_000_000).optional(),\n    audioInputMicrosPerMillionTokens: z.number().int().nonnegative().max(1_000_000_000).optional(),\n    outputMicrosPerMillionTokens: z.number().int().nonnegative().max(1_000_000_000).optional(),\n    marginBps: z.number().int().min(0).max(100_000).optional(),\n  })\n  .strict()\n  .superRefine((pricing, ctx) => {\n    const input = pricing.inputMicrosPerMillionTokens !== undefined;\n    const output = pricing.outputMicrosPerMillionTokens !== undefined;\n    if (input !== output) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: \"inputMicrosPerMillionTokens and outputMicrosPerMillionTokens are set together\",\n      });\n    }\n    if (pricing.audioInputMicrosPerMillionTokens !== undefined && !input) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: \"audioInputMicrosPerMillionTokens requires the token input/output rates\",\n      });\n    }\n  });\n\n/**\n * Built-in list prices (OpenAI API pricing, \"Transcription models\" table)\n * plus the default 5% Opengeni margin used for model pricing. Azure Global\n * Standard deployments use the same list prices; set the provider\n * PRICING_JSON when a deployment's contracted or regional price differs.\n */\nexport const defaultVoiceInputPricing: Readonly<Record<string, VoiceInputPricing>> = {\n  // Audio tokens are listed separately from text tokens on the model pages;\n  // set explicitly so the audio rate never silently follows a text-rate edit.\n  \"gpt-4o-transcribe\": {\n    microsPerMinute: 6_000,\n    inputMicrosPerMillionTokens: 2_500_000,\n    audioInputMicrosPerMillionTokens: 2_500_000,\n    outputMicrosPerMillionTokens: 10_000_000,\n    marginBps: 500,\n  },\n  \"gpt-4o-transcribe-diarize\": {\n    microsPerMinute: 6_000,\n    inputMicrosPerMillionTokens: 2_500_000,\n    audioInputMicrosPerMillionTokens: 2_500_000,\n    outputMicrosPerMillionTokens: 10_000_000,\n    marginBps: 500,\n  },\n  \"gpt-4o-mini-transcribe\": {\n    microsPerMinute: 3_000,\n    inputMicrosPerMillionTokens: 1_250_000,\n    audioInputMicrosPerMillionTokens: 1_250_000,\n    outputMicrosPerMillionTokens: 5_000_000,\n    marginBps: 500,\n  },\n  \"gpt-transcribe\": { microsPerMinute: 4_500, marginBps: 500 },\n  whisper: { microsPerMinute: 6_000, marginBps: 500 },\n  \"whisper-1\": { microsPerMinute: 6_000, marginBps: 500 },\n};\n\n/** Lowercased model with a dated snapshot suffix (`-2025-03-20`) removed. */\nexport function canonicalVoiceInputModel(model: string): string {\n  return model\n    .trim()\n    .toLowerCase()\n    .replace(/-\\d{4}-\\d{2}-\\d{2}$/, \"\");\n}\n\n/** Whisper reports its billed audio duration only in `verbose_json`. */\nexport function voiceInputModelReportsDurationOnly(model: string): boolean {\n  return canonicalVoiceInputModel(model).startsWith(\"whisper\");\n}\n\n/** Parse one provider pricing JSON. Throws a configuration error when malformed. */\nexport function parseVoiceInputPricingJson(\n  raw: string | undefined,\n  env = \"voice-input pricing JSON\",\n): VoiceInputPricing | null {\n  if (raw === undefined || raw.trim() === \"\") return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    throw new Error(`${env} must be valid JSON`);\n  }\n  const result = VoiceInputPricingSchema.safeParse(parsed);\n  if (!result.success) {\n    throw new Error(\n      `${env} is invalid: ${result.error.issues.map((issue) => issue.message).join(\"; \")}`,\n    );\n  }\n  return result.data;\n}\n\n/** Explicit provider pricing JSON wins; otherwise the built-in list price for the model. */\nexport function resolveVoiceInputPricing(\n  raw: string | undefined,\n  model: string,\n): VoiceInputPricing | null {\n  return (\n    parseVoiceInputPricingJson(raw) ??\n    defaultVoiceInputPricing[canonicalVoiceInputModel(model)] ??\n    null\n  );\n}\n\n/** Non-throwing {@link resolveVoiceInputPricing} for registry resolution. */\nexport function safeResolveVoiceInputPricing(\n  raw: string | undefined,\n  model: string,\n  env?: string,\n): { ok: true; pricing: VoiceInputPricing | null } | { ok: false; error: string } {\n  let explicit: VoiceInputPricing | null;\n  try {\n    explicit = parseVoiceInputPricingJson(raw, env);\n  } catch (error) {\n    return { ok: false, error: error instanceof Error ? error.message : String(error) };\n  }\n  return {\n    ok: true,\n    pricing: explicit ?? defaultVoiceInputPricing[canonicalVoiceInputModel(model)] ?? null,\n  };\n}\n\n/** Same predicate as model/credit limits: credit balance and debits are enforced. */\nexport function voiceInputCreditBillingActive(\n  settings: Pick<Settings, \"billingMode\" | \"usageLimitsMode\">,\n): boolean {\n  return settings.billingMode === \"stripe\" || settings.usageLimitsMode === \"managed\";\n}\n\n/** Provider-reported transcription usage, normalized. Never client-reported. */\nexport type VoiceInputUsage =\n  | {\n      kind: \"tokens\";\n      inputTokens: number;\n      audioInputTokens: number;\n      textInputTokens: number;\n      outputTokens: number;\n    }\n  | { kind: \"duration\"; seconds: number };\n\nexport type VoiceInputCost = {\n  /** Upstream list cost before margin, rounded up to whole micros. */\n  providerCostMicros: number;\n  /** Opengeni credit price after margin, rounded up to whole micros. */\n  creditCostMicros: number;\n};\n\n/** True when token usage can be priced exactly. */\nexport function voiceInputPricingHasTokenRates(pricing: VoiceInputPricing): boolean {\n  return (\n    pricing.inputMicrosPerMillionTokens !== undefined &&\n    pricing.outputMicrosPerMillionTokens !== undefined\n  );\n}\n\n/** Resolve the deployment override without changing unset per-price behavior. */\nfunction effectiveCreditMarginBps(\n  settings: Pick<Settings, \"creditMarginBpsOverride\">,\n  configuredMarginBps: number | undefined,\n): number {\n  return settings.creditMarginBpsOverride ?? configuredMarginBps ?? 0;\n}\n\n/**\n * Exact integer credit math. Token usage needs token rates; duration usage\n * uses `microsPerMinute` at millisecond resolution. Both round up once, after\n * summing, so a positive use never becomes a free debit.\n */\nexport function calculateVoiceInputCost(\n  pricing: VoiceInputPricing,\n  usage: VoiceInputUsage,\n  marginBpsOverride?: number,\n): VoiceInputCost {\n  let numerator: bigint;\n  let denominator: bigint;\n  if (usage.kind === \"tokens\") {\n    if (\n      pricing.inputMicrosPerMillionTokens === undefined ||\n      pricing.outputMicrosPerMillionTokens === undefined\n    ) {\n      throw new Error(\"voice-input token usage requires token pricing\");\n    }\n    for (const value of [\n      usage.inputTokens,\n      usage.audioInputTokens,\n      usage.textInputTokens,\n      usage.outputTokens,\n    ]) {\n      if (!Number.isSafeInteger(value) || value < 0) {\n        throw new Error(\"voice-input token usage must be non-negative integers\");\n      }\n    }\n    const audioRate =\n      pricing.audioInputMicrosPerMillionTokens ?? pricing.inputMicrosPerMillionTokens;\n    // Input tokens the provider did not attribute are priced as audio (never cheaper).\n    const unattributed = Math.max(\n      0,\n      usage.inputTokens - usage.audioInputTokens - usage.textInputTokens,\n    );\n    numerator =\n      BigInt(usage.audioInputTokens + unattributed) * BigInt(audioRate) +\n      BigInt(usage.textInputTokens) * BigInt(pricing.inputMicrosPerMillionTokens) +\n      BigInt(usage.outputTokens) * BigInt(pricing.outputMicrosPerMillionTokens);\n    denominator = 1_000_000n;\n  } else {\n    if (!Number.isFinite(usage.seconds) || usage.seconds < 0) {\n      throw new Error(\"voice-input duration must be a non-negative number of seconds\");\n    }\n    numerator = BigInt(Math.ceil(usage.seconds * 1_000)) * BigInt(pricing.microsPerMinute);\n    denominator = 60_000n;\n  }\n  const margin = BigInt(10_000 + (marginBpsOverride ?? pricing.marginBps ?? 0));\n  const provider = (numerator + denominator - 1n) / denominator;\n  const scaled = denominator * 10_000n;\n  const credit = (numerator * margin + scaled - 1n) / scaled;\n  if (credit > BigInt(Number.MAX_SAFE_INTEGER)) {\n    throw new Error(\"voice-input cost exceeds the supported billing range\");\n  }\n  return { providerCostMicros: Number(provider), creditCostMicros: Number(credit) };\n}\n\n/**\n * Deployment-funded providers that have credentials but are withheld because\n * credit billing is active and no price is known. The API logs these (and\n * malformed pricing, see {@link voiceInputPricingIssues}) once at startup so\n * an operator sees why voice input stayed unavailable.\n */\nexport function unpricedVoiceInputProviders(settings: Settings): VoiceInputProviderId[] {\n  return voiceInputPricingIssues(settings).flatMap((issue) =>\n    issue.reason === \"unpriced\" ? [issue.providerId] : [],\n  );\n}\n\n/** True when the deployment has at least one supported (non-experimental) provider. */\nexport function voiceInputDeploymentConfigured(settings: Settings): boolean {\n  return resolveVoiceInputProviderRegistry(settings).some(\n    (provider) =>\n      provider.kind !== \"codex-subscription\" && provider.kind !== \"supergrok-subscription\",\n  );\n}\n\nexport type TemporalTlsConnectionConfig = {\n  serverNameOverride?: string;\n  serverRootCACertificate?: Uint8Array;\n  clientCertPair?: {\n    crt: Uint8Array;\n    key: Uint8Array;\n  };\n};\nexport type TemporalConnectionOptions = {\n  address: string;\n  tls?: true | TemporalTlsConnectionConfig;\n  apiKey?: string;\n};\nexport type ModelPricing = {\n  inputMicrosPerMillionTokens: number;\n  cachedInputMicrosPerMillionTokens?: number | undefined;\n  cacheWriteMicrosPerMillionTokens?: number | undefined;\n  outputMicrosPerMillionTokens: number;\n  marginBps?: number | undefined;\n};\nexport type ModelPricingScheduleV1 = {\n  default: ModelPricing;\n  inputTokenTiers?:\n    | Array<{\n        minimumInputTokens: number;\n        pricing: ModelPricing;\n      }>\n    | undefined;\n};\nexport type ModelUsageInput = {\n  inputTokens?: number | undefined;\n  outputTokens?: number | undefined;\n  totalTokens?: number | undefined;\n  inputTokensDetails?: Record<string, number> | Array<Record<string, number>> | undefined;\n  requestUsageEntries?: ModelUsageInput[] | undefined;\n};\n\nexport type ModelUsageCostBreakdown = {\n  /** Provider-rate cost basis for the exact usage, before Opengeni margin. */\n  providerCostMicros: number;\n  /** Opengeni credit price after configured margin and latency-mode multiplier. */\n  creditCostMicros: number;\n};\n\nexport type ModelListCostClassesMicros = {\n  uncachedInput: number;\n  cacheRead: number;\n  cacheWrite: number;\n  output: number;\n};\n\nexport type ModelListUsageCostSnapshot = ModelUsageCostBreakdown & {\n  /** Captured upstream list costs, summing to providerCostMicros, never debits. */\n  listByClassMicros: ModelListCostClassesMicros | null;\n  /** True only when a returned class split includes latency rounding allocation. */\n  listByClassApprox: boolean;\n};\n\nexport type ModelRecordedListCostAllocation = {\n  /** Approximate attribution of a stored upstream total, never a new price. */\n  listByClassMicros: ModelListCostClassesMicros | null;\n  /** True for every eligible historical allocation, including known zero. */\n  listByClassApprox: boolean;\n};\n\nexport type StaticUsageLimitsConfig = StaticUsageLimits;\nexport type EntitlementsConfig = Entitlements;\n\nconst ModelPricingSchema = z.object({\n  inputMicrosPerMillionTokens: z.number().int().nonnegative(),\n  cachedInputMicrosPerMillionTokens: z.number().int().nonnegative().optional(),\n  cacheWriteMicrosPerMillionTokens: z.number().int().nonnegative().optional(),\n  outputMicrosPerMillionTokens: z.number().int().nonnegative(),\n  marginBps: z.number().int().min(0).max(100_000).optional(),\n});\n\nconst ModelPricingScheduleSchema = z\n  .object({\n    default: ModelPricingSchema,\n    inputTokenTiers: z\n      .array(\n        z.object({\n          minimumInputTokens: z.number().int().nonnegative(),\n          pricing: ModelPricingSchema,\n        }),\n      )\n      .optional(),\n  })\n  .superRefine((schedule, ctx) => {\n    let previous = -1;\n    for (const [index, tier] of (schedule.inputTokenTiers ?? []).entries()) {\n      if (tier.minimumInputTokens <= previous) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"inputTokenTiers\", index, \"minimumInputTokens\"],\n          message: \"input-token tier thresholds must be strictly increasing\",\n        });\n      }\n      previous = tier.minimumInputTokens;\n    }\n  });\n\nexport const CapabilitySupportV1 = z.enum([\"supported\", \"unsupported\", \"unknown\"]);\nexport type CapabilitySupportV1 = z.infer<typeof CapabilitySupportV1>;\n\nexport const CapabilityStateV1Schema = z\n  .object({\n    upstream: CapabilitySupportV1,\n    runnable: z.boolean(),\n  })\n  .superRefine((state, ctx) => {\n    if (state.upstream === \"unsupported\" && state.runnable) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"runnable\"],\n        message: \"an upstream-unsupported capability cannot be runnable\",\n      });\n    }\n  });\nexport type CapabilityStateV1 = z.infer<typeof CapabilityStateV1Schema>;\n\nconst ModelModalityV1 = z.enum([\"text\", \"image\", \"audio\"]);\nconst ModelLatencyModeV1 = z.enum([\"standard\", \"priority\", \"fast\", \"ultrafast\"]);\n\nexport const ModelCapabilitiesV1Schema = z\n  .object({\n    reasoning: CapabilityStateV1Schema.extend({\n      efforts: z.array(ReasoningEffort),\n      defaultEffort: ReasoningEffort.nullable(),\n      required: z.boolean(),\n    }),\n    functionCalling: CapabilityStateV1Schema,\n    structuredOutput: CapabilityStateV1Schema,\n    hostedTools: z.object({\n      webSearch: CapabilityStateV1Schema,\n      xSearch: CapabilityStateV1Schema,\n      codeExecution: CapabilityStateV1Schema,\n      imageGeneration: CapabilityStateV1Schema.default({\n        upstream: \"unknown\",\n        runnable: false,\n      }),\n    }),\n    inputModalities: z.array(ModelModalityV1).min(1),\n    /** Exact MIME types accepted as typed `input_file`; `text/*` is allowed. */\n    inputFileMediaTypes: z.array(z.string()).default([]),\n    outputModalities: z.array(ModelModalityV1).min(1),\n    transports: z.object({\n      sse: CapabilityStateV1Schema,\n      responsesWebSocket: CapabilityStateV1Schema,\n      realtimeAudio: CapabilityStateV1Schema,\n    }),\n    promptCaching: CapabilityStateV1Schema.extend({\n      mode: z.enum([\"implicit\", \"automatic\", \"none\"]),\n    }).optional(),\n    latencyModes: z\n      .array(\n        z.object({\n          id: ModelLatencyModeV1,\n          upstream: CapabilitySupportV1,\n          runnable: z.boolean(),\n          billingMultiplierBps: z.number().int().positive().optional(),\n        }),\n      )\n      .min(1),\n  })\n  .superRefine((capabilities, ctx) => {\n    const efforts = new Set(capabilities.reasoning.efforts);\n    if (efforts.size !== capabilities.reasoning.efforts.length) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reasoning\", \"efforts\"],\n        message: \"reasoning efforts must be unique\",\n      });\n    }\n    if (\n      capabilities.reasoning.defaultEffort !== null &&\n      !efforts.has(capabilities.reasoning.defaultEffort)\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reasoning\", \"defaultEffort\"],\n        message: \"the default reasoning effort must be one of the supported efforts\",\n      });\n    }\n    if (capabilities.reasoning.runnable && capabilities.reasoning.efforts.length === 0) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reasoning\", \"efforts\"],\n        message: \"a runnable reasoning capability must declare at least one effort\",\n      });\n    }\n    for (const field of [\"inputModalities\", \"outputModalities\"] as const) {\n      if (new Set(capabilities[field]).size !== capabilities[field].length) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [field],\n          message: `${field} must be unique`,\n        });\n      }\n    }\n    const latencyIds = new Set<string>();\n    for (const [index, mode] of capabilities.latencyModes.entries()) {\n      if (latencyIds.has(mode.id)) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"latencyModes\", index, \"id\"],\n          message: \"latency mode ids must be unique\",\n        });\n      }\n      latencyIds.add(mode.id);\n      if (mode.upstream === \"unsupported\" && mode.runnable) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"latencyModes\", index, \"runnable\"],\n          message: \"an upstream-unsupported latency mode cannot be runnable\",\n        });\n      }\n    }\n  });\nexport type ModelCapabilitiesV1 = z.infer<typeof ModelCapabilitiesV1Schema>;\n\nexport type ModelDeploymentV1 = {\n  upstreamModelId: string;\n  wireApi: ModelProviderApi;\n};\n\nexport type ModelExecutionLimitsV1 = {\n  contextWindowTokens: number | null;\n  effectiveContextWindowTokens: number | null;\n  autoCompactTokenLimit: number | null;\n  toolOutputTruncationTokens: number | null;\n};\n\nexport type CredentialSourceV1 =\n  | { kind: \"deployment\"; mechanism: \"api_key\" | \"azure_ad_bearer\" | \"none\" }\n  | { kind: \"connected_subscription\"; provider: \"codex\" | \"xai\" | \"claude\" }\n  | { kind: \"workspace_connection\"; mechanism: \"api_key\" }\n  | { kind: \"organization_connection\"; mechanism: \"api_key\" };\n\nexport type BillingAttributionV1 = {\n  upstreamPayer: \"deployment\" | \"workspace\" | \"organization\" | \"connected_subscription\";\n  metering: \"opengeni_credits\" | \"external\";\n};\n\n/**\n * Wire API a provider speaks. The built-in OpenAI/Azure provider always uses\n * \"responses\" (the OpenAI Responses API). Extra registry providers default to\n * \"chat\" (the broadly compatible /v1/chat/completions surface); Fireworks is\n * wired as \"chat\" because its beta Responses endpoint echoes input back and\n * silently no-ops hosted tools (see docs/model-providers.md).\n */\nexport const ModelProviderApi = z.enum([\"responses\", \"chat\", \"anthropic-messages\"]);\nexport type ModelProviderApi = z.infer<typeof ModelProviderApi>;\n\n/**\n * Provider-specific request semantics that are independent of the endpoint's\n * OpenAI-compatible wire API. Secondary Azure resources still speak the\n * Responses API, but need Azure's stricter computer-call normalization.\n */\nexport const ModelProviderWireProfile = z.enum([\"openai\", \"azure-openai\"]);\nexport type ModelProviderWireProfile = z.infer<typeof ModelProviderWireProfile>;\n\n/**\n * Registry provider kind. \"api-key\" providers carry their own static key/headers;\n * \"anonymous\" providers intentionally send no credential and are externally\n * metered; connected-subscription providers resolve a workspace account token\n * at call time and never carry a static key in the registry definition.\n */\nexport const RegistryProviderKind = z.enum([\n  \"api-key\",\n  \"anonymous\",\n  \"codex-subscription\",\n  \"xai-subscription\",\n  \"vercel-gateway-managed\",\n  \"vercel-gateway-workspace\",\n  \"vercel-gateway-organization\",\n  \"direct-openai-workspace\",\n  \"direct-azure-workspace\",\n  \"direct-openai-organization\",\n  \"direct-azure-organization\",\n  \"openrouter-workspace\",\n  \"openrouter-organization\",\n  \"opper-workspace\",\n  \"opper-organization\",\n  \"anthropic-organization\",\n  \"claude-subscription-organization\",\n  \"anthropic-workspace\",\n  \"claude-subscription-workspace\",\n]);\nexport type RegistryProviderKind = z.infer<typeof RegistryProviderKind>;\n\n/** A single model exposed by a registry provider. */\nconst ModelLogoUrlSchema = z\n  .string()\n  .refine(\n    (value) => modelLogoUrl({ id: \"\", logoUrl: value }) !== null,\n    \"model logoUrl must be an HTTPS URL without embedded credentials, at most 2048 characters\",\n  );\n\nconst RegistryModelSchema = z\n  .object({\n    id: z.string().min(1), // canonical Opengeni product id\n    upstreamModelId: z.string().min(1).optional(), // exact provider slug; defaults to id\n    aliases: z.array(z.string().min(1)).optional(), // accepted input only; never sent upstream\n    label: z.string().min(1).optional(), // display name; defaults to id\n    shortLabel: z.string().min(1).max(64).optional(), // compact UI label; optional\n    logoUrl: ModelLogoUrlSchema.optional(),\n    contextWindowTokens: z.number().int().positive().optional(),\n    effectiveContextWindowTokens: z.number().int().positive().optional(),\n    autoCompactTokenLimit: z.number().int().positive().optional(),\n    // Canonical model-facing function/tool-result policy. The runtime applies\n    // the same 1.2x serialization allowance as Codex when materializing output.\n    toolOutputTruncationTokens: z.number().int().positive().optional(),\n    reasoningEffort: z.boolean().optional(), // legacy compatibility input/projection\n    hostedWebSearch: z.boolean().optional(), // legacy compatibility input/projection\n    capabilities: ModelCapabilitiesV1Schema.optional(),\n    pricing: z.union([ModelPricingSchema, ModelPricingScheduleSchema]).optional(),\n    // Reserved normalized contracts are derived by Opengeni in V1. Generic\n    // registry JSON must not opt itself into workspace BYOK or reattribute cost.\n    credentialSource: z.never().optional(),\n    billing: z.never().optional(),\n  })\n  .superRefine((model, ctx) => {\n    if (\n      model.capabilities &&\n      model.reasoningEffort !== undefined &&\n      model.reasoningEffort !== model.capabilities.reasoning.runnable\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reasoningEffort\"],\n        message: \"legacy reasoningEffort must agree with capabilities.reasoning.runnable\",\n      });\n    }\n    if (\n      model.capabilities &&\n      model.hostedWebSearch !== undefined &&\n      model.hostedWebSearch !== model.capabilities.hostedTools.webSearch.runnable\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"hostedWebSearch\"],\n        message:\n          \"legacy hostedWebSearch must agree with capabilities.hostedTools.webSearch.runnable\",\n      });\n    }\n  });\n\n/** A non-built-in provider declared by the host via OPENGENI_MODEL_PROVIDERS_JSON. */\nexport const ClaudeSubscriptionIdentity = z\n  .object({\n    accountUuid: z.union([z.string().uuid(), z.literal(\"\")]),\n    deviceId: z.string().regex(/^[a-f0-9]{64}$/),\n  })\n  .strict();\nexport type ClaudeSubscriptionIdentity = z.infer<typeof ClaudeSubscriptionIdentity>;\nexport const ClaudeSubscriptionCredential = z\n  .object({\n    version: z.literal(1),\n    token: z.string().regex(/^sk-ant-oat[0-9]+-\\S+$/),\n    identity: ClaudeSubscriptionIdentity,\n    oauth: z\n      .object({\n        refreshToken: z.string().min(1).max(16384),\n        expiresAt: z.string().datetime(),\n        scopes: z.array(z.string().min(1).max(256)).min(1).max(32),\n      })\n      .strict()\n      .optional(),\n  })\n  .strict();\nconst AnthropicProviderOptions = z.object({\n  identity: ClaudeSubscriptionIdentity.optional(),\n  // Native connection provenance only; never included in Anthropic request bodies.\n  credentialBinding: z\n    .object({\n      connectionId: z.string().uuid(),\n      credentialVersion: z.number().int().positive(),\n    })\n    .strict()\n    .optional(),\n  auth: z.enum([\"api-key\", \"oauth\"]).default(\"api-key\"),\n  cacheTtl: z.enum([\"5m\", \"1h\", \"off\"]).default(\"5m\"),\n  maxOutputTokens: z.number().int().positive().default(32000),\n  streamIdleTimeoutMs: z.number().int().positive().default(600000),\n});\n\nconst RegistryProviderSchema = z\n  .object({\n    kind: RegistryProviderKind.default(\"api-key\"),\n    id: z.string().min(1).regex(registryId), // stable provider id, e.g. \"fireworks\"\n    label: z.string().min(1).optional(),\n    api: ModelProviderApi.default(\"chat\"),\n    anthropic: AnthropicProviderOptions.optional(),\n    // Generic OpenAI-compatible stream silence bound; overrides the deployment\n    // `modelStreamIdleTimeoutMs` for this provider only.\n    streamIdleTimeoutMs: z\n      .number()\n      .int()\n      .positive()\n      .max(24 * 60 * 60_000)\n      .optional(),\n    streamProgressTimeoutMs: z\n      .number()\n      .int()\n      .positive()\n      .max(24 * 60 * 60_000)\n      .optional(),\n    wireProfile: ModelProviderWireProfile.default(\"openai\"),\n    baseUrl: z.string().url(),\n    apiKey: z.string().optional(), // inline key (pragmatic) ...\n    apiKeyEnv: z.string().optional(), // ... OR name of the env var holding the key (preferred)\n    defaultQuery: z.record(z.string(), z.string()).optional(),\n    defaultHeaders: z.record(z.string(), z.string()).optional(),\n    publicDefaultQueryNames: z.array(z.string().min(1)).optional(),\n    publicDefaultHeaderNames: z.array(z.string().min(1)).optional(),\n    // V1 derives these from provider kind. Workspace BYOK is deliberately not a\n    // registry switch and requires a separately reviewed encrypted broker.\n    credentialSource: z.never().optional(),\n    billing: z.never().optional(),\n    models: z.array(RegistryModelSchema).min(1),\n  })\n  .superRefine((provider, ctx) => {\n    if (provider.kind !== \"anonymous\") {\n      return;\n    }\n    if (provider.apiKey !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"apiKey\"],\n        message: \"anonymous providers must not declare apiKey\",\n      });\n    }\n    if (provider.apiKeyEnv !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"apiKeyEnv\"],\n        message: \"anonymous providers must not declare apiKeyEnv\",\n      });\n    }\n    if (provider.defaultHeaders !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"defaultHeaders\"],\n        message: \"anonymous providers must not declare defaultHeaders\",\n      });\n    }\n    if (provider.defaultQuery !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"defaultQuery\"],\n        message: \"anonymous providers must not declare defaultQuery\",\n      });\n    }\n    if (provider.publicDefaultHeaderNames !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"publicDefaultHeaderNames\"],\n        message: \"anonymous providers must not declare publicDefaultHeaderNames\",\n      });\n    }\n    if (provider.publicDefaultQueryNames !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"publicDefaultQueryNames\"],\n        message: \"anonymous providers must not declare publicDefaultQueryNames\",\n      });\n    }\n  });\nexport type RegistryProvider = z.infer<typeof RegistryProviderSchema>;\n\nexport const OPENGENI_GATEWAY_PROVIDER_ID = \"opengeni-gateway\" as const;\nexport const WORKSPACE_GATEWAY_PROVIDER_ID = \"workspace-gateway\" as const;\nexport const WORKSPACE_GATEWAY_MODEL_ID_PREFIX = \"workspace-gateway/\" as const;\nexport const ORGANIZATION_GATEWAY_PROVIDER_ID = \"organization-gateway\" as const;\nexport const ORGANIZATION_GATEWAY_MODEL_ID_PREFIX = \"organization-gateway/\" as const;\nexport const OPENROUTER_PROVIDER_ID = \"openrouter\" as const;\nexport const OPENROUTER_MODEL_ID_PREFIX = \"openrouter/\" as const;\nexport const WORKSPACE_OPENROUTER_PROVIDER_ID = \"workspace-openrouter\" as const;\nexport const WORKSPACE_OPENROUTER_MODEL_ID_PREFIX = \"workspace-openrouter/\" as const;\nexport const ORGANIZATION_OPENROUTER_PROVIDER_ID = \"organization-openrouter\" as const;\nexport const ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX = \"organization-openrouter/\" as const;\nexport const OPENROUTER_BASE_URL = \"https://openrouter.ai/api/v1\" as const;\nexport const OPPER_PROVIDER_ID = \"opper\" as const;\nexport const OPPER_MODEL_ID_PREFIX = \"opper/\" as const;\nexport const WORKSPACE_OPPER_PROVIDER_ID = \"workspace-opper\" as const;\nexport const WORKSPACE_OPPER_MODEL_ID_PREFIX = \"workspace-opper/\" as const;\nexport const ORGANIZATION_OPPER_PROVIDER_ID = \"organization-opper\" as const;\nexport const ORGANIZATION_OPPER_MODEL_ID_PREFIX = \"organization-opper/\" as const;\n/**\n * Organization-owned OpenAI and Azure OpenAI: one connection each (an API key,\n * plus a resource endpoint for Azure) whose curated models (Azure deployments)\n * inherit into shared workspaces.\n */\nexport const ORGANIZATION_OPENAI_PROVIDER_ID = \"organization-openai\" as const;\nexport const ORGANIZATION_OPENAI_MODEL_ID_PREFIX = \"organization-openai/\" as const;\nexport const ORGANIZATION_AZURE_OPENAI_PROVIDER_ID = \"organization-azure-openai\" as const;\nexport const ORGANIZATION_AZURE_OPENAI_MODEL_ID_PREFIX = \"organization-azure-openai/\" as const;\n/** Opper's OpenAI-compatible Chat Completions surface (Bearer key). */\nexport const OPPER_BASE_URL = \"https://api.opper.ai/v3/compat\" as const;\n\nconst RESERVED_MODEL_PROVIDER_IDS = new Set<string>([\n  \"openai\",\n  \"azure\",\n  CODEX_PROVIDER_ID,\n  XAI_SUBSCRIPTION_PROVIDER_ID,\n  OPENGENI_GATEWAY_PROVIDER_ID,\n  WORKSPACE_GATEWAY_PROVIDER_ID,\n  ORGANIZATION_GATEWAY_PROVIDER_ID,\n  OPENROUTER_PROVIDER_ID,\n  WORKSPACE_OPENROUTER_PROVIDER_ID,\n  ORGANIZATION_OPENROUTER_PROVIDER_ID,\n  OPPER_PROVIDER_ID,\n  WORKSPACE_OPPER_PROVIDER_ID,\n  ORGANIZATION_OPPER_PROVIDER_ID,\n  ORGANIZATION_OPENAI_PROVIDER_ID,\n  ORGANIZATION_AZURE_OPENAI_PROVIDER_ID,\n  \"organization-anthropic\",\n  \"organization-claude-subscription\",\n  \"workspace-anthropic\",\n  \"workspace-claude-subscription\",\n]);\n\nexport const ModelCostClass = z.enum([\"free\", \"credits\"]);\nexport type ModelCostClass = z.infer<typeof ModelCostClass>;\n\nexport const ConfiguredModelCostClass = z.enum([\n  \"free\",\n  \"credits\",\n  \"subscription\",\n  \"workspace\",\n  \"organization\",\n]);\nexport type ConfiguredModelCostClass = z.infer<typeof ConfiguredModelCostClass>;\n\nconst ModelNote = z\n  .string()\n  .max(500)\n  .refine((value) => !/[\\r\\n|]/u.test(value), {\n    message: \"model notes must not contain newlines or the | field separator\",\n  });\n\nexport function parseModelCostPolicyJson(raw: string): Record<string, ModelCostClass> {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    throw new Error(\n      `OPENGENI_MODEL_COST_POLICY_JSON must be valid JSON: ${error instanceof Error ? error.message : String(error)}`,\n      { cause: error },\n    );\n  }\n  return z.record(z.string().min(1), ModelCostClass).parse(parsed);\n}\n\nexport function parseModelNotesJson(raw: string): Record<string, string> {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    throw new Error(\n      `OPENGENI_MODEL_NOTES_JSON must be valid JSON: ${error instanceof Error ? error.message : String(error)}`,\n      { cause: error },\n    );\n  }\n  return z.record(z.string().min(1), ModelNote).parse(parsed);\n}\n\nexport function configuredModelNotes(\n  settings: Pick<Settings, \"modelNotesJson\">,\n): Record<string, string> {\n  return parseModelNotesJson(settings.modelNotesJson);\n}\n\nexport const GatewayCatalogModel = z\n  .object({\n    productId: z.string().min(1),\n    workspaceProductId: z.string().min(1).startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX),\n    upstreamModelId: z.string().min(1),\n    label: z.string().min(1),\n    shortLabel: z.string().min(1).max(64).optional(),\n    logoUrl: ModelLogoUrlSchema.optional(),\n    providers: z.array(z.string().min(1)).min(1),\n    implicitCaching: z.boolean().default(false),\n    vision: z.boolean().default(false),\n    inputFileMediaTypes: z.array(z.string().min(1)).default([]),\n    contextWindowTokens: z.number().int().positive().default(1_000_000),\n    effectiveContextWindowTokens: z.number().int().positive().default(900_000),\n    autoCompactTokenLimit: z.number().int().positive().default(850_000),\n    pricing: z.union([ModelPricingSchema, ModelPricingScheduleSchema]).optional(),\n    credentialSource: z.never().optional(),\n    billing: z.never().optional(),\n    apiKey: z.never().optional(),\n  })\n  .strict();\nexport type GatewayCatalogModel = z.infer<typeof GatewayCatalogModel>;\n\nexport const OpenRouterCatalogModel = z\n  .object({\n    upstreamModelId: z.string().min(1).endsWith(\":free\"),\n    label: z.string().min(1),\n    shortLabel: z.string().min(1).max(64).optional(),\n    logoUrl: ModelLogoUrlSchema.optional(),\n    aliases: z.array(z.string().min(1)).default([]),\n    capabilities: ModelCapabilitiesV1Schema,\n    contextWindowTokens: z.number().int().positive().optional(),\n    effectiveContextWindowTokens: z.number().int().positive().optional(),\n    autoCompactTokenLimit: z.number().int().positive().optional(),\n    toolOutputTruncationTokens: z.number().int().positive().optional(),\n    credentialSource: z.never().optional(),\n    billing: z.never().optional(),\n    pricing: z.never().optional(),\n    apiKey: z.never().optional(),\n  })\n  .strict();\nexport type OpenRouterCatalogModel = z.infer<typeof OpenRouterCatalogModel>;\n\n/**\n * One reviewed Opper route. `upstreamModelId` is Opper's exact catalogue id:\n * a bare upstream name is a pool (Opper picks the serving provider), while a\n * `provider/model` id pins one route and region. Curated entries pin a route.\n * Code-defined entries may carry a reviewed price; database documents may not.\n */\nexport const OpperCatalogModel = z\n  .object({\n    upstreamModelId: z\n      .string()\n      .min(1)\n      .max(200)\n      .regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*(?:\\/[A-Za-z0-9][A-Za-z0-9._:-]*)*$/u),\n    label: z.string().min(1),\n    shortLabel: z.string().min(1).max(64).optional(),\n    logoUrl: ModelLogoUrlSchema.optional(),\n    aliases: z.array(z.string().min(1)).default([]),\n    capabilities: ModelCapabilitiesV1Schema,\n    contextWindowTokens: z.number().int().positive().optional(),\n    effectiveContextWindowTokens: z.number().int().positive().optional(),\n    autoCompactTokenLimit: z.number().int().positive().optional(),\n    toolOutputTruncationTokens: z.number().int().positive().optional(),\n    /** Opper's advertised `max_output_tokens` for this route. Sent as\n     * `max_tokens` on every Chat request that does not set its own, because\n     * Opper otherwise caps output at 4,096 tokens, which hidden reasoning can\n     * exhaust before any answer. Must not exceed the route's real limit:\n     * Opper rejects (400), it does not clamp. */\n    maxOutputTokens: z.number().int().positive().optional(),\n    pricing: z.union([ModelPricingSchema, ModelPricingScheduleSchema]).optional(),\n    credentialSource: z.never().optional(),\n    billing: z.never().optional(),\n    apiKey: z.never().optional(),\n  })\n  .strict();\nexport type OpperCatalogModel = z.infer<typeof OpperCatalogModel>;\n\nconst DeploymentRegistryBaseUrl = z\n  .string()\n  .url()\n  .superRefine((value, context) => {\n    const url = new URL(value);\n    if (url.username || url.password) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"database catalog provider baseUrl must not contain userinfo\",\n      });\n    }\n    if (url.search) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"database catalog provider baseUrl must not contain a query\",\n      });\n    }\n    if (url.hash) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"database catalog provider baseUrl must not contain a fragment\",\n      });\n    }\n  });\n\nconst DeploymentRegistryProviderKind = z.enum([\"api-key\", \"anonymous\"]);\n\nconst DeploymentRegistryModelSchema = RegistryModelSchema.safeExtend({\n  pricing: z.never().optional(),\n}).strict();\n\nconst DeploymentRegistryProviderSchema = RegistryProviderSchema.safeExtend({\n  kind: DeploymentRegistryProviderKind.default(\"api-key\"),\n  baseUrl: DeploymentRegistryBaseUrl,\n  models: z.array(DeploymentRegistryModelSchema).min(1),\n  apiKey: z.never().optional(),\n  apiKeyEnv: z.never().optional(),\n  defaultHeaders: z.never().optional(),\n  defaultQuery: z.never().optional(),\n  publicDefaultHeaderNames: z.never().optional(),\n  publicDefaultQueryNames: z.never().optional(),\n}).strict();\n\nconst DeploymentGatewayCatalogModelSchema = GatewayCatalogModel.safeExtend({\n  pricing: z.never().optional(),\n}).strict();\n\nconst DeploymentOpperCatalogModelSchema = OpperCatalogModel.safeExtend({\n  pricing: z.never().optional(),\n}).strict();\n\nconst CodexCatalogModelSchema = RegistryModelSchema.safeExtend({\n  retired: z.boolean().optional(),\n  id: z.string().regex(/^codex\\/[a-zA-Z0-9][a-zA-Z0-9._-]*$/),\n  upstreamModelId: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/),\n  capabilities: ModelCapabilitiesV1Schema,\n  pricing: z.never().optional(),\n})\n  .strict()\n  .superRefine((model, context) => {\n    if (model.id !== `${CODEX_MODEL_ID_PREFIX}${model.upstreamModelId}`) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"id\"],\n        message: \"Codex product id must match its upstream model slug\",\n      });\n    }\n  })\n  .transform((model) => ({\n    ...model,\n    capabilities: reviewedCodexCatalogCapabilities(model.upstreamModelId, model.capabilities),\n  }));\n\nexport const ModelCatalogDocument = z\n  .object({\n    schemaVersion: z.literal(1),\n    /** Canonical deployment default. Omission preserves the V1 first-built-in\n     * fallback for existing documents; operators should set this explicitly\n     * when cutting over a registry or connected-subscription default. */\n    defaultModel: z.string().min(1).optional(),\n    builtInModels: z.array(z.string().min(1)),\n    registryProviders: z.array(DeploymentRegistryProviderSchema).default([]),\n    codexModels: z.array(CodexCatalogModelSchema).optional(),\n    gatewayModels: z.array(DeploymentGatewayCatalogModelSchema).default([]),\n    openrouterModels: z.array(OpenRouterCatalogModel).default([]),\n    /** Reviewed paid Opper routes. Membership only: price comes from Opper's\n     * per-response reported cost, with the reviewed code snapshot (or\n     * OPENGENI_MODEL_PRICING_JSON) as fallback/validation, never here. */\n    opperModels: z.array(DeploymentOpperCatalogModelSchema).default([]),\n    modelNotes: z.record(z.string().min(1), ModelNote).default({}),\n    billing: z.never().optional(),\n    enabled: z.never().optional(),\n    apiKey: z.never().optional(),\n    bands: z.never().optional(),\n  })\n  .strict()\n  .superRefine((document, context) => {\n    if (document.builtInModels.length === 0 && !document.defaultModel) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"defaultModel\"],\n        message: \"catalogs without built-in models require an explicit default model\",\n      });\n    }\n    const productIds = new Set<string>();\n    const providerIds = new Set<string>();\n    const gatewayUpstreamIds = new Set<string>();\n    const add = (id: string, path: Array<string | number>): void => {\n      if (/[\\u000A\\u000D|]/u.test(id)) {\n        context.addIssue({\n          code: \"custom\",\n          path,\n          message: \"catalog product ids must not contain newlines or the | field separator\",\n        });\n      }\n      if (productIds.has(id)) {\n        context.addIssue({\n          code: \"custom\",\n          path,\n          message: `duplicate product id ${id}`,\n        });\n      }\n      productIds.add(id);\n    };\n    document.builtInModels.forEach((id, index) => add(id, [\"builtInModels\", index]));\n    document.codexModels?.forEach((model, index) => add(model.id, [\"codexModels\", index, \"id\"]));\n    if (\n      document.codexModels?.some((model) => model.retired && model.id === document.defaultModel)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"defaultModel\"],\n        message: \"a retired model cannot be the deployment default\",\n      });\n    }\n    document.registryProviders.forEach((provider, providerIndex) => {\n      if (\n        RESERVED_MODEL_PROVIDER_IDS.has(provider.id) ||\n        provider.id.startsWith(\"workspace-openai-\") ||\n        provider.id.startsWith(\"workspace-azure-openai-\")\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"registryProviders\", providerIndex, \"id\"],\n          message: `provider id ${provider.id} is reserved for a reviewed Opengeni provider`,\n        });\n      }\n      if (providerIds.has(provider.id)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"registryProviders\", providerIndex, \"id\"],\n          message: `duplicate provider id ${provider.id}`,\n        });\n      }\n      providerIds.add(provider.id);\n      provider.models.forEach((model, modelIndex) =>\n        add(model.id, [\"registryProviders\", providerIndex, \"models\", modelIndex, \"id\"]),\n      );\n    });\n    document.gatewayModels.forEach((model, index) => {\n      if (gatewayUpstreamIds.has(model.upstreamModelId)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"gatewayModels\", index, \"upstreamModelId\"],\n          message: `duplicate Gateway upstream model id ${model.upstreamModelId}`,\n        });\n      }\n      gatewayUpstreamIds.add(model.upstreamModelId);\n      add(model.productId, [\"gatewayModels\", index, \"productId\"]);\n      add(model.workspaceProductId, [\"gatewayModels\", index, \"workspaceProductId\"]);\n    });\n    document.openrouterModels.forEach((model, index) =>\n      add(`${OPENROUTER_MODEL_ID_PREFIX}${model.upstreamModelId}`, [\n        \"openrouterModels\",\n        index,\n        \"upstreamModelId\",\n      ]),\n    );\n    document.opperModels.forEach((model, index) =>\n      add(`${OPPER_MODEL_ID_PREFIX}${model.upstreamModelId}`, [\n        \"opperModels\",\n        index,\n        \"upstreamModelId\",\n      ]),\n    );\n    if (document.defaultModel && /[\\u000A\\u000D|]/u.test(document.defaultModel)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"defaultModel\"],\n        message: \"catalog default model must not contain newlines or the | field separator\",\n      });\n    }\n    if (\n      document.defaultModel &&\n      !productIds.has(document.defaultModel) &&\n      !(\n        document.codexModels === undefined &&\n        document.defaultModel.startsWith(CODEX_MODEL_ID_PREFIX)\n      ) &&\n      !document.defaultModel.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"defaultModel\"],\n        message:\n          \"catalog default model must reference deployment catalog membership or a connected-subscription product\",\n      });\n    }\n    for (const productId of Object.keys(document.modelNotes)) {\n      if (!productIds.has(productId)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"modelNotes\", productId],\n          message: \"model note references a product id outside the deployment catalog\",\n        });\n      }\n    }\n  });\nexport type ModelCatalogDocument = z.infer<typeof ModelCatalogDocument>;\n\nexport function parseModelCatalogDocument(value: unknown): ModelCatalogDocument {\n  return ModelCatalogDocument.parse(value);\n}\n\nfunction deploymentRegistryProvidersWithHostCredentials(\n  settings: Settings,\n  providers: readonly z.infer<typeof DeploymentRegistryProviderSchema>[],\n): RegistryProvider[] {\n  const hostProviders = new Map(\n    parseModelProvidersJson(settings.modelProvidersJson).map((provider) => [provider.id, provider]),\n  );\n  return providers.map((provider) => {\n    if (provider.kind !== \"api-key\") return provider;\n    const host = hostProviders.get(provider.id);\n    if (!host || host.kind !== \"api-key\") {\n      throw new Error(\n        `database model catalog provider ${provider.id} has no matching host-authorized api-key transport`,\n      );\n    }\n    const transportIdentity = (candidate: typeof provider | RegistryProvider) => ({\n      kind: candidate.kind,\n      baseUrl: candidate.baseUrl,\n      api: candidate.api,\n      wireProfile: candidate.wireProfile,\n    });\n    if (canonicalJson(transportIdentity(provider)) !== canonicalJson(transportIdentity(host))) {\n      throw new Error(\n        `database model catalog provider ${provider.id} does not match its host-authorized transport`,\n      );\n    }\n    return {\n      ...provider,\n      ...(host.defaultHeaders === undefined ? {} : { defaultHeaders: host.defaultHeaders }),\n      ...(host.defaultQuery === undefined ? {} : { defaultQuery: host.defaultQuery }),\n      ...(host.publicDefaultHeaderNames === undefined\n        ? {}\n        : { publicDefaultHeaderNames: host.publicDefaultHeaderNames }),\n      ...(host.publicDefaultQueryNames === undefined\n        ? {}\n        : { publicDefaultQueryNames: host.publicDefaultQueryNames }),\n      ...(host.apiKey === undefined ? {} : { apiKey: host.apiKey }),\n      ...(host.apiKeyEnv === undefined ? {} : { apiKeyEnv: host.apiKeyEnv }),\n    };\n  });\n}\n\n/** Pure secret-free database catalog overlay. getSettings remains env-only. */\n/**\n * OPENGENI_MANAGED_MODELS_JSON: the managed-provider slice of a catalog\n * document for code catalog mode. Each present array uses the database\n * document's exact strict entry schema (so no entry may carry `pricing`,\n * credentials, or billing) and replaces that provider's reviewed code table;\n * an omitted array keeps it. Price authority stays with provider-reported\n * cost (Gateway/Opper), the reviewed code snapshot, and\n * OPENGENI_MODEL_PRICING_JSON, which boot validation requires for every\n * credits-billed product without a reviewed price.\n */\nexport const ManagedModelsOverride = z\n  .object({\n    gatewayModels: z.array(DeploymentGatewayCatalogModelSchema).optional(),\n    openrouterModels: z.array(OpenRouterCatalogModel).optional(),\n    opperModels: z.array(DeploymentOpperCatalogModelSchema).optional(),\n  })\n  .strict()\n  .superRefine((override, context) => {\n    const unique = (\n      key: \"gatewayModels\" | \"openrouterModels\" | \"opperModels\",\n      ids: (model: { upstreamModelId: string }) => string[],\n    ) => {\n      const seen = new Set<string>();\n      (override[key] ?? []).forEach((model, index) => {\n        for (const id of ids(model)) {\n          if (seen.has(id)) {\n            context.addIssue({\n              code: \"custom\",\n              path: [key, index, \"upstreamModelId\"],\n              message: `duplicate ${key} model id ${id}`,\n            });\n          }\n          seen.add(id);\n        }\n      });\n    };\n    unique(\"gatewayModels\", (model) => {\n      const gateway = model as GatewayCatalogModel;\n      return [gateway.upstreamModelId, gateway.productId, gateway.workspaceProductId];\n    });\n    unique(\"openrouterModels\", (model) => [\n      model.upstreamModelId,\n      ...(model as OpenRouterCatalogModel).aliases,\n    ]);\n    unique(\"opperModels\", (model) => [\n      model.upstreamModelId,\n      ...(model as OpperCatalogModel).aliases,\n    ]);\n  });\nexport type ManagedModelsOverride = z.infer<typeof ManagedModelsOverride>;\n\nconst parsedManagedModelsJson = new Map<string, ManagedModelsOverride>();\n\n/** Parse and validate OPENGENI_MANAGED_MODELS_JSON (memoized per raw value). */\nexport function parseManagedModelsJson(raw: string): ManagedModelsOverride {\n  const cached = parsedManagedModelsJson.get(raw);\n  if (cached) return cached;\n  let json: unknown;\n  try {\n    json = JSON.parse(raw);\n  } catch (error) {\n    throw new Error(\"OPENGENI_MANAGED_MODELS_JSON must be valid JSON\", { cause: error });\n  }\n  const result = ManagedModelsOverride.safeParse(json);\n  if (!result.success) {\n    throw new Error(\n      `OPENGENI_MANAGED_MODELS_JSON is invalid: ${result.error.issues\n        .map((issue) => `${issue.path.join(\".\") || \"(root)\"}: ${issue.message}`)\n        .join(\"; \")}`,\n    );\n  }\n  if (parsedManagedModelsJson.size > 16) parsedManagedModelsJson.clear();\n  parsedManagedModelsJson.set(raw, result.data);\n  return result.data;\n}\n\n/** The code-mode managed model override; always empty in database mode. */\nfunction codeModeManagedModels(settings: Settings): ManagedModelsOverride {\n  if (settings.modelCatalogSource !== \"code\" || !settings.managedModelsJson?.trim()) return {};\n  return parseManagedModelsJson(settings.managedModelsJson);\n}\n\nexport function applyModelCatalogDocument(settings: Settings, rawDocument: unknown): Settings {\n  const document = parseModelCatalogDocument(rawDocument);\n  const defaultModel = document.defaultModel ?? document.builtInModels[0]!;\n  const resolved = {\n    ...settings,\n    openaiModel: defaultModel,\n    // Keep the complete built-in membership, including the default. The worker\n    // replaces openaiModel with the exact turn model; the run-scoped router\n    // needs one stable built-in id in this allow-list so a bare provider model\n    // is not temporarily claimed by OpenAI/Azure during name re-resolution.\n    openaiAllowedModels: document.builtInModels.join(\",\"),\n    modelProvidersJson: JSON.stringify(\n      deploymentRegistryProvidersWithHostCredentials(settings, document.registryProviders),\n    ),\n    resolvedGatewayModelsJson: JSON.stringify(document.gatewayModels),\n    resolvedOpenRouterModelsJson: JSON.stringify(document.openrouterModels),\n    resolvedOpperModelsJson: JSON.stringify(document.opperModels),\n    resolvedCodexModelsJson:\n      document.codexModels === undefined ? undefined : JSON.stringify(document.codexModels),\n    modelNotesJson: JSON.stringify(document.modelNotes),\n  };\n  return resolved;\n}\n\nexport const IntegrationOAuthClientConfigSchema = z.object({\n  clientId: z.string().min(1),\n  clientSecret: z.string().min(1).optional(),\n  tokenEndpointAuthMethod: z\n    .enum([\"none\", \"client_secret_post\", \"client_secret_basic\"])\n    .default(\"none\"),\n});\nexport type IntegrationOAuthClientConfig = z.infer<typeof IntegrationOAuthClientConfigSchema>;\n\n/**\n * Runtime-resolved provider (built-in or registry), client-construction-ready.\n * The built-in OpenAI/Azure provider is always present and always \"responses\";\n * registry providers carry their own base URL / key / wire API. Compaction is\n * not a provider capability: all providers use the same durable plaintext\n * replacement.\n */\nexport interface ResolvedModelProvider {\n  anthropic?: z.infer<typeof AnthropicProviderOptions> | undefined;\n  id: string; // \"openai\" | \"azure\" | registry id\n  label: string;\n  kind: RegistryProviderKind | \"openrouter-managed\" | \"opper-managed\";\n  api: ModelProviderApi;\n  wireProfile: ModelProviderWireProfile;\n  builtin: boolean;\n  baseUrl?: string | undefined;\n  apiKey?: string | undefined;\n  defaultQuery?: Record<string, string> | undefined;\n  defaultHeaders?: Record<string, string> | undefined;\n  publicDefaultQueryNames?: string[] | undefined;\n  publicDefaultHeaderNames?: string[] | undefined;\n  /** Generic OpenAI-compatible stream silence bound override (ms). */\n  streamIdleTimeoutMs?: number | undefined;\n  /** Generic OpenAI-compatible keepalive-only progress bound override (ms). */\n  streamProgressTimeoutMs?: number | undefined;\n  credentialSource: CredentialSourceV1;\n  billing: BillingAttributionV1;\n}\n\ntype InternalRegistryProvider = Omit<RegistryProvider, \"kind\"> & {\n  kind: RegistryProviderKind | \"openrouter-managed\" | \"opper-managed\";\n};\n\n/** A single exposed model + the provider that serves it. */\nexport interface ConfiguredModel {\n  schemaVersion: 1;\n  id: string;\n  aliases: string[];\n  label: string;\n  /** Optional curated compact label for dense UI (e.g. mobile composer). */\n  shortLabel?: string | undefined;\n  /** Optional HTTPS maker logo; display metadata does not change execution identity. */\n  logoUrl?: string | undefined;\n  providerId: string;\n  providerLabel: string;\n  api: ModelProviderApi;\n  upstreamModelId: string;\n  deployment: ModelDeploymentV1;\n  executionLimits: ModelExecutionLimitsV1;\n  credentialSource: CredentialSourceV1;\n  billing: BillingAttributionV1;\n  /** Workspace-facing funding policy, independent of upstream settlement. */\n  cost: ConfiguredModelCostClass;\n  capabilities: ModelCapabilitiesV1;\n  requestPolicy?: {\n    gateway: {\n      only: [string, ...string[]];\n      caching: \"auto\" | \"none\";\n    };\n  };\n  pricing?: ModelPricingScheduleV1 | undefined;\n  definitionVersion: string;\n  contextWindowTokens?: number | undefined;\n  effectiveContextWindowTokens?: number | undefined;\n  autoCompactTokenLimit?: number | undefined;\n  toolOutputTruncationTokens?: number | undefined;\n  reasoningEffort: boolean;\n  hostedWebSearch: boolean;\n}\n\n/**\n * Whether a resolved route is the deployment-funded OpenRouter free tier: the\n * managed OpenRouter provider, which sends every workspace's requests with the\n * deployment's one OpenRouter key, serving an upstream `:free` variant (the\n * curated catalog admits nothing else). OpenRouter limits free-variant\n * requests per account per minute and per day, so each request on this route\n * spends quota that every turn on the deployment shares. A workspace or\n * organization OpenRouter connection uses its own account and is not this\n * route.\n */\nexport function isManagedOpenRouterFreeRoute(route: {\n  provider: Pick<ResolvedModelProvider, \"kind\">;\n  configured: Pick<ConfiguredModel, \"upstreamModelId\">;\n}): boolean {\n  return (\n    route.provider.kind === \"openrouter-managed\" &&\n    route.configured.upstreamModelId.endsWith(\":free\")\n  );\n}\n\nexport const VERCEL_AI_GATEWAY_BASE_URL = \"https://ai-gateway.vercel.sh/v1\" as const;\nexport const VERCEL_AI_GATEWAY_AI_SDK_BASE_URL = \"https://ai-gateway.vercel.sh/v4/ai\" as const;\nexport const VERCEL_AI_GATEWAY_CONNECTION_DOMAIN = \"ai-gateway.vercel.sh\" as const;\nexport const VERCEL_AI_GATEWAY_CONNECTION_ROLE = \"vercel_ai_gateway\" as const;\nexport const WORKSPACE_OPENROUTER_CONNECTION_DOMAIN = \"openrouter.ai\" as const;\nexport const WORKSPACE_OPENROUTER_CONNECTION_ROLE = \"openrouter\" as const;\nexport const WORKSPACE_OPPER_CONNECTION_DOMAIN = \"api.opper.ai\" as const;\nexport const WORKSPACE_OPPER_CONNECTION_ROLE = \"opper\" as const;\nexport const WORKSPACE_ELEVENLABS_CONNECTION_DOMAIN = \"api.elevenlabs.io\" as const;\nexport const WORKSPACE_ELEVENLABS_CONNECTION_ROLE = \"elevenlabs\" as const;\n\n/**\n * Opper issues separate management keys (`op-mak-…`) that its inference routes\n * refuse with 403 (\"management API keys cannot be used on inference routes\").\n * Reject them before they are stored so a connection never looks ready while\n * every turn fails. Returns a user-facing explanation, or null when usable.\n */\nexport function opperCredentialProblem(apiKey: string): string | null {\n  const key = apiKey.trim();\n  if (!key) return \"Enter an Opper API key.\";\n  if (/^op-mak-/iu.test(key)) {\n    return \"This is an Opper management key, which Opper does not accept for model requests. Create an API key (not a management key) at platform.opper.ai and connect that instead.\";\n  }\n  return null;\n}\n\nexport const CODEX_REALTIME_MODEL_ID = \"gpt-live-1-boulder-alpha\" as const;\nexport const SUPERGROK_REALTIME_MODEL_ID = \"supergrok/grok-voice-think-fast-2.0\" as const;\nexport const OPENGENI_REALTIME_MODEL_ID_PREFIX = \"opengeni-gateway/\" as const;\nexport const WORKSPACE_REALTIME_MODEL_ID_PREFIX = \"workspace-gateway/\" as const;\n\n/** Curated voice models exposed through AI Gateway's normalized realtime API. */\nexport const AI_GATEWAY_REALTIME_MODELS = {\n  openaiRealtime21: {\n    upstreamModelId: \"openai/gpt-realtime-2.1\",\n    managedModelId: `${OPENGENI_REALTIME_MODEL_ID_PREFIX}openai/gpt-realtime-2.1`,\n    workspaceModelId: `${WORKSPACE_REALTIME_MODEL_ID_PREFIX}openai/gpt-realtime-2.1`,\n    label: \"GPT Realtime 2.1\",\n    description: \"Best overall voice intelligence\",\n  },\n  openaiRealtimeMini: {\n    upstreamModelId: \"openai/gpt-realtime-mini\",\n    managedModelId: `${OPENGENI_REALTIME_MODEL_ID_PREFIX}openai/gpt-realtime-mini`,\n    workspaceModelId: `${WORKSPACE_REALTIME_MODEL_ID_PREFIX}openai/gpt-realtime-mini`,\n    label: \"GPT Realtime Mini\",\n    description: \"Faster, lighter live voice\",\n  },\n  grokVoiceThinkFast20: {\n    upstreamModelId: \"xai/grok-voice-think-fast-2.0\",\n    managedModelId: `${OPENGENI_REALTIME_MODEL_ID_PREFIX}xai/grok-voice-think-fast-2.0`,\n    workspaceModelId: `${WORKSPACE_REALTIME_MODEL_ID_PREFIX}xai/grok-voice-think-fast-2.0`,\n    label: \"Grok Voice Think Fast 2.0\",\n    description: \"Fast, natural xAI voice\",\n  },\n} as const;\n\nexport const ELEVENLABS_REALTIME_MODEL_ID_PREFIX = \"workspace-elevenlabs/\" as const;\n\n/**\n * Eleven Realtime speech-to-speech models, reached with the workspace's own\n * ElevenLabs key. v1 max comes first: it is far more reliable at handing work\n * to the session agent.\n */\nexport const ELEVENLABS_REALTIME_MODELS = {\n  v1Max: {\n    upstreamModelId: \"eleven_realtime_v1_max\",\n    modelId: `${ELEVENLABS_REALTIME_MODEL_ID_PREFIX}eleven_realtime_v1_max`,\n    label: \"Eleven Realtime v1 max\",\n    description: \"Reasons before replying; best at handing off work\",\n  },\n  v1Mini: {\n    upstreamModelId: \"eleven_realtime_v1_mini\",\n    modelId: `${ELEVENLABS_REALTIME_MODEL_ID_PREFIX}eleven_realtime_v1_mini`,\n    label: \"Eleven Realtime v1 mini\",\n    description: \"Lowest latency and cost\",\n  },\n} as const;\n\n/** The ElevenLabs upstream model of a realtime model id, or null for other providers. */\nexport function resolveElevenLabsRealtimeModel(modelId: string): string | null {\n  for (const model of Object.values(ELEVENLABS_REALTIME_MODELS)) {\n    if (model.modelId === modelId) return model.upstreamModelId;\n  }\n  return null;\n}\n\n/**\n * Conversation languages Eleven Realtime accepts (both models). ElevenLabs does\n * not detect the spoken language: the session's language sets what it hears and\n * the language it replies in, and an unlisted code fails the session.\n */\nexport const ELEVENLABS_REALTIME_LANGUAGES = [\n  \"af\",\n  \"am\",\n  \"ar\",\n  \"as\",\n  \"ast\",\n  \"az\",\n  \"be\",\n  \"bg\",\n  \"bn\",\n  \"bs\",\n  \"ca\",\n  \"cs\",\n  \"cy\",\n  \"da\",\n  \"de\",\n  \"el\",\n  \"en\",\n  \"es\",\n  \"et\",\n  \"fa\",\n  \"fi\",\n  \"fil\",\n  \"fr\",\n  \"ga\",\n  \"gl\",\n  \"gu\",\n  \"ha\",\n  \"he\",\n  \"hi\",\n  \"hr\",\n  \"hu\",\n  \"hy\",\n  \"id\",\n  \"is\",\n  \"it\",\n  \"ja\",\n  \"jv\",\n  \"ka\",\n  \"kk\",\n  \"kn\",\n  \"ko\",\n  \"ky\",\n  \"lb\",\n  \"lg\",\n  \"lo\",\n  \"lt\",\n  \"lv\",\n  \"mi\",\n  \"mk\",\n  \"ml\",\n  \"mn\",\n  \"mr\",\n  \"ms\",\n  \"mt\",\n  \"my\",\n  \"ne\",\n  \"nl\",\n  \"no\",\n  \"oc\",\n  \"or\",\n  \"pa\",\n  \"pl\",\n  \"ps\",\n  \"pt\",\n  \"pt-br\",\n  \"ro\",\n  \"ru\",\n  \"sd\",\n  \"sk\",\n  \"sl\",\n  \"sn\",\n  \"so\",\n  \"sr\",\n  \"sv\",\n  \"sw\",\n  \"ta\",\n  \"te\",\n  \"tg\",\n  \"th\",\n  \"tl\",\n  \"tr\",\n  \"uk\",\n  \"ur\",\n  \"uz\",\n  \"vi\",\n  \"wo\",\n  \"yo\",\n  \"yue\",\n  \"zh\",\n  \"zu\",\n] as const;\n\n// Tags whose language ElevenLabs lists under another code: Norwegian Bokmål and\n// Nynorsk are Norwegian, and the legacy Hebrew, Indonesian and Javanese codes.\nconst ELEVENLABS_REALTIME_LANGUAGE_ALIASES: Readonly<Record<string, string>> = {\n  nb: \"no\",\n  nn: \"no\",\n  iw: \"he\",\n  in: \"id\",\n  jw: \"jv\",\n};\n\n/**\n * The Eleven Realtime language for a BCP 47 tag such as `nb-NO` or `pt-BR`, or\n * null when ElevenLabs does not support it.\n */\nexport function resolveElevenLabsRealtimeLanguage(tag: string): string | null {\n  const normalized = tag.trim().toLowerCase().replaceAll(\"_\", \"-\");\n  const supported: readonly string[] = ELEVENLABS_REALTIME_LANGUAGES;\n  if (supported.includes(normalized)) return normalized;\n  const base = normalized.split(\"-\")[0] ?? \"\";\n  const language = ELEVENLABS_REALTIME_LANGUAGE_ALIASES[base] ?? base;\n  return supported.includes(language) ? language : null;\n}\n\nexport type AiGatewayRealtimeModel =\n  (typeof AI_GATEWAY_REALTIME_MODELS)[keyof typeof AI_GATEWAY_REALTIME_MODELS];\n\nexport function resolveAiGatewayRealtimeModel(\n  modelId: string,\n): { source: \"managed\" | \"workspace\"; upstreamModelId: string } | null {\n  for (const model of Object.values(AI_GATEWAY_REALTIME_MODELS)) {\n    if (model.managedModelId === modelId) {\n      return { source: \"managed\", upstreamModelId: model.upstreamModelId };\n    }\n    if (model.workspaceModelId === modelId) {\n      return { source: \"workspace\", upstreamModelId: model.upstreamModelId };\n    }\n  }\n  return null;\n}\n\nexport const OPENGENI_GATEWAY_MODELS = {\n  deepseek: {\n    productId: \"deepseek-v4-flash-0731\",\n    workspaceProductId: `${WORKSPACE_GATEWAY_MODEL_ID_PREFIX}deepseek-v4-flash-0731`,\n    upstreamModelId: \"deepseek/deepseek-v4-flash-0731\",\n    label: \"DeepSeek V4 Flash 0731\",\n    shortLabel: \"V4 Flash\",\n    providers: [\"baseten\", \"novita\", \"deepinfra\"],\n    implicitCaching: true,\n  },\n  kimi: {\n    productId: \"kimi-k3\",\n    workspaceProductId: `${WORKSPACE_GATEWAY_MODEL_ID_PREFIX}kimi-k3`,\n    upstreamModelId: \"moonshotai/kimi-k3\",\n    label: \"Kimi K3\",\n    shortLabel: \"Kimi K3\",\n    providers: [\"baseten\", \"fireworks\"],\n    implicitCaching: true,\n  },\n} as const;\n\nexport const OPENGENI_OPENROUTER_MODELS: readonly OpenRouterCatalogModel[] = [\n  OpenRouterCatalogModel.parse({\n    upstreamModelId: \"nvidia/nemotron-3-super-120b-a12b:free\",\n    label: \"Nemotron 3 Super 120B\",\n    shortLabel: \"Nemotron 3 Super\",\n    aliases: [],\n    capabilities: {\n      reasoning: {\n        upstream: \"supported\",\n        // OpenRouter /api/v1/models advertises low and medium for this route.\n        runnable: true,\n        efforts: [\"low\", \"medium\"],\n        defaultEffort: \"medium\",\n        required: false,\n      },\n      functionCalling: { upstream: \"supported\", runnable: true },\n      structuredOutput: { upstream: \"supported\", runnable: true },\n      hostedTools: {\n        webSearch: { upstream: \"unknown\", runnable: false },\n        xSearch: { upstream: \"unknown\", runnable: false },\n        codeExecution: { upstream: \"unknown\", runnable: false },\n        imageGeneration: { upstream: \"unknown\", runnable: false },\n      },\n      inputModalities: [\"text\"],\n      inputFileMediaTypes: [],\n      outputModalities: [\"text\"],\n      transports: {\n        sse: { upstream: \"supported\", runnable: true },\n        responsesWebSocket: { upstream: \"unknown\", runnable: false },\n        realtimeAudio: { upstream: \"unsupported\", runnable: false },\n      },\n      latencyModes: [{ id: \"standard\", upstream: \"unknown\", runnable: true }],\n    },\n    contextWindowTokens: 262_144,\n    effectiveContextWindowTokens: 235_929,\n    autoCompactTokenLimit: 220_000,\n  }),\n];\n\n/** Shared Opper Chat capability envelope. Opper accepts every\n * `reasoning_effort` value on every probed route (it ignores values a route\n * does not support rather than failing), so the declared vocabulary is a\n * product choice, never a request-validity guarantee. */\nfunction opperCapabilities(input: {\n  reasoning: Pick<\n    ModelCapabilitiesV1[\"reasoning\"],\n    \"upstream\" | \"runnable\" | \"efforts\" | \"defaultEffort\"\n  >;\n  structuredOutput: CapabilitySupportV1;\n  image: boolean;\n  inputFileMediaTypes: string[];\n}): ModelCapabilitiesV1 {\n  return ModelCapabilitiesV1Schema.parse({\n    reasoning: { ...input.reasoning, required: false },\n    // Opengeni sends ordinary OpenAI-compatible Chat function tools.\n    functionCalling: { upstream: \"supported\", runnable: true },\n    structuredOutput: {\n      upstream: input.structuredOutput,\n      runnable: input.structuredOutput === \"supported\",\n    },\n    hostedTools: {\n      webSearch: { upstream: \"unknown\", runnable: false },\n      xSearch: { upstream: \"unknown\", runnable: false },\n      codeExecution: { upstream: \"unknown\", runnable: false },\n      imageGeneration: { upstream: \"unknown\", runnable: false },\n    },\n    inputModalities: input.image ? [\"text\", \"image\"] : [\"text\"],\n    inputFileMediaTypes: input.inputFileMediaTypes,\n    outputModalities: [\"text\"],\n    transports: {\n      sse: { upstream: \"supported\", runnable: true },\n      responsesWebSocket: { upstream: \"unsupported\", runnable: false },\n      realtimeAudio: { upstream: \"unsupported\", runnable: false },\n    },\n    promptCaching: { upstream: \"unknown\", runnable: false, mode: \"none\" },\n    latencyModes: [{ id: \"standard\", upstream: \"supported\", runnable: true }],\n  });\n}\n\n/**\n * Reviewed Opper starter route. Snapshot of Opper's catalogue\n * (`GET https://api.opper.ai/v3/compat/models`) reviewed 2026-10-05 and probed\n * live end to end. The route is provider-pinned (`provider/model`) to AWS\n * Bedrock eu-north-1 (Stockholm) with no provider logging, so Opper never\n * pools it onto a non-EU provider. `pricing` is Opper's listed supplier rate\n * (USD per 1M tokens); turns debit Opper's exact reported cost +5% and use\n * this rate only when cost metadata is absent. Hosts replace this list with\n * OPENGENI_OPPER_MODELS_JSON (code mode) or the catalog document's\n * `opperModels` (database mode).\n */\n/**\n * Default automatic-compaction threshold for Claude Opus 5.5 on every route.\n * Workspaces can still choose another threshold per model.\n */\nexport const OPUS_5_5_AUTO_COMPACT_TOKEN_LIMIT = 300_000;\n\nexport const OPENGENI_OPPER_MODELS: readonly OpperCatalogModel[] = [\n  OpperCatalogModel.parse({\n    upstreamModelId: \"aws/claude-opus-5-5\",\n    label: \"Claude Opus 5.5 (EU)\",\n    shortLabel: \"Opus 5.5\",\n    aliases: [],\n    capabilities: opperCapabilities({\n      // Opper lists `reasoning.supported` low..max with no default for this\n      // route; `reasoning_effort` measurably changes hidden thinking length.\n      // Default medium matches the native Claude Opus 5.5 profile.\n      reasoning: {\n        upstream: \"supported\",\n        runnable: true,\n        efforts: [\"low\", \"medium\", \"high\", \"xhigh\", \"max\"],\n        defaultEffort: \"medium\",\n      },\n      // The route lists text/vision/tools/pdf/reasoning, not structured_output.\n      structuredOutput: \"unknown\",\n      image: true,\n      inputFileMediaTypes: [\"application/pdf\"],\n    }),\n    contextWindowTokens: 1_000_000,\n    // 1,000,000 minus Opper's 128,000 max output tokens.\n    effectiveContextWindowTokens: 872_000,\n    // Same product default as the native Claude Opus 5.5 profile.\n    autoCompactTokenLimit: OPUS_5_5_AUTO_COMPACT_TOKEN_LIMIT,\n    maxOutputTokens: 128_000,\n    pricing: {\n      // Opper list: $4.40 input / $0.22 cached input / $5.50 5-minute cache\n      // write / $22.00 output per 1M (Bedrock EU regional rate).\n      inputMicrosPerMillionTokens: 4_400_000,\n      cachedInputMicrosPerMillionTokens: 220_000,\n      cacheWriteMicrosPerMillionTokens: 5_500_000,\n      outputMicrosPerMillionTokens: 22_000_000,\n      marginBps: 500,\n    },\n  }),\n];\n\n/**\n * Reviewed Opper list prices for routes a host may add through\n * OPENGENI_OPPER_MODELS_JSON or the catalog document without its own\n * OPENGENI_MODEL_PRICING_JSON entry. Price only: membership, labels,\n * capabilities and limits always come from configuration.\n */\nconst REVIEWED_OPPER_MODEL_PRICING: Readonly<\n  Record<string, ModelPricing | ModelPricingScheduleV1>\n> = {\n  ...Object.fromEntries(\n    OPENGENI_OPPER_MODELS.flatMap((model) =>\n      model.pricing ? [[model.upstreamModelId, model.pricing] as const] : [],\n    ),\n  ),\n  // Reviewed 2026-10-05: $0.825 input / $0.0825 cached input / $4.125 output.\n  \"vertexai/gemini-3.8-flash-eu\": {\n    inputMicrosPerMillionTokens: 825_000,\n    cachedInputMicrosPerMillionTokens: 82_500,\n    outputMicrosPerMillionTokens: 4_125_000,\n    marginBps: 500,\n  },\n  // Reviewed 2026-10-05: $3.30 input / $0.33 cached / $4.125 cache write / $16.50 output.\n  \"aws/claude-sonnet-4-6-eu\": {\n    inputMicrosPerMillionTokens: 3_300_000,\n    cachedInputMicrosPerMillionTokens: 330_000,\n    cacheWriteMicrosPerMillionTokens: 4_125_000,\n    outputMicrosPerMillionTokens: 16_500_000,\n    marginBps: 500,\n  },\n};\n\n/** Keepalive-only progress bound for Opper streams: room for a full 128,000-\n * token hidden-reasoning response at roughly 35 tokens per second. */\nexport const OPPER_STREAM_PROGRESS_TIMEOUT_MS = 60 * 60_000;\n\n/** Opper's smallest advertised `max_output_tokens` across every Claude route\n * in its 2026-10-05 catalogue (all 70 routes are 64,000 or more). */\nconst OPPER_CLAUDE_FAMILY_MAX_OUTPUT_TOKENS = 64_000;\n\nfunction isOpperClaudeFamilyModel(upstreamModelId: string): boolean {\n  return /(?:^|[/.])claude-/iu.test(upstreamModelId);\n}\n\nfunction isOpperGeminiFamilyModel(upstreamModelId: string): boolean {\n  return /(?:^|[/.])gemini-/iu.test(upstreamModelId);\n}\n\n/**\n * Capability envelope for a workspace/organization custom Opper id that is not\n * in the configured deployment list. Deterministic and offline (the API and\n * worker must derive the same frozen definition, so no live `GET /models`):\n * - reasoning is runnable with low/medium/high, because Opper accepts any\n *   effort on every probed route and ignores one a route does not support;\n * - image input is on for the Claude and Gemini families, where every route\n *   in Opper's catalogue lists vision; other families stay text-only;\n * - typed file input stays off (Opengeni sends documents to the sandbox).\n */\nfunction opperCustomModelCapabilities(upstreamModelId: string): ModelCapabilitiesV1 {\n  return opperCapabilities({\n    reasoning: {\n      upstream: \"unknown\",\n      runnable: true,\n      efforts: [\"low\", \"medium\", \"high\"],\n      defaultEffort: \"medium\",\n    },\n    structuredOutput: \"unknown\",\n    image: isOpperClaudeFamilyModel(upstreamModelId) || isOpperGeminiFamilyModel(upstreamModelId),\n    inputFileMediaTypes: [],\n  });\n}\n\n/**\n * `max_tokens` the Opper Chat adapter sends when a request sets none. Opper's\n * own default is 4,096 output tokens, which hidden reasoning can exhaust before\n * any answer, and Opper rejects (does not clamp) a value above the route's\n * limit. A configured entry's `maxOutputTokens` wins; a Claude-family custom id\n * gets the smallest Claude limit in Opper's catalogue; other ids keep Opper's\n * default.\n */\nexport function opperMaxOutputTokens(\n  settings: Settings,\n  upstreamModelId: string,\n): number | undefined {\n  const configured = configuredOpperCatalogModels(settings).find(\n    (model) => model.upstreamModelId === upstreamModelId,\n  );\n  if (configured?.maxOutputTokens !== undefined) return configured.maxOutputTokens;\n  return isOpperClaudeFamilyModel(upstreamModelId)\n    ? OPPER_CLAUDE_FAMILY_MAX_OUTPUT_TOKENS\n    : undefined;\n}\n\nfunction defaultGatewayCatalogModels(): GatewayCatalogModel[] {\n  return [\n    {\n      ...OPENGENI_GATEWAY_MODELS.deepseek,\n      vision: false,\n      inputFileMediaTypes: [],\n      contextWindowTokens: 1_000_000,\n      effectiveContextWindowTokens: 900_000,\n      autoCompactTokenLimit: 850_000,\n    },\n    {\n      ...OPENGENI_GATEWAY_MODELS.kimi,\n      vision: true,\n      inputFileMediaTypes: [\"application/pdf\"],\n      contextWindowTokens: 1_000_000,\n      effectiveContextWindowTokens: 900_000,\n      autoCompactTokenLimit: 850_000,\n    },\n  ].map((model) => GatewayCatalogModel.parse(model));\n}\n\nfunction configuredGatewayCatalogModels(settings: Settings): GatewayCatalogModel[] {\n  if (settings.resolvedGatewayModelsJson !== undefined) {\n    return z.array(GatewayCatalogModel).parse(JSON.parse(settings.resolvedGatewayModelsJson));\n  }\n  const override = codeModeManagedModels(settings).gatewayModels;\n  if (override) return override.map((model) => GatewayCatalogModel.parse(model));\n  return defaultGatewayCatalogModels();\n}\n\nexport function configuredGatewayUpstreamModelIds(settings: Settings): string[] {\n  return configuredGatewayCatalogModels(settings).map((model) => model.upstreamModelId);\n}\n\nexport function configuredGatewayWorkspaceProductModelIds(settings: Settings): string[] {\n  return configuredGatewayCatalogModels(settings).map((model) => model.workspaceProductId);\n}\n\nexport function configuredGatewayOrganizationProductModelIds(settings: Settings): string[] {\n  void settings;\n  return [];\n}\n\nexport function configuredModelInputIdentities(settings: Settings): string[] {\n  return configuredModels(settings).flatMap((model) => [model.id, ...model.aliases]);\n}\n\nfunction configuredOpenRouterCatalogModels(settings: Settings): OpenRouterCatalogModel[] {\n  if (settings.resolvedOpenRouterModelsJson !== undefined) {\n    return z.array(OpenRouterCatalogModel).parse(JSON.parse(settings.resolvedOpenRouterModelsJson));\n  }\n  const override = codeModeManagedModels(settings).openrouterModels;\n  if (override) return override.map((model) => OpenRouterCatalogModel.parse(model));\n  return [...OPENGENI_OPENROUTER_MODELS];\n}\n\nexport function configuredOpenRouterUpstreamModelIds(settings: Settings): string[] {\n  return configuredOpenRouterCatalogModels(settings).map((model) => model.upstreamModelId);\n}\n\nfunction workspaceOpenRouterProductId(modelId: string): string {\n  return `${WORKSPACE_OPENROUTER_MODEL_ID_PREFIX}${\n    modelId.startsWith(OPENROUTER_MODEL_ID_PREFIX)\n      ? modelId.slice(OPENROUTER_MODEL_ID_PREFIX.length)\n      : modelId\n  }`;\n}\n\nexport function configuredOpenRouterWorkspaceProductModelIds(settings: Settings): string[] {\n  return configuredOpenRouterCatalogModels(settings).flatMap((model) =>\n    [model.upstreamModelId, ...model.aliases].map(workspaceOpenRouterProductId),\n  );\n}\n\nexport function configuredOpenRouterOrganizationProductModelIds(settings: Settings): string[] {\n  void settings;\n  return [];\n}\n\n/**\n * Deployment Opper membership. A resolved database catalog document is the\n * sole authority in database mode; OPENGENI_MANAGED_MODELS_JSON `opperModels`\n * is read only in code mode, so it can never bypass the database document;\n * otherwise the reviewed code starter table applies.\n */\nfunction configuredOpperCatalogModels(settings: Settings): OpperCatalogModel[] {\n  if (settings.resolvedOpperModelsJson !== undefined) {\n    return z.array(OpperCatalogModel).parse(JSON.parse(settings.resolvedOpperModelsJson));\n  }\n  const override = codeModeManagedModels(settings).opperModels;\n  if (override) return override.map((model) => OpperCatalogModel.parse(model));\n  return [...OPENGENI_OPPER_MODELS];\n}\n\n/** Reviewed code price for one Opper upstream id, if any. */\nfunction reviewedOpperModelPricing(upstreamModelId: string): ModelPricingScheduleV1 | undefined {\n  const pricing = Object.hasOwn(REVIEWED_OPPER_MODEL_PRICING, upstreamModelId)\n    ? REVIEWED_OPPER_MODEL_PRICING[upstreamModelId]\n    : undefined;\n  return pricing === undefined ? undefined : normalizeModelPricingSchedule(pricing);\n}\n\nexport function configuredOpperUpstreamModelIds(settings: Settings): string[] {\n  return configuredOpperCatalogModels(settings).map((model) => model.upstreamModelId);\n}\n\nfunction workspaceOpperProductId(modelId: string): string {\n  return `${WORKSPACE_OPPER_MODEL_ID_PREFIX}${\n    modelId.startsWith(OPPER_MODEL_ID_PREFIX)\n      ? modelId.slice(OPPER_MODEL_ID_PREFIX.length)\n      : modelId\n  }`;\n}\n\nexport function configuredOpperWorkspaceProductModelIds(settings: Settings): string[] {\n  return configuredOpperCatalogModels(settings).flatMap((model) =>\n    [model.upstreamModelId, ...model.aliases].map(workspaceOpperProductId),\n  );\n}\n\nexport function configuredOpperOrganizationProductModelIds(settings: Settings): string[] {\n  void settings;\n  return [];\n}\n\n/**\n * Built-in Opengeni credit pricing schedules.\n *\n * Rates are provider list prices in USD micros per 1M tokens. Debit applies\n * `marginBps` (500 = +5%) on top. Long-context tiers follow OpenAI's\n * \">272K input tokens\" rule (threshold exclusive of 272_000).\n *\n * GPT-5.4 and older families are intentionally omitted — they are no longer\n * offered. Codex / connected-subscription turns use `metering: external`, so\n * this map never debits them, but it does provide their equivalent Opengeni\n * credit price when a matching product model is configured.\n *\n * When adding or changing a billed model, run `bun run check:model-pricing`\n * (see docs/model-providers.md § Price audit). That compares this map to\n * llm-prices.com as a ground-truth canary; it does not generate this table.\n */\nexport const defaultModelPricing: Record<string, ModelPricingScheduleV1> = {\n  \"gpt-6-astra\": {\n    default: {\n      // OpenAI list price: $10 / $1 cached / $12.50 cache write / $50 output.\n      inputMicrosPerMillionTokens: 10_000_000,\n      cachedInputMicrosPerMillionTokens: 1_000_000,\n      cacheWriteMicrosPerMillionTokens: 12_500_000,\n      outputMicrosPerMillionTokens: 50_000_000,\n      marginBps: 500,\n    },\n    inputTokenTiers: [\n      {\n        // Prompts with more than 272K input tokens use 2x input and 1.5x output.\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 20_000_000,\n          cachedInputMicrosPerMillionTokens: 2_000_000,\n          cacheWriteMicrosPerMillionTokens: 25_000_000,\n          outputMicrosPerMillionTokens: 75_000_000,\n          marginBps: 500,\n        },\n      },\n    ],\n  },\n  \"gpt-6-sol\": {\n    default: {\n      // OpenAI list price: $2 / $0.20 cached / $2.50 cache write / $10 output.\n      inputMicrosPerMillionTokens: 2_000_000,\n      cachedInputMicrosPerMillionTokens: 200_000,\n      cacheWriteMicrosPerMillionTokens: 2_500_000,\n      outputMicrosPerMillionTokens: 10_000_000,\n      marginBps: 500,\n    },\n    inputTokenTiers: [\n      {\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 4_000_000,\n          cachedInputMicrosPerMillionTokens: 400_000,\n          cacheWriteMicrosPerMillionTokens: 5_000_000,\n          outputMicrosPerMillionTokens: 15_000_000,\n          marginBps: 500,\n        },\n      },\n    ],\n  },\n  \"gpt-6-luna\": {\n    default: {\n      // OpenAI list price: $0.10 / $0.01 cached / $0.125 cache write / $0.50 output.\n      inputMicrosPerMillionTokens: 100_000,\n      cachedInputMicrosPerMillionTokens: 10_000,\n      cacheWriteMicrosPerMillionTokens: 125_000,\n      outputMicrosPerMillionTokens: 500_000,\n      marginBps: 500,\n    },\n    inputTokenTiers: [\n      {\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 200_000,\n          cachedInputMicrosPerMillionTokens: 20_000,\n          cacheWriteMicrosPerMillionTokens: 250_000,\n          outputMicrosPerMillionTokens: 750_000,\n          marginBps: 500,\n        },\n      },\n    ],\n  },\n  \"gpt-5.6-sol\": {\n    default: {\n      // Promotional OpenAI pricing, guaranteed through at least 2026-11-21.\n      inputMicrosPerMillionTokens: 4_000_000,\n      cachedInputMicrosPerMillionTokens: 400_000,\n      cacheWriteMicrosPerMillionTokens: 5_000_000,\n      outputMicrosPerMillionTokens: 20_000_000,\n      marginBps: 500,\n    },\n    inputTokenTiers: [\n      {\n        // OpenAI: prompts with >272K input tokens use the long-context rate.\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 8_000_000,\n          cachedInputMicrosPerMillionTokens: 800_000,\n          cacheWriteMicrosPerMillionTokens: 10_000_000,\n          outputMicrosPerMillionTokens: 30_000_000,\n          marginBps: 500,\n        },\n      },\n    ],\n  },\n  \"gpt-5.6-terra\": {\n    default: {\n      inputMicrosPerMillionTokens: 2_000_000,\n      cachedInputMicrosPerMillionTokens: 200_000,\n      cacheWriteMicrosPerMillionTokens: 2_500_000,\n      outputMicrosPerMillionTokens: 12_000_000,\n      marginBps: 500,\n    },\n    inputTokenTiers: [\n      {\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 4_000_000,\n          cachedInputMicrosPerMillionTokens: 400_000,\n          cacheWriteMicrosPerMillionTokens: 5_000_000,\n          outputMicrosPerMillionTokens: 18_000_000,\n          marginBps: 500,\n        },\n      },\n    ],\n  },\n  \"gpt-5.6-luna\": {\n    default: {\n      inputMicrosPerMillionTokens: 200_000,\n      cachedInputMicrosPerMillionTokens: 20_000,\n      cacheWriteMicrosPerMillionTokens: 250_000,\n      outputMicrosPerMillionTokens: 1_200_000,\n      marginBps: 500,\n    },\n    inputTokenTiers: [\n      {\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 400_000,\n          cachedInputMicrosPerMillionTokens: 40_000,\n          cacheWriteMicrosPerMillionTokens: 500_000,\n          outputMicrosPerMillionTokens: 1_800_000,\n          marginBps: 500,\n        },\n      },\n    ],\n  },\n  // Conservative Vercel AI Gateway fallback prices. Normal managed Gateway\n  // billing uses the exact response Gateway `cost` / `inferenceCost` and applies\n  // the same margin. These token rates are used only if that\n  // metadata is absent. DeepSeek therefore carries the highest approved route\n  // (Novita); both approved Kimi routes have the same list price.\n  [OPENGENI_GATEWAY_MODELS.deepseek.productId]: {\n    default: {\n      inputMicrosPerMillionTokens: 140_000,\n      cachedInputMicrosPerMillionTokens: 28_000,\n      outputMicrosPerMillionTokens: 280_000,\n      marginBps: 500,\n    },\n  },\n  [OPENGENI_GATEWAY_MODELS.kimi.productId]: {\n    default: {\n      inputMicrosPerMillionTokens: 3_000_000,\n      cachedInputMicrosPerMillionTokens: 300_000,\n      outputMicrosPerMillionTokens: 15_000_000,\n      marginBps: 500,\n    },\n  },\n  // Fireworks AI / GLM 5.2 — the first shipped non-OpenAI registry model. A\n  // built-in default pricing entry makes managed billing work out of the box\n  // for hosts that expose this model via OPENGENI_MODEL_PROVIDERS_JSON without\n  // also setting OPENGENI_MODEL_PRICING_JSON.\n  \"accounts/fireworks/models/glm-5p2\": {\n    default: {\n      inputMicrosPerMillionTokens: 1_400_000,\n      cachedInputMicrosPerMillionTokens: 140_000,\n      outputMicrosPerMillionTokens: 4_400_000,\n      marginBps: 500,\n    },\n  },\n};\n\n/** Reviewed comparison rates only; never debit or execution-definition defaults. */\nexport const reviewedModelListPricing: Record<string, ModelPricingScheduleV1> = {\n  // Reviewed 2026-10-03 against https://developers.openai.com/api/docs/pricing\n  // and https://ai-gateway.vercel.sh/v1/models. GPT-6.1 Sol's cache-read rate\n  // is 5% of input, not GPT-6 Sol's 10%. The long-context boundary is >272K.\n  \"gpt-6.1-sol\": {\n    default: {\n      inputMicrosPerMillionTokens: 2_000_000,\n      cachedInputMicrosPerMillionTokens: 100_000,\n      cacheWriteMicrosPerMillionTokens: 2_500_000,\n      outputMicrosPerMillionTokens: 10_000_000,\n      marginBps: 500,\n    },\n    inputTokenTiers: [\n      {\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 4_000_000,\n          cachedInputMicrosPerMillionTokens: 200_000,\n          cacheWriteMicrosPerMillionTokens: 5_000_000,\n          outputMicrosPerMillionTokens: 15_000_000,\n          marginBps: 500,\n        },\n      },\n    ],\n  },\n  // xAI Standard API list rates, reviewed 2026-10-03:\n  // https://docs.x.ai/developers/models/grok-4.5 (and grok-4.6 / grok-4.7).\n  // Preserve the native API's established >=200K boundary. Gateway's separately\n  // configured >200K schedule is not interchangeable with this native schedule.\n  // xAI's automatic caching has no separate cache-write surcharge.\n  ...Object.fromEntries(\n    (\n      [\n        [\"grok-4.5\", 300_000],\n        [\"grok-4.6\", 500_000],\n        [\"grok-4.7\", 500_000],\n      ] as const\n    ).map(([model, cachedInput]) => [\n      model,\n      {\n        default: {\n          inputMicrosPerMillionTokens: 2_000_000,\n          cachedInputMicrosPerMillionTokens: cachedInput,\n          outputMicrosPerMillionTokens: 6_000_000,\n          marginBps: 500,\n        },\n        inputTokenTiers: [\n          {\n            minimumInputTokens: 200_000,\n            pricing: {\n              inputMicrosPerMillionTokens: 4_000_000,\n              cachedInputMicrosPerMillionTokens: cachedInput * 2,\n              outputMicrosPerMillionTokens: 12_000_000,\n              marginBps: 500,\n            },\n          },\n        ],\n      },\n    ]),\n  ),\n  // Every reviewed native Claude profile. Standard/global prices include\n  // 5-minute cache writes; 1-hour native routes are projected separately.\n  // https://platform.claude.com/docs/en/about-claude/pricing (2026-10-08).\n  // Opus/Sonnet 5.5 cache reads are 5%, unlike the older models' 10%; none of these\n  // models has a long-context premium.\n  ...Object.fromEntries(\n    (\n      [\n        [\"claude-opus-5-5\", 4_000_000, 200_000, 5_000_000, 20_000_000],\n        [\"claude-sonnet-5-5\", 2_000_000, 100_000, 2_500_000, 10_000_000],\n        [\"claude-opus-5\", 5_000_000, 500_000, 6_250_000, 25_000_000],\n        [\"claude-sonnet-5\", 2_000_000, 200_000, 2_500_000, 10_000_000],\n        [\"claude-opus-4-8\", 5_000_000, 500_000, 6_250_000, 25_000_000],\n        [\"claude-opus-4-7\", 5_000_000, 500_000, 6_250_000, 25_000_000],\n        [\"claude-opus-4-6\", 5_000_000, 500_000, 6_250_000, 25_000_000],\n        [\"claude-sonnet-4-6\", 3_000_000, 300_000, 3_750_000, 15_000_000],\n        [\"claude-haiku-4-5-20251001\", 1_000_000, 100_000, 1_250_000, 5_000_000],\n      ] as const\n    ).map(([model, input, cachedInput, cacheWrite, output]) => [\n      model,\n      {\n        default: {\n          inputMicrosPerMillionTokens: input,\n          cachedInputMicrosPerMillionTokens: cachedInput,\n          cacheWriteMicrosPerMillionTokens: cacheWrite,\n          outputMicrosPerMillionTokens: output,\n          marginBps: 500,\n        },\n      },\n    ]),\n  ),\n  // https://platform.claude.com/docs/en/models/haiku-5-5/overview (2026-10-08).\n  // The higher rate applies to the WHOLE request strictly above 100,000 input\n  // tokens, including cached input. These are comparison prices, not a quota.\n  \"claude-haiku-5-5\": {\n    default: {\n      inputMicrosPerMillionTokens: 100_000,\n      cachedInputMicrosPerMillionTokens: 10_000,\n      cacheWriteMicrosPerMillionTokens: 125_000,\n      outputMicrosPerMillionTokens: 500_000,\n      marginBps: 500,\n    },\n    inputTokenTiers: [\n      {\n        minimumInputTokens: 100_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 500_000,\n          cachedInputMicrosPerMillionTokens: 50_000,\n          cacheWriteMicrosPerMillionTokens: 625_000,\n          outputMicrosPerMillionTokens: 2_500_000,\n          marginBps: 500,\n        },\n      },\n    ],\n  },\n};\n\n// Explicitly priced free variant, not an unknown rate. List-only metadata\n// preserves previously accepted free-route execution definitions.\n// https://openrouter.ai/api/v1/models, verified 2026-10-03.\nconst reviewedFreeOpenRouterListPricing: ModelPricingScheduleV1 = {\n  default: {\n    inputMicrosPerMillionTokens: 0,\n    cachedInputMicrosPerMillionTokens: 0,\n    cacheWriteMicrosPerMillionTokens: 0,\n    outputMicrosPerMillionTokens: 0,\n    marginBps: 500,\n  },\n};\n\n// --- backend-gated required-credential table (the single source of truth) ---\n// Each sandbox backend declares ONLY its own required credentials: a deployment\n// configured for `sandboxBackend=modal` must carry the Modal token, but a\n// daytona/e2b/local/none deployment must NOT be forced to set Modal creds (and\n// vice versa). validateSettings() iterates this table for the *active* backend\n// only — so the cred a backend doesn't use is never a boot blocker — and the\n// deployment package mirrors the same table to drive its env-render + the\n// required-env manifest (one table, two consumers).\n//\n// `field` is the parsed Settings key (boot validation reads the typed value);\n// `env` is the OPENGENI_* variable name (deployment renders/requires it). The\n// modal token is a both-or-neither pair handled by an extra refine in\n// validateSettings — this table holds the hard \"must be present when active\"\n// requirements.\nexport type SandboxRequiredEnv = {\n  field: keyof Settings;\n  env: string;\n};\n\nexport const SANDBOX_REQUIRED_ENV: Record<\n  z.infer<typeof SandboxBackend>,\n  readonly SandboxRequiredEnv[]\n> = {\n  // docker/local/none need no credentials (local dev container / in-process / off).\n  docker: [],\n  local: [],\n  none: [],\n  modal: [\n    { field: \"modalAppName\", env: \"OPENGENI_MODAL_APP_NAME\" },\n    { field: \"modalTokenId\", env: \"OPENGENI_MODAL_TOKEN_ID\" },\n    { field: \"modalTokenSecret\", env: \"OPENGENI_MODAL_TOKEN_SECRET\" },\n  ],\n  daytona: [{ field: \"daytonaApiKey\", env: \"OPENGENI_DAYTONA_API_KEY\" }],\n  runloop: [{ field: \"runloopApiKey\", env: \"OPENGENI_RUNLOOP_API_KEY\" }],\n  e2b: [{ field: \"e2bApiKey\", env: \"OPENGENI_E2B_API_KEY\" }],\n  blaxel: [{ field: \"blaxelApiKey\", env: \"OPENGENI_BLAXEL_API_KEY\" }],\n  cloudflare: [{ field: \"cloudflareWorkerUrl\", env: \"OPENGENI_CLOUDFLARE_WORKER_URL\" }],\n  vercel: [\n    { field: \"vercelToken\", env: \"OPENGENI_VERCEL_TOKEN\" },\n    { field: \"vercelProjectId\", env: \"OPENGENI_VERCEL_PROJECT_ID\" },\n  ],\n  opensandbox: [\n    { field: \"openSandboxBaseUrl\", env: \"OPENGENI_OPENSANDBOX_BASE_URL\" },\n    { field: \"openSandboxApiKey\", env: \"OPENGENI_OPENSANDBOX_API_KEY\" },\n    { field: \"openSandboxImage\", env: \"OPENGENI_OPENSANDBOX_IMAGE\" },\n  ],\n  // compute also needs the gateway and relay; computeSettingsIssues checks them.\n  compute: [\n    { field: \"computeApiUrl\", env: \"OPENGENI_COMPUTE_API_URL\" },\n    { field: \"computeApiKey\", env: \"OPENGENI_COMPUTE_API_KEY\" },\n  ],\n  // selfhosted needs NO per-box credentials: it is the user's own machine reached\n  // over the agent's own enrollment. The enrollment-signing + relay-token secrets\n  // are deployment-level (a single runtime secret, not per-active-backend creds),\n  // wired in the connectivity/enrollment milestones (M4/M5), not here.\n  selfhosted: [],\n};\n\n/** The required OPENGENI_* env var names for a backend (for the deployment manifest). */\nexport function requiredSandboxEnvForBackend(backend: z.infer<typeof SandboxBackend>): string[] {\n  return (SANDBOX_REQUIRED_ENV[backend] ?? []).map((entry) => entry.env);\n}\n\nfunction objectStorageConfiguredForWorkspaceArchives(settings: Settings): boolean {\n  switch (settings.objectStorageBackend) {\n    case \"azure-blob\":\n      return Boolean(\n        settings.objectStorageAzureConnectionString ||\n        (settings.objectStorageAzureAccountName && settings.objectStorageAzureAccountKey),\n      );\n    case \"gcs\":\n      return Boolean(\n        settings.objectStorageGcsCredentialsJson ||\n        settings.objectStorageGcsKeyFilename ||\n        settings.objectStorageGcsProjectId,\n      );\n    case \"aws-s3\":\n      return true;\n    case \"s3-compatible\":\n      return Boolean(\n        settings.objectStorageEndpoint &&\n        settings.objectStorageAccessKeyId &&\n        settings.objectStorageSecretAccessKey,\n      );\n    default: {\n      const _exhaustive: never = settings.objectStorageBackend;\n      return _exhaustive;\n    }\n  }\n}\n\nfunction optionalEnvironmentValue(name: string, source: NodeJS.ProcessEnv): string | undefined {\n  const value = source[name];\n  return value && value.trim().length > 0 ? value : undefined;\n}\n\n// getSettings runs per request in some processes; say this once per process.\nlet idleCommandContainmentDisabledWarned = false;\n\nexport function getSettings(source: NodeJS.ProcessEnv = process.env): Settings {\n  const optional = (name: string): string | undefined => optionalEnvironmentValue(name, source);\n  const modelCatalogSource = optional(\"OPENGENI_MODEL_CATALOG_SOURCE\");\n  const modelCostPolicyJson =\n    optional(\"OPENGENI_MODEL_COST_POLICY_JSON\") ??\n    (modelCatalogSource === \"database\" ? \"{}\" : DEFAULT_MODEL_COST_POLICY_JSON);\n  const raw = {\n    serviceName: optional(\"OPENGENI_SERVICE_NAME\"),\n    environment: optional(\"OPENGENI_ENVIRONMENT\"),\n    deploymentRevision:\n      optional(\"OPENGENI_DEPLOYMENT_REVISION\") ??\n      optional(\"SOURCE_VERSION\") ??\n      optional(\"GITHUB_SHA\"),\n    serverVersion: optional(\"OPENGENI_SERVER_VERSION\"),\n    databaseUrl: optional(\"OPENGENI_DATABASE_URL\"),\n    databaseNotificationUrl: optional(\"OPENGENI_DATABASE_NOTIFICATION_URL\"),\n    apiDatabasePoolMax: optional(\"OPENGENI_API_DATABASE_POOL_MAX\"),\n    databasePreparedStatements: optional(\"OPENGENI_DATABASE_PREPARED_STATEMENTS\"),\n    dbSchema: optional(\"OPENGENI_DB_SCHEMA\"),\n    rlsStrategy: optional(\"OPENGENI_RLS_STRATEGY\"),\n    runtimeDatabaseRole: optional(\"OPENGENI_RUNTIME_DATABASE_ROLE\"),\n    natsUrl: optional(\"OPENGENI_NATS_URL\"),\n    temporalHost: optional(\"OPENGENI_TEMPORAL_HOST\"),\n    temporalNamespace: optional(\"OPENGENI_TEMPORAL_NAMESPACE\"),\n    temporalTaskQueue: optional(\"OPENGENI_TEMPORAL_TASK_QUEUE\"),\n    temporalTlsEnabled: optional(\"OPENGENI_TEMPORAL_TLS_ENABLED\"),\n    temporalApiKey: optional(\"OPENGENI_TEMPORAL_API_KEY\"),\n    temporalTlsServerName: optional(\"OPENGENI_TEMPORAL_TLS_SERVER_NAME\"),\n    temporalTlsRootCaCertificateBase64: optional(\n      \"OPENGENI_TEMPORAL_TLS_ROOT_CA_CERTIFICATE_BASE64\",\n    ),\n    temporalTlsClientCertificateBase64: optional(\"OPENGENI_TEMPORAL_TLS_CLIENT_CERTIFICATE_BASE64\"),\n    temporalTlsClientPrivateKeyBase64: optional(\"OPENGENI_TEMPORAL_TLS_CLIENT_PRIVATE_KEY_BASE64\"),\n    startupDependencyRetryAttempts: optional(\"OPENGENI_STARTUP_DEPENDENCY_RETRY_ATTEMPTS\"),\n    startupDependencyRetryInitialDelayMs: optional(\n      \"OPENGENI_STARTUP_DEPENDENCY_RETRY_INITIAL_DELAY_MS\",\n    ),\n    startupDependencyRetryMaxDelayMs: optional(\"OPENGENI_STARTUP_DEPENDENCY_RETRY_MAX_DELAY_MS\"),\n    turnWorkerConcurrencyMode: optional(\"OPENGENI_TURN_WORKER_CONCURRENCY_MODE\"),\n    turnWorkerMaxConcurrentTurns: optional(\"OPENGENI_TURN_WORKER_MAX_CONCURRENT_TURNS\"),\n    turnWorkerTargetCpuUsage: optional(\"OPENGENI_TURN_WORKER_TARGET_CPU_USAGE\"),\n    turnWorkerTargetMemoryUsage: optional(\"OPENGENI_TURN_WORKER_TARGET_MEMORY_USAGE\"),\n    turnWorkerEmergencyMemoryUsage: optional(\"OPENGENI_TURN_WORKER_EMERGENCY_MEMORY_USAGE\"),\n    turnWorkerMemoryGuardIntervalMs: optional(\"OPENGENI_TURN_WORKER_MEMORY_GUARD_INTERVAL_MS\"),\n    turnWorkerMemoryGuardSustainMs: optional(\"OPENGENI_TURN_WORKER_MEMORY_GUARD_SUSTAIN_MS\"),\n    observabilityStructuredLogs: optional(\"OPENGENI_OBSERVABILITY_STRUCTURED_LOGS\"),\n    observabilityMetricsEnabled: optional(\"OPENGENI_OBSERVABILITY_METRICS_ENABLED\"),\n    observabilityOtlpEndpoint:\n      optional(\"OPENGENI_OTEL_EXPORTER_OTLP_ENDPOINT\") ?? optional(\"OTEL_EXPORTER_OTLP_ENDPOINT\"),\n    observabilityOtlpHeaders:\n      optional(\"OPENGENI_OTEL_EXPORTER_OTLP_HEADERS\") ?? optional(\"OTEL_EXPORTER_OTLP_HEADERS\"),\n    observabilityDiagnosticsEndpoint: optional(\"OPENGENI_OBSERVABILITY_DIAGNOSTICS_ENDPOINT\"),\n    observabilityDiagnosticsHeaders: optional(\"OPENGENI_OBSERVABILITY_DIAGNOSTICS_HEADERS\"),\n    analyticsEnabled: optional(\"OPENGENI_ANALYTICS_ENABLED\"),\n    analyticsConsentRequired: optional(\"OPENGENI_ANALYTICS_CONSENT_REQUIRED\"),\n    analyticsReoClientId: optional(\"OPENGENI_ANALYTICS_REO_CLIENT_ID\"),\n    analyticsPosthogProjectKey: optional(\"OPENGENI_ANALYTICS_POSTHOG_PROJECT_KEY\"),\n    analyticsPosthogHost: optional(\"OPENGENI_ANALYTICS_POSTHOG_HOST\"),\n    analyticsGa4MeasurementId: optional(\"OPENGENI_ANALYTICS_GA4_MEASUREMENT_ID\"),\n    legalPrivacyPolicyUrl: optional(\"OPENGENI_LEGAL_PRIVACY_POLICY_URL\"),\n    legalTermsOfServiceUrl: optional(\"OPENGENI_LEGAL_TERMS_OF_SERVICE_URL\"),\n    supportEmail: optional(\"OPENGENI_SUPPORT_EMAIL\"),\n    publicBaseUrl: optional(\"OPENGENI_PUBLIC_BASE_URL\"),\n    documentationUrl: optional(\"OPENGENI_DOCUMENTATION_URL\"),\n    mcpOauthEnabled: optional(\"OPENGENI_MCP_OAUTH_ENABLED\"),\n    apiTrustedProxyHops: optional(\"OPENGENI_API_TRUSTED_PROXY_HOPS\"),\n    apiTrustedProxyCidrs: optional(\"OPENGENI_API_TRUSTED_PROXY_CIDRS\"),\n    webBaseUrl: optional(\"OPENGENI_WEB_BASE_URL\"),\n    officeAddinName: optional(\"OPENGENI_OFFICE_ADDIN_NAME\"),\n    officeAddinInstallUrl: optional(\"OPENGENI_OFFICE_ADDIN_INSTALL_URL\"),\n    agentReleasesBaseUrl: optional(\"OPENGENI_AGENT_RELEASES_BASE_URL\"),\n    agentStableVersion: optional(\"OPENGENI_AGENT_STABLE_VERSION\"),\n    agentBetaVersion: optional(\"OPENGENI_AGENT_BETA_VERSION\"),\n    desktopStableVersion: optional(\"OPENGENI_DESKTOP_STABLE_VERSION\"),\n    agentAutoUpdate: optional(\"OPENGENI_AGENT_AUTO_UPDATE\"),\n    productAccessMode: optional(\"OPENGENI_PRODUCT_ACCESS_MODE\"),\n    billingMode: optional(\"OPENGENI_BILLING_MODE\"),\n    verifiedSignupTrialCreditsEnabled: optional(\"OPENGENI_VERIFIED_SIGNUP_TRIAL_CREDITS_ENABLED\"),\n    creditPromotionPolicy: optional(\"OPENGENI_CREDIT_PROMOTION_POLICY_JSON\"),\n    entitlementsMode: optional(\"OPENGENI_ENTITLEMENTS_MODE\"),\n    usageLimitsMode: optional(\"OPENGENI_USAGE_LIMITS_MODE\"),\n    usageAllowancesEnabled: optional(\"OPENGENI_USAGE_ALLOWANCES_ENABLED\"),\n    staticEntitlementsJson: optional(\"OPENGENI_STATIC_ENTITLEMENTS_JSON\"),\n    staticUsageLimitsJson: optional(\"OPENGENI_STATIC_USAGE_LIMITS_JSON\"),\n    delegationSecret: optional(\"OPENGENI_DELEGATION_SECRET\"),\n    defaultFirstPartyMcpTools: optional(\"OPENGENI_DEFAULT_FIRST_PARTY_MCP_TOOLS\"),\n    allowedFirstPartyMcpTools: optional(\"OPENGENI_ALLOWED_FIRST_PARTY_MCP_TOOLS\"),\n    artifactMaterializerDeployed: optional(\"OPENGENI_ARTIFACT_MATERIALIZER_DEPLOYED\"),\n    streamTokenSecret: optional(\"OPENGENI_STREAM_TOKEN_SECRET\"),\n    streamControlEnabled: optional(\"OPENGENI_STREAM_CONTROL_ENABLED\"),\n    workDiscoveryEnabled: optional(\"OPENGENI_WORK_DISCOVERY_ENABLED\"),\n    workClaimMutationsEnabled: optional(\"OPENGENI_WORK_CLAIM_MUTATIONS_ENABLED\"),\n    workDiscoveryHumanAdvisoriesEnabled: optional(\n      \"OPENGENI_WORK_DISCOVERY_HUMAN_ADVISORIES_ENABLED\",\n    ),\n    workDiscoveryAutomaticNudgesEnabled: optional(\n      \"OPENGENI_WORK_DISCOVERY_AUTOMATIC_NUDGES_ENABLED\",\n    ),\n    ogtoolPackageSpec: optional(\"OPENGENI_OGTOOL_PACKAGE_SPEC\"),\n    environmentsEncryptionKey: optional(\"OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY\"),\n    onePasswordFakeTokens: optional(\"OPENGENI_ONEPASSWORD_FAKE_TOKENS\"),\n    protonPassCliPath: optional(\"OPENGENI_PROTON_PASS_CLI_PATH\"),\n    integrationsEnabled: optional(\"OPENGENI_INTEGRATIONS_ENABLED\"),\n    integrationsStateSecret: optional(\"OPENGENI_INTEGRATIONS_STATE_SECRET\"),\n    integrationsAllowPrivateNetworkTargets: optional(\n      \"OPENGENI_INTEGRATIONS_ALLOW_PRIVATE_NETWORK_TARGETS\",\n    ),\n    privacyOnlyMeAllowed: optional(\"OPENGENI_PRIVACY_ONLY_ME_ALLOWED\"),\n    privacyWorkspaceDefaultRequired: optional(\"OPENGENI_PRIVACY_WORKSPACE_DEFAULT_REQUIRED\"),\n    privacyAdminScheduleSummariesRequired: optional(\n      \"OPENGENI_PRIVACY_ADMIN_SCHEDULE_SUMMARIES_REQUIRED\",\n    ),\n    integrationsOauthClientsJson: optional(\"OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON\"),\n    gmailWatchTopicName: optional(\"OPENGENI_GMAIL_WATCH_TOPIC_NAME\"),\n    slackClientId: optional(\"OPENGENI_SLACK_CLIENT_ID\"),\n    slackClientSecret: optional(\"OPENGENI_SLACK_CLIENT_SECRET\"),\n    slackSigningSecret: optional(\"OPENGENI_SLACK_SIGNING_SECRET\"),\n    slackAccessMode: optional(\"OPENGENI_SLACK_ACCESS_MODE\"),\n    slackBotDisplayName: optional(\"OPENGENI_SLACK_BOT_DISPLAY_NAME\"),\n    slackCommand: optional(\"OPENGENI_SLACK_COMMAND\"),\n    googleDriveClientId: optional(\"OPENGENI_GOOGLE_DRIVE_CLIENT_ID\"),\n    googleDriveClientSecret: optional(\"OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET\"),\n    googleDriveSyncMaxItems: optional(\"OPENGENI_GOOGLE_DRIVE_SYNC_MAX_ITEMS\"),\n    googleDriveSyncMaxBytes: optional(\"OPENGENI_GOOGLE_DRIVE_SYNC_MAX_BYTES\"),\n    googleDriveSyncMaxFileBytes: optional(\"OPENGENI_GOOGLE_DRIVE_SYNC_MAX_FILE_BYTES\"),\n    googleDriveSyncMaxProviderRequests: optional(\n      \"OPENGENI_GOOGLE_DRIVE_SYNC_MAX_PROVIDER_REQUESTS\",\n    ),\n    googleDriveSyncMaxElapsedSeconds: optional(\"OPENGENI_GOOGLE_DRIVE_SYNC_MAX_ELAPSED_SECONDS\"),\n    googleDriveSyncMaxFailureDetails: optional(\"OPENGENI_GOOGLE_DRIVE_SYNC_MAX_FAILURE_DETAILS\"),\n    googleDriveProviderRequestTimeoutMs: optional(\n      \"OPENGENI_GOOGLE_DRIVE_PROVIDER_REQUEST_TIMEOUT_MS\",\n    ),\n    googleDriveProviderRetryAttempts: optional(\"OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_ATTEMPTS\"),\n    googleDriveProviderRetryInitialDelayMs: optional(\n      \"OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_INITIAL_DELAY_MS\",\n    ),\n    googleDriveProviderRetryMaxDelayMs: optional(\n      \"OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_MAX_DELAY_MS\",\n    ),\n    googleDriveProviderRetryBudgetMs: optional(\"OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_BUDGET_MS\"),\n    fikenClientId: optional(\"OPENGENI_FIKEN_OAUTH_CLIENT_ID\"),\n    fikenClientSecret: optional(\"OPENGENI_FIKEN_OAUTH_CLIENT_SECRET\"),\n    googleDriveWorkspaceEventsEnabled: optional(\"OPENGENI_GOOGLE_DRIVE_WORKSPACE_EVENTS_ENABLED\"),\n    atlassianClientId: optional(\"OPENGENI_ATLASSIAN_CLIENT_ID\"),\n    atlassianClientSecret: optional(\"OPENGENI_ATLASSIAN_CLIENT_SECRET\"),\n    maxNestedAgentDepth: optional(\"OPENGENI_MAX_NESTED_AGENT_DEPTH\"),\n    socialOauthClientsJson: optional(\"OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON\"),\n    goalMaxAutoContinuations: optional(\"OPENGENI_GOAL_MAX_AUTO_CONTINUATIONS\"),\n    goalIdleBackoffMs: optional(\"OPENGENI_GOAL_IDLE_BACKOFF_MS\"),\n    goalIdleBackoffMaxMs: optional(\"OPENGENI_GOAL_IDLE_BACKOFF_MAX_MS\"),\n    childLifecycleNoticesEnabled: optional(\"OPENGENI_CHILD_LIFECYCLE_NOTICES_ENABLED\"),\n    sessionUsageLimitsEnabled: optional(\"OPENGENI_SESSION_USAGE_LIMITS_ENABLED\"),\n    slackWorkspaceRoutingEnabled: optional(\"OPENGENI_SLACK_WORKSPACE_ROUTING_ENABLED\"),\n    agentMaxModelCallsPerTurn: optional(\"OPENGENI_AGENT_MAX_MODEL_CALLS_PER_TURN\"),\n    contextWindowTokens: optional(\"OPENGENI_CONTEXT_WINDOW_TOKENS\"),\n    contextEffectiveWindowTokens: optional(\"OPENGENI_CONTEXT_EFFECTIVE_WINDOW_TOKENS\"),\n    contextCompactionThresholdRatio: optional(\"OPENGENI_COMPACTION_THRESHOLD_RATIO\"),\n    contextReservedOutputTokens: optional(\"OPENGENI_CONTEXT_RESERVED_OUTPUT_TOKENS\"),\n    contextAutoCompactThresholdTokens: optional(\"OPENGENI_CONTEXT_AUTO_COMPACT_THRESHOLD_TOKENS\"),\n    modelToolOutputTruncationTokens: optional(\"OPENGENI_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS\"),\n    authRequired: optional(\"OPENGENI_AUTH_REQUIRED\"),\n    accessKey: optional(\"OPENGENI_ACCESS_KEY\"),\n    authAllowHealth: optional(\"OPENGENI_AUTH_ALLOW_HEALTH\"),\n    authAllowMetrics: optional(\"OPENGENI_AUTH_ALLOW_METRICS\"),\n    apiHost: optional(\"OPENGENI_API_HOST\"),\n    apiPort: optional(\"OPENGENI_API_PORT\"),\n    apiMetricsPort: optional(\"OPENGENI_API_METRICS_PORT\"),\n    workerHttpPort: optional(\"OPENGENI_WORKER_HTTP_PORT\"),\n    opengeniMcpInternalUrl: optional(\"OPENGENI_MCP_INTERNAL_URL\"),\n    opengeniMcpUrl: optional(\"OPENGENI_MCP_URL\"),\n    corsAllowOriginRegex: optional(\"OPENGENI_CORS_ALLOW_ORIGIN_REGEX\"),\n    localAllowedOrigins: optional(\"OPENGENI_LOCAL_ALLOWED_ORIGINS\"),\n    openaiProvider: optional(\"OPENGENI_OPENAI_PROVIDER\"),\n    openaiApiKey: optional(\"OPENGENI_OPENAI_API_KEY\") ?? optional(\"OPENAI_API_KEY\"),\n    openaiBaseUrl: optional(\"OPENGENI_OPENAI_BASE_URL\") ?? optional(\"OPENAI_BASE_URL\"),\n    openaiModel: optional(\"OPENGENI_OPENAI_MODEL\"),\n    openaiAllowedModels: optional(\"OPENGENI_OPENAI_ALLOWED_MODELS\"),\n    vercelAiGatewayApiKey: optional(\"OPENGENI_VERCEL_AI_GATEWAY_API_KEY\"),\n    imageGenerationModel: optional(\"OPENGENI_IMAGE_GENERATION_MODEL\"),\n    videoGenerationPollIntervalMs: optional(\"OPENGENI_VIDEO_GENERATION_POLL_INTERVAL_MS\"),\n    videoGenerationRecoveryDeadlineMs: optional(\"OPENGENI_VIDEO_GENERATION_RECOVERY_DEADLINE_MS\"),\n    videoGenerationReferenceUrlTtlSeconds: optional(\n      \"OPENGENI_VIDEO_GENERATION_REFERENCE_URL_TTL_SECONDS\",\n    ),\n    videoGenerationMaxConcurrentPerWorkspace: optional(\n      \"OPENGENI_VIDEO_GENERATION_MAX_CONCURRENT_PER_WORKSPACE\",\n    ),\n    videoGenerationWorkspaceQuotaBytes: optional(\"OPENGENI_VIDEO_GENERATION_WORKSPACE_QUOTA_BYTES\"),\n    retainedImageWorkspaceQuotaBytes: optional(\"OPENGENI_RETAINED_IMAGE_WORKSPACE_QUOTA_BYTES\"),\n    retainedImageWorkspaceQuotaOverrides: optional(\n      \"OPENGENI_RETAINED_IMAGE_WORKSPACE_QUOTA_OVERRIDES\",\n    ),\n    videoGenerationTempDirectory: optional(\"OPENGENI_VIDEO_GENERATION_TEMP_DIRECTORY\"),\n    videoGenerationFfprobePath: optional(\"OPENGENI_VIDEO_GENERATION_FFPROBE_PATH\"),\n    videoGenerationCredit480pMicrosPerSecond: optional(\n      \"OPENGENI_VIDEO_GENERATION_CREDIT_480P_MICROS_PER_SECOND\",\n    ),\n    videoGenerationCredit720pMicrosPerSecond: optional(\n      \"OPENGENI_VIDEO_GENERATION_CREDIT_720P_MICROS_PER_SECOND\",\n    ),\n    voiceInputMaxDurationSeconds: optional(\"OPENGENI_VOICE_INPUT_MAX_DURATION_SECONDS\"),\n    voiceInputMaxSizeBytes: optional(\"OPENGENI_VOICE_INPUT_MAX_SIZE_BYTES\"),\n    voiceInputResumableEnabled: optional(\"OPENGENI_VOICE_INPUT_RESUMABLE_ENABLED\"),\n    voiceInputResumableMaxDurationSeconds: optional(\n      \"OPENGENI_VOICE_INPUT_RESUMABLE_MAX_DURATION_SECONDS\",\n    ),\n    voiceInputResumableMaxSizeBytes: optional(\"OPENGENI_VOICE_INPUT_RESUMABLE_MAX_SIZE_BYTES\"),\n    voiceInputResumableMaxChunkSizeBytes: optional(\n      \"OPENGENI_VOICE_INPUT_RESUMABLE_MAX_CHUNK_SIZE_BYTES\",\n    ),\n    sessionArchiveEnabled: optional(\"OPENGENI_SESSION_ARCHIVE_ENABLED\"),\n    sessionArchiveIdleDays: optional(\"OPENGENI_SESSION_ARCHIVE_IDLE_DAYS\"),\n    voiceInputResumableRetentionSeconds: optional(\n      \"OPENGENI_VOICE_INPUT_RESUMABLE_RETENTION_SECONDS\",\n    ),\n    voiceInputFfmpegPath: optional(\"OPENGENI_VOICE_INPUT_FFMPEG_PATH\"),\n    voiceInputProviderOrder: optional(\"OPENGENI_VOICE_INPUT_PROVIDER_ORDER\"),\n    voiceInputOpenaiEnabled: optional(\"OPENGENI_VOICE_INPUT_OPENAI_ENABLED\"),\n    voiceInputOpenaiApiKey: optional(\"OPENGENI_VOICE_INPUT_OPENAI_API_KEY\"),\n    voiceInputOpenaiBaseUrl: optional(\"OPENGENI_VOICE_INPUT_OPENAI_BASE_URL\"),\n    voiceInputOpenaiModel: optional(\"OPENGENI_VOICE_INPUT_OPENAI_MODEL\"),\n    voiceInputAzureEnabled: optional(\"OPENGENI_VOICE_INPUT_AZURE_ENABLED\"),\n    voiceInputAzureEndpoint: optional(\"OPENGENI_VOICE_INPUT_AZURE_ENDPOINT\"),\n    voiceInputAzureDeployment: optional(\"OPENGENI_VOICE_INPUT_AZURE_DEPLOYMENT\"),\n    voiceInputAzureApiVersion: optional(\"OPENGENI_VOICE_INPUT_AZURE_API_VERSION\"),\n    voiceInputAzureApiKey: optional(\"OPENGENI_VOICE_INPUT_AZURE_API_KEY\"),\n    voiceInputAzureAdToken: optional(\"OPENGENI_VOICE_INPUT_AZURE_AD_TOKEN\"),\n    azureLiveEndpoint: optional(\"OPENGENI_AZURE_LIVE_ENDPOINT\"),\n    azureLiveApiKey: optional(\"OPENGENI_AZURE_LIVE_API_KEY\"),\n    azureLiveDeployment: optional(\"OPENGENI_AZURE_LIVE_DEPLOYMENT\"),\n    azureLiveVoice: optional(\"OPENGENI_AZURE_LIVE_VOICE\"),\n    azureLivePricingJson: optional(\"OPENGENI_AZURE_LIVE_PRICING_JSON\"),\n    aiGatewayRealtimePricingJson: optional(\"OPENGENI_AI_GATEWAY_REALTIME_PRICING_JSON\"),\n    voiceInputMaiEndpoint: optional(\"OPENGENI_VOICE_INPUT_MAI_ENDPOINT\"),\n    voiceInputMaiApiKey: optional(\"OPENGENI_VOICE_INPUT_MAI_API_KEY\"),\n    voiceInputMaiApiVersion: optional(\"OPENGENI_VOICE_INPUT_MAI_API_VERSION\"),\n    voiceInputMaiPricingJson: optional(\"OPENGENI_VOICE_INPUT_MAI_PRICING_JSON\"),\n    voiceInputMaiModel: optional(\"OPENGENI_VOICE_INPUT_MAI_MODEL\"),\n    voiceInputAzureModel: optional(\"OPENGENI_VOICE_INPUT_AZURE_MODEL\"),\n    voiceInputOpenaiPricingJson: optional(\"OPENGENI_VOICE_INPUT_OPENAI_PRICING_JSON\"),\n    voiceInputAzurePricingJson: optional(\"OPENGENI_VOICE_INPUT_AZURE_PRICING_JSON\"),\n    voiceInputCodexExperimentalEnabled: optional(\"OPENGENI_VOICE_INPUT_CODEX_EXPERIMENTAL\"),\n    creditMarginBpsOverride: optional(\"OPENGENI_CREDIT_MARGIN_BPS_OVERRIDE\"),\n    modelPricingJson: optional(\"OPENGENI_MODEL_PRICING_JSON\"),\n    modelCatalogSource,\n    modelCostPolicyJson,\n    modelNotesJson: optional(\"OPENGENI_MODEL_NOTES_JSON\"),\n    openrouterApiKey: optional(\"OPENGENI_OPENROUTER_API_KEY\"),\n    opperApiKey: optional(\"OPENGENI_OPPER_API_KEY\"),\n    managedModelsJson: optional(\"OPENGENI_MANAGED_MODELS_JSON\"),\n    modelProvidersJson: optional(\"OPENGENI_MODEL_PROVIDERS_JSON\"),\n    codexSubscriptionEnabled: optional(\"OPENGENI_CODEX_SUBSCRIPTION_ENABLED\"),\n    experimentSystemPromptCacheSplit: optional(\"OPENGENI_EXPERIMENT_SYSTEM_PROMPT_CACHE_SPLIT\"),\n    experimentCutPolling: optional(\"OPENGENI_EXPERIMENT_CUT_POLLING\"),\n    experimentOutputCost: optional(\"OPENGENI_EXPERIMENT_OUTPUT_COST\"),\n    supergrokSubscriptionEnabled: optional(\"OPENGENI_SUPERGROK_SUBSCRIPTION_ENABLED\"),\n    claudeSubscriptionEnabled: optional(\"OPENGENI_CLAUDE_SUBSCRIPTION_ENABLED\"),\n    supergrokResponseStreamIdleTimeoutMs: optional(\n      \"OPENGENI_SUPERGROK_RESPONSE_STREAM_IDLE_TIMEOUT_MS\",\n    ),\n    modelStreamIdleTimeoutMs: optional(\"OPENGENI_MODEL_STREAM_IDLE_TIMEOUT_MS\"),\n    modelStreamProgressTimeoutMs: optional(\"OPENGENI_MODEL_STREAM_PROGRESS_TIMEOUT_MS\"),\n    codexConnectedAppsEnabled: optional(\"OPENGENI_CODEX_CONNECTED_APPS_ENABLED\"),\n    codexToolSearchEnabled: optional(\"OPENGENI_CODEX_TOOL_SEARCH_ENABLED\"),\n    codexResponsesWebSocketEnabled: optional(\"OPENGENI_CODEX_RESPONSES_WEBSOCKET_ENABLED\"),\n    openaiResponsesWebSocketEnabled: optional(\"OPENGENI_OPENAI_RESPONSES_WEBSOCKET_ENABLED\"),\n    lazyToolSearchEnabled: optional(\"OPENGENI_LAZY_TOOL_SEARCH_ENABLED\"),\n    decisionModelProvider: optional(\"OPENGENI_DECISION_MODEL_PROVIDER\"),\n    decisionModelId: optional(\"OPENGENI_DECISION_MODEL_ID\"),\n    decisionModelApiKey: optional(\"OPENGENI_DECISION_MODEL_API_KEY\"),\n    decisionModelBaseUrl: optional(\"OPENGENI_DECISION_MODEL_BASE_URL\"),\n    codexFleetPolicyShadowEnabled: optional(\"OPENGENI_CODEX_FLEET_POLICY_SHADOW_ENABLED\"),\n    subscriptionCoreShadowEnabled: optional(\"OPENGENI_SUBSCRIPTION_CORE_SHADOW_ENABLED\"),\n    subscriptionCrossProviderFailoverEnabled: optional(\n      \"OPENGENI_SUBSCRIPTION_CROSS_PROVIDER_FAILOVER_ENABLED\",\n    ),\n    subscriptionCoreShadowTimeoutMs: optional(\"OPENGENI_SUBSCRIPTION_CORE_SHADOW_TIMEOUT_MS\"),\n    codexProductSku: optional(\"OPENGENI_CODEX_PRODUCT_SKU\"),\n    reasoningConfigurationUpdatesEnabled: optional(\n      \"OPENGENI_REASONING_CONFIGURATION_UPDATES_ENABLED\",\n    ),\n    openaiReasoningEffort: optional(\"OPENGENI_OPENAI_REASONING_EFFORT\"),\n    openaiAllowedReasoningEfforts: optional(\"OPENGENI_OPENAI_ALLOWED_REASONING_EFFORTS\"),\n    creditsDefaultModel: optional(\"OPENGENI_CREDITS_DEFAULT_MODEL\"),\n    creditsDefaultReasoningEffort: optional(\"OPENGENI_CREDITS_DEFAULT_REASONING_EFFORT\"),\n    openaiResponsesTransport: optional(\"OPENGENI_OPENAI_RESPONSES_TRANSPORT\"),\n    openaiProviderItemIds: optional(\"OPENGENI_OPENAI_PROVIDER_ITEM_IDS\"),\n    openaiReasoningEncryptedContent: optional(\"OPENGENI_OPENAI_REASONING_ENCRYPTED_CONTENT\"),\n    openaiMaxRetries: optional(\"OPENGENI_OPENAI_MAX_RETRIES\"),\n    webSearchEnabled: optional(\"OPENGENI_WEB_SEARCH_ENABLED\"),\n    webSearchProvider: optional(\"OPENGENI_WEB_SEARCH_PROVIDER\"),\n    webSearchPrefer: optional(\"OPENGENI_WEB_SEARCH_PREFER\"),\n    webSearchProviderCredentials: webSearchProviderCredentialsFromEnv(source),\n    webSearchApiKey: optional(\"OPENGENI_WEB_SEARCH_API_KEY\"),\n    webSearchBaseUrl: optional(\"OPENGENI_WEB_SEARCH_BASE_URL\"),\n    webFetchProvider: optional(\"OPENGENI_WEB_FETCH_PROVIDER\"),\n    webFetchApiKey: optional(\"OPENGENI_WEB_FETCH_API_KEY\"),\n    webFetchBaseUrl: optional(\"OPENGENI_WEB_FETCH_BASE_URL\"),\n    webSearchProviderMode: optional(\"OPENGENI_WEB_SEARCH_PROVIDER_MODE\"),\n    webSearchPricingJson: optional(\"OPENGENI_WEB_SEARCH_PRICING_JSON\"),\n    webSearchRequestTimeoutMs: optional(\"OPENGENI_WEB_SEARCH_REQUEST_TIMEOUT_MS\"),\n    jevApiKey: optional(\"OPENGENI_JEV_API_KEY\"),\n    jevBaseUrl: optional(\"OPENGENI_JEV_BASE_URL\"),\n    jevModel: optional(\"OPENGENI_JEV_MODEL\"),\n    jevRequestTimeoutMs: optional(\"OPENGENI_JEV_REQUEST_TIMEOUT_MS\"),\n    codeSearchMode: optional(\"OPENGENI_CODE_SEARCH_MODE\"),\n    agentInstructionsTemplate: optional(\"OPENGENI_AGENT_INSTRUCTIONS_TEMPLATE\"),\n    deploymentAgentInstructions: optional(\"OPENGENI_DEPLOYMENT_AGENT_INSTRUCTIONS\"),\n    experimentKnowledgeRetrievalGuidance: optional(\n      \"OPENGENI_EXPERIMENT_KNOWLEDGE_RETRIEVAL_GUIDANCE\",\n    ),\n    azureOpenaiBaseUrl: optional(\"OPENGENI_AZURE_OPENAI_BASE_URL\"),\n    azureOpenaiEndpoint: optional(\"OPENGENI_AZURE_OPENAI_ENDPOINT\"),\n    azureOpenaiDeployment: optional(\"OPENGENI_AZURE_OPENAI_DEPLOYMENT\"),\n    azureOpenaiApiVersion: optional(\"OPENGENI_AZURE_OPENAI_API_VERSION\"),\n    azureOpenaiApiKey: optional(\"OPENGENI_AZURE_OPENAI_API_KEY\"),\n    azureOpenaiAdToken: optional(\"OPENGENI_AZURE_OPENAI_AD_TOKEN\"),\n    disableOpenaiTracing: optional(\"OPENGENI_DISABLE_OPENAI_TRACING\"),\n    sandboxBackend: optional(\"OPENGENI_SANDBOX_BACKEND\"),\n    dockerImage: optional(\"OPENGENI_DOCKER_IMAGE\"),\n    sandboxArtifactRuntimeEnabled: optional(\"OPENGENI_SANDBOX_ARTIFACT_RUNTIME_ENABLED\"),\n    dockerExposedPorts: optional(\"OPENGENI_DOCKER_EXPOSED_PORTS\"),\n    dockerNetwork: optional(\"OPENGENI_DOCKER_NETWORK\"),\n    dockerWorkspaceBaseDir: optional(\"OPENGENI_DOCKER_WORKSPACE_BASE_DIR\"),\n    modalAppName: optional(\"OPENGENI_MODAL_APP_NAME\"),\n    modalImageRef: optional(\"OPENGENI_MODAL_IMAGE_REF\") ?? DEFAULT_MODAL_IMAGE_REF,\n    modalCommandSupervisionEnabled: optional(\"OPENGENI_MODAL_COMMAND_SUPERVISION_ENABLED\"),\n    modalImageId: optional(\"OPENGENI_MODAL_IMAGE_ID\"),\n    modalImageRegistrySecret: optional(\"OPENGENI_MODAL_IMAGE_REGISTRY_SECRET\"),\n    modalTimeoutSeconds: optional(\"OPENGENI_MODAL_TIMEOUT_SECONDS\"),\n    modalSandboxCpu: optional(\"OPENGENI_MODAL_SANDBOX_CPU\"),\n    modalSandboxMemoryMiB: optional(\"OPENGENI_MODAL_SANDBOX_MEMORY_MIB\"),\n    modalRegions: optional(\"OPENGENI_MODAL_REGIONS\"),\n    modalTokenId: optional(\"OPENGENI_MODAL_TOKEN_ID\"),\n    modalTokenSecret: optional(\"OPENGENI_MODAL_TOKEN_SECRET\"),\n    modalEnvironment: optional(\"OPENGENI_MODAL_ENVIRONMENT\"),\n    modalIdleTimeoutSeconds: optional(\"OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS\"),\n    modalWorkspacePersistence: optional(\"OPENGENI_MODAL_WORKSPACE_PERSISTENCE\"),\n    sandboxDesktopEnabled: optional(\"OPENGENI_SANDBOX_DESKTOP_ENABLED\"),\n    sandboxDesktopInteractive: optional(\"OPENGENI_SANDBOX_DESKTOP_INTERACTIVE\"),\n    sandboxTerminalEnabled: optional(\"OPENGENI_SANDBOX_TERMINAL_ENABLED\"),\n    streamResolutionWidth: optional(\"OPENGENI_STREAM_RESOLUTION_WIDTH\"),\n    streamResolutionHeight: optional(\"OPENGENI_STREAM_RESOLUTION_HEIGHT\"),\n    recordingEnabled: optional(\"OPENGENI_RECORDING_ENABLED\"),\n    workspaceCaptureEnabled: optional(\"OPENGENI_WORKSPACE_CAPTURE\"),\n    recordingDefaultCodec: optional(\"OPENGENI_RECORDING_DEFAULT_CODEC\"),\n    recordingFramerate: optional(\"OPENGENI_RECORDING_FRAMERATE\"),\n    recordingMaxSeconds: optional(\"OPENGENI_RECORDING_MAX_SECONDS\"),\n    recordingMaxBytes: optional(\"OPENGENI_RECORDING_MAX_BYTES\"),\n    daytonaApiKey: optional(\"OPENGENI_DAYTONA_API_KEY\"),\n    daytonaApiUrl: optional(\"OPENGENI_DAYTONA_API_URL\"),\n    daytonaTarget: optional(\"OPENGENI_DAYTONA_TARGET\"),\n    daytonaImage: optional(\"OPENGENI_DAYTONA_IMAGE\"),\n    daytonaSnapshotName: optional(\"OPENGENI_DAYTONA_SNAPSHOT_NAME\"),\n    daytonaAutoStopInterval: optional(\"OPENGENI_DAYTONA_AUTO_STOP_INTERVAL\"),\n    daytonaTimeoutSeconds: optional(\"OPENGENI_DAYTONA_TIMEOUT_SECONDS\"),\n    daytonaExposedPortUrlTtlSeconds: optional(\"OPENGENI_DAYTONA_EXPOSED_PORT_URL_TTL_SECONDS\"),\n    runloopApiKey: optional(\"OPENGENI_RUNLOOP_API_KEY\"),\n    runloopBaseUrl: optional(\"OPENGENI_RUNLOOP_BASE_URL\"),\n    runloopBlueprintName: optional(\"OPENGENI_RUNLOOP_BLUEPRINT_NAME\"),\n    runloopBlueprintId: optional(\"OPENGENI_RUNLOOP_BLUEPRINT_ID\"),\n    runloopTunnel: optional(\"OPENGENI_RUNLOOP_TUNNEL\"),\n    runloopKeepAliveSeconds: optional(\"OPENGENI_RUNLOOP_KEEP_ALIVE_SECONDS\"),\n    e2bApiKey: optional(\"OPENGENI_E2B_API_KEY\"),\n    e2bDomain: optional(\"OPENGENI_E2B_DOMAIN\"),\n    e2bApiUrl: optional(\"OPENGENI_E2B_API_URL\"),\n    e2bSandboxUrl: optional(\"OPENGENI_E2B_SANDBOX_URL\"),\n    e2bTemplate: optional(\"OPENGENI_E2B_TEMPLATE\"),\n    e2bTimeoutSeconds: optional(\"OPENGENI_E2B_TIMEOUT_SECONDS\"),\n    e2bTimeoutAction: optional(\"OPENGENI_E2B_TIMEOUT_ACTION\"),\n    e2bAllowInternetAccess: optional(\"OPENGENI_E2B_ALLOW_INTERNET_ACCESS\"),\n    e2bAutoResume: optional(\"OPENGENI_E2B_AUTO_RESUME\"),\n    e2bWorkspacePersistence: optional(\"OPENGENI_E2B_WORKSPACE_PERSISTENCE\"),\n    blaxelApiKey: optional(\"OPENGENI_BLAXEL_API_KEY\"),\n    blaxelImage: optional(\"OPENGENI_BLAXEL_IMAGE\"),\n    blaxelRegion: optional(\"OPENGENI_BLAXEL_REGION\"),\n    blaxelExposedPortPublic: optional(\"OPENGENI_BLAXEL_EXPOSED_PORT_PUBLIC\"),\n    blaxelExposedPortUrlTtlSeconds: optional(\"OPENGENI_BLAXEL_EXPOSED_PORT_URL_TTL_SECONDS\"),\n    blaxelMemoryMb: optional(\"OPENGENI_BLAXEL_MEMORY_MB\"),\n    blaxelTtl: optional(\"OPENGENI_BLAXEL_TTL\"),\n    cloudflareWorkerUrl: optional(\"OPENGENI_CLOUDFLARE_WORKER_URL\"),\n    cloudflareApiKey: optional(\"OPENGENI_CLOUDFLARE_API_KEY\"),\n    experimentalBrowserContextPoolEnabled: optional(\n      \"OPENGENI_EXPERIMENTAL_BROWSER_CONTEXT_POOL_ENABLED\",\n    ),\n    browserbaseApiKey: optional(\"OPENGENI_BROWSERBASE_API_KEY\"),\n    kernelApiKey: optional(\"OPENGENI_KERNEL_API_KEY\"),\n    kernelEndpoint: optional(\"OPENGENI_KERNEL_ENDPOINT\"),\n    kernelBrowserTimeoutSeconds: optional(\"OPENGENI_KERNEL_BROWSER_TIMEOUT_SECONDS\"),\n    kernelBrowserStealth: optional(\"OPENGENI_KERNEL_BROWSER_STEALTH\"),\n    vercelToken: optional(\"OPENGENI_VERCEL_TOKEN\"),\n    vercelProjectId: optional(\"OPENGENI_VERCEL_PROJECT_ID\"),\n    vercelTeamId: optional(\"OPENGENI_VERCEL_TEAM_ID\"),\n    vercelRuntime: optional(\"OPENGENI_VERCEL_RUNTIME\"),\n    openSandboxBaseUrl: optional(\"OPENGENI_OPENSANDBOX_BASE_URL\"),\n    openSandboxApiKey: optional(\"OPENGENI_OPENSANDBOX_API_KEY\"),\n    openSandboxImage: optional(\"OPENGENI_OPENSANDBOX_IMAGE\"),\n    openSandboxTtlSeconds: optional(\"OPENGENI_OPENSANDBOX_TTL_SECONDS\"),\n    openSandboxUseServerProxy: optional(\"OPENGENI_OPENSANDBOX_USE_SERVER_PROXY\"),\n    openSandboxSignedEndpoints: optional(\"OPENGENI_OPENSANDBOX_SIGNED_ENDPOINTS\"),\n    openSandboxSignedEndpointTtlSeconds: optional(\n      \"OPENGENI_OPENSANDBOX_SIGNED_ENDPOINT_TTL_SECONDS\",\n    ),\n    openSandboxChannelBPublicBaseUrl: optional(\"OPENGENI_OPENSANDBOX_CHANNEL_B_PUBLIC_BASE_URL\"),\n    openSandboxInteractionFrameProxy: optional(\"OPENGENI_OPENSANDBOX_INTERACTION_FRAME_PROXY\"),\n    openSandboxPoolRef: optional(\"OPENGENI_OPENSANDBOX_POOL_REF\"),\n    openSandboxKubernetesInventoryNamespace: optional(\n      \"OPENGENI_OPENSANDBOX_KUBERNETES_INVENTORY_NAMESPACE\",\n    ),\n    computeApiUrl: optional(\"OPENGENI_COMPUTE_API_URL\"),\n    computeApiKey: optional(\"OPENGENI_COMPUTE_API_KEY\"),\n    computeImage: optional(\"OPENGENI_COMPUTE_IMAGE\"),\n    computeDesktopImage: optional(\"OPENGENI_COMPUTE_DESKTOP_IMAGE\"),\n    computeVcpus: optional(\"OPENGENI_COMPUTE_VCPUS\"),\n    computeMemoryMib: optional(\"OPENGENI_COMPUTE_MEMORY_MIB\"),\n    computeMemoryRequestMib: optional(\"OPENGENI_COMPUTE_MEMORY_REQUEST_MIB\"),\n    computeCpuRequestMillis: optional(\"OPENGENI_COMPUTE_CPU_REQUEST_MILLIS\"),\n    computeLinkUrl: optional(\"OPENGENI_COMPUTE_LINK_URL\"),\n    computeAgentReadyTimeoutMs: optional(\"OPENGENI_COMPUTE_AGENT_READY_TIMEOUT_MS\"),\n    sandboxOwnershipEnabled: optional(\"OPENGENI_SANDBOX_OWNERSHIP_ENABLED\"),\n    rigVerificationLeaseOwnershipEnabled: optional(\n      \"OPENGENI_RIG_VERIFICATION_LEASE_OWNERSHIP_ENABLED\",\n    ),\n    sandboxLazyProvisionEnabled: optional(\"OPENGENI_SANDBOX_LAZY_PROVISION\"),\n    sandboxSelfhostedEnabled: optional(\"OPENGENI_SANDBOX_SELFHOSTED_ENABLED\"),\n    agentOpStreamEnabled: optional(\"OPENGENI_AGENT_OP_STREAM_ENABLED\"),\n    enrollmentSigningSecret: optional(\"OPENGENI_ENROLLMENT_SIGNING_SECRET\"),\n    selfhostedNatsUrl: optional(\"OPENGENI_SELFHOSTED_NATS_URL\"),\n    selfhostedRelayUrl: optional(\"OPENGENI_SELFHOSTED_RELAY_URL\"),\n    selfhostedRelayTokenSecret: optional(\"OPENGENI_SELFHOSTED_RELAY_TOKEN_SECRET\"),\n    agentUpdatePublicKey: optional(\"OPENGENI_AGENT_UPDATE_PUBLIC_KEY\"),\n    selfhostedNatsCalloutAccountSeed: optional(\"OPENGENI_SELFHOSTED_NATS_CALLOUT_ACCOUNT_SEED\"),\n    selfhostedNatsCalloutAccountName: optional(\"OPENGENI_SELFHOSTED_NATS_CALLOUT_ACCOUNT_NAME\"),\n    selfhostedNatsCalloutUser: optional(\"OPENGENI_SELFHOSTED_NATS_CALLOUT_USER\"),\n    selfhostedNatsCalloutPassword: optional(\"OPENGENI_SELFHOSTED_NATS_CALLOUT_PASSWORD\"),\n    selfhostedNatsControlUser: optional(\"OPENGENI_SELFHOSTED_NATS_CONTROL_USER\"),\n    selfhostedNatsControlPassword: optional(\"OPENGENI_SELFHOSTED_NATS_CONTROL_PASSWORD\"),\n    sandboxSelfhostedExecTimeoutMs: optional(\"OPENGENI_SANDBOX_SELFHOSTED_EXEC_TIMEOUT_MS\"),\n    sandboxSelfhostedControlTimeoutMs: optional(\"OPENGENI_SANDBOX_SELFHOSTED_CONTROL_TIMEOUT_MS\"),\n    sandboxLeaseReaperPeriodMs: optional(\"OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS\"),\n    sandboxViewerHolderTtlMs: optional(\"OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS\"),\n    sandboxInteractionHolderTtlMs: optional(\"OPENGENI_SANDBOX_INTERACTION_HOLDER_TTL_MS\"),\n    sandboxIdleGraceMs: optional(\"OPENGENI_SANDBOX_IDLE_GRACE_MS\"),\n    sandboxIdleCommandContainmentMs: optional(\"OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS\"),\n    sandboxSnapshotIntervalMs: optional(\"OPENGENI_SANDBOX_SNAPSHOT_INTERVAL_MS\"),\n    sandboxSnapshotTimeoutMs: optional(\"OPENGENI_SANDBOX_SNAPSHOT_TIMEOUT_MS\"),\n    sandboxDrainSnapshotTimeoutMs: optional(\"OPENGENI_SANDBOX_DRAIN_SNAPSHOT_TIMEOUT_MS\"),\n    sandboxRotationLeadMs: optional(\"OPENGENI_SANDBOX_ROTATION_LEAD_MS\"),\n    sandboxRotationBatchSize: optional(\"OPENGENI_SANDBOX_ROTATION_BATCH_SIZE\"),\n    sandboxLeaseTtlMs: optional(\"OPENGENI_SANDBOX_LEASE_TTL_MS\"),\n    sandboxLeaseWarmingTtlMs: optional(\"OPENGENI_SANDBOX_LEASE_WARMING_TTL_MS\"),\n    sandboxWarmingTimeoutMs: optional(\"OPENGENI_SANDBOX_WARMING_TIMEOUT_MS\"),\n    workspaceControlLockTimeoutMs: optional(\"OPENGENI_WORKSPACE_CONTROL_LOCK_TIMEOUT_MS\"),\n    rigSetupTimeoutMs: optional(\"OPENGENI_RIG_SETUP_TIMEOUT_MS\"),\n    sandboxWarmRateMicrosPerSecondJson: optional(\n      \"OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON\",\n    ),\n    sandboxWarmBillingMode: optional(\"OPENGENI_SANDBOX_WARM_BILLING_MODE\"),\n    sandboxMaxWarmSecondsPerWorkspace: optional(\"OPENGENI_SANDBOX_MAX_WARM_SECONDS_PER_WORKSPACE\"),\n    sandboxPreparationProfiles: optional(\"OPENGENI_SANDBOX_PREPARATION_PROFILES\"),\n    sandboxEnvAllowlist: optional(\"OPENGENI_SANDBOX_ENV_ALLOWLIST\"),\n    sandboxImageAllowlist: optional(\"OPENGENI_SANDBOX_IMAGE_ALLOWLIST\"),\n    objectStorageEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_ENDPOINT\"),\n    objectStorageInternalEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_INTERNAL_ENDPOINT\"),\n    objectStorageSandboxEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_SANDBOX_ENDPOINT\"),\n    objectStorageBackend: optional(\"OPENGENI_OBJECT_STORAGE_BACKEND\"),\n    objectStorageBucket: optional(\"OPENGENI_OBJECT_STORAGE_BUCKET\"),\n    objectStorageRegion: optional(\"OPENGENI_OBJECT_STORAGE_REGION\"),\n    objectStorageS3Provider: optional(\"OPENGENI_OBJECT_STORAGE_S3_PROVIDER\"),\n    objectStorageAccessKeyId: optional(\"OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID\"),\n    objectStorageSecretAccessKey: optional(\"OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY\"),\n    objectStorageForcePathStyle: optional(\"OPENGENI_OBJECT_STORAGE_FORCE_PATH_STYLE\"),\n    objectStorageAzureConnectionString: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_CONNECTION_STRING\"),\n    objectStorageAzureAccountName: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_NAME\"),\n    objectStorageAzureAccountKey: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_KEY\"),\n    objectStorageAzureEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ENDPOINT\"),\n    objectStorageGcsProjectId: optional(\"OPENGENI_OBJECT_STORAGE_GCS_PROJECT_ID\"),\n    objectStorageGcsCredentialsJson: optional(\"OPENGENI_OBJECT_STORAGE_GCS_CREDENTIALS_JSON\"),\n    objectStorageGcsKeyFilename: optional(\"OPENGENI_OBJECT_STORAGE_GCS_KEY_FILENAME\"),\n    objectStorageGcsApiEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_GCS_API_ENDPOINT\"),\n    documentParser: optional(\"OPENGENI_DOCUMENT_PARSER\"),\n    documentChunkSize: optional(\"OPENGENI_DOCUMENT_CHUNK_SIZE\"),\n    documentChunkOverlap: optional(\"OPENGENI_DOCUMENT_CHUNK_OVERLAP\"),\n    documentEmbeddingProvider: optional(\"OPENGENI_DOCUMENT_EMBEDDING_PROVIDER\"),\n    documentEmbeddingModel: optional(\"OPENGENI_DOCUMENT_EMBEDDING_MODEL\"),\n    documentEmbeddingDimensions: optional(\"OPENGENI_DOCUMENT_EMBEDDING_DIMENSIONS\"),\n    documentEmbeddingApiKey: optional(\"OPENGENI_DOCUMENT_EMBEDDING_API_KEY\"),\n    documentEmbeddingBaseUrl: optional(\"OPENGENI_DOCUMENT_EMBEDDING_BASE_URL\"),\n    documentEmbeddingBillingMode: optional(\"OPENGENI_DOCUMENT_EMBEDDING_BILLING_MODE\"),\n    sitesCloudflareStorageEnabled: optional(\"OPENGENI_SITES_CLOUDFLARE_STORAGE_ENABLED\"),\n    sitesGatewayInternalOrigin: optional(\"OPENGENI_SITES_GATEWAY_INTERNAL_ORIGIN\"),\n    sitesSqlFreeStorageBytes: optional(\"OPENGENI_SITES_SQL_FREE_STORAGE_BYTES\"),\n    sitesSqlFreeRowsReadPerMonth: optional(\"OPENGENI_SITES_SQL_FREE_ROWS_READ_PER_MONTH\"),\n    sitesSqlFreeRowsWrittenPerMonth: optional(\"OPENGENI_SITES_SQL_FREE_ROWS_WRITTEN_PER_MONTH\"),\n    sitesSqlFreeCallsPerMinutePerViewer: optional(\n      \"OPENGENI_SITES_SQL_FREE_CALLS_PER_MINUTE_PER_VIEWER\",\n    ),\n    sitesSqlFreeCallsPerMinutePerSite: optional(\n      \"OPENGENI_SITES_SQL_FREE_CALLS_PER_MINUTE_PER_SITE\",\n    ),\n    sitesSqlMaxRowsPerCall: optional(\"OPENGENI_SITES_SQL_MAX_ROWS_PER_CALL\"),\n    sitesSqlMaxResponseBytes: optional(\"OPENGENI_SITES_SQL_MAX_RESPONSE_BYTES\"),\n    sitesSqlTimeoutMs: optional(\"OPENGENI_SITES_SQL_TIMEOUT_MS\"),\n    siteDataRecordBytesPerSite: optional(\"OPENGENI_SITE_DATA_RECORD_BYTES_PER_SITE\"),\n    siteDataMaxRecordBytes: optional(\"OPENGENI_SITE_DATA_MAX_RECORD_BYTES\"),\n    siteDataMaxCollectionsPerSite: optional(\"OPENGENI_SITE_DATA_MAX_COLLECTIONS_PER_SITE\"),\n    siteDataFileBytesPerSite: optional(\"OPENGENI_SITE_DATA_FILE_BYTES_PER_SITE\"),\n    siteDataMaxFileBytes: optional(\"OPENGENI_SITE_DATA_MAX_FILE_BYTES\"),\n    siteDataWorkspaceBytes: optional(\"OPENGENI_SITE_DATA_WORKSPACE_BYTES\"),\n    siteDataViewerWritesPerMinute: optional(\"OPENGENI_SITE_DATA_VIEWER_WRITES_PER_MINUTE\"),\n    siteDataSiteWritesPerMinute: optional(\"OPENGENI_SITE_DATA_SITE_WRITES_PER_MINUTE\"),\n    siteDataViewerReadsPerMinute: optional(\"OPENGENI_SITE_DATA_VIEWER_READS_PER_MINUTE\"),\n    siteDataManagerWritesPerMinute: optional(\"OPENGENI_SITE_DATA_MANAGER_WRITES_PER_MINUTE\"),\n    siteDataSiteValidationMsPerMinute: optional(\"OPENGENI_SITE_DATA_SITE_VALIDATION_MS_PER_MINUTE\"),\n    siteDataWorkspaceValidationMsPerMinute: optional(\n      \"OPENGENI_SITE_DATA_WORKSPACE_VALIDATION_MS_PER_MINUTE\",\n    ),\n    siteDataMaxRecordsPerCollection: optional(\"OPENGENI_SITE_DATA_MAX_RECORDS_PER_COLLECTION\"),\n    sitesDomain: optional(\"OPENGENI_SITES_DOMAIN\"),\n    sitesGatewaySecret: optional(\"OPENGENI_SITES_GATEWAY_SECRET\"),\n    sitesGatewaySecretPrevious: optional(\"OPENGENI_SITES_GATEWAY_SECRET_PREVIOUS\"),\n    sitesPublicEnabled: optional(\"OPENGENI_SITES_PUBLIC_ENABLED\"),\n    sitesPublicAgentsEnabled: optional(\"OPENGENI_SITES_PUBLIC_AGENTS_ENABLED\"),\n    sitesLoginOnly: optional(\"OPENGENI_SITES_LOGIN_ONLY\"),\n    sitesForceNoindex: optional(\"OPENGENI_SITES_FORCE_NOINDEX\"),\n    sitesAbuseEmail: optional(\"OPENGENI_SITES_ABUSE_EMAIL\"),\n    sitesGuestAgentHumanCheck: optional(\"OPENGENI_SITES_GUEST_AGENT_HUMAN_CHECK\"),\n    sitesFreeRequestsPerMinutePerVisitor: optional(\n      \"OPENGENI_SITES_FREE_REQUESTS_PER_MINUTE_PER_VISITOR\",\n    ),\n    sitesFreeGuestWritesPerMinute: optional(\"OPENGENI_SITES_FREE_GUEST_WRITES_PER_MINUTE\"),\n    sitesFreeConversationsPerVisitorPerDay: optional(\n      \"OPENGENI_SITES_FREE_CONVERSATIONS_PER_VISITOR_PER_DAY\",\n    ),\n    sitesFreeConversationsPerSitePerDay: optional(\n      \"OPENGENI_SITES_FREE_CONVERSATIONS_PER_SITE_PER_DAY\",\n    ),\n    sitesFreeTurnsPerConversation: optional(\"OPENGENI_SITES_FREE_TURNS_PER_CONVERSATION\"),\n    sitesFreeAgentMicrosPerConversation: optional(\n      \"OPENGENI_SITES_FREE_AGENT_MICROS_PER_CONVERSATION\",\n    ),\n    sitesFreeAgentMicrosPerVisitorPerDay: optional(\n      \"OPENGENI_SITES_FREE_AGENT_MICROS_PER_VISITOR_PER_DAY\",\n    ),\n    sitesFreeAgentMicrosPerSitePerMonth: optional(\n      \"OPENGENI_SITES_FREE_AGENT_MICROS_PER_SITE_PER_MONTH\",\n    ),\n    sitesCreditsLimitMultiplier: optional(\"OPENGENI_SITES_CREDITS_LIMIT_MULTIPLIER\"),\n    sitesAgentReservationMicrosPerTurn: optional(\n      \"OPENGENI_SITES_AGENT_RESERVATION_MICROS_PER_TURN\",\n    ),\n    sitesAgentMicrosPerSitePerMonth: optional(\"OPENGENI_SITES_AGENT_MICROS_PER_SITE_PER_MONTH\"),\n    sitesAgentMicrosPerPersonPerDay: optional(\"OPENGENI_SITES_AGENT_MICROS_PER_PERSON_PER_DAY\"),\n    sitesGuestConversationsPerVisitorPerDay: optional(\n      \"OPENGENI_SITES_GUEST_CONVERSATIONS_PER_VISITOR_PER_DAY\",\n    ),\n    sitesGuestConversationsPerSitePerDay: optional(\n      \"OPENGENI_SITES_GUEST_CONVERSATIONS_PER_SITE_PER_DAY\",\n    ),\n    sitesGuestTurnsPerConversation: optional(\"OPENGENI_SITES_GUEST_TURNS_PER_CONVERSATION\"),\n    sitesGuestAgentMicrosPerConversation: optional(\n      \"OPENGENI_SITES_GUEST_AGENT_MICROS_PER_CONVERSATION\",\n    ),\n    sitesPlatformBillingMode: optional(\"OPENGENI_SITES_PLATFORM_BILLING_MODE\"),\n    sitesPlatformOverageEnabled: optional(\"OPENGENI_SITES_PLATFORM_OVERAGE_ENABLED\"),\n    sitesPlatformAllowanceRequests: optional(\"OPENGENI_SITES_PLATFORM_ALLOWANCE_REQUESTS\"),\n    sitesPlatformAllowanceSqlRowsRead: optional(\"OPENGENI_SITES_PLATFORM_ALLOWANCE_SQL_ROWS_READ\"),\n    sitesPlatformAllowanceSqlRowsWritten: optional(\n      \"OPENGENI_SITES_PLATFORM_ALLOWANCE_SQL_ROWS_WRITTEN\",\n    ),\n    sitesPlatformAllowanceStorageBytes: optional(\"OPENGENI_SITES_PLATFORM_ALLOWANCE_STORAGE_BYTES\"),\n    sitesPlatformPriceMicrosPerMillionRequests: optional(\n      \"OPENGENI_SITES_PLATFORM_PRICE_MICROS_PER_MILLION_REQUESTS\",\n    ),\n    sitesPlatformPriceMicrosPerMillionSqlRowsRead: optional(\n      \"OPENGENI_SITES_PLATFORM_PRICE_MICROS_PER_MILLION_SQL_ROWS_READ\",\n    ),\n    sitesPlatformPriceMicrosPerMillionSqlRowsWritten: optional(\n      \"OPENGENI_SITES_PLATFORM_PRICE_MICROS_PER_MILLION_SQL_ROWS_WRITTEN\",\n    ),\n    sitesPlatformPriceMicrosPerGbMonth: optional(\n      \"OPENGENI_SITES_PLATFORM_PRICE_MICROS_PER_GB_MONTH\",\n    ),\n    sitesPlatformMonthlyLimitUsd: optional(\"OPENGENI_SITES_PLATFORM_MONTHLY_LIMIT_USD\"),\n    sitesPlatformAlertPercent: optional(\"OPENGENI_SITES_PLATFORM_ALERT_PERCENT\"),\n    sitesReportsPerMinutePerVisitor: optional(\"OPENGENI_SITES_REPORTS_PER_MINUTE_PER_VISITOR\"),\n    sitesViewerSessionIdleSeconds: optional(\"OPENGENI_SITES_VIEWER_SESSION_IDLE_SECONDS\"),\n    sitesViewerSessionAbsoluteSeconds: optional(\"OPENGENI_SITES_VIEWER_SESSION_ABSOLUTE_SECONDS\"),\n    sitesHostnameHoldDays: optional(\"OPENGENI_SITES_HOSTNAME_HOLD_DAYS\"),\n    sitesCloudflareApiToken: optional(\"OPENGENI_SITES_CLOUDFLARE_API_TOKEN\"),\n    sitesCloudflareAccountId: optional(\"OPENGENI_SITES_CLOUDFLARE_ACCOUNT_ID\"),\n    sitesCloudflareKvNamespaceId: optional(\"OPENGENI_SITES_CLOUDFLARE_KV_NAMESPACE_ID\"),\n    sitesCloudflareZoneId: optional(\"OPENGENI_SITES_CLOUDFLARE_ZONE_ID\"),\n    sitesHostMapTtlSeconds: optional(\"OPENGENI_SITES_HOST_MAP_TTL_SECONDS\"),\n    sitesWebRiskApiKey: optional(\"OPENGENI_SITES_WEB_RISK_API_KEY\"),\n    documentEmbeddingCreditsActivatedAt: optional(\n      \"OPENGENI_DOCUMENT_EMBEDDING_CREDITS_ACTIVATED_AT\",\n    ),\n    documentEmbeddingRateMicrosPerMillionBytes: optional(\n      \"OPENGENI_DOCUMENT_EMBEDDING_RATE_MICROS_PER_MILLION_BYTES\",\n    ),\n    documentCurationProvider: optional(\"OPENGENI_DOCUMENT_CURATION_PROVIDER\"),\n    documentCurationModel: optional(\"OPENGENI_DOCUMENT_CURATION_MODEL\"),\n    documentCurationApiKey: optional(\"OPENGENI_DOCUMENT_CURATION_API_KEY\"),\n    documentCurationBaseUrl: optional(\"OPENGENI_DOCUMENT_CURATION_BASE_URL\"),\n    gitAuthorName: optional(\"OPENGENI_GIT_AUTHOR_NAME\"),\n    gitAuthorEmail: optional(\"OPENGENI_GIT_AUTHOR_EMAIL\"),\n    gitCommitterName: optional(\"OPENGENI_GIT_COMMITTER_NAME\"),\n    gitCommitterEmail: optional(\"OPENGENI_GIT_COMMITTER_EMAIL\"),\n    githubAppManifestBaseUrl: optional(\"OPENGENI_GITHUB_APP_MANIFEST_BASE_URL\"),\n    githubAppManifestStateSecret: optional(\"OPENGENI_GITHUB_APP_MANIFEST_STATE_SECRET\"),\n    githubAppId: optional(\"OPENGENI_GITHUB_APP_ID\"),\n    githubClientId: optional(\"OPENGENI_GITHUB_CLIENT_ID\"),\n    githubClientSecret: optional(\"OPENGENI_GITHUB_CLIENT_SECRET\"),\n    githubRestMcpEnabled: optional(\"OPENGENI_GITHUB_REST_MCP_ENABLED\"),\n    githubPersonalOauthEnabled: optional(\"OPENGENI_GITHUB_PERSONAL_OAUTH_ENABLED\"),\n    githubPersonalOauthClientId: optional(\"OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_ID\"),\n    githubPersonalOauthClientSecret: optional(\"OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_SECRET\"),\n    githubAppSlug: optional(\"OPENGENI_GITHUB_APP_SLUG\"),\n    githubWebhookSecret: optional(\"OPENGENI_GITHUB_WEBHOOK_SECRET\"),\n    githubAppPrivateKey: optional(\"OPENGENI_GITHUB_APP_PRIVATE_KEY\"),\n    prReviewGithubAppId: optional(\"OPENGENI_PR_REVIEW_GITHUB_APP_ID\"),\n    prReviewGithubClientId: optional(\"OPENGENI_PR_REVIEW_GITHUB_CLIENT_ID\"),\n    prReviewGithubClientSecret: optional(\"OPENGENI_PR_REVIEW_GITHUB_CLIENT_SECRET\"),\n    prReviewGithubAppSlug: optional(\"OPENGENI_PR_REVIEW_GITHUB_APP_SLUG\"),\n    prReviewGithubWebhookSecret: optional(\"OPENGENI_PR_REVIEW_GITHUB_WEBHOOK_SECRET\"),\n    prReviewGithubAppPrivateKey: optional(\"OPENGENI_PR_REVIEW_GITHUB_APP_PRIVATE_KEY\"),\n    betterAuthSecret: optional(\"OPENGENI_BETTER_AUTH_SECRET\"),\n    betterAuthAllowedHosts: optional(\"OPENGENI_BETTER_AUTH_ALLOWED_HOSTS\"),\n    betterAuthCookieDomain: optional(\"OPENGENI_BETTER_AUTH_COOKIE_DOMAIN\"),\n    betterAuthTrustedOrigins: optional(\"OPENGENI_BETTER_AUTH_TRUSTED_ORIGINS\"),\n    managedAuthGoogleClientId: optional(\"OPENGENI_MANAGED_AUTH_GOOGLE_CLIENT_ID\"),\n    managedAuthGoogleClientSecret: optional(\"OPENGENI_MANAGED_AUTH_GOOGLE_CLIENT_SECRET\"),\n    managedAuthGithubClientId: optional(\"OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_ID\"),\n    managedAuthGithubClientSecret: optional(\"OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_SECRET\"),\n    allowedUserEmails:\n      source.OPENGENI_ALLOWED_USER_EMAILS === undefined\n        ? undefined\n        : source.OPENGENI_ALLOWED_USER_EMAILS.split(\",\").map((email) => email.trim()),\n    managedAuthSessionSetMode: optional(\"OPENGENI_MANAGED_AUTH_SESSION_SET_MODE\"),\n    nativeAppSchemes:\n      source.OPENGENI_NATIVE_APP_SCHEMES === undefined\n        ? undefined\n        : source.OPENGENI_NATIVE_APP_SCHEMES.split(\",\")\n            .map((scheme) => scheme.trim())\n            .filter(Boolean),\n    nativeAppIds:\n      source.OPENGENI_NATIVE_APP_IDS === undefined\n        ? undefined\n        : source.OPENGENI_NATIVE_APP_IDS.split(\",\")\n            .map((id) => id.trim())\n            .filter(Boolean),\n    apnsKeyId: optional(\"OPENGENI_APNS_KEY_ID\"),\n    apnsTeamId: optional(\"OPENGENI_APNS_TEAM_ID\"),\n    apnsPrivateKey: optional(\"OPENGENI_APNS_PRIVATE_KEY\"),\n    fcmServiceAccountJson: optional(\"OPENGENI_FCM_SERVICE_ACCOUNT_JSON\"),\n    managedAuthNewSignupsEnabled: optional(\"OPENGENI_MANAGED_AUTH_NEW_SIGNUPS_ENABLED\"),\n    managedAuthRequireEmailVerification: optional(\n      \"OPENGENI_MANAGED_AUTH_REQUIRE_EMAIL_VERIFICATION\",\n    ),\n    organizationUserSetupEmailTokenTransport: optional(\n      \"OPENGENI_ORGANIZATION_USER_SETUP_EMAIL_TOKEN_TRANSPORT\",\n    ),\n    organizationUserSetupQueryEdgeSanitizationConfirmed: optional(\n      \"OPENGENI_ORGANIZATION_USER_SETUP_QUERY_EDGE_SANITIZATION_CONFIRMED\",\n    ),\n    managedEmailDelivery: optional(\"OPENGENI_MANAGED_EMAIL_DELIVERY\"),\n    resendApiKey: optional(\"OPENGENI_RESEND_API_KEY\"),\n    emailFrom: optional(\"OPENGENI_EMAIL_FROM\"),\n    stripeSecretKey: optional(\"OPENGENI_STRIPE_SECRET_KEY\"),\n    stripePublishableKey: optional(\"OPENGENI_STRIPE_PUBLISHABLE_KEY\"),\n    stripeWebhookSecret: optional(\"OPENGENI_STRIPE_WEBHOOK_SECRET\"),\n    stripeCreditsProductId: optional(\"OPENGENI_STRIPE_CREDITS_PRODUCT_ID\"),\n    subscriptionPlansEnabled: optional(\"OPENGENI_SUBSCRIPTION_PLANS_ENABLED\"),\n    mcpServers: parseMcpServers(optional(\"OPENGENI_MCP_SERVERS\")),\n  };\n  const parsed = SettingsSchema.parse(raw);\n  const settings = {\n    ...parsed,\n    sandboxIdleGraceMs:\n      raw.sandboxIdleGraceMs === undefined && parsed.sandboxBackend === \"modal\"\n        ? Math.min(60_000, Math.floor((parsed.modalTimeoutSeconds * 1000) / 2))\n        : parsed.sandboxIdleGraceMs,\n    sandboxRotationLeadMs:\n      raw.sandboxRotationLeadMs === undefined && parsed.sandboxBackend === \"modal\"\n        ? Math.min(\n            3_600_000,\n            Math.max(\n              Math.floor((parsed.modalTimeoutSeconds * 1000) / 2),\n              SANDBOX_DEADLINE_COMMAND_STOP_GRACE_MS +\n                sandboxArchiveCaptureTimeoutMs({\n                  sandboxSnapshotTimeoutMs: Math.max(\n                    parsed.sandboxSnapshotTimeoutMs,\n                    parsed.sandboxDrainSnapshotTimeoutMs ?? parsed.sandboxSnapshotTimeoutMs,\n                  ),\n                }) +\n                2 * parsed.sandboxLeaseReaperPeriodMs +\n                1,\n            ),\n          )\n        : parsed.sandboxRotationLeadMs,\n    mcpServers: ensureBuiltInMcpServers(parsed),\n  };\n  if (raw.sandboxIdleCommandContainmentMs === undefined) {\n    // Strictly between the idle grace and the rotation lead whenever that\n    // interval exists (short test/canary lifetimes), never above 30 minutes,\n    // and early enough that an explicit Modal idle timeout cannot fire first.\n    const modalIdleCeilingMs =\n      settings.sandboxBackend === \"modal\" && settings.modalIdleTimeoutSeconds !== undefined\n        ? settings.modalIdleTimeoutSeconds * 1000 -\n          settings.sandboxLeaseReaperPeriodMs -\n          sandboxArchiveCaptureTimeoutMs({\n            sandboxSnapshotTimeoutMs: effectiveSandboxDrainSnapshotTimeoutMs(settings),\n          }) -\n          1\n        : Number.POSITIVE_INFINITY;\n    const derived = Math.min(\n      1_800_000,\n      Math.floor((settings.sandboxIdleGraceMs + settings.sandboxRotationLeadMs) / 2),\n      modalIdleCeilingMs,\n    );\n    // A derived value never fails validation: with no room above the idle\n    // grace, idle containment stays off and only the deadline rule applies.\n    if (derived > settings.sandboxIdleGraceMs) {\n      settings.sandboxIdleCommandContainmentMs = derived;\n    } else {\n      settings.sandboxIdleCommandContainmentMs = undefined;\n      if (!idleCommandContainmentDisabledWarned) {\n        idleCommandContainmentDisabledWarned = true;\n        console.warn(\n          \"[config] idle command containment disabled: no window fits between \" +\n            `OPENGENI_SANDBOX_IDLE_GRACE_MS (${settings.sandboxIdleGraceMs}) and the Modal idle ` +\n            \"timeout / rotation lead ceiling; set OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS to override.\",\n        );\n      }\n    }\n  }\n  warnRetiredDeploymentSwitches(source);\n  validateSettings(settings, source);\n  return settings;\n}\n\n/**\n * Former deployment switches that are now accepted and ignored. Deployments\n * that still set one keep booting; a one-time warning tells the operator to\n * delete it.\n */\nconst RETIRED_DEPLOYMENT_SWITCHES: ReadonlyArray<{ name: string; reason: string }> = [\n  {\n    name: \"OPENGENI_ORGANIZATION_TENANCY_CANONICAL_ACTIVATION_ENABLED\",\n    reason: \"every organization is session-tenancy activated (migration 0611)\",\n  },\n  {\n    name: \"OPENGENI_INTEGRATIONS_OAUTH_SHORT_STATE_ENABLED\",\n    reason: \"MCP OAuth always sends the short reference state (migration 0507)\",\n  },\n];\n\nconst warnedRetiredDeploymentSwitches = new Set<string>();\n\nfunction warnRetiredDeploymentSwitches(source: NodeJS.ProcessEnv): void {\n  for (const { name, reason } of RETIRED_DEPLOYMENT_SWITCHES) {\n    if (source[name] === undefined || warnedRetiredDeploymentSwitches.has(name)) continue;\n    warnedRetiredDeploymentSwitches.add(name);\n    console.warn(\n      `[config] ${name} is retired and ignored: ${reason}. Remove it from the deployment.`,\n    );\n  }\n}\n\nconst LOCAL_FIRST_PARTY_DELEGATION_SECRET = \"opengeni-local-first-party-delegation-secret-v1\";\n\n/**\n * First-party session tools need a shared HMAC identity even in the unauthenticated\n * local product mode. A fixed local-only value is no broader than that mode's\n * existing access boundary, while configured and managed deployments continue to\n * require an operator-provided secret.\n */\nexport function resolveFirstPartyDelegationSecret(settings: Settings): string | undefined {\n  const explicit = settings.delegationSecret?.trim();\n  if (explicit) return explicit;\n  const configuredAccessKey = settings.accessKey?.trim();\n  if (settings.productAccessMode === \"configured\" && settings.authRequired && configuredAccessKey) {\n    return configuredAccessKey;\n  }\n  return settings.productAccessMode === \"local\" &&\n    (settings.environment === \"local\" || settings.environment === \"test\")\n    ? LOCAL_FIRST_PARTY_DELEGATION_SECRET\n    : undefined;\n}\n\nexport type FirstPartyMcpToolPolicy = {\n  default: FirstPartyMcpToolNameType[];\n  allowed: FirstPartyMcpToolNameType[];\n};\n\nexport type FirstPartyMcpToolPolicySettings = Pick<\n  Settings,\n  \"defaultFirstPartyMcpTools\" | \"allowedFirstPartyMcpTools\" | \"artifactMaterializerDeployed\"\n>;\n\nconst EDITABLE_ARTIFACT_EXPORT_TOOLS: readonly FirstPartyMcpToolNameType[] = [\n  \"editable_artifact_export\",\n  \"editable_artifact_export_status\",\n];\n\n/**\n * First-party tools whose backing workload this deployment does not run. They\n * are absent from the ceiling (never offered) and an explicit request for one\n * is dropped rather than rejected: it is a deployment fact, not a caller error.\n */\nexport function deploymentUnavailableFirstPartyMcpTools(\n  settings: Pick<Settings, \"artifactMaterializerDeployed\">,\n): ReadonlySet<FirstPartyMcpToolNameType> {\n  return new Set(settings.artifactMaterializerDeployed ? [] : EDITABLE_ARTIFACT_EXPORT_TOOLS);\n}\n\n/** Resolve the deployment's session-tool defaults and hard execution ceiling. */\nexport function resolveFirstPartyMcpToolPolicy(\n  settings: FirstPartyMcpToolPolicySettings,\n): FirstPartyMcpToolPolicy {\n  const unavailable = deploymentUnavailableFirstPartyMcpTools(settings);\n  const allowed = currentAgentLearningToolSelection(\n    settings.allowedFirstPartyMcpTools ?? [...FIRST_PARTY_MCP_TOOL_NAMES],\n  ).filter((tool) => !isRetiredNativeAtlassianTool(tool) && !unavailable.has(tool));\n  const allowedSet = new Set(allowed);\n  const defaults = currentAgentLearningToolSelection(\n    settings.defaultFirstPartyMcpTools ?? [...DEFAULT_FIRST_PARTY_MCP_TOOLS],\n  );\n  return {\n    default: defaults.filter((tool) => allowedSet.has(tool)),\n    allowed: [...allowed],\n  };\n}\n\n/** Apply the deployment ceiling to an existing durable session selection. */\nexport function allowedFirstPartyMcpToolsForSession(\n  settings: FirstPartyMcpToolPolicySettings,\n  selected: readonly FirstPartyMcpToolNameType[] | null | undefined,\n): FirstPartyMcpToolNameType[] {\n  const policy = resolveFirstPartyMcpToolPolicy(settings);\n  const allowed = new Set(policy.allowed);\n  const tools = new Set(currentAgentLearningToolSelection(selected ?? policy.default));\n  // Existing sessions with pause authority also receive its resume counterpart.\n  if (tools.has(\"goal_pause\")) tools.add(\"goal_resume\");\n  return [...tools].filter((tool) => allowed.has(tool));\n}\n\n/** Resolve durable selection intent before freezing a new attempt's catalog. */\nexport function resolveSessionFirstPartyMcpTools(\n  settings: FirstPartyMcpToolPolicySettings,\n  session: Pick<Session, \"firstPartyMcpTools\" | \"toolPolicy\"> & Partial<Pick<Session, \"agent\">>,\n  workspaceSettings: unknown,\n): FirstPartyMcpToolNameType[] {\n  let selected: readonly FirstPartyMcpToolNameType[] | null | undefined =\n    session.firstPartyMcpTools;\n  if (session.toolPolicy.firstPartyMode === \"workspace_default\") {\n    // Follow today's defaults, plus any tools the creator guaranteed on top.\n    const defaults = resolveWorkspaceSessionToolDefaults(workspaceSettings)?.firstPartyMcpTools;\n    const additions = session.toolPolicy.firstPartyAdditions ?? [];\n    selected = additions.length\n      ? [\n          ...new Set([\n            ...(defaults ?? resolveFirstPartyMcpToolPolicy(settings).default),\n            ...additions,\n          ]),\n        ]\n      : defaults;\n  }\n  const allowed = allowedFirstPartyMcpToolsForSession(settings, selected);\n  return session.agent ? agentConfigFirstPartyMcpTools(session.agent, allowed) : allowed;\n}\n\n/**\n * The Modal sandbox idle timeout (seconds) the provider actually passes as\n * idleTimeoutMs (sandbox-file-persistence). When the operator did not pin\n * OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS we DEFAULT it to the hard lifetime\n * (modalTimeoutSeconds): Opengeni's reaper owns box lifecycle, so Modal's\n * built-in idle-reap (which would otherwise fire on its short server default and\n * kill the box BEFORE the reaper can snapshot /workspace) is pushed out to the\n * hard backstop. An explicit smaller value is honoured (the boot invariant keeps\n * it above reaperPeriod + idleGrace so a drained box still survives long enough\n * to be persisted).\n */\nexport function effectiveModalIdleTimeoutSeconds(settings: Settings): number {\n  return settings.modalIdleTimeoutSeconds ?? settings.modalTimeoutSeconds;\n}\n\nexport type EffectiveSandboxLifecycle = {\n  hardLifetimeMs: number | null;\n  renewableTtlSeconds: number | null;\n  providerIdleTimeoutMs: number | null;\n  rotationLeadMs: number | null;\n};\n\n/** Resolve provider lifecycle clocks without teaching generic callers Modal or\n * OpenSandbox field names. Modal's returned values are exactly the pre-existing\n * hard/idle/rotation values; OpenSandbox instead exposes a renewable TTL and no\n * finite-deadline rotation. */\nexport function effectiveSandboxLifecycle(\n  settings: Settings,\n  backend: z.infer<typeof SandboxBackend> = settings.sandboxBackend,\n): EffectiveSandboxLifecycle {\n  if (backend === \"modal\") {\n    return {\n      hardLifetimeMs: settings.modalTimeoutSeconds * 1000,\n      renewableTtlSeconds: null,\n      providerIdleTimeoutMs: effectiveModalIdleTimeoutSeconds(settings) * 1000,\n      rotationLeadMs: settings.sandboxRotationLeadMs,\n    };\n  }\n  if (backend === \"opensandbox\") {\n    return {\n      hardLifetimeMs: null,\n      renewableTtlSeconds: settings.openSandboxTtlSeconds,\n      providerIdleTimeoutMs: null,\n      rotationLeadMs: null,\n    };\n  }\n  return {\n    hardLifetimeMs: CAPABILITY_DESCRIPTORS[backend].lifetime.hardLifetimeMs ?? null,\n    renewableTtlSeconds: null,\n    providerIdleTimeoutMs: null,\n    rotationLeadMs: null,\n  };\n}\n\n/** How long a box reported missing could still be running anywhere: its hard\n * lifetime, or the renewable TTL nobody renews once the box is lost. Null when\n * the backend has no such bound (its loss needs other proof). */\nexport function sandboxProviderMaxRemainingLifetimeMs(\n  settings: Settings,\n  backend: z.infer<typeof SandboxBackend>,\n): number | null {\n  const lifecycle = effectiveSandboxLifecycle(settings, backend);\n  if (lifecycle.hardLifetimeMs !== null) return lifecycle.hardLifetimeMs;\n  return lifecycle.renewableTtlSeconds !== null ? lifecycle.renewableTtlSeconds * 1000 : null;\n}\n\n/**\n * One shared upper bound for the durable provider-capture claim and for command\n * admission waiting behind it. The SDK request itself is bounded by\n * sandboxSnapshotTimeoutMs (a warm host-backed spool capture is stopped there);\n * the extra window lets a non-cancellable provider response settle and release\n * its exact claim without turning a normal checkpoint into a visible command\n * failure. Database validation caps both consumers at one hour.\n */\nexport function sandboxArchiveCaptureTimeoutMs(\n  settings: Pick<Settings, \"sandboxSnapshotTimeoutMs\">,\n): number {\n  return Math.min(\n    SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS,\n    settings.sandboxSnapshotTimeoutMs + SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS,\n  );\n}\n\n/** Provider operation budget used only by zero-holder drain/rotation capture.\n * Unset preserves the historical shared snapshot budget exactly. */\nexport function effectiveSandboxDrainSnapshotTimeoutMs(\n  settings: Pick<Settings, \"sandboxSnapshotTimeoutMs\" | \"sandboxDrainSnapshotTimeoutMs\">,\n): number {\n  return settings.sandboxDrainSnapshotTimeoutMs ?? settings.sandboxSnapshotTimeoutMs;\n}\n\n/**\n * How long before a finite provider deadline the deadline save stops waiting\n * for an orderly shutdown and becomes mandatory. Past this point the\n * reaper captures and terminates the box around anything that cannot finish in\n * time (pending owner quiescence, sibling attempts that do not hold the box,\n * in-flight requests whose holders are gone, commands that ignored their stop\n * request) instead of letting the provider kill it uncaptured. It leaves the\n * legacy command stop grace, the full drain capture budget and two reaper\n * periods before the deadline, and never exceeds the rotation lead.\n */\nexport function sandboxDeadlineMandatoryCaptureLeadMs(\n  settings: Pick<\n    Settings,\n    | \"sandboxRotationLeadMs\"\n    | \"sandboxSnapshotTimeoutMs\"\n    | \"sandboxDrainSnapshotTimeoutMs\"\n    | \"sandboxLeaseReaperPeriodMs\"\n  >,\n): number {\n  return Math.min(\n    settings.sandboxRotationLeadMs,\n    SANDBOX_DEADLINE_COMMAND_STOP_GRACE_MS +\n      sandboxArchiveCaptureTimeoutMs({\n        sandboxSnapshotTimeoutMs: effectiveSandboxDrainSnapshotTimeoutMs(settings),\n      }) +\n      2 * settings.sandboxLeaseReaperPeriodMs,\n  );\n}\n\nexport function sandboxLifecycleTransitionWaitMs(\n  settings: Pick<\n    Settings,\n    \"sandboxSnapshotTimeoutMs\" | \"sandboxDrainSnapshotTimeoutMs\" | \"sandboxLeaseReaperPeriodMs\"\n  >,\n): number {\n  const captureTimeoutMs = sandboxArchiveCaptureTimeoutMs({\n    sandboxSnapshotTimeoutMs: effectiveSandboxDrainSnapshotTimeoutMs(settings),\n  });\n  return Math.min(\n    SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS,\n    settings.sandboxLeaseReaperPeriodMs +\n      captureTimeoutMs +\n      SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS,\n  );\n}\n\nexport function collectSandboxEnvironment(\n  settings: Settings,\n  source: NodeJS.ProcessEnv = process.env,\n): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const name of sandboxEnvironmentVariableNames(settings)) {\n    const value = source[name];\n    if (value) {\n      out[name] = value;\n    }\n  }\n  return out;\n}\n\n/**\n * Resolved API key for a registry provider: the inline `apiKey` when present,\n * else the value of the env var named by `apiKeyEnv`. The preferred form is\n * `apiKeyEnv` (the secret stays out of OPENGENI_MODEL_PROVIDERS_JSON). Reads\n * from `source` (defaults to process.env) so callers can resolve against an\n * explicit environment in tests.\n */\nexport function resolveProviderApiKey(\n  provider: Pick<RegistryProvider, \"apiKey\" | \"apiKeyEnv\">,\n  source: NodeJS.ProcessEnv = process.env,\n): string | undefined {\n  if (provider.apiKey) {\n    return provider.apiKey;\n  }\n  if (provider.apiKeyEnv) {\n    const value = source[provider.apiKeyEnv];\n    return value && value.trim().length > 0 ? value : undefined;\n  }\n  return undefined;\n}\n\nconst HTTP_FIELD_NAME = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\nconst CREDENTIAL_LIKE_NAME_PARTS = new Set([\n  \"apikey\",\n  \"auth\",\n  \"authorization\",\n  \"bearer\",\n  \"credential\",\n  \"cookie\",\n  \"key\",\n  \"password\",\n  \"secret\",\n  \"session\",\n  \"signature\",\n  \"token\",\n]);\nconst REASONING_EFFORT_ORDER = new Map(\n  ReasoningEffort.options.map((effort, index) => [effort, index]),\n);\nconst MODALITY_ORDER = new Map([\"text\", \"image\", \"audio\"].map((value, index) => [value, index]));\nconst LATENCY_MODE_ORDER = new Map(\n  [\"standard\", \"priority\", \"fast\", \"ultrafast\"].map((value, index) => [value, index]),\n);\n\nfunction normalizeRegistryBaseUrl(value: string, providerId: string): string {\n  const url = new URL(value);\n  if (url.username || url.password) {\n    throw new Error(`provider ${providerId} baseUrl must not contain userinfo`);\n  }\n  if (url.search) {\n    throw new Error(\n      `provider ${providerId} baseUrl must not contain a query; move query entries to defaultQuery`,\n    );\n  }\n  if (url.hash) {\n    throw new Error(`provider ${providerId} baseUrl must not contain a fragment`);\n  }\n  return url.toString();\n}\n\nfunction isCredentialLikeMetadataName(name: string): boolean {\n  return name\n    .toLowerCase()\n    .split(/[-_.]/u)\n    .some((part) => CREDENTIAL_LIKE_NAME_PARTS.has(part));\n}\n\nfunction normalizeHeaderMap(\n  providerId: string,\n  headers: Record<string, string> | undefined,\n): Record<string, string> | undefined {\n  if (!headers) {\n    return undefined;\n  }\n  const normalized: Record<string, string> = {};\n  const rawByNormalized = new Map<string, string>();\n  for (const [rawName, value] of Object.entries(headers)) {\n    if (!HTTP_FIELD_NAME.test(rawName)) {\n      throw new Error(\n        `provider ${providerId} defaultHeaders contains invalid HTTP field name ${JSON.stringify(rawName)}`,\n      );\n    }\n    const name = rawName.toLowerCase();\n    const previous = rawByNormalized.get(name);\n    if (previous !== undefined) {\n      throw new Error(\n        `provider ${providerId} defaultHeaders names ${JSON.stringify(previous)} and ${JSON.stringify(rawName)} collide after lowercase normalization`,\n      );\n    }\n    if (name === \"authorization\") {\n      throw new Error(\n        `provider ${providerId} defaultHeaders must not override SDK-managed Authorization`,\n      );\n    }\n    rawByNormalized.set(name, rawName);\n    normalized[name] = value;\n  }\n  return normalized;\n}\n\nfunction normalizePublicHeaderNames(\n  providerId: string,\n  names: string[] | undefined,\n  headers: Record<string, string> | undefined,\n): string[] | undefined {\n  if (!names) {\n    return undefined;\n  }\n  const normalized: string[] = [];\n  const seen = new Set<string>();\n  for (const rawName of names) {\n    if (!HTTP_FIELD_NAME.test(rawName)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultHeaderNames contains invalid HTTP field name ${JSON.stringify(rawName)}`,\n      );\n    }\n    const name = rawName.toLowerCase();\n    if (seen.has(name)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultHeaderNames contains duplicate normalized name ${JSON.stringify(name)}`,\n      );\n    }\n    if (!(name in (headers ?? {}))) {\n      throw new Error(\n        `provider ${providerId} publicDefaultHeaderNames declares absent defaultHeaders entry ${JSON.stringify(name)}`,\n      );\n    }\n    if (isCredentialLikeMetadataName(name)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultHeaderNames cannot classify credential-like name ${JSON.stringify(name)} as public`,\n      );\n    }\n    seen.add(name);\n    normalized.push(name);\n  }\n  return normalized;\n}\n\nfunction normalizeQueryMap(\n  providerId: string,\n  query: Record<string, string> | undefined,\n): Record<string, string> | undefined {\n  if (!query) {\n    return undefined;\n  }\n  for (const name of Object.keys(query)) {\n    if (!name) {\n      throw new Error(`provider ${providerId} defaultQuery contains an empty name`);\n    }\n  }\n  return { ...query };\n}\n\nfunction normalizePublicQueryNames(\n  providerId: string,\n  names: string[] | undefined,\n  query: Record<string, string> | undefined,\n): string[] | undefined {\n  if (!names) {\n    return undefined;\n  }\n  const seen = new Set<string>();\n  for (const name of names) {\n    if (seen.has(name)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultQueryNames contains duplicate name ${JSON.stringify(name)}`,\n      );\n    }\n    if (!(name in (query ?? {}))) {\n      throw new Error(\n        `provider ${providerId} publicDefaultQueryNames declares absent defaultQuery entry ${JSON.stringify(name)}`,\n      );\n    }\n    if (isCredentialLikeMetadataName(name)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultQueryNames cannot classify credential-like name ${JSON.stringify(name)} as public`,\n      );\n    }\n    seen.add(name);\n  }\n  return [...names];\n}\n\nfunction normalizeRegistryProvider(provider: RegistryProvider): RegistryProvider {\n  const defaultHeaders = normalizeHeaderMap(provider.id, provider.defaultHeaders);\n  const defaultQuery = normalizeQueryMap(provider.id, provider.defaultQuery);\n  return {\n    ...provider,\n    baseUrl: normalizeRegistryBaseUrl(provider.baseUrl, provider.id),\n    ...(defaultHeaders === undefined ? {} : { defaultHeaders }),\n    ...(defaultQuery === undefined ? {} : { defaultQuery }),\n    ...(provider.publicDefaultHeaderNames === undefined\n      ? {}\n      : {\n          publicDefaultHeaderNames: normalizePublicHeaderNames(\n            provider.id,\n            provider.publicDefaultHeaderNames,\n            defaultHeaders,\n          ),\n        }),\n    ...(provider.publicDefaultQueryNames === undefined\n      ? {}\n      : {\n          publicDefaultQueryNames: normalizePublicQueryNames(\n            provider.id,\n            provider.publicDefaultQueryNames,\n            defaultQuery,\n          ),\n        }),\n  };\n}\n\nfunction normalizeModelPricingSchedule(\n  pricing: ModelPricing | ModelPricingScheduleV1,\n): ModelPricingScheduleV1 {\n  return \"default\" in pricing ? pricing : { default: pricing };\n}\n\nfunction normalizeCapabilities(capabilities: ModelCapabilitiesV1): ModelCapabilitiesV1 {\n  const parsed = ModelCapabilitiesV1Schema.parse(capabilities);\n  return {\n    ...parsed,\n    reasoning: {\n      ...parsed.reasoning,\n      efforts: [...parsed.reasoning.efforts].sort(\n        (left, right) =>\n          (REASONING_EFFORT_ORDER.get(left) ?? 0) - (REASONING_EFFORT_ORDER.get(right) ?? 0),\n      ),\n    },\n    inputModalities: [...parsed.inputModalities].sort(\n      (left, right) => (MODALITY_ORDER.get(left) ?? 0) - (MODALITY_ORDER.get(right) ?? 0),\n    ),\n    inputFileMediaTypes: [...new Set(parsed.inputFileMediaTypes)].sort(),\n    outputModalities: [...parsed.outputModalities].sort(\n      (left, right) => (MODALITY_ORDER.get(left) ?? 0) - (MODALITY_ORDER.get(right) ?? 0),\n    ),\n    latencyModes: [...parsed.latencyModes].sort(\n      (left, right) =>\n        (LATENCY_MODE_ORDER.get(left.id) ?? 0) - (LATENCY_MODE_ORDER.get(right.id) ?? 0),\n    ),\n  };\n}\n\nfunction legacyModelCapabilities(\n  settings: Settings,\n  input: {\n    reasoningEffort: boolean;\n    hostedWebSearch: boolean;\n    hostedImageGeneration?: boolean;\n    vision?: boolean;\n  },\n): ModelCapabilitiesV1 {\n  const reasoningEfforts = input.reasoningEffort ? configuredAllowedReasoningEfforts(settings) : [];\n  return normalizeCapabilities({\n    reasoning: {\n      upstream: input.reasoningEffort ? \"supported\" : \"unknown\",\n      runnable: input.reasoningEffort,\n      efforts: reasoningEfforts,\n      defaultEffort: input.reasoningEffort ? settings.openaiReasoningEffort : null,\n      required: false,\n    },\n    functionCalling: { upstream: \"unknown\", runnable: true },\n    structuredOutput: { upstream: \"unknown\", runnable: false },\n    hostedTools: {\n      webSearch: {\n        upstream: input.hostedWebSearch ? \"supported\" : \"unknown\",\n        runnable: input.hostedWebSearch,\n      },\n      xSearch: { upstream: \"unknown\", runnable: false },\n      codeExecution: { upstream: \"unknown\", runnable: false },\n      imageGeneration: {\n        upstream: input.hostedImageGeneration ? \"supported\" : \"unknown\",\n        runnable: input.hostedImageGeneration ?? false,\n      },\n    },\n    inputModalities: input.vision ? [\"text\", \"image\"] : [\"text\"],\n    inputFileMediaTypes: [\n      \"application/json\",\n      \"application/pdf\",\n      \"application/x-yaml\",\n      \"application/yaml\",\n      \"text/*\",\n    ],\n    outputModalities: [\"text\"],\n    transports: {\n      sse: { upstream: \"unknown\", runnable: true },\n      responsesWebSocket: { upstream: \"unknown\", runnable: false },\n      realtimeAudio: { upstream: \"unknown\", runnable: false },\n    },\n    latencyModes: [{ id: \"standard\", upstream: \"unknown\", runnable: true }],\n  });\n}\n\nexport function gatewayRequestPolicyForUpstreamModel(\n  upstreamModelId: string,\n  models: readonly GatewayCatalogModel[] = defaultGatewayCatalogModels(),\n): ConfiguredModel[\"requestPolicy\"] {\n  const model = models.find((candidate) => candidate.upstreamModelId === upstreamModelId);\n  if (!model) {\n    return undefined;\n  }\n  return {\n    gateway: {\n      only: [...model.providers] as [string, ...string[]],\n      caching: model.implicitCaching ? \"auto\" : \"none\",\n    },\n  };\n}\n\nfunction gatewayModelCapabilities(\n  settings: Settings,\n  input: {\n    implicitCaching: boolean;\n    vision: boolean;\n    inputFileMediaTypes?: string[];\n  },\n): ModelCapabilitiesV1 {\n  const legacy = legacyModelCapabilities(settings, {\n    reasoningEffort: true,\n    hostedWebSearch: false,\n  });\n  return normalizeCapabilities({\n    ...legacy,\n    functionCalling: { upstream: \"supported\", runnable: true },\n    inputModalities: input.vision ? [\"text\", \"image\"] : [\"text\"],\n    inputFileMediaTypes: input.inputFileMediaTypes ?? [],\n    transports: {\n      ...legacy.transports,\n      sse: { upstream: \"supported\", runnable: true },\n    },\n    promptCaching: input.implicitCaching\n      ? { upstream: \"supported\", runnable: true, mode: \"implicit\" }\n      : { upstream: \"unsupported\", runnable: false, mode: \"none\" },\n    // Both Gateway products expose one reviewed route policy and no separately\n    // billed latency mode.\n    latencyModes: [{ id: \"standard\", upstream: \"supported\", runnable: true }],\n  });\n}\n\nfunction openRouterCustomModelCapabilities(settings: Settings): ModelCapabilitiesV1 {\n  const legacy = legacyModelCapabilities(settings, {\n    reasoningEffort: false,\n    hostedWebSearch: false,\n  });\n  return normalizeCapabilities({\n    ...legacy,\n    functionCalling: { upstream: \"supported\", runnable: true },\n    inputModalities: [\"text\"],\n    inputFileMediaTypes: [],\n    transports: {\n      ...legacy.transports,\n      sse: { upstream: \"supported\", runnable: true },\n    },\n    promptCaching: { upstream: \"unsupported\", runnable: false, mode: \"none\" },\n    latencyModes: [{ id: \"standard\", upstream: \"supported\", runnable: true }],\n  });\n}\n\nfunction gatewayRegistryProvider(\n  settings: Settings,\n  input:\n    | { kind: \"vercel-gateway-managed\"; apiKey: string }\n    | {\n        kind: \"vercel-gateway-workspace\" | \"vercel-gateway-organization\";\n        apiKey?: string;\n        customModels?: readonly {\n          upstreamModelId: string;\n          label?: string | null;\n        }[];\n      },\n): InternalRegistryProvider {\n  const workspace = input.kind === \"vercel-gateway-workspace\";\n  const organization = input.kind === \"vercel-gateway-organization\";\n  const scoped = workspace || organization;\n  const curated = organization ? [] : configuredGatewayCatalogModels(settings);\n  const upstreamIds = new Set(curated.map((model) => model.upstreamModelId));\n  const productIds = new Set(\n    parseModelProvidersJson(settings.modelProvidersJson)\n      .filter(\n        (provider) =>\n          provider.id !== WORKSPACE_GATEWAY_PROVIDER_ID &&\n          provider.id !== ORGANIZATION_GATEWAY_PROVIDER_ID,\n      )\n      .flatMap((provider) =>\n        provider.models.flatMap((model) => [model.id, ...(model.aliases ?? [])]),\n      ),\n  );\n  const models = curated.map((model) => {\n    const id = workspace\n      ? model.workspaceProductId\n      : organization\n        ? `${ORGANIZATION_GATEWAY_MODEL_ID_PREFIX}${model.upstreamModelId}`\n        : model.productId;\n    productIds.add(id);\n    return {\n      id,\n      upstreamModelId: model.upstreamModelId,\n      label: model.label,\n      ...(model.shortLabel ? { shortLabel: model.shortLabel } : {}),\n      ...(model.logoUrl ? { logoUrl: model.logoUrl } : {}),\n      capabilities: gatewayModelCapabilities(settings, {\n        implicitCaching: model.implicitCaching,\n        vision: model.vision,\n        inputFileMediaTypes: model.inputFileMediaTypes,\n      }),\n      contextWindowTokens: model.contextWindowTokens,\n      effectiveContextWindowTokens: model.effectiveContextWindowTokens,\n      autoCompactTokenLimit: model.autoCompactTokenLimit,\n      toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n      ...(model.pricing === undefined ? {} : { pricing: model.pricing }),\n    };\n  });\n  if (scoped) {\n    for (const custom of input.customModels ?? []) {\n      const productId = `${workspace ? WORKSPACE_GATEWAY_MODEL_ID_PREFIX : ORGANIZATION_GATEWAY_MODEL_ID_PREFIX}${custom.upstreamModelId}`;\n      // Deployment membership wins over an older or concurrently-created\n      // workspace row with the same upstream identity or generated product id.\n      // This keeps runtime routing deterministic and prevents a legacy/admin\n      // row from making the entire workspace catalog fail uniqueness checks.\n      if (upstreamIds.has(custom.upstreamModelId) || productIds.has(productId)) continue;\n      upstreamIds.add(custom.upstreamModelId);\n      productIds.add(productId);\n      models.push({\n        id: productId,\n        upstreamModelId: custom.upstreamModelId,\n        label: custom.label?.trim() || custom.upstreamModelId,\n        capabilities: gatewayModelCapabilities(settings, {\n          implicitCaching: false,\n          vision: false,\n          inputFileMediaTypes: [],\n        }),\n        contextWindowTokens: 1_000_000,\n        effectiveContextWindowTokens: 900_000,\n        autoCompactTokenLimit: 850_000,\n        toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n      });\n    }\n  }\n  return {\n    kind: input.kind,\n    id: workspace\n      ? WORKSPACE_GATEWAY_PROVIDER_ID\n      : organization\n        ? ORGANIZATION_GATEWAY_PROVIDER_ID\n        : OPENGENI_GATEWAY_PROVIDER_ID,\n    label: workspace ? \"Your Gateway\" : organization ? \"Organization Gateway\" : \"Opengeni\",\n    // Responses preserves vision, reasoning items, and provider-native usage.\n    // Model-specific compatibility stays at the reviewed request fence rather\n    // than downgrading the whole provider wire.\n    api: \"responses\",\n    wireProfile: \"openai\",\n    baseUrl: VERCEL_AI_GATEWAY_BASE_URL,\n    ...(input.apiKey ? { apiKey: input.apiKey } : {}),\n    models,\n  };\n}\n\nfunction openRouterRegistryProvider(\n  settings: Settings,\n  input:\n    | { kind: \"openrouter-managed\"; apiKey: string }\n    | {\n        kind: \"openrouter-workspace\" | \"openrouter-organization\";\n        apiKey?: string;\n        customModels?: readonly {\n          upstreamModelId: string;\n          label?: string | null;\n        }[];\n      },\n): InternalRegistryProvider | null {\n  const workspace = input.kind === \"openrouter-workspace\";\n  const organization = input.kind === \"openrouter-organization\";\n  const scoped = workspace || organization;\n  const curated = organization ? [] : configuredOpenRouterCatalogModels(settings);\n  const upstreamIds = new Set(curated.map((model) => model.upstreamModelId));\n  const productIds = new Set(\n    parseModelProvidersJson(settings.modelProvidersJson)\n      .filter(\n        (provider) =>\n          provider.id !== WORKSPACE_OPENROUTER_PROVIDER_ID &&\n          provider.id !== ORGANIZATION_OPENROUTER_PROVIDER_ID,\n      )\n      .flatMap((provider) =>\n        provider.models.flatMap((model) => [model.id, ...(model.aliases ?? [])]),\n      ),\n  );\n  const models: RegistryProvider[\"models\"] = curated.map((model) => {\n    const id = workspace\n      ? workspaceOpenRouterProductId(model.upstreamModelId)\n      : organization\n        ? `${ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX}${model.upstreamModelId}`\n        : `${OPENROUTER_MODEL_ID_PREFIX}${model.upstreamModelId}`;\n    const aliases = workspace\n      ? model.aliases.map(workspaceOpenRouterProductId)\n      : organization\n        ? model.aliases.map((alias) => `${ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX}${alias}`)\n        : model.aliases;\n    productIds.add(id);\n    for (const alias of aliases) productIds.add(alias);\n    return {\n      id,\n      upstreamModelId: model.upstreamModelId,\n      aliases,\n      label: model.label,\n      ...(model.shortLabel ? { shortLabel: model.shortLabel } : {}),\n      ...(model.logoUrl ? { logoUrl: model.logoUrl } : {}),\n      capabilities: model.capabilities,\n      ...(model.contextWindowTokens === undefined\n        ? {}\n        : { contextWindowTokens: model.contextWindowTokens }),\n      ...(model.effectiveContextWindowTokens === undefined\n        ? {}\n        : { effectiveContextWindowTokens: model.effectiveContextWindowTokens }),\n      ...(model.autoCompactTokenLimit === undefined\n        ? {}\n        : { autoCompactTokenLimit: model.autoCompactTokenLimit }),\n      toolOutputTruncationTokens:\n        model.toolOutputTruncationTokens ?? settings.modelToolOutputTruncationTokens,\n    };\n  });\n  if (scoped) {\n    for (const custom of input.customModels ?? []) {\n      const productId = `${workspace ? WORKSPACE_OPENROUTER_MODEL_ID_PREFIX : ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX}${custom.upstreamModelId}`;\n      if (upstreamIds.has(custom.upstreamModelId) || productIds.has(productId)) continue;\n      upstreamIds.add(custom.upstreamModelId);\n      productIds.add(productId);\n      models.push({\n        id: productId,\n        upstreamModelId: custom.upstreamModelId,\n        aliases: [],\n        label: custom.label?.trim() || custom.upstreamModelId,\n        capabilities: openRouterCustomModelCapabilities(settings),\n        toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n      });\n    }\n  }\n  if (models.length === 0) return null;\n  const defaultHeaders: Record<string, string> = {\n    \"x-title\": \"Opengeni\",\n    ...(settings.publicBaseUrl ? { \"http-referer\": settings.publicBaseUrl } : {}),\n  };\n  return {\n    kind: input.kind,\n    id: workspace\n      ? WORKSPACE_OPENROUTER_PROVIDER_ID\n      : organization\n        ? ORGANIZATION_OPENROUTER_PROVIDER_ID\n        : OPENROUTER_PROVIDER_ID,\n    label: workspace ? \"Your OpenRouter\" : organization ? \"Organization OpenRouter\" : \"OpenRouter\",\n    api: \"chat\",\n    wireProfile: \"openai\",\n    baseUrl: OPENROUTER_BASE_URL,\n    ...(input.apiKey ? { apiKey: input.apiKey } : {}),\n    defaultHeaders,\n    publicDefaultHeaderNames: Object.keys(defaultHeaders),\n    models,\n  };\n}\n\nfunction opperRegistryProvider(\n  settings: Settings,\n  input:\n    | { kind: \"opper-managed\"; apiKey: string }\n    | {\n        kind: \"opper-workspace\" | \"opper-organization\";\n        apiKey?: string;\n        customModels?: readonly {\n          upstreamModelId: string;\n          label?: string | null;\n        }[];\n      },\n): InternalRegistryProvider | null {\n  const workspace = input.kind === \"opper-workspace\";\n  const organization = input.kind === \"opper-organization\";\n  const scoped = workspace || organization;\n  const curated = organization ? [] : configuredOpperCatalogModels(settings);\n  const upstreamIds = new Set(curated.map((model) => model.upstreamModelId));\n  const productIds = new Set(\n    parseModelProvidersJson(settings.modelProvidersJson)\n      .filter(\n        (provider) =>\n          provider.id !== WORKSPACE_OPPER_PROVIDER_ID &&\n          provider.id !== ORGANIZATION_OPPER_PROVIDER_ID,\n      )\n      .flatMap((provider) =>\n        provider.models.flatMap((model) => [model.id, ...(model.aliases ?? [])]),\n      ),\n  );\n  const models: RegistryProvider[\"models\"] = curated.map((model) => {\n    const id = workspace\n      ? workspaceOpperProductId(model.upstreamModelId)\n      : `${OPPER_MODEL_ID_PREFIX}${model.upstreamModelId}`;\n    const aliases = workspace ? model.aliases.map(workspaceOpperProductId) : model.aliases;\n    productIds.add(id);\n    for (const alias of aliases) productIds.add(alias);\n    return {\n      id,\n      upstreamModelId: model.upstreamModelId,\n      aliases,\n      label: model.label,\n      ...(model.shortLabel ? { shortLabel: model.shortLabel } : {}),\n      ...(model.logoUrl ? { logoUrl: model.logoUrl } : {}),\n      capabilities: model.capabilities,\n      ...(model.contextWindowTokens === undefined\n        ? {}\n        : { contextWindowTokens: model.contextWindowTokens }),\n      ...(model.effectiveContextWindowTokens === undefined\n        ? {}\n        : { effectiveContextWindowTokens: model.effectiveContextWindowTokens }),\n      ...(model.autoCompactTokenLimit === undefined\n        ? {}\n        : { autoCompactTokenLimit: model.autoCompactTokenLimit }),\n      toolOutputTruncationTokens:\n        model.toolOutputTruncationTokens ?? settings.modelToolOutputTruncationTokens,\n      // Price authority is the reviewed code snapshot (or a code-defined\n      // entry's own reviewed rate), never a database catalog document.\n      ...(() => {\n        const pricing = model.pricing ?? reviewedOpperModelPricing(model.upstreamModelId);\n        return pricing === undefined ? {} : { pricing };\n      })(),\n    };\n  });\n  if (scoped) {\n    // An organization custom id that names a configured deployment route\n    // inherits that reviewed definition (capabilities and limits); the\n    // workspace rail already lists those routes as curated products.\n    const configuredByUpstream = new Map(\n      configuredOpperCatalogModels(settings).map((model) => [model.upstreamModelId, model]),\n    );\n    for (const custom of input.customModels ?? []) {\n      const productId = `${workspace ? WORKSPACE_OPPER_MODEL_ID_PREFIX : ORGANIZATION_OPPER_MODEL_ID_PREFIX}${custom.upstreamModelId}`;\n      // Deployment membership wins over a workspace row with the same identity.\n      if (upstreamIds.has(custom.upstreamModelId) || productIds.has(productId)) continue;\n      upstreamIds.add(custom.upstreamModelId);\n      productIds.add(productId);\n      const reviewed = configuredByUpstream.get(custom.upstreamModelId);\n      models.push({\n        id: productId,\n        upstreamModelId: custom.upstreamModelId,\n        aliases: [],\n        label: custom.label?.trim() || reviewed?.label || custom.upstreamModelId,\n        ...(reviewed?.shortLabel && !custom.label?.trim()\n          ? { shortLabel: reviewed.shortLabel }\n          : {}),\n        capabilities:\n          reviewed?.capabilities ?? opperCustomModelCapabilities(custom.upstreamModelId),\n        ...(reviewed?.contextWindowTokens === undefined\n          ? {}\n          : { contextWindowTokens: reviewed.contextWindowTokens }),\n        ...(reviewed?.effectiveContextWindowTokens === undefined\n          ? {}\n          : { effectiveContextWindowTokens: reviewed.effectiveContextWindowTokens }),\n        ...(reviewed?.autoCompactTokenLimit === undefined\n          ? {}\n          : { autoCompactTokenLimit: reviewed.autoCompactTokenLimit }),\n        toolOutputTruncationTokens:\n          reviewed?.toolOutputTruncationTokens ?? settings.modelToolOutputTruncationTokens,\n      });\n    }\n  }\n  if (models.length === 0) return null;\n  return {\n    kind: input.kind,\n    id: workspace\n      ? WORKSPACE_OPPER_PROVIDER_ID\n      : organization\n        ? ORGANIZATION_OPPER_PROVIDER_ID\n        : OPPER_PROVIDER_ID,\n    label: workspace ? \"Your Opper\" : organization ? \"Organization Opper\" : \"Opper\",\n    api: \"chat\",\n    wireProfile: \"openai\",\n    baseUrl: OPPER_BASE_URL,\n    // Opper streams only SSE keepalives while a route thinks with hidden\n    // reasoning (Claude via Bedrock returns no reasoning deltas). A live\n    // `max`-effort Opus 5.5 request sent keepalives and no model progress for\n    // more than 10 minutes, so the deployment 10-minute progress bound would\n    // abort and replay legitimate thinking. The byte-silence bound still\n    // catches a dead connection.\n    streamProgressTimeoutMs: OPPER_STREAM_PROGRESS_TIMEOUT_MS,\n    ...(input.apiKey ? { apiKey: input.apiKey } : {}),\n    models,\n  };\n}\n\nfunction configuredRegistryProviders(settings: Settings): InternalRegistryProvider[] {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  const injected: InternalRegistryProvider[] = providers.filter(\n    (provider) =>\n      settings.claudeSubscriptionEnabled ||\n      !(provider.api === \"anthropic-messages\" && provider.anthropic?.auth === \"oauth\"),\n  );\n  if (settings.vercelAiGatewayApiKey && configuredGatewayCatalogModels(settings).length > 0) {\n    injected.push(\n      gatewayRegistryProvider(settings, {\n        kind: \"vercel-gateway-managed\",\n        apiKey: settings.vercelAiGatewayApiKey,\n      }),\n    );\n  }\n  const openrouter = settings.openrouterApiKey\n    ? openRouterRegistryProvider(settings, {\n        kind: \"openrouter-managed\",\n        apiKey: settings.openrouterApiKey,\n      })\n    : null;\n  if (openrouter) injected.push(openrouter);\n  const opper = settings.opperApiKey\n    ? opperRegistryProvider(settings, { kind: \"opper-managed\", apiKey: settings.opperApiKey })\n    : null;\n  if (opper) injected.push(opper);\n  return injected;\n}\n\n/** Customer-owned OpenAI/Azure routes, bound to immutable connection identity. */\nexport function withDirectModelProviders(\n  settings: Settings,\n  connections: readonly {\n    id: string;\n    version: number;\n    subjectId: string | null;\n    kind: string;\n    status: string;\n    providerDomain: string;\n    metadata: Record<string, unknown>;\n    apiKey?: string;\n  }[],\n): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson).filter(\n    (provider) =>\n      !provider.id.startsWith(\"workspace-openai-\") &&\n      !provider.id.startsWith(\"workspace-azure-openai-\"),\n  );\n  for (const connection of connections) {\n    const spec = directModelConnectionSpec(connection);\n    if (!spec) continue;\n    providers.push({\n      kind: spec.provider === \"openai\" ? \"direct-openai-workspace\" : \"direct-azure-workspace\",\n      id: spec.providerId,\n      label: spec.provider === \"openai\" ? \"Your OpenAI\" : \"Your Azure OpenAI\",\n      api: \"responses\",\n      wireProfile: spec.provider === \"openai\" ? \"openai\" : \"azure-openai\",\n      baseUrl: spec.baseUrl,\n      ...(connection.apiKey ? { apiKey: connection.apiKey } : {}),\n      models: [\n        {\n          id: spec.modelId,\n          upstreamModelId: spec.model,\n          label: spec.model,\n          capabilities: legacyModelCapabilities(settings, {\n            reasoningEffort: false,\n            hostedWebSearch: false,\n          }),\n          toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n        },\n      ],\n    });\n  }\n  return { ...settings, modelProvidersJson: JSON.stringify(providers) };\n}\n\n/** Static catalog overlay; it contains no concrete workspace credential. */\nexport function withWorkspaceGatewayCatalogProvider(\n  settings: Settings,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  const withoutWorkspace = providers.filter(\n    (provider) => provider.id !== WORKSPACE_GATEWAY_PROVIDER_ID,\n  );\n  const curatedCount = configuredGatewayCatalogModels(settings).length;\n  if (curatedCount === 0 && customModels.length === 0) return settings;\n  return {\n    ...settings,\n    modelProvidersJson: JSON.stringify([\n      ...withoutWorkspace,\n      gatewayRegistryProvider(settings, {\n        kind: \"vercel-gateway-workspace\",\n        customModels,\n      }),\n    ]),\n  };\n}\n\n/** Runtime overlay after the worker resolves the workspace's encrypted key. */\nexport function withWorkspaceGatewayCredential(\n  settings: Settings,\n  apiKey: string,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  if (!apiKey.trim()) {\n    throw new Error(\"workspace AI Gateway credential is empty\");\n  }\n  const catalogSettings = withWorkspaceGatewayCatalogProvider(settings, customModels);\n  const providers = parseModelProvidersJson(catalogSettings.modelProvidersJson).map((provider) =>\n    provider.id === WORKSPACE_GATEWAY_PROVIDER_ID ? { ...provider, apiKey } : provider,\n  );\n  return { ...catalogSettings, modelProvidersJson: JSON.stringify(providers) };\n}\n\n/** Static OpenRouter catalog overlay; it contains no concrete workspace credential. */\nexport function withWorkspaceOpenRouterCatalogProvider(\n  settings: Settings,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  const withoutWorkspace = providers.filter(\n    (provider) => provider.id !== WORKSPACE_OPENROUTER_PROVIDER_ID,\n  );\n  const provider = openRouterRegistryProvider(settings, {\n    kind: \"openrouter-workspace\",\n    customModels,\n  });\n  if (!provider) return settings;\n  return {\n    ...settings,\n    modelProvidersJson: JSON.stringify([...withoutWorkspace, provider]),\n  };\n}\n\n/** Runtime overlay after the worker resolves the workspace's encrypted OpenRouter key. */\nexport function withWorkspaceOpenRouterCredential(\n  settings: Settings,\n  apiKey: string,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  if (!apiKey.trim()) {\n    throw new Error(\"workspace OpenRouter credential is empty\");\n  }\n  const catalogSettings = withWorkspaceOpenRouterCatalogProvider(settings, customModels);\n  const providers = parseModelProvidersJson(catalogSettings.modelProvidersJson).map((provider) =>\n    provider.id === WORKSPACE_OPENROUTER_PROVIDER_ID ? { ...provider, apiKey } : provider,\n  );\n  return { ...catalogSettings, modelProvidersJson: JSON.stringify(providers) };\n}\n\n/** Static Opper catalog overlay; it contains no concrete workspace credential. */\nexport function withWorkspaceOpperCatalogProvider(\n  settings: Settings,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  const withoutWorkspace = providers.filter(\n    (provider) => provider.id !== WORKSPACE_OPPER_PROVIDER_ID,\n  );\n  const provider = opperRegistryProvider(settings, {\n    kind: \"opper-workspace\",\n    customModels,\n  });\n  if (!provider) return settings;\n  return {\n    ...settings,\n    modelProvidersJson: JSON.stringify([...withoutWorkspace, provider]),\n  };\n}\n\n/** Runtime overlay after the worker resolves the workspace's encrypted Opper key. */\nexport function withWorkspaceOpperCredential(\n  settings: Settings,\n  apiKey: string,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  if (!apiKey.trim()) {\n    throw new Error(\"workspace Opper credential is empty\");\n  }\n  const catalogSettings = withWorkspaceOpperCatalogProvider(settings, customModels);\n  const providers = parseModelProvidersJson(catalogSettings.modelProvidersJson).map((provider) =>\n    provider.id === WORKSPACE_OPPER_PROVIDER_ID ? { ...provider, apiKey } : provider,\n  );\n  return { ...catalogSettings, modelProvidersJson: JSON.stringify(providers) };\n}\n\n/** Secret-free organization Opper catalog overlay. */\nexport function withOrganizationOpperCatalogProvider(\n  settings: Settings,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson).filter(\n    (provider) => provider.id !== ORGANIZATION_OPPER_PROVIDER_ID,\n  );\n  const provider = opperRegistryProvider(settings, {\n    kind: \"opper-organization\",\n    customModels,\n  });\n  return provider\n    ? { ...settings, modelProvidersJson: JSON.stringify([...providers, provider]) }\n    : settings;\n}\n\nexport function withOrganizationOpperCredential(\n  settings: Settings,\n  apiKey: string,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  if (!apiKey.trim()) throw new Error(\"organization Opper credential is empty\");\n  const catalog = withOrganizationOpperCatalogProvider(settings, customModels);\n  const providers = parseModelProvidersJson(catalog.modelProvidersJson).map((provider) =>\n    provider.id === ORGANIZATION_OPPER_PROVIDER_ID ? { ...provider, apiKey } : provider,\n  );\n  return { ...catalog, modelProvidersJson: JSON.stringify(providers) };\n}\n\n/** The organization's own OpenAI or Azure OpenAI key (a direct, non-gateway route). */\nexport type OrganizationDirectModelProvider = \"openai\" | \"azure_openai\";\n\nconst ORGANIZATION_DIRECT_ROUTES = {\n  openai: {\n    kind: \"direct-openai-organization\",\n    id: ORGANIZATION_OPENAI_PROVIDER_ID,\n    prefix: ORGANIZATION_OPENAI_MODEL_ID_PREFIX,\n    label: \"Organization OpenAI\",\n    wireProfile: \"openai\",\n  },\n  azure_openai: {\n    kind: \"direct-azure-organization\",\n    id: ORGANIZATION_AZURE_OPENAI_PROVIDER_ID,\n    prefix: ORGANIZATION_AZURE_OPENAI_MODEL_ID_PREFIX,\n    label: \"Organization Azure OpenAI\",\n    wireProfile: \"azure-openai\",\n  },\n} as const;\n\n/** The organization direct route a product model id belongs to, if any. */\nexport function organizationDirectModelProviderOf(\n  modelId: string | null | undefined,\n): OrganizationDirectModelProvider | null {\n  if (modelId?.startsWith(ORGANIZATION_OPENAI_MODEL_ID_PREFIX)) return \"openai\";\n  if (modelId?.startsWith(ORGANIZATION_AZURE_OPENAI_MODEL_ID_PREFIX)) return \"azure_openai\";\n  return null;\n}\n\nexport function organizationDirectModelIdPrefix(provider: OrganizationDirectModelProvider): string {\n  return ORGANIZATION_DIRECT_ROUTES[provider].prefix;\n}\n\n/**\n * One organization-owned OpenAI or Azure OpenAI route with its curated models.\n * A custom model's `upstreamModelId` is the exact OpenAI model or Azure\n * deployment name. Capabilities match the workspace direct routes: Responses\n * with ordinary function tools only, no reasoning control or hosted web search\n * inferred for an arbitrary model or deployment name.\n */\nfunction organizationDirectRegistryProvider(\n  settings: Settings,\n  provider: OrganizationDirectModelProvider,\n  input: {\n    endpoint?: string | null | undefined;\n    models: readonly { upstreamModelId: string; label?: string | null }[];\n    apiKey?: string;\n  },\n): InternalRegistryProvider | null {\n  const route = ORGANIZATION_DIRECT_ROUTES[provider];\n  const baseUrl =\n    provider === \"openai\"\n      ? \"https://api.openai.com/v1\"\n      : input.endpoint\n        ? organizationAzureOpenAIBaseUrl(input.endpoint)\n        : null;\n  if (!baseUrl) return null;\n  const seen = new Set<string>();\n  const models: RegistryProvider[\"models\"] = [];\n  for (const model of input.models) {\n    if (seen.has(model.upstreamModelId)) continue;\n    seen.add(model.upstreamModelId);\n    models.push({\n      id: `${route.prefix}${model.upstreamModelId}`,\n      upstreamModelId: model.upstreamModelId,\n      aliases: [],\n      label: model.label?.trim() || model.upstreamModelId,\n      capabilities: legacyModelCapabilities(settings, {\n        reasoningEffort: false,\n        hostedWebSearch: false,\n      }),\n      toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n    });\n  }\n  if (models.length === 0) return null;\n  return {\n    kind: route.kind,\n    id: route.id,\n    label: route.label,\n    api: \"responses\",\n    wireProfile: route.wireProfile,\n    baseUrl,\n    ...(input.apiKey ? { apiKey: input.apiKey } : {}),\n    models,\n  };\n}\n\n/**\n * The official `https://<resource>.openai.azure.com/openai/v1` base for a\n * stored organization endpoint, or null for anything else. The API validates\n * the endpoint on write; this keeps a malformed persisted value from routing.\n */\nfunction organizationAzureOpenAIBaseUrl(endpoint: string): string | null {\n  let url: URL;\n  try {\n    url = new URL(endpoint);\n  } catch {\n    return null;\n  }\n  if (\n    url.protocol !== \"https:\" ||\n    url.username ||\n    url.password ||\n    url.port ||\n    url.search ||\n    url.hash ||\n    !/^[a-z0-9-]+\\.openai\\.azure\\.com$/i.test(url.hostname) ||\n    ![\"\", \"/\", \"/openai/v1\", \"/openai/v1/\"].includes(url.pathname)\n  )\n    return null;\n  return `${url.origin}/openai/v1`;\n}\n\nfunction withOrganizationDirectProvider(\n  settings: Settings,\n  provider: OrganizationDirectModelProvider,\n  overlay: InternalRegistryProvider | null,\n): Settings {\n  if (!overlay) return settings;\n  const providers = parseModelProvidersJson(settings.modelProvidersJson).filter(\n    (candidate) => candidate.id !== ORGANIZATION_DIRECT_ROUTES[provider].id,\n  );\n  return { ...settings, modelProvidersJson: JSON.stringify([...providers, overlay]) };\n}\n\n/** Secret-free organization OpenAI or Azure OpenAI catalog overlay (models, and Azure's endpoint). */\nexport function withOrganizationDirectCatalogProvider(\n  settings: Settings,\n  provider: OrganizationDirectModelProvider,\n  input: {\n    endpoint?: string | null | undefined;\n    models: readonly { upstreamModelId: string; label?: string | null }[];\n  },\n): Settings {\n  return withOrganizationDirectProvider(\n    settings,\n    provider,\n    organizationDirectRegistryProvider(settings, provider, input),\n  );\n}\n\n/** Runtime overlay after the worker resolves the organization's encrypted key. */\nexport function withOrganizationDirectCredential(\n  settings: Settings,\n  provider: OrganizationDirectModelProvider,\n  apiKey: string,\n  input: {\n    endpoint?: string | null | undefined;\n    models: readonly { upstreamModelId: string; label?: string | null }[];\n  },\n): Settings {\n  if (!apiKey.trim()) throw new Error(`organization ${provider} credential is empty`);\n  return withOrganizationDirectProvider(\n    settings,\n    provider,\n    organizationDirectRegistryProvider(settings, provider, { ...input, apiKey }),\n  );\n}\n\n/** Secret-free organization Azure OpenAI catalog overlay (endpoint + deployments). */\nexport function withOrganizationAzureOpenAICatalogProvider(\n  settings: Settings,\n  input: {\n    endpoint: string | null | undefined;\n    models: readonly { upstreamModelId: string; label?: string | null }[];\n  },\n): Settings {\n  return withOrganizationDirectCatalogProvider(settings, \"azure_openai\", input);\n}\n\n/** Runtime overlay after the worker resolves the organization's encrypted Azure key. */\nexport function withOrganizationAzureOpenAICredential(\n  settings: Settings,\n  apiKey: string,\n  input: {\n    endpoint: string | null | undefined;\n    models: readonly { upstreamModelId: string; label?: string | null }[];\n  },\n): Settings {\n  return withOrganizationDirectCredential(settings, \"azure_openai\", apiKey, input);\n}\n\n/** Secret-free organization Vercel AI Gateway catalog overlay. */\nexport function withOrganizationGatewayCatalogProvider(\n  settings: Settings,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  if (customModels.length === 0) return settings;\n  const providers = parseModelProvidersJson(settings.modelProvidersJson).filter(\n    (provider) => provider.id !== ORGANIZATION_GATEWAY_PROVIDER_ID,\n  );\n  const provider = gatewayRegistryProvider(settings, {\n    kind: \"vercel-gateway-organization\",\n    customModels,\n  });\n  return { ...settings, modelProvidersJson: JSON.stringify([...providers, provider]) };\n}\n\nexport function withOrganizationGatewayCredential(\n  settings: Settings,\n  apiKey: string,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  if (!apiKey.trim()) throw new Error(\"organization AI Gateway credential is empty\");\n  const catalog = withOrganizationGatewayCatalogProvider(settings, customModels);\n  const providers = parseModelProvidersJson(catalog.modelProvidersJson).map((provider) =>\n    provider.id === ORGANIZATION_GATEWAY_PROVIDER_ID ? { ...provider, apiKey } : provider,\n  );\n  return { ...catalog, modelProvidersJson: JSON.stringify(providers) };\n}\n\n/** Secret-free organization OpenRouter catalog overlay. */\nexport function withOrganizationOpenRouterCatalogProvider(\n  settings: Settings,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson).filter(\n    (provider) => provider.id !== ORGANIZATION_OPENROUTER_PROVIDER_ID,\n  );\n  const provider = openRouterRegistryProvider(settings, {\n    kind: \"openrouter-organization\",\n    customModels,\n  });\n  return provider\n    ? { ...settings, modelProvidersJson: JSON.stringify([...providers, provider]) }\n    : settings;\n}\n\nexport function withOrganizationOpenRouterCredential(\n  settings: Settings,\n  apiKey: string,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  if (!apiKey.trim()) throw new Error(\"organization OpenRouter credential is empty\");\n  const catalog = withOrganizationOpenRouterCatalogProvider(settings, customModels);\n  const providers = parseModelProvidersJson(catalog.modelProvidersJson).map((provider) =>\n    provider.id === ORGANIZATION_OPENROUTER_PROVIDER_ID ? { ...provider, apiKey } : provider,\n  );\n  return { ...catalog, modelProvidersJson: JSON.stringify(providers) };\n}\n\n/** OpenAI GPT-5.6 Fast mode is 2× Standard list rates (service_tier fast/priority). */\nconst GPT56_FAST_BILLING_MULTIPLIER_BPS = 20_000;\n/**\n * OpenAI Ultrafast is 6× Standard list rates (service_tier ultrafast). Codex\n * subscriptions count it against included limits at 8×; those limits are\n * observed from the provider's own usage readings, not priced here.\n */\nconst ULTRAFAST_BILLING_MULTIPLIER_BPS = 60_000;\n/** Upstream slugs OpenAI serves at the Ultrafast tier. */\nconst ULTRAFAST_UPSTREAM_SLUGS: readonly string[] = [\"gpt-6-astra\", \"gpt-6.1-sol\"];\n\n/**\n * Ultrafast for a model id (`gpt-6-astra` or `codex/gpt-6-astra`), when OpenAI\n * serves its slug at that tier. Codex accounts must still advertise the tier:\n * placement serves an Ultrafast turn only from an account whose live model\n * list includes it for that model.\n */\nfunction ultrafastLatencyModeForModel(modelId: string):\n  | {\n      id: \"ultrafast\";\n      upstream: \"supported\";\n      runnable: true;\n      billingMultiplierBps: number;\n    }\n  | undefined {\n  const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX)\n    ? modelId.slice(CODEX_MODEL_ID_PREFIX.length)\n    : modelId;\n  return ULTRAFAST_UPSTREAM_SLUGS.includes(slug)\n    ? {\n        id: \"ultrafast\",\n        upstream: \"supported\",\n        runnable: true,\n        billingMultiplierBps: ULTRAFAST_BILLING_MULTIPLIER_BPS,\n      }\n    : undefined;\n}\n\n/**\n * Product display label for catalog/picker UI.\n * Same string for OpenAI and Codex copies of a slug (`gpt-5.6-luna` and\n * `codex/gpt-5.6-luna` → `GPT-5.6 Luna`). Curated Grok slugs receive the same\n * product casing; other ids pass through unchanged.\n */\nexport function productLabelForModelId(modelId: string): string {\n  const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX)\n    ? modelId.slice(CODEX_MODEL_ID_PREFIX.length)\n    : modelId;\n  const grokMatch = /^grok-(\\d+(?:\\.\\d+)?)$/i.exec(slug);\n  if (grokMatch) {\n    return `Grok ${grokMatch[1]}`;\n  }\n  const match = /^(gpt-\\d+(?:\\.\\d+)?)(?:-(.+))?$/i.exec(slug);\n  if (!match) {\n    return slug;\n  }\n  const family = match[1]!.replace(/^gpt/i, \"GPT\");\n  const rest = match[2];\n  if (!rest) {\n    return family;\n  }\n  const suffix = rest\n    .split(\"-\")\n    .filter((part) => part.length > 0)\n    .map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase())\n    .join(\" \");\n  return suffix.length > 0 ? `${family} ${suffix}` : family;\n}\n\n/**\n * Curated compact product labels for dense UI. Unknown model slugs return null\n * so callers fall back to the full `label`.\n */\nexport function productShortLabelForModelId(modelId: string): string | null {\n  const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX)\n    ? modelId.slice(CODEX_MODEL_ID_PREFIX.length)\n    : modelId;\n  switch (slug) {\n    case \"grok-4.7\":\n      return \"4.7\";\n    case \"gpt-5.6-sol\":\n      return \"5.6 Sol\";\n    case \"gpt-5.6-terra\":\n      return \"5.6 Terra\";\n    case \"gpt-5.6-luna\":\n      return \"5.6 Luna\";\n    case \"gpt-6-astra\":\n      return \"6 Astra\";\n    case \"gpt-6-sol\":\n      return \"6 Sol\";\n    case \"gpt-6-luna\":\n      return \"6 Luna\";\n    default:\n      return null;\n  }\n}\n\nconst BUILTIN_GPT56_MODEL_IDS = [\"gpt-5.6-sol\", \"gpt-5.6-terra\", \"gpt-5.6-luna\"] as const;\n\nfunction isBuiltinGpt56ModelId(modelId: string): boolean {\n  return (BUILTIN_GPT56_MODEL_IDS as readonly string[]).includes(modelId);\n}\n\n/** Billed GPT-5.6 uses the same raw/effective/auto-compact catalog as Codex. */\nfunction builtinContextLimitsForModel(\n  settings: Settings,\n  modelId: string,\n): Pick<\n  ConfiguredModel,\n  \"contextWindowTokens\" | \"effectiveContextWindowTokens\" | \"autoCompactTokenLimit\"\n> {\n  if (isBuiltinGpt56ModelId(modelId)) {\n    return {\n      contextWindowTokens: CODEX_MODEL_CONTEXT_WINDOW_TOKENS,\n      effectiveContextWindowTokens: CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,\n      autoCompactTokenLimit: CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT,\n    };\n  }\n  return { contextWindowTokens: settings.contextWindowTokens };\n}\n\nfunction builtinLatencyModesForModel(modelId: string): Array<{\n  id: z.infer<typeof ModelLatencyModeV1>;\n  upstream: \"supported\" | \"unsupported\" | \"unknown\";\n  runnable: boolean;\n  billingMultiplierBps?: number;\n}> {\n  if (\n    isBuiltinGpt56ModelId(modelId) ||\n    /^gpt-6(?:\\.\\d+)?-/u.test(modelId) ||\n    modelId.startsWith(\"codex/gpt-5.6-\") ||\n    /^codex\\/gpt-6(?:\\.\\d+)?-/u.test(modelId)\n  ) {\n    const ultrafast = ultrafastLatencyModeForModel(modelId);\n    return [\n      { id: \"standard\", upstream: \"supported\", runnable: true },\n      {\n        id: \"fast\",\n        upstream: \"supported\",\n        runnable: true,\n        billingMultiplierBps: GPT56_FAST_BILLING_MULTIPLIER_BPS,\n      },\n      ...(ultrafast ? [ultrafast] : []),\n    ];\n  }\n  return [{ id: \"standard\", upstream: \"unknown\", runnable: true }];\n}\n\nfunction isReviewedGptVisionModel(slug: string): boolean {\n  return slug.startsWith(\"gpt-5.6-\") || /^gpt-6(?:\\.\\d+)?-/u.test(slug);\n}\n\n/** Repair missing reviewed capabilities in live/stored Codex definitions.\n * GPT-6 models accept image input and JSON-schema output (`text.format`, as the\n * Codex CLI's `--output-schema` sends it; verified live). Explicit latency and\n * structured-output restrictions and every unrelated catalog field remain\n * authoritative.\n */\nfunction reviewedCodexCatalogCapabilities(\n  slug: string,\n  capabilities: ModelCapabilitiesV1,\n): ModelCapabilitiesV1 {\n  if (!/^gpt-6(?:\\.\\d+)?-/u.test(slug)) return capabilities;\n  const builtin = builtinLatencyModesForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`);\n  const added = builtin.filter(\n    (mode) =>\n      (mode.id === \"fast\" || mode.id === \"ultrafast\") &&\n      !capabilities.latencyModes.some((existing) => existing.id === mode.id),\n  );\n  return normalizeCapabilities({\n    ...capabilities,\n    inputModalities: [...new Set([...capabilities.inputModalities, \"image\" as const])],\n    structuredOutput:\n      capabilities.structuredOutput.upstream === \"unknown\"\n        ? { upstream: \"supported\", runnable: true }\n        : capabilities.structuredOutput,\n    latencyModes: [...capabilities.latencyModes, ...added],\n  });\n}\n\nfunction builtinPromptCachingForModel(\n  modelId: string,\n): NonNullable<ModelCapabilitiesV1[\"promptCaching\"]> | undefined {\n  const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX)\n    ? modelId.slice(CODEX_MODEL_ID_PREFIX.length)\n    : modelId;\n  return slug.startsWith(\"gpt-5.6-\") || slug.startsWith(\"gpt-6-\")\n    ? { upstream: \"supported\", runnable: true, mode: \"implicit\" }\n    : undefined;\n}\n\n/** Reviewed direct-OpenAI text models that accept the hosted image tool. */\nfunction builtinHostedImageGenerationForModel(settings: Settings, modelId: string): boolean {\n  return (\n    settings.openaiProvider === \"openai\" &&\n    isDirectOpenAiApiBaseUrl(settings.openaiBaseUrl) &&\n    (isBuiltinGpt56ModelId(modelId) || modelId.startsWith(\"gpt-6-\"))\n  );\n}\n\n/** Undefined and the exact public OpenAI v1 endpoint are the same direct route. */\nexport function isDirectOpenAiApiBaseUrl(baseUrl: string | undefined): boolean {\n  if (baseUrl === undefined) return true;\n  try {\n    const parsed = new URL(baseUrl);\n    return (\n      parsed.protocol === \"https:\" &&\n      parsed.hostname === \"api.openai.com\" &&\n      parsed.port === \"\" &&\n      parsed.username === \"\" &&\n      parsed.password === \"\" &&\n      parsed.search === \"\" &&\n      parsed.hash === \"\" &&\n      parsed.pathname.replace(/\\/+$/, \"\") === \"/v1\"\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Map Opengeni latency mode to the provider `service_tier` wire value.\n * Azure, Codex ChatGPT, and xAI accept `priority`; OpenAI API accepts `fast`.\n * Ultrafast is `ultrafast` wherever a model declares it (OpenAI API and Codex).\n * Standard omits the field.\n */\nexport function serviceTierForLatencyMode(\n  providerId: string,\n  latencyMode: LatencyMode,\n): \"fast\" | \"priority\" | \"ultrafast\" | undefined {\n  if (latencyMode === \"standard\") {\n    return undefined;\n  }\n  if (latencyMode === \"ultrafast\") {\n    return \"ultrafast\";\n  }\n  if (\n    providerId === \"azure\" ||\n    providerId === CODEX_PROVIDER_ID ||\n    providerId === XAI_SUBSCRIPTION_PROVIDER_ID\n  ) {\n    return \"priority\";\n  }\n  return \"fast\";\n}\n\n/** True when the response tier fulfills a non-standard Fast/priority request. */\nexport function responseSatisfiesLatencyMode(\n  requested: LatencyMode,\n  responseServiceTier: string | null | undefined,\n): boolean {\n  if (requested === \"standard\") {\n    return true;\n  }\n  if (requested === \"ultrafast\") {\n    return responseServiceTier === \"ultrafast\";\n  }\n  return responseServiceTier === \"priority\" || responseServiceTier === \"fast\";\n}\n\nexport function runnableLatencyModesForModel(settings: Settings, modelId: string): LatencyMode[] {\n  const resolved = resolveModelProvider(\n    settingsForTurnExecutionPolicy(settings, modelId),\n    canonicalizeConfiguredModelId(settings, modelId),\n  );\n  if (!resolved) {\n    return [\"standard\"];\n  }\n  return resolved.model.capabilities.latencyModes\n    .filter((mode) => mode.runnable)\n    .map((mode) => LatencyMode.parse(mode.id));\n}\n\nfunction assertLatencyModeRunnable(\n  settings: Settings,\n  modelId: string,\n  latencyMode: LatencyMode,\n): void {\n  const runnable = runnableLatencyModesForModel(settings, modelId);\n  if (!runnable.includes(latencyMode)) {\n    throw new UnsupportedLatencyModeError(modelId, latencyMode, runnable);\n  }\n}\n\nexport class UnsupportedLatencyModeError extends Error {\n  readonly code = \"UNSUPPORTED_LATENCY_MODE\";\n\n  constructor(\n    readonly modelId: string,\n    readonly latencyMode: LatencyMode,\n    readonly allowedLatencyModes: readonly LatencyMode[],\n  ) {\n    super(\n      `latency mode ${latencyMode} is not runnable for model ${modelId} (allowed: ${allowedLatencyModes.join(\", \")})`,\n    );\n    this.name = \"UnsupportedLatencyModeError\";\n  }\n}\n\nfunction registryCredentialSource(provider: InternalRegistryProvider): CredentialSourceV1 {\n  switch (provider.kind) {\n    case \"anonymous\":\n      return { kind: \"deployment\", mechanism: \"none\" };\n    case \"codex-subscription\":\n      return { kind: \"connected_subscription\", provider: \"codex\" };\n    case \"xai-subscription\":\n      return { kind: \"connected_subscription\", provider: \"xai\" };\n    case \"claude-subscription-workspace\":\n    case \"claude-subscription-organization\":\n      return { kind: \"connected_subscription\", provider: \"claude\" };\n    case \"vercel-gateway-workspace\":\n    case \"direct-openai-workspace\":\n    case \"direct-azure-workspace\":\n    case \"openrouter-workspace\":\n    case \"opper-workspace\":\n    case \"anthropic-workspace\":\n      return { kind: \"workspace_connection\", mechanism: \"api_key\" };\n    case \"vercel-gateway-organization\":\n    case \"anthropic-organization\":\n    case \"openrouter-organization\":\n    case \"opper-organization\":\n    case \"direct-openai-organization\":\n    case \"direct-azure-organization\":\n      return { kind: \"organization_connection\", mechanism: \"api_key\" };\n    case \"api-key\":\n    case \"vercel-gateway-managed\":\n    case \"openrouter-managed\":\n    case \"opper-managed\":\n      return { kind: \"deployment\", mechanism: \"api_key\" };\n    default: {\n      const _exhaustive: never = provider.kind;\n      return _exhaustive;\n    }\n  }\n}\n\nfunction registryBilling(provider: InternalRegistryProvider): BillingAttributionV1 {\n  switch (provider.kind) {\n    case \"anonymous\":\n    case \"openrouter-managed\":\n      return { upstreamPayer: \"deployment\", metering: \"external\" };\n    case \"codex-subscription\":\n    case \"xai-subscription\":\n    case \"claude-subscription-workspace\":\n    case \"claude-subscription-organization\":\n      return { upstreamPayer: \"connected_subscription\", metering: \"external\" };\n    case \"vercel-gateway-workspace\":\n    case \"direct-openai-workspace\":\n    case \"direct-azure-workspace\":\n    case \"openrouter-workspace\":\n    case \"opper-workspace\":\n    case \"anthropic-workspace\":\n      return { upstreamPayer: \"workspace\", metering: \"external\" };\n    case \"vercel-gateway-organization\":\n    case \"anthropic-organization\":\n    case \"openrouter-organization\":\n    case \"opper-organization\":\n    case \"direct-openai-organization\":\n    case \"direct-azure-organization\":\n      return { upstreamPayer: \"organization\", metering: \"external\" };\n    case \"api-key\":\n    case \"vercel-gateway-managed\":\n    // Paid deployment Opper routes settle through the deployment's Opper\n    // account and debit Opengeni credits, like managed AI Gateway.\n    case \"opper-managed\":\n      return { upstreamPayer: \"deployment\", metering: \"opengeni_credits\" };\n    default: {\n      const _exhaustive: never = provider.kind;\n      return _exhaustive;\n    }\n  }\n}\n\nfunction configuredCostForModel(\n  settings: Settings,\n  productModelId: string,\n  credentialSource: CredentialSourceV1,\n): ConfiguredModelCostClass {\n  if (credentialSource.kind === \"workspace_connection\") return \"workspace\";\n  if (credentialSource.kind === \"organization_connection\") return \"organization\";\n  if (credentialSource.kind === \"connected_subscription\") return \"subscription\";\n  return parseModelCostPolicyJson(settings.modelCostPolicyJson)[productModelId] ?? \"credits\";\n}\n\nexport function modelCostClassForConfiguredModel(\n  _settings: Settings,\n  model: Pick<ConfiguredModel, \"cost\">,\n): ConfiguredModelCostClass {\n  return model.cost;\n}\n\nfunction builtinCredentialSource(settings: Settings): CredentialSourceV1 {\n  if (settings.openaiProvider === \"azure\" && !settings.azureOpenaiApiKey) {\n    return { kind: \"deployment\", mechanism: \"azure_ad_bearer\" };\n  }\n  return { kind: \"deployment\", mechanism: \"api_key\" };\n}\n\nfunction staticRequestMetadataForDigest(provider: ResolvedModelProvider): {\n  anthropic?: ResolvedModelProvider[\"anthropic\"];\n  headers: Array<{\n    name: string;\n    classification: \"public\" | \"secret\";\n    value?: string;\n  }>;\n  query: Array<{\n    name: string;\n    classification: \"public\" | \"secret\";\n    value?: string;\n  }>;\n} {\n  const publicHeaders = new Set(provider.publicDefaultHeaderNames ?? []);\n  const publicQuery = new Set(provider.publicDefaultQueryNames ?? []);\n  return {\n    ...(provider.anthropic\n      ? {\n          anthropic: (({ identity: _identity, credentialBinding: _binding, ...options }) =>\n            options)(provider.anthropic),\n        }\n      : {}),\n    headers: Object.entries(provider.defaultHeaders ?? {})\n      .sort(([left], [right]) => left.localeCompare(right))\n      .map(([name, value]) =>\n        publicHeaders.has(name)\n          ? { name, classification: \"public\" as const, value }\n          : { name, classification: \"secret\" as const },\n      ),\n    query: Object.entries(provider.defaultQuery ?? {})\n      .sort(([left], [right]) => left.localeCompare(right))\n      .map(([name, value]) =>\n        publicQuery.has(name)\n          ? { name, classification: \"public\" as const, value }\n          : { name, classification: \"secret\" as const },\n      ),\n  };\n}\n\nfunction canonicalJson(value: unknown): string {\n  const normalize = (input: unknown): unknown => {\n    if (Array.isArray(input)) {\n      return input.map((entry) => normalize(entry));\n    }\n    if (input && typeof input === \"object\") {\n      const out: Record<string, unknown> = {};\n      for (const key of Object.keys(input).sort()) {\n        const child = (input as Record<string, unknown>)[key];\n        if (child !== undefined) {\n          out[key] = normalize(child);\n        }\n      }\n      return out;\n    }\n    return input;\n  };\n  return JSON.stringify(normalize(value));\n}\n\nfunction definitionVersionFor(\n  model: Omit<ConfiguredModel, \"definitionVersion\">,\n  provider: ResolvedModelProvider,\n  options: { includeWireProfile?: boolean; includeAutoCompactTokenLimit?: boolean } = {},\n): string {\n  const requestMetadata = staticRequestMetadataForDigest(provider);\n  const includeWireProfile = options.includeWireProfile ?? true;\n  // The automatic-compaction trigger is a context-management default, not\n  // executable identity: workspace and organization compaction preferences\n  // already replace it live on every attempt of an accepted turn. Freezing\n  // it made a changed default strand every in-flight turn of that model.\n  // Only the pre-exclusion compatibility digests below still include it.\n  const { autoCompactTokenLimit, ...executableLimits } = model.executionLimits;\n  const executionLimits = options.includeAutoCompactTokenLimit\n    ? { ...executableLimits, autoCompactTokenLimit }\n    : executableLimits;\n  const digestInput = canonicalJson({\n    schemaVersion: model.schemaVersion,\n    id: model.id,\n    providerId: model.providerId,\n    deployment: model.deployment,\n    provider: {\n      adapterKind: provider.kind,\n      wireApi: provider.api,\n      ...(includeWireProfile ? { wireProfile: provider.wireProfile } : {}),\n      baseUrl: provider.baseUrl ?? null,\n      defaultHeaders: requestMetadata.headers,\n      defaultQuery: requestMetadata.query,\n      ...(requestMetadata.anthropic ? { anthropic: requestMetadata.anthropic } : {}),\n    },\n    credentialSource: model.credentialSource,\n    billing: model.billing,\n    executionLimits,\n    capabilities: model.capabilities,\n    // Workspace-facing free/credits classification is a separate live\n    // deployment policy. Operators must drain/fence accepted turns before\n    // changing it; it is intentionally not a second executable-definition\n    // freeze inside TurnExecutionPolicyV1.\n    ...(model.requestPolicy ? { requestPolicy: model.requestPolicy } : {}),\n    pricing: model.pricing ?? null,\n  });\n  return `sha256:${createHash(\"sha256\")\n    .update(\"opengeni:model-definition:v1\\n\", \"utf8\")\n    .update(digestInput, \"utf8\")\n    .digest(\"hex\")}`;\n}\n\n/**\n * The digest a turn accepted before the compaction trigger left the\n * definition carries. It reproduces only the current trigger value, so an\n * accepted turn stays runnable across the release that drops the field, and\n * every other executable field must still match exactly.\n */\nfunction legacyFrozenAutoCompactDefinitionVersionFor(\n  model: ConfiguredModel,\n  provider: ResolvedModelProvider,\n): string {\n  const { definitionVersion: _definitionVersion, ...modelWithoutVersion } = model;\n  return definitionVersionFor(modelWithoutVersion, provider, {\n    includeAutoCompactTokenLimit: true,\n  });\n}\n\nfunction legacyImplicitOpenAiDefinitionVersionFor(\n  model: ConfiguredModel,\n  provider: ResolvedModelProvider,\n): string | null {\n  if (provider.wireProfile !== \"openai\") return null;\n  const { definitionVersion: _definitionVersion, ...modelWithoutVersion } = model;\n  return definitionVersionFor(modelWithoutVersion, provider, {\n    includeWireProfile: false,\n    includeAutoCompactTokenLimit: true,\n  });\n}\n\nfunction legacyCodexAstraImplicitCachingDefinitionVersionFor(\n  model: ConfiguredModel,\n  provider: ResolvedModelProvider,\n): string | null {\n  // The GPT-6 rollout only made the already-implicit Codex cache discoverable.\n  // Bound this compatibility to that product/transport and exact declaration;\n  // never normalize explicit caching, another capability, or another model.\n  if (\n    model.id !== \"codex/gpt-6-astra\" ||\n    model.upstreamModelId !== \"gpt-6-astra\" ||\n    provider.id !== CODEX_PROVIDER_ID ||\n    provider.kind !== \"codex-subscription\" ||\n    provider.api !== \"responses\" ||\n    provider.wireProfile !== \"openai\" ||\n    canonicalJson(model.capabilities.promptCaching) !==\n      canonicalJson({ upstream: \"supported\", runnable: true, mode: \"implicit\" })\n  ) {\n    return null;\n  }\n  const { definitionVersion: _definitionVersion, ...modelWithoutVersion } = model;\n  const { promptCaching: _promptCaching, ...capabilities } = model.capabilities;\n  // Recompute, rather than allowlisting an incident hash: all other current\n  // fields must still reproduce the accepted digest. Do not compose this with\n  // the older wire-profile compatibility or rewrite the accepted policy.\n  // Ultrafast was declared later; that historical declaration never had it.\n  return definitionVersionFor(\n    {\n      ...modelWithoutVersion,\n      capabilities: {\n        ...capabilities,\n        latencyModes: capabilities.latencyModes.filter((mode) => mode.id !== \"ultrafast\"),\n      },\n    },\n    provider,\n    { includeAutoCompactTokenLimit: true },\n  );\n}\n\nfunction matchesAdditiveCapabilityDefinitionVersion(\n  model: ConfiguredModel,\n  provider: ResolvedModelProvider,\n  policy: TurnExecutionPolicyV1,\n): boolean {\n  const { definitionVersion: _definitionVersion, ...modelWithoutVersion } = model;\n  const { latencyModes, inputModalities } = model.capabilities;\n  // V1 has four unique latency ids and three unique input modalities:\n  // at most 15 * 7 subset digests retaining the frozen mode. Reconstruct an\n  // exact historical declaration; never ignore the digest or alter existing\n  // mode support, runnable state, billing multiplier, or request-tier routing.\n  // Every other executable field remains in the digest. Do not compose this\n  // with the pre-wire-profile or implicit-caching migration exceptions.\n  for (let latencyMask = 1; latencyMask < 1 << latencyModes.length; latencyMask += 1) {\n    const retainedModes = latencyModes.filter((_mode, index) => latencyMask & (1 << index));\n    if (!retainedModes.some((mode) => mode.id === policy.latencyMode && mode.runnable)) {\n      continue;\n    }\n    for (let inputMask = 1; inputMask < 1 << inputModalities.length; inputMask += 1) {\n      const retainedInputs = inputModalities.filter((_modality, index) => inputMask & (1 << index));\n      if (\n        retainedModes.length === latencyModes.length &&\n        retainedInputs.length === inputModalities.length\n      ) {\n        continue;\n      }\n      const capabilities = {\n        ...model.capabilities,\n        latencyModes: retainedModes,\n        inputModalities: retainedInputs,\n      };\n      if (\n        matchesCurrentOrPreCompactionExclusionDigest(\n          policy,\n          { ...modelWithoutVersion, capabilities },\n          provider,\n        )\n      ) {\n        return true;\n      }\n    }\n  }\n  return false;\n}\n\n/**\n * The model as accepted before runnable structured output was declared, or\n * null when it is not declared. Agent turns never request structured output\n * (only stateless single calls do), so enabling it from the exact unknown/off\n * declaration cannot change an accepted turn's execution. Every definition\n * compatibility check also runs against this one historical declaration;\n * every other field still has to reproduce the frozen digest.\n */\nfunction structuredOutputPreEnablementModel(\n  model: ConfiguredModel,\n  provider: ResolvedModelProvider,\n): ConfiguredModel | null {\n  if (!model.capabilities.structuredOutput.runnable) return null;\n  const { definitionVersion: _definitionVersion, ...modelWithoutVersion } = model;\n  const historical = {\n    ...modelWithoutVersion,\n    capabilities: {\n      ...model.capabilities,\n      structuredOutput: { upstream: \"unknown\" as const, runnable: false },\n    },\n  };\n  return { ...historical, definitionVersion: definitionVersionFor(historical, provider) };\n}\n\n/** Whether a frozen digest matches this model definition or one tolerated historical form of it. */\nfunction acceptedDefinitionVersionMatches(\n  model: ConfiguredModel,\n  provider: ResolvedModelProvider,\n  policy: TurnExecutionPolicyV1,\n): boolean {\n  return (\n    policy.definitionVersion === model.definitionVersion ||\n    policy.definitionVersion === legacyFrozenAutoCompactDefinitionVersionFor(model, provider) ||\n    policy.definitionVersion === legacyImplicitOpenAiDefinitionVersionFor(model, provider) ||\n    policy.definitionVersion ===\n      legacyCodexAstraImplicitCachingDefinitionVersionFor(model, provider) ||\n    matchesAdditiveCapabilityDefinitionVersion(model, provider, policy) ||\n    matchesWebSearchEnablementDefinitionVersion(model, provider, policy)\n  );\n}\n\n/**\n * Operator-change compatibility (an added capability or enabled web search)\n * also applies to a turn accepted before the compaction trigger left the\n * digest. This is the same single historical declaration in either digest\n * form, never an additional tolerated change.\n */\nfunction matchesCurrentOrPreCompactionExclusionDigest(\n  policy: TurnExecutionPolicyV1,\n  model: Omit<ConfiguredModel, \"definitionVersion\">,\n  provider: ResolvedModelProvider,\n): boolean {\n  return (\n    policy.definitionVersion === definitionVersionFor(model, provider) ||\n    policy.definitionVersion ===\n      definitionVersionFor(model, provider, { includeAutoCompactTokenLimit: true })\n  );\n}\n\n/** The one pre-enablement hosted web-search declaration an operator may upgrade from. */\nfunction webSearchPreEnablementState(): CapabilityStateV1 {\n  return { upstream: \"unknown\", runnable: false };\n}\n\nfunction matchesWebSearchEnablementDefinitionVersion(\n  model: ConfiguredModel,\n  provider: ResolvedModelProvider,\n  policy: TurnExecutionPolicyV1,\n): boolean {\n  // An operator turning on hosted web search for an existing model changes\n  // only capabilities.hostedTools.webSearch from the exact unknown/off\n  // declaration to a runnable one. Reconstruct that single historical\n  // declaration and require every other current field to reproduce the frozen\n  // digest; never ignore the digest. Turning web search off, or changing any\n  // other capability, still fails closed. Do not compose this with the\n  // latency/input-modality subsets or the wire-profile, implicit-caching, or\n  // Claude-accounting migration exceptions.\n  if (!model.capabilities.hostedTools.webSearch.runnable) return false;\n  const { definitionVersion: _definitionVersion, ...modelWithoutVersion } = model;\n  const capabilities = {\n    ...model.capabilities,\n    hostedTools: { ...model.capabilities.hostedTools, webSearch: webSearchPreEnablementState() },\n  };\n  return matchesCurrentOrPreCompactionExclusionDigest(\n    policy,\n    { ...modelWithoutVersion, capabilities },\n    provider,\n  );\n}\n\n/**\n * The executable model an accepted turn runs: the current definition, except\n * that a turn frozen before hosted web search was enabled keeps its frozen\n * tool set (no web_search) on every recovery attempt. Only the next accepted\n * logical turn resolves the newly enabled tool. Call only with a policy that\n * already passed assertTurnExecutionPolicyMatchesConfigV1.\n */\nexport function configuredModelForAcceptedTurnExecutionPolicy(\n  model: ConfiguredModel,\n  provider: ResolvedModelProvider,\n  policy: TurnExecutionPolicyV1,\n): ConfiguredModel {\n  if (\n    policy.definitionVersion === model.definitionVersion ||\n    // Runtime test doubles may resolve a partial shape; a model without a\n    // runnable web-search declaration has nothing to withhold.\n    model.capabilities?.hostedTools?.webSearch?.runnable !== true ||\n    !matchesWebSearchEnablementDefinitionVersion(model, provider, policy)\n  ) {\n    return model;\n  }\n  return {\n    ...model,\n    capabilities: {\n      ...model.capabilities,\n      hostedTools: {\n        ...model.capabilities.hostedTools,\n        webSearch: webSearchPreEnablementState(),\n      },\n    },\n    hostedWebSearch: false,\n    definitionVersion: policy.definitionVersion,\n  };\n}\n\n/**\n * The built-in provider's stable id: \"openai\" on the OpenAI platform, \"azure\"\n * on Azure. Exported because the workspace model-policy gate must attribute\n * the legacy resolveTurnModel-null fallback (which routes to this built-in\n * client) to the SAME identity the router uses — otherwise a policy blocking\n * the built-in could be bypassed through the null-resolution path.\n */\nexport function builtinProviderId(settings: Pick<Settings, \"openaiProvider\">): string {\n  return settings.openaiProvider === \"azure\" ? \"azure\" : \"openai\";\n}\n\nfunction builtinProviderLabel(settings: Pick<Settings, \"openaiProvider\">): string {\n  return settings.openaiProvider === \"azure\" ? \"Azure OpenAI\" : \"OpenAI\";\n}\n\n/**\n * Every provider a client may route to: the built-in OpenAI/Azure provider\n * first (id \"openai\"/\"azure\", always \"responses\"), then each registry provider\n * in declaration order. Client-construction inputs are filled from\n * the existing flat openai/azure settings for the built-in, and from the\n * registry entry for the rest. Registry ids may not collide with the built-in\n * id — validateSettings rejects that at boot.\n */\nexport function configuredProviders(\n  settings: Settings,\n  source: NodeJS.ProcessEnv = process.env,\n): ResolvedModelProvider[] {\n  const credentialSource = builtinCredentialSource(settings);\n  const builtin: ResolvedModelProvider = {\n    id: builtinProviderId(settings),\n    label: builtinProviderLabel(settings),\n    kind: \"api-key\",\n    api: \"responses\",\n    wireProfile: settings.openaiProvider === \"azure\" ? \"azure-openai\" : \"openai\",\n    builtin: true,\n    credentialSource,\n    billing: { upstreamPayer: \"deployment\", metering: \"opengeni_credits\" },\n  };\n  if (settings.openaiProvider === \"azure\") {\n    const baseUrl = settings.azureOpenaiBaseUrl ?? settings.azureOpenaiEndpoint;\n    builtin.baseUrl = baseUrl ? normalizeRegistryBaseUrl(baseUrl, builtin.id) : undefined;\n    builtin.apiKey =\n      usableDeploymentSecret(settings.azureOpenaiApiKey) ?? settings.azureOpenaiAdToken;\n  } else {\n    builtin.baseUrl = settings.openaiBaseUrl\n      ? normalizeRegistryBaseUrl(settings.openaiBaseUrl, builtin.id)\n      : undefined;\n    builtin.apiKey = usableDeploymentSecret(settings.openaiApiKey);\n  }\n  const registry = configuredRegistryProviders(settings).map(\n    (provider): ResolvedModelProvider => ({\n      id: provider.id,\n      label: provider.label ?? provider.id,\n      kind: provider.kind,\n      api: provider.api,\n      anthropic: provider.anthropic,\n      wireProfile: provider.wireProfile,\n      builtin: false,\n      baseUrl: provider.baseUrl,\n      apiKey: resolveProviderApiKey(provider, source),\n      defaultQuery: provider.defaultQuery,\n      defaultHeaders: provider.defaultHeaders,\n      publicDefaultQueryNames: provider.publicDefaultQueryNames,\n      publicDefaultHeaderNames: provider.publicDefaultHeaderNames,\n      ...(provider.streamIdleTimeoutMs !== undefined\n        ? { streamIdleTimeoutMs: provider.streamIdleTimeoutMs }\n        : {}),\n      ...(provider.streamProgressTimeoutMs !== undefined\n        ? { streamProgressTimeoutMs: provider.streamProgressTimeoutMs }\n        : {}),\n      credentialSource: registryCredentialSource(provider),\n      billing: registryBilling(provider),\n    }),\n  );\n  return [builtin, ...registry];\n}\n\n/**\n * Pure catalog overlay for a workspace whose existing Codex connection seam\n * reports ready. This describes product/provider identity only; it does not\n * select, lease, refresh, or expose a concrete credential; those runtime\n * operations remain owned by the credential allocator.\n */\n/** Exact upstream slugs of the active Codex catalog (or the built-in fallback list). */\nexport function codexUpstreamModelSlugs(settings: Settings): string[] {\n  if (settings.resolvedCodexModelsJson === undefined) return [...CODEX_FALLBACK_MODEL_SLUGS];\n  return z\n    .array(CodexCatalogModelSchema)\n    .parse(JSON.parse(settings.resolvedCodexModelsJson))\n    .filter((model) => !model.retired)\n    .map((model) => model.upstreamModelId);\n}\n\nexport function withCodexCatalogProvider(settings: Settings): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  if (providers.some((provider) => provider.id === CODEX_PROVIDER_ID)) {\n    return settings;\n  }\n  const catalogModels =\n    settings.resolvedCodexModelsJson === undefined\n      ? undefined\n      : z\n          .array(CodexCatalogModelSchema)\n          .parse(JSON.parse(settings.resolvedCodexModelsJson))\n          .filter((model) => !model.retired)\n          .map(({ retired: _retired, ...model }) => model);\n  if (catalogModels?.length === 0) return settings;\n  const provider: RegistryProvider = {\n    kind: \"codex-subscription\",\n    id: CODEX_PROVIDER_ID,\n    label: \"Codex (ChatGPT subscription)\",\n    api: \"responses\",\n    wireProfile: \"openai\",\n    baseUrl: CODEX_PROVIDER_BASE_URL,\n    models:\n      catalogModels ??\n      CODEX_FALLBACK_MODEL_SLUGS.map((slug) => {\n        const capabilities = reviewedCodexCatalogCapabilities(slug, {\n          ...legacyModelCapabilities(settings, {\n            reasoningEffort: true,\n            hostedWebSearch: true,\n            vision: isReviewedGptVisionModel(slug),\n          }),\n          ...(builtinPromptCachingForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`)\n            ? {\n                promptCaching: builtinPromptCachingForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`)!,\n              }\n            : {}),\n          latencyModes: builtinLatencyModesForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`),\n        });\n        return {\n          id: `${CODEX_MODEL_ID_PREFIX}${slug}`,\n          upstreamModelId: slug,\n          label: productLabelForModelId(slug),\n          ...(productShortLabelForModelId(slug)\n            ? { shortLabel: productShortLabelForModelId(slug)! }\n            : {}),\n          reasoningEffort: true,\n          // The ChatGPT/Codex Responses backend accepts the native web_search\n          // hosted tool (unlike hosted apply_patch/computer transports). Declaring\n          // this here makes provider resolution truthful; the worker still applies\n          // the durable session/turn policy gate before attaching it.\n          hostedWebSearch: true,\n          capabilities,\n          contextWindowTokens: CODEX_MODEL_CONTEXT_WINDOW_TOKENS,\n          effectiveContextWindowTokens: CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,\n          autoCompactTokenLimit: CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT,\n          toolOutputTruncationTokens: CODEX_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS,\n        };\n      }),\n  };\n  return {\n    ...settings,\n    modelProvidersJson: JSON.stringify([...providers, provider]),\n  };\n}\n\n/**\n * Static SuperGrok product catalogue, matching the Codex subscription seam.\n * The overlay never contains a concrete account id or bearer; selection and\n * per-turn credential freeze remain worker/DB responsibilities.\n */\nexport function withXaiSubscriptionCatalogProvider(settings: Settings): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  if (providers.some((provider) => provider.id === XAI_SUBSCRIPTION_PROVIDER_ID)) {\n    return settings;\n  }\n  const provider: RegistryProvider = {\n    kind: \"xai-subscription\",\n    id: XAI_SUBSCRIPTION_PROVIDER_ID,\n    label: \"SuperGrok (xAI subscription)\",\n    api: \"responses\",\n    wireProfile: \"openai\",\n    baseUrl: XAI_SUBSCRIPTION_PROXY_BASE_URL,\n    models: XAI_SUBSCRIPTION_MODEL_SLUGS.map((slug) => {\n      const capabilities = legacyModelCapabilities(settings, {\n        reasoningEffort: true,\n        hostedWebSearch: true,\n        vision: true,\n      });\n      capabilities.reasoning.efforts = [\"low\", \"medium\", \"high\", \"xhigh\"];\n      capabilities.reasoning.defaultEffort = \"high\";\n      capabilities.latencyModes = [\n        { id: \"standard\", upstream: \"supported\", runnable: true },\n        { id: \"fast\", upstream: \"supported\", runnable: true },\n      ];\n      capabilities.hostedTools.xSearch = {\n        upstream: \"supported\",\n        runnable: true,\n      };\n      capabilities.hostedTools.imageGeneration = {\n        upstream: \"supported\",\n        runnable: true,\n      };\n      return {\n        id: `${XAI_SUBSCRIPTION_MODEL_ID_PREFIX}${slug}`,\n        upstreamModelId: slug,\n        label: productLabelForModelId(slug),\n        ...(productShortLabelForModelId(slug)\n          ? { shortLabel: productShortLabelForModelId(slug)! }\n          : {}),\n        reasoningEffort: true,\n        hostedWebSearch: true,\n        capabilities,\n        contextWindowTokens: XAI_SUBSCRIPTION_MODEL_CONTEXT_WINDOW_TOKENS,\n        effectiveContextWindowTokens: XAI_SUBSCRIPTION_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,\n        autoCompactTokenLimit: XAI_SUBSCRIPTION_MODEL_AUTO_COMPACT_TOKEN_LIMIT,\n        toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n      };\n    }),\n  };\n  return {\n    ...settings,\n    modelProvidersJson: JSON.stringify([...providers, provider]),\n  };\n}\n\n/**\n * The provider identity a model id resolves to, for workspace model-policy\n * evaluation — MUST agree with the real router (resolveTurnModel /\n * MultiProviderModelProvider) on every case:\n *   - `codex/<slug>` → the codex-subscription provider id, ALWAYS. With no\n *     active subscription the router fails loud (CodexSubscriptionUnavailableError),\n *     never the built-in — so attributing by prefix is exact even against BASE\n *     settings where the overlay provider is not injected.\n *   - a configured model id → its configuredModels providerId (registry or built-in).\n *   - anything else → the built-in id: an unknown id is the legacy\n *     resolveTurnModel-null fallback, which the built-in OpenAI/Azure client\n *     serves. A policy blocking the built-in must block this path too.\n */\nexport function policyProviderIdForModel(settings: Settings, modelId: string): string {\n  const canonicalModelId = canonicalizeConfiguredModelId(settings, modelId);\n  if (canonicalModelId.startsWith(CODEX_MODEL_ID_PREFIX)) {\n    return CODEX_PROVIDER_ID;\n  }\n  if (canonicalModelId.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX)) {\n    return XAI_SUBSCRIPTION_PROVIDER_ID;\n  }\n  if (canonicalModelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {\n    return WORKSPACE_GATEWAY_PROVIDER_ID;\n  }\n  if (canonicalModelId.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX)) {\n    return WORKSPACE_OPENROUTER_PROVIDER_ID;\n  }\n  if (canonicalModelId.startsWith(WORKSPACE_OPPER_MODEL_ID_PREFIX)) {\n    return WORKSPACE_OPPER_PROVIDER_ID;\n  }\n  const configured = configuredModels(settings).find((model) => model.id === canonicalModelId);\n  return configured?.providerId ?? builtinProviderId(settings);\n}\n\n/**\n * Provider ids whose models are never paid with Opengeni credits: connected\n * subscriptions and workspace/organization-owned API keys. A model id under\n * one of these prefixes is attributed to its own payer even against BASE\n * settings, where the per-workspace overlay that defines it is not injected.\n */\nconst NON_CREDIT_POLICY_PROVIDER_IDS = new Set<string>([\n  CODEX_PROVIDER_ID,\n  XAI_SUBSCRIPTION_PROVIDER_ID,\n  WORKSPACE_GATEWAY_PROVIDER_ID,\n  ORGANIZATION_GATEWAY_PROVIDER_ID,\n  WORKSPACE_OPENROUTER_PROVIDER_ID,\n  ORGANIZATION_OPENROUTER_PROVIDER_ID,\n  WORKSPACE_OPPER_PROVIDER_ID,\n  ORGANIZATION_OPPER_PROVIDER_ID,\n  ORGANIZATION_OPENAI_PROVIDER_ID,\n  ORGANIZATION_AZURE_OPENAI_PROVIDER_ID,\n  \"workspace-anthropic\",\n  \"organization-anthropic\",\n  \"workspace-claude-subscription\",\n  \"organization-claude-subscription\",\n]);\n\n/**\n * Whether a model id spends Opengeni credits, for the workspace model\n * policy's credit switch. MUST agree with the cost the worker bills\n * (`ConfiguredModel.cost === \"credits\"`):\n *   - a configured model → its own cost class;\n *   - `codex/…`, `xai…/`, and workspace/organization connection ids → never;\n *   - anything else → the legacy built-in fallback, which the deployment pays\n *     and bills in credits unless the cost policy marks that exact id free.\n *     Failing closed here keeps an unknown id from slipping past a workspace\n *     that turned credits off.\n */\nexport function policyChargesCreditsForModel(settings: Settings, modelId: string): boolean {\n  const canonicalModelId = canonicalizeConfiguredModelId(settings, modelId);\n  const configured = configuredModels(settings).find((model) => model.id === canonicalModelId);\n  if (configured) return configured.cost === \"credits\";\n  if (canonicalModelId.startsWith(CODEX_MODEL_ID_PREFIX)) return false;\n  if (canonicalModelId.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX)) return false;\n  const slash = canonicalModelId.indexOf(\"/\");\n  const providerPrefix = slash > 0 ? canonicalModelId.slice(0, slash) : \"\";\n  if (\n    NON_CREDIT_POLICY_PROVIDER_IDS.has(providerPrefix) ||\n    // Direct workspace OpenAI / Azure OpenAI keys (`workspace-openai-<id>/…`).\n    providerPrefix.startsWith(\"workspace-openai-\") ||\n    providerPrefix.startsWith(\"workspace-azure-openai-\")\n  ) {\n    return false;\n  }\n  return (\n    (parseModelCostPolicyJson(settings.modelCostPolicyJson)[canonicalModelId] ?? \"credits\") ===\n    \"credits\"\n  );\n}\n\nfunction resolvedExecutionLimits(\n  settings: Settings,\n  model: {\n    contextWindowTokens?: number | undefined;\n    effectiveContextWindowTokens?: number | undefined;\n    autoCompactTokenLimit?: number | undefined;\n    toolOutputTruncationTokens?: number | undefined;\n  },\n): ModelExecutionLimitsV1 {\n  return {\n    contextWindowTokens: model.contextWindowTokens ?? settings.contextWindowTokens,\n    effectiveContextWindowTokens:\n      model.effectiveContextWindowTokens ?? settings.contextEffectiveWindowTokens ?? null,\n    autoCompactTokenLimit:\n      model.autoCompactTokenLimit ?? settings.contextAutoCompactThresholdTokens ?? null,\n    toolOutputTruncationTokens:\n      model.toolOutputTruncationTokens ?? settings.modelToolOutputTruncationTokens ?? null,\n  };\n}\n\nfunction finalizeConfiguredModel(\n  settings: Settings,\n  provider: ResolvedModelProvider,\n  input: Omit<ConfiguredModel, \"schemaVersion\" | \"definitionVersion\" | \"executionLimits\" | \"cost\">,\n): ConfiguredModel {\n  const requestPolicy =\n    provider.kind === \"vercel-gateway-managed\" ||\n    provider.kind === \"vercel-gateway-workspace\" ||\n    provider.kind === \"vercel-gateway-organization\"\n      ? gatewayRequestPolicyForUpstreamModel(\n          input.upstreamModelId,\n          configuredGatewayCatalogModels(settings),\n        )\n      : undefined;\n  const modelWithoutVersion: Omit<ConfiguredModel, \"definitionVersion\"> = {\n    schemaVersion: 1,\n    ...input,\n    cost: configuredCostForModel(settings, input.id, input.credentialSource),\n    ...(requestPolicy ? { requestPolicy } : {}),\n    executionLimits: resolvedExecutionLimits(settings, input),\n  };\n  return {\n    ...modelWithoutVersion,\n    definitionVersion: definitionVersionFor(modelWithoutVersion, provider),\n  };\n}\n\nfunction assertUniqueModelIdentities(models: ConfiguredModel[]): void {\n  const canonicalOwners = new Map<string, string>();\n  for (const model of models) {\n    const previous = canonicalOwners.get(model.id);\n    if (previous !== undefined) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON model id ${JSON.stringify(model.id)} is declared by both ${previous} and ${model.providerId}`,\n      );\n    }\n    canonicalOwners.set(model.id, model.providerId);\n  }\n\n  const acceptedInputs = new Map(canonicalOwners);\n  for (const model of models) {\n    const ownAliases = new Set<string>();\n    for (const alias of model.aliases) {\n      if (ownAliases.has(alias)) {\n        throw new Error(\n          `OPENGENI_MODEL_PROVIDERS_JSON model ${JSON.stringify(model.id)} contains duplicate alias ${JSON.stringify(alias)}`,\n        );\n      }\n      ownAliases.add(alias);\n      const previous = acceptedInputs.get(alias);\n      if (previous !== undefined) {\n        throw new Error(\n          `OPENGENI_MODEL_PROVIDERS_JSON alias ${JSON.stringify(alias)} for model ${JSON.stringify(model.id)} collides with model/provider ${previous}`,\n        );\n      }\n      acceptedInputs.set(alias, model.id);\n    }\n  }\n}\n\n/**\n * Every model a client may use, the built-in provider's models first\n * (configuredAllowedModels-from-openai, mapped to \"responses\" with\n * hostedWebSearch/contextWindow/reasoningEffort from the flat settings), then\n * each registry provider's models (label→id, hostedWebSearch/reasoningEffort\n * default false). De-duplicated by id (first wins) so the default model stays\n * first and the built-in allow-list takes precedence over registry entries.\n */\nexport function configuredModels(\n  settings: Settings,\n  source: NodeJS.ProcessEnv = process.env,\n): ConfiguredModel[] {\n  const builtinId = builtinProviderId(settings);\n  const builtinLabel = builtinProviderLabel(settings);\n  const providers = configuredProviders(settings, source);\n  const providerById = new Map(providers.map((provider) => [provider.id, provider]));\n  const pricingSchedules = configuredModelPricingSchedules(settings);\n  // The built-in (OpenAI/Azure) provider must NEVER claim a registry-namespaced\n  // model id. The worker overwrites settings.openaiModel with the turn's model\n  // (apps/worker agent-turn runSettings) — including a `codex/<slug>` id, or a\n  // registry id like \"accounts/fireworks/models/glm-5p2\" — so without this\n  // filter the built-in allow-list would emit a `{ id, providerId: <azure> }`\n  // entry that, by the first-wins de-dup below, shadows the real registry /\n  // codex-subscription provider and ships the id to Azure as a deployment name\n  // (opaque DeploymentNotFound 404). A `<provider>/<model>`-namespaced id (it\n  // contains \"/\") that a registry actually owns is never a valid Azure/OpenAI\n  // deployment name, and a `codex/`-prefixed id never is either — exclude both\n  // from the built-in list. A BARE id a registry merely redeclares (e.g.\n  // \"gpt-5.6-sol\") is left in place so the built-in still wins it via the first-wins\n  // de-dup below (preserving the documented built-in-precedence contract). When\n  // a codex/ id has NO codex provider injected (no active subscription) it then\n  // resolves to nothing and getModel fails loud with\n  // CodexSubscriptionUnavailableError instead of mis-routing to Azure.\n  const parsedRegistry = configuredRegistryProviders(settings);\n  const registryOwnedIds = new Set(\n    parsedRegistry.flatMap((provider) => provider.models.map((model) => model.id)),\n  );\n  const registryAliases = new Set(\n    parsedRegistry.flatMap((provider) => provider.models.flatMap((model) => model.aliases ?? [])),\n  );\n  const isRegistryNamespaced = (id: string): boolean =>\n    id.startsWith(CODEX_MODEL_ID_PREFIX) ||\n    id.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX) ||\n    registryAliases.has(id) ||\n    (id.includes(\"/\") && registryOwnedIds.has(id));\n  const builtinProvider = providerById.get(builtinId);\n  if (!builtinProvider) {\n    throw new Error(`Built-in model provider ${builtinId} is not configured`);\n  }\n  const out: ConfiguredModel[] = uniqueValues([\n    settings.openaiModel,\n    ...splitCsv(settings.openaiAllowedModels),\n  ])\n    .filter((id) => !isRegistryNamespaced(id))\n    .map((id) => {\n      const capabilities = {\n        ...legacyModelCapabilities(settings, {\n          reasoningEffort: true,\n          hostedWebSearch: settings.webSearchEnabled,\n          hostedImageGeneration: builtinHostedImageGenerationForModel(settings, id),\n          vision: isReviewedGptVisionModel(id),\n        }),\n        ...(builtinPromptCachingForModel(id)\n          ? { promptCaching: builtinPromptCachingForModel(id)! }\n          : {}),\n        latencyModes: builtinLatencyModesForModel(id),\n      };\n      return finalizeConfiguredModel(settings, builtinProvider, {\n        id,\n        aliases: [],\n        label: productLabelForModelId(id),\n        ...(productShortLabelForModelId(id)\n          ? { shortLabel: productShortLabelForModelId(id)! }\n          : {}),\n        providerId: builtinId,\n        providerLabel: builtinLabel,\n        api: \"responses\" as const,\n        upstreamModelId: id,\n        deployment: { upstreamModelId: id, wireApi: \"responses\" },\n        credentialSource: builtinProvider.credentialSource,\n        billing: builtinProvider.billing,\n        capabilities,\n        ...(pricingSchedules[id] === undefined ? {} : { pricing: pricingSchedules[id] }),\n        ...builtinContextLimitsForModel(settings, id),\n        toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n        reasoningEffort: capabilities.reasoning.runnable,\n        hostedWebSearch: capabilities.hostedTools.webSearch.runnable,\n      });\n    });\n  for (const provider of parsedRegistry) {\n    const providerLabel = provider.label ?? provider.id;\n    const resolvedProvider = providerById.get(provider.id);\n    if (!resolvedProvider) {\n      throw new Error(`Registry model provider ${provider.id} is not configured`);\n    }\n    for (const model of provider.models) {\n      const capabilities = model.capabilities\n        ? normalizeCapabilities(model.capabilities)\n        : legacyModelCapabilities(settings, {\n            reasoningEffort: model.reasoningEffort ?? false,\n            hostedWebSearch: model.hostedWebSearch ?? false,\n          });\n      const upstreamModelId = model.upstreamModelId ?? model.id;\n      out.push(\n        finalizeConfiguredModel(settings, resolvedProvider, {\n          id: model.id,\n          aliases: [...(model.aliases ?? [])],\n          label: model.label ?? productLabelForModelId(model.id),\n          ...(model.logoUrl ? { logoUrl: model.logoUrl } : {}),\n          ...(model.shortLabel\n            ? { shortLabel: model.shortLabel }\n            : productShortLabelForModelId(model.id)\n              ? { shortLabel: productShortLabelForModelId(model.id)! }\n              : {}),\n          providerId: provider.id,\n          providerLabel,\n          api: provider.api,\n          upstreamModelId,\n          deployment: { upstreamModelId, wireApi: provider.api },\n          credentialSource: resolvedProvider.credentialSource,\n          billing: resolvedProvider.billing,\n          capabilities,\n          ...(pricingSchedules[model.id] === undefined\n            ? {}\n            : { pricing: pricingSchedules[model.id] }),\n          ...(model.contextWindowTokens === undefined\n            ? {}\n            : { contextWindowTokens: model.contextWindowTokens }),\n          ...(model.effectiveContextWindowTokens === undefined\n            ? {}\n            : {\n                effectiveContextWindowTokens: model.effectiveContextWindowTokens,\n              }),\n          ...(model.autoCompactTokenLimit === undefined\n            ? {}\n            : { autoCompactTokenLimit: model.autoCompactTokenLimit }),\n          ...(model.toolOutputTruncationTokens === undefined\n            ? {}\n            : { toolOutputTruncationTokens: model.toolOutputTruncationTokens }),\n          reasoningEffort: capabilities.reasoning.runnable,\n          hostedWebSearch: capabilities.hostedTools.webSearch.runnable,\n        }),\n      );\n    }\n  }\n  assertUniqueModelIdentities(out);\n  const defaultIndex = out.findIndex(\n    (model) => model.id === settings.openaiModel || model.aliases.includes(settings.openaiModel),\n  );\n  return defaultIndex > 0\n    ? [out[defaultIndex]!, ...out.slice(0, defaultIndex), ...out.slice(defaultIndex + 1)]\n    : out;\n}\n\n/** Resolve a known canonical id or alias. Unknown strings are returned unchanged. */\nexport function canonicalizeConfiguredModelId(settings: Settings, modelId: string): string {\n  const models = configuredModels(settings);\n  const canonical = models.find((model) => model.id === modelId);\n  if (canonical) {\n    return canonical.id;\n  }\n  return models.find((model) => model.aliases.includes(modelId))?.id ?? modelId;\n}\n\n/**\n * Allowed model ids in selection order. Reimplemented on top of\n * configuredModels so it is the union of the built-in allow-list and every\n * registry provider's ids, de-duplicated. INVARIANT (existing callers + tests\n * depend on it): settings.openaiModel is always first, then the rest of the\n * openai allow-list, then registry ids.\n */\nexport function configuredAllowedModels(settings: Settings): string[] {\n  return configuredModels(settings)\n    .filter((model) => isModelAvailableForNewSelection(settings, model.id))\n    .map((model) => model.id);\n}\n\n/** Retirement is selection metadata, never provider authority or executable identity. */\nexport function isModelAvailableForNewSelection(settings: Settings, modelId: string): boolean {\n  if (!modelId.startsWith(CODEX_MODEL_ID_PREFIX) || settings.resolvedCodexModelsJson === undefined)\n    return true;\n  const models = z\n    .array(CodexCatalogModelSchema)\n    .parse(JSON.parse(settings.resolvedCodexModelsJson));\n  return models.some((model) => model.id === modelId && !model.retired);\n}\n\n/** Called only with the durable policy installed for a claimed accepted attempt. */\nexport function settingsForAcceptedSubscriptionTurn(\n  settings: Settings,\n  policy: TurnExecutionPolicyV1,\n  expected: {\n    modelId: string;\n    reasoningEffort: Settings[\"openaiReasoningEffort\"];\n    latencyMode?: LatencyMode;\n  },\n): Settings {\n  const parsed = TurnExecutionPolicyV1.parse(policy);\n  if (!parsed.productModelId.startsWith(CODEX_MODEL_ID_PREFIX)) return settings;\n  if (!settings.codexSubscriptionEnabled) throw new Error(\"Codex subscription is disabled\");\n  const models =\n    settings.resolvedCodexModelsJson === undefined\n      ? []\n      : z.array(CodexCatalogModelSchema).parse(JSON.parse(settings.resolvedCodexModelsJson));\n  const retained = models.find((model) => model.id === parsed.productModelId && model.retired);\n  if (!retained) {\n    assertTurnExecutionPolicyMatchesConfigV1(settings, parsed, expected);\n    return settings;\n  }\n  const { retired: _retired, ...model } = retained;\n  // Use the existing fixed broker transport. Only this exact definition is added;\n  // selection metadata remains retired in the original catalog JSON.\n  const withoutCodex = {\n    ...settings,\n    modelProvidersJson: JSON.stringify(\n      parseModelProvidersJson(settings.modelProvidersJson).filter(\n        (provider) => provider.id !== CODEX_PROVIDER_ID,\n      ),\n    ),\n  };\n  const providerSettings = withCodexCatalogProvider({\n    ...withoutCodex,\n    resolvedCodexModelsJson: JSON.stringify([model]),\n  });\n  const retainedProvider = parseModelProvidersJson(providerSettings.modelProvidersJson).find(\n    (provider) => provider.id === CODEX_PROVIDER_ID,\n  )!;\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  const current = providers.find((provider) => provider.id === CODEX_PROVIDER_ID);\n  const restored = {\n    ...settings,\n    modelProvidersJson: JSON.stringify([\n      ...providers.filter((provider) => provider.id !== CODEX_PROVIDER_ID),\n      {\n        ...retainedProvider,\n        models: [\n          ...(current?.models ?? []).filter((candidate) => candidate.id !== model.id),\n          model,\n        ],\n      },\n    ]),\n  };\n  assertTurnExecutionPolicyMatchesConfigV1(restored, parsed, expected);\n  return restored;\n}\n\n/**\n * Resolve a model string to the provider that serves it and its configured\n * shape. Returns undefined when the id is not exposed (built-in allow-list nor\n * any registry provider), so the runtime can fall back to the legacy global\n * client path.\n */\nexport function resolveModelProvider(\n  settings: Settings,\n  modelId: string,\n): { provider: ResolvedModelProvider; model: ConfiguredModel } | undefined {\n  const canonicalModelId = canonicalizeConfiguredModelId(settings, modelId);\n  const model = configuredModels(settings).find((candidate) => candidate.id === canonicalModelId);\n  if (!model) {\n    return undefined;\n  }\n  const provider = configuredProviders(settings).find(\n    (candidate) => candidate.id === model.providerId,\n  );\n  if (!provider) {\n    return undefined;\n  }\n  return { provider, model };\n}\n\nexport type ResolveTurnExecutionPolicyV1Input = {\n  /** Effective persisted turn model. Aliases are accepted and canonicalized. */\n  modelId: string;\n  /** Exact caller-supplied input before canonicalization, only for explicit switches. */\n  requestedModelId: string | null;\n  modelSource: TurnExecutionModelSourceV1;\n  reasoningEffort: Settings[\"openaiReasoningEffort\"];\n  reasoningSource: TurnExecutionReasoningSourceV1;\n  latencyMode?: LatencyMode;\n  latencyModeSource?: TurnExecutionLatencyModeSourceV1;\n};\n\nfunction settingsForTurnExecutionPolicy(settings: Settings, modelId: string): Settings {\n  if (settings.codexSubscriptionEnabled && modelId.startsWith(CODEX_MODEL_ID_PREFIX)) {\n    return withCodexCatalogProvider(settings);\n  }\n  if (\n    settings.supergrokSubscriptionEnabled &&\n    modelId.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX)\n  ) {\n    return withXaiSubscriptionCatalogProvider(settings);\n  }\n  if (modelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {\n    // API/worker workspace boundaries may already have overlaid durable custom\n    // rows and, at execution time, the decrypted workspace key. Re-applying an\n    // empty static overlay would silently discard both. Only synthesize the\n    // curated fallback when this exact model is not already executable.\n    if (resolveModelProvider(settings, modelId)) {\n      return settings;\n    }\n    return withWorkspaceGatewayCatalogProvider(settings);\n  }\n  if (modelId.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX)) {\n    if (resolveModelProvider(settings, modelId)) {\n      return settings;\n    }\n    return withWorkspaceOpenRouterCatalogProvider(settings);\n  }\n  if (modelId.startsWith(ORGANIZATION_GATEWAY_MODEL_ID_PREFIX)) {\n    return resolveModelProvider(settings, modelId)\n      ? settings\n      : withOrganizationGatewayCatalogProvider(settings);\n  }\n  if (modelId.startsWith(ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX)) {\n    return resolveModelProvider(settings, modelId)\n      ? settings\n      : withOrganizationOpenRouterCatalogProvider(settings);\n  }\n  if (modelId.startsWith(WORKSPACE_OPPER_MODEL_ID_PREFIX)) {\n    return resolveModelProvider(settings, modelId)\n      ? settings\n      : withWorkspaceOpperCatalogProvider(settings);\n  }\n  if (modelId.startsWith(ORGANIZATION_OPPER_MODEL_ID_PREFIX)) {\n    return resolveModelProvider(settings, modelId)\n      ? settings\n      : withOrganizationOpperCatalogProvider(settings);\n  }\n  // Organization OpenAI and Azure OpenAI have no secret-free fallback: each\n  // provider exists only with the organization's own curated models, which\n  // the workspace boundary overlays. Without them the model stays unresolved.\n  return settings;\n}\n\n/**\n * Resolve the static catalog identity used by an accepted turn. Subscription\n * overlays contain no account or bearer and do not prove connection readiness;\n * callers must keep their live credential/readiness gate authoritative.\n */\nexport function resolveModelProviderForTurn(\n  settings: Settings,\n  modelId: string,\n): ReturnType<typeof resolveModelProvider> {\n  const catalogSettings = settingsForTurnExecutionPolicy(settings, modelId);\n  return resolveModelProvider(\n    catalogSettings,\n    canonicalizeConfiguredModelId(catalogSettings, modelId),\n  );\n}\n\n/**\n * The requested model cannot start new work: it is retired from new selection\n * or absent from the configured catalog. Callers that own a durable refusal\n * (for example a scheduled occurrence) record it instead of failing blindly.\n */\nexport class TurnExecutionPolicyModelUnavailableError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"TurnExecutionPolicyModelUnavailableError\";\n  }\n}\n\n/**\n * Build a trusted, secret-safe execution policy from the normalized catalog.\n * The Codex overlay here contains static product/provider identity only; it\n * neither proves readiness nor chooses, decrypts, leases, or exposes an account.\n */\nexport function resolveTurnExecutionPolicyV1(\n  settings: Settings,\n  input: ResolveTurnExecutionPolicyV1Input,\n): TurnExecutionPolicyV1 {\n  const catalogSettings = settingsForTurnExecutionPolicy(settings, input.modelId);\n  const productModelId = canonicalizeConfiguredModelId(catalogSettings, input.modelId);\n  if (!isModelAvailableForNewSelection(catalogSettings, productModelId)) {\n    throw new TurnExecutionPolicyModelUnavailableError(\n      \"Turn execution policy model is retired from new selection\",\n    );\n  }\n  const resolved = resolveModelProvider(catalogSettings, productModelId);\n  if (!resolved) {\n    throw new TurnExecutionPolicyModelUnavailableError(\n      \"Turn execution policy model is not present in the configured catalog\",\n    );\n  }\n  if (\n    input.requestedModelId !== null &&\n    canonicalizeConfiguredModelId(catalogSettings, input.requestedModelId) !== productModelId\n  ) {\n    throw new Error(\"Turn execution policy requested model does not canonicalize to its product\");\n  }\n  const latencyMode = LatencyMode.parse(input.latencyMode ?? \"standard\");\n  const latencyModeSource = input.latencyModeSource ?? \"deployment\";\n  assertLatencyModeRunnable(catalogSettings, productModelId, latencyMode);\n  return TurnExecutionPolicyV1.parse({\n    schemaVersion: 1,\n    productModelId,\n    requestedModelId: input.requestedModelId,\n    modelSource: input.modelSource,\n    reasoningEffort: input.reasoningEffort,\n    reasoningSource: input.reasoningSource,\n    latencyMode,\n    latencyModeSource,\n    providerId: resolved.provider.id,\n    upstreamModelId: resolved.model.upstreamModelId,\n    wireApi: resolved.model.api,\n    credentialSource: resolved.model.credentialSource,\n    billing: resolved.model.billing,\n    definitionVersion: resolved.model.definitionVersion,\n  });\n}\n\n/** Explicit accepted execution identity matches, but its definition digest differs. */\nexport class TurnExecutionPolicyDefinitionMismatchError extends Error {\n  readonly code = \"turn_execution_policy_definition_mismatch\";\n\n  constructor() {\n    super(\"Turn execution policy does not match the current provider definition\");\n    this.name = \"TurnExecutionPolicyDefinitionMismatchError\";\n  }\n}\n\n/**\n * Parse-time validation lives in @opengeni/contracts; this verifier binds a\n * serving snapshot to its executable definition and mapped reasoning. This\n * does not activate placement or replace the immutable accepted-turn policy.\n */\nexport function assertTurnServingPolicyMatchesConfigV1(\n  settings: Settings,\n  revision: TurnServingPolicyV1,\n  acceptedPolicy: TurnExecutionPolicyV1,\n): ReturnType<typeof assertTurnExecutionPolicyMatchesConfigV1> {\n  if (!settings.subscriptionCrossProviderFailoverEnabled)\n    throw new Error(\"Subscription model failover is disabled\");\n  if (TurnExecutionPolicyV1.parse(acceptedPolicy).credentialRestriction !== undefined) {\n    throw new Error(\"Restricted accepted policies cannot switch\");\n  }\n  const { policy } = TurnServingPolicyV1.parse(revision);\n  // Verify the SERVING definition and mapped level, never compare with the\n  // accepted model or mutate that immutable admission/authority snapshot.\n  return assertTurnExecutionPolicyMatchesConfigV1(settings, policy, {\n    modelId: policy.productModelId,\n    reasoningEffort: policy.reasoningEffort,\n    latencyMode: policy.latencyMode,\n  });\n}\n\n/** Bind an accepted snapshot to the current definition and exact turn row.\n * Non-additive executable drift fails before a provider or compaction call.\n */\nexport function assertTurnExecutionPolicyMatchesConfigV1(\n  settings: Settings,\n  policy: TurnExecutionPolicyV1,\n  expected: {\n    modelId: string;\n    reasoningEffort: Settings[\"openaiReasoningEffort\"];\n    latencyMode?: LatencyMode;\n  },\n): {\n  policy: TurnExecutionPolicyV1;\n  provider: ResolvedModelProvider;\n  model: ConfiguredModel;\n} {\n  const parsed = TurnExecutionPolicyV1.parse(policy);\n  const catalogSettings = settingsForTurnExecutionPolicy(settings, parsed.productModelId);\n  const canonicalExpectedModel = canonicalizeConfiguredModelId(catalogSettings, expected.modelId);\n  const expectedLatencyMode = expected.latencyMode ?? parsed.latencyMode;\n  if (\n    parsed.productModelId !== canonicalExpectedModel ||\n    parsed.reasoningEffort !== expected.reasoningEffort ||\n    parsed.latencyMode !== expectedLatencyMode\n  ) {\n    throw new Error(\n      \"Turn execution policy does not match the accepted turn model/reasoning/latency\",\n    );\n  }\n  assertLatencyModeRunnable(catalogSettings, parsed.productModelId, parsed.latencyMode);\n  if (\n    parsed.requestedModelId !== null &&\n    canonicalizeConfiguredModelId(catalogSettings, parsed.requestedModelId) !==\n      parsed.productModelId\n  ) {\n    throw new Error(\"Turn execution policy requested model does not match its product model\");\n  }\n  const resolved = resolveModelProvider(catalogSettings, parsed.productModelId);\n  if (!resolved) {\n    throw new Error(\"Turn execution policy model is no longer configured\");\n  }\n  // The individual-account cutover corrects subscription accounting labels.\n  // Preserve an already accepted legacy policy only if its complete original\n  // executable digest matches; this exception cannot compose with other drift.\n  const legacyClaudeScope =\n    resolved.provider.kind === \"claude-subscription-workspace\"\n      ? \"workspace\"\n      : resolved.provider.kind === \"claude-subscription-organization\"\n        ? \"organization\"\n        : null;\n  const legacyClaudeAccountingMatches =\n    legacyClaudeScope !== null &&\n    parsed.providerId === resolved.provider.id &&\n    parsed.upstreamModelId === resolved.model.upstreamModelId &&\n    parsed.wireApi === resolved.model.api &&\n    canonicalJson(parsed.credentialSource) ===\n      canonicalJson({\n        kind: `${legacyClaudeScope}_connection`,\n        mechanism: \"api_key\",\n      }) &&\n    canonicalJson(parsed.billing) ===\n      canonicalJson({\n        upstreamPayer: legacyClaudeScope,\n        metering: \"external\",\n      }) &&\n    parsed.definitionVersion ===\n      definitionVersionFor(\n        {\n          ...resolved.model,\n          credentialSource: parsed.credentialSource,\n          billing: parsed.billing,\n        },\n        resolved.provider,\n        { includeAutoCompactTokenLimit: true },\n      );\n  // wireProfile was added to the definition digest after policies already\n  // existed in durable in-flight turns. An omitted profile meant exactly\n  // \"openai\", so accept that one legacy digest only; Azure and every other\n  // executable-definition change remain fail-closed. A model whose structured\n  // output was enabled after acceptance is also checked in its one\n  // pre-enablement form.\n  const structuredOutputHistorical = structuredOutputPreEnablementModel(\n    resolved.model,\n    resolved.provider,\n  );\n  const definitionVersionMatches =\n    acceptedDefinitionVersionMatches(resolved.model, resolved.provider, parsed) ||\n    (structuredOutputHistorical !== null &&\n      acceptedDefinitionVersionMatches(structuredOutputHistorical, resolved.provider, parsed));\n  const identityMismatched =\n    parsed.providerId !== resolved.provider.id ||\n    parsed.upstreamModelId !== resolved.model.upstreamModelId ||\n    parsed.wireApi !== resolved.model.api ||\n    canonicalJson(parsed.credentialSource) !== canonicalJson(resolved.model.credentialSource) ||\n    canonicalJson(parsed.billing) !== canonicalJson(resolved.model.billing);\n  // Identity/source changes must never enter a rollout-retry classification,\n  // even when their definition digest also differs.\n  if (identityMismatched && !legacyClaudeAccountingMatches) {\n    throw new Error(\"Turn execution policy does not match the current provider definition\");\n  }\n  if (!definitionVersionMatches && !legacyClaudeAccountingMatches) {\n    throw new TurnExecutionPolicyDefinitionMismatchError();\n  }\n  return {\n    policy: parsed,\n    provider: resolved.provider,\n    model: configuredModelForAcceptedTurnExecutionPolicy(resolved.model, resolved.provider, parsed),\n  };\n}\n\n/**\n * Effective per-model pricing schedules. Merge order (later wins): built-in\n * flat defaults → registry model flat/scheduled pricing → explicit\n * OPENGENI_MODEL_PRICING_JSON. Explicit entries may be legacy flat prices or a\n * complete schedule, and always replace the lower-precedence schedule.\n */\nexport function configuredModelPricingSchedules(\n  settings: Settings,\n): Record<string, ModelPricingScheduleV1> {\n  const defaults = Object.fromEntries(\n    Object.entries(defaultModelPricing).map(([model, pricing]) => [\n      model,\n      normalizeModelPricingSchedule(pricing),\n    ]),\n  );\n  const registry: Record<string, ModelPricingScheduleV1> = {};\n  for (const provider of configuredRegistryProviders(settings)) {\n    for (const model of provider.models) {\n      if (model.pricing) {\n        registry[model.id] = normalizeModelPricingSchedule(model.pricing);\n      }\n    }\n  }\n  const configured = Object.fromEntries(\n    Object.entries(parseModelPricingJson(settings.modelPricingJson)).map(([model, pricing]) => [\n      model,\n      normalizeModelPricingSchedule(pricing),\n    ]),\n  );\n  return {\n    ...defaults,\n    ...registry,\n    ...configured,\n  };\n}\n\n/**\n * Insights list-price metadata, including reviewed namespaced provider routes.\n * Kept separate from debit/catalog pricing: adding a comparison must not change\n * an accepted turn's frozen execution-definition hash or payer classification.\n * Inline registry and explicit product-ID prices always win over projections.\n */\nexport function configuredModelListPricingSchedules(\n  settings: Settings,\n): Record<string, ModelPricingScheduleV1> {\n  const prices = configuredModelPricingSchedules(settings);\n  const configured = Object.fromEntries(\n    Object.entries(parseModelPricingJson(settings.modelPricingJson)).map(([model, pricing]) => [\n      model,\n      normalizeModelPricingSchedule(pricing),\n    ]),\n  );\n  // Bare new IDs need the actual configured public OpenAI route, not merely a\n  // familiar model name. Azure/custom endpoints do not inherit these API rates.\n  if (\n    settings.openaiProvider === \"openai\" &&\n    isDirectOpenAiApiBaseUrl(settings.openaiBaseUrl ?? \"https://api.openai.com/v1\")\n  ) {\n    for (const model of configuredModels(settings)) {\n      if (\n        model.providerId !== builtinProviderId(settings) ||\n        !model.upstreamModelId.startsWith(\"gpt-\") ||\n        prices[model.id] !== undefined\n      )\n        continue;\n      const reviewed = reviewedModelListPricing[model.upstreamModelId];\n      if (reviewed) prices[model.id] = reviewed;\n    }\n  }\n  for (const provider of configuredRegistryProviders(settings)) {\n    for (const model of provider.models) {\n      if (prices[model.id] !== undefined) continue;\n      const reviewed = reviewedProviderModelPricing(settings, provider, model, configured);\n      if (reviewed) prices[model.id] = reviewed;\n    }\n  }\n  return prices;\n}\n\n/**\n * A reviewed upstream list rate may also describe a namespaced product route.\n * Never infer a rate by stripping arbitrary prefixes, matching labels, or\n * treating every OpenAI-compatible endpoint as the original provider.\n * This is pricing metadata only: credential selection and payer/metering are\n * still derived exclusively from the accepted execution policy.\n */\nfunction reviewedProviderModelPricing(\n  settings: Settings,\n  provider: InternalRegistryProvider,\n  model: RegistryProvider[\"models\"][number],\n  configured: Record<string, ModelPricingScheduleV1>,\n): ModelPricingScheduleV1 | undefined {\n  const upstream = model.upstreamModelId ?? model.id;\n  let priceId: string | undefined;\n  let nativeClaude = false;\n  switch (provider.kind) {\n    case \"anonymous\":\n      if (\n        provider.baseUrl.replace(/\\/$/u, \"\") === OPENROUTER_BASE_URL &&\n        upstream === DEFAULT_OPENROUTER_MODEL_ID.slice(OPENROUTER_MODEL_ID_PREFIX.length)\n      ) {\n        priceId = DEFAULT_OPENROUTER_MODEL_ID;\n      }\n      break;\n    case \"codex-subscription\":\n      if (upstream.startsWith(\"gpt-\")) priceId = upstream;\n      break;\n    case \"xai-subscription\":\n      if (upstream.startsWith(\"grok-\")) priceId = upstream;\n      break;\n    case \"anthropic-workspace\":\n    case \"anthropic-organization\":\n    case \"claude-subscription-workspace\":\n    case \"claude-subscription-organization\":\n      if (claudeNativeModelProfile(upstream)) {\n        priceId = upstream;\n        nativeClaude = true;\n      }\n      break;\n    case \"direct-openai-workspace\":\n    case \"direct-openai-organization\":\n      if (isDirectOpenAiApiBaseUrl(provider.baseUrl) && upstream.startsWith(\"gpt-\")) {\n        priceId = upstream;\n      }\n      break;\n    case \"vercel-gateway-managed\":\n    case \"vercel-gateway-workspace\":\n    case \"vercel-gateway-organization\":\n      // Only curated, provider-pinned routes use the conservative fallback.\n      // Arbitrary Gateway custom models still require exact reported cost or\n      // an explicit operator rate, even if their slugs resemble a known model.\n      priceId = configuredGatewayCatalogModels(settings).find(\n        (candidate) =>\n          candidate.upstreamModelId === upstream &&\n          Object.values(OPENGENI_GATEWAY_MODELS).some(\n            (reviewed) => reviewed.upstreamModelId === candidate.upstreamModelId,\n          ),\n      )?.productId;\n      break;\n    case \"openrouter-workspace\":\n    case \"openrouter-organization\":\n    case \"openrouter-managed\":\n      if (upstream === DEFAULT_OPENROUTER_MODEL_ID.slice(OPENROUTER_MODEL_ID_PREFIX.length)) {\n        priceId = DEFAULT_OPENROUTER_MODEL_ID;\n      }\n      break;\n    case \"opper-managed\":\n    case \"opper-workspace\":\n    case \"opper-organization\": {\n      // Only reviewed, provider-pinned curated routes carry a static rate.\n      // Custom slugs and pools need an explicit operator rate.\n      if (!configuredOpperUpstreamModelIds(settings).includes(upstream)) return undefined;\n      return reviewedOpperModelPricing(upstream);\n    }\n    case \"api-key\":\n      // Explicit deployments of the official APIs may use their own product\n      // IDs. Custom gateways/proxies and Azure SKUs do not inherit API rates.\n      if (isDirectOpenAiApiBaseUrl(provider.baseUrl) && upstream.startsWith(\"gpt-\")) {\n        priceId = upstream;\n      } else if (provider.baseUrl.replace(/\\/$/u, \"\") === \"https://api.x.ai/v1\") {\n        if (upstream.startsWith(\"grok-\")) priceId = upstream;\n      } else if (\n        provider.api === \"anthropic-messages\" &&\n        provider.baseUrl.replace(/\\/$/u, \"\") === \"https://api.anthropic.com/v1\" &&\n        claudeNativeModelProfile(upstream)\n      ) {\n        priceId = upstream;\n        nativeClaude = true;\n      }\n      break;\n    default:\n      return undefined;\n  }\n  if (!priceId) return undefined;\n  // Explicit upstream overrides retain the existing Codex comparison behavior;\n  // a product-ID override or inline registry rate still has higher precedence.\n  if (configured[priceId]) return configured[priceId];\n  const schedule =\n    reviewedModelListPricing[priceId] ??\n    defaultModelPricing[priceId] ??\n    (priceId === DEFAULT_OPENROUTER_MODEL_ID ? reviewedFreeOpenRouterListPricing : undefined);\n  if (!schedule) return undefined;\n  if (!nativeClaude || provider.anthropic?.cacheTtl !== \"1h\") return schedule;\n  // Anthropic's 1-hour cache writes are 2x base input, rather than 5m's 1.25x.\n  const hourCacheWrite = (price: ModelPricing) => ({\n    ...price,\n    cacheWriteMicrosPerMillionTokens: price.inputMicrosPerMillionTokens * 2,\n  });\n  return {\n    ...schedule,\n    default: hourCacheWrite(schedule.default),\n    ...(schedule.inputTokenTiers\n      ? {\n          inputTokenTiers: schedule.inputTokenTiers.map((tier) => ({\n            ...tier,\n            pricing: hourCacheWrite(tier.pricing),\n          })),\n        }\n      : {}),\n  };\n}\n\n/** Legacy flat projection: returns the default/below-threshold price. */\nexport function configuredModelPricing(settings: Settings): Record<string, ModelPricing> {\n  return Object.fromEntries(\n    Object.entries(configuredModelPricingSchedules(settings)).map(([model, schedule]) => [\n      model,\n      schedule.default,\n    ]),\n  );\n}\n\n/** Select the per-provider-request price at an exact input-token threshold. */\nexport function selectModelPricing(\n  schedule: ModelPricingScheduleV1,\n  inputTokens: number,\n): ModelPricing {\n  const normalizedInputTokens = Math.max(0, Math.floor(inputTokens));\n  let selected = schedule.default;\n  for (const tier of schedule.inputTokenTiers ?? []) {\n    if (normalizedInputTokens < tier.minimumInputTokens) {\n      break;\n    }\n    selected = tier.pricing;\n  }\n  return selected;\n}\n\n/**\n * Usable input-token budget: an explicit model-catalog effective window when\n * available, otherwise the deployment window minus its output reserve.\n */\nexport function contextInputBudgetTokens(\n  settings: Pick<\n    Settings,\n    \"contextWindowTokens\" | \"contextEffectiveWindowTokens\" | \"contextReservedOutputTokens\"\n  >,\n): number {\n  if (settings.contextEffectiveWindowTokens !== undefined) {\n    return Math.min(settings.contextWindowTokens, settings.contextEffectiveWindowTokens);\n  }\n  return Math.max(0, settings.contextWindowTokens - settings.contextReservedOutputTokens);\n}\n\n/**\n * Apply the resolved provider/model's context policy to one turn. Registry\n * metadata is authoritative when present; deployment defaults remain the\n * fallback for models that do not declare their own limits.\n */\nexport function settingsWithResolvedModelContext(\n  settings: Settings,\n  model: Pick<\n    ConfiguredModel,\n    | \"contextWindowTokens\"\n    | \"effectiveContextWindowTokens\"\n    | \"autoCompactTokenLimit\"\n    | \"toolOutputTruncationTokens\"\n  > & { id?: string },\n  workspaceSettings?: unknown,\n  organizationDefaults?: Pick<OrganizationModelDefaults, \"modelCompactionThresholds\"> | null,\n): Settings {\n  const contextWindowTokens = model.contextWindowTokens ?? settings.contextWindowTokens;\n  const resolved = {\n    ...settings,\n    contextWindowTokens,\n    ...(model.effectiveContextWindowTokens === undefined\n      ? {}\n      : {\n          contextEffectiveWindowTokens: Math.min(\n            contextWindowTokens,\n            model.effectiveContextWindowTokens,\n          ),\n        }),\n    ...(model.autoCompactTokenLimit === undefined\n      ? {}\n      : { contextAutoCompactThresholdTokens: model.autoCompactTokenLimit }),\n    ...(model.toolOutputTruncationTokens === undefined\n      ? {}\n      : { modelToolOutputTruncationTokens: model.toolOutputTruncationTokens }),\n  };\n  if (workspaceSettings === undefined || !model.id) return resolved;\n  return {\n    ...resolved,\n    contextAutoCompactThresholdTokens: workspaceModelCompactionPolicy(\n      settings,\n      { ...model, id: model.id },\n      workspaceSettings,\n      organizationDefaults,\n    ).effectiveTokens,\n  };\n}\n\n/**\n * One policy projection for settings UI and all model-facing worker paths.\n * The workspace's own preference wins, then the organization's default for\n * the model, then the model's own default.\n */\nexport function workspaceModelCompactionPolicy(\n  settings: Settings,\n  model: Pick<\n    ConfiguredModel,\n    \"id\" | \"contextWindowTokens\" | \"effectiveContextWindowTokens\" | \"autoCompactTokenLimit\"\n  >,\n  workspaceSettings: unknown,\n  organizationDefaults?: Pick<OrganizationModelDefaults, \"modelCompactionThresholds\"> | null,\n): ModelCompactionPolicy {\n  const resolved = settingsWithResolvedModelContext(settings, model);\n  const maximumTokens = Math.max(\n    0,\n    Math.floor(Math.min(resolved.contextWindowTokens * 0.9, contextInputBudgetTokens(resolved))),\n  );\n  const minimumTokens = Math.min(16_000, maximumTokens);\n  // Preserve deployment defaults below the UI's custom minimum. A new\n  // preference must not silently raise an existing operator-set trigger.\n  const clamp = (value: number) => Math.max(0, Math.min(maximumTokens, Math.floor(value)));\n  const defaultTokens = clamp(\n    resolved.contextAutoCompactThresholdTokens ??\n      resolved.contextWindowTokens *\n        Math.max(0.3, Math.min(0.9, resolved.contextCompactionThresholdRatio)),\n  );\n  const overrideTokens = workspaceModelCompactionThreshold(workspaceSettings, model.id);\n  const organizationTokens = organizationModelCompactionThreshold(organizationDefaults, model.id);\n  return {\n    defaultTokens,\n    overrideTokens,\n    organizationTokens,\n    effectiveTokens: clamp(overrideTokens ?? organizationTokens ?? defaultTokens),\n    minimumTokens,\n    maximumTokens,\n  };\n}\n\nexport function configuredStaticUsageLimits(settings: Settings): StaticUsageLimitsConfig {\n  return parseStaticUsageLimitsJson(settings.staticUsageLimitsJson);\n}\n\nexport function configuredEntitlements(settings: Settings): EntitlementsConfig {\n  if (settings.entitlementsMode === \"none\") {\n    return {};\n  }\n  const configured = parseStaticEntitlementsJson(settings.staticEntitlementsJson);\n  if (settings.entitlementsMode === \"static\") {\n    return configured;\n  }\n  return {\n    \"managed.auth.email_password\": true,\n    \"managed.billing.prepaid_credits\": settings.billingMode === \"stripe\",\n    \"managed.api_keys\": true,\n    \"managed.workspaces\": true,\n    \"managed.github_app\": Boolean(settings.githubAppId && settings.githubAppPrivateKey),\n    ...configured,\n  };\n}\n\nexport function calculateModelUsageCostMicros(\n  settings: Settings,\n  model: string,\n  usage: ModelUsageInput,\n  options?: { latencyMode?: LatencyMode },\n): number {\n  return calculateModelUsageCostBreakdown(settings, model, usage, options).creditCostMicros;\n}\n\nexport function calculateModelUsageCostBreakdown(\n  settings: Settings,\n  model: string,\n  usage: ModelUsageInput,\n  options?: { latencyMode?: LatencyMode },\n): ModelUsageCostBreakdown {\n  const schedule = configuredModelPricingSchedules(settings)[model];\n  return calculateUsageCostBreakdown(settings, model, usage, schedule, options);\n}\n\n/** Provider-list/equivalent-credit comparison only; never debit authority. */\nexport function calculateModelListUsageCostBreakdown(\n  settings: Settings,\n  model: string,\n  usage: ModelUsageInput,\n  options?: { latencyMode?: LatencyMode },\n): ModelUsageCostBreakdown {\n  const schedule = configuredModelListPricingSchedules(settings)[model];\n  return calculateUsageCostBreakdown(settings, model, usage, schedule, options);\n}\n\n/**\n * Forward-only list comparison snapshot for the model-call fact writer.\n * Callers must establish request price provenance (including geography/service\n * tier) and retain per-request counters. Unknown counters/TTL/modifiers yield\n * no class split, not invented zeros. Historical facts must not use this helper.\n * Native Claude details preserve cache_write_tokens_5m and cache_write_tokens_1h.\n */\nexport function calculateModelListUsageCostSnapshot(\n  settings: Settings,\n  model: string,\n  usage: ModelUsageInput,\n  options?: { latencyMode?: LatencyMode; priceContextKnown?: boolean },\n): ModelListUsageCostSnapshot {\n  const schedule = configuredModelListPricingSchedules(settings)[model];\n  const fallback = calculateUsageCostBreakdown(settings, model, usage, schedule, options);\n  const unknown = { ...fallback, listByClassMicros: null, listByClassApprox: false };\n  if (!schedule || !options?.priceContextKnown) return unknown;\n  const entries = usage.requestUsageEntries?.length ? usage.requestUsageEntries : [usage];\n  const classes: ModelListCostClassesMicros = {\n    uncachedInput: 0,\n    cacheRead: 0,\n    cacheWrite: 0,\n    output: 0,\n  };\n  const rawCostByPricing = new Map<ModelPricing, number>();\n  const native = nativeClaudeListWriteContext(settings, model);\n  for (const entry of entries) {\n    if (!knownTokenCounter(entry.inputTokens) || !knownTokenCounter(entry.outputTokens))\n      return unknown;\n    const cached = knownDetailTokenCounter(entry, [\n      \"cached_tokens\",\n      \"cachedInputTokens\",\n      \"cached_input_tokens\",\n    ]);\n    const writes = knownDetailTokenCounter(entry, [\"cache_write_tokens\", \"cacheWriteTokens\"], true);\n    if (cached === undefined || writes === undefined || cached + writes > entry.inputTokens)\n      return unknown;\n    const pricing = selectModelPricing(schedule, entry.inputTokens);\n    if (cached > 0 && pricing.cachedInputMicrosPerMillionTokens === undefined) return unknown;\n    if (writes > 0 && pricing.cacheWriteMicrosPerMillionTokens === undefined) return unknown;\n    const costs: ModelListCostClassesMicros = {\n      uncachedInput: Math.ceil(\n        ((entry.inputTokens - cached - writes) * pricing.inputMicrosPerMillionTokens) / 1_000_000,\n      ),\n      cacheRead: Math.ceil((cached * (pricing.cachedInputMicrosPerMillionTokens ?? 0)) / 1_000_000),\n      cacheWrite: Math.ceil((writes * (pricing.cacheWriteMicrosPerMillionTokens ?? 0)) / 1_000_000),\n      output: Math.ceil((entry.outputTokens * pricing.outputMicrosPerMillionTokens) / 1_000_000),\n    };\n    if (native && writes > 0) {\n      const fiveMinute = knownDetailTokenCounter(entry, [\"cache_write_tokens_5m\"]);\n      const oneHour = knownDetailTokenCounter(entry, [\"cache_write_tokens_1h\"]);\n      if (fiveMinute === undefined || oneHour === undefined || fiveMinute + oneHour !== writes)\n        return unknown;\n      if (native.publishedRates) {\n        costs.cacheWrite =\n          Math.ceil((fiveMinute * native.publishedRates.fiveMinute) / 1_000_000) +\n          Math.ceil((oneHour * native.publishedRates.oneHour) / 1_000_000);\n      } else if (\n        !(\n          (native.declaredTtl === \"5m\" && oneHour === 0) ||\n          (native.declaredTtl === \"1h\" && fiveMinute === 0)\n        )\n      ) {\n        // A single explicit override cannot establish two different TTL prices.\n        return unknown;\n      }\n    }\n    const raw = sumListCostClasses(costs);\n    rawCostByPricing.set(pricing, (rawCostByPricing.get(pricing) ?? 0) + raw);\n    for (const key of MODEL_LIST_COST_CLASS_KEYS) classes[key] += costs[key];\n  }\n  let providerCostMicros = sumListCostClasses(classes);\n  let creditCostMicros = 0;\n  for (const [pricing, raw] of rawCostByPricing) {\n    const marginBps = effectiveCreditMarginBps(settings, pricing.marginBps);\n    creditCostMicros += Math.ceil((raw * (10_000 + marginBps)) / 10_000);\n  }\n  let listByClassApprox = false;\n  const latencyMode = options.latencyMode ?? \"standard\";\n  if (latencyMode !== \"standard\") {\n    const catalogSettings = settingsForTurnExecutionPolicy(settings, model);\n    const resolved = resolveModelProvider(\n      catalogSettings,\n      canonicalizeConfiguredModelId(catalogSettings, model),\n    );\n    const multiplier = resolved?.model.capabilities.latencyModes.find(\n      (mode) => mode.id === latencyMode && mode.runnable,\n    )?.billingMultiplierBps;\n    if (multiplier === undefined || multiplier <= 0) return unknown;\n    providerCostMicros = Math.ceil((providerCostMicros * multiplier) / 10_000);\n    creditCostMicros = Math.ceil((creditCostMicros * multiplier) / 10_000);\n    const scaled = allocateLatencyListCostClasses(classes, multiplier, providerCostMicros);\n    if (!scaled) return unknown;\n    Object.assign(classes, scaled.classes);\n    listByClassApprox = scaled.approximate;\n  }\n  if (![providerCostMicros, creditCostMicros, ...Object.values(classes)].every(knownTokenCounter))\n    return unknown;\n  return { providerCostMicros, creditCostMicros, listByClassMicros: classes, listByClassApprox };\n}\n\n/**\n * Approximate class attribution of a previously recorded upstream list total.\n * Current reviewed rates are weights only: this never recomputes that total,\n * credits, or charges. Missing class counters/rates remain unknown. Historical\n * cache writes use the schedule's single TTL rate, not an exact TTL assertion.\n * Reasoning is already included in outputTokens and is never added again.\n */\nexport function allocateRecordedModelListCostByClass(\n  settings: Settings,\n  model: string,\n  usage: ModelUsageInput,\n  recordedProviderCostMicros: number | null | undefined,\n): ModelRecordedListCostAllocation {\n  const unknown: ModelRecordedListCostAllocation = {\n    listByClassMicros: null,\n    listByClassApprox: false,\n  };\n  if (!knownTokenCounter(recordedProviderCostMicros)) return unknown;\n  const schedule = configuredModelListPricingSchedules(settings)[model];\n  if (!schedule) return unknown;\n  const weights = { uncachedInput: 0n, cacheRead: 0n, cacheWrite: 0n, output: 0n };\n  const entries = usage.requestUsageEntries?.length ? usage.requestUsageEntries : [usage];\n  for (const entry of entries) {\n    if (!knownTokenCounter(entry.inputTokens) || !knownTokenCounter(entry.outputTokens))\n      return unknown;\n    const cached = knownDetailTokenCounter(entry, [\n      \"cached_tokens\",\n      \"cachedInputTokens\",\n      \"cached_input_tokens\",\n    ]);\n    const writes = knownDetailTokenCounter(entry, [\"cache_write_tokens\", \"cacheWriteTokens\"], true);\n    if (cached === undefined || writes === undefined || cached + writes > entry.inputTokens)\n      return unknown;\n    const pricing = selectModelPricing(schedule, entry.inputTokens);\n    const counters = {\n      uncachedInput: entry.inputTokens - cached - writes,\n      cacheRead: cached,\n      cacheWrite: writes,\n      output: entry.outputTokens,\n    };\n    const rates = {\n      uncachedInput: pricing.inputMicrosPerMillionTokens,\n      cacheRead: pricing.cachedInputMicrosPerMillionTokens,\n      cacheWrite: pricing.cacheWriteMicrosPerMillionTokens,\n      output: pricing.outputMicrosPerMillionTokens,\n    };\n    for (const key of MODEL_LIST_COST_CLASS_KEYS) {\n      if (counters[key] === 0) continue;\n      const rate = rates[key];\n      if (!knownTokenCounter(rate)) return unknown;\n      // Do not round or convert weights to Number: both can distort ratios.\n      weights[key] += BigInt(counters[key]) * BigInt(rate);\n    }\n  }\n  const classes = allocateRecordedListCostWeights(weights, recordedProviderCostMicros);\n  return classes ? { listByClassMicros: classes, listByClassApprox: true } : unknown;\n}\n\nconst MODEL_LIST_COST_CLASS_KEYS = [\"uncachedInput\", \"cacheRead\", \"cacheWrite\", \"output\"] as const;\n\nfunction sumListCostClasses(costs: ModelListCostClassesMicros): number {\n  return MODEL_LIST_COST_CLASS_KEYS.reduce((total, key) => total + costs[key], 0);\n}\n\n/** Integer-only largest remainder, preserving the supplied historical total. */\nfunction allocateRecordedListCostWeights(\n  weights: Record<(typeof MODEL_LIST_COST_CLASS_KEYS)[number], bigint>,\n  target: number,\n): ModelListCostClassesMicros | undefined {\n  const denominator = MODEL_LIST_COST_CLASS_KEYS.reduce((total, key) => total + weights[key], 0n);\n  if (denominator === 0n) {\n    return target === 0 ? { uncachedInput: 0, cacheRead: 0, cacheWrite: 0, output: 0 } : undefined;\n  }\n  const rows = MODEL_LIST_COST_CLASS_KEYS.map((key, index) => {\n    const numerator = BigInt(target) * weights[key];\n    return { key, index, value: numerator / denominator, remainder: numerator % denominator };\n  });\n  const remaining = BigInt(target) - rows.reduce((total, row) => total + row.value, 0n);\n  const ranked = [...rows].sort((a, b) =>\n    a.remainder === b.remainder ? a.index - b.index : a.remainder > b.remainder ? -1 : 1,\n  );\n  for (let index = 0; index < Number(remaining); index++) ranked[index]!.value += 1n;\n  return Object.fromEntries(\n    rows.map((row) => [row.key, Number(row.value)]),\n  ) as ModelListCostClassesMicros;\n}\n\nfunction knownTokenCounter(value: unknown): value is number {\n  return typeof value === \"number\" && Number.isSafeInteger(value) && value >= 0;\n}\n\nfunction knownDetailTokenCounter(\n  entry: ModelUsageInput,\n  keys: readonly string[],\n  firstOnly = false,\n): number | undefined {\n  const details = Array.isArray(entry.inputTokensDetails)\n    ? entry.inputTokensDetails\n    : entry.inputTokensDetails\n      ? [entry.inputTokensDetails]\n      : [];\n  if (details.length === 0) return undefined;\n  let total = 0;\n  for (const detail of details) {\n    const present = keys.filter((key) => detail[key] !== undefined);\n    if (present.length === 0) return undefined;\n    for (const key of firstOnly ? present.slice(0, 1) : present) {\n      if (!knownTokenCounter(detail[key])) return undefined;\n      total += detail[key]!;\n    }\n  }\n  return knownTokenCounter(total) ? total : undefined;\n}\n\nfunction nativeClaudeListWriteContext(\n  settings: Settings,\n  modelId: string,\n):\n  | {\n      declaredTtl: \"off\" | \"5m\" | \"1h\" | undefined;\n      publishedRates?: { fiveMinute: number; oneHour: number };\n    }\n  | undefined {\n  for (const provider of configuredRegistryProviders(settings)) {\n    const model = provider.models.find((candidate) => candidate.id === modelId);\n    if (!model || provider.api !== \"anthropic-messages\") continue;\n    const result = { declaredTtl: provider.anthropic?.cacheTtl };\n    const upstream = model.upstreamModelId ?? model.id;\n    const overrides = parseModelPricingJson(settings.modelPricingJson);\n    const official =\n      provider.kind === \"anthropic-workspace\" ||\n      provider.kind === \"anthropic-organization\" ||\n      provider.kind === \"claude-subscription-workspace\" ||\n      provider.kind === \"claude-subscription-organization\" ||\n      (provider.kind === \"api-key\" &&\n        provider.baseUrl.replace(/\\/$/u, \"\") === \"https://api.anthropic.com/v1\");\n    const published = reviewedModelListPricing[upstream]?.default;\n    if (\n      !official ||\n      !claudeNativeModelProfile(upstream) ||\n      !published?.cacheWriteMicrosPerMillionTokens ||\n      model.pricing ||\n      overrides[modelId] !== undefined ||\n      overrides[upstream] !== undefined\n    )\n      return result;\n    return {\n      ...result,\n      publishedRates: {\n        fiveMinute: published.cacheWriteMicrosPerMillionTokens,\n        oneHour: published.inputMicrosPerMillionTokens * 2,\n      },\n    };\n  }\n  return undefined;\n}\n\n/** Deterministic largest-remainder allocation; disclose any fractional scaling. */\nfunction allocateLatencyListCostClasses(\n  classes: ModelListCostClassesMicros,\n  multiplier: number,\n  target: number,\n): { classes: ModelListCostClassesMicros; approximate: boolean } | undefined {\n  if (\n    !knownTokenCounter(multiplier) ||\n    !knownTokenCounter(target) ||\n    !Object.values(classes).every(knownTokenCounter)\n  )\n    return undefined;\n  const rows = MODEL_LIST_COST_CLASS_KEYS.map((key, index) => {\n    const numerator = BigInt(classes[key]) * BigInt(multiplier);\n    return { key, index, value: Number(numerator / 10_000n), remainder: numerator % 10_000n };\n  });\n  const remaining = target - rows.reduce((total, row) => total + row.value, 0);\n  if (remaining < 0 || remaining > rows.length) return undefined;\n  const ranked = [...rows].sort((a, b) =>\n    a.remainder === b.remainder ? a.index - b.index : a.remainder > b.remainder ? -1 : 1,\n  );\n  for (let index = 0; index < remaining; index++) ranked[index]!.value += 1;\n  return {\n    classes: Object.fromEntries(\n      rows.map((row) => [row.key, row.value]),\n    ) as ModelListCostClassesMicros,\n    approximate: rows.some((row) => row.remainder !== 0n),\n  };\n}\n\nfunction calculateUsageCostBreakdown(\n  settings: Settings,\n  model: string,\n  usage: ModelUsageInput,\n  schedule: ModelPricingScheduleV1 | undefined,\n  options?: { latencyMode?: LatencyMode },\n): ModelUsageCostBreakdown {\n  if (!schedule) {\n    throw new Error(`Missing model pricing for ${model}`);\n  }\n  const entries =\n    usage.requestUsageEntries && usage.requestUsageEntries.length > 0\n      ? usage.requestUsageEntries\n      : [usage];\n  const rawCostByPricing = new Map<ModelPricing, number>();\n  for (const entry of entries) {\n    const pricing = selectModelPricing(schedule, positiveInt(entry.inputTokens));\n    rawCostByPricing.set(\n      pricing,\n      (rawCostByPricing.get(pricing) ?? 0) + calculateEntryCostMicros(pricing, entry),\n    );\n  }\n  let providerCostMicros = 0;\n  let creditCostMicros = 0;\n  for (const [pricing, rawCost] of rawCostByPricing) {\n    const marginBps = effectiveCreditMarginBps(settings, pricing.marginBps);\n    providerCostMicros += rawCost;\n    creditCostMicros += Math.ceil((rawCost * (10_000 + marginBps)) / 10_000);\n  }\n  const latencyMode = options?.latencyMode ?? \"standard\";\n  if (latencyMode !== \"standard\") {\n    const catalogSettings = settingsForTurnExecutionPolicy(settings, model);\n    const resolved = resolveModelProvider(\n      catalogSettings,\n      canonicalizeConfiguredModelId(catalogSettings, model),\n    );\n    const multiplierBps = resolved?.model.capabilities.latencyModes.find(\n      (mode) => mode.id === latencyMode && mode.runnable,\n    )?.billingMultiplierBps;\n    if (multiplierBps && multiplierBps > 0) {\n      providerCostMicros = Math.ceil((providerCostMicros * multiplierBps) / 10_000);\n      creditCostMicros = Math.ceil((creditCostMicros * multiplierBps) / 10_000);\n    }\n  }\n  return { providerCostMicros, creditCostMicros };\n}\n\n/**\n * Convert AI Gateway's exact USD inference cost to Opengeni credit micros and\n * apply the configured model margin. Decimal arithmetic is integer-only so a\n * sub-micro provider charge cannot be lost to floating-point rounding.\n */\nexport function calculateGatewayReportedCostMicros(\n  settings: Settings,\n  model: string,\n  inferenceCostUsd: string,\n  options?: { inputTokens?: number },\n): number {\n  return calculateGatewayReportedCostBreakdown(settings, model, inferenceCostUsd, options)\n    .creditCostMicros;\n}\n\ntype GatewayReportedCostDecimal = {\n  providerNumerator: bigint;\n  decimalScale: bigint;\n  providerCostMicros: number;\n};\n\nfunction parseGatewayReportedCostDecimal(inferenceCostUsd: string): GatewayReportedCostDecimal {\n  const match = /^(0|[1-9]\\d*)(?:\\.(\\d{1,18}))?$/.exec(inferenceCostUsd);\n  if (!match) {\n    throw new Error(\"Invalid AI Gateway inference cost\");\n  }\n  const fraction = match[2] ?? \"\";\n  const decimalDigits = BigInt(`${match[1]}${fraction}`);\n  const decimalScale = 10n ** BigInt(fraction.length);\n  const providerNumerator = decimalDigits * 1_000_000n;\n  const providerCostMicros = (providerNumerator + decimalScale - 1n) / decimalScale;\n  if (providerCostMicros > BigInt(Number.MAX_SAFE_INTEGER)) {\n    throw new Error(\"AI Gateway inference cost exceeds the supported billing range\");\n  }\n  return {\n    providerNumerator,\n    decimalScale,\n    providerCostMicros: Number(providerCostMicros),\n  };\n}\n\n/** Exact provider-reported Gateway cost without requiring an Opengeni price schedule. */\nexport function calculateGatewayReportedProviderCostMicros(inferenceCostUsd: string): number {\n  return parseGatewayReportedCostDecimal(inferenceCostUsd).providerCostMicros;\n}\n\nexport function calculateGatewayReportedCostBreakdown(\n  settings: Settings,\n  model: string,\n  inferenceCostUsd: string,\n  options?: { inputTokens?: number },\n): ModelUsageCostBreakdown {\n  const schedule = configuredModelPricingSchedules(settings)[model];\n  if (!schedule) {\n    throw new Error(`Missing model pricing for ${model}`);\n  }\n  const pricing = selectModelPricing(schedule, positiveInt(options?.inputTokens));\n  const { providerNumerator, decimalScale, providerCostMicros } =\n    parseGatewayReportedCostDecimal(inferenceCostUsd);\n  const marginBps = BigInt(10_000 + effectiveCreditMarginBps(settings, pricing.marginBps));\n  const numerator = providerNumerator * marginBps;\n  const denominator = decimalScale * 10_000n;\n  const creditMicros = (numerator + denominator - 1n) / denominator;\n  if (creditMicros > BigInt(Number.MAX_SAFE_INTEGER)) {\n    throw new Error(\"AI Gateway inference cost exceeds the supported billing range\");\n  }\n  return {\n    providerCostMicros,\n    creditCostMicros: Number(creditMicros),\n  };\n}\n\n/**\n * Exact Opengeni product price frozen before a managed video request starts.\n * Gateway reporting is delayed for asynchronous video, so this deliberately\n * does not masquerade as provider-reported cost.\n */\nexport function calculateVideoGenerationCreditCostMicros(\n  settings: Settings,\n  input: {\n    modelId: string;\n    resolution: VideoGenerationResolution;\n    durationSeconds: number;\n  },\n): number {\n  if (input.modelId !== SEEDANCE_2_5_MODEL_ID) {\n    throw new Error(`Missing video generation credit pricing for ${input.modelId}`);\n  }\n  if (!Number.isSafeInteger(input.durationSeconds) || input.durationSeconds < 1) {\n    throw new Error(\"Video generation duration is invalid for credit pricing\");\n  }\n  const rate =\n    input.resolution === \"480p\"\n      ? settings.videoGenerationCredit480pMicrosPerSecond\n      : settings.videoGenerationCredit720pMicrosPerSecond;\n  const cost = rate * input.durationSeconds;\n  if (!Number.isSafeInteger(cost) || cost <= 0 || cost > 1_000_000_000) {\n    throw new Error(\"Video generation credit price exceeds the supported range\");\n  }\n  return cost;\n}\n\nexport function configuredAllowedReasoningEfforts(\n  settings: Settings,\n): Array<z.infer<typeof ReasoningEffort>> {\n  return uniqueValues([\n    settings.openaiReasoningEffort,\n    ...splitCsv(settings.openaiAllowedReasoningEfforts),\n  ]).map((value) => ReasoningEffort.parse(value));\n}\n\n/**\n * Decodes OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY (base64, exactly 32 bytes) for\n * AES-256-GCM workspace environment value encryption. Returns null when unset.\n * Throws naming only the env var, never echoing its value.\n */\nexport function environmentsEncryptionKeyBytes(settings: Settings): Uint8Array | null {\n  if (!settings.environmentsEncryptionKey) {\n    return null;\n  }\n  const decoded = Buffer.from(settings.environmentsEncryptionKey, \"base64\");\n  if (decoded.length !== 32) {\n    throw new Error(\n      \"OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY must be base64 for exactly 32 bytes (generate with: openssl rand -base64 32)\",\n    );\n  }\n  return new Uint8Array(decoded);\n}\n\n/**\n * Build one structurally compatible connection policy for both\n * `@temporalio/client` and `@temporalio/worker`. An API key or any custom TLS\n * material enables TLS automatically; the explicit flag covers server-auth TLS\n * without credentials. Secret values are never included in validation errors.\n */\nexport function temporalConnectionOptions(settings: Settings): TemporalConnectionOptions {\n  const apiKey = settings.temporalApiKey?.trim() || undefined;\n  const serverNameOverride = settings.temporalTlsServerName?.trim() || undefined;\n  const rootCa = decodeTemporalTlsMaterial(\n    settings.temporalTlsRootCaCertificateBase64,\n    \"OPENGENI_TEMPORAL_TLS_ROOT_CA_CERTIFICATE_BASE64\",\n  );\n  const clientCertificate = decodeTemporalTlsMaterial(\n    settings.temporalTlsClientCertificateBase64,\n    \"OPENGENI_TEMPORAL_TLS_CLIENT_CERTIFICATE_BASE64\",\n  );\n  const clientPrivateKey = decodeTemporalTlsMaterial(\n    settings.temporalTlsClientPrivateKeyBase64,\n    \"OPENGENI_TEMPORAL_TLS_CLIENT_PRIVATE_KEY_BASE64\",\n  );\n\n  if (Boolean(clientCertificate) !== Boolean(clientPrivateKey)) {\n    throw new Error(\n      \"OPENGENI_TEMPORAL_TLS_CLIENT_CERTIFICATE_BASE64 and \" +\n        \"OPENGENI_TEMPORAL_TLS_CLIENT_PRIVATE_KEY_BASE64 must both be set or both omitted\",\n    );\n  }\n\n  const tls: TemporalTlsConnectionConfig = {};\n  if (serverNameOverride) {\n    tls.serverNameOverride = serverNameOverride;\n  }\n  if (rootCa) {\n    tls.serverRootCACertificate = rootCa;\n  }\n  if (clientCertificate && clientPrivateKey) {\n    tls.clientCertPair = { crt: clientCertificate, key: clientPrivateKey };\n  }\n  const hasCustomTls = Object.keys(tls).length > 0;\n  const tlsEnabled = settings.temporalTlsEnabled || Boolean(apiKey) || hasCustomTls;\n\n  return {\n    address: settings.temporalHost,\n    ...(tlsEnabled ? { tls: hasCustomTls ? tls : true } : {}),\n    ...(apiKey ? { apiKey } : {}),\n  };\n}\n\nfunction decodeTemporalTlsMaterial(\n  value: string | undefined,\n  settingName: string,\n): Uint8Array | undefined {\n  // RFC 2045 base64 commonly arrives wrapped at 76 columns. Kubernetes\n  // stringData and external secret stores preserve those line breaks, so\n  // normalize whitespace before applying the strict alphabet/canonical check.\n  const encoded = value?.replace(/\\s/g, \"\");\n  if (!encoded) {\n    return undefined;\n  }\n  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded) || encoded.length % 4 === 1) {\n    throw new Error(`${settingName} must contain valid base64`);\n  }\n  const decoded = Buffer.from(encoded, \"base64\");\n  const canonical = decoded.toString(\"base64\").replace(/=+$/, \"\");\n  if (decoded.length === 0 || canonical !== encoded.replace(/=+$/, \"\")) {\n    throw new Error(`${settingName} must contain valid base64`);\n  }\n  return new Uint8Array(decoded);\n}\n\n/**\n * The connection `search_path` for Opengeni's db handles + the managed-auth pool\n * (Step I, §7.8 runtime half). Returns `undefined` when `dbSchema` is unset\n * (standalone) so no `search_path` startup parameter is sent and the server\n * default (`public`) applies — byte-for-byte today's behavior. When `dbSchema`\n * is set (embedded), returns `\"<schema>,opengeni_private,public\"` — `public`\n * stays LAST so `gen_random_uuid()` (pgcrypto) and the `vector` type still\n * resolve (the schema-isolation contract live footgun). `opengeni_private` is on the path so the\n * RLS GUC-reader helpers resolve when referenced unqualified.\n */\nexport function dbSearchPath(settings: Pick<Settings, \"dbSchema\">): string | undefined {\n  const schema = settings.dbSchema?.trim();\n  if (!schema) {\n    return undefined;\n  }\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(schema)) {\n    throw new Error(`OPENGENI_DB_SCHEMA is not a valid Postgres identifier: ${schema}`);\n  }\n  return `${schema},opengeni_private,public`;\n}\n\nexport function collectGitIdentityEnvironment(settings: Settings): Record<string, string> {\n  return Object.fromEntries(\n    Object.entries({\n      GIT_AUTHOR_NAME: settings.gitAuthorName,\n      GIT_AUTHOR_EMAIL: settings.gitAuthorEmail,\n      GIT_COMMITTER_NAME: settings.gitCommitterName ?? settings.gitAuthorName,\n      GIT_COMMITTER_EMAIL: settings.gitCommitterEmail ?? settings.gitAuthorEmail,\n    }).filter(\n      (entry): entry is [string, string] =>\n        typeof entry[1] === \"string\" && entry[1].trim().length > 0,\n    ),\n  );\n}\n\nconst DEFAULT_SANDBOX_PATH = \"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\";\n\n/** Platform-owned manifest env names that are not `OPENGENI_*` pointers. */\nconst PLATFORM_SANDBOX_ENVIRONMENT_NAMES = new Set([\n  \"HOME\",\n  \"PATH\",\n  \"GIT_AUTHOR_NAME\",\n  \"GIT_AUTHOR_EMAIL\",\n  \"GIT_COMMITTER_NAME\",\n  \"GIT_COMMITTER_EMAIL\",\n  \"GIT_ASKPASS\",\n  \"GIT_TERMINAL_PROMPT\",\n]);\n\n/**\n * The manifest-env constants predicate (W1 secrets delivery, RM-3). A sandbox\n * manifest may carry only deployment constants: HOME, PATH, git identity and\n * askpass pointers, `OPENGENI_*` pointers, and the deployment allowlist\n * (`sandboxEnvironmentVariableNames`). User secrets never qualify: they are\n * resolved per command from `{{secret:…}}` references. Used by `buildManifest`\n * and the persisted-envelope strip as a defensive filter.\n */\nexport function sandboxManifestEnvironmentNamePredicate(\n  settings: Settings,\n): (name: string) => boolean {\n  const deployment = new Set(sandboxEnvironmentVariableNames(settings));\n  return (name) =>\n    PLATFORM_SANDBOX_ENVIRONMENT_NAMES.has(name) ||\n    name.startsWith(\"OPENGENI_\") ||\n    deployment.has(name);\n}\n\nfunction prependPathEntry(pathValue: string | undefined, entry: string): string {\n  const parts = (pathValue ?? DEFAULT_SANDBOX_PATH).split(\":\").filter(Boolean);\n  return [entry, ...parts.filter((part) => part !== entry)].join(\":\");\n}\n\n/**\n * The STABLE run-scoped sandbox environment: the subset of a run's box-manifest\n * environment that is IDENTICAL whether the box is first warmed by the worker\n * TURN or by an API-direct ATTACH (viewer / Channel-A / desktop / terminal). It\n * is the layered base every cold box must be created with so a later turn's\n * agent-manifest apply finds an EMPTY environment delta in the SDK's\n * `validateNoEnvironmentDelta` (which throws \"Live sandbox sessions cannot change\n * manifest environment variables\" on ANY key the agent declares that the box's\n * manifest lacks or carries a different value for).\n *\n * Precedence (lowest → highest): deployment allowlist (`collectSandboxEnvironment`)\n * < git identity (`collectGitIdentityEnvironment`) < the backend-aware HOME default.\n * The manifest holds deployment constants only: user secrets never ride it.\n * They are resolved per command from `{{secret:…}}` references (W1 delivery).\n *\n * DELIBERATELY EXCLUDES the per-run, ROTATING git provider token VALUES that\n * `sandboxEnvironmentForRun` mints when a repository resource is\n * attached: that token is minted FRESH per call, so it is not a stable, attach-\n * reproducible value and must not be part of the shared base. Under the token-\n * broker (B1) token VALUES never ride the manifest at all — they are seeded to\n * FILES inside the box and git/provider CLI auth reads those files. What IS stable\n * and lives here for provisioned boxes are the token directory / GitHub alias\n * FILE PATH and wrapper PATH entries: constants derived from HOME, so they\n * appear IDENTICALLY on BOTH the turn AND every attach manifest (the SDK's\n * per-turn provided-session env delta stays empty even as tokens rotate). These\n * helper pointers are deliberately not added for selfhosted/local/none because\n * the platform never mints or seeds git provider tokens there. The attach\n * surfaces have only the `Session` (no repo resources) and so never seed a token,\n * but unwritten files simply yield no auth; the BLOCKING attach-vs-turn error\n * this helper fixes is for the common (no-repo) provisioned-box case.\n */\nexport function stableSandboxEnvironmentForRun(\n  settings: Settings,\n  options: { workspaceId?: string } = {},\n): Record<string, string> {\n  const environment: Record<string, string> = {\n    ...collectSandboxEnvironment(settings),\n    ...collectGitIdentityEnvironment(settings),\n  };\n  // Backend-aware HOME: a provisioned box (docker + every cloud provider) runs the\n  // agent under the descriptor's workspaceRoot. `local` runs in-process as the host\n  // unix user (keep its real $HOME); `selfhosted` runs on a user's machine and must\n  // likewise preserve that machine's real HOME; `none` has no box.\n  const descriptor = CAPABILITY_DESCRIPTORS[settings.sandboxBackend];\n  if (\n    settings.sandboxBackend !== \"none\" &&\n    settings.sandboxBackend !== \"local\" &&\n    settings.sandboxBackend !== \"selfhosted\"\n  ) {\n    environment.HOME ??= descriptor.workspaceRoot;\n  }\n  // TOKEN-BROKER (B1): the STABLE credential FILE PATHS and CLI wrapper PATH for\n  // provisioned boxes only. Constants derived from the resolved HOME (falling\n  // back to the descriptor workspaceRoot), so they are parity-safe — they join\n  // the shared base and therefore appear IDENTICALLY on BOTH the worker-turn\n  // manifest AND every API-direct attach manifest. Only PATHS are stable; token\n  // VALUES live exclusively in files that runtime seeds off-manifest.\n  const provisionedGitHelperBackend =\n    settings.sandboxBackend !== \"none\" &&\n    settings.sandboxBackend !== \"local\" &&\n    settings.sandboxBackend !== \"selfhosted\";\n  if (provisionedGitHelperBackend) {\n    const home = environment.HOME ?? descriptor.workspaceRoot;\n    environment.OPENGENI_GIT_CREDENTIALS_DIR ??= `${home}/.opengeni/git-credentials`;\n    environment.OPENGENI_GIT_TOKEN_FILE ??= `${home}/.opengeni/git-token`;\n    environment.OPENGENI_GIT_CLI_WRAPPER_DIR ??= `${home}/.opengeni/bin`;\n    environment.PATH = prependPathEntry(environment.PATH, environment.OPENGENI_GIT_CLI_WRAPPER_DIR);\n  }\n  if (settings.sandboxBackend !== \"selfhosted\" && resolveFirstPartyDelegationSecret(settings)) {\n    environment.OPENGENI_CODEMODE_TOKEN_FILE ??= `${environment.HOME ?? descriptor.workspaceRoot}/.opengeni/codemode-token`;\n    if (settings.ogtoolPackageSpec) {\n      environment.OPENGENI_OGTOOL_PACKAGE_SPEC ??= settings.ogtoolPackageSpec;\n    }\n    if (options.workspaceId) {\n      environment.OPENGENI_CODEMODE_URL ??= codemodeWorkspaceUrl(settings, options.workspaceId);\n    }\n  }\n  return environment;\n}\n\n/**\n * Whether a resource set carries a GitHub-App-connected repository (installation\n * + repository ids present) — the SAME predicate the worker turn uses to decide\n * whether it declares the stable git-auth pointers. Attach surfaces call this so\n * an attach-warmed cold box carries the IDENTICAL manifest env a later repo turn\n * declares (env parity — see applyGitAuthPointerEnvironment).\n */\nexport function hasGitHubRepositorySelection(\n  resources: ReadonlyArray<{\n    kind: string;\n    provider?: unknown;\n    installationId?: unknown;\n    repositoryId?: unknown;\n    githubInstallationId?: unknown;\n    githubRepositoryId?: unknown;\n  }>,\n): boolean {\n  const positive = (value: unknown): boolean =>\n    (typeof value === \"number\" && Number.isInteger(value) && value > 0) ||\n    (typeof value === \"string\" && /^\\d+$/.test(value) && Number(value) > 0);\n  return resources.some(\n    (resource) =>\n      resource.kind === \"repository\" &&\n      ((positive(resource.githubInstallationId) && positive(resource.githubRepositoryId)) ||\n        (resource.provider === \"github\" &&\n          positive(resource.installationId) &&\n          positive(resource.repositoryId))),\n  );\n}\n\nexport function hasGitCredentialRepositorySelection(\n  resources: ReadonlyArray<{\n    kind: string;\n    provider?: unknown;\n    githubInstallationId?: unknown;\n    githubRepositoryId?: unknown;\n  }>,\n): boolean {\n  return resources.some(\n    (resource) =>\n      resource.kind === \"repository\" &&\n      (resource.provider === \"github\" ||\n        resource.provider === \"gitlab\" ||\n        resource.provider === \"azure_devops\" ||\n        hasGitHubRepositorySelection([resource])),\n  );\n}\n\n/**\n * TOKEN-BROKER (B1) parity: the STABLE git-auth POINTER environment a\n * repo-attached run declares — GIT_ASKPASS (a fixed path under HOME; the script\n * itself is provisioned at box setup), GIT_TERMINAL_PROMPT, and the GitHub-App\n * bot identity fallbacks. NO rotating value rides here (the token lives in the\n * file behind the askpass), so the layer is attach-reproducible and MUST be\n * applied identically by the worker turn (sandboxEnvironmentForRun) AND every\n * API-direct attach surface that can cold-create the box (viewer attach,\n * channel-A ops). A box cold-created WITHOUT this layer kills the next repo\n * turn: the turn's manifest declares these keys, the box's env lacks them, and\n * the SDK's provided-session guard throws \"Live sandbox sessions cannot change\n * manifest environment variables\" (observed live: an open session page's viewer\n * attach won the cold-create race and the first turn died).\n *\n * Mutates and returns `environment`. Identity fallbacks preserve values already\n * present (the deployment git-identity allowlist wins over the bot identity).\n */\nexport function applyGitAuthPointerEnvironment(\n  environment: Record<string, string>,\n  identity: { name: string; email: string } | null,\n): Record<string, string> {\n  environment.GIT_ASKPASS = `${environment.HOME ?? \"/workspace\"}/.opengeni/askpass`;\n  environment.GIT_TERMINAL_PROMPT = \"0\";\n  if (identity) {\n    environment.GIT_AUTHOR_NAME = environment.GIT_AUTHOR_NAME || identity.name;\n    environment.GIT_AUTHOR_EMAIL = environment.GIT_AUTHOR_EMAIL || identity.email;\n    environment.GIT_COMMITTER_NAME = environment.GIT_COMMITTER_NAME || identity.name;\n    environment.GIT_COMMITTER_EMAIL = environment.GIT_COMMITTER_EMAIL || identity.email;\n  }\n  return environment;\n}\n\nexport type StartupRetryOptions = {\n  shouldRetry?: (error: unknown) => boolean;\n  attempts?: number;\n  initialDelayMs?: number;\n  maxDelayMs?: number;\n  onRetry?: (event: {\n    label: string;\n    attempt: number;\n    attempts: number;\n    delayMs: number;\n    error: unknown;\n  }) => void;\n};\n\nexport function startupRetryOptions(\n  settings: Settings,\n): Required<Omit<StartupRetryOptions, \"onRetry\" | \"shouldRetry\">> {\n  return {\n    attempts: settings.startupDependencyRetryAttempts,\n    initialDelayMs: settings.startupDependencyRetryInitialDelayMs,\n    maxDelayMs: settings.startupDependencyRetryMaxDelayMs,\n  };\n}\n\nexport async function retryStartupDependency<T>(\n  label: string,\n  operation: () => Promise<T>,\n  options: StartupRetryOptions = {},\n): Promise<T> {\n  const attempts = Math.max(1, Math.floor(options.attempts ?? 30));\n  const initialDelayMs = Math.max(0, Math.floor(options.initialDelayMs ?? 1000));\n  const maxDelayMs = Math.max(initialDelayMs, Math.floor(options.maxDelayMs ?? 5000));\n  for (let attempt = 1; attempt <= attempts; attempt += 1) {\n    try {\n      return await operation();\n    } catch (error) {\n      if (attempt >= attempts || options.shouldRetry?.(error) === false) {\n        throw error;\n      }\n      const delayMs = Math.min(maxDelayMs, initialDelayMs * 2 ** (attempt - 1));\n      options.onRetry?.({ label, attempt, attempts, delayMs, error });\n      await delay(delayMs);\n    }\n  }\n  throw new Error(`unreachable startup retry state for ${label}`);\n}\n\nexport function sandboxEnvironmentVariableNames(settings: Settings): string[] {\n  const profiles = sandboxPreparationProfileNames(settings);\n  const names: string[] = [];\n  for (const profile of profiles) {\n    names.push(...sandboxPreparationProfiles[profile]!.env);\n  }\n  names.push(...splitCsv(settings.sandboxEnvAllowlist));\n  return uniqueEnvNames(names, \"sandbox env\");\n}\n\nexport function sandboxLifecycleHookIds(settings: Settings): string[] {\n  const ids: string[] = [];\n  for (const profile of sandboxPreparationProfileNames(settings)) {\n    ids.push(...sandboxPreparationProfiles[profile]!.hooks);\n  }\n  return uniqueValues(ids);\n}\n\nfunction sandboxPreparationProfileNames(settings: Settings): string[] {\n  const profiles = splitCsv(settings.sandboxPreparationProfiles).map((value) =>\n    value.toLowerCase(),\n  );\n  if (profiles.includes(\"none\")) {\n    if (profiles.length > 1) {\n      throw new Error(\n        \"OPENGENI_SANDBOX_PREPARATION_PROFILES cannot combine none with other profiles\",\n      );\n    }\n    return [\"none\"];\n  }\n  for (const profile of profiles) {\n    if (!sandboxPreparationProfiles[profile]) {\n      throw new Error(`Unknown sandbox preparation profile ${profile}`);\n    }\n  }\n  return profiles;\n}\n\nexport function parseExposedPorts(raw: string): number[] {\n  return splitCsv(raw).map((value) => {\n    const port = Number(value);\n    if (!Number.isInteger(port) || port < 1 || port > 65535) {\n      throw new Error(\"OPENGENI_DOCKER_EXPOSED_PORTS must contain TCP port numbers\");\n    }\n    return port;\n  });\n}\n\nexport function parseMcpServers(raw: string | undefined): unknown[] | undefined {\n  if (!raw) {\n    return undefined;\n  }\n  try {\n    const parsed = JSON.parse(raw);\n    if (!Array.isArray(parsed)) {\n      throw new Error(\"value must be a JSON array\");\n    }\n    return parsed;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_MCP_SERVERS must be a JSON array: ${message}`, {\n      cause: error,\n    });\n  }\n}\n\nexport function parseModelPricingJson(\n  raw: string,\n): Record<string, ModelPricing | ModelPricingScheduleV1> {\n  if (!raw.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_MODEL_PRICING_JSON must be valid JSON: ${message}`, { cause: error });\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\"OPENGENI_MODEL_PRICING_JSON must be a JSON object keyed by model name\");\n  }\n  const out: Record<string, ModelPricing | ModelPricingScheduleV1> = {};\n  for (const [model, value] of Object.entries(parsed)) {\n    if (!model.trim()) {\n      throw new Error(\"OPENGENI_MODEL_PRICING_JSON contains an empty model name\");\n    }\n    out[model] = z.union([ModelPricingSchema, ModelPricingScheduleSchema]).parse(value);\n  }\n  return out;\n}\n\n// --- sandbox warm-rate table (P2.1) ---\n// Per-backend usd_micros/sec, parsed from sandboxWarmRateMicrosPerSecondJson the\n// same way model pricing is. An empty {} (the default) means no warm-cost is\n// debited — warm-seconds are still metered for audit, just at rate 0.\nexport function parseSandboxWarmRateJson(raw: string): Record<string, number> {\n  if (!raw.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(\n      `OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON must be valid JSON: ${message}`,\n      { cause: error },\n    );\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\n      \"OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON must be a JSON object keyed by backend name\",\n    );\n  }\n  const out: Record<string, number> = {};\n  for (const [backend, value] of Object.entries(parsed)) {\n    if (!backend.trim()) {\n      throw new Error(\n        \"OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON contains an empty backend name\",\n      );\n    }\n    const rate = typeof value === \"number\" ? value : Number(value);\n    if (!Number.isFinite(rate) || rate < 0) {\n      throw new Error(\n        `OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON rate for ${backend} must be a non-negative number`,\n      );\n    }\n    out[backend] = rate;\n  }\n  return out;\n}\n\n// Resolve the warm rate (usd_micros/sec) for a backend; 0 when the backend has no\n// configured rate (the box is metered in seconds but not cost-debited).\nexport function sandboxWarmRateMicrosPerSecond(settings: Settings, backend: string): number {\n  const table = parseSandboxWarmRateJson(settings.sandboxWarmRateMicrosPerSecondJson);\n  return table[backend] ?? 0;\n}\n\n/**\n * Parse + validate the extra-provider registry JSON. `[]` (or empty/whitespace)\n * yields an empty list. Surfaces JSON and zod errors prefixed with the env-var\n * name so a malformed registry fails fast at boot (validateSettings calls this).\n */\nexport function parseModelProvidersJson(raw: string): RegistryProvider[] {\n  if (!raw.trim() || raw.trim() === \"[]\") {\n    return [];\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_MODEL_PROVIDERS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  if (!Array.isArray(parsed)) {\n    throw new Error(\"OPENGENI_MODEL_PROVIDERS_JSON must be a JSON array of providers\");\n  }\n  return parsed.map((entry, index) => {\n    const result = RegistryProviderSchema.safeParse(entry);\n    if (!result.success) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider[${index}] is invalid: ${result.error.message}`,\n      );\n    }\n    try {\n      return normalizeRegistryProvider(result.data);\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error);\n      throw new Error(`OPENGENI_MODEL_PROVIDERS_JSON provider[${index}] is invalid: ${message}`, {\n        cause: error,\n      });\n    }\n  });\n}\n\nexport function parseIntegrationsOauthClientsJson(\n  raw: string | undefined,\n): Record<string, IntegrationOAuthClientConfig> {\n  if (!raw?.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\n      \"OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON must be a JSON object keyed by authorization-server issuer or URL\",\n    );\n  }\n  const out: Record<string, IntegrationOAuthClientConfig> = {};\n  for (const [key, value] of Object.entries(parsed)) {\n    if (!key.trim()) {\n      throw new Error(\"OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON contains an empty issuer key\");\n    }\n    const result = IntegrationOAuthClientConfigSchema.safeParse(value);\n    if (!result.success) {\n      throw new Error(\n        `OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON client for ${key} is invalid: ${result.error.message}`,\n      );\n    }\n    out[key] = result.data;\n  }\n  return out;\n}\n\n/**\n * The operator-registered client for one authorization server, matched by\n * exact issuer/URL key first and then trailing-slash-insensitively. The OAuth\n * start flow and the connector catalog's connectability projection share this\n * so a catalog row is offered exactly when a start would find a client.\n */\nexport function findIntegrationsOauthClient(\n  configured: Readonly<Record<string, IntegrationOAuthClientConfig>>,\n  candidates: readonly string[],\n): IntegrationOAuthClientConfig | null {\n  const normalize = (value: string) => value.replace(/\\/+$/, \"\");\n  for (const key of new Set(candidates.flatMap((candidate) => [candidate, normalize(candidate)]))) {\n    const entry = configured[key];\n    if (entry) return entry;\n  }\n  const normalizedCandidates = new Set(candidates.map(normalize));\n  for (const [key, entry] of Object.entries(configured)) {\n    if (normalizedCandidates.has(normalize(key))) return entry;\n  }\n  return null;\n}\n\nexport const SocialOAuthClientConfigSchema = z.object({\n  clientId: z.string().min(1),\n  clientSecret: z.string().min(1).optional(),\n});\nexport type SocialOAuthClientConfig = z.infer<typeof SocialOAuthClientConfigSchema>;\n\nconst SOCIAL_OAUTH_PROVIDER_IDS = [\"x\", \"reddit\"] as const;\n\nexport function parseSocialOauthClientsJson(\n  raw: string | undefined,\n): Partial<Record<(typeof SOCIAL_OAUTH_PROVIDER_IDS)[number], SocialOAuthClientConfig>> {\n  if (!raw?.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\n      \"OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON must be a JSON object keyed by social provider id\",\n    );\n  }\n  const out: Partial<Record<(typeof SOCIAL_OAUTH_PROVIDER_IDS)[number], SocialOAuthClientConfig>> =\n    {};\n  for (const [key, value] of Object.entries(parsed)) {\n    if (!SOCIAL_OAUTH_PROVIDER_IDS.includes(key as (typeof SOCIAL_OAUTH_PROVIDER_IDS)[number])) {\n      throw new Error(\n        `OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON provider ${key} is not supported (expected: ${SOCIAL_OAUTH_PROVIDER_IDS.join(\", \")})`,\n      );\n    }\n    const result = SocialOAuthClientConfigSchema.safeParse(value);\n    if (!result.success) {\n      throw new Error(\n        `OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON client for ${key} is invalid: ${result.error.message}`,\n      );\n    }\n    out[key as (typeof SOCIAL_OAUTH_PROVIDER_IDS)[number]] = result.data;\n  }\n  return out;\n}\n\nexport function parseStaticUsageLimitsJson(raw: string): StaticUsageLimitsConfig {\n  if (!raw.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_STATIC_USAGE_LIMITS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  return StaticUsageLimits.parse(parsed);\n}\n\nexport function parseStaticEntitlementsJson(raw: string): EntitlementsConfig {\n  if (!raw.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_STATIC_ENTITLEMENTS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  return Entitlements.parse(parsed);\n}\n\nfunction calculateEntryCostMicros(pricing: ModelPricing, entry: ModelUsageInput): number {\n  const inputTokens = positiveInt(entry.inputTokens);\n  const outputTokens = positiveInt(entry.outputTokens);\n  const cachedTokens = Math.min(inputTokens, cachedInputTokens(entry));\n  const cacheWriteTokens = Math.min(\n    Math.max(0, inputTokens - cachedTokens),\n    cacheWriteInputTokens(entry),\n  );\n  const uncachedInputTokens = Math.max(0, inputTokens - cachedTokens - cacheWriteTokens);\n  const cachedInputRate =\n    pricing.cachedInputMicrosPerMillionTokens ?? pricing.inputMicrosPerMillionTokens;\n  const cacheWriteRate =\n    pricing.cacheWriteMicrosPerMillionTokens ?? pricing.inputMicrosPerMillionTokens;\n  return (\n    Math.ceil((uncachedInputTokens * pricing.inputMicrosPerMillionTokens) / 1_000_000) +\n    Math.ceil((cachedTokens * cachedInputRate) / 1_000_000) +\n    Math.ceil((cacheWriteTokens * cacheWriteRate) / 1_000_000) +\n    Math.ceil((outputTokens * pricing.outputMicrosPerMillionTokens) / 1_000_000)\n  );\n}\n\nfunction cachedInputTokens(entry: ModelUsageInput): number {\n  const details = Array.isArray(entry.inputTokensDetails)\n    ? entry.inputTokensDetails\n    : entry.inputTokensDetails\n      ? [entry.inputTokensDetails]\n      : [];\n  let total = 0;\n  for (const detail of details) {\n    total +=\n      positiveInt(detail.cached_tokens) +\n      positiveInt(detail.cachedInputTokens) +\n      positiveInt(detail.cached_input_tokens);\n  }\n  return total;\n}\n\nfunction cacheWriteInputTokens(entry: ModelUsageInput): number {\n  const details = Array.isArray(entry.inputTokensDetails)\n    ? entry.inputTokensDetails\n    : entry.inputTokensDetails\n      ? [entry.inputTokensDetails]\n      : [];\n  let total = 0;\n  for (const detail of details) {\n    total += positiveInt(detail.cache_write_tokens ?? detail.cacheWriteTokens);\n  }\n  return total;\n}\n\nfunction positiveInt(value: unknown): number {\n  return typeof value === \"number\" && Number.isFinite(value) && value > 0 ? Math.floor(value) : 0;\n}\n\n/**\n * Setup bound for Opengeni's own MCP servers. They are the deployment's API,\n * which is briefly slow while it restarts or is under load; the client's\n * 5-second default turned that into failed turns. Tool calls are unaffected.\n */\nexport const FIRST_PARTY_MCP_SETUP_TIMEOUT_MS = 30_000;\n\nfunction ensureBuiltInMcpServers(settings: Settings): Settings[\"mcpServers\"] {\n  const existing = settings.mcpServers.filter((server) => server.id !== \"opengeni\");\n  const firstPartyMcpUrl = firstPartyMcpServerUrl(settings);\n  const firstPartyFilesMcpUrl = firstPartyFilesMcpServerUrl(firstPartyMcpUrl);\n  const firstPartyDocsMcpUrl = firstPartyDocumentsMcpServerUrl(firstPartyMcpUrl);\n  const hasFiles = existing.some((server) => server.id === \"files\");\n  const hasDocs = existing.some((server) => server.id === \"docs\");\n  return [\n    {\n      id: \"opengeni\",\n      name: \"Opengeni\",\n      url: firstPartyMcpUrl,\n      // The opengeni server's tools/list response is permission-scoped: it\n      // varies by the calling session's delegated grant (e.g. a manager\n      // session sees sessions_*/environment_* tools that a worker session\n      // does not). The OpenAI Agents SDK caches tools/list in a process-global\n      // map keyed only by the MCP server name, which is identical for every\n      // session in the worker process. Caching here would let the first\n      // session to warm the cache dictate what every later session sees,\n      // regardless of permissions. tools/list is a cheap per-turn call, so we\n      // never cache it. (The files server pins allowedTools to a single\n      // permission-invariant tool and docs is already uncached, so both stay\n      // safe to cache / leave as-is.)\n      cacheToolsList: false,\n      setupTimeoutMs: FIRST_PARTY_MCP_SETUP_TIMEOUT_MS,\n    },\n    ...(hasFiles\n      ? []\n      : [\n          {\n            id: \"files\",\n            name: \"Files\",\n            url: firstPartyFilesMcpUrl,\n            allowedTools: [\"files_get_download_url\"],\n            cacheToolsList: true,\n            setupTimeoutMs: FIRST_PARTY_MCP_SETUP_TIMEOUT_MS,\n          },\n        ]),\n    ...(hasDocs\n      ? []\n      : [\n          {\n            id: \"docs\",\n            name: \"Knowledge\",\n            url: firstPartyDocsMcpUrl,\n            allowedTools: [\"knowledge_search\", \"knowledge_get\", \"knowledge_browse\"],\n            cacheToolsList: false,\n            setupTimeoutMs: FIRST_PARTY_MCP_SETUP_TIMEOUT_MS,\n          },\n        ]),\n    ...existing,\n  ];\n}\n\n/**\n * The sandbox/external base URL of Opengeni's first-party MCP endpoint, as a\n * `{workspaceId}` template. Codemode and remote placements use this route.\n *\n * BINDING CONTRACT (`opengeniMcpUrl`):\n *   - STANDALONE (unset): falls back to the loopback default.\n *   - EMBEDDED / MOUNTED (must set): when Opengeni's API is mounted as a host\n *     sub-app under a prefix (e.g. `https://host/og/v1/...`), the loopback\n *     default is WRONG — the worker runs in the host process and `127.0.0.1:\n *     ${apiPort}` is not where the mounted, sandbox-routable MCP lives. The host\n *     MUST set `OPENGENI_MCP_URL` to the externally/sandbox-routable base (a\n *     `{workspaceId}` template, or a concrete base that gets re-scoped). This is\n *     the one binding a mounted embed cannot leave unset.\n */\nexport function firstPartyMcpBaseUrl(settings: Settings): string {\n  return (\n    settings.opengeniMcpUrl ??\n    `http://127.0.0.1:${settings.apiPort}/v1/workspaces/{workspaceId}/mcp`\n  );\n}\n\n/**\n * Worker-side first-party MCP base. It never inherits the public/tunnel URL:\n * an operator may intentionally expose that route to Modal or a Connected\n * Machine, while the worker should still use loopback or cluster service DNS.\n */\nexport function firstPartyMcpInternalBaseUrl(settings: Settings): string {\n  return (\n    settings.opengeniMcpInternalUrl ??\n    `http://127.0.0.1:${settings.apiPort}/v1/workspaces/{workspaceId}/mcp`\n  );\n}\n\nfunction scopedFirstPartyMcpUrl(raw: string, workspaceId: string): string {\n  if (raw.includes(\"{workspaceId}\")) {\n    return raw.replaceAll(\"{workspaceId}\", workspaceId);\n  }\n  const url = new URL(raw);\n  url.pathname = `/v1/workspaces/${workspaceId}/mcp`;\n  url.search = \"\";\n  url.hash = \"\";\n  return url.toString();\n}\n\nexport function firstPartyMcpWorkspaceUrl(settings: Settings, workspaceId: string): string {\n  return scopedFirstPartyMcpUrl(firstPartyMcpBaseUrl(settings), workspaceId);\n}\n\nexport function firstPartyMcpInternalWorkspaceUrl(settings: Settings, workspaceId: string): string {\n  return scopedFirstPartyMcpUrl(firstPartyMcpInternalBaseUrl(settings), workspaceId);\n}\n\nexport function codemodeWorkspaceUrl(settings: Settings, workspaceId: string): string {\n  if (settings.opengeniMcpUrl) {\n    const url = new URL(firstPartyMcpWorkspaceUrl(settings, workspaceId));\n    if (!url.pathname.endsWith(\"/mcp\")) {\n      throw new Error(\"First-party MCP URL cannot be projected to the Codemode endpoint\");\n    }\n    url.pathname = `${url.pathname.slice(0, -4)}/codemode`;\n    return url.toString();\n  }\n\n  // Codemode executes inside the selected placement, not beside the worker.\n  // Local Docker reaches the host through Docker's canonical host alias; an\n  // in-process local sandbox uses loopback; remote managed providers use the\n  // deployment's public origin. `OPENGENI_MCP_URL` above remains the explicit\n  // escape hatch for mounted deployments and local remote-provider tunnels.\n  const executionOrigin =\n    settings.sandboxBackend === \"docker\"\n      ? `http://host.docker.internal:${settings.apiPort}`\n      : settings.sandboxBackend === \"local\"\n        ? `http://127.0.0.1:${settings.apiPort}`\n        : (settings.publicBaseUrl ?? `http://127.0.0.1:${settings.apiPort}`);\n  const url = new URL(executionOrigin);\n  url.pathname = `${url.pathname.replace(/\\/+$/u, \"\")}/v1/workspaces/${workspaceId}/codemode`;\n  url.search = \"\";\n  url.hash = \"\";\n  return url.toString();\n}\n\nfunction firstPartyMcpServerUrl(settings: Settings): string {\n  return firstPartyMcpBaseUrl(settings);\n}\n\nfunction firstPartyDocumentsMcpServerUrl(mcpUrl: string): string {\n  return `${mcpUrl.replace(/\\/+$/, \"\")}/docs`;\n}\n\nfunction firstPartyFilesMcpServerUrl(mcpUrl: string): string {\n  return `${mcpUrl.replace(/\\/+$/, \"\")}/files`;\n}\n\nconst MODAL_DESKTOP_IMAGE_DIGEST_REF = /@sha256:[0-9a-f]{64}$/i;\n\nfunction isDigestPinnedModalDesktopImage(settings: Settings): boolean {\n  if (settings.modalImageId) return true;\n  return (\n    typeof settings.modalImageRef === \"string\" &&\n    MODAL_DESKTOP_IMAGE_DIGEST_REF.test(settings.modalImageRef)\n  );\n}\n\nexport type TrustedProxyCidr = {\n  address: string;\n  prefix: number;\n  family: \"ipv4\" | \"ipv6\";\n};\n\n/**\n * Parse `OPENGENI_API_TRUSTED_PROXY_CIDRS`: comma-separated IPv4/IPv6 CIDRs or\n * single addresses. Throws on any malformed entry so a typo can never widen or\n * silently disable the trusted proxy set.\n */\nexport function trustedProxyCidrEntries(raw: string): TrustedProxyCidr[] {\n  const entries: TrustedProxyCidr[] = [];\n  for (const entry of raw.split(\",\")) {\n    const value = entry.trim();\n    if (!value) continue;\n    const slash = value.indexOf(\"/\");\n    const address = slash < 0 ? value : value.slice(0, slash);\n    const version = isIP(address);\n    const family = version === 4 ? \"ipv4\" : version === 6 ? \"ipv6\" : null;\n    const maxPrefix = family === \"ipv4\" ? 32 : 128;\n    const prefixText = slash < 0 ? String(maxPrefix) : value.slice(slash + 1);\n    const prefix = /^\\d{1,3}$/u.test(prefixText) ? Number(prefixText) : Number.NaN;\n    if (!family || !Number.isInteger(prefix) || prefix < 0 || prefix > maxPrefix) {\n      throw new Error(\n        `OPENGENI_API_TRUSTED_PROXY_CIDRS entry \"${value.slice(0, 64)}\" is not an IP address or CIDR range`,\n      );\n    }\n    entries.push({ address, prefix, family });\n  }\n  return entries;\n}\n\n/**\n * Parse `OPENGENI_LOCAL_ALLOWED_ORIGINS`: comma-separated exact browser origins\n * (`http(s)://host[:port]`, no path, query, credentials, or wildcard). Throws on\n * any malformed entry so a typo can never widen or silently disable the local\n * browser boundary.\n */\nexport function localAllowedOriginEntries(raw: string | undefined): string[] {\n  const origins: string[] = [];\n  for (const entry of (raw ?? \"\").split(\",\")) {\n    const value = entry.trim();\n    if (!value) continue;\n    let url: URL | null = null;\n    try {\n      url = new URL(value);\n    } catch {\n      url = null;\n    }\n    if (\n      !url ||\n      (url.protocol !== \"http:\" && url.protocol !== \"https:\") ||\n      url.username ||\n      url.password ||\n      url.hostname.includes(\"*\") ||\n      url.pathname !== \"/\" ||\n      url.search ||\n      url.hash ||\n      value.endsWith(\"?\") ||\n      value.endsWith(\"#\")\n    ) {\n      throw new Error(\n        `OPENGENI_LOCAL_ALLOWED_ORIGINS entry \"${value.slice(0, 64)}\" is not an exact http(s) origin such as http://127.0.0.1:5173`,\n      );\n    }\n    origins.push(url.origin);\n  }\n  return origins;\n}\n\nconst LOCAL_SANDBOX_API_ROUTES: readonly RegExp[] = [\n  // Codemode calls, journal reads, catalog, and the Site/SDK proxy.\n  /^\\/v1\\/workspaces\\/[^/]+\\/codemode(?:\\/|$)/u,\n  // First-party MCP, including its /docs and /files servers.\n  /^\\/v1\\/workspaces\\/[^/]+\\/mcp(?:\\/|$)/u,\n  // The personal GitHub HTTPS smart-Git broker.\n  /^\\/v1\\/git\\/personal\\/[A-Za-z0-9_-]{43}\\/(?:info\\/refs|git-upload-pack|git-receive-pack)$/u,\n];\n\n/**\n * Local development only: whether a normalized API path is one a sandbox calls\n * (Codemode, first-party MCP, and the personal Git broker). The Linux Docker\n * sandbox route relays only these, and the local API serves only these on the\n * addresses that only sandboxes use (see `apps/api/src/http/local-browser-boundary.ts`).\n */\nexport function localSandboxApiRouteAllowed(pathname: string): boolean {\n  return LOCAL_SANDBOX_API_ROUTES.some((route) => route.test(pathname));\n}\n\n/**\n * Published Sites serve untrusted HTML, so their domain must not hold or sit\n * inside the console or API hosts: a Site could otherwise read or set their\n * cookies. A separate registrable domain is required (see\n * docs/published-sites.md); this catches the nesting a host check can see.\n */\nexport function validateSitesDomain(\n  settings: Pick<Settings, \"sitesDomain\" | \"publicBaseUrl\" | \"webBaseUrl\">,\n): void {\n  if (settings.sitesDomain === undefined) return;\n  let domain: string;\n  try {\n    domain = normalizeSitesDomain(settings.sitesDomain);\n  } catch {\n    throw new Error(\"OPENGENI_SITES_DOMAIN must be a domain name such as sites.example.com\");\n  }\n  const hosts: Array<[string, string | undefined]> = [\n    [\"OPENGENI_PUBLIC_BASE_URL\", settings.publicBaseUrl],\n    [\"OPENGENI_WEB_BASE_URL\", settings.webBaseUrl],\n  ];\n  for (const [name, url] of hosts) {\n    if (!url) continue;\n    const host = new URL(url).hostname.toLowerCase().replace(/\\.$/u, \"\");\n    if (host === domain || host.endsWith(`.${domain}`) || domain.endsWith(`.${host}`))\n      throw new Error(\n        `OPENGENI_SITES_DOMAIN (${domain}) must be a separate domain from the console and API: ${name} uses ${host}`,\n      );\n  }\n}\n\nfunction validateSettings(settings: Settings, source: NodeJS.ProcessEnv = process.env): void {\n  temporalConnectionOptions(settings);\n  localAllowedOriginEntries(settings.localAllowedOrigins);\n  validateSitesDomain(settings);\n  if (\n    settings.organizationUserSetupEmailTokenTransport === \"query\" &&\n    !settings.organizationUserSetupQueryEdgeSanitizationConfirmed\n  ) {\n    throw new Error(\n      \"OPENGENI_ORGANIZATION_USER_SETUP_QUERY_EDGE_SANITIZATION_CONFIRMED=true is required when OPENGENI_ORGANIZATION_USER_SETUP_EMAIL_TOKEN_TRANSPORT=query\",\n    );\n  }\n  if (settings.goalIdleBackoffMs.some((delayMs) => delayMs > settings.goalIdleBackoffMaxMs)) {\n    throw new Error(\n      `OPENGENI_GOAL_IDLE_BACKOFF_MS entries must not exceed OPENGENI_GOAL_IDLE_BACKOFF_MAX_MS (${settings.goalIdleBackoffMaxMs})`,\n    );\n  }\n  const allowedFirstPartyMcpTools = new Set(\n    settings.allowedFirstPartyMcpTools ?? FIRST_PARTY_MCP_TOOL_NAMES,\n  );\n  const disallowedDefaults = (settings.defaultFirstPartyMcpTools ?? []).filter(\n    (tool) => !allowedFirstPartyMcpTools.has(tool),\n  );\n  if (disallowedDefaults.length > 0) {\n    throw new Error(\n      `OPENGENI_DEFAULT_FIRST_PARTY_MCP_TOOLS must be a subset of OPENGENI_ALLOWED_FIRST_PARTY_MCP_TOOLS: ${disallowedDefaults.join(\", \")}`,\n    );\n  }\n  if (settings.productAccessMode === \"managed\") {\n    if (settings.onePasswordFakeTokens && ![\"local\", \"test\"].includes(settings.environment)) {\n      throw new Error(\n        \"OPENGENI_ONEPASSWORD_FAKE_TOKENS is a local development switch and is refused by the managed runtime\",\n      );\n    }\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    if (!settings.betterAuthSecret) {\n      throw new Error(\n        \"OPENGENI_BETTER_AUTH_SECRET is required when OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    if (!settings.delegationSecret) {\n      throw new Error(\n        \"OPENGENI_DELEGATION_SECRET is required when OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    if (\n      settings.managedAuthSessionSetMode !== \"legacy\" &&\n      ![\"local\", \"test\"].includes(settings.environment) &&\n      !settings.publicBaseUrl.startsWith(\"https://\")\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when browser session sets are enabled outside local/test\",\n      );\n    }\n    if (\n      settings.managedEmailDelivery === \"resend\" &&\n      ![\"local\", \"test\"].includes(settings.environment) &&\n      !settings.resendApiKey\n    ) {\n      throw new Error(\"OPENGENI_RESEND_API_KEY is required for managed mode outside local/test\");\n    }\n    if (settings.managedEmailDelivery === \"disabled\" && settings.resendApiKey) {\n      throw new Error(\n        \"OPENGENI_RESEND_API_KEY must be unset when OPENGENI_MANAGED_EMAIL_DELIVERY=disabled\",\n      );\n    }\n    if (![\"local\", \"test\"].includes(settings.environment) && !settings.environmentsEncryptionKey) {\n      throw new Error(\n        \"OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is required for managed mode outside local/test\",\n      );\n    }\n  }\n  if (\n    Boolean(settings.managedAuthGoogleClientId) !== Boolean(settings.managedAuthGoogleClientSecret)\n  ) {\n    throw new Error(\n      \"OPENGENI_MANAGED_AUTH_GOOGLE_CLIENT_ID and OPENGENI_MANAGED_AUTH_GOOGLE_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (\n    Boolean(settings.managedAuthGithubClientId) !== Boolean(settings.managedAuthGithubClientSecret)\n  ) {\n    throw new Error(\n      \"OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_ID and OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_SECRET must be configured together\",\n    );\n  }\n  const managedSocialAuthConfigured = Boolean(\n    settings.managedAuthGoogleClientId || settings.managedAuthGithubClientId,\n  );\n  if (managedSocialAuthConfigured) {\n    if (settings.productAccessMode !== \"managed\") {\n      throw new Error(\n        \"Managed Google/GitHub authentication requires OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    const publicOrigin = canonicalPublicOrigin(settings.publicBaseUrl);\n    if (!publicOrigin) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must be a credential-free HTTP(S) origin when managed social authentication is configured\",\n      );\n    }\n    if (!publicOrigin.startsWith(\"https://\") && ![\"local\", \"test\"].includes(settings.environment)) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when managed social authentication is configured outside local/test\",\n      );\n    }\n  }\n  // The retired MCP-only name must never be ignored silently: a deployment\n  // that trusted forwarded addresses would fall back to the transport peer.\n  // \"0\" (the old .env.example value) means the same as the new default.\n  const retiredTrustedProxyHops = source.OPENGENI_MCP_OAUTH_TRUSTED_PROXY_HOPS?.trim();\n  if (retiredTrustedProxyHops && retiredTrustedProxyHops !== \"0\") {\n    throw new Error(\n      \"OPENGENI_MCP_OAUTH_TRUSTED_PROXY_HOPS was renamed to OPENGENI_API_TRUSTED_PROXY_HOPS, which now sets the client address for every API rate limit and auth session; rename the variable\",\n    );\n  }\n  const trustedProxyCidrs = trustedProxyCidrEntries(settings.apiTrustedProxyCidrs);\n  if (trustedProxyCidrs.length > 0 && settings.apiTrustedProxyHops === 0) {\n    throw new Error(\n      \"OPENGENI_API_TRUSTED_PROXY_CIDRS requires OPENGENI_API_TRUSTED_PROXY_HOPS greater than 0\",\n    );\n  }\n  if (settings.mcpOauthEnabled) {\n    if (settings.productAccessMode === \"configured\") {\n      throw new Error(\n        \"OPENGENI_MCP_OAUTH_ENABLED=true requires managed or local product access mode\",\n      );\n    }\n    const publicOrigin = canonicalPublicOrigin(settings.publicBaseUrl);\n    if (!publicOrigin) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must be a credential-free HTTP(S) origin when OPENGENI_MCP_OAUTH_ENABLED=true\",\n      );\n    }\n    if (!publicOrigin.startsWith(\"https://\") && ![\"local\", \"test\"].includes(settings.environment)) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when OPENGENI_MCP_OAUTH_ENABLED=true outside local/test\",\n      );\n    }\n  }\n  environmentsEncryptionKeyBytes(settings);\n  if (settings.integrationsEnabled) {\n    if (settings.productAccessMode === \"managed\" && !settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when OPENGENI_INTEGRATIONS_ENABLED=true and OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    if (\n      settings.publicBaseUrl &&\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when OPENGENI_INTEGRATIONS_ENABLED=true outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret && ![\"local\", \"test\"].includes(settings.environment)) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when OPENGENI_INTEGRATIONS_ENABLED=true outside local/test\",\n      );\n    }\n  }\n  if (Boolean(settings.slackClientId) !== Boolean(settings.slackClientSecret)) {\n    throw new Error(\n      \"OPENGENI_SLACK_CLIENT_ID and OPENGENI_SLACK_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (settings.slackClientId) {\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when the Opengeni Slack app is configured\",\n      );\n    }\n    if (\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when the Opengeni Slack app is configured outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when the Opengeni Slack app is configured\",\n      );\n    }\n  }\n  if (Boolean(settings.googleDriveClientId) !== Boolean(settings.googleDriveClientSecret)) {\n    throw new Error(\n      \"OPENGENI_GOOGLE_DRIVE_CLIENT_ID and OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (\n    Boolean(settings.githubPersonalOauthClientId) !==\n    Boolean(settings.githubPersonalOauthClientSecret)\n  ) {\n    throw new Error(\n      \"OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_ID and OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (settings.githubPersonalOauthEnabled) {\n    if (!settings.integrationsEnabled) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_ENABLED=true is required when personal GitHub OAuth is enabled\",\n      );\n    }\n    if (!settings.githubPersonalOauthClientId || !settings.githubPersonalOauthClientSecret) {\n      throw new Error(\n        \"personal GitHub OAuth requires OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_ID and OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_SECRET\",\n      );\n    }\n    if (settings.githubPersonalOauthClientId === settings.githubClientId) {\n      throw new Error(\n        \"personal GitHub OAuth must use a different OAuth App client from the Opengeni GitHub App\",\n      );\n    }\n    if (!personalGitHubOAuthCallbackUrl(settings.publicBaseUrl)) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must be a credential-free origin without a path, query, or fragment when personal GitHub OAuth is enabled\",\n      );\n    }\n    if (\n      !settings.publicBaseUrl?.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when personal GitHub OAuth is enabled outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when personal GitHub OAuth is enabled\",\n      );\n    }\n    if (!settings.environmentsEncryptionKey) {\n      throw new Error(\n        \"OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is required when personal GitHub OAuth is enabled\",\n      );\n    }\n  }\n  if (Boolean(settings.fikenClientId) !== Boolean(settings.fikenClientSecret)) {\n    throw new Error(\n      \"OPENGENI_FIKEN_OAUTH_CLIENT_ID and OPENGENI_FIKEN_OAUTH_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (settings.fikenClientId) {\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when the Fiken OAuth integration is configured\",\n      );\n    }\n    if (\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when the Fiken OAuth integration is configured outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when the Fiken OAuth integration is configured\",\n      );\n    }\n  }\n  if (settings.googleDriveClientId) {\n    if (!settings.integrationsEnabled) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_ENABLED=true is required when the Google Drive integration is configured\",\n      );\n    }\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when the Google Drive integration is configured\",\n      );\n    }\n    if (!googleDriveOAuthCallbackUrl(settings.publicBaseUrl)) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must be a credential-free origin without a path, query, or fragment when the Google Drive integration is configured\",\n      );\n    }\n    if (\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when the Google Drive integration is configured outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when the Google Drive integration is configured\",\n      );\n    }\n  }\n  if (settings.googleDriveSyncMaxFileBytes > settings.googleDriveSyncMaxBytes) {\n    throw new Error(\n      \"OPENGENI_GOOGLE_DRIVE_SYNC_MAX_FILE_BYTES must not exceed OPENGENI_GOOGLE_DRIVE_SYNC_MAX_BYTES\",\n    );\n  }\n  if (\n    settings.googleDriveProviderRetryInitialDelayMs > settings.googleDriveProviderRetryMaxDelayMs\n  ) {\n    throw new Error(\n      \"OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_INITIAL_DELAY_MS must not exceed OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_MAX_DELAY_MS\",\n    );\n  }\n  if (settings.googleDriveProviderRetryInitialDelayMs > settings.googleDriveProviderRetryBudgetMs) {\n    throw new Error(\n      \"OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_INITIAL_DELAY_MS must not exceed OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_BUDGET_MS\",\n    );\n  }\n  if (Boolean(settings.atlassianClientId) !== Boolean(settings.atlassianClientSecret)) {\n    throw new Error(\n      \"OPENGENI_ATLASSIAN_CLIENT_ID and OPENGENI_ATLASSIAN_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (settings.atlassianClientId) {\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when the Atlassian integration is configured\",\n      );\n    }\n    if (\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when the Atlassian integration is configured outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when the Atlassian integration is configured\",\n      );\n    }\n  }\n  parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);\n  parseSocialOauthClientsJson(settings.socialOauthClientsJson);\n  if (\n    settings.productAccessMode === \"configured\" &&\n    ![\"local\", \"test\"].includes(settings.environment) &&\n    !settings.delegationSecret &&\n    !settings.authRequired\n  ) {\n    throw new Error(\n      \"OPENGENI_PRODUCT_ACCESS_MODE=configured requires OPENGENI_DELEGATION_SECRET or OPENGENI_AUTH_REQUIRED=true outside local/test\",\n    );\n  }\n  if (settings.billingMode === \"stripe\") {\n    if (!settings.stripeSecretKey || !settings.stripeWebhookSecret) {\n      throw new Error(\n        \"OPENGENI_STRIPE_SECRET_KEY and OPENGENI_STRIPE_WEBHOOK_SECRET are required when OPENGENI_BILLING_MODE=stripe\",\n      );\n    }\n  }\n  if (settings.productAccessMode !== \"managed\" && settings.billingMode === \"stripe\") {\n    throw new Error(\"OPENGENI_BILLING_MODE=stripe requires OPENGENI_PRODUCT_ACCESS_MODE=managed\");\n  }\n  if (settings.usageLimitsMode === \"static\") {\n    const limits = configuredStaticUsageLimits(settings);\n    if (Object.keys(limits).length === 0) {\n      throw new Error(\n        \"OPENGENI_STATIC_USAGE_LIMITS_JSON must define at least one cap when OPENGENI_USAGE_LIMITS_MODE=static\",\n      );\n    }\n  } else {\n    parseStaticUsageLimitsJson(settings.staticUsageLimitsJson);\n  }\n  if (settings.entitlementsMode === \"static\") {\n    const entitlements = parseStaticEntitlementsJson(settings.staticEntitlementsJson);\n    if (Object.keys(entitlements).length === 0) {\n      throw new Error(\n        \"OPENGENI_STATIC_ENTITLEMENTS_JSON must define at least one feature when OPENGENI_ENTITLEMENTS_MODE=static\",\n      );\n    }\n  } else {\n    parseStaticEntitlementsJson(settings.staticEntitlementsJson);\n  }\n  if (settings.authRequired && !settings.accessKey) {\n    throw new Error(\"OPENGENI_ACCESS_KEY is required when OPENGENI_AUTH_REQUIRED=true\");\n  }\n  if (settings.openaiProvider === \"azure\") {\n    if (!settings.azureOpenaiBaseUrl && !settings.azureOpenaiEndpoint) {\n      throw new Error(\n        \"Azure OpenAI requires OPENGENI_AZURE_OPENAI_BASE_URL or OPENGENI_AZURE_OPENAI_ENDPOINT\",\n      );\n    }\n    if (!settings.azureOpenaiBaseUrl && !settings.azureOpenaiDeployment) {\n      throw new Error(\"Azure OpenAI endpoint mode requires OPENGENI_AZURE_OPENAI_DEPLOYMENT\");\n    }\n    if (!settings.azureOpenaiBaseUrl && !settings.azureOpenaiApiVersion) {\n      throw new Error(\"Azure OpenAI endpoint mode requires OPENGENI_AZURE_OPENAI_API_VERSION\");\n    }\n    if (!settings.azureOpenaiApiKey && !settings.azureOpenaiAdToken) {\n      throw new Error(\"Azure OpenAI requires an API key or AD token\");\n    }\n  }\n  // The Modal token is a both-or-neither pair regardless of the active backend\n  // (a half-configured token is always a misconfiguration). This is orthogonal\n  // to the backend-gated required-cred sweep below.\n  if (Boolean(settings.modalTokenId) !== Boolean(settings.modalTokenSecret)) {\n    throw new Error(\n      \"OPENGENI_MODAL_TOKEN_ID and OPENGENI_MODAL_TOKEN_SECRET must both be set or both omitted\",\n    );\n  }\n  // Backend-gated required credentials: only the *active* backend's creds are\n  // required. A modal deployment must carry the Modal token; a daytona/e2b/none\n  // deployment must NOT be forced to (and is not). Drives off the single\n  // SANDBOX_REQUIRED_ENV table that the deployment package also mirrors.\n  for (const required of SANDBOX_REQUIRED_ENV[settings.sandboxBackend] ?? []) {\n    const value = settings[required.field];\n    if (\n      value === undefined ||\n      value === null ||\n      (typeof value === \"string\" && value.trim().length === 0)\n    ) {\n      throw new Error(\n        `${required.env} is required when OPENGENI_SANDBOX_BACKEND=${settings.sandboxBackend}`,\n      );\n    }\n  }\n  validateObjectStorageSettings(settings);\n  if (settings.documentChunkOverlap >= settings.documentChunkSize) {\n    throw new Error(\n      \"OPENGENI_DOCUMENT_CHUNK_OVERLAP must be smaller than OPENGENI_DOCUMENT_CHUNK_SIZE\",\n    );\n  }\n  parseExposedPorts(settings.dockerExposedPorts);\n  // Malformed voice-input pricing deliberately does not fail boot: every\n  // process shares this config, and a voice-only typo must not crash-loop\n  // workers. The provider is withheld and the API logs voiceInputPricingIssues.\n  sandboxEnvironmentVariableNames(settings);\n  sandboxLifecycleHookIds(settings);\n  // Fail fast on a malformed warm-rate table (P2.1).\n  const warmRates = parseSandboxWarmRateJson(settings.sandboxWarmRateMicrosPerSecondJson);\n  // The meter rounds each settled interval to whole USD micros. Fractional\n  // micros/second would make the total depend on heartbeat frequency; only\n  // integer rates have interval-independent settlement at the same elapsed time.\n  if (\n    settings.sandboxWarmBillingMode === \"credits\" &&\n    Object.values(warmRates).some((rate) => !Number.isSafeInteger(rate))\n  ) {\n    throw new Error(\n      \"OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON paid rates must be safe integers\",\n    );\n  }\n  if (\n    settings.documentEmbeddingBillingMode === \"credits\" &&\n    settings.documentEmbeddingProvider === \"openai\" &&\n    settings.documentEmbeddingRateMicrosPerMillionBytes <= 0\n  ) {\n    throw new Error(\n      \"OPENGENI_DOCUMENT_EMBEDDING_RATE_MICROS_PER_MILLION_BYTES must be positive when paid OpenAI embedding billing is enabled\",\n    );\n  }\n  if (\n    settings.documentEmbeddingBillingMode === \"credits\" &&\n    settings.documentEmbeddingProvider === \"openai\" &&\n    !settings.documentEmbeddingCreditsActivatedAt\n  ) {\n    throw new Error(\n      \"OPENGENI_DOCUMENT_EMBEDDING_CREDITS_ACTIVATED_AT is required for paid OpenAI embeddings\",\n    );\n  }\n  if (settings.sandboxBackend === \"compute\") {\n    const issues = computeSettingsIssues(settings);\n    if (issues.length > 0) {\n      throw new Error(`OPENGENI_SANDBOX_BACKEND=compute: ${issues.join(\"; \")}`);\n    }\n  }\n  if (settings.sandboxBackend === \"opensandbox\") {\n    if (!/@sha256:[0-9a-f]{64}$/i.test(settings.openSandboxImage ?? \"\")) {\n      throw new Error(\n        \"OPENGENI_OPENSANDBOX_IMAGE must be an immutable OCI reference ending in @sha256:<64 hex characters>\",\n      );\n    }\n    if (!objectStorageConfiguredForWorkspaceArchives(settings)) {\n      throw new Error(\n        \"OPENGENI_SANDBOX_BACKEND=opensandbox requires configured object storage for portable /workspace archives\",\n      );\n    }\n  }\n  const serverIds = new Set<string>();\n  for (const server of settings.mcpServers) {\n    if (serverIds.has(server.id)) {\n      throw new Error(`OPENGENI_MCP_SERVERS contains duplicate id ${server.id}`);\n    }\n    serverIds.add(server.id);\n    if (server.connectionRef?.authoritySource === \"host\") {\n      throw new Error(\n        \"OPENGENI_MCP_SERVERS host-owned connection refs are no longer supported; select ordinary native connections\",\n      );\n    }\n  }\n  // --- sandbox lease cadence invariant (fail fast at boot) ---\n  // Holder TTLs are provider-neutral. Modal's finite hard/idle clocks and\n  // deadline rotation are validated only when Modal is active; renewable-TTL\n  // providers such as OpenSandbox do not enter that deadline model.\n  {\n    const reaperPeriod = settings.sandboxLeaseReaperPeriodMs;\n    const viewerTtl = settings.sandboxViewerHolderTtlMs;\n    const interactionTtl = settings.sandboxInteractionHolderTtlMs;\n    if (!(reaperPeriod < viewerTtl)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS (${reaperPeriod}) must be strictly less than ` +\n          `OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS (${viewerTtl}): the reaper must run more often ` +\n          `than the TTL it polices, or stale viewer holders outlive a full reaper period.`,\n      );\n    }\n    if (!(reaperPeriod < interactionTtl)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS (${reaperPeriod}) must be strictly less than ` +\n          `OPENGENI_SANDBOX_INTERACTION_HOLDER_TTL_MS (${interactionTtl}): the reaper must run ` +\n          `more often than the controller-heartbeat horizon.`,\n      );\n    }\n    if (settings.sandboxDrainSnapshotTimeoutMs !== undefined) {\n      const drainCaptureTimeoutMs = sandboxArchiveCaptureTimeoutMs({\n        sandboxSnapshotTimeoutMs: effectiveSandboxDrainSnapshotTimeoutMs(settings),\n      });\n      const requiredTransitionWaitMs =\n        reaperPeriod + drainCaptureTimeoutMs + SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS;\n      if (requiredTransitionWaitMs > SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS) {\n        throw new Error(\n          `OPENGENI_SANDBOX_DRAIN_SNAPSHOT_TIMEOUT_MS (${settings.sandboxDrainSnapshotTimeoutMs}) ` +\n            `requires a sandbox lifecycle transition wait of ${requiredTransitionWaitMs}ms after ` +\n            `one reaper period and provider settlement, exceeding the ` +\n            `${SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS}ms limit. Lower the drain snapshot timeout ` +\n            `or OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS.`,\n        );\n      }\n    }\n    // A backend rollout does not rewrite or synchronously drain existing\n    // leases. Preserve enough deadline-rotation headroom for historical Modal\n    // leases even when the deployment default has moved to another backend.\n    const rotationLeadMs = settings.sandboxRotationLeadMs;\n    const ordinaryCaptureTimeoutMs = sandboxArchiveCaptureTimeoutMs(settings);\n    const drainCaptureTimeoutMs = sandboxArchiveCaptureTimeoutMs({\n      sandboxSnapshotTimeoutMs: effectiveSandboxDrainSnapshotTimeoutMs(settings),\n    });\n    const providerDeadlineCaptureTimeoutMs = Math.max(\n      ordinaryCaptureTimeoutMs,\n      drainCaptureTimeoutMs,\n    );\n    const requiredRotationLeadMs =\n      SANDBOX_DEADLINE_COMMAND_STOP_GRACE_MS + providerDeadlineCaptureTimeoutMs + 2 * reaperPeriod;\n    if (!(rotationLeadMs > requiredRotationLeadMs)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must exceed the ` +\n          `legacy command stop grace, largest durable snapshot or drain capture timeout, and two reaper periods ` +\n          `(${requiredRotationLeadMs}), including for persisted Modal ` +\n          `leases after a default-backend rollout.`,\n      );\n    }\n    const containmentMs = settings.sandboxIdleCommandContainmentMs;\n    if (containmentMs !== undefined && !(containmentMs > settings.sandboxIdleGraceMs)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS (${containmentMs}) must exceed ` +\n          `OPENGENI_SANDBOX_IDLE_GRACE_MS (${settings.sandboxIdleGraceMs}): a box kept warm only by ` +\n          `retained commands must stay available at least as long as an idle box awaiting drain.`,\n      );\n    }\n    if (\n      containmentMs !== undefined &&\n      optionalEnvironmentValue(\"OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS\", source) !==\n        undefined &&\n      !(containmentMs < rotationLeadMs)\n    ) {\n      throw new Error(\n        `OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS (${containmentMs}) must be strictly less than ` +\n          `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}): an idle box must be checkpointed ` +\n          `and stopped well before its provider deadline.`,\n      );\n    }\n    if (settings.sandboxBackend === \"modal\") {\n      const idleGraceMs = settings.sandboxIdleGraceMs;\n      const lifecycle = effectiveSandboxLifecycle(settings, \"modal\");\n      const providerLifetimeMs = lifecycle.hardLifetimeMs!;\n      const idleTimeoutMs = lifecycle.providerIdleTimeoutMs!;\n      if (!(idleTimeoutMs <= providerLifetimeMs)) {\n        throw new Error(\n          `OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS*1000 (${idleTimeoutMs}) must not exceed the hard provider ` +\n            `lifetime (OPENGENI_MODAL_TIMEOUT_SECONDS*1000 = ${providerLifetimeMs}): the idle timeout is a ` +\n            `floor under the hard lifetime, not above it.`,\n        );\n      }\n      if (!(rotationLeadMs < providerLifetimeMs)) {\n        throw new Error(\n          `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must be strictly less than ` +\n            `OPENGENI_MODAL_TIMEOUT_SECONDS*1000 (${providerLifetimeMs}).`,\n        );\n      }\n      if (!(viewerTtl < idleTimeoutMs)) {\n        throw new Error(\n          `OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS (${viewerTtl}) must be strictly less than the effective box ` +\n            `idle timeout (${idleTimeoutMs}): a viewer holder must be reapable before the box idles out from ` +\n            `under it (the provider idle-timeout is the backstop).`,\n        );\n      }\n      if (!(interactionTtl < idleTimeoutMs)) {\n        throw new Error(\n          `OPENGENI_SANDBOX_INTERACTION_HOLDER_TTL_MS (${interactionTtl}) must be strictly less than ` +\n            `the effective box idle timeout (${idleTimeoutMs}): a dead browser controller must be ` +\n            `reapable before the provider reclaims its placement.`,\n        );\n      }\n      if (!(reaperPeriod + idleGraceMs < idleTimeoutMs)) {\n        throw new Error(\n          `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS + OPENGENI_SANDBOX_IDLE_GRACE_MS ` +\n            `(${reaperPeriod} + ${idleGraceMs} = ${reaperPeriod + idleGraceMs}) must be strictly less than the ` +\n            `effective box idle timeout (${idleTimeoutMs}): a drained box must SURVIVE its full warm window so ` +\n            `the reaper can resume + snapshot /workspace + terminate it on the sweep AFTER the drain grace ` +\n            `elapses — Modal's idle-reap must NOT fire first (or /workspace is lost). Raise ` +\n            `OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS (defaults to OPENGENI_MODAL_TIMEOUT_SECONDS) or lower ` +\n            `OPENGENI_SANDBOX_IDLE_GRACE_MS.`,\n        );\n      }\n      if (\n        settings.modalIdleTimeoutSeconds !== undefined &&\n        containmentMs !== undefined &&\n        !(reaperPeriod + containmentMs + drainCaptureTimeoutMs < idleTimeoutMs)\n      ) {\n        throw new Error(\n          `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS + OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS + ` +\n            `drain capture timeout (${reaperPeriod} + ${containmentMs} + ${drainCaptureTimeoutMs}) ` +\n            `must be strictly less than OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS*1000 (${idleTimeoutMs}): ` +\n            `idle command containment must checkpoint a box before Modal's own idle reaper stops it. ` +\n            `Lower OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS or raise the Modal idle timeout.`,\n        );\n      }\n    }\n  }\n  // --- stream-token secret: required-when-desktop, but GRACEFULLY DEGRADE (stream-token availability contract) ---\n  // The desktop pixel plane needs an HMAC secret to mint scoped stream tokens.\n  // It is REQUIRED when desktop is enabled — but per OD-8 a missing secret is NOT\n  // a hard boot-fail: we emit a LOUD warning and the deployment ships with\n  // DesktopStream.transport:null (resolveStreamTokenSecret returns undefined ->\n  // negotiateCapabilities degrades the desktop cell). This keeps a desktop-\n  // configured deployment bootable (headless + Channel-A still work) instead of\n  // crashing the whole API on a missing secret.\n  if (\n    settings.sandboxDesktopEnabled &&\n    settings.sandboxBackend === \"modal\" &&\n    ![\"local\", \"test\"].includes(settings.environment)\n  ) {\n    if (!isDigestPinnedModalDesktopImage(settings)) {\n      throw new Error(\n        \"OPENGENI_MODAL_IMAGE_REF must be digest-pinned (registry/name@sha256:…) when \" +\n          \"OPENGENI_SANDBOX_BACKEND=modal and OPENGENI_SANDBOX_DESKTOP_ENABLED=true. \" +\n          \"Computer/Browser need docker/desktop.Dockerfile, not the official headless \" +\n          \"opengeni-sandbox image. Helm desktop.imageRef writes this pin.\",\n      );\n    }\n  }\n  if (settings.sandboxDesktopEnabled && resolveStreamTokenSecret(settings) === undefined) {\n    console.warn(\n      \"[opengeni] OPENGENI_SANDBOX_DESKTOP_ENABLED=true but neither OPENGENI_STREAM_TOKEN_SECRET nor \" +\n        \"OPENGENI_DELEGATION_SECRET is set: the desktop pixel plane will GRACEFULLY DEGRADE \" +\n        \"(DesktopStream.transport=null — no scoped stream tokens can be minted). Set \" +\n        \"OPENGENI_STREAM_TOKEN_SECRET to enable the live desktop stream.\",\n    );\n  }\n  if (settings.modelCatalogSource === \"code\") {\n    validateModelCatalogSettings(settings, source);\n  } else {\n    // Database mode resolves membership asynchronously. Only the independent\n    // deployment funding JSON is parsed here; env catalog and note inputs are\n    // intentionally ignored until resolveCatalogSettings applies the singleton.\n    parseModelCostPolicyJson(settings.modelCostPolicyJson);\n    if (settings.managedModelsJson?.trim()) {\n      console.warn(\n        \"[opengeni] OPENGENI_MANAGED_MODELS_JSON is ignored because OPENGENI_MODEL_CATALOG_SOURCE=database; \" +\n          \"set gatewayModels/openrouterModels/opperModels in the deployment catalog document instead.\",\n      );\n    }\n  }\n}\n\n/** Validate one fully resolved, secret-bearing executable catalog. */\nexport function validateModelCatalogSettings(\n  settings: Settings,\n  source: NodeJS.ProcessEnv = process.env,\n): ConfiguredModel[] {\n  const costPolicy = parseModelCostPolicyJson(settings.modelCostPolicyJson);\n  const notes = parseModelNotesJson(settings.modelNotesJson);\n  const registryProviders = parseModelProvidersJson(settings.modelProvidersJson);\n  const builtinId = builtinProviderId(settings);\n  const opperKeyProblem =\n    settings.opperApiKey === undefined ? null : opperCredentialProblem(settings.opperApiKey);\n  if (opperKeyProblem) {\n    throw new Error(`OPENGENI_OPPER_API_KEY: ${opperKeyProblem}`);\n  }\n  const providerIds = new Set<string>();\n  for (const provider of registryProviders) {\n    if (\n      provider.kind === \"vercel-gateway-managed\" ||\n      provider.kind === \"vercel-gateway-workspace\" ||\n      provider.kind === \"vercel-gateway-organization\" ||\n      provider.kind === \"direct-openai-workspace\" ||\n      provider.kind === \"direct-azure-workspace\" ||\n      provider.kind === \"direct-openai-organization\" ||\n      provider.kind === \"direct-azure-organization\" ||\n      provider.kind === \"openrouter-workspace\" ||\n      provider.kind === \"openrouter-organization\" ||\n      provider.kind === \"opper-workspace\" ||\n      provider.kind === \"opper-organization\" ||\n      provider.kind === \"anthropic-organization\" ||\n      provider.kind === \"anthropic-workspace\" ||\n      provider.kind === \"claude-subscription-workspace\" ||\n      provider.kind === \"claude-subscription-organization\" ||\n      provider.kind === \"xai-subscription\"\n    ) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider kind ${provider.kind} is reserved for a reviewed Opengeni credential broker`,\n      );\n    }\n    if (RESERVED_MODEL_PROVIDER_IDS.has(provider.id)) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider id ${provider.id} is reserved for a reviewed Opengeni provider`,\n      );\n    }\n    if (provider.id === builtinId) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider id ${provider.id} collides with the built-in provider id`,\n      );\n    }\n    if (providerIds.has(provider.id)) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON contains duplicate provider id ${provider.id}`,\n      );\n    }\n    providerIds.add(provider.id);\n    if (\n      provider.kind !== \"codex-subscription\" &&\n      provider.kind !== \"anonymous\" &&\n      !resolveProviderApiKey(provider, source)\n    ) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider ${provider.id} requires a resolvable API key (set apiKey or apiKeyEnv)`,\n      );\n    }\n  }\n  // Materialize the normalized catalog at boot so canonical product ids,\n  // aliases, definition digests, and capability/pricing normalization are\n  // validated even when managed billing is disabled.\n  const models = configuredModels(settings, source);\n  const defaultCatalogSettings = settingsForTurnExecutionPolicy(settings, settings.openaiModel);\n  const policy = settings.creditPromotionPolicy;\n  const promotionalModelIds = new Set([\n    ...(policy.defaultModelIds ?? []),\n    ...(policy.signupModelIds ?? []),\n    ...Object.values(policy.offers).flatMap((offer) => offer.eligibleModelIds ?? []),\n  ]);\n  for (const modelId of promotionalModelIds) {\n    if (!models.some((model) => model.id === modelId && model.cost === \"credits\")) {\n      throw new Error(\n        `Promotional credit model ${modelId} must be a canonical credits-billed model in the catalog`,\n      );\n    }\n  }\n  const defaultCatalogModels =\n    defaultCatalogSettings === settings ? models : configuredModels(defaultCatalogSettings, source);\n  if (models.length === 0 && defaultCatalogModels.length === 0) {\n    throw new Error(\"The resolved model catalog contains no executable models\");\n  }\n  const defaultModelId = canonicalizeConfiguredModelId(\n    defaultCatalogSettings,\n    settings.openaiModel,\n  );\n  if (!defaultCatalogModels.some((model) => model.id === defaultModelId)) {\n    throw new Error(\n      `The default model ${settings.openaiModel} is not executable in the resolved model catalog`,\n    );\n  }\n  // An operator-set credits default must name a credits-billed model in the\n  // env catalog; a typo would otherwise fall back silently to the first\n  // selectable credits model. Only an explicit value in code catalog mode is\n  // checked: the built-in gpt-6-luna may be absent from a custom catalog, and\n  // a database catalog is edited independently of this env value, so both keep\n  // the documented fallback (docs/model-providers.md) instead of failing\n  // every catalog read.\n  const explicitCreditsDefault = source.OPENGENI_CREDITS_DEFAULT_MODEL?.trim();\n  if (\n    explicitCreditsDefault &&\n    settings.modelCatalogSource === \"code\" &&\n    settings.billingMode === \"stripe\"\n  ) {\n    const creditsDefaultId = canonicalizeConfiguredModelId(settings, settings.creditsDefaultModel);\n    const creditsDefault = models.find((model) => model.id === creditsDefaultId);\n    if (creditsDefault?.cost !== \"credits\") {\n      throw new Error(\n        `OPENGENI_CREDITS_DEFAULT_MODEL ${settings.creditsDefaultModel} is not a credits-billed model in the resolved model catalog`,\n      );\n    }\n  }\n\n  const deploymentProductIds = new Set(\n    models.filter((model) => model.credentialSource.kind === \"deployment\").map((model) => model.id),\n  );\n  const noteProductIds = new Set(models.map((model) => model.id));\n  if (settings.resolvedCodexModelsJson !== undefined) {\n    for (const model of z\n      .array(CodexCatalogModelSchema)\n      .parse(JSON.parse(settings.resolvedCodexModelsJson))) {\n      noteProductIds.add(model.id);\n    }\n  }\n  for (const model of configuredGatewayCatalogModels(settings)) {\n    deploymentProductIds.add(model.productId);\n    noteProductIds.add(model.productId);\n    noteProductIds.add(model.workspaceProductId);\n  }\n  for (const model of configuredOpenRouterCatalogModels(settings)) {\n    const productId = `${OPENROUTER_MODEL_ID_PREFIX}${model.upstreamModelId}`;\n    deploymentProductIds.add(productId);\n    noteProductIds.add(productId);\n    noteProductIds.add(`${WORKSPACE_OPENROUTER_MODEL_ID_PREFIX}${model.upstreamModelId}`);\n  }\n  for (const model of configuredOpperCatalogModels(settings)) {\n    const productId = `${OPPER_MODEL_ID_PREFIX}${model.upstreamModelId}`;\n    deploymentProductIds.add(productId);\n    noteProductIds.add(productId);\n    noteProductIds.add(`${WORKSPACE_OPPER_MODEL_ID_PREFIX}${model.upstreamModelId}`);\n  }\n  if (settings.modelCatalogSource === \"code\") {\n    for (const productId of Object.keys(costPolicy)) {\n      if (!deploymentProductIds.has(productId)) {\n        throw new Error(\n          `OPENGENI_MODEL_COST_POLICY_JSON references unknown deployment model ${productId}`,\n        );\n      }\n    }\n  }\n  for (const productId of Object.keys(notes)) {\n    if (!noteProductIds.has(productId)) {\n      throw new Error(`OPENGENI_MODEL_NOTES_JSON references unknown catalog model ${productId}`);\n    }\n  }\n\n  if (settings.billingMode === \"stripe\" || settings.usageLimitsMode === \"managed\") {\n    const pricing = configuredModelPricing(settings);\n    const missing = models\n      .filter((model) => model.cost === \"credits\" && !pricing[model.id])\n      .map((model) => model.id);\n    if (missing.length > 0) {\n      throw new Error(\n        `Missing model pricing for managed billing model(s): ${missing.join(\", \")}. Set OPENGENI_MODEL_PRICING_JSON.`,\n      );\n    }\n  }\n  return models;\n}\n\n/**\n * Resolve the secret used to sign/verify scoped stream tokens (sandbox contract\n * §C.3). Falls back to `delegationSecret` (the same HMAC envelope family —\n * `ogs_` vs `ogd_` prefix) so a deployment that already carries a delegation\n * secret does not need a second one. Returns undefined when neither is set,\n * which drives the graceful-degrade (DesktopStream.transport:null).\n */\nexport function resolveStreamTokenSecret(settings: Settings): string | undefined {\n  const explicit = settings.streamTokenSecret?.trim();\n  if (explicit) {\n    return explicit;\n  }\n  const delegation = settings.delegationSecret?.trim();\n  return delegation ? delegation : undefined;\n}\n\n/**\n * True iff the desktop pixel plane must GRACEFULLY DEGRADE because desktop is\n * enabled but no stream-token secret is resolvable (stream-token availability contract). When true,\n * negotiateCapabilities forces DesktopStream.transport:null.\n */\nexport function streamTokenDegraded(settings: Settings): boolean {\n  return settings.sandboxDesktopEnabled && resolveStreamTokenSecret(settings) === undefined;\n}\n\n/** Whether this deployment serves the compute agent gateway: the control service API\n * it reads link keys from and the gateway's own URL are both configured. */\nexport function computeGatewayConfigured(settings: Settings): boolean {\n  return Boolean(settings.computeApiUrl && settings.computeApiKey && settings.computeLinkUrl);\n}\n\n/** Everything a deployment must configure before a compute sandbox can work,\n * as human-readable problems; empty when it is ready. Checked at boot when\n * compute is the deployment backend, and whenever a compute client is built,\n * so a session that selects compute fails clearly instead of half-creating. */\nexport function computeSettingsIssues(settings: Settings): string[] {\n  const issues: string[] = [];\n  if (!settings.computeApiUrl) issues.push(\"OPENGENI_COMPUTE_API_URL is required\");\n  if (!settings.computeApiKey) issues.push(\"OPENGENI_COMPUTE_API_KEY is required\");\n  if (\n    settings.computeApiUrl &&\n    ![\"local\", \"test\"].includes(settings.environment) &&\n    !settings.computeApiUrl.startsWith(\"https://\")\n  ) {\n    issues.push(\"OPENGENI_COMPUTE_API_URL must use https outside local/test\");\n  }\n  const linkUrl = settings.computeLinkUrl;\n  if (!linkUrl) {\n    issues.push(\"OPENGENI_COMPUTE_LINK_URL is required\");\n  } else if (\n    !linkUrl.startsWith(\"wss://\") &&\n    !([\"local\", \"test\"].includes(settings.environment) && linkUrl.startsWith(\"ws://\"))\n  ) {\n    issues.push(\"OPENGENI_COMPUTE_LINK_URL must be a wss:// URL (ws:// only in local/test)\");\n  }\n  if (!settings.selfhostedRelayUrl || !resolveRelayTokenSecret(settings)) {\n    issues.push(\n      \"OPENGENI_SELFHOSTED_RELAY_URL and the relay token secret are required (terminal, desktop and ports)\",\n    );\n  }\n  if (settings.agentOpStreamEnabled !== true) {\n    issues.push(\"OPENGENI_AGENT_OP_STREAM_ENABLED must stay true (agent exec needs op-stream)\");\n  }\n  if (\n    settings.computeMemoryRequestMib !== undefined &&\n    settings.computeMemoryRequestMib > settings.computeMemoryMib\n  ) {\n    issues.push(\"OPENGENI_COMPUTE_MEMORY_REQUEST_MIB must not exceed OPENGENI_COMPUTE_MEMORY_MIB\");\n  }\n  if (\n    settings.computeCpuRequestMillis !== undefined &&\n    settings.computeCpuRequestMillis > settings.computeVcpus * 1000\n  ) {\n    issues.push(\n      \"OPENGENI_COMPUTE_CPU_REQUEST_MILLIS must not exceed OPENGENI_COMPUTE_VCPUS * 1000\",\n    );\n  }\n  return issues;\n}\n\n/**\n * Resolve the secret the control plane signs the enrollment bearer credential\n * with (the `oge_` envelope the agent presents back — M5). Falls\n * back to `delegationSecret` (the same HMAC envelope family) so a deployment that\n * already carries a delegation secret needs no second one. Returns undefined when\n * neither is set; when selfhosted is enabled but this is undefined, the poll route\n * reports the credential plane disabled (graceful degrade, never a 500). NEVER log\n * the returned value.\n */\nexport function resolveEnrollmentSigningSecret(settings: Settings): string | undefined {\n  const explicit = settings.enrollmentSigningSecret?.trim();\n  if (explicit) {\n    return explicit;\n  }\n  const delegation = settings.delegationSecret?.trim();\n  return delegation ? delegation : undefined;\n}\n\n/**\n * Resolve the HMAC secret the control plane signs the agent's relay PRODUCER token\n * with (the `ogr_` envelope; M8b). The RELAY verifies the producer\n * token with the SAME secret (injected into the relay via env). Prefers an explicit\n * `selfhostedRelayTokenSecret`, then the `streamTokenSecret` (the relay already\n * needs that one to verify the viewer's `ogs_` token, so a single secret can back\n * both planes), then `delegationSecret` (same HMAC family). Returns undefined when\n * none is set — the enrollment poll then returns an empty relayToken (graceful\n * degrade; the stream plane is unavailable until configured). NEVER log the value.\n */\nexport function resolveRelayTokenSecret(settings: Settings): string | undefined {\n  const explicit = settings.selfhostedRelayTokenSecret?.trim();\n  if (explicit) {\n    return explicit;\n  }\n  const stream = settings.streamTokenSecret?.trim();\n  if (stream) {\n    return stream;\n  }\n  const delegation = settings.delegationSecret?.trim();\n  return delegation ? delegation : undefined;\n}\n\n/**\n * The resolved NATS auth-callout responder config (M-AUTH). Present only when the\n * callout plane is FULLY configured: the account signing seed + the responder's own\n * login. When any piece is missing this returns null and the responder does not\n * start (selfhosted agents cannot connect — a graceful disabled state, never a boot\n * crash). The returned `accountSeed` is a secret; NEVER log it.\n */\nexport interface NatsCalloutConfig {\n  /** The callout account SIGNING seed (`SA...`) — signs the user + response JWTs. */\n  accountSeed: string;\n  /** The target account NAME the user is placed into (the response `aud`). */\n  accountName: string;\n  /** The responder's NATS login (an `auth_callout.auth_users` user). */\n  user: string;\n  password: string;\n}\n\nexport function resolveNatsCalloutConfig(settings: Settings): NatsCalloutConfig | null {\n  const accountSeed = settings.selfhostedNatsCalloutAccountSeed?.trim();\n  const accountName = settings.selfhostedNatsCalloutAccountName?.trim() || \"APP\";\n  const user = settings.selfhostedNatsCalloutUser?.trim();\n  const password = settings.selfhostedNatsCalloutPassword?.trim();\n  if (!accountSeed || !user || !password) {\n    return null;\n  }\n  return { accountSeed, accountName, user, password };\n}\n\nfunction validateObjectStorageSettings(settings: ObjectStorageSettings): void {\n  if (\n    settings.objectStorageBackend === \"s3-compatible\" ||\n    settings.objectStorageBackend === \"aws-s3\"\n  ) {\n    if (\n      Boolean(settings.objectStorageAccessKeyId) !== Boolean(settings.objectStorageSecretAccessKey)\n    ) {\n      throw new Error(\n        \"OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID and OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY must both be set or both omitted\",\n      );\n    }\n    if (\n      settings.objectStorageBackend === \"s3-compatible\" &&\n      (settings.objectStorageEndpoint ||\n        settings.objectStorageInternalEndpoint ||\n        settings.objectStorageSandboxEndpoint) &&\n      (!settings.objectStorageAccessKeyId || !settings.objectStorageSecretAccessKey)\n    ) {\n      throw new Error(\n        \"S3-compatible object storage endpoints require OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID and OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY\",\n      );\n    }\n    if (\n      settings.objectStorageAzureConnectionString ||\n      settings.objectStorageAzureAccountName ||\n      settings.objectStorageAzureAccountKey ||\n      settings.objectStorageAzureEndpoint\n    ) {\n      throw new Error(\n        \"S3 object storage uses OPENGENI_OBJECT_STORAGE_* S3 settings, not OPENGENI_OBJECT_STORAGE_AZURE_* settings\",\n      );\n    }\n    if (\n      settings.objectStorageGcsProjectId ||\n      settings.objectStorageGcsCredentialsJson ||\n      settings.objectStorageGcsKeyFilename ||\n      settings.objectStorageGcsApiEndpoint\n    ) {\n      throw new Error(\n        \"S3 object storage uses OPENGENI_OBJECT_STORAGE_* S3 settings, not OPENGENI_OBJECT_STORAGE_GCS_* settings\",\n      );\n    }\n  } else if (settings.objectStorageBackend === \"azure-blob\") {\n    if (\n      settings.objectStorageEndpoint ||\n      settings.objectStorageInternalEndpoint ||\n      settings.objectStorageSandboxEndpoint ||\n      settings.objectStorageAccessKeyId ||\n      settings.objectStorageSecretAccessKey\n    ) {\n      throw new Error(\n        \"Azure Blob storage uses OPENGENI_OBJECT_STORAGE_AZURE_* settings, not S3-compatible object storage settings\",\n      );\n    }\n    if (\n      settings.objectStorageGcsProjectId ||\n      settings.objectStorageGcsCredentialsJson ||\n      settings.objectStorageGcsKeyFilename ||\n      settings.objectStorageGcsApiEndpoint\n    ) {\n      throw new Error(\n        \"Azure Blob storage uses OPENGENI_OBJECT_STORAGE_AZURE_* settings, not OPENGENI_OBJECT_STORAGE_GCS_* settings\",\n      );\n    }\n    const hasConnectionString = Boolean(settings.objectStorageAzureConnectionString);\n    const hasSharedKey =\n      Boolean(settings.objectStorageAzureAccountName) &&\n      Boolean(settings.objectStorageAzureAccountKey);\n    if (!hasConnectionString && !hasSharedKey) {\n      throw new Error(\n        \"Azure Blob storage requires OPENGENI_OBJECT_STORAGE_AZURE_CONNECTION_STRING or OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_NAME plus OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_KEY\",\n      );\n    }\n  } else {\n    if (\n      settings.objectStorageEndpoint ||\n      settings.objectStorageInternalEndpoint ||\n      settings.objectStorageSandboxEndpoint ||\n      settings.objectStorageAccessKeyId ||\n      settings.objectStorageSecretAccessKey\n    ) {\n      throw new Error(\n        \"GCS object storage uses OPENGENI_OBJECT_STORAGE_GCS_* settings, not S3-compatible object storage settings\",\n      );\n    }\n    if (\n      settings.objectStorageAzureConnectionString ||\n      settings.objectStorageAzureAccountName ||\n      settings.objectStorageAzureAccountKey ||\n      settings.objectStorageAzureEndpoint\n    ) {\n      throw new Error(\n        \"GCS object storage uses OPENGENI_OBJECT_STORAGE_GCS_* settings, not OPENGENI_OBJECT_STORAGE_AZURE_* settings\",\n      );\n    }\n    if (settings.objectStorageGcsCredentialsJson) {\n      parseGcsCredentialsJson(settings.objectStorageGcsCredentialsJson);\n    }\n  }\n}\n\n/**\n * The PRIVILEGED control-plane NATS login (api/worker). Present only when BOTH a\n * user and password are set; otherwise null and the bus connects anonymously (local\n * dev / a NATS without auth_callout). When the callout plane is on, this is the\n * static account user permitted to request exact generation-fenced agent RPC subjects.\n */\nexport interface NatsControlPlaneAuth {\n  user: string;\n  password: string;\n}\n\nexport function resolveNatsControlPlaneAuth(\n  settings: Pick<Settings, \"selfhostedNatsControlUser\" | \"selfhostedNatsControlPassword\">,\n): NatsControlPlaneAuth | null {\n  const user = settings.selfhostedNatsControlUser?.trim();\n  const password = settings.selfhostedNatsControlPassword?.trim();\n  if (!user || !password) {\n    return null;\n  }\n  return { user, password };\n}\n\nfunction splitCsv(raw: string): string[] {\n  return raw\n    .split(\",\")\n    .map((value) => value.trim())\n    .filter(Boolean);\n}\n\n/** Image references a workspace may select as its default sandbox image. */\nexport function sandboxImageAllowlist(settings: Pick<Settings, \"sandboxImageAllowlist\">): string[] {\n  return [...new Set(splitCsv(settings.sandboxImageAllowlist ?? \"\"))];\n}\n\nfunction uniqueEnvNames(raw: string[], fieldName: string): string[] {\n  const seen = new Set<string>();\n  const out: string[] = [];\n  for (const name of raw) {\n    if (!envName.test(name)) {\n      throw new Error(`${fieldName} contains invalid variable name ${name}`);\n    }\n    if (!seen.has(name)) {\n      seen.add(name);\n      out.push(name);\n    }\n  }\n  return out;\n}\n\nfunction uniqueValues(raw: string[]): string[] {\n  return [...new Set(raw.filter(Boolean))];\n}\n\nfunction parseGcsCredentialsJson(raw: string): unknown {\n  try {\n    return JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_OBJECT_STORAGE_GCS_CREDENTIALS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n}\n\nfunction delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n/** Native Claude connections reuse the encrypted workspace and organization boundaries. */\nexport const CLAUDE_CONNECTION_KINDS = [\"anthropic\", \"claude_subscription\"] as const;\nexport type ClaudeConnectionKind = (typeof CLAUDE_CONNECTION_KINDS)[number];\n// Per-model native Messages controls. Unknown IDs never inherit adaptive\n// thinking merely because they share a provider with a supported model.\nconst CLAUDE_NATIVE_MODEL_PROFILES: Readonly<\n  Record<\n    string,\n    Readonly<{\n      efforts: readonly ReasoningEffort[];\n      defaultEffort: ReasoningEffort | null;\n      contextWindowTokens: number;\n      maxOutputTokens: number;\n      autoCompactTokenLimit?: number;\n      prefixBoundThinking?: boolean;\n      /**\n       * The model writes its notes for the person between tool calls as\n       * progress-update `thinking` blocks instead of `text` blocks. Requests\n       * use `thinking.display: \"updates\"` so those blocks, and only those,\n       * carry readable text (Anthropic's documented way to tell them apart\n       * from reasoning).\n       */\n      progressUpdates?: boolean;\n    }>\n  >\n> = Object.fromEntries([\n  ...[\n    [\"claude-opus-5-5\", \"medium\"],\n    [\"claude-sonnet-5-5\", \"medium\"],\n    [\"claude-haiku-5-5\", \"medium\"],\n    [\"claude-opus-5\", \"high\"],\n    [\"claude-sonnet-5\", \"high\"],\n    [\"claude-opus-4-8\", \"high\"],\n    [\"claude-opus-4-7\", \"xhigh\"],\n  ].map(([id, defaultEffort]) => [\n    id,\n    {\n      efforts: [\"low\", \"medium\", \"high\", \"xhigh\", \"max\"],\n      defaultEffort,\n      contextWindowTokens: 1_000_000,\n      maxOutputTokens: 128_000,\n      prefixBoundThinking:\n        id === \"claude-opus-5-5\" || id === \"claude-sonnet-5-5\" || id === \"claude-haiku-5-5\",\n      ...(id === \"claude-opus-5-5\" || id === \"claude-sonnet-5-5\" ? { progressUpdates: true } : {}),\n      ...(id === \"claude-haiku-5-5\"\n        ? { autoCompactTokenLimit: 95_000 }\n        : id === \"claude-opus-5-5\"\n          ? { autoCompactTokenLimit: OPUS_5_5_AUTO_COMPACT_TOKEN_LIMIT }\n          : {}),\n    },\n  ]),\n  ...[\"claude-opus-4-6\", \"claude-sonnet-4-6\"].map((id) => [\n    id,\n    {\n      efforts: [\"low\", \"medium\", \"high\", \"max\"],\n      defaultEffort: \"high\",\n      contextWindowTokens: 1_000_000,\n      maxOutputTokens: 128_000,\n    },\n  ]),\n  [\n    \"claude-haiku-4-5-20251001\",\n    {\n      efforts: [],\n      defaultEffort: null,\n      contextWindowTokens: 200_000,\n      maxOutputTokens: 64_000,\n    },\n  ],\n]);\nexport function claudeNativeModelProfile(upstreamModelId: string) {\n  return Object.hasOwn(CLAUDE_NATIVE_MODEL_PROFILES, upstreamModelId)\n    ? CLAUDE_NATIVE_MODEL_PROFILES[upstreamModelId]\n    : undefined;\n}\n/**\n * Models a new Claude connection offers without anyone adding them. Seeded\n * once per scope and connection kind, only when that scope never configured\n * Claude models; a removed model stays removed.\n */\nexport const CLAUDE_DEFAULT_CONNECTION_MODEL_IDS = [\n  \"claude-opus-5-5\",\n  \"claude-sonnet-5-5\",\n  \"claude-haiku-5-5\",\n] as const;\nexport function claudeProviderId(\n  kind: ClaudeConnectionKind,\n  scope: \"workspace\" | \"organization\" = \"organization\",\n): string {\n  return `${scope}-${kind === \"anthropic\" ? \"anthropic\" : \"claude-subscription\"}`;\n}\nexport type ClaudeConnectionCatalog = Partial<\n  Record<\n    ClaudeConnectionKind,\n    {\n      active?: boolean;\n      models: readonly { upstreamModelId: string; label?: string | null }[];\n    }\n  >\n>;\nexport function withClaudeConnectionCatalog(\n  settings: Settings,\n  connections: ClaudeConnectionCatalog,\n  scope: \"workspace\" | \"organization\" = \"organization\",\n): Settings {\n  let providers = parseModelProvidersJson(settings.modelProvidersJson);\n  for (const kind of CLAUDE_CONNECTION_KINDS) {\n    if (kind === \"claude_subscription\" && !settings.claudeSubscriptionEnabled) {\n      providers = providers.filter((provider) => provider.id !== claudeProviderId(kind, scope));\n      continue;\n    }\n    const connection = connections[kind];\n    if (!connection) continue;\n    const id = claudeProviderId(kind, scope);\n    providers = providers.filter((provider) => provider.id !== id);\n    if (!connection.models.length) continue;\n    providers.push({\n      id,\n      label: kind === \"anthropic\" ? \"Anthropic API\" : \"Claude subscription\",\n      kind: kind === \"anthropic\" ? `anthropic-${scope}` : `claude-subscription-${scope}`,\n      api: \"anthropic-messages\",\n      wireProfile: \"openai\",\n      baseUrl: \"https://api.anthropic.com/v1\",\n      anthropic: {\n        auth: kind === \"anthropic\" ? \"api-key\" : \"oauth\",\n        cacheTtl: \"5m\",\n        maxOutputTokens: 128000,\n        streamIdleTimeoutMs: 600000,\n      },\n      models: connection.models.map((model) => {\n        const profile = claudeNativeModelProfile(model.upstreamModelId);\n        const adaptiveThinking = Boolean(profile?.efforts.length);\n        const contextWindowTokens = profile?.contextWindowTokens ?? 200_000;\n        const outputReserve = profile?.maxOutputTokens ?? 32_000;\n        return {\n          contextWindowTokens,\n          effectiveContextWindowTokens: contextWindowTokens - outputReserve,\n          autoCompactTokenLimit:\n            profile?.autoCompactTokenLimit ??\n            (contextWindowTokens === 1_000_000\n              ? 800_000\n              : Math.min(150_000, contextWindowTokens - outputReserve - 18_000)),\n          id: id + \"/\" + model.upstreamModelId,\n          upstreamModelId: model.upstreamModelId,\n          label:\n            model.label ??\n            (model.upstreamModelId === \"claude-opus-5-5\"\n              ? \"Claude Opus 5.5\"\n              : model.upstreamModelId === \"claude-sonnet-5-5\"\n                ? \"Claude Sonnet 5.5\"\n                : model.upstreamModelId === \"claude-haiku-5-5\"\n                  ? \"Claude Haiku 5.5\"\n                  : model.upstreamModelId),\n          reasoningEffort: adaptiveThinking,\n          // Claude's server-side web search runs on every Claude route (API\n          // key and subscription) under the deployment's web search switch.\n          hostedWebSearch: settings.webSearchEnabled,\n          capabilities: {\n            ...legacyModelCapabilities(settings, {\n              reasoningEffort: adaptiveThinking,\n              hostedWebSearch: settings.webSearchEnabled,\n              vision: true,\n            }),\n            inputFileMediaTypes: [],\n            reasoning: {\n              upstream: adaptiveThinking ? \"supported\" : \"unknown\",\n              runnable: adaptiveThinking,\n              efforts: [...(profile?.efforts ?? [])],\n              defaultEffort: profile?.defaultEffort ?? null,\n              required: false,\n            },\n            functionCalling: { upstream: \"supported\", runnable: true },\n            promptCaching: { upstream: \"supported\", runnable: true, mode: \"automatic\" },\n          },\n        };\n      }),\n    });\n  }\n  return { ...settings, modelProvidersJson: JSON.stringify(providers) };\n}\nexport function withClaudeConnectionCredential(\n  settings: Settings,\n  kind: ClaudeConnectionKind,\n  credential: string,\n  scope: \"workspace\" | \"organization\" = \"organization\",\n  credentialBinding?: { connectionId: string; credentialVersion: number },\n): Settings {\n  if (kind === \"claude_subscription\" && !settings.claudeSubscriptionEnabled)\n    throw new Error(\"Claude subscriptions are not enabled on this deployment\");\n  if (!credential.trim()) throw new Error(\"Claude credential is empty\");\n  const bundle =\n    kind === \"claude_subscription\" && credential.trim().startsWith(\"{\")\n      ? ClaudeSubscriptionCredential.parse(JSON.parse(credential))\n      : null;\n  return {\n    ...settings,\n    modelProvidersJson: JSON.stringify(\n      parseModelProvidersJson(settings.modelProvidersJson).map((provider) =>\n        provider.id === claudeProviderId(kind, scope)\n          ? {\n              ...provider,\n              apiKey: bundle?.token ?? credential,\n              ...(kind === \"claude_subscription\" && provider.anthropic\n                ? {\n                    anthropic: {\n                      ...provider.anthropic,\n                      identity: bundle?.identity,\n                      credentialBinding: credentialBinding\n                        ? {\n                            connectionId: credentialBinding.connectionId,\n                            credentialVersion: credentialBinding.credentialVersion,\n                          }\n                        : undefined,\n                    },\n                  }\n                : {}),\n            }\n          : provider,\n      ),\n    ),\n  };\n}\nexport * from \"./claude-subscription-usage\";\nexport * from \"./claude-subscription-oauth\";\nexport * from \"./subscription-account-selection\";\nexport * from \"./claude-subscription-capacity\";\n","import {\n  ClaudeUsageWindowId,\n  type ClaudeSubscriptionUsage,\n  type ClaudeUsageWindow,\n  type ClaudeUsageRequestStatus,\n} from \"@opengeni/contracts\";\n\nexport type ClaudeUsageObservation = {\n  windows: ClaudeUsageWindow[];\n  observedAt: string;\n  source: \"response_headers\" | \"provider\";\n  requestStatus?: ClaudeUsageRequestStatus | null;\n  requestRestrictions?: ClaudeUsageRequestStatus[];\n};\nconst prefixes: Record<string, string[]> = {\n  five_hour: [\"5h\"],\n  seven_day: [\"7d\"],\n  seven_day_opus: [\"7d-opus\"],\n  seven_day_sonnet: [\"7d-sonnet\"],\n  seven_day_overage_included: [\"7d_oi\", \"7d-overage-included\"],\n  overage: [\"overage\"],\n};\nfunction percent(value: unknown, scale: number): number | null {\n  if (typeof value !== \"number\" && (typeof value !== \"string\" || !value.trim())) return null;\n  const number = Number(value) * scale;\n  return Number.isFinite(number) && number >= 0 ? number : null;\n}\nfunction epoch(value: string | null): string | null {\n  if (!value || !/^\\d+(?:\\.\\d+)?$/.test(value)) return null;\n  const time = Number(value) * 1000;\n  return Number.isFinite(time) && time > 0 && time < 8.64e15 ? new Date(time).toISOString() : null;\n}\nfunction status(value: unknown): ClaudeUsageWindow[\"status\"] {\n  return value === \"allowed\" || value === \"allowed_warning\" || value === \"rejected\" ? value : null;\n}\n\nfunction latestReset(left: string | null, right: string | null, observedAt: string): string {\n  return new Date(\n    Math.max(\n      left ? Date.parse(left) : Date.parse(observedAt) + 60_000,\n      right ? Date.parse(right) : Date.parse(observedAt) + 60_000,\n    ),\n  ).toISOString();\n}\n\nfunction evidenceKey(item: ClaudeUsageRequestStatus): string {\n  // A legacy Sonnet claim does not prove an account-wide restriction cleared.\n  return JSON.stringify([\n    item.upstreamModelId,\n    item.upstreamModelId ? null : item.representativeClaim,\n    item.source === \"provider\",\n  ]);\n}\n\nfunction tiedRequest(\n  left: ClaudeUsageRequestStatus,\n  right: ClaudeUsageRequestStatus,\n): ClaudeUsageRequestStatus {\n  const denied = left.status === \"rejected\" ? left : right.status === \"rejected\" ? right : null;\n  return {\n    ...(denied ?? left),\n    resetsAt: denied\n      ? latestReset(\n          left.status === \"rejected\" ? left.resetsAt : denied.resetsAt,\n          right.status === \"rejected\" ? right.resetsAt : denied.resetsAt,\n          left.observedAt,\n        )\n      : null,\n    representativeClaim:\n      left.representativeClaim === right.representativeClaim ? left.representativeClaim : null,\n    status: denied ? \"rejected\" : null,\n    overageStatus: null,\n    overageResetsAt: null,\n  };\n}\n\nexport function parseClaudeUsageHeaders(\n  headers: Headers,\n  now = new Date(),\n  upstreamModelId?: string,\n): ClaudeUsageObservation | null {\n  const observedAt = now.toISOString();\n  const claim = ClaudeUsageWindowId.safeParse(\n    headers.get(\"anthropic-ratelimit-unified-representative-claim\"),\n  );\n  const claimedStatus = status(headers.get(\"anthropic-ratelimit-unified-status\"));\n  const claimedReset = epoch(headers.get(\"anthropic-ratelimit-unified-reset\"));\n  const overageStatus = status(headers.get(\"anthropic-ratelimit-unified-overage-status\"));\n  const overageResetsAt = epoch(headers.get(\"anthropic-ratelimit-unified-overage-reset\"));\n  const windows = ClaudeUsageWindowId.options.flatMap((id) => {\n    const header = (suffix: string) =>\n      prefixes[id]!.map((prefix) =>\n        headers.get(`anthropic-ratelimit-unified-${prefix}-${suffix}`),\n      ).find((value) => value !== null) ?? null;\n    const representative = claim.success && claim.data === id;\n    const usedPercent = percent(header(\"utilization\"), 100);\n    const resetsAt = epoch(header(\"reset\")) ?? (representative ? claimedReset : null);\n    const windowStatus = status(header(\"status\")) ?? (representative ? claimedStatus : null);\n    if (usedPercent === null && resetsAt === null && windowStatus === null) return [];\n    return [{ id, usedPercent, resetsAt, status: windowStatus, observedAt }];\n  });\n  return windows.length || claimedStatus || overageStatus\n    ? {\n        windows,\n        observedAt,\n        source: \"response_headers\",\n        requestStatus: {\n          status: claimedStatus,\n          resetsAt: claimedReset,\n          representativeClaim: claim.success ? claim.data : null,\n          overageStatus,\n          overageResetsAt,\n          upstreamModelId: upstreamModelId ?? null,\n          observedAt,\n        },\n      }\n    : null;\n}\n\nexport function parseClaudeUsageResponse(\n  value: unknown,\n  now = new Date(),\n): ClaudeUsageObservation | null {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return null;\n  const observedAt = now.toISOString();\n  const windows = ClaudeUsageWindowId.options.flatMap((id) => {\n    const window = (value as Record<string, unknown>)[id];\n    if (!window || typeof window !== \"object\" || Array.isArray(window)) return [];\n    const fields = window as Record<string, unknown>;\n    const usedPercent = percent(fields.utilization, 1);\n    const time = typeof fields.resets_at === \"string\" ? Date.parse(fields.resets_at) : NaN;\n    const resetsAt = Number.isFinite(time) ? new Date(time).toISOString() : null;\n    if (usedPercent === null && resetsAt === null) return [];\n    return [{ id, usedPercent, resetsAt, status: null, observedAt }];\n  });\n  return windows.length ? { windows, observedAt, source: \"provider\" } : null;\n}\n\nexport function emptyClaudeUsage(credentialVersion: number | null): ClaudeSubscriptionUsage {\n  return {\n    connected: credentialVersion !== null,\n    credentialVersion,\n    windows: [],\n    observedAt: null,\n    source: null,\n    refreshStatus: \"not_checked\",\n    refreshCheckedAt: null,\n  };\n}\n\n/** Preserve omitted windows and reject observations older than their individual window. */\nexport function mergeClaudeUsage(\n  current: ClaudeSubscriptionUsage,\n  observation: ClaudeUsageObservation,\n): ClaudeSubscriptionUsage {\n  const windows = new Map(current.windows.map((window) => [window.id, window]));\n  for (const incomingWindow of observation.windows) {\n    const window = { ...incomingWindow, source: incomingWindow.source ?? observation.source };\n    const previous = windows.get(window.id);\n    if (!previous || previous.observedAt < window.observedAt) windows.set(window.id, window);\n    else if (\n      previous.observedAt === window.observedAt &&\n      JSON.stringify(previous) !== JSON.stringify(window)\n    ) {\n      const rejected = previous.status === \"rejected\" || window.status === \"rejected\";\n      const full = (previous.usedPercent ?? 0) >= 100 || (window.usedPercent ?? 0) >= 100;\n      windows.set(window.id, {\n        ...previous,\n        usedPercent:\n          previous.usedPercent === null\n            ? window.usedPercent\n            : window.usedPercent === null\n              ? previous.usedPercent\n              : Math.max(previous.usedPercent, window.usedPercent),\n        status: rejected ? \"rejected\" : previous.status === window.status ? previous.status : null,\n        resetsAt:\n          rejected || full\n            ? latestReset(previous.resetsAt, window.resetsAt, window.observedAt)\n            : previous.resetsAt === window.resetsAt\n              ? previous.resetsAt\n              : null,\n        source:\n          previous.source === \"response_headers\" || window.source === \"response_headers\"\n            ? \"response_headers\"\n            : \"provider\",\n      });\n    }\n  }\n  const incoming = observation.requestStatus;\n  const restrictions = new Map(\n    (current.requestRestrictions ?? []).map((item) => [evidenceKey(item), item]),\n  );\n  // Legacy snapshots also contribute their denial; a different model's success\n  // must not erase a restriction with an unknown representative claim.\n  for (const item of [\n    current.requestStatus?.status ? current.requestStatus : null,\n    ...(observation.requestRestrictions ?? []),\n    incoming?.status ? incoming : null,\n  ]) {\n    if (!item) continue;\n    const key = evidenceKey(item);\n    const previous = restrictions.get(key);\n    const sanitized = {\n      ...item,\n      overageStatus: null,\n      overageResetsAt: null,\n    };\n    if (!previous || item.observedAt > previous.observedAt) restrictions.set(key, sanitized);\n    else if (\n      item.observedAt === previous.observedAt &&\n      JSON.stringify(previous) !== JSON.stringify(sanitized)\n    )\n      restrictions.set(key, tiedRequest(previous, sanitized));\n  }\n  // Direct refreshes can precede late turn finalizers. Retain each direct\n  // window's watermark even when no model restriction is present yet.\n  const directWindows = [\n    ...current.windows.filter(\n      (window) =>\n        window.source === \"provider\" ||\n        (!window.source &&\n          current.source === \"provider\" &&\n          current.observedAt === window.observedAt),\n    ),\n    ...observation.windows.filter((window) => (window.source ?? observation.source) === \"provider\"),\n  ];\n  for (const window of directWindows) {\n    if (window.usedPercent === null || window.usedPercent >= 100) continue;\n    const proof: ClaudeUsageRequestStatus = {\n      status: null,\n      resetsAt: null,\n      representativeClaim: window.id,\n      upstreamModelId: null,\n      overageStatus: null,\n      overageResetsAt: null,\n      observedAt: window.observedAt,\n      source: \"provider\",\n    };\n    const key = evidenceKey(proof);\n    if (!restrictions.has(key) || restrictions.get(key)!.observedAt < proof.observedAt)\n      restrictions.set(key, proof);\n  }\n  for (const [key, item] of restrictions) {\n    if (item.status !== \"rejected\") continue;\n    const proof = [...restrictions.values()].find(\n      (candidate) =>\n        candidate.source === \"provider\" &&\n        candidate.representativeClaim === item.representativeClaim &&\n        candidate.observedAt > item.observedAt &&\n        candidate.representativeClaim !== \"overage\" &&\n        candidate.representativeClaim !== \"seven_day_overage_included\",\n    );\n    if (proof)\n      restrictions.set(key, {\n        ...item,\n        status: null,\n        resetsAt: null,\n        observedAt: proof.observedAt,\n      });\n  }\n  // Bound persisted state without dropping denials: overflow collapses to a\n  // conservative account-wide restriction until the latest known reset.\n  let requestRestrictions = [...restrictions.values()];\n  const evidenceTime = requestRestrictions.reduce(\n    (value, item) => (item.observedAt > value ? item.observedAt : value),\n    observation.observedAt,\n  );\n  const liveDenials = requestRestrictions.filter(\n    (item) =>\n      item.status === \"rejected\" &&\n      (item.resetsAt ? Date.parse(item.resetsAt) : Date.parse(item.observedAt) + 60_000) >\n        Date.parse(evidenceTime),\n  );\n  if (requestRestrictions.length > 64 && liveDenials.length === 0) {\n    requestRestrictions = requestRestrictions\n      .sort((left, right) => right.observedAt.localeCompare(left.observedAt))\n      .slice(0, 64);\n  } else if (requestRestrictions.length > 64) {\n    const observedAt = evidenceTime;\n    const resetsAt = new Date(\n      Math.max(\n        ...liveDenials.map((item) =>\n          item.resetsAt ? Date.parse(item.resetsAt) : Date.parse(item.observedAt) + 60_000,\n        ),\n        Date.parse(observedAt) + 60_000,\n      ),\n    ).toISOString();\n    requestRestrictions = [\n      {\n        status: \"rejected\",\n        resetsAt,\n        representativeClaim: null,\n        overageStatus: null,\n        overageResetsAt: null,\n        upstreamModelId: null,\n        observedAt,\n      },\n    ];\n  }\n  const newest = !current.observedAt || current.observedAt < observation.observedAt;\n  const tied = current.observedAt === observation.observedAt;\n  let requestStatus = current.requestStatus ?? null;\n  if (newest) requestStatus = incoming ?? null;\n  else if (tied && JSON.stringify(requestStatus) !== JSON.stringify(incoming ?? null)) {\n    // Millisecond timestamps do not order concurrent responses. Never restore\n    // paid authority or erase a denial on an ambiguous tie.\n    requestStatus =\n      incoming && requestStatus && evidenceKey(incoming) === evidenceKey(requestStatus)\n        ? tiedRequest(requestStatus, incoming)\n        : null;\n  }\n  return {\n    ...current,\n    requestRestrictions,\n    requestStatus,\n    windows: ClaudeUsageWindowId.options.flatMap((id) =>\n      windows.has(id) ? [windows.get(id)!] : [],\n    ),\n    ...(newest\n      ? {\n          observedAt: observation.observedAt,\n          source: observation.source,\n          // A newer direct or partial observation cannot retain an older paid\n          // fallback authorization. Window readings remain independently merged.\n        }\n      : {}),\n  };\n}\n","import { z } from \"zod\";\n\n/** Claude Code 2.1.285's installed OAuth flow; model calls and profile reads only. */\nexport const CLAUDE_OAUTH_CLIENT_ID = \"9d1c250a-e61b-44d9-88ed-5944d1962f5e\";\nexport const CLAUDE_OAUTH_AUTHORIZE_URL = \"https://claude.com/cai/oauth/authorize\";\nexport const CLAUDE_OAUTH_TOKEN_URL = \"https://platform.claude.com/v1/oauth/token\";\nexport const CLAUDE_OAUTH_REDIRECT_URL = \"https://platform.claude.com/oauth/code/callback\";\nexport const CLAUDE_OAUTH_SCOPES = [\"user:inference\", \"user:profile\"] as const;\n\nexport const ClaudeOAuthTokenResponse = z\n  .object({\n    access_token: z\n      .string()\n      .max(16384)\n      .regex(/^sk-ant-oat[0-9]+-\\S+$/),\n    refresh_token: z.string().min(1).max(16384).optional(),\n    expires_in: z.number().int().positive().max(31536000),\n    scope: z.string().min(1).max(8192),\n  })\n  .passthrough();\n\nexport function claudeAuthorizationUrl(input: { challenge: string; state: string }) {\n  const url = new URL(CLAUDE_OAUTH_AUTHORIZE_URL);\n  url.searchParams.set(\"code\", \"true\");\n  url.searchParams.set(\"client_id\", CLAUDE_OAUTH_CLIENT_ID);\n  url.searchParams.set(\"response_type\", \"code\");\n  url.searchParams.set(\"redirect_uri\", CLAUDE_OAUTH_REDIRECT_URL);\n  url.searchParams.set(\"scope\", CLAUDE_OAUTH_SCOPES.join(\" \"));\n  url.searchParams.set(\"code_challenge\", input.challenge);\n  url.searchParams.set(\"code_challenge_method\", \"S256\");\n  url.searchParams.set(\"state\", input.state);\n  return url.toString();\n}\n","/** Stable account affinity shared by subscription providers. Candidate order is durable creation order. */\nexport function subscriptionAccountShardIndex(sessionId: string, candidateCount: number): number {\n  if (!Number.isSafeInteger(candidateCount) || candidateCount <= 0)\n    throw new Error(\"Subscription shard candidate count must be positive\");\n  let hash = 0x811c9dc5;\n  for (let index = 0; index < sessionId.length; index += 1) {\n    hash ^= sessionId.charCodeAt(index);\n    hash = Math.imul(hash, 0x01000193);\n  }\n  return (hash >>> 0) % candidateCount;\n}\n\n/**\n * Manual pins are binding even when unavailable. Policy homes remain sticky only\n * while rotation is on; an exhausted home re-shards over the eligible survivors.\n * Selection never changes the pool's active pointer.\n */\nexport function selectSubscriptionAccount<T extends { id: string }>(input: {\n  sessionId: string;\n  eligible: readonly T[];\n  rotationEnabled: boolean;\n  activeCredentialId: string | null;\n  pinnedCredentialId: string | null;\n  pinSource: \"manual\" | \"policy\" | null;\n}): T | null {\n  const pinned = input.eligible.find((account) => account.id === input.pinnedCredentialId);\n  if (input.pinnedCredentialId && input.pinSource !== \"policy\") return pinned ?? null;\n  if (!input.rotationEnabled)\n    return input.eligible.find((account) => account.id === input.activeCredentialId) ?? null;\n  return (\n    pinned ??\n    (input.eligible.length\n      ? input.eligible[subscriptionAccountShardIndex(input.sessionId, input.eligible.length)]!\n      : null)\n  );\n}\n","import type { ClaudeSubscriptionUsage, ClaudeUsageWindow } from \"@opengeni/contracts\";\n\nconst UNKNOWN_RESET_RECHECK_MS = 60_000;\nconst allowed = (status: ClaudeUsageWindow[\"status\"]) =>\n  status === \"allowed\" || status === \"allowed_warning\";\n\n/** Evaluate provider-reported plan capacity and its explicitly allowed paid fallback. */\nexport function claudeSubscriptionCapacity(\n  usage: ClaudeSubscriptionUsage,\n  upstreamModelId: string,\n  now: Date,\n  options: { allowOverage?: boolean } = {},\n): { available: boolean; nextCheckAt: Date | null; blockingWindows: ClaudeUsageWindow[\"id\"][] } {\n  const available = { available: true, nextCheckAt: null, blockingWindows: [] };\n  if (!usage.connected || usage.refreshStatus === \"reconnect\")\n    return { ...available, available: false };\n  const relevant = (id: ClaudeUsageWindow[\"id\"]): boolean => {\n    if (id === \"seven_day_opus\") return /^claude-opus-/.test(upstreamModelId);\n    if (id === \"seven_day_sonnet\") return /^claude-sonnet-/.test(upstreamModelId);\n    return id === \"five_hour\" || id === \"seven_day\";\n  };\n  const applicable = usage.windows.filter((window) => relevant(window.id));\n  const relevantClaim = (id: ClaudeUsageWindow[\"id\"] | null) =>\n    id === \"seven_day_opus\" || id === \"seven_day_sonnet\" ? relevant(id) : true;\n  const restrictions = (usage.requestRestrictions ?? []).filter(\n    (item) =>\n      item.status === \"rejected\" &&\n      (item.upstreamModelId === upstreamModelId ||\n        (item.upstreamModelId === null && relevantClaim(item.representativeClaim))) &&\n      !applicable.some(\n        (window) =>\n          window.source === \"provider\" &&\n          window.usedPercent !== null &&\n          window.usedPercent < 100 &&\n          window.id === item.representativeClaim &&\n          window.observedAt > item.observedAt,\n      ) &&\n      (item.resetsAt\n        ? Date.parse(item.resetsAt)\n        : Date.parse(item.observedAt) + UNKNOWN_RESET_RECHECK_MS) > now.getTime(),\n  );\n  const blocking = applicable.filter((window) => {\n    if (\n      (window.resetsAt\n        ? Date.parse(window.resetsAt)\n        : Date.parse(window.observedAt) + UNKNOWN_RESET_RECHECK_MS) <= now.getTime()\n    )\n      return false;\n    return (\n      window.status === \"rejected\" || (window.status === null && (window.usedPercent ?? 0) >= 100)\n    );\n  });\n  const request = usage.requestStatus;\n  const exactModel = request?.upstreamModelId === upstreamModelId;\n  const relevantRequest =\n    request &&\n    (exactModel ||\n      (request.upstreamModelId === null && relevantClaim(request.representativeClaim)));\n  const freshRequest =\n    relevantRequest &&\n    applicable.every((window) => window.observedAt <= request.observedAt) &&\n    restrictions.every((item) => item.observedAt <= request.observedAt);\n  const planResetElapsed =\n    request &&\n    (request.resetsAt\n      ? Date.parse(request.resetsAt)\n      : Date.parse(request.observedAt) + UNKNOWN_RESET_RECHECK_MS) <= now.getTime();\n  const exactAllowance = (usage.requestRestrictions ?? []).find(\n    (item) =>\n      item.upstreamModelId === upstreamModelId &&\n      allowed(item.status) &&\n      blocking.every((window) => window.observedAt < item.observedAt) &&\n      restrictions.every((restriction) => restriction.observedAt < item.observedAt),\n  );\n  if (exactAllowance) return available;\n  // An allowed response for Sonnet never overrides an independently observed\n  // Opus cap. Only the exact model's fresh response proves overall dispatch.\n  if (freshRequest && exactModel && allowed(request.status) && !planResetElapsed) return available;\n  const mayUseOverage = options.allowOverage !== false;\n  const overageResetElapsed =\n    request?.overageResetsAt && Date.parse(request.overageResetsAt) <= now.getTime();\n  if (\n    freshRequest &&\n    request.status === \"rejected\" &&\n    mayUseOverage &&\n    allowed(request.overageStatus) &&\n    !overageResetElapsed\n  )\n    return available;\n  const rejectedRequest = freshRequest && request.status === \"rejected\" && !planResetElapsed;\n  if (blocking.length === 0 && !rejectedRequest && restrictions.length === 0) return available;\n  // An extra-usage balance is a separate fallback. Its rejection does not block\n  // an available base plan or delay the next base-plan reset to a monthly date.\n  const resets = blocking.map((window) =>\n    window.resetsAt\n      ? Date.parse(window.resetsAt)\n      : Date.parse(window.observedAt) + UNKNOWN_RESET_RECHECK_MS,\n  );\n  if (rejectedRequest)\n    resets.push(\n      request.resetsAt\n        ? Date.parse(request.resetsAt)\n        : Date.parse(request.observedAt) + UNKNOWN_RESET_RECHECK_MS,\n    );\n  resets.push(\n    ...restrictions.map((item) =>\n      item.resetsAt\n        ? Date.parse(item.resetsAt)\n        : Date.parse(item.observedAt) + UNKNOWN_RESET_RECHECK_MS,\n    ),\n  );\n  let nextCheckAt = Math.max(...resets);\n  if (\n    rejectedRequest &&\n    mayUseOverage &&\n    request.overageStatus === \"rejected\" &&\n    request.overageResetsAt\n  ) {\n    const overageReset = Date.parse(request.overageResetsAt);\n    // A known reset permits a new authoritative probe, never invents a reading.\n    if (overageReset <= now.getTime()) return available;\n    nextCheckAt = Math.min(nextCheckAt, overageReset);\n  }\n  return {\n    available: false,\n    nextCheckAt: new Date(nextCheckAt),\n    blockingWindows: blocking.map((window) => window.id),\n  };\n}\n"],"mappings":";;;;;;;;;;AACO,SAAS,wBACd,mBACA,OACS;AACT,SACE,sBAAsB,UACrB,OAAO,UAAU,YAChB,kBAAkB,KAAK,CAACA,aAAYA,SAAQ,YAAY,MAAM,MAAM,KAAK,EAAE,YAAY,CAAC;AAE9F;;;ACVA,SAAS,SAAS;AAiBlB,IAAM,6BAA6B,EAChC,OAAO;AAAA,EACN,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAW;AAAA,EAC5D,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO,EAAE,SAAS;AAC3D,CAAC,EACA,OAAO;AAGH,IAAM,+BAA+B;AAE5C,SAAS,UAAU,KAAa,KAAsB;AACpD,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,UAAM,IAAI,MAAM,GAAG,GAAG,qBAAqB;AAAA,EAC7C;AACF;AAEA,SAAS,OAAO,OAA2B;AACzC,SAAO,MAAM,OACV,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,EACtE,KAAK,IAAI;AACd;AAGO,SAAS,8BACd,KACA,MAAM,2BACuB;AAC7B,MAAI,QAAQ,UAAa,IAAI,KAAK,MAAM,GAAI,QAAO;AACnD,QAAM,SAAS,2BAA2B,UAAU,UAAU,KAAK,GAAG,CAAC;AACvE,MAAI,CAAC,OAAO,QAAS,OAAM,IAAI,MAAM,GAAG,GAAG,gBAAgB,OAAO,OAAO,KAAK,CAAC,EAAE;AACjF,SAAO,OAAO;AAChB;AAMO,SAAS,mCACd,KACA,MAAM,iCACgC;AACtC,MAAI,QAAQ,UAAa,IAAI,KAAK,MAAM,GAAI,QAAO,CAAC;AACpD,QAAM,SAAS,EACZ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,GAAG,0BAA0B,EAC7D,UAAU,UAAU,KAAK,GAAG,CAAC;AAChC,MAAI,CAAC,OAAO,QAAS,OAAM,IAAI,MAAM,GAAG,GAAG,gBAAgB,OAAO,OAAO,KAAK,CAAC,EAAE;AACjF,SAAO,OAAO;AAChB;AAGO,SAAS,gCACd,SACA,mBAIA;AACA,QAAM,WAAW,OAAO,QAAQ,eAAe;AAC/C,QAAM,UACH,WAAW,OAAO,OAAU,qBAAqB,QAAQ,aAAa,EAAE,IAAI,SAAU;AACzF,SAAO,EAAE,oBAAoB,OAAO,QAAQ,GAAG,kBAAkB,OAAO,MAAM,EAAE;AAClF;AAGO,SAAS,4BAA4B,WAAiB,eAA6B;AACxF,QAAM,UAAU,KAAK,IAAI,GAAG,cAAc,QAAQ,IAAI,UAAU,QAAQ,CAAC;AACzE,SAAO,KAAK,IAAI,GAAG,KAAK,KAAK,UAAU,GAAM,CAAC;AAChD;;;ACtFA,SAAS,KAAAC,UAAS;AAkBX,IAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIO,IAAM,8BAAmD;AAGzD,IAAM,uBAAuB;AAC7B,IAAM,sBAAsB;AAS5B,IAAM,sBAAsBA,GAAE,KAAK,CAAC,UAAU,UAAU,CAAC;AA4BzD,IAAM,8BAET;AAAA,EACF,UAAU;AAAA,IACR,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA,IAEP,QAAQ;AAAA,MACN,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAClB;AAAA,IACA,OAAO;AAAA,MACL,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,EACd;AAAA,EACA,UAAU;AAAA,IACR,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA,IAEP,QAAQ;AAAA,MACN,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAClB;AAAA,IACA,OAAO,EAAE,iBAAiB,KAAO,aAAa,MAAM,gBAAgB,0BAA0B;AAAA,IAC9F,YAAY;AAAA,EACd;AAAA,EACA,YAAY;AAAA,IACV,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA,IAEP,QAAQ;AAAA,MACN,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAClB;AAAA,IACA,OAAO;AAAA,IACP,YAAY;AAAA,EACd;AAAA,EACA,KAAK;AAAA,IACH,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA,IAEP,QAAQ,EAAE,iBAAiB,KAAO,aAAa,MAAM,gBAAgB,qBAAqB;AAAA,IAC1F,OAAO,EAAE,iBAAiB,KAAO,aAAa,MAAM,gBAAgB,qBAAqB;AAAA,IACzF,YAAY;AAAA,EACd;AAAA,EACA,QAAQ;AAAA,IACN,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA,IAEP,QAAQ,EAAE,iBAAiB,KAAO,aAAa,MAAM,gBAAgB,yBAAyB;AAAA,IAC9F,OAAO,EAAE,iBAAiB,MAAO,aAAa,MAAM,gBAAgB,yBAAyB;AAAA,IAC7F,YAAY;AAAA,EACd;AAAA,EACA,WAAW;AAAA,IACT,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA,IAEP,QAAQ;AAAA,MACN,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAClB;AAAA,IACA,OAAO;AAAA,MACL,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,EACd;AAAA,EACA,OAAO;AAAA,IACL,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA,IAEP,QAAQ;AAAA,MACN,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAClB;AAAA,IACA,OAAO;AAAA,IACP,YAAY;AAAA,EACd;AAAA,EACA,MAAM;AAAA,IACJ,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA;AAAA,IAGP,QAAQ,EAAE,iBAAiB,KAAK,aAAa,MAAM,gBAAgB,oBAAoB;AAAA,IACvF,OAAO,EAAE,iBAAiB,KAAK,aAAa,OAAO,gBAAgB,oBAAoB;AAAA,IACvF,YAAY;AAAA,EACd;AAAA,EACA,SAAS;AAAA,IACP,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA,IAEP,QAAQ,EAAE,iBAAiB,GAAG,aAAa,OAAO,gBAAgB,KAAK;AAAA,IACvE,OAAO;AAAA,IACP,YAAY;AAAA,EACd;AACF;AAEA,SAAS,gBAAgB,IAAiC;AACxD,SAAO,GAAG,YAAY;AACxB;AAGO,SAAS,2BAA2B,IAAiC;AAC1E,SAAO,gBAAgB,gBAAgB,EAAE,CAAC;AAC5C;AAGO,SAAS,4BAA4B,IAAiC;AAC3E,SAAO,gBAAgB,gBAAgB,EAAE,CAAC;AAC5C;AAGO,SAAS,gCAA0C;AACxD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,wBAAwB,QAAQ,CAAC,OAAO;AAAA,MACzC,2BAA2B,EAAE;AAAA,MAC7B,4BAA4B,EAAE;AAAA,IAChC,CAAC;AAAA;AAAA,IAED;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAMO,IAAM,qCAAqCA,GAC/C;AAAA,EACCA,GAAE,OAAO;AAAA,EACTA,GAAE,OAAO,EAAE,QAAQA,GAAE,OAAO,EAAE,SAAS,GAAG,SAASA,GAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO;AACrF,EACC,QAAQ,CAAC,CAAC;AAGN,SAAS,oCACd,QAC8B;AAC9B,QAAM,cAA4C,CAAC;AACnD,aAAW,MAAM,yBAAyB;AACxC,UAAM,SAAS,OAAO,2BAA2B,EAAE,CAAC,GAAG,KAAK;AAC5D,UAAM,UAAU,OAAO,4BAA4B,EAAE,CAAC,GAAG,KAAK;AAC9D,QAAI,UAAU,SAAS;AACrB,kBAAY,EAAE,IAAI,EAAE,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC,GAAI,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC,EAAG;AAAA,IACrF;AAAA,EACF;AACA,SAAO;AACT;AAaA,IAAM,yBAAyBA,GAC5B,OAAO;AAAA,EACN,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,GAAU;AAAA,EAC3D,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,GAAU;AAAA,EAC1D,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO,EAAE,SAAS;AAC3D,CAAC,EACA,OAAO;AAEV,IAAM,qBAAqB;AAGpB,IAAM,uBAAuB;AA+CpC,SAAS,aAAa,OAA0C;AAC9D,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,CAAC,QAAS,QAAO;AAErB,MAAI,gDAAgD,KAAK,OAAO,EAAG,QAAO;AAC1E,SAAO;AACT;AAEA,SAAS,kBAAkB,OAA2B,MAA6B;AACjF,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,OAAO;AAAA,EACvB,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,GAAG,IAAI,oCAAoC,EAAE,OAAO,MAAM,CAAC;AAAA,EAC7E;AACA,MAAI,IAAI,aAAa,YAAY,IAAI,aAAa,SAAS;AACzD,UAAM,IAAI,MAAM,GAAG,IAAI,kCAAkC;AAAA,EAC3D;AACA,MAAI,IAAI,YAAY,IAAI,SAAU,OAAM,IAAI,MAAM,GAAG,IAAI,6BAA6B;AACtF,SAAO,IAAI,SAAS,EAAE,QAAQ,SAAS,EAAE;AAC3C;AAEA,SAAS,aAAa,KAAa,UAAkB,WAA+B;AAClF,QAAM,MAA6B,CAAC;AACpC,aAAW,QAAQ,IAAI,MAAM,GAAG,GAAG;AACjC,UAAM,aAAa,KAAK,KAAK,EAAE,YAAY;AAC3C,QAAI,CAAC,WAAY;AACjB,UAAM,UAAU,wBAAwB;AAAA,MACtC,CAAC,OAAO,4BAA4B,EAAE,EAAE,SAAS;AAAA,IACnD;AACA,QAAI,CAAE,QAA8B,SAAS,UAAU,GAAG;AACxD,YAAM,IAAI;AAAA,QACR,GAAG,QAAQ,8CAA8C,QAAQ,KAAK,IAAI,CAAC;AAAA,MAC7E;AAAA,IACF;AACA,QAAI,CAAC,IAAI,SAAS,UAAiC;AACjD,UAAI,KAAK,UAAiC;AAAA,EAC9C;AACA,MAAI,IAAI,WAAW,EAAG,OAAM,IAAI,MAAM,GAAG,QAAQ,oBAAoB;AACrE,SAAO;AACT;AAEA,SAAS,WAAW,UAAkD;AACpE,QAAM,SAAS,SAAS,iBAAiB,KAAK,EAAE,YAAY;AAC5D,MAAI,QAAQ;AACV,UAAM,SAAS,oBAAoB,UAAU,MAAM;AACnD,QAAI,CAAC,OAAO,QAAS,OAAM,IAAI,MAAM,uDAAuD;AAC5F,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,SAAS,SAAS,uBAAuB,KAAK,EAAE,YAAY;AAClE,MAAI,CAAC,UAAU,WAAW,WAAY,QAAO;AAC7C,MAAI,WAAW,UAAW,QAAO;AACjC,QAAM,IAAI,MAAM,+DAA+D;AACjF;AAEA,SAAS,iBAAiB,KAAsE;AAC9F,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,OAAO;AAAA,EAC7B,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,uDAAuD,EAAE,OAAO,MAAM,CAAC;AAAA,EACzF;AACA,QAAM,WAAW,CAAC,UAChB,gDAAgD,MAAM,OACnD,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,EACtE,KAAK,IAAI,CAAC;AAEf,MAAI,UAAU,OAAO,WAAW,YAAY,kBAAkB,QAAQ;AACpE,UAAM,OAAO,uBAAuB,UAAU,MAAM;AACpD,QAAI,CAAC,KAAK,QAAS,OAAM,IAAI,MAAM,SAAS,KAAK,KAAK,CAAC;AACvD,WAAO,OAAO,YAAY,wBAAwB,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAAA,EAChF;AACA,QAAM,aAAaA,GAChB,OAAOA,GAAE,OAAO,GAAG,sBAAsB,EACzC,YAAY,CAAC,OAAO,YAAY;AAC/B,eAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,UAAI,CAAE,wBAA8C,SAAS,GAAG,GAAG;AACjE,gBAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,CAAC,GAAG,GAAG,SAAS,mBAAmB,CAAC;AAAA,MAC/E;AAAA,IACF;AAAA,EACF,CAAC,EACA,UAAU,MAAM;AACnB,MAAI,CAAC,WAAW,QAAS,OAAM,IAAI,MAAM,SAAS,WAAW,KAAK,CAAC;AACnE,SAAO,WAAW;AACpB;AAUO,SAAS,yBAAyB,UAA0D;AACjG,QAAM,QAAQ,SAAS,mBAAmB,KAAK,KAAK;AACpD,MAAI,CAAC,SAAS,oBAAoB,MAAM,YAAY,MAAM,OAAQ,QAAO,EAAE,QAAQ,MAAM;AACzF,QAAM,cAAc,SAAS,gCAAgC,CAAC;AAC9D,MAAI,UAAU,IAAI;AAEhB,QAAI,CAAC,aAAa,YAAY,2BAA2B,GAAG,MAAM,EAAG,QAAO,EAAE,QAAQ,MAAM;AAAA,EAC9F;AACA,MAAI;AACF,UAAM,YAAY;AAAA,MAChB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AACA,UAAM,WAAW,CACf,IACA,WACA,QACA,iBAC8B;AAC9B,YAAM,MAAM,YAAY,EAAE;AAC1B,YAAM,SACJ,aAAa,KAAK,MAAM,MACvB,SAAS,aAAa,OAAO,MAAM,IAAI,SACxC,cAAc,UACd;AACF,YAAM,UACJ,kBAAkB,KAAK,SAAS,4BAA4B,EAAE,CAAC,MAC9D,SAAS,kBAAkB,OAAO,SAAS,GAAG,OAAO,IAAI,WAAW,IAAI,SACzE,cAAc,WACd;AACF,YAAM,OAAO,4BAA4B,EAAE,EAAE,SAAS;AACtD,UAAI,KAAK,eAAe,CAAC,QAAQ;AAC/B,cAAM,IAAI,MAAM,GAAG,EAAE,IAAI,SAAS,UAAU,2BAA2B,EAAE,CAAC,EAAE;AAAA,MAC9E;AACA,UAAI,CAAC,KAAK,kBAAkB,CAAC,SAAS;AACpC,cAAM,IAAI,MAAM,GAAG,EAAE,IAAI,SAAS,UAAU,4BAA4B,EAAE,CAAC,EAAE;AAAA,MAC/E;AACA,aAAO,EAAE,UAAU,IAAI,QAAQ,QAAQ;AAAA,IACzC;AACA,UAAM,SAAS,UAAU;AAAA,MAAI,CAAC,IAAI,UAChC;AAAA,QACE;AAAA,QACA;AAAA,QACA,UAAU,KAAK,QACX;AAAA,UACE,QAAQ,SAAS;AAAA,UACjB,SAAS,SAAS;AAAA,UAClB,MAAM;AAAA,QACR,IACA;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa,SAAS,kBAAkB,KAAK,KAAK;AACxD,QAAI;AACJ,QAAI,eAAe,IAAI;AAErB,cAAQ,OAAO;AAAA,QAAQ,CAAC,UACtB,4BAA4B,MAAM,QAAQ,EAAE,QAAQ,CAAC,KAAK,IAAI,CAAC;AAAA,MACjE;AAAA,IACF,WAAW,WAAW,YAAY,MAAM,QAAQ;AAC9C,cAAQ,CAAC;AAAA,IACX,OAAO;AACL,cAAQ,aAAa,YAAY,+BAA+B,OAAO,EAAE;AAAA,QAAI,CAAC,IAAI,UAChF;AAAA,UACE;AAAA,UACA;AAAA,UACA,UAAU,IACN;AAAA,YACE,QAAQ,SAAS;AAAA,YACjB,SAAS,SAAS;AAAA,YAClB,MAAM;AAAA,UACR,IACA;AAAA,UACJ,OAAO,KAAK,CAAC,UAAU,MAAM,aAAa,EAAE;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN,YAAY,WAAW,QAAQ;AAAA,QAC/B;AAAA,QACA;AAAA,QACA,kBAAkB,iBAAiB,SAAS,oBAAoB;AAAA,QAChE,GAAI,SAAS,4BAA4B,SACrC,EAAE,yBAAyB,SAAS,wBAAwB,IAC5D,CAAC;AAAA,QACL,WAAW,SAAS,6BAA6B;AAAA,MACnD;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO,EAAE,QAAQ,WAAW,QAAS,MAAgB,QAAQ;AAAA,EAC/D;AACF;AAGO,SAAS,wBACd,UACgC;AAChC,QAAM,aAAa,yBAAyB,QAAQ;AACpD,SAAO,WAAW,WAAW,eAAe,WAAW,SAAS;AAClE;AAUO,SAAS,kBACd,UACA,MAU0E;AAC1E,QAAM,SAAS,wBAAwB,QAAQ;AAC/C,MAAI,CAAC,UAAU,KAAK,uBAAuB;AACzC,WAAO,EAAE,iBAAiB,KAAK,iBAAiB,eAAe,CAAC,EAAE;AAAA,EACpE;AACA,MAAI,OAAO,eAAe,YAAY,KAAK,iBAAiB;AAC1D,WAAO,EAAE,iBAAiB,MAAM,eAAe,CAAC,EAAE;AAAA,EACpD;AACA,QAAM,UACJ,OAAO,MAAM,SAAS,IAAI,CAAC,sBAAsB,mBAAmB,IAAI,CAAC,oBAAoB;AAC/F,QAAM,gBAAgB,KAAK,kBACvB,QAAQ,OAAO,CAAC,SAAS,CAAC,2BAA2B,UAAU,QAAQ,IAAI,CAAC,IAC5E;AACJ,SAAO;AAAA;AAAA;AAAA,IAGL,iBAAiB,KAAK,mBAAmB,CAAC,cAAc,SAAS,oBAAoB;AAAA,IACrF;AAAA,EACF;AACF;AAGO,SAAS,6BACd,UACS;AACT,SAAO,SAAS,gBAAgB,YAAY,SAAS,oBAAoB;AAC3E;AAGO,SAAS,2BACd,UACA,QACA,MACS;AACT,QAAM,YAAY,SAAS,uBAAuB,WAAW;AAC7D,SACE,6BAA6B,QAAQ,KACrC,OAAO,SAAS,EAAE;AAAA,IAChB,CAAC,aAAa,qBAAqB,QAAQ,UAAU,SAAS,EAAE,iBAAiB;AAAA,EACnF;AAEJ;AAGO,SAAS,qBACd,QACA,UACA,WACkE;AAClE,QAAM,WAAW,OAAO,iBAAiB,SAAS,QAAQ;AAC1D,MAAI,UAAU;AACZ,WAAO;AAAA,MACL,gBAAgB,cAAc,WAAW,SAAS,eAAe,SAAS;AAAA,MAC1E,WAAW,OAAO,2BAA2B,SAAS,aAAa;AAAA,MACnE,UAAU;AAAA,IACZ;AAAA,EACF;AACA,QAAM,OAAO,4BAA4B,SAAS,QAAQ,EAAE,SAAS;AAErE,SAAO;AAAA,IACL,gBAAgB,QAAQ,SAAS,SAAS,KAAK,kBAAkB;AAAA,IACjE,WAAW,OAAO,2BAA2B;AAAA,IAC7C,UAAU;AAAA,EACZ;AACF;AAGO,SAAS,sBAAsB,gBAAwB,WAA2B;AACvF,MAAI,CAAC,OAAO,cAAc,cAAc,KAAK,iBAAiB,GAAG;AAC/D,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,SAAO,QAAQ,OAAO,cAAc,IAAI,OAAO,MAAS,SAAS,IAAI,SAAU,MAAO;AACxF;;;AC7lBA,SAAS,8BAA8B;AACvC,SAAS,KAAAC,UAAS;AAElB,IAAM,WAAW,uBAAuB,MAAM,iBAAiB,UAAU,CAAC,QAAQ;AAAA,EAChF,GAAG,IAAI,IAAI,GAAG;AAChB,CAAC;AAGM,IAAM,wBAAwBA,GAClC,OAAO;AAAA,EACN,iBAAiB,SAAS,SAAS;AAAA,EACnC,gBAAgB,SAAS,SAAS;AAAA,EAClC,QAAQA,GACL;AAAA,IACCA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAChBA,GACG,OAAO;AAAA,MACN,OAAO,uBAAuB,MAAM;AAAA,MACpC,kBAAkB,SAAS,SAAS;AAAA,IACtC,CAAC,EACA,OAAO;AAAA,EACZ,EACC,QAAQ,CAAC,CAAC;AACf,CAAC,EACA,OAAO,EACP,YAAY,CAAC,QAAQ,QAAQ;AAC5B,aAAW,CAAC,IAAI,KAAK,KAAK,OAAO,QAAQ,OAAO,MAAM,GAAG;AACvD,QAAI,CAAC,MAAM,oBAAoB,CAAC,OAAO,iBAAiB;AACtD,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,UAAU,EAAE;AAAA,QACnB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAEI,IAAM,2BAA2BA,GAAE;AAAA,EACxC,CAAC,UAAU;AACT,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAI;AACF,aAAO,KAAK,MAAM,KAAK;AAAA,IACzB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,sBAAsB,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;AAC9C;AAEO,SAAS,qBAAqB,UAElC;AACD,SACE,SAAS,sBAAsB,kBAAkB,SAAS,sBAAsB;AAEpF;AAEO,SAAS,uBACd,UACA,UACoC;AACpC,QAAM,SAAS,SAAS;AACxB,QAAM,QAAQ,OAAO,OAAO,QAAQ;AACpC,QAAM,mBAAmB,OAAO,oBAAoB,OAAO;AAC3D,SAAO,mBACH,EAAE,OAAO,OAAO,SAAS,uBAAuB,iBAAiB,IACjE;AACN;;;ACvCA,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,0BAA0B;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAOK;AAEP,SAAS,iDAAiD;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAAC,yCAAwC;AACjD,SAAS,kBAAkB;AAC3B,SAAS,YAAY;AACrB,SAAS,KAAAC,UAAS;;;AC/FlB;AAAA,EACE;AAAA,OAIK;AASP,IAAM,WAAqC;AAAA,EACzC,WAAW,CAAC,IAAI;AAAA,EAChB,WAAW,CAAC,IAAI;AAAA,EAChB,gBAAgB,CAAC,SAAS;AAAA,EAC1B,kBAAkB,CAAC,WAAW;AAAA,EAC9B,4BAA4B,CAAC,SAAS,qBAAqB;AAAA,EAC3D,SAAS,CAAC,SAAS;AACrB;AACA,SAAS,QAAQ,OAAgB,OAA8B;AAC7D,MAAI,OAAO,UAAU,aAAa,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,GAAI,QAAO;AACtF,QAAM,SAAS,OAAO,KAAK,IAAI;AAC/B,SAAO,OAAO,SAAS,MAAM,KAAK,UAAU,IAAI,SAAS;AAC3D;AACA,SAAS,MAAM,OAAqC;AAClD,MAAI,CAAC,SAAS,CAAC,kBAAkB,KAAK,KAAK,EAAG,QAAO;AACrD,QAAM,OAAO,OAAO,KAAK,IAAI;AAC7B,SAAO,OAAO,SAAS,IAAI,KAAK,OAAO,KAAK,OAAO,SAAU,IAAI,KAAK,IAAI,EAAE,YAAY,IAAI;AAC9F;AACA,SAAS,OAAO,OAA6C;AAC3D,SAAO,UAAU,aAAa,UAAU,qBAAqB,UAAU,aAAa,QAAQ;AAC9F;AAEA,SAAS,YAAY,MAAqB,OAAsB,YAA4B;AAC1F,SAAO,IAAI;AAAA,IACT,KAAK;AAAA,MACH,OAAO,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,UAAU,IAAI;AAAA,MACnD,QAAQ,KAAK,MAAM,KAAK,IAAI,KAAK,MAAM,UAAU,IAAI;AAAA,IACvD;AAAA,EACF,EAAE,YAAY;AAChB;AAEA,SAAS,YAAY,MAAwC;AAE3D,SAAO,KAAK,UAAU;AAAA,IACpB,KAAK;AAAA,IACL,KAAK,kBAAkB,OAAO,KAAK;AAAA,IACnC,KAAK,WAAW;AAAA,EAClB,CAAC;AACH;AAEA,SAAS,YACP,MACA,OAC0B;AAC1B,QAAM,SAAS,KAAK,WAAW,aAAa,OAAO,MAAM,WAAW,aAAa,QAAQ;AACzF,SAAO;AAAA,IACL,GAAI,UAAU;AAAA,IACd,UAAU,SACN;AAAA,MACE,KAAK,WAAW,aAAa,KAAK,WAAW,OAAO;AAAA,MACpD,MAAM,WAAW,aAAa,MAAM,WAAW,OAAO;AAAA,MACtD,KAAK;AAAA,IACP,IACA;AAAA,IACJ,qBACE,KAAK,wBAAwB,MAAM,sBAAsB,KAAK,sBAAsB;AAAA,IACtF,QAAQ,SAAS,aAAa;AAAA,IAC9B,eAAe;AAAA,IACf,iBAAiB;AAAA,EACnB;AACF;AAEO,SAAS,wBACd,SACA,MAAM,oBAAI,KAAK,GACf,iBAC+B;AAC/B,QAAM,aAAa,IAAI,YAAY;AACnC,QAAM,QAAQ,oBAAoB;AAAA,IAChC,QAAQ,IAAI,kDAAkD;AAAA,EAChE;AACA,QAAM,gBAAgB,OAAO,QAAQ,IAAI,oCAAoC,CAAC;AAC9E,QAAM,eAAe,MAAM,QAAQ,IAAI,mCAAmC,CAAC;AAC3E,QAAM,gBAAgB,OAAO,QAAQ,IAAI,4CAA4C,CAAC;AACtF,QAAM,kBAAkB,MAAM,QAAQ,IAAI,2CAA2C,CAAC;AACtF,QAAM,UAAU,oBAAoB,QAAQ,QAAQ,CAAC,OAAO;AAC1D,UAAM,SAAS,CAAC,WACd,SAAS,EAAE,EAAG;AAAA,MAAI,CAAC,WACjB,QAAQ,IAAI,+BAA+B,MAAM,IAAI,MAAM,EAAE;AAAA,IAC/D,EAAE,KAAK,CAAC,UAAU,UAAU,IAAI,KAAK;AACvC,UAAM,iBAAiB,MAAM,WAAW,MAAM,SAAS;AACvD,UAAM,cAAc,QAAQ,OAAO,aAAa,GAAG,GAAG;AACtD,UAAM,WAAW,MAAM,OAAO,OAAO,CAAC,MAAM,iBAAiB,eAAe;AAC5E,UAAM,eAAe,OAAO,OAAO,QAAQ,CAAC,MAAM,iBAAiB,gBAAgB;AACnF,QAAI,gBAAgB,QAAQ,aAAa,QAAQ,iBAAiB,KAAM,QAAO,CAAC;AAChF,WAAO,CAAC,EAAE,IAAI,aAAa,UAAU,QAAQ,cAAc,WAAW,CAAC;AAAA,EACzE,CAAC;AACD,SAAO,QAAQ,UAAU,iBAAiB,gBACtC;AAAA,IACE;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,eAAe;AAAA,MACb,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,qBAAqB,MAAM,UAAU,MAAM,OAAO;AAAA,MAClD;AAAA,MACA;AAAA,MACA,iBAAiB,mBAAmB;AAAA,MACpC;AAAA,IACF;AAAA,EACF,IACA;AACN;AAEO,SAAS,yBACd,OACA,MAAM,oBAAI,KAAK,GACgB;AAC/B,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,aAAa,IAAI,YAAY;AACnC,QAAM,UAAU,oBAAoB,QAAQ,QAAQ,CAAC,OAAO;AAC1D,UAAM,SAAU,MAAkC,EAAE;AACpD,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AAC5E,UAAM,SAAS;AACf,UAAM,cAAc,QAAQ,OAAO,aAAa,CAAC;AACjD,UAAM,OAAO,OAAO,OAAO,cAAc,WAAW,KAAK,MAAM,OAAO,SAAS,IAAI;AACnF,UAAM,WAAW,OAAO,SAAS,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,YAAY,IAAI;AACxE,QAAI,gBAAgB,QAAQ,aAAa,KAAM,QAAO,CAAC;AACvD,WAAO,CAAC,EAAE,IAAI,aAAa,UAAU,QAAQ,MAAM,WAAW,CAAC;AAAA,EACjE,CAAC;AACD,SAAO,QAAQ,SAAS,EAAE,SAAS,YAAY,QAAQ,WAAW,IAAI;AACxE;AAEO,SAAS,iBAAiB,mBAA2D;AAC1F,SAAO;AAAA,IACL,WAAW,sBAAsB;AAAA,IACjC;AAAA,IACA,SAAS,CAAC;AAAA,IACV,YAAY;AAAA,IACZ,QAAQ;AAAA,IACR,eAAe;AAAA,IACf,kBAAkB;AAAA,EACpB;AACF;AAGO,SAAS,iBACd,SACA,aACyB;AACzB,QAAM,UAAU,IAAI,IAAI,QAAQ,QAAQ,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;AAC5E,aAAW,kBAAkB,YAAY,SAAS;AAChD,UAAM,SAAS,EAAE,GAAG,gBAAgB,QAAQ,eAAe,UAAU,YAAY,OAAO;AACxF,UAAM,WAAW,QAAQ,IAAI,OAAO,EAAE;AACtC,QAAI,CAAC,YAAY,SAAS,aAAa,OAAO,WAAY,SAAQ,IAAI,OAAO,IAAI,MAAM;AAAA,aAErF,SAAS,eAAe,OAAO,cAC/B,KAAK,UAAU,QAAQ,MAAM,KAAK,UAAU,MAAM,GAClD;AACA,YAAM,WAAW,SAAS,WAAW,cAAc,OAAO,WAAW;AACrE,YAAM,QAAQ,SAAS,eAAe,MAAM,QAAQ,OAAO,eAAe,MAAM;AAChF,cAAQ,IAAI,OAAO,IAAI;AAAA,QACrB,GAAG;AAAA,QACH,aACE,SAAS,gBAAgB,OACrB,OAAO,cACP,OAAO,gBAAgB,OACrB,SAAS,cACT,KAAK,IAAI,SAAS,aAAa,OAAO,WAAW;AAAA,QACzD,QAAQ,WAAW,aAAa,SAAS,WAAW,OAAO,SAAS,SAAS,SAAS;AAAA,QACtF,UACE,YAAY,OACR,YAAY,SAAS,UAAU,OAAO,UAAU,OAAO,UAAU,IACjE,SAAS,aAAa,OAAO,WAC3B,SAAS,WACT;AAAA,QACR,QACE,SAAS,WAAW,sBAAsB,OAAO,WAAW,qBACxD,qBACA;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,WAAW,YAAY;AAC7B,QAAM,eAAe,IAAI;AAAA,KACtB,QAAQ,uBAAuB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,GAAG,IAAI,CAAC;AAAA,EAC7E;AAGA,aAAW,QAAQ;AAAA,IACjB,QAAQ,eAAe,SAAS,QAAQ,gBAAgB;AAAA,IACxD,GAAI,YAAY,uBAAuB,CAAC;AAAA,IACxC,UAAU,SAAS,WAAW;AAAA,EAChC,GAAG;AACD,QAAI,CAAC,KAAM;AACX,UAAM,MAAM,YAAY,IAAI;AAC5B,UAAM,WAAW,aAAa,IAAI,GAAG;AACrC,UAAM,YAAY;AAAA,MAChB,GAAG;AAAA,MACH,eAAe;AAAA,MACf,iBAAiB;AAAA,IACnB;AACA,QAAI,CAAC,YAAY,KAAK,aAAa,SAAS,WAAY,cAAa,IAAI,KAAK,SAAS;AAAA,aAErF,KAAK,eAAe,SAAS,cAC7B,KAAK,UAAU,QAAQ,MAAM,KAAK,UAAU,SAAS;AAErD,mBAAa,IAAI,KAAK,YAAY,UAAU,SAAS,CAAC;AAAA,EAC1D;AAGA,QAAM,gBAAgB;AAAA,IACpB,GAAG,QAAQ,QAAQ;AAAA,MACjB,CAAC,WACC,OAAO,WAAW,cACjB,CAAC,OAAO,UACP,QAAQ,WAAW,cACnB,QAAQ,eAAe,OAAO;AAAA,IACpC;AAAA,IACA,GAAG,YAAY,QAAQ,OAAO,CAAC,YAAY,OAAO,UAAU,YAAY,YAAY,UAAU;AAAA,EAChG;AACA,aAAW,UAAU,eAAe;AAClC,QAAI,OAAO,gBAAgB,QAAQ,OAAO,eAAe,IAAK;AAC9D,UAAM,QAAkC;AAAA,MACtC,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,qBAAqB,OAAO;AAAA,MAC5B,iBAAiB;AAAA,MACjB,eAAe;AAAA,MACf,iBAAiB;AAAA,MACjB,YAAY,OAAO;AAAA,MACnB,QAAQ;AAAA,IACV;AACA,UAAM,MAAM,YAAY,KAAK;AAC7B,QAAI,CAAC,aAAa,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,EAAG,aAAa,MAAM;AACtE,mBAAa,IAAI,KAAK,KAAK;AAAA,EAC/B;AACA,aAAW,CAAC,KAAK,IAAI,KAAK,cAAc;AACtC,QAAI,KAAK,WAAW,WAAY;AAChC,UAAM,QAAQ,CAAC,GAAG,aAAa,OAAO,CAAC,EAAE;AAAA,MACvC,CAAC,cACC,UAAU,WAAW,cACrB,UAAU,wBAAwB,KAAK,uBACvC,UAAU,aAAa,KAAK,cAC5B,UAAU,wBAAwB,aAClC,UAAU,wBAAwB;AAAA,IACtC;AACA,QAAI;AACF,mBAAa,IAAI,KAAK;AAAA,QACpB,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,YAAY,MAAM;AAAA,MACpB,CAAC;AAAA,EACL;AAGA,MAAI,sBAAsB,CAAC,GAAG,aAAa,OAAO,CAAC;AACnD,QAAM,eAAe,oBAAoB;AAAA,IACvC,CAAC,OAAO,SAAU,KAAK,aAAa,QAAQ,KAAK,aAAa;AAAA,IAC9D,YAAY;AAAA,EACd;AACA,QAAM,cAAc,oBAAoB;AAAA,IACtC,CAAC,SACC,KAAK,WAAW,eACf,KAAK,WAAW,KAAK,MAAM,KAAK,QAAQ,IAAI,KAAK,MAAM,KAAK,UAAU,IAAI,OACzE,KAAK,MAAM,YAAY;AAAA,EAC7B;AACA,MAAI,oBAAoB,SAAS,MAAM,YAAY,WAAW,GAAG;AAC/D,0BAAsB,oBACnB,KAAK,CAAC,MAAM,UAAU,MAAM,WAAW,cAAc,KAAK,UAAU,CAAC,EACrE,MAAM,GAAG,EAAE;AAAA,EAChB,WAAW,oBAAoB,SAAS,IAAI;AAC1C,UAAM,aAAa;AACnB,UAAM,WAAW,IAAI;AAAA,MACnB,KAAK;AAAA,QACH,GAAG,YAAY;AAAA,UAAI,CAAC,SAClB,KAAK,WAAW,KAAK,MAAM,KAAK,QAAQ,IAAI,KAAK,MAAM,KAAK,UAAU,IAAI;AAAA,QAC5E;AAAA,QACA,KAAK,MAAM,UAAU,IAAI;AAAA,MAC3B;AAAA,IACF,EAAE,YAAY;AACd,0BAAsB;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR;AAAA,QACA,qBAAqB;AAAA,QACrB,eAAe;AAAA,QACf,iBAAiB;AAAA,QACjB,iBAAiB;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,CAAC,QAAQ,cAAc,QAAQ,aAAa,YAAY;AACvE,QAAM,OAAO,QAAQ,eAAe,YAAY;AAChD,MAAI,gBAAgB,QAAQ,iBAAiB;AAC7C,MAAI,OAAQ,iBAAgB,YAAY;AAAA,WAC/B,QAAQ,KAAK,UAAU,aAAa,MAAM,KAAK,UAAU,YAAY,IAAI,GAAG;AAGnF,oBACE,YAAY,iBAAiB,YAAY,QAAQ,MAAM,YAAY,aAAa,IAC5E,YAAY,eAAe,QAAQ,IACnC;AAAA,EACR;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA,SAAS,oBAAoB,QAAQ;AAAA,MAAQ,CAAC,OAC5C,QAAQ,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAE,IAAI,CAAC;AAAA,IAC1C;AAAA,IACA,GAAI,SACA;AAAA,MACE,YAAY,YAAY;AAAA,MACxB,QAAQ,YAAY;AAAA;AAAA;AAAA,IAGtB,IACA,CAAC;AAAA,EACP;AACF;;;ACvUA,SAAS,KAAAC,UAAS;AAGX,IAAM,yBAAyB;AAC/B,IAAM,6BAA6B;AACnC,IAAM,yBAAyB;AAC/B,IAAM,4BAA4B;AAClC,IAAM,sBAAsB,CAAC,kBAAkB,cAAc;AAE7D,IAAM,2BAA2BA,GACrC,OAAO;AAAA,EACN,cAAcA,GACX,OAAO,EACP,IAAI,KAAK,EACT,MAAM,wBAAwB;AAAA,EACjC,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA,EACrD,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,OAAQ;AAAA,EACpD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AACnC,CAAC,EACA,YAAY;AAER,SAAS,uBAAuB,OAA6C;AAClF,QAAM,MAAM,IAAI,IAAI,0BAA0B;AAC9C,MAAI,aAAa,IAAI,QAAQ,MAAM;AACnC,MAAI,aAAa,IAAI,aAAa,sBAAsB;AACxD,MAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,MAAI,aAAa,IAAI,gBAAgB,yBAAyB;AAC9D,MAAI,aAAa,IAAI,SAAS,oBAAoB,KAAK,GAAG,CAAC;AAC3D,MAAI,aAAa,IAAI,kBAAkB,MAAM,SAAS;AACtD,MAAI,aAAa,IAAI,yBAAyB,MAAM;AACpD,MAAI,aAAa,IAAI,SAAS,MAAM,KAAK;AACzC,SAAO,IAAI,SAAS;AACtB;;;AC/BO,SAAS,8BAA8B,WAAmB,gBAAgC;AAC/F,MAAI,CAAC,OAAO,cAAc,cAAc,KAAK,kBAAkB;AAC7D,UAAM,IAAI,MAAM,qDAAqD;AACvE,MAAI,OAAO;AACX,WAAS,QAAQ,GAAG,QAAQ,UAAU,QAAQ,SAAS,GAAG;AACxD,YAAQ,UAAU,WAAW,KAAK;AAClC,WAAO,KAAK,KAAK,MAAM,QAAU;AAAA,EACnC;AACA,UAAQ,SAAS,KAAK;AACxB;AAOO,SAAS,0BAAoD,OAOvD;AACX,QAAM,SAAS,MAAM,SAAS,KAAK,CAAC,YAAY,QAAQ,OAAO,MAAM,kBAAkB;AACvF,MAAI,MAAM,sBAAsB,MAAM,cAAc,SAAU,QAAO,UAAU;AAC/E,MAAI,CAAC,MAAM;AACT,WAAO,MAAM,SAAS,KAAK,CAAC,YAAY,QAAQ,OAAO,MAAM,kBAAkB,KAAK;AACtF,SACE,WACC,MAAM,SAAS,SACZ,MAAM,SAAS,8BAA8B,MAAM,WAAW,MAAM,SAAS,MAAM,CAAC,IACpF;AAER;;;ACjCA,IAAM,2BAA2B;AACjC,IAAM,UAAU,CAACC,YACfA,YAAW,aAAaA,YAAW;AAG9B,SAAS,2BACd,OACA,iBACA,KACA,UAAsC,CAAC,GACuD;AAC9F,QAAM,YAAY,EAAE,WAAW,MAAM,aAAa,MAAM,iBAAiB,CAAC,EAAE;AAC5E,MAAI,CAAC,MAAM,aAAa,MAAM,kBAAkB;AAC9C,WAAO,EAAE,GAAG,WAAW,WAAW,MAAM;AAC1C,QAAM,WAAW,CAAC,OAAyC;AACzD,QAAI,OAAO,iBAAkB,QAAO,gBAAgB,KAAK,eAAe;AACxE,QAAI,OAAO,mBAAoB,QAAO,kBAAkB,KAAK,eAAe;AAC5E,WAAO,OAAO,eAAe,OAAO;AAAA,EACtC;AACA,QAAM,aAAa,MAAM,QAAQ,OAAO,CAAC,WAAW,SAAS,OAAO,EAAE,CAAC;AACvE,QAAM,gBAAgB,CAAC,OACrB,OAAO,oBAAoB,OAAO,qBAAqB,SAAS,EAAE,IAAI;AACxE,QAAM,gBAAgB,MAAM,uBAAuB,CAAC,GAAG;AAAA,IACrD,CAAC,SACC,KAAK,WAAW,eACf,KAAK,oBAAoB,mBACvB,KAAK,oBAAoB,QAAQ,cAAc,KAAK,mBAAmB,MAC1E,CAAC,WAAW;AAAA,MACV,CAAC,WACC,OAAO,WAAW,cAClB,OAAO,gBAAgB,QACvB,OAAO,cAAc,OACrB,OAAO,OAAO,KAAK,uBACnB,OAAO,aAAa,KAAK;AAAA,IAC7B,MACC,KAAK,WACF,KAAK,MAAM,KAAK,QAAQ,IACxB,KAAK,MAAM,KAAK,UAAU,IAAI,4BAA4B,IAAI,QAAQ;AAAA,EAC9E;AACA,QAAM,WAAW,WAAW,OAAO,CAAC,WAAW;AAC7C,SACG,OAAO,WACJ,KAAK,MAAM,OAAO,QAAQ,IAC1B,KAAK,MAAM,OAAO,UAAU,IAAI,6BAA6B,IAAI,QAAQ;AAE7E,aAAO;AACT,WACE,OAAO,WAAW,cAAe,OAAO,WAAW,SAAS,OAAO,eAAe,MAAM;AAAA,EAE5F,CAAC;AACD,QAAM,UAAU,MAAM;AACtB,QAAM,aAAa,SAAS,oBAAoB;AAChD,QAAM,kBACJ,YACC,cACE,QAAQ,oBAAoB,QAAQ,cAAc,QAAQ,mBAAmB;AAClF,QAAM,eACJ,mBACA,WAAW,MAAM,CAAC,WAAW,OAAO,cAAc,QAAQ,UAAU,KACpE,aAAa,MAAM,CAAC,SAAS,KAAK,cAAc,QAAQ,UAAU;AACpE,QAAM,mBACJ,YACC,QAAQ,WACL,KAAK,MAAM,QAAQ,QAAQ,IAC3B,KAAK,MAAM,QAAQ,UAAU,IAAI,6BAA6B,IAAI,QAAQ;AAChF,QAAM,kBAAkB,MAAM,uBAAuB,CAAC,GAAG;AAAA,IACvD,CAAC,SACC,KAAK,oBAAoB,mBACzB,QAAQ,KAAK,MAAM,KACnB,SAAS,MAAM,CAAC,WAAW,OAAO,aAAa,KAAK,UAAU,KAC9D,aAAa,MAAM,CAAC,gBAAgB,YAAY,aAAa,KAAK,UAAU;AAAA,EAChF;AACA,MAAI,eAAgB,QAAO;AAG3B,MAAI,gBAAgB,cAAc,QAAQ,QAAQ,MAAM,KAAK,CAAC,iBAAkB,QAAO;AACvF,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,sBACJ,SAAS,mBAAmB,KAAK,MAAM,QAAQ,eAAe,KAAK,IAAI,QAAQ;AACjF,MACE,gBACA,QAAQ,WAAW,cACnB,iBACA,QAAQ,QAAQ,aAAa,KAC7B,CAAC;AAED,WAAO;AACT,QAAM,kBAAkB,gBAAgB,QAAQ,WAAW,cAAc,CAAC;AAC1E,MAAI,SAAS,WAAW,KAAK,CAAC,mBAAmB,aAAa,WAAW,EAAG,QAAO;AAGnF,QAAM,SAAS,SAAS;AAAA,IAAI,CAAC,WAC3B,OAAO,WACH,KAAK,MAAM,OAAO,QAAQ,IAC1B,KAAK,MAAM,OAAO,UAAU,IAAI;AAAA,EACtC;AACA,MAAI;AACF,WAAO;AAAA,MACL,QAAQ,WACJ,KAAK,MAAM,QAAQ,QAAQ,IAC3B,KAAK,MAAM,QAAQ,UAAU,IAAI;AAAA,IACvC;AACF,SAAO;AAAA,IACL,GAAG,aAAa;AAAA,MAAI,CAAC,SACnB,KAAK,WACD,KAAK,MAAM,KAAK,QAAQ,IACxB,KAAK,MAAM,KAAK,UAAU,IAAI;AAAA,IACpC;AAAA,EACF;AACA,MAAI,cAAc,KAAK,IAAI,GAAG,MAAM;AACpC,MACE,mBACA,iBACA,QAAQ,kBAAkB,cAC1B,QAAQ,iBACR;AACA,UAAM,eAAe,KAAK,MAAM,QAAQ,eAAe;AAEvD,QAAI,gBAAgB,IAAI,QAAQ,EAAG,QAAO;AAC1C,kBAAc,KAAK,IAAI,aAAa,YAAY;AAAA,EAClD;AACA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,aAAa,IAAI,KAAK,WAAW;AAAA,IACjC,iBAAiB,SAAS,IAAI,CAAC,WAAW,OAAO,EAAE;AAAA,EACrD;AACF;;;AJxBO,IAAM,uCAAuC;AAS7C,IAAM,2CAA2C;AAExD,IAAM,UAAU;AAChB,IAAM,aAAa;AAKZ,IAAM,yCAAyC,KAAK;AACpD,IAAM,8CAA8C;AAGpD,IAAM,yCAAyC;AAC/C,IAAM,kCACX,yCAAyC;AACpC,IAAM,+CAA+C;AACrD,IAAM,2CAA2C;AASjD,IAAM,2CAA2C,KAAK;AACtD,IAAM,2CAA2C;AACxD,IAAM,aAAaC,GAAE,WAAW,CAAC,UAAU;AACzC,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,MAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,IAAI,EAAE,SAAS,UAAU,GAAG;AACxD,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAS,KAAK,MAAM,KAAK,KAAK,EAAE,SAAS,UAAU,GAAG;AACzD,WAAO;AAAA,EACT;AACA,SAAO;AACT,GAAGA,GAAE,QAAQ,CAAC;AAGd,IAAM,gBAAgBA,GACnB,OAAO,EACP,IAAI,EACJ,IAAI,IAAK,EACT,OAAO,CAAC,UAAU,iBAAiB,KAAK,KAAK,GAAG,wBAAwB;AAE3E,IAAM,uBAAuBA,GAAE,WAAW,CAAC,UAAU;AACnD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,SAAS,MAAM,KAAK;AAC1B,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,OAAO,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU;AACtC,UAAM,UAAU,MAAM,KAAK;AAC3B,WAAO,YAAY,KAAK,OAAO,MAAM,OAAO,OAAO;AAAA,EACrD,CAAC;AACH,GAAGA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,IAAI,GAAG,4EAA4E,EAAE,SAAS,CAAC;AAI1I,IAAM,kBAAkBA,GAAE;AAAA,EACxB,CAAC,UAAU;AACT,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,SAAS,MAAM,KAAK;AAC1B,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,OAAO,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,EAAE,YAAY,CAAC;AAAA,EACpE;AAAA,EACAA,GACG;AAAA,IACCA,GACG,OAAO,EACP;AAAA,MACC;AAAA,MACA;AAAA,IACF;AAAA,EACJ,EACC,IAAI,CAAC,EACL,OAAO,CAAC,YAAY,IAAI,IAAI,OAAO,EAAE,SAAS,QAAQ,QAAQ;AAAA,IAC7D,SAAS;AAAA,EACX,CAAC,EACA,SAAS,EACT,SAAS;AACd;AAGA,IAAM,0CAA0CA,GAAE;AAAA,EAChD,CAAC,UAAU;AACT,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,SAAS,MAAM,KAAK;AAC1B,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,MAAM;AAAA,IAC5B,QAAQ;AACN,aAAO;AAAA,IACT;AACA,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO;AAC3E,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC,YAAY,YAAY,GAAG,KAAK,CAAC;AAAA,IACzF;AAAA,EACF;AAAA,EACAA,GACG,OAAOA,GAAE,OAAO,EAAE,KAAK,GAAGA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,OAAO,gBAAgB,CAAC,EACzF,QAAQ,CAAC,CAAC;AACf;AAGO,SAAS,iCACd,UAIA,aACQ;AACR,SACE,SAAS,qCAAqC,YAAY,YAAY,CAAC,KACvE,SAAS;AAEb;AAEA,IAAM,wBAAwBA,GAAE;AAAA,EAC9B,CAAC,UAAU;AACT,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,SAAS,MAAM,KAAK;AAC1B,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,OAAO,WAAW,GAAG,GAAG;AAC1B,UAAI;AACF,eAAO,KAAK,MAAM,MAAM;AAAA,MAC1B,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO,OAAO,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAAA,EACtD;AAAA,EACAA,GACG,MAAM,qBAAqB,EAC3B,YAAY,CAAC,OAAO,YAAY;AAC/B,UAAM,OAAO,oBAAI,IAA+B;AAChD,eAAW,CAAC,OAAO,IAAI,KAAK,MAAM,QAAQ,GAAG;AAC3C,UAAI,KAAK,IAAI,IAAI,GAAG;AAClB,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM,CAAC,KAAK;AAAA,QACd,CAAC;AAAA,MACH;AACA,WAAK,IAAI,IAAI;AAAA,IACf;AAAA,EACF,CAAC,EACA,SAAS;AACd;AAEO,IAAM,6BAAiF;AAAA,EAC5F,MAAM;AAAA,IACJ,KAAK,CAAC;AAAA,IACN,OAAO,CAAC;AAAA,EACV;AAAA,EACA,OAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,OAAO,CAAC,iBAAiB;AAAA,EAC3B;AAAA,EACA,QAAQ;AAAA,IACN,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,OAAO,CAAC;AAAA,EACV;AACF;AAGO,IAAM,+BAA+B;AAIrC,IAAM,6BAA6BA,GACvC;AAAA,EACCA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,MAAM,QAAQ;AAAA,EACzCA,GAAE,OAAO,EAAE,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,MAAM,QAAQ,EAAE,CAAC,EAAE,OAAO;AAChF,EACC,YAAY,CAAC,UAAU,YAAY;AAClC,aAAW,CAAC,cAAc,OAAO,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAC9D,QAAI,iBAAiB,QAAQ,cAAc;AACzC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,cAAc,cAAc;AAAA,QACnC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAGI,IAAM,0BACX;AAEF,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EAC9B,aAAaA,GAAE,OAAO,EAAE,QAAQ,UAAU;AAAA,EAC1C,aAAaA,GAAE,OAAO,EAAE,QAAQ,OAAO;AAAA,EACvC,oBAAoBA,GAAE,OAAO,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA,EAG5C,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,aAAaA,GAAE,OAAO,EAAE,QAAQ,sDAAsD;AAAA;AAAA;AAAA,EAGtF,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI7C,oBAAoBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,EAKjE,4BAA4B,WAAW,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhD,UAAUA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA,EAI/B,aAAaA,GAAE,KAAK,CAAC,SAAS,QAAQ,CAAC,EAAE,QAAQ,OAAO;AAAA;AAAA;AAAA;AAAA,EAIxD,qBAAqBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,cAAc;AAAA,EAC7D,SAASA,GAAE,OAAO,EAAE,QAAQ,uBAAuB;AAAA,EACnD,cAAcA,GAAE,OAAO,EAAE,QAAQ,gBAAgB;AAAA,EACjD,mBAAmBA,GAAE,OAAO,EAAE,QAAQ,SAAS;AAAA,EAC/C,mBAAmBA,GAAE,OAAO,EAAE,QAAQ,kBAAkB;AAAA,EACxD,oBAAoB,WAAW,QAAQ,KAAK;AAAA,EAC5C,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACpC,uBAAuBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,oCAAoCA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxD,oCAAoCA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxD,mCAAmCA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvD,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EAC7E,sCAAsCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA,EACrF,kCAAkCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA,EACjF,2BAA2BA,GAAE,KAAK,CAAC,SAAS,gBAAgB,CAAC,EAAE,QAAQ,OAAO;AAAA,EAC9E,8BAA8BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAK,EAAE,QAAQ,EAAE;AAAA,EACtF,0BAA0BA,GAAE,OAAO,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA,EACzE,6BAA6BA,GAAE,OAAO,OAAO,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAI/E,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,QAAQ,GAAG;AAAA,EACjF,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAK;AAAA,EAC7F,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,IAAI,GAAO,EAAE,QAAQ,GAAM;AAAA,EAC9F,6BAA6B,WAAW,QAAQ,KAAK;AAAA,EACrD,6BAA6B,WAAW,QAAQ,IAAI;AAAA,EACpD,2BAA2BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrD,0BAA0BA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC/C,kCAAkCA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5D,iCAAiCA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EACtD,kBAAkB,WAAW,QAAQ,KAAK;AAAA,EAC1C,0BAA0B,WAAW,QAAQ,IAAI;AAAA,EACjD,sBAAsBA,GACnB,OAAO,EACP,IAAI,GAAG,EACP,MAAM,mBAAmB,EACzB,SAAS;AAAA,EACZ,4BAA4BA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAChE,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAK,EAAE,SAAS;AAAA,EAC3D,2BAA2BA,GACxB,OAAO,EACP,IAAI,EAAE,EACN,MAAM,gBAAgB,EACtB,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,uBAAuB,cAAc,SAAS;AAAA,EAC9C,wBAAwB,cAAc,SAAS;AAAA;AAAA;AAAA;AAAA,EAI/C,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIzC,kBAAkBA,GAAE;AAAA,IAClB,CAAC,UACC,OAAO,UAAU,WACb,MAAM,KAAK,EAAE,YAAY,MAAM,SAC7B,OACA,MAAM,KAAK,IACb;AAAA,IACNA,GACG,IAAI,EAAE,UAAU,aAAa,OAAO,0CAA0C,CAAC,EAC/E,SAAS,EACT,QAAQ,kCAAkC;AAAA,EAC/C;AAAA;AAAA;AAAA,EAGA,iBAAiB,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMzC,qBAAqBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA,EAIrE,sBAAsBA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA,EAG3C,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtC,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,UAAU;AAAA,EACpE,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIjD,sBAAsBA,GACnB,OAAO,EACP,IAAI,EACJ,QAAQ,mDAAmD;AAAA;AAAA;AAAA;AAAA,EAI9D,oBAAoBA,GACjB,OAAO,EACP,MAAM,mDAAmD,EACzD,QAAQ,QAAQ;AAAA;AAAA;AAAA,EAGnB,sBAAsBA,GACnB,OAAO,EACP,MAAM,mDAAmD,EACzD,SAAS;AAAA;AAAA;AAAA,EAGZ,kBAAkBA,GACf,OAAO,EACP,MAAM,mDAAmD,EACzD,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,iBAAiB,WAAW,QAAQ,IAAI;AAAA,EACxC,mBAAmB,kBAAkB,QAAQ,OAAO;AAAA,EACpD,aAAa,YAAY,QAAQ,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3C,mCAAmC,WAAW,QAAQ,KAAK;AAAA,EAC3D,uBAAuB;AAAA,EACvB,kBAAkB,iBAAiB,QAAQ,MAAM;AAAA,EACjD,iBAAiB,gBAAgB,QAAQ,MAAM;AAAA;AAAA;AAAA,EAG/C,wBAAwB,WAAW,QAAQ,KAAK;AAAA,EAChD,wBAAwBA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA,EAC/C,uBAAuBA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA,EAC9C,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,2BAA2B;AAAA,EAC3B,2BAA2B;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3B,8BAA8B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtD,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIvC,sBAAsB,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI9C,sBAAsB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAI7C,2BAA2B,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAIlD,qCAAqC,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA,EAG5D,qCAAqC,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI7D,mBAAmBA,GAChB,OAAO,EACP,MAAM,qEAAqE,EAC3E,SAAS;AAAA,EACZ,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI/C,uBAAuB,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA,EAG/C,mBAAmBA,GAChB,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL,IAAI,IAAK,EACT;AAAA,IACC,CAAC,UAAU,MAAM,WAAW,GAAG,KAAK,gBAAgB,KAAK,KAAK;AAAA,IAC9D;AAAA,EACF,EACC,SAAS;AAAA,EACZ,qBAAqB,WAAW,QAAQ,KAAK;AAAA,EAC7C,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,wCAAwC,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhE,sBAAsB,WAAW,QAAQ,IAAI;AAAA,EAC7C,iCAAiC,WAAW,QAAQ,KAAK;AAAA,EACzD,uCAAuC,WAAW,QAAQ,KAAK;AAAA,EAC/D,8BAA8BA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA,EACrD,qBAAqBA,GAClB,OAAO,EACP,MAAM,mCAAmC,EACzC,SAAS;AAAA,EACZ,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAExC,iBAAiBA,GAAE,KAAK,CAAC,WAAW,MAAM,CAAC,EAAE,QAAQ,SAAS;AAAA,EAC9D,qBAAqB,4BAA4B,QAAQ,UAAU;AAAA,EACnE,cAAcA,GACX,OAAO,EACP,KAAK,EACL,MAAM,uBAAuB,EAC7B,QAAQ,WAAW;AAAA,EACtB,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,yBAAyBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAG;AAAA,EACnF,yBAAyBA,GAAE,OACxB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,GAAa,EACjB,QAAQ,GAAW;AAAA,EACtB,6BAA6BA,GAAE,OAC5B,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,GAAa,EACjB,QAAQ,GAAW;AAAA,EACtB,oCAAoCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAK;AAAA,EAChG,kCAAkCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAK,EAAE,QAAQ,GAAG;AAAA,EAC3F,kCAAkCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACxF,qCAAqCA,GAAE,OACpC,OAAO,EACP,IAAI,EACJ,IAAI,GAAK,EACT,IAAI,4CAA4C,EAChD,QAAQ,GAAM;AAAA,EACjB,kCAAkCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACjF,wCAAwCA,GAAE,OACvC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,GAAM,EACV,QAAQ,GAAG;AAAA,EACd,oCAAoCA,GAAE,OACnC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,wCAAwC,EAC5C,QAAQ,GAAK;AAAA,EAChB,kCAAkCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAO,EAAE,QAAQ,IAAM;AAAA,EAChG,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,mCAAmC,WAAW,SAAS;AAAA,EACvD,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,uBAAuBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAG3C,qBAAqBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,sBAAsB,EAAE,SAAS;AAAA;AAAA;AAAA,EAGhG,wBAAwBA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/C,0BAA0BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtE,mBAAmB,qBAAqB,QAAQ,4BAA4B;AAAA,EAC5E,sBAAsBA,GAAE,OACrB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,QAAQ,gCAAgC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAa3C,8BAA8B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAStD,2BAA2B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUnD,8BAA8B,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrD,2BAA2BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/E,qBAAqBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,KAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzE,8BAA8BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ1E,iCAAiCA,GAAE,OAChC,OAAO,EACP,QAAQ,GAAG,EACX,UAAU,CAAC,UAAU;AACpB,QAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,aAAO;AAAA,IACT;AACA,WAAO,KAAK,IAAI,KAAK,KAAK,IAAI,KAAK,KAAK,CAAC;AAAA,EAC3C,CAAC;AAAA;AAAA;AAAA,EAGH,6BAA6BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,KAAO;AAAA;AAAA;AAAA,EAGlF,mCAAmCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI/E,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EAClF,cAAc,WAAW,QAAQ,KAAK;AAAA,EACtC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,iBAAiB,WAAW,QAAQ,IAAI;AAAA,EACxC,kBAAkB,WAAW,QAAQ,KAAK;AAAA,EAC1C,SAASA,GAAE,OAAO,EAAE,QAAQ,SAAS;AAAA,EACrC,SAASA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA;AAAA;AAAA,EAGxD,gBAAgBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,gBAAgBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAI/D,wBAAwBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAClD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI1C,sBAAsBA,GAAE,OAAO,EAAE,QAAQ,OAAO,+CAA+C;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/F,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,gBAAgBA,GAAE,KAAK,CAAC,UAAU,OAAO,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC5D,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,aAAaA,GAAE,OAAO,EAAE,QAAQ,aAAa;AAAA,EAC7C,qBAAqBA,GAAE,OAAO,EAAE,QAAQ,kCAAkC;AAAA;AAAA;AAAA;AAAA,EAI1E,uBAAuBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3C,sBAAsBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,oBAAoB;AAAA;AAAA,EAEpF,+BAA+BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAK;AAAA,EAC3F,mCAAmCA,GAAE,OAClC,OAAO,EACP,IAAI,EACJ,IAAI,GAAM,EACV,IAAI,KAAK,KAAK,GAAM,EACpB,QAAQ,IAAI,KAAK,GAAM;AAAA,EAC1B,uCAAuCA,GAAE,OACtC,OAAO,EACP,IAAI,EACJ,IAAI,GAAG,EACP,IAAI,IAAI,KAAK,EAAE,EACf,QAAQ,KAAK,EAAE;AAAA,EAClB,0CAA0CA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EAC1F,oCAAoCA,GAAE,OACnC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,OAAO,gBAAgB,EAC3B,QAAQ,KAAK,OAAO,OAAO,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlC,kCAAkCA,GAAE,OACjC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,OAAO,gBAAgB,EAC3B,QAAQ,IAAI,OAAO,OAAO,IAAI;AAAA,EACjC,sCAAsC;AAAA,EACtC,8BAA8BA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK,EAAE,QAAQ,qBAAqB;AAAA,EAC/F,4BAA4BA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK,EAAE,QAAQ,SAAS;AAAA;AAAA;AAAA,EAGjF,0CAA0CA,GAAE,OACzC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,GAAU,EACd,QAAQ,KAAO;AAAA,EAClB,0CAA0CA,GAAE,OACzC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,GAAU,EACd,QAAQ,IAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlB,8BAA8BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACpF,wBAAwBA,GAAE,OACvB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,OAAO,IAAI,EACpB,QAAQ,KAAK,OAAO,IAAI;AAAA;AAAA;AAAA;AAAA,EAI3B,4BAA4B,WAAW,QAAQ,IAAI;AAAA,EACnD,uCAAuCA,GAAE,OACtC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,IAAI,KAAK,EAAE,EACf,QAAQ,IAAI,KAAK,EAAE;AAAA,EACtB,iCAAiCA,GAAE,OAChC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,MAAM,OAAO,IAAI,EACrB,QAAQ,MAAM,OAAO,IAAI;AAAA,EAC5B,sCAAsCA,GAAE,OACrC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,OAAO,IAAI,EACpB,QAAQ,IAAI,OAAO,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1B,uBAAuB,WAAW,QAAQ,IAAI;AAAA;AAAA,EAE9C,wBAAwBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,QAAQ,EAAE;AAAA,EAC3E,qCAAqCA,GAAE,OACpC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,IAAI,KAAK,KAAK,EAAE,EACpB,QAAQ,KAAK,KAAK,EAAE;AAAA,EACvB,sBAAsBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzE,yBAAyBA,GACtB,OAAO,EACP,QAAQ,+DAA+D;AAAA;AAAA;AAAA,EAG1E,yBAAyB,WAAW,QAAQ,IAAI;AAAA,EAChD,wBAAwBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,uBAAuBA,GAAE,OAAO,EAAE,QAAQ,gBAAgB;AAAA;AAAA;AAAA,EAG1D,wBAAwB,WAAW,QAAQ,IAAI;AAAA,EAC/C,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,uBAAuBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,wBAAwBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE5C,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC7C,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,qBAAqBA,GAAE,OAAO,EAAE,QAAQ,YAAY;AAAA,EACpD,gBAAgBA,GAAE,OAAO,EAAE,QAAQ,OAAO;AAAA;AAAA;AAAA,EAG1C,sBAAsBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1C,8BAA8BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAElD,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjD,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,yBAAyBA,GAAE,OAAO,EAAE,QAAQ,YAAY;AAAA,EACxD,0BAA0BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9C,oBAAoBA,GAAE,OAAO,EAAE,QAAQ,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMzD,sBAAsBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjE,6BAA6BA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjD,4BAA4BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKhD,oCAAoC,WAAW,QAAQ,KAAK;AAAA;AAAA,EAE5D,yBAAyBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAM,EAAE,SAAS;AAAA,EAC7E,kBAAkBA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA,EAGzC,oBAAoBA,GAAE,KAAK,CAAC,QAAQ,UAAU,CAAC,EAAE,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA,EAI/D,qBAAqBA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA,EAG5C,gBAAgBA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA,EAGvC,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAGtC,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjC,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIvC,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,8BAA8BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClD,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO7C,oBAAoBA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAI3C,0BAA0B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAGlD,kCAAkC,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAIzD,sBAAsB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAG7C,sBAAsB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7C,8BAA8B,WAAW,QAAQ,KAAK;AAAA;AAAA,EACtD,2BAA2B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAGnD,sCAAsCA,GAAE,OACrC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,KAAK,GAAM,EACpB,QAAQ,mCAAmC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS9C,0BAA0BA,GAAE,OACzB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,KAAK,GAAM,EACpB,QAAQ,oCAAoC;AAAA;AAAA;AAAA;AAAA,EAI/C,8BAA8BA,GAAE,OAC7B,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,KAAK,GAAM,EACpB,QAAQ,wCAAwC;AAAA;AAAA;AAAA;AAAA,EAInD,2BAA2B,WAAW,QAAQ,KAAK;AAAA;AAAA,EACnD,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUrC,wBAAwB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/C,gCAAgC,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMvD,iCAAiC,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxD,uBAAuB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA,EAG9C,uBAAuBA,GAAE,KAAK,CAAC,OAAO,UAAU,YAAY,CAAC,EAAE,SAAS;AAAA,EACxE,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIhD,+BAA+B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMvD,+BAA+B,WAAW,QAAQ,IAAI;AAAA;AAAA,EAEtD,0CAA0C,WAAW,QAAQ,KAAK;AAAA,EAClE,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,GAAK,EAAE,QAAQ,GAAG;AAAA;AAAA;AAAA;AAAA,EAIvF,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EAClF,sCAAsC,WAAW,QAAQ,KAAK;AAAA,EAC9D,uBAAuB,gBAAgB,QAAQ,KAAK;AAAA,EACpD,+BAA+BA,GAAE,OAAO,EAAE,QAAQ,2BAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO7E,qBAAqBA,GAClB,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL,IAAI,GAAG,EACP,OAAO,CAAC,UAAU,CAAC,mBAAmB,KAAK,KAAK,GAAG;AAAA,IAClD,SAAS;AAAA,EACX,CAAC,EACA,QAAQ,YAAY;AAAA;AAAA;AAAA,EAGvB,+BAA+B,gBAAgB,QAAQ,OAAO;AAAA,EAC9D,0BAA0BA,GAAE,KAAK,CAAC,QAAQ,WAAW,CAAC,EAAE,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAStE,uBAAuBA,GAAE,KAAK,CAAC,SAAS,UAAU,CAAC,EAAE,QAAQ,OAAO;AAAA;AAAA;AAAA;AAAA,EAIpE,iCAAiC,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAIxD,kBAAkBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjE,kBAAkB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAIzC,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,8BAA8B;AAAA;AAAA,EAE9B,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACpC,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,uBAAuBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,sBAAsBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1C,2BAA2BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAO,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA,EAIzF,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,yBAAyB;AAAA,EAC9D,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,YAAY;AAAA,EAChE,qBAAqBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAO,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMnF,gBAAgBA,GAAE,KAAK,CAAC,OAAO,UAAU,cAAc,YAAY,CAAC,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQnF,2BAA2BA,GAAE,OAAO,EAAE,QAAQ,0BAA0B;AAAA,EACxE,6BAA6BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAGjD,sCAAsC,WAAW,QAAQ,IAAI;AAAA;AAAA,EAC7D,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxC,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,uBAAuBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,uBAAuBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxC,sBAAsB,WAAW,QAAQ,KAAK;AAAA,EAC9C,gBAAgB,eAAe,QAAQ,QAAQ;AAAA,EAC/C,aAAaA,GAAE,OAAO,EAAE,QAAQ,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOxD,+BAA+B,WAAW,QAAQ,KAAK;AAAA,EACvD,oBAAoBA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EACzC,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKnC,wBAAwBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,cAAcA,GAAE,OAAO,EAAE,QAAQ,kBAAkB;AAAA,EACnD,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAGnC,gCAAgC,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMxD,cAAcA,GACX,OAAO,EAKP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,mBAAmB,EACzB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASZ,0BAA0BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9C,qBAAqBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAM,EAAE,QAAQ,KAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMlF,iBAAiBA,GAAE,OAAO,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,uBAAuBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMnE,cAAc;AAAA,EACd,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBtC,yBAAyBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASrE,2BAA2BA,GACxB,KAAK,CAAC,OAAO,uBAAuB,oBAAoB,CAAC,EACzD,QAAQ,oBAAoB;AAAA;AAAA;AAAA,EAG/B,uBAAuB,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/C,2BAA2B,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOlD,wBAAwB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAI/C,uBAAuBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACtE,wBAAwBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA;AAAA;AAAA;AAAA,EAItE,kBAAkB,WAAW,QAAQ,IAAI;AAAA,EACzC,uBAAuBA,GAAE,KAAK,CAAC,YAAY,UAAU,CAAC,EAAE,QAAQ,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO1E,yBAAyB,WAAW,QAAQ,IAAI;AAAA,EAChD,oBAAoBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EACjE,qBAAqBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EACnE,mBAAmBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,SAAW;AAAA;AAAA;AAAA,EAEzE,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzC,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,yBAAyBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA,EACxE,uBAAuBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE7E,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC1C,sBAAsBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1C,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxC,eAAe,WAAW,QAAQ,IAAI;AAAA,EACtC,yBAAyBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIrE,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAG/B,WAAWA,GACR,OAAO,EACP,MAAM,4DAA4D;AAAA,IACjE,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AAAA,EACZ,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAGrC,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzC,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,mBAAmBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,kBAAkBA,GAAE,KAAK,CAAC,SAAS,MAAM,CAAC,EAAE,SAAS;AAAA,EACrD,wBAAwB,WAAW,SAAS;AAAA,EAC5C,eAAe,WAAW,SAAS;AAAA,EACnC,yBAAyBA,GAAE,KAAK,CAAC,OAAO,UAAU,CAAC,EAAE,SAAS;AAAA;AAAA,EAE9D,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,yBAAyB,WAAW,SAAS;AAAA;AAAA,EAC7C,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5E,gBAAgBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,uCAAuC,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI/D,mBAAmBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACxD,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACnD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC1C,6BAA6BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAM,EAAE,QAAQ,IAAK;AAAA,EACzF,sBAAsB,WAAW,QAAQ,KAAK;AAAA;AAAA,EAE9C,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEnC,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC9C,mBAAmBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAG9C,kBAAkBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI7C,uBAAuBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,KAAM,EAAE,QAAQ,IAAK;AAAA,EAChF,2BAA2B,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA,EAGlD,4BAA4B,WAAW,QAAQ,KAAK;AAAA,EACpD,qCAAqCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,IAAK,EAAE,QAAQ,GAAG;AAAA,EAC3F,kCAAkCA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI5D,kCAAkC,WAAW,SAAS;AAAA,EACtD,oBAAoBA,GACjB,OAAO,EACP,MAAM,8CAA8C,EACpD,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,yCAAyCA,GACtC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,EAAE,EACN,MAAM,mCAAmC,EACzC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMZ,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzC,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAGpD,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACnD,qBAAqBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAC1D,cAAcA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EAC9D,kBAAkBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,MAAO,EAAE,QAAQ,IAAI;AAAA;AAAA,EAE5E,yBAAyBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,MAAO,EAAE,SAAS;AAAA,EAChF,yBAAyBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,IAAM,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9E,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAG1C,4BAA4BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,IAAI,GAAO,EAAE,QAAQ,IAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAU3F,yBAAyB,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASjD,sCAAsC,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAa9D,6BAA6B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQrD,0BAA0B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQlD,sBAAsB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM7C,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7C,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQxC,4BAA4BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAGhD,sBAAsBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiB1C,kCAAkCA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtD,kCAAkCA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAItD,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,+BAA+BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKnD,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,+BAA+BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUnD,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC/E,mCAAmCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQpF,4BAA4BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EAC7E,0BAA0BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA,EAI3E,+BAA+BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWjF,oBAAoBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBrE,iCAAiCA,GAAE,OAChC,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,SAAS,EACT,UAAU,CAAC,UAAW,UAAU,IAAI,SAAY,KAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUzD,2BAA2BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMzE,0BAA0BA,GAAE,OACzB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,+BAA+B,EACnC,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjB,+BAA+BA,GAAE,OAC9B,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,+BAA+B,EACnC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASZ,uBAAuBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM3E,0BAA0BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA,EAIhF,mBAAmBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EACpE,0BAA0BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAO;AAAA;AAAA;AAAA;AAAA,EAI5E,yBAAyBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS3E,+BAA+BA,GAAE,OAC9B,OAAO;AAAA,IACN,SAAS;AAAA,EACX,CAAC,EACA,IAAI,4EAA4E,EAChF,SAAS,4EAA4E,EACrF,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA,EAKjB,mBAAmBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMrE,oCAAoCA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA,EAC3D,wBAAwBA,GAAE,KAAK,CAAC,cAAc,UAAU,SAAS,CAAC,EAAE,QAAQ,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxF,mCAAmCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAClF,4BAA4BA,GAAE,OAAO,EAAE,QAAQ,MAAM;AAAA,EACrD,qBAAqBA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA,EAG1C,uBAAuBA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC5C,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjD,+BAA+BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzD,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACxD,sBAAsBA,GACnB,KAAK,CAAC,iBAAiB,UAAU,cAAc,KAAK,CAAC,EACrD,QAAQ,eAAe;AAAA,EAC1B,qBAAqBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,gBAAgB;AAAA,EAC/D,qBAAqBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,WAAW;AAAA,EAC1D,yBAAyBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,OAAO;AAAA,EAC1D,0BAA0BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9C,8BAA8BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClD,6BAA6B,WAAW,QAAQ,IAAI;AAAA,EACpD,oCAAoCA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxD,+BAA+BA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnD,8BAA8BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClD,4BAA4BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtD,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,iCAAiCA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrD,6BAA6BA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjD,6BAA6BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,WAAW;AAAA,EACrD,mBAAmBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAClE,sBAAsBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,GAAG;AAAA,EACvE,2BAA2BA,GAAE,KAAK,CAAC,UAAU,eAAe,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC/E,wBAAwBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,wBAAwB;AAAA,EAC1E,6BAA6BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC5E,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,0BAA0BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpD,8BAA8BA,GAAE,KAAK,CAAC,cAAc,UAAU,SAAS,CAAC,EAAE,QAAQ,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM9F,+BAA+B,WAAW,QAAQ,KAAK;AAAA,EACvD,4BAA4BA,GACzB,OAAO,EACP,IAAI,EACJ,OAAO,CAAC,UAAU;AACjB,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,IAAI,aAAa,OAAO,IAAI,UAAU,IAAI,QAAQ,IAAI,YAAY,IAAI;AACxE,aAAO;AACT,QAAI,IAAI,aAAa,SAAU,QAAO;AACtC,WAAO,IAAI,aAAa,WAAW,CAAC,aAAa,aAAa,OAAO,EAAE,SAAS,IAAI,QAAQ;AAAA,EAC9F,GAAG,iDAAiD,EACnD,SAAS;AAAA;AAAA,EAEZ,0BAA0BA,GAAE,OACzB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,QAAQ,IAAI,OAAO,OAAO,IAAI;AAAA;AAAA;AAAA,EAGjC,8BAA8BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1E,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7E,qCAAqCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EAClF,mCAAmCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EACjF,wBAAwBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAK,EAAE,QAAQ,GAAK;AAAA,EAC/E,0BAA0BA,GAAE,OACzB,OAAO,EACP,IAAI,EACJ,IAAI,IAAI,EACR,IAAI,IAAI,OAAO,IAAI,EACnB,QAAQ,OAAO,IAAI;AAAA,EACtB,mBAAmBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,IAAI,GAAM,EAAE,QAAQ,IAAM;AAAA;AAAA;AAAA,EAGhF,4BAA4BA,GAAE,OAC3B,OAAO,EACP,IAAI,EACJ,SAAS,EACT,QAAQ,MAAM,OAAO,IAAI;AAAA,EAC5B,wBAAwBA,GAAE,OACvB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,QAAQ,MAAM,IAAI;AAAA,EACrB,+BAA+BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EAC5E,0BAA0BA,GAAE,OACzB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,QAAQ,OAAO,OAAO,IAAI;AAAA,EAC7B,sBAAsBA,GAAE,OACrB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,QAAQ,KAAK,OAAO,IAAI;AAAA,EAC3B,wBAAwBA,GAAE,OACvB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,QAAQ,OAAO,OAAO,IAAI;AAAA,EAC7B,+BAA+BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EAC7E,6BAA6BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EAC3E,8BAA8BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EAC5E,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAK;AAAA;AAAA,EAEhF,mCAAmCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAK;AAAA;AAAA,EAEnF,wCAAwCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EACzF,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA;AAAA,EAInF,aAAaA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxD,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA,EAEhD,4BAA4BA,GAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACxD,oBAAoB,WAAW,QAAQ,IAAI;AAAA,EAC3C,0BAA0B,WAAW,QAAQ,IAAI;AAAA;AAAA,EAEjD,gBAAgB,WAAW,QAAQ,KAAK;AAAA,EACxC,mBAAmB,WAAW,QAAQ,KAAK;AAAA;AAAA,EAE3C,iBAAiBA,GAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA;AAAA,EAE7C,2BAA2B,WAAW,QAAQ,KAAK;AAAA;AAAA,EAEnD,sCAAsCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EACpF,+BAA+BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA,EAG/E,wCAAwCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACvF,qCAAqCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACpF,+BAA+BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC9E,qCAAqCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACpF,sCAAsCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACrF,qCAAqCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKpF,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAChF,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA;AAAA,EAGhF,yCAAyCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACxF,sCAAsCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACrF,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC/E,sCAAsCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIrF,oCAAoCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,QAAQ,IAAO;AAAA;AAAA,EAEtF,6BAA6BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAK,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,EAKjF,0BAA0BA,GAAE,KAAK,CAAC,cAAc,UAAU,SAAS,CAAC,EAAE,QAAQ,YAAY;AAAA;AAAA,EAE1F,6BAA6B,WAAW,QAAQ,IAAI;AAAA,EACpD,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,GAAS;AAAA,EACvF,mCAAmCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,GAAU;AAAA,EAC3F,sCAAsCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,GAAO;AAAA,EAC3F,oCAAoCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,GAAa;AAAA;AAAA;AAAA;AAAA,EAI/F,4CAA4CA,GAAE,OAC3C,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,QAAQ,GAAO;AAAA,EAClB,+CAA+CA,GAAE,OAC9C,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,QAAQ,GAAK;AAAA,EAChB,kDAAkDA,GAAE,OACjD,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,QAAQ,GAAS;AAAA,EACpB,oCAAoCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA,EAGzF,8BAA8BA,GAAE,OAAO,OAAO,EAAE,YAAY,EAAE,IAAI,GAAW,EAAE,QAAQ,GAAK;AAAA,EAC5F,2BAA2BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EAC7E,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;AAAA,EAC7E,+BAA+BA,GAAE,OAC9B,OAAO,EACP,IAAI,EACJ,IAAI,EAAE,EACN,QAAQ,KAAK,KAAK,EAAE;AAAA,EACvB,mCAAmCA,GAAE,OAClC,OAAO,EACP,IAAI,EACJ,IAAI,EAAE,EACN,IAAI,KAAK,KAAK,KAAK,EAAE,EACrB,QAAQ,IAAI,KAAK,KAAK,EAAE;AAAA;AAAA,EAE3B,uBAAuBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE;AAAA;AAAA,EAEjE,yBAAyBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACpD,0BAA0BA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrD,8BAA8BA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzD,uBAAuBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAElD,wBAAwBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,KAAM,EAAE,QAAQ,GAAG;AAAA;AAAA,EAE/E,oBAAoBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAG/C,qCAAqCA,GAAE,IAAI,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAG/D,4CAA4CA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC3F,0BAA0BA,GAAE,KAAK,CAAC,UAAU,aAAa,MAAM,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAClF,uBAAuBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,aAAa;AAAA,EAC9D,wBAAwBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,yBAAyBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnD,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACpC,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,0BAA0BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9C,8BAA8BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClD,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACpC,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAExC,sBAAsB,WAAW,QAAQ,KAAK;AAAA,EAC9C,4BAA4B,WAAW,QAAQ,KAAK;AAAA,EACpD,6BAA6BA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjD,iCAAiCA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrD,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,wBAAwBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,4BAA4BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChD,uBAAuBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,6BAA6BA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjD,6BAA6BA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjD,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,wBAAwBA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC7C,wBAAwBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,0BAA0BA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC/C,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,+BAA+BA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnD,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,+BAA+BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAGnD,mBAAmBA,GAChB,MAAMA,GAAE,MAAM,EAAE,UAAU,CAAC,UAAU,MAAM,YAAY,CAAC,CAAC,EACzD,IAAI,CAAC,EACL,SAAS;AAAA,EACZ,2BAA2BA,GAAE,KAAK,CAAC,UAAU,QAAQ,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA,EAIhF,kBAAkBA,GACf,MAAMA,GAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC,EACnD,IAAI,CAAC,EACL,QAAQ,CAAC,UAAU,CAAC;AAAA;AAAA;AAAA;AAAA,EAIvB,cAAcA,GACX,MAAMA,GAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC,EAClD,IAAI,CAAC,EACL,QAAQ,CAAC,iBAAiB,CAAC;AAAA,EAC9B,WAAWA,GACR,OAAO,EACP,MAAM,iBAAiB,EACvB,SAAS;AAAA,EACZ,YAAYA,GACT,OAAO,EACP,MAAM,iBAAiB,EACvB,SAAS;AAAA;AAAA,EAEZ,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAE3C,uBAAuBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMlD,8BAA8B,WAAW,QAAQ,IAAI;AAAA;AAAA,EAErD,qCAAqC,WAAW,SAAS;AAAA;AAAA;AAAA;AAAA,EAIzD,0CAA0CA,GAAE,KAAK,CAAC,YAAY,OAAO,CAAC,EAAE,QAAQ,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1F,qDAAqD,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7E,sBAAsBA,GAAE,KAAK,CAAC,UAAU,UAAU,CAAC,EAAE,QAAQ,QAAQ;AAAA,EACrE,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAWA,GAAE,OAAO,EAAE,QAAQ,kCAAkC;AAAA,EAChE,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,sBAAsBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1C,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,wBAAwBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE5C,0BAA0B,WAAW,QAAQ,KAAK;AAAA,EAClD,YAAYA,GACT;AAAA,IACCA,GAAE,OAAO;AAAA,MACP,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,UAAU;AAAA,MACtC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACjC,KAAKA,GAAE,OAAO,EAAE,IAAI;AAAA,MACpB,cAAcA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,MAClD,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMhD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,MACrD,gBAAgBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,MAEzC,iBAAiB,yBAAyB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOnD,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACnD,eAAe,6BAA6B,SAAS;AAAA,MACrD,mBAAmB,2BAA2B,SAAS;AAAA,IACzD,CAAC;AAAA,EACH,EACC,QAAQ,CAAC,CAAC;AACf,CAAC;AAMD,IAAM,gCAAgC,eAAe,KAAK;AAAA,EACxD,aAAa;AAAA,EACb,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,UAAU;AAAA,EACV,aAAa;AAAA,EACb,4BAA4B;AAAA,EAC5B,6BAA6B;AAAA,EAC7B,6BAA6B;AAAA,EAC7B,2BAA2B;AAAA,EAC3B,0BAA0B;AAC5B,CAAC;AACD,IAAM,+BAA+B,8BAA8B,OAAO;AAAA,EACxE,SAAS,eAAe,MAAM;AAAA,EAC9B,2BAA2B,eAAe,MAAM;AAAA,EAChD,+BAA+B,eAAe,MAAM;AACtD,CAAC;AACD,IAAM,8BAA8B,eAAe,KAAK;AAAA,EACtD,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,+BAA+B;AAAA,EAC/B,8BAA8B;AAAA,EAC9B,qBAAqB;AAAA,EACrB,qBAAqB;AAAA,EACrB,0BAA0B;AAAA,EAC1B,8BAA8B;AAAA,EAC9B,6BAA6B;AAAA,EAC7B,oCAAoC;AAAA,EACpC,+BAA+B;AAAA,EAC/B,8BAA8B;AAAA,EAC9B,4BAA4B;AAAA,EAC5B,2BAA2B;AAAA,EAC3B,iCAAiC;AAAA,EACjC,6BAA6B;AAAA,EAC7B,6BAA6B;AAC/B,CAAC;AACD,IAAM,qCAAqC,8BAA8B;AAAA,EACvE,4BAA4B;AAC9B;AAKA,SAAS,2BAA2B,QAA2B;AAC7D,QAAM,WAAW,CAAC,SAAiB,yBAAyB,MAAM,MAAM;AACxE,SAAO;AAAA,IACL,aAAa,SAAS,uBAAuB;AAAA,IAC7C,aAAa,SAAS,sBAAsB;AAAA,IAC5C,oBACE,SAAS,8BAA8B,KACvC,SAAS,gBAAgB,KACzB,SAAS,YAAY;AAAA,IACvB,UAAU,SAAS,oBAAoB;AAAA,IACvC,aAAa,SAAS,uBAAuB;AAAA,IAC7C,4BAA4B,SAAS,uCAAuC;AAAA,IAC5E,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,2BACE,SAAS,sCAAsC,KAAK,SAAS,6BAA6B;AAAA,IAC5F,0BACE,SAAS,qCAAqC,KAAK,SAAS,4BAA4B;AAAA,EAC5F;AACF;AAEO,SAAS,0BACd,SAA4B,QAAQ,KACZ;AACxB,QAAM,WAAW,6BAA6B,MAAM;AAAA,IAClD,GAAG,2BAA2B,MAAM;AAAA,IACpC,SAAS,yBAAyB,qBAAqB,MAAM;AAAA,IAC7D,2BAA2B;AAAA,MACzB;AAAA,MACA;AAAA,IACF;AAAA,IACA,+BAA+B;AAAA,MAC7B;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACD,eAAa,QAAQ;AACrB,MACE,QAAQ,SAAS,yBAAyB,MAAM,QAAQ,SAAS,6BAA6B,GAC9F;AACA,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,SAAO;AACT;AAEO,SAAS,gCACd,SAA4B,QAAQ,KACN;AAC9B,QAAM,WAAW,CAAC,SAAiB,yBAAyB,MAAM,MAAM;AACxE,QAAM,WAAW,mCAAmC,MAAM;AAAA,IACxD,GAAG,2BAA2B,MAAM;AAAA,IACpC,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,oCAAoC,SAAS,iDAAiD;AAAA,IAC9F,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,iCAAiC,SAAS,8CAA8C;AAAA,IACxF,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,6BAA6B,SAAS,0CAA0C;AAAA,EAClF,CAAC;AACD,eAAa,QAAQ;AACrB,gCAA8B,QAAQ;AACtC,SAAO;AACT;AAeO,SAAS,gCAAgC,UAAoB;AAClE,SAAO,0BAA0B,MAAM;AAAA,IACrC,UAAU,SAAS;AAAA,IACnB,UAAU,SAAS;AAAA,IACnB,cAAc,SAAS;AAAA,IACvB,qBAAqB,SAAS;AAAA,IAC9B,mBAAmB,SAAS;AAAA,IAC5B,mBAAmB,SAAS;AAAA,EAC9B,CAAC;AACH;AAIO,SAAS,gCACd,UACiC;AACjC,SAAO;AAAA,IACL,kBAAkB,SAAS;AAAA,IAC3B,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,IACzB,YAAY,SAAS;AAAA,IACrB,UAAU,SAAS;AAAA,EACrB;AACF;AAIO,SAAS,sBAAsB,eAAkD;AACtF,MAAI,CAAC,cAAe,QAAO;AAC3B,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,aAAa;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MACE,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,OAAO,QAAQ,KAC7C,OAAO,YACP,OAAO,YACP,OAAO,UACP,OAAO,QACN,OAAO,aAAa,MAAM,OAAO,aAAa,KAC/C;AACA,WAAO;AAAA,EACT;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,4BAA4B,eAAkD;AAC5F,QAAM,SAAS,sBAAsB,aAAa;AAClD,SAAO,SAAS,GAAG,MAAM,2CAA2C;AACtE;AAGO,SAAS,+BAA+B,eAAkD;AAC/F,QAAM,SAAS,sBAAsB,aAAa;AAClD,SAAO,SAAS,GAAG,MAAM,oDAAoD;AAC/E;AAqDA,SAAS,uBAAuB,OAAsD;AACpF,SAAO,yBAAyB,KAAK,IAAI,QAAQ;AACnD;AAGO,SAAS,gBAAgB,UAA2D;AACzF,SAAO,uBAAuB,SAAS,SAAS;AAClD;AAOO,SAAS,2BACd,UAEA,wBAAwB,OAGZ;AACZ,QAAM,WACJ,SAAS,0BAA0B,UACnC,SAAS,oBAAoB,UAC7B,SAAS,wBAAwB,UACjC,SAAS,yBAAyB;AACpC,MAAI,UAAU;AACZ,UAAMC,UAAS,uBAAuB,SAAS,mBAAmB;AAClE,QAAI,CAAC,SAAS,yBAAyB,CAAC,SAAS,mBAAmB,CAACA,QAAQ,QAAO;AACpF,WAAO;AAAA,MACL,UAAU,SAAS;AAAA,MACnB,OAAO,SAAS;AAAA,MAChB,QAAAA;AAAA,MACA,GAAI,SAAS,uBAAuB,EAAE,SAAS,SAAS,qBAAqB,IAAI,CAAC;AAAA,IACpF;AAAA,EACF;AACA,QAAM,SAAS,wBAAwB,gBAAgB,QAAQ,IAAI;AACnE,SAAO,SACH;AAAA,IACE,UAAU;AAAA,IACV,OAAO,SAAS,YAAY;AAAA,IAC5B;AAAA,IACA,GAAI,SAAS,aAAa,EAAE,SAAS,SAAS,WAAW,IAAI,CAAC;AAAA,EAChE,IACA;AACN;AAGO,SAAS,4BACd,UAC6B;AAC7B,SAAO;AAAA,IACL,+BAA+B,QAAQ,EAAE;AAAA,IACzC,SAAS,mBAAmB,CAAC,IAAI,EAAE,WAAW,0CAA0C;AAAA,EAC1F;AACF;AAQO,SAAS,2BACd,UAC4B;AAC5B,QAAM,YACJ,SAAS,mBAAmB,SAAS,2BAA2B,UAAU,IAAI,MAAM;AACtF,MAAI,CAAC,UAAW,QAAO,EAAE,WAAW,OAAO,kBAAkB,MAAM;AACnE,QAAM,mBACJ,SAAS,mBAAmB,eACxB,OACA,SAAS,mBAAmB,eAC1B,UACA;AACR,SAAO,EAAE,WAAW,iBAAiB;AACvC;AAMO,SAAS,yBAAyB,OAAmD;AAC1F,MAAI,SAAS,KAAM,QAAO;AAC1B,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,aAAa,QAAQ,YAAY;AACvC,MACE,eAAe,cACf,eAAe,cACf,eAAe,cACf,eAAe,gBACf,eAAe,SACf,WAAW,WAAW,OAAO,KAC7B,WAAW,WAAW,OAAO,GAC7B;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOO,SAAS,kCAAkC,UAAgD;AAChG,SAAO,qCAAqC,QAAQ,EAAE;AACxD;AAgBO,SAAS,wBAAwB,UAA8C;AACpF,SAAO,qCAAqC,QAAQ,EAAE;AACxD;AAEA,SAAS,0BACP,UACAC,SACA,YACA,KACA,KACA,OACyE;AACzE,QAAM,WAAW,6BAA6B,KAAK,OAAO,GAAG;AAC7D,MAAI,CAAC,SAAS,IAAI;AAChB,IAAAA,QAAO,KAAK,EAAE,YAAY,KAAK,QAAQ,aAAa,SAAS,SAAS,MAAM,CAAC;AAC7E,WAAO,EAAE,QAAQ,MAAM;AAAA,EACzB;AACA,MAAI,CAAC,SAAS,WAAW,8BAA8B,QAAQ,GAAG;AAEhE,IAAAA,QAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,SAAS,GAAG,GAAG,qDAAqD,KAAK;AAAA,IAC3E,CAAC;AACD,WAAO,EAAE,QAAQ,MAAM;AAAA,EACzB;AACA,SAAO,EAAE,QAAQ,MAAM,SAAS,SAAS,QAAQ;AACnD;AAEA,SAAS,qCAAqC,UAG5C;AACA,QAAMA,UAAmC,CAAC;AAC1C,QAAM,QAAQ,SAAS,wBACpB,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB;AAAA,IACC,CAAC,SACC,SAAS,YACT,SAAS,kBACT,SAAS,eACT,SAAS,wBACT,SAAS;AAAA,EACb;AACF,QAAM,OAAO,oBAAI,IAA0B;AAC3C,QAAM,YAAwC,CAAC;AAC/C,aAAW,MAAM,OAAO;AACtB,QAAI,KAAK,IAAI,EAAE,EAAG;AAClB,SAAK,IAAI,EAAE;AACX,QAAI,OAAO,aAAa;AACtB,UACE,CAAC,SAAS,yBACV,CAAC,yBAAyB,SAAS,mBAAmB;AAEtD;AACF,YAAM,SAAS;AAAA,QACb;AAAA,QACAA;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AACA,UAAI,CAAC,OAAO,OAAQ;AACpB,gBAAU,KAAK;AAAA,QACb;AAAA,QACA,MAAM;AAAA,QACN,SAAS,OAAO;AAAA,QAChB,UAAU,SAAS,sBAAsB,QAAQ,QAAQ,EAAE;AAAA,QAC3D,QAAQ,SAAS;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB,OAAO,SAAS;AAAA,MAClB,CAAC;AACD;AAAA,IACF;AACA,QAAI,OAAO,UAAU;AACnB,UAAI,CAAC,SAAS,wBAAyB;AACvC,YAAM,SAAS,SAAS,0BAA0B,SAAS;AAC3D,UAAI,CAAC,yBAAyB,MAAM,EAAG;AAGvC,UACE,SAAS,mBAAmB,WAC5B,CAAC,SAAS,0BACV,CAAC,SAAS,yBACV;AACA;AAAA,MACF;AACA,YAAM,SAAS;AAAA,QACb;AAAA,QACAA;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AACA,UAAI,CAAC,OAAO,OAAQ;AACpB,gBAAU,KAAK;AAAA,QACb,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,SAAS,OAAO;AAAA,QAChB;AAAA,QACA,UACE,SAAS,2BACT,SAAS,iBACT,6BACA,QAAQ,QAAQ,EAAE;AAAA,QACpB,OAAO,SAAS;AAAA,MAClB,CAAC;AACD;AAAA,IACF;AACA,QAAI,OAAO,gBAAgB;AACzB,UAAI,CAAC,SAAS,uBAAwB;AACtC,YAAM,YACJ,SAAS,2BACT,SAAS,uBACT,IACA,QAAQ,QAAQ,EAAE;AACpB,YAAM,aAAa,SAAS,6BAA6B,SAAS,yBAAyB;AAC3F,YAAM,aACJ,SAAS,6BACT,SAAS,yBACT;AACF,YAAM,SAAS,SAAS,yBAAyB,SAAS,qBAAqB;AAC/E,YAAM,UAAU,SAAS,0BAA0B,SAAS,sBAAsB;AAClF,UACE,CAAC,YACD,CAAC,cACA,CAAC,yBAAyB,MAAM,KAAK,CAAC,yBAAyB,OAAO,GACvE;AACA;AAAA,MACF;AAGA,UACE,SAAS,mBAAmB,WAC5B,CAAC,SAAS,2BACV,CAAC,SAAS,6BACV,CAAC,SAAS,yBACV,CAAC,SAAS,wBACV;AACA;AAAA,MACF;AACA,YAAM,QAAQ,SAAS,wBAAwB;AAC/C,YAAM,SAAS;AAAA,QACb;AAAA,QACAA;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT;AAAA,MACF;AACA,UAAI,CAAC,OAAO,OAAQ;AACpB,YAAM,UAAU,OAAO;AACvB,gBAAU,KAAK;AAAA,QACb,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ,yBAAyB,MAAM,IAAI,SAAS;AAAA,QACpD,SAAS,yBAAyB,OAAO,IAAI,UAAU;AAAA,QACvD;AAAA,QACA;AAAA,MACF,CAAC;AACD;AAAA,IACF;AACA,QAAI,OAAO,sBAAsB;AAM/B,UAAI,CAAC,SAAS,yBAA0B;AACxC,gBAAU,KAAK;AAAA,QACb,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,cAAc;AAAA,MAChB,CAAC;AACD;AAAA,IACF;AACA,QAAI,OAAO,0BAA0B;AACnC,UAAI,CAAC,SAAS,6BAA8B;AAC5C,gBAAU,KAAK;AAAA,QACb,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,EAAE,WAAW,QAAAA,QAAO;AAC7B;AAmBA,IAAM,0BAA0BF,GAC7B,OAAO;AAAA,EACN,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAW;AAAA,EAC5D,6BAA6BA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,GAAa,EAAE,SAAS;AAAA,EACxF,kCAAkCA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,GAAa,EAAE,SAAS;AAAA,EAC7F,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,GAAa,EAAE,SAAS;AAAA,EACzF,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO,EAAE,SAAS;AAC3D,CAAC,EACA,OAAO,EACP,YAAY,CAAC,SAAS,QAAQ;AAC7B,QAAM,QAAQ,QAAQ,gCAAgC;AACtD,QAAM,SAAS,QAAQ,iCAAiC;AACxD,MAAI,UAAU,QAAQ;AACpB,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,QAAQ,qCAAqC,UAAa,CAAC,OAAO;AACpE,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAQI,IAAM,2BAAwE;AAAA;AAAA;AAAA,EAGnF,qBAAqB;AAAA,IACnB,iBAAiB;AAAA,IACjB,6BAA6B;AAAA,IAC7B,kCAAkC;AAAA,IAClC,8BAA8B;AAAA,IAC9B,WAAW;AAAA,EACb;AAAA,EACA,6BAA6B;AAAA,IAC3B,iBAAiB;AAAA,IACjB,6BAA6B;AAAA,IAC7B,kCAAkC;AAAA,IAClC,8BAA8B;AAAA,IAC9B,WAAW;AAAA,EACb;AAAA,EACA,0BAA0B;AAAA,IACxB,iBAAiB;AAAA,IACjB,6BAA6B;AAAA,IAC7B,kCAAkC;AAAA,IAClC,8BAA8B;AAAA,IAC9B,WAAW;AAAA,EACb;AAAA,EACA,kBAAkB,EAAE,iBAAiB,MAAO,WAAW,IAAI;AAAA,EAC3D,SAAS,EAAE,iBAAiB,KAAO,WAAW,IAAI;AAAA,EAClD,aAAa,EAAE,iBAAiB,KAAO,WAAW,IAAI;AACxD;AAGO,SAAS,yBAAyB,OAAuB;AAC9D,SAAO,MACJ,KAAK,EACL,YAAY,EACZ,QAAQ,uBAAuB,EAAE;AACtC;AAGO,SAAS,mCAAmC,OAAwB;AACzE,SAAO,yBAAyB,KAAK,EAAE,WAAW,SAAS;AAC7D;AAGO,SAAS,2BACd,KACA,MAAM,4BACoB;AAC1B,MAAI,QAAQ,UAAa,IAAI,KAAK,MAAM,GAAI,QAAO;AACnD,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI,MAAM,GAAG,GAAG,qBAAqB;AAAA,EAC7C;AACA,QAAM,SAAS,wBAAwB,UAAU,MAAM;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR,GAAG,GAAG,gBAAgB,OAAO,MAAM,OAAO,IAAI,CAAC,UAAU,MAAM,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,IACpF;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAGO,SAAS,yBACd,KACA,OAC0B;AAC1B,SACE,2BAA2B,GAAG,KAC9B,yBAAyB,yBAAyB,KAAK,CAAC,KACxD;AAEJ;AAGO,SAAS,6BACd,KACA,OACA,KACgF;AAChF,MAAI;AACJ,MAAI;AACF,eAAW,2BAA2B,KAAK,GAAG;AAAA,EAChD,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;AAAA,EACpF;AACA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS,YAAY,yBAAyB,yBAAyB,KAAK,CAAC,KAAK;AAAA,EACpF;AACF;AAGO,SAAS,8BACd,UACS;AACT,SAAO,SAAS,gBAAgB,YAAY,SAAS,oBAAoB;AAC3E;AAqBO,SAAS,+BAA+B,SAAqC;AAClF,SACE,QAAQ,gCAAgC,UACxC,QAAQ,iCAAiC;AAE7C;AAGA,SAAS,yBACP,UACA,qBACQ;AACR,SAAO,SAAS,2BAA2B,uBAAuB;AACpE;AAOO,SAAS,wBACd,SACA,OACA,mBACgB;AAChB,MAAI;AACJ,MAAI;AACJ,MAAI,MAAM,SAAS,UAAU;AAC3B,QACE,QAAQ,gCAAgC,UACxC,QAAQ,iCAAiC,QACzC;AACA,YAAM,IAAI,MAAM,gDAAgD;AAAA,IAClE;AACA,eAAW,SAAS;AAAA,MAClB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACR,GAAG;AACD,UAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC7C,cAAM,IAAI,MAAM,uDAAuD;AAAA,MACzE;AAAA,IACF;AACA,UAAM,YACJ,QAAQ,oCAAoC,QAAQ;AAEtD,UAAM,eAAe,KAAK;AAAA,MACxB;AAAA,MACA,MAAM,cAAc,MAAM,mBAAmB,MAAM;AAAA,IACrD;AACA,gBACE,OAAO,MAAM,mBAAmB,YAAY,IAAI,OAAO,SAAS,IAChE,OAAO,MAAM,eAAe,IAAI,OAAO,QAAQ,2BAA2B,IAC1E,OAAO,MAAM,YAAY,IAAI,OAAO,QAAQ,4BAA4B;AAC1E,kBAAc;AAAA,EAChB,OAAO;AACL,QAAI,CAAC,OAAO,SAAS,MAAM,OAAO,KAAK,MAAM,UAAU,GAAG;AACxD,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AACA,gBAAY,OAAO,KAAK,KAAK,MAAM,UAAU,GAAK,CAAC,IAAI,OAAO,QAAQ,eAAe;AACrF,kBAAc;AAAA,EAChB;AACA,QAAM,SAAS,OAAO,OAAU,qBAAqB,QAAQ,aAAa,EAAE;AAC5E,QAAM,YAAY,YAAY,cAAc,MAAM;AAClD,QAAM,SAAS,cAAc;AAC7B,QAAM,UAAU,YAAY,SAAS,SAAS,MAAM;AACpD,MAAI,SAAS,OAAO,OAAO,gBAAgB,GAAG;AAC5C,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,SAAO,EAAE,oBAAoB,OAAO,QAAQ,GAAG,kBAAkB,OAAO,MAAM,EAAE;AAClF;AAQO,SAAS,4BAA4B,UAA4C;AACtF,SAAO,wBAAwB,QAAQ,EAAE;AAAA,IAAQ,CAAC,UAChD,MAAM,WAAW,aAAa,CAAC,MAAM,UAAU,IAAI,CAAC;AAAA,EACtD;AACF;AAGO,SAAS,+BAA+B,UAA6B;AAC1E,SAAO,kCAAkC,QAAQ,EAAE;AAAA,IACjD,CAAC,aACC,SAAS,SAAS,wBAAwB,SAAS,SAAS;AAAA,EAChE;AACF;AAsEA,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EAClC,6BAA6BA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,mCAAmCA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC3E,kCAAkCA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC1E,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC3D,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO,EAAE,SAAS;AAC3D,CAAC;AAED,IAAM,6BAA6BA,GAChC,OAAO;AAAA,EACN,SAAS;AAAA,EACT,iBAAiBA,GACd;AAAA,IACCA,GAAE,OAAO;AAAA,MACP,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MACjD,SAAS;AAAA,IACX,CAAC;AAAA,EACH,EACC,SAAS;AACd,CAAC,EACA,YAAY,CAAC,UAAU,QAAQ;AAC9B,MAAI,WAAW;AACf,aAAW,CAAC,OAAO,IAAI,MAAM,SAAS,mBAAmB,CAAC,GAAG,QAAQ,GAAG;AACtE,QAAI,KAAK,sBAAsB,UAAU;AACvC,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,mBAAmB,OAAO,oBAAoB;AAAA,QACrD,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,eAAW,KAAK;AAAA,EAClB;AACF,CAAC;AAEI,IAAM,sBAAsBA,GAAE,KAAK,CAAC,aAAa,eAAe,SAAS,CAAC;AAG1E,IAAM,0BAA0BA,GACpC,OAAO;AAAA,EACN,UAAU;AAAA,EACV,UAAUA,GAAE,QAAQ;AACtB,CAAC,EACA,YAAY,CAAC,OAAO,QAAQ;AAC3B,MAAI,MAAM,aAAa,iBAAiB,MAAM,UAAU;AACtD,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,UAAU;AAAA,MACjB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGH,IAAM,kBAAkBA,GAAE,KAAK,CAAC,QAAQ,SAAS,OAAO,CAAC;AACzD,IAAM,qBAAqBA,GAAE,KAAK,CAAC,YAAY,YAAY,QAAQ,WAAW,CAAC;AAExE,IAAM,4BAA4BA,GACtC,OAAO;AAAA,EACN,WAAW,wBAAwB,OAAO;AAAA,IACxC,SAASA,GAAE,MAAM,eAAe;AAAA,IAChC,eAAe,gBAAgB,SAAS;AAAA,IACxC,UAAUA,GAAE,QAAQ;AAAA,EACtB,CAAC;AAAA,EACD,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,aAAaA,GAAE,OAAO;AAAA,IACpB,WAAW;AAAA,IACX,SAAS;AAAA,IACT,eAAe;AAAA,IACf,iBAAiB,wBAAwB,QAAQ;AAAA,MAC/C,UAAU;AAAA,MACV,UAAU;AAAA,IACZ,CAAC;AAAA,EACH,CAAC;AAAA,EACD,iBAAiBA,GAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AAAA;AAAA,EAE/C,qBAAqBA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACnD,kBAAkBA,GAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AAAA,EAChD,YAAYA,GAAE,OAAO;AAAA,IACnB,KAAK;AAAA,IACL,oBAAoB;AAAA,IACpB,eAAe;AAAA,EACjB,CAAC;AAAA,EACD,eAAe,wBAAwB,OAAO;AAAA,IAC5C,MAAMA,GAAE,KAAK,CAAC,YAAY,aAAa,MAAM,CAAC;AAAA,EAChD,CAAC,EAAE,SAAS;AAAA,EACZ,cAAcA,GACX;AAAA,IACCA,GAAE,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,UAAUA,GAAE,QAAQ;AAAA,MACpB,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IAC7D,CAAC;AAAA,EACH,EACC,IAAI,CAAC;AACV,CAAC,EACA,YAAY,CAAC,cAAc,QAAQ;AAClC,QAAM,UAAU,IAAI,IAAI,aAAa,UAAU,OAAO;AACtD,MAAI,QAAQ,SAAS,aAAa,UAAU,QAAQ,QAAQ;AAC1D,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,aAAa,SAAS;AAAA,MAC7B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,aAAa,UAAU,kBAAkB,QACzC,CAAC,QAAQ,IAAI,aAAa,UAAU,aAAa,GACjD;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,aAAa,eAAe;AAAA,MACnC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,aAAa,UAAU,YAAY,aAAa,UAAU,QAAQ,WAAW,GAAG;AAClF,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,aAAa,SAAS;AAAA,MAC7B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,aAAW,SAAS,CAAC,mBAAmB,kBAAkB,GAAY;AACpE,QAAI,IAAI,IAAI,aAAa,KAAK,CAAC,EAAE,SAAS,aAAa,KAAK,EAAE,QAAQ;AACpE,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,GAAG,KAAK;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,aAAa,oBAAI,IAAY;AACnC,aAAW,CAAC,OAAO,IAAI,KAAK,aAAa,aAAa,QAAQ,GAAG;AAC/D,QAAI,WAAW,IAAI,KAAK,EAAE,GAAG;AAC3B,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,IAAI;AAAA,QAClC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,eAAW,IAAI,KAAK,EAAE;AACtB,QAAI,KAAK,aAAa,iBAAiB,KAAK,UAAU;AACpD,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,UAAU;AAAA,QACxC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAiCI,IAAM,mBAAmBA,GAAE,KAAK,CAAC,aAAa,QAAQ,oBAAoB,CAAC;AAQ3E,IAAM,2BAA2BA,GAAE,KAAK,CAAC,UAAU,cAAc,CAAC;AASlE,IAAM,uBAAuBA,GAAE,KAAK;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAID,IAAM,qBAAqBA,GACxB,OAAO,EACP;AAAA,EACC,CAAC,UAAU,aAAa,EAAE,IAAI,IAAI,SAAS,MAAM,CAAC,MAAM;AAAA,EACxD;AACF;AAEF,IAAM,sBAAsBA,GACzB,OAAO;AAAA,EACN,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EACpB,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAC5C,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA,EAC7C,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAClC,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA,EAC/C,SAAS,mBAAmB,SAAS;AAAA,EACrC,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAG5D,4BAA4BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjE,iBAAiBA,GAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EACtC,iBAAiBA,GAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EACtC,cAAc,0BAA0B,SAAS;AAAA,EACjD,SAASA,GAAE,MAAM,CAAC,oBAAoB,0BAA0B,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAG5E,kBAAkBA,GAAE,MAAM,EAAE,SAAS;AAAA,EACrC,SAASA,GAAE,MAAM,EAAE,SAAS;AAC9B,CAAC,EACA,YAAY,CAAC,OAAO,QAAQ;AAC3B,MACE,MAAM,gBACN,MAAM,oBAAoB,UAC1B,MAAM,oBAAoB,MAAM,aAAa,UAAU,UACvD;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,gBACN,MAAM,oBAAoB,UAC1B,MAAM,oBAAoB,MAAM,aAAa,YAAY,UAAU,UACnE;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,6BAA6BA,GACvC,OAAO;AAAA,EACN,aAAaA,GAAE,MAAM,CAACA,GAAE,OAAO,EAAE,KAAK,GAAGA,GAAE,QAAQ,EAAE,CAAC,CAAC;AAAA,EACvD,UAAUA,GAAE,OAAO,EAAE,MAAM,gBAAgB;AAC7C,CAAC,EACA,OAAO;AAEH,IAAM,+BAA+BA,GACzC,OAAO;AAAA,EACN,SAASA,GAAE,QAAQ,CAAC;AAAA,EACpB,OAAOA,GAAE,OAAO,EAAE,MAAM,wBAAwB;AAAA,EAChD,UAAU;AAAA,EACV,OAAOA,GACJ,OAAO;AAAA,IACN,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK;AAAA,IACzC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAC3D,CAAC,EACA,OAAO,EACP,SAAS;AACd,CAAC,EACA,OAAO;AACV,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EACxC,UAAU,2BAA2B,SAAS;AAAA;AAAA,EAE9C,mBAAmBA,GAChB,OAAO;AAAA,IACN,cAAcA,GAAE,OAAO,EAAE,KAAK;AAAA,IAC9B,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,CAAC,EACA,OAAO,EACP,SAAS;AAAA,EACZ,MAAMA,GAAE,KAAK,CAAC,WAAW,OAAO,CAAC,EAAE,QAAQ,SAAS;AAAA,EACpD,UAAUA,GAAE,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,EAAE,QAAQ,IAAI;AAAA,EAClD,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAK;AAAA,EAC1D,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AACjE,CAAC;AAED,IAAM,yBAAyBA,GAC5B,OAAO;AAAA,EACN,MAAM,qBAAqB,QAAQ,SAAS;AAAA,EAC5C,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,UAAU;AAAA;AAAA,EACtC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,KAAK,iBAAiB,QAAQ,MAAM;AAAA,EACpC,WAAW,yBAAyB,SAAS;AAAA;AAAA;AAAA,EAG7C,qBAAqBA,GAClB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,KAAK,GAAM,EACpB,SAAS;AAAA,EACZ,yBAAyBA,GACtB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,KAAK,GAAM,EACpB,SAAS;AAAA,EACZ,aAAa,yBAAyB,QAAQ,QAAQ;AAAA,EACtD,SAASA,GAAE,OAAO,EAAE,IAAI;AAAA,EACxB,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC5B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC/B,cAAcA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACxD,gBAAgBA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC1D,yBAAyBA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC7D,0BAA0BA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAG9D,kBAAkBA,GAAE,MAAM,EAAE,SAAS;AAAA,EACrC,SAASA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC5B,QAAQA,GAAE,MAAM,mBAAmB,EAAE,IAAI,CAAC;AAC5C,CAAC,EACA,YAAY,CAAC,UAAU,QAAQ;AAC9B,MAAI,SAAS,SAAS,aAAa;AACjC;AAAA,EACF;AACA,MAAI,SAAS,WAAW,QAAW;AACjC,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,SAAS,cAAc,QAAW;AACpC,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,WAAW;AAAA,MAClB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,SAAS,mBAAmB,QAAW;AACzC,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,SAAS,iBAAiB,QAAW;AACvC,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,SAAS,6BAA6B,QAAW;AACnD,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,0BAA0B;AAAA,MACjC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,SAAS,4BAA4B,QAAW;AAClD,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,yBAAyB;AAAA,MAChC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,+BAA+B;AACrC,IAAM,gCAAgC;AACtC,IAAM,oCAAoC;AAC1C,IAAM,mCAAmC;AACzC,IAAM,uCAAuC;AAC7C,IAAM,yBAAyB;AAC/B,IAAM,6BAA6B;AACnC,IAAM,mCAAmC;AACzC,IAAM,uCAAuC;AAC7C,IAAM,sCAAsC;AAC5C,IAAM,0CAA0C;AAChD,IAAM,sBAAsB;AAC5B,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB;AAC9B,IAAM,8BAA8B;AACpC,IAAM,kCAAkC;AACxC,IAAM,iCAAiC;AACvC,IAAM,qCAAqC;AAM3C,IAAM,kCAAkC;AACxC,IAAM,sCAAsC;AAC5C,IAAM,wCAAwC;AAC9C,IAAM,4CAA4C;AAElD,IAAM,iBAAiB;AAE9B,IAAM,8BAA8B,oBAAI,IAAY;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,IAAM,iBAAiBA,GAAE,KAAK,CAAC,QAAQ,SAAS,CAAC;AAGjD,IAAM,2BAA2BA,GAAE,KAAK;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,YAAYA,GACf,OAAO,EACP,IAAI,GAAG,EACP,OAAO,CAAC,UAAU,CAAC,WAAW,KAAK,KAAK,GAAG;AAAA,EAC1C,SAAS;AACX,CAAC;AAEI,SAAS,yBAAyB,KAA6C;AACpF,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,uDAAuD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAC7G,EAAE,OAAO,MAAM;AAAA,IACjB;AAAA,EACF;AACA,SAAOA,GAAE,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,GAAG,cAAc,EAAE,MAAM,MAAM;AACjE;AAEO,SAAS,oBAAoB,KAAqC;AACvE,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,iDAAiD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACvG,EAAE,OAAO,MAAM;AAAA,IACjB;AAAA,EACF;AACA,SAAOA,GAAE,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,GAAG,SAAS,EAAE,MAAM,MAAM;AAC5D;AAEO,SAAS,qBACd,UACwB;AACxB,SAAO,oBAAoB,SAAS,cAAc;AACpD;AAEO,IAAM,sBAAsBA,GAChC,OAAO;AAAA,EACN,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,oBAAoBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,iCAAiC;AAAA,EAClF,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACjC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC/C,SAAS,mBAAmB,SAAS;AAAA,EACrC,WAAWA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;AAAA,EAC3C,iBAAiBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAC1C,QAAQA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjC,qBAAqBA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC1D,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAS;AAAA,EAClE,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAO;AAAA,EACzE,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAO;AAAA,EAClE,SAASA,GAAE,MAAM,CAAC,oBAAoB,0BAA0B,CAAC,EAAE,SAAS;AAAA,EAC5E,kBAAkBA,GAAE,MAAM,EAAE,SAAS;AAAA,EACrC,SAASA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC5B,QAAQA,GAAE,MAAM,EAAE,SAAS;AAC7B,CAAC,EACA,OAAO;AAGH,IAAM,yBAAyBA,GACnC,OAAO;AAAA,EACN,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,OAAO;AAAA,EACnD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC/C,SAAS,mBAAmB,SAAS;AAAA,EACrC,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC9C,cAAc;AAAA,EACd,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,4BAA4BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjE,kBAAkBA,GAAE,MAAM,EAAE,SAAS;AAAA,EACrC,SAASA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC5B,SAASA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC5B,QAAQA,GAAE,MAAM,EAAE,SAAS;AAC7B,CAAC,EACA,OAAO;AASH,IAAM,oBAAoBA,GAC9B,OAAO;AAAA,EACN,iBAAiBA,GACd,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,kEAAkE;AAAA,EAC3E,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC/C,SAAS,mBAAmB,SAAS;AAAA,EACrC,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC9C,cAAc;AAAA,EACd,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,4BAA4BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjE,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,SAASA,GAAE,MAAM,CAAC,oBAAoB,0BAA0B,CAAC,EAAE,SAAS;AAAA,EAC5E,kBAAkBA,GAAE,MAAM,EAAE,SAAS;AAAA,EACrC,SAASA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC5B,QAAQA,GAAE,MAAM,EAAE,SAAS;AAC7B,CAAC,EACA,OAAO;AAGV,IAAM,4BAA4BA,GAC/B,OAAO,EACP,IAAI,EACJ,YAAY,CAAC,OAAO,YAAY;AAC/B,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,IAAI,QAAQ;AACd,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,IAAI,MAAM;AACZ,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAEH,IAAM,iCAAiCA,GAAE,KAAK,CAAC,WAAW,WAAW,CAAC;AAEtE,IAAM,gCAAgC,oBAAoB,WAAW;AAAA,EACnE,SAASA,GAAE,MAAM,EAAE,SAAS;AAC9B,CAAC,EAAE,OAAO;AAEV,IAAM,mCAAmC,uBAAuB,WAAW;AAAA,EACzE,MAAM,+BAA+B,QAAQ,SAAS;AAAA,EACtD,SAAS;AAAA,EACT,QAAQA,GAAE,MAAM,6BAA6B,EAAE,IAAI,CAAC;AAAA,EACpD,QAAQA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC3B,WAAWA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC9B,gBAAgBA,GAAE,MAAM,EAAE,SAAS;AAAA,EACnC,cAAcA,GAAE,MAAM,EAAE,SAAS;AAAA,EACjC,0BAA0BA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC7C,yBAAyBA,GAAE,MAAM,EAAE,SAAS;AAC9C,CAAC,EAAE,OAAO;AAEV,IAAM,sCAAsC,oBAAoB,WAAW;AAAA,EACzE,SAASA,GAAE,MAAM,EAAE,SAAS;AAC9B,CAAC,EAAE,OAAO;AAEV,IAAM,oCAAoC,kBAAkB,WAAW;AAAA,EACrE,SAASA,GAAE,MAAM,EAAE,SAAS;AAC9B,CAAC,EAAE,OAAO;AAEV,IAAM,0BAA0B,oBAAoB,WAAW;AAAA,EAC7D,SAASA,GAAE,QAAQ,EAAE,SAAS;AAAA,EAC9B,IAAIA,GAAE,OAAO,EAAE,MAAM,qCAAqC;AAAA,EAC1D,iBAAiBA,GAAE,OAAO,EAAE,MAAM,8BAA8B;AAAA,EAChE,cAAc;AAAA,EACd,SAASA,GAAE,MAAM,EAAE,SAAS;AAC9B,CAAC,EACE,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,OAAO,GAAG,qBAAqB,GAAG,MAAM,eAAe,IAAI;AACnE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,IAAI;AAAA,MACX,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC,EACA,UAAU,CAAC,WAAW;AAAA,EACrB,GAAG;AAAA,EACH,cAAc,iCAAiC,MAAM,iBAAiB,MAAM,YAAY;AAC1F,EAAE;AAEG,IAAM,uBAAuBA,GACjC,OAAO;AAAA,EACN,eAAeA,GAAE,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA,EAI1B,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,eAAeA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAAA,EACxC,mBAAmBA,GAAE,MAAM,gCAAgC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACvE,aAAaA,GAAE,MAAM,uBAAuB,EAAE,SAAS;AAAA,EACvD,eAAeA,GAAE,MAAM,mCAAmC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtE,kBAAkBA,GAAE,MAAM,sBAAsB,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA,EAI5D,aAAaA,GAAE,MAAM,iCAAiC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClE,YAAYA,GAAE,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,GAAG,SAAS,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC7D,SAASA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC5B,SAASA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC5B,QAAQA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC3B,OAAOA,GAAE,MAAM,EAAE,SAAS;AAC5B,CAAC,EACA,OAAO,EACP,YAAY,CAAC,UAAU,YAAY;AAClC,MAAI,SAAS,cAAc,WAAW,KAAK,CAAC,SAAS,cAAc;AACjE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,aAAa,oBAAI,IAAY;AACnC,QAAM,cAAc,oBAAI,IAAY;AACpC,QAAM,qBAAqB,oBAAI,IAAY;AAC3C,QAAM,MAAM,CAAC,IAAY,SAAuC;AAC9D,QAAI,mBAAmB,KAAK,EAAE,GAAG;AAC/B,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN;AAAA,QACA,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,WAAW,IAAI,EAAE,GAAG;AACtB,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN;AAAA,QACA,SAAS,wBAAwB,EAAE;AAAA,MACrC,CAAC;AAAA,IACH;AACA,eAAW,IAAI,EAAE;AAAA,EACnB;AACA,WAAS,cAAc,QAAQ,CAAC,IAAI,UAAU,IAAI,IAAI,CAAC,iBAAiB,KAAK,CAAC,CAAC;AAC/E,WAAS,aAAa,QAAQ,CAAC,OAAO,UAAU,IAAI,MAAM,IAAI,CAAC,eAAe,OAAO,IAAI,CAAC,CAAC;AAC3F,MACE,SAAS,aAAa,KAAK,CAAC,UAAU,MAAM,WAAW,MAAM,OAAO,SAAS,YAAY,GACzF;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,WAAS,kBAAkB,QAAQ,CAAC,UAAU,kBAAkB;AAC9D,QACE,4BAA4B,IAAI,SAAS,EAAE,KAC3C,SAAS,GAAG,WAAW,mBAAmB,KAC1C,SAAS,GAAG,WAAW,yBAAyB,GAChD;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,qBAAqB,eAAe,IAAI;AAAA,QAC/C,SAAS,eAAe,SAAS,EAAE;AAAA,MACrC,CAAC;AAAA,IACH;AACA,QAAI,YAAY,IAAI,SAAS,EAAE,GAAG;AAChC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,qBAAqB,eAAe,IAAI;AAAA,QAC/C,SAAS,yBAAyB,SAAS,EAAE;AAAA,MAC/C,CAAC;AAAA,IACH;AACA,gBAAY,IAAI,SAAS,EAAE;AAC3B,aAAS,OAAO;AAAA,MAAQ,CAAC,OAAO,eAC9B,IAAI,MAAM,IAAI,CAAC,qBAAqB,eAAe,UAAU,YAAY,IAAI,CAAC;AAAA,IAChF;AAAA,EACF,CAAC;AACD,WAAS,cAAc,QAAQ,CAAC,OAAO,UAAU;AAC/C,QAAI,mBAAmB,IAAI,MAAM,eAAe,GAAG;AACjD,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,iBAAiB,OAAO,iBAAiB;AAAA,QAChD,SAAS,uCAAuC,MAAM,eAAe;AAAA,MACvE,CAAC;AAAA,IACH;AACA,uBAAmB,IAAI,MAAM,eAAe;AAC5C,QAAI,MAAM,WAAW,CAAC,iBAAiB,OAAO,WAAW,CAAC;AAC1D,QAAI,MAAM,oBAAoB,CAAC,iBAAiB,OAAO,oBAAoB,CAAC;AAAA,EAC9E,CAAC;AACD,WAAS,iBAAiB;AAAA,IAAQ,CAAC,OAAO,UACxC,IAAI,GAAG,0BAA0B,GAAG,MAAM,eAAe,IAAI;AAAA,MAC3D;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACA,WAAS,YAAY;AAAA,IAAQ,CAAC,OAAO,UACnC,IAAI,GAAG,qBAAqB,GAAG,MAAM,eAAe,IAAI;AAAA,MACtD;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACA,MAAI,SAAS,gBAAgB,mBAAmB,KAAK,SAAS,YAAY,GAAG;AAC3E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,SAAS,gBACT,CAAC,WAAW,IAAI,SAAS,YAAY,KACrC,EACE,SAAS,gBAAgB,UACzB,SAAS,aAAa,WAAW,qBAAqB,MAExD,CAAC,SAAS,aAAa,WAAW,gCAAgC,GAClE;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACA,aAAW,aAAa,OAAO,KAAK,SAAS,UAAU,GAAG;AACxD,QAAI,CAAC,WAAW,IAAI,SAAS,GAAG;AAC9B,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,cAAc,SAAS;AAAA,QAC9B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAGI,SAAS,0BAA0B,OAAsC;AAC9E,SAAO,qBAAqB,MAAM,KAAK;AACzC;AAEA,SAAS,+CACP,UACA,WACoB;AACpB,QAAM,gBAAgB,IAAI;AAAA,IACxB,wBAAwB,SAAS,kBAAkB,EAAE,IAAI,CAAC,aAAa,CAAC,SAAS,IAAI,QAAQ,CAAC;AAAA,EAChG;AACA,SAAO,UAAU,IAAI,CAAC,aAAa;AACjC,QAAI,SAAS,SAAS,UAAW,QAAO;AACxC,UAAM,OAAO,cAAc,IAAI,SAAS,EAAE;AAC1C,QAAI,CAAC,QAAQ,KAAK,SAAS,WAAW;AACpC,YAAM,IAAI;AAAA,QACR,mCAAmC,SAAS,EAAE;AAAA,MAChD;AAAA,IACF;AACA,UAAM,oBAAoB,CAAC,eAAmD;AAAA,MAC5E,MAAM,UAAU;AAAA,MAChB,SAAS,UAAU;AAAA,MACnB,KAAK,UAAU;AAAA,MACf,aAAa,UAAU;AAAA,IACzB;AACA,QAAI,cAAc,kBAAkB,QAAQ,CAAC,MAAM,cAAc,kBAAkB,IAAI,CAAC,GAAG;AACzF,YAAM,IAAI;AAAA,QACR,mCAAmC,SAAS,EAAE;AAAA,MAChD;AAAA,IACF;AACA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,GAAI,KAAK,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,KAAK,eAAe;AAAA,MACnF,GAAI,KAAK,iBAAiB,SAAY,CAAC,IAAI,EAAE,cAAc,KAAK,aAAa;AAAA,MAC7E,GAAI,KAAK,6BAA6B,SAClC,CAAC,IACD,EAAE,0BAA0B,KAAK,yBAAyB;AAAA,MAC9D,GAAI,KAAK,4BAA4B,SACjC,CAAC,IACD,EAAE,yBAAyB,KAAK,wBAAwB;AAAA,MAC5D,GAAI,KAAK,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;AAAA,MAC3D,GAAI,KAAK,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,KAAK,UAAU;AAAA,IACtE;AAAA,EACF,CAAC;AACH;AAaO,IAAM,wBAAwBA,GAClC,OAAO;AAAA,EACN,eAAeA,GAAE,MAAM,mCAAmC,EAAE,SAAS;AAAA,EACrE,kBAAkBA,GAAE,MAAM,sBAAsB,EAAE,SAAS;AAAA,EAC3D,aAAaA,GAAE,MAAM,iCAAiC,EAAE,SAAS;AACnE,CAAC,EACA,OAAO,EACP,YAAY,CAAC,UAAU,YAAY;AAClC,QAAM,SAAS,CACb,KACA,QACG;AACH,UAAM,OAAO,oBAAI,IAAY;AAC7B,KAAC,SAAS,GAAG,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,UAAU;AAC9C,iBAAW,MAAM,IAAI,KAAK,GAAG;AAC3B,YAAI,KAAK,IAAI,EAAE,GAAG;AAChB,kBAAQ,SAAS;AAAA,YACf,MAAM;AAAA,YACN,MAAM,CAAC,KAAK,OAAO,iBAAiB;AAAA,YACpC,SAAS,aAAa,GAAG,aAAa,EAAE;AAAA,UAC1C,CAAC;AAAA,QACH;AACA,aAAK,IAAI,EAAE;AAAA,MACb;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,iBAAiB,CAAC,UAAU;AACjC,UAAM,UAAU;AAChB,WAAO,CAAC,QAAQ,iBAAiB,QAAQ,WAAW,QAAQ,kBAAkB;AAAA,EAChF,CAAC;AACD,SAAO,oBAAoB,CAAC,UAAU;AAAA,IACpC,MAAM;AAAA,IACN,GAAI,MAAiC;AAAA,EACvC,CAAC;AACD,SAAO,eAAe,CAAC,UAAU;AAAA,IAC/B,MAAM;AAAA,IACN,GAAI,MAA4B;AAAA,EAClC,CAAC;AACH,CAAC;AAGH,IAAM,0BAA0B,oBAAI,IAAmC;AAGhE,SAAS,uBAAuB,KAAoC;AACzE,QAAM,SAAS,wBAAwB,IAAI,GAAG;AAC9C,MAAI,OAAQ,QAAO;AACnB,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,mDAAmD,EAAE,OAAO,MAAM,CAAC;AAAA,EACrF;AACA,QAAM,SAAS,sBAAsB,UAAU,IAAI;AACnD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR,4CAA4C,OAAO,MAAM,OACtD,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,EACtE,KAAK,IAAI,CAAC;AAAA,IACf;AAAA,EACF;AACA,MAAI,wBAAwB,OAAO,GAAI,yBAAwB,MAAM;AACrE,0BAAwB,IAAI,KAAK,OAAO,IAAI;AAC5C,SAAO,OAAO;AAChB;AAGA,SAAS,sBAAsB,UAA2C;AACxE,MAAI,SAAS,uBAAuB,UAAU,CAAC,SAAS,mBAAmB,KAAK,EAAG,QAAO,CAAC;AAC3F,SAAO,uBAAuB,SAAS,iBAAiB;AAC1D;AAEO,SAAS,0BAA0B,UAAoB,aAAgC;AAC5F,QAAM,WAAW,0BAA0B,WAAW;AACtD,QAAM,eAAe,SAAS,gBAAgB,SAAS,cAAc,CAAC;AACtE,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,IAKb,qBAAqB,SAAS,cAAc,KAAK,GAAG;AAAA,IACpD,oBAAoB,KAAK;AAAA,MACvB,+CAA+C,UAAU,SAAS,iBAAiB;AAAA,IACrF;AAAA,IACA,2BAA2B,KAAK,UAAU,SAAS,aAAa;AAAA,IAChE,8BAA8B,KAAK,UAAU,SAAS,gBAAgB;AAAA,IACtE,yBAAyB,KAAK,UAAU,SAAS,WAAW;AAAA,IAC5D,yBACE,SAAS,gBAAgB,SAAY,SAAY,KAAK,UAAU,SAAS,WAAW;AAAA,IACtF,gBAAgB,KAAK,UAAU,SAAS,UAAU;AAAA,EACpD;AACA,SAAO;AACT;AAEO,IAAM,qCAAqCA,GAAE,OAAO;AAAA,EACzD,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,yBAAyBA,GACtB,KAAK,CAAC,QAAQ,sBAAsB,qBAAqB,CAAC,EAC1D,QAAQ,MAAM;AACnB,CAAC;AAmFM,SAAS,6BAA6B,OAGjC;AACV,SACE,MAAM,SAAS,SAAS,wBACxB,MAAM,WAAW,gBAAgB,SAAS,OAAO;AAErD;AAEO,IAAM,6BAA6B;AACnC,IAAM,oCAAoC;AAC1C,IAAM,sCAAsC;AAC5C,IAAM,oCAAoC;AAC1C,IAAM,yCAAyC;AAC/C,IAAM,uCAAuC;AAC7C,IAAM,oCAAoC;AAC1C,IAAM,kCAAkC;AACxC,IAAM,yCAAyC;AAC/C,IAAM,uCAAuC;AAQ7C,SAAS,uBAAuB,QAA+B;AACpE,QAAM,MAAM,OAAO,KAAK;AACxB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,aAAa,KAAK,GAAG,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,IAAM,0BAA0B;AAChC,IAAM,8BAA8B;AACpC,IAAM,oCAAoC;AAC1C,IAAM,qCAAqC;AAG3C,IAAM,6BAA6B;AAAA,EACxC,kBAAkB;AAAA,IAChB,iBAAiB;AAAA,IACjB,gBAAgB,GAAG,iCAAiC;AAAA,IACpD,kBAAkB,GAAG,kCAAkC;AAAA,IACvD,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA,oBAAoB;AAAA,IAClB,iBAAiB;AAAA,IACjB,gBAAgB,GAAG,iCAAiC;AAAA,IACpD,kBAAkB,GAAG,kCAAkC;AAAA,IACvD,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA,sBAAsB;AAAA,IACpB,iBAAiB;AAAA,IACjB,gBAAgB,GAAG,iCAAiC;AAAA,IACpD,kBAAkB,GAAG,kCAAkC;AAAA,IACvD,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AACF;AAEO,IAAM,sCAAsC;AAO5C,IAAM,6BAA6B;AAAA,EACxC,OAAO;AAAA,IACL,iBAAiB;AAAA,IACjB,SAAS,GAAG,mCAAmC;AAAA,IAC/C,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,iBAAiB;AAAA,IACjB,SAAS,GAAG,mCAAmC;AAAA,IAC/C,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AACF;AAGO,SAAS,+BAA+B,SAAgC;AAC7E,aAAW,SAAS,OAAO,OAAO,0BAA0B,GAAG;AAC7D,QAAI,MAAM,YAAY,QAAS,QAAO,MAAM;AAAA,EAC9C;AACA,SAAO;AACT;AAOO,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,IAAM,uCAAyE;AAAA,EAC7E,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AACN;AAMO,SAAS,kCAAkC,KAA4B;AAC5E,QAAM,aAAa,IAAI,KAAK,EAAE,YAAY,EAAE,WAAW,KAAK,GAAG;AAC/D,QAAM,YAA+B;AACrC,MAAI,UAAU,SAAS,UAAU,EAAG,QAAO;AAC3C,QAAM,OAAO,WAAW,MAAM,GAAG,EAAE,CAAC,KAAK;AACzC,QAAM,WAAW,qCAAqC,IAAI,KAAK;AAC/D,SAAO,UAAU,SAAS,QAAQ,IAAI,WAAW;AACnD;AAKO,SAAS,8BACd,SACqE;AACrE,aAAW,SAAS,OAAO,OAAO,0BAA0B,GAAG;AAC7D,QAAI,MAAM,mBAAmB,SAAS;AACpC,aAAO,EAAE,QAAQ,WAAW,iBAAiB,MAAM,gBAAgB;AAAA,IACrE;AACA,QAAI,MAAM,qBAAqB,SAAS;AACtC,aAAO,EAAE,QAAQ,aAAa,iBAAiB,MAAM,gBAAgB;AAAA,IACvE;AAAA,EACF;AACA,SAAO;AACT;AAEO,IAAM,0BAA0B;AAAA,EACrC,UAAU;AAAA,IACR,WAAW;AAAA,IACX,oBAAoB,GAAG,iCAAiC;AAAA,IACxD,iBAAiB;AAAA,IACjB,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,WAAW,CAAC,WAAW,UAAU,WAAW;AAAA,IAC5C,iBAAiB;AAAA,EACnB;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,oBAAoB,GAAG,iCAAiC;AAAA,IACxD,iBAAiB;AAAA,IACjB,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,WAAW,CAAC,WAAW,WAAW;AAAA,IAClC,iBAAiB;AAAA,EACnB;AACF;AAEO,IAAM,6BAAgE;AAAA,EAC3E,uBAAuB,MAAM;AAAA,IAC3B,iBAAiB;AAAA,IACjB,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,SAAS,CAAC;AAAA,IACV,cAAc;AAAA,MACZ,WAAW;AAAA,QACT,UAAU;AAAA;AAAA,QAEV,UAAU;AAAA,QACV,SAAS,CAAC,OAAO,QAAQ;AAAA,QACzB,eAAe;AAAA,QACf,UAAU;AAAA,MACZ;AAAA,MACA,iBAAiB,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,MACzD,kBAAkB,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,MAC1D,aAAa;AAAA,QACX,WAAW,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,QAClD,SAAS,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,QAChD,eAAe,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,QACtD,iBAAiB,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MAC1D;AAAA,MACA,iBAAiB,CAAC,MAAM;AAAA,MACxB,qBAAqB,CAAC;AAAA,MACtB,kBAAkB,CAAC,MAAM;AAAA,MACzB,YAAY;AAAA,QACV,KAAK,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,QAC7C,oBAAoB,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,QAC3D,eAAe,EAAE,UAAU,eAAe,UAAU,MAAM;AAAA,MAC5D;AAAA,MACA,cAAc,CAAC,EAAE,IAAI,YAAY,UAAU,WAAW,UAAU,KAAK,CAAC;AAAA,IACxE;AAAA,IACA,qBAAqB;AAAA,IACrB,8BAA8B;AAAA,IAC9B,uBAAuB;AAAA,EACzB,CAAC;AACH;AAMA,SAAS,kBAAkB,OAQH;AACtB,SAAO,0BAA0B,MAAM;AAAA,IACrC,WAAW,EAAE,GAAG,MAAM,WAAW,UAAU,MAAM;AAAA;AAAA,IAEjD,iBAAiB,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,IACzD,kBAAkB;AAAA,MAChB,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM,qBAAqB;AAAA,IACvC;AAAA,IACA,aAAa;AAAA,MACX,WAAW,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MAClD,SAAS,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MAChD,eAAe,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MACtD,iBAAiB,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,IAC1D;AAAA,IACA,iBAAiB,MAAM,QAAQ,CAAC,QAAQ,OAAO,IAAI,CAAC,MAAM;AAAA,IAC1D,qBAAqB,MAAM;AAAA,IAC3B,kBAAkB,CAAC,MAAM;AAAA,IACzB,YAAY;AAAA,MACV,KAAK,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,MAC7C,oBAAoB,EAAE,UAAU,eAAe,UAAU,MAAM;AAAA,MAC/D,eAAe,EAAE,UAAU,eAAe,UAAU,MAAM;AAAA,IAC5D;AAAA,IACA,eAAe,EAAE,UAAU,WAAW,UAAU,OAAO,MAAM,OAAO;AAAA,IACpE,cAAc,CAAC,EAAE,IAAI,YAAY,UAAU,aAAa,UAAU,KAAK,CAAC;AAAA,EAC1E,CAAC;AACH;AAiBO,IAAM,oCAAoC;AAE1C,IAAM,wBAAsD;AAAA,EACjE,kBAAkB,MAAM;AAAA,IACtB,iBAAiB;AAAA,IACjB,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,SAAS,CAAC;AAAA,IACV,cAAc,kBAAkB;AAAA;AAAA;AAAA;AAAA,MAI9B,WAAW;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,SAAS,CAAC,OAAO,UAAU,QAAQ,SAAS,KAAK;AAAA,QACjD,eAAe;AAAA,MACjB;AAAA;AAAA,MAEA,kBAAkB;AAAA,MAClB,OAAO;AAAA,MACP,qBAAqB,CAAC,iBAAiB;AAAA,IACzC,CAAC;AAAA,IACD,qBAAqB;AAAA;AAAA,IAErB,8BAA8B;AAAA;AAAA,IAE9B,uBAAuB;AAAA,IACvB,iBAAiB;AAAA,IACjB,SAAS;AAAA;AAAA;AAAA,MAGP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,EACF,CAAC;AACH;AAQA,IAAM,+BAEF;AAAA,EACF,GAAG,OAAO;AAAA,IACR,sBAAsB;AAAA,MAAQ,CAAC,UAC7B,MAAM,UAAU,CAAC,CAAC,MAAM,iBAAiB,MAAM,OAAO,CAAU,IAAI,CAAC;AAAA,IACvE;AAAA,EACF;AAAA;AAAA,EAEA,gCAAgC;AAAA,IAC9B,6BAA6B;AAAA,IAC7B,mCAAmC;AAAA,IACnC,8BAA8B;AAAA,IAC9B,WAAW;AAAA,EACb;AAAA;AAAA,EAEA,4BAA4B;AAAA,IAC1B,6BAA6B;AAAA,IAC7B,mCAAmC;AAAA,IACnC,kCAAkC;AAAA,IAClC,8BAA8B;AAAA,IAC9B,WAAW;AAAA,EACb;AACF;AAIO,IAAM,mCAAmC,KAAK;AAIrD,IAAM,wCAAwC;AAE9C,SAAS,yBAAyB,iBAAkC;AAClE,SAAO,sBAAsB,KAAK,eAAe;AACnD;AAEA,SAAS,yBAAyB,iBAAkC;AAClE,SAAO,sBAAsB,KAAK,eAAe;AACnD;AAYA,SAAS,6BAA6B,iBAA8C;AAClF,SAAO,kBAAkB;AAAA,IACvB,WAAW;AAAA,MACT,UAAU;AAAA,MACV,UAAU;AAAA,MACV,SAAS,CAAC,OAAO,UAAU,MAAM;AAAA,MACjC,eAAe;AAAA,IACjB;AAAA,IACA,kBAAkB;AAAA,IAClB,OAAO,yBAAyB,eAAe,KAAK,yBAAyB,eAAe;AAAA,IAC5F,qBAAqB,CAAC;AAAA,EACxB,CAAC;AACH;AAUO,SAAS,qBACd,UACA,iBACoB;AACpB,QAAM,aAAa,6BAA6B,QAAQ,EAAE;AAAA,IACxD,CAAC,UAAU,MAAM,oBAAoB;AAAA,EACvC;AACA,MAAI,YAAY,oBAAoB,OAAW,QAAO,WAAW;AACjE,SAAO,yBAAyB,eAAe,IAC3C,wCACA;AACN;AAEA,SAAS,8BAAqD;AAC5D,SAAO;AAAA,IACL;AAAA,MACE,GAAG,wBAAwB;AAAA,MAC3B,QAAQ;AAAA,MACR,qBAAqB,CAAC;AAAA,MACtB,qBAAqB;AAAA,MACrB,8BAA8B;AAAA,MAC9B,uBAAuB;AAAA,IACzB;AAAA,IACA;AAAA,MACE,GAAG,wBAAwB;AAAA,MAC3B,QAAQ;AAAA,MACR,qBAAqB,CAAC,iBAAiB;AAAA,MACvC,qBAAqB;AAAA,MACrB,8BAA8B;AAAA,MAC9B,uBAAuB;AAAA,IACzB;AAAA,EACF,EAAE,IAAI,CAAC,UAAU,oBAAoB,MAAM,KAAK,CAAC;AACnD;AAEA,SAAS,+BAA+B,UAA2C;AACjF,MAAI,SAAS,8BAA8B,QAAW;AACpD,WAAOA,GAAE,MAAM,mBAAmB,EAAE,MAAM,KAAK,MAAM,SAAS,yBAAyB,CAAC;AAAA,EAC1F;AACA,QAAM,WAAW,sBAAsB,QAAQ,EAAE;AACjD,MAAI,SAAU,QAAO,SAAS,IAAI,CAAC,UAAU,oBAAoB,MAAM,KAAK,CAAC;AAC7E,SAAO,4BAA4B;AACrC;AAEO,SAAS,kCAAkC,UAA8B;AAC9E,SAAO,+BAA+B,QAAQ,EAAE,IAAI,CAAC,UAAU,MAAM,eAAe;AACtF;AAEO,SAAS,0CAA0C,UAA8B;AACtF,SAAO,+BAA+B,QAAQ,EAAE,IAAI,CAAC,UAAU,MAAM,kBAAkB;AACzF;AAEO,SAAS,6CAA6C,UAA8B;AACzF,OAAK;AACL,SAAO,CAAC;AACV;AAEO,SAAS,+BAA+B,UAA8B;AAC3E,SAAO,iBAAiB,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC;AACnF;AAEA,SAAS,kCAAkC,UAA8C;AACvF,MAAI,SAAS,iCAAiC,QAAW;AACvD,WAAOA,GAAE,MAAM,sBAAsB,EAAE,MAAM,KAAK,MAAM,SAAS,4BAA4B,CAAC;AAAA,EAChG;AACA,QAAM,WAAW,sBAAsB,QAAQ,EAAE;AACjD,MAAI,SAAU,QAAO,SAAS,IAAI,CAAC,UAAU,uBAAuB,MAAM,KAAK,CAAC;AAChF,SAAO,CAAC,GAAG,0BAA0B;AACvC;AAEO,SAAS,qCAAqC,UAA8B;AACjF,SAAO,kCAAkC,QAAQ,EAAE,IAAI,CAAC,UAAU,MAAM,eAAe;AACzF;AAEA,SAAS,6BAA6B,SAAyB;AAC7D,SAAO,GAAG,oCAAoC,GAC5C,QAAQ,WAAW,0BAA0B,IACzC,QAAQ,MAAM,2BAA2B,MAAM,IAC/C,OACN;AACF;AAEO,SAAS,6CAA6C,UAA8B;AACzF,SAAO,kCAAkC,QAAQ,EAAE;AAAA,IAAQ,CAAC,UAC1D,CAAC,MAAM,iBAAiB,GAAG,MAAM,OAAO,EAAE,IAAI,4BAA4B;AAAA,EAC5E;AACF;AAEO,SAAS,gDAAgD,UAA8B;AAC5F,OAAK;AACL,SAAO,CAAC;AACV;AAQA,SAAS,6BAA6B,UAAyC;AAC7E,MAAI,SAAS,4BAA4B,QAAW;AAClD,WAAOA,GAAE,MAAM,iBAAiB,EAAE,MAAM,KAAK,MAAM,SAAS,uBAAuB,CAAC;AAAA,EACtF;AACA,QAAM,WAAW,sBAAsB,QAAQ,EAAE;AACjD,MAAI,SAAU,QAAO,SAAS,IAAI,CAAC,UAAU,kBAAkB,MAAM,KAAK,CAAC;AAC3E,SAAO,CAAC,GAAG,qBAAqB;AAClC;AAGA,SAAS,0BAA0B,iBAA6D;AAC9F,QAAM,UAAU,OAAO,OAAO,8BAA8B,eAAe,IACvE,6BAA6B,eAAe,IAC5C;AACJ,SAAO,YAAY,SAAY,SAAY,8BAA8B,OAAO;AAClF;AAEO,SAAS,gCAAgC,UAA8B;AAC5E,SAAO,6BAA6B,QAAQ,EAAE,IAAI,CAAC,UAAU,MAAM,eAAe;AACpF;AAEA,SAAS,wBAAwB,SAAyB;AACxD,SAAO,GAAG,+BAA+B,GACvC,QAAQ,WAAW,qBAAqB,IACpC,QAAQ,MAAM,sBAAsB,MAAM,IAC1C,OACN;AACF;AAEO,SAAS,wCAAwC,UAA8B;AACpF,SAAO,6BAA6B,QAAQ,EAAE;AAAA,IAAQ,CAAC,UACrD,CAAC,MAAM,iBAAiB,GAAG,MAAM,OAAO,EAAE,IAAI,uBAAuB;AAAA,EACvE;AACF;AAEO,SAAS,2CAA2C,UAA8B;AACvF,OAAK;AACL,SAAO,CAAC;AACV;AAkBO,IAAM,sBAA8D;AAAA,EACzE,eAAe;AAAA,IACb,SAAS;AAAA;AAAA,MAEP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA;AAAA,QAEE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,aAAa;AAAA,IACX,SAAS;AAAA;AAAA,MAEP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,cAAc;AAAA,IACZ,SAAS;AAAA;AAAA,MAEP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,eAAe;AAAA,IACb,SAAS;AAAA;AAAA,MAEP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA;AAAA,QAEE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,gBAAgB;AAAA,IACd,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,CAAC,wBAAwB,SAAS,SAAS,GAAG;AAAA,IAC5C,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,EACF;AAAA,EACA,CAAC,wBAAwB,KAAK,SAAS,GAAG;AAAA,IACxC,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,qCAAqC;AAAA,IACnC,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,EACF;AACF;AAGO,IAAM,2BAAmE;AAAA;AAAA;AAAA;AAAA,EAI9E,eAAe;AAAA,IACb,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,GAAG,OAAO;AAAA,IAEN;AAAA,MACE,CAAC,YAAY,GAAO;AAAA,MACpB,CAAC,YAAY,GAAO;AAAA,MACpB,CAAC,YAAY,GAAO;AAAA,IACtB,EACA,IAAI,CAAC,CAAC,OAAO,WAAW,MAAM;AAAA,MAC9B;AAAA,MACA;AAAA,QACE,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,QACA,iBAAiB;AAAA,UACf;AAAA,YACE,oBAAoB;AAAA,YACpB,SAAS;AAAA,cACP,6BAA6B;AAAA,cAC7B,mCAAmC,cAAc;AAAA,cACjD,8BAA8B;AAAA,cAC9B,WAAW;AAAA,YACb;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,GAAG,OAAO;AAAA,IAEN;AAAA,MACE,CAAC,mBAAmB,KAAW,KAAS,KAAW,GAAU;AAAA,MAC7D,CAAC,qBAAqB,KAAW,KAAS,MAAW,GAAU;AAAA,MAC/D,CAAC,iBAAiB,KAAW,KAAS,OAAW,IAAU;AAAA,MAC3D,CAAC,mBAAmB,KAAW,KAAS,MAAW,GAAU;AAAA,MAC7D,CAAC,mBAAmB,KAAW,KAAS,OAAW,IAAU;AAAA,MAC7D,CAAC,mBAAmB,KAAW,KAAS,OAAW,IAAU;AAAA,MAC7D,CAAC,mBAAmB,KAAW,KAAS,OAAW,IAAU;AAAA,MAC7D,CAAC,qBAAqB,KAAW,KAAS,OAAW,IAAU;AAAA,MAC/D,CAAC,6BAA6B,KAAW,KAAS,OAAW,GAAS;AAAA,IACxE,EACA,IAAI,CAAC,CAAC,OAAO,OAAO,aAAa,YAAY,MAAM,MAAM;AAAA,MACzD;AAAA,MACA;AAAA,QACE,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAIA,oBAAoB;AAAA,IAClB,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAKA,IAAM,oCAA4D;AAAA,EAChE,SAAS;AAAA,IACP,6BAA6B;AAAA,IAC7B,mCAAmC;AAAA,IACnC,kCAAkC;AAAA,IAClC,8BAA8B;AAAA,IAC9B,WAAW;AAAA,EACb;AACF;AAqBO,IAAM,uBAGT;AAAA;AAAA,EAEF,QAAQ,CAAC;AAAA,EACT,OAAO,CAAC;AAAA,EACR,MAAM,CAAC;AAAA,EACP,OAAO;AAAA,IACL,EAAE,OAAO,gBAAgB,KAAK,0BAA0B;AAAA,IACxD,EAAE,OAAO,gBAAgB,KAAK,0BAA0B;AAAA,IACxD,EAAE,OAAO,oBAAoB,KAAK,8BAA8B;AAAA,EAClE;AAAA,EACA,SAAS,CAAC,EAAE,OAAO,iBAAiB,KAAK,2BAA2B,CAAC;AAAA,EACrE,SAAS,CAAC,EAAE,OAAO,iBAAiB,KAAK,2BAA2B,CAAC;AAAA,EACrE,KAAK,CAAC,EAAE,OAAO,aAAa,KAAK,uBAAuB,CAAC;AAAA,EACzD,QAAQ,CAAC,EAAE,OAAO,gBAAgB,KAAK,0BAA0B,CAAC;AAAA,EAClE,YAAY,CAAC,EAAE,OAAO,uBAAuB,KAAK,iCAAiC,CAAC;AAAA,EACpF,QAAQ;AAAA,IACN,EAAE,OAAO,eAAe,KAAK,wBAAwB;AAAA,IACrD,EAAE,OAAO,mBAAmB,KAAK,6BAA6B;AAAA,EAChE;AAAA,EACA,aAAa;AAAA,IACX,EAAE,OAAO,sBAAsB,KAAK,gCAAgC;AAAA,IACpE,EAAE,OAAO,qBAAqB,KAAK,+BAA+B;AAAA,IAClE,EAAE,OAAO,oBAAoB,KAAK,6BAA6B;AAAA,EACjE;AAAA;AAAA,EAEA,SAAS;AAAA,IACP,EAAE,OAAO,iBAAiB,KAAK,2BAA2B;AAAA,IAC1D,EAAE,OAAO,iBAAiB,KAAK,2BAA2B;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,YAAY,CAAC;AACf;AAGO,SAAS,6BAA6B,SAAmD;AAC9F,UAAQ,qBAAqB,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,MAAM,GAAG;AACvE;AAEA,SAAS,4CAA4C,UAA6B;AAChF,UAAQ,SAAS,sBAAsB;AAAA,IACrC,KAAK;AACH,aAAO;AAAA,QACL,SAAS,sCACR,SAAS,iCAAiC,SAAS;AAAA,MACtD;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,SAAS,mCACT,SAAS,+BACT,SAAS;AAAA,MACX;AAAA,IACF,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,QACL,SAAS,yBACT,SAAS,4BACT,SAAS;AAAA,MACX;AAAA,IACF,SAAS;AACP,YAAM,cAAqB,SAAS;AACpC,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,MAAc,QAA+C;AAC7F,QAAM,QAAQ,OAAO,IAAI;AACzB,SAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AACpD;AAGA,IAAI,uCAAuC;AAEpC,SAAS,YAAY,SAA4B,QAAQ,KAAe;AAC7E,QAAM,WAAW,CAAC,SAAqC,yBAAyB,MAAM,MAAM;AAC5F,QAAM,qBAAqB,SAAS,+BAA+B;AACnE,QAAM,sBACJ,SAAS,iCAAiC,MACzC,uBAAuB,aAAa,OAAO;AAC9C,QAAM,MAAM;AAAA,IACV,aAAa,SAAS,uBAAuB;AAAA,IAC7C,aAAa,SAAS,sBAAsB;AAAA,IAC5C,oBACE,SAAS,8BAA8B,KACvC,SAAS,gBAAgB,KACzB,SAAS,YAAY;AAAA,IACvB,eAAe,SAAS,yBAAyB;AAAA,IACjD,aAAa,SAAS,uBAAuB;AAAA,IAC7C,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,oBAAoB,SAAS,gCAAgC;AAAA,IAC7D,4BAA4B,SAAS,uCAAuC;AAAA,IAC5E,UAAU,SAAS,oBAAoB;AAAA,IACvC,aAAa,SAAS,uBAAuB;AAAA,IAC7C,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,SAAS,SAAS,mBAAmB;AAAA,IACrC,cAAc,SAAS,wBAAwB;AAAA,IAC/C,mBAAmB,SAAS,6BAA6B;AAAA,IACzD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,oCAAoC;AAAA,MAClC;AAAA,IACF;AAAA,IACA,oCAAoC,SAAS,iDAAiD;AAAA,IAC9F,mCAAmC,SAAS,iDAAiD;AAAA,IAC7F,gCAAgC,SAAS,4CAA4C;AAAA,IACrF,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,kCAAkC,SAAS,gDAAgD;AAAA,IAC3F,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,gCAAgC,SAAS,6CAA6C;AAAA,IACtF,iCAAiC,SAAS,+CAA+C;AAAA,IACzF,gCAAgC,SAAS,8CAA8C;AAAA,IACvF,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,2BACE,SAAS,sCAAsC,KAAK,SAAS,6BAA6B;AAAA,IAC5F,0BACE,SAAS,qCAAqC,KAAK,SAAS,4BAA4B;AAAA,IAC1F,kCAAkC,SAAS,6CAA6C;AAAA,IACxF,iCAAiC,SAAS,4CAA4C;AAAA,IACtF,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,cAAc,SAAS,wBAAwB;AAAA,IAC/C,eAAe,SAAS,0BAA0B;AAAA,IAClD,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,YAAY,SAAS,uBAAuB;AAAA,IAC5C,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,aAAa,SAAS,uBAAuB;AAAA,IAC7C,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,uBAAuB,SAAS,uCAAuC;AAAA,IACvE,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,8BAA8B,SAAS,yCAAyC;AAAA,IAChF,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,qBAAqB,SAAS,+BAA+B;AAAA,IAC7D,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,wCAAwC;AAAA,MACtC;AAAA,IACF;AAAA,IACA,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,iCAAiC,SAAS,6CAA6C;AAAA,IACvF,uCAAuC;AAAA,MACrC;AAAA,IACF;AAAA,IACA,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,eAAe,SAAS,0BAA0B;AAAA,IAClD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,cAAc,SAAS,wBAAwB;AAAA,IAC/C,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,yBAAyB,SAAS,sCAAsC;AAAA,IACxE,yBAAyB,SAAS,sCAAsC;AAAA,IACxE,6BAA6B,SAAS,2CAA2C;AAAA,IACjF,oCAAoC;AAAA,MAClC;AAAA,IACF;AAAA,IACA,kCAAkC,SAAS,gDAAgD;AAAA,IAC3F,kCAAkC,SAAS,gDAAgD;AAAA,IAC3F,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,kCAAkC,SAAS,+CAA+C;AAAA,IAC1F,wCAAwC;AAAA,MACtC;AAAA,IACF;AAAA,IACA,oCAAoC;AAAA,MAClC;AAAA,IACF;AAAA,IACA,kCAAkC,SAAS,gDAAgD;AAAA,IAC3F,eAAe,SAAS,gCAAgC;AAAA,IACxD,mBAAmB,SAAS,oCAAoC;AAAA,IAChE,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,sBAAsB,SAAS,mCAAmC;AAAA,IAClE,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,2BAA2B,SAAS,yCAAyC;AAAA,IAC7E,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,iCAAiC,SAAS,qCAAqC;AAAA,IAC/E,6BAA6B,SAAS,yCAAyC;AAAA,IAC/E,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,iCAAiC,SAAS,8CAA8C;AAAA,IACxF,cAAc,SAAS,wBAAwB;AAAA,IAC/C,WAAW,SAAS,qBAAqB;AAAA,IACzC,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,SAAS,SAAS,mBAAmB;AAAA,IACrC,SAAS,SAAS,mBAAmB;AAAA,IACrC,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,wBAAwB,SAAS,2BAA2B;AAAA,IAC5D,gBAAgB,SAAS,kBAAkB;AAAA,IAC3C,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,gBAAgB,SAAS,0BAA0B;AAAA,IACnD,cAAc,SAAS,yBAAyB,KAAK,SAAS,gBAAgB;AAAA,IAC9E,eAAe,SAAS,0BAA0B,KAAK,SAAS,iBAAiB;AAAA,IACjF,aAAa,SAAS,uBAAuB;AAAA,IAC7C,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,uBAAuB,SAAS,oCAAoC;AAAA,IACpE,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,uCAAuC;AAAA,MACrC;AAAA,IACF;AAAA,IACA,0CAA0C;AAAA,MACxC;AAAA,IACF;AAAA,IACA,oCAAoC,SAAS,iDAAiD;AAAA,IAC9F,kCAAkC,SAAS,+CAA+C;AAAA,IAC1F,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,0CAA0C;AAAA,MACxC;AAAA,IACF;AAAA,IACA,0CAA0C;AAAA,MACxC;AAAA,IACF;AAAA,IACA,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,uCAAuC;AAAA,MACrC;AAAA,IACF;AAAA,IACA,iCAAiC,SAAS,+CAA+C;AAAA,IACzF,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,yBAAyB,SAAS,sCAAsC;AAAA,IACxE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,uBAAuB,SAAS,oCAAoC;AAAA,IACpE,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,iBAAiB,SAAS,6BAA6B;AAAA,IACvD,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,qBAAqB,SAAS,kCAAkC;AAAA,IAChE,yBAAyB,SAAS,sCAAsC;AAAA,IACxE,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,oBAAoB,SAAS,gCAAgC;AAAA,IAC7D,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,4BAA4B,SAAS,yCAAyC;AAAA,IAC9E,oCAAoC,SAAS,yCAAyC;AAAA,IACtF,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,kBAAkB,SAAS,6BAA6B;AAAA,IACxD;AAAA,IACA;AAAA,IACA,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,aAAa,SAAS,wBAAwB;AAAA,IAC9C,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,kCAAkC,SAAS,+CAA+C;AAAA,IAC1F,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,8BAA8B,SAAS,yCAAyC;AAAA,IAChF,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,gCAAgC,SAAS,4CAA4C;AAAA,IACrF,iCAAiC,SAAS,6CAA6C;AAAA,IACvF,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,0CAA0C;AAAA,MACxC;AAAA,IACF;AAAA,IACA,iCAAiC,SAAS,8CAA8C;AAAA,IACxF,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,iCAAiC,SAAS,6CAA6C;AAAA,IACvF,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,8BAA8B,oCAAoC,MAAM;AAAA,IACxE,iBAAiB,SAAS,6BAA6B;AAAA,IACvD,kBAAkB,SAAS,8BAA8B;AAAA,IACzD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,gBAAgB,SAAS,4BAA4B;AAAA,IACrD,iBAAiB,SAAS,6BAA6B;AAAA,IACvD,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,WAAW,SAAS,sBAAsB;AAAA,IAC1C,YAAY,SAAS,uBAAuB;AAAA,IAC5C,UAAU,SAAS,oBAAoB;AAAA,IACvC,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,oBAAoB,SAAS,gCAAgC;AAAA,IAC7D,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,oBAAoB,SAAS,gCAAgC;AAAA,IAC7D,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,gBAAgB,SAAS,0BAA0B;AAAA,IACnD,aAAa,SAAS,uBAAuB;AAAA,IAC7C,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,eAAe,SAAS,yBAAyB;AAAA,IACjD,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,cAAc,SAAS,yBAAyB;AAAA,IAChD,eAAe,SAAS,0BAA0B,KAAK;AAAA,IACvD,gCAAgC,SAAS,4CAA4C;AAAA,IACrF,cAAc,SAAS,yBAAyB;AAAA,IAChD,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,cAAc,SAAS,wBAAwB;AAAA,IAC/C,cAAc,SAAS,yBAAyB;AAAA,IAChD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,yBAAyB,SAAS,4BAA4B;AAAA,IAC9D,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,oBAAoB,SAAS,8BAA8B;AAAA,IAC3D,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,eAAe,SAAS,0BAA0B;AAAA,IAClD,eAAe,SAAS,0BAA0B;AAAA,IAClD,eAAe,SAAS,yBAAyB;AAAA,IACjD,cAAc,SAAS,wBAAwB;AAAA,IAC/C,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,iCAAiC,SAAS,+CAA+C;AAAA,IACzF,eAAe,SAAS,0BAA0B;AAAA,IAClD,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,eAAe,SAAS,yBAAyB;AAAA,IACjD,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,WAAW,SAAS,sBAAsB;AAAA,IAC1C,WAAW,SAAS,qBAAqB;AAAA,IACzC,WAAW,SAAS,sBAAsB;AAAA,IAC1C,eAAe,SAAS,0BAA0B;AAAA,IAClD,aAAa,SAAS,uBAAuB;AAAA,IAC7C,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,eAAe,SAAS,0BAA0B;AAAA,IAClD,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,cAAc,SAAS,yBAAyB;AAAA,IAChD,aAAa,SAAS,uBAAuB;AAAA,IAC7C,cAAc,SAAS,wBAAwB;AAAA,IAC/C,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,gCAAgC,SAAS,8CAA8C;AAAA,IACvF,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,WAAW,SAAS,qBAAqB;AAAA,IACzC,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,uCAAuC;AAAA,MACrC;AAAA,IACF;AAAA,IACA,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,cAAc,SAAS,yBAAyB;AAAA,IAChD,gBAAgB,SAAS,0BAA0B;AAAA,IACnD,6BAA6B,SAAS,yCAAyC;AAAA,IAC/E,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,aAAa,SAAS,uBAAuB;AAAA,IAC7C,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,cAAc,SAAS,yBAAyB;AAAA,IAChD,eAAe,SAAS,yBAAyB;AAAA,IACjD,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,4BAA4B,SAAS,uCAAuC;AAAA,IAC5E,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,kCAAkC,SAAS,gDAAgD;AAAA,IAC3F,kCAAkC,SAAS,8CAA8C;AAAA,IACzF,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,yCAAyC;AAAA,MACvC;AAAA,IACF;AAAA,IACA,eAAe,SAAS,0BAA0B;AAAA,IAClD,eAAe,SAAS,0BAA0B;AAAA,IAClD,cAAc,SAAS,wBAAwB;AAAA,IAC/C,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,cAAc,SAAS,wBAAwB;AAAA,IAC/C,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,4BAA4B,SAAS,yCAAyC;AAAA,IAC9E,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,6BAA6B,SAAS,iCAAiC;AAAA,IACvE,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,kCAAkC,SAAS,+CAA+C;AAAA,IAC1F,kCAAkC,SAAS,+CAA+C;AAAA,IAC1F,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,gCAAgC,SAAS,6CAA6C;AAAA,IACtF,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,4BAA4B,SAAS,yCAAyC;AAAA,IAC9E,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,oBAAoB,SAAS,gCAAgC;AAAA,IAC7D,iCAAiC,SAAS,8CAA8C;AAAA,IACxF,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,oCAAoC;AAAA,MAClC;AAAA,IACF;AAAA,IACA,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,mCAAmC,SAAS,iDAAiD;AAAA,IAC7F,4BAA4B,SAAS,uCAAuC;AAAA,IAC5E,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,oCAAoC,SAAS,iDAAiD;AAAA,IAC9F,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,iCAAiC,SAAS,8CAA8C;AAAA,IACxF,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,gBAAgB,SAAS,0BAA0B;AAAA,IACnD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,8BAA8B,SAAS,6CAA6C;AAAA,IACpF,iCAAiC,SAAS,gDAAgD;AAAA,IAC1F,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,mCAAmC;AAAA,MACjC;AAAA,IACF;AAAA,IACA,wBAAwB,SAAS,sCAAsC;AAAA,IACvE,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,4BAA4B,SAAS,0CAA0C;AAAA,IAC/E,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,+BAA+B,SAAS,6CAA6C;AAAA,IACrF,0BAA0B,SAAS,wCAAwC;AAAA,IAC3E,sBAAsB,SAAS,mCAAmC;AAAA,IAClE,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,+BAA+B,SAAS,6CAA6C;AAAA,IACrF,6BAA6B,SAAS,2CAA2C;AAAA,IACjF,8BAA8B,SAAS,4CAA4C;AAAA,IACnF,gCAAgC,SAAS,8CAA8C;AAAA,IACvF,mCAAmC,SAAS,kDAAkD;AAAA,IAC9F,wCAAwC;AAAA,MACtC;AAAA,IACF;AAAA,IACA,iCAAiC,SAAS,+CAA+C;AAAA,IACzF,aAAa,SAAS,uBAAuB;AAAA,IAC7C,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,+BAA+B,SAAS,6CAA6C;AAAA,IACrF,wCAAwC;AAAA,MACtC;AAAA,IACF;AAAA,IACA,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,6BAA6B,SAAS,yCAAyC;AAAA,IAC/E,oCAAoC;AAAA,MAClC;AAAA,IACF;AAAA,IACA,iCAAiC,SAAS,gDAAgD;AAAA,IAC1F,iCAAiC,SAAS,gDAAgD;AAAA,IAC1F,yCAAyC;AAAA,MACvC;AAAA,IACF;AAAA,IACA,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,gCAAgC,SAAS,6CAA6C;AAAA,IACtF,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,6BAA6B,SAAS,yCAAyC;AAAA,IAC/E,gCAAgC,SAAS,4CAA4C;AAAA,IACrF,mCAAmC,SAAS,iDAAiD;AAAA,IAC7F,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,oCAAoC,SAAS,iDAAiD;AAAA,IAC9F,4CAA4C;AAAA,MAC1C;AAAA,IACF;AAAA,IACA,+CAA+C;AAAA,MAC7C;AAAA,IACF;AAAA,IACA,kDAAkD;AAAA,MAChD;AAAA,IACF;AAAA,IACA,oCAAoC;AAAA,MAClC;AAAA,IACF;AAAA,IACA,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,iCAAiC,SAAS,+CAA+C;AAAA,IACzF,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,oBAAoB,SAAS,iCAAiC;AAAA,IAC9D,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,4CAA4C;AAAA,MAC1C;AAAA,IACF;AAAA,IACA,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,eAAe,SAAS,0BAA0B;AAAA,IAClD,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,aAAa,SAAS,wBAAwB;AAAA,IAC9C,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,iCAAiC,SAAS,8CAA8C;AAAA,IACxF,eAAe,SAAS,0BAA0B;AAAA,IAClD,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,qBAAqB,SAAS,kCAAkC;AAAA,IAChE,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,4BAA4B,SAAS,yCAAyC;AAAA,IAC9E,uBAAuB,SAAS,oCAAoC;AAAA,IACpE,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,6BAA6B,SAAS,2CAA2C;AAAA,IACjF,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,mBACE,OAAO,iCAAiC,SACpC,SACA,OAAO,6BAA6B,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAAA,IAChF,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,kBACE,OAAO,gCAAgC,SACnC,SACA,OAAO,4BAA4B,MAAM,GAAG,EACzC,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAC7B,OAAO,OAAO;AAAA,IACvB,cACE,OAAO,4BAA4B,SAC/B,SACA,OAAO,wBAAwB,MAAM,GAAG,EACrC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,EACrB,OAAO,OAAO;AAAA,IACvB,WAAW,SAAS,sBAAsB;AAAA,IAC1C,YAAY,SAAS,uBAAuB;AAAA,IAC5C,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,0CAA0C;AAAA,MACxC;AAAA,IACF;AAAA,IACA,qDAAqD;AAAA,MACnD;AAAA,IACF;AAAA,IACA,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,cAAc,SAAS,yBAAyB;AAAA,IAChD,WAAW,SAAS,qBAAqB;AAAA,IACzC,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,YAAY,gBAAgB,SAAS,sBAAsB,CAAC;AAAA,EAC9D;AACA,QAAM,SAAS,eAAe,MAAM,GAAG;AACvC,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH,oBACE,IAAI,uBAAuB,UAAa,OAAO,mBAAmB,UAC9D,KAAK,IAAI,KAAQ,KAAK,MAAO,OAAO,sBAAsB,MAAQ,CAAC,CAAC,IACpE,OAAO;AAAA,IACb,uBACE,IAAI,0BAA0B,UAAa,OAAO,mBAAmB,UACjE,KAAK;AAAA,MACH;AAAA,MACA,KAAK;AAAA,QACH,KAAK,MAAO,OAAO,sBAAsB,MAAQ,CAAC;AAAA,QAClD,yCACE,+BAA+B;AAAA,UAC7B,0BAA0B,KAAK;AAAA,YAC7B,OAAO;AAAA,YACP,OAAO,iCAAiC,OAAO;AAAA,UACjD;AAAA,QACF,CAAC,IACD,IAAI,OAAO,6BACX;AAAA,MACJ;AAAA,IACF,IACA,OAAO;AAAA,IACb,YAAY,wBAAwB,MAAM;AAAA,EAC5C;AACA,MAAI,IAAI,oCAAoC,QAAW;AAIrD,UAAM,qBACJ,SAAS,mBAAmB,WAAW,SAAS,4BAA4B,SACxE,SAAS,0BAA0B,MACnC,SAAS,6BACT,+BAA+B;AAAA,MAC7B,0BAA0B,uCAAuC,QAAQ;AAAA,IAC3E,CAAC,IACD,IACA,OAAO;AACb,UAAM,UAAU,KAAK;AAAA,MACnB;AAAA,MACA,KAAK,OAAO,SAAS,qBAAqB,SAAS,yBAAyB,CAAC;AAAA,MAC7E;AAAA,IACF;AAGA,QAAI,UAAU,SAAS,oBAAoB;AACzC,eAAS,kCAAkC;AAAA,IAC7C,OAAO;AACL,eAAS,kCAAkC;AAC3C,UAAI,CAAC,sCAAsC;AACzC,+CAAuC;AACvC,gBAAQ;AAAA,UACN,sGACqC,SAAS,kBAAkB;AAAA,QAElE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,gCAA8B,MAAM;AACpC,mBAAiB,UAAU,MAAM;AACjC,SAAO;AACT;AAOA,IAAM,8BAA+E;AAAA,EACnF;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,EACV;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,EACV;AACF;AAEA,IAAM,kCAAkC,oBAAI,IAAY;AAExD,SAAS,8BAA8B,QAAiC;AACtE,aAAW,EAAE,MAAM,OAAO,KAAK,6BAA6B;AAC1D,QAAI,OAAO,IAAI,MAAM,UAAa,gCAAgC,IAAI,IAAI,EAAG;AAC7E,oCAAgC,IAAI,IAAI;AACxC,YAAQ;AAAA,MACN,YAAY,IAAI,4BAA4B,MAAM;AAAA,IACpD;AAAA,EACF;AACF;AAEA,IAAM,sCAAsC;AAQrC,SAAS,kCAAkC,UAAwC;AACxF,QAAM,WAAW,SAAS,kBAAkB,KAAK;AACjD,MAAI,SAAU,QAAO;AACrB,QAAM,sBAAsB,SAAS,WAAW,KAAK;AACrD,MAAI,SAAS,sBAAsB,gBAAgB,SAAS,gBAAgB,qBAAqB;AAC/F,WAAO;AAAA,EACT;AACA,SAAO,SAAS,sBAAsB,YACnC,SAAS,gBAAgB,WAAW,SAAS,gBAAgB,UAC5D,sCACA;AACN;AAYA,IAAM,iCAAuE;AAAA,EAC3E;AAAA,EACA;AACF;AAOO,SAAS,wCACd,UACwC;AACxC,SAAO,IAAI,IAAI,SAAS,+BAA+B,CAAC,IAAI,8BAA8B;AAC5F;AAGO,SAAS,+BACd,UACyB;AACzB,QAAM,cAAc,wCAAwC,QAAQ;AACpE,QAAMG,WAAU;AAAA,IACd,SAAS,6BAA6B,CAAC,GAAG,0BAA0B;AAAA,EACtE,EAAE,OAAO,CAAC,SAAS,CAAC,6BAA6B,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC;AAChF,QAAM,aAAa,IAAI,IAAIA,QAAO;AAClC,QAAM,WAAW;AAAA,IACf,SAAS,6BAA6B,CAAC,GAAG,6BAA6B;AAAA,EACzE;AACA,SAAO;AAAA,IACL,SAAS,SAAS,OAAO,CAAC,SAAS,WAAW,IAAI,IAAI,CAAC;AAAA,IACvD,SAAS,CAAC,GAAGA,QAAO;AAAA,EACtB;AACF;AAGO,SAAS,oCACd,UACA,UAC6B;AAC7B,QAAM,SAAS,+BAA+B,QAAQ;AACtD,QAAMA,WAAU,IAAI,IAAI,OAAO,OAAO;AACtC,QAAM,QAAQ,IAAI,IAAI,kCAAkC,YAAY,OAAO,OAAO,CAAC;AAEnF,MAAI,MAAM,IAAI,YAAY,EAAG,OAAM,IAAI,aAAa;AACpD,SAAO,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,SAASA,SAAQ,IAAI,IAAI,CAAC;AACtD;AAGO,SAAS,iCACd,UACA,SACA,mBAC6B;AAC7B,MAAI,WACF,QAAQ;AACV,MAAI,QAAQ,WAAW,mBAAmB,qBAAqB;AAE7D,UAAM,WAAW,oCAAoC,iBAAiB,GAAG;AACzE,UAAM,YAAY,QAAQ,WAAW,uBAAuB,CAAC;AAC7D,eAAW,UAAU,SACjB;AAAA,MACE,GAAG,oBAAI,IAAI;AAAA,QACT,GAAI,YAAY,+BAA+B,QAAQ,EAAE;AAAA,QACzD,GAAG;AAAA,MACL,CAAC;AAAA,IACH,IACA;AAAA,EACN;AACA,QAAMA,WAAU,oCAAoC,UAAU,QAAQ;AACtE,SAAO,QAAQ,QAAQ,8BAA8B,QAAQ,OAAOA,QAAO,IAAIA;AACjF;AAaO,SAAS,iCAAiC,UAA4B;AAC3E,SAAO,SAAS,2BAA2B,SAAS;AACtD;AAaO,SAAS,0BACd,UACA,UAA0C,SAAS,gBACxB;AAC3B,MAAI,YAAY,SAAS;AACvB,WAAO;AAAA,MACL,gBAAgB,SAAS,sBAAsB;AAAA,MAC/C,qBAAqB;AAAA,MACrB,uBAAuB,iCAAiC,QAAQ,IAAI;AAAA,MACpE,gBAAgB,SAAS;AAAA,IAC3B;AAAA,EACF;AACA,MAAI,YAAY,eAAe;AAC7B,WAAO;AAAA,MACL,gBAAgB;AAAA,MAChB,qBAAqB,SAAS;AAAA,MAC9B,uBAAuB;AAAA,MACvB,gBAAgB;AAAA,IAClB;AAAA,EACF;AACA,SAAO;AAAA,IACL,gBAAgB,uBAAuB,OAAO,EAAE,SAAS,kBAAkB;AAAA,IAC3E,qBAAqB;AAAA,IACrB,uBAAuB;AAAA,IACvB,gBAAgB;AAAA,EAClB;AACF;AAKO,SAAS,sCACd,UACA,SACe;AACf,QAAM,YAAY,0BAA0B,UAAU,OAAO;AAC7D,MAAI,UAAU,mBAAmB,KAAM,QAAO,UAAU;AACxD,SAAO,UAAU,wBAAwB,OAAO,UAAU,sBAAsB,MAAO;AACzF;AAUO,SAAS,+BACd,UACQ;AACR,SAAO,KAAK;AAAA,IACV;AAAA,IACA,SAAS,2BAA2B;AAAA,EACtC;AACF;AAIO,SAAS,uCACd,UACQ;AACR,SAAO,SAAS,iCAAiC,SAAS;AAC5D;AAYO,SAAS,sCACd,UAOQ;AACR,SAAO,KAAK;AAAA,IACV,SAAS;AAAA,IACT,yCACE,+BAA+B;AAAA,MAC7B,0BAA0B,uCAAuC,QAAQ;AAAA,IAC3E,CAAC,IACD,IAAI,SAAS;AAAA,EACjB;AACF;AAEO,SAAS,iCACd,UAIQ;AACR,QAAM,mBAAmB,+BAA+B;AAAA,IACtD,0BAA0B,uCAAuC,QAAQ;AAAA,EAC3E,CAAC;AACD,SAAO,KAAK;AAAA,IACV;AAAA,IACA,SAAS,6BACP,mBACA;AAAA,EACJ;AACF;AAEO,SAAS,0BACd,UACA,SAA4B,QAAQ,KACZ;AACxB,QAAM,MAA8B,CAAC;AACrC,aAAW,QAAQ,gCAAgC,QAAQ,GAAG;AAC5D,UAAM,QAAQ,OAAO,IAAI;AACzB,QAAI,OAAO;AACT,UAAI,IAAI,IAAI;AAAA,IACd;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,sBACd,UACA,SAA4B,QAAQ,KAChB;AACpB,MAAI,SAAS,QAAQ;AACnB,WAAO,SAAS;AAAA,EAClB;AACA,MAAI,SAAS,WAAW;AACtB,UAAM,QAAQ,OAAO,SAAS,SAAS;AACvC,WAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AAAA,EACpD;AACA,SAAO;AACT;AAEA,IAAM,kBAAkB;AACxB,IAAM,6BAA6B,oBAAI,IAAI;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,yBAAyB,IAAI;AAAA,EACjC,gBAAgB,QAAQ,IAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,KAAK,CAAC;AAChE;AACA,IAAM,iBAAiB,IAAI,IAAI,CAAC,QAAQ,SAAS,OAAO,EAAE,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AAC/F,IAAM,qBAAqB,IAAI;AAAA,EAC7B,CAAC,YAAY,YAAY,QAAQ,WAAW,EAAE,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,KAAK,CAAC;AACpF;AAEA,SAAS,yBAAyB,OAAe,YAA4B;AAC3E,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,UAAM,IAAI,MAAM,YAAY,UAAU,oCAAoC;AAAA,EAC5E;AACA,MAAI,IAAI,QAAQ;AACd,UAAM,IAAI;AAAA,MACR,YAAY,UAAU;AAAA,IACxB;AAAA,EACF;AACA,MAAI,IAAI,MAAM;AACZ,UAAM,IAAI,MAAM,YAAY,UAAU,sCAAsC;AAAA,EAC9E;AACA,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,6BAA6B,MAAuB;AAC3D,SAAO,KACJ,YAAY,EACZ,MAAM,QAAQ,EACd,KAAK,CAAC,SAAS,2BAA2B,IAAI,IAAI,CAAC;AACxD;AAEA,SAAS,mBACP,YACA,SACoC;AACpC,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,QAAM,aAAqC,CAAC;AAC5C,QAAM,kBAAkB,oBAAI,IAAoB;AAChD,aAAW,CAAC,SAAS,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AACtD,QAAI,CAAC,gBAAgB,KAAK,OAAO,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,oDAAoD,KAAK,UAAU,OAAO,CAAC;AAAA,MACnG;AAAA,IACF;AACA,UAAM,OAAO,QAAQ,YAAY;AACjC,UAAM,WAAW,gBAAgB,IAAI,IAAI;AACzC,QAAI,aAAa,QAAW;AAC1B,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,yBAAyB,KAAK,UAAU,QAAQ,CAAC,QAAQ,KAAK,UAAU,OAAO,CAAC;AAAA,MACxG;AAAA,IACF;AACA,QAAI,SAAS,iBAAiB;AAC5B,YAAM,IAAI;AAAA,QACR,YAAY,UAAU;AAAA,MACxB;AAAA,IACF;AACA,oBAAgB,IAAI,MAAM,OAAO;AACjC,eAAW,IAAI,IAAI;AAAA,EACrB;AACA,SAAO;AACT;AAEA,SAAS,2BACP,YACA,OACA,SACsB;AACtB,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,aAAuB,CAAC;AAC9B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,WAAW,OAAO;AAC3B,QAAI,CAAC,gBAAgB,KAAK,OAAO,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,8DAA8D,KAAK,UAAU,OAAO,CAAC;AAAA,MAC7G;AAAA,IACF;AACA,UAAM,OAAO,QAAQ,YAAY;AACjC,QAAI,KAAK,IAAI,IAAI,GAAG;AAClB,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,gEAAgE,KAAK,UAAU,IAAI,CAAC;AAAA,MAC5G;AAAA,IACF;AACA,QAAI,EAAE,SAAS,WAAW,CAAC,KAAK;AAC9B,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,kEAAkE,KAAK,UAAU,IAAI,CAAC;AAAA,MAC9G;AAAA,IACF;AACA,QAAI,6BAA6B,IAAI,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,kEAAkE,KAAK,UAAU,IAAI,CAAC;AAAA,MAC9G;AAAA,IACF;AACA,SAAK,IAAI,IAAI;AACb,eAAW,KAAK,IAAI;AAAA,EACtB;AACA,SAAO;AACT;AAEA,SAAS,kBACP,YACA,OACoC;AACpC,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,aAAW,QAAQ,OAAO,KAAK,KAAK,GAAG;AACrC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,YAAY,UAAU,sCAAsC;AAAA,IAC9E;AAAA,EACF;AACA,SAAO,EAAE,GAAG,MAAM;AACpB;AAEA,SAAS,0BACP,YACA,OACA,OACsB;AACtB,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,IAAI,IAAI,GAAG;AAClB,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,oDAAoD,KAAK,UAAU,IAAI,CAAC;AAAA,MAChG;AAAA,IACF;AACA,QAAI,EAAE,SAAS,SAAS,CAAC,KAAK;AAC5B,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,+DAA+D,KAAK,UAAU,IAAI,CAAC;AAAA,MAC3G;AAAA,IACF;AACA,QAAI,6BAA6B,IAAI,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,iEAAiE,KAAK,UAAU,IAAI,CAAC;AAAA,MAC7G;AAAA,IACF;AACA,SAAK,IAAI,IAAI;AAAA,EACf;AACA,SAAO,CAAC,GAAG,KAAK;AAClB;AAEA,SAAS,0BAA0B,UAA8C;AAC/E,QAAM,iBAAiB,mBAAmB,SAAS,IAAI,SAAS,cAAc;AAC9E,QAAM,eAAe,kBAAkB,SAAS,IAAI,SAAS,YAAY;AACzE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,yBAAyB,SAAS,SAAS,SAAS,EAAE;AAAA,IAC/D,GAAI,mBAAmB,SAAY,CAAC,IAAI,EAAE,eAAe;AAAA,IACzD,GAAI,iBAAiB,SAAY,CAAC,IAAI,EAAE,aAAa;AAAA,IACrD,GAAI,SAAS,6BAA6B,SACtC,CAAC,IACD;AAAA,MACE,0BAA0B;AAAA,QACxB,SAAS;AAAA,QACT,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,IACJ,GAAI,SAAS,4BAA4B,SACrC,CAAC,IACD;AAAA,MACE,yBAAyB;AAAA,QACvB,SAAS;AAAA,QACT,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACN;AACF;AAEA,SAAS,8BACP,SACwB;AACxB,SAAO,aAAa,UAAU,UAAU,EAAE,SAAS,QAAQ;AAC7D;AAEA,SAAS,sBAAsB,cAAwD;AACrF,QAAM,SAAS,0BAA0B,MAAM,YAAY;AAC3D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW;AAAA,MACT,GAAG,OAAO;AAAA,MACV,SAAS,CAAC,GAAG,OAAO,UAAU,OAAO,EAAE;AAAA,QACrC,CAAC,MAAM,WACJ,uBAAuB,IAAI,IAAI,KAAK,MAAM,uBAAuB,IAAI,KAAK,KAAK;AAAA,MACpF;AAAA,IACF;AAAA,IACA,iBAAiB,CAAC,GAAG,OAAO,eAAe,EAAE;AAAA,MAC3C,CAAC,MAAM,WAAW,eAAe,IAAI,IAAI,KAAK,MAAM,eAAe,IAAI,KAAK,KAAK;AAAA,IACnF;AAAA,IACA,qBAAqB,CAAC,GAAG,IAAI,IAAI,OAAO,mBAAmB,CAAC,EAAE,KAAK;AAAA,IACnE,kBAAkB,CAAC,GAAG,OAAO,gBAAgB,EAAE;AAAA,MAC7C,CAAC,MAAM,WAAW,eAAe,IAAI,IAAI,KAAK,MAAM,eAAe,IAAI,KAAK,KAAK;AAAA,IACnF;AAAA,IACA,cAAc,CAAC,GAAG,OAAO,YAAY,EAAE;AAAA,MACrC,CAAC,MAAM,WACJ,mBAAmB,IAAI,KAAK,EAAE,KAAK,MAAM,mBAAmB,IAAI,MAAM,EAAE,KAAK;AAAA,IAClF;AAAA,EACF;AACF;AAEA,SAAS,wBACP,UACA,OAMqB;AACrB,QAAM,mBAAmB,MAAM,kBAAkB,kCAAkC,QAAQ,IAAI,CAAC;AAChG,SAAO,sBAAsB;AAAA,IAC3B,WAAW;AAAA,MACT,UAAU,MAAM,kBAAkB,cAAc;AAAA,MAChD,UAAU,MAAM;AAAA,MAChB,SAAS;AAAA,MACT,eAAe,MAAM,kBAAkB,SAAS,wBAAwB;AAAA,MACxE,UAAU;AAAA,IACZ;AAAA,IACA,iBAAiB,EAAE,UAAU,WAAW,UAAU,KAAK;AAAA,IACvD,kBAAkB,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,IACzD,aAAa;AAAA,MACX,WAAW;AAAA,QACT,UAAU,MAAM,kBAAkB,cAAc;AAAA,QAChD,UAAU,MAAM;AAAA,MAClB;AAAA,MACA,SAAS,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MAChD,eAAe,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MACtD,iBAAiB;AAAA,QACf,UAAU,MAAM,wBAAwB,cAAc;AAAA,QACtD,UAAU,MAAM,yBAAyB;AAAA,MAC3C;AAAA,IACF;AAAA,IACA,iBAAiB,MAAM,SAAS,CAAC,QAAQ,OAAO,IAAI,CAAC,MAAM;AAAA,IAC3D,qBAAqB;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,kBAAkB,CAAC,MAAM;AAAA,IACzB,YAAY;AAAA,MACV,KAAK,EAAE,UAAU,WAAW,UAAU,KAAK;AAAA,MAC3C,oBAAoB,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MAC3D,eAAe,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,IACxD;AAAA,IACA,cAAc,CAAC,EAAE,IAAI,YAAY,UAAU,WAAW,UAAU,KAAK,CAAC;AAAA,EACxE,CAAC;AACH;AAEO,SAAS,qCACd,iBACA,SAAyC,4BAA4B,GACnC;AAClC,QAAM,QAAQ,OAAO,KAAK,CAAC,cAAc,UAAU,oBAAoB,eAAe;AACtF,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,SAAS;AAAA,MACP,MAAM,CAAC,GAAG,MAAM,SAAS;AAAA,MACzB,SAAS,MAAM,kBAAkB,SAAS;AAAA,IAC5C;AAAA,EACF;AACF;AAEA,SAAS,yBACP,UACA,OAKqB;AACrB,QAAM,SAAS,wBAAwB,UAAU;AAAA,IAC/C,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,EACnB,CAAC;AACD,SAAO,sBAAsB;AAAA,IAC3B,GAAG;AAAA,IACH,iBAAiB,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,IACzD,iBAAiB,MAAM,SAAS,CAAC,QAAQ,OAAO,IAAI,CAAC,MAAM;AAAA,IAC3D,qBAAqB,MAAM,uBAAuB,CAAC;AAAA,IACnD,YAAY;AAAA,MACV,GAAG,OAAO;AAAA,MACV,KAAK,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,IAC/C;AAAA,IACA,eAAe,MAAM,kBACjB,EAAE,UAAU,aAAa,UAAU,MAAM,MAAM,WAAW,IAC1D,EAAE,UAAU,eAAe,UAAU,OAAO,MAAM,OAAO;AAAA;AAAA;AAAA,IAG7D,cAAc,CAAC,EAAE,IAAI,YAAY,UAAU,aAAa,UAAU,KAAK,CAAC;AAAA,EAC1E,CAAC;AACH;AAEA,SAAS,kCAAkC,UAAyC;AAClF,QAAM,SAAS,wBAAwB,UAAU;AAAA,IAC/C,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,EACnB,CAAC;AACD,SAAO,sBAAsB;AAAA,IAC3B,GAAG;AAAA,IACH,iBAAiB,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,IACzD,iBAAiB,CAAC,MAAM;AAAA,IACxB,qBAAqB,CAAC;AAAA,IACtB,YAAY;AAAA,MACV,GAAG,OAAO;AAAA,MACV,KAAK,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,IAC/C;AAAA,IACA,eAAe,EAAE,UAAU,eAAe,UAAU,OAAO,MAAM,OAAO;AAAA,IACxE,cAAc,CAAC,EAAE,IAAI,YAAY,UAAU,aAAa,UAAU,KAAK,CAAC;AAAA,EAC1E,CAAC;AACH;AAEA,SAAS,wBACP,UACA,OAU0B;AAC1B,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,eAAe,MAAM,SAAS;AACpC,QAAM,SAAS,aAAa;AAC5B,QAAM,UAAU,eAAe,CAAC,IAAI,+BAA+B,QAAQ;AAC3E,QAAM,cAAc,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,MAAM,eAAe,CAAC;AACzE,QAAM,aAAa,IAAI;AAAA,IACrB,wBAAwB,SAAS,kBAAkB,EAChD;AAAA,MACC,CAAC,aACC,SAAS,OAAO,iCAChB,SAAS,OAAO;AAAA,IACpB,EACC;AAAA,MAAQ,CAAC,aACR,SAAS,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,GAAI,MAAM,WAAW,CAAC,CAAE,CAAC;AAAA,IACzE;AAAA,EACJ;AACA,QAAM,SAAS,QAAQ,IAAI,CAAC,UAAU;AACpC,UAAM,KAAK,YACP,MAAM,qBACN,eACE,GAAG,oCAAoC,GAAG,MAAM,eAAe,KAC/D,MAAM;AACZ,eAAW,IAAI,EAAE;AACjB,WAAO;AAAA,MACL;AAAA,MACA,iBAAiB,MAAM;AAAA,MACvB,OAAO,MAAM;AAAA,MACb,GAAI,MAAM,aAAa,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,MAC3D,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClD,cAAc,yBAAyB,UAAU;AAAA,QAC/C,iBAAiB,MAAM;AAAA,QACvB,QAAQ,MAAM;AAAA,QACd,qBAAqB,MAAM;AAAA,MAC7B,CAAC;AAAA,MACD,qBAAqB,MAAM;AAAA,MAC3B,8BAA8B,MAAM;AAAA,MACpC,uBAAuB,MAAM;AAAA,MAC7B,4BAA4B,SAAS;AAAA,MACrC,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,IAClE;AAAA,EACF,CAAC;AACD,MAAI,QAAQ;AACV,eAAW,UAAU,MAAM,gBAAgB,CAAC,GAAG;AAC7C,YAAM,YAAY,GAAG,YAAY,oCAAoC,oCAAoC,GAAG,OAAO,eAAe;AAKlI,UAAI,YAAY,IAAI,OAAO,eAAe,KAAK,WAAW,IAAI,SAAS,EAAG;AAC1E,kBAAY,IAAI,OAAO,eAAe;AACtC,iBAAW,IAAI,SAAS;AACxB,aAAO,KAAK;AAAA,QACV,IAAI;AAAA,QACJ,iBAAiB,OAAO;AAAA,QACxB,OAAO,OAAO,OAAO,KAAK,KAAK,OAAO;AAAA,QACtC,cAAc,yBAAyB,UAAU;AAAA,UAC/C,iBAAiB;AAAA,UACjB,QAAQ;AAAA,UACR,qBAAqB,CAAC;AAAA,QACxB,CAAC;AAAA,QACD,qBAAqB;AAAA,QACrB,8BAA8B;AAAA,QAC9B,uBAAuB;AAAA,QACvB,4BAA4B,SAAS;AAAA,MACvC,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,IAAI,YACA,gCACA,eACE,mCACA;AAAA,IACN,OAAO,YAAY,iBAAiB,eAAe,yBAAyB;AAAA;AAAA;AAAA;AAAA,IAI5E,KAAK;AAAA,IACL,aAAa;AAAA,IACb,SAAS;AAAA,IACT,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC/C;AAAA,EACF;AACF;AAEA,SAAS,2BACP,UACA,OAUiC;AACjC,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,eAAe,MAAM,SAAS;AACpC,QAAM,SAAS,aAAa;AAC5B,QAAM,UAAU,eAAe,CAAC,IAAI,kCAAkC,QAAQ;AAC9E,QAAM,cAAc,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,MAAM,eAAe,CAAC;AACzE,QAAM,aAAa,IAAI;AAAA,IACrB,wBAAwB,SAAS,kBAAkB,EAChD;AAAA,MACC,CAAC,aACC,SAAS,OAAO,oCAChB,SAAS,OAAO;AAAA,IACpB,EACC;AAAA,MAAQ,CAAC,aACR,SAAS,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,GAAI,MAAM,WAAW,CAAC,CAAE,CAAC;AAAA,IACzE;AAAA,EACJ;AACA,QAAM,SAAqC,QAAQ,IAAI,CAAC,UAAU;AAChE,UAAM,KAAK,YACP,6BAA6B,MAAM,eAAe,IAClD,eACE,GAAG,uCAAuC,GAAG,MAAM,eAAe,KAClE,GAAG,0BAA0B,GAAG,MAAM,eAAe;AAC3D,UAAM,UAAU,YACZ,MAAM,QAAQ,IAAI,4BAA4B,IAC9C,eACE,MAAM,QAAQ,IAAI,CAAC,UAAU,GAAG,uCAAuC,GAAG,KAAK,EAAE,IACjF,MAAM;AACZ,eAAW,IAAI,EAAE;AACjB,eAAW,SAAS,QAAS,YAAW,IAAI,KAAK;AACjD,WAAO;AAAA,MACL;AAAA,MACA,iBAAiB,MAAM;AAAA,MACvB;AAAA,MACA,OAAO,MAAM;AAAA,MACb,GAAI,MAAM,aAAa,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,MAC3D,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClD,cAAc,MAAM;AAAA,MACpB,GAAI,MAAM,wBAAwB,SAC9B,CAAC,IACD,EAAE,qBAAqB,MAAM,oBAAoB;AAAA,MACrD,GAAI,MAAM,iCAAiC,SACvC,CAAC,IACD,EAAE,8BAA8B,MAAM,6BAA6B;AAAA,MACvE,GAAI,MAAM,0BAA0B,SAChC,CAAC,IACD,EAAE,uBAAuB,MAAM,sBAAsB;AAAA,MACzD,4BACE,MAAM,8BAA8B,SAAS;AAAA,IACjD;AAAA,EACF,CAAC;AACD,MAAI,QAAQ;AACV,eAAW,UAAU,MAAM,gBAAgB,CAAC,GAAG;AAC7C,YAAM,YAAY,GAAG,YAAY,uCAAuC,uCAAuC,GAAG,OAAO,eAAe;AACxI,UAAI,YAAY,IAAI,OAAO,eAAe,KAAK,WAAW,IAAI,SAAS,EAAG;AAC1E,kBAAY,IAAI,OAAO,eAAe;AACtC,iBAAW,IAAI,SAAS;AACxB,aAAO,KAAK;AAAA,QACV,IAAI;AAAA,QACJ,iBAAiB,OAAO;AAAA,QACxB,SAAS,CAAC;AAAA,QACV,OAAO,OAAO,OAAO,KAAK,KAAK,OAAO;AAAA,QACtC,cAAc,kCAAkC,QAAQ;AAAA,QACxD,4BAA4B,SAAS;AAAA,MACvC,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,QAAM,iBAAyC;AAAA,IAC7C,WAAW;AAAA,IACX,GAAI,SAAS,gBAAgB,EAAE,gBAAgB,SAAS,cAAc,IAAI,CAAC;AAAA,EAC7E;AACA,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,IAAI,YACA,mCACA,eACE,sCACA;AAAA,IACN,OAAO,YAAY,oBAAoB,eAAe,4BAA4B;AAAA,IAClF,KAAK;AAAA,IACL,aAAa;AAAA,IACb,SAAS;AAAA,IACT,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC/C;AAAA,IACA,0BAA0B,OAAO,KAAK,cAAc;AAAA,IACpD;AAAA,EACF;AACF;AAEA,SAAS,sBACP,UACA,OAUiC;AACjC,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,eAAe,MAAM,SAAS;AACpC,QAAM,SAAS,aAAa;AAC5B,QAAM,UAAU,eAAe,CAAC,IAAI,6BAA6B,QAAQ;AACzE,QAAM,cAAc,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,MAAM,eAAe,CAAC;AACzE,QAAM,aAAa,IAAI;AAAA,IACrB,wBAAwB,SAAS,kBAAkB,EAChD;AAAA,MACC,CAAC,aACC,SAAS,OAAO,+BAChB,SAAS,OAAO;AAAA,IACpB,EACC;AAAA,MAAQ,CAAC,aACR,SAAS,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,GAAI,MAAM,WAAW,CAAC,CAAE,CAAC;AAAA,IACzE;AAAA,EACJ;AACA,QAAM,SAAqC,QAAQ,IAAI,CAAC,UAAU;AAChE,UAAM,KAAK,YACP,wBAAwB,MAAM,eAAe,IAC7C,GAAG,qBAAqB,GAAG,MAAM,eAAe;AACpD,UAAM,UAAU,YAAY,MAAM,QAAQ,IAAI,uBAAuB,IAAI,MAAM;AAC/E,eAAW,IAAI,EAAE;AACjB,eAAW,SAAS,QAAS,YAAW,IAAI,KAAK;AACjD,WAAO;AAAA,MACL;AAAA,MACA,iBAAiB,MAAM;AAAA,MACvB;AAAA,MACA,OAAO,MAAM;AAAA,MACb,GAAI,MAAM,aAAa,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,MAC3D,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClD,cAAc,MAAM;AAAA,MACpB,GAAI,MAAM,wBAAwB,SAC9B,CAAC,IACD,EAAE,qBAAqB,MAAM,oBAAoB;AAAA,MACrD,GAAI,MAAM,iCAAiC,SACvC,CAAC,IACD,EAAE,8BAA8B,MAAM,6BAA6B;AAAA,MACvE,GAAI,MAAM,0BAA0B,SAChC,CAAC,IACD,EAAE,uBAAuB,MAAM,sBAAsB;AAAA,MACzD,4BACE,MAAM,8BAA8B,SAAS;AAAA;AAAA;AAAA,MAG/C,IAAI,MAAM;AACR,cAAM,UAAU,MAAM,WAAW,0BAA0B,MAAM,eAAe;AAChF,eAAO,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,MAChD,GAAG;AAAA,IACL;AAAA,EACF,CAAC;AACD,MAAI,QAAQ;AAIV,UAAM,uBAAuB,IAAI;AAAA,MAC/B,6BAA6B,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,iBAAiB,KAAK,CAAC;AAAA,IACtF;AACA,eAAW,UAAU,MAAM,gBAAgB,CAAC,GAAG;AAC7C,YAAM,YAAY,GAAG,YAAY,kCAAkC,kCAAkC,GAAG,OAAO,eAAe;AAE9H,UAAI,YAAY,IAAI,OAAO,eAAe,KAAK,WAAW,IAAI,SAAS,EAAG;AAC1E,kBAAY,IAAI,OAAO,eAAe;AACtC,iBAAW,IAAI,SAAS;AACxB,YAAM,WAAW,qBAAqB,IAAI,OAAO,eAAe;AAChE,aAAO,KAAK;AAAA,QACV,IAAI;AAAA,QACJ,iBAAiB,OAAO;AAAA,QACxB,SAAS,CAAC;AAAA,QACV,OAAO,OAAO,OAAO,KAAK,KAAK,UAAU,SAAS,OAAO;AAAA,QACzD,GAAI,UAAU,cAAc,CAAC,OAAO,OAAO,KAAK,IAC5C,EAAE,YAAY,SAAS,WAAW,IAClC,CAAC;AAAA,QACL,cACE,UAAU,gBAAgB,6BAA6B,OAAO,eAAe;AAAA,QAC/E,GAAI,UAAU,wBAAwB,SAClC,CAAC,IACD,EAAE,qBAAqB,SAAS,oBAAoB;AAAA,QACxD,GAAI,UAAU,iCAAiC,SAC3C,CAAC,IACD,EAAE,8BAA8B,SAAS,6BAA6B;AAAA,QAC1E,GAAI,UAAU,0BAA0B,SACpC,CAAC,IACD,EAAE,uBAAuB,SAAS,sBAAsB;AAAA,QAC5D,4BACE,UAAU,8BAA8B,SAAS;AAAA,MACrD,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,IAAI,YACA,8BACA,eACE,iCACA;AAAA,IACN,OAAO,YAAY,eAAe,eAAe,uBAAuB;AAAA,IACxE,KAAK;AAAA,IACL,aAAa;AAAA,IACb,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOT,yBAAyB;AAAA,IACzB,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC/C;AAAA,EACF;AACF;AAEA,SAAS,4BAA4B,UAAgD;AACnF,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,QAAM,WAAuC,UAAU;AAAA,IACrD,CAAC,aACC,SAAS,6BACT,EAAE,SAAS,QAAQ,wBAAwB,SAAS,WAAW,SAAS;AAAA,EAC5E;AACA,MAAI,SAAS,yBAAyB,+BAA+B,QAAQ,EAAE,SAAS,GAAG;AACzF,aAAS;AAAA,MACP,wBAAwB,UAAU;AAAA,QAChC,MAAM;AAAA,QACN,QAAQ,SAAS;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,aAAa,SAAS,mBACxB,2BAA2B,UAAU;AAAA,IACnC,MAAM;AAAA,IACN,QAAQ,SAAS;AAAA,EACnB,CAAC,IACD;AACJ,MAAI,WAAY,UAAS,KAAK,UAAU;AACxC,QAAM,QAAQ,SAAS,cACnB,sBAAsB,UAAU,EAAE,MAAM,iBAAiB,QAAQ,SAAS,YAAY,CAAC,IACvF;AACJ,MAAI,MAAO,UAAS,KAAK,KAAK;AAC9B,SAAO;AACT;AAGO,SAAS,yBACd,UACA,aAUU;AACV,QAAM,YAAY,wBAAwB,SAAS,kBAAkB,EAAE;AAAA,IACrE,CAAC,aACC,CAAC,SAAS,GAAG,WAAW,mBAAmB,KAC3C,CAAC,SAAS,GAAG,WAAW,yBAAyB;AAAA,EACrD;AACA,aAAW,cAAc,aAAa;AACpC,UAAM,OAAO,0BAA0B,UAAU;AACjD,QAAI,CAAC,KAAM;AACX,cAAU,KAAK;AAAA,MACb,MAAM,KAAK,aAAa,WAAW,4BAA4B;AAAA,MAC/D,IAAI,KAAK;AAAA,MACT,OAAO,KAAK,aAAa,WAAW,gBAAgB;AAAA,MACpD,KAAK;AAAA,MACL,aAAa,KAAK,aAAa,WAAW,WAAW;AAAA,MACrD,SAAS,KAAK;AAAA,MACd,GAAI,WAAW,SAAS,EAAE,QAAQ,WAAW,OAAO,IAAI,CAAC;AAAA,MACzD,QAAQ;AAAA,QACN;AAAA,UACE,IAAI,KAAK;AAAA,UACT,iBAAiB,KAAK;AAAA,UACtB,OAAO,KAAK;AAAA,UACZ,cAAc,wBAAwB,UAAU;AAAA,YAC9C,iBAAiB;AAAA,YACjB,iBAAiB;AAAA,UACnB,CAAC;AAAA,UACD,4BAA4B,SAAS;AAAA,QACvC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,EAAE,GAAG,UAAU,oBAAoB,KAAK,UAAU,SAAS,EAAE;AACtE;AAGO,SAAS,oCACd,UACA,eAGM,CAAC,GACG;AACV,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,QAAM,mBAAmB,UAAU;AAAA,IACjC,CAAC,aAAa,SAAS,OAAO;AAAA,EAChC;AACA,QAAM,eAAe,+BAA+B,QAAQ,EAAE;AAC9D,MAAI,iBAAiB,KAAK,aAAa,WAAW,EAAG,QAAO;AAC5D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB,KAAK,UAAU;AAAA,MACjC,GAAG;AAAA,MACH,wBAAwB,UAAU;AAAA,QAChC,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AACF;AAGO,SAAS,+BACd,UACA,QACA,eAGM,CAAC,GACG;AACV,MAAI,CAAC,OAAO,KAAK,GAAG;AAClB,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,QAAM,kBAAkB,oCAAoC,UAAU,YAAY;AAClF,QAAM,YAAY,wBAAwB,gBAAgB,kBAAkB,EAAE;AAAA,IAAI,CAAC,aACjF,SAAS,OAAO,gCAAgC,EAAE,GAAG,UAAU,OAAO,IAAI;AAAA,EAC5E;AACA,SAAO,EAAE,GAAG,iBAAiB,oBAAoB,KAAK,UAAU,SAAS,EAAE;AAC7E;AAGO,SAAS,uCACd,UACA,eAGM,CAAC,GACG;AACV,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,QAAM,mBAAmB,UAAU;AAAA,IACjC,CAACC,cAAaA,UAAS,OAAO;AAAA,EAChC;AACA,QAAM,WAAW,2BAA2B,UAAU;AAAA,IACpD,MAAM;AAAA,IACN;AAAA,EACF,CAAC;AACD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB,KAAK,UAAU,CAAC,GAAG,kBAAkB,QAAQ,CAAC;AAAA,EACpE;AACF;AAGO,SAAS,kCACd,UACA,QACA,eAGM,CAAC,GACG;AACV,MAAI,CAAC,OAAO,KAAK,GAAG;AAClB,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,QAAM,kBAAkB,uCAAuC,UAAU,YAAY;AACrF,QAAM,YAAY,wBAAwB,gBAAgB,kBAAkB,EAAE;AAAA,IAAI,CAAC,aACjF,SAAS,OAAO,mCAAmC,EAAE,GAAG,UAAU,OAAO,IAAI;AAAA,EAC/E;AACA,SAAO,EAAE,GAAG,iBAAiB,oBAAoB,KAAK,UAAU,SAAS,EAAE;AAC7E;AAGO,SAAS,kCACd,UACA,eAGM,CAAC,GACG;AACV,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,QAAM,mBAAmB,UAAU;AAAA,IACjC,CAACA,cAAaA,UAAS,OAAO;AAAA,EAChC;AACA,QAAM,WAAW,sBAAsB,UAAU;AAAA,IAC/C,MAAM;AAAA,IACN;AAAA,EACF,CAAC;AACD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB,KAAK,UAAU,CAAC,GAAG,kBAAkB,QAAQ,CAAC;AAAA,EACpE;AACF;AAGO,SAAS,6BACd,UACA,QACA,eAGM,CAAC,GACG;AACV,MAAI,CAAC,OAAO,KAAK,GAAG;AAClB,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AACA,QAAM,kBAAkB,kCAAkC,UAAU,YAAY;AAChF,QAAM,YAAY,wBAAwB,gBAAgB,kBAAkB,EAAE;AAAA,IAAI,CAAC,aACjF,SAAS,OAAO,8BAA8B,EAAE,GAAG,UAAU,OAAO,IAAI;AAAA,EAC1E;AACA,SAAO,EAAE,GAAG,iBAAiB,oBAAoB,KAAK,UAAU,SAAS,EAAE;AAC7E;AAGO,SAAS,qCACd,UACA,eAGM,CAAC,GACG;AACV,QAAM,YAAY,wBAAwB,SAAS,kBAAkB,EAAE;AAAA,IACrE,CAACA,cAAaA,UAAS,OAAO;AAAA,EAChC;AACA,QAAM,WAAW,sBAAsB,UAAU;AAAA,IAC/C,MAAM;AAAA,IACN;AAAA,EACF,CAAC;AACD,SAAO,WACH,EAAE,GAAG,UAAU,oBAAoB,KAAK,UAAU,CAAC,GAAG,WAAW,QAAQ,CAAC,EAAE,IAC5E;AACN;AAEO,SAAS,gCACd,UACA,QACA,eAGM,CAAC,GACG;AACV,MAAI,CAAC,OAAO,KAAK,EAAG,OAAM,IAAI,MAAM,wCAAwC;AAC5E,QAAM,UAAU,qCAAqC,UAAU,YAAY;AAC3E,QAAM,YAAY,wBAAwB,QAAQ,kBAAkB,EAAE;AAAA,IAAI,CAAC,aACzE,SAAS,OAAO,iCAAiC,EAAE,GAAG,UAAU,OAAO,IAAI;AAAA,EAC7E;AACA,SAAO,EAAE,GAAG,SAAS,oBAAoB,KAAK,UAAU,SAAS,EAAE;AACrE;AAKA,IAAM,6BAA6B;AAAA,EACjC,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AACF;AAGO,SAAS,kCACd,SACwC;AACxC,MAAI,SAAS,WAAW,mCAAmC,EAAG,QAAO;AACrE,MAAI,SAAS,WAAW,yCAAyC,EAAG,QAAO;AAC3E,SAAO;AACT;AAEO,SAAS,gCAAgC,UAAmD;AACjG,SAAO,2BAA2B,QAAQ,EAAE;AAC9C;AASA,SAAS,mCACP,UACA,UACA,OAKiC;AACjC,QAAM,QAAQ,2BAA2B,QAAQ;AACjD,QAAM,UACJ,aAAa,WACT,8BACA,MAAM,WACJ,+BAA+B,MAAM,QAAQ,IAC7C;AACR,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAAqC,CAAC;AAC5C,aAAW,SAAS,MAAM,QAAQ;AAChC,QAAI,KAAK,IAAI,MAAM,eAAe,EAAG;AACrC,SAAK,IAAI,MAAM,eAAe;AAC9B,WAAO,KAAK;AAAA,MACV,IAAI,GAAG,MAAM,MAAM,GAAG,MAAM,eAAe;AAAA,MAC3C,iBAAiB,MAAM;AAAA,MACvB,SAAS,CAAC;AAAA,MACV,OAAO,MAAM,OAAO,KAAK,KAAK,MAAM;AAAA,MACpC,cAAc,wBAAwB,UAAU;AAAA,QAC9C,iBAAiB;AAAA,QACjB,iBAAiB;AAAA,MACnB,CAAC;AAAA,MACD,4BAA4B,SAAS;AAAA,IACvC,CAAC;AAAA,EACH;AACA,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,IAAI,MAAM;AAAA,IACV,OAAO,MAAM;AAAA,IACb,KAAK;AAAA,IACL,aAAa,MAAM;AAAA,IACnB;AAAA,IACA,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC/C;AAAA,EACF;AACF;AAOA,SAAS,+BAA+B,UAAiC;AACvE,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,QAAQ;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MACE,IAAI,aAAa,YACjB,IAAI,YACJ,IAAI,YACJ,IAAI,QACJ,IAAI,UACJ,IAAI,QACJ,CAAC,oCAAoC,KAAK,IAAI,QAAQ,KACtD,CAAC,CAAC,IAAI,KAAK,cAAc,aAAa,EAAE,SAAS,IAAI,QAAQ;AAE7D,WAAO;AACT,SAAO,GAAG,IAAI,MAAM;AACtB;AAEA,SAAS,+BACP,UACA,UACA,SACU;AACV,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,YAAY,wBAAwB,SAAS,kBAAkB,EAAE;AAAA,IACrE,CAAC,cAAc,UAAU,OAAO,2BAA2B,QAAQ,EAAE;AAAA,EACvE;AACA,SAAO,EAAE,GAAG,UAAU,oBAAoB,KAAK,UAAU,CAAC,GAAG,WAAW,OAAO,CAAC,EAAE;AACpF;AAGO,SAAS,sCACd,UACA,UACA,OAIU;AACV,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mCAAmC,UAAU,UAAU,KAAK;AAAA,EAC9D;AACF;AAGO,SAAS,iCACd,UACA,UACA,QACA,OAIU;AACV,MAAI,CAAC,OAAO,KAAK,EAAG,OAAM,IAAI,MAAM,gBAAgB,QAAQ,sBAAsB;AAClF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mCAAmC,UAAU,UAAU,EAAE,GAAG,OAAO,OAAO,CAAC;AAAA,EAC7E;AACF;AAGO,SAAS,2CACd,UACA,OAIU;AACV,SAAO,sCAAsC,UAAU,gBAAgB,KAAK;AAC9E;AAGO,SAAS,sCACd,UACA,QACA,OAIU;AACV,SAAO,iCAAiC,UAAU,gBAAgB,QAAQ,KAAK;AACjF;AAGO,SAAS,uCACd,UACA,eAGM,CAAC,GACG;AACV,MAAI,aAAa,WAAW,EAAG,QAAO;AACtC,QAAM,YAAY,wBAAwB,SAAS,kBAAkB,EAAE;AAAA,IACrE,CAACA,cAAaA,UAAS,OAAO;AAAA,EAChC;AACA,QAAM,WAAW,wBAAwB,UAAU;AAAA,IACjD,MAAM;AAAA,IACN;AAAA,EACF,CAAC;AACD,SAAO,EAAE,GAAG,UAAU,oBAAoB,KAAK,UAAU,CAAC,GAAG,WAAW,QAAQ,CAAC,EAAE;AACrF;AAEO,SAAS,kCACd,UACA,QACA,eAGM,CAAC,GACG;AACV,MAAI,CAAC,OAAO,KAAK,EAAG,OAAM,IAAI,MAAM,6CAA6C;AACjF,QAAM,UAAU,uCAAuC,UAAU,YAAY;AAC7E,QAAM,YAAY,wBAAwB,QAAQ,kBAAkB,EAAE;AAAA,IAAI,CAAC,aACzE,SAAS,OAAO,mCAAmC,EAAE,GAAG,UAAU,OAAO,IAAI;AAAA,EAC/E;AACA,SAAO,EAAE,GAAG,SAAS,oBAAoB,KAAK,UAAU,SAAS,EAAE;AACrE;AAGO,SAAS,0CACd,UACA,eAGM,CAAC,GACG;AACV,QAAM,YAAY,wBAAwB,SAAS,kBAAkB,EAAE;AAAA,IACrE,CAACA,cAAaA,UAAS,OAAO;AAAA,EAChC;AACA,QAAM,WAAW,2BAA2B,UAAU;AAAA,IACpD,MAAM;AAAA,IACN;AAAA,EACF,CAAC;AACD,SAAO,WACH,EAAE,GAAG,UAAU,oBAAoB,KAAK,UAAU,CAAC,GAAG,WAAW,QAAQ,CAAC,EAAE,IAC5E;AACN;AAEO,SAAS,qCACd,UACA,QACA,eAGM,CAAC,GACG;AACV,MAAI,CAAC,OAAO,KAAK,EAAG,OAAM,IAAI,MAAM,6CAA6C;AACjF,QAAM,UAAU,0CAA0C,UAAU,YAAY;AAChF,QAAM,YAAY,wBAAwB,QAAQ,kBAAkB,EAAE;AAAA,IAAI,CAAC,aACzE,SAAS,OAAO,sCAAsC,EAAE,GAAG,UAAU,OAAO,IAAI;AAAA,EAClF;AACA,SAAO,EAAE,GAAG,SAAS,oBAAoB,KAAK,UAAU,SAAS,EAAE;AACrE;AAGA,IAAM,oCAAoC;AAM1C,IAAM,mCAAmC;AAEzC,IAAM,2BAA8C,CAAC,eAAe,aAAa;AAQjF,SAAS,6BAA6B,SAOxB;AACZ,QAAM,OAAO,QAAQ,WAAW,qBAAqB,IACjD,QAAQ,MAAM,sBAAsB,MAAM,IAC1C;AACJ,SAAO,yBAAyB,SAAS,IAAI,IACzC;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,UAAU;AAAA,IACV,sBAAsB;AAAA,EACxB,IACA;AACN;AAQO,SAAS,uBAAuB,SAAyB;AAC9D,QAAM,OAAO,QAAQ,WAAW,qBAAqB,IACjD,QAAQ,MAAM,sBAAsB,MAAM,IAC1C;AACJ,QAAM,YAAY,0BAA0B,KAAK,IAAI;AACrD,MAAI,WAAW;AACb,WAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,EAC7B;AACA,QAAM,QAAQ,mCAAmC,KAAK,IAAI;AAC1D,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,SAAS,MAAM,CAAC,EAAG,QAAQ,SAAS,KAAK;AAC/C,QAAM,OAAO,MAAM,CAAC;AACpB,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KACZ,MAAM,GAAG,EACT,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,EAChC,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,YAAY,IAAI,KAAK,MAAM,CAAC,EAAE,YAAY,CAAC,EACxE,KAAK,GAAG;AACX,SAAO,OAAO,SAAS,IAAI,GAAG,MAAM,IAAI,MAAM,KAAK;AACrD;AAMO,SAAS,4BAA4B,SAAgC;AAC1E,QAAM,OAAO,QAAQ,WAAW,qBAAqB,IACjD,QAAQ,MAAM,sBAAsB,MAAM,IAC1C;AACJ,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,IAAM,0BAA0B,CAAC,eAAe,iBAAiB,cAAc;AAE/E,SAAS,sBAAsB,SAA0B;AACvD,SAAQ,wBAA8C,SAAS,OAAO;AACxE;AAGA,SAAS,6BACP,UACA,SAIA;AACA,MAAI,sBAAsB,OAAO,GAAG;AAClC,WAAO;AAAA,MACL,qBAAqB;AAAA,MACrB,8BAA8B;AAAA,MAC9B,uBAAuB;AAAA,IACzB;AAAA,EACF;AACA,SAAO,EAAE,qBAAqB,SAAS,oBAAoB;AAC7D;AAEA,SAAS,4BAA4B,SAKlC;AACD,MACE,sBAAsB,OAAO,KAC7B,qBAAqB,KAAK,OAAO,KACjC,QAAQ,WAAW,gBAAgB,KACnC,4BAA4B,KAAK,OAAO,GACxC;AACA,UAAM,YAAY,6BAA6B,OAAO;AACtD,WAAO;AAAA,MACL,EAAE,IAAI,YAAY,UAAU,aAAa,UAAU,KAAK;AAAA,MACxD;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,UAAU;AAAA,QACV,sBAAsB;AAAA,MACxB;AAAA,MACA,GAAI,YAAY,CAAC,SAAS,IAAI,CAAC;AAAA,IACjC;AAAA,EACF;AACA,SAAO,CAAC,EAAE,IAAI,YAAY,UAAU,WAAW,UAAU,KAAK,CAAC;AACjE;AAEA,SAAS,yBAAyB,MAAuB;AACvD,SAAO,KAAK,WAAW,UAAU,KAAK,qBAAqB,KAAK,IAAI;AACtE;AAQA,SAAS,iCACP,MACA,cACqB;AACrB,MAAI,CAAC,qBAAqB,KAAK,IAAI,EAAG,QAAO;AAC7C,QAAM,UAAU,4BAA4B,GAAG,qBAAqB,GAAG,IAAI,EAAE;AAC7E,QAAM,QAAQ,QAAQ;AAAA,IACpB,CAAC,UACE,KAAK,OAAO,UAAU,KAAK,OAAO,gBACnC,CAAC,aAAa,aAAa,KAAK,CAAC,aAAa,SAAS,OAAO,KAAK,EAAE;AAAA,EACzE;AACA,SAAO,sBAAsB;AAAA,IAC3B,GAAG;AAAA,IACH,iBAAiB,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,aAAa,iBAAiB,OAAgB,CAAC,CAAC;AAAA,IACjF,kBACE,aAAa,iBAAiB,aAAa,YACvC,EAAE,UAAU,aAAa,UAAU,KAAK,IACxC,aAAa;AAAA,IACnB,cAAc,CAAC,GAAG,aAAa,cAAc,GAAG,KAAK;AAAA,EACvD,CAAC;AACH;AAEA,SAAS,6BACP,SAC+D;AAC/D,QAAM,OAAO,QAAQ,WAAW,qBAAqB,IACjD,QAAQ,MAAM,sBAAsB,MAAM,IAC1C;AACJ,SAAO,KAAK,WAAW,UAAU,KAAK,KAAK,WAAW,QAAQ,IAC1D,EAAE,UAAU,aAAa,UAAU,MAAM,MAAM,WAAW,IAC1D;AACN;AAGA,SAAS,qCAAqC,UAAoB,SAA0B;AAC1F,SACE,SAAS,mBAAmB,YAC5B,yBAAyB,SAAS,aAAa,MAC9C,sBAAsB,OAAO,KAAK,QAAQ,WAAW,QAAQ;AAElE;AAGO,SAAS,yBAAyB,SAAsC;AAC7E,MAAI,YAAY,OAAW,QAAO;AAClC,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,OAAO;AAC9B,WACE,OAAO,aAAa,YACpB,OAAO,aAAa,oBACpB,OAAO,SAAS,MAChB,OAAO,aAAa,MACpB,OAAO,aAAa,MACpB,OAAO,WAAW,MAClB,OAAO,SAAS,MAChB,OAAO,SAAS,QAAQ,QAAQ,EAAE,MAAM;AAAA,EAE5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQO,SAAS,0BACd,YACA,aAC+C;AAC/C,MAAI,gBAAgB,YAAY;AAC9B,WAAO;AAAA,EACT;AACA,MAAI,gBAAgB,aAAa;AAC/B,WAAO;AAAA,EACT;AACA,MACE,eAAe,WACf,eAAe,qBACf,eAAe,8BACf;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,6BACd,WACA,qBACS;AACT,MAAI,cAAc,YAAY;AAC5B,WAAO;AAAA,EACT;AACA,MAAI,cAAc,aAAa;AAC7B,WAAO,wBAAwB;AAAA,EACjC;AACA,SAAO,wBAAwB,cAAc,wBAAwB;AACvE;AAEO,SAAS,6BAA6B,UAAoB,SAAgC;AAC/F,QAAM,WAAW;AAAA,IACf,+BAA+B,UAAU,OAAO;AAAA,IAChD,8BAA8B,UAAU,OAAO;AAAA,EACjD;AACA,MAAI,CAAC,UAAU;AACb,WAAO,CAAC,UAAU;AAAA,EACpB;AACA,SAAO,SAAS,MAAM,aAAa,aAChC,OAAO,CAAC,SAAS,KAAK,QAAQ,EAC9B,IAAI,CAAC,SAAS,YAAY,MAAM,KAAK,EAAE,CAAC;AAC7C;AAEA,SAAS,0BACP,UACA,SACA,aACM;AACN,QAAM,WAAW,6BAA6B,UAAU,OAAO;AAC/D,MAAI,CAAC,SAAS,SAAS,WAAW,GAAG;AACnC,UAAM,IAAI,4BAA4B,SAAS,aAAa,QAAQ;AAAA,EACtE;AACF;AAEO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAGrD,YACW,SACA,aACA,qBACT;AACA;AAAA,MACE,gBAAgB,WAAW,8BAA8B,OAAO,cAAc,oBAAoB,KAAK,IAAI,CAAC;AAAA,IAC9G;AANS;AACA;AACA;AAKT,SAAK,OAAO;AAAA,EACd;AAAA,EAXS,OAAO;AAYlB;AAEA,SAAS,yBAAyB,UAAwD;AACxF,UAAQ,SAAS,MAAM;AAAA,IACrB,KAAK;AACH,aAAO,EAAE,MAAM,cAAc,WAAW,OAAO;AAAA,IACjD,KAAK;AACH,aAAO,EAAE,MAAM,0BAA0B,UAAU,QAAQ;AAAA,IAC7D,KAAK;AACH,aAAO,EAAE,MAAM,0BAA0B,UAAU,MAAM;AAAA,IAC3D,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,MAAM,0BAA0B,UAAU,SAAS;AAAA,IAC9D,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,MAAM,wBAAwB,WAAW,UAAU;AAAA,IAC9D,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,MAAM,2BAA2B,WAAW,UAAU;AAAA,IACjE,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,MAAM,cAAc,WAAW,UAAU;AAAA,IACpD,SAAS;AACP,YAAM,cAAqB,SAAS;AACpC,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,UAA0D;AACjF,UAAQ,SAAS,MAAM;AAAA,IACrB,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,eAAe,cAAc,UAAU,WAAW;AAAA,IAC7D,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,eAAe,0BAA0B,UAAU,WAAW;AAAA,IACzE,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,eAAe,aAAa,UAAU,WAAW;AAAA,IAC5D,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,eAAe,gBAAgB,UAAU,WAAW;AAAA,IAC/D,KAAK;AAAA,IACL,KAAK;AAAA;AAAA;AAAA,IAGL,KAAK;AACH,aAAO,EAAE,eAAe,cAAc,UAAU,mBAAmB;AAAA,IACrE,SAAS;AACP,YAAM,cAAqB,SAAS;AACpC,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,uBACP,UACA,gBACA,kBAC0B;AAC1B,MAAI,iBAAiB,SAAS,uBAAwB,QAAO;AAC7D,MAAI,iBAAiB,SAAS,0BAA2B,QAAO;AAChE,MAAI,iBAAiB,SAAS,yBAA0B,QAAO;AAC/D,SAAO,yBAAyB,SAAS,mBAAmB,EAAE,cAAc,KAAK;AACnF;AAEO,SAAS,iCACd,WACA,OAC0B;AAC1B,SAAO,MAAM;AACf;AAEA,SAAS,wBAAwB,UAAwC;AACvE,MAAI,SAAS,mBAAmB,WAAW,CAAC,SAAS,mBAAmB;AACtE,WAAO,EAAE,MAAM,cAAc,WAAW,kBAAkB;AAAA,EAC5D;AACA,SAAO,EAAE,MAAM,cAAc,WAAW,UAAU;AACpD;AAEA,SAAS,+BAA+B,UAYtC;AACA,QAAM,gBAAgB,IAAI,IAAI,SAAS,4BAA4B,CAAC,CAAC;AACrE,QAAM,cAAc,IAAI,IAAI,SAAS,2BAA2B,CAAC,CAAC;AAClE,SAAO;AAAA,IACL,GAAI,SAAS,YACT;AAAA,MACE,YAAY,CAAC,EAAE,UAAU,WAAW,mBAAmB,UAAU,GAAG,QAAQ,MAC1E,SAAS,SAAS,SAAS;AAAA,IAC/B,IACA,CAAC;AAAA,IACL,SAAS,OAAO,QAAQ,SAAS,kBAAkB,CAAC,CAAC,EAClD,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD;AAAA,MAAI,CAAC,CAAC,MAAM,KAAK,MAChB,cAAc,IAAI,IAAI,IAClB,EAAE,MAAM,gBAAgB,UAAmB,MAAM,IACjD,EAAE,MAAM,gBAAgB,SAAkB;AAAA,IAChD;AAAA,IACF,OAAO,OAAO,QAAQ,SAAS,gBAAgB,CAAC,CAAC,EAC9C,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD;AAAA,MAAI,CAAC,CAAC,MAAM,KAAK,MAChB,YAAY,IAAI,IAAI,IAChB,EAAE,MAAM,gBAAgB,UAAmB,MAAM,IACjD,EAAE,MAAM,gBAAgB,SAAkB;AAAA,IAChD;AAAA,EACJ;AACF;AAEA,SAAS,cAAc,OAAwB;AAC7C,QAAM,YAAY,CAAC,UAA4B;AAC7C,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,aAAO,MAAM,IAAI,CAAC,UAAU,UAAU,KAAK,CAAC;AAAA,IAC9C;AACA,QAAI,SAAS,OAAO,UAAU,UAAU;AACtC,YAAM,MAA+B,CAAC;AACtC,iBAAW,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK,GAAG;AAC3C,cAAM,QAAS,MAAkC,GAAG;AACpD,YAAI,UAAU,QAAW;AACvB,cAAI,GAAG,IAAI,UAAU,KAAK;AAAA,QAC5B;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,UAAU,UAAU,KAAK,CAAC;AACxC;AAEA,SAAS,qBACP,OACA,UACA,UAAoF,CAAC,GAC7E;AACR,QAAM,kBAAkB,+BAA+B,QAAQ;AAC/D,QAAM,qBAAqB,QAAQ,sBAAsB;AAMzD,QAAM,EAAE,uBAAuB,GAAG,iBAAiB,IAAI,MAAM;AAC7D,QAAM,kBAAkB,QAAQ,+BAC5B,EAAE,GAAG,kBAAkB,sBAAsB,IAC7C;AACJ,QAAM,cAAc,cAAc;AAAA,IAChC,eAAe,MAAM;AAAA,IACrB,IAAI,MAAM;AAAA,IACV,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM;AAAA,IAClB,UAAU;AAAA,MACR,aAAa,SAAS;AAAA,MACtB,SAAS,SAAS;AAAA,MAClB,GAAI,qBAAqB,EAAE,aAAa,SAAS,YAAY,IAAI,CAAC;AAAA,MAClE,SAAS,SAAS,WAAW;AAAA,MAC7B,gBAAgB,gBAAgB;AAAA,MAChC,cAAc,gBAAgB;AAAA,MAC9B,GAAI,gBAAgB,YAAY,EAAE,WAAW,gBAAgB,UAAU,IAAI,CAAC;AAAA,IAC9E;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB,SAAS,MAAM;AAAA,IACf;AAAA,IACA,cAAc,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,IAKpB,GAAI,MAAM,gBAAgB,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,IACpE,SAAS,MAAM,WAAW;AAAA,EAC5B,CAAC;AACD,SAAO,UAAU,WAAW,QAAQ,EACjC,OAAO,kCAAkC,MAAM,EAC/C,OAAO,aAAa,MAAM,EAC1B,OAAO,KAAK,CAAC;AAClB;AAQA,SAAS,4CACP,OACA,UACQ;AACR,QAAM,EAAE,mBAAmB,oBAAoB,GAAG,oBAAoB,IAAI;AAC1E,SAAO,qBAAqB,qBAAqB,UAAU;AAAA,IACzD,8BAA8B;AAAA,EAChC,CAAC;AACH;AAEA,SAAS,yCACP,OACA,UACe;AACf,MAAI,SAAS,gBAAgB,SAAU,QAAO;AAC9C,QAAM,EAAE,mBAAmB,oBAAoB,GAAG,oBAAoB,IAAI;AAC1E,SAAO,qBAAqB,qBAAqB,UAAU;AAAA,IACzD,oBAAoB;AAAA,IACpB,8BAA8B;AAAA,EAChC,CAAC;AACH;AAEA,SAAS,oDACP,OACA,UACe;AAIf,MACE,MAAM,OAAO,uBACb,MAAM,oBAAoB,iBAC1B,SAAS,OAAO,qBAChB,SAAS,SAAS,wBAClB,SAAS,QAAQ,eACjB,SAAS,gBAAgB,YACzB,cAAc,MAAM,aAAa,aAAa,MAC5C,cAAc,EAAE,UAAU,aAAa,UAAU,MAAM,MAAM,WAAW,CAAC,GAC3E;AACA,WAAO;AAAA,EACT;AACA,QAAM,EAAE,mBAAmB,oBAAoB,GAAG,oBAAoB,IAAI;AAC1E,QAAM,EAAE,eAAe,gBAAgB,GAAG,aAAa,IAAI,MAAM;AAKjE,SAAO;AAAA,IACL;AAAA,MACE,GAAG;AAAA,MACH,cAAc;AAAA,QACZ,GAAG;AAAA,QACH,cAAc,aAAa,aAAa,OAAO,CAAC,SAAS,KAAK,OAAO,WAAW;AAAA,MAClF;AAAA,IACF;AAAA,IACA;AAAA,IACA,EAAE,8BAA8B,KAAK;AAAA,EACvC;AACF;AAEA,SAAS,2CACP,OACA,UACA,QACS;AACT,QAAM,EAAE,mBAAmB,oBAAoB,GAAG,oBAAoB,IAAI;AAC1E,QAAM,EAAE,cAAc,gBAAgB,IAAI,MAAM;AAOhD,WAAS,cAAc,GAAG,cAAc,KAAK,aAAa,QAAQ,eAAe,GAAG;AAClF,UAAM,gBAAgB,aAAa,OAAO,CAAC,OAAO,UAAU,cAAe,KAAK,KAAM;AACtF,QAAI,CAAC,cAAc,KAAK,CAAC,SAAS,KAAK,OAAO,OAAO,eAAe,KAAK,QAAQ,GAAG;AAClF;AAAA,IACF;AACA,aAAS,YAAY,GAAG,YAAY,KAAK,gBAAgB,QAAQ,aAAa,GAAG;AAC/E,YAAM,iBAAiB,gBAAgB,OAAO,CAAC,WAAW,UAAU,YAAa,KAAK,KAAM;AAC5F,UACE,cAAc,WAAW,aAAa,UACtC,eAAe,WAAW,gBAAgB,QAC1C;AACA;AAAA,MACF;AACA,YAAM,eAAe;AAAA,QACnB,GAAG,MAAM;AAAA,QACT,cAAc;AAAA,QACd,iBAAiB;AAAA,MACnB;AACA,UACE;AAAA,QACE;AAAA,QACA,EAAE,GAAG,qBAAqB,aAAa;AAAA,QACvC;AAAA,MACF,GACA;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAUA,SAAS,mCACP,OACA,UACwB;AACxB,MAAI,CAAC,MAAM,aAAa,iBAAiB,SAAU,QAAO;AAC1D,QAAM,EAAE,mBAAmB,oBAAoB,GAAG,oBAAoB,IAAI;AAC1E,QAAM,aAAa;AAAA,IACjB,GAAG;AAAA,IACH,cAAc;AAAA,MACZ,GAAG,MAAM;AAAA,MACT,kBAAkB,EAAE,UAAU,WAAoB,UAAU,MAAM;AAAA,IACpE;AAAA,EACF;AACA,SAAO,EAAE,GAAG,YAAY,mBAAmB,qBAAqB,YAAY,QAAQ,EAAE;AACxF;AAGA,SAAS,iCACP,OACA,UACA,QACS;AACT,SACE,OAAO,sBAAsB,MAAM,qBACnC,OAAO,sBAAsB,4CAA4C,OAAO,QAAQ,KACxF,OAAO,sBAAsB,yCAAyC,OAAO,QAAQ,KACrF,OAAO,sBACL,oDAAoD,OAAO,QAAQ,KACrE,2CAA2C,OAAO,UAAU,MAAM,KAClE,4CAA4C,OAAO,UAAU,MAAM;AAEvE;AAQA,SAAS,6CACP,QACA,OACA,UACS;AACT,SACE,OAAO,sBAAsB,qBAAqB,OAAO,QAAQ,KACjE,OAAO,sBACL,qBAAqB,OAAO,UAAU,EAAE,8BAA8B,KAAK,CAAC;AAElF;AAGA,SAAS,8BAAiD;AACxD,SAAO,EAAE,UAAU,WAAW,UAAU,MAAM;AAChD;AAEA,SAAS,4CACP,OACA,UACA,QACS;AAST,MAAI,CAAC,MAAM,aAAa,YAAY,UAAU,SAAU,QAAO;AAC/D,QAAM,EAAE,mBAAmB,oBAAoB,GAAG,oBAAoB,IAAI;AAC1E,QAAM,eAAe;AAAA,IACnB,GAAG,MAAM;AAAA,IACT,aAAa,EAAE,GAAG,MAAM,aAAa,aAAa,WAAW,4BAA4B,EAAE;AAAA,EAC7F;AACA,SAAO;AAAA,IACL;AAAA,IACA,EAAE,GAAG,qBAAqB,aAAa;AAAA,IACvC;AAAA,EACF;AACF;AASO,SAAS,8CACd,OACA,UACA,QACiB;AACjB,MACE,OAAO,sBAAsB,MAAM;AAAA;AAAA,EAGnC,MAAM,cAAc,aAAa,WAAW,aAAa,QACzD,CAAC,4CAA4C,OAAO,UAAU,MAAM,GACpE;AACA,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,cAAc;AAAA,MACZ,GAAG,MAAM;AAAA,MACT,aAAa;AAAA,QACX,GAAG,MAAM,aAAa;AAAA,QACtB,WAAW,4BAA4B;AAAA,MACzC;AAAA,IACF;AAAA,IACA,iBAAiB;AAAA,IACjB,mBAAmB,OAAO;AAAA,EAC5B;AACF;AASO,SAAS,kBAAkB,UAAoD;AACpF,SAAO,SAAS,mBAAmB,UAAU,UAAU;AACzD;AAEA,SAAS,qBAAqB,UAAoD;AAChF,SAAO,SAAS,mBAAmB,UAAU,iBAAiB;AAChE;AAUO,SAAS,oBACd,UACA,SAA4B,QAAQ,KACX;AACzB,QAAM,mBAAmB,wBAAwB,QAAQ;AACzD,QAAM,UAAiC;AAAA,IACrC,IAAI,kBAAkB,QAAQ;AAAA,IAC9B,OAAO,qBAAqB,QAAQ;AAAA,IACpC,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa,SAAS,mBAAmB,UAAU,iBAAiB;AAAA,IACpE,SAAS;AAAA,IACT;AAAA,IACA,SAAS,EAAE,eAAe,cAAc,UAAU,mBAAmB;AAAA,EACvE;AACA,MAAI,SAAS,mBAAmB,SAAS;AACvC,UAAM,UAAU,SAAS,sBAAsB,SAAS;AACxD,YAAQ,UAAU,UAAU,yBAAyB,SAAS,QAAQ,EAAE,IAAI;AAC5E,YAAQ,SACN,uBAAuB,SAAS,iBAAiB,KAAK,SAAS;AAAA,EACnE,OAAO;AACL,YAAQ,UAAU,SAAS,gBACvB,yBAAyB,SAAS,eAAe,QAAQ,EAAE,IAC3D;AACJ,YAAQ,SAAS,uBAAuB,SAAS,YAAY;AAAA,EAC/D;AACA,QAAM,WAAW,4BAA4B,QAAQ,EAAE;AAAA,IACrD,CAAC,cAAqC;AAAA,MACpC,IAAI,SAAS;AAAA,MACb,OAAO,SAAS,SAAS,SAAS;AAAA,MAClC,MAAM,SAAS;AAAA,MACf,KAAK,SAAS;AAAA,MACd,WAAW,SAAS;AAAA,MACpB,aAAa,SAAS;AAAA,MACtB,SAAS;AAAA,MACT,SAAS,SAAS;AAAA,MAClB,QAAQ,sBAAsB,UAAU,MAAM;AAAA,MAC9C,cAAc,SAAS;AAAA,MACvB,gBAAgB,SAAS;AAAA,MACzB,yBAAyB,SAAS;AAAA,MAClC,0BAA0B,SAAS;AAAA,MACnC,GAAI,SAAS,wBAAwB,SACjC,EAAE,qBAAqB,SAAS,oBAAoB,IACpD,CAAC;AAAA,MACL,GAAI,SAAS,4BAA4B,SACrC,EAAE,yBAAyB,SAAS,wBAAwB,IAC5D,CAAC;AAAA,MACL,kBAAkB,yBAAyB,QAAQ;AAAA,MACnD,SAAS,gBAAgB,QAAQ;AAAA,IACnC;AAAA,EACF;AACA,SAAO,CAAC,SAAS,GAAG,QAAQ;AAC9B;AASO,SAAS,wBAAwB,UAA8B;AACpE,MAAI,SAAS,4BAA4B,OAAW,QAAO,CAAC,GAAG,0BAA0B;AACzF,SAAOJ,GACJ,MAAM,uBAAuB,EAC7B,MAAM,KAAK,MAAM,SAAS,uBAAuB,CAAC,EAClD,OAAO,CAAC,UAAU,CAAC,MAAM,OAAO,EAChC,IAAI,CAAC,UAAU,MAAM,eAAe;AACzC;AAEO,SAAS,yBAAyB,UAA8B;AACrE,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,MAAI,UAAU,KAAK,CAACI,cAAaA,UAAS,OAAO,iBAAiB,GAAG;AACnE,WAAO;AAAA,EACT;AACA,QAAM,gBACJ,SAAS,4BAA4B,SACjC,SACAJ,GACG,MAAM,uBAAuB,EAC7B,MAAM,KAAK,MAAM,SAAS,uBAAuB,CAAC,EAClD,OAAO,CAAC,UAAU,CAAC,MAAM,OAAO,EAChC,IAAI,CAAC,EAAE,SAAS,UAAU,GAAG,MAAM,MAAM,KAAK;AACvD,MAAI,eAAe,WAAW,EAAG,QAAO;AACxC,QAAM,WAA6B;AAAA,IACjC,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,KAAK;AAAA,IACL,aAAa;AAAA,IACb,SAAS;AAAA,IACT,QACE,iBACA,2BAA2B,IAAI,CAAC,SAAS;AACvC,YAAM,eAAe,iCAAiC,MAAM;AAAA,QAC1D,GAAG,wBAAwB,UAAU;AAAA,UACnC,iBAAiB;AAAA,UACjB,iBAAiB;AAAA,UACjB,QAAQ,yBAAyB,IAAI;AAAA,QACvC,CAAC;AAAA,QACD,GAAI,6BAA6B,GAAG,qBAAqB,GAAG,IAAI,EAAE,IAC9D;AAAA,UACE,eAAe,6BAA6B,GAAG,qBAAqB,GAAG,IAAI,EAAE;AAAA,QAC/E,IACA,CAAC;AAAA,QACL,cAAc,4BAA4B,GAAG,qBAAqB,GAAG,IAAI,EAAE;AAAA,MAC7E,CAAC;AACD,aAAO;AAAA,QACL,IAAI,GAAG,qBAAqB,GAAG,IAAI;AAAA,QACnC,iBAAiB;AAAA,QACjB,OAAO,uBAAuB,IAAI;AAAA,QAClC,GAAI,4BAA4B,IAAI,IAChC,EAAE,YAAY,4BAA4B,IAAI,EAAG,IACjD,CAAC;AAAA,QACL,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA,QAKjB,iBAAiB;AAAA,QACjB;AAAA,QACA,qBAAqB;AAAA,QACrB,8BAA8B;AAAA,QAC9B,uBAAuB;AAAA,QACvB,4BAA4B;AAAA,MAC9B;AAAA,IACF,CAAC;AAAA,EACL;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB,KAAK,UAAU,CAAC,GAAG,WAAW,QAAQ,CAAC;AAAA,EAC7D;AACF;AAOO,SAAS,mCAAmC,UAA8B;AAC/E,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,MAAI,UAAU,KAAK,CAACI,cAAaA,UAAS,OAAO,4BAA4B,GAAG;AAC9E,WAAO;AAAA,EACT;AACA,QAAM,WAA6B;AAAA,IACjC,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,KAAK;AAAA,IACL,aAAa;AAAA,IACb,SAAS;AAAA,IACT,QAAQ,6BAA6B,IAAI,CAAC,SAAS;AACjD,YAAM,eAAe,wBAAwB,UAAU;AAAA,QACrD,iBAAiB;AAAA,QACjB,iBAAiB;AAAA,QACjB,QAAQ;AAAA,MACV,CAAC;AACD,mBAAa,UAAU,UAAU,CAAC,OAAO,UAAU,QAAQ,OAAO;AAClE,mBAAa,UAAU,gBAAgB;AACvC,mBAAa,eAAe;AAAA,QAC1B,EAAE,IAAI,YAAY,UAAU,aAAa,UAAU,KAAK;AAAA,QACxD,EAAE,IAAI,QAAQ,UAAU,aAAa,UAAU,KAAK;AAAA,MACtD;AACA,mBAAa,YAAY,UAAU;AAAA,QACjC,UAAU;AAAA,QACV,UAAU;AAAA,MACZ;AACA,mBAAa,YAAY,kBAAkB;AAAA,QACzC,UAAU;AAAA,QACV,UAAU;AAAA,MACZ;AACA,aAAO;AAAA,QACL,IAAI,GAAG,gCAAgC,GAAG,IAAI;AAAA,QAC9C,iBAAiB;AAAA,QACjB,OAAO,uBAAuB,IAAI;AAAA,QAClC,GAAI,4BAA4B,IAAI,IAChC,EAAE,YAAY,4BAA4B,IAAI,EAAG,IACjD,CAAC;AAAA,QACL,iBAAiB;AAAA,QACjB,iBAAiB;AAAA,QACjB;AAAA,QACA,qBAAqB;AAAA,QACrB,8BAA8B;AAAA,QAC9B,uBAAuB;AAAA,QACvB,4BAA4B,SAAS;AAAA,MACvC;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB,KAAK,UAAU,CAAC,GAAG,WAAW,QAAQ,CAAC;AAAA,EAC7D;AACF;AAeO,SAAS,yBAAyB,UAAoB,SAAyB;AACpF,QAAM,mBAAmB,8BAA8B,UAAU,OAAO;AACxE,MAAI,iBAAiB,WAAW,qBAAqB,GAAG;AACtD,WAAO;AAAA,EACT;AACA,MAAI,iBAAiB,WAAW,gCAAgC,GAAG;AACjE,WAAO;AAAA,EACT;AACA,MAAI,iBAAiB,WAAW,iCAAiC,GAAG;AAClE,WAAO;AAAA,EACT;AACA,MAAI,iBAAiB,WAAW,oCAAoC,GAAG;AACrE,WAAO;AAAA,EACT;AACA,MAAI,iBAAiB,WAAW,+BAA+B,GAAG;AAChE,WAAO;AAAA,EACT;AACA,QAAM,aAAa,iBAAiB,QAAQ,EAAE,KAAK,CAAC,UAAU,MAAM,OAAO,gBAAgB;AAC3F,SAAO,YAAY,cAAc,kBAAkB,QAAQ;AAC7D;AAQA,IAAM,iCAAiC,oBAAI,IAAY;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAaM,SAAS,6BAA6B,UAAoB,SAA0B;AACzF,QAAM,mBAAmB,8BAA8B,UAAU,OAAO;AACxE,QAAM,aAAa,iBAAiB,QAAQ,EAAE,KAAK,CAAC,UAAU,MAAM,OAAO,gBAAgB;AAC3F,MAAI,WAAY,QAAO,WAAW,SAAS;AAC3C,MAAI,iBAAiB,WAAW,qBAAqB,EAAG,QAAO;AAC/D,MAAI,iBAAiB,WAAW,gCAAgC,EAAG,QAAO;AAC1E,QAAM,QAAQ,iBAAiB,QAAQ,GAAG;AAC1C,QAAM,iBAAiB,QAAQ,IAAI,iBAAiB,MAAM,GAAG,KAAK,IAAI;AACtE,MACE,+BAA+B,IAAI,cAAc;AAAA,EAEjD,eAAe,WAAW,mBAAmB,KAC7C,eAAe,WAAW,yBAAyB,GACnD;AACA,WAAO;AAAA,EACT;AACA,UACG,yBAAyB,SAAS,mBAAmB,EAAE,gBAAgB,KAAK,eAC7E;AAEJ;AAEA,SAAS,wBACP,UACA,OAMwB;AACxB,SAAO;AAAA,IACL,qBAAqB,MAAM,uBAAuB,SAAS;AAAA,IAC3D,8BACE,MAAM,gCAAgC,SAAS,gCAAgC;AAAA,IACjF,uBACE,MAAM,yBAAyB,SAAS,qCAAqC;AAAA,IAC/E,4BACE,MAAM,8BAA8B,SAAS,mCAAmC;AAAA,EACpF;AACF;AAEA,SAAS,wBACP,UACA,UACA,OACiB;AACjB,QAAM,gBACJ,SAAS,SAAS,4BAClB,SAAS,SAAS,8BAClB,SAAS,SAAS,gCACd;AAAA,IACE,MAAM;AAAA,IACN,+BAA+B,QAAQ;AAAA,EACzC,IACA;AACN,QAAM,sBAAkE;AAAA,IACtE,eAAe;AAAA,IACf,GAAG;AAAA,IACH,MAAM,uBAAuB,UAAU,MAAM,IAAI,MAAM,gBAAgB;AAAA,IACvE,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA,IACzC,iBAAiB,wBAAwB,UAAU,KAAK;AAAA,EAC1D;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,mBAAmB,qBAAqB,qBAAqB,QAAQ;AAAA,EACvE;AACF;AAEA,SAAS,4BAA4B,QAAiC;AACpE,QAAM,kBAAkB,oBAAI,IAAoB;AAChD,aAAW,SAAS,QAAQ;AAC1B,UAAM,WAAW,gBAAgB,IAAI,MAAM,EAAE;AAC7C,QAAI,aAAa,QAAW;AAC1B,YAAM,IAAI;AAAA,QACR,0CAA0C,KAAK,UAAU,MAAM,EAAE,CAAC,wBAAwB,QAAQ,QAAQ,MAAM,UAAU;AAAA,MAC5H;AAAA,IACF;AACA,oBAAgB,IAAI,MAAM,IAAI,MAAM,UAAU;AAAA,EAChD;AAEA,QAAM,iBAAiB,IAAI,IAAI,eAAe;AAC9C,aAAW,SAAS,QAAQ;AAC1B,UAAM,aAAa,oBAAI,IAAY;AACnC,eAAW,SAAS,MAAM,SAAS;AACjC,UAAI,WAAW,IAAI,KAAK,GAAG;AACzB,cAAM,IAAI;AAAA,UACR,uCAAuC,KAAK,UAAU,MAAM,EAAE,CAAC,6BAA6B,KAAK,UAAU,KAAK,CAAC;AAAA,QACnH;AAAA,MACF;AACA,iBAAW,IAAI,KAAK;AACpB,YAAM,WAAW,eAAe,IAAI,KAAK;AACzC,UAAI,aAAa,QAAW;AAC1B,cAAM,IAAI;AAAA,UACR,uCAAuC,KAAK,UAAU,KAAK,CAAC,cAAc,KAAK,UAAU,MAAM,EAAE,CAAC,iCAAiC,QAAQ;AAAA,QAC7I;AAAA,MACF;AACA,qBAAe,IAAI,OAAO,MAAM,EAAE;AAAA,IACpC;AAAA,EACF;AACF;AAUO,SAAS,iBACd,UACA,SAA4B,QAAQ,KACjB;AACnB,QAAM,YAAY,kBAAkB,QAAQ;AAC5C,QAAM,eAAe,qBAAqB,QAAQ;AAClD,QAAM,YAAY,oBAAoB,UAAU,MAAM;AACtD,QAAM,eAAe,IAAI,IAAI,UAAU,IAAI,CAAC,aAAa,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;AACjF,QAAM,mBAAmB,gCAAgC,QAAQ;AAiBjE,QAAM,iBAAiB,4BAA4B,QAAQ;AAC3D,QAAM,mBAAmB,IAAI;AAAA,IAC3B,eAAe,QAAQ,CAAC,aAAa,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC;AAAA,EAC/E;AACA,QAAM,kBAAkB,IAAI;AAAA,IAC1B,eAAe,QAAQ,CAAC,aAAa,SAAS,OAAO,QAAQ,CAAC,UAAU,MAAM,WAAW,CAAC,CAAC,CAAC;AAAA,EAC9F;AACA,QAAM,uBAAuB,CAAC,OAC5B,GAAG,WAAW,qBAAqB,KACnC,GAAG,WAAW,gCAAgC,KAC9C,gBAAgB,IAAI,EAAE,KACrB,GAAG,SAAS,GAAG,KAAK,iBAAiB,IAAI,EAAE;AAC9C,QAAM,kBAAkB,aAAa,IAAI,SAAS;AAClD,MAAI,CAAC,iBAAiB;AACpB,UAAM,IAAI,MAAM,2BAA2B,SAAS,oBAAoB;AAAA,EAC1E;AACA,QAAM,MAAyB,aAAa;AAAA,IAC1C,SAAS;AAAA,IACT,GAAG,SAAS,SAAS,mBAAmB;AAAA,EAC1C,CAAC,EACE,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,EACxC,IAAI,CAAC,OAAO;AACX,UAAM,eAAe;AAAA,MACnB,GAAG,wBAAwB,UAAU;AAAA,QACnC,iBAAiB;AAAA,QACjB,iBAAiB,SAAS;AAAA,QAC1B,uBAAuB,qCAAqC,UAAU,EAAE;AAAA,QACxE,QAAQ,yBAAyB,EAAE;AAAA,MACrC,CAAC;AAAA,MACD,GAAI,6BAA6B,EAAE,IAC/B,EAAE,eAAe,6BAA6B,EAAE,EAAG,IACnD,CAAC;AAAA,MACL,cAAc,4BAA4B,EAAE;AAAA,IAC9C;AACA,WAAO,wBAAwB,UAAU,iBAAiB;AAAA,MACxD;AAAA,MACA,SAAS,CAAC;AAAA,MACV,OAAO,uBAAuB,EAAE;AAAA,MAChC,GAAI,4BAA4B,EAAE,IAC9B,EAAE,YAAY,4BAA4B,EAAE,EAAG,IAC/C,CAAC;AAAA,MACL,YAAY;AAAA,MACZ,eAAe;AAAA,MACf,KAAK;AAAA,MACL,iBAAiB;AAAA,MACjB,YAAY,EAAE,iBAAiB,IAAI,SAAS,YAAY;AAAA,MACxD,kBAAkB,gBAAgB;AAAA,MAClC,SAAS,gBAAgB;AAAA,MACzB;AAAA,MACA,GAAI,iBAAiB,EAAE,MAAM,SAAY,CAAC,IAAI,EAAE,SAAS,iBAAiB,EAAE,EAAE;AAAA,MAC9E,GAAG,6BAA6B,UAAU,EAAE;AAAA,MAC5C,4BAA4B,SAAS;AAAA,MACrC,iBAAiB,aAAa,UAAU;AAAA,MACxC,iBAAiB,aAAa,YAAY,UAAU;AAAA,IACtD,CAAC;AAAA,EACH,CAAC;AACH,aAAW,YAAY,gBAAgB;AACrC,UAAM,gBAAgB,SAAS,SAAS,SAAS;AACjD,UAAM,mBAAmB,aAAa,IAAI,SAAS,EAAE;AACrD,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,MAAM,2BAA2B,SAAS,EAAE,oBAAoB;AAAA,IAC5E;AACA,eAAW,SAAS,SAAS,QAAQ;AACnC,YAAM,eAAe,MAAM,eACvB,sBAAsB,MAAM,YAAY,IACxC,wBAAwB,UAAU;AAAA,QAChC,iBAAiB,MAAM,mBAAmB;AAAA,QAC1C,iBAAiB,MAAM,mBAAmB;AAAA,MAC5C,CAAC;AACL,YAAM,kBAAkB,MAAM,mBAAmB,MAAM;AACvD,UAAI;AAAA,QACF,wBAAwB,UAAU,kBAAkB;AAAA,UAClD,IAAI,MAAM;AAAA,UACV,SAAS,CAAC,GAAI,MAAM,WAAW,CAAC,CAAE;AAAA,UAClC,OAAO,MAAM,SAAS,uBAAuB,MAAM,EAAE;AAAA,UACrD,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,UAClD,GAAI,MAAM,aACN,EAAE,YAAY,MAAM,WAAW,IAC/B,4BAA4B,MAAM,EAAE,IAClC,EAAE,YAAY,4BAA4B,MAAM,EAAE,EAAG,IACrD,CAAC;AAAA,UACP,YAAY,SAAS;AAAA,UACrB;AAAA,UACA,KAAK,SAAS;AAAA,UACd;AAAA,UACA,YAAY,EAAE,iBAAiB,SAAS,SAAS,IAAI;AAAA,UACrD,kBAAkB,iBAAiB;AAAA,UACnC,SAAS,iBAAiB;AAAA,UAC1B;AAAA,UACA,GAAI,iBAAiB,MAAM,EAAE,MAAM,SAC/B,CAAC,IACD,EAAE,SAAS,iBAAiB,MAAM,EAAE,EAAE;AAAA,UAC1C,GAAI,MAAM,wBAAwB,SAC9B,CAAC,IACD,EAAE,qBAAqB,MAAM,oBAAoB;AAAA,UACrD,GAAI,MAAM,iCAAiC,SACvC,CAAC,IACD;AAAA,YACE,8BAA8B,MAAM;AAAA,UACtC;AAAA,UACJ,GAAI,MAAM,0BAA0B,SAChC,CAAC,IACD,EAAE,uBAAuB,MAAM,sBAAsB;AAAA,UACzD,GAAI,MAAM,+BAA+B,SACrC,CAAC,IACD,EAAE,4BAA4B,MAAM,2BAA2B;AAAA,UACnE,iBAAiB,aAAa,UAAU;AAAA,UACxC,iBAAiB,aAAa,YAAY,UAAU;AAAA,QACtD,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,8BAA4B,GAAG;AAC/B,QAAM,eAAe,IAAI;AAAA,IACvB,CAAC,UAAU,MAAM,OAAO,SAAS,eAAe,MAAM,QAAQ,SAAS,SAAS,WAAW;AAAA,EAC7F;AACA,SAAO,eAAe,IAClB,CAAC,IAAI,YAAY,GAAI,GAAG,IAAI,MAAM,GAAG,YAAY,GAAG,GAAG,IAAI,MAAM,eAAe,CAAC,CAAC,IAClF;AACN;AAGO,SAAS,8BAA8B,UAAoB,SAAyB;AACzF,QAAM,SAAS,iBAAiB,QAAQ;AACxC,QAAM,YAAY,OAAO,KAAK,CAAC,UAAU,MAAM,OAAO,OAAO;AAC7D,MAAI,WAAW;AACb,WAAO,UAAU;AAAA,EACnB;AACA,SAAO,OAAO,KAAK,CAAC,UAAU,MAAM,QAAQ,SAAS,OAAO,CAAC,GAAG,MAAM;AACxE;AASO,SAAS,wBAAwB,UAA8B;AACpE,SAAO,iBAAiB,QAAQ,EAC7B,OAAO,CAAC,UAAU,gCAAgC,UAAU,MAAM,EAAE,CAAC,EACrE,IAAI,CAAC,UAAU,MAAM,EAAE;AAC5B;AAGO,SAAS,gCAAgC,UAAoB,SAA0B;AAC5F,MAAI,CAAC,QAAQ,WAAW,qBAAqB,KAAK,SAAS,4BAA4B;AACrF,WAAO;AACT,QAAM,SAASJ,GACZ,MAAM,uBAAuB,EAC7B,MAAM,KAAK,MAAM,SAAS,uBAAuB,CAAC;AACrD,SAAO,OAAO,KAAK,CAAC,UAAU,MAAM,OAAO,WAAW,CAAC,MAAM,OAAO;AACtE;AAGO,SAAS,oCACd,UACA,QACA,UAKU;AACV,QAAM,SAAS,sBAAsB,MAAM,MAAM;AACjD,MAAI,CAAC,OAAO,eAAe,WAAW,qBAAqB,EAAG,QAAO;AACrE,MAAI,CAAC,SAAS,yBAA0B,OAAM,IAAI,MAAM,gCAAgC;AACxF,QAAM,SACJ,SAAS,4BAA4B,SACjC,CAAC,IACDA,GAAE,MAAM,uBAAuB,EAAE,MAAM,KAAK,MAAM,SAAS,uBAAuB,CAAC;AACzF,QAAM,WAAW,OAAO,KAAK,CAACK,WAAUA,OAAM,OAAO,OAAO,kBAAkBA,OAAM,OAAO;AAC3F,MAAI,CAAC,UAAU;AACb,6CAAyC,UAAU,QAAQ,QAAQ;AACnE,WAAO;AAAA,EACT;AACA,QAAM,EAAE,SAAS,UAAU,GAAG,MAAM,IAAI;AAGxC,QAAM,eAAe;AAAA,IACnB,GAAG;AAAA,IACH,oBAAoB,KAAK;AAAA,MACvB,wBAAwB,SAAS,kBAAkB,EAAE;AAAA,QACnD,CAAC,aAAa,SAAS,OAAO;AAAA,MAChC;AAAA,IACF;AAAA,EACF;AACA,QAAM,mBAAmB,yBAAyB;AAAA,IAChD,GAAG;AAAA,IACH,yBAAyB,KAAK,UAAU,CAAC,KAAK,CAAC;AAAA,EACjD,CAAC;AACD,QAAM,mBAAmB,wBAAwB,iBAAiB,kBAAkB,EAAE;AAAA,IACpF,CAAC,aAAa,SAAS,OAAO;AAAA,EAChC;AACA,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,QAAM,UAAU,UAAU,KAAK,CAAC,aAAa,SAAS,OAAO,iBAAiB;AAC9E,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH,oBAAoB,KAAK,UAAU;AAAA,MACjC,GAAG,UAAU,OAAO,CAAC,aAAa,SAAS,OAAO,iBAAiB;AAAA,MACnE;AAAA,QACE,GAAG;AAAA,QACH,QAAQ;AAAA,UACN,IAAI,SAAS,UAAU,CAAC,GAAG,OAAO,CAAC,cAAc,UAAU,OAAO,MAAM,EAAE;AAAA,UAC1E;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACA,2CAAyC,UAAU,QAAQ,QAAQ;AACnE,SAAO;AACT;AAQO,SAAS,qBACd,UACA,SACyE;AACzE,QAAM,mBAAmB,8BAA8B,UAAU,OAAO;AACxE,QAAM,QAAQ,iBAAiB,QAAQ,EAAE,KAAK,CAAC,cAAc,UAAU,OAAO,gBAAgB;AAC9F,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,WAAW,oBAAoB,QAAQ,EAAE;AAAA,IAC7C,CAAC,cAAc,UAAU,OAAO,MAAM;AAAA,EACxC;AACA,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AACA,SAAO,EAAE,UAAU,MAAM;AAC3B;AAcA,SAAS,+BAA+B,UAAoB,SAA2B;AACrF,MAAI,SAAS,4BAA4B,QAAQ,WAAW,qBAAqB,GAAG;AAClF,WAAO,yBAAyB,QAAQ;AAAA,EAC1C;AACA,MACE,SAAS,gCACT,QAAQ,WAAW,gCAAgC,GACnD;AACA,WAAO,mCAAmC,QAAQ;AAAA,EACpD;AACA,MAAI,QAAQ,WAAW,iCAAiC,GAAG;AAKzD,QAAI,qBAAqB,UAAU,OAAO,GAAG;AAC3C,aAAO;AAAA,IACT;AACA,WAAO,oCAAoC,QAAQ;AAAA,EACrD;AACA,MAAI,QAAQ,WAAW,oCAAoC,GAAG;AAC5D,QAAI,qBAAqB,UAAU,OAAO,GAAG;AAC3C,aAAO;AAAA,IACT;AACA,WAAO,uCAAuC,QAAQ;AAAA,EACxD;AACA,MAAI,QAAQ,WAAW,oCAAoC,GAAG;AAC5D,WAAO,qBAAqB,UAAU,OAAO,IACzC,WACA,uCAAuC,QAAQ;AAAA,EACrD;AACA,MAAI,QAAQ,WAAW,uCAAuC,GAAG;AAC/D,WAAO,qBAAqB,UAAU,OAAO,IACzC,WACA,0CAA0C,QAAQ;AAAA,EACxD;AACA,MAAI,QAAQ,WAAW,+BAA+B,GAAG;AACvD,WAAO,qBAAqB,UAAU,OAAO,IACzC,WACA,kCAAkC,QAAQ;AAAA,EAChD;AACA,MAAI,QAAQ,WAAW,kCAAkC,GAAG;AAC1D,WAAO,qBAAqB,UAAU,OAAO,IACzC,WACA,qCAAqC,QAAQ;AAAA,EACnD;AAIA,SAAO;AACT;AAOO,SAAS,4BACd,UACA,SACyC;AACzC,QAAM,kBAAkB,+BAA+B,UAAU,OAAO;AACxE,SAAO;AAAA,IACL;AAAA,IACA,8BAA8B,iBAAiB,OAAO;AAAA,EACxD;AACF;AAOO,IAAM,2CAAN,cAAuD,MAAM;AAAA,EAClE,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,SAAS,6BACd,UACA,OACuB;AACvB,QAAM,kBAAkB,+BAA+B,UAAU,MAAM,OAAO;AAC9E,QAAM,iBAAiB,8BAA8B,iBAAiB,MAAM,OAAO;AACnF,MAAI,CAAC,gCAAgC,iBAAiB,cAAc,GAAG;AACrE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,qBAAqB,iBAAiB,cAAc;AACrE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,MAAM,qBAAqB,QAC3B,8BAA8B,iBAAiB,MAAM,gBAAgB,MAAM,gBAC3E;AACA,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,cAAc,YAAY,MAAM,MAAM,eAAe,UAAU;AACrE,QAAM,oBAAoB,MAAM,qBAAqB;AACrD,4BAA0B,iBAAiB,gBAAgB,WAAW;AACtE,SAAO,sBAAsB,MAAM;AAAA,IACjC,eAAe;AAAA,IACf;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB,aAAa,MAAM;AAAA,IACnB,iBAAiB,MAAM;AAAA,IACvB,iBAAiB,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,IACA,YAAY,SAAS,SAAS;AAAA,IAC9B,iBAAiB,SAAS,MAAM;AAAA,IAChC,SAAS,SAAS,MAAM;AAAA,IACxB,kBAAkB,SAAS,MAAM;AAAA,IACjC,SAAS,SAAS,MAAM;AAAA,IACxB,mBAAmB,SAAS,MAAM;AAAA,EACpC,CAAC;AACH;AAGO,IAAM,6CAAN,cAAyD,MAAM;AAAA,EAC3D,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,sEAAsE;AAC5E,SAAK,OAAO;AAAA,EACd;AACF;AAOO,SAAS,uCACd,UACA,UACA,gBAC6D;AAC7D,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,yCAAyC;AAC3D,MAAI,sBAAsB,MAAM,cAAc,EAAE,0BAA0B,QAAW;AACnF,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AACA,QAAM,EAAE,OAAO,IAAI,oBAAoB,MAAM,QAAQ;AAGrD,SAAO,yCAAyC,UAAU,QAAQ;AAAA,IAChE,SAAS,OAAO;AAAA,IAChB,iBAAiB,OAAO;AAAA,IACxB,aAAa,OAAO;AAAA,EACtB,CAAC;AACH;AAKO,SAAS,yCACd,UACA,QACA,UASA;AACA,QAAM,SAAS,sBAAsB,MAAM,MAAM;AACjD,QAAM,kBAAkB,+BAA+B,UAAU,OAAO,cAAc;AACtF,QAAM,yBAAyB,8BAA8B,iBAAiB,SAAS,OAAO;AAC9F,QAAM,sBAAsB,SAAS,eAAe,OAAO;AAC3D,MACE,OAAO,mBAAmB,0BAC1B,OAAO,oBAAoB,SAAS,mBACpC,OAAO,gBAAgB,qBACvB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,4BAA0B,iBAAiB,OAAO,gBAAgB,OAAO,WAAW;AACpF,MACE,OAAO,qBAAqB,QAC5B,8BAA8B,iBAAiB,OAAO,gBAAgB,MACpE,OAAO,gBACT;AACA,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,QAAM,WAAW,qBAAqB,iBAAiB,OAAO,cAAc;AAC5E,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AAIA,QAAM,oBACJ,SAAS,SAAS,SAAS,kCACvB,cACA,SAAS,SAAS,SAAS,qCACzB,iBACA;AACR,QAAM,gCACJ,sBAAsB,QACtB,OAAO,eAAe,SAAS,SAAS,MACxC,OAAO,oBAAoB,SAAS,MAAM,mBAC1C,OAAO,YAAY,SAAS,MAAM,OAClC,cAAc,OAAO,gBAAgB,MACnC,cAAc;AAAA,IACZ,MAAM,GAAG,iBAAiB;AAAA,IAC1B,WAAW;AAAA,EACb,CAAC,KACH,cAAc,OAAO,OAAO,MAC1B,cAAc;AAAA,IACZ,eAAe;AAAA,IACf,UAAU;AAAA,EACZ,CAAC,KACH,OAAO,sBACL;AAAA,IACE;AAAA,MACE,GAAG,SAAS;AAAA,MACZ,kBAAkB,OAAO;AAAA,MACzB,SAAS,OAAO;AAAA,IAClB;AAAA,IACA,SAAS;AAAA,IACT,EAAE,8BAA8B,KAAK;AAAA,EACvC;AAOJ,QAAM,6BAA6B;AAAA,IACjC,SAAS;AAAA,IACT,SAAS;AAAA,EACX;AACA,QAAM,2BACJ,iCAAiC,SAAS,OAAO,SAAS,UAAU,MAAM,KACzE,+BAA+B,QAC9B,iCAAiC,4BAA4B,SAAS,UAAU,MAAM;AAC1F,QAAM,qBACJ,OAAO,eAAe,SAAS,SAAS,MACxC,OAAO,oBAAoB,SAAS,MAAM,mBAC1C,OAAO,YAAY,SAAS,MAAM,OAClC,cAAc,OAAO,gBAAgB,MAAM,cAAc,SAAS,MAAM,gBAAgB,KACxF,cAAc,OAAO,OAAO,MAAM,cAAc,SAAS,MAAM,OAAO;AAGxE,MAAI,sBAAsB,CAAC,+BAA+B;AACxD,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,MAAI,CAAC,4BAA4B,CAAC,+BAA+B;AAC/D,UAAM,IAAI,2CAA2C;AAAA,EACvD;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,UAAU,SAAS;AAAA,IACnB,OAAO,8CAA8C,SAAS,OAAO,SAAS,UAAU,MAAM;AAAA,EAChG;AACF;AAQO,SAAS,gCACd,UACwC;AACxC,QAAM,WAAW,OAAO;AAAA,IACtB,OAAO,QAAQ,mBAAmB,EAAE,IAAI,CAAC,CAAC,OAAO,OAAO,MAAM;AAAA,MAC5D;AAAA,MACA,8BAA8B,OAAO;AAAA,IACvC,CAAC;AAAA,EACH;AACA,QAAM,WAAmD,CAAC;AAC1D,aAAW,YAAY,4BAA4B,QAAQ,GAAG;AAC5D,eAAW,SAAS,SAAS,QAAQ;AACnC,UAAI,MAAM,SAAS;AACjB,iBAAS,MAAM,EAAE,IAAI,8BAA8B,MAAM,OAAO;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,OAAO;AAAA,IACxB,OAAO,QAAQ,sBAAsB,SAAS,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,OAAO,MAAM;AAAA,MACzF;AAAA,MACA,8BAA8B,OAAO;AAAA,IACvC,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AACF;AAQO,SAAS,oCACd,UACwC;AACxC,QAAM,SAAS,gCAAgC,QAAQ;AACvD,QAAM,aAAa,OAAO;AAAA,IACxB,OAAO,QAAQ,sBAAsB,SAAS,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,OAAO,MAAM;AAAA,MACzF;AAAA,MACA,8BAA8B,OAAO;AAAA,IACvC,CAAC;AAAA,EACH;AAGA,MACE,SAAS,mBAAmB,YAC5B,yBAAyB,SAAS,iBAAiB,2BAA2B,GAC9E;AACA,eAAW,SAAS,iBAAiB,QAAQ,GAAG;AAC9C,UACE,MAAM,eAAe,kBAAkB,QAAQ,KAC/C,CAAC,MAAM,gBAAgB,WAAW,MAAM,KACxC,OAAO,MAAM,EAAE,MAAM;AAErB;AACF,YAAM,WAAW,yBAAyB,MAAM,eAAe;AAC/D,UAAI,SAAU,QAAO,MAAM,EAAE,IAAI;AAAA,IACnC;AAAA,EACF;AACA,aAAW,YAAY,4BAA4B,QAAQ,GAAG;AAC5D,eAAW,SAAS,SAAS,QAAQ;AACnC,UAAI,OAAO,MAAM,EAAE,MAAM,OAAW;AACpC,YAAM,WAAW,6BAA6B,UAAU,UAAU,OAAO,UAAU;AACnF,UAAI,SAAU,QAAO,MAAM,EAAE,IAAI;AAAA,IACnC;AAAA,EACF;AACA,SAAO;AACT;AASA,SAAS,6BACP,UACA,UACA,OACA,YACoC;AACpC,QAAM,WAAW,MAAM,mBAAmB,MAAM;AAChD,MAAI;AACJ,MAAI,eAAe;AACnB,UAAQ,SAAS,MAAM;AAAA,IACrB,KAAK;AACH,UACE,SAAS,QAAQ,QAAQ,QAAQ,EAAE,MAAM,uBACzC,aAAa,4BAA4B,MAAM,2BAA2B,MAAM,GAChF;AACA,kBAAU;AAAA,MACZ;AACA;AAAA,IACF,KAAK;AACH,UAAI,SAAS,WAAW,MAAM,EAAG,WAAU;AAC3C;AAAA,IACF,KAAK;AACH,UAAI,SAAS,WAAW,OAAO,EAAG,WAAU;AAC5C;AAAA,IACF,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,UAAI,yBAAyB,QAAQ,GAAG;AACtC,kBAAU;AACV,uBAAe;AAAA,MACjB;AACA;AAAA,IACF,KAAK;AAAA,IACL,KAAK;AACH,UAAI,yBAAyB,SAAS,OAAO,KAAK,SAAS,WAAW,MAAM,GAAG;AAC7E,kBAAU;AAAA,MACZ;AACA;AAAA,IACF,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAIH,gBAAU,+BAA+B,QAAQ,EAAE;AAAA,QACjD,CAAC,cACC,UAAU,oBAAoB,YAC9B,OAAO,OAAO,uBAAuB,EAAE;AAAA,UACrC,CAAC,aAAa,SAAS,oBAAoB,UAAU;AAAA,QACvD;AAAA,MACJ,GAAG;AACH;AAAA,IACF,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,UAAI,aAAa,4BAA4B,MAAM,2BAA2B,MAAM,GAAG;AACrF,kBAAU;AAAA,MACZ;AACA;AAAA,IACF,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,sBAAsB;AAGzB,UAAI,CAAC,gCAAgC,QAAQ,EAAE,SAAS,QAAQ,EAAG,QAAO;AAC1E,aAAO,0BAA0B,QAAQ;AAAA,IAC3C;AAAA,IACA,KAAK;AAGH,UAAI,yBAAyB,SAAS,OAAO,KAAK,SAAS,WAAW,MAAM,GAAG;AAC7E,kBAAU;AAAA,MACZ,WAAW,SAAS,QAAQ,QAAQ,QAAQ,EAAE,MAAM,uBAAuB;AACzE,YAAI,SAAS,WAAW,OAAO,EAAG,WAAU;AAAA,MAC9C,WACE,SAAS,QAAQ,wBACjB,SAAS,QAAQ,QAAQ,QAAQ,EAAE,MAAM,kCACzC,yBAAyB,QAAQ,GACjC;AACA,kBAAU;AACV,uBAAe;AAAA,MACjB;AACA;AAAA,IACF;AACE,aAAO;AAAA,EACX;AACA,MAAI,CAAC,QAAS,QAAO;AAGrB,MAAI,WAAW,OAAO,EAAG,QAAO,WAAW,OAAO;AAClD,QAAM,WACJ,yBAAyB,OAAO,KAChC,oBAAoB,OAAO,MAC1B,YAAY,8BAA8B,oCAAoC;AACjF,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,CAAC,gBAAgB,SAAS,WAAW,aAAa,KAAM,QAAO;AAEnE,QAAM,iBAAiB,CAAC,WAAyB;AAAA,IAC/C,GAAG;AAAA,IACH,kCAAkC,MAAM,8BAA8B;AAAA,EACxE;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,eAAe,SAAS,OAAO;AAAA,IACxC,GAAI,SAAS,kBACT;AAAA,MACE,iBAAiB,SAAS,gBAAgB,IAAI,CAAC,UAAU;AAAA,QACvD,GAAG;AAAA,QACH,SAAS,eAAe,KAAK,OAAO;AAAA,MACtC,EAAE;AAAA,IACJ,IACA,CAAC;AAAA,EACP;AACF;AAGO,SAAS,uBAAuB,UAAkD;AACvF,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,gCAAgC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,QAAQ,MAAM;AAAA,MACnF;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAGO,SAAS,mBACd,UACA,aACc;AACd,QAAM,wBAAwB,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,CAAC;AACjE,MAAI,WAAW,SAAS;AACxB,aAAW,QAAQ,SAAS,mBAAmB,CAAC,GAAG;AACjD,QAAI,wBAAwB,KAAK,oBAAoB;AACnD;AAAA,IACF;AACA,eAAW,KAAK;AAAA,EAClB;AACA,SAAO;AACT;AAMO,SAAS,yBACd,UAIQ;AACR,MAAI,SAAS,iCAAiC,QAAW;AACvD,WAAO,KAAK,IAAI,SAAS,qBAAqB,SAAS,4BAA4B;AAAA,EACrF;AACA,SAAO,KAAK,IAAI,GAAG,SAAS,sBAAsB,SAAS,2BAA2B;AACxF;AAOO,SAAS,iCACd,UACA,OAOA,mBACA,sBACU;AACV,QAAM,sBAAsB,MAAM,uBAAuB,SAAS;AAClE,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH;AAAA,IACA,GAAI,MAAM,iCAAiC,SACvC,CAAC,IACD;AAAA,MACE,8BAA8B,KAAK;AAAA,QACjC;AAAA,QACA,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACJ,GAAI,MAAM,0BAA0B,SAChC,CAAC,IACD,EAAE,mCAAmC,MAAM,sBAAsB;AAAA,IACrE,GAAI,MAAM,+BAA+B,SACrC,CAAC,IACD,EAAE,iCAAiC,MAAM,2BAA2B;AAAA,EAC1E;AACA,MAAI,sBAAsB,UAAa,CAAC,MAAM,GAAI,QAAO;AACzD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,mCAAmC;AAAA,MACjC;AAAA,MACA,EAAE,GAAG,OAAO,IAAI,MAAM,GAAG;AAAA,MACzB;AAAA,MACA;AAAA,IACF,EAAE;AAAA,EACJ;AACF;AAOO,SAAS,+BACd,UACA,OAIA,mBACA,sBACuB;AACvB,QAAM,WAAW,iCAAiC,UAAU,KAAK;AACjE,QAAM,gBAAgB,KAAK;AAAA,IACzB;AAAA,IACA,KAAK,MAAM,KAAK,IAAI,SAAS,sBAAsB,KAAK,yBAAyB,QAAQ,CAAC,CAAC;AAAA,EAC7F;AACA,QAAM,gBAAgB,KAAK,IAAI,MAAQ,aAAa;AAGpD,QAAM,QAAQ,CAAC,UAAkB,KAAK,IAAI,GAAG,KAAK,IAAI,eAAe,KAAK,MAAM,KAAK,CAAC,CAAC;AACvF,QAAM,gBAAgB;AAAA,IACpB,SAAS,qCACP,SAAS,sBACP,KAAK,IAAI,KAAK,KAAK,IAAI,KAAK,SAAS,+BAA+B,CAAC;AAAA,EAC3E;AACA,QAAM,iBAAiB,kCAAkC,mBAAmB,MAAM,EAAE;AACpF,QAAM,qBAAqB,qCAAqC,sBAAsB,MAAM,EAAE;AAC9F,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,MAAM,kBAAkB,sBAAsB,aAAa;AAAA,IAC5E;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,4BAA4B,UAA6C;AACvF,SAAO,2BAA2B,SAAS,qBAAqB;AAClE;AAEO,SAAS,uBAAuB,UAAwC;AAC7E,MAAI,SAAS,qBAAqB,QAAQ;AACxC,WAAO,CAAC;AAAA,EACV;AACA,QAAM,aAAa,4BAA4B,SAAS,sBAAsB;AAC9E,MAAI,SAAS,qBAAqB,UAAU;AAC1C,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,+BAA+B;AAAA,IAC/B,mCAAmC,SAAS,gBAAgB;AAAA,IAC5D,oBAAoB;AAAA,IACpB,sBAAsB;AAAA,IACtB,sBAAsB,QAAQ,SAAS,eAAe,SAAS,mBAAmB;AAAA,IAClF,GAAG;AAAA,EACL;AACF;AAEO,SAAS,8BACd,UACA,OACA,OACA,SACQ;AACR,SAAO,iCAAiC,UAAU,OAAO,OAAO,OAAO,EAAE;AAC3E;AAEO,SAAS,iCACd,UACA,OACA,OACA,SACyB;AACzB,QAAM,WAAW,gCAAgC,QAAQ,EAAE,KAAK;AAChE,SAAO,4BAA4B,UAAU,OAAO,OAAO,UAAU,OAAO;AAC9E;AAGO,SAAS,qCACd,UACA,OACA,OACA,SACyB;AACzB,QAAM,WAAW,oCAAoC,QAAQ,EAAE,KAAK;AACpE,SAAO,4BAA4B,UAAU,OAAO,OAAO,UAAU,OAAO;AAC9E;AASO,SAAS,oCACd,UACA,OACA,OACA,SAC4B;AAC5B,QAAM,WAAW,oCAAoC,QAAQ,EAAE,KAAK;AACpE,QAAM,WAAW,4BAA4B,UAAU,OAAO,OAAO,UAAU,OAAO;AACtF,QAAM,UAAU,EAAE,GAAG,UAAU,mBAAmB,MAAM,mBAAmB,MAAM;AACjF,MAAI,CAAC,YAAY,CAAC,SAAS,kBAAmB,QAAO;AACrD,QAAM,UAAU,MAAM,qBAAqB,SAAS,MAAM,sBAAsB,CAAC,KAAK;AACtF,QAAM,UAAsC;AAAA,IAC1C,eAAe;AAAA,IACf,WAAW;AAAA,IACX,YAAY;AAAA,IACZ,QAAQ;AAAA,EACV;AACA,QAAM,mBAAmB,oBAAI,IAA0B;AACvD,QAAM,SAAS,6BAA6B,UAAU,KAAK;AAC3D,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,kBAAkB,MAAM,WAAW,KAAK,CAAC,kBAAkB,MAAM,YAAY;AAChF,aAAO;AACT,UAAM,SAAS,wBAAwB,OAAO;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,SAAS,wBAAwB,OAAO,CAAC,sBAAsB,kBAAkB,GAAG,IAAI;AAC9F,QAAI,WAAW,UAAa,WAAW,UAAa,SAAS,SAAS,MAAM;AAC1E,aAAO;AACT,UAAM,UAAU,mBAAmB,UAAU,MAAM,WAAW;AAC9D,QAAI,SAAS,KAAK,QAAQ,sCAAsC,OAAW,QAAO;AAClF,QAAI,SAAS,KAAK,QAAQ,qCAAqC,OAAW,QAAO;AACjF,UAAM,QAAoC;AAAA,MACxC,eAAe,KAAK;AAAA,SAChB,MAAM,cAAc,SAAS,UAAU,QAAQ,8BAA+B;AAAA,MAClF;AAAA,MACA,WAAW,KAAK,KAAM,UAAU,QAAQ,qCAAqC,KAAM,GAAS;AAAA,MAC5F,YAAY,KAAK,KAAM,UAAU,QAAQ,oCAAoC,KAAM,GAAS;AAAA,MAC5F,QAAQ,KAAK,KAAM,MAAM,eAAe,QAAQ,+BAAgC,GAAS;AAAA,IAC3F;AACA,QAAI,UAAU,SAAS,GAAG;AACxB,YAAM,aAAa,wBAAwB,OAAO,CAAC,uBAAuB,CAAC;AAC3E,YAAM,UAAU,wBAAwB,OAAO,CAAC,uBAAuB,CAAC;AACxE,UAAI,eAAe,UAAa,YAAY,UAAa,aAAa,YAAY;AAChF,eAAO;AACT,UAAI,OAAO,gBAAgB;AACzB,cAAM,aACJ,KAAK,KAAM,aAAa,OAAO,eAAe,aAAc,GAAS,IACrE,KAAK,KAAM,UAAU,OAAO,eAAe,UAAW,GAAS;AAAA,MACnE,WACE,EACG,OAAO,gBAAgB,QAAQ,YAAY,KAC3C,OAAO,gBAAgB,QAAQ,eAAe,IAEjD;AAEA,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,MAAM,mBAAmB,KAAK;AACpC,qBAAiB,IAAI,UAAU,iBAAiB,IAAI,OAAO,KAAK,KAAK,GAAG;AACxE,eAAW,OAAO,2BAA4B,SAAQ,GAAG,KAAK,MAAM,GAAG;AAAA,EACzE;AACA,MAAI,qBAAqB,mBAAmB,OAAO;AACnD,MAAI,mBAAmB;AACvB,aAAW,CAAC,SAAS,GAAG,KAAK,kBAAkB;AAC7C,UAAM,YAAY,yBAAyB,UAAU,QAAQ,SAAS;AACtE,wBAAoB,KAAK,KAAM,OAAO,MAAS,aAAc,GAAM;AAAA,EACrE;AACA,MAAI,oBAAoB;AACxB,QAAM,cAAc,QAAQ,eAAe;AAC3C,MAAI,gBAAgB,YAAY;AAC9B,UAAM,kBAAkB,+BAA+B,UAAU,KAAK;AACtE,UAAM,WAAW;AAAA,MACf;AAAA,MACA,8BAA8B,iBAAiB,KAAK;AAAA,IACtD;AACA,UAAM,aAAa,UAAU,MAAM,aAAa,aAAa;AAAA,MAC3D,CAAC,SAAS,KAAK,OAAO,eAAe,KAAK;AAAA,IAC5C,GAAG;AACH,QAAI,eAAe,UAAa,cAAc,EAAG,QAAO;AACxD,yBAAqB,KAAK,KAAM,qBAAqB,aAAc,GAAM;AACzE,uBAAmB,KAAK,KAAM,mBAAmB,aAAc,GAAM;AACrE,UAAM,SAAS,+BAA+B,SAAS,YAAY,kBAAkB;AACrF,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,OAAO,SAAS,OAAO,OAAO;AACrC,wBAAoB,OAAO;AAAA,EAC7B;AACA,MAAI,CAAC,CAAC,oBAAoB,kBAAkB,GAAG,OAAO,OAAO,OAAO,CAAC,EAAE,MAAM,iBAAiB;AAC5F,WAAO;AACT,SAAO,EAAE,oBAAoB,kBAAkB,mBAAmB,SAAS,kBAAkB;AAC/F;AASO,SAAS,qCACd,UACA,OACA,OACA,4BACiC;AACjC,QAAM,UAA2C;AAAA,IAC/C,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,EACrB;AACA,MAAI,CAAC,kBAAkB,0BAA0B,EAAG,QAAO;AAC3D,QAAM,WAAW,oCAAoC,QAAQ,EAAE,KAAK;AACpE,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,UAAU,EAAE,eAAe,IAAI,WAAW,IAAI,YAAY,IAAI,QAAQ,GAAG;AAC/E,QAAM,UAAU,MAAM,qBAAqB,SAAS,MAAM,sBAAsB,CAAC,KAAK;AACtF,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,kBAAkB,MAAM,WAAW,KAAK,CAAC,kBAAkB,MAAM,YAAY;AAChF,aAAO;AACT,UAAM,SAAS,wBAAwB,OAAO;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,SAAS,wBAAwB,OAAO,CAAC,sBAAsB,kBAAkB,GAAG,IAAI;AAC9F,QAAI,WAAW,UAAa,WAAW,UAAa,SAAS,SAAS,MAAM;AAC1E,aAAO;AACT,UAAM,UAAU,mBAAmB,UAAU,MAAM,WAAW;AAC9D,UAAM,WAAW;AAAA,MACf,eAAe,MAAM,cAAc,SAAS;AAAA,MAC5C,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,QAAQ,MAAM;AAAA,IAChB;AACA,UAAM,QAAQ;AAAA,MACZ,eAAe,QAAQ;AAAA,MACvB,WAAW,QAAQ;AAAA,MACnB,YAAY,QAAQ;AAAA,MACpB,QAAQ,QAAQ;AAAA,IAClB;AACA,eAAW,OAAO,4BAA4B;AAC5C,UAAI,SAAS,GAAG,MAAM,EAAG;AACzB,YAAM,OAAO,MAAM,GAAG;AACtB,UAAI,CAAC,kBAAkB,IAAI,EAAG,QAAO;AAErC,cAAQ,GAAG,KAAK,OAAO,SAAS,GAAG,CAAC,IAAI,OAAO,IAAI;AAAA,IACrD;AAAA,EACF;AACA,QAAM,UAAU,gCAAgC,SAAS,0BAA0B;AACnF,SAAO,UAAU,EAAE,mBAAmB,SAAS,mBAAmB,KAAK,IAAI;AAC7E;AAEA,IAAM,6BAA6B,CAAC,iBAAiB,aAAa,cAAc,QAAQ;AAExF,SAAS,mBAAmB,OAA2C;AACrE,SAAO,2BAA2B,OAAO,CAAC,OAAO,QAAQ,QAAQ,MAAM,GAAG,GAAG,CAAC;AAChF;AAGA,SAAS,gCACP,SACA,QACwC;AACxC,QAAM,cAAc,2BAA2B,OAAO,CAAC,OAAO,QAAQ,QAAQ,QAAQ,GAAG,GAAG,EAAE;AAC9F,MAAI,gBAAgB,IAAI;AACtB,WAAO,WAAW,IAAI,EAAE,eAAe,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,EAAE,IAAI;AAAA,EACvF;AACA,QAAM,OAAO,2BAA2B,IAAI,CAAC,KAAK,UAAU;AAC1D,UAAM,YAAY,OAAO,MAAM,IAAI,QAAQ,GAAG;AAC9C,WAAO,EAAE,KAAK,OAAO,OAAO,YAAY,aAAa,WAAW,YAAY,YAAY;AAAA,EAC1F,CAAC;AACD,QAAM,YAAY,OAAO,MAAM,IAAI,KAAK,OAAO,CAAC,OAAO,QAAQ,QAAQ,IAAI,OAAO,EAAE;AACpF,QAAM,SAAS,CAAC,GAAG,IAAI,EAAE;AAAA,IAAK,CAAC,GAAG,MAChC,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,KAAK;AAAA,EACrF;AACA,WAAS,QAAQ,GAAG,QAAQ,OAAO,SAAS,GAAG,QAAS,QAAO,KAAK,EAAG,SAAS;AAChF,SAAO,OAAO;AAAA,IACZ,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC;AAAA,EAChD;AACF;AAEA,SAAS,kBAAkB,OAAiC;AAC1D,SAAO,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS;AAC9E;AAEA,SAAS,wBACP,OACA,MACA,YAAY,OACQ;AACpB,QAAM,UAAU,MAAM,QAAQ,MAAM,kBAAkB,IAClD,MAAM,qBACN,MAAM,qBACJ,CAAC,MAAM,kBAAkB,IACzB,CAAC;AACP,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,MAAI,QAAQ;AACZ,aAAW,UAAU,SAAS;AAC5B,UAAM,UAAU,KAAK,OAAO,CAAC,QAAQ,OAAO,GAAG,MAAM,MAAS;AAC9D,QAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,eAAW,OAAO,YAAY,QAAQ,MAAM,GAAG,CAAC,IAAI,SAAS;AAC3D,UAAI,CAAC,kBAAkB,OAAO,GAAG,CAAC,EAAG,QAAO;AAC5C,eAAS,OAAO,GAAG;AAAA,IACrB;AAAA,EACF;AACA,SAAO,kBAAkB,KAAK,IAAI,QAAQ;AAC5C;AAEA,SAAS,6BACP,UACA,SAMY;AACZ,aAAW,YAAY,4BAA4B,QAAQ,GAAG;AAC5D,UAAM,QAAQ,SAAS,OAAO,KAAK,CAAC,cAAc,UAAU,OAAO,OAAO;AAC1E,QAAI,CAAC,SAAS,SAAS,QAAQ,qBAAsB;AACrD,UAAM,SAAS,EAAE,aAAa,SAAS,WAAW,SAAS;AAC3D,UAAM,WAAW,MAAM,mBAAmB,MAAM;AAChD,UAAM,YAAY,sBAAsB,SAAS,gBAAgB;AACjE,UAAM,WACJ,SAAS,SAAS,yBAClB,SAAS,SAAS,4BAClB,SAAS,SAAS,mCAClB,SAAS,SAAS,sCACjB,SAAS,SAAS,aACjB,SAAS,QAAQ,QAAQ,QAAQ,EAAE,MAAM;AAC7C,UAAM,YAAY,yBAAyB,QAAQ,GAAG;AACtD,QACE,CAAC,YACD,CAAC,yBAAyB,QAAQ,KAClC,CAAC,WAAW,oCACZ,MAAM,WACN,UAAU,OAAO,MAAM,UACvB,UAAU,QAAQ,MAAM;AAExB,aAAO;AACT,WAAO;AAAA,MACL,GAAG;AAAA,MACH,gBAAgB;AAAA,QACd,YAAY,UAAU;AAAA,QACtB,SAAS,UAAU,8BAA8B;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,+BACP,SACA,YACA,QAC2E;AAC3E,MACE,CAAC,kBAAkB,UAAU,KAC7B,CAAC,kBAAkB,MAAM,KACzB,CAAC,OAAO,OAAO,OAAO,EAAE,MAAM,iBAAiB;AAE/C,WAAO;AACT,QAAM,OAAO,2BAA2B,IAAI,CAAC,KAAK,UAAU;AAC1D,UAAM,YAAY,OAAO,QAAQ,GAAG,CAAC,IAAI,OAAO,UAAU;AAC1D,WAAO,EAAE,KAAK,OAAO,OAAO,OAAO,YAAY,MAAO,GAAG,WAAW,YAAY,OAAQ;AAAA,EAC1F,CAAC;AACD,QAAM,YAAY,SAAS,KAAK,OAAO,CAAC,OAAO,QAAQ,QAAQ,IAAI,OAAO,CAAC;AAC3E,MAAI,YAAY,KAAK,YAAY,KAAK,OAAQ,QAAO;AACrD,QAAM,SAAS,CAAC,GAAG,IAAI,EAAE;AAAA,IAAK,CAAC,GAAG,MAChC,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,KAAK;AAAA,EACrF;AACA,WAAS,QAAQ,GAAG,QAAQ,WAAW,QAAS,QAAO,KAAK,EAAG,SAAS;AACxE,SAAO;AAAA,IACL,SAAS,OAAO;AAAA,MACd,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC;AAAA,IACxC;AAAA,IACA,aAAa,KAAK,KAAK,CAAC,QAAQ,IAAI,cAAc,EAAE;AAAA,EACtD;AACF;AAEA,SAAS,4BACP,UACA,OACA,OACA,UACA,SACyB;AACzB,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,6BAA6B,KAAK,EAAE;AAAA,EACtD;AACA,QAAM,UACJ,MAAM,uBAAuB,MAAM,oBAAoB,SAAS,IAC5D,MAAM,sBACN,CAAC,KAAK;AACZ,QAAM,mBAAmB,oBAAI,IAA0B;AACvD,aAAW,SAAS,SAAS;AAC3B,UAAM,UAAU,mBAAmB,UAAU,YAAY,MAAM,WAAW,CAAC;AAC3E,qBAAiB;AAAA,MACf;AAAA,OACC,iBAAiB,IAAI,OAAO,KAAK,KAAK,yBAAyB,SAAS,KAAK;AAAA,IAChF;AAAA,EACF;AACA,MAAI,qBAAqB;AACzB,MAAI,mBAAmB;AACvB,aAAW,CAAC,SAAS,OAAO,KAAK,kBAAkB;AACjD,UAAM,YAAY,yBAAyB,UAAU,QAAQ,SAAS;AACtE,0BAAsB;AACtB,wBAAoB,KAAK,KAAM,WAAW,MAAS,aAAc,GAAM;AAAA,EACzE;AACA,QAAM,cAAc,SAAS,eAAe;AAC5C,MAAI,gBAAgB,YAAY;AAC9B,UAAM,kBAAkB,+BAA+B,UAAU,KAAK;AACtE,UAAM,WAAW;AAAA,MACf;AAAA,MACA,8BAA8B,iBAAiB,KAAK;AAAA,IACtD;AACA,UAAM,gBAAgB,UAAU,MAAM,aAAa,aAAa;AAAA,MAC9D,CAAC,SAAS,KAAK,OAAO,eAAe,KAAK;AAAA,IAC5C,GAAG;AACH,QAAI,iBAAiB,gBAAgB,GAAG;AACtC,2BAAqB,KAAK,KAAM,qBAAqB,gBAAiB,GAAM;AAC5E,yBAAmB,KAAK,KAAM,mBAAmB,gBAAiB,GAAM;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,EAAE,oBAAoB,iBAAiB;AAChD;AAOO,SAAS,mCACd,UACA,OACA,kBACA,SACQ;AACR,SAAO,sCAAsC,UAAU,OAAO,kBAAkB,OAAO,EACpF;AACL;AAQA,SAAS,gCAAgC,kBAAsD;AAC7F,QAAM,QAAQ,kCAAkC,KAAK,gBAAgB;AACrE,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AACA,QAAM,WAAW,MAAM,CAAC,KAAK;AAC7B,QAAM,gBAAgB,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,QAAQ,EAAE;AACrD,QAAM,eAAe,OAAO,OAAO,SAAS,MAAM;AAClD,QAAM,oBAAoB,gBAAgB;AAC1C,QAAM,sBAAsB,oBAAoB,eAAe,MAAM;AACrE,MAAI,qBAAqB,OAAO,OAAO,gBAAgB,GAAG;AACxD,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,oBAAoB,OAAO,kBAAkB;AAAA,EAC/C;AACF;AAGO,SAAS,2CAA2C,kBAAkC;AAC3F,SAAO,gCAAgC,gBAAgB,EAAE;AAC3D;AAEO,SAAS,sCACd,UACA,OACA,kBACA,SACyB;AACzB,QAAM,WAAW,gCAAgC,QAAQ,EAAE,KAAK;AAChE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,6BAA6B,KAAK,EAAE;AAAA,EACtD;AACA,QAAM,UAAU,mBAAmB,UAAU,YAAY,SAAS,WAAW,CAAC;AAC9E,QAAM,EAAE,mBAAmB,cAAc,mBAAmB,IAC1D,gCAAgC,gBAAgB;AAClD,QAAM,YAAY,OAAO,MAAS,yBAAyB,UAAU,QAAQ,SAAS,CAAC;AACvF,QAAM,YAAY,oBAAoB;AACtC,QAAM,cAAc,eAAe;AACnC,QAAM,gBAAgB,YAAY,cAAc,MAAM;AACtD,MAAI,eAAe,OAAO,OAAO,gBAAgB,GAAG;AAClD,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO;AAAA,IACL;AAAA,IACA,kBAAkB,OAAO,YAAY;AAAA,EACvC;AACF;AAOO,SAAS,yCACd,UACA,OAKQ;AACR,MAAI,MAAM,YAAY,uBAAuB;AAC3C,UAAM,IAAI,MAAM,+CAA+C,MAAM,OAAO,EAAE;AAAA,EAChF;AACA,MAAI,CAAC,OAAO,cAAc,MAAM,eAAe,KAAK,MAAM,kBAAkB,GAAG;AAC7E,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,OACJ,MAAM,eAAe,SACjB,SAAS,2CACT,SAAS;AACf,QAAM,OAAO,OAAO,MAAM;AAC1B,MAAI,CAAC,OAAO,cAAc,IAAI,KAAK,QAAQ,KAAK,OAAO,KAAe;AACpE,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO;AACT;AAEO,SAAS,kCACd,UACwC;AACxC,SAAO,aAAa;AAAA,IAClB,SAAS;AAAA,IACT,GAAG,SAAS,SAAS,6BAA6B;AAAA,EACpD,CAAC,EAAE,IAAI,CAAC,UAAU,gBAAgB,MAAM,KAAK,CAAC;AAChD;AAOO,SAAS,+BAA+B,UAAuC;AACpF,MAAI,CAAC,SAAS,2BAA2B;AACvC,WAAO;AAAA,EACT;AACA,QAAM,UAAU,OAAO,KAAK,SAAS,2BAA2B,QAAQ;AACxE,MAAI,QAAQ,WAAW,IAAI;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,IAAI,WAAW,OAAO;AAC/B;AAQO,SAAS,0BAA0B,UAA+C;AACvF,QAAM,SAAS,SAAS,gBAAgB,KAAK,KAAK;AAClD,QAAM,qBAAqB,SAAS,uBAAuB,KAAK,KAAK;AACrE,QAAM,SAAS;AAAA,IACb,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,oBAAoB;AAAA,IACxB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,mBAAmB;AAAA,IACvB,SAAS;AAAA,IACT;AAAA,EACF;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ,gBAAgB,GAAG;AAC5D,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,MAAmC,CAAC;AAC1C,MAAI,oBAAoB;AACtB,QAAI,qBAAqB;AAAA,EAC3B;AACA,MAAI,QAAQ;AACV,QAAI,0BAA0B;AAAA,EAChC;AACA,MAAI,qBAAqB,kBAAkB;AACzC,QAAI,iBAAiB,EAAE,KAAK,mBAAmB,KAAK,iBAAiB;AAAA,EACvE;AACA,QAAM,eAAe,OAAO,KAAK,GAAG,EAAE,SAAS;AAC/C,QAAM,aAAa,SAAS,sBAAsB,QAAQ,MAAM,KAAK;AAErE,SAAO;AAAA,IACL,SAAS,SAAS;AAAA,IAClB,GAAI,aAAa,EAAE,KAAK,eAAe,MAAM,KAAK,IAAI,CAAC;AAAA,IACvD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,EAC7B;AACF;AAEA,SAAS,0BACP,OACA,aACwB;AAIxB,QAAM,UAAU,OAAO,QAAQ,OAAO,EAAE;AACxC,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,MAAI,CAAC,yBAAyB,KAAK,OAAO,KAAK,QAAQ,SAAS,MAAM,GAAG;AACvE,UAAM,IAAI,MAAM,GAAG,WAAW,4BAA4B;AAAA,EAC5D;AACA,QAAM,UAAU,OAAO,KAAK,SAAS,QAAQ;AAC7C,QAAM,YAAY,QAAQ,SAAS,QAAQ,EAAE,QAAQ,OAAO,EAAE;AAC9D,MAAI,QAAQ,WAAW,KAAK,cAAc,QAAQ,QAAQ,OAAO,EAAE,GAAG;AACpE,UAAM,IAAI,MAAM,GAAG,WAAW,4BAA4B;AAAA,EAC5D;AACA,SAAO,IAAI,WAAW,OAAO;AAC/B;AAYO,SAAS,aAAa,UAA0D;AACrF,QAAM,SAAS,SAAS,UAAU,KAAK;AACvC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AACA,MAAI,CAAC,2BAA2B,KAAK,MAAM,GAAG;AAC5C,UAAM,IAAI,MAAM,0DAA0D,MAAM,EAAE;AAAA,EACpF;AACA,SAAO,GAAG,MAAM;AAClB;AAEO,SAAS,8BAA8B,UAA4C;AACxF,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ;AAAA,MACb,iBAAiB,SAAS;AAAA,MAC1B,kBAAkB,SAAS;AAAA,MAC3B,oBAAoB,SAAS,oBAAoB,SAAS;AAAA,MAC1D,qBAAqB,SAAS,qBAAqB,SAAS;AAAA,IAC9D,CAAC,EAAE;AAAA,MACD,CAAC,UACC,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS;AAAA,IAC7D;AAAA,EACF;AACF;AAEA,IAAM,uBAAuB;AAG7B,IAAM,qCAAqC,oBAAI,IAAI;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAUM,SAAS,wCACd,UAC2B;AAC3B,QAAM,aAAa,IAAI,IAAI,gCAAgC,QAAQ,CAAC;AACpE,SAAO,CAAC,SACN,mCAAmC,IAAI,IAAI,KAC3C,KAAK,WAAW,WAAW,KAC3B,WAAW,IAAI,IAAI;AACvB;AAEA,SAAS,iBAAiB,WAA+B,OAAuB;AAC9E,QAAM,SAAS,aAAa,sBAAsB,MAAM,GAAG,EAAE,OAAO,OAAO;AAC3E,SAAO,CAAC,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,SAAS,KAAK,CAAC,EAAE,KAAK,GAAG;AACpE;AAiCO,SAAS,+BACd,UACA,UAAoC,CAAC,GACb;AACxB,QAAM,cAAsC;AAAA,IAC1C,GAAG,0BAA0B,QAAQ;AAAA,IACrC,GAAG,8BAA8B,QAAQ;AAAA,EAC3C;AAKA,QAAM,aAAa,uBAAuB,SAAS,cAAc;AACjE,MACE,SAAS,mBAAmB,UAC5B,SAAS,mBAAmB,WAC5B,SAAS,mBAAmB,cAC5B;AACA,gBAAY,SAAS,WAAW;AAAA,EAClC;AAOA,QAAM,8BACJ,SAAS,mBAAmB,UAC5B,SAAS,mBAAmB,WAC5B,SAAS,mBAAmB;AAC9B,MAAI,6BAA6B;AAC/B,UAAM,OAAO,YAAY,QAAQ,WAAW;AAC5C,gBAAY,iCAAiC,GAAG,IAAI;AACpD,gBAAY,4BAA4B,GAAG,IAAI;AAC/C,gBAAY,iCAAiC,GAAG,IAAI;AACpD,gBAAY,OAAO,iBAAiB,YAAY,MAAM,YAAY,4BAA4B;AAAA,EAChG;AACA,MAAI,SAAS,mBAAmB,gBAAgB,kCAAkC,QAAQ,GAAG;AAC3F,gBAAY,iCAAiC,GAAG,YAAY,QAAQ,WAAW,aAAa;AAC5F,QAAI,SAAS,mBAAmB;AAC9B,kBAAY,iCAAiC,SAAS;AAAA,IACxD;AACA,QAAI,QAAQ,aAAa;AACvB,kBAAY,0BAA0B,qBAAqB,UAAU,QAAQ,WAAW;AAAA,IAC1F;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,6BACd,WAQS;AACT,QAAM,WAAW,CAAC,UACf,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,KAAK,QAAQ,KAChE,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,KAAK,OAAO,KAAK,IAAI;AACvE,SAAO,UAAU;AAAA,IACf,CAAC,aACC,SAAS,SAAS,iBAChB,SAAS,SAAS,oBAAoB,KAAK,SAAS,SAAS,kBAAkB,KAC9E,SAAS,aAAa,YACrB,SAAS,SAAS,cAAc,KAChC,SAAS,SAAS,YAAY;AAAA,EACtC;AACF;AAEO,SAAS,oCACd,WAMS;AACT,SAAO,UAAU;AAAA,IACf,CAAC,aACC,SAAS,SAAS,iBACjB,SAAS,aAAa,YACrB,SAAS,aAAa,YACtB,SAAS,aAAa,kBACtB,6BAA6B,CAAC,QAAQ,CAAC;AAAA,EAC7C;AACF;AAmBO,SAAS,+BACd,aACA,UACwB;AACxB,cAAY,cAAc,GAAG,YAAY,QAAQ,YAAY;AAC7D,cAAY,sBAAsB;AAClC,MAAI,UAAU;AACZ,gBAAY,kBAAkB,YAAY,mBAAmB,SAAS;AACtE,gBAAY,mBAAmB,YAAY,oBAAoB,SAAS;AACxE,gBAAY,qBAAqB,YAAY,sBAAsB,SAAS;AAC5E,gBAAY,sBAAsB,YAAY,uBAAuB,SAAS;AAAA,EAChF;AACA,SAAO;AACT;AAgBO,SAAS,oBACd,UACgE;AAChE,SAAO;AAAA,IACL,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,IACzB,YAAY,SAAS;AAAA,EACvB;AACF;AAEA,eAAsB,uBACpB,OACA,WACA,UAA+B,CAAC,GACpB;AACZ,QAAM,WAAW,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,YAAY,EAAE,CAAC;AAC/D,QAAM,iBAAiB,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,kBAAkB,GAAI,CAAC;AAC7E,QAAM,aAAa,KAAK,IAAI,gBAAgB,KAAK,MAAM,QAAQ,cAAc,GAAI,CAAC;AAClF,WAAS,UAAU,GAAG,WAAW,UAAU,WAAW,GAAG;AACvD,QAAI;AACF,aAAO,MAAM,UAAU;AAAA,IACzB,SAAS,OAAO;AACd,UAAI,WAAW,YAAY,QAAQ,cAAc,KAAK,MAAM,OAAO;AACjE,cAAM;AAAA,MACR;AACA,YAAM,UAAU,KAAK,IAAI,YAAY,iBAAiB,MAAM,UAAU,EAAE;AACxE,cAAQ,UAAU,EAAE,OAAO,SAAS,UAAU,SAAS,MAAM,CAAC;AAC9D,YAAM,MAAM,OAAO;AAAA,IACrB;AAAA,EACF;AACA,QAAM,IAAI,MAAM,uCAAuC,KAAK,EAAE;AAChE;AAEO,SAAS,gCAAgC,UAA8B;AAC5E,QAAM,WAAW,+BAA+B,QAAQ;AACxD,QAAM,QAAkB,CAAC;AACzB,aAAW,WAAW,UAAU;AAC9B,UAAM,KAAK,GAAG,2BAA2B,OAAO,EAAG,GAAG;AAAA,EACxD;AACA,QAAM,KAAK,GAAG,SAAS,SAAS,mBAAmB,CAAC;AACpD,SAAO,eAAe,OAAO,aAAa;AAC5C;AAEO,SAAS,wBAAwB,UAA8B;AACpE,QAAM,MAAgB,CAAC;AACvB,aAAW,WAAW,+BAA+B,QAAQ,GAAG;AAC9D,QAAI,KAAK,GAAG,2BAA2B,OAAO,EAAG,KAAK;AAAA,EACxD;AACA,SAAO,aAAa,GAAG;AACzB;AAEA,SAAS,+BAA+B,UAA8B;AACpE,QAAM,WAAW,SAAS,SAAS,0BAA0B,EAAE;AAAA,IAAI,CAAC,UAClE,MAAM,YAAY;AAAA,EACpB;AACA,MAAI,SAAS,SAAS,MAAM,GAAG;AAC7B,QAAI,SAAS,SAAS,GAAG;AACvB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,CAAC,MAAM;AAAA,EAChB;AACA,aAAW,WAAW,UAAU;AAC9B,QAAI,CAAC,2BAA2B,OAAO,GAAG;AACxC,YAAM,IAAI,MAAM,uCAAuC,OAAO,EAAE;AAAA,IAClE;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,kBAAkB,KAAuB;AACvD,SAAO,SAAS,GAAG,EAAE,IAAI,CAAC,UAAU;AAClC,UAAM,OAAO,OAAO,KAAK;AACzB,QAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,OAAO;AACvD,YAAM,IAAI,MAAM,6DAA6D;AAAA,IAC/E;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAEO,SAAS,gBAAgB,KAAgD;AAC9E,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC1B,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,8CAA8C,OAAO,IAAI;AAAA,MACvE,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEO,SAAS,sBACd,KACuD;AACvD,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,mDAAmD,OAAO,IAAI,EAAE,OAAO,MAAM,CAAC;AAAA,EAChG;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,MAAM,uEAAuE;AAAA,EACzF;AACA,QAAM,MAA6D,CAAC;AACpE,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,QAAI,CAAC,MAAM,KAAK,GAAG;AACjB,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AACA,QAAI,KAAK,IAAIL,GAAE,MAAM,CAAC,oBAAoB,0BAA0B,CAAC,EAAE,MAAM,KAAK;AAAA,EACpF;AACA,SAAO;AACT;AAMO,SAAS,yBAAyB,KAAqC;AAC5E,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI;AAAA,MACR,yEAAyE,OAAO;AAAA,MAChF,EAAE,OAAO,MAAM;AAAA,IACjB;AAAA,EACF;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,SAAS,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACrD,QAAI,CAAC,QAAQ,KAAK,GAAG;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,OAAO,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK;AAC7D,QAAI,CAAC,OAAO,SAAS,IAAI,KAAK,OAAO,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,8DAA8D,OAAO;AAAA,MACvE;AAAA,IACF;AACA,QAAI,OAAO,IAAI;AAAA,EACjB;AACA,SAAO;AACT;AAIO,SAAS,+BAA+B,UAAoB,SAAyB;AAC1F,QAAM,QAAQ,yBAAyB,SAAS,kCAAkC;AAClF,SAAO,MAAM,OAAO,KAAK;AAC3B;AAOO,SAAS,wBAAwB,KAAiC;AACvE,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,qDAAqD,OAAO,IAAI;AAAA,MAC9E,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC1B,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,SAAO,OAAO,IAAI,CAAC,OAAO,UAAU;AAClC,UAAM,SAAS,uBAAuB,UAAU,KAAK;AACrD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR,0CAA0C,KAAK,iBAAiB,OAAO,MAAM,OAAO;AAAA,MACtF;AAAA,IACF;AACA,QAAI;AACF,aAAO,0BAA0B,OAAO,IAAI;AAAA,IAC9C,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,YAAM,IAAI,MAAM,0CAA0C,KAAK,iBAAiB,OAAO,IAAI;AAAA,QACzF,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,SAAS,kCACd,KAC8C;AAC9C,MAAI,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACvC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,gEAAgE,OAAO,IAAI;AAAA,MACzF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAoD,CAAC;AAC3D,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,CAAC,IAAI,KAAK,GAAG;AACf,YAAM,IAAI,MAAM,uEAAuE;AAAA,IACzF;AACA,UAAM,SAAS,mCAAmC,UAAU,KAAK;AACjE,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR,uDAAuD,GAAG,gBAAgB,OAAO,MAAM,OAAO;AAAA,MAChG;AAAA,IACF;AACA,QAAI,GAAG,IAAI,OAAO;AAAA,EACpB;AACA,SAAO;AACT;AAQO,SAAS,4BACd,YACA,YACqC;AACrC,QAAM,YAAY,CAAC,UAAkB,MAAM,QAAQ,QAAQ,EAAE;AAC7D,aAAW,OAAO,IAAI,IAAI,WAAW,QAAQ,CAAC,cAAc,CAAC,WAAW,UAAU,SAAS,CAAC,CAAC,CAAC,GAAG;AAC/F,UAAM,QAAQ,WAAW,GAAG;AAC5B,QAAI,MAAO,QAAO;AAAA,EACpB;AACA,QAAM,uBAAuB,IAAI,IAAI,WAAW,IAAI,SAAS,CAAC;AAC9D,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,QAAI,qBAAqB,IAAI,UAAU,GAAG,CAAC,EAAG,QAAO;AAAA,EACvD;AACA,SAAO;AACT;AAEO,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAC3C,CAAC;AAGD,IAAM,4BAA4B,CAAC,KAAK,QAAQ;AAEzC,SAAS,4BACd,KACsF;AACtF,MAAI,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACvC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,0DAA0D,OAAO,IAAI;AAAA,MACnF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MACJ,CAAC;AACH,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,CAAC,0BAA0B,SAAS,GAAiD,GAAG;AAC1F,YAAM,IAAI;AAAA,QACR,+CAA+C,GAAG,gCAAgC,0BAA0B,KAAK,IAAI,CAAC;AAAA,MACxH;AAAA,IACF;AACA,UAAM,SAAS,8BAA8B,UAAU,KAAK;AAC5D,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR,iDAAiD,GAAG,gBAAgB,OAAO,MAAM,OAAO;AAAA,MAC1F;AAAA,IACF;AACA,QAAI,GAAiD,IAAI,OAAO;AAAA,EAClE;AACA,SAAO;AACT;AAEO,SAAS,2BAA2B,KAAsC;AAC/E,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,yDAAyD,OAAO,IAAI;AAAA,MAClF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,kBAAkB,MAAM,MAAM;AACvC;AAEO,SAAS,4BAA4B,KAAiC;AAC3E,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,yDAAyD,OAAO,IAAI;AAAA,MAClF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,aAAa,MAAM,MAAM;AAClC;AAEA,SAAS,yBAAyB,SAAuB,OAAgC;AACvF,QAAM,cAAc,YAAY,MAAM,WAAW;AACjD,QAAM,eAAe,YAAY,MAAM,YAAY;AACnD,QAAM,eAAe,KAAK,IAAI,aAAa,kBAAkB,KAAK,CAAC;AACnE,QAAM,mBAAmB,KAAK;AAAA,IAC5B,KAAK,IAAI,GAAG,cAAc,YAAY;AAAA,IACtC,sBAAsB,KAAK;AAAA,EAC7B;AACA,QAAM,sBAAsB,KAAK,IAAI,GAAG,cAAc,eAAe,gBAAgB;AACrF,QAAM,kBACJ,QAAQ,qCAAqC,QAAQ;AACvD,QAAM,iBACJ,QAAQ,oCAAoC,QAAQ;AACtD,SACE,KAAK,KAAM,sBAAsB,QAAQ,8BAA+B,GAAS,IACjF,KAAK,KAAM,eAAe,kBAAmB,GAAS,IACtD,KAAK,KAAM,mBAAmB,iBAAkB,GAAS,IACzD,KAAK,KAAM,eAAe,QAAQ,+BAAgC,GAAS;AAE/E;AAEA,SAAS,kBAAkB,OAAgC;AACzD,QAAM,UAAU,MAAM,QAAQ,MAAM,kBAAkB,IAClD,MAAM,qBACN,MAAM,qBACJ,CAAC,MAAM,kBAAkB,IACzB,CAAC;AACP,MAAI,QAAQ;AACZ,aAAW,UAAU,SAAS;AAC5B,aACE,YAAY,OAAO,aAAa,IAChC,YAAY,OAAO,iBAAiB,IACpC,YAAY,OAAO,mBAAmB;AAAA,EAC1C;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAgC;AAC7D,QAAM,UAAU,MAAM,QAAQ,MAAM,kBAAkB,IAClD,MAAM,qBACN,MAAM,qBACJ,CAAC,MAAM,kBAAkB,IACzB,CAAC;AACP,MAAI,QAAQ;AACZ,aAAW,UAAU,SAAS;AAC5B,aAAS,YAAY,OAAO,sBAAsB,OAAO,gBAAgB;AAAA,EAC3E;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAwB;AAC3C,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,QAAQ,IAAI,KAAK,MAAM,KAAK,IAAI;AAChG;AAOO,IAAM,mCAAmC;AAEhD,SAAS,wBAAwB,UAA4C;AAC3E,QAAM,WAAW,SAAS,WAAW,OAAO,CAAC,WAAW,OAAO,OAAO,UAAU;AAChF,QAAM,mBAAmB,uBAAuB,QAAQ;AACxD,QAAM,wBAAwB,4BAA4B,gBAAgB;AAC1E,QAAM,uBAAuB,gCAAgC,gBAAgB;AAC7E,QAAM,WAAW,SAAS,KAAK,CAAC,WAAW,OAAO,OAAO,OAAO;AAChE,QAAM,UAAU,SAAS,KAAK,CAAC,WAAW,OAAO,OAAO,MAAM;AAC9D,SAAO;AAAA,IACL;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAYL,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,IACA,GAAI,WACA,CAAC,IACD;AAAA,MACE;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,KAAK;AAAA,QACL,cAAc,CAAC,wBAAwB;AAAA,QACvC,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,IACJ,GAAI,UACA,CAAC,IACD;AAAA,MACE;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,KAAK;AAAA,QACL,cAAc,CAAC,oBAAoB,iBAAiB,kBAAkB;AAAA,QACtE,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,IACJ,GAAG;AAAA,EACL;AACF;AAgBO,SAAS,qBAAqB,UAA4B;AAC/D,SACE,SAAS,kBACT,oBAAoB,SAAS,OAAO;AAExC;AAOO,SAAS,6BAA6B,UAA4B;AACvE,SACE,SAAS,0BACT,oBAAoB,SAAS,OAAO;AAExC;AAEA,SAAS,uBAAuB,KAAa,aAA6B;AACxE,MAAI,IAAI,SAAS,eAAe,GAAG;AACjC,WAAO,IAAI,WAAW,iBAAiB,WAAW;AAAA,EACpD;AACA,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,MAAI,WAAW,kBAAkB,WAAW;AAC5C,MAAI,SAAS;AACb,MAAI,OAAO;AACX,SAAO,IAAI,SAAS;AACtB;AAEO,SAAS,0BAA0B,UAAoB,aAA6B;AACzF,SAAO,uBAAuB,qBAAqB,QAAQ,GAAG,WAAW;AAC3E;AAEO,SAAS,kCAAkC,UAAoB,aAA6B;AACjG,SAAO,uBAAuB,6BAA6B,QAAQ,GAAG,WAAW;AACnF;AAEO,SAAS,qBAAqB,UAAoB,aAA6B;AACpF,MAAI,SAAS,gBAAgB;AAC3B,UAAMM,OAAM,IAAI,IAAI,0BAA0B,UAAU,WAAW,CAAC;AACpE,QAAI,CAACA,KAAI,SAAS,SAAS,MAAM,GAAG;AAClC,YAAM,IAAI,MAAM,kEAAkE;AAAA,IACpF;AACA,IAAAA,KAAI,WAAW,GAAGA,KAAI,SAAS,MAAM,GAAG,EAAE,CAAC;AAC3C,WAAOA,KAAI,SAAS;AAAA,EACtB;AAOA,QAAM,kBACJ,SAAS,mBAAmB,WACxB,+BAA+B,SAAS,OAAO,KAC/C,SAAS,mBAAmB,UAC1B,oBAAoB,SAAS,OAAO,KACnC,SAAS,iBAAiB,oBAAoB,SAAS,OAAO;AACvE,QAAM,MAAM,IAAI,IAAI,eAAe;AACnC,MAAI,WAAW,GAAG,IAAI,SAAS,QAAQ,SAAS,EAAE,CAAC,kBAAkB,WAAW;AAChF,MAAI,SAAS;AACb,MAAI,OAAO;AACX,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,uBAAuB,UAA4B;AAC1D,SAAO,qBAAqB,QAAQ;AACtC;AAEA,SAAS,gCAAgC,QAAwB;AAC/D,SAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC;AACtC;AAEA,SAAS,4BAA4B,QAAwB;AAC3D,SAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC;AACtC;AAEA,IAAM,iCAAiC;AAEvC,SAAS,gCAAgC,UAA6B;AACpE,MAAI,SAAS,aAAc,QAAO;AAClC,SACE,OAAO,SAAS,kBAAkB,YAClC,+BAA+B,KAAK,SAAS,aAAa;AAE9D;AAaO,SAAS,wBAAwB,KAAiC;AACvE,QAAM,UAA8B,CAAC;AACrC,aAAW,SAAS,IAAI,MAAM,GAAG,GAAG;AAClC,UAAM,QAAQ,MAAM,KAAK;AACzB,QAAI,CAAC,MAAO;AACZ,UAAM,QAAQ,MAAM,QAAQ,GAAG;AAC/B,UAAM,UAAU,QAAQ,IAAI,QAAQ,MAAM,MAAM,GAAG,KAAK;AACxD,UAAM,UAAU,KAAK,OAAO;AAC5B,UAAM,SAAS,YAAY,IAAI,SAAS,YAAY,IAAI,SAAS;AACjE,UAAM,YAAY,WAAW,SAAS,KAAK;AAC3C,UAAM,aAAa,QAAQ,IAAI,OAAO,SAAS,IAAI,MAAM,MAAM,QAAQ,CAAC;AACxE,UAAM,SAAS,aAAa,KAAK,UAAU,IAAI,OAAO,UAAU,IAAI,OAAO;AAC3E,QAAI,CAAC,UAAU,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,WAAW;AAC5E,YAAM,IAAI;AAAA,QACR,2CAA2C,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAC/D;AAAA,IACF;AACA,YAAQ,KAAK,EAAE,SAAS,QAAQ,OAAO,CAAC;AAAA,EAC1C;AACA,SAAO;AACT;AAQO,SAAS,0BAA0B,KAAmC;AAC3E,QAAM,UAAoB,CAAC;AAC3B,aAAW,UAAU,OAAO,IAAI,MAAM,GAAG,GAAG;AAC1C,UAAM,QAAQ,MAAM,KAAK;AACzB,QAAI,CAAC,MAAO;AACZ,QAAI,MAAkB;AACtB,QAAI;AACF,YAAM,IAAI,IAAI,KAAK;AAAA,IACrB,QAAQ;AACN,YAAM;AAAA,IACR;AACA,QACE,CAAC,OACA,IAAI,aAAa,WAAW,IAAI,aAAa,YAC9C,IAAI,YACJ,IAAI,YACJ,IAAI,SAAS,SAAS,GAAG,KACzB,IAAI,aAAa,OACjB,IAAI,UACJ,IAAI,QACJ,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,GAAG,GAClB;AACA,YAAM,IAAI;AAAA,QACR,yCAAyC,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAC7D;AAAA,IACF;AACA,YAAQ,KAAK,IAAI,MAAM;AAAA,EACzB;AACA,SAAO;AACT;AAEA,IAAM,2BAA8C;AAAA;AAAA,EAElD;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AACF;AAQO,SAAS,4BAA4B,UAA2B;AACrE,SAAO,yBAAyB,KAAK,CAAC,UAAU,MAAM,KAAK,QAAQ,CAAC;AACtE;AAQO,SAAS,oBACd,UACM;AACN,MAAI,SAAS,gBAAgB,OAAW;AACxC,MAAI;AACJ,MAAI;AACF,aAAS,qBAAqB,SAAS,WAAW;AAAA,EACpD,QAAQ;AACN,UAAM,IAAI,MAAM,uEAAuE;AAAA,EACzF;AACA,QAAM,QAA6C;AAAA,IACjD,CAAC,4BAA4B,SAAS,aAAa;AAAA,IACnD,CAAC,yBAAyB,SAAS,UAAU;AAAA,EAC/C;AACA,aAAW,CAAC,MAAM,GAAG,KAAK,OAAO;AAC/B,QAAI,CAAC,IAAK;AACV,UAAM,OAAO,IAAI,IAAI,GAAG,EAAE,SAAS,YAAY,EAAE,QAAQ,QAAQ,EAAE;AACnE,QAAI,SAAS,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,KAAK,OAAO,SAAS,IAAI,IAAI,EAAE;AAC9E,YAAM,IAAI;AAAA,QACR,0BAA0B,MAAM,yDAAyD,IAAI,SAAS,IAAI;AAAA,MAC5G;AAAA,EACJ;AACF;AAEA,SAAS,iBAAiB,UAAoB,SAA4B,QAAQ,KAAW;AAC3F,4BAA0B,QAAQ;AAClC,4BAA0B,SAAS,mBAAmB;AACtD,sBAAoB,QAAQ;AAC5B,MACE,SAAS,6CAA6C,WACtD,CAAC,SAAS,qDACV;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,kBAAkB,KAAK,CAAC,YAAY,UAAU,SAAS,oBAAoB,GAAG;AACzF,UAAM,IAAI;AAAA,MACR,4FAA4F,SAAS,oBAAoB;AAAA,IAC3H;AAAA,EACF;AACA,QAAM,4BAA4B,IAAI;AAAA,IACpC,SAAS,6BAA6B;AAAA,EACxC;AACA,QAAM,sBAAsB,SAAS,6BAA6B,CAAC,GAAG;AAAA,IACpE,CAAC,SAAS,CAAC,0BAA0B,IAAI,IAAI;AAAA,EAC/C;AACA,MAAI,mBAAmB,SAAS,GAAG;AACjC,UAAM,IAAI;AAAA,MACR,sGAAsG,mBAAmB,KAAK,IAAI,CAAC;AAAA,IACrI;AAAA,EACF;AACA,MAAI,SAAS,sBAAsB,WAAW;AAC5C,QAAI,SAAS,yBAAyB,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAAG;AACvF,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,kBAAkB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,kBAAkB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,8BAA8B,YACvC,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAChD,CAAC,SAAS,cAAc,WAAW,UAAU,GAC7C;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,yBAAyB,YAClC,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAChD,CAAC,SAAS,cACV;AACA,YAAM,IAAI,MAAM,yEAAyE;AAAA,IAC3F;AACA,QAAI,SAAS,yBAAyB,cAAc,SAAS,cAAc;AACzE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAAK,CAAC,SAAS,2BAA2B;AAC5F,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MACE,QAAQ,SAAS,yBAAyB,MAAM,QAAQ,SAAS,6BAA6B,GAC9F;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,QAAQ,SAAS,yBAAyB,MAAM,QAAQ,SAAS,6BAA6B,GAC9F;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,8BAA8B;AAAA,IAClC,SAAS,6BAA6B,SAAS;AAAA,EACjD;AACA,MAAI,6BAA6B;AAC/B,QAAI,SAAS,sBAAsB,WAAW;AAC5C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,eAAe,sBAAsB,SAAS,aAAa;AACjE,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,aAAa,WAAW,UAAU,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAAG;AAC7F,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAIA,QAAM,0BAA0B,OAAO,uCAAuC,KAAK;AACnF,MAAI,2BAA2B,4BAA4B,KAAK;AAC9D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,oBAAoB,wBAAwB,SAAS,oBAAoB;AAC/E,MAAI,kBAAkB,SAAS,KAAK,SAAS,wBAAwB,GAAG;AACtE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,iBAAiB;AAC5B,QAAI,SAAS,sBAAsB,cAAc;AAC/C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,eAAe,sBAAsB,SAAS,aAAa;AACjE,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,aAAa,WAAW,UAAU,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAAG;AAC7F,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,iCAA+B,QAAQ;AACvC,MAAI,SAAS,qBAAqB;AAChC,QAAI,SAAS,sBAAsB,aAAa,CAAC,SAAS,eAAe;AACvE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,iBACT,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,2BAA2B,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAAG;AAC1F,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,aAAa,MAAM,QAAQ,SAAS,iBAAiB,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,eAAe;AAC1B,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,yBAAyB;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,mBAAmB,MAAM,QAAQ,SAAS,uBAAuB,GAAG;AACvF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,QAAQ,SAAS,2BAA2B,MAC5C,QAAQ,SAAS,+BAA+B,GAChD;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,4BAA4B;AACvC,QAAI,CAAC,SAAS,qBAAqB;AACjC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,+BAA+B,CAAC,SAAS,iCAAiC;AACtF,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,gCAAgC,SAAS,gBAAgB;AACpE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,+BAA+B,SAAS,aAAa,GAAG;AAC3D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,SAAS,eAAe,WAAW,UAAU,KAC9C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,yBAAyB;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,2BAA2B;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,aAAa,MAAM,QAAQ,SAAS,iBAAiB,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,eAAe;AAC1B,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,yBAAyB;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,qBAAqB;AAChC,QAAI,CAAC,SAAS,qBAAqB;AACjC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,4BAA4B,SAAS,aAAa,GAAG;AACxD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,yBAAyB;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,8BAA8B,SAAS,yBAAyB;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,SAAS,yCAAyC,SAAS,oCAC3D;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,yCAAyC,SAAS,kCAAkC;AAC/F,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,iBAAiB,MAAM,QAAQ,SAAS,qBAAqB,GAAG;AACnF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,mBAAmB;AAC9B,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,yBAAyB;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,oCAAkC,SAAS,4BAA4B;AACvE,8BAA4B,SAAS,sBAAsB;AAC3D,MACE,SAAS,sBAAsB,gBAC/B,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAChD,CAAC,SAAS,oBACV,CAAC,SAAS,cACV;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,gBAAgB,UAAU;AACrC,QAAI,CAAC,SAAS,mBAAmB,CAAC,SAAS,qBAAqB;AAC9D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,sBAAsB,aAAa,SAAS,gBAAgB,UAAU;AACjF,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,MAAI,SAAS,oBAAoB,UAAU;AACzC,UAAM,SAAS,4BAA4B,QAAQ;AACnD,QAAI,OAAO,KAAK,MAAM,EAAE,WAAW,GAAG;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,OAAO;AACL,+BAA2B,SAAS,qBAAqB;AAAA,EAC3D;AACA,MAAI,SAAS,qBAAqB,UAAU;AAC1C,UAAM,eAAe,4BAA4B,SAAS,sBAAsB;AAChF,QAAI,OAAO,KAAK,YAAY,EAAE,WAAW,GAAG;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,OAAO;AACL,gCAA4B,SAAS,sBAAsB;AAAA,EAC7D;AACA,MAAI,SAAS,gBAAgB,CAAC,SAAS,WAAW;AAChD,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,SAAS,mBAAmB,SAAS;AACvC,QAAI,CAAC,SAAS,sBAAsB,CAAC,SAAS,qBAAqB;AACjE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,sBAAsB,CAAC,SAAS,uBAAuB;AACnE,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AACA,QAAI,CAAC,SAAS,sBAAsB,CAAC,SAAS,uBAAuB;AACnE,YAAM,IAAI,MAAM,uEAAuE;AAAA,IACzF;AACA,QAAI,CAAC,SAAS,qBAAqB,CAAC,SAAS,oBAAoB;AAC/D,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAAA,EACF;AAIA,MAAI,QAAQ,SAAS,YAAY,MAAM,QAAQ,SAAS,gBAAgB,GAAG;AACzE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAKA,aAAW,YAAY,qBAAqB,SAAS,cAAc,KAAK,CAAC,GAAG;AAC1E,UAAM,QAAQ,SAAS,SAAS,KAAK;AACrC,QACE,UAAU,UACV,UAAU,QACT,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GACtD;AACA,YAAM,IAAI;AAAA,QACR,GAAG,SAAS,GAAG,8CAA8C,SAAS,cAAc;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACA,gCAA8B,QAAQ;AACtC,MAAI,SAAS,wBAAwB,SAAS,mBAAmB;AAC/D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,oBAAkB,SAAS,kBAAkB;AAI7C,kCAAgC,QAAQ;AACxC,0BAAwB,QAAQ;AAEhC,QAAM,YAAY,yBAAyB,SAAS,kCAAkC;AAItF,MACE,SAAS,2BAA2B,aACpC,OAAO,OAAO,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,cAAc,IAAI,CAAC,GACnE;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,SAAS,iCAAiC,aAC1C,SAAS,8BAA8B,YACvC,SAAS,8CAA8C,GACvD;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,SAAS,iCAAiC,aAC1C,SAAS,8BAA8B,YACvC,CAAC,SAAS,qCACV;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,mBAAmB,WAAW;AACzC,UAAMJ,UAAS,sBAAsB,QAAQ;AAC7C,QAAIA,QAAO,SAAS,GAAG;AACrB,YAAM,IAAI,MAAM,qCAAqCA,QAAO,KAAK,IAAI,CAAC,EAAE;AAAA,IAC1E;AAAA,EACF;AACA,MAAI,SAAS,mBAAmB,eAAe;AAC7C,QAAI,CAAC,yBAAyB,KAAK,SAAS,oBAAoB,EAAE,GAAG;AACnE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,4CAA4C,QAAQ,GAAG;AAC1D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,oBAAI,IAAY;AAClC,aAAW,UAAU,SAAS,YAAY;AACxC,QAAI,UAAU,IAAI,OAAO,EAAE,GAAG;AAC5B,YAAM,IAAI,MAAM,8CAA8C,OAAO,EAAE,EAAE;AAAA,IAC3E;AACA,cAAU,IAAI,OAAO,EAAE;AACvB,QAAI,OAAO,eAAe,oBAAoB,QAAQ;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAKA;AACE,UAAM,eAAe,SAAS;AAC9B,UAAM,YAAY,SAAS;AAC3B,UAAM,iBAAiB,SAAS;AAChC,QAAI,EAAE,eAAe,YAAY;AAC/B,YAAM,IAAI;AAAA,QACR,4CAA4C,YAAY,uEACZ,SAAS;AAAA,MAEvD;AAAA,IACF;AACA,QAAI,EAAE,eAAe,iBAAiB;AACpC,YAAM,IAAI;AAAA,QACR,4CAA4C,YAAY,4EACP,cAAc;AAAA,MAEjE;AAAA,IACF;AACA,QAAI,SAAS,kCAAkC,QAAW;AACxD,YAAMK,yBAAwB,+BAA+B;AAAA,QAC3D,0BAA0B,uCAAuC,QAAQ;AAAA,MAC3E,CAAC;AACD,YAAM,2BACJ,eAAeA,yBAAwB;AACzC,UAAI,2BAA2B,0CAA0C;AACvE,cAAM,IAAI;AAAA,UACR,+CAA+C,SAAS,6BAA6B,qDAChC,wBAAwB,qEAExE,wCAAwC;AAAA,QAE/C;AAAA,MACF;AAAA,IACF;AAIA,UAAM,iBAAiB,SAAS;AAChC,UAAM,2BAA2B,+BAA+B,QAAQ;AACxE,UAAM,wBAAwB,+BAA+B;AAAA,MAC3D,0BAA0B,uCAAuC,QAAQ;AAAA,IAC3E,CAAC;AACD,UAAM,mCAAmC,KAAK;AAAA,MAC5C;AAAA,MACA;AAAA,IACF;AACA,UAAM,yBACJ,yCAAyC,mCAAmC,IAAI;AAClF,QAAI,EAAE,iBAAiB,yBAAyB;AAC9C,YAAM,IAAI;AAAA,QACR,sCAAsC,cAAc,2HAE9C,sBAAsB;AAAA,MAE9B;AAAA,IACF;AACA,UAAM,gBAAgB,SAAS;AAC/B,QAAI,kBAAkB,UAAa,EAAE,gBAAgB,SAAS,qBAAqB;AACjF,YAAM,IAAI;AAAA,QACR,iDAAiD,aAAa,iDACzB,SAAS,kBAAkB;AAAA,MAElE;AAAA,IACF;AACA,QACE,kBAAkB,UAClB,yBAAyB,gDAAgD,MAAM,MAC7E,UACF,EAAE,gBAAgB,iBAClB;AACA,YAAM,IAAI;AAAA,QACR,iDAAiD,aAAa,mEACtB,cAAc;AAAA,MAExD;AAAA,IACF;AACA,QAAI,SAAS,mBAAmB,SAAS;AACvC,YAAM,cAAc,SAAS;AAC7B,YAAM,YAAY,0BAA0B,UAAU,OAAO;AAC7D,YAAM,qBAAqB,UAAU;AACrC,YAAM,gBAAgB,UAAU;AAChC,UAAI,EAAE,iBAAiB,qBAAqB;AAC1C,cAAM,IAAI;AAAA,UACR,6CAA6C,aAAa,uFACL,kBAAkB;AAAA,QAEzE;AAAA,MACF;AACA,UAAI,EAAE,iBAAiB,qBAAqB;AAC1C,cAAM,IAAI;AAAA,UACR,sCAAsC,cAAc,qEACV,kBAAkB;AAAA,QAC9D;AAAA,MACF;AACA,UAAI,EAAE,YAAY,gBAAgB;AAChC,cAAM,IAAI;AAAA,UACR,0CAA0C,SAAS,gEAChC,aAAa;AAAA,QAElC;AAAA,MACF;AACA,UAAI,EAAE,iBAAiB,gBAAgB;AACrC,cAAM,IAAI;AAAA,UACR,+CAA+C,cAAc,gEACxB,aAAa;AAAA,QAEpD;AAAA,MACF;AACA,UAAI,EAAE,eAAe,cAAc,gBAAgB;AACjD,cAAM,IAAI;AAAA,UACR,6EACM,YAAY,MAAM,WAAW,MAAM,eAAe,WAAW,gEAClC,aAAa;AAAA,QAKhD;AAAA,MACF;AACA,UACE,SAAS,4BAA4B,UACrC,kBAAkB,UAClB,EAAE,eAAe,gBAAgB,wBAAwB,gBACzD;AACA,cAAM,IAAI;AAAA,UACR,mHAC4B,YAAY,MAAM,aAAa,MAAM,qBAAqB,0EACZ,aAAa;AAAA,QAGzF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AASA,MACE,SAAS,yBACT,SAAS,mBAAmB,WAC5B,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,QAAI,CAAC,gCAAgC,QAAQ,GAAG;AAC9C,YAAM,IAAI;AAAA,QACR;AAAA,MAIF;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,yBAAyB,yBAAyB,QAAQ,MAAM,QAAW;AACtF,YAAQ;AAAA,MACN;AAAA,IAIF;AAAA,EACF;AACA,MAAI,SAAS,uBAAuB,QAAQ;AAC1C,iCAA6B,UAAU,MAAM;AAAA,EAC/C,OAAO;AAIL,6BAAyB,SAAS,mBAAmB;AACrD,QAAI,SAAS,mBAAmB,KAAK,GAAG;AACtC,cAAQ;AAAA,QACN;AAAA,MAEF;AAAA,IACF;AAAA,EACF;AACF;AAGO,SAAS,6BACd,UACA,SAA4B,QAAQ,KACjB;AACnB,QAAM,aAAa,yBAAyB,SAAS,mBAAmB;AACxE,QAAM,QAAQ,oBAAoB,SAAS,cAAc;AACzD,QAAM,oBAAoB,wBAAwB,SAAS,kBAAkB;AAC7E,QAAM,YAAY,kBAAkB,QAAQ;AAC5C,QAAM,kBACJ,SAAS,gBAAgB,SAAY,OAAO,uBAAuB,SAAS,WAAW;AACzF,MAAI,iBAAiB;AACnB,UAAM,IAAI,MAAM,2BAA2B,eAAe,EAAE;AAAA,EAC9D;AACA,QAAM,cAAc,oBAAI,IAAY;AACpC,aAAW,YAAY,mBAAmB;AACxC,QACE,SAAS,SAAS,4BAClB,SAAS,SAAS,8BAClB,SAAS,SAAS,iCAClB,SAAS,SAAS,6BAClB,SAAS,SAAS,4BAClB,SAAS,SAAS,gCAClB,SAAS,SAAS,+BAClB,SAAS,SAAS,0BAClB,SAAS,SAAS,6BAClB,SAAS,SAAS,qBAClB,SAAS,SAAS,wBAClB,SAAS,SAAS,4BAClB,SAAS,SAAS,yBAClB,SAAS,SAAS,mCAClB,SAAS,SAAS,sCAClB,SAAS,SAAS,oBAClB;AACA,YAAM,IAAI;AAAA,QACR,+CAA+C,SAAS,IAAI;AAAA,MAC9D;AAAA,IACF;AACA,QAAI,4BAA4B,IAAI,SAAS,EAAE,GAAG;AAChD,YAAM,IAAI;AAAA,QACR,6CAA6C,SAAS,EAAE;AAAA,MAC1D;AAAA,IACF;AACA,QAAI,SAAS,OAAO,WAAW;AAC7B,YAAM,IAAI;AAAA,QACR,6CAA6C,SAAS,EAAE;AAAA,MAC1D;AAAA,IACF;AACA,QAAI,YAAY,IAAI,SAAS,EAAE,GAAG;AAChC,YAAM,IAAI;AAAA,QACR,gEAAgE,SAAS,EAAE;AAAA,MAC7E;AAAA,IACF;AACA,gBAAY,IAAI,SAAS,EAAE;AAC3B,QACE,SAAS,SAAS,wBAClB,SAAS,SAAS,eAClB,CAAC,sBAAsB,UAAU,MAAM,GACvC;AACA,YAAM,IAAI;AAAA,QACR,0CAA0C,SAAS,EAAE;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AAIA,QAAM,SAAS,iBAAiB,UAAU,MAAM;AAChD,QAAM,yBAAyB,+BAA+B,UAAU,SAAS,WAAW;AAC5F,QAAM,SAAS,SAAS;AACxB,QAAM,sBAAsB,oBAAI,IAAI;AAAA,IAClC,GAAI,OAAO,mBAAmB,CAAC;AAAA,IAC/B,GAAI,OAAO,kBAAkB,CAAC;AAAA,IAC9B,GAAG,OAAO,OAAO,OAAO,MAAM,EAAE,QAAQ,CAAC,UAAU,MAAM,oBAAoB,CAAC,CAAC;AAAA,EACjF,CAAC;AACD,aAAW,WAAW,qBAAqB;AACzC,QAAI,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,OAAO,WAAW,MAAM,SAAS,SAAS,GAAG;AAC7E,YAAM,IAAI;AAAA,QACR,4BAA4B,OAAO;AAAA,MACrC;AAAA,IACF;AAAA,EACF;AACA,QAAM,uBACJ,2BAA2B,WAAW,SAAS,iBAAiB,wBAAwB,MAAM;AAChG,MAAI,OAAO,WAAW,KAAK,qBAAqB,WAAW,GAAG;AAC5D,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,QAAM,iBAAiB;AAAA,IACrB;AAAA,IACA,SAAS;AAAA,EACX;AACA,MAAI,CAAC,qBAAqB,KAAK,CAAC,UAAU,MAAM,OAAO,cAAc,GAAG;AACtE,UAAM,IAAI;AAAA,MACR,qBAAqB,SAAS,WAAW;AAAA,IAC3C;AAAA,EACF;AAQA,QAAM,yBAAyB,OAAO,gCAAgC,KAAK;AAC3E,MACE,0BACA,SAAS,uBAAuB,UAChC,SAAS,gBAAgB,UACzB;AACA,UAAM,mBAAmB,8BAA8B,UAAU,SAAS,mBAAmB;AAC7F,UAAM,iBAAiB,OAAO,KAAK,CAAC,UAAU,MAAM,OAAO,gBAAgB;AAC3E,QAAI,gBAAgB,SAAS,WAAW;AACtC,YAAM,IAAI;AAAA,QACR,kCAAkC,SAAS,mBAAmB;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AAEA,QAAM,uBAAuB,IAAI;AAAA,IAC/B,OAAO,OAAO,CAAC,UAAU,MAAM,iBAAiB,SAAS,YAAY,EAAE,IAAI,CAAC,UAAU,MAAM,EAAE;AAAA,EAChG;AACA,QAAM,iBAAiB,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC;AAC9D,MAAI,SAAS,4BAA4B,QAAW;AAClD,eAAW,SAASP,GACjB,MAAM,uBAAuB,EAC7B,MAAM,KAAK,MAAM,SAAS,uBAAuB,CAAC,GAAG;AACtD,qBAAe,IAAI,MAAM,EAAE;AAAA,IAC7B;AAAA,EACF;AACA,aAAW,SAAS,+BAA+B,QAAQ,GAAG;AAC5D,yBAAqB,IAAI,MAAM,SAAS;AACxC,mBAAe,IAAI,MAAM,SAAS;AAClC,mBAAe,IAAI,MAAM,kBAAkB;AAAA,EAC7C;AACA,aAAW,SAAS,kCAAkC,QAAQ,GAAG;AAC/D,UAAM,YAAY,GAAG,0BAA0B,GAAG,MAAM,eAAe;AACvE,yBAAqB,IAAI,SAAS;AAClC,mBAAe,IAAI,SAAS;AAC5B,mBAAe,IAAI,GAAG,oCAAoC,GAAG,MAAM,eAAe,EAAE;AAAA,EACtF;AACA,aAAW,SAAS,6BAA6B,QAAQ,GAAG;AAC1D,UAAM,YAAY,GAAG,qBAAqB,GAAG,MAAM,eAAe;AAClE,yBAAqB,IAAI,SAAS;AAClC,mBAAe,IAAI,SAAS;AAC5B,mBAAe,IAAI,GAAG,+BAA+B,GAAG,MAAM,eAAe,EAAE;AAAA,EACjF;AACA,MAAI,SAAS,uBAAuB,QAAQ;AAC1C,eAAW,aAAa,OAAO,KAAK,UAAU,GAAG;AAC/C,UAAI,CAAC,qBAAqB,IAAI,SAAS,GAAG;AACxC,cAAM,IAAI;AAAA,UACR,uEAAuE,SAAS;AAAA,QAClF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,aAAW,aAAa,OAAO,KAAK,KAAK,GAAG;AAC1C,QAAI,CAAC,eAAe,IAAI,SAAS,GAAG;AAClC,YAAM,IAAI,MAAM,8DAA8D,SAAS,EAAE;AAAA,IAC3F;AAAA,EACF;AAEA,MAAI,SAAS,gBAAgB,YAAY,SAAS,oBAAoB,WAAW;AAC/E,UAAM,UAAU,uBAAuB,QAAQ;AAC/C,UAAM,UAAU,OACb,OAAO,CAAC,UAAU,MAAM,SAAS,aAAa,CAAC,QAAQ,MAAM,EAAE,CAAC,EAChE,IAAI,CAAC,UAAU,MAAM,EAAE;AAC1B,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,uDAAuD,QAAQ,KAAK,IAAI,CAAC;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,yBAAyB,UAAwC;AAC/E,QAAM,WAAW,SAAS,mBAAmB,KAAK;AAClD,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AACA,QAAM,aAAa,SAAS,kBAAkB,KAAK;AACnD,SAAO,aAAa,aAAa;AACnC;AAOO,SAAS,oBAAoB,UAA6B;AAC/D,SAAO,SAAS,yBAAyB,yBAAyB,QAAQ,MAAM;AAClF;AAIO,SAAS,yBAAyB,UAA6B;AACpE,SAAO,QAAQ,SAAS,iBAAiB,SAAS,iBAAiB,SAAS,cAAc;AAC5F;AAMO,SAAS,sBAAsB,UAA8B;AAClE,QAAME,UAAmB,CAAC;AAC1B,MAAI,CAAC,SAAS,cAAe,CAAAA,QAAO,KAAK,sCAAsC;AAC/E,MAAI,CAAC,SAAS,cAAe,CAAAA,QAAO,KAAK,sCAAsC;AAC/E,MACE,SAAS,iBACT,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAChD,CAAC,SAAS,cAAc,WAAW,UAAU,GAC7C;AACA,IAAAA,QAAO,KAAK,4DAA4D;AAAA,EAC1E;AACA,QAAM,UAAU,SAAS;AACzB,MAAI,CAAC,SAAS;AACZ,IAAAA,QAAO,KAAK,uCAAuC;AAAA,EACrD,WACE,CAAC,QAAQ,WAAW,QAAQ,KAC5B,EAAE,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAAK,QAAQ,WAAW,OAAO,IAChF;AACA,IAAAA,QAAO,KAAK,2EAA2E;AAAA,EACzF;AACA,MAAI,CAAC,SAAS,sBAAsB,CAAC,wBAAwB,QAAQ,GAAG;AACtE,IAAAA,QAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,yBAAyB,MAAM;AAC1C,IAAAA,QAAO,KAAK,8EAA8E;AAAA,EAC5F;AACA,MACE,SAAS,4BAA4B,UACrC,SAAS,0BAA0B,SAAS,kBAC5C;AACA,IAAAA,QAAO,KAAK,iFAAiF;AAAA,EAC/F;AACA,MACE,SAAS,4BAA4B,UACrC,SAAS,0BAA0B,SAAS,eAAe,KAC3D;AACA,IAAAA,QAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF;AACA,SAAOA;AACT;AAWO,SAAS,+BAA+B,UAAwC;AACrF,QAAM,WAAW,SAAS,yBAAyB,KAAK;AACxD,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AACA,QAAM,aAAa,SAAS,kBAAkB,KAAK;AACnD,SAAO,aAAa,aAAa;AACnC;AAYO,SAAS,wBAAwB,UAAwC;AAC9E,QAAM,WAAW,SAAS,4BAA4B,KAAK;AAC3D,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AACA,QAAM,SAAS,SAAS,mBAAmB,KAAK;AAChD,MAAI,QAAQ;AACV,WAAO;AAAA,EACT;AACA,QAAM,aAAa,SAAS,kBAAkB,KAAK;AACnD,SAAO,aAAa,aAAa;AACnC;AAmBO,SAAS,yBAAyB,UAA8C;AACrF,QAAM,cAAc,SAAS,kCAAkC,KAAK;AACpE,QAAM,cAAc,SAAS,kCAAkC,KAAK,KAAK;AACzE,QAAM,OAAO,SAAS,2BAA2B,KAAK;AACtD,QAAM,WAAW,SAAS,+BAA+B,KAAK;AAC9D,MAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU;AACtC,WAAO;AAAA,EACT;AACA,SAAO,EAAE,aAAa,aAAa,MAAM,SAAS;AACpD;AAEA,SAAS,8BAA8B,UAAuC;AAC5E,MACE,SAAS,yBAAyB,mBAClC,SAAS,yBAAyB,UAClC;AACA,QACE,QAAQ,SAAS,wBAAwB,MAAM,QAAQ,SAAS,4BAA4B,GAC5F;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,yBAAyB,oBACjC,SAAS,yBACR,SAAS,iCACT,SAAS,kCACV,CAAC,SAAS,4BAA4B,CAAC,SAAS,+BACjD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,sCACT,SAAS,iCACT,SAAS,gCACT,SAAS,4BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,6BACT,SAAS,mCACT,SAAS,+BACT,SAAS,6BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,WAAW,SAAS,yBAAyB,cAAc;AACzD,QACE,SAAS,yBACT,SAAS,iCACT,SAAS,gCACT,SAAS,4BACT,SAAS,8BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,6BACT,SAAS,mCACT,SAAS,+BACT,SAAS,6BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,sBAAsB,QAAQ,SAAS,kCAAkC;AAC/E,UAAM,eACJ,QAAQ,SAAS,6BAA6B,KAC9C,QAAQ,SAAS,4BAA4B;AAC/C,QAAI,CAAC,uBAAuB,CAAC,cAAc;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,OAAO;AACL,QACE,SAAS,yBACT,SAAS,iCACT,SAAS,gCACT,SAAS,4BACT,SAAS,8BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,sCACT,SAAS,iCACT,SAAS,gCACT,SAAS,4BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,iCAAiC;AAC5C,8BAAwB,SAAS,+BAA+B;AAAA,IAClE;AAAA,EACF;AACF;AAaO,SAAS,4BACd,UAC6B;AAC7B,QAAM,OAAO,SAAS,2BAA2B,KAAK;AACtD,QAAM,WAAW,SAAS,+BAA+B,KAAK;AAC9D,MAAI,CAAC,QAAQ,CAAC,UAAU;AACtB,WAAO;AAAA,EACT;AACA,SAAO,EAAE,MAAM,SAAS;AAC1B;AAEA,SAAS,SAAS,KAAuB;AACvC,SAAO,IACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACnB;AAGO,SAAS,sBAAsB,UAA6D;AACjG,SAAO,CAAC,GAAG,IAAI,IAAI,SAAS,SAAS,yBAAyB,EAAE,CAAC,CAAC;AACpE;AAEA,SAAS,eAAe,KAAe,WAA6B;AAClE,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAgB,CAAC;AACvB,aAAW,QAAQ,KAAK;AACtB,QAAI,CAAC,QAAQ,KAAK,IAAI,GAAG;AACvB,YAAM,IAAI,MAAM,GAAG,SAAS,mCAAmC,IAAI,EAAE;AAAA,IACvE;AACA,QAAI,CAAC,KAAK,IAAI,IAAI,GAAG;AACnB,WAAK,IAAI,IAAI;AACb,UAAI,KAAK,IAAI;AAAA,IACf;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,KAAyB;AAC7C,SAAO,CAAC,GAAG,IAAI,IAAI,IAAI,OAAO,OAAO,CAAC,CAAC;AACzC;AAEA,SAAS,wBAAwB,KAAsB;AACrD,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,oEAAoE,OAAO,IAAI;AAAA,MAC7F,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;AAGO,IAAM,0BAA0B,CAAC,aAAa,qBAAqB;AAI1E,IAAM,+BAoBF,OAAO,YAAY;AAAA,EACrB,GAAG;AAAA,IACD,CAAC,mBAAmB,QAAQ;AAAA,IAC5B,CAAC,qBAAqB,QAAQ;AAAA,IAC9B,CAAC,oBAAoB,QAAQ;AAAA,IAC7B,CAAC,iBAAiB,MAAM;AAAA,IACxB,CAAC,mBAAmB,MAAM;AAAA,IAC1B,CAAC,mBAAmB,MAAM;AAAA,IAC1B,CAAC,mBAAmB,OAAO;AAAA,EAC7B,EAAE,IAAI,CAAC,CAAC,IAAI,aAAa,MAAM;AAAA,IAC7B;AAAA,IACA;AAAA,MACE,SAAS,CAAC,OAAO,UAAU,QAAQ,SAAS,KAAK;AAAA,MACjD;AAAA,MACA,qBAAqB;AAAA,MACrB,iBAAiB;AAAA,MACjB,qBACE,OAAO,qBAAqB,OAAO,uBAAuB,OAAO;AAAA,MACnE,GAAI,OAAO,qBAAqB,OAAO,sBAAsB,EAAE,iBAAiB,KAAK,IAAI,CAAC;AAAA,MAC1F,GAAI,OAAO,qBACP,EAAE,uBAAuB,KAAO,IAChC,OAAO,oBACL,EAAE,uBAAuB,kCAAkC,IAC3D,CAAC;AAAA,IACT;AAAA,EACF,CAAC;AAAA,EACD,GAAG,CAAC,mBAAmB,mBAAmB,EAAE,IAAI,CAAC,OAAO;AAAA,IACtD;AAAA,IACA;AAAA,MACE,SAAS,CAAC,OAAO,UAAU,QAAQ,KAAK;AAAA,MACxC,eAAe;AAAA,MACf,qBAAqB;AAAA,MACrB,iBAAiB;AAAA,IACnB;AAAA,EACF,CAAC;AAAA,EACD;AAAA,IACE;AAAA,IACA;AAAA,MACE,SAAS,CAAC;AAAA,MACV,eAAe;AAAA,MACf,qBAAqB;AAAA,MACrB,iBAAiB;AAAA,IACnB;AAAA,EACF;AACF,CAAC;AACM,SAAS,yBAAyB,iBAAyB;AAChE,SAAO,OAAO,OAAO,8BAA8B,eAAe,IAC9D,6BAA6B,eAAe,IAC5C;AACN;AAMO,IAAM,sCAAsC;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AACF;AACO,SAAS,iBACd,MACA,QAAsC,gBAC9B;AACR,SAAO,GAAG,KAAK,IAAI,SAAS,cAAc,cAAc,qBAAqB;AAC/E;AAUO,SAAS,4BACd,UACA,aACA,QAAsC,gBAC5B;AACV,MAAI,YAAY,wBAAwB,SAAS,kBAAkB;AACnE,aAAW,QAAQ,yBAAyB;AAC1C,QAAI,SAAS,yBAAyB,CAAC,SAAS,2BAA2B;AACzE,kBAAY,UAAU,OAAO,CAAC,aAAa,SAAS,OAAO,iBAAiB,MAAM,KAAK,CAAC;AACxF;AAAA,IACF;AACA,UAAM,aAAa,YAAY,IAAI;AACnC,QAAI,CAAC,WAAY;AACjB,UAAM,KAAK,iBAAiB,MAAM,KAAK;AACvC,gBAAY,UAAU,OAAO,CAAC,aAAa,SAAS,OAAO,EAAE;AAC7D,QAAI,CAAC,WAAW,OAAO,OAAQ;AAC/B,cAAU,KAAK;AAAA,MACb;AAAA,MACA,OAAO,SAAS,cAAc,kBAAkB;AAAA,MAChD,MAAM,SAAS,cAAc,aAAa,KAAK,KAAK,uBAAuB,KAAK;AAAA,MAChF,KAAK;AAAA,MACL,aAAa;AAAA,MACb,SAAS;AAAA,MACT,WAAW;AAAA,QACT,MAAM,SAAS,cAAc,YAAY;AAAA,QACzC,UAAU;AAAA,QACV,iBAAiB;AAAA,QACjB,qBAAqB;AAAA,MACvB;AAAA,MACA,QAAQ,WAAW,OAAO,IAAI,CAAC,UAAU;AACvC,cAAM,UAAU,yBAAyB,MAAM,eAAe;AAC9D,cAAM,mBAAmB,QAAQ,SAAS,QAAQ,MAAM;AACxD,cAAM,sBAAsB,SAAS,uBAAuB;AAC5D,cAAM,gBAAgB,SAAS,mBAAmB;AAClD,eAAO;AAAA,UACL;AAAA,UACA,8BAA8B,sBAAsB;AAAA,UACpD,uBACE,SAAS,0BACR,wBAAwB,MACrB,MACA,KAAK,IAAI,MAAS,sBAAsB,gBAAgB,IAAM;AAAA,UACpE,IAAI,KAAK,MAAM,MAAM;AAAA,UACrB,iBAAiB,MAAM;AAAA,UACvB,OACE,MAAM,UACL,MAAM,oBAAoB,oBACvB,oBACA,MAAM,oBAAoB,sBACxB,sBACA,MAAM,oBAAoB,qBACxB,qBACA,MAAM;AAAA,UAChB,iBAAiB;AAAA;AAAA;AAAA,UAGjB,iBAAiB,SAAS;AAAA,UAC1B,cAAc;AAAA,YACZ,GAAG,wBAAwB,UAAU;AAAA,cACnC,iBAAiB;AAAA,cACjB,iBAAiB,SAAS;AAAA,cAC1B,QAAQ;AAAA,YACV,CAAC;AAAA,YACD,qBAAqB,CAAC;AAAA,YACtB,WAAW;AAAA,cACT,UAAU,mBAAmB,cAAc;AAAA,cAC3C,UAAU;AAAA,cACV,SAAS,CAAC,GAAI,SAAS,WAAW,CAAC,CAAE;AAAA,cACrC,eAAe,SAAS,iBAAiB;AAAA,cACzC,UAAU;AAAA,YACZ;AAAA,YACA,iBAAiB,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,YACzD,eAAe,EAAE,UAAU,aAAa,UAAU,MAAM,MAAM,YAAY;AAAA,UAC5E;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AACA,SAAO,EAAE,GAAG,UAAU,oBAAoB,KAAK,UAAU,SAAS,EAAE;AACtE;AACO,SAAS,+BACd,UACA,MACA,YACA,QAAsC,gBACtC,mBACU;AACV,MAAI,SAAS,yBAAyB,CAAC,SAAS;AAC9C,UAAM,IAAI,MAAM,yDAAyD;AAC3E,MAAI,CAAC,WAAW,KAAK,EAAG,OAAM,IAAI,MAAM,4BAA4B;AACpE,QAAM,SACJ,SAAS,yBAAyB,WAAW,KAAK,EAAE,WAAW,GAAG,IAC9D,6BAA6B,MAAM,KAAK,MAAM,UAAU,CAAC,IACzD;AACN,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB,KAAK;AAAA,MACvB,wBAAwB,SAAS,kBAAkB,EAAE;AAAA,QAAI,CAAC,aACxD,SAAS,OAAO,iBAAiB,MAAM,KAAK,IACxC;AAAA,UACE,GAAG;AAAA,UACH,QAAQ,QAAQ,SAAS;AAAA,UACzB,GAAI,SAAS,yBAAyB,SAAS,YAC3C;AAAA,YACE,WAAW;AAAA,cACT,GAAG,SAAS;AAAA,cACZ,UAAU,QAAQ;AAAA,cAClB,mBAAmB,oBACf;AAAA,gBACE,cAAc,kBAAkB;AAAA,gBAChC,mBAAmB,kBAAkB;AAAA,cACvC,IACA;AAAA,YACN;AAAA,UACF,IACA,CAAC;AAAA,QACP,IACA;AAAA,MACN;AAAA,IACF;AAAA,EACF;AACF;","names":["allowed","z","z","XAI_SUBSCRIPTION_MODEL_ID_PREFIX","z","z","status","z","apiKey","issues","allowed","provider","model","url","drainCaptureTimeoutMs"]}
+{"version":3,"sources":["../src/managed-user-admission.ts","../src/realtime-voice-pricing.ts","../src/web-search.ts","../src/credit-promotions.ts","../src/index.ts","../src/claude-subscription-usage.ts","../src/claude-subscription-oauth.ts","../src/subscription-account-selection.ts","../src/claude-subscription-capacity.ts"],"sourcesContent":["/** Deployment admission for native human accounts; never service credentials. */\nexport function managedUserEmailAllowed(\n  allowedUserEmails: readonly string[] | undefined,\n  email: unknown,\n): boolean {\n  return (\n    allowedUserEmails === undefined ||\n    (typeof email === \"string\" &&\n      allowedUserEmails.some((allowed) => allowed.toLowerCase() === email.trim().toLowerCase()))\n  );\n}\n","import { z } from \"zod\";\n\n/**\n * Credit pricing for deployment-funded live (speech-to-speech) voice.\n *\n * Live voice is metered by server-observed connection time, billed per started\n * minute. Prices are deployment configuration, never code defaults: when credit\n * billing is active, a deployment-funded voice model without a configured price\n * is not offered and cannot be started.\n */\nexport type RealtimeVoicePricing = {\n  /** Upstream cost of one minute of live voice, in USD micros. */\n  microsPerMinute: number;\n  /** Opengeni margin in basis points added on top of the upstream cost. */\n  marginBps?: number | undefined;\n};\n\nconst RealtimeVoicePricingSchema = z\n  .object({\n    microsPerMinute: z.number().int().positive().max(100_000_000),\n    marginBps: z.number().int().min(0).max(100_000).optional(),\n  })\n  .strict();\n\n/** Model id of the deployment-hosted Azure GPT Live voice. */\nexport const AZURE_LIVE_REALTIME_MODEL_ID = \"opengeni-azure/gpt-live-1\" as const;\n\nfunction parseJson(raw: string, env: string): unknown {\n  try {\n    return JSON.parse(raw);\n  } catch {\n    throw new Error(`${env} must be valid JSON`);\n  }\n}\n\nfunction issues(error: z.ZodError): string {\n  return error.issues\n    .map((issue) => `${issue.path.join(\".\") || \"(root)\"}: ${issue.message}`)\n    .join(\"; \");\n}\n\n/** One live-voice price, e.g. `{\"microsPerMinute\":50000,\"marginBps\":500}`. */\nexport function parseRealtimeVoicePricingJson(\n  raw: string | undefined,\n  env = \"live voice pricing JSON\",\n): RealtimeVoicePricing | null {\n  if (raw === undefined || raw.trim() === \"\") return null;\n  const result = RealtimeVoicePricingSchema.safeParse(parseJson(raw, env));\n  if (!result.success) throw new Error(`${env} is invalid: ${issues(result.error)}`);\n  return result.data;\n}\n\n/**\n * Prices keyed by upstream AI Gateway realtime model id, e.g.\n * `{\"openai/gpt-realtime-2.1\":{\"microsPerMinute\":120000,\"marginBps\":500}}`.\n */\nexport function parseRealtimeVoicePricingTableJson(\n  raw: string | undefined,\n  env = \"live voice pricing table JSON\",\n): Record<string, RealtimeVoicePricing> {\n  if (raw === undefined || raw.trim() === \"\") return {};\n  const result = z\n    .record(z.string().min(1).max(256), RealtimeVoicePricingSchema)\n    .safeParse(parseJson(raw, env));\n  if (!result.success) throw new Error(`${env} is invalid: ${issues(result.error)}`);\n  return result.data;\n}\n\n/** Credit price of one started minute, after margin, rounded up to whole micros. */\nexport function realtimeVoiceMinuteCreditMicros(\n  pricing: RealtimeVoicePricing,\n  marginBpsOverride?: number,\n): {\n  providerCostMicros: number;\n  creditCostMicros: number;\n} {\n  const provider = BigInt(pricing.microsPerMinute);\n  const credit =\n    (provider * BigInt(10_000 + (marginBpsOverride ?? pricing.marginBps ?? 0)) + 9_999n) / 10_000n;\n  return { providerCostMicros: Number(provider), creditCostMicros: Number(credit) };\n}\n\n/** Billed minutes for a server-observed interval: every started minute, at least one. */\nexport function realtimeVoiceStartedMinutes(startedAt: Date, observedUntil: Date): number {\n  const elapsed = Math.max(0, observedUntil.getTime() - startedAt.getTime());\n  return Math.max(1, Math.ceil(elapsed / 60_000));\n}\n","import { z } from \"zod\";\n\n/**\n * Provider-agnostic web search: the deployment-funded `web_search` and\n * `web_fetch` agent tools.\n *\n * Hosted search (the provider-executed `web_search` tool of the model's own\n * API) follows the model catalog. Provider search is a separate,\n * deployment-configured HTTP provider that Opengeni calls from the worker.\n * Search and page reading are separate slots; each slot holds an ordered\n * list of providers, and a call moves to the next provider when one fails.\n * By default the provider tools are offered only where the turn has no\n * hosted search (`OPENGENI_WEB_SEARCH_PREFER=native`).\n *\n * Adding a provider means one catalog entry here plus one adapter in\n * `@opengeni/runtime/web-search`.\n */\n\nexport const WEB_SEARCH_PROVIDER_IDS = [\n  \"tinyfish\",\n  \"parallel\",\n  \"perplexity\",\n  \"exa\",\n  \"tavily\",\n  \"firecrawl\",\n  \"brave\",\n  \"jina\",\n  \"searxng\",\n] as const;\nexport type WebSearchProviderId = (typeof WEB_SEARCH_PROVIDER_IDS)[number];\n\n/** Used when `OPENGENI_WEB_SEARCH_PROVIDER` is unset: free with an account key. */\nexport const DEFAULT_WEB_SEARCH_PROVIDER: WebSearchProviderId = \"tinyfish\";\n\n/** Model-visible names of the provider tools. */\nexport const WEB_SEARCH_TOOL_NAME = \"web_search\";\nexport const WEB_FETCH_TOOL_NAME = \"web_fetch\";\nexport type WebSearchProviderToolName = typeof WEB_SEARCH_TOOL_NAME | typeof WEB_FETCH_TOOL_NAME;\n\n/**\n * `native` (default): offer provider tools only to turns without hosted\n * search. `provider`: offer them to every turn and withhold the SDK-hosted\n * `web_search` tool. SuperGrok keeps its transport-level native search either\n * way because Opengeni does not attach it as an agent tool.\n */\nexport const WebSearchPreference = z.enum([\"native\", \"provider\"]);\nexport type WebSearchPreference = z.infer<typeof WebSearchPreference>;\n\n/** One operation (search or page fetch) a provider offers. */\nexport type WebSearchProviderOperation = {\n  /** Pay-as-you-go list price of one successful call, in USD micros. */\n  listPriceMicros: number;\n  /** The operation needs an API key; keyless calls are billed as free. */\n  keyRequired: boolean;\n  /** Default API base URL; null when the operator must supply one. */\n  defaultBaseUrl: string | null;\n};\n\nexport type WebSearchProviderCatalogEntry = {\n  id: WebSearchProviderId;\n  label: string;\n  search: WebSearchProviderOperation | null;\n  fetch: WebSearchProviderOperation | null;\n  /** Where the list price comes from (checked 2026-10). */\n  pricingUrl: string;\n};\n\n/**\n * Every supported provider with its capabilities, default endpoints and\n * list prices. A provider response that reports its own dollar cost (Exa\n * `costDollars`, Tavily `usage.credits`) bills that cost instead, and\n * `OPENGENI_WEB_SEARCH_PRICING_JSON` overrides both.\n */\nexport const WEB_SEARCH_PROVIDER_CATALOG: Readonly<\n  Record<WebSearchProviderId, WebSearchProviderCatalogEntry>\n> = {\n  tinyfish: {\n    id: \"tinyfish\",\n    label: \"TinyFish\",\n    // Search and Fetch are free at any wallet balance, within account rate limits.\n    search: {\n      listPriceMicros: 0,\n      keyRequired: true,\n      defaultBaseUrl: \"https://api.search.tinyfish.ai\",\n    },\n    fetch: {\n      listPriceMicros: 0,\n      keyRequired: true,\n      defaultBaseUrl: \"https://api.fetch.tinyfish.ai\",\n    },\n    pricingUrl: \"https://www.tinyfish.ai/pricing\",\n  },\n  parallel: {\n    id: \"parallel\",\n    label: \"Parallel\",\n    // Search in `fast` mode $1/1k requests; Extract $1/1k URLs.\n    search: {\n      listPriceMicros: 1_000,\n      keyRequired: true,\n      defaultBaseUrl: \"https://api.parallel.ai\",\n    },\n    fetch: { listPriceMicros: 1_000, keyRequired: true, defaultBaseUrl: \"https://api.parallel.ai\" },\n    pricingUrl: \"https://parallel.ai/pricing\",\n  },\n  perplexity: {\n    id: \"perplexity\",\n    label: \"Perplexity\",\n    // Search API with `search_type: \"fast\"`: $1/1k requests.\n    search: {\n      listPriceMicros: 1_000,\n      keyRequired: true,\n      defaultBaseUrl: \"https://api.perplexity.ai\",\n    },\n    fetch: null,\n    pricingUrl: \"https://docs.perplexity.ai/getting-started/pricing\",\n  },\n  exa: {\n    id: \"exa\",\n    label: \"Exa\",\n    // Auto search $7/1k + highlights $1/1k; contents text $1/1k pages.\n    search: { listPriceMicros: 8_000, keyRequired: true, defaultBaseUrl: \"https://api.exa.ai\" },\n    fetch: { listPriceMicros: 1_000, keyRequired: true, defaultBaseUrl: \"https://api.exa.ai\" },\n    pricingUrl: \"https://exa.ai/pricing\",\n  },\n  tavily: {\n    id: \"tavily\",\n    label: \"Tavily\",\n    // Basic search 1 credit, basic extract 1 credit per 5 URLs; $0.008/credit.\n    search: { listPriceMicros: 8_000, keyRequired: true, defaultBaseUrl: \"https://api.tavily.com\" },\n    fetch: { listPriceMicros: 1_600, keyRequired: true, defaultBaseUrl: \"https://api.tavily.com\" },\n    pricingUrl: \"https://docs.tavily.com/documentation/api-credits\",\n  },\n  firecrawl: {\n    id: \"firecrawl\",\n    label: \"Firecrawl\",\n    // 2 credits per 10 results, 1 credit per scrape, at Hobby-plan credit cost.\n    search: {\n      listPriceMicros: 6_400,\n      keyRequired: true,\n      defaultBaseUrl: \"https://api.firecrawl.dev\",\n    },\n    fetch: {\n      listPriceMicros: 3_200,\n      keyRequired: true,\n      defaultBaseUrl: \"https://api.firecrawl.dev\",\n    },\n    pricingUrl: \"https://www.firecrawl.dev/pricing\",\n  },\n  brave: {\n    id: \"brave\",\n    label: \"Brave Search\",\n    // $5 per 1k requests.\n    search: {\n      listPriceMicros: 5_000,\n      keyRequired: true,\n      defaultBaseUrl: \"https://api.search.brave.com\",\n    },\n    fetch: null,\n    pricingUrl: \"https://brave.com/search/api/\",\n  },\n  jina: {\n    id: \"jina\",\n    label: \"Jina\",\n    // At least 10k tokens per search at $0.05/1M; the reader works keyless at\n    // a low per-IP rate and can be self-hosted (set its base URL).\n    search: { listPriceMicros: 500, keyRequired: true, defaultBaseUrl: \"https://s.jina.ai\" },\n    fetch: { listPriceMicros: 250, keyRequired: false, defaultBaseUrl: \"https://r.jina.ai\" },\n    pricingUrl: \"https://jina.ai/reader/\",\n  },\n  searxng: {\n    id: \"searxng\",\n    label: \"SearXNG\",\n    // Self-hosted metasearch; needs the operator's base URL.\n    search: { listPriceMicros: 0, keyRequired: false, defaultBaseUrl: null },\n    fetch: null,\n    pricingUrl: \"https://docs.searxng.org/\",\n  },\n};\n\nfunction envProviderName(id: WebSearchProviderId): string {\n  return id.toUpperCase();\n}\n\n/** Per-provider API key variable, e.g. `OPENGENI_WEB_TINYFISH_API_KEY`. */\nexport function webSearchProviderApiKeyEnv(id: WebSearchProviderId): string {\n  return `OPENGENI_WEB_${envProviderName(id)}_API_KEY`;\n}\n\n/** Per-provider base URL variable, e.g. `OPENGENI_WEB_SEARXNG_BASE_URL`. */\nexport function webSearchProviderBaseUrlEnv(id: WebSearchProviderId): string {\n  return `OPENGENI_WEB_${envProviderName(id)}_BASE_URL`;\n}\n\n/** Every environment variable that configures provider web search. */\nexport function webSearchEnvironmentVariables(): string[] {\n  return [\n    \"OPENGENI_WEB_SEARCH_PROVIDER\",\n    \"OPENGENI_WEB_FETCH_PROVIDER\",\n    \"OPENGENI_WEB_SEARCH_PREFER\",\n    \"OPENGENI_WEB_SEARCH_PRICING_JSON\",\n    \"OPENGENI_WEB_SEARCH_REQUEST_TIMEOUT_MS\",\n    ...WEB_SEARCH_PROVIDER_IDS.flatMap((id) => [\n      webSearchProviderApiKeyEnv(id),\n      webSearchProviderBaseUrlEnv(id),\n    ]),\n    // Earlier single-provider names, still honoured.\n    \"OPENGENI_WEB_SEARCH_API_KEY\",\n    \"OPENGENI_WEB_SEARCH_BASE_URL\",\n    \"OPENGENI_WEB_FETCH_API_KEY\",\n    \"OPENGENI_WEB_FETCH_BASE_URL\",\n    \"OPENGENI_WEB_SEARCH_PROVIDER_MODE\",\n  ];\n}\n\nexport type WebSearchProviderCredentials = Partial<\n  Record<string, { apiKey?: string | undefined; baseUrl?: string | undefined }>\n>;\n\nexport const WebSearchProviderCredentialsSchema = z\n  .record(\n    z.string(),\n    z.object({ apiKey: z.string().optional(), baseUrl: z.string().optional() }).strict(),\n  )\n  .default({});\n\n/** Per-provider keys and base URLs from the environment. */\nexport function webSearchProviderCredentialsFromEnv(\n  source: Record<string, string | undefined>,\n): WebSearchProviderCredentials {\n  const credentials: WebSearchProviderCredentials = {};\n  for (const id of WEB_SEARCH_PROVIDER_IDS) {\n    const apiKey = source[webSearchProviderApiKeyEnv(id)]?.trim();\n    const baseUrl = source[webSearchProviderBaseUrlEnv(id)]?.trim();\n    if (apiKey || baseUrl) {\n      credentials[id] = { ...(apiKey ? { apiKey } : {}), ...(baseUrl ? { baseUrl } : {}) };\n    }\n  }\n  return credentials;\n}\n\n/**\n * Upstream price of one call in integer USD micros, plus the Opengeni\n * margin in basis points (500 = +5%, as for model pricing). Credit billing\n * charges `ceil(providerCost * (10000 + marginBps) / 10000)` per call.\n */\nexport type WebSearchPricing = {\n  searchMicros: number;\n  fetchMicros: number;\n  marginBps?: number | undefined;\n};\n\nconst WebSearchPricingSchema = z\n  .object({\n    searchMicros: z.number().int().nonnegative().max(10_000_000),\n    fetchMicros: z.number().int().nonnegative().max(10_000_000),\n    marginBps: z.number().int().min(0).max(100_000).optional(),\n  })\n  .strict();\n\nconst DEFAULT_MARGIN_BPS = 500;\n\n/** Tavily's pay-as-you-go price of one credit, used for reported usage. */\nexport const TAVILY_CREDIT_MICROS = 8_000;\n\nexport type WebSearchProviderEndpoint = {\n  provider: WebSearchProviderId;\n  apiKey: string | null;\n  baseUrl: string | null;\n};\n\nexport type WebSearchProviderConfig = {\n  preference: WebSearchPreference;\n  /** Search providers in failover order; never empty. */\n  search: WebSearchProviderEndpoint[];\n  /** Page readers in failover order; empty when pages cannot be fetched. */\n  fetch: WebSearchProviderEndpoint[];\n  /** Explicit operator prices by provider, overriding list prices. */\n  pricingOverrides: Partial<Record<WebSearchProviderId, WebSearchPricing>>;\n  /** Deployment-wide margin override for provider-rate credit billing. */\n  creditMarginBpsOverride?: number | undefined;\n  timeoutMs: number;\n};\n\nexport type WebSearchSettings = {\n  webSearchEnabled: boolean;\n  webSearchProvider?: string | undefined;\n  webFetchProvider?: string | undefined;\n  webSearchPrefer?: string | undefined;\n  /** Per-provider keys and base URLs (`OPENGENI_WEB_<PROVIDER>_API_KEY` / `_BASE_URL`). */\n  webSearchProviderCredentials?: WebSearchProviderCredentials | undefined;\n  /** Earlier single-provider settings: apply to the first provider of their slot. */\n  webSearchApiKey?: string | undefined;\n  webSearchBaseUrl?: string | undefined;\n  webFetchApiKey?: string | undefined;\n  webFetchBaseUrl?: string | undefined;\n  webSearchProviderMode?: string | undefined;\n  webSearchPricingJson?: string | undefined;\n  webSearchRequestTimeoutMs?: number | undefined;\n  /** Credit billing is active for this deployment (see webSearchCreditBillingActive). */\n  billingMode?: string | undefined;\n  usageLimitsMode?: string | undefined;\n  creditMarginBpsOverride?: number | undefined;\n};\n\nexport type WebSearchProviderResolution =\n  | { status: \"off\" }\n  | { status: \"invalid\"; reason: string }\n  | { status: \"configured\"; config: WebSearchProviderConfig };\n\nfunction usableSecret(value: string | undefined): string | null {\n  const trimmed = value?.trim();\n  if (!trimmed) return null;\n  // `.env.example` placeholders must never advertise a dead tool.\n  if (/^(your[-_ ]|<|changeme|replace[-_ ]?me|xxx)/iu.test(trimmed)) return null;\n  return trimmed;\n}\n\nfunction normalizedBaseUrl(value: string | undefined, name: string): string | null {\n  const trimmed = value?.trim();\n  if (!trimmed) return null;\n  let url: URL;\n  try {\n    url = new URL(trimmed);\n  } catch (error) {\n    throw new Error(`${name} must be an absolute http(s) URL`, { cause: error });\n  }\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(`${name} must be an absolute http(s) URL`);\n  }\n  if (url.username || url.password) throw new Error(`${name} must not embed credentials`);\n  return url.toString().replace(/\\/+$/u, \"\");\n}\n\nfunction providerList(raw: string, variable: string, operation: \"search\" | \"fetch\") {\n  const ids: WebSearchProviderId[] = [];\n  for (const part of raw.split(\",\")) {\n    const normalized = part.trim().toLowerCase();\n    if (!normalized) continue;\n    const capable = WEB_SEARCH_PROVIDER_IDS.filter(\n      (id) => WEB_SEARCH_PROVIDER_CATALOG[id][operation],\n    );\n    if (!(capable as readonly string[]).includes(normalized)) {\n      throw new Error(\n        `${variable} must be none or a comma-separated list of ${capable.join(\", \")}`,\n      );\n    }\n    if (!ids.includes(normalized as WebSearchProviderId))\n      ids.push(normalized as WebSearchProviderId);\n  }\n  if (ids.length === 0) throw new Error(`${variable} names no provider`);\n  return ids;\n}\n\nfunction preference(settings: WebSearchSettings): WebSearchPreference {\n  const prefer = settings.webSearchPrefer?.trim().toLowerCase();\n  if (prefer) {\n    const parsed = WebSearchPreference.safeParse(prefer);\n    if (!parsed.success) throw new Error(\"OPENGENI_WEB_SEARCH_PREFER must be native or provider\");\n    return parsed.data;\n  }\n  const legacy = settings.webSearchProviderMode?.trim().toLowerCase();\n  if (!legacy || legacy === \"fallback\") return \"native\";\n  if (legacy === \"replace\") return \"provider\";\n  throw new Error(\"OPENGENI_WEB_SEARCH_PROVIDER_MODE must be fallback or replace\");\n}\n\nfunction pricingOverrides(raw: string | undefined): WebSearchProviderConfig[\"pricingOverrides\"] {\n  const trimmed = raw?.trim();\n  if (!trimmed) return {};\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(trimmed);\n  } catch (error) {\n    throw new Error(\"OPENGENI_WEB_SEARCH_PRICING_JSON must be valid JSON\", { cause: error });\n  }\n  const describe = (error: z.ZodError) =>\n    `OPENGENI_WEB_SEARCH_PRICING_JSON is invalid: ${error.issues\n      .map((issue) => `${issue.path.join(\".\") || \"(root)\"}: ${issue.message}`)\n      .join(\"; \")}`;\n  // One flat price applies to every configured provider.\n  if (parsed && typeof parsed === \"object\" && \"searchMicros\" in parsed) {\n    const flat = WebSearchPricingSchema.safeParse(parsed);\n    if (!flat.success) throw new Error(describe(flat.error));\n    return Object.fromEntries(WEB_SEARCH_PROVIDER_IDS.map((id) => [id, flat.data]));\n  }\n  const byProvider = z\n    .record(z.string(), WebSearchPricingSchema)\n    .superRefine((value, context) => {\n      for (const key of Object.keys(value)) {\n        if (!(WEB_SEARCH_PROVIDER_IDS as readonly string[]).includes(key)) {\n          context.addIssue({ code: \"custom\", path: [key], message: \"unknown provider\" });\n        }\n      }\n    })\n    .safeParse(parsed);\n  if (!byProvider.success) throw new Error(describe(byProvider.error));\n  return byProvider.data as WebSearchProviderConfig[\"pricingOverrides\"];\n}\n\n/**\n * Resolve the deployment's provider search. `off` applies when\n * `OPENGENI_WEB_SEARCH_ENABLED=false` (the server-wide web search switch),\n * when the provider is `none`, and when the provider is left at its default\n * (TinyFish) without that provider's key. `invalid` means an operator named\n * providers but the configuration cannot work; the tools stay unoffered and\n * the worker logs the reason.\n */\nexport function resolveWebSearchProvider(settings: WebSearchSettings): WebSearchProviderResolution {\n  const named = settings.webSearchProvider?.trim() ?? \"\";\n  if (!settings.webSearchEnabled || named.toLowerCase() === \"none\") return { status: \"off\" };\n  const credentials = settings.webSearchProviderCredentials ?? {};\n  if (named === \"\") {\n    // The default provider turns on only once its own key is set.\n    if (!usableSecret(credentials[DEFAULT_WEB_SEARCH_PROVIDER]?.apiKey)) return { status: \"off\" };\n  }\n  try {\n    const searchIds = providerList(\n      named || DEFAULT_WEB_SEARCH_PROVIDER,\n      \"OPENGENI_WEB_SEARCH_PROVIDER\",\n      \"search\",\n    );\n    const endpoint = (\n      id: WebSearchProviderId,\n      operation: \"search\" | \"fetch\",\n      legacy: { apiKey: string | undefined; baseUrl: string | undefined; name: string } | null,\n      sameProvider: WebSearchProviderEndpoint | undefined,\n    ): WebSearchProviderEndpoint => {\n      const own = credentials[id];\n      const apiKey =\n        usableSecret(own?.apiKey) ??\n        (legacy ? usableSecret(legacy.apiKey) : null) ??\n        sameProvider?.apiKey ??\n        null;\n      const baseUrl =\n        normalizedBaseUrl(own?.baseUrl, webSearchProviderBaseUrlEnv(id)) ??\n        (legacy ? normalizedBaseUrl(legacy.baseUrl, `${legacy.name}_BASE_URL`) : null) ??\n        sameProvider?.baseUrl ??\n        null;\n      const spec = WEB_SEARCH_PROVIDER_CATALOG[id][operation]!;\n      if (spec.keyRequired && !apiKey) {\n        throw new Error(`${id} ${operation} needs ${webSearchProviderApiKeyEnv(id)}`);\n      }\n      if (!spec.defaultBaseUrl && !baseUrl) {\n        throw new Error(`${id} ${operation} needs ${webSearchProviderBaseUrlEnv(id)}`);\n      }\n      return { provider: id, apiKey, baseUrl };\n    };\n    const search = searchIds.map((id, index) =>\n      endpoint(\n        id,\n        \"search\",\n        index === 0 && named\n          ? {\n              apiKey: settings.webSearchApiKey,\n              baseUrl: settings.webSearchBaseUrl,\n              name: \"OPENGENI_WEB_SEARCH\",\n            }\n          : null,\n        undefined,\n      ),\n    );\n\n    const fetchNamed = settings.webFetchProvider?.trim() ?? \"\";\n    let fetch: WebSearchProviderEndpoint[];\n    if (fetchNamed === \"\") {\n      // Search providers that can also read pages do so, in the same order.\n      fetch = search.flatMap((entry) =>\n        WEB_SEARCH_PROVIDER_CATALOG[entry.provider].fetch ? [entry] : [],\n      );\n    } else if (fetchNamed.toLowerCase() === \"none\") {\n      fetch = [];\n    } else {\n      fetch = providerList(fetchNamed, \"OPENGENI_WEB_FETCH_PROVIDER\", \"fetch\").map((id, index) =>\n        endpoint(\n          id,\n          \"fetch\",\n          index === 0\n            ? {\n                apiKey: settings.webFetchApiKey,\n                baseUrl: settings.webFetchBaseUrl,\n                name: \"OPENGENI_WEB_FETCH\",\n              }\n            : null,\n          search.find((entry) => entry.provider === id),\n        ),\n      );\n    }\n    return {\n      status: \"configured\",\n      config: {\n        preference: preference(settings),\n        search,\n        fetch,\n        pricingOverrides: pricingOverrides(settings.webSearchPricingJson),\n        ...(settings.creditMarginBpsOverride !== undefined\n          ? { creditMarginBpsOverride: settings.creditMarginBpsOverride }\n          : {}),\n        timeoutMs: settings.webSearchRequestTimeoutMs ?? 20_000,\n      },\n    };\n  } catch (error) {\n    return { status: \"invalid\", reason: (error as Error).message };\n  }\n}\n\n/** The configured provider, or null when off or invalid. */\nexport function webSearchProviderConfig(\n  settings: WebSearchSettings,\n): WebSearchProviderConfig | null {\n  const resolution = resolveWebSearchProvider(settings);\n  return resolution.status === \"configured\" ? resolution.config : null;\n}\n\n/**\n * The single web-search plan for one turn, shared by the worker (which tools\n * it attaches) and the API's effective-tools projection (what it reports).\n *\n * `hostedWebSearch` is whether the resolved model attaches the SDK-hosted\n * `web_search` tool. `transportHostedSearch` is true for providers whose native\n * search is added by the transport rather than as an agent tool (SuperGrok).\n */\nexport function webSearchToolPlan(\n  settings: WebSearchSettings,\n  turn: {\n    hostedWebSearch: boolean;\n    transportHostedSearch?: boolean;\n    /**\n     * The workspace turned Opengeni credits off: a provider tool is offered\n     * only when one of its providers is free (admission still refuses paid\n     * calls if the switch flips mid-turn).\n     */\n    creditsDisabled?: boolean;\n  },\n): { hostedWebSearch: boolean; providerTools: WebSearchProviderToolName[] } {\n  const config = webSearchProviderConfig(settings);\n  if (!config || turn.transportHostedSearch) {\n    return { hostedWebSearch: turn.hostedWebSearch, providerTools: [] };\n  }\n  if (config.preference === \"native\" && turn.hostedWebSearch) {\n    return { hostedWebSearch: true, providerTools: [] };\n  }\n  const offered: WebSearchProviderToolName[] =\n    config.fetch.length > 0 ? [WEB_SEARCH_TOOL_NAME, WEB_FETCH_TOOL_NAME] : [WEB_SEARCH_TOOL_NAME];\n  const providerTools = turn.creditsDisabled\n    ? offered.filter((tool) => !webSearchToolSpendsCredits(settings, config, tool))\n    : offered;\n  return {\n    // `provider` withholds hosted search only in favour of a provider tool the\n    // turn actually gets.\n    hostedWebSearch: turn.hostedWebSearch && !providerTools.includes(WEB_SEARCH_TOOL_NAME),\n    providerTools,\n  };\n}\n\n/** Whether this deployment bills web search and fetch in Opengeni credits. */\nexport function webSearchCreditBillingActive(\n  settings: Pick<WebSearchSettings, \"billingMode\" | \"usageLimitsMode\">,\n): boolean {\n  return settings.billingMode === \"stripe\" || settings.usageLimitsMode === \"managed\";\n}\n\n/** Whether every provider of this tool would spend Opengeni credits per call. */\nexport function webSearchToolSpendsCredits(\n  settings: WebSearchSettings,\n  config: WebSearchProviderConfig,\n  tool: WebSearchProviderToolName,\n): boolean {\n  const operation = tool === WEB_SEARCH_TOOL_NAME ? \"search\" : \"fetch\";\n  return (\n    webSearchCreditBillingActive(settings) &&\n    config[operation].every(\n      (endpoint) => webSearchCallPricing(config, endpoint, operation).providerMicros > 0,\n    )\n  );\n}\n\n/** Upstream price for one call to one provider, before any provider-reported cost. */\nexport function webSearchCallPricing(\n  config: Pick<WebSearchProviderConfig, \"pricingOverrides\" | \"creditMarginBpsOverride\">,\n  endpoint: WebSearchProviderEndpoint,\n  operation: \"search\" | \"fetch\",\n): { providerMicros: number; marginBps: number; explicit: boolean } {\n  const override = config.pricingOverrides[endpoint.provider];\n  if (override) {\n    return {\n      providerMicros: operation === \"search\" ? override.searchMicros : override.fetchMicros,\n      marginBps: config.creditMarginBpsOverride ?? override.marginBps ?? DEFAULT_MARGIN_BPS,\n      explicit: true,\n    };\n  }\n  const spec = WEB_SEARCH_PROVIDER_CATALOG[endpoint.provider][operation];\n  // A keyless call (Jina reader, self-hosted SearXNG) costs nothing.\n  return {\n    providerMicros: spec && endpoint.apiKey ? spec.listPriceMicros : 0,\n    marginBps: config.creditMarginBpsOverride ?? DEFAULT_MARGIN_BPS,\n    explicit: false,\n  };\n}\n\n/** Credit cost of a provider cost after margin, rounded up to whole micros. */\nexport function webSearchCreditMicros(providerMicros: number, marginBps: number): number {\n  if (!Number.isSafeInteger(providerMicros) || providerMicros < 0) {\n    throw new Error(\"web search provider cost must be a non-negative safe integer\");\n  }\n  return Number((BigInt(providerMicros) * BigInt(10_000 + marginBps) + 9_999n) / 10_000n);\n}\n","import { PromotionalCreditScope } from \"@opengeni/contracts\";\nimport { z } from \"zod\";\n\nconst ModelIds = PromotionalCreditScope.shape.eligibleModelIds.transform((ids) => [\n  ...new Set(ids),\n]);\n\n/** Operator configuration only. Keys are Stripe coupon IDs, never customer account IDs. */\nexport const CreditPromotionPolicy = z\n  .object({\n    defaultModelIds: ModelIds.optional(),\n    signupModelIds: ModelIds.optional(),\n    offers: z\n      .record(\n        z.string().min(1),\n        z\n          .object({\n            label: PromotionalCreditScope.shape.label,\n            eligibleModelIds: ModelIds.optional(),\n          })\n          .strict(),\n      )\n      .default({}),\n  })\n  .strict()\n  .superRefine((policy, ctx) => {\n    for (const [id, offer] of Object.entries(policy.offers)) {\n      if (!offer.eligibleModelIds && !policy.defaultModelIds) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"offers\", id],\n          message: \"Offer requires eligibleModelIds or defaultModelIds\",\n        });\n      }\n    }\n  });\n\nexport const EnvCreditPromotionPolicy = z.preprocess(\n  (value) => {\n    if (typeof value !== \"string\") return value;\n    try {\n      return JSON.parse(value);\n    } catch {\n      return value;\n    }\n  },\n  CreditPromotionPolicy.default({ offers: {} }),\n);\n\nexport function signupCreditModelIds(settings: {\n  creditPromotionPolicy: z.infer<typeof CreditPromotionPolicy>;\n}) {\n  return (\n    settings.creditPromotionPolicy.signupModelIds ?? settings.creditPromotionPolicy.defaultModelIds\n  );\n}\n\nexport function promotionalCreditScope(\n  settings: { creditPromotionPolicy: z.infer<typeof CreditPromotionPolicy> },\n  couponId: string,\n): PromotionalCreditScope | undefined {\n  const policy = settings.creditPromotionPolicy;\n  const offer = policy.offers[couponId];\n  const eligibleModelIds = offer?.eligibleModelIds ?? policy.defaultModelIds;\n  return eligibleModelIds\n    ? { label: offer?.label ?? \"Promotional credits\", eligibleModelIds }\n    : undefined;\n}\n","import {\n  DEFAULT_OPENROUTER_MODEL_ID,\n  DEFAULT_MODEL_COST_POLICY_JSON,\n  DEFAULT_GOAL_IDLE_BACKOFF_MS,\n  DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS,\n  DEFAULT_AGENT_INSTRUCTIONS,\n} from \"./defaults\";\nexport {\n  DEFAULT_OPENROUTER_MODEL_ID,\n  DEFAULT_MODEL_COST_POLICY_JSON,\n  DEFAULT_GOAL_IDLE_BACKOFF_MS,\n  DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS,\n  AGENT_INSTRUCTIONS_CORE_PLACEHOLDER,\n  DEFAULT_AGENT_INSTRUCTIONS,\n} from \"./defaults\";\nexport { managedUserEmailAllowed } from \"./managed-user-admission\";\nexport * from \"./realtime-voice-pricing\";\nexport * from \"./web-search\";\nimport {\n  WebSearchProviderCredentialsSchema,\n  webSearchProviderCredentialsFromEnv,\n} from \"./web-search\";\nimport { EnvCreditPromotionPolicy } from \"./credit-promotions\";\nexport {\n  CreditPromotionPolicy,\n  signupCreditModelIds,\n  promotionalCreditScope,\n} from \"./credit-promotions\";\nimport { isRetiredNativeAtlassianTool } from \"@opengeni/contracts/atlassian-native-retirement\";\nimport { modelLogoUrl } from \"@opengeni/contracts/model-display\";\nimport {\n  directModelConnectionSpec,\n  BillingMode,\n  CAPABILITY_DESCRIPTORS,\n  agentConfigDeploymentLimitsFromAllowlist,\n  agentConfigFirstPartyMcpTools,\n  type AgentConfigDeploymentLimits,\n  DEFAULT_FIRST_PARTY_MCP_TOOLS,\n  DEFAULT_OPENGENI_DOCUMENTATION_URL,\n  currentAgentLearningToolSelection,\n  resolveWorkspaceSessionToolDefaults,\n  workspaceModelCompactionThreshold,\n  organizationModelCompactionThreshold,\n  type OrganizationModelDefaults,\n  type ModelCompactionPolicy,\n  Entitlements,\n  EntitlementsMode,\n  KnowledgeSourceSyncLimits,\n  LatencyMode,\n  MAX_NESTED_AGENT_DEPTH,\n  McpServerConnectionRef as PublicMcpServerConnectionRef,\n  ProductAccessMode,\n  ReasoningEffort,\n  FIRST_PARTY_MCP_TOOL_NAMES,\n  FirstPartyMcpToolName,\n  normalizeSitesDomain,\n  OpenGeniSlackBotDisplayName,\n  SandboxBackend,\n  SessionMcpApprovalPolicy,\n  SEEDANCE_2_5_MODEL_ID,\n  StaticUsageLimits,\n  TurnExecutionPolicyV1,\n  TurnServingPolicyV1,\n  UsageLimitsMode,\n  type TurnExecutionLatencyModeSourceV1,\n  type TurnExecutionModelSourceV1,\n  type TurnExecutionReasoningSourceV1,\n  type VideoGenerationResolution,\n  type FirstPartyMcpToolName as FirstPartyMcpToolNameType,\n  type Session,\n} from \"@opengeni/contracts\";\nimport type { CodeSearchDeploymentPolicy } from \"@opengeni/contracts/code-search\";\nimport { CODEX_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS } from \"@opengeni/codex\";\nimport {\n  CODEX_FALLBACK_MODEL_SLUGS,\n  CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT,\n  CODEX_MODEL_CONTEXT_WINDOW_TOKENS,\n  CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,\n  CODEX_MODEL_ID_PREFIX,\n  CODEX_PROVIDER_BASE_URL,\n  CODEX_PROVIDER_ID,\n} from \"@opengeni/codex/constants\";\nimport {\n  XAI_SUBSCRIPTION_MODEL_SLUGS,\n  XAI_SUBSCRIPTION_MODEL_AUTO_COMPACT_TOKEN_LIMIT,\n  XAI_SUBSCRIPTION_MODEL_CONTEXT_WINDOW_TOKENS,\n  XAI_SUBSCRIPTION_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,\n  XAI_SUBSCRIPTION_MODEL_ID_PREFIX,\n  XAI_SUBSCRIPTION_PROVIDER_ID,\n  XAI_SUBSCRIPTION_PROXY_BASE_URL,\n  XAI_RESPONSE_STREAM_IDLE_TIMEOUT_MS,\n} from \"@opengeni/xai-subscription\";\nexport { XAI_SUBSCRIPTION_MODEL_ID_PREFIX } from \"@opengeni/xai-subscription\";\nimport { createHash } from \"node:crypto\";\nimport { isIP } from \"node:net\";\nimport { z } from \"zod\";\n\n/**\n * Default maximum provider silence on a generic OpenAI-compatible model stream\n * while the worker is waiting for the next chunk. Matches the Codex transport\n * and SuperGrok idle defaults (5 minutes): long enough for a reasoning model's\n * silent thinking gaps, short enough that a wedged stream recovers the same\n * turn instead of hanging until a worker roll.\n */\nexport const DEFAULT_MODEL_STREAM_IDLE_TIMEOUT_MS = 300_000;\n/**\n * Default maximum wait across keepalive-only traffic (SSE comments, `ping` /\n * `keepalive` events, repeated `response.in_progress`) for the next\n * model-progress event on a generic model stream. A provider can keep a\n * connection alive while its generation is wedged; this bounds that case.\n * Ten minutes leaves room for a reasoning model's longest silent thinking\n * window (reasoning summaries stream as progress).\n */\nexport const DEFAULT_MODEL_STREAM_PROGRESS_TIMEOUT_MS = 600_000;\n\nconst envName = /^[A-Za-z_][A-Za-z0-9_]*$/;\nconst registryId = /^[A-Za-z0-9_-]+$/;\n\n// Archive capture claims are also the admission/teardown fence around a\n// provider snapshot. Keep a real settlement window after the provider request;\n// a configured request timeout may never consume the entire durable claim.\nexport const SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS = 60 * 60_000;\nexport const SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS = 10_000;\n// Deadline rotation gives retained legacy commands a bounded stop window\n// before capturing the still-running sandbox's current files.\nexport const SANDBOX_DEADLINE_COMMAND_STOP_GRACE_MS = 120_000;\nexport const SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS =\n  SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS - SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS;\nexport const GOOGLE_DRIVE_PROVIDER_REQUEST_TIMEOUT_MAX_MS = 60_000;\nexport const GOOGLE_DRIVE_PROVIDER_RETRY_DELAY_MAX_MS = 60_000;\n// Admission waits are observational: successful capture/teardown returns as\n// soon as the DB fence clears. This ceiling only covers the unhealthy path. It\n// allows one scheduled inventory and one complete successor claim without\n// turning a recoverable lifecycle transition into a visible caller error. A\n// dead holder's TTL is deliberately NOT included: admission cannot accelerate\n// that proof, and the turn moves to durable recovery if holder quiescence takes\n// longer than this observational wait. The outer cap remains an explicit\n// request-resource boundary; successful transitions return immediately.\nexport const SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS = 60 * 60_000;\nexport const SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS = 10_000;\nconst EnvBoolean = z.preprocess((value) => {\n  if (typeof value !== \"string\") {\n    return value;\n  }\n  const normalized = value.trim().toLowerCase();\n  if ([\"true\", \"1\", \"yes\", \"y\", \"on\"].includes(normalized)) {\n    return true;\n  }\n  if ([\"false\", \"0\", \"no\", \"n\", \"off\"].includes(normalized)) {\n    return false;\n  }\n  return value;\n}, z.boolean());\n\n/** An absolute http(s) URL that is safe to render as a browser link. */\nconst PublicHttpUrl = z\n  .string()\n  .url()\n  .max(2_048)\n  .refine((value) => /^https?:\\/\\//iu.test(value), \"must be an http(s) URL\");\n\nconst EnvGoalIdleBackoffMs = z.preprocess((value) => {\n  if (typeof value !== \"string\") return value;\n  const source = value.trim();\n  if (!source) return undefined;\n  return source.split(\",\").map((entry) => {\n    const trimmed = entry.trim();\n    return trimmed === \"\" ? Number.NaN : Number(trimmed);\n  });\n}, z.array(z.number().int().nonnegative()).min(1, \"OPENGENI_GOAL_IDLE_BACKOFF_MS must list at least one delay in milliseconds\").readonly());\n\n/** Comma-separated Modal region selectors (for example `eu` or\n * `us-east-1,us-west-2`). Blank or unset keeps Modal's own placement. */\nconst EnvModalRegions = z.preprocess(\n  (value) => {\n    if (typeof value !== \"string\") return value;\n    const source = value.trim();\n    if (!source) return undefined;\n    return source.split(\",\").map((entry) => entry.trim().toLowerCase());\n  },\n  z\n    .array(\n      z\n        .string()\n        .regex(\n          /^[a-z][a-z0-9-]{0,62}$/u,\n          \"OPENGENI_MODAL_REGIONS entries must be Modal region names such as eu or us-east-1\",\n        ),\n    )\n    .min(1)\n    .refine((regions) => new Set(regions).size === regions.length, {\n      message: \"OPENGENI_MODAL_REGIONS must not repeat a region\",\n    })\n    .readonly()\n    .optional(),\n);\n\n/** `{\"<workspace id>\": bytes}`: per-workspace retained-image limits. */\nconst EnvRetainedImageWorkspaceQuotaOverrides = z.preprocess(\n  (value) => {\n    if (typeof value !== \"string\") return value;\n    const source = value.trim();\n    if (!source) return undefined;\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(source);\n    } catch {\n      return value;\n    }\n    if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) return parsed;\n    return Object.fromEntries(\n      Object.entries(parsed).map(([workspaceId, bytes]) => [workspaceId.toLowerCase(), bytes]),\n    );\n  },\n  z\n    .record(z.string().uuid(), z.coerce.number().int().positive().max(Number.MAX_SAFE_INTEGER))\n    .default({}),\n);\n\n/** The retained-image byte limit for one workspace: its override, else the deployment default. */\nexport function retainedImageWorkspaceQuotaBytes(\n  settings: Pick<\n    Settings,\n    \"retainedImageWorkspaceQuotaBytes\" | \"retainedImageWorkspaceQuotaOverrides\"\n  >,\n  workspaceId: string,\n): number {\n  return (\n    settings.retainedImageWorkspaceQuotaOverrides[workspaceId.toLowerCase()] ??\n    settings.retainedImageWorkspaceQuotaBytes\n  );\n}\n\nconst EnvFirstPartyMcpTools = z.preprocess(\n  (value) => {\n    if (typeof value !== \"string\") return value;\n    const source = value.trim();\n    if (!source) return undefined;\n    if (source.startsWith(\"[\")) {\n      try {\n        return JSON.parse(source);\n      } catch {\n        return value;\n      }\n    }\n    return source.split(\",\").map((entry) => entry.trim());\n  },\n  z\n    .array(FirstPartyMcpToolName)\n    .superRefine((tools, context) => {\n      const seen = new Set<FirstPartyMcpToolNameType>();\n      for (const [index, tool] of tools.entries()) {\n        if (seen.has(tool)) {\n          context.addIssue({\n            code: \"custom\",\n            message: \"first-party MCP tool lists must not contain duplicates\",\n            path: [index],\n          });\n        }\n        seen.add(tool);\n      }\n    })\n    .optional(),\n);\n\nexport const sandboxPreparationProfiles: Record<string, { env: string[]; hooks: string[] }> = {\n  none: {\n    env: [],\n    hooks: [],\n  },\n  azure: {\n    env: [\n      \"ARM_CLIENT_ID\",\n      \"ARM_CLIENT_SECRET\",\n      \"ARM_TENANT_ID\",\n      \"ARM_SUBSCRIPTION_ID\",\n      \"AZURE_CLIENT_ID\",\n      \"AZURE_CLIENT_SECRET\",\n      \"AZURE_TENANT_ID\",\n      \"AZURE_SUBSCRIPTION_ID\",\n      \"AZURE_AUTHORITY_HOST\",\n    ],\n    hooks: [\"azure-cli-login\"],\n  },\n  github: {\n    env: [\n      \"GH_TOKEN\",\n      \"GITHUB_TOKEN\",\n      \"GIT_AUTHOR_NAME\",\n      \"GIT_AUTHOR_EMAIL\",\n      \"GIT_COMMITTER_NAME\",\n      \"GIT_COMMITTER_EMAIL\",\n    ],\n    hooks: [],\n  },\n};\n\n// Configuration and public session attachments share one authority contract.\nexport const McpServerConnectionRefSchema = PublicMcpServerConnectionRef;\nexport type McpServerConnectionRef = z.infer<typeof McpServerConnectionRefSchema>;\n\n/** Operator-owned protocol binding. Tool annotations cannot establish recovery. */\nexport const McpOperationRecoverySchema = z\n  .record(\n    z.string().min(1).max(512).regex(/^\\S+$/u),\n    z.object({ observerTool: z.string().min(1).max(512).regex(/^\\S+$/u) }).strict(),\n  )\n  .superRefine((bindings, context) => {\n    for (const [originalTool, binding] of Object.entries(bindings)) {\n      if (originalTool === binding.observerTool) {\n        context.addIssue({\n          code: \"custom\",\n          path: [originalTool, \"observerTool\"],\n          message: \"MCP recovery observer must differ from the original tool\",\n        });\n      }\n    }\n  });\n\n/** Public, digest-pinned desktop image used by Modal unless the operator overrides it. */\nexport const DEFAULT_MODAL_IMAGE_REF =\n  \"opengenipublicneuacr.azurecr.io/opengeni-desktop@sha256:5bb54a1a6d0c6e99f058290718e55c13193fde3dcbcb54568ce95ddef0768805\";\n\nconst SettingsSchema = z.object({\n  serviceName: z.string().default(\"opengeni\"),\n  environment: z.string().default(\"local\"),\n  deploymentRevision: z.string().default(\"dev\"),\n  // The release-train version baked into official images (OPENGENI_SERVER_VERSION).\n  // Absent on dev/source builds — consumers must treat it as optional.\n  serverVersion: z.string().optional(),\n  databaseUrl: z.string().default(\"postgres://opengeni:opengeni@127.0.0.1:5432/opengeni\"),\n  // LISTEN needs a session-pinned connection. Direct deployments reuse the\n  // ordinary URL; transaction poolers supply this separate direct endpoint.\n  databaseNotificationUrl: z.string().optional(),\n  // API application pool only. Managed auth owns its separate pool; readiness\n  // reuses the application handle. Keep the historical default for existing\n  // deployments and let operators budget this per process with replica counts.\n  apiDatabasePoolMax: z.coerce.number().int().positive().default(32),\n  // Named prepared statements for the application database pools. Unset → on\n  // for direct connections and off when the URL targets port 6432 (PgBouncer's\n  // port, including Azure Flexible Server's built-in pooler). Set false for any\n  // other transaction-pooling proxy; set true to force them on.\n  databasePreparedStatements: EnvBoolean.optional(),\n  // Step I (§7.8 runtime half). Dedicated Postgres schema for the EMBEDDED\n  // topology. Default \"\" → standalone: no search_path scoping, server default\n  // (`public`). When set (e.g. \"opengeni\"), the db handle + the managed-auth\n  // pool send `search_path = \"<dbSchema>\",\"opengeni_private\",\"public\"` so every\n  // query resolves into the dedicated schema with NO query rewrite (schema-isolation contract F1).\n  dbSchema: z.string().default(\"\"),\n  // Step I (§7.7). RLS posture. \"force\" (default) = today's FORCE-RLS via the\n  // non-owner `opengeni_app` role. \"scoped\" = the embedded owner-role path (the\n  // GUC is still emitted defensively, so the query path is identical).\n  rlsStrategy: z.enum([\"force\", \"scoped\"]).default(\"force\"),\n  // Exact PostgreSQL login identity required by the standalone FORCE-RLS\n  // startup/readiness assertion. Embedded `scoped` hosts own their role model\n  // and are deliberately not constrained to this name.\n  runtimeDatabaseRole: z.string().min(1).default(\"opengeni_app\"),\n  natsUrl: z.string().default(\"nats://127.0.0.1:4222\"),\n  temporalHost: z.string().default(\"127.0.0.1:7233\"),\n  temporalNamespace: z.string().default(\"default\"),\n  temporalTaskQueue: z.string().default(\"opengeni-runs-ts\"),\n  temporalTlsEnabled: EnvBoolean.default(false),\n  temporalApiKey: z.string().optional(),\n  temporalTlsServerName: z.string().optional(),\n  temporalTlsRootCaCertificateBase64: z.string().optional(),\n  temporalTlsClientCertificateBase64: z.string().optional(),\n  temporalTlsClientPrivateKeyBase64: z.string().optional(),\n  startupDependencyRetryAttempts: z.coerce.number().int().positive().default(30),\n  startupDependencyRetryInitialDelayMs: z.coerce.number().int().positive().default(1000),\n  startupDependencyRetryMaxDelayMs: z.coerce.number().int().positive().default(5000),\n  turnWorkerConcurrencyMode: z.enum([\"fixed\", \"resource-based\"]).default(\"fixed\"),\n  turnWorkerMaxConcurrentTurns: z.coerce.number().int().positive().max(2_000).default(16),\n  turnWorkerTargetCpuUsage: z.coerce.number().positive().max(1).default(0.8),\n  turnWorkerTargetMemoryUsage: z.coerce.number().positive().max(0.8).default(0.75),\n  // Admission and emergency recovery are deliberately separate control loops.\n  // The Temporal tuner stops polling at the lower target; only genuine danger\n  // may invoke the disruptive graceful-drain fallback.\n  turnWorkerEmergencyMemoryUsage: z.coerce.number().min(0.85).max(0.95).default(0.9),\n  turnWorkerMemoryGuardIntervalMs: z.coerce.number().int().min(1_000).max(60_000).default(5_000),\n  turnWorkerMemoryGuardSustainMs: z.coerce.number().int().min(5_000).max(300_000).default(30_000),\n  observabilityStructuredLogs: EnvBoolean.default(false),\n  observabilityMetricsEnabled: EnvBoolean.default(true),\n  observabilityOtlpEndpoint: z.string().url().optional(),\n  observabilityOtlpHeaders: z.string().default(\"\"),\n  observabilityDiagnosticsEndpoint: z.string().url().optional(),\n  observabilityDiagnosticsHeaders: z.string().default(\"\"),\n  analyticsEnabled: EnvBoolean.default(false),\n  analyticsConsentRequired: EnvBoolean.default(true),\n  analyticsReoClientId: z\n    .string()\n    .max(128)\n    .regex(/^[A-Za-z0-9_-]+$/u)\n    .optional(),\n  analyticsPosthogProjectKey: z.string().min(1).max(256).optional(),\n  analyticsPosthogHost: z.string().url().max(2_048).optional(),\n  analyticsGa4MeasurementId: z\n    .string()\n    .max(32)\n    .regex(/^G-[A-Z0-9]+$/u)\n    .optional(),\n  // Optional operator-owned legal documents linked from the signed-out console.\n  // Unset by default, so a self-hosted deployment never shows another operator's\n  // policies; the managed service points these at its own published pages.\n  legalPrivacyPolicyUrl: PublicHttpUrl.optional(),\n  legalTermsOfServiceUrl: PublicHttpUrl.optional(),\n  // Optional operator support address, shown as a \"Contact support\" mailto link\n  // on the signed-out page and in the Help menu. Unset by default for the same\n  // reason as the legal links.\n  supportEmail: z.string().trim().email().max(254).optional(),\n  publicBaseUrl: z.string().url().optional(),\n  // Product documentation the web console links from its Help menu. Absent\n  // means the public Opengeni docs; `none` hides the link for deployments that\n  // publish no documentation of their own.\n  documentationUrl: z.preprocess(\n    (value) =>\n      typeof value === \"string\"\n        ? value.trim().toLowerCase() === \"none\"\n          ? null\n          : value.trim()\n        : value,\n    z\n      .url({ protocol: /^https?$/u, error: \"must be an absolute http(s) URL or none\" })\n      .nullable()\n      .default(DEFAULT_OPENGENI_DOCUMENTATION_URL),\n  ),\n  // Standards-based OAuth authorization server for external workspace MCP\n  // clients. Opt-in because it creates a new public authentication surface.\n  mcpOauthEnabled: EnvBoolean.default(false),\n  // Client source address for every API rate limit, abuse quota, and auth\n  // session record (Better Auth, MCP OAuth registration, enrollment, account\n  // setup, login transactions). Forwarded client addresses are ignored by\n  // default so a caller cannot choose its own bucket. Operators may trust an\n  // exact number of proxy hops only when direct access to the API is blocked.\n  apiTrustedProxyHops: z.coerce.number().int().min(0).max(16).default(0),\n  // Optional comma-separated CIDRs (or single addresses) of the proxy that\n  // connects to the API. When set, forwarded client addresses are honored\n  // only for requests whose transport peer is inside one of them.\n  apiTrustedProxyCidrs: z.string().default(\"\"),\n  // Browser origin when the web app and API use separate origins in local\n  // development. Production normally leaves this unset and uses publicBaseUrl.\n  webBaseUrl: z.string().url().optional(),\n  // The Excel add-in people connect workbooks with, as agents name it to them\n  // (\"open the <name> add-in\"), and the page that shows how to add it. A\n  // product that ships its own branded add-in sets both; otherwise agents name\n  // Opengeni's and link this deployment's web app page.\n  officeAddinName: z.string().trim().min(1).max(80).default(\"Opengeni\"),\n  officeAddinInstallUrl: z.string().url().optional(),\n  // The Chrome extension that connects people's own Chrome to their connected\n  // computer, as agents and the chat name it, and where it is installed (its\n  // Chrome Web Store page). A product that ships its own branded build of the\n  // extension sets both; otherwise they name and link Opengeni Browser.\n  browserExtensionName: z.string().trim().min(1).max(80).default(\"Opengeni Browser\"),\n  browserExtensionInstallUrl: z.string().url().startsWith(\"https://\").optional(),\n  // Base URL for the bring-your-own-compute agent release assets the get.<domain>\n  // install routes redirect to. Defaults to this repo's GitHub Releases. The route\n  // appends `/download/agent-v<ver>/<asset>`.\n  agentReleasesBaseUrl: z\n    .string()\n    .url()\n    .default(\"https://github.com/Cloudgeni-ai/opengeni/releases\"),\n  // Explicit operator-controlled promotion pointer for `/agent/latest/*`.\n  // Versioned agent releases are immutable; changing this setting promotes or\n  // rolls back the stable channel without moving or deleting a provider tag.\n  agentStableVersion: z\n    .string()\n    .regex(/^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$/u)\n    .default(\"0.1.54\"),\n  // Optional pin for the desktop app served by /desktop/latest/*. When unset,\n  // the newest desktop-v release on the agent release repository is served.\n  desktopStableVersion: z\n    .string()\n    .regex(/^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$/u)\n    .optional(),\n  // Optional independent beta-channel pointer. When unset, the beta update\n  // manifest route is unavailable rather than silently serving stable.\n  agentBetaVersion: z\n    .string()\n    .regex(/^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$/u)\n    .optional(),\n  // Bring every live Connected Machine to its channel's promoted build without\n  // a click. The agent applies an update only at an idle point, so this never\n  // interrupts accepted work; a busy machine is retried until it can apply.\n  agentAutoUpdate: EnvBoolean.default(true),\n  productAccessMode: ProductAccessMode.default(\"local\"),\n  billingMode: BillingMode.default(\"disabled\"),\n  // Explicit launch gate for the one-time $10 verified self-service signup grant.\n  // A migration or deployment alone must not start issuing live credits.\n  // Legacy pre-0845 money switch; current signup eligibility is unconditional\n  // and zero-valued. Kept for compatibility with existing deployment config.\n  verifiedSignupTrialCreditsEnabled: EnvBoolean.default(false),\n  creditPromotionPolicy: EnvCreditPromotionPolicy,\n  entitlementsMode: EntitlementsMode.default(\"none\"),\n  usageLimitsMode: UsageLimitsMode.default(\"none\"),\n  // Gate new allowance policies until every API/worker in the fleet enforces\n  // them. Persisted-policy enforcement and recovery reads/clears stay active.\n  usageAllowancesEnabled: EnvBoolean.default(false),\n  staticEntitlementsJson: z.string().default(\"{}\"),\n  staticUsageLimitsJson: z.string().default(\"{}\"),\n  delegationSecret: z.string().optional(),\n  defaultFirstPartyMcpTools: EnvFirstPartyMcpTools,\n  allowedFirstPartyMcpTools: EnvFirstPartyMcpTools,\n  // Deployment fact: the isolated artifact materializer workload runs and\n  // drains export jobs. Without it an export is queued forever, so the export\n  // tools leave the first-party ceiling. Helm sets this from\n  // artifactMaterializer.enabled.\n  artifactMaterializerDeployed: EnvBoolean.default(false),\n  // sandbox workspace scoped stream-token HMAC secret (sandbox contract §C.3 / stream-token availability contract).\n  // When unset, the API falls back to `delegationSecret` (the same HMAC envelope\n  // family, `ogs_` vs `ogd_` prefix). REQUIRED-WHEN-DESKTOP, but the absence of\n  // BOTH while sandboxDesktopEnabled=true is a GRACEFUL DEGRADE (DesktopStream\n  // transport:null + a loud boot warning), NOT a hard boot-fail (stream-token availability contract).\n  streamTokenSecret: z.string().optional(),\n  // The desktop input plane (raw stream:control writes) is OFF in v1: even a\n  // holder of stream:control gets 403 until this flips. Keeps stream:control a\n  // declared-but-inert permission so later hardening is a flag flip.\n  streamControlEnabled: EnvBoolean.default(false),\n  // Provider-neutral advisory work discovery rollout. Disabling this keeps\n  // ordinary session listings available while rejecting relevance discovery\n  // and omitting claim evidence from their compact projections.\n  workDiscoveryEnabled: EnvBoolean.default(true),\n  // Exact-attempt claim mutations are independently reversible. Turning this\n  // off removes the first-party mutation tools; durable claims and lifecycle\n  // settlement evidence remain readable.\n  workClaimMutationsEnabled: EnvBoolean.default(true),\n  // Human presentation is a separate rollout stage from the read API. The\n  // topology response carries this decision so clients can hide advisory UI\n  // without inventing authorization or ownership semantics.\n  workDiscoveryHumanAdvisoriesEnabled: EnvBoolean.default(true),\n  // Automatic overlap nudges are deliberately unshipped and default OFF until\n  // an evaluated precision threshold and operator runbook approve them.\n  workDiscoveryAutomaticNudgesEnabled: EnvBoolean.default(false),\n  // Optional release-coherent bootstrap hint for custom rigs/connected machines\n  // that do not carry the stock-image ogtool binary. Exact stable versions only:\n  // the agent must never guess a tag or silently install `latest`.\n  ogtoolPackageSpec: z\n    .string()\n    .regex(/^@opengeni\\/ogtool@(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$/u)\n    .optional(),\n  environmentsEncryptionKey: z.string().optional(),\n  // Dev/seed only: accept the `ops_fake_healthy` / `ops_fake_sync_error`\n  // 1Password tokens, backed by the in-memory fake provider. The managed\n  // product posture refuses to start with it set (OP-7).\n  onePasswordFakeTokens: EnvBoolean.default(false),\n  // Operator-installed official pass-cli; never auto-download or resolve an\n  // agent-controlled executable from PATH. The adapter verifies its version.\n  protonPassCliPath: z\n    .string()\n    .trim()\n    .min(1)\n    .max(1_024)\n    .refine(\n      (value) => value.startsWith(\"/\") || /^[a-z]:[\\\\/]/i.test(value),\n      \"Proton Pass CLI path must be absolute\",\n    )\n    .optional(),\n  integrationsEnabled: EnvBoolean.default(false),\n  integrationsStateSecret: z.string().optional(),\n  integrationsAllowPrivateNetworkTargets: EnvBoolean.default(false),\n  // Privacy limits a deployment (for example a product that embeds Opengeni)\n  // sets for every organization. They only narrow what organizations choose:\n  // Only me chats and schedules off in shared workspaces, new chats and\n  // schedules always starting as Workspace, and admins always seeing that\n  // other people's Only me schedules exist.\n  privacyOnlyMeAllowed: EnvBoolean.default(true),\n  privacyWorkspaceDefaultRequired: EnvBoolean.default(false),\n  privacyAdminScheduleSummariesRequired: EnvBoolean.default(false),\n  integrationsOauthClientsJson: z.string().default(\"{}\"),\n  gmailWatchTopicName: z\n    .string()\n    .regex(/^projects\\/[^/]+\\/topics\\/[^/]+$/u)\n    .optional(),\n  slackClientId: z.string().optional(),\n  slackClientSecret: z.string().optional(),\n  slackSigningSecret: z.string().optional(),\n  // Unlisted apps share Slack’s restricted history/replies quota across all tokens.\n  slackAccessMode: z.enum([\"limited\", \"full\"]).default(\"limited\"),\n  slackBotDisplayName: OpenGeniSlackBotDisplayName.default(\"Opengeni\"),\n  slackCommand: z\n    .string()\n    .trim()\n    .regex(/^\\/[a-z0-9_-]{1,31}$/u)\n    .default(\"/opengeni\"),\n  googleDriveClientId: z.string().optional(),\n  googleDriveClientSecret: z.string().optional(),\n  googleDriveSyncMaxItems: z.coerce.number().int().positive().max(10_000).default(500),\n  googleDriveSyncMaxBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(5_000_000_000)\n    .default(500_000_000),\n  googleDriveSyncMaxFileBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(5_000_000_000)\n    .default(100_000_000),\n  googleDriveSyncMaxProviderRequests: z.coerce.number().int().positive().max(10_000).default(1_000),\n  googleDriveSyncMaxElapsedSeconds: z.coerce.number().int().positive().max(3_600).default(300),\n  googleDriveSyncMaxFailureDetails: z.coerce.number().int().positive().max(100).default(25),\n  googleDriveProviderRequestTimeoutMs: z.coerce\n    .number()\n    .int()\n    .min(1_000)\n    .max(GOOGLE_DRIVE_PROVIDER_REQUEST_TIMEOUT_MAX_MS)\n    .default(30_000),\n  googleDriveProviderRetryAttempts: z.coerce.number().int().min(1).max(5).default(3),\n  googleDriveProviderRetryInitialDelayMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(30_000)\n    .default(250),\n  googleDriveProviderRetryMaxDelayMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(GOOGLE_DRIVE_PROVIDER_RETRY_DELAY_MAX_MS)\n    .default(5_000),\n  googleDriveProviderRetryBudgetMs: z.coerce.number().int().positive().max(120_000).default(15_000),\n  fikenClientId: z.string().optional(),\n  fikenClientSecret: z.string().optional(),\n  googleDriveWorkspaceEventsEnabled: EnvBoolean.optional(),\n  atlassianClientId: z.string().optional(),\n  atlassianClientSecret: z.string().optional(),\n  // Undefined is meaningful: the migration boundary persists the product\n  // default of 3 when no deployment override is supplied.\n  maxNestedAgentDepth: z.coerce.number().int().nonnegative().max(MAX_NESTED_AGENT_DEPTH).optional(),\n  // Operator OAuth apps for first-party social connectors, keyed by provider\n  // id (\"x\", \"reddit\"): {\"x\":{\"clientId\":\"...\",\"clientSecret\":\"...\"}}.\n  socialOauthClientsJson: z.string().default(\"{}\"),\n  // Session goal guard rails. Goals are designed for runs that legitimately\n  // span days, so length is bounded by explicit completion/pause and budget\n  // exhaustion, never by count. goalMaxAutoContinuations is therefore UNSET\n  // by default (no cap); deployments may configure one, and it then acts as a\n  // hard ceiling that per-goal overrides can only lower.\n  goalMaxAutoContinuations: z.coerce.number().int().positive().optional(),\n  // Idle backoff between CONSECUTIVE no-input goal continuations. This is\n  // pacing, not a cap: the first continuation after a turn that consumed any\n  // external input is immediate, the n-th consecutive no-input continuation\n  // waits schedule[min(n - 1, last)] ms after the previous one finished, and\n  // any new input (machine input, human/API prompt, Steer) wakes the session\n  // immediately. The delay never exceeds goalIdleBackoffMaxMs.\n  goalIdleBackoffMs: EnvGoalIdleBackoffMs.default(DEFAULT_GOAL_IDLE_BACKOFF_MS),\n  goalIdleBackoffMaxMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .default(DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS),\n  // Child lifecycle notices: a child session's requires_action freeze, its\n  // resolution, a direct Pause, a provider-capacity wait, and goal progress\n  // become typed `session_system_updates` rows for the parent (in addition to\n  // `child_terminal_result`). Rolling hazard: a pre-notice worker throws on an\n  // unknown update kind, so enable only once the whole fleet runs an image\n  // that understands the new kinds. Once the flag has produced rows, a\n  // pre-notice image must never restart while any new-kind row is still\n  // pending (session_system_updates or session_system_update_outbox); turning\n  // the flag back off stops production but does not drain already committed\n  // rows. Default off. The API and both workers install the validated value\n  // into @opengeni/db once at boot.\n  // Env: OPENGENI_CHILD_LIFECYCLE_NOTICES_ENABLED.\n  childLifecycleNoticesEnabled: EnvBoolean.default(false),\n  // Per-task (root session) API-equivalent usage limits: producer\n  // flag only. Off (default) rejects NEW non-null limits on create and on the\n  // usage-limit route and hides the editor; limits already persisted are still\n  // metered and enforced, and clearing stays allowed. Metering and enforcement\n  // never depend on this flag. Enable only after every API, worker, web, SDK\n  // and embedded host consumer runs an image that understands the\n  // `session_usage_limit` stop and goal reason.\n  // Env: OPENGENI_SESSION_USAGE_LIMITS_ENABLED.\n  sessionUsageLimitsEnabled: EnvBoolean.default(false),\n  // Per-channel and per-DM Slack workspace routing. Default ON. A channel does\n  // not count a personal workspace as a candidate, so an organization with one\n  // shared workspace resolves it as the sole candidate and never asks; the\n  // visible change is confined to organizations that genuinely have more than\n  // one - plus one case worth knowing before an upgrade: a person who has lost\n  // live authority now receives a posted refusal where the pre-routing code\n  // failed silently. Set the env var to `false` to restore the short-circuit\n  // to the installation's own workspace.\n  // Env: OPENGENI_SLACK_WORKSPACE_ROUTING_ENABLED.\n  slackWorkspaceRoutingEnabled: EnvBoolean.default(true),\n  // Per-segment ceiling on agent loop turns (model calls) within a single\n  // session turn. Effectively unbounded by default for the same reason as\n  // above; the graceful max-turns valve (idle + goal continuation, never a\n  // session failure) remains as inert safety should a deployment set a cap.\n  agentMaxModelCallsPerTurn: z.coerce.number().int().positive().default(1_000_000),\n  // Deployment fallback for models that do not declare their own window.\n  // Built-in billed GPT-5.6 Sol/Terra/Luna pin Codex's 272k catalog instead.\n  // Opengeni always performs one durable, portable plaintext compaction\n  // transition; there is no provider/server/off mode ladder.\n  contextWindowTokens: z.coerce.number().int().positive().default(1_050_000),\n  // Optional model-catalog effective input ceiling. Codex and billed GPT-5.6\n  // models expose this as raw context_window * effective_context_window_percent;\n  // when absent, retain the deployment-level window-minus-reserved-output\n  // behavior.\n  contextEffectiveWindowTokens: z.coerce.number().int().positive().optional(),\n  // Proactive compaction threshold as a ratio of the model context window.\n  // Defaults to 90%: compact as late as possible — retained context beats early\n  // headroom now that per-model windows are declared honestly (input-effective,\n  // empirically measured), and the fail-closed reactive compact-on-reject path\n  // absorbs any overshoot as one retried call rather than a dead session.\n  // Clamped to [0.3, 0.9] so deployments can tune the trigger without\n  // accidentally disabling compaction.\n  contextCompactionThresholdRatio: z.coerce\n    .number()\n    .default(0.9)\n    .transform((value) => {\n      if (!Number.isFinite(value)) {\n        return 0.9;\n      }\n      return Math.min(0.9, Math.max(0.3, value));\n    }),\n  // Tokens reserved for model output; subtracted from the window to get the\n  // usable input budget B = contextWindowTokens - contextReservedOutputTokens.\n  contextReservedOutputTokens: z.coerce.number().int().nonnegative().default(128_000),\n  // Model-catalog auto-compact limit. When present it is clamped to\n  // 90% of the raw window, matching Codex core's auto_compact_token_limit().\n  contextAutoCompactThresholdTokens: z.coerce.number().int().positive().optional(),\n  // Provider-neutral fallback for canonical model-facing tool-result text.\n  // The current stable Codex catalog policy is 10k tokens; the truncator adds\n  // Codex's 1.2x JSON serialization allowance when applying it.\n  modelToolOutputTruncationTokens: z.coerce.number().int().positive().default(10_000),\n  authRequired: EnvBoolean.default(false),\n  accessKey: z.string().optional(),\n  authAllowHealth: EnvBoolean.default(true),\n  authAllowMetrics: EnvBoolean.default(false),\n  apiHost: z.string().default(\"0.0.0.0\"),\n  apiPort: z.coerce.number().int().positive().default(8000),\n  // When set, GET /metrics is served only on this dedicated internal listener\n  // and never on the public API port that an ingress forwards to.\n  apiMetricsPort: z.coerce.number().int().positive().optional(),\n  workerHttpPort: z.coerce.number().int().positive().default(8001),\n  // Worker-side first-party MCP traffic stays on the deployment's internal\n  // network. OPENGENI_MCP_URL remains the sandbox/external route used by\n  // Codemode and remote placements.\n  opengeniMcpInternalUrl: z.string().url().optional(),\n  opengeniMcpUrl: z.string().url().optional(),\n  // Origins allowed to send browser cookies cross-origin. Other origins may\n  // call the public API with bearer credentials, but never receive credentialed\n  // CORS responses.\n  corsAllowOriginRegex: z.string().default(String.raw`^https?://(localhost|127\\.0\\.0\\.1)(:\\d+)?$`),\n  // Local development only (`local` access mode in the `local` environment):\n  // extra exact browser origins, comma-separated, that may call the\n  // unauthenticated API besides this stack's own web origin. The local browser\n  // boundary ignores `corsAllowOriginRegex`.\n  localAllowedOrigins: z.string().optional(),\n  openaiProvider: z.enum([\"openai\", \"azure\"]).default(\"openai\"),\n  openaiApiKey: z.string().optional(),\n  openaiBaseUrl: z.string().optional(),\n  openaiModel: z.string().default(\"gpt-6-astra\"),\n  openaiAllowedModels: z.string().default(\"gpt-6-astra,gpt-6-sol,gpt-6-luna\"),\n  // Opengeni-managed Vercel AI Gateway. When configured, the two reviewed\n  // Gateway models below are added to the managed-credit catalog. Workspace\n  // Gateway keys use the encrypted connection broker and never this secret.\n  vercelAiGatewayApiKey: z.string().optional(),\n  /** Image adapter route; native hosted providers ignore this model. */\n  imageGenerationModel: z.string().trim().min(1).max(256).default(\"openai/gpt-image-2\"),\n  /** Durable video generation uses the workspace-owned Gateway credential. */\n  videoGenerationPollIntervalMs: z.coerce.number().int().min(1_000).max(60_000).default(5_000),\n  videoGenerationRecoveryDeadlineMs: z.coerce\n    .number()\n    .int()\n    .min(60_000)\n    .max(24 * 60 * 60_000)\n    .default(2 * 60 * 60_000),\n  videoGenerationReferenceUrlTtlSeconds: z.coerce\n    .number()\n    .int()\n    .min(300)\n    .max(6 * 60 * 60)\n    .default(60 * 60),\n  videoGenerationMaxConcurrentPerWorkspace: z.coerce.number().int().min(1).max(16).default(2),\n  videoGenerationWorkspaceQuotaBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(Number.MAX_SAFE_INTEGER)\n    .default(20 * 1024 * 1024 * 1024),\n  // Bytes of retained session images (screenshots, viewed images) a workspace\n  // keeps. When a new image does not fit, the workspace's oldest images are\n  // evicted to make room; a new image is only refused when it is larger than\n  // the whole limit. The overrides map a workspace id to its own limit.\n  retainedImageWorkspaceQuotaBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(Number.MAX_SAFE_INTEGER)\n    .default(5 * 1024 * 1024 * 1024),\n  retainedImageWorkspaceQuotaOverrides: EnvRetainedImageWorkspaceQuotaOverrides,\n  videoGenerationTempDirectory: z.string().trim().min(1).max(1_024).default(\"/tmp/opengeni-video\"),\n  videoGenerationFfprobePath: z.string().trim().min(1).max(1_024).default(\"ffprobe\"),\n  // Opengeni's customer price, not a claim about the provider's delayed cost report.\n  // The durable operation freezes the exact resulting price before provider submit.\n  videoGenerationCredit480pMicrosPerSecond: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(10_000_000)\n    .default(155_000),\n  videoGenerationCredit720pMicrosPerSecond: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(10_000_000)\n    .default(350_000),\n  // Native composer voice input (browser MediaRecorder → API transcription).\n  // Provider credentials stay server-side; ClientConfig only projects availability\n  // and hard ceilings. Selection happens once before audio is sent — never retry\n  // the same clip across vendors after an upstream request may have started.\n  voiceInputMaxDurationSeconds: z.coerce.number().int().positive().max(600).default(60),\n  voiceInputMaxSizeBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(25 * 1024 * 1024)\n    .default(25 * 1024 * 1024),\n  // Durable long-form capture uploads bounded chunks to object storage, then\n  // normalizes them into provider-safe segments. It is advertised only when\n  // object storage and the configured ffmpeg executable are both available.\n  voiceInputResumableEnabled: EnvBoolean.default(true),\n  voiceInputResumableMaxDurationSeconds: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(8 * 60 * 60)\n    .default(2 * 60 * 60),\n  voiceInputResumableMaxSizeBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(512 * 1024 * 1024)\n    .default(512 * 1024 * 1024),\n  voiceInputResumableMaxChunkSizeBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(25 * 1024 * 1024)\n    .default(8 * 1024 * 1024),\n  /**\n   * Move idle sessions' bulky content to object storage (docs/session-storage-lifecycle.md).\n   * On by default; without object storage the worker skips archiving.\n   */\n  sessionArchiveEnabled: EnvBoolean.default(true),\n  /** Days without a new turn before a session becomes eligible for the archive. */\n  sessionArchiveIdleDays: z.coerce.number().int().min(1).max(3650).default(30),\n  voiceInputResumableRetentionSeconds: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(7 * 24 * 60 * 60)\n    .default(24 * 60 * 60),\n  voiceInputFfmpegPath: z.string().trim().min(1).max(1024).default(\"ffmpeg\"),\n  // Preferred provider order (comma-separated ids). First configured+ready wins.\n  // Connected subscription STT is preferred by default; operators can put\n  // openai/azure-openai first explicitly.\n  // Supported: supergrok-subscription, codex-subscription, openai, azure-openai.\n  voiceInputProviderOrder: z\n    .string()\n    .default(\"supergrok-subscription,codex-subscription,openai,azure-openai\"),\n  // OpenAI public /v1/audio/transcriptions path. Reuses OPENGENI_OPENAI_API_KEY\n  // when voiceInputOpenaiApiKey is unset. Default model is gpt-transcribe.\n  voiceInputOpenaiEnabled: EnvBoolean.default(true),\n  voiceInputOpenaiApiKey: z.string().optional(),\n  voiceInputOpenaiBaseUrl: z.string().optional(),\n  voiceInputOpenaiModel: z.string().default(\"gpt-transcribe\"),\n  // Azure OpenAI deployment-scoped audio transcriptions. Reuses the turn-model\n  // Azure endpoint/key/AD token when voice-specific overrides are unset.\n  voiceInputAzureEnabled: EnvBoolean.default(true),\n  voiceInputAzureEndpoint: z.string().optional(),\n  voiceInputAzureDeployment: z.string().optional(),\n  voiceInputAzureApiVersion: z.string().optional(),\n  voiceInputAzureApiKey: z.string().optional(),\n  voiceInputAzureAdToken: z.string().optional(),\n  // Hosted realtime voice is configured independently of dictation.\n  azureLiveEndpoint: z.string().url().optional(),\n  azureLiveApiKey: z.string().optional(),\n  azureLiveDeployment: z.string().default(\"gpt-live-1\"),\n  azureLiveVoice: z.string().default(\"marin\"),\n  // Credit price of deployment-funded live voice (RealtimeVoicePricing JSON).\n  // Required while credit billing is active, otherwise the model is withheld.\n  azureLivePricingJson: z.string().optional(),\n  // Managed AI Gateway live voice prices keyed by upstream model id.\n  aiGatewayRealtimePricingJson: z.string().optional(),\n  // Azure Speech credentials are explicit: a different resource can host MAI.\n  voiceInputMaiEndpoint: z.string().url().optional(),\n  voiceInputMaiApiKey: z.string().optional(),\n  voiceInputMaiApiVersion: z.string().default(\"2025-10-15\"),\n  voiceInputMaiPricingJson: z.string().optional(),\n  voiceInputMaiModel: z.string().default(\"MAI-Transcribe-2\"),\n  // Underlying model of the Azure deployment (for example gpt-4o-transcribe or\n  // whisper). Azure routes by deployment name, so this only selects built-in\n  // pricing and the provider-reported usage shape (Whisper requests\n  // verbose_json so Azure reports the billed audio duration). Defaults to the\n  // deployment name.\n  voiceInputAzureModel: z.string().trim().min(1).max(256).optional(),\n  // Opengeni credit pricing for deployment-funded voice input (`openai`,\n  // `azure-openai`). JSON VoiceInputPricing; overrides the built-in list price\n  // for the configured model. Validated at boot. When credit billing is active\n  // (OPENGENI_BILLING_MODE=stripe or OPENGENI_USAGE_LIMITS_MODE=managed) a\n  // deployment-funded provider without any pricing is not offered at all.\n  voiceInputOpenaiPricingJson: z.string().optional(),\n  voiceInputAzurePricingJson: z.string().optional(),\n  // Legacy opt-in for undocumented ChatGPT /backend-api/transcribe. When\n  // OPENGENI_CODEX_SUBSCRIPTION_ENABLED is true, Codex STT is included without\n  // this flag. Set false and omit codex-subscription from PROVIDER_ORDER to\n  // keep subscription model routing while disabling Codex voice input.\n  voiceInputCodexExperimentalEnabled: EnvBoolean.default(false),\n  /** Deployment-wide override for every credit price calculated from a provider rate. */\n  creditMarginBpsOverride: z.coerce.number().int().min(0).max(10_000).optional(),\n  modelPricingJson: z.string().default(\"{}\"),\n  // Supported-model membership source. Database mode is resolved by the async\n  // core overlay; getSettings remains synchronous and env-only.\n  modelCatalogSource: z.enum([\"code\", \"database\"]).default(\"code\"),\n  // Deployment-owned workspace-facing price policy. This is deliberately\n  // separate from catalog membership and upstream credential ownership.\n  // Shape: { \"product/model-id\": \"free\" | \"credits\" }.\n  modelCostPolicyJson: z.string().default(\"{}\"),\n  // Optional per-product agent guidance. Database mode replaces this with the\n  // singleton document's validated modelNotes map.\n  modelNotesJson: z.string().default(\"{}\"),\n  // Managed OpenRouter credential. The curated model table is injected in\n  // code/catalog-document resolution and never read from host provider JSON.\n  openrouterApiKey: z.string().optional(),\n  // Managed Opper credential. Like OpenRouter, the reviewed Opper model table\n  // is injected by code/catalog-document resolution, never host provider JSON.\n  opperApiKey: z.string().optional(),\n  // Code-mode host override for the managed provider model lists\n  // (OPENGENI_MANAGED_MODELS_JSON): a partial catalog document carrying any of\n  // `gatewayModels`, `openrouterModels`, `opperModels`, each validated by the\n  // exact database catalog document entry schema. A present key replaces that\n  // provider's reviewed code table; an omitted key keeps it. Read only when\n  // modelCatalogSource is \"code\": database mode ignores it so the singleton\n  // document stays the sole membership authority.\n  managedModelsJson: z.string().optional(),\n  // Internal, secret-free catalog overlays populated only by\n  // applyModelCatalogDocument. They intentionally have no OPENGENI_* env\n  // binding so database mode cannot be bypassed with a second source.\n  resolvedGatewayModelsJson: z.string().optional(),\n  resolvedOpenRouterModelsJson: z.string().optional(),\n  resolvedOpperModelsJson: z.string().optional(),\n  resolvedCodexModelsJson: z.string().optional(),\n  // Extra (non-built-in) model providers, declared by the host as a JSON\n  // provider registry. Each entry carries its own base URL, API key, wire API\n  // (\"responses\" | \"chat\") and the models it exposes. The models a client may\n  // use are the UNION of the built-in provider's allowed models and every\n  // registry provider's models. validateSettings parses this at boot so a\n  // malformed registry / unresolvable key / id collision fails fast.\n  modelProvidersJson: z.string().default(\"[]\"),\n  // Codex (ChatGPT) subscription: when enabled, a per-workspace connected\n  // subscription is injected as a synthetic \"codex-subscription\" registry\n  // provider whose models route through the ChatGPT backend (@opengeni/codex).\n  codexSubscriptionEnabled: EnvBoolean.default(false), // OPENGENI_CODEX_SUBSCRIPTION_ENABLED\n  // Cache the session-independent system-prompt prefix (on by default after an A/B\n  // comparison; set false to disable) separately on Anthropic Messages requests.\n  experimentSystemPromptCacheSplit: EnvBoolean.default(true), // OPENGENI_EXPERIMENT_SYSTEM_PROMPT_CACHE_SPLIT\n  // Honor a model-requested foreground shell wait up to 4 minutes instead of 30\n  // seconds, returning early for quiet servers and input prompts (on by default\n  // after an A/B halved command polls; set false to disable).\n  experimentCutPolling: EnvBoolean.default(true), // OPENGENI_EXPERIMENT_CUT_POLLING\n  // Lean non-strict `exec_command` schema: only `cmd` and `max_output_tokens`\n  // are required (on by default after an A/B; set false to disable).\n  experimentOutputCost: EnvBoolean.default(true), // OPENGENI_EXPERIMENT_OUTPUT_COST\n  // Explicit operator opt-in for active turns to continue using provider extra credits.\n  // Default: re-admit each model request against included subscription usage.\n  // SuperGrok/xAI connected subscription. This is a workspace-scoped OAuth\n  // account pool and a distinct rail from the existing xai/* API-key provider.\n  supergrokSubscriptionEnabled: EnvBoolean.default(false), // OPENGENI_SUPERGROK_SUBSCRIPTION_ENABLED\n  claudeSubscriptionEnabled: EnvBoolean.default(false), // OPENGENI_CLAUDE_SUBSCRIPTION_ENABLED\n  // Maximum silence between complete, valid SuperGrok SSE data events. This is\n  // not a request/run duration cap; every valid event resets the timer.\n  supergrokResponseStreamIdleTimeoutMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(24 * 60 * 60_000)\n    .default(XAI_RESPONSE_STREAM_IDLE_TIMEOUT_MS),\n  // Maximum silence between response bytes on a generic OpenAI-compatible\n  // model stream (built-in OpenAI/Azure and registry chat/responses providers).\n  // Not a request/run duration cap: every received byte resets the timer, and\n  // it measures only time spent waiting on the provider for the next chunk. A\n  // stalled stream fails as a retryable provider failure so finite same-turn\n  // recovery replaces it. A registry provider may override it with\n  // `streamIdleTimeoutMs`. Codex, SuperGrok, and Anthropic Messages own their\n  // transport-specific idle timers.\n  modelStreamIdleTimeoutMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(24 * 60 * 60_000)\n    .default(DEFAULT_MODEL_STREAM_IDLE_TIMEOUT_MS),\n  // Maximum wait across keepalive-only stream traffic for the next\n  // model-progress event (registry override: `streamProgressTimeoutMs`).\n  // Never shorter than modelStreamIdleTimeoutMs.\n  modelStreamProgressTimeoutMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(24 * 60 * 60_000)\n    .default(DEFAULT_MODEL_STREAM_PROGRESS_TIMEOUT_MS),\n  // Expose the connected apps attached to a Codex subscription through the\n  // synthetic codex_apps MCP server. Independent from subscription routing so\n  // operators can use Codex models without exposing ChatGPT connectors.\n  codexConnectedAppsEnabled: EnvBoolean.default(false), // OPENGENI_CODEX_CONNECTED_APPS_ENABLED\n  codexProductSku: z.string().optional(), // OPENGENI_CODEX_PRODUCT_SKU (X-OpenAI-Product-Sku, apps only)\n  // Progressive MCP disclosure (Codex-CLI-style tool_search): on a codex turn,\n  // flag non-eager selected MCP tools `defer_loading:true` (dropping their\n  // schemas from model context) and add one client-executed tool_search tool\n  // that BM25-discloses bounded matches. Only an exact session tool ref with\n  // `eager:true` stays on the startup path; mandatory selection alone does not\n  // imply eagerness. Default ON so selected connector catalogues do not consume\n  // every Codex turn's context. Operators may explicitly disable it for\n  // emergency compatibility diagnosis.\n  // OPENGENI_CODEX_TOOL_SEARCH_ENABLED\n  codexToolSearchEnabled: EnvBoolean.default(true),\n  // Carry Codex subscription model requests over the backend's Responses\n  // WebSocket (one warm connection per conversation) instead of a new HTTP\n  // request per step. Requests the socket cannot carry fall back to HTTP.\n  // OPENGENI_CODEX_RESPONSES_WEBSOCKET_ENABLED\n  codexResponsesWebSocketEnabled: EnvBoolean.default(true),\n  // The same transport for the OpenAI API (/v1/responses) and Azure OpenAI's\n  // v1 API (/openai/v1/responses): one connection per conversation, each step\n  // continuing the previous response with only its new input. Other\n  // OpenAI-compatible hosts always use HTTP.\n  // OPENGENI_OPENAI_RESPONSES_WEBSOCKET_ENABLED\n  openaiResponsesWebSocketEnabled: EnvBoolean.default(true),\n  // Provider-neutral progressive disclosure for direct OpenAI/Azure native\n  // client search and ordinary-function generic dispatch. Kept separate from\n  // the Codex rollout so an emergency Codex opt-out cannot disable every model.\n  // OPENGENI_LAZY_TOOL_SEARCH_ENABLED\n  lazyToolSearchEnabled: EnvBoolean.default(true),\n  // Typed decision-model category, separate from conversational models. Explicit\n  // configuration is shared by tool discovery and code search; no account fallback.\n  decisionModelProvider: z.enum([\"jev\", \"openai\", \"openrouter\"]).optional(),\n  decisionModelId: z.string().trim().min(1).optional(),\n  decisionModelApiKey: z.string().optional(),\n  decisionModelBaseUrl: z.string().url().optional(),\n  // Decision-observability fence. When enabled, the worker emits one\n  // bounded, metadata-only adaptive-policy replay record alongside the unchanged\n  // sticky-sharded decision. It never changes placement/admission/failover.\n  codexFleetPolicyShadowEnabled: EnvBoolean.default(false),\n  // Shared subscription core shadow. After the legacy Codex, Claude or\n  // SuperGrok selection, the worker reads a read-only legacy world and records\n  // content-free metrics comparing the core's decision. Fail-open and bounded by\n  // the timeout; it never changes placement.\n  // OPENGENI_SUBSCRIPTION_CORE_SHADOW_ENABLED, OPENGENI_SUBSCRIPTION_CORE_SHADOW_TIMEOUT_MS\n  subscriptionCoreShadowEnabled: EnvBoolean.default(true),\n  // D-43: dormant until the failover hooks and serving-model notice ship.\n  subscriptionCrossProviderFailoverEnabled: EnvBoolean.default(false),\n  subscriptionCoreShadowTimeoutMs: z.coerce.number().int().min(10).max(1_000).default(250),\n  // Multi-account P3 (auto-rotation): an account is \"near exhaustion\" — ineligible to be\n  // rotated TO — when EITHER usage window (5h/weekly) is at/over this percent. Default 90 to\n  // match the UI danger flip (UsageBar danger at pct >= 90). OPENGENI_CODEX_ROTATION_NEAR_EXHAUSTION_PCT.\n  codexRotationNearExhaustionPct: z.coerce.number().int().min(1).max(100).default(90),\n  reasoningConfigurationUpdatesEnabled: EnvBoolean.default(false),\n  openaiReasoningEffort: ReasoningEffort.default(\"low\"),\n  openaiAllowedReasoningEfforts: z.string().default(\"low,medium,high,xhigh,max\"),\n  // Default for new chats and scheduled tasks when the workspace has an\n  // Opengeni credit balance, no saved workspace default, and no usable\n  // connected subscription, and the deployment default is not already a\n  // credits-billed model. Selected only when this model is selectable in the\n  // workspace catalog; otherwise the first selectable credits model is used.\n  // OPENGENI_CREDITS_DEFAULT_MODEL / OPENGENI_CREDITS_DEFAULT_REASONING_EFFORT.\n  creditsDefaultModel: z\n    .string()\n    .trim()\n    .min(1)\n    .max(256)\n    .refine((value) => !/[\\u000A\\u000D|]/u.test(value), {\n      message: \"credits default model must not contain newlines or the | field separator\",\n    })\n    .default(\"gpt-6-luna\"),\n  // Preferred effort for the credits default. Clamped to the highest effort\n  // the selected model supports at or below this value.\n  creditsDefaultReasoningEffort: ReasoningEffort.default(\"xhigh\"),\n  openaiResponsesTransport: z.enum([\"http\", \"websocket\"]).default(\"http\"),\n  // Provider-assigned item ids (rs_/msg_/fc_…) in Responses API input are\n  // resolved against the provider's server-side response store. That store is\n  // not durable enough to anchor long runs on: a response that streamed fine\n  // can be missing from the store on the very next model call, which then\n  // fails with 400 \"Item with id ... not found\". \"strip\" removes the ids from\n  // every model-call input so requests are self-contained — conversation\n  // truth already lives client-side in session_history_items. \"preserve\"\n  // keeps the SDK's pass-through behavior.\n  openaiProviderItemIds: z.enum([\"strip\", \"preserve\"]).default(\"strip\"),\n  // With ids stripped the provider cannot resolve prior reasoning server-side,\n  // so request reasoning.encrypted_content and send it back with each call:\n  // reasoning continuity without depending on provider-side storage.\n  openaiReasoningEncryptedContent: EnvBoolean.default(true),\n  // Model-call retry budget for transient provider failures (429s and friends).\n  // The openai client default of 2 retries is too small for sustained TPM\n  // backpressure during long autonomous runs.\n  openaiMaxRetries: z.coerce.number().int().nonnegative().default(5),\n  // Native hosted web search. The live Azure Responses path executes the\n  // hosted web_search tool, so this is provider-unconditional: ON by default\n  // on every provider, exposed only so operators can disable it. When true,\n  // buildOpenGeniAgent attaches webSearchTool() to the agent's tools — it is\n  // merged with the MCP-server tools (getAllTools = [...mcpTools, ...tools])\n  // and the sandbox capability tools, never replacing them.\n  webSearchEnabled: EnvBoolean.default(true),\n  // Provider-agnostic web search (`web_search` / `web_fetch` agent tools,\n  // see ./web-search.ts). Inert until a provider and its key are set; validated\n  // lazily so a misconfiguration withholds the tools instead of failing boot.\n  webSearchProvider: z.string().optional(),\n  webFetchProvider: z.string().optional(),\n  webSearchPrefer: z.string().optional(),\n  webSearchProviderCredentials: WebSearchProviderCredentialsSchema,\n  // Earlier single-provider settings, applied to the first provider of a slot.\n  webSearchApiKey: z.string().optional(),\n  webSearchBaseUrl: z.string().optional(),\n  webFetchApiKey: z.string().optional(),\n  webFetchBaseUrl: z.string().optional(),\n  webSearchProviderMode: z.string().optional(),\n  webSearchPricingJson: z.string().optional(),\n  webSearchRequestTimeoutMs: z.coerce.number().int().positive().max(120_000).default(20_000),\n  // Jev (TypeSafe's fast judge model) for worker-side agent tools. Without a\n  // usable key every Jev-backed feature is off. The key stays on the server\n  // (API and worker) and never reaches a sandbox or Connected Machine.\n  jevApiKey: z.string().optional(),\n  jevBaseUrl: z.string().url().default(\"https://api.typesafe.ai\"),\n  jevModel: z.string().trim().min(1).max(128).default(\"jev-latest\"),\n  jevRequestTimeoutMs: z.coerce.number().int().positive().max(120_000).default(10_000),\n  // Jev-backed `code_search` agent tool. `off` never offers it, `opt_in` offers\n  // it only where workspace settings enable it, `default_on` offers it\n  // everywhere except workspaces that disable it, and `experiment` gives it to\n  // a fixed half of sessions in workspaces without their own setting, for\n  // comparison. It also needs jevApiKey.\n  codeSearchMode: z.enum([\"off\", \"opt_in\", \"default_on\", \"experiment\"]).default(\"off\"),\n  // Deployment-default agent persona template (the white-label surface). The\n  // runtime resolves the effective template per turn as\n  // per-session-override > per-workspace override > this default, substitutes\n  // the non-bypassable CORE at AGENT_INSTRUCTIONS_CORE_PLACEHOLDER (or appends\n  // it when the template omits the marker), and uses the result as the agent's\n  // instructions. Defaulting to DEFAULT_AGENT_INSTRUCTIONS keeps the composed\n  // default pinned by runtime tests.\n  agentInstructionsTemplate: z.string().default(DEFAULT_AGENT_INSTRUCTIONS),\n  deploymentAgentInstructions: z.string().optional(),\n  // Knowledge retrieval, correction and standing-preference guidance (on by default after the\n  // instruction-following A/B; set false to disable).\n  experimentKnowledgeRetrievalGuidance: EnvBoolean.default(true), // OPENGENI_EXPERIMENT_KNOWLEDGE_RETRIEVAL_GUIDANCE\n  azureOpenaiBaseUrl: z.string().optional(),\n  azureOpenaiEndpoint: z.string().optional(),\n  azureOpenaiDeployment: z.string().optional(),\n  azureOpenaiApiVersion: z.string().optional(),\n  azureOpenaiApiKey: z.string().optional(),\n  azureOpenaiAdToken: z.string().optional(),\n  disableOpenaiTracing: EnvBoolean.default(false),\n  sandboxBackend: SandboxBackend.default(\"docker\"),\n  dockerImage: z.string().default(\"opengeni-sandbox:local\"),\n  // Explicit deployment contract: the configured base sandbox image contains\n  // the verified, self-contained native artifact runtime at its fixed image\n  // paths. Disabled by default so arbitrary/custom provider images never make\n  // document/spreadsheet/presentation skills appear when their runtime is\n\n  // when this base-image contract is enabled.\n  sandboxArtifactRuntimeEnabled: EnvBoolean.default(false),\n  dockerExposedPorts: z.string().default(\"\"),\n  dockerNetwork: z.string().optional(),\n  // When the worker itself runs in a container and talks to a host Docker daemon,\n  // this directory must be bind-mounted at the exact same absolute path on both\n  // sides. The Agents SDK materializes the workspace here before bind-mounting it\n  // into the sandbox container.\n  dockerWorkspaceBaseDir: z.string().min(1).optional(),\n  modalAppName: z.string().default(\"opengeni-sandbox\"),\n  modalImageRef: z.string().optional(),\n  // Activate only after descriptor-aware readers, DB fences and the exact\n  // native image have passed the supervised-command rollout canary.\n  modalCommandSupervisionEnabled: EnvBoolean.default(false),\n  // Provider-native immutable Modal image ID for the exact logical\n  // `modalImageRef`. When set, the runtime uses ModalImageSelector.fromId and\n  // never asks Modal to parse or import the registry ref. The logical ref is\n  // still persisted on the sandbox lease for provenance and conflict fencing;\n  // the Modal session envelope persists the actual image ID.\n  modalImageId: z\n    .string()\n    // Modal image IDs are provider-opaque. Older builds use a 22-character\n    // random suffix while current filesystem snapshots use a 26-character\n    // ULID suffix. Validate the stable namespace/safe alphabet and let Modal\n    // remain authoritative over current/future suffix lengths.\n    .min(4)\n    .max(128)\n    .regex(/^im-[A-Za-z0-9]+$/)\n    .optional(),\n  // Name of a Modal Secret (containing REGISTRY_USERNAME + REGISTRY_PASSWORD) used\n  // to authenticate the pull of `modalImageRef` from a PRIVATE registry. When UNSET\n  // (the default), the sandbox image is pulled UNAUTHENTICATED — i.e. it must be a\n  // PUBLIC registry tag, which is the only shape the Agents-extension Modal backend\n  // supports out of the box (`Image.fromRegistry(tag)` with no secret). Set this to\n  // run a private image (e.g. a cloud-hosted ACR/ECR/GCR digest): the runtime resolves\n  // the named Secret and builds the image via `fromRegistry(tag, secret)` before the\n  // first sandbox is created. Knob: OPENGENI_MODAL_IMAGE_REGISTRY_SECRET.\n  modalImageRegistrySecret: z.string().optional(),\n  // Modal's hard sandbox lifetime (timeoutMs = this * 1000), counted from box\n  // creation. A resume-by-id does NOT reset that provider clock. It is the\n  // BACKSTOP that reclaims a box if the reaper/worker is down, NOT the warm-window\n  // controller (that's sandboxIdleGraceMs). It must comfortably exceed\n  // reaperPeriod + idleGrace so the reaper terminates a genuinely-idle box FIRST;\n  // the boot invariant below enforces that. Default 24h, Modal's documented\n  // maximum, to reduce premature active-box loss and leave headroom for the\n  // deadline-aware snapshot/rematerialization transition. The transition—not a\n  // larger timeout—is what lets a session outlive one finite provider box.\n  // Knob: OPENGENI_MODAL_TIMEOUT_SECONDS.\n  modalTimeoutSeconds: z.coerce.number().int().positive().max(86_400).default(86_400),\n  // Optional provider reservations for every new Modal sandbox. CPU is measured\n  // in physical cores and may be fractional; memory is measured in MiB. Leave\n  // both unset to preserve Modal's provider defaults. The Agents adapter stores\n  // the resolved values in its session state so snapshot replacement and exact\n  // resume cannot silently change the reservation.\n  modalSandboxCpu: z.coerce.number().positive().optional(),\n  modalSandboxMemoryMiB: z.coerce.number().int().positive().optional(),\n  // Optional Modal placement for every new physical box (fresh create and\n  // snapshot restore alike). Every setup step and tool call is a round trip from\n  // the worker to the box, so placing boxes near the workers cuts per-command\n  // latency; Modal bills region selection as a compute multiplier. Existing\n  // boxes keep their placement on resume. Knob: OPENGENI_MODAL_REGIONS.\n  modalRegions: EnvModalRegions,\n  modalTokenId: z.string().optional(),\n  modalTokenSecret: z.string().optional(),\n  modalEnvironment: z.string().optional(),\n  // modal gap-fill: idleTimeoutMs + workspacePersistence were unmapped (module 03 §4.1).\n  //\n  // CRITICAL (sandbox-file-persistence): when this is UNSET the Modal SDK sends\n  // idleTimeoutSecs=undefined, so Modal applies its OWN short server-default idle\n  // timeout (~minutes) — and a box between turns sits with NO active connection,\n  // so that idle clock runs and Modal idle-reaps the box LONG before Opengeni's\n  // own reaper waits out sandboxIdleGraceMs to resume+persist+terminate\n  // it. The observed failure: every drain logs \"drainable box already gone\n  // (NotFound on resume)\", persistWorkspace() never fires, /workspace is lost.\n  // Modal's idle-reap is a SECOND reaper racing Opengeni's — and it wins. The fix:\n  // Opengeni OWNS box lifecycle via its reaper + the hard modalTimeoutSeconds\n  // backstop, so the Modal idle-reap must NOT fire first. We default the effective\n  // idle timeout to the hard lifetime (effectiveModalIdleTimeoutSeconds), making\n  // the box survive its full warm window so the reaper can snapshot it. Set this\n  // explicitly (OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS) only to deliberately idle-reap\n  // SOONER than the hard lifetime; the boot invariant forbids a value that would\n  // reap before reaperPeriod + idleGrace elapses.\n  modalIdleTimeoutSeconds: z.coerce.number().int().positive().optional(),\n  // /workspace FILE PERSISTENCE across warm/cold cycles. Directory snapshots\n  // preserve only the durable user workspace, so provider recovery does not\n  // restore an entire machine image or replace the selected rig/base image.\n  // Cold restore derives the mode from its verified native artifact, so existing\n  // serialized sessions remain recoverable; this default governs archive-free\n  // Modal creations only.\n  // `snapshot_filesystem` remains available for explicit compatibility and\n  // immutable rig-image materialization. `tar` is the portable fallback.\n  modalWorkspacePersistence: z\n    .enum([\"tar\", \"snapshot_filesystem\", \"snapshot_directory\"])\n    .default(\"snapshot_directory\"),\n  // Shared desktop toggle: this module reads it for the 6080 port-merge; the\n  // owner module (P4.x) acts on it to launch the display stack.\n  sandboxDesktopEnabled: EnvBoolean.default(false),\n  // Human sandbox input policy. Canonical ComputerSession attachments reflect\n  // it and /actions enforces it independently of the client. The legacy\n  // DesktopStream adapter also reports read-only when disabled. Agent tools\n  // retain their separate session-control authority.\n  sandboxDesktopInteractive: EnvBoolean.default(true),\n  // REAL PTY terminal toggle (P5.t): gates the ttyd pty-ws plane (7681) the API\n  // mints over the SAME tunnel as the desktop. Defaults ON — the interactive\n  // terminal is a baseline structured-service surface (unlike the heavier desktop\n  // pixel plane); a deployment can turn it off to fall back to the read-only\n  // sse-events command firehose. The 7681 port-merge tracks sandboxDesktopEnabled\n  // (a desktop-capable image is the one that bakes ttyd).\n  sandboxTerminalEnabled: EnvBoolean.default(true),\n  // The desktop framebuffer geometry the pixel plane advertises + launches the\n  // display stack with (P4.2). v1 has no live RANDR resize; a change is a full\n  // down→up restart. Defaults match the proven spike geometry (1280x800).\n  streamResolutionWidth: z.coerce.number().int().positive().default(1280),\n  streamResolutionHeight: z.coerce.number().int().positive().default(800),\n  // Recording loop: ffmpeg x11grab of :0 → mp4/webm → @opengeni/storage.\n  // recordingMaxBytes caps the in-memory finalize buffer (≤ storage single-PUT);\n  // recordingMaxSeconds is the ffmpeg -t hard ceiling (bounds a multi-day turn).\n  recordingEnabled: EnvBoolean.default(true),\n  recordingDefaultCodec: z.enum([\"h264-mp4\", \"vp9-webm\"]).default(\"h264-mp4\"),\n  // Workbench v2 turn-end workspace capture. When on, the turn\n  // activity probes the box's changed files off the live box at turn end and\n  // persists a capture revision (blobs in @opengeni/storage) so the workbench\n  // paints cold/offline sessions with zero machine round-trips. Best-effort and\n  // fully behind this flag: off ⇒ capture is skipped and reads fall back to the\n  // live/wake path (status-quo behavior). Default on; explicit per environment.\n  workspaceCaptureEnabled: EnvBoolean.default(true),\n  recordingFramerate: z.coerce.number().int().positive().default(15),\n  recordingMaxSeconds: z.coerce.number().int().positive().default(600),\n  recordingMaxBytes: z.coerce.number().int().positive().default(268_435_456), // 256 MB\n  // --- daytona ---\n  daytonaApiKey: z.string().optional(),\n  daytonaApiUrl: z.string().url().optional(),\n  daytonaTarget: z.string().optional(),\n  daytonaImage: z.string().optional(),\n  daytonaSnapshotName: z.string().optional(),\n  daytonaAutoStopInterval: z.coerce.number().int().nonnegative().optional(), // 0 disables idle-kill\n  daytonaTimeoutSeconds: z.coerce.number().int().positive().optional(),\n  daytonaExposedPortUrlTtlSeconds: z.coerce.number().int().positive().optional(),\n  // --- runloop ---\n  runloopApiKey: z.string().optional(),\n  runloopBaseUrl: z.string().url().optional(),\n  runloopBlueprintName: z.string().optional(),\n  runloopBlueprintId: z.string().optional(),\n  runloopTunnel: EnvBoolean.default(true),\n  runloopKeepAliveSeconds: z.coerce.number().int().positive().optional(),\n  // --- e2b: E2B's cloud or any E2B-compatible API ---\n  // The key, domain and addresses are handed to the SDK explicitly on every\n  // create and resume; unset ones keep the SDK's defaults (E2B's cloud).\n  e2bApiKey: z.string().optional(),\n  // Sandboxes are reached as `<port>-<sandbox id>.<domain>`; the API is\n  // `https://api.<domain>` unless e2bApiUrl is set.\n  e2bDomain: z\n    .string()\n    .regex(/^[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?(?::\\d{1,5})?$/, {\n      message: \"must be a host name such as sandboxes.example.com, without a scheme or path\",\n    })\n    .optional(),\n  e2bApiUrl: z.string().url().optional(),\n  // One address for all envd traffic, routed by the E2b-Sandbox-Id and\n  // E2b-Sandbox-Port headers, instead of a name per sandbox.\n  e2bSandboxUrl: z.string().url().optional(),\n  e2bTemplate: z.string().optional(),\n  e2bTimeoutSeconds: z.coerce.number().int().positive().optional(),\n  e2bTimeoutAction: z.enum([\"pause\", \"kill\"]).optional(),\n  e2bAllowInternetAccess: EnvBoolean.optional(),\n  e2bAutoResume: EnvBoolean.optional(),\n  e2bWorkspacePersistence: z.enum([\"tar\", \"snapshot\"]).optional(),\n  // --- blaxel ---\n  blaxelApiKey: z.string().optional(),\n  blaxelImage: z.string().optional(),\n  blaxelRegion: z.string().optional(),\n  blaxelExposedPortPublic: EnvBoolean.optional(), // public vs bl_preview_token\n  blaxelExposedPortUrlTtlSeconds: z.coerce.number().int().positive().optional(),\n  blaxelMemoryMb: z.coerce.number().int().positive().optional(),\n  blaxelTtl: z.string().optional(),\n  // --- cloudflare (headless) ---\n  cloudflareWorkerUrl: z.string().url().optional(),\n  cloudflareApiKey: z.string().optional(),\n  experimentalBrowserContextPoolEnabled: EnvBoolean.default(false),\n  // --- remote browser placements ---\n  // Provider credentials are injected only into the placement-resident\n  // browserd launch. They never enter session contracts, journals, or sandboxes.\n  browserbaseApiKey: z.string().min(1).max(8192).optional(),\n  kernelApiKey: z.string().min(1).max(8192).optional(),\n  kernelEndpoint: z.string().url().optional(),\n  kernelBrowserTimeoutSeconds: z.coerce.number().int().positive().max(86_400).default(3_600),\n  kernelBrowserStealth: EnvBoolean.default(false),\n  // --- vercel (headless) ---\n  vercelToken: z.string().optional(),\n  vercelProjectId: z.string().optional(),\n  vercelTeamId: z.string().optional(),\n  vercelRuntime: z.string().optional(),\n  // --- OpenSandbox (optional Kubernetes-native provisioned sandbox) ---\n  openSandboxBaseUrl: z.string().url().optional(),\n  openSandboxApiKey: z.string().min(1).optional(),\n  // Release and preview profiles must provide an immutable OCI digest. The\n  // adapter refuses tag-only references when this backend is active.\n  openSandboxImage: z.string().min(1).optional(),\n  // Renewable provider TTL is a leak/backstop clock, not Opengeni's idle\n  // policy. The pinned server accepts a one-minute minimum; ordinary\n  // deployments default to one hour.\n  openSandboxTtlSeconds: z.coerce.number().int().min(60).max(86_400).default(3_600),\n  openSandboxUseServerProxy: EnvBoolean.default(true),\n  // Channel B (browserd / noVNC / ttyd) uses OSEP-0011 signed URI-mode ingress.\n  // Exec/files stay on the private lifecycle server-proxy regardless of this flag.\n  openSandboxSignedEndpoints: EnvBoolean.default(false),\n  openSandboxSignedEndpointTtlSeconds: z.coerce.number().int().min(60).max(3_600).default(600),\n  openSandboxChannelBPublicBaseUrl: z.string().url().optional(),\n  // Emergency hatch only: force JPEG/RFB through the API frame-proxy even when\n  // signed endpoints are on (M2 subprotocol failure). Unset means OpenSandbox\n  // uses the frame-proxy unless signed endpoints are on.\n  openSandboxInteractionFrameProxy: EnvBoolean.optional(),\n  openSandboxPoolRef: z\n    .string()\n    .regex(/^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/)\n    .optional(),\n  // Optional same-cluster, read-only observability projection. The application\n  // chart sets this only on the control worker and mounts a dedicated projected\n  // service-account token; non-Kubernetes and remote-provider deployments omit it.\n  openSandboxKubernetesInventoryNamespace: z\n    .string()\n    .min(1)\n    .max(63)\n    .regex(/^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/)\n    .optional(),\n  // --- Opengeni compute (optional; Opengeni's own microVM sandboxes) ---\n  // Every compute sandbox runs the Connected Machine agent, reached through\n  // its host's link to this API's agent gateway, so this backend also needs\n  // the relay and the agent op-stream. Nothing here is read unless a session\n  // or the deployment selects `compute`, or the gateway URL is set.\n  computeApiUrl: z.string().url().optional(),\n  computeApiKey: z.string().min(1).max(8192).optional(),\n  // Compute image refs. Omitted, the control service's default image. The desktop image is\n  // used when OPENGENI_SANDBOX_DESKTOP_ENABLED=true and carries the display stack.\n  computeImage: z.string().min(1).max(2048).optional(),\n  computeDesktopImage: z.string().min(1).max(2048).optional(),\n  computeVcpus: z.coerce.number().int().min(1).max(64).default(2),\n  computeMemoryMib: z.coerce.number().int().min(512).max(262_144).default(4096),\n  // Guaranteed shares below the ceilings above; omitted, the whole ceiling.\n  computeMemoryRequestMib: z.coerce.number().int().min(128).max(262_144).optional(),\n  computeCpuRequestMillis: z.coerce.number().int().min(10).max(64_000).optional(),\n  // The agent gateway's public WebSocket URL (wss://). Compute hosts dial it,\n  // and it is the exact audience of their host tokens and sandbox tickets, so\n  // it must equal the URL the control service is configured with for Opengeni's team.\n  // This API serves the gateway at its path.\n  computeLinkUrl: z.string().url().optional(),\n  // How long a create waits for the sandbox's agent to connect, and how long\n  // a request to an unreachable sandbox keeps waking and retrying it.\n  computeAgentReadyTimeoutMs: z.coerce.number().int().min(1_000).max(900_000).default(120_000),\n  // --- sandbox ownership inversion (P1.2 rollout flag, default OFF) ---\n  // The keystone flag for the stateless resume-by-id model. When FALSE the\n  // agent-turn path is BYTE-FOR-BYTE today's build-and-discard behavior (no\n  // lease acquire, no resume-by-id, no non-owned injection). When TRUE the turn\n  // activity acquires the group lease, resumes the one box by id from the lease\n  // envelope, injects it as a NON-OWNED RunConfig session (the SDK never reaps\n  // it — the proven keystone), and releases the holder in finally. Uses\n  // EnvBoolean (NOT z.coerce.boolean(), which would coerce \"false\" -> true and\n  // turn the flag ON the moment anyone set the env var to disable it).\n  sandboxOwnershipEnabled: EnvBoolean.default(false),\n  // --- standalone rig-verifier ownership rollout flag, default OFF ---\n  // Rig verification creates a throwaway provider sandbox outside the normal\n  // session-turn path. When enabled, that sandbox must first acquire the same\n  // durable lease lifecycle used by session boxes so the global orphan sweep\n  // recognizes its exact provider instance. Keep this separate from the general\n  // sandboxOwnershipEnabled rollout: every reaper worker must understand verifier\n  // leases before dispatch is enabled. When false the verifier fails closed before\n  // provider create; it never falls back to the legacy unowned path.\n  rigVerificationLeaseOwnershipEnabled: EnvBoolean.default(false),\n  // --- lazy sandbox provisioning rollout flag, default OFF ---\n  // Only effective when sandboxOwnershipEnabled is ALSO on (lazy provisioning is a\n  // property of the owned path — the SDK never creates/resumes an injected session,\n  // so we control when the box is established). When TRUE, a turn does NOT provision\n  // its box at turn start: the lease acquire + resume-by-id + hooks + downloads +\n  // heartbeat + recording are deferred to an in-process single-flight provisioner\n  // that runs the FIRST time a sandbox op is dispatched (via the routing proxy's\n  // resolveActiveBackend). A turn whose model never calls a sandbox-backed tool ends\n  // with NO lease row and ZERO warm-seconds. When FALSE (or ownership off) the turn\n  // provisions eagerly exactly as today — byte-for-byte. EnvBoolean (NOT\n  // z.coerce.boolean(), which coerces \"false\" -> true and would turn the flag ON the\n  // moment anyone set the env var to disable it).\n  sandboxLazyProvisionEnabled: EnvBoolean.default(false),\n  // --- bring-your-own-compute (selfhosted 11th backend) rollout flag, default OFF ---\n  // The keystone flag for the whole selfhosted feature (the enrollment device-flow,\n  // the NATS control plane, the relay stream tier). When FALSE the enrollment routes\n  // 404 (invisible — the surface does not exist for this deployment) and the\n  // selfhosted backend is inert; boot is unaffected. EnvBoolean (NOT\n  // z.coerce.boolean(), which coerces \"false\" -> true). Flipped per-environment via\n  // the deploy-staging IaC secret/configmap pattern.\n  sandboxSelfhostedEnabled: EnvBoolean.default(false),\n  // Gates the op-stream (streaming exec) transport to Connected Machines. The\n  // runner must ALSO advertise Capabilities.op_stream. Streaming is the default\n  // because it is the only transport that can keep a command alive without an\n  // arbitrary request/reply wall while still supporting replay and cancellation.\n  // Exec fails closed when the deployment or runner does not provide op-stream.\n  // EnvBoolean (NOT\n  // z.coerce.boolean(), which coerces \"false\" -> true).\n  agentOpStreamEnabled: EnvBoolean.default(true),\n  // The HMAC secret the control plane signs the enrollment bearer credential with\n  // (the `oge_` envelope the agent presents back to the control plane). Optional:\n  // when ABSENT and sandboxSelfhostedEnabled is on, the poll route reports the\n  // credential plane disabled (graceful degrade, mirrors streamTokenSecret). NEVER\n  // logged. Lives in the opengeni-runtime secret (Helm-clobbered configmap avoided).\n  enrollmentSigningSecret: z.string().optional(),\n  // Connect-info the EnrollmentCredentials hand the agent: the NATS server URL(s)\n  // the agent dials for the control plane, and the relay edge base URL for streams.\n  // The per-workspace NATS Account creds binding is infra-deferred (M4/relay\n  // milestone) — the poll returns these endpoints + a placeholder creds field.\n  selfhostedNatsUrl: z.string().optional(),\n  selfhostedRelayUrl: z.string().optional(),\n  // The HMAC secret the control plane signs the agent's relay PRODUCER token with\n  // (the `ogr_` envelope threaded into EnrollmentCredentials.relayToken; M8b/design\n  // §10.5). The relay verifies the producer token with the SAME secret. Optional:\n  // when ABSENT the poll returns an empty relayToken (graceful degrade — the stream\n  // plane is simply unavailable until configured). Falls back to streamTokenSecret /\n  // delegationSecret (same HMAC family) so a deployment with a stream-token secret\n  // needs no second one. NEVER logged. Lives in the opengeni-runtime secret.\n  selfhostedRelayTokenSecret: z.string().optional(),\n  // The minisign PUBLIC key the agent pins for self-update verification (handed to\n  // the agent in EnrollmentCredentials; the SECRET key lives only in CI).\n  agentUpdatePublicKey: z.string().optional(),\n  // --- NATS auth-callout tenancy boundary (bring-your-own-compute M-AUTH; design\n  //     §10.1 NATS Accounts per workspace + §17 the isolation smoke) -------------\n  // nats-server is configured with AUTH CALLOUT: an external agent connects\n  // presenting its `oge_` enrollment bearer as the connect auth-token; the server\n  // issues an authorization request on $SYS.REQ.USER.AUTH to our responder, which\n  // validates the bearer, claims one daemon generation, and returns a SIGNED NATS\n  // user JWT scoped to that exact process subtree (+ `_INBOX.>`). The exact scope\n  // provides both workspace isolation and single-daemon routing authority. These\n  // are deployment-level secrets in the opengeni-runtime secret\n  // (Helm-clobbered configmap avoided), all OPTIONAL: when the callout plane is not\n  // configured the responder simply does not start (selfhosted agents cannot\n  // connect — graceful, never a boot-fail).\n  //\n  // The callout account SIGNING SEED (`SA...`). Both the user JWT and the\n  // authorization-response JWT are signed by this account key; its public key\n  // (`A...`) is the `auth_callout.issuer` in the server config. NEVER logged.\n  selfhostedNatsCalloutAccountSeed: z.string().optional(),\n  // The TARGET ACCOUNT NAME the minted user is placed into (the server-config-mode\n  // `auth_callout.account`, e.g. \"APP\"). The responder writes it as the minted user\n  // JWT `aud` so nats-server binds the agent to this account — the SAME account the\n  // privileged control plane connects into, so exact process request/reply\n  // routes. Optional; resolveNatsCalloutConfig defaults it to \"APP\".\n  selfhostedNatsCalloutAccountName: z.string().optional(),\n  // The callout RESPONDER's own NATS login (one of the `auth_callout.auth_users`\n  // in the AUTH account) — the responder connects with this to subscribe\n  // $SYS.REQ.USER.AUTH. Username/password.\n  selfhostedNatsCalloutUser: z.string().optional(),\n  selfhostedNatsCalloutPassword: z.string().optional(),\n  // The PRIVILEGED control-plane login (api/worker): a static account user that may\n  // request exact process RPC subjects + receive their inbox replies. The event bus + the\n  // selfhosted control RPC ride THIS connection. Username/password; when unset the\n  // bus connects anonymously (local dev / a NATS with no auth_callout).\n  selfhostedNatsControlUser: z.string().optional(),\n  selfhostedNatsControlPassword: z.string().optional(),\n  // --- selfhosted (Connected Machine) control/exec op deadlines ---------------\n  // CONTROL ops (ping / fs / git / desktop / pty) keep a short request timeout so\n  // liveness failures surface promptly. EXEC duration is a different concern: by\n  // default it is unbounded (0), exactly like a command launched by an unrestricted\n  // local agent. The op-stream transport keeps control liveness, replay, and explicit\n  // cancellation independent of command duration. A deployment may opt into a hard\n  // process deadline by setting a positive value; 0 never schedules a process kill.\n  // Knobs: OPENGENI_SANDBOX_SELFHOSTED_EXEC_TIMEOUT_MS (default 0 = none) and\n  // OPENGENI_SANDBOX_SELFHOSTED_CONTROL_TIMEOUT_MS (default 30s).\n  sandboxSelfhostedExecTimeoutMs: z.coerce.number().int().nonnegative().default(0),\n  sandboxSelfhostedControlTimeoutMs: z.coerce.number().int().positive().default(30_000),\n  // --- sandbox lease cadences (cadence invariant validated at boot below) ---\n  // reaperPeriod < viewerHolderTTL, and reaperPeriod + idleGrace < the EFFECTIVE\n  // box idle timeout (effectiveModalIdleTimeoutSeconds, which defaults to the hard\n  // modalTimeoutSeconds). No keep-alive loop: between turns the box survives on its\n  // idle timeout — which we pin high enough (via the idle-timeout default) that\n  // Opengeni's reaper, not Modal's idle-reap, governs teardown so /workspace is\n  // snapshotted before the box dies (sandbox-file-persistence).\n  sandboxLeaseReaperPeriodMs: z.coerce.number().int().positive().default(30_000),\n  sandboxViewerHolderTtlMs: z.coerce.number().int().positive().default(90_000),\n  // A BrowserSession controller refreshes its durable resource and exact\n  // interaction lease holder together. This longer crash horizon tolerates API\n  // replacement while still releasing a placement whose controller died.\n  sandboxInteractionHolderTtlMs: z.coerce.number().int().positive().default(180_000),\n  // The DRAIN grace: how long a refcount-0 (draining) lease stays WARM before the\n  // reaper resume-by-ids the box and terminates it. This is the cost-vs-snappiness\n  // dial — when the user navigates away the box keeps refcount 0, but it survives\n  // this whole window so a \"glanced away then came back\" re-arms the SAME warm box\n  // (acquireLease re-arms draining->warm; the reaper's BEFORE-terminate re-read\n  // skips a re-armed box). Default 1min: a box restores from its workspace\n  // snapshot when the next turn comes later, so a long warm tail mostly bills an\n  // idle box. Raise it to trade warm cost for warm resumes after longer pauses.\n  // getSettings caps the default at half a shorter configured Modal lifetime so\n  // the entire reaper window always fits. Knob: OPENGENI_SANDBOX_IDLE_GRACE_MS.\n  sandboxIdleGraceMs: z.coerce.number().int().positive().default(60_000),\n  // Idle command containment. A legacy retained background command (a dev\n  // server, a command whose output is still draining, a stopped command the\n  // provider no longer answers for) keeps its box warm through a non-expiring\n  // process holder, so the zero-holder drain never runs and the box would stay\n  // up until the provider deadline kills it uncaptured. Once every session of\n  // the sandbox group has been unused this long - no open turn or pending\n  // request, no held wait_for_input, no other holder or writer, measured from\n  // durable turn/holder/admission facts - the reaper checkpoints the workspace,\n  // stops the box and settles those commands `lost` with reason\n  // `idle_containment`. Default 30min: well above the idle\n  // grace, so a lease that is only waiting for a \"glanced away\" user is\n  // never contained earlier than an idle lease would drain, and well inside\n  // the 1h provider-deadline rotation lead, so an idle box is saved long before\n  // the deadline path has to act. Set 0 to disable new idle enrollments without\n  // disabling provider-deadline containment or cancelling an enrolled drain.\n  // A positive window must exceed OPENGENI_SANDBOX_IDLE_GRACE_MS;\n  // an explicit positive value must also stay below OPENGENI_SANDBOX_ROTATION_LEAD_MS,\n  // and with an explicit OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS the reaper period\n  // plus this window plus the drain capture budget must fit before it.\n  // getSettings derives the unset default between those two for short-lived\n  // provider lifetimes. Knob: OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS.\n  sandboxIdleCommandContainmentMs: z.coerce\n    .number()\n    .int()\n    .nonnegative()\n    .optional()\n    .transform((value) => (value === 0 ? undefined : value)),\n  // MID-SESSION /workspace snapshot cadence (sandbox-file-persistence). The\n  // reaper's drain-persist only protects boxes the reaper itself kills; a box\n  // that dies any other way (Modal's hard creation-time timeout on a session\n  // busy past it, provider OOM/infra death) loses everything since the last\n  // clean drain. While a turn holds the box, the turn heartbeat and turn-end\n  // both take a snapshot when at least this interval has passed since the last\n  // one (same epoch-fenced fold-onto-lease seam as the drain), bounding the\n  // worst-case loss of ANY unclean box death to this window. 0 disables.\n  // Knob: OPENGENI_SANDBOX_SNAPSHOT_INTERVAL_MS. Default 15min.\n  sandboxSnapshotIntervalMs: z.coerce.number().int().min(0).default(900_000),\n  // Maximum time a best-effort /workspace snapshot capture may hold turn/reaper\n  // cleanup. A hung provider snapshot must never pin a lease holder, block\n  // graceful shutdown, or become permission to GC an older archive. Timeout is\n  // treated exactly like a failed best-effort snapshot. Knob:\n  // OPENGENI_SANDBOX_SNAPSHOT_TIMEOUT_MS. Default 60s.\n  sandboxSnapshotTimeoutMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS)\n    .default(60_000),\n  // A zero-holder drain may need substantially longer than a best-effort\n  // mid-turn/turn-end snapshot for a very large workspace. Keep that provider\n  // budget independent so increasing drain recovery headroom cannot pin an\n  // ordinary turn finalizer for the same duration. Unset preserves the legacy\n  // single-budget behavior. Knob:\n  // OPENGENI_SANDBOX_DRAIN_SNAPSHOT_TIMEOUT_MS.\n  sandboxDrainSnapshotTimeoutMs: z.coerce\n    .number()\n    .int()\n    .positive()\n    .max(SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS)\n    .optional(),\n  // Begin a controlled snapshot/quiesce/drain/rematerialize transition this far\n  // ahead of a finite provider deadline. Modal's 24h creation clock cannot be\n  // extended; the logical sandbox outlives it by moving to one successor box.\n  // getSettings derives the actual default as min(1h, half the configured\n  // provider lifetime) so short-lived test/canary boxes remain bootable without\n  // an extra coupled environment override. An explicit value may be larger when\n  // an operator deliberately wants more rotation headroom; the boot invariant\n  // still requires it to remain below the provider lifetime.\n  sandboxRotationLeadMs: z.coerce.number().int().positive().default(3_600_000),\n  // Bound provider-deadline rotation admission independently of execution.\n  // Every admitted box receives its own durable drain child; the control worker\n  // limits provider I/O to 32 concurrent activities. Matching that bound avoids\n  // both the old one-box-per-tick deadline backlog and an unbounded provider/API\n  // burst. Operators may tune this for a differently-sized worker pool.\n  sandboxRotationBatchSize: z.coerce.number().int().positive().max(500).default(32),\n  // expires_at refresh window for a held lease (>> the turn 10s heartbeat so a\n  // single missed heartbeat never TTL-reaps a live turn). The warming TTL is the\n  // window a cold->warming spawner has to commit warm before a reaper resets it.\n  sandboxLeaseTtlMs: z.coerce.number().int().positive().default(90_000),\n  sandboxLeaseWarmingTtlMs: z.coerce.number().int().positive().default(120_000),\n  // Overall user-facing budget for warming a sandbox lease. Unlike the lease TTL\n  // (a liveness/reaper cadence), this bounds how long one turn waits for capacity\n  // or provider creation before surfacing a clear turn.failed error.\n  sandboxWarmingTimeoutMs: z.coerce.number().int().positive().default(600_000),\n  // Request-scoped workspace control-prefix budget: how long one HTTP-originated\n  // session/workspace mutation (Send, Steer, Pause/Resume/Cancel, queue\n  // move/edit/delete, composer draft, settings narrowing, quiescent tree\n  // deletion) may wait to enter the fair `workspace_inference_controls` prefix\n  // before failing with the retryable 503 `WORKSPACE_CONTROL_BUSY`. Worker\n  // settlement and claims never use it. The API installs the validated value\n  // into @opengeni/db once at app construction; nothing reads the env per\n  // request. Env: OPENGENI_WORKSPACE_CONTROL_LOCK_TIMEOUT_MS. Default 20 s.\n  workspaceControlLockTimeoutMs: z.coerce\n    .number({\n      message: \"OPENGENI_WORKSPACE_CONTROL_LOCK_TIMEOUT_MS must be a positive integer (ms)\",\n    })\n    .int(\"OPENGENI_WORKSPACE_CONTROL_LOCK_TIMEOUT_MS must be a positive integer (ms)\")\n    .positive(\"OPENGENI_WORKSPACE_CONTROL_LOCK_TIMEOUT_MS must be a positive integer (ms)\")\n    .default(20_000),\n  // Rig setup-script budget (M3): the wall-clock timeout the rig-setup lifecycle\n  // hook runs its script under, distinct from the 120s per-command lifecycle\n  // default (a rig may compile/install heavy tooling on first cold create).\n  // Env: OPENGENI_RIG_SETUP_TIMEOUT_MS. Default 10min.\n  rigSetupTimeoutMs: z.coerce.number().int().positive().default(600_000),\n  // --- sandbox warm-time billing (P2.1) ---\n  // Per-backend warm rate (usd_micros/sec), like modelPricingJson: an empty {}\n  // means warm-cost is not debited (warm-seconds are still metered for audit).\n  // Shape: { \"modal\": 5, \"runloop\": 4, ... }. Backends absent here meter\n  // warm-seconds but accrue NO warm_cost / debit (rate 0).\n  sandboxWarmRateMicrosPerSecondJson: z.string().default(\"{}\"),\n  sandboxWarmBillingMode: z.enum([\"usage_only\", \"shadow\", \"credits\"]).default(\"usage_only\"),\n  // Per-workspace warm cap (cumulative warm-seconds since the start of the UTC\n  // month, summed over sandbox.warm_seconds). 0 = unbounded. A workspace over the\n  // cap force-drains its VIEWER-ONLY boxes (guarded AND turn_holders=0 — a paying\n  // turn is never killed); the reaper then stop()s at refcount 0.\n  sandboxMaxWarmSecondsPerWorkspace: z.coerce.number().int().nonnegative().default(0),\n  sandboxPreparationProfiles: z.string().default(\"none\"),\n  sandboxEnvAllowlist: z.string().default(\"\"),\n  // Comma-separated image references a workspace may select as its default\n  // sandbox image. Empty keeps every workspace on the deployment image.\n  sandboxImageAllowlist: z.string().default(\"\"),\n  objectStorageEndpoint: z.string().url().optional(),\n  objectStorageInternalEndpoint: z.string().url().optional(),\n  objectStorageSandboxEndpoint: z.string().url().optional(),\n  objectStorageBackend: z\n    .enum([\"s3-compatible\", \"aws-s3\", \"azure-blob\", \"gcs\"])\n    .default(\"s3-compatible\"),\n  objectStorageBucket: z.string().min(1).default(\"opengeni-files\"),\n  objectStorageRegion: z.string().min(1).default(\"us-east-1\"),\n  objectStorageS3Provider: z.string().min(1).default(\"Minio\"),\n  objectStorageAccessKeyId: z.string().optional(),\n  objectStorageSecretAccessKey: z.string().optional(),\n  objectStorageForcePathStyle: EnvBoolean.default(true),\n  objectStorageAzureConnectionString: z.string().optional(),\n  objectStorageAzureAccountName: z.string().optional(),\n  objectStorageAzureAccountKey: z.string().optional(),\n  objectStorageAzureEndpoint: z.string().url().optional(),\n  objectStorageGcsProjectId: z.string().optional(),\n  objectStorageGcsCredentialsJson: z.string().optional(),\n  objectStorageGcsKeyFilename: z.string().optional(),\n  objectStorageGcsApiEndpoint: z.string().url().optional(),\n  documentParser: z.string().min(1).default(\"liteparse\"),\n  documentChunkSize: z.coerce.number().int().positive().default(1200),\n  documentChunkOverlap: z.coerce.number().int().nonnegative().default(160),\n  documentEmbeddingProvider: z.enum([\"openai\", \"deterministic\"]).default(\"openai\"),\n  documentEmbeddingModel: z.string().min(1).default(\"text-embedding-3-large\"),\n  documentEmbeddingDimensions: z.coerce.number().int().positive().default(3072),\n  documentEmbeddingApiKey: z.string().optional(),\n  documentEmbeddingBaseUrl: z.string().url().optional(),\n  documentEmbeddingBillingMode: z.enum([\"usage_only\", \"shadow\", \"credits\"]).default(\"usage_only\"),\n  // Site SQL: optional per-Site Cloudflare storage (one SQLite Durable Object\n  // per Site, docs/site-data.md). Off unless enabled here, the gateway's\n  // internal origin is set and the published Sites gateway secret is\n  // configured; the API signs its calls to the gateway with that secret.\n  // Usage is recorded in the usage ledger only. Free-profile defaults are strict.\n  sitesCloudflareStorageEnabled: EnvBoolean.default(false),\n  sitesGatewayInternalOrigin: z\n    .string()\n    .url()\n    .refine((value) => {\n      const url = new URL(value);\n      if (url.pathname !== \"/\" || url.search || url.hash || url.username || url.password)\n        return false;\n      if (url.protocol === \"https:\") return true;\n      return url.protocol === \"http:\" && [\"127.0.0.1\", \"localhost\", \"[::1]\"].includes(url.hostname);\n    }, \"must be an https origin (http only on loopback)\")\n    .optional(),\n  // Site SQL storage per Site; defaults to the 5 GiB hard ceiling.\n  sitesSqlFreeStorageBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .default(5 * 1024 * 1024 * 1024),\n  // Optional per-Site monthly row quotas; unset means none (the platform\n  // meters rows per workspace instead; rate and per-call caps still apply).\n  sitesSqlFreeRowsReadPerMonth: z.coerce.number().int().positive().optional(),\n  sitesSqlFreeRowsWrittenPerMonth: z.coerce.number().int().positive().optional(),\n  sitesSqlFreeCallsPerMinutePerViewer: z.coerce.number().int().positive().default(60),\n  sitesSqlFreeCallsPerMinutePerSite: z.coerce.number().int().positive().default(600),\n  sitesSqlMaxRowsPerCall: z.coerce.number().int().min(1).max(5_000).default(1_000),\n  sitesSqlMaxResponseBytes: z.coerce\n    .number()\n    .int()\n    .min(1024)\n    .max(4 * 1024 * 1024)\n    .default(1024 * 1024),\n  sitesSqlTimeoutMs: z.coerce.number().int().min(1_000).max(60_000).default(15_000),\n  // Site Data quotas and write rate limits. Usage is recorded in the\n  // usage ledger only; shadow and paid modes are a later rollout step.\n  siteDataRecordBytesPerSite: z.coerce\n    .number()\n    .int()\n    .positive()\n    .default(100 * 1024 * 1024),\n  siteDataMaxRecordBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .default(256 * 1024),\n  siteDataMaxCollectionsPerSite: z.coerce.number().int().positive().default(50),\n  siteDataFileBytesPerSite: z.coerce\n    .number()\n    .int()\n    .positive()\n    .default(1024 * 1024 * 1024),\n  siteDataMaxFileBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .default(10 * 1024 * 1024),\n  siteDataWorkspaceBytes: z.coerce\n    .number()\n    .int()\n    .positive()\n    .default(1024 * 1024 * 1024),\n  siteDataViewerWritesPerMinute: z.coerce.number().int().positive().default(120),\n  siteDataSiteWritesPerMinute: z.coerce.number().int().positive().default(600),\n  siteDataViewerReadsPerMinute: z.coerce.number().int().positive().default(600),\n  siteDataManagerWritesPerMinute: z.coerce.number().int().positive().default(6_000),\n  // Schema-validation time one Site may spend per minute.\n  siteDataSiteValidationMsPerMinute: z.coerce.number().int().positive().default(5_000),\n  // Schema-validation time all of a workspace's Sites may spend per minute.\n  siteDataWorkspaceValidationMsPerMinute: z.coerce.number().int().positive().default(20_000),\n  siteDataMaxRecordsPerCollection: z.coerce.number().int().positive().default(100_000),\n  // Published Sites (docs/design/published-sites-2026-10-14.md). Publishing is\n  // off unless sitesDomain names the Sites domain; the site-runtime API also\n  // needs the gateway secret. Defaults are strict.\n  sitesDomain: z.string().trim().min(3).max(200).optional(),\n  sitesGatewaySecret: z.string().min(32).optional(),\n  // Accepted during rotation only; remove once the gateway signs with the new secret.\n  sitesGatewaySecretPrevious: z.string().min(32).optional(),\n  sitesPublicEnabled: EnvBoolean.default(true),\n  sitesPublicAgentsEnabled: EnvBoolean.default(true),\n  // Login-only deployments (staging): public means any signed-in user; no guests.\n  sitesLoginOnly: EnvBoolean.default(false),\n  sitesForceNoindex: EnvBoolean.default(false),\n  // Defaults to abuse@<sites domain>.\n  sitesAbuseEmail: z.string().email().optional(),\n  // Guests start embedded agents only after the gateway verified a bot challenge.\n  sitesGuestAgentHumanCheck: EnvBoolean.default(false),\n  // Rate brakes of every Site limit profile (all access modes).\n  sitesFreeRequestsPerMinutePerVisitor: z.coerce.number().int().positive().default(120),\n  sitesFreeGuestWritesPerMinute: z.coerce.number().int().nonnegative().default(30),\n  // Deprecated (the former free profile): fallbacks for the public and guest\n  // settings below when those are unset.\n  sitesFreeConversationsPerVisitorPerDay: z.coerce.number().int().nonnegative().optional(),\n  sitesFreeConversationsPerSitePerDay: z.coerce.number().int().nonnegative().optional(),\n  sitesFreeTurnsPerConversation: z.coerce.number().int().nonnegative().optional(),\n  sitesFreeAgentMicrosPerConversation: z.coerce.number().int().nonnegative().optional(),\n  sitesFreeAgentMicrosPerVisitorPerDay: z.coerce.number().int().nonnegative().optional(),\n  sitesFreeAgentMicrosPerSitePerMonth: z.coerce.number().int().nonnegative().optional(),\n  // Standard model-spend limits (micro-USD) for people outside the workspace\n  // (invited and public alike). Members are never limited by Site limits:\n  // they use the workspace's normal session limits. Unset: the deprecated\n  // free setting, else $10 per Site per month and no per-person limit.\n  sitesAgentMicrosPerSitePerMonth: z.coerce.number().int().nonnegative().optional(),\n  sitesAgentMicrosPerPersonPerDay: z.coerce.number().int().nonnegative().optional(),\n  // Internal guards for anonymous public visitors (not shown to Site owners). Unset:\n  // the deprecated free setting, else 20, 500, 50 and $1.\n  sitesGuestConversationsPerVisitorPerDay: z.coerce.number().int().nonnegative().optional(),\n  sitesGuestConversationsPerSitePerDay: z.coerce.number().int().nonnegative().optional(),\n  sitesGuestTurnsPerConversation: z.coerce.number().int().nonnegative().optional(),\n  sitesGuestAgentMicrosPerConversation: z.coerce.number().int().nonnegative().optional(),\n  // What each agent turn of someone outside the workspace holds against the\n  // Site's spend limits while it runs (micro-USD; actual spend replaces it\n  // when settled), capped by the conversation's own cap and what is left.\n  sitesAgentReservationMicrosPerTurn: z.coerce.number().int().min(1_000).default(250_000),\n  // The credits profile multiplies the standard spend caps and guest guards.\n  sitesCreditsLimitMultiplier: z.coerce.number().int().min(1).max(1_000).default(10),\n  // Site platform usage (gateway requests, Site SQL rows and storage, Site\n  // Data storage), metered apart from model spend. usage_only records it;\n  // shadow computes the charge without charging; credits charges usage above\n  // the per-workspace monthly allowance.\n  sitesPlatformBillingMode: z.enum([\"usage_only\", \"shadow\", \"credits\"]).default(\"usage_only\"),\n  // Credits mode: false refuses usage past the allowance instead of charging it.\n  sitesPlatformOverageEnabled: EnvBoolean.default(true),\n  sitesPlatformAllowanceRequests: z.coerce.number().int().nonnegative().default(1_000_000),\n  sitesPlatformAllowanceSqlRowsRead: z.coerce.number().int().nonnegative().default(10_000_000),\n  sitesPlatformAllowanceSqlRowsWritten: z.coerce.number().int().nonnegative().default(100_000),\n  sitesPlatformAllowanceStorageBytes: z.coerce.number().int().nonnegative().default(1_000_000_000),\n  // Unit prices in micro-USD: twice the Cloudflare list price (Workers\n  // requests, Durable Object SQLite rows and storage), covering host lookups,\n  // Durable Object requests and duration, and API work.\n  sitesPlatformPriceMicrosPerMillionRequests: z.coerce\n    .number()\n    .int()\n    .nonnegative()\n    .default(600_000),\n  sitesPlatformPriceMicrosPerMillionSqlRowsRead: z.coerce\n    .number()\n    .int()\n    .nonnegative()\n    .default(2_000),\n  sitesPlatformPriceMicrosPerMillionSqlRowsWritten: z.coerce\n    .number()\n    .int()\n    .nonnegative()\n    .default(2_000_000),\n  sitesPlatformPriceMicrosPerGbMonth: z.coerce.number().int().nonnegative().default(400_000),\n  // The Opengeni-wide monthly brake: estimated USD cost of all workspaces'\n  // platform usage at the prices above. 0 turns the brake off.\n  sitesPlatformMonthlyLimitUsd: z.coerce.number().nonnegative().max(100_000_000).default(1_000),\n  sitesPlatformAlertPercent: z.coerce.number().int().min(1).max(100).default(80),\n  sitesReportsPerMinutePerVisitor: z.coerce.number().int().positive().default(5),\n  sitesViewerSessionIdleSeconds: z.coerce\n    .number()\n    .int()\n    .min(60)\n    .default(12 * 60 * 60),\n  sitesViewerSessionAbsoluteSeconds: z.coerce\n    .number()\n    .int()\n    .min(60)\n    .max(30 * 24 * 60 * 60)\n    .default(7 * 24 * 60 * 60),\n  // A released hostname stays held for its workspace at least this long.\n  sitesHostnameHoldDays: z.coerce.number().int().min(30).default(30),\n  // Optional Cloudflare edge sync: KV host map and cache purge. All unset: no-op.\n  sitesCloudflareApiToken: z.string().min(1).optional(),\n  sitesCloudflareAccountId: z.string().min(1).optional(),\n  sitesCloudflareKvNamespaceId: z.string().min(1).optional(),\n  sitesCloudflareZoneId: z.string().min(1).optional(),\n  // KV expiry of host-map entries; bounds staleness if a sync write is missed.\n  sitesHostMapTtlSeconds: z.coerce.number().int().min(60).max(86_400).default(300),\n  // Google Web Risk scanning of URLs in Site HTML on publish; off without a key.\n  sitesWebRiskApiKey: z.string().min(1).optional(),\n  // Explicit commercial cutover. Existing queued revisions remain unpriced;\n  // only jobs created at or after this instant may enter the paid rail.\n  documentEmbeddingCreditsActivatedAt: z.iso.datetime().optional(),\n  // Customer tariff for the exact UTF-8 bytes sent to the embedder. Zero leaves\n  // the paid mode unavailable; no commercial rate is selected by this PR.\n  documentEmbeddingRateMicrosPerMillionBytes: z.coerce.number().int().nonnegative().default(0),\n  documentCurationProvider: z.enum([\"openai\", \"heuristic\", \"none\"]).default(\"openai\"),\n  documentCurationModel: z.string().min(1).default(\"gpt-4o-mini\"),\n  documentCurationApiKey: z.string().optional(),\n  documentCurationBaseUrl: z.string().url().optional(),\n  gitAuthorName: z.string().optional(),\n  gitAuthorEmail: z.string().optional(),\n  gitCommitterName: z.string().optional(),\n  gitCommitterEmail: z.string().optional(),\n  githubAppManifestBaseUrl: z.string().optional(),\n  githubAppManifestStateSecret: z.string().optional(),\n  githubAppId: z.string().optional(),\n  githubClientId: z.string().optional(),\n  githubClientSecret: z.string().optional(),\n  /** Default-off rollout for the in-process GitHub repository API tool surface. */\n  githubRestMcpEnabled: EnvBoolean.default(false),\n  githubPersonalOauthEnabled: EnvBoolean.default(false),\n  githubPersonalOauthClientId: z.string().optional(),\n  githubPersonalOauthClientSecret: z.string().optional(),\n  githubAppSlug: z.string().optional(),\n  githubWebhookSecret: z.string().optional(),\n  githubAppPrivateKey: z.string().optional(),\n  prReviewGithubAppId: z.string().optional(),\n  prReviewGithubClientId: z.string().optional(),\n  prReviewGithubClientSecret: z.string().optional(),\n  prReviewGithubAppSlug: z.string().optional(),\n  prReviewGithubWebhookSecret: z.string().optional(),\n  prReviewGithubAppPrivateKey: z.string().optional(),\n  betterAuthSecret: z.string().optional(),\n  betterAuthAllowedHosts: z.string().default(\"\"),\n  betterAuthCookieDomain: z.string().optional(),\n  betterAuthTrustedOrigins: z.string().default(\"\"),\n  managedAuthGoogleClientId: z.string().optional(),\n  managedAuthGoogleClientSecret: z.string().optional(),\n  managedAuthGithubClientId: z.string().optional(),\n  managedAuthGithubClientSecret: z.string().optional(),\n  // Rolling browser login-slot compatibility. Repository/deployment default is\n  // deliberately legacy; changing to broker is an operator-authorized rollout.\n  allowedUserEmails: z\n    .array(z.email().transform((email) => email.toLowerCase()))\n    .min(1)\n    .optional(),\n  managedAuthSessionSetMode: z.enum([\"legacy\", \"dual\", \"broker\"]).default(\"legacy\"),\n  // URL schemes the native app may receive its sign-in code on\n  // (`<scheme>://auth/callback`). A host shipping its own build of the app\n  // adds its scheme here.\n  nativeAppSchemes: z\n    .array(z.string().regex(/^[a-z][a-z0-9+.-]{1,63}$/u))\n    .min(1)\n    .default([\"opengeni\"]),\n  // Bundle identifiers / package names of native app builds allowed to\n  // register for push, and the provider credentials that push to them. Push\n  // stays off for a platform until its credentials are set.\n  nativeAppIds: z\n    .array(z.string().regex(/^[A-Za-z0-9._-]{1,255}$/u))\n    .min(1)\n    .default([\"ai.opengeni.app\"]),\n  apnsKeyId: z\n    .string()\n    .regex(/^[A-Z0-9]{10}$/u)\n    .optional(),\n  apnsTeamId: z\n    .string()\n    .regex(/^[A-Z0-9]{10}$/u)\n    .optional(),\n  // The APNs auth key (.p8 PEM). Literal \"\\n\" sequences are accepted.\n  apnsPrivateKey: z.string().min(1).optional(),\n  // A Firebase service account JSON with the Cloud Messaging API role.\n  fcmServiceAccountJson: z.string().min(1).optional(),\n  // Deployment ceiling for new managed accounts. When false, managed auth\n  // refuses every new Better Auth account (email/password sign-up and implicit\n  // Google/GitHub sign-up) while existing sign-in, sessions, password reset,\n  // email verification, and invitation-bound account setup keep working. Read\n  // at startup; the 0585 runtime switch pauses sign-ups without a restart.\n  managedAuthNewSignupsEnabled: EnvBoolean.default(true),\n  // Unset retains environment-based verification (required outside local).\n  managedAuthRequireEmailVerification: EnvBoolean.optional(),\n  // Query transport is an explicit second-stage rollout. A pre-compatibility\n  // web image understands only fragment bearers, so API replicas must keep\n  // generating fragment links until the compatible web fleet has converged.\n  organizationUserSetupEmailTokenTransport: z.enum([\"fragment\", \"query\"]).default(\"fragment\"),\n  // Query-bearing setup links may appear in controller/edge error logs even\n  // when access logs and request tracing are disabled. This explicit operator\n  // confirmation keeps query transport fail closed until that separate sink is\n  // proven sanitized.\n  organizationUserSetupQueryEdgeSanitizationConfirmed: EnvBoolean.default(false),\n  // Managed mode sends sign-up verification, organization user setup and sign-in\n  // method notices by email. \"disabled\" is an explicit operator choice for\n  // deployments that provision accounts another way: nothing is ever sent, and\n  // those deliveries settle as failed with errorClass \"delivery_disabled\".\n  managedEmailDelivery: z.enum([\"resend\", \"disabled\"]).default(\"resend\"),\n  resendApiKey: z.string().optional(),\n  emailFrom: z.string().default(\"Opengeni <auth@mail.opengeni.ai>\"),\n  stripeSecretKey: z.string().optional(),\n  stripePublishableKey: z.string().optional(),\n  stripeWebhookSecret: z.string().optional(),\n  stripeCreditsProductId: z.string().optional(),\n  // Enables subscription service paths only; top-up billing remains independent.\n  subscriptionPlansEnabled: EnvBoolean.default(false),\n  mcpServers: z\n    .array(\n      z.object({\n        id: z.string().min(1).regex(registryId),\n        name: z.string().min(1).optional(),\n        url: z.string().url(),\n        allowedTools: z.array(z.string().min(1)).optional(),\n        timeoutMs: z.number().int().positive().optional(),\n        /**\n         * Bound for session setup requests only (initialize and tools/list),\n         * when it should be longer than the client's default. Tool calls keep\n         * `timeoutMs` (or the client default) unchanged.\n         */\n        setupTimeoutMs: z.number().int().positive().optional(),\n        cacheToolsList: z.boolean().default(false),\n        /** Runtime approval policy, overlaid from an attempt-frozen session snapshot. */\n        requireApproval: SessionMcpApprovalPolicy.optional(),\n        /**\n         * Extra request headers sent to this MCP server (credential injection\n         * for workspace-enabled capability MCPs). Populated at runtime from\n         * encrypted capability-installation credentials; do not put secrets in\n         * OPENGENI_MCP_SERVERS.\n         */\n        headers: z.record(z.string(), z.string()).optional(),\n        connectionRef: McpServerConnectionRefSchema.optional(),\n        operationRecovery: McpOperationRecoverySchema.optional(),\n      }),\n    )\n    .default([]),\n});\n\nexport type Settings = z.infer<typeof SettingsSchema>;\n\n// Independently supervised artifact services are not API/agent runtimes. Parse\n// only their actual capabilities, using the same field schemas as getSettings.\nconst ArtifactServiceSettingsSchema = SettingsSchema.pick({\n  serviceName: true,\n  environment: true,\n  deploymentRevision: true,\n  dbSchema: true,\n  rlsStrategy: true,\n  databasePreparedStatements: true,\n  observabilityStructuredLogs: true,\n  observabilityMetricsEnabled: true,\n  observabilityOtlpEndpoint: true,\n  observabilityOtlpHeaders: true,\n});\nconst ArtifactOutboxSettingsSchema = ArtifactServiceSettingsSchema.extend({\n  natsUrl: SettingsSchema.shape.natsUrl,\n  selfhostedNatsControlUser: SettingsSchema.shape.selfhostedNatsControlUser,\n  selfhostedNatsControlPassword: SettingsSchema.shape.selfhostedNatsControlPassword,\n});\nconst ObjectStorageSettingsSchema = SettingsSchema.pick({\n  objectStorageBackend: true,\n  objectStorageEndpoint: true,\n  objectStorageInternalEndpoint: true,\n  objectStorageSandboxEndpoint: true,\n  objectStorageBucket: true,\n  objectStorageRegion: true,\n  objectStorageAccessKeyId: true,\n  objectStorageSecretAccessKey: true,\n  objectStorageForcePathStyle: true,\n  objectStorageAzureConnectionString: true,\n  objectStorageAzureAccountName: true,\n  objectStorageAzureAccountKey: true,\n  objectStorageAzureEndpoint: true,\n  objectStorageGcsProjectId: true,\n  objectStorageGcsCredentialsJson: true,\n  objectStorageGcsKeyFilename: true,\n  objectStorageGcsApiEndpoint: true,\n});\nconst ArtifactMaterializerSettingsSchema = ArtifactServiceSettingsSchema.extend(\n  ObjectStorageSettingsSchema.shape,\n);\nexport type ArtifactOutboxSettings = z.infer<typeof ArtifactOutboxSettingsSchema>;\nexport type ObjectStorageSettings = z.infer<typeof ObjectStorageSettingsSchema>;\nexport type ArtifactMaterializerSettings = z.infer<typeof ArtifactMaterializerSettingsSchema>;\n\nfunction artifactServiceEnvironment(source: NodeJS.ProcessEnv) {\n  const optional = (name: string) => optionalEnvironmentValue(name, source);\n  return {\n    serviceName: optional(\"OPENGENI_SERVICE_NAME\"),\n    environment: optional(\"OPENGENI_ENVIRONMENT\"),\n    deploymentRevision:\n      optional(\"OPENGENI_DEPLOYMENT_REVISION\") ??\n      optional(\"SOURCE_VERSION\") ??\n      optional(\"GITHUB_SHA\"),\n    dbSchema: optional(\"OPENGENI_DB_SCHEMA\"),\n    rlsStrategy: optional(\"OPENGENI_RLS_STRATEGY\"),\n    databasePreparedStatements: optional(\"OPENGENI_DATABASE_PREPARED_STATEMENTS\"),\n    observabilityStructuredLogs: optional(\"OPENGENI_OBSERVABILITY_STRUCTURED_LOGS\"),\n    observabilityMetricsEnabled: optional(\"OPENGENI_OBSERVABILITY_METRICS_ENABLED\"),\n    observabilityOtlpEndpoint:\n      optional(\"OPENGENI_OTEL_EXPORTER_OTLP_ENDPOINT\") ?? optional(\"OTEL_EXPORTER_OTLP_ENDPOINT\"),\n    observabilityOtlpHeaders:\n      optional(\"OPENGENI_OTEL_EXPORTER_OTLP_HEADERS\") ?? optional(\"OTEL_EXPORTER_OTLP_HEADERS\"),\n  };\n}\n\nexport function getArtifactOutboxSettings(\n  source: NodeJS.ProcessEnv = process.env,\n): ArtifactOutboxSettings {\n  const settings = ArtifactOutboxSettingsSchema.parse({\n    ...artifactServiceEnvironment(source),\n    natsUrl: optionalEnvironmentValue(\"OPENGENI_NATS_URL\", source),\n    selfhostedNatsControlUser: optionalEnvironmentValue(\n      \"OPENGENI_SELFHOSTED_NATS_CONTROL_USER\",\n      source,\n    ),\n    selfhostedNatsControlPassword: optionalEnvironmentValue(\n      \"OPENGENI_SELFHOSTED_NATS_CONTROL_PASSWORD\",\n      source,\n    ),\n  });\n  dbSearchPath(settings);\n  if (\n    Boolean(settings.selfhostedNatsControlUser) !== Boolean(settings.selfhostedNatsControlPassword)\n  ) {\n    throw new Error(\"Artifact outbox NATS control user and password must be configured together\");\n  }\n  return settings;\n}\n\nexport function getArtifactMaterializerSettings(\n  source: NodeJS.ProcessEnv = process.env,\n): ArtifactMaterializerSettings {\n  const optional = (name: string) => optionalEnvironmentValue(name, source);\n  const settings = ArtifactMaterializerSettingsSchema.parse({\n    ...artifactServiceEnvironment(source),\n    objectStorageEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_ENDPOINT\"),\n    objectStorageInternalEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_INTERNAL_ENDPOINT\"),\n    objectStorageSandboxEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_SANDBOX_ENDPOINT\"),\n    objectStorageBackend: optional(\"OPENGENI_OBJECT_STORAGE_BACKEND\"),\n    objectStorageBucket: optional(\"OPENGENI_OBJECT_STORAGE_BUCKET\"),\n    objectStorageRegion: optional(\"OPENGENI_OBJECT_STORAGE_REGION\"),\n    objectStorageAccessKeyId: optional(\"OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID\"),\n    objectStorageSecretAccessKey: optional(\"OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY\"),\n    objectStorageForcePathStyle: optional(\"OPENGENI_OBJECT_STORAGE_FORCE_PATH_STYLE\"),\n    objectStorageAzureConnectionString: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_CONNECTION_STRING\"),\n    objectStorageAzureAccountName: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_NAME\"),\n    objectStorageAzureAccountKey: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_KEY\"),\n    objectStorageAzureEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ENDPOINT\"),\n    objectStorageGcsProjectId: optional(\"OPENGENI_OBJECT_STORAGE_GCS_PROJECT_ID\"),\n    objectStorageGcsCredentialsJson: optional(\"OPENGENI_OBJECT_STORAGE_GCS_CREDENTIALS_JSON\"),\n    objectStorageGcsKeyFilename: optional(\"OPENGENI_OBJECT_STORAGE_GCS_KEY_FILENAME\"),\n    objectStorageGcsApiEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_GCS_API_ENDPOINT\"),\n  });\n  dbSearchPath(settings);\n  validateObjectStorageSettings(settings);\n  return settings;\n}\n\nexport type McpServerConfig = Settings[\"mcpServers\"][number];\n\nexport type GoogleDriveProviderRetryOptions = {\n  requestTimeoutMs: number;\n  attempts: number;\n  initialDelayMs: number;\n  maxDelayMs: number;\n  budgetMs: number;\n};\n\n/** Freeze one validated provider-neutral budget into every newly created or\n * updated Google Drive knowledge-source schedule. Existing schedules retain\n * their persisted limits until an authorized source save updates them. */\nexport function configuredGoogleDriveSyncLimits(settings: Settings) {\n  return KnowledgeSourceSyncLimits.parse({\n    maxItems: settings.googleDriveSyncMaxItems,\n    maxBytes: settings.googleDriveSyncMaxBytes,\n    maxFileBytes: settings.googleDriveSyncMaxFileBytes,\n    maxProviderRequests: settings.googleDriveSyncMaxProviderRequests,\n    maxElapsedSeconds: settings.googleDriveSyncMaxElapsedSeconds,\n    maxFailureDetails: settings.googleDriveSyncMaxFailureDetails,\n  });\n}\n\n/** Bounded in-activity retry policy for individual Google Drive requests. The\n * durable sync workflow remains authoritative after this local budget ends. */\nexport function googleDriveProviderRetryOptions(\n  settings: Settings,\n): GoogleDriveProviderRetryOptions {\n  return {\n    requestTimeoutMs: settings.googleDriveProviderRequestTimeoutMs,\n    attempts: settings.googleDriveProviderRetryAttempts,\n    initialDelayMs: settings.googleDriveProviderRetryInitialDelayMs,\n    maxDelayMs: settings.googleDriveProviderRetryMaxDelayMs,\n    budgetMs: settings.googleDriveProviderRetryBudgetMs,\n  };\n}\n\n/** Return only a credential-free HTTP(S) origin. Reject path, user-info, query,\n * and fragment input instead of reflecting it into callbacks or evidence. */\nexport function canonicalPublicOrigin(publicBaseUrl: string | undefined): string | null {\n  if (!publicBaseUrl) return null;\n  let parsed: URL;\n  try {\n    parsed = new URL(publicBaseUrl);\n  } catch {\n    return null;\n  }\n  if (\n    ![\"http:\", \"https:\"].includes(parsed.protocol) ||\n    parsed.username ||\n    parsed.password ||\n    parsed.search ||\n    parsed.hash ||\n    (parsed.pathname !== \"\" && parsed.pathname !== \"/\")\n  ) {\n    return null;\n  }\n  return parsed.origin;\n}\n\nexport function googleDriveOAuthCallbackUrl(publicBaseUrl: string | undefined): string | null {\n  const origin = canonicalPublicOrigin(publicBaseUrl);\n  return origin ? `${origin}/v1/integrations/google-drive/callback` : null;\n}\n\n/** Exact callback registered on the environment-specific personal GitHub OAuth App. */\nexport function personalGitHubOAuthCallbackUrl(publicBaseUrl: string | undefined): string | null {\n  const origin = canonicalPublicOrigin(publicBaseUrl);\n  return origin ? `${origin}/v1/integrations/github-personal/oauth/callback` : null;\n}\n\n/** Declarative voice-input transcription provider ids. */\nexport type VoiceInputProviderId =\n  | \"openai\"\n  | \"azure-openai\"\n  | \"azure-mai\"\n  | \"codex-subscription\"\n  | \"supergrok-subscription\";\n\nexport type VoiceInputProviderConfig =\n  | {\n      id: \"azure-mai\";\n      kind: \"azure-mai\";\n      pricing: VoiceInputPricing | null;\n      endpoint: string;\n      apiKey: string;\n      apiVersion: string;\n      model: string;\n    }\n  | {\n      id: \"openai\";\n      kind: \"openai\";\n      apiKey: string;\n      baseUrl: string;\n      model: string;\n      /** Deployment-funded: Opengeni pays upstream and charges credits. */\n      pricing: VoiceInputPricing | null;\n    }\n  | {\n      id: \"azure-openai\";\n      kind: \"azure-openai\";\n      endpoint: string;\n      deployment: string;\n      apiVersion: string;\n      apiKey: string | null;\n      adToken: string | null;\n      /** Underlying model (pricing + response shape); defaults to the deployment name. */\n      model: string;\n      /** Deployment-funded: Opengeni pays upstream and charges credits. */\n      pricing: VoiceInputPricing | null;\n    }\n  | {\n      id: \"codex-subscription\";\n      kind: \"codex-subscription\";\n      experimental: true;\n    }\n  | {\n      id: \"supergrok-subscription\";\n      kind: \"supergrok-subscription\";\n      experimental: true;\n    };\n\nfunction usableDeploymentSecret(value: string | null | undefined): string | undefined {\n  return isUsableVoiceInputSecret(value) ? value : undefined;\n}\n\n/** The deployment's Jev key, or undefined when it is missing or a placeholder. */\nexport function usableJevApiKey(settings: Pick<Settings, \"jevApiKey\">): string | undefined {\n  return usableDeploymentSecret(settings.jevApiKey);\n}\n\nexport type DecisionModelSettings = Pick<\n  Settings,\n  \"decisionModelProvider\" | \"decisionModelId\" | \"decisionModelApiKey\" | \"decisionModelBaseUrl\"\n>;\n/** Explicit deployment credentials only. Compatibility is code-search-only. */\nexport function decisionModelConfiguration(\n  settings: DecisionModelSettings &\n    Partial<Pick<Settings, \"jevApiKey\" | \"jevModel\" | \"jevBaseUrl\">>,\n  allowLegacyCodeSearch = false,\n):\n  | { provider: \"jev\" | \"openai\" | \"openrouter\"; model: string; apiKey: string; baseUrl?: string }\n  | undefined {\n  const explicit =\n    settings.decisionModelProvider !== undefined ||\n    settings.decisionModelId !== undefined ||\n    settings.decisionModelApiKey !== undefined ||\n    settings.decisionModelBaseUrl !== undefined;\n  if (explicit) {\n    const apiKey = usableDeploymentSecret(settings.decisionModelApiKey);\n    if (!settings.decisionModelProvider || !settings.decisionModelId || !apiKey) return undefined;\n    return {\n      provider: settings.decisionModelProvider,\n      model: settings.decisionModelId,\n      apiKey,\n      ...(settings.decisionModelBaseUrl ? { baseUrl: settings.decisionModelBaseUrl } : {}),\n    };\n  }\n  const apiKey = allowLegacyCodeSearch ? usableJevApiKey(settings) : undefined;\n  return apiKey\n    ? {\n        provider: \"jev\",\n        model: settings.jevModel ?? \"jev-latest\",\n        apiKey,\n        ...(settings.jevBaseUrl ? { baseUrl: settings.jevBaseUrl } : {}),\n      }\n    : undefined;\n}\n\n/** Deployment half of agent configuration: hard capability limits. */\nexport function agentConfigDeploymentPolicy(\n  settings: FirstPartyMcpToolPolicySettings & Pick<Settings, \"webSearchEnabled\">,\n): AgentConfigDeploymentLimits {\n  return agentConfigDeploymentLimitsFromAllowlist(\n    resolveFirstPartyMcpToolPolicy(settings).allowed,\n    settings.webSearchEnabled ? {} : { webSearch: \"web search is turned off on this server\" },\n  );\n}\n\n/**\n * Deployment half of the `code_search` decision. `available` is false when\n * the mode is off or no usable decision model is configured; workspaces then cannot\n * turn it on. `workspaceDefault` applies to workspaces without their own\n * setting.\n */\nexport function codeSearchDeploymentPolicy(\n  settings: Pick<Settings, \"codeSearchMode\" | \"jevApiKey\"> & DecisionModelSettings,\n): CodeSearchDeploymentPolicy {\n  const available =\n    settings.codeSearchMode !== \"off\" && decisionModelConfiguration(settings, true) !== undefined;\n  if (!available) return { available: false, workspaceDefault: \"off\" };\n  const workspaceDefault =\n    settings.codeSearchMode === \"default_on\"\n      ? \"on\"\n      : settings.codeSearchMode === \"experiment\"\n        ? \"split\"\n        : \"off\";\n  return { available, workspaceDefault };\n}\n\n/**\n * Reject empty / template secrets so `.env.example` placeholders like\n * `your-key` cannot advertise voice input as available and then 401 upstream.\n */\nexport function isUsableVoiceInputSecret(value: string | null | undefined): value is string {\n  if (value == null) return false;\n  const trimmed = value.trim();\n  if (!trimmed) return false;\n  const normalized = trimmed.toLowerCase();\n  if (\n    normalized === \"your-key\" ||\n    normalized === \"your_key\" ||\n    normalized === \"changeme\" ||\n    normalized === \"replace-me\" ||\n    normalized === \"xxx\" ||\n    normalized.startsWith(\"your-\") ||\n    normalized.startsWith(\"your_\")\n  ) {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Resolve the configured voice-input provider registry in selection order.\n * Credentials stay in this server-side structure; ClientConfig only projects\n * whether at least one non-experimental (or probed experimental) provider exists.\n */\nexport function resolveVoiceInputProviderRegistry(settings: Settings): VoiceInputProviderConfig[] {\n  return voiceInputProviderRegistryWithIssues(settings).providers;\n}\n\n/** Why a credentialed deployment-funded voice provider is withheld. */\nexport type VoiceInputPricingIssue = {\n  providerId: \"openai\" | \"azure-openai\" | \"azure-mai\";\n  env: string;\n  reason: \"malformed\" | \"unpriced\";\n  message: string;\n};\n\n/**\n * Pricing problems that withhold a credentialed deployment-funded provider.\n * A malformed PRICING_JSON never fails boot (workers share this config and\n * must not crash-loop over a voice-only setting); the API logs each issue\n * once at startup and the provider stays unavailable.\n */\nexport function voiceInputPricingIssues(settings: Settings): VoiceInputPricingIssue[] {\n  return voiceInputProviderRegistryWithIssues(settings).issues;\n}\n\nfunction voiceInputProviderPricing(\n  settings: Settings,\n  issues: VoiceInputPricingIssue[],\n  providerId: VoiceInputPricingIssue[\"providerId\"],\n  env: string,\n  raw: string | undefined,\n  model: string,\n): { usable: true; pricing: VoiceInputPricing | null } | { usable: false } {\n  const resolved = safeResolveVoiceInputPricing(raw, model, env);\n  if (!resolved.ok) {\n    issues.push({ providerId, env, reason: \"malformed\", message: resolved.error });\n    return { usable: false };\n  }\n  if (!resolved.pricing && voiceInputCreditBillingActive(settings)) {\n    // Never serve unpriced deployment-paid audio on a credit-billed deployment.\n    issues.push({\n      providerId,\n      env,\n      reason: \"unpriced\",\n      message: `${env} is required: credit billing is active and model \"${model}\" has no built-in voice price`,\n    });\n    return { usable: false };\n  }\n  return { usable: true, pricing: resolved.pricing };\n}\n\nfunction voiceInputProviderRegistryWithIssues(settings: Settings): {\n  providers: VoiceInputProviderConfig[];\n  issues: VoiceInputPricingIssue[];\n} {\n  const issues: VoiceInputPricingIssue[] = [];\n  const order = settings.voiceInputProviderOrder\n    .split(\",\")\n    .map((part) => part.trim())\n    .filter(\n      (part): part is VoiceInputProviderId =>\n        part === \"openai\" ||\n        part === \"azure-openai\" ||\n        part === \"azure-mai\" ||\n        part === \"codex-subscription\" ||\n        part === \"supergrok-subscription\",\n    );\n  const seen = new Set<VoiceInputProviderId>();\n  const providers: VoiceInputProviderConfig[] = [];\n  for (const id of order) {\n    if (seen.has(id)) continue;\n    seen.add(id);\n    if (id === \"azure-mai\") {\n      if (\n        !settings.voiceInputMaiEndpoint ||\n        !isUsableVoiceInputSecret(settings.voiceInputMaiApiKey)\n      )\n        continue;\n      const priced = voiceInputProviderPricing(\n        settings,\n        issues,\n        \"azure-mai\",\n        \"OPENGENI_VOICE_INPUT_MAI_PRICING_JSON\",\n        settings.voiceInputMaiPricingJson,\n        settings.voiceInputMaiModel,\n      );\n      if (!priced.usable) continue;\n      providers.push({\n        id,\n        kind: \"azure-mai\",\n        pricing: priced.pricing,\n        endpoint: settings.voiceInputMaiEndpoint.replace(/\\/+$/, \"\"),\n        apiKey: settings.voiceInputMaiApiKey,\n        apiVersion: settings.voiceInputMaiApiVersion,\n        model: settings.voiceInputMaiModel,\n      });\n      continue;\n    }\n    if (id === \"openai\") {\n      if (!settings.voiceInputOpenaiEnabled) continue;\n      const apiKey = settings.voiceInputOpenaiApiKey ?? settings.openaiApiKey;\n      if (!isUsableVoiceInputSecret(apiKey)) continue;\n      // When the turn provider is Azure-only and no voice-specific OpenAI key/URL\n      // was set, do not silently reuse a leftover OPENAI_API_KEY for voice.\n      if (\n        settings.openaiProvider === \"azure\" &&\n        !settings.voiceInputOpenaiApiKey &&\n        !settings.voiceInputOpenaiBaseUrl\n      ) {\n        continue;\n      }\n      const priced = voiceInputProviderPricing(\n        settings,\n        issues,\n        \"openai\",\n        \"OPENGENI_VOICE_INPUT_OPENAI_PRICING_JSON\",\n        settings.voiceInputOpenaiPricingJson,\n        settings.voiceInputOpenaiModel,\n      );\n      if (!priced.usable) continue;\n      providers.push({\n        id: \"openai\",\n        kind: \"openai\",\n        pricing: priced.pricing,\n        apiKey,\n        baseUrl: (\n          settings.voiceInputOpenaiBaseUrl ??\n          settings.openaiBaseUrl ??\n          \"https://api.openai.com/v1\"\n        ).replace(/\\/+$/, \"\"),\n        model: settings.voiceInputOpenaiModel,\n      });\n      continue;\n    }\n    if (id === \"azure-openai\") {\n      if (!settings.voiceInputAzureEnabled) continue;\n      const endpoint = (\n        settings.voiceInputAzureEndpoint ??\n        settings.azureOpenaiEndpoint ??\n        \"\"\n      ).replace(/\\/+$/, \"\");\n      const deployment = settings.voiceInputAzureDeployment ?? settings.azureOpenaiDeployment ?? \"\";\n      const apiVersion =\n        settings.voiceInputAzureApiVersion ??\n        settings.azureOpenaiApiVersion ??\n        \"2025-04-01-preview\";\n      const apiKey = settings.voiceInputAzureApiKey ?? settings.azureOpenaiApiKey ?? null;\n      const adToken = settings.voiceInputAzureAdToken ?? settings.azureOpenaiAdToken ?? null;\n      if (\n        !endpoint ||\n        !deployment ||\n        (!isUsableVoiceInputSecret(apiKey) && !isUsableVoiceInputSecret(adToken))\n      ) {\n        continue;\n      }\n      // When turn provider is OpenAI-only and no voice-specific Azure settings\n      // were provided, skip ambient Azure leftovers.\n      if (\n        settings.openaiProvider !== \"azure\" &&\n        !settings.voiceInputAzureEndpoint &&\n        !settings.voiceInputAzureDeployment &&\n        !settings.voiceInputAzureApiKey &&\n        !settings.voiceInputAzureAdToken\n      ) {\n        continue;\n      }\n      const model = settings.voiceInputAzureModel ?? deployment;\n      const priced = voiceInputProviderPricing(\n        settings,\n        issues,\n        \"azure-openai\",\n        \"OPENGENI_VOICE_INPUT_AZURE_PRICING_JSON\",\n        settings.voiceInputAzurePricingJson,\n        model,\n      );\n      if (!priced.usable) continue;\n      const pricing = priced.pricing;\n      providers.push({\n        id: \"azure-openai\",\n        kind: \"azure-openai\",\n        endpoint,\n        deployment,\n        apiVersion,\n        apiKey: isUsableVoiceInputSecret(apiKey) ? apiKey : null,\n        adToken: isUsableVoiceInputSecret(adToken) ? adToken : null,\n        model,\n        pricing,\n      });\n      continue;\n    }\n    if (id === \"codex-subscription\") {\n      // Prefer Codex STT whenever subscription model routing is enabled.\n      // Operators who want OpenAI/Azure first should set PROVIDER_ORDER; omit\n      // `codex-subscription` from the order to disable Codex voice while keeping\n      // subscription turns. VOICE_INPUT_CODEX_EXPERIMENTAL is retained for\n      // back-compat docs/env but no longer gates inclusion.\n      if (!settings.codexSubscriptionEnabled) continue;\n      providers.push({\n        id: \"codex-subscription\",\n        kind: \"codex-subscription\",\n        experimental: true,\n      });\n      continue;\n    }\n    if (id === \"supergrok-subscription\") {\n      if (!settings.supergrokSubscriptionEnabled) continue;\n      providers.push({\n        id: \"supergrok-subscription\",\n        kind: \"supergrok-subscription\",\n        experimental: true,\n      });\n    }\n  }\n  return { providers, issues };\n}\n\n/**\n * Opengeni credit price for one deployment-funded transcription provider.\n * Rates are upstream list prices in integer USD micros; `marginBps` (500 =\n * +5%) is added on top, exactly like model pricing. `microsPerMinute` prices\n * provider-reported audio duration (Whisper, `usage.type: \"duration\"`) and is\n * a server-measured WAV duration when provider usage is absent. Token\n * rates price `usage.type: \"tokens\"` (gpt-4o-transcribe family); `input`\n * covers text input tokens and, unless `audioInput` is set, audio tokens.\n */\nexport type VoiceInputPricing = {\n  microsPerMinute: number;\n  inputMicrosPerMillionTokens?: number | undefined;\n  audioInputMicrosPerMillionTokens?: number | undefined;\n  outputMicrosPerMillionTokens?: number | undefined;\n  marginBps?: number | undefined;\n};\n\nconst VoiceInputPricingSchema = z\n  .object({\n    microsPerMinute: z.number().int().positive().max(100_000_000),\n    inputMicrosPerMillionTokens: z.number().int().nonnegative().max(1_000_000_000).optional(),\n    audioInputMicrosPerMillionTokens: z.number().int().nonnegative().max(1_000_000_000).optional(),\n    outputMicrosPerMillionTokens: z.number().int().nonnegative().max(1_000_000_000).optional(),\n    marginBps: z.number().int().min(0).max(100_000).optional(),\n  })\n  .strict()\n  .superRefine((pricing, ctx) => {\n    const input = pricing.inputMicrosPerMillionTokens !== undefined;\n    const output = pricing.outputMicrosPerMillionTokens !== undefined;\n    if (input !== output) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: \"inputMicrosPerMillionTokens and outputMicrosPerMillionTokens are set together\",\n      });\n    }\n    if (pricing.audioInputMicrosPerMillionTokens !== undefined && !input) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: \"audioInputMicrosPerMillionTokens requires the token input/output rates\",\n      });\n    }\n  });\n\n/**\n * Built-in list prices (OpenAI API pricing, \"Transcription models\" table)\n * plus the default 5% Opengeni margin used for model pricing. Azure Global\n * Standard deployments use the same list prices; set the provider\n * PRICING_JSON when a deployment's contracted or regional price differs.\n */\nexport const defaultVoiceInputPricing: Readonly<Record<string, VoiceInputPricing>> = {\n  // Audio tokens are listed separately from text tokens on the model pages;\n  // set explicitly so the audio rate never silently follows a text-rate edit.\n  \"gpt-4o-transcribe\": {\n    microsPerMinute: 6_000,\n    inputMicrosPerMillionTokens: 2_500_000,\n    audioInputMicrosPerMillionTokens: 2_500_000,\n    outputMicrosPerMillionTokens: 10_000_000,\n    marginBps: 500,\n  },\n  \"gpt-4o-transcribe-diarize\": {\n    microsPerMinute: 6_000,\n    inputMicrosPerMillionTokens: 2_500_000,\n    audioInputMicrosPerMillionTokens: 2_500_000,\n    outputMicrosPerMillionTokens: 10_000_000,\n    marginBps: 500,\n  },\n  \"gpt-4o-mini-transcribe\": {\n    microsPerMinute: 3_000,\n    inputMicrosPerMillionTokens: 1_250_000,\n    audioInputMicrosPerMillionTokens: 1_250_000,\n    outputMicrosPerMillionTokens: 5_000_000,\n    marginBps: 500,\n  },\n  \"gpt-transcribe\": { microsPerMinute: 4_500, marginBps: 500 },\n  whisper: { microsPerMinute: 6_000, marginBps: 500 },\n  \"whisper-1\": { microsPerMinute: 6_000, marginBps: 500 },\n};\n\n/** Lowercased model with a dated snapshot suffix (`-2025-03-20`) removed. */\nexport function canonicalVoiceInputModel(model: string): string {\n  return model\n    .trim()\n    .toLowerCase()\n    .replace(/-\\d{4}-\\d{2}-\\d{2}$/, \"\");\n}\n\n/** Whisper reports its billed audio duration only in `verbose_json`. */\nexport function voiceInputModelReportsDurationOnly(model: string): boolean {\n  return canonicalVoiceInputModel(model).startsWith(\"whisper\");\n}\n\n/** Parse one provider pricing JSON. Throws a configuration error when malformed. */\nexport function parseVoiceInputPricingJson(\n  raw: string | undefined,\n  env = \"voice-input pricing JSON\",\n): VoiceInputPricing | null {\n  if (raw === undefined || raw.trim() === \"\") return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    throw new Error(`${env} must be valid JSON`);\n  }\n  const result = VoiceInputPricingSchema.safeParse(parsed);\n  if (!result.success) {\n    throw new Error(\n      `${env} is invalid: ${result.error.issues.map((issue) => issue.message).join(\"; \")}`,\n    );\n  }\n  return result.data;\n}\n\n/** Explicit provider pricing JSON wins; otherwise the built-in list price for the model. */\nexport function resolveVoiceInputPricing(\n  raw: string | undefined,\n  model: string,\n): VoiceInputPricing | null {\n  return (\n    parseVoiceInputPricingJson(raw) ??\n    defaultVoiceInputPricing[canonicalVoiceInputModel(model)] ??\n    null\n  );\n}\n\n/** Non-throwing {@link resolveVoiceInputPricing} for registry resolution. */\nexport function safeResolveVoiceInputPricing(\n  raw: string | undefined,\n  model: string,\n  env?: string,\n): { ok: true; pricing: VoiceInputPricing | null } | { ok: false; error: string } {\n  let explicit: VoiceInputPricing | null;\n  try {\n    explicit = parseVoiceInputPricingJson(raw, env);\n  } catch (error) {\n    return { ok: false, error: error instanceof Error ? error.message : String(error) };\n  }\n  return {\n    ok: true,\n    pricing: explicit ?? defaultVoiceInputPricing[canonicalVoiceInputModel(model)] ?? null,\n  };\n}\n\n/** Same predicate as model/credit limits: credit balance and debits are enforced. */\nexport function voiceInputCreditBillingActive(\n  settings: Pick<Settings, \"billingMode\" | \"usageLimitsMode\">,\n): boolean {\n  return settings.billingMode === \"stripe\" || settings.usageLimitsMode === \"managed\";\n}\n\n/** Provider-reported transcription usage, normalized. Never client-reported. */\nexport type VoiceInputUsage =\n  | {\n      kind: \"tokens\";\n      inputTokens: number;\n      audioInputTokens: number;\n      textInputTokens: number;\n      outputTokens: number;\n    }\n  | { kind: \"duration\"; seconds: number };\n\nexport type VoiceInputCost = {\n  /** Upstream list cost before margin, rounded up to whole micros. */\n  providerCostMicros: number;\n  /** Opengeni credit price after margin, rounded up to whole micros. */\n  creditCostMicros: number;\n};\n\n/** True when token usage can be priced exactly. */\nexport function voiceInputPricingHasTokenRates(pricing: VoiceInputPricing): boolean {\n  return (\n    pricing.inputMicrosPerMillionTokens !== undefined &&\n    pricing.outputMicrosPerMillionTokens !== undefined\n  );\n}\n\n/** Resolve the deployment override without changing unset per-price behavior. */\nfunction effectiveCreditMarginBps(\n  settings: Pick<Settings, \"creditMarginBpsOverride\">,\n  configuredMarginBps: number | undefined,\n): number {\n  return settings.creditMarginBpsOverride ?? configuredMarginBps ?? 0;\n}\n\n/**\n * Exact integer credit math. Token usage needs token rates; duration usage\n * uses `microsPerMinute` at millisecond resolution. Both round up once, after\n * summing, so a positive use never becomes a free debit.\n */\nexport function calculateVoiceInputCost(\n  pricing: VoiceInputPricing,\n  usage: VoiceInputUsage,\n  marginBpsOverride?: number,\n): VoiceInputCost {\n  let numerator: bigint;\n  let denominator: bigint;\n  if (usage.kind === \"tokens\") {\n    if (\n      pricing.inputMicrosPerMillionTokens === undefined ||\n      pricing.outputMicrosPerMillionTokens === undefined\n    ) {\n      throw new Error(\"voice-input token usage requires token pricing\");\n    }\n    for (const value of [\n      usage.inputTokens,\n      usage.audioInputTokens,\n      usage.textInputTokens,\n      usage.outputTokens,\n    ]) {\n      if (!Number.isSafeInteger(value) || value < 0) {\n        throw new Error(\"voice-input token usage must be non-negative integers\");\n      }\n    }\n    const audioRate =\n      pricing.audioInputMicrosPerMillionTokens ?? pricing.inputMicrosPerMillionTokens;\n    // Input tokens the provider did not attribute are priced as audio (never cheaper).\n    const unattributed = Math.max(\n      0,\n      usage.inputTokens - usage.audioInputTokens - usage.textInputTokens,\n    );\n    numerator =\n      BigInt(usage.audioInputTokens + unattributed) * BigInt(audioRate) +\n      BigInt(usage.textInputTokens) * BigInt(pricing.inputMicrosPerMillionTokens) +\n      BigInt(usage.outputTokens) * BigInt(pricing.outputMicrosPerMillionTokens);\n    denominator = 1_000_000n;\n  } else {\n    if (!Number.isFinite(usage.seconds) || usage.seconds < 0) {\n      throw new Error(\"voice-input duration must be a non-negative number of seconds\");\n    }\n    numerator = BigInt(Math.ceil(usage.seconds * 1_000)) * BigInt(pricing.microsPerMinute);\n    denominator = 60_000n;\n  }\n  const margin = BigInt(10_000 + (marginBpsOverride ?? pricing.marginBps ?? 0));\n  const provider = (numerator + denominator - 1n) / denominator;\n  const scaled = denominator * 10_000n;\n  const credit = (numerator * margin + scaled - 1n) / scaled;\n  if (credit > BigInt(Number.MAX_SAFE_INTEGER)) {\n    throw new Error(\"voice-input cost exceeds the supported billing range\");\n  }\n  return { providerCostMicros: Number(provider), creditCostMicros: Number(credit) };\n}\n\n/**\n * Deployment-funded providers that have credentials but are withheld because\n * credit billing is active and no price is known. The API logs these (and\n * malformed pricing, see {@link voiceInputPricingIssues}) once at startup so\n * an operator sees why voice input stayed unavailable.\n */\nexport function unpricedVoiceInputProviders(settings: Settings): VoiceInputProviderId[] {\n  return voiceInputPricingIssues(settings).flatMap((issue) =>\n    issue.reason === \"unpriced\" ? [issue.providerId] : [],\n  );\n}\n\n/** True when the deployment has at least one supported (non-experimental) provider. */\nexport function voiceInputDeploymentConfigured(settings: Settings): boolean {\n  return resolveVoiceInputProviderRegistry(settings).some(\n    (provider) =>\n      provider.kind !== \"codex-subscription\" && provider.kind !== \"supergrok-subscription\",\n  );\n}\n\nexport type TemporalTlsConnectionConfig = {\n  serverNameOverride?: string;\n  serverRootCACertificate?: Uint8Array;\n  clientCertPair?: {\n    crt: Uint8Array;\n    key: Uint8Array;\n  };\n};\nexport type TemporalConnectionOptions = {\n  address: string;\n  tls?: true | TemporalTlsConnectionConfig;\n  apiKey?: string;\n};\nexport type ModelPricing = {\n  inputMicrosPerMillionTokens: number;\n  cachedInputMicrosPerMillionTokens?: number | undefined;\n  cacheWriteMicrosPerMillionTokens?: number | undefined;\n  outputMicrosPerMillionTokens: number;\n  marginBps?: number | undefined;\n};\nexport type ModelPricingScheduleV1 = {\n  default: ModelPricing;\n  inputTokenTiers?:\n    | Array<{\n        minimumInputTokens: number;\n        pricing: ModelPricing;\n      }>\n    | undefined;\n};\nexport type ModelUsageInput = {\n  inputTokens?: number | undefined;\n  outputTokens?: number | undefined;\n  totalTokens?: number | undefined;\n  inputTokensDetails?: Record<string, number> | Array<Record<string, number>> | undefined;\n  requestUsageEntries?: ModelUsageInput[] | undefined;\n};\n\nexport type ModelUsageCostBreakdown = {\n  /** Provider-rate cost basis for the exact usage, before Opengeni margin. */\n  providerCostMicros: number;\n  /** Opengeni credit price after configured margin and latency-mode multiplier. */\n  creditCostMicros: number;\n};\n\nexport type ModelListCostClassesMicros = {\n  uncachedInput: number;\n  cacheRead: number;\n  cacheWrite: number;\n  output: number;\n};\n\nexport type ModelListUsageCostSnapshot = ModelUsageCostBreakdown & {\n  /** Captured upstream list costs, summing to providerCostMicros, never debits. */\n  listByClassMicros: ModelListCostClassesMicros | null;\n  /** True only when a returned class split includes latency rounding allocation. */\n  listByClassApprox: boolean;\n};\n\nexport type ModelRecordedListCostAllocation = {\n  /** Approximate attribution of a stored upstream total, never a new price. */\n  listByClassMicros: ModelListCostClassesMicros | null;\n  /** True for every eligible historical allocation, including known zero. */\n  listByClassApprox: boolean;\n};\n\nexport type StaticUsageLimitsConfig = StaticUsageLimits;\nexport type EntitlementsConfig = Entitlements;\n\nconst ModelPricingSchema = z.object({\n  inputMicrosPerMillionTokens: z.number().int().nonnegative(),\n  cachedInputMicrosPerMillionTokens: z.number().int().nonnegative().optional(),\n  cacheWriteMicrosPerMillionTokens: z.number().int().nonnegative().optional(),\n  outputMicrosPerMillionTokens: z.number().int().nonnegative(),\n  marginBps: z.number().int().min(0).max(100_000).optional(),\n});\n\nconst ModelPricingScheduleSchema = z\n  .object({\n    default: ModelPricingSchema,\n    inputTokenTiers: z\n      .array(\n        z.object({\n          minimumInputTokens: z.number().int().nonnegative(),\n          pricing: ModelPricingSchema,\n        }),\n      )\n      .optional(),\n  })\n  .superRefine((schedule, ctx) => {\n    let previous = -1;\n    for (const [index, tier] of (schedule.inputTokenTiers ?? []).entries()) {\n      if (tier.minimumInputTokens <= previous) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"inputTokenTiers\", index, \"minimumInputTokens\"],\n          message: \"input-token tier thresholds must be strictly increasing\",\n        });\n      }\n      previous = tier.minimumInputTokens;\n    }\n  });\n\nexport const CapabilitySupportV1 = z.enum([\"supported\", \"unsupported\", \"unknown\"]);\nexport type CapabilitySupportV1 = z.infer<typeof CapabilitySupportV1>;\n\nexport const CapabilityStateV1Schema = z\n  .object({\n    upstream: CapabilitySupportV1,\n    runnable: z.boolean(),\n  })\n  .superRefine((state, ctx) => {\n    if (state.upstream === \"unsupported\" && state.runnable) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"runnable\"],\n        message: \"an upstream-unsupported capability cannot be runnable\",\n      });\n    }\n  });\nexport type CapabilityStateV1 = z.infer<typeof CapabilityStateV1Schema>;\n\nconst ModelModalityV1 = z.enum([\"text\", \"image\", \"audio\"]);\nconst ModelLatencyModeV1 = z.enum([\"standard\", \"priority\", \"fast\", \"ultrafast\"]);\n\nexport const ModelCapabilitiesV1Schema = z\n  .object({\n    reasoning: CapabilityStateV1Schema.extend({\n      efforts: z.array(ReasoningEffort),\n      defaultEffort: ReasoningEffort.nullable(),\n      required: z.boolean(),\n    }),\n    functionCalling: CapabilityStateV1Schema,\n    structuredOutput: CapabilityStateV1Schema,\n    hostedTools: z.object({\n      webSearch: CapabilityStateV1Schema,\n      xSearch: CapabilityStateV1Schema,\n      codeExecution: CapabilityStateV1Schema,\n      imageGeneration: CapabilityStateV1Schema.default({\n        upstream: \"unknown\",\n        runnable: false,\n      }),\n    }),\n    inputModalities: z.array(ModelModalityV1).min(1),\n    /** Exact MIME types accepted as typed `input_file`; `text/*` is allowed. */\n    inputFileMediaTypes: z.array(z.string()).default([]),\n    outputModalities: z.array(ModelModalityV1).min(1),\n    transports: z.object({\n      sse: CapabilityStateV1Schema,\n      responsesWebSocket: CapabilityStateV1Schema,\n      realtimeAudio: CapabilityStateV1Schema,\n    }),\n    promptCaching: CapabilityStateV1Schema.extend({\n      mode: z.enum([\"implicit\", \"automatic\", \"none\"]),\n    }).optional(),\n    latencyModes: z\n      .array(\n        z.object({\n          id: ModelLatencyModeV1,\n          upstream: CapabilitySupportV1,\n          runnable: z.boolean(),\n          billingMultiplierBps: z.number().int().positive().optional(),\n        }),\n      )\n      .min(1),\n  })\n  .superRefine((capabilities, ctx) => {\n    const efforts = new Set(capabilities.reasoning.efforts);\n    if (efforts.size !== capabilities.reasoning.efforts.length) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reasoning\", \"efforts\"],\n        message: \"reasoning efforts must be unique\",\n      });\n    }\n    if (\n      capabilities.reasoning.defaultEffort !== null &&\n      !efforts.has(capabilities.reasoning.defaultEffort)\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reasoning\", \"defaultEffort\"],\n        message: \"the default reasoning effort must be one of the supported efforts\",\n      });\n    }\n    if (capabilities.reasoning.runnable && capabilities.reasoning.efforts.length === 0) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reasoning\", \"efforts\"],\n        message: \"a runnable reasoning capability must declare at least one effort\",\n      });\n    }\n    for (const field of [\"inputModalities\", \"outputModalities\"] as const) {\n      if (new Set(capabilities[field]).size !== capabilities[field].length) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [field],\n          message: `${field} must be unique`,\n        });\n      }\n    }\n    const latencyIds = new Set<string>();\n    for (const [index, mode] of capabilities.latencyModes.entries()) {\n      if (latencyIds.has(mode.id)) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"latencyModes\", index, \"id\"],\n          message: \"latency mode ids must be unique\",\n        });\n      }\n      latencyIds.add(mode.id);\n      if (mode.upstream === \"unsupported\" && mode.runnable) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"latencyModes\", index, \"runnable\"],\n          message: \"an upstream-unsupported latency mode cannot be runnable\",\n        });\n      }\n    }\n  });\nexport type ModelCapabilitiesV1 = z.infer<typeof ModelCapabilitiesV1Schema>;\n\nexport type ModelDeploymentV1 = {\n  upstreamModelId: string;\n  wireApi: ModelProviderApi;\n};\n\nexport type ModelExecutionLimitsV1 = {\n  contextWindowTokens: number | null;\n  effectiveContextWindowTokens: number | null;\n  autoCompactTokenLimit: number | null;\n  toolOutputTruncationTokens: number | null;\n};\n\nexport type CredentialSourceV1 =\n  | { kind: \"deployment\"; mechanism: \"api_key\" | \"azure_ad_bearer\" | \"none\" }\n  | { kind: \"connected_subscription\"; provider: \"codex\" | \"xai\" | \"claude\" }\n  | { kind: \"workspace_connection\"; mechanism: \"api_key\" }\n  | { kind: \"organization_connection\"; mechanism: \"api_key\" };\n\nexport type BillingAttributionV1 = {\n  upstreamPayer: \"deployment\" | \"workspace\" | \"organization\" | \"connected_subscription\";\n  metering: \"opengeni_credits\" | \"external\";\n};\n\n/**\n * Wire API a provider speaks. The built-in OpenAI/Azure provider always uses\n * \"responses\" (the OpenAI Responses API). Extra registry providers default to\n * \"chat\" (the broadly compatible /v1/chat/completions surface); Fireworks is\n * wired as \"chat\" because its beta Responses endpoint echoes input back and\n * silently no-ops hosted tools (see docs/model-providers.md).\n */\nexport const ModelProviderApi = z.enum([\"responses\", \"chat\", \"anthropic-messages\"]);\nexport type ModelProviderApi = z.infer<typeof ModelProviderApi>;\n\n/**\n * Provider-specific request semantics that are independent of the endpoint's\n * OpenAI-compatible wire API. Secondary Azure resources still speak the\n * Responses API, but need Azure's stricter computer-call normalization.\n */\nexport const ModelProviderWireProfile = z.enum([\"openai\", \"azure-openai\"]);\nexport type ModelProviderWireProfile = z.infer<typeof ModelProviderWireProfile>;\n\n/**\n * Registry provider kind. \"api-key\" providers carry their own static key/headers;\n * \"anonymous\" providers intentionally send no credential and are externally\n * metered; connected-subscription providers resolve a workspace account token\n * at call time and never carry a static key in the registry definition.\n */\nexport const RegistryProviderKind = z.enum([\n  \"api-key\",\n  \"anonymous\",\n  \"codex-subscription\",\n  \"xai-subscription\",\n  \"vercel-gateway-managed\",\n  \"vercel-gateway-workspace\",\n  \"vercel-gateway-organization\",\n  \"direct-openai-workspace\",\n  \"direct-azure-workspace\",\n  \"direct-openai-organization\",\n  \"direct-azure-organization\",\n  \"openrouter-workspace\",\n  \"openrouter-organization\",\n  \"opper-workspace\",\n  \"opper-organization\",\n  \"anthropic-organization\",\n  \"claude-subscription-organization\",\n  \"anthropic-workspace\",\n  \"claude-subscription-workspace\",\n]);\nexport type RegistryProviderKind = z.infer<typeof RegistryProviderKind>;\n\n/** A single model exposed by a registry provider. */\nconst ModelLogoUrlSchema = z\n  .string()\n  .refine(\n    (value) => modelLogoUrl({ id: \"\", logoUrl: value }) !== null,\n    \"model logoUrl must be an HTTPS URL without embedded credentials, at most 2048 characters\",\n  );\n\nconst RegistryModelSchema = z\n  .object({\n    id: z.string().min(1), // canonical Opengeni product id\n    upstreamModelId: z.string().min(1).optional(), // exact provider slug; defaults to id\n    aliases: z.array(z.string().min(1)).optional(), // accepted input only; never sent upstream\n    label: z.string().min(1).optional(), // display name; defaults to id\n    shortLabel: z.string().min(1).max(64).optional(), // compact UI label; optional\n    logoUrl: ModelLogoUrlSchema.optional(),\n    contextWindowTokens: z.number().int().positive().optional(),\n    effectiveContextWindowTokens: z.number().int().positive().optional(),\n    autoCompactTokenLimit: z.number().int().positive().optional(),\n    // Canonical model-facing function/tool-result policy. The runtime applies\n    // the same 1.2x serialization allowance as Codex when materializing output.\n    toolOutputTruncationTokens: z.number().int().positive().optional(),\n    reasoningEffort: z.boolean().optional(), // legacy compatibility input/projection\n    hostedWebSearch: z.boolean().optional(), // legacy compatibility input/projection\n    capabilities: ModelCapabilitiesV1Schema.optional(),\n    pricing: z.union([ModelPricingSchema, ModelPricingScheduleSchema]).optional(),\n    // Reserved normalized contracts are derived by Opengeni in V1. Generic\n    // registry JSON must not opt itself into workspace BYOK or reattribute cost.\n    credentialSource: z.never().optional(),\n    billing: z.never().optional(),\n  })\n  .superRefine((model, ctx) => {\n    if (\n      model.capabilities &&\n      model.reasoningEffort !== undefined &&\n      model.reasoningEffort !== model.capabilities.reasoning.runnable\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reasoningEffort\"],\n        message: \"legacy reasoningEffort must agree with capabilities.reasoning.runnable\",\n      });\n    }\n    if (\n      model.capabilities &&\n      model.hostedWebSearch !== undefined &&\n      model.hostedWebSearch !== model.capabilities.hostedTools.webSearch.runnable\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"hostedWebSearch\"],\n        message:\n          \"legacy hostedWebSearch must agree with capabilities.hostedTools.webSearch.runnable\",\n      });\n    }\n  });\n\n/** A non-built-in provider declared by the host via OPENGENI_MODEL_PROVIDERS_JSON. */\nexport const ClaudeSubscriptionIdentity = z\n  .object({\n    accountUuid: z.union([z.string().uuid(), z.literal(\"\")]),\n    deviceId: z.string().regex(/^[a-f0-9]{64}$/),\n  })\n  .strict();\nexport type ClaudeSubscriptionIdentity = z.infer<typeof ClaudeSubscriptionIdentity>;\nexport const ClaudeSubscriptionCredential = z\n  .object({\n    version: z.literal(1),\n    token: z.string().regex(/^sk-ant-oat[0-9]+-\\S+$/),\n    identity: ClaudeSubscriptionIdentity,\n    oauth: z\n      .object({\n        refreshToken: z.string().min(1).max(16384),\n        expiresAt: z.string().datetime(),\n        scopes: z.array(z.string().min(1).max(256)).min(1).max(32),\n      })\n      .strict()\n      .optional(),\n  })\n  .strict();\nconst AnthropicProviderOptions = z.object({\n  identity: ClaudeSubscriptionIdentity.optional(),\n  // Native connection provenance only; never included in Anthropic request bodies.\n  credentialBinding: z\n    .object({\n      connectionId: z.string().uuid(),\n      credentialVersion: z.number().int().positive(),\n    })\n    .strict()\n    .optional(),\n  auth: z.enum([\"api-key\", \"oauth\"]).default(\"api-key\"),\n  cacheTtl: z.enum([\"5m\", \"1h\", \"off\"]).default(\"5m\"),\n  maxOutputTokens: z.number().int().positive().default(32000),\n  streamIdleTimeoutMs: z.number().int().positive().default(600000),\n});\n\nconst RegistryProviderSchema = z\n  .object({\n    kind: RegistryProviderKind.default(\"api-key\"),\n    id: z.string().min(1).regex(registryId), // stable provider id, e.g. \"fireworks\"\n    label: z.string().min(1).optional(),\n    api: ModelProviderApi.default(\"chat\"),\n    anthropic: AnthropicProviderOptions.optional(),\n    // Generic OpenAI-compatible stream silence bound; overrides the deployment\n    // `modelStreamIdleTimeoutMs` for this provider only.\n    streamIdleTimeoutMs: z\n      .number()\n      .int()\n      .positive()\n      .max(24 * 60 * 60_000)\n      .optional(),\n    streamProgressTimeoutMs: z\n      .number()\n      .int()\n      .positive()\n      .max(24 * 60 * 60_000)\n      .optional(),\n    wireProfile: ModelProviderWireProfile.default(\"openai\"),\n    baseUrl: z.string().url(),\n    apiKey: z.string().optional(), // inline key (pragmatic) ...\n    apiKeyEnv: z.string().optional(), // ... OR name of the env var holding the key (preferred)\n    defaultQuery: z.record(z.string(), z.string()).optional(),\n    defaultHeaders: z.record(z.string(), z.string()).optional(),\n    publicDefaultQueryNames: z.array(z.string().min(1)).optional(),\n    publicDefaultHeaderNames: z.array(z.string().min(1)).optional(),\n    // V1 derives these from provider kind. Workspace BYOK is deliberately not a\n    // registry switch and requires a separately reviewed encrypted broker.\n    credentialSource: z.never().optional(),\n    billing: z.never().optional(),\n    models: z.array(RegistryModelSchema).min(1),\n  })\n  .superRefine((provider, ctx) => {\n    if (provider.kind !== \"anonymous\") {\n      return;\n    }\n    if (provider.apiKey !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"apiKey\"],\n        message: \"anonymous providers must not declare apiKey\",\n      });\n    }\n    if (provider.apiKeyEnv !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"apiKeyEnv\"],\n        message: \"anonymous providers must not declare apiKeyEnv\",\n      });\n    }\n    if (provider.defaultHeaders !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"defaultHeaders\"],\n        message: \"anonymous providers must not declare defaultHeaders\",\n      });\n    }\n    if (provider.defaultQuery !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"defaultQuery\"],\n        message: \"anonymous providers must not declare defaultQuery\",\n      });\n    }\n    if (provider.publicDefaultHeaderNames !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"publicDefaultHeaderNames\"],\n        message: \"anonymous providers must not declare publicDefaultHeaderNames\",\n      });\n    }\n    if (provider.publicDefaultQueryNames !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"publicDefaultQueryNames\"],\n        message: \"anonymous providers must not declare publicDefaultQueryNames\",\n      });\n    }\n  });\nexport type RegistryProvider = z.infer<typeof RegistryProviderSchema>;\n\nexport const OPENGENI_GATEWAY_PROVIDER_ID = \"opengeni-gateway\" as const;\nexport const WORKSPACE_GATEWAY_PROVIDER_ID = \"workspace-gateway\" as const;\nexport const WORKSPACE_GATEWAY_MODEL_ID_PREFIX = \"workspace-gateway/\" as const;\nexport const ORGANIZATION_GATEWAY_PROVIDER_ID = \"organization-gateway\" as const;\nexport const ORGANIZATION_GATEWAY_MODEL_ID_PREFIX = \"organization-gateway/\" as const;\nexport const OPENROUTER_PROVIDER_ID = \"openrouter\" as const;\nexport const OPENROUTER_MODEL_ID_PREFIX = \"openrouter/\" as const;\nexport const WORKSPACE_OPENROUTER_PROVIDER_ID = \"workspace-openrouter\" as const;\nexport const WORKSPACE_OPENROUTER_MODEL_ID_PREFIX = \"workspace-openrouter/\" as const;\nexport const ORGANIZATION_OPENROUTER_PROVIDER_ID = \"organization-openrouter\" as const;\nexport const ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX = \"organization-openrouter/\" as const;\nexport const OPENROUTER_BASE_URL = \"https://openrouter.ai/api/v1\" as const;\nexport const OPPER_PROVIDER_ID = \"opper\" as const;\nexport const OPPER_MODEL_ID_PREFIX = \"opper/\" as const;\nexport const WORKSPACE_OPPER_PROVIDER_ID = \"workspace-opper\" as const;\nexport const WORKSPACE_OPPER_MODEL_ID_PREFIX = \"workspace-opper/\" as const;\nexport const ORGANIZATION_OPPER_PROVIDER_ID = \"organization-opper\" as const;\nexport const ORGANIZATION_OPPER_MODEL_ID_PREFIX = \"organization-opper/\" as const;\n/**\n * Organization-owned OpenAI and Azure OpenAI: one connection each (an API key,\n * plus a resource endpoint for Azure) whose curated models (Azure deployments)\n * inherit into shared workspaces.\n */\nexport const ORGANIZATION_OPENAI_PROVIDER_ID = \"organization-openai\" as const;\nexport const ORGANIZATION_OPENAI_MODEL_ID_PREFIX = \"organization-openai/\" as const;\nexport const ORGANIZATION_AZURE_OPENAI_PROVIDER_ID = \"organization-azure-openai\" as const;\nexport const ORGANIZATION_AZURE_OPENAI_MODEL_ID_PREFIX = \"organization-azure-openai/\" as const;\n/** Opper's OpenAI-compatible Chat Completions surface (Bearer key). */\nexport const OPPER_BASE_URL = \"https://api.opper.ai/v3/compat\" as const;\n\nconst RESERVED_MODEL_PROVIDER_IDS = new Set<string>([\n  \"openai\",\n  \"azure\",\n  CODEX_PROVIDER_ID,\n  XAI_SUBSCRIPTION_PROVIDER_ID,\n  OPENGENI_GATEWAY_PROVIDER_ID,\n  WORKSPACE_GATEWAY_PROVIDER_ID,\n  ORGANIZATION_GATEWAY_PROVIDER_ID,\n  OPENROUTER_PROVIDER_ID,\n  WORKSPACE_OPENROUTER_PROVIDER_ID,\n  ORGANIZATION_OPENROUTER_PROVIDER_ID,\n  OPPER_PROVIDER_ID,\n  WORKSPACE_OPPER_PROVIDER_ID,\n  ORGANIZATION_OPPER_PROVIDER_ID,\n  ORGANIZATION_OPENAI_PROVIDER_ID,\n  ORGANIZATION_AZURE_OPENAI_PROVIDER_ID,\n  \"organization-anthropic\",\n  \"organization-claude-subscription\",\n  \"workspace-anthropic\",\n  \"workspace-claude-subscription\",\n]);\n\nexport const ModelCostClass = z.enum([\"free\", \"credits\"]);\nexport type ModelCostClass = z.infer<typeof ModelCostClass>;\n\nexport const ConfiguredModelCostClass = z.enum([\n  \"free\",\n  \"credits\",\n  \"subscription\",\n  \"workspace\",\n  \"organization\",\n]);\nexport type ConfiguredModelCostClass = z.infer<typeof ConfiguredModelCostClass>;\n\nconst ModelNote = z\n  .string()\n  .max(500)\n  .refine((value) => !/[\\r\\n|]/u.test(value), {\n    message: \"model notes must not contain newlines or the | field separator\",\n  });\n\nexport function parseModelCostPolicyJson(raw: string): Record<string, ModelCostClass> {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    throw new Error(\n      `OPENGENI_MODEL_COST_POLICY_JSON must be valid JSON: ${error instanceof Error ? error.message : String(error)}`,\n      { cause: error },\n    );\n  }\n  return z.record(z.string().min(1), ModelCostClass).parse(parsed);\n}\n\nexport function parseModelNotesJson(raw: string): Record<string, string> {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    throw new Error(\n      `OPENGENI_MODEL_NOTES_JSON must be valid JSON: ${error instanceof Error ? error.message : String(error)}`,\n      { cause: error },\n    );\n  }\n  return z.record(z.string().min(1), ModelNote).parse(parsed);\n}\n\nexport function configuredModelNotes(\n  settings: Pick<Settings, \"modelNotesJson\">,\n): Record<string, string> {\n  return parseModelNotesJson(settings.modelNotesJson);\n}\n\nexport const GatewayCatalogModel = z\n  .object({\n    productId: z.string().min(1),\n    workspaceProductId: z.string().min(1).startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX),\n    upstreamModelId: z.string().min(1),\n    label: z.string().min(1),\n    shortLabel: z.string().min(1).max(64).optional(),\n    logoUrl: ModelLogoUrlSchema.optional(),\n    providers: z.array(z.string().min(1)).min(1),\n    implicitCaching: z.boolean().default(false),\n    vision: z.boolean().default(false),\n    inputFileMediaTypes: z.array(z.string().min(1)).default([]),\n    contextWindowTokens: z.number().int().positive().default(1_000_000),\n    effectiveContextWindowTokens: z.number().int().positive().default(900_000),\n    autoCompactTokenLimit: z.number().int().positive().default(850_000),\n    pricing: z.union([ModelPricingSchema, ModelPricingScheduleSchema]).optional(),\n    credentialSource: z.never().optional(),\n    billing: z.never().optional(),\n    apiKey: z.never().optional(),\n  })\n  .strict();\nexport type GatewayCatalogModel = z.infer<typeof GatewayCatalogModel>;\n\nexport const OpenRouterCatalogModel = z\n  .object({\n    upstreamModelId: z.string().min(1).endsWith(\":free\"),\n    label: z.string().min(1),\n    shortLabel: z.string().min(1).max(64).optional(),\n    logoUrl: ModelLogoUrlSchema.optional(),\n    aliases: z.array(z.string().min(1)).default([]),\n    capabilities: ModelCapabilitiesV1Schema,\n    contextWindowTokens: z.number().int().positive().optional(),\n    effectiveContextWindowTokens: z.number().int().positive().optional(),\n    autoCompactTokenLimit: z.number().int().positive().optional(),\n    toolOutputTruncationTokens: z.number().int().positive().optional(),\n    credentialSource: z.never().optional(),\n    billing: z.never().optional(),\n    pricing: z.never().optional(),\n    apiKey: z.never().optional(),\n  })\n  .strict();\nexport type OpenRouterCatalogModel = z.infer<typeof OpenRouterCatalogModel>;\n\n/**\n * One reviewed Opper route. `upstreamModelId` is Opper's exact catalogue id:\n * a bare upstream name is a pool (Opper picks the serving provider), while a\n * `provider/model` id pins one route and region. Curated entries pin a route.\n * Code-defined entries may carry a reviewed price; database documents may not.\n */\nexport const OpperCatalogModel = z\n  .object({\n    upstreamModelId: z\n      .string()\n      .min(1)\n      .max(200)\n      .regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*(?:\\/[A-Za-z0-9][A-Za-z0-9._:-]*)*$/u),\n    label: z.string().min(1),\n    shortLabel: z.string().min(1).max(64).optional(),\n    logoUrl: ModelLogoUrlSchema.optional(),\n    aliases: z.array(z.string().min(1)).default([]),\n    capabilities: ModelCapabilitiesV1Schema,\n    contextWindowTokens: z.number().int().positive().optional(),\n    effectiveContextWindowTokens: z.number().int().positive().optional(),\n    autoCompactTokenLimit: z.number().int().positive().optional(),\n    toolOutputTruncationTokens: z.number().int().positive().optional(),\n    /** Opper's advertised `max_output_tokens` for this route. Sent as\n     * `max_tokens` on every Chat request that does not set its own, because\n     * Opper otherwise caps output at 4,096 tokens, which hidden reasoning can\n     * exhaust before any answer. Must not exceed the route's real limit:\n     * Opper rejects (400), it does not clamp. */\n    maxOutputTokens: z.number().int().positive().optional(),\n    pricing: z.union([ModelPricingSchema, ModelPricingScheduleSchema]).optional(),\n    credentialSource: z.never().optional(),\n    billing: z.never().optional(),\n    apiKey: z.never().optional(),\n  })\n  .strict();\nexport type OpperCatalogModel = z.infer<typeof OpperCatalogModel>;\n\nconst DeploymentRegistryBaseUrl = z\n  .string()\n  .url()\n  .superRefine((value, context) => {\n    const url = new URL(value);\n    if (url.username || url.password) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"database catalog provider baseUrl must not contain userinfo\",\n      });\n    }\n    if (url.search) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"database catalog provider baseUrl must not contain a query\",\n      });\n    }\n    if (url.hash) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"database catalog provider baseUrl must not contain a fragment\",\n      });\n    }\n  });\n\nconst DeploymentRegistryProviderKind = z.enum([\"api-key\", \"anonymous\"]);\n\nconst DeploymentRegistryModelSchema = RegistryModelSchema.safeExtend({\n  pricing: z.never().optional(),\n}).strict();\n\nconst DeploymentRegistryProviderSchema = RegistryProviderSchema.safeExtend({\n  kind: DeploymentRegistryProviderKind.default(\"api-key\"),\n  baseUrl: DeploymentRegistryBaseUrl,\n  models: z.array(DeploymentRegistryModelSchema).min(1),\n  apiKey: z.never().optional(),\n  apiKeyEnv: z.never().optional(),\n  defaultHeaders: z.never().optional(),\n  defaultQuery: z.never().optional(),\n  publicDefaultHeaderNames: z.never().optional(),\n  publicDefaultQueryNames: z.never().optional(),\n}).strict();\n\nconst DeploymentGatewayCatalogModelSchema = GatewayCatalogModel.safeExtend({\n  pricing: z.never().optional(),\n}).strict();\n\nconst DeploymentOpperCatalogModelSchema = OpperCatalogModel.safeExtend({\n  pricing: z.never().optional(),\n}).strict();\n\nconst CodexCatalogModelSchema = RegistryModelSchema.safeExtend({\n  retired: z.boolean().optional(),\n  id: z.string().regex(/^codex\\/[a-zA-Z0-9][a-zA-Z0-9._-]*$/),\n  upstreamModelId: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/),\n  capabilities: ModelCapabilitiesV1Schema,\n  pricing: z.never().optional(),\n})\n  .strict()\n  .superRefine((model, context) => {\n    if (model.id !== `${CODEX_MODEL_ID_PREFIX}${model.upstreamModelId}`) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"id\"],\n        message: \"Codex product id must match its upstream model slug\",\n      });\n    }\n  })\n  .transform((model) => ({\n    ...model,\n    capabilities: reviewedCodexCatalogCapabilities(model.upstreamModelId, model.capabilities),\n  }));\n\nexport const ModelCatalogDocument = z\n  .object({\n    schemaVersion: z.literal(1),\n    /** Canonical deployment default. Omission preserves the V1 first-built-in\n     * fallback for existing documents; operators should set this explicitly\n     * when cutting over a registry or connected-subscription default. */\n    defaultModel: z.string().min(1).optional(),\n    builtInModels: z.array(z.string().min(1)),\n    registryProviders: z.array(DeploymentRegistryProviderSchema).default([]),\n    codexModels: z.array(CodexCatalogModelSchema).optional(),\n    gatewayModels: z.array(DeploymentGatewayCatalogModelSchema).default([]),\n    openrouterModels: z.array(OpenRouterCatalogModel).default([]),\n    /** Reviewed paid Opper routes. Membership only: price comes from Opper's\n     * per-response reported cost, with the reviewed code snapshot (or\n     * OPENGENI_MODEL_PRICING_JSON) as fallback/validation, never here. */\n    opperModels: z.array(DeploymentOpperCatalogModelSchema).default([]),\n    modelNotes: z.record(z.string().min(1), ModelNote).default({}),\n    billing: z.never().optional(),\n    enabled: z.never().optional(),\n    apiKey: z.never().optional(),\n    bands: z.never().optional(),\n  })\n  .strict()\n  .superRefine((document, context) => {\n    if (document.builtInModels.length === 0 && !document.defaultModel) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"defaultModel\"],\n        message: \"catalogs without built-in models require an explicit default model\",\n      });\n    }\n    const productIds = new Set<string>();\n    const providerIds = new Set<string>();\n    const gatewayUpstreamIds = new Set<string>();\n    const add = (id: string, path: Array<string | number>): void => {\n      if (/[\\u000A\\u000D|]/u.test(id)) {\n        context.addIssue({\n          code: \"custom\",\n          path,\n          message: \"catalog product ids must not contain newlines or the | field separator\",\n        });\n      }\n      if (productIds.has(id)) {\n        context.addIssue({\n          code: \"custom\",\n          path,\n          message: `duplicate product id ${id}`,\n        });\n      }\n      productIds.add(id);\n    };\n    document.builtInModels.forEach((id, index) => add(id, [\"builtInModels\", index]));\n    document.codexModels?.forEach((model, index) => add(model.id, [\"codexModels\", index, \"id\"]));\n    if (\n      document.codexModels?.some((model) => model.retired && model.id === document.defaultModel)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"defaultModel\"],\n        message: \"a retired model cannot be the deployment default\",\n      });\n    }\n    document.registryProviders.forEach((provider, providerIndex) => {\n      if (\n        RESERVED_MODEL_PROVIDER_IDS.has(provider.id) ||\n        provider.id.startsWith(\"workspace-openai-\") ||\n        provider.id.startsWith(\"workspace-azure-openai-\")\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"registryProviders\", providerIndex, \"id\"],\n          message: `provider id ${provider.id} is reserved for a reviewed Opengeni provider`,\n        });\n      }\n      if (providerIds.has(provider.id)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"registryProviders\", providerIndex, \"id\"],\n          message: `duplicate provider id ${provider.id}`,\n        });\n      }\n      providerIds.add(provider.id);\n      provider.models.forEach((model, modelIndex) =>\n        add(model.id, [\"registryProviders\", providerIndex, \"models\", modelIndex, \"id\"]),\n      );\n    });\n    document.gatewayModels.forEach((model, index) => {\n      if (gatewayUpstreamIds.has(model.upstreamModelId)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"gatewayModels\", index, \"upstreamModelId\"],\n          message: `duplicate Gateway upstream model id ${model.upstreamModelId}`,\n        });\n      }\n      gatewayUpstreamIds.add(model.upstreamModelId);\n      add(model.productId, [\"gatewayModels\", index, \"productId\"]);\n      add(model.workspaceProductId, [\"gatewayModels\", index, \"workspaceProductId\"]);\n    });\n    document.openrouterModels.forEach((model, index) =>\n      add(`${OPENROUTER_MODEL_ID_PREFIX}${model.upstreamModelId}`, [\n        \"openrouterModels\",\n        index,\n        \"upstreamModelId\",\n      ]),\n    );\n    document.opperModels.forEach((model, index) =>\n      add(`${OPPER_MODEL_ID_PREFIX}${model.upstreamModelId}`, [\n        \"opperModels\",\n        index,\n        \"upstreamModelId\",\n      ]),\n    );\n    if (document.defaultModel && /[\\u000A\\u000D|]/u.test(document.defaultModel)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"defaultModel\"],\n        message: \"catalog default model must not contain newlines or the | field separator\",\n      });\n    }\n    if (\n      document.defaultModel &&\n      !productIds.has(document.defaultModel) &&\n      !(\n        document.codexModels === undefined &&\n        document.defaultModel.startsWith(CODEX_MODEL_ID_PREFIX)\n      ) &&\n      !document.defaultModel.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"defaultModel\"],\n        message:\n          \"catalog default model must reference deployment catalog membership or a connected-subscription product\",\n      });\n    }\n    for (const productId of Object.keys(document.modelNotes)) {\n      if (!productIds.has(productId)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"modelNotes\", productId],\n          message: \"model note references a product id outside the deployment catalog\",\n        });\n      }\n    }\n  });\nexport type ModelCatalogDocument = z.infer<typeof ModelCatalogDocument>;\n\nexport function parseModelCatalogDocument(value: unknown): ModelCatalogDocument {\n  return ModelCatalogDocument.parse(value);\n}\n\nfunction deploymentRegistryProvidersWithHostCredentials(\n  settings: Settings,\n  providers: readonly z.infer<typeof DeploymentRegistryProviderSchema>[],\n): RegistryProvider[] {\n  const hostProviders = new Map(\n    parseModelProvidersJson(settings.modelProvidersJson).map((provider) => [provider.id, provider]),\n  );\n  return providers.map((provider) => {\n    if (provider.kind !== \"api-key\") return provider;\n    const host = hostProviders.get(provider.id);\n    if (!host || host.kind !== \"api-key\") {\n      throw new Error(\n        `database model catalog provider ${provider.id} has no matching host-authorized api-key transport`,\n      );\n    }\n    const transportIdentity = (candidate: typeof provider | RegistryProvider) => ({\n      kind: candidate.kind,\n      baseUrl: candidate.baseUrl,\n      api: candidate.api,\n      wireProfile: candidate.wireProfile,\n    });\n    if (canonicalJson(transportIdentity(provider)) !== canonicalJson(transportIdentity(host))) {\n      throw new Error(\n        `database model catalog provider ${provider.id} does not match its host-authorized transport`,\n      );\n    }\n    return {\n      ...provider,\n      ...(host.defaultHeaders === undefined ? {} : { defaultHeaders: host.defaultHeaders }),\n      ...(host.defaultQuery === undefined ? {} : { defaultQuery: host.defaultQuery }),\n      ...(host.publicDefaultHeaderNames === undefined\n        ? {}\n        : { publicDefaultHeaderNames: host.publicDefaultHeaderNames }),\n      ...(host.publicDefaultQueryNames === undefined\n        ? {}\n        : { publicDefaultQueryNames: host.publicDefaultQueryNames }),\n      ...(host.apiKey === undefined ? {} : { apiKey: host.apiKey }),\n      ...(host.apiKeyEnv === undefined ? {} : { apiKeyEnv: host.apiKeyEnv }),\n    };\n  });\n}\n\n/** Pure secret-free database catalog overlay. getSettings remains env-only. */\n/**\n * OPENGENI_MANAGED_MODELS_JSON: the managed-provider slice of a catalog\n * document for code catalog mode. Each present array uses the database\n * document's exact strict entry schema (so no entry may carry `pricing`,\n * credentials, or billing) and replaces that provider's reviewed code table;\n * an omitted array keeps it. Price authority stays with provider-reported\n * cost (Gateway/Opper), the reviewed code snapshot, and\n * OPENGENI_MODEL_PRICING_JSON, which boot validation requires for every\n * credits-billed product without a reviewed price.\n */\nexport const ManagedModelsOverride = z\n  .object({\n    gatewayModels: z.array(DeploymentGatewayCatalogModelSchema).optional(),\n    openrouterModels: z.array(OpenRouterCatalogModel).optional(),\n    opperModels: z.array(DeploymentOpperCatalogModelSchema).optional(),\n  })\n  .strict()\n  .superRefine((override, context) => {\n    const unique = (\n      key: \"gatewayModels\" | \"openrouterModels\" | \"opperModels\",\n      ids: (model: { upstreamModelId: string }) => string[],\n    ) => {\n      const seen = new Set<string>();\n      (override[key] ?? []).forEach((model, index) => {\n        for (const id of ids(model)) {\n          if (seen.has(id)) {\n            context.addIssue({\n              code: \"custom\",\n              path: [key, index, \"upstreamModelId\"],\n              message: `duplicate ${key} model id ${id}`,\n            });\n          }\n          seen.add(id);\n        }\n      });\n    };\n    unique(\"gatewayModels\", (model) => {\n      const gateway = model as GatewayCatalogModel;\n      return [gateway.upstreamModelId, gateway.productId, gateway.workspaceProductId];\n    });\n    unique(\"openrouterModels\", (model) => [\n      model.upstreamModelId,\n      ...(model as OpenRouterCatalogModel).aliases,\n    ]);\n    unique(\"opperModels\", (model) => [\n      model.upstreamModelId,\n      ...(model as OpperCatalogModel).aliases,\n    ]);\n  });\nexport type ManagedModelsOverride = z.infer<typeof ManagedModelsOverride>;\n\nconst parsedManagedModelsJson = new Map<string, ManagedModelsOverride>();\n\n/** Parse and validate OPENGENI_MANAGED_MODELS_JSON (memoized per raw value). */\nexport function parseManagedModelsJson(raw: string): ManagedModelsOverride {\n  const cached = parsedManagedModelsJson.get(raw);\n  if (cached) return cached;\n  let json: unknown;\n  try {\n    json = JSON.parse(raw);\n  } catch (error) {\n    throw new Error(\"OPENGENI_MANAGED_MODELS_JSON must be valid JSON\", { cause: error });\n  }\n  const result = ManagedModelsOverride.safeParse(json);\n  if (!result.success) {\n    throw new Error(\n      `OPENGENI_MANAGED_MODELS_JSON is invalid: ${result.error.issues\n        .map((issue) => `${issue.path.join(\".\") || \"(root)\"}: ${issue.message}`)\n        .join(\"; \")}`,\n    );\n  }\n  if (parsedManagedModelsJson.size > 16) parsedManagedModelsJson.clear();\n  parsedManagedModelsJson.set(raw, result.data);\n  return result.data;\n}\n\n/** The code-mode managed model override; always empty in database mode. */\nfunction codeModeManagedModels(settings: Settings): ManagedModelsOverride {\n  if (settings.modelCatalogSource !== \"code\" || !settings.managedModelsJson?.trim()) return {};\n  return parseManagedModelsJson(settings.managedModelsJson);\n}\n\nexport function applyModelCatalogDocument(settings: Settings, rawDocument: unknown): Settings {\n  const document = parseModelCatalogDocument(rawDocument);\n  const defaultModel = document.defaultModel ?? document.builtInModels[0]!;\n  const resolved = {\n    ...settings,\n    openaiModel: defaultModel,\n    // Keep the complete built-in membership, including the default. The worker\n    // replaces openaiModel with the exact turn model; the run-scoped router\n    // needs one stable built-in id in this allow-list so a bare provider model\n    // is not temporarily claimed by OpenAI/Azure during name re-resolution.\n    openaiAllowedModels: document.builtInModels.join(\",\"),\n    modelProvidersJson: JSON.stringify(\n      deploymentRegistryProvidersWithHostCredentials(settings, document.registryProviders),\n    ),\n    resolvedGatewayModelsJson: JSON.stringify(document.gatewayModels),\n    resolvedOpenRouterModelsJson: JSON.stringify(document.openrouterModels),\n    resolvedOpperModelsJson: JSON.stringify(document.opperModels),\n    resolvedCodexModelsJson:\n      document.codexModels === undefined ? undefined : JSON.stringify(document.codexModels),\n    modelNotesJson: JSON.stringify(document.modelNotes),\n  };\n  return resolved;\n}\n\nexport const IntegrationOAuthClientConfigSchema = z.object({\n  clientId: z.string().min(1),\n  clientSecret: z.string().min(1).optional(),\n  tokenEndpointAuthMethod: z\n    .enum([\"none\", \"client_secret_post\", \"client_secret_basic\"])\n    .default(\"none\"),\n});\nexport type IntegrationOAuthClientConfig = z.infer<typeof IntegrationOAuthClientConfigSchema>;\n\n/**\n * Runtime-resolved provider (built-in or registry), client-construction-ready.\n * The built-in OpenAI/Azure provider is always present and always \"responses\";\n * registry providers carry their own base URL / key / wire API. Compaction is\n * not a provider capability: all providers use the same durable plaintext\n * replacement.\n */\nexport interface ResolvedModelProvider {\n  anthropic?: z.infer<typeof AnthropicProviderOptions> | undefined;\n  id: string; // \"openai\" | \"azure\" | registry id\n  label: string;\n  kind: RegistryProviderKind | \"openrouter-managed\" | \"opper-managed\";\n  api: ModelProviderApi;\n  wireProfile: ModelProviderWireProfile;\n  builtin: boolean;\n  baseUrl?: string | undefined;\n  apiKey?: string | undefined;\n  defaultQuery?: Record<string, string> | undefined;\n  defaultHeaders?: Record<string, string> | undefined;\n  publicDefaultQueryNames?: string[] | undefined;\n  publicDefaultHeaderNames?: string[] | undefined;\n  /** Generic OpenAI-compatible stream silence bound override (ms). */\n  streamIdleTimeoutMs?: number | undefined;\n  /** Generic OpenAI-compatible keepalive-only progress bound override (ms). */\n  streamProgressTimeoutMs?: number | undefined;\n  credentialSource: CredentialSourceV1;\n  billing: BillingAttributionV1;\n}\n\ntype InternalRegistryProvider = Omit<RegistryProvider, \"kind\"> & {\n  kind: RegistryProviderKind | \"openrouter-managed\" | \"opper-managed\";\n};\n\n/** A single exposed model + the provider that serves it. */\nexport interface ConfiguredModel {\n  schemaVersion: 1;\n  id: string;\n  aliases: string[];\n  label: string;\n  /** Optional curated compact label for dense UI (e.g. mobile composer). */\n  shortLabel?: string | undefined;\n  /** Optional HTTPS maker logo; display metadata does not change execution identity. */\n  logoUrl?: string | undefined;\n  providerId: string;\n  providerLabel: string;\n  api: ModelProviderApi;\n  upstreamModelId: string;\n  deployment: ModelDeploymentV1;\n  executionLimits: ModelExecutionLimitsV1;\n  credentialSource: CredentialSourceV1;\n  billing: BillingAttributionV1;\n  /** Workspace-facing funding policy, independent of upstream settlement. */\n  cost: ConfiguredModelCostClass;\n  capabilities: ModelCapabilitiesV1;\n  requestPolicy?: {\n    gateway: {\n      only: [string, ...string[]];\n      caching: \"auto\" | \"none\";\n    };\n  };\n  pricing?: ModelPricingScheduleV1 | undefined;\n  definitionVersion: string;\n  contextWindowTokens?: number | undefined;\n  effectiveContextWindowTokens?: number | undefined;\n  autoCompactTokenLimit?: number | undefined;\n  toolOutputTruncationTokens?: number | undefined;\n  reasoningEffort: boolean;\n  hostedWebSearch: boolean;\n}\n\n/**\n * Whether a resolved route is the deployment-funded OpenRouter free tier: the\n * managed OpenRouter provider, which sends every workspace's requests with the\n * deployment's one OpenRouter key, serving an upstream `:free` variant (the\n * curated catalog admits nothing else). OpenRouter limits free-variant\n * requests per account per minute and per day, so each request on this route\n * spends quota that every turn on the deployment shares. A workspace or\n * organization OpenRouter connection uses its own account and is not this\n * route.\n */\nexport function isManagedOpenRouterFreeRoute(route: {\n  provider: Pick<ResolvedModelProvider, \"kind\">;\n  configured: Pick<ConfiguredModel, \"upstreamModelId\">;\n}): boolean {\n  return (\n    route.provider.kind === \"openrouter-managed\" &&\n    route.configured.upstreamModelId.endsWith(\":free\")\n  );\n}\n\nexport const VERCEL_AI_GATEWAY_BASE_URL = \"https://ai-gateway.vercel.sh/v1\" as const;\nexport const VERCEL_AI_GATEWAY_AI_SDK_BASE_URL = \"https://ai-gateway.vercel.sh/v4/ai\" as const;\nexport const VERCEL_AI_GATEWAY_CONNECTION_DOMAIN = \"ai-gateway.vercel.sh\" as const;\nexport const VERCEL_AI_GATEWAY_CONNECTION_ROLE = \"vercel_ai_gateway\" as const;\nexport const WORKSPACE_OPENROUTER_CONNECTION_DOMAIN = \"openrouter.ai\" as const;\nexport const WORKSPACE_OPENROUTER_CONNECTION_ROLE = \"openrouter\" as const;\nexport const WORKSPACE_OPPER_CONNECTION_DOMAIN = \"api.opper.ai\" as const;\nexport const WORKSPACE_OPPER_CONNECTION_ROLE = \"opper\" as const;\nexport const WORKSPACE_ELEVENLABS_CONNECTION_DOMAIN = \"api.elevenlabs.io\" as const;\nexport const WORKSPACE_ELEVENLABS_CONNECTION_ROLE = \"elevenlabs\" as const;\n\n/**\n * Opper issues separate management keys (`op-mak-…`) that its inference routes\n * refuse with 403 (\"management API keys cannot be used on inference routes\").\n * Reject them before they are stored so a connection never looks ready while\n * every turn fails. Returns a user-facing explanation, or null when usable.\n */\nexport function opperCredentialProblem(apiKey: string): string | null {\n  const key = apiKey.trim();\n  if (!key) return \"Enter an Opper API key.\";\n  if (/^op-mak-/iu.test(key)) {\n    return \"This is an Opper management key, which Opper does not accept for model requests. Create an API key (not a management key) at platform.opper.ai and connect that instead.\";\n  }\n  return null;\n}\n\nexport const CODEX_REALTIME_MODEL_ID = \"gpt-live-1-boulder-alpha\" as const;\nexport const SUPERGROK_REALTIME_MODEL_ID = \"supergrok/grok-voice-think-fast-2.0\" as const;\nexport const OPENGENI_REALTIME_MODEL_ID_PREFIX = \"opengeni-gateway/\" as const;\nexport const WORKSPACE_REALTIME_MODEL_ID_PREFIX = \"workspace-gateway/\" as const;\n\n/** Curated voice models exposed through AI Gateway's normalized realtime API. */\nexport const AI_GATEWAY_REALTIME_MODELS = {\n  openaiRealtime21: {\n    upstreamModelId: \"openai/gpt-realtime-2.1\",\n    managedModelId: `${OPENGENI_REALTIME_MODEL_ID_PREFIX}openai/gpt-realtime-2.1`,\n    workspaceModelId: `${WORKSPACE_REALTIME_MODEL_ID_PREFIX}openai/gpt-realtime-2.1`,\n    label: \"GPT Realtime 2.1\",\n    description: \"Best overall voice intelligence\",\n  },\n  openaiRealtimeMini: {\n    upstreamModelId: \"openai/gpt-realtime-mini\",\n    managedModelId: `${OPENGENI_REALTIME_MODEL_ID_PREFIX}openai/gpt-realtime-mini`,\n    workspaceModelId: `${WORKSPACE_REALTIME_MODEL_ID_PREFIX}openai/gpt-realtime-mini`,\n    label: \"GPT Realtime Mini\",\n    description: \"Faster, lighter live voice\",\n  },\n  grokVoiceThinkFast20: {\n    upstreamModelId: \"xai/grok-voice-think-fast-2.0\",\n    managedModelId: `${OPENGENI_REALTIME_MODEL_ID_PREFIX}xai/grok-voice-think-fast-2.0`,\n    workspaceModelId: `${WORKSPACE_REALTIME_MODEL_ID_PREFIX}xai/grok-voice-think-fast-2.0`,\n    label: \"Grok Voice Think Fast 2.0\",\n    description: \"Fast, natural xAI voice\",\n  },\n} as const;\n\nexport const ELEVENLABS_REALTIME_MODEL_ID_PREFIX = \"workspace-elevenlabs/\" as const;\n\n/**\n * Eleven Realtime speech-to-speech models, reached with the workspace's own\n * ElevenLabs key. v1 max comes first: it is far more reliable at handing work\n * to the session agent.\n */\nexport const ELEVENLABS_REALTIME_MODELS = {\n  v1Max: {\n    upstreamModelId: \"eleven_realtime_v1_max\",\n    modelId: `${ELEVENLABS_REALTIME_MODEL_ID_PREFIX}eleven_realtime_v1_max`,\n    label: \"Eleven Realtime v1 max\",\n    description: \"Reasons before replying; best at handing off work\",\n  },\n  v1Mini: {\n    upstreamModelId: \"eleven_realtime_v1_mini\",\n    modelId: `${ELEVENLABS_REALTIME_MODEL_ID_PREFIX}eleven_realtime_v1_mini`,\n    label: \"Eleven Realtime v1 mini\",\n    description: \"Lowest latency and cost\",\n  },\n} as const;\n\n/** The ElevenLabs upstream model of a realtime model id, or null for other providers. */\nexport function resolveElevenLabsRealtimeModel(modelId: string): string | null {\n  for (const model of Object.values(ELEVENLABS_REALTIME_MODELS)) {\n    if (model.modelId === modelId) return model.upstreamModelId;\n  }\n  return null;\n}\n\n/**\n * Conversation languages Eleven Realtime accepts (both models). ElevenLabs does\n * not detect the spoken language: the session's language sets what it hears and\n * the language it replies in, and an unlisted code fails the session.\n */\nexport const ELEVENLABS_REALTIME_LANGUAGES = [\n  \"af\",\n  \"am\",\n  \"ar\",\n  \"as\",\n  \"ast\",\n  \"az\",\n  \"be\",\n  \"bg\",\n  \"bn\",\n  \"bs\",\n  \"ca\",\n  \"cs\",\n  \"cy\",\n  \"da\",\n  \"de\",\n  \"el\",\n  \"en\",\n  \"es\",\n  \"et\",\n  \"fa\",\n  \"fi\",\n  \"fil\",\n  \"fr\",\n  \"ga\",\n  \"gl\",\n  \"gu\",\n  \"ha\",\n  \"he\",\n  \"hi\",\n  \"hr\",\n  \"hu\",\n  \"hy\",\n  \"id\",\n  \"is\",\n  \"it\",\n  \"ja\",\n  \"jv\",\n  \"ka\",\n  \"kk\",\n  \"kn\",\n  \"ko\",\n  \"ky\",\n  \"lb\",\n  \"lg\",\n  \"lo\",\n  \"lt\",\n  \"lv\",\n  \"mi\",\n  \"mk\",\n  \"ml\",\n  \"mn\",\n  \"mr\",\n  \"ms\",\n  \"mt\",\n  \"my\",\n  \"ne\",\n  \"nl\",\n  \"no\",\n  \"oc\",\n  \"or\",\n  \"pa\",\n  \"pl\",\n  \"ps\",\n  \"pt\",\n  \"pt-br\",\n  \"ro\",\n  \"ru\",\n  \"sd\",\n  \"sk\",\n  \"sl\",\n  \"sn\",\n  \"so\",\n  \"sr\",\n  \"sv\",\n  \"sw\",\n  \"ta\",\n  \"te\",\n  \"tg\",\n  \"th\",\n  \"tl\",\n  \"tr\",\n  \"uk\",\n  \"ur\",\n  \"uz\",\n  \"vi\",\n  \"wo\",\n  \"yo\",\n  \"yue\",\n  \"zh\",\n  \"zu\",\n] as const;\n\n// Tags whose language ElevenLabs lists under another code: Norwegian Bokmål and\n// Nynorsk are Norwegian, and the legacy Hebrew, Indonesian and Javanese codes.\nconst ELEVENLABS_REALTIME_LANGUAGE_ALIASES: Readonly<Record<string, string>> = {\n  nb: \"no\",\n  nn: \"no\",\n  iw: \"he\",\n  in: \"id\",\n  jw: \"jv\",\n};\n\n/**\n * The Eleven Realtime language for a BCP 47 tag such as `nb-NO` or `pt-BR`, or\n * null when ElevenLabs does not support it.\n */\nexport function resolveElevenLabsRealtimeLanguage(tag: string): string | null {\n  const normalized = tag.trim().toLowerCase().replaceAll(\"_\", \"-\");\n  const supported: readonly string[] = ELEVENLABS_REALTIME_LANGUAGES;\n  if (supported.includes(normalized)) return normalized;\n  const base = normalized.split(\"-\")[0] ?? \"\";\n  const language = ELEVENLABS_REALTIME_LANGUAGE_ALIASES[base] ?? base;\n  return supported.includes(language) ? language : null;\n}\n\nexport type AiGatewayRealtimeModel =\n  (typeof AI_GATEWAY_REALTIME_MODELS)[keyof typeof AI_GATEWAY_REALTIME_MODELS];\n\nexport function resolveAiGatewayRealtimeModel(\n  modelId: string,\n): { source: \"managed\" | \"workspace\"; upstreamModelId: string } | null {\n  for (const model of Object.values(AI_GATEWAY_REALTIME_MODELS)) {\n    if (model.managedModelId === modelId) {\n      return { source: \"managed\", upstreamModelId: model.upstreamModelId };\n    }\n    if (model.workspaceModelId === modelId) {\n      return { source: \"workspace\", upstreamModelId: model.upstreamModelId };\n    }\n  }\n  return null;\n}\n\nexport const OPENGENI_GATEWAY_MODELS = {\n  deepseek: {\n    productId: \"deepseek-v4-flash-0731\",\n    workspaceProductId: `${WORKSPACE_GATEWAY_MODEL_ID_PREFIX}deepseek-v4-flash-0731`,\n    upstreamModelId: \"deepseek/deepseek-v4-flash-0731\",\n    label: \"DeepSeek V4 Flash 0731\",\n    shortLabel: \"V4 Flash\",\n    providers: [\"baseten\", \"novita\", \"deepinfra\"],\n    implicitCaching: true,\n  },\n  kimi: {\n    productId: \"kimi-k3\",\n    workspaceProductId: `${WORKSPACE_GATEWAY_MODEL_ID_PREFIX}kimi-k3`,\n    upstreamModelId: \"moonshotai/kimi-k3\",\n    label: \"Kimi K3\",\n    shortLabel: \"Kimi K3\",\n    providers: [\"baseten\", \"fireworks\"],\n    implicitCaching: true,\n  },\n} as const;\n\nexport const OPENGENI_OPENROUTER_MODELS: readonly OpenRouterCatalogModel[] = [\n  OpenRouterCatalogModel.parse({\n    upstreamModelId: \"nvidia/nemotron-3-super-120b-a12b:free\",\n    label: \"Nemotron 3 Super 120B\",\n    shortLabel: \"Nemotron 3 Super\",\n    aliases: [],\n    capabilities: {\n      reasoning: {\n        upstream: \"supported\",\n        // OpenRouter /api/v1/models advertises low and medium for this route.\n        runnable: true,\n        efforts: [\"low\", \"medium\"],\n        defaultEffort: \"medium\",\n        required: false,\n      },\n      functionCalling: { upstream: \"supported\", runnable: true },\n      structuredOutput: { upstream: \"supported\", runnable: true },\n      hostedTools: {\n        webSearch: { upstream: \"unknown\", runnable: false },\n        xSearch: { upstream: \"unknown\", runnable: false },\n        codeExecution: { upstream: \"unknown\", runnable: false },\n        imageGeneration: { upstream: \"unknown\", runnable: false },\n      },\n      inputModalities: [\"text\"],\n      inputFileMediaTypes: [],\n      outputModalities: [\"text\"],\n      transports: {\n        sse: { upstream: \"supported\", runnable: true },\n        responsesWebSocket: { upstream: \"unknown\", runnable: false },\n        realtimeAudio: { upstream: \"unsupported\", runnable: false },\n      },\n      latencyModes: [{ id: \"standard\", upstream: \"unknown\", runnable: true }],\n    },\n    contextWindowTokens: 262_144,\n    effectiveContextWindowTokens: 235_929,\n    autoCompactTokenLimit: 220_000,\n  }),\n];\n\n/** Shared Opper Chat capability envelope. Opper accepts every\n * `reasoning_effort` value on every probed route (it ignores values a route\n * does not support rather than failing), so the declared vocabulary is a\n * product choice, never a request-validity guarantee. */\nfunction opperCapabilities(input: {\n  reasoning: Pick<\n    ModelCapabilitiesV1[\"reasoning\"],\n    \"upstream\" | \"runnable\" | \"efforts\" | \"defaultEffort\"\n  >;\n  structuredOutput: CapabilitySupportV1;\n  image: boolean;\n  inputFileMediaTypes: string[];\n}): ModelCapabilitiesV1 {\n  return ModelCapabilitiesV1Schema.parse({\n    reasoning: { ...input.reasoning, required: false },\n    // Opengeni sends ordinary OpenAI-compatible Chat function tools.\n    functionCalling: { upstream: \"supported\", runnable: true },\n    structuredOutput: {\n      upstream: input.structuredOutput,\n      runnable: input.structuredOutput === \"supported\",\n    },\n    hostedTools: {\n      webSearch: { upstream: \"unknown\", runnable: false },\n      xSearch: { upstream: \"unknown\", runnable: false },\n      codeExecution: { upstream: \"unknown\", runnable: false },\n      imageGeneration: { upstream: \"unknown\", runnable: false },\n    },\n    inputModalities: input.image ? [\"text\", \"image\"] : [\"text\"],\n    inputFileMediaTypes: input.inputFileMediaTypes,\n    outputModalities: [\"text\"],\n    transports: {\n      sse: { upstream: \"supported\", runnable: true },\n      responsesWebSocket: { upstream: \"unsupported\", runnable: false },\n      realtimeAudio: { upstream: \"unsupported\", runnable: false },\n    },\n    promptCaching: { upstream: \"unknown\", runnable: false, mode: \"none\" },\n    latencyModes: [{ id: \"standard\", upstream: \"supported\", runnable: true }],\n  });\n}\n\n/**\n * Reviewed Opper starter route. Snapshot of Opper's catalogue\n * (`GET https://api.opper.ai/v3/compat/models`) reviewed 2026-10-05 and probed\n * live end to end. The route is provider-pinned (`provider/model`) to AWS\n * Bedrock eu-north-1 (Stockholm) with no provider logging, so Opper never\n * pools it onto a non-EU provider. `pricing` is Opper's listed supplier rate\n * (USD per 1M tokens); turns debit Opper's exact reported cost +5% and use\n * this rate only when cost metadata is absent. Hosts replace this list with\n * OPENGENI_OPPER_MODELS_JSON (code mode) or the catalog document's\n * `opperModels` (database mode).\n */\n/**\n * Default automatic-compaction threshold for Claude Opus 5.5 on every route.\n * Workspaces can still choose another threshold per model.\n */\nexport const OPUS_5_5_AUTO_COMPACT_TOKEN_LIMIT = 300_000;\n\nexport const OPENGENI_OPPER_MODELS: readonly OpperCatalogModel[] = [\n  OpperCatalogModel.parse({\n    upstreamModelId: \"aws/claude-opus-5-5\",\n    label: \"Claude Opus 5.5 (EU)\",\n    shortLabel: \"Opus 5.5\",\n    aliases: [],\n    capabilities: opperCapabilities({\n      // Opper lists `reasoning.supported` low..max with no default for this\n      // route; `reasoning_effort` measurably changes hidden thinking length.\n      // Default medium matches the native Claude Opus 5.5 profile.\n      reasoning: {\n        upstream: \"supported\",\n        runnable: true,\n        efforts: [\"low\", \"medium\", \"high\", \"xhigh\", \"max\"],\n        defaultEffort: \"medium\",\n      },\n      // The route lists text/vision/tools/pdf/reasoning, not structured_output.\n      structuredOutput: \"unknown\",\n      image: true,\n      inputFileMediaTypes: [\"application/pdf\"],\n    }),\n    contextWindowTokens: 1_000_000,\n    // 1,000,000 minus Opper's 128,000 max output tokens.\n    effectiveContextWindowTokens: 872_000,\n    // Same product default as the native Claude Opus 5.5 profile.\n    autoCompactTokenLimit: OPUS_5_5_AUTO_COMPACT_TOKEN_LIMIT,\n    maxOutputTokens: 128_000,\n    pricing: {\n      // Opper list: $4.40 input / $0.22 cached input / $5.50 5-minute cache\n      // write / $22.00 output per 1M (Bedrock EU regional rate).\n      inputMicrosPerMillionTokens: 4_400_000,\n      cachedInputMicrosPerMillionTokens: 220_000,\n      cacheWriteMicrosPerMillionTokens: 5_500_000,\n      outputMicrosPerMillionTokens: 22_000_000,\n      marginBps: 500,\n    },\n  }),\n];\n\n/**\n * Reviewed Opper list prices for routes a host may add through\n * OPENGENI_OPPER_MODELS_JSON or the catalog document without its own\n * OPENGENI_MODEL_PRICING_JSON entry. Price only: membership, labels,\n * capabilities and limits always come from configuration.\n */\nconst REVIEWED_OPPER_MODEL_PRICING: Readonly<\n  Record<string, ModelPricing | ModelPricingScheduleV1>\n> = {\n  ...Object.fromEntries(\n    OPENGENI_OPPER_MODELS.flatMap((model) =>\n      model.pricing ? [[model.upstreamModelId, model.pricing] as const] : [],\n    ),\n  ),\n  // Reviewed 2026-10-05: $0.825 input / $0.0825 cached input / $4.125 output.\n  \"vertexai/gemini-3.8-flash-eu\": {\n    inputMicrosPerMillionTokens: 825_000,\n    cachedInputMicrosPerMillionTokens: 82_500,\n    outputMicrosPerMillionTokens: 4_125_000,\n    marginBps: 500,\n  },\n  // Reviewed 2026-10-05: $3.30 input / $0.33 cached / $4.125 cache write / $16.50 output.\n  \"aws/claude-sonnet-4-6-eu\": {\n    inputMicrosPerMillionTokens: 3_300_000,\n    cachedInputMicrosPerMillionTokens: 330_000,\n    cacheWriteMicrosPerMillionTokens: 4_125_000,\n    outputMicrosPerMillionTokens: 16_500_000,\n    marginBps: 500,\n  },\n};\n\n/** Keepalive-only progress bound for Opper streams: room for a full 128,000-\n * token hidden-reasoning response at roughly 35 tokens per second. */\nexport const OPPER_STREAM_PROGRESS_TIMEOUT_MS = 60 * 60_000;\n\n/** Opper's smallest advertised `max_output_tokens` across every Claude route\n * in its 2026-10-05 catalogue (all 70 routes are 64,000 or more). */\nconst OPPER_CLAUDE_FAMILY_MAX_OUTPUT_TOKENS = 64_000;\n\nfunction isOpperClaudeFamilyModel(upstreamModelId: string): boolean {\n  return /(?:^|[/.])claude-/iu.test(upstreamModelId);\n}\n\nfunction isOpperGeminiFamilyModel(upstreamModelId: string): boolean {\n  return /(?:^|[/.])gemini-/iu.test(upstreamModelId);\n}\n\n/**\n * Capability envelope for a workspace/organization custom Opper id that is not\n * in the configured deployment list. Deterministic and offline (the API and\n * worker must derive the same frozen definition, so no live `GET /models`):\n * - reasoning is runnable with low/medium/high, because Opper accepts any\n *   effort on every probed route and ignores one a route does not support;\n * - image input is on for the Claude and Gemini families, where every route\n *   in Opper's catalogue lists vision; other families stay text-only;\n * - typed file input stays off (Opengeni sends documents to the sandbox).\n */\nfunction opperCustomModelCapabilities(upstreamModelId: string): ModelCapabilitiesV1 {\n  return opperCapabilities({\n    reasoning: {\n      upstream: \"unknown\",\n      runnable: true,\n      efforts: [\"low\", \"medium\", \"high\"],\n      defaultEffort: \"medium\",\n    },\n    structuredOutput: \"unknown\",\n    image: isOpperClaudeFamilyModel(upstreamModelId) || isOpperGeminiFamilyModel(upstreamModelId),\n    inputFileMediaTypes: [],\n  });\n}\n\n/**\n * `max_tokens` the Opper Chat adapter sends when a request sets none. Opper's\n * own default is 4,096 output tokens, which hidden reasoning can exhaust before\n * any answer, and Opper rejects (does not clamp) a value above the route's\n * limit. A configured entry's `maxOutputTokens` wins; a Claude-family custom id\n * gets the smallest Claude limit in Opper's catalogue; other ids keep Opper's\n * default.\n */\nexport function opperMaxOutputTokens(\n  settings: Settings,\n  upstreamModelId: string,\n): number | undefined {\n  const configured = configuredOpperCatalogModels(settings).find(\n    (model) => model.upstreamModelId === upstreamModelId,\n  );\n  if (configured?.maxOutputTokens !== undefined) return configured.maxOutputTokens;\n  return isOpperClaudeFamilyModel(upstreamModelId)\n    ? OPPER_CLAUDE_FAMILY_MAX_OUTPUT_TOKENS\n    : undefined;\n}\n\nfunction defaultGatewayCatalogModels(): GatewayCatalogModel[] {\n  return [\n    {\n      ...OPENGENI_GATEWAY_MODELS.deepseek,\n      vision: false,\n      inputFileMediaTypes: [],\n      contextWindowTokens: 1_000_000,\n      effectiveContextWindowTokens: 900_000,\n      autoCompactTokenLimit: 850_000,\n    },\n    {\n      ...OPENGENI_GATEWAY_MODELS.kimi,\n      vision: true,\n      inputFileMediaTypes: [\"application/pdf\"],\n      contextWindowTokens: 1_000_000,\n      effectiveContextWindowTokens: 900_000,\n      autoCompactTokenLimit: 850_000,\n    },\n  ].map((model) => GatewayCatalogModel.parse(model));\n}\n\nfunction configuredGatewayCatalogModels(settings: Settings): GatewayCatalogModel[] {\n  if (settings.resolvedGatewayModelsJson !== undefined) {\n    return z.array(GatewayCatalogModel).parse(JSON.parse(settings.resolvedGatewayModelsJson));\n  }\n  const override = codeModeManagedModels(settings).gatewayModels;\n  if (override) return override.map((model) => GatewayCatalogModel.parse(model));\n  return defaultGatewayCatalogModels();\n}\n\nexport function configuredGatewayUpstreamModelIds(settings: Settings): string[] {\n  return configuredGatewayCatalogModels(settings).map((model) => model.upstreamModelId);\n}\n\nexport function configuredGatewayWorkspaceProductModelIds(settings: Settings): string[] {\n  return configuredGatewayCatalogModels(settings).map((model) => model.workspaceProductId);\n}\n\nexport function configuredGatewayOrganizationProductModelIds(settings: Settings): string[] {\n  void settings;\n  return [];\n}\n\nexport function configuredModelInputIdentities(settings: Settings): string[] {\n  return configuredModels(settings).flatMap((model) => [model.id, ...model.aliases]);\n}\n\nfunction configuredOpenRouterCatalogModels(settings: Settings): OpenRouterCatalogModel[] {\n  if (settings.resolvedOpenRouterModelsJson !== undefined) {\n    return z.array(OpenRouterCatalogModel).parse(JSON.parse(settings.resolvedOpenRouterModelsJson));\n  }\n  const override = codeModeManagedModels(settings).openrouterModels;\n  if (override) return override.map((model) => OpenRouterCatalogModel.parse(model));\n  return [...OPENGENI_OPENROUTER_MODELS];\n}\n\nexport function configuredOpenRouterUpstreamModelIds(settings: Settings): string[] {\n  return configuredOpenRouterCatalogModels(settings).map((model) => model.upstreamModelId);\n}\n\nfunction workspaceOpenRouterProductId(modelId: string): string {\n  return `${WORKSPACE_OPENROUTER_MODEL_ID_PREFIX}${\n    modelId.startsWith(OPENROUTER_MODEL_ID_PREFIX)\n      ? modelId.slice(OPENROUTER_MODEL_ID_PREFIX.length)\n      : modelId\n  }`;\n}\n\nexport function configuredOpenRouterWorkspaceProductModelIds(settings: Settings): string[] {\n  return configuredOpenRouterCatalogModels(settings).flatMap((model) =>\n    [model.upstreamModelId, ...model.aliases].map(workspaceOpenRouterProductId),\n  );\n}\n\nexport function configuredOpenRouterOrganizationProductModelIds(settings: Settings): string[] {\n  void settings;\n  return [];\n}\n\n/**\n * Deployment Opper membership. A resolved database catalog document is the\n * sole authority in database mode; OPENGENI_MANAGED_MODELS_JSON `opperModels`\n * is read only in code mode, so it can never bypass the database document;\n * otherwise the reviewed code starter table applies.\n */\nfunction configuredOpperCatalogModels(settings: Settings): OpperCatalogModel[] {\n  if (settings.resolvedOpperModelsJson !== undefined) {\n    return z.array(OpperCatalogModel).parse(JSON.parse(settings.resolvedOpperModelsJson));\n  }\n  const override = codeModeManagedModels(settings).opperModels;\n  if (override) return override.map((model) => OpperCatalogModel.parse(model));\n  return [...OPENGENI_OPPER_MODELS];\n}\n\n/** Reviewed code price for one Opper upstream id, if any. */\nfunction reviewedOpperModelPricing(upstreamModelId: string): ModelPricingScheduleV1 | undefined {\n  const pricing = Object.hasOwn(REVIEWED_OPPER_MODEL_PRICING, upstreamModelId)\n    ? REVIEWED_OPPER_MODEL_PRICING[upstreamModelId]\n    : undefined;\n  return pricing === undefined ? undefined : normalizeModelPricingSchedule(pricing);\n}\n\nexport function configuredOpperUpstreamModelIds(settings: Settings): string[] {\n  return configuredOpperCatalogModels(settings).map((model) => model.upstreamModelId);\n}\n\nfunction workspaceOpperProductId(modelId: string): string {\n  return `${WORKSPACE_OPPER_MODEL_ID_PREFIX}${\n    modelId.startsWith(OPPER_MODEL_ID_PREFIX)\n      ? modelId.slice(OPPER_MODEL_ID_PREFIX.length)\n      : modelId\n  }`;\n}\n\nexport function configuredOpperWorkspaceProductModelIds(settings: Settings): string[] {\n  return configuredOpperCatalogModels(settings).flatMap((model) =>\n    [model.upstreamModelId, ...model.aliases].map(workspaceOpperProductId),\n  );\n}\n\nexport function configuredOpperOrganizationProductModelIds(settings: Settings): string[] {\n  void settings;\n  return [];\n}\n\n/**\n * Built-in Opengeni credit pricing schedules.\n *\n * Rates are provider list prices in USD micros per 1M tokens. Debit applies\n * `marginBps` (500 = +5%) on top. Long-context tiers follow OpenAI's\n * \">272K input tokens\" rule (threshold exclusive of 272_000).\n *\n * GPT-5.4 and older families are intentionally omitted — they are no longer\n * offered. Codex / connected-subscription turns use `metering: external`, so\n * this map never debits them, but it does provide their equivalent Opengeni\n * credit price when a matching product model is configured.\n *\n * When adding or changing a billed model, run `bun run check:model-pricing`\n * (see docs/model-providers.md § Price audit). That compares this map to\n * llm-prices.com as a ground-truth canary; it does not generate this table.\n */\nexport const defaultModelPricing: Record<string, ModelPricingScheduleV1> = {\n  \"gpt-6-astra\": {\n    default: {\n      // OpenAI list price: $10 / $1 cached / $12.50 cache write / $50 output.\n      inputMicrosPerMillionTokens: 10_000_000,\n      cachedInputMicrosPerMillionTokens: 1_000_000,\n      cacheWriteMicrosPerMillionTokens: 12_500_000,\n      outputMicrosPerMillionTokens: 50_000_000,\n      marginBps: 500,\n    },\n    inputTokenTiers: [\n      {\n        // Prompts with more than 272K input tokens use 2x input and 1.5x output.\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 20_000_000,\n          cachedInputMicrosPerMillionTokens: 2_000_000,\n          cacheWriteMicrosPerMillionTokens: 25_000_000,\n          outputMicrosPerMillionTokens: 75_000_000,\n          marginBps: 500,\n        },\n      },\n    ],\n  },\n  \"gpt-6-sol\": {\n    default: {\n      // OpenAI list price: $2 / $0.20 cached / $2.50 cache write / $10 output.\n      inputMicrosPerMillionTokens: 2_000_000,\n      cachedInputMicrosPerMillionTokens: 200_000,\n      cacheWriteMicrosPerMillionTokens: 2_500_000,\n      outputMicrosPerMillionTokens: 10_000_000,\n      marginBps: 500,\n    },\n    inputTokenTiers: [\n      {\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 4_000_000,\n          cachedInputMicrosPerMillionTokens: 400_000,\n          cacheWriteMicrosPerMillionTokens: 5_000_000,\n          outputMicrosPerMillionTokens: 15_000_000,\n          marginBps: 500,\n        },\n      },\n    ],\n  },\n  \"gpt-6-luna\": {\n    default: {\n      // OpenAI list price: $0.10 / $0.01 cached / $0.125 cache write / $0.50 output.\n      inputMicrosPerMillionTokens: 100_000,\n      cachedInputMicrosPerMillionTokens: 10_000,\n      cacheWriteMicrosPerMillionTokens: 125_000,\n      outputMicrosPerMillionTokens: 500_000,\n      marginBps: 500,\n    },\n    inputTokenTiers: [\n      {\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 200_000,\n          cachedInputMicrosPerMillionTokens: 20_000,\n          cacheWriteMicrosPerMillionTokens: 250_000,\n          outputMicrosPerMillionTokens: 750_000,\n          marginBps: 500,\n        },\n      },\n    ],\n  },\n  \"gpt-5.6-sol\": {\n    default: {\n      // Promotional OpenAI pricing, guaranteed through at least 2026-11-21.\n      inputMicrosPerMillionTokens: 4_000_000,\n      cachedInputMicrosPerMillionTokens: 400_000,\n      cacheWriteMicrosPerMillionTokens: 5_000_000,\n      outputMicrosPerMillionTokens: 20_000_000,\n      marginBps: 500,\n    },\n    inputTokenTiers: [\n      {\n        // OpenAI: prompts with >272K input tokens use the long-context rate.\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 8_000_000,\n          cachedInputMicrosPerMillionTokens: 800_000,\n          cacheWriteMicrosPerMillionTokens: 10_000_000,\n          outputMicrosPerMillionTokens: 30_000_000,\n          marginBps: 500,\n        },\n      },\n    ],\n  },\n  \"gpt-5.6-terra\": {\n    default: {\n      inputMicrosPerMillionTokens: 2_000_000,\n      cachedInputMicrosPerMillionTokens: 200_000,\n      cacheWriteMicrosPerMillionTokens: 2_500_000,\n      outputMicrosPerMillionTokens: 12_000_000,\n      marginBps: 500,\n    },\n    inputTokenTiers: [\n      {\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 4_000_000,\n          cachedInputMicrosPerMillionTokens: 400_000,\n          cacheWriteMicrosPerMillionTokens: 5_000_000,\n          outputMicrosPerMillionTokens: 18_000_000,\n          marginBps: 500,\n        },\n      },\n    ],\n  },\n  \"gpt-5.6-luna\": {\n    default: {\n      inputMicrosPerMillionTokens: 200_000,\n      cachedInputMicrosPerMillionTokens: 20_000,\n      cacheWriteMicrosPerMillionTokens: 250_000,\n      outputMicrosPerMillionTokens: 1_200_000,\n      marginBps: 500,\n    },\n    inputTokenTiers: [\n      {\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 400_000,\n          cachedInputMicrosPerMillionTokens: 40_000,\n          cacheWriteMicrosPerMillionTokens: 500_000,\n          outputMicrosPerMillionTokens: 1_800_000,\n          marginBps: 500,\n        },\n      },\n    ],\n  },\n  // Conservative Vercel AI Gateway fallback prices. Normal managed Gateway\n  // billing uses the exact response Gateway `cost` / `inferenceCost` and applies\n  // the same margin. These token rates are used only if that\n  // metadata is absent. DeepSeek therefore carries the highest approved route\n  // (Novita); both approved Kimi routes have the same list price.\n  [OPENGENI_GATEWAY_MODELS.deepseek.productId]: {\n    default: {\n      inputMicrosPerMillionTokens: 140_000,\n      cachedInputMicrosPerMillionTokens: 28_000,\n      outputMicrosPerMillionTokens: 280_000,\n      marginBps: 500,\n    },\n  },\n  [OPENGENI_GATEWAY_MODELS.kimi.productId]: {\n    default: {\n      inputMicrosPerMillionTokens: 3_000_000,\n      cachedInputMicrosPerMillionTokens: 300_000,\n      outputMicrosPerMillionTokens: 15_000_000,\n      marginBps: 500,\n    },\n  },\n  // Fireworks AI / GLM 5.2 — the first shipped non-OpenAI registry model. A\n  // built-in default pricing entry makes managed billing work out of the box\n  // for hosts that expose this model via OPENGENI_MODEL_PROVIDERS_JSON without\n  // also setting OPENGENI_MODEL_PRICING_JSON.\n  \"accounts/fireworks/models/glm-5p2\": {\n    default: {\n      inputMicrosPerMillionTokens: 1_400_000,\n      cachedInputMicrosPerMillionTokens: 140_000,\n      outputMicrosPerMillionTokens: 4_400_000,\n      marginBps: 500,\n    },\n  },\n};\n\n/** Reviewed comparison rates only; never debit or execution-definition defaults. */\nexport const reviewedModelListPricing: Record<string, ModelPricingScheduleV1> = {\n  // Reviewed 2026-10-03 against https://developers.openai.com/api/docs/pricing\n  // and https://ai-gateway.vercel.sh/v1/models. GPT-6.1 Sol's cache-read rate\n  // is 5% of input, not GPT-6 Sol's 10%. The long-context boundary is >272K.\n  \"gpt-6.1-sol\": {\n    default: {\n      inputMicrosPerMillionTokens: 2_000_000,\n      cachedInputMicrosPerMillionTokens: 100_000,\n      cacheWriteMicrosPerMillionTokens: 2_500_000,\n      outputMicrosPerMillionTokens: 10_000_000,\n      marginBps: 500,\n    },\n    inputTokenTiers: [\n      {\n        minimumInputTokens: 272_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 4_000_000,\n          cachedInputMicrosPerMillionTokens: 200_000,\n          cacheWriteMicrosPerMillionTokens: 5_000_000,\n          outputMicrosPerMillionTokens: 15_000_000,\n          marginBps: 500,\n        },\n      },\n    ],\n  },\n  // xAI Standard API list rates, reviewed 2026-10-03:\n  // https://docs.x.ai/developers/models/grok-4.5 (and grok-4.6 / grok-4.7).\n  // Preserve the native API's established >=200K boundary. Gateway's separately\n  // configured >200K schedule is not interchangeable with this native schedule.\n  // xAI's automatic caching has no separate cache-write surcharge.\n  ...Object.fromEntries(\n    (\n      [\n        [\"grok-4.5\", 300_000],\n        [\"grok-4.6\", 500_000],\n        [\"grok-4.7\", 500_000],\n      ] as const\n    ).map(([model, cachedInput]) => [\n      model,\n      {\n        default: {\n          inputMicrosPerMillionTokens: 2_000_000,\n          cachedInputMicrosPerMillionTokens: cachedInput,\n          outputMicrosPerMillionTokens: 6_000_000,\n          marginBps: 500,\n        },\n        inputTokenTiers: [\n          {\n            minimumInputTokens: 200_000,\n            pricing: {\n              inputMicrosPerMillionTokens: 4_000_000,\n              cachedInputMicrosPerMillionTokens: cachedInput * 2,\n              outputMicrosPerMillionTokens: 12_000_000,\n              marginBps: 500,\n            },\n          },\n        ],\n      },\n    ]),\n  ),\n  // Every reviewed native Claude profile. Standard/global prices include\n  // 5-minute cache writes; 1-hour native routes are projected separately.\n  // https://platform.claude.com/docs/en/about-claude/pricing (2026-10-08).\n  // Opus/Sonnet 5.5 cache reads are 5%, unlike the older models' 10%; none of these\n  // models has a long-context premium.\n  ...Object.fromEntries(\n    (\n      [\n        [\"claude-opus-5-5\", 4_000_000, 200_000, 5_000_000, 20_000_000],\n        [\"claude-sonnet-5-5\", 2_000_000, 100_000, 2_500_000, 10_000_000],\n        [\"claude-opus-5\", 5_000_000, 500_000, 6_250_000, 25_000_000],\n        [\"claude-sonnet-5\", 2_000_000, 200_000, 2_500_000, 10_000_000],\n        [\"claude-opus-4-8\", 5_000_000, 500_000, 6_250_000, 25_000_000],\n        [\"claude-opus-4-7\", 5_000_000, 500_000, 6_250_000, 25_000_000],\n        [\"claude-opus-4-6\", 5_000_000, 500_000, 6_250_000, 25_000_000],\n        [\"claude-sonnet-4-6\", 3_000_000, 300_000, 3_750_000, 15_000_000],\n        [\"claude-haiku-4-5-20251001\", 1_000_000, 100_000, 1_250_000, 5_000_000],\n      ] as const\n    ).map(([model, input, cachedInput, cacheWrite, output]) => [\n      model,\n      {\n        default: {\n          inputMicrosPerMillionTokens: input,\n          cachedInputMicrosPerMillionTokens: cachedInput,\n          cacheWriteMicrosPerMillionTokens: cacheWrite,\n          outputMicrosPerMillionTokens: output,\n          marginBps: 500,\n        },\n      },\n    ]),\n  ),\n  // https://platform.claude.com/docs/en/models/haiku-5-5/overview (2026-10-08).\n  // The higher rate applies to the WHOLE request strictly above 100,000 input\n  // tokens, including cached input. These are comparison prices, not a quota.\n  \"claude-haiku-5-5\": {\n    default: {\n      inputMicrosPerMillionTokens: 100_000,\n      cachedInputMicrosPerMillionTokens: 10_000,\n      cacheWriteMicrosPerMillionTokens: 125_000,\n      outputMicrosPerMillionTokens: 500_000,\n      marginBps: 500,\n    },\n    inputTokenTiers: [\n      {\n        minimumInputTokens: 100_001,\n        pricing: {\n          inputMicrosPerMillionTokens: 500_000,\n          cachedInputMicrosPerMillionTokens: 50_000,\n          cacheWriteMicrosPerMillionTokens: 625_000,\n          outputMicrosPerMillionTokens: 2_500_000,\n          marginBps: 500,\n        },\n      },\n    ],\n  },\n};\n\n// Explicitly priced free variant, not an unknown rate. List-only metadata\n// preserves previously accepted free-route execution definitions.\n// https://openrouter.ai/api/v1/models, verified 2026-10-03.\nconst reviewedFreeOpenRouterListPricing: ModelPricingScheduleV1 = {\n  default: {\n    inputMicrosPerMillionTokens: 0,\n    cachedInputMicrosPerMillionTokens: 0,\n    cacheWriteMicrosPerMillionTokens: 0,\n    outputMicrosPerMillionTokens: 0,\n    marginBps: 500,\n  },\n};\n\n// --- backend-gated required-credential table (the single source of truth) ---\n// Each sandbox backend declares ONLY its own required credentials: a deployment\n// configured for `sandboxBackend=modal` must carry the Modal token, but a\n// daytona/e2b/local/none deployment must NOT be forced to set Modal creds (and\n// vice versa). validateSettings() iterates this table for the *active* backend\n// only — so the cred a backend doesn't use is never a boot blocker — and the\n// deployment package mirrors the same table to drive its env-render + the\n// required-env manifest (one table, two consumers).\n//\n// `field` is the parsed Settings key (boot validation reads the typed value);\n// `env` is the OPENGENI_* variable name (deployment renders/requires it). The\n// modal token is a both-or-neither pair handled by an extra refine in\n// validateSettings — this table holds the hard \"must be present when active\"\n// requirements.\nexport type SandboxRequiredEnv = {\n  field: keyof Settings;\n  env: string;\n};\n\nexport const SANDBOX_REQUIRED_ENV: Record<\n  z.infer<typeof SandboxBackend>,\n  readonly SandboxRequiredEnv[]\n> = {\n  // docker/local/none need no credentials (local dev container / in-process / off).\n  docker: [],\n  local: [],\n  none: [],\n  modal: [\n    { field: \"modalAppName\", env: \"OPENGENI_MODAL_APP_NAME\" },\n    { field: \"modalTokenId\", env: \"OPENGENI_MODAL_TOKEN_ID\" },\n    { field: \"modalTokenSecret\", env: \"OPENGENI_MODAL_TOKEN_SECRET\" },\n  ],\n  daytona: [{ field: \"daytonaApiKey\", env: \"OPENGENI_DAYTONA_API_KEY\" }],\n  runloop: [{ field: \"runloopApiKey\", env: \"OPENGENI_RUNLOOP_API_KEY\" }],\n  e2b: [{ field: \"e2bApiKey\", env: \"OPENGENI_E2B_API_KEY\" }],\n  blaxel: [{ field: \"blaxelApiKey\", env: \"OPENGENI_BLAXEL_API_KEY\" }],\n  cloudflare: [{ field: \"cloudflareWorkerUrl\", env: \"OPENGENI_CLOUDFLARE_WORKER_URL\" }],\n  vercel: [\n    { field: \"vercelToken\", env: \"OPENGENI_VERCEL_TOKEN\" },\n    { field: \"vercelProjectId\", env: \"OPENGENI_VERCEL_PROJECT_ID\" },\n  ],\n  opensandbox: [\n    { field: \"openSandboxBaseUrl\", env: \"OPENGENI_OPENSANDBOX_BASE_URL\" },\n    { field: \"openSandboxApiKey\", env: \"OPENGENI_OPENSANDBOX_API_KEY\" },\n    { field: \"openSandboxImage\", env: \"OPENGENI_OPENSANDBOX_IMAGE\" },\n  ],\n  // compute also needs the gateway and relay; computeSettingsIssues checks them.\n  compute: [\n    { field: \"computeApiUrl\", env: \"OPENGENI_COMPUTE_API_URL\" },\n    { field: \"computeApiKey\", env: \"OPENGENI_COMPUTE_API_KEY\" },\n  ],\n  // selfhosted needs NO per-box credentials: it is the user's own machine reached\n  // over the agent's own enrollment. The enrollment-signing + relay-token secrets\n  // are deployment-level (a single runtime secret, not per-active-backend creds),\n  // wired in the connectivity/enrollment milestones (M4/M5), not here.\n  selfhosted: [],\n};\n\n/** The required OPENGENI_* env var names for a backend (for the deployment manifest). */\nexport function requiredSandboxEnvForBackend(backend: z.infer<typeof SandboxBackend>): string[] {\n  return (SANDBOX_REQUIRED_ENV[backend] ?? []).map((entry) => entry.env);\n}\n\nfunction objectStorageConfiguredForWorkspaceArchives(settings: Settings): boolean {\n  switch (settings.objectStorageBackend) {\n    case \"azure-blob\":\n      return Boolean(\n        settings.objectStorageAzureConnectionString ||\n        (settings.objectStorageAzureAccountName && settings.objectStorageAzureAccountKey),\n      );\n    case \"gcs\":\n      return Boolean(\n        settings.objectStorageGcsCredentialsJson ||\n        settings.objectStorageGcsKeyFilename ||\n        settings.objectStorageGcsProjectId,\n      );\n    case \"aws-s3\":\n      return true;\n    case \"s3-compatible\":\n      return Boolean(\n        settings.objectStorageEndpoint &&\n        settings.objectStorageAccessKeyId &&\n        settings.objectStorageSecretAccessKey,\n      );\n    default: {\n      const _exhaustive: never = settings.objectStorageBackend;\n      return _exhaustive;\n    }\n  }\n}\n\nfunction optionalEnvironmentValue(name: string, source: NodeJS.ProcessEnv): string | undefined {\n  const value = source[name];\n  return value && value.trim().length > 0 ? value : undefined;\n}\n\n// getSettings runs per request in some processes; say this once per process.\nlet idleCommandContainmentDisabledWarned = false;\n\nexport function getSettings(source: NodeJS.ProcessEnv = process.env): Settings {\n  const optional = (name: string): string | undefined => optionalEnvironmentValue(name, source);\n  const modelCatalogSource = optional(\"OPENGENI_MODEL_CATALOG_SOURCE\");\n  const modelCostPolicyJson =\n    optional(\"OPENGENI_MODEL_COST_POLICY_JSON\") ??\n    (modelCatalogSource === \"database\" ? \"{}\" : DEFAULT_MODEL_COST_POLICY_JSON);\n  const raw = {\n    serviceName: optional(\"OPENGENI_SERVICE_NAME\"),\n    environment: optional(\"OPENGENI_ENVIRONMENT\"),\n    deploymentRevision:\n      optional(\"OPENGENI_DEPLOYMENT_REVISION\") ??\n      optional(\"SOURCE_VERSION\") ??\n      optional(\"GITHUB_SHA\"),\n    serverVersion: optional(\"OPENGENI_SERVER_VERSION\"),\n    databaseUrl: optional(\"OPENGENI_DATABASE_URL\"),\n    databaseNotificationUrl: optional(\"OPENGENI_DATABASE_NOTIFICATION_URL\"),\n    apiDatabasePoolMax: optional(\"OPENGENI_API_DATABASE_POOL_MAX\"),\n    databasePreparedStatements: optional(\"OPENGENI_DATABASE_PREPARED_STATEMENTS\"),\n    dbSchema: optional(\"OPENGENI_DB_SCHEMA\"),\n    rlsStrategy: optional(\"OPENGENI_RLS_STRATEGY\"),\n    runtimeDatabaseRole: optional(\"OPENGENI_RUNTIME_DATABASE_ROLE\"),\n    natsUrl: optional(\"OPENGENI_NATS_URL\"),\n    temporalHost: optional(\"OPENGENI_TEMPORAL_HOST\"),\n    temporalNamespace: optional(\"OPENGENI_TEMPORAL_NAMESPACE\"),\n    temporalTaskQueue: optional(\"OPENGENI_TEMPORAL_TASK_QUEUE\"),\n    temporalTlsEnabled: optional(\"OPENGENI_TEMPORAL_TLS_ENABLED\"),\n    temporalApiKey: optional(\"OPENGENI_TEMPORAL_API_KEY\"),\n    temporalTlsServerName: optional(\"OPENGENI_TEMPORAL_TLS_SERVER_NAME\"),\n    temporalTlsRootCaCertificateBase64: optional(\n      \"OPENGENI_TEMPORAL_TLS_ROOT_CA_CERTIFICATE_BASE64\",\n    ),\n    temporalTlsClientCertificateBase64: optional(\"OPENGENI_TEMPORAL_TLS_CLIENT_CERTIFICATE_BASE64\"),\n    temporalTlsClientPrivateKeyBase64: optional(\"OPENGENI_TEMPORAL_TLS_CLIENT_PRIVATE_KEY_BASE64\"),\n    startupDependencyRetryAttempts: optional(\"OPENGENI_STARTUP_DEPENDENCY_RETRY_ATTEMPTS\"),\n    startupDependencyRetryInitialDelayMs: optional(\n      \"OPENGENI_STARTUP_DEPENDENCY_RETRY_INITIAL_DELAY_MS\",\n    ),\n    startupDependencyRetryMaxDelayMs: optional(\"OPENGENI_STARTUP_DEPENDENCY_RETRY_MAX_DELAY_MS\"),\n    turnWorkerConcurrencyMode: optional(\"OPENGENI_TURN_WORKER_CONCURRENCY_MODE\"),\n    turnWorkerMaxConcurrentTurns: optional(\"OPENGENI_TURN_WORKER_MAX_CONCURRENT_TURNS\"),\n    turnWorkerTargetCpuUsage: optional(\"OPENGENI_TURN_WORKER_TARGET_CPU_USAGE\"),\n    turnWorkerTargetMemoryUsage: optional(\"OPENGENI_TURN_WORKER_TARGET_MEMORY_USAGE\"),\n    turnWorkerEmergencyMemoryUsage: optional(\"OPENGENI_TURN_WORKER_EMERGENCY_MEMORY_USAGE\"),\n    turnWorkerMemoryGuardIntervalMs: optional(\"OPENGENI_TURN_WORKER_MEMORY_GUARD_INTERVAL_MS\"),\n    turnWorkerMemoryGuardSustainMs: optional(\"OPENGENI_TURN_WORKER_MEMORY_GUARD_SUSTAIN_MS\"),\n    observabilityStructuredLogs: optional(\"OPENGENI_OBSERVABILITY_STRUCTURED_LOGS\"),\n    observabilityMetricsEnabled: optional(\"OPENGENI_OBSERVABILITY_METRICS_ENABLED\"),\n    observabilityOtlpEndpoint:\n      optional(\"OPENGENI_OTEL_EXPORTER_OTLP_ENDPOINT\") ?? optional(\"OTEL_EXPORTER_OTLP_ENDPOINT\"),\n    observabilityOtlpHeaders:\n      optional(\"OPENGENI_OTEL_EXPORTER_OTLP_HEADERS\") ?? optional(\"OTEL_EXPORTER_OTLP_HEADERS\"),\n    observabilityDiagnosticsEndpoint: optional(\"OPENGENI_OBSERVABILITY_DIAGNOSTICS_ENDPOINT\"),\n    observabilityDiagnosticsHeaders: optional(\"OPENGENI_OBSERVABILITY_DIAGNOSTICS_HEADERS\"),\n    analyticsEnabled: optional(\"OPENGENI_ANALYTICS_ENABLED\"),\n    analyticsConsentRequired: optional(\"OPENGENI_ANALYTICS_CONSENT_REQUIRED\"),\n    analyticsReoClientId: optional(\"OPENGENI_ANALYTICS_REO_CLIENT_ID\"),\n    analyticsPosthogProjectKey: optional(\"OPENGENI_ANALYTICS_POSTHOG_PROJECT_KEY\"),\n    analyticsPosthogHost: optional(\"OPENGENI_ANALYTICS_POSTHOG_HOST\"),\n    analyticsGa4MeasurementId: optional(\"OPENGENI_ANALYTICS_GA4_MEASUREMENT_ID\"),\n    legalPrivacyPolicyUrl: optional(\"OPENGENI_LEGAL_PRIVACY_POLICY_URL\"),\n    legalTermsOfServiceUrl: optional(\"OPENGENI_LEGAL_TERMS_OF_SERVICE_URL\"),\n    supportEmail: optional(\"OPENGENI_SUPPORT_EMAIL\"),\n    publicBaseUrl: optional(\"OPENGENI_PUBLIC_BASE_URL\"),\n    documentationUrl: optional(\"OPENGENI_DOCUMENTATION_URL\"),\n    mcpOauthEnabled: optional(\"OPENGENI_MCP_OAUTH_ENABLED\"),\n    apiTrustedProxyHops: optional(\"OPENGENI_API_TRUSTED_PROXY_HOPS\"),\n    apiTrustedProxyCidrs: optional(\"OPENGENI_API_TRUSTED_PROXY_CIDRS\"),\n    webBaseUrl: optional(\"OPENGENI_WEB_BASE_URL\"),\n    officeAddinName: optional(\"OPENGENI_OFFICE_ADDIN_NAME\"),\n    officeAddinInstallUrl: optional(\"OPENGENI_OFFICE_ADDIN_INSTALL_URL\"),\n    browserExtensionName: optional(\"OPENGENI_BROWSER_EXTENSION_NAME\"),\n    browserExtensionInstallUrl: optional(\"OPENGENI_BROWSER_EXTENSION_INSTALL_URL\"),\n    agentReleasesBaseUrl: optional(\"OPENGENI_AGENT_RELEASES_BASE_URL\"),\n    agentStableVersion: optional(\"OPENGENI_AGENT_STABLE_VERSION\"),\n    agentBetaVersion: optional(\"OPENGENI_AGENT_BETA_VERSION\"),\n    desktopStableVersion: optional(\"OPENGENI_DESKTOP_STABLE_VERSION\"),\n    agentAutoUpdate: optional(\"OPENGENI_AGENT_AUTO_UPDATE\"),\n    productAccessMode: optional(\"OPENGENI_PRODUCT_ACCESS_MODE\"),\n    billingMode: optional(\"OPENGENI_BILLING_MODE\"),\n    verifiedSignupTrialCreditsEnabled: optional(\"OPENGENI_VERIFIED_SIGNUP_TRIAL_CREDITS_ENABLED\"),\n    creditPromotionPolicy: optional(\"OPENGENI_CREDIT_PROMOTION_POLICY_JSON\"),\n    entitlementsMode: optional(\"OPENGENI_ENTITLEMENTS_MODE\"),\n    usageLimitsMode: optional(\"OPENGENI_USAGE_LIMITS_MODE\"),\n    usageAllowancesEnabled: optional(\"OPENGENI_USAGE_ALLOWANCES_ENABLED\"),\n    staticEntitlementsJson: optional(\"OPENGENI_STATIC_ENTITLEMENTS_JSON\"),\n    staticUsageLimitsJson: optional(\"OPENGENI_STATIC_USAGE_LIMITS_JSON\"),\n    delegationSecret: optional(\"OPENGENI_DELEGATION_SECRET\"),\n    defaultFirstPartyMcpTools: optional(\"OPENGENI_DEFAULT_FIRST_PARTY_MCP_TOOLS\"),\n    allowedFirstPartyMcpTools: optional(\"OPENGENI_ALLOWED_FIRST_PARTY_MCP_TOOLS\"),\n    artifactMaterializerDeployed: optional(\"OPENGENI_ARTIFACT_MATERIALIZER_DEPLOYED\"),\n    streamTokenSecret: optional(\"OPENGENI_STREAM_TOKEN_SECRET\"),\n    streamControlEnabled: optional(\"OPENGENI_STREAM_CONTROL_ENABLED\"),\n    workDiscoveryEnabled: optional(\"OPENGENI_WORK_DISCOVERY_ENABLED\"),\n    workClaimMutationsEnabled: optional(\"OPENGENI_WORK_CLAIM_MUTATIONS_ENABLED\"),\n    workDiscoveryHumanAdvisoriesEnabled: optional(\n      \"OPENGENI_WORK_DISCOVERY_HUMAN_ADVISORIES_ENABLED\",\n    ),\n    workDiscoveryAutomaticNudgesEnabled: optional(\n      \"OPENGENI_WORK_DISCOVERY_AUTOMATIC_NUDGES_ENABLED\",\n    ),\n    ogtoolPackageSpec: optional(\"OPENGENI_OGTOOL_PACKAGE_SPEC\"),\n    environmentsEncryptionKey: optional(\"OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY\"),\n    onePasswordFakeTokens: optional(\"OPENGENI_ONEPASSWORD_FAKE_TOKENS\"),\n    protonPassCliPath: optional(\"OPENGENI_PROTON_PASS_CLI_PATH\"),\n    integrationsEnabled: optional(\"OPENGENI_INTEGRATIONS_ENABLED\"),\n    integrationsStateSecret: optional(\"OPENGENI_INTEGRATIONS_STATE_SECRET\"),\n    integrationsAllowPrivateNetworkTargets: optional(\n      \"OPENGENI_INTEGRATIONS_ALLOW_PRIVATE_NETWORK_TARGETS\",\n    ),\n    privacyOnlyMeAllowed: optional(\"OPENGENI_PRIVACY_ONLY_ME_ALLOWED\"),\n    privacyWorkspaceDefaultRequired: optional(\"OPENGENI_PRIVACY_WORKSPACE_DEFAULT_REQUIRED\"),\n    privacyAdminScheduleSummariesRequired: optional(\n      \"OPENGENI_PRIVACY_ADMIN_SCHEDULE_SUMMARIES_REQUIRED\",\n    ),\n    integrationsOauthClientsJson: optional(\"OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON\"),\n    gmailWatchTopicName: optional(\"OPENGENI_GMAIL_WATCH_TOPIC_NAME\"),\n    slackClientId: optional(\"OPENGENI_SLACK_CLIENT_ID\"),\n    slackClientSecret: optional(\"OPENGENI_SLACK_CLIENT_SECRET\"),\n    slackSigningSecret: optional(\"OPENGENI_SLACK_SIGNING_SECRET\"),\n    slackAccessMode: optional(\"OPENGENI_SLACK_ACCESS_MODE\"),\n    slackBotDisplayName: optional(\"OPENGENI_SLACK_BOT_DISPLAY_NAME\"),\n    slackCommand: optional(\"OPENGENI_SLACK_COMMAND\"),\n    googleDriveClientId: optional(\"OPENGENI_GOOGLE_DRIVE_CLIENT_ID\"),\n    googleDriveClientSecret: optional(\"OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET\"),\n    googleDriveSyncMaxItems: optional(\"OPENGENI_GOOGLE_DRIVE_SYNC_MAX_ITEMS\"),\n    googleDriveSyncMaxBytes: optional(\"OPENGENI_GOOGLE_DRIVE_SYNC_MAX_BYTES\"),\n    googleDriveSyncMaxFileBytes: optional(\"OPENGENI_GOOGLE_DRIVE_SYNC_MAX_FILE_BYTES\"),\n    googleDriveSyncMaxProviderRequests: optional(\n      \"OPENGENI_GOOGLE_DRIVE_SYNC_MAX_PROVIDER_REQUESTS\",\n    ),\n    googleDriveSyncMaxElapsedSeconds: optional(\"OPENGENI_GOOGLE_DRIVE_SYNC_MAX_ELAPSED_SECONDS\"),\n    googleDriveSyncMaxFailureDetails: optional(\"OPENGENI_GOOGLE_DRIVE_SYNC_MAX_FAILURE_DETAILS\"),\n    googleDriveProviderRequestTimeoutMs: optional(\n      \"OPENGENI_GOOGLE_DRIVE_PROVIDER_REQUEST_TIMEOUT_MS\",\n    ),\n    googleDriveProviderRetryAttempts: optional(\"OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_ATTEMPTS\"),\n    googleDriveProviderRetryInitialDelayMs: optional(\n      \"OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_INITIAL_DELAY_MS\",\n    ),\n    googleDriveProviderRetryMaxDelayMs: optional(\n      \"OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_MAX_DELAY_MS\",\n    ),\n    googleDriveProviderRetryBudgetMs: optional(\"OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_BUDGET_MS\"),\n    fikenClientId: optional(\"OPENGENI_FIKEN_OAUTH_CLIENT_ID\"),\n    fikenClientSecret: optional(\"OPENGENI_FIKEN_OAUTH_CLIENT_SECRET\"),\n    googleDriveWorkspaceEventsEnabled: optional(\"OPENGENI_GOOGLE_DRIVE_WORKSPACE_EVENTS_ENABLED\"),\n    atlassianClientId: optional(\"OPENGENI_ATLASSIAN_CLIENT_ID\"),\n    atlassianClientSecret: optional(\"OPENGENI_ATLASSIAN_CLIENT_SECRET\"),\n    maxNestedAgentDepth: optional(\"OPENGENI_MAX_NESTED_AGENT_DEPTH\"),\n    socialOauthClientsJson: optional(\"OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON\"),\n    goalMaxAutoContinuations: optional(\"OPENGENI_GOAL_MAX_AUTO_CONTINUATIONS\"),\n    goalIdleBackoffMs: optional(\"OPENGENI_GOAL_IDLE_BACKOFF_MS\"),\n    goalIdleBackoffMaxMs: optional(\"OPENGENI_GOAL_IDLE_BACKOFF_MAX_MS\"),\n    childLifecycleNoticesEnabled: optional(\"OPENGENI_CHILD_LIFECYCLE_NOTICES_ENABLED\"),\n    sessionUsageLimitsEnabled: optional(\"OPENGENI_SESSION_USAGE_LIMITS_ENABLED\"),\n    slackWorkspaceRoutingEnabled: optional(\"OPENGENI_SLACK_WORKSPACE_ROUTING_ENABLED\"),\n    agentMaxModelCallsPerTurn: optional(\"OPENGENI_AGENT_MAX_MODEL_CALLS_PER_TURN\"),\n    contextWindowTokens: optional(\"OPENGENI_CONTEXT_WINDOW_TOKENS\"),\n    contextEffectiveWindowTokens: optional(\"OPENGENI_CONTEXT_EFFECTIVE_WINDOW_TOKENS\"),\n    contextCompactionThresholdRatio: optional(\"OPENGENI_COMPACTION_THRESHOLD_RATIO\"),\n    contextReservedOutputTokens: optional(\"OPENGENI_CONTEXT_RESERVED_OUTPUT_TOKENS\"),\n    contextAutoCompactThresholdTokens: optional(\"OPENGENI_CONTEXT_AUTO_COMPACT_THRESHOLD_TOKENS\"),\n    modelToolOutputTruncationTokens: optional(\"OPENGENI_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS\"),\n    authRequired: optional(\"OPENGENI_AUTH_REQUIRED\"),\n    accessKey: optional(\"OPENGENI_ACCESS_KEY\"),\n    authAllowHealth: optional(\"OPENGENI_AUTH_ALLOW_HEALTH\"),\n    authAllowMetrics: optional(\"OPENGENI_AUTH_ALLOW_METRICS\"),\n    apiHost: optional(\"OPENGENI_API_HOST\"),\n    apiPort: optional(\"OPENGENI_API_PORT\"),\n    apiMetricsPort: optional(\"OPENGENI_API_METRICS_PORT\"),\n    workerHttpPort: optional(\"OPENGENI_WORKER_HTTP_PORT\"),\n    opengeniMcpInternalUrl: optional(\"OPENGENI_MCP_INTERNAL_URL\"),\n    opengeniMcpUrl: optional(\"OPENGENI_MCP_URL\"),\n    corsAllowOriginRegex: optional(\"OPENGENI_CORS_ALLOW_ORIGIN_REGEX\"),\n    localAllowedOrigins: optional(\"OPENGENI_LOCAL_ALLOWED_ORIGINS\"),\n    openaiProvider: optional(\"OPENGENI_OPENAI_PROVIDER\"),\n    openaiApiKey: optional(\"OPENGENI_OPENAI_API_KEY\") ?? optional(\"OPENAI_API_KEY\"),\n    openaiBaseUrl: optional(\"OPENGENI_OPENAI_BASE_URL\") ?? optional(\"OPENAI_BASE_URL\"),\n    openaiModel: optional(\"OPENGENI_OPENAI_MODEL\"),\n    openaiAllowedModels: optional(\"OPENGENI_OPENAI_ALLOWED_MODELS\"),\n    vercelAiGatewayApiKey: optional(\"OPENGENI_VERCEL_AI_GATEWAY_API_KEY\"),\n    imageGenerationModel: optional(\"OPENGENI_IMAGE_GENERATION_MODEL\"),\n    videoGenerationPollIntervalMs: optional(\"OPENGENI_VIDEO_GENERATION_POLL_INTERVAL_MS\"),\n    videoGenerationRecoveryDeadlineMs: optional(\"OPENGENI_VIDEO_GENERATION_RECOVERY_DEADLINE_MS\"),\n    videoGenerationReferenceUrlTtlSeconds: optional(\n      \"OPENGENI_VIDEO_GENERATION_REFERENCE_URL_TTL_SECONDS\",\n    ),\n    videoGenerationMaxConcurrentPerWorkspace: optional(\n      \"OPENGENI_VIDEO_GENERATION_MAX_CONCURRENT_PER_WORKSPACE\",\n    ),\n    videoGenerationWorkspaceQuotaBytes: optional(\"OPENGENI_VIDEO_GENERATION_WORKSPACE_QUOTA_BYTES\"),\n    retainedImageWorkspaceQuotaBytes: optional(\"OPENGENI_RETAINED_IMAGE_WORKSPACE_QUOTA_BYTES\"),\n    retainedImageWorkspaceQuotaOverrides: optional(\n      \"OPENGENI_RETAINED_IMAGE_WORKSPACE_QUOTA_OVERRIDES\",\n    ),\n    videoGenerationTempDirectory: optional(\"OPENGENI_VIDEO_GENERATION_TEMP_DIRECTORY\"),\n    videoGenerationFfprobePath: optional(\"OPENGENI_VIDEO_GENERATION_FFPROBE_PATH\"),\n    videoGenerationCredit480pMicrosPerSecond: optional(\n      \"OPENGENI_VIDEO_GENERATION_CREDIT_480P_MICROS_PER_SECOND\",\n    ),\n    videoGenerationCredit720pMicrosPerSecond: optional(\n      \"OPENGENI_VIDEO_GENERATION_CREDIT_720P_MICROS_PER_SECOND\",\n    ),\n    voiceInputMaxDurationSeconds: optional(\"OPENGENI_VOICE_INPUT_MAX_DURATION_SECONDS\"),\n    voiceInputMaxSizeBytes: optional(\"OPENGENI_VOICE_INPUT_MAX_SIZE_BYTES\"),\n    voiceInputResumableEnabled: optional(\"OPENGENI_VOICE_INPUT_RESUMABLE_ENABLED\"),\n    voiceInputResumableMaxDurationSeconds: optional(\n      \"OPENGENI_VOICE_INPUT_RESUMABLE_MAX_DURATION_SECONDS\",\n    ),\n    voiceInputResumableMaxSizeBytes: optional(\"OPENGENI_VOICE_INPUT_RESUMABLE_MAX_SIZE_BYTES\"),\n    voiceInputResumableMaxChunkSizeBytes: optional(\n      \"OPENGENI_VOICE_INPUT_RESUMABLE_MAX_CHUNK_SIZE_BYTES\",\n    ),\n    sessionArchiveEnabled: optional(\"OPENGENI_SESSION_ARCHIVE_ENABLED\"),\n    sessionArchiveIdleDays: optional(\"OPENGENI_SESSION_ARCHIVE_IDLE_DAYS\"),\n    voiceInputResumableRetentionSeconds: optional(\n      \"OPENGENI_VOICE_INPUT_RESUMABLE_RETENTION_SECONDS\",\n    ),\n    voiceInputFfmpegPath: optional(\"OPENGENI_VOICE_INPUT_FFMPEG_PATH\"),\n    voiceInputProviderOrder: optional(\"OPENGENI_VOICE_INPUT_PROVIDER_ORDER\"),\n    voiceInputOpenaiEnabled: optional(\"OPENGENI_VOICE_INPUT_OPENAI_ENABLED\"),\n    voiceInputOpenaiApiKey: optional(\"OPENGENI_VOICE_INPUT_OPENAI_API_KEY\"),\n    voiceInputOpenaiBaseUrl: optional(\"OPENGENI_VOICE_INPUT_OPENAI_BASE_URL\"),\n    voiceInputOpenaiModel: optional(\"OPENGENI_VOICE_INPUT_OPENAI_MODEL\"),\n    voiceInputAzureEnabled: optional(\"OPENGENI_VOICE_INPUT_AZURE_ENABLED\"),\n    voiceInputAzureEndpoint: optional(\"OPENGENI_VOICE_INPUT_AZURE_ENDPOINT\"),\n    voiceInputAzureDeployment: optional(\"OPENGENI_VOICE_INPUT_AZURE_DEPLOYMENT\"),\n    voiceInputAzureApiVersion: optional(\"OPENGENI_VOICE_INPUT_AZURE_API_VERSION\"),\n    voiceInputAzureApiKey: optional(\"OPENGENI_VOICE_INPUT_AZURE_API_KEY\"),\n    voiceInputAzureAdToken: optional(\"OPENGENI_VOICE_INPUT_AZURE_AD_TOKEN\"),\n    azureLiveEndpoint: optional(\"OPENGENI_AZURE_LIVE_ENDPOINT\"),\n    azureLiveApiKey: optional(\"OPENGENI_AZURE_LIVE_API_KEY\"),\n    azureLiveDeployment: optional(\"OPENGENI_AZURE_LIVE_DEPLOYMENT\"),\n    azureLiveVoice: optional(\"OPENGENI_AZURE_LIVE_VOICE\"),\n    azureLivePricingJson: optional(\"OPENGENI_AZURE_LIVE_PRICING_JSON\"),\n    aiGatewayRealtimePricingJson: optional(\"OPENGENI_AI_GATEWAY_REALTIME_PRICING_JSON\"),\n    voiceInputMaiEndpoint: optional(\"OPENGENI_VOICE_INPUT_MAI_ENDPOINT\"),\n    voiceInputMaiApiKey: optional(\"OPENGENI_VOICE_INPUT_MAI_API_KEY\"),\n    voiceInputMaiApiVersion: optional(\"OPENGENI_VOICE_INPUT_MAI_API_VERSION\"),\n    voiceInputMaiPricingJson: optional(\"OPENGENI_VOICE_INPUT_MAI_PRICING_JSON\"),\n    voiceInputMaiModel: optional(\"OPENGENI_VOICE_INPUT_MAI_MODEL\"),\n    voiceInputAzureModel: optional(\"OPENGENI_VOICE_INPUT_AZURE_MODEL\"),\n    voiceInputOpenaiPricingJson: optional(\"OPENGENI_VOICE_INPUT_OPENAI_PRICING_JSON\"),\n    voiceInputAzurePricingJson: optional(\"OPENGENI_VOICE_INPUT_AZURE_PRICING_JSON\"),\n    voiceInputCodexExperimentalEnabled: optional(\"OPENGENI_VOICE_INPUT_CODEX_EXPERIMENTAL\"),\n    creditMarginBpsOverride: optional(\"OPENGENI_CREDIT_MARGIN_BPS_OVERRIDE\"),\n    modelPricingJson: optional(\"OPENGENI_MODEL_PRICING_JSON\"),\n    modelCatalogSource,\n    modelCostPolicyJson,\n    modelNotesJson: optional(\"OPENGENI_MODEL_NOTES_JSON\"),\n    openrouterApiKey: optional(\"OPENGENI_OPENROUTER_API_KEY\"),\n    opperApiKey: optional(\"OPENGENI_OPPER_API_KEY\"),\n    managedModelsJson: optional(\"OPENGENI_MANAGED_MODELS_JSON\"),\n    modelProvidersJson: optional(\"OPENGENI_MODEL_PROVIDERS_JSON\"),\n    codexSubscriptionEnabled: optional(\"OPENGENI_CODEX_SUBSCRIPTION_ENABLED\"),\n    experimentSystemPromptCacheSplit: optional(\"OPENGENI_EXPERIMENT_SYSTEM_PROMPT_CACHE_SPLIT\"),\n    experimentCutPolling: optional(\"OPENGENI_EXPERIMENT_CUT_POLLING\"),\n    experimentOutputCost: optional(\"OPENGENI_EXPERIMENT_OUTPUT_COST\"),\n    supergrokSubscriptionEnabled: optional(\"OPENGENI_SUPERGROK_SUBSCRIPTION_ENABLED\"),\n    claudeSubscriptionEnabled: optional(\"OPENGENI_CLAUDE_SUBSCRIPTION_ENABLED\"),\n    supergrokResponseStreamIdleTimeoutMs: optional(\n      \"OPENGENI_SUPERGROK_RESPONSE_STREAM_IDLE_TIMEOUT_MS\",\n    ),\n    modelStreamIdleTimeoutMs: optional(\"OPENGENI_MODEL_STREAM_IDLE_TIMEOUT_MS\"),\n    modelStreamProgressTimeoutMs: optional(\"OPENGENI_MODEL_STREAM_PROGRESS_TIMEOUT_MS\"),\n    codexConnectedAppsEnabled: optional(\"OPENGENI_CODEX_CONNECTED_APPS_ENABLED\"),\n    codexToolSearchEnabled: optional(\"OPENGENI_CODEX_TOOL_SEARCH_ENABLED\"),\n    codexResponsesWebSocketEnabled: optional(\"OPENGENI_CODEX_RESPONSES_WEBSOCKET_ENABLED\"),\n    openaiResponsesWebSocketEnabled: optional(\"OPENGENI_OPENAI_RESPONSES_WEBSOCKET_ENABLED\"),\n    lazyToolSearchEnabled: optional(\"OPENGENI_LAZY_TOOL_SEARCH_ENABLED\"),\n    decisionModelProvider: optional(\"OPENGENI_DECISION_MODEL_PROVIDER\"),\n    decisionModelId: optional(\"OPENGENI_DECISION_MODEL_ID\"),\n    decisionModelApiKey: optional(\"OPENGENI_DECISION_MODEL_API_KEY\"),\n    decisionModelBaseUrl: optional(\"OPENGENI_DECISION_MODEL_BASE_URL\"),\n    codexFleetPolicyShadowEnabled: optional(\"OPENGENI_CODEX_FLEET_POLICY_SHADOW_ENABLED\"),\n    subscriptionCoreShadowEnabled: optional(\"OPENGENI_SUBSCRIPTION_CORE_SHADOW_ENABLED\"),\n    subscriptionCrossProviderFailoverEnabled: optional(\n      \"OPENGENI_SUBSCRIPTION_CROSS_PROVIDER_FAILOVER_ENABLED\",\n    ),\n    subscriptionCoreShadowTimeoutMs: optional(\"OPENGENI_SUBSCRIPTION_CORE_SHADOW_TIMEOUT_MS\"),\n    codexProductSku: optional(\"OPENGENI_CODEX_PRODUCT_SKU\"),\n    reasoningConfigurationUpdatesEnabled: optional(\n      \"OPENGENI_REASONING_CONFIGURATION_UPDATES_ENABLED\",\n    ),\n    openaiReasoningEffort: optional(\"OPENGENI_OPENAI_REASONING_EFFORT\"),\n    openaiAllowedReasoningEfforts: optional(\"OPENGENI_OPENAI_ALLOWED_REASONING_EFFORTS\"),\n    creditsDefaultModel: optional(\"OPENGENI_CREDITS_DEFAULT_MODEL\"),\n    creditsDefaultReasoningEffort: optional(\"OPENGENI_CREDITS_DEFAULT_REASONING_EFFORT\"),\n    openaiResponsesTransport: optional(\"OPENGENI_OPENAI_RESPONSES_TRANSPORT\"),\n    openaiProviderItemIds: optional(\"OPENGENI_OPENAI_PROVIDER_ITEM_IDS\"),\n    openaiReasoningEncryptedContent: optional(\"OPENGENI_OPENAI_REASONING_ENCRYPTED_CONTENT\"),\n    openaiMaxRetries: optional(\"OPENGENI_OPENAI_MAX_RETRIES\"),\n    webSearchEnabled: optional(\"OPENGENI_WEB_SEARCH_ENABLED\"),\n    webSearchProvider: optional(\"OPENGENI_WEB_SEARCH_PROVIDER\"),\n    webSearchPrefer: optional(\"OPENGENI_WEB_SEARCH_PREFER\"),\n    webSearchProviderCredentials: webSearchProviderCredentialsFromEnv(source),\n    webSearchApiKey: optional(\"OPENGENI_WEB_SEARCH_API_KEY\"),\n    webSearchBaseUrl: optional(\"OPENGENI_WEB_SEARCH_BASE_URL\"),\n    webFetchProvider: optional(\"OPENGENI_WEB_FETCH_PROVIDER\"),\n    webFetchApiKey: optional(\"OPENGENI_WEB_FETCH_API_KEY\"),\n    webFetchBaseUrl: optional(\"OPENGENI_WEB_FETCH_BASE_URL\"),\n    webSearchProviderMode: optional(\"OPENGENI_WEB_SEARCH_PROVIDER_MODE\"),\n    webSearchPricingJson: optional(\"OPENGENI_WEB_SEARCH_PRICING_JSON\"),\n    webSearchRequestTimeoutMs: optional(\"OPENGENI_WEB_SEARCH_REQUEST_TIMEOUT_MS\"),\n    jevApiKey: optional(\"OPENGENI_JEV_API_KEY\"),\n    jevBaseUrl: optional(\"OPENGENI_JEV_BASE_URL\"),\n    jevModel: optional(\"OPENGENI_JEV_MODEL\"),\n    jevRequestTimeoutMs: optional(\"OPENGENI_JEV_REQUEST_TIMEOUT_MS\"),\n    codeSearchMode: optional(\"OPENGENI_CODE_SEARCH_MODE\"),\n    agentInstructionsTemplate: optional(\"OPENGENI_AGENT_INSTRUCTIONS_TEMPLATE\"),\n    deploymentAgentInstructions: optional(\"OPENGENI_DEPLOYMENT_AGENT_INSTRUCTIONS\"),\n    experimentKnowledgeRetrievalGuidance: optional(\n      \"OPENGENI_EXPERIMENT_KNOWLEDGE_RETRIEVAL_GUIDANCE\",\n    ),\n    azureOpenaiBaseUrl: optional(\"OPENGENI_AZURE_OPENAI_BASE_URL\"),\n    azureOpenaiEndpoint: optional(\"OPENGENI_AZURE_OPENAI_ENDPOINT\"),\n    azureOpenaiDeployment: optional(\"OPENGENI_AZURE_OPENAI_DEPLOYMENT\"),\n    azureOpenaiApiVersion: optional(\"OPENGENI_AZURE_OPENAI_API_VERSION\"),\n    azureOpenaiApiKey: optional(\"OPENGENI_AZURE_OPENAI_API_KEY\"),\n    azureOpenaiAdToken: optional(\"OPENGENI_AZURE_OPENAI_AD_TOKEN\"),\n    disableOpenaiTracing: optional(\"OPENGENI_DISABLE_OPENAI_TRACING\"),\n    sandboxBackend: optional(\"OPENGENI_SANDBOX_BACKEND\"),\n    dockerImage: optional(\"OPENGENI_DOCKER_IMAGE\"),\n    sandboxArtifactRuntimeEnabled: optional(\"OPENGENI_SANDBOX_ARTIFACT_RUNTIME_ENABLED\"),\n    dockerExposedPorts: optional(\"OPENGENI_DOCKER_EXPOSED_PORTS\"),\n    dockerNetwork: optional(\"OPENGENI_DOCKER_NETWORK\"),\n    dockerWorkspaceBaseDir: optional(\"OPENGENI_DOCKER_WORKSPACE_BASE_DIR\"),\n    modalAppName: optional(\"OPENGENI_MODAL_APP_NAME\"),\n    modalImageRef: optional(\"OPENGENI_MODAL_IMAGE_REF\") ?? DEFAULT_MODAL_IMAGE_REF,\n    modalCommandSupervisionEnabled: optional(\"OPENGENI_MODAL_COMMAND_SUPERVISION_ENABLED\"),\n    modalImageId: optional(\"OPENGENI_MODAL_IMAGE_ID\"),\n    modalImageRegistrySecret: optional(\"OPENGENI_MODAL_IMAGE_REGISTRY_SECRET\"),\n    modalTimeoutSeconds: optional(\"OPENGENI_MODAL_TIMEOUT_SECONDS\"),\n    modalSandboxCpu: optional(\"OPENGENI_MODAL_SANDBOX_CPU\"),\n    modalSandboxMemoryMiB: optional(\"OPENGENI_MODAL_SANDBOX_MEMORY_MIB\"),\n    modalRegions: optional(\"OPENGENI_MODAL_REGIONS\"),\n    modalTokenId: optional(\"OPENGENI_MODAL_TOKEN_ID\"),\n    modalTokenSecret: optional(\"OPENGENI_MODAL_TOKEN_SECRET\"),\n    modalEnvironment: optional(\"OPENGENI_MODAL_ENVIRONMENT\"),\n    modalIdleTimeoutSeconds: optional(\"OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS\"),\n    modalWorkspacePersistence: optional(\"OPENGENI_MODAL_WORKSPACE_PERSISTENCE\"),\n    sandboxDesktopEnabled: optional(\"OPENGENI_SANDBOX_DESKTOP_ENABLED\"),\n    sandboxDesktopInteractive: optional(\"OPENGENI_SANDBOX_DESKTOP_INTERACTIVE\"),\n    sandboxTerminalEnabled: optional(\"OPENGENI_SANDBOX_TERMINAL_ENABLED\"),\n    streamResolutionWidth: optional(\"OPENGENI_STREAM_RESOLUTION_WIDTH\"),\n    streamResolutionHeight: optional(\"OPENGENI_STREAM_RESOLUTION_HEIGHT\"),\n    recordingEnabled: optional(\"OPENGENI_RECORDING_ENABLED\"),\n    workspaceCaptureEnabled: optional(\"OPENGENI_WORKSPACE_CAPTURE\"),\n    recordingDefaultCodec: optional(\"OPENGENI_RECORDING_DEFAULT_CODEC\"),\n    recordingFramerate: optional(\"OPENGENI_RECORDING_FRAMERATE\"),\n    recordingMaxSeconds: optional(\"OPENGENI_RECORDING_MAX_SECONDS\"),\n    recordingMaxBytes: optional(\"OPENGENI_RECORDING_MAX_BYTES\"),\n    daytonaApiKey: optional(\"OPENGENI_DAYTONA_API_KEY\"),\n    daytonaApiUrl: optional(\"OPENGENI_DAYTONA_API_URL\"),\n    daytonaTarget: optional(\"OPENGENI_DAYTONA_TARGET\"),\n    daytonaImage: optional(\"OPENGENI_DAYTONA_IMAGE\"),\n    daytonaSnapshotName: optional(\"OPENGENI_DAYTONA_SNAPSHOT_NAME\"),\n    daytonaAutoStopInterval: optional(\"OPENGENI_DAYTONA_AUTO_STOP_INTERVAL\"),\n    daytonaTimeoutSeconds: optional(\"OPENGENI_DAYTONA_TIMEOUT_SECONDS\"),\n    daytonaExposedPortUrlTtlSeconds: optional(\"OPENGENI_DAYTONA_EXPOSED_PORT_URL_TTL_SECONDS\"),\n    runloopApiKey: optional(\"OPENGENI_RUNLOOP_API_KEY\"),\n    runloopBaseUrl: optional(\"OPENGENI_RUNLOOP_BASE_URL\"),\n    runloopBlueprintName: optional(\"OPENGENI_RUNLOOP_BLUEPRINT_NAME\"),\n    runloopBlueprintId: optional(\"OPENGENI_RUNLOOP_BLUEPRINT_ID\"),\n    runloopTunnel: optional(\"OPENGENI_RUNLOOP_TUNNEL\"),\n    runloopKeepAliveSeconds: optional(\"OPENGENI_RUNLOOP_KEEP_ALIVE_SECONDS\"),\n    e2bApiKey: optional(\"OPENGENI_E2B_API_KEY\"),\n    e2bDomain: optional(\"OPENGENI_E2B_DOMAIN\"),\n    e2bApiUrl: optional(\"OPENGENI_E2B_API_URL\"),\n    e2bSandboxUrl: optional(\"OPENGENI_E2B_SANDBOX_URL\"),\n    e2bTemplate: optional(\"OPENGENI_E2B_TEMPLATE\"),\n    e2bTimeoutSeconds: optional(\"OPENGENI_E2B_TIMEOUT_SECONDS\"),\n    e2bTimeoutAction: optional(\"OPENGENI_E2B_TIMEOUT_ACTION\"),\n    e2bAllowInternetAccess: optional(\"OPENGENI_E2B_ALLOW_INTERNET_ACCESS\"),\n    e2bAutoResume: optional(\"OPENGENI_E2B_AUTO_RESUME\"),\n    e2bWorkspacePersistence: optional(\"OPENGENI_E2B_WORKSPACE_PERSISTENCE\"),\n    blaxelApiKey: optional(\"OPENGENI_BLAXEL_API_KEY\"),\n    blaxelImage: optional(\"OPENGENI_BLAXEL_IMAGE\"),\n    blaxelRegion: optional(\"OPENGENI_BLAXEL_REGION\"),\n    blaxelExposedPortPublic: optional(\"OPENGENI_BLAXEL_EXPOSED_PORT_PUBLIC\"),\n    blaxelExposedPortUrlTtlSeconds: optional(\"OPENGENI_BLAXEL_EXPOSED_PORT_URL_TTL_SECONDS\"),\n    blaxelMemoryMb: optional(\"OPENGENI_BLAXEL_MEMORY_MB\"),\n    blaxelTtl: optional(\"OPENGENI_BLAXEL_TTL\"),\n    cloudflareWorkerUrl: optional(\"OPENGENI_CLOUDFLARE_WORKER_URL\"),\n    cloudflareApiKey: optional(\"OPENGENI_CLOUDFLARE_API_KEY\"),\n    experimentalBrowserContextPoolEnabled: optional(\n      \"OPENGENI_EXPERIMENTAL_BROWSER_CONTEXT_POOL_ENABLED\",\n    ),\n    browserbaseApiKey: optional(\"OPENGENI_BROWSERBASE_API_KEY\"),\n    kernelApiKey: optional(\"OPENGENI_KERNEL_API_KEY\"),\n    kernelEndpoint: optional(\"OPENGENI_KERNEL_ENDPOINT\"),\n    kernelBrowserTimeoutSeconds: optional(\"OPENGENI_KERNEL_BROWSER_TIMEOUT_SECONDS\"),\n    kernelBrowserStealth: optional(\"OPENGENI_KERNEL_BROWSER_STEALTH\"),\n    vercelToken: optional(\"OPENGENI_VERCEL_TOKEN\"),\n    vercelProjectId: optional(\"OPENGENI_VERCEL_PROJECT_ID\"),\n    vercelTeamId: optional(\"OPENGENI_VERCEL_TEAM_ID\"),\n    vercelRuntime: optional(\"OPENGENI_VERCEL_RUNTIME\"),\n    openSandboxBaseUrl: optional(\"OPENGENI_OPENSANDBOX_BASE_URL\"),\n    openSandboxApiKey: optional(\"OPENGENI_OPENSANDBOX_API_KEY\"),\n    openSandboxImage: optional(\"OPENGENI_OPENSANDBOX_IMAGE\"),\n    openSandboxTtlSeconds: optional(\"OPENGENI_OPENSANDBOX_TTL_SECONDS\"),\n    openSandboxUseServerProxy: optional(\"OPENGENI_OPENSANDBOX_USE_SERVER_PROXY\"),\n    openSandboxSignedEndpoints: optional(\"OPENGENI_OPENSANDBOX_SIGNED_ENDPOINTS\"),\n    openSandboxSignedEndpointTtlSeconds: optional(\n      \"OPENGENI_OPENSANDBOX_SIGNED_ENDPOINT_TTL_SECONDS\",\n    ),\n    openSandboxChannelBPublicBaseUrl: optional(\"OPENGENI_OPENSANDBOX_CHANNEL_B_PUBLIC_BASE_URL\"),\n    openSandboxInteractionFrameProxy: optional(\"OPENGENI_OPENSANDBOX_INTERACTION_FRAME_PROXY\"),\n    openSandboxPoolRef: optional(\"OPENGENI_OPENSANDBOX_POOL_REF\"),\n    openSandboxKubernetesInventoryNamespace: optional(\n      \"OPENGENI_OPENSANDBOX_KUBERNETES_INVENTORY_NAMESPACE\",\n    ),\n    computeApiUrl: optional(\"OPENGENI_COMPUTE_API_URL\"),\n    computeApiKey: optional(\"OPENGENI_COMPUTE_API_KEY\"),\n    computeImage: optional(\"OPENGENI_COMPUTE_IMAGE\"),\n    computeDesktopImage: optional(\"OPENGENI_COMPUTE_DESKTOP_IMAGE\"),\n    computeVcpus: optional(\"OPENGENI_COMPUTE_VCPUS\"),\n    computeMemoryMib: optional(\"OPENGENI_COMPUTE_MEMORY_MIB\"),\n    computeMemoryRequestMib: optional(\"OPENGENI_COMPUTE_MEMORY_REQUEST_MIB\"),\n    computeCpuRequestMillis: optional(\"OPENGENI_COMPUTE_CPU_REQUEST_MILLIS\"),\n    computeLinkUrl: optional(\"OPENGENI_COMPUTE_LINK_URL\"),\n    computeAgentReadyTimeoutMs: optional(\"OPENGENI_COMPUTE_AGENT_READY_TIMEOUT_MS\"),\n    sandboxOwnershipEnabled: optional(\"OPENGENI_SANDBOX_OWNERSHIP_ENABLED\"),\n    rigVerificationLeaseOwnershipEnabled: optional(\n      \"OPENGENI_RIG_VERIFICATION_LEASE_OWNERSHIP_ENABLED\",\n    ),\n    sandboxLazyProvisionEnabled: optional(\"OPENGENI_SANDBOX_LAZY_PROVISION\"),\n    sandboxSelfhostedEnabled: optional(\"OPENGENI_SANDBOX_SELFHOSTED_ENABLED\"),\n    agentOpStreamEnabled: optional(\"OPENGENI_AGENT_OP_STREAM_ENABLED\"),\n    enrollmentSigningSecret: optional(\"OPENGENI_ENROLLMENT_SIGNING_SECRET\"),\n    selfhostedNatsUrl: optional(\"OPENGENI_SELFHOSTED_NATS_URL\"),\n    selfhostedRelayUrl: optional(\"OPENGENI_SELFHOSTED_RELAY_URL\"),\n    selfhostedRelayTokenSecret: optional(\"OPENGENI_SELFHOSTED_RELAY_TOKEN_SECRET\"),\n    agentUpdatePublicKey: optional(\"OPENGENI_AGENT_UPDATE_PUBLIC_KEY\"),\n    selfhostedNatsCalloutAccountSeed: optional(\"OPENGENI_SELFHOSTED_NATS_CALLOUT_ACCOUNT_SEED\"),\n    selfhostedNatsCalloutAccountName: optional(\"OPENGENI_SELFHOSTED_NATS_CALLOUT_ACCOUNT_NAME\"),\n    selfhostedNatsCalloutUser: optional(\"OPENGENI_SELFHOSTED_NATS_CALLOUT_USER\"),\n    selfhostedNatsCalloutPassword: optional(\"OPENGENI_SELFHOSTED_NATS_CALLOUT_PASSWORD\"),\n    selfhostedNatsControlUser: optional(\"OPENGENI_SELFHOSTED_NATS_CONTROL_USER\"),\n    selfhostedNatsControlPassword: optional(\"OPENGENI_SELFHOSTED_NATS_CONTROL_PASSWORD\"),\n    sandboxSelfhostedExecTimeoutMs: optional(\"OPENGENI_SANDBOX_SELFHOSTED_EXEC_TIMEOUT_MS\"),\n    sandboxSelfhostedControlTimeoutMs: optional(\"OPENGENI_SANDBOX_SELFHOSTED_CONTROL_TIMEOUT_MS\"),\n    sandboxLeaseReaperPeriodMs: optional(\"OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS\"),\n    sandboxViewerHolderTtlMs: optional(\"OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS\"),\n    sandboxInteractionHolderTtlMs: optional(\"OPENGENI_SANDBOX_INTERACTION_HOLDER_TTL_MS\"),\n    sandboxIdleGraceMs: optional(\"OPENGENI_SANDBOX_IDLE_GRACE_MS\"),\n    sandboxIdleCommandContainmentMs: optional(\"OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS\"),\n    sandboxSnapshotIntervalMs: optional(\"OPENGENI_SANDBOX_SNAPSHOT_INTERVAL_MS\"),\n    sandboxSnapshotTimeoutMs: optional(\"OPENGENI_SANDBOX_SNAPSHOT_TIMEOUT_MS\"),\n    sandboxDrainSnapshotTimeoutMs: optional(\"OPENGENI_SANDBOX_DRAIN_SNAPSHOT_TIMEOUT_MS\"),\n    sandboxRotationLeadMs: optional(\"OPENGENI_SANDBOX_ROTATION_LEAD_MS\"),\n    sandboxRotationBatchSize: optional(\"OPENGENI_SANDBOX_ROTATION_BATCH_SIZE\"),\n    sandboxLeaseTtlMs: optional(\"OPENGENI_SANDBOX_LEASE_TTL_MS\"),\n    sandboxLeaseWarmingTtlMs: optional(\"OPENGENI_SANDBOX_LEASE_WARMING_TTL_MS\"),\n    sandboxWarmingTimeoutMs: optional(\"OPENGENI_SANDBOX_WARMING_TIMEOUT_MS\"),\n    workspaceControlLockTimeoutMs: optional(\"OPENGENI_WORKSPACE_CONTROL_LOCK_TIMEOUT_MS\"),\n    rigSetupTimeoutMs: optional(\"OPENGENI_RIG_SETUP_TIMEOUT_MS\"),\n    sandboxWarmRateMicrosPerSecondJson: optional(\n      \"OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON\",\n    ),\n    sandboxWarmBillingMode: optional(\"OPENGENI_SANDBOX_WARM_BILLING_MODE\"),\n    sandboxMaxWarmSecondsPerWorkspace: optional(\"OPENGENI_SANDBOX_MAX_WARM_SECONDS_PER_WORKSPACE\"),\n    sandboxPreparationProfiles: optional(\"OPENGENI_SANDBOX_PREPARATION_PROFILES\"),\n    sandboxEnvAllowlist: optional(\"OPENGENI_SANDBOX_ENV_ALLOWLIST\"),\n    sandboxImageAllowlist: optional(\"OPENGENI_SANDBOX_IMAGE_ALLOWLIST\"),\n    objectStorageEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_ENDPOINT\"),\n    objectStorageInternalEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_INTERNAL_ENDPOINT\"),\n    objectStorageSandboxEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_SANDBOX_ENDPOINT\"),\n    objectStorageBackend: optional(\"OPENGENI_OBJECT_STORAGE_BACKEND\"),\n    objectStorageBucket: optional(\"OPENGENI_OBJECT_STORAGE_BUCKET\"),\n    objectStorageRegion: optional(\"OPENGENI_OBJECT_STORAGE_REGION\"),\n    objectStorageS3Provider: optional(\"OPENGENI_OBJECT_STORAGE_S3_PROVIDER\"),\n    objectStorageAccessKeyId: optional(\"OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID\"),\n    objectStorageSecretAccessKey: optional(\"OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY\"),\n    objectStorageForcePathStyle: optional(\"OPENGENI_OBJECT_STORAGE_FORCE_PATH_STYLE\"),\n    objectStorageAzureConnectionString: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_CONNECTION_STRING\"),\n    objectStorageAzureAccountName: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_NAME\"),\n    objectStorageAzureAccountKey: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_KEY\"),\n    objectStorageAzureEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_AZURE_ENDPOINT\"),\n    objectStorageGcsProjectId: optional(\"OPENGENI_OBJECT_STORAGE_GCS_PROJECT_ID\"),\n    objectStorageGcsCredentialsJson: optional(\"OPENGENI_OBJECT_STORAGE_GCS_CREDENTIALS_JSON\"),\n    objectStorageGcsKeyFilename: optional(\"OPENGENI_OBJECT_STORAGE_GCS_KEY_FILENAME\"),\n    objectStorageGcsApiEndpoint: optional(\"OPENGENI_OBJECT_STORAGE_GCS_API_ENDPOINT\"),\n    documentParser: optional(\"OPENGENI_DOCUMENT_PARSER\"),\n    documentChunkSize: optional(\"OPENGENI_DOCUMENT_CHUNK_SIZE\"),\n    documentChunkOverlap: optional(\"OPENGENI_DOCUMENT_CHUNK_OVERLAP\"),\n    documentEmbeddingProvider: optional(\"OPENGENI_DOCUMENT_EMBEDDING_PROVIDER\"),\n    documentEmbeddingModel: optional(\"OPENGENI_DOCUMENT_EMBEDDING_MODEL\"),\n    documentEmbeddingDimensions: optional(\"OPENGENI_DOCUMENT_EMBEDDING_DIMENSIONS\"),\n    documentEmbeddingApiKey: optional(\"OPENGENI_DOCUMENT_EMBEDDING_API_KEY\"),\n    documentEmbeddingBaseUrl: optional(\"OPENGENI_DOCUMENT_EMBEDDING_BASE_URL\"),\n    documentEmbeddingBillingMode: optional(\"OPENGENI_DOCUMENT_EMBEDDING_BILLING_MODE\"),\n    sitesCloudflareStorageEnabled: optional(\"OPENGENI_SITES_CLOUDFLARE_STORAGE_ENABLED\"),\n    sitesGatewayInternalOrigin: optional(\"OPENGENI_SITES_GATEWAY_INTERNAL_ORIGIN\"),\n    sitesSqlFreeStorageBytes: optional(\"OPENGENI_SITES_SQL_FREE_STORAGE_BYTES\"),\n    sitesSqlFreeRowsReadPerMonth: optional(\"OPENGENI_SITES_SQL_FREE_ROWS_READ_PER_MONTH\"),\n    sitesSqlFreeRowsWrittenPerMonth: optional(\"OPENGENI_SITES_SQL_FREE_ROWS_WRITTEN_PER_MONTH\"),\n    sitesSqlFreeCallsPerMinutePerViewer: optional(\n      \"OPENGENI_SITES_SQL_FREE_CALLS_PER_MINUTE_PER_VIEWER\",\n    ),\n    sitesSqlFreeCallsPerMinutePerSite: optional(\n      \"OPENGENI_SITES_SQL_FREE_CALLS_PER_MINUTE_PER_SITE\",\n    ),\n    sitesSqlMaxRowsPerCall: optional(\"OPENGENI_SITES_SQL_MAX_ROWS_PER_CALL\"),\n    sitesSqlMaxResponseBytes: optional(\"OPENGENI_SITES_SQL_MAX_RESPONSE_BYTES\"),\n    sitesSqlTimeoutMs: optional(\"OPENGENI_SITES_SQL_TIMEOUT_MS\"),\n    siteDataRecordBytesPerSite: optional(\"OPENGENI_SITE_DATA_RECORD_BYTES_PER_SITE\"),\n    siteDataMaxRecordBytes: optional(\"OPENGENI_SITE_DATA_MAX_RECORD_BYTES\"),\n    siteDataMaxCollectionsPerSite: optional(\"OPENGENI_SITE_DATA_MAX_COLLECTIONS_PER_SITE\"),\n    siteDataFileBytesPerSite: optional(\"OPENGENI_SITE_DATA_FILE_BYTES_PER_SITE\"),\n    siteDataMaxFileBytes: optional(\"OPENGENI_SITE_DATA_MAX_FILE_BYTES\"),\n    siteDataWorkspaceBytes: optional(\"OPENGENI_SITE_DATA_WORKSPACE_BYTES\"),\n    siteDataViewerWritesPerMinute: optional(\"OPENGENI_SITE_DATA_VIEWER_WRITES_PER_MINUTE\"),\n    siteDataSiteWritesPerMinute: optional(\"OPENGENI_SITE_DATA_SITE_WRITES_PER_MINUTE\"),\n    siteDataViewerReadsPerMinute: optional(\"OPENGENI_SITE_DATA_VIEWER_READS_PER_MINUTE\"),\n    siteDataManagerWritesPerMinute: optional(\"OPENGENI_SITE_DATA_MANAGER_WRITES_PER_MINUTE\"),\n    siteDataSiteValidationMsPerMinute: optional(\"OPENGENI_SITE_DATA_SITE_VALIDATION_MS_PER_MINUTE\"),\n    siteDataWorkspaceValidationMsPerMinute: optional(\n      \"OPENGENI_SITE_DATA_WORKSPACE_VALIDATION_MS_PER_MINUTE\",\n    ),\n    siteDataMaxRecordsPerCollection: optional(\"OPENGENI_SITE_DATA_MAX_RECORDS_PER_COLLECTION\"),\n    sitesDomain: optional(\"OPENGENI_SITES_DOMAIN\"),\n    sitesGatewaySecret: optional(\"OPENGENI_SITES_GATEWAY_SECRET\"),\n    sitesGatewaySecretPrevious: optional(\"OPENGENI_SITES_GATEWAY_SECRET_PREVIOUS\"),\n    sitesPublicEnabled: optional(\"OPENGENI_SITES_PUBLIC_ENABLED\"),\n    sitesPublicAgentsEnabled: optional(\"OPENGENI_SITES_PUBLIC_AGENTS_ENABLED\"),\n    sitesLoginOnly: optional(\"OPENGENI_SITES_LOGIN_ONLY\"),\n    sitesForceNoindex: optional(\"OPENGENI_SITES_FORCE_NOINDEX\"),\n    sitesAbuseEmail: optional(\"OPENGENI_SITES_ABUSE_EMAIL\"),\n    sitesGuestAgentHumanCheck: optional(\"OPENGENI_SITES_GUEST_AGENT_HUMAN_CHECK\"),\n    sitesFreeRequestsPerMinutePerVisitor: optional(\n      \"OPENGENI_SITES_FREE_REQUESTS_PER_MINUTE_PER_VISITOR\",\n    ),\n    sitesFreeGuestWritesPerMinute: optional(\"OPENGENI_SITES_FREE_GUEST_WRITES_PER_MINUTE\"),\n    sitesFreeConversationsPerVisitorPerDay: optional(\n      \"OPENGENI_SITES_FREE_CONVERSATIONS_PER_VISITOR_PER_DAY\",\n    ),\n    sitesFreeConversationsPerSitePerDay: optional(\n      \"OPENGENI_SITES_FREE_CONVERSATIONS_PER_SITE_PER_DAY\",\n    ),\n    sitesFreeTurnsPerConversation: optional(\"OPENGENI_SITES_FREE_TURNS_PER_CONVERSATION\"),\n    sitesFreeAgentMicrosPerConversation: optional(\n      \"OPENGENI_SITES_FREE_AGENT_MICROS_PER_CONVERSATION\",\n    ),\n    sitesFreeAgentMicrosPerVisitorPerDay: optional(\n      \"OPENGENI_SITES_FREE_AGENT_MICROS_PER_VISITOR_PER_DAY\",\n    ),\n    sitesFreeAgentMicrosPerSitePerMonth: optional(\n      \"OPENGENI_SITES_FREE_AGENT_MICROS_PER_SITE_PER_MONTH\",\n    ),\n    sitesCreditsLimitMultiplier: optional(\"OPENGENI_SITES_CREDITS_LIMIT_MULTIPLIER\"),\n    sitesAgentReservationMicrosPerTurn: optional(\n      \"OPENGENI_SITES_AGENT_RESERVATION_MICROS_PER_TURN\",\n    ),\n    sitesAgentMicrosPerSitePerMonth: optional(\"OPENGENI_SITES_AGENT_MICROS_PER_SITE_PER_MONTH\"),\n    sitesAgentMicrosPerPersonPerDay: optional(\"OPENGENI_SITES_AGENT_MICROS_PER_PERSON_PER_DAY\"),\n    sitesGuestConversationsPerVisitorPerDay: optional(\n      \"OPENGENI_SITES_GUEST_CONVERSATIONS_PER_VISITOR_PER_DAY\",\n    ),\n    sitesGuestConversationsPerSitePerDay: optional(\n      \"OPENGENI_SITES_GUEST_CONVERSATIONS_PER_SITE_PER_DAY\",\n    ),\n    sitesGuestTurnsPerConversation: optional(\"OPENGENI_SITES_GUEST_TURNS_PER_CONVERSATION\"),\n    sitesGuestAgentMicrosPerConversation: optional(\n      \"OPENGENI_SITES_GUEST_AGENT_MICROS_PER_CONVERSATION\",\n    ),\n    sitesPlatformBillingMode: optional(\"OPENGENI_SITES_PLATFORM_BILLING_MODE\"),\n    sitesPlatformOverageEnabled: optional(\"OPENGENI_SITES_PLATFORM_OVERAGE_ENABLED\"),\n    sitesPlatformAllowanceRequests: optional(\"OPENGENI_SITES_PLATFORM_ALLOWANCE_REQUESTS\"),\n    sitesPlatformAllowanceSqlRowsRead: optional(\"OPENGENI_SITES_PLATFORM_ALLOWANCE_SQL_ROWS_READ\"),\n    sitesPlatformAllowanceSqlRowsWritten: optional(\n      \"OPENGENI_SITES_PLATFORM_ALLOWANCE_SQL_ROWS_WRITTEN\",\n    ),\n    sitesPlatformAllowanceStorageBytes: optional(\"OPENGENI_SITES_PLATFORM_ALLOWANCE_STORAGE_BYTES\"),\n    sitesPlatformPriceMicrosPerMillionRequests: optional(\n      \"OPENGENI_SITES_PLATFORM_PRICE_MICROS_PER_MILLION_REQUESTS\",\n    ),\n    sitesPlatformPriceMicrosPerMillionSqlRowsRead: optional(\n      \"OPENGENI_SITES_PLATFORM_PRICE_MICROS_PER_MILLION_SQL_ROWS_READ\",\n    ),\n    sitesPlatformPriceMicrosPerMillionSqlRowsWritten: optional(\n      \"OPENGENI_SITES_PLATFORM_PRICE_MICROS_PER_MILLION_SQL_ROWS_WRITTEN\",\n    ),\n    sitesPlatformPriceMicrosPerGbMonth: optional(\n      \"OPENGENI_SITES_PLATFORM_PRICE_MICROS_PER_GB_MONTH\",\n    ),\n    sitesPlatformMonthlyLimitUsd: optional(\"OPENGENI_SITES_PLATFORM_MONTHLY_LIMIT_USD\"),\n    sitesPlatformAlertPercent: optional(\"OPENGENI_SITES_PLATFORM_ALERT_PERCENT\"),\n    sitesReportsPerMinutePerVisitor: optional(\"OPENGENI_SITES_REPORTS_PER_MINUTE_PER_VISITOR\"),\n    sitesViewerSessionIdleSeconds: optional(\"OPENGENI_SITES_VIEWER_SESSION_IDLE_SECONDS\"),\n    sitesViewerSessionAbsoluteSeconds: optional(\"OPENGENI_SITES_VIEWER_SESSION_ABSOLUTE_SECONDS\"),\n    sitesHostnameHoldDays: optional(\"OPENGENI_SITES_HOSTNAME_HOLD_DAYS\"),\n    sitesCloudflareApiToken: optional(\"OPENGENI_SITES_CLOUDFLARE_API_TOKEN\"),\n    sitesCloudflareAccountId: optional(\"OPENGENI_SITES_CLOUDFLARE_ACCOUNT_ID\"),\n    sitesCloudflareKvNamespaceId: optional(\"OPENGENI_SITES_CLOUDFLARE_KV_NAMESPACE_ID\"),\n    sitesCloudflareZoneId: optional(\"OPENGENI_SITES_CLOUDFLARE_ZONE_ID\"),\n    sitesHostMapTtlSeconds: optional(\"OPENGENI_SITES_HOST_MAP_TTL_SECONDS\"),\n    sitesWebRiskApiKey: optional(\"OPENGENI_SITES_WEB_RISK_API_KEY\"),\n    documentEmbeddingCreditsActivatedAt: optional(\n      \"OPENGENI_DOCUMENT_EMBEDDING_CREDITS_ACTIVATED_AT\",\n    ),\n    documentEmbeddingRateMicrosPerMillionBytes: optional(\n      \"OPENGENI_DOCUMENT_EMBEDDING_RATE_MICROS_PER_MILLION_BYTES\",\n    ),\n    documentCurationProvider: optional(\"OPENGENI_DOCUMENT_CURATION_PROVIDER\"),\n    documentCurationModel: optional(\"OPENGENI_DOCUMENT_CURATION_MODEL\"),\n    documentCurationApiKey: optional(\"OPENGENI_DOCUMENT_CURATION_API_KEY\"),\n    documentCurationBaseUrl: optional(\"OPENGENI_DOCUMENT_CURATION_BASE_URL\"),\n    gitAuthorName: optional(\"OPENGENI_GIT_AUTHOR_NAME\"),\n    gitAuthorEmail: optional(\"OPENGENI_GIT_AUTHOR_EMAIL\"),\n    gitCommitterName: optional(\"OPENGENI_GIT_COMMITTER_NAME\"),\n    gitCommitterEmail: optional(\"OPENGENI_GIT_COMMITTER_EMAIL\"),\n    githubAppManifestBaseUrl: optional(\"OPENGENI_GITHUB_APP_MANIFEST_BASE_URL\"),\n    githubAppManifestStateSecret: optional(\"OPENGENI_GITHUB_APP_MANIFEST_STATE_SECRET\"),\n    githubAppId: optional(\"OPENGENI_GITHUB_APP_ID\"),\n    githubClientId: optional(\"OPENGENI_GITHUB_CLIENT_ID\"),\n    githubClientSecret: optional(\"OPENGENI_GITHUB_CLIENT_SECRET\"),\n    githubRestMcpEnabled: optional(\"OPENGENI_GITHUB_REST_MCP_ENABLED\"),\n    githubPersonalOauthEnabled: optional(\"OPENGENI_GITHUB_PERSONAL_OAUTH_ENABLED\"),\n    githubPersonalOauthClientId: optional(\"OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_ID\"),\n    githubPersonalOauthClientSecret: optional(\"OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_SECRET\"),\n    githubAppSlug: optional(\"OPENGENI_GITHUB_APP_SLUG\"),\n    githubWebhookSecret: optional(\"OPENGENI_GITHUB_WEBHOOK_SECRET\"),\n    githubAppPrivateKey: optional(\"OPENGENI_GITHUB_APP_PRIVATE_KEY\"),\n    prReviewGithubAppId: optional(\"OPENGENI_PR_REVIEW_GITHUB_APP_ID\"),\n    prReviewGithubClientId: optional(\"OPENGENI_PR_REVIEW_GITHUB_CLIENT_ID\"),\n    prReviewGithubClientSecret: optional(\"OPENGENI_PR_REVIEW_GITHUB_CLIENT_SECRET\"),\n    prReviewGithubAppSlug: optional(\"OPENGENI_PR_REVIEW_GITHUB_APP_SLUG\"),\n    prReviewGithubWebhookSecret: optional(\"OPENGENI_PR_REVIEW_GITHUB_WEBHOOK_SECRET\"),\n    prReviewGithubAppPrivateKey: optional(\"OPENGENI_PR_REVIEW_GITHUB_APP_PRIVATE_KEY\"),\n    betterAuthSecret: optional(\"OPENGENI_BETTER_AUTH_SECRET\"),\n    betterAuthAllowedHosts: optional(\"OPENGENI_BETTER_AUTH_ALLOWED_HOSTS\"),\n    betterAuthCookieDomain: optional(\"OPENGENI_BETTER_AUTH_COOKIE_DOMAIN\"),\n    betterAuthTrustedOrigins: optional(\"OPENGENI_BETTER_AUTH_TRUSTED_ORIGINS\"),\n    managedAuthGoogleClientId: optional(\"OPENGENI_MANAGED_AUTH_GOOGLE_CLIENT_ID\"),\n    managedAuthGoogleClientSecret: optional(\"OPENGENI_MANAGED_AUTH_GOOGLE_CLIENT_SECRET\"),\n    managedAuthGithubClientId: optional(\"OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_ID\"),\n    managedAuthGithubClientSecret: optional(\"OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_SECRET\"),\n    allowedUserEmails:\n      source.OPENGENI_ALLOWED_USER_EMAILS === undefined\n        ? undefined\n        : source.OPENGENI_ALLOWED_USER_EMAILS.split(\",\").map((email) => email.trim()),\n    managedAuthSessionSetMode: optional(\"OPENGENI_MANAGED_AUTH_SESSION_SET_MODE\"),\n    nativeAppSchemes:\n      source.OPENGENI_NATIVE_APP_SCHEMES === undefined\n        ? undefined\n        : source.OPENGENI_NATIVE_APP_SCHEMES.split(\",\")\n            .map((scheme) => scheme.trim())\n            .filter(Boolean),\n    nativeAppIds:\n      source.OPENGENI_NATIVE_APP_IDS === undefined\n        ? undefined\n        : source.OPENGENI_NATIVE_APP_IDS.split(\",\")\n            .map((id) => id.trim())\n            .filter(Boolean),\n    apnsKeyId: optional(\"OPENGENI_APNS_KEY_ID\"),\n    apnsTeamId: optional(\"OPENGENI_APNS_TEAM_ID\"),\n    apnsPrivateKey: optional(\"OPENGENI_APNS_PRIVATE_KEY\"),\n    fcmServiceAccountJson: optional(\"OPENGENI_FCM_SERVICE_ACCOUNT_JSON\"),\n    managedAuthNewSignupsEnabled: optional(\"OPENGENI_MANAGED_AUTH_NEW_SIGNUPS_ENABLED\"),\n    managedAuthRequireEmailVerification: optional(\n      \"OPENGENI_MANAGED_AUTH_REQUIRE_EMAIL_VERIFICATION\",\n    ),\n    organizationUserSetupEmailTokenTransport: optional(\n      \"OPENGENI_ORGANIZATION_USER_SETUP_EMAIL_TOKEN_TRANSPORT\",\n    ),\n    organizationUserSetupQueryEdgeSanitizationConfirmed: optional(\n      \"OPENGENI_ORGANIZATION_USER_SETUP_QUERY_EDGE_SANITIZATION_CONFIRMED\",\n    ),\n    managedEmailDelivery: optional(\"OPENGENI_MANAGED_EMAIL_DELIVERY\"),\n    resendApiKey: optional(\"OPENGENI_RESEND_API_KEY\"),\n    emailFrom: optional(\"OPENGENI_EMAIL_FROM\"),\n    stripeSecretKey: optional(\"OPENGENI_STRIPE_SECRET_KEY\"),\n    stripePublishableKey: optional(\"OPENGENI_STRIPE_PUBLISHABLE_KEY\"),\n    stripeWebhookSecret: optional(\"OPENGENI_STRIPE_WEBHOOK_SECRET\"),\n    stripeCreditsProductId: optional(\"OPENGENI_STRIPE_CREDITS_PRODUCT_ID\"),\n    subscriptionPlansEnabled: optional(\"OPENGENI_SUBSCRIPTION_PLANS_ENABLED\"),\n    mcpServers: parseMcpServers(optional(\"OPENGENI_MCP_SERVERS\")),\n  };\n  const parsed = SettingsSchema.parse(raw);\n  const settings = {\n    ...parsed,\n    sandboxIdleGraceMs:\n      raw.sandboxIdleGraceMs === undefined && parsed.sandboxBackend === \"modal\"\n        ? Math.min(60_000, Math.floor((parsed.modalTimeoutSeconds * 1000) / 2))\n        : parsed.sandboxIdleGraceMs,\n    sandboxRotationLeadMs:\n      raw.sandboxRotationLeadMs === undefined && parsed.sandboxBackend === \"modal\"\n        ? Math.min(\n            3_600_000,\n            Math.max(\n              Math.floor((parsed.modalTimeoutSeconds * 1000) / 2),\n              SANDBOX_DEADLINE_COMMAND_STOP_GRACE_MS +\n                sandboxArchiveCaptureTimeoutMs({\n                  sandboxSnapshotTimeoutMs: Math.max(\n                    parsed.sandboxSnapshotTimeoutMs,\n                    parsed.sandboxDrainSnapshotTimeoutMs ?? parsed.sandboxSnapshotTimeoutMs,\n                  ),\n                }) +\n                2 * parsed.sandboxLeaseReaperPeriodMs +\n                1,\n            ),\n          )\n        : parsed.sandboxRotationLeadMs,\n    mcpServers: ensureBuiltInMcpServers(parsed),\n  };\n  if (raw.sandboxIdleCommandContainmentMs === undefined) {\n    // Strictly between the idle grace and the rotation lead whenever that\n    // interval exists (short test/canary lifetimes), never above 30 minutes,\n    // and early enough that an explicit Modal idle timeout cannot fire first.\n    const modalIdleCeilingMs =\n      settings.sandboxBackend === \"modal\" && settings.modalIdleTimeoutSeconds !== undefined\n        ? settings.modalIdleTimeoutSeconds * 1000 -\n          settings.sandboxLeaseReaperPeriodMs -\n          sandboxArchiveCaptureTimeoutMs({\n            sandboxSnapshotTimeoutMs: effectiveSandboxDrainSnapshotTimeoutMs(settings),\n          }) -\n          1\n        : Number.POSITIVE_INFINITY;\n    const derived = Math.min(\n      1_800_000,\n      Math.floor((settings.sandboxIdleGraceMs + settings.sandboxRotationLeadMs) / 2),\n      modalIdleCeilingMs,\n    );\n    // A derived value never fails validation: with no room above the idle\n    // grace, idle containment stays off and only the deadline rule applies.\n    if (derived > settings.sandboxIdleGraceMs) {\n      settings.sandboxIdleCommandContainmentMs = derived;\n    } else {\n      settings.sandboxIdleCommandContainmentMs = undefined;\n      if (!idleCommandContainmentDisabledWarned) {\n        idleCommandContainmentDisabledWarned = true;\n        console.warn(\n          \"[config] idle command containment disabled: no window fits between \" +\n            `OPENGENI_SANDBOX_IDLE_GRACE_MS (${settings.sandboxIdleGraceMs}) and the Modal idle ` +\n            \"timeout / rotation lead ceiling; set OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS to override.\",\n        );\n      }\n    }\n  }\n  warnRetiredDeploymentSwitches(source);\n  validateSettings(settings, source);\n  return settings;\n}\n\n/**\n * Former deployment switches that are now accepted and ignored. Deployments\n * that still set one keep booting; a one-time warning tells the operator to\n * delete it.\n */\nconst RETIRED_DEPLOYMENT_SWITCHES: ReadonlyArray<{ name: string; reason: string }> = [\n  {\n    name: \"OPENGENI_ORGANIZATION_TENANCY_CANONICAL_ACTIVATION_ENABLED\",\n    reason: \"every organization is session-tenancy activated (migration 0611)\",\n  },\n  {\n    name: \"OPENGENI_INTEGRATIONS_OAUTH_SHORT_STATE_ENABLED\",\n    reason: \"MCP OAuth always sends the short reference state (migration 0507)\",\n  },\n];\n\nconst warnedRetiredDeploymentSwitches = new Set<string>();\n\nfunction warnRetiredDeploymentSwitches(source: NodeJS.ProcessEnv): void {\n  for (const { name, reason } of RETIRED_DEPLOYMENT_SWITCHES) {\n    if (source[name] === undefined || warnedRetiredDeploymentSwitches.has(name)) continue;\n    warnedRetiredDeploymentSwitches.add(name);\n    console.warn(\n      `[config] ${name} is retired and ignored: ${reason}. Remove it from the deployment.`,\n    );\n  }\n}\n\nconst LOCAL_FIRST_PARTY_DELEGATION_SECRET = \"opengeni-local-first-party-delegation-secret-v1\";\n\n/**\n * First-party session tools need a shared HMAC identity even in the unauthenticated\n * local product mode. A fixed local-only value is no broader than that mode's\n * existing access boundary, while configured and managed deployments continue to\n * require an operator-provided secret.\n */\nexport function resolveFirstPartyDelegationSecret(settings: Settings): string | undefined {\n  const explicit = settings.delegationSecret?.trim();\n  if (explicit) return explicit;\n  const configuredAccessKey = settings.accessKey?.trim();\n  if (settings.productAccessMode === \"configured\" && settings.authRequired && configuredAccessKey) {\n    return configuredAccessKey;\n  }\n  return settings.productAccessMode === \"local\" &&\n    (settings.environment === \"local\" || settings.environment === \"test\")\n    ? LOCAL_FIRST_PARTY_DELEGATION_SECRET\n    : undefined;\n}\n\nexport type FirstPartyMcpToolPolicy = {\n  default: FirstPartyMcpToolNameType[];\n  allowed: FirstPartyMcpToolNameType[];\n};\n\nexport type FirstPartyMcpToolPolicySettings = Pick<\n  Settings,\n  \"defaultFirstPartyMcpTools\" | \"allowedFirstPartyMcpTools\" | \"artifactMaterializerDeployed\"\n>;\n\nconst EDITABLE_ARTIFACT_EXPORT_TOOLS: readonly FirstPartyMcpToolNameType[] = [\n  \"editable_artifact_export\",\n  \"editable_artifact_export_status\",\n];\n\n/**\n * First-party tools whose backing workload this deployment does not run. They\n * are absent from the ceiling (never offered) and an explicit request for one\n * is dropped rather than rejected: it is a deployment fact, not a caller error.\n */\nexport function deploymentUnavailableFirstPartyMcpTools(\n  settings: Pick<Settings, \"artifactMaterializerDeployed\">,\n): ReadonlySet<FirstPartyMcpToolNameType> {\n  return new Set(settings.artifactMaterializerDeployed ? [] : EDITABLE_ARTIFACT_EXPORT_TOOLS);\n}\n\n/** Resolve the deployment's session-tool defaults and hard execution ceiling. */\nexport function resolveFirstPartyMcpToolPolicy(\n  settings: FirstPartyMcpToolPolicySettings,\n): FirstPartyMcpToolPolicy {\n  const unavailable = deploymentUnavailableFirstPartyMcpTools(settings);\n  const allowed = currentAgentLearningToolSelection(\n    settings.allowedFirstPartyMcpTools ?? [...FIRST_PARTY_MCP_TOOL_NAMES],\n  ).filter((tool) => !isRetiredNativeAtlassianTool(tool) && !unavailable.has(tool));\n  const allowedSet = new Set(allowed);\n  const defaults = currentAgentLearningToolSelection(\n    settings.defaultFirstPartyMcpTools ?? [...DEFAULT_FIRST_PARTY_MCP_TOOLS],\n  );\n  return {\n    default: defaults.filter((tool) => allowedSet.has(tool)),\n    allowed: [...allowed],\n  };\n}\n\n/** Apply the deployment ceiling to an existing durable session selection. */\nexport function allowedFirstPartyMcpToolsForSession(\n  settings: FirstPartyMcpToolPolicySettings,\n  selected: readonly FirstPartyMcpToolNameType[] | null | undefined,\n): FirstPartyMcpToolNameType[] {\n  const policy = resolveFirstPartyMcpToolPolicy(settings);\n  const allowed = new Set(policy.allowed);\n  const tools = new Set(currentAgentLearningToolSelection(selected ?? policy.default));\n  // Existing sessions with pause authority also receive its resume counterpart.\n  if (tools.has(\"goal_pause\")) tools.add(\"goal_resume\");\n  return [...tools].filter((tool) => allowed.has(tool));\n}\n\n/** Resolve durable selection intent before freezing a new attempt's catalog. */\nexport function resolveSessionFirstPartyMcpTools(\n  settings: FirstPartyMcpToolPolicySettings,\n  session: Pick<Session, \"firstPartyMcpTools\" | \"toolPolicy\"> & Partial<Pick<Session, \"agent\">>,\n  workspaceSettings: unknown,\n): FirstPartyMcpToolNameType[] {\n  let selected: readonly FirstPartyMcpToolNameType[] | null | undefined =\n    session.firstPartyMcpTools;\n  if (session.toolPolicy.firstPartyMode === \"workspace_default\") {\n    // Follow today's defaults, plus any tools the creator guaranteed on top.\n    const defaults = resolveWorkspaceSessionToolDefaults(workspaceSettings)?.firstPartyMcpTools;\n    const additions = session.toolPolicy.firstPartyAdditions ?? [];\n    selected = additions.length\n      ? [\n          ...new Set([\n            ...(defaults ?? resolveFirstPartyMcpToolPolicy(settings).default),\n            ...additions,\n          ]),\n        ]\n      : defaults;\n  }\n  const allowed = allowedFirstPartyMcpToolsForSession(settings, selected);\n  return session.agent ? agentConfigFirstPartyMcpTools(session.agent, allowed) : allowed;\n}\n\n/**\n * The Modal sandbox idle timeout (seconds) the provider actually passes as\n * idleTimeoutMs (sandbox-file-persistence). When the operator did not pin\n * OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS we DEFAULT it to the hard lifetime\n * (modalTimeoutSeconds): Opengeni's reaper owns box lifecycle, so Modal's\n * built-in idle-reap (which would otherwise fire on its short server default and\n * kill the box BEFORE the reaper can snapshot /workspace) is pushed out to the\n * hard backstop. An explicit smaller value is honoured (the boot invariant keeps\n * it above reaperPeriod + idleGrace so a drained box still survives long enough\n * to be persisted).\n */\nexport function effectiveModalIdleTimeoutSeconds(settings: Settings): number {\n  return settings.modalIdleTimeoutSeconds ?? settings.modalTimeoutSeconds;\n}\n\nexport type EffectiveSandboxLifecycle = {\n  hardLifetimeMs: number | null;\n  renewableTtlSeconds: number | null;\n  providerIdleTimeoutMs: number | null;\n  rotationLeadMs: number | null;\n};\n\n/** Resolve provider lifecycle clocks without teaching generic callers Modal or\n * OpenSandbox field names. Modal's returned values are exactly the pre-existing\n * hard/idle/rotation values; OpenSandbox instead exposes a renewable TTL and no\n * finite-deadline rotation. */\nexport function effectiveSandboxLifecycle(\n  settings: Settings,\n  backend: z.infer<typeof SandboxBackend> = settings.sandboxBackend,\n): EffectiveSandboxLifecycle {\n  if (backend === \"modal\") {\n    return {\n      hardLifetimeMs: settings.modalTimeoutSeconds * 1000,\n      renewableTtlSeconds: null,\n      providerIdleTimeoutMs: effectiveModalIdleTimeoutSeconds(settings) * 1000,\n      rotationLeadMs: settings.sandboxRotationLeadMs,\n    };\n  }\n  if (backend === \"opensandbox\") {\n    return {\n      hardLifetimeMs: null,\n      renewableTtlSeconds: settings.openSandboxTtlSeconds,\n      providerIdleTimeoutMs: null,\n      rotationLeadMs: null,\n    };\n  }\n  return {\n    hardLifetimeMs: CAPABILITY_DESCRIPTORS[backend].lifetime.hardLifetimeMs ?? null,\n    renewableTtlSeconds: null,\n    providerIdleTimeoutMs: null,\n    rotationLeadMs: null,\n  };\n}\n\n/** How long a box reported missing could still be running anywhere: its hard\n * lifetime, or the renewable TTL nobody renews once the box is lost. Null when\n * the backend has no such bound (its loss needs other proof). */\nexport function sandboxProviderMaxRemainingLifetimeMs(\n  settings: Settings,\n  backend: z.infer<typeof SandboxBackend>,\n): number | null {\n  const lifecycle = effectiveSandboxLifecycle(settings, backend);\n  if (lifecycle.hardLifetimeMs !== null) return lifecycle.hardLifetimeMs;\n  return lifecycle.renewableTtlSeconds !== null ? lifecycle.renewableTtlSeconds * 1000 : null;\n}\n\n/**\n * One shared upper bound for the durable provider-capture claim and for command\n * admission waiting behind it. The SDK request itself is bounded by\n * sandboxSnapshotTimeoutMs (a warm host-backed spool capture is stopped there);\n * the extra window lets a non-cancellable provider response settle and release\n * its exact claim without turning a normal checkpoint into a visible command\n * failure. Database validation caps both consumers at one hour.\n */\nexport function sandboxArchiveCaptureTimeoutMs(\n  settings: Pick<Settings, \"sandboxSnapshotTimeoutMs\">,\n): number {\n  return Math.min(\n    SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS,\n    settings.sandboxSnapshotTimeoutMs + SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS,\n  );\n}\n\n/** Provider operation budget used only by zero-holder drain/rotation capture.\n * Unset preserves the historical shared snapshot budget exactly. */\nexport function effectiveSandboxDrainSnapshotTimeoutMs(\n  settings: Pick<Settings, \"sandboxSnapshotTimeoutMs\" | \"sandboxDrainSnapshotTimeoutMs\">,\n): number {\n  return settings.sandboxDrainSnapshotTimeoutMs ?? settings.sandboxSnapshotTimeoutMs;\n}\n\n/**\n * How long before a finite provider deadline the deadline save stops waiting\n * for an orderly shutdown and becomes mandatory. Past this point the\n * reaper captures and terminates the box around anything that cannot finish in\n * time (pending owner quiescence, sibling attempts that do not hold the box,\n * in-flight requests whose holders are gone, commands that ignored their stop\n * request) instead of letting the provider kill it uncaptured. It leaves the\n * legacy command stop grace, the full drain capture budget and two reaper\n * periods before the deadline, and never exceeds the rotation lead.\n */\nexport function sandboxDeadlineMandatoryCaptureLeadMs(\n  settings: Pick<\n    Settings,\n    | \"sandboxRotationLeadMs\"\n    | \"sandboxSnapshotTimeoutMs\"\n    | \"sandboxDrainSnapshotTimeoutMs\"\n    | \"sandboxLeaseReaperPeriodMs\"\n  >,\n): number {\n  return Math.min(\n    settings.sandboxRotationLeadMs,\n    SANDBOX_DEADLINE_COMMAND_STOP_GRACE_MS +\n      sandboxArchiveCaptureTimeoutMs({\n        sandboxSnapshotTimeoutMs: effectiveSandboxDrainSnapshotTimeoutMs(settings),\n      }) +\n      2 * settings.sandboxLeaseReaperPeriodMs,\n  );\n}\n\nexport function sandboxLifecycleTransitionWaitMs(\n  settings: Pick<\n    Settings,\n    \"sandboxSnapshotTimeoutMs\" | \"sandboxDrainSnapshotTimeoutMs\" | \"sandboxLeaseReaperPeriodMs\"\n  >,\n): number {\n  const captureTimeoutMs = sandboxArchiveCaptureTimeoutMs({\n    sandboxSnapshotTimeoutMs: effectiveSandboxDrainSnapshotTimeoutMs(settings),\n  });\n  return Math.min(\n    SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS,\n    settings.sandboxLeaseReaperPeriodMs +\n      captureTimeoutMs +\n      SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS,\n  );\n}\n\nexport function collectSandboxEnvironment(\n  settings: Settings,\n  source: NodeJS.ProcessEnv = process.env,\n): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const name of sandboxEnvironmentVariableNames(settings)) {\n    const value = source[name];\n    if (value) {\n      out[name] = value;\n    }\n  }\n  return out;\n}\n\n/**\n * Resolved API key for a registry provider: the inline `apiKey` when present,\n * else the value of the env var named by `apiKeyEnv`. The preferred form is\n * `apiKeyEnv` (the secret stays out of OPENGENI_MODEL_PROVIDERS_JSON). Reads\n * from `source` (defaults to process.env) so callers can resolve against an\n * explicit environment in tests.\n */\nexport function resolveProviderApiKey(\n  provider: Pick<RegistryProvider, \"apiKey\" | \"apiKeyEnv\">,\n  source: NodeJS.ProcessEnv = process.env,\n): string | undefined {\n  if (provider.apiKey) {\n    return provider.apiKey;\n  }\n  if (provider.apiKeyEnv) {\n    const value = source[provider.apiKeyEnv];\n    return value && value.trim().length > 0 ? value : undefined;\n  }\n  return undefined;\n}\n\nconst HTTP_FIELD_NAME = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\nconst CREDENTIAL_LIKE_NAME_PARTS = new Set([\n  \"apikey\",\n  \"auth\",\n  \"authorization\",\n  \"bearer\",\n  \"credential\",\n  \"cookie\",\n  \"key\",\n  \"password\",\n  \"secret\",\n  \"session\",\n  \"signature\",\n  \"token\",\n]);\nconst REASONING_EFFORT_ORDER = new Map(\n  ReasoningEffort.options.map((effort, index) => [effort, index]),\n);\nconst MODALITY_ORDER = new Map([\"text\", \"image\", \"audio\"].map((value, index) => [value, index]));\nconst LATENCY_MODE_ORDER = new Map(\n  [\"standard\", \"priority\", \"fast\", \"ultrafast\"].map((value, index) => [value, index]),\n);\n\nfunction normalizeRegistryBaseUrl(value: string, providerId: string): string {\n  const url = new URL(value);\n  if (url.username || url.password) {\n    throw new Error(`provider ${providerId} baseUrl must not contain userinfo`);\n  }\n  if (url.search) {\n    throw new Error(\n      `provider ${providerId} baseUrl must not contain a query; move query entries to defaultQuery`,\n    );\n  }\n  if (url.hash) {\n    throw new Error(`provider ${providerId} baseUrl must not contain a fragment`);\n  }\n  return url.toString();\n}\n\nfunction isCredentialLikeMetadataName(name: string): boolean {\n  return name\n    .toLowerCase()\n    .split(/[-_.]/u)\n    .some((part) => CREDENTIAL_LIKE_NAME_PARTS.has(part));\n}\n\nfunction normalizeHeaderMap(\n  providerId: string,\n  headers: Record<string, string> | undefined,\n): Record<string, string> | undefined {\n  if (!headers) {\n    return undefined;\n  }\n  const normalized: Record<string, string> = {};\n  const rawByNormalized = new Map<string, string>();\n  for (const [rawName, value] of Object.entries(headers)) {\n    if (!HTTP_FIELD_NAME.test(rawName)) {\n      throw new Error(\n        `provider ${providerId} defaultHeaders contains invalid HTTP field name ${JSON.stringify(rawName)}`,\n      );\n    }\n    const name = rawName.toLowerCase();\n    const previous = rawByNormalized.get(name);\n    if (previous !== undefined) {\n      throw new Error(\n        `provider ${providerId} defaultHeaders names ${JSON.stringify(previous)} and ${JSON.stringify(rawName)} collide after lowercase normalization`,\n      );\n    }\n    if (name === \"authorization\") {\n      throw new Error(\n        `provider ${providerId} defaultHeaders must not override SDK-managed Authorization`,\n      );\n    }\n    rawByNormalized.set(name, rawName);\n    normalized[name] = value;\n  }\n  return normalized;\n}\n\nfunction normalizePublicHeaderNames(\n  providerId: string,\n  names: string[] | undefined,\n  headers: Record<string, string> | undefined,\n): string[] | undefined {\n  if (!names) {\n    return undefined;\n  }\n  const normalized: string[] = [];\n  const seen = new Set<string>();\n  for (const rawName of names) {\n    if (!HTTP_FIELD_NAME.test(rawName)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultHeaderNames contains invalid HTTP field name ${JSON.stringify(rawName)}`,\n      );\n    }\n    const name = rawName.toLowerCase();\n    if (seen.has(name)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultHeaderNames contains duplicate normalized name ${JSON.stringify(name)}`,\n      );\n    }\n    if (!(name in (headers ?? {}))) {\n      throw new Error(\n        `provider ${providerId} publicDefaultHeaderNames declares absent defaultHeaders entry ${JSON.stringify(name)}`,\n      );\n    }\n    if (isCredentialLikeMetadataName(name)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultHeaderNames cannot classify credential-like name ${JSON.stringify(name)} as public`,\n      );\n    }\n    seen.add(name);\n    normalized.push(name);\n  }\n  return normalized;\n}\n\nfunction normalizeQueryMap(\n  providerId: string,\n  query: Record<string, string> | undefined,\n): Record<string, string> | undefined {\n  if (!query) {\n    return undefined;\n  }\n  for (const name of Object.keys(query)) {\n    if (!name) {\n      throw new Error(`provider ${providerId} defaultQuery contains an empty name`);\n    }\n  }\n  return { ...query };\n}\n\nfunction normalizePublicQueryNames(\n  providerId: string,\n  names: string[] | undefined,\n  query: Record<string, string> | undefined,\n): string[] | undefined {\n  if (!names) {\n    return undefined;\n  }\n  const seen = new Set<string>();\n  for (const name of names) {\n    if (seen.has(name)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultQueryNames contains duplicate name ${JSON.stringify(name)}`,\n      );\n    }\n    if (!(name in (query ?? {}))) {\n      throw new Error(\n        `provider ${providerId} publicDefaultQueryNames declares absent defaultQuery entry ${JSON.stringify(name)}`,\n      );\n    }\n    if (isCredentialLikeMetadataName(name)) {\n      throw new Error(\n        `provider ${providerId} publicDefaultQueryNames cannot classify credential-like name ${JSON.stringify(name)} as public`,\n      );\n    }\n    seen.add(name);\n  }\n  return [...names];\n}\n\nfunction normalizeRegistryProvider(provider: RegistryProvider): RegistryProvider {\n  const defaultHeaders = normalizeHeaderMap(provider.id, provider.defaultHeaders);\n  const defaultQuery = normalizeQueryMap(provider.id, provider.defaultQuery);\n  return {\n    ...provider,\n    baseUrl: normalizeRegistryBaseUrl(provider.baseUrl, provider.id),\n    ...(defaultHeaders === undefined ? {} : { defaultHeaders }),\n    ...(defaultQuery === undefined ? {} : { defaultQuery }),\n    ...(provider.publicDefaultHeaderNames === undefined\n      ? {}\n      : {\n          publicDefaultHeaderNames: normalizePublicHeaderNames(\n            provider.id,\n            provider.publicDefaultHeaderNames,\n            defaultHeaders,\n          ),\n        }),\n    ...(provider.publicDefaultQueryNames === undefined\n      ? {}\n      : {\n          publicDefaultQueryNames: normalizePublicQueryNames(\n            provider.id,\n            provider.publicDefaultQueryNames,\n            defaultQuery,\n          ),\n        }),\n  };\n}\n\nfunction normalizeModelPricingSchedule(\n  pricing: ModelPricing | ModelPricingScheduleV1,\n): ModelPricingScheduleV1 {\n  return \"default\" in pricing ? pricing : { default: pricing };\n}\n\nfunction normalizeCapabilities(capabilities: ModelCapabilitiesV1): ModelCapabilitiesV1 {\n  const parsed = ModelCapabilitiesV1Schema.parse(capabilities);\n  return {\n    ...parsed,\n    reasoning: {\n      ...parsed.reasoning,\n      efforts: [...parsed.reasoning.efforts].sort(\n        (left, right) =>\n          (REASONING_EFFORT_ORDER.get(left) ?? 0) - (REASONING_EFFORT_ORDER.get(right) ?? 0),\n      ),\n    },\n    inputModalities: [...parsed.inputModalities].sort(\n      (left, right) => (MODALITY_ORDER.get(left) ?? 0) - (MODALITY_ORDER.get(right) ?? 0),\n    ),\n    inputFileMediaTypes: [...new Set(parsed.inputFileMediaTypes)].sort(),\n    outputModalities: [...parsed.outputModalities].sort(\n      (left, right) => (MODALITY_ORDER.get(left) ?? 0) - (MODALITY_ORDER.get(right) ?? 0),\n    ),\n    latencyModes: [...parsed.latencyModes].sort(\n      (left, right) =>\n        (LATENCY_MODE_ORDER.get(left.id) ?? 0) - (LATENCY_MODE_ORDER.get(right.id) ?? 0),\n    ),\n  };\n}\n\nfunction legacyModelCapabilities(\n  settings: Settings,\n  input: {\n    reasoningEffort: boolean;\n    hostedWebSearch: boolean;\n    hostedImageGeneration?: boolean;\n    vision?: boolean;\n  },\n): ModelCapabilitiesV1 {\n  const reasoningEfforts = input.reasoningEffort ? configuredAllowedReasoningEfforts(settings) : [];\n  return normalizeCapabilities({\n    reasoning: {\n      upstream: input.reasoningEffort ? \"supported\" : \"unknown\",\n      runnable: input.reasoningEffort,\n      efforts: reasoningEfforts,\n      defaultEffort: input.reasoningEffort ? settings.openaiReasoningEffort : null,\n      required: false,\n    },\n    functionCalling: { upstream: \"unknown\", runnable: true },\n    structuredOutput: { upstream: \"unknown\", runnable: false },\n    hostedTools: {\n      webSearch: {\n        upstream: input.hostedWebSearch ? \"supported\" : \"unknown\",\n        runnable: input.hostedWebSearch,\n      },\n      xSearch: { upstream: \"unknown\", runnable: false },\n      codeExecution: { upstream: \"unknown\", runnable: false },\n      imageGeneration: {\n        upstream: input.hostedImageGeneration ? \"supported\" : \"unknown\",\n        runnable: input.hostedImageGeneration ?? false,\n      },\n    },\n    inputModalities: input.vision ? [\"text\", \"image\"] : [\"text\"],\n    inputFileMediaTypes: [\n      \"application/json\",\n      \"application/pdf\",\n      \"application/x-yaml\",\n      \"application/yaml\",\n      \"text/*\",\n    ],\n    outputModalities: [\"text\"],\n    transports: {\n      sse: { upstream: \"unknown\", runnable: true },\n      responsesWebSocket: { upstream: \"unknown\", runnable: false },\n      realtimeAudio: { upstream: \"unknown\", runnable: false },\n    },\n    latencyModes: [{ id: \"standard\", upstream: \"unknown\", runnable: true }],\n  });\n}\n\nexport function gatewayRequestPolicyForUpstreamModel(\n  upstreamModelId: string,\n  models: readonly GatewayCatalogModel[] = defaultGatewayCatalogModels(),\n): ConfiguredModel[\"requestPolicy\"] {\n  const model = models.find((candidate) => candidate.upstreamModelId === upstreamModelId);\n  if (!model) {\n    return undefined;\n  }\n  return {\n    gateway: {\n      only: [...model.providers] as [string, ...string[]],\n      caching: model.implicitCaching ? \"auto\" : \"none\",\n    },\n  };\n}\n\nfunction gatewayModelCapabilities(\n  settings: Settings,\n  input: {\n    implicitCaching: boolean;\n    vision: boolean;\n    inputFileMediaTypes?: string[];\n  },\n): ModelCapabilitiesV1 {\n  const legacy = legacyModelCapabilities(settings, {\n    reasoningEffort: true,\n    hostedWebSearch: false,\n  });\n  return normalizeCapabilities({\n    ...legacy,\n    functionCalling: { upstream: \"supported\", runnable: true },\n    inputModalities: input.vision ? [\"text\", \"image\"] : [\"text\"],\n    inputFileMediaTypes: input.inputFileMediaTypes ?? [],\n    transports: {\n      ...legacy.transports,\n      sse: { upstream: \"supported\", runnable: true },\n    },\n    promptCaching: input.implicitCaching\n      ? { upstream: \"supported\", runnable: true, mode: \"implicit\" }\n      : { upstream: \"unsupported\", runnable: false, mode: \"none\" },\n    // Both Gateway products expose one reviewed route policy and no separately\n    // billed latency mode.\n    latencyModes: [{ id: \"standard\", upstream: \"supported\", runnable: true }],\n  });\n}\n\nfunction openRouterCustomModelCapabilities(settings: Settings): ModelCapabilitiesV1 {\n  const legacy = legacyModelCapabilities(settings, {\n    reasoningEffort: false,\n    hostedWebSearch: false,\n  });\n  return normalizeCapabilities({\n    ...legacy,\n    functionCalling: { upstream: \"supported\", runnable: true },\n    inputModalities: [\"text\"],\n    inputFileMediaTypes: [],\n    transports: {\n      ...legacy.transports,\n      sse: { upstream: \"supported\", runnable: true },\n    },\n    promptCaching: { upstream: \"unsupported\", runnable: false, mode: \"none\" },\n    latencyModes: [{ id: \"standard\", upstream: \"supported\", runnable: true }],\n  });\n}\n\nfunction gatewayRegistryProvider(\n  settings: Settings,\n  input:\n    | { kind: \"vercel-gateway-managed\"; apiKey: string }\n    | {\n        kind: \"vercel-gateway-workspace\" | \"vercel-gateway-organization\";\n        apiKey?: string;\n        customModels?: readonly {\n          upstreamModelId: string;\n          label?: string | null;\n        }[];\n      },\n): InternalRegistryProvider {\n  const workspace = input.kind === \"vercel-gateway-workspace\";\n  const organization = input.kind === \"vercel-gateway-organization\";\n  const scoped = workspace || organization;\n  const curated = organization ? [] : configuredGatewayCatalogModels(settings);\n  const upstreamIds = new Set(curated.map((model) => model.upstreamModelId));\n  const productIds = new Set(\n    parseModelProvidersJson(settings.modelProvidersJson)\n      .filter(\n        (provider) =>\n          provider.id !== WORKSPACE_GATEWAY_PROVIDER_ID &&\n          provider.id !== ORGANIZATION_GATEWAY_PROVIDER_ID,\n      )\n      .flatMap((provider) =>\n        provider.models.flatMap((model) => [model.id, ...(model.aliases ?? [])]),\n      ),\n  );\n  const models = curated.map((model) => {\n    const id = workspace\n      ? model.workspaceProductId\n      : organization\n        ? `${ORGANIZATION_GATEWAY_MODEL_ID_PREFIX}${model.upstreamModelId}`\n        : model.productId;\n    productIds.add(id);\n    return {\n      id,\n      upstreamModelId: model.upstreamModelId,\n      label: model.label,\n      ...(model.shortLabel ? { shortLabel: model.shortLabel } : {}),\n      ...(model.logoUrl ? { logoUrl: model.logoUrl } : {}),\n      capabilities: gatewayModelCapabilities(settings, {\n        implicitCaching: model.implicitCaching,\n        vision: model.vision,\n        inputFileMediaTypes: model.inputFileMediaTypes,\n      }),\n      contextWindowTokens: model.contextWindowTokens,\n      effectiveContextWindowTokens: model.effectiveContextWindowTokens,\n      autoCompactTokenLimit: model.autoCompactTokenLimit,\n      toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n      ...(model.pricing === undefined ? {} : { pricing: model.pricing }),\n    };\n  });\n  if (scoped) {\n    for (const custom of input.customModels ?? []) {\n      const productId = `${workspace ? WORKSPACE_GATEWAY_MODEL_ID_PREFIX : ORGANIZATION_GATEWAY_MODEL_ID_PREFIX}${custom.upstreamModelId}`;\n      // Deployment membership wins over an older or concurrently-created\n      // workspace row with the same upstream identity or generated product id.\n      // This keeps runtime routing deterministic and prevents a legacy/admin\n      // row from making the entire workspace catalog fail uniqueness checks.\n      if (upstreamIds.has(custom.upstreamModelId) || productIds.has(productId)) continue;\n      upstreamIds.add(custom.upstreamModelId);\n      productIds.add(productId);\n      models.push({\n        id: productId,\n        upstreamModelId: custom.upstreamModelId,\n        label: custom.label?.trim() || custom.upstreamModelId,\n        capabilities: gatewayModelCapabilities(settings, {\n          implicitCaching: false,\n          vision: false,\n          inputFileMediaTypes: [],\n        }),\n        contextWindowTokens: 1_000_000,\n        effectiveContextWindowTokens: 900_000,\n        autoCompactTokenLimit: 850_000,\n        toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n      });\n    }\n  }\n  return {\n    kind: input.kind,\n    id: workspace\n      ? WORKSPACE_GATEWAY_PROVIDER_ID\n      : organization\n        ? ORGANIZATION_GATEWAY_PROVIDER_ID\n        : OPENGENI_GATEWAY_PROVIDER_ID,\n    label: workspace ? \"Your Gateway\" : organization ? \"Organization Gateway\" : \"Opengeni\",\n    // Responses preserves vision, reasoning items, and provider-native usage.\n    // Model-specific compatibility stays at the reviewed request fence rather\n    // than downgrading the whole provider wire.\n    api: \"responses\",\n    wireProfile: \"openai\",\n    baseUrl: VERCEL_AI_GATEWAY_BASE_URL,\n    ...(input.apiKey ? { apiKey: input.apiKey } : {}),\n    models,\n  };\n}\n\nfunction openRouterRegistryProvider(\n  settings: Settings,\n  input:\n    | { kind: \"openrouter-managed\"; apiKey: string }\n    | {\n        kind: \"openrouter-workspace\" | \"openrouter-organization\";\n        apiKey?: string;\n        customModels?: readonly {\n          upstreamModelId: string;\n          label?: string | null;\n        }[];\n      },\n): InternalRegistryProvider | null {\n  const workspace = input.kind === \"openrouter-workspace\";\n  const organization = input.kind === \"openrouter-organization\";\n  const scoped = workspace || organization;\n  const curated = organization ? [] : configuredOpenRouterCatalogModels(settings);\n  const upstreamIds = new Set(curated.map((model) => model.upstreamModelId));\n  const productIds = new Set(\n    parseModelProvidersJson(settings.modelProvidersJson)\n      .filter(\n        (provider) =>\n          provider.id !== WORKSPACE_OPENROUTER_PROVIDER_ID &&\n          provider.id !== ORGANIZATION_OPENROUTER_PROVIDER_ID,\n      )\n      .flatMap((provider) =>\n        provider.models.flatMap((model) => [model.id, ...(model.aliases ?? [])]),\n      ),\n  );\n  const models: RegistryProvider[\"models\"] = curated.map((model) => {\n    const id = workspace\n      ? workspaceOpenRouterProductId(model.upstreamModelId)\n      : organization\n        ? `${ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX}${model.upstreamModelId}`\n        : `${OPENROUTER_MODEL_ID_PREFIX}${model.upstreamModelId}`;\n    const aliases = workspace\n      ? model.aliases.map(workspaceOpenRouterProductId)\n      : organization\n        ? model.aliases.map((alias) => `${ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX}${alias}`)\n        : model.aliases;\n    productIds.add(id);\n    for (const alias of aliases) productIds.add(alias);\n    return {\n      id,\n      upstreamModelId: model.upstreamModelId,\n      aliases,\n      label: model.label,\n      ...(model.shortLabel ? { shortLabel: model.shortLabel } : {}),\n      ...(model.logoUrl ? { logoUrl: model.logoUrl } : {}),\n      capabilities: model.capabilities,\n      ...(model.contextWindowTokens === undefined\n        ? {}\n        : { contextWindowTokens: model.contextWindowTokens }),\n      ...(model.effectiveContextWindowTokens === undefined\n        ? {}\n        : { effectiveContextWindowTokens: model.effectiveContextWindowTokens }),\n      ...(model.autoCompactTokenLimit === undefined\n        ? {}\n        : { autoCompactTokenLimit: model.autoCompactTokenLimit }),\n      toolOutputTruncationTokens:\n        model.toolOutputTruncationTokens ?? settings.modelToolOutputTruncationTokens,\n    };\n  });\n  if (scoped) {\n    for (const custom of input.customModels ?? []) {\n      const productId = `${workspace ? WORKSPACE_OPENROUTER_MODEL_ID_PREFIX : ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX}${custom.upstreamModelId}`;\n      if (upstreamIds.has(custom.upstreamModelId) || productIds.has(productId)) continue;\n      upstreamIds.add(custom.upstreamModelId);\n      productIds.add(productId);\n      models.push({\n        id: productId,\n        upstreamModelId: custom.upstreamModelId,\n        aliases: [],\n        label: custom.label?.trim() || custom.upstreamModelId,\n        capabilities: openRouterCustomModelCapabilities(settings),\n        toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n      });\n    }\n  }\n  if (models.length === 0) return null;\n  const defaultHeaders: Record<string, string> = {\n    \"x-title\": \"Opengeni\",\n    ...(settings.publicBaseUrl ? { \"http-referer\": settings.publicBaseUrl } : {}),\n  };\n  return {\n    kind: input.kind,\n    id: workspace\n      ? WORKSPACE_OPENROUTER_PROVIDER_ID\n      : organization\n        ? ORGANIZATION_OPENROUTER_PROVIDER_ID\n        : OPENROUTER_PROVIDER_ID,\n    label: workspace ? \"Your OpenRouter\" : organization ? \"Organization OpenRouter\" : \"OpenRouter\",\n    api: \"chat\",\n    wireProfile: \"openai\",\n    baseUrl: OPENROUTER_BASE_URL,\n    ...(input.apiKey ? { apiKey: input.apiKey } : {}),\n    defaultHeaders,\n    publicDefaultHeaderNames: Object.keys(defaultHeaders),\n    models,\n  };\n}\n\nfunction opperRegistryProvider(\n  settings: Settings,\n  input:\n    | { kind: \"opper-managed\"; apiKey: string }\n    | {\n        kind: \"opper-workspace\" | \"opper-organization\";\n        apiKey?: string;\n        customModels?: readonly {\n          upstreamModelId: string;\n          label?: string | null;\n        }[];\n      },\n): InternalRegistryProvider | null {\n  const workspace = input.kind === \"opper-workspace\";\n  const organization = input.kind === \"opper-organization\";\n  const scoped = workspace || organization;\n  const curated = organization ? [] : configuredOpperCatalogModels(settings);\n  const upstreamIds = new Set(curated.map((model) => model.upstreamModelId));\n  const productIds = new Set(\n    parseModelProvidersJson(settings.modelProvidersJson)\n      .filter(\n        (provider) =>\n          provider.id !== WORKSPACE_OPPER_PROVIDER_ID &&\n          provider.id !== ORGANIZATION_OPPER_PROVIDER_ID,\n      )\n      .flatMap((provider) =>\n        provider.models.flatMap((model) => [model.id, ...(model.aliases ?? [])]),\n      ),\n  );\n  const models: RegistryProvider[\"models\"] = curated.map((model) => {\n    const id = workspace\n      ? workspaceOpperProductId(model.upstreamModelId)\n      : `${OPPER_MODEL_ID_PREFIX}${model.upstreamModelId}`;\n    const aliases = workspace ? model.aliases.map(workspaceOpperProductId) : model.aliases;\n    productIds.add(id);\n    for (const alias of aliases) productIds.add(alias);\n    return {\n      id,\n      upstreamModelId: model.upstreamModelId,\n      aliases,\n      label: model.label,\n      ...(model.shortLabel ? { shortLabel: model.shortLabel } : {}),\n      ...(model.logoUrl ? { logoUrl: model.logoUrl } : {}),\n      capabilities: model.capabilities,\n      ...(model.contextWindowTokens === undefined\n        ? {}\n        : { contextWindowTokens: model.contextWindowTokens }),\n      ...(model.effectiveContextWindowTokens === undefined\n        ? {}\n        : { effectiveContextWindowTokens: model.effectiveContextWindowTokens }),\n      ...(model.autoCompactTokenLimit === undefined\n        ? {}\n        : { autoCompactTokenLimit: model.autoCompactTokenLimit }),\n      toolOutputTruncationTokens:\n        model.toolOutputTruncationTokens ?? settings.modelToolOutputTruncationTokens,\n      // Price authority is the reviewed code snapshot (or a code-defined\n      // entry's own reviewed rate), never a database catalog document.\n      ...(() => {\n        const pricing = model.pricing ?? reviewedOpperModelPricing(model.upstreamModelId);\n        return pricing === undefined ? {} : { pricing };\n      })(),\n    };\n  });\n  if (scoped) {\n    // An organization custom id that names a configured deployment route\n    // inherits that reviewed definition (capabilities and limits); the\n    // workspace rail already lists those routes as curated products.\n    const configuredByUpstream = new Map(\n      configuredOpperCatalogModels(settings).map((model) => [model.upstreamModelId, model]),\n    );\n    for (const custom of input.customModels ?? []) {\n      const productId = `${workspace ? WORKSPACE_OPPER_MODEL_ID_PREFIX : ORGANIZATION_OPPER_MODEL_ID_PREFIX}${custom.upstreamModelId}`;\n      // Deployment membership wins over a workspace row with the same identity.\n      if (upstreamIds.has(custom.upstreamModelId) || productIds.has(productId)) continue;\n      upstreamIds.add(custom.upstreamModelId);\n      productIds.add(productId);\n      const reviewed = configuredByUpstream.get(custom.upstreamModelId);\n      models.push({\n        id: productId,\n        upstreamModelId: custom.upstreamModelId,\n        aliases: [],\n        label: custom.label?.trim() || reviewed?.label || custom.upstreamModelId,\n        ...(reviewed?.shortLabel && !custom.label?.trim()\n          ? { shortLabel: reviewed.shortLabel }\n          : {}),\n        capabilities:\n          reviewed?.capabilities ?? opperCustomModelCapabilities(custom.upstreamModelId),\n        ...(reviewed?.contextWindowTokens === undefined\n          ? {}\n          : { contextWindowTokens: reviewed.contextWindowTokens }),\n        ...(reviewed?.effectiveContextWindowTokens === undefined\n          ? {}\n          : { effectiveContextWindowTokens: reviewed.effectiveContextWindowTokens }),\n        ...(reviewed?.autoCompactTokenLimit === undefined\n          ? {}\n          : { autoCompactTokenLimit: reviewed.autoCompactTokenLimit }),\n        toolOutputTruncationTokens:\n          reviewed?.toolOutputTruncationTokens ?? settings.modelToolOutputTruncationTokens,\n      });\n    }\n  }\n  if (models.length === 0) return null;\n  return {\n    kind: input.kind,\n    id: workspace\n      ? WORKSPACE_OPPER_PROVIDER_ID\n      : organization\n        ? ORGANIZATION_OPPER_PROVIDER_ID\n        : OPPER_PROVIDER_ID,\n    label: workspace ? \"Your Opper\" : organization ? \"Organization Opper\" : \"Opper\",\n    api: \"chat\",\n    wireProfile: \"openai\",\n    baseUrl: OPPER_BASE_URL,\n    // Opper streams only SSE keepalives while a route thinks with hidden\n    // reasoning (Claude via Bedrock returns no reasoning deltas). A live\n    // `max`-effort Opus 5.5 request sent keepalives and no model progress for\n    // more than 10 minutes, so the deployment 10-minute progress bound would\n    // abort and replay legitimate thinking. The byte-silence bound still\n    // catches a dead connection.\n    streamProgressTimeoutMs: OPPER_STREAM_PROGRESS_TIMEOUT_MS,\n    ...(input.apiKey ? { apiKey: input.apiKey } : {}),\n    models,\n  };\n}\n\nfunction configuredRegistryProviders(settings: Settings): InternalRegistryProvider[] {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  const injected: InternalRegistryProvider[] = providers.filter(\n    (provider) =>\n      settings.claudeSubscriptionEnabled ||\n      !(provider.api === \"anthropic-messages\" && provider.anthropic?.auth === \"oauth\"),\n  );\n  if (settings.vercelAiGatewayApiKey && configuredGatewayCatalogModels(settings).length > 0) {\n    injected.push(\n      gatewayRegistryProvider(settings, {\n        kind: \"vercel-gateway-managed\",\n        apiKey: settings.vercelAiGatewayApiKey,\n      }),\n    );\n  }\n  const openrouter = settings.openrouterApiKey\n    ? openRouterRegistryProvider(settings, {\n        kind: \"openrouter-managed\",\n        apiKey: settings.openrouterApiKey,\n      })\n    : null;\n  if (openrouter) injected.push(openrouter);\n  const opper = settings.opperApiKey\n    ? opperRegistryProvider(settings, { kind: \"opper-managed\", apiKey: settings.opperApiKey })\n    : null;\n  if (opper) injected.push(opper);\n  return injected;\n}\n\n/** Customer-owned OpenAI/Azure routes, bound to immutable connection identity. */\nexport function withDirectModelProviders(\n  settings: Settings,\n  connections: readonly {\n    id: string;\n    version: number;\n    subjectId: string | null;\n    kind: string;\n    status: string;\n    providerDomain: string;\n    metadata: Record<string, unknown>;\n    apiKey?: string;\n  }[],\n): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson).filter(\n    (provider) =>\n      !provider.id.startsWith(\"workspace-openai-\") &&\n      !provider.id.startsWith(\"workspace-azure-openai-\"),\n  );\n  for (const connection of connections) {\n    const spec = directModelConnectionSpec(connection);\n    if (!spec) continue;\n    providers.push({\n      kind: spec.provider === \"openai\" ? \"direct-openai-workspace\" : \"direct-azure-workspace\",\n      id: spec.providerId,\n      label: spec.provider === \"openai\" ? \"Your OpenAI\" : \"Your Azure OpenAI\",\n      api: \"responses\",\n      wireProfile: spec.provider === \"openai\" ? \"openai\" : \"azure-openai\",\n      baseUrl: spec.baseUrl,\n      ...(connection.apiKey ? { apiKey: connection.apiKey } : {}),\n      models: [\n        {\n          id: spec.modelId,\n          upstreamModelId: spec.model,\n          label: spec.model,\n          capabilities: legacyModelCapabilities(settings, {\n            reasoningEffort: false,\n            hostedWebSearch: false,\n          }),\n          toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n        },\n      ],\n    });\n  }\n  return { ...settings, modelProvidersJson: JSON.stringify(providers) };\n}\n\n/** Static catalog overlay; it contains no concrete workspace credential. */\nexport function withWorkspaceGatewayCatalogProvider(\n  settings: Settings,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  const withoutWorkspace = providers.filter(\n    (provider) => provider.id !== WORKSPACE_GATEWAY_PROVIDER_ID,\n  );\n  const curatedCount = configuredGatewayCatalogModels(settings).length;\n  if (curatedCount === 0 && customModels.length === 0) return settings;\n  return {\n    ...settings,\n    modelProvidersJson: JSON.stringify([\n      ...withoutWorkspace,\n      gatewayRegistryProvider(settings, {\n        kind: \"vercel-gateway-workspace\",\n        customModels,\n      }),\n    ]),\n  };\n}\n\n/** Runtime overlay after the worker resolves the workspace's encrypted key. */\nexport function withWorkspaceGatewayCredential(\n  settings: Settings,\n  apiKey: string,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  if (!apiKey.trim()) {\n    throw new Error(\"workspace AI Gateway credential is empty\");\n  }\n  const catalogSettings = withWorkspaceGatewayCatalogProvider(settings, customModels);\n  const providers = parseModelProvidersJson(catalogSettings.modelProvidersJson).map((provider) =>\n    provider.id === WORKSPACE_GATEWAY_PROVIDER_ID ? { ...provider, apiKey } : provider,\n  );\n  return { ...catalogSettings, modelProvidersJson: JSON.stringify(providers) };\n}\n\n/** Static OpenRouter catalog overlay; it contains no concrete workspace credential. */\nexport function withWorkspaceOpenRouterCatalogProvider(\n  settings: Settings,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  const withoutWorkspace = providers.filter(\n    (provider) => provider.id !== WORKSPACE_OPENROUTER_PROVIDER_ID,\n  );\n  const provider = openRouterRegistryProvider(settings, {\n    kind: \"openrouter-workspace\",\n    customModels,\n  });\n  if (!provider) return settings;\n  return {\n    ...settings,\n    modelProvidersJson: JSON.stringify([...withoutWorkspace, provider]),\n  };\n}\n\n/** Runtime overlay after the worker resolves the workspace's encrypted OpenRouter key. */\nexport function withWorkspaceOpenRouterCredential(\n  settings: Settings,\n  apiKey: string,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  if (!apiKey.trim()) {\n    throw new Error(\"workspace OpenRouter credential is empty\");\n  }\n  const catalogSettings = withWorkspaceOpenRouterCatalogProvider(settings, customModels);\n  const providers = parseModelProvidersJson(catalogSettings.modelProvidersJson).map((provider) =>\n    provider.id === WORKSPACE_OPENROUTER_PROVIDER_ID ? { ...provider, apiKey } : provider,\n  );\n  return { ...catalogSettings, modelProvidersJson: JSON.stringify(providers) };\n}\n\n/** Static Opper catalog overlay; it contains no concrete workspace credential. */\nexport function withWorkspaceOpperCatalogProvider(\n  settings: Settings,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  const withoutWorkspace = providers.filter(\n    (provider) => provider.id !== WORKSPACE_OPPER_PROVIDER_ID,\n  );\n  const provider = opperRegistryProvider(settings, {\n    kind: \"opper-workspace\",\n    customModels,\n  });\n  if (!provider) return settings;\n  return {\n    ...settings,\n    modelProvidersJson: JSON.stringify([...withoutWorkspace, provider]),\n  };\n}\n\n/** Runtime overlay after the worker resolves the workspace's encrypted Opper key. */\nexport function withWorkspaceOpperCredential(\n  settings: Settings,\n  apiKey: string,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  if (!apiKey.trim()) {\n    throw new Error(\"workspace Opper credential is empty\");\n  }\n  const catalogSettings = withWorkspaceOpperCatalogProvider(settings, customModels);\n  const providers = parseModelProvidersJson(catalogSettings.modelProvidersJson).map((provider) =>\n    provider.id === WORKSPACE_OPPER_PROVIDER_ID ? { ...provider, apiKey } : provider,\n  );\n  return { ...catalogSettings, modelProvidersJson: JSON.stringify(providers) };\n}\n\n/** Secret-free organization Opper catalog overlay. */\nexport function withOrganizationOpperCatalogProvider(\n  settings: Settings,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson).filter(\n    (provider) => provider.id !== ORGANIZATION_OPPER_PROVIDER_ID,\n  );\n  const provider = opperRegistryProvider(settings, {\n    kind: \"opper-organization\",\n    customModels,\n  });\n  return provider\n    ? { ...settings, modelProvidersJson: JSON.stringify([...providers, provider]) }\n    : settings;\n}\n\nexport function withOrganizationOpperCredential(\n  settings: Settings,\n  apiKey: string,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  if (!apiKey.trim()) throw new Error(\"organization Opper credential is empty\");\n  const catalog = withOrganizationOpperCatalogProvider(settings, customModels);\n  const providers = parseModelProvidersJson(catalog.modelProvidersJson).map((provider) =>\n    provider.id === ORGANIZATION_OPPER_PROVIDER_ID ? { ...provider, apiKey } : provider,\n  );\n  return { ...catalog, modelProvidersJson: JSON.stringify(providers) };\n}\n\n/** The organization's own OpenAI or Azure OpenAI key (a direct, non-gateway route). */\nexport type OrganizationDirectModelProvider = \"openai\" | \"azure_openai\";\n\nconst ORGANIZATION_DIRECT_ROUTES = {\n  openai: {\n    kind: \"direct-openai-organization\",\n    id: ORGANIZATION_OPENAI_PROVIDER_ID,\n    prefix: ORGANIZATION_OPENAI_MODEL_ID_PREFIX,\n    label: \"Organization OpenAI\",\n    wireProfile: \"openai\",\n  },\n  azure_openai: {\n    kind: \"direct-azure-organization\",\n    id: ORGANIZATION_AZURE_OPENAI_PROVIDER_ID,\n    prefix: ORGANIZATION_AZURE_OPENAI_MODEL_ID_PREFIX,\n    label: \"Organization Azure OpenAI\",\n    wireProfile: \"azure-openai\",\n  },\n} as const;\n\n/** The organization direct route a product model id belongs to, if any. */\nexport function organizationDirectModelProviderOf(\n  modelId: string | null | undefined,\n): OrganizationDirectModelProvider | null {\n  if (modelId?.startsWith(ORGANIZATION_OPENAI_MODEL_ID_PREFIX)) return \"openai\";\n  if (modelId?.startsWith(ORGANIZATION_AZURE_OPENAI_MODEL_ID_PREFIX)) return \"azure_openai\";\n  return null;\n}\n\nexport function organizationDirectModelIdPrefix(provider: OrganizationDirectModelProvider): string {\n  return ORGANIZATION_DIRECT_ROUTES[provider].prefix;\n}\n\n/**\n * One organization-owned OpenAI or Azure OpenAI route with its curated models.\n * A custom model's `upstreamModelId` is the exact OpenAI model or Azure\n * deployment name. Capabilities match the workspace direct routes: Responses\n * with ordinary function tools only, no reasoning control or hosted web search\n * inferred for an arbitrary model or deployment name.\n */\nfunction organizationDirectRegistryProvider(\n  settings: Settings,\n  provider: OrganizationDirectModelProvider,\n  input: {\n    endpoint?: string | null | undefined;\n    models: readonly { upstreamModelId: string; label?: string | null }[];\n    apiKey?: string;\n  },\n): InternalRegistryProvider | null {\n  const route = ORGANIZATION_DIRECT_ROUTES[provider];\n  const baseUrl =\n    provider === \"openai\"\n      ? \"https://api.openai.com/v1\"\n      : input.endpoint\n        ? organizationAzureOpenAIBaseUrl(input.endpoint)\n        : null;\n  if (!baseUrl) return null;\n  const seen = new Set<string>();\n  const models: RegistryProvider[\"models\"] = [];\n  for (const model of input.models) {\n    if (seen.has(model.upstreamModelId)) continue;\n    seen.add(model.upstreamModelId);\n    models.push({\n      id: `${route.prefix}${model.upstreamModelId}`,\n      upstreamModelId: model.upstreamModelId,\n      aliases: [],\n      label: model.label?.trim() || model.upstreamModelId,\n      capabilities: legacyModelCapabilities(settings, {\n        reasoningEffort: false,\n        hostedWebSearch: false,\n      }),\n      toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n    });\n  }\n  if (models.length === 0) return null;\n  return {\n    kind: route.kind,\n    id: route.id,\n    label: route.label,\n    api: \"responses\",\n    wireProfile: route.wireProfile,\n    baseUrl,\n    ...(input.apiKey ? { apiKey: input.apiKey } : {}),\n    models,\n  };\n}\n\n/**\n * The official `https://<resource>.openai.azure.com/openai/v1` base for a\n * stored organization endpoint, or null for anything else. The API validates\n * the endpoint on write; this keeps a malformed persisted value from routing.\n */\nfunction organizationAzureOpenAIBaseUrl(endpoint: string): string | null {\n  let url: URL;\n  try {\n    url = new URL(endpoint);\n  } catch {\n    return null;\n  }\n  if (\n    url.protocol !== \"https:\" ||\n    url.username ||\n    url.password ||\n    url.port ||\n    url.search ||\n    url.hash ||\n    !/^[a-z0-9-]+\\.openai\\.azure\\.com$/i.test(url.hostname) ||\n    ![\"\", \"/\", \"/openai/v1\", \"/openai/v1/\"].includes(url.pathname)\n  )\n    return null;\n  return `${url.origin}/openai/v1`;\n}\n\nfunction withOrganizationDirectProvider(\n  settings: Settings,\n  provider: OrganizationDirectModelProvider,\n  overlay: InternalRegistryProvider | null,\n): Settings {\n  if (!overlay) return settings;\n  const providers = parseModelProvidersJson(settings.modelProvidersJson).filter(\n    (candidate) => candidate.id !== ORGANIZATION_DIRECT_ROUTES[provider].id,\n  );\n  return { ...settings, modelProvidersJson: JSON.stringify([...providers, overlay]) };\n}\n\n/** Secret-free organization OpenAI or Azure OpenAI catalog overlay (models, and Azure's endpoint). */\nexport function withOrganizationDirectCatalogProvider(\n  settings: Settings,\n  provider: OrganizationDirectModelProvider,\n  input: {\n    endpoint?: string | null | undefined;\n    models: readonly { upstreamModelId: string; label?: string | null }[];\n  },\n): Settings {\n  return withOrganizationDirectProvider(\n    settings,\n    provider,\n    organizationDirectRegistryProvider(settings, provider, input),\n  );\n}\n\n/** Runtime overlay after the worker resolves the organization's encrypted key. */\nexport function withOrganizationDirectCredential(\n  settings: Settings,\n  provider: OrganizationDirectModelProvider,\n  apiKey: string,\n  input: {\n    endpoint?: string | null | undefined;\n    models: readonly { upstreamModelId: string; label?: string | null }[];\n  },\n): Settings {\n  if (!apiKey.trim()) throw new Error(`organization ${provider} credential is empty`);\n  return withOrganizationDirectProvider(\n    settings,\n    provider,\n    organizationDirectRegistryProvider(settings, provider, { ...input, apiKey }),\n  );\n}\n\n/** Secret-free organization Azure OpenAI catalog overlay (endpoint + deployments). */\nexport function withOrganizationAzureOpenAICatalogProvider(\n  settings: Settings,\n  input: {\n    endpoint: string | null | undefined;\n    models: readonly { upstreamModelId: string; label?: string | null }[];\n  },\n): Settings {\n  return withOrganizationDirectCatalogProvider(settings, \"azure_openai\", input);\n}\n\n/** Runtime overlay after the worker resolves the organization's encrypted Azure key. */\nexport function withOrganizationAzureOpenAICredential(\n  settings: Settings,\n  apiKey: string,\n  input: {\n    endpoint: string | null | undefined;\n    models: readonly { upstreamModelId: string; label?: string | null }[];\n  },\n): Settings {\n  return withOrganizationDirectCredential(settings, \"azure_openai\", apiKey, input);\n}\n\n/** Secret-free organization Vercel AI Gateway catalog overlay. */\nexport function withOrganizationGatewayCatalogProvider(\n  settings: Settings,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  if (customModels.length === 0) return settings;\n  const providers = parseModelProvidersJson(settings.modelProvidersJson).filter(\n    (provider) => provider.id !== ORGANIZATION_GATEWAY_PROVIDER_ID,\n  );\n  const provider = gatewayRegistryProvider(settings, {\n    kind: \"vercel-gateway-organization\",\n    customModels,\n  });\n  return { ...settings, modelProvidersJson: JSON.stringify([...providers, provider]) };\n}\n\nexport function withOrganizationGatewayCredential(\n  settings: Settings,\n  apiKey: string,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  if (!apiKey.trim()) throw new Error(\"organization AI Gateway credential is empty\");\n  const catalog = withOrganizationGatewayCatalogProvider(settings, customModels);\n  const providers = parseModelProvidersJson(catalog.modelProvidersJson).map((provider) =>\n    provider.id === ORGANIZATION_GATEWAY_PROVIDER_ID ? { ...provider, apiKey } : provider,\n  );\n  return { ...catalog, modelProvidersJson: JSON.stringify(providers) };\n}\n\n/** Secret-free organization OpenRouter catalog overlay. */\nexport function withOrganizationOpenRouterCatalogProvider(\n  settings: Settings,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson).filter(\n    (provider) => provider.id !== ORGANIZATION_OPENROUTER_PROVIDER_ID,\n  );\n  const provider = openRouterRegistryProvider(settings, {\n    kind: \"openrouter-organization\",\n    customModels,\n  });\n  return provider\n    ? { ...settings, modelProvidersJson: JSON.stringify([...providers, provider]) }\n    : settings;\n}\n\nexport function withOrganizationOpenRouterCredential(\n  settings: Settings,\n  apiKey: string,\n  customModels: readonly {\n    upstreamModelId: string;\n    label?: string | null;\n  }[] = [],\n): Settings {\n  if (!apiKey.trim()) throw new Error(\"organization OpenRouter credential is empty\");\n  const catalog = withOrganizationOpenRouterCatalogProvider(settings, customModels);\n  const providers = parseModelProvidersJson(catalog.modelProvidersJson).map((provider) =>\n    provider.id === ORGANIZATION_OPENROUTER_PROVIDER_ID ? { ...provider, apiKey } : provider,\n  );\n  return { ...catalog, modelProvidersJson: JSON.stringify(providers) };\n}\n\n/** OpenAI GPT-5.6 Fast mode is 2× Standard list rates (service_tier fast/priority). */\nconst GPT56_FAST_BILLING_MULTIPLIER_BPS = 20_000;\n/**\n * OpenAI Ultrafast is 6× Standard list rates (service_tier ultrafast). Codex\n * subscriptions count it against included limits at 8×; those limits are\n * observed from the provider's own usage readings, not priced here.\n */\nconst ULTRAFAST_BILLING_MULTIPLIER_BPS = 60_000;\n/** Upstream slugs OpenAI serves at the Ultrafast tier. */\nconst ULTRAFAST_UPSTREAM_SLUGS: readonly string[] = [\"gpt-6-astra\", \"gpt-6.1-sol\"];\n\n/**\n * Ultrafast for a model id (`gpt-6-astra` or `codex/gpt-6-astra`), when OpenAI\n * serves its slug at that tier. Codex accounts must still advertise the tier:\n * placement serves an Ultrafast turn only from an account whose live model\n * list includes it for that model.\n */\nfunction ultrafastLatencyModeForModel(modelId: string):\n  | {\n      id: \"ultrafast\";\n      upstream: \"supported\";\n      runnable: true;\n      billingMultiplierBps: number;\n    }\n  | undefined {\n  const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX)\n    ? modelId.slice(CODEX_MODEL_ID_PREFIX.length)\n    : modelId;\n  return ULTRAFAST_UPSTREAM_SLUGS.includes(slug)\n    ? {\n        id: \"ultrafast\",\n        upstream: \"supported\",\n        runnable: true,\n        billingMultiplierBps: ULTRAFAST_BILLING_MULTIPLIER_BPS,\n      }\n    : undefined;\n}\n\n/**\n * Product display label for catalog/picker UI.\n * Same string for OpenAI and Codex copies of a slug (`gpt-5.6-luna` and\n * `codex/gpt-5.6-luna` → `GPT-5.6 Luna`). Curated Grok slugs receive the same\n * product casing; other ids pass through unchanged.\n */\nexport function productLabelForModelId(modelId: string): string {\n  const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX)\n    ? modelId.slice(CODEX_MODEL_ID_PREFIX.length)\n    : modelId;\n  const grokMatch = /^grok-(\\d+(?:\\.\\d+)?)$/i.exec(slug);\n  if (grokMatch) {\n    return `Grok ${grokMatch[1]}`;\n  }\n  const match = /^(gpt-\\d+(?:\\.\\d+)?)(?:-(.+))?$/i.exec(slug);\n  if (!match) {\n    return slug;\n  }\n  const family = match[1]!.replace(/^gpt/i, \"GPT\");\n  const rest = match[2];\n  if (!rest) {\n    return family;\n  }\n  const suffix = rest\n    .split(\"-\")\n    .filter((part) => part.length > 0)\n    .map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase())\n    .join(\" \");\n  return suffix.length > 0 ? `${family} ${suffix}` : family;\n}\n\n/**\n * Curated compact product labels for dense UI. Unknown model slugs return null\n * so callers fall back to the full `label`.\n */\nexport function productShortLabelForModelId(modelId: string): string | null {\n  const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX)\n    ? modelId.slice(CODEX_MODEL_ID_PREFIX.length)\n    : modelId;\n  switch (slug) {\n    case \"grok-4.7\":\n      return \"4.7\";\n    case \"gpt-5.6-sol\":\n      return \"5.6 Sol\";\n    case \"gpt-5.6-terra\":\n      return \"5.6 Terra\";\n    case \"gpt-5.6-luna\":\n      return \"5.6 Luna\";\n    case \"gpt-6-astra\":\n      return \"6 Astra\";\n    case \"gpt-6-sol\":\n      return \"6 Sol\";\n    case \"gpt-6-luna\":\n      return \"6 Luna\";\n    default:\n      return null;\n  }\n}\n\nconst BUILTIN_GPT56_MODEL_IDS = [\"gpt-5.6-sol\", \"gpt-5.6-terra\", \"gpt-5.6-luna\"] as const;\n\nfunction isBuiltinGpt56ModelId(modelId: string): boolean {\n  return (BUILTIN_GPT56_MODEL_IDS as readonly string[]).includes(modelId);\n}\n\n/** Billed GPT-5.6 uses the same raw/effective/auto-compact catalog as Codex. */\nfunction builtinContextLimitsForModel(\n  settings: Settings,\n  modelId: string,\n): Pick<\n  ConfiguredModel,\n  \"contextWindowTokens\" | \"effectiveContextWindowTokens\" | \"autoCompactTokenLimit\"\n> {\n  if (isBuiltinGpt56ModelId(modelId)) {\n    return {\n      contextWindowTokens: CODEX_MODEL_CONTEXT_WINDOW_TOKENS,\n      effectiveContextWindowTokens: CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,\n      autoCompactTokenLimit: CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT,\n    };\n  }\n  return { contextWindowTokens: settings.contextWindowTokens };\n}\n\nfunction builtinLatencyModesForModel(modelId: string): Array<{\n  id: z.infer<typeof ModelLatencyModeV1>;\n  upstream: \"supported\" | \"unsupported\" | \"unknown\";\n  runnable: boolean;\n  billingMultiplierBps?: number;\n}> {\n  if (\n    isBuiltinGpt56ModelId(modelId) ||\n    /^gpt-6(?:\\.\\d+)?-/u.test(modelId) ||\n    modelId.startsWith(\"codex/gpt-5.6-\") ||\n    /^codex\\/gpt-6(?:\\.\\d+)?-/u.test(modelId)\n  ) {\n    const ultrafast = ultrafastLatencyModeForModel(modelId);\n    return [\n      { id: \"standard\", upstream: \"supported\", runnable: true },\n      {\n        id: \"fast\",\n        upstream: \"supported\",\n        runnable: true,\n        billingMultiplierBps: GPT56_FAST_BILLING_MULTIPLIER_BPS,\n      },\n      ...(ultrafast ? [ultrafast] : []),\n    ];\n  }\n  return [{ id: \"standard\", upstream: \"unknown\", runnable: true }];\n}\n\nfunction isReviewedGptVisionModel(slug: string): boolean {\n  return slug.startsWith(\"gpt-5.6-\") || /^gpt-6(?:\\.\\d+)?-/u.test(slug);\n}\n\n/** Repair missing reviewed capabilities in live/stored Codex definitions.\n * GPT-6 models accept image input and JSON-schema output (`text.format`, as the\n * Codex CLI's `--output-schema` sends it; verified live). Explicit latency and\n * structured-output restrictions and every unrelated catalog field remain\n * authoritative.\n */\nfunction reviewedCodexCatalogCapabilities(\n  slug: string,\n  capabilities: ModelCapabilitiesV1,\n): ModelCapabilitiesV1 {\n  if (!/^gpt-6(?:\\.\\d+)?-/u.test(slug)) return capabilities;\n  const builtin = builtinLatencyModesForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`);\n  const added = builtin.filter(\n    (mode) =>\n      (mode.id === \"fast\" || mode.id === \"ultrafast\") &&\n      !capabilities.latencyModes.some((existing) => existing.id === mode.id),\n  );\n  return normalizeCapabilities({\n    ...capabilities,\n    inputModalities: [...new Set([...capabilities.inputModalities, \"image\" as const])],\n    structuredOutput:\n      capabilities.structuredOutput.upstream === \"unknown\"\n        ? { upstream: \"supported\", runnable: true }\n        : capabilities.structuredOutput,\n    latencyModes: [...capabilities.latencyModes, ...added],\n  });\n}\n\nfunction builtinPromptCachingForModel(\n  modelId: string,\n): NonNullable<ModelCapabilitiesV1[\"promptCaching\"]> | undefined {\n  const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX)\n    ? modelId.slice(CODEX_MODEL_ID_PREFIX.length)\n    : modelId;\n  return slug.startsWith(\"gpt-5.6-\") || slug.startsWith(\"gpt-6-\")\n    ? { upstream: \"supported\", runnable: true, mode: \"implicit\" }\n    : undefined;\n}\n\n/** Reviewed direct-OpenAI text models that accept the hosted image tool. */\nfunction builtinHostedImageGenerationForModel(settings: Settings, modelId: string): boolean {\n  return (\n    settings.openaiProvider === \"openai\" &&\n    isDirectOpenAiApiBaseUrl(settings.openaiBaseUrl) &&\n    (isBuiltinGpt56ModelId(modelId) || modelId.startsWith(\"gpt-6-\"))\n  );\n}\n\n/** Undefined and the exact public OpenAI v1 endpoint are the same direct route. */\nexport function isDirectOpenAiApiBaseUrl(baseUrl: string | undefined): boolean {\n  if (baseUrl === undefined) return true;\n  try {\n    const parsed = new URL(baseUrl);\n    return (\n      parsed.protocol === \"https:\" &&\n      parsed.hostname === \"api.openai.com\" &&\n      parsed.port === \"\" &&\n      parsed.username === \"\" &&\n      parsed.password === \"\" &&\n      parsed.search === \"\" &&\n      parsed.hash === \"\" &&\n      parsed.pathname.replace(/\\/+$/, \"\") === \"/v1\"\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Map Opengeni latency mode to the provider `service_tier` wire value.\n * Azure, Codex ChatGPT, and xAI accept `priority`; OpenAI API accepts `fast`.\n * Ultrafast is `ultrafast` wherever a model declares it (OpenAI API and Codex).\n * Standard omits the field.\n */\nexport function serviceTierForLatencyMode(\n  providerId: string,\n  latencyMode: LatencyMode,\n): \"fast\" | \"priority\" | \"ultrafast\" | undefined {\n  if (latencyMode === \"standard\") {\n    return undefined;\n  }\n  if (latencyMode === \"ultrafast\") {\n    return \"ultrafast\";\n  }\n  if (\n    providerId === \"azure\" ||\n    providerId === CODEX_PROVIDER_ID ||\n    providerId === XAI_SUBSCRIPTION_PROVIDER_ID\n  ) {\n    return \"priority\";\n  }\n  return \"fast\";\n}\n\n/** True when the response tier fulfills a non-standard Fast/priority request. */\nexport function responseSatisfiesLatencyMode(\n  requested: LatencyMode,\n  responseServiceTier: string | null | undefined,\n): boolean {\n  if (requested === \"standard\") {\n    return true;\n  }\n  if (requested === \"ultrafast\") {\n    return responseServiceTier === \"ultrafast\";\n  }\n  return responseServiceTier === \"priority\" || responseServiceTier === \"fast\";\n}\n\nexport function runnableLatencyModesForModel(settings: Settings, modelId: string): LatencyMode[] {\n  const resolved = resolveModelProvider(\n    settingsForTurnExecutionPolicy(settings, modelId),\n    canonicalizeConfiguredModelId(settings, modelId),\n  );\n  if (!resolved) {\n    return [\"standard\"];\n  }\n  return resolved.model.capabilities.latencyModes\n    .filter((mode) => mode.runnable)\n    .map((mode) => LatencyMode.parse(mode.id));\n}\n\nfunction assertLatencyModeRunnable(\n  settings: Settings,\n  modelId: string,\n  latencyMode: LatencyMode,\n): void {\n  const runnable = runnableLatencyModesForModel(settings, modelId);\n  if (!runnable.includes(latencyMode)) {\n    throw new UnsupportedLatencyModeError(modelId, latencyMode, runnable);\n  }\n}\n\nexport class UnsupportedLatencyModeError extends Error {\n  readonly code = \"UNSUPPORTED_LATENCY_MODE\";\n\n  constructor(\n    readonly modelId: string,\n    readonly latencyMode: LatencyMode,\n    readonly allowedLatencyModes: readonly LatencyMode[],\n  ) {\n    super(\n      `latency mode ${latencyMode} is not runnable for model ${modelId} (allowed: ${allowedLatencyModes.join(\", \")})`,\n    );\n    this.name = \"UnsupportedLatencyModeError\";\n  }\n}\n\nfunction registryCredentialSource(provider: InternalRegistryProvider): CredentialSourceV1 {\n  switch (provider.kind) {\n    case \"anonymous\":\n      return { kind: \"deployment\", mechanism: \"none\" };\n    case \"codex-subscription\":\n      return { kind: \"connected_subscription\", provider: \"codex\" };\n    case \"xai-subscription\":\n      return { kind: \"connected_subscription\", provider: \"xai\" };\n    case \"claude-subscription-workspace\":\n    case \"claude-subscription-organization\":\n      return { kind: \"connected_subscription\", provider: \"claude\" };\n    case \"vercel-gateway-workspace\":\n    case \"direct-openai-workspace\":\n    case \"direct-azure-workspace\":\n    case \"openrouter-workspace\":\n    case \"opper-workspace\":\n    case \"anthropic-workspace\":\n      return { kind: \"workspace_connection\", mechanism: \"api_key\" };\n    case \"vercel-gateway-organization\":\n    case \"anthropic-organization\":\n    case \"openrouter-organization\":\n    case \"opper-organization\":\n    case \"direct-openai-organization\":\n    case \"direct-azure-organization\":\n      return { kind: \"organization_connection\", mechanism: \"api_key\" };\n    case \"api-key\":\n    case \"vercel-gateway-managed\":\n    case \"openrouter-managed\":\n    case \"opper-managed\":\n      return { kind: \"deployment\", mechanism: \"api_key\" };\n    default: {\n      const _exhaustive: never = provider.kind;\n      return _exhaustive;\n    }\n  }\n}\n\nfunction registryBilling(provider: InternalRegistryProvider): BillingAttributionV1 {\n  switch (provider.kind) {\n    case \"anonymous\":\n    case \"openrouter-managed\":\n      return { upstreamPayer: \"deployment\", metering: \"external\" };\n    case \"codex-subscription\":\n    case \"xai-subscription\":\n    case \"claude-subscription-workspace\":\n    case \"claude-subscription-organization\":\n      return { upstreamPayer: \"connected_subscription\", metering: \"external\" };\n    case \"vercel-gateway-workspace\":\n    case \"direct-openai-workspace\":\n    case \"direct-azure-workspace\":\n    case \"openrouter-workspace\":\n    case \"opper-workspace\":\n    case \"anthropic-workspace\":\n      return { upstreamPayer: \"workspace\", metering: \"external\" };\n    case \"vercel-gateway-organization\":\n    case \"anthropic-organization\":\n    case \"openrouter-organization\":\n    case \"opper-organization\":\n    case \"direct-openai-organization\":\n    case \"direct-azure-organization\":\n      return { upstreamPayer: \"organization\", metering: \"external\" };\n    case \"api-key\":\n    case \"vercel-gateway-managed\":\n    // Paid deployment Opper routes settle through the deployment's Opper\n    // account and debit Opengeni credits, like managed AI Gateway.\n    case \"opper-managed\":\n      return { upstreamPayer: \"deployment\", metering: \"opengeni_credits\" };\n    default: {\n      const _exhaustive: never = provider.kind;\n      return _exhaustive;\n    }\n  }\n}\n\nfunction configuredCostForModel(\n  settings: Settings,\n  productModelId: string,\n  credentialSource: CredentialSourceV1,\n): ConfiguredModelCostClass {\n  if (credentialSource.kind === \"workspace_connection\") return \"workspace\";\n  if (credentialSource.kind === \"organization_connection\") return \"organization\";\n  if (credentialSource.kind === \"connected_subscription\") return \"subscription\";\n  return parseModelCostPolicyJson(settings.modelCostPolicyJson)[productModelId] ?? \"credits\";\n}\n\nexport function modelCostClassForConfiguredModel(\n  _settings: Settings,\n  model: Pick<ConfiguredModel, \"cost\">,\n): ConfiguredModelCostClass {\n  return model.cost;\n}\n\nfunction builtinCredentialSource(settings: Settings): CredentialSourceV1 {\n  if (settings.openaiProvider === \"azure\" && !settings.azureOpenaiApiKey) {\n    return { kind: \"deployment\", mechanism: \"azure_ad_bearer\" };\n  }\n  return { kind: \"deployment\", mechanism: \"api_key\" };\n}\n\nfunction staticRequestMetadataForDigest(provider: ResolvedModelProvider): {\n  anthropic?: ResolvedModelProvider[\"anthropic\"];\n  headers: Array<{\n    name: string;\n    classification: \"public\" | \"secret\";\n    value?: string;\n  }>;\n  query: Array<{\n    name: string;\n    classification: \"public\" | \"secret\";\n    value?: string;\n  }>;\n} {\n  const publicHeaders = new Set(provider.publicDefaultHeaderNames ?? []);\n  const publicQuery = new Set(provider.publicDefaultQueryNames ?? []);\n  return {\n    ...(provider.anthropic\n      ? {\n          anthropic: (({ identity: _identity, credentialBinding: _binding, ...options }) =>\n            options)(provider.anthropic),\n        }\n      : {}),\n    headers: Object.entries(provider.defaultHeaders ?? {})\n      .sort(([left], [right]) => left.localeCompare(right))\n      .map(([name, value]) =>\n        publicHeaders.has(name)\n          ? { name, classification: \"public\" as const, value }\n          : { name, classification: \"secret\" as const },\n      ),\n    query: Object.entries(provider.defaultQuery ?? {})\n      .sort(([left], [right]) => left.localeCompare(right))\n      .map(([name, value]) =>\n        publicQuery.has(name)\n          ? { name, classification: \"public\" as const, value }\n          : { name, classification: \"secret\" as const },\n      ),\n  };\n}\n\nfunction canonicalJson(value: unknown): string {\n  const normalize = (input: unknown): unknown => {\n    if (Array.isArray(input)) {\n      return input.map((entry) => normalize(entry));\n    }\n    if (input && typeof input === \"object\") {\n      const out: Record<string, unknown> = {};\n      for (const key of Object.keys(input).sort()) {\n        const child = (input as Record<string, unknown>)[key];\n        if (child !== undefined) {\n          out[key] = normalize(child);\n        }\n      }\n      return out;\n    }\n    return input;\n  };\n  return JSON.stringify(normalize(value));\n}\n\nfunction definitionVersionFor(\n  model: Omit<ConfiguredModel, \"definitionVersion\">,\n  provider: ResolvedModelProvider,\n  options: { includeWireProfile?: boolean; includeAutoCompactTokenLimit?: boolean } = {},\n): string {\n  const requestMetadata = staticRequestMetadataForDigest(provider);\n  const includeWireProfile = options.includeWireProfile ?? true;\n  // The automatic-compaction trigger is a context-management default, not\n  // executable identity: workspace and organization compaction preferences\n  // already replace it live on every attempt of an accepted turn. Freezing\n  // it made a changed default strand every in-flight turn of that model.\n  // Only the pre-exclusion compatibility digests below still include it.\n  const { autoCompactTokenLimit, ...executableLimits } = model.executionLimits;\n  const executionLimits = options.includeAutoCompactTokenLimit\n    ? { ...executableLimits, autoCompactTokenLimit }\n    : executableLimits;\n  const digestInput = canonicalJson({\n    schemaVersion: model.schemaVersion,\n    id: model.id,\n    providerId: model.providerId,\n    deployment: model.deployment,\n    provider: {\n      adapterKind: provider.kind,\n      wireApi: provider.api,\n      ...(includeWireProfile ? { wireProfile: provider.wireProfile } : {}),\n      baseUrl: provider.baseUrl ?? null,\n      defaultHeaders: requestMetadata.headers,\n      defaultQuery: requestMetadata.query,\n      ...(requestMetadata.anthropic ? { anthropic: requestMetadata.anthropic } : {}),\n    },\n    credentialSource: model.credentialSource,\n    billing: model.billing,\n    executionLimits,\n    capabilities: model.capabilities,\n    // Workspace-facing free/credits classification is a separate live\n    // deployment policy. Operators must drain/fence accepted turns before\n    // changing it; it is intentionally not a second executable-definition\n    // freeze inside TurnExecutionPolicyV1.\n    ...(model.requestPolicy ? { requestPolicy: model.requestPolicy } : {}),\n    pricing: model.pricing ?? null,\n  });\n  return `sha256:${createHash(\"sha256\")\n    .update(\"opengeni:model-definition:v1\\n\", \"utf8\")\n    .update(digestInput, \"utf8\")\n    .digest(\"hex\")}`;\n}\n\n/**\n * The digest a turn accepted before the compaction trigger left the\n * definition carries. It reproduces only the current trigger value, so an\n * accepted turn stays runnable across the release that drops the field, and\n * every other executable field must still match exactly.\n */\nfunction legacyFrozenAutoCompactDefinitionVersionFor(\n  model: ConfiguredModel,\n  provider: ResolvedModelProvider,\n): string {\n  const { definitionVersion: _definitionVersion, ...modelWithoutVersion } = model;\n  return definitionVersionFor(modelWithoutVersion, provider, {\n    includeAutoCompactTokenLimit: true,\n  });\n}\n\nfunction legacyImplicitOpenAiDefinitionVersionFor(\n  model: ConfiguredModel,\n  provider: ResolvedModelProvider,\n): string | null {\n  if (provider.wireProfile !== \"openai\") return null;\n  const { definitionVersion: _definitionVersion, ...modelWithoutVersion } = model;\n  return definitionVersionFor(modelWithoutVersion, provider, {\n    includeWireProfile: false,\n    includeAutoCompactTokenLimit: true,\n  });\n}\n\nfunction legacyCodexAstraImplicitCachingDefinitionVersionFor(\n  model: ConfiguredModel,\n  provider: ResolvedModelProvider,\n): string | null {\n  // The GPT-6 rollout only made the already-implicit Codex cache discoverable.\n  // Bound this compatibility to that product/transport and exact declaration;\n  // never normalize explicit caching, another capability, or another model.\n  if (\n    model.id !== \"codex/gpt-6-astra\" ||\n    model.upstreamModelId !== \"gpt-6-astra\" ||\n    provider.id !== CODEX_PROVIDER_ID ||\n    provider.kind !== \"codex-subscription\" ||\n    provider.api !== \"responses\" ||\n    provider.wireProfile !== \"openai\" ||\n    canonicalJson(model.capabilities.promptCaching) !==\n      canonicalJson({ upstream: \"supported\", runnable: true, mode: \"implicit\" })\n  ) {\n    return null;\n  }\n  const { definitionVersion: _definitionVersion, ...modelWithoutVersion } = model;\n  const { promptCaching: _promptCaching, ...capabilities } = model.capabilities;\n  // Recompute, rather than allowlisting an incident hash: all other current\n  // fields must still reproduce the accepted digest. Do not compose this with\n  // the older wire-profile compatibility or rewrite the accepted policy.\n  // Ultrafast was declared later; that historical declaration never had it.\n  return definitionVersionFor(\n    {\n      ...modelWithoutVersion,\n      capabilities: {\n        ...capabilities,\n        latencyModes: capabilities.latencyModes.filter((mode) => mode.id !== \"ultrafast\"),\n      },\n    },\n    provider,\n    { includeAutoCompactTokenLimit: true },\n  );\n}\n\nfunction matchesAdditiveCapabilityDefinitionVersion(\n  model: ConfiguredModel,\n  provider: ResolvedModelProvider,\n  policy: TurnExecutionPolicyV1,\n): boolean {\n  const { definitionVersion: _definitionVersion, ...modelWithoutVersion } = model;\n  const { latencyModes, inputModalities } = model.capabilities;\n  // V1 has four unique latency ids and three unique input modalities:\n  // at most 15 * 7 subset digests retaining the frozen mode. Reconstruct an\n  // exact historical declaration; never ignore the digest or alter existing\n  // mode support, runnable state, billing multiplier, or request-tier routing.\n  // Every other executable field remains in the digest. Do not compose this\n  // with the pre-wire-profile or implicit-caching migration exceptions.\n  for (let latencyMask = 1; latencyMask < 1 << latencyModes.length; latencyMask += 1) {\n    const retainedModes = latencyModes.filter((_mode, index) => latencyMask & (1 << index));\n    if (!retainedModes.some((mode) => mode.id === policy.latencyMode && mode.runnable)) {\n      continue;\n    }\n    for (let inputMask = 1; inputMask < 1 << inputModalities.length; inputMask += 1) {\n      const retainedInputs = inputModalities.filter((_modality, index) => inputMask & (1 << index));\n      if (\n        retainedModes.length === latencyModes.length &&\n        retainedInputs.length === inputModalities.length\n      ) {\n        continue;\n      }\n      const capabilities = {\n        ...model.capabilities,\n        latencyModes: retainedModes,\n        inputModalities: retainedInputs,\n      };\n      if (\n        matchesCurrentOrPreCompactionExclusionDigest(\n          policy,\n          { ...modelWithoutVersion, capabilities },\n          provider,\n        )\n      ) {\n        return true;\n      }\n    }\n  }\n  return false;\n}\n\n/**\n * The model as accepted before runnable structured output was declared, or\n * null when it is not declared. Agent turns never request structured output\n * (only stateless single calls do), so enabling it from the exact unknown/off\n * declaration cannot change an accepted turn's execution. Every definition\n * compatibility check also runs against this one historical declaration;\n * every other field still has to reproduce the frozen digest.\n */\nfunction structuredOutputPreEnablementModel(\n  model: ConfiguredModel,\n  provider: ResolvedModelProvider,\n): ConfiguredModel | null {\n  if (!model.capabilities.structuredOutput.runnable) return null;\n  const { definitionVersion: _definitionVersion, ...modelWithoutVersion } = model;\n  const historical = {\n    ...modelWithoutVersion,\n    capabilities: {\n      ...model.capabilities,\n      structuredOutput: { upstream: \"unknown\" as const, runnable: false },\n    },\n  };\n  return { ...historical, definitionVersion: definitionVersionFor(historical, provider) };\n}\n\n/** Whether a frozen digest matches this model definition or one tolerated historical form of it. */\nfunction acceptedDefinitionVersionMatches(\n  model: ConfiguredModel,\n  provider: ResolvedModelProvider,\n  policy: TurnExecutionPolicyV1,\n): boolean {\n  return (\n    policy.definitionVersion === model.definitionVersion ||\n    policy.definitionVersion === legacyFrozenAutoCompactDefinitionVersionFor(model, provider) ||\n    policy.definitionVersion === legacyImplicitOpenAiDefinitionVersionFor(model, provider) ||\n    policy.definitionVersion ===\n      legacyCodexAstraImplicitCachingDefinitionVersionFor(model, provider) ||\n    matchesAdditiveCapabilityDefinitionVersion(model, provider, policy) ||\n    matchesWebSearchEnablementDefinitionVersion(model, provider, policy)\n  );\n}\n\n/**\n * Operator-change compatibility (an added capability or enabled web search)\n * also applies to a turn accepted before the compaction trigger left the\n * digest. This is the same single historical declaration in either digest\n * form, never an additional tolerated change.\n */\nfunction matchesCurrentOrPreCompactionExclusionDigest(\n  policy: TurnExecutionPolicyV1,\n  model: Omit<ConfiguredModel, \"definitionVersion\">,\n  provider: ResolvedModelProvider,\n): boolean {\n  return (\n    policy.definitionVersion === definitionVersionFor(model, provider) ||\n    policy.definitionVersion ===\n      definitionVersionFor(model, provider, { includeAutoCompactTokenLimit: true })\n  );\n}\n\n/** The one pre-enablement hosted web-search declaration an operator may upgrade from. */\nfunction webSearchPreEnablementState(): CapabilityStateV1 {\n  return { upstream: \"unknown\", runnable: false };\n}\n\nfunction matchesWebSearchEnablementDefinitionVersion(\n  model: ConfiguredModel,\n  provider: ResolvedModelProvider,\n  policy: TurnExecutionPolicyV1,\n): boolean {\n  // An operator turning on hosted web search for an existing model changes\n  // only capabilities.hostedTools.webSearch from the exact unknown/off\n  // declaration to a runnable one. Reconstruct that single historical\n  // declaration and require every other current field to reproduce the frozen\n  // digest; never ignore the digest. Turning web search off, or changing any\n  // other capability, still fails closed. Do not compose this with the\n  // latency/input-modality subsets or the wire-profile, implicit-caching, or\n  // Claude-accounting migration exceptions.\n  if (!model.capabilities.hostedTools.webSearch.runnable) return false;\n  const { definitionVersion: _definitionVersion, ...modelWithoutVersion } = model;\n  const capabilities = {\n    ...model.capabilities,\n    hostedTools: { ...model.capabilities.hostedTools, webSearch: webSearchPreEnablementState() },\n  };\n  return matchesCurrentOrPreCompactionExclusionDigest(\n    policy,\n    { ...modelWithoutVersion, capabilities },\n    provider,\n  );\n}\n\n/**\n * The executable model an accepted turn runs: the current definition, except\n * that a turn frozen before hosted web search was enabled keeps its frozen\n * tool set (no web_search) on every recovery attempt. Only the next accepted\n * logical turn resolves the newly enabled tool. Call only with a policy that\n * already passed assertTurnExecutionPolicyMatchesConfigV1.\n */\nexport function configuredModelForAcceptedTurnExecutionPolicy(\n  model: ConfiguredModel,\n  provider: ResolvedModelProvider,\n  policy: TurnExecutionPolicyV1,\n): ConfiguredModel {\n  if (\n    policy.definitionVersion === model.definitionVersion ||\n    // Runtime test doubles may resolve a partial shape; a model without a\n    // runnable web-search declaration has nothing to withhold.\n    model.capabilities?.hostedTools?.webSearch?.runnable !== true ||\n    !matchesWebSearchEnablementDefinitionVersion(model, provider, policy)\n  ) {\n    return model;\n  }\n  return {\n    ...model,\n    capabilities: {\n      ...model.capabilities,\n      hostedTools: {\n        ...model.capabilities.hostedTools,\n        webSearch: webSearchPreEnablementState(),\n      },\n    },\n    hostedWebSearch: false,\n    definitionVersion: policy.definitionVersion,\n  };\n}\n\n/**\n * The built-in provider's stable id: \"openai\" on the OpenAI platform, \"azure\"\n * on Azure. Exported because the workspace model-policy gate must attribute\n * the legacy resolveTurnModel-null fallback (which routes to this built-in\n * client) to the SAME identity the router uses — otherwise a policy blocking\n * the built-in could be bypassed through the null-resolution path.\n */\nexport function builtinProviderId(settings: Pick<Settings, \"openaiProvider\">): string {\n  return settings.openaiProvider === \"azure\" ? \"azure\" : \"openai\";\n}\n\nfunction builtinProviderLabel(settings: Pick<Settings, \"openaiProvider\">): string {\n  return settings.openaiProvider === \"azure\" ? \"Azure OpenAI\" : \"OpenAI\";\n}\n\n/**\n * Every provider a client may route to: the built-in OpenAI/Azure provider\n * first (id \"openai\"/\"azure\", always \"responses\"), then each registry provider\n * in declaration order. Client-construction inputs are filled from\n * the existing flat openai/azure settings for the built-in, and from the\n * registry entry for the rest. Registry ids may not collide with the built-in\n * id — validateSettings rejects that at boot.\n */\nexport function configuredProviders(\n  settings: Settings,\n  source: NodeJS.ProcessEnv = process.env,\n): ResolvedModelProvider[] {\n  const credentialSource = builtinCredentialSource(settings);\n  const builtin: ResolvedModelProvider = {\n    id: builtinProviderId(settings),\n    label: builtinProviderLabel(settings),\n    kind: \"api-key\",\n    api: \"responses\",\n    wireProfile: settings.openaiProvider === \"azure\" ? \"azure-openai\" : \"openai\",\n    builtin: true,\n    credentialSource,\n    billing: { upstreamPayer: \"deployment\", metering: \"opengeni_credits\" },\n  };\n  if (settings.openaiProvider === \"azure\") {\n    const baseUrl = settings.azureOpenaiBaseUrl ?? settings.azureOpenaiEndpoint;\n    builtin.baseUrl = baseUrl ? normalizeRegistryBaseUrl(baseUrl, builtin.id) : undefined;\n    builtin.apiKey =\n      usableDeploymentSecret(settings.azureOpenaiApiKey) ?? settings.azureOpenaiAdToken;\n  } else {\n    builtin.baseUrl = settings.openaiBaseUrl\n      ? normalizeRegistryBaseUrl(settings.openaiBaseUrl, builtin.id)\n      : undefined;\n    builtin.apiKey = usableDeploymentSecret(settings.openaiApiKey);\n  }\n  const registry = configuredRegistryProviders(settings).map(\n    (provider): ResolvedModelProvider => ({\n      id: provider.id,\n      label: provider.label ?? provider.id,\n      kind: provider.kind,\n      api: provider.api,\n      anthropic: provider.anthropic,\n      wireProfile: provider.wireProfile,\n      builtin: false,\n      baseUrl: provider.baseUrl,\n      apiKey: resolveProviderApiKey(provider, source),\n      defaultQuery: provider.defaultQuery,\n      defaultHeaders: provider.defaultHeaders,\n      publicDefaultQueryNames: provider.publicDefaultQueryNames,\n      publicDefaultHeaderNames: provider.publicDefaultHeaderNames,\n      ...(provider.streamIdleTimeoutMs !== undefined\n        ? { streamIdleTimeoutMs: provider.streamIdleTimeoutMs }\n        : {}),\n      ...(provider.streamProgressTimeoutMs !== undefined\n        ? { streamProgressTimeoutMs: provider.streamProgressTimeoutMs }\n        : {}),\n      credentialSource: registryCredentialSource(provider),\n      billing: registryBilling(provider),\n    }),\n  );\n  return [builtin, ...registry];\n}\n\n/**\n * Pure catalog overlay for a workspace whose existing Codex connection seam\n * reports ready. This describes product/provider identity only; it does not\n * select, lease, refresh, or expose a concrete credential; those runtime\n * operations remain owned by the credential allocator.\n */\n/** Exact upstream slugs of the active Codex catalog (or the built-in fallback list). */\nexport function codexUpstreamModelSlugs(settings: Settings): string[] {\n  if (settings.resolvedCodexModelsJson === undefined) return [...CODEX_FALLBACK_MODEL_SLUGS];\n  return z\n    .array(CodexCatalogModelSchema)\n    .parse(JSON.parse(settings.resolvedCodexModelsJson))\n    .filter((model) => !model.retired)\n    .map((model) => model.upstreamModelId);\n}\n\nexport function withCodexCatalogProvider(settings: Settings): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  if (providers.some((provider) => provider.id === CODEX_PROVIDER_ID)) {\n    return settings;\n  }\n  const catalogModels =\n    settings.resolvedCodexModelsJson === undefined\n      ? undefined\n      : z\n          .array(CodexCatalogModelSchema)\n          .parse(JSON.parse(settings.resolvedCodexModelsJson))\n          .filter((model) => !model.retired)\n          .map(({ retired: _retired, ...model }) => model);\n  if (catalogModels?.length === 0) return settings;\n  const provider: RegistryProvider = {\n    kind: \"codex-subscription\",\n    id: CODEX_PROVIDER_ID,\n    label: \"Codex (ChatGPT subscription)\",\n    api: \"responses\",\n    wireProfile: \"openai\",\n    baseUrl: CODEX_PROVIDER_BASE_URL,\n    models:\n      catalogModels ??\n      CODEX_FALLBACK_MODEL_SLUGS.map((slug) => {\n        const capabilities = reviewedCodexCatalogCapabilities(slug, {\n          ...legacyModelCapabilities(settings, {\n            reasoningEffort: true,\n            hostedWebSearch: true,\n            vision: isReviewedGptVisionModel(slug),\n          }),\n          ...(builtinPromptCachingForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`)\n            ? {\n                promptCaching: builtinPromptCachingForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`)!,\n              }\n            : {}),\n          latencyModes: builtinLatencyModesForModel(`${CODEX_MODEL_ID_PREFIX}${slug}`),\n        });\n        return {\n          id: `${CODEX_MODEL_ID_PREFIX}${slug}`,\n          upstreamModelId: slug,\n          label: productLabelForModelId(slug),\n          ...(productShortLabelForModelId(slug)\n            ? { shortLabel: productShortLabelForModelId(slug)! }\n            : {}),\n          reasoningEffort: true,\n          // The ChatGPT/Codex Responses backend accepts the native web_search\n          // hosted tool (unlike hosted apply_patch/computer transports). Declaring\n          // this here makes provider resolution truthful; the worker still applies\n          // the durable session/turn policy gate before attaching it.\n          hostedWebSearch: true,\n          capabilities,\n          contextWindowTokens: CODEX_MODEL_CONTEXT_WINDOW_TOKENS,\n          effectiveContextWindowTokens: CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,\n          autoCompactTokenLimit: CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT,\n          toolOutputTruncationTokens: CODEX_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS,\n        };\n      }),\n  };\n  return {\n    ...settings,\n    modelProvidersJson: JSON.stringify([...providers, provider]),\n  };\n}\n\n/**\n * Static SuperGrok product catalogue, matching the Codex subscription seam.\n * The overlay never contains a concrete account id or bearer; selection and\n * per-turn credential freeze remain worker/DB responsibilities.\n */\nexport function withXaiSubscriptionCatalogProvider(settings: Settings): Settings {\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  if (providers.some((provider) => provider.id === XAI_SUBSCRIPTION_PROVIDER_ID)) {\n    return settings;\n  }\n  const provider: RegistryProvider = {\n    kind: \"xai-subscription\",\n    id: XAI_SUBSCRIPTION_PROVIDER_ID,\n    label: \"SuperGrok (xAI subscription)\",\n    api: \"responses\",\n    wireProfile: \"openai\",\n    baseUrl: XAI_SUBSCRIPTION_PROXY_BASE_URL,\n    models: XAI_SUBSCRIPTION_MODEL_SLUGS.map((slug) => {\n      const capabilities = legacyModelCapabilities(settings, {\n        reasoningEffort: true,\n        hostedWebSearch: true,\n        vision: true,\n      });\n      capabilities.reasoning.efforts = [\"low\", \"medium\", \"high\", \"xhigh\"];\n      capabilities.reasoning.defaultEffort = \"high\";\n      capabilities.latencyModes = [\n        { id: \"standard\", upstream: \"supported\", runnable: true },\n        { id: \"fast\", upstream: \"supported\", runnable: true },\n      ];\n      capabilities.hostedTools.xSearch = {\n        upstream: \"supported\",\n        runnable: true,\n      };\n      capabilities.hostedTools.imageGeneration = {\n        upstream: \"supported\",\n        runnable: true,\n      };\n      return {\n        id: `${XAI_SUBSCRIPTION_MODEL_ID_PREFIX}${slug}`,\n        upstreamModelId: slug,\n        label: productLabelForModelId(slug),\n        ...(productShortLabelForModelId(slug)\n          ? { shortLabel: productShortLabelForModelId(slug)! }\n          : {}),\n        reasoningEffort: true,\n        hostedWebSearch: true,\n        capabilities,\n        contextWindowTokens: XAI_SUBSCRIPTION_MODEL_CONTEXT_WINDOW_TOKENS,\n        effectiveContextWindowTokens: XAI_SUBSCRIPTION_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,\n        autoCompactTokenLimit: XAI_SUBSCRIPTION_MODEL_AUTO_COMPACT_TOKEN_LIMIT,\n        toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n      };\n    }),\n  };\n  return {\n    ...settings,\n    modelProvidersJson: JSON.stringify([...providers, provider]),\n  };\n}\n\n/**\n * The provider identity a model id resolves to, for workspace model-policy\n * evaluation — MUST agree with the real router (resolveTurnModel /\n * MultiProviderModelProvider) on every case:\n *   - `codex/<slug>` → the codex-subscription provider id, ALWAYS. With no\n *     active subscription the router fails loud (CodexSubscriptionUnavailableError),\n *     never the built-in — so attributing by prefix is exact even against BASE\n *     settings where the overlay provider is not injected.\n *   - a configured model id → its configuredModels providerId (registry or built-in).\n *   - anything else → the built-in id: an unknown id is the legacy\n *     resolveTurnModel-null fallback, which the built-in OpenAI/Azure client\n *     serves. A policy blocking the built-in must block this path too.\n */\nexport function policyProviderIdForModel(settings: Settings, modelId: string): string {\n  const canonicalModelId = canonicalizeConfiguredModelId(settings, modelId);\n  if (canonicalModelId.startsWith(CODEX_MODEL_ID_PREFIX)) {\n    return CODEX_PROVIDER_ID;\n  }\n  if (canonicalModelId.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX)) {\n    return XAI_SUBSCRIPTION_PROVIDER_ID;\n  }\n  if (canonicalModelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {\n    return WORKSPACE_GATEWAY_PROVIDER_ID;\n  }\n  if (canonicalModelId.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX)) {\n    return WORKSPACE_OPENROUTER_PROVIDER_ID;\n  }\n  if (canonicalModelId.startsWith(WORKSPACE_OPPER_MODEL_ID_PREFIX)) {\n    return WORKSPACE_OPPER_PROVIDER_ID;\n  }\n  const configured = configuredModels(settings).find((model) => model.id === canonicalModelId);\n  return configured?.providerId ?? builtinProviderId(settings);\n}\n\n/**\n * Provider ids whose models are never paid with Opengeni credits: connected\n * subscriptions and workspace/organization-owned API keys. A model id under\n * one of these prefixes is attributed to its own payer even against BASE\n * settings, where the per-workspace overlay that defines it is not injected.\n */\nconst NON_CREDIT_POLICY_PROVIDER_IDS = new Set<string>([\n  CODEX_PROVIDER_ID,\n  XAI_SUBSCRIPTION_PROVIDER_ID,\n  WORKSPACE_GATEWAY_PROVIDER_ID,\n  ORGANIZATION_GATEWAY_PROVIDER_ID,\n  WORKSPACE_OPENROUTER_PROVIDER_ID,\n  ORGANIZATION_OPENROUTER_PROVIDER_ID,\n  WORKSPACE_OPPER_PROVIDER_ID,\n  ORGANIZATION_OPPER_PROVIDER_ID,\n  ORGANIZATION_OPENAI_PROVIDER_ID,\n  ORGANIZATION_AZURE_OPENAI_PROVIDER_ID,\n  \"workspace-anthropic\",\n  \"organization-anthropic\",\n  \"workspace-claude-subscription\",\n  \"organization-claude-subscription\",\n]);\n\n/**\n * Whether a model id spends Opengeni credits, for the workspace model\n * policy's credit switch. MUST agree with the cost the worker bills\n * (`ConfiguredModel.cost === \"credits\"`):\n *   - a configured model → its own cost class;\n *   - `codex/…`, `xai…/`, and workspace/organization connection ids → never;\n *   - anything else → the legacy built-in fallback, which the deployment pays\n *     and bills in credits unless the cost policy marks that exact id free.\n *     Failing closed here keeps an unknown id from slipping past a workspace\n *     that turned credits off.\n */\nexport function policyChargesCreditsForModel(settings: Settings, modelId: string): boolean {\n  const canonicalModelId = canonicalizeConfiguredModelId(settings, modelId);\n  const configured = configuredModels(settings).find((model) => model.id === canonicalModelId);\n  if (configured) return configured.cost === \"credits\";\n  if (canonicalModelId.startsWith(CODEX_MODEL_ID_PREFIX)) return false;\n  if (canonicalModelId.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX)) return false;\n  const slash = canonicalModelId.indexOf(\"/\");\n  const providerPrefix = slash > 0 ? canonicalModelId.slice(0, slash) : \"\";\n  if (\n    NON_CREDIT_POLICY_PROVIDER_IDS.has(providerPrefix) ||\n    // Direct workspace OpenAI / Azure OpenAI keys (`workspace-openai-<id>/…`).\n    providerPrefix.startsWith(\"workspace-openai-\") ||\n    providerPrefix.startsWith(\"workspace-azure-openai-\")\n  ) {\n    return false;\n  }\n  return (\n    (parseModelCostPolicyJson(settings.modelCostPolicyJson)[canonicalModelId] ?? \"credits\") ===\n    \"credits\"\n  );\n}\n\nfunction resolvedExecutionLimits(\n  settings: Settings,\n  model: {\n    contextWindowTokens?: number | undefined;\n    effectiveContextWindowTokens?: number | undefined;\n    autoCompactTokenLimit?: number | undefined;\n    toolOutputTruncationTokens?: number | undefined;\n  },\n): ModelExecutionLimitsV1 {\n  return {\n    contextWindowTokens: model.contextWindowTokens ?? settings.contextWindowTokens,\n    effectiveContextWindowTokens:\n      model.effectiveContextWindowTokens ?? settings.contextEffectiveWindowTokens ?? null,\n    autoCompactTokenLimit:\n      model.autoCompactTokenLimit ?? settings.contextAutoCompactThresholdTokens ?? null,\n    toolOutputTruncationTokens:\n      model.toolOutputTruncationTokens ?? settings.modelToolOutputTruncationTokens ?? null,\n  };\n}\n\nfunction finalizeConfiguredModel(\n  settings: Settings,\n  provider: ResolvedModelProvider,\n  input: Omit<ConfiguredModel, \"schemaVersion\" | \"definitionVersion\" | \"executionLimits\" | \"cost\">,\n): ConfiguredModel {\n  const requestPolicy =\n    provider.kind === \"vercel-gateway-managed\" ||\n    provider.kind === \"vercel-gateway-workspace\" ||\n    provider.kind === \"vercel-gateway-organization\"\n      ? gatewayRequestPolicyForUpstreamModel(\n          input.upstreamModelId,\n          configuredGatewayCatalogModels(settings),\n        )\n      : undefined;\n  const modelWithoutVersion: Omit<ConfiguredModel, \"definitionVersion\"> = {\n    schemaVersion: 1,\n    ...input,\n    cost: configuredCostForModel(settings, input.id, input.credentialSource),\n    ...(requestPolicy ? { requestPolicy } : {}),\n    executionLimits: resolvedExecutionLimits(settings, input),\n  };\n  return {\n    ...modelWithoutVersion,\n    definitionVersion: definitionVersionFor(modelWithoutVersion, provider),\n  };\n}\n\nfunction assertUniqueModelIdentities(models: ConfiguredModel[]): void {\n  const canonicalOwners = new Map<string, string>();\n  for (const model of models) {\n    const previous = canonicalOwners.get(model.id);\n    if (previous !== undefined) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON model id ${JSON.stringify(model.id)} is declared by both ${previous} and ${model.providerId}`,\n      );\n    }\n    canonicalOwners.set(model.id, model.providerId);\n  }\n\n  const acceptedInputs = new Map(canonicalOwners);\n  for (const model of models) {\n    const ownAliases = new Set<string>();\n    for (const alias of model.aliases) {\n      if (ownAliases.has(alias)) {\n        throw new Error(\n          `OPENGENI_MODEL_PROVIDERS_JSON model ${JSON.stringify(model.id)} contains duplicate alias ${JSON.stringify(alias)}`,\n        );\n      }\n      ownAliases.add(alias);\n      const previous = acceptedInputs.get(alias);\n      if (previous !== undefined) {\n        throw new Error(\n          `OPENGENI_MODEL_PROVIDERS_JSON alias ${JSON.stringify(alias)} for model ${JSON.stringify(model.id)} collides with model/provider ${previous}`,\n        );\n      }\n      acceptedInputs.set(alias, model.id);\n    }\n  }\n}\n\n/**\n * Every model a client may use, the built-in provider's models first\n * (configuredAllowedModels-from-openai, mapped to \"responses\" with\n * hostedWebSearch/contextWindow/reasoningEffort from the flat settings), then\n * each registry provider's models (label→id, hostedWebSearch/reasoningEffort\n * default false). De-duplicated by id (first wins) so the default model stays\n * first and the built-in allow-list takes precedence over registry entries.\n */\nexport function configuredModels(\n  settings: Settings,\n  source: NodeJS.ProcessEnv = process.env,\n): ConfiguredModel[] {\n  const builtinId = builtinProviderId(settings);\n  const builtinLabel = builtinProviderLabel(settings);\n  const providers = configuredProviders(settings, source);\n  const providerById = new Map(providers.map((provider) => [provider.id, provider]));\n  const pricingSchedules = configuredModelPricingSchedules(settings);\n  // The built-in (OpenAI/Azure) provider must NEVER claim a registry-namespaced\n  // model id. The worker overwrites settings.openaiModel with the turn's model\n  // (apps/worker agent-turn runSettings) — including a `codex/<slug>` id, or a\n  // registry id like \"accounts/fireworks/models/glm-5p2\" — so without this\n  // filter the built-in allow-list would emit a `{ id, providerId: <azure> }`\n  // entry that, by the first-wins de-dup below, shadows the real registry /\n  // codex-subscription provider and ships the id to Azure as a deployment name\n  // (opaque DeploymentNotFound 404). A `<provider>/<model>`-namespaced id (it\n  // contains \"/\") that a registry actually owns is never a valid Azure/OpenAI\n  // deployment name, and a `codex/`-prefixed id never is either — exclude both\n  // from the built-in list. A BARE id a registry merely redeclares (e.g.\n  // \"gpt-5.6-sol\") is left in place so the built-in still wins it via the first-wins\n  // de-dup below (preserving the documented built-in-precedence contract). When\n  // a codex/ id has NO codex provider injected (no active subscription) it then\n  // resolves to nothing and getModel fails loud with\n  // CodexSubscriptionUnavailableError instead of mis-routing to Azure.\n  const parsedRegistry = configuredRegistryProviders(settings);\n  const registryOwnedIds = new Set(\n    parsedRegistry.flatMap((provider) => provider.models.map((model) => model.id)),\n  );\n  const registryAliases = new Set(\n    parsedRegistry.flatMap((provider) => provider.models.flatMap((model) => model.aliases ?? [])),\n  );\n  const isRegistryNamespaced = (id: string): boolean =>\n    id.startsWith(CODEX_MODEL_ID_PREFIX) ||\n    id.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX) ||\n    registryAliases.has(id) ||\n    (id.includes(\"/\") && registryOwnedIds.has(id));\n  const builtinProvider = providerById.get(builtinId);\n  if (!builtinProvider) {\n    throw new Error(`Built-in model provider ${builtinId} is not configured`);\n  }\n  const out: ConfiguredModel[] = uniqueValues([\n    settings.openaiModel,\n    ...splitCsv(settings.openaiAllowedModels),\n  ])\n    .filter((id) => !isRegistryNamespaced(id))\n    .map((id) => {\n      const capabilities = {\n        ...legacyModelCapabilities(settings, {\n          reasoningEffort: true,\n          hostedWebSearch: settings.webSearchEnabled,\n          hostedImageGeneration: builtinHostedImageGenerationForModel(settings, id),\n          vision: isReviewedGptVisionModel(id),\n        }),\n        ...(builtinPromptCachingForModel(id)\n          ? { promptCaching: builtinPromptCachingForModel(id)! }\n          : {}),\n        latencyModes: builtinLatencyModesForModel(id),\n      };\n      return finalizeConfiguredModel(settings, builtinProvider, {\n        id,\n        aliases: [],\n        label: productLabelForModelId(id),\n        ...(productShortLabelForModelId(id)\n          ? { shortLabel: productShortLabelForModelId(id)! }\n          : {}),\n        providerId: builtinId,\n        providerLabel: builtinLabel,\n        api: \"responses\" as const,\n        upstreamModelId: id,\n        deployment: { upstreamModelId: id, wireApi: \"responses\" },\n        credentialSource: builtinProvider.credentialSource,\n        billing: builtinProvider.billing,\n        capabilities,\n        ...(pricingSchedules[id] === undefined ? {} : { pricing: pricingSchedules[id] }),\n        ...builtinContextLimitsForModel(settings, id),\n        toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,\n        reasoningEffort: capabilities.reasoning.runnable,\n        hostedWebSearch: capabilities.hostedTools.webSearch.runnable,\n      });\n    });\n  for (const provider of parsedRegistry) {\n    const providerLabel = provider.label ?? provider.id;\n    const resolvedProvider = providerById.get(provider.id);\n    if (!resolvedProvider) {\n      throw new Error(`Registry model provider ${provider.id} is not configured`);\n    }\n    for (const model of provider.models) {\n      const capabilities = model.capabilities\n        ? normalizeCapabilities(model.capabilities)\n        : legacyModelCapabilities(settings, {\n            reasoningEffort: model.reasoningEffort ?? false,\n            hostedWebSearch: model.hostedWebSearch ?? false,\n          });\n      const upstreamModelId = model.upstreamModelId ?? model.id;\n      out.push(\n        finalizeConfiguredModel(settings, resolvedProvider, {\n          id: model.id,\n          aliases: [...(model.aliases ?? [])],\n          label: model.label ?? productLabelForModelId(model.id),\n          ...(model.logoUrl ? { logoUrl: model.logoUrl } : {}),\n          ...(model.shortLabel\n            ? { shortLabel: model.shortLabel }\n            : productShortLabelForModelId(model.id)\n              ? { shortLabel: productShortLabelForModelId(model.id)! }\n              : {}),\n          providerId: provider.id,\n          providerLabel,\n          api: provider.api,\n          upstreamModelId,\n          deployment: { upstreamModelId, wireApi: provider.api },\n          credentialSource: resolvedProvider.credentialSource,\n          billing: resolvedProvider.billing,\n          capabilities,\n          ...(pricingSchedules[model.id] === undefined\n            ? {}\n            : { pricing: pricingSchedules[model.id] }),\n          ...(model.contextWindowTokens === undefined\n            ? {}\n            : { contextWindowTokens: model.contextWindowTokens }),\n          ...(model.effectiveContextWindowTokens === undefined\n            ? {}\n            : {\n                effectiveContextWindowTokens: model.effectiveContextWindowTokens,\n              }),\n          ...(model.autoCompactTokenLimit === undefined\n            ? {}\n            : { autoCompactTokenLimit: model.autoCompactTokenLimit }),\n          ...(model.toolOutputTruncationTokens === undefined\n            ? {}\n            : { toolOutputTruncationTokens: model.toolOutputTruncationTokens }),\n          reasoningEffort: capabilities.reasoning.runnable,\n          hostedWebSearch: capabilities.hostedTools.webSearch.runnable,\n        }),\n      );\n    }\n  }\n  assertUniqueModelIdentities(out);\n  const defaultIndex = out.findIndex(\n    (model) => model.id === settings.openaiModel || model.aliases.includes(settings.openaiModel),\n  );\n  return defaultIndex > 0\n    ? [out[defaultIndex]!, ...out.slice(0, defaultIndex), ...out.slice(defaultIndex + 1)]\n    : out;\n}\n\n/** Resolve a known canonical id or alias. Unknown strings are returned unchanged. */\nexport function canonicalizeConfiguredModelId(settings: Settings, modelId: string): string {\n  const models = configuredModels(settings);\n  const canonical = models.find((model) => model.id === modelId);\n  if (canonical) {\n    return canonical.id;\n  }\n  return models.find((model) => model.aliases.includes(modelId))?.id ?? modelId;\n}\n\n/**\n * Allowed model ids in selection order. Reimplemented on top of\n * configuredModels so it is the union of the built-in allow-list and every\n * registry provider's ids, de-duplicated. INVARIANT (existing callers + tests\n * depend on it): settings.openaiModel is always first, then the rest of the\n * openai allow-list, then registry ids.\n */\nexport function configuredAllowedModels(settings: Settings): string[] {\n  return configuredModels(settings)\n    .filter((model) => isModelAvailableForNewSelection(settings, model.id))\n    .map((model) => model.id);\n}\n\n/** Retirement is selection metadata, never provider authority or executable identity. */\nexport function isModelAvailableForNewSelection(settings: Settings, modelId: string): boolean {\n  if (!modelId.startsWith(CODEX_MODEL_ID_PREFIX) || settings.resolvedCodexModelsJson === undefined)\n    return true;\n  const models = z\n    .array(CodexCatalogModelSchema)\n    .parse(JSON.parse(settings.resolvedCodexModelsJson));\n  return models.some((model) => model.id === modelId && !model.retired);\n}\n\n/** Called only with the durable policy installed for a claimed accepted attempt. */\nexport function settingsForAcceptedSubscriptionTurn(\n  settings: Settings,\n  policy: TurnExecutionPolicyV1,\n  expected: {\n    modelId: string;\n    reasoningEffort: Settings[\"openaiReasoningEffort\"];\n    latencyMode?: LatencyMode;\n  },\n): Settings {\n  const parsed = TurnExecutionPolicyV1.parse(policy);\n  if (!parsed.productModelId.startsWith(CODEX_MODEL_ID_PREFIX)) return settings;\n  if (!settings.codexSubscriptionEnabled) throw new Error(\"Codex subscription is disabled\");\n  const models =\n    settings.resolvedCodexModelsJson === undefined\n      ? []\n      : z.array(CodexCatalogModelSchema).parse(JSON.parse(settings.resolvedCodexModelsJson));\n  const retained = models.find((model) => model.id === parsed.productModelId && model.retired);\n  if (!retained) {\n    assertTurnExecutionPolicyMatchesConfigV1(settings, parsed, expected);\n    return settings;\n  }\n  const { retired: _retired, ...model } = retained;\n  // Use the existing fixed broker transport. Only this exact definition is added;\n  // selection metadata remains retired in the original catalog JSON.\n  const withoutCodex = {\n    ...settings,\n    modelProvidersJson: JSON.stringify(\n      parseModelProvidersJson(settings.modelProvidersJson).filter(\n        (provider) => provider.id !== CODEX_PROVIDER_ID,\n      ),\n    ),\n  };\n  const providerSettings = withCodexCatalogProvider({\n    ...withoutCodex,\n    resolvedCodexModelsJson: JSON.stringify([model]),\n  });\n  const retainedProvider = parseModelProvidersJson(providerSettings.modelProvidersJson).find(\n    (provider) => provider.id === CODEX_PROVIDER_ID,\n  )!;\n  const providers = parseModelProvidersJson(settings.modelProvidersJson);\n  const current = providers.find((provider) => provider.id === CODEX_PROVIDER_ID);\n  const restored = {\n    ...settings,\n    modelProvidersJson: JSON.stringify([\n      ...providers.filter((provider) => provider.id !== CODEX_PROVIDER_ID),\n      {\n        ...retainedProvider,\n        models: [\n          ...(current?.models ?? []).filter((candidate) => candidate.id !== model.id),\n          model,\n        ],\n      },\n    ]),\n  };\n  assertTurnExecutionPolicyMatchesConfigV1(restored, parsed, expected);\n  return restored;\n}\n\n/**\n * Resolve a model string to the provider that serves it and its configured\n * shape. Returns undefined when the id is not exposed (built-in allow-list nor\n * any registry provider), so the runtime can fall back to the legacy global\n * client path.\n */\nexport function resolveModelProvider(\n  settings: Settings,\n  modelId: string,\n): { provider: ResolvedModelProvider; model: ConfiguredModel } | undefined {\n  const canonicalModelId = canonicalizeConfiguredModelId(settings, modelId);\n  const model = configuredModels(settings).find((candidate) => candidate.id === canonicalModelId);\n  if (!model) {\n    return undefined;\n  }\n  const provider = configuredProviders(settings).find(\n    (candidate) => candidate.id === model.providerId,\n  );\n  if (!provider) {\n    return undefined;\n  }\n  return { provider, model };\n}\n\nexport type ResolveTurnExecutionPolicyV1Input = {\n  /** Effective persisted turn model. Aliases are accepted and canonicalized. */\n  modelId: string;\n  /** Exact caller-supplied input before canonicalization, only for explicit switches. */\n  requestedModelId: string | null;\n  modelSource: TurnExecutionModelSourceV1;\n  reasoningEffort: Settings[\"openaiReasoningEffort\"];\n  reasoningSource: TurnExecutionReasoningSourceV1;\n  latencyMode?: LatencyMode;\n  latencyModeSource?: TurnExecutionLatencyModeSourceV1;\n};\n\nfunction settingsForTurnExecutionPolicy(settings: Settings, modelId: string): Settings {\n  if (settings.codexSubscriptionEnabled && modelId.startsWith(CODEX_MODEL_ID_PREFIX)) {\n    return withCodexCatalogProvider(settings);\n  }\n  if (\n    settings.supergrokSubscriptionEnabled &&\n    modelId.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX)\n  ) {\n    return withXaiSubscriptionCatalogProvider(settings);\n  }\n  if (modelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {\n    // API/worker workspace boundaries may already have overlaid durable custom\n    // rows and, at execution time, the decrypted workspace key. Re-applying an\n    // empty static overlay would silently discard both. Only synthesize the\n    // curated fallback when this exact model is not already executable.\n    if (resolveModelProvider(settings, modelId)) {\n      return settings;\n    }\n    return withWorkspaceGatewayCatalogProvider(settings);\n  }\n  if (modelId.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX)) {\n    if (resolveModelProvider(settings, modelId)) {\n      return settings;\n    }\n    return withWorkspaceOpenRouterCatalogProvider(settings);\n  }\n  if (modelId.startsWith(ORGANIZATION_GATEWAY_MODEL_ID_PREFIX)) {\n    return resolveModelProvider(settings, modelId)\n      ? settings\n      : withOrganizationGatewayCatalogProvider(settings);\n  }\n  if (modelId.startsWith(ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX)) {\n    return resolveModelProvider(settings, modelId)\n      ? settings\n      : withOrganizationOpenRouterCatalogProvider(settings);\n  }\n  if (modelId.startsWith(WORKSPACE_OPPER_MODEL_ID_PREFIX)) {\n    return resolveModelProvider(settings, modelId)\n      ? settings\n      : withWorkspaceOpperCatalogProvider(settings);\n  }\n  if (modelId.startsWith(ORGANIZATION_OPPER_MODEL_ID_PREFIX)) {\n    return resolveModelProvider(settings, modelId)\n      ? settings\n      : withOrganizationOpperCatalogProvider(settings);\n  }\n  // Organization OpenAI and Azure OpenAI have no secret-free fallback: each\n  // provider exists only with the organization's own curated models, which\n  // the workspace boundary overlays. Without them the model stays unresolved.\n  return settings;\n}\n\n/**\n * Resolve the static catalog identity used by an accepted turn. Subscription\n * overlays contain no account or bearer and do not prove connection readiness;\n * callers must keep their live credential/readiness gate authoritative.\n */\nexport function resolveModelProviderForTurn(\n  settings: Settings,\n  modelId: string,\n): ReturnType<typeof resolveModelProvider> {\n  const catalogSettings = settingsForTurnExecutionPolicy(settings, modelId);\n  return resolveModelProvider(\n    catalogSettings,\n    canonicalizeConfiguredModelId(catalogSettings, modelId),\n  );\n}\n\n/**\n * The requested model cannot start new work: it is retired from new selection\n * or absent from the configured catalog. Callers that own a durable refusal\n * (for example a scheduled occurrence) record it instead of failing blindly.\n */\nexport class TurnExecutionPolicyModelUnavailableError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"TurnExecutionPolicyModelUnavailableError\";\n  }\n}\n\n/**\n * Build a trusted, secret-safe execution policy from the normalized catalog.\n * The Codex overlay here contains static product/provider identity only; it\n * neither proves readiness nor chooses, decrypts, leases, or exposes an account.\n */\nexport function resolveTurnExecutionPolicyV1(\n  settings: Settings,\n  input: ResolveTurnExecutionPolicyV1Input,\n): TurnExecutionPolicyV1 {\n  const catalogSettings = settingsForTurnExecutionPolicy(settings, input.modelId);\n  const productModelId = canonicalizeConfiguredModelId(catalogSettings, input.modelId);\n  if (!isModelAvailableForNewSelection(catalogSettings, productModelId)) {\n    throw new TurnExecutionPolicyModelUnavailableError(\n      \"Turn execution policy model is retired from new selection\",\n    );\n  }\n  const resolved = resolveModelProvider(catalogSettings, productModelId);\n  if (!resolved) {\n    throw new TurnExecutionPolicyModelUnavailableError(\n      \"Turn execution policy model is not present in the configured catalog\",\n    );\n  }\n  if (\n    input.requestedModelId !== null &&\n    canonicalizeConfiguredModelId(catalogSettings, input.requestedModelId) !== productModelId\n  ) {\n    throw new Error(\"Turn execution policy requested model does not canonicalize to its product\");\n  }\n  const latencyMode = LatencyMode.parse(input.latencyMode ?? \"standard\");\n  const latencyModeSource = input.latencyModeSource ?? \"deployment\";\n  assertLatencyModeRunnable(catalogSettings, productModelId, latencyMode);\n  return TurnExecutionPolicyV1.parse({\n    schemaVersion: 1,\n    productModelId,\n    requestedModelId: input.requestedModelId,\n    modelSource: input.modelSource,\n    reasoningEffort: input.reasoningEffort,\n    reasoningSource: input.reasoningSource,\n    latencyMode,\n    latencyModeSource,\n    providerId: resolved.provider.id,\n    upstreamModelId: resolved.model.upstreamModelId,\n    wireApi: resolved.model.api,\n    credentialSource: resolved.model.credentialSource,\n    billing: resolved.model.billing,\n    definitionVersion: resolved.model.definitionVersion,\n  });\n}\n\n/** Explicit accepted execution identity matches, but its definition digest differs. */\nexport class TurnExecutionPolicyDefinitionMismatchError extends Error {\n  readonly code = \"turn_execution_policy_definition_mismatch\";\n\n  constructor() {\n    super(\"Turn execution policy does not match the current provider definition\");\n    this.name = \"TurnExecutionPolicyDefinitionMismatchError\";\n  }\n}\n\n/**\n * Parse-time validation lives in @opengeni/contracts; this verifier binds a\n * serving snapshot to its executable definition and mapped reasoning. This\n * does not activate placement or replace the immutable accepted-turn policy.\n */\nexport function assertTurnServingPolicyMatchesConfigV1(\n  settings: Settings,\n  revision: TurnServingPolicyV1,\n  acceptedPolicy: TurnExecutionPolicyV1,\n): ReturnType<typeof assertTurnExecutionPolicyMatchesConfigV1> {\n  if (!settings.subscriptionCrossProviderFailoverEnabled)\n    throw new Error(\"Subscription model failover is disabled\");\n  if (TurnExecutionPolicyV1.parse(acceptedPolicy).credentialRestriction !== undefined) {\n    throw new Error(\"Restricted accepted policies cannot switch\");\n  }\n  const { policy } = TurnServingPolicyV1.parse(revision);\n  // Verify the SERVING definition and mapped level, never compare with the\n  // accepted model or mutate that immutable admission/authority snapshot.\n  return assertTurnExecutionPolicyMatchesConfigV1(settings, policy, {\n    modelId: policy.productModelId,\n    reasoningEffort: policy.reasoningEffort,\n    latencyMode: policy.latencyMode,\n  });\n}\n\n/** Bind an accepted snapshot to the current definition and exact turn row.\n * Non-additive executable drift fails before a provider or compaction call.\n */\nexport function assertTurnExecutionPolicyMatchesConfigV1(\n  settings: Settings,\n  policy: TurnExecutionPolicyV1,\n  expected: {\n    modelId: string;\n    reasoningEffort: Settings[\"openaiReasoningEffort\"];\n    latencyMode?: LatencyMode;\n  },\n): {\n  policy: TurnExecutionPolicyV1;\n  provider: ResolvedModelProvider;\n  model: ConfiguredModel;\n} {\n  const parsed = TurnExecutionPolicyV1.parse(policy);\n  const catalogSettings = settingsForTurnExecutionPolicy(settings, parsed.productModelId);\n  const canonicalExpectedModel = canonicalizeConfiguredModelId(catalogSettings, expected.modelId);\n  const expectedLatencyMode = expected.latencyMode ?? parsed.latencyMode;\n  if (\n    parsed.productModelId !== canonicalExpectedModel ||\n    parsed.reasoningEffort !== expected.reasoningEffort ||\n    parsed.latencyMode !== expectedLatencyMode\n  ) {\n    throw new Error(\n      \"Turn execution policy does not match the accepted turn model/reasoning/latency\",\n    );\n  }\n  assertLatencyModeRunnable(catalogSettings, parsed.productModelId, parsed.latencyMode);\n  if (\n    parsed.requestedModelId !== null &&\n    canonicalizeConfiguredModelId(catalogSettings, parsed.requestedModelId) !==\n      parsed.productModelId\n  ) {\n    throw new Error(\"Turn execution policy requested model does not match its product model\");\n  }\n  const resolved = resolveModelProvider(catalogSettings, parsed.productModelId);\n  if (!resolved) {\n    throw new Error(\"Turn execution policy model is no longer configured\");\n  }\n  // The individual-account cutover corrects subscription accounting labels.\n  // Preserve an already accepted legacy policy only if its complete original\n  // executable digest matches; this exception cannot compose with other drift.\n  const legacyClaudeScope =\n    resolved.provider.kind === \"claude-subscription-workspace\"\n      ? \"workspace\"\n      : resolved.provider.kind === \"claude-subscription-organization\"\n        ? \"organization\"\n        : null;\n  const legacyClaudeAccountingMatches =\n    legacyClaudeScope !== null &&\n    parsed.providerId === resolved.provider.id &&\n    parsed.upstreamModelId === resolved.model.upstreamModelId &&\n    parsed.wireApi === resolved.model.api &&\n    canonicalJson(parsed.credentialSource) ===\n      canonicalJson({\n        kind: `${legacyClaudeScope}_connection`,\n        mechanism: \"api_key\",\n      }) &&\n    canonicalJson(parsed.billing) ===\n      canonicalJson({\n        upstreamPayer: legacyClaudeScope,\n        metering: \"external\",\n      }) &&\n    parsed.definitionVersion ===\n      definitionVersionFor(\n        {\n          ...resolved.model,\n          credentialSource: parsed.credentialSource,\n          billing: parsed.billing,\n        },\n        resolved.provider,\n        { includeAutoCompactTokenLimit: true },\n      );\n  // wireProfile was added to the definition digest after policies already\n  // existed in durable in-flight turns. An omitted profile meant exactly\n  // \"openai\", so accept that one legacy digest only; Azure and every other\n  // executable-definition change remain fail-closed. A model whose structured\n  // output was enabled after acceptance is also checked in its one\n  // pre-enablement form.\n  const structuredOutputHistorical = structuredOutputPreEnablementModel(\n    resolved.model,\n    resolved.provider,\n  );\n  const definitionVersionMatches =\n    acceptedDefinitionVersionMatches(resolved.model, resolved.provider, parsed) ||\n    (structuredOutputHistorical !== null &&\n      acceptedDefinitionVersionMatches(structuredOutputHistorical, resolved.provider, parsed));\n  const identityMismatched =\n    parsed.providerId !== resolved.provider.id ||\n    parsed.upstreamModelId !== resolved.model.upstreamModelId ||\n    parsed.wireApi !== resolved.model.api ||\n    canonicalJson(parsed.credentialSource) !== canonicalJson(resolved.model.credentialSource) ||\n    canonicalJson(parsed.billing) !== canonicalJson(resolved.model.billing);\n  // Identity/source changes must never enter a rollout-retry classification,\n  // even when their definition digest also differs.\n  if (identityMismatched && !legacyClaudeAccountingMatches) {\n    throw new Error(\"Turn execution policy does not match the current provider definition\");\n  }\n  if (!definitionVersionMatches && !legacyClaudeAccountingMatches) {\n    throw new TurnExecutionPolicyDefinitionMismatchError();\n  }\n  return {\n    policy: parsed,\n    provider: resolved.provider,\n    model: configuredModelForAcceptedTurnExecutionPolicy(resolved.model, resolved.provider, parsed),\n  };\n}\n\n/**\n * Effective per-model pricing schedules. Merge order (later wins): built-in\n * flat defaults → registry model flat/scheduled pricing → explicit\n * OPENGENI_MODEL_PRICING_JSON. Explicit entries may be legacy flat prices or a\n * complete schedule, and always replace the lower-precedence schedule.\n */\nexport function configuredModelPricingSchedules(\n  settings: Settings,\n): Record<string, ModelPricingScheduleV1> {\n  const defaults = Object.fromEntries(\n    Object.entries(defaultModelPricing).map(([model, pricing]) => [\n      model,\n      normalizeModelPricingSchedule(pricing),\n    ]),\n  );\n  const registry: Record<string, ModelPricingScheduleV1> = {};\n  for (const provider of configuredRegistryProviders(settings)) {\n    for (const model of provider.models) {\n      if (model.pricing) {\n        registry[model.id] = normalizeModelPricingSchedule(model.pricing);\n      }\n    }\n  }\n  const configured = Object.fromEntries(\n    Object.entries(parseModelPricingJson(settings.modelPricingJson)).map(([model, pricing]) => [\n      model,\n      normalizeModelPricingSchedule(pricing),\n    ]),\n  );\n  return {\n    ...defaults,\n    ...registry,\n    ...configured,\n  };\n}\n\n/**\n * Insights list-price metadata, including reviewed namespaced provider routes.\n * Kept separate from debit/catalog pricing: adding a comparison must not change\n * an accepted turn's frozen execution-definition hash or payer classification.\n * Inline registry and explicit product-ID prices always win over projections.\n */\nexport function configuredModelListPricingSchedules(\n  settings: Settings,\n): Record<string, ModelPricingScheduleV1> {\n  const prices = configuredModelPricingSchedules(settings);\n  const configured = Object.fromEntries(\n    Object.entries(parseModelPricingJson(settings.modelPricingJson)).map(([model, pricing]) => [\n      model,\n      normalizeModelPricingSchedule(pricing),\n    ]),\n  );\n  // Bare new IDs need the actual configured public OpenAI route, not merely a\n  // familiar model name. Azure/custom endpoints do not inherit these API rates.\n  if (\n    settings.openaiProvider === \"openai\" &&\n    isDirectOpenAiApiBaseUrl(settings.openaiBaseUrl ?? \"https://api.openai.com/v1\")\n  ) {\n    for (const model of configuredModels(settings)) {\n      if (\n        model.providerId !== builtinProviderId(settings) ||\n        !model.upstreamModelId.startsWith(\"gpt-\") ||\n        prices[model.id] !== undefined\n      )\n        continue;\n      const reviewed = reviewedModelListPricing[model.upstreamModelId];\n      if (reviewed) prices[model.id] = reviewed;\n    }\n  }\n  for (const provider of configuredRegistryProviders(settings)) {\n    for (const model of provider.models) {\n      if (prices[model.id] !== undefined) continue;\n      const reviewed = reviewedProviderModelPricing(settings, provider, model, configured);\n      if (reviewed) prices[model.id] = reviewed;\n    }\n  }\n  return prices;\n}\n\n/**\n * A reviewed upstream list rate may also describe a namespaced product route.\n * Never infer a rate by stripping arbitrary prefixes, matching labels, or\n * treating every OpenAI-compatible endpoint as the original provider.\n * This is pricing metadata only: credential selection and payer/metering are\n * still derived exclusively from the accepted execution policy.\n */\nfunction reviewedProviderModelPricing(\n  settings: Settings,\n  provider: InternalRegistryProvider,\n  model: RegistryProvider[\"models\"][number],\n  configured: Record<string, ModelPricingScheduleV1>,\n): ModelPricingScheduleV1 | undefined {\n  const upstream = model.upstreamModelId ?? model.id;\n  let priceId: string | undefined;\n  let nativeClaude = false;\n  switch (provider.kind) {\n    case \"anonymous\":\n      if (\n        provider.baseUrl.replace(/\\/$/u, \"\") === OPENROUTER_BASE_URL &&\n        upstream === DEFAULT_OPENROUTER_MODEL_ID.slice(OPENROUTER_MODEL_ID_PREFIX.length)\n      ) {\n        priceId = DEFAULT_OPENROUTER_MODEL_ID;\n      }\n      break;\n    case \"codex-subscription\":\n      if (upstream.startsWith(\"gpt-\")) priceId = upstream;\n      break;\n    case \"xai-subscription\":\n      if (upstream.startsWith(\"grok-\")) priceId = upstream;\n      break;\n    case \"anthropic-workspace\":\n    case \"anthropic-organization\":\n    case \"claude-subscription-workspace\":\n    case \"claude-subscription-organization\":\n      if (claudeNativeModelProfile(upstream)) {\n        priceId = upstream;\n        nativeClaude = true;\n      }\n      break;\n    case \"direct-openai-workspace\":\n    case \"direct-openai-organization\":\n      if (isDirectOpenAiApiBaseUrl(provider.baseUrl) && upstream.startsWith(\"gpt-\")) {\n        priceId = upstream;\n      }\n      break;\n    case \"vercel-gateway-managed\":\n    case \"vercel-gateway-workspace\":\n    case \"vercel-gateway-organization\":\n      // Only curated, provider-pinned routes use the conservative fallback.\n      // Arbitrary Gateway custom models still require exact reported cost or\n      // an explicit operator rate, even if their slugs resemble a known model.\n      priceId = configuredGatewayCatalogModels(settings).find(\n        (candidate) =>\n          candidate.upstreamModelId === upstream &&\n          Object.values(OPENGENI_GATEWAY_MODELS).some(\n            (reviewed) => reviewed.upstreamModelId === candidate.upstreamModelId,\n          ),\n      )?.productId;\n      break;\n    case \"openrouter-workspace\":\n    case \"openrouter-organization\":\n    case \"openrouter-managed\":\n      if (upstream === DEFAULT_OPENROUTER_MODEL_ID.slice(OPENROUTER_MODEL_ID_PREFIX.length)) {\n        priceId = DEFAULT_OPENROUTER_MODEL_ID;\n      }\n      break;\n    case \"opper-managed\":\n    case \"opper-workspace\":\n    case \"opper-organization\": {\n      // Only reviewed, provider-pinned curated routes carry a static rate.\n      // Custom slugs and pools need an explicit operator rate.\n      if (!configuredOpperUpstreamModelIds(settings).includes(upstream)) return undefined;\n      return reviewedOpperModelPricing(upstream);\n    }\n    case \"api-key\":\n      // Explicit deployments of the official APIs may use their own product\n      // IDs. Custom gateways/proxies and Azure SKUs do not inherit API rates.\n      if (isDirectOpenAiApiBaseUrl(provider.baseUrl) && upstream.startsWith(\"gpt-\")) {\n        priceId = upstream;\n      } else if (provider.baseUrl.replace(/\\/$/u, \"\") === \"https://api.x.ai/v1\") {\n        if (upstream.startsWith(\"grok-\")) priceId = upstream;\n      } else if (\n        provider.api === \"anthropic-messages\" &&\n        provider.baseUrl.replace(/\\/$/u, \"\") === \"https://api.anthropic.com/v1\" &&\n        claudeNativeModelProfile(upstream)\n      ) {\n        priceId = upstream;\n        nativeClaude = true;\n      }\n      break;\n    default:\n      return undefined;\n  }\n  if (!priceId) return undefined;\n  // Explicit upstream overrides retain the existing Codex comparison behavior;\n  // a product-ID override or inline registry rate still has higher precedence.\n  if (configured[priceId]) return configured[priceId];\n  const schedule =\n    reviewedModelListPricing[priceId] ??\n    defaultModelPricing[priceId] ??\n    (priceId === DEFAULT_OPENROUTER_MODEL_ID ? reviewedFreeOpenRouterListPricing : undefined);\n  if (!schedule) return undefined;\n  if (!nativeClaude || provider.anthropic?.cacheTtl !== \"1h\") return schedule;\n  // Anthropic's 1-hour cache writes are 2x base input, rather than 5m's 1.25x.\n  const hourCacheWrite = (price: ModelPricing) => ({\n    ...price,\n    cacheWriteMicrosPerMillionTokens: price.inputMicrosPerMillionTokens * 2,\n  });\n  return {\n    ...schedule,\n    default: hourCacheWrite(schedule.default),\n    ...(schedule.inputTokenTiers\n      ? {\n          inputTokenTiers: schedule.inputTokenTiers.map((tier) => ({\n            ...tier,\n            pricing: hourCacheWrite(tier.pricing),\n          })),\n        }\n      : {}),\n  };\n}\n\n/** Legacy flat projection: returns the default/below-threshold price. */\nexport function configuredModelPricing(settings: Settings): Record<string, ModelPricing> {\n  return Object.fromEntries(\n    Object.entries(configuredModelPricingSchedules(settings)).map(([model, schedule]) => [\n      model,\n      schedule.default,\n    ]),\n  );\n}\n\n/** Select the per-provider-request price at an exact input-token threshold. */\nexport function selectModelPricing(\n  schedule: ModelPricingScheduleV1,\n  inputTokens: number,\n): ModelPricing {\n  const normalizedInputTokens = Math.max(0, Math.floor(inputTokens));\n  let selected = schedule.default;\n  for (const tier of schedule.inputTokenTiers ?? []) {\n    if (normalizedInputTokens < tier.minimumInputTokens) {\n      break;\n    }\n    selected = tier.pricing;\n  }\n  return selected;\n}\n\n/**\n * Usable input-token budget: an explicit model-catalog effective window when\n * available, otherwise the deployment window minus its output reserve.\n */\nexport function contextInputBudgetTokens(\n  settings: Pick<\n    Settings,\n    \"contextWindowTokens\" | \"contextEffectiveWindowTokens\" | \"contextReservedOutputTokens\"\n  >,\n): number {\n  if (settings.contextEffectiveWindowTokens !== undefined) {\n    return Math.min(settings.contextWindowTokens, settings.contextEffectiveWindowTokens);\n  }\n  return Math.max(0, settings.contextWindowTokens - settings.contextReservedOutputTokens);\n}\n\n/**\n * Apply the resolved provider/model's context policy to one turn. Registry\n * metadata is authoritative when present; deployment defaults remain the\n * fallback for models that do not declare their own limits.\n */\nexport function settingsWithResolvedModelContext(\n  settings: Settings,\n  model: Pick<\n    ConfiguredModel,\n    | \"contextWindowTokens\"\n    | \"effectiveContextWindowTokens\"\n    | \"autoCompactTokenLimit\"\n    | \"toolOutputTruncationTokens\"\n  > & { id?: string },\n  workspaceSettings?: unknown,\n  organizationDefaults?: Pick<OrganizationModelDefaults, \"modelCompactionThresholds\"> | null,\n): Settings {\n  const contextWindowTokens = model.contextWindowTokens ?? settings.contextWindowTokens;\n  const resolved = {\n    ...settings,\n    contextWindowTokens,\n    ...(model.effectiveContextWindowTokens === undefined\n      ? {}\n      : {\n          contextEffectiveWindowTokens: Math.min(\n            contextWindowTokens,\n            model.effectiveContextWindowTokens,\n          ),\n        }),\n    ...(model.autoCompactTokenLimit === undefined\n      ? {}\n      : { contextAutoCompactThresholdTokens: model.autoCompactTokenLimit }),\n    ...(model.toolOutputTruncationTokens === undefined\n      ? {}\n      : { modelToolOutputTruncationTokens: model.toolOutputTruncationTokens }),\n  };\n  if (workspaceSettings === undefined || !model.id) return resolved;\n  return {\n    ...resolved,\n    contextAutoCompactThresholdTokens: workspaceModelCompactionPolicy(\n      settings,\n      { ...model, id: model.id },\n      workspaceSettings,\n      organizationDefaults,\n    ).effectiveTokens,\n  };\n}\n\n/**\n * One policy projection for settings UI and all model-facing worker paths.\n * The workspace's own preference wins, then the organization's default for\n * the model, then the model's own default.\n */\nexport function workspaceModelCompactionPolicy(\n  settings: Settings,\n  model: Pick<\n    ConfiguredModel,\n    \"id\" | \"contextWindowTokens\" | \"effectiveContextWindowTokens\" | \"autoCompactTokenLimit\"\n  >,\n  workspaceSettings: unknown,\n  organizationDefaults?: Pick<OrganizationModelDefaults, \"modelCompactionThresholds\"> | null,\n): ModelCompactionPolicy {\n  const resolved = settingsWithResolvedModelContext(settings, model);\n  const maximumTokens = Math.max(\n    0,\n    Math.floor(Math.min(resolved.contextWindowTokens * 0.9, contextInputBudgetTokens(resolved))),\n  );\n  const minimumTokens = Math.min(16_000, maximumTokens);\n  // Preserve deployment defaults below the UI's custom minimum. A new\n  // preference must not silently raise an existing operator-set trigger.\n  const clamp = (value: number) => Math.max(0, Math.min(maximumTokens, Math.floor(value)));\n  const defaultTokens = clamp(\n    resolved.contextAutoCompactThresholdTokens ??\n      resolved.contextWindowTokens *\n        Math.max(0.3, Math.min(0.9, resolved.contextCompactionThresholdRatio)),\n  );\n  const overrideTokens = workspaceModelCompactionThreshold(workspaceSettings, model.id);\n  const organizationTokens = organizationModelCompactionThreshold(organizationDefaults, model.id);\n  return {\n    defaultTokens,\n    overrideTokens,\n    organizationTokens,\n    effectiveTokens: clamp(overrideTokens ?? organizationTokens ?? defaultTokens),\n    minimumTokens,\n    maximumTokens,\n  };\n}\n\nexport function configuredStaticUsageLimits(settings: Settings): StaticUsageLimitsConfig {\n  return parseStaticUsageLimitsJson(settings.staticUsageLimitsJson);\n}\n\nexport function configuredEntitlements(settings: Settings): EntitlementsConfig {\n  if (settings.entitlementsMode === \"none\") {\n    return {};\n  }\n  const configured = parseStaticEntitlementsJson(settings.staticEntitlementsJson);\n  if (settings.entitlementsMode === \"static\") {\n    return configured;\n  }\n  return {\n    \"managed.auth.email_password\": true,\n    \"managed.billing.prepaid_credits\": settings.billingMode === \"stripe\",\n    \"managed.api_keys\": true,\n    \"managed.workspaces\": true,\n    \"managed.github_app\": Boolean(settings.githubAppId && settings.githubAppPrivateKey),\n    ...configured,\n  };\n}\n\nexport function calculateModelUsageCostMicros(\n  settings: Settings,\n  model: string,\n  usage: ModelUsageInput,\n  options?: { latencyMode?: LatencyMode },\n): number {\n  return calculateModelUsageCostBreakdown(settings, model, usage, options).creditCostMicros;\n}\n\nexport function calculateModelUsageCostBreakdown(\n  settings: Settings,\n  model: string,\n  usage: ModelUsageInput,\n  options?: { latencyMode?: LatencyMode },\n): ModelUsageCostBreakdown {\n  const schedule = configuredModelPricingSchedules(settings)[model];\n  return calculateUsageCostBreakdown(settings, model, usage, schedule, options);\n}\n\n/** Provider-list/equivalent-credit comparison only; never debit authority. */\nexport function calculateModelListUsageCostBreakdown(\n  settings: Settings,\n  model: string,\n  usage: ModelUsageInput,\n  options?: { latencyMode?: LatencyMode },\n): ModelUsageCostBreakdown {\n  const schedule = configuredModelListPricingSchedules(settings)[model];\n  return calculateUsageCostBreakdown(settings, model, usage, schedule, options);\n}\n\n/**\n * Forward-only list comparison snapshot for the model-call fact writer.\n * Callers must establish request price provenance (including geography/service\n * tier) and retain per-request counters. Unknown counters/TTL/modifiers yield\n * no class split, not invented zeros. Historical facts must not use this helper.\n * Native Claude details preserve cache_write_tokens_5m and cache_write_tokens_1h.\n */\nexport function calculateModelListUsageCostSnapshot(\n  settings: Settings,\n  model: string,\n  usage: ModelUsageInput,\n  options?: { latencyMode?: LatencyMode; priceContextKnown?: boolean },\n): ModelListUsageCostSnapshot {\n  const schedule = configuredModelListPricingSchedules(settings)[model];\n  const fallback = calculateUsageCostBreakdown(settings, model, usage, schedule, options);\n  const unknown = { ...fallback, listByClassMicros: null, listByClassApprox: false };\n  if (!schedule || !options?.priceContextKnown) return unknown;\n  const entries = usage.requestUsageEntries?.length ? usage.requestUsageEntries : [usage];\n  const classes: ModelListCostClassesMicros = {\n    uncachedInput: 0,\n    cacheRead: 0,\n    cacheWrite: 0,\n    output: 0,\n  };\n  const rawCostByPricing = new Map<ModelPricing, number>();\n  const native = nativeClaudeListWriteContext(settings, model);\n  for (const entry of entries) {\n    if (!knownTokenCounter(entry.inputTokens) || !knownTokenCounter(entry.outputTokens))\n      return unknown;\n    const cached = knownDetailTokenCounter(entry, [\n      \"cached_tokens\",\n      \"cachedInputTokens\",\n      \"cached_input_tokens\",\n    ]);\n    const writes = knownDetailTokenCounter(entry, [\"cache_write_tokens\", \"cacheWriteTokens\"], true);\n    if (cached === undefined || writes === undefined || cached + writes > entry.inputTokens)\n      return unknown;\n    const pricing = selectModelPricing(schedule, entry.inputTokens);\n    if (cached > 0 && pricing.cachedInputMicrosPerMillionTokens === undefined) return unknown;\n    if (writes > 0 && pricing.cacheWriteMicrosPerMillionTokens === undefined) return unknown;\n    const costs: ModelListCostClassesMicros = {\n      uncachedInput: Math.ceil(\n        ((entry.inputTokens - cached - writes) * pricing.inputMicrosPerMillionTokens) / 1_000_000,\n      ),\n      cacheRead: Math.ceil((cached * (pricing.cachedInputMicrosPerMillionTokens ?? 0)) / 1_000_000),\n      cacheWrite: Math.ceil((writes * (pricing.cacheWriteMicrosPerMillionTokens ?? 0)) / 1_000_000),\n      output: Math.ceil((entry.outputTokens * pricing.outputMicrosPerMillionTokens) / 1_000_000),\n    };\n    if (native && writes > 0) {\n      const fiveMinute = knownDetailTokenCounter(entry, [\"cache_write_tokens_5m\"]);\n      const oneHour = knownDetailTokenCounter(entry, [\"cache_write_tokens_1h\"]);\n      if (fiveMinute === undefined || oneHour === undefined || fiveMinute + oneHour !== writes)\n        return unknown;\n      if (native.publishedRates) {\n        costs.cacheWrite =\n          Math.ceil((fiveMinute * native.publishedRates.fiveMinute) / 1_000_000) +\n          Math.ceil((oneHour * native.publishedRates.oneHour) / 1_000_000);\n      } else if (\n        !(\n          (native.declaredTtl === \"5m\" && oneHour === 0) ||\n          (native.declaredTtl === \"1h\" && fiveMinute === 0)\n        )\n      ) {\n        // A single explicit override cannot establish two different TTL prices.\n        return unknown;\n      }\n    }\n    const raw = sumListCostClasses(costs);\n    rawCostByPricing.set(pricing, (rawCostByPricing.get(pricing) ?? 0) + raw);\n    for (const key of MODEL_LIST_COST_CLASS_KEYS) classes[key] += costs[key];\n  }\n  let providerCostMicros = sumListCostClasses(classes);\n  let creditCostMicros = 0;\n  for (const [pricing, raw] of rawCostByPricing) {\n    const marginBps = effectiveCreditMarginBps(settings, pricing.marginBps);\n    creditCostMicros += Math.ceil((raw * (10_000 + marginBps)) / 10_000);\n  }\n  let listByClassApprox = false;\n  const latencyMode = options.latencyMode ?? \"standard\";\n  if (latencyMode !== \"standard\") {\n    const catalogSettings = settingsForTurnExecutionPolicy(settings, model);\n    const resolved = resolveModelProvider(\n      catalogSettings,\n      canonicalizeConfiguredModelId(catalogSettings, model),\n    );\n    const multiplier = resolved?.model.capabilities.latencyModes.find(\n      (mode) => mode.id === latencyMode && mode.runnable,\n    )?.billingMultiplierBps;\n    if (multiplier === undefined || multiplier <= 0) return unknown;\n    providerCostMicros = Math.ceil((providerCostMicros * multiplier) / 10_000);\n    creditCostMicros = Math.ceil((creditCostMicros * multiplier) / 10_000);\n    const scaled = allocateLatencyListCostClasses(classes, multiplier, providerCostMicros);\n    if (!scaled) return unknown;\n    Object.assign(classes, scaled.classes);\n    listByClassApprox = scaled.approximate;\n  }\n  if (![providerCostMicros, creditCostMicros, ...Object.values(classes)].every(knownTokenCounter))\n    return unknown;\n  return { providerCostMicros, creditCostMicros, listByClassMicros: classes, listByClassApprox };\n}\n\n/**\n * Approximate class attribution of a previously recorded upstream list total.\n * Current reviewed rates are weights only: this never recomputes that total,\n * credits, or charges. Missing class counters/rates remain unknown. Historical\n * cache writes use the schedule's single TTL rate, not an exact TTL assertion.\n * Reasoning is already included in outputTokens and is never added again.\n */\nexport function allocateRecordedModelListCostByClass(\n  settings: Settings,\n  model: string,\n  usage: ModelUsageInput,\n  recordedProviderCostMicros: number | null | undefined,\n): ModelRecordedListCostAllocation {\n  const unknown: ModelRecordedListCostAllocation = {\n    listByClassMicros: null,\n    listByClassApprox: false,\n  };\n  if (!knownTokenCounter(recordedProviderCostMicros)) return unknown;\n  const schedule = configuredModelListPricingSchedules(settings)[model];\n  if (!schedule) return unknown;\n  const weights = { uncachedInput: 0n, cacheRead: 0n, cacheWrite: 0n, output: 0n };\n  const entries = usage.requestUsageEntries?.length ? usage.requestUsageEntries : [usage];\n  for (const entry of entries) {\n    if (!knownTokenCounter(entry.inputTokens) || !knownTokenCounter(entry.outputTokens))\n      return unknown;\n    const cached = knownDetailTokenCounter(entry, [\n      \"cached_tokens\",\n      \"cachedInputTokens\",\n      \"cached_input_tokens\",\n    ]);\n    const writes = knownDetailTokenCounter(entry, [\"cache_write_tokens\", \"cacheWriteTokens\"], true);\n    if (cached === undefined || writes === undefined || cached + writes > entry.inputTokens)\n      return unknown;\n    const pricing = selectModelPricing(schedule, entry.inputTokens);\n    const counters = {\n      uncachedInput: entry.inputTokens - cached - writes,\n      cacheRead: cached,\n      cacheWrite: writes,\n      output: entry.outputTokens,\n    };\n    const rates = {\n      uncachedInput: pricing.inputMicrosPerMillionTokens,\n      cacheRead: pricing.cachedInputMicrosPerMillionTokens,\n      cacheWrite: pricing.cacheWriteMicrosPerMillionTokens,\n      output: pricing.outputMicrosPerMillionTokens,\n    };\n    for (const key of MODEL_LIST_COST_CLASS_KEYS) {\n      if (counters[key] === 0) continue;\n      const rate = rates[key];\n      if (!knownTokenCounter(rate)) return unknown;\n      // Do not round or convert weights to Number: both can distort ratios.\n      weights[key] += BigInt(counters[key]) * BigInt(rate);\n    }\n  }\n  const classes = allocateRecordedListCostWeights(weights, recordedProviderCostMicros);\n  return classes ? { listByClassMicros: classes, listByClassApprox: true } : unknown;\n}\n\nconst MODEL_LIST_COST_CLASS_KEYS = [\"uncachedInput\", \"cacheRead\", \"cacheWrite\", \"output\"] as const;\n\nfunction sumListCostClasses(costs: ModelListCostClassesMicros): number {\n  return MODEL_LIST_COST_CLASS_KEYS.reduce((total, key) => total + costs[key], 0);\n}\n\n/** Integer-only largest remainder, preserving the supplied historical total. */\nfunction allocateRecordedListCostWeights(\n  weights: Record<(typeof MODEL_LIST_COST_CLASS_KEYS)[number], bigint>,\n  target: number,\n): ModelListCostClassesMicros | undefined {\n  const denominator = MODEL_LIST_COST_CLASS_KEYS.reduce((total, key) => total + weights[key], 0n);\n  if (denominator === 0n) {\n    return target === 0 ? { uncachedInput: 0, cacheRead: 0, cacheWrite: 0, output: 0 } : undefined;\n  }\n  const rows = MODEL_LIST_COST_CLASS_KEYS.map((key, index) => {\n    const numerator = BigInt(target) * weights[key];\n    return { key, index, value: numerator / denominator, remainder: numerator % denominator };\n  });\n  const remaining = BigInt(target) - rows.reduce((total, row) => total + row.value, 0n);\n  const ranked = [...rows].sort((a, b) =>\n    a.remainder === b.remainder ? a.index - b.index : a.remainder > b.remainder ? -1 : 1,\n  );\n  for (let index = 0; index < Number(remaining); index++) ranked[index]!.value += 1n;\n  return Object.fromEntries(\n    rows.map((row) => [row.key, Number(row.value)]),\n  ) as ModelListCostClassesMicros;\n}\n\nfunction knownTokenCounter(value: unknown): value is number {\n  return typeof value === \"number\" && Number.isSafeInteger(value) && value >= 0;\n}\n\nfunction knownDetailTokenCounter(\n  entry: ModelUsageInput,\n  keys: readonly string[],\n  firstOnly = false,\n): number | undefined {\n  const details = Array.isArray(entry.inputTokensDetails)\n    ? entry.inputTokensDetails\n    : entry.inputTokensDetails\n      ? [entry.inputTokensDetails]\n      : [];\n  if (details.length === 0) return undefined;\n  let total = 0;\n  for (const detail of details) {\n    const present = keys.filter((key) => detail[key] !== undefined);\n    if (present.length === 0) return undefined;\n    for (const key of firstOnly ? present.slice(0, 1) : present) {\n      if (!knownTokenCounter(detail[key])) return undefined;\n      total += detail[key]!;\n    }\n  }\n  return knownTokenCounter(total) ? total : undefined;\n}\n\nfunction nativeClaudeListWriteContext(\n  settings: Settings,\n  modelId: string,\n):\n  | {\n      declaredTtl: \"off\" | \"5m\" | \"1h\" | undefined;\n      publishedRates?: { fiveMinute: number; oneHour: number };\n    }\n  | undefined {\n  for (const provider of configuredRegistryProviders(settings)) {\n    const model = provider.models.find((candidate) => candidate.id === modelId);\n    if (!model || provider.api !== \"anthropic-messages\") continue;\n    const result = { declaredTtl: provider.anthropic?.cacheTtl };\n    const upstream = model.upstreamModelId ?? model.id;\n    const overrides = parseModelPricingJson(settings.modelPricingJson);\n    const official =\n      provider.kind === \"anthropic-workspace\" ||\n      provider.kind === \"anthropic-organization\" ||\n      provider.kind === \"claude-subscription-workspace\" ||\n      provider.kind === \"claude-subscription-organization\" ||\n      (provider.kind === \"api-key\" &&\n        provider.baseUrl.replace(/\\/$/u, \"\") === \"https://api.anthropic.com/v1\");\n    const published = reviewedModelListPricing[upstream]?.default;\n    if (\n      !official ||\n      !claudeNativeModelProfile(upstream) ||\n      !published?.cacheWriteMicrosPerMillionTokens ||\n      model.pricing ||\n      overrides[modelId] !== undefined ||\n      overrides[upstream] !== undefined\n    )\n      return result;\n    return {\n      ...result,\n      publishedRates: {\n        fiveMinute: published.cacheWriteMicrosPerMillionTokens,\n        oneHour: published.inputMicrosPerMillionTokens * 2,\n      },\n    };\n  }\n  return undefined;\n}\n\n/** Deterministic largest-remainder allocation; disclose any fractional scaling. */\nfunction allocateLatencyListCostClasses(\n  classes: ModelListCostClassesMicros,\n  multiplier: number,\n  target: number,\n): { classes: ModelListCostClassesMicros; approximate: boolean } | undefined {\n  if (\n    !knownTokenCounter(multiplier) ||\n    !knownTokenCounter(target) ||\n    !Object.values(classes).every(knownTokenCounter)\n  )\n    return undefined;\n  const rows = MODEL_LIST_COST_CLASS_KEYS.map((key, index) => {\n    const numerator = BigInt(classes[key]) * BigInt(multiplier);\n    return { key, index, value: Number(numerator / 10_000n), remainder: numerator % 10_000n };\n  });\n  const remaining = target - rows.reduce((total, row) => total + row.value, 0);\n  if (remaining < 0 || remaining > rows.length) return undefined;\n  const ranked = [...rows].sort((a, b) =>\n    a.remainder === b.remainder ? a.index - b.index : a.remainder > b.remainder ? -1 : 1,\n  );\n  for (let index = 0; index < remaining; index++) ranked[index]!.value += 1;\n  return {\n    classes: Object.fromEntries(\n      rows.map((row) => [row.key, row.value]),\n    ) as ModelListCostClassesMicros,\n    approximate: rows.some((row) => row.remainder !== 0n),\n  };\n}\n\nfunction calculateUsageCostBreakdown(\n  settings: Settings,\n  model: string,\n  usage: ModelUsageInput,\n  schedule: ModelPricingScheduleV1 | undefined,\n  options?: { latencyMode?: LatencyMode },\n): ModelUsageCostBreakdown {\n  if (!schedule) {\n    throw new Error(`Missing model pricing for ${model}`);\n  }\n  const entries =\n    usage.requestUsageEntries && usage.requestUsageEntries.length > 0\n      ? usage.requestUsageEntries\n      : [usage];\n  const rawCostByPricing = new Map<ModelPricing, number>();\n  for (const entry of entries) {\n    const pricing = selectModelPricing(schedule, positiveInt(entry.inputTokens));\n    rawCostByPricing.set(\n      pricing,\n      (rawCostByPricing.get(pricing) ?? 0) + calculateEntryCostMicros(pricing, entry),\n    );\n  }\n  let providerCostMicros = 0;\n  let creditCostMicros = 0;\n  for (const [pricing, rawCost] of rawCostByPricing) {\n    const marginBps = effectiveCreditMarginBps(settings, pricing.marginBps);\n    providerCostMicros += rawCost;\n    creditCostMicros += Math.ceil((rawCost * (10_000 + marginBps)) / 10_000);\n  }\n  const latencyMode = options?.latencyMode ?? \"standard\";\n  if (latencyMode !== \"standard\") {\n    const catalogSettings = settingsForTurnExecutionPolicy(settings, model);\n    const resolved = resolveModelProvider(\n      catalogSettings,\n      canonicalizeConfiguredModelId(catalogSettings, model),\n    );\n    const multiplierBps = resolved?.model.capabilities.latencyModes.find(\n      (mode) => mode.id === latencyMode && mode.runnable,\n    )?.billingMultiplierBps;\n    if (multiplierBps && multiplierBps > 0) {\n      providerCostMicros = Math.ceil((providerCostMicros * multiplierBps) / 10_000);\n      creditCostMicros = Math.ceil((creditCostMicros * multiplierBps) / 10_000);\n    }\n  }\n  return { providerCostMicros, creditCostMicros };\n}\n\n/**\n * Convert AI Gateway's exact USD inference cost to Opengeni credit micros and\n * apply the configured model margin. Decimal arithmetic is integer-only so a\n * sub-micro provider charge cannot be lost to floating-point rounding.\n */\nexport function calculateGatewayReportedCostMicros(\n  settings: Settings,\n  model: string,\n  inferenceCostUsd: string,\n  options?: { inputTokens?: number },\n): number {\n  return calculateGatewayReportedCostBreakdown(settings, model, inferenceCostUsd, options)\n    .creditCostMicros;\n}\n\ntype GatewayReportedCostDecimal = {\n  providerNumerator: bigint;\n  decimalScale: bigint;\n  providerCostMicros: number;\n};\n\nfunction parseGatewayReportedCostDecimal(inferenceCostUsd: string): GatewayReportedCostDecimal {\n  const match = /^(0|[1-9]\\d*)(?:\\.(\\d{1,18}))?$/.exec(inferenceCostUsd);\n  if (!match) {\n    throw new Error(\"Invalid AI Gateway inference cost\");\n  }\n  const fraction = match[2] ?? \"\";\n  const decimalDigits = BigInt(`${match[1]}${fraction}`);\n  const decimalScale = 10n ** BigInt(fraction.length);\n  const providerNumerator = decimalDigits * 1_000_000n;\n  const providerCostMicros = (providerNumerator + decimalScale - 1n) / decimalScale;\n  if (providerCostMicros > BigInt(Number.MAX_SAFE_INTEGER)) {\n    throw new Error(\"AI Gateway inference cost exceeds the supported billing range\");\n  }\n  return {\n    providerNumerator,\n    decimalScale,\n    providerCostMicros: Number(providerCostMicros),\n  };\n}\n\n/** Exact provider-reported Gateway cost without requiring an Opengeni price schedule. */\nexport function calculateGatewayReportedProviderCostMicros(inferenceCostUsd: string): number {\n  return parseGatewayReportedCostDecimal(inferenceCostUsd).providerCostMicros;\n}\n\nexport function calculateGatewayReportedCostBreakdown(\n  settings: Settings,\n  model: string,\n  inferenceCostUsd: string,\n  options?: { inputTokens?: number },\n): ModelUsageCostBreakdown {\n  const schedule = configuredModelPricingSchedules(settings)[model];\n  if (!schedule) {\n    throw new Error(`Missing model pricing for ${model}`);\n  }\n  const pricing = selectModelPricing(schedule, positiveInt(options?.inputTokens));\n  const { providerNumerator, decimalScale, providerCostMicros } =\n    parseGatewayReportedCostDecimal(inferenceCostUsd);\n  const marginBps = BigInt(10_000 + effectiveCreditMarginBps(settings, pricing.marginBps));\n  const numerator = providerNumerator * marginBps;\n  const denominator = decimalScale * 10_000n;\n  const creditMicros = (numerator + denominator - 1n) / denominator;\n  if (creditMicros > BigInt(Number.MAX_SAFE_INTEGER)) {\n    throw new Error(\"AI Gateway inference cost exceeds the supported billing range\");\n  }\n  return {\n    providerCostMicros,\n    creditCostMicros: Number(creditMicros),\n  };\n}\n\n/**\n * Exact Opengeni product price frozen before a managed video request starts.\n * Gateway reporting is delayed for asynchronous video, so this deliberately\n * does not masquerade as provider-reported cost.\n */\nexport function calculateVideoGenerationCreditCostMicros(\n  settings: Settings,\n  input: {\n    modelId: string;\n    resolution: VideoGenerationResolution;\n    durationSeconds: number;\n  },\n): number {\n  if (input.modelId !== SEEDANCE_2_5_MODEL_ID) {\n    throw new Error(`Missing video generation credit pricing for ${input.modelId}`);\n  }\n  if (!Number.isSafeInteger(input.durationSeconds) || input.durationSeconds < 1) {\n    throw new Error(\"Video generation duration is invalid for credit pricing\");\n  }\n  const rate =\n    input.resolution === \"480p\"\n      ? settings.videoGenerationCredit480pMicrosPerSecond\n      : settings.videoGenerationCredit720pMicrosPerSecond;\n  const cost = rate * input.durationSeconds;\n  if (!Number.isSafeInteger(cost) || cost <= 0 || cost > 1_000_000_000) {\n    throw new Error(\"Video generation credit price exceeds the supported range\");\n  }\n  return cost;\n}\n\nexport function configuredAllowedReasoningEfforts(\n  settings: Settings,\n): Array<z.infer<typeof ReasoningEffort>> {\n  return uniqueValues([\n    settings.openaiReasoningEffort,\n    ...splitCsv(settings.openaiAllowedReasoningEfforts),\n  ]).map((value) => ReasoningEffort.parse(value));\n}\n\n/**\n * Decodes OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY (base64, exactly 32 bytes) for\n * AES-256-GCM workspace environment value encryption. Returns null when unset.\n * Throws naming only the env var, never echoing its value.\n */\nexport function environmentsEncryptionKeyBytes(settings: Settings): Uint8Array | null {\n  if (!settings.environmentsEncryptionKey) {\n    return null;\n  }\n  const decoded = Buffer.from(settings.environmentsEncryptionKey, \"base64\");\n  if (decoded.length !== 32) {\n    throw new Error(\n      \"OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY must be base64 for exactly 32 bytes (generate with: openssl rand -base64 32)\",\n    );\n  }\n  return new Uint8Array(decoded);\n}\n\n/**\n * Build one structurally compatible connection policy for both\n * `@temporalio/client` and `@temporalio/worker`. An API key or any custom TLS\n * material enables TLS automatically; the explicit flag covers server-auth TLS\n * without credentials. Secret values are never included in validation errors.\n */\nexport function temporalConnectionOptions(settings: Settings): TemporalConnectionOptions {\n  const apiKey = settings.temporalApiKey?.trim() || undefined;\n  const serverNameOverride = settings.temporalTlsServerName?.trim() || undefined;\n  const rootCa = decodeTemporalTlsMaterial(\n    settings.temporalTlsRootCaCertificateBase64,\n    \"OPENGENI_TEMPORAL_TLS_ROOT_CA_CERTIFICATE_BASE64\",\n  );\n  const clientCertificate = decodeTemporalTlsMaterial(\n    settings.temporalTlsClientCertificateBase64,\n    \"OPENGENI_TEMPORAL_TLS_CLIENT_CERTIFICATE_BASE64\",\n  );\n  const clientPrivateKey = decodeTemporalTlsMaterial(\n    settings.temporalTlsClientPrivateKeyBase64,\n    \"OPENGENI_TEMPORAL_TLS_CLIENT_PRIVATE_KEY_BASE64\",\n  );\n\n  if (Boolean(clientCertificate) !== Boolean(clientPrivateKey)) {\n    throw new Error(\n      \"OPENGENI_TEMPORAL_TLS_CLIENT_CERTIFICATE_BASE64 and \" +\n        \"OPENGENI_TEMPORAL_TLS_CLIENT_PRIVATE_KEY_BASE64 must both be set or both omitted\",\n    );\n  }\n\n  const tls: TemporalTlsConnectionConfig = {};\n  if (serverNameOverride) {\n    tls.serverNameOverride = serverNameOverride;\n  }\n  if (rootCa) {\n    tls.serverRootCACertificate = rootCa;\n  }\n  if (clientCertificate && clientPrivateKey) {\n    tls.clientCertPair = { crt: clientCertificate, key: clientPrivateKey };\n  }\n  const hasCustomTls = Object.keys(tls).length > 0;\n  const tlsEnabled = settings.temporalTlsEnabled || Boolean(apiKey) || hasCustomTls;\n\n  return {\n    address: settings.temporalHost,\n    ...(tlsEnabled ? { tls: hasCustomTls ? tls : true } : {}),\n    ...(apiKey ? { apiKey } : {}),\n  };\n}\n\nfunction decodeTemporalTlsMaterial(\n  value: string | undefined,\n  settingName: string,\n): Uint8Array | undefined {\n  // RFC 2045 base64 commonly arrives wrapped at 76 columns. Kubernetes\n  // stringData and external secret stores preserve those line breaks, so\n  // normalize whitespace before applying the strict alphabet/canonical check.\n  const encoded = value?.replace(/\\s/g, \"\");\n  if (!encoded) {\n    return undefined;\n  }\n  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded) || encoded.length % 4 === 1) {\n    throw new Error(`${settingName} must contain valid base64`);\n  }\n  const decoded = Buffer.from(encoded, \"base64\");\n  const canonical = decoded.toString(\"base64\").replace(/=+$/, \"\");\n  if (decoded.length === 0 || canonical !== encoded.replace(/=+$/, \"\")) {\n    throw new Error(`${settingName} must contain valid base64`);\n  }\n  return new Uint8Array(decoded);\n}\n\n/**\n * The connection `search_path` for Opengeni's db handles + the managed-auth pool\n * (Step I, §7.8 runtime half). Returns `undefined` when `dbSchema` is unset\n * (standalone) so no `search_path` startup parameter is sent and the server\n * default (`public`) applies — byte-for-byte today's behavior. When `dbSchema`\n * is set (embedded), returns `\"<schema>,opengeni_private,public\"` — `public`\n * stays LAST so `gen_random_uuid()` (pgcrypto) and the `vector` type still\n * resolve (the schema-isolation contract live footgun). `opengeni_private` is on the path so the\n * RLS GUC-reader helpers resolve when referenced unqualified.\n */\nexport function dbSearchPath(settings: Pick<Settings, \"dbSchema\">): string | undefined {\n  const schema = settings.dbSchema?.trim();\n  if (!schema) {\n    return undefined;\n  }\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(schema)) {\n    throw new Error(`OPENGENI_DB_SCHEMA is not a valid Postgres identifier: ${schema}`);\n  }\n  return `${schema},opengeni_private,public`;\n}\n\nexport function collectGitIdentityEnvironment(settings: Settings): Record<string, string> {\n  return Object.fromEntries(\n    Object.entries({\n      GIT_AUTHOR_NAME: settings.gitAuthorName,\n      GIT_AUTHOR_EMAIL: settings.gitAuthorEmail,\n      GIT_COMMITTER_NAME: settings.gitCommitterName ?? settings.gitAuthorName,\n      GIT_COMMITTER_EMAIL: settings.gitCommitterEmail ?? settings.gitAuthorEmail,\n    }).filter(\n      (entry): entry is [string, string] =>\n        typeof entry[1] === \"string\" && entry[1].trim().length > 0,\n    ),\n  );\n}\n\nconst DEFAULT_SANDBOX_PATH = \"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\";\n\n/** Platform-owned manifest env names that are not `OPENGENI_*` pointers. */\nconst PLATFORM_SANDBOX_ENVIRONMENT_NAMES = new Set([\n  \"HOME\",\n  \"PATH\",\n  \"GIT_AUTHOR_NAME\",\n  \"GIT_AUTHOR_EMAIL\",\n  \"GIT_COMMITTER_NAME\",\n  \"GIT_COMMITTER_EMAIL\",\n  \"GIT_ASKPASS\",\n  \"GIT_TERMINAL_PROMPT\",\n]);\n\n/**\n * The manifest-env constants predicate (W1 secrets delivery, RM-3). A sandbox\n * manifest may carry only deployment constants: HOME, PATH, git identity and\n * askpass pointers, `OPENGENI_*` pointers, and the deployment allowlist\n * (`sandboxEnvironmentVariableNames`). User secrets never qualify: they are\n * resolved per command from `{{secret:…}}` references. Used by `buildManifest`\n * and the persisted-envelope strip as a defensive filter.\n */\nexport function sandboxManifestEnvironmentNamePredicate(\n  settings: Settings,\n): (name: string) => boolean {\n  const deployment = new Set(sandboxEnvironmentVariableNames(settings));\n  return (name) =>\n    PLATFORM_SANDBOX_ENVIRONMENT_NAMES.has(name) ||\n    name.startsWith(\"OPENGENI_\") ||\n    deployment.has(name);\n}\n\nfunction prependPathEntry(pathValue: string | undefined, entry: string): string {\n  const parts = (pathValue ?? DEFAULT_SANDBOX_PATH).split(\":\").filter(Boolean);\n  return [entry, ...parts.filter((part) => part !== entry)].join(\":\");\n}\n\n/**\n * The STABLE run-scoped sandbox environment: the subset of a run's box-manifest\n * environment that is IDENTICAL whether the box is first warmed by the worker\n * TURN or by an API-direct ATTACH (viewer / Channel-A / desktop / terminal). It\n * is the layered base every cold box must be created with so a later turn's\n * agent-manifest apply finds an EMPTY environment delta in the SDK's\n * `validateNoEnvironmentDelta` (which throws \"Live sandbox sessions cannot change\n * manifest environment variables\" on ANY key the agent declares that the box's\n * manifest lacks or carries a different value for).\n *\n * Precedence (lowest → highest): deployment allowlist (`collectSandboxEnvironment`)\n * < git identity (`collectGitIdentityEnvironment`) < the backend-aware HOME default.\n * The manifest holds deployment constants only: user secrets never ride it.\n * They are resolved per command from `{{secret:…}}` references (W1 delivery).\n *\n * DELIBERATELY EXCLUDES the per-run, ROTATING git provider token VALUES that\n * `sandboxEnvironmentForRun` mints when a repository resource is\n * attached: that token is minted FRESH per call, so it is not a stable, attach-\n * reproducible value and must not be part of the shared base. Under the token-\n * broker (B1) token VALUES never ride the manifest at all — they are seeded to\n * FILES inside the box and git/provider CLI auth reads those files. What IS stable\n * and lives here for provisioned boxes are the token directory / GitHub alias\n * FILE PATH and wrapper PATH entries: constants derived from HOME, so they\n * appear IDENTICALLY on BOTH the turn AND every attach manifest (the SDK's\n * per-turn provided-session env delta stays empty even as tokens rotate). These\n * helper pointers are deliberately not added for selfhosted/local/none because\n * the platform never mints or seeds git provider tokens there. The attach\n * surfaces have only the `Session` (no repo resources) and so never seed a token,\n * but unwritten files simply yield no auth; the BLOCKING attach-vs-turn error\n * this helper fixes is for the common (no-repo) provisioned-box case.\n */\nexport function stableSandboxEnvironmentForRun(\n  settings: Settings,\n  options: { workspaceId?: string } = {},\n): Record<string, string> {\n  const environment: Record<string, string> = {\n    ...collectSandboxEnvironment(settings),\n    ...collectGitIdentityEnvironment(settings),\n  };\n  // Backend-aware HOME: a provisioned box (docker + every cloud provider) runs the\n  // agent under the descriptor's workspaceRoot. `local` runs in-process as the host\n  // unix user (keep its real $HOME); `selfhosted` runs on a user's machine and must\n  // likewise preserve that machine's real HOME; `none` has no box.\n  const descriptor = CAPABILITY_DESCRIPTORS[settings.sandboxBackend];\n  if (\n    settings.sandboxBackend !== \"none\" &&\n    settings.sandboxBackend !== \"local\" &&\n    settings.sandboxBackend !== \"selfhosted\"\n  ) {\n    environment.HOME ??= descriptor.workspaceRoot;\n  }\n  // TOKEN-BROKER (B1): the STABLE credential FILE PATHS and CLI wrapper PATH for\n  // provisioned boxes only. Constants derived from the resolved HOME (falling\n  // back to the descriptor workspaceRoot), so they are parity-safe — they join\n  // the shared base and therefore appear IDENTICALLY on BOTH the worker-turn\n  // manifest AND every API-direct attach manifest. Only PATHS are stable; token\n  // VALUES live exclusively in files that runtime seeds off-manifest.\n  const provisionedGitHelperBackend =\n    settings.sandboxBackend !== \"none\" &&\n    settings.sandboxBackend !== \"local\" &&\n    settings.sandboxBackend !== \"selfhosted\";\n  if (provisionedGitHelperBackend) {\n    const home = environment.HOME ?? descriptor.workspaceRoot;\n    environment.OPENGENI_GIT_CREDENTIALS_DIR ??= `${home}/.opengeni/git-credentials`;\n    environment.OPENGENI_GIT_TOKEN_FILE ??= `${home}/.opengeni/git-token`;\n    environment.OPENGENI_GIT_CLI_WRAPPER_DIR ??= `${home}/.opengeni/bin`;\n    environment.PATH = prependPathEntry(environment.PATH, environment.OPENGENI_GIT_CLI_WRAPPER_DIR);\n  }\n  if (settings.sandboxBackend !== \"selfhosted\" && resolveFirstPartyDelegationSecret(settings)) {\n    environment.OPENGENI_CODEMODE_TOKEN_FILE ??= `${environment.HOME ?? descriptor.workspaceRoot}/.opengeni/codemode-token`;\n    if (settings.ogtoolPackageSpec) {\n      environment.OPENGENI_OGTOOL_PACKAGE_SPEC ??= settings.ogtoolPackageSpec;\n    }\n    if (options.workspaceId) {\n      environment.OPENGENI_CODEMODE_URL ??= codemodeWorkspaceUrl(settings, options.workspaceId);\n    }\n  }\n  return environment;\n}\n\n/**\n * Whether a resource set carries a GitHub-App-connected repository (installation\n * + repository ids present) — the SAME predicate the worker turn uses to decide\n * whether it declares the stable git-auth pointers. Attach surfaces call this so\n * an attach-warmed cold box carries the IDENTICAL manifest env a later repo turn\n * declares (env parity — see applyGitAuthPointerEnvironment).\n */\nexport function hasGitHubRepositorySelection(\n  resources: ReadonlyArray<{\n    kind: string;\n    provider?: unknown;\n    installationId?: unknown;\n    repositoryId?: unknown;\n    githubInstallationId?: unknown;\n    githubRepositoryId?: unknown;\n  }>,\n): boolean {\n  const positive = (value: unknown): boolean =>\n    (typeof value === \"number\" && Number.isInteger(value) && value > 0) ||\n    (typeof value === \"string\" && /^\\d+$/.test(value) && Number(value) > 0);\n  return resources.some(\n    (resource) =>\n      resource.kind === \"repository\" &&\n      ((positive(resource.githubInstallationId) && positive(resource.githubRepositoryId)) ||\n        (resource.provider === \"github\" &&\n          positive(resource.installationId) &&\n          positive(resource.repositoryId))),\n  );\n}\n\nexport function hasGitCredentialRepositorySelection(\n  resources: ReadonlyArray<{\n    kind: string;\n    provider?: unknown;\n    githubInstallationId?: unknown;\n    githubRepositoryId?: unknown;\n  }>,\n): boolean {\n  return resources.some(\n    (resource) =>\n      resource.kind === \"repository\" &&\n      (resource.provider === \"github\" ||\n        resource.provider === \"gitlab\" ||\n        resource.provider === \"azure_devops\" ||\n        hasGitHubRepositorySelection([resource])),\n  );\n}\n\n/**\n * TOKEN-BROKER (B1) parity: the STABLE git-auth POINTER environment a\n * repo-attached run declares — GIT_ASKPASS (a fixed path under HOME; the script\n * itself is provisioned at box setup), GIT_TERMINAL_PROMPT, and the GitHub-App\n * bot identity fallbacks. NO rotating value rides here (the token lives in the\n * file behind the askpass), so the layer is attach-reproducible and MUST be\n * applied identically by the worker turn (sandboxEnvironmentForRun) AND every\n * API-direct attach surface that can cold-create the box (viewer attach,\n * channel-A ops). A box cold-created WITHOUT this layer kills the next repo\n * turn: the turn's manifest declares these keys, the box's env lacks them, and\n * the SDK's provided-session guard throws \"Live sandbox sessions cannot change\n * manifest environment variables\" (observed live: an open session page's viewer\n * attach won the cold-create race and the first turn died).\n *\n * Mutates and returns `environment`. Identity fallbacks preserve values already\n * present (the deployment git-identity allowlist wins over the bot identity).\n */\nexport function applyGitAuthPointerEnvironment(\n  environment: Record<string, string>,\n  identity: { name: string; email: string } | null,\n): Record<string, string> {\n  environment.GIT_ASKPASS = `${environment.HOME ?? \"/workspace\"}/.opengeni/askpass`;\n  environment.GIT_TERMINAL_PROMPT = \"0\";\n  if (identity) {\n    environment.GIT_AUTHOR_NAME = environment.GIT_AUTHOR_NAME || identity.name;\n    environment.GIT_AUTHOR_EMAIL = environment.GIT_AUTHOR_EMAIL || identity.email;\n    environment.GIT_COMMITTER_NAME = environment.GIT_COMMITTER_NAME || identity.name;\n    environment.GIT_COMMITTER_EMAIL = environment.GIT_COMMITTER_EMAIL || identity.email;\n  }\n  return environment;\n}\n\nexport type StartupRetryOptions = {\n  shouldRetry?: (error: unknown) => boolean;\n  attempts?: number;\n  initialDelayMs?: number;\n  maxDelayMs?: number;\n  onRetry?: (event: {\n    label: string;\n    attempt: number;\n    attempts: number;\n    delayMs: number;\n    error: unknown;\n  }) => void;\n};\n\nexport function startupRetryOptions(\n  settings: Settings,\n): Required<Omit<StartupRetryOptions, \"onRetry\" | \"shouldRetry\">> {\n  return {\n    attempts: settings.startupDependencyRetryAttempts,\n    initialDelayMs: settings.startupDependencyRetryInitialDelayMs,\n    maxDelayMs: settings.startupDependencyRetryMaxDelayMs,\n  };\n}\n\nexport async function retryStartupDependency<T>(\n  label: string,\n  operation: () => Promise<T>,\n  options: StartupRetryOptions = {},\n): Promise<T> {\n  const attempts = Math.max(1, Math.floor(options.attempts ?? 30));\n  const initialDelayMs = Math.max(0, Math.floor(options.initialDelayMs ?? 1000));\n  const maxDelayMs = Math.max(initialDelayMs, Math.floor(options.maxDelayMs ?? 5000));\n  for (let attempt = 1; attempt <= attempts; attempt += 1) {\n    try {\n      return await operation();\n    } catch (error) {\n      if (attempt >= attempts || options.shouldRetry?.(error) === false) {\n        throw error;\n      }\n      const delayMs = Math.min(maxDelayMs, initialDelayMs * 2 ** (attempt - 1));\n      options.onRetry?.({ label, attempt, attempts, delayMs, error });\n      await delay(delayMs);\n    }\n  }\n  throw new Error(`unreachable startup retry state for ${label}`);\n}\n\nexport function sandboxEnvironmentVariableNames(settings: Settings): string[] {\n  const profiles = sandboxPreparationProfileNames(settings);\n  const names: string[] = [];\n  for (const profile of profiles) {\n    names.push(...sandboxPreparationProfiles[profile]!.env);\n  }\n  names.push(...splitCsv(settings.sandboxEnvAllowlist));\n  return uniqueEnvNames(names, \"sandbox env\");\n}\n\nexport function sandboxLifecycleHookIds(settings: Settings): string[] {\n  const ids: string[] = [];\n  for (const profile of sandboxPreparationProfileNames(settings)) {\n    ids.push(...sandboxPreparationProfiles[profile]!.hooks);\n  }\n  return uniqueValues(ids);\n}\n\nfunction sandboxPreparationProfileNames(settings: Settings): string[] {\n  const profiles = splitCsv(settings.sandboxPreparationProfiles).map((value) =>\n    value.toLowerCase(),\n  );\n  if (profiles.includes(\"none\")) {\n    if (profiles.length > 1) {\n      throw new Error(\n        \"OPENGENI_SANDBOX_PREPARATION_PROFILES cannot combine none with other profiles\",\n      );\n    }\n    return [\"none\"];\n  }\n  for (const profile of profiles) {\n    if (!sandboxPreparationProfiles[profile]) {\n      throw new Error(`Unknown sandbox preparation profile ${profile}`);\n    }\n  }\n  return profiles;\n}\n\nexport function parseExposedPorts(raw: string): number[] {\n  return splitCsv(raw).map((value) => {\n    const port = Number(value);\n    if (!Number.isInteger(port) || port < 1 || port > 65535) {\n      throw new Error(\"OPENGENI_DOCKER_EXPOSED_PORTS must contain TCP port numbers\");\n    }\n    return port;\n  });\n}\n\nexport function parseMcpServers(raw: string | undefined): unknown[] | undefined {\n  if (!raw) {\n    return undefined;\n  }\n  try {\n    const parsed = JSON.parse(raw);\n    if (!Array.isArray(parsed)) {\n      throw new Error(\"value must be a JSON array\");\n    }\n    return parsed;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_MCP_SERVERS must be a JSON array: ${message}`, {\n      cause: error,\n    });\n  }\n}\n\nexport function parseModelPricingJson(\n  raw: string,\n): Record<string, ModelPricing | ModelPricingScheduleV1> {\n  if (!raw.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_MODEL_PRICING_JSON must be valid JSON: ${message}`, { cause: error });\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\"OPENGENI_MODEL_PRICING_JSON must be a JSON object keyed by model name\");\n  }\n  const out: Record<string, ModelPricing | ModelPricingScheduleV1> = {};\n  for (const [model, value] of Object.entries(parsed)) {\n    if (!model.trim()) {\n      throw new Error(\"OPENGENI_MODEL_PRICING_JSON contains an empty model name\");\n    }\n    out[model] = z.union([ModelPricingSchema, ModelPricingScheduleSchema]).parse(value);\n  }\n  return out;\n}\n\n// --- sandbox warm-rate table (P2.1) ---\n// Per-backend usd_micros/sec, parsed from sandboxWarmRateMicrosPerSecondJson the\n// same way model pricing is. An empty {} (the default) means no warm-cost is\n// debited — warm-seconds are still metered for audit, just at rate 0.\nexport function parseSandboxWarmRateJson(raw: string): Record<string, number> {\n  if (!raw.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(\n      `OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON must be valid JSON: ${message}`,\n      { cause: error },\n    );\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\n      \"OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON must be a JSON object keyed by backend name\",\n    );\n  }\n  const out: Record<string, number> = {};\n  for (const [backend, value] of Object.entries(parsed)) {\n    if (!backend.trim()) {\n      throw new Error(\n        \"OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON contains an empty backend name\",\n      );\n    }\n    const rate = typeof value === \"number\" ? value : Number(value);\n    if (!Number.isFinite(rate) || rate < 0) {\n      throw new Error(\n        `OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON rate for ${backend} must be a non-negative number`,\n      );\n    }\n    out[backend] = rate;\n  }\n  return out;\n}\n\n// Resolve the warm rate (usd_micros/sec) for a backend; 0 when the backend has no\n// configured rate (the box is metered in seconds but not cost-debited).\nexport function sandboxWarmRateMicrosPerSecond(settings: Settings, backend: string): number {\n  const table = parseSandboxWarmRateJson(settings.sandboxWarmRateMicrosPerSecondJson);\n  return table[backend] ?? 0;\n}\n\n/**\n * Parse + validate the extra-provider registry JSON. `[]` (or empty/whitespace)\n * yields an empty list. Surfaces JSON and zod errors prefixed with the env-var\n * name so a malformed registry fails fast at boot (validateSettings calls this).\n */\nexport function parseModelProvidersJson(raw: string): RegistryProvider[] {\n  if (!raw.trim() || raw.trim() === \"[]\") {\n    return [];\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_MODEL_PROVIDERS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  if (!Array.isArray(parsed)) {\n    throw new Error(\"OPENGENI_MODEL_PROVIDERS_JSON must be a JSON array of providers\");\n  }\n  return parsed.map((entry, index) => {\n    const result = RegistryProviderSchema.safeParse(entry);\n    if (!result.success) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider[${index}] is invalid: ${result.error.message}`,\n      );\n    }\n    try {\n      return normalizeRegistryProvider(result.data);\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error);\n      throw new Error(`OPENGENI_MODEL_PROVIDERS_JSON provider[${index}] is invalid: ${message}`, {\n        cause: error,\n      });\n    }\n  });\n}\n\nexport function parseIntegrationsOauthClientsJson(\n  raw: string | undefined,\n): Record<string, IntegrationOAuthClientConfig> {\n  if (!raw?.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\n      \"OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON must be a JSON object keyed by authorization-server issuer or URL\",\n    );\n  }\n  const out: Record<string, IntegrationOAuthClientConfig> = {};\n  for (const [key, value] of Object.entries(parsed)) {\n    if (!key.trim()) {\n      throw new Error(\"OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON contains an empty issuer key\");\n    }\n    const result = IntegrationOAuthClientConfigSchema.safeParse(value);\n    if (!result.success) {\n      throw new Error(\n        `OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON client for ${key} is invalid: ${result.error.message}`,\n      );\n    }\n    out[key] = result.data;\n  }\n  return out;\n}\n\n/**\n * The operator-registered client for one authorization server, matched by\n * exact issuer/URL key first and then trailing-slash-insensitively. The OAuth\n * start flow and the connector catalog's connectability projection share this\n * so a catalog row is offered exactly when a start would find a client.\n */\nexport function findIntegrationsOauthClient(\n  configured: Readonly<Record<string, IntegrationOAuthClientConfig>>,\n  candidates: readonly string[],\n): IntegrationOAuthClientConfig | null {\n  const normalize = (value: string) => value.replace(/\\/+$/, \"\");\n  for (const key of new Set(candidates.flatMap((candidate) => [candidate, normalize(candidate)]))) {\n    const entry = configured[key];\n    if (entry) return entry;\n  }\n  const normalizedCandidates = new Set(candidates.map(normalize));\n  for (const [key, entry] of Object.entries(configured)) {\n    if (normalizedCandidates.has(normalize(key))) return entry;\n  }\n  return null;\n}\n\nexport const SocialOAuthClientConfigSchema = z.object({\n  clientId: z.string().min(1),\n  clientSecret: z.string().min(1).optional(),\n});\nexport type SocialOAuthClientConfig = z.infer<typeof SocialOAuthClientConfigSchema>;\n\nconst SOCIAL_OAUTH_PROVIDER_IDS = [\"x\", \"reddit\"] as const;\n\nexport function parseSocialOauthClientsJson(\n  raw: string | undefined,\n): Partial<Record<(typeof SOCIAL_OAUTH_PROVIDER_IDS)[number], SocialOAuthClientConfig>> {\n  if (!raw?.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\n      \"OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON must be a JSON object keyed by social provider id\",\n    );\n  }\n  const out: Partial<Record<(typeof SOCIAL_OAUTH_PROVIDER_IDS)[number], SocialOAuthClientConfig>> =\n    {};\n  for (const [key, value] of Object.entries(parsed)) {\n    if (!SOCIAL_OAUTH_PROVIDER_IDS.includes(key as (typeof SOCIAL_OAUTH_PROVIDER_IDS)[number])) {\n      throw new Error(\n        `OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON provider ${key} is not supported (expected: ${SOCIAL_OAUTH_PROVIDER_IDS.join(\", \")})`,\n      );\n    }\n    const result = SocialOAuthClientConfigSchema.safeParse(value);\n    if (!result.success) {\n      throw new Error(\n        `OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON client for ${key} is invalid: ${result.error.message}`,\n      );\n    }\n    out[key as (typeof SOCIAL_OAUTH_PROVIDER_IDS)[number]] = result.data;\n  }\n  return out;\n}\n\nexport function parseStaticUsageLimitsJson(raw: string): StaticUsageLimitsConfig {\n  if (!raw.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_STATIC_USAGE_LIMITS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  return StaticUsageLimits.parse(parsed);\n}\n\nexport function parseStaticEntitlementsJson(raw: string): EntitlementsConfig {\n  if (!raw.trim() || raw.trim() === \"{}\") {\n    return {};\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_STATIC_ENTITLEMENTS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n  return Entitlements.parse(parsed);\n}\n\nfunction calculateEntryCostMicros(pricing: ModelPricing, entry: ModelUsageInput): number {\n  const inputTokens = positiveInt(entry.inputTokens);\n  const outputTokens = positiveInt(entry.outputTokens);\n  const cachedTokens = Math.min(inputTokens, cachedInputTokens(entry));\n  const cacheWriteTokens = Math.min(\n    Math.max(0, inputTokens - cachedTokens),\n    cacheWriteInputTokens(entry),\n  );\n  const uncachedInputTokens = Math.max(0, inputTokens - cachedTokens - cacheWriteTokens);\n  const cachedInputRate =\n    pricing.cachedInputMicrosPerMillionTokens ?? pricing.inputMicrosPerMillionTokens;\n  const cacheWriteRate =\n    pricing.cacheWriteMicrosPerMillionTokens ?? pricing.inputMicrosPerMillionTokens;\n  return (\n    Math.ceil((uncachedInputTokens * pricing.inputMicrosPerMillionTokens) / 1_000_000) +\n    Math.ceil((cachedTokens * cachedInputRate) / 1_000_000) +\n    Math.ceil((cacheWriteTokens * cacheWriteRate) / 1_000_000) +\n    Math.ceil((outputTokens * pricing.outputMicrosPerMillionTokens) / 1_000_000)\n  );\n}\n\nfunction cachedInputTokens(entry: ModelUsageInput): number {\n  const details = Array.isArray(entry.inputTokensDetails)\n    ? entry.inputTokensDetails\n    : entry.inputTokensDetails\n      ? [entry.inputTokensDetails]\n      : [];\n  let total = 0;\n  for (const detail of details) {\n    total +=\n      positiveInt(detail.cached_tokens) +\n      positiveInt(detail.cachedInputTokens) +\n      positiveInt(detail.cached_input_tokens);\n  }\n  return total;\n}\n\nfunction cacheWriteInputTokens(entry: ModelUsageInput): number {\n  const details = Array.isArray(entry.inputTokensDetails)\n    ? entry.inputTokensDetails\n    : entry.inputTokensDetails\n      ? [entry.inputTokensDetails]\n      : [];\n  let total = 0;\n  for (const detail of details) {\n    total += positiveInt(detail.cache_write_tokens ?? detail.cacheWriteTokens);\n  }\n  return total;\n}\n\nfunction positiveInt(value: unknown): number {\n  return typeof value === \"number\" && Number.isFinite(value) && value > 0 ? Math.floor(value) : 0;\n}\n\n/**\n * Setup bound for Opengeni's own MCP servers. They are the deployment's API,\n * which is briefly slow while it restarts or is under load; the client's\n * 5-second default turned that into failed turns. Tool calls are unaffected.\n */\nexport const FIRST_PARTY_MCP_SETUP_TIMEOUT_MS = 30_000;\n\nfunction ensureBuiltInMcpServers(settings: Settings): Settings[\"mcpServers\"] {\n  const existing = settings.mcpServers.filter((server) => server.id !== \"opengeni\");\n  const firstPartyMcpUrl = firstPartyMcpServerUrl(settings);\n  const firstPartyFilesMcpUrl = firstPartyFilesMcpServerUrl(firstPartyMcpUrl);\n  const firstPartyDocsMcpUrl = firstPartyDocumentsMcpServerUrl(firstPartyMcpUrl);\n  const hasFiles = existing.some((server) => server.id === \"files\");\n  const hasDocs = existing.some((server) => server.id === \"docs\");\n  return [\n    {\n      id: \"opengeni\",\n      name: \"Opengeni\",\n      url: firstPartyMcpUrl,\n      // The opengeni server's tools/list response is permission-scoped: it\n      // varies by the calling session's delegated grant (e.g. a manager\n      // session sees sessions_*/environment_* tools that a worker session\n      // does not). The OpenAI Agents SDK caches tools/list in a process-global\n      // map keyed only by the MCP server name, which is identical for every\n      // session in the worker process. Caching here would let the first\n      // session to warm the cache dictate what every later session sees,\n      // regardless of permissions. tools/list is a cheap per-turn call, so we\n      // never cache it. (The files server pins allowedTools to a single\n      // permission-invariant tool and docs is already uncached, so both stay\n      // safe to cache / leave as-is.)\n      cacheToolsList: false,\n      setupTimeoutMs: FIRST_PARTY_MCP_SETUP_TIMEOUT_MS,\n    },\n    ...(hasFiles\n      ? []\n      : [\n          {\n            id: \"files\",\n            name: \"Files\",\n            url: firstPartyFilesMcpUrl,\n            allowedTools: [\"files_get_download_url\"],\n            cacheToolsList: true,\n            setupTimeoutMs: FIRST_PARTY_MCP_SETUP_TIMEOUT_MS,\n          },\n        ]),\n    ...(hasDocs\n      ? []\n      : [\n          {\n            id: \"docs\",\n            name: \"Knowledge\",\n            url: firstPartyDocsMcpUrl,\n            allowedTools: [\"knowledge_search\", \"knowledge_get\", \"knowledge_browse\"],\n            cacheToolsList: false,\n            setupTimeoutMs: FIRST_PARTY_MCP_SETUP_TIMEOUT_MS,\n          },\n        ]),\n    ...existing,\n  ];\n}\n\n/**\n * The sandbox/external base URL of Opengeni's first-party MCP endpoint, as a\n * `{workspaceId}` template. Codemode and remote placements use this route.\n *\n * BINDING CONTRACT (`opengeniMcpUrl`):\n *   - STANDALONE (unset): falls back to the loopback default.\n *   - EMBEDDED / MOUNTED (must set): when Opengeni's API is mounted as a host\n *     sub-app under a prefix (e.g. `https://host/og/v1/...`), the loopback\n *     default is WRONG — the worker runs in the host process and `127.0.0.1:\n *     ${apiPort}` is not where the mounted, sandbox-routable MCP lives. The host\n *     MUST set `OPENGENI_MCP_URL` to the externally/sandbox-routable base (a\n *     `{workspaceId}` template, or a concrete base that gets re-scoped). This is\n *     the one binding a mounted embed cannot leave unset.\n */\nexport function firstPartyMcpBaseUrl(settings: Settings): string {\n  return (\n    settings.opengeniMcpUrl ??\n    `http://127.0.0.1:${settings.apiPort}/v1/workspaces/{workspaceId}/mcp`\n  );\n}\n\n/**\n * Worker-side first-party MCP base. It never inherits the public/tunnel URL:\n * an operator may intentionally expose that route to Modal or a Connected\n * Machine, while the worker should still use loopback or cluster service DNS.\n */\nexport function firstPartyMcpInternalBaseUrl(settings: Settings): string {\n  return (\n    settings.opengeniMcpInternalUrl ??\n    `http://127.0.0.1:${settings.apiPort}/v1/workspaces/{workspaceId}/mcp`\n  );\n}\n\nfunction scopedFirstPartyMcpUrl(raw: string, workspaceId: string): string {\n  if (raw.includes(\"{workspaceId}\")) {\n    return raw.replaceAll(\"{workspaceId}\", workspaceId);\n  }\n  const url = new URL(raw);\n  url.pathname = `/v1/workspaces/${workspaceId}/mcp`;\n  url.search = \"\";\n  url.hash = \"\";\n  return url.toString();\n}\n\nexport function firstPartyMcpWorkspaceUrl(settings: Settings, workspaceId: string): string {\n  return scopedFirstPartyMcpUrl(firstPartyMcpBaseUrl(settings), workspaceId);\n}\n\nexport function firstPartyMcpInternalWorkspaceUrl(settings: Settings, workspaceId: string): string {\n  return scopedFirstPartyMcpUrl(firstPartyMcpInternalBaseUrl(settings), workspaceId);\n}\n\nexport function codemodeWorkspaceUrl(settings: Settings, workspaceId: string): string {\n  if (settings.opengeniMcpUrl) {\n    const url = new URL(firstPartyMcpWorkspaceUrl(settings, workspaceId));\n    if (!url.pathname.endsWith(\"/mcp\")) {\n      throw new Error(\"First-party MCP URL cannot be projected to the Codemode endpoint\");\n    }\n    url.pathname = `${url.pathname.slice(0, -4)}/codemode`;\n    return url.toString();\n  }\n\n  // Codemode executes inside the selected placement, not beside the worker.\n  // Local Docker reaches the host through Docker's canonical host alias; an\n  // in-process local sandbox uses loopback; remote managed providers use the\n  // deployment's public origin. `OPENGENI_MCP_URL` above remains the explicit\n  // escape hatch for mounted deployments and local remote-provider tunnels.\n  const executionOrigin =\n    settings.sandboxBackend === \"docker\"\n      ? `http://host.docker.internal:${settings.apiPort}`\n      : settings.sandboxBackend === \"local\"\n        ? `http://127.0.0.1:${settings.apiPort}`\n        : (settings.publicBaseUrl ?? `http://127.0.0.1:${settings.apiPort}`);\n  const url = new URL(executionOrigin);\n  url.pathname = `${url.pathname.replace(/\\/+$/u, \"\")}/v1/workspaces/${workspaceId}/codemode`;\n  url.search = \"\";\n  url.hash = \"\";\n  return url.toString();\n}\n\nfunction firstPartyMcpServerUrl(settings: Settings): string {\n  return firstPartyMcpBaseUrl(settings);\n}\n\nfunction firstPartyDocumentsMcpServerUrl(mcpUrl: string): string {\n  return `${mcpUrl.replace(/\\/+$/, \"\")}/docs`;\n}\n\nfunction firstPartyFilesMcpServerUrl(mcpUrl: string): string {\n  return `${mcpUrl.replace(/\\/+$/, \"\")}/files`;\n}\n\nconst MODAL_DESKTOP_IMAGE_DIGEST_REF = /@sha256:[0-9a-f]{64}$/i;\n\nfunction isDigestPinnedModalDesktopImage(settings: Settings): boolean {\n  if (settings.modalImageId) return true;\n  return (\n    typeof settings.modalImageRef === \"string\" &&\n    MODAL_DESKTOP_IMAGE_DIGEST_REF.test(settings.modalImageRef)\n  );\n}\n\nexport type TrustedProxyCidr = {\n  address: string;\n  prefix: number;\n  family: \"ipv4\" | \"ipv6\";\n};\n\n/**\n * Parse `OPENGENI_API_TRUSTED_PROXY_CIDRS`: comma-separated IPv4/IPv6 CIDRs or\n * single addresses. Throws on any malformed entry so a typo can never widen or\n * silently disable the trusted proxy set.\n */\nexport function trustedProxyCidrEntries(raw: string): TrustedProxyCidr[] {\n  const entries: TrustedProxyCidr[] = [];\n  for (const entry of raw.split(\",\")) {\n    const value = entry.trim();\n    if (!value) continue;\n    const slash = value.indexOf(\"/\");\n    const address = slash < 0 ? value : value.slice(0, slash);\n    const version = isIP(address);\n    const family = version === 4 ? \"ipv4\" : version === 6 ? \"ipv6\" : null;\n    const maxPrefix = family === \"ipv4\" ? 32 : 128;\n    const prefixText = slash < 0 ? String(maxPrefix) : value.slice(slash + 1);\n    const prefix = /^\\d{1,3}$/u.test(prefixText) ? Number(prefixText) : Number.NaN;\n    if (!family || !Number.isInteger(prefix) || prefix < 0 || prefix > maxPrefix) {\n      throw new Error(\n        `OPENGENI_API_TRUSTED_PROXY_CIDRS entry \"${value.slice(0, 64)}\" is not an IP address or CIDR range`,\n      );\n    }\n    entries.push({ address, prefix, family });\n  }\n  return entries;\n}\n\n/**\n * Parse `OPENGENI_LOCAL_ALLOWED_ORIGINS`: comma-separated exact browser origins\n * (`http(s)://host[:port]`, no path, query, credentials, or wildcard). Throws on\n * any malformed entry so a typo can never widen or silently disable the local\n * browser boundary.\n */\nexport function localAllowedOriginEntries(raw: string | undefined): string[] {\n  const origins: string[] = [];\n  for (const entry of (raw ?? \"\").split(\",\")) {\n    const value = entry.trim();\n    if (!value) continue;\n    let url: URL | null = null;\n    try {\n      url = new URL(value);\n    } catch {\n      url = null;\n    }\n    if (\n      !url ||\n      (url.protocol !== \"http:\" && url.protocol !== \"https:\") ||\n      url.username ||\n      url.password ||\n      url.hostname.includes(\"*\") ||\n      url.pathname !== \"/\" ||\n      url.search ||\n      url.hash ||\n      value.endsWith(\"?\") ||\n      value.endsWith(\"#\")\n    ) {\n      throw new Error(\n        `OPENGENI_LOCAL_ALLOWED_ORIGINS entry \"${value.slice(0, 64)}\" is not an exact http(s) origin such as http://127.0.0.1:5173`,\n      );\n    }\n    origins.push(url.origin);\n  }\n  return origins;\n}\n\nconst LOCAL_SANDBOX_API_ROUTES: readonly RegExp[] = [\n  // Codemode calls, journal reads, catalog, and the Site/SDK proxy.\n  /^\\/v1\\/workspaces\\/[^/]+\\/codemode(?:\\/|$)/u,\n  // First-party MCP, including its /docs and /files servers.\n  /^\\/v1\\/workspaces\\/[^/]+\\/mcp(?:\\/|$)/u,\n  // The personal GitHub HTTPS smart-Git broker.\n  /^\\/v1\\/git\\/personal\\/[A-Za-z0-9_-]{43}\\/(?:info\\/refs|git-upload-pack|git-receive-pack)$/u,\n];\n\n/**\n * Local development only: whether a normalized API path is one a sandbox calls\n * (Codemode, first-party MCP, and the personal Git broker). The Linux Docker\n * sandbox route relays only these, and the local API serves only these on the\n * addresses that only sandboxes use (see `apps/api/src/http/local-browser-boundary.ts`).\n */\nexport function localSandboxApiRouteAllowed(pathname: string): boolean {\n  return LOCAL_SANDBOX_API_ROUTES.some((route) => route.test(pathname));\n}\n\n/**\n * Published Sites serve untrusted HTML, so their domain must not hold or sit\n * inside the console or API hosts: a Site could otherwise read or set their\n * cookies. A separate registrable domain is required (see\n * docs/published-sites.md); this catches the nesting a host check can see.\n */\nexport function validateSitesDomain(\n  settings: Pick<Settings, \"sitesDomain\" | \"publicBaseUrl\" | \"webBaseUrl\">,\n): void {\n  if (settings.sitesDomain === undefined) return;\n  let domain: string;\n  try {\n    domain = normalizeSitesDomain(settings.sitesDomain);\n  } catch {\n    throw new Error(\"OPENGENI_SITES_DOMAIN must be a domain name such as sites.example.com\");\n  }\n  const hosts: Array<[string, string | undefined]> = [\n    [\"OPENGENI_PUBLIC_BASE_URL\", settings.publicBaseUrl],\n    [\"OPENGENI_WEB_BASE_URL\", settings.webBaseUrl],\n  ];\n  for (const [name, url] of hosts) {\n    if (!url) continue;\n    const host = new URL(url).hostname.toLowerCase().replace(/\\.$/u, \"\");\n    if (host === domain || host.endsWith(`.${domain}`) || domain.endsWith(`.${host}`))\n      throw new Error(\n        `OPENGENI_SITES_DOMAIN (${domain}) must be a separate domain from the console and API: ${name} uses ${host}`,\n      );\n  }\n}\n\nfunction validateSettings(settings: Settings, source: NodeJS.ProcessEnv = process.env): void {\n  temporalConnectionOptions(settings);\n  localAllowedOriginEntries(settings.localAllowedOrigins);\n  validateSitesDomain(settings);\n  if (\n    settings.organizationUserSetupEmailTokenTransport === \"query\" &&\n    !settings.organizationUserSetupQueryEdgeSanitizationConfirmed\n  ) {\n    throw new Error(\n      \"OPENGENI_ORGANIZATION_USER_SETUP_QUERY_EDGE_SANITIZATION_CONFIRMED=true is required when OPENGENI_ORGANIZATION_USER_SETUP_EMAIL_TOKEN_TRANSPORT=query\",\n    );\n  }\n  if (settings.goalIdleBackoffMs.some((delayMs) => delayMs > settings.goalIdleBackoffMaxMs)) {\n    throw new Error(\n      `OPENGENI_GOAL_IDLE_BACKOFF_MS entries must not exceed OPENGENI_GOAL_IDLE_BACKOFF_MAX_MS (${settings.goalIdleBackoffMaxMs})`,\n    );\n  }\n  const allowedFirstPartyMcpTools = new Set(\n    settings.allowedFirstPartyMcpTools ?? FIRST_PARTY_MCP_TOOL_NAMES,\n  );\n  const disallowedDefaults = (settings.defaultFirstPartyMcpTools ?? []).filter(\n    (tool) => !allowedFirstPartyMcpTools.has(tool),\n  );\n  if (disallowedDefaults.length > 0) {\n    throw new Error(\n      `OPENGENI_DEFAULT_FIRST_PARTY_MCP_TOOLS must be a subset of OPENGENI_ALLOWED_FIRST_PARTY_MCP_TOOLS: ${disallowedDefaults.join(\", \")}`,\n    );\n  }\n  if (settings.productAccessMode === \"managed\") {\n    if (settings.onePasswordFakeTokens && ![\"local\", \"test\"].includes(settings.environment)) {\n      throw new Error(\n        \"OPENGENI_ONEPASSWORD_FAKE_TOKENS is a local development switch and is refused by the managed runtime\",\n      );\n    }\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    if (!settings.betterAuthSecret) {\n      throw new Error(\n        \"OPENGENI_BETTER_AUTH_SECRET is required when OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    if (!settings.delegationSecret) {\n      throw new Error(\n        \"OPENGENI_DELEGATION_SECRET is required when OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    if (\n      settings.managedAuthSessionSetMode !== \"legacy\" &&\n      ![\"local\", \"test\"].includes(settings.environment) &&\n      !settings.publicBaseUrl.startsWith(\"https://\")\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when browser session sets are enabled outside local/test\",\n      );\n    }\n    if (\n      settings.managedEmailDelivery === \"resend\" &&\n      ![\"local\", \"test\"].includes(settings.environment) &&\n      !settings.resendApiKey\n    ) {\n      throw new Error(\"OPENGENI_RESEND_API_KEY is required for managed mode outside local/test\");\n    }\n    if (settings.managedEmailDelivery === \"disabled\" && settings.resendApiKey) {\n      throw new Error(\n        \"OPENGENI_RESEND_API_KEY must be unset when OPENGENI_MANAGED_EMAIL_DELIVERY=disabled\",\n      );\n    }\n    if (![\"local\", \"test\"].includes(settings.environment) && !settings.environmentsEncryptionKey) {\n      throw new Error(\n        \"OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is required for managed mode outside local/test\",\n      );\n    }\n  }\n  if (\n    Boolean(settings.managedAuthGoogleClientId) !== Boolean(settings.managedAuthGoogleClientSecret)\n  ) {\n    throw new Error(\n      \"OPENGENI_MANAGED_AUTH_GOOGLE_CLIENT_ID and OPENGENI_MANAGED_AUTH_GOOGLE_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (\n    Boolean(settings.managedAuthGithubClientId) !== Boolean(settings.managedAuthGithubClientSecret)\n  ) {\n    throw new Error(\n      \"OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_ID and OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_SECRET must be configured together\",\n    );\n  }\n  const managedSocialAuthConfigured = Boolean(\n    settings.managedAuthGoogleClientId || settings.managedAuthGithubClientId,\n  );\n  if (managedSocialAuthConfigured) {\n    if (settings.productAccessMode !== \"managed\") {\n      throw new Error(\n        \"Managed Google/GitHub authentication requires OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    const publicOrigin = canonicalPublicOrigin(settings.publicBaseUrl);\n    if (!publicOrigin) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must be a credential-free HTTP(S) origin when managed social authentication is configured\",\n      );\n    }\n    if (!publicOrigin.startsWith(\"https://\") && ![\"local\", \"test\"].includes(settings.environment)) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when managed social authentication is configured outside local/test\",\n      );\n    }\n  }\n  // The retired MCP-only name must never be ignored silently: a deployment\n  // that trusted forwarded addresses would fall back to the transport peer.\n  // \"0\" (the old .env.example value) means the same as the new default.\n  const retiredTrustedProxyHops = source.OPENGENI_MCP_OAUTH_TRUSTED_PROXY_HOPS?.trim();\n  if (retiredTrustedProxyHops && retiredTrustedProxyHops !== \"0\") {\n    throw new Error(\n      \"OPENGENI_MCP_OAUTH_TRUSTED_PROXY_HOPS was renamed to OPENGENI_API_TRUSTED_PROXY_HOPS, which now sets the client address for every API rate limit and auth session; rename the variable\",\n    );\n  }\n  const trustedProxyCidrs = trustedProxyCidrEntries(settings.apiTrustedProxyCidrs);\n  if (trustedProxyCidrs.length > 0 && settings.apiTrustedProxyHops === 0) {\n    throw new Error(\n      \"OPENGENI_API_TRUSTED_PROXY_CIDRS requires OPENGENI_API_TRUSTED_PROXY_HOPS greater than 0\",\n    );\n  }\n  if (settings.mcpOauthEnabled) {\n    if (settings.productAccessMode === \"configured\") {\n      throw new Error(\n        \"OPENGENI_MCP_OAUTH_ENABLED=true requires managed or local product access mode\",\n      );\n    }\n    const publicOrigin = canonicalPublicOrigin(settings.publicBaseUrl);\n    if (!publicOrigin) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must be a credential-free HTTP(S) origin when OPENGENI_MCP_OAUTH_ENABLED=true\",\n      );\n    }\n    if (!publicOrigin.startsWith(\"https://\") && ![\"local\", \"test\"].includes(settings.environment)) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when OPENGENI_MCP_OAUTH_ENABLED=true outside local/test\",\n      );\n    }\n  }\n  environmentsEncryptionKeyBytes(settings);\n  if (settings.integrationsEnabled) {\n    if (settings.productAccessMode === \"managed\" && !settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when OPENGENI_INTEGRATIONS_ENABLED=true and OPENGENI_PRODUCT_ACCESS_MODE=managed\",\n      );\n    }\n    if (\n      settings.publicBaseUrl &&\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when OPENGENI_INTEGRATIONS_ENABLED=true outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret && ![\"local\", \"test\"].includes(settings.environment)) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when OPENGENI_INTEGRATIONS_ENABLED=true outside local/test\",\n      );\n    }\n  }\n  if (Boolean(settings.slackClientId) !== Boolean(settings.slackClientSecret)) {\n    throw new Error(\n      \"OPENGENI_SLACK_CLIENT_ID and OPENGENI_SLACK_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (settings.slackClientId) {\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when the Opengeni Slack app is configured\",\n      );\n    }\n    if (\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when the Opengeni Slack app is configured outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when the Opengeni Slack app is configured\",\n      );\n    }\n  }\n  if (Boolean(settings.googleDriveClientId) !== Boolean(settings.googleDriveClientSecret)) {\n    throw new Error(\n      \"OPENGENI_GOOGLE_DRIVE_CLIENT_ID and OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (\n    Boolean(settings.githubPersonalOauthClientId) !==\n    Boolean(settings.githubPersonalOauthClientSecret)\n  ) {\n    throw new Error(\n      \"OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_ID and OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (settings.githubPersonalOauthEnabled) {\n    if (!settings.integrationsEnabled) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_ENABLED=true is required when personal GitHub OAuth is enabled\",\n      );\n    }\n    if (!settings.githubPersonalOauthClientId || !settings.githubPersonalOauthClientSecret) {\n      throw new Error(\n        \"personal GitHub OAuth requires OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_ID and OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_SECRET\",\n      );\n    }\n    if (settings.githubPersonalOauthClientId === settings.githubClientId) {\n      throw new Error(\n        \"personal GitHub OAuth must use a different OAuth App client from the Opengeni GitHub App\",\n      );\n    }\n    if (!personalGitHubOAuthCallbackUrl(settings.publicBaseUrl)) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must be a credential-free origin without a path, query, or fragment when personal GitHub OAuth is enabled\",\n      );\n    }\n    if (\n      !settings.publicBaseUrl?.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when personal GitHub OAuth is enabled outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when personal GitHub OAuth is enabled\",\n      );\n    }\n    if (!settings.environmentsEncryptionKey) {\n      throw new Error(\n        \"OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is required when personal GitHub OAuth is enabled\",\n      );\n    }\n  }\n  if (Boolean(settings.fikenClientId) !== Boolean(settings.fikenClientSecret)) {\n    throw new Error(\n      \"OPENGENI_FIKEN_OAUTH_CLIENT_ID and OPENGENI_FIKEN_OAUTH_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (settings.fikenClientId) {\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when the Fiken OAuth integration is configured\",\n      );\n    }\n    if (\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when the Fiken OAuth integration is configured outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when the Fiken OAuth integration is configured\",\n      );\n    }\n  }\n  if (settings.googleDriveClientId) {\n    if (!settings.integrationsEnabled) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_ENABLED=true is required when the Google Drive integration is configured\",\n      );\n    }\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when the Google Drive integration is configured\",\n      );\n    }\n    if (!googleDriveOAuthCallbackUrl(settings.publicBaseUrl)) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must be a credential-free origin without a path, query, or fragment when the Google Drive integration is configured\",\n      );\n    }\n    if (\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when the Google Drive integration is configured outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when the Google Drive integration is configured\",\n      );\n    }\n  }\n  if (settings.googleDriveSyncMaxFileBytes > settings.googleDriveSyncMaxBytes) {\n    throw new Error(\n      \"OPENGENI_GOOGLE_DRIVE_SYNC_MAX_FILE_BYTES must not exceed OPENGENI_GOOGLE_DRIVE_SYNC_MAX_BYTES\",\n    );\n  }\n  if (\n    settings.googleDriveProviderRetryInitialDelayMs > settings.googleDriveProviderRetryMaxDelayMs\n  ) {\n    throw new Error(\n      \"OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_INITIAL_DELAY_MS must not exceed OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_MAX_DELAY_MS\",\n    );\n  }\n  if (settings.googleDriveProviderRetryInitialDelayMs > settings.googleDriveProviderRetryBudgetMs) {\n    throw new Error(\n      \"OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_INITIAL_DELAY_MS must not exceed OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_BUDGET_MS\",\n    );\n  }\n  if (Boolean(settings.atlassianClientId) !== Boolean(settings.atlassianClientSecret)) {\n    throw new Error(\n      \"OPENGENI_ATLASSIAN_CLIENT_ID and OPENGENI_ATLASSIAN_CLIENT_SECRET must be configured together\",\n    );\n  }\n  if (settings.atlassianClientId) {\n    if (!settings.publicBaseUrl) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL is required when the Atlassian integration is configured\",\n      );\n    }\n    if (\n      !settings.publicBaseUrl.startsWith(\"https://\") &&\n      ![\"local\", \"test\"].includes(settings.environment)\n    ) {\n      throw new Error(\n        \"OPENGENI_PUBLIC_BASE_URL must use https when the Atlassian integration is configured outside local/test\",\n      );\n    }\n    if (!settings.integrationsStateSecret) {\n      throw new Error(\n        \"OPENGENI_INTEGRATIONS_STATE_SECRET is required when the Atlassian integration is configured\",\n      );\n    }\n  }\n  parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);\n  parseSocialOauthClientsJson(settings.socialOauthClientsJson);\n  if (\n    settings.productAccessMode === \"configured\" &&\n    ![\"local\", \"test\"].includes(settings.environment) &&\n    !settings.delegationSecret &&\n    !settings.authRequired\n  ) {\n    throw new Error(\n      \"OPENGENI_PRODUCT_ACCESS_MODE=configured requires OPENGENI_DELEGATION_SECRET or OPENGENI_AUTH_REQUIRED=true outside local/test\",\n    );\n  }\n  if (settings.billingMode === \"stripe\") {\n    if (!settings.stripeSecretKey || !settings.stripeWebhookSecret) {\n      throw new Error(\n        \"OPENGENI_STRIPE_SECRET_KEY and OPENGENI_STRIPE_WEBHOOK_SECRET are required when OPENGENI_BILLING_MODE=stripe\",\n      );\n    }\n  }\n  if (settings.productAccessMode !== \"managed\" && settings.billingMode === \"stripe\") {\n    throw new Error(\"OPENGENI_BILLING_MODE=stripe requires OPENGENI_PRODUCT_ACCESS_MODE=managed\");\n  }\n  if (settings.usageLimitsMode === \"static\") {\n    const limits = configuredStaticUsageLimits(settings);\n    if (Object.keys(limits).length === 0) {\n      throw new Error(\n        \"OPENGENI_STATIC_USAGE_LIMITS_JSON must define at least one cap when OPENGENI_USAGE_LIMITS_MODE=static\",\n      );\n    }\n  } else {\n    parseStaticUsageLimitsJson(settings.staticUsageLimitsJson);\n  }\n  if (settings.entitlementsMode === \"static\") {\n    const entitlements = parseStaticEntitlementsJson(settings.staticEntitlementsJson);\n    if (Object.keys(entitlements).length === 0) {\n      throw new Error(\n        \"OPENGENI_STATIC_ENTITLEMENTS_JSON must define at least one feature when OPENGENI_ENTITLEMENTS_MODE=static\",\n      );\n    }\n  } else {\n    parseStaticEntitlementsJson(settings.staticEntitlementsJson);\n  }\n  if (settings.authRequired && !settings.accessKey) {\n    throw new Error(\"OPENGENI_ACCESS_KEY is required when OPENGENI_AUTH_REQUIRED=true\");\n  }\n  if (settings.openaiProvider === \"azure\") {\n    if (!settings.azureOpenaiBaseUrl && !settings.azureOpenaiEndpoint) {\n      throw new Error(\n        \"Azure OpenAI requires OPENGENI_AZURE_OPENAI_BASE_URL or OPENGENI_AZURE_OPENAI_ENDPOINT\",\n      );\n    }\n    if (!settings.azureOpenaiBaseUrl && !settings.azureOpenaiDeployment) {\n      throw new Error(\"Azure OpenAI endpoint mode requires OPENGENI_AZURE_OPENAI_DEPLOYMENT\");\n    }\n    if (!settings.azureOpenaiBaseUrl && !settings.azureOpenaiApiVersion) {\n      throw new Error(\"Azure OpenAI endpoint mode requires OPENGENI_AZURE_OPENAI_API_VERSION\");\n    }\n    if (!settings.azureOpenaiApiKey && !settings.azureOpenaiAdToken) {\n      throw new Error(\"Azure OpenAI requires an API key or AD token\");\n    }\n  }\n  // The Modal token is a both-or-neither pair regardless of the active backend\n  // (a half-configured token is always a misconfiguration). This is orthogonal\n  // to the backend-gated required-cred sweep below.\n  if (Boolean(settings.modalTokenId) !== Boolean(settings.modalTokenSecret)) {\n    throw new Error(\n      \"OPENGENI_MODAL_TOKEN_ID and OPENGENI_MODAL_TOKEN_SECRET must both be set or both omitted\",\n    );\n  }\n  // Backend-gated required credentials: only the *active* backend's creds are\n  // required. A modal deployment must carry the Modal token; a daytona/e2b/none\n  // deployment must NOT be forced to (and is not). Drives off the single\n  // SANDBOX_REQUIRED_ENV table that the deployment package also mirrors.\n  for (const required of SANDBOX_REQUIRED_ENV[settings.sandboxBackend] ?? []) {\n    const value = settings[required.field];\n    if (\n      value === undefined ||\n      value === null ||\n      (typeof value === \"string\" && value.trim().length === 0)\n    ) {\n      throw new Error(\n        `${required.env} is required when OPENGENI_SANDBOX_BACKEND=${settings.sandboxBackend}`,\n      );\n    }\n  }\n  validateObjectStorageSettings(settings);\n  if (settings.documentChunkOverlap >= settings.documentChunkSize) {\n    throw new Error(\n      \"OPENGENI_DOCUMENT_CHUNK_OVERLAP must be smaller than OPENGENI_DOCUMENT_CHUNK_SIZE\",\n    );\n  }\n  parseExposedPorts(settings.dockerExposedPorts);\n  // Malformed voice-input pricing deliberately does not fail boot: every\n  // process shares this config, and a voice-only typo must not crash-loop\n  // workers. The provider is withheld and the API logs voiceInputPricingIssues.\n  sandboxEnvironmentVariableNames(settings);\n  sandboxLifecycleHookIds(settings);\n  // Fail fast on a malformed warm-rate table (P2.1).\n  const warmRates = parseSandboxWarmRateJson(settings.sandboxWarmRateMicrosPerSecondJson);\n  // The meter rounds each settled interval to whole USD micros. Fractional\n  // micros/second would make the total depend on heartbeat frequency; only\n  // integer rates have interval-independent settlement at the same elapsed time.\n  if (\n    settings.sandboxWarmBillingMode === \"credits\" &&\n    Object.values(warmRates).some((rate) => !Number.isSafeInteger(rate))\n  ) {\n    throw new Error(\n      \"OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON paid rates must be safe integers\",\n    );\n  }\n  if (\n    settings.documentEmbeddingBillingMode === \"credits\" &&\n    settings.documentEmbeddingProvider === \"openai\" &&\n    settings.documentEmbeddingRateMicrosPerMillionBytes <= 0\n  ) {\n    throw new Error(\n      \"OPENGENI_DOCUMENT_EMBEDDING_RATE_MICROS_PER_MILLION_BYTES must be positive when paid OpenAI embedding billing is enabled\",\n    );\n  }\n  if (\n    settings.documentEmbeddingBillingMode === \"credits\" &&\n    settings.documentEmbeddingProvider === \"openai\" &&\n    !settings.documentEmbeddingCreditsActivatedAt\n  ) {\n    throw new Error(\n      \"OPENGENI_DOCUMENT_EMBEDDING_CREDITS_ACTIVATED_AT is required for paid OpenAI embeddings\",\n    );\n  }\n  if (settings.sandboxBackend === \"compute\") {\n    const issues = computeSettingsIssues(settings);\n    if (issues.length > 0) {\n      throw new Error(`OPENGENI_SANDBOX_BACKEND=compute: ${issues.join(\"; \")}`);\n    }\n  }\n  if (settings.sandboxBackend === \"opensandbox\") {\n    if (!/@sha256:[0-9a-f]{64}$/i.test(settings.openSandboxImage ?? \"\")) {\n      throw new Error(\n        \"OPENGENI_OPENSANDBOX_IMAGE must be an immutable OCI reference ending in @sha256:<64 hex characters>\",\n      );\n    }\n    if (!objectStorageConfiguredForWorkspaceArchives(settings)) {\n      throw new Error(\n        \"OPENGENI_SANDBOX_BACKEND=opensandbox requires configured object storage for portable /workspace archives\",\n      );\n    }\n  }\n  const serverIds = new Set<string>();\n  for (const server of settings.mcpServers) {\n    if (serverIds.has(server.id)) {\n      throw new Error(`OPENGENI_MCP_SERVERS contains duplicate id ${server.id}`);\n    }\n    serverIds.add(server.id);\n    if (server.connectionRef?.authoritySource === \"host\") {\n      throw new Error(\n        \"OPENGENI_MCP_SERVERS host-owned connection refs are no longer supported; select ordinary native connections\",\n      );\n    }\n  }\n  // --- sandbox lease cadence invariant (fail fast at boot) ---\n  // Holder TTLs are provider-neutral. Modal's finite hard/idle clocks and\n  // deadline rotation are validated only when Modal is active; renewable-TTL\n  // providers such as OpenSandbox do not enter that deadline model.\n  {\n    const reaperPeriod = settings.sandboxLeaseReaperPeriodMs;\n    const viewerTtl = settings.sandboxViewerHolderTtlMs;\n    const interactionTtl = settings.sandboxInteractionHolderTtlMs;\n    if (!(reaperPeriod < viewerTtl)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS (${reaperPeriod}) must be strictly less than ` +\n          `OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS (${viewerTtl}): the reaper must run more often ` +\n          `than the TTL it polices, or stale viewer holders outlive a full reaper period.`,\n      );\n    }\n    if (!(reaperPeriod < interactionTtl)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS (${reaperPeriod}) must be strictly less than ` +\n          `OPENGENI_SANDBOX_INTERACTION_HOLDER_TTL_MS (${interactionTtl}): the reaper must run ` +\n          `more often than the controller-heartbeat horizon.`,\n      );\n    }\n    if (settings.sandboxDrainSnapshotTimeoutMs !== undefined) {\n      const drainCaptureTimeoutMs = sandboxArchiveCaptureTimeoutMs({\n        sandboxSnapshotTimeoutMs: effectiveSandboxDrainSnapshotTimeoutMs(settings),\n      });\n      const requiredTransitionWaitMs =\n        reaperPeriod + drainCaptureTimeoutMs + SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS;\n      if (requiredTransitionWaitMs > SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS) {\n        throw new Error(\n          `OPENGENI_SANDBOX_DRAIN_SNAPSHOT_TIMEOUT_MS (${settings.sandboxDrainSnapshotTimeoutMs}) ` +\n            `requires a sandbox lifecycle transition wait of ${requiredTransitionWaitMs}ms after ` +\n            `one reaper period and provider settlement, exceeding the ` +\n            `${SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS}ms limit. Lower the drain snapshot timeout ` +\n            `or OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS.`,\n        );\n      }\n    }\n    // A backend rollout does not rewrite or synchronously drain existing\n    // leases. Preserve enough deadline-rotation headroom for historical Modal\n    // leases even when the deployment default has moved to another backend.\n    const rotationLeadMs = settings.sandboxRotationLeadMs;\n    const ordinaryCaptureTimeoutMs = sandboxArchiveCaptureTimeoutMs(settings);\n    const drainCaptureTimeoutMs = sandboxArchiveCaptureTimeoutMs({\n      sandboxSnapshotTimeoutMs: effectiveSandboxDrainSnapshotTimeoutMs(settings),\n    });\n    const providerDeadlineCaptureTimeoutMs = Math.max(\n      ordinaryCaptureTimeoutMs,\n      drainCaptureTimeoutMs,\n    );\n    const requiredRotationLeadMs =\n      SANDBOX_DEADLINE_COMMAND_STOP_GRACE_MS + providerDeadlineCaptureTimeoutMs + 2 * reaperPeriod;\n    if (!(rotationLeadMs > requiredRotationLeadMs)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must exceed the ` +\n          `legacy command stop grace, largest durable snapshot or drain capture timeout, and two reaper periods ` +\n          `(${requiredRotationLeadMs}), including for persisted Modal ` +\n          `leases after a default-backend rollout.`,\n      );\n    }\n    const containmentMs = settings.sandboxIdleCommandContainmentMs;\n    if (containmentMs !== undefined && !(containmentMs > settings.sandboxIdleGraceMs)) {\n      throw new Error(\n        `OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS (${containmentMs}) must exceed ` +\n          `OPENGENI_SANDBOX_IDLE_GRACE_MS (${settings.sandboxIdleGraceMs}): a box kept warm only by ` +\n          `retained commands must stay available at least as long as an idle box awaiting drain.`,\n      );\n    }\n    if (\n      containmentMs !== undefined &&\n      optionalEnvironmentValue(\"OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS\", source) !==\n        undefined &&\n      !(containmentMs < rotationLeadMs)\n    ) {\n      throw new Error(\n        `OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS (${containmentMs}) must be strictly less than ` +\n          `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}): an idle box must be checkpointed ` +\n          `and stopped well before its provider deadline.`,\n      );\n    }\n    if (settings.sandboxBackend === \"modal\") {\n      const idleGraceMs = settings.sandboxIdleGraceMs;\n      const lifecycle = effectiveSandboxLifecycle(settings, \"modal\");\n      const providerLifetimeMs = lifecycle.hardLifetimeMs!;\n      const idleTimeoutMs = lifecycle.providerIdleTimeoutMs!;\n      if (!(idleTimeoutMs <= providerLifetimeMs)) {\n        throw new Error(\n          `OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS*1000 (${idleTimeoutMs}) must not exceed the hard provider ` +\n            `lifetime (OPENGENI_MODAL_TIMEOUT_SECONDS*1000 = ${providerLifetimeMs}): the idle timeout is a ` +\n            `floor under the hard lifetime, not above it.`,\n        );\n      }\n      if (!(rotationLeadMs < providerLifetimeMs)) {\n        throw new Error(\n          `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must be strictly less than ` +\n            `OPENGENI_MODAL_TIMEOUT_SECONDS*1000 (${providerLifetimeMs}).`,\n        );\n      }\n      if (!(viewerTtl < idleTimeoutMs)) {\n        throw new Error(\n          `OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS (${viewerTtl}) must be strictly less than the effective box ` +\n            `idle timeout (${idleTimeoutMs}): a viewer holder must be reapable before the box idles out from ` +\n            `under it (the provider idle-timeout is the backstop).`,\n        );\n      }\n      if (!(interactionTtl < idleTimeoutMs)) {\n        throw new Error(\n          `OPENGENI_SANDBOX_INTERACTION_HOLDER_TTL_MS (${interactionTtl}) must be strictly less than ` +\n            `the effective box idle timeout (${idleTimeoutMs}): a dead browser controller must be ` +\n            `reapable before the provider reclaims its placement.`,\n        );\n      }\n      if (!(reaperPeriod + idleGraceMs < idleTimeoutMs)) {\n        throw new Error(\n          `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS + OPENGENI_SANDBOX_IDLE_GRACE_MS ` +\n            `(${reaperPeriod} + ${idleGraceMs} = ${reaperPeriod + idleGraceMs}) must be strictly less than the ` +\n            `effective box idle timeout (${idleTimeoutMs}): a drained box must SURVIVE its full warm window so ` +\n            `the reaper can resume + snapshot /workspace + terminate it on the sweep AFTER the drain grace ` +\n            `elapses — Modal's idle-reap must NOT fire first (or /workspace is lost). Raise ` +\n            `OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS (defaults to OPENGENI_MODAL_TIMEOUT_SECONDS) or lower ` +\n            `OPENGENI_SANDBOX_IDLE_GRACE_MS.`,\n        );\n      }\n      if (\n        settings.modalIdleTimeoutSeconds !== undefined &&\n        containmentMs !== undefined &&\n        !(reaperPeriod + containmentMs + drainCaptureTimeoutMs < idleTimeoutMs)\n      ) {\n        throw new Error(\n          `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS + OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS + ` +\n            `drain capture timeout (${reaperPeriod} + ${containmentMs} + ${drainCaptureTimeoutMs}) ` +\n            `must be strictly less than OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS*1000 (${idleTimeoutMs}): ` +\n            `idle command containment must checkpoint a box before Modal's own idle reaper stops it. ` +\n            `Lower OPENGENI_SANDBOX_IDLE_COMMAND_CONTAINMENT_MS or raise the Modal idle timeout.`,\n        );\n      }\n    }\n  }\n  // --- stream-token secret: required-when-desktop, but GRACEFULLY DEGRADE (stream-token availability contract) ---\n  // The desktop pixel plane needs an HMAC secret to mint scoped stream tokens.\n  // It is REQUIRED when desktop is enabled — but per OD-8 a missing secret is NOT\n  // a hard boot-fail: we emit a LOUD warning and the deployment ships with\n  // DesktopStream.transport:null (resolveStreamTokenSecret returns undefined ->\n  // negotiateCapabilities degrades the desktop cell). This keeps a desktop-\n  // configured deployment bootable (headless + Channel-A still work) instead of\n  // crashing the whole API on a missing secret.\n  if (\n    settings.sandboxDesktopEnabled &&\n    settings.sandboxBackend === \"modal\" &&\n    ![\"local\", \"test\"].includes(settings.environment)\n  ) {\n    if (!isDigestPinnedModalDesktopImage(settings)) {\n      throw new Error(\n        \"OPENGENI_MODAL_IMAGE_REF must be digest-pinned (registry/name@sha256:…) when \" +\n          \"OPENGENI_SANDBOX_BACKEND=modal and OPENGENI_SANDBOX_DESKTOP_ENABLED=true. \" +\n          \"Computer/Browser need docker/desktop.Dockerfile, not the official headless \" +\n          \"opengeni-sandbox image. Helm desktop.imageRef writes this pin.\",\n      );\n    }\n  }\n  if (settings.sandboxDesktopEnabled && resolveStreamTokenSecret(settings) === undefined) {\n    console.warn(\n      \"[opengeni] OPENGENI_SANDBOX_DESKTOP_ENABLED=true but neither OPENGENI_STREAM_TOKEN_SECRET nor \" +\n        \"OPENGENI_DELEGATION_SECRET is set: the desktop pixel plane will GRACEFULLY DEGRADE \" +\n        \"(DesktopStream.transport=null — no scoped stream tokens can be minted). Set \" +\n        \"OPENGENI_STREAM_TOKEN_SECRET to enable the live desktop stream.\",\n    );\n  }\n  if (settings.modelCatalogSource === \"code\") {\n    validateModelCatalogSettings(settings, source);\n  } else {\n    // Database mode resolves membership asynchronously. Only the independent\n    // deployment funding JSON is parsed here; env catalog and note inputs are\n    // intentionally ignored until resolveCatalogSettings applies the singleton.\n    parseModelCostPolicyJson(settings.modelCostPolicyJson);\n    if (settings.managedModelsJson?.trim()) {\n      console.warn(\n        \"[opengeni] OPENGENI_MANAGED_MODELS_JSON is ignored because OPENGENI_MODEL_CATALOG_SOURCE=database; \" +\n          \"set gatewayModels/openrouterModels/opperModels in the deployment catalog document instead.\",\n      );\n    }\n  }\n}\n\n/** Validate one fully resolved, secret-bearing executable catalog. */\nexport function validateModelCatalogSettings(\n  settings: Settings,\n  source: NodeJS.ProcessEnv = process.env,\n): ConfiguredModel[] {\n  const costPolicy = parseModelCostPolicyJson(settings.modelCostPolicyJson);\n  const notes = parseModelNotesJson(settings.modelNotesJson);\n  const registryProviders = parseModelProvidersJson(settings.modelProvidersJson);\n  const builtinId = builtinProviderId(settings);\n  const opperKeyProblem =\n    settings.opperApiKey === undefined ? null : opperCredentialProblem(settings.opperApiKey);\n  if (opperKeyProblem) {\n    throw new Error(`OPENGENI_OPPER_API_KEY: ${opperKeyProblem}`);\n  }\n  const providerIds = new Set<string>();\n  for (const provider of registryProviders) {\n    if (\n      provider.kind === \"vercel-gateway-managed\" ||\n      provider.kind === \"vercel-gateway-workspace\" ||\n      provider.kind === \"vercel-gateway-organization\" ||\n      provider.kind === \"direct-openai-workspace\" ||\n      provider.kind === \"direct-azure-workspace\" ||\n      provider.kind === \"direct-openai-organization\" ||\n      provider.kind === \"direct-azure-organization\" ||\n      provider.kind === \"openrouter-workspace\" ||\n      provider.kind === \"openrouter-organization\" ||\n      provider.kind === \"opper-workspace\" ||\n      provider.kind === \"opper-organization\" ||\n      provider.kind === \"anthropic-organization\" ||\n      provider.kind === \"anthropic-workspace\" ||\n      provider.kind === \"claude-subscription-workspace\" ||\n      provider.kind === \"claude-subscription-organization\" ||\n      provider.kind === \"xai-subscription\"\n    ) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider kind ${provider.kind} is reserved for a reviewed Opengeni credential broker`,\n      );\n    }\n    if (RESERVED_MODEL_PROVIDER_IDS.has(provider.id)) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider id ${provider.id} is reserved for a reviewed Opengeni provider`,\n      );\n    }\n    if (provider.id === builtinId) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider id ${provider.id} collides with the built-in provider id`,\n      );\n    }\n    if (providerIds.has(provider.id)) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON contains duplicate provider id ${provider.id}`,\n      );\n    }\n    providerIds.add(provider.id);\n    if (\n      provider.kind !== \"codex-subscription\" &&\n      provider.kind !== \"anonymous\" &&\n      !resolveProviderApiKey(provider, source)\n    ) {\n      throw new Error(\n        `OPENGENI_MODEL_PROVIDERS_JSON provider ${provider.id} requires a resolvable API key (set apiKey or apiKeyEnv)`,\n      );\n    }\n  }\n  // Materialize the normalized catalog at boot so canonical product ids,\n  // aliases, definition digests, and capability/pricing normalization are\n  // validated even when managed billing is disabled.\n  const models = configuredModels(settings, source);\n  const defaultCatalogSettings = settingsForTurnExecutionPolicy(settings, settings.openaiModel);\n  const policy = settings.creditPromotionPolicy;\n  const promotionalModelIds = new Set([\n    ...(policy.defaultModelIds ?? []),\n    ...(policy.signupModelIds ?? []),\n    ...Object.values(policy.offers).flatMap((offer) => offer.eligibleModelIds ?? []),\n  ]);\n  for (const modelId of promotionalModelIds) {\n    if (!models.some((model) => model.id === modelId && model.cost === \"credits\")) {\n      throw new Error(\n        `Promotional credit model ${modelId} must be a canonical credits-billed model in the catalog`,\n      );\n    }\n  }\n  const defaultCatalogModels =\n    defaultCatalogSettings === settings ? models : configuredModels(defaultCatalogSettings, source);\n  if (models.length === 0 && defaultCatalogModels.length === 0) {\n    throw new Error(\"The resolved model catalog contains no executable models\");\n  }\n  const defaultModelId = canonicalizeConfiguredModelId(\n    defaultCatalogSettings,\n    settings.openaiModel,\n  );\n  if (!defaultCatalogModels.some((model) => model.id === defaultModelId)) {\n    throw new Error(\n      `The default model ${settings.openaiModel} is not executable in the resolved model catalog`,\n    );\n  }\n  // An operator-set credits default must name a credits-billed model in the\n  // env catalog; a typo would otherwise fall back silently to the first\n  // selectable credits model. Only an explicit value in code catalog mode is\n  // checked: the built-in gpt-6-luna may be absent from a custom catalog, and\n  // a database catalog is edited independently of this env value, so both keep\n  // the documented fallback (docs/model-providers.md) instead of failing\n  // every catalog read.\n  const explicitCreditsDefault = source.OPENGENI_CREDITS_DEFAULT_MODEL?.trim();\n  if (\n    explicitCreditsDefault &&\n    settings.modelCatalogSource === \"code\" &&\n    settings.billingMode === \"stripe\"\n  ) {\n    const creditsDefaultId = canonicalizeConfiguredModelId(settings, settings.creditsDefaultModel);\n    const creditsDefault = models.find((model) => model.id === creditsDefaultId);\n    if (creditsDefault?.cost !== \"credits\") {\n      throw new Error(\n        `OPENGENI_CREDITS_DEFAULT_MODEL ${settings.creditsDefaultModel} is not a credits-billed model in the resolved model catalog`,\n      );\n    }\n  }\n\n  const deploymentProductIds = new Set(\n    models.filter((model) => model.credentialSource.kind === \"deployment\").map((model) => model.id),\n  );\n  const noteProductIds = new Set(models.map((model) => model.id));\n  if (settings.resolvedCodexModelsJson !== undefined) {\n    for (const model of z\n      .array(CodexCatalogModelSchema)\n      .parse(JSON.parse(settings.resolvedCodexModelsJson))) {\n      noteProductIds.add(model.id);\n    }\n  }\n  for (const model of configuredGatewayCatalogModels(settings)) {\n    deploymentProductIds.add(model.productId);\n    noteProductIds.add(model.productId);\n    noteProductIds.add(model.workspaceProductId);\n  }\n  for (const model of configuredOpenRouterCatalogModels(settings)) {\n    const productId = `${OPENROUTER_MODEL_ID_PREFIX}${model.upstreamModelId}`;\n    deploymentProductIds.add(productId);\n    noteProductIds.add(productId);\n    noteProductIds.add(`${WORKSPACE_OPENROUTER_MODEL_ID_PREFIX}${model.upstreamModelId}`);\n  }\n  for (const model of configuredOpperCatalogModels(settings)) {\n    const productId = `${OPPER_MODEL_ID_PREFIX}${model.upstreamModelId}`;\n    deploymentProductIds.add(productId);\n    noteProductIds.add(productId);\n    noteProductIds.add(`${WORKSPACE_OPPER_MODEL_ID_PREFIX}${model.upstreamModelId}`);\n  }\n  if (settings.modelCatalogSource === \"code\") {\n    for (const productId of Object.keys(costPolicy)) {\n      if (!deploymentProductIds.has(productId)) {\n        throw new Error(\n          `OPENGENI_MODEL_COST_POLICY_JSON references unknown deployment model ${productId}`,\n        );\n      }\n    }\n  }\n  for (const productId of Object.keys(notes)) {\n    if (!noteProductIds.has(productId)) {\n      throw new Error(`OPENGENI_MODEL_NOTES_JSON references unknown catalog model ${productId}`);\n    }\n  }\n\n  if (settings.billingMode === \"stripe\" || settings.usageLimitsMode === \"managed\") {\n    const pricing = configuredModelPricing(settings);\n    const missing = models\n      .filter((model) => model.cost === \"credits\" && !pricing[model.id])\n      .map((model) => model.id);\n    if (missing.length > 0) {\n      throw new Error(\n        `Missing model pricing for managed billing model(s): ${missing.join(\", \")}. Set OPENGENI_MODEL_PRICING_JSON.`,\n      );\n    }\n  }\n  return models;\n}\n\n/**\n * Resolve the secret used to sign/verify scoped stream tokens (sandbox contract\n * §C.3). Falls back to `delegationSecret` (the same HMAC envelope family —\n * `ogs_` vs `ogd_` prefix) so a deployment that already carries a delegation\n * secret does not need a second one. Returns undefined when neither is set,\n * which drives the graceful-degrade (DesktopStream.transport:null).\n */\nexport function resolveStreamTokenSecret(settings: Settings): string | undefined {\n  const explicit = settings.streamTokenSecret?.trim();\n  if (explicit) {\n    return explicit;\n  }\n  const delegation = settings.delegationSecret?.trim();\n  return delegation ? delegation : undefined;\n}\n\n/**\n * True iff the desktop pixel plane must GRACEFULLY DEGRADE because desktop is\n * enabled but no stream-token secret is resolvable (stream-token availability contract). When true,\n * negotiateCapabilities forces DesktopStream.transport:null.\n */\nexport function streamTokenDegraded(settings: Settings): boolean {\n  return settings.sandboxDesktopEnabled && resolveStreamTokenSecret(settings) === undefined;\n}\n\n/** Whether this deployment serves the compute agent gateway: the control service API\n * it reads link keys from and the gateway's own URL are both configured. */\nexport function computeGatewayConfigured(settings: Settings): boolean {\n  return Boolean(settings.computeApiUrl && settings.computeApiKey && settings.computeLinkUrl);\n}\n\n/** Everything a deployment must configure before a compute sandbox can work,\n * as human-readable problems; empty when it is ready. Checked at boot when\n * compute is the deployment backend, and whenever a compute client is built,\n * so a session that selects compute fails clearly instead of half-creating. */\nexport function computeSettingsIssues(settings: Settings): string[] {\n  const issues: string[] = [];\n  if (!settings.computeApiUrl) issues.push(\"OPENGENI_COMPUTE_API_URL is required\");\n  if (!settings.computeApiKey) issues.push(\"OPENGENI_COMPUTE_API_KEY is required\");\n  if (\n    settings.computeApiUrl &&\n    ![\"local\", \"test\"].includes(settings.environment) &&\n    !settings.computeApiUrl.startsWith(\"https://\")\n  ) {\n    issues.push(\"OPENGENI_COMPUTE_API_URL must use https outside local/test\");\n  }\n  const linkUrl = settings.computeLinkUrl;\n  if (!linkUrl) {\n    issues.push(\"OPENGENI_COMPUTE_LINK_URL is required\");\n  } else if (\n    !linkUrl.startsWith(\"wss://\") &&\n    !([\"local\", \"test\"].includes(settings.environment) && linkUrl.startsWith(\"ws://\"))\n  ) {\n    issues.push(\"OPENGENI_COMPUTE_LINK_URL must be a wss:// URL (ws:// only in local/test)\");\n  }\n  if (!settings.selfhostedRelayUrl || !resolveRelayTokenSecret(settings)) {\n    issues.push(\n      \"OPENGENI_SELFHOSTED_RELAY_URL and the relay token secret are required (terminal, desktop and ports)\",\n    );\n  }\n  if (settings.agentOpStreamEnabled !== true) {\n    issues.push(\"OPENGENI_AGENT_OP_STREAM_ENABLED must stay true (agent exec needs op-stream)\");\n  }\n  if (\n    settings.computeMemoryRequestMib !== undefined &&\n    settings.computeMemoryRequestMib > settings.computeMemoryMib\n  ) {\n    issues.push(\"OPENGENI_COMPUTE_MEMORY_REQUEST_MIB must not exceed OPENGENI_COMPUTE_MEMORY_MIB\");\n  }\n  if (\n    settings.computeCpuRequestMillis !== undefined &&\n    settings.computeCpuRequestMillis > settings.computeVcpus * 1000\n  ) {\n    issues.push(\n      \"OPENGENI_COMPUTE_CPU_REQUEST_MILLIS must not exceed OPENGENI_COMPUTE_VCPUS * 1000\",\n    );\n  }\n  return issues;\n}\n\n/**\n * Resolve the secret the control plane signs the enrollment bearer credential\n * with (the `oge_` envelope the agent presents back — M5). Falls\n * back to `delegationSecret` (the same HMAC envelope family) so a deployment that\n * already carries a delegation secret needs no second one. Returns undefined when\n * neither is set; when selfhosted is enabled but this is undefined, the poll route\n * reports the credential plane disabled (graceful degrade, never a 500). NEVER log\n * the returned value.\n */\nexport function resolveEnrollmentSigningSecret(settings: Settings): string | undefined {\n  const explicit = settings.enrollmentSigningSecret?.trim();\n  if (explicit) {\n    return explicit;\n  }\n  const delegation = settings.delegationSecret?.trim();\n  return delegation ? delegation : undefined;\n}\n\n/**\n * Resolve the HMAC secret the control plane signs the agent's relay PRODUCER token\n * with (the `ogr_` envelope; M8b). The RELAY verifies the producer\n * token with the SAME secret (injected into the relay via env). Prefers an explicit\n * `selfhostedRelayTokenSecret`, then the `streamTokenSecret` (the relay already\n * needs that one to verify the viewer's `ogs_` token, so a single secret can back\n * both planes), then `delegationSecret` (same HMAC family). Returns undefined when\n * none is set — the enrollment poll then returns an empty relayToken (graceful\n * degrade; the stream plane is unavailable until configured). NEVER log the value.\n */\nexport function resolveRelayTokenSecret(settings: Settings): string | undefined {\n  const explicit = settings.selfhostedRelayTokenSecret?.trim();\n  if (explicit) {\n    return explicit;\n  }\n  const stream = settings.streamTokenSecret?.trim();\n  if (stream) {\n    return stream;\n  }\n  const delegation = settings.delegationSecret?.trim();\n  return delegation ? delegation : undefined;\n}\n\n/**\n * The resolved NATS auth-callout responder config (M-AUTH). Present only when the\n * callout plane is FULLY configured: the account signing seed + the responder's own\n * login. When any piece is missing this returns null and the responder does not\n * start (selfhosted agents cannot connect — a graceful disabled state, never a boot\n * crash). The returned `accountSeed` is a secret; NEVER log it.\n */\nexport interface NatsCalloutConfig {\n  /** The callout account SIGNING seed (`SA...`) — signs the user + response JWTs. */\n  accountSeed: string;\n  /** The target account NAME the user is placed into (the response `aud`). */\n  accountName: string;\n  /** The responder's NATS login (an `auth_callout.auth_users` user). */\n  user: string;\n  password: string;\n}\n\nexport function resolveNatsCalloutConfig(settings: Settings): NatsCalloutConfig | null {\n  const accountSeed = settings.selfhostedNatsCalloutAccountSeed?.trim();\n  const accountName = settings.selfhostedNatsCalloutAccountName?.trim() || \"APP\";\n  const user = settings.selfhostedNatsCalloutUser?.trim();\n  const password = settings.selfhostedNatsCalloutPassword?.trim();\n  if (!accountSeed || !user || !password) {\n    return null;\n  }\n  return { accountSeed, accountName, user, password };\n}\n\nfunction validateObjectStorageSettings(settings: ObjectStorageSettings): void {\n  if (\n    settings.objectStorageBackend === \"s3-compatible\" ||\n    settings.objectStorageBackend === \"aws-s3\"\n  ) {\n    if (\n      Boolean(settings.objectStorageAccessKeyId) !== Boolean(settings.objectStorageSecretAccessKey)\n    ) {\n      throw new Error(\n        \"OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID and OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY must both be set or both omitted\",\n      );\n    }\n    if (\n      settings.objectStorageBackend === \"s3-compatible\" &&\n      (settings.objectStorageEndpoint ||\n        settings.objectStorageInternalEndpoint ||\n        settings.objectStorageSandboxEndpoint) &&\n      (!settings.objectStorageAccessKeyId || !settings.objectStorageSecretAccessKey)\n    ) {\n      throw new Error(\n        \"S3-compatible object storage endpoints require OPENGENI_OBJECT_STORAGE_ACCESS_KEY_ID and OPENGENI_OBJECT_STORAGE_SECRET_ACCESS_KEY\",\n      );\n    }\n    if (\n      settings.objectStorageAzureConnectionString ||\n      settings.objectStorageAzureAccountName ||\n      settings.objectStorageAzureAccountKey ||\n      settings.objectStorageAzureEndpoint\n    ) {\n      throw new Error(\n        \"S3 object storage uses OPENGENI_OBJECT_STORAGE_* S3 settings, not OPENGENI_OBJECT_STORAGE_AZURE_* settings\",\n      );\n    }\n    if (\n      settings.objectStorageGcsProjectId ||\n      settings.objectStorageGcsCredentialsJson ||\n      settings.objectStorageGcsKeyFilename ||\n      settings.objectStorageGcsApiEndpoint\n    ) {\n      throw new Error(\n        \"S3 object storage uses OPENGENI_OBJECT_STORAGE_* S3 settings, not OPENGENI_OBJECT_STORAGE_GCS_* settings\",\n      );\n    }\n  } else if (settings.objectStorageBackend === \"azure-blob\") {\n    if (\n      settings.objectStorageEndpoint ||\n      settings.objectStorageInternalEndpoint ||\n      settings.objectStorageSandboxEndpoint ||\n      settings.objectStorageAccessKeyId ||\n      settings.objectStorageSecretAccessKey\n    ) {\n      throw new Error(\n        \"Azure Blob storage uses OPENGENI_OBJECT_STORAGE_AZURE_* settings, not S3-compatible object storage settings\",\n      );\n    }\n    if (\n      settings.objectStorageGcsProjectId ||\n      settings.objectStorageGcsCredentialsJson ||\n      settings.objectStorageGcsKeyFilename ||\n      settings.objectStorageGcsApiEndpoint\n    ) {\n      throw new Error(\n        \"Azure Blob storage uses OPENGENI_OBJECT_STORAGE_AZURE_* settings, not OPENGENI_OBJECT_STORAGE_GCS_* settings\",\n      );\n    }\n    const hasConnectionString = Boolean(settings.objectStorageAzureConnectionString);\n    const hasSharedKey =\n      Boolean(settings.objectStorageAzureAccountName) &&\n      Boolean(settings.objectStorageAzureAccountKey);\n    if (!hasConnectionString && !hasSharedKey) {\n      throw new Error(\n        \"Azure Blob storage requires OPENGENI_OBJECT_STORAGE_AZURE_CONNECTION_STRING or OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_NAME plus OPENGENI_OBJECT_STORAGE_AZURE_ACCOUNT_KEY\",\n      );\n    }\n  } else {\n    if (\n      settings.objectStorageEndpoint ||\n      settings.objectStorageInternalEndpoint ||\n      settings.objectStorageSandboxEndpoint ||\n      settings.objectStorageAccessKeyId ||\n      settings.objectStorageSecretAccessKey\n    ) {\n      throw new Error(\n        \"GCS object storage uses OPENGENI_OBJECT_STORAGE_GCS_* settings, not S3-compatible object storage settings\",\n      );\n    }\n    if (\n      settings.objectStorageAzureConnectionString ||\n      settings.objectStorageAzureAccountName ||\n      settings.objectStorageAzureAccountKey ||\n      settings.objectStorageAzureEndpoint\n    ) {\n      throw new Error(\n        \"GCS object storage uses OPENGENI_OBJECT_STORAGE_GCS_* settings, not OPENGENI_OBJECT_STORAGE_AZURE_* settings\",\n      );\n    }\n    if (settings.objectStorageGcsCredentialsJson) {\n      parseGcsCredentialsJson(settings.objectStorageGcsCredentialsJson);\n    }\n  }\n}\n\n/**\n * The PRIVILEGED control-plane NATS login (api/worker). Present only when BOTH a\n * user and password are set; otherwise null and the bus connects anonymously (local\n * dev / a NATS without auth_callout). When the callout plane is on, this is the\n * static account user permitted to request exact generation-fenced agent RPC subjects.\n */\nexport interface NatsControlPlaneAuth {\n  user: string;\n  password: string;\n}\n\nexport function resolveNatsControlPlaneAuth(\n  settings: Pick<Settings, \"selfhostedNatsControlUser\" | \"selfhostedNatsControlPassword\">,\n): NatsControlPlaneAuth | null {\n  const user = settings.selfhostedNatsControlUser?.trim();\n  const password = settings.selfhostedNatsControlPassword?.trim();\n  if (!user || !password) {\n    return null;\n  }\n  return { user, password };\n}\n\nfunction splitCsv(raw: string): string[] {\n  return raw\n    .split(\",\")\n    .map((value) => value.trim())\n    .filter(Boolean);\n}\n\n/** Image references a workspace may select as its default sandbox image. */\nexport function sandboxImageAllowlist(settings: Pick<Settings, \"sandboxImageAllowlist\">): string[] {\n  return [...new Set(splitCsv(settings.sandboxImageAllowlist ?? \"\"))];\n}\n\nfunction uniqueEnvNames(raw: string[], fieldName: string): string[] {\n  const seen = new Set<string>();\n  const out: string[] = [];\n  for (const name of raw) {\n    if (!envName.test(name)) {\n      throw new Error(`${fieldName} contains invalid variable name ${name}`);\n    }\n    if (!seen.has(name)) {\n      seen.add(name);\n      out.push(name);\n    }\n  }\n  return out;\n}\n\nfunction uniqueValues(raw: string[]): string[] {\n  return [...new Set(raw.filter(Boolean))];\n}\n\nfunction parseGcsCredentialsJson(raw: string): unknown {\n  try {\n    return JSON.parse(raw);\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    throw new Error(`OPENGENI_OBJECT_STORAGE_GCS_CREDENTIALS_JSON must be valid JSON: ${message}`, {\n      cause: error,\n    });\n  }\n}\n\nfunction delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n/** Native Claude connections reuse the encrypted workspace and organization boundaries. */\nexport const CLAUDE_CONNECTION_KINDS = [\"anthropic\", \"claude_subscription\"] as const;\nexport type ClaudeConnectionKind = (typeof CLAUDE_CONNECTION_KINDS)[number];\n// Per-model native Messages controls. Unknown IDs never inherit adaptive\n// thinking merely because they share a provider with a supported model.\nconst CLAUDE_NATIVE_MODEL_PROFILES: Readonly<\n  Record<\n    string,\n    Readonly<{\n      efforts: readonly ReasoningEffort[];\n      defaultEffort: ReasoningEffort | null;\n      contextWindowTokens: number;\n      maxOutputTokens: number;\n      autoCompactTokenLimit?: number;\n      prefixBoundThinking?: boolean;\n      /**\n       * The model writes its notes for the person between tool calls as\n       * progress-update `thinking` blocks instead of `text` blocks. Requests\n       * use `thinking.display: \"updates\"` so those blocks, and only those,\n       * carry readable text (Anthropic's documented way to tell them apart\n       * from reasoning).\n       */\n      progressUpdates?: boolean;\n    }>\n  >\n> = Object.fromEntries([\n  ...[\n    [\"claude-opus-5-5\", \"medium\"],\n    [\"claude-sonnet-5-5\", \"medium\"],\n    [\"claude-haiku-5-5\", \"medium\"],\n    [\"claude-opus-5\", \"high\"],\n    [\"claude-sonnet-5\", \"high\"],\n    [\"claude-opus-4-8\", \"high\"],\n    [\"claude-opus-4-7\", \"xhigh\"],\n  ].map(([id, defaultEffort]) => [\n    id,\n    {\n      efforts: [\"low\", \"medium\", \"high\", \"xhigh\", \"max\"],\n      defaultEffort,\n      contextWindowTokens: 1_000_000,\n      maxOutputTokens: 128_000,\n      prefixBoundThinking:\n        id === \"claude-opus-5-5\" || id === \"claude-sonnet-5-5\" || id === \"claude-haiku-5-5\",\n      ...(id === \"claude-opus-5-5\" || id === \"claude-sonnet-5-5\" ? { progressUpdates: true } : {}),\n      ...(id === \"claude-haiku-5-5\"\n        ? { autoCompactTokenLimit: 95_000 }\n        : id === \"claude-opus-5-5\"\n          ? { autoCompactTokenLimit: OPUS_5_5_AUTO_COMPACT_TOKEN_LIMIT }\n          : {}),\n    },\n  ]),\n  ...[\"claude-opus-4-6\", \"claude-sonnet-4-6\"].map((id) => [\n    id,\n    {\n      efforts: [\"low\", \"medium\", \"high\", \"max\"],\n      defaultEffort: \"high\",\n      contextWindowTokens: 1_000_000,\n      maxOutputTokens: 128_000,\n    },\n  ]),\n  [\n    \"claude-haiku-4-5-20251001\",\n    {\n      efforts: [],\n      defaultEffort: null,\n      contextWindowTokens: 200_000,\n      maxOutputTokens: 64_000,\n    },\n  ],\n]);\nexport function claudeNativeModelProfile(upstreamModelId: string) {\n  return Object.hasOwn(CLAUDE_NATIVE_MODEL_PROFILES, upstreamModelId)\n    ? CLAUDE_NATIVE_MODEL_PROFILES[upstreamModelId]\n    : undefined;\n}\n/**\n * Models a new Claude connection offers without anyone adding them. Seeded\n * once per scope and connection kind, only when that scope never configured\n * Claude models; a removed model stays removed.\n */\nexport const CLAUDE_DEFAULT_CONNECTION_MODEL_IDS = [\n  \"claude-opus-5-5\",\n  \"claude-sonnet-5-5\",\n  \"claude-haiku-5-5\",\n] as const;\nexport function claudeProviderId(\n  kind: ClaudeConnectionKind,\n  scope: \"workspace\" | \"organization\" = \"organization\",\n): string {\n  return `${scope}-${kind === \"anthropic\" ? \"anthropic\" : \"claude-subscription\"}`;\n}\nexport type ClaudeConnectionCatalog = Partial<\n  Record<\n    ClaudeConnectionKind,\n    {\n      active?: boolean;\n      models: readonly { upstreamModelId: string; label?: string | null }[];\n    }\n  >\n>;\nexport function withClaudeConnectionCatalog(\n  settings: Settings,\n  connections: ClaudeConnectionCatalog,\n  scope: \"workspace\" | \"organization\" = \"organization\",\n): Settings {\n  let providers = parseModelProvidersJson(settings.modelProvidersJson);\n  for (const kind of CLAUDE_CONNECTION_KINDS) {\n    if (kind === \"claude_subscription\" && !settings.claudeSubscriptionEnabled) {\n      providers = providers.filter((provider) => provider.id !== claudeProviderId(kind, scope));\n      continue;\n    }\n    const connection = connections[kind];\n    if (!connection) continue;\n    const id = claudeProviderId(kind, scope);\n    providers = providers.filter((provider) => provider.id !== id);\n    if (!connection.models.length) continue;\n    providers.push({\n      id,\n      label: kind === \"anthropic\" ? \"Anthropic API\" : \"Claude subscription\",\n      kind: kind === \"anthropic\" ? `anthropic-${scope}` : `claude-subscription-${scope}`,\n      api: \"anthropic-messages\",\n      wireProfile: \"openai\",\n      baseUrl: \"https://api.anthropic.com/v1\",\n      anthropic: {\n        auth: kind === \"anthropic\" ? \"api-key\" : \"oauth\",\n        cacheTtl: \"5m\",\n        maxOutputTokens: 128000,\n        streamIdleTimeoutMs: 600000,\n      },\n      models: connection.models.map((model) => {\n        const profile = claudeNativeModelProfile(model.upstreamModelId);\n        const adaptiveThinking = Boolean(profile?.efforts.length);\n        const contextWindowTokens = profile?.contextWindowTokens ?? 200_000;\n        const outputReserve = profile?.maxOutputTokens ?? 32_000;\n        return {\n          contextWindowTokens,\n          effectiveContextWindowTokens: contextWindowTokens - outputReserve,\n          autoCompactTokenLimit:\n            profile?.autoCompactTokenLimit ??\n            (contextWindowTokens === 1_000_000\n              ? 800_000\n              : Math.min(150_000, contextWindowTokens - outputReserve - 18_000)),\n          id: id + \"/\" + model.upstreamModelId,\n          upstreamModelId: model.upstreamModelId,\n          label:\n            model.label ??\n            (model.upstreamModelId === \"claude-opus-5-5\"\n              ? \"Claude Opus 5.5\"\n              : model.upstreamModelId === \"claude-sonnet-5-5\"\n                ? \"Claude Sonnet 5.5\"\n                : model.upstreamModelId === \"claude-haiku-5-5\"\n                  ? \"Claude Haiku 5.5\"\n                  : model.upstreamModelId),\n          reasoningEffort: adaptiveThinking,\n          // Claude's server-side web search runs on every Claude route (API\n          // key and subscription) under the deployment's web search switch.\n          hostedWebSearch: settings.webSearchEnabled,\n          capabilities: {\n            ...legacyModelCapabilities(settings, {\n              reasoningEffort: adaptiveThinking,\n              hostedWebSearch: settings.webSearchEnabled,\n              vision: true,\n            }),\n            inputFileMediaTypes: [],\n            reasoning: {\n              upstream: adaptiveThinking ? \"supported\" : \"unknown\",\n              runnable: adaptiveThinking,\n              efforts: [...(profile?.efforts ?? [])],\n              defaultEffort: profile?.defaultEffort ?? null,\n              required: false,\n            },\n            functionCalling: { upstream: \"supported\", runnable: true },\n            promptCaching: { upstream: \"supported\", runnable: true, mode: \"automatic\" },\n          },\n        };\n      }),\n    });\n  }\n  return { ...settings, modelProvidersJson: JSON.stringify(providers) };\n}\nexport function withClaudeConnectionCredential(\n  settings: Settings,\n  kind: ClaudeConnectionKind,\n  credential: string,\n  scope: \"workspace\" | \"organization\" = \"organization\",\n  credentialBinding?: { connectionId: string; credentialVersion: number },\n): Settings {\n  if (kind === \"claude_subscription\" && !settings.claudeSubscriptionEnabled)\n    throw new Error(\"Claude subscriptions are not enabled on this deployment\");\n  if (!credential.trim()) throw new Error(\"Claude credential is empty\");\n  const bundle =\n    kind === \"claude_subscription\" && credential.trim().startsWith(\"{\")\n      ? ClaudeSubscriptionCredential.parse(JSON.parse(credential))\n      : null;\n  return {\n    ...settings,\n    modelProvidersJson: JSON.stringify(\n      parseModelProvidersJson(settings.modelProvidersJson).map((provider) =>\n        provider.id === claudeProviderId(kind, scope)\n          ? {\n              ...provider,\n              apiKey: bundle?.token ?? credential,\n              ...(kind === \"claude_subscription\" && provider.anthropic\n                ? {\n                    anthropic: {\n                      ...provider.anthropic,\n                      identity: bundle?.identity,\n                      credentialBinding: credentialBinding\n                        ? {\n                            connectionId: credentialBinding.connectionId,\n                            credentialVersion: credentialBinding.credentialVersion,\n                          }\n                        : undefined,\n                    },\n                  }\n                : {}),\n            }\n          : provider,\n      ),\n    ),\n  };\n}\nexport * from \"./claude-subscription-usage\";\nexport * from \"./claude-subscription-oauth\";\nexport * from \"./subscription-account-selection\";\nexport * from \"./claude-subscription-capacity\";\n","import {\n  ClaudeUsageWindowId,\n  type ClaudeSubscriptionUsage,\n  type ClaudeUsageWindow,\n  type ClaudeUsageRequestStatus,\n} from \"@opengeni/contracts\";\n\nexport type ClaudeUsageObservation = {\n  windows: ClaudeUsageWindow[];\n  observedAt: string;\n  source: \"response_headers\" | \"provider\";\n  requestStatus?: ClaudeUsageRequestStatus | null;\n  requestRestrictions?: ClaudeUsageRequestStatus[];\n};\nconst prefixes: Record<string, string[]> = {\n  five_hour: [\"5h\"],\n  seven_day: [\"7d\"],\n  seven_day_opus: [\"7d-opus\"],\n  seven_day_sonnet: [\"7d-sonnet\"],\n  seven_day_overage_included: [\"7d_oi\", \"7d-overage-included\"],\n  overage: [\"overage\"],\n};\nfunction percent(value: unknown, scale: number): number | null {\n  if (typeof value !== \"number\" && (typeof value !== \"string\" || !value.trim())) return null;\n  const number = Number(value) * scale;\n  return Number.isFinite(number) && number >= 0 ? number : null;\n}\nfunction epoch(value: string | null): string | null {\n  if (!value || !/^\\d+(?:\\.\\d+)?$/.test(value)) return null;\n  const time = Number(value) * 1000;\n  return Number.isFinite(time) && time > 0 && time < 8.64e15 ? new Date(time).toISOString() : null;\n}\nfunction status(value: unknown): ClaudeUsageWindow[\"status\"] {\n  return value === \"allowed\" || value === \"allowed_warning\" || value === \"rejected\" ? value : null;\n}\n\nfunction latestReset(left: string | null, right: string | null, observedAt: string): string {\n  return new Date(\n    Math.max(\n      left ? Date.parse(left) : Date.parse(observedAt) + 60_000,\n      right ? Date.parse(right) : Date.parse(observedAt) + 60_000,\n    ),\n  ).toISOString();\n}\n\nfunction evidenceKey(item: ClaudeUsageRequestStatus): string {\n  // A legacy Sonnet claim does not prove an account-wide restriction cleared.\n  return JSON.stringify([\n    item.upstreamModelId,\n    item.upstreamModelId ? null : item.representativeClaim,\n    item.source === \"provider\",\n  ]);\n}\n\nfunction tiedRequest(\n  left: ClaudeUsageRequestStatus,\n  right: ClaudeUsageRequestStatus,\n): ClaudeUsageRequestStatus {\n  const denied = left.status === \"rejected\" ? left : right.status === \"rejected\" ? right : null;\n  return {\n    ...(denied ?? left),\n    resetsAt: denied\n      ? latestReset(\n          left.status === \"rejected\" ? left.resetsAt : denied.resetsAt,\n          right.status === \"rejected\" ? right.resetsAt : denied.resetsAt,\n          left.observedAt,\n        )\n      : null,\n    representativeClaim:\n      left.representativeClaim === right.representativeClaim ? left.representativeClaim : null,\n    status: denied ? \"rejected\" : null,\n    overageStatus: null,\n    overageResetsAt: null,\n  };\n}\n\nexport function parseClaudeUsageHeaders(\n  headers: Headers,\n  now = new Date(),\n  upstreamModelId?: string,\n): ClaudeUsageObservation | null {\n  const observedAt = now.toISOString();\n  const claim = ClaudeUsageWindowId.safeParse(\n    headers.get(\"anthropic-ratelimit-unified-representative-claim\"),\n  );\n  const claimedStatus = status(headers.get(\"anthropic-ratelimit-unified-status\"));\n  const claimedReset = epoch(headers.get(\"anthropic-ratelimit-unified-reset\"));\n  const overageStatus = status(headers.get(\"anthropic-ratelimit-unified-overage-status\"));\n  const overageResetsAt = epoch(headers.get(\"anthropic-ratelimit-unified-overage-reset\"));\n  const windows = ClaudeUsageWindowId.options.flatMap((id) => {\n    const header = (suffix: string) =>\n      prefixes[id]!.map((prefix) =>\n        headers.get(`anthropic-ratelimit-unified-${prefix}-${suffix}`),\n      ).find((value) => value !== null) ?? null;\n    const representative = claim.success && claim.data === id;\n    const usedPercent = percent(header(\"utilization\"), 100);\n    const resetsAt = epoch(header(\"reset\")) ?? (representative ? claimedReset : null);\n    const windowStatus = status(header(\"status\")) ?? (representative ? claimedStatus : null);\n    if (usedPercent === null && resetsAt === null && windowStatus === null) return [];\n    return [{ id, usedPercent, resetsAt, status: windowStatus, observedAt }];\n  });\n  return windows.length || claimedStatus || overageStatus\n    ? {\n        windows,\n        observedAt,\n        source: \"response_headers\",\n        requestStatus: {\n          status: claimedStatus,\n          resetsAt: claimedReset,\n          representativeClaim: claim.success ? claim.data : null,\n          overageStatus,\n          overageResetsAt,\n          upstreamModelId: upstreamModelId ?? null,\n          observedAt,\n        },\n      }\n    : null;\n}\n\nexport function parseClaudeUsageResponse(\n  value: unknown,\n  now = new Date(),\n): ClaudeUsageObservation | null {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return null;\n  const observedAt = now.toISOString();\n  const windows = ClaudeUsageWindowId.options.flatMap((id) => {\n    const window = (value as Record<string, unknown>)[id];\n    if (!window || typeof window !== \"object\" || Array.isArray(window)) return [];\n    const fields = window as Record<string, unknown>;\n    const usedPercent = percent(fields.utilization, 1);\n    const time = typeof fields.resets_at === \"string\" ? Date.parse(fields.resets_at) : NaN;\n    const resetsAt = Number.isFinite(time) ? new Date(time).toISOString() : null;\n    if (usedPercent === null && resetsAt === null) return [];\n    return [{ id, usedPercent, resetsAt, status: null, observedAt }];\n  });\n  return windows.length ? { windows, observedAt, source: \"provider\" } : null;\n}\n\nexport function emptyClaudeUsage(credentialVersion: number | null): ClaudeSubscriptionUsage {\n  return {\n    connected: credentialVersion !== null,\n    credentialVersion,\n    windows: [],\n    observedAt: null,\n    source: null,\n    refreshStatus: \"not_checked\",\n    refreshCheckedAt: null,\n  };\n}\n\n/** Preserve omitted windows and reject observations older than their individual window. */\nexport function mergeClaudeUsage(\n  current: ClaudeSubscriptionUsage,\n  observation: ClaudeUsageObservation,\n): ClaudeSubscriptionUsage {\n  const windows = new Map(current.windows.map((window) => [window.id, window]));\n  for (const incomingWindow of observation.windows) {\n    const window = { ...incomingWindow, source: incomingWindow.source ?? observation.source };\n    const previous = windows.get(window.id);\n    if (!previous || previous.observedAt < window.observedAt) windows.set(window.id, window);\n    else if (\n      previous.observedAt === window.observedAt &&\n      JSON.stringify(previous) !== JSON.stringify(window)\n    ) {\n      const rejected = previous.status === \"rejected\" || window.status === \"rejected\";\n      const full = (previous.usedPercent ?? 0) >= 100 || (window.usedPercent ?? 0) >= 100;\n      windows.set(window.id, {\n        ...previous,\n        usedPercent:\n          previous.usedPercent === null\n            ? window.usedPercent\n            : window.usedPercent === null\n              ? previous.usedPercent\n              : Math.max(previous.usedPercent, window.usedPercent),\n        status: rejected ? \"rejected\" : previous.status === window.status ? previous.status : null,\n        resetsAt:\n          rejected || full\n            ? latestReset(previous.resetsAt, window.resetsAt, window.observedAt)\n            : previous.resetsAt === window.resetsAt\n              ? previous.resetsAt\n              : null,\n        source:\n          previous.source === \"response_headers\" || window.source === \"response_headers\"\n            ? \"response_headers\"\n            : \"provider\",\n      });\n    }\n  }\n  const incoming = observation.requestStatus;\n  const restrictions = new Map(\n    (current.requestRestrictions ?? []).map((item) => [evidenceKey(item), item]),\n  );\n  // Legacy snapshots also contribute their denial; a different model's success\n  // must not erase a restriction with an unknown representative claim.\n  for (const item of [\n    current.requestStatus?.status ? current.requestStatus : null,\n    ...(observation.requestRestrictions ?? []),\n    incoming?.status ? incoming : null,\n  ]) {\n    if (!item) continue;\n    const key = evidenceKey(item);\n    const previous = restrictions.get(key);\n    const sanitized = {\n      ...item,\n      overageStatus: null,\n      overageResetsAt: null,\n    };\n    if (!previous || item.observedAt > previous.observedAt) restrictions.set(key, sanitized);\n    else if (\n      item.observedAt === previous.observedAt &&\n      JSON.stringify(previous) !== JSON.stringify(sanitized)\n    )\n      restrictions.set(key, tiedRequest(previous, sanitized));\n  }\n  // Direct refreshes can precede late turn finalizers. Retain each direct\n  // window's watermark even when no model restriction is present yet.\n  const directWindows = [\n    ...current.windows.filter(\n      (window) =>\n        window.source === \"provider\" ||\n        (!window.source &&\n          current.source === \"provider\" &&\n          current.observedAt === window.observedAt),\n    ),\n    ...observation.windows.filter((window) => (window.source ?? observation.source) === \"provider\"),\n  ];\n  for (const window of directWindows) {\n    if (window.usedPercent === null || window.usedPercent >= 100) continue;\n    const proof: ClaudeUsageRequestStatus = {\n      status: null,\n      resetsAt: null,\n      representativeClaim: window.id,\n      upstreamModelId: null,\n      overageStatus: null,\n      overageResetsAt: null,\n      observedAt: window.observedAt,\n      source: \"provider\",\n    };\n    const key = evidenceKey(proof);\n    if (!restrictions.has(key) || restrictions.get(key)!.observedAt < proof.observedAt)\n      restrictions.set(key, proof);\n  }\n  for (const [key, item] of restrictions) {\n    if (item.status !== \"rejected\") continue;\n    const proof = [...restrictions.values()].find(\n      (candidate) =>\n        candidate.source === \"provider\" &&\n        candidate.representativeClaim === item.representativeClaim &&\n        candidate.observedAt > item.observedAt &&\n        candidate.representativeClaim !== \"overage\" &&\n        candidate.representativeClaim !== \"seven_day_overage_included\",\n    );\n    if (proof)\n      restrictions.set(key, {\n        ...item,\n        status: null,\n        resetsAt: null,\n        observedAt: proof.observedAt,\n      });\n  }\n  // Bound persisted state without dropping denials: overflow collapses to a\n  // conservative account-wide restriction until the latest known reset.\n  let requestRestrictions = [...restrictions.values()];\n  const evidenceTime = requestRestrictions.reduce(\n    (value, item) => (item.observedAt > value ? item.observedAt : value),\n    observation.observedAt,\n  );\n  const liveDenials = requestRestrictions.filter(\n    (item) =>\n      item.status === \"rejected\" &&\n      (item.resetsAt ? Date.parse(item.resetsAt) : Date.parse(item.observedAt) + 60_000) >\n        Date.parse(evidenceTime),\n  );\n  if (requestRestrictions.length > 64 && liveDenials.length === 0) {\n    requestRestrictions = requestRestrictions\n      .sort((left, right) => right.observedAt.localeCompare(left.observedAt))\n      .slice(0, 64);\n  } else if (requestRestrictions.length > 64) {\n    const observedAt = evidenceTime;\n    const resetsAt = new Date(\n      Math.max(\n        ...liveDenials.map((item) =>\n          item.resetsAt ? Date.parse(item.resetsAt) : Date.parse(item.observedAt) + 60_000,\n        ),\n        Date.parse(observedAt) + 60_000,\n      ),\n    ).toISOString();\n    requestRestrictions = [\n      {\n        status: \"rejected\",\n        resetsAt,\n        representativeClaim: null,\n        overageStatus: null,\n        overageResetsAt: null,\n        upstreamModelId: null,\n        observedAt,\n      },\n    ];\n  }\n  const newest = !current.observedAt || current.observedAt < observation.observedAt;\n  const tied = current.observedAt === observation.observedAt;\n  let requestStatus = current.requestStatus ?? null;\n  if (newest) requestStatus = incoming ?? null;\n  else if (tied && JSON.stringify(requestStatus) !== JSON.stringify(incoming ?? null)) {\n    // Millisecond timestamps do not order concurrent responses. Never restore\n    // paid authority or erase a denial on an ambiguous tie.\n    requestStatus =\n      incoming && requestStatus && evidenceKey(incoming) === evidenceKey(requestStatus)\n        ? tiedRequest(requestStatus, incoming)\n        : null;\n  }\n  return {\n    ...current,\n    requestRestrictions,\n    requestStatus,\n    windows: ClaudeUsageWindowId.options.flatMap((id) =>\n      windows.has(id) ? [windows.get(id)!] : [],\n    ),\n    ...(newest\n      ? {\n          observedAt: observation.observedAt,\n          source: observation.source,\n          // A newer direct or partial observation cannot retain an older paid\n          // fallback authorization. Window readings remain independently merged.\n        }\n      : {}),\n  };\n}\n","import { z } from \"zod\";\n\n/** Claude Code 2.1.285's installed OAuth flow; model calls and profile reads only. */\nexport const CLAUDE_OAUTH_CLIENT_ID = \"9d1c250a-e61b-44d9-88ed-5944d1962f5e\";\nexport const CLAUDE_OAUTH_AUTHORIZE_URL = \"https://claude.com/cai/oauth/authorize\";\nexport const CLAUDE_OAUTH_TOKEN_URL = \"https://platform.claude.com/v1/oauth/token\";\nexport const CLAUDE_OAUTH_REDIRECT_URL = \"https://platform.claude.com/oauth/code/callback\";\nexport const CLAUDE_OAUTH_SCOPES = [\"user:inference\", \"user:profile\"] as const;\n\nexport const ClaudeOAuthTokenResponse = z\n  .object({\n    access_token: z\n      .string()\n      .max(16384)\n      .regex(/^sk-ant-oat[0-9]+-\\S+$/),\n    refresh_token: z.string().min(1).max(16384).optional(),\n    expires_in: z.number().int().positive().max(31536000),\n    scope: z.string().min(1).max(8192),\n  })\n  .passthrough();\n\nexport function claudeAuthorizationUrl(input: { challenge: string; state: string }) {\n  const url = new URL(CLAUDE_OAUTH_AUTHORIZE_URL);\n  url.searchParams.set(\"code\", \"true\");\n  url.searchParams.set(\"client_id\", CLAUDE_OAUTH_CLIENT_ID);\n  url.searchParams.set(\"response_type\", \"code\");\n  url.searchParams.set(\"redirect_uri\", CLAUDE_OAUTH_REDIRECT_URL);\n  url.searchParams.set(\"scope\", CLAUDE_OAUTH_SCOPES.join(\" \"));\n  url.searchParams.set(\"code_challenge\", input.challenge);\n  url.searchParams.set(\"code_challenge_method\", \"S256\");\n  url.searchParams.set(\"state\", input.state);\n  return url.toString();\n}\n","/** Stable account affinity shared by subscription providers. Candidate order is durable creation order. */\nexport function subscriptionAccountShardIndex(sessionId: string, candidateCount: number): number {\n  if (!Number.isSafeInteger(candidateCount) || candidateCount <= 0)\n    throw new Error(\"Subscription shard candidate count must be positive\");\n  let hash = 0x811c9dc5;\n  for (let index = 0; index < sessionId.length; index += 1) {\n    hash ^= sessionId.charCodeAt(index);\n    hash = Math.imul(hash, 0x01000193);\n  }\n  return (hash >>> 0) % candidateCount;\n}\n\n/**\n * Manual pins are binding even when unavailable. Policy homes remain sticky only\n * while rotation is on; an exhausted home re-shards over the eligible survivors.\n * Selection never changes the pool's active pointer.\n */\nexport function selectSubscriptionAccount<T extends { id: string }>(input: {\n  sessionId: string;\n  eligible: readonly T[];\n  rotationEnabled: boolean;\n  activeCredentialId: string | null;\n  pinnedCredentialId: string | null;\n  pinSource: \"manual\" | \"policy\" | null;\n}): T | null {\n  const pinned = input.eligible.find((account) => account.id === input.pinnedCredentialId);\n  if (input.pinnedCredentialId && input.pinSource !== \"policy\") return pinned ?? null;\n  if (!input.rotationEnabled)\n    return input.eligible.find((account) => account.id === input.activeCredentialId) ?? null;\n  return (\n    pinned ??\n    (input.eligible.length\n      ? input.eligible[subscriptionAccountShardIndex(input.sessionId, input.eligible.length)]!\n      : null)\n  );\n}\n","import type { ClaudeSubscriptionUsage, ClaudeUsageWindow } from \"@opengeni/contracts\";\n\nconst UNKNOWN_RESET_RECHECK_MS = 60_000;\nconst allowed = (status: ClaudeUsageWindow[\"status\"]) =>\n  status === \"allowed\" || status === \"allowed_warning\";\n\n/** Evaluate provider-reported plan capacity and its explicitly allowed paid fallback. */\nexport function claudeSubscriptionCapacity(\n  usage: ClaudeSubscriptionUsage,\n  upstreamModelId: string,\n  now: Date,\n  options: { allowOverage?: boolean } = {},\n): { available: boolean; nextCheckAt: Date | null; blockingWindows: ClaudeUsageWindow[\"id\"][] } {\n  const available = { available: true, nextCheckAt: null, blockingWindows: [] };\n  if (!usage.connected || usage.refreshStatus === \"reconnect\")\n    return { ...available, available: false };\n  const relevant = (id: ClaudeUsageWindow[\"id\"]): boolean => {\n    if (id === \"seven_day_opus\") return /^claude-opus-/.test(upstreamModelId);\n    if (id === \"seven_day_sonnet\") return /^claude-sonnet-/.test(upstreamModelId);\n    return id === \"five_hour\" || id === \"seven_day\";\n  };\n  const applicable = usage.windows.filter((window) => relevant(window.id));\n  const relevantClaim = (id: ClaudeUsageWindow[\"id\"] | null) =>\n    id === \"seven_day_opus\" || id === \"seven_day_sonnet\" ? relevant(id) : true;\n  const restrictions = (usage.requestRestrictions ?? []).filter(\n    (item) =>\n      item.status === \"rejected\" &&\n      (item.upstreamModelId === upstreamModelId ||\n        (item.upstreamModelId === null && relevantClaim(item.representativeClaim))) &&\n      !applicable.some(\n        (window) =>\n          window.source === \"provider\" &&\n          window.usedPercent !== null &&\n          window.usedPercent < 100 &&\n          window.id === item.representativeClaim &&\n          window.observedAt > item.observedAt,\n      ) &&\n      (item.resetsAt\n        ? Date.parse(item.resetsAt)\n        : Date.parse(item.observedAt) + UNKNOWN_RESET_RECHECK_MS) > now.getTime(),\n  );\n  const blocking = applicable.filter((window) => {\n    if (\n      (window.resetsAt\n        ? Date.parse(window.resetsAt)\n        : Date.parse(window.observedAt) + UNKNOWN_RESET_RECHECK_MS) <= now.getTime()\n    )\n      return false;\n    return (\n      window.status === \"rejected\" || (window.status === null && (window.usedPercent ?? 0) >= 100)\n    );\n  });\n  const request = usage.requestStatus;\n  const exactModel = request?.upstreamModelId === upstreamModelId;\n  const relevantRequest =\n    request &&\n    (exactModel ||\n      (request.upstreamModelId === null && relevantClaim(request.representativeClaim)));\n  const freshRequest =\n    relevantRequest &&\n    applicable.every((window) => window.observedAt <= request.observedAt) &&\n    restrictions.every((item) => item.observedAt <= request.observedAt);\n  const planResetElapsed =\n    request &&\n    (request.resetsAt\n      ? Date.parse(request.resetsAt)\n      : Date.parse(request.observedAt) + UNKNOWN_RESET_RECHECK_MS) <= now.getTime();\n  const exactAllowance = (usage.requestRestrictions ?? []).find(\n    (item) =>\n      item.upstreamModelId === upstreamModelId &&\n      allowed(item.status) &&\n      blocking.every((window) => window.observedAt < item.observedAt) &&\n      restrictions.every((restriction) => restriction.observedAt < item.observedAt),\n  );\n  if (exactAllowance) return available;\n  // An allowed response for Sonnet never overrides an independently observed\n  // Opus cap. Only the exact model's fresh response proves overall dispatch.\n  if (freshRequest && exactModel && allowed(request.status) && !planResetElapsed) return available;\n  const mayUseOverage = options.allowOverage !== false;\n  const overageResetElapsed =\n    request?.overageResetsAt && Date.parse(request.overageResetsAt) <= now.getTime();\n  if (\n    freshRequest &&\n    request.status === \"rejected\" &&\n    mayUseOverage &&\n    allowed(request.overageStatus) &&\n    !overageResetElapsed\n  )\n    return available;\n  const rejectedRequest = freshRequest && request.status === \"rejected\" && !planResetElapsed;\n  if (blocking.length === 0 && !rejectedRequest && restrictions.length === 0) return available;\n  // An extra-usage balance is a separate fallback. Its rejection does not block\n  // an available base plan or delay the next base-plan reset to a monthly date.\n  const resets = blocking.map((window) =>\n    window.resetsAt\n      ? Date.parse(window.resetsAt)\n      : Date.parse(window.observedAt) + UNKNOWN_RESET_RECHECK_MS,\n  );\n  if (rejectedRequest)\n    resets.push(\n      request.resetsAt\n        ? Date.parse(request.resetsAt)\n        : Date.parse(request.observedAt) + UNKNOWN_RESET_RECHECK_MS,\n    );\n  resets.push(\n    ...restrictions.map((item) =>\n      item.resetsAt\n        ? Date.parse(item.resetsAt)\n        : Date.parse(item.observedAt) + UNKNOWN_RESET_RECHECK_MS,\n    ),\n  );\n  let nextCheckAt = Math.max(...resets);\n  if (\n    rejectedRequest &&\n    mayUseOverage &&\n    request.overageStatus === \"rejected\" &&\n    request.overageResetsAt\n  ) {\n    const overageReset = Date.parse(request.overageResetsAt);\n    // A known reset permits a new authoritative probe, never invents a reading.\n    if (overageReset <= now.getTime()) return available;\n    nextCheckAt = Math.min(nextCheckAt, overageReset);\n  }\n  return {\n    available: false,\n    nextCheckAt: new Date(nextCheckAt),\n    blockingWindows: blocking.map((window) => window.id),\n  };\n}\n"],"mappings":";;;;;;;;;;AACO,SAAS,wBACd,mBACA,OACS;AACT,SACE,sBAAsB,UACrB,OAAO,UAAU,YAChB,kBAAkB,KAAK,CAACA,aAAYA,SAAQ,YAAY,MAAM,MAAM,KAAK,EAAE,YAAY,CAAC;AAE9F;;;ACVA,SAAS,SAAS;AAiBlB,IAAM,6BAA6B,EAChC,OAAO;AAAA,EACN,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAW;AAAA,EAC5D,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO,EAAE,SAAS;AAC3D,CAAC,EACA,OAAO;AAGH,IAAM,+BAA+B;AAE5C,SAAS,UAAU,KAAa,KAAsB;AACpD,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,UAAM,IAAI,MAAM,GAAG,GAAG,qBAAqB;AAAA,EAC7C;AACF;AAEA,SAAS,OAAO,OAA2B;AACzC,SAAO,MAAM,OACV,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,EACtE,KAAK,IAAI;AACd;AAGO,SAAS,8BACd,KACA,MAAM,2BACuB;AAC7B,MAAI,QAAQ,UAAa,IAAI,KAAK,MAAM,GAAI,QAAO;AACnD,QAAM,SAAS,2BAA2B,UAAU,UAAU,KAAK,GAAG,CAAC;AACvE,MAAI,CAAC,OAAO,QAAS,OAAM,IAAI,MAAM,GAAG,GAAG,gBAAgB,OAAO,OAAO,KAAK,CAAC,EAAE;AACjF,SAAO,OAAO;AAChB;AAMO,SAAS,mCACd,KACA,MAAM,iCACgC;AACtC,MAAI,QAAQ,UAAa,IAAI,KAAK,MAAM,GAAI,QAAO,CAAC;AACpD,QAAM,SAAS,EACZ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,GAAG,0BAA0B,EAC7D,UAAU,UAAU,KAAK,GAAG,CAAC;AAChC,MAAI,CAAC,OAAO,QAAS,OAAM,IAAI,MAAM,GAAG,GAAG,gBAAgB,OAAO,OAAO,KAAK,CAAC,EAAE;AACjF,SAAO,OAAO;AAChB;AAGO,SAAS,gCACd,SACA,mBAIA;AACA,QAAM,WAAW,OAAO,QAAQ,eAAe;AAC/C,QAAM,UACH,WAAW,OAAO,OAAU,qBAAqB,QAAQ,aAAa,EAAE,IAAI,SAAU;AACzF,SAAO,EAAE,oBAAoB,OAAO,QAAQ,GAAG,kBAAkB,OAAO,MAAM,EAAE;AAClF;AAGO,SAAS,4BAA4B,WAAiB,eAA6B;AACxF,QAAM,UAAU,KAAK,IAAI,GAAG,cAAc,QAAQ,IAAI,UAAU,QAAQ,CAAC;AACzE,SAAO,KAAK,IAAI,GAAG,KAAK,KAAK,UAAU,GAAM,CAAC;AAChD;;;ACtFA,SAAS,KAAAC,UAAS;AAkBX,IAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIO,IAAM,8BAAmD;AAGzD,IAAM,uBAAuB;AAC7B,IAAM,sBAAsB;AAS5B,IAAM,sBAAsBA,GAAE,KAAK,CAAC,UAAU,UAAU,CAAC;AA4BzD,IAAM,8BAET;AAAA,EACF,UAAU;AAAA,IACR,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA,IAEP,QAAQ;AAAA,MACN,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAClB;AAAA,IACA,OAAO;AAAA,MACL,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,EACd;AAAA,EACA,UAAU;AAAA,IACR,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA,IAEP,QAAQ;AAAA,MACN,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAClB;AAAA,IACA,OAAO,EAAE,iBAAiB,KAAO,aAAa,MAAM,gBAAgB,0BAA0B;AAAA,IAC9F,YAAY;AAAA,EACd;AAAA,EACA,YAAY;AAAA,IACV,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA,IAEP,QAAQ;AAAA,MACN,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAClB;AAAA,IACA,OAAO;AAAA,IACP,YAAY;AAAA,EACd;AAAA,EACA,KAAK;AAAA,IACH,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA,IAEP,QAAQ,EAAE,iBAAiB,KAAO,aAAa,MAAM,gBAAgB,qBAAqB;AAAA,IAC1F,OAAO,EAAE,iBAAiB,KAAO,aAAa,MAAM,gBAAgB,qBAAqB;AAAA,IACzF,YAAY;AAAA,EACd;AAAA,EACA,QAAQ;AAAA,IACN,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA,IAEP,QAAQ,EAAE,iBAAiB,KAAO,aAAa,MAAM,gBAAgB,yBAAyB;AAAA,IAC9F,OAAO,EAAE,iBAAiB,MAAO,aAAa,MAAM,gBAAgB,yBAAyB;AAAA,IAC7F,YAAY;AAAA,EACd;AAAA,EACA,WAAW;AAAA,IACT,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA,IAEP,QAAQ;AAAA,MACN,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAClB;AAAA,IACA,OAAO;AAAA,MACL,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,EACd;AAAA,EACA,OAAO;AAAA,IACL,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA,IAEP,QAAQ;AAAA,MACN,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,gBAAgB;AAAA,IAClB;AAAA,IACA,OAAO;AAAA,IACP,YAAY;AAAA,EACd;AAAA,EACA,MAAM;AAAA,IACJ,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA;AAAA,IAGP,QAAQ,EAAE,iBAAiB,KAAK,aAAa,MAAM,gBAAgB,oBAAoB;AAAA,IACvF,OAAO,EAAE,iBAAiB,KAAK,aAAa,OAAO,gBAAgB,oBAAoB;AAAA,IACvF,YAAY;AAAA,EACd;AAAA,EACA,SAAS;AAAA,IACP,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA,IAEP,QAAQ,EAAE,iBAAiB,GAAG,aAAa,OAAO,gBAAgB,KAAK;AAAA,IACvE,OAAO;AAAA,IACP,YAAY;AAAA,EACd;AACF;AAEA,SAAS,gBAAgB,IAAiC;AACxD,SAAO,GAAG,YAAY;AACxB;AAGO,SAAS,2BAA2B,IAAiC;AAC1E,SAAO,gBAAgB,gBAAgB,EAAE,CAAC;AAC5C;AAGO,SAAS,4BAA4B,IAAiC;AAC3E,SAAO,gBAAgB,gBAAgB,EAAE,CAAC;AAC5C;AAGO,SAAS,gCAA0C;AACxD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,wBAAwB,QAAQ,CAAC,OAAO;AAAA,MACzC,2BAA2B,EAAE;AAAA,MAC7B,4BAA4B,EAAE;AAAA,IAChC,CAAC;AAAA;AAAA,IAED;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAMO,IAAM,qCAAqCA,GAC/C;AAAA,EACCA,GAAE,OAAO;AAAA,EACTA,GAAE,OAAO,EAAE,QAAQA,GAAE,OAAO,EAAE,SAAS,GAAG,SAASA,GAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO;AACrF,EACC,QAAQ,CAAC,CAAC;AAGN,SAAS,oCACd,QAC8B;AAC9B,QAAM,cAA4C,CAAC;AACnD,aAAW,MAAM,yBAAyB;AACxC,UAAM,SAAS,OAAO,2BAA2B,EAAE,CAAC,GAAG,KAAK;AAC5D,UAAM,UAAU,OAAO,4BAA4B,EAAE,CAAC,GAAG,KAAK;AAC9D,QAAI,UAAU,SAAS;AACrB,kBAAY,EAAE,IAAI,EAAE,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC,GAAI,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC,EAAG;AAAA,IACrF;AAAA,EACF;AACA,SAAO;AACT;AAaA,IAAM,yBAAyBA,GAC5B,OAAO;AAAA,EACN,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,GAAU;AAAA,EAC3D,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,GAAU;AAAA,EAC1D,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO,EAAE,SAAS;AAC3D,CAAC,EACA,OAAO;AAEV,IAAM,qBAAqB;AAGpB,IAAM,uBAAuB;AA+CpC,SAAS,aAAa,OAA0C;AAC9D,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,CAAC,QAAS,QAAO;AAErB,MAAI,gDAAgD,KAAK,OAAO,EAAG,QAAO;AAC1E,SAAO;AACT;AAEA,SAAS,kBAAkB,OAA2B,MAA6B;AACjF,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,OAAO;AAAA,EACvB,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,GAAG,IAAI,oCAAoC,EAAE,OAAO,MAAM,CAAC;AAAA,EAC7E;AACA,MAAI,IAAI,aAAa,YAAY,IAAI,aAAa,SAAS;AACzD,UAAM,IAAI,MAAM,GAAG,IAAI,kCAAkC;AAAA,EAC3D;AACA,MAAI,IAAI,YAAY,IAAI,SAAU,OAAM,IAAI,MAAM,GAAG,IAAI,6BAA6B;AACtF,SAAO,IAAI,SAAS,EAAE,QAAQ,SAAS,EAAE;AAC3C;AAEA,SAAS,aAAa,KAAa,UAAkB,WAA+B;AAClF,QAAM,MAA6B,CAAC;AACpC,aAAW,QAAQ,IAAI,MAAM,GAAG,GAAG;AACjC,UAAM,aAAa,KAAK,KAAK,EAAE,YAAY;AAC3C,QAAI,CAAC,WAAY;AACjB,UAAM,UAAU,wBAAwB;AAAA,MACtC,CAAC,OAAO,4BAA4B,EAAE,EAAE,SAAS;AAAA,IACnD;AACA,QAAI,CAAE,QAA8B,SAAS,UAAU,GAAG;AACxD,YAAM,IAAI;AAAA,QACR,GAAG,QAAQ,8CAA8C,QAAQ,KAAK,IAAI,CAAC;AAAA,MAC7E;AAAA,IACF;AACA,QAAI,CAAC,IAAI,SAAS,UAAiC;AACjD,UAAI,KAAK,UAAiC;AAAA,EAC9C;AACA,MAAI,IAAI,WAAW,EAAG,OAAM,IAAI,MAAM,GAAG,QAAQ,oBAAoB;AACrE,SAAO;AACT;AAEA,SAAS,WAAW,UAAkD;AACpE,QAAM,SAAS,SAAS,iBAAiB,KAAK,EAAE,YAAY;AAC5D,MAAI,QAAQ;AACV,UAAM,SAAS,oBAAoB,UAAU,MAAM;AACnD,QAAI,CAAC,OAAO,QAAS,OAAM,IAAI,MAAM,uDAAuD;AAC5F,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,SAAS,SAAS,uBAAuB,KAAK,EAAE,YAAY;AAClE,MAAI,CAAC,UAAU,WAAW,WAAY,QAAO;AAC7C,MAAI,WAAW,UAAW,QAAO;AACjC,QAAM,IAAI,MAAM,+DAA+D;AACjF;AAEA,SAAS,iBAAiB,KAAsE;AAC9F,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,OAAO;AAAA,EAC7B,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,uDAAuD,EAAE,OAAO,MAAM,CAAC;AAAA,EACzF;AACA,QAAM,WAAW,CAAC,UAChB,gDAAgD,MAAM,OACnD,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,EACtE,KAAK,IAAI,CAAC;AAEf,MAAI,UAAU,OAAO,WAAW,YAAY,kBAAkB,QAAQ;AACpE,UAAM,OAAO,uBAAuB,UAAU,MAAM;AACpD,QAAI,CAAC,KAAK,QAAS,OAAM,IAAI,MAAM,SAAS,KAAK,KAAK,CAAC;AACvD,WAAO,OAAO,YAAY,wBAAwB,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAAA,EAChF;AACA,QAAM,aAAaA,GAChB,OAAOA,GAAE,OAAO,GAAG,sBAAsB,EACzC,YAAY,CAAC,OAAO,YAAY;AAC/B,eAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,UAAI,CAAE,wBAA8C,SAAS,GAAG,GAAG;AACjE,gBAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,CAAC,GAAG,GAAG,SAAS,mBAAmB,CAAC;AAAA,MAC/E;AAAA,IACF;AAAA,EACF,CAAC,EACA,UAAU,MAAM;AACnB,MAAI,CAAC,WAAW,QAAS,OAAM,IAAI,MAAM,SAAS,WAAW,KAAK,CAAC;AACnE,SAAO,WAAW;AACpB;AAUO,SAAS,yBAAyB,UAA0D;AACjG,QAAM,QAAQ,SAAS,mBAAmB,KAAK,KAAK;AACpD,MAAI,CAAC,SAAS,oBAAoB,MAAM,YAAY,MAAM,OAAQ,QAAO,EAAE,QAAQ,MAAM;AACzF,QAAM,cAAc,SAAS,gCAAgC,CAAC;AAC9D,MAAI,UAAU,IAAI;AAEhB,QAAI,CAAC,aAAa,YAAY,2BAA2B,GAAG,MAAM,EAAG,QAAO,EAAE,QAAQ,MAAM;AAAA,EAC9F;AACA,MAAI;AACF,UAAM,YAAY;AAAA,MAChB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AACA,UAAM,WAAW,CACf,IACA,WACA,QACA,iBAC8B;AAC9B,YAAM,MAAM,YAAY,EAAE;AAC1B,YAAM,SACJ,aAAa,KAAK,MAAM,MACvB,SAAS,aAAa,OAAO,MAAM,IAAI,SACxC,cAAc,UACd;AACF,YAAM,UACJ,kBAAkB,KAAK,SAAS,4BAA4B,EAAE,CAAC,MAC9D,SAAS,kBAAkB,OAAO,SAAS,GAAG,OAAO,IAAI,WAAW,IAAI,SACzE,cAAc,WACd;AACF,YAAM,OAAO,4BAA4B,EAAE,EAAE,SAAS;AACtD,UAAI,KAAK,eAAe,CAAC,QAAQ;AAC/B,cAAM,IAAI,MAAM,GAAG,EAAE,IAAI,SAAS,UAAU,2BAA2B,EAAE,CAAC,EAAE;AAAA,MAC9E;AACA,UAAI,CAAC,KAAK,kBAAkB,CAAC,SAAS;AACpC,cAAM,IAAI,MAAM,GAAG,EAAE,IAAI,SAAS,UAAU,4BAA4B,EAAE,CAAC,EAAE;AAAA,MAC/E;AACA,aAAO,EAAE,UAAU,IAAI,QAAQ,QAAQ;AAAA,IACzC;AACA,UAAM,SAAS,UAAU;AAAA,MAAI,CAAC,IAAI,UAChC;AAAA,QACE;AAAA,QACA;AAAA,QACA,UAAU,KAAK,QACX;AAAA,UACE,QAAQ,SAAS;AAAA,UACjB,SAAS,SAAS;AAAA,UAClB,MAAM;AAAA,QACR,IACA;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa,SAAS,kBAAkB,KAAK,KAAK;AACxD,QAAI;AACJ,QAAI,eAAe,IAAI;AAErB,cAAQ,OAAO;AAAA,QAAQ,CAAC,UACtB,4BAA4B,MAAM,QAAQ,EAAE,QAAQ,CAAC,KAAK,IAAI,CAAC;AAAA,MACjE;AAAA,IACF,WAAW,WAAW,YAAY,MAAM,QAAQ;AAC9C,cAAQ,CAAC;AAAA,IACX,OAAO;AACL,cAAQ,aAAa,YAAY,+BAA+B,OAAO,EAAE;AAAA,QAAI,CAAC,IAAI,UAChF;AAAA,UACE;AAAA,UACA;AAAA,UACA,UAAU,IACN;AAAA,YACE,QAAQ,SAAS;AAAA,YACjB,SAAS,SAAS;AAAA,YAClB,MAAM;AAAA,UACR,IACA;AAAA,UACJ,OAAO,KAAK,CAAC,UAAU,MAAM,aAAa,EAAE;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN,YAAY,WAAW,QAAQ;AAAA,QAC/B;AAAA,QACA;AAAA,QACA,kBAAkB,iBAAiB,SAAS,oBAAoB;AAAA,QAChE,GAAI,SAAS,4BAA4B,SACrC,EAAE,yBAAyB,SAAS,wBAAwB,IAC5D,CAAC;AAAA,QACL,WAAW,SAAS,6BAA6B;AAAA,MACnD;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO,EAAE,QAAQ,WAAW,QAAS,MAAgB,QAAQ;AAAA,EAC/D;AACF;AAGO,SAAS,wBACd,UACgC;AAChC,QAAM,aAAa,yBAAyB,QAAQ;AACpD,SAAO,WAAW,WAAW,eAAe,WAAW,SAAS;AAClE;AAUO,SAAS,kBACd,UACA,MAU0E;AAC1E,QAAM,SAAS,wBAAwB,QAAQ;AAC/C,MAAI,CAAC,UAAU,KAAK,uBAAuB;AACzC,WAAO,EAAE,iBAAiB,KAAK,iBAAiB,eAAe,CAAC,EAAE;AAAA,EACpE;AACA,MAAI,OAAO,eAAe,YAAY,KAAK,iBAAiB;AAC1D,WAAO,EAAE,iBAAiB,MAAM,eAAe,CAAC,EAAE;AAAA,EACpD;AACA,QAAM,UACJ,OAAO,MAAM,SAAS,IAAI,CAAC,sBAAsB,mBAAmB,IAAI,CAAC,oBAAoB;AAC/F,QAAM,gBAAgB,KAAK,kBACvB,QAAQ,OAAO,CAAC,SAAS,CAAC,2BAA2B,UAAU,QAAQ,IAAI,CAAC,IAC5E;AACJ,SAAO;AAAA;AAAA;AAAA,IAGL,iBAAiB,KAAK,mBAAmB,CAAC,cAAc,SAAS,oBAAoB;AAAA,IACrF;AAAA,EACF;AACF;AAGO,SAAS,6BACd,UACS;AACT,SAAO,SAAS,gBAAgB,YAAY,SAAS,oBAAoB;AAC3E;AAGO,SAAS,2BACd,UACA,QACA,MACS;AACT,QAAM,YAAY,SAAS,uBAAuB,WAAW;AAC7D,SACE,6BAA6B,QAAQ,KACrC,OAAO,SAAS,EAAE;AAAA,IAChB,CAAC,aAAa,qBAAqB,QAAQ,UAAU,SAAS,EAAE,iBAAiB;AAAA,EACnF;AAEJ;AAGO,SAAS,qBACd,QACA,UACA,WACkE;AAClE,QAAM,WAAW,OAAO,iBAAiB,SAAS,QAAQ;AAC1D,MAAI,UAAU;AACZ,WAAO;AAAA,MACL,gBAAgB,cAAc,WAAW,SAAS,eAAe,SAAS;AAAA,MAC1E,WAAW,OAAO,2BAA2B,SAAS,aAAa;AAAA,MACnE,UAAU;AAAA,IACZ;AAAA,EACF;AACA,QAAM,OAAO,4BAA4B,SAAS,QAAQ,EAAE,SAAS;AAErE,SAAO;AAAA,IACL,gBAAgB,QAAQ,SAAS,SAAS,KAAK,kBAAkB;AAAA,IACjE,WAAW,OAAO,2BAA2B;AAAA,IAC7C,UAAU;AAAA,EACZ;AACF;AAGO,SAAS,sBAAsB,gBAAwB,WAA2B;AACvF,MAAI,CAAC,OAAO,cAAc,cAAc,KAAK,iBAAiB,GAAG;AAC/D,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,SAAO,QAAQ,OAAO,cAAc,IAAI,OAAO,MAAS,SAAS,IAAI,SAAU,MAAO;AACxF;;;AC7lBA,SAAS,8BAA8B;AACvC,SAAS,KAAAC,UAAS;AAElB,IAAM,WAAW,uBAAuB,MAAM,iBAAiB,UAAU,CAAC,QAAQ;AAAA,EAChF,GAAG,IAAI,IAAI,GAAG;AAChB,CAAC;AAGM,IAAM,wBAAwBA,GAClC,OAAO;AAAA,EACN,iBAAiB,SAAS,SAAS;AAAA,EACnC,gBAAgB,SAAS,SAAS;AAAA,EAClC,QAAQA,GACL;AAAA,IACCA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAChBA,GACG,OAAO;AAAA,MACN,OAAO,uBAAuB,MAAM;AAAA,MACpC,kBAAkB,SAAS,SAAS;AAAA,IACtC,CAAC,EACA,OAAO;AAAA,EACZ,EACC,QAAQ,CAAC,CAAC;AACf,CAAC,EACA,OAAO,EACP,YAAY,CAAC,QAAQ,QAAQ;AAC5B,aAAW,CAAC,IAAI,KAAK,KAAK,OAAO,QAAQ,OAAO,MAAM,GAAG;AACvD,QAAI,CAAC,MAAM,oBAAoB,CAAC,OAAO,iBAAiB;AACtD,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,UAAU,EAAE;AAAA,QACnB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAEI,IAAM,2BAA2BA,GAAE;AAAA,EACxC,CAAC,UAAU;AACT,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAI;AACF,aAAO,KAAK,MAAM,KAAK;AAAA,IACzB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,sBAAsB,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;AAC9C;AAEO,SAAS,qBAAqB,UAElC;AACD,SACE,SAAS,sBAAsB,kBAAkB,SAAS,sBAAsB;AAEpF;AAEO,SAAS,uBACd,UACA,UACoC;AACpC,QAAM,SAAS,SAAS;AACxB,QAAM,QAAQ,OAAO,OAAO,QAAQ;AACpC,QAAM,mBAAmB,OAAO,oBAAoB,OAAO;AAC3D,SAAO,mBACH,EAAE,OAAO,OAAO,SAAS,uBAAuB,iBAAiB,IACjE;AACN;;;ACvCA,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,0BAA0B;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAOK;AAEP,SAAS,iDAAiD;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAAC,yCAAwC;AACjD,SAAS,kBAAkB;AAC3B,SAAS,YAAY;AACrB,SAAS,KAAAC,UAAS;;;AC/FlB;AAAA,EACE;AAAA,OAIK;AASP,IAAM,WAAqC;AAAA,EACzC,WAAW,CAAC,IAAI;AAAA,EAChB,WAAW,CAAC,IAAI;AAAA,EAChB,gBAAgB,CAAC,SAAS;AAAA,EAC1B,kBAAkB,CAAC,WAAW;AAAA,EAC9B,4BAA4B,CAAC,SAAS,qBAAqB;AAAA,EAC3D,SAAS,CAAC,SAAS;AACrB;AACA,SAAS,QAAQ,OAAgB,OAA8B;AAC7D,MAAI,OAAO,UAAU,aAAa,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,GAAI,QAAO;AACtF,QAAM,SAAS,OAAO,KAAK,IAAI;AAC/B,SAAO,OAAO,SAAS,MAAM,KAAK,UAAU,IAAI,SAAS;AAC3D;AACA,SAAS,MAAM,OAAqC;AAClD,MAAI,CAAC,SAAS,CAAC,kBAAkB,KAAK,KAAK,EAAG,QAAO;AACrD,QAAM,OAAO,OAAO,KAAK,IAAI;AAC7B,SAAO,OAAO,SAAS,IAAI,KAAK,OAAO,KAAK,OAAO,SAAU,IAAI,KAAK,IAAI,EAAE,YAAY,IAAI;AAC9F;AACA,SAAS,OAAO,OAA6C;AAC3D,SAAO,UAAU,aAAa,UAAU,qBAAqB,UAAU,aAAa,QAAQ;AAC9F;AAEA,SAAS,YAAY,MAAqB,OAAsB,YAA4B;AAC1F,SAAO,IAAI;AAAA,IACT,KAAK;AAAA,MACH,OAAO,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,UAAU,IAAI;AAAA,MACnD,QAAQ,KAAK,MAAM,KAAK,IAAI,KAAK,MAAM,UAAU,IAAI;AAAA,IACvD;AAAA,EACF,EAAE,YAAY;AAChB;AAEA,SAAS,YAAY,MAAwC;AAE3D,SAAO,KAAK,UAAU;AAAA,IACpB,KAAK;AAAA,IACL,KAAK,kBAAkB,OAAO,KAAK;AAAA,IACnC,KAAK,WAAW;AAAA,EAClB,CAAC;AACH;AAEA,SAAS,YACP,MACA,OAC0B;AAC1B,QAAM,SAAS,KAAK,WAAW,aAAa,OAAO,MAAM,WAAW,aAAa,QAAQ;AACzF,SAAO;AAAA,IACL,GAAI,UAAU;AAAA,IACd,UAAU,SACN;AAAA,MACE,KAAK,WAAW,aAAa,KAAK,WAAW,OAAO;AAAA,MACpD,MAAM,WAAW,aAAa,MAAM,WAAW,OAAO;AAAA,MACtD,KAAK;AAAA,IACP,IACA;AAAA,IACJ,qBACE,KAAK,wBAAwB,MAAM,sBAAsB,KAAK,sBAAsB;AAAA,IACtF,QAAQ,SAAS,aAAa;AAAA,IAC9B,eAAe;AAAA,IACf,iBAAiB;AAAA,EACnB;AACF;AAEO,SAAS,wBACd,SACA,MAAM,oBAAI,KAAK,GACf,iBAC+B;AAC/B,QAAM,aAAa,IAAI,YAAY;AACnC,QAAM,QAAQ,oBAAoB;AAAA,IAChC,QAAQ,IAAI,kDAAkD;AAAA,EAChE;AACA,QAAM,gBAAgB,OAAO,QAAQ,IAAI,oCAAoC,CAAC;AAC9E,QAAM,eAAe,MAAM,QAAQ,IAAI,mCAAmC,CAAC;AAC3E,QAAM,gBAAgB,OAAO,QAAQ,IAAI,4CAA4C,CAAC;AACtF,QAAM,kBAAkB,MAAM,QAAQ,IAAI,2CAA2C,CAAC;AACtF,QAAM,UAAU,oBAAoB,QAAQ,QAAQ,CAAC,OAAO;AAC1D,UAAM,SAAS,CAAC,WACd,SAAS,EAAE,EAAG;AAAA,MAAI,CAAC,WACjB,QAAQ,IAAI,+BAA+B,MAAM,IAAI,MAAM,EAAE;AAAA,IAC/D,EAAE,KAAK,CAAC,UAAU,UAAU,IAAI,KAAK;AACvC,UAAM,iBAAiB,MAAM,WAAW,MAAM,SAAS;AACvD,UAAM,cAAc,QAAQ,OAAO,aAAa,GAAG,GAAG;AACtD,UAAM,WAAW,MAAM,OAAO,OAAO,CAAC,MAAM,iBAAiB,eAAe;AAC5E,UAAM,eAAe,OAAO,OAAO,QAAQ,CAAC,MAAM,iBAAiB,gBAAgB;AACnF,QAAI,gBAAgB,QAAQ,aAAa,QAAQ,iBAAiB,KAAM,QAAO,CAAC;AAChF,WAAO,CAAC,EAAE,IAAI,aAAa,UAAU,QAAQ,cAAc,WAAW,CAAC;AAAA,EACzE,CAAC;AACD,SAAO,QAAQ,UAAU,iBAAiB,gBACtC;AAAA,IACE;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,eAAe;AAAA,MACb,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,qBAAqB,MAAM,UAAU,MAAM,OAAO;AAAA,MAClD;AAAA,MACA;AAAA,MACA,iBAAiB,mBAAmB;AAAA,MACpC;AAAA,IACF;AAAA,EACF,IACA;AACN;AAEO,SAAS,yBACd,OACA,MAAM,oBAAI,KAAK,GACgB;AAC/B,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,aAAa,IAAI,YAAY;AACnC,QAAM,UAAU,oBAAoB,QAAQ,QAAQ,CAAC,OAAO;AAC1D,UAAM,SAAU,MAAkC,EAAE;AACpD,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AAC5E,UAAM,SAAS;AACf,UAAM,cAAc,QAAQ,OAAO,aAAa,CAAC;AACjD,UAAM,OAAO,OAAO,OAAO,cAAc,WAAW,KAAK,MAAM,OAAO,SAAS,IAAI;AACnF,UAAM,WAAW,OAAO,SAAS,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,YAAY,IAAI;AACxE,QAAI,gBAAgB,QAAQ,aAAa,KAAM,QAAO,CAAC;AACvD,WAAO,CAAC,EAAE,IAAI,aAAa,UAAU,QAAQ,MAAM,WAAW,CAAC;AAAA,EACjE,CAAC;AACD,SAAO,QAAQ,SAAS,EAAE,SAAS,YAAY,QAAQ,WAAW,IAAI;AACxE;AAEO,SAAS,iBAAiB,mBAA2D;AAC1F,SAAO;AAAA,IACL,WAAW,sBAAsB;AAAA,IACjC;AAAA,IACA,SAAS,CAAC;AAAA,IACV,YAAY;AAAA,IACZ,QAAQ;AAAA,IACR,eAAe;AAAA,IACf,kBAAkB;AAAA,EACpB;AACF;AAGO,SAAS,iBACd,SACA,aACyB;AACzB,QAAM,UAAU,IAAI,IAAI,QAAQ,QAAQ,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;AAC5E,aAAW,kBAAkB,YAAY,SAAS;AAChD,UAAM,SAAS,EAAE,GAAG,gBAAgB,QAAQ,eAAe,UAAU,YAAY,OAAO;AACxF,UAAM,WAAW,QAAQ,IAAI,OAAO,EAAE;AACtC,QAAI,CAAC,YAAY,SAAS,aAAa,OAAO,WAAY,SAAQ,IAAI,OAAO,IAAI,MAAM;AAAA,aAErF,SAAS,eAAe,OAAO,cAC/B,KAAK,UAAU,QAAQ,MAAM,KAAK,UAAU,MAAM,GAClD;AACA,YAAM,WAAW,SAAS,WAAW,cAAc,OAAO,WAAW;AACrE,YAAM,QAAQ,SAAS,eAAe,MAAM,QAAQ,OAAO,eAAe,MAAM;AAChF,cAAQ,IAAI,OAAO,IAAI;AAAA,QACrB,GAAG;AAAA,QACH,aACE,SAAS,gBAAgB,OACrB,OAAO,cACP,OAAO,gBAAgB,OACrB,SAAS,cACT,KAAK,IAAI,SAAS,aAAa,OAAO,WAAW;AAAA,QACzD,QAAQ,WAAW,aAAa,SAAS,WAAW,OAAO,SAAS,SAAS,SAAS;AAAA,QACtF,UACE,YAAY,OACR,YAAY,SAAS,UAAU,OAAO,UAAU,OAAO,UAAU,IACjE,SAAS,aAAa,OAAO,WAC3B,SAAS,WACT;AAAA,QACR,QACE,SAAS,WAAW,sBAAsB,OAAO,WAAW,qBACxD,qBACA;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,WAAW,YAAY;AAC7B,QAAM,eAAe,IAAI;AAAA,KACtB,QAAQ,uBAAuB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,GAAG,IAAI,CAAC;AAAA,EAC7E;AAGA,aAAW,QAAQ;AAAA,IACjB,QAAQ,eAAe,SAAS,QAAQ,gBAAgB;AAAA,IACxD,GAAI,YAAY,uBAAuB,CAAC;AAAA,IACxC,UAAU,SAAS,WAAW;AAAA,EAChC,GAAG;AACD,QAAI,CAAC,KAAM;AACX,UAAM,MAAM,YAAY,IAAI;AAC5B,UAAM,WAAW,aAAa,IAAI,GAAG;AACrC,UAAM,YAAY;AAAA,MAChB,GAAG;AAAA,MACH,eAAe;AAAA,MACf,iBAAiB;AAAA,IACnB;AACA,QAAI,CAAC,YAAY,KAAK,aAAa,SAAS,WAAY,cAAa,IAAI,KAAK,SAAS;AAAA,aAErF,KAAK,eAAe,SAAS,cAC7B,KAAK,UAAU,QAAQ,MAAM,KAAK,UAAU,SAAS;AAErD,mBAAa,IAAI,KAAK,YAAY,UAAU,SAAS,CAAC;AAAA,EAC1D;AAGA,QAAM,gBAAgB;AAAA,IACpB,GAAG,QAAQ,QAAQ;AAAA,MACjB,CAAC,WACC,OAAO,WAAW,cACjB,CAAC,OAAO,UACP,QAAQ,WAAW,cACnB,QAAQ,eAAe,OAAO;AAAA,IACpC;AAAA,IACA,GAAG,YAAY,QAAQ,OAAO,CAAC,YAAY,OAAO,UAAU,YAAY,YAAY,UAAU;AAAA,EAChG;AACA,aAAW,UAAU,eAAe;AAClC,QAAI,OAAO,gBAAgB,QAAQ,OAAO,eAAe,IAAK;AAC9D,UAAM,QAAkC;AAAA,MACtC,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,qBAAqB,OAAO;AAAA,MAC5B,iBAAiB;AAAA,MACjB,eAAe;AAAA,MACf,iBAAiB;AAAA,MACjB,YAAY,OAAO;AAAA,MACnB,QAAQ;AAAA,IACV;AACA,UAAM,MAAM,YAAY,KAAK;AAC7B,QAAI,CAAC,aAAa,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,EAAG,aAAa,MAAM;AACtE,mBAAa,IAAI,KAAK,KAAK;AAAA,EAC/B;AACA,aAAW,CAAC,KAAK,IAAI,KAAK,cAAc;AACtC,QAAI,KAAK,WAAW,WAAY;AAChC,UAAM,QAAQ,CAAC,GAAG,aAAa,OAAO,CAAC,EAAE;AAAA,MACvC,CAAC,cACC,UAAU,WAAW,cACrB,UAAU,wBAAwB,KAAK,uBACvC,UAAU,aAAa,KAAK,cAC5B,UAAU,wBAAwB,aAClC,UAAU,wBAAwB;AAAA,IACtC;AACA,QAAI;AACF,mBAAa,IAAI,KAAK;AAAA,QACpB,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,YAAY,MAAM;AAAA,MACpB,CAAC;AAAA,EACL;AAGA,MAAI,sBAAsB,CAAC,GAAG,aAAa,OAAO,CAAC;AACnD,QAAM,eAAe,oBAAoB;AAAA,IACvC,CAAC,OAAO,SAAU,KAAK,aAAa,QAAQ,KAAK,aAAa;AAAA,IAC9D,YAAY;AAAA,EACd;AACA,QAAM,cAAc,oBAAoB;AAAA,IACtC,CAAC,SACC,KAAK,WAAW,eACf,KAAK,WAAW,KAAK,MAAM,KAAK,QAAQ,IAAI,KAAK,MAAM,KAAK,UAAU,IAAI,OACzE,KAAK,MAAM,YAAY;AAAA,EAC7B;AACA,MAAI,oBAAoB,SAAS,MAAM,YAAY,WAAW,GAAG;AAC/D,0BAAsB,oBACnB,KAAK,CAAC,MAAM,UAAU,MAAM,WAAW,cAAc,KAAK,UAAU,CAAC,EACrE,MAAM,GAAG,EAAE;AAAA,EAChB,WAAW,oBAAoB,SAAS,IAAI;AAC1C,UAAM,aAAa;AACnB,UAAM,WAAW,IAAI;AAAA,MACnB,KAAK;AAAA,QACH,GAAG,YAAY;AAAA,UAAI,CAAC,SAClB,KAAK,WAAW,KAAK,MAAM,KAAK,QAAQ,IAAI,KAAK,MAAM,KAAK,UAAU,IAAI;AAAA,QAC5E;AAAA,QACA,KAAK,MAAM,UAAU,IAAI;AAAA,MAC3B;AAAA,IACF,EAAE,YAAY;AACd,0BAAsB;AAAA,MACpB;AAAA,QACE,QAAQ;AAAA,QACR;AAAA,QACA,qBAAqB;AAAA,QACrB,eAAe;AAAA,QACf,iBAAiB;AAAA,QACjB,iBAAiB;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,CAAC,QAAQ,cAAc,QAAQ,aAAa,YAAY;AACvE,QAAM,OAAO,QAAQ,eAAe,YAAY;AAChD,MAAI,gBAAgB,QAAQ,iBAAiB;AAC7C,MAAI,OAAQ,iBAAgB,YAAY;AAAA,WAC/B,QAAQ,KAAK,UAAU,aAAa,MAAM,KAAK,UAAU,YAAY,IAAI,GAAG;AAGnF,oBACE,YAAY,iBAAiB,YAAY,QAAQ,MAAM,YAAY,aAAa,IAC5E,YAAY,eAAe,QAAQ,IACnC;AAAA,EACR;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA,SAAS,oBAAoB,QAAQ;AAAA,MAAQ,CAAC,OAC5C,QAAQ,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAE,IAAI,CAAC;AAAA,IAC1C;AAAA,IACA,GAAI,SACA;AAAA,MACE,YAAY,YAAY;AAAA,MACxB,QAAQ,YAAY;AAAA;AAAA;AAAA,IAGtB,IACA,CAAC;AAAA,EACP;AACF;;;ACvUA,SAAS,KAAAC,UAAS;AAGX,IAAM,yBAAyB;AAC/B,IAAM,6BAA6B;AACnC,IAAM,yBAAyB;AAC/B,IAAM,4BAA4B;AAClC,IAAM,sBAAsB,CAAC,kBAAkB,cAAc;AAE7D,IAAM,2BAA2BA,GACrC,OAAO;AAAA,EACN,cAAcA,GACX,OAAO,EACP,IAAI,KAAK,EACT,MAAM,wBAAwB;AAAA,EACjC,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA,EACrD,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,OAAQ;AAAA,EACpD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AACnC,CAAC,EACA,YAAY;AAER,SAAS,uBAAuB,OAA6C;AAClF,QAAM,MAAM,IAAI,IAAI,0BAA0B;AAC9C,MAAI,aAAa,IAAI,QAAQ,MAAM;AACnC,MAAI,aAAa,IAAI,aAAa,sBAAsB;AACxD,MAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,MAAI,aAAa,IAAI,gBAAgB,yBAAyB;AAC9D,MAAI,aAAa,IAAI,SAAS,oBAAoB,KAAK,GAAG,CAAC;AAC3D,MAAI,aAAa,IAAI,kBAAkB,MAAM,SAAS;AACtD,MAAI,aAAa,IAAI,yBAAyB,MAAM;AACpD,MAAI,aAAa,IAAI,SAAS,MAAM,KAAK;AACzC,SAAO,IAAI,SAAS;AACtB;;;AC/BO,SAAS,8BAA8B,WAAmB,gBAAgC;AAC/F,MAAI,CAAC,OAAO,cAAc,cAAc,KAAK,kBAAkB;AAC7D,UAAM,IAAI,MAAM,qDAAqD;AACvE,MAAI,OAAO;AACX,WAAS,QAAQ,GAAG,QAAQ,UAAU,QAAQ,SAAS,GAAG;AACxD,YAAQ,UAAU,WAAW,KAAK;AAClC,WAAO,KAAK,KAAK,MAAM,QAAU;AAAA,EACnC;AACA,UAAQ,SAAS,KAAK;AACxB;AAOO,SAAS,0BAAoD,OAOvD;AACX,QAAM,SAAS,MAAM,SAAS,KAAK,CAAC,YAAY,QAAQ,OAAO,MAAM,kBAAkB;AACvF,MAAI,MAAM,sBAAsB,MAAM,cAAc,SAAU,QAAO,UAAU;AAC/E,MAAI,CAAC,MAAM;AACT,WAAO,MAAM,SAAS,KAAK,CAAC,YAAY,QAAQ,OAAO,MAAM,kBAAkB,KAAK;AACtF,SACE,WACC,MAAM,SAAS,SACZ,MAAM,SAAS,8BAA8B,MAAM,WAAW,MAAM,SAAS,MAAM,CAAC,IACpF;AAER;;;ACjCA,IAAM,2BAA2B;AACjC,IAAM,UAAU,CAACC,YACfA,YAAW,aAAaA,YAAW;AAG9B,SAAS,2BACd,OACA,iBACA,KACA,UAAsC,CAAC,GACuD;AAC9F,QAAM,YAAY,EAAE,WAAW,MAAM,aAAa,MAAM,iBAAiB,CAAC,EAAE;AAC5E,MAAI,CAAC,MAAM,aAAa,MAAM,kBAAkB;AAC9C,WAAO,EAAE,GAAG,WAAW,WAAW,MAAM;AAC1C,QAAM,WAAW,CAAC,OAAyC;AACzD,QAAI,OAAO,iBAAkB,QAAO,gBAAgB,KAAK,eAAe;AACxE,QAAI,OAAO,mBAAoB,QAAO,kBAAkB,KAAK,eAAe;AAC5E,WAAO,OAAO,eAAe,OAAO;AAAA,EACtC;AACA,QAAM,aAAa,MAAM,QAAQ,OAAO,CAAC,WAAW,SAAS,OAAO,EAAE,CAAC;AACvE,QAAM,gBAAgB,CAAC,OACrB,OAAO,oBAAoB,OAAO,qBAAqB,SAAS,EAAE,IAAI;AACxE,QAAM,gBAAgB,MAAM,uBAAuB,CAAC,GAAG;AAAA,IACrD,CAAC,SACC,KAAK,WAAW,eACf,KAAK,oBAAoB,mBACvB,KAAK,oBAAoB,QAAQ,cAAc,KAAK,mBAAmB,MAC1E,CAAC,WAAW;AAAA,MACV,CAAC,WACC,OAAO,WAAW,cAClB,OAAO,gBAAgB,QACvB,OAAO,cAAc,OACrB,OAAO,OAAO,KAAK,uBACnB,OAAO,aAAa,KAAK;AAAA,IAC7B,MACC,KAAK,WACF,KAAK,MAAM,KAAK,QAAQ,IACxB,KAAK,MAAM,KAAK,UAAU,IAAI,4BAA4B,IAAI,QAAQ;AAAA,EAC9E;AACA,QAAM,WAAW,WAAW,OAAO,CAAC,WAAW;AAC7C,SACG,OAAO,WACJ,KAAK,MAAM,OAAO,QAAQ,IAC1B,KAAK,MAAM,OAAO,UAAU,IAAI,6BAA6B,IAAI,QAAQ;AAE7E,aAAO;AACT,WACE,OAAO,WAAW,cAAe,OAAO,WAAW,SAAS,OAAO,eAAe,MAAM;AAAA,EAE5F,CAAC;AACD,QAAM,UAAU,MAAM;AACtB,QAAM,aAAa,SAAS,oBAAoB;AAChD,QAAM,kBACJ,YACC,cACE,QAAQ,oBAAoB,QAAQ,cAAc,QAAQ,mBAAmB;AAClF,QAAM,eACJ,mBACA,WAAW,MAAM,CAAC,WAAW,OAAO,cAAc,QAAQ,UAAU,KACpE,aAAa,MAAM,CAAC,SAAS,KAAK,cAAc,QAAQ,UAAU;AACpE,QAAM,mBACJ,YACC,QAAQ,WACL,KAAK,MAAM,QAAQ,QAAQ,IAC3B,KAAK,MAAM,QAAQ,UAAU,IAAI,6BAA6B,IAAI,QAAQ;AAChF,QAAM,kBAAkB,MAAM,uBAAuB,CAAC,GAAG;AAAA,IACvD,CAAC,SACC,KAAK,oBAAoB,mBACzB,QAAQ,KAAK,MAAM,KACnB,SAAS,MAAM,CAAC,WAAW,OAAO,aAAa,KAAK,UAAU,KAC9D,aAAa,MAAM,CAAC,gBAAgB,YAAY,aAAa,KAAK,UAAU;AAAA,EAChF;AACA,MAAI,eAAgB,QAAO;AAG3B,MAAI,gBAAgB,cAAc,QAAQ,QAAQ,MAAM,KAAK,CAAC,iBAAkB,QAAO;AACvF,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,sBACJ,SAAS,mBAAmB,KAAK,MAAM,QAAQ,eAAe,KAAK,IAAI,QAAQ;AACjF,MACE,gBACA,QAAQ,WAAW,cACnB,iBACA,QAAQ,QAAQ,aAAa,KAC7B,CAAC;AAED,WAAO;AACT,QAAM,kBAAkB,gBAAgB,QAAQ,WAAW,cAAc,CAAC;AAC1E,MAAI,SAAS,WAAW,KAAK,CAAC,mBAAmB,aAAa,WAAW,EAAG,QAAO;AAGnF,QAAM,SAAS,SAAS;AAAA,IAAI,CAAC,WAC3B,OAAO,WACH,KAAK,MAAM,OAAO,QAAQ,IAC1B,KAAK,MAAM,OAAO,UAAU,IAAI;AAAA,EACtC;AACA,MAAI;AACF,WAAO;AAAA,MACL,QAAQ,WACJ,KAAK,MAAM,QAAQ,QAAQ,IAC3B,KAAK,MAAM,QAAQ,UAAU,IAAI;AAAA,IACvC;AACF,SAAO;AAAA,IACL,GAAG,aAAa;AAAA,MAAI,CAAC,SACnB,KAAK,WACD,KAAK,MAAM,KAAK,QAAQ,IACxB,KAAK,MAAM,KAAK,UAAU,IAAI;AAAA,IACpC;AAAA,EACF;AACA,MAAI,cAAc,KAAK,IAAI,GAAG,MAAM;AACpC,MACE,mBACA,iBACA,QAAQ,kBAAkB,cAC1B,QAAQ,iBACR;AACA,UAAM,eAAe,KAAK,MAAM,QAAQ,eAAe;AAEvD,QAAI,gBAAgB,IAAI,QAAQ,EAAG,QAAO;AAC1C,kBAAc,KAAK,IAAI,aAAa,YAAY;AAAA,EAClD;AACA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,aAAa,IAAI,KAAK,WAAW;AAAA,IACjC,iBAAiB,SAAS,IAAI,CAAC,WAAW,OAAO,EAAE;AAAA,EACrD;AACF;;;AJxBO,IAAM,uCAAuC;AAS7C,IAAM,2CAA2C;AAExD,IAAM,UAAU;AAChB,IAAM,aAAa;AAKZ,IAAM,yCAAyC,KAAK;AACpD,IAAM,8CAA8C;AAGpD,IAAM,yCAAyC;AAC/C,IAAM,kCACX,yCAAyC;AACpC,IAAM,+CAA+C;AACrD,IAAM,2CAA2C;AASjD,IAAM,2CAA2C,KAAK;AACtD,IAAM,2CAA2C;AACxD,IAAM,aAAaC,GAAE,WAAW,CAAC,UAAU;AACzC,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,MAAI,CAAC,QAAQ,KAAK,OAAO,KAAK,IAAI,EAAE,SAAS,UAAU,GAAG;AACxD,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAS,KAAK,MAAM,KAAK,KAAK,EAAE,SAAS,UAAU,GAAG;AACzD,WAAO;AAAA,EACT;AACA,SAAO;AACT,GAAGA,GAAE,QAAQ,CAAC;AAGd,IAAM,gBAAgBA,GACnB,OAAO,EACP,IAAI,EACJ,IAAI,IAAK,EACT,OAAO,CAAC,UAAU,iBAAiB,KAAK,KAAK,GAAG,wBAAwB;AAE3E,IAAM,uBAAuBA,GAAE,WAAW,CAAC,UAAU;AACnD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,SAAS,MAAM,KAAK;AAC1B,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,OAAO,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU;AACtC,UAAM,UAAU,MAAM,KAAK;AAC3B,WAAO,YAAY,KAAK,OAAO,MAAM,OAAO,OAAO;AAAA,EACrD,CAAC;AACH,GAAGA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,IAAI,GAAG,4EAA4E,EAAE,SAAS,CAAC;AAI1I,IAAM,kBAAkBA,GAAE;AAAA,EACxB,CAAC,UAAU;AACT,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,SAAS,MAAM,KAAK;AAC1B,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,OAAO,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,EAAE,YAAY,CAAC;AAAA,EACpE;AAAA,EACAA,GACG;AAAA,IACCA,GACG,OAAO,EACP;AAAA,MACC;AAAA,MACA;AAAA,IACF;AAAA,EACJ,EACC,IAAI,CAAC,EACL,OAAO,CAAC,YAAY,IAAI,IAAI,OAAO,EAAE,SAAS,QAAQ,QAAQ;AAAA,IAC7D,SAAS;AAAA,EACX,CAAC,EACA,SAAS,EACT,SAAS;AACd;AAGA,IAAM,0CAA0CA,GAAE;AAAA,EAChD,CAAC,UAAU;AACT,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,SAAS,MAAM,KAAK;AAC1B,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,MAAM;AAAA,IAC5B,QAAQ;AACN,aAAO;AAAA,IACT;AACA,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO;AAC3E,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC,YAAY,YAAY,GAAG,KAAK,CAAC;AAAA,IACzF;AAAA,EACF;AAAA,EACAA,GACG,OAAOA,GAAE,OAAO,EAAE,KAAK,GAAGA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,OAAO,gBAAgB,CAAC,EACzF,QAAQ,CAAC,CAAC;AACf;AAGO,SAAS,iCACd,UAIA,aACQ;AACR,SACE,SAAS,qCAAqC,YAAY,YAAY,CAAC,KACvE,SAAS;AAEb;AAEA,IAAM,wBAAwBA,GAAE;AAAA,EAC9B,CAAC,UAAU;AACT,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,SAAS,MAAM,KAAK;AAC1B,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,OAAO,WAAW,GAAG,GAAG;AAC1B,UAAI;AACF,eAAO,KAAK,MAAM,MAAM;AAAA,MAC1B,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO,OAAO,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAAA,EACtD;AAAA,EACAA,GACG,MAAM,qBAAqB,EAC3B,YAAY,CAAC,OAAO,YAAY;AAC/B,UAAM,OAAO,oBAAI,IAA+B;AAChD,eAAW,CAAC,OAAO,IAAI,KAAK,MAAM,QAAQ,GAAG;AAC3C,UAAI,KAAK,IAAI,IAAI,GAAG;AAClB,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM,CAAC,KAAK;AAAA,QACd,CAAC;AAAA,MACH;AACA,WAAK,IAAI,IAAI;AAAA,IACf;AAAA,EACF,CAAC,EACA,SAAS;AACd;AAEO,IAAM,6BAAiF;AAAA,EAC5F,MAAM;AAAA,IACJ,KAAK,CAAC;AAAA,IACN,OAAO,CAAC;AAAA,EACV;AAAA,EACA,OAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,OAAO,CAAC,iBAAiB;AAAA,EAC3B;AAAA,EACA,QAAQ;AAAA,IACN,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,OAAO,CAAC;AAAA,EACV;AACF;AAGO,IAAM,+BAA+B;AAIrC,IAAM,6BAA6BA,GACvC;AAAA,EACCA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,MAAM,QAAQ;AAAA,EACzCA,GAAE,OAAO,EAAE,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,MAAM,QAAQ,EAAE,CAAC,EAAE,OAAO;AAChF,EACC,YAAY,CAAC,UAAU,YAAY;AAClC,aAAW,CAAC,cAAc,OAAO,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAC9D,QAAI,iBAAiB,QAAQ,cAAc;AACzC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,cAAc,cAAc;AAAA,QACnC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAGI,IAAM,0BACX;AAEF,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EAC9B,aAAaA,GAAE,OAAO,EAAE,QAAQ,UAAU;AAAA,EAC1C,aAAaA,GAAE,OAAO,EAAE,QAAQ,OAAO;AAAA,EACvC,oBAAoBA,GAAE,OAAO,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA,EAG5C,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,aAAaA,GAAE,OAAO,EAAE,QAAQ,sDAAsD;AAAA;AAAA;AAAA,EAGtF,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI7C,oBAAoBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,EAKjE,4BAA4B,WAAW,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhD,UAAUA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA,EAI/B,aAAaA,GAAE,KAAK,CAAC,SAAS,QAAQ,CAAC,EAAE,QAAQ,OAAO;AAAA;AAAA;AAAA;AAAA,EAIxD,qBAAqBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,cAAc;AAAA,EAC7D,SAASA,GAAE,OAAO,EAAE,QAAQ,uBAAuB;AAAA,EACnD,cAAcA,GAAE,OAAO,EAAE,QAAQ,gBAAgB;AAAA,EACjD,mBAAmBA,GAAE,OAAO,EAAE,QAAQ,SAAS;AAAA,EAC/C,mBAAmBA,GAAE,OAAO,EAAE,QAAQ,kBAAkB;AAAA,EACxD,oBAAoB,WAAW,QAAQ,KAAK;AAAA,EAC5C,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACpC,uBAAuBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,oCAAoCA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxD,oCAAoCA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxD,mCAAmCA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvD,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EAC7E,sCAAsCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA,EACrF,kCAAkCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA,EACjF,2BAA2BA,GAAE,KAAK,CAAC,SAAS,gBAAgB,CAAC,EAAE,QAAQ,OAAO;AAAA,EAC9E,8BAA8BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAK,EAAE,QAAQ,EAAE;AAAA,EACtF,0BAA0BA,GAAE,OAAO,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA,EACzE,6BAA6BA,GAAE,OAAO,OAAO,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAI/E,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,QAAQ,GAAG;AAAA,EACjF,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAK;AAAA,EAC7F,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,IAAI,GAAO,EAAE,QAAQ,GAAM;AAAA,EAC9F,6BAA6B,WAAW,QAAQ,KAAK;AAAA,EACrD,6BAA6B,WAAW,QAAQ,IAAI;AAAA,EACpD,2BAA2BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrD,0BAA0BA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC/C,kCAAkCA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5D,iCAAiCA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EACtD,kBAAkB,WAAW,QAAQ,KAAK;AAAA,EAC1C,0BAA0B,WAAW,QAAQ,IAAI;AAAA,EACjD,sBAAsBA,GACnB,OAAO,EACP,IAAI,GAAG,EACP,MAAM,mBAAmB,EACzB,SAAS;AAAA,EACZ,4BAA4BA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAChE,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAK,EAAE,SAAS;AAAA,EAC3D,2BAA2BA,GACxB,OAAO,EACP,IAAI,EAAE,EACN,MAAM,gBAAgB,EACtB,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,uBAAuB,cAAc,SAAS;AAAA,EAC9C,wBAAwB,cAAc,SAAS;AAAA;AAAA;AAAA;AAAA,EAI/C,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIzC,kBAAkBA,GAAE;AAAA,IAClB,CAAC,UACC,OAAO,UAAU,WACb,MAAM,KAAK,EAAE,YAAY,MAAM,SAC7B,OACA,MAAM,KAAK,IACb;AAAA,IACNA,GACG,IAAI,EAAE,UAAU,aAAa,OAAO,0CAA0C,CAAC,EAC/E,SAAS,EACT,QAAQ,kCAAkC;AAAA,EAC/C;AAAA;AAAA;AAAA,EAGA,iBAAiB,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMzC,qBAAqBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA,EAIrE,sBAAsBA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA,EAG3C,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtC,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,UAAU;AAAA,EACpE,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKjD,sBAAsBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,kBAAkB;AAAA,EACjF,4BAA4BA,GAAE,OAAO,EAAE,IAAI,EAAE,WAAW,UAAU,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI7E,sBAAsBA,GACnB,OAAO,EACP,IAAI,EACJ,QAAQ,mDAAmD;AAAA;AAAA;AAAA;AAAA,EAI9D,oBAAoBA,GACjB,OAAO,EACP,MAAM,mDAAmD,EACzD,QAAQ,QAAQ;AAAA;AAAA;AAAA,EAGnB,sBAAsBA,GACnB,OAAO,EACP,MAAM,mDAAmD,EACzD,SAAS;AAAA;AAAA;AAAA,EAGZ,kBAAkBA,GACf,OAAO,EACP,MAAM,mDAAmD,EACzD,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,iBAAiB,WAAW,QAAQ,IAAI;AAAA,EACxC,mBAAmB,kBAAkB,QAAQ,OAAO;AAAA,EACpD,aAAa,YAAY,QAAQ,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3C,mCAAmC,WAAW,QAAQ,KAAK;AAAA,EAC3D,uBAAuB;AAAA,EACvB,kBAAkB,iBAAiB,QAAQ,MAAM;AAAA,EACjD,iBAAiB,gBAAgB,QAAQ,MAAM;AAAA;AAAA;AAAA,EAG/C,wBAAwB,WAAW,QAAQ,KAAK;AAAA,EAChD,wBAAwBA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA,EAC/C,uBAAuBA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA,EAC9C,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,2BAA2B;AAAA,EAC3B,2BAA2B;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3B,8BAA8B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtD,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIvC,sBAAsB,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI9C,sBAAsB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAI7C,2BAA2B,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAIlD,qCAAqC,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA,EAG5D,qCAAqC,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI7D,mBAAmBA,GAChB,OAAO,EACP,MAAM,qEAAqE,EAC3E,SAAS;AAAA,EACZ,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI/C,uBAAuB,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA,EAG/C,mBAAmBA,GAChB,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL,IAAI,IAAK,EACT;AAAA,IACC,CAAC,UAAU,MAAM,WAAW,GAAG,KAAK,gBAAgB,KAAK,KAAK;AAAA,IAC9D;AAAA,EACF,EACC,SAAS;AAAA,EACZ,qBAAqB,WAAW,QAAQ,KAAK;AAAA,EAC7C,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,wCAAwC,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhE,sBAAsB,WAAW,QAAQ,IAAI;AAAA,EAC7C,iCAAiC,WAAW,QAAQ,KAAK;AAAA,EACzD,uCAAuC,WAAW,QAAQ,KAAK;AAAA,EAC/D,8BAA8BA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA,EACrD,qBAAqBA,GAClB,OAAO,EACP,MAAM,mCAAmC,EACzC,SAAS;AAAA,EACZ,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAExC,iBAAiBA,GAAE,KAAK,CAAC,WAAW,MAAM,CAAC,EAAE,QAAQ,SAAS;AAAA,EAC9D,qBAAqB,4BAA4B,QAAQ,UAAU;AAAA,EACnE,cAAcA,GACX,OAAO,EACP,KAAK,EACL,MAAM,uBAAuB,EAC7B,QAAQ,WAAW;AAAA,EACtB,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,yBAAyBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAG;AAAA,EACnF,yBAAyBA,GAAE,OACxB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,GAAa,EACjB,QAAQ,GAAW;AAAA,EACtB,6BAA6BA,GAAE,OAC5B,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,GAAa,EACjB,QAAQ,GAAW;AAAA,EACtB,oCAAoCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAK;AAAA,EAChG,kCAAkCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAK,EAAE,QAAQ,GAAG;AAAA,EAC3F,kCAAkCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACxF,qCAAqCA,GAAE,OACpC,OAAO,EACP,IAAI,EACJ,IAAI,GAAK,EACT,IAAI,4CAA4C,EAChD,QAAQ,GAAM;AAAA,EACjB,kCAAkCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACjF,wCAAwCA,GAAE,OACvC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,GAAM,EACV,QAAQ,GAAG;AAAA,EACd,oCAAoCA,GAAE,OACnC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,wCAAwC,EAC5C,QAAQ,GAAK;AAAA,EAChB,kCAAkCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAO,EAAE,QAAQ,IAAM;AAAA,EAChG,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,mCAAmC,WAAW,SAAS;AAAA,EACvD,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,uBAAuBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAG3C,qBAAqBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,sBAAsB,EAAE,SAAS;AAAA;AAAA;AAAA,EAGhG,wBAAwBA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/C,0BAA0BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtE,mBAAmB,qBAAqB,QAAQ,4BAA4B;AAAA,EAC5E,sBAAsBA,GAAE,OACrB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,QAAQ,gCAAgC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAa3C,8BAA8B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAStD,2BAA2B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUnD,8BAA8B,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrD,2BAA2BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/E,qBAAqBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,KAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzE,8BAA8BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ1E,iCAAiCA,GAAE,OAChC,OAAO,EACP,QAAQ,GAAG,EACX,UAAU,CAAC,UAAU;AACpB,QAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,aAAO;AAAA,IACT;AACA,WAAO,KAAK,IAAI,KAAK,KAAK,IAAI,KAAK,KAAK,CAAC;AAAA,EAC3C,CAAC;AAAA;AAAA;AAAA,EAGH,6BAA6BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,KAAO;AAAA;AAAA;AAAA,EAGlF,mCAAmCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI/E,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EAClF,cAAc,WAAW,QAAQ,KAAK;AAAA,EACtC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,iBAAiB,WAAW,QAAQ,IAAI;AAAA,EACxC,kBAAkB,WAAW,QAAQ,KAAK;AAAA,EAC1C,SAASA,GAAE,OAAO,EAAE,QAAQ,SAAS;AAAA,EACrC,SAASA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA;AAAA;AAAA,EAGxD,gBAAgBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,gBAAgBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAI/D,wBAAwBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAClD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI1C,sBAAsBA,GAAE,OAAO,EAAE,QAAQ,OAAO,+CAA+C;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/F,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,gBAAgBA,GAAE,KAAK,CAAC,UAAU,OAAO,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC5D,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,aAAaA,GAAE,OAAO,EAAE,QAAQ,aAAa;AAAA,EAC7C,qBAAqBA,GAAE,OAAO,EAAE,QAAQ,kCAAkC;AAAA;AAAA;AAAA;AAAA,EAI1E,uBAAuBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3C,sBAAsBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,oBAAoB;AAAA;AAAA,EAEpF,+BAA+BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAK;AAAA,EAC3F,mCAAmCA,GAAE,OAClC,OAAO,EACP,IAAI,EACJ,IAAI,GAAM,EACV,IAAI,KAAK,KAAK,GAAM,EACpB,QAAQ,IAAI,KAAK,GAAM;AAAA,EAC1B,uCAAuCA,GAAE,OACtC,OAAO,EACP,IAAI,EACJ,IAAI,GAAG,EACP,IAAI,IAAI,KAAK,EAAE,EACf,QAAQ,KAAK,EAAE;AAAA,EAClB,0CAA0CA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EAC1F,oCAAoCA,GAAE,OACnC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,OAAO,gBAAgB,EAC3B,QAAQ,KAAK,OAAO,OAAO,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlC,kCAAkCA,GAAE,OACjC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,OAAO,gBAAgB,EAC3B,QAAQ,IAAI,OAAO,OAAO,IAAI;AAAA,EACjC,sCAAsC;AAAA,EACtC,8BAA8BA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK,EAAE,QAAQ,qBAAqB;AAAA,EAC/F,4BAA4BA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK,EAAE,QAAQ,SAAS;AAAA;AAAA;AAAA,EAGjF,0CAA0CA,GAAE,OACzC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,GAAU,EACd,QAAQ,KAAO;AAAA,EAClB,0CAA0CA,GAAE,OACzC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,GAAU,EACd,QAAQ,IAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlB,8BAA8BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACpF,wBAAwBA,GAAE,OACvB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,OAAO,IAAI,EACpB,QAAQ,KAAK,OAAO,IAAI;AAAA;AAAA;AAAA;AAAA,EAI3B,4BAA4B,WAAW,QAAQ,IAAI;AAAA,EACnD,uCAAuCA,GAAE,OACtC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,IAAI,KAAK,EAAE,EACf,QAAQ,IAAI,KAAK,EAAE;AAAA,EACtB,iCAAiCA,GAAE,OAChC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,MAAM,OAAO,IAAI,EACrB,QAAQ,MAAM,OAAO,IAAI;AAAA,EAC5B,sCAAsCA,GAAE,OACrC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,OAAO,IAAI,EACpB,QAAQ,IAAI,OAAO,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1B,uBAAuB,WAAW,QAAQ,IAAI;AAAA;AAAA,EAE9C,wBAAwBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,QAAQ,EAAE;AAAA,EAC3E,qCAAqCA,GAAE,OACpC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,IAAI,KAAK,KAAK,EAAE,EACpB,QAAQ,KAAK,KAAK,EAAE;AAAA,EACvB,sBAAsBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzE,yBAAyBA,GACtB,OAAO,EACP,QAAQ,+DAA+D;AAAA;AAAA;AAAA,EAG1E,yBAAyB,WAAW,QAAQ,IAAI;AAAA,EAChD,wBAAwBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,uBAAuBA,GAAE,OAAO,EAAE,QAAQ,gBAAgB;AAAA;AAAA;AAAA,EAG1D,wBAAwB,WAAW,QAAQ,IAAI;AAAA,EAC/C,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,uBAAuBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,wBAAwBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE5C,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC7C,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,qBAAqBA,GAAE,OAAO,EAAE,QAAQ,YAAY;AAAA,EACpD,gBAAgBA,GAAE,OAAO,EAAE,QAAQ,OAAO;AAAA;AAAA;AAAA,EAG1C,sBAAsBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1C,8BAA8BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAElD,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjD,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,yBAAyBA,GAAE,OAAO,EAAE,QAAQ,YAAY;AAAA,EACxD,0BAA0BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9C,oBAAoBA,GAAE,OAAO,EAAE,QAAQ,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMzD,sBAAsBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjE,6BAA6BA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjD,4BAA4BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKhD,oCAAoC,WAAW,QAAQ,KAAK;AAAA;AAAA,EAE5D,yBAAyBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAM,EAAE,SAAS;AAAA,EAC7E,kBAAkBA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA,EAGzC,oBAAoBA,GAAE,KAAK,CAAC,QAAQ,UAAU,CAAC,EAAE,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA,EAI/D,qBAAqBA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA,EAG5C,gBAAgBA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA,EAGvC,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAGtC,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjC,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIvC,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,8BAA8BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClD,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO7C,oBAAoBA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAI3C,0BAA0B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAGlD,kCAAkC,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAIzD,sBAAsB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAG7C,sBAAsB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7C,8BAA8B,WAAW,QAAQ,KAAK;AAAA;AAAA,EACtD,2BAA2B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAGnD,sCAAsCA,GAAE,OACrC,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,KAAK,GAAM,EACpB,QAAQ,mCAAmC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS9C,0BAA0BA,GAAE,OACzB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,KAAK,GAAM,EACpB,QAAQ,oCAAoC;AAAA;AAAA;AAAA;AAAA,EAI/C,8BAA8BA,GAAE,OAC7B,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,KAAK,GAAM,EACpB,QAAQ,wCAAwC;AAAA;AAAA;AAAA;AAAA,EAInD,2BAA2B,WAAW,QAAQ,KAAK;AAAA;AAAA,EACnD,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUrC,wBAAwB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/C,gCAAgC,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMvD,iCAAiC,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxD,uBAAuB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA,EAG9C,uBAAuBA,GAAE,KAAK,CAAC,OAAO,UAAU,YAAY,CAAC,EAAE,SAAS;AAAA,EACxE,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIhD,+BAA+B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMvD,+BAA+B,WAAW,QAAQ,IAAI;AAAA;AAAA,EAEtD,0CAA0C,WAAW,QAAQ,KAAK;AAAA,EAClE,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,GAAK,EAAE,QAAQ,GAAG;AAAA;AAAA;AAAA;AAAA,EAIvF,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EAClF,sCAAsC,WAAW,QAAQ,KAAK;AAAA,EAC9D,uBAAuB,gBAAgB,QAAQ,KAAK;AAAA,EACpD,+BAA+BA,GAAE,OAAO,EAAE,QAAQ,2BAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO7E,qBAAqBA,GAClB,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL,IAAI,GAAG,EACP,OAAO,CAAC,UAAU,CAAC,mBAAmB,KAAK,KAAK,GAAG;AAAA,IAClD,SAAS;AAAA,EACX,CAAC,EACA,QAAQ,YAAY;AAAA;AAAA;AAAA,EAGvB,+BAA+B,gBAAgB,QAAQ,OAAO;AAAA,EAC9D,0BAA0BA,GAAE,KAAK,CAAC,QAAQ,WAAW,CAAC,EAAE,QAAQ,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAStE,uBAAuBA,GAAE,KAAK,CAAC,SAAS,UAAU,CAAC,EAAE,QAAQ,OAAO;AAAA;AAAA;AAAA;AAAA,EAIpE,iCAAiC,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAIxD,kBAAkBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjE,kBAAkB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAIzC,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,8BAA8B;AAAA;AAAA,EAE9B,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACpC,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,uBAAuBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,sBAAsBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1C,2BAA2BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAO,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA,EAIzF,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,yBAAyB;AAAA,EAC9D,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,YAAY;AAAA,EAChE,qBAAqBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAO,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMnF,gBAAgBA,GAAE,KAAK,CAAC,OAAO,UAAU,cAAc,YAAY,CAAC,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQnF,2BAA2BA,GAAE,OAAO,EAAE,QAAQ,0BAA0B;AAAA,EACxE,6BAA6BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAGjD,sCAAsC,WAAW,QAAQ,IAAI;AAAA;AAAA,EAC7D,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxC,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,uBAAuBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,uBAAuBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxC,sBAAsB,WAAW,QAAQ,KAAK;AAAA,EAC9C,gBAAgB,eAAe,QAAQ,QAAQ;AAAA,EAC/C,aAAaA,GAAE,OAAO,EAAE,QAAQ,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOxD,+BAA+B,WAAW,QAAQ,KAAK;AAAA,EACvD,oBAAoBA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EACzC,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKnC,wBAAwBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,cAAcA,GAAE,OAAO,EAAE,QAAQ,kBAAkB;AAAA,EACnD,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAGnC,gCAAgC,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMxD,cAAcA,GACX,OAAO,EAKP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,mBAAmB,EACzB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASZ,0BAA0BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW9C,qBAAqBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAM,EAAE,QAAQ,KAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMlF,iBAAiBA,GAAE,OAAO,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,uBAAuBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMnE,cAAc;AAAA,EACd,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBtC,yBAAyBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASrE,2BAA2BA,GACxB,KAAK,CAAC,OAAO,uBAAuB,oBAAoB,CAAC,EACzD,QAAQ,oBAAoB;AAAA;AAAA;AAAA,EAG/B,uBAAuB,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/C,2BAA2B,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOlD,wBAAwB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAI/C,uBAAuBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACtE,wBAAwBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA;AAAA;AAAA;AAAA,EAItE,kBAAkB,WAAW,QAAQ,IAAI;AAAA,EACzC,uBAAuBA,GAAE,KAAK,CAAC,YAAY,UAAU,CAAC,EAAE,QAAQ,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO1E,yBAAyB,WAAW,QAAQ,IAAI;AAAA,EAChD,oBAAoBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EACjE,qBAAqBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EACnE,mBAAmBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,SAAW;AAAA;AAAA;AAAA,EAEzE,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzC,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,yBAAyBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA,EACxE,uBAAuBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE7E,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC1C,sBAAsBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1C,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxC,eAAe,WAAW,QAAQ,IAAI;AAAA,EACtC,yBAAyBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIrE,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAG/B,WAAWA,GACR,OAAO,EACP,MAAM,4DAA4D;AAAA,IACjE,SAAS;AAAA,EACX,CAAC,EACA,SAAS;AAAA,EACZ,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAGrC,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzC,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,mBAAmBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,kBAAkBA,GAAE,KAAK,CAAC,SAAS,MAAM,CAAC,EAAE,SAAS;AAAA,EACrD,wBAAwB,WAAW,SAAS;AAAA,EAC5C,eAAe,WAAW,SAAS;AAAA,EACnC,yBAAyBA,GAAE,KAAK,CAAC,OAAO,UAAU,CAAC,EAAE,SAAS;AAAA;AAAA,EAE9D,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,yBAAyB,WAAW,SAAS;AAAA;AAAA,EAC7C,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5E,gBAAgBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,uCAAuC,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI/D,mBAAmBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACxD,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACnD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC1C,6BAA6BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAM,EAAE,QAAQ,IAAK;AAAA,EACzF,sBAAsB,WAAW,QAAQ,KAAK;AAAA;AAAA,EAE9C,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEnC,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC9C,mBAAmBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAG9C,kBAAkBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI7C,uBAAuBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,KAAM,EAAE,QAAQ,IAAK;AAAA,EAChF,2BAA2B,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA,EAGlD,4BAA4B,WAAW,QAAQ,KAAK;AAAA,EACpD,qCAAqCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,IAAK,EAAE,QAAQ,GAAG;AAAA,EAC3F,kCAAkCA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI5D,kCAAkC,WAAW,SAAS;AAAA,EACtD,oBAAoBA,GACjB,OAAO,EACP,MAAM,8CAA8C,EACpD,SAAS;AAAA;AAAA;AAAA;AAAA,EAIZ,yCAAyCA,GACtC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,EAAE,EACN,MAAM,mCAAmC,EACzC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMZ,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzC,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAGpD,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACnD,qBAAqBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAC1D,cAAcA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EAC9D,kBAAkBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,MAAO,EAAE,QAAQ,IAAI;AAAA;AAAA,EAE5E,yBAAyBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,MAAO,EAAE,SAAS;AAAA,EAChF,yBAAyBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,IAAM,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9E,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAG1C,4BAA4BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,IAAI,GAAO,EAAE,QAAQ,IAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAU3F,yBAAyB,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASjD,sCAAsC,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAa9D,6BAA6B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQrD,0BAA0B,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQlD,sBAAsB,WAAW,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM7C,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7C,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQxC,4BAA4BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAGhD,sBAAsBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiB1C,kCAAkCA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtD,kCAAkCA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAItD,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,+BAA+BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKnD,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,+BAA+BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUnD,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC/E,mCAAmCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQpF,4BAA4BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EAC7E,0BAA0BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA,EAI3E,+BAA+BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWjF,oBAAoBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBrE,iCAAiCA,GAAE,OAChC,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,SAAS,EACT,UAAU,CAAC,UAAW,UAAU,IAAI,SAAY,KAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUzD,2BAA2BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMzE,0BAA0BA,GAAE,OACzB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,+BAA+B,EACnC,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjB,+BAA+BA,GAAE,OAC9B,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,+BAA+B,EACnC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASZ,uBAAuBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM3E,0BAA0BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA,EAIhF,mBAAmBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EACpE,0BAA0BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAO;AAAA;AAAA;AAAA;AAAA,EAI5E,yBAAyBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS3E,+BAA+BA,GAAE,OAC9B,OAAO;AAAA,IACN,SAAS;AAAA,EACX,CAAC,EACA,IAAI,4EAA4E,EAChF,SAAS,4EAA4E,EACrF,QAAQ,GAAM;AAAA;AAAA;AAAA;AAAA;AAAA,EAKjB,mBAAmBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMrE,oCAAoCA,GAAE,OAAO,EAAE,QAAQ,IAAI;AAAA,EAC3D,wBAAwBA,GAAE,KAAK,CAAC,cAAc,UAAU,SAAS,CAAC,EAAE,QAAQ,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxF,mCAAmCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAClF,4BAA4BA,GAAE,OAAO,EAAE,QAAQ,MAAM;AAAA,EACrD,qBAAqBA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA,EAG1C,uBAAuBA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC5C,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjD,+BAA+BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzD,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACxD,sBAAsBA,GACnB,KAAK,CAAC,iBAAiB,UAAU,cAAc,KAAK,CAAC,EACrD,QAAQ,eAAe;AAAA,EAC1B,qBAAqBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,gBAAgB;AAAA,EAC/D,qBAAqBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,WAAW;AAAA,EAC1D,yBAAyBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,OAAO;AAAA,EAC1D,0BAA0BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9C,8BAA8BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClD,6BAA6B,WAAW,QAAQ,IAAI;AAAA,EACpD,oCAAoCA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxD,+BAA+BA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnD,8BAA8BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClD,4BAA4BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtD,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,iCAAiCA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrD,6BAA6BA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjD,6BAA6BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,WAAW;AAAA,EACrD,mBAAmBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAClE,sBAAsBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,GAAG;AAAA,EACvE,2BAA2BA,GAAE,KAAK,CAAC,UAAU,eAAe,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC/E,wBAAwBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,wBAAwB;AAAA,EAC1E,6BAA6BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC5E,yBAAyBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,0BAA0BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpD,8BAA8BA,GAAE,KAAK,CAAC,cAAc,UAAU,SAAS,CAAC,EAAE,QAAQ,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM9F,+BAA+B,WAAW,QAAQ,KAAK;AAAA,EACvD,4BAA4BA,GACzB,OAAO,EACP,IAAI,EACJ,OAAO,CAAC,UAAU;AACjB,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,IAAI,aAAa,OAAO,IAAI,UAAU,IAAI,QAAQ,IAAI,YAAY,IAAI;AACxE,aAAO;AACT,QAAI,IAAI,aAAa,SAAU,QAAO;AACtC,WAAO,IAAI,aAAa,WAAW,CAAC,aAAa,aAAa,OAAO,EAAE,SAAS,IAAI,QAAQ;AAAA,EAC9F,GAAG,iDAAiD,EACnD,SAAS;AAAA;AAAA,EAEZ,0BAA0BA,GAAE,OACzB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,QAAQ,IAAI,OAAO,OAAO,IAAI;AAAA;AAAA;AAAA,EAGjC,8BAA8BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1E,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7E,qCAAqCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EAClF,mCAAmCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EACjF,wBAAwBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAK,EAAE,QAAQ,GAAK;AAAA,EAC/E,0BAA0BA,GAAE,OACzB,OAAO,EACP,IAAI,EACJ,IAAI,IAAI,EACR,IAAI,IAAI,OAAO,IAAI,EACnB,QAAQ,OAAO,IAAI;AAAA,EACtB,mBAAmBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,IAAI,GAAM,EAAE,QAAQ,IAAM;AAAA;AAAA;AAAA,EAGhF,4BAA4BA,GAAE,OAC3B,OAAO,EACP,IAAI,EACJ,SAAS,EACT,QAAQ,MAAM,OAAO,IAAI;AAAA,EAC5B,wBAAwBA,GAAE,OACvB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,QAAQ,MAAM,IAAI;AAAA,EACrB,+BAA+BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EAC5E,0BAA0BA,GAAE,OACzB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,QAAQ,OAAO,OAAO,IAAI;AAAA,EAC7B,sBAAsBA,GAAE,OACrB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,QAAQ,KAAK,OAAO,IAAI;AAAA,EAC3B,wBAAwBA,GAAE,OACvB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,QAAQ,OAAO,OAAO,IAAI;AAAA,EAC7B,+BAA+BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EAC7E,6BAA6BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EAC3E,8BAA8BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EAC5E,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAK;AAAA;AAAA,EAEhF,mCAAmCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAK;AAAA;AAAA,EAEnF,wCAAwCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EACzF,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA;AAAA,EAInF,aAAaA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxD,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA,EAEhD,4BAA4BA,GAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACxD,oBAAoB,WAAW,QAAQ,IAAI;AAAA,EAC3C,0BAA0B,WAAW,QAAQ,IAAI;AAAA;AAAA,EAEjD,gBAAgB,WAAW,QAAQ,KAAK;AAAA,EACxC,mBAAmB,WAAW,QAAQ,KAAK;AAAA;AAAA,EAE3C,iBAAiBA,GAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA;AAAA,EAE7C,2BAA2B,WAAW,QAAQ,KAAK;AAAA;AAAA,EAEnD,sCAAsCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAAA,EACpF,+BAA+BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA,EAG/E,wCAAwCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACvF,qCAAqCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACpF,+BAA+BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC9E,qCAAqCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACpF,sCAAsCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACrF,qCAAqCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKpF,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAChF,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA;AAAA,EAGhF,yCAAyCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACxF,sCAAsCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACrF,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC/E,sCAAsCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIrF,oCAAoCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,QAAQ,IAAO;AAAA;AAAA,EAEtF,6BAA6BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAK,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,EAKjF,0BAA0BA,GAAE,KAAK,CAAC,cAAc,UAAU,SAAS,CAAC,EAAE,QAAQ,YAAY;AAAA;AAAA,EAE1F,6BAA6B,WAAW,QAAQ,IAAI;AAAA,EACpD,gCAAgCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,GAAS;AAAA,EACvF,mCAAmCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,GAAU;AAAA,EAC3F,sCAAsCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,GAAO;AAAA,EAC3F,oCAAoCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,GAAa;AAAA;AAAA;AAAA;AAAA,EAI/F,4CAA4CA,GAAE,OAC3C,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,QAAQ,GAAO;AAAA,EAClB,+CAA+CA,GAAE,OAC9C,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,QAAQ,GAAK;AAAA,EAChB,kDAAkDA,GAAE,OACjD,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,QAAQ,GAAS;AAAA,EACpB,oCAAoCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,GAAO;AAAA;AAAA;AAAA,EAGzF,8BAA8BA,GAAE,OAAO,OAAO,EAAE,YAAY,EAAE,IAAI,GAAW,EAAE,QAAQ,GAAK;AAAA,EAC5F,2BAA2BA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EAC7E,iCAAiCA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;AAAA,EAC7E,+BAA+BA,GAAE,OAC9B,OAAO,EACP,IAAI,EACJ,IAAI,EAAE,EACN,QAAQ,KAAK,KAAK,EAAE;AAAA,EACvB,mCAAmCA,GAAE,OAClC,OAAO,EACP,IAAI,EACJ,IAAI,EAAE,EACN,IAAI,KAAK,KAAK,KAAK,EAAE,EACrB,QAAQ,IAAI,KAAK,KAAK,EAAE;AAAA;AAAA,EAE3B,uBAAuBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE;AAAA;AAAA,EAEjE,yBAAyBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACpD,0BAA0BA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrD,8BAA8BA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzD,uBAAuBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAElD,wBAAwBA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,KAAM,EAAE,QAAQ,GAAG;AAAA;AAAA,EAE/E,oBAAoBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAG/C,qCAAqCA,GAAE,IAAI,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAG/D,4CAA4CA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC3F,0BAA0BA,GAAE,KAAK,CAAC,UAAU,aAAa,MAAM,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAClF,uBAAuBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,aAAa;AAAA,EAC9D,wBAAwBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,yBAAyBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnD,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACpC,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,0BAA0BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9C,8BAA8BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClD,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACpC,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAExC,sBAAsB,WAAW,QAAQ,KAAK;AAAA,EAC9C,4BAA4B,WAAW,QAAQ,KAAK;AAAA,EACpD,6BAA6BA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjD,iCAAiCA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrD,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,wBAAwBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,4BAA4BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChD,uBAAuBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,6BAA6BA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjD,6BAA6BA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjD,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,wBAAwBA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC7C,wBAAwBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,0BAA0BA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC/C,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,+BAA+BA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnD,2BAA2BA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,+BAA+BA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAGnD,mBAAmBA,GAChB,MAAMA,GAAE,MAAM,EAAE,UAAU,CAAC,UAAU,MAAM,YAAY,CAAC,CAAC,EACzD,IAAI,CAAC,EACL,SAAS;AAAA,EACZ,2BAA2BA,GAAE,KAAK,CAAC,UAAU,QAAQ,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA,EAIhF,kBAAkBA,GACf,MAAMA,GAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC,EACnD,IAAI,CAAC,EACL,QAAQ,CAAC,UAAU,CAAC;AAAA;AAAA;AAAA;AAAA,EAIvB,cAAcA,GACX,MAAMA,GAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC,EAClD,IAAI,CAAC,EACL,QAAQ,CAAC,iBAAiB,CAAC;AAAA,EAC9B,WAAWA,GACR,OAAO,EACP,MAAM,iBAAiB,EACvB,SAAS;AAAA,EACZ,YAAYA,GACT,OAAO,EACP,MAAM,iBAAiB,EACvB,SAAS;AAAA;AAAA,EAEZ,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAE3C,uBAAuBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMlD,8BAA8B,WAAW,QAAQ,IAAI;AAAA;AAAA,EAErD,qCAAqC,WAAW,SAAS;AAAA;AAAA;AAAA;AAAA,EAIzD,0CAA0CA,GAAE,KAAK,CAAC,YAAY,OAAO,CAAC,EAAE,QAAQ,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1F,qDAAqD,WAAW,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7E,sBAAsBA,GAAE,KAAK,CAAC,UAAU,UAAU,CAAC,EAAE,QAAQ,QAAQ;AAAA,EACrE,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAWA,GAAE,OAAO,EAAE,QAAQ,kCAAkC;AAAA,EAChE,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,sBAAsBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1C,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,wBAAwBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE5C,0BAA0B,WAAW,QAAQ,KAAK;AAAA,EAClD,YAAYA,GACT;AAAA,IACCA,GAAE,OAAO;AAAA,MACP,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,UAAU;AAAA,MACtC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACjC,KAAKA,GAAE,OAAO,EAAE,IAAI;AAAA,MACpB,cAAcA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,MAClD,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMhD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,MACrD,gBAAgBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,MAEzC,iBAAiB,yBAAyB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOnD,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACnD,eAAe,6BAA6B,SAAS;AAAA,MACrD,mBAAmB,2BAA2B,SAAS;AAAA,IACzD,CAAC;AAAA,EACH,EACC,QAAQ,CAAC,CAAC;AACf,CAAC;AAMD,IAAM,gCAAgC,eAAe,KAAK;AAAA,EACxD,aAAa;AAAA,EACb,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,UAAU;AAAA,EACV,aAAa;AAAA,EACb,4BAA4B;AAAA,EAC5B,6BAA6B;AAAA,EAC7B,6BAA6B;AAAA,EAC7B,2BAA2B;AAAA,EAC3B,0BAA0B;AAC5B,CAAC;AACD,IAAM,+BAA+B,8BAA8B,OAAO;AAAA,EACxE,SAAS,eAAe,MAAM;AAAA,EAC9B,2BAA2B,eAAe,MAAM;AAAA,EAChD,+BAA+B,eAAe,MAAM;AACtD,CAAC;AACD,IAAM,8BAA8B,eAAe,KAAK;AAAA,EACtD,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,+BAA+B;AAAA,EAC/B,8BAA8B;AAAA,EAC9B,qBAAqB;AAAA,EACrB,qBAAqB;AAAA,EACrB,0BAA0B;AAAA,EAC1B,8BAA8B;AAAA,EAC9B,6BAA6B;AAAA,EAC7B,oCAAoC;AAAA,EACpC,+BAA+B;AAAA,EAC/B,8BAA8B;AAAA,EAC9B,4BAA4B;AAAA,EAC5B,2BAA2B;AAAA,EAC3B,iCAAiC;AAAA,EACjC,6BAA6B;AAAA,EAC7B,6BAA6B;AAC/B,CAAC;AACD,IAAM,qCAAqC,8BAA8B;AAAA,EACvE,4BAA4B;AAC9B;AAKA,SAAS,2BAA2B,QAA2B;AAC7D,QAAM,WAAW,CAAC,SAAiB,yBAAyB,MAAM,MAAM;AACxE,SAAO;AAAA,IACL,aAAa,SAAS,uBAAuB;AAAA,IAC7C,aAAa,SAAS,sBAAsB;AAAA,IAC5C,oBACE,SAAS,8BAA8B,KACvC,SAAS,gBAAgB,KACzB,SAAS,YAAY;AAAA,IACvB,UAAU,SAAS,oBAAoB;AAAA,IACvC,aAAa,SAAS,uBAAuB;AAAA,IAC7C,4BAA4B,SAAS,uCAAuC;AAAA,IAC5E,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,2BACE,SAAS,sCAAsC,KAAK,SAAS,6BAA6B;AAAA,IAC5F,0BACE,SAAS,qCAAqC,KAAK,SAAS,4BAA4B;AAAA,EAC5F;AACF;AAEO,SAAS,0BACd,SAA4B,QAAQ,KACZ;AACxB,QAAM,WAAW,6BAA6B,MAAM;AAAA,IAClD,GAAG,2BAA2B,MAAM;AAAA,IACpC,SAAS,yBAAyB,qBAAqB,MAAM;AAAA,IAC7D,2BAA2B;AAAA,MACzB;AAAA,MACA;AAAA,IACF;AAAA,IACA,+BAA+B;AAAA,MAC7B;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACD,eAAa,QAAQ;AACrB,MACE,QAAQ,SAAS,yBAAyB,MAAM,QAAQ,SAAS,6BAA6B,GAC9F;AACA,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,SAAO;AACT;AAEO,SAAS,gCACd,SAA4B,QAAQ,KACN;AAC9B,QAAM,WAAW,CAAC,SAAiB,yBAAyB,MAAM,MAAM;AACxE,QAAM,WAAW,mCAAmC,MAAM;AAAA,IACxD,GAAG,2BAA2B,MAAM;AAAA,IACpC,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,oCAAoC,SAAS,iDAAiD;AAAA,IAC9F,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,iCAAiC,SAAS,8CAA8C;AAAA,IACxF,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,6BAA6B,SAAS,0CAA0C;AAAA,EAClF,CAAC;AACD,eAAa,QAAQ;AACrB,gCAA8B,QAAQ;AACtC,SAAO;AACT;AAeO,SAAS,gCAAgC,UAAoB;AAClE,SAAO,0BAA0B,MAAM;AAAA,IACrC,UAAU,SAAS;AAAA,IACnB,UAAU,SAAS;AAAA,IACnB,cAAc,SAAS;AAAA,IACvB,qBAAqB,SAAS;AAAA,IAC9B,mBAAmB,SAAS;AAAA,IAC5B,mBAAmB,SAAS;AAAA,EAC9B,CAAC;AACH;AAIO,SAAS,gCACd,UACiC;AACjC,SAAO;AAAA,IACL,kBAAkB,SAAS;AAAA,IAC3B,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,IACzB,YAAY,SAAS;AAAA,IACrB,UAAU,SAAS;AAAA,EACrB;AACF;AAIO,SAAS,sBAAsB,eAAkD;AACtF,MAAI,CAAC,cAAe,QAAO;AAC3B,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,aAAa;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MACE,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,OAAO,QAAQ,KAC7C,OAAO,YACP,OAAO,YACP,OAAO,UACP,OAAO,QACN,OAAO,aAAa,MAAM,OAAO,aAAa,KAC/C;AACA,WAAO;AAAA,EACT;AACA,SAAO,OAAO;AAChB;AAEO,SAAS,4BAA4B,eAAkD;AAC5F,QAAM,SAAS,sBAAsB,aAAa;AAClD,SAAO,SAAS,GAAG,MAAM,2CAA2C;AACtE;AAGO,SAAS,+BAA+B,eAAkD;AAC/F,QAAM,SAAS,sBAAsB,aAAa;AAClD,SAAO,SAAS,GAAG,MAAM,oDAAoD;AAC/E;AAqDA,SAAS,uBAAuB,OAAsD;AACpF,SAAO,yBAAyB,KAAK,IAAI,QAAQ;AACnD;AAGO,SAAS,gBAAgB,UAA2D;AACzF,SAAO,uBAAuB,SAAS,SAAS;AAClD;AAOO,SAAS,2BACd,UAEA,wBAAwB,OAGZ;AACZ,QAAM,WACJ,SAAS,0BAA0B,UACnC,SAAS,oBAAoB,UAC7B,SAAS,wBAAwB,UACjC,SAAS,yBAAyB;AACpC,MAAI,UAAU;AACZ,UAAMC,UAAS,uBAAuB,SAAS,mBAAmB;AAClE,QAAI,CAAC,SAAS,yBAAyB,CAAC,SAAS,mBAAmB,CAACA,QAAQ,QAAO;AACpF,WAAO;AAAA,MACL,UAAU,SAAS;AAAA,MACnB,OAAO,SAAS;AAAA,MAChB,QAAAA;AAAA,MACA,GAAI,SAAS,uBAAuB,EAAE,SAAS,SAAS,qBAAqB,IAAI,CAAC;AAAA,IACpF;AAAA,EACF;AACA,QAAM,SAAS,wBAAwB,gBAAgB,QAAQ,IAAI;AACnE,SAAO,SACH;AAAA,IACE,UAAU;AAAA,IACV,OAAO,SAAS,YAAY;AAAA,IAC5B;AAAA,IACA,GAAI,SAAS,aAAa,EAAE,SAAS,SAAS,WAAW,IAAI,CAAC;AAAA,EAChE,IACA;AACN;AAGO,SAAS,4BACd,UAC6B;AAC7B,SAAO;AAAA,IACL,+BAA+B,QAAQ,EAAE;AAAA,IACzC,SAAS,mBAAmB,CAAC,IAAI,EAAE,WAAW,0CAA0C;AAAA,EAC1F;AACF;AAQO,SAAS,2BACd,UAC4B;AAC5B,QAAM,YACJ,SAAS,mBAAmB,SAAS,2BAA2B,UAAU,IAAI,MAAM;AACtF,MAAI,CAAC,UAAW,QAAO,EAAE,WAAW,OAAO,kBAAkB,MAAM;AACnE,QAAM,mBACJ,SAAS,mBAAmB,eACxB,OACA,SAAS,mBAAmB,eAC1B,UACA;AACR,SAAO,EAAE,WAAW,iBAAiB;AACvC;AAMO,SAAS,yBAAyB,OAAmD;AAC1F,MAAI,SAAS,KAAM,QAAO;AAC1B,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,aAAa,QAAQ,YAAY;AACvC,MACE,eAAe,cACf,eAAe,cACf,eAAe,cACf,eAAe,gBACf,eAAe,SACf,WAAW,WAAW,OAAO,KAC7B,WAAW,WAAW,OAAO,GAC7B;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOO,SAAS,kCAAkC,UAAgD;AAChG,SAAO,qCAAqC,QAAQ,EAAE;AACxD;AAgBO,SAAS,wBAAwB,UAA8C;AACpF,SAAO,qCAAqC,QAAQ,EAAE;AACxD;AAEA,SAAS,0BACP,UACAC,SACA,YACA,KACA,KACA,OACyE;AACzE,QAAM,WAAW,6BAA6B,KAAK,OAAO,GAAG;AAC7D,MAAI,CAAC,SAAS,IAAI;AAChB,IAAAA,QAAO,KAAK,EAAE,YAAY,KAAK,QAAQ,aAAa,SAAS,SAAS,MAAM,CAAC;AAC7E,WAAO,EAAE,QAAQ,MAAM;AAAA,EACzB;AACA,MAAI,CAAC,SAAS,WAAW,8BAA8B,QAAQ,GAAG;AAEhE,IAAAA,QAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,SAAS,GAAG,GAAG,qDAAqD,KAAK;AAAA,IAC3E,CAAC;AACD,WAAO,EAAE,QAAQ,MAAM;AAAA,EACzB;AACA,SAAO,EAAE,QAAQ,MAAM,SAAS,SAAS,QAAQ;AACnD;AAEA,SAAS,qCAAqC,UAG5C;AACA,QAAMA,UAAmC,CAAC;AAC1C,QAAM,QAAQ,SAAS,wBACpB,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB;AAAA,IACC,CAAC,SACC,SAAS,YACT,SAAS,kBACT,SAAS,eACT,SAAS,wBACT,SAAS;AAAA,EACb;AACF,QAAM,OAAO,oBAAI,IAA0B;AAC3C,QAAM,YAAwC,CAAC;AAC/C,aAAW,MAAM,OAAO;AACtB,QAAI,KAAK,IAAI,EAAE,EAAG;AAClB,SAAK,IAAI,EAAE;AACX,QAAI,OAAO,aAAa;AACtB,UACE,CAAC,SAAS,yBACV,CAAC,yBAAyB,SAAS,mBAAmB;AAEtD;AACF,YAAM,SAAS;AAAA,QACb;AAAA,QACAA;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AACA,UAAI,CAAC,OAAO,OAAQ;AACpB,gBAAU,KAAK;AAAA,QACb;AAAA,QACA,MAAM;AAAA,QACN,SAAS,OAAO;AAAA,QAChB,UAAU,SAAS,sBAAsB,QAAQ,QAAQ,EAAE;AAAA,QAC3D,QAAQ,SAAS;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB,OAAO,SAAS;AAAA,MAClB,CAAC;AACD;AAAA,IACF;AACA,QAAI,OAAO,UAAU;AACnB,UAAI,CAAC,SAAS,wBAAyB;AACvC,YAAM,SAAS,SAAS,0BAA0B,SAAS;AAC3D,UAAI,CAAC,yBAAyB,MAAM,EAAG;AAGvC,UACE,SAAS,mBAAmB,WAC5B,CAAC,SAAS,0BACV,CAAC,SAAS,yBACV;AACA;AAAA,MACF;AACA,YAAM,SAAS;AAAA,QACb;AAAA,QACAA;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AACA,UAAI,CAAC,OAAO,OAAQ;AACpB,gBAAU,KAAK;AAAA,QACb,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,SAAS,OAAO;AAAA,QAChB;AAAA,QACA,UACE,SAAS,2BACT,SAAS,iBACT,6BACA,QAAQ,QAAQ,EAAE;AAAA,QACpB,OAAO,SAAS;AAAA,MAClB,CAAC;AACD;AAAA,IACF;AACA,QAAI,OAAO,gBAAgB;AACzB,UAAI,CAAC,SAAS,uBAAwB;AACtC,YAAM,YACJ,SAAS,2BACT,SAAS,uBACT,IACA,QAAQ,QAAQ,EAAE;AACpB,YAAM,aAAa,SAAS,6BAA6B,SAAS,yBAAyB;AAC3F,YAAM,aACJ,SAAS,6BACT,SAAS,yBACT;AACF,YAAM,SAAS,SAAS,yBAAyB,SAAS,qBAAqB;AAC/E,YAAM,UAAU,SAAS,0BAA0B,SAAS,sBAAsB;AAClF,UACE,CAAC,YACD,CAAC,cACA,CAAC,yBAAyB,MAAM,KAAK,CAAC,yBAAyB,OAAO,GACvE;AACA;AAAA,MACF;AAGA,UACE,SAAS,mBAAmB,WAC5B,CAAC,SAAS,2BACV,CAAC,SAAS,6BACV,CAAC,SAAS,yBACV,CAAC,SAAS,wBACV;AACA;AAAA,MACF;AACA,YAAM,QAAQ,SAAS,wBAAwB;AAC/C,YAAM,SAAS;AAAA,QACb;AAAA,QACAA;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT;AAAA,MACF;AACA,UAAI,CAAC,OAAO,OAAQ;AACpB,YAAM,UAAU,OAAO;AACvB,gBAAU,KAAK;AAAA,QACb,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ,yBAAyB,MAAM,IAAI,SAAS;AAAA,QACpD,SAAS,yBAAyB,OAAO,IAAI,UAAU;AAAA,QACvD;AAAA,QACA;AAAA,MACF,CAAC;AACD;AAAA,IACF;AACA,QAAI,OAAO,sBAAsB;AAM/B,UAAI,CAAC,SAAS,yBAA0B;AACxC,gBAAU,KAAK;AAAA,QACb,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,cAAc;AAAA,MAChB,CAAC;AACD;AAAA,IACF;AACA,QAAI,OAAO,0BAA0B;AACnC,UAAI,CAAC,SAAS,6BAA8B;AAC5C,gBAAU,KAAK;AAAA,QACb,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,EAAE,WAAW,QAAAA,QAAO;AAC7B;AAmBA,IAAM,0BAA0BF,GAC7B,OAAO;AAAA,EACN,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAW;AAAA,EAC5D,6BAA6BA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,GAAa,EAAE,SAAS;AAAA,EACxF,kCAAkCA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,GAAa,EAAE,SAAS;AAAA,EAC7F,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,GAAa,EAAE,SAAS;AAAA,EACzF,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO,EAAE,SAAS;AAC3D,CAAC,EACA,OAAO,EACP,YAAY,CAAC,SAAS,QAAQ;AAC7B,QAAM,QAAQ,QAAQ,gCAAgC;AACtD,QAAM,SAAS,QAAQ,iCAAiC;AACxD,MAAI,UAAU,QAAQ;AACpB,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,QAAQ,qCAAqC,UAAa,CAAC,OAAO;AACpE,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAQI,IAAM,2BAAwE;AAAA;AAAA;AAAA,EAGnF,qBAAqB;AAAA,IACnB,iBAAiB;AAAA,IACjB,6BAA6B;AAAA,IAC7B,kCAAkC;AAAA,IAClC,8BAA8B;AAAA,IAC9B,WAAW;AAAA,EACb;AAAA,EACA,6BAA6B;AAAA,IAC3B,iBAAiB;AAAA,IACjB,6BAA6B;AAAA,IAC7B,kCAAkC;AAAA,IAClC,8BAA8B;AAAA,IAC9B,WAAW;AAAA,EACb;AAAA,EACA,0BAA0B;AAAA,IACxB,iBAAiB;AAAA,IACjB,6BAA6B;AAAA,IAC7B,kCAAkC;AAAA,IAClC,8BAA8B;AAAA,IAC9B,WAAW;AAAA,EACb;AAAA,EACA,kBAAkB,EAAE,iBAAiB,MAAO,WAAW,IAAI;AAAA,EAC3D,SAAS,EAAE,iBAAiB,KAAO,WAAW,IAAI;AAAA,EAClD,aAAa,EAAE,iBAAiB,KAAO,WAAW,IAAI;AACxD;AAGO,SAAS,yBAAyB,OAAuB;AAC9D,SAAO,MACJ,KAAK,EACL,YAAY,EACZ,QAAQ,uBAAuB,EAAE;AACtC;AAGO,SAAS,mCAAmC,OAAwB;AACzE,SAAO,yBAAyB,KAAK,EAAE,WAAW,SAAS;AAC7D;AAGO,SAAS,2BACd,KACA,MAAM,4BACoB;AAC1B,MAAI,QAAQ,UAAa,IAAI,KAAK,MAAM,GAAI,QAAO;AACnD,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI,MAAM,GAAG,GAAG,qBAAqB;AAAA,EAC7C;AACA,QAAM,SAAS,wBAAwB,UAAU,MAAM;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR,GAAG,GAAG,gBAAgB,OAAO,MAAM,OAAO,IAAI,CAAC,UAAU,MAAM,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,IACpF;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAGO,SAAS,yBACd,KACA,OAC0B;AAC1B,SACE,2BAA2B,GAAG,KAC9B,yBAAyB,yBAAyB,KAAK,CAAC,KACxD;AAEJ;AAGO,SAAS,6BACd,KACA,OACA,KACgF;AAChF,MAAI;AACJ,MAAI;AACF,eAAW,2BAA2B,KAAK,GAAG;AAAA,EAChD,SAAS,OAAO;AACd,WAAO,EAAE,IAAI,OAAO,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;AAAA,EACpF;AACA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS,YAAY,yBAAyB,yBAAyB,KAAK,CAAC,KAAK;AAAA,EACpF;AACF;AAGO,SAAS,8BACd,UACS;AACT,SAAO,SAAS,gBAAgB,YAAY,SAAS,oBAAoB;AAC3E;AAqBO,SAAS,+BAA+B,SAAqC;AAClF,SACE,QAAQ,gCAAgC,UACxC,QAAQ,iCAAiC;AAE7C;AAGA,SAAS,yBACP,UACA,qBACQ;AACR,SAAO,SAAS,2BAA2B,uBAAuB;AACpE;AAOO,SAAS,wBACd,SACA,OACA,mBACgB;AAChB,MAAI;AACJ,MAAI;AACJ,MAAI,MAAM,SAAS,UAAU;AAC3B,QACE,QAAQ,gCAAgC,UACxC,QAAQ,iCAAiC,QACzC;AACA,YAAM,IAAI,MAAM,gDAAgD;AAAA,IAClE;AACA,eAAW,SAAS;AAAA,MAClB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACR,GAAG;AACD,UAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC7C,cAAM,IAAI,MAAM,uDAAuD;AAAA,MACzE;AAAA,IACF;AACA,UAAM,YACJ,QAAQ,oCAAoC,QAAQ;AAEtD,UAAM,eAAe,KAAK;AAAA,MACxB;AAAA,MACA,MAAM,cAAc,MAAM,mBAAmB,MAAM;AAAA,IACrD;AACA,gBACE,OAAO,MAAM,mBAAmB,YAAY,IAAI,OAAO,SAAS,IAChE,OAAO,MAAM,eAAe,IAAI,OAAO,QAAQ,2BAA2B,IAC1E,OAAO,MAAM,YAAY,IAAI,OAAO,QAAQ,4BAA4B;AAC1E,kBAAc;AAAA,EAChB,OAAO;AACL,QAAI,CAAC,OAAO,SAAS,MAAM,OAAO,KAAK,MAAM,UAAU,GAAG;AACxD,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AACA,gBAAY,OAAO,KAAK,KAAK,MAAM,UAAU,GAAK,CAAC,IAAI,OAAO,QAAQ,eAAe;AACrF,kBAAc;AAAA,EAChB;AACA,QAAM,SAAS,OAAO,OAAU,qBAAqB,QAAQ,aAAa,EAAE;AAC5E,QAAM,YAAY,YAAY,cAAc,MAAM;AAClD,QAAM,SAAS,cAAc;AAC7B,QAAM,UAAU,YAAY,SAAS,SAAS,MAAM;AACpD,MAAI,SAAS,OAAO,OAAO,gBAAgB,GAAG;AAC5C,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,SAAO,EAAE,oBAAoB,OAAO,QAAQ,GAAG,kBAAkB,OAAO,MAAM,EAAE;AAClF;AAQO,SAAS,4BAA4B,UAA4C;AACtF,SAAO,wBAAwB,QAAQ,EAAE;AAAA,IAAQ,CAAC,UAChD,MAAM,WAAW,aAAa,CAAC,MAAM,UAAU,IAAI,CAAC;AAAA,EACtD;AACF;AAGO,SAAS,+BAA+B,UAA6B;AAC1E,SAAO,kCAAkC,QAAQ,EAAE;AAAA,IACjD,CAAC,aACC,SAAS,SAAS,wBAAwB,SAAS,SAAS;AAAA,EAChE;AACF;AAsEA,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EAClC,6BAA6BA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,mCAAmCA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC3E,kCAAkCA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC1E,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC3D,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO,EAAE,SAAS;AAC3D,CAAC;AAED,IAAM,6BAA6BA,GAChC,OAAO;AAAA,EACN,SAAS;AAAA,EACT,iBAAiBA,GACd;AAAA,IACCA,GAAE,OAAO;AAAA,MACP,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MACjD,SAAS;AAAA,IACX,CAAC;AAAA,EACH,EACC,SAAS;AACd,CAAC,EACA,YAAY,CAAC,UAAU,QAAQ;AAC9B,MAAI,WAAW;AACf,aAAW,CAAC,OAAO,IAAI,MAAM,SAAS,mBAAmB,CAAC,GAAG,QAAQ,GAAG;AACtE,QAAI,KAAK,sBAAsB,UAAU;AACvC,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,mBAAmB,OAAO,oBAAoB;AAAA,QACrD,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,eAAW,KAAK;AAAA,EAClB;AACF,CAAC;AAEI,IAAM,sBAAsBA,GAAE,KAAK,CAAC,aAAa,eAAe,SAAS,CAAC;AAG1E,IAAM,0BAA0BA,GACpC,OAAO;AAAA,EACN,UAAU;AAAA,EACV,UAAUA,GAAE,QAAQ;AACtB,CAAC,EACA,YAAY,CAAC,OAAO,QAAQ;AAC3B,MAAI,MAAM,aAAa,iBAAiB,MAAM,UAAU;AACtD,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,UAAU;AAAA,MACjB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGH,IAAM,kBAAkBA,GAAE,KAAK,CAAC,QAAQ,SAAS,OAAO,CAAC;AACzD,IAAM,qBAAqBA,GAAE,KAAK,CAAC,YAAY,YAAY,QAAQ,WAAW,CAAC;AAExE,IAAM,4BAA4BA,GACtC,OAAO;AAAA,EACN,WAAW,wBAAwB,OAAO;AAAA,IACxC,SAASA,GAAE,MAAM,eAAe;AAAA,IAChC,eAAe,gBAAgB,SAAS;AAAA,IACxC,UAAUA,GAAE,QAAQ;AAAA,EACtB,CAAC;AAAA,EACD,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,aAAaA,GAAE,OAAO;AAAA,IACpB,WAAW;AAAA,IACX,SAAS;AAAA,IACT,eAAe;AAAA,IACf,iBAAiB,wBAAwB,QAAQ;AAAA,MAC/C,UAAU;AAAA,MACV,UAAU;AAAA,IACZ,CAAC;AAAA,EACH,CAAC;AAAA,EACD,iBAAiBA,GAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AAAA;AAAA,EAE/C,qBAAqBA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACnD,kBAAkBA,GAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AAAA,EAChD,YAAYA,GAAE,OAAO;AAAA,IACnB,KAAK;AAAA,IACL,oBAAoB;AAAA,IACpB,eAAe;AAAA,EACjB,CAAC;AAAA,EACD,eAAe,wBAAwB,OAAO;AAAA,IAC5C,MAAMA,GAAE,KAAK,CAAC,YAAY,aAAa,MAAM,CAAC;AAAA,EAChD,CAAC,EAAE,SAAS;AAAA,EACZ,cAAcA,GACX;AAAA,IACCA,GAAE,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,UAAUA,GAAE,QAAQ;AAAA,MACpB,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IAC7D,CAAC;AAAA,EACH,EACC,IAAI,CAAC;AACV,CAAC,EACA,YAAY,CAAC,cAAc,QAAQ;AAClC,QAAM,UAAU,IAAI,IAAI,aAAa,UAAU,OAAO;AACtD,MAAI,QAAQ,SAAS,aAAa,UAAU,QAAQ,QAAQ;AAC1D,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,aAAa,SAAS;AAAA,MAC7B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,aAAa,UAAU,kBAAkB,QACzC,CAAC,QAAQ,IAAI,aAAa,UAAU,aAAa,GACjD;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,aAAa,eAAe;AAAA,MACnC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,aAAa,UAAU,YAAY,aAAa,UAAU,QAAQ,WAAW,GAAG;AAClF,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,aAAa,SAAS;AAAA,MAC7B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,aAAW,SAAS,CAAC,mBAAmB,kBAAkB,GAAY;AACpE,QAAI,IAAI,IAAI,aAAa,KAAK,CAAC,EAAE,SAAS,aAAa,KAAK,EAAE,QAAQ;AACpE,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,GAAG,KAAK;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,aAAa,oBAAI,IAAY;AACnC,aAAW,CAAC,OAAO,IAAI,KAAK,aAAa,aAAa,QAAQ,GAAG;AAC/D,QAAI,WAAW,IAAI,KAAK,EAAE,GAAG;AAC3B,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,IAAI;AAAA,QAClC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,eAAW,IAAI,KAAK,EAAE;AACtB,QAAI,KAAK,aAAa,iBAAiB,KAAK,UAAU;AACpD,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,UAAU;AAAA,QACxC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAiCI,IAAM,mBAAmBA,GAAE,KAAK,CAAC,aAAa,QAAQ,oBAAoB,CAAC;AAQ3E,IAAM,2BAA2BA,GAAE,KAAK,CAAC,UAAU,cAAc,CAAC;AASlE,IAAM,uBAAuBA,GAAE,KAAK;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAID,IAAM,qBAAqBA,GACxB,OAAO,EACP;AAAA,EACC,CAAC,UAAU,aAAa,EAAE,IAAI,IAAI,SAAS,MAAM,CAAC,MAAM;AAAA,EACxD;AACF;AAEF,IAAM,sBAAsBA,GACzB,OAAO;AAAA,EACN,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EACpB,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAC5C,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA,EAC7C,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAClC,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA,EAC/C,SAAS,mBAAmB,SAAS;AAAA,EACrC,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAG5D,4BAA4BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjE,iBAAiBA,GAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EACtC,iBAAiBA,GAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EACtC,cAAc,0BAA0B,SAAS;AAAA,EACjD,SAASA,GAAE,MAAM,CAAC,oBAAoB,0BAA0B,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAG5E,kBAAkBA,GAAE,MAAM,EAAE,SAAS;AAAA,EACrC,SAASA,GAAE,MAAM,EAAE,SAAS;AAC9B,CAAC,EACA,YAAY,CAAC,OAAO,QAAQ;AAC3B,MACE,MAAM,gBACN,MAAM,oBAAoB,UAC1B,MAAM,oBAAoB,MAAM,aAAa,UAAU,UACvD;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,gBACN,MAAM,oBAAoB,UAC1B,MAAM,oBAAoB,MAAM,aAAa,YAAY,UAAU,UACnE;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,6BAA6BA,GACvC,OAAO;AAAA,EACN,aAAaA,GAAE,MAAM,CAACA,GAAE,OAAO,EAAE,KAAK,GAAGA,GAAE,QAAQ,EAAE,CAAC,CAAC;AAAA,EACvD,UAAUA,GAAE,OAAO,EAAE,MAAM,gBAAgB;AAC7C,CAAC,EACA,OAAO;AAEH,IAAM,+BAA+BA,GACzC,OAAO;AAAA,EACN,SAASA,GAAE,QAAQ,CAAC;AAAA,EACpB,OAAOA,GAAE,OAAO,EAAE,MAAM,wBAAwB;AAAA,EAChD,UAAU;AAAA,EACV,OAAOA,GACJ,OAAO;AAAA,IACN,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK;AAAA,IACzC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAC3D,CAAC,EACA,OAAO,EACP,SAAS;AACd,CAAC,EACA,OAAO;AACV,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EACxC,UAAU,2BAA2B,SAAS;AAAA;AAAA,EAE9C,mBAAmBA,GAChB,OAAO;AAAA,IACN,cAAcA,GAAE,OAAO,EAAE,KAAK;AAAA,IAC9B,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,CAAC,EACA,OAAO,EACP,SAAS;AAAA,EACZ,MAAMA,GAAE,KAAK,CAAC,WAAW,OAAO,CAAC,EAAE,QAAQ,SAAS;AAAA,EACpD,UAAUA,GAAE,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,EAAE,QAAQ,IAAI;AAAA,EAClD,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAK;AAAA,EAC1D,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AACjE,CAAC;AAED,IAAM,yBAAyBA,GAC5B,OAAO;AAAA,EACN,MAAM,qBAAqB,QAAQ,SAAS;AAAA,EAC5C,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,UAAU;AAAA;AAAA,EACtC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,KAAK,iBAAiB,QAAQ,MAAM;AAAA,EACpC,WAAW,yBAAyB,SAAS;AAAA;AAAA;AAAA,EAG7C,qBAAqBA,GAClB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,KAAK,GAAM,EACpB,SAAS;AAAA,EACZ,yBAAyBA,GACtB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,KAAK,GAAM,EACpB,SAAS;AAAA,EACZ,aAAa,yBAAyB,QAAQ,QAAQ;AAAA,EACtD,SAASA,GAAE,OAAO,EAAE,IAAI;AAAA,EACxB,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC5B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC/B,cAAcA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACxD,gBAAgBA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC1D,yBAAyBA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC7D,0BAA0BA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAG9D,kBAAkBA,GAAE,MAAM,EAAE,SAAS;AAAA,EACrC,SAASA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC5B,QAAQA,GAAE,MAAM,mBAAmB,EAAE,IAAI,CAAC;AAC5C,CAAC,EACA,YAAY,CAAC,UAAU,QAAQ;AAC9B,MAAI,SAAS,SAAS,aAAa;AACjC;AAAA,EACF;AACA,MAAI,SAAS,WAAW,QAAW;AACjC,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,SAAS,cAAc,QAAW;AACpC,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,WAAW;AAAA,MAClB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,SAAS,mBAAmB,QAAW;AACzC,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,SAAS,iBAAiB,QAAW;AACvC,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,SAAS,6BAA6B,QAAW;AACnD,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,0BAA0B;AAAA,MACjC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,SAAS,4BAA4B,QAAW;AAClD,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,yBAAyB;AAAA,MAChC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,+BAA+B;AACrC,IAAM,gCAAgC;AACtC,IAAM,oCAAoC;AAC1C,IAAM,mCAAmC;AACzC,IAAM,uCAAuC;AAC7C,IAAM,yBAAyB;AAC/B,IAAM,6BAA6B;AACnC,IAAM,mCAAmC;AACzC,IAAM,uCAAuC;AAC7C,IAAM,sCAAsC;AAC5C,IAAM,0CAA0C;AAChD,IAAM,sBAAsB;AAC5B,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB;AAC9B,IAAM,8BAA8B;AACpC,IAAM,kCAAkC;AACxC,IAAM,iCAAiC;AACvC,IAAM,qCAAqC;AAM3C,IAAM,kCAAkC;AACxC,IAAM,sCAAsC;AAC5C,IAAM,wCAAwC;AAC9C,IAAM,4CAA4C;AAElD,IAAM,iBAAiB;AAE9B,IAAM,8BAA8B,oBAAI,IAAY;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,IAAM,iBAAiBA,GAAE,KAAK,CAAC,QAAQ,SAAS,CAAC;AAGjD,IAAM,2BAA2BA,GAAE,KAAK;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,YAAYA,GACf,OAAO,EACP,IAAI,GAAG,EACP,OAAO,CAAC,UAAU,CAAC,WAAW,KAAK,KAAK,GAAG;AAAA,EAC1C,SAAS;AACX,CAAC;AAEI,SAAS,yBAAyB,KAA6C;AACpF,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,uDAAuD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAC7G,EAAE,OAAO,MAAM;AAAA,IACjB;AAAA,EACF;AACA,SAAOA,GAAE,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,GAAG,cAAc,EAAE,MAAM,MAAM;AACjE;AAEO,SAAS,oBAAoB,KAAqC;AACvE,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,iDAAiD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACvG,EAAE,OAAO,MAAM;AAAA,IACjB;AAAA,EACF;AACA,SAAOA,GAAE,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,GAAG,SAAS,EAAE,MAAM,MAAM;AAC5D;AAEO,SAAS,qBACd,UACwB;AACxB,SAAO,oBAAoB,SAAS,cAAc;AACpD;AAEO,IAAM,sBAAsBA,GAChC,OAAO;AAAA,EACN,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,oBAAoBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,iCAAiC;AAAA,EAClF,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACjC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC/C,SAAS,mBAAmB,SAAS;AAAA,EACrC,WAAWA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;AAAA,EAC3C,iBAAiBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAC1C,QAAQA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjC,qBAAqBA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC1D,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAS;AAAA,EAClE,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAO;AAAA,EACzE,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAO;AAAA,EAClE,SAASA,GAAE,MAAM,CAAC,oBAAoB,0BAA0B,CAAC,EAAE,SAAS;AAAA,EAC5E,kBAAkBA,GAAE,MAAM,EAAE,SAAS;AAAA,EACrC,SAASA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC5B,QAAQA,GAAE,MAAM,EAAE,SAAS;AAC7B,CAAC,EACA,OAAO;AAGH,IAAM,yBAAyBA,GACnC,OAAO;AAAA,EACN,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,OAAO;AAAA,EACnD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC/C,SAAS,mBAAmB,SAAS;AAAA,EACrC,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC9C,cAAc;AAAA,EACd,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,4BAA4BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjE,kBAAkBA,GAAE,MAAM,EAAE,SAAS;AAAA,EACrC,SAASA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC5B,SAASA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC5B,QAAQA,GAAE,MAAM,EAAE,SAAS;AAC7B,CAAC,EACA,OAAO;AASH,IAAM,oBAAoBA,GAC9B,OAAO;AAAA,EACN,iBAAiBA,GACd,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,kEAAkE;AAAA,EAC3E,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC/C,SAAS,mBAAmB,SAAS;AAAA,EACrC,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC9C,cAAc;AAAA,EACd,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,4BAA4BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjE,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,SAASA,GAAE,MAAM,CAAC,oBAAoB,0BAA0B,CAAC,EAAE,SAAS;AAAA,EAC5E,kBAAkBA,GAAE,MAAM,EAAE,SAAS;AAAA,EACrC,SAASA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC5B,QAAQA,GAAE,MAAM,EAAE,SAAS;AAC7B,CAAC,EACA,OAAO;AAGV,IAAM,4BAA4BA,GAC/B,OAAO,EACP,IAAI,EACJ,YAAY,CAAC,OAAO,YAAY;AAC/B,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,IAAI,QAAQ;AACd,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,IAAI,MAAM;AACZ,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAEH,IAAM,iCAAiCA,GAAE,KAAK,CAAC,WAAW,WAAW,CAAC;AAEtE,IAAM,gCAAgC,oBAAoB,WAAW;AAAA,EACnE,SAASA,GAAE,MAAM,EAAE,SAAS;AAC9B,CAAC,EAAE,OAAO;AAEV,IAAM,mCAAmC,uBAAuB,WAAW;AAAA,EACzE,MAAM,+BAA+B,QAAQ,SAAS;AAAA,EACtD,SAAS;AAAA,EACT,QAAQA,GAAE,MAAM,6BAA6B,EAAE,IAAI,CAAC;AAAA,EACpD,QAAQA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC3B,WAAWA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC9B,gBAAgBA,GAAE,MAAM,EAAE,SAAS;AAAA,EACnC,cAAcA,GAAE,MAAM,EAAE,SAAS;AAAA,EACjC,0BAA0BA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC7C,yBAAyBA,GAAE,MAAM,EAAE,SAAS;AAC9C,CAAC,EAAE,OAAO;AAEV,IAAM,sCAAsC,oBAAoB,WAAW;AAAA,EACzE,SAASA,GAAE,MAAM,EAAE,SAAS;AAC9B,CAAC,EAAE,OAAO;AAEV,IAAM,oCAAoC,kBAAkB,WAAW;AAAA,EACrE,SAASA,GAAE,MAAM,EAAE,SAAS;AAC9B,CAAC,EAAE,OAAO;AAEV,IAAM,0BAA0B,oBAAoB,WAAW;AAAA,EAC7D,SAASA,GAAE,QAAQ,EAAE,SAAS;AAAA,EAC9B,IAAIA,GAAE,OAAO,EAAE,MAAM,qCAAqC;AAAA,EAC1D,iBAAiBA,GAAE,OAAO,EAAE,MAAM,8BAA8B;AAAA,EAChE,cAAc;AAAA,EACd,SAASA,GAAE,MAAM,EAAE,SAAS;AAC9B,CAAC,EACE,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,OAAO,GAAG,qBAAqB,GAAG,MAAM,eAAe,IAAI;AACnE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,IAAI;AAAA,MACX,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC,EACA,UAAU,CAAC,WAAW;AAAA,EACrB,GAAG;AAAA,EACH,cAAc,iCAAiC,MAAM,iBAAiB,MAAM,YAAY;AAC1F,EAAE;AAEG,IAAM,uBAAuBA,GACjC,OAAO;AAAA,EACN,eAAeA,GAAE,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA,EAI1B,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,eAAeA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAAA,EACxC,mBAAmBA,GAAE,MAAM,gCAAgC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACvE,aAAaA,GAAE,MAAM,uBAAuB,EAAE,SAAS;AAAA,EACvD,eAAeA,GAAE,MAAM,mCAAmC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtE,kBAAkBA,GAAE,MAAM,sBAAsB,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA,EAI5D,aAAaA,GAAE,MAAM,iCAAiC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClE,YAAYA,GAAE,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,GAAG,SAAS,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC7D,SAASA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC5B,SAASA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC5B,QAAQA,GAAE,MAAM,EAAE,SAAS;AAAA,EAC3B,OAAOA,GAAE,MAAM,EAAE,SAAS;AAC5B,CAAC,EACA,OAAO,EACP,YAAY,CAAC,UAAU,YAAY;AAClC,MAAI,SAAS,cAAc,WAAW,KAAK,CAAC,SAAS,cAAc;AACjE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,aAAa,oBAAI,IAAY;AACnC,QAAM,cAAc,oBAAI,IAAY;AACpC,QAAM,qBAAqB,oBAAI,IAAY;AAC3C,QAAM,MAAM,CAAC,IAAY,SAAuC;AAC9D,QAAI,mBAAmB,KAAK,EAAE,GAAG;AAC/B,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN;AAAA,QACA,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,WAAW,IAAI,EAAE,GAAG;AACtB,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN;AAAA,QACA,SAAS,wBAAwB,EAAE;AAAA,MACrC,CAAC;AAAA,IACH;AACA,eAAW,IAAI,EAAE;AAAA,EACnB;AACA,WAAS,cAAc,QAAQ,CAAC,IAAI,UAAU,IAAI,IAAI,CAAC,iBAAiB,KAAK,CAAC,CAAC;AAC/E,WAAS,aAAa,QAAQ,CAAC,OAAO,UAAU,IAAI,MAAM,IAAI,CAAC,eAAe,OAAO,IAAI,CAAC,CAAC;AAC3F,MACE,SAAS,aAAa,KAAK,CAAC,UAAU,MAAM,WAAW,MAAM,OAAO,SAAS,YAAY,GACzF;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,WAAS,kBAAkB,QAAQ,CAAC,UAAU,kBAAkB;AAC9D,QACE,4BAA4B,IAAI,SAAS,EAAE,KAC3C,SAAS,GAAG,WAAW,mBAAmB,KAC1C,SAAS,GAAG,WAAW,yBAAyB,GAChD;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,qBAAqB,eAAe,IAAI;AAAA,QAC/C,SAAS,eAAe,SAAS,EAAE;AAAA,MACrC,CAAC;AAAA,IACH;AACA,QAAI,YAAY,IAAI,SAAS,EAAE,GAAG;AAChC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,qBAAqB,eAAe,IAAI;AAAA,QAC/C,SAAS,yBAAyB,SAAS,EAAE;AAAA,MAC/C,CAAC;AAAA,IACH;AACA,gBAAY,IAAI,SAAS,EAAE;AAC3B,aAAS,OAAO;AAAA,MAAQ,CAAC,OAAO,eAC9B,IAAI,MAAM,IAAI,CAAC,qBAAqB,eAAe,UAAU,YAAY,IAAI,CAAC;AAAA,IAChF;AAAA,EACF,CAAC;AACD,WAAS,cAAc,QAAQ,CAAC,OAAO,UAAU;AAC/C,QAAI,mBAAmB,IAAI,MAAM,eAAe,GAAG;AACjD,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,iBAAiB,OAAO,iBAAiB;AAAA,QAChD,SAAS,uCAAuC,MAAM,eAAe;AAAA,MACvE,CAAC;AAAA,IACH;AACA,uBAAmB,IAAI,MAAM,eAAe;AAC5C,QAAI,MAAM,WAAW,CAAC,iBAAiB,OAAO,WAAW,CAAC;AAC1D,QAAI,MAAM,oBAAoB,CAAC,iBAAiB,OAAO,oBAAoB,CAAC;AAAA,EAC9E,CAAC;AACD,WAAS,iBAAiB;AAAA,IAAQ,CAAC,OAAO,UACxC,IAAI,GAAG,0BAA0B,GAAG,MAAM,eAAe,IAAI;AAAA,MAC3D;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACA,WAAS,YAAY;AAAA,IAAQ,CAAC,OAAO,UACnC,IAAI,GAAG,qBAAqB,GAAG,MAAM,eAAe,IAAI;AAAA,MACtD;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACA,MAAI,SAAS,gBAAgB,mBAAmB,KAAK,SAAS,YAAY,GAAG;AAC3E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,SAAS,gBACT,CAAC,WAAW,IAAI,SAAS,YAAY,KACrC,EACE,SAAS,gBAAgB,UACzB,SAAS,aAAa,WAAW,qBAAqB,MAExD,CAAC,SAAS,aAAa,WAAW,gCAAgC,GAClE;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACA,aAAW,aAAa,OAAO,KAAK,SAAS,UAAU,GAAG;AACxD,QAAI,CAAC,WAAW,IAAI,SAAS,GAAG;AAC9B,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,cAAc,SAAS;AAAA,QAC9B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAGI,SAAS,0BAA0B,OAAsC;AAC9E,SAAO,qBAAqB,MAAM,KAAK;AACzC;AAEA,SAAS,+CACP,UACA,WACoB;AACpB,QAAM,gBAAgB,IAAI;AAAA,IACxB,wBAAwB,SAAS,kBAAkB,EAAE,IAAI,CAAC,aAAa,CAAC,SAAS,IAAI,QAAQ,CAAC;AAAA,EAChG;AACA,SAAO,UAAU,IAAI,CAAC,aAAa;AACjC,QAAI,SAAS,SAAS,UAAW,QAAO;AACxC,UAAM,OAAO,cAAc,IAAI,SAAS,EAAE;AAC1C,QAAI,CAAC,QAAQ,KAAK,SAAS,WAAW;AACpC,YAAM,IAAI;AAAA,QACR,mCAAmC,SAAS,EAAE;AAAA,MAChD;AAAA,IACF;AACA,UAAM,oBAAoB,CAAC,eAAmD;AAAA,MAC5E,MAAM,UAAU;AAAA,MAChB,SAAS,UAAU;AAAA,MACnB,KAAK,UAAU;AAAA,MACf,aAAa,UAAU;AAAA,IACzB;AACA,QAAI,cAAc,kBAAkB,QAAQ,CAAC,MAAM,cAAc,kBAAkB,IAAI,CAAC,GAAG;AACzF,YAAM,IAAI;AAAA,QACR,mCAAmC,SAAS,EAAE;AAAA,MAChD;AAAA,IACF;AACA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,GAAI,KAAK,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,KAAK,eAAe;AAAA,MACnF,GAAI,KAAK,iBAAiB,SAAY,CAAC,IAAI,EAAE,cAAc,KAAK,aAAa;AAAA,MAC7E,GAAI,KAAK,6BAA6B,SAClC,CAAC,IACD,EAAE,0BAA0B,KAAK,yBAAyB;AAAA,MAC9D,GAAI,KAAK,4BAA4B,SACjC,CAAC,IACD,EAAE,yBAAyB,KAAK,wBAAwB;AAAA,MAC5D,GAAI,KAAK,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;AAAA,MAC3D,GAAI,KAAK,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,KAAK,UAAU;AAAA,IACtE;AAAA,EACF,CAAC;AACH;AAaO,IAAM,wBAAwBA,GAClC,OAAO;AAAA,EACN,eAAeA,GAAE,MAAM,mCAAmC,EAAE,SAAS;AAAA,EACrE,kBAAkBA,GAAE,MAAM,sBAAsB,EAAE,SAAS;AAAA,EAC3D,aAAaA,GAAE,MAAM,iCAAiC,EAAE,SAAS;AACnE,CAAC,EACA,OAAO,EACP,YAAY,CAAC,UAAU,YAAY;AAClC,QAAM,SAAS,CACb,KACA,QACG;AACH,UAAM,OAAO,oBAAI,IAAY;AAC7B,KAAC,SAAS,GAAG,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,UAAU;AAC9C,iBAAW,MAAM,IAAI,KAAK,GAAG;AAC3B,YAAI,KAAK,IAAI,EAAE,GAAG;AAChB,kBAAQ,SAAS;AAAA,YACf,MAAM;AAAA,YACN,MAAM,CAAC,KAAK,OAAO,iBAAiB;AAAA,YACpC,SAAS,aAAa,GAAG,aAAa,EAAE;AAAA,UAC1C,CAAC;AAAA,QACH;AACA,aAAK,IAAI,EAAE;AAAA,MACb;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,iBAAiB,CAAC,UAAU;AACjC,UAAM,UAAU;AAChB,WAAO,CAAC,QAAQ,iBAAiB,QAAQ,WAAW,QAAQ,kBAAkB;AAAA,EAChF,CAAC;AACD,SAAO,oBAAoB,CAAC,UAAU;AAAA,IACpC,MAAM;AAAA,IACN,GAAI,MAAiC;AAAA,EACvC,CAAC;AACD,SAAO,eAAe,CAAC,UAAU;AAAA,IAC/B,MAAM;AAAA,IACN,GAAI,MAA4B;AAAA,EAClC,CAAC;AACH,CAAC;AAGH,IAAM,0BAA0B,oBAAI,IAAmC;AAGhE,SAAS,uBAAuB,KAAoC;AACzE,QAAM,SAAS,wBAAwB,IAAI,GAAG;AAC9C,MAAI,OAAQ,QAAO;AACnB,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,mDAAmD,EAAE,OAAO,MAAM,CAAC;AAAA,EACrF;AACA,QAAM,SAAS,sBAAsB,UAAU,IAAI;AACnD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR,4CAA4C,OAAO,MAAM,OACtD,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,EACtE,KAAK,IAAI,CAAC;AAAA,IACf;AAAA,EACF;AACA,MAAI,wBAAwB,OAAO,GAAI,yBAAwB,MAAM;AACrE,0BAAwB,IAAI,KAAK,OAAO,IAAI;AAC5C,SAAO,OAAO;AAChB;AAGA,SAAS,sBAAsB,UAA2C;AACxE,MAAI,SAAS,uBAAuB,UAAU,CAAC,SAAS,mBAAmB,KAAK,EAAG,QAAO,CAAC;AAC3F,SAAO,uBAAuB,SAAS,iBAAiB;AAC1D;AAEO,SAAS,0BAA0B,UAAoB,aAAgC;AAC5F,QAAM,WAAW,0BAA0B,WAAW;AACtD,QAAM,eAAe,SAAS,gBAAgB,SAAS,cAAc,CAAC;AACtE,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,IAKb,qBAAqB,SAAS,cAAc,KAAK,GAAG;AAAA,IACpD,oBAAoB,KAAK;AAAA,MACvB,+CAA+C,UAAU,SAAS,iBAAiB;AAAA,IACrF;AAAA,IACA,2BAA2B,KAAK,UAAU,SAAS,aAAa;AAAA,IAChE,8BAA8B,KAAK,UAAU,SAAS,gBAAgB;AAAA,IACtE,yBAAyB,KAAK,UAAU,SAAS,WAAW;AAAA,IAC5D,yBACE,SAAS,gBAAgB,SAAY,SAAY,KAAK,UAAU,SAAS,WAAW;AAAA,IACtF,gBAAgB,KAAK,UAAU,SAAS,UAAU;AAAA,EACpD;AACA,SAAO;AACT;AAEO,IAAM,qCAAqCA,GAAE,OAAO;AAAA,EACzD,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,yBAAyBA,GACtB,KAAK,CAAC,QAAQ,sBAAsB,qBAAqB,CAAC,EAC1D,QAAQ,MAAM;AACnB,CAAC;AAmFM,SAAS,6BAA6B,OAGjC;AACV,SACE,MAAM,SAAS,SAAS,wBACxB,MAAM,WAAW,gBAAgB,SAAS,OAAO;AAErD;AAEO,IAAM,6BAA6B;AACnC,IAAM,oCAAoC;AAC1C,IAAM,sCAAsC;AAC5C,IAAM,oCAAoC;AAC1C,IAAM,yCAAyC;AAC/C,IAAM,uCAAuC;AAC7C,IAAM,oCAAoC;AAC1C,IAAM,kCAAkC;AACxC,IAAM,yCAAyC;AAC/C,IAAM,uCAAuC;AAQ7C,SAAS,uBAAuB,QAA+B;AACpE,QAAM,MAAM,OAAO,KAAK;AACxB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,aAAa,KAAK,GAAG,GAAG;AAC1B,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,IAAM,0BAA0B;AAChC,IAAM,8BAA8B;AACpC,IAAM,oCAAoC;AAC1C,IAAM,qCAAqC;AAG3C,IAAM,6BAA6B;AAAA,EACxC,kBAAkB;AAAA,IAChB,iBAAiB;AAAA,IACjB,gBAAgB,GAAG,iCAAiC;AAAA,IACpD,kBAAkB,GAAG,kCAAkC;AAAA,IACvD,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA,oBAAoB;AAAA,IAClB,iBAAiB;AAAA,IACjB,gBAAgB,GAAG,iCAAiC;AAAA,IACpD,kBAAkB,GAAG,kCAAkC;AAAA,IACvD,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA,sBAAsB;AAAA,IACpB,iBAAiB;AAAA,IACjB,gBAAgB,GAAG,iCAAiC;AAAA,IACpD,kBAAkB,GAAG,kCAAkC;AAAA,IACvD,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AACF;AAEO,IAAM,sCAAsC;AAO5C,IAAM,6BAA6B;AAAA,EACxC,OAAO;AAAA,IACL,iBAAiB;AAAA,IACjB,SAAS,GAAG,mCAAmC;AAAA,IAC/C,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,iBAAiB;AAAA,IACjB,SAAS,GAAG,mCAAmC;AAAA,IAC/C,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AACF;AAGO,SAAS,+BAA+B,SAAgC;AAC7E,aAAW,SAAS,OAAO,OAAO,0BAA0B,GAAG;AAC7D,QAAI,MAAM,YAAY,QAAS,QAAO,MAAM;AAAA,EAC9C;AACA,SAAO;AACT;AAOO,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,IAAM,uCAAyE;AAAA,EAC7E,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AACN;AAMO,SAAS,kCAAkC,KAA4B;AAC5E,QAAM,aAAa,IAAI,KAAK,EAAE,YAAY,EAAE,WAAW,KAAK,GAAG;AAC/D,QAAM,YAA+B;AACrC,MAAI,UAAU,SAAS,UAAU,EAAG,QAAO;AAC3C,QAAM,OAAO,WAAW,MAAM,GAAG,EAAE,CAAC,KAAK;AACzC,QAAM,WAAW,qCAAqC,IAAI,KAAK;AAC/D,SAAO,UAAU,SAAS,QAAQ,IAAI,WAAW;AACnD;AAKO,SAAS,8BACd,SACqE;AACrE,aAAW,SAAS,OAAO,OAAO,0BAA0B,GAAG;AAC7D,QAAI,MAAM,mBAAmB,SAAS;AACpC,aAAO,EAAE,QAAQ,WAAW,iBAAiB,MAAM,gBAAgB;AAAA,IACrE;AACA,QAAI,MAAM,qBAAqB,SAAS;AACtC,aAAO,EAAE,QAAQ,aAAa,iBAAiB,MAAM,gBAAgB;AAAA,IACvE;AAAA,EACF;AACA,SAAO;AACT;AAEO,IAAM,0BAA0B;AAAA,EACrC,UAAU;AAAA,IACR,WAAW;AAAA,IACX,oBAAoB,GAAG,iCAAiC;AAAA,IACxD,iBAAiB;AAAA,IACjB,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,WAAW,CAAC,WAAW,UAAU,WAAW;AAAA,IAC5C,iBAAiB;AAAA,EACnB;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,oBAAoB,GAAG,iCAAiC;AAAA,IACxD,iBAAiB;AAAA,IACjB,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,WAAW,CAAC,WAAW,WAAW;AAAA,IAClC,iBAAiB;AAAA,EACnB;AACF;AAEO,IAAM,6BAAgE;AAAA,EAC3E,uBAAuB,MAAM;AAAA,IAC3B,iBAAiB;AAAA,IACjB,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,SAAS,CAAC;AAAA,IACV,cAAc;AAAA,MACZ,WAAW;AAAA,QACT,UAAU;AAAA;AAAA,QAEV,UAAU;AAAA,QACV,SAAS,CAAC,OAAO,QAAQ;AAAA,QACzB,eAAe;AAAA,QACf,UAAU;AAAA,MACZ;AAAA,MACA,iBAAiB,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,MACzD,kBAAkB,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,MAC1D,aAAa;AAAA,QACX,WAAW,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,QAClD,SAAS,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,QAChD,eAAe,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,QACtD,iBAAiB,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MAC1D;AAAA,MACA,iBAAiB,CAAC,MAAM;AAAA,MACxB,qBAAqB,CAAC;AAAA,MACtB,kBAAkB,CAAC,MAAM;AAAA,MACzB,YAAY;AAAA,QACV,KAAK,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,QAC7C,oBAAoB,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,QAC3D,eAAe,EAAE,UAAU,eAAe,UAAU,MAAM;AAAA,MAC5D;AAAA,MACA,cAAc,CAAC,EAAE,IAAI,YAAY,UAAU,WAAW,UAAU,KAAK,CAAC;AAAA,IACxE;AAAA,IACA,qBAAqB;AAAA,IACrB,8BAA8B;AAAA,IAC9B,uBAAuB;AAAA,EACzB,CAAC;AACH;AAMA,SAAS,kBAAkB,OAQH;AACtB,SAAO,0BAA0B,MAAM;AAAA,IACrC,WAAW,EAAE,GAAG,MAAM,WAAW,UAAU,MAAM;AAAA;AAAA,IAEjD,iBAAiB,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,IACzD,kBAAkB;AAAA,MAChB,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM,qBAAqB;AAAA,IACvC;AAAA,IACA,aAAa;AAAA,MACX,WAAW,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MAClD,SAAS,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MAChD,eAAe,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MACtD,iBAAiB,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,IAC1D;AAAA,IACA,iBAAiB,MAAM,QAAQ,CAAC,QAAQ,OAAO,IAAI,CAAC,MAAM;AAAA,IAC1D,qBAAqB,MAAM;AAAA,IAC3B,kBAAkB,CAAC,MAAM;AAAA,IACzB,YAAY;AAAA,MACV,KAAK,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,MAC7C,oBAAoB,EAAE,UAAU,eAAe,UAAU,MAAM;AAAA,MAC/D,eAAe,EAAE,UAAU,eAAe,UAAU,MAAM;AAAA,IAC5D;AAAA,IACA,eAAe,EAAE,UAAU,WAAW,UAAU,OAAO,MAAM,OAAO;AAAA,IACpE,cAAc,CAAC,EAAE,IAAI,YAAY,UAAU,aAAa,UAAU,KAAK,CAAC;AAAA,EAC1E,CAAC;AACH;AAiBO,IAAM,oCAAoC;AAE1C,IAAM,wBAAsD;AAAA,EACjE,kBAAkB,MAAM;AAAA,IACtB,iBAAiB;AAAA,IACjB,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,SAAS,CAAC;AAAA,IACV,cAAc,kBAAkB;AAAA;AAAA;AAAA;AAAA,MAI9B,WAAW;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,SAAS,CAAC,OAAO,UAAU,QAAQ,SAAS,KAAK;AAAA,QACjD,eAAe;AAAA,MACjB;AAAA;AAAA,MAEA,kBAAkB;AAAA,MAClB,OAAO;AAAA,MACP,qBAAqB,CAAC,iBAAiB;AAAA,IACzC,CAAC;AAAA,IACD,qBAAqB;AAAA;AAAA,IAErB,8BAA8B;AAAA;AAAA,IAE9B,uBAAuB;AAAA,IACvB,iBAAiB;AAAA,IACjB,SAAS;AAAA;AAAA;AAAA,MAGP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,EACF,CAAC;AACH;AAQA,IAAM,+BAEF;AAAA,EACF,GAAG,OAAO;AAAA,IACR,sBAAsB;AAAA,MAAQ,CAAC,UAC7B,MAAM,UAAU,CAAC,CAAC,MAAM,iBAAiB,MAAM,OAAO,CAAU,IAAI,CAAC;AAAA,IACvE;AAAA,EACF;AAAA;AAAA,EAEA,gCAAgC;AAAA,IAC9B,6BAA6B;AAAA,IAC7B,mCAAmC;AAAA,IACnC,8BAA8B;AAAA,IAC9B,WAAW;AAAA,EACb;AAAA;AAAA,EAEA,4BAA4B;AAAA,IAC1B,6BAA6B;AAAA,IAC7B,mCAAmC;AAAA,IACnC,kCAAkC;AAAA,IAClC,8BAA8B;AAAA,IAC9B,WAAW;AAAA,EACb;AACF;AAIO,IAAM,mCAAmC,KAAK;AAIrD,IAAM,wCAAwC;AAE9C,SAAS,yBAAyB,iBAAkC;AAClE,SAAO,sBAAsB,KAAK,eAAe;AACnD;AAEA,SAAS,yBAAyB,iBAAkC;AAClE,SAAO,sBAAsB,KAAK,eAAe;AACnD;AAYA,SAAS,6BAA6B,iBAA8C;AAClF,SAAO,kBAAkB;AAAA,IACvB,WAAW;AAAA,MACT,UAAU;AAAA,MACV,UAAU;AAAA,MACV,SAAS,CAAC,OAAO,UAAU,MAAM;AAAA,MACjC,eAAe;AAAA,IACjB;AAAA,IACA,kBAAkB;AAAA,IAClB,OAAO,yBAAyB,eAAe,KAAK,yBAAyB,eAAe;AAAA,IAC5F,qBAAqB,CAAC;AAAA,EACxB,CAAC;AACH;AAUO,SAAS,qBACd,UACA,iBACoB;AACpB,QAAM,aAAa,6BAA6B,QAAQ,EAAE;AAAA,IACxD,CAAC,UAAU,MAAM,oBAAoB;AAAA,EACvC;AACA,MAAI,YAAY,oBAAoB,OAAW,QAAO,WAAW;AACjE,SAAO,yBAAyB,eAAe,IAC3C,wCACA;AACN;AAEA,SAAS,8BAAqD;AAC5D,SAAO;AAAA,IACL;AAAA,MACE,GAAG,wBAAwB;AAAA,MAC3B,QAAQ;AAAA,MACR,qBAAqB,CAAC;AAAA,MACtB,qBAAqB;AAAA,MACrB,8BAA8B;AAAA,MAC9B,uBAAuB;AAAA,IACzB;AAAA,IACA;AAAA,MACE,GAAG,wBAAwB;AAAA,MAC3B,QAAQ;AAAA,MACR,qBAAqB,CAAC,iBAAiB;AAAA,MACvC,qBAAqB;AAAA,MACrB,8BAA8B;AAAA,MAC9B,uBAAuB;AAAA,IACzB;AAAA,EACF,EAAE,IAAI,CAAC,UAAU,oBAAoB,MAAM,KAAK,CAAC;AACnD;AAEA,SAAS,+BAA+B,UAA2C;AACjF,MAAI,SAAS,8BAA8B,QAAW;AACpD,WAAOA,GAAE,MAAM,mBAAmB,EAAE,MAAM,KAAK,MAAM,SAAS,yBAAyB,CAAC;AAAA,EAC1F;AACA,QAAM,WAAW,sBAAsB,QAAQ,EAAE;AACjD,MAAI,SAAU,QAAO,SAAS,IAAI,CAAC,UAAU,oBAAoB,MAAM,KAAK,CAAC;AAC7E,SAAO,4BAA4B;AACrC;AAEO,SAAS,kCAAkC,UAA8B;AAC9E,SAAO,+BAA+B,QAAQ,EAAE,IAAI,CAAC,UAAU,MAAM,eAAe;AACtF;AAEO,SAAS,0CAA0C,UAA8B;AACtF,SAAO,+BAA+B,QAAQ,EAAE,IAAI,CAAC,UAAU,MAAM,kBAAkB;AACzF;AAEO,SAAS,6CAA6C,UAA8B;AACzF,OAAK;AACL,SAAO,CAAC;AACV;AAEO,SAAS,+BAA+B,UAA8B;AAC3E,SAAO,iBAAiB,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC;AACnF;AAEA,SAAS,kCAAkC,UAA8C;AACvF,MAAI,SAAS,iCAAiC,QAAW;AACvD,WAAOA,GAAE,MAAM,sBAAsB,EAAE,MAAM,KAAK,MAAM,SAAS,4BAA4B,CAAC;AAAA,EAChG;AACA,QAAM,WAAW,sBAAsB,QAAQ,EAAE;AACjD,MAAI,SAAU,QAAO,SAAS,IAAI,CAAC,UAAU,uBAAuB,MAAM,KAAK,CAAC;AAChF,SAAO,CAAC,GAAG,0BAA0B;AACvC;AAEO,SAAS,qCAAqC,UAA8B;AACjF,SAAO,kCAAkC,QAAQ,EAAE,IAAI,CAAC,UAAU,MAAM,eAAe;AACzF;AAEA,SAAS,6BAA6B,SAAyB;AAC7D,SAAO,GAAG,oCAAoC,GAC5C,QAAQ,WAAW,0BAA0B,IACzC,QAAQ,MAAM,2BAA2B,MAAM,IAC/C,OACN;AACF;AAEO,SAAS,6CAA6C,UAA8B;AACzF,SAAO,kCAAkC,QAAQ,EAAE;AAAA,IAAQ,CAAC,UAC1D,CAAC,MAAM,iBAAiB,GAAG,MAAM,OAAO,EAAE,IAAI,4BAA4B;AAAA,EAC5E;AACF;AAEO,SAAS,gDAAgD,UAA8B;AAC5F,OAAK;AACL,SAAO,CAAC;AACV;AAQA,SAAS,6BAA6B,UAAyC;AAC7E,MAAI,SAAS,4BAA4B,QAAW;AAClD,WAAOA,GAAE,MAAM,iBAAiB,EAAE,MAAM,KAAK,MAAM,SAAS,uBAAuB,CAAC;AAAA,EACtF;AACA,QAAM,WAAW,sBAAsB,QAAQ,EAAE;AACjD,MAAI,SAAU,QAAO,SAAS,IAAI,CAAC,UAAU,kBAAkB,MAAM,KAAK,CAAC;AAC3E,SAAO,CAAC,GAAG,qBAAqB;AAClC;AAGA,SAAS,0BAA0B,iBAA6D;AAC9F,QAAM,UAAU,OAAO,OAAO,8BAA8B,eAAe,IACvE,6BAA6B,eAAe,IAC5C;AACJ,SAAO,YAAY,SAAY,SAAY,8BAA8B,OAAO;AAClF;AAEO,SAAS,gCAAgC,UAA8B;AAC5E,SAAO,6BAA6B,QAAQ,EAAE,IAAI,CAAC,UAAU,MAAM,eAAe;AACpF;AAEA,SAAS,wBAAwB,SAAyB;AACxD,SAAO,GAAG,+BAA+B,GACvC,QAAQ,WAAW,qBAAqB,IACpC,QAAQ,MAAM,sBAAsB,MAAM,IAC1C,OACN;AACF;AAEO,SAAS,wCAAwC,UAA8B;AACpF,SAAO,6BAA6B,QAAQ,EAAE;AAAA,IAAQ,CAAC,UACrD,CAAC,MAAM,iBAAiB,GAAG,MAAM,OAAO,EAAE,IAAI,uBAAuB;AAAA,EACvE;AACF;AAEO,SAAS,2CAA2C,UAA8B;AACvF,OAAK;AACL,SAAO,CAAC;AACV;AAkBO,IAAM,sBAA8D;AAAA,EACzE,eAAe;AAAA,IACb,SAAS;AAAA;AAAA,MAEP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA;AAAA,QAEE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,aAAa;AAAA,IACX,SAAS;AAAA;AAAA,MAEP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,cAAc;AAAA,IACZ,SAAS;AAAA;AAAA,MAEP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,eAAe;AAAA,IACb,SAAS;AAAA;AAAA,MAEP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA;AAAA,QAEE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,iBAAiB;AAAA,IACf,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,gBAAgB;AAAA,IACd,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,CAAC,wBAAwB,SAAS,SAAS,GAAG;AAAA,IAC5C,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,EACF;AAAA,EACA,CAAC,wBAAwB,KAAK,SAAS,GAAG;AAAA,IACxC,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,qCAAqC;AAAA,IACnC,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,EACF;AACF;AAGO,IAAM,2BAAmE;AAAA;AAAA;AAAA;AAAA,EAI9E,eAAe;AAAA,IACb,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,GAAG,OAAO;AAAA,IAEN;AAAA,MACE,CAAC,YAAY,GAAO;AAAA,MACpB,CAAC,YAAY,GAAO;AAAA,MACpB,CAAC,YAAY,GAAO;AAAA,IACtB,EACA,IAAI,CAAC,CAAC,OAAO,WAAW,MAAM;AAAA,MAC9B;AAAA,MACA;AAAA,QACE,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,QACA,iBAAiB;AAAA,UACf;AAAA,YACE,oBAAoB;AAAA,YACpB,SAAS;AAAA,cACP,6BAA6B;AAAA,cAC7B,mCAAmC,cAAc;AAAA,cACjD,8BAA8B;AAAA,cAC9B,WAAW;AAAA,YACb;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,GAAG,OAAO;AAAA,IAEN;AAAA,MACE,CAAC,mBAAmB,KAAW,KAAS,KAAW,GAAU;AAAA,MAC7D,CAAC,qBAAqB,KAAW,KAAS,MAAW,GAAU;AAAA,MAC/D,CAAC,iBAAiB,KAAW,KAAS,OAAW,IAAU;AAAA,MAC3D,CAAC,mBAAmB,KAAW,KAAS,MAAW,GAAU;AAAA,MAC7D,CAAC,mBAAmB,KAAW,KAAS,OAAW,IAAU;AAAA,MAC7D,CAAC,mBAAmB,KAAW,KAAS,OAAW,IAAU;AAAA,MAC7D,CAAC,mBAAmB,KAAW,KAAS,OAAW,IAAU;AAAA,MAC7D,CAAC,qBAAqB,KAAW,KAAS,OAAW,IAAU;AAAA,MAC/D,CAAC,6BAA6B,KAAW,KAAS,OAAW,GAAS;AAAA,IACxE,EACA,IAAI,CAAC,CAAC,OAAO,OAAO,aAAa,YAAY,MAAM,MAAM;AAAA,MACzD;AAAA,MACA;AAAA,QACE,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAIA,oBAAoB;AAAA,IAClB,SAAS;AAAA,MACP,6BAA6B;AAAA,MAC7B,mCAAmC;AAAA,MACnC,kCAAkC;AAAA,MAClC,8BAA8B;AAAA,MAC9B,WAAW;AAAA,IACb;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,6BAA6B;AAAA,UAC7B,mCAAmC;AAAA,UACnC,kCAAkC;AAAA,UAClC,8BAA8B;AAAA,UAC9B,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAKA,IAAM,oCAA4D;AAAA,EAChE,SAAS;AAAA,IACP,6BAA6B;AAAA,IAC7B,mCAAmC;AAAA,IACnC,kCAAkC;AAAA,IAClC,8BAA8B;AAAA,IAC9B,WAAW;AAAA,EACb;AACF;AAqBO,IAAM,uBAGT;AAAA;AAAA,EAEF,QAAQ,CAAC;AAAA,EACT,OAAO,CAAC;AAAA,EACR,MAAM,CAAC;AAAA,EACP,OAAO;AAAA,IACL,EAAE,OAAO,gBAAgB,KAAK,0BAA0B;AAAA,IACxD,EAAE,OAAO,gBAAgB,KAAK,0BAA0B;AAAA,IACxD,EAAE,OAAO,oBAAoB,KAAK,8BAA8B;AAAA,EAClE;AAAA,EACA,SAAS,CAAC,EAAE,OAAO,iBAAiB,KAAK,2BAA2B,CAAC;AAAA,EACrE,SAAS,CAAC,EAAE,OAAO,iBAAiB,KAAK,2BAA2B,CAAC;AAAA,EACrE,KAAK,CAAC,EAAE,OAAO,aAAa,KAAK,uBAAuB,CAAC;AAAA,EACzD,QAAQ,CAAC,EAAE,OAAO,gBAAgB,KAAK,0BAA0B,CAAC;AAAA,EAClE,YAAY,CAAC,EAAE,OAAO,uBAAuB,KAAK,iCAAiC,CAAC;AAAA,EACpF,QAAQ;AAAA,IACN,EAAE,OAAO,eAAe,KAAK,wBAAwB;AAAA,IACrD,EAAE,OAAO,mBAAmB,KAAK,6BAA6B;AAAA,EAChE;AAAA,EACA,aAAa;AAAA,IACX,EAAE,OAAO,sBAAsB,KAAK,gCAAgC;AAAA,IACpE,EAAE,OAAO,qBAAqB,KAAK,+BAA+B;AAAA,IAClE,EAAE,OAAO,oBAAoB,KAAK,6BAA6B;AAAA,EACjE;AAAA;AAAA,EAEA,SAAS;AAAA,IACP,EAAE,OAAO,iBAAiB,KAAK,2BAA2B;AAAA,IAC1D,EAAE,OAAO,iBAAiB,KAAK,2BAA2B;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,YAAY,CAAC;AACf;AAGO,SAAS,6BAA6B,SAAmD;AAC9F,UAAQ,qBAAqB,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,MAAM,GAAG;AACvE;AAEA,SAAS,4CAA4C,UAA6B;AAChF,UAAQ,SAAS,sBAAsB;AAAA,IACrC,KAAK;AACH,aAAO;AAAA,QACL,SAAS,sCACR,SAAS,iCAAiC,SAAS;AAAA,MACtD;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,SAAS,mCACT,SAAS,+BACT,SAAS;AAAA,MACX;AAAA,IACF,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,QACL,SAAS,yBACT,SAAS,4BACT,SAAS;AAAA,MACX;AAAA,IACF,SAAS;AACP,YAAM,cAAqB,SAAS;AACpC,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,MAAc,QAA+C;AAC7F,QAAM,QAAQ,OAAO,IAAI;AACzB,SAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AACpD;AAGA,IAAI,uCAAuC;AAEpC,SAAS,YAAY,SAA4B,QAAQ,KAAe;AAC7E,QAAM,WAAW,CAAC,SAAqC,yBAAyB,MAAM,MAAM;AAC5F,QAAM,qBAAqB,SAAS,+BAA+B;AACnE,QAAM,sBACJ,SAAS,iCAAiC,MACzC,uBAAuB,aAAa,OAAO;AAC9C,QAAM,MAAM;AAAA,IACV,aAAa,SAAS,uBAAuB;AAAA,IAC7C,aAAa,SAAS,sBAAsB;AAAA,IAC5C,oBACE,SAAS,8BAA8B,KACvC,SAAS,gBAAgB,KACzB,SAAS,YAAY;AAAA,IACvB,eAAe,SAAS,yBAAyB;AAAA,IACjD,aAAa,SAAS,uBAAuB;AAAA,IAC7C,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,oBAAoB,SAAS,gCAAgC;AAAA,IAC7D,4BAA4B,SAAS,uCAAuC;AAAA,IAC5E,UAAU,SAAS,oBAAoB;AAAA,IACvC,aAAa,SAAS,uBAAuB;AAAA,IAC7C,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,SAAS,SAAS,mBAAmB;AAAA,IACrC,cAAc,SAAS,wBAAwB;AAAA,IAC/C,mBAAmB,SAAS,6BAA6B;AAAA,IACzD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,oCAAoC;AAAA,MAClC;AAAA,IACF;AAAA,IACA,oCAAoC,SAAS,iDAAiD;AAAA,IAC9F,mCAAmC,SAAS,iDAAiD;AAAA,IAC7F,gCAAgC,SAAS,4CAA4C;AAAA,IACrF,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,kCAAkC,SAAS,gDAAgD;AAAA,IAC3F,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,gCAAgC,SAAS,6CAA6C;AAAA,IACtF,iCAAiC,SAAS,+CAA+C;AAAA,IACzF,gCAAgC,SAAS,8CAA8C;AAAA,IACvF,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,2BACE,SAAS,sCAAsC,KAAK,SAAS,6BAA6B;AAAA,IAC5F,0BACE,SAAS,qCAAqC,KAAK,SAAS,4BAA4B;AAAA,IAC1F,kCAAkC,SAAS,6CAA6C;AAAA,IACxF,iCAAiC,SAAS,4CAA4C;AAAA,IACtF,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,cAAc,SAAS,wBAAwB;AAAA,IAC/C,eAAe,SAAS,0BAA0B;AAAA,IAClD,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,YAAY,SAAS,uBAAuB;AAAA,IAC5C,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,aAAa,SAAS,uBAAuB;AAAA,IAC7C,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,uBAAuB,SAAS,uCAAuC;AAAA,IACvE,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,8BAA8B,SAAS,yCAAyC;AAAA,IAChF,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,qBAAqB,SAAS,+BAA+B;AAAA,IAC7D,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,wCAAwC;AAAA,MACtC;AAAA,IACF;AAAA,IACA,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,iCAAiC,SAAS,6CAA6C;AAAA,IACvF,uCAAuC;AAAA,MACrC;AAAA,IACF;AAAA,IACA,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,eAAe,SAAS,0BAA0B;AAAA,IAClD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,cAAc,SAAS,wBAAwB;AAAA,IAC/C,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,yBAAyB,SAAS,sCAAsC;AAAA,IACxE,yBAAyB,SAAS,sCAAsC;AAAA,IACxE,6BAA6B,SAAS,2CAA2C;AAAA,IACjF,oCAAoC;AAAA,MAClC;AAAA,IACF;AAAA,IACA,kCAAkC,SAAS,gDAAgD;AAAA,IAC3F,kCAAkC,SAAS,gDAAgD;AAAA,IAC3F,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,kCAAkC,SAAS,+CAA+C;AAAA,IAC1F,wCAAwC;AAAA,MACtC;AAAA,IACF;AAAA,IACA,oCAAoC;AAAA,MAClC;AAAA,IACF;AAAA,IACA,kCAAkC,SAAS,gDAAgD;AAAA,IAC3F,eAAe,SAAS,gCAAgC;AAAA,IACxD,mBAAmB,SAAS,oCAAoC;AAAA,IAChE,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,sBAAsB,SAAS,mCAAmC;AAAA,IAClE,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,2BAA2B,SAAS,yCAAyC;AAAA,IAC7E,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,iCAAiC,SAAS,qCAAqC;AAAA,IAC/E,6BAA6B,SAAS,yCAAyC;AAAA,IAC/E,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,iCAAiC,SAAS,8CAA8C;AAAA,IACxF,cAAc,SAAS,wBAAwB;AAAA,IAC/C,WAAW,SAAS,qBAAqB;AAAA,IACzC,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,SAAS,SAAS,mBAAmB;AAAA,IACrC,SAAS,SAAS,mBAAmB;AAAA,IACrC,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,wBAAwB,SAAS,2BAA2B;AAAA,IAC5D,gBAAgB,SAAS,kBAAkB;AAAA,IAC3C,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,gBAAgB,SAAS,0BAA0B;AAAA,IACnD,cAAc,SAAS,yBAAyB,KAAK,SAAS,gBAAgB;AAAA,IAC9E,eAAe,SAAS,0BAA0B,KAAK,SAAS,iBAAiB;AAAA,IACjF,aAAa,SAAS,uBAAuB;AAAA,IAC7C,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,uBAAuB,SAAS,oCAAoC;AAAA,IACpE,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,uCAAuC;AAAA,MACrC;AAAA,IACF;AAAA,IACA,0CAA0C;AAAA,MACxC;AAAA,IACF;AAAA,IACA,oCAAoC,SAAS,iDAAiD;AAAA,IAC9F,kCAAkC,SAAS,+CAA+C;AAAA,IAC1F,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,0CAA0C;AAAA,MACxC;AAAA,IACF;AAAA,IACA,0CAA0C;AAAA,MACxC;AAAA,IACF;AAAA,IACA,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,uCAAuC;AAAA,MACrC;AAAA,IACF;AAAA,IACA,iCAAiC,SAAS,+CAA+C;AAAA,IACzF,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,yBAAyB,SAAS,sCAAsC;AAAA,IACxE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,uBAAuB,SAAS,oCAAoC;AAAA,IACpE,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,iBAAiB,SAAS,6BAA6B;AAAA,IACvD,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,qBAAqB,SAAS,kCAAkC;AAAA,IAChE,yBAAyB,SAAS,sCAAsC;AAAA,IACxE,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,oBAAoB,SAAS,gCAAgC;AAAA,IAC7D,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,4BAA4B,SAAS,yCAAyC;AAAA,IAC9E,oCAAoC,SAAS,yCAAyC;AAAA,IACtF,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,kBAAkB,SAAS,6BAA6B;AAAA,IACxD;AAAA,IACA;AAAA,IACA,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,aAAa,SAAS,wBAAwB;AAAA,IAC9C,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,kCAAkC,SAAS,+CAA+C;AAAA,IAC1F,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,8BAA8B,SAAS,yCAAyC;AAAA,IAChF,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,gCAAgC,SAAS,4CAA4C;AAAA,IACrF,iCAAiC,SAAS,6CAA6C;AAAA,IACvF,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,0CAA0C;AAAA,MACxC;AAAA,IACF;AAAA,IACA,iCAAiC,SAAS,8CAA8C;AAAA,IACxF,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,iCAAiC,SAAS,6CAA6C;AAAA,IACvF,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,8BAA8B,oCAAoC,MAAM;AAAA,IACxE,iBAAiB,SAAS,6BAA6B;AAAA,IACvD,kBAAkB,SAAS,8BAA8B;AAAA,IACzD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,gBAAgB,SAAS,4BAA4B;AAAA,IACrD,iBAAiB,SAAS,6BAA6B;AAAA,IACvD,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,WAAW,SAAS,sBAAsB;AAAA,IAC1C,YAAY,SAAS,uBAAuB;AAAA,IAC5C,UAAU,SAAS,oBAAoB;AAAA,IACvC,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,oBAAoB,SAAS,gCAAgC;AAAA,IAC7D,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,oBAAoB,SAAS,gCAAgC;AAAA,IAC7D,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,gBAAgB,SAAS,0BAA0B;AAAA,IACnD,aAAa,SAAS,uBAAuB;AAAA,IAC7C,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,eAAe,SAAS,yBAAyB;AAAA,IACjD,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,cAAc,SAAS,yBAAyB;AAAA,IAChD,eAAe,SAAS,0BAA0B,KAAK;AAAA,IACvD,gCAAgC,SAAS,4CAA4C;AAAA,IACrF,cAAc,SAAS,yBAAyB;AAAA,IAChD,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,cAAc,SAAS,wBAAwB;AAAA,IAC/C,cAAc,SAAS,yBAAyB;AAAA,IAChD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,yBAAyB,SAAS,4BAA4B;AAAA,IAC9D,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,oBAAoB,SAAS,8BAA8B;AAAA,IAC3D,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,eAAe,SAAS,0BAA0B;AAAA,IAClD,eAAe,SAAS,0BAA0B;AAAA,IAClD,eAAe,SAAS,yBAAyB;AAAA,IACjD,cAAc,SAAS,wBAAwB;AAAA,IAC/C,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,iCAAiC,SAAS,+CAA+C;AAAA,IACzF,eAAe,SAAS,0BAA0B;AAAA,IAClD,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,eAAe,SAAS,yBAAyB;AAAA,IACjD,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,WAAW,SAAS,sBAAsB;AAAA,IAC1C,WAAW,SAAS,qBAAqB;AAAA,IACzC,WAAW,SAAS,sBAAsB;AAAA,IAC1C,eAAe,SAAS,0BAA0B;AAAA,IAClD,aAAa,SAAS,uBAAuB;AAAA,IAC7C,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,eAAe,SAAS,0BAA0B;AAAA,IAClD,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,cAAc,SAAS,yBAAyB;AAAA,IAChD,aAAa,SAAS,uBAAuB;AAAA,IAC7C,cAAc,SAAS,wBAAwB;AAAA,IAC/C,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,gCAAgC,SAAS,8CAA8C;AAAA,IACvF,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,WAAW,SAAS,qBAAqB;AAAA,IACzC,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,uCAAuC;AAAA,MACrC;AAAA,IACF;AAAA,IACA,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,cAAc,SAAS,yBAAyB;AAAA,IAChD,gBAAgB,SAAS,0BAA0B;AAAA,IACnD,6BAA6B,SAAS,yCAAyC;AAAA,IAC/E,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,aAAa,SAAS,uBAAuB;AAAA,IAC7C,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,cAAc,SAAS,yBAAyB;AAAA,IAChD,eAAe,SAAS,yBAAyB;AAAA,IACjD,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,kBAAkB,SAAS,4BAA4B;AAAA,IACvD,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,4BAA4B,SAAS,uCAAuC;AAAA,IAC5E,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,kCAAkC,SAAS,gDAAgD;AAAA,IAC3F,kCAAkC,SAAS,8CAA8C;AAAA,IACzF,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,yCAAyC;AAAA,MACvC;AAAA,IACF;AAAA,IACA,eAAe,SAAS,0BAA0B;AAAA,IAClD,eAAe,SAAS,0BAA0B;AAAA,IAClD,cAAc,SAAS,wBAAwB;AAAA,IAC/C,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,cAAc,SAAS,wBAAwB;AAAA,IAC/C,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,4BAA4B,SAAS,yCAAyC;AAAA,IAC9E,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,6BAA6B,SAAS,iCAAiC;AAAA,IACvE,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,yBAAyB,SAAS,oCAAoC;AAAA,IACtE,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,kCAAkC,SAAS,+CAA+C;AAAA,IAC1F,kCAAkC,SAAS,+CAA+C;AAAA,IAC1F,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,gCAAgC,SAAS,6CAA6C;AAAA,IACtF,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,4BAA4B,SAAS,yCAAyC;AAAA,IAC9E,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,oBAAoB,SAAS,gCAAgC;AAAA,IAC7D,iCAAiC,SAAS,8CAA8C;AAAA,IACxF,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,oCAAoC;AAAA,MAClC;AAAA,IACF;AAAA,IACA,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,mCAAmC,SAAS,iDAAiD;AAAA,IAC7F,4BAA4B,SAAS,uCAAuC;AAAA,IAC5E,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,oCAAoC,SAAS,iDAAiD;AAAA,IAC9F,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,iCAAiC,SAAS,8CAA8C;AAAA,IACxF,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,gBAAgB,SAAS,0BAA0B;AAAA,IACnD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,2BAA2B,SAAS,sCAAsC;AAAA,IAC1E,wBAAwB,SAAS,mCAAmC;AAAA,IACpE,6BAA6B,SAAS,wCAAwC;AAAA,IAC9E,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,8BAA8B,SAAS,0CAA0C;AAAA,IACjF,+BAA+B,SAAS,2CAA2C;AAAA,IACnF,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,8BAA8B,SAAS,6CAA6C;AAAA,IACpF,iCAAiC,SAAS,gDAAgD;AAAA,IAC1F,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,mCAAmC;AAAA,MACjC;AAAA,IACF;AAAA,IACA,wBAAwB,SAAS,sCAAsC;AAAA,IACvE,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,mBAAmB,SAAS,+BAA+B;AAAA,IAC3D,4BAA4B,SAAS,0CAA0C;AAAA,IAC/E,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,+BAA+B,SAAS,6CAA6C;AAAA,IACrF,0BAA0B,SAAS,wCAAwC;AAAA,IAC3E,sBAAsB,SAAS,mCAAmC;AAAA,IAClE,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,+BAA+B,SAAS,6CAA6C;AAAA,IACrF,6BAA6B,SAAS,2CAA2C;AAAA,IACjF,8BAA8B,SAAS,4CAA4C;AAAA,IACnF,gCAAgC,SAAS,8CAA8C;AAAA,IACvF,mCAAmC,SAAS,kDAAkD;AAAA,IAC9F,wCAAwC;AAAA,MACtC;AAAA,IACF;AAAA,IACA,iCAAiC,SAAS,+CAA+C;AAAA,IACzF,aAAa,SAAS,uBAAuB;AAAA,IAC7C,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,+BAA+B,SAAS,6CAA6C;AAAA,IACrF,wCAAwC;AAAA,MACtC;AAAA,IACF;AAAA,IACA,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,6BAA6B,SAAS,yCAAyC;AAAA,IAC/E,oCAAoC;AAAA,MAClC;AAAA,IACF;AAAA,IACA,iCAAiC,SAAS,gDAAgD;AAAA,IAC1F,iCAAiC,SAAS,gDAAgD;AAAA,IAC1F,yCAAyC;AAAA,MACvC;AAAA,IACF;AAAA,IACA,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,gCAAgC,SAAS,6CAA6C;AAAA,IACtF,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,6BAA6B,SAAS,yCAAyC;AAAA,IAC/E,gCAAgC,SAAS,4CAA4C;AAAA,IACrF,mCAAmC,SAAS,iDAAiD;AAAA,IAC7F,sCAAsC;AAAA,MACpC;AAAA,IACF;AAAA,IACA,oCAAoC,SAAS,iDAAiD;AAAA,IAC9F,4CAA4C;AAAA,MAC1C;AAAA,IACF;AAAA,IACA,+CAA+C;AAAA,MAC7C;AAAA,IACF;AAAA,IACA,kDAAkD;AAAA,MAChD;AAAA,IACF;AAAA,IACA,oCAAoC;AAAA,MAClC;AAAA,IACF;AAAA,IACA,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,2BAA2B,SAAS,uCAAuC;AAAA,IAC3E,iCAAiC,SAAS,+CAA+C;AAAA,IACzF,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,mCAAmC,SAAS,gDAAgD;AAAA,IAC5F,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,oBAAoB,SAAS,iCAAiC;AAAA,IAC9D,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,4CAA4C;AAAA,MAC1C;AAAA,IACF;AAAA,IACA,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,uBAAuB,SAAS,kCAAkC;AAAA,IAClE,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,yBAAyB,SAAS,qCAAqC;AAAA,IACvE,eAAe,SAAS,0BAA0B;AAAA,IAClD,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,mBAAmB,SAAS,8BAA8B;AAAA,IAC1D,0BAA0B,SAAS,uCAAuC;AAAA,IAC1E,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,aAAa,SAAS,wBAAwB;AAAA,IAC9C,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,oBAAoB,SAAS,+BAA+B;AAAA,IAC5D,sBAAsB,SAAS,kCAAkC;AAAA,IACjE,4BAA4B,SAAS,wCAAwC;AAAA,IAC7E,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,iCAAiC,SAAS,8CAA8C;AAAA,IACxF,eAAe,SAAS,0BAA0B;AAAA,IAClD,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,qBAAqB,SAAS,iCAAiC;AAAA,IAC/D,qBAAqB,SAAS,kCAAkC;AAAA,IAChE,wBAAwB,SAAS,qCAAqC;AAAA,IACtE,4BAA4B,SAAS,yCAAyC;AAAA,IAC9E,uBAAuB,SAAS,oCAAoC;AAAA,IACpE,6BAA6B,SAAS,0CAA0C;AAAA,IAChF,6BAA6B,SAAS,2CAA2C;AAAA,IACjF,kBAAkB,SAAS,6BAA6B;AAAA,IACxD,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,0BAA0B,SAAS,sCAAsC;AAAA,IACzE,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,+BAA+B,SAAS,4CAA4C;AAAA,IACpF,mBACE,OAAO,iCAAiC,SACpC,SACA,OAAO,6BAA6B,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAAA,IAChF,2BAA2B,SAAS,wCAAwC;AAAA,IAC5E,kBACE,OAAO,gCAAgC,SACnC,SACA,OAAO,4BAA4B,MAAM,GAAG,EACzC,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAC7B,OAAO,OAAO;AAAA,IACvB,cACE,OAAO,4BAA4B,SAC/B,SACA,OAAO,wBAAwB,MAAM,GAAG,EACrC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,EACrB,OAAO,OAAO;AAAA,IACvB,WAAW,SAAS,sBAAsB;AAAA,IAC1C,YAAY,SAAS,uBAAuB;AAAA,IAC5C,gBAAgB,SAAS,2BAA2B;AAAA,IACpD,uBAAuB,SAAS,mCAAmC;AAAA,IACnE,8BAA8B,SAAS,2CAA2C;AAAA,IAClF,qCAAqC;AAAA,MACnC;AAAA,IACF;AAAA,IACA,0CAA0C;AAAA,MACxC;AAAA,IACF;AAAA,IACA,qDAAqD;AAAA,MACnD;AAAA,IACF;AAAA,IACA,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,cAAc,SAAS,yBAAyB;AAAA,IAChD,WAAW,SAAS,qBAAqB;AAAA,IACzC,iBAAiB,SAAS,4BAA4B;AAAA,IACtD,sBAAsB,SAAS,iCAAiC;AAAA,IAChE,qBAAqB,SAAS,gCAAgC;AAAA,IAC9D,wBAAwB,SAAS,oCAAoC;AAAA,IACrE,0BAA0B,SAAS,qCAAqC;AAAA,IACxE,YAAY,gBAAgB,SAAS,sBAAsB,CAAC;AAAA,EAC9D;AACA,QAAM,SAAS,eAAe,MAAM,GAAG;AACvC,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH,oBACE,IAAI,uBAAuB,UAAa,OAAO,mBAAmB,UAC9D,KAAK,IAAI,KAAQ,KAAK,MAAO,OAAO,sBAAsB,MAAQ,CAAC,CAAC,IACpE,OAAO;AAAA,IACb,uBACE,IAAI,0BAA0B,UAAa,OAAO,mBAAmB,UACjE,KAAK;AAAA,MACH;AAAA,MACA,KAAK;AAAA,QACH,KAAK,MAAO,OAAO,sBAAsB,MAAQ,CAAC;AAAA,QAClD,yCACE,+BAA+B;AAAA,UAC7B,0BAA0B,KAAK;AAAA,YAC7B,OAAO;AAAA,YACP,OAAO,iCAAiC,OAAO;AAAA,UACjD;AAAA,QACF,CAAC,IACD,IAAI,OAAO,6BACX;AAAA,MACJ;AAAA,IACF,IACA,OAAO;AAAA,IACb,YAAY,wBAAwB,MAAM;AAAA,EAC5C;AACA,MAAI,IAAI,oCAAoC,QAAW;AAIrD,UAAM,qBACJ,SAAS,mBAAmB,WAAW,SAAS,4BAA4B,SACxE,SAAS,0BAA0B,MACnC,SAAS,6BACT,+BAA+B;AAAA,MAC7B,0BAA0B,uCAAuC,QAAQ;AAAA,IAC3E,CAAC,IACD,IACA,OAAO;AACb,UAAM,UAAU,KAAK;AAAA,MACnB;AAAA,MACA,KAAK,OAAO,SAAS,qBAAqB,SAAS,yBAAyB,CAAC;AAAA,MAC7E;AAAA,IACF;AAGA,QAAI,UAAU,SAAS,oBAAoB;AACzC,eAAS,kCAAkC;AAAA,IAC7C,OAAO;AACL,eAAS,kCAAkC;AAC3C,UAAI,CAAC,sCAAsC;AACzC,+CAAuC;AACvC,gBAAQ;AAAA,UACN,sGACqC,SAAS,kBAAkB;AAAA,QAElE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,gCAA8B,MAAM;AACpC,mBAAiB,UAAU,MAAM;AACjC,SAAO;AACT;AAOA,IAAM,8BAA+E;AAAA,EACnF;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,EACV;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,EACV;AACF;AAEA,IAAM,kCAAkC,oBAAI,IAAY;AAExD,SAAS,8BAA8B,QAAiC;AACtE,aAAW,EAAE,MAAM,OAAO,KAAK,6BAA6B;AAC1D,QAAI,OAAO,IAAI,MAAM,UAAa,gCAAgC,IAAI,IAAI,EAAG;AAC7E,oCAAgC,IAAI,IAAI;AACxC,YAAQ;AAAA,MACN,YAAY,IAAI,4BAA4B,MAAM;AAAA,IACpD;AAAA,EACF;AACF;AAEA,IAAM,sCAAsC;AAQrC,SAAS,kCAAkC,UAAwC;AACxF,QAAM,WAAW,SAAS,kBAAkB,KAAK;AACjD,MAAI,SAAU,QAAO;AACrB,QAAM,sBAAsB,SAAS,WAAW,KAAK;AACrD,MAAI,SAAS,sBAAsB,gBAAgB,SAAS,gBAAgB,qBAAqB;AAC/F,WAAO;AAAA,EACT;AACA,SAAO,SAAS,sBAAsB,YACnC,SAAS,gBAAgB,WAAW,SAAS,gBAAgB,UAC5D,sCACA;AACN;AAYA,IAAM,iCAAuE;AAAA,EAC3E;AAAA,EACA;AACF;AAOO,SAAS,wCACd,UACwC;AACxC,SAAO,IAAI,IAAI,SAAS,+BAA+B,CAAC,IAAI,8BAA8B;AAC5F;AAGO,SAAS,+BACd,UACyB;AACzB,QAAM,cAAc,wCAAwC,QAAQ;AACpE,QAAMG,WAAU;AAAA,IACd,SAAS,6BAA6B,CAAC,GAAG,0BAA0B;AAAA,EACtE,EAAE,OAAO,CAAC,SAAS,CAAC,6BAA6B,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC;AAChF,QAAM,aAAa,IAAI,IAAIA,QAAO;AAClC,QAAM,WAAW;AAAA,IACf,SAAS,6BAA6B,CAAC,GAAG,6BAA6B;AAAA,EACzE;AACA,SAAO;AAAA,IACL,SAAS,SAAS,OAAO,CAAC,SAAS,WAAW,IAAI,IAAI,CAAC;AAAA,IACvD,SAAS,CAAC,GAAGA,QAAO;AAAA,EACtB;AACF;AAGO,SAAS,oCACd,UACA,UAC6B;AAC7B,QAAM,SAAS,+BAA+B,QAAQ;AACtD,QAAMA,WAAU,IAAI,IAAI,OAAO,OAAO;AACtC,QAAM,QAAQ,IAAI,IAAI,kCAAkC,YAAY,OAAO,OAAO,CAAC;AAEnF,MAAI,MAAM,IAAI,YAAY,EAAG,OAAM,IAAI,aAAa;AACpD,SAAO,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,SAASA,SAAQ,IAAI,IAAI,CAAC;AACtD;AAGO,SAAS,iCACd,UACA,SACA,mBAC6B;AAC7B,MAAI,WACF,QAAQ;AACV,MAAI,QAAQ,WAAW,mBAAmB,qBAAqB;AAE7D,UAAM,WAAW,oCAAoC,iBAAiB,GAAG;AACzE,UAAM,YAAY,QAAQ,WAAW,uBAAuB,CAAC;AAC7D,eAAW,UAAU,SACjB;AAAA,MACE,GAAG,oBAAI,IAAI;AAAA,QACT,GAAI,YAAY,+BAA+B,QAAQ,EAAE;AAAA,QACzD,GAAG;AAAA,MACL,CAAC;AAAA,IACH,IACA;AAAA,EACN;AACA,QAAMA,WAAU,oCAAoC,UAAU,QAAQ;AACtE,SAAO,QAAQ,QAAQ,8BAA8B,QAAQ,OAAOA,QAAO,IAAIA;AACjF;AAaO,SAAS,iCAAiC,UAA4B;AAC3E,SAAO,SAAS,2BAA2B,SAAS;AACtD;AAaO,SAAS,0BACd,UACA,UAA0C,SAAS,gBACxB;AAC3B,MAAI,YAAY,SAAS;AACvB,WAAO;AAAA,MACL,gBAAgB,SAAS,sBAAsB;AAAA,MAC/C,qBAAqB;AAAA,MACrB,uBAAuB,iCAAiC,QAAQ,IAAI;AAAA,MACpE,gBAAgB,SAAS;AAAA,IAC3B;AAAA,EACF;AACA,MAAI,YAAY,eAAe;AAC7B,WAAO;AAAA,MACL,gBAAgB;AAAA,MAChB,qBAAqB,SAAS;AAAA,MAC9B,uBAAuB;AAAA,MACvB,gBAAgB;AAAA,IAClB;AAAA,EACF;AACA,SAAO;AAAA,IACL,gBAAgB,uBAAuB,OAAO,EAAE,SAAS,kBAAkB;AAAA,IAC3E,qBAAqB;AAAA,IACrB,uBAAuB;AAAA,IACvB,gBAAgB;AAAA,EAClB;AACF;AAKO,SAAS,sCACd,UACA,SACe;AACf,QAAM,YAAY,0BAA0B,UAAU,OAAO;AAC7D,MAAI,UAAU,mBAAmB,KAAM,QAAO,UAAU;AACxD,SAAO,UAAU,wBAAwB,OAAO,UAAU,sBAAsB,MAAO;AACzF;AAUO,SAAS,+BACd,UACQ;AACR,SAAO,KAAK;AAAA,IACV;AAAA,IACA,SAAS,2BAA2B;AAAA,EACtC;AACF;AAIO,SAAS,uCACd,UACQ;AACR,SAAO,SAAS,iCAAiC,SAAS;AAC5D;AAYO,SAAS,sCACd,UAOQ;AACR,SAAO,KAAK;AAAA,IACV,SAAS;AAAA,IACT,yCACE,+BAA+B;AAAA,MAC7B,0BAA0B,uCAAuC,QAAQ;AAAA,IAC3E,CAAC,IACD,IAAI,SAAS;AAAA,EACjB;AACF;AAEO,SAAS,iCACd,UAIQ;AACR,QAAM,mBAAmB,+BAA+B;AAAA,IACtD,0BAA0B,uCAAuC,QAAQ;AAAA,EAC3E,CAAC;AACD,SAAO,KAAK;AAAA,IACV;AAAA,IACA,SAAS,6BACP,mBACA;AAAA,EACJ;AACF;AAEO,SAAS,0BACd,UACA,SAA4B,QAAQ,KACZ;AACxB,QAAM,MAA8B,CAAC;AACrC,aAAW,QAAQ,gCAAgC,QAAQ,GAAG;AAC5D,UAAM,QAAQ,OAAO,IAAI;AACzB,QAAI,OAAO;AACT,UAAI,IAAI,IAAI;AAAA,IACd;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,sBACd,UACA,SAA4B,QAAQ,KAChB;AACpB,MAAI,SAAS,QAAQ;AACnB,WAAO,SAAS;AAAA,EAClB;AACA,MAAI,SAAS,WAAW;AACtB,UAAM,QAAQ,OAAO,SAAS,SAAS;AACvC,WAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ;AAAA,EACpD;AACA,SAAO;AACT;AAEA,IAAM,kBAAkB;AACxB,IAAM,6BAA6B,oBAAI,IAAI;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,yBAAyB,IAAI;AAAA,EACjC,gBAAgB,QAAQ,IAAI,CAAC,QAAQ,UAAU,CAAC,QAAQ,KAAK,CAAC;AAChE;AACA,IAAM,iBAAiB,IAAI,IAAI,CAAC,QAAQ,SAAS,OAAO,EAAE,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AAC/F,IAAM,qBAAqB,IAAI;AAAA,EAC7B,CAAC,YAAY,YAAY,QAAQ,WAAW,EAAE,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,KAAK,CAAC;AACpF;AAEA,SAAS,yBAAyB,OAAe,YAA4B;AAC3E,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,IAAI,YAAY,IAAI,UAAU;AAChC,UAAM,IAAI,MAAM,YAAY,UAAU,oCAAoC;AAAA,EAC5E;AACA,MAAI,IAAI,QAAQ;AACd,UAAM,IAAI;AAAA,MACR,YAAY,UAAU;AAAA,IACxB;AAAA,EACF;AACA,MAAI,IAAI,MAAM;AACZ,UAAM,IAAI,MAAM,YAAY,UAAU,sCAAsC;AAAA,EAC9E;AACA,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,6BAA6B,MAAuB;AAC3D,SAAO,KACJ,YAAY,EACZ,MAAM,QAAQ,EACd,KAAK,CAAC,SAAS,2BAA2B,IAAI,IAAI,CAAC;AACxD;AAEA,SAAS,mBACP,YACA,SACoC;AACpC,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,QAAM,aAAqC,CAAC;AAC5C,QAAM,kBAAkB,oBAAI,IAAoB;AAChD,aAAW,CAAC,SAAS,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AACtD,QAAI,CAAC,gBAAgB,KAAK,OAAO,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,oDAAoD,KAAK,UAAU,OAAO,CAAC;AAAA,MACnG;AAAA,IACF;AACA,UAAM,OAAO,QAAQ,YAAY;AACjC,UAAM,WAAW,gBAAgB,IAAI,IAAI;AACzC,QAAI,aAAa,QAAW;AAC1B,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,yBAAyB,KAAK,UAAU,QAAQ,CAAC,QAAQ,KAAK,UAAU,OAAO,CAAC;AAAA,MACxG;AAAA,IACF;AACA,QAAI,SAAS,iBAAiB;AAC5B,YAAM,IAAI;AAAA,QACR,YAAY,UAAU;AAAA,MACxB;AAAA,IACF;AACA,oBAAgB,IAAI,MAAM,OAAO;AACjC,eAAW,IAAI,IAAI;AAAA,EACrB;AACA,SAAO;AACT;AAEA,SAAS,2BACP,YACA,OACA,SACsB;AACtB,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,aAAuB,CAAC;AAC9B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,WAAW,OAAO;AAC3B,QAAI,CAAC,gBAAgB,KAAK,OAAO,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,8DAA8D,KAAK,UAAU,OAAO,CAAC;AAAA,MAC7G;AAAA,IACF;AACA,UAAM,OAAO,QAAQ,YAAY;AACjC,QAAI,KAAK,IAAI,IAAI,GAAG;AAClB,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,gEAAgE,KAAK,UAAU,IAAI,CAAC;AAAA,MAC5G;AAAA,IACF;AACA,QAAI,EAAE,SAAS,WAAW,CAAC,KAAK;AAC9B,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,kEAAkE,KAAK,UAAU,IAAI,CAAC;AAAA,MAC9G;AAAA,IACF;AACA,QAAI,6BAA6B,IAAI,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,kEAAkE,KAAK,UAAU,IAAI,CAAC;AAAA,MAC9G;AAAA,IACF;AACA,SAAK,IAAI,IAAI;AACb,eAAW,KAAK,IAAI;AAAA,EACtB;AACA,SAAO;AACT;AAEA,SAAS,kBACP,YACA,OACoC;AACpC,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,aAAW,QAAQ,OAAO,KAAK,KAAK,GAAG;AACrC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,YAAY,UAAU,sCAAsC;AAAA,IAC9E;AAAA,EACF;AACA,SAAO,EAAE,GAAG,MAAM;AACpB;AAEA,SAAS,0BACP,YACA,OACA,OACsB;AACtB,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,IAAI,IAAI,GAAG;AAClB,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,oDAAoD,KAAK,UAAU,IAAI,CAAC;AAAA,MAChG;AAAA,IACF;AACA,QAAI,EAAE,SAAS,SAAS,CAAC,KAAK;AAC5B,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,+DAA+D,KAAK,UAAU,IAAI,CAAC;AAAA,MAC3G;AAAA,IACF;AACA,QAAI,6BAA6B,IAAI,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,YAAY,UAAU,iEAAiE,KAAK,UAAU,IAAI,CAAC;AAAA,MAC7G;AAAA,IACF;AACA,SAAK,IAAI,IAAI;AAAA,EACf;AACA,SAAO,CAAC,GAAG,KAAK;AAClB;AAEA,SAAS,0BAA0B,UAA8C;AAC/E,QAAM,iBAAiB,mBAAmB,SAAS,IAAI,SAAS,cAAc;AAC9E,QAAM,eAAe,kBAAkB,SAAS,IAAI,SAAS,YAAY;AACzE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,yBAAyB,SAAS,SAAS,SAAS,EAAE;AAAA,IAC/D,GAAI,mBAAmB,SAAY,CAAC,IAAI,EAAE,eAAe;AAAA,IACzD,GAAI,iBAAiB,SAAY,CAAC,IAAI,EAAE,aAAa;AAAA,IACrD,GAAI,SAAS,6BAA6B,SACtC,CAAC,IACD;AAAA,MACE,0BAA0B;AAAA,QACxB,SAAS;AAAA,QACT,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,IACJ,GAAI,SAAS,4BAA4B,SACrC,CAAC,IACD;AAAA,MACE,yBAAyB;AAAA,QACvB,SAAS;AAAA,QACT,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACN;AACF;AAEA,SAAS,8BACP,SACwB;AACxB,SAAO,aAAa,UAAU,UAAU,EAAE,SAAS,QAAQ;AAC7D;AAEA,SAAS,sBAAsB,cAAwD;AACrF,QAAM,SAAS,0BAA0B,MAAM,YAAY;AAC3D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW;AAAA,MACT,GAAG,OAAO;AAAA,MACV,SAAS,CAAC,GAAG,OAAO,UAAU,OAAO,EAAE;AAAA,QACrC,CAAC,MAAM,WACJ,uBAAuB,IAAI,IAAI,KAAK,MAAM,uBAAuB,IAAI,KAAK,KAAK;AAAA,MACpF;AAAA,IACF;AAAA,IACA,iBAAiB,CAAC,GAAG,OAAO,eAAe,EAAE;AAAA,MAC3C,CAAC,MAAM,WAAW,eAAe,IAAI,IAAI,KAAK,MAAM,eAAe,IAAI,KAAK,KAAK;AAAA,IACnF;AAAA,IACA,qBAAqB,CAAC,GAAG,IAAI,IAAI,OAAO,mBAAmB,CAAC,EAAE,KAAK;AAAA,IACnE,kBAAkB,CAAC,GAAG,OAAO,gBAAgB,EAAE;AAAA,MAC7C,CAAC,MAAM,WAAW,eAAe,IAAI,IAAI,KAAK,MAAM,eAAe,IAAI,KAAK,KAAK;AAAA,IACnF;AAAA,IACA,cAAc,CAAC,GAAG,OAAO,YAAY,EAAE;AAAA,MACrC,CAAC,MAAM,WACJ,mBAAmB,IAAI,KAAK,EAAE,KAAK,MAAM,mBAAmB,IAAI,MAAM,EAAE,KAAK;AAAA,IAClF;AAAA,EACF;AACF;AAEA,SAAS,wBACP,UACA,OAMqB;AACrB,QAAM,mBAAmB,MAAM,kBAAkB,kCAAkC,QAAQ,IAAI,CAAC;AAChG,SAAO,sBAAsB;AAAA,IAC3B,WAAW;AAAA,MACT,UAAU,MAAM,kBAAkB,cAAc;AAAA,MAChD,UAAU,MAAM;AAAA,MAChB,SAAS;AAAA,MACT,eAAe,MAAM,kBAAkB,SAAS,wBAAwB;AAAA,MACxE,UAAU;AAAA,IACZ;AAAA,IACA,iBAAiB,EAAE,UAAU,WAAW,UAAU,KAAK;AAAA,IACvD,kBAAkB,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,IACzD,aAAa;AAAA,MACX,WAAW;AAAA,QACT,UAAU,MAAM,kBAAkB,cAAc;AAAA,QAChD,UAAU,MAAM;AAAA,MAClB;AAAA,MACA,SAAS,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MAChD,eAAe,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MACtD,iBAAiB;AAAA,QACf,UAAU,MAAM,wBAAwB,cAAc;AAAA,QACtD,UAAU,MAAM,yBAAyB;AAAA,MAC3C;AAAA,IACF;AAAA,IACA,iBAAiB,MAAM,SAAS,CAAC,QAAQ,OAAO,IAAI,CAAC,MAAM;AAAA,IAC3D,qBAAqB;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,kBAAkB,CAAC,MAAM;AAAA,IACzB,YAAY;AAAA,MACV,KAAK,EAAE,UAAU,WAAW,UAAU,KAAK;AAAA,MAC3C,oBAAoB,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,MAC3D,eAAe,EAAE,UAAU,WAAW,UAAU,MAAM;AAAA,IACxD;AAAA,IACA,cAAc,CAAC,EAAE,IAAI,YAAY,UAAU,WAAW,UAAU,KAAK,CAAC;AAAA,EACxE,CAAC;AACH;AAEO,SAAS,qCACd,iBACA,SAAyC,4BAA4B,GACnC;AAClC,QAAM,QAAQ,OAAO,KAAK,CAAC,cAAc,UAAU,oBAAoB,eAAe;AACtF,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,SAAS;AAAA,MACP,MAAM,CAAC,GAAG,MAAM,SAAS;AAAA,MACzB,SAAS,MAAM,kBAAkB,SAAS;AAAA,IAC5C;AAAA,EACF;AACF;AAEA,SAAS,yBACP,UACA,OAKqB;AACrB,QAAM,SAAS,wBAAwB,UAAU;AAAA,IAC/C,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,EACnB,CAAC;AACD,SAAO,sBAAsB;AAAA,IAC3B,GAAG;AAAA,IACH,iBAAiB,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,IACzD,iBAAiB,MAAM,SAAS,CAAC,QAAQ,OAAO,IAAI,CAAC,MAAM;AAAA,IAC3D,qBAAqB,MAAM,uBAAuB,CAAC;AAAA,IACnD,YAAY;AAAA,MACV,GAAG,OAAO;AAAA,MACV,KAAK,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,IAC/C;AAAA,IACA,eAAe,MAAM,kBACjB,EAAE,UAAU,aAAa,UAAU,MAAM,MAAM,WAAW,IAC1D,EAAE,UAAU,eAAe,UAAU,OAAO,MAAM,OAAO;AAAA;AAAA;AAAA,IAG7D,cAAc,CAAC,EAAE,IAAI,YAAY,UAAU,aAAa,UAAU,KAAK,CAAC;AAAA,EAC1E,CAAC;AACH;AAEA,SAAS,kCAAkC,UAAyC;AAClF,QAAM,SAAS,wBAAwB,UAAU;AAAA,IAC/C,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,EACnB,CAAC;AACD,SAAO,sBAAsB;AAAA,IAC3B,GAAG;AAAA,IACH,iBAAiB,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,IACzD,iBAAiB,CAAC,MAAM;AAAA,IACxB,qBAAqB,CAAC;AAAA,IACtB,YAAY;AAAA,MACV,GAAG,OAAO;AAAA,MACV,KAAK,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,IAC/C;AAAA,IACA,eAAe,EAAE,UAAU,eAAe,UAAU,OAAO,MAAM,OAAO;AAAA,IACxE,cAAc,CAAC,EAAE,IAAI,YAAY,UAAU,aAAa,UAAU,KAAK,CAAC;AAAA,EAC1E,CAAC;AACH;AAEA,SAAS,wBACP,UACA,OAU0B;AAC1B,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,eAAe,MAAM,SAAS;AACpC,QAAM,SAAS,aAAa;AAC5B,QAAM,UAAU,eAAe,CAAC,IAAI,+BAA+B,QAAQ;AAC3E,QAAM,cAAc,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,MAAM,eAAe,CAAC;AACzE,QAAM,aAAa,IAAI;AAAA,IACrB,wBAAwB,SAAS,kBAAkB,EAChD;AAAA,MACC,CAAC,aACC,SAAS,OAAO,iCAChB,SAAS,OAAO;AAAA,IACpB,EACC;AAAA,MAAQ,CAAC,aACR,SAAS,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,GAAI,MAAM,WAAW,CAAC,CAAE,CAAC;AAAA,IACzE;AAAA,EACJ;AACA,QAAM,SAAS,QAAQ,IAAI,CAAC,UAAU;AACpC,UAAM,KAAK,YACP,MAAM,qBACN,eACE,GAAG,oCAAoC,GAAG,MAAM,eAAe,KAC/D,MAAM;AACZ,eAAW,IAAI,EAAE;AACjB,WAAO;AAAA,MACL;AAAA,MACA,iBAAiB,MAAM;AAAA,MACvB,OAAO,MAAM;AAAA,MACb,GAAI,MAAM,aAAa,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,MAC3D,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClD,cAAc,yBAAyB,UAAU;AAAA,QAC/C,iBAAiB,MAAM;AAAA,QACvB,QAAQ,MAAM;AAAA,QACd,qBAAqB,MAAM;AAAA,MAC7B,CAAC;AAAA,MACD,qBAAqB,MAAM;AAAA,MAC3B,8BAA8B,MAAM;AAAA,MACpC,uBAAuB,MAAM;AAAA,MAC7B,4BAA4B,SAAS;AAAA,MACrC,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,IAClE;AAAA,EACF,CAAC;AACD,MAAI,QAAQ;AACV,eAAW,UAAU,MAAM,gBAAgB,CAAC,GAAG;AAC7C,YAAM,YAAY,GAAG,YAAY,oCAAoC,oCAAoC,GAAG,OAAO,eAAe;AAKlI,UAAI,YAAY,IAAI,OAAO,eAAe,KAAK,WAAW,IAAI,SAAS,EAAG;AAC1E,kBAAY,IAAI,OAAO,eAAe;AACtC,iBAAW,IAAI,SAAS;AACxB,aAAO,KAAK;AAAA,QACV,IAAI;AAAA,QACJ,iBAAiB,OAAO;AAAA,QACxB,OAAO,OAAO,OAAO,KAAK,KAAK,OAAO;AAAA,QACtC,cAAc,yBAAyB,UAAU;AAAA,UAC/C,iBAAiB;AAAA,UACjB,QAAQ;AAAA,UACR,qBAAqB,CAAC;AAAA,QACxB,CAAC;AAAA,QACD,qBAAqB;AAAA,QACrB,8BAA8B;AAAA,QAC9B,uBAAuB;AAAA,QACvB,4BAA4B,SAAS;AAAA,MACvC,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,IAAI,YACA,gCACA,eACE,mCACA;AAAA,IACN,OAAO,YAAY,iBAAiB,eAAe,yBAAyB;AAAA;AAAA;AAAA;AAAA,IAI5E,KAAK;AAAA,IACL,aAAa;AAAA,IACb,SAAS;AAAA,IACT,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC/C;AAAA,EACF;AACF;AAEA,SAAS,2BACP,UACA,OAUiC;AACjC,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,eAAe,MAAM,SAAS;AACpC,QAAM,SAAS,aAAa;AAC5B,QAAM,UAAU,eAAe,CAAC,IAAI,kCAAkC,QAAQ;AAC9E,QAAM,cAAc,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,MAAM,eAAe,CAAC;AACzE,QAAM,aAAa,IAAI;AAAA,IACrB,wBAAwB,SAAS,kBAAkB,EAChD;AAAA,MACC,CAAC,aACC,SAAS,OAAO,oCAChB,SAAS,OAAO;AAAA,IACpB,EACC;AAAA,MAAQ,CAAC,aACR,SAAS,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,GAAI,MAAM,WAAW,CAAC,CAAE,CAAC;AAAA,IACzE;AAAA,EACJ;AACA,QAAM,SAAqC,QAAQ,IAAI,CAAC,UAAU;AAChE,UAAM,KAAK,YACP,6BAA6B,MAAM,eAAe,IAClD,eACE,GAAG,uCAAuC,GAAG,MAAM,eAAe,KAClE,GAAG,0BAA0B,GAAG,MAAM,eAAe;AAC3D,UAAM,UAAU,YACZ,MAAM,QAAQ,IAAI,4BAA4B,IAC9C,eACE,MAAM,QAAQ,IAAI,CAAC,UAAU,GAAG,uCAAuC,GAAG,KAAK,EAAE,IACjF,MAAM;AACZ,eAAW,IAAI,EAAE;AACjB,eAAW,SAAS,QAAS,YAAW,IAAI,KAAK;AACjD,WAAO;AAAA,MACL;AAAA,MACA,iBAAiB,MAAM;AAAA,MACvB;AAAA,MACA,OAAO,MAAM;AAAA,MACb,GAAI,MAAM,aAAa,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,MAC3D,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClD,cAAc,MAAM;AAAA,MACpB,GAAI,MAAM,wBAAwB,SAC9B,CAAC,IACD,EAAE,qBAAqB,MAAM,oBAAoB;AAAA,MACrD,GAAI,MAAM,iCAAiC,SACvC,CAAC,IACD,EAAE,8BAA8B,MAAM,6BAA6B;AAAA,MACvE,GAAI,MAAM,0BAA0B,SAChC,CAAC,IACD,EAAE,uBAAuB,MAAM,sBAAsB;AAAA,MACzD,4BACE,MAAM,8BAA8B,SAAS;AAAA,IACjD;AAAA,EACF,CAAC;AACD,MAAI,QAAQ;AACV,eAAW,UAAU,MAAM,gBAAgB,CAAC,GAAG;AAC7C,YAAM,YAAY,GAAG,YAAY,uCAAuC,uCAAuC,GAAG,OAAO,eAAe;AACxI,UAAI,YAAY,IAAI,OAAO,eAAe,KAAK,WAAW,IAAI,SAAS,EAAG;AAC1E,kBAAY,IAAI,OAAO,eAAe;AACtC,iBAAW,IAAI,SAAS;AACxB,aAAO,KAAK;AAAA,QACV,IAAI;AAAA,QACJ,iBAAiB,OAAO;AAAA,QACxB,SAAS,CAAC;AAAA,QACV,OAAO,OAAO,OAAO,KAAK,KAAK,OAAO;AAAA,QACtC,cAAc,kCAAkC,QAAQ;AAAA,QACxD,4BAA4B,SAAS;AAAA,MACvC,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,QAAM,iBAAyC;AAAA,IAC7C,WAAW;AAAA,IACX,GAAI,SAAS,gBAAgB,EAAE,gBAAgB,SAAS,cAAc,IAAI,CAAC;AAAA,EAC7E;AACA,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,IAAI,YACA,mCACA,eACE,sCACA;AAAA,IACN,OAAO,YAAY,oBAAoB,eAAe,4BAA4B;AAAA,IAClF,KAAK;AAAA,IACL,aAAa;AAAA,IACb,SAAS;AAAA,IACT,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC/C;AAAA,IACA,0BAA0B,OAAO,KAAK,cAAc;AAAA,IACpD;AAAA,EACF;AACF;AAEA,SAAS,sBACP,UACA,OAUiC;AACjC,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,eAAe,MAAM,SAAS;AACpC,QAAM,SAAS,aAAa;AAC5B,QAAM,UAAU,eAAe,CAAC,IAAI,6BAA6B,QAAQ;AACzE,QAAM,cAAc,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,MAAM,eAAe,CAAC;AACzE,QAAM,aAAa,IAAI;AAAA,IACrB,wBAAwB,SAAS,kBAAkB,EAChD;AAAA,MACC,CAAC,aACC,SAAS,OAAO,+BAChB,SAAS,OAAO;AAAA,IACpB,EACC;AAAA,MAAQ,CAAC,aACR,SAAS,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,GAAI,MAAM,WAAW,CAAC,CAAE,CAAC;AAAA,IACzE;AAAA,EACJ;AACA,QAAM,SAAqC,QAAQ,IAAI,CAAC,UAAU;AAChE,UAAM,KAAK,YACP,wBAAwB,MAAM,eAAe,IAC7C,GAAG,qBAAqB,GAAG,MAAM,eAAe;AACpD,UAAM,UAAU,YAAY,MAAM,QAAQ,IAAI,uBAAuB,IAAI,MAAM;AAC/E,eAAW,IAAI,EAAE;AACjB,eAAW,SAAS,QAAS,YAAW,IAAI,KAAK;AACjD,WAAO;AAAA,MACL;AAAA,MACA,iBAAiB,MAAM;AAAA,MACvB;AAAA,MACA,OAAO,MAAM;AAAA,MACb,GAAI,MAAM,aAAa,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,MAC3D,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,MAClD,cAAc,MAAM;AAAA,MACpB,GAAI,MAAM,wBAAwB,SAC9B,CAAC,IACD,EAAE,qBAAqB,MAAM,oBAAoB;AAAA,MACrD,GAAI,MAAM,iCAAiC,SACvC,CAAC,IACD,EAAE,8BAA8B,MAAM,6BAA6B;AAAA,MACvE,GAAI,MAAM,0BAA0B,SAChC,CAAC,IACD,EAAE,uBAAuB,MAAM,sBAAsB;AAAA,MACzD,4BACE,MAAM,8BAA8B,SAAS;AAAA;AAAA;AAAA,MAG/C,IAAI,MAAM;AACR,cAAM,UAAU,MAAM,WAAW,0BAA0B,MAAM,eAAe;AAChF,eAAO,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,MAChD,GAAG;AAAA,IACL;AAAA,EACF,CAAC;AACD,MAAI,QAAQ;AAIV,UAAM,uBAAuB,IAAI;AAAA,MAC/B,6BAA6B,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,iBAAiB,KAAK,CAAC;AAAA,IACtF;AACA,eAAW,UAAU,MAAM,gBAAgB,CAAC,GAAG;AAC7C,YAAM,YAAY,GAAG,YAAY,kCAAkC,kCAAkC,GAAG,OAAO,eAAe;AAE9H,UAAI,YAAY,IAAI,OAAO,eAAe,KAAK,WAAW,IAAI,SAAS,EAAG;AAC1E,kBAAY,IAAI,OAAO,eAAe;AACtC,iBAAW,IAAI,SAAS;AACxB,YAAM,WAAW,qBAAqB,IAAI,OAAO,eAAe;AAChE,aAAO,KAAK;AAAA,QACV,IAAI;AAAA,QACJ,iBAAiB,OAAO;AAAA,QACxB,SAAS,CAAC;AAAA,QACV,OAAO,OAAO,OAAO,KAAK,KAAK,UAAU,SAAS,OAAO;AAAA,QACzD,GAAI,UAAU,cAAc,CAAC,OAAO,OAAO,KAAK,IAC5C,EAAE,YAAY,SAAS,WAAW,IAClC,CAAC;AAAA,QACL,cACE,UAAU,gBAAgB,6BAA6B,OAAO,eAAe;AAAA,QAC/E,GAAI,UAAU,wBAAwB,SAClC,CAAC,IACD,EAAE,qBAAqB,SAAS,oBAAoB;AAAA,QACxD,GAAI,UAAU,iCAAiC,SAC3C,CAAC,IACD,EAAE,8BAA8B,SAAS,6BAA6B;AAAA,QAC1E,GAAI,UAAU,0BAA0B,SACpC,CAAC,IACD,EAAE,uBAAuB,SAAS,sBAAsB;AAAA,QAC5D,4BACE,UAAU,8BAA8B,SAAS;AAAA,MACrD,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,IAAI,YACA,8BACA,eACE,iCACA;AAAA,IACN,OAAO,YAAY,eAAe,eAAe,uBAAuB;AAAA,IACxE,KAAK;AAAA,IACL,aAAa;AAAA,IACb,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOT,yBAAyB;AAAA,IACzB,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC/C;AAAA,EACF;AACF;AAEA,SAAS,4BAA4B,UAAgD;AACnF,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,QAAM,WAAuC,UAAU;AAAA,IACrD,CAAC,aACC,SAAS,6BACT,EAAE,SAAS,QAAQ,wBAAwB,SAAS,WAAW,SAAS;AAAA,EAC5E;AACA,MAAI,SAAS,yBAAyB,+BAA+B,QAAQ,EAAE,SAAS,GAAG;AACzF,aAAS;AAAA,MACP,wBAAwB,UAAU;AAAA,QAChC,MAAM;AAAA,QACN,QAAQ,SAAS;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,aAAa,SAAS,mBACxB,2BAA2B,UAAU;AAAA,IACnC,MAAM;AAAA,IACN,QAAQ,SAAS;AAAA,EACnB,CAAC,IACD;AACJ,MAAI,WAAY,UAAS,KAAK,UAAU;AACxC,QAAM,QAAQ,SAAS,cACnB,sBAAsB,UAAU,EAAE,MAAM,iBAAiB,QAAQ,SAAS,YAAY,CAAC,IACvF;AACJ,MAAI,MAAO,UAAS,KAAK,KAAK;AAC9B,SAAO;AACT;AAGO,SAAS,yBACd,UACA,aAUU;AACV,QAAM,YAAY,wBAAwB,SAAS,kBAAkB,EAAE;AAAA,IACrE,CAAC,aACC,CAAC,SAAS,GAAG,WAAW,mBAAmB,KAC3C,CAAC,SAAS,GAAG,WAAW,yBAAyB;AAAA,EACrD;AACA,aAAW,cAAc,aAAa;AACpC,UAAM,OAAO,0BAA0B,UAAU;AACjD,QAAI,CAAC,KAAM;AACX,cAAU,KAAK;AAAA,MACb,MAAM,KAAK,aAAa,WAAW,4BAA4B;AAAA,MAC/D,IAAI,KAAK;AAAA,MACT,OAAO,KAAK,aAAa,WAAW,gBAAgB;AAAA,MACpD,KAAK;AAAA,MACL,aAAa,KAAK,aAAa,WAAW,WAAW;AAAA,MACrD,SAAS,KAAK;AAAA,MACd,GAAI,WAAW,SAAS,EAAE,QAAQ,WAAW,OAAO,IAAI,CAAC;AAAA,MACzD,QAAQ;AAAA,QACN;AAAA,UACE,IAAI,KAAK;AAAA,UACT,iBAAiB,KAAK;AAAA,UACtB,OAAO,KAAK;AAAA,UACZ,cAAc,wBAAwB,UAAU;AAAA,YAC9C,iBAAiB;AAAA,YACjB,iBAAiB;AAAA,UACnB,CAAC;AAAA,UACD,4BAA4B,SAAS;AAAA,QACvC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,EAAE,GAAG,UAAU,oBAAoB,KAAK,UAAU,SAAS,EAAE;AACtE;AAGO,SAAS,oCACd,UACA,eAGM,CAAC,GACG;AACV,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,QAAM,mBAAmB,UAAU;AAAA,IACjC,CAAC,aAAa,SAAS,OAAO;AAAA,EAChC;AACA,QAAM,eAAe,+BAA+B,QAAQ,EAAE;AAC9D,MAAI,iBAAiB,KAAK,aAAa,WAAW,EAAG,QAAO;AAC5D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB,KAAK,UAAU;AAAA,MACjC,GAAG;AAAA,MACH,wBAAwB,UAAU;AAAA,QAChC,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AACF;AAGO,SAAS,+BACd,UACA,QACA,eAGM,CAAC,GACG;AACV,MAAI,CAAC,OAAO,KAAK,GAAG;AAClB,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,QAAM,kBAAkB,oCAAoC,UAAU,YAAY;AAClF,QAAM,YAAY,wBAAwB,gBAAgB,kBAAkB,EAAE;AAAA,IAAI,CAAC,aACjF,SAAS,OAAO,gCAAgC,EAAE,GAAG,UAAU,OAAO,IAAI;AAAA,EAC5E;AACA,SAAO,EAAE,GAAG,iBAAiB,oBAAoB,KAAK,UAAU,SAAS,EAAE;AAC7E;AAGO,SAAS,uCACd,UACA,eAGM,CAAC,GACG;AACV,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,QAAM,mBAAmB,UAAU;AAAA,IACjC,CAACC,cAAaA,UAAS,OAAO;AAAA,EAChC;AACA,QAAM,WAAW,2BAA2B,UAAU;AAAA,IACpD,MAAM;AAAA,IACN;AAAA,EACF,CAAC;AACD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB,KAAK,UAAU,CAAC,GAAG,kBAAkB,QAAQ,CAAC;AAAA,EACpE;AACF;AAGO,SAAS,kCACd,UACA,QACA,eAGM,CAAC,GACG;AACV,MAAI,CAAC,OAAO,KAAK,GAAG;AAClB,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,QAAM,kBAAkB,uCAAuC,UAAU,YAAY;AACrF,QAAM,YAAY,wBAAwB,gBAAgB,kBAAkB,EAAE;AAAA,IAAI,CAAC,aACjF,SAAS,OAAO,mCAAmC,EAAE,GAAG,UAAU,OAAO,IAAI;AAAA,EAC/E;AACA,SAAO,EAAE,GAAG,iBAAiB,oBAAoB,KAAK,UAAU,SAAS,EAAE;AAC7E;AAGO,SAAS,kCACd,UACA,eAGM,CAAC,GACG;AACV,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,QAAM,mBAAmB,UAAU;AAAA,IACjC,CAACA,cAAaA,UAAS,OAAO;AAAA,EAChC;AACA,QAAM,WAAW,sBAAsB,UAAU;AAAA,IAC/C,MAAM;AAAA,IACN;AAAA,EACF,CAAC;AACD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB,KAAK,UAAU,CAAC,GAAG,kBAAkB,QAAQ,CAAC;AAAA,EACpE;AACF;AAGO,SAAS,6BACd,UACA,QACA,eAGM,CAAC,GACG;AACV,MAAI,CAAC,OAAO,KAAK,GAAG;AAClB,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AACA,QAAM,kBAAkB,kCAAkC,UAAU,YAAY;AAChF,QAAM,YAAY,wBAAwB,gBAAgB,kBAAkB,EAAE;AAAA,IAAI,CAAC,aACjF,SAAS,OAAO,8BAA8B,EAAE,GAAG,UAAU,OAAO,IAAI;AAAA,EAC1E;AACA,SAAO,EAAE,GAAG,iBAAiB,oBAAoB,KAAK,UAAU,SAAS,EAAE;AAC7E;AAGO,SAAS,qCACd,UACA,eAGM,CAAC,GACG;AACV,QAAM,YAAY,wBAAwB,SAAS,kBAAkB,EAAE;AAAA,IACrE,CAACA,cAAaA,UAAS,OAAO;AAAA,EAChC;AACA,QAAM,WAAW,sBAAsB,UAAU;AAAA,IAC/C,MAAM;AAAA,IACN;AAAA,EACF,CAAC;AACD,SAAO,WACH,EAAE,GAAG,UAAU,oBAAoB,KAAK,UAAU,CAAC,GAAG,WAAW,QAAQ,CAAC,EAAE,IAC5E;AACN;AAEO,SAAS,gCACd,UACA,QACA,eAGM,CAAC,GACG;AACV,MAAI,CAAC,OAAO,KAAK,EAAG,OAAM,IAAI,MAAM,wCAAwC;AAC5E,QAAM,UAAU,qCAAqC,UAAU,YAAY;AAC3E,QAAM,YAAY,wBAAwB,QAAQ,kBAAkB,EAAE;AAAA,IAAI,CAAC,aACzE,SAAS,OAAO,iCAAiC,EAAE,GAAG,UAAU,OAAO,IAAI;AAAA,EAC7E;AACA,SAAO,EAAE,GAAG,SAAS,oBAAoB,KAAK,UAAU,SAAS,EAAE;AACrE;AAKA,IAAM,6BAA6B;AAAA,EACjC,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AACF;AAGO,SAAS,kCACd,SACwC;AACxC,MAAI,SAAS,WAAW,mCAAmC,EAAG,QAAO;AACrE,MAAI,SAAS,WAAW,yCAAyC,EAAG,QAAO;AAC3E,SAAO;AACT;AAEO,SAAS,gCAAgC,UAAmD;AACjG,SAAO,2BAA2B,QAAQ,EAAE;AAC9C;AASA,SAAS,mCACP,UACA,UACA,OAKiC;AACjC,QAAM,QAAQ,2BAA2B,QAAQ;AACjD,QAAM,UACJ,aAAa,WACT,8BACA,MAAM,WACJ,+BAA+B,MAAM,QAAQ,IAC7C;AACR,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAAqC,CAAC;AAC5C,aAAW,SAAS,MAAM,QAAQ;AAChC,QAAI,KAAK,IAAI,MAAM,eAAe,EAAG;AACrC,SAAK,IAAI,MAAM,eAAe;AAC9B,WAAO,KAAK;AAAA,MACV,IAAI,GAAG,MAAM,MAAM,GAAG,MAAM,eAAe;AAAA,MAC3C,iBAAiB,MAAM;AAAA,MACvB,SAAS,CAAC;AAAA,MACV,OAAO,MAAM,OAAO,KAAK,KAAK,MAAM;AAAA,MACpC,cAAc,wBAAwB,UAAU;AAAA,QAC9C,iBAAiB;AAAA,QACjB,iBAAiB;AAAA,MACnB,CAAC;AAAA,MACD,4BAA4B,SAAS;AAAA,IACvC,CAAC;AAAA,EACH;AACA,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,IAAI,MAAM;AAAA,IACV,OAAO,MAAM;AAAA,IACb,KAAK;AAAA,IACL,aAAa,MAAM;AAAA,IACnB;AAAA,IACA,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC/C;AAAA,EACF;AACF;AAOA,SAAS,+BAA+B,UAAiC;AACvE,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,QAAQ;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MACE,IAAI,aAAa,YACjB,IAAI,YACJ,IAAI,YACJ,IAAI,QACJ,IAAI,UACJ,IAAI,QACJ,CAAC,oCAAoC,KAAK,IAAI,QAAQ,KACtD,CAAC,CAAC,IAAI,KAAK,cAAc,aAAa,EAAE,SAAS,IAAI,QAAQ;AAE7D,WAAO;AACT,SAAO,GAAG,IAAI,MAAM;AACtB;AAEA,SAAS,+BACP,UACA,UACA,SACU;AACV,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,YAAY,wBAAwB,SAAS,kBAAkB,EAAE;AAAA,IACrE,CAAC,cAAc,UAAU,OAAO,2BAA2B,QAAQ,EAAE;AAAA,EACvE;AACA,SAAO,EAAE,GAAG,UAAU,oBAAoB,KAAK,UAAU,CAAC,GAAG,WAAW,OAAO,CAAC,EAAE;AACpF;AAGO,SAAS,sCACd,UACA,UACA,OAIU;AACV,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mCAAmC,UAAU,UAAU,KAAK;AAAA,EAC9D;AACF;AAGO,SAAS,iCACd,UACA,UACA,QACA,OAIU;AACV,MAAI,CAAC,OAAO,KAAK,EAAG,OAAM,IAAI,MAAM,gBAAgB,QAAQ,sBAAsB;AAClF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mCAAmC,UAAU,UAAU,EAAE,GAAG,OAAO,OAAO,CAAC;AAAA,EAC7E;AACF;AAGO,SAAS,2CACd,UACA,OAIU;AACV,SAAO,sCAAsC,UAAU,gBAAgB,KAAK;AAC9E;AAGO,SAAS,sCACd,UACA,QACA,OAIU;AACV,SAAO,iCAAiC,UAAU,gBAAgB,QAAQ,KAAK;AACjF;AAGO,SAAS,uCACd,UACA,eAGM,CAAC,GACG;AACV,MAAI,aAAa,WAAW,EAAG,QAAO;AACtC,QAAM,YAAY,wBAAwB,SAAS,kBAAkB,EAAE;AAAA,IACrE,CAACA,cAAaA,UAAS,OAAO;AAAA,EAChC;AACA,QAAM,WAAW,wBAAwB,UAAU;AAAA,IACjD,MAAM;AAAA,IACN;AAAA,EACF,CAAC;AACD,SAAO,EAAE,GAAG,UAAU,oBAAoB,KAAK,UAAU,CAAC,GAAG,WAAW,QAAQ,CAAC,EAAE;AACrF;AAEO,SAAS,kCACd,UACA,QACA,eAGM,CAAC,GACG;AACV,MAAI,CAAC,OAAO,KAAK,EAAG,OAAM,IAAI,MAAM,6CAA6C;AACjF,QAAM,UAAU,uCAAuC,UAAU,YAAY;AAC7E,QAAM,YAAY,wBAAwB,QAAQ,kBAAkB,EAAE;AAAA,IAAI,CAAC,aACzE,SAAS,OAAO,mCAAmC,EAAE,GAAG,UAAU,OAAO,IAAI;AAAA,EAC/E;AACA,SAAO,EAAE,GAAG,SAAS,oBAAoB,KAAK,UAAU,SAAS,EAAE;AACrE;AAGO,SAAS,0CACd,UACA,eAGM,CAAC,GACG;AACV,QAAM,YAAY,wBAAwB,SAAS,kBAAkB,EAAE;AAAA,IACrE,CAACA,cAAaA,UAAS,OAAO;AAAA,EAChC;AACA,QAAM,WAAW,2BAA2B,UAAU;AAAA,IACpD,MAAM;AAAA,IACN;AAAA,EACF,CAAC;AACD,SAAO,WACH,EAAE,GAAG,UAAU,oBAAoB,KAAK,UAAU,CAAC,GAAG,WAAW,QAAQ,CAAC,EAAE,IAC5E;AACN;AAEO,SAAS,qCACd,UACA,QACA,eAGM,CAAC,GACG;AACV,MAAI,CAAC,OAAO,KAAK,EAAG,OAAM,IAAI,MAAM,6CAA6C;AACjF,QAAM,UAAU,0CAA0C,UAAU,YAAY;AAChF,QAAM,YAAY,wBAAwB,QAAQ,kBAAkB,EAAE;AAAA,IAAI,CAAC,aACzE,SAAS,OAAO,sCAAsC,EAAE,GAAG,UAAU,OAAO,IAAI;AAAA,EAClF;AACA,SAAO,EAAE,GAAG,SAAS,oBAAoB,KAAK,UAAU,SAAS,EAAE;AACrE;AAGA,IAAM,oCAAoC;AAM1C,IAAM,mCAAmC;AAEzC,IAAM,2BAA8C,CAAC,eAAe,aAAa;AAQjF,SAAS,6BAA6B,SAOxB;AACZ,QAAM,OAAO,QAAQ,WAAW,qBAAqB,IACjD,QAAQ,MAAM,sBAAsB,MAAM,IAC1C;AACJ,SAAO,yBAAyB,SAAS,IAAI,IACzC;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,UAAU;AAAA,IACV,sBAAsB;AAAA,EACxB,IACA;AACN;AAQO,SAAS,uBAAuB,SAAyB;AAC9D,QAAM,OAAO,QAAQ,WAAW,qBAAqB,IACjD,QAAQ,MAAM,sBAAsB,MAAM,IAC1C;AACJ,QAAM,YAAY,0BAA0B,KAAK,IAAI;AACrD,MAAI,WAAW;AACb,WAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,EAC7B;AACA,QAAM,QAAQ,mCAAmC,KAAK,IAAI;AAC1D,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,SAAS,MAAM,CAAC,EAAG,QAAQ,SAAS,KAAK;AAC/C,QAAM,OAAO,MAAM,CAAC;AACpB,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KACZ,MAAM,GAAG,EACT,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,EAChC,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,YAAY,IAAI,KAAK,MAAM,CAAC,EAAE,YAAY,CAAC,EACxE,KAAK,GAAG;AACX,SAAO,OAAO,SAAS,IAAI,GAAG,MAAM,IAAI,MAAM,KAAK;AACrD;AAMO,SAAS,4BAA4B,SAAgC;AAC1E,QAAM,OAAO,QAAQ,WAAW,qBAAqB,IACjD,QAAQ,MAAM,sBAAsB,MAAM,IAC1C;AACJ,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,IAAM,0BAA0B,CAAC,eAAe,iBAAiB,cAAc;AAE/E,SAAS,sBAAsB,SAA0B;AACvD,SAAQ,wBAA8C,SAAS,OAAO;AACxE;AAGA,SAAS,6BACP,UACA,SAIA;AACA,MAAI,sBAAsB,OAAO,GAAG;AAClC,WAAO;AAAA,MACL,qBAAqB;AAAA,MACrB,8BAA8B;AAAA,MAC9B,uBAAuB;AAAA,IACzB;AAAA,EACF;AACA,SAAO,EAAE,qBAAqB,SAAS,oBAAoB;AAC7D;AAEA,SAAS,4BAA4B,SAKlC;AACD,MACE,sBAAsB,OAAO,KAC7B,qBAAqB,KAAK,OAAO,KACjC,QAAQ,WAAW,gBAAgB,KACnC,4BAA4B,KAAK,OAAO,GACxC;AACA,UAAM,YAAY,6BAA6B,OAAO;AACtD,WAAO;AAAA,MACL,EAAE,IAAI,YAAY,UAAU,aAAa,UAAU,KAAK;AAAA,MACxD;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,UAAU;AAAA,QACV,sBAAsB;AAAA,MACxB;AAAA,MACA,GAAI,YAAY,CAAC,SAAS,IAAI,CAAC;AAAA,IACjC;AAAA,EACF;AACA,SAAO,CAAC,EAAE,IAAI,YAAY,UAAU,WAAW,UAAU,KAAK,CAAC;AACjE;AAEA,SAAS,yBAAyB,MAAuB;AACvD,SAAO,KAAK,WAAW,UAAU,KAAK,qBAAqB,KAAK,IAAI;AACtE;AAQA,SAAS,iCACP,MACA,cACqB;AACrB,MAAI,CAAC,qBAAqB,KAAK,IAAI,EAAG,QAAO;AAC7C,QAAM,UAAU,4BAA4B,GAAG,qBAAqB,GAAG,IAAI,EAAE;AAC7E,QAAM,QAAQ,QAAQ;AAAA,IACpB,CAAC,UACE,KAAK,OAAO,UAAU,KAAK,OAAO,gBACnC,CAAC,aAAa,aAAa,KAAK,CAAC,aAAa,SAAS,OAAO,KAAK,EAAE;AAAA,EACzE;AACA,SAAO,sBAAsB;AAAA,IAC3B,GAAG;AAAA,IACH,iBAAiB,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,aAAa,iBAAiB,OAAgB,CAAC,CAAC;AAAA,IACjF,kBACE,aAAa,iBAAiB,aAAa,YACvC,EAAE,UAAU,aAAa,UAAU,KAAK,IACxC,aAAa;AAAA,IACnB,cAAc,CAAC,GAAG,aAAa,cAAc,GAAG,KAAK;AAAA,EACvD,CAAC;AACH;AAEA,SAAS,6BACP,SAC+D;AAC/D,QAAM,OAAO,QAAQ,WAAW,qBAAqB,IACjD,QAAQ,MAAM,sBAAsB,MAAM,IAC1C;AACJ,SAAO,KAAK,WAAW,UAAU,KAAK,KAAK,WAAW,QAAQ,IAC1D,EAAE,UAAU,aAAa,UAAU,MAAM,MAAM,WAAW,IAC1D;AACN;AAGA,SAAS,qCAAqC,UAAoB,SAA0B;AAC1F,SACE,SAAS,mBAAmB,YAC5B,yBAAyB,SAAS,aAAa,MAC9C,sBAAsB,OAAO,KAAK,QAAQ,WAAW,QAAQ;AAElE;AAGO,SAAS,yBAAyB,SAAsC;AAC7E,MAAI,YAAY,OAAW,QAAO;AAClC,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,OAAO;AAC9B,WACE,OAAO,aAAa,YACpB,OAAO,aAAa,oBACpB,OAAO,SAAS,MAChB,OAAO,aAAa,MACpB,OAAO,aAAa,MACpB,OAAO,WAAW,MAClB,OAAO,SAAS,MAChB,OAAO,SAAS,QAAQ,QAAQ,EAAE,MAAM;AAAA,EAE5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQO,SAAS,0BACd,YACA,aAC+C;AAC/C,MAAI,gBAAgB,YAAY;AAC9B,WAAO;AAAA,EACT;AACA,MAAI,gBAAgB,aAAa;AAC/B,WAAO;AAAA,EACT;AACA,MACE,eAAe,WACf,eAAe,qBACf,eAAe,8BACf;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,6BACd,WACA,qBACS;AACT,MAAI,cAAc,YAAY;AAC5B,WAAO;AAAA,EACT;AACA,MAAI,cAAc,aAAa;AAC7B,WAAO,wBAAwB;AAAA,EACjC;AACA,SAAO,wBAAwB,cAAc,wBAAwB;AACvE;AAEO,SAAS,6BAA6B,UAAoB,SAAgC;AAC/F,QAAM,WAAW;AAAA,IACf,+BAA+B,UAAU,OAAO;AAAA,IAChD,8BAA8B,UAAU,OAAO;AAAA,EACjD;AACA,MAAI,CAAC,UAAU;AACb,WAAO,CAAC,UAAU;AAAA,EACpB;AACA,SAAO,SAAS,MAAM,aAAa,aAChC,OAAO,CAAC,SAAS,KAAK,QAAQ,EAC9B,IAAI,CAAC,SAAS,YAAY,MAAM,KAAK,EAAE,CAAC;AAC7C;AAEA,SAAS,0BACP,UACA,SACA,aACM;AACN,QAAM,WAAW,6BAA6B,UAAU,OAAO;AAC/D,MAAI,CAAC,SAAS,SAAS,WAAW,GAAG;AACnC,UAAM,IAAI,4BAA4B,SAAS,aAAa,QAAQ;AAAA,EACtE;AACF;AAEO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAGrD,YACW,SACA,aACA,qBACT;AACA;AAAA,MACE,gBAAgB,WAAW,8BAA8B,OAAO,cAAc,oBAAoB,KAAK,IAAI,CAAC;AAAA,IAC9G;AANS;AACA;AACA;AAKT,SAAK,OAAO;AAAA,EACd;AAAA,EAXS,OAAO;AAYlB;AAEA,SAAS,yBAAyB,UAAwD;AACxF,UAAQ,SAAS,MAAM;AAAA,IACrB,KAAK;AACH,aAAO,EAAE,MAAM,cAAc,WAAW,OAAO;AAAA,IACjD,KAAK;AACH,aAAO,EAAE,MAAM,0BAA0B,UAAU,QAAQ;AAAA,IAC7D,KAAK;AACH,aAAO,EAAE,MAAM,0BAA0B,UAAU,MAAM;AAAA,IAC3D,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,MAAM,0BAA0B,UAAU,SAAS;AAAA,IAC9D,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,MAAM,wBAAwB,WAAW,UAAU;AAAA,IAC9D,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,MAAM,2BAA2B,WAAW,UAAU;AAAA,IACjE,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,MAAM,cAAc,WAAW,UAAU;AAAA,IACpD,SAAS;AACP,YAAM,cAAqB,SAAS;AACpC,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,UAA0D;AACjF,UAAQ,SAAS,MAAM;AAAA,IACrB,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,eAAe,cAAc,UAAU,WAAW;AAAA,IAC7D,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,eAAe,0BAA0B,UAAU,WAAW;AAAA,IACzE,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,eAAe,aAAa,UAAU,WAAW;AAAA,IAC5D,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,eAAe,gBAAgB,UAAU,WAAW;AAAA,IAC/D,KAAK;AAAA,IACL,KAAK;AAAA;AAAA;AAAA,IAGL,KAAK;AACH,aAAO,EAAE,eAAe,cAAc,UAAU,mBAAmB;AAAA,IACrE,SAAS;AACP,YAAM,cAAqB,SAAS;AACpC,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,uBACP,UACA,gBACA,kBAC0B;AAC1B,MAAI,iBAAiB,SAAS,uBAAwB,QAAO;AAC7D,MAAI,iBAAiB,SAAS,0BAA2B,QAAO;AAChE,MAAI,iBAAiB,SAAS,yBAA0B,QAAO;AAC/D,SAAO,yBAAyB,SAAS,mBAAmB,EAAE,cAAc,KAAK;AACnF;AAEO,SAAS,iCACd,WACA,OAC0B;AAC1B,SAAO,MAAM;AACf;AAEA,SAAS,wBAAwB,UAAwC;AACvE,MAAI,SAAS,mBAAmB,WAAW,CAAC,SAAS,mBAAmB;AACtE,WAAO,EAAE,MAAM,cAAc,WAAW,kBAAkB;AAAA,EAC5D;AACA,SAAO,EAAE,MAAM,cAAc,WAAW,UAAU;AACpD;AAEA,SAAS,+BAA+B,UAYtC;AACA,QAAM,gBAAgB,IAAI,IAAI,SAAS,4BAA4B,CAAC,CAAC;AACrE,QAAM,cAAc,IAAI,IAAI,SAAS,2BAA2B,CAAC,CAAC;AAClE,SAAO;AAAA,IACL,GAAI,SAAS,YACT;AAAA,MACE,YAAY,CAAC,EAAE,UAAU,WAAW,mBAAmB,UAAU,GAAG,QAAQ,MAC1E,SAAS,SAAS,SAAS;AAAA,IAC/B,IACA,CAAC;AAAA,IACL,SAAS,OAAO,QAAQ,SAAS,kBAAkB,CAAC,CAAC,EAClD,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD;AAAA,MAAI,CAAC,CAAC,MAAM,KAAK,MAChB,cAAc,IAAI,IAAI,IAClB,EAAE,MAAM,gBAAgB,UAAmB,MAAM,IACjD,EAAE,MAAM,gBAAgB,SAAkB;AAAA,IAChD;AAAA,IACF,OAAO,OAAO,QAAQ,SAAS,gBAAgB,CAAC,CAAC,EAC9C,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD;AAAA,MAAI,CAAC,CAAC,MAAM,KAAK,MAChB,YAAY,IAAI,IAAI,IAChB,EAAE,MAAM,gBAAgB,UAAmB,MAAM,IACjD,EAAE,MAAM,gBAAgB,SAAkB;AAAA,IAChD;AAAA,EACJ;AACF;AAEA,SAAS,cAAc,OAAwB;AAC7C,QAAM,YAAY,CAAC,UAA4B;AAC7C,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,aAAO,MAAM,IAAI,CAAC,UAAU,UAAU,KAAK,CAAC;AAAA,IAC9C;AACA,QAAI,SAAS,OAAO,UAAU,UAAU;AACtC,YAAM,MAA+B,CAAC;AACtC,iBAAW,OAAO,OAAO,KAAK,KAAK,EAAE,KAAK,GAAG;AAC3C,cAAM,QAAS,MAAkC,GAAG;AACpD,YAAI,UAAU,QAAW;AACvB,cAAI,GAAG,IAAI,UAAU,KAAK;AAAA,QAC5B;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,UAAU,UAAU,KAAK,CAAC;AACxC;AAEA,SAAS,qBACP,OACA,UACA,UAAoF,CAAC,GAC7E;AACR,QAAM,kBAAkB,+BAA+B,QAAQ;AAC/D,QAAM,qBAAqB,QAAQ,sBAAsB;AAMzD,QAAM,EAAE,uBAAuB,GAAG,iBAAiB,IAAI,MAAM;AAC7D,QAAM,kBAAkB,QAAQ,+BAC5B,EAAE,GAAG,kBAAkB,sBAAsB,IAC7C;AACJ,QAAM,cAAc,cAAc;AAAA,IAChC,eAAe,MAAM;AAAA,IACrB,IAAI,MAAM;AAAA,IACV,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM;AAAA,IAClB,UAAU;AAAA,MACR,aAAa,SAAS;AAAA,MACtB,SAAS,SAAS;AAAA,MAClB,GAAI,qBAAqB,EAAE,aAAa,SAAS,YAAY,IAAI,CAAC;AAAA,MAClE,SAAS,SAAS,WAAW;AAAA,MAC7B,gBAAgB,gBAAgB;AAAA,MAChC,cAAc,gBAAgB;AAAA,MAC9B,GAAI,gBAAgB,YAAY,EAAE,WAAW,gBAAgB,UAAU,IAAI,CAAC;AAAA,IAC9E;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB,SAAS,MAAM;AAAA,IACf;AAAA,IACA,cAAc,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,IAKpB,GAAI,MAAM,gBAAgB,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,IACpE,SAAS,MAAM,WAAW;AAAA,EAC5B,CAAC;AACD,SAAO,UAAU,WAAW,QAAQ,EACjC,OAAO,kCAAkC,MAAM,EAC/C,OAAO,aAAa,MAAM,EAC1B,OAAO,KAAK,CAAC;AAClB;AAQA,SAAS,4CACP,OACA,UACQ;AACR,QAAM,EAAE,mBAAmB,oBAAoB,GAAG,oBAAoB,IAAI;AAC1E,SAAO,qBAAqB,qBAAqB,UAAU;AAAA,IACzD,8BAA8B;AAAA,EAChC,CAAC;AACH;AAEA,SAAS,yCACP,OACA,UACe;AACf,MAAI,SAAS,gBAAgB,SAAU,QAAO;AAC9C,QAAM,EAAE,mBAAmB,oBAAoB,GAAG,oBAAoB,IAAI;AAC1E,SAAO,qBAAqB,qBAAqB,UAAU;AAAA,IACzD,oBAAoB;AAAA,IACpB,8BAA8B;AAAA,EAChC,CAAC;AACH;AAEA,SAAS,oDACP,OACA,UACe;AAIf,MACE,MAAM,OAAO,uBACb,MAAM,oBAAoB,iBAC1B,SAAS,OAAO,qBAChB,SAAS,SAAS,wBAClB,SAAS,QAAQ,eACjB,SAAS,gBAAgB,YACzB,cAAc,MAAM,aAAa,aAAa,MAC5C,cAAc,EAAE,UAAU,aAAa,UAAU,MAAM,MAAM,WAAW,CAAC,GAC3E;AACA,WAAO;AAAA,EACT;AACA,QAAM,EAAE,mBAAmB,oBAAoB,GAAG,oBAAoB,IAAI;AAC1E,QAAM,EAAE,eAAe,gBAAgB,GAAG,aAAa,IAAI,MAAM;AAKjE,SAAO;AAAA,IACL;AAAA,MACE,GAAG;AAAA,MACH,cAAc;AAAA,QACZ,GAAG;AAAA,QACH,cAAc,aAAa,aAAa,OAAO,CAAC,SAAS,KAAK,OAAO,WAAW;AAAA,MAClF;AAAA,IACF;AAAA,IACA;AAAA,IACA,EAAE,8BAA8B,KAAK;AAAA,EACvC;AACF;AAEA,SAAS,2CACP,OACA,UACA,QACS;AACT,QAAM,EAAE,mBAAmB,oBAAoB,GAAG,oBAAoB,IAAI;AAC1E,QAAM,EAAE,cAAc,gBAAgB,IAAI,MAAM;AAOhD,WAAS,cAAc,GAAG,cAAc,KAAK,aAAa,QAAQ,eAAe,GAAG;AAClF,UAAM,gBAAgB,aAAa,OAAO,CAAC,OAAO,UAAU,cAAe,KAAK,KAAM;AACtF,QAAI,CAAC,cAAc,KAAK,CAAC,SAAS,KAAK,OAAO,OAAO,eAAe,KAAK,QAAQ,GAAG;AAClF;AAAA,IACF;AACA,aAAS,YAAY,GAAG,YAAY,KAAK,gBAAgB,QAAQ,aAAa,GAAG;AAC/E,YAAM,iBAAiB,gBAAgB,OAAO,CAAC,WAAW,UAAU,YAAa,KAAK,KAAM;AAC5F,UACE,cAAc,WAAW,aAAa,UACtC,eAAe,WAAW,gBAAgB,QAC1C;AACA;AAAA,MACF;AACA,YAAM,eAAe;AAAA,QACnB,GAAG,MAAM;AAAA,QACT,cAAc;AAAA,QACd,iBAAiB;AAAA,MACnB;AACA,UACE;AAAA,QACE;AAAA,QACA,EAAE,GAAG,qBAAqB,aAAa;AAAA,QACvC;AAAA,MACF,GACA;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAUA,SAAS,mCACP,OACA,UACwB;AACxB,MAAI,CAAC,MAAM,aAAa,iBAAiB,SAAU,QAAO;AAC1D,QAAM,EAAE,mBAAmB,oBAAoB,GAAG,oBAAoB,IAAI;AAC1E,QAAM,aAAa;AAAA,IACjB,GAAG;AAAA,IACH,cAAc;AAAA,MACZ,GAAG,MAAM;AAAA,MACT,kBAAkB,EAAE,UAAU,WAAoB,UAAU,MAAM;AAAA,IACpE;AAAA,EACF;AACA,SAAO,EAAE,GAAG,YAAY,mBAAmB,qBAAqB,YAAY,QAAQ,EAAE;AACxF;AAGA,SAAS,iCACP,OACA,UACA,QACS;AACT,SACE,OAAO,sBAAsB,MAAM,qBACnC,OAAO,sBAAsB,4CAA4C,OAAO,QAAQ,KACxF,OAAO,sBAAsB,yCAAyC,OAAO,QAAQ,KACrF,OAAO,sBACL,oDAAoD,OAAO,QAAQ,KACrE,2CAA2C,OAAO,UAAU,MAAM,KAClE,4CAA4C,OAAO,UAAU,MAAM;AAEvE;AAQA,SAAS,6CACP,QACA,OACA,UACS;AACT,SACE,OAAO,sBAAsB,qBAAqB,OAAO,QAAQ,KACjE,OAAO,sBACL,qBAAqB,OAAO,UAAU,EAAE,8BAA8B,KAAK,CAAC;AAElF;AAGA,SAAS,8BAAiD;AACxD,SAAO,EAAE,UAAU,WAAW,UAAU,MAAM;AAChD;AAEA,SAAS,4CACP,OACA,UACA,QACS;AAST,MAAI,CAAC,MAAM,aAAa,YAAY,UAAU,SAAU,QAAO;AAC/D,QAAM,EAAE,mBAAmB,oBAAoB,GAAG,oBAAoB,IAAI;AAC1E,QAAM,eAAe;AAAA,IACnB,GAAG,MAAM;AAAA,IACT,aAAa,EAAE,GAAG,MAAM,aAAa,aAAa,WAAW,4BAA4B,EAAE;AAAA,EAC7F;AACA,SAAO;AAAA,IACL;AAAA,IACA,EAAE,GAAG,qBAAqB,aAAa;AAAA,IACvC;AAAA,EACF;AACF;AASO,SAAS,8CACd,OACA,UACA,QACiB;AACjB,MACE,OAAO,sBAAsB,MAAM;AAAA;AAAA,EAGnC,MAAM,cAAc,aAAa,WAAW,aAAa,QACzD,CAAC,4CAA4C,OAAO,UAAU,MAAM,GACpE;AACA,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,cAAc;AAAA,MACZ,GAAG,MAAM;AAAA,MACT,aAAa;AAAA,QACX,GAAG,MAAM,aAAa;AAAA,QACtB,WAAW,4BAA4B;AAAA,MACzC;AAAA,IACF;AAAA,IACA,iBAAiB;AAAA,IACjB,mBAAmB,OAAO;AAAA,EAC5B;AACF;AASO,SAAS,kBAAkB,UAAoD;AACpF,SAAO,SAAS,mBAAmB,UAAU,UAAU;AACzD;AAEA,SAAS,qBAAqB,UAAoD;AAChF,SAAO,SAAS,mBAAmB,UAAU,iBAAiB;AAChE;AAUO,SAAS,oBACd,UACA,SAA4B,QAAQ,KACX;AACzB,QAAM,mBAAmB,wBAAwB,QAAQ;AACzD,QAAM,UAAiC;AAAA,IACrC,IAAI,kBAAkB,QAAQ;AAAA,IAC9B,OAAO,qBAAqB,QAAQ;AAAA,IACpC,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa,SAAS,mBAAmB,UAAU,iBAAiB;AAAA,IACpE,SAAS;AAAA,IACT;AAAA,IACA,SAAS,EAAE,eAAe,cAAc,UAAU,mBAAmB;AAAA,EACvE;AACA,MAAI,SAAS,mBAAmB,SAAS;AACvC,UAAM,UAAU,SAAS,sBAAsB,SAAS;AACxD,YAAQ,UAAU,UAAU,yBAAyB,SAAS,QAAQ,EAAE,IAAI;AAC5E,YAAQ,SACN,uBAAuB,SAAS,iBAAiB,KAAK,SAAS;AAAA,EACnE,OAAO;AACL,YAAQ,UAAU,SAAS,gBACvB,yBAAyB,SAAS,eAAe,QAAQ,EAAE,IAC3D;AACJ,YAAQ,SAAS,uBAAuB,SAAS,YAAY;AAAA,EAC/D;AACA,QAAM,WAAW,4BAA4B,QAAQ,EAAE;AAAA,IACrD,CAAC,cAAqC;AAAA,MACpC,IAAI,SAAS;AAAA,MACb,OAAO,SAAS,SAAS,SAAS;AAAA,MAClC,MAAM,SAAS;AAAA,MACf,KAAK,SAAS;AAAA,MACd,WAAW,SAAS;AAAA,MACpB,aAAa,SAAS;AAAA,MACtB,SAAS;AAAA,MACT,SAAS,SAAS;AAAA,MAClB,QAAQ,sBAAsB,UAAU,MAAM;AAAA,MAC9C,cAAc,SAAS;AAAA,MACvB,gBAAgB,SAAS;AAAA,MACzB,yBAAyB,SAAS;AAAA,MAClC,0BAA0B,SAAS;AAAA,MACnC,GAAI,SAAS,wBAAwB,SACjC,EAAE,qBAAqB,SAAS,oBAAoB,IACpD,CAAC;AAAA,MACL,GAAI,SAAS,4BAA4B,SACrC,EAAE,yBAAyB,SAAS,wBAAwB,IAC5D,CAAC;AAAA,MACL,kBAAkB,yBAAyB,QAAQ;AAAA,MACnD,SAAS,gBAAgB,QAAQ;AAAA,IACnC;AAAA,EACF;AACA,SAAO,CAAC,SAAS,GAAG,QAAQ;AAC9B;AASO,SAAS,wBAAwB,UAA8B;AACpE,MAAI,SAAS,4BAA4B,OAAW,QAAO,CAAC,GAAG,0BAA0B;AACzF,SAAOJ,GACJ,MAAM,uBAAuB,EAC7B,MAAM,KAAK,MAAM,SAAS,uBAAuB,CAAC,EAClD,OAAO,CAAC,UAAU,CAAC,MAAM,OAAO,EAChC,IAAI,CAAC,UAAU,MAAM,eAAe;AACzC;AAEO,SAAS,yBAAyB,UAA8B;AACrE,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,MAAI,UAAU,KAAK,CAACI,cAAaA,UAAS,OAAO,iBAAiB,GAAG;AACnE,WAAO;AAAA,EACT;AACA,QAAM,gBACJ,SAAS,4BAA4B,SACjC,SACAJ,GACG,MAAM,uBAAuB,EAC7B,MAAM,KAAK,MAAM,SAAS,uBAAuB,CAAC,EAClD,OAAO,CAAC,UAAU,CAAC,MAAM,OAAO,EAChC,IAAI,CAAC,EAAE,SAAS,UAAU,GAAG,MAAM,MAAM,KAAK;AACvD,MAAI,eAAe,WAAW,EAAG,QAAO;AACxC,QAAM,WAA6B;AAAA,IACjC,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,KAAK;AAAA,IACL,aAAa;AAAA,IACb,SAAS;AAAA,IACT,QACE,iBACA,2BAA2B,IAAI,CAAC,SAAS;AACvC,YAAM,eAAe,iCAAiC,MAAM;AAAA,QAC1D,GAAG,wBAAwB,UAAU;AAAA,UACnC,iBAAiB;AAAA,UACjB,iBAAiB;AAAA,UACjB,QAAQ,yBAAyB,IAAI;AAAA,QACvC,CAAC;AAAA,QACD,GAAI,6BAA6B,GAAG,qBAAqB,GAAG,IAAI,EAAE,IAC9D;AAAA,UACE,eAAe,6BAA6B,GAAG,qBAAqB,GAAG,IAAI,EAAE;AAAA,QAC/E,IACA,CAAC;AAAA,QACL,cAAc,4BAA4B,GAAG,qBAAqB,GAAG,IAAI,EAAE;AAAA,MAC7E,CAAC;AACD,aAAO;AAAA,QACL,IAAI,GAAG,qBAAqB,GAAG,IAAI;AAAA,QACnC,iBAAiB;AAAA,QACjB,OAAO,uBAAuB,IAAI;AAAA,QAClC,GAAI,4BAA4B,IAAI,IAChC,EAAE,YAAY,4BAA4B,IAAI,EAAG,IACjD,CAAC;AAAA,QACL,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA,QAKjB,iBAAiB;AAAA,QACjB;AAAA,QACA,qBAAqB;AAAA,QACrB,8BAA8B;AAAA,QAC9B,uBAAuB;AAAA,QACvB,4BAA4B;AAAA,MAC9B;AAAA,IACF,CAAC;AAAA,EACL;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB,KAAK,UAAU,CAAC,GAAG,WAAW,QAAQ,CAAC;AAAA,EAC7D;AACF;AAOO,SAAS,mCAAmC,UAA8B;AAC/E,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,MAAI,UAAU,KAAK,CAACI,cAAaA,UAAS,OAAO,4BAA4B,GAAG;AAC9E,WAAO;AAAA,EACT;AACA,QAAM,WAA6B;AAAA,IACjC,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,KAAK;AAAA,IACL,aAAa;AAAA,IACb,SAAS;AAAA,IACT,QAAQ,6BAA6B,IAAI,CAAC,SAAS;AACjD,YAAM,eAAe,wBAAwB,UAAU;AAAA,QACrD,iBAAiB;AAAA,QACjB,iBAAiB;AAAA,QACjB,QAAQ;AAAA,MACV,CAAC;AACD,mBAAa,UAAU,UAAU,CAAC,OAAO,UAAU,QAAQ,OAAO;AAClE,mBAAa,UAAU,gBAAgB;AACvC,mBAAa,eAAe;AAAA,QAC1B,EAAE,IAAI,YAAY,UAAU,aAAa,UAAU,KAAK;AAAA,QACxD,EAAE,IAAI,QAAQ,UAAU,aAAa,UAAU,KAAK;AAAA,MACtD;AACA,mBAAa,YAAY,UAAU;AAAA,QACjC,UAAU;AAAA,QACV,UAAU;AAAA,MACZ;AACA,mBAAa,YAAY,kBAAkB;AAAA,QACzC,UAAU;AAAA,QACV,UAAU;AAAA,MACZ;AACA,aAAO;AAAA,QACL,IAAI,GAAG,gCAAgC,GAAG,IAAI;AAAA,QAC9C,iBAAiB;AAAA,QACjB,OAAO,uBAAuB,IAAI;AAAA,QAClC,GAAI,4BAA4B,IAAI,IAChC,EAAE,YAAY,4BAA4B,IAAI,EAAG,IACjD,CAAC;AAAA,QACL,iBAAiB;AAAA,QACjB,iBAAiB;AAAA,QACjB;AAAA,QACA,qBAAqB;AAAA,QACrB,8BAA8B;AAAA,QAC9B,uBAAuB;AAAA,QACvB,4BAA4B,SAAS;AAAA,MACvC;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB,KAAK,UAAU,CAAC,GAAG,WAAW,QAAQ,CAAC;AAAA,EAC7D;AACF;AAeO,SAAS,yBAAyB,UAAoB,SAAyB;AACpF,QAAM,mBAAmB,8BAA8B,UAAU,OAAO;AACxE,MAAI,iBAAiB,WAAW,qBAAqB,GAAG;AACtD,WAAO;AAAA,EACT;AACA,MAAI,iBAAiB,WAAW,gCAAgC,GAAG;AACjE,WAAO;AAAA,EACT;AACA,MAAI,iBAAiB,WAAW,iCAAiC,GAAG;AAClE,WAAO;AAAA,EACT;AACA,MAAI,iBAAiB,WAAW,oCAAoC,GAAG;AACrE,WAAO;AAAA,EACT;AACA,MAAI,iBAAiB,WAAW,+BAA+B,GAAG;AAChE,WAAO;AAAA,EACT;AACA,QAAM,aAAa,iBAAiB,QAAQ,EAAE,KAAK,CAAC,UAAU,MAAM,OAAO,gBAAgB;AAC3F,SAAO,YAAY,cAAc,kBAAkB,QAAQ;AAC7D;AAQA,IAAM,iCAAiC,oBAAI,IAAY;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAaM,SAAS,6BAA6B,UAAoB,SAA0B;AACzF,QAAM,mBAAmB,8BAA8B,UAAU,OAAO;AACxE,QAAM,aAAa,iBAAiB,QAAQ,EAAE,KAAK,CAAC,UAAU,MAAM,OAAO,gBAAgB;AAC3F,MAAI,WAAY,QAAO,WAAW,SAAS;AAC3C,MAAI,iBAAiB,WAAW,qBAAqB,EAAG,QAAO;AAC/D,MAAI,iBAAiB,WAAW,gCAAgC,EAAG,QAAO;AAC1E,QAAM,QAAQ,iBAAiB,QAAQ,GAAG;AAC1C,QAAM,iBAAiB,QAAQ,IAAI,iBAAiB,MAAM,GAAG,KAAK,IAAI;AACtE,MACE,+BAA+B,IAAI,cAAc;AAAA,EAEjD,eAAe,WAAW,mBAAmB,KAC7C,eAAe,WAAW,yBAAyB,GACnD;AACA,WAAO;AAAA,EACT;AACA,UACG,yBAAyB,SAAS,mBAAmB,EAAE,gBAAgB,KAAK,eAC7E;AAEJ;AAEA,SAAS,wBACP,UACA,OAMwB;AACxB,SAAO;AAAA,IACL,qBAAqB,MAAM,uBAAuB,SAAS;AAAA,IAC3D,8BACE,MAAM,gCAAgC,SAAS,gCAAgC;AAAA,IACjF,uBACE,MAAM,yBAAyB,SAAS,qCAAqC;AAAA,IAC/E,4BACE,MAAM,8BAA8B,SAAS,mCAAmC;AAAA,EACpF;AACF;AAEA,SAAS,wBACP,UACA,UACA,OACiB;AACjB,QAAM,gBACJ,SAAS,SAAS,4BAClB,SAAS,SAAS,8BAClB,SAAS,SAAS,gCACd;AAAA,IACE,MAAM;AAAA,IACN,+BAA+B,QAAQ;AAAA,EACzC,IACA;AACN,QAAM,sBAAkE;AAAA,IACtE,eAAe;AAAA,IACf,GAAG;AAAA,IACH,MAAM,uBAAuB,UAAU,MAAM,IAAI,MAAM,gBAAgB;AAAA,IACvE,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA,IACzC,iBAAiB,wBAAwB,UAAU,KAAK;AAAA,EAC1D;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,mBAAmB,qBAAqB,qBAAqB,QAAQ;AAAA,EACvE;AACF;AAEA,SAAS,4BAA4B,QAAiC;AACpE,QAAM,kBAAkB,oBAAI,IAAoB;AAChD,aAAW,SAAS,QAAQ;AAC1B,UAAM,WAAW,gBAAgB,IAAI,MAAM,EAAE;AAC7C,QAAI,aAAa,QAAW;AAC1B,YAAM,IAAI;AAAA,QACR,0CAA0C,KAAK,UAAU,MAAM,EAAE,CAAC,wBAAwB,QAAQ,QAAQ,MAAM,UAAU;AAAA,MAC5H;AAAA,IACF;AACA,oBAAgB,IAAI,MAAM,IAAI,MAAM,UAAU;AAAA,EAChD;AAEA,QAAM,iBAAiB,IAAI,IAAI,eAAe;AAC9C,aAAW,SAAS,QAAQ;AAC1B,UAAM,aAAa,oBAAI,IAAY;AACnC,eAAW,SAAS,MAAM,SAAS;AACjC,UAAI,WAAW,IAAI,KAAK,GAAG;AACzB,cAAM,IAAI;AAAA,UACR,uCAAuC,KAAK,UAAU,MAAM,EAAE,CAAC,6BAA6B,KAAK,UAAU,KAAK,CAAC;AAAA,QACnH;AAAA,MACF;AACA,iBAAW,IAAI,KAAK;AACpB,YAAM,WAAW,eAAe,IAAI,KAAK;AACzC,UAAI,aAAa,QAAW;AAC1B,cAAM,IAAI;AAAA,UACR,uCAAuC,KAAK,UAAU,KAAK,CAAC,cAAc,KAAK,UAAU,MAAM,EAAE,CAAC,iCAAiC,QAAQ;AAAA,QAC7I;AAAA,MACF;AACA,qBAAe,IAAI,OAAO,MAAM,EAAE;AAAA,IACpC;AAAA,EACF;AACF;AAUO,SAAS,iBACd,UACA,SAA4B,QAAQ,KACjB;AACnB,QAAM,YAAY,kBAAkB,QAAQ;AAC5C,QAAM,eAAe,qBAAqB,QAAQ;AAClD,QAAM,YAAY,oBAAoB,UAAU,MAAM;AACtD,QAAM,eAAe,IAAI,IAAI,UAAU,IAAI,CAAC,aAAa,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;AACjF,QAAM,mBAAmB,gCAAgC,QAAQ;AAiBjE,QAAM,iBAAiB,4BAA4B,QAAQ;AAC3D,QAAM,mBAAmB,IAAI;AAAA,IAC3B,eAAe,QAAQ,CAAC,aAAa,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC;AAAA,EAC/E;AACA,QAAM,kBAAkB,IAAI;AAAA,IAC1B,eAAe,QAAQ,CAAC,aAAa,SAAS,OAAO,QAAQ,CAAC,UAAU,MAAM,WAAW,CAAC,CAAC,CAAC;AAAA,EAC9F;AACA,QAAM,uBAAuB,CAAC,OAC5B,GAAG,WAAW,qBAAqB,KACnC,GAAG,WAAW,gCAAgC,KAC9C,gBAAgB,IAAI,EAAE,KACrB,GAAG,SAAS,GAAG,KAAK,iBAAiB,IAAI,EAAE;AAC9C,QAAM,kBAAkB,aAAa,IAAI,SAAS;AAClD,MAAI,CAAC,iBAAiB;AACpB,UAAM,IAAI,MAAM,2BAA2B,SAAS,oBAAoB;AAAA,EAC1E;AACA,QAAM,MAAyB,aAAa;AAAA,IAC1C,SAAS;AAAA,IACT,GAAG,SAAS,SAAS,mBAAmB;AAAA,EAC1C,CAAC,EACE,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,EACxC,IAAI,CAAC,OAAO;AACX,UAAM,eAAe;AAAA,MACnB,GAAG,wBAAwB,UAAU;AAAA,QACnC,iBAAiB;AAAA,QACjB,iBAAiB,SAAS;AAAA,QAC1B,uBAAuB,qCAAqC,UAAU,EAAE;AAAA,QACxE,QAAQ,yBAAyB,EAAE;AAAA,MACrC,CAAC;AAAA,MACD,GAAI,6BAA6B,EAAE,IAC/B,EAAE,eAAe,6BAA6B,EAAE,EAAG,IACnD,CAAC;AAAA,MACL,cAAc,4BAA4B,EAAE;AAAA,IAC9C;AACA,WAAO,wBAAwB,UAAU,iBAAiB;AAAA,MACxD;AAAA,MACA,SAAS,CAAC;AAAA,MACV,OAAO,uBAAuB,EAAE;AAAA,MAChC,GAAI,4BAA4B,EAAE,IAC9B,EAAE,YAAY,4BAA4B,EAAE,EAAG,IAC/C,CAAC;AAAA,MACL,YAAY;AAAA,MACZ,eAAe;AAAA,MACf,KAAK;AAAA,MACL,iBAAiB;AAAA,MACjB,YAAY,EAAE,iBAAiB,IAAI,SAAS,YAAY;AAAA,MACxD,kBAAkB,gBAAgB;AAAA,MAClC,SAAS,gBAAgB;AAAA,MACzB;AAAA,MACA,GAAI,iBAAiB,EAAE,MAAM,SAAY,CAAC,IAAI,EAAE,SAAS,iBAAiB,EAAE,EAAE;AAAA,MAC9E,GAAG,6BAA6B,UAAU,EAAE;AAAA,MAC5C,4BAA4B,SAAS;AAAA,MACrC,iBAAiB,aAAa,UAAU;AAAA,MACxC,iBAAiB,aAAa,YAAY,UAAU;AAAA,IACtD,CAAC;AAAA,EACH,CAAC;AACH,aAAW,YAAY,gBAAgB;AACrC,UAAM,gBAAgB,SAAS,SAAS,SAAS;AACjD,UAAM,mBAAmB,aAAa,IAAI,SAAS,EAAE;AACrD,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,MAAM,2BAA2B,SAAS,EAAE,oBAAoB;AAAA,IAC5E;AACA,eAAW,SAAS,SAAS,QAAQ;AACnC,YAAM,eAAe,MAAM,eACvB,sBAAsB,MAAM,YAAY,IACxC,wBAAwB,UAAU;AAAA,QAChC,iBAAiB,MAAM,mBAAmB;AAAA,QAC1C,iBAAiB,MAAM,mBAAmB;AAAA,MAC5C,CAAC;AACL,YAAM,kBAAkB,MAAM,mBAAmB,MAAM;AACvD,UAAI;AAAA,QACF,wBAAwB,UAAU,kBAAkB;AAAA,UAClD,IAAI,MAAM;AAAA,UACV,SAAS,CAAC,GAAI,MAAM,WAAW,CAAC,CAAE;AAAA,UAClC,OAAO,MAAM,SAAS,uBAAuB,MAAM,EAAE;AAAA,UACrD,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,UAClD,GAAI,MAAM,aACN,EAAE,YAAY,MAAM,WAAW,IAC/B,4BAA4B,MAAM,EAAE,IAClC,EAAE,YAAY,4BAA4B,MAAM,EAAE,EAAG,IACrD,CAAC;AAAA,UACP,YAAY,SAAS;AAAA,UACrB;AAAA,UACA,KAAK,SAAS;AAAA,UACd;AAAA,UACA,YAAY,EAAE,iBAAiB,SAAS,SAAS,IAAI;AAAA,UACrD,kBAAkB,iBAAiB;AAAA,UACnC,SAAS,iBAAiB;AAAA,UAC1B;AAAA,UACA,GAAI,iBAAiB,MAAM,EAAE,MAAM,SAC/B,CAAC,IACD,EAAE,SAAS,iBAAiB,MAAM,EAAE,EAAE;AAAA,UAC1C,GAAI,MAAM,wBAAwB,SAC9B,CAAC,IACD,EAAE,qBAAqB,MAAM,oBAAoB;AAAA,UACrD,GAAI,MAAM,iCAAiC,SACvC,CAAC,IACD;AAAA,YACE,8BAA8B,MAAM;AAAA,UACtC;AAAA,UACJ,GAAI,MAAM,0BAA0B,SAChC,CAAC,IACD,EAAE,uBAAuB,MAAM,sBAAsB;AAAA,UACzD,GAAI,MAAM,+BAA+B,SACrC,CAAC,IACD,EAAE,4BAA4B,MAAM,2BAA2B;AAAA,UACnE,iBAAiB,aAAa,UAAU;AAAA,UACxC,iBAAiB,aAAa,YAAY,UAAU;AAAA,QACtD,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,8BAA4B,GAAG;AAC/B,QAAM,eAAe,IAAI;AAAA,IACvB,CAAC,UAAU,MAAM,OAAO,SAAS,eAAe,MAAM,QAAQ,SAAS,SAAS,WAAW;AAAA,EAC7F;AACA,SAAO,eAAe,IAClB,CAAC,IAAI,YAAY,GAAI,GAAG,IAAI,MAAM,GAAG,YAAY,GAAG,GAAG,IAAI,MAAM,eAAe,CAAC,CAAC,IAClF;AACN;AAGO,SAAS,8BAA8B,UAAoB,SAAyB;AACzF,QAAM,SAAS,iBAAiB,QAAQ;AACxC,QAAM,YAAY,OAAO,KAAK,CAAC,UAAU,MAAM,OAAO,OAAO;AAC7D,MAAI,WAAW;AACb,WAAO,UAAU;AAAA,EACnB;AACA,SAAO,OAAO,KAAK,CAAC,UAAU,MAAM,QAAQ,SAAS,OAAO,CAAC,GAAG,MAAM;AACxE;AASO,SAAS,wBAAwB,UAA8B;AACpE,SAAO,iBAAiB,QAAQ,EAC7B,OAAO,CAAC,UAAU,gCAAgC,UAAU,MAAM,EAAE,CAAC,EACrE,IAAI,CAAC,UAAU,MAAM,EAAE;AAC5B;AAGO,SAAS,gCAAgC,UAAoB,SAA0B;AAC5F,MAAI,CAAC,QAAQ,WAAW,qBAAqB,KAAK,SAAS,4BAA4B;AACrF,WAAO;AACT,QAAM,SAASJ,GACZ,MAAM,uBAAuB,EAC7B,MAAM,KAAK,MAAM,SAAS,uBAAuB,CAAC;AACrD,SAAO,OAAO,KAAK,CAAC,UAAU,MAAM,OAAO,WAAW,CAAC,MAAM,OAAO;AACtE;AAGO,SAAS,oCACd,UACA,QACA,UAKU;AACV,QAAM,SAAS,sBAAsB,MAAM,MAAM;AACjD,MAAI,CAAC,OAAO,eAAe,WAAW,qBAAqB,EAAG,QAAO;AACrE,MAAI,CAAC,SAAS,yBAA0B,OAAM,IAAI,MAAM,gCAAgC;AACxF,QAAM,SACJ,SAAS,4BAA4B,SACjC,CAAC,IACDA,GAAE,MAAM,uBAAuB,EAAE,MAAM,KAAK,MAAM,SAAS,uBAAuB,CAAC;AACzF,QAAM,WAAW,OAAO,KAAK,CAACK,WAAUA,OAAM,OAAO,OAAO,kBAAkBA,OAAM,OAAO;AAC3F,MAAI,CAAC,UAAU;AACb,6CAAyC,UAAU,QAAQ,QAAQ;AACnE,WAAO;AAAA,EACT;AACA,QAAM,EAAE,SAAS,UAAU,GAAG,MAAM,IAAI;AAGxC,QAAM,eAAe;AAAA,IACnB,GAAG;AAAA,IACH,oBAAoB,KAAK;AAAA,MACvB,wBAAwB,SAAS,kBAAkB,EAAE;AAAA,QACnD,CAAC,aAAa,SAAS,OAAO;AAAA,MAChC;AAAA,IACF;AAAA,EACF;AACA,QAAM,mBAAmB,yBAAyB;AAAA,IAChD,GAAG;AAAA,IACH,yBAAyB,KAAK,UAAU,CAAC,KAAK,CAAC;AAAA,EACjD,CAAC;AACD,QAAM,mBAAmB,wBAAwB,iBAAiB,kBAAkB,EAAE;AAAA,IACpF,CAAC,aAAa,SAAS,OAAO;AAAA,EAChC;AACA,QAAM,YAAY,wBAAwB,SAAS,kBAAkB;AACrE,QAAM,UAAU,UAAU,KAAK,CAAC,aAAa,SAAS,OAAO,iBAAiB;AAC9E,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH,oBAAoB,KAAK,UAAU;AAAA,MACjC,GAAG,UAAU,OAAO,CAAC,aAAa,SAAS,OAAO,iBAAiB;AAAA,MACnE;AAAA,QACE,GAAG;AAAA,QACH,QAAQ;AAAA,UACN,IAAI,SAAS,UAAU,CAAC,GAAG,OAAO,CAAC,cAAc,UAAU,OAAO,MAAM,EAAE;AAAA,UAC1E;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACA,2CAAyC,UAAU,QAAQ,QAAQ;AACnE,SAAO;AACT;AAQO,SAAS,qBACd,UACA,SACyE;AACzE,QAAM,mBAAmB,8BAA8B,UAAU,OAAO;AACxE,QAAM,QAAQ,iBAAiB,QAAQ,EAAE,KAAK,CAAC,cAAc,UAAU,OAAO,gBAAgB;AAC9F,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,QAAM,WAAW,oBAAoB,QAAQ,EAAE;AAAA,IAC7C,CAAC,cAAc,UAAU,OAAO,MAAM;AAAA,EACxC;AACA,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AACA,SAAO,EAAE,UAAU,MAAM;AAC3B;AAcA,SAAS,+BAA+B,UAAoB,SAA2B;AACrF,MAAI,SAAS,4BAA4B,QAAQ,WAAW,qBAAqB,GAAG;AAClF,WAAO,yBAAyB,QAAQ;AAAA,EAC1C;AACA,MACE,SAAS,gCACT,QAAQ,WAAW,gCAAgC,GACnD;AACA,WAAO,mCAAmC,QAAQ;AAAA,EACpD;AACA,MAAI,QAAQ,WAAW,iCAAiC,GAAG;AAKzD,QAAI,qBAAqB,UAAU,OAAO,GAAG;AAC3C,aAAO;AAAA,IACT;AACA,WAAO,oCAAoC,QAAQ;AAAA,EACrD;AACA,MAAI,QAAQ,WAAW,oCAAoC,GAAG;AAC5D,QAAI,qBAAqB,UAAU,OAAO,GAAG;AAC3C,aAAO;AAAA,IACT;AACA,WAAO,uCAAuC,QAAQ;AAAA,EACxD;AACA,MAAI,QAAQ,WAAW,oCAAoC,GAAG;AAC5D,WAAO,qBAAqB,UAAU,OAAO,IACzC,WACA,uCAAuC,QAAQ;AAAA,EACrD;AACA,MAAI,QAAQ,WAAW,uCAAuC,GAAG;AAC/D,WAAO,qBAAqB,UAAU,OAAO,IACzC,WACA,0CAA0C,QAAQ;AAAA,EACxD;AACA,MAAI,QAAQ,WAAW,+BAA+B,GAAG;AACvD,WAAO,qBAAqB,UAAU,OAAO,IACzC,WACA,kCAAkC,QAAQ;AAAA,EAChD;AACA,MAAI,QAAQ,WAAW,kCAAkC,GAAG;AAC1D,WAAO,qBAAqB,UAAU,OAAO,IACzC,WACA,qCAAqC,QAAQ;AAAA,EACnD;AAIA,SAAO;AACT;AAOO,SAAS,4BACd,UACA,SACyC;AACzC,QAAM,kBAAkB,+BAA+B,UAAU,OAAO;AACxE,SAAO;AAAA,IACL;AAAA,IACA,8BAA8B,iBAAiB,OAAO;AAAA,EACxD;AACF;AAOO,IAAM,2CAAN,cAAuD,MAAM;AAAA,EAClE,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,SAAS,6BACd,UACA,OACuB;AACvB,QAAM,kBAAkB,+BAA+B,UAAU,MAAM,OAAO;AAC9E,QAAM,iBAAiB,8BAA8B,iBAAiB,MAAM,OAAO;AACnF,MAAI,CAAC,gCAAgC,iBAAiB,cAAc,GAAG;AACrE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,qBAAqB,iBAAiB,cAAc;AACrE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,MAAM,qBAAqB,QAC3B,8BAA8B,iBAAiB,MAAM,gBAAgB,MAAM,gBAC3E;AACA,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,cAAc,YAAY,MAAM,MAAM,eAAe,UAAU;AACrE,QAAM,oBAAoB,MAAM,qBAAqB;AACrD,4BAA0B,iBAAiB,gBAAgB,WAAW;AACtE,SAAO,sBAAsB,MAAM;AAAA,IACjC,eAAe;AAAA,IACf;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB,aAAa,MAAM;AAAA,IACnB,iBAAiB,MAAM;AAAA,IACvB,iBAAiB,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,IACA,YAAY,SAAS,SAAS;AAAA,IAC9B,iBAAiB,SAAS,MAAM;AAAA,IAChC,SAAS,SAAS,MAAM;AAAA,IACxB,kBAAkB,SAAS,MAAM;AAAA,IACjC,SAAS,SAAS,MAAM;AAAA,IACxB,mBAAmB,SAAS,MAAM;AAAA,EACpC,CAAC;AACH;AAGO,IAAM,6CAAN,cAAyD,MAAM;AAAA,EAC3D,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,sEAAsE;AAC5E,SAAK,OAAO;AAAA,EACd;AACF;AAOO,SAAS,uCACd,UACA,UACA,gBAC6D;AAC7D,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,yCAAyC;AAC3D,MAAI,sBAAsB,MAAM,cAAc,EAAE,0BAA0B,QAAW;AACnF,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AACA,QAAM,EAAE,OAAO,IAAI,oBAAoB,MAAM,QAAQ;AAGrD,SAAO,yCAAyC,UAAU,QAAQ;AAAA,IAChE,SAAS,OAAO;AAAA,IAChB,iBAAiB,OAAO;AAAA,IACxB,aAAa,OAAO;AAAA,EACtB,CAAC;AACH;AAKO,SAAS,yCACd,UACA,QACA,UASA;AACA,QAAM,SAAS,sBAAsB,MAAM,MAAM;AACjD,QAAM,kBAAkB,+BAA+B,UAAU,OAAO,cAAc;AACtF,QAAM,yBAAyB,8BAA8B,iBAAiB,SAAS,OAAO;AAC9F,QAAM,sBAAsB,SAAS,eAAe,OAAO;AAC3D,MACE,OAAO,mBAAmB,0BAC1B,OAAO,oBAAoB,SAAS,mBACpC,OAAO,gBAAgB,qBACvB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,4BAA0B,iBAAiB,OAAO,gBAAgB,OAAO,WAAW;AACpF,MACE,OAAO,qBAAqB,QAC5B,8BAA8B,iBAAiB,OAAO,gBAAgB,MACpE,OAAO,gBACT;AACA,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,QAAM,WAAW,qBAAqB,iBAAiB,OAAO,cAAc;AAC5E,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AAIA,QAAM,oBACJ,SAAS,SAAS,SAAS,kCACvB,cACA,SAAS,SAAS,SAAS,qCACzB,iBACA;AACR,QAAM,gCACJ,sBAAsB,QACtB,OAAO,eAAe,SAAS,SAAS,MACxC,OAAO,oBAAoB,SAAS,MAAM,mBAC1C,OAAO,YAAY,SAAS,MAAM,OAClC,cAAc,OAAO,gBAAgB,MACnC,cAAc;AAAA,IACZ,MAAM,GAAG,iBAAiB;AAAA,IAC1B,WAAW;AAAA,EACb,CAAC,KACH,cAAc,OAAO,OAAO,MAC1B,cAAc;AAAA,IACZ,eAAe;AAAA,IACf,UAAU;AAAA,EACZ,CAAC,KACH,OAAO,sBACL;AAAA,IACE;AAAA,MACE,GAAG,SAAS;AAAA,MACZ,kBAAkB,OAAO;AAAA,MACzB,SAAS,OAAO;AAAA,IAClB;AAAA,IACA,SAAS;AAAA,IACT,EAAE,8BAA8B,KAAK;AAAA,EACvC;AAOJ,QAAM,6BAA6B;AAAA,IACjC,SAAS;AAAA,IACT,SAAS;AAAA,EACX;AACA,QAAM,2BACJ,iCAAiC,SAAS,OAAO,SAAS,UAAU,MAAM,KACzE,+BAA+B,QAC9B,iCAAiC,4BAA4B,SAAS,UAAU,MAAM;AAC1F,QAAM,qBACJ,OAAO,eAAe,SAAS,SAAS,MACxC,OAAO,oBAAoB,SAAS,MAAM,mBAC1C,OAAO,YAAY,SAAS,MAAM,OAClC,cAAc,OAAO,gBAAgB,MAAM,cAAc,SAAS,MAAM,gBAAgB,KACxF,cAAc,OAAO,OAAO,MAAM,cAAc,SAAS,MAAM,OAAO;AAGxE,MAAI,sBAAsB,CAAC,+BAA+B;AACxD,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,MAAI,CAAC,4BAA4B,CAAC,+BAA+B;AAC/D,UAAM,IAAI,2CAA2C;AAAA,EACvD;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,UAAU,SAAS;AAAA,IACnB,OAAO,8CAA8C,SAAS,OAAO,SAAS,UAAU,MAAM;AAAA,EAChG;AACF;AAQO,SAAS,gCACd,UACwC;AACxC,QAAM,WAAW,OAAO;AAAA,IACtB,OAAO,QAAQ,mBAAmB,EAAE,IAAI,CAAC,CAAC,OAAO,OAAO,MAAM;AAAA,MAC5D;AAAA,MACA,8BAA8B,OAAO;AAAA,IACvC,CAAC;AAAA,EACH;AACA,QAAM,WAAmD,CAAC;AAC1D,aAAW,YAAY,4BAA4B,QAAQ,GAAG;AAC5D,eAAW,SAAS,SAAS,QAAQ;AACnC,UAAI,MAAM,SAAS;AACjB,iBAAS,MAAM,EAAE,IAAI,8BAA8B,MAAM,OAAO;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,OAAO;AAAA,IACxB,OAAO,QAAQ,sBAAsB,SAAS,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,OAAO,MAAM;AAAA,MACzF;AAAA,MACA,8BAA8B,OAAO;AAAA,IACvC,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AACF;AAQO,SAAS,oCACd,UACwC;AACxC,QAAM,SAAS,gCAAgC,QAAQ;AACvD,QAAM,aAAa,OAAO;AAAA,IACxB,OAAO,QAAQ,sBAAsB,SAAS,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,OAAO,MAAM;AAAA,MACzF;AAAA,MACA,8BAA8B,OAAO;AAAA,IACvC,CAAC;AAAA,EACH;AAGA,MACE,SAAS,mBAAmB,YAC5B,yBAAyB,SAAS,iBAAiB,2BAA2B,GAC9E;AACA,eAAW,SAAS,iBAAiB,QAAQ,GAAG;AAC9C,UACE,MAAM,eAAe,kBAAkB,QAAQ,KAC/C,CAAC,MAAM,gBAAgB,WAAW,MAAM,KACxC,OAAO,MAAM,EAAE,MAAM;AAErB;AACF,YAAM,WAAW,yBAAyB,MAAM,eAAe;AAC/D,UAAI,SAAU,QAAO,MAAM,EAAE,IAAI;AAAA,IACnC;AAAA,EACF;AACA,aAAW,YAAY,4BAA4B,QAAQ,GAAG;AAC5D,eAAW,SAAS,SAAS,QAAQ;AACnC,UAAI,OAAO,MAAM,EAAE,MAAM,OAAW;AACpC,YAAM,WAAW,6BAA6B,UAAU,UAAU,OAAO,UAAU;AACnF,UAAI,SAAU,QAAO,MAAM,EAAE,IAAI;AAAA,IACnC;AAAA,EACF;AACA,SAAO;AACT;AASA,SAAS,6BACP,UACA,UACA,OACA,YACoC;AACpC,QAAM,WAAW,MAAM,mBAAmB,MAAM;AAChD,MAAI;AACJ,MAAI,eAAe;AACnB,UAAQ,SAAS,MAAM;AAAA,IACrB,KAAK;AACH,UACE,SAAS,QAAQ,QAAQ,QAAQ,EAAE,MAAM,uBACzC,aAAa,4BAA4B,MAAM,2BAA2B,MAAM,GAChF;AACA,kBAAU;AAAA,MACZ;AACA;AAAA,IACF,KAAK;AACH,UAAI,SAAS,WAAW,MAAM,EAAG,WAAU;AAC3C;AAAA,IACF,KAAK;AACH,UAAI,SAAS,WAAW,OAAO,EAAG,WAAU;AAC5C;AAAA,IACF,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,UAAI,yBAAyB,QAAQ,GAAG;AACtC,kBAAU;AACV,uBAAe;AAAA,MACjB;AACA;AAAA,IACF,KAAK;AAAA,IACL,KAAK;AACH,UAAI,yBAAyB,SAAS,OAAO,KAAK,SAAS,WAAW,MAAM,GAAG;AAC7E,kBAAU;AAAA,MACZ;AACA;AAAA,IACF,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAIH,gBAAU,+BAA+B,QAAQ,EAAE;AAAA,QACjD,CAAC,cACC,UAAU,oBAAoB,YAC9B,OAAO,OAAO,uBAAuB,EAAE;AAAA,UACrC,CAAC,aAAa,SAAS,oBAAoB,UAAU;AAAA,QACvD;AAAA,MACJ,GAAG;AACH;AAAA,IACF,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,UAAI,aAAa,4BAA4B,MAAM,2BAA2B,MAAM,GAAG;AACrF,kBAAU;AAAA,MACZ;AACA;AAAA,IACF,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,sBAAsB;AAGzB,UAAI,CAAC,gCAAgC,QAAQ,EAAE,SAAS,QAAQ,EAAG,QAAO;AAC1E,aAAO,0BAA0B,QAAQ;AAAA,IAC3C;AAAA,IACA,KAAK;AAGH,UAAI,yBAAyB,SAAS,OAAO,KAAK,SAAS,WAAW,MAAM,GAAG;AAC7E,kBAAU;AAAA,MACZ,WAAW,SAAS,QAAQ,QAAQ,QAAQ,EAAE,MAAM,uBAAuB;AACzE,YAAI,SAAS,WAAW,OAAO,EAAG,WAAU;AAAA,MAC9C,WACE,SAAS,QAAQ,wBACjB,SAAS,QAAQ,QAAQ,QAAQ,EAAE,MAAM,kCACzC,yBAAyB,QAAQ,GACjC;AACA,kBAAU;AACV,uBAAe;AAAA,MACjB;AACA;AAAA,IACF;AACE,aAAO;AAAA,EACX;AACA,MAAI,CAAC,QAAS,QAAO;AAGrB,MAAI,WAAW,OAAO,EAAG,QAAO,WAAW,OAAO;AAClD,QAAM,WACJ,yBAAyB,OAAO,KAChC,oBAAoB,OAAO,MAC1B,YAAY,8BAA8B,oCAAoC;AACjF,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,CAAC,gBAAgB,SAAS,WAAW,aAAa,KAAM,QAAO;AAEnE,QAAM,iBAAiB,CAAC,WAAyB;AAAA,IAC/C,GAAG;AAAA,IACH,kCAAkC,MAAM,8BAA8B;AAAA,EACxE;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,eAAe,SAAS,OAAO;AAAA,IACxC,GAAI,SAAS,kBACT;AAAA,MACE,iBAAiB,SAAS,gBAAgB,IAAI,CAAC,UAAU;AAAA,QACvD,GAAG;AAAA,QACH,SAAS,eAAe,KAAK,OAAO;AAAA,MACtC,EAAE;AAAA,IACJ,IACA,CAAC;AAAA,EACP;AACF;AAGO,SAAS,uBAAuB,UAAkD;AACvF,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,gCAAgC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,QAAQ,MAAM;AAAA,MACnF;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAGO,SAAS,mBACd,UACA,aACc;AACd,QAAM,wBAAwB,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,CAAC;AACjE,MAAI,WAAW,SAAS;AACxB,aAAW,QAAQ,SAAS,mBAAmB,CAAC,GAAG;AACjD,QAAI,wBAAwB,KAAK,oBAAoB;AACnD;AAAA,IACF;AACA,eAAW,KAAK;AAAA,EAClB;AACA,SAAO;AACT;AAMO,SAAS,yBACd,UAIQ;AACR,MAAI,SAAS,iCAAiC,QAAW;AACvD,WAAO,KAAK,IAAI,SAAS,qBAAqB,SAAS,4BAA4B;AAAA,EACrF;AACA,SAAO,KAAK,IAAI,GAAG,SAAS,sBAAsB,SAAS,2BAA2B;AACxF;AAOO,SAAS,iCACd,UACA,OAOA,mBACA,sBACU;AACV,QAAM,sBAAsB,MAAM,uBAAuB,SAAS;AAClE,QAAM,WAAW;AAAA,IACf,GAAG;AAAA,IACH;AAAA,IACA,GAAI,MAAM,iCAAiC,SACvC,CAAC,IACD;AAAA,MACE,8BAA8B,KAAK;AAAA,QACjC;AAAA,QACA,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACJ,GAAI,MAAM,0BAA0B,SAChC,CAAC,IACD,EAAE,mCAAmC,MAAM,sBAAsB;AAAA,IACrE,GAAI,MAAM,+BAA+B,SACrC,CAAC,IACD,EAAE,iCAAiC,MAAM,2BAA2B;AAAA,EAC1E;AACA,MAAI,sBAAsB,UAAa,CAAC,MAAM,GAAI,QAAO;AACzD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,mCAAmC;AAAA,MACjC;AAAA,MACA,EAAE,GAAG,OAAO,IAAI,MAAM,GAAG;AAAA,MACzB;AAAA,MACA;AAAA,IACF,EAAE;AAAA,EACJ;AACF;AAOO,SAAS,+BACd,UACA,OAIA,mBACA,sBACuB;AACvB,QAAM,WAAW,iCAAiC,UAAU,KAAK;AACjE,QAAM,gBAAgB,KAAK;AAAA,IACzB;AAAA,IACA,KAAK,MAAM,KAAK,IAAI,SAAS,sBAAsB,KAAK,yBAAyB,QAAQ,CAAC,CAAC;AAAA,EAC7F;AACA,QAAM,gBAAgB,KAAK,IAAI,MAAQ,aAAa;AAGpD,QAAM,QAAQ,CAAC,UAAkB,KAAK,IAAI,GAAG,KAAK,IAAI,eAAe,KAAK,MAAM,KAAK,CAAC,CAAC;AACvF,QAAM,gBAAgB;AAAA,IACpB,SAAS,qCACP,SAAS,sBACP,KAAK,IAAI,KAAK,KAAK,IAAI,KAAK,SAAS,+BAA+B,CAAC;AAAA,EAC3E;AACA,QAAM,iBAAiB,kCAAkC,mBAAmB,MAAM,EAAE;AACpF,QAAM,qBAAqB,qCAAqC,sBAAsB,MAAM,EAAE;AAC9F,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,MAAM,kBAAkB,sBAAsB,aAAa;AAAA,IAC5E;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,4BAA4B,UAA6C;AACvF,SAAO,2BAA2B,SAAS,qBAAqB;AAClE;AAEO,SAAS,uBAAuB,UAAwC;AAC7E,MAAI,SAAS,qBAAqB,QAAQ;AACxC,WAAO,CAAC;AAAA,EACV;AACA,QAAM,aAAa,4BAA4B,SAAS,sBAAsB;AAC9E,MAAI,SAAS,qBAAqB,UAAU;AAC1C,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,+BAA+B;AAAA,IAC/B,mCAAmC,SAAS,gBAAgB;AAAA,IAC5D,oBAAoB;AAAA,IACpB,sBAAsB;AAAA,IACtB,sBAAsB,QAAQ,SAAS,eAAe,SAAS,mBAAmB;AAAA,IAClF,GAAG;AAAA,EACL;AACF;AAEO,SAAS,8BACd,UACA,OACA,OACA,SACQ;AACR,SAAO,iCAAiC,UAAU,OAAO,OAAO,OAAO,EAAE;AAC3E;AAEO,SAAS,iCACd,UACA,OACA,OACA,SACyB;AACzB,QAAM,WAAW,gCAAgC,QAAQ,EAAE,KAAK;AAChE,SAAO,4BAA4B,UAAU,OAAO,OAAO,UAAU,OAAO;AAC9E;AAGO,SAAS,qCACd,UACA,OACA,OACA,SACyB;AACzB,QAAM,WAAW,oCAAoC,QAAQ,EAAE,KAAK;AACpE,SAAO,4BAA4B,UAAU,OAAO,OAAO,UAAU,OAAO;AAC9E;AASO,SAAS,oCACd,UACA,OACA,OACA,SAC4B;AAC5B,QAAM,WAAW,oCAAoC,QAAQ,EAAE,KAAK;AACpE,QAAM,WAAW,4BAA4B,UAAU,OAAO,OAAO,UAAU,OAAO;AACtF,QAAM,UAAU,EAAE,GAAG,UAAU,mBAAmB,MAAM,mBAAmB,MAAM;AACjF,MAAI,CAAC,YAAY,CAAC,SAAS,kBAAmB,QAAO;AACrD,QAAM,UAAU,MAAM,qBAAqB,SAAS,MAAM,sBAAsB,CAAC,KAAK;AACtF,QAAM,UAAsC;AAAA,IAC1C,eAAe;AAAA,IACf,WAAW;AAAA,IACX,YAAY;AAAA,IACZ,QAAQ;AAAA,EACV;AACA,QAAM,mBAAmB,oBAAI,IAA0B;AACvD,QAAM,SAAS,6BAA6B,UAAU,KAAK;AAC3D,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,kBAAkB,MAAM,WAAW,KAAK,CAAC,kBAAkB,MAAM,YAAY;AAChF,aAAO;AACT,UAAM,SAAS,wBAAwB,OAAO;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,SAAS,wBAAwB,OAAO,CAAC,sBAAsB,kBAAkB,GAAG,IAAI;AAC9F,QAAI,WAAW,UAAa,WAAW,UAAa,SAAS,SAAS,MAAM;AAC1E,aAAO;AACT,UAAM,UAAU,mBAAmB,UAAU,MAAM,WAAW;AAC9D,QAAI,SAAS,KAAK,QAAQ,sCAAsC,OAAW,QAAO;AAClF,QAAI,SAAS,KAAK,QAAQ,qCAAqC,OAAW,QAAO;AACjF,UAAM,QAAoC;AAAA,MACxC,eAAe,KAAK;AAAA,SAChB,MAAM,cAAc,SAAS,UAAU,QAAQ,8BAA+B;AAAA,MAClF;AAAA,MACA,WAAW,KAAK,KAAM,UAAU,QAAQ,qCAAqC,KAAM,GAAS;AAAA,MAC5F,YAAY,KAAK,KAAM,UAAU,QAAQ,oCAAoC,KAAM,GAAS;AAAA,MAC5F,QAAQ,KAAK,KAAM,MAAM,eAAe,QAAQ,+BAAgC,GAAS;AAAA,IAC3F;AACA,QAAI,UAAU,SAAS,GAAG;AACxB,YAAM,aAAa,wBAAwB,OAAO,CAAC,uBAAuB,CAAC;AAC3E,YAAM,UAAU,wBAAwB,OAAO,CAAC,uBAAuB,CAAC;AACxE,UAAI,eAAe,UAAa,YAAY,UAAa,aAAa,YAAY;AAChF,eAAO;AACT,UAAI,OAAO,gBAAgB;AACzB,cAAM,aACJ,KAAK,KAAM,aAAa,OAAO,eAAe,aAAc,GAAS,IACrE,KAAK,KAAM,UAAU,OAAO,eAAe,UAAW,GAAS;AAAA,MACnE,WACE,EACG,OAAO,gBAAgB,QAAQ,YAAY,KAC3C,OAAO,gBAAgB,QAAQ,eAAe,IAEjD;AAEA,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,MAAM,mBAAmB,KAAK;AACpC,qBAAiB,IAAI,UAAU,iBAAiB,IAAI,OAAO,KAAK,KAAK,GAAG;AACxE,eAAW,OAAO,2BAA4B,SAAQ,GAAG,KAAK,MAAM,GAAG;AAAA,EACzE;AACA,MAAI,qBAAqB,mBAAmB,OAAO;AACnD,MAAI,mBAAmB;AACvB,aAAW,CAAC,SAAS,GAAG,KAAK,kBAAkB;AAC7C,UAAM,YAAY,yBAAyB,UAAU,QAAQ,SAAS;AACtE,wBAAoB,KAAK,KAAM,OAAO,MAAS,aAAc,GAAM;AAAA,EACrE;AACA,MAAI,oBAAoB;AACxB,QAAM,cAAc,QAAQ,eAAe;AAC3C,MAAI,gBAAgB,YAAY;AAC9B,UAAM,kBAAkB,+BAA+B,UAAU,KAAK;AACtE,UAAM,WAAW;AAAA,MACf;AAAA,MACA,8BAA8B,iBAAiB,KAAK;AAAA,IACtD;AACA,UAAM,aAAa,UAAU,MAAM,aAAa,aAAa;AAAA,MAC3D,CAAC,SAAS,KAAK,OAAO,eAAe,KAAK;AAAA,IAC5C,GAAG;AACH,QAAI,eAAe,UAAa,cAAc,EAAG,QAAO;AACxD,yBAAqB,KAAK,KAAM,qBAAqB,aAAc,GAAM;AACzE,uBAAmB,KAAK,KAAM,mBAAmB,aAAc,GAAM;AACrE,UAAM,SAAS,+BAA+B,SAAS,YAAY,kBAAkB;AACrF,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,OAAO,SAAS,OAAO,OAAO;AACrC,wBAAoB,OAAO;AAAA,EAC7B;AACA,MAAI,CAAC,CAAC,oBAAoB,kBAAkB,GAAG,OAAO,OAAO,OAAO,CAAC,EAAE,MAAM,iBAAiB;AAC5F,WAAO;AACT,SAAO,EAAE,oBAAoB,kBAAkB,mBAAmB,SAAS,kBAAkB;AAC/F;AASO,SAAS,qCACd,UACA,OACA,OACA,4BACiC;AACjC,QAAM,UAA2C;AAAA,IAC/C,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,EACrB;AACA,MAAI,CAAC,kBAAkB,0BAA0B,EAAG,QAAO;AAC3D,QAAM,WAAW,oCAAoC,QAAQ,EAAE,KAAK;AACpE,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,UAAU,EAAE,eAAe,IAAI,WAAW,IAAI,YAAY,IAAI,QAAQ,GAAG;AAC/E,QAAM,UAAU,MAAM,qBAAqB,SAAS,MAAM,sBAAsB,CAAC,KAAK;AACtF,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,kBAAkB,MAAM,WAAW,KAAK,CAAC,kBAAkB,MAAM,YAAY;AAChF,aAAO;AACT,UAAM,SAAS,wBAAwB,OAAO;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,SAAS,wBAAwB,OAAO,CAAC,sBAAsB,kBAAkB,GAAG,IAAI;AAC9F,QAAI,WAAW,UAAa,WAAW,UAAa,SAAS,SAAS,MAAM;AAC1E,aAAO;AACT,UAAM,UAAU,mBAAmB,UAAU,MAAM,WAAW;AAC9D,UAAM,WAAW;AAAA,MACf,eAAe,MAAM,cAAc,SAAS;AAAA,MAC5C,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,QAAQ,MAAM;AAAA,IAChB;AACA,UAAM,QAAQ;AAAA,MACZ,eAAe,QAAQ;AAAA,MACvB,WAAW,QAAQ;AAAA,MACnB,YAAY,QAAQ;AAAA,MACpB,QAAQ,QAAQ;AAAA,IAClB;AACA,eAAW,OAAO,4BAA4B;AAC5C,UAAI,SAAS,GAAG,MAAM,EAAG;AACzB,YAAM,OAAO,MAAM,GAAG;AACtB,UAAI,CAAC,kBAAkB,IAAI,EAAG,QAAO;AAErC,cAAQ,GAAG,KAAK,OAAO,SAAS,GAAG,CAAC,IAAI,OAAO,IAAI;AAAA,IACrD;AAAA,EACF;AACA,QAAM,UAAU,gCAAgC,SAAS,0BAA0B;AACnF,SAAO,UAAU,EAAE,mBAAmB,SAAS,mBAAmB,KAAK,IAAI;AAC7E;AAEA,IAAM,6BAA6B,CAAC,iBAAiB,aAAa,cAAc,QAAQ;AAExF,SAAS,mBAAmB,OAA2C;AACrE,SAAO,2BAA2B,OAAO,CAAC,OAAO,QAAQ,QAAQ,MAAM,GAAG,GAAG,CAAC;AAChF;AAGA,SAAS,gCACP,SACA,QACwC;AACxC,QAAM,cAAc,2BAA2B,OAAO,CAAC,OAAO,QAAQ,QAAQ,QAAQ,GAAG,GAAG,EAAE;AAC9F,MAAI,gBAAgB,IAAI;AACtB,WAAO,WAAW,IAAI,EAAE,eAAe,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,EAAE,IAAI;AAAA,EACvF;AACA,QAAM,OAAO,2BAA2B,IAAI,CAAC,KAAK,UAAU;AAC1D,UAAM,YAAY,OAAO,MAAM,IAAI,QAAQ,GAAG;AAC9C,WAAO,EAAE,KAAK,OAAO,OAAO,YAAY,aAAa,WAAW,YAAY,YAAY;AAAA,EAC1F,CAAC;AACD,QAAM,YAAY,OAAO,MAAM,IAAI,KAAK,OAAO,CAAC,OAAO,QAAQ,QAAQ,IAAI,OAAO,EAAE;AACpF,QAAM,SAAS,CAAC,GAAG,IAAI,EAAE;AAAA,IAAK,CAAC,GAAG,MAChC,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,KAAK;AAAA,EACrF;AACA,WAAS,QAAQ,GAAG,QAAQ,OAAO,SAAS,GAAG,QAAS,QAAO,KAAK,EAAG,SAAS;AAChF,SAAO,OAAO;AAAA,IACZ,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC;AAAA,EAChD;AACF;AAEA,SAAS,kBAAkB,OAAiC;AAC1D,SAAO,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS;AAC9E;AAEA,SAAS,wBACP,OACA,MACA,YAAY,OACQ;AACpB,QAAM,UAAU,MAAM,QAAQ,MAAM,kBAAkB,IAClD,MAAM,qBACN,MAAM,qBACJ,CAAC,MAAM,kBAAkB,IACzB,CAAC;AACP,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,MAAI,QAAQ;AACZ,aAAW,UAAU,SAAS;AAC5B,UAAM,UAAU,KAAK,OAAO,CAAC,QAAQ,OAAO,GAAG,MAAM,MAAS;AAC9D,QAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,eAAW,OAAO,YAAY,QAAQ,MAAM,GAAG,CAAC,IAAI,SAAS;AAC3D,UAAI,CAAC,kBAAkB,OAAO,GAAG,CAAC,EAAG,QAAO;AAC5C,eAAS,OAAO,GAAG;AAAA,IACrB;AAAA,EACF;AACA,SAAO,kBAAkB,KAAK,IAAI,QAAQ;AAC5C;AAEA,SAAS,6BACP,UACA,SAMY;AACZ,aAAW,YAAY,4BAA4B,QAAQ,GAAG;AAC5D,UAAM,QAAQ,SAAS,OAAO,KAAK,CAAC,cAAc,UAAU,OAAO,OAAO;AAC1E,QAAI,CAAC,SAAS,SAAS,QAAQ,qBAAsB;AACrD,UAAM,SAAS,EAAE,aAAa,SAAS,WAAW,SAAS;AAC3D,UAAM,WAAW,MAAM,mBAAmB,MAAM;AAChD,UAAM,YAAY,sBAAsB,SAAS,gBAAgB;AACjE,UAAM,WACJ,SAAS,SAAS,yBAClB,SAAS,SAAS,4BAClB,SAAS,SAAS,mCAClB,SAAS,SAAS,sCACjB,SAAS,SAAS,aACjB,SAAS,QAAQ,QAAQ,QAAQ,EAAE,MAAM;AAC7C,UAAM,YAAY,yBAAyB,QAAQ,GAAG;AACtD,QACE,CAAC,YACD,CAAC,yBAAyB,QAAQ,KAClC,CAAC,WAAW,oCACZ,MAAM,WACN,UAAU,OAAO,MAAM,UACvB,UAAU,QAAQ,MAAM;AAExB,aAAO;AACT,WAAO;AAAA,MACL,GAAG;AAAA,MACH,gBAAgB;AAAA,QACd,YAAY,UAAU;AAAA,QACtB,SAAS,UAAU,8BAA8B;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,+BACP,SACA,YACA,QAC2E;AAC3E,MACE,CAAC,kBAAkB,UAAU,KAC7B,CAAC,kBAAkB,MAAM,KACzB,CAAC,OAAO,OAAO,OAAO,EAAE,MAAM,iBAAiB;AAE/C,WAAO;AACT,QAAM,OAAO,2BAA2B,IAAI,CAAC,KAAK,UAAU;AAC1D,UAAM,YAAY,OAAO,QAAQ,GAAG,CAAC,IAAI,OAAO,UAAU;AAC1D,WAAO,EAAE,KAAK,OAAO,OAAO,OAAO,YAAY,MAAO,GAAG,WAAW,YAAY,OAAQ;AAAA,EAC1F,CAAC;AACD,QAAM,YAAY,SAAS,KAAK,OAAO,CAAC,OAAO,QAAQ,QAAQ,IAAI,OAAO,CAAC;AAC3E,MAAI,YAAY,KAAK,YAAY,KAAK,OAAQ,QAAO;AACrD,QAAM,SAAS,CAAC,GAAG,IAAI,EAAE;AAAA,IAAK,CAAC,GAAG,MAChC,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,KAAK;AAAA,EACrF;AACA,WAAS,QAAQ,GAAG,QAAQ,WAAW,QAAS,QAAO,KAAK,EAAG,SAAS;AACxE,SAAO;AAAA,IACL,SAAS,OAAO;AAAA,MACd,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC;AAAA,IACxC;AAAA,IACA,aAAa,KAAK,KAAK,CAAC,QAAQ,IAAI,cAAc,EAAE;AAAA,EACtD;AACF;AAEA,SAAS,4BACP,UACA,OACA,OACA,UACA,SACyB;AACzB,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,6BAA6B,KAAK,EAAE;AAAA,EACtD;AACA,QAAM,UACJ,MAAM,uBAAuB,MAAM,oBAAoB,SAAS,IAC5D,MAAM,sBACN,CAAC,KAAK;AACZ,QAAM,mBAAmB,oBAAI,IAA0B;AACvD,aAAW,SAAS,SAAS;AAC3B,UAAM,UAAU,mBAAmB,UAAU,YAAY,MAAM,WAAW,CAAC;AAC3E,qBAAiB;AAAA,MACf;AAAA,OACC,iBAAiB,IAAI,OAAO,KAAK,KAAK,yBAAyB,SAAS,KAAK;AAAA,IAChF;AAAA,EACF;AACA,MAAI,qBAAqB;AACzB,MAAI,mBAAmB;AACvB,aAAW,CAAC,SAAS,OAAO,KAAK,kBAAkB;AACjD,UAAM,YAAY,yBAAyB,UAAU,QAAQ,SAAS;AACtE,0BAAsB;AACtB,wBAAoB,KAAK,KAAM,WAAW,MAAS,aAAc,GAAM;AAAA,EACzE;AACA,QAAM,cAAc,SAAS,eAAe;AAC5C,MAAI,gBAAgB,YAAY;AAC9B,UAAM,kBAAkB,+BAA+B,UAAU,KAAK;AACtE,UAAM,WAAW;AAAA,MACf;AAAA,MACA,8BAA8B,iBAAiB,KAAK;AAAA,IACtD;AACA,UAAM,gBAAgB,UAAU,MAAM,aAAa,aAAa;AAAA,MAC9D,CAAC,SAAS,KAAK,OAAO,eAAe,KAAK;AAAA,IAC5C,GAAG;AACH,QAAI,iBAAiB,gBAAgB,GAAG;AACtC,2BAAqB,KAAK,KAAM,qBAAqB,gBAAiB,GAAM;AAC5E,yBAAmB,KAAK,KAAM,mBAAmB,gBAAiB,GAAM;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,EAAE,oBAAoB,iBAAiB;AAChD;AAOO,SAAS,mCACd,UACA,OACA,kBACA,SACQ;AACR,SAAO,sCAAsC,UAAU,OAAO,kBAAkB,OAAO,EACpF;AACL;AAQA,SAAS,gCAAgC,kBAAsD;AAC7F,QAAM,QAAQ,kCAAkC,KAAK,gBAAgB;AACrE,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AACA,QAAM,WAAW,MAAM,CAAC,KAAK;AAC7B,QAAM,gBAAgB,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,QAAQ,EAAE;AACrD,QAAM,eAAe,OAAO,OAAO,SAAS,MAAM;AAClD,QAAM,oBAAoB,gBAAgB;AAC1C,QAAM,sBAAsB,oBAAoB,eAAe,MAAM;AACrE,MAAI,qBAAqB,OAAO,OAAO,gBAAgB,GAAG;AACxD,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,oBAAoB,OAAO,kBAAkB;AAAA,EAC/C;AACF;AAGO,SAAS,2CAA2C,kBAAkC;AAC3F,SAAO,gCAAgC,gBAAgB,EAAE;AAC3D;AAEO,SAAS,sCACd,UACA,OACA,kBACA,SACyB;AACzB,QAAM,WAAW,gCAAgC,QAAQ,EAAE,KAAK;AAChE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,6BAA6B,KAAK,EAAE;AAAA,EACtD;AACA,QAAM,UAAU,mBAAmB,UAAU,YAAY,SAAS,WAAW,CAAC;AAC9E,QAAM,EAAE,mBAAmB,cAAc,mBAAmB,IAC1D,gCAAgC,gBAAgB;AAClD,QAAM,YAAY,OAAO,MAAS,yBAAyB,UAAU,QAAQ,SAAS,CAAC;AACvF,QAAM,YAAY,oBAAoB;AACtC,QAAM,cAAc,eAAe;AACnC,QAAM,gBAAgB,YAAY,cAAc,MAAM;AACtD,MAAI,eAAe,OAAO,OAAO,gBAAgB,GAAG;AAClD,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO;AAAA,IACL;AAAA,IACA,kBAAkB,OAAO,YAAY;AAAA,EACvC;AACF;AAOO,SAAS,yCACd,UACA,OAKQ;AACR,MAAI,MAAM,YAAY,uBAAuB;AAC3C,UAAM,IAAI,MAAM,+CAA+C,MAAM,OAAO,EAAE;AAAA,EAChF;AACA,MAAI,CAAC,OAAO,cAAc,MAAM,eAAe,KAAK,MAAM,kBAAkB,GAAG;AAC7E,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,OACJ,MAAM,eAAe,SACjB,SAAS,2CACT,SAAS;AACf,QAAM,OAAO,OAAO,MAAM;AAC1B,MAAI,CAAC,OAAO,cAAc,IAAI,KAAK,QAAQ,KAAK,OAAO,KAAe;AACpE,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO;AACT;AAEO,SAAS,kCACd,UACwC;AACxC,SAAO,aAAa;AAAA,IAClB,SAAS;AAAA,IACT,GAAG,SAAS,SAAS,6BAA6B;AAAA,EACpD,CAAC,EAAE,IAAI,CAAC,UAAU,gBAAgB,MAAM,KAAK,CAAC;AAChD;AAOO,SAAS,+BAA+B,UAAuC;AACpF,MAAI,CAAC,SAAS,2BAA2B;AACvC,WAAO;AAAA,EACT;AACA,QAAM,UAAU,OAAO,KAAK,SAAS,2BAA2B,QAAQ;AACxE,MAAI,QAAQ,WAAW,IAAI;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,IAAI,WAAW,OAAO;AAC/B;AAQO,SAAS,0BAA0B,UAA+C;AACvF,QAAM,SAAS,SAAS,gBAAgB,KAAK,KAAK;AAClD,QAAM,qBAAqB,SAAS,uBAAuB,KAAK,KAAK;AACrE,QAAM,SAAS;AAAA,IACb,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,oBAAoB;AAAA,IACxB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,mBAAmB;AAAA,IACvB,SAAS;AAAA,IACT;AAAA,EACF;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ,gBAAgB,GAAG;AAC5D,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,MAAmC,CAAC;AAC1C,MAAI,oBAAoB;AACtB,QAAI,qBAAqB;AAAA,EAC3B;AACA,MAAI,QAAQ;AACV,QAAI,0BAA0B;AAAA,EAChC;AACA,MAAI,qBAAqB,kBAAkB;AACzC,QAAI,iBAAiB,EAAE,KAAK,mBAAmB,KAAK,iBAAiB;AAAA,EACvE;AACA,QAAM,eAAe,OAAO,KAAK,GAAG,EAAE,SAAS;AAC/C,QAAM,aAAa,SAAS,sBAAsB,QAAQ,MAAM,KAAK;AAErE,SAAO;AAAA,IACL,SAAS,SAAS;AAAA,IAClB,GAAI,aAAa,EAAE,KAAK,eAAe,MAAM,KAAK,IAAI,CAAC;AAAA,IACvD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,EAC7B;AACF;AAEA,SAAS,0BACP,OACA,aACwB;AAIxB,QAAM,UAAU,OAAO,QAAQ,OAAO,EAAE;AACxC,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,MAAI,CAAC,yBAAyB,KAAK,OAAO,KAAK,QAAQ,SAAS,MAAM,GAAG;AACvE,UAAM,IAAI,MAAM,GAAG,WAAW,4BAA4B;AAAA,EAC5D;AACA,QAAM,UAAU,OAAO,KAAK,SAAS,QAAQ;AAC7C,QAAM,YAAY,QAAQ,SAAS,QAAQ,EAAE,QAAQ,OAAO,EAAE;AAC9D,MAAI,QAAQ,WAAW,KAAK,cAAc,QAAQ,QAAQ,OAAO,EAAE,GAAG;AACpE,UAAM,IAAI,MAAM,GAAG,WAAW,4BAA4B;AAAA,EAC5D;AACA,SAAO,IAAI,WAAW,OAAO;AAC/B;AAYO,SAAS,aAAa,UAA0D;AACrF,QAAM,SAAS,SAAS,UAAU,KAAK;AACvC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AACA,MAAI,CAAC,2BAA2B,KAAK,MAAM,GAAG;AAC5C,UAAM,IAAI,MAAM,0DAA0D,MAAM,EAAE;AAAA,EACpF;AACA,SAAO,GAAG,MAAM;AAClB;AAEO,SAAS,8BAA8B,UAA4C;AACxF,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ;AAAA,MACb,iBAAiB,SAAS;AAAA,MAC1B,kBAAkB,SAAS;AAAA,MAC3B,oBAAoB,SAAS,oBAAoB,SAAS;AAAA,MAC1D,qBAAqB,SAAS,qBAAqB,SAAS;AAAA,IAC9D,CAAC,EAAE;AAAA,MACD,CAAC,UACC,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS;AAAA,IAC7D;AAAA,EACF;AACF;AAEA,IAAM,uBAAuB;AAG7B,IAAM,qCAAqC,oBAAI,IAAI;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAUM,SAAS,wCACd,UAC2B;AAC3B,QAAM,aAAa,IAAI,IAAI,gCAAgC,QAAQ,CAAC;AACpE,SAAO,CAAC,SACN,mCAAmC,IAAI,IAAI,KAC3C,KAAK,WAAW,WAAW,KAC3B,WAAW,IAAI,IAAI;AACvB;AAEA,SAAS,iBAAiB,WAA+B,OAAuB;AAC9E,QAAM,SAAS,aAAa,sBAAsB,MAAM,GAAG,EAAE,OAAO,OAAO;AAC3E,SAAO,CAAC,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,SAAS,KAAK,CAAC,EAAE,KAAK,GAAG;AACpE;AAiCO,SAAS,+BACd,UACA,UAAoC,CAAC,GACb;AACxB,QAAM,cAAsC;AAAA,IAC1C,GAAG,0BAA0B,QAAQ;AAAA,IACrC,GAAG,8BAA8B,QAAQ;AAAA,EAC3C;AAKA,QAAM,aAAa,uBAAuB,SAAS,cAAc;AACjE,MACE,SAAS,mBAAmB,UAC5B,SAAS,mBAAmB,WAC5B,SAAS,mBAAmB,cAC5B;AACA,gBAAY,SAAS,WAAW;AAAA,EAClC;AAOA,QAAM,8BACJ,SAAS,mBAAmB,UAC5B,SAAS,mBAAmB,WAC5B,SAAS,mBAAmB;AAC9B,MAAI,6BAA6B;AAC/B,UAAM,OAAO,YAAY,QAAQ,WAAW;AAC5C,gBAAY,iCAAiC,GAAG,IAAI;AACpD,gBAAY,4BAA4B,GAAG,IAAI;AAC/C,gBAAY,iCAAiC,GAAG,IAAI;AACpD,gBAAY,OAAO,iBAAiB,YAAY,MAAM,YAAY,4BAA4B;AAAA,EAChG;AACA,MAAI,SAAS,mBAAmB,gBAAgB,kCAAkC,QAAQ,GAAG;AAC3F,gBAAY,iCAAiC,GAAG,YAAY,QAAQ,WAAW,aAAa;AAC5F,QAAI,SAAS,mBAAmB;AAC9B,kBAAY,iCAAiC,SAAS;AAAA,IACxD;AACA,QAAI,QAAQ,aAAa;AACvB,kBAAY,0BAA0B,qBAAqB,UAAU,QAAQ,WAAW;AAAA,IAC1F;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,6BACd,WAQS;AACT,QAAM,WAAW,CAAC,UACf,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,KAAK,QAAQ,KAChE,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,KAAK,OAAO,KAAK,IAAI;AACvE,SAAO,UAAU;AAAA,IACf,CAAC,aACC,SAAS,SAAS,iBAChB,SAAS,SAAS,oBAAoB,KAAK,SAAS,SAAS,kBAAkB,KAC9E,SAAS,aAAa,YACrB,SAAS,SAAS,cAAc,KAChC,SAAS,SAAS,YAAY;AAAA,EACtC;AACF;AAEO,SAAS,oCACd,WAMS;AACT,SAAO,UAAU;AAAA,IACf,CAAC,aACC,SAAS,SAAS,iBACjB,SAAS,aAAa,YACrB,SAAS,aAAa,YACtB,SAAS,aAAa,kBACtB,6BAA6B,CAAC,QAAQ,CAAC;AAAA,EAC7C;AACF;AAmBO,SAAS,+BACd,aACA,UACwB;AACxB,cAAY,cAAc,GAAG,YAAY,QAAQ,YAAY;AAC7D,cAAY,sBAAsB;AAClC,MAAI,UAAU;AACZ,gBAAY,kBAAkB,YAAY,mBAAmB,SAAS;AACtE,gBAAY,mBAAmB,YAAY,oBAAoB,SAAS;AACxE,gBAAY,qBAAqB,YAAY,sBAAsB,SAAS;AAC5E,gBAAY,sBAAsB,YAAY,uBAAuB,SAAS;AAAA,EAChF;AACA,SAAO;AACT;AAgBO,SAAS,oBACd,UACgE;AAChE,SAAO;AAAA,IACL,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,IACzB,YAAY,SAAS;AAAA,EACvB;AACF;AAEA,eAAsB,uBACpB,OACA,WACA,UAA+B,CAAC,GACpB;AACZ,QAAM,WAAW,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,YAAY,EAAE,CAAC;AAC/D,QAAM,iBAAiB,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,kBAAkB,GAAI,CAAC;AAC7E,QAAM,aAAa,KAAK,IAAI,gBAAgB,KAAK,MAAM,QAAQ,cAAc,GAAI,CAAC;AAClF,WAAS,UAAU,GAAG,WAAW,UAAU,WAAW,GAAG;AACvD,QAAI;AACF,aAAO,MAAM,UAAU;AAAA,IACzB,SAAS,OAAO;AACd,UAAI,WAAW,YAAY,QAAQ,cAAc,KAAK,MAAM,OAAO;AACjE,cAAM;AAAA,MACR;AACA,YAAM,UAAU,KAAK,IAAI,YAAY,iBAAiB,MAAM,UAAU,EAAE;AACxE,cAAQ,UAAU,EAAE,OAAO,SAAS,UAAU,SAAS,MAAM,CAAC;AAC9D,YAAM,MAAM,OAAO;AAAA,IACrB;AAAA,EACF;AACA,QAAM,IAAI,MAAM,uCAAuC,KAAK,EAAE;AAChE;AAEO,SAAS,gCAAgC,UAA8B;AAC5E,QAAM,WAAW,+BAA+B,QAAQ;AACxD,QAAM,QAAkB,CAAC;AACzB,aAAW,WAAW,UAAU;AAC9B,UAAM,KAAK,GAAG,2BAA2B,OAAO,EAAG,GAAG;AAAA,EACxD;AACA,QAAM,KAAK,GAAG,SAAS,SAAS,mBAAmB,CAAC;AACpD,SAAO,eAAe,OAAO,aAAa;AAC5C;AAEO,SAAS,wBAAwB,UAA8B;AACpE,QAAM,MAAgB,CAAC;AACvB,aAAW,WAAW,+BAA+B,QAAQ,GAAG;AAC9D,QAAI,KAAK,GAAG,2BAA2B,OAAO,EAAG,KAAK;AAAA,EACxD;AACA,SAAO,aAAa,GAAG;AACzB;AAEA,SAAS,+BAA+B,UAA8B;AACpE,QAAM,WAAW,SAAS,SAAS,0BAA0B,EAAE;AAAA,IAAI,CAAC,UAClE,MAAM,YAAY;AAAA,EACpB;AACA,MAAI,SAAS,SAAS,MAAM,GAAG;AAC7B,QAAI,SAAS,SAAS,GAAG;AACvB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,CAAC,MAAM;AAAA,EAChB;AACA,aAAW,WAAW,UAAU;AAC9B,QAAI,CAAC,2BAA2B,OAAO,GAAG;AACxC,YAAM,IAAI,MAAM,uCAAuC,OAAO,EAAE;AAAA,IAClE;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,kBAAkB,KAAuB;AACvD,SAAO,SAAS,GAAG,EAAE,IAAI,CAAC,UAAU;AAClC,UAAM,OAAO,OAAO,KAAK;AACzB,QAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,OAAO;AACvD,YAAM,IAAI,MAAM,6DAA6D;AAAA,IAC/E;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAEO,SAAS,gBAAgB,KAAgD;AAC9E,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC1B,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,8CAA8C,OAAO,IAAI;AAAA,MACvE,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEO,SAAS,sBACd,KACuD;AACvD,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,mDAAmD,OAAO,IAAI,EAAE,OAAO,MAAM,CAAC;AAAA,EAChG;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,MAAM,uEAAuE;AAAA,EACzF;AACA,QAAM,MAA6D,CAAC;AACpE,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,QAAI,CAAC,MAAM,KAAK,GAAG;AACjB,YAAM,IAAI,MAAM,0DAA0D;AAAA,IAC5E;AACA,QAAI,KAAK,IAAIL,GAAE,MAAM,CAAC,oBAAoB,0BAA0B,CAAC,EAAE,MAAM,KAAK;AAAA,EACpF;AACA,SAAO;AACT;AAMO,SAAS,yBAAyB,KAAqC;AAC5E,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI;AAAA,MACR,yEAAyE,OAAO;AAAA,MAChF,EAAE,OAAO,MAAM;AAAA,IACjB;AAAA,EACF;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,SAAS,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACrD,QAAI,CAAC,QAAQ,KAAK,GAAG;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,OAAO,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK;AAC7D,QAAI,CAAC,OAAO,SAAS,IAAI,KAAK,OAAO,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,8DAA8D,OAAO;AAAA,MACvE;AAAA,IACF;AACA,QAAI,OAAO,IAAI;AAAA,EACjB;AACA,SAAO;AACT;AAIO,SAAS,+BAA+B,UAAoB,SAAyB;AAC1F,QAAM,QAAQ,yBAAyB,SAAS,kCAAkC;AAClF,SAAO,MAAM,OAAO,KAAK;AAC3B;AAOO,SAAS,wBAAwB,KAAiC;AACvE,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,qDAAqD,OAAO,IAAI;AAAA,MAC9E,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC1B,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,SAAO,OAAO,IAAI,CAAC,OAAO,UAAU;AAClC,UAAM,SAAS,uBAAuB,UAAU,KAAK;AACrD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR,0CAA0C,KAAK,iBAAiB,OAAO,MAAM,OAAO;AAAA,MACtF;AAAA,IACF;AACA,QAAI;AACF,aAAO,0BAA0B,OAAO,IAAI;AAAA,IAC9C,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,YAAM,IAAI,MAAM,0CAA0C,KAAK,iBAAiB,OAAO,IAAI;AAAA,QACzF,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,SAAS,kCACd,KAC8C;AAC9C,MAAI,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACvC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,gEAAgE,OAAO,IAAI;AAAA,MACzF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAoD,CAAC;AAC3D,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,CAAC,IAAI,KAAK,GAAG;AACf,YAAM,IAAI,MAAM,uEAAuE;AAAA,IACzF;AACA,UAAM,SAAS,mCAAmC,UAAU,KAAK;AACjE,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR,uDAAuD,GAAG,gBAAgB,OAAO,MAAM,OAAO;AAAA,MAChG;AAAA,IACF;AACA,QAAI,GAAG,IAAI,OAAO;AAAA,EACpB;AACA,SAAO;AACT;AAQO,SAAS,4BACd,YACA,YACqC;AACrC,QAAM,YAAY,CAAC,UAAkB,MAAM,QAAQ,QAAQ,EAAE;AAC7D,aAAW,OAAO,IAAI,IAAI,WAAW,QAAQ,CAAC,cAAc,CAAC,WAAW,UAAU,SAAS,CAAC,CAAC,CAAC,GAAG;AAC/F,UAAM,QAAQ,WAAW,GAAG;AAC5B,QAAI,MAAO,QAAO;AAAA,EACpB;AACA,QAAM,uBAAuB,IAAI,IAAI,WAAW,IAAI,SAAS,CAAC;AAC9D,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,QAAI,qBAAqB,IAAI,UAAU,GAAG,CAAC,EAAG,QAAO;AAAA,EACvD;AACA,SAAO;AACT;AAEO,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAC3C,CAAC;AAGD,IAAM,4BAA4B,CAAC,KAAK,QAAQ;AAEzC,SAAS,4BACd,KACsF;AACtF,MAAI,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACvC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,0DAA0D,OAAO,IAAI;AAAA,MACnF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,MACJ,CAAC;AACH,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,CAAC,0BAA0B,SAAS,GAAiD,GAAG;AAC1F,YAAM,IAAI;AAAA,QACR,+CAA+C,GAAG,gCAAgC,0BAA0B,KAAK,IAAI,CAAC;AAAA,MACxH;AAAA,IACF;AACA,UAAM,SAAS,8BAA8B,UAAU,KAAK;AAC5D,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR,iDAAiD,GAAG,gBAAgB,OAAO,MAAM,OAAO;AAAA,MAC1F;AAAA,IACF;AACA,QAAI,GAAiD,IAAI,OAAO;AAAA,EAClE;AACA,SAAO;AACT;AAEO,SAAS,2BAA2B,KAAsC;AAC/E,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,yDAAyD,OAAO,IAAI;AAAA,MAClF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,kBAAkB,MAAM,MAAM;AACvC;AAEO,SAAS,4BAA4B,KAAiC;AAC3E,MAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,MAAM;AACtC,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,yDAAyD,OAAO,IAAI;AAAA,MAClF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,aAAa,MAAM,MAAM;AAClC;AAEA,SAAS,yBAAyB,SAAuB,OAAgC;AACvF,QAAM,cAAc,YAAY,MAAM,WAAW;AACjD,QAAM,eAAe,YAAY,MAAM,YAAY;AACnD,QAAM,eAAe,KAAK,IAAI,aAAa,kBAAkB,KAAK,CAAC;AACnE,QAAM,mBAAmB,KAAK;AAAA,IAC5B,KAAK,IAAI,GAAG,cAAc,YAAY;AAAA,IACtC,sBAAsB,KAAK;AAAA,EAC7B;AACA,QAAM,sBAAsB,KAAK,IAAI,GAAG,cAAc,eAAe,gBAAgB;AACrF,QAAM,kBACJ,QAAQ,qCAAqC,QAAQ;AACvD,QAAM,iBACJ,QAAQ,oCAAoC,QAAQ;AACtD,SACE,KAAK,KAAM,sBAAsB,QAAQ,8BAA+B,GAAS,IACjF,KAAK,KAAM,eAAe,kBAAmB,GAAS,IACtD,KAAK,KAAM,mBAAmB,iBAAkB,GAAS,IACzD,KAAK,KAAM,eAAe,QAAQ,+BAAgC,GAAS;AAE/E;AAEA,SAAS,kBAAkB,OAAgC;AACzD,QAAM,UAAU,MAAM,QAAQ,MAAM,kBAAkB,IAClD,MAAM,qBACN,MAAM,qBACJ,CAAC,MAAM,kBAAkB,IACzB,CAAC;AACP,MAAI,QAAQ;AACZ,aAAW,UAAU,SAAS;AAC5B,aACE,YAAY,OAAO,aAAa,IAChC,YAAY,OAAO,iBAAiB,IACpC,YAAY,OAAO,mBAAmB;AAAA,EAC1C;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAgC;AAC7D,QAAM,UAAU,MAAM,QAAQ,MAAM,kBAAkB,IAClD,MAAM,qBACN,MAAM,qBACJ,CAAC,MAAM,kBAAkB,IACzB,CAAC;AACP,MAAI,QAAQ;AACZ,aAAW,UAAU,SAAS;AAC5B,aAAS,YAAY,OAAO,sBAAsB,OAAO,gBAAgB;AAAA,EAC3E;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAwB;AAC3C,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,QAAQ,IAAI,KAAK,MAAM,KAAK,IAAI;AAChG;AAOO,IAAM,mCAAmC;AAEhD,SAAS,wBAAwB,UAA4C;AAC3E,QAAM,WAAW,SAAS,WAAW,OAAO,CAAC,WAAW,OAAO,OAAO,UAAU;AAChF,QAAM,mBAAmB,uBAAuB,QAAQ;AACxD,QAAM,wBAAwB,4BAA4B,gBAAgB;AAC1E,QAAM,uBAAuB,gCAAgC,gBAAgB;AAC7E,QAAM,WAAW,SAAS,KAAK,CAAC,WAAW,OAAO,OAAO,OAAO;AAChE,QAAM,UAAU,SAAS,KAAK,CAAC,WAAW,OAAO,OAAO,MAAM;AAC9D,SAAO;AAAA,IACL;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAYL,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,IACA,GAAI,WACA,CAAC,IACD;AAAA,MACE;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,KAAK;AAAA,QACL,cAAc,CAAC,wBAAwB;AAAA,QACvC,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,IACJ,GAAI,UACA,CAAC,IACD;AAAA,MACE;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,KAAK;AAAA,QACL,cAAc,CAAC,oBAAoB,iBAAiB,kBAAkB;AAAA,QACtE,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,IACJ,GAAG;AAAA,EACL;AACF;AAgBO,SAAS,qBAAqB,UAA4B;AAC/D,SACE,SAAS,kBACT,oBAAoB,SAAS,OAAO;AAExC;AAOO,SAAS,6BAA6B,UAA4B;AACvE,SACE,SAAS,0BACT,oBAAoB,SAAS,OAAO;AAExC;AAEA,SAAS,uBAAuB,KAAa,aAA6B;AACxE,MAAI,IAAI,SAAS,eAAe,GAAG;AACjC,WAAO,IAAI,WAAW,iBAAiB,WAAW;AAAA,EACpD;AACA,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,MAAI,WAAW,kBAAkB,WAAW;AAC5C,MAAI,SAAS;AACb,MAAI,OAAO;AACX,SAAO,IAAI,SAAS;AACtB;AAEO,SAAS,0BAA0B,UAAoB,aAA6B;AACzF,SAAO,uBAAuB,qBAAqB,QAAQ,GAAG,WAAW;AAC3E;AAEO,SAAS,kCAAkC,UAAoB,aAA6B;AACjG,SAAO,uBAAuB,6BAA6B,QAAQ,GAAG,WAAW;AACnF;AAEO,SAAS,qBAAqB,UAAoB,aAA6B;AACpF,MAAI,SAAS,gBAAgB;AAC3B,UAAMM,OAAM,IAAI,IAAI,0BAA0B,UAAU,WAAW,CAAC;AACpE,QAAI,CAACA,KAAI,SAAS,SAAS,MAAM,GAAG;AAClC,YAAM,IAAI,MAAM,kEAAkE;AAAA,IACpF;AACA,IAAAA,KAAI,WAAW,GAAGA,KAAI,SAAS,MAAM,GAAG,EAAE,CAAC;AAC3C,WAAOA,KAAI,SAAS;AAAA,EACtB;AAOA,QAAM,kBACJ,SAAS,mBAAmB,WACxB,+BAA+B,SAAS,OAAO,KAC/C,SAAS,mBAAmB,UAC1B,oBAAoB,SAAS,OAAO,KACnC,SAAS,iBAAiB,oBAAoB,SAAS,OAAO;AACvE,QAAM,MAAM,IAAI,IAAI,eAAe;AACnC,MAAI,WAAW,GAAG,IAAI,SAAS,QAAQ,SAAS,EAAE,CAAC,kBAAkB,WAAW;AAChF,MAAI,SAAS;AACb,MAAI,OAAO;AACX,SAAO,IAAI,SAAS;AACtB;AAEA,SAAS,uBAAuB,UAA4B;AAC1D,SAAO,qBAAqB,QAAQ;AACtC;AAEA,SAAS,gCAAgC,QAAwB;AAC/D,SAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC;AACtC;AAEA,SAAS,4BAA4B,QAAwB;AAC3D,SAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC;AACtC;AAEA,IAAM,iCAAiC;AAEvC,SAAS,gCAAgC,UAA6B;AACpE,MAAI,SAAS,aAAc,QAAO;AAClC,SACE,OAAO,SAAS,kBAAkB,YAClC,+BAA+B,KAAK,SAAS,aAAa;AAE9D;AAaO,SAAS,wBAAwB,KAAiC;AACvE,QAAM,UAA8B,CAAC;AACrC,aAAW,SAAS,IAAI,MAAM,GAAG,GAAG;AAClC,UAAM,QAAQ,MAAM,KAAK;AACzB,QAAI,CAAC,MAAO;AACZ,UAAM,QAAQ,MAAM,QAAQ,GAAG;AAC/B,UAAM,UAAU,QAAQ,IAAI,QAAQ,MAAM,MAAM,GAAG,KAAK;AACxD,UAAM,UAAU,KAAK,OAAO;AAC5B,UAAM,SAAS,YAAY,IAAI,SAAS,YAAY,IAAI,SAAS;AACjE,UAAM,YAAY,WAAW,SAAS,KAAK;AAC3C,UAAM,aAAa,QAAQ,IAAI,OAAO,SAAS,IAAI,MAAM,MAAM,QAAQ,CAAC;AACxE,UAAM,SAAS,aAAa,KAAK,UAAU,IAAI,OAAO,UAAU,IAAI,OAAO;AAC3E,QAAI,CAAC,UAAU,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,WAAW;AAC5E,YAAM,IAAI;AAAA,QACR,2CAA2C,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAC/D;AAAA,IACF;AACA,YAAQ,KAAK,EAAE,SAAS,QAAQ,OAAO,CAAC;AAAA,EAC1C;AACA,SAAO;AACT;AAQO,SAAS,0BAA0B,KAAmC;AAC3E,QAAM,UAAoB,CAAC;AAC3B,aAAW,UAAU,OAAO,IAAI,MAAM,GAAG,GAAG;AAC1C,UAAM,QAAQ,MAAM,KAAK;AACzB,QAAI,CAAC,MAAO;AACZ,QAAI,MAAkB;AACtB,QAAI;AACF,YAAM,IAAI,IAAI,KAAK;AAAA,IACrB,QAAQ;AACN,YAAM;AAAA,IACR;AACA,QACE,CAAC,OACA,IAAI,aAAa,WAAW,IAAI,aAAa,YAC9C,IAAI,YACJ,IAAI,YACJ,IAAI,SAAS,SAAS,GAAG,KACzB,IAAI,aAAa,OACjB,IAAI,UACJ,IAAI,QACJ,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,GAAG,GAClB;AACA,YAAM,IAAI;AAAA,QACR,yCAAyC,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAC7D;AAAA,IACF;AACA,YAAQ,KAAK,IAAI,MAAM;AAAA,EACzB;AACA,SAAO;AACT;AAEA,IAAM,2BAA8C;AAAA;AAAA,EAElD;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AACF;AAQO,SAAS,4BAA4B,UAA2B;AACrE,SAAO,yBAAyB,KAAK,CAAC,UAAU,MAAM,KAAK,QAAQ,CAAC;AACtE;AAQO,SAAS,oBACd,UACM;AACN,MAAI,SAAS,gBAAgB,OAAW;AACxC,MAAI;AACJ,MAAI;AACF,aAAS,qBAAqB,SAAS,WAAW;AAAA,EACpD,QAAQ;AACN,UAAM,IAAI,MAAM,uEAAuE;AAAA,EACzF;AACA,QAAM,QAA6C;AAAA,IACjD,CAAC,4BAA4B,SAAS,aAAa;AAAA,IACnD,CAAC,yBAAyB,SAAS,UAAU;AAAA,EAC/C;AACA,aAAW,CAAC,MAAM,GAAG,KAAK,OAAO;AAC/B,QAAI,CAAC,IAAK;AACV,UAAM,OAAO,IAAI,IAAI,GAAG,EAAE,SAAS,YAAY,EAAE,QAAQ,QAAQ,EAAE;AACnE,QAAI,SAAS,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,KAAK,OAAO,SAAS,IAAI,IAAI,EAAE;AAC9E,YAAM,IAAI;AAAA,QACR,0BAA0B,MAAM,yDAAyD,IAAI,SAAS,IAAI;AAAA,MAC5G;AAAA,EACJ;AACF;AAEA,SAAS,iBAAiB,UAAoB,SAA4B,QAAQ,KAAW;AAC3F,4BAA0B,QAAQ;AAClC,4BAA0B,SAAS,mBAAmB;AACtD,sBAAoB,QAAQ;AAC5B,MACE,SAAS,6CAA6C,WACtD,CAAC,SAAS,qDACV;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,kBAAkB,KAAK,CAAC,YAAY,UAAU,SAAS,oBAAoB,GAAG;AACzF,UAAM,IAAI;AAAA,MACR,4FAA4F,SAAS,oBAAoB;AAAA,IAC3H;AAAA,EACF;AACA,QAAM,4BAA4B,IAAI;AAAA,IACpC,SAAS,6BAA6B;AAAA,EACxC;AACA,QAAM,sBAAsB,SAAS,6BAA6B,CAAC,GAAG;AAAA,IACpE,CAAC,SAAS,CAAC,0BAA0B,IAAI,IAAI;AAAA,EAC/C;AACA,MAAI,mBAAmB,SAAS,GAAG;AACjC,UAAM,IAAI;AAAA,MACR,sGAAsG,mBAAmB,KAAK,IAAI,CAAC;AAAA,IACrI;AAAA,EACF;AACA,MAAI,SAAS,sBAAsB,WAAW;AAC5C,QAAI,SAAS,yBAAyB,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAAG;AACvF,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,kBAAkB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,kBAAkB;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,8BAA8B,YACvC,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAChD,CAAC,SAAS,cAAc,WAAW,UAAU,GAC7C;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,yBAAyB,YAClC,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAChD,CAAC,SAAS,cACV;AACA,YAAM,IAAI,MAAM,yEAAyE;AAAA,IAC3F;AACA,QAAI,SAAS,yBAAyB,cAAc,SAAS,cAAc;AACzE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAAK,CAAC,SAAS,2BAA2B;AAC5F,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MACE,QAAQ,SAAS,yBAAyB,MAAM,QAAQ,SAAS,6BAA6B,GAC9F;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,QAAQ,SAAS,yBAAyB,MAAM,QAAQ,SAAS,6BAA6B,GAC9F;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,8BAA8B;AAAA,IAClC,SAAS,6BAA6B,SAAS;AAAA,EACjD;AACA,MAAI,6BAA6B;AAC/B,QAAI,SAAS,sBAAsB,WAAW;AAC5C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,eAAe,sBAAsB,SAAS,aAAa;AACjE,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,aAAa,WAAW,UAAU,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAAG;AAC7F,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAIA,QAAM,0BAA0B,OAAO,uCAAuC,KAAK;AACnF,MAAI,2BAA2B,4BAA4B,KAAK;AAC9D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,oBAAoB,wBAAwB,SAAS,oBAAoB;AAC/E,MAAI,kBAAkB,SAAS,KAAK,SAAS,wBAAwB,GAAG;AACtE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,iBAAiB;AAC5B,QAAI,SAAS,sBAAsB,cAAc;AAC/C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,eAAe,sBAAsB,SAAS,aAAa;AACjE,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,aAAa,WAAW,UAAU,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAAG;AAC7F,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,iCAA+B,QAAQ;AACvC,MAAI,SAAS,qBAAqB;AAChC,QAAI,SAAS,sBAAsB,aAAa,CAAC,SAAS,eAAe;AACvE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,iBACT,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,2BAA2B,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAAG;AAC1F,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,aAAa,MAAM,QAAQ,SAAS,iBAAiB,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,eAAe;AAC1B,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,yBAAyB;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,mBAAmB,MAAM,QAAQ,SAAS,uBAAuB,GAAG;AACvF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,QAAQ,SAAS,2BAA2B,MAC5C,QAAQ,SAAS,+BAA+B,GAChD;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,4BAA4B;AACvC,QAAI,CAAC,SAAS,qBAAqB;AACjC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,+BAA+B,CAAC,SAAS,iCAAiC;AACtF,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,gCAAgC,SAAS,gBAAgB;AACpE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,+BAA+B,SAAS,aAAa,GAAG;AAC3D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,SAAS,eAAe,WAAW,UAAU,KAC9C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,yBAAyB;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,2BAA2B;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,aAAa,MAAM,QAAQ,SAAS,iBAAiB,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,eAAe;AAC1B,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,yBAAyB;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,qBAAqB;AAChC,QAAI,CAAC,SAAS,qBAAqB;AACjC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,4BAA4B,SAAS,aAAa,GAAG;AACxD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,yBAAyB;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,8BAA8B,SAAS,yBAAyB;AAC3E,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,SAAS,yCAAyC,SAAS,oCAC3D;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,yCAAyC,SAAS,kCAAkC;AAC/F,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,iBAAiB,MAAM,QAAQ,SAAS,qBAAqB,GAAG;AACnF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,mBAAmB;AAC9B,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,CAAC,SAAS,cAAc,WAAW,UAAU,KAC7C,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,yBAAyB;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,oCAAkC,SAAS,4BAA4B;AACvE,8BAA4B,SAAS,sBAAsB;AAC3D,MACE,SAAS,sBAAsB,gBAC/B,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAChD,CAAC,SAAS,oBACV,CAAC,SAAS,cACV;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,gBAAgB,UAAU;AACrC,QAAI,CAAC,SAAS,mBAAmB,CAAC,SAAS,qBAAqB;AAC9D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,sBAAsB,aAAa,SAAS,gBAAgB,UAAU;AACjF,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,MAAI,SAAS,oBAAoB,UAAU;AACzC,UAAM,SAAS,4BAA4B,QAAQ;AACnD,QAAI,OAAO,KAAK,MAAM,EAAE,WAAW,GAAG;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,OAAO;AACL,+BAA2B,SAAS,qBAAqB;AAAA,EAC3D;AACA,MAAI,SAAS,qBAAqB,UAAU;AAC1C,UAAM,eAAe,4BAA4B,SAAS,sBAAsB;AAChF,QAAI,OAAO,KAAK,YAAY,EAAE,WAAW,GAAG;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,OAAO;AACL,gCAA4B,SAAS,sBAAsB;AAAA,EAC7D;AACA,MAAI,SAAS,gBAAgB,CAAC,SAAS,WAAW;AAChD,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,SAAS,mBAAmB,SAAS;AACvC,QAAI,CAAC,SAAS,sBAAsB,CAAC,SAAS,qBAAqB;AACjE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,SAAS,sBAAsB,CAAC,SAAS,uBAAuB;AACnE,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AACA,QAAI,CAAC,SAAS,sBAAsB,CAAC,SAAS,uBAAuB;AACnE,YAAM,IAAI,MAAM,uEAAuE;AAAA,IACzF;AACA,QAAI,CAAC,SAAS,qBAAqB,CAAC,SAAS,oBAAoB;AAC/D,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAAA,EACF;AAIA,MAAI,QAAQ,SAAS,YAAY,MAAM,QAAQ,SAAS,gBAAgB,GAAG;AACzE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAKA,aAAW,YAAY,qBAAqB,SAAS,cAAc,KAAK,CAAC,GAAG;AAC1E,UAAM,QAAQ,SAAS,SAAS,KAAK;AACrC,QACE,UAAU,UACV,UAAU,QACT,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GACtD;AACA,YAAM,IAAI;AAAA,QACR,GAAG,SAAS,GAAG,8CAA8C,SAAS,cAAc;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACA,gCAA8B,QAAQ;AACtC,MAAI,SAAS,wBAAwB,SAAS,mBAAmB;AAC/D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,oBAAkB,SAAS,kBAAkB;AAI7C,kCAAgC,QAAQ;AACxC,0BAAwB,QAAQ;AAEhC,QAAM,YAAY,yBAAyB,SAAS,kCAAkC;AAItF,MACE,SAAS,2BAA2B,aACpC,OAAO,OAAO,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,cAAc,IAAI,CAAC,GACnE;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,SAAS,iCAAiC,aAC1C,SAAS,8BAA8B,YACvC,SAAS,8CAA8C,GACvD;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MACE,SAAS,iCAAiC,aAC1C,SAAS,8BAA8B,YACvC,CAAC,SAAS,qCACV;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,mBAAmB,WAAW;AACzC,UAAMJ,UAAS,sBAAsB,QAAQ;AAC7C,QAAIA,QAAO,SAAS,GAAG;AACrB,YAAM,IAAI,MAAM,qCAAqCA,QAAO,KAAK,IAAI,CAAC,EAAE;AAAA,IAC1E;AAAA,EACF;AACA,MAAI,SAAS,mBAAmB,eAAe;AAC7C,QAAI,CAAC,yBAAyB,KAAK,SAAS,oBAAoB,EAAE,GAAG;AACnE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,4CAA4C,QAAQ,GAAG;AAC1D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,oBAAI,IAAY;AAClC,aAAW,UAAU,SAAS,YAAY;AACxC,QAAI,UAAU,IAAI,OAAO,EAAE,GAAG;AAC5B,YAAM,IAAI,MAAM,8CAA8C,OAAO,EAAE,EAAE;AAAA,IAC3E;AACA,cAAU,IAAI,OAAO,EAAE;AACvB,QAAI,OAAO,eAAe,oBAAoB,QAAQ;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAKA;AACE,UAAM,eAAe,SAAS;AAC9B,UAAM,YAAY,SAAS;AAC3B,UAAM,iBAAiB,SAAS;AAChC,QAAI,EAAE,eAAe,YAAY;AAC/B,YAAM,IAAI;AAAA,QACR,4CAA4C,YAAY,uEACZ,SAAS;AAAA,MAEvD;AAAA,IACF;AACA,QAAI,EAAE,eAAe,iBAAiB;AACpC,YAAM,IAAI;AAAA,QACR,4CAA4C,YAAY,4EACP,cAAc;AAAA,MAEjE;AAAA,IACF;AACA,QAAI,SAAS,kCAAkC,QAAW;AACxD,YAAMK,yBAAwB,+BAA+B;AAAA,QAC3D,0BAA0B,uCAAuC,QAAQ;AAAA,MAC3E,CAAC;AACD,YAAM,2BACJ,eAAeA,yBAAwB;AACzC,UAAI,2BAA2B,0CAA0C;AACvE,cAAM,IAAI;AAAA,UACR,+CAA+C,SAAS,6BAA6B,qDAChC,wBAAwB,qEAExE,wCAAwC;AAAA,QAE/C;AAAA,MACF;AAAA,IACF;AAIA,UAAM,iBAAiB,SAAS;AAChC,UAAM,2BAA2B,+BAA+B,QAAQ;AACxE,UAAM,wBAAwB,+BAA+B;AAAA,MAC3D,0BAA0B,uCAAuC,QAAQ;AAAA,IAC3E,CAAC;AACD,UAAM,mCAAmC,KAAK;AAAA,MAC5C;AAAA,MACA;AAAA,IACF;AACA,UAAM,yBACJ,yCAAyC,mCAAmC,IAAI;AAClF,QAAI,EAAE,iBAAiB,yBAAyB;AAC9C,YAAM,IAAI;AAAA,QACR,sCAAsC,cAAc,2HAE9C,sBAAsB;AAAA,MAE9B;AAAA,IACF;AACA,UAAM,gBAAgB,SAAS;AAC/B,QAAI,kBAAkB,UAAa,EAAE,gBAAgB,SAAS,qBAAqB;AACjF,YAAM,IAAI;AAAA,QACR,iDAAiD,aAAa,iDACzB,SAAS,kBAAkB;AAAA,MAElE;AAAA,IACF;AACA,QACE,kBAAkB,UAClB,yBAAyB,gDAAgD,MAAM,MAC7E,UACF,EAAE,gBAAgB,iBAClB;AACA,YAAM,IAAI;AAAA,QACR,iDAAiD,aAAa,mEACtB,cAAc;AAAA,MAExD;AAAA,IACF;AACA,QAAI,SAAS,mBAAmB,SAAS;AACvC,YAAM,cAAc,SAAS;AAC7B,YAAM,YAAY,0BAA0B,UAAU,OAAO;AAC7D,YAAM,qBAAqB,UAAU;AACrC,YAAM,gBAAgB,UAAU;AAChC,UAAI,EAAE,iBAAiB,qBAAqB;AAC1C,cAAM,IAAI;AAAA,UACR,6CAA6C,aAAa,uFACL,kBAAkB;AAAA,QAEzE;AAAA,MACF;AACA,UAAI,EAAE,iBAAiB,qBAAqB;AAC1C,cAAM,IAAI;AAAA,UACR,sCAAsC,cAAc,qEACV,kBAAkB;AAAA,QAC9D;AAAA,MACF;AACA,UAAI,EAAE,YAAY,gBAAgB;AAChC,cAAM,IAAI;AAAA,UACR,0CAA0C,SAAS,gEAChC,aAAa;AAAA,QAElC;AAAA,MACF;AACA,UAAI,EAAE,iBAAiB,gBAAgB;AACrC,cAAM,IAAI;AAAA,UACR,+CAA+C,cAAc,gEACxB,aAAa;AAAA,QAEpD;AAAA,MACF;AACA,UAAI,EAAE,eAAe,cAAc,gBAAgB;AACjD,cAAM,IAAI;AAAA,UACR,6EACM,YAAY,MAAM,WAAW,MAAM,eAAe,WAAW,gEAClC,aAAa;AAAA,QAKhD;AAAA,MACF;AACA,UACE,SAAS,4BAA4B,UACrC,kBAAkB,UAClB,EAAE,eAAe,gBAAgB,wBAAwB,gBACzD;AACA,cAAM,IAAI;AAAA,UACR,mHAC4B,YAAY,MAAM,aAAa,MAAM,qBAAqB,0EACZ,aAAa;AAAA,QAGzF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AASA,MACE,SAAS,yBACT,SAAS,mBAAmB,WAC5B,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,GAChD;AACA,QAAI,CAAC,gCAAgC,QAAQ,GAAG;AAC9C,YAAM,IAAI;AAAA,QACR;AAAA,MAIF;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,yBAAyB,yBAAyB,QAAQ,MAAM,QAAW;AACtF,YAAQ;AAAA,MACN;AAAA,IAIF;AAAA,EACF;AACA,MAAI,SAAS,uBAAuB,QAAQ;AAC1C,iCAA6B,UAAU,MAAM;AAAA,EAC/C,OAAO;AAIL,6BAAyB,SAAS,mBAAmB;AACrD,QAAI,SAAS,mBAAmB,KAAK,GAAG;AACtC,cAAQ;AAAA,QACN;AAAA,MAEF;AAAA,IACF;AAAA,EACF;AACF;AAGO,SAAS,6BACd,UACA,SAA4B,QAAQ,KACjB;AACnB,QAAM,aAAa,yBAAyB,SAAS,mBAAmB;AACxE,QAAM,QAAQ,oBAAoB,SAAS,cAAc;AACzD,QAAM,oBAAoB,wBAAwB,SAAS,kBAAkB;AAC7E,QAAM,YAAY,kBAAkB,QAAQ;AAC5C,QAAM,kBACJ,SAAS,gBAAgB,SAAY,OAAO,uBAAuB,SAAS,WAAW;AACzF,MAAI,iBAAiB;AACnB,UAAM,IAAI,MAAM,2BAA2B,eAAe,EAAE;AAAA,EAC9D;AACA,QAAM,cAAc,oBAAI,IAAY;AACpC,aAAW,YAAY,mBAAmB;AACxC,QACE,SAAS,SAAS,4BAClB,SAAS,SAAS,8BAClB,SAAS,SAAS,iCAClB,SAAS,SAAS,6BAClB,SAAS,SAAS,4BAClB,SAAS,SAAS,gCAClB,SAAS,SAAS,+BAClB,SAAS,SAAS,0BAClB,SAAS,SAAS,6BAClB,SAAS,SAAS,qBAClB,SAAS,SAAS,wBAClB,SAAS,SAAS,4BAClB,SAAS,SAAS,yBAClB,SAAS,SAAS,mCAClB,SAAS,SAAS,sCAClB,SAAS,SAAS,oBAClB;AACA,YAAM,IAAI;AAAA,QACR,+CAA+C,SAAS,IAAI;AAAA,MAC9D;AAAA,IACF;AACA,QAAI,4BAA4B,IAAI,SAAS,EAAE,GAAG;AAChD,YAAM,IAAI;AAAA,QACR,6CAA6C,SAAS,EAAE;AAAA,MAC1D;AAAA,IACF;AACA,QAAI,SAAS,OAAO,WAAW;AAC7B,YAAM,IAAI;AAAA,QACR,6CAA6C,SAAS,EAAE;AAAA,MAC1D;AAAA,IACF;AACA,QAAI,YAAY,IAAI,SAAS,EAAE,GAAG;AAChC,YAAM,IAAI;AAAA,QACR,gEAAgE,SAAS,EAAE;AAAA,MAC7E;AAAA,IACF;AACA,gBAAY,IAAI,SAAS,EAAE;AAC3B,QACE,SAAS,SAAS,wBAClB,SAAS,SAAS,eAClB,CAAC,sBAAsB,UAAU,MAAM,GACvC;AACA,YAAM,IAAI;AAAA,QACR,0CAA0C,SAAS,EAAE;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AAIA,QAAM,SAAS,iBAAiB,UAAU,MAAM;AAChD,QAAM,yBAAyB,+BAA+B,UAAU,SAAS,WAAW;AAC5F,QAAM,SAAS,SAAS;AACxB,QAAM,sBAAsB,oBAAI,IAAI;AAAA,IAClC,GAAI,OAAO,mBAAmB,CAAC;AAAA,IAC/B,GAAI,OAAO,kBAAkB,CAAC;AAAA,IAC9B,GAAG,OAAO,OAAO,OAAO,MAAM,EAAE,QAAQ,CAAC,UAAU,MAAM,oBAAoB,CAAC,CAAC;AAAA,EACjF,CAAC;AACD,aAAW,WAAW,qBAAqB;AACzC,QAAI,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,OAAO,WAAW,MAAM,SAAS,SAAS,GAAG;AAC7E,YAAM,IAAI;AAAA,QACR,4BAA4B,OAAO;AAAA,MACrC;AAAA,IACF;AAAA,EACF;AACA,QAAM,uBACJ,2BAA2B,WAAW,SAAS,iBAAiB,wBAAwB,MAAM;AAChG,MAAI,OAAO,WAAW,KAAK,qBAAqB,WAAW,GAAG;AAC5D,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,QAAM,iBAAiB;AAAA,IACrB;AAAA,IACA,SAAS;AAAA,EACX;AACA,MAAI,CAAC,qBAAqB,KAAK,CAAC,UAAU,MAAM,OAAO,cAAc,GAAG;AACtE,UAAM,IAAI;AAAA,MACR,qBAAqB,SAAS,WAAW;AAAA,IAC3C;AAAA,EACF;AAQA,QAAM,yBAAyB,OAAO,gCAAgC,KAAK;AAC3E,MACE,0BACA,SAAS,uBAAuB,UAChC,SAAS,gBAAgB,UACzB;AACA,UAAM,mBAAmB,8BAA8B,UAAU,SAAS,mBAAmB;AAC7F,UAAM,iBAAiB,OAAO,KAAK,CAAC,UAAU,MAAM,OAAO,gBAAgB;AAC3E,QAAI,gBAAgB,SAAS,WAAW;AACtC,YAAM,IAAI;AAAA,QACR,kCAAkC,SAAS,mBAAmB;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AAEA,QAAM,uBAAuB,IAAI;AAAA,IAC/B,OAAO,OAAO,CAAC,UAAU,MAAM,iBAAiB,SAAS,YAAY,EAAE,IAAI,CAAC,UAAU,MAAM,EAAE;AAAA,EAChG;AACA,QAAM,iBAAiB,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC;AAC9D,MAAI,SAAS,4BAA4B,QAAW;AAClD,eAAW,SAASP,GACjB,MAAM,uBAAuB,EAC7B,MAAM,KAAK,MAAM,SAAS,uBAAuB,CAAC,GAAG;AACtD,qBAAe,IAAI,MAAM,EAAE;AAAA,IAC7B;AAAA,EACF;AACA,aAAW,SAAS,+BAA+B,QAAQ,GAAG;AAC5D,yBAAqB,IAAI,MAAM,SAAS;AACxC,mBAAe,IAAI,MAAM,SAAS;AAClC,mBAAe,IAAI,MAAM,kBAAkB;AAAA,EAC7C;AACA,aAAW,SAAS,kCAAkC,QAAQ,GAAG;AAC/D,UAAM,YAAY,GAAG,0BAA0B,GAAG,MAAM,eAAe;AACvE,yBAAqB,IAAI,SAAS;AAClC,mBAAe,IAAI,SAAS;AAC5B,mBAAe,IAAI,GAAG,oCAAoC,GAAG,MAAM,eAAe,EAAE;AAAA,EACtF;AACA,aAAW,SAAS,6BAA6B,QAAQ,GAAG;AAC1D,UAAM,YAAY,GAAG,qBAAqB,GAAG,MAAM,eAAe;AAClE,yBAAqB,IAAI,SAAS;AAClC,mBAAe,IAAI,SAAS;AAC5B,mBAAe,IAAI,GAAG,+BAA+B,GAAG,MAAM,eAAe,EAAE;AAAA,EACjF;AACA,MAAI,SAAS,uBAAuB,QAAQ;AAC1C,eAAW,aAAa,OAAO,KAAK,UAAU,GAAG;AAC/C,UAAI,CAAC,qBAAqB,IAAI,SAAS,GAAG;AACxC,cAAM,IAAI;AAAA,UACR,uEAAuE,SAAS;AAAA,QAClF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,aAAW,aAAa,OAAO,KAAK,KAAK,GAAG;AAC1C,QAAI,CAAC,eAAe,IAAI,SAAS,GAAG;AAClC,YAAM,IAAI,MAAM,8DAA8D,SAAS,EAAE;AAAA,IAC3F;AAAA,EACF;AAEA,MAAI,SAAS,gBAAgB,YAAY,SAAS,oBAAoB,WAAW;AAC/E,UAAM,UAAU,uBAAuB,QAAQ;AAC/C,UAAM,UAAU,OACb,OAAO,CAAC,UAAU,MAAM,SAAS,aAAa,CAAC,QAAQ,MAAM,EAAE,CAAC,EAChE,IAAI,CAAC,UAAU,MAAM,EAAE;AAC1B,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,uDAAuD,QAAQ,KAAK,IAAI,CAAC;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,yBAAyB,UAAwC;AAC/E,QAAM,WAAW,SAAS,mBAAmB,KAAK;AAClD,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AACA,QAAM,aAAa,SAAS,kBAAkB,KAAK;AACnD,SAAO,aAAa,aAAa;AACnC;AAOO,SAAS,oBAAoB,UAA6B;AAC/D,SAAO,SAAS,yBAAyB,yBAAyB,QAAQ,MAAM;AAClF;AAIO,SAAS,yBAAyB,UAA6B;AACpE,SAAO,QAAQ,SAAS,iBAAiB,SAAS,iBAAiB,SAAS,cAAc;AAC5F;AAMO,SAAS,sBAAsB,UAA8B;AAClE,QAAME,UAAmB,CAAC;AAC1B,MAAI,CAAC,SAAS,cAAe,CAAAA,QAAO,KAAK,sCAAsC;AAC/E,MAAI,CAAC,SAAS,cAAe,CAAAA,QAAO,KAAK,sCAAsC;AAC/E,MACE,SAAS,iBACT,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAChD,CAAC,SAAS,cAAc,WAAW,UAAU,GAC7C;AACA,IAAAA,QAAO,KAAK,4DAA4D;AAAA,EAC1E;AACA,QAAM,UAAU,SAAS;AACzB,MAAI,CAAC,SAAS;AACZ,IAAAA,QAAO,KAAK,uCAAuC;AAAA,EACrD,WACE,CAAC,QAAQ,WAAW,QAAQ,KAC5B,EAAE,CAAC,SAAS,MAAM,EAAE,SAAS,SAAS,WAAW,KAAK,QAAQ,WAAW,OAAO,IAChF;AACA,IAAAA,QAAO,KAAK,2EAA2E;AAAA,EACzF;AACA,MAAI,CAAC,SAAS,sBAAsB,CAAC,wBAAwB,QAAQ,GAAG;AACtE,IAAAA,QAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,yBAAyB,MAAM;AAC1C,IAAAA,QAAO,KAAK,8EAA8E;AAAA,EAC5F;AACA,MACE,SAAS,4BAA4B,UACrC,SAAS,0BAA0B,SAAS,kBAC5C;AACA,IAAAA,QAAO,KAAK,iFAAiF;AAAA,EAC/F;AACA,MACE,SAAS,4BAA4B,UACrC,SAAS,0BAA0B,SAAS,eAAe,KAC3D;AACA,IAAAA,QAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF;AACA,SAAOA;AACT;AAWO,SAAS,+BAA+B,UAAwC;AACrF,QAAM,WAAW,SAAS,yBAAyB,KAAK;AACxD,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AACA,QAAM,aAAa,SAAS,kBAAkB,KAAK;AACnD,SAAO,aAAa,aAAa;AACnC;AAYO,SAAS,wBAAwB,UAAwC;AAC9E,QAAM,WAAW,SAAS,4BAA4B,KAAK;AAC3D,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AACA,QAAM,SAAS,SAAS,mBAAmB,KAAK;AAChD,MAAI,QAAQ;AACV,WAAO;AAAA,EACT;AACA,QAAM,aAAa,SAAS,kBAAkB,KAAK;AACnD,SAAO,aAAa,aAAa;AACnC;AAmBO,SAAS,yBAAyB,UAA8C;AACrF,QAAM,cAAc,SAAS,kCAAkC,KAAK;AACpE,QAAM,cAAc,SAAS,kCAAkC,KAAK,KAAK;AACzE,QAAM,OAAO,SAAS,2BAA2B,KAAK;AACtD,QAAM,WAAW,SAAS,+BAA+B,KAAK;AAC9D,MAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU;AACtC,WAAO;AAAA,EACT;AACA,SAAO,EAAE,aAAa,aAAa,MAAM,SAAS;AACpD;AAEA,SAAS,8BAA8B,UAAuC;AAC5E,MACE,SAAS,yBAAyB,mBAClC,SAAS,yBAAyB,UAClC;AACA,QACE,QAAQ,SAAS,wBAAwB,MAAM,QAAQ,SAAS,4BAA4B,GAC5F;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,yBAAyB,oBACjC,SAAS,yBACR,SAAS,iCACT,SAAS,kCACV,CAAC,SAAS,4BAA4B,CAAC,SAAS,+BACjD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,sCACT,SAAS,iCACT,SAAS,gCACT,SAAS,4BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,6BACT,SAAS,mCACT,SAAS,+BACT,SAAS,6BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,WAAW,SAAS,yBAAyB,cAAc;AACzD,QACE,SAAS,yBACT,SAAS,iCACT,SAAS,gCACT,SAAS,4BACT,SAAS,8BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,6BACT,SAAS,mCACT,SAAS,+BACT,SAAS,6BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,sBAAsB,QAAQ,SAAS,kCAAkC;AAC/E,UAAM,eACJ,QAAQ,SAAS,6BAA6B,KAC9C,QAAQ,SAAS,4BAA4B;AAC/C,QAAI,CAAC,uBAAuB,CAAC,cAAc;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF,OAAO;AACL,QACE,SAAS,yBACT,SAAS,iCACT,SAAS,gCACT,SAAS,4BACT,SAAS,8BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QACE,SAAS,sCACT,SAAS,iCACT,SAAS,gCACT,SAAS,4BACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,iCAAiC;AAC5C,8BAAwB,SAAS,+BAA+B;AAAA,IAClE;AAAA,EACF;AACF;AAaO,SAAS,4BACd,UAC6B;AAC7B,QAAM,OAAO,SAAS,2BAA2B,KAAK;AACtD,QAAM,WAAW,SAAS,+BAA+B,KAAK;AAC9D,MAAI,CAAC,QAAQ,CAAC,UAAU;AACtB,WAAO;AAAA,EACT;AACA,SAAO,EAAE,MAAM,SAAS;AAC1B;AAEA,SAAS,SAAS,KAAuB;AACvC,SAAO,IACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACnB;AAGO,SAAS,sBAAsB,UAA6D;AACjG,SAAO,CAAC,GAAG,IAAI,IAAI,SAAS,SAAS,yBAAyB,EAAE,CAAC,CAAC;AACpE;AAEA,SAAS,eAAe,KAAe,WAA6B;AAClE,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAgB,CAAC;AACvB,aAAW,QAAQ,KAAK;AACtB,QAAI,CAAC,QAAQ,KAAK,IAAI,GAAG;AACvB,YAAM,IAAI,MAAM,GAAG,SAAS,mCAAmC,IAAI,EAAE;AAAA,IACvE;AACA,QAAI,CAAC,KAAK,IAAI,IAAI,GAAG;AACnB,WAAK,IAAI,IAAI;AACb,UAAI,KAAK,IAAI;AAAA,IACf;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,KAAyB;AAC7C,SAAO,CAAC,GAAG,IAAI,IAAI,IAAI,OAAO,OAAO,CAAC,CAAC;AACzC;AAEA,SAAS,wBAAwB,KAAsB;AACrD,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,IAAI,MAAM,oEAAoE,OAAO,IAAI;AAAA,MAC7F,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;AAGO,IAAM,0BAA0B,CAAC,aAAa,qBAAqB;AAI1E,IAAM,+BAoBF,OAAO,YAAY;AAAA,EACrB,GAAG;AAAA,IACD,CAAC,mBAAmB,QAAQ;AAAA,IAC5B,CAAC,qBAAqB,QAAQ;AAAA,IAC9B,CAAC,oBAAoB,QAAQ;AAAA,IAC7B,CAAC,iBAAiB,MAAM;AAAA,IACxB,CAAC,mBAAmB,MAAM;AAAA,IAC1B,CAAC,mBAAmB,MAAM;AAAA,IAC1B,CAAC,mBAAmB,OAAO;AAAA,EAC7B,EAAE,IAAI,CAAC,CAAC,IAAI,aAAa,MAAM;AAAA,IAC7B;AAAA,IACA;AAAA,MACE,SAAS,CAAC,OAAO,UAAU,QAAQ,SAAS,KAAK;AAAA,MACjD;AAAA,MACA,qBAAqB;AAAA,MACrB,iBAAiB;AAAA,MACjB,qBACE,OAAO,qBAAqB,OAAO,uBAAuB,OAAO;AAAA,MACnE,GAAI,OAAO,qBAAqB,OAAO,sBAAsB,EAAE,iBAAiB,KAAK,IAAI,CAAC;AAAA,MAC1F,GAAI,OAAO,qBACP,EAAE,uBAAuB,KAAO,IAChC,OAAO,oBACL,EAAE,uBAAuB,kCAAkC,IAC3D,CAAC;AAAA,IACT;AAAA,EACF,CAAC;AAAA,EACD,GAAG,CAAC,mBAAmB,mBAAmB,EAAE,IAAI,CAAC,OAAO;AAAA,IACtD;AAAA,IACA;AAAA,MACE,SAAS,CAAC,OAAO,UAAU,QAAQ,KAAK;AAAA,MACxC,eAAe;AAAA,MACf,qBAAqB;AAAA,MACrB,iBAAiB;AAAA,IACnB;AAAA,EACF,CAAC;AAAA,EACD;AAAA,IACE;AAAA,IACA;AAAA,MACE,SAAS,CAAC;AAAA,MACV,eAAe;AAAA,MACf,qBAAqB;AAAA,MACrB,iBAAiB;AAAA,IACnB;AAAA,EACF;AACF,CAAC;AACM,SAAS,yBAAyB,iBAAyB;AAChE,SAAO,OAAO,OAAO,8BAA8B,eAAe,IAC9D,6BAA6B,eAAe,IAC5C;AACN;AAMO,IAAM,sCAAsC;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AACF;AACO,SAAS,iBACd,MACA,QAAsC,gBAC9B;AACR,SAAO,GAAG,KAAK,IAAI,SAAS,cAAc,cAAc,qBAAqB;AAC/E;AAUO,SAAS,4BACd,UACA,aACA,QAAsC,gBAC5B;AACV,MAAI,YAAY,wBAAwB,SAAS,kBAAkB;AACnE,aAAW,QAAQ,yBAAyB;AAC1C,QAAI,SAAS,yBAAyB,CAAC,SAAS,2BAA2B;AACzE,kBAAY,UAAU,OAAO,CAAC,aAAa,SAAS,OAAO,iBAAiB,MAAM,KAAK,CAAC;AACxF;AAAA,IACF;AACA,UAAM,aAAa,YAAY,IAAI;AACnC,QAAI,CAAC,WAAY;AACjB,UAAM,KAAK,iBAAiB,MAAM,KAAK;AACvC,gBAAY,UAAU,OAAO,CAAC,aAAa,SAAS,OAAO,EAAE;AAC7D,QAAI,CAAC,WAAW,OAAO,OAAQ;AAC/B,cAAU,KAAK;AAAA,MACb;AAAA,MACA,OAAO,SAAS,cAAc,kBAAkB;AAAA,MAChD,MAAM,SAAS,cAAc,aAAa,KAAK,KAAK,uBAAuB,KAAK;AAAA,MAChF,KAAK;AAAA,MACL,aAAa;AAAA,MACb,SAAS;AAAA,MACT,WAAW;AAAA,QACT,MAAM,SAAS,cAAc,YAAY;AAAA,QACzC,UAAU;AAAA,QACV,iBAAiB;AAAA,QACjB,qBAAqB;AAAA,MACvB;AAAA,MACA,QAAQ,WAAW,OAAO,IAAI,CAAC,UAAU;AACvC,cAAM,UAAU,yBAAyB,MAAM,eAAe;AAC9D,cAAM,mBAAmB,QAAQ,SAAS,QAAQ,MAAM;AACxD,cAAM,sBAAsB,SAAS,uBAAuB;AAC5D,cAAM,gBAAgB,SAAS,mBAAmB;AAClD,eAAO;AAAA,UACL;AAAA,UACA,8BAA8B,sBAAsB;AAAA,UACpD,uBACE,SAAS,0BACR,wBAAwB,MACrB,MACA,KAAK,IAAI,MAAS,sBAAsB,gBAAgB,IAAM;AAAA,UACpE,IAAI,KAAK,MAAM,MAAM;AAAA,UACrB,iBAAiB,MAAM;AAAA,UACvB,OACE,MAAM,UACL,MAAM,oBAAoB,oBACvB,oBACA,MAAM,oBAAoB,sBACxB,sBACA,MAAM,oBAAoB,qBACxB,qBACA,MAAM;AAAA,UAChB,iBAAiB;AAAA;AAAA;AAAA,UAGjB,iBAAiB,SAAS;AAAA,UAC1B,cAAc;AAAA,YACZ,GAAG,wBAAwB,UAAU;AAAA,cACnC,iBAAiB;AAAA,cACjB,iBAAiB,SAAS;AAAA,cAC1B,QAAQ;AAAA,YACV,CAAC;AAAA,YACD,qBAAqB,CAAC;AAAA,YACtB,WAAW;AAAA,cACT,UAAU,mBAAmB,cAAc;AAAA,cAC3C,UAAU;AAAA,cACV,SAAS,CAAC,GAAI,SAAS,WAAW,CAAC,CAAE;AAAA,cACrC,eAAe,SAAS,iBAAiB;AAAA,cACzC,UAAU;AAAA,YACZ;AAAA,YACA,iBAAiB,EAAE,UAAU,aAAa,UAAU,KAAK;AAAA,YACzD,eAAe,EAAE,UAAU,aAAa,UAAU,MAAM,MAAM,YAAY;AAAA,UAC5E;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AACA,SAAO,EAAE,GAAG,UAAU,oBAAoB,KAAK,UAAU,SAAS,EAAE;AACtE;AACO,SAAS,+BACd,UACA,MACA,YACA,QAAsC,gBACtC,mBACU;AACV,MAAI,SAAS,yBAAyB,CAAC,SAAS;AAC9C,UAAM,IAAI,MAAM,yDAAyD;AAC3E,MAAI,CAAC,WAAW,KAAK,EAAG,OAAM,IAAI,MAAM,4BAA4B;AACpE,QAAM,SACJ,SAAS,yBAAyB,WAAW,KAAK,EAAE,WAAW,GAAG,IAC9D,6BAA6B,MAAM,KAAK,MAAM,UAAU,CAAC,IACzD;AACN,SAAO;AAAA,IACL,GAAG;AAAA,IACH,oBAAoB,KAAK;AAAA,MACvB,wBAAwB,SAAS,kBAAkB,EAAE;AAAA,QAAI,CAAC,aACxD,SAAS,OAAO,iBAAiB,MAAM,KAAK,IACxC;AAAA,UACE,GAAG;AAAA,UACH,QAAQ,QAAQ,SAAS;AAAA,UACzB,GAAI,SAAS,yBAAyB,SAAS,YAC3C;AAAA,YACE,WAAW;AAAA,cACT,GAAG,SAAS;AAAA,cACZ,UAAU,QAAQ;AAAA,cAClB,mBAAmB,oBACf;AAAA,gBACE,cAAc,kBAAkB;AAAA,gBAChC,mBAAmB,kBAAkB;AAAA,cACvC,IACA;AAAA,YACN;AAAA,UACF,IACA,CAAC;AAAA,QACP,IACA;AAAA,MACN;AAAA,IACF;AAAA,EACF;AACF;","names":["allowed","z","z","XAI_SUBSCRIPTION_MODEL_ID_PREFIX","z","z","status","z","apiKey","issues","allowed","provider","model","url","drainCaptureTimeoutMs"]}