@opengeni/contracts 0.21.0 → 0.22.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/retained-output.ts","../src/event-preview.ts","../src/codex-fleet-policy.ts","../src/secret-redaction.ts","../src/workspace-instruction-policies.ts"],"sourcesContent":["import { z } from \"zod\";\nimport {\n  boundSessionEventPayload,\n  measureSessionEventJson,\n  sessionEventJsonBytes,\n  type SessionEventBoundarySurface,\n} from \"./event-preview\";\n\nexport {\n  SESSION_EVENT_PAYLOAD_MAX_BYTES,\n  approximateSessionEventTokens,\n  boundSessionEventPayload,\n  measureSessionEventJson,\n  sessionEventJsonBytes,\n  sessionEventMediaPreview,\n  sessionEventMediaPreviewFromDataUrl,\n  sessionEventPayloadTruncation,\n  type BoundSessionEventPayloadOptions,\n  type SessionEventBoundarySurface,\n  type SessionEventMediaPreview,\n  type SessionEventJsonMeasurement,\n  type SessionEventPayloadTruncation,\n} from \"./event-preview\";\n\nexport {\n  RETAINED_OUTPUT_DEFAULT_PAGE_BYTES,\n  RETAINED_OUTPUT_MAX_PAGE_BYTES,\n  RETAINED_OUTPUT_RECEIPT_MAX_BYTES,\n  RetainedArtifactMetadataSchema,\n  RetainedArtifactReferenceSchema,\n  RetainedArtifactUnavailableSchema,\n  RetainedOutputEvidenceSchema,\n  RetainedOutputKind,\n  RetainedOutputUnavailableReason,\n  retainedArtifactReferenceFromFile,\n  retainedOutputUnavailable,\n  resolveRetainedOutputRange,\n  validateRetainedOutputEvidence,\n  type RetainedArtifactFileInput,\n  type RetainedArtifactMetadata,\n  type RetainedArtifactReference,\n  type RetainedArtifactUnavailable,\n  type RetainedOutputAvailableEvidence,\n  type RetainedOutputEvidence,\n  type RetainedOutputRangeResolution,\n  type RetainedOutputResolvedRange,\n} from \"./retained-output\";\n\nexport const SessionStatus = z.enum([\n  \"queued\",\n  \"running\",\n  \"idle\",\n  \"requires_action\",\n  \"recovering\",\n  \"waiting_capacity\",\n  \"failed\",\n  \"cancelled\",\n]);\nexport type SessionStatus = z.infer<typeof SessionStatus>;\n\n// 11 backends; 3-way enum parity (contracts / sdk / deployment) is pinned by\n// `packages/sdk/test/contract-parity.test.ts`. Every member is ADDITIVE AT THE\n// END (the parity test pins positions): the original four, then the six cloud\n// backends, then `selfhosted` (bring-your-own-compute — a user's own machine\n// enrolled as a first-class sandbox).\nexport const SandboxBackend = z.enum([\n  \"docker\",\n  \"modal\",\n  \"local\",\n  \"none\",\n  \"daytona\",\n  \"runloop\",\n  \"e2b\",\n  \"blaxel\",\n  \"cloudflare\",\n  \"vercel\",\n  \"selfhosted\",\n]);\nexport type SandboxBackend = z.infer<typeof SandboxBackend>;\n\n// OS axis. Only \"linux\" is reachable in v1; macos/windows are seam placeholders.\nexport const SandboxOs = z.enum([\"linux\", \"macos\", \"windows\"]);\nexport type SandboxOs = z.infer<typeof SandboxOs>;\n\n// The five surfaceable sandbox capabilities (PascalCase, the canonical names).\nexport const SandboxCapabilityName = z.enum([\n  \"FileSystem\", // Channel A: list/read/write/search (Pierre tree)\n  \"Terminal\", // Channel A: command-output firehose (+ future pty-ws)\n  \"Git\", // Channel A: status/diff/log/show (Pierre diff)\n  \"DesktopStream\", // Channel B: noVNC pixels over a scoped tunnel URL\n  \"Recording\", // ffmpeg x11grab -> object storage\n]);\nexport type SandboxCapabilityName = z.infer<typeof SandboxCapabilityName>;\n\n// How a backend exposes a network port to the data plane.\nexport type PortExposureKind = \"provider-tunnel\" | \"preview-url\" | \"local-port\" | \"none\";\n\n// Static per-backend metadata — pure data, no runtime state. This table lives\n// in CONTRACTS (not runtime) so config can read it without an import cycle\n// through runtime (ledger CR8). Everything downstream (config boot-validation,\n// OS image selection, capability negotiation, env/mount branch) reads this\n// data, never a hard-coded backend name.\nexport type CapabilityDescriptor = {\n  backend: SandboxBackend;\n  backendId: string; // asserted === SDK client.backendId at registry build (deferred to P0.3)\n  tier: \"desktop\" | \"headless\" | \"dev\" | \"none\";\n  os: { supported: SandboxOs[]; default: SandboxOs };\n  capabilities: {\n    FileSystem: { available: boolean; readOnly: boolean };\n    Terminal: {\n      available: boolean;\n      transport: \"sse-events\" | \"pty-ws\" | null;\n      pty: boolean;\n    };\n    Git: { available: boolean };\n    DesktopStream: {\n      available: boolean;\n      transport: \"vnc-ws\" | \"rdp-ws\" | \"webrtc\" | null;\n    };\n    // Feasibility only (== DesktopStream.available && os==linux); NOT a request.\n    Recording: { available: boolean };\n  };\n  lifetime: {\n    hardLifetimeMs?: number; // modal 24h, vercel 5h\n    requiresSnapshotRollover: boolean;\n    hasIdleKiller: boolean;\n    supportsSuspendResume: boolean; // runloop/e2b/vercel/modal true\n    resumeIsLockFree: boolean; // modal true (fromId, no lock)\n    idleKillDisableHint?: string;\n  };\n  snapshot: {\n    kind: \"native-fs\" | \"native-dir\" | \"native-snapshot-id\" | \"tar-only\" | \"none\";\n    hasTarFallback: boolean;\n  };\n  portExposure: { kind: PortExposureKind; supportsOnDemandPorts: boolean }; // runloop=false; blaxel only true\n  workspaceRoot: string; // os-overridable; per-backend default (providers owns; os defers)\n  nativeBucketMount: boolean; // modal true -> mount/signed-download branch\n  persistable: boolean;\n  supportsRunAs: boolean;\n};\n\n// The websockify/noVNC desktop port that is merged into `exposedPorts` for\n// every desktop-capable (backend, os). Asserted present by boot-validation.\nexport const DESKTOP_STREAM_PORT = 6080;\n\n// The ttyd PTY-over-websocket port that is exposed over the SAME Modal raw-TLS\n// tunnel as the desktop, for the REAL interactive terminal (Channel-B-symmetric).\n// ttyd's default; the box bakes ttyd and launches it on this port. The pty-ws\n// Terminal cell's `url` is the tunnel address resolved against this port.\nexport const TERMINAL_STREAM_PORT = 7681;\n\n// The provider capability matrix (sandbox contract PART D + module 03-providers). One row per\n// backend (10 rows). v1 reachable cells are all Linux; macos/windows are seam\n// placeholders (no enum members shipped). Reading rule: a capability cell is\n// `available:false` + a reason in the negotiated doc, never absent.\nexport const CAPABILITY_DESCRIPTORS: Record<SandboxBackend, CapabilityDescriptor> = {\n  modal: {\n    backend: \"modal\",\n    backendId: \"modal\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      hardLifetimeMs: 24 * 60 * 60 * 1000,\n      requiresSnapshotRollover: true,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: true,\n    },\n    snapshot: { kind: \"native-fs\", hasTarFallback: true },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: false }, // pre-declare 6080\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: true,\n    persistable: true,\n    supportsRunAs: true,\n  },\n  daytona: {\n    backend: \"daytona\",\n    backendId: \"daytona\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"native-snapshot-id\", hasTarFallback: true },\n    portExposure: { kind: \"preview-url\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: true,\n  },\n  runloop: {\n    backend: \"runloop\",\n    backendId: \"runloop\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: false },\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"native-snapshot-id\", hasTarFallback: true },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: false }, // CR9: pre-declare 6080\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: false,\n  },\n  e2b: {\n    backend: \"e2b\",\n    backendId: \"e2b\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: false }, // pty-until-proven=no\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"native-snapshot-id\", hasTarFallback: true },\n    portExposure: { kind: \"preview-url\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/home/user\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: false,\n  },\n  blaxel: {\n    backend: \"blaxel\",\n    backendId: \"blaxel\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: false }, // pty-until-proven=no\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: false,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"tar-only\", hasTarFallback: true },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: true }, // only on-demand backend\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: false,\n  },\n  cloudflare: {\n    backend: \"cloudflare\",\n    backendId: \"cloudflare\",\n    tier: \"headless\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: false, transport: null },\n      Recording: { available: false },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: false,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"tar-only\", hasTarFallback: true },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: true,\n  },\n  vercel: {\n    backend: \"vercel\",\n    backendId: \"vercel\",\n    tier: \"headless\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: false },\n      Git: { available: true },\n      DesktopStream: { available: false, transport: null },\n      Recording: { available: false },\n    },\n    lifetime: {\n      hardLifetimeMs: 5 * 60 * 60 * 1000,\n      requiresSnapshotRollover: true,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"tar-only\", hasTarFallback: true },\n    portExposure: { kind: \"preview-url\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/vercel/sandbox\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: false,\n  },\n  docker: {\n    backend: \"docker\",\n    backendId: \"docker\",\n    tier: \"dev\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: false, transport: null }, // local\n      Recording: { available: false },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: false,\n      supportsSuspendResume: false,\n      resumeIsLockFree: true,\n    },\n    snapshot: { kind: \"native-dir\", hasTarFallback: true },\n    portExposure: { kind: \"local-port\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: true,\n  },\n  local: {\n    backend: \"local\",\n    // The SDK's UnixLocalSandboxClient reports backendId \"unix_local\" — this MUST\n    // match it (it is the resume-fence field compared against client.backendId).\n    backendId: \"unix_local\",\n    tier: \"dev\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: false, transport: null },\n      Recording: { available: false },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: false,\n      supportsSuspendResume: false,\n      resumeIsLockFree: true,\n    },\n    snapshot: { kind: \"native-dir\", hasTarFallback: true },\n    portExposure: { kind: \"local-port\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: false,\n    supportsRunAs: false,\n  },\n  none: {\n    backend: \"none\",\n    backendId: \"none\",\n    tier: \"none\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: false, readOnly: true },\n      Terminal: { available: false, transport: null, pty: false },\n      Git: { available: false },\n      DesktopStream: { available: false, transport: null },\n      Recording: { available: false },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: false,\n      supportsSuspendResume: false,\n      resumeIsLockFree: true,\n    },\n    snapshot: { kind: \"none\", hasTarFallback: false },\n    portExposure: { kind: \"none\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: false,\n    supportsRunAs: false,\n  },\n  // Bring-your-own-compute: the user's OWN machine, enrolled via a Rust agent,\n  // becomes ONE shared whole-machine sandbox (the agent IS the box). It is the\n  // first backend to make macOS/Windows reachable (default linux). Desktop is\n  // capability-PROCLAIMED (\"vnc-ws\") — the agent serves a native display stack\n  // (Linux X11/Xvfb, macOS CGEvent/ScreenCaptureKit) consent-gated at enroll;\n  // the online/offline/consent/display negotiation lives in select.ts (M3), this\n  // row is the static feasibility ceiling. Always-on (process-lifetime, never\n  // idle-reaped) and NOT persistable — OpenGeni cannot snapshot the user's disk,\n  // so resume = \"is the agent's subject live?\", never a cold re-create. Ports\n  // surface on-demand through the stateless relay edge, which lands behind the\n  // `resolveExposedPort` swap-seam later; until then it reuses the existing\n  // `provider-tunnel` exposure kind (the relay IS the provider tunnel for the\n  // agent) so no new PortExposureKind literal — and no new switch arms — are\n  // introduced. supportsOnDemandPorts:true: the agent opens a stream channel for\n  // a port on request rather than pre-declaring 6080/7681 at construction.\n  selfhosted: {\n    backend: \"selfhosted\",\n    backendId: \"selfhosted\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\", \"macos\", \"windows\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"pty-ws\", pty: true }, // real PTY over the relay\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" }, // proclaimed; consent-gated at enroll\n      Recording: { available: true }, // boot invariant: == DesktopStream.available\n    },\n    lifetime: {\n      // Whole-machine, always-there: online while the agent process runs, offline\n      // when it stops. The lease is NEVER idle-killed (it's the user's machine,\n      // not a reapable cloud box) and there is nothing to suspend/resume — the\n      // machine simply is or isn't reachable.\n      requiresSnapshotRollover: false,\n      hasIdleKiller: false,\n      supportsSuspendResume: false,\n      resumeIsLockFree: true, // resume = address the live NATS subject; no provider lock\n    },\n    // persistable:false forces snapshot.kind:\"none\" (the descriptor invariant\n    // `persistable ⇒ snapshot.kind!==\"none\"`): OpenGeni cannot snapshot the\n    // user's disk — the machine itself is the persistence.\n    snapshot: { kind: \"none\", hasTarFallback: false },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: true },\n    workspaceRoot: \"/\", // agent-reported machine root (the whole machine is the sandbox)\n    nativeBucketMount: false,\n    persistable: false,\n    supportsRunAs: false,\n  },\n};\n\nexport const ReasoningEffort = z.enum([\"none\", \"minimal\", \"low\", \"medium\", \"high\", \"xhigh\"]);\nexport type ReasoningEffort = z.infer<typeof ReasoningEffort>;\n\nexport const ErrorCode = z.enum([\n  \"unauthenticated\",\n  \"forbidden\",\n  \"not_found\",\n  \"validation_failed\",\n  \"conflict\",\n  \"idempotency_conflict\",\n  \"limit_exceeded\",\n  \"nested_agent_depth_exceeded\",\n  \"nested_agent_depth_override_forbidden\",\n  \"provider_verification_failed\",\n  \"upstream_unavailable\",\n  \"internal_error\",\n]);\nexport type ErrorCode = z.infer<typeof ErrorCode>;\n\nexport const ErrorEnvelope = z.object({\n  error: z.object({\n    status: z.number().int().min(400).max(599),\n    code: ErrorCode,\n    message: z.string(),\n    retryable: z.boolean(),\n    requestId: z.string().optional(),\n    details: z.record(z.string(), z.unknown()).optional(),\n  }),\n});\nexport type ErrorEnvelope = z.infer<typeof ErrorEnvelope>;\n\n/** Physical ceiling of the PostgreSQL integer columns that persist depth policy. */\nexport const MAX_NESTED_AGENT_DEPTH = 2_147_483_647;\nexport const NestedAgentDepthValue = z.number().int().nonnegative().max(MAX_NESTED_AGENT_DEPTH);\nexport type NestedAgentDepthValue = z.infer<typeof NestedAgentDepthValue>;\n/** A denied child can be one greater than the persisted PostgreSQL int ceiling. */\nexport const NestedAgentDepthAttemptValue = z\n  .number()\n  .int()\n  .nonnegative()\n  .max(MAX_NESTED_AGENT_DEPTH + 1);\n\nexport const NestedAgentDepthPolicySource = z.enum([\n  \"session\",\n  \"workspace\",\n  \"deployment\",\n  \"default\",\n]);\nexport type NestedAgentDepthPolicySource = z.infer<typeof NestedAgentDepthPolicySource>;\n\n/** Durable evidence for a session-create denial at the database admission boundary. */\nexport const SessionSpawnDenial = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  parentSessionId: z.string().uuid().nullable(),\n  rootSessionId: z.string().uuid().nullable(),\n  currentDepth: NestedAgentDepthValue,\n  attemptedDepth: NestedAgentDepthAttemptValue,\n  effectiveMaxNestedAgentDepth: NestedAgentDepthValue,\n  requestedMaxNestedAgentDepthOverride: NestedAgentDepthValue.nullable(),\n  policySource: NestedAgentDepthPolicySource,\n  policySessionId: z.string().uuid().nullable(),\n  subjectId: z.string().nullable(),\n  code: z.enum([\"nested_agent_depth_exceeded\", \"nested_agent_depth_override_forbidden\"]),\n  idempotencyKey: z.string().nullable(),\n  createdAt: z.string(),\n});\nexport type SessionSpawnDenial = z.infer<typeof SessionSpawnDenial>;\n\nexport const Permission = z.enum([\n  \"account:read\",\n  \"account:admin\",\n  \"members:manage\",\n  \"workspace:create\",\n  \"billing:read\",\n  \"billing:manage\",\n  \"workspace:read\",\n  \"workspace:admin\",\n  \"sessions:create\",\n  \"sessions:read\",\n  \"sessions:control\",\n  // sandbox workspace (sandbox contract §C.3 / crosscut PART 1.2). stream:view is a\n  // REAL, distinct permission — strictly BROADER than sessions:read — because the\n  // pixel plane (Channel B) is UN-REDACTED: a viewer of raw pixels can see cloud\n  // creds the agent cat's into a terminal, which the redacted Channel-A event log\n  // never exposes. sessions:read is NOT permission to watch raw pixels.\n  \"stream:view\",\n  // SEPARATE from stream:view: raw input to the desktop (bypasses approvalQueue /\n  // interrupt). NEVER granted by default in v1 (the input plane is OFF —\n  // streamControlEnabled=false); the permission exists so later hardening is a\n  // flag flip, not a redesign.\n  \"stream:control\",\n  // Accept the pixel-plane secret-leak acknowledgment (consent gate before the\n  // un-redacted desktop URL is handed out).\n  \"stream:acknowledge\",\n  \"files:upload\",\n  \"files:read\",\n  // Channel-A structured write surface (FS writes / apply-patch); distinct from\n  // files:read so a read-only viewer can't mutate the box filesystem.\n  \"files:write\",\n  // Attach to an interactive PTY (terminal-as-pty, Channel A); distinct from\n  // sessions:read which only reads the command-output firehose.\n  \"terminal:attach\",\n  \"documents:manage\",\n  \"documents:search\",\n  \"scheduled_tasks:manage\",\n  \"scheduled_tasks:run\",\n  \"github:manage\",\n  \"github:use\",\n  \"api_keys:manage\",\n  \"connections:read\",\n  \"connections:write\",\n  /** @deprecated alias of variable-sets:manage */\n  \"environments:manage\",\n  /** @deprecated alias of variable-sets:use */\n  \"environments:use\",\n  \"variable-sets:manage\",\n  \"variable-sets:use\",\n  // Attach or rotate per-session third-party MCP server credentials. Deliberately\n  // not part of the worker's default first-party MCP permission set: a sandboxed\n  // agent must not be able to hand itself new bearer credentials.\n  \"mcp_servers:attach\",\n  // Programmatic sandbox -> tool access through the first-party MCP gate. This is\n  // intentionally narrow and is never part of first-party MCP defaults; callers\n  // must receive it through an explicit delegated `ogd_` mint carrying sessionId.\n  \"toolspace:call\",\n  \"goals:manage\",\n  // Bring-your-own-compute (M5). enrollments:read lists a workspace's machines;\n  // enrollments:manage approves a device-flow enrollment (the LOUD whole-machine\n  // consent) + revokes a machine. Distinct from sessions/stream perms because an\n  // enrollment grants WHOLE-MACHINE access to a user's own hardware — a high-trust,\n  // admin-shaped action. workspace:admin is the super-wildcard over both.\n  \"enrollments:read\",\n  \"enrollments:manage\",\n  // Rigs (workspace-scoped, versioned sandbox machine definitions). rigs:use is\n  // read + propose-change (the agent-native, additive path a sandboxed session\n  // is trusted with); rigs:manage is create/edit/activate/promote/delete (the\n  // admin-shaped path that mints or rolls versions). workspace:admin is the\n  // super-wildcard over both.\n  \"rigs:use\",\n  \"rigs:manage\",\n]);\nexport type Permission = z.infer<typeof Permission>;\n\n/**\n * Capability-first permissions signed into a session's first-party OpenGeni\n * MCP token when a top-level creator does not explicitly narrow them.\n *\n * Keep this contract shared by admission and runtime signing: a worker-signed\n * child whose parent was narrowed must inherit the parent's effective subset,\n * never fall back to a different runtime-local default.\n */\nexport const DEFAULT_FIRST_PARTY_MCP_PERMISSIONS = [\n  \"workspace:read\",\n  \"files:read\",\n  \"documents:search\",\n  \"scheduled_tasks:manage\",\n  \"scheduled_tasks:run\",\n  \"goals:manage\",\n  \"sessions:read\",\n  \"sessions:create\",\n  \"sessions:control\",\n  \"variable-sets:use\",\n  \"variable-sets:manage\",\n  \"rigs:use\",\n  \"github:use\",\n] as const satisfies readonly Permission[];\n\nexport function prefixedMcpToolName(registryId: string, toolName: string): string {\n  return `${registryId}__${toolName}`;\n}\n\nexport const ProductAccessMode = z.enum([\"local\", \"configured\", \"managed\"]);\nexport type ProductAccessMode = z.infer<typeof ProductAccessMode>;\n\nexport const BillingMode = z.enum([\"disabled\", \"stripe\"]);\nexport type BillingMode = z.infer<typeof BillingMode>;\n\nexport const EntitlementsMode = z.enum([\"none\", \"static\", \"managed\"]);\nexport type EntitlementsMode = z.infer<typeof EntitlementsMode>;\n\nexport const UsageLimitsMode = z.enum([\"none\", \"static\", \"managed\"]);\nexport type UsageLimitsMode = z.infer<typeof UsageLimitsMode>;\n\nexport const AccountRole = z.enum([\"owner\", \"admin\", \"member\"]);\nexport type AccountRole = z.infer<typeof AccountRole>;\n\nexport const ManagedAccount = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  externalSource: z.string().nullable(),\n  externalId: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ManagedAccount = z.infer<typeof ManagedAccount>;\n\nexport const Workspace = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  name: z.string(),\n  slug: z.string().nullable(),\n  externalSource: z.string().nullable(),\n  externalId: z.string().nullable(),\n  // Per-workspace agent persona template (white-label override). null means\n  // the deployment default (OPENGENI_AGENT_INSTRUCTIONS_TEMPLATE /\n  // DEFAULT_AGENT_INSTRUCTIONS) is used. The runtime always injects the\n  // non-bypassable CORE (goal-loop ownership + variableSet block), so an\n  // override restyles the persona without dropping that contract.\n  agentInstructions: z.string().nullable(),\n  // Growth-ready per-workspace settings bag (migration 0045). Known keys are\n  // validated by WorkspaceSettingsSchema; unknown keys are preserved across\n  // PATCH merges so newer settings survive an older server.\n  settings: z.record(z.string(), z.unknown()),\n  inferenceControl: z.object({\n    state: z.enum([\"active\", \"paused\"]),\n    revision: z.number().int().nonnegative(),\n    reason: z.string().nullable(),\n    changedBy: z.string().nullable(),\n    changedAt: z.string().nullable(),\n  }),\n  // Workspace default rig used by session/scheduled-task create fallback.\n  defaultRigId: z.string().uuid().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type Workspace = z.infer<typeof Workspace>;\n\nexport const WorkspaceTranscriptionTarget = z\n  .object({\n    provider: z.string().trim().min(1).max(128),\n    model: z.string().trim().min(1).max(256).nullable(),\n    credentialMode: z.enum([\"managed\", \"byok\"]),\n    // A workspace-scoped connection reference, never credential material.\n    credentialConnectionId: z.string().uuid().nullable(),\n    region: z.string().trim().min(1).max(128).nullable(),\n  })\n  .strict()\n  .superRefine((target, context) => {\n    if (target.provider === \"azure-speech\" && target.credentialMode !== \"byok\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"credentialMode\"],\n        message: \"Azure Speech is supported only through workspace BYOK\",\n      });\n    }\n    if (target.credentialMode === \"byok\" && target.credentialConnectionId === null) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"credentialConnectionId\"],\n        message: \"BYOK transcription targets require a workspace connection reference\",\n      });\n    }\n    if (target.credentialMode === \"managed\" && target.credentialConnectionId !== null) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"credentialConnectionId\"],\n        message: \"managed transcription targets cannot name a BYOK connection\",\n      });\n    }\n  });\nexport type WorkspaceTranscriptionTarget = z.infer<typeof WorkspaceTranscriptionTarget>;\n\nexport const TranscriptionErrorCode = z.enum([\n  \"permission_denied\",\n  \"not_supported\",\n  \"network\",\n  \"provider\",\n  \"policy_blocked\",\n  \"timeout\",\n  \"cancelled\",\n  \"unknown\",\n]);\nexport type TranscriptionErrorCode = z.infer<typeof TranscriptionErrorCode>;\n\nexport const TranscriptionTimeSpan = z\n  .object({\n    startMilliseconds: z.number().finite().nonnegative(),\n    endMilliseconds: z.number().finite().nonnegative(),\n  })\n  .strict()\n  .superRefine((span, context) => {\n    if (span.endMilliseconds < span.startMilliseconds) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"endMilliseconds\"],\n        message: \"transcription spans must not end before they start\",\n      });\n    }\n  });\nexport type TranscriptionTimeSpan = z.infer<typeof TranscriptionTimeSpan>;\n\nexport const TranscriptionSpeaker = z\n  .object({\n    id: z.string().trim().min(1).max(128),\n    label: z.string().trim().min(1).max(128).optional(),\n  })\n  .strict();\nexport type TranscriptionSpeaker = z.infer<typeof TranscriptionSpeaker>;\n\nexport const TranscriptionWord = z\n  .object({\n    text: z.string().min(1).max(4096),\n    span: TranscriptionTimeSpan,\n    confidence: z.number().finite().min(0).max(1).optional(),\n    speaker: TranscriptionSpeaker.optional(),\n  })\n  .strict();\nexport type TranscriptionWord = z.infer<typeof TranscriptionWord>;\n\nexport const TranscriptionResultMetadata = z\n  .object({\n    detectedLanguage: z.string().trim().min(1).max(64).optional(),\n    span: TranscriptionTimeSpan.optional(),\n    confidence: z.number().finite().min(0).max(1).optional(),\n    speaker: TranscriptionSpeaker.optional(),\n    words: z.array(TranscriptionWord).max(10_000).optional(),\n  })\n  .strict()\n  .superRefine((metadata, context) => {\n    let previousStart = -1;\n    for (const [index, word] of (metadata.words ?? []).entries()) {\n      if (word.span.startMilliseconds < previousStart) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"words\", index, \"span\", \"startMilliseconds\"],\n          message: \"transcription words must be ordered by start time\",\n        });\n      }\n      previousStart = word.span.startMilliseconds;\n      if (\n        metadata.span &&\n        (word.span.startMilliseconds < metadata.span.startMilliseconds ||\n          word.span.endMilliseconds > metadata.span.endMilliseconds)\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"words\", index, \"span\"],\n          message: \"transcription word spans must fall within the result span\",\n        });\n      }\n    }\n  });\nexport type TranscriptionResultMetadata = z.infer<typeof TranscriptionResultMetadata>;\n\nconst TranscriptionEventBase = z\n  .object({\n    localSessionId: z.string().min(1).max(256),\n    sequence: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),\n    occurredAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\n\n/** Strict provider-neutral event surface; provider payload bags are rejected. */\nexport const TranscriptionEvent = z.discriminatedUnion(\"type\", [\n  TranscriptionEventBase.extend({ type: z.literal(\"permission.requested\") }),\n  TranscriptionEventBase.extend({\n    type: z.literal(\"session.opened\"),\n    providerSessionId: z.string().min(1).max(512),\n  }),\n  TranscriptionEventBase.extend({\n    type: z.literal(\"transcript.partial\"),\n    segmentId: z.string().min(1).max(512),\n    text: z.string().max(1_000_000),\n    metadata: TranscriptionResultMetadata.optional(),\n  }),\n  TranscriptionEventBase.extend({\n    type: z.literal(\"transcript.final\"),\n    segmentId: z.string().min(1).max(512),\n    text: z.string().max(1_000_000),\n    providerAcceptanceId: z.string().min(1).max(512),\n    metadata: TranscriptionResultMetadata.optional(),\n  }),\n  TranscriptionEventBase.extend({\n    type: z.literal(\"usage\"),\n    audioMilliseconds: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),\n    costUsd: z.number().finite().nonnegative().max(1_000_000_000).nullable(),\n  }),\n  TranscriptionEventBase.extend({\n    type: z.literal(\"session.reconnecting\"),\n    attempt: z.number().int().nonnegative().max(10_000),\n    reason: z.string().min(1).max(256),\n  }),\n  TranscriptionEventBase.extend({\n    type: z.literal(\"session.error\"),\n    code: TranscriptionErrorCode,\n    recoverable: z.boolean(),\n  }),\n  TranscriptionEventBase.extend({\n    type: z.literal(\"session.closed\"),\n    reason: z.enum([\"completed\", \"cancelled\", \"error\", \"replaced\"]),\n  }),\n]);\nexport type TranscriptionEvent = z.infer<typeof TranscriptionEvent>;\n\n/**\n * Workspace-only policy for the distinct speech-to-text capability. It never\n * authorizes a turn model/provider and contains connection references rather\n * than secrets. `acceptanceId` changes whenever an admin accepts a new target\n * set, so clients can bind a microphone session to one exact policy revision.\n */\nexport const WorkspaceTranscriptionPolicy = z\n  .object({\n    enabled: z.boolean(),\n    acceptanceId: z.string().uuid().nullable(),\n    primary: WorkspaceTranscriptionTarget.nullable(),\n    language: z.string().trim().min(1).max(64).nullable(),\n    autoDetectLanguage: z.boolean(),\n    diarization: z\n      .object({\n        enabled: z.boolean(),\n        maxSpeakers: z.number().int().min(2).max(100).nullable(),\n      })\n      .strict(),\n    retention: z\n      .object({\n        mode: z.enum([\"none\", \"provider-policy\"]),\n        maxDays: z.number().int().nonnegative().max(3650).nullable(),\n      })\n      .strict(),\n    privacy: z\n      .object({\n        allowProviderLogging: z.boolean(),\n        allowProviderTraining: z.boolean(),\n      })\n      .strict(),\n    fallback: z\n      .object({\n        mode: z.enum([\"disabled\", \"explicit\"]),\n        targets: z.array(WorkspaceTranscriptionTarget).max(8),\n      })\n      .strict(),\n    cost: z\n      .object({\n        currency: z.literal(\"USD\"),\n        maxPerHour: z.number().finite().nonnegative().max(10_000).nullable(),\n        maxPerMonth: z.number().finite().nonnegative().max(1_000_000).nullable(),\n      })\n      .strict(),\n  })\n  .strict()\n  .superRefine((policy, context) => {\n    if (policy.enabled && policy.acceptanceId === null) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"acceptanceId\"],\n        message: \"enabled transcription requires an accepted policy identity\",\n      });\n    }\n    if (policy.enabled && policy.primary === null) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"primary\"],\n        message: \"enabled transcription requires a primary target\",\n      });\n    }\n    if (policy.enabled && !policy.autoDetectLanguage && policy.language === null) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"language\"],\n        message: \"enabled transcription requires a language or accepted automatic detection\",\n      });\n    }\n    if (policy.autoDetectLanguage && policy.language !== null) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"language\"],\n        message: \"automatic language detection and a fixed language are mutually exclusive\",\n      });\n    }\n    if (!policy.diarization.enabled && policy.diarization.maxSpeakers !== null) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"diarization\", \"maxSpeakers\"],\n        message: \"disabled diarization cannot retain a speaker limit\",\n      });\n    }\n    if (policy.fallback.mode === \"disabled\" && policy.fallback.targets.length > 0) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"fallback\", \"targets\"],\n        message: \"disabled fallback cannot retain accepted targets\",\n      });\n    }\n    if (policy.fallback.mode === \"explicit\" && policy.fallback.targets.length === 0) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"fallback\", \"targets\"],\n        message: \"explicit fallback requires at least one accepted target\",\n      });\n    }\n    const targetKeys = [policy.primary, ...policy.fallback.targets]\n      .filter((target): target is WorkspaceTranscriptionTarget => target !== null)\n      .map((target) =>\n        [\n          target.provider,\n          target.model ?? \"\",\n          target.credentialMode,\n          target.credentialConnectionId ?? \"\",\n          target.region ?? \"\",\n        ].join(\"\\u0000\"),\n      );\n    if (new Set(targetKeys).size !== targetKeys.length) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"fallback\", \"targets\"],\n        message: \"transcription targets must be unique\",\n      });\n    }\n  });\nexport type WorkspaceTranscriptionPolicy = z.infer<typeof WorkspaceTranscriptionPolicy>;\n\n// Validates the KNOWN keys of workspaces.settings; passthrough keeps unknown\n// (future) keys rather than stripping them. memoryEnabled and transcription are\n// both default-off capabilities.\nexport const WorkspaceSettingsSchema = z\n  .object({\n    memoryEnabled: z.boolean().optional(),\n    transcription: WorkspaceTranscriptionPolicy.optional(),\n    // null clears the workspace override and falls back to the persisted\n    // deployment policy. The database boundary validates the same range.\n    maxNestedAgentDepth: NestedAgentDepthValue.nullable().optional(),\n  })\n  .passthrough();\nexport type WorkspaceSettings = z.infer<typeof WorkspaceSettingsSchema>;\n\n// Resolve the effective memoryEnabled flag from a raw settings bag (default off).\nexport function resolveWorkspaceMemoryEnabled(settings: unknown): boolean {\n  const parsed = WorkspaceSettingsSchema.safeParse(settings ?? {});\n  return parsed.success ? parsed.data.memoryEnabled === true : false;\n}\n\n// PATCH body for workspace settings: a partial top-level patch that merges into\n// the stored bag. Nested transcription policy updates are therefore full\n// replacements; passthrough carries forward-compatible unknown keys.\nexport const UpdateWorkspaceSettingsRequest = z\n  .object({\n    memoryEnabled: z.boolean().optional(),\n    transcription: WorkspaceTranscriptionPolicy.optional(),\n    maxNestedAgentDepth: NestedAgentDepthValue.nullable().optional(),\n  })\n  .passthrough();\nexport type UpdateWorkspaceSettingsRequest = z.infer<typeof UpdateWorkspaceSettingsRequest>;\n\nexport const SetWorkspaceDefaultRigRequest = z.object({\n  rigId: z.string().uuid().nullable(),\n});\nexport type SetWorkspaceDefaultRigRequest = z.infer<typeof SetWorkspaceDefaultRigRequest>;\n\n// PUT body for the workspace model policy (full replace, not a merge). null (or\n// omitted) = unrestricted for that dimension; an EMPTY array is a valid,\n// explicit total block. Entries are provider ids / exact model ids as the\n// router resolves them (see evaluateWorkspaceModelPolicy).\nexport const UpdateWorkspaceModelPolicyRequest = z.object({\n  allowedProviders: z.array(z.string().min(1).max(128)).max(64).nullable().optional(),\n  allowedModels: z.array(z.string().min(1).max(256)).max(256).nullable().optional(),\n});\nexport type UpdateWorkspaceModelPolicyRequest = z.infer<typeof UpdateWorkspaceModelPolicyRequest>;\n\nconst turnInitiatorIdentityFields = {\n  subjectId: z.string().min(1),\n  /** Immutable display snapshot; never an authorization input. */\n  label: z.string().min(1).optional(),\n} as const;\n\n/** Reserved creator/initiator id used only by legacy-row migration defaults. */\nexport const UNATTRIBUTED_LEGACY_INITIATOR_SUBJECT_ID = \"unattributed-legacy\" as const;\n\n/**\n * A named machine/service principal asserted by a trusted embedding host. This\n * deliberately excludes `kind: \"subject\"`: a delegated service assertion may\n * describe causal machine work, but it is not a generic human-impersonation\n * mechanism. The authenticated grant remains the authorization boundary.\n */\nexport const ServiceTurnInitiator = z.object({\n  kind: z.literal(\"service\"),\n  subjectId: z\n    .string()\n    .min(1)\n    .max(1024)\n    .refine((value) => value !== UNATTRIBUTED_LEGACY_INITIATOR_SUBJECT_ID, {\n      message: \"unattributed-legacy is reserved for migrated rows\",\n    }),\n  /** Immutable display snapshot; never an authorization input. */\n  label: z.string().min(1).max(256).optional(),\n});\nexport type ServiceTurnInitiator = z.infer<typeof ServiceTurnInitiator>;\n\n/**\n * Immutable, non-secret provenance captured with an initiator. This is audit\n * context (for example an external occurrence id), not a second identity or\n * authorization surface.\n */\nexport const TurnInitiatorContext = z.record(z.string(), z.unknown());\nexport type TurnInitiatorContext = z.infer<typeof TurnInitiatorContext>;\n\nconst reservedServiceTurnInitiatorContextKeys = new Set([\n  \"backfill\",\n  \"label\",\n  \"provenanceError\",\n  \"via\",\n  \"viaTruncated\",\n]);\n\n/** Bounded host provenance that cannot forge OpenGeni-owned lineage fields. */\nexport const ServiceTurnInitiatorContext = TurnInitiatorContext.superRefine((value, ctx) => {\n  for (const key of reservedServiceTurnInitiatorContextKeys) {\n    if (Object.prototype.hasOwnProperty.call(value, key)) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: [key],\n        message: `${key} is reserved OpenGeni initiator context`,\n      });\n    }\n  }\n  try {\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 4096) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: \"service initiator context exceeds 4096 UTF-8 bytes\",\n      });\n    }\n  } catch {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      message: \"service initiator context must be JSON-serializable\",\n    });\n  }\n});\nexport type ServiceTurnInitiatorContext = z.infer<typeof ServiceTurnInitiatorContext>;\n\nexport const AccountGrant = z.object({\n  accountId: z.string().uuid(),\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().optional(),\n  role: AccountRole.optional(),\n  permissions: z.array(Permission),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\nexport type AccountGrant = z.infer<typeof AccountGrant>;\n\nexport const AccessGrant = z.object({\n  workspaceId: z.string().uuid(),\n  accountId: z.string().uuid(),\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().optional(),\n  permissions: z.array(Permission),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n  // Optional trusted causal principal for a command submitted by an embedding\n  // host. Authorization still uses subjectId + permissions above.\n  serviceInitiator: ServiceTurnInitiator.optional(),\n  serviceInitiatorContext: ServiceTurnInitiatorContext.optional(),\n});\nexport type AccessGrant = z.infer<typeof AccessGrant>;\n\nexport const AccessContext = z.object({\n  mode: ProductAccessMode,\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().optional(),\n  accountGrants: z.array(AccountGrant),\n  workspaceGrants: z.array(AccessGrant),\n  defaultAccountId: z.string().uuid().nullable(),\n  defaultWorkspaceId: z.string().uuid().nullable(),\n});\nexport type AccessContext = z.infer<typeof AccessContext>;\n\nexport const DelegatedAccessTokenPayload = z\n  .object({\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    subjectId: z.string().min(1),\n    subjectLabel: z.string().optional(),\n    permissions: z.array(Permission).min(1),\n    // Trusted embedding hosts can sign a causal service principal separately\n    // from the grant subject that authorizes the request. The claim is consumed\n    // only when a command creates a new session/turn.\n    serviceInitiator: ServiceTurnInitiator.optional(),\n    serviceInitiatorContext: ServiceTurnInitiatorContext.optional(),\n    // Worker-asserted session scope for first-party MCP calls (HMAC-signed, not\n    // agent-controlled); enables session-scoped tools such as goal management.\n    sessionId: z.string().uuid().optional(),\n    // The turn making the call (the caller's identity), HMAC-signed by the worker\n    // at turn setup. Lets a tool classify WHO is calling from the token itself,\n    // instead of racily re-reading the session's live active_turn_id — e.g. the\n    // sacred-pause guard must know if the CALLER is a machine child-notification\n    // turn, and the active pointer can flip to another turn mid-check.\n    turnId: z.string().uuid().optional(),\n    // Exact execution owner. Agent control commands are accepted only while this\n    // attempt still owns the signed turn.\n    attemptId: z.string().uuid().optional(),\n    executionGeneration: z.number().int().positive().optional(),\n    exp: z.number().int().positive(),\n  })\n  .superRefine((payload, ctx) => {\n    if (payload.serviceInitiatorContext && !payload.serviceInitiator) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: [\"serviceInitiatorContext\"],\n        message: \"serviceInitiatorContext requires serviceInitiator\",\n      });\n    }\n    if (\n      payload.serviceInitiator &&\n      (payload.turnId !== undefined ||\n        payload.attemptId !== undefined ||\n        payload.executionGeneration !== undefined)\n    ) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: [\"serviceInitiator\"],\n        message: \"serviceInitiator cannot replace an exact agent-attempt initiator\",\n      });\n    }\n  });\nexport type DelegatedAccessTokenPayload = z.infer<typeof DelegatedAccessTokenPayload>;\n\nconst delegatedAccessTokenPrefix = \"ogd_\";\nconst delegatedServiceAccessTokenPrefix = \"ogd2_\";\n\nexport async function signDelegatedAccessToken(\n  secret: string,\n  payload: DelegatedAccessTokenPayload,\n): Promise<string> {\n  const parsed = DelegatedAccessTokenPayload.parse(payload);\n  const prefix = parsed.serviceInitiator\n    ? delegatedServiceAccessTokenPrefix\n    : delegatedAccessTokenPrefix;\n  const encodedPayload = base64UrlEncode(JSON.stringify(parsed));\n  // The service-capable envelope binds its prefix into the signature. An old\n  // verifier accepts only ogd_ and therefore fails closed during a rolling\n  // deploy; changing ogd2_ to ogd_ cannot turn provenance loss into success.\n  const signature = await hmacSha256Base64Url(\n    secret,\n    prefix === delegatedServiceAccessTokenPrefix ? `${prefix}${encodedPayload}` : encodedPayload,\n  );\n  return `${prefix}${encodedPayload}.${signature}`;\n}\n\nexport async function verifyDelegatedAccessToken(\n  secret: string,\n  token: string,\n  nowSeconds = Math.floor(Date.now() / 1000),\n): Promise<DelegatedAccessTokenPayload | null> {\n  const prefix = token.startsWith(delegatedServiceAccessTokenPrefix)\n    ? delegatedServiceAccessTokenPrefix\n    : token.startsWith(delegatedAccessTokenPrefix)\n      ? delegatedAccessTokenPrefix\n      : null;\n  if (!prefix) {\n    return null;\n  }\n  const withoutPrefix = token.slice(prefix.length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(\n    secret,\n    prefix === delegatedServiceAccessTokenPrefix ? `${prefix}${encodedPayload}` : encodedPayload,\n  );\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(base64UrlDecode(encodedPayload));\n  } catch {\n    return null;\n  }\n  const payload = DelegatedAccessTokenPayload.safeParse(decoded);\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  if (\n    (prefix === delegatedServiceAccessTokenPrefix) !==\n    (payload.data.serviceInitiator !== undefined)\n  ) {\n    return null;\n  }\n  return payload.data;\n}\n\n// --- Enrollment bearer credential (bring-your-own-compute M5) ---\n//\n// The signed bearer the agent presents to the control plane after enrollment (the\n// EnrollmentCredentials.bearer the poll returns). REUSES the SAME HMAC envelope as\n// the delegated/stream tokens (base64Url payload + hmacSha256Base64Url) with a\n// distinct `oge_` prefix so it can never be confused with an `ogd_` access token or\n// an `ogs_` stream token. It binds (workspaceId, agentId, enrollmentId) so the\n// control plane can verify the agent owns the subject `agent.<ws>.<id>` it\n// subscribes to. Signed with resolveEnrollmentSigningSecret; the secret value is\n// NEVER logged. The real per-workspace NATS Account creds binding is infra-deferred\n// (M4/relay) — this bearer is the application-tier identity proof.\nexport const EnrollmentBearerPayload = z.object({\n  workspaceId: z.string().uuid(),\n  agentId: z.string().uuid(),\n  enrollmentId: z.string().uuid(),\n  // The Account-scoped control-plane subject prefix the agent subscribes to.\n  subjectPrefix: z.string().min(1),\n  exp: z.number().int().positive(),\n});\nexport type EnrollmentBearerPayload = z.infer<typeof EnrollmentBearerPayload>;\n\nexport async function signEnrollmentBearer(\n  secret: string,\n  payload: EnrollmentBearerPayload,\n): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(EnrollmentBearerPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `oge_${encodedPayload}.${signature}`;\n}\n\nexport async function verifyEnrollmentBearer(\n  secret: string,\n  token: string,\n  nowSeconds = Math.floor(Date.now() / 1000),\n): Promise<EnrollmentBearerPayload | null> {\n  if (!token.startsWith(\"oge_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"oge_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  const payload = EnrollmentBearerPayload.safeParse(JSON.parse(base64UrlDecode(encodedPayload)));\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\n// --- Non-interactive enroll token (self-hosted enrollment UX §A2.1) ----------\n//\n// The SHORT-TTL, secret, workspace-scoped token the headless/fleet enroll path\n// presents to /v1/enrollments/token/exchange. The token IS the grant — there is\n// no human approve step — so it is stateless-signed (no DB row): the holder of an\n// unexpired token can enroll ONE machine identity into ONE workspace.\n//\n// It REUSES the SAME HMAC envelope as signEnrollmentBearer (base64Url payload +\n// hmacSha256Base64Url) with a DISTINCT `oget_` prefix and a `typ: \"enroll\"` claim.\n// DOMAIN SEPARATION: even though it shares the signing secret with the `oge_`\n// bearer, the prefix + typ claim make an enroll token unusable as an `oge_`\n// bearer (verifyEnrollmentBearer's `oge_` prefix check rejects it) and vice-versa\n// (verifyEnrollToken's `oget_` prefix + typ check rejects an `oge_` bearer). The\n// secret value is NEVER logged.\nexport const EnrollTokenPayload = z.object({\n  // Domain-separation claim — fixed \"enroll\" so an `oge_`/`ogd_`/`ogs_` payload (no\n  // typ, or a different typ) can never satisfy verifyEnrollToken even past the prefix.\n  typ: z.literal(\"enroll\"),\n  workspaceId: z.string().uuid(),\n  accountId: z.string().uuid(),\n  // The screen-control consent baked into the token at mint (the minting user's\n  // decision); the exchange records it as consentedScreenControl on the enrollment.\n  allowScreenControl: z.boolean(),\n  iat: z.number().int().nonnegative(),\n  exp: z.number().int().positive(),\n});\nexport type EnrollTokenPayload = z.infer<typeof EnrollTokenPayload>;\n\nexport async function signEnrollToken(\n  secret: string,\n  payload: EnrollTokenPayload,\n): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(EnrollTokenPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `oget_${encodedPayload}.${signature}`;\n}\n\n/**\n * Verify an enroll token: rejects (returns null) on a bad prefix (NOT `oget_`),\n * a malformed envelope, a bad HMAC signature (constant-time), schema-invalid\n * claims (which includes `typ !== \"enroll\"` — the `z.literal` rejects it), or an\n * expired token (`exp < now`). Mirrors verifyEnrollmentBearer exactly. An `oge_`\n * bearer fails the prefix gate; a same-secret token that lacks the typ claim fails\n * the schema gate — both halves of the domain separation are enforced here.\n */\nexport async function verifyEnrollToken(\n  secret: string,\n  token: string,\n  nowSeconds = Math.floor(Date.now() / 1000),\n): Promise<EnrollTokenPayload | null> {\n  if (!token.startsWith(\"oget_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"oget_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(base64UrlDecode(encodedPayload));\n  } catch {\n    return null;\n  }\n  const payload = EnrollTokenPayload.safeParse(decoded);\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\n// --- Scoped data-plane stream token (sandbox contract §C.3 / crosscut PART 1.3) ---\n//\n// REUSES the existing HMAC envelope (sign/verifyDelegatedAccessToken's\n// base64Url + hmacSha256Base64Url) — NOT a second crypto — but with a distinct\n// `ogs_` prefix and a HARD-NARROW claim set. The token is a CLAIM the OpenGeni\n// control plane mints; it is NOT the provider's tunnel secret. The browser\n// receives { providerUrl, streamToken }; the provider tunnel URL is the\n// transport, the streamToken is what the in-box edge validates (websockify\n// TokenFile is later-hardening; in v1 the URL's short TTL + the acknowledged\n// stream:view gate are the real boundary). The token is minted + recorded\n// against the holder from day one. It is NEVER appended to the URL as a query\n// param (the provider's own scoped token already lives in the URL).\n//\n// `leaseEpoch` is the fence: when the box is re-elected (warming→warm bumps the\n// epoch) the URL is re-minted with epoch+1 and the old tunnel is torn down, so a\n// stale token points at a dead tunnel. Epoch mismatch is enforced at USE (by the\n// caller comparing the claim against the live lease), not inside verify.\nexport const StreamTokenPayload = z.object({\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  // Identifies the sandbox_lease_holders row (the viewer holder).\n  viewerId: z.string().uuid(),\n  // Fence: the token logically dies when the box is re-elected (epoch++).\n  leaseEpoch: z.number().int().nonnegative(),\n  // v1 is always \"view\"; \"control\" is the never-granted raw-input plane.\n  mode: z.enum([\"view\", \"control\"]),\n  // 6080 (noVNC); pins the token to ONE exposed port.\n  port: z.number().int().positive(),\n  // Short TTL (120s default); rotation is event-driven under the epoch fence,\n  // not on a keepalive clock.\n  exp: z.number().int().positive(),\n});\nexport type StreamTokenPayload = z.infer<typeof StreamTokenPayload>;\n\nexport async function signStreamToken(\n  secret: string,\n  payload: StreamTokenPayload,\n): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(StreamTokenPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `ogs_${encodedPayload}.${signature}`;\n}\n\n/**\n * Verify a stream token: rejects (returns null) on a bad prefix, malformed\n * envelope, bad HMAC signature (constant-time), schema-invalid claims, or an\n * expired token (`exp < now`). Mirrors verifyDelegatedAccessToken exactly.\n *\n * The epoch fence (claim.leaseEpoch vs the LIVE lease epoch) and the\n * workspace/session scope are checked by the CALLER at use against the live\n * lease + route params — verify proves the token is authentic + unexpired, the\n * caller proves it is for THIS box's current epoch and THIS workspace+session.\n */\nexport async function verifyStreamToken(\n  secret: string,\n  token: string,\n  nowSeconds = Math.floor(Date.now() / 1000),\n): Promise<StreamTokenPayload | null> {\n  if (!token.startsWith(\"ogs_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"ogs_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(base64UrlDecode(encodedPayload));\n  } catch {\n    return null;\n  }\n  const payload = StreamTokenPayload.safeParse(decoded);\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\n// --- Relay PRODUCER token (bring-your-own-compute M8b) ---\n//\n// The token the AGENT presents to the relay edge when it registers a pty/desktop\n// stream channel (role=AGENT) — distinct from the viewer's `ogs_` token. It is\n// minted by the control plane at enrollment and threaded into EnrollmentCredentials\n// (proto field `relay_token`); the relay verifies it on its own merits, then pairs\n// the producer with the consumer by the shared channel key.\n//\n// REUSES the EXACT SAME HMAC envelope as the `ogs_`/`ogd_`/`oge_` tokens\n// (base64Url JSON payload + hmacSha256Base64Url) — NOT a second crypto — with a\n// distinct `ogr_` prefix so it can never be confused with the others. The claim\n// set binds (workspaceId, agentId): the relay reads the channel-key's ws+agent\n// from the StreamOpen and asserts the producer token claims the SAME pair, so a\n// producer token for workspace A can never register a channel for workspace B.\n// Signed with resolveRelayTokenSecret (the relay-token HMAC secret); the value is\n// NEVER logged. Long-lived by design (it is enrollment-scoped, not per-stream —\n// the agent presents it on every channel registration for the life of the\n// enrollment); the relay additionally validates the channel key + (for the\n// viewer's `ogs_`) the lease/active-epoch fence.\n//\n// The Rust relay re-implements this verify (the same base64url(JSON) + HMAC-SHA256\n// + prefix split) so TS-mint and Rust-verify provably agree — see the cross-stack\n// fixture in agent/crates/opengeni-relay/tests and the relay's `token` module doc.\nexport const RelayTokenPayload = z.object({\n  // The workspace the agent (and its channels) belong to — the relay asserts this\n  // equals the channel-key's ws so a producer can only register its own channels.\n  workspaceId: z.string().uuid(),\n  // The agent (machine) id — the relay asserts this equals the channel-key's agent.\n  agentId: z.string().uuid(),\n  // Expiry (unix seconds). Enrollment-scoped horizon (re-minted on re-enroll).\n  exp: z.number().int().positive(),\n});\nexport type RelayTokenPayload = z.infer<typeof RelayTokenPayload>;\n\nexport async function signRelayToken(secret: string, payload: RelayTokenPayload): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(RelayTokenPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `ogr_${encodedPayload}.${signature}`;\n}\n\n/**\n * Verify a relay producer token: rejects (returns null) on a bad prefix, malformed\n * envelope, bad HMAC signature (constant-time), schema-invalid claims, or expiry.\n * Mirrors verifyStreamToken exactly. The relay (Rust) re-implements this verify;\n * the TS verify here proves the format for the cross-stack fixture + any TS caller.\n *\n * The channel-key scope (claim.workspaceId/agentId vs the StreamOpen channel key)\n * is enforced by the relay at USE — verify proves authenticity + freshness only.\n */\nexport async function verifyRelayToken(\n  secret: string,\n  token: string,\n  nowSeconds = Math.floor(Date.now() / 1000),\n): Promise<RelayTokenPayload | null> {\n  if (!token.startsWith(\"ogr_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"ogr_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(base64UrlDecode(encodedPayload));\n  } catch {\n    return null;\n  }\n  const payload = RelayTokenPayload.safeParse(decoded);\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\nexport const CreateWorkspaceRequest = z.object({\n  accountId: z.string().uuid().optional(),\n  name: z.string().min(1),\n  slug: z.string().min(1).optional(),\n  externalSource: z.string().min(1).optional(),\n  externalId: z.string().min(1).optional(),\n  // White-label persona override for this workspace's agent. null/omitted uses\n  // the deployment default template.\n  agentInstructions: z.string().min(1).nullable().optional(),\n});\nexport type CreateWorkspaceRequest = z.infer<typeof CreateWorkspaceRequest>;\n\nexport const UpdateWorkspaceRequest = z.object({\n  name: z.string().min(1).optional(),\n  slug: z.string().min(1).nullable().optional(),\n  // White-label persona override. Pass null to clear it back to the deployment\n  // default; omit to leave it unchanged.\n  agentInstructions: z.string().min(1).nullable().optional(),\n});\nexport type UpdateWorkspaceRequest = z.infer<typeof UpdateWorkspaceRequest>;\n\nexport const ApiKey = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid().nullable(),\n  name: z.string(),\n  prefix: z.string(),\n  permissions: z.array(Permission),\n  expiresAt: z.string().nullable(),\n  revokedAt: z.string().nullable(),\n  lastUsedAt: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ApiKey = z.infer<typeof ApiKey>;\n\nexport const CreateApiKeyRequest = z.object({\n  name: z.string().min(1),\n  workspaceId: z.string().uuid().optional(),\n  permissions: z.array(Permission).min(1),\n  expiresAt: z.string().datetime({ offset: true }).optional(),\n});\nexport type CreateApiKeyRequest = z.infer<typeof CreateApiKeyRequest>;\n\nexport const CreateApiKeyResponse = z.object({\n  apiKey: ApiKey,\n  token: z.string().min(1),\n});\nexport type CreateApiKeyResponse = z.infer<typeof CreateApiKeyResponse>;\n\n// A person (or API key) with access to a workspace: one workspace_memberships\n// row. `subjectId` is `user:<betterAuthUserId>` or `api_key:<id>`; the People\n// surface lists the `user:` subjects (api_key subjects belong to API keys).\nexport const WorkspaceMember = z.object({\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().nullable(),\n  role: z.string(),\n  permissions: z.array(Permission),\n  createdAt: z.string(),\n});\nexport type WorkspaceMember = z.infer<typeof WorkspaceMember>;\n\nexport const ListWorkspaceMembersResponse = z.object({\n  members: z.array(WorkspaceMember),\n});\nexport type ListWorkspaceMembersResponse = z.infer<typeof ListWorkspaceMembersResponse>;\n\nexport const AddWorkspaceMemberRequest = z.object({\n  // Resolved against the managed (Better Auth) users; email invites for\n  // not-yet-registered users are deferred, so an unknown email returns 404.\n  email: z.string().email(),\n  role: z.string().min(1).optional(),\n  permissions: z.array(Permission),\n});\nexport type AddWorkspaceMemberRequest = z.infer<typeof AddWorkspaceMemberRequest>;\n\nexport const UpdateWorkspaceMemberRequest = z.object({\n  role: z.string().min(1).optional(),\n  permissions: z.array(Permission),\n});\nexport type UpdateWorkspaceMemberRequest = z.infer<typeof UpdateWorkspaceMemberRequest>;\n\nexport const UsageEventType = z.enum([\n  \"agent_run.created\",\n  \"agent_run.completed\",\n  \"model.tokens\",\n  \"model.cost\",\n  \"file.uploaded\",\n  \"file.deleted\",\n  \"document.indexed\",\n  \"scheduled_task.fired\",\n  \"api_key.request\",\n  // --- sandbox warm-time metering (P2.1) ---\n  // Wall-clock seconds a box was warm — the billable warm-time meter. Accrued on\n  // the two stateless ticks (turn heartbeat + reaper sweep), idempotent on\n  // (sandbox_group_id, lease_epoch, tick) so a shared box (N sessions) is metered\n  // EXACTLY ONCE per tick (N sessions != N x bill). Orthogonal to model.tokens /\n  // model.cost (model API cost vs provider compute cost — both real, no overlap).\n  \"sandbox.warm_seconds\",\n  // usd_micros: warm-seconds x the per-provider per-second warm rate.\n  \"sandbox.warm_cost\",\n]);\nexport type UsageEventType = z.infer<typeof UsageEventType>;\n\nexport const UsageEvent = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  accountId: z.string().uuid(),\n  subjectId: z.string().nullable(),\n  eventType: UsageEventType,\n  quantity: z.number(),\n  unit: z.string(),\n  sourceResourceType: z.string().nullable(),\n  sourceResourceId: z.string().nullable(),\n  idempotencyKey: z.string(),\n  occurredAt: z.string(),\n  recordedAt: z.string(),\n  exportedToBillingAt: z.string().nullable(),\n  billingProviderEventId: z.string().nullable(),\n});\nexport type UsageEvent = z.infer<typeof UsageEvent>;\n\nexport const LimitAction = z.enum([\n  \"agent_run:create\",\n  \"tokens:consume\",\n  \"file:upload\",\n  \"document:index\",\n  \"schedule:create\",\n  \"workspace:create\",\n  \"api_key:create\",\n]);\nexport type LimitAction = z.infer<typeof LimitAction>;\n\nexport const StaticUsageLimits = z.object({\n  maxWorkspacesPerAccount: z.number().int().positive().optional(),\n  maxApiKeysPerWorkspace: z.number().int().positive().optional(),\n  maxSchedulesPerWorkspace: z.number().int().positive().optional(),\n  maxFileUploadBytes: z.number().int().positive().optional(),\n  maxMonthlyAgentRunsPerWorkspace: z.number().int().positive().optional(),\n  maxMonthlyTokensPerWorkspace: z.number().int().positive().optional(),\n  maxMonthlyCostMicrosPerAccount: z.number().int().positive().optional(),\n  maxDocumentIndexedChunksPerWorkspace: z.number().int().positive().optional(),\n});\nexport type StaticUsageLimits = z.infer<typeof StaticUsageLimits>;\n\nexport const EntitlementValue = z.union([z.boolean(), z.string(), z.number(), z.array(z.string())]);\nexport type EntitlementValue = z.infer<typeof EntitlementValue>;\n\nexport const Entitlements = z.record(z.string().min(1), EntitlementValue);\nexport type Entitlements = z.infer<typeof Entitlements>;\n\nexport const LimitDecision = z.discriminatedUnion(\"allowed\", [\n  z.object({ allowed: z.literal(true) }),\n  z.object({\n    allowed: z.literal(false),\n    code: z.string(),\n    message: z.string(),\n  }),\n]);\nexport type LimitDecision = z.infer<typeof LimitDecision>;\n\n// ============ P3 — Entitlements port (§7.5) ============\n//\n// The host-providable admission seam over OpenGeni's TWO existing admission\n// sites: the API edge (`checkLimit`/`requireLimit`, billing/limits.ts) AND the\n// worker edge (`ensureRunAllowed`, agent-turn.ts — both turn-entry and the\n// mid-stream budget valve). A host that owns its OWN ledger/meter binds this to\n// keep OpenGeni from re-deriving admission from its local ledger.\n//\n// CRITICAL CONTRACT: `admitRun` returns a transport-neutral allow/deny decision\n// (+ optional structured reason + the echoed quantity it admitted) and NEVER\n// exposes `getBillingBalance` or any ledger internals — the host's balance math\n// stays on the host side of the boundary. This is what lets the same port serve\n// both PUSH (host funds OpenGeni's ledger; admission is a LOCAL read of that\n// funded ledger) and PULL (a network callback to the host's own meter).\n//\n// `action` is a free `string` (NOT the internal `LimitAction` enum) so a host\n// meter can key on actions OpenGeni does not model. `quantity` is the units the\n// caller is about to consume (tokens, bytes, 1 run, …); the decision MAY echo\n// the admitted quantity so a PULL host can grant a partial allowance.\nexport const EntitlementDecision = z.discriminatedUnion(\"allowed\", [\n  z.object({ allowed: z.literal(true), quantity: z.number().optional() }),\n  z.object({\n    allowed: z.literal(false),\n    reason: z.string(),\n    code: z.string().optional(),\n    quantity: z.number().optional(),\n  }),\n]);\nexport type EntitlementDecision = z.infer<typeof EntitlementDecision>;\n\nexport type AdmitRunInput = {\n  accountId: string;\n  workspaceId: string;\n  action: string;\n  quantity: number;\n};\n\nexport type EntitlementsPort = {\n  admitRun(input: AdmitRunInput): Promise<EntitlementDecision>;\n};\n\nexport const GitCredentialProvider = z.enum([\"github\", \"gitlab\", \"azure_devops\"]);\nexport type GitCredentialProvider = z.infer<typeof GitCredentialProvider>;\n\n// Host-opaque identity for one independently mintable Git credential. It is\n// deliberately NOT constrained to a filesystem-safe alphabet: runtimes hash it\n// before using it in paths, command text, or environment variable names.\nexport const GitCredentialBindingId = z.string().min(1).max(256);\nexport type GitCredentialBindingId = z.infer<typeof GitCredentialBindingId>;\n\nexport const GitRepositoryAccess = z.enum([\"read\", \"write\"]);\nexport type GitRepositoryAccess = z.infer<typeof GitRepositoryAccess>;\n\nconst GitProviderRepositoryId = z.union([z.number().int().positive(), z.string().min(1)]);\n\nexport const GitCredentialRepositoryRef = z.object({\n  provider: GitCredentialProvider.optional(),\n  credentialBindingId: GitCredentialBindingId.optional(),\n  access: GitRepositoryAccess.optional(),\n  uri: z.string().min(1),\n  ref: z.string().min(1),\n  repositoryId: GitProviderRepositoryId.optional(),\n  installationId: GitProviderRepositoryId.optional(),\n  projectId: GitProviderRepositoryId.optional(),\n  connectionId: z.string().min(1).optional(),\n});\nexport type GitCredentialRepositoryRef = z.infer<typeof GitCredentialRepositoryRef>;\n\n// ============ connection-credential provider — Connection-credential provider (§7.6) ============\n//\n// The host-providable credential seam over OpenGeni's run-scoped credential\n// sites in the worker and API:\n//   - GIT credentials: run-scoped provider tokens minted in\n//     `sandboxEnvironmentForRun` (standalone self-mints GitHub App tokens from\n//     `settings`; embedded hosts can broker GitHub, GitLab, and Azure DevOps)\n//     and seeded off-manifest into sandbox token files for git + provider CLIs.\n//   - SANDBOX secrets: the decrypted variable set values loaded in\n//     `loadVariableSetForRun` (today decrypted with\n//     `environmentsEncryptionKeyBytes(settings)`).\n//   - MCP credentials: request-time transport headers for connection-backed\n//     servers, shared by normal model tools and Toolspace/Code Mode.\n//\n// In embedded/separate topologies the HOST owns these external connections\n// (its GitHub App, its secret vault + encryption key). When a host binds this\n// port, OpenGeni asks the host to mint/decrypt per-run instead of self-minting\n// from `settings`. Unset (standalone default) → byte-for-byte today's\n// self-mint.\n//\n// Workspace-scope cross-check (the host-mapping safety guardrail): a credential\n// provider returns the `workspaceId` it scoped the credential to, and the\n// activity ASSERTS it agrees with the run's workspace BEFORE injecting\n// any git provider token seed (or applying decrypted environment values). A host mapping bug that\n// returns tenant B's creds while the run is tenant A is thereby caught at the\n// seam, never silently injected into tenant A's sandbox.\n\nexport type GitCredentialsRequest = {\n  accountId: string;\n  workspaceId: string;\n  /** Immutable authority admitted with the turn requesting this credential. */\n  sessionId: string;\n  rootSessionId: string;\n  turnId: string;\n  attemptId: string;\n  executionGeneration: number;\n  initiator: TurnInitiator;\n  initiatorContext: TurnInitiatorContext;\n  // Provider defaults to \"github\" for the legacy request shape. GitHub-only\n  // hosts can keep reading installationId/repositoryIds exactly as before;\n  // provider-aware hosts should branch on this and repositoryRefs.\n  provider?: GitCredentialProvider;\n  // Present when the host supplied an explicit binding or when more than one\n  // independently mintable credential exists for this provider. A host must\n  // mint only this binding; OpenGeni never treats provider identity as enough\n  // to select among multiple accounts/installations.\n  credentialBindingId?: GitCredentialBindingId;\n  // Canonical lower-case host shared by this binding's repository refs when\n  // there is exactly one. Binding-aware providers echo it when present.\n  providerHost?: string;\n  // Token requests are the existing behavior. Identity requests let lazy\n  // sandbox provisioning resolve stable git author/committer identity before\n  // the box exists while deferring the rotating token value to first provision.\n  purpose?: \"token\" | \"identity\";\n  // Provider-neutral repository refs for hosts that broker non-GitHub tokens.\n  // For GitHub requests these are additive to the legacy fields below.\n  repositoryRefs?: GitCredentialRepositoryRef[];\n  // Legacy GitHub App installation shape retained for 0.x compatibility.\n  installationId: number;\n  repositoryIds: number[];\n};\n\n/**\n * One exact repository route exposed by a host-owned HTTPS smart-Git broker.\n *\n * `repositoryUri` must echo one URI from the request's `repositoryRefs`.\n * `brokerUri` is a stable, credential-free HTTPS remote. The rotating bearer\n * remains separate in `GitCredentials.token`, so it cannot leak through Git\n * configuration, provider-CLI arguments, manifests, or repository metadata.\n */\nexport type GitHttpBrokerRepositoryRoute = {\n  repositoryUri: string;\n  brokerUri: string;\n};\n\n/**\n * Optional transport override for credentials that cannot be safely narrowed\n * into a provider token. Omission retains the provider-token behavior.\n */\nexport type GitCredentialTransport = {\n  kind: \"http_broker\";\n  repositories: GitHttpBrokerRepositoryRoute[];\n};\n\nexport type GitCredentials = {\n  // The minted secret. For the default transport this is a provider token; for\n  // `http_broker` it is the broker bearer. Required for purpose=\"token\";\n  // optional for purpose=\"identity\" so hosts can return only stable git identity\n  // before lazy sandbox provision. The value never enters the manifest.\n  token?: string;\n  // A host-owned exact smart-Git transport for providers whose available token\n  // cannot be constrained to the selected repositories. OpenGeni rewrites only\n  // the echoed repository remotes and never exposes this bearer to provider\n  // CLIs. Omitted means the token is a direct provider credential.\n  transport?: GitCredentialTransport;\n  // workspace-scope cross-check echo: the workspace the provider scoped this token to. The activity\n  // asserts `workspaceId === request.workspaceId` before injecting.\n  workspaceId: string;\n  // Strict request echoes for binding-aware requests. OpenGeni validates these\n  // before accepting a token, preventing a host routing bug from returning a\n  // sibling connection's credential. They remain optional for legacy single-\n  // binding/provider hosts.\n  credentialBindingId?: GitCredentialBindingId;\n  provider?: GitCredentialProvider;\n  providerHost?: string;\n  // Optional provider expiry for host-managed proactive renewal. ISO-8601;\n  // null/omitted means the host does not expose a deadline and OpenGeni uses\n  // its conservative bounded refresh cadence instead.\n  expiresAt?: string | null;\n  // Optional git identity override. When omitted the activity falls back to\n  // today's `githubAppBotIdentity(settings)`.\n  identity?: { name: string; email: string } | null;\n};\n\nexport type SandboxSecretsRequest = {\n  accountId: string;\n  workspaceId: string;\n  // The variable set the run's session declares (null = unattached;\n  // the provider, like the self-mint path, returns null values for it).\n  variableSetId: string;\n};\n\nexport type SandboxSecrets = {\n  // The decrypted variableSet values the run injects, replacing the local\n  // `environmentsEncryptionKeyBytes` decrypt. Same shape the self-mint path\n  // produces (plaintext name→value).\n  values: Record<string, string>;\n  // workspace-scope cross-check echo: the workspace the provider scoped these secrets to.\n  workspaceId: string;\n  // Optional variableSet metadata; when omitted the activity uses the\n  // variableSetId as both id and name (the local decrypt carries the row's\n  // id/name/description, but only `id` is load-bearing downstream).\n  id?: string;\n  name?: string;\n  description?: string | null;\n};\n\nexport type CredentialAuthNeededReason =\n  | \"missing_connection\"\n  | \"expired\"\n  | \"insufficient_scope\"\n  | \"refresh_failed\";\n\n/**\n * Host-owned run credentials are materialized below one OpenGeni-owned sandbox\n * directory. Paths are relative POSIX names; the runtime validates traversal,\n * collisions, bounds, and modes before any content reaches a sandbox.\n */\nexport type RunCredentialFile = {\n  path: string;\n  content: string;\n  mode?: \"0400\" | \"0600\";\n};\n\nexport type RunCredentialAuthNeeded = {\n  reason: CredentialAuthNeededReason;\n  providerDomain?: string;\n  connectionId?: string;\n  scopes?: string[];\n  resource?: string;\n  authorizationUrl?: string;\n  /** Bounded non-secret guidance. Never place credential material here. */\n  message?: string;\n};\n\nexport type RunCredentialRedaction = {\n  /** Bounded diagnostic label used only in the replacement marker. */\n  name: string;\n  /** One atomic secret value that must be removed from streamed/audit output. */\n  value: string;\n};\n\nexport type RunCredentialsRequest = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  parentSessionId: string | null;\n  rootSessionId: string;\n  /** All sessions sharing this sandbox group share one OS/filesystem trust boundary. */\n  sandboxGroupId: string;\n  turnId: string;\n  attemptId: string;\n  executionGeneration: number;\n  /** Immutable authority admitted with this turn. */\n  initiator: TurnInitiator;\n  initiatorContext: TurnInitiatorContext;\n  effectiveSandboxBackend: SandboxBackend;\n  sandboxOs: SandboxOs;\n  purpose: \"provision\" | \"renewal\";\n  forceRefresh: boolean;\n  /** Informational standalone variable-set identity; never gates host resolution. */\n  variableSet: { id: string; name: string } | null;\n};\n\nexport type RunCredentialsResolution =\n  | {\n      /**\n       * The frozen target/attempt must not receive host material. Hosts use\n       * this for unsupported OSes/backends and policy-based opt-out; the\n       * decision must remain stable for the attempt.\n       */\n      status: \"not_applicable\";\n      accountId: string;\n      workspaceId: string;\n      sessionId: string;\n    }\n  | {\n      status: \"ok\";\n      /** Scope echoes are mandatory and checked before materialization. */\n      accountId: string;\n      workspaceId: string;\n      sessionId: string;\n      /** Secret environment values. Always delivered off-manifest. */\n      environment: Record<string, string>;\n      files?: RunCredentialFile[];\n      /** Environment name to one returned relative file path. */\n      fileEnvironment?: Record<string, string>;\n      /**\n       * Atomic sensitive values embedded inside credential files or derived\n       * material. Environment values are registered automatically; hosts list\n       * additional file-contained values here so chunked output is redacted.\n       */\n      redactions?: RunCredentialRedaction[];\n      /** Earliest material expiry. Null/omitted uses a bounded refresh cadence. */\n      expiresAt?: string | null;\n      /** Partial degradation: usable material may coexist with reconnect notices. */\n      authNeeded?: RunCredentialAuthNeeded[];\n    }\n  | {\n      status: \"auth_needed\";\n      accountId: string;\n      workspaceId: string;\n      sessionId: string;\n      authNeeded: RunCredentialAuthNeeded[];\n    };\n\nexport const McpConnectionResourceScope = z\n  .object({\n    /** Provider-stable repository identity, serialized as a string on the wire. */\n    id: z.string().min(1).max(512),\n    kind: z.literal(\"repository\"),\n  })\n  .strict();\nexport type McpConnectionResourceScope = z.infer<typeof McpConnectionResourceScope>;\n\nconst McpConnectionResourceScopes = z\n  .array(McpConnectionResourceScope)\n  .min(1)\n  .max(256)\n  .superRefine((resources, context) => {\n    const seen = new Set<string>();\n    for (const [index, resource] of resources.entries()) {\n      const key = `${resource.kind}\\0${resource.id}`;\n      if (seen.has(key)) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"selectedResources must not contain duplicates\",\n          path: [index],\n        });\n      }\n      seen.add(key);\n    }\n  });\n\nexport const McpServerConnectionRef = z\n  .object({\n    /** Opaque host or standalone connection identifier. */\n    connectionId: z.string().min(1).optional(),\n    /** Stable provider family (for example github, gitlab, or azure_devops). */\n    provider: z.string().min(1).max(128).optional(),\n    /** Provider host or tenant domain. */\n    providerDomain: z.string().min(1),\n    kind: z.enum([\"oauth2\", \"api_key\", \"app_install\", \"delegated\"]).optional(),\n    scopes: z.array(z.string().min(1)).optional(),\n    /** OAuth resource indicator. This is distinct from selectedResources. */\n    resource: z.string().min(1).optional(),\n    /** Exact provider resources this MCP binding is allowed to operate on. */\n    selectedResources: McpConnectionResourceScopes.optional(),\n    subjectScope: z.enum([\"workspace\", \"subject\"]).optional(),\n  })\n  .strict()\n  .superRefine((reference, context) => {\n    if (!reference.selectedResources) return;\n    if (!reference.connectionId) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"selectedResources requires connectionId\",\n        path: [\"connectionId\"],\n      });\n    }\n    if (!reference.provider) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"selectedResources requires provider\",\n        path: [\"provider\"],\n      });\n    }\n  });\nexport type McpServerConnectionRef = z.infer<typeof McpServerConnectionRef>;\n\nexport type McpCredentialsRequest = {\n  accountId: string;\n  workspaceId: string;\n  /** Immediate session whose model or Toolspace call needs the credential. */\n  sessionId: string;\n  /** Workspace-scoped lineage root for host authorization and binding lookup. */\n  rootSessionId: string;\n  turnId: string;\n  /** Null only while a durable turn exists without a currently executing attempt. */\n  attemptId: string | null;\n  executionGeneration: number;\n  /** The immutable authority that admitted this turn. Never substitute the sandbox caller. */\n  initiator: TurnInitiator;\n  initiatorContext: TurnInitiatorContext;\n  /** Immediate technical caller, retained only as non-authoritative audit context. */\n  callerSubjectId?: string;\n  surface: \"model\" | \"toolspace\";\n  /** Canonical MCP destination that will receive the resolved headers. */\n  destinationUrl: string;\n  serverId: string;\n  toolName?: string;\n  connectionRef: McpServerConnectionRef;\n  forceRefresh: boolean;\n};\n\nexport type McpCredentialAuthNeededReason =\n  | CredentialAuthNeededReason\n  | \"unsupported_auth\"\n  | \"resource_scope_unavailable\";\n\nexport type McpCredentialResolution =\n  | {\n      status: \"ok\";\n      /** Scope echoes are mandatory and verified before any header is used. */\n      accountId: string;\n      workspaceId: string;\n      sessionId: string;\n      headers: Record<string, string>;\n      connectionId: string;\n      providerDomain: string;\n      provider?: string;\n      scopes?: string[];\n      resource?: string;\n      selectedResources?: McpConnectionResourceScope[];\n      expiresAt?: string | null;\n    }\n  | {\n      status: \"auth_needed\";\n      /** Scope echoes are mandatory even when the credential cannot be resolved. */\n      accountId: string;\n      workspaceId: string;\n      sessionId: string;\n      reason: McpCredentialAuthNeededReason;\n      providerDomain: string;\n      provider?: string;\n      connectionId?: string;\n      scopes?: string[];\n      resource?: string;\n      selectedResources?: McpConnectionResourceScope[];\n      authorizationUrl?: string;\n    };\n\nexport type ConnectionCredentialsPort = {\n  // Every leg is optional: a host may drive only the credential classes it\n  // owns. An unset leg falls through to today's standalone implementation for\n  // that leg only.\n  gitCredentials?(input: GitCredentialsRequest): Promise<GitCredentials>;\n  sandboxSecrets?(input: SandboxSecretsRequest): Promise<SandboxSecrets>;\n  /**\n   * Resolve host-owned, session-aware sandbox credentials independently of an\n   * OpenGeni variable set. OpenGeni transports and renews the material; the host\n   * remains the sole owner of connection selection and credential policy.\n   */\n  runCredentials?(input: RunCredentialsRequest): Promise<RunCredentialsResolution>;\n  /**\n   * Resolve rotating MCP transport credentials at request time. Embedded hosts\n   * use this to keep their provider connection as the sole credential source;\n   * OpenGeni never requires a duplicate connection record. The same resolver is\n   * used by model-visible MCP tools and the additive Toolspace/Code Mode proxy.\n   */\n  mcpCredentials?(input: McpCredentialsRequest): Promise<McpCredentialResolution>;\n};\n\n// ============ connection-credential provider — GitHub App API port (BYO-App, §7.6 / GitHub credential prototype remainder) ===\n//\n// The host-driven GitHub-API credential leg. GitHub credential prototype closed the establishment +\n// gate (storage) axis; this closes the credential leg by making the live\n// GitHub-API calls host-PROVIDABLE so a BYO-GitHub-App host drives its OWN App\n// credentials (its own JWT-signing key, its own OAuth client) instead of\n// OpenGeni self-minting from `settings`:\n//   - authorizeUser: OAuth code exchange + user-visible installation and\n//     repository permission discovery. Retained for provider ABI compatibility;\n//     visibility is not proof of installation authority and core does not use\n//     this method for new workspace binding.\n//   - verifyInstallationAccessForUser: OAuth code→token + installation lookup,\n//     also retained for provider ABI compatibility and not used for binding.\n//   - getInstallation: retained in the provider ABI for compatibility. Direct\n//     existing-installation selection is fail-closed and core does not call\n//     this method for binding.\n//   - listRepositories: the installation-scoped repo listing behind\n//     `GET /v1/workspaces/:id/github/repositories` (today\n//     `listGitHubAppRepositories(settings, …)`).\n//\n// Unset (standalone default) → today's `settings`-based self-mint runs\n// byte-for-byte (the live GitHub-API verify/list against OpenGeni's own App).\n\nexport type GitHubInstallationSummary = {\n  installationId: number;\n  accountId: number;\n  accountLogin: string | null;\n  accountType: string | null;\n  suspended: boolean;\n};\n\nexport type GitHubInstallationAuthorityKind = \"personal_owner\" | \"organization_owner\";\n\nexport interface GitHubInstallationBindingProof {\n  actorId: number;\n  actorLogin: string;\n  authorityKind: GitHubInstallationAuthorityKind;\n  installation: GitHubInstallationSummary;\n  repositories: GitHubRepository[];\n}\n\nexport type GitHubRepositoryPermissions = {\n  admin: boolean;\n  maintain: boolean;\n  push: boolean;\n  triage: boolean;\n  pull: boolean;\n};\n\nexport type GitHubUserRepositoryAccess = GitHubRepository & {\n  permissions: GitHubRepositoryPermissions;\n};\n\nexport type GitHubUserInstallationAccess = GitHubInstallationSummary & {\n  repositories: GitHubUserRepositoryAccess[];\n};\n\nexport type GitHubAppApiPort = {\n  /**\n   * Exchange one fresh GitHub user-authorization code and prove current\n   * installation authority. Implementations must accept only exact personal\n   * ownership or active organization ownership; installation visibility,\n   * repository permission bits, and App Manager metadata are not authority.\n   * Organization ownership must be revalidated after repository discovery,\n   * immediately before returning the proof used by the durable bind.\n   */\n  authorizeInstallationBinding?: (input: {\n    code: string;\n    installationId: number;\n  }) => Promise<GitHubInstallationBindingProof>;\n  authorizeUser?: (input: { code: string }) => Promise<GitHubUserInstallationAccess[]>;\n  verifyInstallationAccessForUser?: (input: {\n    code: string;\n    installationId: number;\n  }) => Promise<GitHubInstallationSummary>;\n  getInstallation?: (input: {\n    installationId: number;\n  }) => Promise<GitHubInstallationSummary | null>;\n  listRepositories?: (input: { installationIds?: number[] }) => Promise<GitHubRepository[]>;\n};\n\nexport const BillingBalance = z.object({\n  accountId: z.string().uuid(),\n  balanceMicros: z.number().int(),\n  currency: z.literal(\"usd\"),\n  updatedAt: z.string(),\n});\nexport type BillingBalance = z.infer<typeof BillingBalance>;\n\nexport const CreateCheckoutRequest = z.object({\n  accountId: z.string().uuid().optional(),\n  amountUsd: z\n    .number()\n    .min(5)\n    .max(10_000)\n    .refine(\n      (value) => Number.isFinite(value) && Math.abs(value - Math.round(value * 100) / 100) < 1e-9,\n      { message: \"amountUsd must use cent precision\" },\n    ),\n  successUrl: z.string().url().optional(),\n  cancelUrl: z.string().url().optional(),\n});\nexport type CreateCheckoutRequest = z.infer<typeof CreateCheckoutRequest>;\n\nexport const CreateCheckoutResponse = z.object({\n  checkoutSessionId: z.string(),\n  url: z.string().url(),\n});\nexport type CreateCheckoutResponse = z.infer<typeof CreateCheckoutResponse>;\n\nexport const RepositoryResourceRef = z.object({\n  kind: z.literal(\"repository\"),\n  uri: z.string().min(1),\n  ref: z.string().min(1),\n  mountPath: z.string().min(1).optional(),\n  subpath: z.string().min(1).optional(),\n  provider: GitCredentialProvider.optional(),\n  credentialBindingId: GitCredentialBindingId.optional(),\n  access: GitRepositoryAccess.optional(),\n  repositoryId: GitProviderRepositoryId.optional(),\n  installationId: GitProviderRepositoryId.optional(),\n  projectId: GitProviderRepositoryId.optional(),\n  connectionId: z.string().min(1).optional(),\n  githubInstallationId: z.number().int().positive().optional(),\n  githubRepositoryId: z.number().int().positive().optional(),\n});\nexport type RepositoryResourceRef = z.infer<typeof RepositoryResourceRef>;\n\nfunction positiveGitProviderInteger(value: unknown): number | null {\n  if (typeof value === \"number\" && Number.isInteger(value) && value > 0) return value;\n  if (typeof value === \"string\" && /^\\d+$/.test(value) && Number(value) > 0) {\n    return Number(value);\n  }\n  return null;\n}\n\n/**\n * Resolve whether a repository participates in platform-brokered Git auth.\n * Provider-less public repositories return null; legacy GitHub aliases infer\n * GitHub only when both positive installation and repository ids are present.\n */\nexport function gitCredentialProviderForRepository(\n  resource: RepositoryResourceRef,\n): GitCredentialProvider | null {\n  if (resource.provider) return resource.provider;\n  if (\n    positiveGitProviderInteger(resource.githubInstallationId) &&\n    positiveGitProviderInteger(resource.githubRepositoryId)\n  ) {\n    return \"github\";\n  }\n  return null;\n}\n\n/**\n * Derive the one canonical runtime/broker identity for a repository credential.\n * Every consumer must use this helper so mint grouping, token filenames, and\n * credential-helper routing cannot diverge on legacy provider ids.\n */\nexport function gitCredentialBindingIdForRepository(\n  resource: RepositoryResourceRef,\n  provider: GitCredentialProvider | null = gitCredentialProviderForRepository(resource),\n): GitCredentialBindingId | null {\n  if (!provider) return null;\n  const installationId =\n    provider === \"github\"\n      ? positiveGitProviderInteger(resource.githubInstallationId ?? resource.installationId)\n      : null;\n  return (\n    resource.credentialBindingId ??\n    resource.connectionId ??\n    (installationId ? `github-installation:${installationId}` : provider)\n  );\n}\n\nexport const FileResourceRef = z.object({\n  kind: z.literal(\"file\"),\n  fileId: z.string().uuid(),\n  mountPath: z.string().min(1).optional(),\n});\nexport type FileResourceRef = z.infer<typeof FileResourceRef>;\n\nexport const ResourceRef = z.discriminatedUnion(\"kind\", [RepositoryResourceRef, FileResourceRef]);\nexport type ResourceRef = z.infer<typeof ResourceRef>;\n\nexport class ResourceMountPathError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResourceMountPathError\";\n  }\n}\n\n/**\n * Normalize one workspace-relative resource mount path for every runtime.\n *\n * Backslashes are treated as separators so a path cannot be harmless on Linux\n * but become traversal on a connected Windows machine. Empty, absolute,\n * drive-qualified, dot-segment, NUL-containing, and repeated-separator paths\n * fail closed instead of being silently reinterpreted.\n */\nexport function normalizeResourceMountPath(path: string): string {\n  const normalizedSeparators = path.trim().replace(/\\\\/g, \"/\");\n  if (\n    !normalizedSeparators ||\n    normalizedSeparators.startsWith(\"/\") ||\n    /^[A-Za-z]:\\//.test(normalizedSeparators) ||\n    normalizedSeparators.includes(\"\\0\")\n  ) {\n    throw new ResourceMountPathError(`invalid resource mount path: ${path}`);\n  }\n  const segments = normalizedSeparators.split(\"/\");\n  if (\n    segments.some(\n      (segment) =>\n        !segment ||\n        segment === \".\" ||\n        segment === \"..\" ||\n        /[<>:\"|?*\\u0000-\\u001f]/.test(segment) ||\n        /[ .]$/.test(segment) ||\n        /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\\.|$)/i.test(segment),\n    )\n  ) {\n    throw new ResourceMountPathError(`invalid resource mount path: ${path}`);\n  }\n  return segments.join(\"/\");\n}\n\n/** Normalize a repository-internal subpath while preserving legacy `/path/` input. */\nexport function normalizeRepositorySubpath(path: string): string {\n  const relative = path\n    .trim()\n    .replace(/\\\\/g, \"/\")\n    .replace(/^\\/+|\\/+$/g, \"\");\n  return normalizeResourceMountPath(relative);\n}\n\n/** A conservative collision identity that is portable to case-insensitive hosts. */\nexport function resourceMountPathCollisionKey(path: string): string {\n  return normalizeResourceMountPath(path).normalize(\"NFKC\").toLowerCase();\n}\n\n/**\n * Default repository mount identity. The normalized remote host (including a\n * non-default port) is part of the path, so equal owner/repo names on GitHub,\n * GitLab, Azure DevOps, or a custom host do not collide. Encoding the host keeps\n * IPv6/custom-port identities inside one portable path segment.\n */\nexport function defaultRepositoryMountPath(uri: string): string {\n  let url: URL;\n  try {\n    url = new URL(uri);\n  } catch {\n    throw new ResourceMountPathError(`invalid repository URI for mount path: ${uri}`);\n  }\n  if (url.protocol !== \"https:\" || !url.host) {\n    throw new ResourceMountPathError(`invalid repository URI for mount path: ${uri}`);\n  }\n  const repositoryPath = url.pathname.replace(/^\\/+|\\/+$/g, \"\").replace(/\\.git$/, \"\");\n  const segments = repositoryPath.split(\"/\").filter(Boolean);\n  if (segments.length < 2) {\n    throw new ResourceMountPathError(`repository URI must include owner and repo: ${uri}`);\n  }\n  return normalizeResourceMountPath(\n    `repos/${encodeURIComponent(url.host.toLowerCase())}/${segments.join(\"/\")}`,\n  );\n}\n\n/** Resolve the exact mount used by API normalization, manifests, and clone hooks. */\nexport function resourceMountPath(resource: ResourceRef): string {\n  if (resource.mountPath) return normalizeResourceMountPath(resource.mountPath);\n  return resource.kind === \"file\"\n    ? normalizeResourceMountPath(`files/${resource.fileId}`)\n    : defaultRepositoryMountPath(resource.uri);\n}\n\n/** Fail before sandbox execution when two resources share a portable path. */\nexport function assertUniqueResourceMountPaths(resources: readonly ResourceRef[]): void {\n  const mounted = new Set<string>();\n  for (const resource of resources) {\n    const path = resourceMountPath(resource);\n    const key = resourceMountPathCollisionKey(path);\n    if (mounted.has(key)) {\n      throw new ResourceRefConflictError(`resource mount path is already attached: ${path}`);\n    }\n    mounted.add(key);\n  }\n}\n\nexport const FileStatus = z.enum([\"pending_upload\", \"ready\", \"failed\", \"expired\", \"deleted\"]);\nexport type FileStatus = z.infer<typeof FileStatus>;\n\nexport const FileUploadStatus = z.enum([\n  \"pending\",\n  \"cleanup_pending\",\n  \"completed\",\n  \"expired\",\n  \"failed\",\n]);\nexport type FileUploadStatus = z.infer<typeof FileUploadStatus>;\n\nexport const FileAsset = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  status: FileStatus,\n  filename: z.string(),\n  safeFilename: z.string(),\n  contentType: z.string(),\n  sizeBytes: z.number().int().nonnegative(),\n  sha256: z.string().nullable(),\n  bucket: z.string(),\n  objectKey: z.string(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type FileAsset = z.infer<typeof FileAsset>;\n\nexport const CreateFileUploadRequest = z.object({\n  filename: z.string().min(1),\n  contentType: z.string().min(1),\n  sizeBytes: z.number().int().positive(),\n  sha256: z.string().min(1).optional(),\n});\nexport type CreateFileUploadRequest = z.infer<typeof CreateFileUploadRequest>;\n\nexport const CreateFileUploadResponse = z.object({\n  fileId: z.string().uuid(),\n  uploadId: z.string().uuid(),\n  putUrl: z.string().url(),\n  requiredHeaders: z.record(z.string(), z.string()),\n  expiresAt: z.string(),\n  maxSizeBytes: z.number().int().positive(),\n});\nexport type CreateFileUploadResponse = z.infer<typeof CreateFileUploadResponse>;\n\nexport const CompleteFileUploadResponse = z.object({\n  file: FileAsset,\n});\nexport type CompleteFileUploadResponse = z.infer<typeof CompleteFileUploadResponse>;\n\nexport const FileDownloadUrlResponse = z.object({\n  url: z.string().url(),\n  expiresAt: z.string(),\n});\nexport type FileDownloadUrlResponse = z.infer<typeof FileDownloadUrlResponse>;\n\nexport const DocumentStatus = z.enum([\"queued\", \"indexing\", \"ready\", \"failed\"]);\nexport type DocumentStatus = z.infer<typeof DocumentStatus>;\n\nexport const KnowledgeSourceKind = z.enum([\n  \"manual_upload\",\n  \"meeting_transcript\",\n  \"repository\",\n  \"email\",\n  \"chat\",\n  \"document\",\n  \"web\",\n  \"other\",\n]);\nexport type KnowledgeSourceKind = z.infer<typeof KnowledgeSourceKind>;\n\nexport const DocumentSearchMode = z.enum([\"hybrid\", \"vector\", \"keyword\"]);\nexport type DocumentSearchMode = z.infer<typeof DocumentSearchMode>;\n\n// 'workspace' documents are readable by anyone with workspace access;\n// 'private' documents are readable only by the grant subject that created them.\nexport const DocumentVisibility = z.enum([\"workspace\", \"private\"]);\nexport type DocumentVisibility = z.infer<typeof DocumentVisibility>;\n\n// Knowledge-drop auto-curation lifecycle. 'none' = ordinary caller-described add\n// (never auto-curated). 'pending' = dropped, curation runs during indexing.\n// 'suggested' = curated but the base move was NOT applied (low confidence or\n// conflict) — the suggestion lives in Document.curation. 'auto_filed' = curated\n// and moved into the suggested base. 'failed' = curation errored (fail-soft;\n// the document still indexes and stays searchable).\nexport const DocumentCurationStatus = z.enum([\n  \"none\",\n  \"pending\",\n  \"suggested\",\n  \"auto_filed\",\n  \"failed\",\n]);\nexport type DocumentCurationStatus = z.infer<typeof DocumentCurationStatus>;\n\n// Curator audit blob persisted on the document.\nexport const DocumentCuration = z.object({\n  suggestedBaseId: z.string().uuid().nullable(),\n  suggestedBaseName: z.string().nullable(),\n  confidence: z.number().min(0).max(1),\n  reason: z.string().nullable(),\n  originalTitle: z.string().nullable(),\n  model: z.string().nullable(),\n});\nexport type DocumentCuration = z.infer<typeof DocumentCuration>;\n\nexport const DocumentBase = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  name: z.string(),\n  description: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type DocumentBase = z.infer<typeof DocumentBase>;\n\nexport const Document = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  baseId: z.string().uuid(),\n  fileId: z.string().uuid(),\n  status: DocumentStatus,\n  title: z.string(),\n  parser: z.string(),\n  chunkCount: z.number().int().nonnegative(),\n  error: z.string().nullable(),\n  sourceKind: KnowledgeSourceKind,\n  sourceUri: z.string().nullable(),\n  sourceExternalId: z.string().nullable(),\n  sourceTitle: z.string().nullable(),\n  sourceAuthor: z.string().nullable(),\n  sourceCreatedAt: z.string().nullable(),\n  sourceUpdatedAt: z.string().nullable(),\n  sourceVersion: z.string().nullable(),\n  aclTags: z.array(z.string()),\n  visibility: DocumentVisibility,\n  createdBy: z.string().nullable(),\n  agentAccess: z.boolean(),\n  summary: z.string().nullable(),\n  topics: z.array(z.string()),\n  curationStatus: DocumentCurationStatus,\n  curation: DocumentCuration.nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type Document = z.infer<typeof Document>;\n\nexport const DocumentSearchResult = z.object({\n  chunkId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  documentId: z.string().uuid(),\n  baseId: z.string().uuid(),\n  fileId: z.string().uuid(),\n  title: z.string(),\n  text: z.string(),\n  score: z.number(),\n  matchType: DocumentSearchMode,\n  vectorScore: z.number().nullable(),\n  keywordScore: z.number().nullable(),\n  chunkIndex: z.number().int().nonnegative(),\n  metadata: z.record(z.string(), z.unknown()),\n  sourceKind: KnowledgeSourceKind,\n  sourceUri: z.string().nullable(),\n  sourceExternalId: z.string().nullable(),\n  sourceTitle: z.string().nullable(),\n  sourceAuthor: z.string().nullable(),\n  sourceCreatedAt: z.string().nullable(),\n  sourceUpdatedAt: z.string().nullable(),\n  sourceVersion: z.string().nullable(),\n  aclTags: z.array(z.string()),\n});\nexport type DocumentSearchResult = z.infer<typeof DocumentSearchResult>;\n\nexport const CreateDocumentBaseRequest = z.object({\n  name: z.string().min(1),\n  description: z.string().optional(),\n});\nexport type CreateDocumentBaseRequest = z.infer<typeof CreateDocumentBaseRequest>;\n\nexport const AddDocumentRequest = z.object({\n  fileId: z.string().uuid(),\n  title: z.string().min(1).optional(),\n  sourceKind: KnowledgeSourceKind.optional(),\n  sourceUri: z.string().min(1).optional(),\n  sourceExternalId: z.string().min(1).optional(),\n  sourceTitle: z.string().min(1).optional(),\n  sourceAuthor: z.string().min(1).optional(),\n  sourceCreatedAt: z.string().datetime({ offset: true }).optional(),\n  sourceUpdatedAt: z.string().datetime({ offset: true }).optional(),\n  sourceVersion: z.string().min(1).optional(),\n  aclTags: z.array(z.string().min(1)).optional(),\n  visibility: DocumentVisibility.optional(),\n  agentAccess: z.boolean().optional(),\n});\nexport type AddDocumentRequest = z.infer<typeof AddDocumentRequest>;\n\n// A knowledge drop: raw text or an already-uploaded file, with no required\n// metadata. The server files it into the workspace Default base. When a\n// curation provider is enabled, it may name, summarize, categorize, and\n// (confidence permitting) move the document; provider=none leaves caller\n// metadata and Default placement unchanged.\nexport const CreateKnowledgeDropRequest = z\n  .object({\n    text: z.string().min(1).max(2_000_000).optional(),\n    fileId: z.string().uuid().optional(),\n    filename: z.string().min(1).optional(),\n    title: z.string().min(1).optional(),\n    visibility: DocumentVisibility.optional(),\n    agentAccess: z.boolean().optional(),\n  })\n  .refine((value) => (value.text === undefined) !== (value.fileId === undefined), {\n    message: \"provide exactly one of text or fileId\",\n  });\nexport type CreateKnowledgeDropRequest = z.infer<typeof CreateKnowledgeDropRequest>;\n\n// Move a document (and its indexed chunks) to another base. With no explicit\n// targetBaseId, applies the document's stored curation suggestion.\nexport const MoveDocumentRequest = z.object({\n  targetBaseId: z.string().uuid().optional(),\n});\nexport type MoveDocumentRequest = z.infer<typeof MoveDocumentRequest>;\n\nexport const DocumentSearchRequest = z.object({\n  query: z.string().min(1),\n  baseIds: z.array(z.string().uuid()).optional(),\n  mode: DocumentSearchMode.optional(),\n  sourceKinds: z.array(KnowledgeSourceKind).optional(),\n  aclTags: z.array(z.string().min(1)).optional(),\n  limit: z.number().int().positive().max(50).default(5),\n});\nexport type DocumentSearchRequest = z.infer<typeof DocumentSearchRequest>;\n\n// proposed/approved/rejected are the legacy curated-knowledge review states\n// (docs-MCP memory_propose lane). active/superseded/archived are Workspace\n// Memory V1: agent-written memories land `active` (usable immediately — human is\n// auditor, not gatekeeper), get `superseded` when replaced, `archived` when\n// retired. Agent-visible set = active ∪ approved.\nexport const KnowledgeMemoryStatus = z.enum([\n  \"proposed\",\n  \"approved\",\n  \"rejected\",\n  \"active\",\n  \"superseded\",\n  \"archived\",\n]);\nexport type KnowledgeMemoryStatus = z.infer<typeof KnowledgeMemoryStatus>;\n\nexport const KnowledgeMemoryKind = z.enum([\n  \"semantic\",\n  \"episodic\",\n  \"procedural\",\n  \"decision\",\n  \"preference\",\n]);\nexport type KnowledgeMemoryKind = z.infer<typeof KnowledgeMemoryKind>;\n\nexport const KnowledgeSourceRef = z.object({\n  kind: z.enum([\"document_chunk\", \"document\", \"session_event\", \"memory\", \"external\"]),\n  id: z.string().min(1),\n  uri: z.string().min(1).optional(),\n  title: z.string().min(1).optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type KnowledgeSourceRef = z.infer<typeof KnowledgeSourceRef>;\n\nexport const KnowledgeMemory = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  status: KnowledgeMemoryStatus,\n  kind: KnowledgeMemoryKind,\n  scope: z.string(),\n  text: z.string(),\n  sourceRefs: z.array(KnowledgeSourceRef),\n  confidence: z.number().min(0).max(1),\n  metadata: z.record(z.string(), z.unknown()),\n  createdBySessionId: z.string().uuid().nullable(),\n  reviewedBy: z.string().nullable(),\n  reviewedAt: z.string().nullable(),\n  // Workspace Memory V1 fields. usageCount/lastUsedAt feed end-state ranking and\n  // decay; supersedesId/supersededById link correction chains; validFrom/validUntil\n  // are the point-in-time window. embedding/embeddingModel/textHash are internal\n  // and never exposed on the wire.\n  pinned: z.boolean(),\n  usageCount: z.number().int(),\n  lastUsedAt: z.string().nullable(),\n  supersedesId: z.string().uuid().nullable(),\n  supersededById: z.string().uuid().nullable(),\n  validFrom: z.string(),\n  validUntil: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type KnowledgeMemory = z.infer<typeof KnowledgeMemory>;\n\n// Default status is `active`: a create through this request lands an\n// agent-visible memory via the one write gate (saveWorkspaceMemory). Passing an\n// explicit `proposed`/`approved`/`rejected` status routes to the legacy curated\n// create instead (the docs-MCP memory_propose lane). pinned/replacesId apply to\n// the active (memory) path.\nexport const CreateKnowledgeMemoryRequest = z.object({\n  status: KnowledgeMemoryStatus.default(\"active\"),\n  kind: KnowledgeMemoryKind.default(\"semantic\"),\n  scope: z.string().min(1).default(\"workspace\"),\n  text: z.string().min(1),\n  sourceRefs: z.array(KnowledgeSourceRef).default([]),\n  confidence: z.number().min(0).max(1).default(0.5),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  createdBySessionId: z.string().uuid().optional(),\n  pinned: z.boolean().optional(),\n  replacesId: z.string().min(1).optional(),\n});\nexport type CreateKnowledgeMemoryRequest = z.infer<typeof CreateKnowledgeMemoryRequest>;\n\nexport const UpdateKnowledgeMemoryRequest = z.object({\n  status: KnowledgeMemoryStatus.optional(),\n  kind: KnowledgeMemoryKind.optional(),\n  scope: z.string().min(1).optional(),\n  text: z.string().min(1).optional(),\n  sourceRefs: z.array(KnowledgeSourceRef).optional(),\n  confidence: z.number().min(0).max(1).optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n  reviewedBy: z.string().min(1).optional(),\n  // Human audit action: pin (never decays) / unpin.\n  pinned: z.boolean().optional(),\n});\nexport type UpdateKnowledgeMemoryRequest = z.infer<typeof UpdateKnowledgeMemoryRequest>;\n\n// GET list/filter over knowledge memories (curated + memory).\nexport const KnowledgeMemorySearchRequest = z.object({\n  query: z.string().min(1).optional(),\n  status: KnowledgeMemoryStatus.optional(),\n  kind: KnowledgeMemoryKind.optional(),\n  scope: z.string().min(1).optional(),\n  limit: z.number().int().positive().max(100).default(20),\n});\nexport type KnowledgeMemorySearchRequest = z.infer<typeof KnowledgeMemorySearchRequest>;\n\nexport const WorkspaceMemorySearchMode = z.enum([\"hybrid\", \"vector\", \"keyword\"]);\nexport type WorkspaceMemorySearchMode = z.infer<typeof WorkspaceMemorySearchMode>;\n\n// POST hybrid search over the workspace's agent-visible memory (active ∪ approved).\nexport const WorkspaceMemorySearchRequest = z.object({\n  query: z.string().min(1),\n  kind: KnowledgeMemoryKind.optional(),\n  limit: z.number().int().positive().max(20).optional(),\n  mode: WorkspaceMemorySearchMode.optional(),\n});\nexport type WorkspaceMemorySearchRequest = z.infer<typeof WorkspaceMemorySearchRequest>;\n\nexport const WorkspaceMemorySearchResult = z.object({\n  memory: KnowledgeMemory,\n  score: z.number(),\n  matchType: WorkspaceMemorySearchMode,\n  vectorScore: z.number().nullable(),\n  keywordScore: z.number().nullable(),\n});\nexport type WorkspaceMemorySearchResult = z.infer<typeof WorkspaceMemorySearchResult>;\n\nexport const WorkspaceMemorySearchResponse = z.object({\n  results: z.array(WorkspaceMemorySearchResult),\n});\nexport type WorkspaceMemorySearchResponse = z.infer<typeof WorkspaceMemorySearchResponse>;\n\nexport const ToolRef = z.object({\n  kind: z.literal(\"mcp\"),\n  id: z.string().min(1),\n  // Non-fatal-on-connect marker for MCP server refs that can degrade\n  // gracefully. Absent/false is STRICT: the id must be configured and an\n  // unavailable server fails the turn. `optional:true` is preserved for known\n  // servers and makes runtime connect/list failures skip that server; if the\n  // deployment does not configure the id, validation drops the ref. The server\n  // also sets this for auto-attached workspace-default capability MCPs.\n  optional: z.boolean().optional(),\n});\nexport type ToolRef = z.infer<typeof ToolRef>;\n\nconst registryId = /^[A-Za-z0-9_-]+$/;\nexport const SessionMcpServerId = z.string().min(1).regex(registryId);\nexport type SessionMcpServerId = z.infer<typeof SessionMcpServerId>;\n\n// How a session's persisted `tools` snapshot was selected. `legacy` is\n// reserved for rows written before this descriptor existed; those rows must\n// keep their materialized historical allow-list rather than being guessed to\n// mean either omitted or explicitly empty.\nexport const SessionToolPolicy = z.object({\n  mode: z.enum([\"workspace_default\", \"explicit\", \"inherited\", \"legacy\"]),\n  inheritedFromSessionId: z.string().uuid().nullable(),\n});\nexport type SessionToolPolicy = z.infer<typeof SessionToolPolicy>;\n\nexport const SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT = 64;\nexport const SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH = 200;\nconst SessionEffectiveToolPolicyId = z\n  .string()\n  .min(1)\n  .max(SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH)\n  .regex(registryId);\nconst SessionEffectiveToolPolicyIds = z\n  .array(SessionEffectiveToolPolicyId)\n  .max(SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT);\n\n// Secret-safe, read-time policy truth. This projection contains only bounded\n// MCP registry ids and exact counts: never URLs, names, headers, credentials,\n// connector configuration, or tool schemas. IDs are samples when capped;\n// counts remain exact and idsTruncated makes that explicit to clients.\nexport const SessionEffectiveToolPolicy = z\n  .object({\n    mode: z.enum([\"workspace_default\", \"explicit\", \"inherited\", \"legacy\"]),\n    inheritedFromSessionId: z.string().uuid().nullable(),\n    selectedIds: SessionEffectiveToolPolicyIds,\n    effectiveIds: SessionEffectiveToolPolicyIds,\n    mandatoryIds: SessionEffectiveToolPolicyIds,\n    lazyRouter: z\n      .object({\n        state: z.enum([\"required\", \"disabled\"]),\n        deferredIds: SessionEffectiveToolPolicyIds,\n      })\n      .strict(),\n    configuredIds: SessionEffectiveToolPolicyIds,\n    droppedIds: SessionEffectiveToolPolicyIds,\n    counts: z\n      .object({\n        selected: z.number().int().nonnegative(),\n        effective: z.number().int().nonnegative(),\n        mandatory: z.number().int().nonnegative(),\n        deferred: z.number().int().nonnegative(),\n        configured: z.number().int().nonnegative(),\n        dropped: z.number().int().nonnegative(),\n      })\n      .strict(),\n    idsTruncated: z.boolean(),\n  })\n  .strict();\nexport type SessionEffectiveToolPolicy = z.infer<typeof SessionEffectiveToolPolicy>;\nconst httpsUrl = z\n  .string()\n  .url()\n  .refine(\n    (value) => {\n      try {\n        return new URL(value).protocol === \"https:\";\n      } catch {\n        return false;\n      }\n    },\n    { message: \"URL must use https\" },\n  );\n\n/**\n * Human-approval policy for one MCP server. `true` gates every tool, `false`\n * gates none, and a list gates only those unprefixed names.\n */\nexport const SESSION_MCP_APPROVAL_POLICY_MAX_TOOL_NAMES = 2_048;\nexport const SESSION_MCP_APPROVAL_POLICY_MAX_BYTES = 256 * 1024;\nexport const SESSION_MCP_APPROVAL_TOOL_NAME_MAX_BYTES = 1_024;\nexport const SESSION_MCP_SERVERS_MAX = 64;\n\nconst sessionMcpApprovalToolName = z\n  .string()\n  .min(1)\n  .superRefine((name, ctx) => {\n    if (new TextEncoder().encode(name).byteLength > SESSION_MCP_APPROVAL_TOOL_NAME_MAX_BYTES) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: `MCP approval tool names must be at most ${SESSION_MCP_APPROVAL_TOOL_NAME_MAX_BYTES} UTF-8 bytes`,\n      });\n    }\n  });\nconst selectiveSessionMcpApprovalPolicy = z\n  .array(sessionMcpApprovalToolName)\n  .max(SESSION_MCP_APPROVAL_POLICY_MAX_TOOL_NAMES)\n  .superRefine((names, ctx) => {\n    const bytes = names.reduce(\n      (total, name) => total + new TextEncoder().encode(name).byteLength,\n      0,\n    );\n    if (bytes > SESSION_MCP_APPROVAL_POLICY_MAX_BYTES) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: `MCP approval policies must be at most ${SESSION_MCP_APPROVAL_POLICY_MAX_BYTES} UTF-8 bytes`,\n      });\n    }\n  })\n  .transform((names) => [...new Set(names)].sort());\nexport const SessionMcpApprovalPolicy = z.union([z.boolean(), selectiveSessionMcpApprovalPolicy]);\nexport type SessionMcpApprovalPolicy = z.infer<typeof SessionMcpApprovalPolicy>;\n\nexport const SessionMcpServerInput = z.object({\n  id: SessionMcpServerId,\n  name: z.string().min(1).optional(),\n  url: httpsUrl,\n  allowedTools: z.array(z.string().min(1)).optional(),\n  timeoutMs: z.number().int().positive().optional(),\n  cacheToolsList: z.boolean().optional(),\n  // The caller resolves an approval pause with `user.approvalDecision`.\n  requireApproval: SessionMcpApprovalPolicy.optional(),\n  // Write-only credential headers. Values are encrypted at rest and never\n  // returned in session responses or events; response metadata exposes names.\n  headers: z.record(z.string(), z.string()).optional(),\n  // Non-secret opaque pointer resolved at request time by the standalone\n  // connection broker or an embedding host's mcpCredentials port.\n  connectionRef: McpServerConnectionRef.optional(),\n});\nexport type SessionMcpServerInput = z.infer<typeof SessionMcpServerInput>;\n\nexport const SessionMcpCredentialUpdateInput = z.object({\n  id: SessionMcpServerId,\n  headers: z.record(z.string(), z.string()),\n});\nexport type SessionMcpCredentialUpdateInput = z.infer<typeof SessionMcpCredentialUpdateInput>;\n\nexport const SessionMcpServerMetadata = z\n  .object({\n    id: SessionMcpServerId,\n    name: z.string().min(1).nullable(),\n    url: httpsUrl,\n    headerNames: z.array(z.string()).default([]),\n    credentialVersion: z.number().int().positive(),\n    requireApproval: SessionMcpApprovalPolicy.default(false),\n    connectionRef: McpServerConnectionRef.nullable().default(null),\n  })\n  .strict();\nexport type SessionMcpServerMetadata = z.infer<typeof SessionMcpServerMetadata>;\n\nexport const UpdateSessionMcpApprovalPolicyRequest = z\n  .object({\n    requireApproval: SessionMcpApprovalPolicy,\n  })\n  .strict();\nexport type UpdateSessionMcpApprovalPolicyRequest = z.infer<\n  typeof UpdateSessionMcpApprovalPolicyRequest\n>;\n\nexport const UpdateSessionMcpApprovalPolicyResponse = z\n  .object({\n    server: SessionMcpServerMetadata,\n    effectiveFrom: z.literal(\"next_attempt\"),\n  })\n  .strict();\nexport type UpdateSessionMcpApprovalPolicyResponse = z.infer<\n  typeof UpdateSessionMcpApprovalPolicyResponse\n>;\n\nexport class ResourceRefConflictError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResourceRefConflictError\";\n  }\n}\n\nexport function mergeToolRefs(existing: ToolRef[], additions: ToolRef[]): ToolRef[] {\n  const byKey = new Map<string, ToolRef>();\n  const order: string[] = [];\n  for (const tool of [...existing, ...additions]) {\n    const key = `${tool.kind}:${tool.id}`;\n    const prior = byKey.get(key);\n    if (!prior) {\n      byKey.set(key, tool);\n      order.push(key);\n      continue;\n    }\n    // Strict wins: if the same server appears both optional and strict, the\n    // strict occurrence upgrades the merged ref so an unavailable server fails\n    // the turn. This preserves the fail-loud default when defaults, packs, and\n    // per-turn tool selections are combined.\n    if (prior.optional === true && tool.optional !== true) {\n      const { optional: _dropped, ...strict } = prior;\n      byKey.set(key, strict);\n    }\n  }\n  return order.map((key) => byKey.get(key)!);\n}\n\nexport function mergeResourceRefs(\n  existing: ResourceRef[],\n  additions: ResourceRef[],\n  options: { rejectConflicts?: boolean } = {},\n): ResourceRef[] {\n  if (options.rejectConflicts) {\n    assertUniqueResourceMountPaths(existing);\n  }\n  const out = [...existing];\n  const mountPaths = new Map(\n    existing.map(\n      (resource) =>\n        [resourceMountPathCollisionKey(resourceMountPath(resource)), stableJson(resource)] as const,\n    ),\n  );\n  const identities = new Map(\n    existing.map((resource) => [resourceIdentityKey(resource), stableJson(resource)] as const),\n  );\n  const exact = new Set(existing.map(stableJson));\n\n  for (const resource of additions) {\n    const serialized = stableJson(resource);\n    if (exact.has(serialized)) {\n      continue;\n    }\n    if (options.rejectConflicts) {\n      const mountPath = resourceMountPath(resource);\n      const existingAtMount = mountPaths.get(resourceMountPathCollisionKey(mountPath));\n      if (existingAtMount && existingAtMount !== serialized) {\n        throw new ResourceRefConflictError(`resource mount path is already attached: ${mountPath}`);\n      }\n      const identity = resourceIdentityKey(resource);\n      const existingIdentity = identities.get(identity);\n      if (existingIdentity && existingIdentity !== serialized) {\n        throw new ResourceRefConflictError(\n          `resource is already attached with different settings: ${identity}`,\n        );\n      }\n    }\n    out.push(resource);\n    exact.add(serialized);\n    identities.set(resourceIdentityKey(resource), serialized);\n    mountPaths.set(resourceMountPathCollisionKey(resourceMountPath(resource)), serialized);\n  }\n  return out;\n}\n\nexport function reasoningEffortForMetadata(\n  metadata: Record<string, unknown>,\n  fallback: ReasoningEffort,\n): ReasoningEffort {\n  const value = metadata.reasoningEffort;\n  return value === \"none\" ||\n    value === \"minimal\" ||\n    value === \"low\" ||\n    value === \"medium\" ||\n    value === \"high\" ||\n    value === \"xhigh\"\n    ? value\n    : fallback;\n}\n\nexport function stableJson(value: unknown): string {\n  return JSON.stringify(sortJson(value));\n}\n\nexport function resourceIdentityKey(resource: ResourceRef): string {\n  if (resource.kind === \"file\") {\n    return `file:${resource.fileId}`;\n  }\n  return `repository:${resource.uri}`;\n}\n\nfunction sortJson(value: unknown): unknown {\n  if (Array.isArray(value)) {\n    return value.map(sortJson);\n  }\n  if (value && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value)\n        .sort(([a], [b]) => a.localeCompare(b))\n        .map(([key, nested]) => [key, sortJson(nested)]),\n    );\n  }\n  return value;\n}\n\nexport const SessionTurnStatus = z.enum([\n  \"queued\",\n  \"running\",\n  \"requires_action\",\n  \"recovering\",\n  \"waiting_capacity\",\n  \"completed\",\n  \"failed\",\n  \"cancelled\",\n  \"superseded\",\n  \"withdrawn_for_edit\",\n]);\nexport type SessionTurnStatus = z.infer<typeof SessionTurnStatus>;\n\nexport const SessionTurnSource = z.enum([\n  \"user\",\n  \"scheduled_task\",\n  \"api\",\n  \"goal\",\n  \"system\",\n  \"compaction\",\n]);\nexport type SessionTurnSource = z.infer<typeof SessionTurnSource>;\n\nexport const SessionControlState = z.enum([\"active\", \"paused\"]);\nexport type SessionControlState = z.infer<typeof SessionControlState>;\n\nexport const WorkspaceInferenceState = z.enum([\"active\", \"paused\"]);\nexport type WorkspaceInferenceState = z.infer<typeof WorkspaceInferenceState>;\n\nexport const SessionGoalStatus = z.enum([\"active\", \"paused\", \"completed\"]);\nexport type SessionGoalStatus = z.infer<typeof SessionGoalStatus>;\n\nexport const SessionGoalCreatedBy = z.enum([\"api\", \"agent\", \"scheduled_task\"]);\nexport type SessionGoalCreatedBy = z.infer<typeof SessionGoalCreatedBy>;\n\nexport const SessionGoalPausedReason = z.enum([\n  \"agent\",\n  \"user_pause\",\n  \"api\",\n  \"no_progress\",\n  \"max_auto_continuations\",\n  \"limits\",\n]);\nexport type SessionGoalPausedReason = z.infer<typeof SessionGoalPausedReason>;\n\nexport const SessionGoalContinuationState = z.enum([\n  \"inactive\",\n  \"scheduled\",\n  \"running\",\n  \"blocked\",\n  \"invariant_broken\",\n]);\nexport type SessionGoalContinuationState = z.infer<typeof SessionGoalContinuationState>;\n\nexport const SessionGoalContinuationReason = z.enum([\n  \"goal_inactive\",\n  \"wake_pending\",\n  \"continuation_pending\",\n  \"human_work_pending\",\n  \"goal_turn_running\",\n  \"human_turn_running\",\n  \"workstream_paused\",\n  \"approval_required\",\n  \"provider_backpressure\",\n  \"session_cancelled\",\n  \"system_work_pending\",\n  \"missing_obligation\",\n]);\nexport type SessionGoalContinuationReason = z.infer<typeof SessionGoalContinuationReason>;\n\nexport const SessionGoalContinuation = z.object({\n  state: SessionGoalContinuationState,\n  reason: SessionGoalContinuationReason,\n  wakeRevision: z.number().int().nonnegative(),\n  observedRevision: z.number().int().nonnegative(),\n  nextAttemptAt: z.string().datetime({ offset: true }).nullable(),\n  lastError: z.string().nullable(),\n});\nexport type SessionGoalContinuation = z.infer<typeof SessionGoalContinuation>;\n\nexport const SessionGoal = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  status: SessionGoalStatus,\n  text: z.string(),\n  successCriteria: z.string().nullable(),\n  evidence: z.string().nullable(),\n  rationale: z.string().nullable(),\n  pausedReason: z.string().nullable(),\n  createdBy: SessionGoalCreatedBy,\n  version: z.number().int().positive(),\n  autoContinuations: z.number().int().nonnegative(),\n  noProgressStreak: z.number().int().nonnegative(),\n  maxAutoContinuations: z.number().int().positive().nullable(),\n  metadata: z.record(z.string(), z.unknown()),\n  // Optional for source compatibility with older clients; the API always\n  // supplies this authoritative continuation projection.\n  continuation: SessionGoalContinuation.optional(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type SessionGoal = z.infer<typeof SessionGoal>;\n\nexport const GoalSpec = z.object({\n  text: z.string().min(1),\n  successCriteria: z.string().min(1).optional(),\n  maxAutoContinuations: z.number().int().positive().optional(),\n});\nexport type GoalSpec = z.infer<typeof GoalSpec>;\n\nexport const UpdateSessionGoalRequest = z.object({\n  status: z.enum([\"paused\", \"active\"]),\n  rationale: z.string().min(1).optional(),\n});\nexport type UpdateSessionGoalRequest = z.infer<typeof UpdateSessionGoalRequest>;\n\nexport const UpdateSessionRequest = z.object({\n  title: z.string().min(1).max(200),\n});\nexport type UpdateSessionRequest = z.infer<typeof UpdateSessionRequest>;\n\n/**\n * Replace an existing session's durable tool policy, or explicitly opt back in\n * to the current workspace defaults. The mode-less explicit shape is retained\n * for compatibility with clients released before workspace-default adoption\n * was supported.\n */\nexport const UpdateSessionToolPolicyRequest = z.union([\n  z\n    .object({\n      mode: z.literal(\"workspace_default\"),\n      expectedVersion: z.number().int().positive(),\n    })\n    .strict(),\n  z\n    .object({\n      mode: z.literal(\"explicit\").optional(),\n      tools: z.array(ToolRef).max(64),\n      expectedVersion: z.number().int().positive(),\n    })\n    .strict(),\n]);\nexport type UpdateSessionToolPolicyRequest = z.infer<typeof UpdateSessionToolPolicyRequest>;\n\n/**\n * A member's personal pin preference for a session. `expectedVersion` is\n * optional: ordinary pin/unpin actions are idempotent last-write-wins, while a\n * client that has a known version can fail closed rather than overwrite a newer\n * action from another browser.\n */\nexport const UpdateSessionPinRequest = z.object({\n  pinned: z.boolean(),\n  expectedVersion: z.number().int().nonnegative().optional(),\n});\nexport type UpdateSessionPinRequest = z.infer<typeof UpdateSessionPinRequest>;\n\n// Operator context controls (slash-command palette: /clear, /compact). These\n// are session/operator actions, NOT a structured way to talk to the agent —\n// the human↔agent channel stays plain chat. Both require `sessions:control`.\n\n/**\n * Clear a session's conversation context. `confirm` must be the literal `true`\n * so an accidental/empty POST cannot wipe context — the destructive intent is\n * explicit on the wire, mirroring the client-side confirm affordance.\n */\nexport const ClearSessionContextRequest = z.object({\n  confirm: z.literal(true),\n});\nexport type ClearSessionContextRequest = z.infer<typeof ClearSessionContextRequest>;\n\n/**\n * The marker key on the sentinel run-state blob written by a context clear. The\n * blob ({@link CLEARED_RUN_STATE_BLOB}) is NOT a real Agents-SDK serialized run\n * state — it carries no `$schemaVersion`/history, so `RunState.fromString` would\n * throw on it. Every read path that deserializes a run-state blob MUST first\n * check {@link isClearedRunStateBlob} and treat a match as \"no prior state\"\n * (a fresh, empty start), which is exactly what a clear means. This is the\n * shared contract that keeps the db (writer) and the runtime (reader) in sync.\n */\nexport const CLEARED_RUN_STATE_MARKER = \"$opengeniCleared\" as const;\n\n/** The canonical sentinel serializedRunState value a context clear stores. */\nexport const CLEARED_RUN_STATE_BLOB = JSON.stringify({\n  [CLEARED_RUN_STATE_MARKER]: true,\n});\n\n/**\n * True when a serialized run-state blob is the cleared sentinel rather than a\n * real Agents-SDK run state. Recognized leniently (any object carrying the\n * marker key set truthy) so a future field addition to the sentinel does not\n * resurrect the pre-clear context. Anything that is not the sentinel — including\n * malformed JSON — returns false so genuine blobs/corruption are handled by the\n * normal deserialize path.\n */\nexport function isClearedRunStateBlob(serialized: string | null | undefined): boolean {\n  if (!serialized) {\n    return false;\n  }\n  try {\n    const parsed = JSON.parse(serialized) as unknown;\n    return (\n      typeof parsed === \"object\" &&\n      parsed !== null &&\n      (parsed as Record<string, unknown>)[CLEARED_RUN_STATE_MARKER] === true\n    );\n  } catch {\n    return false;\n  }\n}\n\n/** Trigger conversation compaction now. No body fields today (forward-room). */\nexport const CompactSessionContextRequest = z.object({}).strict();\nexport type CompactSessionContextRequest = z.infer<typeof CompactSessionContextRequest>;\n\n/** Outcome of a manual /compact trigger. */\nexport const CompactSessionContextResult = z.object({\n  // pending: an active/paused session will compact at its next safe boundary.\n  // completed: an idle compaction-only activity completed synchronously.\n  // noop: there is no active history to compact.\n  status: z.enum([\"pending\", \"completed\", \"noop\"]),\n  message: z.string(),\n});\nexport type CompactSessionContextResult = z.infer<typeof CompactSessionContextResult>;\n\n/**\n * The principal whose authority accepted a session or turn. `subjectId` is an\n * opaque host/standalone identity and therefore must never encode `kind` by\n * convention: embedding hosts own their subject namespace.\n */\nexport const TurnInitiator = z.object({\n  kind: z.enum([\"subject\", \"service\"]),\n  ...turnInitiatorIdentityFields,\n});\nexport type TurnInitiator = z.infer<typeof TurnInitiator>;\n\n// ============ embedding host session authorization ============\n//\n// Workspace permissions answer whether a principal may use an OpenGeni\n// capability. An embedding host can additionally own per-session visibility\n// (ownership, sharing, nested workspaces, revocation). This port is the one\n// host-neutral boundary for that second decision. Inputs contain OpenGeni ids\n// and immutable, non-secret authority only; host records and policy details\n// never cross the boundary.\n\nexport const SessionAuthorizationSurface = z.enum([\n  \"http\",\n  \"core\",\n  \"stream\",\n  \"first_party_mcp\",\n  \"toolspace\",\n]);\nexport type SessionAuthorizationSurface = z.infer<typeof SessionAuthorizationSurface>;\n\nexport const SessionAuthorizationOperation = z.enum([\n  \"session.read\",\n  \"session.events.read\",\n  \"session.stream.read\",\n  \"session.stream.acknowledge\",\n  \"session.turns.read\",\n  \"session.append\",\n  \"session.steer\",\n  \"session.control\",\n  \"session.queue.read\",\n  \"session.queue.control\",\n  \"session.composer.read\",\n  \"session.composer.write\",\n  \"session.lineage.read\",\n  \"session.capture.read\",\n  \"session.files.read\",\n  \"session.files.write\",\n  \"session.git.read\",\n  \"session.terminal.read\",\n  \"session.terminal.control\",\n  \"session.viewer.read\",\n  \"session.viewer.control\",\n  \"session.first_party_mcp.call\",\n  \"session.toolspace.call\",\n  \"session.pin.write\",\n  \"session.codex_account.write\",\n  \"session.context.write\",\n  \"session.approval.write\",\n  \"session.human_input.read\",\n  \"session.human_input.write\",\n  \"session.title.write\",\n  \"session.mcp.approval_policy.write\",\n  \"session.tool_policy.write\",\n  \"session.goal.read\",\n  \"session.goal.write\",\n  \"session.child.create\",\n]);\nexport type SessionAuthorizationOperation = z.infer<typeof SessionAuthorizationOperation>;\n\nexport const SessionAuthorizationActor = z.discriminatedUnion(\"kind\", [\n  z.object({\n    kind: z.literal(\"subject\"),\n    subjectId: z.string().min(1),\n    subjectLabel: z.string().min(1).optional(),\n  }),\n  z.object({\n    kind: z.literal(\"agent_attempt\"),\n    /** Technical, authenticated first-party caller (not the host authority). */\n    subjectId: z.string().min(1),\n    callerSessionId: z.string().uuid(),\n    callerRootSessionId: z.string().uuid(),\n    turnId: z.string().uuid(),\n    attemptId: z.string().uuid(),\n    executionGeneration: z.number().int().positive(),\n    /** Frozen authority that admitted the calling turn. */\n    initiator: TurnInitiator,\n    initiatorContext: TurnInitiatorContext,\n  }),\n]);\nexport type SessionAuthorizationActor = z.infer<typeof SessionAuthorizationActor>;\n\nexport const SessionAuthorizationTarget = z.object({\n  sessionId: z.string().uuid(),\n  /** Server-resolved workspace lineage root; never accepted from a caller. */\n  rootSessionId: z.string().uuid(),\n});\nexport type SessionAuthorizationTarget = z.infer<typeof SessionAuthorizationTarget>;\n\nexport type AuthorizeSessionInput = {\n  accountId: string;\n  workspaceId: string;\n  actor: SessionAuthorizationActor;\n  target: SessionAuthorizationTarget;\n  operation: SessionAuthorizationOperation;\n  surface: SessionAuthorizationSurface;\n};\n\nexport const SessionAuthorizationDecision = z.discriminatedUnion(\"allowed\", [\n  z.object({\n    allowed: z.literal(true),\n    /**\n     * Whether related-session metadata may be projected with the target.\n     * `target` is the fail-closed default for exact shares; `root` permits the\n     * target's full lineage tree. This does not authorize a separate operation\n     * against another session, which always requires its own decision.\n     */\n    relatedSessionAccess: z.enum([\"target\", \"root\"]).optional(),\n    /** A host may request a tighter stream reauthorization bound. */\n    reauthorizeAfterMs: z.number().int().min(1_000).max(60_000).optional(),\n  }),\n  z.object({\n    allowed: z.literal(false),\n    reason: z.enum([\"not_found\", \"forbidden\", \"revoked\"]),\n  }),\n]);\nexport type SessionAuthorizationDecision = z.infer<typeof SessionAuthorizationDecision>;\n\n/**\n * A database-applicable listing scope. `rootSessionIds` includes every\n * descendant of those lineage anchors; `sessionIds` authorizes only the exact\n * sessions. Supplying neither is an explicit empty scope. OpenGeni intersects\n * every id with the requested workspace and never trusts a host scope as\n * session existence evidence.\n */\nexport const SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS = 10_000;\n\nexport const SessionAuthorizationListScope = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"all\") }),\n  z.object({\n    kind: z.literal(\"scoped\"),\n    rootSessionIds: z.array(z.string().uuid()).max(SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS),\n    sessionIds: z.array(z.string().uuid()).max(SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS),\n  }),\n]);\nexport type SessionAuthorizationListScope = z.infer<typeof SessionAuthorizationListScope>;\n\nexport type ResolveSessionAuthorizationListScopeInput = {\n  accountId: string;\n  workspaceId: string;\n  actor: SessionAuthorizationActor;\n  surface: SessionAuthorizationSurface;\n};\n\nexport type SessionAuthorizationPort = {\n  authorizeSession(input: AuthorizeSessionInput): Promise<SessionAuthorizationDecision>;\n  /**\n   * Return the complete current scope used inside OpenGeni's cursor query.\n   * This is deliberately not a post-filter callback: search, pinning, ordering,\n   * totals, and cursor advancement must all operate on authorized rows.\n   */\n  resolveListScope(\n    input: ResolveSessionAuthorizationListScopeInput,\n  ): Promise<SessionAuthorizationListScope>;\n};\n\nexport const SessionTurn = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  triggerEventId: z.string().uuid(),\n  temporalWorkflowId: z.string(),\n  status: SessionTurnStatus,\n  source: SessionTurnSource,\n  position: z.number().int(),\n  prompt: z.string().min(1),\n  resources: z.array(ResourceRef),\n  tools: z.array(ToolRef),\n  // Omitted/default discovery and explicit `tools: []` are distinct. False\n  // inherits the durable session policy; true replaces it for this turn after\n  // admission proves the selection is a subset.\n  toolsProvided: z.boolean().optional(),\n  model: z.string().min(1),\n  reasoningEffort: ReasoningEffort,\n  sandboxBackend: SandboxBackend,\n  // Per-turn OS override. NULL = inherit the session's sandboxOs.\n  sandboxOs: SandboxOs.nullable(),\n  metadata: z.record(z.string(), z.unknown()),\n  version: z.number().int().positive(),\n  executionGeneration: z.number().int().nonnegative(),\n  activeAttemptId: z.string().uuid().nullable(),\n  lineage: z.record(z.string(), z.unknown()),\n  initiator: TurnInitiator,\n  initiatorContext: TurnInitiatorContext,\n  cancelledBy: z.string().nullable(),\n  cancelReason: z.string().nullable(),\n  startedAt: z.string().nullable(),\n  finishedAt: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type SessionTurn = z.infer<typeof SessionTurn>;\n\nexport const EffectiveControlBlocker = z.object({\n  kind: z.enum([\"session\", \"workspace\"]),\n  sessionId: z.string().uuid().optional(),\n  displayName: z.string().min(1),\n  actor: z.string().nullable(),\n  reason: z.string().nullable(),\n  changedAt: z.string().nullable(),\n  revision: z.number().int().nonnegative(),\n});\nexport type EffectiveControlBlocker = z.infer<typeof EffectiveControlBlocker>;\n\nexport const EffectiveControlResumeOption = z.object({\n  scope: z.enum([\"selected\", \"session\", \"workspace\"]),\n  targetId: z.string().uuid().optional(),\n  selectedStateAfter: SessionControlState,\n  remainingPrimaryBlocker: EffectiveControlBlocker.optional(),\n  impactCopy: z.string().min(1),\n});\nexport type EffectiveControlResumeOption = z.infer<typeof EffectiveControlResumeOption>;\n\nexport const EffectiveSessionControl = z.object({\n  state: SessionControlState,\n  controlVersion: z.number().int().nonnegative(),\n  controlEtag: z.string().min(1),\n  directState: SessionControlState,\n  primaryBlocker: EffectiveControlBlocker.nullable(),\n  additionalBlockerCount: z.number().int().nonnegative(),\n  blockers: z.array(EffectiveControlBlocker),\n  resumeOptions: z.array(EffectiveControlResumeOption),\n  override: z\n    .object({\n      rootSessionId: z.string().uuid(),\n      revision: z.number().int().nonnegative(),\n    })\n    .nullable(),\n  settlement: z\n    .object({\n      state: z.literal(\"stopping\"),\n      attemptCount: z.number().int().positive(),\n      interruptionPendingCount: z.number().int().nonnegative(),\n      quiescencePendingCount: z.number().int().nonnegative(),\n    })\n    .nullable(),\n});\nexport type EffectiveSessionControl = z.infer<typeof EffectiveSessionControl>;\n\nexport const SESSION_OPERATION_KEY_MAX_CHARS = 256;\nconst SessionOperationKey = z.string().min(1).max(SESSION_OPERATION_KEY_MAX_CHARS);\n\nexport const SessionCommandReceipt = z.object({\n  id: z.string().uuid(),\n  action: z.string().min(1),\n  operationKey: z.string().min(1).max(SESSION_OPERATION_KEY_MAX_CHARS),\n  targetSessionId: z.string().uuid().nullable(),\n  targetTurnId: z.string().uuid().nullable(),\n  appliedControlRevision: z.number().int().nonnegative().nullable(),\n  appliedQueueVersion: z.number().int().nonnegative().nullable(),\n  appliedTurnVersion: z.number().int().positive().nullable(),\n  appliedDraftRevision: z.number().int().positive().nullable(),\n  createdAt: z.string(),\n});\nexport type SessionCommandReceipt = z.infer<typeof SessionCommandReceipt>;\n\nexport const ComposerDraft = z.object({\n  revision: z.number().int().nonnegative(),\n  text: z.string(),\n  resources: z.array(ResourceRef),\n  tools: z.array(ToolRef),\n  // False means the draft inherits the session policy. True preserves an\n  // explicit array, including [], across autosave/reload and queue checkout.\n  toolsProvided: z.boolean().default(false),\n  model: z.string().min(1),\n  reasoningEffort: ReasoningEffort,\n  sourceTurnId: z.string().uuid().nullable(),\n  sourceTurnVersion: z.number().int().positive().nullable(),\n  updatedAt: z.string().nullable(),\n});\nexport type ComposerDraft = z.infer<typeof ComposerDraft>;\n\nexport const SessionQueueSnapshot = z.object({\n  version: z.number().int().nonnegative(),\n  effectiveControl: EffectiveSessionControl,\n  /**\n   * True while the latest attempt is interrupted but has not durably proved\n   * quiescence: no more inference, user-visible output, or workspace-persistence\n   * authority. Temporal cancellation/terminalization is not that proof. This is\n   * distinct from ordinary capacity queueing, remains accurate with an empty\n   * visible queue, and is independent of Steer-row metadata or withdrawal.\n   */\n  stoppingPreviousAttempt: z.boolean(),\n  items: z.array(SessionTurn),\n});\nexport type SessionQueueSnapshot = z.infer<typeof SessionQueueSnapshot>;\n\nexport const MoveSessionQueueItemRequest = z.object({\n  clientEventId: SessionOperationKey,\n  expectedQueueVersion: z.number().int().nonnegative(),\n  beforeTurnId: z.string().uuid().nullable(),\n});\nexport type MoveSessionQueueItemRequest = z.infer<typeof MoveSessionQueueItemRequest>;\n\nexport const EditSessionQueueItemRequest = z.object({\n  clientEventId: SessionOperationKey,\n  expectedTurnVersion: z.number().int().positive(),\n  expectedDraftRevision: z.number().int().nonnegative(),\n  replaceDraft: z.boolean(),\n});\nexport type EditSessionQueueItemRequest = z.infer<typeof EditSessionQueueItemRequest>;\n\nexport const SteerSessionQueueItemRequest = z.object({\n  clientEventId: SessionOperationKey,\n  expectedTurnVersion: z.number().int().positive(),\n  controlEtag: z.string().min(1).optional(),\n});\nexport type SteerSessionQueueItemRequest = z.infer<typeof SteerSessionQueueItemRequest>;\n\nexport const DeleteSessionQueueItemRequest = z.object({\n  clientEventId: SessionOperationKey,\n  expectedTurnVersion: z.number().int().positive(),\n  reason: z.string().min(1).optional(),\n});\nexport type DeleteSessionQueueItemRequest = z.infer<typeof DeleteSessionQueueItemRequest>;\n\nexport const SaveComposerDraftRequest = ComposerDraft.pick({\n  text: true,\n  resources: true,\n  tools: true,\n  toolsProvided: true,\n  model: true,\n  reasoningEffort: true,\n}).extend({ expectedRevision: z.number().int().nonnegative() });\nexport type SaveComposerDraftRequest = z.infer<typeof SaveComposerDraftRequest>;\n\n/**\n * Create-only options saved with an actor's private pre-session draft. This is\n * deliberately narrower than CreateSessionRequest: idempotency/event keys and\n * credential-bearing MCP server inputs are per-attempt data, never draft state.\n */\nexport const NewSessionDraftOptions = z.object({\n  sandboxBackend: SandboxBackend.optional(),\n  targetSandboxId: z.string().uuid().optional(),\n  workingDir: z.string().min(1).optional(),\n  variableSetId: z.string().uuid().optional(),\n  rigId: z.string().uuid().optional(),\n  goal: GoalSpec.optional(),\n  firstPartyMcpPermissions: z.array(Permission).optional(),\n});\nexport type NewSessionDraftOptions = z.infer<typeof NewSessionDraftOptions>;\n\n/** Actor-private, server-authoritative composer state before a session exists. */\nexport const NewSessionDraft = z.object({\n  revision: z.number().int().nonnegative(),\n  text: z.string(),\n  resources: z.array(ResourceRef),\n  tools: z.array(ToolRef),\n  /** False means the workspace-default MCP policy is still inherited. */\n  toolsProvided: z.boolean().default(false),\n  model: z.string().min(1),\n  reasoningEffort: ReasoningEffort,\n  options: NewSessionDraftOptions,\n  updatedAt: z.string().nullable(),\n});\nexport type NewSessionDraft = z.infer<typeof NewSessionDraft>;\n\nexport const SaveNewSessionDraftRequest = NewSessionDraft.pick({\n  text: true,\n  resources: true,\n  tools: true,\n  toolsProvided: true,\n  model: true,\n  reasoningEffort: true,\n  options: true,\n}).extend({ expectedRevision: z.number().int().nonnegative() });\nexport type SaveNewSessionDraftRequest = z.infer<typeof SaveNewSessionDraftRequest>;\n\nexport const WORKSPACE_CONTROL_REASON_MAX_BYTES = 8 * 1024;\nexport const WORKSPACE_CONTROL_ACTOR_MAX_BYTES = 1024;\nexport const WORKSPACE_CONTROL_EVENT_MAX_BYTES = 16 * 1024;\n\nconst WorkspaceControlReason = z\n  .string()\n  .min(1)\n  .refine((value) => !value.includes(\"\\u0000\"), \"reason must not contain NUL bytes\")\n  .refine(\n    (value) => workspaceControlUtf8Bytes(value) <= WORKSPACE_CONTROL_REASON_MAX_BYTES,\n    `reason must not exceed ${WORKSPACE_CONTROL_REASON_MAX_BYTES} UTF-8 bytes`,\n  );\n\nexport const SessionControlRequest = z.object({\n  action: z.enum([\"pause\", \"resume\"]),\n  reason: WorkspaceControlReason.optional(),\n  clientEventId: SessionOperationKey,\n  expectedControlEtag: z.string().min(1).optional(),\n});\nexport type SessionControlRequest = z.infer<typeof SessionControlRequest>;\n\nexport const WorkspaceInferenceControlRequest = z.object({\n  action: z.enum([\"pause\", \"resume\"]),\n  reason: WorkspaceControlReason.optional(),\n  clientEventId: SessionOperationKey,\n  expectedRevision: z.number().int().nonnegative().optional(),\n});\nexport type WorkspaceInferenceControlRequest = z.infer<typeof WorkspaceInferenceControlRequest>;\n\nexport const WorkspaceInferenceControlResponse = z.object({\n  receipt: SessionCommandReceipt,\n  state: SessionControlState,\n  revision: z.number().int().nonnegative(),\n  interruptionCount: z.number().int().nonnegative(),\n  wakeCount: z.number().int().nonnegative(),\n});\nexport type WorkspaceInferenceControlResponse = z.infer<typeof WorkspaceInferenceControlResponse>;\n\n/**\n * One durable workspace-wide invalidation for one committed control revision.\n * It is not conversation history and never becomes queue work; clients use it\n * only to refetch authoritative workspace/session projections.\n */\nexport const WorkspaceControlEventTruncation = z.object({\n  truncated: z.literal(true),\n  surface: z.enum([\n    \"durable_control\",\n    \"database_guard\",\n    \"http_projection\",\n    \"nats_legacy_guard\",\n    \"sse_legacy_guard\",\n  ]),\n  deliveredBytes: z.number().int().nonnegative(),\n  fields: z.array(\n    z.object({\n      field: z.enum([\"reason\", \"actor\"]),\n      originalBytes: z.number().int().nonnegative(),\n      deliveredBytes: z.number().int().nonnegative(),\n      omittedBytes: z.number().int().nonnegative(),\n    }),\n  ),\n  fullEvidence: z.object({\n    available: z.literal(false),\n    reason: z.literal(\"not_retained\"),\n  }),\n});\nexport type WorkspaceControlEventTruncation = z.infer<typeof WorkspaceControlEventTruncation>;\n\nexport const WorkspaceControlEvent = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sequence: z.number().int().positive(),\n  revision: z.number().int().positive(),\n  type: z.literal(\"workspace.control.changed\"),\n  scope: z.enum([\"workspace\", \"session\"]),\n  rootSessionId: z.string().uuid().nullable(),\n  action: z.enum([\"pause\", \"resume\"]),\n  automatic: z.boolean(),\n  reason: z.string().nullable(),\n  actor: z.string().min(1),\n  occurredAt: z.string(),\n  truncation: WorkspaceControlEventTruncation.nullable().optional(),\n});\nexport type WorkspaceControlEvent = z.infer<typeof WorkspaceControlEvent>;\n\nexport type WorkspaceControlBoundarySurface = WorkspaceControlEventTruncation[\"surface\"];\n\nexport type BoundWorkspaceControlEventOptions = {\n  surface?: WorkspaceControlBoundarySurface;\n  reasonOriginalBytes?: number | null;\n  actorOriginalBytes?: number | null;\n};\n\n/** UTF-8 byte count used by workspace-control storage and transport guards. */\nexport function workspaceControlUtf8Bytes(value: string): number {\n  return new TextEncoder().encode(value).byteLength;\n}\n\n/**\n * Canonical bounded invalidation event. The event is not a full evidence store:\n * when a producer or legacy row exceeds a field cap, the retained head carries\n * a visible marker and structured exact byte-loss facts.\n */\nexport function boundWorkspaceControlEvent(\n  event: WorkspaceControlEvent,\n  options: BoundWorkspaceControlEventOptions = {},\n): WorkspaceControlEvent {\n  const existingFields = new Map(\n    (event.truncation?.fields ?? []).map((field) => [field.field, field] as const),\n  );\n  const reason =\n    event.reason === null\n      ? null\n      : boundWorkspaceControlText(event.reason, WORKSPACE_CONTROL_REASON_MAX_BYTES);\n  const actor = boundWorkspaceControlText(event.actor, WORKSPACE_CONTROL_ACTOR_MAX_BYTES);\n  const reasonBytes = reason === null ? 0 : workspaceControlUtf8Bytes(reason);\n  const actorBytes = workspaceControlUtf8Bytes(actor);\n  const reasonOriginalBytes =\n    event.reason === null\n      ? null\n      : Math.max(\n          workspaceControlUtf8Bytes(event.reason),\n          normalizedWorkspaceControlOriginalBytes(options.reasonOriginalBytes),\n          existingFields.get(\"reason\")?.originalBytes ?? 0,\n        );\n  const actorOriginalBytes = Math.max(\n    workspaceControlUtf8Bytes(event.actor),\n    normalizedWorkspaceControlOriginalBytes(options.actorOriginalBytes),\n    existingFields.get(\"actor\")?.originalBytes ?? 0,\n  );\n  const fields: WorkspaceControlEventTruncation[\"fields\"] = [];\n  if (reasonOriginalBytes !== null && reasonOriginalBytes > reasonBytes) {\n    fields.push({\n      field: \"reason\",\n      originalBytes: reasonOriginalBytes,\n      deliveredBytes: reasonBytes,\n      omittedBytes: reasonOriginalBytes - reasonBytes,\n    });\n  }\n  if (actorOriginalBytes > actorBytes) {\n    fields.push({\n      field: \"actor\",\n      originalBytes: actorOriginalBytes,\n      deliveredBytes: actorBytes,\n      omittedBytes: actorOriginalBytes - actorBytes,\n    });\n  }\n  if (fields.length === 0 && event.truncation == null) {\n    if (sessionEventJsonBytes(event) > WORKSPACE_CONTROL_EVENT_MAX_BYTES) {\n      throw new RangeError(\"Workspace control event exceeds its bounded envelope\");\n    }\n    return event;\n  }\n\n  const truncation: WorkspaceControlEventTruncation = {\n    truncated: true,\n    surface: event.truncation?.surface ?? options.surface ?? \"durable_control\",\n    deliveredBytes: 0,\n    fields,\n    fullEvidence: { available: false, reason: \"not_retained\" },\n  };\n  const bounded: WorkspaceControlEvent = {\n    ...event,\n    reason,\n    actor,\n    truncation,\n  };\n  settleWorkspaceControlDeliveredBytes(bounded, truncation);\n  const deliveredBytes = sessionEventJsonBytes(bounded);\n  if (deliveredBytes > WORKSPACE_CONTROL_EVENT_MAX_BYTES) {\n    throw new RangeError(\n      `Bounded workspace control event exceeds its final envelope (${deliveredBytes} > ${WORKSPACE_CONTROL_EVENT_MAX_BYTES} bytes)`,\n    );\n  }\n  return bounded;\n}\n\nfunction boundWorkspaceControlText(value: string, maxBytes: number): string {\n  const encoder = new TextEncoder();\n  const decoder = new TextDecoder();\n  const bytes = encoder.encode(value);\n  if (bytes.byteLength <= maxBytes) return value;\n  const marker = \"…[truncated]\";\n  const prefixBudget = Math.max(0, maxBytes - encoder.encode(marker).byteLength);\n  let prefixEnd = Math.min(prefixBudget, bytes.byteLength);\n  while (prefixEnd > 0 && prefixEnd < bytes.byteLength && (bytes[prefixEnd]! & 0xc0) === 0x80) {\n    prefixEnd -= 1;\n  }\n  return `${decoder.decode(bytes.subarray(0, prefixEnd))}${marker}`;\n}\n\nfunction normalizedWorkspaceControlOriginalBytes(value: number | null | undefined): number {\n  return value === null || value === undefined || !Number.isFinite(value)\n    ? 0\n    : Math.max(0, Math.floor(value));\n}\n\nfunction settleWorkspaceControlDeliveredBytes(\n  event: WorkspaceControlEvent,\n  truncation: WorkspaceControlEventTruncation,\n): void {\n  for (let attempt = 0; attempt < 16; attempt += 1) {\n    const deliveredBytes = sessionEventJsonBytes(event);\n    if (truncation.deliveredBytes === deliveredBytes) return;\n    truncation.deliveredBytes = deliveredBytes;\n  }\n  const deliveredBytes = sessionEventJsonBytes(event);\n  if (truncation.deliveredBytes !== deliveredBytes) {\n    throw new RangeError(\"Workspace control event byte accounting did not converge\");\n  }\n}\n\nexport const SystemUpdateClassification = z.enum([\"success\", \"failure\", \"action_required\", \"info\"]);\nexport type SystemUpdateClassification = z.infer<typeof SystemUpdateClassification>;\n\nexport const SessionSystemUpdateKind = z.enum([\n  \"scheduled_occurrence\",\n  \"goal_continuation\",\n  \"agent_message\",\n  \"agent_steer_instruction\",\n  \"child_terminal_result\",\n]);\nexport type SessionSystemUpdateKind = z.infer<typeof SessionSystemUpdateKind>;\n\nexport const SessionSystemUpdatePayload = z.discriminatedUnion(\"type\", [\n  z\n    .object({\n      type: z.literal(\"scheduled_occurrence\"),\n      text: z.string().min(1),\n      scheduledTaskId: z.string().uuid(),\n      scheduledTaskRunId: z.string().uuid(),\n      resources: z.array(ResourceRef).optional(),\n      tools: z.array(ToolRef).optional(),\n    })\n    .passthrough(),\n  z\n    .object({\n      type: z.literal(\"goal_continuation\"),\n      goalId: z.string().uuid(),\n      goalVersion: z.number().int().positive(),\n      prompt: z.string().min(1),\n      reason: z.string().optional(),\n    })\n    .passthrough(),\n  z\n    .object({\n      type: z.literal(\"agent_message\"),\n      text: z.string().min(1),\n      operationId: z.string().uuid(),\n    })\n    .passthrough(),\n  z\n    .object({\n      type: z.literal(\"agent_steer_instruction\"),\n      instruction: z.string().min(1),\n      operationId: z.string().uuid(),\n    })\n    .passthrough(),\n  z\n    .object({\n      type: z.literal(\"child_terminal_result\"),\n      childSessionId: z.string().uuid(),\n      status: z.enum([\"idle\", \"failed\"]),\n    })\n    .passthrough(),\n]);\nexport type SessionSystemUpdatePayload = z.infer<typeof SessionSystemUpdatePayload>;\n\nexport const SessionSystemUpdateState = z.enum([\n  \"pending\",\n  \"deferred\",\n  \"delivered\",\n  \"cancelled\",\n  \"superseded\",\n  \"failed\",\n]);\nexport type SessionSystemUpdateState = z.infer<typeof SessionSystemUpdateState>;\n\nexport const SessionSystemUpdate = z.object({\n  id: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  kind: SessionSystemUpdateKind,\n  classification: SystemUpdateClassification,\n  sourceId: z.string(),\n  dedupeKey: z.string(),\n  summary: z.string(),\n  payload: SessionSystemUpdatePayload,\n  lineage: z.record(z.string(), z.unknown()),\n  state: SessionSystemUpdateState,\n  deliveredTurnId: z.string().uuid().nullable(),\n  deliveredAt: z.string().nullable(),\n  createdAt: z.string(),\n});\nexport type SessionSystemUpdate = z.infer<typeof SessionSystemUpdate>;\n\nexport const VariableSetVariableName = z\n  .string()\n  .regex(/^[A-Z][A-Z0-9_]*$/)\n  .max(128);\nexport type VariableSetVariableName = z.infer<typeof VariableSetVariableName>;\n\nfunction withVariableSetIdAlias<T extends z.ZodRawShape>(shape: T) {\n  return z.preprocess((input) => {\n    if (!input || typeof input !== \"object\" || Array.isArray(input)) {\n      return input;\n    }\n    const record = input as Record<string, unknown>;\n    if (record.variableSetId !== undefined || record.environmentId === undefined) {\n      return record;\n    }\n    return { ...record, variableSetId: record.environmentId };\n  }, z.object(shape));\n}\n\n// Metadata only by design: no schema in this file ever carries a variable value\n// back to a client. Values are write-only and decrypted exclusively inside the\n// worker at sandbox materialization time.\nexport const VariableSetVariableMetadata = z.object({\n  name: VariableSetVariableName,\n  version: z.number().int().positive(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type VariableSetVariableMetadata = z.infer<typeof VariableSetVariableMetadata>;\n/** @deprecated use VariableSetVariableMetadata */\nexport const WorkspaceEnvironmentVariableMetadata = VariableSetVariableMetadata;\n/** @deprecated use VariableSetVariableMetadata */\nexport type WorkspaceEnvironmentVariableMetadata = VariableSetVariableMetadata;\n\nexport const VariableSet = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  name: z.string(),\n  description: z.string().nullable(),\n  variables: z.array(VariableSetVariableMetadata),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type VariableSet = z.infer<typeof VariableSet>;\n/** @deprecated use VariableSet */\nexport const WorkspaceEnvironment = VariableSet;\n/** @deprecated use VariableSet */\nexport type WorkspaceEnvironment = VariableSet;\n\nexport const CreateVariableSetRequest = z.object({\n  name: z.string().min(1).max(120),\n  description: z.string().max(2000).optional(),\n  variables: z\n    .array(\n      z.object({\n        name: VariableSetVariableName,\n        value: z.string().min(1).max(32768),\n      }),\n    )\n    .default([]),\n});\nexport type CreateVariableSetRequest = z.infer<typeof CreateVariableSetRequest>;\n/** @deprecated use CreateVariableSetRequest */\nexport const CreateWorkspaceEnvironmentRequest = CreateVariableSetRequest;\n/** @deprecated use CreateVariableSetRequest */\nexport type CreateWorkspaceEnvironmentRequest = CreateVariableSetRequest;\n\nexport const UpdateVariableSetRequest = z.object({\n  name: z.string().min(1).max(120).optional(),\n  description: z.string().max(2000).nullable().optional(),\n});\nexport type UpdateVariableSetRequest = z.infer<typeof UpdateVariableSetRequest>;\n/** @deprecated use UpdateVariableSetRequest */\nexport const UpdateWorkspaceEnvironmentRequest = UpdateVariableSetRequest;\n/** @deprecated use UpdateVariableSetRequest */\nexport type UpdateWorkspaceEnvironmentRequest = UpdateVariableSetRequest;\n\nexport const SetVariableSetVariableRequest = z.object({\n  value: z.string().min(1).max(32768),\n});\nexport type SetVariableSetVariableRequest = z.infer<typeof SetVariableSetVariableRequest>;\n/** @deprecated use SetVariableSetVariableRequest */\nexport const SetWorkspaceEnvironmentVariableRequest = SetVariableSetVariableRequest;\n/** @deprecated use SetVariableSetVariableRequest */\nexport type SetWorkspaceEnvironmentVariableRequest = SetVariableSetVariableRequest;\n\n// --- Rigs ---------------------------------------------------------------------\n// Workspace-scoped, versioned sandbox machine definitions. A rig is the named\n// truth; each sandbox is a disposable fork of a rig version. Versions are\n// append-only and content-immutable; exactly one is active per rig.\n\n// A self-declared health check: a name + the shell command that must exit 0.\nexport const RigCheck = z.object({\n  name: z.string().min(1).max(120),\n  command: z.string().min(1).max(8192),\n});\nexport type RigCheck = z.infer<typeof RigCheck>;\n\nexport const RigVersion = z.object({\n  id: z.string().uuid(),\n  rigId: z.string().uuid(),\n  version: z.number().int().positive(),\n  image: z.string().nullable(),\n  setupScript: z.string().nullable(),\n  checks: z.array(RigCheck),\n  credentialHooks: z.array(z.string()),\n  defaultVariableSetIds: z.array(z.string().uuid()),\n  changelog: z.string().nullable(),\n  // Attribution: 'user:<subject>' | 'session:<id>' | 'system'.\n  createdBy: z.string().nullable(),\n  active: z.boolean(),\n  createdAt: z.string(),\n});\nexport type RigVersion = z.infer<typeof RigVersion>;\n\nexport const RigVerificationHealth = z.object({\n  checkHealth: z.enum([\"passing\", \"failing\", \"unknown\"]),\n  lastVerifiedAt: z.string().nullable(),\n});\nexport type RigVerificationHealth = z.infer<typeof RigVerificationHealth>;\n\nexport const Rig = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  name: z.string(),\n  description: z.string().nullable(),\n  createdBy: z.string().nullable(),\n  // The rig's currently-active version (present after create; nullable so a\n  // partial/list read can omit it without a schema change).\n  activeVersion: RigVersion.nullable(),\n  // Summary for the currently active version. null only when there is no active\n  // version; otherwise \"unknown\" means the active version has no verification.\n  activeVersionHealth: RigVerificationHealth.nullable(),\n  versionCount: z.number().int().nonnegative(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type Rig = z.infer<typeof Rig>;\n\nexport const RigChangeKind = z.enum([\"setup_append\", \"definition_edit\"]);\nexport type RigChangeKind = z.infer<typeof RigChangeKind>;\n\nexport const RigChangeStatus = z.enum([\"proposed\", \"verifying\", \"merged\", \"rejected\", \"failed\"]);\nexport type RigChangeStatus = z.infer<typeof RigChangeStatus>;\n\n// A single check's outcome inside a verification run (populated in M4).\nexport const RigCheckResult = z.object({\n  name: z.string(),\n  command: z.string(),\n  exitCode: z.number().int().nullable(),\n  output: z.string().optional(),\n});\nexport type RigCheckResult = z.infer<typeof RigCheckResult>;\n\n// The verification record a rig-CI run writes onto a change (M4). Open-ended\n// (passthrough) so M4 can enrich it without a contracts break.\nexport const RigChangeVerification = z\n  .object({\n    startedAt: z.string().optional(),\n    finishedAt: z.string().optional(),\n    log: z.string().optional(),\n    checkResults: z.array(RigCheckResult).optional(),\n  })\n  .passthrough();\nexport type RigChangeVerification = z.infer<typeof RigChangeVerification>;\n\nexport const RigChange = z.object({\n  id: z.string().uuid(),\n  rigId: z.string().uuid(),\n  baseVersionId: z.string().uuid().nullable(),\n  kind: RigChangeKind,\n  payload: z.record(z.string(), z.unknown()),\n  status: RigChangeStatus,\n  proposedBy: z.string().nullable(),\n  verification: RigChangeVerification.nullable(),\n  resultVersionId: z.string().uuid().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type RigChange = z.infer<typeof RigChange>;\n\nexport const CreateRigRequest = z.object({\n  name: z.string().min(1).max(120),\n  description: z.string().max(2000).optional(),\n  // Initial (version 1) content, inline.\n  image: z.string().max(1024).optional(),\n  setupScript: z.string().max(131072).optional(),\n  checks: z.array(RigCheck).max(100).default([]),\n  credentialHooks: z.array(z.string().min(1).max(200)).max(50).default([]),\n  defaultVariableSetIds: z.array(z.string().uuid()).max(25).default([]),\n});\nexport type CreateRigRequest = z.infer<typeof CreateRigRequest>;\n\nexport const UpdateRigRequest = z.object({\n  name: z.string().min(1).max(120).optional(),\n  description: z.string().max(2000).nullable().optional(),\n});\nexport type UpdateRigRequest = z.infer<typeof UpdateRigRequest>;\n\n// setup_append: the exact command that already worked (+ an optional note).\nexport const RigSetupAppendPayload = z.object({\n  command: z.string().min(1).max(8192),\n  note: z.string().max(2000).optional(),\n});\nexport type RigSetupAppendPayload = z.infer<typeof RigSetupAppendPayload>;\n\n// definition_edit: the full next-version content (all fields optional; unset\n// fields inherit from the base version at promote time).\nexport const RigDefinitionEditPayload = z.object({\n  image: z.string().max(1024).nullish(),\n  setupScript: z.string().max(131072).nullish(),\n  checks: z.array(RigCheck).max(100).optional(),\n  credentialHooks: z.array(z.string().min(1).max(200)).max(50).optional(),\n  defaultVariableSetIds: z.array(z.string().uuid()).max(25).optional(),\n  changelog: z.string().max(4096).nullish(),\n});\nexport type RigDefinitionEditPayload = z.infer<typeof RigDefinitionEditPayload>;\n\nexport const ProposeRigChangeRequest = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"setup_append\"), payload: RigSetupAppendPayload }),\n  z.object({\n    kind: z.literal(\"definition_edit\"),\n    payload: RigDefinitionEditPayload,\n  }),\n]);\nexport type ProposeRigChangeRequest = z.infer<typeof ProposeRigChangeRequest>;\n\nexport const ScheduledTaskStatus = z.enum([\"active\", \"paused\"]);\nexport type ScheduledTaskStatus = z.infer<typeof ScheduledTaskStatus>;\n\nexport const ScheduledTaskRunStatus = z.enum([\"queued\", \"dispatched\", \"failed\"]);\nexport type ScheduledTaskRunStatus = z.infer<typeof ScheduledTaskRunStatus>;\n\nexport const ScheduledTaskRunMode = z.enum([\"new_session_per_run\", \"reusable_session\"]);\nexport type ScheduledTaskRunMode = z.infer<typeof ScheduledTaskRunMode>;\n\nexport const ScheduledTaskOverlapPolicy = z.enum([\"allow_concurrent\", \"skip\", \"buffer_one\"]);\nexport type ScheduledTaskOverlapPolicy = z.infer<typeof ScheduledTaskOverlapPolicy>;\n\nexport const ScheduledTaskTriggerType = z.enum([\"scheduled\", \"manual\"]);\nexport type ScheduledTaskTriggerType = z.infer<typeof ScheduledTaskTriggerType>;\n\nexport const ScheduledTaskScheduleSpec = z.discriminatedUnion(\"type\", [\n  z.object({\n    type: z.literal(\"once\"),\n    runAt: z.string().datetime({ offset: true }),\n    timeZone: z.string().min(1).default(\"UTC\"),\n  }),\n  z.object({\n    type: z.literal(\"interval\"),\n    everySeconds: z.number().int().positive(),\n    startAt: z.string().datetime({ offset: true }).optional(),\n    endAt: z.string().datetime({ offset: true }).optional(),\n  }),\n  z.object({\n    type: z.literal(\"calendar\"),\n    timeZone: z.string().min(1).default(\"UTC\"),\n    hour: z.number().int().min(0).max(23),\n    minute: z.number().int().min(0).max(59),\n    daysOfWeek: z\n      .array(z.enum([\"SUNDAY\", \"MONDAY\", \"TUESDAY\", \"WEDNESDAY\", \"THURSDAY\", \"FRIDAY\", \"SATURDAY\"]))\n      .min(1)\n      .optional(),\n  }),\n]);\nexport type ScheduledTaskScheduleSpec = z.infer<typeof ScheduledTaskScheduleSpec>;\n\nexport const ScheduledTaskAgentConfig = z.object({\n  prompt: z.string().min(1),\n  resources: z.array(ResourceRef).default([]),\n  tools: z.array(ToolRef).default([]),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  // Explicit workspace-shared OpenGeni Slack bot binding for scheduled runs.\n  // The worker copies this non-secret pointer into session metadata; the\n  // first-party Slack tools never fall back to a personal hosted-MCP grant.\n  slackBotConnectionId: z.string().uuid().optional(),\n  model: z.string().min(1).optional(),\n  reasoningEffort: ReasoningEffort.optional(),\n  sandboxBackend: SandboxBackend.optional(),\n  goal: GoalSpec.optional(),\n  // Durable task override. Scheduled dispatch is trusted to preserve this\n  // snapshot even if the workspace/deployment policy narrows later.\n  maxNestedAgentDepth: NestedAgentDepthValue.optional(),\n});\nexport type ScheduledTaskAgentConfig = z.infer<typeof ScheduledTaskAgentConfig>;\n\nexport const ScheduledTask = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  name: z.string(),\n  status: ScheduledTaskStatus,\n  schedule: ScheduledTaskScheduleSpec,\n  temporalScheduleId: z.string(),\n  runMode: ScheduledTaskRunMode,\n  overlapPolicy: ScheduledTaskOverlapPolicy,\n  agentConfig: ScheduledTaskAgentConfig,\n  reusableSessionId: z.string().uuid().nullable(),\n  variableSetId: z.string().uuid().nullable().default(null),\n  /** @deprecated use variableSetId */\n  environmentId: z.string().uuid().nullable().default(null),\n  // The rig each run binds to (M3). Stored on the task; the ACTIVE version is\n  // resolved PER FIRE (at dispatch), so a task always runs the rig's current\n  // version rather than one frozen at task-create time. Null ⇒ rig-less runs.\n  rigId: z.string().uuid().nullable().default(null),\n  metadata: z.record(z.string(), z.unknown()),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ScheduledTask = z.infer<typeof ScheduledTask>;\n\nexport const ScheduledTaskRun = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  taskId: z.string().uuid(),\n  status: ScheduledTaskRunStatus,\n  triggerType: ScheduledTaskTriggerType,\n  scheduledAt: z.string().nullable(),\n  firedAt: z.string(),\n  sessionId: z.string().uuid().nullable(),\n  triggerEventId: z.string().uuid().nullable(),\n  error: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ScheduledTaskRun = z.infer<typeof ScheduledTaskRun>;\n\nexport const CreateScheduledTaskRequest = withVariableSetIdAlias({\n  name: z.string().min(1),\n  schedule: ScheduledTaskScheduleSpec,\n  runMode: ScheduledTaskRunMode.default(\"new_session_per_run\"),\n  overlapPolicy: ScheduledTaskOverlapPolicy.default(\"allow_concurrent\"),\n  agentConfig: ScheduledTaskAgentConfig,\n  status: ScheduledTaskStatus.default(\"active\"),\n  variableSetId: z.string().uuid().nullable().optional(),\n  environmentId: z.string().uuid().nullable().optional(),\n  // The rig each run binds to (M3); its active version is resolved per fire.\n  rigId: z.string().uuid().nullable().optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateScheduledTaskRequest = z.infer<typeof CreateScheduledTaskRequest>;\n\nexport const UpdateScheduledTaskRequest = withVariableSetIdAlias({\n  name: z.string().min(1).optional(),\n  schedule: ScheduledTaskScheduleSpec.optional(),\n  runMode: ScheduledTaskRunMode.optional(),\n  overlapPolicy: ScheduledTaskOverlapPolicy.optional(),\n  agentConfig: ScheduledTaskAgentConfig.optional(),\n  status: ScheduledTaskStatus.optional(),\n  variableSetId: z.string().uuid().nullable().optional(),\n  environmentId: z.string().uuid().nullable().optional(),\n  // The rig each run binds to (M3); null clears it. Its active version is\n  // resolved per fire, so an update takes effect on the next dispatch.\n  rigId: z.string().uuid().nullable().optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\nexport type UpdateScheduledTaskRequest = z.infer<typeof UpdateScheduledTaskRequest>;\n\n/**\n * Manual-trigger body. `triggerId` is a client-supplied idempotency token: a\n * retried trigger that reuses the same token charges once and starts one run.\n * Omitting it makes each call a distinct trigger (the server mints a token).\n */\nexport const TriggerScheduledTaskRequest = z.object({\n  triggerId: z.string().min(1).max(128).optional(),\n});\nexport type TriggerScheduledTaskRequest = z.infer<typeof TriggerScheduledTaskRequest>;\n\nexport const CapabilityPackConnectorAuthModel = z.enum([\n  \"oauth2_authorization_code_pkce\",\n  \"oauth2_authorization_code\",\n  \"api_key\",\n  \"credential_ref\",\n]);\nexport type CapabilityPackConnectorAuthModel = z.infer<typeof CapabilityPackConnectorAuthModel>;\n\nexport const CapabilityPackConnector = z.object({\n  id: z.string().min(1),\n  name: z.string().min(1),\n  category: z.string().min(1),\n  authModel: CapabilityPackConnectorAuthModel,\n  providers: z.array(z.string().min(1)).default([]),\n  scopes: z.array(z.string().min(1)).default([]),\n  required: z.boolean().default(false),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CapabilityPackConnector = z.infer<typeof CapabilityPackConnector>;\n\nexport const CapabilityPackKnowledge = z.object({\n  type: z.literal(\"document_base\"),\n  id: z.string().min(1),\n  name: z.string().min(1),\n  description: z.string().nullable().default(null),\n  required: z.boolean().default(false),\n});\nexport type CapabilityPackKnowledge = z.infer<typeof CapabilityPackKnowledge>;\n\nexport const CapabilityPackScheduledTaskTemplate = z.object({\n  id: z.string().min(1),\n  name: z.string().min(1),\n  description: z.string().min(1),\n  defaultSchedule: ScheduledTaskScheduleSpec,\n  defaultRunMode: ScheduledTaskRunMode.default(\"new_session_per_run\"),\n  defaultOverlapPolicy: ScheduledTaskOverlapPolicy.default(\"skip\"),\n  // Optional default agent prompt so registered pack manifests can ship fully\n  // instantiable templates; built-in packs may instead build prompts in code.\n  prompt: z.string().min(1).optional(),\n});\nexport type CapabilityPackScheduledTaskTemplate = z.infer<\n  typeof CapabilityPackScheduledTaskTemplate\n>;\n\n// One file inside a pack skill directory. Paths are workspace-relative POSIX\n// paths inside the skill directory (for example \"SKILL.md\" or\n// \"references/runbook.md\"); content is UTF-8 text carried inline in the pack\n// manifest, which is also how registered packs persist it (the manifest JSONB\n// row in workspace_packs is the storage of record for pack skills).\nexport const CapabilityPackSkillFile = z.object({\n  path: z.string().min(1).max(512).refine(isSafePackSkillRelativePath, {\n    message: \"skill file path must be a safe relative POSIX path without '..' segments\",\n  }),\n  content: z.string().max(256 * 1024),\n});\nexport type CapabilityPackSkillFile = z.infer<typeof CapabilityPackSkillFile>;\n\n// A skill delivered by a capability pack. The name doubles as the skill\n// directory under the sandbox skill index (skills/<name>), so it must be a\n// single safe path segment. Every skill must ship a top-level SKILL.md.\nexport const CapabilityPackSkill = z\n  .object({\n    name: z\n      .string()\n      .min(1)\n      .max(64)\n      .regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, {\n        message: \"skill name must be a single path segment of letters, digits, '.', '_' or '-'\",\n      }),\n    description: z.string().min(1).max(2048).optional(),\n    files: z.array(CapabilityPackSkillFile).min(1).max(64),\n  })\n  .superRefine((skill, ctx) => {\n    const seen = new Set<string>();\n    skill.files.forEach((file, index) => {\n      if (seen.has(file.path)) {\n        ctx.addIssue({\n          code: \"custom\",\n          message: `duplicate skill file path: ${file.path}`,\n          path: [\"files\", index, \"path\"],\n        });\n      }\n      seen.add(file.path);\n    });\n    if (!skill.files.some((file) => file.path === \"SKILL.md\")) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: \"skill must include a top-level SKILL.md file\",\n        path: [\"files\"],\n      });\n    }\n  });\nexport type CapabilityPackSkill = z.infer<typeof CapabilityPackSkill>;\n\n// Inline skill content fixed onto one session at creation. It intentionally\n// uses the exact same validated directory shape as a pack skill, but has a\n// different semantic owner and lifecycle. Session readers can inspect it; it\n// is configuration, never a secret store.\nexport const SessionSkill = CapabilityPackSkill;\nexport type SessionSkill = z.infer<typeof SessionSkill>;\n\nexport const SessionSkills = z\n  .array(SessionSkill)\n  .max(32)\n  .transform((skills, ctx) => {\n    const selected = new Map<string, { fingerprint: string; skill: SessionSkill }>();\n    for (const skill of skills) {\n      const key = skill.name.toLowerCase();\n      const fingerprint = JSON.stringify({\n        description: skill.description ?? null,\n        files: [...skill.files]\n          .sort((left, right) => left.path.localeCompare(right.path))\n          .map(({ path, content }) => ({ path, content })),\n      });\n      const existing = selected.get(key);\n      if (!existing) {\n        selected.set(key, { fingerprint, skill });\n        continue;\n      }\n      if (existing.fingerprint !== fingerprint) {\n        ctx.addIssue({\n          code: \"custom\",\n          message: `conflicting session skill definitions: ${skill.name}`,\n        });\n      }\n    }\n    return [...selected.values()].map(({ skill }) => skill);\n  });\n\nfunction isSafePackSkillRelativePath(path: string): boolean {\n  if (path.startsWith(\"/\") || path.includes(\"\\\\\")) {\n    return false;\n  }\n  return path\n    .split(\"/\")\n    .every((segment) => segment.length > 0 && segment !== \".\" && segment !== \"..\");\n}\n\nconst CapabilityPackVariableSet = z.object({\n  description: z.string().min(1),\n  requiredVariables: z.array(VariableSetVariableName).default([]),\n  required: z.boolean().default(false),\n});\n\nexport const CapabilityPack = z.preprocess(\n  (input) => {\n    if (!input || typeof input !== \"object\" || Array.isArray(input)) {\n      return input;\n    }\n    const record = input as Record<string, unknown>;\n    if (record.variableSet !== undefined) {\n      return record;\n    }\n    if (record.environment !== undefined) {\n      const { environment: _environment, ...rest } = record;\n      return { ...rest, variableSet: record.environment };\n    }\n    if (record.requiredVariables !== undefined) {\n      const { requiredVariables: _requiredVariables, ...rest } = record;\n      return {\n        ...rest,\n        variableSet: {\n          description: \"Required variables\",\n          requiredVariables: record.requiredVariables,\n          required: Array.isArray(record.requiredVariables) && record.requiredVariables.length > 0,\n        },\n      };\n    }\n    return record;\n  },\n  z.object({\n    id: z.string().min(1),\n    name: z.string().min(1),\n    description: z.string().min(1),\n    role: z.string().min(1),\n    category: z.string().min(1),\n    version: z.string().min(1),\n    // Container image ref (digest-pinned recommended) the pack's sessions run\n    // in. At most one enabled pack per workspace may declare one; with none,\n    // sessions use the deployment-wide image settings.\n    sandboxImage: z.string().trim().min(1).max(512).optional(),\n    // Skills delivered into the sandbox skill index when the pack is enabled.\n    skills: z\n      .array(CapabilityPackSkill)\n      .max(32)\n      .superRefine((skills, ctx) => {\n        const seen = new Set<string>();\n        skills.forEach((skill, index) => {\n          const key = skill.name.toLowerCase();\n          if (seen.has(key)) {\n            ctx.addIssue({\n              code: \"custom\",\n              message: `duplicate pack skill name: ${skill.name}`,\n              path: [index, \"name\"],\n            });\n          }\n          seen.add(key);\n        });\n      })\n      .default([]),\n    tools: z.array(ToolRef).default([]),\n    connectors: z.array(CapabilityPackConnector).default([]),\n    knowledge: z.array(CapabilityPackKnowledge).default([]),\n    scheduledTaskTemplates: z.array(CapabilityPackScheduledTaskTemplate).default([]),\n    variableSet: CapabilityPackVariableSet.optional(),\n    metadata: z.record(z.string(), z.unknown()).default({}),\n  }),\n);\nexport type CapabilityPack = z.infer<typeof CapabilityPack>;\n\n// Registering a pack stores the manifest itself; the request body is a full\n// CapabilityPack manifest.\nexport const RegisterCapabilityPackRequest = CapabilityPack;\nexport type RegisterCapabilityPackRequest = z.infer<typeof RegisterCapabilityPackRequest>;\n\nexport const WorkspaceRegisteredPack = z.object({\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  pack: CapabilityPack,\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type WorkspaceRegisteredPack = z.infer<typeof WorkspaceRegisteredPack>;\n\nexport const PackInstallationStatus = z.enum([\"active\", \"disabled\"]);\nexport type PackInstallationStatus = z.infer<typeof PackInstallationStatus>;\n\nexport const PackInstallation = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  packId: z.string().min(1),\n  status: PackInstallationStatus,\n  metadata: z.record(z.string(), z.unknown()),\n  enabledAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type PackInstallation = z.infer<typeof PackInstallation>;\n\nexport const EnablePackRequest = withVariableSetIdAlias({\n  variableSetId: z.string().uuid().optional(),\n  environmentId: z.string().uuid().optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type EnablePackRequest = z.infer<typeof EnablePackRequest>;\n\nexport const SocialProvider = z.enum([\n  \"x\",\n  \"linkedin\",\n  \"instagram\",\n  \"facebook\",\n  \"tiktok\",\n  \"youtube\",\n  \"custom\",\n]);\nexport type SocialProvider = z.infer<typeof SocialProvider>;\n\nexport const SocialConnectionStatus = z.enum([\"connected\", \"needs_reauth\", \"disabled\"]);\nexport type SocialConnectionStatus = z.infer<typeof SocialConnectionStatus>;\n\nexport const SocialConnection = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  provider: SocialProvider,\n  accountHandle: z.string().min(1),\n  accountName: z.string().nullable(),\n  externalAccountId: z.string().nullable(),\n  status: SocialConnectionStatus,\n  scopes: z.array(z.string()),\n  credentialRef: z.string().nullable(),\n  tokenMetadata: z.record(z.string(), z.unknown()),\n  metadata: z.record(z.string(), z.unknown()),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type SocialConnection = z.infer<typeof SocialConnection>;\n\nexport const CreateSocialConnectionRequest = z.object({\n  provider: SocialProvider,\n  accountHandle: z.string().min(1),\n  accountName: z.string().min(1).optional(),\n  externalAccountId: z.string().min(1).optional(),\n  status: SocialConnectionStatus.default(\"connected\"),\n  scopes: z.array(z.string().min(1)).default([]),\n  credentialRef: z.string().min(1).optional(),\n  tokenMetadata: z.record(z.string(), z.unknown()).default({}),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateSocialConnectionRequest = z.infer<typeof CreateSocialConnectionRequest>;\n\nexport const SocialPost = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  connectionId: z.string().uuid(),\n  provider: SocialProvider,\n  externalPostId: z.string().nullable(),\n  url: z.string().url().nullable(),\n  authorHandle: z.string().nullable(),\n  text: z.string(),\n  publishedAt: z.string(),\n  metrics: z.record(z.string(), z.number()),\n  raw: z.record(z.string(), z.unknown()),\n  createdAt: z.string(),\n});\nexport type SocialPost = z.infer<typeof SocialPost>;\n\nexport const CreateSocialPostRequest = z.object({\n  connectionId: z.string().uuid(),\n  externalPostId: z.string().min(1).optional(),\n  url: z.string().url().optional(),\n  authorHandle: z.string().min(1).optional(),\n  text: z.string().min(1),\n  publishedAt: z.string().datetime({ offset: true }),\n  metrics: z.record(z.string(), z.number()).default({}),\n  raw: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateSocialPostRequest = z.infer<typeof CreateSocialPostRequest>;\n\nexport const ConnectionKind = z.enum([\"oauth2\", \"api_key\", \"app_install\", \"delegated\"]);\nexport type ConnectionKind = z.infer<typeof ConnectionKind>;\n\nexport const ConnectionStatus = z.enum([\"active\", \"needs_reauth\", \"revoked\", \"error\"]);\nexport type ConnectionStatus = z.infer<typeof ConnectionStatus>;\n\nexport const OPENGENI_SLACK_BOT_CREDENTIAL_ROLE = \"opengeni_slack_bot\" as const;\nexport const OPENGENI_SLACK_BOT_CREDENTIAL_LABEL = \"OpenGeni Slack bot\" as const;\nexport const OPENGENI_SLACK_BOT_SESSION_METADATA_KEY = \"opengeniSlackBotConnectionId\" as const;\nexport const OPENGENI_SLACK_BOT_REQUIRED_SCOPES = [\n  \"chat:write\",\n  \"im:write\",\n  \"channels:read\",\n  \"channels:history\",\n  \"groups:read\",\n  \"groups:history\",\n  \"users:read\",\n] as const;\nexport const OPENGENI_SLACK_BOT_FORBIDDEN_SCOPES = [\"channels:join\", \"chat:write.public\"] as const;\n\nexport const OpenGeniSlackBotConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(OPENGENI_SLACK_BOT_CREDENTIAL_ROLE),\n    credentialLabel: z.literal(OPENGENI_SLACK_BOT_CREDENTIAL_LABEL),\n    slackTeamId: z.string().min(1).max(64),\n    slackTeamName: z.string().min(1).max(256),\n    botUserId: z.string().min(1).max(64),\n    botId: z.string().min(1).max(64),\n    botDisplayName: z.literal(\"OpenGeni\"),\n    verifiedAt: z.string().datetime({ offset: true }),\n  })\n  .passthrough();\nexport type OpenGeniSlackBotConnectionMetadata = z.infer<typeof OpenGeniSlackBotConnectionMetadata>;\n\nexport const ConnectionMetadata = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  subjectId: z.string().nullable(),\n  providerDomain: z.string(),\n  kind: ConnectionKind,\n  status: ConnectionStatus,\n  grantedScopes: z.array(z.string()),\n  expiresAt: z.string().nullable(),\n  lastRefreshAt: z.string().nullable(),\n  lastUsedAt: z.string().nullable(),\n  lastError: z.string().nullable(),\n  version: z.number().int().positive(),\n  verifiedInstallAt: z.string().datetime({ offset: true }).nullable().optional(),\n  verifiedInstallVersion: z.number().int().positive().nullable().optional(),\n  metadata: z.record(z.string(), z.unknown()),\n  createdBySubjectId: z.string().nullable(),\n  updatedBySubjectId: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ConnectionMetadata = z.infer<typeof ConnectionMetadata>;\n\nexport const ConnectionCredentialBundle = z.record(z.string(), z.unknown());\nexport type ConnectionCredentialBundle = z.infer<typeof ConnectionCredentialBundle>;\n\nexport const CreateConnectionRequest = z.object({\n  providerDomain: z.string().min(1),\n  kind: ConnectionKind,\n  subjectId: z.string().min(1).nullable().optional(),\n  credential: ConnectionCredentialBundle,\n  grantedScopes: z.array(z.string().min(1)).default([]),\n  expiresAt: z.string().datetime({ offset: true }).nullable().optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateConnectionRequest = z.infer<typeof CreateConnectionRequest>;\n\nexport const OpenGeniSlackBotInstallRequest = z.object({\n  connectionId: z.string().uuid().optional(),\n});\nexport type OpenGeniSlackBotInstallRequest = z.infer<typeof OpenGeniSlackBotInstallRequest>;\n\nexport const OpenGeniSlackBotInstallStart = z.object({\n  authorizationUrl: z.string().url(),\n  expiresAt: z.string().datetime({ offset: true }),\n});\nexport type OpenGeniSlackBotInstallStart = z.infer<typeof OpenGeniSlackBotInstallStart>;\n\nexport const UpdateConnectionRequest = z.object({\n  providerDomain: z.string().min(1).optional(),\n  subjectId: z.string().min(1).nullable().optional(),\n  kind: ConnectionKind.optional(),\n  status: ConnectionStatus.optional(),\n  credential: ConnectionCredentialBundle.optional(),\n  grantedScopes: z.array(z.string().min(1)).optional(),\n  expiresAt: z.string().datetime({ offset: true }).nullable().optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\nexport type UpdateConnectionRequest = z.infer<typeof UpdateConnectionRequest>;\n\nexport const ConnectionResponse = z.object({\n  connection: ConnectionMetadata,\n});\nexport type ConnectionResponse = z.infer<typeof ConnectionResponse>;\n\nexport const ListConnectionsResponse = z.object({\n  connections: z.array(ConnectionMetadata),\n});\nexport type ListConnectionsResponse = z.infer<typeof ListConnectionsResponse>;\n\nexport const OAuthStartRequest = z\n  .object({\n    providerDomain: z.string().min(1).optional(),\n    mcpUrl: z.string().url().optional(),\n    resource: z.string().url().optional(),\n    requestedScopes: z.array(z.string().min(1)).default([]),\n    returnPath: z.string().min(1).optional(),\n    connectionId: z.string().uuid().optional(),\n    oauthClient: z\n      .object({\n        clientId: z.string().min(1),\n        clientSecret: z.string().min(1).optional(),\n        tokenEndpointAuthMethod: z\n          .enum([\"none\", \"client_secret_post\", \"client_secret_basic\"])\n          .optional(),\n      })\n      .optional(),\n  })\n  .refine((value) => Boolean(value.mcpUrl ?? value.resource), {\n    message: \"mcpUrl is required\",\n    path: [\"mcpUrl\"],\n  });\nexport type OAuthStartRequest = z.infer<typeof OAuthStartRequest>;\n\nexport const OAuthStartResponse = z.object({\n  state: z.string().min(1),\n  authorizationUrl: z.string().url().nullable(),\n  expiresAt: z.string(),\n});\nexport type OAuthStartResponse = z.infer<typeof OAuthStartResponse>;\n\nexport const IntegrationClientMetadata = z.object({\n  client_id: z.string().url(),\n  client_name: z.literal(\"OpenGeni\"),\n  redirect_uris: z.array(z.string().url()),\n  token_endpoint_auth_method: z.literal(\"none\"),\n  grant_types: z.array(z.enum([\"authorization_code\", \"refresh_token\"])),\n  response_types: z.array(z.literal(\"code\")),\n});\nexport type IntegrationClientMetadata = z.infer<typeof IntegrationClientMetadata>;\n\nexport const MarketingDailyAnalysisTaskRequest = z.object({\n  name: z.string().min(1).optional(),\n  connectionIds: z.array(z.string().uuid()).default([]),\n  documentBaseIds: z.array(z.string().uuid()).default([]),\n  timeZone: z.string().min(1).default(\"UTC\"),\n  hour: z.number().int().min(0).max(23).default(9),\n  minute: z.number().int().min(0).max(59).default(0),\n  promptInstructions: z.string().min(1).optional(),\n  status: ScheduledTaskStatus.default(\"active\"),\n  runMode: ScheduledTaskRunMode.default(\"new_session_per_run\"),\n  overlapPolicy: ScheduledTaskOverlapPolicy.default(\"skip\"),\n});\nexport type MarketingDailyAnalysisTaskRequest = z.infer<typeof MarketingDailyAnalysisTaskRequest>;\n\nexport const CapabilityKind = z.enum([\"pack\", \"mcp\", \"api\", \"skill\", \"plugin\"]);\nexport type CapabilityKind = z.infer<typeof CapabilityKind>;\n\nexport const CapabilitySource = z.enum([\n  \"built_in\",\n  \"library\",\n  \"configured\",\n  \"public_registry\",\n  \"registry\",\n  \"manual\",\n]);\nexport type CapabilitySource = z.infer<typeof CapabilitySource>;\n\nexport const CapabilityInstallationStatus = z.enum([\"active\", \"disabled\"]);\nexport type CapabilityInstallationStatus = z.infer<typeof CapabilityInstallationStatus>;\n\nexport const CapabilityCatalogAuthKind = z.enum([\"oauth2\", \"api_key\", \"none\", \"unknown\"]);\nexport type CapabilityCatalogAuthKind = z.infer<typeof CapabilityCatalogAuthKind>;\n\nexport const CapabilityCatalogTier = z.enum([\"verified\", \"community\"]);\nexport type CapabilityCatalogTier = z.infer<typeof CapabilityCatalogTier>;\n\nexport const CapabilityRuntime = z.object({\n  available: z.boolean().default(false),\n  mcpServerId: z.string().min(1).optional(),\n  transport: z.string().min(1).optional(),\n  notes: z.string().nullable().default(null),\n  // Registry exposure provenance is server-derived and contains no endpoint or\n  // credential material.\n  catalogTrust: z\n    .object({\n      state: z.enum([\"trusted\", \"legacy_active\", \"unverified\"]),\n      reason: z.enum([\n        \"trusted_source\",\n        \"verified_probe\",\n        \"active_installation_compatibility\",\n        \"missing_verification\",\n      ]),\n    })\n    .optional(),\n});\nexport type CapabilityRuntime = z.infer<typeof CapabilityRuntime>;\n\nexport const CapabilityCatalogItem = z.object({\n  id: z.string().min(1),\n  accountId: z.string().uuid().optional(),\n  workspaceId: z.string().uuid().optional(),\n  kind: CapabilityKind,\n  source: CapabilitySource,\n  name: z.string().min(1),\n  description: z.string().nullable().default(null),\n  category: z.string().min(1).default(\"custom\"),\n  tags: z.array(z.string().min(1)).default([]),\n  homepageUrl: z.string().url().nullable().default(null),\n  endpointUrl: z.string().url().nullable().default(null),\n  installUrl: z.string().url().nullable().default(null),\n  authModel: z.string().min(1).nullable().default(null),\n  providerDomain: z.string().min(1).nullable().default(null),\n  surfaceType: z.string().min(1).nullable().default(null),\n  transport: z.string().min(1).nullable().default(null),\n  mcpUrl: z.string().url().nullable().default(null),\n  authKind: CapabilityCatalogAuthKind.nullable().default(null),\n  credentialFacts: z.array(z.record(z.string(), z.unknown())).default([]),\n  tier: CapabilityCatalogTier.nullable().default(null),\n  provenance: z.string().min(1).nullable().default(null),\n  logoAssetPath: z.string().min(1).nullable().default(null),\n  importBatchId: z.string().uuid().nullable().default(null),\n  stale: z.boolean().default(false),\n  staleAt: z.string().nullable().default(null),\n  tools: z.array(ToolRef).default([]),\n  runtime: CapabilityRuntime.default({ available: false, notes: null }),\n  enabled: z.boolean().default(false),\n  enabledReason: z.string().nullable().default(null),\n  // The non-secret connection binding stored with an enabled installation.\n  // Workspace refs retain an exact row id. Subject refs deliberately omit it:\n  // each caller resolves their own visible row by provider/kind at runtime.\n  connectionRef: z\n    .object({\n      connectionId: z.string().min(1).optional(),\n      providerDomain: z.string().min(1),\n      kind: z.string().min(1),\n      subjectScope: z.enum([\"workspace\", \"subject\"]).optional(),\n    })\n    .nullable()\n    .default(null),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  createdAt: z.string().optional(),\n  updatedAt: z.string().optional(),\n});\nexport type CapabilityCatalogItem = z.infer<typeof CapabilityCatalogItem>;\n\n/**\n * Shared trust gate for catalog visibility and runtime selection. Registry rows\n * remain durable for provenance and audit, but only a reviewed real-MCP probe\n * with known authentication is exposable. API-key rows additionally need a\n * machine-actionable header contract; prose credential instructions are not a\n * runtime contract and must fail closed.\n */\nexport function capabilityCatalogItemIsTrustedForExposure(\n  item: Pick<CapabilityCatalogItem, \"source\" | \"stale\" | \"authKind\" | \"metadata\">,\n): boolean {\n  if (item.stale) return false;\n  if (item.source !== \"registry\") return true;\n  const probe = item.metadata.mcpProbe;\n  if (!probe || typeof probe !== \"object\" || Array.isArray(probe)) return false;\n  if ((probe as Record<string, unknown>).status !== \"real\") return false;\n  if (item.authKind === null || item.authKind === \"unknown\") return false;\n  if (item.authKind !== \"api_key\") return true;\n  const contract = item.metadata.authContract;\n  if (!contract || typeof contract !== \"object\" || Array.isArray(contract)) return false;\n  const record = contract as Record<string, unknown>;\n  return (\n    typeof record.headerName === \"string\" &&\n    /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/.test(record.headerName) &&\n    typeof record.scheme === \"string\" &&\n    record.scheme.trim().length > 0\n  );\n}\n\nexport const CapabilityInstallation = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  capabilityId: z.string().min(1),\n  kind: CapabilityKind,\n  status: CapabilityInstallationStatus,\n  config: z.record(z.string(), z.unknown()),\n  metadata: z.record(z.string(), z.unknown()),\n  enabledAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type CapabilityInstallation = z.infer<typeof CapabilityInstallation>;\n\nexport const CreateCapabilityCatalogItemRequest = z.object({\n  id: z.string().min(1).optional(),\n  kind: CapabilityKind.exclude([\"pack\"]),\n  source: CapabilitySource.default(\"manual\"),\n  name: z.string().min(1),\n  description: z.string().min(1).optional(),\n  category: z.string().min(1).default(\"custom\"),\n  tags: z.array(z.string().min(1)).default([]),\n  homepageUrl: z.string().url().optional(),\n  endpointUrl: z.string().url().optional(),\n  installUrl: z.string().url().optional(),\n  authModel: z.string().min(1).optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateCapabilityCatalogItemRequest = z.infer<typeof CreateCapabilityCatalogItemRequest>;\n\nexport const EnableCapabilityRequest = withVariableSetIdAlias({\n  config: z.record(z.string(), z.unknown()).default({}),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  connectionRef: McpServerConnectionRef.optional(),\n  /**\n   * Credential headers for remote MCP capabilities (for example an\n   * Authorization bearer token). Values are encrypted at rest with the\n   * workspace-variable-sets key, injected only into the runtime MCP client,\n   * and never returned by the API — responses expose header names only.\n   */\n  headers: z.record(z.string(), z.string()).default({}),\n  /**\n   * Initial variableSet attachment for kind=pack capabilities. Mirrors the\n   * dedicated POST /packs/:id/enable body: required to enable an\n   * variableSet.required pack through the unified capability-enable path,\n   * optional otherwise. Ignored by non-pack capabilities.\n   */\n  variableSetId: z.string().uuid().optional(),\n  environmentId: z.string().uuid().optional(),\n});\nexport type EnableCapabilityRequest = z.infer<typeof EnableCapabilityRequest>;\n\nexport const CapabilityCatalogResponse = z.object({\n  items: z.array(CapabilityCatalogItem),\n  installations: z.array(CapabilityInstallation),\n});\nexport type CapabilityCatalogResponse = z.infer<typeof CapabilityCatalogResponse>;\n\nexport const DiscoverMcpCapabilitiesResponse = z.object({\n  items: z.array(CapabilityCatalogItem),\n  source: z.literal(\"official_mcp_registry\"),\n  sourceUrl: z.string().url(),\n});\nexport type DiscoverMcpCapabilitiesResponse = z.infer<typeof DiscoverMcpCapabilitiesResponse>;\n\nexport const Session = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  accountId: z.string().uuid(),\n  status: SessionStatus,\n  initialMessage: z.string(),\n  title: z.string().nullable(),\n  titleSource: z.enum([\"user\", \"agent\"]).nullable(),\n  // Per-session agent persona/system instructions supplied at create. Org-visible\n  // metadata (exposed like title/goal), never a secret and never a timeline event.\n  // null when the session carried none.\n  instructions: z.string().nullable(),\n  resources: z.array(ResourceRef),\n  skills: SessionSkills.default([]),\n  tools: z.array(ToolRef),\n  // Origin of the persisted tool allow-list. Optional for rolling client\n  // compatibility; current servers emit it and legacy rows map to `legacy`.\n  toolPolicy: SessionToolPolicy.optional(),\n  // Optimistic-concurrency fence for durable policy mutations. Optional for\n  // older clients/fixtures; current servers always emit the authoritative\n  // value.\n  toolPolicyVersion: z.number().int().positive().optional(),\n  // Secret-safe current resolution, computed at an API/read or execution\n  // boundary from IDs only. Optional because internal DB readers need not load\n  // the workspace runtime registry.\n  effectiveToolPolicy: SessionEffectiveToolPolicy.optional(),\n  metadata: z.record(z.string(), z.unknown()),\n  /** Frozen creator fact used only for creation attribution/idempotent repair. */\n  createdBy: TurnInitiator,\n  createdByContext: TurnInitiatorContext,\n  model: z.string(),\n  sandboxBackend: SandboxBackend,\n  // The OS the session's box runs. Defaults to 'linux' (today's only OS).\n  sandboxOs: SandboxOs,\n  // The shared-sandbox group the session's box belongs to. Equals the session's\n  // own id for a singleton group (today's 1:1 default); equals the parent's\n  // group when spawned shared (both sessions run in ONE box).\n  sandboxGroupId: z.string().uuid(),\n  // The first-class swappable-sandbox POINTER (bring-your-own-compute M2). NULL\n  // resolves to the session's own group sandbox (the backward-compat default);\n  // a swap sets it to the target sandbox row. active_epoch is the second epoch\n  // ABOVE the lease epoch, bumped on every swap so the routing proxy can fence a\n  // stale in-flight op and retry against the new active sandbox.\n  activeSandboxId: z.string().uuid().nullable(),\n  activeEpoch: z.number().int().nonnegative(),\n  variableSetId: z.string().uuid().nullable().default(null),\n  /** @deprecated use variableSetId */\n  environmentId: z.string().uuid().nullable().default(null),\n  // The rig this session rides (M3 runtime binding). Both are resolved and\n  // FROZEN at session create: rigId names the rig, rigVersionId pins the exact\n  // active version the session's box/env/setup/doctrine are built from for the\n  // session's whole life (a later promote does NOT move an existing session).\n  // Both null ⇒ a rig-less session (byte-for-byte today's behavior).\n  rigId: z.string().uuid().nullable().default(null),\n  rigVersionId: z.string().uuid().nullable().default(null),\n  // Non-default first-party MCP token permissions (manager-style sessions);\n  // null means the fixed worker default set.\n  firstPartyMcpPermissions: z.array(Permission).nullable(),\n  // Per-session third-party MCP servers, metadata only. Credential values are\n  // write-only and never appear here.\n  mcpServers: z.array(SessionMcpServerMetadata).default([]),\n  // The manager session that spawned this one via session_create (set only\n  // when the creating grant carried a worker-signed sessionId claim); null for\n  // direct API creates and scheduled-task runs. When set, this session's\n  // terminal-for-now transitions wake the parent.\n  parentSessionId: z.string().uuid().nullable(),\n  // Server-authored nested-agent lineage/policy. Root sessions are depth 0;\n  // snapshots are immutable and govern only future descendant creation.\n  rootSessionId: z.string().uuid(),\n  nestedAgentDepth: NestedAgentDepthValue,\n  maxNestedAgentDepthOverride: NestedAgentDepthValue.nullable(),\n  effectiveMaxNestedAgentDepth: NestedAgentDepthValue,\n  nestedAgentDepthPolicySource: NestedAgentDepthPolicySource,\n  nestedAgentDepthPolicySessionId: z.string().uuid().nullable(),\n  // Workspace-scoped CREATE idempotency key the session was created under (the\n  // dedup target collapsing double-submit/retry races to one session); null\n  // when the create carried no key.\n  createIdempotencyKey: z.string().nullable(),\n  temporalWorkflowId: z.string().nullable(),\n  activeTurnId: z.string().uuid().nullable(),\n  // Actual input tokens of the last model call of the most recent turn; the\n  // pre-turn portable context-compaction trigger reads it as its budget\n  // signal. Null until a turn with usage has completed.\n  lastInputTokens: z.number().int().nonnegative().nullable(),\n  queueVersion: z.number().int().nonnegative(),\n  queueHeadPosition: z.number().int(),\n  queueTailPosition: z.number().int(),\n  effectiveControl: EffectiveSessionControl,\n  lastSequence: z.number().int().nonnegative(),\n  // Multi-account Codex (P1). codexPinnedCredentialId: the account this session is\n  // manually PINNED to (null ⇒ follow the workspace active pointer).\n  // codexLastCredentialId: the account the most recent turn actually ran on (the\n  // \"Running on:\" indicator's source). Both are credential-row ids, null until set.\n  codexPinnedCredentialId: z.string().uuid().nullable(),\n  codexLastCredentialId: z.string().uuid().nullable(),\n  /** Personal (authenticated subject) workspace pin state, never workspace-global. */\n  pinned: z.boolean().default(false),\n  /** Stable pin ordering key; null when this subject has not pinned the session. */\n  pinnedAt: z.string().nullable().default(null),\n  /** Optimistic pin-state revision; zero represents an absent pin relation. */\n  pinVersion: z.number().int().nonnegative().default(0),\n  /**\n   * Server-authoritative hierarchy summary populated on session-list reads.\n   * Detail reads may omit it. The rail uses this instead of guessing a tree\n   * from whichever global recency page happened to be loaded.\n   */\n  treeStats: z\n    .object({\n      directChildren: z.number().int().nonnegative(),\n      totalDescendants: z.number().int().nonnegative(),\n      runningDescendants: z.number().int().nonnegative(),\n      queuedDescendants: z.number().int().nonnegative(),\n      attentionDescendants: z.number().int().nonnegative(),\n      pausedDescendants: z.number().int().nonnegative(),\n      failedDescendants: z.number().int().nonnegative(),\n      /** Counts are lower bounds rather than exact totals when true. */\n      truncated: z.boolean().default(false),\n    })\n    .optional(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type Session = z.infer<typeof Session>;\n\n/**\n * Additive receipt returned only by session creation. `activeTurnId` remains an\n * execution pointer and is correctly null while the first turn is queued;\n * embedders use this immutable identity to correlate their preallocated run.\n */\nexport const CreateSessionResponse = Session.extend({\n  initialTurnId: z.string().uuid().nullable(),\n});\nexport type CreateSessionResponse = z.infer<typeof CreateSessionResponse>;\n\nexport type SessionSummary = Session;\n\n/**\n * The canonical session-list page. Pinned rows are returned separately and are\n * excluded from `sessions`, so a cursor can page ordinary recency rows without\n * duplicating a pin. The newest 100 matching pins are returned, ordered by\n * pinnedAt DESC, id DESC; `pinnedTruncated` makes an older-pin omission\n * explicit. Pins are filtered by the same parent/search predicates as ordinary\n * rows.\n */\nexport const SessionListResponse = z.object({\n  pinned: z.array(Session),\n  /** True when older matching pins were omitted from this bounded page. */\n  pinnedTruncated: z.boolean().optional(),\n  sessions: z.array(Session),\n  nextCursor: z.string().nullable(),\n});\nexport type SessionListResponse = z.infer<typeof SessionListResponse>;\n\n// Recursive: the TS type is declared first so the schema annotation can carry\n// the FULL recursive shape (a shallow annotation loses type information for\n// contracts consumers after one level of nesting).\nexport type LineageNode = {\n  session: SessionSummary;\n  children: LineageNode[];\n};\nexport const LineageNode: z.ZodType<LineageNode> = z.lazy(() =>\n  z.object({\n    session: Session,\n    children: z.array(LineageNode),\n  }),\n);\n\nexport const SessionLineageResponse = z.object({\n  ancestors: z.array(Session),\n  children: z.array(LineageNode),\n  truncated: z.boolean().default(false),\n});\nexport type SessionLineageResponse = z.infer<typeof SessionLineageResponse>;\n\nexport const SessionEventType = z.enum([\n  \"session.created\",\n  // Defensive read/transport projection for a malformed or historically\n  // oversized retained event envelope. The original row stays durable; this\n  // explicit synthetic type prevents unbounded free-form envelope fields from\n  // crossing NATS, SSE, REST, or browser boundaries.\n  \"session.event.envelope_omitted\",\n  \"session.status.changed\",\n  \"session.requiresAction\",\n  \"session.humanInput.requested\",\n  \"session.context.compaction.requested\",\n  \"session.context.compacted\",\n  \"session.context.compaction.skipped\",\n  \"session.context.cleared\",\n  \"user.message\",\n  \"user.pause\",\n  \"user.approvalDecision\",\n  \"user.humanInputResponse\",\n  \"turn.queued\",\n  \"turn.started\",\n  \"turn.completed\",\n  \"turn.failed\",\n  \"turn.cancelled\",\n  \"turn.superseded\",\n  \"turn.recovery.requested\",\n  \"turn.capacity_waiting\",\n  \"agent.message.delta\",\n  \"agent.message.completed\",\n  \"agent.reasoning.delta\",\n  \"agent.toolCall.created\",\n  \"agent.toolCall.output\",\n  // Attempt-fenced Codex Responses lifecycle metadata (request identity,\n  // deadlines, first-byte/terminal phase, provider request id). Never body/auth.\n  \"agent.model.request\",\n  \"agent.model.usage\",\n  \"tool.auth_needed\",\n  \"credential.auth_needed\",\n  \"agent.updated\",\n  \"rig.setup.started\",\n  \"rig.setup.completed\",\n  \"rig.setup.skipped\",\n  \"rig.setup.failed\",\n  \"sandbox.operation.started\",\n  \"sandbox.operation.completed\",\n  \"sandbox.operation.failed\",\n  \"sandbox.command.output.delta\",\n  \"artifact.created\",\n  \"goal.set\",\n  \"goal.updated\",\n  \"goal.completed\",\n  \"goal.paused\",\n  \"goal.resumed\",\n  \"goal.cleared\",\n  \"goal.continuation\",\n  \"system.update.pending\",\n  \"system.update.delivered\",\n  \"session.control.paused\",\n  \"session.control.resumed\",\n  \"session.control.steer_requested\",\n  \"workspace.inference.paused\",\n  \"workspace.inference.resumed\",\n  \"session.queue.changed\",\n  \"session.queue.prompt.cancelled\",\n  \"session.queue.history\",\n  // A terminal/stale activity callback is retained as an audit wrapper rather\n  // than being dropped or emitted as though it belonged to the current turn.\n  \"turn.event.rejected_late\",\n  \"memory.saved\",\n  \"memory.corrected\",\n  // Channel-B desktop pixel-plane signals (07-channel-b §1.2). The pixel socket\n  // carries opaque RFB and cannot carry a control message the client can act on,\n  // so these ride the durable, sequenced, gap-filled Channel-A SSE spine.\n  \"stream.url.rotated\", // re-minted {url,token,expiresAt} on box rollover (event-driven)\n  \"stream.opened\", // a viewer attached (audit + refcount visibility)\n  \"stream.closed\", // a viewer detached / was reaped\n  \"stream.revoked\", // a grant was revoked → connected clients MUST disconnect now\n  // Desktop recording signals. The capture loop records the same display humans\n  // watch, then stores the finalized artifact for replay.\n  // → storage. The artifact ref rides the AVAILABLE event (storageKey, NOT a\n  // long-lived URL — clients mint a short-TTL signed GET via the route).\n  \"recording.started\", // ffmpeg launched on :0 (mode/codec/dimensions)\n  \"recording.available\", // finalized: bytes PUT to storage, replayable\n  \"recording.failed\", // ffmpeg/box-death/rollover/upload error — no artifact\n  // Structured-service notifications. File, Git, and terminal reads are\n  // synchronous API-direct point\n  // queries (their result is the HTTP response, NEVER an event). What rides A1\n  // here are the side-effect NOTIFICATIONS — a path changed, git state changed,\n  // a pty opened/printed/exited — durable, sequenced, gap-filled like every\n  // other session event, so any viewer's Pierre tree / diff / terminal stays\n  // live. fs.changed/git.changed are cache-invalidation signals; the pty.*\n  // events carry the interactive terminal byte stream.\n  \"fs.changed\", // a path was created/modified/deleted (write or agent mutation)\n  \"git.changed\", // working-tree/index/HEAD changed (debounced re-probe)\n  \"terminal.pty.started\", // an interactive PTY session opened (carries ptyId)\n  \"terminal.pty.output.delta\", // PTY stdout/stderr bytes (separate from command.output)\n  \"terminal.pty.exited\", // PTY session ended (exitCode/reason)\n  \"session.title_set\",\n  \"session.mcp.approval_policy.updated\",\n  \"session.tool_policy.updated\",\n  // Multi-account Codex (P1): the account a session's turn runs on changed\n  // (manual switch in P1; failover/rotation in P3 reuse the same event). Drives\n  // the in-session \"Running on:\" indicator's live flip.\n  \"codex.account.switched\",\n  // credential allocator per-turn selection audit. Payload is metadata only: credential row\n  // id, bounded strategy/reason, and pool counts — never token material.\n  \"codex.credential.selected\",\n  // Adaptive fleet shadow decision record. Contains only bounded opaque candidate aliases,\n  // normalized pressure/cache/confidence features, deterministic fingerprints,\n  // the actual-vs-shadow comparison, and no credential/account identity.\n  \"codex.fleet.decision\",\n  // credential allocator durable zero-capacity wait lifecycle. Runtime/system events only;\n  // no synthetic user message is created when capacity returns.\n  \"codex.capacity.waiting\",\n  \"codex.capacity.resumed\",\n  \"codex.capacity.superseded\",\n  // Sandbox durability observability (sandbox-file-persistence). The 2026-07\n  // incidents (mid-session box death with /workspace loss; a fatal manifest-env\n  // delta on a live box) were near-unattributable because box lifecycle left no\n  // durable trace — only worker logs, which rotate within hours. These events\n  // make every box transition and env recomputation drift readable from the DB\n  // alone. Payloads carry ids/flags/key NAMES only — never env values (secrets).\n  \"sandbox.box.created\", // box cold-created/cold-restored ({hydrated: \"archive\"|\"none\"})\n  \"sandbox.box.lost\", // resume-by-id found the box gone (provider NotFound)\n  \"sandbox.box.terminated\", // reaper drain terminated the box ({actor, persisted})\n  \"sandbox.box.snapshot\", // mid-session /workspace snapshot persisted ({trigger})\n  \"sandbox.env.drift\", // recomputed manifest env != live box env (key names only)\n  // Active-sandbox pointer reconcile (issue #341 invariant B). Turn start found the\n  // persisted (active_sandbox_id, active_epoch) pointing at a target the turn cannot\n  // establish — a deleted/absent sandbox, a Modal sibling with no establisher, or a\n  // selfhosted sandbox with no enrollment — and reset it to the session HOME under\n  // the epoch fence instead of routing every op into the dead target. A VISIBLE,\n  // never-silent downgrade: payload carries the typed reason + from/to epoch, never a\n  // target id or command content. Announce-only; hits the timeline projection default\n  // (no rendered item) like the other sandbox.* diagnostics.\n  \"session.route.reconciled\",\n  // Workbench v2 turn-end workspace capture. ANNOUNCE-ONLY: a new\n  // capture revision was persisted at turn end; the client refetches the latest\n  // capture. It carries metadata only (revision/turnId/capturedAt/leaseEpoch/stats),\n  // never file content. Hits the timeline projection default case (ignored) — it\n  // must NEVER gain a rendered timeline item without regenerating the golden\n  // snapshots (golden-grammar gate).\n  \"workspace.revision.captured\",\n  // Repository discovery could not prove a complete capture. The worker\n  // persisted a failed/degraded revision marker and clients must fall back to\n  // the live box rather than trust a zero-repository snapshot.\n  \"workspace.revision.degraded\",\n  // Connected Machine (selfhosted) op-outcome observability (failure-visibility\n  // doctrine, out-of-band plane). SESSION-scoped facts only: these fire for the\n  // session whose turn ran the op (the two-planes rule — machine-plane facts like\n  // pressure live in the M10 metrics DB, never as session events). Payloads carry\n  // the op kind + a typed fault class + attempt count — NEVER command content.\n  //\n  // `machine.op.failed` fires ONLY for INFRASTRUCTURE fault classes (offline,\n  // draining-exhausted, payload-too-large, reconnecting-timeout, OS/stream/protocol)\n  // — a semantic miss the model asked about (a missing path, a consent gate, a\n  // nonzero exit) is an OUTCOME, not an infra fault, and never fires this.\n  // `machine.op.recovered` is the healed-fault leading indicator (a blip/backpressure\n  // the transport absorbed): announce-only, quiet. Both hit the timeline projection's\n  // quiet status-tick tier (the severity split's \"degraded\"); adding a rendered item\n  // requires regenerating the golden snapshots (the golden-grammar gate).\n  \"machine.op.failed\",\n  \"machine.op.recovered\",\n  // Connected Machine (selfhosted) LINK-plane observability (failure-visibility\n  // doctrine). SESSION-scoped, ANNOUNCE-ONLY facts fanned out to the sessions that\n  // had an active op running on the machine when its control link changed — never\n  // to idle/historical sessions. Payloads carry ids / a typed reason / key-names\n  // only, NEVER command content.\n  //\n  // `machine.link.lost` — the machine announced a clean GoingOffline (its control\n  // link is going away) while a session had a running turn on it. `machine.link.\n  // restored` — a reconnect Hello re-established the link that was previously lost.\n  // `machine.runner.restarted` — the additional signal that the going-offline was\n  // a self-update restart specifically (link.lost also fires for it; this\n  // distinguishes a restart from a plain stop / host shutdown). All three hit the\n  // timeline projection's quiet default tier (no rendered item); adding a rendered\n  // item requires regenerating the golden snapshots (the golden-grammar gate).\n  \"machine.link.lost\",\n  \"machine.link.restored\",\n  \"machine.runner.restarted\",\n]);\nexport type SessionEventType = z.infer<typeof SessionEventType>;\n\n/**\n * Stable semantic groups for bounded session monitoring. These are a read\n * projection only: an event keeps its canonical durable `type`, and callers\n * can always combine a class with explicit type include/exclude filters.\n */\nexport const SessionEventSemanticClass = z.enum([\n  \"control\",\n  \"terminal\",\n  \"failure\",\n  \"checkpoint\",\n  \"tool_receipt\",\n  \"provider_account\",\n]);\nexport type SessionEventSemanticClass = z.infer<typeof SessionEventSemanticClass>;\n\n/**\n * The semantic classes accepted by an exclusive latest lookup. `receipt` is\n * the concise public spelling for the historical `tool_receipt` class; the\n * latter remains accepted everywhere for backwards compatibility.\n */\nexport const SessionEventLatestClass = z.enum([\n  \"control\",\n  \"terminal\",\n  \"failure\",\n  \"checkpoint\",\n  \"tool_receipt\",\n  \"provider_account\",\n  \"receipt\",\n]);\nexport type SessionEventLatestClass = z.infer<typeof SessionEventLatestClass>;\n\nexport function sessionEventLatestClassToSemanticClass(\n  value: SessionEventLatestClass,\n): SessionEventSemanticClass {\n  return value === \"receipt\" ? \"tool_receipt\" : value;\n}\n\nexport const SessionEventPayloadMode = z.enum([\"none\", \"summary\", \"full\"]);\nexport type SessionEventPayloadMode = z.infer<typeof SessionEventPayloadMode>;\n\n/** Select the compact semantic-result projection instead of an event array. */\nexport const SessionEventResultMode = z.enum([\"events\", \"compact\"]);\nexport type SessionEventResultMode = z.infer<typeof SessionEventResultMode>;\n\nexport const SessionEventReadMode = z.enum([\"monitoring\", \"forensic\"]);\nexport type SessionEventReadMode = z.infer<typeof SessionEventReadMode>;\n\nexport const SessionEventReadDirection = z.enum([\"after\", \"before\"]);\nexport type SessionEventReadDirection = z.infer<typeof SessionEventReadDirection>;\n\nexport const SESSION_EVENT_RAW_DELTA_TYPES = [\n  \"agent.message.delta\",\n  \"agent.reasoning.delta\",\n  \"sandbox.command.output.delta\",\n  \"terminal.pty.output.delta\",\n] as const satisfies readonly SessionEventType[];\n\nexport const SESSION_EVENT_SEMANTIC_CLASS_TYPES = {\n  control: [\n    \"session.status.changed\",\n    \"session.requiresAction\",\n    \"session.humanInput.requested\",\n    \"user.pause\",\n    \"user.approvalDecision\",\n    \"user.humanInputResponse\",\n    \"goal.set\",\n    \"goal.updated\",\n    \"goal.completed\",\n    \"goal.paused\",\n    \"goal.resumed\",\n    \"goal.cleared\",\n    \"goal.continuation\",\n    \"system.update.pending\",\n    \"system.update.delivered\",\n    \"session.control.paused\",\n    \"session.control.resumed\",\n    \"session.control.steer_requested\",\n    \"workspace.inference.paused\",\n    \"workspace.inference.resumed\",\n    \"session.queue.changed\",\n    \"session.queue.prompt.cancelled\",\n    \"session.mcp.approval_policy.updated\",\n    \"session.tool_policy.updated\",\n  ],\n  terminal: [\n    \"turn.completed\",\n    \"agent.message.completed\",\n    \"turn.failed\",\n    \"turn.cancelled\",\n    \"turn.superseded\",\n    \"goal.completed\",\n    \"goal.paused\",\n    \"rig.setup.completed\",\n    \"rig.setup.skipped\",\n    \"rig.setup.failed\",\n    \"sandbox.operation.completed\",\n    \"sandbox.operation.failed\",\n    \"recording.available\",\n    \"recording.failed\",\n    \"terminal.pty.exited\",\n  ],\n  failure: [\n    \"session.event.envelope_omitted\",\n    \"turn.failed\",\n    \"tool.auth_needed\",\n    \"credential.auth_needed\",\n    \"rig.setup.failed\",\n    \"sandbox.operation.failed\",\n    \"recording.failed\",\n    \"sandbox.box.lost\",\n    \"workspace.revision.degraded\",\n    \"machine.op.failed\",\n    \"machine.link.lost\",\n  ],\n  checkpoint: [\n    \"session.context.compaction.requested\",\n    \"session.context.compacted\",\n    \"session.context.compaction.skipped\",\n    \"session.context.cleared\",\n    \"turn.recovery.requested\",\n    \"session.queue.history\",\n    \"sandbox.box.snapshot\",\n    \"workspace.revision.captured\",\n  ],\n  tool_receipt: [\n    \"agent.toolCall.created\",\n    \"agent.toolCall.output\",\n    \"tool.auth_needed\",\n    \"artifact.created\",\n  ],\n  provider_account: [\n    \"agent.model.usage\",\n    \"codex.account.switched\",\n    \"codex.credential.selected\",\n    \"codex.capacity.waiting\",\n    \"codex.capacity.resumed\",\n    \"codex.capacity.superseded\",\n    \"sandbox.box.created\",\n    \"sandbox.box.lost\",\n    \"sandbox.box.terminated\",\n    \"sandbox.box.snapshot\",\n    \"sandbox.env.drift\",\n    \"session.route.reconciled\",\n    \"machine.op.failed\",\n    \"machine.op.recovered\",\n    \"machine.link.lost\",\n    \"machine.link.restored\",\n    \"machine.runner.restarted\",\n  ],\n} as const satisfies Record<SessionEventSemanticClass, readonly SessionEventType[]>;\n\nexport type ResolveSessionEventTypeFiltersInput = {\n  includeTypes?: readonly SessionEventType[] | undefined;\n  excludeTypes?: readonly SessionEventType[] | undefined;\n  includeClasses?: readonly SessionEventSemanticClass[] | undefined;\n  excludeClasses?: readonly SessionEventSemanticClass[] | undefined;\n  /** Applied unless the same type was explicitly included by type or class. */\n  defaultExcludeTypes?: readonly SessionEventType[] | undefined;\n};\n\n/** Resolve class/type filter algebra once so every read surface behaves alike. */\nexport function resolveSessionEventTypeFilters(input: ResolveSessionEventTypeFiltersInput): {\n  includeTypes: SessionEventType[];\n  excludeTypes: SessionEventType[];\n} {\n  const included = new Set<SessionEventType>(input.includeTypes ?? []);\n  for (const semanticClass of input.includeClasses ?? []) {\n    for (const type of SESSION_EVENT_SEMANTIC_CLASS_TYPES[semanticClass]) included.add(type);\n  }\n\n  const excluded = new Set<SessionEventType>(input.excludeTypes ?? []);\n  for (const semanticClass of input.excludeClasses ?? []) {\n    for (const type of SESSION_EVENT_SEMANTIC_CLASS_TYPES[semanticClass]) excluded.add(type);\n  }\n  for (const type of input.defaultExcludeTypes ?? []) {\n    if (!included.has(type)) excluded.add(type);\n  }\n\n  // An explicit exclusion always wins over a positive selector.\n  for (const type of excluded) included.delete(type);\n  return { includeTypes: [...included], excludeTypes: [...excluded] };\n}\n\nexport const ToolAuthNeededPayload = z.object({\n  serverId: z.string().min(1),\n  toolName: z.string().min(1).nullable().optional(),\n  providerDomain: z.string().min(1),\n  provider: z.string().min(1).max(128).optional(),\n  // Embedded hosts may use an opaque connection identity; never assume an\n  // OpenGeni UUID on the public event wire.\n  connectionId: z.string().min(1).nullable().optional(),\n  reason: z.enum([\n    \"missing_connection\",\n    \"expired\",\n    \"insufficient_scope\",\n    \"refresh_failed\",\n    \"unsupported_auth\",\n    \"resource_scope_unavailable\",\n  ]),\n  scopes: z.array(z.string().min(1)).optional(),\n  resource: z.string().min(1).optional(),\n  selectedResources: McpConnectionResourceScopes.optional(),\n  authorizationUrl: z.string().url().optional(),\n  subjectId: z.string().min(1).nullable().optional(),\n});\nexport type ToolAuthNeededPayload = z.infer<typeof ToolAuthNeededPayload>;\n\n/** A host-owned non-tool credential needed by the active run. */\nexport const CredentialAuthNeededPayload = z.object({\n  credentialClass: z.literal(\"run\"),\n  providerDomain: z.string().min(1).optional(),\n  connectionId: z.string().min(1).optional(),\n  reason: z.enum([\"missing_connection\", \"expired\", \"insufficient_scope\", \"refresh_failed\"]),\n  scopes: z.array(z.string().min(1)).optional(),\n  resource: z.string().min(1).optional(),\n  authorizationUrl: z.string().url().optional(),\n  message: z.string().min(1).optional(),\n});\nexport type CredentialAuthNeededPayload = z.infer<typeof CredentialAuthNeededPayload>;\n\n// Channel-B stream-event payloads (07-channel-b §1.2). SessionEvent.payload is\n// z.unknown() (NOT a discriminated union) — these are standalone schemas parsed\n// explicitly at the producer (the API-direct handshake/rotation) and the SDK/\n// React consumer. The rotation payload carries the freshly-minted data-plane URL\n// + the scoped stream token so a connected client hot-swaps its noVNC socket.\nexport const StreamUrlRotatedPayload = z.object({\n  url: z.string().url(),\n  token: z.string().nullable(),\n  expiresAt: z.string().datetime().nullable(),\n  // The epoch the new URL was minted under (the box-rollover fence the client\n  // reconciles against). A client must drop a rotation event whose epoch it has\n  // already advanced past.\n  leaseEpoch: z.number().int().nonnegative(),\n  transport: z.literal(\"vnc-ws\"),\n  // The viewer holder this URL is for (so a client filters out other viewers').\n  viewerId: z.string().uuid().nullable().default(null),\n});\nexport type StreamUrlRotatedPayload = z.infer<typeof StreamUrlRotatedPayload>;\n\nexport const StreamOpenedPayload = z.object({\n  viewerId: z.string().uuid(),\n  shared: z.boolean().default(false),\n  viewerCount: z.number().int().nonnegative(),\n});\nexport type StreamOpenedPayload = z.infer<typeof StreamOpenedPayload>;\n\nexport const StreamClosedPayload = z.object({\n  viewerId: z.string().uuid(),\n  reason: z.enum([\"client-disconnect\", \"reaped\", \"revoked\", \"box-rollover\"]),\n  viewerCount: z.number().int().nonnegative(),\n});\nexport type StreamClosedPayload = z.infer<typeof StreamClosedPayload>;\n\nexport const StreamRevokedPayload = z.object({\n  viewerId: z.string().uuid().nullable().default(null),\n  reason: z.enum([\"grant-revoked\", \"session-failed\", \"admin\"]),\n});\nexport type StreamRevokedPayload = z.infer<typeof StreamRevokedPayload>;\n\n// ── Recording payloads (P4.3 / module 05 §3.4) ──────────────────────────────\n// SessionEvent.payload is z.unknown() (NOT a discriminated union) — these are\n// standalone schemas parsed explicitly at the producer (the recording activity)\n// and the SDK/React consumer. The codec/contentType pair stays consistent\n// (h264-mp4↔video/mp4, vp9-webm↔video/webm).\nexport const RecordingMode = z.enum([\"manual\", \"on-turn\", \"on-verify\"]);\nexport type RecordingMode = z.infer<typeof RecordingMode>;\nexport const RecordingCodec = z.enum([\"h264-mp4\", \"vp9-webm\"]);\nexport type RecordingCodec = z.infer<typeof RecordingCodec>;\nexport const RecordingContentType = z.enum([\"video/mp4\", \"video/webm\"]);\nexport type RecordingContentType = z.infer<typeof RecordingContentType>;\n\nexport const RecordingStartedPayload = z.object({\n  recordingId: z.string().uuid(),\n  turnId: z.string().uuid().nullable(),\n  mode: RecordingMode,\n  codec: RecordingCodec,\n  dimensions: z.tuple([z.number().int().positive(), z.number().int().positive()]),\n  framerate: z.number().int().positive(),\n  startedAt: z.string(), // ISO\n  // The verification rationale (\"agent-verification: tf apply succeeded\"). Agent-\n  // authored free text — the producer caps + scrubs it before emit.\n  reason: z.string().nullable().optional(),\n});\nexport type RecordingStartedPayload = z.infer<typeof RecordingStartedPayload>;\n\nexport const RecordingAvailablePayload = z.object({\n  recordingId: z.string().uuid(),\n  turnId: z.string().uuid().nullable(),\n  codec: RecordingCodec,\n  contentType: RecordingContentType,\n  // The @opengeni/storage object key. NO long-lived URL in the event — clients\n  // mint a short-TTL signed GET via GET …/recordings/:id/url.\n  storageKey: z.string(),\n  durationSeconds: z.number().nonnegative().nullable(),\n  sizeBytes: z.number().int().nonnegative(),\n  dimensions: z.tuple([z.number().int().positive(), z.number().int().positive()]),\n});\nexport type RecordingAvailablePayload = z.infer<typeof RecordingAvailablePayload>;\n\n// `max-bytes-exceeded` is distinct from `timeout` (the -t ceiling hitting is a\n// SUCCESSFUL finalize, never a failure) — the adversarial-review F7 fix.\nexport const RecordingFailedReason = z.enum([\n  \"ffmpeg-error\",\n  \"box-death\",\n  \"box-rollover\",\n  \"upload-failed\",\n  \"max-bytes-exceeded\",\n  \"display-unavailable\",\n]);\nexport type RecordingFailedReason = z.infer<typeof RecordingFailedReason>;\n\nexport const RecordingFailedPayload = z.object({\n  recordingId: z.string().uuid(),\n  turnId: z.string().uuid().nullable(),\n  reason: RecordingFailedReason,\n  // ffmpeg-stderr tail / error detail — agent/ffmpeg-controlled, so the producer\n  // caps + scrubs it before emit (it rides redact() like every payload).\n  detail: z.string().nullable().optional(),\n});\nexport type RecordingFailedPayload = z.infer<typeof RecordingFailedPayload>;\n\n// ── Structured sandbox services ─────────────────────────────────────────────\n// Two transports on one spine: the A2 request/response shapes (FsNode tree,\n// GitDiff hunks, terminal exec) are returned INLINE on synchronous API-direct\n// routes (never the bus); the A1 notification payloads below ride the durable\n// SSE event log so every viewer's Pierre tree / diff / terminal stays live.\n\n// --- A1 event payloads -------------------------------------------------------\n\n// The agent's command-output firehose, enriched. Backward-compatible widening\n// of the existing sandbox.command.output.delta (consumers read `chunk`); the\n// producer may now also stamp stream/commandId/seq for finer terminal rendering.\nexport const SandboxCommandOutputDeltaPayload = z.object({\n  stream: z.enum([\"stdout\", \"stderr\"]).default(\"stdout\"),\n  chunk: z.string(), // raw bytes, utf-8 (lossy) — terminal is opaque-ish\n  commandId: z.string().optional(), // groups deltas to one agent command\n  seq: z.number().int().nonnegative().optional(), // intra-command ordering hint\n});\nexport type SandboxCommandOutputDeltaPayload = z.infer<typeof SandboxCommandOutputDeltaPayload>;\n\nexport const FsChangeKind = z.enum([\"created\", \"modified\", \"deleted\", \"renamed\"]);\nexport type FsChangeKind = z.infer<typeof FsChangeKind>;\nexport const FsChangedPayload = z.object({\n  changes: z\n    .array(\n      z.object({\n        path: z.string(), // workspace-relative POSIX path\n        kind: FsChangeKind,\n        isDir: z.boolean().default(false),\n        sizeBytes: z.number().int().nonnegative().nullable().default(null),\n        oldPath: z.string().optional(), // for \"renamed\"\n      }),\n    )\n    .min(1),\n  source: z.enum([\"write\", \"watch\", \"agent\"]).default(\"write\"),\n  // Monotonic FS revision (per-lease, paired with leaseEpoch for staleness).\n  revision: z.number().int().nonnegative(),\n  // The lease epoch the revision was minted under: a client invalidates on a\n  // (leaseEpoch, revision) tuple change, never a bare revision compare (H3 —\n  // revision resets to 0 on box re-key, so a bare monotonic compare goes stale).\n  leaseEpoch: z.number().int().nonnegative().default(0),\n});\nexport type FsChangedPayload = z.infer<typeof FsChangedPayload>;\n\nexport const GitChangedPayload = z.object({\n  head: z.string().nullable(), // current branch or detached SHA\n  dirty: z.boolean(), // working tree has uncommitted changes\n  ahead: z.number().int().nonnegative().default(0),\n  behind: z.number().int().nonnegative().default(0),\n  changedFileCount: z.number().int().nonnegative(),\n  reason: z\n    .enum([\"commit\", \"checkout\", \"stage\", \"worktree\", \"fetch\", \"unknown\"])\n    .default(\"unknown\"),\n  revision: z.number().int().nonnegative().default(0),\n  leaseEpoch: z.number().int().nonnegative().default(0),\n});\nexport type GitChangedPayload = z.infer<typeof GitChangedPayload>;\n\nexport const TerminalPtyStartedPayload = z.object({\n  ptyId: z.string().uuid(),\n  cols: z.number().int().positive(),\n  rows: z.number().int().positive(),\n  shell: z.string(), // resolved shell, e.g. \"/bin/bash\"\n  cwd: z.string(),\n});\nexport type TerminalPtyStartedPayload = z.infer<typeof TerminalPtyStartedPayload>;\n\nexport const TerminalPtyOutputDeltaPayload = z.object({\n  ptyId: z.string().uuid(),\n  stream: z.enum([\"stdout\", \"stderr\"]).default(\"stdout\"),\n  chunk: z.string(), // raw terminal bytes (incl. ANSI), utf-8 lossy\n  seq: z.number().int().nonnegative(), // strict per-pty ordering (owner-assigned)\n});\nexport type TerminalPtyOutputDeltaPayload = z.infer<typeof TerminalPtyOutputDeltaPayload>;\n\nexport const TerminalPtyExitedPayload = z.object({\n  ptyId: z.string().uuid(),\n  exitCode: z.number().int().nullable(),\n  reason: z.enum([\"exit\", \"killed\", \"owner_gone\", \"timeout\", \"lost\"]),\n});\nexport type TerminalPtyExitedPayload = z.infer<typeof TerminalPtyExitedPayload>;\n\n// --- A2 FileSystem request/response (NOT events; returned inline) ------------\nexport const FsNodeType = z.enum([\"file\", \"dir\", \"symlink\", \"other\"]);\nexport type FsNodeType = z.infer<typeof FsNodeType>;\n// The Pierre-tree node. `children` is present only when the dir was listed with\n// depth>0; the tree lazy-expands via repeated depth-1 lists at deeper paths.\nexport interface FsTreeNode {\n  name: string;\n  path: string; // workspace-relative POSIX, no leading slash\n  type: z.infer<typeof FsNodeType>;\n  sizeBytes: number | null; // null for dirs\n  mtimeMs: number | null;\n  mode: number | null; // unix mode bits, for Pierre tree icons/perms\n  children?: FsTreeNode[] | undefined;\n  truncated: boolean; // dir had more entries than the cap\n}\nexport const FsTreeNode: z.ZodType<FsTreeNode> = z.lazy(() =>\n  z.object({\n    name: z.string(),\n    path: z.string(),\n    type: FsNodeType,\n    sizeBytes: z.number().int().nonnegative().nullable(),\n    mtimeMs: z.number().int().nonnegative().nullable(),\n    mode: z.number().int().nullable(),\n    children: z.array(FsTreeNode).optional(),\n    truncated: z.boolean().default(false),\n  }),\n) as z.ZodType<FsTreeNode>;\n\nexport const FsListRequest = z.object({\n  path: z.string().default(\"\"), // \"\" = workspace root\n  depth: z.number().int().min(0).max(8).default(1),\n  maxEntries: z.number().int().positive().max(20_000).default(2_000),\n  includeHidden: z.boolean().default(true),\n});\nexport type FsListRequest = z.infer<typeof FsListRequest>;\nexport const FsListResponse = z.object({\n  root: FsTreeNode,\n  revision: z.number().int().nonnegative(),\n  truncated: z.boolean(), // global cap hit\n});\nexport type FsListResponse = z.infer<typeof FsListResponse>;\n\nexport const FsEncoding = z.enum([\"utf8\", \"base64\"]);\nexport type FsEncoding = z.infer<typeof FsEncoding>;\nexport const FsReadRequest = z.object({\n  path: z.string(),\n  encoding: FsEncoding.default(\"utf8\"),\n  maxBytes: z\n    .number()\n    .int()\n    .positive()\n    .max(25 * 1024 * 1024)\n    .default(5 * 1024 * 1024),\n});\nexport type FsReadRequest = z.infer<typeof FsReadRequest>;\nexport const FsReadResponse = z.object({\n  path: z.string(),\n  encoding: FsEncoding,\n  content: z.string(), // text or base64 per encoding\n  sizeBytes: z.number().int().nonnegative(), // bytes returned (== content size)\n  truncated: z.boolean(), // sizeBytes hit maxBytes; content is the prefix\n  isBinary: z.boolean(), // sniffed NUL byte in first 8KB\n  revision: z.number().int().nonnegative(),\n});\nexport type FsReadResponse = z.infer<typeof FsReadResponse>;\n\nexport const FsWriteRequest = z.object({\n  path: z.string(),\n  encoding: FsEncoding.default(\"utf8\"),\n  content: z.string(),\n  overwrite: z.boolean().default(true), // false + existing path => 409\n  createParents: z.boolean().default(true),\n});\nexport type FsWriteRequest = z.infer<typeof FsWriteRequest>;\nexport const FsWriteResponse = z.object({\n  path: z.string(),\n  sizeBytes: z.number().int().nonnegative(),\n  revision: z.number().int().nonnegative(), // == the fs.changed revision\n});\nexport type FsWriteResponse = z.infer<typeof FsWriteResponse>;\n\nexport const FsDeleteRequest = z.object({\n  path: z.string(),\n  recursive: z.boolean().default(false), // required true to delete a non-empty dir\n});\nexport type FsDeleteRequest = z.infer<typeof FsDeleteRequest>;\nexport const FsDeleteResponse = z.object({\n  revision: z.number().int().nonnegative(),\n});\nexport type FsDeleteResponse = z.infer<typeof FsDeleteResponse>;\n\nexport const FsMoveRequest = z.object({\n  path: z.string(),\n  newPath: z.string(),\n  overwrite: z.boolean().default(false), // false + existing destination => 409\n  createParents: z.boolean().default(true),\n});\nexport type FsMoveRequest = z.infer<typeof FsMoveRequest>;\nexport const FsMoveResponse = z.object({\n  path: z.string(),\n  newPath: z.string(),\n  revision: z.number().int().nonnegative(), // == the fs.changed revision\n});\nexport type FsMoveResponse = z.infer<typeof FsMoveResponse>;\n\nexport const FsMkdirRequest = z.object({\n  path: z.string(),\n  recursive: z.boolean().default(true), // false + existing path => 400\n});\nexport type FsMkdirRequest = z.infer<typeof FsMkdirRequest>;\nexport const FsMkdirResponse = z.object({\n  path: z.string(),\n  revision: z.number().int().nonnegative(), // == the fs.changed revision\n});\nexport type FsMkdirResponse = z.infer<typeof FsMkdirResponse>;\n\n// --- A2 Git request/response (read-only; feeds Pierre diff/tree) -------------\nexport const GitFileStatusCode = z.enum([\n  \"added\",\n  \"modified\",\n  \"deleted\",\n  \"renamed\",\n  \"copied\",\n  \"untracked\",\n  \"ignored\",\n  \"conflicted\",\n  \"typechange\",\n]);\nexport type GitFileStatusCode = z.infer<typeof GitFileStatusCode>;\nexport const GitFileStatus = z.object({\n  path: z.string(),\n  oldPath: z.string().nullable(), // for renamed/copied\n  index: GitFileStatusCode.nullable(), // staged change (X in porcelain XY)\n  worktree: GitFileStatusCode.nullable(), // unstaged change (Y in porcelain XY)\n  isConflicted: z.boolean().default(false),\n});\nexport type GitFileStatus = z.infer<typeof GitFileStatus>;\nexport const GitStatusRequest = z.object({\n  path: z.string().default(\"\"), // repo root within workspace (multi-repo support)\n});\nexport type GitStatusRequest = z.infer<typeof GitStatusRequest>;\nexport const GitStatusResponse = z.object({\n  isRepo: z.boolean(),\n  head: z.string().nullable(), // branch name\n  detached: z.boolean().default(false),\n  upstream: z.string().nullable(),\n  ahead: z.number().int().nonnegative().default(0),\n  behind: z.number().int().nonnegative().default(0),\n  files: z.array(GitFileStatus),\n  revision: z.number().int().nonnegative(),\n});\nexport type GitStatusResponse = z.infer<typeof GitStatusResponse>;\n\n// The structured hunk shape that feeds Pierre diff — the whole point of Git.\nexport const GitDiffLineType = z.enum([\"context\", \"add\", \"del\", \"meta\"]);\nexport type GitDiffLineType = z.infer<typeof GitDiffLineType>;\nexport const GitDiffLine = z.object({\n  type: GitDiffLineType,\n  // null on the side that doesn't have the line (add => oldNo null; del => newNo null)\n  oldNo: z.number().int().positive().nullable(),\n  newNo: z.number().int().positive().nullable(),\n  text: z.string(), // line WITHOUT leading +/-/space marker\n});\nexport type GitDiffLine = z.infer<typeof GitDiffLine>;\nexport const GitDiffHunk = z.object({\n  oldStart: z.number().int().nonnegative(),\n  oldLines: z.number().int().nonnegative(),\n  newStart: z.number().int().nonnegative(),\n  newLines: z.number().int().nonnegative(),\n  header: z.string(), // the @@ ... @@ section heading\n  lines: z.array(GitDiffLine),\n});\nexport type GitDiffHunk = z.infer<typeof GitDiffHunk>;\nexport const GitFileDiff = z.object({\n  path: z.string(),\n  oldPath: z.string().nullable(),\n  status: GitFileStatusCode,\n  isBinary: z.boolean().default(false),\n  isImage: z.boolean().default(false),\n  additions: z.number().int().nonnegative(),\n  deletions: z.number().int().nonnegative(),\n  hunks: z.array(GitDiffHunk), // empty if binary or truncated\n  truncated: z.boolean().default(false), // diff exceeded maxBytes; hunks omitted\n});\nexport type GitFileDiff = z.infer<typeof GitFileDiff>;\nexport const GitDiffRequest = z.object({\n  path: z.string().default(\"\"), // repo root\n  // diff selectors, mutually exclusive precedence: refs > staged > worktree\n  staged: z.boolean().default(false), // --cached (index vs HEAD)\n  // Workspace review includes after-images that ordinary `git diff` omits.\n  // Explicit so commit/staged consumers keep native Git semantics by default.\n  includeUntracked: z.boolean().default(false),\n  fromRef: z.string().optional(),\n  toRef: z.string().optional(),\n  pathspec: z.array(z.string()).default([]),\n  contextLines: z.number().int().min(0).max(10).default(3),\n  maxBytesPerFile: z\n    .number()\n    .int()\n    .positive()\n    .max(2 * 1024 * 1024)\n    .default(512 * 1024),\n});\nexport type GitDiffRequest = z.infer<typeof GitDiffRequest>;\nexport const GitDiffResponse = z.object({\n  files: z.array(GitFileDiff),\n  revision: z.number().int().nonnegative(),\n});\nexport type GitDiffResponse = z.infer<typeof GitDiffResponse>;\n\n// ─── Workbench v2 turn-end workspace capture ────────────\n// A capture is a point-in-time snapshot of the session workspace's CHANGES,\n// probed live off the box at turn end (detectRepos → gitStatus/gitDiff → fsRead\n// after-images → fsList tree index). It is the cold/offline read source that\n// lets the workbench paint instantly with zero machine round-trips. Live always\n// wins when the box is warm; a capture is a labelled cache, never a replacement.\n// This is the shape the M1 worker writes and the M2 API serves inline.\n\n// One touched file in the capture. `contentRef` is the content-addressed storage\n// key of its after-image blob (shared across revisions → the GC set-difference\n// key). Deleted / binary / >5MB (tooLarge) files carry no contentRef; the UI\n// renders \"too large — open live\" for tooLarge, and the diff hunks for the rest.\nexport const WorkspaceCaptureFile = z.object({\n  path: z.string(),\n  status: GitFileStatusCode,\n  // sha256 of the captured after-image bytes; null when deleted / tooLarge.\n  hash: z.string().nullable(),\n  // git blob sha of the HEAD version — the wake-on-edit flush guard (design\n  // §10.1). null when the path is new/untracked (no HEAD blob).\n  baseHash: z.string().nullable(),\n  // Content-addressed storage key of the after-image; null when deleted /\n  // tooLarge / binary (no inline content captured).\n  contentRef: z.string().nullable(),\n  sizeBytes: z.number().int().nonnegative(),\n  isBinary: z.boolean().default(false),\n  // >5MB per-file content guard tripped: content NOT captured, render \"open live\".\n  tooLarge: z.boolean().default(false),\n  deleted: z.boolean().default(false),\n});\nexport type WorkspaceCaptureFile = z.infer<typeof WorkspaceCaptureFile>;\n\n// One repo discovered in the workspace. `diff` is `git diff HEAD` (combined\n// staged+unstaged tracked changes vs HEAD — the review diff); `status` is the\n// full porcelain file list (drives the rail glyphs incl. untracked, which the\n// HEAD diff omits). root \"\" = the workspace root repo.\nexport const WorkspaceCaptureRepo = z.object({\n  root: z.string(),\n  head: z.string().nullable(),\n  detached: z.boolean().default(false),\n  upstream: z.string().nullable(),\n  ahead: z.number().int().nonnegative().default(0),\n  behind: z.number().int().nonnegative().default(0),\n  status: z.array(GitFileStatus),\n  diff: z.array(GitFileDiff),\n});\nexport type WorkspaceCaptureRepo = z.infer<typeof WorkspaceCaptureRepo>;\n\nexport const WorkspaceCaptureDegradedReason = z.enum([\n  \"repository_discovery_command_failed\",\n  \"repository_discovery_timed_out\",\n  \"repository_discovery_result_limit_exceeded\",\n  \"repository_read_unavailable\",\n]);\nexport type WorkspaceCaptureDegradedReason = z.infer<typeof WorkspaceCaptureDegradedReason>;\n\n// Rollup counters — carried on the row (jsonb) and the announce event so the UI\n// can reserve layout (no layout shift) before fetching the manifest.\nexport const WorkspaceCaptureStats = z.object({\n  repoCount: z.number().int().nonnegative(),\n  fileCount: z.number().int().nonnegative(),\n  additions: z.number().int().nonnegative(),\n  deletions: z.number().int().nonnegative(),\n  totalBytes: z.number().int().nonnegative(),\n  tooLargeCount: z.number().int().nonnegative(),\n  binaryCount: z.number().int().nonnegative(),\n  treeEntryCount: z.number().int().nonnegative(),\n  treeTruncated: z.boolean().default(false),\n  durationMs: z.number().int().nonnegative(),\n  // sha256 over the change surface (per-file path/hash/status + per-repo diff\n  // summary, tree/mtime excluded). The empty-turn gate skips a capture whose\n  // fingerprint equals the previous revision's — \"no new revision when nothing\n  // changed\" holds even when the tree stays dirty across read-only turns.\n  fingerprint: z.string().optional(),\n});\nexport type WorkspaceCaptureStats = z.infer<typeof WorkspaceCaptureStats>;\n\n// The single manifest blob (one per revision). Holds everything the workbench\n// needs for a cold paint: the tree index, per-repo status+diff, and the file\n// index (after-image refs). The M2 API serves this inline when small (≤2MB).\nexport const WorkspaceCaptureManifest = z.object({\n  version: z.literal(1),\n  revision: z.number().int().nonnegative(),\n  capturedAt: z.string(),\n  turnId: z.string().nullable(),\n  leaseEpoch: z.number().int().nonnegative(),\n  treeIndex: FsTreeNode,\n  treeTruncated: z.boolean().default(false),\n  repos: z.array(WorkspaceCaptureRepo),\n  files: z.array(WorkspaceCaptureFile),\n  stats: WorkspaceCaptureStats,\n});\nexport type WorkspaceCaptureManifest = z.infer<typeof WorkspaceCaptureManifest>;\n\n// Announce-only event payload. Metadata only — never content.\nexport const WorkspaceRevisionCapturedPayload = z.object({\n  revision: z.number().int().nonnegative(),\n  turnId: z.string().nullable(),\n  capturedAt: z.string(),\n  leaseEpoch: z.number().int().nonnegative(),\n  stats: WorkspaceCaptureStats,\n});\nexport type WorkspaceRevisionCapturedPayload = z.infer<typeof WorkspaceRevisionCapturedPayload>;\n\nexport const WorkspaceRevisionDegradedPayload = z.object({\n  revision: z.number().int().nonnegative(),\n  turnId: z.string().nullable(),\n  capturedAt: z.string(),\n  leaseEpoch: z.number().int().nonnegative(),\n  reason: WorkspaceCaptureDegradedReason,\n});\nexport type WorkspaceRevisionDegradedPayload = z.infer<typeof WorkspaceRevisionDegradedPayload>;\n\n// --- M2 capture READ API -------------------------------------\n// A short-TTL signed GET URL minted PER REQUEST (never stored). The manifest is\n// served inline for the ≤2MB common case (the <200ms one-round-trip paint); a\n// >2MB manifest and a >256KB single-file after-image fall back to one of these.\nexport const WorkspaceCaptureSignedUrl = z.object({\n  url: z.string().url(),\n  expiresAt: z.string(),\n});\nexport type WorkspaceCaptureSignedUrl = z.infer<typeof WorkspaceCaptureSignedUrl>;\n\n// GET …/sessions/:sid/workspace/capture. `{available:false}` when no capture row\n// exists yet (or its manifest blob was GC'd) — the client falls back to the\n// live/wake path (status-quo behavior, NEVER an error → served 200). When\n// available: the row metadata (revision/turn/epoch/stats/size) is always inline;\n// the manifest is inline (`manifest`) for the ≤2MB common case and a signed GET\n// URL (`manifestUrl`) above that. Exactly one of manifest/manifestUrl is non-null.\nexport const GetWorkspaceCaptureResponse = z.discriminatedUnion(\"available\", [\n  z.object({\n    available: z.literal(false),\n    // Optional for additive compatibility with older servers. New servers set\n    // these fields when the newest durable revision is an explicit degraded\n    // marker rather than \"no capture exists yet\".\n    degradedReason: WorkspaceCaptureDegradedReason.nullable().optional(),\n    revision: z.number().int().nonnegative().nullable().optional(),\n    capturedAt: z.string().nullable().optional(),\n    turnId: z.string().nullable().optional(),\n    leaseEpoch: z.number().int().nonnegative().nullable().optional(),\n  }),\n  z.object({\n    available: z.literal(true),\n    revision: z.number().int().nonnegative(),\n    capturedAt: z.string(),\n    turnId: z.string().nullable(),\n    leaseEpoch: z.number().int().nonnegative(),\n    sizeBytes: z.number().int().nonnegative(),\n    stats: WorkspaceCaptureStats,\n    manifest: WorkspaceCaptureManifest.nullable().default(null),\n    manifestUrl: WorkspaceCaptureSignedUrl.nullable().default(null),\n  }),\n]);\nexport type GetWorkspaceCaptureResponse = z.infer<typeof GetWorkspaceCaptureResponse>;\n\n// GET …/sessions/:sid/workspace/capture/file?path=…&revision=…. A single\n// after-image resolved from the (revision|latest) manifest. The file metadata\n// (from the manifest entry) is always present; `content` is inline for ≤256KB\n// (base64 for binary, utf8 otherwise), else a signed GET URL (`contentUrl`) to\n// the raw content-addressed blob. A tooLarge marker (or a captured file with no\n// content blob — e.g. the after-image was GC'd) returns metadata only, no\n// content and no URL. Path-not-in-manifest / deleted → 404 at the route (not\n// represented here).\nexport const GetWorkspaceCaptureFileResponse = z.object({\n  path: z.string(),\n  revision: z.number().int().nonnegative(),\n  status: GitFileStatusCode,\n  hash: z.string().nullable(),\n  baseHash: z.string().nullable(),\n  sizeBytes: z.number().int().nonnegative(),\n  isBinary: z.boolean(),\n  tooLarge: z.boolean(),\n  encoding: FsEncoding.nullable().default(null), // set iff content is inline\n  content: z.string().nullable().default(null), // inline ≤256KB (per encoding)\n  contentUrl: WorkspaceCaptureSignedUrl.nullable().default(null), // signed >256KB\n});\nexport type GetWorkspaceCaptureFileResponse = z.infer<typeof GetWorkspaceCaptureFileResponse>;\n\nexport const GitLogRequest = z.object({\n  path: z.string().default(\"\"),\n  ref: z.string().default(\"HEAD\"),\n  maxCount: z.number().int().positive().max(1_000).default(100),\n  skip: z.number().int().nonnegative().default(0),\n  pathspec: z.array(z.string()).default([]),\n});\nexport type GitLogRequest = z.infer<typeof GitLogRequest>;\nexport const GitCommit = z.object({\n  sha: z.string(),\n  shortSha: z.string(),\n  parents: z.array(z.string()),\n  author: z.object({\n    name: z.string(),\n    email: z.string(),\n    timestamp: z.number().int(),\n  }),\n  committer: z.object({\n    name: z.string(),\n    email: z.string(),\n    timestamp: z.number().int(),\n  }),\n  subject: z.string(),\n  body: z.string(),\n  refs: z.array(z.string()).default([]), // decorations: branch/tag pointers\n});\nexport type GitCommit = z.infer<typeof GitCommit>;\nexport const GitLogResponse = z.object({\n  commits: z.array(GitCommit),\n  hasMore: z.boolean(),\n});\nexport type GitLogResponse = z.infer<typeof GitLogResponse>;\n\nexport const GitShowRequest = z.object({\n  path: z.string().default(\"\"),\n  ref: z.string(), // a commit/tag/tree-ish\n  filePath: z.string().optional(), // ref + filePath => raw blob (\"open file at commit\")\n  encoding: FsEncoding.default(\"utf8\"),\n  maxBytesPerFile: z\n    .number()\n    .int()\n    .positive()\n    .max(2 * 1024 * 1024)\n    .default(512 * 1024),\n});\nexport type GitShowRequest = z.infer<typeof GitShowRequest>;\nexport const GitShowResponse = z.object({\n  commit: GitCommit.nullable(), // null when fetching a raw blob\n  files: z.array(GitFileDiff), // commit diff vs first parent\n  blob: z\n    .object({\n      content: z.string(),\n      encoding: FsEncoding,\n      sizeBytes: z.number().int(),\n      truncated: z.boolean(),\n    })\n    .nullable(),\n  revision: z.number().int().nonnegative(),\n});\nexport type GitShowResponse = z.infer<typeof GitShowResponse>;\n\n// --- A2 Terminal exec (run a command in-box, stream stdout/stderr) -----------\n// The command-output FIREHOSE rides A1 (sandbox.command.output.delta). This is\n// the SYNCHRONOUS exec: run a bounded command and return its stdout/stderr +\n// exit code inline (the result IS the HTTP response). Full interactive PTY\n// (open/write/resize) layers on top via the pty.* events; exec ships now.\nexport const TerminalExecRequest = z.object({\n  command: z.string().min(1),\n  cwd: z.string().default(\"\"), // workspace-relative\n  // Hard wall-clock bound. A timeout response is returned only after the exact\n  // provider process is physically absent and any retained admission settles.\n  timeoutMs: z.number().int().positive().max(120_000).default(30_000),\n  // Stream the deltas onto A1 as the agent firehose (so other viewers see it),\n  // in addition to returning the buffered result inline.\n  emitStream: z.boolean().default(true),\n});\nexport type TerminalExecRequest = z.infer<typeof TerminalExecRequest>;\nexport const TerminalExecResponse = z.object({\n  stdout: z.string(),\n  stderr: z.string(),\n  exitCode: z.number().int(),\n  // Retained for wire compatibility; synchronous exec never exposes a live\n  // provider process. Interactive work uses the PTY API.\n  running: z.literal(false),\n  wallTimeSeconds: z.number().nonnegative(),\n});\nexport type TerminalExecResponse = z.infer<typeof TerminalExecResponse>;\n\n// --- A2 Terminal PTY control (output rides A1) -------------------------------\nexport const PtyOpenRequest = z.object({\n  cols: z.number().int().positive().max(500).default(80),\n  rows: z.number().int().positive().max(300).default(24),\n  cwd: z.string().default(\"\"), // workspace-relative\n  shell: z.string().optional(), // default: resolved login shell\n});\nexport type PtyOpenRequest = z.infer<typeof PtyOpenRequest>;\nexport const PtyOpenResponse = z.object({\n  ptyId: z.string().uuid(),\n  // output streams as terminal.pty.output.delta on the SSE channel the client holds\n  streamVia: z.literal(\"sse-events\"),\n  supportsInput: z.boolean(), // false on backends without writeStdin\n});\nexport type PtyOpenResponse = z.infer<typeof PtyOpenResponse>;\nexport const PtyWriteRequest = z.object({\n  ptyId: z.string().uuid(),\n  data: z.string(),\n}); // utf-8 stdin\nexport type PtyWriteRequest = z.infer<typeof PtyWriteRequest>;\nexport const PtyResizeRequest = z.object({\n  ptyId: z.string().uuid(),\n  cols: z.number().int().positive(),\n  rows: z.number().int().positive(),\n});\nexport type PtyResizeRequest = z.infer<typeof PtyResizeRequest>;\nexport const PtyCloseRequest = z.object({ ptyId: z.string().uuid() });\nexport type PtyCloseRequest = z.infer<typeof PtyCloseRequest>;\n\n// Per-session structured-service capabilities (the Channel-A slice of the\n// negotiation). The full SessionCapabilities doc already carries FileSystem /\n// Terminal / Git blocks (P0.1); this is the compact projection the SDK mirrors.\nexport const SessionStructuredCapabilities = z.object({\n  FileSystem: z.object({\n    available: z.boolean(),\n    readOnly: z.boolean(),\n    root: z.string(),\n  }),\n  Terminal: z.object({\n    events: z.boolean(), // command.output firehose (always on if a box exists)\n    exec: z.boolean(), // synchronous terminal exec\n    pty: z.object({ available: z.boolean() }), // interactive stdin (writeStdin)\n  }),\n  Git: z.object({ available: z.boolean(), repos: z.array(z.string()) }),\n});\nexport type SessionStructuredCapabilities = z.infer<typeof SessionStructuredCapabilities>;\n\nexport const SessionEvent = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  sequence: z.number().int().positive(),\n  type: SessionEventType,\n  payload: z.unknown().default({}),\n  occurredAt: z.string(),\n  clientEventId: SessionOperationKey.nullable().optional(),\n  turnId: z.string().uuid().nullable().optional(),\n  turnGeneration: z.number().int().nonnegative().nullable().optional(),\n  turnAttemptId: z.string().uuid().nullable().optional(),\n  turnAssociation: z.enum([\"current\", \"late_rejected\", \"duplicate\"]).nullable().optional(),\n  duplicateOfEventId: z.string().uuid().nullable().optional(),\n  duplicateReason: z.string().min(1).max(1024).nullable().optional(),\n});\nexport type SessionEvent = z.infer<typeof SessionEvent>;\n\nexport type SessionEventCompactResult = {\n  version: 1;\n  semanticClass: SessionEventSemanticClass;\n  source: {\n    id: string;\n    type: SessionEventType;\n    sequence: number;\n    occurredAt: string;\n    turnId: string | null;\n    turnGeneration: number | null;\n    turnAttemptId: string | null;\n    turnAssociation: SessionEvent[\"turnAssociation\"];\n  };\n  // These identity fields are repeated at the top level intentionally: an\n  // MCP caller can act on the result without unpacking the source envelope.\n  id: string;\n  type: SessionEventType;\n  sequence: number;\n  occurredAt: string;\n  turnId: string | null;\n  turnGeneration: number | null;\n  turnAttemptId: string | null;\n  turnAssociation: SessionEvent[\"turnAssociation\"];\n  coveredSequence: { first: number; last: number };\n  status:\n    | \"completed\"\n    | \"failed\"\n    | \"cancelled\"\n    | \"superseded\"\n    | \"checkpoint\"\n    | \"receipt\"\n    | \"unknown\";\n  text: string | null;\n  output: unknown;\n  result: unknown;\n  failure: {\n    error: string | null;\n    code: string | null;\n    retryable: boolean | null;\n    recovery: string | null;\n  } | null;\n  checkpoint: unknown;\n  receipt: unknown;\n  truncation: {\n    truncated: boolean;\n    fields: string[];\n    originalBytes: number | null;\n    deliveredBytes: number;\n  };\n};\n\nconst SESSION_EVENT_COMPACT_RESULT_TEXT_MAX_BYTES = 12 * 1024;\n// Five independently bounded slots plus identity/metadata must fit below the\n// 64 KiB MCP envelope even when a pathological producer supplies every slot.\nconst SESSION_EVENT_COMPACT_RESULT_VALUE_MAX_BYTES = 8 * 1024;\n\ntype CompactValue = {\n  value: unknown;\n  truncated: boolean;\n  originalBytes: number | null;\n};\n\ntype JsonRecord = Record<string, unknown>;\n\n/**\n * Build the bounded semantic result used by `latest + result=compact`.\n *\n * This is intentionally a pure projection over one already-authoritative\n * event. It never reads history, invokes a model, follows a URL, or stores an\n * artifact. The DB/API/MCP layers decide which event is authoritative; this\n * helper only extracts the small result facts that can cross a client boundary.\n */\nexport function compactSessionEventResult(\n  event: SessionEvent,\n  semanticClass: SessionEventSemanticClass,\n  coveredSequence: { first: number; last: number } = {\n    first: event.sequence,\n    last: event.sequence,\n  },\n): SessionEventCompactResult {\n  const payload = isSessionEventJsonRecord(event.payload) ? event.payload : {};\n  const fields: string[] = [];\n  let originalBytes = 0;\n\n  const textCandidate = typeof payload.text === \"string\" ? payload.text : null;\n  const outputCandidate = Object.prototype.hasOwnProperty.call(payload, \"output\")\n    ? payload.output\n    : null;\n  const resultCandidate = Object.prototype.hasOwnProperty.call(payload, \"result\")\n    ? payload.result\n    : undefined;\n  const textValue = textCandidate ?? (typeof outputCandidate === \"string\" ? outputCandidate : null);\n  const text = textValue === null ? null : compactResultText(textValue);\n  if (text && text.truncated) {\n    fields.push(\"text\");\n    originalBytes += text.originalBytes ?? 0;\n  }\n\n  const output = compactResultValue(outputCandidate);\n  if (outputCandidate !== null && output.truncated) {\n    fields.push(\"output\");\n    originalBytes += output.originalBytes ?? 0;\n  }\n\n  const result = compactResultValue(\n    resultCandidate === undefined ? (textValue ?? outputCandidate) : resultCandidate,\n  );\n  if (resultCandidate !== undefined && result.truncated) {\n    fields.push(\"result\");\n    originalBytes += result.originalBytes ?? 0;\n  }\n\n  const checkpointField = firstOwnPayloadValue(payload, [\"checkpoint\", \"summary\", \"snapshot\"]);\n  const checkpointCandidate =\n    checkpointField !== undefined\n      ? checkpointField\n      : semanticClass === \"checkpoint\"\n        ? payload\n        : null;\n  const checkpoint = compactResultValue(checkpointCandidate);\n  if (checkpointCandidate !== null && checkpoint.truncated) {\n    fields.push(\"checkpoint\");\n    originalBytes += checkpoint.originalBytes ?? 0;\n  }\n\n  const receiptCandidate = firstOwnPayloadValue(payload, [\"receipt\", \"receiptData\"]);\n  const receipt = compactResultValue(\n    receiptCandidate !== undefined\n      ? receiptCandidate\n      : semanticClass === \"tool_receipt\"\n        ? payload\n        : null,\n  );\n  if (receipt.truncated) {\n    fields.push(\"receipt\");\n    originalBytes += receipt.originalBytes ?? 0;\n  }\n\n  const failure = compactFailure(payload, event.type);\n  if (failure.truncated) {\n    fields.push(\"failure\");\n    originalBytes += failure.originalBytes ?? 0;\n  }\n\n  if (isSessionEventJsonRecord(payload.truncation) && payload.truncation.truncated === true) {\n    fields.push(\"payload\");\n  }\n\n  const source = {\n    id: event.id,\n    type: event.type,\n    sequence: event.sequence,\n    occurredAt: event.occurredAt,\n    turnId: event.turnId ?? null,\n    turnGeneration: event.turnGeneration ?? null,\n    turnAttemptId: event.turnAttemptId ?? null,\n    turnAssociation: event.turnAssociation ?? null,\n  };\n  const status = compactResultStatus(event.type, semanticClass, payload);\n  const outputValue = outputCandidate === null ? null : output.value;\n  const resultValue = result.value;\n  const checkpointValue = checkpointCandidate === null ? null : checkpoint.value;\n  const receiptValue =\n    receiptCandidate === null && semanticClass !== \"tool_receipt\" ? null : receipt.value;\n  const compact: SessionEventCompactResult = {\n    version: 1,\n    semanticClass,\n    source,\n    id: source.id,\n    type: source.type,\n    sequence: source.sequence,\n    occurredAt: source.occurredAt,\n    turnId: source.turnId,\n    turnGeneration: source.turnGeneration,\n    turnAttemptId: source.turnAttemptId,\n    turnAssociation: source.turnAssociation,\n    coveredSequence,\n    status,\n    text: text?.value ?? null,\n    output: outputValue,\n    result: resultValue,\n    failure: failure.value,\n    checkpoint: checkpointValue,\n    receipt: receiptValue,\n    truncation: {\n      truncated: fields.length > 0,\n      fields: [...new Set(fields)],\n      originalBytes: fields.length > 0 ? originalBytes || null : null,\n      deliveredBytes: sessionEventJsonBytes({\n        text: text?.value ?? null,\n        output: outputValue,\n        result: resultValue,\n        failure: failure.value,\n        checkpoint: checkpointValue,\n        receipt: receiptValue,\n      }),\n    },\n  };\n  return compact;\n}\n\nfunction isSessionEventJsonRecord(value: unknown): value is JsonRecord {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction firstOwnPayloadValue(payload: JsonRecord, keys: readonly string[]): unknown | undefined {\n  for (const key of keys) {\n    if (Object.prototype.hasOwnProperty.call(payload, key)) return payload[key];\n  }\n  return undefined;\n}\n\nfunction compactResultText(value: string): CompactValue & { value: string } {\n  const originalBytes = new TextEncoder().encode(value).byteLength;\n  if (originalBytes <= SESSION_EVENT_COMPACT_RESULT_TEXT_MAX_BYTES) {\n    return { value, truncated: false, originalBytes };\n  }\n  let omittedBytes = originalBytes - SESSION_EVENT_COMPACT_RESULT_TEXT_MAX_BYTES;\n  let projected = value;\n  for (let attempt = 0; attempt < 4; attempt += 1) {\n    const marker = `…[${omittedBytes} UTF-8 bytes omitted from compact result]…`;\n    const budget = Math.max(0, SESSION_EVENT_COMPACT_RESULT_TEXT_MAX_BYTES - utf8Bytes(marker));\n    const head = utf8PrefixForResult(value, Math.floor(budget * 0.7));\n    const tail = utf8SuffixForResult(value, budget - utf8Bytes(head));\n    projected = `${head}${marker}${tail}`;\n    const nextOmitted = Math.max(0, originalBytes - utf8Bytes(head) - utf8Bytes(tail));\n    if (nextOmitted === omittedBytes) break;\n    omittedBytes = nextOmitted;\n  }\n  return { value: projected, truncated: true, originalBytes };\n}\n\nfunction compactResultValue(value: unknown): CompactValue {\n  if (value === null || value === undefined) {\n    return { value: null, truncated: false, originalBytes: null };\n  }\n  const measurement = measureSessionEventJson(value);\n  const bounded = boundSessionEventPayload(value, {\n    surface: \"http_projection\",\n    maxBytes: SESSION_EVENT_COMPACT_RESULT_VALUE_MAX_BYTES,\n  });\n  const deliveredBytes = measureSessionEventJson(bounded).bytes;\n  return {\n    value: bounded,\n    truncated:\n      measurement.bytes === null || deliveredBytes === null || measurement.bytes !== deliveredBytes,\n    originalBytes: measurement.bytes,\n  };\n}\n\nfunction compactFailure(\n  payload: JsonRecord,\n  eventType: SessionEventType,\n): CompactValue & {\n  value: SessionEventCompactResult[\"failure\"];\n} {\n  const isFailure =\n    eventType === \"turn.failed\" ||\n    eventType === \"turn.cancelled\" ||\n    eventType === \"turn.superseded\";\n  const hasFailureField = [\"error\", \"code\", \"retryable\", \"recovery\"].some((key) =>\n    Object.prototype.hasOwnProperty.call(payload, key),\n  );\n  if (!isFailure && !hasFailureField) {\n    return { value: null, truncated: false, originalBytes: null };\n  }\n  const error = compactResultStringField(payload.error);\n  const code = compactResultStringField(payload.code);\n  const recovery = compactResultStringField(payload.recovery);\n  const retryable = typeof payload.retryable === \"boolean\" ? payload.retryable : null;\n  const value = { error: error.value, code: code.value, retryable, recovery: recovery.value };\n  const originalBytes = [error, code, recovery]\n    .map((field) => field.originalBytes ?? 0)\n    .reduce((sum, bytes) => sum + bytes, 0);\n  return {\n    value,\n    truncated: error.truncated || code.truncated || recovery.truncated,\n    originalBytes: originalBytes || null,\n  };\n}\n\nfunction compactResultStringField(value: unknown): CompactValue & { value: string | null } {\n  if (typeof value !== \"string\") {\n    return { value: null, truncated: false, originalBytes: null };\n  }\n  return compactResultText(value);\n}\n\nfunction compactResultStatus(\n  eventType: SessionEventType,\n  semanticClass: SessionEventSemanticClass,\n  payload: JsonRecord,\n): SessionEventCompactResult[\"status\"] {\n  if (eventType === \"turn.failed\") return \"failed\";\n  if (eventType === \"turn.cancelled\") return \"cancelled\";\n  if (eventType === \"turn.superseded\") return \"superseded\";\n  if (eventType === \"turn.completed\" || eventType === \"agent.message.completed\") {\n    return \"completed\";\n  }\n  if (semanticClass === \"checkpoint\") return \"checkpoint\";\n  if (\n    semanticClass === \"tool_receipt\" ||\n    eventType === \"artifact.created\" ||\n    eventType === \"recording.available\"\n  ) {\n    return \"receipt\";\n  }\n  if (payload.status === \"failed\") return \"failed\";\n  if (payload.status === \"completed\") return \"completed\";\n  return \"unknown\";\n}\n\nfunction utf8Bytes(value: string): number {\n  return new TextEncoder().encode(value).byteLength;\n}\n\nfunction utf8PrefixForResult(value: string, maxBytes: number): string {\n  let bytes = 0;\n  let index = 0;\n  while (index < value.length) {\n    const codePoint = value.codePointAt(index);\n    if (codePoint === undefined) break;\n    const character = String.fromCodePoint(codePoint);\n    const next = utf8Bytes(character);\n    if (bytes + next > maxBytes) break;\n    bytes += next;\n    index += character.length;\n  }\n  return value.slice(0, index);\n}\n\nfunction utf8SuffixForResult(value: string, maxBytes: number): string {\n  let bytes = 0;\n  let index = value.length;\n  while (index > 0) {\n    const width =\n      index > 1 && value.charCodeAt(index - 1) >= 0xdc00 && value.charCodeAt(index - 1) <= 0xdfff\n        ? 2\n        : 1;\n    const character = value.slice(index - width, index);\n    const next = utf8Bytes(character);\n    if (bytes + next > maxBytes) break;\n    bytes += next;\n    index -= width;\n  }\n  return value.slice(index);\n}\n\n// --- Durable host export ------------------------------------------------------\n\n/** Wire revision for the durable host event/usage export stream. */\nexport const OPENGENI_HOST_EXPORT_SCHEMA_REVISION = \"2026-07-host-export-v1\" as const;\n\n/**\n * Decimal string rather than a JavaScript number: export cursors are PostgreSQL\n * bigint values and must remain exact beyond Number.MAX_SAFE_INTEGER.\n */\nexport const HostExportCursor = z.string().regex(/^(0|[1-9][0-9]*)$/);\nexport type HostExportCursor = z.infer<typeof HostExportCursor>;\n\nexport const HostExportConsumerId = z\n  .string()\n  .min(1)\n  .max(128)\n  .regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/);\nexport type HostExportConsumerId = z.infer<typeof HostExportConsumerId>;\n\nexport const HostExportInitiator = TurnInitiator.extend({\n  subjectId: z.string().min(1).max(1024),\n  label: z.string().min(1).max(256).optional(),\n});\nexport type HostExportInitiator = z.infer<typeof HostExportInitiator>;\n\nexport const HostExportInitiatorContext = TurnInitiatorContext.refine(\n  (value) => {\n    try {\n      return new TextEncoder().encode(JSON.stringify(value)).byteLength <= 4096;\n    } catch {\n      return false;\n    }\n  },\n  { message: \"Host export initiator context exceeds 4096 UTF-8 bytes\" },\n);\nexport type HostExportInitiatorContext = z.infer<typeof HostExportInitiatorContext>;\n\nconst HostExportAttribution = {\n  initiator: HostExportInitiator.nullable(),\n  initiatorContext: HostExportInitiatorContext,\n  origin: SessionTurnSource.nullable(),\n} as const;\n\n/**\n * Host streams are deliberately forward-tolerant across rolling upgrades.\n * OpenGeni's application contract enumerates the event types known to this\n * build, while the durable export may be read by an older host consumer after\n * a newer writer has committed a bounded type. The database remains the\n * authority for the byte bounds on these persisted strings.\n */\nexport const HostSessionEvent = SessionEvent.extend({\n  type: z.string().min(1).max(256),\n  clientEventId: z.string().max(1024).nullable().optional(),\n  turnAssociation: z.string().min(1).max(64).nullable().optional(),\n  duplicateReason: z.string().max(4096).nullable().optional(),\n});\nexport type HostSessionEvent = z.infer<typeof HostSessionEvent>;\n\n/** Export-bounded usage fact; custom bounded metric names remain supported. */\nexport const HostUsageEvent = UsageEvent.extend({\n  subjectId: z.string().max(1024).nullable(),\n  eventType: z.string().min(1).max(256),\n  unit: z.string().min(1).max(128),\n  sourceResourceType: z.string().max(256).nullable(),\n  sourceResourceId: z.string().max(2048).nullable(),\n  idempotencyKey: z.string().min(1).max(2048),\n  billingProviderEventId: z.string().max(2048).nullable(),\n});\nexport type HostUsageEvent = z.infer<typeof HostUsageEvent>;\n\n/**\n * One immutable, bounded session-event snapshot from the transactional host\n * outbox. Cross-session cursor order is stable but deliberately non-causal;\n * within a session, `event.sequence` remains authoritative and monotonic.\n */\nexport const HostEventExport = z.object({\n  schemaRevision: z.literal(OPENGENI_HOST_EXPORT_SCHEMA_REVISION),\n  cursor: HostExportCursor,\n  idempotencyKey: z.string().min(1).max(2048),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  /**\n   * Immutable root of event.sessionId's session lineage at capture time. Null\n   * only for an unresolved pre-lineage/legacy export row.\n   */\n  rootSessionId: z.string().uuid().nullable(),\n  ...HostExportAttribution,\n  event: HostSessionEvent,\n});\nexport type HostEventExport = z.infer<typeof HostEventExport>;\n\n/** One exact, idempotency-keyed usage fact from the same ordered outbox. */\nexport const HostUsageExport = z.object({\n  schemaRevision: z.literal(OPENGENI_HOST_EXPORT_SCHEMA_REVISION),\n  cursor: HostExportCursor,\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid().nullable(),\n  /** Null when sessionId is null or an unresolved pre-lineage legacy row. */\n  rootSessionId: z.string().uuid().nullable(),\n  turnId: z.string().uuid().nullable(),\n  turnAttemptId: z.string().uuid().nullable(),\n  ...HostExportAttribution,\n  usage: HostUsageEvent,\n});\nexport type HostUsageExport = z.infer<typeof HostUsageExport>;\n\nexport const HostEventExportBatch = z.object({\n  schemaRevision: z.literal(OPENGENI_HOST_EXPORT_SCHEMA_REVISION),\n  consumerId: HostExportConsumerId,\n  leaseToken: z.string().uuid(),\n  checkpoint: HostExportCursor,\n  throughCursor: HostExportCursor,\n  events: z.array(HostEventExport).min(1).max(256),\n});\nexport type HostEventExportBatch = z.infer<typeof HostEventExportBatch>;\n\nexport const HostUsageExportBatch = z.object({\n  schemaRevision: z.literal(OPENGENI_HOST_EXPORT_SCHEMA_REVISION),\n  consumerId: HostExportConsumerId,\n  leaseToken: z.string().uuid(),\n  checkpoint: HostExportCursor,\n  throughCursor: HostExportCursor,\n  events: z.array(HostUsageExport).min(1).max(256),\n});\nexport type HostUsageExportBatch = z.infer<typeof HostUsageExportBatch>;\n\n/**\n * Optional embedded-host sinks. Delivery is at least once: the same batch may\n * be repeated after a process dies between sink success and checkpoint commit,\n * so sinks must deduplicate by event/usage idempotency key.\n */\nexport type HostEventSink = {\n  consumerId: HostExportConsumerId;\n  deliverEvents: (batch: HostEventExportBatch) => Promise<void>;\n};\n\nexport type HostUsageSink = {\n  consumerId: HostExportConsumerId;\n  deliverUsage: (batch: HostUsageExportBatch) => Promise<void>;\n};\n\nexport const SESSION_EVENT_TYPE_MAX_BYTES = 256;\nexport const SESSION_EVENT_CLIENT_EVENT_ID_MAX_BYTES = SESSION_OPERATION_KEY_MAX_CHARS * 4;\nexport const SESSION_EVENT_TURN_ASSOCIATION_MAX_BYTES = 64;\nexport const SESSION_EVENT_DUPLICATE_REASON_MAX_BYTES = 4 * 1024;\nexport const SESSION_EVENT_ENVELOPE_MAX_BYTES = 80 * 1024;\n\nexport type BoundSessionEventOptions = {\n  surface?: SessionEventBoundarySurface;\n  maxBytes?: number;\n};\n\n/**\n * Canonical lossy projection for a complete session event. Payload bounds alone\n * are insufficient: a malformed retained row can also carry an oversized type,\n * client id, or duplicate diagnostic. Keep cursor/UUID identity intact, bound\n * every free-form envelope string, and assert the exact final JSON envelope.\n */\nexport function boundSessionEvent(\n  event: SessionEvent,\n  options: BoundSessionEventOptions = {},\n): SessionEvent {\n  const surface = options.surface ?? \"durable_audit\";\n  const maxBytes = Math.max(8 * 1024, options.maxBytes ?? SESSION_EVENT_ENVELOPE_MAX_BYTES);\n  // Never stringify the untrusted complete event. Measurement has one global\n  // work budget and never invokes accessors/custom toJSON; serialization is\n  // permitted only after the compact projection below has been constructed.\n  const originalBytes = measureSessionEventJson(event).bytes;\n  const source = sessionEventOwnDataFields(event);\n  const id = canonicalSessionEventUuid(source.id, SESSION_EVENT_ZERO_UUID);\n  const workspaceId = canonicalSessionEventUuid(source.workspaceId, SESSION_EVENT_ZERO_UUID);\n  const sessionId = canonicalSessionEventUuid(source.sessionId, SESSION_EVENT_ZERO_UUID);\n  const sequence =\n    source.sequence.readable &&\n    typeof source.sequence.value === \"number\" &&\n    Number.isSafeInteger(source.sequence.value) &&\n    source.sequence.value > 0\n      ? source.sequence.value\n      : 1;\n  const occurredAt =\n    source.occurredAt.readable &&\n    typeof source.occurredAt.value === \"string\" &&\n    sessionEventUtf8Bytes(source.occurredAt.value) <= 256\n      ? source.occurredAt.value\n      : \"1970-01-01T00:00:00.000Z\";\n  const rawType = source.type.readable ? source.type.value : undefined;\n  const typeIsSafe =\n    typeof rawType === \"string\" &&\n    sessionEventUtf8Bytes(rawType) <= SESSION_EVENT_TYPE_MAX_BYTES &&\n    !rawType.includes(\"\\n\") &&\n    !rawType.includes(\"\\r\");\n  const rawClientEventId = source.clientEventId.readable ? source.clientEventId.value : undefined;\n  const clientEventId = boundOptionalSessionEventText(\n    typeof rawClientEventId === \"string\" || rawClientEventId === null\n      ? rawClientEventId\n      : undefined,\n    SESSION_EVENT_CLIENT_EVENT_ID_MAX_BYTES,\n  );\n  const rawTurnAssociation = source.turnAssociation.readable\n    ? source.turnAssociation.value\n    : undefined;\n  const turnAssociation =\n    rawTurnAssociation === null ||\n    rawTurnAssociation === undefined ||\n    rawTurnAssociation === \"current\" ||\n    rawTurnAssociation === \"late_rejected\" ||\n    rawTurnAssociation === \"duplicate\"\n      ? rawTurnAssociation\n      : null;\n  const rawDuplicateReason = source.duplicateReason.readable\n    ? source.duplicateReason.value\n    : undefined;\n  const duplicateReason = boundOptionalSessionEventText(\n    typeof rawDuplicateReason === \"string\" || rawDuplicateReason === null\n      ? rawDuplicateReason\n      : undefined,\n    SESSION_EVENT_DUPLICATE_REASON_MAX_BYTES,\n  );\n  const turnId = canonicalOptionalSessionEventUuid(source.turnId);\n  const turnGeneration = canonicalSessionEventGeneration(source.turnGeneration);\n  const turnAttemptId = canonicalOptionalSessionEventUuid(source.turnAttemptId);\n  const duplicateOfEventId = canonicalOptionalSessionEventUuid(source.duplicateOfEventId);\n  const envelopeFields = [\n    sessionEventCustomSerializerProjection(event),\n    sessionEventAdditionalTopLevelFieldProjection(event),\n    !typeIsSafe\n      ? sessionEventEnvelopeFieldProjection(\n          \"type\",\n          rawType,\n          \"session.event.envelope_omitted\",\n          source.type.readable,\n        )\n      : null,\n    !source.clientEventId.readable || rawClientEventId !== clientEventId\n      ? sessionEventEnvelopeFieldProjection(\n          \"clientEventId\",\n          rawClientEventId,\n          clientEventId,\n          source.clientEventId.readable,\n        )\n      : null,\n    !source.turnAssociation.readable || rawTurnAssociation !== turnAssociation\n      ? sessionEventEnvelopeFieldProjection(\n          \"turnAssociation\",\n          rawTurnAssociation,\n          turnAssociation,\n          source.turnAssociation.readable,\n        )\n      : null,\n    !source.duplicateReason.readable || rawDuplicateReason !== duplicateReason\n      ? sessionEventEnvelopeFieldProjection(\n          \"duplicateReason\",\n          rawDuplicateReason,\n          duplicateReason,\n          source.duplicateReason.readable,\n        )\n      : null,\n    ...sessionEventCanonicalFieldProjections(source, {\n      id,\n      workspaceId,\n      sessionId,\n      sequence,\n      occurredAt,\n    }),\n    ...sessionEventOptionalFieldProjections(source, {\n      turnId,\n      turnGeneration,\n      turnAttemptId,\n      duplicateOfEventId,\n    }),\n    !source.payload.readable\n      ? sessionEventEnvelopeFieldProjection(\"payload\", undefined, null, false)\n      : null,\n  ].filter((field) => field !== null);\n  const rawPayload = source.payload.readable\n    ? source.payload.value\n    : \"[event payload accessor omitted at bounded projection boundary]\";\n  const payload =\n    envelopeFields.length === 0\n      ? boundSessionEventPayload(rawPayload, { surface })\n      : boundSessionEventPayload(\n          {\n            preview: \"[legacy event envelope normalized at bounded projection boundary]\",\n            originalEventBytes: originalBytes,\n            originalType: typeof rawType === \"string\" ? boundSessionEventText(rawType, 256) : null,\n            envelopeProjection: {\n              truncated: true,\n              surface,\n              fields: envelopeFields,\n            },\n            fullEvidence: { available: false, reason: \"not_retained\" },\n          },\n          { surface, maxBytes: 8 * 1024 },\n        );\n  const bounded: SessionEvent = {\n    id,\n    workspaceId,\n    sessionId,\n    sequence,\n    type: typeIsSafe ? (rawType as SessionEvent[\"type\"]) : \"session.event.envelope_omitted\",\n    payload,\n    occurredAt,\n    ...(sessionEventShouldEmitOptionalField(source.clientEventId) ? { clientEventId } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.turnId) ? { turnId } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.turnGeneration) ? { turnGeneration } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.turnAttemptId) ? { turnAttemptId } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.turnAssociation) ? { turnAssociation } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.duplicateOfEventId)\n      ? { duplicateOfEventId }\n      : {}),\n    ...(sessionEventShouldEmitOptionalField(source.duplicateReason) ? { duplicateReason } : {}),\n  };\n  if (sessionEventJsonBytes(bounded) <= maxBytes) return bounded;\n\n  const fallback: SessionEvent = {\n    id,\n    workspaceId,\n    sessionId,\n    sequence,\n    type: \"session.event.envelope_omitted\",\n    payload: boundSessionEventPayload(\n      {\n        preview: \"[legacy event envelope omitted at bounded projection boundary]\",\n        originalEventBytes: originalBytes,\n        originalType: typeof rawType === \"string\" ? boundSessionEventText(rawType, 256) : null,\n        fullEvidence: { available: false, reason: \"not_retained\" },\n      },\n      { surface, maxBytes: 4 * 1024 },\n    ),\n    occurredAt,\n    ...(sessionEventShouldEmitOptionalField(source.clientEventId) ? { clientEventId } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.turnId) ? { turnId } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.turnGeneration) ? { turnGeneration } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.turnAttemptId) ? { turnAttemptId } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.turnAssociation) ? { turnAssociation } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.duplicateOfEventId)\n      ? { duplicateOfEventId }\n      : {}),\n    ...(sessionEventShouldEmitOptionalField(source.duplicateReason) ? { duplicateReason } : {}),\n  };\n  const deliveredBytes = sessionEventJsonBytes(fallback);\n  if (deliveredBytes > maxBytes) {\n    throw new RangeError(\n      `Bounded session event exceeds its final envelope (${deliveredBytes} > ${maxBytes} bytes)`,\n    );\n  }\n  return fallback;\n}\n\nfunction sessionEventEnvelopeFieldProjection(\n  field: string,\n  original: unknown,\n  delivered: unknown,\n  originalReadable = true,\n): { field: string; originalBytes: number | null; deliveredBytes: number } {\n  return {\n    field,\n    originalBytes: originalReadable\n      ? typeof original === \"string\"\n        ? sessionEventUtf8Bytes(original)\n        : typeof original === \"number\" || typeof original === \"boolean\"\n          ? sessionEventJsonBytes(original)\n          : original === null || original === undefined\n            ? 0\n            : null\n      : null,\n    deliveredBytes:\n      typeof delivered === \"string\"\n        ? sessionEventUtf8Bytes(delivered)\n        : typeof delivered === \"number\" || typeof delivered === \"boolean\"\n          ? sessionEventJsonBytes(delivered)\n          : 0,\n  };\n}\n\nfunction sessionEventCustomSerializerProjection(\n  event: SessionEvent,\n): { field: string; originalBytes: null; deliveredBytes: 0 } | null {\n  const projection = {\n    field: \"toJSON\",\n    originalBytes: null,\n    deliveredBytes: 0,\n  } as const;\n  let candidate: object | null = event;\n  try {\n    for (let depth = 0; depth <= SESSION_EVENT_PROTOTYPE_MAX_DEPTH; depth += 1) {\n      if (candidate === null) return null;\n      const descriptor = Object.getOwnPropertyDescriptor(candidate, \"toJSON\");\n      if (descriptor) {\n        // JSON.stringify performs an ordinary lookup, so an accessor is both\n        // executable behavior and an unknown possible serializer. A data\n        // property shadows the rest of the chain and is relevant only when it\n        // is callable.\n        return !(\"value\" in descriptor) || typeof descriptor.value === \"function\"\n          ? projection\n          : null;\n      }\n      candidate = Object.getPrototypeOf(candidate);\n    }\n    // A hostile or malformed prototype chain that exceeds the fixed lookup\n    // budget cannot prove the absence of inherited serialization behavior.\n    return projection;\n  } catch {\n    return projection;\n  }\n}\n\nconst SESSION_EVENT_PROTOTYPE_MAX_DEPTH = 32;\nconst SESSION_EVENT_ZERO_UUID = \"00000000-0000-4000-8000-000000000000\";\nconst SESSION_EVENT_UUID_PATTERN =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\nconst SESSION_EVENT_OWN_DATA_FIELDS = [\n  \"id\",\n  \"workspaceId\",\n  \"sessionId\",\n  \"sequence\",\n  \"type\",\n  \"payload\",\n  \"occurredAt\",\n  \"clientEventId\",\n  \"turnId\",\n  \"turnGeneration\",\n  \"turnAttemptId\",\n  \"turnAssociation\",\n  \"duplicateOfEventId\",\n  \"duplicateReason\",\n] as const satisfies readonly (keyof SessionEvent)[];\nconst SESSION_EVENT_KNOWN_ENUMERABLE_FIELDS = new Set<string>([\n  ...SESSION_EVENT_OWN_DATA_FIELDS,\n  \"toJSON\",\n]);\n\n/**\n * Detect future/legacy own enumerable envelope fields without reading their\n * values. There can be at most the fixed known-key cardinality before an\n * additional key must be observed, so the source-level iterator is bounded.\n * A proxy/enumeration failure is conservatively surfaced as unknown loss.\n */\nfunction sessionEventAdditionalTopLevelFieldProjection(\n  event: SessionEvent,\n): { field: string; originalBytes: null; deliveredBytes: 0 } | null {\n  const projection = {\n    field: \"additionalTopLevelFields\",\n    originalBytes: null,\n    deliveredBytes: 0,\n  } as const;\n  let inspected = 0;\n  try {\n    for (const key in event as SessionEvent & Record<string, unknown>) {\n      inspected += 1;\n      if (inspected > SESSION_EVENT_KNOWN_ENUMERABLE_FIELDS.size + 1) return projection;\n      const descriptor = Object.getOwnPropertyDescriptor(event, key);\n      if (descriptor?.enumerable && !SESSION_EVENT_KNOWN_ENUMERABLE_FIELDS.has(key)) {\n        return projection;\n      }\n    }\n    return null;\n  } catch {\n    return projection;\n  }\n}\n\ntype SessionEventOwnField = { readable: true; value: unknown } | { readable: false };\ntype SessionEventOwnDataFields = Record<keyof SessionEvent, SessionEventOwnField>;\n\nfunction sessionEventOwnDataFields(event: SessionEvent): SessionEventOwnDataFields {\n  return Object.fromEntries(\n    SESSION_EVENT_OWN_DATA_FIELDS.map((key) => {\n      try {\n        const descriptor = Object.getOwnPropertyDescriptor(event, key);\n        if (!descriptor) return [key, { readable: true, value: undefined }];\n        return [\n          key,\n          \"value\" in descriptor ? { readable: true, value: descriptor.value } : { readable: false },\n        ];\n      } catch {\n        return [key, { readable: false }];\n      }\n    }),\n  ) as SessionEventOwnDataFields;\n}\n\nfunction canonicalSessionEventUuid(field: SessionEventOwnField, fallback: string): string {\n  return field.readable &&\n    typeof field.value === \"string\" &&\n    SESSION_EVENT_UUID_PATTERN.test(field.value)\n    ? field.value\n    : fallback;\n}\n\nfunction canonicalOptionalSessionEventUuid(field: SessionEventOwnField): string | null {\n  return field.readable &&\n    typeof field.value === \"string\" &&\n    SESSION_EVENT_UUID_PATTERN.test(field.value)\n    ? field.value\n    : null;\n}\n\nfunction canonicalSessionEventGeneration(field: SessionEventOwnField): number | null {\n  return field.readable &&\n    typeof field.value === \"number\" &&\n    Number.isSafeInteger(field.value) &&\n    field.value >= 0\n    ? field.value\n    : null;\n}\n\nfunction sessionEventShouldEmitOptionalField(field: SessionEventOwnField): boolean {\n  return !field.readable || field.value !== undefined;\n}\n\nfunction sessionEventCanonicalFieldProjections(\n  source: SessionEventOwnDataFields,\n  delivered: {\n    id: string;\n    workspaceId: string;\n    sessionId: string;\n    sequence: number;\n    occurredAt: string;\n  },\n): Array<{\n  field: string;\n  originalBytes: number | null;\n  deliveredBytes: number;\n}> {\n  return ([\"id\", \"workspaceId\", \"sessionId\", \"sequence\", \"occurredAt\"] as const).flatMap(\n    (field) => {\n      const original = source[field].readable ? source[field].value : undefined;\n      return source[field].readable && original === delivered[field]\n        ? []\n        : [\n            sessionEventEnvelopeFieldProjection(\n              field,\n              original,\n              delivered[field],\n              source[field].readable,\n            ),\n          ];\n    },\n  );\n}\n\nfunction sessionEventOptionalFieldProjections(\n  source: SessionEventOwnDataFields,\n  delivered: {\n    turnId: string | null;\n    turnGeneration: number | null;\n    turnAttemptId: string | null;\n    duplicateOfEventId: string | null;\n  },\n): Array<{\n  field: string;\n  originalBytes: number | null;\n  deliveredBytes: number;\n}> {\n  return ([\"turnId\", \"turnGeneration\", \"turnAttemptId\", \"duplicateOfEventId\"] as const).flatMap(\n    (field) => {\n      const original = source[field].readable ? source[field].value : undefined;\n      const canonicalOriginal = original ?? null;\n      return source[field].readable && canonicalOriginal === delivered[field]\n        ? []\n        : [\n            sessionEventEnvelopeFieldProjection(\n              field,\n              original,\n              delivered[field],\n              source[field].readable,\n            ),\n          ];\n    },\n  );\n}\n\nfunction boundOptionalSessionEventText<T extends string | null | undefined>(\n  value: T,\n  maxBytes: number,\n): T {\n  return (typeof value === \"string\" ? boundSessionEventText(value, maxBytes) : value) as T;\n}\n\nfunction boundSessionEventText(value: string, maxBytes: number): string {\n  const encoder = new TextEncoder();\n  const decoder = new TextDecoder();\n  const bytes = encoder.encode(value);\n  if (bytes.byteLength <= maxBytes) return value;\n  const marker = \"…[truncated]\";\n  const markerBytes = encoder.encode(marker).byteLength;\n  const prefixBudget = Math.max(0, maxBytes - markerBytes);\n  let prefixEnd = Math.min(prefixBudget, bytes.byteLength);\n  while (prefixEnd > 0 && prefixEnd < bytes.byteLength && (bytes[prefixEnd]! & 0xc0) === 0x80) {\n    prefixEnd -= 1;\n  }\n  return `${decoder.decode(bytes.subarray(0, prefixEnd))}${marker}`;\n}\n\nfunction sessionEventUtf8Bytes(value: string): number {\n  return new TextEncoder().encode(value).byteLength;\n}\n\nexport const SessionQueueMutationResponse = z.object({\n  receipt: SessionCommandReceipt,\n  snapshot: SessionQueueSnapshot,\n  draft: ComposerDraft.optional(),\n});\nexport type SessionQueueMutationResponse = z.infer<typeof SessionQueueMutationResponse>;\n\nexport const SessionControlResponse = z.object({\n  receipt: SessionCommandReceipt,\n  effectiveControl: EffectiveSessionControl,\n  interruptionCount: z.number().int().nonnegative(),\n  wakeCount: z.number().int().nonnegative(),\n});\nexport type SessionControlResponse = z.infer<typeof SessionControlResponse>;\n\nexport const CreateSessionRequest = withVariableSetIdAlias({\n  /**\n   * Optional UUID preallocated by an embedding host. This lets the host durably\n   * link its own projection before OpenGeni admits the initial turn. Replays\n   * must pair it with the same idempotency key; OpenGeni never derives host\n   * identity or authorization from the UUID.\n   */\n  requestedSessionId: z.string().uuid().optional(),\n  initialMessage: z.string().min(1),\n  // System-level host context for the initial turn only. Unlike `instructions`,\n  // this does not persist into later turns and is never emitted as a user event.\n  turnInstructions: z.string().trim().min(1).max(32768).optional(),\n  // Per-session agent persona/system instructions (org-visible metadata, NOT a\n  // secret). Rides the SAME system-level instructions channel the per-workspace\n  // agentInstructions rides, composed AFTER the workspace persona so it refines\n  // it for this one session — how a host delivers per-agent-type prompts without\n  // leaking them into the user-visible timeline (it is NEVER emitted as an\n  // event, unlike goal/initialMessage). Trimmed, non-empty. The 32768-char cap\n  // matches the codebase's largest free-form string convention (workspace\n  // variable set variable values). Absent ⇒ byte-identical to today.\n  instructions: z.string().trim().min(1).max(32768).optional(),\n  // For an agent-created child, omission inherits the trusted immediate\n  // parent's repository/file context. An explicit array, including [], is\n  // authoritative. Top-level omission remains []. Presence is resolved from\n  // the raw request because this Zod default erases absent-vs-empty.\n  resources: z.array(ResourceRef).default([]),\n  // Inline skills are fixed onto the session. Child omission inherits the\n  // trusted parent's selection; an explicit array, including [], wins.\n  skills: SessionSkills.default([]),\n  // The same child omission rule applies to selected MCP tool refs. Top-level\n  // omission still applies workspace-default capability MCP tools; explicit []\n  // suppresses those defaults (the first-party OpenGeni server remains added).\n  tools: z.array(ToolRef).default([]),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  model: z.string().min(1).optional(),\n  reasoningEffort: ReasoningEffort.optional(),\n  sandboxBackend: SandboxBackend.optional(),\n  // The enrolled machine (a sandbox id) to run this session on; seeds the\n  // active-sandbox pointer at creation so the FIRST turn routes to the chosen\n  // machine (race-free: the pointer is committed before the worker turn\n  // workflow can read it). An invalid/unowned/offline target fails the create.\n  targetSandboxId: z.string().uuid().optional(),\n  // The working directory the targeted machine runs the session under — the\n  // path/cwd base for its agent exec, terminal, and file dock. Free-form pass-\n  // through: a launch-workspace_root-relative subdir or an absolute machine path\n  // (the agent's resolve_cwd handles both). Only valid WITH targetSandboxId\n  // (workingDir alone is a 422); omitted ⇒ the machine's default workspace_root.\n  workingDir: z.string().min(1).optional(),\n  // Variable set attachment is fixed at session creation; follow-up\n  // user.message events cannot switch or add one.\n  variableSetId: z.string().uuid().optional(),\n  environmentId: z.string().uuid().optional(),\n  // The rig to bind this session to (M3). Its ACTIVE version is resolved and\n  // FROZEN onto the session at create. Omitted ⇒ the workspace's default rig\n  // (workspaces.default_rig_id) when set, else a rig-less session (today's\n  // behavior). An id that does not name a rig in the workspace is a 422.\n  rigId: z.string().uuid().optional(),\n  goal: GoalSpec.optional(),\n  clientEventId: SessionOperationKey.optional(),\n  // Workspace-scoped CREATE idempotency key: collapses concurrent/retried\n  // create calls carrying the same key to a single session (partial unique\n  // index on (workspace_id, create_idempotency_key)). Distinct from\n  // clientEventId, whose uniqueness is per-session and so cannot dedup the\n  // creation of a brand-new session. Absent means no create-dedup (each call\n  // is an independent create).\n  idempotencyKey: z.string().min(1).max(200).optional(),\n  // The exact actor-private pre-session draft revision represented by this\n  // create. The durable initializer consumes only this revision. A newer draft\n  // written by a sibling tab survives, while every failed pre-initialization\n  // create leaves the submitted draft intact.\n  expectedNewSessionDraftRevision: z.number().int().nonnegative().optional(),\n  // A child may lower its inherited limit freely; an increase requires\n  // workspace:admin and is checked again at the DB transaction boundary.\n  maxNestedAgentDepth: NestedAgentDepthValue.optional(),\n  // Permissions the session's first-party MCP token should carry. A top-level\n  // omission uses the deployment's worker default; a child omission inherits\n  // the creating session's effective grant. An explicit set is capped at\n  // creation: every requested permission must be held by the creating grant.\n  // A goal-bearing session whose explicit/effective set omits goals:manage is\n  // rejected; creation never silently expands a child beyond that set.\n  firstPartyMcpPermissions: z.array(Permission).optional(),\n  // Third-party MCP servers attached only to this session. For an agent-created\n  // child, omission snapshots its trusted immediate parent's server definitions,\n  // policies, connection refs, and encrypted credentials. Explicit arrays,\n  // including [], are authoritative; non-empty explicit arrays require attach\n  // permission. Credential headers are write-only: create responses and events\n  // expose only SessionMcpServerMetadata.\n  mcpServers: z.array(SessionMcpServerInput).max(SESSION_MCP_SERVERS_MAX).default([]),\n  // Shared-sandbox placement (addendum 05 §D.1). Three-way union; OMITTED ⇒\n  // today's behavior (a context-dependent default resolved server-side: from\n  // inside a session → \"shared\" with the creator's box, top-level → \"new\").\n  //   - \"shared\":  join the CREATOR's box. Requires a parent session (inferred\n  //                from the worker-signed sessionId claim, never caller-supplied);\n  //                top-level \"shared\" is a 422.\n  //   - \"new\":     mint a fresh singleton box (group ≡ the new session's id).\n  //   - {groupId}: join a SPECIFIC sibling group in THIS workspace (manager\n  //                fan-out). Validated workspace-scoped (cross-workspace → 404).\n  // A shared spawn inherits the box's (backend, os) — it is literally the same\n  // box; the child cannot pick its own backend. Cross-workspace sharing is\n  // forbidden by construction (the parent/group reads are RLS-workspace-scoped).\n  // ENV-AWARE: the box's variable set is fixed at creation, so a share requires\n  // the SAME variableSetId as the creator's box. On a mismatch the inherited\n  // default silently falls back to an own box; an explicit \"shared\"/{groupId}\n  // request 422s at create (instead of the first turn dying on the SDK's\n  // manifest-env guard).\n  sandbox: z\n    .union([z.literal(\"shared\"), z.literal(\"new\"), z.object({ groupId: z.string().uuid() })])\n    .optional(),\n});\nexport type CreateSessionRequest = z.infer<typeof CreateSessionRequest>;\n\n// Generic, host-neutral structured human input. One model tool call creates one\n// request containing one or more questions; the durable response resumes that\n// exact call. This is deliberately distinct from tool approval: an answer,\n// skip, or expiry is structured tool output, never an approve/reject decision.\nexport const HumanInputQuestionKind = z.enum([\"text\", \"single_select\", \"multi_select\"]);\nexport type HumanInputQuestionKind = z.infer<typeof HumanInputQuestionKind>;\n\nexport const HumanInputOption = z.object({\n  id: z.string().min(1).max(64),\n  label: z.string().min(1).max(256),\n  description: z.string().max(2048).nullable().optional(),\n});\nexport type HumanInputOption = z.infer<typeof HumanInputOption>;\n\nexport const HumanInputQuestion = z\n  .object({\n    id: z.string().min(1).max(64),\n    kind: HumanInputQuestionKind,\n    prompt: z.string().min(1).max(4096),\n    label: z.string().min(1).max(128).nullable().optional(),\n    helpText: z.string().max(2048).nullable().optional(),\n    options: z.array(HumanInputOption).max(20).default([]),\n    required: z.boolean().default(true),\n    allowOther: z.boolean().default(false),\n    validation: z\n      .object({\n        minLength: z.number().int().nonnegative().max(8192).nullable().optional(),\n        maxLength: z.number().int().positive().max(8192).nullable().optional(),\n        minSelections: z.number().int().nonnegative().max(20).nullable().optional(),\n        maxSelections: z.number().int().positive().max(20).nullable().optional(),\n      })\n      .nullable()\n      .optional(),\n  })\n  .superRefine((question, ctx) => {\n    const optionIds = new Set(question.options.map((option) => option.id));\n    if (optionIds.size !== question.options.length) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"options\"],\n        message: \"option ids must be unique\",\n      });\n    }\n    if (question.kind === \"text\") {\n      if (question.options.length > 0) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"options\"],\n          message: \"text questions cannot have options\",\n        });\n      }\n      if (question.allowOther) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"allowOther\"],\n          message: \"text questions do not use Other\",\n        });\n      }\n    } else if (question.options.length === 0) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"options\"],\n        message: \"select questions require options\",\n      });\n    }\n    const validation = question.validation;\n    if (\n      validation?.minLength != null &&\n      validation?.maxLength != null &&\n      validation.minLength > validation.maxLength\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"validation\"],\n        message: \"minLength exceeds maxLength\",\n      });\n    }\n    if (\n      validation?.minSelections != null &&\n      validation?.maxSelections != null &&\n      validation.minSelections > validation.maxSelections\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"validation\"],\n        message: \"minSelections exceeds maxSelections\",\n      });\n    }\n  });\nexport type HumanInputQuestion = z.infer<typeof HumanInputQuestion>;\n\nexport const HumanInputRequestStatus = z.enum([\n  \"pending\",\n  \"answered\",\n  \"skipped\",\n  \"expired\",\n  \"cancelled\",\n]);\nexport type HumanInputRequestStatus = z.infer<typeof HumanInputRequestStatus>;\n\nexport const RequestHumanInputToolInput = z.object({\n  questions: z.array(HumanInputQuestion).min(1).max(20),\n  allowSkip: z.boolean().default(false),\n  expiresInSeconds: z\n    .number()\n    .int()\n    .positive()\n    .max(30 * 24 * 60 * 60)\n    .nullable()\n    .optional(),\n});\nexport type RequestHumanInputToolInput = z.infer<typeof RequestHumanInputToolInput>;\n\nexport const HumanInputAnswer = z.object({\n  questionId: z.string().min(1).max(64),\n  values: z.array(z.string().max(8192)).max(20),\n  other: z.string().max(8192).nullable().optional(),\n});\nexport type HumanInputAnswer = z.infer<typeof HumanInputAnswer>;\n\nexport const HumanInputResponse = z.discriminatedUnion(\"outcome\", [\n  z.object({\n    outcome: z.literal(\"answered\"),\n    answers: z.array(HumanInputAnswer).max(20),\n  }),\n  z.object({ outcome: z.literal(\"skipped\") }),\n  z.object({ outcome: z.literal(\"expired\") }),\n  z.object({ outcome: z.literal(\"cancelled\") }),\n]);\nexport type HumanInputResponse = z.infer<typeof HumanInputResponse>;\n\nexport const SubmitHumanInputResponseRequest = z.discriminatedUnion(\"outcome\", [\n  z.object({\n    outcome: z.literal(\"answered\"),\n    answers: z.array(HumanInputAnswer).max(20),\n  }),\n  z.object({ outcome: z.literal(\"skipped\") }),\n]);\nexport type SubmitHumanInputResponseRequest = z.infer<typeof SubmitHumanInputResponseRequest>;\n\nexport const SessionHumanInputRequest = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  turnId: z.string().uuid(),\n  turnGeneration: z.number().int().positive(),\n  creationAttemptId: z.string().uuid(),\n  toolCallId: z.string().min(1).max(1024),\n  status: HumanInputRequestStatus,\n  questions: z.array(HumanInputQuestion).min(1).max(20),\n  allowSkip: z.boolean(),\n  response: HumanInputResponse.nullable(),\n  respondedBy: z.string().max(1024).nullable(),\n  respondedAt: z.string().nullable(),\n  expiresAt: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type SessionHumanInputRequest = z.infer<typeof SessionHumanInputRequest>;\n\n/**\n * Extract the stable approval identity used by both durable admission and\n * runtime resume. Serialized SDK interruptions may place it on the wrapper or\n * its raw item; malformed entries fail closed instead of inventing an id.\n */\nexport function approvalIdentifier(value: unknown): string | null {\n  if (!value || typeof value !== \"object\") return null;\n  const approval = value as Record<string, unknown>;\n  const rawItem =\n    approval.rawItem && typeof approval.rawItem === \"object\"\n      ? (approval.rawItem as Record<string, unknown>)\n      : null;\n  const candidate = rawItem?.callId ?? rawItem?.id ?? approval.id ?? approval.name;\n  if (typeof candidate !== \"string\" && typeof candidate !== \"number\") return null;\n  return String(candidate);\n}\n\nexport const ClientSessionEvent = z.discriminatedUnion(\"type\", [\n  z.object({\n    type: z.literal(\"user.message\"),\n    clientEventId: SessionOperationKey.optional(),\n    payload: z.object({\n      text: z.string().min(1),\n      // System-level host context for this exact turn only. Persisted on the\n      // turn for retry/recovery, never copied into the visible user message.\n      turnInstructions: z.string().trim().min(1).max(32768).optional(),\n      resources: z.array(ResourceRef).default([]),\n      tools: z.array(ToolRef).default([]),\n      model: z.string().min(1).optional(),\n      reasoningEffort: ReasoningEffort.optional(),\n      controlEtag: z.string().min(1).optional(),\n      expectedDraftRevision: z.number().int().nonnegative().optional(),\n      // Header-value rotation only. URL/name/tool settings are immutable after\n      // session create; persisted events expose metadata, never header values.\n      mcpCredentialUpdates: z.array(SessionMcpCredentialUpdateInput).optional(),\n    }),\n  }),\n  z.object({\n    type: z.literal(\"user.approvalDecision\"),\n    clientEventId: SessionOperationKey.optional(),\n    payload: z.object({\n      approvalId: z.string().min(1).max(SESSION_OPERATION_KEY_MAX_CHARS),\n      decision: z.enum([\"approve\", \"reject\"]),\n      message: z.string().optional(),\n    }),\n  }),\n  z.object({\n    type: z.literal(\"user.humanInputResponse\"),\n    clientEventId: SessionOperationKey.optional(),\n    payload: z.object({\n      requestId: z.string().uuid(),\n      response: SubmitHumanInputResponseRequest,\n    }),\n  }),\n]);\nexport type ClientSessionEvent = z.infer<typeof ClientSessionEvent>;\n\nexport const SteerSessionMessageRequest = z.object({\n  text: z.string().min(1),\n  // Same per-turn system-level context as a queued user.message.\n  turnInstructions: z.string().trim().min(1).max(32768).optional(),\n  resources: z.array(ResourceRef).default([]),\n  tools: z.array(ToolRef).default([]),\n  model: z.string().min(1).optional(),\n  reasoningEffort: ReasoningEffort.optional(),\n  clientEventId: SessionOperationKey.optional(),\n  controlEtag: z.string().min(1).optional(),\n  expectedDraftRevision: z.number().int().nonnegative().optional(),\n  mcpCredentialUpdates: z.array(SessionMcpCredentialUpdateInput).optional(),\n});\nexport type SteerSessionMessageRequest = z.infer<typeof SteerSessionMessageRequest>;\n\nexport const SteerSessionMessageResponse = z.object({\n  accepted: SessionEvent,\n  turn: SessionTurn,\n});\nexport type SteerSessionMessageResponse = z.infer<typeof SteerSessionMessageResponse>;\n\nexport const SessionBusMessage = z.object({\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  events: z.array(SessionEvent).min(1),\n});\nexport type SessionBusMessage = z.infer<typeof SessionBusMessage>;\n\nexport const GitHubAppManifestCreate = z.object({\n  appName: z.string().optional(),\n  organization: z.string().optional(),\n  public: z.boolean().default(false),\n  includeCiPermissions: z.boolean().default(true),\n});\nexport type GitHubAppManifestCreate = z.infer<typeof GitHubAppManifestCreate>;\n\nexport const GitHubRepository = z.object({\n  id: z.number().int(),\n  installationId: z.number().int(),\n  fullName: z.string(),\n  name: z.string(),\n  private: z.boolean(),\n  htmlUrl: z.string(),\n  cloneUrl: z.string(),\n  defaultBranch: z.string(),\n  accountLogin: z.string(),\n  accountType: z.string().nullable(),\n});\nexport type GitHubRepository = z.infer<typeof GitHubRepository>;\n\nexport const GitHubRepositoryScope = z.enum([\"all\", \"selected\"]);\nexport type GitHubRepositoryScope = z.infer<typeof GitHubRepositoryScope>;\n\nexport const GitHubBindingStatus = z.enum([\"disabled\", \"unbound\", \"bound\"]);\nexport type GitHubBindingStatus = z.infer<typeof GitHubBindingStatus>;\n\nexport const GitHubInstallationLifecycle = z.enum([\"active\", \"suspended\", \"deleted\", \"unverified\"]);\nexport type GitHubInstallationLifecycle = z.infer<typeof GitHubInstallationLifecycle>;\n\nexport const GitHubInstallationBinding = z.object({\n  installationId: z.number().int().positive(),\n  githubAccountId: z.number().int().positive().nullable(),\n  accountLogin: z.string().nullable(),\n  accountType: z.string().nullable(),\n  lifecycle: GitHubInstallationLifecycle,\n  repositoryScope: GitHubRepositoryScope,\n  repositoryCount: z.number().int().nonnegative(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type GitHubInstallationBinding = z.infer<typeof GitHubInstallationBinding>;\n\nexport const GitHubAppInfo = z.object({\n  configured: z.boolean(),\n  status: GitHubBindingStatus,\n  appId: z.string().nullable(),\n  clientId: z.string().nullable(),\n  appSlug: z.string().nullable(),\n  installUrl: z.string().nullable(),\n  linkUrl: z.string().nullable(),\n  installations: z.array(GitHubInstallationBinding),\n  missing: z.array(z.string()),\n});\nexport type GitHubAppInfo = z.infer<typeof GitHubAppInfo>;\n\nexport const GitHubRepositoriesResponse = z.object({\n  repositories: z.array(GitHubRepository),\n});\nexport type GitHubRepositoriesResponse = z.infer<typeof GitHubRepositoriesResponse>;\n\nexport const ClientAuthConfig = z.discriminatedUnion(\"mode\", [\n  z.object({\n    mode: z.literal(\"none\"),\n  }),\n  z.object({\n    mode: z.literal(\"deploymentKey\"),\n    headerName: z.literal(\"x-opengeni-access-key\"),\n  }),\n  z.object({\n    mode: z.literal(\"configuredToken\"),\n    headerName: z.literal(\"authorization\"),\n    scheme: z.literal(\"bearer\"),\n  }),\n  z.object({\n    mode: z.literal(\"managedSession\"),\n    session: z.literal(\"cookie\"),\n  }),\n]);\nexport type ClientAuthConfig = z.infer<typeof ClientAuthConfig>;\n\n// The negotiated capability handshake document (sandbox contract C.3). ONE shape;\n// collapses the parallel per-module definitions. A capability cell is always\n// present with `available`/`transport` + a `reason` when unavailable — never\n// absent.\nexport const CapabilityUnavailableReason = z.enum([\n  \"backend_unsupported\",\n  \"os_unsupported\",\n  \"not_provisioned\",\n  \"disabled_by_policy\",\n  \"lease_cold\",\n  \"tier_headless\",\n  // Selfhosted (bring-your-own-compute) negotiation states (M1 additive; the\n  // selfhosted negotiation in select.ts wires them in M3):\n  \"agent_offline\", // the enrolled agent process is not running / unreachable\n  \"agent_reconnecting\", // a transient blip — the agent is reconnecting (warmable)\n  \"consent_required\", // whole-machine / screen-control consent not yet acknowledged\n  \"display_unavailable\", // headless machine with no display stack (no DesktopStream)\n]);\nexport type CapabilityUnavailableReason = z.infer<typeof CapabilityUnavailableReason>;\n\nexport const SessionCapabilities = z.object({\n  sessionId: z.string().uuid(),\n  backend: SandboxBackend,\n  os: SandboxOs,\n  liveness: z.enum([\"cold\", \"warming\", \"warm\", \"draining\"]),\n  // Echoed on viewer heartbeats (the split-brain fence).\n  leaseEpoch: z.number().int().nonnegative(),\n  workspaceGeneration: z.number().int().nonnegative().nullable().default(null),\n  archiveGeneration: z.number().int().nonnegative().nullable().default(null),\n  archiveComplete: z.boolean().default(false),\n  viewerHeartbeatIntervalMs: z.number().int().positive().default(30_000),\n  FileSystem: z.object({\n    available: z.boolean(),\n    readOnly: z.boolean(),\n    root: z.string(),\n    pathSep: z.enum([\"/\", \"\\\\\"]),\n    treeMode: z.enum([\"lazy\", \"snapshot\"]),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  Terminal: z.object({\n    transport: z.enum([\"sse-events\", \"pty-ws\"]).nullable(),\n    ptyCapable: z.boolean(),\n    shell: z.string(),\n    // The direct-to-provider ttyd PTY-over-websocket URL (pty-ws) resolved on the\n    // SAME tunnel as the desktop; null on a cold lease / read-only sse-events\n    // firehose / degraded terminal. The scoped stream token is recorded against\n    // the holder (NEVER a URL query param), symmetric with DesktopStream.\n    url: z.string().url().nullable(),\n    token: z.string().nullable(),\n    // ISO absolute expiry of the minted stream token (symmetric with\n    // DesktopStream.expiresAt). Null when no live URL/token is minted.\n    expiresAt: z.string().nullable(),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  Git: z.object({\n    available: z.boolean(),\n    repos: z.array(z.string()),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  DesktopStream: z.object({\n    // \"relay-frames\" is the selfhosted framebuffer stream: PNG-per-frame protobuf\n    // datagrams spliced over the relay (NOT RFB). The viewer renders it with the\n    // \"frames\" client (a canvas painter), distinct from Modal's \"vnc-ws\"/\"novnc\".\n    transport: z.enum([\"vnc-ws\", \"rdp-ws\", \"webrtc\", \"relay-frames\"]).nullable(),\n    client: z.enum([\"novnc\", \"web-rdp\", \"frames\"]).nullable(),\n    mode: z.enum([\"read-only\", \"interactive\"]).default(\"read-only\"),\n    url: z.string().url().nullable(),\n    token: z.string().nullable(),\n    expiresAt: z.string().nullable(),\n    resolution: z\n      .tuple([z.number().int().positive(), z.number().int().positive()])\n      .default([1024, 768]),\n    // REQUIRED, no default (the server must assert un-redacted pixels).\n    unredacted: z.boolean(),\n    requiresAcknowledgment: z.boolean(),\n    acknowledged: z.boolean(),\n    // SHARED-EXPOSURE disclosure (addendum E.1). `shared` is true when the box's\n    // group has >1 session: watching this desktop ALSO shows the sibling\n    // sessions' agents on the one :0 framebuffer (the pixels cannot be redacted).\n    // `sharedSessionIds` lists the OTHER sessions whose agents may appear — IDS\n    // ONLY, never their goal/metadata/conversation (a viewer of A must not be\n    // able to use \"I can see B's id\" to subscribe to B's events; stress g). When\n    // shared, the consent gate requires the shared-exposure acknowledgment (409\n    // shared_acknowledgment_required) before the desktop path is handed out.\n    shared: z.boolean().default(false),\n    sharedSessionIds: z.array(z.string().uuid()).default([]),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  Recording: z.object({\n    available: z.boolean(),\n    modes: z.array(z.enum([\"manual\", \"on-turn\", \"on-verify\"])),\n    codecs: z.array(z.enum([\"h264-mp4\", \"vp9-webm\"])),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  // The AGENT drives the SAME :0 (xdotool/XTEST + scrot) the human watches; the\n  // human viewer plane is read-only by default (§6). `available` == desktop-\n  // capable backend && computerUseEnabled; `readOnly` reports whether the agent\n  // driver itself is gated to no-op input (v1 default false — the agent clicks).\n  ComputerUse: z.object({\n    available: z.boolean(),\n    readOnly: z.boolean(),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  negotiatedAt: z.string(),\n});\nexport type SessionCapabilities = z.infer<typeof SessionCapabilities>;\n\n// ── API-direct viewer attach (P1.4) ─────────────────────────────────────────\n// A viewer holds the GROUP lease (keeping the box warm while watched). These\n// shape the in-process attach/heartbeat/detach handlers. The scoped stream\n// token + the un-redacted-pixel acknowledgment are P3/P4 — here it is the\n// viewer-HOLDER lifecycle only.\n\n// POST .../viewers — acquire a viewer holder. An omitted viewerId mints a fresh\n// one (returned in the response, to carry through heartbeats + detach).\n//\n// `desktop` declares intent to attach the UN-REDACTED pixel plane (noVNC). ONLY\n// that plane carries the consent gate (the un-redacted/shared acknowledgment). A\n// terminal-only warm attach (`desktop:false`, the default) needs NO consent — a\n// shell is interactive by nature and the gate is the scoped tunnel URL + stream\n// token — so it warms the box and mints the pty-ws terminal cell WITHOUT a 409.\n// Omitted defaults to `false` so a terminal-only client never trips the gate.\nexport const AttachViewerRequest = z.object({\n  viewerId: z.string().uuid().optional(),\n  desktop: z.boolean().optional(),\n});\nexport type AttachViewerRequest = z.infer<typeof AttachViewerRequest>;\n\nexport const ViewerHolder = z.object({\n  viewerId: z.string().uuid(),\n  sandboxGroupId: z.string().uuid(),\n  liveness: z.enum([\"cold\", \"warming\", \"warm\", \"draining\"]),\n  // The epoch the viewer is fenced on; echoed back on heartbeats.\n  leaseEpoch: z.number().int().nonnegative(),\n  workspaceGeneration: z.number().int().nonnegative().nullable(),\n  archiveGeneration: z.number().int().nonnegative().nullable(),\n  archiveComplete: z.boolean(),\n  viewerHeartbeatIntervalMs: z.number().int().positive(),\n  // The desktop pixel tunnel URL the viewer connects to directly; null until\n  // a viewer grant is minted (gated until then).\n  dataPlaneUrl: z.string().nullable(),\n});\nexport type ViewerHolder = z.infer<typeof ViewerHolder>;\n\n// POST .../stream-capabilities/acknowledge — record the calling principal's\n// acknowledgment of the un-redacted pixel plane. Reuses the acknowledgment\n// machinery — no new endpoint\n// shape beyond this body, no new permission beyond stream:acknowledge.\n//\n// `acknowledgeShared` MUST be true when the box is shared (the group has >1\n// session): the un-redacted desktop path returns 409 shared_acknowledgment_required\n// until a shared box is acknowledged WITH the shared-exposure consent. For a\n// solo box `acknowledgeShared` is irrelevant (the un-redacted ack alone gates).\nexport const AcknowledgeStreamRequest = z.object({\n  // The principal accepts that the desktop pixel plane is un-redacted (can show\n  // cloud creds the agent cat's into a terminal). Always true to record consent;\n  // present for self-documentation + a future explicit withdraw.\n  acknowledgeUnredacted: z.boolean().default(true),\n  // The principal accepts the shared-exposure disclosure: watching this desktop\n  // also shows sibling sessions' agents on the one framebuffer.\n  acknowledgeShared: z.boolean().default(false),\n});\nexport type AcknowledgeStreamRequest = z.infer<typeof AcknowledgeStreamRequest>;\n\nexport const AcknowledgeStreamResponse = z.object({\n  acknowledged: z.boolean(),\n  acknowledgedShared: z.boolean(),\n});\nexport type AcknowledgeStreamResponse = z.infer<typeof AcknowledgeStreamResponse>;\n\n// POST .../viewers/:viewerId/heartbeat — refresh the holder TTL. Epoch-fenced:\n// a stale-epoch beat (a box re-established under a newer epoch) is rejected.\nexport const ViewerHeartbeatRequest = z.object({\n  leaseEpoch: z.number().int().nonnegative(),\n});\nexport type ViewerHeartbeatRequest = z.infer<typeof ViewerHeartbeatRequest>;\n\nexport const ViewerHeartbeatResponse = z.object({\n  // false ⇒ the holder was reaped or the epoch is stale; the client re-attaches.\n  alive: z.boolean(),\n});\nexport type ViewerHeartbeatResponse = z.infer<typeof ViewerHeartbeatResponse>;\n\n// =============================================================================\n// Bring-your-own-compute (M5) — enrollment device-flow HTTP contract.\n//\n// The HTTP shapes mirror the @opengeni/agent-proto device-flow messages\n// (DeviceAuthStart*, DeviceAuthPoll*, EnrollmentCredentials) so the Rust agent's\n// `enroll` command (which runs the flow over HTTP before it has NATS creds)\n// decodes the SAME field names (the proto's ts-proto JSON is camelCase). The\n// request bodies additionally carry the consent-relevant fields the design brief\n// mandates (the agent ed25519 pubkey + can-offer-display + requests-screen-control).\n// =============================================================================\n\nexport const EnrollmentOs = z.enum([\"linux\", \"macos\", \"windows\"]);\nexport type EnrollmentOs = z.infer<typeof EnrollmentOs>;\nexport const EnrollmentArch = z.enum([\"x86_64\", \"aarch64\"]);\nexport type EnrollmentArch = z.infer<typeof EnrollmentArch>;\n\n// POST /enrollments/device/start (agent-side, unauthenticated-at-the-user-level,\n// rate-limited). The agent presents its ed25519 public key + os/arch + the\n// requested whole-machine exposure + whether it can offer a display + whether it\n// requests screen control.\nexport const DeviceEnrollmentStartRequest = z.object({\n  // The agent's ed25519 public key (the machine identity the enrollment binds to).\n  publicKey: z.string().min(1).max(1024),\n  os: EnrollmentOs.default(\"linux\"),\n  arch: EnrollmentArch.default(\"x86_64\"),\n  // Human-friendly machine name (hostname by default).\n  machineName: z.string().min(1).max(256).optional(),\n  // v1 only supports whole-machine; kept explicit so the consent is recorded.\n  exposure: z.literal(\"whole-machine\").default(\"whole-machine\"),\n  // The agent can offer a display (a real screen / Xvfb is available).\n  canOfferDisplay: z.boolean().default(false),\n  // The agent requests screen control (computer-use); the user's allow_screen_control\n  // at approve is the AUTHORITATIVE consent.\n  requestsScreenControl: z.boolean().default(false),\n  // The workspace this machine is enrolling into. The agent is told this at install\n  // (the user picks the workspace, or the install/enroll token carries it). The user\n  // who approves must hold a grant in THIS workspace — that binding is what makes\n  // the (user-unauthenticated) start safe: it cannot grant access to a workspace no\n  // authorized user later approves in.\n  workspaceId: z.string().uuid(),\n});\nexport type DeviceEnrollmentStartRequest = z.infer<typeof DeviceEnrollmentStartRequest>;\n\n// The DeviceAuthStart response (field names match the proto's JSON).\nexport const DeviceEnrollmentStartResponse = z.object({\n  deviceCode: z.string(),\n  userCode: z.string(),\n  verificationUri: z.string(),\n  verificationUriComplete: z.string(),\n  intervalSeconds: z.number().int().positive(),\n  expiresInSeconds: z.number().int().positive(),\n});\nexport type DeviceEnrollmentStartResponse = z.infer<typeof DeviceEnrollmentStartResponse>;\n\n// POST /enrollments/device/approve (USER-authenticated, workspace-gated). The\n// LOUD CONSENT step. whole-machine is mandatory (implicit); screen-control is\n// opt-in per allow_screen_control.\nexport const DeviceEnrollmentApproveRequest = z.object({\n  userCode: z.string().min(1).max(64),\n  allowScreenControl: z.boolean().default(false),\n});\nexport type DeviceEnrollmentApproveRequest = z.infer<typeof DeviceEnrollmentApproveRequest>;\n\nexport const DeviceEnrollmentApproveResponse = z.object({\n  approved: z.boolean(),\n  enrollmentId: z.string().uuid(),\n  sandboxId: z.string().uuid(),\n  allowScreenControl: z.boolean(),\n});\nexport type DeviceEnrollmentApproveResponse = z.infer<typeof DeviceEnrollmentApproveResponse>;\n\n// POST /enrollments/device/poll (agent-side). The poll state machine.\nexport const DeviceEnrollmentPollRequest = z.object({\n  deviceCode: z.string().min(1).max(256),\n});\nexport type DeviceEnrollmentPollRequest = z.infer<typeof DeviceEnrollmentPollRequest>;\n\nexport const DeviceEnrollmentState = z.enum([\n  \"pending\",\n  \"authorized\",\n  \"denied\",\n  \"expired\",\n  \"disabled\",\n]);\nexport type DeviceEnrollmentState = z.infer<typeof DeviceEnrollmentState>;\n\n// The EnrollmentCredentials (field names match the proto's JSON). natsAccountCreds\n// is a PLACEHOLDER — the real per-workspace NATS Account creds binding is\n// infra-deferred (M4/relay); the bearer + subjectPrefix are the application-tier\n// identity the agent presents today.\nexport const EnrollmentCredentialsResponse = z.object({\n  agentId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  // The signed bearer the agent presents to the control plane (the `oge_` token).\n  bearer: z.string(),\n  // The Account-scoped control-plane subject prefix the agent subscribes to:\n  // agent.<workspaceId>.<agentId>.\n  subjectPrefix: z.string(),\n  // Connect info for the control plane + stream relay (may be empty when not yet\n  // configured for this deployment — the agent surfaces \"control plane unconfigured\").\n  natsUrls: z.array(z.string()),\n  relayUrl: z.string(),\n  // The agent's PRODUCER token for the relay edge (the `ogr_` token; M8b). Presented\n  // as StreamOpen.token when the agent registers a pty/desktop channel; the relay\n  // verifies it then pairs the producer with the viewer (whose `ogs_` token the\n  // relay also verifies). Empty when the relay-token plane is unconfigured for this\n  // deployment (graceful degrade — the agent then presents an empty token the relay\n  // rejects, surfacing the gap loudly rather than silently producing a dead stream).\n  relayToken: z.string(),\n  // VESTIGIAL (M-AUTH): there is no per-machine NATS Account creds file. The agent\n  // presents the `bearer` above as the NATS connect AUTH-TOKEN; the server's\n  // auth-callout responder validates it and mints a workspace-scoped user JWT. This\n  // field echoes the bearer so a consumer reading it as the connect credential still\n  // works; new consumers should read `bearer` directly.\n  natsAccountCreds: z.string(),\n  // The minisign public key the agent pins for self-update verification.\n  updatePublicKey: z.string(),\n  consentedWholeMachine: z.boolean(),\n  consentedScreenControl: z.boolean(),\n});\nexport type EnrollmentCredentialsResponse = z.infer<typeof EnrollmentCredentialsResponse>;\n\nexport const DeviceEnrollmentPollResponse = z.object({\n  state: DeviceEnrollmentState,\n  // Present only when state === \"authorized\".\n  credentials: EnrollmentCredentialsResponse.optional(),\n});\nexport type DeviceEnrollmentPollResponse = z.infer<typeof DeviceEnrollmentPollResponse>;\n\n// GET /enrollments — a workspace's machines (the Machines dashboard surface).\nexport const EnrollmentSummary = z.object({\n  id: z.string().uuid(),\n  pubkey: z.string(),\n  exposure: z.literal(\"whole-machine\"),\n  hasDisplay: z.boolean(),\n  // Present (non-null) only when a display EXISTS but capture is blocked (macOS\n  // Screen Recording / TCC not granted): a human, actionable reason so the UI can\n  // show \"display: capture not granted\" instead of a bare \"headless\". null == capture\n  // permitted OR genuinely headless.\n  desktopUnavailableReason: z.string().nullish(),\n  allowScreenControl: z.boolean(),\n  status: z.enum([\"active\", \"revoked\"]),\n  os: EnrollmentOs,\n  arch: z.string(),\n  lastSeenAt: z.string().nullable(),\n  createdAt: z.string(),\n  revokedAt: z.string().nullable(),\n});\nexport type EnrollmentSummary = z.infer<typeof EnrollmentSummary>;\n\nexport const ListEnrollmentsResponse = z.object({\n  enrollments: z.array(EnrollmentSummary),\n});\nexport type ListEnrollmentsResponse = z.infer<typeof ListEnrollmentsResponse>;\n\nexport const RevokeEnrollmentResponse = z.object({\n  revoked: z.boolean(),\n});\nexport type RevokeEnrollmentResponse = z.infer<typeof RevokeEnrollmentResponse>;\n\n// =============================================================================\n// Enrollment UX (self-hosted enrollment UX, design 11): the click-Grant approve\n// page lookup/deny + the headless enroll-token mint/exchange. These sit beside the\n// device-flow contracts above and REUSE EnrollmentCredentialsResponse for the\n// exchange's credential payload (identical shape to the poll authorized branch).\n// =============================================================================\n\n// POST /v1/enrollments/device/lookup (USER-authenticated, NO workspace in the\n// path). The approve page (EnrollmentConsent) needs the machine details for a\n// user_code WITHOUT consuming the request. The user_code is globally unique among\n// pending rows; the route resolves its workspace, authorizes (enrollments:read),\n// and returns the machine details — or 404 (never revealing cross-workspace\n// existence) when the grant check fails or no live pending row matches.\nexport const DeviceEnrollmentLookupRequest = z.object({\n  userCode: z.string().min(1).max(64),\n});\nexport type DeviceEnrollmentLookupRequest = z.infer<typeof DeviceEnrollmentLookupRequest>;\n\n// The presentational machine details the consent screen renders (a subset of the\n// pending request — NO secrets, NO device_code).\nexport const DeviceEnrollmentLookupMachine = z.object({\n  machineName: z.string().nullable(),\n  os: EnrollmentOs,\n  arch: z.string(),\n  canOfferDisplay: z.boolean(),\n  requestsScreenControl: z.boolean(),\n});\nexport type DeviceEnrollmentLookupMachine = z.infer<typeof DeviceEnrollmentLookupMachine>;\n\nexport const DeviceEnrollmentLookupResponse = z.object({\n  workspaceId: z.string().uuid(),\n  userCode: z.string(),\n  machine: DeviceEnrollmentLookupMachine,\n  expiresAt: z.string(),\n});\nexport type DeviceEnrollmentLookupResponse = z.infer<typeof DeviceEnrollmentLookupResponse>;\n\n// POST /v1/workspaces/:workspaceId/enrollments/device/deny (USER-authenticated,\n// enrollments:manage). The explicit \"no\" at the approve page — mirrors approve.\nexport const DeviceEnrollmentDenyRequest = z.object({\n  userCode: z.string().min(1).max(64),\n});\nexport type DeviceEnrollmentDenyRequest = z.infer<typeof DeviceEnrollmentDenyRequest>;\n\nexport const DeviceEnrollmentDenyResponse = z.object({\n  denied: z.boolean(),\n});\nexport type DeviceEnrollmentDenyResponse = z.infer<typeof DeviceEnrollmentDenyResponse>;\n\n// POST /v1/workspaces/:workspaceId/enrollments/token (USER-authenticated,\n// enrollments:manage). Mints the short-TTL headless enroll token (the `oget_`\n// token). allowScreenControl bakes the screen-control consent into the token.\nexport const MintEnrollTokenRequest = z.object({\n  allowScreenControl: z.boolean().default(false),\n});\nexport type MintEnrollTokenRequest = z.infer<typeof MintEnrollTokenRequest>;\n\nexport const MintEnrollTokenResponse = z.object({\n  // The `oget_` token. SECRET — the UI shows it once with a copy-now warning.\n  token: z.string(),\n  expiresAt: z.string(),\n  expiresInSeconds: z.number().int().positive(),\n});\nexport type MintEnrollTokenResponse = z.infer<typeof MintEnrollTokenResponse>;\n\n// POST /v1/enrollments/token/exchange (UNAUTHENTICATED — the token IS the auth).\n// The agent presents the same identity fields it sends to device/start plus the\n// enroll token. On a valid token the control plane performs the SAME finalize as\n// approve and returns the IDENTICAL EnrollmentCredentialsResponse shape (so the\n// agent's existing credential parsing is reused).\nexport const EnrollTokenExchangeRequest = z.object({\n  // The `oget_` enroll token (the auth + the workspace/account/consent grant).\n  token: z.string().min(1),\n  // The agent's ed25519 public key (the machine identity the enrollment binds to).\n  publicKey: z.string().min(1).max(1024),\n  os: EnrollmentOs.default(\"linux\"),\n  arch: EnrollmentArch.default(\"x86_64\"),\n  machineName: z.string().min(1).max(256).optional(),\n  // v1 only supports whole-machine; kept explicit so the consent is recorded.\n  exposure: z.literal(\"whole-machine\").default(\"whole-machine\"),\n  canOfferDisplay: z.boolean().default(false),\n  // The agent's REQUEST; the token's allowScreenControl is the AUTHORITATIVE consent.\n  requestsScreenControl: z.boolean().default(false),\n});\nexport type EnrollTokenExchangeRequest = z.infer<typeof EnrollTokenExchangeRequest>;\n\n// The exchange wraps the EXISTING EnrollmentCredentialsResponse — IDENTICAL to the\n// poll authorized branch's `credentials` (NOT a redefined credential shape).\nexport const EnrollTokenExchangeResponse = z.object({\n  credentials: EnrollmentCredentialsResponse,\n});\nexport type EnrollTokenExchangeResponse = z.infer<typeof EnrollTokenExchangeResponse>;\n\n// ── Machines dashboard + per-machine metrics (M10) ────────────\n//\n// The SHARED data contract M10 (backend) implements + M9 (UI) renders. THE\n// orchestrator owns this shape; M9 imports these types so the dashboard never\n// drifts from the API. The fields mirror the agent's MetricsSample wire shape\n// (`@opengeni/agent-proto`) projected to the dashboard's JSON, plus the derived\n// machine state matrix (the M3 liveness + the consent/display reasons).\n\n/**\n * A point-in-time machine metrics sample as the dashboard reads it. `cpuPct` and\n * the load averages are 0..N doubles; the byte figures are integers; `gpuUtilPct`\n * / `gpuMemBytes` are null when no GPU was present at sample time (the wire\n * contract: absence == not-reported, NEVER a real zero). `runQueue` is the\n * runnable-count contention signal. `sampledAt` is an ISO-8601 instant.\n */\nexport const MetricSample = z.object({\n  cpuPct: z.number(),\n  load1: z.number(),\n  load5: z.number(),\n  load15: z.number(),\n  memUsedBytes: z.number().int(),\n  memTotalBytes: z.number().int(),\n  diskUsedBytes: z.number().int(),\n  diskTotalBytes: z.number().int(),\n  gpuUtilPct: z.number().nullable(),\n  gpuMemBytes: z.number().int().nullable(),\n  runQueue: z.number(),\n  sampledAt: z.string(),\n});\nexport type MetricSample = z.infer<typeof MetricSample>;\n\n/** The derived dashboard state of a machine. The M3 liveness\n *  (online/reconnecting/offline) plus the enrollment-derived consent/display\n *  reasons (consent_required / display_unavailable) and the in-flight device-flow\n *  (enrolling). */\nexport const MachineState = z.enum([\n  \"online\",\n  \"reconnecting\",\n  \"offline\",\n  \"consent_required\",\n  \"display_unavailable\",\n  \"enrolling\",\n]);\nexport type MachineState = z.infer<typeof MachineState>;\n\nexport const MachineKind = z.enum([\"modal\", \"selfhosted\"]);\nexport type MachineKind = z.infer<typeof MachineKind>;\n\n/**\n * A machine as the Machines dashboard renders it. The workspace's enrolled\n * selfhosted machines PLUS the session's synthetic Modal group box\n * (`isSessionGroup: true`). `active` marks the session's currently-active\n * routing target. `sharedSessionCount` is the lease refcount (how many sessions\n * share this whole machine). `metrics` is the latest sample, or null when none\n * has landed yet (just enrolled / offline before a first heartbeat).\n */\nexport const MachineView = z.object({\n  sandboxId: z.string(),\n  enrollmentId: z.string().nullable(),\n  name: z.string(),\n  kind: MachineKind,\n  state: MachineState,\n  active: z.boolean(),\n  isSessionGroup: z.boolean(),\n  workspaceGeneration: z.number().int().nonnegative().nullable(),\n  archiveGeneration: z.number().int().nonnegative().nullable(),\n  archiveComplete: z.boolean(),\n  os: z.string(),\n  arch: z.string(),\n  hasDisplay: z.boolean(),\n  // Non-null only when a display exists but capture is blocked (macOS Screen\n  // Recording / TCC not granted) — the UI can surface \"display: capture not granted\".\n  // null == capture permitted OR headless.\n  desktopUnavailableReason: z.string().nullish(),\n  allowScreenControl: z.boolean(),\n  sharedSessionCount: z.number().int(),\n  lastSeenAt: z.string().nullable(),\n  metrics: MetricSample.nullable(),\n});\nexport type MachineView = z.infer<typeof MachineView>;\n\n/**\n * GET /v1/workspaces/:ws/machines — the dashboard list. `activeSandboxId` /\n * `activeEpoch` echo the session's epoch-fenced active-sandbox pointer (null\n * activeSandboxId == the session's own group box is active).\n */\nexport const MachinesResponse = z.object({\n  activeSandboxId: z.string().nullable(),\n  activeEpoch: z.number().int(),\n  machines: z.array(MachineView),\n});\nexport type MachinesResponse = z.infer<typeof MachinesResponse>;\n\n/**\n * POST /v1/workspaces/:ws/sessions/:sessionId/active-sandbox — the user-\n * authenticated swap of a session's active sandbox (the same epoch-fenced\n * mechanic the M7 `sandbox_swap` MCP tool exposes to the agent). `target` is a\n * `MachinesResponse` machine's `sandboxId`, or \"session\"/\"default\" to swap back\n * to the session's own group box.\n */\nexport const SwapActiveSandboxRequest = z.object({\n  target: z.string().min(1),\n});\nexport type SwapActiveSandboxRequest = z.infer<typeof SwapActiveSandboxRequest>;\n\n/**\n * The swap outcome (mirrors the server `FleetSwapResult`). `swapped` is true on a\n * successful repoint OR a no-op (already pointed there); `reason` carries the\n * failure detail (unowned/offline target, or a lost epoch fence) when false.\n */\nexport const SwapActiveSandboxResponse = z.object({\n  swapped: z.boolean(),\n  activeSandboxId: z.string().nullable(),\n  activeEpoch: z.number().int(),\n  reason: z.string().optional(),\n  // Typed rejection discriminant (issue #341). Present only when swapped is false,\n  // so a client distinguishes a deleted/absent target from an unaddressable\n  // enrollment from a backend the turn cannot establish from a lost epoch race —\n  // without parsing the human reason string.\n  code: z\n    .enum([\n      \"stale_pointer\",\n      \"offline_enrollment\",\n      \"unsupported_backend_context\",\n      \"transient_establishment\",\n      \"concurrent_swap\",\n      \"recovery_in_progress\",\n      \"recovery_degraded\",\n      \"recovery_unrecoverable\",\n    ])\n    .optional(),\n});\nexport type SwapActiveSandboxResponse = z.infer<typeof SwapActiveSandboxResponse>;\n\n/**\n * GET /v1/workspaces/:ws/machines/:enrollmentId/metrics/series?window=1h — the\n * downsampled (~1/min) history the dashboard time-range reads.\n */\nexport const MachineMetricsSeriesResponse = z.object({\n  samples: z.array(MetricSample),\n});\nexport type MachineMetricsSeriesResponse = z.infer<typeof MachineMetricsSeriesResponse>;\n\n/**\n * Keep this server-facing schema graph eager when imported while allowing\n * browser bundlers to discard it when contracts is used only for unrelated\n * helpers. Keep each call site annotated as pure; the factory argument itself\n * is side-effect-free until invoked.\n */\nfunction defineModelContractSchema<Schema>(factory: () => Schema): Schema {\n  return factory();\n}\n\nexport const ModelCapabilitySupportV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.enum([\"supported\", \"unsupported\", \"unknown\"]),\n);\nexport type ModelCapabilitySupportV1 = z.infer<typeof ModelCapabilitySupportV1>;\n\nexport const ModelCapabilityStateV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.object({\n    upstream: ModelCapabilitySupportV1,\n    runnable: z.boolean(),\n  }),\n);\nexport type ModelCapabilityStateV1 = z.infer<typeof ModelCapabilityStateV1>;\n\nexport const ModelCapabilitiesV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.object({\n    reasoning: ModelCapabilityStateV1.extend({\n      efforts: z.array(ReasoningEffort),\n      defaultEffort: ReasoningEffort.nullable(),\n      required: z.boolean(),\n    }),\n    functionCalling: ModelCapabilityStateV1,\n    structuredOutput: ModelCapabilityStateV1,\n    hostedTools: z.object({\n      webSearch: ModelCapabilityStateV1,\n      xSearch: ModelCapabilityStateV1,\n      codeExecution: ModelCapabilityStateV1,\n    }),\n    inputModalities: z.array(z.enum([\"text\", \"image\", \"audio\"])),\n    outputModalities: z.array(z.enum([\"text\", \"image\", \"audio\"])),\n    transports: z.object({\n      sse: ModelCapabilityStateV1,\n      responsesWebSocket: ModelCapabilityStateV1,\n      realtimeAudio: ModelCapabilityStateV1,\n    }),\n    latencyModes: z.array(\n      z.object({\n        id: z.enum([\"standard\", \"priority\", \"fast\"]),\n        upstream: ModelCapabilitySupportV1,\n        runnable: z.boolean(),\n        billingMultiplierBps: z.number().int().positive().optional(),\n      }),\n    ),\n  }),\n);\nexport type ModelCapabilitiesV1 = z.infer<typeof ModelCapabilitiesV1>;\n\nexport const ModelCredentialSourceV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.union([\n    z\n      .object({ kind: z.literal(\"deployment\"), mechanism: z.enum([\"api_key\", \"azure_ad_bearer\"]) })\n      .strict(),\n    z.object({ kind: z.literal(\"connected_subscription\"), provider: z.literal(\"codex\") }).strict(),\n    z.object({ kind: z.literal(\"workspace_connection\"), mechanism: z.literal(\"api_key\") }).strict(),\n  ]),\n);\nexport type ModelCredentialSourceV1 = z.infer<typeof ModelCredentialSourceV1>;\n\nexport const ModelBillingAttributionV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z\n    .object({\n      upstreamPayer: z.enum([\"deployment\", \"workspace\", \"connected_subscription\"]),\n      metering: z.enum([\"opengeni_credits\", \"external\"]),\n    })\n    .strict(),\n);\nexport type ModelBillingAttributionV1 = z.infer<typeof ModelBillingAttributionV1>;\n\nexport const TURN_EXECUTION_POLICY_METADATA_KEY = \"turnExecutionPolicyV1\" as const;\n\nexport const TurnExecutionModelSourceV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.enum([\"explicit\", \"session\", \"deployment\", \"continuation\"]),\n);\nexport type TurnExecutionModelSourceV1 = z.infer<typeof TurnExecutionModelSourceV1>;\n\nexport const TurnExecutionReasoningSourceV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.enum([\"explicit\", \"session\", \"deployment\", \"continuation\"]),\n);\nexport type TurnExecutionReasoningSourceV1 = z.infer<typeof TurnExecutionReasoningSourceV1>;\n\n/**\n * Secret-safe execution identity frozen onto one accepted logical turn.\n *\n * This is deliberately a strict, normalized reference to the deployment\n * definition rather than a serialized provider client. It must never contain\n * a key/token, concrete connected credential id, account label, authorization\n * header, or credential-bearing URL/query value.\n */\nexport const TurnExecutionPolicyV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z\n    .object({\n      schemaVersion: z.literal(1),\n      productModelId: z.string().min(1),\n      requestedModelId: z.string().min(1).nullable(),\n      modelSource: TurnExecutionModelSourceV1,\n      reasoningEffort: ReasoningEffort,\n      reasoningSource: TurnExecutionReasoningSourceV1,\n      providerId: z.string().min(1),\n      upstreamModelId: z.string().min(1),\n      wireApi: z.enum([\"responses\", \"chat\"]),\n      credentialSource: ModelCredentialSourceV1,\n      billing: ModelBillingAttributionV1,\n      definitionVersion: z.string().regex(/^sha256:[a-f0-9]{64}$/u),\n    })\n    .strict()\n    .superRefine((policy, context) => {\n      if (policy.modelSource === \"explicit\" && policy.requestedModelId === null) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"requestedModelId\"],\n          message: \"an explicit model source requires a requested model id\",\n        });\n      }\n      if (policy.modelSource !== \"explicit\" && policy.requestedModelId !== null) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"requestedModelId\"],\n          message: \"only an explicit model source may retain a requested model id\",\n        });\n      }\n    }),\n);\nexport type TurnExecutionPolicyV1 = z.infer<typeof TurnExecutionPolicyV1>;\n\nexport type TurnExecutionPolicyReadV1 =\n  | { kind: \"absent\" }\n  | { kind: \"valid\"; policy: TurnExecutionPolicyV1 };\n\n/**\n * Read the policy from turn metadata. Only a literally absent key is legacy;\n * null, undefined, an unknown schema version, extra fields, and every other\n * malformed present value fail closed. Error text reports paths only and never\n * reflects the untrusted value into logs or events.\n */\nexport function readTurnExecutionPolicyV1(metadata: unknown): TurnExecutionPolicyReadV1 {\n  if (metadata === null || metadata === undefined) {\n    return { kind: \"absent\" };\n  }\n  if (typeof metadata !== \"object\" || Array.isArray(metadata)) {\n    throw new Error(\"Malformed turn execution policy metadata: turn metadata is not an object\");\n  }\n  const record = metadata as Record<string, unknown>;\n  if (!Object.prototype.hasOwnProperty.call(record, TURN_EXECUTION_POLICY_METADATA_KEY)) {\n    return { kind: \"absent\" };\n  }\n  const parsed = TurnExecutionPolicyV1.safeParse(record[TURN_EXECUTION_POLICY_METADATA_KEY]);\n  if (!parsed.success) {\n    const paths = [\n      ...new Set(\n        parsed.error.issues.map((issue) =>\n          issue.path.length === 0 ? \"policy\" : `policy.${issue.path.join(\".\")}`,\n        ),\n      ),\n    ].join(\", \");\n    throw new Error(`Malformed turn execution policy metadata at ${paths || \"policy\"}`);\n  }\n  return { kind: \"valid\", policy: parsed.data };\n}\n\n/** Merge a trusted policy into metadata without disturbing dispatch/recovery state. */\nexport function metadataWithTurnExecutionPolicyV1(\n  metadata: Readonly<Record<string, unknown>> | null | undefined,\n  policy: TurnExecutionPolicyV1,\n): Record<string, unknown> {\n  return {\n    ...(metadata ?? {}),\n    [TURN_EXECUTION_POLICY_METADATA_KEY]: TurnExecutionPolicyV1.parse(policy),\n  };\n}\n\n/**\n * Minimal, stable evidence projection for command receipts and audit events.\n * It intentionally excludes aliases, URLs, request metadata, and all concrete\n * credential-selection identity.\n */\nexport function turnExecutionPolicyAuditMetadata(\n  policy: TurnExecutionPolicyV1,\n  turnId: string,\n): Record<string, unknown> {\n  const parsed = TurnExecutionPolicyV1.parse(policy);\n  return {\n    turnId,\n    requestedModelId: parsed.requestedModelId,\n    effectiveModelId: parsed.productModelId,\n    modelSource: parsed.modelSource,\n    effectiveReasoningEffort: parsed.reasoningEffort,\n    reasoningSource: parsed.reasoningSource,\n    providerId: parsed.providerId,\n    credentialSourceKind: parsed.credentialSource.kind,\n    credentialSourceMechanism:\n      parsed.credentialSource.kind === \"connected_subscription\"\n        ? parsed.credentialSource.provider\n        : parsed.credentialSource.mechanism,\n    billingOwner: parsed.billing.upstreamPayer,\n    billingMetering: parsed.billing.metering,\n    definitionVersion: parsed.definitionVersion,\n  };\n}\n\nexport const ModelPricingV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.object({\n    inputMicrosPerMillionTokens: z.number().int().nonnegative(),\n    cachedInputMicrosPerMillionTokens: z.number().int().nonnegative().optional(),\n    outputMicrosPerMillionTokens: z.number().int().nonnegative(),\n    marginBps: z.number().int().min(0).max(100_000).optional(),\n  }),\n);\nexport type ModelPricingV1 = z.infer<typeof ModelPricingV1>;\n\nexport const ModelPricingScheduleV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.object({\n    default: ModelPricingV1,\n    inputTokenTiers: z\n      .array(\n        z.object({\n          minimumInputTokens: z.number().int().nonnegative(),\n          pricing: ModelPricingV1,\n        }),\n      )\n      .optional(),\n  }),\n);\nexport type ModelPricingScheduleV1 = z.infer<typeof ModelPricingScheduleV1>;\n\n/**\n * A single host-exposed model + the provider that serves it, as surfaced to\n * clients (SDK + React composer) by GET /v1/config/client. The wire `api`\n * (\"responses\" | \"chat\") lets a client reason about provider capabilities; the\n * provider id/label drive the picker's grouping. This mirrors the runtime's\n * ConfiguredModel (packages/config) projected to the client-safe fields.\n */\nexport const ClientModel = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.object({\n    id: z.string(),\n    label: z.string(),\n    provider: z.string(), // provider id\n    providerLabel: z.string(),\n    api: z.enum([\"responses\", \"chat\"]),\n    contextWindowTokens: z.number().int().positive().optional(),\n    // Additive normalized definition metadata. Optional so older server payloads\n    // remain parseable; current servers project the complete V1 set.\n    schemaVersion: z.literal(1).optional(),\n    aliases: z.array(z.string()).optional(),\n    deployment: z\n      .object({\n        upstreamModelId: z.string().min(1),\n        wireApi: z.enum([\"responses\", \"chat\"]),\n      })\n      .optional(),\n    executionLimits: z\n      .object({\n        contextWindowTokens: z.number().int().positive().nullable(),\n        effectiveContextWindowTokens: z.number().int().positive().nullable(),\n        autoCompactTokenLimit: z.number().int().positive().nullable(),\n        toolOutputTruncationTokens: z.number().int().positive().nullable(),\n      })\n      .optional(),\n    credentialSource: ModelCredentialSourceV1.optional(),\n    billing: ModelBillingAttributionV1.optional(),\n    capabilities: ModelCapabilitiesV1.optional(),\n    pricing: ModelPricingScheduleV1.optional(),\n    definitionVersion: z\n      .string()\n      .regex(/^sha256:[a-f0-9]{64}$/u)\n      .optional(),\n  }),\n);\nexport type ClientModel = z.infer<typeof ClientModel>;\n\nexport const ModelCredentialReadinessV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z\n    .object({\n      status: z.enum([\"ready\", \"not_ready\", \"error\"]),\n      reason: z\n        .enum([\n          \"missing_credential\",\n          \"needs_reauth\",\n          \"prerequisites_missing\",\n          \"resolver_error\",\n          \"observation_stale\",\n        ])\n        .nullable(),\n      basis: z.enum([\"configuration\", \"connection\", \"resolver\"]),\n      checkedAt: z.string().datetime().nullable(),\n    })\n    .strict()\n    .superRefine((readiness, context) => {\n      if ((readiness.status === \"ready\") !== (readiness.reason === null)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"reason\"],\n          message: \"ready credential state requires no reason; non-ready state requires a reason\",\n        });\n      }\n      if ((readiness.status === \"error\") !== (readiness.reason === \"resolver_error\")) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"reason\"],\n          message:\n            \"credential errors require resolver_error and resolver_error requires error status\",\n        });\n      }\n      if (\n        readiness.basis === \"resolver\" &&\n        readiness.status === \"ready\" &&\n        readiness.checkedAt === null\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"checkedAt\"],\n          message: \"resolver readiness requires an observation timestamp\",\n        });\n      }\n      if (readiness.reason === \"observation_stale\" && readiness.checkedAt === null) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"checkedAt\"],\n          message: \"a stale observation requires its observation timestamp\",\n        });\n      }\n    }),\n);\nexport type ModelCredentialReadinessV1 = z.infer<typeof ModelCredentialReadinessV1>;\n\nexport const ModelAvailabilityV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.object({\n    status: z.enum([\"available\", \"unavailable\", \"degraded\", \"unknown\"]),\n    selectable: z.boolean(),\n    reason: z\n      .enum([\n        \"missing_credential\",\n        \"needs_reauth\",\n        \"credential_not_ready\",\n        \"not_entitled\",\n        \"provider_unhealthy\",\n        \"policy_blocked\",\n        \"unsupported\",\n      ])\n      .nullable(),\n    checkedAt: z.string().datetime().nullable(),\n  }),\n);\nexport type ModelAvailabilityV1 = z.infer<typeof ModelAvailabilityV1>;\n\nexport const WorkspaceModelCatalogModel = /* @__PURE__ */ defineModelContractSchema(() =>\n  ClientModel.extend({\n    credentialReadiness: ModelCredentialReadinessV1,\n    availability: ModelAvailabilityV1,\n  }),\n);\nexport type WorkspaceModelCatalogModel = z.infer<typeof WorkspaceModelCatalogModel>;\n\nexport const WorkspaceModelCatalogResponse = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.object({\n    models: z.array(WorkspaceModelCatalogModel),\n  }),\n);\nexport type WorkspaceModelCatalogResponse = z.infer<typeof WorkspaceModelCatalogResponse>;\n\n/**\n * Exact public HTTP protocol revision spoken by this release train.\n *\n * This is deliberately independent from a deployment SHA: API and web may roll\n * at different instants, while incompatible request shapes must never cross\n * that rollout boundary. Mutating clients send this value in\n * `x-opengeni-api-contract`; the API rejects any other value before routing.\n */\nexport const OPENGENI_API_CONTRACT_REVISION = \"2026-07-turn-instructions-v1\" as const;\nexport const OPENGENI_API_CONTRACT_HEADER = \"x-opengeni-api-contract\" as const;\n/** Bounded request/response identifier shared by browser, ingress, and API diagnostics. */\nexport const OPENGENI_CORRELATION_HEADER = \"x-opengeni-correlation-id\" as const;\n\nexport const ClientConfig = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.object({\n    deploymentRevision: z.string(),\n    apiContractRevision: z.literal(OPENGENI_API_CONTRACT_REVISION),\n    // Release-train version of the server (absent on dev/source builds). The\n    // compatibility policy lives in docs/architecture.md — clients within the\n    // same major are supported; evolution is additive within a major.\n    serverVersion: z.string().optional(),\n    defaultModel: z.string(),\n    allowedModels: z.array(z.string()).min(1),\n    // Richer model list (provider-grouped) for the picker. Defaults to [] for\n    // back-compat: callers that only read allowedModels are unaffected.\n    models: z.array(ClientModel).default([]),\n    defaultReasoningEffort: ReasoningEffort,\n    allowedReasoningEfforts: z.array(ReasoningEffort).min(1),\n    mcpServers: z\n      .array(\n        z.object({\n          id: z.string(),\n          name: z.string(),\n        }),\n      )\n      .default([]),\n    fileUploads: z.object({\n      enabled: z.boolean(),\n      maxSizeBytes: z.number().int().positive(),\n    }),\n    productAccessMode: ProductAccessMode,\n    auth: ClientAuthConfig.default({ mode: \"none\" }),\n    // Server-wide hint: does this deployment support Channel-A structured services\n    // at all (P4.4). Per-session availability is negotiated on /stream-capabilities\n    // (it depends on the session's pinned backend); this is the coarse on/off the\n    // client uses to decide whether to even attempt the fs/git/terminal panels.\n    structuredServices: z\n      .object({\n        fileSystem: z.boolean(),\n        git: z.boolean(),\n        terminalEvents: z.boolean(),\n      })\n      .default({ fileSystem: false, git: false, terminalEvents: false }),\n  }),\n);\nexport type ClientConfig = z.infer<typeof ClientConfig>;\n\nfunction base64UrlEncode(value: string): string {\n  return Buffer.from(value, \"utf8\").toString(\"base64url\");\n}\n\nfunction base64UrlDecode(value: string): string {\n  return Buffer.from(value, \"base64url\").toString(\"utf8\");\n}\n\nasync function hmacSha256Base64Url(secret: string, value: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    new TextEncoder().encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const signature = await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(value));\n  return Buffer.from(signature).toString(\"base64url\");\n}\n\nfunction constantTimeEqual(actual: string, expected: string): boolean {\n  const actualBytes = new TextEncoder().encode(actual);\n  const expectedBytes = new TextEncoder().encode(expected);\n  if (actualBytes.length !== expectedBytes.length) {\n    return false;\n  }\n  let diff = 0;\n  for (let index = 0; index < actualBytes.length; index += 1) {\n    diff |= actualBytes[index]! ^ expectedBytes[index]!;\n  }\n  return diff === 0;\n}\n\nexport type HealthResponse = {\n  service: string;\n  variableSet: string;\n  ok: boolean;\n};\n\n/**\n * Per-workspace model/provider availability policy (see @opengeni/db\n * workspace_model_policies). NULL fields = unrestricted; a non-null\n * allowedProviders is a strict allowlist over RESOLVED provider identities\n * (the built-in OpenAI/Azure client's id — \"openai\"/\"azure\" — including the\n * legacy null-resolution fallback; \"codex-subscription\" for the ChatGPT/Codex\n * overlay; registry providers by their declared ids); a non-null allowedModels\n * is an additional exact-model-id allowlist. Pure and shared so the API edge\n * (422) and the worker's authoritative post-resolution gate (fail-loud\n * turn.failed, never a silent remap) can never disagree on semantics.\n */\nexport type WorkspaceModelPolicyContract = {\n  allowedProviders: string[] | null;\n  allowedModels: string[] | null;\n};\n\nexport type WorkspaceModelPolicyVerdict =\n  | { allowed: true }\n  | { allowed: false; reason: \"provider\" | \"model\" };\n\nexport function evaluateWorkspaceModelPolicy(\n  policy: WorkspaceModelPolicyContract | null | undefined,\n  candidate: { providerId: string; modelId: string },\n): WorkspaceModelPolicyVerdict {\n  if (!policy) {\n    return { allowed: true };\n  }\n  if (policy.allowedProviders !== null && !policy.allowedProviders.includes(candidate.providerId)) {\n    return { allowed: false, reason: \"provider\" };\n  }\n  if (policy.allowedModels !== null && !policy.allowedModels.includes(candidate.modelId)) {\n    return { allowed: false, reason: \"model\" };\n  }\n  return { allowed: true };\n}\n\nexport * from \"./codex-fleet-policy\";\nexport * from \"./secret-redaction\";\nexport * from \"./workspace-instruction-policies\";\n","import { z } from \"zod\";\n\n/** Hard server-side ceiling for one retained-output response body. */\nexport const RETAINED_OUTPUT_MAX_PAGE_BYTES = 1024 * 1024;\n/** Default first page when the client does not send a Range header. */\nexport const RETAINED_OUTPUT_DEFAULT_PAGE_BYTES = 256 * 1024;\n/** Receipts are timeline references, never an extensible metadata bag. */\nexport const RETAINED_OUTPUT_RECEIPT_MAX_BYTES = 2 * 1024;\n\nconst encoder = new TextEncoder();\nconst LOWERCASE_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;\nconst LOWERCASE_SHA256 = /^[0-9a-f]{64}$/;\nconst CANONICAL_MEDIA_TYPE = /^[a-z0-9][a-z0-9!#$&^_.+-]{0,62}\\/[a-z0-9][a-z0-9!#$&^_.+-]{0,62}$/;\nconst RETRIEVAL_PATH = /^\\/v1\\/workspaces\\/([0-9a-f-]+)\\/artifacts\\/([0-9a-f-]+)\\/content$/;\n\nexport const RetainedOutputKind = z.enum([\n  \"tool_result\",\n  \"assistant_completion\",\n  \"internal_update\",\n  \"event_media\",\n  \"file\",\n]);\nexport type RetainedOutputKind = z.infer<typeof RetainedOutputKind>;\n\nexport const RetainedOutputUnavailableReason = z.enum([\n  \"not_retained\",\n  \"pending\",\n  \"failed\",\n  \"expired\",\n  \"deleted\",\n  \"missing_storage\",\n  \"storage_write_failed\",\n  \"unsupported\",\n]);\nexport type RetainedOutputUnavailableReason = z.infer<typeof RetainedOutputUnavailableReason>;\n\nconst RetainedOutputUnavailableEvidenceSchema = z\n  .object({\n    available: z.literal(false),\n    reason: RetainedOutputUnavailableReason,\n  })\n  .strict();\n\nexport const RetainedArtifactReferenceSchema = z\n  .object({\n    available: z.literal(true),\n    artifactId: z.string().regex(LOWERCASE_UUID),\n    kind: RetainedOutputKind,\n    contentType: z.string().max(127).regex(CANONICAL_MEDIA_TYPE),\n    originalBytes: z.number().int().nonnegative().safe(),\n    sha256: z.string().regex(LOWERCASE_SHA256),\n    retainedAt: z.string().datetime({ offset: true }),\n    retention: z\n      .object({\n        policy: z.literal(\"workspace_file\"),\n        expiresAt: z.null(),\n      })\n      .strict(),\n    retrieval: z\n      .object({\n        method: z.literal(\"GET\"),\n        path: z.string().max(256),\n        acceptRanges: z.literal(\"bytes\"),\n        maxRangeBytes: z.number().int().positive().max(RETAINED_OUTPUT_MAX_PAGE_BYTES),\n      })\n      .strict(),\n  })\n  .strict()\n  .superRefine((value, ctx) => {\n    const match = RETRIEVAL_PATH.exec(value.retrieval.path);\n    if (!match || !LOWERCASE_UUID.test(match[1] ?? \"\") || match[2] !== value.artifactId) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"retrieval\", \"path\"],\n        message: \"retrieval path must be a workspace API content path for this artifact\",\n      });\n    }\n\n    if (encoder.encode(JSON.stringify(value)).byteLength > RETAINED_OUTPUT_RECEIPT_MAX_BYTES) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: \"retained-output receipt exceeds its byte envelope\",\n      });\n    }\n  });\n\n/**\n * Canonical evidence fact carried by bounded audit/NATS/SSE/UI previews.\n *\n * The available variant is intentionally provider-neutral and closed: no bucket,\n * object key, signed URL, arbitrary metadata, or producer-controlled labels can\n * cross this boundary.\n */\nexport const RetainedOutputEvidenceSchema = z.discriminatedUnion(\"available\", [\n  RetainedOutputUnavailableEvidenceSchema,\n  RetainedArtifactReferenceSchema,\n]);\nexport type RetainedOutputEvidence = z.infer<typeof RetainedOutputEvidenceSchema>;\nexport type RetainedArtifactReference = z.infer<typeof RetainedArtifactReferenceSchema>;\n/** @deprecated use RetainedArtifactReference. */\nexport type RetainedOutputAvailableEvidence = RetainedArtifactReference;\n\nexport const RetainedArtifactUnavailableSchema = z\n  .object({\n    available: z.literal(false),\n    artifactId: z.string().regex(LOWERCASE_UUID),\n    reason: RetainedOutputUnavailableReason,\n  })\n  .strict();\nexport type RetainedArtifactUnavailable = z.infer<typeof RetainedArtifactUnavailableSchema>;\n\n/** Authenticated metadata result for one opaque workspace file identity. */\nexport const RetainedArtifactMetadataSchema = z.union([\n  RetainedArtifactReferenceSchema,\n  RetainedArtifactUnavailableSchema,\n]);\nexport type RetainedArtifactMetadata = z.infer<typeof RetainedArtifactMetadataSchema>;\n\nexport type RetainedArtifactFileInput = {\n  id: string;\n  workspaceId: string;\n  status: string;\n  contentType: string;\n  sizeBytes: number;\n  sha256: string | null;\n  updatedAt: string;\n};\n\n/**\n * Convert a ready, integrity-addressed workspace file into the only available\n * retained-output receipt shape. Invalid, pending, or checksum-less files fail\n * closed instead of implying that full evidence is retrievable.\n */\nexport function retainedArtifactReferenceFromFile(\n  file: RetainedArtifactFileInput,\n  kind: RetainedOutputKind = \"file\",\n): RetainedArtifactReference | null {\n  if (file.status !== \"ready\" || !file.sha256) return null;\n  const value = {\n    available: true as const,\n    artifactId: file.id,\n    kind,\n    contentType: canonicalRetainedContentType(file.contentType),\n    originalBytes: file.sizeBytes,\n    sha256: file.sha256,\n    retainedAt: file.updatedAt,\n    retention: {\n      policy: \"workspace_file\" as const,\n      expiresAt: null,\n    },\n    retrieval: {\n      method: \"GET\" as const,\n      path: `/v1/workspaces/${file.workspaceId}/artifacts/${file.id}/content`,\n      acceptRanges: \"bytes\" as const,\n      maxRangeBytes: RETAINED_OUTPUT_MAX_PAGE_BYTES,\n    },\n  };\n  const parsed = RetainedArtifactReferenceSchema.safeParse(value);\n  return parsed.success ? parsed.data : null;\n}\n\nfunction canonicalRetainedContentType(value: string): string {\n  const mediaType = value.split(\";\", 1)[0]?.trim().toLowerCase() ?? \"\";\n  return CANONICAL_MEDIA_TYPE.test(mediaType) ? mediaType : \"application/octet-stream\";\n}\n\n/** Parse and clone a trusted server receipt; invalid/untrusted data fails closed. */\nexport function validateRetainedOutputEvidence(value: unknown): RetainedOutputEvidence | null {\n  const parsed = RetainedOutputEvidenceSchema.safeParse(value);\n  return parsed.success ? parsed.data : null;\n}\n\nexport function retainedOutputUnavailable(\n  reason: RetainedOutputUnavailableReason = \"not_retained\",\n): RetainedOutputEvidence {\n  return { available: false, reason };\n}\n\nexport type RetainedOutputResolvedRange = {\n  kind: \"range\";\n  start: number;\n  end: number;\n  length: number;\n  totalBytes: number;\n  status: 200 | 206;\n  contentRange: string | null;\n  acceptRanges: \"bytes\";\n};\n\nexport type RetainedOutputRangeResolution =\n  | RetainedOutputResolvedRange\n  | {\n      kind: \"empty\";\n      length: 0;\n      totalBytes: 0;\n      status: 200;\n      contentRange: null;\n      acceptRanges: \"bytes\";\n    }\n  | {\n      kind: \"invalid\";\n      reason: \"malformed\" | \"multipart_not_supported\" | \"numeric_overflow\" | \"range_too_large\";\n      maxPageBytes: number;\n    }\n  | {\n      kind: \"unsatisfiable\";\n      reason: \"empty_artifact\" | \"start_out_of_bounds\" | \"end_before_start\" | \"zero_suffix\";\n      totalBytes: number;\n      contentRange: string;\n    };\n\n/**\n * Resolve one RFC-style bytes range without ever licensing a response larger\n * than `maxPageBytes`. Multipart ranges and oversized explicit/suffix requests\n * fail closed. An omitted or open-ended range becomes one resumable bounded page.\n */\nexport function resolveRetainedOutputRange(\n  rangeHeader: string | null | undefined,\n  totalBytes: number,\n  maxPageBytes = RETAINED_OUTPUT_DEFAULT_PAGE_BYTES,\n): RetainedOutputRangeResolution {\n  assertRangeInputs(totalBytes, maxPageBytes);\n\n  if (rangeHeader === null || rangeHeader === undefined || rangeHeader === \"\") {\n    if (totalBytes === 0) {\n      return {\n        kind: \"empty\",\n        length: 0,\n        totalBytes: 0,\n        status: 200,\n        contentRange: null,\n        acceptRanges: \"bytes\",\n      };\n    }\n    const end = Math.min(totalBytes - 1, maxPageBytes - 1);\n    const partial = end + 1 < totalBytes;\n    return resolvedRange(0, end, totalBytes, partial ? 206 : 200);\n  }\n\n  if (rangeHeader.length > 128 || /[^\\x20-\\x7e]/.test(rangeHeader)) {\n    return invalidRange(\"malformed\", maxPageBytes);\n  }\n  if (rangeHeader.includes(\",\")) {\n    return invalidRange(\"multipart_not_supported\", maxPageBytes);\n  }\n  const match = /^bytes=(\\d*)-(\\d*)$/.exec(rangeHeader);\n  if (!match || (!match[1] && !match[2])) {\n    return invalidRange(\"malformed\", maxPageBytes);\n  }\n\n  const first = parseRangeInteger(match[1]);\n  const second = parseRangeInteger(match[2]);\n  if (first === \"overflow\" || second === \"overflow\") {\n    return invalidRange(\"numeric_overflow\", maxPageBytes);\n  }\n\n  if (first === null) {\n    const suffixLength = second;\n    if (suffixLength === null) return invalidRange(\"malformed\", maxPageBytes);\n    if (suffixLength === 0) return unsatisfiableRange(\"zero_suffix\", totalBytes);\n    if (suffixLength > maxPageBytes) return invalidRange(\"range_too_large\", maxPageBytes);\n    if (totalBytes === 0) return unsatisfiableRange(\"empty_artifact\", totalBytes);\n    const length = Math.min(suffixLength, totalBytes);\n    return resolvedRange(totalBytes - length, totalBytes - 1, totalBytes, 206);\n  }\n\n  if (totalBytes === 0) return unsatisfiableRange(\"empty_artifact\", totalBytes);\n  if (first >= totalBytes) return unsatisfiableRange(\"start_out_of_bounds\", totalBytes);\n\n  if (second === null) {\n    const end = Math.min(totalBytes - 1, first + maxPageBytes - 1);\n    return resolvedRange(first, end, totalBytes, 206);\n  }\n  if (second < first) return unsatisfiableRange(\"end_before_start\", totalBytes);\n  if (second - first >= maxPageBytes) {\n    return invalidRange(\"range_too_large\", maxPageBytes);\n  }\n  return resolvedRange(first, Math.min(second, totalBytes - 1), totalBytes, 206);\n}\n\nfunction assertRangeInputs(totalBytes: number, maxPageBytes: number): void {\n  if (!Number.isSafeInteger(totalBytes) || totalBytes < 0) {\n    throw new RangeError(\"totalBytes must be a nonnegative safe integer\");\n  }\n  if (\n    !Number.isSafeInteger(maxPageBytes) ||\n    maxPageBytes <= 0 ||\n    maxPageBytes > RETAINED_OUTPUT_MAX_PAGE_BYTES\n  ) {\n    throw new RangeError(\n      `maxPageBytes must be an integer between 1 and ${RETAINED_OUTPUT_MAX_PAGE_BYTES}`,\n    );\n  }\n}\n\nfunction parseRangeInteger(value: string | undefined): number | null | \"overflow\" {\n  if (!value) return null;\n  // Avoid both precision loss and work proportional to an adversarial digit run.\n  if (value.length > 16) return \"overflow\";\n  const parsed = Number(value);\n  return Number.isSafeInteger(parsed) ? parsed : \"overflow\";\n}\n\nfunction resolvedRange(\n  start: number,\n  end: number,\n  totalBytes: number,\n  status: 200 | 206,\n): RetainedOutputResolvedRange {\n  return {\n    kind: \"range\",\n    start,\n    end,\n    length: end - start + 1,\n    totalBytes,\n    status,\n    contentRange: status === 206 ? `bytes ${start}-${end}/${totalBytes}` : null,\n    acceptRanges: \"bytes\",\n  };\n}\n\nfunction invalidRange(\n  reason: Extract<RetainedOutputRangeResolution, { kind: \"invalid\" }>[\"reason\"],\n  maxPageBytes: number,\n): RetainedOutputRangeResolution {\n  return { kind: \"invalid\", reason, maxPageBytes };\n}\n\nfunction unsatisfiableRange(\n  reason: Extract<RetainedOutputRangeResolution, { kind: \"unsatisfiable\" }>[\"reason\"],\n  totalBytes: number,\n): RetainedOutputRangeResolution {\n  return {\n    kind: \"unsatisfiable\",\n    reason,\n    totalBytes,\n    contentRange: `bytes */${totalBytes}`,\n  };\n}\n","/**\n * Canonical bounded representation for `session_events.payload`.\n *\n * Session events are the lossy human/audit projection, not model memory and not\n * an evidence blob store. This helper keeps that projection useful while making\n * the loss explicit. It deliberately has no server-only dependency so the DB,\n * realtime transports, SDK/React, and tests can share one wire contract.\n */\n\nimport {\n  retainedOutputUnavailable,\n  validateRetainedOutputEvidence,\n  type RetainedOutputEvidence,\n} from \"./retained-output\";\n\nexport const SESSION_EVENT_PAYLOAD_MAX_BYTES = 64 * 1024;\n\nconst TARGET_PAYLOAD_BYTES = 60 * 1024;\nconst DEFAULT_STRING_BYTES = 8 * 1024;\nconst RETRY_STRING_BYTES = 1024;\nconst DEFAULT_ARRAY_ENTRIES = 40;\nconst RETRY_ARRAY_ENTRIES = 12;\nconst DEFAULT_OBJECT_FIELDS = 80;\nconst RETRY_OBJECT_FIELDS = 32;\nconst MAX_PREVIEW_DEPTH = 12;\nconst MAX_PREVIEW_NODES = 512;\nconst MAX_MEASUREMENT_NODES = 2_048;\nconst MAX_MEASUREMENT_DEPTH = 64;\nconst MAX_DETAIL_RECORDS = 24;\nconst APPROX_BYTES_PER_TOKEN = 4;\nconst encoder = new TextEncoder();\n\nconst IDENTITY_FIELDS = new Set([\n  \"id\",\n  \"callId\",\n  \"call_id\",\n  \"name\",\n  \"toolName\",\n  \"type\",\n  \"status\",\n  \"code\",\n  \"isError\",\n  \"stream\",\n  \"commandId\",\n  \"sequence\",\n]);\n\nexport type SessionEventBoundarySurface =\n  | \"durable_audit\"\n  | \"database_guard\"\n  | \"database_read_projection\"\n  | \"http_projection\"\n  | \"nats_legacy_guard\"\n  | \"sse_legacy_guard\"\n  | \"browser_legacy_guard\";\n\nexport type SessionEventPayloadTruncation = {\n  truncated: true;\n  surface: SessionEventBoundarySurface;\n  reason:\n    | \"payload_bytes_exceeded\"\n    | \"payload_not_serializable\"\n    | \"payload_measurement_bounded\"\n    | \"inline_media_not_retained\"\n    | \"database_guard\";\n  originalBytes: number | null;\n  deliveredBytes: number;\n  omittedBytes: number | null;\n  estimatedOriginalTokens: number | null;\n  estimatedDeliveredTokens: number;\n  fullEvidence: RetainedOutputEvidence;\n  details: Array<{\n    path: string;\n    kind:\n      | \"string\"\n      | \"array\"\n      | \"object\"\n      | \"depth\"\n      | \"budget\"\n      | \"media\"\n      | \"binary\"\n      | \"unserializable\";\n    originalBytes?: number;\n    deliveredBytes?: number;\n    omittedEntries?: number | null;\n    mediaType?: string;\n  }>;\n};\n\nexport type BoundSessionEventPayloadOptions = {\n  surface?: SessionEventBoundarySurface;\n  maxBytes?: number;\n  /**\n   * Separately trusted durable receipt. Producer payload fields never populate\n   * this slot; invalid values fail closed to not_retained.\n   */\n  fullEvidence?: unknown;\n};\n\nexport type SessionEventJsonMeasurement =\n  | { bytes: number; reason: null }\n  | {\n      bytes: null;\n      reason: \"payload_not_serializable\" | \"payload_measurement_bounded\";\n    };\n\nexport type SessionEventMediaPreview = {\n  type: \"media_preview\";\n  mediaType: string;\n  inlineBytes: number | null;\n  fullOutputAvailable: false;\n  preview: string;\n};\n\ntype PreviewState = {\n  changed: boolean;\n  sawMedia: boolean;\n  details: SessionEventPayloadTruncation[\"details\"];\n  stringBytes: number;\n  arrayEntries: number;\n  objectFields: number;\n  remainingNodes: number;\n};\n\n/** UTF-8 bytes used by the JSON wire/storage representation. */\nexport function sessionEventJsonBytes(value: unknown): number {\n  return encoder.encode(stringifyForBoundary(value)).byteLength;\n}\n\n/**\n * Inspect a prospective event value without invoking accessors, custom\n * serializers, or allocating its complete JSON representation. A null byte\n * count is explicit: the traversal stopped at the global work/depth boundary\n * or found serialization behavior that must first be normalized.\n */\nexport function measureSessionEventJson(value: unknown): SessionEventJsonMeasurement {\n  return measureJsonBytes(value);\n}\n\n/** The same deliberately coarse bytes/4 token estimate used by Codex parity code. */\nexport function approximateSessionEventTokens(bytes: number): number {\n  return Math.ceil(Math.max(0, bytes) / APPROX_BYTES_PER_TOKEN);\n}\n\n/** Truthful audit fact for inline media whose source bytes are not durably retained. */\nexport function sessionEventMediaPreview(\n  mediaType: string,\n  inlineBytes: number | null,\n): SessionEventMediaPreview {\n  return {\n    type: \"media_preview\",\n    mediaType: mediaType || \"application/octet-stream\",\n    inlineBytes:\n      inlineBytes === null\n        ? null\n        : Math.max(0, Math.floor(Number.isFinite(inlineBytes) ? inlineBytes : 0)),\n    fullOutputAvailable: false,\n    preview: \"Inline media omitted from the audit timeline; source bytes were not retained.\",\n  };\n}\n\n/** Parse a base64 data URL into a compact audit fact without decoding/copying its bytes. */\nexport function sessionEventMediaPreviewFromDataUrl(\n  value: string,\n): SessionEventMediaPreview | null {\n  const match = /^data:([^;,]+)(?:;[^,]*)?;base64,/i.exec(value);\n  if (!match) return null;\n  const encodedLength = Math.max(0, value.length - match[0].length);\n  const padding = value.endsWith(\"==\") ? 2 : value.endsWith(\"=\") ? 1 : 0;\n  return sessionEventMediaPreview(\n    match[1] ?? \"application/octet-stream\",\n    Math.max(0, Math.floor((encodedLength * 3) / 4) - padding),\n  );\n}\n\n/** Read explicit truncation metadata from a bounded object payload. */\nexport function sessionEventPayloadTruncation(\n  payload: unknown,\n): SessionEventPayloadTruncation | null {\n  if (!isPlainRecord(payload)) return null;\n  const value = payload.truncation;\n  if (!isPlainRecord(value) || value.truncated !== true) return null;\n  return value as SessionEventPayloadTruncation;\n}\n\n/**\n * Return a byte-bounded audit payload. Unchanged ordinary payloads retain their\n * reference. Oversized strings/containers get deterministic head+tail previews;\n * inline images/binary values become metadata because `session_events` does not\n * durably retain their source bytes as independently retrievable evidence.\n */\nexport function boundSessionEventPayload<T>(\n  payload: T,\n  options: BoundSessionEventPayloadOptions = {},\n): T {\n  const maxBytes = Math.max(1024, Math.floor(options.maxBytes ?? SESSION_EVENT_PAYLOAD_MAX_BYTES));\n  const surface = options.surface ?? \"durable_audit\";\n  const fullEvidence =\n    validateRetainedOutputEvidence(options.fullEvidence) ?? retainedOutputUnavailable();\n  const originalMeasurement = measureJsonBytes(payload);\n  const originalBytes = originalMeasurement.bytes;\n\n  let state = previewState(DEFAULT_STRING_BYTES, DEFAULT_ARRAY_ENTRIES, DEFAULT_OBJECT_FIELDS);\n  let preview = previewValue(payload, state, \"$\", 0);\n  if (!state.changed && originalBytes !== null && originalBytes <= maxBytes) {\n    return payload;\n  }\n\n  let reason = payloadTruncationReason(originalMeasurement, state);\n  let bounded = attachTruncation(\n    preview,\n    boundaryMetadata(surface, reason, originalBytes, state, fullEvidence),\n  );\n\n  if (sessionEventJsonBytes(bounded) > Math.min(maxBytes, TARGET_PAYLOAD_BYTES)) {\n    state = previewState(RETRY_STRING_BYTES, RETRY_ARRAY_ENTRIES, RETRY_OBJECT_FIELDS);\n    preview = previewValue(payload, state, \"$\", 0);\n    reason = payloadTruncationReason(originalMeasurement, state);\n    bounded = attachTruncation(\n      preview,\n      boundaryMetadata(surface, reason, originalBytes, state, fullEvidence),\n    );\n  }\n\n  if (sessionEventJsonBytes(bounded) > maxBytes) {\n    const identity = identityPreview(payload);\n    state.changed = true;\n    recordDetail(state, {\n      path: \"$\",\n      kind: \"object\",\n      ...(originalBytes === null ? {} : { originalBytes }),\n    });\n    bounded = attachTruncation(\n      {\n        ...identity,\n        preview: \"[event payload omitted: bounded audit preview exceeded the storage envelope]\",\n      },\n      boundaryMetadata(surface, reason, originalBytes, state, fullEvidence),\n    );\n  }\n\n  settleDeliveredSizes(bounded, maxBytes);\n  return bounded as T;\n}\n\nfunction previewState(\n  stringBytes: number,\n  arrayEntries: number,\n  objectFields: number,\n): PreviewState {\n  return {\n    changed: false,\n    sawMedia: false,\n    details: [],\n    stringBytes,\n    arrayEntries,\n    objectFields,\n    remainingNodes: MAX_PREVIEW_NODES,\n  };\n}\n\nfunction payloadTruncationReason(\n  measurement: JsonMeasurement,\n  state: PreviewState,\n): SessionEventPayloadTruncation[\"reason\"] {\n  if (state.sawMedia) return \"inline_media_not_retained\";\n  return measurement.bytes === null ? measurement.reason : \"payload_bytes_exceeded\";\n}\n\nfunction previewValue(value: unknown, state: PreviewState, path: string, depth: number): unknown {\n  if (state.remainingNodes <= 0) {\n    state.changed = true;\n    recordDetail(state, { path, kind: \"budget\" });\n    return \"[nested value omitted at audit preview traversal boundary]\";\n  }\n  state.remainingNodes -= 1;\n  if (typeof value === \"string\") {\n    const media = inlineMediaFact(value);\n    if (media) {\n      state.changed = true;\n      state.sawMedia = true;\n      recordDetail(state, {\n        path,\n        kind: \"media\",\n        originalBytes: utf8Bytes(value),\n        deliveredBytes: sessionEventJsonBytes(media),\n        mediaType: media.mediaType,\n      });\n      return media;\n    }\n    const originalBytes = utf8Bytes(value);\n    if (originalBytes <= state.stringBytes) return value;\n    state.changed = true;\n    const delivered = truncateUtf8Middle(value, state.stringBytes, originalBytes);\n    recordDetail(state, {\n      path,\n      kind: \"string\",\n      originalBytes,\n      deliveredBytes: utf8Bytes(delivered),\n    });\n    return delivered;\n  }\n  if (typeof value === \"bigint\" || typeof value === \"function\" || typeof value === \"symbol\") {\n    state.changed = true;\n    recordDetail(state, { path, kind: \"unserializable\" });\n    return `[${typeof value} value omitted at audit serialization boundary]`;\n  }\n  if (value === null || typeof value !== \"object\") return value;\n\n  const binary = binaryFact(value);\n  if (binary) {\n    state.changed = true;\n    recordDetail(state, {\n      path,\n      kind: \"binary\",\n      originalBytes: binary.originalBytes,\n      deliveredBytes: sessionEventJsonBytes(binary.preview),\n    });\n    return binary.preview;\n  }\n\n  if (depth >= MAX_PREVIEW_DEPTH) {\n    state.changed = true;\n    recordDetail(state, { path, kind: \"depth\" });\n    return \"[nested value omitted at audit preview depth boundary]\";\n  }\n\n  if (Array.isArray(value)) {\n    const keep = Math.max(2, state.arrayEntries);\n    if (value.length <= keep) {\n      return Array.from({ length: value.length }, (_, index) =>\n        previewArrayEntry(value, index, state, path, depth),\n      );\n    }\n    state.changed = true;\n    const head = Math.ceil(keep / 2);\n    const tail = Math.floor(keep / 2);\n    const omitted = value.length - head - tail;\n    recordDetail(state, { path, kind: \"array\", omittedEntries: omitted });\n    return [\n      ...Array.from({ length: head }, (_, index) =>\n        previewArrayEntry(value, index, state, path, depth),\n      ),\n      { omittedEntries: omitted, preview: \"[middle array entries omitted]\" },\n      ...Array.from({ length: tail }, (_, index) =>\n        previewArrayEntry(value, value.length - tail + index, state, path, depth),\n      ),\n    ];\n  }\n\n  if (value instanceof Date) {\n    if (!hasCanonicalDateSerialization(value)) {\n      state.changed = true;\n      recordDetail(state, { path, kind: \"unserializable\" });\n      return \"[Date value with custom serialization omitted at audit boundary]\";\n    }\n    try {\n      const epoch = Date.prototype.getTime.call(value);\n      return Number.isFinite(epoch) ? Date.prototype.toISOString.call(value) : null;\n    } catch {\n      state.changed = true;\n      recordDetail(state, { path, kind: \"unserializable\" });\n      return \"[Date value omitted at audit serialization boundary]\";\n    }\n  }\n\n  const record = value as Record<string, unknown>;\n  const { entries, omitted, accessorKeys } = selectObjectEntries(record, state.objectFields);\n  for (const key of accessorKeys) {\n    state.changed = true;\n    recordDetail(state, {\n      path: `${path}.${key}`,\n      kind: \"unserializable\",\n    });\n  }\n  if (omitted) {\n    state.changed = true;\n    recordDetail(state, {\n      path,\n      kind: \"object\",\n      // Counting every remaining field would defeat the traversal bound. `null`\n      // is deliberate: at least one field was omitted, but its exact count is\n      // unknown because the source was not fully enumerated.\n      omittedEntries: null,\n    });\n  }\n  const out: Record<string, unknown> = {};\n  for (const [key, entry] of entries) {\n    out[key] = previewValue(entry, state, `${path}.${key}`, depth + 1);\n  }\n  if (omitted) {\n    out.omittedFields = \"additional fields omitted; exact count not measured\";\n  }\n  return out;\n}\n\nfunction previewArrayEntry(\n  value: unknown[],\n  index: number,\n  state: PreviewState,\n  path: string,\n  depth: number,\n): unknown {\n  let descriptor: PropertyDescriptor | undefined;\n  try {\n    descriptor = Object.getOwnPropertyDescriptor(value, String(index));\n  } catch {\n    state.changed = true;\n    recordDetail(state, { path: `${path}[${index}]`, kind: \"unserializable\" });\n    return \"[array element omitted at audit serialization boundary]\";\n  }\n  if (descriptor && !(\"value\" in descriptor)) {\n    state.changed = true;\n    recordDetail(state, { path: `${path}[${index}]`, kind: \"unserializable\" });\n    return \"[array accessor value omitted at audit serialization boundary]\";\n  }\n  return previewValue(\n    descriptor && \"value\" in descriptor ? descriptor.value : undefined,\n    state,\n    `${path}[${index}]`,\n    depth + 1,\n  );\n}\n\nfunction selectObjectEntries(\n  record: Record<string, unknown>,\n  maxFields: number,\n): {\n  entries: Array<[string, unknown]>;\n  omitted: boolean;\n  accessorKeys: string[];\n} {\n  const entries: Array<[string, unknown]> = [];\n  const selected = new Set<string>();\n  const accessorKeys: string[] = [];\n  const select = (key: string): boolean => {\n    const descriptor = Object.getOwnPropertyDescriptor(record, key);\n    if (!descriptor?.enumerable) return false;\n    selected.add(key);\n    if (\"value\" in descriptor) {\n      entries.push([key, descriptor.value]);\n    } else {\n      entries.push([key, \"[accessor value omitted at audit serialization boundary]\"]);\n      accessorKeys.push(key);\n    }\n    return true;\n  };\n  try {\n    for (const key of IDENTITY_FIELDS) {\n      if (entries.length >= maxFields) break;\n      select(key);\n    }\n    for (const key in record) {\n      if (!Object.prototype.hasOwnProperty.call(record, key) || selected.has(key)) continue;\n      if (entries.length >= maxFields) {\n        return { entries, omitted: true, accessorKeys };\n      }\n      select(key);\n    }\n  } catch {\n    return { entries, omitted: true, accessorKeys };\n  }\n  return { entries, omitted: false, accessorKeys };\n}\n\nfunction attachTruncation(\n  preview: unknown,\n  truncation: SessionEventPayloadTruncation,\n): Record<string, unknown> {\n  if (isPlainRecord(preview)) {\n    // `truncation` is reserved boundary metadata. A producer-supplied value is\n    // intentionally replaced when the boundary actually omits content.\n    return { ...preview, truncation };\n  }\n  return { value: preview, truncation };\n}\n\nfunction boundaryMetadata(\n  surface: SessionEventBoundarySurface,\n  reason: SessionEventPayloadTruncation[\"reason\"],\n  originalBytes: number | null,\n  state: PreviewState,\n  fullEvidence: RetainedOutputEvidence,\n): SessionEventPayloadTruncation {\n  return {\n    truncated: true,\n    surface,\n    reason,\n    originalBytes,\n    deliveredBytes: 0,\n    omittedBytes: originalBytes,\n    estimatedOriginalTokens:\n      originalBytes === null ? null : approximateSessionEventTokens(originalBytes),\n    estimatedDeliveredTokens: 0,\n    fullEvidence,\n    details: state.details,\n  };\n}\n\nfunction settleDeliveredSizes(payload: Record<string, unknown>, maxBytes: number): void {\n  const truncation = payload.truncation as SessionEventPayloadTruncation;\n  convergeDeliveredSizes(payload, truncation);\n  // This should only be reachable when a caller supplies an unusually tiny\n  // custom maxBytes. Preserve explicit metadata over an accidental overshoot.\n  if (sessionEventJsonBytes(payload) > maxBytes) {\n    payload.preview = \"[event payload omitted at audit byte boundary]\";\n    for (const key of Object.keys(payload)) {\n      if (key !== \"preview\" && key !== \"truncation\" && IDENTITY_FIELDS.has(key) === false) {\n        delete payload[key];\n      }\n    }\n    truncation.details = truncation.details.slice(0, 4);\n    convergeDeliveredSizes(payload, truncation);\n  }\n}\n\nfunction convergeDeliveredSizes(\n  payload: Record<string, unknown>,\n  truncation: SessionEventPayloadTruncation,\n): void {\n  for (let attempt = 0; attempt < 16; attempt += 1) {\n    const deliveredBytes = sessionEventJsonBytes(payload);\n    const omittedBytes =\n      truncation.originalBytes === null\n        ? null\n        : Math.max(0, truncation.originalBytes - deliveredBytes);\n    const estimatedDeliveredTokens = approximateSessionEventTokens(deliveredBytes);\n    if (\n      truncation.deliveredBytes === deliveredBytes &&\n      truncation.omittedBytes === omittedBytes &&\n      truncation.estimatedDeliveredTokens === estimatedDeliveredTokens\n    ) {\n      return;\n    }\n    truncation.deliveredBytes = deliveredBytes;\n    truncation.omittedBytes = omittedBytes;\n    truncation.estimatedDeliveredTokens = estimatedDeliveredTokens;\n  }\n  throw new RangeError(\"Session event byte accounting did not converge\");\n}\n\nfunction recordDetail(\n  state: PreviewState,\n  detail: SessionEventPayloadTruncation[\"details\"][number],\n): void {\n  if (state.details.length < MAX_DETAIL_RECORDS) state.details.push(detail);\n}\n\nfunction identityPreview(value: unknown): Record<string, unknown> {\n  if (!isPlainRecord(value)) return {};\n  const out: Record<string, unknown> = {};\n  for (const key of IDENTITY_FIELDS) {\n    let field: unknown;\n    try {\n      const descriptor = Object.getOwnPropertyDescriptor(value, key);\n      if (!descriptor?.enumerable || !(\"value\" in descriptor)) continue;\n      field = descriptor.value;\n    } catch {\n      continue;\n    }\n    if (typeof field === \"string\") {\n      out[key] = truncateUtf8Middle(field, 256, utf8Bytes(field));\n    } else if (typeof field === \"number\" || typeof field === \"boolean\" || field === null) {\n      out[key] = field;\n    }\n  }\n  return out;\n}\n\nfunction inlineMediaFact(value: string): SessionEventMediaPreview | null {\n  return sessionEventMediaPreviewFromDataUrl(value);\n}\n\nfunction binaryFact(value: object): {\n  originalBytes: number;\n  preview: {\n    type: \"binary_preview\";\n    byteLength: number;\n    fullOutputAvailable: false;\n    preview: string;\n  };\n} | null {\n  if (ArrayBuffer.isView(value)) {\n    return {\n      originalBytes: value.byteLength,\n      preview: {\n        type: \"binary_preview\",\n        byteLength: value.byteLength,\n        fullOutputAvailable: false,\n        preview: \"Inline binary value omitted from the audit timeline; bytes were not retained.\",\n      },\n    };\n  }\n  if (value instanceof ArrayBuffer) {\n    return {\n      originalBytes: value.byteLength,\n      preview: {\n        type: \"binary_preview\",\n        byteLength: value.byteLength,\n        fullOutputAvailable: false,\n        preview: \"Inline binary value omitted from the audit timeline; bytes were not retained.\",\n      },\n    };\n  }\n  return null;\n}\n\nfunction truncateUtf8Middle(\n  value: string,\n  maxBytes: number,\n  knownBytes = utf8Bytes(value),\n): string {\n  if (knownBytes <= maxBytes) return value;\n  let omittedBytes = Math.max(0, knownBytes - maxBytes);\n  for (let attempt = 0; attempt < 4; attempt += 1) {\n    const marker = `…[${omittedBytes} bytes omitted]…`;\n    const contentBudget = Math.max(0, maxBytes - utf8Bytes(marker));\n    if (contentBudget === 0) return marker;\n    const left = utf8Prefix(value, Math.floor(contentBudget / 2));\n    const right = utf8Suffix(value, contentBudget - left.bytes);\n    const exactOmittedBytes = Math.max(0, knownBytes - left.bytes - right.bytes);\n    if (exactOmittedBytes === omittedBytes) {\n      return `${value.slice(0, left.end)}${marker}${value.slice(right.start)}`;\n    }\n    omittedBytes = exactOmittedBytes;\n  }\n\n  const marker = `…[${omittedBytes} bytes omitted]…`;\n  const contentBudget = Math.max(0, maxBytes - utf8Bytes(marker));\n  const left = utf8Prefix(value, Math.floor(contentBudget / 2));\n  const right = utf8Suffix(value, contentBudget - left.bytes);\n  return `${value.slice(0, left.end)}${marker}${value.slice(right.start)}`;\n}\n\nfunction utf8Prefix(value: string, maxBytes: number): { end: number; bytes: number } {\n  let end = 0;\n  let bytes = 0;\n  while (end < value.length) {\n    const unit = utf8UnitAt(value, end);\n    if (bytes + unit.bytes > maxBytes) break;\n    bytes += unit.bytes;\n    end += unit.codeUnits;\n  }\n  return { end, bytes };\n}\n\nfunction utf8Suffix(value: string, maxBytes: number): { start: number; bytes: number } {\n  let start = value.length;\n  let bytes = 0;\n  while (start > 0) {\n    const unit = utf8UnitBefore(value, start);\n    if (bytes + unit.bytes > maxBytes) break;\n    bytes += unit.bytes;\n    start -= unit.codeUnits;\n  }\n  return { start, bytes };\n}\n\nfunction utf8UnitAt(value: string, index: number): { codeUnits: number; bytes: number } {\n  const code = value.charCodeAt(index);\n  if (code <= 0x7f) return { codeUnits: 1, bytes: 1 };\n  if (code <= 0x7ff) return { codeUnits: 1, bytes: 2 };\n  if (code >= 0xd800 && code <= 0xdbff) {\n    const next = index + 1 < value.length ? value.charCodeAt(index + 1) : 0;\n    if (next >= 0xdc00 && next <= 0xdfff) {\n      return { codeUnits: 2, bytes: 4 };\n    }\n  }\n  return { codeUnits: 1, bytes: 3 };\n}\n\nfunction utf8UnitBefore(value: string, end: number): { codeUnits: number; bytes: number } {\n  const code = value.charCodeAt(end - 1);\n  if (code >= 0xdc00 && code <= 0xdfff && end >= 2) {\n    const previous = value.charCodeAt(end - 2);\n    if (previous >= 0xd800 && previous <= 0xdbff) {\n      return { codeUnits: 2, bytes: 4 };\n    }\n  }\n  if (code <= 0x7f) return { codeUnits: 1, bytes: 1 };\n  if (code <= 0x7ff) return { codeUnits: 1, bytes: 2 };\n  return { codeUnits: 1, bytes: 3 };\n}\n\nfunction utf8Bytes(value: string): number {\n  let bytes = 0;\n  for (let index = 0; index < value.length;) {\n    const unit = utf8UnitAt(value, index);\n    bytes += unit.bytes;\n    index += unit.codeUnits;\n  }\n  return bytes;\n}\n\n/**\n * Count the JSON wire bytes without first allocating the complete JSON string.\n * A global node budget prevents an adversarial broad graph from moving the\n * durable 64 KiB bound into an unbounded measurement pass. `null` means exact\n * source size is unknown; callers expose that truth instead of measuring a\n * placeholder or claiming a lower bound is exact.\n */\ntype JsonMeasurement = SessionEventJsonMeasurement;\n\nfunction measureJsonBytes(value: unknown): JsonMeasurement {\n  const state: JsonMeasurementState = {\n    remainingNodes: MAX_MEASUREMENT_NODES,\n    seen: new WeakSet<object>(),\n    failureReason: null,\n  };\n  try {\n    const bytes = measureJsonValue(value, state, \"top\", 0);\n    return bytes === null\n      ? {\n          bytes: null,\n          reason: state.failureReason ?? \"payload_measurement_bounded\",\n        }\n      : { bytes, reason: null };\n  } catch {\n    return { bytes: null, reason: \"payload_measurement_bounded\" };\n  }\n}\n\ntype JsonMeasurementState = {\n  remainingNodes: number;\n  seen: WeakSet<object>;\n  failureReason: \"payload_not_serializable\" | \"payload_measurement_bounded\" | null;\n};\n\nfunction measureJsonValue(\n  value: unknown,\n  state: JsonMeasurementState,\n  position: \"top\" | \"array\" | \"object\",\n  depth: number,\n): number | null {\n  if (state.remainingNodes <= 0 || depth > MAX_MEASUREMENT_DEPTH) {\n    return failJsonMeasurement(state, \"payload_measurement_bounded\");\n  }\n  state.remainingNodes -= 1;\n  if (value === null) return 4;\n  if (typeof value === \"string\") return jsonStringBytes(value);\n  if (typeof value === \"boolean\") return value ? 4 : 5;\n  if (typeof value === \"number\") {\n    const serialized = JSON.stringify(value);\n    return serialized === undefined ? null : serialized.length;\n  }\n  if (typeof value === \"undefined\" || typeof value === \"function\" || typeof value === \"symbol\") {\n    return position === \"array\" ? 4 : failJsonMeasurement(state, \"payload_not_serializable\");\n  }\n  if (typeof value === \"bigint\") {\n    return failJsonMeasurement(state, \"payload_not_serializable\");\n  }\n  if (typeof value !== \"object\") {\n    return failJsonMeasurement(state, \"payload_not_serializable\");\n  }\n  if (value instanceof Date) {\n    if (!hasCanonicalDateSerialization(value)) {\n      return failJsonMeasurement(state, \"payload_measurement_bounded\");\n    }\n    try {\n      const epoch = Date.prototype.getTime.call(value);\n      return Number.isFinite(epoch) ? jsonStringBytes(Date.prototype.toISOString.call(value)) : 4;\n    } catch {\n      return failJsonMeasurement(state, \"payload_not_serializable\");\n    }\n  }\n  if (ArrayBuffer.isView(value) || value instanceof ArrayBuffer) {\n    return failJsonMeasurement(state, \"payload_measurement_bounded\");\n  }\n  if (state.seen.has(value)) {\n    return failJsonMeasurement(state, \"payload_not_serializable\");\n  }\n  state.seen.add(value);\n  try {\n    if (Array.isArray(value)) {\n      if (Object.getPrototypeOf(value) !== Array.prototype) {\n        return failJsonMeasurement(state, \"payload_measurement_bounded\");\n      }\n      const toJson = Object.getOwnPropertyDescriptor(value, \"toJSON\");\n      if (toJson && (\"get\" in toJson || typeof toJson.value === \"function\")) {\n        return failJsonMeasurement(state, \"payload_measurement_bounded\");\n      }\n      if (value.length > state.remainingNodes) {\n        return failJsonMeasurement(state, \"payload_measurement_bounded\");\n      }\n      let bytes = 2;\n      for (let index = 0; index < value.length; index += 1) {\n        if (index > 0) bytes += 1;\n        const descriptor = Object.getOwnPropertyDescriptor(value, String(index));\n        if (descriptor && !(\"value\" in descriptor)) {\n          return failJsonMeasurement(state, \"payload_measurement_bounded\");\n        }\n        const entry = descriptor && \"value\" in descriptor ? descriptor.value : undefined;\n        const measured = measureJsonValue(entry, state, \"array\", depth + 1);\n        if (measured === null) return null;\n        bytes += measured;\n      }\n      return bytes;\n    }\n\n    const prototype = Object.getPrototypeOf(value);\n    if (prototype !== Object.prototype && prototype !== null) {\n      return failJsonMeasurement(state, \"payload_measurement_bounded\");\n    }\n    const toJson = Object.getOwnPropertyDescriptor(value, \"toJSON\");\n    if (toJson && (\"get\" in toJson || typeof toJson.value === \"function\")) {\n      return failJsonMeasurement(state, \"payload_measurement_bounded\");\n    }\n    let bytes = 2;\n    let fields = 0;\n    try {\n      for (const key in value as Record<string, unknown>) {\n        if (!Object.prototype.hasOwnProperty.call(value, key)) continue;\n        if (state.remainingNodes <= 0) {\n          return failJsonMeasurement(state, \"payload_measurement_bounded\");\n        }\n        // A property consumes traversal work even when JSON.stringify would\n        // omit its value. Without this decrement a broad object containing\n        // only undefined/functions/symbols bypasses the global node budget.\n        state.remainingNodes -= 1;\n        const descriptor = Object.getOwnPropertyDescriptor(value, key);\n        if (!descriptor || !(\"value\" in descriptor)) {\n          return failJsonMeasurement(state, \"payload_measurement_bounded\");\n        }\n        const entry = descriptor.value;\n        if (\n          typeof entry === \"undefined\" ||\n          typeof entry === \"function\" ||\n          typeof entry === \"symbol\"\n        ) {\n          continue;\n        }\n        const measured = measureJsonValue(entry, state, \"object\", depth + 1);\n        if (measured === null) return null;\n        if (fields > 0) bytes += 1;\n        bytes += jsonStringBytes(key) + 1 + measured;\n        fields += 1;\n      }\n    } catch {\n      return null;\n    }\n    return bytes;\n  } finally {\n    state.seen.delete(value);\n  }\n}\n\nfunction hasCanonicalDateSerialization(value: Date): boolean {\n  try {\n    if (Object.getPrototypeOf(value) !== Date.prototype) return false;\n    // JSON.stringify performs an ordinary property lookup for toJSON. Any own\n    // shadow (data or accessor) changes that behavior and must not be invoked.\n    return Object.getOwnPropertyDescriptor(value, \"toJSON\") === undefined;\n  } catch {\n    return false;\n  }\n}\n\nfunction failJsonMeasurement(\n  state: JsonMeasurementState,\n  reason: Exclude<JsonMeasurement, { bytes: number }>[\"reason\"],\n): null {\n  state.failureReason ??= reason;\n  return null;\n}\n\nfunction jsonStringBytes(value: string): number {\n  let bytes = 2;\n  for (let index = 0; index < value.length; index += 1) {\n    const code = value.charCodeAt(index);\n    if (\n      code === 0x22 ||\n      code === 0x5c ||\n      code === 0x08 ||\n      code === 0x09 ||\n      code === 0x0a ||\n      code === 0x0c ||\n      code === 0x0d\n    ) {\n      bytes += 2;\n    } else if (code <= 0x1f) {\n      bytes += 6;\n    } else if (code <= 0x7f) {\n      bytes += 1;\n    } else if (code <= 0x7ff) {\n      bytes += 2;\n    } else if (code >= 0xd800 && code <= 0xdbff) {\n      const next = index + 1 < value.length ? value.charCodeAt(index + 1) : 0;\n      if (next >= 0xdc00 && next <= 0xdfff) {\n        bytes += 4;\n        index += 1;\n      } else {\n        // JSON.stringify escapes lone surrogates as six ASCII bytes.\n        bytes += 6;\n      }\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      bytes += 6;\n    } else {\n      bytes += 3;\n    }\n  }\n  return bytes;\n}\n\nfunction serializeForBoundary(value: unknown): {\n  value: string;\n  serializable: boolean;\n} {\n  try {\n    const serialized = JSON.stringify(value);\n    return {\n      value: serialized === undefined ? \"null\" : serialized,\n      serializable: serialized !== undefined,\n    };\n  } catch {\n    return {\n      value: JSON.stringify(\"[unserializable event payload omitted]\"),\n      serializable: false,\n    };\n  }\n}\n\nfunction stringifyForBoundary(value: unknown): string {\n  return serializeForBoundary(value).value;\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value && typeof value === \"object\" && !Array.isArray(value));\n}\n","/**\n * Adaptive Codex fleet policy, replay contract, and shadow evaluator.\n *\n * This module is deliberately pure and browser-safe. It accepts only bounded,\n * metadata-only snapshots whose candidate keys are opaque aliases assigned by\n * the caller. It never accepts credential ids, account emails, labels, token\n * material, prompts, or tenant activity. The same normalized snapshot can be\n * persisted in a session event, replayed offline, and compared byte-for-byte.\n *\n * V1 is shadow-only at the runtime integration boundary. The evaluator models\n * later placement, admission, manager priority, borrowing, emergency-fuse, and\n * named-overlay semantics so they can be proven with deterministic simulations\n * before any independent kill switch is allowed to affect a live allocation.\n */\n\nimport { sha256 } from \"@noble/hashes/sha256\";\nimport { bytesToHex } from \"@noble/hashes/utils\";\n\nexport const CODEX_FLEET_POLICY_SCHEMA_VERSION = 1 as const;\nexport const CODEX_FLEET_POLICY_VERSION = \"adaptive-shadow-v1\" as const;\nexport const CODEX_FLEET_POLICY_MAX_CANDIDATES = 32;\nexport const CODEX_FLEET_POLICY_MAX_OVERLAYS_PER_CANDIDATE = 4;\n\nconst MAX_DURATION_MS = 31 * 24 * 60 * 60_000;\nconst MAX_COUNT = 1_000_000;\nconst SCORE_SCALE = 100;\n\n/**\n * Replay-integrity ordering for bounded ASCII-safe fleet keys and aliases.\n *\n * Locale-aware collation is intentionally forbidden here because its result\n * can depend on locale and ICU data. Relational string comparison uses\n * ECMAScript UTF-16 code-unit ordering and is therefore identical in Bun,\n * Node, and browsers.\n */\nexport function compareCodexFleetCanonicalStringsV1(left: string, right: string): number {\n  return left < right ? -1 : left > right ? 1 : 0;\n}\n\nexport type CodexFleetConfidence = \"unknown\" | \"low\" | \"medium\" | \"high\";\nexport type CodexFleetCandidateStatus = \"active\" | \"needs_relogin\" | \"error\" | \"unknown\";\nexport type CodexFleetCacheState = \"unknown\" | \"healthy\" | \"collapsed\";\nexport type CodexFleetPriority = \"standard\" | \"manager\";\nexport type CodexFleetPlacementKind = \"new\" | \"fenced_in_flight\";\nexport type CodexFleetOverlayMode = \"none\" | \"prefer\" | \"isolate\";\n\nexport type CodexFleetQuotaWindowV1 = {\n  /** Provider-reported percentage from a workspace-local cache, never inferred tenant truth. */\n  usedPercent: number | null;\n  /** Relative to input.observedAtMs. Zero means the reported window has reset. */\n  resetRemainingMs: number | null;\n};\n\nexport type CodexFleetCandidateV1 = {\n  /** Opaque, event-local alias such as c00. Never a credential/account id. */\n  key: string;\n  status: CodexFleetCandidateStatus;\n  allocatorEnabled: boolean;\n  /** Relative cooldown. A positive value excludes only NEW placements. */\n  cooldownRemainingMs: number | null;\n  activeLeaseCount: number;\n  quota: {\n    primary: CodexFleetQuotaWindowV1;\n    secondary: CodexFleetQuotaWindowV1;\n    checkedAgeMs: number | null;\n    confidence: CodexFleetConfidence;\n  };\n  /**\n   * Runtime-observed cache evidence. It may be absent because the production\n   * baseline currently exists as aggregate metrics/logs rather than allocator\n   * state. Absence is explicit uncertainty, not a zero cache hit.\n   */\n  cache: {\n    hitRatio: number | null;\n    sampledTokens: number | null;\n    checkedAgeMs: number | null;\n    confidence: CodexFleetConfidence;\n    /** Previously latched state; the evaluator applies dwell and recovery thresholds. */\n    state: CodexFleetCacheState;\n    /** Duration of the current continuous below/above-threshold observation. */\n    thresholdObservedForMs: number | null;\n  };\n  /** Workspace-local observed burn, separate from unexplained/external inference. */\n  observedBurn: {\n    primaryPercentPerHour: number | null;\n    secondaryPercentPerHour: number | null;\n    confidence: CodexFleetConfidence;\n  };\n  /**\n   * Unexplained/external burn is an inference only. The name and confidence are\n   * load-bearing: consumers must never relabel it as provider or tenant truth.\n   */\n  inferredUnexplainedBurn: {\n    primaryPercentPerHour: number | null;\n    secondaryPercentPerHour: number | null;\n    confidence: CodexFleetConfidence;\n  };\n  /** Opaque named-policy keys. Ignored unless overlaysEnabled is independently true. */\n  overlayKeys: string[];\n};\n\nexport type CodexFleetAdmissionSnapshotV1 = {\n  /** Dynamically observed capacity, not a static per-account slot allocation. */\n  dynamicCapacityUnits: number | null;\n  inUseUnits: number;\n  queuedManagerCount: number;\n  emergencyFuseActive: boolean;\n};\n\nexport type CodexFleetDecisionInputV1 = {\n  observedAtMs: number;\n  request: {\n    placement: CodexFleetPlacementKind;\n    priority: CodexFleetPriority;\n    currentCandidateKey: string | null;\n    waitAgeMs: number;\n    overlayKey: string | null;\n    overlayMode: CodexFleetOverlayMode;\n  };\n  admission: CodexFleetAdmissionSnapshotV1;\n  candidates: CodexFleetCandidateV1[];\n};\n\nexport type CodexFleetPolicyConfigV1 = {\n  maxCandidates: number;\n  quotaFreshForMs: number;\n  quotaStaleAfterMs: number;\n  placementUsageCeilingPercent: number;\n  cacheFreshForMs: number;\n  cacheCollapseThreshold: number;\n  cacheCollapseRecoveryThreshold: number;\n  cacheMinimumSampledTokens: number;\n  cacheCollapseDwellMs: number;\n  cacheRecoveryDwellMs: number;\n  activeLeaseScore: number;\n  unknownQuotaScore: number;\n  lowQuotaConfidenceScore: number;\n  mediumQuotaConfidenceScore: number;\n  inferredBurnScorePerPercentHour: number;\n  observedBurnScorePerPercentHour: number;\n  /** Maximum exhaustion-before-reset gap that contributes placement pressure. */\n  runwayRiskCapHours: number;\n  runwayScorePerAtRiskHour: number;\n  healthyCacheAffinityBenefit: number;\n  unknownCacheAffinityBenefit: number;\n  collapsedCacheAffinityBenefit: number;\n  switchHysteresisScore: number;\n  admissionPacingEnabled: boolean;\n  managerPriorityEnabled: boolean;\n  managerStandardStarvationMs: number;\n  emergencyFuseEnabled: boolean;\n  overlaysEnabled: boolean;\n  overlayPreferenceScore: number;\n};\n\n/**\n * Experimental shadow defaults. None of the boolean control fields is enabled;\n * production behavior therefore remains sticky-sharded until operators enable\n * each independently after shadow acceptance.\n */\nexport const DEFAULT_CODEX_FLEET_POLICY_V1: CodexFleetPolicyConfigV1 = Object.freeze({\n  maxCandidates: CODEX_FLEET_POLICY_MAX_CANDIDATES,\n  quotaFreshForMs: 15 * 60_000,\n  quotaStaleAfterMs: 60 * 60_000,\n  placementUsageCeilingPercent: 90,\n  cacheFreshForMs: 30 * 60_000,\n  cacheCollapseThreshold: 0.4,\n  cacheCollapseRecoveryThreshold: 0.65,\n  cacheMinimumSampledTokens: 4_096,\n  cacheCollapseDwellMs: 5 * 60_000,\n  cacheRecoveryDwellMs: 10 * 60_000,\n  activeLeaseScore: 8 * SCORE_SCALE,\n  unknownQuotaScore: 16 * SCORE_SCALE,\n  lowQuotaConfidenceScore: 10 * SCORE_SCALE,\n  mediumQuotaConfidenceScore: 4 * SCORE_SCALE,\n  inferredBurnScorePerPercentHour: 0.2 * SCORE_SCALE,\n  observedBurnScorePerPercentHour: 0.1 * SCORE_SCALE,\n  runwayRiskCapHours: 2,\n  runwayScorePerAtRiskHour: 8 * SCORE_SCALE,\n  healthyCacheAffinityBenefit: 32 * SCORE_SCALE,\n  unknownCacheAffinityBenefit: 24 * SCORE_SCALE,\n  collapsedCacheAffinityBenefit: 6 * SCORE_SCALE,\n  switchHysteresisScore: 8 * SCORE_SCALE,\n  admissionPacingEnabled: false,\n  managerPriorityEnabled: false,\n  managerStandardStarvationMs: 2 * 60_000,\n  emergencyFuseEnabled: false,\n  overlaysEnabled: false,\n  overlayPreferenceScore: 12 * SCORE_SCALE,\n});\n\nexport type CodexFleetScoreV1 = {\n  candidateKey: string;\n  eligible: boolean;\n  rejectionReason:\n    | \"allocator_disabled\"\n    | \"unavailable\"\n    | \"cooling\"\n    | \"quota_ceiling\"\n    | \"overlay_isolation\"\n    | null;\n  quotaPressure: number;\n  leasePressure: number;\n  observedBurnPressure: number;\n  inferredBurnPressure: number;\n  runwayPressure: number;\n  uncertaintyPressure: number;\n  cacheAffinityBenefit: number;\n  cacheState: CodexFleetCacheState;\n  overlayPreferenceBenefit: number;\n  total: number;\n  confidence: CodexFleetConfidence;\n};\n\nexport type CodexFleetAdmissionDecisionV1 = {\n  outcome: \"admit\" | \"pace\";\n  reason:\n    | \"fenced_in_flight\"\n    | \"pacing_disabled\"\n    | \"capacity_unknown\"\n    | \"capacity_available\"\n    | \"work_conserving_borrow\"\n    | \"manager_priority\"\n    | \"standard_starvation_bound\"\n    | \"capacity_saturated\"\n    | \"emergency_fuse\";\n  /** True only when standard work uses otherwise-idle capacity with no manager backlog. */\n  borrowedIdleCapacity: boolean;\n};\n\nexport type CodexFleetDecisionV1 = {\n  outcome: \"selected\" | \"paced\" | \"none\";\n  selectedCandidateKey: string | null;\n  reason:\n    | \"fenced_in_flight\"\n    | \"fenced_candidate_missing\"\n    | \"admission_paced\"\n    | \"no_eligible_candidate\"\n    | \"overlay_isolated_empty\"\n    | \"best_score\"\n    | \"affinity_best\"\n    | \"hysteresis_hold\";\n  admission: CodexFleetAdmissionDecisionV1;\n  borrowedOverlayCapacity: boolean;\n  strandedEligibleCount: number;\n  confidence: CodexFleetConfidence;\n  scores: CodexFleetScoreV1[];\n};\n\nexport type CodexFleetReplayRecordV1 = {\n  schemaVersion: typeof CODEX_FLEET_POLICY_SCHEMA_VERSION;\n  policyVersion: typeof CODEX_FLEET_POLICY_VERSION;\n  mode: \"shadow\";\n  policy: CodexFleetPolicyConfigV1;\n  input: CodexFleetDecisionInputV1;\n  truncatedCandidateCount: number;\n  policyFingerprint: string;\n  inputFingerprint: string;\n  decision: CodexFleetDecisionV1;\n  decisionFingerprint: string;\n};\n\nexport type CodexFleetReplayVerdictV1 = {\n  matches: boolean;\n  policyFingerprintMatches: boolean;\n  inputFingerprintMatches: boolean;\n  decisionFingerprintMatches: boolean;\n  recordedDecisionFingerprintMatches: boolean;\n  decision: CodexFleetDecisionV1;\n};\n\ntype NormalizedInput = {\n  input: CodexFleetDecisionInputV1;\n  truncatedCandidateCount: number;\n};\n\nexport function createCodexFleetReplayRecordV1(\n  input: CodexFleetDecisionInputV1,\n  policy: CodexFleetPolicyConfigV1 = DEFAULT_CODEX_FLEET_POLICY_V1,\n): CodexFleetReplayRecordV1 {\n  const normalizedPolicy = normalizePolicy(policy);\n  const normalized = normalizeInput(input, normalizedPolicy.maxCandidates);\n  const decision = evaluateCodexFleetDecisionV1(normalized.input, normalizedPolicy);\n  return {\n    schemaVersion: CODEX_FLEET_POLICY_SCHEMA_VERSION,\n    policyVersion: CODEX_FLEET_POLICY_VERSION,\n    mode: \"shadow\",\n    policy: normalizedPolicy,\n    input: normalized.input,\n    truncatedCandidateCount: normalized.truncatedCandidateCount,\n    policyFingerprint: fingerprint(normalizedPolicy),\n    inputFingerprint: fingerprintReplayInput(normalized.input, normalized.truncatedCandidateCount),\n    decision,\n    decisionFingerprint: fingerprint(decision),\n  };\n}\n\nexport function replayCodexFleetDecisionV1(value: unknown): CodexFleetReplayVerdictV1 {\n  const record = readCodexFleetReplayRecordV1(value);\n  const policyFingerprintMatches = fingerprint(record.policy) === record.policyFingerprint;\n  const inputFingerprintMatches =\n    fingerprintReplayInput(record.input, record.truncatedCandidateCount) ===\n    record.inputFingerprint;\n  const decision = evaluateCodexFleetDecisionV1(record.input, record.policy);\n  const replayedDecisionFingerprint = fingerprint(decision);\n  const recordedDecisionFingerprintMatches =\n    fingerprint(record.decision) === record.decisionFingerprint;\n  const decisionFingerprintMatches =\n    recordedDecisionFingerprintMatches &&\n    replayedDecisionFingerprint === record.decisionFingerprint;\n  return {\n    matches:\n      policyFingerprintMatches &&\n      inputFingerprintMatches &&\n      decisionFingerprintMatches &&\n      canonicalJson(decision) === canonicalJson(record.decision),\n    policyFingerprintMatches,\n    inputFingerprintMatches,\n    decisionFingerprintMatches,\n    recordedDecisionFingerprintMatches,\n    decision,\n  };\n}\n\n/**\n * Canonical replay bytes for already-bounded, identity-free fleet values.\n * This is exported so offline tools can prove the exact bytes across runtimes;\n * it performs no redaction and must not be used with raw account metadata.\n */\nexport function canonicalCodexFleetReplayJsonV1(value: CodexFleetReplayRecordV1): string {\n  return canonicalJson(value);\n}\n\n/**\n * Strict reader for durable/offline replay. Unknown fields, lossy normalization,\n * malformed decisions, and non-SHA-256 digests are rejected before comparison.\n */\nexport function readCodexFleetReplayRecordV1(value: unknown): CodexFleetReplayRecordV1 {\n  const record = strictRecord(value, [\n    \"schemaVersion\",\n    \"policyVersion\",\n    \"mode\",\n    \"policy\",\n    \"input\",\n    \"truncatedCandidateCount\",\n    \"policyFingerprint\",\n    \"inputFingerprint\",\n    \"decision\",\n    \"decisionFingerprint\",\n  ]);\n  if (\n    record.schemaVersion !== CODEX_FLEET_POLICY_SCHEMA_VERSION ||\n    record.policyVersion !== CODEX_FLEET_POLICY_VERSION ||\n    record.mode !== \"shadow\"\n  ) {\n    throw new Error(\"Unsupported Codex fleet replay envelope\");\n  }\n\n  const policy = normalizePolicy(record.policy as CodexFleetPolicyConfigV1);\n  if (canonicalJson(policy) !== canonicalJson(record.policy)) {\n    throw new Error(\"Codex fleet replay policy is not in canonical bounded form\");\n  }\n  const normalizedInput = normalizeInput(\n    record.input as CodexFleetDecisionInputV1,\n    policy.maxCandidates,\n  );\n  if (\n    normalizedInput.truncatedCandidateCount !== 0 ||\n    canonicalJson(normalizedInput.input) !== canonicalJson(record.input)\n  ) {\n    throw new Error(\"Codex fleet replay input is not in canonical bounded form\");\n  }\n\n  return {\n    schemaVersion: CODEX_FLEET_POLICY_SCHEMA_VERSION,\n    policyVersion: CODEX_FLEET_POLICY_VERSION,\n    mode: \"shadow\",\n    policy,\n    input: normalizedInput.input,\n    truncatedCandidateCount: strictInteger(record.truncatedCandidateCount, 0, MAX_COUNT),\n    policyFingerprint: strictSha256(record.policyFingerprint),\n    inputFingerprint: strictSha256(record.inputFingerprint),\n    decision: readCodexFleetDecisionV1(\n      record.decision,\n      new Set(normalizedInput.input.candidates.map((candidate) => candidate.key)),\n    ),\n    decisionFingerprint: strictSha256(record.decisionFingerprint),\n  };\n}\n\nexport function evaluateCodexFleetDecisionV1(\n  input: CodexFleetDecisionInputV1,\n  policy: CodexFleetPolicyConfigV1 = DEFAULT_CODEX_FLEET_POLICY_V1,\n): CodexFleetDecisionV1 {\n  const admission = evaluateAdmission(input, policy);\n  const current = input.request.currentCandidateKey\n    ? input.candidates.find((candidate) => candidate.key === input.request.currentCandidateKey)\n    : undefined;\n\n  // A fenced turn is immutable under every overlay, pacing rule, manager class,\n  // or emergency fuse. If its candidate vanished, fail closed instead of moving.\n  if (input.request.placement === \"fenced_in_flight\") {\n    if (!current) {\n      return emptyDecision(\"fenced_candidate_missing\", admission, \"unknown\");\n    }\n    return {\n      outcome: \"selected\",\n      selectedCandidateKey: current.key,\n      reason: \"fenced_in_flight\",\n      admission,\n      borrowedOverlayCapacity: false,\n      strandedEligibleCount: 0,\n      confidence: candidateConfidence(current, policy),\n      scores: [scoreCandidate(current, input, policy, false)],\n    };\n  }\n\n  if (admission.outcome === \"pace\") {\n    return emptyDecision(\"admission_paced\", admission, \"unknown\");\n  }\n\n  const scored = input.candidates.map((candidate) =>\n    scoreCandidate(candidate, input, policy, false),\n  );\n  const baseEligibleKeys = new Set(\n    scored.filter((candidate) => candidate.eligible).map((candidate) => candidate.candidateKey),\n  );\n  const overlay = selectOverlayScope(input, policy, baseEligibleKeys);\n  const scopedScores = input.candidates\n    .map((candidate) =>\n      scoreCandidate(\n        candidate,\n        input,\n        policy,\n        overlay.rejectedByIsolation.has(candidate.key),\n        overlay.preferredMembers.has(candidate.key),\n      ),\n    )\n    .sort((a, b) => compareCodexFleetCanonicalStringsV1(a.candidateKey, b.candidateKey));\n  const eligible = scopedScores\n    .filter((candidate) => candidate.eligible)\n    .sort(\n      (a, b) =>\n        a.total - b.total || compareCodexFleetCanonicalStringsV1(a.candidateKey, b.candidateKey),\n    );\n\n  if (eligible.length === 0) {\n    return {\n      ...emptyDecision(\n        overlay.isolatedEmpty ? \"overlay_isolated_empty\" : \"no_eligible_candidate\",\n        admission,\n        aggregateConfidence(scopedScores),\n      ),\n      strandedEligibleCount: overlay.strandedEligibleCount,\n      scores: scopedScores,\n    };\n  }\n\n  let selected = eligible[0]!;\n  let reason: CodexFleetDecisionV1[\"reason\"] = \"best_score\";\n  const currentScore = input.request.currentCandidateKey\n    ? eligible.find((candidate) => candidate.candidateKey === input.request.currentCandidateKey)\n    : undefined;\n  if (currentScore) {\n    if (selected.candidateKey === currentScore.candidateKey) {\n      reason = \"affinity_best\";\n    } else if (selected.total + policy.switchHysteresisScore >= currentScore.total) {\n      selected = currentScore;\n      reason = \"hysteresis_hold\";\n    }\n  }\n\n  return {\n    outcome: \"selected\",\n    selectedCandidateKey: selected.candidateKey,\n    reason,\n    admission,\n    borrowedOverlayCapacity:\n      policy.overlaysEnabled &&\n      input.request.overlayMode === \"prefer\" &&\n      input.request.overlayKey !== null &&\n      !overlay.preferredMembers.has(selected.candidateKey),\n    strandedEligibleCount: overlay.strandedEligibleCount,\n    confidence: aggregateConfidence(eligible),\n    scores: scopedScores,\n  };\n}\n\nfunction evaluateAdmission(\n  input: CodexFleetDecisionInputV1,\n  policy: CodexFleetPolicyConfigV1,\n): CodexFleetAdmissionDecisionV1 {\n  if (input.request.placement === \"fenced_in_flight\") {\n    return {\n      outcome: \"admit\",\n      reason: \"fenced_in_flight\",\n      borrowedIdleCapacity: false,\n    };\n  }\n  if (policy.emergencyFuseEnabled && input.admission.emergencyFuseActive) {\n    return {\n      outcome: \"pace\",\n      reason: \"emergency_fuse\",\n      borrowedIdleCapacity: false,\n    };\n  }\n  if (!policy.admissionPacingEnabled) {\n    return {\n      outcome: \"admit\",\n      reason: \"pacing_disabled\",\n      borrowedIdleCapacity: false,\n    };\n  }\n  if (input.admission.dynamicCapacityUnits === null) {\n    // Observability-first fail-open: unknown soft capacity never invents a hard slot.\n    return {\n      outcome: \"admit\",\n      reason: \"capacity_unknown\",\n      borrowedIdleCapacity: false,\n    };\n  }\n  const available = Math.max(0, input.admission.dynamicCapacityUnits - input.admission.inUseUnits);\n  if (available === 0) {\n    return {\n      outcome: \"pace\",\n      reason: \"capacity_saturated\",\n      borrowedIdleCapacity: false,\n    };\n  }\n  if (\n    policy.managerPriorityEnabled &&\n    input.request.priority === \"standard\" &&\n    input.admission.queuedManagerCount > 0 &&\n    available <= input.admission.queuedManagerCount\n  ) {\n    if (input.request.waitAgeMs >= policy.managerStandardStarvationMs) {\n      return {\n        outcome: \"admit\",\n        reason: \"standard_starvation_bound\",\n        borrowedIdleCapacity: false,\n      };\n    }\n    return {\n      outcome: \"pace\",\n      reason: \"manager_priority\",\n      borrowedIdleCapacity: false,\n    };\n  }\n  if (input.request.priority === \"standard\" && input.admission.queuedManagerCount === 0) {\n    return {\n      outcome: \"admit\",\n      reason: \"work_conserving_borrow\",\n      borrowedIdleCapacity: true,\n    };\n  }\n  return {\n    outcome: \"admit\",\n    reason: \"capacity_available\",\n    borrowedIdleCapacity: false,\n  };\n}\n\nfunction scoreCandidate(\n  candidate: CodexFleetCandidateV1,\n  input: CodexFleetDecisionInputV1,\n  policy: CodexFleetPolicyConfigV1,\n  rejectedByIsolation: boolean,\n  preferredOverlayMember = false,\n): CodexFleetScoreV1 {\n  const confidence = candidateConfidence(candidate, policy);\n  const bindingUsed = bindingUsedPercent(candidate);\n  const hardQuotaKnown = confidence === \"high\" || confidence === \"medium\";\n  const rejectionReason: CodexFleetScoreV1[\"rejectionReason\"] = !candidate.allocatorEnabled\n    ? \"allocator_disabled\"\n    : candidate.status !== \"active\"\n      ? \"unavailable\"\n      : (candidate.cooldownRemainingMs ?? 0) > 0\n        ? \"cooling\"\n        : hardQuotaKnown &&\n            bindingUsed !== null &&\n            bindingUsed >= policy.placementUsageCeilingPercent\n          ? \"quota_ceiling\"\n          : rejectedByIsolation\n            ? \"overlay_isolation\"\n            : null;\n\n  const confidenceFactor = confidenceWeight(confidence);\n  // Missing quota is not treated as pristine 0% or as a hard exclusion. Blend\n  // toward neutral 50% and add an explicit uncertainty component instead.\n  const quotaPressure = Math.round(\n    ((bindingUsed ?? 50) * confidenceFactor + 50 * (1 - confidenceFactor)) * SCORE_SCALE,\n  );\n  const leasePressure = candidate.activeLeaseCount * policy.activeLeaseScore;\n  const observedBurnConfidence = confidenceWeight(candidate.observedBurn.confidence);\n  const observedBurn = maximumWindowBurn(candidate.observedBurn);\n  const observedBurnPressure = Math.round(\n    observedBurn * policy.observedBurnScorePerPercentHour * observedBurnConfidence,\n  );\n  const burnConfidence = confidenceWeight(candidate.inferredUnexplainedBurn.confidence);\n  const inferredBurn = maximumWindowBurn(candidate.inferredUnexplainedBurn);\n  const inferredBurnPressure = Math.round(\n    inferredBurn * policy.inferredBurnScorePerPercentHour * burnConfidence,\n  );\n  const runwayPressure = runwayRiskPressure(candidate, confidence, policy);\n  const uncertaintyPressure = quotaUncertaintyScore(confidence, policy);\n  const cacheState = effectiveCodexFleetCacheStateV1(candidate.cache, policy);\n  const cacheAffinityBenefit =\n    candidate.key === input.request.currentCandidateKey\n      ? cacheAffinityBenefitFor(cacheState, policy)\n      : 0;\n  const overlayPreferenceBenefit = preferredOverlayMember ? policy.overlayPreferenceScore : 0;\n  return {\n    candidateKey: candidate.key,\n    eligible: rejectionReason === null,\n    rejectionReason,\n    quotaPressure,\n    leasePressure,\n    observedBurnPressure,\n    inferredBurnPressure,\n    runwayPressure,\n    uncertaintyPressure,\n    cacheAffinityBenefit,\n    cacheState,\n    overlayPreferenceBenefit,\n    total:\n      quotaPressure +\n      leasePressure +\n      observedBurnPressure +\n      inferredBurnPressure +\n      runwayPressure +\n      uncertaintyPressure -\n      cacheAffinityBenefit -\n      overlayPreferenceBenefit,\n    confidence,\n  };\n}\n\ntype CodexFleetBurnSnapshotV1 = CodexFleetCandidateV1[\"observedBurn\"];\ntype CodexFleetWindowKey = \"primary\" | \"secondary\";\n\nfunction maximumWindowBurn(burn: CodexFleetBurnSnapshotV1): number {\n  return Math.max(burn.primaryPercentPerHour ?? 0, burn.secondaryPercentPerHour ?? 0);\n}\n\nfunction windowBurn(burn: CodexFleetBurnSnapshotV1, window: CodexFleetWindowKey): number {\n  return window === \"primary\"\n    ? (burn.primaryPercentPerHour ?? 0)\n    : (burn.secondaryPercentPerHour ?? 0);\n}\n\n/**\n * Score only a confidence-bounded exhaustion risk that occurs before the\n * corresponding provider reset. Each quota window has its own percentage burn\n * denominator and reset horizon; the highest-risk complete window binds.\n * Missing/stale observations contribute uncertainty elsewhere, never invented\n * burn. A zero reset horizon means that reported window has already reset.\n */\nfunction runwayRiskPressure(\n  candidate: CodexFleetCandidateV1,\n  quotaConfidence: CodexFleetConfidence,\n  policy: CodexFleetPolicyConfigV1,\n): number {\n  if (quotaConfidence === \"unknown\") return 0;\n  const windows: Array<[CodexFleetWindowKey, CodexFleetQuotaWindowV1]> = [\n    [\"primary\", candidate.quota.primary],\n    [\"secondary\", candidate.quota.secondary],\n  ];\n  let maximumPressure = 0;\n  for (const [windowKey, window] of windows) {\n    if (\n      window.usedPercent === null ||\n      window.resetRemainingMs === null ||\n      window.resetRemainingMs === 0\n    ) {\n      continue;\n    }\n    const observedConfidence = confidenceWeight(\n      lowerConfidence(candidate.observedBurn.confidence, quotaConfidence),\n    );\n    const inferredConfidence = confidenceWeight(\n      lowerConfidence(candidate.inferredUnexplainedBurn.confidence, quotaConfidence),\n    );\n    const confidenceBoundedBurn =\n      windowBurn(candidate.observedBurn, windowKey) * observedConfidence +\n      windowBurn(candidate.inferredUnexplainedBurn, windowKey) * inferredConfidence;\n    if (confidenceBoundedBurn <= 0) continue;\n\n    const exhaustionRunwayHours = Math.max(0, 100 - window.usedPercent) / confidenceBoundedBurn;\n    const resetHorizonHours = window.resetRemainingMs / 60 / 60_000;\n    const atRiskHours = Math.min(\n      policy.runwayRiskCapHours,\n      Math.max(0, resetHorizonHours - exhaustionRunwayHours),\n    );\n    maximumPressure = Math.max(\n      maximumPressure,\n      Math.round(atRiskHours * policy.runwayScorePerAtRiskHour),\n    );\n  }\n  return maximumPressure;\n}\n\nfunction selectOverlayScope(\n  input: CodexFleetDecisionInputV1,\n  policy: CodexFleetPolicyConfigV1,\n  baseEligibleKeys: Set<string>,\n): {\n  rejectedByIsolation: Set<string>;\n  preferredMembers: Set<string>;\n  isolatedEmpty: boolean;\n  strandedEligibleCount: number;\n} {\n  if (\n    !policy.overlaysEnabled ||\n    input.request.overlayMode === \"none\" ||\n    input.request.overlayKey === null\n  ) {\n    return {\n      rejectedByIsolation: new Set(),\n      preferredMembers: new Set(),\n      isolatedEmpty: false,\n      strandedEligibleCount: 0,\n    };\n  }\n  const members = new Set(\n    input.candidates\n      .filter(\n        (candidate) =>\n          baseEligibleKeys.has(candidate.key) &&\n          candidate.overlayKeys.includes(input.request.overlayKey!),\n      )\n      .map((candidate) => candidate.key),\n  );\n  if (input.request.overlayMode === \"prefer\") {\n    if (members.size === 0) {\n      return {\n        rejectedByIsolation: new Set(),\n        preferredMembers: members,\n        isolatedEmpty: false,\n        strandedEligibleCount: 0,\n      };\n    }\n    return {\n      // Preference is a bounded score benefit, never a hard partition. Healthy\n      // authorized outsiders remain eligible and borrowable.\n      rejectedByIsolation: new Set(),\n      preferredMembers: members,\n      isolatedEmpty: false,\n      strandedEligibleCount: 0,\n    };\n  }\n  const outside = [...baseEligibleKeys].filter((candidateKey) => !members.has(candidateKey));\n  return {\n    rejectedByIsolation: new Set(outside),\n    preferredMembers: members,\n    isolatedEmpty: members.size === 0,\n    strandedEligibleCount: outside.length,\n  };\n}\n\nfunction candidateConfidence(\n  candidate: CodexFleetCandidateV1,\n  policy: CodexFleetPolicyConfigV1,\n): CodexFleetConfidence {\n  const age = candidate.quota.checkedAgeMs;\n  if (age === null || age > policy.quotaStaleAfterMs) return \"unknown\";\n  const windows = [candidate.quota.primary, candidate.quota.secondary];\n  const completeWindowCount = windows.filter(\n    (window) => window.usedPercent !== null && window.resetRemainingMs !== null,\n  ).length;\n  const hasPartialWindow = windows.some(\n    (window) => (window.usedPercent === null) !== (window.resetRemainingMs === null),\n  );\n  if (completeWindowCount === 0) return \"unknown\";\n  const completenessCeiling: CodexFleetConfidence = hasPartialWindow\n    ? \"low\"\n    : completeWindowCount === windows.length\n      ? \"high\"\n      : \"medium\";\n  const completeConfidence = lowerConfidence(candidate.quota.confidence, completenessCeiling);\n  if (age > policy.quotaFreshForMs) {\n    return lowerConfidence(completeConfidence, \"low\");\n  }\n  return completeConfidence;\n}\n\nexport function effectiveCodexFleetCacheStateV1(\n  cache: CodexFleetCandidateV1[\"cache\"],\n  policy: CodexFleetPolicyConfigV1,\n): CodexFleetCacheState {\n  const { hitRatio, sampledTokens, checkedAgeMs, confidence, state, thresholdObservedForMs } =\n    cache;\n  if (\n    hitRatio === null ||\n    sampledTokens === null ||\n    sampledTokens < policy.cacheMinimumSampledTokens ||\n    checkedAgeMs === null ||\n    checkedAgeMs > policy.cacheFreshForMs ||\n    confidenceWeight(confidence) < confidenceWeight(\"medium\")\n  ) {\n    return \"unknown\";\n  }\n  const observedForMs = thresholdObservedForMs ?? 0;\n  if (state === \"healthy\") {\n    return hitRatio < policy.cacheCollapseThreshold && observedForMs >= policy.cacheCollapseDwellMs\n      ? \"collapsed\"\n      : \"healthy\";\n  }\n  if (state === \"collapsed\") {\n    return hitRatio >= policy.cacheCollapseRecoveryThreshold &&\n      observedForMs >= policy.cacheRecoveryDwellMs\n      ? \"healthy\"\n      : \"collapsed\";\n  }\n  if (hitRatio < policy.cacheCollapseThreshold && observedForMs >= policy.cacheCollapseDwellMs) {\n    return \"collapsed\";\n  }\n  if (\n    hitRatio >= policy.cacheCollapseRecoveryThreshold &&\n    observedForMs >= policy.cacheRecoveryDwellMs\n  ) {\n    return \"healthy\";\n  }\n  return \"unknown\";\n}\n\nfunction cacheAffinityBenefitFor(\n  state: CodexFleetCacheState,\n  policy: CodexFleetPolicyConfigV1,\n): number {\n  if (state === \"healthy\") return policy.healthyCacheAffinityBenefit;\n  if (state === \"collapsed\") return policy.collapsedCacheAffinityBenefit;\n  return policy.unknownCacheAffinityBenefit;\n}\n\nfunction bindingUsedPercent(candidate: CodexFleetCandidateV1): number | null {\n  const windows = [candidate.quota.primary, candidate.quota.secondary]\n    .filter((window) => window.usedPercent !== null && window.resetRemainingMs !== null)\n    .map((window) => (window.resetRemainingMs === 0 ? 0 : window.usedPercent))\n    .filter((used): used is number => used !== null);\n  return windows.length > 0 ? Math.max(...windows) : null;\n}\n\nfunction quotaUncertaintyScore(\n  confidence: CodexFleetConfidence,\n  policy: CodexFleetPolicyConfigV1,\n): number {\n  if (confidence === \"unknown\") return policy.unknownQuotaScore;\n  if (confidence === \"low\") return policy.lowQuotaConfidenceScore;\n  if (confidence === \"medium\") return policy.mediumQuotaConfidenceScore;\n  return 0;\n}\n\nfunction emptyDecision(\n  reason: CodexFleetDecisionV1[\"reason\"],\n  admission: CodexFleetAdmissionDecisionV1,\n  confidence: CodexFleetConfidence,\n): CodexFleetDecisionV1 {\n  return {\n    outcome: admission.outcome === \"pace\" ? \"paced\" : \"none\",\n    selectedCandidateKey: null,\n    reason,\n    admission,\n    borrowedOverlayCapacity: false,\n    strandedEligibleCount: 0,\n    confidence,\n    scores: [],\n  };\n}\n\nfunction aggregateConfidence(scores: CodexFleetScoreV1[]): CodexFleetConfidence {\n  if (scores.length === 0) return \"unknown\";\n  return scores.reduce<CodexFleetConfidence>(\n    (lowest, score) =>\n      confidenceWeight(score.confidence) < confidenceWeight(lowest) ? score.confidence : lowest,\n    \"high\",\n  );\n}\n\nfunction normalizeInput(input: CodexFleetDecisionInputV1, maxCandidates: number): NormalizedInput {\n  const currentCandidateKey = normalizeOptionalKey(input.request.currentCandidateKey);\n  const candidates = input.candidates\n    .map(normalizeCandidate)\n    .sort((a, b) => compareCodexFleetCanonicalStringsV1(a.key, b.key));\n  for (let index = 1; index < candidates.length; index += 1) {\n    if (candidates[index - 1]!.key === candidates[index]!.key) {\n      throw new Error(`Duplicate Codex fleet candidate key: ${candidates[index]!.key}`);\n    }\n  }\n  let bounded = candidates.slice(0, maxCandidates);\n  if (\n    currentCandidateKey &&\n    candidates.some((candidate) => candidate.key === currentCandidateKey) &&\n    !bounded.some((candidate) => candidate.key === currentCandidateKey)\n  ) {\n    bounded = [\n      ...bounded.slice(0, Math.max(0, maxCandidates - 1)),\n      candidates.find((candidate) => candidate.key === currentCandidateKey)!,\n    ].sort((a, b) => compareCodexFleetCanonicalStringsV1(a.key, b.key));\n  }\n  return {\n    input: {\n      observedAtMs: normalizeInteger(input.observedAtMs, 0, Number.MAX_SAFE_INTEGER),\n      request: {\n        placement: input.request.placement === \"fenced_in_flight\" ? \"fenced_in_flight\" : \"new\",\n        priority: input.request.priority === \"manager\" ? \"manager\" : \"standard\",\n        currentCandidateKey,\n        waitAgeMs: normalizeInteger(input.request.waitAgeMs, 0, MAX_DURATION_MS),\n        overlayKey: normalizeOptionalKey(input.request.overlayKey),\n        overlayMode:\n          input.request.overlayMode === \"isolate\"\n            ? \"isolate\"\n            : input.request.overlayMode === \"prefer\"\n              ? \"prefer\"\n              : \"none\",\n      },\n      admission: {\n        dynamicCapacityUnits:\n          input.admission.dynamicCapacityUnits === null\n            ? null\n            : normalizeInteger(input.admission.dynamicCapacityUnits, 0, MAX_COUNT),\n        inUseUnits: normalizeInteger(input.admission.inUseUnits, 0, MAX_COUNT),\n        queuedManagerCount: normalizeInteger(input.admission.queuedManagerCount, 0, MAX_COUNT),\n        emergencyFuseActive: input.admission.emergencyFuseActive === true,\n      },\n      candidates: bounded,\n    },\n    truncatedCandidateCount: candidates.length - bounded.length,\n  };\n}\n\nfunction normalizeCandidate(candidate: CodexFleetCandidateV1): CodexFleetCandidateV1 {\n  return {\n    key: normalizeKey(candidate.key),\n    status:\n      candidate.status === \"active\" ||\n      candidate.status === \"needs_relogin\" ||\n      candidate.status === \"error\"\n        ? candidate.status\n        : \"unknown\",\n    allocatorEnabled: candidate.allocatorEnabled === true,\n    cooldownRemainingMs: normalizeNullableInteger(\n      candidate.cooldownRemainingMs,\n      0,\n      MAX_DURATION_MS,\n    ),\n    activeLeaseCount: normalizeInteger(candidate.activeLeaseCount, 0, MAX_COUNT),\n    quota: {\n      primary: normalizeQuotaWindow(candidate.quota.primary),\n      secondary: normalizeQuotaWindow(candidate.quota.secondary),\n      checkedAgeMs: normalizeNullableInteger(candidate.quota.checkedAgeMs, 0, MAX_DURATION_MS),\n      confidence: normalizeConfidence(candidate.quota.confidence),\n    },\n    cache: {\n      hitRatio: normalizeNullableNumber(candidate.cache.hitRatio, 0, 1, 4),\n      sampledTokens: normalizeNullableInteger(candidate.cache.sampledTokens, 0, MAX_COUNT),\n      checkedAgeMs: normalizeNullableInteger(candidate.cache.checkedAgeMs, 0, MAX_DURATION_MS),\n      confidence: normalizeConfidence(candidate.cache.confidence),\n      state: normalizeCacheState(candidate.cache.state),\n      thresholdObservedForMs: normalizeNullableInteger(\n        candidate.cache.thresholdObservedForMs,\n        0,\n        MAX_DURATION_MS,\n      ),\n    },\n    observedBurn: {\n      primaryPercentPerHour: normalizeNullableNumber(\n        candidate.observedBurn.primaryPercentPerHour,\n        0,\n        100,\n        3,\n      ),\n      secondaryPercentPerHour: normalizeNullableNumber(\n        candidate.observedBurn.secondaryPercentPerHour,\n        0,\n        100,\n        3,\n      ),\n      confidence: normalizeConfidence(candidate.observedBurn.confidence),\n    },\n    inferredUnexplainedBurn: {\n      primaryPercentPerHour: normalizeNullableNumber(\n        candidate.inferredUnexplainedBurn.primaryPercentPerHour,\n        0,\n        100,\n        3,\n      ),\n      secondaryPercentPerHour: normalizeNullableNumber(\n        candidate.inferredUnexplainedBurn.secondaryPercentPerHour,\n        0,\n        100,\n        3,\n      ),\n      confidence: normalizeConfidence(candidate.inferredUnexplainedBurn.confidence),\n    },\n    overlayKeys: [...new Set(candidate.overlayKeys.map(normalizeKey))]\n      .sort(compareCodexFleetCanonicalStringsV1)\n      .slice(0, CODEX_FLEET_POLICY_MAX_OVERLAYS_PER_CANDIDATE),\n  };\n}\n\nfunction normalizeQuotaWindow(window: CodexFleetQuotaWindowV1): CodexFleetQuotaWindowV1 {\n  return {\n    usedPercent: normalizeNullableNumber(window.usedPercent, 0, 100, 3),\n    resetRemainingMs: normalizeNullableInteger(window.resetRemainingMs, 0, MAX_DURATION_MS),\n  };\n}\n\nfunction normalizePolicy(policy: CodexFleetPolicyConfigV1): CodexFleetPolicyConfigV1 {\n  const quotaFreshForMs = normalizeInteger(policy.quotaFreshForMs, 1, MAX_DURATION_MS);\n  const cacheCollapseThreshold = normalizeNumber(policy.cacheCollapseThreshold, 0, 1, 4);\n  return {\n    maxCandidates: normalizeInteger(policy.maxCandidates, 1, CODEX_FLEET_POLICY_MAX_CANDIDATES),\n    quotaFreshForMs,\n    quotaStaleAfterMs: normalizeInteger(policy.quotaStaleAfterMs, quotaFreshForMs, MAX_DURATION_MS),\n    placementUsageCeilingPercent: normalizeNumber(policy.placementUsageCeilingPercent, 1, 100, 3),\n    cacheFreshForMs: normalizeInteger(policy.cacheFreshForMs, 1, MAX_DURATION_MS),\n    cacheCollapseThreshold,\n    cacheCollapseRecoveryThreshold: normalizeNumber(\n      policy.cacheCollapseRecoveryThreshold,\n      cacheCollapseThreshold,\n      1,\n      4,\n    ),\n    cacheMinimumSampledTokens: normalizeInteger(policy.cacheMinimumSampledTokens, 1, MAX_COUNT),\n    cacheCollapseDwellMs: normalizeInteger(policy.cacheCollapseDwellMs, 1, MAX_DURATION_MS),\n    cacheRecoveryDwellMs: normalizeInteger(policy.cacheRecoveryDwellMs, 1, MAX_DURATION_MS),\n    activeLeaseScore: normalizeNumber(policy.activeLeaseScore, 0, MAX_COUNT, 3),\n    unknownQuotaScore: normalizeNumber(policy.unknownQuotaScore, 0, MAX_COUNT, 3),\n    lowQuotaConfidenceScore: normalizeNumber(policy.lowQuotaConfidenceScore, 0, MAX_COUNT, 3),\n    mediumQuotaConfidenceScore: normalizeNumber(policy.mediumQuotaConfidenceScore, 0, MAX_COUNT, 3),\n    inferredBurnScorePerPercentHour: normalizeNumber(\n      policy.inferredBurnScorePerPercentHour,\n      0,\n      MAX_COUNT,\n      3,\n    ),\n    observedBurnScorePerPercentHour: normalizeNumber(\n      policy.observedBurnScorePerPercentHour,\n      0,\n      MAX_COUNT,\n      3,\n    ),\n    runwayRiskCapHours: normalizeNumber(policy.runwayRiskCapHours, 0, 24 * 31, 3),\n    runwayScorePerAtRiskHour: normalizeNumber(policy.runwayScorePerAtRiskHour, 0, MAX_COUNT, 3),\n    healthyCacheAffinityBenefit: normalizeNumber(\n      policy.healthyCacheAffinityBenefit,\n      0,\n      MAX_COUNT,\n      3,\n    ),\n    unknownCacheAffinityBenefit: normalizeNumber(\n      policy.unknownCacheAffinityBenefit,\n      0,\n      MAX_COUNT,\n      3,\n    ),\n    collapsedCacheAffinityBenefit: normalizeNumber(\n      policy.collapsedCacheAffinityBenefit,\n      0,\n      MAX_COUNT,\n      3,\n    ),\n    switchHysteresisScore: normalizeNumber(policy.switchHysteresisScore, 0, MAX_COUNT, 3),\n    admissionPacingEnabled: policy.admissionPacingEnabled === true,\n    managerPriorityEnabled: policy.managerPriorityEnabled === true,\n    managerStandardStarvationMs: normalizeInteger(\n      policy.managerStandardStarvationMs,\n      1,\n      MAX_DURATION_MS,\n    ),\n    emergencyFuseEnabled: policy.emergencyFuseEnabled === true,\n    overlaysEnabled: policy.overlaysEnabled === true,\n    overlayPreferenceScore: normalizeNumber(policy.overlayPreferenceScore, 0, MAX_COUNT, 3),\n  };\n}\n\nfunction normalizeConfidence(value: CodexFleetConfidence): CodexFleetConfidence {\n  return value === \"high\" || value === \"medium\" || value === \"low\" ? value : \"unknown\";\n}\n\nfunction normalizeCacheState(value: CodexFleetCacheState): CodexFleetCacheState {\n  return value === \"healthy\" || value === \"collapsed\" ? value : \"unknown\";\n}\n\nfunction confidenceWeight(confidence: CodexFleetConfidence): number {\n  if (confidence === \"high\") return 1;\n  if (confidence === \"medium\") return 0.6;\n  if (confidence === \"low\") return 0.25;\n  return 0;\n}\n\nfunction lowerConfidence(\n  value: CodexFleetConfidence,\n  ceiling: CodexFleetConfidence,\n): CodexFleetConfidence {\n  return confidenceWeight(value) < confidenceWeight(ceiling) ? value : ceiling;\n}\n\nfunction normalizeKey(value: string): string {\n  if (!/^[a-zA-Z0-9._:-]{1,32}$/.test(value)) {\n    throw new Error(\"Codex fleet candidate/overlay keys must be 1-32 opaque safe characters\");\n  }\n  return value;\n}\n\nfunction normalizeOptionalKey(value: string | null): string | null {\n  return value === null ? null : normalizeKey(value);\n}\n\nfunction normalizeNullableNumber(\n  value: number | null,\n  min: number,\n  max: number,\n  decimals: number,\n): number | null {\n  return value === null ? null : normalizeNumber(value, min, max, decimals);\n}\n\nfunction normalizeNumber(value: number, min: number, max: number, decimals: number): number {\n  const finite = Number.isFinite(value) ? value : min;\n  const clamped = Math.min(max, Math.max(min, finite));\n  const scale = 10 ** decimals;\n  return Math.round(clamped * scale) / scale;\n}\n\nfunction normalizeNullableInteger(value: number | null, min: number, max: number): number | null {\n  return value === null ? null : normalizeInteger(value, min, max);\n}\n\nfunction normalizeInteger(value: number, min: number, max: number): number {\n  return Math.round(normalizeNumber(value, min, max, 0));\n}\n\nfunction readCodexFleetDecisionV1(\n  value: unknown,\n  candidateKeys: ReadonlySet<string>,\n): CodexFleetDecisionV1 {\n  const decision = strictRecord(value, [\n    \"outcome\",\n    \"selectedCandidateKey\",\n    \"reason\",\n    \"admission\",\n    \"borrowedOverlayCapacity\",\n    \"strandedEligibleCount\",\n    \"confidence\",\n    \"scores\",\n  ]);\n  const outcome = strictEnum(decision.outcome, [\"selected\", \"paced\", \"none\"] as const);\n  const selectedCandidateKey = strictOptionalKey(decision.selectedCandidateKey);\n  const reason = strictEnum(decision.reason, [\n    \"fenced_in_flight\",\n    \"fenced_candidate_missing\",\n    \"admission_paced\",\n    \"no_eligible_candidate\",\n    \"overlay_isolated_empty\",\n    \"best_score\",\n    \"affinity_best\",\n    \"hysteresis_hold\",\n  ] as const);\n  const admissionRecord = strictRecord(decision.admission, [\n    \"outcome\",\n    \"reason\",\n    \"borrowedIdleCapacity\",\n  ]);\n  const admission: CodexFleetAdmissionDecisionV1 = {\n    outcome: strictEnum(admissionRecord.outcome, [\"admit\", \"pace\"] as const),\n    reason: strictEnum(admissionRecord.reason, [\n      \"fenced_in_flight\",\n      \"pacing_disabled\",\n      \"capacity_unknown\",\n      \"capacity_available\",\n      \"work_conserving_borrow\",\n      \"manager_priority\",\n      \"standard_starvation_bound\",\n      \"capacity_saturated\",\n      \"emergency_fuse\",\n    ] as const),\n    borrowedIdleCapacity: strictBoolean(admissionRecord.borrowedIdleCapacity),\n  };\n  if (!Array.isArray(decision.scores) || decision.scores.length > candidateKeys.size) {\n    throw new Error(\"Codex fleet replay decision scores are not a bounded array\");\n  }\n  const scores = decision.scores.map(readCodexFleetScoreV1);\n  if (\n    new Set(scores.map((score) => score.candidateKey)).size !== scores.length ||\n    scores.some((score) => !candidateKeys.has(score.candidateKey))\n  ) {\n    throw new Error(\"Codex fleet replay decision has invalid candidate scores\");\n  }\n  const borrowedOverlayCapacity = strictBoolean(decision.borrowedOverlayCapacity);\n  const strandedEligibleCount = strictInteger(decision.strandedEligibleCount, 0, MAX_COUNT);\n\n  const selectedReasons = [\n    \"fenced_in_flight\",\n    \"best_score\",\n    \"affinity_best\",\n    \"hysteresis_hold\",\n  ] as const;\n  const noneReasons = [\n    \"fenced_candidate_missing\",\n    \"no_eligible_candidate\",\n    \"overlay_isolated_empty\",\n  ] as const;\n  const paceReasons = [\"manager_priority\", \"capacity_saturated\", \"emergency_fuse\"] as const;\n  const consistent =\n    outcome === \"selected\"\n      ? selectedCandidateKey !== null &&\n        admission.outcome === \"admit\" &&\n        selectedReasons.includes(reason as (typeof selectedReasons)[number]) &&\n        scores.some((score) => score.candidateKey === selectedCandidateKey)\n      : outcome === \"paced\"\n        ? selectedCandidateKey === null &&\n          reason === \"admission_paced\" &&\n          admission.outcome === \"pace\" &&\n          paceReasons.includes(admission.reason as (typeof paceReasons)[number])\n        : selectedCandidateKey === null &&\n          admission.outcome === \"admit\" &&\n          noneReasons.includes(reason as (typeof noneReasons)[number]);\n  if (\n    !consistent ||\n    strandedEligibleCount > candidateKeys.size ||\n    admission.borrowedIdleCapacity !== (admission.reason === \"work_conserving_borrow\") ||\n    (borrowedOverlayCapacity && (outcome !== \"selected\" || strandedEligibleCount !== 0))\n  ) {\n    throw new Error(\"Codex fleet replay decision is internally inconsistent\");\n  }\n\n  return {\n    outcome,\n    selectedCandidateKey,\n    reason,\n    admission,\n    borrowedOverlayCapacity,\n    strandedEligibleCount,\n    confidence: strictConfidence(decision.confidence),\n    scores,\n  };\n}\n\nfunction readCodexFleetScoreV1(value: unknown): CodexFleetScoreV1 {\n  const score = strictRecord(value, [\n    \"candidateKey\",\n    \"eligible\",\n    \"rejectionReason\",\n    \"quotaPressure\",\n    \"leasePressure\",\n    \"observedBurnPressure\",\n    \"inferredBurnPressure\",\n    \"runwayPressure\",\n    \"uncertaintyPressure\",\n    \"cacheAffinityBenefit\",\n    \"cacheState\",\n    \"overlayPreferenceBenefit\",\n    \"total\",\n    \"confidence\",\n  ]);\n  const parsed: CodexFleetScoreV1 = {\n    candidateKey: normalizeKey(strictString(score.candidateKey)),\n    eligible: strictBoolean(score.eligible),\n    rejectionReason:\n      score.rejectionReason === null\n        ? null\n        : strictEnum(score.rejectionReason, [\n            \"allocator_disabled\",\n            \"unavailable\",\n            \"cooling\",\n            \"quota_ceiling\",\n            \"overlay_isolation\",\n          ] as const),\n    quotaPressure: strictFiniteNumber(score.quotaPressure, 0, Number.MAX_SAFE_INTEGER),\n    leasePressure: strictFiniteNumber(score.leasePressure, 0, Number.MAX_SAFE_INTEGER),\n    observedBurnPressure: strictFiniteNumber(\n      score.observedBurnPressure,\n      0,\n      Number.MAX_SAFE_INTEGER,\n    ),\n    inferredBurnPressure: strictFiniteNumber(\n      score.inferredBurnPressure,\n      0,\n      Number.MAX_SAFE_INTEGER,\n    ),\n    runwayPressure: strictFiniteNumber(score.runwayPressure, 0, Number.MAX_SAFE_INTEGER),\n    uncertaintyPressure: strictFiniteNumber(score.uncertaintyPressure, 0, Number.MAX_SAFE_INTEGER),\n    cacheAffinityBenefit: strictFiniteNumber(\n      score.cacheAffinityBenefit,\n      0,\n      Number.MAX_SAFE_INTEGER,\n    ),\n    cacheState: strictEnum(score.cacheState, [\"unknown\", \"healthy\", \"collapsed\"] as const),\n    overlayPreferenceBenefit: strictFiniteNumber(\n      score.overlayPreferenceBenefit,\n      0,\n      Number.MAX_SAFE_INTEGER,\n    ),\n    total: strictFiniteNumber(score.total, -Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER),\n    confidence: strictConfidence(score.confidence),\n  };\n  const expectedTotal =\n    parsed.quotaPressure +\n    parsed.leasePressure +\n    parsed.observedBurnPressure +\n    parsed.inferredBurnPressure +\n    parsed.runwayPressure +\n    parsed.uncertaintyPressure -\n    parsed.cacheAffinityBenefit -\n    parsed.overlayPreferenceBenefit;\n  if (parsed.eligible !== (parsed.rejectionReason === null) || parsed.total !== expectedTotal) {\n    throw new Error(\"Codex fleet replay score is internally inconsistent\");\n  }\n  return parsed;\n}\n\nfunction strictRecord(value: unknown, expectedKeys: readonly string[]): Record<string, unknown> {\n  if (\n    value === null ||\n    typeof value !== \"object\" ||\n    Array.isArray(value) ||\n    ![Object.prototype, null].includes(Object.getPrototypeOf(value))\n  ) {\n    throw new Error(\"Codex fleet replay value must be a plain object\");\n  }\n  const record = value as Record<string, unknown>;\n  const actualKeys = Object.keys(record).sort(compareCodexFleetCanonicalStringsV1);\n  const canonicalExpected = [...expectedKeys].sort(compareCodexFleetCanonicalStringsV1);\n  if (canonicalJson(actualKeys) !== canonicalJson(canonicalExpected)) {\n    throw new Error(\"Codex fleet replay object has missing or unknown fields\");\n  }\n  return record;\n}\n\nfunction strictEnum<const T extends readonly string[]>(value: unknown, values: T): T[number] {\n  if (typeof value !== \"string\" || !values.includes(value)) {\n    throw new Error(\"Codex fleet replay enum value is invalid\");\n  }\n  return value as T[number];\n}\n\nfunction strictConfidence(value: unknown): CodexFleetConfidence {\n  return strictEnum(value, [\"unknown\", \"low\", \"medium\", \"high\"] as const);\n}\n\nfunction strictString(value: unknown): string {\n  if (typeof value !== \"string\") throw new Error(\"Codex fleet replay value must be a string\");\n  return value;\n}\n\nfunction strictOptionalKey(value: unknown): string | null {\n  return value === null ? null : normalizeKey(strictString(value));\n}\n\nfunction strictBoolean(value: unknown): boolean {\n  if (typeof value !== \"boolean\") throw new Error(\"Codex fleet replay value must be boolean\");\n  return value;\n}\n\nfunction strictFiniteNumber(value: unknown, min: number, max: number): number {\n  if (typeof value !== \"number\" || !Number.isFinite(value) || value < min || value > max) {\n    throw new Error(\"Codex fleet replay numeric value is invalid\");\n  }\n  return value;\n}\n\nfunction strictInteger(value: unknown, min: number, max: number): number {\n  const number = strictFiniteNumber(value, min, max);\n  if (!Number.isInteger(number)) throw new Error(\"Codex fleet replay value must be an integer\");\n  return number;\n}\n\nfunction strictSha256(value: unknown): string {\n  if (typeof value !== \"string\" || !/^[a-f0-9]{64}$/.test(value)) {\n    throw new Error(\"Codex fleet replay fingerprint must be lowercase SHA-256\");\n  }\n  return value;\n}\n\nfunction fingerprint(value: unknown): string {\n  const serialized = canonicalJson(value);\n  return bytesToHex(sha256(new TextEncoder().encode(serialized)));\n}\n\nfunction fingerprintReplayInput(\n  input: CodexFleetDecisionInputV1,\n  truncatedCandidateCount: number,\n): string {\n  // Truncation affects actual-vs-shadow comparability and the UI explanation,\n  // so it is part of the replay input's integrity boundary rather than mutable\n  // envelope metadata.\n  return fingerprint({ input, truncatedCandidateCount });\n}\n\nfunction canonicalJson(value: unknown): string {\n  return JSON.stringify(sortJson(value));\n}\n\nfunction sortJson(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(sortJson);\n  if (value && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value as Record<string, unknown>)\n        .sort(([left], [right]) => compareCodexFleetCanonicalStringsV1(left, right))\n        .map(([key, child]) => [key, sortJson(child)]),\n    );\n  }\n  return value;\n}\n","const MIN_REDACTABLE_VALUE_LENGTH = 6;\nconst REDACTED = \"[redacted]\";\nconst MAX_REDACTION_DEPTH = 64;\nconst CYCLE_MARKER = \"[OpenGeni omitted cyclic value during secret redaction]\";\nconst DEPTH_MARKER = \"[OpenGeni omitted value beyond secret-redaction depth]\";\n\nexport type SecretForRedaction = {\n  name: string;\n  value: string;\n};\n\ntype PreparedSecret = {\n  marker: string;\n  value: string;\n};\n\nconst SENSITIVE_FIELD_NAMES = new Set([\n  \"authorization\",\n  \"proxyauthorization\",\n  \"cookie\",\n  \"setcookie\",\n  \"accesstoken\",\n  \"refreshtoken\",\n  \"idtoken\",\n  \"apikey\",\n  \"secret\",\n  \"clientsecret\",\n  \"password\",\n  \"passwd\",\n  \"privatekey\",\n  \"credential\",\n  \"credentials\",\n  \"credentialencrypted\",\n  \"encryptedcredential\",\n  \"headersencrypted\",\n  \"encryptedpkceverifier\",\n  \"codeverifier\",\n  \"signingkey\",\n]);\n\nconst CREDENTIAL_HEADER_PATTERNS = [\n  /^(?:proxy-)?authorization$/i,\n  /^(?:set-)?cookie$/i,\n  /^(?:x[-_])?api[-_]?key$/i,\n  /^(?:x[-_])?(?:access|refresh|id)[-_]?token$/i,\n  /^(?:x[-_])?(?:auth|session)[-_]?(?:token|key|secret)$/i,\n  /^(?:x[-_])?(?:client|app|consumer)[-_]?secret$/i,\n  /^x-opengeni-access-key$/i,\n] as const;\n\nconst SECRET_KEY_SOURCE =\n  \"(?:proxy[-_ ]?authorization|authorization|set[-_ ]?cookie|cookie|access[-_ ]?token|refresh[-_ ]?token|id[-_ ]?token|api[-_ ]?key|client[-_ ]?secret|secret|password|passwd|private[-_ ]?key|credential(?:s|[-_ ]?encrypted)?|encrypted[-_ ]?credential|encrypted[-_ ]?pkce[-_ ]?verifier|code[-_ ]?verifier|signing[-_ ]?key)\";\nconst UNQUOTED_SECRET_KEY_SOURCE =\n  \"(?:access[-_ ]?token|refresh[-_ ]?token|id[-_ ]?token|api[-_ ]?key|client[-_ ]?secret|secret|password|passwd|private[-_ ]?key|credential(?:s|[-_ ]?encrypted)?|encrypted[-_ ]?credential|encrypted[-_ ]?pkce[-_ ]?verifier|code[-_ ]?verifier|signing[-_ ]?key)\";\n\nconst AUTHORIZATION_HEADER_PATTERN =\n  /(\\b(?:proxy-)?authorization[^\\S\\r\\n]*:[^\\S\\r\\n]*)([^\\r\\n'\"`]+)/gi;\nconst COOKIE_HEADER_PATTERN = /(\\b(?:set-cookie|cookie)\\s*:\\s*)([^\\r\\n'\"`]+)/gi;\nconst API_KEY_HEADER_PATTERN = /(\\b(?:x[-_])?api[-_]?key[^\\S\\r\\n]*:[^\\S\\r\\n]*)([^\\r\\n'\"`]+)/gi;\nconst CURL_USER_PATTERN = /((?:^|\\s)(?:-u|--user)(?:=|\\s+))(?:(\"[^\"]*\")|('[^']*')|([^\\s]+))/gm;\nconst URL_USERINFO_PATTERN = /(https?:\\/\\/)[^\\s/@]+@/gi;\nconst SIGNED_QUERY_PATTERN = new RegExp(\n  `([?&](?:sig|signature|x-amz-signature|x-amz-credential|x-amz-security-token|x-goog-signature|x-goog-credential|access_token|refresh_token|token)=)([^&#\\\\s'\"<>]+)`,\n  \"gi\",\n);\nconst QUOTED_SECRET_ASSIGNMENT_PATTERN = new RegExp(\n  `((?:[\"']${SECRET_KEY_SOURCE}[\"']|\\\\b${SECRET_KEY_SOURCE})\\\\s*[:=]\\\\s*)([\"'])(.*?)\\\\2`,\n  \"gi\",\n);\nconst UNQUOTED_SECRET_ASSIGNMENT_PATTERN = new RegExp(\n  `((?:\\\\b${UNQUOTED_SECRET_KEY_SOURCE})\\\\s*[:=]\\\\s*)([^\\\\s,;}&]+)`,\n  \"gi\",\n);\nconst SECRET_ENV_ASSIGNMENT_PATTERN =\n  /((?:^|[\\s;])(?:export\\s+)?[A-Za-z_][A-Za-z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|PRIVATE_KEY|CREDENTIAL|AUTHORIZATION|COOKIE)[A-Za-z0-9_]*\\s*=\\s*)(?:(\"[^\"]*\")|('[^']*')|([^\\s;]+))/gim;\n\nconst PROVIDER_TOKEN_PATTERNS = [\n  /\\bgithub_pat_[A-Za-z0-9_]{20,}\\b/g,\n  /\\bgh[pousr]_[A-Za-z0-9]{20,}\\b/g,\n  /\\bglpat-[A-Za-z0-9_-]{20,}\\b/g,\n  /\\bsk-[A-Za-z0-9_-]{20,}\\b/g,\n  /\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b/g,\n  /\\bAIza[0-9A-Za-z_-]{30,}\\b/g,\n  /\\b(?:AKIA|ASIA)[A-Z0-9]{16}\\b/g,\n  /\\bogd_[A-Za-z0-9._~-]{10,}\\b/g,\n  /\\beyJ[A-Za-z0-9_-]{5,}\\.[A-Za-z0-9_-]{6,}\\.[A-Za-z0-9_-]{6,}\\b/g,\n] as const;\n\n/**\n * Returns true only for fields whose value is itself credential material.\n * Container fields such as `headers` and URL fields are intentionally not\n * included: their nested/value sanitizers retain useful names, hosts, paths,\n * and non-sensitive query parameters.\n */\nexport function isSensitiveFieldName(name: string): boolean {\n  return SENSITIVE_FIELD_NAMES.has(normalizeFieldName(name));\n}\n\n/**\n * Return true only for header names whose values are credential material.\n * Ordinary protocol metadata (`content-type`, `accept`, `user-agent`, and\n * pagination/signature headers outside this allowlist) must remain intact.\n */\nexport function isCredentialHeaderName(name: string): boolean {\n  return CREDENTIAL_HEADER_PATTERNS.some((pattern) => pattern.test(name));\n}\n\n/**\n * Redact only exact known-secret provenance from a structured object key.\n * Generic field/header heuristics intentionally do not run here: a key is\n * metadata unless the caller has proved that its bytes are secret material.\n */\nexport function redactSensitiveKey(\n  key: string,\n  knownSecrets: readonly SecretForRedaction[] = [],\n): string {\n  return replacePreparedSecrets(key, prepareSecrets(knownSecrets));\n}\n\n/**\n * Redact known secret provenance and common credential-bearing text shapes.\n * This is deliberately a conservative safety boundary, not a promise of\n * general-purpose DLP. It never includes a matched value in a marker or error.\n */\nexport function redactSensitiveText(\n  text: string,\n  knownSecrets: readonly SecretForRedaction[] = [],\n): string {\n  let redacted = replacePreparedSecrets(text, prepareSecrets(knownSecrets));\n\n  redacted = redacted.replace(\n    AUTHORIZATION_HEADER_PATTERN,\n    (match, prefix: string, rawValue: string) => {\n      const value = rawValue.trimEnd();\n      const trailingWhitespace = rawValue.slice(value.length);\n      const schemeMatch = value.match(/^([A-Za-z][A-Za-z0-9_-]*)(\\s+)(.+)$/);\n      if (schemeMatch) {\n        const scheme = schemeMatch[1];\n        const whitespace = schemeMatch[2];\n        const credential = schemeMatch[3];\n        if (scheme && whitespace && credential) {\n          return isRedactionMarker(credential.trim())\n            ? match\n            : `${prefix}${scheme}${whitespace}${REDACTED}${trailingWhitespace}`;\n        }\n      }\n      return isRedactionMarker(value) ? match : `${prefix}${REDACTED}${trailingWhitespace}`;\n    },\n  );\n  redacted = redacted.replace(COOKIE_HEADER_PATTERN, `$1${REDACTED}`);\n  redacted = redacted.replace(API_KEY_HEADER_PATTERN, `$1${REDACTED}`);\n  redacted = redacted.replace(CURL_USER_PATTERN, (_match, prefix: string) => {\n    return `${prefix}${REDACTED}`;\n  });\n  redacted = redacted.replace(URL_USERINFO_PATTERN, `$1${REDACTED}@`);\n  redacted = redacted.replace(SIGNED_QUERY_PATTERN, `$1${REDACTED}`);\n  redacted = redacted.replace(\n    QUOTED_SECRET_ASSIGNMENT_PATTERN,\n    (match, prefix: string, quote: string, value: string) =>\n      isRedactionMarker(value) ? match : `${prefix}${quote}${REDACTED}${quote}`,\n  );\n  redacted = redacted.replace(\n    UNQUOTED_SECRET_ASSIGNMENT_PATTERN,\n    (match, prefix: string, value: string) =>\n      isRedactionMarker(value) ? match : `${prefix}${REDACTED}`,\n  );\n  redacted = redacted.replace(\n    SECRET_ENV_ASSIGNMENT_PATTERN,\n    (\n      match,\n      prefix: string,\n      doubleQuoted: string | undefined,\n      singleQuoted: string | undefined,\n      bare: string | undefined,\n    ) => {\n      const value = doubleQuoted ?? singleQuoted ?? bare ?? \"\";\n      return isRedactionMarker(stripMatchingQuotes(value)) ? match : `${prefix}${REDACTED}`;\n    },\n  );\n  for (const pattern of PROVIDER_TOKEN_PATTERNS) {\n    redacted = redacted.replace(pattern, REDACTED);\n  }\n  return redacted;\n}\n\n/** Deeply redact plain structured data while retaining its diagnostic shape. */\nexport function redactSensitiveData<T>(\n  value: T,\n  knownSecrets: readonly SecretForRedaction[] = [],\n): T {\n  return redactSensitiveDataDeep(value, knownSecrets, new WeakSet<object>(), 0);\n}\n\n/** Build the worker-friendly single-argument redactor used at turn boundaries. */\nexport function createSecretRedactor(\n  knownSecrets: readonly SecretForRedaction[],\n): (value: unknown) => unknown {\n  const prepared = prepareSecrets(knownSecrets).map(({ marker, value }) => ({\n    name: marker.slice(\"[redacted:\".length, -1),\n    value,\n  }));\n  return (value: unknown) => redactSensitiveData(value, prepared);\n}\n\n/**\n * Redact a serialized JSON checkpoint without requiring it to be valid JSON.\n * Valid JSON retains structure; malformed/opaque text still receives text\n * classification and exact-known-value replacement.\n */\nexport function redactSerializedJson(\n  serialized: string,\n  knownSecrets: readonly SecretForRedaction[] = [],\n): string {\n  try {\n    return JSON.stringify(redactSensitiveData(JSON.parse(serialized), knownSecrets));\n  } catch {\n    return redactSensitiveText(serialized, knownSecrets);\n  }\n}\n\nexport function identityRedactor<T>(value: T): T {\n  return value;\n}\n\nfunction redactSensitiveDataDeep<T>(\n  value: T,\n  knownSecrets: readonly SecretForRedaction[],\n  seen: WeakSet<object>,\n  depth: number,\n): T {\n  if (typeof value === \"string\") {\n    return redactSensitiveText(value, knownSecrets) as T;\n  }\n  if (!value || typeof value !== \"object\" || value instanceof Date) {\n    return value;\n  }\n  if (depth >= MAX_REDACTION_DEPTH) {\n    return DEPTH_MARKER as T;\n  }\n  if (seen.has(value)) {\n    return CYCLE_MARKER as T;\n  }\n  seen.add(value);\n  try {\n    if (Array.isArray(value)) {\n      return value.map((item) => redactSensitiveDataDeep(item, knownSecrets, seen, depth + 1)) as T;\n    }\n    if (!isPlainObject(value)) {\n      return value;\n    }\n    const usedKeys = new Set<string>();\n    return Object.fromEntries(\n      Object.entries(value).map(([key, child]) => {\n        const safeKey = nextUniqueKey(redactSensitiveKey(key, knownSecrets), usedKeys);\n        if (isSensitiveFieldName(key)) {\n          return [safeKey, REDACTED] as const;\n        }\n        if (normalizeFieldName(key) === \"headers\") {\n          return [safeKey, redactHeaderMap(child, knownSecrets, seen, depth + 1)] as const;\n        }\n        return [safeKey, redactSensitiveDataDeep(child, knownSecrets, seen, depth + 1)] as const;\n      }),\n    ) as T;\n  } finally {\n    seen.delete(value);\n  }\n}\n\nfunction redactHeaderMap(\n  value: unknown,\n  knownSecrets: readonly SecretForRedaction[],\n  seen: WeakSet<object>,\n  depth: number,\n): unknown {\n  if (!isPlainObject(value)) {\n    return redactSensitiveDataDeep(value, knownSecrets, seen, depth);\n  }\n  if (depth >= MAX_REDACTION_DEPTH) return DEPTH_MARKER;\n  if (seen.has(value)) return CYCLE_MARKER;\n  seen.add(value);\n  try {\n    const usedKeys = new Set<string>();\n    return Object.fromEntries(\n      Object.entries(value).map(([key, child]) => {\n        const safeKey = nextUniqueKey(redactSensitiveKey(key, knownSecrets), usedKeys);\n        return [\n          safeKey,\n          isCredentialHeaderName(key)\n            ? REDACTED\n            : redactSensitiveDataDeep(child, knownSecrets, seen, depth + 1),\n        ];\n      }),\n    );\n  } finally {\n    seen.delete(value);\n  }\n}\n\nfunction prepareSecrets(knownSecrets: readonly SecretForRedaction[]): PreparedSecret[] {\n  const unique = new Map<string, string>();\n  for (const secret of knownSecrets) {\n    if (secret.value.length < MIN_REDACTABLE_VALUE_LENGTH || unique.has(secret.value)) {\n      continue;\n    }\n    unique.set(secret.value, `[redacted:${safeSecretName(secret.name)}]`);\n  }\n  return [...unique]\n    .map(([value, marker]) => ({ marker, value }))\n    .sort((a, b) => b.value.length - a.value.length || a.marker.localeCompare(b.marker));\n}\n\nfunction replacePreparedSecrets(text: string, prepared: readonly PreparedSecret[]): string {\n  let redacted = text;\n  for (const secret of prepared) {\n    if (redacted.includes(secret.value)) {\n      redacted = redacted.split(secret.value).join(secret.marker);\n    }\n  }\n  return redacted;\n}\n\nfunction nextUniqueKey(base: string, usedKeys: Set<string>): string {\n  let candidate = base;\n  let suffix = 2;\n  while (usedKeys.has(candidate)) {\n    candidate = `${base}#${suffix}`;\n    suffix += 1;\n  }\n  usedKeys.add(candidate);\n  return candidate;\n}\n\nfunction safeSecretName(name: string): string {\n  const safe = name\n    .toUpperCase()\n    .replace(/[^A-Z0-9_]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n  return safe.slice(0, 64) || \"KNOWN_SECRET\";\n}\n\nfunction normalizeFieldName(name: string): string {\n  return name.toLowerCase().replace(/[-_\\s]/g, \"\");\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (!value || typeof value !== \"object\") return false;\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\n\nfunction isRedactionMarker(value: string): boolean {\n  return /^\\[redacted(?::[A-Z0-9_]{1,64})?\\]$/.test(value);\n}\n\nfunction stripMatchingQuotes(value: string): string {\n  if (\n    value.length >= 2 &&\n    ((value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\")))\n  ) {\n    return value.slice(1, -1);\n  }\n  return value;\n}\n","import { z } from \"zod\";\n\nexport const WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS = 262_144;\nexport const WORKSPACE_INSTRUCTION_POLICY_REASON_MAX_CHARS = 4_096;\nexport const WORKSPACE_INSTRUCTION_POLICY_ROLE_KEY_MAX_CHARS = 64;\nexport const WORKSPACE_INSTRUCTION_POLICY_SOURCE_ID_MAX_CHARS = 512;\n\nexport const WorkspaceInstructionPolicyKind = z.enum([\"charter\", \"policy\"]);\nexport type WorkspaceInstructionPolicyKind = z.infer<typeof WorkspaceInstructionPolicyKind>;\n\nexport const WorkspaceInstructionPolicyScope = z.enum([\"global\", \"role\"]);\nexport type WorkspaceInstructionPolicyScope = z.infer<typeof WorkspaceInstructionPolicyScope>;\n\nexport const WorkspaceInstructionPolicyProvenanceSource = z.enum([\n  \"human\",\n  \"onboarding\",\n  \"knowledge_proposal\",\n  \"legacy_import\",\n]);\nexport type WorkspaceInstructionPolicyProvenanceSource = z.infer<\n  typeof WorkspaceInstructionPolicyProvenanceSource\n>;\n\nexport const WorkspaceInstructionPolicyDraftProvenanceSource = z.enum([\n  \"human\",\n  \"onboarding\",\n  \"knowledge_proposal\",\n]);\nexport type WorkspaceInstructionPolicyDraftProvenanceSource = z.infer<\n  typeof WorkspaceInstructionPolicyDraftProvenanceSource\n>;\n\nexport const WorkspaceInstructionPolicyActivationType = z.enum([\"activate\", \"rollback\"]);\nexport type WorkspaceInstructionPolicyActivationType = z.infer<\n  typeof WorkspaceInstructionPolicyActivationType\n>;\n\nexport const WorkspaceInstructionPolicyRoleKey = z\n  .string()\n  .min(1)\n  .max(WORKSPACE_INSTRUCTION_POLICY_ROLE_KEY_MAX_CHARS)\n  .regex(/^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$/);\nexport type WorkspaceInstructionPolicyRoleKey = z.infer<typeof WorkspaceInstructionPolicyRoleKey>;\n\n/**\n * Role-policy keys are identifiers rather than display names. Normalize once\n * at ingress so activation uniqueness and every client use the same key.\n */\nexport function normalizeWorkspaceInstructionPolicyRoleKey(value: string): string {\n  return value.normalize(\"NFKC\").trim().toLowerCase().replace(/\\s+/gu, \"-\").replace(/-+/g, \"-\");\n}\n\nconst RequestRoleKey = z\n  .string()\n  .transform(normalizeWorkspaceInstructionPolicyRoleKey)\n  .pipe(WorkspaceInstructionPolicyRoleKey);\n\nconst targetShape = {\n  kind: WorkspaceInstructionPolicyKind,\n  scope: WorkspaceInstructionPolicyScope,\n  roleKey: WorkspaceInstructionPolicyRoleKey.nullable(),\n};\n\nfunction validateTarget(\n  value: {\n    kind: WorkspaceInstructionPolicyKind;\n    scope: WorkspaceInstructionPolicyScope;\n    roleKey: string | null;\n  },\n  context: z.RefinementCtx,\n): void {\n  if (value.kind === \"charter\" && (value.scope !== \"global\" || value.roleKey !== null)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"scope\"],\n      message: \"a charter must use global scope with no role key\",\n    });\n  }\n  if (value.scope === \"global\" && value.roleKey !== null) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"roleKey\"],\n      message: \"a global instruction policy must not have a role key\",\n    });\n  }\n  if (value.scope === \"role\" && (value.kind !== \"policy\" || value.roleKey === null)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"roleKey\"],\n      message: \"role scope requires a policy and a normalized role key\",\n    });\n  }\n}\n\nexport const WorkspaceInstructionPolicyTarget = z.object(targetShape).superRefine(validateTarget);\nexport type WorkspaceInstructionPolicyTarget = z.infer<typeof WorkspaceInstructionPolicyTarget>;\n\nexport const WorkspaceInstructionPolicyProvenance = z.object({\n  source: WorkspaceInstructionPolicyProvenanceSource,\n  sourceId: z.string().min(1).max(WORKSPACE_INSTRUCTION_POLICY_SOURCE_ID_MAX_CHARS).nullable(),\n});\nexport type WorkspaceInstructionPolicyProvenance = z.infer<\n  typeof WorkspaceInstructionPolicyProvenance\n>;\n\nconst revisionIdentityShape = {\n  id: z.string().uuid(),\n  revision: z.number().int().positive(),\n  contentHash: z.string().regex(/^[0-9a-f]{64}$/),\n};\n\nexport const WorkspaceInstructionPolicyRevisionIdentity = z.object(revisionIdentityShape);\nexport type WorkspaceInstructionPolicyRevisionIdentity = z.infer<\n  typeof WorkspaceInstructionPolicyRevisionIdentity\n>;\n\nexport const WorkspaceInstructionPolicyRevision = z.object({\n  ...revisionIdentityShape,\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  ...targetShape,\n  content: z.string().min(1).max(WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS),\n  provenance: WorkspaceInstructionPolicyProvenance,\n  supersedesRevisionId: z.string().uuid().nullable(),\n  createdBySubjectId: z.string().min(1),\n  createdAt: z.string().datetime(),\n});\nexport type WorkspaceInstructionPolicyRevision = z.infer<typeof WorkspaceInstructionPolicyRevision>;\n\nexport const WorkspaceInstructionPolicyHead = z.object({\n  workspaceId: z.string().uuid(),\n  ...targetShape,\n  revisionId: z.string().uuid(),\n  revision: z.number().int().positive(),\n  contentHash: z.string().regex(/^[0-9a-f]{64}$/),\n  activationVersion: z.number().int().positive(),\n  activatedAt: z.string().datetime(),\n});\nexport type WorkspaceInstructionPolicyHead = z.infer<typeof WorkspaceInstructionPolicyHead>;\n\nexport const WorkspaceInstructionPolicyActivationEvent = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  ...targetShape,\n  type: WorkspaceInstructionPolicyActivationType,\n  activationVersion: z.number().int().positive(),\n  oldRevision: WorkspaceInstructionPolicyRevisionIdentity.nullable(),\n  newRevision: WorkspaceInstructionPolicyRevisionIdentity,\n  actorSubjectId: z.string().min(1),\n  reason: z.string().min(1).max(WORKSPACE_INSTRUCTION_POLICY_REASON_MAX_CHARS),\n  createdAt: z.string().datetime(),\n});\nexport type WorkspaceInstructionPolicyActivationEvent = z.infer<\n  typeof WorkspaceInstructionPolicyActivationEvent\n>;\n\nexport const CreateWorkspaceInstructionPolicyDraftRequest = z\n  .object({\n    kind: WorkspaceInstructionPolicyKind,\n    scope: WorkspaceInstructionPolicyScope,\n    roleKey: RequestRoleKey.nullable().default(null),\n    content: z\n      .string()\n      .min(1)\n      .max(WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS)\n      .refine((value) => value.trim().length > 0, \"instruction policy content must not be blank\"),\n    provenanceSource: WorkspaceInstructionPolicyDraftProvenanceSource.default(\"human\"),\n    provenanceSourceId: z\n      .string()\n      .min(1)\n      .max(WORKSPACE_INSTRUCTION_POLICY_SOURCE_ID_MAX_CHARS)\n      .nullable()\n      .default(null),\n    supersedesRevisionId: z.string().uuid().nullable().default(null),\n  })\n  .superRefine(validateTarget);\nexport type CreateWorkspaceInstructionPolicyDraftRequest = z.infer<\n  typeof CreateWorkspaceInstructionPolicyDraftRequest\n>;\n\nexport const ImportLegacyWorkspaceInstructionPolicyDraftRequest = z\n  .object({\n    supersedesRevisionId: z.string().uuid().nullable().default(null),\n  })\n  .strict();\nexport type ImportLegacyWorkspaceInstructionPolicyDraftRequest = z.infer<\n  typeof ImportLegacyWorkspaceInstructionPolicyDraftRequest\n>;\n\nexport const WorkspaceInstructionPolicyListQuery = z.object({\n  kind: WorkspaceInstructionPolicyKind.optional(),\n  scope: WorkspaceInstructionPolicyScope.optional(),\n  roleKey: RequestRoleKey.nullable().optional(),\n  afterRevision: z.coerce.number().int().positive().optional(),\n  limit: z.coerce.number().int().min(1).max(100).default(50),\n});\nexport type WorkspaceInstructionPolicyListQuery = z.infer<\n  typeof WorkspaceInstructionPolicyListQuery\n>;\n\nexport const WorkspaceInstructionPolicyListResponse = z.object({\n  revisions: z.array(WorkspaceInstructionPolicyRevision),\n  activeHeads: z.array(WorkspaceInstructionPolicyHead),\n  activationEvents: z.array(WorkspaceInstructionPolicyActivationEvent),\n  nextAfterRevision: z.number().int().positive().nullable(),\n});\nexport type WorkspaceInstructionPolicyListResponse = z.infer<\n  typeof WorkspaceInstructionPolicyListResponse\n>;\n\nexport const WorkspaceInstructionPolicyDiffRequest = z\n  .object({\n    fromRevisionId: z.string().uuid(),\n    toRevisionId: z.string().uuid(),\n  })\n  .refine((value) => value.fromRevisionId !== value.toRevisionId, {\n    message: \"diff revisions must be different\",\n    path: [\"toRevisionId\"],\n  });\nexport type WorkspaceInstructionPolicyDiffRequest = z.infer<\n  typeof WorkspaceInstructionPolicyDiffRequest\n>;\n\nexport const WorkspaceInstructionPolicyDiffResponse = z.object({\n  from: WorkspaceInstructionPolicyRevision,\n  to: WorkspaceInstructionPolicyRevision,\n  format: z.literal(\"unified\"),\n  diff: z.string(),\n});\nexport type WorkspaceInstructionPolicyDiffResponse = z.infer<\n  typeof WorkspaceInstructionPolicyDiffResponse\n>;\n\nexport const ActivateWorkspaceInstructionPolicyRequest = z.object({\n  expectedCurrentRevisionId: z.string().uuid().nullable(),\n  reason: z.string().trim().min(1).max(WORKSPACE_INSTRUCTION_POLICY_REASON_MAX_CHARS),\n});\nexport type ActivateWorkspaceInstructionPolicyRequest = z.infer<\n  typeof ActivateWorkspaceInstructionPolicyRequest\n>;\n\nexport const RollbackWorkspaceInstructionPolicyRequest = z.object({\n  targetRevisionId: z.string().uuid(),\n  expectedCurrentRevisionId: z.string().uuid(),\n  reason: z.string().trim().min(1).max(WORKSPACE_INSTRUCTION_POLICY_REASON_MAX_CHARS),\n});\nexport type RollbackWorkspaceInstructionPolicyRequest = z.infer<\n  typeof RollbackWorkspaceInstructionPolicyRequest\n>;\n\nexport const WorkspaceInstructionPolicyActivationResponse = z.object({\n  head: WorkspaceInstructionPolicyHead,\n  event: WorkspaceInstructionPolicyActivationEvent,\n});\nexport type WorkspaceInstructionPolicyActivationResponse = z.infer<\n  typeof WorkspaceInstructionPolicyActivationResponse\n>;\n\nexport const WorkspaceInstructionPolicyConflictResponse = z.object({\n  code: z.literal(\"WORKSPACE_INSTRUCTION_POLICY_CONFLICT\"),\n  message: z.string(),\n  currentHead: WorkspaceInstructionPolicyHead.nullable(),\n});\nexport type WorkspaceInstructionPolicyConflictResponse = z.infer<\n  typeof WorkspaceInstructionPolicyConflictResponse\n>;\n"],"mappings":";AAAA,SAAS,KAAAA,UAAS;;;ACAlB,SAAS,SAAS;AAGX,IAAM,iCAAiC,OAAO;AAE9C,IAAM,qCAAqC,MAAM;AAEjD,IAAM,oCAAoC,IAAI;AAErD,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,iBAAiB;AACvB,IAAM,mBAAmB;AACzB,IAAM,uBAAuB;AAC7B,IAAM,iBAAiB;AAEhB,IAAM,qBAAqB,EAAE,KAAK;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,kCAAkC,EAAE,KAAK;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,0CAA0C,EAC7C,OAAO;AAAA,EACN,WAAW,EAAE,QAAQ,KAAK;AAAA,EAC1B,QAAQ;AACV,CAAC,EACA,OAAO;AAEH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,WAAW,EAAE,QAAQ,IAAI;AAAA,EACzB,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc;AAAA,EAC3C,MAAM;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,MAAM,oBAAoB;AAAA,EAC3D,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK;AAAA,EACnD,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EACzC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,WAAW,EACR,OAAO;AAAA,IACN,QAAQ,EAAE,QAAQ,gBAAgB;AAAA,IAClC,WAAW,EAAE,KAAK;AAAA,EACpB,CAAC,EACA,OAAO;AAAA,EACV,WAAW,EACR,OAAO;AAAA,IACN,QAAQ,EAAE,QAAQ,KAAK;AAAA,IACvB,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,IACxB,cAAc,EAAE,QAAQ,OAAO;AAAA,IAC/B,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,8BAA8B;AAAA,EAC/E,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,QAAQ;AAC3B,QAAM,QAAQ,eAAe,KAAK,MAAM,UAAU,IAAI;AACtD,MAAI,CAAC,SAAS,CAAC,eAAe,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,MAAM,CAAC,MAAM,MAAM,YAAY;AACnF,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,aAAa,MAAM;AAAA,MAC1B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,MAAI,QAAQ,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa,mCAAmC;AACxF,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AASI,IAAM,+BAA+B,EAAE,mBAAmB,aAAa;AAAA,EAC5E;AAAA,EACA;AACF,CAAC;AAMM,IAAM,oCAAoC,EAC9C,OAAO;AAAA,EACN,WAAW,EAAE,QAAQ,KAAK;AAAA,EAC1B,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc;AAAA,EAC3C,QAAQ;AACV,CAAC,EACA,OAAO;AAIH,IAAM,iCAAiC,EAAE,MAAM;AAAA,EACpD;AAAA,EACA;AACF,CAAC;AAkBM,SAAS,kCACd,MACA,OAA2B,QACO;AAClC,MAAI,KAAK,WAAW,WAAW,CAAC,KAAK,OAAQ,QAAO;AACpD,QAAM,QAAQ;AAAA,IACZ,WAAW;AAAA,IACX,YAAY,KAAK;AAAA,IACjB;AAAA,IACA,aAAa,6BAA6B,KAAK,WAAW;AAAA,IAC1D,eAAe,KAAK;AAAA,IACpB,QAAQ,KAAK;AAAA,IACb,YAAY,KAAK;AAAA,IACjB,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,MAAM,kBAAkB,KAAK,WAAW,cAAc,KAAK,EAAE;AAAA,MAC7D,cAAc;AAAA,MACd,eAAe;AAAA,IACjB;AAAA,EACF;AACA,QAAM,SAAS,gCAAgC,UAAU,KAAK;AAC9D,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,SAAS,6BAA6B,OAAuB;AAC3D,QAAM,YAAY,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,YAAY,KAAK;AAClE,SAAO,qBAAqB,KAAK,SAAS,IAAI,YAAY;AAC5D;AAGO,SAAS,+BAA+B,OAA+C;AAC5F,QAAM,SAAS,6BAA6B,UAAU,KAAK;AAC3D,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEO,SAAS,0BACd,SAA0C,gBAClB;AACxB,SAAO,EAAE,WAAW,OAAO,OAAO;AACpC;AAwCO,SAAS,2BACd,aACA,YACA,eAAe,oCACgB;AAC/B,oBAAkB,YAAY,YAAY;AAE1C,MAAI,gBAAgB,QAAQ,gBAAgB,UAAa,gBAAgB,IAAI;AAC3E,QAAI,eAAe,GAAG;AACpB,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,IACF;AACA,UAAM,MAAM,KAAK,IAAI,aAAa,GAAG,eAAe,CAAC;AACrD,UAAM,UAAU,MAAM,IAAI;AAC1B,WAAO,cAAc,GAAG,KAAK,YAAY,UAAU,MAAM,GAAG;AAAA,EAC9D;AAEA,MAAI,YAAY,SAAS,OAAO,eAAe,KAAK,WAAW,GAAG;AAChE,WAAO,aAAa,aAAa,YAAY;AAAA,EAC/C;AACA,MAAI,YAAY,SAAS,GAAG,GAAG;AAC7B,WAAO,aAAa,2BAA2B,YAAY;AAAA,EAC7D;AACA,QAAM,QAAQ,sBAAsB,KAAK,WAAW;AACpD,MAAI,CAAC,SAAU,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAI;AACtC,WAAO,aAAa,aAAa,YAAY;AAAA,EAC/C;AAEA,QAAM,QAAQ,kBAAkB,MAAM,CAAC,CAAC;AACxC,QAAM,SAAS,kBAAkB,MAAM,CAAC,CAAC;AACzC,MAAI,UAAU,cAAc,WAAW,YAAY;AACjD,WAAO,aAAa,oBAAoB,YAAY;AAAA,EACtD;AAEA,MAAI,UAAU,MAAM;AAClB,UAAM,eAAe;AACrB,QAAI,iBAAiB,KAAM,QAAO,aAAa,aAAa,YAAY;AACxE,QAAI,iBAAiB,EAAG,QAAO,mBAAmB,eAAe,UAAU;AAC3E,QAAI,eAAe,aAAc,QAAO,aAAa,mBAAmB,YAAY;AACpF,QAAI,eAAe,EAAG,QAAO,mBAAmB,kBAAkB,UAAU;AAC5E,UAAM,SAAS,KAAK,IAAI,cAAc,UAAU;AAChD,WAAO,cAAc,aAAa,QAAQ,aAAa,GAAG,YAAY,GAAG;AAAA,EAC3E;AAEA,MAAI,eAAe,EAAG,QAAO,mBAAmB,kBAAkB,UAAU;AAC5E,MAAI,SAAS,WAAY,QAAO,mBAAmB,uBAAuB,UAAU;AAEpF,MAAI,WAAW,MAAM;AACnB,UAAM,MAAM,KAAK,IAAI,aAAa,GAAG,QAAQ,eAAe,CAAC;AAC7D,WAAO,cAAc,OAAO,KAAK,YAAY,GAAG;AAAA,EAClD;AACA,MAAI,SAAS,MAAO,QAAO,mBAAmB,oBAAoB,UAAU;AAC5E,MAAI,SAAS,SAAS,cAAc;AAClC,WAAO,aAAa,mBAAmB,YAAY;AAAA,EACrD;AACA,SAAO,cAAc,OAAO,KAAK,IAAI,QAAQ,aAAa,CAAC,GAAG,YAAY,GAAG;AAC/E;AAEA,SAAS,kBAAkB,YAAoB,cAA4B;AACzE,MAAI,CAAC,OAAO,cAAc,UAAU,KAAK,aAAa,GAAG;AACvD,UAAM,IAAI,WAAW,+CAA+C;AAAA,EACtE;AACA,MACE,CAAC,OAAO,cAAc,YAAY,KAClC,gBAAgB,KAChB,eAAe,gCACf;AACA,UAAM,IAAI;AAAA,MACR,iDAAiD,8BAA8B;AAAA,IACjF;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,OAAuD;AAChF,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI,MAAM,SAAS,GAAI,QAAO;AAC9B,QAAM,SAAS,OAAO,KAAK;AAC3B,SAAO,OAAO,cAAc,MAAM,IAAI,SAAS;AACjD;AAEA,SAAS,cACP,OACA,KACA,YACA,QAC6B;AAC7B,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,QAAQ,MAAM,QAAQ;AAAA,IACtB;AAAA,IACA;AAAA,IACA,cAAc,WAAW,MAAM,SAAS,KAAK,IAAI,GAAG,IAAI,UAAU,KAAK;AAAA,IACvE,cAAc;AAAA,EAChB;AACF;AAEA,SAAS,aACP,QACA,cAC+B;AAC/B,SAAO,EAAE,MAAM,WAAW,QAAQ,aAAa;AACjD;AAEA,SAAS,mBACP,QACA,YAC+B;AAC/B,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,cAAc,WAAW,UAAU;AAAA,EACrC;AACF;;;ACnUO,IAAM,kCAAkC,KAAK;AAEpD,IAAM,uBAAuB,KAAK;AAClC,IAAM,uBAAuB,IAAI;AACjC,IAAM,qBAAqB;AAC3B,IAAM,wBAAwB;AAC9B,IAAM,sBAAsB;AAC5B,IAAM,wBAAwB;AAC9B,IAAM,sBAAsB;AAC5B,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB;AAC9B,IAAM,wBAAwB;AAC9B,IAAM,qBAAqB;AAC3B,IAAM,yBAAyB;AAC/B,IAAMC,WAAU,IAAI,YAAY;AAEhC,IAAM,kBAAkB,oBAAI,IAAI;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAgFM,SAAS,sBAAsB,OAAwB;AAC5D,SAAOA,SAAQ,OAAO,qBAAqB,KAAK,CAAC,EAAE;AACrD;AAQO,SAAS,wBAAwB,OAA6C;AACnF,SAAO,iBAAiB,KAAK;AAC/B;AAGO,SAAS,8BAA8B,OAAuB;AACnE,SAAO,KAAK,KAAK,KAAK,IAAI,GAAG,KAAK,IAAI,sBAAsB;AAC9D;AAGO,SAAS,yBACd,WACA,aAC0B;AAC1B,SAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,aAAa;AAAA,IACxB,aACE,gBAAgB,OACZ,OACA,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,SAAS,WAAW,IAAI,cAAc,CAAC,CAAC;AAAA,IAC5E,qBAAqB;AAAA,IACrB,SAAS;AAAA,EACX;AACF;AAGO,SAAS,oCACd,OACiC;AACjC,QAAM,QAAQ,qCAAqC,KAAK,KAAK;AAC7D,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,gBAAgB,KAAK,IAAI,GAAG,MAAM,SAAS,MAAM,CAAC,EAAE,MAAM;AAChE,QAAM,UAAU,MAAM,SAAS,IAAI,IAAI,IAAI,MAAM,SAAS,GAAG,IAAI,IAAI;AACrE,SAAO;AAAA,IACL,MAAM,CAAC,KAAK;AAAA,IACZ,KAAK,IAAI,GAAG,KAAK,MAAO,gBAAgB,IAAK,CAAC,IAAI,OAAO;AAAA,EAC3D;AACF;AAGO,SAAS,8BACd,SACsC;AACtC,MAAI,CAAC,cAAc,OAAO,EAAG,QAAO;AACpC,QAAM,QAAQ,QAAQ;AACtB,MAAI,CAAC,cAAc,KAAK,KAAK,MAAM,cAAc,KAAM,QAAO;AAC9D,SAAO;AACT;AAQO,SAAS,yBACd,SACA,UAA2C,CAAC,GACzC;AACH,QAAM,WAAW,KAAK,IAAI,MAAM,KAAK,MAAM,QAAQ,YAAY,+BAA+B,CAAC;AAC/F,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,eACJ,+BAA+B,QAAQ,YAAY,KAAK,0BAA0B;AACpF,QAAM,sBAAsB,iBAAiB,OAAO;AACpD,QAAM,gBAAgB,oBAAoB;AAE1C,MAAI,QAAQ,aAAa,sBAAsB,uBAAuB,qBAAqB;AAC3F,MAAI,UAAU,aAAa,SAAS,OAAO,KAAK,CAAC;AACjD,MAAI,CAAC,MAAM,WAAW,kBAAkB,QAAQ,iBAAiB,UAAU;AACzE,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,wBAAwB,qBAAqB,KAAK;AAC/D,MAAI,UAAU;AAAA,IACZ;AAAA,IACA,iBAAiB,SAAS,QAAQ,eAAe,OAAO,YAAY;AAAA,EACtE;AAEA,MAAI,sBAAsB,OAAO,IAAI,KAAK,IAAI,UAAU,oBAAoB,GAAG;AAC7E,YAAQ,aAAa,oBAAoB,qBAAqB,mBAAmB;AACjF,cAAU,aAAa,SAAS,OAAO,KAAK,CAAC;AAC7C,aAAS,wBAAwB,qBAAqB,KAAK;AAC3D,cAAU;AAAA,MACR;AAAA,MACA,iBAAiB,SAAS,QAAQ,eAAe,OAAO,YAAY;AAAA,IACtE;AAAA,EACF;AAEA,MAAI,sBAAsB,OAAO,IAAI,UAAU;AAC7C,UAAM,WAAW,gBAAgB,OAAO;AACxC,UAAM,UAAU;AAChB,iBAAa,OAAO;AAAA,MAClB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,GAAI,kBAAkB,OAAO,CAAC,IAAI,EAAE,cAAc;AAAA,IACpD,CAAC;AACD,cAAU;AAAA,MACR;AAAA,QACE,GAAG;AAAA,QACH,SAAS;AAAA,MACX;AAAA,MACA,iBAAiB,SAAS,QAAQ,eAAe,OAAO,YAAY;AAAA,IACtE;AAAA,EACF;AAEA,uBAAqB,SAAS,QAAQ;AACtC,SAAO;AACT;AAEA,SAAS,aACP,aACA,cACA,cACc;AACd,SAAO;AAAA,IACL,SAAS;AAAA,IACT,UAAU;AAAA,IACV,SAAS,CAAC;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,EAClB;AACF;AAEA,SAAS,wBACP,aACA,OACyC;AACzC,MAAI,MAAM,SAAU,QAAO;AAC3B,SAAO,YAAY,UAAU,OAAO,YAAY,SAAS;AAC3D;AAEA,SAAS,aAAa,OAAgB,OAAqB,MAAc,OAAwB;AAC/F,MAAI,MAAM,kBAAkB,GAAG;AAC7B,UAAM,UAAU;AAChB,iBAAa,OAAO,EAAE,MAAM,MAAM,SAAS,CAAC;AAC5C,WAAO;AAAA,EACT;AACA,QAAM,kBAAkB;AACxB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,QAAQ,gBAAgB,KAAK;AACnC,QAAI,OAAO;AACT,YAAM,UAAU;AAChB,YAAM,WAAW;AACjB,mBAAa,OAAO;AAAA,QAClB;AAAA,QACA,MAAM;AAAA,QACN,eAAe,UAAU,KAAK;AAAA,QAC9B,gBAAgB,sBAAsB,KAAK;AAAA,QAC3C,WAAW,MAAM;AAAA,MACnB,CAAC;AACD,aAAO;AAAA,IACT;AACA,UAAM,gBAAgB,UAAU,KAAK;AACrC,QAAI,iBAAiB,MAAM,YAAa,QAAO;AAC/C,UAAM,UAAU;AAChB,UAAM,YAAY,mBAAmB,OAAO,MAAM,aAAa,aAAa;AAC5E,iBAAa,OAAO;AAAA,MAClB;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,gBAAgB,UAAU,SAAS;AAAA,IACrC,CAAC;AACD,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,cAAc,OAAO,UAAU,UAAU;AACzF,UAAM,UAAU;AAChB,iBAAa,OAAO,EAAE,MAAM,MAAM,iBAAiB,CAAC;AACpD,WAAO,IAAI,OAAO,KAAK;AAAA,EACzB;AACA,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AAExD,QAAM,SAAS,WAAW,KAAK;AAC/B,MAAI,QAAQ;AACV,UAAM,UAAU;AAChB,iBAAa,OAAO;AAAA,MAClB;AAAA,MACA,MAAM;AAAA,MACN,eAAe,OAAO;AAAA,MACtB,gBAAgB,sBAAsB,OAAO,OAAO;AAAA,IACtD,CAAC;AACD,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,SAAS,mBAAmB;AAC9B,UAAM,UAAU;AAChB,iBAAa,OAAO,EAAE,MAAM,MAAM,QAAQ,CAAC;AAC3C,WAAO;AAAA,EACT;AAEA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,OAAO,KAAK,IAAI,GAAG,MAAM,YAAY;AAC3C,QAAI,MAAM,UAAU,MAAM;AACxB,aAAO,MAAM;AAAA,QAAK,EAAE,QAAQ,MAAM,OAAO;AAAA,QAAG,CAAC,GAAG,UAC9C,kBAAkB,OAAO,OAAO,OAAO,MAAM,KAAK;AAAA,MACpD;AAAA,IACF;AACA,UAAM,UAAU;AAChB,UAAM,OAAO,KAAK,KAAK,OAAO,CAAC;AAC/B,UAAM,OAAO,KAAK,MAAM,OAAO,CAAC;AAChC,UAAMC,WAAU,MAAM,SAAS,OAAO;AACtC,iBAAa,OAAO,EAAE,MAAM,MAAM,SAAS,gBAAgBA,SAAQ,CAAC;AACpE,WAAO;AAAA,MACL,GAAG,MAAM;AAAA,QAAK,EAAE,QAAQ,KAAK;AAAA,QAAG,CAAC,GAAG,UAClC,kBAAkB,OAAO,OAAO,OAAO,MAAM,KAAK;AAAA,MACpD;AAAA,MACA,EAAE,gBAAgBA,UAAS,SAAS,iCAAiC;AAAA,MACrE,GAAG,MAAM;AAAA,QAAK,EAAE,QAAQ,KAAK;AAAA,QAAG,CAAC,GAAG,UAClC,kBAAkB,OAAO,MAAM,SAAS,OAAO,OAAO,OAAO,MAAM,KAAK;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEA,MAAI,iBAAiB,MAAM;AACzB,QAAI,CAAC,8BAA8B,KAAK,GAAG;AACzC,YAAM,UAAU;AAChB,mBAAa,OAAO,EAAE,MAAM,MAAM,iBAAiB,CAAC;AACpD,aAAO;AAAA,IACT;AACA,QAAI;AACF,YAAM,QAAQ,KAAK,UAAU,QAAQ,KAAK,KAAK;AAC/C,aAAO,OAAO,SAAS,KAAK,IAAI,KAAK,UAAU,YAAY,KAAK,KAAK,IAAI;AAAA,IAC3E,QAAQ;AACN,YAAM,UAAU;AAChB,mBAAa,OAAO,EAAE,MAAM,MAAM,iBAAiB,CAAC;AACpD,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,SAAS;AACf,QAAM,EAAE,SAAS,SAAS,aAAa,IAAI,oBAAoB,QAAQ,MAAM,YAAY;AACzF,aAAW,OAAO,cAAc;AAC9B,UAAM,UAAU;AAChB,iBAAa,OAAO;AAAA,MAClB,MAAM,GAAG,IAAI,IAAI,GAAG;AAAA,MACpB,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,SAAS;AACX,UAAM,UAAU;AAChB,iBAAa,OAAO;AAAA,MAClB;AAAA,MACA,MAAM;AAAA;AAAA;AAAA;AAAA,MAIN,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,KAAK,KAAK,SAAS;AAClC,QAAI,GAAG,IAAI,aAAa,OAAO,OAAO,GAAG,IAAI,IAAI,GAAG,IAAI,QAAQ,CAAC;AAAA,EACnE;AACA,MAAI,SAAS;AACX,QAAI,gBAAgB;AAAA,EACtB;AACA,SAAO;AACT;AAEA,SAAS,kBACP,OACA,OACA,OACA,MACA,OACS;AACT,MAAI;AACJ,MAAI;AACF,iBAAa,OAAO,yBAAyB,OAAO,OAAO,KAAK,CAAC;AAAA,EACnE,QAAQ;AACN,UAAM,UAAU;AAChB,iBAAa,OAAO,EAAE,MAAM,GAAG,IAAI,IAAI,KAAK,KAAK,MAAM,iBAAiB,CAAC;AACzE,WAAO;AAAA,EACT;AACA,MAAI,cAAc,EAAE,WAAW,aAAa;AAC1C,UAAM,UAAU;AAChB,iBAAa,OAAO,EAAE,MAAM,GAAG,IAAI,IAAI,KAAK,KAAK,MAAM,iBAAiB,CAAC;AACzE,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,cAAc,WAAW,aAAa,WAAW,QAAQ;AAAA,IACzD;AAAA,IACA,GAAG,IAAI,IAAI,KAAK;AAAA,IAChB,QAAQ;AAAA,EACV;AACF;AAEA,SAAS,oBACP,QACA,WAKA;AACA,QAAM,UAAoC,CAAC;AAC3C,QAAM,WAAW,oBAAI,IAAY;AACjC,QAAM,eAAyB,CAAC;AAChC,QAAM,SAAS,CAAC,QAAyB;AACvC,UAAM,aAAa,OAAO,yBAAyB,QAAQ,GAAG;AAC9D,QAAI,CAAC,YAAY,WAAY,QAAO;AACpC,aAAS,IAAI,GAAG;AAChB,QAAI,WAAW,YAAY;AACzB,cAAQ,KAAK,CAAC,KAAK,WAAW,KAAK,CAAC;AAAA,IACtC,OAAO;AACL,cAAQ,KAAK,CAAC,KAAK,0DAA0D,CAAC;AAC9E,mBAAa,KAAK,GAAG;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AACA,MAAI;AACF,eAAW,OAAO,iBAAiB;AACjC,UAAI,QAAQ,UAAU,UAAW;AACjC,aAAO,GAAG;AAAA,IACZ;AACA,eAAW,OAAO,QAAQ;AACxB,UAAI,CAAC,OAAO,UAAU,eAAe,KAAK,QAAQ,GAAG,KAAK,SAAS,IAAI,GAAG,EAAG;AAC7E,UAAI,QAAQ,UAAU,WAAW;AAC/B,eAAO,EAAE,SAAS,SAAS,MAAM,aAAa;AAAA,MAChD;AACA,aAAO,GAAG;AAAA,IACZ;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,SAAS,SAAS,MAAM,aAAa;AAAA,EAChD;AACA,SAAO,EAAE,SAAS,SAAS,OAAO,aAAa;AACjD;AAEA,SAAS,iBACP,SACA,YACyB;AACzB,MAAI,cAAc,OAAO,GAAG;AAG1B,WAAO,EAAE,GAAG,SAAS,WAAW;AAAA,EAClC;AACA,SAAO,EAAE,OAAO,SAAS,WAAW;AACtC;AAEA,SAAS,iBACP,SACA,QACA,eACA,OACA,cAC+B;AAC/B,SAAO;AAAA,IACL,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB,cAAc;AAAA,IACd,yBACE,kBAAkB,OAAO,OAAO,8BAA8B,aAAa;AAAA,IAC7E,0BAA0B;AAAA,IAC1B;AAAA,IACA,SAAS,MAAM;AAAA,EACjB;AACF;AAEA,SAAS,qBAAqB,SAAkC,UAAwB;AACtF,QAAM,aAAa,QAAQ;AAC3B,yBAAuB,SAAS,UAAU;AAG1C,MAAI,sBAAsB,OAAO,IAAI,UAAU;AAC7C,YAAQ,UAAU;AAClB,eAAW,OAAO,OAAO,KAAK,OAAO,GAAG;AACtC,UAAI,QAAQ,aAAa,QAAQ,gBAAgB,gBAAgB,IAAI,GAAG,MAAM,OAAO;AACnF,eAAO,QAAQ,GAAG;AAAA,MACpB;AAAA,IACF;AACA,eAAW,UAAU,WAAW,QAAQ,MAAM,GAAG,CAAC;AAClD,2BAAuB,SAAS,UAAU;AAAA,EAC5C;AACF;AAEA,SAAS,uBACP,SACA,YACM;AACN,WAAS,UAAU,GAAG,UAAU,IAAI,WAAW,GAAG;AAChD,UAAM,iBAAiB,sBAAsB,OAAO;AACpD,UAAM,eACJ,WAAW,kBAAkB,OACzB,OACA,KAAK,IAAI,GAAG,WAAW,gBAAgB,cAAc;AAC3D,UAAM,2BAA2B,8BAA8B,cAAc;AAC7E,QACE,WAAW,mBAAmB,kBAC9B,WAAW,iBAAiB,gBAC5B,WAAW,6BAA6B,0BACxC;AACA;AAAA,IACF;AACA,eAAW,iBAAiB;AAC5B,eAAW,eAAe;AAC1B,eAAW,2BAA2B;AAAA,EACxC;AACA,QAAM,IAAI,WAAW,gDAAgD;AACvE;AAEA,SAAS,aACP,OACA,QACM;AACN,MAAI,MAAM,QAAQ,SAAS,mBAAoB,OAAM,QAAQ,KAAK,MAAM;AAC1E;AAEA,SAAS,gBAAgB,OAAyC;AAChE,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,iBAAiB;AACjC,QAAI;AACJ,QAAI;AACF,YAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,UAAI,CAAC,YAAY,cAAc,EAAE,WAAW,YAAa;AACzD,cAAQ,WAAW;AAAA,IACrB,QAAQ;AACN;AAAA,IACF;AACA,QAAI,OAAO,UAAU,UAAU;AAC7B,UAAI,GAAG,IAAI,mBAAmB,OAAO,KAAK,UAAU,KAAK,CAAC;AAAA,IAC5D,WAAW,OAAO,UAAU,YAAY,OAAO,UAAU,aAAa,UAAU,MAAM;AACpF,UAAI,GAAG,IAAI;AAAA,IACb;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAgD;AACvE,SAAO,oCAAoC,KAAK;AAClD;AAEA,SAAS,WAAW,OAQX;AACP,MAAI,YAAY,OAAO,KAAK,GAAG;AAC7B,WAAO;AAAA,MACL,eAAe,MAAM;AAAA,MACrB,SAAS;AAAA,QACP,MAAM;AAAA,QACN,YAAY,MAAM;AAAA,QAClB,qBAAqB;AAAA,QACrB,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AACA,MAAI,iBAAiB,aAAa;AAChC,WAAO;AAAA,MACL,eAAe,MAAM;AAAA,MACrB,SAAS;AAAA,QACP,MAAM;AAAA,QACN,YAAY,MAAM;AAAA,QAClB,qBAAqB;AAAA,QACrB,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBACP,OACA,UACA,aAAa,UAAU,KAAK,GACpB;AACR,MAAI,cAAc,SAAU,QAAO;AACnC,MAAI,eAAe,KAAK,IAAI,GAAG,aAAa,QAAQ;AACpD,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,UAAMC,UAAS,UAAK,YAAY;AAChC,UAAMC,iBAAgB,KAAK,IAAI,GAAG,WAAW,UAAUD,OAAM,CAAC;AAC9D,QAAIC,mBAAkB,EAAG,QAAOD;AAChC,UAAME,QAAO,WAAW,OAAO,KAAK,MAAMD,iBAAgB,CAAC,CAAC;AAC5D,UAAME,SAAQ,WAAW,OAAOF,iBAAgBC,MAAK,KAAK;AAC1D,UAAM,oBAAoB,KAAK,IAAI,GAAG,aAAaA,MAAK,QAAQC,OAAM,KAAK;AAC3E,QAAI,sBAAsB,cAAc;AACtC,aAAO,GAAG,MAAM,MAAM,GAAGD,MAAK,GAAG,CAAC,GAAGF,OAAM,GAAG,MAAM,MAAMG,OAAM,KAAK,CAAC;AAAA,IACxE;AACA,mBAAe;AAAA,EACjB;AAEA,QAAM,SAAS,UAAK,YAAY;AAChC,QAAM,gBAAgB,KAAK,IAAI,GAAG,WAAW,UAAU,MAAM,CAAC;AAC9D,QAAM,OAAO,WAAW,OAAO,KAAK,MAAM,gBAAgB,CAAC,CAAC;AAC5D,QAAM,QAAQ,WAAW,OAAO,gBAAgB,KAAK,KAAK;AAC1D,SAAO,GAAG,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,GAAG,MAAM,GAAG,MAAM,MAAM,MAAM,KAAK,CAAC;AACxE;AAEA,SAAS,WAAW,OAAe,UAAkD;AACnF,MAAI,MAAM;AACV,MAAI,QAAQ;AACZ,SAAO,MAAM,MAAM,QAAQ;AACzB,UAAM,OAAO,WAAW,OAAO,GAAG;AAClC,QAAI,QAAQ,KAAK,QAAQ,SAAU;AACnC,aAAS,KAAK;AACd,WAAO,KAAK;AAAA,EACd;AACA,SAAO,EAAE,KAAK,MAAM;AACtB;AAEA,SAAS,WAAW,OAAe,UAAoD;AACrF,MAAI,QAAQ,MAAM;AAClB,MAAI,QAAQ;AACZ,SAAO,QAAQ,GAAG;AAChB,UAAM,OAAO,eAAe,OAAO,KAAK;AACxC,QAAI,QAAQ,KAAK,QAAQ,SAAU;AACnC,aAAS,KAAK;AACd,aAAS,KAAK;AAAA,EAChB;AACA,SAAO,EAAE,OAAO,MAAM;AACxB;AAEA,SAAS,WAAW,OAAe,OAAqD;AACtF,QAAM,OAAO,MAAM,WAAW,KAAK;AACnC,MAAI,QAAQ,IAAM,QAAO,EAAE,WAAW,GAAG,OAAO,EAAE;AAClD,MAAI,QAAQ,KAAO,QAAO,EAAE,WAAW,GAAG,OAAO,EAAE;AACnD,MAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,UAAM,OAAO,QAAQ,IAAI,MAAM,SAAS,MAAM,WAAW,QAAQ,CAAC,IAAI;AACtE,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,aAAO,EAAE,WAAW,GAAG,OAAO,EAAE;AAAA,IAClC;AAAA,EACF;AACA,SAAO,EAAE,WAAW,GAAG,OAAO,EAAE;AAClC;AAEA,SAAS,eAAe,OAAe,KAAmD;AACxF,QAAM,OAAO,MAAM,WAAW,MAAM,CAAC;AACrC,MAAI,QAAQ,SAAU,QAAQ,SAAU,OAAO,GAAG;AAChD,UAAM,WAAW,MAAM,WAAW,MAAM,CAAC;AACzC,QAAI,YAAY,SAAU,YAAY,OAAQ;AAC5C,aAAO,EAAE,WAAW,GAAG,OAAO,EAAE;AAAA,IAClC;AAAA,EACF;AACA,MAAI,QAAQ,IAAM,QAAO,EAAE,WAAW,GAAG,OAAO,EAAE;AAClD,MAAI,QAAQ,KAAO,QAAO,EAAE,WAAW,GAAG,OAAO,EAAE;AACnD,SAAO,EAAE,WAAW,GAAG,OAAO,EAAE;AAClC;AAEA,SAAS,UAAU,OAAuB;AACxC,MAAI,QAAQ;AACZ,WAAS,QAAQ,GAAG,QAAQ,MAAM,UAAS;AACzC,UAAM,OAAO,WAAW,OAAO,KAAK;AACpC,aAAS,KAAK;AACd,aAAS,KAAK;AAAA,EAChB;AACA,SAAO;AACT;AAWA,SAAS,iBAAiB,OAAiC;AACzD,QAAM,QAA8B;AAAA,IAClC,gBAAgB;AAAA,IAChB,MAAM,oBAAI,QAAgB;AAAA,IAC1B,eAAe;AAAA,EACjB;AACA,MAAI;AACF,UAAM,QAAQ,iBAAiB,OAAO,OAAO,OAAO,CAAC;AACrD,WAAO,UAAU,OACb;AAAA,MACE,OAAO;AAAA,MACP,QAAQ,MAAM,iBAAiB;AAAA,IACjC,IACA,EAAE,OAAO,QAAQ,KAAK;AAAA,EAC5B,QAAQ;AACN,WAAO,EAAE,OAAO,MAAM,QAAQ,8BAA8B;AAAA,EAC9D;AACF;AAQA,SAAS,iBACP,OACA,OACA,UACA,OACe;AACf,MAAI,MAAM,kBAAkB,KAAK,QAAQ,uBAAuB;AAC9D,WAAO,oBAAoB,OAAO,6BAA6B;AAAA,EACjE;AACA,QAAM,kBAAkB;AACxB,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,SAAU,QAAO,gBAAgB,KAAK;AAC3D,MAAI,OAAO,UAAU,UAAW,QAAO,QAAQ,IAAI;AACnD,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,aAAa,KAAK,UAAU,KAAK;AACvC,WAAO,eAAe,SAAY,OAAO,WAAW;AAAA,EACtD;AACA,MAAI,OAAO,UAAU,eAAe,OAAO,UAAU,cAAc,OAAO,UAAU,UAAU;AAC5F,WAAO,aAAa,UAAU,IAAI,oBAAoB,OAAO,0BAA0B;AAAA,EACzF;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,oBAAoB,OAAO,0BAA0B;AAAA,EAC9D;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,oBAAoB,OAAO,0BAA0B;AAAA,EAC9D;AACA,MAAI,iBAAiB,MAAM;AACzB,QAAI,CAAC,8BAA8B,KAAK,GAAG;AACzC,aAAO,oBAAoB,OAAO,6BAA6B;AAAA,IACjE;AACA,QAAI;AACF,YAAM,QAAQ,KAAK,UAAU,QAAQ,KAAK,KAAK;AAC/C,aAAO,OAAO,SAAS,KAAK,IAAI,gBAAgB,KAAK,UAAU,YAAY,KAAK,KAAK,CAAC,IAAI;AAAA,IAC5F,QAAQ;AACN,aAAO,oBAAoB,OAAO,0BAA0B;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,YAAY,OAAO,KAAK,KAAK,iBAAiB,aAAa;AAC7D,WAAO,oBAAoB,OAAO,6BAA6B;AAAA,EACjE;AACA,MAAI,MAAM,KAAK,IAAI,KAAK,GAAG;AACzB,WAAO,oBAAoB,OAAO,0BAA0B;AAAA,EAC9D;AACA,QAAM,KAAK,IAAI,KAAK;AACpB,MAAI;AACF,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAI,OAAO,eAAe,KAAK,MAAM,MAAM,WAAW;AACpD,eAAO,oBAAoB,OAAO,6BAA6B;AAAA,MACjE;AACA,YAAMC,UAAS,OAAO,yBAAyB,OAAO,QAAQ;AAC9D,UAAIA,YAAW,SAASA,WAAU,OAAOA,QAAO,UAAU,aAAa;AACrE,eAAO,oBAAoB,OAAO,6BAA6B;AAAA,MACjE;AACA,UAAI,MAAM,SAAS,MAAM,gBAAgB;AACvC,eAAO,oBAAoB,OAAO,6BAA6B;AAAA,MACjE;AACA,UAAIC,SAAQ;AACZ,eAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,YAAI,QAAQ,EAAG,CAAAA,UAAS;AACxB,cAAM,aAAa,OAAO,yBAAyB,OAAO,OAAO,KAAK,CAAC;AACvE,YAAI,cAAc,EAAE,WAAW,aAAa;AAC1C,iBAAO,oBAAoB,OAAO,6BAA6B;AAAA,QACjE;AACA,cAAM,QAAQ,cAAc,WAAW,aAAa,WAAW,QAAQ;AACvE,cAAM,WAAW,iBAAiB,OAAO,OAAO,SAAS,QAAQ,CAAC;AAClE,YAAI,aAAa,KAAM,QAAO;AAC9B,QAAAA,UAAS;AAAA,MACX;AACA,aAAOA;AAAA,IACT;AAEA,UAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,QAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,aAAO,oBAAoB,OAAO,6BAA6B;AAAA,IACjE;AACA,UAAM,SAAS,OAAO,yBAAyB,OAAO,QAAQ;AAC9D,QAAI,WAAW,SAAS,UAAU,OAAO,OAAO,UAAU,aAAa;AACrE,aAAO,oBAAoB,OAAO,6BAA6B;AAAA,IACjE;AACA,QAAI,QAAQ;AACZ,QAAI,SAAS;AACb,QAAI;AACF,iBAAW,OAAO,OAAkC;AAClD,YAAI,CAAC,OAAO,UAAU,eAAe,KAAK,OAAO,GAAG,EAAG;AACvD,YAAI,MAAM,kBAAkB,GAAG;AAC7B,iBAAO,oBAAoB,OAAO,6BAA6B;AAAA,QACjE;AAIA,cAAM,kBAAkB;AACxB,cAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,YAAI,CAAC,cAAc,EAAE,WAAW,aAAa;AAC3C,iBAAO,oBAAoB,OAAO,6BAA6B;AAAA,QACjE;AACA,cAAM,QAAQ,WAAW;AACzB,YACE,OAAO,UAAU,eACjB,OAAO,UAAU,cACjB,OAAO,UAAU,UACjB;AACA;AAAA,QACF;AACA,cAAM,WAAW,iBAAiB,OAAO,OAAO,UAAU,QAAQ,CAAC;AACnE,YAAI,aAAa,KAAM,QAAO;AAC9B,YAAI,SAAS,EAAG,UAAS;AACzB,iBAAS,gBAAgB,GAAG,IAAI,IAAI;AACpC,kBAAU;AAAA,MACZ;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,UAAE;AACA,UAAM,KAAK,OAAO,KAAK;AAAA,EACzB;AACF;AAEA,SAAS,8BAA8B,OAAsB;AAC3D,MAAI;AACF,QAAI,OAAO,eAAe,KAAK,MAAM,KAAK,UAAW,QAAO;AAG5D,WAAO,OAAO,yBAAyB,OAAO,QAAQ,MAAM;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBACP,OACA,QACM;AACN,QAAM,kBAAkB;AACxB,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,MAAI,QAAQ;AACZ,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QACE,SAAS,MACT,SAAS,MACT,SAAS,KACT,SAAS,KACT,SAAS,MACT,SAAS,MACT,SAAS,IACT;AACA,eAAS;AAAA,IACX,WAAW,QAAQ,IAAM;AACvB,eAAS;AAAA,IACX,WAAW,QAAQ,KAAM;AACvB,eAAS;AAAA,IACX,WAAW,QAAQ,MAAO;AACxB,eAAS;AAAA,IACX,WAAW,QAAQ,SAAU,QAAQ,OAAQ;AAC3C,YAAM,OAAO,QAAQ,IAAI,MAAM,SAAS,MAAM,WAAW,QAAQ,CAAC,IAAI;AACtE,UAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,iBAAS;AACT,iBAAS;AAAA,MACX,OAAO;AAEL,iBAAS;AAAA,MACX;AAAA,IACF,WAAW,QAAQ,SAAU,QAAQ,OAAQ;AAC3C,eAAS;AAAA,IACX,OAAO;AACL,eAAS;AAAA,IACX;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAG5B;AACA,MAAI;AACF,UAAM,aAAa,KAAK,UAAU,KAAK;AACvC,WAAO;AAAA,MACL,OAAO,eAAe,SAAY,SAAS;AAAA,MAC3C,cAAc,eAAe;AAAA,IAC/B;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL,OAAO,KAAK,UAAU,wCAAwC;AAAA,MAC9D,cAAc;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,OAAwB;AACpD,SAAO,qBAAqB,KAAK,EAAE;AACrC;AAEA,SAAS,cAAc,OAAkD;AACvE,SAAO,QAAQ,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,CAAC;AAC5E;;;ACh5BA,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAEpB,IAAM,oCAAoC;AAC1C,IAAM,6BAA6B;AACnC,IAAM,oCAAoC;AAC1C,IAAM,gDAAgD;AAE7D,IAAM,kBAAkB,KAAK,KAAK,KAAK;AACvC,IAAM,YAAY;AAClB,IAAM,cAAc;AAUb,SAAS,oCAAoC,MAAc,OAAuB;AACvF,SAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAChD;AA2HO,IAAM,gCAA0D,OAAO,OAAO;AAAA,EACnF,eAAe;AAAA,EACf,iBAAiB,KAAK;AAAA,EACtB,mBAAmB,KAAK;AAAA,EACxB,8BAA8B;AAAA,EAC9B,iBAAiB,KAAK;AAAA,EACtB,wBAAwB;AAAA,EACxB,gCAAgC;AAAA,EAChC,2BAA2B;AAAA,EAC3B,sBAAsB,IAAI;AAAA,EAC1B,sBAAsB,KAAK;AAAA,EAC3B,kBAAkB,IAAI;AAAA,EACtB,mBAAmB,KAAK;AAAA,EACxB,yBAAyB,KAAK;AAAA,EAC9B,4BAA4B,IAAI;AAAA,EAChC,iCAAiC,MAAM;AAAA,EACvC,iCAAiC,MAAM;AAAA,EACvC,oBAAoB;AAAA,EACpB,0BAA0B,IAAI;AAAA,EAC9B,6BAA6B,KAAK;AAAA,EAClC,6BAA6B,KAAK;AAAA,EAClC,+BAA+B,IAAI;AAAA,EACnC,uBAAuB,IAAI;AAAA,EAC3B,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,6BAA6B,IAAI;AAAA,EACjC,sBAAsB;AAAA,EACtB,iBAAiB;AAAA,EACjB,wBAAwB,KAAK;AAC/B,CAAC;AAuFM,SAAS,+BACd,OACA,SAAmC,+BACT;AAC1B,QAAM,mBAAmB,gBAAgB,MAAM;AAC/C,QAAM,aAAa,eAAe,OAAO,iBAAiB,aAAa;AACvE,QAAM,WAAW,6BAA6B,WAAW,OAAO,gBAAgB;AAChF,SAAO;AAAA,IACL,eAAe;AAAA,IACf,eAAe;AAAA,IACf,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,WAAW;AAAA,IAClB,yBAAyB,WAAW;AAAA,IACpC,mBAAmB,YAAY,gBAAgB;AAAA,IAC/C,kBAAkB,uBAAuB,WAAW,OAAO,WAAW,uBAAuB;AAAA,IAC7F;AAAA,IACA,qBAAqB,YAAY,QAAQ;AAAA,EAC3C;AACF;AAEO,SAAS,2BAA2B,OAA2C;AACpF,QAAM,SAAS,6BAA6B,KAAK;AACjD,QAAM,2BAA2B,YAAY,OAAO,MAAM,MAAM,OAAO;AACvE,QAAM,0BACJ,uBAAuB,OAAO,OAAO,OAAO,uBAAuB,MACnE,OAAO;AACT,QAAM,WAAW,6BAA6B,OAAO,OAAO,OAAO,MAAM;AACzE,QAAM,8BAA8B,YAAY,QAAQ;AACxD,QAAM,qCACJ,YAAY,OAAO,QAAQ,MAAM,OAAO;AAC1C,QAAM,6BACJ,sCACA,gCAAgC,OAAO;AACzC,SAAO;AAAA,IACL,SACE,4BACA,2BACA,8BACA,cAAc,QAAQ,MAAM,cAAc,OAAO,QAAQ;AAAA,IAC3D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAOO,SAAS,gCAAgC,OAAyC;AACvF,SAAO,cAAc,KAAK;AAC5B;AAMO,SAAS,6BAA6B,OAA0C;AACrF,QAAM,SAAS,aAAa,OAAO;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MACE,OAAO,kBAAkB,qCACzB,OAAO,kBAAkB,8BACzB,OAAO,SAAS,UAChB;AACA,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAEA,QAAM,SAAS,gBAAgB,OAAO,MAAkC;AACxE,MAAI,cAAc,MAAM,MAAM,cAAc,OAAO,MAAM,GAAG;AAC1D,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,QAAM,kBAAkB;AAAA,IACtB,OAAO;AAAA,IACP,OAAO;AAAA,EACT;AACA,MACE,gBAAgB,4BAA4B,KAC5C,cAAc,gBAAgB,KAAK,MAAM,cAAc,OAAO,KAAK,GACnE;AACA,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AAEA,SAAO;AAAA,IACL,eAAe;AAAA,IACf,eAAe;AAAA,IACf,MAAM;AAAA,IACN;AAAA,IACA,OAAO,gBAAgB;AAAA,IACvB,yBAAyB,cAAc,OAAO,yBAAyB,GAAG,SAAS;AAAA,IACnF,mBAAmB,aAAa,OAAO,iBAAiB;AAAA,IACxD,kBAAkB,aAAa,OAAO,gBAAgB;AAAA,IACtD,UAAU;AAAA,MACR,OAAO;AAAA,MACP,IAAI,IAAI,gBAAgB,MAAM,WAAW,IAAI,CAAC,cAAc,UAAU,GAAG,CAAC;AAAA,IAC5E;AAAA,IACA,qBAAqB,aAAa,OAAO,mBAAmB;AAAA,EAC9D;AACF;AAEO,SAAS,6BACd,OACA,SAAmC,+BACb;AACtB,QAAM,YAAY,kBAAkB,OAAO,MAAM;AACjD,QAAM,UAAU,MAAM,QAAQ,sBAC1B,MAAM,WAAW,KAAK,CAAC,cAAc,UAAU,QAAQ,MAAM,QAAQ,mBAAmB,IACxF;AAIJ,MAAI,MAAM,QAAQ,cAAc,oBAAoB;AAClD,QAAI,CAAC,SAAS;AACZ,aAAO,cAAc,4BAA4B,WAAW,SAAS;AAAA,IACvE;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,sBAAsB,QAAQ;AAAA,MAC9B,QAAQ;AAAA,MACR;AAAA,MACA,yBAAyB;AAAA,MACzB,uBAAuB;AAAA,MACvB,YAAY,oBAAoB,SAAS,MAAM;AAAA,MAC/C,QAAQ,CAAC,eAAe,SAAS,OAAO,QAAQ,KAAK,CAAC;AAAA,IACxD;AAAA,EACF;AAEA,MAAI,UAAU,YAAY,QAAQ;AAChC,WAAO,cAAc,mBAAmB,WAAW,SAAS;AAAA,EAC9D;AAEA,QAAM,SAAS,MAAM,WAAW;AAAA,IAAI,CAAC,cACnC,eAAe,WAAW,OAAO,QAAQ,KAAK;AAAA,EAChD;AACA,QAAM,mBAAmB,IAAI;AAAA,IAC3B,OAAO,OAAO,CAAC,cAAc,UAAU,QAAQ,EAAE,IAAI,CAAC,cAAc,UAAU,YAAY;AAAA,EAC5F;AACA,QAAM,UAAU,mBAAmB,OAAO,QAAQ,gBAAgB;AAClE,QAAM,eAAe,MAAM,WACxB;AAAA,IAAI,CAAC,cACJ;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,oBAAoB,IAAI,UAAU,GAAG;AAAA,MAC7C,QAAQ,iBAAiB,IAAI,UAAU,GAAG;AAAA,IAC5C;AAAA,EACF,EACC,KAAK,CAAC,GAAG,MAAM,oCAAoC,EAAE,cAAc,EAAE,YAAY,CAAC;AACrF,QAAM,WAAW,aACd,OAAO,CAAC,cAAc,UAAU,QAAQ,EACxC;AAAA,IACC,CAAC,GAAG,MACF,EAAE,QAAQ,EAAE,SAAS,oCAAoC,EAAE,cAAc,EAAE,YAAY;AAAA,EAC3F;AAEF,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO;AAAA,MACL,GAAG;AAAA,QACD,QAAQ,gBAAgB,2BAA2B;AAAA,QACnD;AAAA,QACA,oBAAoB,YAAY;AAAA,MAClC;AAAA,MACA,uBAAuB,QAAQ;AAAA,MAC/B,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,MAAI,WAAW,SAAS,CAAC;AACzB,MAAI,SAAyC;AAC7C,QAAM,eAAe,MAAM,QAAQ,sBAC/B,SAAS,KAAK,CAAC,cAAc,UAAU,iBAAiB,MAAM,QAAQ,mBAAmB,IACzF;AACJ,MAAI,cAAc;AAChB,QAAI,SAAS,iBAAiB,aAAa,cAAc;AACvD,eAAS;AAAA,IACX,WAAW,SAAS,QAAQ,OAAO,yBAAyB,aAAa,OAAO;AAC9E,iBAAW;AACX,eAAS;AAAA,IACX;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,sBAAsB,SAAS;AAAA,IAC/B;AAAA,IACA;AAAA,IACA,yBACE,OAAO,mBACP,MAAM,QAAQ,gBAAgB,YAC9B,MAAM,QAAQ,eAAe,QAC7B,CAAC,QAAQ,iBAAiB,IAAI,SAAS,YAAY;AAAA,IACrD,uBAAuB,QAAQ;AAAA,IAC/B,YAAY,oBAAoB,QAAQ;AAAA,IACxC,QAAQ;AAAA,EACV;AACF;AAEA,SAAS,kBACP,OACA,QAC+B;AAC/B,MAAI,MAAM,QAAQ,cAAc,oBAAoB;AAClD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,sBAAsB;AAAA,IACxB;AAAA,EACF;AACA,MAAI,OAAO,wBAAwB,MAAM,UAAU,qBAAqB;AACtE,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,sBAAsB;AAAA,IACxB;AAAA,EACF;AACA,MAAI,CAAC,OAAO,wBAAwB;AAClC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,sBAAsB;AAAA,IACxB;AAAA,EACF;AACA,MAAI,MAAM,UAAU,yBAAyB,MAAM;AAEjD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,sBAAsB;AAAA,IACxB;AAAA,EACF;AACA,QAAM,YAAY,KAAK,IAAI,GAAG,MAAM,UAAU,uBAAuB,MAAM,UAAU,UAAU;AAC/F,MAAI,cAAc,GAAG;AACnB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,sBAAsB;AAAA,IACxB;AAAA,EACF;AACA,MACE,OAAO,0BACP,MAAM,QAAQ,aAAa,cAC3B,MAAM,UAAU,qBAAqB,KACrC,aAAa,MAAM,UAAU,oBAC7B;AACA,QAAI,MAAM,QAAQ,aAAa,OAAO,6BAA6B;AACjE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,sBAAsB;AAAA,MACxB;AAAA,IACF;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,sBAAsB;AAAA,IACxB;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,aAAa,cAAc,MAAM,UAAU,uBAAuB,GAAG;AACrF,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,sBAAsB;AAAA,IACxB;AAAA,EACF;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,sBAAsB;AAAA,EACxB;AACF;AAEA,SAAS,eACP,WACA,OACA,QACA,qBACA,yBAAyB,OACN;AACnB,QAAM,aAAa,oBAAoB,WAAW,MAAM;AACxD,QAAM,cAAc,mBAAmB,SAAS;AAChD,QAAM,iBAAiB,eAAe,UAAU,eAAe;AAC/D,QAAM,kBAAwD,CAAC,UAAU,mBACrE,uBACA,UAAU,WAAW,WACnB,iBACC,UAAU,uBAAuB,KAAK,IACrC,YACA,kBACE,gBAAgB,QAChB,eAAe,OAAO,+BACtB,kBACA,sBACE,sBACA;AAEZ,QAAM,mBAAmB,iBAAiB,UAAU;AAGpD,QAAM,gBAAgB,KAAK;AAAA,MACvB,eAAe,MAAM,mBAAmB,MAAM,IAAI,qBAAqB;AAAA,EAC3E;AACA,QAAM,gBAAgB,UAAU,mBAAmB,OAAO;AAC1D,QAAM,yBAAyB,iBAAiB,UAAU,aAAa,UAAU;AACjF,QAAM,eAAe,kBAAkB,UAAU,YAAY;AAC7D,QAAM,uBAAuB,KAAK;AAAA,IAChC,eAAe,OAAO,kCAAkC;AAAA,EAC1D;AACA,QAAM,iBAAiB,iBAAiB,UAAU,wBAAwB,UAAU;AACpF,QAAM,eAAe,kBAAkB,UAAU,uBAAuB;AACxE,QAAM,uBAAuB,KAAK;AAAA,IAChC,eAAe,OAAO,kCAAkC;AAAA,EAC1D;AACA,QAAM,iBAAiB,mBAAmB,WAAW,YAAY,MAAM;AACvE,QAAM,sBAAsB,sBAAsB,YAAY,MAAM;AACpE,QAAM,aAAa,gCAAgC,UAAU,OAAO,MAAM;AAC1E,QAAM,uBACJ,UAAU,QAAQ,MAAM,QAAQ,sBAC5B,wBAAwB,YAAY,MAAM,IAC1C;AACN,QAAM,2BAA2B,yBAAyB,OAAO,yBAAyB;AAC1F,SAAO;AAAA,IACL,cAAc,UAAU;AAAA,IACxB,UAAU,oBAAoB;AAAA,IAC9B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,OACE,gBACA,gBACA,uBACA,uBACA,iBACA,sBACA,uBACA;AAAA,IACF;AAAA,EACF;AACF;AAKA,SAAS,kBAAkB,MAAwC;AACjE,SAAO,KAAK,IAAI,KAAK,yBAAyB,GAAG,KAAK,2BAA2B,CAAC;AACpF;AAEA,SAAS,WAAW,MAAgC,QAAqC;AACvF,SAAO,WAAW,YACb,KAAK,yBAAyB,IAC9B,KAAK,2BAA2B;AACvC;AASA,SAAS,mBACP,WACA,iBACA,QACQ;AACR,MAAI,oBAAoB,UAAW,QAAO;AAC1C,QAAM,UAAiE;AAAA,IACrE,CAAC,WAAW,UAAU,MAAM,OAAO;AAAA,IACnC,CAAC,aAAa,UAAU,MAAM,SAAS;AAAA,EACzC;AACA,MAAI,kBAAkB;AACtB,aAAW,CAAC,WAAW,MAAM,KAAK,SAAS;AACzC,QACE,OAAO,gBAAgB,QACvB,OAAO,qBAAqB,QAC5B,OAAO,qBAAqB,GAC5B;AACA;AAAA,IACF;AACA,UAAM,qBAAqB;AAAA,MACzB,gBAAgB,UAAU,aAAa,YAAY,eAAe;AAAA,IACpE;AACA,UAAM,qBAAqB;AAAA,MACzB,gBAAgB,UAAU,wBAAwB,YAAY,eAAe;AAAA,IAC/E;AACA,UAAM,wBACJ,WAAW,UAAU,cAAc,SAAS,IAAI,qBAChD,WAAW,UAAU,yBAAyB,SAAS,IAAI;AAC7D,QAAI,yBAAyB,EAAG;AAEhC,UAAM,wBAAwB,KAAK,IAAI,GAAG,MAAM,OAAO,WAAW,IAAI;AACtE,UAAM,oBAAoB,OAAO,mBAAmB,KAAK;AACzD,UAAM,cAAc,KAAK;AAAA,MACvB,OAAO;AAAA,MACP,KAAK,IAAI,GAAG,oBAAoB,qBAAqB;AAAA,IACvD;AACA,sBAAkB,KAAK;AAAA,MACrB;AAAA,MACA,KAAK,MAAM,cAAc,OAAO,wBAAwB;AAAA,IAC1D;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBACP,OACA,QACA,kBAMA;AACA,MACE,CAAC,OAAO,mBACR,MAAM,QAAQ,gBAAgB,UAC9B,MAAM,QAAQ,eAAe,MAC7B;AACA,WAAO;AAAA,MACL,qBAAqB,oBAAI,IAAI;AAAA,MAC7B,kBAAkB,oBAAI,IAAI;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,IACzB;AAAA,EACF;AACA,QAAM,UAAU,IAAI;AAAA,IAClB,MAAM,WACH;AAAA,MACC,CAAC,cACC,iBAAiB,IAAI,UAAU,GAAG,KAClC,UAAU,YAAY,SAAS,MAAM,QAAQ,UAAW;AAAA,IAC5D,EACC,IAAI,CAAC,cAAc,UAAU,GAAG;AAAA,EACrC;AACA,MAAI,MAAM,QAAQ,gBAAgB,UAAU;AAC1C,QAAI,QAAQ,SAAS,GAAG;AACtB,aAAO;AAAA,QACL,qBAAqB,oBAAI,IAAI;AAAA,QAC7B,kBAAkB;AAAA,QAClB,eAAe;AAAA,QACf,uBAAuB;AAAA,MACzB;AAAA,IACF;AACA,WAAO;AAAA;AAAA;AAAA,MAGL,qBAAqB,oBAAI,IAAI;AAAA,MAC7B,kBAAkB;AAAA,MAClB,eAAe;AAAA,MACf,uBAAuB;AAAA,IACzB;AAAA,EACF;AACA,QAAM,UAAU,CAAC,GAAG,gBAAgB,EAAE,OAAO,CAAC,iBAAiB,CAAC,QAAQ,IAAI,YAAY,CAAC;AACzF,SAAO;AAAA,IACL,qBAAqB,IAAI,IAAI,OAAO;AAAA,IACpC,kBAAkB;AAAA,IAClB,eAAe,QAAQ,SAAS;AAAA,IAChC,uBAAuB,QAAQ;AAAA,EACjC;AACF;AAEA,SAAS,oBACP,WACA,QACsB;AACtB,QAAM,MAAM,UAAU,MAAM;AAC5B,MAAI,QAAQ,QAAQ,MAAM,OAAO,kBAAmB,QAAO;AAC3D,QAAM,UAAU,CAAC,UAAU,MAAM,SAAS,UAAU,MAAM,SAAS;AACnE,QAAM,sBAAsB,QAAQ;AAAA,IAClC,CAAC,WAAW,OAAO,gBAAgB,QAAQ,OAAO,qBAAqB;AAAA,EACzE,EAAE;AACF,QAAM,mBAAmB,QAAQ;AAAA,IAC/B,CAAC,WAAY,OAAO,gBAAgB,UAAW,OAAO,qBAAqB;AAAA,EAC7E;AACA,MAAI,wBAAwB,EAAG,QAAO;AACtC,QAAM,sBAA4C,mBAC9C,QACA,wBAAwB,QAAQ,SAC9B,SACA;AACN,QAAM,qBAAqB,gBAAgB,UAAU,MAAM,YAAY,mBAAmB;AAC1F,MAAI,MAAM,OAAO,iBAAiB;AAChC,WAAO,gBAAgB,oBAAoB,KAAK;AAAA,EAClD;AACA,SAAO;AACT;AAEO,SAAS,gCACd,OACA,QACsB;AACtB,QAAM,EAAE,UAAU,eAAe,cAAc,YAAY,OAAO,uBAAuB,IACvF;AACF,MACE,aAAa,QACb,kBAAkB,QAClB,gBAAgB,OAAO,6BACvB,iBAAiB,QACjB,eAAe,OAAO,mBACtB,iBAAiB,UAAU,IAAI,iBAAiB,QAAQ,GACxD;AACA,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,0BAA0B;AAChD,MAAI,UAAU,WAAW;AACvB,WAAO,WAAW,OAAO,0BAA0B,iBAAiB,OAAO,uBACvE,cACA;AAAA,EACN;AACA,MAAI,UAAU,aAAa;AACzB,WAAO,YAAY,OAAO,kCACxB,iBAAiB,OAAO,uBACtB,YACA;AAAA,EACN;AACA,MAAI,WAAW,OAAO,0BAA0B,iBAAiB,OAAO,sBAAsB;AAC5F,WAAO;AAAA,EACT;AACA,MACE,YAAY,OAAO,kCACnB,iBAAiB,OAAO,sBACxB;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,wBACP,OACA,QACQ;AACR,MAAI,UAAU,UAAW,QAAO,OAAO;AACvC,MAAI,UAAU,YAAa,QAAO,OAAO;AACzC,SAAO,OAAO;AAChB;AAEA,SAAS,mBAAmB,WAAiD;AAC3E,QAAM,UAAU,CAAC,UAAU,MAAM,SAAS,UAAU,MAAM,SAAS,EAChE,OAAO,CAAC,WAAW,OAAO,gBAAgB,QAAQ,OAAO,qBAAqB,IAAI,EAClF,IAAI,CAAC,WAAY,OAAO,qBAAqB,IAAI,IAAI,OAAO,WAAY,EACxE,OAAO,CAAC,SAAyB,SAAS,IAAI;AACjD,SAAO,QAAQ,SAAS,IAAI,KAAK,IAAI,GAAG,OAAO,IAAI;AACrD;AAEA,SAAS,sBACP,YACA,QACQ;AACR,MAAI,eAAe,UAAW,QAAO,OAAO;AAC5C,MAAI,eAAe,MAAO,QAAO,OAAO;AACxC,MAAI,eAAe,SAAU,QAAO,OAAO;AAC3C,SAAO;AACT;AAEA,SAAS,cACP,QACA,WACA,YACsB;AACtB,SAAO;AAAA,IACL,SAAS,UAAU,YAAY,SAAS,UAAU;AAAA,IAClD,sBAAsB;AAAA,IACtB;AAAA,IACA;AAAA,IACA,yBAAyB;AAAA,IACzB,uBAAuB;AAAA,IACvB;AAAA,IACA,QAAQ,CAAC;AAAA,EACX;AACF;AAEA,SAAS,oBAAoB,QAAmD;AAC9E,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SAAO,OAAO;AAAA,IACZ,CAAC,QAAQ,UACP,iBAAiB,MAAM,UAAU,IAAI,iBAAiB,MAAM,IAAI,MAAM,aAAa;AAAA,IACrF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,OAAkC,eAAwC;AAChG,QAAM,sBAAsB,qBAAqB,MAAM,QAAQ,mBAAmB;AAClF,QAAM,aAAa,MAAM,WACtB,IAAI,kBAAkB,EACtB,KAAK,CAAC,GAAG,MAAM,oCAAoC,EAAE,KAAK,EAAE,GAAG,CAAC;AACnE,WAAS,QAAQ,GAAG,QAAQ,WAAW,QAAQ,SAAS,GAAG;AACzD,QAAI,WAAW,QAAQ,CAAC,EAAG,QAAQ,WAAW,KAAK,EAAG,KAAK;AACzD,YAAM,IAAI,MAAM,wCAAwC,WAAW,KAAK,EAAG,GAAG,EAAE;AAAA,IAClF;AAAA,EACF;AACA,MAAI,UAAU,WAAW,MAAM,GAAG,aAAa;AAC/C,MACE,uBACA,WAAW,KAAK,CAAC,cAAc,UAAU,QAAQ,mBAAmB,KACpE,CAAC,QAAQ,KAAK,CAAC,cAAc,UAAU,QAAQ,mBAAmB,GAClE;AACA,cAAU;AAAA,MACR,GAAG,QAAQ,MAAM,GAAG,KAAK,IAAI,GAAG,gBAAgB,CAAC,CAAC;AAAA,MAClD,WAAW,KAAK,CAAC,cAAc,UAAU,QAAQ,mBAAmB;AAAA,IACtE,EAAE,KAAK,CAAC,GAAG,MAAM,oCAAoC,EAAE,KAAK,EAAE,GAAG,CAAC;AAAA,EACpE;AACA,SAAO;AAAA,IACL,OAAO;AAAA,MACL,cAAc,iBAAiB,MAAM,cAAc,GAAG,OAAO,gBAAgB;AAAA,MAC7E,SAAS;AAAA,QACP,WAAW,MAAM,QAAQ,cAAc,qBAAqB,qBAAqB;AAAA,QACjF,UAAU,MAAM,QAAQ,aAAa,YAAY,YAAY;AAAA,QAC7D;AAAA,QACA,WAAW,iBAAiB,MAAM,QAAQ,WAAW,GAAG,eAAe;AAAA,QACvE,YAAY,qBAAqB,MAAM,QAAQ,UAAU;AAAA,QACzD,aACE,MAAM,QAAQ,gBAAgB,YAC1B,YACA,MAAM,QAAQ,gBAAgB,WAC5B,WACA;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,sBACE,MAAM,UAAU,yBAAyB,OACrC,OACA,iBAAiB,MAAM,UAAU,sBAAsB,GAAG,SAAS;AAAA,QACzE,YAAY,iBAAiB,MAAM,UAAU,YAAY,GAAG,SAAS;AAAA,QACrE,oBAAoB,iBAAiB,MAAM,UAAU,oBAAoB,GAAG,SAAS;AAAA,QACrF,qBAAqB,MAAM,UAAU,wBAAwB;AAAA,MAC/D;AAAA,MACA,YAAY;AAAA,IACd;AAAA,IACA,yBAAyB,WAAW,SAAS,QAAQ;AAAA,EACvD;AACF;AAEA,SAAS,mBAAmB,WAAyD;AACnF,SAAO;AAAA,IACL,KAAK,aAAa,UAAU,GAAG;AAAA,IAC/B,QACE,UAAU,WAAW,YACrB,UAAU,WAAW,mBACrB,UAAU,WAAW,UACjB,UAAU,SACV;AAAA,IACN,kBAAkB,UAAU,qBAAqB;AAAA,IACjD,qBAAqB;AAAA,MACnB,UAAU;AAAA,MACV;AAAA,MACA;AAAA,IACF;AAAA,IACA,kBAAkB,iBAAiB,UAAU,kBAAkB,GAAG,SAAS;AAAA,IAC3E,OAAO;AAAA,MACL,SAAS,qBAAqB,UAAU,MAAM,OAAO;AAAA,MACrD,WAAW,qBAAqB,UAAU,MAAM,SAAS;AAAA,MACzD,cAAc,yBAAyB,UAAU,MAAM,cAAc,GAAG,eAAe;AAAA,MACvF,YAAY,oBAAoB,UAAU,MAAM,UAAU;AAAA,IAC5D;AAAA,IACA,OAAO;AAAA,MACL,UAAU,wBAAwB,UAAU,MAAM,UAAU,GAAG,GAAG,CAAC;AAAA,MACnE,eAAe,yBAAyB,UAAU,MAAM,eAAe,GAAG,SAAS;AAAA,MACnF,cAAc,yBAAyB,UAAU,MAAM,cAAc,GAAG,eAAe;AAAA,MACvF,YAAY,oBAAoB,UAAU,MAAM,UAAU;AAAA,MAC1D,OAAO,oBAAoB,UAAU,MAAM,KAAK;AAAA,MAChD,wBAAwB;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,uBAAuB;AAAA,QACrB,UAAU,aAAa;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,yBAAyB;AAAA,QACvB,UAAU,aAAa;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,YAAY,oBAAoB,UAAU,aAAa,UAAU;AAAA,IACnE;AAAA,IACA,yBAAyB;AAAA,MACvB,uBAAuB;AAAA,QACrB,UAAU,wBAAwB;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,yBAAyB;AAAA,QACvB,UAAU,wBAAwB;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,YAAY,oBAAoB,UAAU,wBAAwB,UAAU;AAAA,IAC9E;AAAA,IACA,aAAa,CAAC,GAAG,IAAI,IAAI,UAAU,YAAY,IAAI,YAAY,CAAC,CAAC,EAC9D,KAAK,mCAAmC,EACxC,MAAM,GAAG,6CAA6C;AAAA,EAC3D;AACF;AAEA,SAAS,qBAAqB,QAA0D;AACtF,SAAO;AAAA,IACL,aAAa,wBAAwB,OAAO,aAAa,GAAG,KAAK,CAAC;AAAA,IAClE,kBAAkB,yBAAyB,OAAO,kBAAkB,GAAG,eAAe;AAAA,EACxF;AACF;AAEA,SAAS,gBAAgB,QAA4D;AACnF,QAAM,kBAAkB,iBAAiB,OAAO,iBAAiB,GAAG,eAAe;AACnF,QAAM,yBAAyB,gBAAgB,OAAO,wBAAwB,GAAG,GAAG,CAAC;AACrF,SAAO;AAAA,IACL,eAAe,iBAAiB,OAAO,eAAe,GAAG,iCAAiC;AAAA,IAC1F;AAAA,IACA,mBAAmB,iBAAiB,OAAO,mBAAmB,iBAAiB,eAAe;AAAA,IAC9F,8BAA8B,gBAAgB,OAAO,8BAA8B,GAAG,KAAK,CAAC;AAAA,IAC5F,iBAAiB,iBAAiB,OAAO,iBAAiB,GAAG,eAAe;AAAA,IAC5E;AAAA,IACA,gCAAgC;AAAA,MAC9B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,2BAA2B,iBAAiB,OAAO,2BAA2B,GAAG,SAAS;AAAA,IAC1F,sBAAsB,iBAAiB,OAAO,sBAAsB,GAAG,eAAe;AAAA,IACtF,sBAAsB,iBAAiB,OAAO,sBAAsB,GAAG,eAAe;AAAA,IACtF,kBAAkB,gBAAgB,OAAO,kBAAkB,GAAG,WAAW,CAAC;AAAA,IAC1E,mBAAmB,gBAAgB,OAAO,mBAAmB,GAAG,WAAW,CAAC;AAAA,IAC5E,yBAAyB,gBAAgB,OAAO,yBAAyB,GAAG,WAAW,CAAC;AAAA,IACxF,4BAA4B,gBAAgB,OAAO,4BAA4B,GAAG,WAAW,CAAC;AAAA,IAC9F,iCAAiC;AAAA,MAC/B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,iCAAiC;AAAA,MAC/B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,oBAAoB,gBAAgB,OAAO,oBAAoB,GAAG,KAAK,IAAI,CAAC;AAAA,IAC5E,0BAA0B,gBAAgB,OAAO,0BAA0B,GAAG,WAAW,CAAC;AAAA,IAC1F,6BAA6B;AAAA,MAC3B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,6BAA6B;AAAA,MAC3B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,+BAA+B;AAAA,MAC7B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,uBAAuB,gBAAgB,OAAO,uBAAuB,GAAG,WAAW,CAAC;AAAA,IACpF,wBAAwB,OAAO,2BAA2B;AAAA,IAC1D,wBAAwB,OAAO,2BAA2B;AAAA,IAC1D,6BAA6B;AAAA,MAC3B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,IACA,sBAAsB,OAAO,yBAAyB;AAAA,IACtD,iBAAiB,OAAO,oBAAoB;AAAA,IAC5C,wBAAwB,gBAAgB,OAAO,wBAAwB,GAAG,WAAW,CAAC;AAAA,EACxF;AACF;AAEA,SAAS,oBAAoB,OAAmD;AAC9E,SAAO,UAAU,UAAU,UAAU,YAAY,UAAU,QAAQ,QAAQ;AAC7E;AAEA,SAAS,oBAAoB,OAAmD;AAC9E,SAAO,UAAU,aAAa,UAAU,cAAc,QAAQ;AAChE;AAEA,SAAS,iBAAiB,YAA0C;AAClE,MAAI,eAAe,OAAQ,QAAO;AAClC,MAAI,eAAe,SAAU,QAAO;AACpC,MAAI,eAAe,MAAO,QAAO;AACjC,SAAO;AACT;AAEA,SAAS,gBACP,OACA,SACsB;AACtB,SAAO,iBAAiB,KAAK,IAAI,iBAAiB,OAAO,IAAI,QAAQ;AACvE;AAEA,SAAS,aAAa,OAAuB;AAC3C,MAAI,CAAC,0BAA0B,KAAK,KAAK,GAAG;AAC1C,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAqC;AACjE,SAAO,UAAU,OAAO,OAAO,aAAa,KAAK;AACnD;AAEA,SAAS,wBACP,OACA,KACA,KACA,UACe;AACf,SAAO,UAAU,OAAO,OAAO,gBAAgB,OAAO,KAAK,KAAK,QAAQ;AAC1E;AAEA,SAAS,gBAAgB,OAAe,KAAa,KAAa,UAA0B;AAC1F,QAAM,SAAS,OAAO,SAAS,KAAK,IAAI,QAAQ;AAChD,QAAM,UAAU,KAAK,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,CAAC;AACnD,QAAM,QAAQ,MAAM;AACpB,SAAO,KAAK,MAAM,UAAU,KAAK,IAAI;AACvC;AAEA,SAAS,yBAAyB,OAAsB,KAAa,KAA4B;AAC/F,SAAO,UAAU,OAAO,OAAO,iBAAiB,OAAO,KAAK,GAAG;AACjE;AAEA,SAAS,iBAAiB,OAAe,KAAa,KAAqB;AACzE,SAAO,KAAK,MAAM,gBAAgB,OAAO,KAAK,KAAK,CAAC,CAAC;AACvD;AAEA,SAAS,yBACP,OACA,eACsB;AACtB,QAAM,WAAW,aAAa,OAAO;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,UAAU,WAAW,SAAS,SAAS,CAAC,YAAY,SAAS,MAAM,CAAU;AACnF,QAAM,uBAAuB,kBAAkB,SAAS,oBAAoB;AAC5E,QAAM,SAAS,WAAW,SAAS,QAAQ;AAAA,IACzC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAU;AACV,QAAM,kBAAkB,aAAa,SAAS,WAAW;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,YAA2C;AAAA,IAC/C,SAAS,WAAW,gBAAgB,SAAS,CAAC,SAAS,MAAM,CAAU;AAAA,IACvE,QAAQ,WAAW,gBAAgB,QAAQ;AAAA,MACzC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAU;AAAA,IACV,sBAAsB,cAAc,gBAAgB,oBAAoB;AAAA,EAC1E;AACA,MAAI,CAAC,MAAM,QAAQ,SAAS,MAAM,KAAK,SAAS,OAAO,SAAS,cAAc,MAAM;AAClF,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,QAAM,SAAS,SAAS,OAAO,IAAI,qBAAqB;AACxD,MACE,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,YAAY,CAAC,EAAE,SAAS,OAAO,UACnE,OAAO,KAAK,CAAC,UAAU,CAAC,cAAc,IAAI,MAAM,YAAY,CAAC,GAC7D;AACA,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,QAAM,0BAA0B,cAAc,SAAS,uBAAuB;AAC9E,QAAM,wBAAwB,cAAc,SAAS,uBAAuB,GAAG,SAAS;AAExF,QAAM,kBAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,cAAc,CAAC,oBAAoB,sBAAsB,gBAAgB;AAC/E,QAAM,aACJ,YAAY,aACR,yBAAyB,QACzB,UAAU,YAAY,WACtB,gBAAgB,SAAS,MAA0C,KACnE,OAAO,KAAK,CAAC,UAAU,MAAM,iBAAiB,oBAAoB,IAClE,YAAY,UACV,yBAAyB,QACzB,WAAW,qBACX,UAAU,YAAY,UACtB,YAAY,SAAS,UAAU,MAAsC,IACrE,yBAAyB,QACzB,UAAU,YAAY,WACtB,YAAY,SAAS,MAAsC;AACnE,MACE,CAAC,cACD,wBAAwB,cAAc,QACtC,UAAU,0BAA0B,UAAU,WAAW,6BACxD,4BAA4B,YAAY,cAAc,0BAA0B,IACjF;AACA,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,iBAAiB,SAAS,UAAU;AAAA,IAChD;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,OAAmC;AAChE,QAAM,QAAQ,aAAa,OAAO;AAAA,IAChC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,SAA4B;AAAA,IAChC,cAAc,aAAa,aAAa,MAAM,YAAY,CAAC;AAAA,IAC3D,UAAU,cAAc,MAAM,QAAQ;AAAA,IACtC,iBACE,MAAM,oBAAoB,OACtB,OACA,WAAW,MAAM,iBAAiB;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAU;AAAA,IAChB,eAAe,mBAAmB,MAAM,eAAe,GAAG,OAAO,gBAAgB;AAAA,IACjF,eAAe,mBAAmB,MAAM,eAAe,GAAG,OAAO,gBAAgB;AAAA,IACjF,sBAAsB;AAAA,MACpB,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IACA,sBAAsB;AAAA,MACpB,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IACA,gBAAgB,mBAAmB,MAAM,gBAAgB,GAAG,OAAO,gBAAgB;AAAA,IACnF,qBAAqB,mBAAmB,MAAM,qBAAqB,GAAG,OAAO,gBAAgB;AAAA,IAC7F,sBAAsB;AAAA,MACpB,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IACA,YAAY,WAAW,MAAM,YAAY,CAAC,WAAW,WAAW,WAAW,CAAU;AAAA,IACrF,0BAA0B;AAAA,MACxB,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IACA,OAAO,mBAAmB,MAAM,OAAO,CAAC,OAAO,kBAAkB,OAAO,gBAAgB;AAAA,IACxF,YAAY,iBAAiB,MAAM,UAAU;AAAA,EAC/C;AACA,QAAM,gBACJ,OAAO,gBACP,OAAO,gBACP,OAAO,uBACP,OAAO,uBACP,OAAO,iBACP,OAAO,sBACP,OAAO,uBACP,OAAO;AACT,MAAI,OAAO,cAAc,OAAO,oBAAoB,SAAS,OAAO,UAAU,eAAe;AAC3F,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAgB,cAA0D;AAC9F,MACE,UAAU,QACV,OAAO,UAAU,YACjB,MAAM,QAAQ,KAAK,KACnB,CAAC,CAAC,OAAO,WAAW,IAAI,EAAE,SAAS,OAAO,eAAe,KAAK,CAAC,GAC/D;AACA,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,QAAM,SAAS;AACf,QAAM,aAAa,OAAO,KAAK,MAAM,EAAE,KAAK,mCAAmC;AAC/E,QAAM,oBAAoB,CAAC,GAAG,YAAY,EAAE,KAAK,mCAAmC;AACpF,MAAI,cAAc,UAAU,MAAM,cAAc,iBAAiB,GAAG;AAClE,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,SAAO;AACT;AAEA,SAAS,WAA8C,OAAgB,QAAsB;AAC3F,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,GAAG;AACxD,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,OAAsC;AAC9D,SAAO,WAAW,OAAO,CAAC,WAAW,OAAO,UAAU,MAAM,CAAU;AACxE;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI,OAAO,UAAU,SAAU,OAAM,IAAI,MAAM,2CAA2C;AAC1F,SAAO;AACT;AAEA,SAAS,kBAAkB,OAA+B;AACxD,SAAO,UAAU,OAAO,OAAO,aAAa,aAAa,KAAK,CAAC;AACjE;AAEA,SAAS,cAAc,OAAyB;AAC9C,MAAI,OAAO,UAAU,UAAW,OAAM,IAAI,MAAM,0CAA0C;AAC1F,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAgB,KAAa,KAAqB;AAC5E,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,OAAO,QAAQ,KAAK;AACtF,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,SAAO;AACT;AAEA,SAAS,cAAc,OAAgB,KAAa,KAAqB;AACvE,QAAM,SAAS,mBAAmB,OAAO,KAAK,GAAG;AACjD,MAAI,CAAC,OAAO,UAAU,MAAM,EAAG,OAAM,IAAI,MAAM,6CAA6C;AAC5F,SAAO;AACT;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI,OAAO,UAAU,YAAY,CAAC,iBAAiB,KAAK,KAAK,GAAG;AAC9D,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAwB;AAC3C,QAAM,aAAa,cAAc,KAAK;AACtC,SAAO,WAAW,OAAO,IAAI,YAAY,EAAE,OAAO,UAAU,CAAC,CAAC;AAChE;AAEA,SAAS,uBACP,OACA,yBACQ;AAIR,SAAO,YAAY,EAAE,OAAO,wBAAwB,CAAC;AACvD;AAEA,SAAS,cAAc,OAAwB;AAC7C,SAAO,KAAK,UAAU,SAAS,KAAK,CAAC;AACvC;AAEA,SAAS,SAAS,OAAyB;AACzC,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,QAAQ;AACnD,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAgC,EAC5C,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,oCAAoC,MAAM,KAAK,CAAC,EAC1E,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,SAAS,KAAK,CAAC,CAAC;AAAA,IACjD;AAAA,EACF;AACA,SAAO;AACT;;;AC53CA,IAAM,8BAA8B;AACpC,IAAM,WAAW;AACjB,IAAM,sBAAsB;AAC5B,IAAM,eAAe;AACrB,IAAM,eAAe;AAYrB,IAAM,wBAAwB,oBAAI,IAAI;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,6BAA6B;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,oBACJ;AACF,IAAM,6BACJ;AAEF,IAAM,+BACJ;AACF,IAAM,wBAAwB;AAC9B,IAAM,yBAAyB;AAC/B,IAAM,oBAAoB;AAC1B,IAAM,uBAAuB;AAC7B,IAAM,uBAAuB,IAAI;AAAA,EAC/B;AAAA,EACA;AACF;AACA,IAAM,mCAAmC,IAAI;AAAA,EAC3C,WAAW,iBAAiB,WAAW,iBAAiB;AAAA,EACxD;AACF;AACA,IAAM,qCAAqC,IAAI;AAAA,EAC7C,UAAU,0BAA0B;AAAA,EACpC;AACF;AACA,IAAM,gCACJ;AAEF,IAAM,0BAA0B;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAQO,SAAS,qBAAqB,MAAuB;AAC1D,SAAO,sBAAsB,IAAI,mBAAmB,IAAI,CAAC;AAC3D;AAOO,SAAS,uBAAuB,MAAuB;AAC5D,SAAO,2BAA2B,KAAK,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC;AACxE;AAOO,SAAS,mBACd,KACA,eAA8C,CAAC,GACvC;AACR,SAAO,uBAAuB,KAAK,eAAe,YAAY,CAAC;AACjE;AAOO,SAAS,oBACd,MACA,eAA8C,CAAC,GACvC;AACR,MAAI,WAAW,uBAAuB,MAAM,eAAe,YAAY,CAAC;AAExE,aAAW,SAAS;AAAA,IAClB;AAAA,IACA,CAAC,OAAO,QAAgB,aAAqB;AAC3C,YAAM,QAAQ,SAAS,QAAQ;AAC/B,YAAM,qBAAqB,SAAS,MAAM,MAAM,MAAM;AACtD,YAAM,cAAc,MAAM,MAAM,qCAAqC;AACrE,UAAI,aAAa;AACf,cAAM,SAAS,YAAY,CAAC;AAC5B,cAAM,aAAa,YAAY,CAAC;AAChC,cAAM,aAAa,YAAY,CAAC;AAChC,YAAI,UAAU,cAAc,YAAY;AACtC,iBAAO,kBAAkB,WAAW,KAAK,CAAC,IACtC,QACA,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,kBAAkB;AAAA,QACrE;AAAA,MACF;AACA,aAAO,kBAAkB,KAAK,IAAI,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,kBAAkB;AAAA,IACrF;AAAA,EACF;AACA,aAAW,SAAS,QAAQ,uBAAuB,KAAK,QAAQ,EAAE;AAClE,aAAW,SAAS,QAAQ,wBAAwB,KAAK,QAAQ,EAAE;AACnE,aAAW,SAAS,QAAQ,mBAAmB,CAAC,QAAQ,WAAmB;AACzE,WAAO,GAAG,MAAM,GAAG,QAAQ;AAAA,EAC7B,CAAC;AACD,aAAW,SAAS,QAAQ,sBAAsB,KAAK,QAAQ,GAAG;AAClE,aAAW,SAAS,QAAQ,sBAAsB,KAAK,QAAQ,EAAE;AACjE,aAAW,SAAS;AAAA,IAClB;AAAA,IACA,CAAC,OAAO,QAAgB,OAAe,UACrC,kBAAkB,KAAK,IAAI,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,KAAK;AAAA,EAC3E;AACA,aAAW,SAAS;AAAA,IAClB;AAAA,IACA,CAAC,OAAO,QAAgB,UACtB,kBAAkB,KAAK,IAAI,QAAQ,GAAG,MAAM,GAAG,QAAQ;AAAA,EAC3D;AACA,aAAW,SAAS;AAAA,IAClB;AAAA,IACA,CACE,OACA,QACA,cACA,cACA,SACG;AACH,YAAM,QAAQ,gBAAgB,gBAAgB,QAAQ;AACtD,aAAO,kBAAkB,oBAAoB,KAAK,CAAC,IAAI,QAAQ,GAAG,MAAM,GAAG,QAAQ;AAAA,IACrF;AAAA,EACF;AACA,aAAW,WAAW,yBAAyB;AAC7C,eAAW,SAAS,QAAQ,SAAS,QAAQ;AAAA,EAC/C;AACA,SAAO;AACT;AAGO,SAAS,oBACd,OACA,eAA8C,CAAC,GAC5C;AACH,SAAO,wBAAwB,OAAO,cAAc,oBAAI,QAAgB,GAAG,CAAC;AAC9E;AAGO,SAAS,qBACd,cAC6B;AAC7B,QAAM,WAAW,eAAe,YAAY,EAAE,IAAI,CAAC,EAAE,QAAQ,MAAM,OAAO;AAAA,IACxE,MAAM,OAAO,MAAM,aAAa,QAAQ,EAAE;AAAA,IAC1C;AAAA,EACF,EAAE;AACF,SAAO,CAAC,UAAmB,oBAAoB,OAAO,QAAQ;AAChE;AAOO,SAAS,qBACd,YACA,eAA8C,CAAC,GACvC;AACR,MAAI;AACF,WAAO,KAAK,UAAU,oBAAoB,KAAK,MAAM,UAAU,GAAG,YAAY,CAAC;AAAA,EACjF,QAAQ;AACN,WAAO,oBAAoB,YAAY,YAAY;AAAA,EACrD;AACF;AAEO,SAAS,iBAAoB,OAAa;AAC/C,SAAO;AACT;AAEA,SAAS,wBACP,OACA,cACA,MACA,OACG;AACH,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,oBAAoB,OAAO,YAAY;AAAA,EAChD;AACA,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,iBAAiB,MAAM;AAChE,WAAO;AAAA,EACT;AACA,MAAI,SAAS,qBAAqB;AAChC,WAAO;AAAA,EACT;AACA,MAAI,KAAK,IAAI,KAAK,GAAG;AACnB,WAAO;AAAA,EACT;AACA,OAAK,IAAI,KAAK;AACd,MAAI;AACF,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,aAAO,MAAM,IAAI,CAAC,SAAS,wBAAwB,MAAM,cAAc,MAAM,QAAQ,CAAC,CAAC;AAAA,IACzF;AACA,QAAI,CAAC,cAAc,KAAK,GAAG;AACzB,aAAO;AAAA,IACT;AACA,UAAM,WAAW,oBAAI,IAAY;AACjC,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAC1C,cAAM,UAAU,cAAc,mBAAmB,KAAK,YAAY,GAAG,QAAQ;AAC7E,YAAI,qBAAqB,GAAG,GAAG;AAC7B,iBAAO,CAAC,SAAS,QAAQ;AAAA,QAC3B;AACA,YAAI,mBAAmB,GAAG,MAAM,WAAW;AACzC,iBAAO,CAAC,SAAS,gBAAgB,OAAO,cAAc,MAAM,QAAQ,CAAC,CAAC;AAAA,QACxE;AACA,eAAO,CAAC,SAAS,wBAAwB,OAAO,cAAc,MAAM,QAAQ,CAAC,CAAC;AAAA,MAChF,CAAC;AAAA,IACH;AAAA,EACF,UAAE;AACA,SAAK,OAAO,KAAK;AAAA,EACnB;AACF;AAEA,SAAS,gBACP,OACA,cACA,MACA,OACS;AACT,MAAI,CAAC,cAAc,KAAK,GAAG;AACzB,WAAO,wBAAwB,OAAO,cAAc,MAAM,KAAK;AAAA,EACjE;AACA,MAAI,SAAS,oBAAqB,QAAO;AACzC,MAAI,KAAK,IAAI,KAAK,EAAG,QAAO;AAC5B,OAAK,IAAI,KAAK;AACd,MAAI;AACF,UAAM,WAAW,oBAAI,IAAY;AACjC,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAC1C,cAAM,UAAU,cAAc,mBAAmB,KAAK,YAAY,GAAG,QAAQ;AAC7E,eAAO;AAAA,UACL;AAAA,UACA,uBAAuB,GAAG,IACtB,WACA,wBAAwB,OAAO,cAAc,MAAM,QAAQ,CAAC;AAAA,QAClE;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,UAAE;AACA,SAAK,OAAO,KAAK;AAAA,EACnB;AACF;AAEA,SAAS,eAAe,cAA+D;AACrF,QAAM,SAAS,oBAAI,IAAoB;AACvC,aAAW,UAAU,cAAc;AACjC,QAAI,OAAO,MAAM,SAAS,+BAA+B,OAAO,IAAI,OAAO,KAAK,GAAG;AACjF;AAAA,IACF;AACA,WAAO,IAAI,OAAO,OAAO,aAAa,eAAe,OAAO,IAAI,CAAC,GAAG;AAAA,EACtE;AACA,SAAO,CAAC,GAAG,MAAM,EACd,IAAI,CAAC,CAAC,OAAO,MAAM,OAAO,EAAE,QAAQ,MAAM,EAAE,EAC5C,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,SAAS,EAAE,MAAM,UAAU,EAAE,OAAO,cAAc,EAAE,MAAM,CAAC;AACvF;AAEA,SAAS,uBAAuB,MAAc,UAA6C;AACzF,MAAI,WAAW;AACf,aAAW,UAAU,UAAU;AAC7B,QAAI,SAAS,SAAS,OAAO,KAAK,GAAG;AACnC,iBAAW,SAAS,MAAM,OAAO,KAAK,EAAE,KAAK,OAAO,MAAM;AAAA,IAC5D;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,MAAc,UAA+B;AAClE,MAAI,YAAY;AAChB,MAAI,SAAS;AACb,SAAO,SAAS,IAAI,SAAS,GAAG;AAC9B,gBAAY,GAAG,IAAI,IAAI,MAAM;AAC7B,cAAU;AAAA,EACZ;AACA,WAAS,IAAI,SAAS;AACtB,SAAO;AACT;AAEA,SAAS,eAAe,MAAsB;AAC5C,QAAM,OAAO,KACV,YAAY,EACZ,QAAQ,gBAAgB,GAAG,EAC3B,QAAQ,YAAY,EAAE;AACzB,SAAO,KAAK,MAAM,GAAG,EAAE,KAAK;AAC9B;AAEA,SAAS,mBAAmB,MAAsB;AAChD,SAAO,KAAK,YAAY,EAAE,QAAQ,WAAW,EAAE;AACjD;AAEA,SAAS,cAAc,OAAkD;AACvE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,SAAO,cAAc,OAAO,aAAa,cAAc;AACzD;AAEA,SAAS,kBAAkB,OAAwB;AACjD,SAAO,sCAAsC,KAAK,KAAK;AACzD;AAEA,SAAS,oBAAoB,OAAuB;AAClD,MACE,MAAM,UAAU,MACd,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,KAC1C,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,IAC9C;AACA,WAAO,MAAM,MAAM,GAAG,EAAE;AAAA,EAC1B;AACA,SAAO;AACT;;;AC3WA,SAAS,KAAAC,UAAS;AAEX,IAAM,iDAAiD;AACvD,IAAM,gDAAgD;AACtD,IAAM,kDAAkD;AACxD,IAAM,mDAAmD;AAEzD,IAAM,iCAAiCA,GAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;AAGnE,IAAM,kCAAkCA,GAAE,KAAK,CAAC,UAAU,MAAM,CAAC;AAGjE,IAAM,6CAA6CA,GAAE,KAAK;AAAA,EAC/D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKM,IAAM,kDAAkDA,GAAE,KAAK;AAAA,EACpE;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKM,IAAM,2CAA2CA,GAAE,KAAK,CAAC,YAAY,UAAU,CAAC;AAKhF,IAAM,oCAAoCA,GAC9C,OAAO,EACP,IAAI,CAAC,EACL,IAAI,+CAA+C,EACnD,MAAM,qCAAqC;AAOvC,SAAS,2CAA2C,OAAuB;AAChF,SAAO,MAAM,UAAU,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG,EAAE,QAAQ,OAAO,GAAG;AAC9F;AAEA,IAAM,iBAAiBA,GACpB,OAAO,EACP,UAAU,0CAA0C,EACpD,KAAK,iCAAiC;AAEzC,IAAM,cAAc;AAAA,EAClB,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS,kCAAkC,SAAS;AACtD;AAEA,SAAS,eACP,OAKA,SACM;AACN,MAAI,MAAM,SAAS,cAAc,MAAM,UAAU,YAAY,MAAM,YAAY,OAAO;AACpF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,OAAO;AAAA,MACd,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,UAAU,YAAY,MAAM,YAAY,MAAM;AACtD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,UAAU,WAAW,MAAM,SAAS,YAAY,MAAM,YAAY,OAAO;AACjF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAEO,IAAM,mCAAmCA,GAAE,OAAO,WAAW,EAAE,YAAY,cAAc;AAGzF,IAAM,uCAAuCA,GAAE,OAAO;AAAA,EAC3D,QAAQ;AAAA,EACR,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,gDAAgD,EAAE,SAAS;AAC7F,CAAC;AAKD,IAAM,wBAAwB;AAAA,EAC5B,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,aAAaA,GAAE,OAAO,EAAE,MAAM,gBAAgB;AAChD;AAEO,IAAM,6CAA6CA,GAAE,OAAO,qBAAqB;AAKjF,IAAM,qCAAqCA,GAAE,OAAO;AAAA,EACzD,GAAG;AAAA,EACH,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,GAAG;AAAA,EACH,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,8CAA8C;AAAA,EAC7E,YAAY;AAAA,EACZ,sBAAsBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACjD,oBAAoBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpC,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,iCAAiCA,GAAE,OAAO;AAAA,EACrD,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,GAAG;AAAA,EACH,YAAYA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,aAAaA,GAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EAC9C,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC7C,aAAaA,GAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAGM,IAAM,4CAA4CA,GAAE,OAAO;AAAA,EAChE,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,GAAG;AAAA,EACH,MAAM;AAAA,EACN,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC7C,aAAa,2CAA2C,SAAS;AAAA,EACjE,aAAa;AAAA,EACb,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAChC,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,6CAA6C;AAAA,EAC3E,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAKM,IAAM,+CAA+CA,GACzD,OAAO;AAAA,EACN,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS,eAAe,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC/C,SAASA,GACN,OAAO,EACP,IAAI,CAAC,EACL,IAAI,8CAA8C,EAClD,OAAO,CAAC,UAAU,MAAM,KAAK,EAAE,SAAS,GAAG,8CAA8C;AAAA,EAC5F,kBAAkB,gDAAgD,QAAQ,OAAO;AAAA,EACjF,oBAAoBA,GACjB,OAAO,EACP,IAAI,CAAC,EACL,IAAI,gDAAgD,EACpD,SAAS,EACT,QAAQ,IAAI;AAAA,EACf,sBAAsBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AACjE,CAAC,EACA,YAAY,cAAc;AAKtB,IAAM,qDAAqDA,GAC/D,OAAO;AAAA,EACN,sBAAsBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AACjE,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsCA,GAAE,OAAO;AAAA,EAC1D,MAAM,+BAA+B,SAAS;AAAA,EAC9C,OAAO,gCAAgC,SAAS;AAAA,EAChD,SAAS,eAAe,SAAS,EAAE,SAAS;AAAA,EAC5C,eAAeA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3D,OAAOA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAC3D,CAAC;AAKM,IAAM,yCAAyCA,GAAE,OAAO;AAAA,EAC7D,WAAWA,GAAE,MAAM,kCAAkC;AAAA,EACrD,aAAaA,GAAE,MAAM,8BAA8B;AAAA,EACnD,kBAAkBA,GAAE,MAAM,yCAAyC;AAAA,EACnE,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC1D,CAAC;AAKM,IAAM,wCAAwCA,GAClD,OAAO;AAAA,EACN,gBAAgBA,GAAE,OAAO,EAAE,KAAK;AAAA,EAChC,cAAcA,GAAE,OAAO,EAAE,KAAK;AAChC,CAAC,EACA,OAAO,CAAC,UAAU,MAAM,mBAAmB,MAAM,cAAc;AAAA,EAC9D,SAAS;AAAA,EACT,MAAM,CAAC,cAAc;AACvB,CAAC;AAKI,IAAM,yCAAyCA,GAAE,OAAO;AAAA,EAC7D,MAAM;AAAA,EACN,IAAI;AAAA,EACJ,QAAQA,GAAE,QAAQ,SAAS;AAAA,EAC3B,MAAMA,GAAE,OAAO;AACjB,CAAC;AAKM,IAAM,4CAA4CA,GAAE,OAAO;AAAA,EAChE,2BAA2BA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtD,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,6CAA6C;AACpF,CAAC;AAKM,IAAM,4CAA4CA,GAAE,OAAO;AAAA,EAChE,kBAAkBA,GAAE,OAAO,EAAE,KAAK;AAAA,EAClC,2BAA2BA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3C,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,6CAA6C;AACpF,CAAC;AAKM,IAAM,+CAA+CA,GAAE,OAAO;AAAA,EACnE,MAAM;AAAA,EACN,OAAO;AACT,CAAC;AAKM,IAAM,6CAA6CA,GAAE,OAAO;AAAA,EACjE,MAAMA,GAAE,QAAQ,uCAAuC;AAAA,EACvD,SAASA,GAAE,OAAO;AAAA,EAClB,aAAa,+BAA+B,SAAS;AACvD,CAAC;;;ALvNM,IAAM,gBAAgBC,GAAE,KAAK;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQM,IAAM,iBAAiBA,GAAE,KAAK;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAIM,IAAM,YAAYA,GAAE,KAAK,CAAC,SAAS,SAAS,SAAS,CAAC;AAItD,IAAM,wBAAwBA,GAAE,KAAK;AAAA,EAC1C;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF,CAAC;AAoDM,IAAM,sBAAsB;AAM5B,IAAM,uBAAuB;AAM7B,IAAM,yBAAuE;AAAA,EAClF,OAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,gBAAgB,KAAK,KAAK,KAAK;AAAA,MAC/B,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,aAAa,gBAAgB,KAAK;AAAA,IACpD,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,MAAM;AAAA;AAAA,IACtE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,SAAS;AAAA,IACP,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,sBAAsB,gBAAgB,KAAK;AAAA,IAC7D,cAAc,EAAE,MAAM,eAAe,uBAAuB,MAAM;AAAA,IAClE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,SAAS;AAAA,IACP,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA,MACjE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,sBAAsB,gBAAgB,KAAK;AAAA,IAC7D,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,MAAM;AAAA;AAAA,IACtE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,KAAK;AAAA,IACH,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA;AAAA,MACjE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,sBAAsB,gBAAgB,KAAK;AAAA,IAC7D,cAAc,EAAE,MAAM,eAAe,uBAAuB,MAAM;AAAA,IAClE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA;AAAA,MACjE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,YAAY,gBAAgB,KAAK;AAAA,IACnD,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,KAAK;AAAA;AAAA,IACrE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,YAAY;AAAA,IACV,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,YAAY,gBAAgB,KAAK;AAAA,IACnD,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,MAAM;AAAA,IACtE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA,MACjE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,gBAAgB,IAAI,KAAK,KAAK;AAAA,MAC9B,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,YAAY,gBAAgB,KAAK;AAAA,IACnD,cAAc,EAAE,MAAM,eAAe,uBAAuB,MAAM;AAAA,IAClE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,cAAc,gBAAgB,KAAK;AAAA,IACrD,cAAc,EAAE,MAAM,cAAc,uBAAuB,MAAM;AAAA,IACjE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,OAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA,IAGT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,cAAc,gBAAgB,KAAK;AAAA,IACrD,cAAc,EAAE,MAAM,cAAc,uBAAuB,MAAM;AAAA,IACjE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,MAAM;AAAA,IACJ,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,OAAO,UAAU,KAAK;AAAA,MAC/C,UAAU,EAAE,WAAW,OAAO,WAAW,MAAM,KAAK,MAAM;AAAA,MAC1D,KAAK,EAAE,WAAW,MAAM;AAAA,MACxB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,QAAQ,gBAAgB,MAAM;AAAA,IAChD,cAAc,EAAE,MAAM,QAAQ,uBAAuB,MAAM;AAAA,IAC3D,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,YAAY;AAAA,IACV,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,SAAS,SAAS,SAAS,GAAG,SAAS,QAAQ;AAAA,IACjE,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,UAAU,KAAK,KAAK;AAAA;AAAA,MAC5D,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,MAKR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA;AAAA,IACpB;AAAA;AAAA;AAAA;AAAA,IAIA,UAAU,EAAE,MAAM,QAAQ,gBAAgB,MAAM;AAAA,IAChD,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,KAAK;AAAA,IACrE,eAAe;AAAA;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AACF;AAEO,IAAM,kBAAkBA,GAAE,KAAK,CAAC,QAAQ,WAAW,OAAO,UAAU,QAAQ,OAAO,CAAC;AAGpF,IAAM,YAAYA,GAAE,KAAK;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,OAAOA,GAAE,OAAO;AAAA,IACd,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,GAAG;AAAA,IACzC,MAAM;AAAA,IACN,SAASA,GAAE,OAAO;AAAA,IAClB,WAAWA,GAAE,QAAQ;AAAA,IACrB,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACtD,CAAC;AACH,CAAC;AAIM,IAAM,yBAAyB;AAC/B,IAAM,wBAAwBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,sBAAsB;AAGvF,IAAM,+BAA+BA,GACzC,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,IAAI,yBAAyB,CAAC;AAE1B,IAAM,+BAA+BA,GAAE,KAAK;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAIM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,8BAA8B;AAAA,EAC9B,sCAAsC,sBAAsB,SAAS;AAAA,EACrE,cAAc;AAAA,EACd,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,MAAMA,GAAE,KAAK,CAAC,+BAA+B,uCAAuC,CAAC;AAAA,EACrF,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACpC,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,aAAaA,GAAE,KAAK;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA,EACA;AACF,CAAC;AAWM,IAAM,sCAAsC;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,oBAAoBC,aAAoB,UAA0B;AAChF,SAAO,GAAGA,WAAU,KAAK,QAAQ;AACnC;AAEO,IAAM,oBAAoBD,GAAE,KAAK,CAAC,SAAS,cAAc,SAAS,CAAC;AAGnE,IAAM,cAAcA,GAAE,KAAK,CAAC,YAAY,QAAQ,CAAC;AAGjD,IAAM,mBAAmBA,GAAE,KAAK,CAAC,QAAQ,UAAU,SAAS,CAAC;AAG7D,IAAM,kBAAkBA,GAAE,KAAK,CAAC,QAAQ,UAAU,SAAS,CAAC;AAG5D,IAAM,cAAcA,GAAE,KAAK,CAAC,SAAS,SAAS,QAAQ,CAAC;AAGvD,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAMA,GAAE,OAAO;AAAA,EACf,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACpC,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,YAAYA,GAAE,OAAO;AAAA,EAChC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,MAAMA,GAAE,OAAO;AAAA,EACf,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACpC,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhC,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIvC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,kBAAkBA,GAAE,OAAO;AAAA,IACzB,OAAOA,GAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAAA,IAClC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACvC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC5B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC;AAAA;AAAA,EAED,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,+BAA+BA,GACzC,OAAO;AAAA,EACN,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAClD,gBAAgBA,GAAE,KAAK,CAAC,WAAW,MAAM,CAAC;AAAA;AAAA,EAE1C,wBAAwBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnD,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACrD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,QAAQ,YAAY;AAChC,MAAI,OAAO,aAAa,kBAAkB,OAAO,mBAAmB,QAAQ;AAC1E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,OAAO,mBAAmB,UAAU,OAAO,2BAA2B,MAAM;AAC9E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,wBAAwB;AAAA,MAC/B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,OAAO,mBAAmB,aAAa,OAAO,2BAA2B,MAAM;AACjF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,wBAAwB;AAAA,MAC/B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,yBAAyBA,GAAE,KAAK;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,wBAAwBA,GAClC,OAAO;AAAA,EACN,mBAAmBA,GAAE,OAAO,EAAE,OAAO,EAAE,YAAY;AAAA,EACnD,iBAAiBA,GAAE,OAAO,EAAE,OAAO,EAAE,YAAY;AACnD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,MAAM,YAAY;AAC9B,MAAI,KAAK,kBAAkB,KAAK,mBAAmB;AACjD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,uBAAuBA,GACjC,OAAO;AAAA,EACN,IAAIA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACpC,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACpD,CAAC,EACA,OAAO;AAGH,IAAM,oBAAoBA,GAC9B,OAAO;AAAA,EACN,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,MAAM;AAAA,EACN,YAAYA,GAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvD,SAAS,qBAAqB,SAAS;AACzC,CAAC,EACA,OAAO;AAGH,IAAM,8BAA8BA,GACxC,OAAO;AAAA,EACN,kBAAkBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC5D,MAAM,sBAAsB,SAAS;AAAA,EACrC,YAAYA,GAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvD,SAAS,qBAAqB,SAAS;AAAA,EACvC,OAAOA,GAAE,MAAM,iBAAiB,EAAE,IAAI,GAAM,EAAE,SAAS;AACzD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,UAAU,YAAY;AAClC,MAAI,gBAAgB;AACpB,aAAW,CAAC,OAAO,IAAI,MAAM,SAAS,SAAS,CAAC,GAAG,QAAQ,GAAG;AAC5D,QAAI,KAAK,KAAK,oBAAoB,eAAe;AAC/C,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,SAAS,OAAO,QAAQ,mBAAmB;AAAA,QAClD,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,oBAAgB,KAAK,KAAK;AAC1B,QACE,SAAS,SACR,KAAK,KAAK,oBAAoB,SAAS,KAAK,qBAC3C,KAAK,KAAK,kBAAkB,SAAS,KAAK,kBAC5C;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,SAAS,OAAO,MAAM;AAAA,QAC7B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAGH,IAAM,yBAAyBA,GAC5B,OAAO;AAAA,EACN,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,OAAO,gBAAgB;AAAA,EACpE,YAAYA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EACA,OAAO;AAGH,IAAM,qBAAqBA,GAAE,mBAAmB,QAAQ;AAAA,EAC7D,uBAAuB,OAAO,EAAE,MAAMA,GAAE,QAAQ,sBAAsB,EAAE,CAAC;AAAA,EACzE,uBAAuB,OAAO;AAAA,IAC5B,MAAMA,GAAE,QAAQ,gBAAgB;AAAA,IAChC,mBAAmBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC9C,CAAC;AAAA,EACD,uBAAuB,OAAO;AAAA,IAC5B,MAAMA,GAAE,QAAQ,oBAAoB;AAAA,IACpC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACpC,MAAMA,GAAE,OAAO,EAAE,IAAI,GAAS;AAAA,IAC9B,UAAU,4BAA4B,SAAS;AAAA,EACjD,CAAC;AAAA,EACD,uBAAuB,OAAO;AAAA,IAC5B,MAAMA,GAAE,QAAQ,kBAAkB;AAAA,IAClC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACpC,MAAMA,GAAE,OAAO,EAAE,IAAI,GAAS;AAAA,IAC9B,sBAAsBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IAC/C,UAAU,4BAA4B,SAAS;AAAA,EACjD,CAAC;AAAA,EACD,uBAAuB,OAAO;AAAA,IAC5B,MAAMA,GAAE,QAAQ,OAAO;AAAA,IACvB,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,OAAO,gBAAgB;AAAA,IAC7E,SAASA,GAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,GAAa,EAAE,SAAS;AAAA,EACzE,CAAC;AAAA,EACD,uBAAuB,OAAO;AAAA,IAC5B,MAAMA,GAAE,QAAQ,sBAAsB;AAAA,IACtC,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,GAAM;AAAA,IAClD,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,CAAC;AAAA,EACD,uBAAuB,OAAO;AAAA,IAC5B,MAAMA,GAAE,QAAQ,eAAe;AAAA,IAC/B,MAAM;AAAA,IACN,aAAaA,GAAE,QAAQ;AAAA,EACzB,CAAC;AAAA,EACD,uBAAuB,OAAO;AAAA,IAC5B,MAAMA,GAAE,QAAQ,gBAAgB;AAAA,IAChC,QAAQA,GAAE,KAAK,CAAC,aAAa,aAAa,SAAS,UAAU,CAAC;AAAA,EAChE,CAAC;AACH,CAAC;AASM,IAAM,+BAA+BA,GACzC,OAAO;AAAA,EACN,SAASA,GAAE,QAAQ;AAAA,EACnB,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,SAAS,6BAA6B,SAAS;AAAA,EAC/C,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACpD,oBAAoBA,GAAE,QAAQ;AAAA,EAC9B,aAAaA,GACV,OAAO;AAAA,IACN,SAASA,GAAE,QAAQ;AAAA,IACnB,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACzD,CAAC,EACA,OAAO;AAAA,EACV,WAAWA,GACR,OAAO;AAAA,IACN,MAAMA,GAAE,KAAK,CAAC,QAAQ,iBAAiB,CAAC;AAAA,IACxC,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAC7D,CAAC,EACA,OAAO;AAAA,EACV,SAASA,GACN,OAAO;AAAA,IACN,sBAAsBA,GAAE,QAAQ;AAAA,IAChC,uBAAuBA,GAAE,QAAQ;AAAA,EACnC,CAAC,EACA,OAAO;AAAA,EACV,UAAUA,GACP,OAAO;AAAA,IACN,MAAMA,GAAE,KAAK,CAAC,YAAY,UAAU,CAAC;AAAA,IACrC,SAASA,GAAE,MAAM,4BAA4B,EAAE,IAAI,CAAC;AAAA,EACtD,CAAC,EACA,OAAO;AAAA,EACV,MAAMA,GACH,OAAO;AAAA,IACN,UAAUA,GAAE,QAAQ,KAAK;AAAA,IACzB,YAAYA,GAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,GAAM,EAAE,SAAS;AAAA,IACnE,aAAaA,GAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,GAAS,EAAE,SAAS;AAAA,EACzE,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO,EACP,YAAY,CAAC,QAAQ,YAAY;AAChC,MAAI,OAAO,WAAW,OAAO,iBAAiB,MAAM;AAClD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,OAAO,WAAW,OAAO,YAAY,MAAM;AAC7C,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,OAAO,WAAW,CAAC,OAAO,sBAAsB,OAAO,aAAa,MAAM;AAC5E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,UAAU;AAAA,MACjB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,OAAO,sBAAsB,OAAO,aAAa,MAAM;AACzD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,UAAU;AAAA,MACjB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,OAAO,YAAY,WAAW,OAAO,YAAY,gBAAgB,MAAM;AAC1E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,eAAe,aAAa;AAAA,MACnC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,OAAO,SAAS,SAAS,cAAc,OAAO,SAAS,QAAQ,SAAS,GAAG;AAC7E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,YAAY,SAAS;AAAA,MAC5B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,OAAO,SAAS,SAAS,cAAc,OAAO,SAAS,QAAQ,WAAW,GAAG;AAC/E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,YAAY,SAAS;AAAA,MAC5B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,aAAa,CAAC,OAAO,SAAS,GAAG,OAAO,SAAS,OAAO,EAC3D,OAAO,CAAC,WAAmD,WAAW,IAAI,EAC1E;AAAA,IAAI,CAAC,WACJ;AAAA,MACE,OAAO;AAAA,MACP,OAAO,SAAS;AAAA,MAChB,OAAO;AAAA,MACP,OAAO,0BAA0B;AAAA,MACjC,OAAO,UAAU;AAAA,IACnB,EAAE,KAAK,IAAQ;AAAA,EACjB;AACF,MAAI,IAAI,IAAI,UAAU,EAAE,SAAS,WAAW,QAAQ;AAClD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,YAAY,SAAS;AAAA,MAC5B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAMI,IAAM,0BAA0BA,GACpC,OAAO;AAAA,EACN,eAAeA,GAAE,QAAQ,EAAE,SAAS;AAAA,EACpC,eAAe,6BAA6B,SAAS;AAAA;AAAA;AAAA,EAGrD,qBAAqB,sBAAsB,SAAS,EAAE,SAAS;AACjE,CAAC,EACA,YAAY;AAIR,SAAS,8BAA8B,UAA4B;AACxE,QAAM,SAAS,wBAAwB,UAAU,YAAY,CAAC,CAAC;AAC/D,SAAO,OAAO,UAAU,OAAO,KAAK,kBAAkB,OAAO;AAC/D;AAKO,IAAM,iCAAiCA,GAC3C,OAAO;AAAA,EACN,eAAeA,GAAE,QAAQ,EAAE,SAAS;AAAA,EACpC,eAAe,6BAA6B,SAAS;AAAA,EACrD,qBAAqB,sBAAsB,SAAS,EAAE,SAAS;AACjE,CAAC,EACA,YAAY;AAGR,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACpC,CAAC;AAOM,IAAM,oCAAoCA,GAAE,OAAO;AAAA,EACxD,kBAAkBA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EAClF,eAAeA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAClF,CAAC;AAGD,IAAM,8BAA8B;AAAA,EAClC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAE3B,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACpC;AAGO,IAAM,2CAA2C;AAQjD,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,MAAMA,GAAE,QAAQ,SAAS;AAAA,EACzB,WAAWA,GACR,OAAO,EACP,IAAI,CAAC,EACL,IAAI,IAAI,EACR,OAAO,CAAC,UAAU,UAAU,0CAA0C;AAAA,IACrE,SAAS;AAAA,EACX,CAAC;AAAA;AAAA,EAEH,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAC7C,CAAC;AAQM,IAAM,uBAAuBA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAGpE,IAAM,0CAA0C,oBAAI,IAAI;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,8BAA8B,qBAAqB,YAAY,CAAC,OAAO,QAAQ;AAC1F,aAAW,OAAO,yCAAyC;AACzD,QAAI,OAAO,UAAU,eAAe,KAAK,OAAO,GAAG,GAAG;AACpD,UAAI,SAAS;AAAA,QACX,MAAMA,GAAE,aAAa;AAAA,QACrB,MAAM,CAAC,GAAG;AAAA,QACV,SAAS,GAAG,GAAG;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI;AACF,QAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa,MAAM;AACrE,UAAI,SAAS;AAAA,QACX,MAAMA,GAAE,aAAa;AAAA,QACrB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AACN,QAAI,SAAS;AAAA,MACX,MAAMA,GAAE,aAAa;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGM,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,MAAM,YAAY,SAAS;AAAA,EAC3B,aAAaA,GAAE,MAAM,UAAU;AAAA,EAC/B,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,SAAS;AACvD,CAAC;AAGM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,aAAaA,GAAE,MAAM,UAAU;AAAA,EAC/B,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGrD,kBAAkB,qBAAqB,SAAS;AAAA,EAChD,yBAAyB,4BAA4B,SAAS;AAChE,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,MAAM;AAAA,EACN,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,eAAeA,GAAE,MAAM,YAAY;AAAA,EACnC,iBAAiBA,GAAE,MAAM,WAAW;AAAA,EACpC,kBAAkBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,oBAAoBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACjD,CAAC;AAGM,IAAM,8BAA8BA,GACxC,OAAO;AAAA,EACN,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,aAAaA,GAAE,MAAM,UAAU,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,EAItC,kBAAkB,qBAAqB,SAAS;AAAA,EAChD,yBAAyB,4BAA4B,SAAS;AAAA;AAAA;AAAA,EAG9D,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA,EAGnC,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC,EACA,YAAY,CAAC,SAAS,QAAQ;AAC7B,MAAI,QAAQ,2BAA2B,CAAC,QAAQ,kBAAkB;AAChE,QAAI,SAAS;AAAA,MACX,MAAMA,GAAE,aAAa;AAAA,MACrB,MAAM,CAAC,yBAAyB;AAAA,MAChC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,QAAQ,qBACP,QAAQ,WAAW,UAClB,QAAQ,cAAc,UACtB,QAAQ,wBAAwB,SAClC;AACA,QAAI,SAAS;AAAA,MACX,MAAMA,GAAE,aAAa;AAAA,MACrB,MAAM,CAAC,kBAAkB;AAAA,MACzB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGH,IAAM,6BAA6B;AACnC,IAAM,oCAAoC;AAE1C,eAAsB,yBACpB,QACA,SACiB;AACjB,QAAM,SAAS,4BAA4B,MAAM,OAAO;AACxD,QAAM,SAAS,OAAO,mBAClB,oCACA;AACJ,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,MAAM,CAAC;AAI7D,QAAM,YAAY,MAAM;AAAA,IACtB;AAAA,IACA,WAAW,oCAAoC,GAAG,MAAM,GAAG,cAAc,KAAK;AAAA,EAChF;AACA,SAAO,GAAG,MAAM,GAAG,cAAc,IAAI,SAAS;AAChD;AAEA,eAAsB,2BACpB,QACA,OACA,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACI;AAC7C,QAAM,SAAS,MAAM,WAAW,iCAAiC,IAC7D,oCACA,MAAM,WAAW,0BAA0B,IACzC,6BACA;AACN,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,OAAO,MAAM;AAC/C,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA,WAAW,oCAAoC,GAAG,MAAM,GAAG,cAAc,KAAK;AAAA,EAChF;AACA,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,4BAA4B,UAAU,OAAO;AAC7D,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,MACG,WAAW,uCACX,QAAQ,KAAK,qBAAqB,SACnC;AACA,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAaO,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,SAASA,GAAE,OAAO,EAAE,KAAK;AAAA,EACzB,cAAcA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE9B,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,qBACpB,QACA,SACiB;AACjB,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,wBAAwB,MAAM,OAAO,CAAC,CAAC;AAC7F,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,OAAO,cAAc,IAAI,SAAS;AAC3C;AAEA,eAAsB,uBACpB,QACA,OACA,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACA;AACzC,MAAI,CAAC,MAAM,WAAW,MAAM,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,OAAO,MAAM;AAC/C,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,QAAM,UAAU,wBAAwB,UAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC,CAAC;AAC7F,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAgBO,IAAM,qBAAqBA,GAAE,OAAO;AAAA;AAAA;AAAA,EAGzC,KAAKA,GAAE,QAAQ,QAAQ;AAAA,EACvB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA,EAG3B,oBAAoBA,GAAE,QAAQ;AAAA,EAC9B,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAClC,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,gBACpB,QACA,SACiB;AACjB,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,mBAAmB,MAAM,OAAO,CAAC,CAAC;AACxF,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,QAAQ,cAAc,IAAI,SAAS;AAC5C;AAUA,eAAsB,kBACpB,QACA,OACA,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACL;AACpC,MAAI,CAAC,MAAM,WAAW,OAAO,GAAG;AAC9B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,QAAQ,MAAM;AAChD,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,mBAAmB,UAAU,OAAO;AACpD,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAmBO,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE3B,UAAUA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE1B,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EAEzC,MAAMA,GAAE,KAAK,CAAC,QAAQ,SAAS,CAAC;AAAA;AAAA,EAEhC,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAGhC,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,gBACpB,QACA,SACiB;AACjB,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,mBAAmB,MAAM,OAAO,CAAC,CAAC;AACxF,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,OAAO,cAAc,IAAI,SAAS;AAC3C;AAYA,eAAsB,kBACpB,QACA,OACA,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACL;AACpC,MAAI,CAAC,MAAM,WAAW,MAAM,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,OAAO,MAAM;AAC/C,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,mBAAmB,UAAU,OAAO;AACpD,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAyBO,IAAM,oBAAoBA,GAAE,OAAO;AAAA;AAAA;AAAA,EAGxC,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE7B,SAASA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAEzB,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,eAAe,QAAgB,SAA6C;AAChG,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,kBAAkB,MAAM,OAAO,CAAC,CAAC;AACvF,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,OAAO,cAAc,IAAI,SAAS;AAC3C;AAWA,eAAsB,iBACpB,QACA,OACA,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACN;AACnC,MAAI,CAAC,MAAM,WAAW,MAAM,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,OAAO,MAAM;AAC/C,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,kBAAkB,UAAU,OAAO;AACnD,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAEO,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvC,mBAAmBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAC3D,CAAC;AAGM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAG5C,mBAAmBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAC3D,CAAC;AAGM,IAAM,SAASA,GAAE,OAAO;AAAA,EAC7B,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,MAAMA,GAAE,OAAO;AAAA,EACf,QAAQA,GAAE,OAAO;AAAA,EACjB,aAAaA,GAAE,MAAM,UAAU;AAAA,EAC/B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAaA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,aAAaA,GAAE,MAAM,UAAU,EAAE,IAAI,CAAC;AAAA,EACtC,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC;AAGM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,QAAQ;AAAA,EACR,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AACzB,CAAC;AAMM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,MAAMA,GAAE,OAAO;AAAA,EACf,aAAaA,GAAE,MAAM,UAAU;AAAA,EAC/B,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,SAASA,GAAE,MAAM,eAAe;AAClC,CAAC;AAGM,IAAM,4BAA4BA,GAAE,OAAO;AAAA;AAAA;AAAA,EAGhD,OAAOA,GAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,aAAaA,GAAE,MAAM,UAAU;AACjC,CAAC;AAGM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,aAAaA,GAAE,MAAM,UAAU;AACjC,CAAC;AAGM,IAAM,iBAAiBA,GAAE,KAAK;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA;AAAA,EAEA;AACF,CAAC;AAGM,IAAM,aAAaA,GAAE,OAAO;AAAA,EACjC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW;AAAA,EACX,UAAUA,GAAE,OAAO;AAAA,EACnB,MAAMA,GAAE,OAAO;AAAA,EACf,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxC,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,gBAAgBA,GAAE,OAAO;AAAA,EACzB,YAAYA,GAAE,OAAO;AAAA,EACrB,YAAYA,GAAE,OAAO;AAAA,EACrB,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,wBAAwBA,GAAE,OAAO,EAAE,SAAS;AAC9C,CAAC;AAGM,IAAM,cAAcA,GAAE,KAAK;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,yBAAyBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9D,wBAAwBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7D,0BAA0BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACzD,iCAAiCA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACtE,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,gCAAgCA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACrE,sCAAsCA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC7E,CAAC;AAGM,IAAM,mBAAmBA,GAAE,MAAM,CAACA,GAAE,QAAQ,GAAGA,GAAE,OAAO,GAAGA,GAAE,OAAO,GAAGA,GAAE,MAAMA,GAAE,OAAO,CAAC,CAAC,CAAC;AAG3F,IAAM,eAAeA,GAAE,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,GAAG,gBAAgB;AAGjE,IAAM,gBAAgBA,GAAE,mBAAmB,WAAW;AAAA,EAC3DA,GAAE,OAAO,EAAE,SAASA,GAAE,QAAQ,IAAI,EAAE,CAAC;AAAA,EACrCA,GAAE,OAAO;AAAA,IACP,SAASA,GAAE,QAAQ,KAAK;AAAA,IACxB,MAAMA,GAAE,OAAO;AAAA,IACf,SAASA,GAAE,OAAO;AAAA,EACpB,CAAC;AACH,CAAC;AAsBM,IAAM,sBAAsBA,GAAE,mBAAmB,WAAW;AAAA,EACjEA,GAAE,OAAO,EAAE,SAASA,GAAE,QAAQ,IAAI,GAAG,UAAUA,GAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAAA,EACtEA,GAAE,OAAO;AAAA,IACP,SAASA,GAAE,QAAQ,KAAK;AAAA,IACxB,QAAQA,GAAE,OAAO;AAAA,IACjB,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC1B,UAAUA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,CAAC;AACH,CAAC;AAcM,IAAM,wBAAwBA,GAAE,KAAK,CAAC,UAAU,UAAU,cAAc,CAAC;AAMzE,IAAM,yBAAyBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAGxD,IAAM,sBAAsBA,GAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAG3D,IAAM,0BAA0BA,GAAE,MAAM,CAACA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAGA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjF,IAAM,6BAA6BA,GAAE,OAAO;AAAA,EACjD,UAAU,sBAAsB,SAAS;AAAA,EACzC,qBAAqB,uBAAuB,SAAS;AAAA,EACrD,QAAQ,oBAAoB,SAAS;AAAA,EACrC,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,cAAc,wBAAwB,SAAS;AAAA,EAC/C,gBAAgB,wBAAwB,SAAS;AAAA,EACjD,WAAW,wBAAwB,SAAS;AAAA,EAC5C,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAC3C,CAAC;AA+OM,IAAM,6BAA6BA,GACvC,OAAO;AAAA;AAAA,EAEN,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAMA,GAAE,QAAQ,YAAY;AAC9B,CAAC,EACA,OAAO;AAGV,IAAM,8BAA8BA,GACjC,MAAM,0BAA0B,EAChC,IAAI,CAAC,EACL,IAAI,GAAG,EACP,YAAY,CAAC,WAAW,YAAY;AACnC,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,CAAC,OAAO,QAAQ,KAAK,UAAU,QAAQ,GAAG;AACnD,UAAM,MAAM,GAAG,SAAS,IAAI,KAAK,SAAS,EAAE;AAC5C,QAAI,KAAK,IAAI,GAAG,GAAG;AACjB,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM,CAAC,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AACA,SAAK,IAAI,GAAG;AAAA,EACd;AACF,CAAC;AAEI,IAAM,yBAAyBA,GACnC,OAAO;AAAA;AAAA,EAEN,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAEzC,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAE9C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAChC,MAAMA,GAAE,KAAK,CAAC,UAAU,WAAW,eAAe,WAAW,CAAC,EAAE,SAAS;AAAA,EACzE,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA,EAE5C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAErC,mBAAmB,4BAA4B,SAAS;AAAA,EACxD,cAAcA,GAAE,KAAK,CAAC,aAAa,SAAS,CAAC,EAAE,SAAS;AAC1D,CAAC,EACA,OAAO,EACP,YAAY,CAAC,WAAW,YAAY;AACnC,MAAI,CAAC,UAAU,kBAAmB;AAClC,MAAI,CAAC,UAAU,cAAc;AAC3B,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM,CAAC,cAAc;AAAA,IACvB,CAAC;AAAA,EACH;AACA,MAAI,CAAC,UAAU,UAAU;AACvB,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM,CAAC,UAAU;AAAA,IACnB,CAAC;AAAA,EACH;AACF,CAAC;AAuKI,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,eAAeA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC9B,UAAUA,GAAE,QAAQ,KAAK;AAAA,EACzB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,WAAWA,GACR,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAM,EACV;AAAA,IACC,CAAC,UAAU,OAAO,SAAS,KAAK,KAAK,KAAK,IAAI,QAAQ,KAAK,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI;AAAA,IACvF,EAAE,SAAS,oCAAoC;AAAA,EACjD;AAAA,EACF,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACvC,CAAC;AAGM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,mBAAmBA,GAAE,OAAO;AAAA,EAC5B,KAAKA,GAAE,OAAO,EAAE,IAAI;AACtB,CAAC;AAGM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,MAAMA,GAAE,QAAQ,YAAY;AAAA,EAC5B,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACpC,UAAU,sBAAsB,SAAS;AAAA,EACzC,qBAAqB,uBAAuB,SAAS;AAAA,EACrD,QAAQ,oBAAoB,SAAS;AAAA,EACrC,cAAc,wBAAwB,SAAS;AAAA,EAC/C,gBAAgB,wBAAwB,SAAS;AAAA,EACjD,WAAW,wBAAwB,SAAS;AAAA,EAC5C,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3D,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC3D,CAAC;AAGD,SAAS,2BAA2B,OAA+B;AACjE,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,KAAK,QAAQ,EAAG,QAAO;AAC9E,MAAI,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,KAAK,OAAO,KAAK,IAAI,GAAG;AACzE,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,SAAO;AACT;AAOO,SAAS,mCACd,UAC8B;AAC9B,MAAI,SAAS,SAAU,QAAO,SAAS;AACvC,MACE,2BAA2B,SAAS,oBAAoB,KACxD,2BAA2B,SAAS,kBAAkB,GACtD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOO,SAAS,oCACd,UACA,WAAyC,mCAAmC,QAAQ,GACrD;AAC/B,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,iBACJ,aAAa,WACT,2BAA2B,SAAS,wBAAwB,SAAS,cAAc,IACnF;AACN,SACE,SAAS,uBACT,SAAS,iBACR,iBAAiB,uBAAuB,cAAc,KAAK;AAEhE;AAEO,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,MAAMA,GAAE,QAAQ,MAAM;AAAA,EACtB,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACxC,CAAC;AAGM,IAAM,cAAcA,GAAE,mBAAmB,QAAQ,CAAC,uBAAuB,eAAe,CAAC;AAGzF,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAUO,SAAS,2BAA2B,MAAsB;AAC/D,QAAM,uBAAuB,KAAK,KAAK,EAAE,QAAQ,OAAO,GAAG;AAC3D,MACE,CAAC,wBACD,qBAAqB,WAAW,GAAG,KACnC,eAAe,KAAK,oBAAoB,KACxC,qBAAqB,SAAS,IAAI,GAClC;AACA,UAAM,IAAI,uBAAuB,gCAAgC,IAAI,EAAE;AAAA,EACzE;AACA,QAAM,WAAW,qBAAqB,MAAM,GAAG;AAC/C,MACE,SAAS;AAAA,IACP,CAAC,YACC,CAAC,WACD,YAAY,OACZ,YAAY,QACZ,yBAAyB,KAAK,OAAO,KACrC,QAAQ,KAAK,OAAO,KACpB,kDAAkD,KAAK,OAAO;AAAA,EAClE,GACA;AACA,UAAM,IAAI,uBAAuB,gCAAgC,IAAI,EAAE;AAAA,EACzE;AACA,SAAO,SAAS,KAAK,GAAG;AAC1B;AAGO,SAAS,2BAA2B,MAAsB;AAC/D,QAAM,WAAW,KACd,KAAK,EACL,QAAQ,OAAO,GAAG,EAClB,QAAQ,cAAc,EAAE;AAC3B,SAAO,2BAA2B,QAAQ;AAC5C;AAGO,SAAS,8BAA8B,MAAsB;AAClE,SAAO,2BAA2B,IAAI,EAAE,UAAU,MAAM,EAAE,YAAY;AACxE;AAQO,SAAS,2BAA2B,KAAqB;AAC9D,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,GAAG;AAAA,EACnB,QAAQ;AACN,UAAM,IAAI,uBAAuB,0CAA0C,GAAG,EAAE;AAAA,EAClF;AACA,MAAI,IAAI,aAAa,YAAY,CAAC,IAAI,MAAM;AAC1C,UAAM,IAAI,uBAAuB,0CAA0C,GAAG,EAAE;AAAA,EAClF;AACA,QAAM,iBAAiB,IAAI,SAAS,QAAQ,cAAc,EAAE,EAAE,QAAQ,UAAU,EAAE;AAClF,QAAM,WAAW,eAAe,MAAM,GAAG,EAAE,OAAO,OAAO;AACzD,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,IAAI,uBAAuB,+CAA+C,GAAG,EAAE;AAAA,EACvF;AACA,SAAO;AAAA,IACL,SAAS,mBAAmB,IAAI,KAAK,YAAY,CAAC,CAAC,IAAI,SAAS,KAAK,GAAG,CAAC;AAAA,EAC3E;AACF;AAGO,SAAS,kBAAkB,UAA+B;AAC/D,MAAI,SAAS,UAAW,QAAO,2BAA2B,SAAS,SAAS;AAC5E,SAAO,SAAS,SAAS,SACrB,2BAA2B,SAAS,SAAS,MAAM,EAAE,IACrD,2BAA2B,SAAS,GAAG;AAC7C;AAGO,SAAS,+BAA+B,WAAyC;AACtF,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,YAAY,WAAW;AAChC,UAAM,OAAO,kBAAkB,QAAQ;AACvC,UAAM,MAAM,8BAA8B,IAAI;AAC9C,QAAI,QAAQ,IAAI,GAAG,GAAG;AACpB,YAAM,IAAI,yBAAyB,4CAA4C,IAAI,EAAE;AAAA,IACvF;AACA,YAAQ,IAAI,GAAG;AAAA,EACjB;AACF;AAEO,IAAM,aAAaA,GAAE,KAAK,CAAC,kBAAkB,SAAS,UAAU,WAAW,SAAS,CAAC;AAGrF,IAAM,mBAAmBA,GAAE,KAAK;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,YAAYA,GAAE,OAAO;AAAA,EAChC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ;AAAA,EACR,UAAUA,GAAE,OAAO;AAAA,EACnB,cAAcA,GAAE,OAAO;AAAA,EACvB,aAAaA,GAAE,OAAO;AAAA,EACtB,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,QAAQA,GAAE,OAAO;AAAA,EACjB,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrC,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACrC,CAAC;AAGM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAUA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,QAAQA,GAAE,OAAO,EAAE,IAAI;AAAA,EACvB,iBAAiBA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC;AAAA,EAChD,WAAWA,GAAE,OAAO;AAAA,EACpB,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC1C,CAAC;AAGM,IAAM,6BAA6BA,GAAE,OAAO;AAAA,EACjD,MAAM;AACR,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,KAAKA,GAAE,OAAO,EAAE,IAAI;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,iBAAiBA,GAAE,KAAK,CAAC,UAAU,YAAY,SAAS,QAAQ,CAAC;AAGvE,IAAM,sBAAsBA,GAAE,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,qBAAqBA,GAAE,KAAK,CAAC,UAAU,UAAU,SAAS,CAAC;AAKjE,IAAM,qBAAqBA,GAAE,KAAK,CAAC,aAAa,SAAS,CAAC;AAS1D,IAAM,yBAAyBA,GAAE,KAAK;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAIM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EACnC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,OAAOA,GAAE,OAAO,EAAE,SAAS;AAC7B,CAAC;AAGM,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAMA,GAAE,OAAO;AAAA,EACf,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,WAAWA,GAAE,OAAO;AAAA,EAC/B,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ;AAAA,EACR,OAAOA,GAAE,OAAO;AAAA,EAChB,QAAQA,GAAE,OAAO;AAAA,EACjB,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,YAAY;AAAA,EACZ,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EAC3B,YAAY;AAAA,EACZ,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,aAAaA,GAAE,QAAQ;AAAA,EACvB,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,QAAQA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EAC1B,gBAAgB;AAAA,EAChB,UAAU,iBAAiB,SAAS;AAAA,EACpC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,SAASA,GAAE,OAAO,EAAE,KAAK;AAAA,EACzB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAYA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,OAAOA,GAAE,OAAO;AAAA,EAChB,MAAMA,GAAE,OAAO;AAAA,EACf,OAAOA,GAAE,OAAO;AAAA,EAChB,WAAW;AAAA,EACX,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,YAAY;AAAA,EACZ,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAC7B,CAAC;AAGM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAaA,GAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAGM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,YAAY,oBAAoB,SAAS;AAAA,EACzC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,kBAAkBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC7C,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,iBAAiBA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EAChE,iBAAiBA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EAChE,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC1C,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC7C,YAAY,mBAAmB,SAAS;AAAA,EACxC,aAAaA,GAAE,QAAQ,EAAE,SAAS;AACpC,CAAC;AAQM,IAAM,6BAA6BA,GACvC,OAAO;AAAA,EACN,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAS,EAAE,SAAS;AAAA,EAChD,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,YAAY,mBAAmB,SAAS;AAAA,EACxC,aAAaA,GAAE,QAAQ,EAAE,SAAS;AACpC,CAAC,EACA,OAAO,CAAC,UAAW,MAAM,SAAS,YAAgB,MAAM,WAAW,SAAY;AAAA,EAC9E,SAAS;AACX,CAAC;AAKI,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC3C,CAAC;AAGM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAC7C,MAAM,mBAAmB,SAAS;AAAA,EAClC,aAAaA,GAAE,MAAM,mBAAmB,EAAE,SAAS;AAAA,EACnD,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC7C,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AACtD,CAAC;AAQM,IAAM,wBAAwBA,GAAE,KAAK;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,sBAAsBA,GAAE,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,MAAMA,GAAE,KAAK,CAAC,kBAAkB,YAAY,iBAAiB,UAAU,UAAU,CAAC;AAAA,EAClF,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAChC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,OAAOA,GAAE,OAAO;AAAA,EAChB,MAAMA,GAAE,OAAO;AAAA,EACf,YAAYA,GAAE,MAAM,kBAAkB;AAAA,EACtC,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EACnC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,oBAAoBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/C,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKhC,QAAQA,GAAE,QAAQ;AAAA,EAClB,YAAYA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC3B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,gBAAgBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,WAAWA,GAAE,OAAO;AAAA,EACpB,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAQM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,QAAQ,sBAAsB,QAAQ,QAAQ;AAAA,EAC9C,MAAM,oBAAoB,QAAQ,UAAU;AAAA,EAC5C,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,WAAW;AAAA,EAC5C,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,YAAYA,GAAE,MAAM,kBAAkB,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClD,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA,EAChD,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,oBAAoBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/C,QAAQA,GAAE,QAAQ,EAAE,SAAS;AAAA,EAC7B,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACzC,CAAC;AAGM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,QAAQ,sBAAsB,SAAS;AAAA,EACvC,MAAM,oBAAoB,SAAS;AAAA,EACnC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,YAAYA,GAAE,MAAM,kBAAkB,EAAE,SAAS;AAAA,EACjD,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC9C,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACrD,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAEvC,QAAQA,GAAE,QAAQ,EAAE,SAAS;AAC/B,CAAC;AAIM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,QAAQ,sBAAsB,SAAS;AAAA,EACvC,MAAM,oBAAoB,SAAS;AAAA,EACnC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AACxD,CAAC;AAGM,IAAM,4BAA4BA,GAAE,KAAK,CAAC,UAAU,UAAU,SAAS,CAAC;AAIxE,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,MAAM,oBAAoB,SAAS;AAAA,EACnC,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACpD,MAAM,0BAA0B,SAAS;AAC3C,CAAC;AAGM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,QAAQ;AAAA,EACR,OAAOA,GAAE,OAAO;AAAA,EAChB,WAAW;AAAA,EACX,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAcA,GAAE,OAAO,EAAE,SAAS;AACpC,CAAC;AAGM,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,SAASA,GAAE,MAAM,2BAA2B;AAC9C,CAAC;AAGM,IAAM,UAAUA,GAAE,OAAO;AAAA,EAC9B,MAAMA,GAAE,QAAQ,KAAK;AAAA,EACrB,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOpB,UAAUA,GAAE,QAAQ,EAAE,SAAS;AACjC,CAAC;AAGD,IAAM,aAAa;AACZ,IAAM,qBAAqBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,UAAU;AAO7D,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,MAAMA,GAAE,KAAK,CAAC,qBAAqB,YAAY,aAAa,QAAQ,CAAC;AAAA,EACrE,wBAAwBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACrD,CAAC;AAGM,IAAM,yCAAyC;AAC/C,IAAM,8CAA8C;AAC3D,IAAM,+BAA+BA,GAClC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,2CAA2C,EAC/C,MAAM,UAAU;AACnB,IAAM,gCAAgCA,GACnC,MAAM,4BAA4B,EAClC,IAAI,sCAAsC;AAMtC,IAAM,6BAA6BA,GACvC,OAAO;AAAA,EACN,MAAMA,GAAE,KAAK,CAAC,qBAAqB,YAAY,aAAa,QAAQ,CAAC;AAAA,EACrE,wBAAwBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnD,aAAa;AAAA,EACb,cAAc;AAAA,EACd,cAAc;AAAA,EACd,YAAYA,GACT,OAAO;AAAA,IACN,OAAOA,GAAE,KAAK,CAAC,YAAY,UAAU,CAAC;AAAA,IACtC,aAAa;AAAA,EACf,CAAC,EACA,OAAO;AAAA,EACV,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,QAAQA,GACL,OAAO;AAAA,IACN,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACvC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACxC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACxC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACvC,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACzC,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,CAAC,EACA,OAAO;AAAA,EACV,cAAcA,GAAE,QAAQ;AAC1B,CAAC,EACA,OAAO;AAEV,IAAM,WAAWA,GACd,OAAO,EACP,IAAI,EACJ;AAAA,EACC,CAAC,UAAU;AACT,QAAI;AACF,aAAO,IAAI,IAAI,KAAK,EAAE,aAAa;AAAA,IACrC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,EAAE,SAAS,qBAAqB;AAClC;AAMK,IAAM,6CAA6C;AACnD,IAAM,wCAAwC,MAAM;AACpD,IAAM,2CAA2C;AACjD,IAAM,0BAA0B;AAEvC,IAAM,6BAA6BA,GAChC,OAAO,EACP,IAAI,CAAC,EACL,YAAY,CAAC,MAAM,QAAQ;AAC1B,MAAI,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,aAAa,0CAA0C;AACxF,QAAI,SAAS;AAAA,MACX,MAAMA,GAAE,aAAa;AAAA,MACrB,SAAS,2CAA2C,wCAAwC;AAAA,IAC9F,CAAC;AAAA,EACH;AACF,CAAC;AACH,IAAM,oCAAoCA,GACvC,MAAM,0BAA0B,EAChC,IAAI,0CAA0C,EAC9C,YAAY,CAAC,OAAO,QAAQ;AAC3B,QAAM,QAAQ,MAAM;AAAA,IAClB,CAAC,OAAO,SAAS,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE;AAAA,IACxD;AAAA,EACF;AACA,MAAI,QAAQ,uCAAuC;AACjD,QAAI,SAAS;AAAA,MACX,MAAMA,GAAE,aAAa;AAAA,MACrB,SAAS,yCAAyC,qCAAqC;AAAA,IACzF,CAAC;AAAA,EACH;AACF,CAAC,EACA,UAAU,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK,CAAC;AAC3C,IAAM,2BAA2BA,GAAE,MAAM,CAACA,GAAE,QAAQ,GAAG,iCAAiC,CAAC;AAGzF,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,IAAI;AAAA,EACJ,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,KAAK;AAAA,EACL,cAAcA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAClD,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,gBAAgBA,GAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAErC,iBAAiB,yBAAyB,SAAS;AAAA;AAAA;AAAA,EAGnD,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGnD,eAAe,uBAAuB,SAAS;AACjD,CAAC;AAGM,IAAM,kCAAkCA,GAAE,OAAO;AAAA,EACtD,IAAI;AAAA,EACJ,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC;AAC1C,CAAC;AAGM,IAAM,2BAA2BA,GACrC,OAAO;AAAA,EACN,IAAI;AAAA,EACJ,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,KAAK;AAAA,EACL,aAAaA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3C,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC7C,iBAAiB,yBAAyB,QAAQ,KAAK;AAAA,EACvD,eAAe,uBAAuB,SAAS,EAAE,QAAQ,IAAI;AAC/D,CAAC,EACA,OAAO;AAGH,IAAM,wCAAwCA,GAClD,OAAO;AAAA,EACN,iBAAiB;AACnB,CAAC,EACA,OAAO;AAKH,IAAM,yCAAyCA,GACnD,OAAO;AAAA,EACN,QAAQ;AAAA,EACR,eAAeA,GAAE,QAAQ,cAAc;AACzC,CAAC,EACA,OAAO;AAKH,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,cAAc,UAAqB,WAAiC;AAClF,QAAM,QAAQ,oBAAI,IAAqB;AACvC,QAAM,QAAkB,CAAC;AACzB,aAAW,QAAQ,CAAC,GAAG,UAAU,GAAG,SAAS,GAAG;AAC9C,UAAM,MAAM,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE;AACnC,UAAM,QAAQ,MAAM,IAAI,GAAG;AAC3B,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,KAAK,IAAI;AACnB,YAAM,KAAK,GAAG;AACd;AAAA,IACF;AAKA,QAAI,MAAM,aAAa,QAAQ,KAAK,aAAa,MAAM;AACrD,YAAM,EAAE,UAAU,UAAU,GAAG,OAAO,IAAI;AAC1C,YAAM,IAAI,KAAK,MAAM;AAAA,IACvB;AAAA,EACF;AACA,SAAO,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,GAAG,CAAE;AAC3C;AAEO,SAAS,kBACd,UACA,WACA,UAAyC,CAAC,GAC3B;AACf,MAAI,QAAQ,iBAAiB;AAC3B,mCAA+B,QAAQ;AAAA,EACzC;AACA,QAAM,MAAM,CAAC,GAAG,QAAQ;AACxB,QAAM,aAAa,IAAI;AAAA,IACrB,SAAS;AAAA,MACP,CAAC,aACC,CAAC,8BAA8B,kBAAkB,QAAQ,CAAC,GAAG,WAAW,QAAQ,CAAC;AAAA,IACrF;AAAA,EACF;AACA,QAAM,aAAa,IAAI;AAAA,IACrB,SAAS,IAAI,CAAC,aAAa,CAAC,oBAAoB,QAAQ,GAAG,WAAW,QAAQ,CAAC,CAAU;AAAA,EAC3F;AACA,QAAM,QAAQ,IAAI,IAAI,SAAS,IAAI,UAAU,CAAC;AAE9C,aAAW,YAAY,WAAW;AAChC,UAAM,aAAa,WAAW,QAAQ;AACtC,QAAI,MAAM,IAAI,UAAU,GAAG;AACzB;AAAA,IACF;AACA,QAAI,QAAQ,iBAAiB;AAC3B,YAAM,YAAY,kBAAkB,QAAQ;AAC5C,YAAM,kBAAkB,WAAW,IAAI,8BAA8B,SAAS,CAAC;AAC/E,UAAI,mBAAmB,oBAAoB,YAAY;AACrD,cAAM,IAAI,yBAAyB,4CAA4C,SAAS,EAAE;AAAA,MAC5F;AACA,YAAM,WAAW,oBAAoB,QAAQ;AAC7C,YAAM,mBAAmB,WAAW,IAAI,QAAQ;AAChD,UAAI,oBAAoB,qBAAqB,YAAY;AACvD,cAAM,IAAI;AAAA,UACR,yDAAyD,QAAQ;AAAA,QACnE;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,QAAQ;AACjB,UAAM,IAAI,UAAU;AACpB,eAAW,IAAI,oBAAoB,QAAQ,GAAG,UAAU;AACxD,eAAW,IAAI,8BAA8B,kBAAkB,QAAQ,CAAC,GAAG,UAAU;AAAA,EACvF;AACA,SAAO;AACT;AAEO,SAAS,2BACd,UACA,UACiB;AACjB,QAAM,QAAQ,SAAS;AACvB,SAAO,UAAU,UACf,UAAU,aACV,UAAU,SACV,UAAU,YACV,UAAU,UACV,UAAU,UACR,QACA;AACN;AAEO,SAAS,WAAW,OAAwB;AACjD,SAAO,KAAK,UAAUE,UAAS,KAAK,CAAC;AACvC;AAEO,SAAS,oBAAoB,UAA+B;AACjE,MAAI,SAAS,SAAS,QAAQ;AAC5B,WAAO,QAAQ,SAAS,MAAM;AAAA,EAChC;AACA,SAAO,cAAc,SAAS,GAAG;AACnC;AAEA,SAASA,UAAS,OAAyB;AACzC,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAIA,SAAQ;AAAA,EAC3B;AACA,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAK,EACjB,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EACrC,IAAI,CAAC,CAAC,KAAK,MAAM,MAAM,CAAC,KAAKA,UAAS,MAAM,CAAC,CAAC;AAAA,IACnD;AAAA,EACF;AACA,SAAO;AACT;AAEO,IAAM,oBAAoBF,GAAE,KAAK;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,oBAAoBA,GAAE,KAAK;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,sBAAsBA,GAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAGvD,IAAM,0BAA0BA,GAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAG3D,IAAM,oBAAoBA,GAAE,KAAK,CAAC,UAAU,UAAU,WAAW,CAAC;AAGlE,IAAM,uBAAuBA,GAAE,KAAK,CAAC,OAAO,SAAS,gBAAgB,CAAC;AAGtE,IAAM,0BAA0BA,GAAE,KAAK;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,+BAA+BA,GAAE,KAAK;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,gCAAgCA,GAAE,KAAK;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC3C,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC/C,eAAeA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EAC9D,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ;AAAA,EACR,MAAMA,GAAE,OAAO;AAAA,EACf,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,UAAUA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW;AAAA,EACX,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnC,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAChD,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC/C,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3D,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA;AAAA;AAAA,EAG1C,cAAc,wBAAwB,SAAS;AAAA,EAC/C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,WAAWA,GAAE,OAAO;AAAA,EAC/B,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC5C,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC7D,CAAC;AAGM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,QAAQA,GAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAAA,EACnC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACxC,CAAC;AAGM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClC,CAAC;AASM,IAAM,iCAAiCA,GAAE,MAAM;AAAA,EACpDA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,mBAAmB;AAAA,IACnC,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC7C,CAAC,EACA,OAAO;AAAA,EACVA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,UAAU,EAAE,SAAS;AAAA,IACrC,OAAOA,GAAE,MAAM,OAAO,EAAE,IAAI,EAAE;AAAA,IAC9B,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC7C,CAAC,EACA,OAAO;AACZ,CAAC;AASM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,QAAQA,GAAE,QAAQ;AAAA,EAClB,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAC3D,CAAC;AAYM,IAAM,6BAA6BA,GAAE,OAAO;AAAA,EACjD,SAASA,GAAE,QAAQ,IAAI;AACzB,CAAC;AAYM,IAAM,2BAA2B;AAGjC,IAAM,yBAAyB,KAAK,UAAU;AAAA,EACnD,CAAC,wBAAwB,GAAG;AAC9B,CAAC;AAUM,SAAS,sBAAsB,YAAgD;AACpF,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,UAAU;AACpC,WACE,OAAO,WAAW,YAClB,WAAW,QACV,OAAmC,wBAAwB,MAAM;AAAA,EAEtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,IAAM,+BAA+BA,GAAE,OAAO,CAAC,CAAC,EAAE,OAAO;AAIzD,IAAM,8BAA8BA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA,EAIlD,QAAQA,GAAE,KAAK,CAAC,WAAW,aAAa,MAAM,CAAC;AAAA,EAC/C,SAASA,GAAE,OAAO;AACpB,CAAC;AAQM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,MAAMA,GAAE,KAAK,CAAC,WAAW,SAAS,CAAC;AAAA,EACnC,GAAG;AACL,CAAC;AAYM,IAAM,8BAA8BA,GAAE,KAAK;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,gCAAgCA,GAAE,KAAK;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,4BAA4BA,GAAE,mBAAmB,QAAQ;AAAA,EACpEA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,SAAS;AAAA,IACzB,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC3B,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,eAAe;AAAA;AAAA,IAE/B,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC3B,iBAAiBA,GAAE,OAAO,EAAE,KAAK;AAAA,IACjC,qBAAqBA,GAAE,OAAO,EAAE,KAAK;AAAA,IACrC,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,IACxB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,IAC3B,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,IAE/C,WAAW;AAAA,IACX,kBAAkB;AAAA,EACpB,CAAC;AACH,CAAC;AAGM,IAAM,6BAA6BA,GAAE,OAAO;AAAA,EACjD,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE3B,eAAeA,GAAE,OAAO,EAAE,KAAK;AACjC,CAAC;AAYM,IAAM,+BAA+BA,GAAE,mBAAmB,WAAW;AAAA,EAC1EA,GAAE,OAAO;AAAA,IACP,SAASA,GAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOvB,sBAAsBA,GAAE,KAAK,CAAC,UAAU,MAAM,CAAC,EAAE,SAAS;AAAA;AAAA,IAE1D,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,IAAI,GAAM,EAAE,SAAS;AAAA,EACvE,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,SAASA,GAAE,QAAQ,KAAK;AAAA,IACxB,QAAQA,GAAE,KAAK,CAAC,aAAa,aAAa,SAAS,CAAC;AAAA,EACtD,CAAC;AACH,CAAC;AAUM,IAAM,2CAA2C;AAEjD,IAAM,gCAAgCA,GAAE,mBAAmB,QAAQ;AAAA,EACxEA,GAAE,OAAO,EAAE,MAAMA,GAAE,QAAQ,KAAK,EAAE,CAAC;AAAA,EACnCA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,QAAQ;AAAA,IACxB,gBAAgBA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,wCAAwC;AAAA,IACvF,YAAYA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,wCAAwC;AAAA,EACrF,CAAC;AACH,CAAC;AAsBM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,gBAAgBA,GAAE,OAAO,EAAE,KAAK;AAAA,EAChC,oBAAoBA,GAAE,OAAO;AAAA,EAC7B,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,UAAUA,GAAE,OAAO,EAAE,IAAI;AAAA,EACzB,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,WAAWA,GAAE,MAAM,WAAW;AAAA,EAC9B,OAAOA,GAAE,MAAM,OAAO;AAAA;AAAA;AAAA;AAAA,EAItB,eAAeA,GAAE,QAAQ,EAAE,SAAS;AAAA,EACpC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,iBAAiB;AAAA,EACjB,gBAAgB;AAAA;AAAA,EAEhB,WAAW,UAAU,SAAS;AAAA,EAC9B,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnC,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAClD,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EACzC,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,MAAMA,GAAE,KAAK,CAAC,WAAW,WAAW,CAAC;AAAA,EACrC,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAGM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,OAAOA,GAAE,KAAK,CAAC,YAAY,WAAW,WAAW,CAAC;AAAA,EAClD,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,oBAAoB;AAAA,EACpB,yBAAyB,wBAAwB,SAAS;AAAA,EAC1D,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC;AAC9B,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,OAAO;AAAA,EACP,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC7C,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,aAAa;AAAA,EACb,gBAAgB,wBAAwB,SAAS;AAAA,EACjD,wBAAwBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACrD,UAAUA,GAAE,MAAM,uBAAuB;AAAA,EACzC,eAAeA,GAAE,MAAM,4BAA4B;AAAA,EACnD,UAAUA,GACP,OAAO;AAAA,IACN,eAAeA,GAAE,OAAO,EAAE,KAAK;AAAA,IAC/B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,CAAC,EACA,SAAS;AAAA,EACZ,YAAYA,GACT,OAAO;AAAA,IACN,OAAOA,GAAE,QAAQ,UAAU;AAAA,IAC3B,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACxC,0BAA0BA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACvD,wBAAwBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvD,CAAC,EACA,SAAS;AACd,CAAC;AAGM,IAAM,kCAAkC;AAC/C,IAAM,sBAAsBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,+BAA+B;AAE1E,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,+BAA+B;AAAA,EACnE,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,wBAAwBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAChE,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC7D,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACzD,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3D,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,MAAMA,GAAE,OAAO;AAAA,EACf,WAAWA,GAAE,MAAM,WAAW;AAAA,EAC9B,OAAOA,GAAE,MAAM,OAAO;AAAA;AAAA;AAAA,EAGtB,eAAeA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACxC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,iBAAiB;AAAA,EACjB,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACtC,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQlB,yBAAyBA,GAAE,QAAQ;AAAA,EACnC,OAAOA,GAAE,MAAM,WAAW;AAC5B,CAAC;AAGM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,eAAe;AAAA,EACf,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACnD,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC3C,CAAC;AAGM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,eAAe;AAAA,EACf,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpD,cAAcA,GAAE,QAAQ;AAC1B,CAAC;AAGM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,eAAe;AAAA,EACf,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAC1C,CAAC;AAGM,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,eAAe;AAAA,EACf,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACrC,CAAC;AAGM,IAAM,2BAA2B,cAAc,KAAK;AAAA,EACzD,MAAM;AAAA,EACN,WAAW;AAAA,EACX,OAAO;AAAA,EACP,eAAe;AAAA,EACf,OAAO;AAAA,EACP,iBAAiB;AACnB,CAAC,EAAE,OAAO,EAAE,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAQvD,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,gBAAgB,eAAe,SAAS;AAAA,EACxC,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAClC,MAAM,SAAS,SAAS;AAAA,EACxB,0BAA0BA,GAAE,MAAM,UAAU,EAAE,SAAS;AACzD,CAAC;AAIM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,MAAMA,GAAE,OAAO;AAAA,EACf,WAAWA,GAAE,MAAM,WAAW;AAAA,EAC9B,OAAOA,GAAE,MAAM,OAAO;AAAA;AAAA,EAEtB,eAAeA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACxC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,iBAAiB;AAAA,EACjB,SAAS;AAAA,EACT,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,6BAA6B,gBAAgB,KAAK;AAAA,EAC7D,MAAM;AAAA,EACN,WAAW;AAAA,EACX,OAAO;AAAA,EACP,eAAe;AAAA,EACf,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB,SAAS;AACX,CAAC,EAAE,OAAO,EAAE,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAGvD,IAAM,qCAAqC,IAAI;AAC/C,IAAM,oCAAoC;AAC1C,IAAM,oCAAoC,KAAK;AAEtD,IAAM,yBAAyBA,GAC5B,OAAO,EACP,IAAI,CAAC,EACL,OAAO,CAAC,UAAU,CAAC,MAAM,SAAS,IAAQ,GAAG,mCAAmC,EAChF;AAAA,EACC,CAAC,UAAU,0BAA0B,KAAK,KAAK;AAAA,EAC/C,0BAA0B,kCAAkC;AAC9D;AAEK,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,QAAQA,GAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,EAClC,QAAQ,uBAAuB,SAAS;AAAA,EACxC,eAAe;AAAA,EACf,qBAAqBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAClD,CAAC;AAGM,IAAM,mCAAmCA,GAAE,OAAO;AAAA,EACvD,QAAQA,GAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,EAClC,QAAQ,uBAAuB,SAAS;AAAA,EACxC,eAAe;AAAA,EACf,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAC5D,CAAC;AAGM,IAAM,oCAAoCA,GAAE,OAAO;AAAA,EACxD,SAAS;AAAA,EACT,OAAO;AAAA,EACP,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAChD,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC1C,CAAC;AAQM,IAAM,kCAAkCA,GAAE,OAAO;AAAA,EACtD,WAAWA,GAAE,QAAQ,IAAI;AAAA,EACzB,SAASA,GAAE,KAAK;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC7C,QAAQA,GAAE;AAAA,IACRA,GAAE,OAAO;AAAA,MACP,OAAOA,GAAE,KAAK,CAAC,UAAU,OAAO,CAAC;AAAA,MACjC,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MAC5C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MAC7C,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IAC7C,CAAC;AAAA,EACH;AAAA,EACA,cAAcA,GAAE,OAAO;AAAA,IACrB,WAAWA,GAAE,QAAQ,KAAK;AAAA,IAC1B,QAAQA,GAAE,QAAQ,cAAc;AAAA,EAClC,CAAC;AACH,CAAC;AAGM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,MAAMA,GAAE,QAAQ,2BAA2B;AAAA,EAC3C,OAAOA,GAAE,KAAK,CAAC,aAAa,SAAS,CAAC;AAAA,EACtC,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,QAAQA,GAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,EAClC,WAAWA,GAAE,QAAQ;AAAA,EACrB,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,YAAYA,GAAE,OAAO;AAAA,EACrB,YAAY,gCAAgC,SAAS,EAAE,SAAS;AAClE,CAAC;AAYM,SAAS,0BAA0B,OAAuB;AAC/D,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AACzC;AAOO,SAAS,2BACd,OACA,UAA6C,CAAC,GACvB;AACvB,QAAM,iBAAiB,IAAI;AAAA,KACxB,MAAM,YAAY,UAAU,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,OAAO,KAAK,CAAU;AAAA,EAC/E;AACA,QAAM,SACJ,MAAM,WAAW,OACb,OACA,0BAA0B,MAAM,QAAQ,kCAAkC;AAChF,QAAM,QAAQ,0BAA0B,MAAM,OAAO,iCAAiC;AACtF,QAAM,cAAc,WAAW,OAAO,IAAI,0BAA0B,MAAM;AAC1E,QAAM,aAAa,0BAA0B,KAAK;AAClD,QAAM,sBACJ,MAAM,WAAW,OACb,OACA,KAAK;AAAA,IACH,0BAA0B,MAAM,MAAM;AAAA,IACtC,wCAAwC,QAAQ,mBAAmB;AAAA,IACnE,eAAe,IAAI,QAAQ,GAAG,iBAAiB;AAAA,EACjD;AACN,QAAM,qBAAqB,KAAK;AAAA,IAC9B,0BAA0B,MAAM,KAAK;AAAA,IACrC,wCAAwC,QAAQ,kBAAkB;AAAA,IAClE,eAAe,IAAI,OAAO,GAAG,iBAAiB;AAAA,EAChD;AACA,QAAM,SAAoD,CAAC;AAC3D,MAAI,wBAAwB,QAAQ,sBAAsB,aAAa;AACrE,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,eAAe;AAAA,MACf,gBAAgB;AAAA,MAChB,cAAc,sBAAsB;AAAA,IACtC,CAAC;AAAA,EACH;AACA,MAAI,qBAAqB,YAAY;AACnC,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,eAAe;AAAA,MACf,gBAAgB;AAAA,MAChB,cAAc,qBAAqB;AAAA,IACrC,CAAC;AAAA,EACH;AACA,MAAI,OAAO,WAAW,KAAK,MAAM,cAAc,MAAM;AACnD,QAAI,sBAAsB,KAAK,IAAI,mCAAmC;AACpE,YAAM,IAAI,WAAW,sDAAsD;AAAA,IAC7E;AACA,WAAO;AAAA,EACT;AAEA,QAAM,aAA8C;AAAA,IAClD,WAAW;AAAA,IACX,SAAS,MAAM,YAAY,WAAW,QAAQ,WAAW;AAAA,IACzD,gBAAgB;AAAA,IAChB;AAAA,IACA,cAAc,EAAE,WAAW,OAAO,QAAQ,eAAe;AAAA,EAC3D;AACA,QAAM,UAAiC;AAAA,IACrC,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,uCAAqC,SAAS,UAAU;AACxD,QAAM,iBAAiB,sBAAsB,OAAO;AACpD,MAAI,iBAAiB,mCAAmC;AACtD,UAAM,IAAI;AAAA,MACR,+DAA+D,cAAc,MAAM,iCAAiC;AAAA,IACtH;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,0BAA0B,OAAe,UAA0B;AAC1E,QAAMG,WAAU,IAAI,YAAY;AAChC,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,QAAQA,SAAQ,OAAO,KAAK;AAClC,MAAI,MAAM,cAAc,SAAU,QAAO;AACzC,QAAM,SAAS;AACf,QAAM,eAAe,KAAK,IAAI,GAAG,WAAWA,SAAQ,OAAO,MAAM,EAAE,UAAU;AAC7E,MAAI,YAAY,KAAK,IAAI,cAAc,MAAM,UAAU;AACvD,SAAO,YAAY,KAAK,YAAY,MAAM,eAAe,MAAM,SAAS,IAAK,SAAU,KAAM;AAC3F,iBAAa;AAAA,EACf;AACA,SAAO,GAAG,QAAQ,OAAO,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,GAAG,MAAM;AACjE;AAEA,SAAS,wCAAwC,OAA0C;AACzF,SAAO,UAAU,QAAQ,UAAU,UAAa,CAAC,OAAO,SAAS,KAAK,IAClE,IACA,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,CAAC;AACnC;AAEA,SAAS,qCACP,OACA,YACM;AACN,WAAS,UAAU,GAAG,UAAU,IAAI,WAAW,GAAG;AAChD,UAAMC,kBAAiB,sBAAsB,KAAK;AAClD,QAAI,WAAW,mBAAmBA,gBAAgB;AAClD,eAAW,iBAAiBA;AAAA,EAC9B;AACA,QAAM,iBAAiB,sBAAsB,KAAK;AAClD,MAAI,WAAW,mBAAmB,gBAAgB;AAChD,UAAM,IAAI,WAAW,0DAA0D;AAAA,EACjF;AACF;AAEO,IAAM,6BAA6BJ,GAAE,KAAK,CAAC,WAAW,WAAW,mBAAmB,MAAM,CAAC;AAG3F,IAAM,0BAA0BA,GAAE,KAAK;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,6BAA6BA,GAAE,mBAAmB,QAAQ;AAAA,EACrEA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,sBAAsB;AAAA,IACtC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACtB,iBAAiBA,GAAE,OAAO,EAAE,KAAK;AAAA,IACjC,oBAAoBA,GAAE,OAAO,EAAE,KAAK;AAAA,IACpC,WAAWA,GAAE,MAAM,WAAW,EAAE,SAAS;AAAA,IACzC,OAAOA,GAAE,MAAM,OAAO,EAAE,SAAS;AAAA,EACnC,CAAC,EACA,YAAY;AAAA,EACfA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,mBAAmB;AAAA,IACnC,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,IACxB,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACvC,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACxB,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,CAAC,EACA,YAAY;AAAA,EACfA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,eAAe;AAAA,IAC/B,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACtB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,CAAC,EACA,YAAY;AAAA,EACfA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,yBAAyB;AAAA,IACzC,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC7B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,CAAC,EACA,YAAY;AAAA,EACfA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,uBAAuB;AAAA,IACvC,gBAAgBA,GAAE,OAAO,EAAE,KAAK;AAAA,IAChC,QAAQA,GAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;AAAA,EACnC,CAAC,EACA,YAAY;AACjB,CAAC;AAGM,IAAM,2BAA2BA,GAAE,KAAK;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,MAAM;AAAA,EACN,gBAAgB;AAAA,EAChB,UAAUA,GAAE,OAAO;AAAA,EACnB,WAAWA,GAAE,OAAO;AAAA,EACpB,SAASA,GAAE,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EACzC,OAAO;AAAA,EACP,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,0BAA0BA,GACpC,OAAO,EACP,MAAM,mBAAmB,EACzB,IAAI,GAAG;AAGV,SAAS,uBAAgD,OAAU;AACjE,SAAOA,GAAE,WAAW,CAAC,UAAU;AAC7B,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,aAAO;AAAA,IACT;AACA,UAAM,SAAS;AACf,QAAI,OAAO,kBAAkB,UAAa,OAAO,kBAAkB,QAAW;AAC5E,aAAO;AAAA,IACT;AACA,WAAO,EAAE,GAAG,QAAQ,eAAe,OAAO,cAAc;AAAA,EAC1D,GAAGA,GAAE,OAAO,KAAK,CAAC;AACpB;AAKO,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,MAAM;AAAA,EACN,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,uCAAuC;AAI7C,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAMA,GAAE,OAAO;AAAA,EACf,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAWA,GAAE,MAAM,2BAA2B;AAAA,EAC9C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,uBAAuB;AAI7B,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,aAAaA,GAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC3C,WAAWA,GACR;AAAA,IACCA,GAAE,OAAO;AAAA,MACP,MAAM;AAAA,MACN,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK;AAAA,IACpC,CAAC;AAAA,EACH,EACC,QAAQ,CAAC,CAAC;AACf,CAAC;AAGM,IAAM,oCAAoC;AAI1C,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,aAAaA,GAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,SAAS;AACxD,CAAC;AAGM,IAAM,oCAAoC;AAI1C,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK;AACpC,CAAC;AAGM,IAAM,yCAAyC;AAU/C,IAAM,WAAWA,GAAE,OAAO;AAAA,EAC/B,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AACrC,CAAC;AAGM,IAAM,aAAaA,GAAE,OAAO;AAAA,EACjC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAOA,GAAE,OAAO,EAAE,KAAK;AAAA,EACvB,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnC,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,QAAQA,GAAE,MAAM,QAAQ;AAAA,EACxB,iBAAiBA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EACnC,uBAAuBA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EAChD,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,QAAQA,GAAE,QAAQ;AAAA,EAClB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,aAAaA,GAAE,KAAK,CAAC,WAAW,WAAW,SAAS,CAAC;AAAA,EACrD,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AACtC,CAAC;AAGM,IAAM,MAAMA,GAAE,OAAO;AAAA,EAC1B,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAMA,GAAE,OAAO;AAAA,EACf,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAG/B,eAAe,WAAW,SAAS;AAAA;AAAA;AAAA,EAGnC,qBAAqB,sBAAsB,SAAS;AAAA,EACpD,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC3C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,gBAAgBA,GAAE,KAAK,CAAC,gBAAgB,iBAAiB,CAAC;AAGhE,IAAM,kBAAkBA,GAAE,KAAK,CAAC,YAAY,aAAa,UAAU,YAAY,QAAQ,CAAC;AAIxF,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,OAAO;AAAA,EAClB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAKM,IAAM,wBAAwBA,GAClC,OAAO;AAAA,EACN,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzB,cAAcA,GAAE,MAAM,cAAc,EAAE,SAAS;AACjD,CAAC,EACA,YAAY;AAGR,IAAM,YAAYA,GAAE,OAAO;AAAA,EAChC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAOA,GAAE,OAAO,EAAE,KAAK;AAAA,EACvB,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,MAAM;AAAA,EACN,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EACzC,QAAQ;AAAA,EACR,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,cAAc,sBAAsB,SAAS;AAAA,EAC7C,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,aAAaA,GAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA;AAAA,EAE3C,OAAOA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACrC,aAAaA,GAAE,OAAO,EAAE,IAAI,MAAM,EAAE,SAAS;AAAA,EAC7C,QAAQA,GAAE,MAAM,QAAQ,EAAE,IAAI,GAAG,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC7C,iBAAiBA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;AAAA,EACvE,uBAAuBA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;AACtE,CAAC;AAGM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,aAAaA,GAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,SAAS;AACxD,CAAC;AAIM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACnC,MAAMA,GAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AACtC,CAAC;AAKM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,OAAOA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,QAAQ;AAAA,EACpC,aAAaA,GAAE,OAAO,EAAE,IAAI,MAAM,EAAE,QAAQ;AAAA,EAC5C,QAAQA,GAAE,MAAM,QAAQ,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC5C,iBAAiBA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACtE,uBAAuBA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACnE,WAAWA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,QAAQ;AAC1C,CAAC;AAGM,IAAM,0BAA0BA,GAAE,mBAAmB,QAAQ;AAAA,EAClEA,GAAE,OAAO,EAAE,MAAMA,GAAE,QAAQ,cAAc,GAAG,SAAS,sBAAsB,CAAC;AAAA,EAC5EA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,iBAAiB;AAAA,IACjC,SAAS;AAAA,EACX,CAAC;AACH,CAAC;AAGM,IAAM,sBAAsBA,GAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAGvD,IAAM,yBAAyBA,GAAE,KAAK,CAAC,UAAU,cAAc,QAAQ,CAAC;AAGxE,IAAM,uBAAuBA,GAAE,KAAK,CAAC,uBAAuB,kBAAkB,CAAC;AAG/E,IAAM,6BAA6BA,GAAE,KAAK,CAAC,oBAAoB,QAAQ,YAAY,CAAC;AAGpF,IAAM,2BAA2BA,GAAE,KAAK,CAAC,aAAa,QAAQ,CAAC;AAG/D,IAAM,4BAA4BA,GAAE,mBAAmB,QAAQ;AAAA,EACpEA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,MAAM;AAAA,IACtB,OAAOA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,IAC3C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,KAAK;AAAA,EAC3C,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,UAAU;AAAA,IAC1B,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACxC,SAASA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,IACxD,OAAOA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EACxD,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,UAAU;AAAA,IAC1B,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,KAAK;AAAA,IACzC,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,IACpC,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,IACtC,YAAYA,GACT,MAAMA,GAAE,KAAK,CAAC,UAAU,UAAU,WAAW,aAAa,YAAY,UAAU,UAAU,CAAC,CAAC,EAC5F,IAAI,CAAC,EACL,SAAS;AAAA,EACd,CAAC;AACH,CAAC;AAGM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,WAAWA,GAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC1C,OAAOA,GAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA,EAItD,sBAAsBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACjD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,iBAAiB,gBAAgB,SAAS;AAAA,EAC1C,gBAAgB,eAAe,SAAS;AAAA,EACxC,MAAM,SAAS,SAAS;AAAA;AAAA;AAAA,EAGxB,qBAAqB,sBAAsB,SAAS;AACtD,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAMA,GAAE,OAAO;AAAA,EACf,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,oBAAoBA,GAAE,OAAO;AAAA,EAC7B,SAAS;AAAA,EACT,eAAe;AAAA,EACf,aAAa;AAAA,EACb,mBAAmBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC9C,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA,EAExD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAIxD,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAChD,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,SAASA,GAAE,OAAO;AAAA,EAClB,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,gBAAgBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,6BAA6B,uBAAuB;AAAA,EAC/D,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,UAAU;AAAA,EACV,SAAS,qBAAqB,QAAQ,qBAAqB;AAAA,EAC3D,eAAe,2BAA2B,QAAQ,kBAAkB;AAAA,EACpE,aAAa;AAAA,EACb,QAAQ,oBAAoB,QAAQ,QAAQ;AAAA,EAC5C,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErD,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,6BAA6B,uBAAuB;AAAA,EAC/D,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,UAAU,0BAA0B,SAAS;AAAA,EAC7C,SAAS,qBAAqB,SAAS;AAAA,EACvC,eAAe,2BAA2B,SAAS;AAAA,EACnD,aAAa,yBAAyB,SAAS;AAAA,EAC/C,QAAQ,oBAAoB,SAAS;AAAA,EACrC,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAGrD,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,SAAS;AACvD,CAAC;AAQM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACjD,CAAC;AAGM,IAAM,mCAAmCA,GAAE,KAAK;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,WAAW;AAAA,EACX,WAAWA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAChD,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC7C,UAAUA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACnC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,MAAMA,GAAE,QAAQ,eAAe;AAAA,EAC/B,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAaA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC/C,UAAUA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AACrC,CAAC;AAGM,IAAM,sCAAsCA,GAAE,OAAO;AAAA,EAC1D,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,iBAAiB;AAAA,EACjB,gBAAgB,qBAAqB,QAAQ,qBAAqB;AAAA,EAClE,sBAAsB,2BAA2B,QAAQ,MAAM;AAAA;AAAA;AAAA,EAG/D,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACrC,CAAC;AAUM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,OAAO,6BAA6B;AAAA,IACnE,SAAS;AAAA,EACX,CAAC;AAAA,EACD,SAASA,GAAE,OAAO,EAAE,IAAI,MAAM,IAAI;AACpC,CAAC;AAMM,IAAM,sBAAsBA,GAChC,OAAO;AAAA,EACN,MAAMA,GACH,OAAO,EACP,IAAI,CAAC,EACL,IAAI,EAAE,EACN,MAAM,gCAAgC;AAAA,IACrC,SAAS;AAAA,EACX,CAAC;AAAA,EACH,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAClD,OAAOA,GAAE,MAAM,uBAAuB,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AACvD,CAAC,EACA,YAAY,CAAC,OAAO,QAAQ;AAC3B,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAM,QAAQ,CAAC,MAAM,UAAU;AACnC,QAAI,KAAK,IAAI,KAAK,IAAI,GAAG;AACvB,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SAAS,8BAA8B,KAAK,IAAI;AAAA,QAChD,MAAM,CAAC,SAAS,OAAO,MAAM;AAAA,MAC/B,CAAC;AAAA,IACH;AACA,SAAK,IAAI,KAAK,IAAI;AAAA,EACpB,CAAC;AACD,MAAI,CAAC,MAAM,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,UAAU,GAAG;AACzD,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM,CAAC,OAAO;AAAA,IAChB,CAAC;AAAA,EACH;AACF,CAAC;AAOI,IAAM,eAAe;AAGrB,IAAM,gBAAgBA,GAC1B,MAAM,YAAY,EAClB,IAAI,EAAE,EACN,UAAU,CAAC,QAAQ,QAAQ;AAC1B,QAAM,WAAW,oBAAI,IAA0D;AAC/E,aAAW,SAAS,QAAQ;AAC1B,UAAM,MAAM,MAAM,KAAK,YAAY;AACnC,UAAMK,eAAc,KAAK,UAAU;AAAA,MACjC,aAAa,MAAM,eAAe;AAAA,MAClC,OAAO,CAAC,GAAG,MAAM,KAAK,EACnB,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC,EACzD,IAAI,CAAC,EAAE,MAAM,QAAQ,OAAO,EAAE,MAAM,QAAQ,EAAE;AAAA,IACnD,CAAC;AACD,UAAM,WAAW,SAAS,IAAI,GAAG;AACjC,QAAI,CAAC,UAAU;AACb,eAAS,IAAI,KAAK,EAAE,aAAAA,cAAa,MAAM,CAAC;AACxC;AAAA,IACF;AACA,QAAI,SAAS,gBAAgBA,cAAa;AACxC,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SAAS,0CAA0C,MAAM,IAAI;AAAA,MAC/D,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,MAAM,KAAK;AACxD,CAAC;AAEH,SAAS,4BAA4B,MAAuB;AAC1D,MAAI,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,IAAI,GAAG;AAC/C,WAAO;AAAA,EACT;AACA,SAAO,KACJ,MAAM,GAAG,EACT,MAAM,CAAC,YAAY,QAAQ,SAAS,KAAK,YAAY,OAAO,YAAY,IAAI;AACjF;AAEA,IAAM,4BAA4BL,GAAE,OAAO;AAAA,EACzC,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,mBAAmBA,GAAE,MAAM,uBAAuB,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC9D,UAAUA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AACrC,CAAC;AAEM,IAAM,iBAAiBA,GAAE;AAAA,EAC9B,CAAC,UAAU;AACT,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,aAAO;AAAA,IACT;AACA,UAAM,SAAS;AACf,QAAI,OAAO,gBAAgB,QAAW;AACpC,aAAO;AAAA,IACT;AACA,QAAI,OAAO,gBAAgB,QAAW;AACpC,YAAM,EAAE,aAAa,cAAc,GAAG,KAAK,IAAI;AAC/C,aAAO,EAAE,GAAG,MAAM,aAAa,OAAO,YAAY;AAAA,IACpD;AACA,QAAI,OAAO,sBAAsB,QAAW;AAC1C,YAAM,EAAE,mBAAmB,oBAAoB,GAAG,KAAK,IAAI;AAC3D,aAAO;AAAA,QACL,GAAG;AAAA,QACH,aAAa;AAAA,UACX,aAAa;AAAA,UACb,mBAAmB,OAAO;AAAA,UAC1B,UAAU,MAAM,QAAQ,OAAO,iBAAiB,KAAK,OAAO,kBAAkB,SAAS;AAAA,QACzF;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EACAA,GAAE,OAAO;AAAA,IACP,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACpB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACtB,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC7B,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACtB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC1B,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,IAIzB,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,IAEzD,QAAQA,GACL,MAAM,mBAAmB,EACzB,IAAI,EAAE,EACN,YAAY,CAAC,QAAQ,QAAQ;AAC5B,YAAM,OAAO,oBAAI,IAAY;AAC7B,aAAO,QAAQ,CAAC,OAAO,UAAU;AAC/B,cAAM,MAAM,MAAM,KAAK,YAAY;AACnC,YAAI,KAAK,IAAI,GAAG,GAAG;AACjB,cAAI,SAAS;AAAA,YACX,MAAM;AAAA,YACN,SAAS,8BAA8B,MAAM,IAAI;AAAA,YACjD,MAAM,CAAC,OAAO,MAAM;AAAA,UACtB,CAAC;AAAA,QACH;AACA,aAAK,IAAI,GAAG;AAAA,MACd,CAAC;AAAA,IACH,CAAC,EACA,QAAQ,CAAC,CAAC;AAAA,IACb,OAAOA,GAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,IAClC,YAAYA,GAAE,MAAM,uBAAuB,EAAE,QAAQ,CAAC,CAAC;AAAA,IACvD,WAAWA,GAAE,MAAM,uBAAuB,EAAE,QAAQ,CAAC,CAAC;AAAA,IACtD,wBAAwBA,GAAE,MAAM,mCAAmC,EAAE,QAAQ,CAAC,CAAC;AAAA,IAC/E,aAAa,0BAA0B,SAAS;AAAA,IAChD,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACxD,CAAC;AACH;AAKO,IAAM,gCAAgC;AAGtC,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAM;AAAA,EACN,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,yBAAyBA,GAAE,KAAK,CAAC,UAAU,UAAU,CAAC;AAG5D,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,QAAQ;AAAA,EACR,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,oBAAoB,uBAAuB;AAAA,EACtD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,iBAAiBA,GAAE,KAAK;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,yBAAyBA,GAAE,KAAK,CAAC,aAAa,gBAAgB,UAAU,CAAC;AAG/E,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,UAAU;AAAA,EACV,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,QAAQ;AAAA,EACR,QAAQA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EAC1B,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,eAAeA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC/C,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,UAAU;AAAA,EACV,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,mBAAmBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC9C,QAAQ,uBAAuB,QAAQ,WAAW;AAAA,EAClD,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC7C,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC1C,eAAeA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3D,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,aAAaA,GAAE,OAAO;AAAA,EACjC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,cAAcA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,UAAU;AAAA,EACV,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACpC,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,MAAMA,GAAE,OAAO;AAAA,EACf,aAAaA,GAAE,OAAO;AAAA,EACtB,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC;AAAA,EACxC,KAAKA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EACrC,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,cAAcA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAaA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACpD,KAAKA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAGM,IAAM,iBAAiBA,GAAE,KAAK,CAAC,UAAU,WAAW,eAAe,WAAW,CAAC;AAG/E,IAAM,mBAAmBA,GAAE,KAAK,CAAC,UAAU,gBAAgB,WAAW,OAAO,CAAC;AAG9E,IAAM,qCAAqC;AAC3C,IAAM,sCAAsC;AAC5C,IAAM,0CAA0C;AAChD,IAAM,qCAAqC;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACO,IAAM,sCAAsC,CAAC,iBAAiB,mBAAmB;AAEjF,IAAM,qCAAqCA,GAC/C,OAAO;AAAA,EACN,gBAAgBA,GAAE,QAAQ,kCAAkC;AAAA,EAC5D,iBAAiBA,GAAE,QAAQ,mCAAmC;AAAA,EAC9D,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACrC,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACnC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAC/B,gBAAgBA,GAAE,QAAQ,UAAU;AAAA,EACpC,YAAYA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EACA,YAAY;AAGR,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,gBAAgBA,GAAE,OAAO;AAAA,EACzB,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,eAAeA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EACjC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnC,mBAAmBA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7E,wBAAwBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxC,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,6BAA6BA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAGnE,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAChC,MAAM;AAAA,EACN,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,YAAY;AAAA,EACZ,eAAeA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACpD,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACrE,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,iCAAiCA,GAAE,OAAO;AAAA,EACrD,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC3C,CAAC;AAGM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,kBAAkBA,GAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,MAAM,eAAe,SAAS;AAAA,EAC9B,QAAQ,iBAAiB,SAAS;AAAA,EAClC,YAAY,2BAA2B,SAAS;AAAA,EAChD,eAAeA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EACnD,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACrE,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,SAAS;AACvD,CAAC;AAGM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,YAAY;AACd,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,aAAaA,GAAE,MAAM,kBAAkB;AACzC,CAAC;AAGM,IAAM,oBAAoBA,GAC9B,OAAO;AAAA,EACN,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAClC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,iBAAiBA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,aAAaA,GACV,OAAO;AAAA,IACN,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC1B,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IACzC,yBAAyBA,GACtB,KAAK,CAAC,QAAQ,sBAAsB,qBAAqB,CAAC,EAC1D,SAAS;AAAA,EACd,CAAC,EACA,SAAS;AACd,CAAC,EACA,OAAO,CAAC,UAAU,QAAQ,MAAM,UAAU,MAAM,QAAQ,GAAG;AAAA,EAC1D,SAAS;AAAA,EACT,MAAM,CAAC,QAAQ;AACjB,CAAC;AAGI,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5C,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,aAAaA,GAAE,QAAQ,UAAU;AAAA,EACjC,eAAeA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvC,4BAA4BA,GAAE,QAAQ,MAAM;AAAA,EAC5C,aAAaA,GAAE,MAAMA,GAAE,KAAK,CAAC,sBAAsB,eAAe,CAAC,CAAC;AAAA,EACpE,gBAAgBA,GAAE,MAAMA,GAAE,QAAQ,MAAM,CAAC;AAC3C,CAAC;AAGM,IAAM,oCAAoCA,GAAE,OAAO;AAAA,EACxD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,eAAeA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACpD,iBAAiBA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,KAAK;AAAA,EACzC,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EACjD,oBAAoBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC/C,QAAQ,oBAAoB,QAAQ,QAAQ;AAAA,EAC5C,SAAS,qBAAqB,QAAQ,qBAAqB;AAAA,EAC3D,eAAe,2BAA2B,QAAQ,MAAM;AAC1D,CAAC;AAGM,IAAM,iBAAiBA,GAAE,KAAK,CAAC,QAAQ,OAAO,OAAO,SAAS,QAAQ,CAAC;AAGvE,IAAM,mBAAmBA,GAAE,KAAK;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,+BAA+BA,GAAE,KAAK,CAAC,UAAU,UAAU,CAAC;AAGlE,IAAM,4BAA4BA,GAAE,KAAK,CAAC,UAAU,WAAW,QAAQ,SAAS,CAAC;AAGjF,IAAM,wBAAwBA,GAAE,KAAK,CAAC,YAAY,WAAW,CAAC;AAG9D,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,WAAWA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACpC,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,OAAOA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA,EAGzC,cAAcA,GACX,OAAO;AAAA,IACN,OAAOA,GAAE,KAAK,CAAC,WAAW,iBAAiB,YAAY,CAAC;AAAA,IACxD,QAAQA,GAAE,KAAK;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,CAAC,EACA,SAAS;AACd,CAAC;AAGM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,aAAaA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAaA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC/C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC5C,MAAMA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3C,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACrD,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACrD,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACpD,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACpD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACzD,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACtD,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACpD,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAChD,UAAU,0BAA0B,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC3D,iBAAiBA,GAAE,MAAMA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtE,MAAM,sBAAsB,SAAS,EAAE,QAAQ,IAAI;AAAA,EACnD,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACrD,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACxD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACxD,OAAOA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAChC,SAASA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC3C,OAAOA,GAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClC,SAAS,kBAAkB,QAAQ,EAAE,WAAW,OAAO,OAAO,KAAK,CAAC;AAAA,EACpE,SAASA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAClC,eAAeA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAIjD,eAAeA,GACZ,OAAO;AAAA,IACN,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IACzC,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAChC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACtB,cAAcA,GAAE,KAAK,CAAC,aAAa,SAAS,CAAC,EAAE,SAAS;AAAA,EAC1D,CAAC,EACA,SAAS,EACT,QAAQ,IAAI;AAAA,EACf,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAUM,SAAS,0CACd,MACS;AACT,MAAI,KAAK,MAAO,QAAO;AACvB,MAAI,KAAK,WAAW,WAAY,QAAO;AACvC,QAAM,QAAQ,KAAK,SAAS;AAC5B,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,MAAK,MAAkC,WAAW,OAAQ,QAAO;AACjE,MAAI,KAAK,aAAa,QAAQ,KAAK,aAAa,UAAW,QAAO;AAClE,MAAI,KAAK,aAAa,UAAW,QAAO;AACxC,QAAM,WAAW,KAAK,SAAS;AAC/B,MAAI,CAAC,YAAY,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACjF,QAAM,SAAS;AACf,SACE,OAAO,OAAO,eAAe,YAC7B,gCAAgC,KAAK,OAAO,UAAU,KACtD,OAAO,OAAO,WAAW,YACzB,OAAO,OAAO,KAAK,EAAE,SAAS;AAElC;AAEO,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EACxC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,qCAAqCA,GAAE,OAAO;AAAA,EACzD,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC/B,MAAM,eAAe,QAAQ,CAAC,MAAM,CAAC;AAAA,EACrC,QAAQ,iBAAiB,QAAQ,QAAQ;AAAA,EACzC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC5C,MAAMA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3C,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvC,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvC,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,0BAA0B,uBAAuB;AAAA,EAC5D,QAAQA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACpD,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,eAAe,uBAAuB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO/C,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOpD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC5C,CAAC;AAGM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,OAAOA,GAAE,MAAM,qBAAqB;AAAA,EACpC,eAAeA,GAAE,MAAM,sBAAsB;AAC/C,CAAC;AAGM,IAAM,kCAAkCA,GAAE,OAAO;AAAA,EACtD,OAAOA,GAAE,MAAM,qBAAqB;AAAA,EACpC,QAAQA,GAAE,QAAQ,uBAAuB;AAAA,EACzC,WAAWA,GAAE,OAAO,EAAE,IAAI;AAC5B,CAAC;AAGM,IAAM,UAAUA,GAAE,OAAO;AAAA,EAC9B,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ;AAAA,EACR,gBAAgBA,GAAE,OAAO;AAAA,EACzB,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,aAAaA,GAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIhD,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAWA,GAAE,MAAM,WAAW;AAAA,EAC9B,QAAQ,cAAc,QAAQ,CAAC,CAAC;AAAA,EAChC,OAAOA,GAAE,MAAM,OAAO;AAAA;AAAA;AAAA,EAGtB,YAAY,kBAAkB,SAAS;AAAA;AAAA;AAAA;AAAA,EAIvC,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIxD,qBAAqB,2BAA2B,SAAS;AAAA,EACzD,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA;AAAA,EAE1C,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,OAAOA,GAAE,OAAO;AAAA,EAChB,gBAAgB;AAAA;AAAA,EAEhB,WAAW;AAAA;AAAA;AAAA;AAAA,EAIX,gBAAgBA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhC,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1C,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA,EAExD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMxD,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAChD,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA,EAGvD,0BAA0BA,GAAE,MAAM,UAAU,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvD,YAAYA,GAAE,MAAM,wBAAwB,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxD,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA,EAG5C,eAAeA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,kBAAkB;AAAA,EAClB,6BAA6B,sBAAsB,SAAS;AAAA,EAC5D,8BAA8B;AAAA,EAC9B,8BAA8B;AAAA,EAC9B,iCAAiCA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI5D,sBAAsBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1C,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxC,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIzC,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACzD,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC3C,mBAAmBA,GAAE,OAAO,EAAE,IAAI;AAAA,EAClC,mBAAmBA,GAAE,OAAO,EAAE,IAAI;AAAA,EAClC,kBAAkB;AAAA,EAClB,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3C,yBAAyBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACpD,uBAAuBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAElD,QAAQA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAEjC,UAAUA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA,EAE5C,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMpD,WAAWA,GACR,OAAO;AAAA,IACN,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IAC7C,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IAC/C,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACjD,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IAChD,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACnD,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IAChD,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,IAEhD,WAAWA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,CAAC,EACA,SAAS;AAAA,EACZ,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAQM,IAAM,wBAAwB,QAAQ,OAAO;AAAA,EAClD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC5C,CAAC;AAaM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,QAAQA,GAAE,MAAM,OAAO;AAAA;AAAA,EAEvB,iBAAiBA,GAAE,QAAQ,EAAE,SAAS;AAAA,EACtC,UAAUA,GAAE,MAAM,OAAO;AAAA,EACzB,YAAYA,GAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAUM,IAAM,cAAsCA,GAAE;AAAA,EAAK,MACxDA,GAAE,OAAO;AAAA,IACP,SAAS;AAAA,IACT,UAAUA,GAAE,MAAM,WAAW;AAAA,EAC/B,CAAC;AACH;AAEO,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,WAAWA,GAAE,MAAM,OAAO;AAAA,EAC1B,UAAUA,GAAE,MAAM,WAAW;AAAA,EAC7B,WAAWA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AACtC,CAAC;AAGM,IAAM,mBAAmBA,GAAE,KAAK;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQM,IAAM,4BAA4BA,GAAE,KAAK;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQM,IAAM,0BAA0BA,GAAE,KAAK;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,SAAS,uCACd,OAC2B;AAC3B,SAAO,UAAU,YAAY,iBAAiB;AAChD;AAEO,IAAM,0BAA0BA,GAAE,KAAK,CAAC,QAAQ,WAAW,MAAM,CAAC;AAIlE,IAAM,yBAAyBA,GAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAG3D,IAAM,uBAAuBA,GAAE,KAAK,CAAC,cAAc,UAAU,CAAC;AAG9D,IAAM,4BAA4BA,GAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAG5D,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,qCAAqC;AAAA,EAChD,SAAS;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,YAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,cAAc;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAYO,SAAS,+BAA+B,OAG7C;AACA,QAAM,WAAW,IAAI,IAAsB,MAAM,gBAAgB,CAAC,CAAC;AACnE,aAAW,iBAAiB,MAAM,kBAAkB,CAAC,GAAG;AACtD,eAAW,QAAQ,mCAAmC,aAAa,EAAG,UAAS,IAAI,IAAI;AAAA,EACzF;AAEA,QAAM,WAAW,IAAI,IAAsB,MAAM,gBAAgB,CAAC,CAAC;AACnE,aAAW,iBAAiB,MAAM,kBAAkB,CAAC,GAAG;AACtD,eAAW,QAAQ,mCAAmC,aAAa,EAAG,UAAS,IAAI,IAAI;AAAA,EACzF;AACA,aAAW,QAAQ,MAAM,uBAAuB,CAAC,GAAG;AAClD,QAAI,CAAC,SAAS,IAAI,IAAI,EAAG,UAAS,IAAI,IAAI;AAAA,EAC5C;AAGA,aAAW,QAAQ,SAAU,UAAS,OAAO,IAAI;AACjD,SAAO,EAAE,cAAc,CAAC,GAAG,QAAQ,GAAG,cAAc,CAAC,GAAG,QAAQ,EAAE;AACpE;AAEO,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAChC,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA;AAAA,EAG9C,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACpD,QAAQA,GAAE,KAAK;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC5C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,mBAAmB,4BAA4B,SAAS;AAAA,EACxD,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5C,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AACnD,CAAC;AAIM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,iBAAiBA,GAAE,QAAQ,KAAK;AAAA,EAChC,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,QAAQA,GAAE,KAAK,CAAC,sBAAsB,WAAW,sBAAsB,gBAAgB,CAAC;AAAA,EACxF,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC5C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5C,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACtC,CAAC;AAQM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,KAAKA,GAAE,OAAO,EAAE,IAAI;AAAA,EACpB,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI1C,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,WAAWA,GAAE,QAAQ,QAAQ;AAAA;AAAA,EAE7B,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AACrD,CAAC;AAGM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,UAAUA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,QAAQA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjC,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC5C,CAAC;AAGM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,UAAUA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,QAAQA,GAAE,KAAK,CAAC,qBAAqB,UAAU,WAAW,cAAc,CAAC;AAAA,EACzE,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC5C,CAAC;AAGM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACnD,QAAQA,GAAE,KAAK,CAAC,iBAAiB,kBAAkB,OAAO,CAAC;AAC7D,CAAC;AAQM,IAAM,gBAAgBA,GAAE,KAAK,CAAC,UAAU,WAAW,WAAW,CAAC;AAE/D,IAAM,iBAAiBA,GAAE,KAAK,CAAC,YAAY,UAAU,CAAC;AAEtD,IAAM,uBAAuBA,GAAE,KAAK,CAAC,aAAa,YAAY,CAAC;AAG/D,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,MAAM;AAAA,EACN,OAAO;AAAA,EACP,YAAYA,GAAE,MAAM,CAACA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAGA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAAA,EAC9E,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrC,WAAWA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA,EAGpB,QAAQA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AACzC,CAAC;AAGM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,OAAO;AAAA,EACP,aAAa;AAAA;AAAA;AAAA,EAGb,YAAYA,GAAE,OAAO;AAAA,EACrB,iBAAiBA,GAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,EACnD,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,YAAYA,GAAE,MAAM,CAACA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAGA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAChF,CAAC;AAKM,IAAM,wBAAwBA,GAAE,KAAK;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,QAAQ;AAAA;AAAA;AAAA,EAGR,QAAQA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AACzC,CAAC;AAcM,IAAM,mCAAmCA,GAAE,OAAO;AAAA,EACvD,QAAQA,GAAE,KAAK,CAAC,UAAU,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA,EACrD,OAAOA,GAAE,OAAO;AAAA;AAAA,EAChB,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC/B,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAC/C,CAAC;AAGM,IAAM,eAAeA,GAAE,KAAK,CAAC,WAAW,YAAY,WAAW,SAAS,CAAC;AAEzE,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,SAASA,GACN;AAAA,IACCA,GAAE,OAAO;AAAA,MACP,MAAMA,GAAE,OAAO;AAAA;AAAA,MACf,MAAM;AAAA,MACN,OAAOA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,MAChC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,MACjE,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,IAC/B,CAAC;AAAA,EACH,EACC,IAAI,CAAC;AAAA,EACR,QAAQA,GAAE,KAAK,CAAC,SAAS,SAAS,OAAO,CAAC,EAAE,QAAQ,OAAO;AAAA;AAAA,EAE3D,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA;AAAA;AAAA,EAIvC,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AACtD,CAAC;AAGM,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC1B,OAAOA,GAAE,QAAQ;AAAA;AAAA,EACjB,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAChD,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC/C,QAAQA,GACL,KAAK,CAAC,UAAU,YAAY,SAAS,YAAY,SAAS,SAAS,CAAC,EACpE,QAAQ,SAAS;AAAA,EACpB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAClD,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AACtD,CAAC;AAGM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,OAAOA,GAAE,OAAO,EAAE,KAAK;AAAA,EACvB,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,OAAOA,GAAE,OAAO;AAAA;AAAA,EAChB,KAAKA,GAAE,OAAO;AAChB,CAAC;AAGM,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,OAAOA,GAAE,OAAO,EAAE,KAAK;AAAA,EACvB,QAAQA,GAAE,KAAK,CAAC,UAAU,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA,EACrD,OAAOA,GAAE,OAAO;AAAA;AAAA,EAChB,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AACpC,CAAC;AAGM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,OAAOA,GAAE,OAAO,EAAE,KAAK;AAAA,EACvB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,QAAQA,GAAE,KAAK,CAAC,QAAQ,UAAU,cAAc,WAAW,MAAM,CAAC;AACpE,CAAC;AAIM,IAAM,aAAaA,GAAE,KAAK,CAAC,QAAQ,OAAO,WAAW,OAAO,CAAC;AAc7D,IAAM,aAAoCA,GAAE;AAAA,EAAK,MACtDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,OAAO;AAAA,IACf,MAAMA,GAAE,OAAO;AAAA,IACf,MAAM;AAAA,IACN,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,IACnD,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,IACjD,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAChC,UAAUA,GAAE,MAAM,UAAU,EAAE,SAAS;AAAA,IACvC,WAAWA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,CAAC;AACH;AAEO,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,MAAMA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA,EAC3B,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EAC/C,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAK;AAAA,EACjE,eAAeA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AACzC,CAAC;AAEM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAM;AAAA,EACN,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,WAAWA,GAAE,QAAQ;AAAA;AACvB,CAAC;AAGM,IAAM,aAAaA,GAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;AAE5C,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,MAAMA,GAAE,OAAO;AAAA,EACf,UAAU,WAAW,QAAQ,MAAM;AAAA,EACnC,UAAUA,GACP,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,OAAO,IAAI,EACpB,QAAQ,IAAI,OAAO,IAAI;AAC5B,CAAC;AAEM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO;AAAA,EACf,UAAU;AAAA,EACV,SAASA,GAAE,OAAO;AAAA;AAAA,EAClB,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EACxC,WAAWA,GAAE,QAAQ;AAAA;AAAA,EACrB,UAAUA,GAAE,QAAQ;AAAA;AAAA,EACpB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAGM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO;AAAA,EACf,UAAU,WAAW,QAAQ,MAAM;AAAA,EACnC,SAASA,GAAE,OAAO;AAAA,EAClB,WAAWA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EACnC,eAAeA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AACzC,CAAC;AAEM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,MAAMA,GAAE,OAAO;AAAA,EACf,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AACzC,CAAC;AAGM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,MAAMA,GAAE,OAAO;AAAA,EACf,WAAWA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AACtC,CAAC;AAEM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,OAAO;AAAA,EAClB,WAAWA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EACpC,eAAeA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AACzC,CAAC;AAEM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,OAAO;AAAA,EAClB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AACzC,CAAC;AAGM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO;AAAA,EACf,WAAWA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AACrC,CAAC;AAEM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,MAAMA,GAAE,OAAO;AAAA,EACf,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AACzC,CAAC;AAIM,IAAM,oBAAoBA,GAAE,KAAK;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC7B,OAAO,kBAAkB,SAAS;AAAA;AAAA,EAClC,UAAU,kBAAkB,SAAS;AAAA;AAAA,EACrC,cAAcA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AACzC,CAAC;AAEM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,MAAMA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAC7B,CAAC;AAEM,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,QAAQA,GAAE,QAAQ;AAAA,EAClB,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC1B,UAAUA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACnC,UAAUA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAChD,OAAOA,GAAE,MAAM,aAAa;AAAA,EAC5B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAIM,IAAM,kBAAkBA,GAAE,KAAK,CAAC,WAAW,OAAO,OAAO,MAAM,CAAC;AAEhE,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,MAAM;AAAA;AAAA,EAEN,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,MAAMA,GAAE,OAAO;AAAA;AACjB,CAAC;AAEM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,QAAQA,GAAE,OAAO;AAAA;AAAA,EACjB,OAAOA,GAAE,MAAM,WAAW;AAC5B,CAAC;AAEM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,QAAQ;AAAA,EACR,UAAUA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACnC,SAASA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAClC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,OAAOA,GAAE,MAAM,WAAW;AAAA;AAAA,EAC1B,WAAWA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AACtC,CAAC;AAEM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA,EAE3B,QAAQA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAGjC,kBAAkBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAC3C,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,UAAUA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACxC,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EACvD,iBAAiBA,GACd,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,IAAI,OAAO,IAAI,EACnB,QAAQ,MAAM,IAAI;AACvB,CAAC;AAEM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,OAAOA,GAAE,MAAM,WAAW;AAAA,EAC1B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAeM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,MAAMA,GAAE,OAAO;AAAA,EACf,QAAQ;AAAA;AAAA,EAER,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAG1B,UAAUA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAG9B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,UAAUA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAEnC,UAAUA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACnC,SAASA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AACpC,CAAC;AAOM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,MAAMA,GAAE,OAAO;AAAA,EACf,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,UAAUA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACnC,UAAUA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAChD,QAAQA,GAAE,MAAM,aAAa;AAAA,EAC7B,MAAMA,GAAE,MAAM,WAAW;AAC3B,CAAC;AAGM,IAAM,iCAAiCA,GAAE,KAAK;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC5C,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC7C,eAAeA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACxC,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzC,aAAaA,GAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAMM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,SAASA,GAAE,QAAQ,CAAC;AAAA,EACpB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,YAAYA,GAAE,OAAO;AAAA,EACrB,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,WAAW;AAAA,EACX,eAAeA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACxC,OAAOA,GAAE,MAAM,oBAAoB;AAAA,EACnC,OAAOA,GAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO;AACT,CAAC;AAIM,IAAM,mCAAmCA,GAAE,OAAO;AAAA,EACvD,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAYA,GAAE,OAAO;AAAA,EACrB,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,OAAO;AACT,CAAC;AAGM,IAAM,mCAAmCA,GAAE,OAAO;AAAA,EACvD,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAYA,GAAE,OAAO;AAAA,EACrB,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,QAAQ;AACV,CAAC;AAOM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,KAAKA,GAAE,OAAO,EAAE,IAAI;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AASM,IAAM,8BAA8BA,GAAE,mBAAmB,aAAa;AAAA,EAC3EA,GAAE,OAAO;AAAA,IACP,WAAWA,GAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,IAI1B,gBAAgB,+BAA+B,SAAS,EAAE,SAAS;AAAA,IACnE,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS;AAAA,IAC7D,YAAYA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC3C,QAAQA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACvC,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS;AAAA,EACjE,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,WAAWA,GAAE,QAAQ,IAAI;AAAA,IACzB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACvC,YAAYA,GAAE,OAAO;AAAA,IACrB,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC5B,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACzC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACxC,OAAO;AAAA,IACP,UAAU,yBAAyB,SAAS,EAAE,QAAQ,IAAI;AAAA,IAC1D,aAAa,0BAA0B,SAAS,EAAE,QAAQ,IAAI;AAAA,EAChE,CAAC;AACH,CAAC;AAWM,IAAM,kCAAkCA,GAAE,OAAO;AAAA,EACtD,MAAMA,GAAE,OAAO;AAAA,EACf,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,QAAQ;AAAA,EACR,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,UAAUA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,UAAUA,GAAE,QAAQ;AAAA,EACpB,UAAUA,GAAE,QAAQ;AAAA,EACpB,UAAU,WAAW,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA,EAC5C,SAASA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA,EAC3C,YAAY,0BAA0B,SAAS,EAAE,QAAQ,IAAI;AAAA;AAC/D,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,MAAMA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC3B,KAAKA,GAAE,OAAO,EAAE,QAAQ,MAAM;AAAA,EAC9B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAK,EAAE,QAAQ,GAAG;AAAA,EAC5D,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC9C,UAAUA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAEM,IAAM,YAAYA,GAAE,OAAO;AAAA,EAChC,KAAKA,GAAE,OAAO;AAAA,EACd,UAAUA,GAAE,OAAO;AAAA,EACnB,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EAC3B,QAAQA,GAAE,OAAO;AAAA,IACf,MAAMA,GAAE,OAAO;AAAA,IACf,OAAOA,GAAE,OAAO;AAAA,IAChB,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,CAAC;AAAA,EACD,WAAWA,GAAE,OAAO;AAAA,IAClB,MAAMA,GAAE,OAAO;AAAA,IACf,OAAOA,GAAE,OAAO;AAAA,IAChB,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,CAAC;AAAA,EACD,SAASA,GAAE,OAAO;AAAA,EAClB,MAAMA,GAAE,OAAO;AAAA,EACf,MAAMA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AACtC,CAAC;AAEM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,SAASA,GAAE,MAAM,SAAS;AAAA,EAC1B,SAASA,GAAE,QAAQ;AACrB,CAAC;AAGM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC3B,KAAKA,GAAE,OAAO;AAAA;AAAA,EACd,UAAUA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC9B,UAAU,WAAW,QAAQ,MAAM;AAAA,EACnC,iBAAiBA,GACd,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,IAAI,OAAO,IAAI,EACnB,QAAQ,MAAM,IAAI;AACvB,CAAC;AAEM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,QAAQ,UAAU,SAAS;AAAA;AAAA,EAC3B,OAAOA,GAAE,MAAM,WAAW;AAAA;AAAA,EAC1B,MAAMA,GACH,OAAO;AAAA,IACN,SAASA,GAAE,OAAO;AAAA,IAClB,UAAU;AAAA,IACV,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA,IAC1B,WAAWA,GAAE,QAAQ;AAAA,EACvB,CAAC,EACA,SAAS;AAAA,EACZ,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAQM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,KAAKA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA,EAG1B,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAO,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA,EAGlE,YAAYA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AACtC,CAAC;AAEM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,QAAQA,GAAE,OAAO;AAAA,EACjB,QAAQA,GAAE,OAAO;AAAA,EACjB,UAAUA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA;AAAA,EAGzB,SAASA,GAAE,QAAQ,KAAK;AAAA,EACxB,iBAAiBA,GAAE,OAAO,EAAE,YAAY;AAC1C,CAAC;AAIM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACrD,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACrD,KAAKA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA,EAC1B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA;AAC7B,CAAC;AAEM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,OAAOA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAEvB,WAAWA,GAAE,QAAQ,YAAY;AAAA,EACjC,eAAeA,GAAE,QAAQ;AAAA;AAC3B,CAAC;AAEM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,OAAOA,GAAE,OAAO,EAAE,KAAK;AAAA,EACvB,MAAMA,GAAE,OAAO;AACjB,CAAC;AAEM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,OAAOA,GAAE,OAAO,EAAE,KAAK;AAAA,EACvB,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAClC,CAAC;AAEM,IAAM,kBAAkBA,GAAE,OAAO,EAAE,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAM7D,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,YAAYA,GAAE,OAAO;AAAA,IACnB,WAAWA,GAAE,QAAQ;AAAA,IACrB,UAAUA,GAAE,QAAQ;AAAA,IACpB,MAAMA,GAAE,OAAO;AAAA,EACjB,CAAC;AAAA,EACD,UAAUA,GAAE,OAAO;AAAA,IACjB,QAAQA,GAAE,QAAQ;AAAA;AAAA,IAClB,MAAMA,GAAE,QAAQ;AAAA;AAAA,IAChB,KAAKA,GAAE,OAAO,EAAE,WAAWA,GAAE,QAAQ,EAAE,CAAC;AAAA;AAAA,EAC1C,CAAC;AAAA,EACD,KAAKA,GAAE,OAAO,EAAE,WAAWA,GAAE,QAAQ,GAAG,OAAOA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,CAAC;AACtE,CAAC;AAGM,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,MAAM;AAAA,EACN,SAASA,GAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC/B,YAAYA,GAAE,OAAO;AAAA,EACrB,eAAe,oBAAoB,SAAS,EAAE,SAAS;AAAA,EACvD,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,iBAAiBA,GAAE,KAAK,CAAC,WAAW,iBAAiB,WAAW,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACvF,oBAAoBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AACnE,CAAC;AAsDD,IAAM,8CAA8C,KAAK;AAGzD,IAAM,+CAA+C,IAAI;AAkBlD,SAAS,0BACd,OACA,eACA,kBAAmD;AAAA,EACjD,OAAO,MAAM;AAAA,EACb,MAAM,MAAM;AACd,GAC2B;AAC3B,QAAM,UAAU,yBAAyB,MAAM,OAAO,IAAI,MAAM,UAAU,CAAC;AAC3E,QAAM,SAAmB,CAAC;AAC1B,MAAI,gBAAgB;AAEpB,QAAM,gBAAgB,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AACxE,QAAM,kBAAkB,OAAO,UAAU,eAAe,KAAK,SAAS,QAAQ,IAC1E,QAAQ,SACR;AACJ,QAAM,kBAAkB,OAAO,UAAU,eAAe,KAAK,SAAS,QAAQ,IAC1E,QAAQ,SACR;AACJ,QAAM,YAAY,kBAAkB,OAAO,oBAAoB,WAAW,kBAAkB;AAC5F,QAAM,OAAO,cAAc,OAAO,OAAO,kBAAkB,SAAS;AACpE,MAAI,QAAQ,KAAK,WAAW;AAC1B,WAAO,KAAK,MAAM;AAClB,qBAAiB,KAAK,iBAAiB;AAAA,EACzC;AAEA,QAAM,SAAS,mBAAmB,eAAe;AACjD,MAAI,oBAAoB,QAAQ,OAAO,WAAW;AAChD,WAAO,KAAK,QAAQ;AACpB,qBAAiB,OAAO,iBAAiB;AAAA,EAC3C;AAEA,QAAM,SAAS;AAAA,IACb,oBAAoB,SAAa,aAAa,kBAAmB;AAAA,EACnE;AACA,MAAI,oBAAoB,UAAa,OAAO,WAAW;AACrD,WAAO,KAAK,QAAQ;AACpB,qBAAiB,OAAO,iBAAiB;AAAA,EAC3C;AAEA,QAAM,kBAAkB,qBAAqB,SAAS,CAAC,cAAc,WAAW,UAAU,CAAC;AAC3F,QAAM,sBACJ,oBAAoB,SAChB,kBACA,kBAAkB,eAChB,UACA;AACR,QAAM,aAAa,mBAAmB,mBAAmB;AACzD,MAAI,wBAAwB,QAAQ,WAAW,WAAW;AACxD,WAAO,KAAK,YAAY;AACxB,qBAAiB,WAAW,iBAAiB;AAAA,EAC/C;AAEA,QAAM,mBAAmB,qBAAqB,SAAS,CAAC,WAAW,aAAa,CAAC;AACjF,QAAM,UAAU;AAAA,IACd,qBAAqB,SACjB,mBACA,kBAAkB,iBAChB,UACA;AAAA,EACR;AACA,MAAI,QAAQ,WAAW;AACrB,WAAO,KAAK,SAAS;AACrB,qBAAiB,QAAQ,iBAAiB;AAAA,EAC5C;AAEA,QAAM,UAAU,eAAe,SAAS,MAAM,IAAI;AAClD,MAAI,QAAQ,WAAW;AACrB,WAAO,KAAK,SAAS;AACrB,qBAAiB,QAAQ,iBAAiB;AAAA,EAC5C;AAEA,MAAI,yBAAyB,QAAQ,UAAU,KAAK,QAAQ,WAAW,cAAc,MAAM;AACzF,WAAO,KAAK,SAAS;AAAA,EACvB;AAEA,QAAM,SAAS;AAAA,IACb,IAAI,MAAM;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB,YAAY,MAAM;AAAA,IAClB,QAAQ,MAAM,UAAU;AAAA,IACxB,gBAAgB,MAAM,kBAAkB;AAAA,IACxC,eAAe,MAAM,iBAAiB;AAAA,IACtC,iBAAiB,MAAM,mBAAmB;AAAA,EAC5C;AACA,QAAM,SAAS,oBAAoB,MAAM,MAAM,eAAe,OAAO;AACrE,QAAM,cAAc,oBAAoB,OAAO,OAAO,OAAO;AAC7D,QAAM,cAAc,OAAO;AAC3B,QAAM,kBAAkB,wBAAwB,OAAO,OAAO,WAAW;AACzE,QAAM,eACJ,qBAAqB,QAAQ,kBAAkB,iBAAiB,OAAO,QAAQ;AACjF,QAAM,UAAqC;AAAA,IACzC,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,IAAI,OAAO;AAAA,IACX,MAAM,OAAO;AAAA,IACb,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,IACnB,QAAQ,OAAO;AAAA,IACf,gBAAgB,OAAO;AAAA,IACvB,eAAe,OAAO;AAAA,IACtB,iBAAiB,OAAO;AAAA,IACxB;AAAA,IACA;AAAA,IACA,MAAM,MAAM,SAAS;AAAA,IACrB,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,SAAS,QAAQ;AAAA,IACjB,YAAY;AAAA,IACZ,SAAS;AAAA,IACT,YAAY;AAAA,MACV,WAAW,OAAO,SAAS;AAAA,MAC3B,QAAQ,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC;AAAA,MAC3B,eAAe,OAAO,SAAS,IAAI,iBAAiB,OAAO;AAAA,MAC3D,gBAAgB,sBAAsB;AAAA,QACpC,MAAM,MAAM,SAAS;AAAA,QACrB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,SAAS,QAAQ;AAAA,QACjB,YAAY;AAAA,QACZ,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,OAAqC;AACrE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,qBAAqB,SAAqB,MAA8C;AAC/F,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,UAAU,eAAe,KAAK,SAAS,GAAG,EAAG,QAAO,QAAQ,GAAG;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAiD;AAC1E,QAAM,gBAAgB,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AACtD,MAAI,iBAAiB,6CAA6C;AAChE,WAAO,EAAE,OAAO,WAAW,OAAO,cAAc;AAAA,EAClD;AACA,MAAI,eAAe,gBAAgB;AACnC,MAAI,YAAY;AAChB,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,UAAM,SAAS,UAAK,YAAY;AAChC,UAAM,SAAS,KAAK,IAAI,GAAG,8CAA8CM,WAAU,MAAM,CAAC;AAC1F,UAAM,OAAO,oBAAoB,OAAO,KAAK,MAAM,SAAS,GAAG,CAAC;AAChE,UAAM,OAAO,oBAAoB,OAAO,SAASA,WAAU,IAAI,CAAC;AAChE,gBAAY,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI;AACnC,UAAM,cAAc,KAAK,IAAI,GAAG,gBAAgBA,WAAU,IAAI,IAAIA,WAAU,IAAI,CAAC;AACjF,QAAI,gBAAgB,aAAc;AAClC,mBAAe;AAAA,EACjB;AACA,SAAO,EAAE,OAAO,WAAW,WAAW,MAAM,cAAc;AAC5D;AAEA,SAAS,mBAAmB,OAA8B;AACxD,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,WAAO,EAAE,OAAO,MAAM,WAAW,OAAO,eAAe,KAAK;AAAA,EAC9D;AACA,QAAM,cAAc,wBAAwB,KAAK;AACjD,QAAM,UAAU,yBAAyB,OAAO;AAAA,IAC9C,SAAS;AAAA,IACT,UAAU;AAAA,EACZ,CAAC;AACD,QAAM,iBAAiB,wBAAwB,OAAO,EAAE;AACxD,SAAO;AAAA,IACL,OAAO;AAAA,IACP,WACE,YAAY,UAAU,QAAQ,mBAAmB,QAAQ,YAAY,UAAU;AAAA,IACjF,eAAe,YAAY;AAAA,EAC7B;AACF;AAEA,SAAS,eACP,SACA,WAGA;AACA,QAAM,YACJ,cAAc,iBACd,cAAc,oBACd,cAAc;AAChB,QAAM,kBAAkB,CAAC,SAAS,QAAQ,aAAa,UAAU,EAAE;AAAA,IAAK,CAAC,QACvE,OAAO,UAAU,eAAe,KAAK,SAAS,GAAG;AAAA,EACnD;AACA,MAAI,CAAC,aAAa,CAAC,iBAAiB;AAClC,WAAO,EAAE,OAAO,MAAM,WAAW,OAAO,eAAe,KAAK;AAAA,EAC9D;AACA,QAAM,QAAQ,yBAAyB,QAAQ,KAAK;AACpD,QAAM,OAAO,yBAAyB,QAAQ,IAAI;AAClD,QAAM,WAAW,yBAAyB,QAAQ,QAAQ;AAC1D,QAAM,YAAY,OAAO,QAAQ,cAAc,YAAY,QAAQ,YAAY;AAC/E,QAAM,QAAQ,EAAE,OAAO,MAAM,OAAO,MAAM,KAAK,OAAO,WAAW,UAAU,SAAS,MAAM;AAC1F,QAAM,gBAAgB,CAAC,OAAO,MAAM,QAAQ,EACzC,IAAI,CAAC,UAAU,MAAM,iBAAiB,CAAC,EACvC,OAAO,CAAC,KAAK,UAAU,MAAM,OAAO,CAAC;AACxC,SAAO;AAAA,IACL;AAAA,IACA,WAAW,MAAM,aAAa,KAAK,aAAa,SAAS;AAAA,IACzD,eAAe,iBAAiB;AAAA,EAClC;AACF;AAEA,SAAS,yBAAyB,OAAyD;AACzF,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,EAAE,OAAO,MAAM,WAAW,OAAO,eAAe,KAAK;AAAA,EAC9D;AACA,SAAO,kBAAkB,KAAK;AAChC;AAEA,SAAS,oBACP,WACA,eACA,SACqC;AACrC,MAAI,cAAc,cAAe,QAAO;AACxC,MAAI,cAAc,iBAAkB,QAAO;AAC3C,MAAI,cAAc,kBAAmB,QAAO;AAC5C,MAAI,cAAc,oBAAoB,cAAc,2BAA2B;AAC7E,WAAO;AAAA,EACT;AACA,MAAI,kBAAkB,aAAc,QAAO;AAC3C,MACE,kBAAkB,kBAClB,cAAc,sBACd,cAAc,uBACd;AACA,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,WAAW,SAAU,QAAO;AACxC,MAAI,QAAQ,WAAW,YAAa,QAAO;AAC3C,SAAO;AACT;AAEA,SAASA,WAAU,OAAuB;AACxC,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AACzC;AAEA,SAAS,oBAAoB,OAAe,UAA0B;AACpE,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,SAAO,QAAQ,MAAM,QAAQ;AAC3B,UAAM,YAAY,MAAM,YAAY,KAAK;AACzC,QAAI,cAAc,OAAW;AAC7B,UAAM,YAAY,OAAO,cAAc,SAAS;AAChD,UAAM,OAAOA,WAAU,SAAS;AAChC,QAAI,QAAQ,OAAO,SAAU;AAC7B,aAAS;AACT,aAAS,UAAU;AAAA,EACrB;AACA,SAAO,MAAM,MAAM,GAAG,KAAK;AAC7B;AAEA,SAAS,oBAAoB,OAAe,UAA0B;AACpE,MAAI,QAAQ;AACZ,MAAI,QAAQ,MAAM;AAClB,SAAO,QAAQ,GAAG;AAChB,UAAM,QACJ,QAAQ,KAAK,MAAM,WAAW,QAAQ,CAAC,KAAK,SAAU,MAAM,WAAW,QAAQ,CAAC,KAAK,QACjF,IACA;AACN,UAAM,YAAY,MAAM,MAAM,QAAQ,OAAO,KAAK;AAClD,UAAM,OAAOA,WAAU,SAAS;AAChC,QAAI,QAAQ,OAAO,SAAU;AAC7B,aAAS;AACT,aAAS;AAAA,EACX;AACA,SAAO,MAAM,MAAM,KAAK;AAC1B;AAKO,IAAM,uCAAuC;AAM7C,IAAM,mBAAmBN,GAAE,OAAO,EAAE,MAAM,mBAAmB;AAG7D,IAAM,uBAAuBA,GACjC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,+BAA+B;AAGjC,IAAM,sBAAsB,cAAc,OAAO;AAAA,EACtD,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACrC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,6BAA6B,qBAAqB;AAAA,EAC7D,CAAC,UAAU;AACT,QAAI;AACF,aAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,cAAc;AAAA,IACvE,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,EAAE,SAAS,yDAAyD;AACtE;AAGA,IAAM,wBAAwB;AAAA,EAC5B,WAAW,oBAAoB,SAAS;AAAA,EACxC,kBAAkB;AAAA,EAClB,QAAQ,kBAAkB,SAAS;AACrC;AASO,IAAM,mBAAmB,aAAa,OAAO;AAAA,EAClD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,eAAeA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,iBAAiBA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAC5D,CAAC;AAIM,IAAM,iBAAiB,WAAW,OAAO;AAAA,EAC9C,WAAWA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACzC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACpC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,oBAAoBA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,kBAAkBA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAChD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC1C,wBAAwBA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AACxD,CAAC;AAQM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,gBAAgBA,GAAE,QAAQ,oCAAoC;AAAA,EAC9D,QAAQ;AAAA,EACR,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC1C,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7B,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,GAAG;AAAA,EACH,OAAO;AACT,CAAC;AAIM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,gBAAgBA,GAAE,QAAQ,oCAAoC;AAAA,EAC9D,QAAQ;AAAA,EACR,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAEtC,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,GAAG;AAAA,EACH,OAAO;AACT,CAAC;AAGM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,gBAAgBA,GAAE,QAAQ,oCAAoC;AAAA,EAC9D,YAAY;AAAA,EACZ,YAAYA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,QAAQA,GAAE,MAAM,eAAe,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACjD,CAAC;AAGM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,gBAAgBA,GAAE,QAAQ,oCAAoC;AAAA,EAC9D,YAAY;AAAA,EACZ,YAAYA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,QAAQA,GAAE,MAAM,eAAe,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACjD,CAAC;AAkBM,IAAM,+BAA+B;AACrC,IAAM,0CAA0C,kCAAkC;AAClF,IAAM,2CAA2C;AACjD,IAAM,2CAA2C,IAAI;AACrD,IAAM,mCAAmC,KAAK;AAa9C,SAAS,kBACd,OACA,UAAoC,CAAC,GACvB;AACd,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,WAAW,KAAK,IAAI,IAAI,MAAM,QAAQ,YAAY,gCAAgC;AAIxF,QAAM,gBAAgB,wBAAwB,KAAK,EAAE;AACrD,QAAM,SAAS,0BAA0B,KAAK;AAC9C,QAAM,KAAK,0BAA0B,OAAO,IAAI,uBAAuB;AACvE,QAAM,cAAc,0BAA0B,OAAO,aAAa,uBAAuB;AACzF,QAAM,YAAY,0BAA0B,OAAO,WAAW,uBAAuB;AACrF,QAAM,WACJ,OAAO,SAAS,YAChB,OAAO,OAAO,SAAS,UAAU,YACjC,OAAO,cAAc,OAAO,SAAS,KAAK,KAC1C,OAAO,SAAS,QAAQ,IACpB,OAAO,SAAS,QAChB;AACN,QAAM,aACJ,OAAO,WAAW,YAClB,OAAO,OAAO,WAAW,UAAU,YACnC,sBAAsB,OAAO,WAAW,KAAK,KAAK,MAC9C,OAAO,WAAW,QAClB;AACN,QAAM,UAAU,OAAO,KAAK,WAAW,OAAO,KAAK,QAAQ;AAC3D,QAAM,aACJ,OAAO,YAAY,YACnB,sBAAsB,OAAO,KAAK,gCAClC,CAAC,QAAQ,SAAS,IAAI,KACtB,CAAC,QAAQ,SAAS,IAAI;AACxB,QAAM,mBAAmB,OAAO,cAAc,WAAW,OAAO,cAAc,QAAQ;AACtF,QAAM,gBAAgB;AAAA,IACpB,OAAO,qBAAqB,YAAY,qBAAqB,OACzD,mBACA;AAAA,IACJ;AAAA,EACF;AACA,QAAM,qBAAqB,OAAO,gBAAgB,WAC9C,OAAO,gBAAgB,QACvB;AACJ,QAAM,kBACJ,uBAAuB,QACvB,uBAAuB,UACvB,uBAAuB,aACvB,uBAAuB,mBACvB,uBAAuB,cACnB,qBACA;AACN,QAAM,qBAAqB,OAAO,gBAAgB,WAC9C,OAAO,gBAAgB,QACvB;AACJ,QAAM,kBAAkB;AAAA,IACtB,OAAO,uBAAuB,YAAY,uBAAuB,OAC7D,qBACA;AAAA,IACJ;AAAA,EACF;AACA,QAAM,SAAS,kCAAkC,OAAO,MAAM;AAC9D,QAAM,iBAAiB,gCAAgC,OAAO,cAAc;AAC5E,QAAM,gBAAgB,kCAAkC,OAAO,aAAa;AAC5E,QAAM,qBAAqB,kCAAkC,OAAO,kBAAkB;AACtF,QAAM,iBAAiB;AAAA,IACrB,uCAAuC,KAAK;AAAA,IAC5C,8CAA8C,KAAK;AAAA,IACnD,CAAC,aACG;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,KAAK;AAAA,IACd,IACA;AAAA,IACJ,CAAC,OAAO,cAAc,YAAY,qBAAqB,gBACnD;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,cAAc;AAAA,IACvB,IACA;AAAA,IACJ,CAAC,OAAO,gBAAgB,YAAY,uBAAuB,kBACvD;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,gBAAgB;AAAA,IACzB,IACA;AAAA,IACJ,CAAC,OAAO,gBAAgB,YAAY,uBAAuB,kBACvD;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,gBAAgB;AAAA,IACzB,IACA;AAAA,IACJ,GAAG,sCAAsC,QAAQ;AAAA,MAC/C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,GAAG,qCAAqC,QAAQ;AAAA,MAC9C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,CAAC,OAAO,QAAQ,WACZ,oCAAoC,WAAW,QAAW,MAAM,KAAK,IACrE;AAAA,EACN,EAAE,OAAO,CAAC,UAAU,UAAU,IAAI;AAClC,QAAM,aAAa,OAAO,QAAQ,WAC9B,OAAO,QAAQ,QACf;AACJ,QAAM,UACJ,eAAe,WAAW,IACtB,yBAAyB,YAAY,EAAE,QAAQ,CAAC,IAChD;AAAA,IACE;AAAA,MACE,SAAS;AAAA,MACT,oBAAoB;AAAA,MACpB,cAAc,OAAO,YAAY,WAAW,sBAAsB,SAAS,GAAG,IAAI;AAAA,MAClF,oBAAoB;AAAA,QAClB,WAAW;AAAA,QACX;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,MACA,cAAc,EAAE,WAAW,OAAO,QAAQ,eAAe;AAAA,IAC3D;AAAA,IACA,EAAE,SAAS,UAAU,IAAI,KAAK;AAAA,EAChC;AACN,QAAM,UAAwB;AAAA,IAC5B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,aAAc,UAAmC;AAAA,IACvD;AAAA,IACA;AAAA,IACA,GAAI,oCAAoC,OAAO,aAAa,IAAI,EAAE,cAAc,IAAI,CAAC;AAAA,IACrF,GAAI,oCAAoC,OAAO,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC;AAAA,IACvE,GAAI,oCAAoC,OAAO,cAAc,IAAI,EAAE,eAAe,IAAI,CAAC;AAAA,IACvF,GAAI,oCAAoC,OAAO,aAAa,IAAI,EAAE,cAAc,IAAI,CAAC;AAAA,IACrF,GAAI,oCAAoC,OAAO,eAAe,IAAI,EAAE,gBAAgB,IAAI,CAAC;AAAA,IACzF,GAAI,oCAAoC,OAAO,kBAAkB,IAC7D,EAAE,mBAAmB,IACrB,CAAC;AAAA,IACL,GAAI,oCAAoC,OAAO,eAAe,IAAI,EAAE,gBAAgB,IAAI,CAAC;AAAA,EAC3F;AACA,MAAI,sBAAsB,OAAO,KAAK,SAAU,QAAO;AAEvD,QAAM,WAAyB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,SAAS;AAAA,MACP;AAAA,QACE,SAAS;AAAA,QACT,oBAAoB;AAAA,QACpB,cAAc,OAAO,YAAY,WAAW,sBAAsB,SAAS,GAAG,IAAI;AAAA,QAClF,cAAc,EAAE,WAAW,OAAO,QAAQ,eAAe;AAAA,MAC3D;AAAA,MACA,EAAE,SAAS,UAAU,IAAI,KAAK;AAAA,IAChC;AAAA,IACA;AAAA,IACA,GAAI,oCAAoC,OAAO,aAAa,IAAI,EAAE,cAAc,IAAI,CAAC;AAAA,IACrF,GAAI,oCAAoC,OAAO,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC;AAAA,IACvE,GAAI,oCAAoC,OAAO,cAAc,IAAI,EAAE,eAAe,IAAI,CAAC;AAAA,IACvF,GAAI,oCAAoC,OAAO,aAAa,IAAI,EAAE,cAAc,IAAI,CAAC;AAAA,IACrF,GAAI,oCAAoC,OAAO,eAAe,IAAI,EAAE,gBAAgB,IAAI,CAAC;AAAA,IACzF,GAAI,oCAAoC,OAAO,kBAAkB,IAC7D,EAAE,mBAAmB,IACrB,CAAC;AAAA,IACL,GAAI,oCAAoC,OAAO,eAAe,IAAI,EAAE,gBAAgB,IAAI,CAAC;AAAA,EAC3F;AACA,QAAM,iBAAiB,sBAAsB,QAAQ;AACrD,MAAI,iBAAiB,UAAU;AAC7B,UAAM,IAAI;AAAA,MACR,qDAAqD,cAAc,MAAM,QAAQ;AAAA,IACnF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oCACP,OACA,UACA,WACA,mBAAmB,MACsD;AACzE,SAAO;AAAA,IACL;AAAA,IACA,eAAe,mBACX,OAAO,aAAa,WAClB,sBAAsB,QAAQ,IAC9B,OAAO,aAAa,YAAY,OAAO,aAAa,YAClD,sBAAsB,QAAQ,IAC9B,aAAa,QAAQ,aAAa,SAChC,IACA,OACN;AAAA,IACJ,gBACE,OAAO,cAAc,WACjB,sBAAsB,SAAS,IAC/B,OAAO,cAAc,YAAY,OAAO,cAAc,YACpD,sBAAsB,SAAS,IAC/B;AAAA,EACV;AACF;AAEA,SAAS,uCACP,OACkE;AAClE,QAAM,aAAa;AAAA,IACjB,OAAO;AAAA,IACP,eAAe;AAAA,IACf,gBAAgB;AAAA,EAClB;AACA,MAAI,YAA2B;AAC/B,MAAI;AACF,aAAS,QAAQ,GAAG,SAAS,mCAAmC,SAAS,GAAG;AAC1E,UAAI,cAAc,KAAM,QAAO;AAC/B,YAAM,aAAa,OAAO,yBAAyB,WAAW,QAAQ;AACtE,UAAI,YAAY;AAKd,eAAO,EAAE,WAAW,eAAe,OAAO,WAAW,UAAU,aAC3D,aACA;AAAA,MACN;AACA,kBAAY,OAAO,eAAe,SAAS;AAAA,IAC7C;AAGA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,oCAAoC;AAC1C,IAAM,0BAA0B;AAChC,IAAM,6BACJ;AAEF,IAAM,gCAAgC;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,wCAAwC,oBAAI,IAAY;AAAA,EAC5D,GAAG;AAAA,EACH;AACF,CAAC;AAQD,SAAS,8CACP,OACkE;AAClE,QAAM,aAAa;AAAA,IACjB,OAAO;AAAA,IACP,eAAe;AAAA,IACf,gBAAgB;AAAA,EAClB;AACA,MAAI,YAAY;AAChB,MAAI;AACF,eAAW,OAAO,OAAiD;AACjE,mBAAa;AACb,UAAI,YAAY,sCAAsC,OAAO,EAAG,QAAO;AACvE,YAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,UAAI,YAAY,cAAc,CAAC,sCAAsC,IAAI,GAAG,GAAG;AAC7E,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKA,SAAS,0BAA0B,OAAgD;AACjF,SAAO,OAAO;AAAA,IACZ,8BAA8B,IAAI,CAAC,QAAQ;AACzC,UAAI;AACF,cAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,YAAI,CAAC,WAAY,QAAO,CAAC,KAAK,EAAE,UAAU,MAAM,OAAO,OAAU,CAAC;AAClE,eAAO;AAAA,UACL;AAAA,UACA,WAAW,aAAa,EAAE,UAAU,MAAM,OAAO,WAAW,MAAM,IAAI,EAAE,UAAU,MAAM;AAAA,QAC1F;AAAA,MACF,QAAQ;AACN,eAAO,CAAC,KAAK,EAAE,UAAU,MAAM,CAAC;AAAA,MAClC;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,SAAS,0BAA0B,OAA6B,UAA0B;AACxF,SAAO,MAAM,YACX,OAAO,MAAM,UAAU,YACvB,2BAA2B,KAAK,MAAM,KAAK,IACzC,MAAM,QACN;AACN;AAEA,SAAS,kCAAkC,OAA4C;AACrF,SAAO,MAAM,YACX,OAAO,MAAM,UAAU,YACvB,2BAA2B,KAAK,MAAM,KAAK,IACzC,MAAM,QACN;AACN;AAEA,SAAS,gCAAgC,OAA4C;AACnF,SAAO,MAAM,YACX,OAAO,MAAM,UAAU,YACvB,OAAO,cAAc,MAAM,KAAK,KAChC,MAAM,SAAS,IACb,MAAM,QACN;AACN;AAEA,SAAS,oCAAoC,OAAsC;AACjF,SAAO,CAAC,MAAM,YAAY,MAAM,UAAU;AAC5C;AAEA,SAAS,sCACP,QACA,WAWC;AACD,SAAQ,CAAC,MAAM,eAAe,aAAa,YAAY,YAAY,EAAY;AAAA,IAC7E,CAAC,UAAU;AACT,YAAM,WAAW,OAAO,KAAK,EAAE,WAAW,OAAO,KAAK,EAAE,QAAQ;AAChE,aAAO,OAAO,KAAK,EAAE,YAAY,aAAa,UAAU,KAAK,IACzD,CAAC,IACD;AAAA,QACE;AAAA,UACE;AAAA,UACA;AAAA,UACA,UAAU,KAAK;AAAA,UACf,OAAO,KAAK,EAAE;AAAA,QAChB;AAAA,MACF;AAAA,IACN;AAAA,EACF;AACF;AAEA,SAAS,qCACP,QACA,WAUC;AACD,SAAQ,CAAC,UAAU,kBAAkB,iBAAiB,oBAAoB,EAAY;AAAA,IACpF,CAAC,UAAU;AACT,YAAM,WAAW,OAAO,KAAK,EAAE,WAAW,OAAO,KAAK,EAAE,QAAQ;AAChE,YAAM,oBAAoB,YAAY;AACtC,aAAO,OAAO,KAAK,EAAE,YAAY,sBAAsB,UAAU,KAAK,IAClE,CAAC,IACD;AAAA,QACE;AAAA,UACE;AAAA,UACA;AAAA,UACA,UAAU,KAAK;AAAA,UACf,OAAO,KAAK,EAAE;AAAA,QAChB;AAAA,MACF;AAAA,IACN;AAAA,EACF;AACF;AAEA,SAAS,8BACP,OACA,UACG;AACH,SAAQ,OAAO,UAAU,WAAW,sBAAsB,OAAO,QAAQ,IAAI;AAC/E;AAEA,SAAS,sBAAsB,OAAe,UAA0B;AACtE,QAAMG,WAAU,IAAI,YAAY;AAChC,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,QAAQA,SAAQ,OAAO,KAAK;AAClC,MAAI,MAAM,cAAc,SAAU,QAAO;AACzC,QAAM,SAAS;AACf,QAAM,cAAcA,SAAQ,OAAO,MAAM,EAAE;AAC3C,QAAM,eAAe,KAAK,IAAI,GAAG,WAAW,WAAW;AACvD,MAAI,YAAY,KAAK,IAAI,cAAc,MAAM,UAAU;AACvD,SAAO,YAAY,KAAK,YAAY,MAAM,eAAe,MAAM,SAAS,IAAK,SAAU,KAAM;AAC3F,iBAAa;AAAA,EACf;AACA,SAAO,GAAG,QAAQ,OAAO,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,GAAG,MAAM;AACjE;AAEA,SAAS,sBAAsB,OAAuB;AACpD,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AACzC;AAEO,IAAM,+BAA+BH,GAAE,OAAO;AAAA,EACnD,SAAS;AAAA,EACT,UAAU;AAAA,EACV,OAAO,cAAc,SAAS;AAChC,CAAC;AAGM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,SAAS;AAAA,EACT,kBAAkB;AAAA,EAClB,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAChD,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC1C,CAAC;AAGM,IAAM,uBAAuB,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOzD,oBAAoBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,EAGhC,kBAAkBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS/D,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3D,WAAWA,GAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA,EAG1C,QAAQ,cAAc,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA,EAIhC,OAAOA,GAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,iBAAiB,gBAAgB,SAAS;AAAA,EAC1C,gBAAgB,eAAe,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxC,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM5C,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvC,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1C,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAClC,MAAM,SAAS,SAAS;AAAA,EACxB,eAAe,oBAAoB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO5C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKpD,iCAAiCA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA;AAAA,EAGzE,qBAAqB,sBAAsB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOpD,0BAA0BA,GAAE,MAAM,UAAU,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOvD,YAAYA,GAAE,MAAM,qBAAqB,EAAE,IAAI,uBAAuB,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBlF,SAASA,GACN,MAAM,CAACA,GAAE,QAAQ,QAAQ,GAAGA,GAAE,QAAQ,KAAK,GAAGA,GAAE,OAAO,EAAE,SAASA,GAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EACvF,SAAS;AACd,CAAC;AAOM,IAAM,yBAAyBA,GAAE,KAAK,CAAC,QAAQ,iBAAiB,cAAc,CAAC;AAG/E,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAC5B,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,aAAaA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AACxD,CAAC;AAGM,IAAM,qBAAqBA,GAC/B,OAAO;AAAA,EACN,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAC5B,MAAM;AAAA,EACN,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAClC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,UAAUA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,SAASA,GAAE,MAAM,gBAAgB,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;AAAA,EACrD,UAAUA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAClC,YAAYA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACrC,YAAYA,GACT,OAAO;AAAA,IACN,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IACxE,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IACrE,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,IAC1E,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EACzE,CAAC,EACA,SAAS,EACT,SAAS;AACd,CAAC,EACA,YAAY,CAAC,UAAU,QAAQ;AAC9B,QAAM,YAAY,IAAI,IAAI,SAAS,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AACrE,MAAI,UAAU,SAAS,SAAS,QAAQ,QAAQ;AAC9C,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,SAAS,SAAS,QAAQ;AAC5B,QAAI,SAAS,QAAQ,SAAS,GAAG;AAC/B,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,SAAS;AAAA,QAChB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,SAAS,YAAY;AACvB,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,YAAY;AAAA,QACnB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,WAAW,SAAS,QAAQ,WAAW,GAAG;AACxC,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,aAAa,SAAS;AAC5B,MACE,YAAY,aAAa,QACzB,YAAY,aAAa,QACzB,WAAW,YAAY,WAAW,WAClC;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,YAAY;AAAA,MACnB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,YAAY,iBAAiB,QAC7B,YAAY,iBAAiB,QAC7B,WAAW,gBAAgB,WAAW,eACtC;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,YAAY;AAAA,MACnB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,0BAA0BA,GAAE,KAAK;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,6BAA6BA,GAAE,OAAO;AAAA,EACjD,WAAWA,GAAE,MAAM,kBAAkB,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACpD,WAAWA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACpC,kBAAkBA,GACf,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,KAAK,KAAK,EAAE,EACrB,SAAS,EACT,SAAS;AACd,CAAC;AAGM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACpC,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAC5C,OAAOA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAClD,CAAC;AAGM,IAAM,qBAAqBA,GAAE,mBAAmB,WAAW;AAAA,EAChEA,GAAE,OAAO;AAAA,IACP,SAASA,GAAE,QAAQ,UAAU;AAAA,IAC7B,SAASA,GAAE,MAAM,gBAAgB,EAAE,IAAI,EAAE;AAAA,EAC3C,CAAC;AAAA,EACDA,GAAE,OAAO,EAAE,SAASA,GAAE,QAAQ,SAAS,EAAE,CAAC;AAAA,EAC1CA,GAAE,OAAO,EAAE,SAASA,GAAE,QAAQ,SAAS,EAAE,CAAC;AAAA,EAC1CA,GAAE,OAAO,EAAE,SAASA,GAAE,QAAQ,WAAW,EAAE,CAAC;AAC9C,CAAC;AAGM,IAAM,kCAAkCA,GAAE,mBAAmB,WAAW;AAAA,EAC7EA,GAAE,OAAO;AAAA,IACP,SAASA,GAAE,QAAQ,UAAU;AAAA,IAC7B,SAASA,GAAE,MAAM,gBAAgB,EAAE,IAAI,EAAE;AAAA,EAC3C,CAAC;AAAA,EACDA,GAAE,OAAO,EAAE,SAASA,GAAE,QAAQ,SAAS,EAAE,CAAC;AAC5C,CAAC;AAGM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC1C,mBAAmBA,GAAE,OAAO,EAAE,KAAK;AAAA,EACnC,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACtC,QAAQ;AAAA,EACR,WAAWA,GAAE,MAAM,kBAAkB,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACpD,WAAWA,GAAE,QAAQ;AAAA,EACrB,UAAU,mBAAmB,SAAS;AAAA,EACtC,aAAaA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAC3C,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAQM,SAAS,mBAAmB,OAA+B;AAChE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,WAAW;AACjB,QAAM,UACJ,SAAS,WAAW,OAAO,SAAS,YAAY,WAC3C,SAAS,UACV;AACN,QAAM,YAAY,SAAS,UAAU,SAAS,MAAM,SAAS,MAAM,SAAS;AAC5E,MAAI,OAAO,cAAc,YAAY,OAAO,cAAc,SAAU,QAAO;AAC3E,SAAO,OAAO,SAAS;AACzB;AAEO,IAAM,qBAAqBA,GAAE,mBAAmB,QAAQ;AAAA,EAC7DA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,cAAc;AAAA,IAC9B,eAAe,oBAAoB,SAAS;AAAA,IAC5C,SAASA,GAAE,OAAO;AAAA,MAChB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,MAGtB,kBAAkBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA,MAC/D,WAAWA,GAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA,MAC1C,OAAOA,GAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,MAClC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAClC,iBAAiB,gBAAgB,SAAS;AAAA,MAC1C,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACxC,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA;AAAA,MAG/D,sBAAsBA,GAAE,MAAM,+BAA+B,EAAE,SAAS;AAAA,IAC1E,CAAC;AAAA,EACH,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,uBAAuB;AAAA,IACvC,eAAe,oBAAoB,SAAS;AAAA,IAC5C,SAASA,GAAE,OAAO;AAAA,MAChB,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,+BAA+B;AAAA,MACjE,UAAUA,GAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;AAAA,MACtC,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,CAAC;AAAA,EACH,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,yBAAyB;AAAA,IACzC,eAAe,oBAAoB,SAAS;AAAA,IAC5C,SAASA,GAAE,OAAO;AAAA,MAChB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,MAC3B,UAAU;AAAA,IACZ,CAAC;AAAA,EACH,CAAC;AACH,CAAC;AAGM,IAAM,6BAA6BA,GAAE,OAAO;AAAA,EACjD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,kBAAkBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA,EAC/D,WAAWA,GAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC1C,OAAOA,GAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,iBAAiB,gBAAgB,SAAS;AAAA,EAC1C,eAAe,oBAAoB,SAAS;AAAA,EAC5C,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC/D,sBAAsBA,GAAE,MAAM,+BAA+B,EAAE,SAAS;AAC1E,CAAC;AAGM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,UAAU;AAAA,EACV,MAAM;AACR,CAAC;AAGM,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQA,GAAE,MAAM,YAAY,EAAE,IAAI,CAAC;AACrC,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,QAAQA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjC,sBAAsBA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAChD,CAAC;AAGM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,IAAIA,GAAE,OAAO,EAAE,IAAI;AAAA,EACnB,gBAAgBA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,UAAUA,GAAE,OAAO;AAAA,EACnB,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,QAAQ;AAAA,EACnB,SAASA,GAAE,OAAO;AAAA,EAClB,UAAUA,GAAE,OAAO;AAAA,EACnB,eAAeA,GAAE,OAAO;AAAA,EACxB,cAAcA,GAAE,OAAO;AAAA,EACvB,aAAaA,GAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAGM,IAAM,wBAAwBA,GAAE,KAAK,CAAC,OAAO,UAAU,CAAC;AAGxD,IAAM,sBAAsBA,GAAE,KAAK,CAAC,YAAY,WAAW,OAAO,CAAC;AAGnE,IAAM,8BAA8BA,GAAE,KAAK,CAAC,UAAU,aAAa,WAAW,YAAY,CAAC;AAG3F,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC1C,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC9C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,YAAYA,GAAE,QAAQ;AAAA,EACtB,QAAQ;AAAA,EACR,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,UAAUA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,eAAeA,GAAE,MAAM,yBAAyB;AAAA,EAChD,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAC7B,CAAC;AAGM,IAAM,6BAA6BA,GAAE,OAAO;AAAA,EACjD,cAAcA,GAAE,MAAM,gBAAgB;AACxC,CAAC;AAGM,IAAM,mBAAmBA,GAAE,mBAAmB,QAAQ;AAAA,EAC3DA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,MAAM;AAAA,EACxB,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,eAAe;AAAA,IAC/B,YAAYA,GAAE,QAAQ,uBAAuB;AAAA,EAC/C,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,iBAAiB;AAAA,IACjC,YAAYA,GAAE,QAAQ,eAAe;AAAA,IACrC,QAAQA,GAAE,QAAQ,QAAQ;AAAA,EAC5B,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,gBAAgB;AAAA,IAChC,SAASA,GAAE,QAAQ,QAAQ;AAAA,EAC7B,CAAC;AACH,CAAC;AAOM,IAAM,8BAA8BA,GAAE,KAAK;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF,CAAC;AAGM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,SAAS;AAAA,EACT,IAAI;AAAA,EACJ,UAAUA,GAAE,KAAK,CAAC,QAAQ,WAAW,QAAQ,UAAU,CAAC;AAAA;AAAA,EAExD,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC3E,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACzE,iBAAiBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAC1C,2BAA2BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EACrE,YAAYA,GAAE,OAAO;AAAA,IACnB,WAAWA,GAAE,QAAQ;AAAA,IACrB,UAAUA,GAAE,QAAQ;AAAA,IACpB,MAAMA,GAAE,OAAO;AAAA,IACf,SAASA,GAAE,KAAK,CAAC,KAAK,IAAI,CAAC;AAAA,IAC3B,UAAUA,GAAE,KAAK,CAAC,QAAQ,UAAU,CAAC;AAAA,IACrC,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,UAAUA,GAAE,OAAO;AAAA,IACjB,WAAWA,GAAE,KAAK,CAAC,cAAc,QAAQ,CAAC,EAAE,SAAS;AAAA,IACrD,YAAYA,GAAE,QAAQ;AAAA,IACtB,OAAOA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKhB,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC/B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,IAG3B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,KAAKA,GAAE,OAAO;AAAA,IACZ,WAAWA,GAAE,QAAQ;AAAA,IACrB,OAAOA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,IACzB,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,eAAeA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA,IAItB,WAAWA,GAAE,KAAK,CAAC,UAAU,UAAU,UAAU,cAAc,CAAC,EAAE,SAAS;AAAA,IAC3E,QAAQA,GAAE,KAAK,CAAC,SAAS,WAAW,QAAQ,CAAC,EAAE,SAAS;AAAA,IACxD,MAAMA,GAAE,KAAK,CAAC,aAAa,aAAa,CAAC,EAAE,QAAQ,WAAW;AAAA,IAC9D,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC/B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,YAAYA,GACT,MAAM,CAACA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAGA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,EAChE,QAAQ,CAAC,MAAM,GAAG,CAAC;AAAA;AAAA,IAEtB,YAAYA,GAAE,QAAQ;AAAA,IACtB,wBAAwBA,GAAE,QAAQ;AAAA,IAClC,cAAcA,GAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASxB,QAAQA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,IACjC,kBAAkBA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,IACvD,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,WAAWA,GAAE,OAAO;AAAA,IAClB,WAAWA,GAAE,QAAQ;AAAA,IACrB,OAAOA,GAAE,MAAMA,GAAE,KAAK,CAAC,UAAU,WAAW,WAAW,CAAC,CAAC;AAAA,IACzD,QAAQA,GAAE,MAAMA,GAAE,KAAK,CAAC,YAAY,UAAU,CAAC,CAAC;AAAA,IAChD,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKD,aAAaA,GAAE,OAAO;AAAA,IACpB,WAAWA,GAAE,QAAQ;AAAA,IACrB,UAAUA,GAAE,QAAQ;AAAA,IACpB,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,cAAcA,GAAE,OAAO;AACzB,CAAC;AAkBM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,SAASA,GAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAGM,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,UAAUA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,gBAAgBA,GAAE,OAAO,EAAE,KAAK;AAAA,EAChC,UAAUA,GAAE,KAAK,CAAC,QAAQ,WAAW,QAAQ,UAAU,CAAC;AAAA;AAAA,EAExD,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC7D,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC3D,iBAAiBA,GAAE,QAAQ;AAAA,EAC3B,2BAA2BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAGrD,cAAcA,GAAE,OAAO,EAAE,SAAS;AACpC,CAAC;AAYM,IAAM,2BAA2BA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA,EAI/C,uBAAuBA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA,EAG/C,mBAAmBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAC9C,CAAC;AAGM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,cAAcA,GAAE,QAAQ;AAAA,EACxB,oBAAoBA,GAAE,QAAQ;AAChC,CAAC;AAKM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC3C,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA;AAAA,EAE9C,OAAOA,GAAE,QAAQ;AACnB,CAAC;AAcM,IAAM,eAAeA,GAAE,KAAK,CAAC,SAAS,SAAS,SAAS,CAAC;AAEzD,IAAM,iBAAiBA,GAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAOnD,IAAM,+BAA+BA,GAAE,OAAO;AAAA;AAAA,EAEnD,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACrC,IAAI,aAAa,QAAQ,OAAO;AAAA,EAChC,MAAM,eAAe,QAAQ,QAAQ;AAAA;AAAA,EAErC,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEjD,UAAUA,GAAE,QAAQ,eAAe,EAAE,QAAQ,eAAe;AAAA;AAAA,EAE5D,iBAAiBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA,EAG1C,uBAAuBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhD,aAAaA,GAAE,OAAO,EAAE,KAAK;AAC/B,CAAC;AAIM,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,YAAYA,GAAE,OAAO;AAAA,EACrB,UAAUA,GAAE,OAAO;AAAA,EACnB,iBAAiBA,GAAE,OAAO;AAAA,EAC1B,yBAAyBA,GAAE,OAAO;AAAA,EAClC,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC9C,CAAC;AAMM,IAAM,iCAAiCA,GAAE,OAAO;AAAA,EACrD,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAClC,oBAAoBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAC/C,CAAC;AAGM,IAAM,kCAAkCA,GAAE,OAAO;AAAA,EACtD,UAAUA,GAAE,QAAQ;AAAA,EACpB,cAAcA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,oBAAoBA,GAAE,QAAQ;AAChC,CAAC;AAIM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACvC,CAAC;AAGM,IAAM,wBAAwBA,GAAE,KAAK;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,SAASA,GAAE,OAAO,EAAE,KAAK;AAAA,EACzB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE7B,QAAQA,GAAE,OAAO;AAAA;AAAA;AAAA,EAGjB,eAAeA,GAAE,OAAO;AAAA;AAAA;AAAA,EAGxB,UAAUA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EAC5B,UAAUA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOnB,YAAYA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMrB,kBAAkBA,GAAE,OAAO;AAAA;AAAA,EAE3B,iBAAiBA,GAAE,OAAO;AAAA,EAC1B,uBAAuBA,GAAE,QAAQ;AAAA,EACjC,wBAAwBA,GAAE,QAAQ;AACpC,CAAC;AAGM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,OAAO;AAAA;AAAA,EAEP,aAAa,8BAA8B,SAAS;AACtD,CAAC;AAIM,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQA,GAAE,OAAO;AAAA,EACjB,UAAUA,GAAE,QAAQ,eAAe;AAAA,EACnC,YAAYA,GAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtB,0BAA0BA,GAAE,OAAO,EAAE,QAAQ;AAAA,EAC7C,oBAAoBA,GAAE,QAAQ;AAAA,EAC9B,QAAQA,GAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,IAAI;AAAA,EACJ,MAAMA,GAAE,OAAO;AAAA,EACf,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,aAAaA,GAAE,MAAM,iBAAiB;AACxC,CAAC;AAGM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,SAASA,GAAE,QAAQ;AACrB,CAAC;AAgBM,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AACpC,CAAC;AAKM,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,IAAI;AAAA,EACJ,MAAMA,GAAE,OAAO;AAAA,EACf,iBAAiBA,GAAE,QAAQ;AAAA,EAC3B,uBAAuBA,GAAE,QAAQ;AACnC,CAAC;AAGM,IAAM,iCAAiCA,GAAE,OAAO;AAAA,EACrD,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,UAAUA,GAAE,OAAO;AAAA,EACnB,SAAS;AAAA,EACT,WAAWA,GAAE,OAAO;AACtB,CAAC;AAKM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AACpC,CAAC;AAGM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,QAAQA,GAAE,QAAQ;AACpB,CAAC;AAMM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,oBAAoBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAC/C,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA;AAAA,EAE9C,OAAOA,GAAE,OAAO;AAAA,EAChB,WAAWA,GAAE,OAAO;AAAA,EACpB,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC9C,CAAC;AAQM,IAAM,6BAA6BA,GAAE,OAAO;AAAA;AAAA,EAEjD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEvB,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACrC,IAAI,aAAa,QAAQ,OAAO;AAAA,EAChC,MAAM,eAAe,QAAQ,QAAQ;AAAA,EACrC,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEjD,UAAUA,GAAE,QAAQ,eAAe,EAAE,QAAQ,eAAe;AAAA,EAC5D,iBAAiBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAE1C,uBAAuBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAClD,CAAC;AAKM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,aAAa;AACf,CAAC;AAkBM,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,QAAQA,GAAE,OAAO;AAAA,EACjB,OAAOA,GAAE,OAAO;AAAA,EAChB,OAAOA,GAAE,OAAO;AAAA,EAChB,QAAQA,GAAE,OAAO;AAAA,EACjB,cAAcA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,eAAeA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC9B,eAAeA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC9B,gBAAgBA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvC,UAAUA,GAAE,OAAO;AAAA,EACnB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAOM,IAAM,eAAeA,GAAE,KAAK;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,cAAcA,GAAE,KAAK,CAAC,SAAS,YAAY,CAAC;AAWlD,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,WAAWA,GAAE,OAAO;AAAA,EACpB,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,MAAMA,GAAE,OAAO;AAAA,EACf,MAAM;AAAA,EACN,OAAO;AAAA,EACP,QAAQA,GAAE,QAAQ;AAAA,EAClB,gBAAgBA,GAAE,QAAQ;AAAA,EAC1B,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC7D,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC3D,iBAAiBA,GAAE,QAAQ;AAAA,EAC3B,IAAIA,GAAE,OAAO;AAAA,EACb,MAAMA,GAAE,OAAO;AAAA,EACf,YAAYA,GAAE,QAAQ;AAAA;AAAA;AAAA;AAAA,EAItB,0BAA0BA,GAAE,OAAO,EAAE,QAAQ;AAAA,EAC7C,oBAAoBA,GAAE,QAAQ;AAAA,EAC9B,oBAAoBA,GAAE,OAAO,EAAE,IAAI;AAAA,EACnC,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,SAAS,aAAa,SAAS;AACjC,CAAC;AAQM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,aAAaA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,UAAUA,GAAE,MAAM,WAAW;AAC/B,CAAC;AAUM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAC1B,CAAC;AAQM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,SAASA,GAAE,QAAQ;AAAA,EACnB,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,aAAaA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK5B,MAAMA,GACH,KAAK;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,SAAS;AACd,CAAC;AAOM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,SAASA,GAAE,MAAM,YAAY;AAC/B,CAAC;AASD,SAAS,0BAAkC,SAA+B;AACxE,SAAO,QAAQ;AACjB;AAEO,IAAM,2BAA2C;AAAA,EAA0B,MAChFA,GAAE,KAAK,CAAC,aAAa,eAAe,SAAS,CAAC;AAChD;AAGO,IAAM,yBAAyC;AAAA,EAA0B,MAC9EA,GAAE,OAAO;AAAA,IACP,UAAU;AAAA,IACV,UAAUA,GAAE,QAAQ;AAAA,EACtB,CAAC;AACH;AAGO,IAAM,sBAAsC;AAAA,EAA0B,MAC3EA,GAAE,OAAO;AAAA,IACP,WAAW,uBAAuB,OAAO;AAAA,MACvC,SAASA,GAAE,MAAM,eAAe;AAAA,MAChC,eAAe,gBAAgB,SAAS;AAAA,MACxC,UAAUA,GAAE,QAAQ;AAAA,IACtB,CAAC;AAAA,IACD,iBAAiB;AAAA,IACjB,kBAAkB;AAAA,IAClB,aAAaA,GAAE,OAAO;AAAA,MACpB,WAAW;AAAA,MACX,SAAS;AAAA,MACT,eAAe;AAAA,IACjB,CAAC;AAAA,IACD,iBAAiBA,GAAE,MAAMA,GAAE,KAAK,CAAC,QAAQ,SAAS,OAAO,CAAC,CAAC;AAAA,IAC3D,kBAAkBA,GAAE,MAAMA,GAAE,KAAK,CAAC,QAAQ,SAAS,OAAO,CAAC,CAAC;AAAA,IAC5D,YAAYA,GAAE,OAAO;AAAA,MACnB,KAAK;AAAA,MACL,oBAAoB;AAAA,MACpB,eAAe;AAAA,IACjB,CAAC;AAAA,IACD,cAAcA,GAAE;AAAA,MACdA,GAAE,OAAO;AAAA,QACP,IAAIA,GAAE,KAAK,CAAC,YAAY,YAAY,MAAM,CAAC;AAAA,QAC3C,UAAU;AAAA,QACV,UAAUA,GAAE,QAAQ;AAAA,QACpB,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,MAC7D,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAGO,IAAM,0BAA0C;AAAA,EAA0B,MAC/EA,GAAE,MAAM;AAAA,IACNA,GACG,OAAO,EAAE,MAAMA,GAAE,QAAQ,YAAY,GAAG,WAAWA,GAAE,KAAK,CAAC,WAAW,iBAAiB,CAAC,EAAE,CAAC,EAC3F,OAAO;AAAA,IACVA,GAAE,OAAO,EAAE,MAAMA,GAAE,QAAQ,wBAAwB,GAAG,UAAUA,GAAE,QAAQ,OAAO,EAAE,CAAC,EAAE,OAAO;AAAA,IAC7FA,GAAE,OAAO,EAAE,MAAMA,GAAE,QAAQ,sBAAsB,GAAG,WAAWA,GAAE,QAAQ,SAAS,EAAE,CAAC,EAAE,OAAO;AAAA,EAChG,CAAC;AACH;AAGO,IAAM,4BAA4C;AAAA,EAA0B,MACjFA,GACG,OAAO;AAAA,IACN,eAAeA,GAAE,KAAK,CAAC,cAAc,aAAa,wBAAwB,CAAC;AAAA,IAC3E,UAAUA,GAAE,KAAK,CAAC,oBAAoB,UAAU,CAAC;AAAA,EACnD,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,qCAAqC;AAE3C,IAAM,6BAA6C;AAAA,EAA0B,MAClFA,GAAE,KAAK,CAAC,YAAY,WAAW,cAAc,cAAc,CAAC;AAC9D;AAGO,IAAM,iCAAiD;AAAA,EAA0B,MACtFA,GAAE,KAAK,CAAC,YAAY,WAAW,cAAc,cAAc,CAAC;AAC9D;AAWO,IAAM,wBAAwC;AAAA,EAA0B,MAC7EA,GACG,OAAO;AAAA,IACN,eAAeA,GAAE,QAAQ,CAAC;AAAA,IAC1B,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAChC,kBAAkBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAC7C,aAAa;AAAA,IACb,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,IACjB,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC5B,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACjC,SAASA,GAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,IACrC,kBAAkB;AAAA,IAClB,SAAS;AAAA,IACT,mBAAmBA,GAAE,OAAO,EAAE,MAAM,wBAAwB;AAAA,EAC9D,CAAC,EACA,OAAO,EACP,YAAY,CAAC,QAAQ,YAAY;AAChC,QAAI,OAAO,gBAAgB,cAAc,OAAO,qBAAqB,MAAM;AACzE,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,kBAAkB;AAAA,QACzB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,OAAO,gBAAgB,cAAc,OAAO,qBAAqB,MAAM;AACzE,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,kBAAkB;AAAA,QACzB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACL;AAaO,SAAS,0BAA0B,UAA8C;AACtF,MAAI,aAAa,QAAQ,aAAa,QAAW;AAC/C,WAAO,EAAE,MAAM,SAAS;AAAA,EAC1B;AACA,MAAI,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,GAAG;AAC3D,UAAM,IAAI,MAAM,0EAA0E;AAAA,EAC5F;AACA,QAAM,SAAS;AACf,MAAI,CAAC,OAAO,UAAU,eAAe,KAAK,QAAQ,kCAAkC,GAAG;AACrF,WAAO,EAAE,MAAM,SAAS;AAAA,EAC1B;AACA,QAAM,SAAS,sBAAsB,UAAU,OAAO,kCAAkC,CAAC;AACzF,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,QAAQ;AAAA,MACZ,GAAG,IAAI;AAAA,QACL,OAAO,MAAM,OAAO;AAAA,UAAI,CAAC,UACvB,MAAM,KAAK,WAAW,IAAI,WAAW,UAAU,MAAM,KAAK,KAAK,GAAG,CAAC;AAAA,QACrE;AAAA,MACF;AAAA,IACF,EAAE,KAAK,IAAI;AACX,UAAM,IAAI,MAAM,+CAA+C,SAAS,QAAQ,EAAE;AAAA,EACpF;AACA,SAAO,EAAE,MAAM,SAAS,QAAQ,OAAO,KAAK;AAC9C;AAGO,SAAS,kCACd,UACA,QACyB;AACzB,SAAO;AAAA,IACL,GAAI,YAAY,CAAC;AAAA,IACjB,CAAC,kCAAkC,GAAG,sBAAsB,MAAM,MAAM;AAAA,EAC1E;AACF;AAOO,SAAS,iCACd,QACA,QACyB;AACzB,QAAM,SAAS,sBAAsB,MAAM,MAAM;AACjD,SAAO;AAAA,IACL;AAAA,IACA,kBAAkB,OAAO;AAAA,IACzB,kBAAkB,OAAO;AAAA,IACzB,aAAa,OAAO;AAAA,IACpB,0BAA0B,OAAO;AAAA,IACjC,iBAAiB,OAAO;AAAA,IACxB,YAAY,OAAO;AAAA,IACnB,sBAAsB,OAAO,iBAAiB;AAAA,IAC9C,2BACE,OAAO,iBAAiB,SAAS,2BAC7B,OAAO,iBAAiB,WACxB,OAAO,iBAAiB;AAAA,IAC9B,cAAc,OAAO,QAAQ;AAAA,IAC7B,iBAAiB,OAAO,QAAQ;AAAA,IAChC,mBAAmB,OAAO;AAAA,EAC5B;AACF;AAEO,IAAM,iBAAiC;AAAA,EAA0B,MACtEA,GAAE,OAAO;AAAA,IACP,6BAA6BA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IAC1D,mCAAmCA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,IAC3E,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IAC3D,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO,EAAE,SAAS;AAAA,EAC3D,CAAC;AACH;AAGO,IAAM,yBAAyC;AAAA,EAA0B,MAC9EA,GAAE,OAAO;AAAA,IACP,SAAS;AAAA,IACT,iBAAiBA,GACd;AAAA,MACCA,GAAE,OAAO;AAAA,QACP,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,QACjD,SAAS;AAAA,MACX,CAAC;AAAA,IACH,EACC,SAAS;AAAA,EACd,CAAC;AACH;AAUO,IAAM,cAA8B;AAAA,EAA0B,MACnEA,GAAE,OAAO;AAAA,IACP,IAAIA,GAAE,OAAO;AAAA,IACb,OAAOA,GAAE,OAAO;AAAA,IAChB,UAAUA,GAAE,OAAO;AAAA;AAAA,IACnB,eAAeA,GAAE,OAAO;AAAA,IACxB,KAAKA,GAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,IACjC,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,IAG1D,eAAeA,GAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,IACrC,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IACtC,YAAYA,GACT,OAAO;AAAA,MACN,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACjC,SAASA,GAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,IACvC,CAAC,EACA,SAAS;AAAA,IACZ,iBAAiBA,GACd,OAAO;AAAA,MACN,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,MAC1D,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,MACnE,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,MAC5D,4BAA4BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IACnE,CAAC,EACA,SAAS;AAAA,IACZ,kBAAkB,wBAAwB,SAAS;AAAA,IACnD,SAAS,0BAA0B,SAAS;AAAA,IAC5C,cAAc,oBAAoB,SAAS;AAAA,IAC3C,SAAS,uBAAuB,SAAS;AAAA,IACzC,mBAAmBA,GAChB,OAAO,EACP,MAAM,wBAAwB,EAC9B,SAAS;AAAA,EACd,CAAC;AACH;AAGO,IAAM,6BAA6C;AAAA,EAA0B,MAClFA,GACG,OAAO;AAAA,IACN,QAAQA,GAAE,KAAK,CAAC,SAAS,aAAa,OAAO,CAAC;AAAA,IAC9C,QAAQA,GACL,KAAK;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,EACA,SAAS;AAAA,IACZ,OAAOA,GAAE,KAAK,CAAC,iBAAiB,cAAc,UAAU,CAAC;AAAA,IACzD,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,CAAC,EACA,OAAO,EACP,YAAY,CAAC,WAAW,YAAY;AACnC,QAAK,UAAU,WAAW,aAAc,UAAU,WAAW,OAAO;AAClE,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,QAAQ;AAAA,QACf,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAK,UAAU,WAAW,aAAc,UAAU,WAAW,mBAAmB;AAC9E,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,QAAQ;AAAA,QACf,SACE;AAAA,MACJ,CAAC;AAAA,IACH;AACA,QACE,UAAU,UAAU,cACpB,UAAU,WAAW,WACrB,UAAU,cAAc,MACxB;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,WAAW;AAAA,QAClB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,UAAU,WAAW,uBAAuB,UAAU,cAAc,MAAM;AAC5E,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,WAAW;AAAA,QAClB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACL;AAGO,IAAM,sBAAsC;AAAA,EAA0B,MAC3EA,GAAE,OAAO;AAAA,IACP,QAAQA,GAAE,KAAK,CAAC,aAAa,eAAe,YAAY,SAAS,CAAC;AAAA,IAClE,YAAYA,GAAE,QAAQ;AAAA,IACtB,QAAQA,GACL,KAAK;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,EACA,SAAS;AAAA,IACZ,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,CAAC;AACH;AAGO,IAAM,6BAA6C;AAAA,EAA0B,MAClF,YAAY,OAAO;AAAA,IACjB,qBAAqB;AAAA,IACrB,cAAc;AAAA,EAChB,CAAC;AACH;AAGO,IAAM,gCAAgD;AAAA,EAA0B,MACrFA,GAAE,OAAO;AAAA,IACP,QAAQA,GAAE,MAAM,0BAA0B;AAAA,EAC5C,CAAC;AACH;AAWO,IAAM,iCAAiC;AACvC,IAAM,+BAA+B;AAErC,IAAM,8BAA8B;AAEpC,IAAM,eAA+B;AAAA,EAA0B,MACpEA,GAAE,OAAO;AAAA,IACP,oBAAoBA,GAAE,OAAO;AAAA,IAC7B,qBAAqBA,GAAE,QAAQ,8BAA8B;AAAA;AAAA;AAAA;AAAA,IAI7D,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,IACnC,cAAcA,GAAE,OAAO;AAAA,IACvB,eAAeA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,IAGxC,QAAQA,GAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA,IACvC,wBAAwB;AAAA,IACxB,yBAAyBA,GAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AAAA,IACvD,YAAYA,GACT;AAAA,MACCA,GAAE,OAAO;AAAA,QACP,IAAIA,GAAE,OAAO;AAAA,QACb,MAAMA,GAAE,OAAO;AAAA,MACjB,CAAC;AAAA,IACH,EACC,QAAQ,CAAC,CAAC;AAAA,IACb,aAAaA,GAAE,OAAO;AAAA,MACpB,SAASA,GAAE,QAAQ;AAAA,MACnB,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC1C,CAAC;AAAA,IACD,mBAAmB;AAAA,IACnB,MAAM,iBAAiB,QAAQ,EAAE,MAAM,OAAO,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,IAK/C,oBAAoBA,GACjB,OAAO;AAAA,MACN,YAAYA,GAAE,QAAQ;AAAA,MACtB,KAAKA,GAAE,QAAQ;AAAA,MACf,gBAAgBA,GAAE,QAAQ;AAAA,IAC5B,CAAC,EACA,QAAQ,EAAE,YAAY,OAAO,KAAK,OAAO,gBAAgB,MAAM,CAAC;AAAA,EACrE,CAAC;AACH;AAGA,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,WAAW;AACxD;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM;AACxD;AAEA,eAAe,oBAAoB,QAAgB,OAAgC;AACjF,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,IAC/B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACvF,SAAO,OAAO,KAAK,SAAS,EAAE,SAAS,WAAW;AACpD;AAEA,SAAS,kBAAkB,QAAgB,UAA2B;AACpE,QAAM,cAAc,IAAI,YAAY,EAAE,OAAO,MAAM;AACnD,QAAM,gBAAgB,IAAI,YAAY,EAAE,OAAO,QAAQ;AACvD,MAAI,YAAY,WAAW,cAAc,QAAQ;AAC/C,WAAO;AAAA,EACT;AACA,MAAI,OAAO;AACX,WAAS,QAAQ,GAAG,QAAQ,YAAY,QAAQ,SAAS,GAAG;AAC1D,YAAQ,YAAY,KAAK,IAAK,cAAc,KAAK;AAAA,EACnD;AACA,SAAO,SAAS;AAClB;AA4BO,SAAS,6BACd,QACA,WAC6B;AAC7B,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,MAAI,OAAO,qBAAqB,QAAQ,CAAC,OAAO,iBAAiB,SAAS,UAAU,UAAU,GAAG;AAC/F,WAAO,EAAE,SAAS,OAAO,QAAQ,WAAW;AAAA,EAC9C;AACA,MAAI,OAAO,kBAAkB,QAAQ,CAAC,OAAO,cAAc,SAAS,UAAU,OAAO,GAAG;AACtF,WAAO,EAAE,SAAS,OAAO,QAAQ,QAAQ;AAAA,EAC3C;AACA,SAAO,EAAE,SAAS,KAAK;AACzB;","names":["z","encoder","omitted","marker","contentBudget","left","right","toJson","bytes","z","z","registryId","sortJson","encoder","deliveredBytes","fingerprint","utf8Bytes"]}
+{"version":3,"sources":["../src/index.ts","../src/retained-output.ts","../src/event-preview.ts","../src/codex-fleet-policy.ts","../src/secret-redaction.ts","../src/workspace-instruction-policies.ts"],"sourcesContent":["import { z } from \"zod\";\nimport {\n  boundSessionEventPayload,\n  measureSessionEventJson,\n  sessionEventJsonBytes,\n  type SessionEventBoundarySurface,\n} from \"./event-preview\";\n\nexport {\n  SESSION_EVENT_PAYLOAD_MAX_BYTES,\n  approximateSessionEventTokens,\n  boundSessionEventPayload,\n  measureSessionEventJson,\n  sessionEventJsonBytes,\n  sessionEventMediaPreview,\n  sessionEventMediaPreviewFromDataUrl,\n  sessionEventPayloadTruncation,\n  type BoundSessionEventPayloadOptions,\n  type SessionEventBoundarySurface,\n  type SessionEventMediaPreview,\n  type SessionEventJsonMeasurement,\n  type SessionEventPayloadTruncation,\n} from \"./event-preview\";\n\nexport {\n  RETAINED_OUTPUT_DEFAULT_PAGE_BYTES,\n  RETAINED_OUTPUT_MAX_PAGE_BYTES,\n  RETAINED_OUTPUT_RECEIPT_MAX_BYTES,\n  RetainedArtifactMetadataSchema,\n  RetainedArtifactReferenceSchema,\n  RetainedArtifactUnavailableSchema,\n  RetainedOutputEvidenceSchema,\n  RetainedOutputKind,\n  RetainedOutputUnavailableReason,\n  retainedArtifactReferenceFromFile,\n  retainedOutputUnavailable,\n  resolveRetainedOutputRange,\n  validateRetainedOutputEvidence,\n  type RetainedArtifactFileInput,\n  type RetainedArtifactMetadata,\n  type RetainedArtifactReference,\n  type RetainedArtifactUnavailable,\n  type RetainedOutputAvailableEvidence,\n  type RetainedOutputEvidence,\n  type RetainedOutputRangeResolution,\n  type RetainedOutputResolvedRange,\n} from \"./retained-output\";\n\nexport const SessionStatus = z.enum([\n  \"queued\",\n  \"running\",\n  \"idle\",\n  \"requires_action\",\n  \"recovering\",\n  \"waiting_capacity\",\n  \"failed\",\n  \"cancelled\",\n]);\nexport type SessionStatus = z.infer<typeof SessionStatus>;\n\n// 11 backends; 3-way enum parity (contracts / sdk / deployment) is pinned by\n// `packages/sdk/test/contract-parity.test.ts`. Every member is ADDITIVE AT THE\n// END (the parity test pins positions): the original four, then the six cloud\n// backends, then `selfhosted` (bring-your-own-compute — a user's own machine\n// enrolled as a first-class sandbox).\nexport const SandboxBackend = z.enum([\n  \"docker\",\n  \"modal\",\n  \"local\",\n  \"none\",\n  \"daytona\",\n  \"runloop\",\n  \"e2b\",\n  \"blaxel\",\n  \"cloudflare\",\n  \"vercel\",\n  \"selfhosted\",\n]);\nexport type SandboxBackend = z.infer<typeof SandboxBackend>;\n\n// OS axis. Only \"linux\" is reachable in v1; macos/windows are seam placeholders.\nexport const SandboxOs = z.enum([\"linux\", \"macos\", \"windows\"]);\nexport type SandboxOs = z.infer<typeof SandboxOs>;\n\n// The five surfaceable sandbox capabilities (PascalCase, the canonical names).\nexport const SandboxCapabilityName = z.enum([\n  \"FileSystem\", // Channel A: list/read/write/search (Pierre tree)\n  \"Terminal\", // Channel A: command-output firehose (+ future pty-ws)\n  \"Git\", // Channel A: status/diff/log/show (Pierre diff)\n  \"DesktopStream\", // Channel B: noVNC pixels over a scoped tunnel URL\n  \"Recording\", // ffmpeg x11grab -> object storage\n]);\nexport type SandboxCapabilityName = z.infer<typeof SandboxCapabilityName>;\n\n// How a backend exposes a network port to the data plane.\nexport type PortExposureKind = \"provider-tunnel\" | \"preview-url\" | \"local-port\" | \"none\";\n\n// Static per-backend metadata — pure data, no runtime state. This table lives\n// in CONTRACTS (not runtime) so config can read it without an import cycle\n// through runtime (ledger CR8). Everything downstream (config boot-validation,\n// OS image selection, capability negotiation, env/mount branch) reads this\n// data, never a hard-coded backend name.\nexport type CapabilityDescriptor = {\n  backend: SandboxBackend;\n  backendId: string; // asserted === SDK client.backendId at registry build (deferred to P0.3)\n  tier: \"desktop\" | \"headless\" | \"dev\" | \"none\";\n  os: { supported: SandboxOs[]; default: SandboxOs };\n  capabilities: {\n    FileSystem: { available: boolean; readOnly: boolean };\n    Terminal: {\n      available: boolean;\n      transport: \"sse-events\" | \"pty-ws\" | null;\n      pty: boolean;\n    };\n    Git: { available: boolean };\n    DesktopStream: {\n      available: boolean;\n      transport: \"vnc-ws\" | \"rdp-ws\" | \"webrtc\" | null;\n    };\n    // Feasibility only (== DesktopStream.available && os==linux); NOT a request.\n    Recording: { available: boolean };\n  };\n  lifetime: {\n    hardLifetimeMs?: number; // modal 24h, vercel 5h\n    requiresSnapshotRollover: boolean;\n    hasIdleKiller: boolean;\n    supportsSuspendResume: boolean; // runloop/e2b/vercel/modal true\n    resumeIsLockFree: boolean; // modal true (fromId, no lock)\n    idleKillDisableHint?: string;\n  };\n  snapshot: {\n    kind: \"native-fs\" | \"native-dir\" | \"native-snapshot-id\" | \"tar-only\" | \"none\";\n    hasTarFallback: boolean;\n  };\n  portExposure: { kind: PortExposureKind; supportsOnDemandPorts: boolean }; // runloop=false; blaxel only true\n  workspaceRoot: string; // os-overridable; per-backend default (providers owns; os defers)\n  nativeBucketMount: boolean; // modal true -> mount/signed-download branch\n  persistable: boolean;\n  supportsRunAs: boolean;\n};\n\n// The websockify/noVNC desktop port that is merged into `exposedPorts` for\n// every desktop-capable (backend, os). Asserted present by boot-validation.\nexport const DESKTOP_STREAM_PORT = 6080;\n\n// The ttyd PTY-over-websocket port that is exposed over the SAME Modal raw-TLS\n// tunnel as the desktop, for the REAL interactive terminal (Channel-B-symmetric).\n// ttyd's default; the box bakes ttyd and launches it on this port. The pty-ws\n// Terminal cell's `url` is the tunnel address resolved against this port.\nexport const TERMINAL_STREAM_PORT = 7681;\n\n// The provider capability matrix (sandbox contract PART D + module 03-providers). One row per\n// backend (10 rows). v1 reachable cells are all Linux; macos/windows are seam\n// placeholders (no enum members shipped). Reading rule: a capability cell is\n// `available:false` + a reason in the negotiated doc, never absent.\nexport const CAPABILITY_DESCRIPTORS: Record<SandboxBackend, CapabilityDescriptor> = {\n  modal: {\n    backend: \"modal\",\n    backendId: \"modal\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      hardLifetimeMs: 24 * 60 * 60 * 1000,\n      requiresSnapshotRollover: true,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: true,\n    },\n    snapshot: { kind: \"native-fs\", hasTarFallback: true },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: false }, // pre-declare 6080\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: true,\n    persistable: true,\n    supportsRunAs: true,\n  },\n  daytona: {\n    backend: \"daytona\",\n    backendId: \"daytona\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"native-snapshot-id\", hasTarFallback: true },\n    portExposure: { kind: \"preview-url\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: true,\n  },\n  runloop: {\n    backend: \"runloop\",\n    backendId: \"runloop\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: false },\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"native-snapshot-id\", hasTarFallback: true },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: false }, // CR9: pre-declare 6080\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: false,\n  },\n  e2b: {\n    backend: \"e2b\",\n    backendId: \"e2b\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: false }, // pty-until-proven=no\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"native-snapshot-id\", hasTarFallback: true },\n    portExposure: { kind: \"preview-url\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/home/user\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: false,\n  },\n  blaxel: {\n    backend: \"blaxel\",\n    backendId: \"blaxel\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: false }, // pty-until-proven=no\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: false,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"tar-only\", hasTarFallback: true },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: true }, // only on-demand backend\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: false,\n  },\n  cloudflare: {\n    backend: \"cloudflare\",\n    backendId: \"cloudflare\",\n    tier: \"headless\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: false, transport: null },\n      Recording: { available: false },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: false,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"tar-only\", hasTarFallback: true },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: true,\n  },\n  vercel: {\n    backend: \"vercel\",\n    backendId: \"vercel\",\n    tier: \"headless\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: false },\n      Git: { available: true },\n      DesktopStream: { available: false, transport: null },\n      Recording: { available: false },\n    },\n    lifetime: {\n      hardLifetimeMs: 5 * 60 * 60 * 1000,\n      requiresSnapshotRollover: true,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"tar-only\", hasTarFallback: true },\n    portExposure: { kind: \"preview-url\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/vercel/sandbox\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: false,\n  },\n  docker: {\n    backend: \"docker\",\n    backendId: \"docker\",\n    tier: \"dev\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: false, transport: null }, // local\n      Recording: { available: false },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: false,\n      supportsSuspendResume: false,\n      resumeIsLockFree: true,\n    },\n    snapshot: { kind: \"native-dir\", hasTarFallback: true },\n    portExposure: { kind: \"local-port\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: true,\n  },\n  local: {\n    backend: \"local\",\n    // The SDK's UnixLocalSandboxClient reports backendId \"unix_local\" — this MUST\n    // match it (it is the resume-fence field compared against client.backendId).\n    backendId: \"unix_local\",\n    tier: \"dev\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: false, transport: null },\n      Recording: { available: false },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: false,\n      supportsSuspendResume: false,\n      resumeIsLockFree: true,\n    },\n    snapshot: { kind: \"native-dir\", hasTarFallback: true },\n    portExposure: { kind: \"local-port\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: false,\n    supportsRunAs: false,\n  },\n  none: {\n    backend: \"none\",\n    backendId: \"none\",\n    tier: \"none\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: false, readOnly: true },\n      Terminal: { available: false, transport: null, pty: false },\n      Git: { available: false },\n      DesktopStream: { available: false, transport: null },\n      Recording: { available: false },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: false,\n      supportsSuspendResume: false,\n      resumeIsLockFree: true,\n    },\n    snapshot: { kind: \"none\", hasTarFallback: false },\n    portExposure: { kind: \"none\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: false,\n    supportsRunAs: false,\n  },\n  // Bring-your-own-compute: the user's OWN machine, enrolled via a Rust agent,\n  // becomes ONE shared whole-machine sandbox (the agent IS the box). It is the\n  // first backend to make macOS/Windows reachable (default linux). Desktop is\n  // capability-PROCLAIMED (\"vnc-ws\") — the agent serves a native display stack\n  // (Linux X11/Xvfb, macOS CGEvent/ScreenCaptureKit) consent-gated at enroll;\n  // the online/offline/consent/display negotiation lives in select.ts (M3), this\n  // row is the static feasibility ceiling. Always-on (process-lifetime, never\n  // idle-reaped) and NOT persistable — OpenGeni cannot snapshot the user's disk,\n  // so resume = \"is the agent's subject live?\", never a cold re-create. Ports\n  // surface on-demand through the stateless relay edge, which lands behind the\n  // `resolveExposedPort` swap-seam later; until then it reuses the existing\n  // `provider-tunnel` exposure kind (the relay IS the provider tunnel for the\n  // agent) so no new PortExposureKind literal — and no new switch arms — are\n  // introduced. supportsOnDemandPorts:true: the agent opens a stream channel for\n  // a port on request rather than pre-declaring 6080/7681 at construction.\n  selfhosted: {\n    backend: \"selfhosted\",\n    backendId: \"selfhosted\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\", \"macos\", \"windows\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"pty-ws\", pty: true }, // real PTY over the relay\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" }, // proclaimed; consent-gated at enroll\n      Recording: { available: true }, // boot invariant: == DesktopStream.available\n    },\n    lifetime: {\n      // Whole-machine, always-there: online while the agent process runs, offline\n      // when it stops. The lease is NEVER idle-killed (it's the user's machine,\n      // not a reapable cloud box) and there is nothing to suspend/resume — the\n      // machine simply is or isn't reachable.\n      requiresSnapshotRollover: false,\n      hasIdleKiller: false,\n      supportsSuspendResume: false,\n      resumeIsLockFree: true, // resume = address the live NATS subject; no provider lock\n    },\n    // persistable:false forces snapshot.kind:\"none\" (the descriptor invariant\n    // `persistable ⇒ snapshot.kind!==\"none\"`): OpenGeni cannot snapshot the\n    // user's disk — the machine itself is the persistence.\n    snapshot: { kind: \"none\", hasTarFallback: false },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: true },\n    workspaceRoot: \"/\", // agent-reported machine root (the whole machine is the sandbox)\n    nativeBucketMount: false,\n    persistable: false,\n    supportsRunAs: false,\n  },\n};\n\nexport const ReasoningEffort = z.enum([\"none\", \"minimal\", \"low\", \"medium\", \"high\", \"xhigh\"]);\nexport type ReasoningEffort = z.infer<typeof ReasoningEffort>;\n\nexport const ErrorCode = z.enum([\n  \"unauthenticated\",\n  \"forbidden\",\n  \"not_found\",\n  \"validation_failed\",\n  \"conflict\",\n  \"idempotency_conflict\",\n  \"limit_exceeded\",\n  \"nested_agent_depth_exceeded\",\n  \"nested_agent_depth_override_forbidden\",\n  \"provider_verification_failed\",\n  \"upstream_unavailable\",\n  \"internal_error\",\n]);\nexport type ErrorCode = z.infer<typeof ErrorCode>;\n\nexport const ErrorEnvelope = z.object({\n  error: z.object({\n    status: z.number().int().min(400).max(599),\n    code: ErrorCode,\n    message: z.string(),\n    retryable: z.boolean(),\n    requestId: z.string().optional(),\n    details: z.record(z.string(), z.unknown()).optional(),\n  }),\n});\nexport type ErrorEnvelope = z.infer<typeof ErrorEnvelope>;\n\n/** Physical ceiling of the PostgreSQL integer columns that persist depth policy. */\nexport const MAX_NESTED_AGENT_DEPTH = 2_147_483_647;\nexport const NestedAgentDepthValue = z.number().int().nonnegative().max(MAX_NESTED_AGENT_DEPTH);\nexport type NestedAgentDepthValue = z.infer<typeof NestedAgentDepthValue>;\n/** A denied child can be one greater than the persisted PostgreSQL int ceiling. */\nexport const NestedAgentDepthAttemptValue = z\n  .number()\n  .int()\n  .nonnegative()\n  .max(MAX_NESTED_AGENT_DEPTH + 1);\n\nexport const NestedAgentDepthPolicySource = z.enum([\n  \"session\",\n  \"workspace\",\n  \"deployment\",\n  \"default\",\n]);\nexport type NestedAgentDepthPolicySource = z.infer<typeof NestedAgentDepthPolicySource>;\n\n/** Durable evidence for a session-create denial at the database admission boundary. */\nexport const SessionSpawnDenial = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  parentSessionId: z.string().uuid().nullable(),\n  rootSessionId: z.string().uuid().nullable(),\n  currentDepth: NestedAgentDepthValue,\n  attemptedDepth: NestedAgentDepthAttemptValue,\n  effectiveMaxNestedAgentDepth: NestedAgentDepthValue,\n  requestedMaxNestedAgentDepthOverride: NestedAgentDepthValue.nullable(),\n  policySource: NestedAgentDepthPolicySource,\n  policySessionId: z.string().uuid().nullable(),\n  subjectId: z.string().nullable(),\n  code: z.enum([\"nested_agent_depth_exceeded\", \"nested_agent_depth_override_forbidden\"]),\n  idempotencyKey: z.string().nullable(),\n  createdAt: z.string(),\n});\nexport type SessionSpawnDenial = z.infer<typeof SessionSpawnDenial>;\n\nexport const Permission = z.enum([\n  \"account:read\",\n  \"account:admin\",\n  \"members:manage\",\n  \"workspace:create\",\n  \"billing:read\",\n  \"billing:manage\",\n  \"workspace:read\",\n  \"workspace:admin\",\n  \"sessions:create\",\n  \"sessions:read\",\n  \"sessions:control\",\n  // sandbox workspace (sandbox contract §C.3 / crosscut PART 1.2). stream:view is a\n  // REAL, distinct permission — strictly BROADER than sessions:read — because the\n  // pixel plane (Channel B) is UN-REDACTED: a viewer of raw pixels can see cloud\n  // creds the agent cat's into a terminal, which the redacted Channel-A event log\n  // never exposes. sessions:read is NOT permission to watch raw pixels.\n  \"stream:view\",\n  // SEPARATE from stream:view: raw input to the desktop (bypasses approvalQueue /\n  // interrupt). NEVER granted by default in v1 (the input plane is OFF —\n  // streamControlEnabled=false); the permission exists so later hardening is a\n  // flag flip, not a redesign.\n  \"stream:control\",\n  // Accept the pixel-plane secret-leak acknowledgment (consent gate before the\n  // un-redacted desktop URL is handed out).\n  \"stream:acknowledge\",\n  \"files:upload\",\n  \"files:read\",\n  // Channel-A structured write surface (FS writes / apply-patch); distinct from\n  // files:read so a read-only viewer can't mutate the box filesystem.\n  \"files:write\",\n  // Attach to an interactive PTY (terminal-as-pty, Channel A); distinct from\n  // sessions:read which only reads the command-output firehose.\n  \"terminal:attach\",\n  \"documents:manage\",\n  \"documents:search\",\n  \"scheduled_tasks:manage\",\n  \"scheduled_tasks:run\",\n  \"github:manage\",\n  \"github:use\",\n  \"api_keys:manage\",\n  \"connections:read\",\n  \"connections:write\",\n  /** @deprecated alias of variable-sets:manage */\n  \"environments:manage\",\n  /** @deprecated alias of variable-sets:use */\n  \"environments:use\",\n  \"variable-sets:manage\",\n  \"variable-sets:use\",\n  // Attach or rotate per-session third-party MCP server credentials. Deliberately\n  // not part of the worker's default first-party MCP permission set: a sandboxed\n  // agent must not be able to hand itself new bearer credentials.\n  \"mcp_servers:attach\",\n  // Programmatic sandbox -> tool access through the first-party MCP gate. This is\n  // intentionally narrow and is never part of first-party MCP defaults; callers\n  // must receive it through an explicit delegated `ogd_` mint carrying sessionId.\n  \"toolspace:call\",\n  \"goals:manage\",\n  // Bring-your-own-compute (M5). enrollments:read lists a workspace's machines;\n  // enrollments:manage approves a device-flow enrollment (the LOUD whole-machine\n  // consent) + revokes a machine. Distinct from sessions/stream perms because an\n  // enrollment grants WHOLE-MACHINE access to a user's own hardware — a high-trust,\n  // admin-shaped action. workspace:admin is the super-wildcard over both.\n  \"enrollments:read\",\n  \"enrollments:manage\",\n  // Rigs (workspace-scoped, versioned sandbox machine definitions). rigs:use is\n  // read + propose-change (the agent-native, additive path a sandboxed session\n  // is trusted with); rigs:manage is create/edit/activate/promote/delete (the\n  // admin-shaped path that mints or rolls versions). workspace:admin is the\n  // super-wildcard over both.\n  \"rigs:use\",\n  \"rigs:manage\",\n]);\nexport type Permission = z.infer<typeof Permission>;\n\n/**\n * Capability-first permissions signed into a session's first-party OpenGeni\n * MCP token when a top-level creator does not explicitly narrow them.\n *\n * Keep this contract shared by admission and runtime signing: a worker-signed\n * child whose parent was narrowed must inherit the parent's effective subset,\n * never fall back to a different runtime-local default.\n */\nexport const DEFAULT_FIRST_PARTY_MCP_PERMISSIONS = [\n  \"workspace:read\",\n  \"files:read\",\n  \"documents:search\",\n  \"scheduled_tasks:manage\",\n  \"scheduled_tasks:run\",\n  \"goals:manage\",\n  \"sessions:read\",\n  \"sessions:create\",\n  \"sessions:control\",\n  \"variable-sets:use\",\n  \"variable-sets:manage\",\n  \"rigs:use\",\n  \"github:use\",\n] as const satisfies readonly Permission[];\n\n/**\n * Exact public catalog for tools served by the broad first-party `opengeni`\n * MCP server. Adding a registration does not make it model-visible: the name\n * must be admitted here and selected by the session policy.\n *\n * `files_get_download_url` intentionally is not in this catalog. It belongs to\n * the dedicated `files` MCP server.\n */\nexport const FIRST_PARTY_MCP_TOOL_NAMES = [\n  \"set_session_title\",\n  \"goal_set\",\n  \"goal_update\",\n  \"goal_complete\",\n  \"goal_pause\",\n  \"memory_search\",\n  \"memory_save\",\n  \"memory_correct\",\n  \"sandboxes_list\",\n  \"sandbox_attach\",\n  \"sandbox_swap\",\n  \"run_on\",\n  \"sandbox_provision\",\n  \"rig_list\",\n  \"rig_get\",\n  \"rig_propose_change\",\n  \"rig_verify\",\n  \"rig_promote\",\n  \"sessions_list\",\n  \"session_get\",\n  \"session_events\",\n  \"session_create\",\n  \"session_send_message\",\n  \"session_pause\",\n  \"session_resume\",\n  \"session_steer\",\n  \"set_other_session_title\",\n  \"variable_set_list\",\n  \"environment_list\",\n  \"variable_set_set_variable\",\n  \"environment_set_variable\",\n  \"github_connect_link\",\n  \"github_token\",\n  \"github_repositories_list\",\n  \"social_connections_list\",\n  \"social_posts_recent\",\n  \"social_daily_analysis_context\",\n  \"scheduled_tasks_list\",\n  \"scheduled_tasks_get\",\n  \"scheduled_tasks_create\",\n  \"scheduled_tasks_update\",\n  \"scheduled_tasks_pause\",\n  \"scheduled_tasks_resume\",\n  \"scheduled_tasks_trigger\",\n  \"scheduled_tasks_delete\",\n  \"scheduled_task_runs_list\",\n  \"slack_bot_list_channels\",\n  \"slack_bot_channel_history\",\n  \"slack_bot_list_users\",\n  \"slack_bot_post_message\",\n] as const;\nexport const FirstPartyMcpToolName = z.enum(FIRST_PARTY_MCP_TOOL_NAMES);\nexport type FirstPartyMcpToolName = z.infer<typeof FirstPartyMcpToolName>;\n\n/**\n * Ordinary sessions get only the small self-management surface. Authorization\n * permissions remain an independent, additional boundary.\n */\nexport const DEFAULT_FIRST_PARTY_MCP_TOOLS = [\n  \"set_session_title\",\n  \"goal_set\",\n  \"goal_update\",\n  \"goal_complete\",\n  \"goal_pause\",\n] as const satisfies readonly FirstPartyMcpToolName[];\n\nexport function prefixedMcpToolName(registryId: string, toolName: string): string {\n  return `${registryId}__${toolName}`;\n}\n\nexport const ProductAccessMode = z.enum([\"local\", \"configured\", \"managed\"]);\nexport type ProductAccessMode = z.infer<typeof ProductAccessMode>;\n\nexport const BillingMode = z.enum([\"disabled\", \"stripe\"]);\nexport type BillingMode = z.infer<typeof BillingMode>;\n\nexport const EntitlementsMode = z.enum([\"none\", \"static\", \"managed\"]);\nexport type EntitlementsMode = z.infer<typeof EntitlementsMode>;\n\nexport const UsageLimitsMode = z.enum([\"none\", \"static\", \"managed\"]);\nexport type UsageLimitsMode = z.infer<typeof UsageLimitsMode>;\n\nexport const AccountRole = z.enum([\"owner\", \"admin\", \"member\"]);\nexport type AccountRole = z.infer<typeof AccountRole>;\n\nexport const ManagedAccount = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  externalSource: z.string().nullable(),\n  externalId: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ManagedAccount = z.infer<typeof ManagedAccount>;\n\nexport const Workspace = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  name: z.string(),\n  slug: z.string().nullable(),\n  externalSource: z.string().nullable(),\n  externalId: z.string().nullable(),\n  // Per-workspace agent persona template (white-label override). null means\n  // the deployment default (OPENGENI_AGENT_INSTRUCTIONS_TEMPLATE /\n  // DEFAULT_AGENT_INSTRUCTIONS) is used. The runtime always injects the\n  // non-bypassable CORE (goal-loop ownership + variableSet block), so an\n  // override restyles the persona without dropping that contract.\n  agentInstructions: z.string().nullable(),\n  // Growth-ready per-workspace settings bag (migration 0045). Known keys are\n  // validated by WorkspaceSettingsSchema; unknown keys are preserved across\n  // PATCH merges so newer settings survive an older server.\n  settings: z.record(z.string(), z.unknown()),\n  inferenceControl: z.object({\n    state: z.enum([\"active\", \"paused\"]),\n    revision: z.number().int().nonnegative(),\n    reason: z.string().nullable(),\n    changedBy: z.string().nullable(),\n    changedAt: z.string().nullable(),\n  }),\n  // Workspace default rig used by session/scheduled-task create fallback.\n  defaultRigId: z.string().uuid().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type Workspace = z.infer<typeof Workspace>;\n\nexport const WorkspaceTranscriptionTarget = z\n  .object({\n    provider: z.string().trim().min(1).max(128),\n    model: z.string().trim().min(1).max(256).nullable(),\n    credentialMode: z.enum([\"managed\", \"byok\"]),\n    // A workspace-scoped connection reference, never credential material.\n    credentialConnectionId: z.string().uuid().nullable(),\n    region: z.string().trim().min(1).max(128).nullable(),\n  })\n  .strict()\n  .superRefine((target, context) => {\n    if (target.provider === \"azure-speech\" && target.credentialMode !== \"byok\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"credentialMode\"],\n        message: \"Azure Speech is supported only through workspace BYOK\",\n      });\n    }\n    if (target.credentialMode === \"byok\" && target.credentialConnectionId === null) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"credentialConnectionId\"],\n        message: \"BYOK transcription targets require a workspace connection reference\",\n      });\n    }\n    if (target.credentialMode === \"managed\" && target.credentialConnectionId !== null) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"credentialConnectionId\"],\n        message: \"managed transcription targets cannot name a BYOK connection\",\n      });\n    }\n  });\nexport type WorkspaceTranscriptionTarget = z.infer<typeof WorkspaceTranscriptionTarget>;\n\nexport const TranscriptionErrorCode = z.enum([\n  \"permission_denied\",\n  \"not_supported\",\n  \"network\",\n  \"provider\",\n  \"policy_blocked\",\n  \"timeout\",\n  \"cancelled\",\n  \"unknown\",\n]);\nexport type TranscriptionErrorCode = z.infer<typeof TranscriptionErrorCode>;\n\nexport const TranscriptionTimeSpan = z\n  .object({\n    startMilliseconds: z.number().finite().nonnegative(),\n    endMilliseconds: z.number().finite().nonnegative(),\n  })\n  .strict()\n  .superRefine((span, context) => {\n    if (span.endMilliseconds < span.startMilliseconds) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"endMilliseconds\"],\n        message: \"transcription spans must not end before they start\",\n      });\n    }\n  });\nexport type TranscriptionTimeSpan = z.infer<typeof TranscriptionTimeSpan>;\n\nexport const TranscriptionSpeaker = z\n  .object({\n    id: z.string().trim().min(1).max(128),\n    label: z.string().trim().min(1).max(128).optional(),\n  })\n  .strict();\nexport type TranscriptionSpeaker = z.infer<typeof TranscriptionSpeaker>;\n\nexport const TranscriptionWord = z\n  .object({\n    text: z.string().min(1).max(4096),\n    span: TranscriptionTimeSpan,\n    confidence: z.number().finite().min(0).max(1).optional(),\n    speaker: TranscriptionSpeaker.optional(),\n  })\n  .strict();\nexport type TranscriptionWord = z.infer<typeof TranscriptionWord>;\n\nexport const TranscriptionResultMetadata = z\n  .object({\n    detectedLanguage: z.string().trim().min(1).max(64).optional(),\n    span: TranscriptionTimeSpan.optional(),\n    confidence: z.number().finite().min(0).max(1).optional(),\n    speaker: TranscriptionSpeaker.optional(),\n    words: z.array(TranscriptionWord).max(10_000).optional(),\n  })\n  .strict()\n  .superRefine((metadata, context) => {\n    let previousStart = -1;\n    for (const [index, word] of (metadata.words ?? []).entries()) {\n      if (word.span.startMilliseconds < previousStart) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"words\", index, \"span\", \"startMilliseconds\"],\n          message: \"transcription words must be ordered by start time\",\n        });\n      }\n      previousStart = word.span.startMilliseconds;\n      if (\n        metadata.span &&\n        (word.span.startMilliseconds < metadata.span.startMilliseconds ||\n          word.span.endMilliseconds > metadata.span.endMilliseconds)\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"words\", index, \"span\"],\n          message: \"transcription word spans must fall within the result span\",\n        });\n      }\n    }\n  });\nexport type TranscriptionResultMetadata = z.infer<typeof TranscriptionResultMetadata>;\n\nconst TranscriptionEventBase = z\n  .object({\n    localSessionId: z.string().min(1).max(256),\n    sequence: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),\n    occurredAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\n\n/** Strict provider-neutral event surface; provider payload bags are rejected. */\nexport const TranscriptionEvent = z.discriminatedUnion(\"type\", [\n  TranscriptionEventBase.extend({ type: z.literal(\"permission.requested\") }),\n  TranscriptionEventBase.extend({\n    type: z.literal(\"session.opened\"),\n    providerSessionId: z.string().min(1).max(512),\n  }),\n  TranscriptionEventBase.extend({\n    type: z.literal(\"transcript.partial\"),\n    segmentId: z.string().min(1).max(512),\n    text: z.string().max(1_000_000),\n    metadata: TranscriptionResultMetadata.optional(),\n  }),\n  TranscriptionEventBase.extend({\n    type: z.literal(\"transcript.final\"),\n    segmentId: z.string().min(1).max(512),\n    text: z.string().max(1_000_000),\n    providerAcceptanceId: z.string().min(1).max(512),\n    metadata: TranscriptionResultMetadata.optional(),\n  }),\n  TranscriptionEventBase.extend({\n    type: z.literal(\"usage\"),\n    audioMilliseconds: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),\n    costUsd: z.number().finite().nonnegative().max(1_000_000_000).nullable(),\n  }),\n  TranscriptionEventBase.extend({\n    type: z.literal(\"session.reconnecting\"),\n    attempt: z.number().int().nonnegative().max(10_000),\n    reason: z.string().min(1).max(256),\n  }),\n  TranscriptionEventBase.extend({\n    type: z.literal(\"session.error\"),\n    code: TranscriptionErrorCode,\n    recoverable: z.boolean(),\n  }),\n  TranscriptionEventBase.extend({\n    type: z.literal(\"session.closed\"),\n    reason: z.enum([\"completed\", \"cancelled\", \"error\", \"replaced\"]),\n  }),\n]);\nexport type TranscriptionEvent = z.infer<typeof TranscriptionEvent>;\n\n/**\n * Workspace-only policy for the distinct speech-to-text capability. It never\n * authorizes a turn model/provider and contains connection references rather\n * than secrets. `acceptanceId` changes whenever an admin accepts a new target\n * set, so clients can bind a microphone session to one exact policy revision.\n */\nexport const WorkspaceTranscriptionPolicy = z\n  .object({\n    enabled: z.boolean(),\n    acceptanceId: z.string().uuid().nullable(),\n    primary: WorkspaceTranscriptionTarget.nullable(),\n    language: z.string().trim().min(1).max(64).nullable(),\n    autoDetectLanguage: z.boolean(),\n    diarization: z\n      .object({\n        enabled: z.boolean(),\n        maxSpeakers: z.number().int().min(2).max(100).nullable(),\n      })\n      .strict(),\n    retention: z\n      .object({\n        mode: z.enum([\"none\", \"provider-policy\"]),\n        maxDays: z.number().int().nonnegative().max(3650).nullable(),\n      })\n      .strict(),\n    privacy: z\n      .object({\n        allowProviderLogging: z.boolean(),\n        allowProviderTraining: z.boolean(),\n      })\n      .strict(),\n    fallback: z\n      .object({\n        mode: z.enum([\"disabled\", \"explicit\"]),\n        targets: z.array(WorkspaceTranscriptionTarget).max(8),\n      })\n      .strict(),\n    cost: z\n      .object({\n        currency: z.literal(\"USD\"),\n        maxPerHour: z.number().finite().nonnegative().max(10_000).nullable(),\n        maxPerMonth: z.number().finite().nonnegative().max(1_000_000).nullable(),\n      })\n      .strict(),\n  })\n  .strict()\n  .superRefine((policy, context) => {\n    if (policy.enabled && policy.acceptanceId === null) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"acceptanceId\"],\n        message: \"enabled transcription requires an accepted policy identity\",\n      });\n    }\n    if (policy.enabled && policy.primary === null) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"primary\"],\n        message: \"enabled transcription requires a primary target\",\n      });\n    }\n    if (policy.enabled && !policy.autoDetectLanguage && policy.language === null) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"language\"],\n        message: \"enabled transcription requires a language or accepted automatic detection\",\n      });\n    }\n    if (policy.autoDetectLanguage && policy.language !== null) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"language\"],\n        message: \"automatic language detection and a fixed language are mutually exclusive\",\n      });\n    }\n    if (!policy.diarization.enabled && policy.diarization.maxSpeakers !== null) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"diarization\", \"maxSpeakers\"],\n        message: \"disabled diarization cannot retain a speaker limit\",\n      });\n    }\n    if (policy.fallback.mode === \"disabled\" && policy.fallback.targets.length > 0) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"fallback\", \"targets\"],\n        message: \"disabled fallback cannot retain accepted targets\",\n      });\n    }\n    if (policy.fallback.mode === \"explicit\" && policy.fallback.targets.length === 0) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"fallback\", \"targets\"],\n        message: \"explicit fallback requires at least one accepted target\",\n      });\n    }\n    const targetKeys = [policy.primary, ...policy.fallback.targets]\n      .filter((target): target is WorkspaceTranscriptionTarget => target !== null)\n      .map((target) =>\n        [\n          target.provider,\n          target.model ?? \"\",\n          target.credentialMode,\n          target.credentialConnectionId ?? \"\",\n          target.region ?? \"\",\n        ].join(\"\\u0000\"),\n      );\n    if (new Set(targetKeys).size !== targetKeys.length) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"fallback\", \"targets\"],\n        message: \"transcription targets must be unique\",\n      });\n    }\n  });\nexport type WorkspaceTranscriptionPolicy = z.infer<typeof WorkspaceTranscriptionPolicy>;\n\n// Validates the KNOWN keys of workspaces.settings; passthrough keeps unknown\n// (future) keys rather than stripping them. memoryEnabled and transcription are\n// both default-off capabilities.\nexport const WorkspaceSettingsSchema = z\n  .object({\n    memoryEnabled: z.boolean().optional(),\n    transcription: WorkspaceTranscriptionPolicy.optional(),\n    // null clears the workspace override and falls back to the persisted\n    // deployment policy. The database boundary validates the same range.\n    maxNestedAgentDepth: NestedAgentDepthValue.nullable().optional(),\n  })\n  .passthrough();\nexport type WorkspaceSettings = z.infer<typeof WorkspaceSettingsSchema>;\n\n// Resolve the effective memoryEnabled flag from a raw settings bag (default off).\nexport function resolveWorkspaceMemoryEnabled(settings: unknown): boolean {\n  const parsed = WorkspaceSettingsSchema.safeParse(settings ?? {});\n  return parsed.success ? parsed.data.memoryEnabled === true : false;\n}\n\n// PATCH body for workspace settings: a partial top-level patch that merges into\n// the stored bag. Nested transcription policy updates are therefore full\n// replacements; passthrough carries forward-compatible unknown keys.\nexport const UpdateWorkspaceSettingsRequest = z\n  .object({\n    memoryEnabled: z.boolean().optional(),\n    transcription: WorkspaceTranscriptionPolicy.optional(),\n    maxNestedAgentDepth: NestedAgentDepthValue.nullable().optional(),\n  })\n  .passthrough();\nexport type UpdateWorkspaceSettingsRequest = z.infer<typeof UpdateWorkspaceSettingsRequest>;\n\nexport const SetWorkspaceDefaultRigRequest = z.object({\n  rigId: z.string().uuid().nullable(),\n});\nexport type SetWorkspaceDefaultRigRequest = z.infer<typeof SetWorkspaceDefaultRigRequest>;\n\n// PUT body for the workspace model policy (full replace, not a merge). null (or\n// omitted) = unrestricted for that dimension; an EMPTY array is a valid,\n// explicit total block. Entries are provider ids / exact model ids as the\n// router resolves them (see evaluateWorkspaceModelPolicy).\nexport const UpdateWorkspaceModelPolicyRequest = z.object({\n  allowedProviders: z.array(z.string().min(1).max(128)).max(64).nullable().optional(),\n  allowedModels: z.array(z.string().min(1).max(256)).max(256).nullable().optional(),\n});\nexport type UpdateWorkspaceModelPolicyRequest = z.infer<typeof UpdateWorkspaceModelPolicyRequest>;\n\nconst turnInitiatorIdentityFields = {\n  subjectId: z.string().min(1),\n  /** Immutable display snapshot; never an authorization input. */\n  label: z.string().min(1).optional(),\n} as const;\n\n/** Reserved creator/initiator id used only by legacy-row migration defaults. */\nexport const UNATTRIBUTED_LEGACY_INITIATOR_SUBJECT_ID = \"unattributed-legacy\" as const;\n\n/**\n * A named machine/service principal asserted by a trusted embedding host. This\n * deliberately excludes `kind: \"subject\"`: a delegated service assertion may\n * describe causal machine work, but it is not a generic human-impersonation\n * mechanism. The authenticated grant remains the authorization boundary.\n */\nexport const ServiceTurnInitiator = z.object({\n  kind: z.literal(\"service\"),\n  subjectId: z\n    .string()\n    .min(1)\n    .max(1024)\n    .refine((value) => value !== UNATTRIBUTED_LEGACY_INITIATOR_SUBJECT_ID, {\n      message: \"unattributed-legacy is reserved for migrated rows\",\n    }),\n  /** Immutable display snapshot; never an authorization input. */\n  label: z.string().min(1).max(256).optional(),\n});\nexport type ServiceTurnInitiator = z.infer<typeof ServiceTurnInitiator>;\n\n/**\n * Immutable, non-secret provenance captured with an initiator. This is audit\n * context (for example an external occurrence id), not a second identity or\n * authorization surface.\n */\nexport const TurnInitiatorContext = z.record(z.string(), z.unknown());\nexport type TurnInitiatorContext = z.infer<typeof TurnInitiatorContext>;\n\nconst reservedServiceTurnInitiatorContextKeys = new Set([\n  \"backfill\",\n  \"label\",\n  \"provenanceError\",\n  \"via\",\n  \"viaTruncated\",\n]);\n\n/** Bounded host provenance that cannot forge OpenGeni-owned lineage fields. */\nexport const ServiceTurnInitiatorContext = TurnInitiatorContext.superRefine((value, ctx) => {\n  for (const key of reservedServiceTurnInitiatorContextKeys) {\n    if (Object.prototype.hasOwnProperty.call(value, key)) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: [key],\n        message: `${key} is reserved OpenGeni initiator context`,\n      });\n    }\n  }\n  try {\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 4096) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: \"service initiator context exceeds 4096 UTF-8 bytes\",\n      });\n    }\n  } catch {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      message: \"service initiator context must be JSON-serializable\",\n    });\n  }\n});\nexport type ServiceTurnInitiatorContext = z.infer<typeof ServiceTurnInitiatorContext>;\n\nexport const AccountGrant = z.object({\n  accountId: z.string().uuid(),\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().optional(),\n  role: AccountRole.optional(),\n  permissions: z.array(Permission),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\nexport type AccountGrant = z.infer<typeof AccountGrant>;\n\nexport const AccessGrant = z.object({\n  workspaceId: z.string().uuid(),\n  accountId: z.string().uuid(),\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().optional(),\n  permissions: z.array(Permission),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n  // Optional trusted causal principal for a command submitted by an embedding\n  // host. Authorization still uses subjectId + permissions above.\n  serviceInitiator: ServiceTurnInitiator.optional(),\n  serviceInitiatorContext: ServiceTurnInitiatorContext.optional(),\n});\nexport type AccessGrant = z.infer<typeof AccessGrant>;\n\nexport const AccessContext = z.object({\n  mode: ProductAccessMode,\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().optional(),\n  accountGrants: z.array(AccountGrant),\n  workspaceGrants: z.array(AccessGrant),\n  defaultAccountId: z.string().uuid().nullable(),\n  defaultWorkspaceId: z.string().uuid().nullable(),\n});\nexport type AccessContext = z.infer<typeof AccessContext>;\n\nexport const DelegatedAccessTokenPayload = z\n  .object({\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    subjectId: z.string().min(1),\n    subjectLabel: z.string().optional(),\n    permissions: z.array(Permission).min(1),\n    // Trusted embedding hosts can sign a causal service principal separately\n    // from the grant subject that authorizes the request. The claim is consumed\n    // only when a command creates a new session/turn.\n    serviceInitiator: ServiceTurnInitiator.optional(),\n    serviceInitiatorContext: ServiceTurnInitiatorContext.optional(),\n    // Worker-asserted session scope for first-party MCP calls (HMAC-signed, not\n    // agent-controlled); enables session-scoped tools such as goal management.\n    sessionId: z.string().uuid().optional(),\n    // Model-visible first-party tool selection for a worker-bound session.\n    // This is visibility only; permissions remain the authorization boundary.\n    firstPartyMcpTools: z.array(FirstPartyMcpToolName).optional(),\n    // The turn making the call (the caller's identity), HMAC-signed by the worker\n    // at turn setup. Lets a tool classify WHO is calling from the token itself,\n    // instead of racily re-reading the session's live active_turn_id — e.g. the\n    // sacred-pause guard must know if the CALLER is a machine child-notification\n    // turn, and the active pointer can flip to another turn mid-check.\n    turnId: z.string().uuid().optional(),\n    // Exact execution owner. Agent control commands are accepted only while this\n    // attempt still owns the signed turn.\n    attemptId: z.string().uuid().optional(),\n    executionGeneration: z.number().int().positive().optional(),\n    exp: z.number().int().positive(),\n  })\n  .superRefine((payload, ctx) => {\n    if (payload.serviceInitiatorContext && !payload.serviceInitiator) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: [\"serviceInitiatorContext\"],\n        message: \"serviceInitiatorContext requires serviceInitiator\",\n      });\n    }\n    if (\n      payload.serviceInitiator &&\n      (payload.turnId !== undefined ||\n        payload.attemptId !== undefined ||\n        payload.executionGeneration !== undefined)\n    ) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: [\"serviceInitiator\"],\n        message: \"serviceInitiator cannot replace an exact agent-attempt initiator\",\n      });\n    }\n  });\nexport type DelegatedAccessTokenPayload = z.infer<typeof DelegatedAccessTokenPayload>;\n\nconst delegatedAccessTokenPrefix = \"ogd_\";\nconst delegatedServiceAccessTokenPrefix = \"ogd2_\";\n\nexport async function signDelegatedAccessToken(\n  secret: string,\n  payload: DelegatedAccessTokenPayload,\n): Promise<string> {\n  const parsed = DelegatedAccessTokenPayload.parse(payload);\n  const prefix = parsed.serviceInitiator\n    ? delegatedServiceAccessTokenPrefix\n    : delegatedAccessTokenPrefix;\n  const encodedPayload = base64UrlEncode(JSON.stringify(parsed));\n  // The service-capable envelope binds its prefix into the signature. An old\n  // verifier accepts only ogd_ and therefore fails closed during a rolling\n  // deploy; changing ogd2_ to ogd_ cannot turn provenance loss into success.\n  const signature = await hmacSha256Base64Url(\n    secret,\n    prefix === delegatedServiceAccessTokenPrefix ? `${prefix}${encodedPayload}` : encodedPayload,\n  );\n  return `${prefix}${encodedPayload}.${signature}`;\n}\n\nexport async function verifyDelegatedAccessToken(\n  secret: string,\n  token: string,\n  nowSeconds = Math.floor(Date.now() / 1000),\n): Promise<DelegatedAccessTokenPayload | null> {\n  const prefix = token.startsWith(delegatedServiceAccessTokenPrefix)\n    ? delegatedServiceAccessTokenPrefix\n    : token.startsWith(delegatedAccessTokenPrefix)\n      ? delegatedAccessTokenPrefix\n      : null;\n  if (!prefix) {\n    return null;\n  }\n  const withoutPrefix = token.slice(prefix.length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(\n    secret,\n    prefix === delegatedServiceAccessTokenPrefix ? `${prefix}${encodedPayload}` : encodedPayload,\n  );\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(base64UrlDecode(encodedPayload));\n  } catch {\n    return null;\n  }\n  const payload = DelegatedAccessTokenPayload.safeParse(decoded);\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  if (\n    (prefix === delegatedServiceAccessTokenPrefix) !==\n    (payload.data.serviceInitiator !== undefined)\n  ) {\n    return null;\n  }\n  return payload.data;\n}\n\n// --- Enrollment bearer credential (bring-your-own-compute M5) ---\n//\n// The signed bearer the agent presents to the control plane after enrollment (the\n// EnrollmentCredentials.bearer the poll returns). REUSES the SAME HMAC envelope as\n// the delegated/stream tokens (base64Url payload + hmacSha256Base64Url) with a\n// distinct `oge_` prefix so it can never be confused with an `ogd_` access token or\n// an `ogs_` stream token. It binds (workspaceId, agentId, enrollmentId) so the\n// control plane can verify the agent owns the subject `agent.<ws>.<id>` it\n// subscribes to. Signed with resolveEnrollmentSigningSecret; the secret value is\n// NEVER logged. The real per-workspace NATS Account creds binding is infra-deferred\n// (M4/relay) — this bearer is the application-tier identity proof.\nexport const EnrollmentBearerPayload = z.object({\n  workspaceId: z.string().uuid(),\n  agentId: z.string().uuid(),\n  enrollmentId: z.string().uuid(),\n  // The Account-scoped control-plane subject prefix the agent subscribes to.\n  subjectPrefix: z.string().min(1),\n  exp: z.number().int().positive(),\n});\nexport type EnrollmentBearerPayload = z.infer<typeof EnrollmentBearerPayload>;\n\nexport async function signEnrollmentBearer(\n  secret: string,\n  payload: EnrollmentBearerPayload,\n): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(EnrollmentBearerPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `oge_${encodedPayload}.${signature}`;\n}\n\nexport async function verifyEnrollmentBearer(\n  secret: string,\n  token: string,\n  nowSeconds = Math.floor(Date.now() / 1000),\n): Promise<EnrollmentBearerPayload | null> {\n  if (!token.startsWith(\"oge_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"oge_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  const payload = EnrollmentBearerPayload.safeParse(JSON.parse(base64UrlDecode(encodedPayload)));\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\n// --- Non-interactive enroll token (self-hosted enrollment UX §A2.1) ----------\n//\n// The SHORT-TTL, secret, workspace-scoped token the headless/fleet enroll path\n// presents to /v1/enrollments/token/exchange. The token IS the grant — there is\n// no human approve step — so it is stateless-signed (no DB row): the holder of an\n// unexpired token can enroll ONE machine identity into ONE workspace.\n//\n// It REUSES the SAME HMAC envelope as signEnrollmentBearer (base64Url payload +\n// hmacSha256Base64Url) with a DISTINCT `oget_` prefix and a `typ: \"enroll\"` claim.\n// DOMAIN SEPARATION: even though it shares the signing secret with the `oge_`\n// bearer, the prefix + typ claim make an enroll token unusable as an `oge_`\n// bearer (verifyEnrollmentBearer's `oge_` prefix check rejects it) and vice-versa\n// (verifyEnrollToken's `oget_` prefix + typ check rejects an `oge_` bearer). The\n// secret value is NEVER logged.\nexport const EnrollTokenPayload = z.object({\n  // Domain-separation claim — fixed \"enroll\" so an `oge_`/`ogd_`/`ogs_` payload (no\n  // typ, or a different typ) can never satisfy verifyEnrollToken even past the prefix.\n  typ: z.literal(\"enroll\"),\n  workspaceId: z.string().uuid(),\n  accountId: z.string().uuid(),\n  // The screen-control consent baked into the token at mint (the minting user's\n  // decision); the exchange records it as consentedScreenControl on the enrollment.\n  allowScreenControl: z.boolean(),\n  iat: z.number().int().nonnegative(),\n  exp: z.number().int().positive(),\n});\nexport type EnrollTokenPayload = z.infer<typeof EnrollTokenPayload>;\n\nexport async function signEnrollToken(\n  secret: string,\n  payload: EnrollTokenPayload,\n): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(EnrollTokenPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `oget_${encodedPayload}.${signature}`;\n}\n\n/**\n * Verify an enroll token: rejects (returns null) on a bad prefix (NOT `oget_`),\n * a malformed envelope, a bad HMAC signature (constant-time), schema-invalid\n * claims (which includes `typ !== \"enroll\"` — the `z.literal` rejects it), or an\n * expired token (`exp < now`). Mirrors verifyEnrollmentBearer exactly. An `oge_`\n * bearer fails the prefix gate; a same-secret token that lacks the typ claim fails\n * the schema gate — both halves of the domain separation are enforced here.\n */\nexport async function verifyEnrollToken(\n  secret: string,\n  token: string,\n  nowSeconds = Math.floor(Date.now() / 1000),\n): Promise<EnrollTokenPayload | null> {\n  if (!token.startsWith(\"oget_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"oget_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(base64UrlDecode(encodedPayload));\n  } catch {\n    return null;\n  }\n  const payload = EnrollTokenPayload.safeParse(decoded);\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\n// --- Scoped data-plane stream token (sandbox contract §C.3 / crosscut PART 1.3) ---\n//\n// REUSES the existing HMAC envelope (sign/verifyDelegatedAccessToken's\n// base64Url + hmacSha256Base64Url) — NOT a second crypto — but with a distinct\n// `ogs_` prefix and a HARD-NARROW claim set. The token is a CLAIM the OpenGeni\n// control plane mints; it is NOT the provider's tunnel secret. The browser\n// receives { providerUrl, streamToken }; the provider tunnel URL is the\n// transport, the streamToken is what the in-box edge validates (websockify\n// TokenFile is later-hardening; in v1 the URL's short TTL + the acknowledged\n// stream:view gate are the real boundary). The token is minted + recorded\n// against the holder from day one. It is NEVER appended to the URL as a query\n// param (the provider's own scoped token already lives in the URL).\n//\n// `leaseEpoch` is the fence: when the box is re-elected (warming→warm bumps the\n// epoch) the URL is re-minted with epoch+1 and the old tunnel is torn down, so a\n// stale token points at a dead tunnel. Epoch mismatch is enforced at USE (by the\n// caller comparing the claim against the live lease), not inside verify.\nexport const StreamTokenPayload = z.object({\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  // Identifies the sandbox_lease_holders row (the viewer holder).\n  viewerId: z.string().uuid(),\n  // Fence: the token logically dies when the box is re-elected (epoch++).\n  leaseEpoch: z.number().int().nonnegative(),\n  // v1 is always \"view\"; \"control\" is the never-granted raw-input plane.\n  mode: z.enum([\"view\", \"control\"]),\n  // 6080 (noVNC); pins the token to ONE exposed port.\n  port: z.number().int().positive(),\n  // Short TTL (120s default); rotation is event-driven under the epoch fence,\n  // not on a keepalive clock.\n  exp: z.number().int().positive(),\n});\nexport type StreamTokenPayload = z.infer<typeof StreamTokenPayload>;\n\nexport async function signStreamToken(\n  secret: string,\n  payload: StreamTokenPayload,\n): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(StreamTokenPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `ogs_${encodedPayload}.${signature}`;\n}\n\n/**\n * Verify a stream token: rejects (returns null) on a bad prefix, malformed\n * envelope, bad HMAC signature (constant-time), schema-invalid claims, or an\n * expired token (`exp < now`). Mirrors verifyDelegatedAccessToken exactly.\n *\n * The epoch fence (claim.leaseEpoch vs the LIVE lease epoch) and the\n * workspace/session scope are checked by the CALLER at use against the live\n * lease + route params — verify proves the token is authentic + unexpired, the\n * caller proves it is for THIS box's current epoch and THIS workspace+session.\n */\nexport async function verifyStreamToken(\n  secret: string,\n  token: string,\n  nowSeconds = Math.floor(Date.now() / 1000),\n): Promise<StreamTokenPayload | null> {\n  if (!token.startsWith(\"ogs_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"ogs_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(base64UrlDecode(encodedPayload));\n  } catch {\n    return null;\n  }\n  const payload = StreamTokenPayload.safeParse(decoded);\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\n// --- Relay PRODUCER token (bring-your-own-compute M8b) ---\n//\n// The token the AGENT presents to the relay edge when it registers a pty/desktop\n// stream channel (role=AGENT) — distinct from the viewer's `ogs_` token. It is\n// minted by the control plane at enrollment and threaded into EnrollmentCredentials\n// (proto field `relay_token`); the relay verifies it on its own merits, then pairs\n// the producer with the consumer by the shared channel key.\n//\n// REUSES the EXACT SAME HMAC envelope as the `ogs_`/`ogd_`/`oge_` tokens\n// (base64Url JSON payload + hmacSha256Base64Url) — NOT a second crypto — with a\n// distinct `ogr_` prefix so it can never be confused with the others. The claim\n// set binds (workspaceId, agentId): the relay reads the channel-key's ws+agent\n// from the StreamOpen and asserts the producer token claims the SAME pair, so a\n// producer token for workspace A can never register a channel for workspace B.\n// Signed with resolveRelayTokenSecret (the relay-token HMAC secret); the value is\n// NEVER logged. Long-lived by design (it is enrollment-scoped, not per-stream —\n// the agent presents it on every channel registration for the life of the\n// enrollment); the relay additionally validates the channel key + (for the\n// viewer's `ogs_`) the lease/active-epoch fence.\n//\n// The Rust relay re-implements this verify (the same base64url(JSON) + HMAC-SHA256\n// + prefix split) so TS-mint and Rust-verify provably agree — see the cross-stack\n// fixture in agent/crates/opengeni-relay/tests and the relay's `token` module doc.\nexport const RelayTokenPayload = z.object({\n  // The workspace the agent (and its channels) belong to — the relay asserts this\n  // equals the channel-key's ws so a producer can only register its own channels.\n  workspaceId: z.string().uuid(),\n  // The agent (machine) id — the relay asserts this equals the channel-key's agent.\n  agentId: z.string().uuid(),\n  // Expiry (unix seconds). Enrollment-scoped horizon (re-minted on re-enroll).\n  exp: z.number().int().positive(),\n});\nexport type RelayTokenPayload = z.infer<typeof RelayTokenPayload>;\n\nexport async function signRelayToken(secret: string, payload: RelayTokenPayload): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(RelayTokenPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `ogr_${encodedPayload}.${signature}`;\n}\n\n/**\n * Verify a relay producer token: rejects (returns null) on a bad prefix, malformed\n * envelope, bad HMAC signature (constant-time), schema-invalid claims, or expiry.\n * Mirrors verifyStreamToken exactly. The relay (Rust) re-implements this verify;\n * the TS verify here proves the format for the cross-stack fixture + any TS caller.\n *\n * The channel-key scope (claim.workspaceId/agentId vs the StreamOpen channel key)\n * is enforced by the relay at USE — verify proves authenticity + freshness only.\n */\nexport async function verifyRelayToken(\n  secret: string,\n  token: string,\n  nowSeconds = Math.floor(Date.now() / 1000),\n): Promise<RelayTokenPayload | null> {\n  if (!token.startsWith(\"ogr_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"ogr_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(base64UrlDecode(encodedPayload));\n  } catch {\n    return null;\n  }\n  const payload = RelayTokenPayload.safeParse(decoded);\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\nexport const CreateWorkspaceRequest = z.object({\n  accountId: z.string().uuid().optional(),\n  name: z.string().min(1),\n  slug: z.string().min(1).optional(),\n  externalSource: z.string().min(1).optional(),\n  externalId: z.string().min(1).optional(),\n  // White-label persona override for this workspace's agent. null/omitted uses\n  // the deployment default template.\n  agentInstructions: z.string().min(1).nullable().optional(),\n});\nexport type CreateWorkspaceRequest = z.infer<typeof CreateWorkspaceRequest>;\n\nexport const UpdateWorkspaceRequest = z.object({\n  name: z.string().min(1).optional(),\n  slug: z.string().min(1).nullable().optional(),\n  // White-label persona override. Pass null to clear it back to the deployment\n  // default; omit to leave it unchanged.\n  agentInstructions: z.string().min(1).nullable().optional(),\n});\nexport type UpdateWorkspaceRequest = z.infer<typeof UpdateWorkspaceRequest>;\n\nexport const ApiKey = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid().nullable(),\n  name: z.string(),\n  prefix: z.string(),\n  permissions: z.array(Permission),\n  expiresAt: z.string().nullable(),\n  revokedAt: z.string().nullable(),\n  lastUsedAt: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ApiKey = z.infer<typeof ApiKey>;\n\nexport const CreateApiKeyRequest = z.object({\n  name: z.string().min(1),\n  workspaceId: z.string().uuid().optional(),\n  permissions: z.array(Permission).min(1),\n  expiresAt: z.string().datetime({ offset: true }).optional(),\n});\nexport type CreateApiKeyRequest = z.infer<typeof CreateApiKeyRequest>;\n\nexport const CreateApiKeyResponse = z.object({\n  apiKey: ApiKey,\n  token: z.string().min(1),\n});\nexport type CreateApiKeyResponse = z.infer<typeof CreateApiKeyResponse>;\n\n// A person (or API key) with access to a workspace: one workspace_memberships\n// row. `subjectId` is `user:<betterAuthUserId>` or `api_key:<id>`; the People\n// surface lists the `user:` subjects (api_key subjects belong to API keys).\nexport const WorkspaceMember = z.object({\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().nullable(),\n  role: z.string(),\n  permissions: z.array(Permission),\n  createdAt: z.string(),\n});\nexport type WorkspaceMember = z.infer<typeof WorkspaceMember>;\n\nexport const ListWorkspaceMembersResponse = z.object({\n  members: z.array(WorkspaceMember),\n});\nexport type ListWorkspaceMembersResponse = z.infer<typeof ListWorkspaceMembersResponse>;\n\nexport const AddWorkspaceMemberRequest = z.object({\n  // Resolved against the managed (Better Auth) users; email invites for\n  // not-yet-registered users are deferred, so an unknown email returns 404.\n  email: z.string().email(),\n  role: z.string().min(1).optional(),\n  permissions: z.array(Permission),\n});\nexport type AddWorkspaceMemberRequest = z.infer<typeof AddWorkspaceMemberRequest>;\n\nexport const UpdateWorkspaceMemberRequest = z.object({\n  role: z.string().min(1).optional(),\n  permissions: z.array(Permission),\n});\nexport type UpdateWorkspaceMemberRequest = z.infer<typeof UpdateWorkspaceMemberRequest>;\n\nexport const UsageEventType = z.enum([\n  \"agent_run.created\",\n  \"agent_run.completed\",\n  \"model.tokens\",\n  \"model.cost\",\n  \"file.uploaded\",\n  \"file.deleted\",\n  \"document.indexed\",\n  \"scheduled_task.fired\",\n  \"api_key.request\",\n  // --- sandbox warm-time metering (P2.1) ---\n  // Wall-clock seconds a box was warm — the billable warm-time meter. Accrued on\n  // the two stateless ticks (turn heartbeat + reaper sweep), idempotent on\n  // (sandbox_group_id, lease_epoch, tick) so a shared box (N sessions) is metered\n  // EXACTLY ONCE per tick (N sessions != N x bill). Orthogonal to model.tokens /\n  // model.cost (model API cost vs provider compute cost — both real, no overlap).\n  \"sandbox.warm_seconds\",\n  // usd_micros: warm-seconds x the per-provider per-second warm rate.\n  \"sandbox.warm_cost\",\n]);\nexport type UsageEventType = z.infer<typeof UsageEventType>;\n\nexport const UsageEvent = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  accountId: z.string().uuid(),\n  subjectId: z.string().nullable(),\n  eventType: UsageEventType,\n  quantity: z.number(),\n  unit: z.string(),\n  sourceResourceType: z.string().nullable(),\n  sourceResourceId: z.string().nullable(),\n  idempotencyKey: z.string(),\n  occurredAt: z.string(),\n  recordedAt: z.string(),\n  exportedToBillingAt: z.string().nullable(),\n  billingProviderEventId: z.string().nullable(),\n});\nexport type UsageEvent = z.infer<typeof UsageEvent>;\n\nexport const LimitAction = z.enum([\n  \"agent_run:create\",\n  \"tokens:consume\",\n  \"file:upload\",\n  \"document:index\",\n  \"schedule:create\",\n  \"workspace:create\",\n  \"api_key:create\",\n]);\nexport type LimitAction = z.infer<typeof LimitAction>;\n\nexport const StaticUsageLimits = z.object({\n  maxWorkspacesPerAccount: z.number().int().positive().optional(),\n  maxApiKeysPerWorkspace: z.number().int().positive().optional(),\n  maxSchedulesPerWorkspace: z.number().int().positive().optional(),\n  maxFileUploadBytes: z.number().int().positive().optional(),\n  maxMonthlyAgentRunsPerWorkspace: z.number().int().positive().optional(),\n  maxMonthlyTokensPerWorkspace: z.number().int().positive().optional(),\n  maxMonthlyCostMicrosPerAccount: z.number().int().positive().optional(),\n  maxDocumentIndexedChunksPerWorkspace: z.number().int().positive().optional(),\n});\nexport type StaticUsageLimits = z.infer<typeof StaticUsageLimits>;\n\nexport const EntitlementValue = z.union([z.boolean(), z.string(), z.number(), z.array(z.string())]);\nexport type EntitlementValue = z.infer<typeof EntitlementValue>;\n\nexport const Entitlements = z.record(z.string().min(1), EntitlementValue);\nexport type Entitlements = z.infer<typeof Entitlements>;\n\nexport const LimitDecision = z.discriminatedUnion(\"allowed\", [\n  z.object({ allowed: z.literal(true) }),\n  z.object({\n    allowed: z.literal(false),\n    code: z.string(),\n    message: z.string(),\n  }),\n]);\nexport type LimitDecision = z.infer<typeof LimitDecision>;\n\n// ============ P3 — Entitlements port (§7.5) ============\n//\n// The host-providable admission seam over OpenGeni's TWO existing admission\n// sites: the API edge (`checkLimit`/`requireLimit`, billing/limits.ts) AND the\n// worker edge (`ensureRunAllowed`, agent-turn.ts — both turn-entry and the\n// mid-stream budget valve). A host that owns its OWN ledger/meter binds this to\n// keep OpenGeni from re-deriving admission from its local ledger.\n//\n// CRITICAL CONTRACT: `admitRun` returns a transport-neutral allow/deny decision\n// (+ optional structured reason + the echoed quantity it admitted) and NEVER\n// exposes `getBillingBalance` or any ledger internals — the host's balance math\n// stays on the host side of the boundary. This is what lets the same port serve\n// both PUSH (host funds OpenGeni's ledger; admission is a LOCAL read of that\n// funded ledger) and PULL (a network callback to the host's own meter).\n//\n// `action` is a free `string` (NOT the internal `LimitAction` enum) so a host\n// meter can key on actions OpenGeni does not model. `quantity` is the units the\n// caller is about to consume (tokens, bytes, 1 run, …); the decision MAY echo\n// the admitted quantity so a PULL host can grant a partial allowance.\nexport const EntitlementDecision = z.discriminatedUnion(\"allowed\", [\n  z.object({ allowed: z.literal(true), quantity: z.number().optional() }),\n  z.object({\n    allowed: z.literal(false),\n    reason: z.string(),\n    code: z.string().optional(),\n    quantity: z.number().optional(),\n  }),\n]);\nexport type EntitlementDecision = z.infer<typeof EntitlementDecision>;\n\nexport type AdmitRunInput = {\n  accountId: string;\n  workspaceId: string;\n  action: string;\n  quantity: number;\n};\n\nexport type EntitlementsPort = {\n  admitRun(input: AdmitRunInput): Promise<EntitlementDecision>;\n};\n\nexport const GitCredentialProvider = z.enum([\"github\", \"gitlab\", \"azure_devops\"]);\nexport type GitCredentialProvider = z.infer<typeof GitCredentialProvider>;\n\n// Host-opaque identity for one independently mintable Git credential. It is\n// deliberately NOT constrained to a filesystem-safe alphabet: runtimes hash it\n// before using it in paths, command text, or environment variable names.\nexport const GitCredentialBindingId = z.string().min(1).max(256);\nexport type GitCredentialBindingId = z.infer<typeof GitCredentialBindingId>;\n\nexport const GitRepositoryAccess = z.enum([\"read\", \"write\"]);\nexport type GitRepositoryAccess = z.infer<typeof GitRepositoryAccess>;\n\nconst GitProviderRepositoryId = z.union([z.number().int().positive(), z.string().min(1)]);\n\nexport const GitCredentialRepositoryRef = z.object({\n  provider: GitCredentialProvider.optional(),\n  credentialBindingId: GitCredentialBindingId.optional(),\n  access: GitRepositoryAccess.optional(),\n  uri: z.string().min(1),\n  ref: z.string().min(1),\n  repositoryId: GitProviderRepositoryId.optional(),\n  installationId: GitProviderRepositoryId.optional(),\n  projectId: GitProviderRepositoryId.optional(),\n  connectionId: z.string().min(1).optional(),\n});\nexport type GitCredentialRepositoryRef = z.infer<typeof GitCredentialRepositoryRef>;\n\n// ============ connection-credential provider — Connection-credential provider (§7.6) ============\n//\n// The host-providable credential seam over OpenGeni's run-scoped credential\n// sites in the worker and API:\n//   - GIT credentials: run-scoped provider tokens minted in\n//     `sandboxEnvironmentForRun` (standalone self-mints GitHub App tokens from\n//     `settings`; embedded hosts can broker GitHub, GitLab, and Azure DevOps)\n//     and seeded off-manifest into sandbox token files for git + provider CLIs.\n//   - SANDBOX secrets: the decrypted variable set values loaded in\n//     `loadVariableSetForRun` (today decrypted with\n//     `environmentsEncryptionKeyBytes(settings)`).\n//   - MCP credentials: request-time transport headers for connection-backed\n//     servers, shared by normal model tools and Toolspace/Code Mode.\n//\n// In embedded/separate topologies the HOST owns these external connections\n// (its GitHub App, its secret vault + encryption key). When a host binds this\n// port, OpenGeni asks the host to mint/decrypt per-run instead of self-minting\n// from `settings`. Unset (standalone default) → byte-for-byte today's\n// self-mint.\n//\n// Workspace-scope cross-check (the host-mapping safety guardrail): a credential\n// provider returns the `workspaceId` it scoped the credential to, and the\n// activity ASSERTS it agrees with the run's workspace BEFORE injecting\n// any git provider token seed (or applying decrypted environment values). A host mapping bug that\n// returns tenant B's creds while the run is tenant A is thereby caught at the\n// seam, never silently injected into tenant A's sandbox.\n\nexport type GitCredentialsRequest = {\n  accountId: string;\n  workspaceId: string;\n  /** Immutable authority admitted with the turn requesting this credential. */\n  sessionId: string;\n  rootSessionId: string;\n  turnId: string;\n  attemptId: string;\n  executionGeneration: number;\n  initiator: TurnInitiator;\n  initiatorContext: TurnInitiatorContext;\n  // Provider defaults to \"github\" for the legacy request shape. GitHub-only\n  // hosts can keep reading installationId/repositoryIds exactly as before;\n  // provider-aware hosts should branch on this and repositoryRefs.\n  provider?: GitCredentialProvider;\n  // Present when the host supplied an explicit binding or when more than one\n  // independently mintable credential exists for this provider. A host must\n  // mint only this binding; OpenGeni never treats provider identity as enough\n  // to select among multiple accounts/installations.\n  credentialBindingId?: GitCredentialBindingId;\n  // Canonical lower-case host shared by this binding's repository refs when\n  // there is exactly one. Binding-aware providers echo it when present.\n  providerHost?: string;\n  // Token requests are the existing behavior. Identity requests let lazy\n  // sandbox provisioning resolve stable git author/committer identity before\n  // the box exists while deferring the rotating token value to first provision.\n  purpose?: \"token\" | \"identity\";\n  // Provider-neutral repository refs for hosts that broker non-GitHub tokens.\n  // For GitHub requests these are additive to the legacy fields below.\n  repositoryRefs?: GitCredentialRepositoryRef[];\n  // Legacy GitHub App installation shape retained for 0.x compatibility.\n  installationId: number;\n  repositoryIds: number[];\n};\n\n/**\n * One exact repository route exposed by a host-owned HTTPS smart-Git broker.\n *\n * `repositoryUri` must echo one URI from the request's `repositoryRefs`.\n * `brokerUri` is a stable, credential-free HTTPS remote. The rotating bearer\n * remains separate in `GitCredentials.token`, so it cannot leak through Git\n * configuration, provider-CLI arguments, manifests, or repository metadata.\n */\nexport type GitHttpBrokerRepositoryRoute = {\n  repositoryUri: string;\n  brokerUri: string;\n};\n\n/**\n * Optional transport override for credentials that cannot be safely narrowed\n * into a provider token. Omission retains the provider-token behavior.\n */\nexport type GitCredentialTransport = {\n  kind: \"http_broker\";\n  repositories: GitHttpBrokerRepositoryRoute[];\n};\n\nexport type GitCredentials = {\n  // The minted secret. For the default transport this is a provider token; for\n  // `http_broker` it is the broker bearer. Required for purpose=\"token\";\n  // optional for purpose=\"identity\" so hosts can return only stable git identity\n  // before lazy sandbox provision. The value never enters the manifest.\n  token?: string;\n  // A host-owned exact smart-Git transport for providers whose available token\n  // cannot be constrained to the selected repositories. OpenGeni rewrites only\n  // the echoed repository remotes and never exposes this bearer to provider\n  // CLIs. Omitted means the token is a direct provider credential.\n  transport?: GitCredentialTransport;\n  // workspace-scope cross-check echo: the workspace the provider scoped this token to. The activity\n  // asserts `workspaceId === request.workspaceId` before injecting.\n  workspaceId: string;\n  // Strict request echoes for binding-aware requests. OpenGeni validates these\n  // before accepting a token, preventing a host routing bug from returning a\n  // sibling connection's credential. They remain optional for legacy single-\n  // binding/provider hosts.\n  credentialBindingId?: GitCredentialBindingId;\n  provider?: GitCredentialProvider;\n  providerHost?: string;\n  // Optional provider expiry for host-managed proactive renewal. ISO-8601;\n  // null/omitted means the host does not expose a deadline and OpenGeni uses\n  // its conservative bounded refresh cadence instead.\n  expiresAt?: string | null;\n  // Optional git identity override. When omitted the activity falls back to\n  // today's `githubAppBotIdentity(settings)`.\n  identity?: { name: string; email: string } | null;\n};\n\nexport type SandboxSecretsRequest = {\n  accountId: string;\n  workspaceId: string;\n  // The variable set the run's session declares (null = unattached;\n  // the provider, like the self-mint path, returns null values for it).\n  variableSetId: string;\n};\n\nexport type SandboxSecrets = {\n  // The decrypted variableSet values the run injects, replacing the local\n  // `environmentsEncryptionKeyBytes` decrypt. Same shape the self-mint path\n  // produces (plaintext name→value).\n  values: Record<string, string>;\n  // workspace-scope cross-check echo: the workspace the provider scoped these secrets to.\n  workspaceId: string;\n  // Optional variableSet metadata; when omitted the activity uses the\n  // variableSetId as both id and name (the local decrypt carries the row's\n  // id/name/description, but only `id` is load-bearing downstream).\n  id?: string;\n  name?: string;\n  description?: string | null;\n};\n\nexport type CredentialAuthNeededReason =\n  | \"missing_connection\"\n  | \"expired\"\n  | \"insufficient_scope\"\n  | \"refresh_failed\";\n\n/**\n * Host-owned run credentials are materialized below one OpenGeni-owned sandbox\n * directory. Paths are relative POSIX names; the runtime validates traversal,\n * collisions, bounds, and modes before any content reaches a sandbox.\n */\nexport type RunCredentialFile = {\n  path: string;\n  content: string;\n  mode?: \"0400\" | \"0600\";\n};\n\nexport type RunCredentialAuthNeeded = {\n  reason: CredentialAuthNeededReason;\n  providerDomain?: string;\n  connectionId?: string;\n  scopes?: string[];\n  resource?: string;\n  authorizationUrl?: string;\n  /** Bounded non-secret guidance. Never place credential material here. */\n  message?: string;\n};\n\nexport type RunCredentialRedaction = {\n  /** Bounded diagnostic label used only in the replacement marker. */\n  name: string;\n  /** One atomic secret value that must be removed from streamed/audit output. */\n  value: string;\n};\n\nexport type RunCredentialsRequest = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  parentSessionId: string | null;\n  rootSessionId: string;\n  /** All sessions sharing this sandbox group share one OS/filesystem trust boundary. */\n  sandboxGroupId: string;\n  turnId: string;\n  attemptId: string;\n  executionGeneration: number;\n  /** Immutable authority admitted with this turn. */\n  initiator: TurnInitiator;\n  initiatorContext: TurnInitiatorContext;\n  effectiveSandboxBackend: SandboxBackend;\n  sandboxOs: SandboxOs;\n  purpose: \"provision\" | \"renewal\";\n  forceRefresh: boolean;\n  /** Informational standalone variable-set identity; never gates host resolution. */\n  variableSet: { id: string; name: string } | null;\n};\n\nexport type RunCredentialsResolution =\n  | {\n      /**\n       * The frozen target/attempt must not receive host material. Hosts use\n       * this for unsupported OSes/backends and policy-based opt-out; the\n       * decision must remain stable for the attempt.\n       */\n      status: \"not_applicable\";\n      accountId: string;\n      workspaceId: string;\n      sessionId: string;\n    }\n  | {\n      status: \"ok\";\n      /** Scope echoes are mandatory and checked before materialization. */\n      accountId: string;\n      workspaceId: string;\n      sessionId: string;\n      /** Secret environment values. Always delivered off-manifest. */\n      environment: Record<string, string>;\n      files?: RunCredentialFile[];\n      /** Environment name to one returned relative file path. */\n      fileEnvironment?: Record<string, string>;\n      /**\n       * Atomic sensitive values embedded inside credential files or derived\n       * material. Environment values are registered automatically; hosts list\n       * additional file-contained values here so chunked output is redacted.\n       */\n      redactions?: RunCredentialRedaction[];\n      /** Earliest material expiry. Null/omitted uses a bounded refresh cadence. */\n      expiresAt?: string | null;\n      /** Partial degradation: usable material may coexist with reconnect notices. */\n      authNeeded?: RunCredentialAuthNeeded[];\n    }\n  | {\n      status: \"auth_needed\";\n      accountId: string;\n      workspaceId: string;\n      sessionId: string;\n      authNeeded: RunCredentialAuthNeeded[];\n    };\n\nexport const McpConnectionResourceScope = z\n  .object({\n    /** Provider-stable repository identity, serialized as a string on the wire. */\n    id: z.string().min(1).max(512),\n    kind: z.literal(\"repository\"),\n  })\n  .strict();\nexport type McpConnectionResourceScope = z.infer<typeof McpConnectionResourceScope>;\n\nconst McpConnectionResourceScopes = z\n  .array(McpConnectionResourceScope)\n  .min(1)\n  .max(256)\n  .superRefine((resources, context) => {\n    const seen = new Set<string>();\n    for (const [index, resource] of resources.entries()) {\n      const key = `${resource.kind}\\0${resource.id}`;\n      if (seen.has(key)) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"selectedResources must not contain duplicates\",\n          path: [index],\n        });\n      }\n      seen.add(key);\n    }\n  });\n\nexport const McpServerConnectionRef = z\n  .object({\n    /** Opaque host or standalone connection identifier. */\n    connectionId: z.string().min(1).optional(),\n    /** Stable provider family (for example github, gitlab, or azure_devops). */\n    provider: z.string().min(1).max(128).optional(),\n    /** Provider host or tenant domain. */\n    providerDomain: z.string().min(1),\n    kind: z.enum([\"oauth2\", \"api_key\", \"app_install\", \"delegated\"]).optional(),\n    scopes: z.array(z.string().min(1)).optional(),\n    /** OAuth resource indicator. This is distinct from selectedResources. */\n    resource: z.string().min(1).optional(),\n    /** Exact provider resources this MCP binding is allowed to operate on. */\n    selectedResources: McpConnectionResourceScopes.optional(),\n    subjectScope: z.enum([\"workspace\", \"subject\"]).optional(),\n  })\n  .strict()\n  .superRefine((reference, context) => {\n    if (!reference.selectedResources) return;\n    if (!reference.connectionId) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"selectedResources requires connectionId\",\n        path: [\"connectionId\"],\n      });\n    }\n    if (!reference.provider) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"selectedResources requires provider\",\n        path: [\"provider\"],\n      });\n    }\n  });\nexport type McpServerConnectionRef = z.infer<typeof McpServerConnectionRef>;\n\nexport type McpCredentialsRequest = {\n  accountId: string;\n  workspaceId: string;\n  /** Immediate session whose model or Toolspace call needs the credential. */\n  sessionId: string;\n  /** Workspace-scoped lineage root for host authorization and binding lookup. */\n  rootSessionId: string;\n  turnId: string;\n  /** Null only while a durable turn exists without a currently executing attempt. */\n  attemptId: string | null;\n  executionGeneration: number;\n  /** The immutable authority that admitted this turn. Never substitute the sandbox caller. */\n  initiator: TurnInitiator;\n  initiatorContext: TurnInitiatorContext;\n  /** Immediate technical caller, retained only as non-authoritative audit context. */\n  callerSubjectId?: string;\n  surface: \"model\" | \"toolspace\";\n  /** Canonical MCP destination that will receive the resolved headers. */\n  destinationUrl: string;\n  serverId: string;\n  toolName?: string;\n  connectionRef: McpServerConnectionRef;\n  forceRefresh: boolean;\n};\n\nexport type McpCredentialAuthNeededReason =\n  | CredentialAuthNeededReason\n  | \"unsupported_auth\"\n  | \"resource_scope_unavailable\";\n\nexport type McpCredentialResolution =\n  | {\n      status: \"ok\";\n      /** Scope echoes are mandatory and verified before any header is used. */\n      accountId: string;\n      workspaceId: string;\n      sessionId: string;\n      headers: Record<string, string>;\n      connectionId: string;\n      providerDomain: string;\n      provider?: string;\n      scopes?: string[];\n      resource?: string;\n      selectedResources?: McpConnectionResourceScope[];\n      expiresAt?: string | null;\n    }\n  | {\n      status: \"auth_needed\";\n      /** Scope echoes are mandatory even when the credential cannot be resolved. */\n      accountId: string;\n      workspaceId: string;\n      sessionId: string;\n      reason: McpCredentialAuthNeededReason;\n      providerDomain: string;\n      provider?: string;\n      connectionId?: string;\n      scopes?: string[];\n      resource?: string;\n      selectedResources?: McpConnectionResourceScope[];\n      authorizationUrl?: string;\n    };\n\nexport type ConnectionCredentialsPort = {\n  // Every leg is optional: a host may drive only the credential classes it\n  // owns. An unset leg falls through to today's standalone implementation for\n  // that leg only.\n  gitCredentials?(input: GitCredentialsRequest): Promise<GitCredentials>;\n  sandboxSecrets?(input: SandboxSecretsRequest): Promise<SandboxSecrets>;\n  /**\n   * Resolve host-owned, session-aware sandbox credentials independently of an\n   * OpenGeni variable set. OpenGeni transports and renews the material; the host\n   * remains the sole owner of connection selection and credential policy.\n   */\n  runCredentials?(input: RunCredentialsRequest): Promise<RunCredentialsResolution>;\n  /**\n   * Resolve rotating MCP transport credentials at request time. Embedded hosts\n   * use this to keep their provider connection as the sole credential source;\n   * OpenGeni never requires a duplicate connection record. The same resolver is\n   * used by model-visible MCP tools and the additive Toolspace/Code Mode proxy.\n   */\n  mcpCredentials?(input: McpCredentialsRequest): Promise<McpCredentialResolution>;\n};\n\n// ============ connection-credential provider — GitHub App API port (BYO-App, §7.6 / GitHub credential prototype remainder) ===\n//\n// The host-driven GitHub-API credential leg. GitHub credential prototype closed the establishment +\n// gate (storage) axis; this closes the credential leg by making the live\n// GitHub-API calls host-PROVIDABLE so a BYO-GitHub-App host drives its OWN App\n// credentials (its own JWT-signing key, its own OAuth client) instead of\n// OpenGeni self-minting from `settings`:\n//   - authorizeUser: OAuth code exchange + user-visible installation and\n//     repository permission discovery. Retained for provider ABI compatibility;\n//     visibility is not proof of installation authority and core does not use\n//     this method for new workspace binding.\n//   - verifyInstallationAccessForUser: OAuth code→token + installation lookup,\n//     also retained for provider ABI compatibility and not used for binding.\n//   - getInstallation: retained in the provider ABI for compatibility. Direct\n//     existing-installation selection is fail-closed and core does not call\n//     this method for binding.\n//   - listRepositories: the installation-scoped repo listing behind\n//     `GET /v1/workspaces/:id/github/repositories` (today\n//     `listGitHubAppRepositories(settings, …)`).\n//\n// Unset (standalone default) → today's `settings`-based self-mint runs\n// byte-for-byte (the live GitHub-API verify/list against OpenGeni's own App).\n\nexport type GitHubInstallationSummary = {\n  installationId: number;\n  accountId: number;\n  accountLogin: string | null;\n  accountType: string | null;\n  suspended: boolean;\n};\n\nexport type GitHubInstallationAuthorityKind = \"personal_owner\" | \"organization_owner\";\n\nexport interface GitHubInstallationBindingProof {\n  actorId: number;\n  actorLogin: string;\n  authorityKind: GitHubInstallationAuthorityKind;\n  installation: GitHubInstallationSummary;\n  repositories: GitHubRepository[];\n}\n\nexport type GitHubRepositoryPermissions = {\n  admin: boolean;\n  maintain: boolean;\n  push: boolean;\n  triage: boolean;\n  pull: boolean;\n};\n\nexport type GitHubUserRepositoryAccess = GitHubRepository & {\n  permissions: GitHubRepositoryPermissions;\n};\n\nexport type GitHubUserInstallationAccess = GitHubInstallationSummary & {\n  repositories: GitHubUserRepositoryAccess[];\n};\n\nexport type GitHubAppApiPort = {\n  /**\n   * Exchange one fresh GitHub user-authorization code and prove current\n   * installation authority. Implementations must accept only exact personal\n   * ownership or active organization ownership; installation visibility,\n   * repository permission bits, and App Manager metadata are not authority.\n   * Organization ownership must be revalidated after repository discovery,\n   * immediately before returning the proof used by the durable bind.\n   */\n  authorizeInstallationBinding?: (input: {\n    code: string;\n    installationId: number;\n  }) => Promise<GitHubInstallationBindingProof>;\n  authorizeUser?: (input: { code: string }) => Promise<GitHubUserInstallationAccess[]>;\n  verifyInstallationAccessForUser?: (input: {\n    code: string;\n    installationId: number;\n  }) => Promise<GitHubInstallationSummary>;\n  getInstallation?: (input: {\n    installationId: number;\n  }) => Promise<GitHubInstallationSummary | null>;\n  listRepositories?: (input: { installationIds?: number[] }) => Promise<GitHubRepository[]>;\n};\n\nexport const BillingBalance = z.object({\n  accountId: z.string().uuid(),\n  balanceMicros: z.number().int(),\n  currency: z.literal(\"usd\"),\n  updatedAt: z.string(),\n});\nexport type BillingBalance = z.infer<typeof BillingBalance>;\n\nexport const CreateCheckoutRequest = z.object({\n  accountId: z.string().uuid().optional(),\n  amountUsd: z\n    .number()\n    .min(5)\n    .max(10_000)\n    .refine(\n      (value) => Number.isFinite(value) && Math.abs(value - Math.round(value * 100) / 100) < 1e-9,\n      { message: \"amountUsd must use cent precision\" },\n    ),\n  successUrl: z.string().url().optional(),\n  cancelUrl: z.string().url().optional(),\n});\nexport type CreateCheckoutRequest = z.infer<typeof CreateCheckoutRequest>;\n\nexport const CreateCheckoutResponse = z.object({\n  checkoutSessionId: z.string(),\n  url: z.string().url(),\n});\nexport type CreateCheckoutResponse = z.infer<typeof CreateCheckoutResponse>;\n\nexport const RepositoryResourceRef = z.object({\n  kind: z.literal(\"repository\"),\n  uri: z.string().min(1),\n  ref: z.string().min(1),\n  mountPath: z.string().min(1).optional(),\n  subpath: z.string().min(1).optional(),\n  provider: GitCredentialProvider.optional(),\n  credentialBindingId: GitCredentialBindingId.optional(),\n  access: GitRepositoryAccess.optional(),\n  repositoryId: GitProviderRepositoryId.optional(),\n  installationId: GitProviderRepositoryId.optional(),\n  projectId: GitProviderRepositoryId.optional(),\n  connectionId: z.string().min(1).optional(),\n  githubInstallationId: z.number().int().positive().optional(),\n  githubRepositoryId: z.number().int().positive().optional(),\n});\nexport type RepositoryResourceRef = z.infer<typeof RepositoryResourceRef>;\n\nfunction positiveGitProviderInteger(value: unknown): number | null {\n  if (typeof value === \"number\" && Number.isInteger(value) && value > 0) return value;\n  if (typeof value === \"string\" && /^\\d+$/.test(value) && Number(value) > 0) {\n    return Number(value);\n  }\n  return null;\n}\n\n/**\n * Resolve whether a repository participates in platform-brokered Git auth.\n * Provider-less public repositories return null; legacy GitHub aliases infer\n * GitHub only when both positive installation and repository ids are present.\n */\nexport function gitCredentialProviderForRepository(\n  resource: RepositoryResourceRef,\n): GitCredentialProvider | null {\n  if (resource.provider) return resource.provider;\n  if (\n    positiveGitProviderInteger(resource.githubInstallationId) &&\n    positiveGitProviderInteger(resource.githubRepositoryId)\n  ) {\n    return \"github\";\n  }\n  return null;\n}\n\n/**\n * Derive the one canonical runtime/broker identity for a repository credential.\n * Every consumer must use this helper so mint grouping, token filenames, and\n * credential-helper routing cannot diverge on legacy provider ids.\n */\nexport function gitCredentialBindingIdForRepository(\n  resource: RepositoryResourceRef,\n  provider: GitCredentialProvider | null = gitCredentialProviderForRepository(resource),\n): GitCredentialBindingId | null {\n  if (!provider) return null;\n  const installationId =\n    provider === \"github\"\n      ? positiveGitProviderInteger(resource.githubInstallationId ?? resource.installationId)\n      : null;\n  return (\n    resource.credentialBindingId ??\n    resource.connectionId ??\n    (installationId ? `github-installation:${installationId}` : provider)\n  );\n}\n\nexport const FileResourceRef = z.object({\n  kind: z.literal(\"file\"),\n  fileId: z.string().uuid(),\n  mountPath: z.string().min(1).optional(),\n});\nexport type FileResourceRef = z.infer<typeof FileResourceRef>;\n\nexport const ResourceRef = z.discriminatedUnion(\"kind\", [RepositoryResourceRef, FileResourceRef]);\nexport type ResourceRef = z.infer<typeof ResourceRef>;\n\nexport class ResourceMountPathError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResourceMountPathError\";\n  }\n}\n\n/**\n * Normalize one workspace-relative resource mount path for every runtime.\n *\n * Backslashes are treated as separators so a path cannot be harmless on Linux\n * but become traversal on a connected Windows machine. Empty, absolute,\n * drive-qualified, dot-segment, NUL-containing, and repeated-separator paths\n * fail closed instead of being silently reinterpreted.\n */\nexport function normalizeResourceMountPath(path: string): string {\n  const normalizedSeparators = path.trim().replace(/\\\\/g, \"/\");\n  if (\n    !normalizedSeparators ||\n    normalizedSeparators.startsWith(\"/\") ||\n    /^[A-Za-z]:\\//.test(normalizedSeparators) ||\n    normalizedSeparators.includes(\"\\0\")\n  ) {\n    throw new ResourceMountPathError(`invalid resource mount path: ${path}`);\n  }\n  const segments = normalizedSeparators.split(\"/\");\n  if (\n    segments.some(\n      (segment) =>\n        !segment ||\n        segment === \".\" ||\n        segment === \"..\" ||\n        /[<>:\"|?*\\u0000-\\u001f]/.test(segment) ||\n        /[ .]$/.test(segment) ||\n        /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\\.|$)/i.test(segment),\n    )\n  ) {\n    throw new ResourceMountPathError(`invalid resource mount path: ${path}`);\n  }\n  return segments.join(\"/\");\n}\n\n/** Normalize a repository-internal subpath while preserving legacy `/path/` input. */\nexport function normalizeRepositorySubpath(path: string): string {\n  const relative = path\n    .trim()\n    .replace(/\\\\/g, \"/\")\n    .replace(/^\\/+|\\/+$/g, \"\");\n  return normalizeResourceMountPath(relative);\n}\n\n/** A conservative collision identity that is portable to case-insensitive hosts. */\nexport function resourceMountPathCollisionKey(path: string): string {\n  return normalizeResourceMountPath(path).normalize(\"NFKC\").toLowerCase();\n}\n\n/**\n * Default repository mount identity. The normalized remote host (including a\n * non-default port) is part of the path, so equal owner/repo names on GitHub,\n * GitLab, Azure DevOps, or a custom host do not collide. Encoding the host keeps\n * IPv6/custom-port identities inside one portable path segment.\n */\nexport function defaultRepositoryMountPath(uri: string): string {\n  let url: URL;\n  try {\n    url = new URL(uri);\n  } catch {\n    throw new ResourceMountPathError(`invalid repository URI for mount path: ${uri}`);\n  }\n  if (url.protocol !== \"https:\" || !url.host) {\n    throw new ResourceMountPathError(`invalid repository URI for mount path: ${uri}`);\n  }\n  const repositoryPath = url.pathname.replace(/^\\/+|\\/+$/g, \"\").replace(/\\.git$/, \"\");\n  const segments = repositoryPath.split(\"/\").filter(Boolean);\n  if (segments.length < 2) {\n    throw new ResourceMountPathError(`repository URI must include owner and repo: ${uri}`);\n  }\n  return normalizeResourceMountPath(\n    `repos/${encodeURIComponent(url.host.toLowerCase())}/${segments.join(\"/\")}`,\n  );\n}\n\n/** Resolve the exact mount used by API normalization, manifests, and clone hooks. */\nexport function resourceMountPath(resource: ResourceRef): string {\n  if (resource.mountPath) return normalizeResourceMountPath(resource.mountPath);\n  return resource.kind === \"file\"\n    ? normalizeResourceMountPath(`files/${resource.fileId}`)\n    : defaultRepositoryMountPath(resource.uri);\n}\n\n/** Fail before sandbox execution when two resources share a portable path. */\nexport function assertUniqueResourceMountPaths(resources: readonly ResourceRef[]): void {\n  const mounted = new Set<string>();\n  for (const resource of resources) {\n    const path = resourceMountPath(resource);\n    const key = resourceMountPathCollisionKey(path);\n    if (mounted.has(key)) {\n      throw new ResourceRefConflictError(`resource mount path is already attached: ${path}`);\n    }\n    mounted.add(key);\n  }\n}\n\nexport const FileStatus = z.enum([\"pending_upload\", \"ready\", \"failed\", \"expired\", \"deleted\"]);\nexport type FileStatus = z.infer<typeof FileStatus>;\n\nexport const FileUploadStatus = z.enum([\n  \"pending\",\n  \"cleanup_pending\",\n  \"completed\",\n  \"expired\",\n  \"failed\",\n]);\nexport type FileUploadStatus = z.infer<typeof FileUploadStatus>;\n\nexport const FileAsset = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  status: FileStatus,\n  filename: z.string(),\n  safeFilename: z.string(),\n  contentType: z.string(),\n  sizeBytes: z.number().int().nonnegative(),\n  sha256: z.string().nullable(),\n  bucket: z.string(),\n  objectKey: z.string(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type FileAsset = z.infer<typeof FileAsset>;\n\nexport const CreateFileUploadRequest = z.object({\n  filename: z.string().min(1),\n  contentType: z.string().min(1),\n  sizeBytes: z.number().int().positive(),\n  sha256: z.string().min(1).optional(),\n});\nexport type CreateFileUploadRequest = z.infer<typeof CreateFileUploadRequest>;\n\nexport const CreateFileUploadResponse = z.object({\n  fileId: z.string().uuid(),\n  uploadId: z.string().uuid(),\n  putUrl: z.string().url(),\n  requiredHeaders: z.record(z.string(), z.string()),\n  expiresAt: z.string(),\n  maxSizeBytes: z.number().int().positive(),\n});\nexport type CreateFileUploadResponse = z.infer<typeof CreateFileUploadResponse>;\n\nexport const CompleteFileUploadResponse = z.object({\n  file: FileAsset,\n});\nexport type CompleteFileUploadResponse = z.infer<typeof CompleteFileUploadResponse>;\n\nexport const FileDownloadUrlResponse = z.object({\n  url: z.string().url(),\n  expiresAt: z.string(),\n});\nexport type FileDownloadUrlResponse = z.infer<typeof FileDownloadUrlResponse>;\n\nexport const DocumentStatus = z.enum([\"queued\", \"indexing\", \"ready\", \"failed\"]);\nexport type DocumentStatus = z.infer<typeof DocumentStatus>;\n\nexport const KnowledgeSourceKind = z.enum([\n  \"manual_upload\",\n  \"meeting_transcript\",\n  \"repository\",\n  \"email\",\n  \"chat\",\n  \"document\",\n  \"web\",\n  \"other\",\n]);\nexport type KnowledgeSourceKind = z.infer<typeof KnowledgeSourceKind>;\n\nexport const DocumentSearchMode = z.enum([\"hybrid\", \"vector\", \"keyword\"]);\nexport type DocumentSearchMode = z.infer<typeof DocumentSearchMode>;\n\n// 'workspace' documents are readable by anyone with workspace access;\n// 'private' documents are readable only by the grant subject that created them.\nexport const DocumentVisibility = z.enum([\"workspace\", \"private\"]);\nexport type DocumentVisibility = z.infer<typeof DocumentVisibility>;\n\n// Knowledge-drop auto-curation lifecycle. 'none' = ordinary caller-described add\n// (never auto-curated). 'pending' = dropped, curation runs during indexing.\n// 'suggested' = curated but the base move was NOT applied (low confidence or\n// conflict) — the suggestion lives in Document.curation. 'auto_filed' = curated\n// and moved into the suggested base. 'failed' = curation errored (fail-soft;\n// the document still indexes and stays searchable).\nexport const DocumentCurationStatus = z.enum([\n  \"none\",\n  \"pending\",\n  \"suggested\",\n  \"auto_filed\",\n  \"failed\",\n]);\nexport type DocumentCurationStatus = z.infer<typeof DocumentCurationStatus>;\n\n// Curator audit blob persisted on the document.\nexport const DocumentCuration = z.object({\n  suggestedBaseId: z.string().uuid().nullable(),\n  suggestedBaseName: z.string().nullable(),\n  confidence: z.number().min(0).max(1),\n  reason: z.string().nullable(),\n  originalTitle: z.string().nullable(),\n  model: z.string().nullable(),\n});\nexport type DocumentCuration = z.infer<typeof DocumentCuration>;\n\nexport const DocumentBase = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  name: z.string(),\n  description: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type DocumentBase = z.infer<typeof DocumentBase>;\n\nexport const Document = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  baseId: z.string().uuid(),\n  fileId: z.string().uuid(),\n  status: DocumentStatus,\n  title: z.string(),\n  parser: z.string(),\n  chunkCount: z.number().int().nonnegative(),\n  error: z.string().nullable(),\n  sourceKind: KnowledgeSourceKind,\n  sourceUri: z.string().nullable(),\n  sourceExternalId: z.string().nullable(),\n  sourceTitle: z.string().nullable(),\n  sourceAuthor: z.string().nullable(),\n  sourceCreatedAt: z.string().nullable(),\n  sourceUpdatedAt: z.string().nullable(),\n  sourceVersion: z.string().nullable(),\n  aclTags: z.array(z.string()),\n  visibility: DocumentVisibility,\n  createdBy: z.string().nullable(),\n  agentAccess: z.boolean(),\n  summary: z.string().nullable(),\n  topics: z.array(z.string()),\n  curationStatus: DocumentCurationStatus,\n  curation: DocumentCuration.nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type Document = z.infer<typeof Document>;\n\nexport const DocumentSearchResult = z.object({\n  chunkId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  documentId: z.string().uuid(),\n  baseId: z.string().uuid(),\n  fileId: z.string().uuid(),\n  title: z.string(),\n  text: z.string(),\n  score: z.number(),\n  matchType: DocumentSearchMode,\n  vectorScore: z.number().nullable(),\n  keywordScore: z.number().nullable(),\n  chunkIndex: z.number().int().nonnegative(),\n  metadata: z.record(z.string(), z.unknown()),\n  sourceKind: KnowledgeSourceKind,\n  sourceUri: z.string().nullable(),\n  sourceExternalId: z.string().nullable(),\n  sourceTitle: z.string().nullable(),\n  sourceAuthor: z.string().nullable(),\n  sourceCreatedAt: z.string().nullable(),\n  sourceUpdatedAt: z.string().nullable(),\n  sourceVersion: z.string().nullable(),\n  aclTags: z.array(z.string()),\n});\nexport type DocumentSearchResult = z.infer<typeof DocumentSearchResult>;\n\nexport const CreateDocumentBaseRequest = z.object({\n  name: z.string().min(1),\n  description: z.string().optional(),\n});\nexport type CreateDocumentBaseRequest = z.infer<typeof CreateDocumentBaseRequest>;\n\nexport const AddDocumentRequest = z.object({\n  fileId: z.string().uuid(),\n  title: z.string().min(1).optional(),\n  sourceKind: KnowledgeSourceKind.optional(),\n  sourceUri: z.string().min(1).optional(),\n  sourceExternalId: z.string().min(1).optional(),\n  sourceTitle: z.string().min(1).optional(),\n  sourceAuthor: z.string().min(1).optional(),\n  sourceCreatedAt: z.string().datetime({ offset: true }).optional(),\n  sourceUpdatedAt: z.string().datetime({ offset: true }).optional(),\n  sourceVersion: z.string().min(1).optional(),\n  aclTags: z.array(z.string().min(1)).optional(),\n  visibility: DocumentVisibility.optional(),\n  agentAccess: z.boolean().optional(),\n});\nexport type AddDocumentRequest = z.infer<typeof AddDocumentRequest>;\n\n// A knowledge drop: raw text or an already-uploaded file, with no required\n// metadata. The server files it into the workspace Default base. When a\n// curation provider is enabled, it may name, summarize, categorize, and\n// (confidence permitting) move the document; provider=none leaves caller\n// metadata and Default placement unchanged.\nexport const CreateKnowledgeDropRequest = z\n  .object({\n    text: z.string().min(1).max(2_000_000).optional(),\n    fileId: z.string().uuid().optional(),\n    filename: z.string().min(1).optional(),\n    title: z.string().min(1).optional(),\n    visibility: DocumentVisibility.optional(),\n    agentAccess: z.boolean().optional(),\n  })\n  .refine((value) => (value.text === undefined) !== (value.fileId === undefined), {\n    message: \"provide exactly one of text or fileId\",\n  });\nexport type CreateKnowledgeDropRequest = z.infer<typeof CreateKnowledgeDropRequest>;\n\n// Move a document (and its indexed chunks) to another base. With no explicit\n// targetBaseId, applies the document's stored curation suggestion.\nexport const MoveDocumentRequest = z.object({\n  targetBaseId: z.string().uuid().optional(),\n});\nexport type MoveDocumentRequest = z.infer<typeof MoveDocumentRequest>;\n\nexport const DocumentSearchRequest = z.object({\n  query: z.string().min(1),\n  baseIds: z.array(z.string().uuid()).optional(),\n  mode: DocumentSearchMode.optional(),\n  sourceKinds: z.array(KnowledgeSourceKind).optional(),\n  aclTags: z.array(z.string().min(1)).optional(),\n  limit: z.number().int().positive().max(50).default(5),\n});\nexport type DocumentSearchRequest = z.infer<typeof DocumentSearchRequest>;\n\n// proposed/approved/rejected are the legacy curated-knowledge review states\n// (docs-MCP memory_propose lane). active/superseded/archived are Workspace\n// Memory V1: agent-written memories land `active` (usable immediately — human is\n// auditor, not gatekeeper), get `superseded` when replaced, `archived` when\n// retired. Agent-visible set = active ∪ approved.\nexport const KnowledgeMemoryStatus = z.enum([\n  \"proposed\",\n  \"approved\",\n  \"rejected\",\n  \"active\",\n  \"superseded\",\n  \"archived\",\n]);\nexport type KnowledgeMemoryStatus = z.infer<typeof KnowledgeMemoryStatus>;\n\nexport const KnowledgeMemoryKind = z.enum([\n  \"semantic\",\n  \"episodic\",\n  \"procedural\",\n  \"decision\",\n  \"preference\",\n]);\nexport type KnowledgeMemoryKind = z.infer<typeof KnowledgeMemoryKind>;\n\nexport const KnowledgeSourceRef = z.object({\n  kind: z.enum([\"document_chunk\", \"document\", \"session_event\", \"memory\", \"external\"]),\n  id: z.string().min(1),\n  uri: z.string().min(1).optional(),\n  title: z.string().min(1).optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type KnowledgeSourceRef = z.infer<typeof KnowledgeSourceRef>;\n\nexport const KnowledgeMemory = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  status: KnowledgeMemoryStatus,\n  kind: KnowledgeMemoryKind,\n  scope: z.string(),\n  text: z.string(),\n  sourceRefs: z.array(KnowledgeSourceRef),\n  confidence: z.number().min(0).max(1),\n  metadata: z.record(z.string(), z.unknown()),\n  createdBySessionId: z.string().uuid().nullable(),\n  reviewedBy: z.string().nullable(),\n  reviewedAt: z.string().nullable(),\n  // Workspace Memory V1 fields. usageCount/lastUsedAt feed end-state ranking and\n  // decay; supersedesId/supersededById link correction chains; validFrom/validUntil\n  // are the point-in-time window. embedding/embeddingModel/textHash are internal\n  // and never exposed on the wire.\n  pinned: z.boolean(),\n  usageCount: z.number().int(),\n  lastUsedAt: z.string().nullable(),\n  supersedesId: z.string().uuid().nullable(),\n  supersededById: z.string().uuid().nullable(),\n  validFrom: z.string(),\n  validUntil: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type KnowledgeMemory = z.infer<typeof KnowledgeMemory>;\n\n// Default status is `active`: a create through this request lands an\n// agent-visible memory via the one write gate (saveWorkspaceMemory). Passing an\n// explicit `proposed`/`approved`/`rejected` status routes to the legacy curated\n// create instead (the docs-MCP memory_propose lane). pinned/replacesId apply to\n// the active (memory) path.\nexport const CreateKnowledgeMemoryRequest = z.object({\n  status: KnowledgeMemoryStatus.default(\"active\"),\n  kind: KnowledgeMemoryKind.default(\"semantic\"),\n  scope: z.string().min(1).default(\"workspace\"),\n  text: z.string().min(1),\n  sourceRefs: z.array(KnowledgeSourceRef).default([]),\n  confidence: z.number().min(0).max(1).default(0.5),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  createdBySessionId: z.string().uuid().optional(),\n  pinned: z.boolean().optional(),\n  replacesId: z.string().min(1).optional(),\n});\nexport type CreateKnowledgeMemoryRequest = z.infer<typeof CreateKnowledgeMemoryRequest>;\n\nexport const UpdateKnowledgeMemoryRequest = z.object({\n  status: KnowledgeMemoryStatus.optional(),\n  kind: KnowledgeMemoryKind.optional(),\n  scope: z.string().min(1).optional(),\n  text: z.string().min(1).optional(),\n  sourceRefs: z.array(KnowledgeSourceRef).optional(),\n  confidence: z.number().min(0).max(1).optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n  reviewedBy: z.string().min(1).optional(),\n  // Human audit action: pin (never decays) / unpin.\n  pinned: z.boolean().optional(),\n});\nexport type UpdateKnowledgeMemoryRequest = z.infer<typeof UpdateKnowledgeMemoryRequest>;\n\n// GET list/filter over knowledge memories (curated + memory).\nexport const KnowledgeMemorySearchRequest = z.object({\n  query: z.string().min(1).optional(),\n  status: KnowledgeMemoryStatus.optional(),\n  kind: KnowledgeMemoryKind.optional(),\n  scope: z.string().min(1).optional(),\n  limit: z.number().int().positive().max(100).default(20),\n});\nexport type KnowledgeMemorySearchRequest = z.infer<typeof KnowledgeMemorySearchRequest>;\n\nexport const WorkspaceMemorySearchMode = z.enum([\"hybrid\", \"vector\", \"keyword\"]);\nexport type WorkspaceMemorySearchMode = z.infer<typeof WorkspaceMemorySearchMode>;\n\n// POST hybrid search over the workspace's agent-visible memory (active ∪ approved).\nexport const WorkspaceMemorySearchRequest = z.object({\n  query: z.string().min(1),\n  kind: KnowledgeMemoryKind.optional(),\n  limit: z.number().int().positive().max(20).optional(),\n  mode: WorkspaceMemorySearchMode.optional(),\n});\nexport type WorkspaceMemorySearchRequest = z.infer<typeof WorkspaceMemorySearchRequest>;\n\nexport const WorkspaceMemorySearchResult = z.object({\n  memory: KnowledgeMemory,\n  score: z.number(),\n  matchType: WorkspaceMemorySearchMode,\n  vectorScore: z.number().nullable(),\n  keywordScore: z.number().nullable(),\n});\nexport type WorkspaceMemorySearchResult = z.infer<typeof WorkspaceMemorySearchResult>;\n\nexport const WorkspaceMemorySearchResponse = z.object({\n  results: z.array(WorkspaceMemorySearchResult),\n});\nexport type WorkspaceMemorySearchResponse = z.infer<typeof WorkspaceMemorySearchResponse>;\n\nexport const ToolRef = z.object({\n  kind: z.literal(\"mcp\"),\n  id: z.string().min(1),\n  // Non-fatal-on-connect marker for MCP server refs that can degrade\n  // gracefully. Absent/false is STRICT: the id must be configured and an\n  // unavailable server fails the turn. `optional:true` is preserved for known\n  // servers and makes runtime connect/list failures skip that server; if the\n  // deployment does not configure the id, validation drops the ref. The server\n  // also sets this for auto-attached workspace-default capability MCPs.\n  optional: z.boolean().optional(),\n});\nexport type ToolRef = z.infer<typeof ToolRef>;\n\nconst registryId = /^[A-Za-z0-9_-]+$/;\nexport const SessionMcpServerId = z.string().min(1).regex(registryId);\nexport type SessionMcpServerId = z.infer<typeof SessionMcpServerId>;\n\n// How a session's persisted `tools` snapshot was selected. `legacy` is\n// reserved for rows written before this descriptor existed; those rows must\n// keep their materialized historical allow-list rather than being guessed to\n// mean either omitted or explicitly empty.\nexport const SessionToolPolicy = z.object({\n  mode: z.enum([\"workspace_default\", \"explicit\", \"inherited\", \"legacy\"]),\n  inheritedFromSessionId: z.string().uuid().nullable(),\n});\nexport type SessionToolPolicy = z.infer<typeof SessionToolPolicy>;\n\nexport const SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT = 64;\nexport const SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH = 200;\nconst SessionEffectiveToolPolicyId = z\n  .string()\n  .min(1)\n  .max(SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH)\n  .regex(registryId);\nconst SessionEffectiveToolPolicyIds = z\n  .array(SessionEffectiveToolPolicyId)\n  .max(SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT);\n\n// Secret-safe, read-time policy truth. This projection contains only bounded\n// MCP registry ids and exact counts: never URLs, names, headers, credentials,\n// connector configuration, or tool schemas. IDs are samples when capped;\n// counts remain exact and idsTruncated makes that explicit to clients.\nexport const SessionEffectiveToolPolicy = z\n  .object({\n    mode: z.enum([\"workspace_default\", \"explicit\", \"inherited\", \"legacy\"]),\n    inheritedFromSessionId: z.string().uuid().nullable(),\n    selectedIds: SessionEffectiveToolPolicyIds,\n    effectiveIds: SessionEffectiveToolPolicyIds,\n    mandatoryIds: SessionEffectiveToolPolicyIds,\n    lazyRouter: z\n      .object({\n        state: z.enum([\"required\", \"disabled\"]),\n        deferredIds: SessionEffectiveToolPolicyIds,\n      })\n      .strict(),\n    configuredIds: SessionEffectiveToolPolicyIds,\n    droppedIds: SessionEffectiveToolPolicyIds,\n    counts: z\n      .object({\n        selected: z.number().int().nonnegative(),\n        effective: z.number().int().nonnegative(),\n        mandatory: z.number().int().nonnegative(),\n        deferred: z.number().int().nonnegative(),\n        configured: z.number().int().nonnegative(),\n        dropped: z.number().int().nonnegative(),\n      })\n      .strict(),\n    idsTruncated: z.boolean(),\n  })\n  .strict();\nexport type SessionEffectiveToolPolicy = z.infer<typeof SessionEffectiveToolPolicy>;\nconst httpsUrl = z\n  .string()\n  .url()\n  .refine(\n    (value) => {\n      try {\n        return new URL(value).protocol === \"https:\";\n      } catch {\n        return false;\n      }\n    },\n    { message: \"URL must use https\" },\n  );\n\n/**\n * Human-approval policy for one MCP server. `true` gates every tool, `false`\n * gates none, and a list gates only those unprefixed names.\n */\nexport const SESSION_MCP_APPROVAL_POLICY_MAX_TOOL_NAMES = 2_048;\nexport const SESSION_MCP_APPROVAL_POLICY_MAX_BYTES = 256 * 1024;\nexport const SESSION_MCP_APPROVAL_TOOL_NAME_MAX_BYTES = 1_024;\nexport const SESSION_MCP_SERVERS_MAX = 64;\n\nconst sessionMcpApprovalToolName = z\n  .string()\n  .min(1)\n  .superRefine((name, ctx) => {\n    if (new TextEncoder().encode(name).byteLength > SESSION_MCP_APPROVAL_TOOL_NAME_MAX_BYTES) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: `MCP approval tool names must be at most ${SESSION_MCP_APPROVAL_TOOL_NAME_MAX_BYTES} UTF-8 bytes`,\n      });\n    }\n  });\nconst selectiveSessionMcpApprovalPolicy = z\n  .array(sessionMcpApprovalToolName)\n  .max(SESSION_MCP_APPROVAL_POLICY_MAX_TOOL_NAMES)\n  .superRefine((names, ctx) => {\n    const bytes = names.reduce(\n      (total, name) => total + new TextEncoder().encode(name).byteLength,\n      0,\n    );\n    if (bytes > SESSION_MCP_APPROVAL_POLICY_MAX_BYTES) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: `MCP approval policies must be at most ${SESSION_MCP_APPROVAL_POLICY_MAX_BYTES} UTF-8 bytes`,\n      });\n    }\n  })\n  .transform((names) => [...new Set(names)].sort());\nexport const SessionMcpApprovalPolicy = z.union([z.boolean(), selectiveSessionMcpApprovalPolicy]);\nexport type SessionMcpApprovalPolicy = z.infer<typeof SessionMcpApprovalPolicy>;\n\nexport const SessionMcpServerInput = z.object({\n  id: SessionMcpServerId,\n  name: z.string().min(1).optional(),\n  url: httpsUrl,\n  allowedTools: z.array(z.string().min(1)).optional(),\n  timeoutMs: z.number().int().positive().optional(),\n  cacheToolsList: z.boolean().optional(),\n  // The caller resolves an approval pause with `user.approvalDecision`.\n  requireApproval: SessionMcpApprovalPolicy.optional(),\n  // Write-only credential headers. Values are encrypted at rest and never\n  // returned in session responses or events; response metadata exposes names.\n  headers: z.record(z.string(), z.string()).optional(),\n  // Non-secret opaque pointer resolved at request time by the standalone\n  // connection broker or an embedding host's mcpCredentials port.\n  connectionRef: McpServerConnectionRef.optional(),\n});\nexport type SessionMcpServerInput = z.infer<typeof SessionMcpServerInput>;\n\nexport const SessionMcpCredentialUpdateInput = z.object({\n  id: SessionMcpServerId,\n  headers: z.record(z.string(), z.string()),\n});\nexport type SessionMcpCredentialUpdateInput = z.infer<typeof SessionMcpCredentialUpdateInput>;\n\nexport const SessionMcpServerMetadata = z\n  .object({\n    id: SessionMcpServerId,\n    name: z.string().min(1).nullable(),\n    url: httpsUrl,\n    headerNames: z.array(z.string()).default([]),\n    credentialVersion: z.number().int().positive(),\n    requireApproval: SessionMcpApprovalPolicy.default(false),\n    connectionRef: McpServerConnectionRef.nullable().default(null),\n  })\n  .strict();\nexport type SessionMcpServerMetadata = z.infer<typeof SessionMcpServerMetadata>;\n\nexport const UpdateSessionMcpApprovalPolicyRequest = z\n  .object({\n    requireApproval: SessionMcpApprovalPolicy,\n  })\n  .strict();\nexport type UpdateSessionMcpApprovalPolicyRequest = z.infer<\n  typeof UpdateSessionMcpApprovalPolicyRequest\n>;\n\nexport const UpdateSessionMcpApprovalPolicyResponse = z\n  .object({\n    server: SessionMcpServerMetadata,\n    effectiveFrom: z.literal(\"next_attempt\"),\n  })\n  .strict();\nexport type UpdateSessionMcpApprovalPolicyResponse = z.infer<\n  typeof UpdateSessionMcpApprovalPolicyResponse\n>;\n\nexport class ResourceRefConflictError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResourceRefConflictError\";\n  }\n}\n\nexport function mergeToolRefs(existing: ToolRef[], additions: ToolRef[]): ToolRef[] {\n  const byKey = new Map<string, ToolRef>();\n  const order: string[] = [];\n  for (const tool of [...existing, ...additions]) {\n    const key = `${tool.kind}:${tool.id}`;\n    const prior = byKey.get(key);\n    if (!prior) {\n      byKey.set(key, tool);\n      order.push(key);\n      continue;\n    }\n    // Strict wins: if the same server appears both optional and strict, the\n    // strict occurrence upgrades the merged ref so an unavailable server fails\n    // the turn. This preserves the fail-loud default when defaults, packs, and\n    // per-turn tool selections are combined.\n    if (prior.optional === true && tool.optional !== true) {\n      const { optional: _dropped, ...strict } = prior;\n      byKey.set(key, strict);\n    }\n  }\n  return order.map((key) => byKey.get(key)!);\n}\n\nexport function mergeResourceRefs(\n  existing: ResourceRef[],\n  additions: ResourceRef[],\n  options: { rejectConflicts?: boolean } = {},\n): ResourceRef[] {\n  if (options.rejectConflicts) {\n    assertUniqueResourceMountPaths(existing);\n  }\n  const out = [...existing];\n  const mountPaths = new Map(\n    existing.map(\n      (resource) =>\n        [resourceMountPathCollisionKey(resourceMountPath(resource)), stableJson(resource)] as const,\n    ),\n  );\n  const identities = new Map(\n    existing.map((resource) => [resourceIdentityKey(resource), stableJson(resource)] as const),\n  );\n  const exact = new Set(existing.map(stableJson));\n\n  for (const resource of additions) {\n    const serialized = stableJson(resource);\n    if (exact.has(serialized)) {\n      continue;\n    }\n    if (options.rejectConflicts) {\n      const mountPath = resourceMountPath(resource);\n      const existingAtMount = mountPaths.get(resourceMountPathCollisionKey(mountPath));\n      if (existingAtMount && existingAtMount !== serialized) {\n        throw new ResourceRefConflictError(`resource mount path is already attached: ${mountPath}`);\n      }\n      const identity = resourceIdentityKey(resource);\n      const existingIdentity = identities.get(identity);\n      if (existingIdentity && existingIdentity !== serialized) {\n        throw new ResourceRefConflictError(\n          `resource is already attached with different settings: ${identity}`,\n        );\n      }\n    }\n    out.push(resource);\n    exact.add(serialized);\n    identities.set(resourceIdentityKey(resource), serialized);\n    mountPaths.set(resourceMountPathCollisionKey(resourceMountPath(resource)), serialized);\n  }\n  return out;\n}\n\nexport function reasoningEffortForMetadata(\n  metadata: Record<string, unknown>,\n  fallback: ReasoningEffort,\n): ReasoningEffort {\n  const value = metadata.reasoningEffort;\n  return value === \"none\" ||\n    value === \"minimal\" ||\n    value === \"low\" ||\n    value === \"medium\" ||\n    value === \"high\" ||\n    value === \"xhigh\"\n    ? value\n    : fallback;\n}\n\nexport function stableJson(value: unknown): string {\n  return JSON.stringify(sortJson(value));\n}\n\nexport function resourceIdentityKey(resource: ResourceRef): string {\n  if (resource.kind === \"file\") {\n    return `file:${resource.fileId}`;\n  }\n  return `repository:${resource.uri}`;\n}\n\nfunction sortJson(value: unknown): unknown {\n  if (Array.isArray(value)) {\n    return value.map(sortJson);\n  }\n  if (value && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value)\n        .sort(([a], [b]) => a.localeCompare(b))\n        .map(([key, nested]) => [key, sortJson(nested)]),\n    );\n  }\n  return value;\n}\n\nexport const SessionTurnStatus = z.enum([\n  \"queued\",\n  \"running\",\n  \"requires_action\",\n  \"recovering\",\n  \"waiting_capacity\",\n  \"completed\",\n  \"failed\",\n  \"cancelled\",\n  \"superseded\",\n  \"withdrawn_for_edit\",\n]);\nexport type SessionTurnStatus = z.infer<typeof SessionTurnStatus>;\n\nexport const SessionTurnSource = z.enum([\n  \"user\",\n  \"scheduled_task\",\n  \"api\",\n  \"goal\",\n  \"system\",\n  \"compaction\",\n]);\nexport type SessionTurnSource = z.infer<typeof SessionTurnSource>;\n\nexport const SessionControlState = z.enum([\"active\", \"paused\"]);\nexport type SessionControlState = z.infer<typeof SessionControlState>;\n\nexport const WorkspaceInferenceState = z.enum([\"active\", \"paused\"]);\nexport type WorkspaceInferenceState = z.infer<typeof WorkspaceInferenceState>;\n\nexport const SessionGoalStatus = z.enum([\"active\", \"paused\", \"completed\"]);\nexport type SessionGoalStatus = z.infer<typeof SessionGoalStatus>;\n\nexport const SessionGoalCreatedBy = z.enum([\"api\", \"agent\", \"scheduled_task\"]);\nexport type SessionGoalCreatedBy = z.infer<typeof SessionGoalCreatedBy>;\n\nexport const SessionGoalPausedReason = z.enum([\n  \"agent\",\n  \"user_pause\",\n  \"api\",\n  \"no_progress\",\n  \"max_auto_continuations\",\n  \"limits\",\n]);\nexport type SessionGoalPausedReason = z.infer<typeof SessionGoalPausedReason>;\n\nexport const SessionGoalContinuationState = z.enum([\n  \"inactive\",\n  \"scheduled\",\n  \"running\",\n  \"blocked\",\n  \"invariant_broken\",\n]);\nexport type SessionGoalContinuationState = z.infer<typeof SessionGoalContinuationState>;\n\nexport const SessionGoalContinuationReason = z.enum([\n  \"goal_inactive\",\n  \"wake_pending\",\n  \"continuation_pending\",\n  \"human_work_pending\",\n  \"goal_turn_running\",\n  \"human_turn_running\",\n  \"workstream_paused\",\n  \"approval_required\",\n  \"provider_backpressure\",\n  \"session_cancelled\",\n  \"system_work_pending\",\n  \"missing_obligation\",\n]);\nexport type SessionGoalContinuationReason = z.infer<typeof SessionGoalContinuationReason>;\n\nexport const SessionGoalContinuation = z.object({\n  state: SessionGoalContinuationState,\n  reason: SessionGoalContinuationReason,\n  wakeRevision: z.number().int().nonnegative(),\n  observedRevision: z.number().int().nonnegative(),\n  nextAttemptAt: z.string().datetime({ offset: true }).nullable(),\n  lastError: z.string().nullable(),\n});\nexport type SessionGoalContinuation = z.infer<typeof SessionGoalContinuation>;\n\nexport const SessionGoal = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  status: SessionGoalStatus,\n  text: z.string(),\n  successCriteria: z.string().nullable(),\n  evidence: z.string().nullable(),\n  rationale: z.string().nullable(),\n  pausedReason: z.string().nullable(),\n  createdBy: SessionGoalCreatedBy,\n  version: z.number().int().positive(),\n  autoContinuations: z.number().int().nonnegative(),\n  noProgressStreak: z.number().int().nonnegative(),\n  maxAutoContinuations: z.number().int().positive().nullable(),\n  metadata: z.record(z.string(), z.unknown()),\n  // Optional for source compatibility with older clients; the API always\n  // supplies this authoritative continuation projection.\n  continuation: SessionGoalContinuation.optional(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type SessionGoal = z.infer<typeof SessionGoal>;\n\nexport const GoalSpec = z.object({\n  text: z.string().min(1),\n  successCriteria: z.string().min(1).optional(),\n  maxAutoContinuations: z.number().int().positive().optional(),\n});\nexport type GoalSpec = z.infer<typeof GoalSpec>;\n\nexport const UpdateSessionGoalRequest = z.object({\n  status: z.enum([\"paused\", \"active\"]),\n  rationale: z.string().min(1).optional(),\n});\nexport type UpdateSessionGoalRequest = z.infer<typeof UpdateSessionGoalRequest>;\n\nexport const UpdateSessionRequest = z.object({\n  title: z.string().min(1).max(200),\n});\nexport type UpdateSessionRequest = z.infer<typeof UpdateSessionRequest>;\n\n/**\n * Replace an existing session's durable tool policy, or explicitly opt back in\n * to the current workspace defaults. The mode-less explicit shape is retained\n * for compatibility with clients released before workspace-default adoption\n * was supported.\n */\nexport const UpdateSessionToolPolicyRequest = z.union([\n  z\n    .object({\n      mode: z.literal(\"workspace_default\"),\n      expectedVersion: z.number().int().positive(),\n    })\n    .strict(),\n  z\n    .object({\n      mode: z.literal(\"explicit\").optional(),\n      tools: z.array(ToolRef).max(64),\n      expectedVersion: z.number().int().positive(),\n    })\n    .strict(),\n]);\nexport type UpdateSessionToolPolicyRequest = z.infer<typeof UpdateSessionToolPolicyRequest>;\n\n/**\n * A member's personal pin preference for a session. `expectedVersion` is\n * optional: ordinary pin/unpin actions are idempotent last-write-wins, while a\n * client that has a known version can fail closed rather than overwrite a newer\n * action from another browser.\n */\nexport const UpdateSessionPinRequest = z.object({\n  pinned: z.boolean(),\n  expectedVersion: z.number().int().nonnegative().optional(),\n});\nexport type UpdateSessionPinRequest = z.infer<typeof UpdateSessionPinRequest>;\n\n// Operator context controls (slash-command palette: /clear, /compact). These\n// are session/operator actions, NOT a structured way to talk to the agent —\n// the human↔agent channel stays plain chat. Both require `sessions:control`.\n\n/**\n * Clear a session's conversation context. `confirm` must be the literal `true`\n * so an accidental/empty POST cannot wipe context — the destructive intent is\n * explicit on the wire, mirroring the client-side confirm affordance.\n */\nexport const ClearSessionContextRequest = z.object({\n  confirm: z.literal(true),\n});\nexport type ClearSessionContextRequest = z.infer<typeof ClearSessionContextRequest>;\n\n/**\n * The marker key on the sentinel run-state blob written by a context clear. The\n * blob ({@link CLEARED_RUN_STATE_BLOB}) is NOT a real Agents-SDK serialized run\n * state — it carries no `$schemaVersion`/history, so `RunState.fromString` would\n * throw on it. Every read path that deserializes a run-state blob MUST first\n * check {@link isClearedRunStateBlob} and treat a match as \"no prior state\"\n * (a fresh, empty start), which is exactly what a clear means. This is the\n * shared contract that keeps the db (writer) and the runtime (reader) in sync.\n */\nexport const CLEARED_RUN_STATE_MARKER = \"$opengeniCleared\" as const;\n\n/** The canonical sentinel serializedRunState value a context clear stores. */\nexport const CLEARED_RUN_STATE_BLOB = JSON.stringify({\n  [CLEARED_RUN_STATE_MARKER]: true,\n});\n\n/**\n * True when a serialized run-state blob is the cleared sentinel rather than a\n * real Agents-SDK run state. Recognized leniently (any object carrying the\n * marker key set truthy) so a future field addition to the sentinel does not\n * resurrect the pre-clear context. Anything that is not the sentinel — including\n * malformed JSON — returns false so genuine blobs/corruption are handled by the\n * normal deserialize path.\n */\nexport function isClearedRunStateBlob(serialized: string | null | undefined): boolean {\n  if (!serialized) {\n    return false;\n  }\n  try {\n    const parsed = JSON.parse(serialized) as unknown;\n    return (\n      typeof parsed === \"object\" &&\n      parsed !== null &&\n      (parsed as Record<string, unknown>)[CLEARED_RUN_STATE_MARKER] === true\n    );\n  } catch {\n    return false;\n  }\n}\n\n/** Trigger conversation compaction now. No body fields today (forward-room). */\nexport const CompactSessionContextRequest = z.object({}).strict();\nexport type CompactSessionContextRequest = z.infer<typeof CompactSessionContextRequest>;\n\n/** Outcome of a manual /compact trigger. */\nexport const CompactSessionContextResult = z.object({\n  // pending: an active/paused session will compact at its next safe boundary.\n  // completed: an idle compaction-only activity completed synchronously.\n  // noop: there is no active history to compact.\n  status: z.enum([\"pending\", \"completed\", \"noop\"]),\n  message: z.string(),\n});\nexport type CompactSessionContextResult = z.infer<typeof CompactSessionContextResult>;\n\n/**\n * The principal whose authority accepted a session or turn. `subjectId` is an\n * opaque host/standalone identity and therefore must never encode `kind` by\n * convention: embedding hosts own their subject namespace.\n */\nexport const TurnInitiator = z.object({\n  kind: z.enum([\"subject\", \"service\"]),\n  ...turnInitiatorIdentityFields,\n});\nexport type TurnInitiator = z.infer<typeof TurnInitiator>;\n\n// ============ embedding host session authorization ============\n//\n// Workspace permissions answer whether a principal may use an OpenGeni\n// capability. An embedding host can additionally own per-session visibility\n// (ownership, sharing, nested workspaces, revocation). This port is the one\n// host-neutral boundary for that second decision. Inputs contain OpenGeni ids\n// and immutable, non-secret authority only; host records and policy details\n// never cross the boundary.\n\nexport const SessionAuthorizationSurface = z.enum([\n  \"http\",\n  \"core\",\n  \"stream\",\n  \"first_party_mcp\",\n  \"toolspace\",\n]);\nexport type SessionAuthorizationSurface = z.infer<typeof SessionAuthorizationSurface>;\n\nexport const SessionAuthorizationOperation = z.enum([\n  \"session.read\",\n  \"session.events.read\",\n  \"session.stream.read\",\n  \"session.stream.acknowledge\",\n  \"session.turns.read\",\n  \"session.append\",\n  \"session.steer\",\n  \"session.control\",\n  \"session.queue.read\",\n  \"session.queue.control\",\n  \"session.composer.read\",\n  \"session.composer.write\",\n  \"session.lineage.read\",\n  \"session.capture.read\",\n  \"session.files.read\",\n  \"session.files.write\",\n  \"session.git.read\",\n  \"session.terminal.read\",\n  \"session.terminal.control\",\n  \"session.viewer.read\",\n  \"session.viewer.control\",\n  \"session.first_party_mcp.call\",\n  \"session.toolspace.call\",\n  \"session.pin.write\",\n  \"session.codex_account.write\",\n  \"session.context.write\",\n  \"session.approval.write\",\n  \"session.human_input.read\",\n  \"session.human_input.write\",\n  \"session.title.write\",\n  \"session.mcp.approval_policy.write\",\n  \"session.tool_policy.write\",\n  \"session.goal.read\",\n  \"session.goal.write\",\n  \"session.child.create\",\n]);\nexport type SessionAuthorizationOperation = z.infer<typeof SessionAuthorizationOperation>;\n\nexport const SessionAuthorizationActor = z.discriminatedUnion(\"kind\", [\n  z.object({\n    kind: z.literal(\"subject\"),\n    subjectId: z.string().min(1),\n    subjectLabel: z.string().min(1).optional(),\n  }),\n  z.object({\n    kind: z.literal(\"agent_attempt\"),\n    /** Technical, authenticated first-party caller (not the host authority). */\n    subjectId: z.string().min(1),\n    callerSessionId: z.string().uuid(),\n    callerRootSessionId: z.string().uuid(),\n    turnId: z.string().uuid(),\n    attemptId: z.string().uuid(),\n    executionGeneration: z.number().int().positive(),\n    /** Frozen authority that admitted the calling turn. */\n    initiator: TurnInitiator,\n    initiatorContext: TurnInitiatorContext,\n  }),\n]);\nexport type SessionAuthorizationActor = z.infer<typeof SessionAuthorizationActor>;\n\nexport const SessionAuthorizationTarget = z.object({\n  sessionId: z.string().uuid(),\n  /** Server-resolved workspace lineage root; never accepted from a caller. */\n  rootSessionId: z.string().uuid(),\n});\nexport type SessionAuthorizationTarget = z.infer<typeof SessionAuthorizationTarget>;\n\nexport type AuthorizeSessionInput = {\n  accountId: string;\n  workspaceId: string;\n  actor: SessionAuthorizationActor;\n  target: SessionAuthorizationTarget;\n  operation: SessionAuthorizationOperation;\n  surface: SessionAuthorizationSurface;\n};\n\nexport const SessionAuthorizationDecision = z.discriminatedUnion(\"allowed\", [\n  z.object({\n    allowed: z.literal(true),\n    /**\n     * Whether related-session metadata may be projected with the target.\n     * `target` is the fail-closed default for exact shares; `root` permits the\n     * target's full lineage tree. This does not authorize a separate operation\n     * against another session, which always requires its own decision.\n     */\n    relatedSessionAccess: z.enum([\"target\", \"root\"]).optional(),\n    /** A host may request a tighter stream reauthorization bound. */\n    reauthorizeAfterMs: z.number().int().min(1_000).max(60_000).optional(),\n  }),\n  z.object({\n    allowed: z.literal(false),\n    reason: z.enum([\"not_found\", \"forbidden\", \"revoked\"]),\n  }),\n]);\nexport type SessionAuthorizationDecision = z.infer<typeof SessionAuthorizationDecision>;\n\n/**\n * A database-applicable listing scope. `rootSessionIds` includes every\n * descendant of those lineage anchors; `sessionIds` authorizes only the exact\n * sessions. Supplying neither is an explicit empty scope. OpenGeni intersects\n * every id with the requested workspace and never trusts a host scope as\n * session existence evidence.\n */\nexport const SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS = 10_000;\n\nexport const SessionAuthorizationListScope = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"all\") }),\n  z.object({\n    kind: z.literal(\"scoped\"),\n    rootSessionIds: z.array(z.string().uuid()).max(SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS),\n    sessionIds: z.array(z.string().uuid()).max(SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS),\n  }),\n]);\nexport type SessionAuthorizationListScope = z.infer<typeof SessionAuthorizationListScope>;\n\nexport type ResolveSessionAuthorizationListScopeInput = {\n  accountId: string;\n  workspaceId: string;\n  actor: SessionAuthorizationActor;\n  surface: SessionAuthorizationSurface;\n};\n\nexport type SessionAuthorizationPort = {\n  authorizeSession(input: AuthorizeSessionInput): Promise<SessionAuthorizationDecision>;\n  /**\n   * Return the complete current scope used inside OpenGeni's cursor query.\n   * This is deliberately not a post-filter callback: search, pinning, ordering,\n   * totals, and cursor advancement must all operate on authorized rows.\n   */\n  resolveListScope(\n    input: ResolveSessionAuthorizationListScopeInput,\n  ): Promise<SessionAuthorizationListScope>;\n};\n\nexport const SessionTurn = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  triggerEventId: z.string().uuid(),\n  temporalWorkflowId: z.string(),\n  status: SessionTurnStatus,\n  source: SessionTurnSource,\n  position: z.number().int(),\n  prompt: z.string().min(1),\n  resources: z.array(ResourceRef),\n  tools: z.array(ToolRef),\n  // Omitted/default discovery and explicit `tools: []` are distinct. False\n  // inherits the durable session policy; true replaces it for this turn after\n  // admission proves the selection is a subset.\n  toolsProvided: z.boolean().optional(),\n  model: z.string().min(1),\n  reasoningEffort: ReasoningEffort,\n  sandboxBackend: SandboxBackend,\n  // Per-turn OS override. NULL = inherit the session's sandboxOs.\n  sandboxOs: SandboxOs.nullable(),\n  metadata: z.record(z.string(), z.unknown()),\n  version: z.number().int().positive(),\n  executionGeneration: z.number().int().nonnegative(),\n  activeAttemptId: z.string().uuid().nullable(),\n  lineage: z.record(z.string(), z.unknown()),\n  initiator: TurnInitiator,\n  initiatorContext: TurnInitiatorContext,\n  cancelledBy: z.string().nullable(),\n  cancelReason: z.string().nullable(),\n  startedAt: z.string().nullable(),\n  finishedAt: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type SessionTurn = z.infer<typeof SessionTurn>;\n\nexport const EffectiveControlBlocker = z.object({\n  kind: z.enum([\"session\", \"workspace\"]),\n  sessionId: z.string().uuid().optional(),\n  displayName: z.string().min(1),\n  actor: z.string().nullable(),\n  reason: z.string().nullable(),\n  changedAt: z.string().nullable(),\n  revision: z.number().int().nonnegative(),\n});\nexport type EffectiveControlBlocker = z.infer<typeof EffectiveControlBlocker>;\n\nexport const EffectiveControlResumeOption = z.object({\n  scope: z.enum([\"selected\", \"session\", \"workspace\"]),\n  targetId: z.string().uuid().optional(),\n  selectedStateAfter: SessionControlState,\n  remainingPrimaryBlocker: EffectiveControlBlocker.optional(),\n  impactCopy: z.string().min(1),\n});\nexport type EffectiveControlResumeOption = z.infer<typeof EffectiveControlResumeOption>;\n\nexport const EffectiveSessionControl = z.object({\n  state: SessionControlState,\n  controlVersion: z.number().int().nonnegative(),\n  controlEtag: z.string().min(1),\n  directState: SessionControlState,\n  primaryBlocker: EffectiveControlBlocker.nullable(),\n  additionalBlockerCount: z.number().int().nonnegative(),\n  blockers: z.array(EffectiveControlBlocker),\n  resumeOptions: z.array(EffectiveControlResumeOption),\n  override: z\n    .object({\n      rootSessionId: z.string().uuid(),\n      revision: z.number().int().nonnegative(),\n    })\n    .nullable(),\n  settlement: z\n    .object({\n      state: z.literal(\"stopping\"),\n      attemptCount: z.number().int().positive(),\n      interruptionPendingCount: z.number().int().nonnegative(),\n      quiescencePendingCount: z.number().int().nonnegative(),\n    })\n    .nullable(),\n});\nexport type EffectiveSessionControl = z.infer<typeof EffectiveSessionControl>;\n\nexport const SESSION_OPERATION_KEY_MAX_CHARS = 256;\nconst SessionOperationKey = z.string().min(1).max(SESSION_OPERATION_KEY_MAX_CHARS);\n\nexport const SessionCommandReceipt = z.object({\n  id: z.string().uuid(),\n  action: z.string().min(1),\n  operationKey: z.string().min(1).max(SESSION_OPERATION_KEY_MAX_CHARS),\n  targetSessionId: z.string().uuid().nullable(),\n  targetTurnId: z.string().uuid().nullable(),\n  appliedControlRevision: z.number().int().nonnegative().nullable(),\n  appliedQueueVersion: z.number().int().nonnegative().nullable(),\n  appliedTurnVersion: z.number().int().positive().nullable(),\n  appliedDraftRevision: z.number().int().positive().nullable(),\n  createdAt: z.string(),\n});\nexport type SessionCommandReceipt = z.infer<typeof SessionCommandReceipt>;\n\nexport const ComposerDraft = z.object({\n  revision: z.number().int().nonnegative(),\n  text: z.string(),\n  resources: z.array(ResourceRef),\n  tools: z.array(ToolRef),\n  // False means the draft inherits the session policy. True preserves an\n  // explicit array, including [], across autosave/reload and queue checkout.\n  toolsProvided: z.boolean().default(false),\n  model: z.string().min(1),\n  reasoningEffort: ReasoningEffort,\n  sourceTurnId: z.string().uuid().nullable(),\n  sourceTurnVersion: z.number().int().positive().nullable(),\n  updatedAt: z.string().nullable(),\n});\nexport type ComposerDraft = z.infer<typeof ComposerDraft>;\n\nexport const MoveSessionQueueItemRequest = z.object({\n  clientEventId: SessionOperationKey,\n  expectedQueueVersion: z.number().int().nonnegative(),\n  beforeTurnId: z.string().uuid().nullable(),\n});\nexport type MoveSessionQueueItemRequest = z.infer<typeof MoveSessionQueueItemRequest>;\n\nexport const EditSessionQueueItemRequest = z.object({\n  clientEventId: SessionOperationKey,\n  expectedTurnVersion: z.number().int().positive(),\n  expectedDraftRevision: z.number().int().nonnegative(),\n  replaceDraft: z.boolean(),\n});\nexport type EditSessionQueueItemRequest = z.infer<typeof EditSessionQueueItemRequest>;\n\nexport const SteerSessionQueueItemRequest = z.object({\n  clientEventId: SessionOperationKey,\n  expectedTurnVersion: z.number().int().positive(),\n  controlEtag: z.string().min(1).optional(),\n});\nexport type SteerSessionQueueItemRequest = z.infer<typeof SteerSessionQueueItemRequest>;\n\nexport const DeleteSessionQueueItemRequest = z.object({\n  clientEventId: SessionOperationKey,\n  expectedTurnVersion: z.number().int().positive(),\n  reason: z.string().min(1).optional(),\n});\nexport type DeleteSessionQueueItemRequest = z.infer<typeof DeleteSessionQueueItemRequest>;\n\nexport const SaveComposerDraftRequest = ComposerDraft.pick({\n  text: true,\n  resources: true,\n  tools: true,\n  toolsProvided: true,\n  model: true,\n  reasoningEffort: true,\n}).extend({ expectedRevision: z.number().int().nonnegative() });\nexport type SaveComposerDraftRequest = z.infer<typeof SaveComposerDraftRequest>;\n\n/**\n * Create-only options saved with an actor's private pre-session draft. This is\n * deliberately narrower than CreateSessionRequest: idempotency/event keys and\n * credential-bearing MCP server inputs are per-attempt data, never draft state.\n */\nexport const NewSessionDraftOptions = z.object({\n  sandboxBackend: SandboxBackend.optional(),\n  targetSandboxId: z.string().uuid().optional(),\n  workingDir: z.string().min(1).optional(),\n  variableSetId: z.string().uuid().optional(),\n  rigId: z.string().uuid().optional(),\n  goal: GoalSpec.optional(),\n  firstPartyMcpPermissions: z.array(Permission).optional(),\n});\nexport type NewSessionDraftOptions = z.infer<typeof NewSessionDraftOptions>;\n\n/** Actor-private, server-authoritative composer state before a session exists. */\nexport const NewSessionDraft = z.object({\n  revision: z.number().int().nonnegative(),\n  text: z.string(),\n  resources: z.array(ResourceRef),\n  tools: z.array(ToolRef),\n  /** False means the workspace-default MCP policy is still inherited. */\n  toolsProvided: z.boolean().default(false),\n  model: z.string().min(1),\n  reasoningEffort: ReasoningEffort,\n  options: NewSessionDraftOptions,\n  updatedAt: z.string().nullable(),\n});\nexport type NewSessionDraft = z.infer<typeof NewSessionDraft>;\n\nexport const SaveNewSessionDraftRequest = NewSessionDraft.pick({\n  text: true,\n  resources: true,\n  tools: true,\n  toolsProvided: true,\n  model: true,\n  reasoningEffort: true,\n  options: true,\n}).extend({ expectedRevision: z.number().int().nonnegative() });\nexport type SaveNewSessionDraftRequest = z.infer<typeof SaveNewSessionDraftRequest>;\n\nexport const WORKSPACE_CONTROL_REASON_MAX_BYTES = 8 * 1024;\nexport const WORKSPACE_CONTROL_ACTOR_MAX_BYTES = 1024;\nexport const WORKSPACE_CONTROL_EVENT_MAX_BYTES = 16 * 1024;\n\nconst WorkspaceControlReason = z\n  .string()\n  .min(1)\n  .refine((value) => !value.includes(\"\\u0000\"), \"reason must not contain NUL bytes\")\n  .refine(\n    (value) => workspaceControlUtf8Bytes(value) <= WORKSPACE_CONTROL_REASON_MAX_BYTES,\n    `reason must not exceed ${WORKSPACE_CONTROL_REASON_MAX_BYTES} UTF-8 bytes`,\n  );\n\nexport const SessionControlRequest = z.object({\n  action: z.enum([\"pause\", \"resume\"]),\n  reason: WorkspaceControlReason.optional(),\n  clientEventId: SessionOperationKey,\n  expectedControlEtag: z.string().min(1).optional(),\n});\nexport type SessionControlRequest = z.infer<typeof SessionControlRequest>;\n\nexport const WorkspaceInferenceControlRequest = z.object({\n  action: z.enum([\"pause\", \"resume\"]),\n  reason: WorkspaceControlReason.optional(),\n  clientEventId: SessionOperationKey,\n  expectedRevision: z.number().int().nonnegative().optional(),\n});\nexport type WorkspaceInferenceControlRequest = z.infer<typeof WorkspaceInferenceControlRequest>;\n\nexport const WorkspaceInferenceControlResponse = z.object({\n  receipt: SessionCommandReceipt,\n  state: SessionControlState,\n  revision: z.number().int().nonnegative(),\n  interruptionCount: z.number().int().nonnegative(),\n  wakeCount: z.number().int().nonnegative(),\n});\nexport type WorkspaceInferenceControlResponse = z.infer<typeof WorkspaceInferenceControlResponse>;\n\n/**\n * One durable workspace-wide invalidation for one committed control revision.\n * It is not conversation history and never becomes queue work; clients use it\n * only to refetch authoritative workspace/session projections.\n */\nexport const WorkspaceControlEventTruncation = z.object({\n  truncated: z.literal(true),\n  surface: z.enum([\n    \"durable_control\",\n    \"database_guard\",\n    \"http_projection\",\n    \"nats_legacy_guard\",\n    \"sse_legacy_guard\",\n  ]),\n  deliveredBytes: z.number().int().nonnegative(),\n  fields: z.array(\n    z.object({\n      field: z.enum([\"reason\", \"actor\"]),\n      originalBytes: z.number().int().nonnegative(),\n      deliveredBytes: z.number().int().nonnegative(),\n      omittedBytes: z.number().int().nonnegative(),\n    }),\n  ),\n  fullEvidence: z.object({\n    available: z.literal(false),\n    reason: z.literal(\"not_retained\"),\n  }),\n});\nexport type WorkspaceControlEventTruncation = z.infer<typeof WorkspaceControlEventTruncation>;\n\nexport const WorkspaceControlEvent = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sequence: z.number().int().positive(),\n  revision: z.number().int().positive(),\n  type: z.literal(\"workspace.control.changed\"),\n  scope: z.enum([\"workspace\", \"session\"]),\n  rootSessionId: z.string().uuid().nullable(),\n  action: z.enum([\"pause\", \"resume\"]),\n  automatic: z.boolean(),\n  reason: z.string().nullable(),\n  actor: z.string().min(1),\n  occurredAt: z.string(),\n  truncation: WorkspaceControlEventTruncation.nullable().optional(),\n});\nexport type WorkspaceControlEvent = z.infer<typeof WorkspaceControlEvent>;\n\nexport type WorkspaceControlBoundarySurface = WorkspaceControlEventTruncation[\"surface\"];\n\nexport type BoundWorkspaceControlEventOptions = {\n  surface?: WorkspaceControlBoundarySurface;\n  reasonOriginalBytes?: number | null;\n  actorOriginalBytes?: number | null;\n};\n\n/** UTF-8 byte count used by workspace-control storage and transport guards. */\nexport function workspaceControlUtf8Bytes(value: string): number {\n  return new TextEncoder().encode(value).byteLength;\n}\n\n/**\n * Canonical bounded invalidation event. The event is not a full evidence store:\n * when a producer or legacy row exceeds a field cap, the retained head carries\n * a visible marker and structured exact byte-loss facts.\n */\nexport function boundWorkspaceControlEvent(\n  event: WorkspaceControlEvent,\n  options: BoundWorkspaceControlEventOptions = {},\n): WorkspaceControlEvent {\n  const existingFields = new Map(\n    (event.truncation?.fields ?? []).map((field) => [field.field, field] as const),\n  );\n  const reason =\n    event.reason === null\n      ? null\n      : boundWorkspaceControlText(event.reason, WORKSPACE_CONTROL_REASON_MAX_BYTES);\n  const actor = boundWorkspaceControlText(event.actor, WORKSPACE_CONTROL_ACTOR_MAX_BYTES);\n  const reasonBytes = reason === null ? 0 : workspaceControlUtf8Bytes(reason);\n  const actorBytes = workspaceControlUtf8Bytes(actor);\n  const reasonOriginalBytes =\n    event.reason === null\n      ? null\n      : Math.max(\n          workspaceControlUtf8Bytes(event.reason),\n          normalizedWorkspaceControlOriginalBytes(options.reasonOriginalBytes),\n          existingFields.get(\"reason\")?.originalBytes ?? 0,\n        );\n  const actorOriginalBytes = Math.max(\n    workspaceControlUtf8Bytes(event.actor),\n    normalizedWorkspaceControlOriginalBytes(options.actorOriginalBytes),\n    existingFields.get(\"actor\")?.originalBytes ?? 0,\n  );\n  const fields: WorkspaceControlEventTruncation[\"fields\"] = [];\n  if (reasonOriginalBytes !== null && reasonOriginalBytes > reasonBytes) {\n    fields.push({\n      field: \"reason\",\n      originalBytes: reasonOriginalBytes,\n      deliveredBytes: reasonBytes,\n      omittedBytes: reasonOriginalBytes - reasonBytes,\n    });\n  }\n  if (actorOriginalBytes > actorBytes) {\n    fields.push({\n      field: \"actor\",\n      originalBytes: actorOriginalBytes,\n      deliveredBytes: actorBytes,\n      omittedBytes: actorOriginalBytes - actorBytes,\n    });\n  }\n  if (fields.length === 0 && event.truncation == null) {\n    if (sessionEventJsonBytes(event) > WORKSPACE_CONTROL_EVENT_MAX_BYTES) {\n      throw new RangeError(\"Workspace control event exceeds its bounded envelope\");\n    }\n    return event;\n  }\n\n  const truncation: WorkspaceControlEventTruncation = {\n    truncated: true,\n    surface: event.truncation?.surface ?? options.surface ?? \"durable_control\",\n    deliveredBytes: 0,\n    fields,\n    fullEvidence: { available: false, reason: \"not_retained\" },\n  };\n  const bounded: WorkspaceControlEvent = {\n    ...event,\n    reason,\n    actor,\n    truncation,\n  };\n  settleWorkspaceControlDeliveredBytes(bounded, truncation);\n  const deliveredBytes = sessionEventJsonBytes(bounded);\n  if (deliveredBytes > WORKSPACE_CONTROL_EVENT_MAX_BYTES) {\n    throw new RangeError(\n      `Bounded workspace control event exceeds its final envelope (${deliveredBytes} > ${WORKSPACE_CONTROL_EVENT_MAX_BYTES} bytes)`,\n    );\n  }\n  return bounded;\n}\n\nfunction boundWorkspaceControlText(value: string, maxBytes: number): string {\n  const encoder = new TextEncoder();\n  const decoder = new TextDecoder();\n  const bytes = encoder.encode(value);\n  if (bytes.byteLength <= maxBytes) return value;\n  const marker = \"…[truncated]\";\n  const prefixBudget = Math.max(0, maxBytes - encoder.encode(marker).byteLength);\n  let prefixEnd = Math.min(prefixBudget, bytes.byteLength);\n  while (prefixEnd > 0 && prefixEnd < bytes.byteLength && (bytes[prefixEnd]! & 0xc0) === 0x80) {\n    prefixEnd -= 1;\n  }\n  return `${decoder.decode(bytes.subarray(0, prefixEnd))}${marker}`;\n}\n\nfunction normalizedWorkspaceControlOriginalBytes(value: number | null | undefined): number {\n  return value === null || value === undefined || !Number.isFinite(value)\n    ? 0\n    : Math.max(0, Math.floor(value));\n}\n\nfunction settleWorkspaceControlDeliveredBytes(\n  event: WorkspaceControlEvent,\n  truncation: WorkspaceControlEventTruncation,\n): void {\n  for (let attempt = 0; attempt < 16; attempt += 1) {\n    const deliveredBytes = sessionEventJsonBytes(event);\n    if (truncation.deliveredBytes === deliveredBytes) return;\n    truncation.deliveredBytes = deliveredBytes;\n  }\n  const deliveredBytes = sessionEventJsonBytes(event);\n  if (truncation.deliveredBytes !== deliveredBytes) {\n    throw new RangeError(\"Workspace control event byte accounting did not converge\");\n  }\n}\n\nexport const SystemUpdateClassification = z.enum([\"success\", \"failure\", \"action_required\", \"info\"]);\nexport type SystemUpdateClassification = z.infer<typeof SystemUpdateClassification>;\n\nexport const SessionSystemUpdateKind = z.enum([\n  \"scheduled_occurrence\",\n  \"goal_continuation\",\n  \"agent_message\",\n  \"agent_steer_instruction\",\n  \"child_terminal_result\",\n]);\nexport type SessionSystemUpdateKind = z.infer<typeof SessionSystemUpdateKind>;\n\nexport const SessionSystemUpdatePayload = z.discriminatedUnion(\"type\", [\n  z\n    .object({\n      type: z.literal(\"scheduled_occurrence\"),\n      text: z.string().min(1),\n      scheduledTaskId: z.string().uuid(),\n      scheduledTaskRunId: z.string().uuid(),\n      resources: z.array(ResourceRef).optional(),\n      tools: z.array(ToolRef).optional(),\n    })\n    .passthrough(),\n  z\n    .object({\n      type: z.literal(\"goal_continuation\"),\n      goalId: z.string().uuid(),\n      goalVersion: z.number().int().positive(),\n      prompt: z.string().min(1),\n      reason: z.string().optional(),\n    })\n    .passthrough(),\n  z\n    .object({\n      type: z.literal(\"agent_message\"),\n      text: z.string().min(1),\n      operationId: z.string().uuid(),\n    })\n    .passthrough(),\n  z\n    .object({\n      type: z.literal(\"agent_steer_instruction\"),\n      instruction: z.string().min(1),\n      operationId: z.string().uuid(),\n    })\n    .passthrough(),\n  z\n    .object({\n      type: z.literal(\"child_terminal_result\"),\n      childSessionId: z.string().uuid(),\n      status: z.enum([\"idle\", \"failed\"]),\n    })\n    .passthrough(),\n]);\nexport type SessionSystemUpdatePayload = z.infer<typeof SessionSystemUpdatePayload>;\n\nexport const SessionSystemUpdateState = z.enum([\n  \"pending\",\n  \"delivered\",\n  \"cancelled\",\n  \"superseded\",\n  \"failed\",\n]);\nexport type SessionSystemUpdateState = z.infer<typeof SessionSystemUpdateState>;\n\nexport const SessionSystemUpdate = z.object({\n  id: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  kind: SessionSystemUpdateKind,\n  classification: SystemUpdateClassification,\n  sourceId: z.string(),\n  dedupeKey: z.string(),\n  summary: z.string(),\n  payload: SessionSystemUpdatePayload,\n  lineage: z.record(z.string(), z.unknown()),\n  state: SessionSystemUpdateState,\n  deliveredTurnId: z.string().uuid().nullable(),\n  /**\n   * The exact durable model-memory row containing the coalesced batch that\n   * delivered this update. Null until claim; every member of one batch shares\n   * the same id.\n   */\n  deliveredHistoryItemId: z.string().uuid().nullable(),\n  deliveredAt: z.string().nullable(),\n  createdAt: z.string(),\n});\nexport type SessionSystemUpdate = z.infer<typeof SessionSystemUpdate>;\n\n/**\n * Bounded queue projection of a canonical pending machine input. Full payload,\n * lineage, and dedupe data remain in canonical storage and never inflate the\n * hot queue response.\n */\nexport const SessionPendingInputPreview = SessionSystemUpdate.pick({\n  id: true,\n  sessionId: true,\n  kind: true,\n  classification: true,\n  sourceId: true,\n  summary: true,\n  createdAt: true,\n});\nexport type SessionPendingInputPreview = z.infer<typeof SessionPendingInputPreview>;\n\nexport const SessionQueueSnapshot = z.object({\n  version: z.number().int().nonnegative(),\n  effectiveControl: EffectiveSessionControl,\n  /**\n   * True while the latest attempt is interrupted but has not durably proved\n   * quiescence: no more inference, user-visible output, or workspace-persistence\n   * authority. Temporal cancellation/terminalization is not that proof. This is\n   * distinct from ordinary capacity queueing, remains accurate with an empty\n   * visible queue, and is independent of Steer-row metadata or withdrawal.\n   */\n  stoppingPreviousAttempt: z.boolean(),\n  items: z.array(SessionTurn),\n  /** Canonical bounded previews; never reconstructed from session events. */\n  pendingInputs: z.array(SessionPendingInputPreview),\n  /**\n   * Exact members of the next bounded machine-input batch that will join an\n   * already-waiting human/API prompt. Null means the next machine-input claim\n   * is standalone. This is a projection of canonical rows, not queue state.\n   */\n  pendingInputAttachment: z\n    .object({\n      turnId: z.string().uuid(),\n      inputIds: z.array(z.string().uuid()).min(1),\n    })\n    .nullable(),\n});\nexport type SessionQueueSnapshot = z.infer<typeof SessionQueueSnapshot>;\n\n/**\n * Deterministic, protocol-safe model representation of one claimed machine\n * input batch. This exact string is persisted before inference and replayed on\n * every later turn; callers must not synthesize an equivalent transient copy.\n */\nexport function renderSessionSystemUpdateBatch(\n  updates: ReadonlyArray<\n    Pick<\n      SessionSystemUpdate,\n      \"id\" | \"kind\" | \"classification\" | \"sourceId\" | \"summary\" | \"payload\" | \"lineage\"\n    >\n  >,\n): string {\n  if (updates.length === 0) {\n    throw new TypeError(\"A durable machine-input batch requires at least one update\");\n  }\n  return [\n    \"[OpenGeni internal updates]\",\n    \"These platform updates were delivered together for this inference. They are not human prompts.\",\n    JSON.stringify({\n      updates: updates.map((update) => ({\n        id: update.id,\n        kind: update.kind,\n        classification: update.classification,\n        sourceId: update.sourceId,\n        summary: update.summary,\n        payload: update.payload,\n        lineage: update.lineage,\n      })),\n    }),\n  ].join(\"\\n\");\n}\n\nexport function sessionSystemUpdateBatchHistoryItem(\n  updates: Parameters<typeof renderSessionSystemUpdateBatch>[0],\n): { type: \"message\"; role: \"system\"; content: string } {\n  return {\n    type: \"message\",\n    role: \"system\",\n    content: renderSessionSystemUpdateBatch(updates),\n  };\n}\n\nexport const VariableSetVariableName = z\n  .string()\n  .regex(/^[A-Z][A-Z0-9_]*$/)\n  .max(128);\nexport type VariableSetVariableName = z.infer<typeof VariableSetVariableName>;\n\nfunction withVariableSetIdAlias<T extends z.ZodRawShape>(shape: T) {\n  return z.preprocess((input) => {\n    if (!input || typeof input !== \"object\" || Array.isArray(input)) {\n      return input;\n    }\n    const record = input as Record<string, unknown>;\n    if (record.variableSetId !== undefined || record.environmentId === undefined) {\n      return record;\n    }\n    return { ...record, variableSetId: record.environmentId };\n  }, z.object(shape));\n}\n\n// Metadata only by design: no schema in this file ever carries a variable value\n// back to a client. Values are write-only and decrypted exclusively inside the\n// worker at sandbox materialization time.\nexport const VariableSetVariableMetadata = z.object({\n  name: VariableSetVariableName,\n  version: z.number().int().positive(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type VariableSetVariableMetadata = z.infer<typeof VariableSetVariableMetadata>;\n/** @deprecated use VariableSetVariableMetadata */\nexport const WorkspaceEnvironmentVariableMetadata = VariableSetVariableMetadata;\n/** @deprecated use VariableSetVariableMetadata */\nexport type WorkspaceEnvironmentVariableMetadata = VariableSetVariableMetadata;\n\nexport const VariableSet = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  name: z.string(),\n  description: z.string().nullable(),\n  variables: z.array(VariableSetVariableMetadata),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type VariableSet = z.infer<typeof VariableSet>;\n/** @deprecated use VariableSet */\nexport const WorkspaceEnvironment = VariableSet;\n/** @deprecated use VariableSet */\nexport type WorkspaceEnvironment = VariableSet;\n\nexport const CreateVariableSetRequest = z.object({\n  name: z.string().min(1).max(120),\n  description: z.string().max(2000).optional(),\n  variables: z\n    .array(\n      z.object({\n        name: VariableSetVariableName,\n        value: z.string().min(1).max(32768),\n      }),\n    )\n    .default([]),\n});\nexport type CreateVariableSetRequest = z.infer<typeof CreateVariableSetRequest>;\n/** @deprecated use CreateVariableSetRequest */\nexport const CreateWorkspaceEnvironmentRequest = CreateVariableSetRequest;\n/** @deprecated use CreateVariableSetRequest */\nexport type CreateWorkspaceEnvironmentRequest = CreateVariableSetRequest;\n\nexport const UpdateVariableSetRequest = z.object({\n  name: z.string().min(1).max(120).optional(),\n  description: z.string().max(2000).nullable().optional(),\n});\nexport type UpdateVariableSetRequest = z.infer<typeof UpdateVariableSetRequest>;\n/** @deprecated use UpdateVariableSetRequest */\nexport const UpdateWorkspaceEnvironmentRequest = UpdateVariableSetRequest;\n/** @deprecated use UpdateVariableSetRequest */\nexport type UpdateWorkspaceEnvironmentRequest = UpdateVariableSetRequest;\n\nexport const SetVariableSetVariableRequest = z.object({\n  value: z.string().min(1).max(32768),\n});\nexport type SetVariableSetVariableRequest = z.infer<typeof SetVariableSetVariableRequest>;\n/** @deprecated use SetVariableSetVariableRequest */\nexport const SetWorkspaceEnvironmentVariableRequest = SetVariableSetVariableRequest;\n/** @deprecated use SetVariableSetVariableRequest */\nexport type SetWorkspaceEnvironmentVariableRequest = SetVariableSetVariableRequest;\n\n// --- Rigs ---------------------------------------------------------------------\n// Workspace-scoped, versioned sandbox machine definitions. A rig is the named\n// truth; each sandbox is a disposable fork of a rig version. Versions are\n// append-only and content-immutable; exactly one is active per rig.\n\n// A self-declared health check: a name + the shell command that must exit 0.\nexport const RigCheck = z.object({\n  name: z.string().min(1).max(120),\n  command: z.string().min(1).max(8192),\n});\nexport type RigCheck = z.infer<typeof RigCheck>;\n\nexport const RigVersion = z.object({\n  id: z.string().uuid(),\n  rigId: z.string().uuid(),\n  version: z.number().int().positive(),\n  image: z.string().nullable(),\n  setupScript: z.string().nullable(),\n  checks: z.array(RigCheck),\n  credentialHooks: z.array(z.string()),\n  defaultVariableSetIds: z.array(z.string().uuid()),\n  changelog: z.string().nullable(),\n  // Attribution: 'user:<subject>' | 'session:<id>' | 'system'.\n  createdBy: z.string().nullable(),\n  active: z.boolean(),\n  createdAt: z.string(),\n});\nexport type RigVersion = z.infer<typeof RigVersion>;\n\nexport const RigVerificationHealth = z.object({\n  checkHealth: z.enum([\"passing\", \"failing\", \"unknown\"]),\n  lastVerifiedAt: z.string().nullable(),\n});\nexport type RigVerificationHealth = z.infer<typeof RigVerificationHealth>;\n\nexport const Rig = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  name: z.string(),\n  description: z.string().nullable(),\n  createdBy: z.string().nullable(),\n  // The rig's currently-active version (present after create; nullable so a\n  // partial/list read can omit it without a schema change).\n  activeVersion: RigVersion.nullable(),\n  // Summary for the currently active version. null only when there is no active\n  // version; otherwise \"unknown\" means the active version has no verification.\n  activeVersionHealth: RigVerificationHealth.nullable(),\n  versionCount: z.number().int().nonnegative(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type Rig = z.infer<typeof Rig>;\n\nexport const RigChangeKind = z.enum([\"setup_append\", \"definition_edit\"]);\nexport type RigChangeKind = z.infer<typeof RigChangeKind>;\n\nexport const RigChangeStatus = z.enum([\"proposed\", \"verifying\", \"merged\", \"rejected\", \"failed\"]);\nexport type RigChangeStatus = z.infer<typeof RigChangeStatus>;\n\n// A single check's outcome inside a verification run (populated in M4).\nexport const RigCheckResult = z.object({\n  name: z.string(),\n  command: z.string(),\n  exitCode: z.number().int().nullable(),\n  output: z.string().optional(),\n});\nexport type RigCheckResult = z.infer<typeof RigCheckResult>;\n\n// The verification record a rig-CI run writes onto a change (M4). Open-ended\n// (passthrough) so M4 can enrich it without a contracts break.\nexport const RigChangeVerification = z\n  .object({\n    startedAt: z.string().optional(),\n    finishedAt: z.string().optional(),\n    log: z.string().optional(),\n    checkResults: z.array(RigCheckResult).optional(),\n  })\n  .passthrough();\nexport type RigChangeVerification = z.infer<typeof RigChangeVerification>;\n\nexport const RigChange = z.object({\n  id: z.string().uuid(),\n  rigId: z.string().uuid(),\n  baseVersionId: z.string().uuid().nullable(),\n  kind: RigChangeKind,\n  payload: z.record(z.string(), z.unknown()),\n  status: RigChangeStatus,\n  proposedBy: z.string().nullable(),\n  verification: RigChangeVerification.nullable(),\n  resultVersionId: z.string().uuid().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type RigChange = z.infer<typeof RigChange>;\n\nexport const CreateRigRequest = z.object({\n  name: z.string().min(1).max(120),\n  description: z.string().max(2000).optional(),\n  // Initial (version 1) content, inline.\n  image: z.string().max(1024).optional(),\n  setupScript: z.string().max(131072).optional(),\n  checks: z.array(RigCheck).max(100).default([]),\n  credentialHooks: z.array(z.string().min(1).max(200)).max(50).default([]),\n  defaultVariableSetIds: z.array(z.string().uuid()).max(25).default([]),\n});\nexport type CreateRigRequest = z.infer<typeof CreateRigRequest>;\n\nexport const UpdateRigRequest = z.object({\n  name: z.string().min(1).max(120).optional(),\n  description: z.string().max(2000).nullable().optional(),\n});\nexport type UpdateRigRequest = z.infer<typeof UpdateRigRequest>;\n\n// setup_append: the exact command that already worked (+ an optional note).\nexport const RigSetupAppendPayload = z.object({\n  command: z.string().min(1).max(8192),\n  note: z.string().max(2000).optional(),\n});\nexport type RigSetupAppendPayload = z.infer<typeof RigSetupAppendPayload>;\n\n// definition_edit: the full next-version content (all fields optional; unset\n// fields inherit from the base version at promote time).\nexport const RigDefinitionEditPayload = z.object({\n  image: z.string().max(1024).nullish(),\n  setupScript: z.string().max(131072).nullish(),\n  checks: z.array(RigCheck).max(100).optional(),\n  credentialHooks: z.array(z.string().min(1).max(200)).max(50).optional(),\n  defaultVariableSetIds: z.array(z.string().uuid()).max(25).optional(),\n  changelog: z.string().max(4096).nullish(),\n});\nexport type RigDefinitionEditPayload = z.infer<typeof RigDefinitionEditPayload>;\n\nexport const ProposeRigChangeRequest = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"setup_append\"), payload: RigSetupAppendPayload }),\n  z.object({\n    kind: z.literal(\"definition_edit\"),\n    payload: RigDefinitionEditPayload,\n  }),\n]);\nexport type ProposeRigChangeRequest = z.infer<typeof ProposeRigChangeRequest>;\n\nexport const ScheduledTaskStatus = z.enum([\"active\", \"paused\"]);\nexport type ScheduledTaskStatus = z.infer<typeof ScheduledTaskStatus>;\n\nexport const ScheduledTaskRunStatus = z.enum([\"queued\", \"dispatched\", \"failed\"]);\nexport type ScheduledTaskRunStatus = z.infer<typeof ScheduledTaskRunStatus>;\n\nexport const ScheduledTaskRunMode = z.enum([\"new_session_per_run\", \"reusable_session\"]);\nexport type ScheduledTaskRunMode = z.infer<typeof ScheduledTaskRunMode>;\n\nexport const ScheduledTaskOverlapPolicy = z.enum([\"allow_concurrent\", \"skip\", \"buffer_one\"]);\nexport type ScheduledTaskOverlapPolicy = z.infer<typeof ScheduledTaskOverlapPolicy>;\n\nexport const ScheduledTaskTriggerType = z.enum([\"scheduled\", \"manual\"]);\nexport type ScheduledTaskTriggerType = z.infer<typeof ScheduledTaskTriggerType>;\n\nexport const ScheduledTaskScheduleSpec = z.discriminatedUnion(\"type\", [\n  z.object({\n    type: z.literal(\"once\"),\n    runAt: z.string().datetime({ offset: true }),\n    timeZone: z.string().min(1).default(\"UTC\"),\n  }),\n  z.object({\n    type: z.literal(\"interval\"),\n    everySeconds: z.number().int().positive(),\n    startAt: z.string().datetime({ offset: true }).optional(),\n    endAt: z.string().datetime({ offset: true }).optional(),\n  }),\n  z.object({\n    type: z.literal(\"calendar\"),\n    timeZone: z.string().min(1).default(\"UTC\"),\n    hour: z.number().int().min(0).max(23),\n    minute: z.number().int().min(0).max(59),\n    daysOfWeek: z\n      .array(z.enum([\"SUNDAY\", \"MONDAY\", \"TUESDAY\", \"WEDNESDAY\", \"THURSDAY\", \"FRIDAY\", \"SATURDAY\"]))\n      .min(1)\n      .optional(),\n  }),\n]);\nexport type ScheduledTaskScheduleSpec = z.infer<typeof ScheduledTaskScheduleSpec>;\n\nexport const ScheduledTaskAgentConfig = z.object({\n  prompt: z.string().min(1),\n  resources: z.array(ResourceRef).default([]),\n  tools: z.array(ToolRef).default([]),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  // Explicit workspace-shared OpenGeni Slack bot binding for scheduled runs.\n  // The worker copies this non-secret pointer into session metadata; the\n  // first-party Slack tools never fall back to a personal hosted-MCP grant.\n  slackBotConnectionId: z.string().uuid().optional(),\n  model: z.string().min(1).optional(),\n  reasoningEffort: ReasoningEffort.optional(),\n  sandboxBackend: SandboxBackend.optional(),\n  goal: GoalSpec.optional(),\n  // Durable task override. Scheduled dispatch is trusted to preserve this\n  // snapshot even if the workspace/deployment policy narrows later.\n  maxNestedAgentDepth: NestedAgentDepthValue.optional(),\n});\nexport type ScheduledTaskAgentConfig = z.infer<typeof ScheduledTaskAgentConfig>;\n\nexport const ScheduledTask = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  name: z.string(),\n  status: ScheduledTaskStatus,\n  schedule: ScheduledTaskScheduleSpec,\n  temporalScheduleId: z.string(),\n  runMode: ScheduledTaskRunMode,\n  overlapPolicy: ScheduledTaskOverlapPolicy,\n  agentConfig: ScheduledTaskAgentConfig,\n  reusableSessionId: z.string().uuid().nullable(),\n  variableSetId: z.string().uuid().nullable().default(null),\n  /** @deprecated use variableSetId */\n  environmentId: z.string().uuid().nullable().default(null),\n  // The rig each run binds to (M3). Stored on the task; the ACTIVE version is\n  // resolved PER FIRE (at dispatch), so a task always runs the rig's current\n  // version rather than one frozen at task-create time. Null ⇒ rig-less runs.\n  rigId: z.string().uuid().nullable().default(null),\n  metadata: z.record(z.string(), z.unknown()),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ScheduledTask = z.infer<typeof ScheduledTask>;\n\nexport const ScheduledTaskRun = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  taskId: z.string().uuid(),\n  status: ScheduledTaskRunStatus,\n  triggerType: ScheduledTaskTriggerType,\n  scheduledAt: z.string().nullable(),\n  firedAt: z.string(),\n  sessionId: z.string().uuid().nullable(),\n  triggerEventId: z.string().uuid().nullable(),\n  error: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ScheduledTaskRun = z.infer<typeof ScheduledTaskRun>;\n\nexport const CreateScheduledTaskRequest = withVariableSetIdAlias({\n  name: z.string().min(1),\n  schedule: ScheduledTaskScheduleSpec,\n  runMode: ScheduledTaskRunMode.default(\"new_session_per_run\"),\n  overlapPolicy: ScheduledTaskOverlapPolicy.default(\"allow_concurrent\"),\n  agentConfig: ScheduledTaskAgentConfig,\n  status: ScheduledTaskStatus.default(\"active\"),\n  variableSetId: z.string().uuid().nullable().optional(),\n  environmentId: z.string().uuid().nullable().optional(),\n  // The rig each run binds to (M3); its active version is resolved per fire.\n  rigId: z.string().uuid().nullable().optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateScheduledTaskRequest = z.infer<typeof CreateScheduledTaskRequest>;\n\nexport const UpdateScheduledTaskRequest = withVariableSetIdAlias({\n  name: z.string().min(1).optional(),\n  schedule: ScheduledTaskScheduleSpec.optional(),\n  runMode: ScheduledTaskRunMode.optional(),\n  overlapPolicy: ScheduledTaskOverlapPolicy.optional(),\n  agentConfig: ScheduledTaskAgentConfig.optional(),\n  status: ScheduledTaskStatus.optional(),\n  variableSetId: z.string().uuid().nullable().optional(),\n  environmentId: z.string().uuid().nullable().optional(),\n  // The rig each run binds to (M3); null clears it. Its active version is\n  // resolved per fire, so an update takes effect on the next dispatch.\n  rigId: z.string().uuid().nullable().optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\nexport type UpdateScheduledTaskRequest = z.infer<typeof UpdateScheduledTaskRequest>;\n\n/**\n * Manual-trigger body. `triggerId` is a client-supplied idempotency token: a\n * retried trigger that reuses the same token charges once and starts one run.\n * Omitting it makes each call a distinct trigger (the server mints a token).\n */\nexport const TriggerScheduledTaskRequest = z.object({\n  triggerId: z.string().min(1).max(128).optional(),\n});\nexport type TriggerScheduledTaskRequest = z.infer<typeof TriggerScheduledTaskRequest>;\n\nexport const CapabilityPackConnectorAuthModel = z.enum([\n  \"oauth2_authorization_code_pkce\",\n  \"oauth2_authorization_code\",\n  \"api_key\",\n  \"credential_ref\",\n]);\nexport type CapabilityPackConnectorAuthModel = z.infer<typeof CapabilityPackConnectorAuthModel>;\n\nexport const CapabilityPackConnector = z.object({\n  id: z.string().min(1),\n  name: z.string().min(1),\n  category: z.string().min(1),\n  authModel: CapabilityPackConnectorAuthModel,\n  providers: z.array(z.string().min(1)).default([]),\n  scopes: z.array(z.string().min(1)).default([]),\n  required: z.boolean().default(false),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CapabilityPackConnector = z.infer<typeof CapabilityPackConnector>;\n\nexport const CapabilityPackKnowledge = z.object({\n  type: z.literal(\"document_base\"),\n  id: z.string().min(1),\n  name: z.string().min(1),\n  description: z.string().nullable().default(null),\n  required: z.boolean().default(false),\n});\nexport type CapabilityPackKnowledge = z.infer<typeof CapabilityPackKnowledge>;\n\nexport const CapabilityPackScheduledTaskTemplate = z.object({\n  id: z.string().min(1),\n  name: z.string().min(1),\n  description: z.string().min(1),\n  defaultSchedule: ScheduledTaskScheduleSpec,\n  defaultRunMode: ScheduledTaskRunMode.default(\"new_session_per_run\"),\n  defaultOverlapPolicy: ScheduledTaskOverlapPolicy.default(\"skip\"),\n  // Optional default agent prompt so registered pack manifests can ship fully\n  // instantiable templates; built-in packs may instead build prompts in code.\n  prompt: z.string().min(1).optional(),\n});\nexport type CapabilityPackScheduledTaskTemplate = z.infer<\n  typeof CapabilityPackScheduledTaskTemplate\n>;\n\n// One file inside a pack skill directory. Paths are workspace-relative POSIX\n// paths inside the skill directory (for example \"SKILL.md\" or\n// \"references/runbook.md\"); content is UTF-8 text carried inline in the pack\n// manifest, which is also how registered packs persist it (the manifest JSONB\n// row in workspace_packs is the storage of record for pack skills).\nexport const CapabilityPackSkillFile = z.object({\n  path: z.string().min(1).max(512).refine(isSafePackSkillRelativePath, {\n    message: \"skill file path must be a safe relative POSIX path without '..' segments\",\n  }),\n  content: z.string().max(256 * 1024),\n});\nexport type CapabilityPackSkillFile = z.infer<typeof CapabilityPackSkillFile>;\n\n// A skill delivered by a capability pack. The name doubles as the skill\n// directory under the sandbox skill index (skills/<name>), so it must be a\n// single safe path segment. Every skill must ship a top-level SKILL.md.\nexport const CapabilityPackSkill = z\n  .object({\n    name: z\n      .string()\n      .min(1)\n      .max(64)\n      .regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, {\n        message: \"skill name must be a single path segment of letters, digits, '.', '_' or '-'\",\n      }),\n    description: z.string().min(1).max(2048).optional(),\n    files: z.array(CapabilityPackSkillFile).min(1).max(64),\n  })\n  .superRefine((skill, ctx) => {\n    const seen = new Set<string>();\n    skill.files.forEach((file, index) => {\n      if (seen.has(file.path)) {\n        ctx.addIssue({\n          code: \"custom\",\n          message: `duplicate skill file path: ${file.path}`,\n          path: [\"files\", index, \"path\"],\n        });\n      }\n      seen.add(file.path);\n    });\n    if (!skill.files.some((file) => file.path === \"SKILL.md\")) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: \"skill must include a top-level SKILL.md file\",\n        path: [\"files\"],\n      });\n    }\n  });\nexport type CapabilityPackSkill = z.infer<typeof CapabilityPackSkill>;\n\n// Inline skill content fixed onto one session at creation. It intentionally\n// uses the exact same validated directory shape as a pack skill, but has a\n// different semantic owner and lifecycle. Session readers can inspect it; it\n// is configuration, never a secret store.\nexport const SessionSkill = CapabilityPackSkill;\nexport type SessionSkill = z.infer<typeof SessionSkill>;\n\nexport const SessionSkills = z\n  .array(SessionSkill)\n  .max(32)\n  .transform((skills, ctx) => {\n    const selected = new Map<string, { fingerprint: string; skill: SessionSkill }>();\n    for (const skill of skills) {\n      const key = skill.name.toLowerCase();\n      const fingerprint = JSON.stringify({\n        description: skill.description ?? null,\n        files: [...skill.files]\n          .sort((left, right) => left.path.localeCompare(right.path))\n          .map(({ path, content }) => ({ path, content })),\n      });\n      const existing = selected.get(key);\n      if (!existing) {\n        selected.set(key, { fingerprint, skill });\n        continue;\n      }\n      if (existing.fingerprint !== fingerprint) {\n        ctx.addIssue({\n          code: \"custom\",\n          message: `conflicting session skill definitions: ${skill.name}`,\n        });\n      }\n    }\n    return [...selected.values()].map(({ skill }) => skill);\n  });\n\nfunction isSafePackSkillRelativePath(path: string): boolean {\n  if (path.startsWith(\"/\") || path.includes(\"\\\\\")) {\n    return false;\n  }\n  return path\n    .split(\"/\")\n    .every((segment) => segment.length > 0 && segment !== \".\" && segment !== \"..\");\n}\n\nconst CapabilityPackVariableSet = z.object({\n  description: z.string().min(1),\n  requiredVariables: z.array(VariableSetVariableName).default([]),\n  required: z.boolean().default(false),\n});\n\nexport const CapabilityPack = z.preprocess(\n  (input) => {\n    if (!input || typeof input !== \"object\" || Array.isArray(input)) {\n      return input;\n    }\n    const record = input as Record<string, unknown>;\n    if (record.variableSet !== undefined) {\n      return record;\n    }\n    if (record.environment !== undefined) {\n      const { environment: _environment, ...rest } = record;\n      return { ...rest, variableSet: record.environment };\n    }\n    if (record.requiredVariables !== undefined) {\n      const { requiredVariables: _requiredVariables, ...rest } = record;\n      return {\n        ...rest,\n        variableSet: {\n          description: \"Required variables\",\n          requiredVariables: record.requiredVariables,\n          required: Array.isArray(record.requiredVariables) && record.requiredVariables.length > 0,\n        },\n      };\n    }\n    return record;\n  },\n  z.object({\n    id: z.string().min(1),\n    name: z.string().min(1),\n    description: z.string().min(1),\n    role: z.string().min(1),\n    category: z.string().min(1),\n    version: z.string().min(1),\n    // Container image ref (digest-pinned recommended) the pack's sessions run\n    // in. At most one enabled pack per workspace may declare one; with none,\n    // sessions use the deployment-wide image settings.\n    sandboxImage: z.string().trim().min(1).max(512).optional(),\n    // Skills delivered into the sandbox skill index when the pack is enabled.\n    skills: z\n      .array(CapabilityPackSkill)\n      .max(32)\n      .superRefine((skills, ctx) => {\n        const seen = new Set<string>();\n        skills.forEach((skill, index) => {\n          const key = skill.name.toLowerCase();\n          if (seen.has(key)) {\n            ctx.addIssue({\n              code: \"custom\",\n              message: `duplicate pack skill name: ${skill.name}`,\n              path: [index, \"name\"],\n            });\n          }\n          seen.add(key);\n        });\n      })\n      .default([]),\n    tools: z.array(ToolRef).default([]),\n    connectors: z.array(CapabilityPackConnector).default([]),\n    knowledge: z.array(CapabilityPackKnowledge).default([]),\n    scheduledTaskTemplates: z.array(CapabilityPackScheduledTaskTemplate).default([]),\n    variableSet: CapabilityPackVariableSet.optional(),\n    metadata: z.record(z.string(), z.unknown()).default({}),\n  }),\n);\nexport type CapabilityPack = z.infer<typeof CapabilityPack>;\n\n// Registering a pack stores the manifest itself; the request body is a full\n// CapabilityPack manifest.\nexport const RegisterCapabilityPackRequest = CapabilityPack;\nexport type RegisterCapabilityPackRequest = z.infer<typeof RegisterCapabilityPackRequest>;\n\nexport const WorkspaceRegisteredPack = z.object({\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  pack: CapabilityPack,\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type WorkspaceRegisteredPack = z.infer<typeof WorkspaceRegisteredPack>;\n\nexport const PackInstallationStatus = z.enum([\"active\", \"disabled\"]);\nexport type PackInstallationStatus = z.infer<typeof PackInstallationStatus>;\n\nexport const PackInstallation = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  packId: z.string().min(1),\n  status: PackInstallationStatus,\n  metadata: z.record(z.string(), z.unknown()),\n  enabledAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type PackInstallation = z.infer<typeof PackInstallation>;\n\nexport const EnablePackRequest = withVariableSetIdAlias({\n  variableSetId: z.string().uuid().optional(),\n  environmentId: z.string().uuid().optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type EnablePackRequest = z.infer<typeof EnablePackRequest>;\n\nexport const SocialProvider = z.enum([\n  \"x\",\n  \"linkedin\",\n  \"instagram\",\n  \"facebook\",\n  \"tiktok\",\n  \"youtube\",\n  \"custom\",\n]);\nexport type SocialProvider = z.infer<typeof SocialProvider>;\n\nexport const SocialConnectionStatus = z.enum([\"connected\", \"needs_reauth\", \"disabled\"]);\nexport type SocialConnectionStatus = z.infer<typeof SocialConnectionStatus>;\n\nexport const SocialConnection = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  provider: SocialProvider,\n  accountHandle: z.string().min(1),\n  accountName: z.string().nullable(),\n  externalAccountId: z.string().nullable(),\n  status: SocialConnectionStatus,\n  scopes: z.array(z.string()),\n  credentialRef: z.string().nullable(),\n  tokenMetadata: z.record(z.string(), z.unknown()),\n  metadata: z.record(z.string(), z.unknown()),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type SocialConnection = z.infer<typeof SocialConnection>;\n\nexport const CreateSocialConnectionRequest = z.object({\n  provider: SocialProvider,\n  accountHandle: z.string().min(1),\n  accountName: z.string().min(1).optional(),\n  externalAccountId: z.string().min(1).optional(),\n  status: SocialConnectionStatus.default(\"connected\"),\n  scopes: z.array(z.string().min(1)).default([]),\n  credentialRef: z.string().min(1).optional(),\n  tokenMetadata: z.record(z.string(), z.unknown()).default({}),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateSocialConnectionRequest = z.infer<typeof CreateSocialConnectionRequest>;\n\nexport const SocialPost = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  connectionId: z.string().uuid(),\n  provider: SocialProvider,\n  externalPostId: z.string().nullable(),\n  url: z.string().url().nullable(),\n  authorHandle: z.string().nullable(),\n  text: z.string(),\n  publishedAt: z.string(),\n  metrics: z.record(z.string(), z.number()),\n  raw: z.record(z.string(), z.unknown()),\n  createdAt: z.string(),\n});\nexport type SocialPost = z.infer<typeof SocialPost>;\n\nexport const CreateSocialPostRequest = z.object({\n  connectionId: z.string().uuid(),\n  externalPostId: z.string().min(1).optional(),\n  url: z.string().url().optional(),\n  authorHandle: z.string().min(1).optional(),\n  text: z.string().min(1),\n  publishedAt: z.string().datetime({ offset: true }),\n  metrics: z.record(z.string(), z.number()).default({}),\n  raw: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateSocialPostRequest = z.infer<typeof CreateSocialPostRequest>;\n\nexport const ConnectionKind = z.enum([\"oauth2\", \"api_key\", \"app_install\", \"delegated\"]);\nexport type ConnectionKind = z.infer<typeof ConnectionKind>;\n\nexport const ConnectionStatus = z.enum([\"active\", \"needs_reauth\", \"revoked\", \"error\"]);\nexport type ConnectionStatus = z.infer<typeof ConnectionStatus>;\n\nexport const OPENGENI_SLACK_BOT_CREDENTIAL_ROLE = \"opengeni_slack_bot\" as const;\nexport const OPENGENI_SLACK_BOT_CREDENTIAL_LABEL = \"OpenGeni Slack bot\" as const;\nexport const OPENGENI_SLACK_BOT_SESSION_METADATA_KEY = \"opengeniSlackBotConnectionId\" as const;\nexport const OPENGENI_SLACK_BOT_REQUIRED_SCOPES = [\n  \"chat:write\",\n  \"im:write\",\n  \"channels:read\",\n  \"channels:history\",\n  \"groups:read\",\n  \"groups:history\",\n  \"users:read\",\n] as const;\nexport const OPENGENI_SLACK_BOT_FORBIDDEN_SCOPES = [\"channels:join\", \"chat:write.public\"] as const;\n\nexport const OpenGeniSlackBotConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(OPENGENI_SLACK_BOT_CREDENTIAL_ROLE),\n    credentialLabel: z.literal(OPENGENI_SLACK_BOT_CREDENTIAL_LABEL),\n    slackTeamId: z.string().min(1).max(64),\n    slackTeamName: z.string().min(1).max(256),\n    botUserId: z.string().min(1).max(64),\n    botId: z.string().min(1).max(64),\n    botDisplayName: z.literal(\"OpenGeni\"),\n    verifiedAt: z.string().datetime({ offset: true }),\n  })\n  .passthrough();\nexport type OpenGeniSlackBotConnectionMetadata = z.infer<typeof OpenGeniSlackBotConnectionMetadata>;\n\nexport const ConnectionMetadata = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  subjectId: z.string().nullable(),\n  providerDomain: z.string(),\n  kind: ConnectionKind,\n  status: ConnectionStatus,\n  grantedScopes: z.array(z.string()),\n  expiresAt: z.string().nullable(),\n  lastRefreshAt: z.string().nullable(),\n  lastUsedAt: z.string().nullable(),\n  lastError: z.string().nullable(),\n  version: z.number().int().positive(),\n  verifiedInstallAt: z.string().datetime({ offset: true }).nullable().optional(),\n  verifiedInstallVersion: z.number().int().positive().nullable().optional(),\n  metadata: z.record(z.string(), z.unknown()),\n  createdBySubjectId: z.string().nullable(),\n  updatedBySubjectId: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ConnectionMetadata = z.infer<typeof ConnectionMetadata>;\n\nexport const ConnectionCredentialBundle = z.record(z.string(), z.unknown());\nexport type ConnectionCredentialBundle = z.infer<typeof ConnectionCredentialBundle>;\n\nexport const CreateConnectionRequest = z.object({\n  providerDomain: z.string().min(1),\n  kind: ConnectionKind,\n  subjectId: z.string().min(1).nullable().optional(),\n  credential: ConnectionCredentialBundle,\n  grantedScopes: z.array(z.string().min(1)).default([]),\n  expiresAt: z.string().datetime({ offset: true }).nullable().optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateConnectionRequest = z.infer<typeof CreateConnectionRequest>;\n\nexport const OpenGeniSlackBotInstallRequest = z.object({\n  connectionId: z.string().uuid().optional(),\n});\nexport type OpenGeniSlackBotInstallRequest = z.infer<typeof OpenGeniSlackBotInstallRequest>;\n\nexport const OpenGeniSlackBotInstallStart = z.object({\n  authorizationUrl: z.string().url(),\n  expiresAt: z.string().datetime({ offset: true }),\n});\nexport type OpenGeniSlackBotInstallStart = z.infer<typeof OpenGeniSlackBotInstallStart>;\n\nexport const UpdateConnectionRequest = z.object({\n  providerDomain: z.string().min(1).optional(),\n  subjectId: z.string().min(1).nullable().optional(),\n  kind: ConnectionKind.optional(),\n  status: ConnectionStatus.optional(),\n  credential: ConnectionCredentialBundle.optional(),\n  grantedScopes: z.array(z.string().min(1)).optional(),\n  expiresAt: z.string().datetime({ offset: true }).nullable().optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\nexport type UpdateConnectionRequest = z.infer<typeof UpdateConnectionRequest>;\n\nexport const ConnectionResponse = z.object({\n  connection: ConnectionMetadata,\n});\nexport type ConnectionResponse = z.infer<typeof ConnectionResponse>;\n\nexport const ListConnectionsResponse = z.object({\n  connections: z.array(ConnectionMetadata),\n});\nexport type ListConnectionsResponse = z.infer<typeof ListConnectionsResponse>;\n\nexport const OAuthStartRequest = z\n  .object({\n    providerDomain: z.string().min(1).optional(),\n    mcpUrl: z.string().url().optional(),\n    resource: z.string().url().optional(),\n    requestedScopes: z.array(z.string().min(1)).default([]),\n    returnPath: z.string().min(1).optional(),\n    connectionId: z.string().uuid().optional(),\n    oauthClient: z\n      .object({\n        clientId: z.string().min(1),\n        clientSecret: z.string().min(1).optional(),\n        tokenEndpointAuthMethod: z\n          .enum([\"none\", \"client_secret_post\", \"client_secret_basic\"])\n          .optional(),\n      })\n      .optional(),\n  })\n  .refine((value) => Boolean(value.mcpUrl ?? value.resource), {\n    message: \"mcpUrl is required\",\n    path: [\"mcpUrl\"],\n  });\nexport type OAuthStartRequest = z.infer<typeof OAuthStartRequest>;\n\nexport const OAuthStartResponse = z.object({\n  state: z.string().min(1),\n  authorizationUrl: z.string().url().nullable(),\n  expiresAt: z.string(),\n});\nexport type OAuthStartResponse = z.infer<typeof OAuthStartResponse>;\n\nexport const IntegrationClientMetadata = z.object({\n  client_id: z.string().url(),\n  client_name: z.literal(\"OpenGeni\"),\n  redirect_uris: z.array(z.string().url()),\n  token_endpoint_auth_method: z.literal(\"none\"),\n  grant_types: z.array(z.enum([\"authorization_code\", \"refresh_token\"])),\n  response_types: z.array(z.literal(\"code\")),\n});\nexport type IntegrationClientMetadata = z.infer<typeof IntegrationClientMetadata>;\n\nexport const MarketingDailyAnalysisTaskRequest = z.object({\n  name: z.string().min(1).optional(),\n  connectionIds: z.array(z.string().uuid()).default([]),\n  documentBaseIds: z.array(z.string().uuid()).default([]),\n  timeZone: z.string().min(1).default(\"UTC\"),\n  hour: z.number().int().min(0).max(23).default(9),\n  minute: z.number().int().min(0).max(59).default(0),\n  promptInstructions: z.string().min(1).optional(),\n  status: ScheduledTaskStatus.default(\"active\"),\n  runMode: ScheduledTaskRunMode.default(\"new_session_per_run\"),\n  overlapPolicy: ScheduledTaskOverlapPolicy.default(\"skip\"),\n});\nexport type MarketingDailyAnalysisTaskRequest = z.infer<typeof MarketingDailyAnalysisTaskRequest>;\n\nexport const CapabilityKind = z.enum([\"pack\", \"mcp\", \"api\", \"skill\", \"plugin\"]);\nexport type CapabilityKind = z.infer<typeof CapabilityKind>;\n\nexport const CapabilitySource = z.enum([\n  \"built_in\",\n  \"library\",\n  \"configured\",\n  \"public_registry\",\n  \"registry\",\n  \"manual\",\n]);\nexport type CapabilitySource = z.infer<typeof CapabilitySource>;\n\nexport const CapabilityInstallationStatus = z.enum([\"active\", \"disabled\"]);\nexport type CapabilityInstallationStatus = z.infer<typeof CapabilityInstallationStatus>;\n\nexport const CapabilityCatalogAuthKind = z.enum([\"oauth2\", \"api_key\", \"none\", \"unknown\"]);\nexport type CapabilityCatalogAuthKind = z.infer<typeof CapabilityCatalogAuthKind>;\n\nexport const CapabilityCatalogTier = z.enum([\"verified\", \"community\"]);\nexport type CapabilityCatalogTier = z.infer<typeof CapabilityCatalogTier>;\n\nexport const CapabilityRuntime = z.object({\n  available: z.boolean().default(false),\n  mcpServerId: z.string().min(1).optional(),\n  transport: z.string().min(1).optional(),\n  notes: z.string().nullable().default(null),\n  // Registry exposure provenance is server-derived and contains no endpoint or\n  // credential material.\n  catalogTrust: z\n    .object({\n      state: z.enum([\"trusted\", \"legacy_active\", \"unverified\"]),\n      reason: z.enum([\n        \"trusted_source\",\n        \"verified_probe\",\n        \"active_installation_compatibility\",\n        \"missing_verification\",\n      ]),\n    })\n    .optional(),\n});\nexport type CapabilityRuntime = z.infer<typeof CapabilityRuntime>;\n\nexport const CapabilityCatalogItem = z.object({\n  id: z.string().min(1),\n  accountId: z.string().uuid().optional(),\n  workspaceId: z.string().uuid().optional(),\n  kind: CapabilityKind,\n  source: CapabilitySource,\n  name: z.string().min(1),\n  description: z.string().nullable().default(null),\n  category: z.string().min(1).default(\"custom\"),\n  tags: z.array(z.string().min(1)).default([]),\n  homepageUrl: z.string().url().nullable().default(null),\n  endpointUrl: z.string().url().nullable().default(null),\n  installUrl: z.string().url().nullable().default(null),\n  authModel: z.string().min(1).nullable().default(null),\n  providerDomain: z.string().min(1).nullable().default(null),\n  surfaceType: z.string().min(1).nullable().default(null),\n  transport: z.string().min(1).nullable().default(null),\n  mcpUrl: z.string().url().nullable().default(null),\n  authKind: CapabilityCatalogAuthKind.nullable().default(null),\n  credentialFacts: z.array(z.record(z.string(), z.unknown())).default([]),\n  tier: CapabilityCatalogTier.nullable().default(null),\n  provenance: z.string().min(1).nullable().default(null),\n  logoAssetPath: z.string().min(1).nullable().default(null),\n  importBatchId: z.string().uuid().nullable().default(null),\n  stale: z.boolean().default(false),\n  staleAt: z.string().nullable().default(null),\n  tools: z.array(ToolRef).default([]),\n  runtime: CapabilityRuntime.default({ available: false, notes: null }),\n  enabled: z.boolean().default(false),\n  enabledReason: z.string().nullable().default(null),\n  // The non-secret connection binding stored with an enabled installation.\n  // Workspace refs retain an exact row id. Subject refs deliberately omit it:\n  // each caller resolves their own visible row by provider/kind at runtime.\n  connectionRef: z\n    .object({\n      connectionId: z.string().min(1).optional(),\n      providerDomain: z.string().min(1),\n      kind: z.string().min(1),\n      subjectScope: z.enum([\"workspace\", \"subject\"]).optional(),\n    })\n    .nullable()\n    .default(null),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  createdAt: z.string().optional(),\n  updatedAt: z.string().optional(),\n});\nexport type CapabilityCatalogItem = z.infer<typeof CapabilityCatalogItem>;\n\n/**\n * Shared trust gate for catalog visibility and runtime selection. Registry rows\n * remain durable for provenance and audit, but only a reviewed real-MCP probe\n * with known authentication is exposable. API-key rows additionally need a\n * machine-actionable header contract; prose credential instructions are not a\n * runtime contract and must fail closed.\n */\nexport function capabilityCatalogItemIsTrustedForExposure(\n  item: Pick<CapabilityCatalogItem, \"source\" | \"stale\" | \"authKind\" | \"metadata\">,\n): boolean {\n  if (item.stale) return false;\n  if (item.source !== \"registry\") return true;\n  const probe = item.metadata.mcpProbe;\n  if (!probe || typeof probe !== \"object\" || Array.isArray(probe)) return false;\n  if ((probe as Record<string, unknown>).status !== \"real\") return false;\n  if (item.authKind === null || item.authKind === \"unknown\") return false;\n  if (item.authKind !== \"api_key\") return true;\n  const contract = item.metadata.authContract;\n  if (!contract || typeof contract !== \"object\" || Array.isArray(contract)) return false;\n  const record = contract as Record<string, unknown>;\n  return (\n    typeof record.headerName === \"string\" &&\n    /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/.test(record.headerName) &&\n    typeof record.scheme === \"string\" &&\n    record.scheme.trim().length > 0\n  );\n}\n\nexport const CapabilityInstallation = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  capabilityId: z.string().min(1),\n  kind: CapabilityKind,\n  status: CapabilityInstallationStatus,\n  config: z.record(z.string(), z.unknown()),\n  metadata: z.record(z.string(), z.unknown()),\n  enabledAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type CapabilityInstallation = z.infer<typeof CapabilityInstallation>;\n\nexport const CreateCapabilityCatalogItemRequest = z.object({\n  id: z.string().min(1).optional(),\n  kind: CapabilityKind.exclude([\"pack\"]),\n  source: CapabilitySource.default(\"manual\"),\n  name: z.string().min(1),\n  description: z.string().min(1).optional(),\n  category: z.string().min(1).default(\"custom\"),\n  tags: z.array(z.string().min(1)).default([]),\n  homepageUrl: z.string().url().optional(),\n  endpointUrl: z.string().url().optional(),\n  installUrl: z.string().url().optional(),\n  authModel: z.string().min(1).optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateCapabilityCatalogItemRequest = z.infer<typeof CreateCapabilityCatalogItemRequest>;\n\nexport const EnableCapabilityRequest = withVariableSetIdAlias({\n  config: z.record(z.string(), z.unknown()).default({}),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  connectionRef: McpServerConnectionRef.optional(),\n  /**\n   * Credential headers for remote MCP capabilities (for example an\n   * Authorization bearer token). Values are encrypted at rest with the\n   * workspace-variable-sets key, injected only into the runtime MCP client,\n   * and never returned by the API — responses expose header names only.\n   */\n  headers: z.record(z.string(), z.string()).default({}),\n  /**\n   * Initial variableSet attachment for kind=pack capabilities. Mirrors the\n   * dedicated POST /packs/:id/enable body: required to enable an\n   * variableSet.required pack through the unified capability-enable path,\n   * optional otherwise. Ignored by non-pack capabilities.\n   */\n  variableSetId: z.string().uuid().optional(),\n  environmentId: z.string().uuid().optional(),\n});\nexport type EnableCapabilityRequest = z.infer<typeof EnableCapabilityRequest>;\n\nexport const CapabilityCatalogResponse = z.object({\n  items: z.array(CapabilityCatalogItem),\n  installations: z.array(CapabilityInstallation),\n});\nexport type CapabilityCatalogResponse = z.infer<typeof CapabilityCatalogResponse>;\n\nexport const DiscoverMcpCapabilitiesResponse = z.object({\n  items: z.array(CapabilityCatalogItem),\n  source: z.literal(\"official_mcp_registry\"),\n  sourceUrl: z.string().url(),\n});\nexport type DiscoverMcpCapabilitiesResponse = z.infer<typeof DiscoverMcpCapabilitiesResponse>;\n\nexport const Session = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  accountId: z.string().uuid(),\n  status: SessionStatus,\n  initialMessage: z.string(),\n  title: z.string().nullable(),\n  titleSource: z.enum([\"user\", \"agent\"]).nullable(),\n  // Per-session agent persona/system instructions supplied at create. Org-visible\n  // metadata (exposed like title/goal), never a secret and never a timeline event.\n  // null when the session carried none.\n  instructions: z.string().nullable(),\n  resources: z.array(ResourceRef),\n  skills: SessionSkills.default([]),\n  tools: z.array(ToolRef),\n  // Origin of the persisted tool allow-list. Optional for rolling client\n  // compatibility; current servers emit it and legacy rows map to `legacy`.\n  toolPolicy: SessionToolPolicy.optional(),\n  // Optimistic-concurrency fence for durable policy mutations. Optional for\n  // older clients/fixtures; current servers always emit the authoritative\n  // value.\n  toolPolicyVersion: z.number().int().positive().optional(),\n  // Secret-safe current resolution, computed at an API/read or execution\n  // boundary from IDs only. Optional because internal DB readers need not load\n  // the workspace runtime registry.\n  effectiveToolPolicy: SessionEffectiveToolPolicy.optional(),\n  metadata: z.record(z.string(), z.unknown()),\n  /** Frozen creator fact used only for creation attribution/idempotent repair. */\n  createdBy: TurnInitiator,\n  createdByContext: TurnInitiatorContext,\n  model: z.string(),\n  sandboxBackend: SandboxBackend,\n  // The OS the session's box runs. Defaults to 'linux' (today's only OS).\n  sandboxOs: SandboxOs,\n  // The shared-sandbox group the session's box belongs to. Equals the session's\n  // own id for a singleton group (today's 1:1 default); equals the parent's\n  // group when spawned shared (both sessions run in ONE box).\n  sandboxGroupId: z.string().uuid(),\n  // The first-class swappable-sandbox POINTER (bring-your-own-compute M2). NULL\n  // resolves to the session's own group sandbox (the backward-compat default);\n  // a swap sets it to the target sandbox row. active_epoch is the second epoch\n  // ABOVE the lease epoch, bumped on every swap so the routing proxy can fence a\n  // stale in-flight op and retry against the new active sandbox.\n  activeSandboxId: z.string().uuid().nullable(),\n  activeEpoch: z.number().int().nonnegative(),\n  variableSetId: z.string().uuid().nullable().default(null),\n  /** @deprecated use variableSetId */\n  environmentId: z.string().uuid().nullable().default(null),\n  // The rig this session rides (M3 runtime binding). Both are resolved and\n  // FROZEN at session create: rigId names the rig, rigVersionId pins the exact\n  // active version the session's box/env/setup/doctrine are built from for the\n  // session's whole life (a later promote does NOT move an existing session).\n  // Both null ⇒ a rig-less session (byte-for-byte today's behavior).\n  rigId: z.string().uuid().nullable().default(null),\n  rigVersionId: z.string().uuid().nullable().default(null),\n  // Non-default first-party MCP token permissions (manager-style sessions);\n  // null means the fixed worker default set.\n  firstPartyMcpPermissions: z.array(Permission).nullable(),\n  // null means the fixed minimal worker-visible default. An explicit array,\n  // including [], is the exact model-visible first-party selection.\n  firstPartyMcpTools: z.array(FirstPartyMcpToolName).nullable().default(null),\n  // Per-session third-party MCP servers, metadata only. Credential values are\n  // write-only and never appear here.\n  mcpServers: z.array(SessionMcpServerMetadata).default([]),\n  // The manager session that spawned this one via session_create (set only\n  // when the creating grant carried a worker-signed sessionId claim); null for\n  // direct API creates and scheduled-task runs. When set, this session's\n  // terminal-for-now transitions wake the parent.\n  parentSessionId: z.string().uuid().nullable(),\n  // Server-authored nested-agent lineage/policy. Root sessions are depth 0;\n  // snapshots are immutable and govern only future descendant creation.\n  rootSessionId: z.string().uuid(),\n  nestedAgentDepth: NestedAgentDepthValue,\n  maxNestedAgentDepthOverride: NestedAgentDepthValue.nullable(),\n  effectiveMaxNestedAgentDepth: NestedAgentDepthValue,\n  nestedAgentDepthPolicySource: NestedAgentDepthPolicySource,\n  nestedAgentDepthPolicySessionId: z.string().uuid().nullable(),\n  // Workspace-scoped CREATE idempotency key the session was created under (the\n  // dedup target collapsing double-submit/retry races to one session); null\n  // when the create carried no key.\n  createIdempotencyKey: z.string().nullable(),\n  temporalWorkflowId: z.string().nullable(),\n  activeTurnId: z.string().uuid().nullable(),\n  // Actual input tokens of the last model call of the most recent turn; the\n  // pre-turn portable context-compaction trigger reads it as its budget\n  // signal. Null until a turn with usage has completed.\n  lastInputTokens: z.number().int().nonnegative().nullable(),\n  queueVersion: z.number().int().nonnegative(),\n  queueHeadPosition: z.number().int(),\n  queueTailPosition: z.number().int(),\n  effectiveControl: EffectiveSessionControl,\n  lastSequence: z.number().int().nonnegative(),\n  // Multi-account Codex (P1). codexPinnedCredentialId: the account this session is\n  // manually PINNED to (null ⇒ follow the workspace active pointer).\n  // codexLastCredentialId: the account the most recent turn actually ran on (the\n  // \"Running on:\" indicator's source). Both are credential-row ids, null until set.\n  codexPinnedCredentialId: z.string().uuid().nullable(),\n  codexLastCredentialId: z.string().uuid().nullable(),\n  /** Personal (authenticated subject) workspace pin state, never workspace-global. */\n  pinned: z.boolean().default(false),\n  /** Stable pin ordering key; null when this subject has not pinned the session. */\n  pinnedAt: z.string().nullable().default(null),\n  /** Optimistic pin-state revision; zero represents an absent pin relation. */\n  pinVersion: z.number().int().nonnegative().default(0),\n  /**\n   * Server-authoritative hierarchy summary populated on session-list reads.\n   * Detail reads may omit it. The rail uses this instead of guessing a tree\n   * from whichever global recency page happened to be loaded.\n   */\n  treeStats: z\n    .object({\n      directChildren: z.number().int().nonnegative(),\n      totalDescendants: z.number().int().nonnegative(),\n      runningDescendants: z.number().int().nonnegative(),\n      queuedDescendants: z.number().int().nonnegative(),\n      attentionDescendants: z.number().int().nonnegative(),\n      pausedDescendants: z.number().int().nonnegative(),\n      failedDescendants: z.number().int().nonnegative(),\n      /** Counts are lower bounds rather than exact totals when true. */\n      truncated: z.boolean().default(false),\n    })\n    .optional(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type Session = z.infer<typeof Session>;\n\n/**\n * Additive receipt returned only by session creation. `activeTurnId` remains an\n * execution pointer and is correctly null while the first turn is queued;\n * embedders use this immutable identity to correlate their preallocated run.\n */\nexport const CreateSessionResponse = Session.extend({\n  initialTurnId: z.string().uuid().nullable(),\n});\nexport type CreateSessionResponse = z.infer<typeof CreateSessionResponse>;\n\nexport type SessionSummary = Session;\n\n/**\n * The canonical session-list page. Pinned rows are returned separately and are\n * excluded from `sessions`, so a cursor can page ordinary recency rows without\n * duplicating a pin. The newest 100 matching pins are returned, ordered by\n * pinnedAt DESC, id DESC; `pinnedTruncated` makes an older-pin omission\n * explicit. Pins are filtered by the same parent/search predicates as ordinary\n * rows.\n */\nexport const SessionListResponse = z.object({\n  pinned: z.array(Session),\n  /** True when older matching pins were omitted from this bounded page. */\n  pinnedTruncated: z.boolean().optional(),\n  sessions: z.array(Session),\n  nextCursor: z.string().nullable(),\n});\nexport type SessionListResponse = z.infer<typeof SessionListResponse>;\n\n// Recursive: the TS type is declared first so the schema annotation can carry\n// the FULL recursive shape (a shallow annotation loses type information for\n// contracts consumers after one level of nesting).\nexport type LineageNode = {\n  session: SessionSummary;\n  children: LineageNode[];\n};\nexport const LineageNode: z.ZodType<LineageNode> = z.lazy(() =>\n  z.object({\n    session: Session,\n    children: z.array(LineageNode),\n  }),\n);\n\nexport const SessionLineageResponse = z.object({\n  ancestors: z.array(Session),\n  children: z.array(LineageNode),\n  truncated: z.boolean().default(false),\n});\nexport type SessionLineageResponse = z.infer<typeof SessionLineageResponse>;\n\nexport const SessionEventType = z.enum([\n  \"session.created\",\n  // Defensive read/transport projection for a malformed or historically\n  // oversized retained event envelope. The original row stays durable; this\n  // explicit synthetic type prevents unbounded free-form envelope fields from\n  // crossing NATS, SSE, REST, or browser boundaries.\n  \"session.event.envelope_omitted\",\n  \"session.status.changed\",\n  \"session.requiresAction\",\n  \"session.humanInput.requested\",\n  \"session.context.compaction.requested\",\n  \"session.context.compacted\",\n  \"session.context.compaction.skipped\",\n  \"session.context.cleared\",\n  \"user.message\",\n  \"user.pause\",\n  \"user.approvalDecision\",\n  \"user.humanInputResponse\",\n  \"turn.queued\",\n  \"turn.started\",\n  \"turn.completed\",\n  \"turn.failed\",\n  \"turn.cancelled\",\n  \"turn.superseded\",\n  \"turn.recovery.requested\",\n  \"turn.capacity_waiting\",\n  \"agent.message.delta\",\n  \"agent.message.completed\",\n  \"agent.reasoning.delta\",\n  \"agent.toolCall.created\",\n  \"agent.toolCall.output\",\n  // Attempt-fenced Codex Responses lifecycle metadata (request identity,\n  // deadlines, first-byte/terminal phase, provider request id). Never body/auth.\n  \"agent.model.request\",\n  \"agent.model.usage\",\n  \"tool.auth_needed\",\n  \"credential.auth_needed\",\n  \"agent.updated\",\n  \"rig.setup.started\",\n  \"rig.setup.completed\",\n  \"rig.setup.skipped\",\n  \"rig.setup.failed\",\n  \"sandbox.operation.started\",\n  \"sandbox.operation.completed\",\n  \"sandbox.operation.failed\",\n  \"sandbox.command.output.delta\",\n  \"artifact.created\",\n  \"goal.set\",\n  \"goal.updated\",\n  \"goal.completed\",\n  \"goal.paused\",\n  \"goal.resumed\",\n  \"goal.cleared\",\n  \"goal.continuation\",\n  \"system.update.pending\",\n  \"system.update.delivered\",\n  \"system.update.superseded\",\n  \"system.update.cancelled\",\n  \"system.update.settled\",\n  \"session.control.paused\",\n  \"session.control.resumed\",\n  \"session.control.steer_requested\",\n  \"workspace.inference.paused\",\n  \"workspace.inference.resumed\",\n  \"session.queue.changed\",\n  \"session.queue.prompt.cancelled\",\n  \"session.queue.history\",\n  // A terminal/stale activity callback is retained as an audit wrapper rather\n  // than being dropped or emitted as though it belonged to the current turn.\n  \"turn.event.rejected_late\",\n  \"memory.saved\",\n  \"memory.corrected\",\n  // Channel-B desktop pixel-plane signals (07-channel-b §1.2). The pixel socket\n  // carries opaque RFB and cannot carry a control message the client can act on,\n  // so these ride the durable, sequenced, gap-filled Channel-A SSE spine.\n  \"stream.url.rotated\", // re-minted {url,token,expiresAt} on box rollover (event-driven)\n  \"stream.opened\", // a viewer attached (audit + refcount visibility)\n  \"stream.closed\", // a viewer detached / was reaped\n  \"stream.revoked\", // a grant was revoked → connected clients MUST disconnect now\n  // Desktop recording signals. The capture loop records the same display humans\n  // watch, then stores the finalized artifact for replay.\n  // → storage. The artifact ref rides the AVAILABLE event (storageKey, NOT a\n  // long-lived URL — clients mint a short-TTL signed GET via the route).\n  \"recording.started\", // ffmpeg launched on :0 (mode/codec/dimensions)\n  \"recording.available\", // finalized: bytes PUT to storage, replayable\n  \"recording.failed\", // ffmpeg/box-death/rollover/upload error — no artifact\n  // Structured-service notifications. File, Git, and terminal reads are\n  // synchronous API-direct point\n  // queries (their result is the HTTP response, NEVER an event). What rides A1\n  // here are the side-effect NOTIFICATIONS — a path changed, git state changed,\n  // a pty opened/printed/exited — durable, sequenced, gap-filled like every\n  // other session event, so any viewer's Pierre tree / diff / terminal stays\n  // live. fs.changed/git.changed are cache-invalidation signals; the pty.*\n  // events carry the interactive terminal byte stream.\n  \"fs.changed\", // a path was created/modified/deleted (write or agent mutation)\n  \"git.changed\", // working-tree/index/HEAD changed (debounced re-probe)\n  \"terminal.pty.started\", // an interactive PTY session opened (carries ptyId)\n  \"terminal.pty.output.delta\", // PTY stdout/stderr bytes (separate from command.output)\n  \"terminal.pty.exited\", // PTY session ended (exitCode/reason)\n  \"session.title_set\",\n  \"session.mcp.approval_policy.updated\",\n  \"session.tool_policy.updated\",\n  // Multi-account Codex (P1): the account a session's turn runs on changed\n  // (manual switch in P1; failover/rotation in P3 reuse the same event). Drives\n  // the in-session \"Running on:\" indicator's live flip.\n  \"codex.account.switched\",\n  // credential allocator per-turn selection audit. Payload is metadata only: credential row\n  // id, bounded strategy/reason, and pool counts — never token material.\n  \"codex.credential.selected\",\n  // Adaptive fleet shadow decision record. Contains only bounded opaque candidate aliases,\n  // normalized pressure/cache/confidence features, deterministic fingerprints,\n  // the actual-vs-shadow comparison, and no credential/account identity.\n  \"codex.fleet.decision\",\n  // credential allocator durable zero-capacity wait lifecycle. Runtime/system events only;\n  // no synthetic user message is created when capacity returns.\n  \"codex.capacity.waiting\",\n  \"codex.capacity.resumed\",\n  \"codex.capacity.superseded\",\n  // Sandbox durability observability (sandbox-file-persistence). The 2026-07\n  // incidents (mid-session box death with /workspace loss; a fatal manifest-env\n  // delta on a live box) were near-unattributable because box lifecycle left no\n  // durable trace — only worker logs, which rotate within hours. These events\n  // make every box transition and env recomputation drift readable from the DB\n  // alone. Payloads carry ids/flags/key NAMES only — never env values (secrets).\n  \"sandbox.box.created\", // box cold-created/cold-restored ({hydrated: \"archive\"|\"none\"})\n  \"sandbox.box.lost\", // resume-by-id found the box gone (provider NotFound)\n  \"sandbox.box.terminated\", // reaper drain terminated the box ({actor, persisted})\n  \"sandbox.box.snapshot\", // mid-session /workspace snapshot persisted ({trigger})\n  \"sandbox.env.drift\", // recomputed manifest env != live box env (key names only)\n  // Active-sandbox pointer reconcile (issue #341 invariant B). Turn start found the\n  // persisted (active_sandbox_id, active_epoch) pointing at a target the turn cannot\n  // establish — a deleted/absent sandbox, a Modal sibling with no establisher, or a\n  // selfhosted sandbox with no enrollment — and reset it to the session HOME under\n  // the epoch fence instead of routing every op into the dead target. A VISIBLE,\n  // never-silent downgrade: payload carries the typed reason + from/to epoch, never a\n  // target id or command content. Announce-only; hits the timeline projection default\n  // (no rendered item) like the other sandbox.* diagnostics.\n  \"session.route.reconciled\",\n  // Workbench v2 turn-end workspace capture. ANNOUNCE-ONLY: a new\n  // capture revision was persisted at turn end; the client refetches the latest\n  // capture. It carries metadata only (revision/turnId/capturedAt/leaseEpoch/stats),\n  // never file content. Hits the timeline projection default case (ignored) — it\n  // must NEVER gain a rendered timeline item without regenerating the golden\n  // snapshots (golden-grammar gate).\n  \"workspace.revision.captured\",\n  // Repository discovery could not prove a complete capture. The worker\n  // persisted a failed/degraded revision marker and clients must fall back to\n  // the live box rather than trust a zero-repository snapshot.\n  \"workspace.revision.degraded\",\n  // Connected Machine (selfhosted) op-outcome observability (failure-visibility\n  // doctrine, out-of-band plane). SESSION-scoped facts only: these fire for the\n  // session whose turn ran the op (the two-planes rule — machine-plane facts like\n  // pressure live in the M10 metrics DB, never as session events). Payloads carry\n  // the op kind + a typed fault class + attempt count — NEVER command content.\n  //\n  // `machine.op.failed` fires ONLY for INFRASTRUCTURE fault classes (offline,\n  // draining-exhausted, payload-too-large, reconnecting-timeout, OS/stream/protocol)\n  // — a semantic miss the model asked about (a missing path, a consent gate, a\n  // nonzero exit) is an OUTCOME, not an infra fault, and never fires this.\n  // `machine.op.recovered` is the healed-fault leading indicator (a blip/backpressure\n  // the transport absorbed): announce-only, quiet. Both hit the timeline projection's\n  // quiet status-tick tier (the severity split's \"degraded\"); adding a rendered item\n  // requires regenerating the golden snapshots (the golden-grammar gate).\n  \"machine.op.failed\",\n  \"machine.op.recovered\",\n  // Connected Machine (selfhosted) LINK-plane observability (failure-visibility\n  // doctrine). SESSION-scoped, ANNOUNCE-ONLY facts fanned out to the sessions that\n  // had an active op running on the machine when its control link changed — never\n  // to idle/historical sessions. Payloads carry ids / a typed reason / key-names\n  // only, NEVER command content.\n  //\n  // `machine.link.lost` — the machine announced a clean GoingOffline (its control\n  // link is going away) while a session had a running turn on it. `machine.link.\n  // restored` — a reconnect Hello re-established the link that was previously lost.\n  // `machine.runner.restarted` — the additional signal that the going-offline was\n  // a self-update restart specifically (link.lost also fires for it; this\n  // distinguishes a restart from a plain stop / host shutdown). All three hit the\n  // timeline projection's quiet default tier (no rendered item); adding a rendered\n  // item requires regenerating the golden snapshots (the golden-grammar gate).\n  \"machine.link.lost\",\n  \"machine.link.restored\",\n  \"machine.runner.restarted\",\n]);\nexport type SessionEventType = z.infer<typeof SessionEventType>;\n\n/**\n * Stable semantic groups for bounded session monitoring. These are a read\n * projection only: an event keeps its canonical durable `type`, and callers\n * can always combine a class with explicit type include/exclude filters.\n */\nexport const SessionEventSemanticClass = z.enum([\n  \"control\",\n  \"terminal\",\n  \"failure\",\n  \"checkpoint\",\n  \"tool_receipt\",\n  \"provider_account\",\n]);\nexport type SessionEventSemanticClass = z.infer<typeof SessionEventSemanticClass>;\n\n/**\n * The semantic classes accepted by an exclusive latest lookup. `receipt` is\n * the concise public spelling for the historical `tool_receipt` class; the\n * latter remains accepted everywhere for backwards compatibility.\n */\nexport const SessionEventLatestClass = z.enum([\n  \"control\",\n  \"terminal\",\n  \"failure\",\n  \"checkpoint\",\n  \"tool_receipt\",\n  \"provider_account\",\n  \"receipt\",\n]);\nexport type SessionEventLatestClass = z.infer<typeof SessionEventLatestClass>;\n\nexport function sessionEventLatestClassToSemanticClass(\n  value: SessionEventLatestClass,\n): SessionEventSemanticClass {\n  return value === \"receipt\" ? \"tool_receipt\" : value;\n}\n\nexport const SessionEventPayloadMode = z.enum([\"none\", \"summary\", \"full\"]);\nexport type SessionEventPayloadMode = z.infer<typeof SessionEventPayloadMode>;\n\n/** Select the compact semantic-result projection instead of an event array. */\nexport const SessionEventResultMode = z.enum([\"events\", \"compact\"]);\nexport type SessionEventResultMode = z.infer<typeof SessionEventResultMode>;\n\nexport const SessionEventReadMode = z.enum([\"monitoring\", \"forensic\"]);\nexport type SessionEventReadMode = z.infer<typeof SessionEventReadMode>;\n\nexport const SessionEventReadDirection = z.enum([\"after\", \"before\"]);\nexport type SessionEventReadDirection = z.infer<typeof SessionEventReadDirection>;\n\nexport const SESSION_EVENT_RAW_DELTA_TYPES = [\n  \"agent.message.delta\",\n  \"agent.reasoning.delta\",\n  \"sandbox.command.output.delta\",\n  \"terminal.pty.output.delta\",\n] as const satisfies readonly SessionEventType[];\n\nexport const SESSION_EVENT_SEMANTIC_CLASS_TYPES = {\n  control: [\n    \"session.status.changed\",\n    \"session.requiresAction\",\n    \"session.humanInput.requested\",\n    \"user.pause\",\n    \"user.approvalDecision\",\n    \"user.humanInputResponse\",\n    \"goal.set\",\n    \"goal.updated\",\n    \"goal.completed\",\n    \"goal.paused\",\n    \"goal.resumed\",\n    \"goal.cleared\",\n    \"goal.continuation\",\n    \"system.update.pending\",\n    \"system.update.delivered\",\n    \"system.update.superseded\",\n    \"system.update.cancelled\",\n    \"system.update.settled\",\n    \"session.control.paused\",\n    \"session.control.resumed\",\n    \"session.control.steer_requested\",\n    \"workspace.inference.paused\",\n    \"workspace.inference.resumed\",\n    \"session.queue.changed\",\n    \"session.queue.prompt.cancelled\",\n    \"session.mcp.approval_policy.updated\",\n    \"session.tool_policy.updated\",\n  ],\n  terminal: [\n    \"turn.completed\",\n    \"agent.message.completed\",\n    \"turn.failed\",\n    \"turn.cancelled\",\n    \"turn.superseded\",\n    \"goal.completed\",\n    \"goal.paused\",\n    \"rig.setup.completed\",\n    \"rig.setup.skipped\",\n    \"rig.setup.failed\",\n    \"sandbox.operation.completed\",\n    \"sandbox.operation.failed\",\n    \"recording.available\",\n    \"recording.failed\",\n    \"terminal.pty.exited\",\n  ],\n  failure: [\n    \"session.event.envelope_omitted\",\n    \"turn.failed\",\n    \"tool.auth_needed\",\n    \"credential.auth_needed\",\n    \"rig.setup.failed\",\n    \"sandbox.operation.failed\",\n    \"recording.failed\",\n    \"sandbox.box.lost\",\n    \"workspace.revision.degraded\",\n    \"machine.op.failed\",\n    \"machine.link.lost\",\n  ],\n  checkpoint: [\n    \"session.context.compaction.requested\",\n    \"session.context.compacted\",\n    \"session.context.compaction.skipped\",\n    \"session.context.cleared\",\n    \"turn.recovery.requested\",\n    \"session.queue.history\",\n    \"sandbox.box.snapshot\",\n    \"workspace.revision.captured\",\n  ],\n  tool_receipt: [\n    \"agent.toolCall.created\",\n    \"agent.toolCall.output\",\n    \"tool.auth_needed\",\n    \"artifact.created\",\n  ],\n  provider_account: [\n    \"agent.model.usage\",\n    \"codex.account.switched\",\n    \"codex.credential.selected\",\n    \"codex.capacity.waiting\",\n    \"codex.capacity.resumed\",\n    \"codex.capacity.superseded\",\n    \"sandbox.box.created\",\n    \"sandbox.box.lost\",\n    \"sandbox.box.terminated\",\n    \"sandbox.box.snapshot\",\n    \"sandbox.env.drift\",\n    \"session.route.reconciled\",\n    \"machine.op.failed\",\n    \"machine.op.recovered\",\n    \"machine.link.lost\",\n    \"machine.link.restored\",\n    \"machine.runner.restarted\",\n  ],\n} as const satisfies Record<SessionEventSemanticClass, readonly SessionEventType[]>;\n\nexport type ResolveSessionEventTypeFiltersInput = {\n  includeTypes?: readonly SessionEventType[] | undefined;\n  excludeTypes?: readonly SessionEventType[] | undefined;\n  includeClasses?: readonly SessionEventSemanticClass[] | undefined;\n  excludeClasses?: readonly SessionEventSemanticClass[] | undefined;\n  /** Applied unless the same type was explicitly included by type or class. */\n  defaultExcludeTypes?: readonly SessionEventType[] | undefined;\n};\n\n/** Resolve class/type filter algebra once so every read surface behaves alike. */\nexport function resolveSessionEventTypeFilters(input: ResolveSessionEventTypeFiltersInput): {\n  includeTypes: SessionEventType[];\n  excludeTypes: SessionEventType[];\n} {\n  const included = new Set<SessionEventType>(input.includeTypes ?? []);\n  for (const semanticClass of input.includeClasses ?? []) {\n    for (const type of SESSION_EVENT_SEMANTIC_CLASS_TYPES[semanticClass]) included.add(type);\n  }\n\n  const excluded = new Set<SessionEventType>(input.excludeTypes ?? []);\n  for (const semanticClass of input.excludeClasses ?? []) {\n    for (const type of SESSION_EVENT_SEMANTIC_CLASS_TYPES[semanticClass]) excluded.add(type);\n  }\n  for (const type of input.defaultExcludeTypes ?? []) {\n    if (!included.has(type)) excluded.add(type);\n  }\n\n  // An explicit exclusion always wins over a positive selector.\n  for (const type of excluded) included.delete(type);\n  return { includeTypes: [...included], excludeTypes: [...excluded] };\n}\n\nexport const ToolAuthNeededPayload = z.object({\n  serverId: z.string().min(1),\n  toolName: z.string().min(1).nullable().optional(),\n  providerDomain: z.string().min(1),\n  provider: z.string().min(1).max(128).optional(),\n  // Embedded hosts may use an opaque connection identity; never assume an\n  // OpenGeni UUID on the public event wire.\n  connectionId: z.string().min(1).nullable().optional(),\n  reason: z.enum([\n    \"missing_connection\",\n    \"expired\",\n    \"insufficient_scope\",\n    \"refresh_failed\",\n    \"unsupported_auth\",\n    \"resource_scope_unavailable\",\n  ]),\n  scopes: z.array(z.string().min(1)).optional(),\n  resource: z.string().min(1).optional(),\n  selectedResources: McpConnectionResourceScopes.optional(),\n  authorizationUrl: z.string().url().optional(),\n  subjectId: z.string().min(1).nullable().optional(),\n});\nexport type ToolAuthNeededPayload = z.infer<typeof ToolAuthNeededPayload>;\n\n/** A host-owned non-tool credential needed by the active run. */\nexport const CredentialAuthNeededPayload = z.object({\n  credentialClass: z.literal(\"run\"),\n  providerDomain: z.string().min(1).optional(),\n  connectionId: z.string().min(1).optional(),\n  reason: z.enum([\"missing_connection\", \"expired\", \"insufficient_scope\", \"refresh_failed\"]),\n  scopes: z.array(z.string().min(1)).optional(),\n  resource: z.string().min(1).optional(),\n  authorizationUrl: z.string().url().optional(),\n  message: z.string().min(1).optional(),\n});\nexport type CredentialAuthNeededPayload = z.infer<typeof CredentialAuthNeededPayload>;\n\n// Channel-B stream-event payloads (07-channel-b §1.2). SessionEvent.payload is\n// z.unknown() (NOT a discriminated union) — these are standalone schemas parsed\n// explicitly at the producer (the API-direct handshake/rotation) and the SDK/\n// React consumer. The rotation payload carries the freshly-minted data-plane URL\n// + the scoped stream token so a connected client hot-swaps its noVNC socket.\nexport const StreamUrlRotatedPayload = z.object({\n  url: z.string().url(),\n  token: z.string().nullable(),\n  expiresAt: z.string().datetime().nullable(),\n  // The epoch the new URL was minted under (the box-rollover fence the client\n  // reconciles against). A client must drop a rotation event whose epoch it has\n  // already advanced past.\n  leaseEpoch: z.number().int().nonnegative(),\n  transport: z.literal(\"vnc-ws\"),\n  // The viewer holder this URL is for (so a client filters out other viewers').\n  viewerId: z.string().uuid().nullable().default(null),\n});\nexport type StreamUrlRotatedPayload = z.infer<typeof StreamUrlRotatedPayload>;\n\nexport const StreamOpenedPayload = z.object({\n  viewerId: z.string().uuid(),\n  shared: z.boolean().default(false),\n  viewerCount: z.number().int().nonnegative(),\n});\nexport type StreamOpenedPayload = z.infer<typeof StreamOpenedPayload>;\n\nexport const StreamClosedPayload = z.object({\n  viewerId: z.string().uuid(),\n  reason: z.enum([\"client-disconnect\", \"reaped\", \"revoked\", \"box-rollover\"]),\n  viewerCount: z.number().int().nonnegative(),\n});\nexport type StreamClosedPayload = z.infer<typeof StreamClosedPayload>;\n\nexport const StreamRevokedPayload = z.object({\n  viewerId: z.string().uuid().nullable().default(null),\n  reason: z.enum([\"grant-revoked\", \"session-failed\", \"admin\"]),\n});\nexport type StreamRevokedPayload = z.infer<typeof StreamRevokedPayload>;\n\n// ── Recording payloads (P4.3 / module 05 §3.4) ──────────────────────────────\n// SessionEvent.payload is z.unknown() (NOT a discriminated union) — these are\n// standalone schemas parsed explicitly at the producer (the recording activity)\n// and the SDK/React consumer. The codec/contentType pair stays consistent\n// (h264-mp4↔video/mp4, vp9-webm↔video/webm).\nexport const RecordingMode = z.enum([\"manual\", \"on-turn\", \"on-verify\"]);\nexport type RecordingMode = z.infer<typeof RecordingMode>;\nexport const RecordingCodec = z.enum([\"h264-mp4\", \"vp9-webm\"]);\nexport type RecordingCodec = z.infer<typeof RecordingCodec>;\nexport const RecordingContentType = z.enum([\"video/mp4\", \"video/webm\"]);\nexport type RecordingContentType = z.infer<typeof RecordingContentType>;\n\nexport const RecordingStartedPayload = z.object({\n  recordingId: z.string().uuid(),\n  turnId: z.string().uuid().nullable(),\n  mode: RecordingMode,\n  codec: RecordingCodec,\n  dimensions: z.tuple([z.number().int().positive(), z.number().int().positive()]),\n  framerate: z.number().int().positive(),\n  startedAt: z.string(), // ISO\n  // The verification rationale (\"agent-verification: tf apply succeeded\"). Agent-\n  // authored free text — the producer caps + scrubs it before emit.\n  reason: z.string().nullable().optional(),\n});\nexport type RecordingStartedPayload = z.infer<typeof RecordingStartedPayload>;\n\nexport const RecordingAvailablePayload = z.object({\n  recordingId: z.string().uuid(),\n  turnId: z.string().uuid().nullable(),\n  codec: RecordingCodec,\n  contentType: RecordingContentType,\n  // The @opengeni/storage object key. NO long-lived URL in the event — clients\n  // mint a short-TTL signed GET via GET …/recordings/:id/url.\n  storageKey: z.string(),\n  durationSeconds: z.number().nonnegative().nullable(),\n  sizeBytes: z.number().int().nonnegative(),\n  dimensions: z.tuple([z.number().int().positive(), z.number().int().positive()]),\n});\nexport type RecordingAvailablePayload = z.infer<typeof RecordingAvailablePayload>;\n\n// `max-bytes-exceeded` is distinct from `timeout` (the -t ceiling hitting is a\n// SUCCESSFUL finalize, never a failure) — the adversarial-review F7 fix.\nexport const RecordingFailedReason = z.enum([\n  \"ffmpeg-error\",\n  \"box-death\",\n  \"box-rollover\",\n  \"upload-failed\",\n  \"max-bytes-exceeded\",\n  \"display-unavailable\",\n]);\nexport type RecordingFailedReason = z.infer<typeof RecordingFailedReason>;\n\nexport const RecordingFailedPayload = z.object({\n  recordingId: z.string().uuid(),\n  turnId: z.string().uuid().nullable(),\n  reason: RecordingFailedReason,\n  // ffmpeg-stderr tail / error detail — agent/ffmpeg-controlled, so the producer\n  // caps + scrubs it before emit (it rides redact() like every payload).\n  detail: z.string().nullable().optional(),\n});\nexport type RecordingFailedPayload = z.infer<typeof RecordingFailedPayload>;\n\n// ── Structured sandbox services ─────────────────────────────────────────────\n// Two transports on one spine: the A2 request/response shapes (FsNode tree,\n// GitDiff hunks, terminal exec) are returned INLINE on synchronous API-direct\n// routes (never the bus); the A1 notification payloads below ride the durable\n// SSE event log so every viewer's Pierre tree / diff / terminal stays live.\n\n// --- A1 event payloads -------------------------------------------------------\n\n// The agent's command-output firehose, enriched. Backward-compatible widening\n// of the existing sandbox.command.output.delta (consumers read `chunk`); the\n// producer may now also stamp stream/commandId/seq for finer terminal rendering.\nexport const SandboxCommandOutputDeltaPayload = z.object({\n  stream: z.enum([\"stdout\", \"stderr\"]).default(\"stdout\"),\n  chunk: z.string(), // raw bytes, utf-8 (lossy) — terminal is opaque-ish\n  commandId: z.string().optional(), // groups deltas to one agent command\n  seq: z.number().int().nonnegative().optional(), // intra-command ordering hint\n});\nexport type SandboxCommandOutputDeltaPayload = z.infer<typeof SandboxCommandOutputDeltaPayload>;\n\nexport const FsChangeKind = z.enum([\"created\", \"modified\", \"deleted\", \"renamed\"]);\nexport type FsChangeKind = z.infer<typeof FsChangeKind>;\nexport const FsChangedPayload = z.object({\n  changes: z\n    .array(\n      z.object({\n        path: z.string(), // workspace-relative POSIX path\n        kind: FsChangeKind,\n        isDir: z.boolean().default(false),\n        sizeBytes: z.number().int().nonnegative().nullable().default(null),\n        oldPath: z.string().optional(), // for \"renamed\"\n      }),\n    )\n    .min(1),\n  source: z.enum([\"write\", \"watch\", \"agent\"]).default(\"write\"),\n  // Monotonic FS revision (per-lease, paired with leaseEpoch for staleness).\n  revision: z.number().int().nonnegative(),\n  // The lease epoch the revision was minted under: a client invalidates on a\n  // (leaseEpoch, revision) tuple change, never a bare revision compare (H3 —\n  // revision resets to 0 on box re-key, so a bare monotonic compare goes stale).\n  leaseEpoch: z.number().int().nonnegative().default(0),\n});\nexport type FsChangedPayload = z.infer<typeof FsChangedPayload>;\n\nexport const GitChangedPayload = z.object({\n  head: z.string().nullable(), // current branch or detached SHA\n  dirty: z.boolean(), // working tree has uncommitted changes\n  ahead: z.number().int().nonnegative().default(0),\n  behind: z.number().int().nonnegative().default(0),\n  changedFileCount: z.number().int().nonnegative(),\n  reason: z\n    .enum([\"commit\", \"checkout\", \"stage\", \"worktree\", \"fetch\", \"unknown\"])\n    .default(\"unknown\"),\n  revision: z.number().int().nonnegative().default(0),\n  leaseEpoch: z.number().int().nonnegative().default(0),\n});\nexport type GitChangedPayload = z.infer<typeof GitChangedPayload>;\n\nexport const TerminalPtyStartedPayload = z.object({\n  ptyId: z.string().uuid(),\n  cols: z.number().int().positive(),\n  rows: z.number().int().positive(),\n  shell: z.string(), // resolved shell, e.g. \"/bin/bash\"\n  cwd: z.string(),\n});\nexport type TerminalPtyStartedPayload = z.infer<typeof TerminalPtyStartedPayload>;\n\nexport const TerminalPtyOutputDeltaPayload = z.object({\n  ptyId: z.string().uuid(),\n  stream: z.enum([\"stdout\", \"stderr\"]).default(\"stdout\"),\n  chunk: z.string(), // raw terminal bytes (incl. ANSI), utf-8 lossy\n  seq: z.number().int().nonnegative(), // strict per-pty ordering (owner-assigned)\n});\nexport type TerminalPtyOutputDeltaPayload = z.infer<typeof TerminalPtyOutputDeltaPayload>;\n\nexport const TerminalPtyExitedPayload = z.object({\n  ptyId: z.string().uuid(),\n  exitCode: z.number().int().nullable(),\n  reason: z.enum([\"exit\", \"killed\", \"owner_gone\", \"timeout\", \"lost\"]),\n});\nexport type TerminalPtyExitedPayload = z.infer<typeof TerminalPtyExitedPayload>;\n\n// --- A2 FileSystem request/response (NOT events; returned inline) ------------\nexport const FsNodeType = z.enum([\"file\", \"dir\", \"symlink\", \"other\"]);\nexport type FsNodeType = z.infer<typeof FsNodeType>;\n// The Pierre-tree node. `children` is present only when the dir was listed with\n// depth>0; the tree lazy-expands via repeated depth-1 lists at deeper paths.\nexport interface FsTreeNode {\n  name: string;\n  path: string; // workspace-relative POSIX, no leading slash\n  type: z.infer<typeof FsNodeType>;\n  sizeBytes: number | null; // null for dirs\n  mtimeMs: number | null;\n  mode: number | null; // unix mode bits, for Pierre tree icons/perms\n  children?: FsTreeNode[] | undefined;\n  truncated: boolean; // dir had more entries than the cap\n}\nexport const FsTreeNode: z.ZodType<FsTreeNode> = z.lazy(() =>\n  z.object({\n    name: z.string(),\n    path: z.string(),\n    type: FsNodeType,\n    sizeBytes: z.number().int().nonnegative().nullable(),\n    mtimeMs: z.number().int().nonnegative().nullable(),\n    mode: z.number().int().nullable(),\n    children: z.array(FsTreeNode).optional(),\n    truncated: z.boolean().default(false),\n  }),\n) as z.ZodType<FsTreeNode>;\n\nexport const FsListRequest = z.object({\n  path: z.string().default(\"\"), // \"\" = workspace root\n  depth: z.number().int().min(0).max(8).default(1),\n  maxEntries: z.number().int().positive().max(20_000).default(2_000),\n  includeHidden: z.boolean().default(true),\n});\nexport type FsListRequest = z.infer<typeof FsListRequest>;\nexport const FsListResponse = z.object({\n  root: FsTreeNode,\n  revision: z.number().int().nonnegative(),\n  truncated: z.boolean(), // global cap hit\n});\nexport type FsListResponse = z.infer<typeof FsListResponse>;\n\nexport const FsEncoding = z.enum([\"utf8\", \"base64\"]);\nexport type FsEncoding = z.infer<typeof FsEncoding>;\nexport const FsReadRequest = z.object({\n  path: z.string(),\n  encoding: FsEncoding.default(\"utf8\"),\n  maxBytes: z\n    .number()\n    .int()\n    .positive()\n    .max(25 * 1024 * 1024)\n    .default(5 * 1024 * 1024),\n});\nexport type FsReadRequest = z.infer<typeof FsReadRequest>;\nexport const FsReadResponse = z.object({\n  path: z.string(),\n  encoding: FsEncoding,\n  content: z.string(), // text or base64 per encoding\n  sizeBytes: z.number().int().nonnegative(), // bytes returned (== content size)\n  truncated: z.boolean(), // sizeBytes hit maxBytes; content is the prefix\n  isBinary: z.boolean(), // sniffed NUL byte in first 8KB\n  revision: z.number().int().nonnegative(),\n});\nexport type FsReadResponse = z.infer<typeof FsReadResponse>;\n\nexport const FsWriteRequest = z.object({\n  path: z.string(),\n  encoding: FsEncoding.default(\"utf8\"),\n  content: z.string(),\n  overwrite: z.boolean().default(true), // false + existing path => 409\n  createParents: z.boolean().default(true),\n});\nexport type FsWriteRequest = z.infer<typeof FsWriteRequest>;\nexport const FsWriteResponse = z.object({\n  path: z.string(),\n  sizeBytes: z.number().int().nonnegative(),\n  revision: z.number().int().nonnegative(), // == the fs.changed revision\n});\nexport type FsWriteResponse = z.infer<typeof FsWriteResponse>;\n\nexport const FsDeleteRequest = z.object({\n  path: z.string(),\n  recursive: z.boolean().default(false), // required true to delete a non-empty dir\n});\nexport type FsDeleteRequest = z.infer<typeof FsDeleteRequest>;\nexport const FsDeleteResponse = z.object({\n  revision: z.number().int().nonnegative(),\n});\nexport type FsDeleteResponse = z.infer<typeof FsDeleteResponse>;\n\nexport const FsMoveRequest = z.object({\n  path: z.string(),\n  newPath: z.string(),\n  overwrite: z.boolean().default(false), // false + existing destination => 409\n  createParents: z.boolean().default(true),\n});\nexport type FsMoveRequest = z.infer<typeof FsMoveRequest>;\nexport const FsMoveResponse = z.object({\n  path: z.string(),\n  newPath: z.string(),\n  revision: z.number().int().nonnegative(), // == the fs.changed revision\n});\nexport type FsMoveResponse = z.infer<typeof FsMoveResponse>;\n\nexport const FsMkdirRequest = z.object({\n  path: z.string(),\n  recursive: z.boolean().default(true), // false + existing path => 400\n});\nexport type FsMkdirRequest = z.infer<typeof FsMkdirRequest>;\nexport const FsMkdirResponse = z.object({\n  path: z.string(),\n  revision: z.number().int().nonnegative(), // == the fs.changed revision\n});\nexport type FsMkdirResponse = z.infer<typeof FsMkdirResponse>;\n\n// --- A2 Git request/response (read-only; feeds Pierre diff/tree) -------------\nexport const GitFileStatusCode = z.enum([\n  \"added\",\n  \"modified\",\n  \"deleted\",\n  \"renamed\",\n  \"copied\",\n  \"untracked\",\n  \"ignored\",\n  \"conflicted\",\n  \"typechange\",\n]);\nexport type GitFileStatusCode = z.infer<typeof GitFileStatusCode>;\nexport const GitFileStatus = z.object({\n  path: z.string(),\n  oldPath: z.string().nullable(), // for renamed/copied\n  index: GitFileStatusCode.nullable(), // staged change (X in porcelain XY)\n  worktree: GitFileStatusCode.nullable(), // unstaged change (Y in porcelain XY)\n  isConflicted: z.boolean().default(false),\n});\nexport type GitFileStatus = z.infer<typeof GitFileStatus>;\nexport const GitStatusRequest = z.object({\n  path: z.string().default(\"\"), // repo root within workspace (multi-repo support)\n});\nexport type GitStatusRequest = z.infer<typeof GitStatusRequest>;\nexport const GitStatusResponse = z.object({\n  isRepo: z.boolean(),\n  head: z.string().nullable(), // branch name\n  detached: z.boolean().default(false),\n  upstream: z.string().nullable(),\n  ahead: z.number().int().nonnegative().default(0),\n  behind: z.number().int().nonnegative().default(0),\n  files: z.array(GitFileStatus),\n  revision: z.number().int().nonnegative(),\n});\nexport type GitStatusResponse = z.infer<typeof GitStatusResponse>;\n\n// The structured hunk shape that feeds Pierre diff — the whole point of Git.\nexport const GitDiffLineType = z.enum([\"context\", \"add\", \"del\", \"meta\"]);\nexport type GitDiffLineType = z.infer<typeof GitDiffLineType>;\nexport const GitDiffLine = z.object({\n  type: GitDiffLineType,\n  // null on the side that doesn't have the line (add => oldNo null; del => newNo null)\n  oldNo: z.number().int().positive().nullable(),\n  newNo: z.number().int().positive().nullable(),\n  text: z.string(), // line WITHOUT leading +/-/space marker\n});\nexport type GitDiffLine = z.infer<typeof GitDiffLine>;\nexport const GitDiffHunk = z.object({\n  oldStart: z.number().int().nonnegative(),\n  oldLines: z.number().int().nonnegative(),\n  newStart: z.number().int().nonnegative(),\n  newLines: z.number().int().nonnegative(),\n  header: z.string(), // the @@ ... @@ section heading\n  lines: z.array(GitDiffLine),\n});\nexport type GitDiffHunk = z.infer<typeof GitDiffHunk>;\nexport const GitFileDiff = z.object({\n  path: z.string(),\n  oldPath: z.string().nullable(),\n  status: GitFileStatusCode,\n  isBinary: z.boolean().default(false),\n  isImage: z.boolean().default(false),\n  additions: z.number().int().nonnegative(),\n  deletions: z.number().int().nonnegative(),\n  hunks: z.array(GitDiffHunk), // empty if binary or truncated\n  truncated: z.boolean().default(false), // diff exceeded maxBytes; hunks omitted\n});\nexport type GitFileDiff = z.infer<typeof GitFileDiff>;\nexport const GitDiffRequest = z.object({\n  path: z.string().default(\"\"), // repo root\n  // diff selectors, mutually exclusive precedence: refs > staged > worktree\n  staged: z.boolean().default(false), // --cached (index vs HEAD)\n  // Workspace review includes after-images that ordinary `git diff` omits.\n  // Explicit so commit/staged consumers keep native Git semantics by default.\n  includeUntracked: z.boolean().default(false),\n  fromRef: z.string().optional(),\n  toRef: z.string().optional(),\n  pathspec: z.array(z.string()).default([]),\n  contextLines: z.number().int().min(0).max(10).default(3),\n  maxBytesPerFile: z\n    .number()\n    .int()\n    .positive()\n    .max(2 * 1024 * 1024)\n    .default(512 * 1024),\n});\nexport type GitDiffRequest = z.infer<typeof GitDiffRequest>;\nexport const GitDiffResponse = z.object({\n  files: z.array(GitFileDiff),\n  revision: z.number().int().nonnegative(),\n});\nexport type GitDiffResponse = z.infer<typeof GitDiffResponse>;\n\n// ─── Workbench v2 turn-end workspace capture ────────────\n// A capture is a point-in-time snapshot of the session workspace's CHANGES,\n// probed live off the box at turn end (detectRepos → gitStatus/gitDiff → fsRead\n// after-images → fsList tree index). It is the cold/offline read source that\n// lets the workbench paint instantly with zero machine round-trips. Live always\n// wins when the box is warm; a capture is a labelled cache, never a replacement.\n// This is the shape the M1 worker writes and the M2 API serves inline.\n\n// One touched file in the capture. `contentRef` is the content-addressed storage\n// key of its after-image blob (shared across revisions → the GC set-difference\n// key). Deleted / binary / >5MB (tooLarge) files carry no contentRef; the UI\n// renders \"too large — open live\" for tooLarge, and the diff hunks for the rest.\nexport const WorkspaceCaptureFile = z.object({\n  path: z.string(),\n  status: GitFileStatusCode,\n  // sha256 of the captured after-image bytes; null when deleted / tooLarge.\n  hash: z.string().nullable(),\n  // git blob sha of the HEAD version — the wake-on-edit flush guard (design\n  // §10.1). null when the path is new/untracked (no HEAD blob).\n  baseHash: z.string().nullable(),\n  // Content-addressed storage key of the after-image; null when deleted /\n  // tooLarge / binary (no inline content captured).\n  contentRef: z.string().nullable(),\n  sizeBytes: z.number().int().nonnegative(),\n  isBinary: z.boolean().default(false),\n  // >5MB per-file content guard tripped: content NOT captured, render \"open live\".\n  tooLarge: z.boolean().default(false),\n  deleted: z.boolean().default(false),\n});\nexport type WorkspaceCaptureFile = z.infer<typeof WorkspaceCaptureFile>;\n\n// One repo discovered in the workspace. `diff` is `git diff HEAD` (combined\n// staged+unstaged tracked changes vs HEAD — the review diff); `status` is the\n// full porcelain file list (drives the rail glyphs incl. untracked, which the\n// HEAD diff omits). root \"\" = the workspace root repo.\nexport const WorkspaceCaptureRepo = z.object({\n  root: z.string(),\n  head: z.string().nullable(),\n  detached: z.boolean().default(false),\n  upstream: z.string().nullable(),\n  ahead: z.number().int().nonnegative().default(0),\n  behind: z.number().int().nonnegative().default(0),\n  status: z.array(GitFileStatus),\n  diff: z.array(GitFileDiff),\n});\nexport type WorkspaceCaptureRepo = z.infer<typeof WorkspaceCaptureRepo>;\n\nexport const WorkspaceCaptureDegradedReason = z.enum([\n  \"repository_discovery_command_failed\",\n  \"repository_discovery_timed_out\",\n  \"repository_discovery_result_limit_exceeded\",\n  \"repository_read_unavailable\",\n]);\nexport type WorkspaceCaptureDegradedReason = z.infer<typeof WorkspaceCaptureDegradedReason>;\n\n// Rollup counters — carried on the row (jsonb) and the announce event so the UI\n// can reserve layout (no layout shift) before fetching the manifest.\nexport const WorkspaceCaptureStats = z.object({\n  repoCount: z.number().int().nonnegative(),\n  fileCount: z.number().int().nonnegative(),\n  additions: z.number().int().nonnegative(),\n  deletions: z.number().int().nonnegative(),\n  totalBytes: z.number().int().nonnegative(),\n  tooLargeCount: z.number().int().nonnegative(),\n  binaryCount: z.number().int().nonnegative(),\n  treeEntryCount: z.number().int().nonnegative(),\n  treeTruncated: z.boolean().default(false),\n  durationMs: z.number().int().nonnegative(),\n  // sha256 over the change surface (per-file path/hash/status + per-repo diff\n  // summary, tree/mtime excluded). The empty-turn gate skips a capture whose\n  // fingerprint equals the previous revision's — \"no new revision when nothing\n  // changed\" holds even when the tree stays dirty across read-only turns.\n  fingerprint: z.string().optional(),\n});\nexport type WorkspaceCaptureStats = z.infer<typeof WorkspaceCaptureStats>;\n\n// The single manifest blob (one per revision). Holds everything the workbench\n// needs for a cold paint: the tree index, per-repo status+diff, and the file\n// index (after-image refs). The M2 API serves this inline when small (≤2MB).\nexport const WorkspaceCaptureManifest = z.object({\n  version: z.literal(1),\n  revision: z.number().int().nonnegative(),\n  capturedAt: z.string(),\n  turnId: z.string().nullable(),\n  leaseEpoch: z.number().int().nonnegative(),\n  treeIndex: FsTreeNode,\n  treeTruncated: z.boolean().default(false),\n  repos: z.array(WorkspaceCaptureRepo),\n  files: z.array(WorkspaceCaptureFile),\n  stats: WorkspaceCaptureStats,\n});\nexport type WorkspaceCaptureManifest = z.infer<typeof WorkspaceCaptureManifest>;\n\n// Announce-only event payload. Metadata only — never content.\nexport const WorkspaceRevisionCapturedPayload = z.object({\n  revision: z.number().int().nonnegative(),\n  turnId: z.string().nullable(),\n  capturedAt: z.string(),\n  leaseEpoch: z.number().int().nonnegative(),\n  stats: WorkspaceCaptureStats,\n});\nexport type WorkspaceRevisionCapturedPayload = z.infer<typeof WorkspaceRevisionCapturedPayload>;\n\nexport const WorkspaceRevisionDegradedPayload = z.object({\n  revision: z.number().int().nonnegative(),\n  turnId: z.string().nullable(),\n  capturedAt: z.string(),\n  leaseEpoch: z.number().int().nonnegative(),\n  reason: WorkspaceCaptureDegradedReason,\n});\nexport type WorkspaceRevisionDegradedPayload = z.infer<typeof WorkspaceRevisionDegradedPayload>;\n\n// --- M2 capture READ API -------------------------------------\n// A short-TTL signed GET URL minted PER REQUEST (never stored). The manifest is\n// served inline for the ≤2MB common case (the <200ms one-round-trip paint); a\n// >2MB manifest and a >256KB single-file after-image fall back to one of these.\nexport const WorkspaceCaptureSignedUrl = z.object({\n  url: z.string().url(),\n  expiresAt: z.string(),\n});\nexport type WorkspaceCaptureSignedUrl = z.infer<typeof WorkspaceCaptureSignedUrl>;\n\n// GET …/sessions/:sid/workspace/capture. `{available:false}` when no capture row\n// exists yet (or its manifest blob was GC'd) — the client falls back to the\n// live/wake path (status-quo behavior, NEVER an error → served 200). When\n// available: the row metadata (revision/turn/epoch/stats/size) is always inline;\n// the manifest is inline (`manifest`) for the ≤2MB common case and a signed GET\n// URL (`manifestUrl`) above that. Exactly one of manifest/manifestUrl is non-null.\nexport const GetWorkspaceCaptureResponse = z.discriminatedUnion(\"available\", [\n  z.object({\n    available: z.literal(false),\n    // Optional for additive compatibility with older servers. New servers set\n    // these fields when the newest durable revision is an explicit degraded\n    // marker rather than \"no capture exists yet\".\n    degradedReason: WorkspaceCaptureDegradedReason.nullable().optional(),\n    revision: z.number().int().nonnegative().nullable().optional(),\n    capturedAt: z.string().nullable().optional(),\n    turnId: z.string().nullable().optional(),\n    leaseEpoch: z.number().int().nonnegative().nullable().optional(),\n  }),\n  z.object({\n    available: z.literal(true),\n    revision: z.number().int().nonnegative(),\n    capturedAt: z.string(),\n    turnId: z.string().nullable(),\n    leaseEpoch: z.number().int().nonnegative(),\n    sizeBytes: z.number().int().nonnegative(),\n    stats: WorkspaceCaptureStats,\n    manifest: WorkspaceCaptureManifest.nullable().default(null),\n    manifestUrl: WorkspaceCaptureSignedUrl.nullable().default(null),\n  }),\n]);\nexport type GetWorkspaceCaptureResponse = z.infer<typeof GetWorkspaceCaptureResponse>;\n\n// GET …/sessions/:sid/workspace/capture/file?path=…&revision=…. A single\n// after-image resolved from the (revision|latest) manifest. The file metadata\n// (from the manifest entry) is always present; `content` is inline for ≤256KB\n// (base64 for binary, utf8 otherwise), else a signed GET URL (`contentUrl`) to\n// the raw content-addressed blob. A tooLarge marker (or a captured file with no\n// content blob — e.g. the after-image was GC'd) returns metadata only, no\n// content and no URL. Path-not-in-manifest / deleted → 404 at the route (not\n// represented here).\nexport const GetWorkspaceCaptureFileResponse = z.object({\n  path: z.string(),\n  revision: z.number().int().nonnegative(),\n  status: GitFileStatusCode,\n  hash: z.string().nullable(),\n  baseHash: z.string().nullable(),\n  sizeBytes: z.number().int().nonnegative(),\n  isBinary: z.boolean(),\n  tooLarge: z.boolean(),\n  encoding: FsEncoding.nullable().default(null), // set iff content is inline\n  content: z.string().nullable().default(null), // inline ≤256KB (per encoding)\n  contentUrl: WorkspaceCaptureSignedUrl.nullable().default(null), // signed >256KB\n});\nexport type GetWorkspaceCaptureFileResponse = z.infer<typeof GetWorkspaceCaptureFileResponse>;\n\nexport const GitLogRequest = z.object({\n  path: z.string().default(\"\"),\n  ref: z.string().default(\"HEAD\"),\n  maxCount: z.number().int().positive().max(1_000).default(100),\n  skip: z.number().int().nonnegative().default(0),\n  pathspec: z.array(z.string()).default([]),\n});\nexport type GitLogRequest = z.infer<typeof GitLogRequest>;\nexport const GitCommit = z.object({\n  sha: z.string(),\n  shortSha: z.string(),\n  parents: z.array(z.string()),\n  author: z.object({\n    name: z.string(),\n    email: z.string(),\n    timestamp: z.number().int(),\n  }),\n  committer: z.object({\n    name: z.string(),\n    email: z.string(),\n    timestamp: z.number().int(),\n  }),\n  subject: z.string(),\n  body: z.string(),\n  refs: z.array(z.string()).default([]), // decorations: branch/tag pointers\n});\nexport type GitCommit = z.infer<typeof GitCommit>;\nexport const GitLogResponse = z.object({\n  commits: z.array(GitCommit),\n  hasMore: z.boolean(),\n});\nexport type GitLogResponse = z.infer<typeof GitLogResponse>;\n\nexport const GitShowRequest = z.object({\n  path: z.string().default(\"\"),\n  ref: z.string(), // a commit/tag/tree-ish\n  filePath: z.string().optional(), // ref + filePath => raw blob (\"open file at commit\")\n  encoding: FsEncoding.default(\"utf8\"),\n  maxBytesPerFile: z\n    .number()\n    .int()\n    .positive()\n    .max(2 * 1024 * 1024)\n    .default(512 * 1024),\n});\nexport type GitShowRequest = z.infer<typeof GitShowRequest>;\nexport const GitShowResponse = z.object({\n  commit: GitCommit.nullable(), // null when fetching a raw blob\n  files: z.array(GitFileDiff), // commit diff vs first parent\n  blob: z\n    .object({\n      content: z.string(),\n      encoding: FsEncoding,\n      sizeBytes: z.number().int(),\n      truncated: z.boolean(),\n    })\n    .nullable(),\n  revision: z.number().int().nonnegative(),\n});\nexport type GitShowResponse = z.infer<typeof GitShowResponse>;\n\n// --- A2 Terminal exec (run a command in-box, stream stdout/stderr) -----------\n// The command-output FIREHOSE rides A1 (sandbox.command.output.delta). This is\n// the SYNCHRONOUS exec: run a bounded command and return its stdout/stderr +\n// exit code inline (the result IS the HTTP response). Full interactive PTY\n// (open/write/resize) layers on top via the pty.* events; exec ships now.\nexport const TerminalExecRequest = z.object({\n  command: z.string().min(1),\n  cwd: z.string().default(\"\"), // workspace-relative\n  // Hard wall-clock bound. A timeout response is returned only after the exact\n  // provider process is physically absent and any retained admission settles.\n  timeoutMs: z.number().int().positive().max(120_000).default(30_000),\n  // Stream the deltas onto A1 as the agent firehose (so other viewers see it),\n  // in addition to returning the buffered result inline.\n  emitStream: z.boolean().default(true),\n});\nexport type TerminalExecRequest = z.infer<typeof TerminalExecRequest>;\nexport const TerminalExecResponse = z.object({\n  stdout: z.string(),\n  stderr: z.string(),\n  exitCode: z.number().int(),\n  // Retained for wire compatibility; synchronous exec never exposes a live\n  // provider process. Interactive work uses the PTY API.\n  running: z.literal(false),\n  wallTimeSeconds: z.number().nonnegative(),\n});\nexport type TerminalExecResponse = z.infer<typeof TerminalExecResponse>;\n\n// --- A2 Terminal PTY control (output rides A1) -------------------------------\nexport const PtyOpenRequest = z.object({\n  cols: z.number().int().positive().max(500).default(80),\n  rows: z.number().int().positive().max(300).default(24),\n  cwd: z.string().default(\"\"), // workspace-relative\n  shell: z.string().optional(), // default: resolved login shell\n});\nexport type PtyOpenRequest = z.infer<typeof PtyOpenRequest>;\nexport const PtyOpenResponse = z.object({\n  ptyId: z.string().uuid(),\n  // output streams as terminal.pty.output.delta on the SSE channel the client holds\n  streamVia: z.literal(\"sse-events\"),\n  supportsInput: z.boolean(), // false on backends without writeStdin\n});\nexport type PtyOpenResponse = z.infer<typeof PtyOpenResponse>;\nexport const PtyWriteRequest = z.object({\n  ptyId: z.string().uuid(),\n  data: z.string(),\n}); // utf-8 stdin\nexport type PtyWriteRequest = z.infer<typeof PtyWriteRequest>;\nexport const PtyResizeRequest = z.object({\n  ptyId: z.string().uuid(),\n  cols: z.number().int().positive(),\n  rows: z.number().int().positive(),\n});\nexport type PtyResizeRequest = z.infer<typeof PtyResizeRequest>;\nexport const PtyCloseRequest = z.object({ ptyId: z.string().uuid() });\nexport type PtyCloseRequest = z.infer<typeof PtyCloseRequest>;\n\n// Per-session structured-service capabilities (the Channel-A slice of the\n// negotiation). The full SessionCapabilities doc already carries FileSystem /\n// Terminal / Git blocks (P0.1); this is the compact projection the SDK mirrors.\nexport const SessionStructuredCapabilities = z.object({\n  FileSystem: z.object({\n    available: z.boolean(),\n    readOnly: z.boolean(),\n    root: z.string(),\n  }),\n  Terminal: z.object({\n    events: z.boolean(), // command.output firehose (always on if a box exists)\n    exec: z.boolean(), // synchronous terminal exec\n    pty: z.object({ available: z.boolean() }), // interactive stdin (writeStdin)\n  }),\n  Git: z.object({ available: z.boolean(), repos: z.array(z.string()) }),\n});\nexport type SessionStructuredCapabilities = z.infer<typeof SessionStructuredCapabilities>;\n\nexport const SessionEvent = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  sequence: z.number().int().positive(),\n  type: SessionEventType,\n  payload: z.unknown().default({}),\n  occurredAt: z.string(),\n  clientEventId: SessionOperationKey.nullable().optional(),\n  turnId: z.string().uuid().nullable().optional(),\n  turnGeneration: z.number().int().nonnegative().nullable().optional(),\n  turnAttemptId: z.string().uuid().nullable().optional(),\n  turnAssociation: z.enum([\"current\", \"late_rejected\", \"duplicate\"]).nullable().optional(),\n  duplicateOfEventId: z.string().uuid().nullable().optional(),\n  duplicateReason: z.string().min(1).max(1024).nullable().optional(),\n});\nexport type SessionEvent = z.infer<typeof SessionEvent>;\n\nexport type SessionEventCompactResult = {\n  version: 1;\n  semanticClass: SessionEventSemanticClass;\n  source: {\n    id: string;\n    type: SessionEventType;\n    sequence: number;\n    occurredAt: string;\n    turnId: string | null;\n    turnGeneration: number | null;\n    turnAttemptId: string | null;\n    turnAssociation: SessionEvent[\"turnAssociation\"];\n  };\n  // These identity fields are repeated at the top level intentionally: an\n  // MCP caller can act on the result without unpacking the source envelope.\n  id: string;\n  type: SessionEventType;\n  sequence: number;\n  occurredAt: string;\n  turnId: string | null;\n  turnGeneration: number | null;\n  turnAttemptId: string | null;\n  turnAssociation: SessionEvent[\"turnAssociation\"];\n  coveredSequence: { first: number; last: number };\n  status:\n    | \"completed\"\n    | \"failed\"\n    | \"cancelled\"\n    | \"superseded\"\n    | \"checkpoint\"\n    | \"receipt\"\n    | \"unknown\";\n  text: string | null;\n  output: unknown;\n  result: unknown;\n  failure: {\n    error: string | null;\n    code: string | null;\n    retryable: boolean | null;\n    recovery: string | null;\n  } | null;\n  checkpoint: unknown;\n  receipt: unknown;\n  truncation: {\n    truncated: boolean;\n    fields: string[];\n    originalBytes: number | null;\n    deliveredBytes: number;\n  };\n};\n\nconst SESSION_EVENT_COMPACT_RESULT_TEXT_MAX_BYTES = 12 * 1024;\n// Five independently bounded slots plus identity/metadata must fit below the\n// 64 KiB MCP envelope even when a pathological producer supplies every slot.\nconst SESSION_EVENT_COMPACT_RESULT_VALUE_MAX_BYTES = 8 * 1024;\n\ntype CompactValue = {\n  value: unknown;\n  truncated: boolean;\n  originalBytes: number | null;\n};\n\ntype JsonRecord = Record<string, unknown>;\n\n/**\n * Build the bounded semantic result used by `latest + result=compact`.\n *\n * This is intentionally a pure projection over one already-authoritative\n * event. It never reads history, invokes a model, follows a URL, or stores an\n * artifact. The DB/API/MCP layers decide which event is authoritative; this\n * helper only extracts the small result facts that can cross a client boundary.\n */\nexport function compactSessionEventResult(\n  event: SessionEvent,\n  semanticClass: SessionEventSemanticClass,\n  coveredSequence: { first: number; last: number } = {\n    first: event.sequence,\n    last: event.sequence,\n  },\n): SessionEventCompactResult {\n  const payload = isSessionEventJsonRecord(event.payload) ? event.payload : {};\n  const fields: string[] = [];\n  let originalBytes = 0;\n\n  const textCandidate = typeof payload.text === \"string\" ? payload.text : null;\n  const outputCandidate = Object.prototype.hasOwnProperty.call(payload, \"output\")\n    ? payload.output\n    : null;\n  const resultCandidate = Object.prototype.hasOwnProperty.call(payload, \"result\")\n    ? payload.result\n    : undefined;\n  const textValue = textCandidate ?? (typeof outputCandidate === \"string\" ? outputCandidate : null);\n  const text = textValue === null ? null : compactResultText(textValue);\n  if (text && text.truncated) {\n    fields.push(\"text\");\n    originalBytes += text.originalBytes ?? 0;\n  }\n\n  const output = compactResultValue(outputCandidate);\n  if (outputCandidate !== null && output.truncated) {\n    fields.push(\"output\");\n    originalBytes += output.originalBytes ?? 0;\n  }\n\n  const result = compactResultValue(\n    resultCandidate === undefined ? (textValue ?? outputCandidate) : resultCandidate,\n  );\n  if (resultCandidate !== undefined && result.truncated) {\n    fields.push(\"result\");\n    originalBytes += result.originalBytes ?? 0;\n  }\n\n  const checkpointField = firstOwnPayloadValue(payload, [\"checkpoint\", \"summary\", \"snapshot\"]);\n  const checkpointCandidate =\n    checkpointField !== undefined\n      ? checkpointField\n      : semanticClass === \"checkpoint\"\n        ? payload\n        : null;\n  const checkpoint = compactResultValue(checkpointCandidate);\n  if (checkpointCandidate !== null && checkpoint.truncated) {\n    fields.push(\"checkpoint\");\n    originalBytes += checkpoint.originalBytes ?? 0;\n  }\n\n  const receiptCandidate = firstOwnPayloadValue(payload, [\"receipt\", \"receiptData\"]);\n  const receipt = compactResultValue(\n    receiptCandidate !== undefined\n      ? receiptCandidate\n      : semanticClass === \"tool_receipt\"\n        ? payload\n        : null,\n  );\n  if (receipt.truncated) {\n    fields.push(\"receipt\");\n    originalBytes += receipt.originalBytes ?? 0;\n  }\n\n  const failure = compactFailure(payload, event.type);\n  if (failure.truncated) {\n    fields.push(\"failure\");\n    originalBytes += failure.originalBytes ?? 0;\n  }\n\n  if (isSessionEventJsonRecord(payload.truncation) && payload.truncation.truncated === true) {\n    fields.push(\"payload\");\n  }\n\n  const source = {\n    id: event.id,\n    type: event.type,\n    sequence: event.sequence,\n    occurredAt: event.occurredAt,\n    turnId: event.turnId ?? null,\n    turnGeneration: event.turnGeneration ?? null,\n    turnAttemptId: event.turnAttemptId ?? null,\n    turnAssociation: event.turnAssociation ?? null,\n  };\n  const status = compactResultStatus(event.type, semanticClass, payload);\n  const outputValue = outputCandidate === null ? null : output.value;\n  const resultValue = result.value;\n  const checkpointValue = checkpointCandidate === null ? null : checkpoint.value;\n  const receiptValue =\n    receiptCandidate === null && semanticClass !== \"tool_receipt\" ? null : receipt.value;\n  const compact: SessionEventCompactResult = {\n    version: 1,\n    semanticClass,\n    source,\n    id: source.id,\n    type: source.type,\n    sequence: source.sequence,\n    occurredAt: source.occurredAt,\n    turnId: source.turnId,\n    turnGeneration: source.turnGeneration,\n    turnAttemptId: source.turnAttemptId,\n    turnAssociation: source.turnAssociation,\n    coveredSequence,\n    status,\n    text: text?.value ?? null,\n    output: outputValue,\n    result: resultValue,\n    failure: failure.value,\n    checkpoint: checkpointValue,\n    receipt: receiptValue,\n    truncation: {\n      truncated: fields.length > 0,\n      fields: [...new Set(fields)],\n      originalBytes: fields.length > 0 ? originalBytes || null : null,\n      deliveredBytes: sessionEventJsonBytes({\n        text: text?.value ?? null,\n        output: outputValue,\n        result: resultValue,\n        failure: failure.value,\n        checkpoint: checkpointValue,\n        receipt: receiptValue,\n      }),\n    },\n  };\n  return compact;\n}\n\nfunction isSessionEventJsonRecord(value: unknown): value is JsonRecord {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction firstOwnPayloadValue(payload: JsonRecord, keys: readonly string[]): unknown | undefined {\n  for (const key of keys) {\n    if (Object.prototype.hasOwnProperty.call(payload, key)) return payload[key];\n  }\n  return undefined;\n}\n\nfunction compactResultText(value: string): CompactValue & { value: string } {\n  const originalBytes = new TextEncoder().encode(value).byteLength;\n  if (originalBytes <= SESSION_EVENT_COMPACT_RESULT_TEXT_MAX_BYTES) {\n    return { value, truncated: false, originalBytes };\n  }\n  let omittedBytes = originalBytes - SESSION_EVENT_COMPACT_RESULT_TEXT_MAX_BYTES;\n  let projected = value;\n  for (let attempt = 0; attempt < 4; attempt += 1) {\n    const marker = `…[${omittedBytes} UTF-8 bytes omitted from compact result]…`;\n    const budget = Math.max(0, SESSION_EVENT_COMPACT_RESULT_TEXT_MAX_BYTES - utf8Bytes(marker));\n    const head = utf8PrefixForResult(value, Math.floor(budget * 0.7));\n    const tail = utf8SuffixForResult(value, budget - utf8Bytes(head));\n    projected = `${head}${marker}${tail}`;\n    const nextOmitted = Math.max(0, originalBytes - utf8Bytes(head) - utf8Bytes(tail));\n    if (nextOmitted === omittedBytes) break;\n    omittedBytes = nextOmitted;\n  }\n  return { value: projected, truncated: true, originalBytes };\n}\n\nfunction compactResultValue(value: unknown): CompactValue {\n  if (value === null || value === undefined) {\n    return { value: null, truncated: false, originalBytes: null };\n  }\n  const measurement = measureSessionEventJson(value);\n  const bounded = boundSessionEventPayload(value, {\n    surface: \"http_projection\",\n    maxBytes: SESSION_EVENT_COMPACT_RESULT_VALUE_MAX_BYTES,\n  });\n  const deliveredBytes = measureSessionEventJson(bounded).bytes;\n  return {\n    value: bounded,\n    truncated:\n      measurement.bytes === null || deliveredBytes === null || measurement.bytes !== deliveredBytes,\n    originalBytes: measurement.bytes,\n  };\n}\n\nfunction compactFailure(\n  payload: JsonRecord,\n  eventType: SessionEventType,\n): CompactValue & {\n  value: SessionEventCompactResult[\"failure\"];\n} {\n  const isFailure =\n    eventType === \"turn.failed\" ||\n    eventType === \"turn.cancelled\" ||\n    eventType === \"turn.superseded\";\n  const hasFailureField = [\"error\", \"code\", \"retryable\", \"recovery\"].some((key) =>\n    Object.prototype.hasOwnProperty.call(payload, key),\n  );\n  if (!isFailure && !hasFailureField) {\n    return { value: null, truncated: false, originalBytes: null };\n  }\n  const error = compactResultStringField(payload.error);\n  const code = compactResultStringField(payload.code);\n  const recovery = compactResultStringField(payload.recovery);\n  const retryable = typeof payload.retryable === \"boolean\" ? payload.retryable : null;\n  const value = { error: error.value, code: code.value, retryable, recovery: recovery.value };\n  const originalBytes = [error, code, recovery]\n    .map((field) => field.originalBytes ?? 0)\n    .reduce((sum, bytes) => sum + bytes, 0);\n  return {\n    value,\n    truncated: error.truncated || code.truncated || recovery.truncated,\n    originalBytes: originalBytes || null,\n  };\n}\n\nfunction compactResultStringField(value: unknown): CompactValue & { value: string | null } {\n  if (typeof value !== \"string\") {\n    return { value: null, truncated: false, originalBytes: null };\n  }\n  return compactResultText(value);\n}\n\nfunction compactResultStatus(\n  eventType: SessionEventType,\n  semanticClass: SessionEventSemanticClass,\n  payload: JsonRecord,\n): SessionEventCompactResult[\"status\"] {\n  if (eventType === \"turn.failed\") return \"failed\";\n  if (eventType === \"turn.cancelled\") return \"cancelled\";\n  if (eventType === \"turn.superseded\") return \"superseded\";\n  if (eventType === \"turn.completed\" || eventType === \"agent.message.completed\") {\n    return \"completed\";\n  }\n  if (semanticClass === \"checkpoint\") return \"checkpoint\";\n  if (\n    semanticClass === \"tool_receipt\" ||\n    eventType === \"artifact.created\" ||\n    eventType === \"recording.available\"\n  ) {\n    return \"receipt\";\n  }\n  if (payload.status === \"failed\") return \"failed\";\n  if (payload.status === \"completed\") return \"completed\";\n  return \"unknown\";\n}\n\nfunction utf8Bytes(value: string): number {\n  return new TextEncoder().encode(value).byteLength;\n}\n\nfunction utf8PrefixForResult(value: string, maxBytes: number): string {\n  let bytes = 0;\n  let index = 0;\n  while (index < value.length) {\n    const codePoint = value.codePointAt(index);\n    if (codePoint === undefined) break;\n    const character = String.fromCodePoint(codePoint);\n    const next = utf8Bytes(character);\n    if (bytes + next > maxBytes) break;\n    bytes += next;\n    index += character.length;\n  }\n  return value.slice(0, index);\n}\n\nfunction utf8SuffixForResult(value: string, maxBytes: number): string {\n  let bytes = 0;\n  let index = value.length;\n  while (index > 0) {\n    const width =\n      index > 1 && value.charCodeAt(index - 1) >= 0xdc00 && value.charCodeAt(index - 1) <= 0xdfff\n        ? 2\n        : 1;\n    const character = value.slice(index - width, index);\n    const next = utf8Bytes(character);\n    if (bytes + next > maxBytes) break;\n    bytes += next;\n    index -= width;\n  }\n  return value.slice(index);\n}\n\n// --- Durable host export ------------------------------------------------------\n\n/** Wire revision for the durable host event/usage export stream. */\nexport const OPENGENI_HOST_EXPORT_SCHEMA_REVISION = \"2026-07-host-export-v1\" as const;\n\n/**\n * Decimal string rather than a JavaScript number: export cursors are PostgreSQL\n * bigint values and must remain exact beyond Number.MAX_SAFE_INTEGER.\n */\nexport const HostExportCursor = z.string().regex(/^(0|[1-9][0-9]*)$/);\nexport type HostExportCursor = z.infer<typeof HostExportCursor>;\n\nexport const HostExportConsumerId = z\n  .string()\n  .min(1)\n  .max(128)\n  .regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/);\nexport type HostExportConsumerId = z.infer<typeof HostExportConsumerId>;\n\nexport const HostExportInitiator = TurnInitiator.extend({\n  subjectId: z.string().min(1).max(1024),\n  label: z.string().min(1).max(256).optional(),\n});\nexport type HostExportInitiator = z.infer<typeof HostExportInitiator>;\n\nexport const HostExportInitiatorContext = TurnInitiatorContext.refine(\n  (value) => {\n    try {\n      return new TextEncoder().encode(JSON.stringify(value)).byteLength <= 4096;\n    } catch {\n      return false;\n    }\n  },\n  { message: \"Host export initiator context exceeds 4096 UTF-8 bytes\" },\n);\nexport type HostExportInitiatorContext = z.infer<typeof HostExportInitiatorContext>;\n\nconst HostExportAttribution = {\n  initiator: HostExportInitiator.nullable(),\n  initiatorContext: HostExportInitiatorContext,\n  origin: SessionTurnSource.nullable(),\n} as const;\n\n/**\n * Host streams are deliberately forward-tolerant across rolling upgrades.\n * OpenGeni's application contract enumerates the event types known to this\n * build, while the durable export may be read by an older host consumer after\n * a newer writer has committed a bounded type. The database remains the\n * authority for the byte bounds on these persisted strings.\n */\nexport const HostSessionEvent = SessionEvent.extend({\n  type: z.string().min(1).max(256),\n  clientEventId: z.string().max(1024).nullable().optional(),\n  turnAssociation: z.string().min(1).max(64).nullable().optional(),\n  duplicateReason: z.string().max(4096).nullable().optional(),\n});\nexport type HostSessionEvent = z.infer<typeof HostSessionEvent>;\n\n/** Export-bounded usage fact; custom bounded metric names remain supported. */\nexport const HostUsageEvent = UsageEvent.extend({\n  subjectId: z.string().max(1024).nullable(),\n  eventType: z.string().min(1).max(256),\n  unit: z.string().min(1).max(128),\n  sourceResourceType: z.string().max(256).nullable(),\n  sourceResourceId: z.string().max(2048).nullable(),\n  idempotencyKey: z.string().min(1).max(2048),\n  billingProviderEventId: z.string().max(2048).nullable(),\n});\nexport type HostUsageEvent = z.infer<typeof HostUsageEvent>;\n\n/**\n * One immutable, bounded session-event snapshot from the transactional host\n * outbox. Cross-session cursor order is stable but deliberately non-causal;\n * within a session, `event.sequence` remains authoritative and monotonic.\n */\nexport const HostEventExport = z.object({\n  schemaRevision: z.literal(OPENGENI_HOST_EXPORT_SCHEMA_REVISION),\n  cursor: HostExportCursor,\n  idempotencyKey: z.string().min(1).max(2048),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  /**\n   * Immutable root of event.sessionId's session lineage at capture time. Null\n   * only for an unresolved pre-lineage/legacy export row.\n   */\n  rootSessionId: z.string().uuid().nullable(),\n  ...HostExportAttribution,\n  event: HostSessionEvent,\n});\nexport type HostEventExport = z.infer<typeof HostEventExport>;\n\n/** One exact, idempotency-keyed usage fact from the same ordered outbox. */\nexport const HostUsageExport = z.object({\n  schemaRevision: z.literal(OPENGENI_HOST_EXPORT_SCHEMA_REVISION),\n  cursor: HostExportCursor,\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid().nullable(),\n  /** Null when sessionId is null or an unresolved pre-lineage legacy row. */\n  rootSessionId: z.string().uuid().nullable(),\n  turnId: z.string().uuid().nullable(),\n  turnAttemptId: z.string().uuid().nullable(),\n  ...HostExportAttribution,\n  usage: HostUsageEvent,\n});\nexport type HostUsageExport = z.infer<typeof HostUsageExport>;\n\nexport const HostEventExportBatch = z.object({\n  schemaRevision: z.literal(OPENGENI_HOST_EXPORT_SCHEMA_REVISION),\n  consumerId: HostExportConsumerId,\n  leaseToken: z.string().uuid(),\n  checkpoint: HostExportCursor,\n  throughCursor: HostExportCursor,\n  events: z.array(HostEventExport).min(1).max(256),\n});\nexport type HostEventExportBatch = z.infer<typeof HostEventExportBatch>;\n\nexport const HostUsageExportBatch = z.object({\n  schemaRevision: z.literal(OPENGENI_HOST_EXPORT_SCHEMA_REVISION),\n  consumerId: HostExportConsumerId,\n  leaseToken: z.string().uuid(),\n  checkpoint: HostExportCursor,\n  throughCursor: HostExportCursor,\n  events: z.array(HostUsageExport).min(1).max(256),\n});\nexport type HostUsageExportBatch = z.infer<typeof HostUsageExportBatch>;\n\n/**\n * Optional embedded-host sinks. Delivery is at least once: the same batch may\n * be repeated after a process dies between sink success and checkpoint commit,\n * so sinks must deduplicate by event/usage idempotency key.\n */\nexport type HostEventSink = {\n  consumerId: HostExportConsumerId;\n  deliverEvents: (batch: HostEventExportBatch) => Promise<void>;\n};\n\nexport type HostUsageSink = {\n  consumerId: HostExportConsumerId;\n  deliverUsage: (batch: HostUsageExportBatch) => Promise<void>;\n};\n\nexport const SESSION_EVENT_TYPE_MAX_BYTES = 256;\nexport const SESSION_EVENT_CLIENT_EVENT_ID_MAX_BYTES = SESSION_OPERATION_KEY_MAX_CHARS * 4;\nexport const SESSION_EVENT_TURN_ASSOCIATION_MAX_BYTES = 64;\nexport const SESSION_EVENT_DUPLICATE_REASON_MAX_BYTES = 4 * 1024;\nexport const SESSION_EVENT_ENVELOPE_MAX_BYTES = 80 * 1024;\n\nexport type BoundSessionEventOptions = {\n  surface?: SessionEventBoundarySurface;\n  maxBytes?: number;\n};\n\n/**\n * Canonical lossy projection for a complete session event. Payload bounds alone\n * are insufficient: a malformed retained row can also carry an oversized type,\n * client id, or duplicate diagnostic. Keep cursor/UUID identity intact, bound\n * every free-form envelope string, and assert the exact final JSON envelope.\n */\nexport function boundSessionEvent(\n  event: SessionEvent,\n  options: BoundSessionEventOptions = {},\n): SessionEvent {\n  const surface = options.surface ?? \"durable_audit\";\n  const maxBytes = Math.max(8 * 1024, options.maxBytes ?? SESSION_EVENT_ENVELOPE_MAX_BYTES);\n  // Never stringify the untrusted complete event. Measurement has one global\n  // work budget and never invokes accessors/custom toJSON; serialization is\n  // permitted only after the compact projection below has been constructed.\n  const originalBytes = measureSessionEventJson(event).bytes;\n  const source = sessionEventOwnDataFields(event);\n  const id = canonicalSessionEventUuid(source.id, SESSION_EVENT_ZERO_UUID);\n  const workspaceId = canonicalSessionEventUuid(source.workspaceId, SESSION_EVENT_ZERO_UUID);\n  const sessionId = canonicalSessionEventUuid(source.sessionId, SESSION_EVENT_ZERO_UUID);\n  const sequence =\n    source.sequence.readable &&\n    typeof source.sequence.value === \"number\" &&\n    Number.isSafeInteger(source.sequence.value) &&\n    source.sequence.value > 0\n      ? source.sequence.value\n      : 1;\n  const occurredAt =\n    source.occurredAt.readable &&\n    typeof source.occurredAt.value === \"string\" &&\n    sessionEventUtf8Bytes(source.occurredAt.value) <= 256\n      ? source.occurredAt.value\n      : \"1970-01-01T00:00:00.000Z\";\n  const rawType = source.type.readable ? source.type.value : undefined;\n  const typeIsSafe =\n    typeof rawType === \"string\" &&\n    sessionEventUtf8Bytes(rawType) <= SESSION_EVENT_TYPE_MAX_BYTES &&\n    !rawType.includes(\"\\n\") &&\n    !rawType.includes(\"\\r\");\n  const rawClientEventId = source.clientEventId.readable ? source.clientEventId.value : undefined;\n  const clientEventId = boundOptionalSessionEventText(\n    typeof rawClientEventId === \"string\" || rawClientEventId === null\n      ? rawClientEventId\n      : undefined,\n    SESSION_EVENT_CLIENT_EVENT_ID_MAX_BYTES,\n  );\n  const rawTurnAssociation = source.turnAssociation.readable\n    ? source.turnAssociation.value\n    : undefined;\n  const turnAssociation =\n    rawTurnAssociation === null ||\n    rawTurnAssociation === undefined ||\n    rawTurnAssociation === \"current\" ||\n    rawTurnAssociation === \"late_rejected\" ||\n    rawTurnAssociation === \"duplicate\"\n      ? rawTurnAssociation\n      : null;\n  const rawDuplicateReason = source.duplicateReason.readable\n    ? source.duplicateReason.value\n    : undefined;\n  const duplicateReason = boundOptionalSessionEventText(\n    typeof rawDuplicateReason === \"string\" || rawDuplicateReason === null\n      ? rawDuplicateReason\n      : undefined,\n    SESSION_EVENT_DUPLICATE_REASON_MAX_BYTES,\n  );\n  const turnId = canonicalOptionalSessionEventUuid(source.turnId);\n  const turnGeneration = canonicalSessionEventGeneration(source.turnGeneration);\n  const turnAttemptId = canonicalOptionalSessionEventUuid(source.turnAttemptId);\n  const duplicateOfEventId = canonicalOptionalSessionEventUuid(source.duplicateOfEventId);\n  const envelopeFields = [\n    sessionEventCustomSerializerProjection(event),\n    sessionEventAdditionalTopLevelFieldProjection(event),\n    !typeIsSafe\n      ? sessionEventEnvelopeFieldProjection(\n          \"type\",\n          rawType,\n          \"session.event.envelope_omitted\",\n          source.type.readable,\n        )\n      : null,\n    !source.clientEventId.readable || rawClientEventId !== clientEventId\n      ? sessionEventEnvelopeFieldProjection(\n          \"clientEventId\",\n          rawClientEventId,\n          clientEventId,\n          source.clientEventId.readable,\n        )\n      : null,\n    !source.turnAssociation.readable || rawTurnAssociation !== turnAssociation\n      ? sessionEventEnvelopeFieldProjection(\n          \"turnAssociation\",\n          rawTurnAssociation,\n          turnAssociation,\n          source.turnAssociation.readable,\n        )\n      : null,\n    !source.duplicateReason.readable || rawDuplicateReason !== duplicateReason\n      ? sessionEventEnvelopeFieldProjection(\n          \"duplicateReason\",\n          rawDuplicateReason,\n          duplicateReason,\n          source.duplicateReason.readable,\n        )\n      : null,\n    ...sessionEventCanonicalFieldProjections(source, {\n      id,\n      workspaceId,\n      sessionId,\n      sequence,\n      occurredAt,\n    }),\n    ...sessionEventOptionalFieldProjections(source, {\n      turnId,\n      turnGeneration,\n      turnAttemptId,\n      duplicateOfEventId,\n    }),\n    !source.payload.readable\n      ? sessionEventEnvelopeFieldProjection(\"payload\", undefined, null, false)\n      : null,\n  ].filter((field) => field !== null);\n  const rawPayload = source.payload.readable\n    ? source.payload.value\n    : \"[event payload accessor omitted at bounded projection boundary]\";\n  const payload =\n    envelopeFields.length === 0\n      ? boundSessionEventPayload(rawPayload, { surface })\n      : boundSessionEventPayload(\n          {\n            preview: \"[legacy event envelope normalized at bounded projection boundary]\",\n            originalEventBytes: originalBytes,\n            originalType: typeof rawType === \"string\" ? boundSessionEventText(rawType, 256) : null,\n            envelopeProjection: {\n              truncated: true,\n              surface,\n              fields: envelopeFields,\n            },\n            fullEvidence: { available: false, reason: \"not_retained\" },\n          },\n          { surface, maxBytes: 8 * 1024 },\n        );\n  const bounded: SessionEvent = {\n    id,\n    workspaceId,\n    sessionId,\n    sequence,\n    type: typeIsSafe ? (rawType as SessionEvent[\"type\"]) : \"session.event.envelope_omitted\",\n    payload,\n    occurredAt,\n    ...(sessionEventShouldEmitOptionalField(source.clientEventId) ? { clientEventId } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.turnId) ? { turnId } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.turnGeneration) ? { turnGeneration } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.turnAttemptId) ? { turnAttemptId } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.turnAssociation) ? { turnAssociation } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.duplicateOfEventId)\n      ? { duplicateOfEventId }\n      : {}),\n    ...(sessionEventShouldEmitOptionalField(source.duplicateReason) ? { duplicateReason } : {}),\n  };\n  if (sessionEventJsonBytes(bounded) <= maxBytes) return bounded;\n\n  const fallback: SessionEvent = {\n    id,\n    workspaceId,\n    sessionId,\n    sequence,\n    type: \"session.event.envelope_omitted\",\n    payload: boundSessionEventPayload(\n      {\n        preview: \"[legacy event envelope omitted at bounded projection boundary]\",\n        originalEventBytes: originalBytes,\n        originalType: typeof rawType === \"string\" ? boundSessionEventText(rawType, 256) : null,\n        fullEvidence: { available: false, reason: \"not_retained\" },\n      },\n      { surface, maxBytes: 4 * 1024 },\n    ),\n    occurredAt,\n    ...(sessionEventShouldEmitOptionalField(source.clientEventId) ? { clientEventId } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.turnId) ? { turnId } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.turnGeneration) ? { turnGeneration } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.turnAttemptId) ? { turnAttemptId } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.turnAssociation) ? { turnAssociation } : {}),\n    ...(sessionEventShouldEmitOptionalField(source.duplicateOfEventId)\n      ? { duplicateOfEventId }\n      : {}),\n    ...(sessionEventShouldEmitOptionalField(source.duplicateReason) ? { duplicateReason } : {}),\n  };\n  const deliveredBytes = sessionEventJsonBytes(fallback);\n  if (deliveredBytes > maxBytes) {\n    throw new RangeError(\n      `Bounded session event exceeds its final envelope (${deliveredBytes} > ${maxBytes} bytes)`,\n    );\n  }\n  return fallback;\n}\n\nfunction sessionEventEnvelopeFieldProjection(\n  field: string,\n  original: unknown,\n  delivered: unknown,\n  originalReadable = true,\n): { field: string; originalBytes: number | null; deliveredBytes: number } {\n  return {\n    field,\n    originalBytes: originalReadable\n      ? typeof original === \"string\"\n        ? sessionEventUtf8Bytes(original)\n        : typeof original === \"number\" || typeof original === \"boolean\"\n          ? sessionEventJsonBytes(original)\n          : original === null || original === undefined\n            ? 0\n            : null\n      : null,\n    deliveredBytes:\n      typeof delivered === \"string\"\n        ? sessionEventUtf8Bytes(delivered)\n        : typeof delivered === \"number\" || typeof delivered === \"boolean\"\n          ? sessionEventJsonBytes(delivered)\n          : 0,\n  };\n}\n\nfunction sessionEventCustomSerializerProjection(\n  event: SessionEvent,\n): { field: string; originalBytes: null; deliveredBytes: 0 } | null {\n  const projection = {\n    field: \"toJSON\",\n    originalBytes: null,\n    deliveredBytes: 0,\n  } as const;\n  let candidate: object | null = event;\n  try {\n    for (let depth = 0; depth <= SESSION_EVENT_PROTOTYPE_MAX_DEPTH; depth += 1) {\n      if (candidate === null) return null;\n      const descriptor = Object.getOwnPropertyDescriptor(candidate, \"toJSON\");\n      if (descriptor) {\n        // JSON.stringify performs an ordinary lookup, so an accessor is both\n        // executable behavior and an unknown possible serializer. A data\n        // property shadows the rest of the chain and is relevant only when it\n        // is callable.\n        return !(\"value\" in descriptor) || typeof descriptor.value === \"function\"\n          ? projection\n          : null;\n      }\n      candidate = Object.getPrototypeOf(candidate);\n    }\n    // A hostile or malformed prototype chain that exceeds the fixed lookup\n    // budget cannot prove the absence of inherited serialization behavior.\n    return projection;\n  } catch {\n    return projection;\n  }\n}\n\nconst SESSION_EVENT_PROTOTYPE_MAX_DEPTH = 32;\nconst SESSION_EVENT_ZERO_UUID = \"00000000-0000-4000-8000-000000000000\";\nconst SESSION_EVENT_UUID_PATTERN =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\nconst SESSION_EVENT_OWN_DATA_FIELDS = [\n  \"id\",\n  \"workspaceId\",\n  \"sessionId\",\n  \"sequence\",\n  \"type\",\n  \"payload\",\n  \"occurredAt\",\n  \"clientEventId\",\n  \"turnId\",\n  \"turnGeneration\",\n  \"turnAttemptId\",\n  \"turnAssociation\",\n  \"duplicateOfEventId\",\n  \"duplicateReason\",\n] as const satisfies readonly (keyof SessionEvent)[];\nconst SESSION_EVENT_KNOWN_ENUMERABLE_FIELDS = new Set<string>([\n  ...SESSION_EVENT_OWN_DATA_FIELDS,\n  \"toJSON\",\n]);\n\n/**\n * Detect future/legacy own enumerable envelope fields without reading their\n * values. There can be at most the fixed known-key cardinality before an\n * additional key must be observed, so the source-level iterator is bounded.\n * A proxy/enumeration failure is conservatively surfaced as unknown loss.\n */\nfunction sessionEventAdditionalTopLevelFieldProjection(\n  event: SessionEvent,\n): { field: string; originalBytes: null; deliveredBytes: 0 } | null {\n  const projection = {\n    field: \"additionalTopLevelFields\",\n    originalBytes: null,\n    deliveredBytes: 0,\n  } as const;\n  let inspected = 0;\n  try {\n    for (const key in event as SessionEvent & Record<string, unknown>) {\n      inspected += 1;\n      if (inspected > SESSION_EVENT_KNOWN_ENUMERABLE_FIELDS.size + 1) return projection;\n      const descriptor = Object.getOwnPropertyDescriptor(event, key);\n      if (descriptor?.enumerable && !SESSION_EVENT_KNOWN_ENUMERABLE_FIELDS.has(key)) {\n        return projection;\n      }\n    }\n    return null;\n  } catch {\n    return projection;\n  }\n}\n\ntype SessionEventOwnField = { readable: true; value: unknown } | { readable: false };\ntype SessionEventOwnDataFields = Record<keyof SessionEvent, SessionEventOwnField>;\n\nfunction sessionEventOwnDataFields(event: SessionEvent): SessionEventOwnDataFields {\n  return Object.fromEntries(\n    SESSION_EVENT_OWN_DATA_FIELDS.map((key) => {\n      try {\n        const descriptor = Object.getOwnPropertyDescriptor(event, key);\n        if (!descriptor) return [key, { readable: true, value: undefined }];\n        return [\n          key,\n          \"value\" in descriptor ? { readable: true, value: descriptor.value } : { readable: false },\n        ];\n      } catch {\n        return [key, { readable: false }];\n      }\n    }),\n  ) as SessionEventOwnDataFields;\n}\n\nfunction canonicalSessionEventUuid(field: SessionEventOwnField, fallback: string): string {\n  return field.readable &&\n    typeof field.value === \"string\" &&\n    SESSION_EVENT_UUID_PATTERN.test(field.value)\n    ? field.value\n    : fallback;\n}\n\nfunction canonicalOptionalSessionEventUuid(field: SessionEventOwnField): string | null {\n  return field.readable &&\n    typeof field.value === \"string\" &&\n    SESSION_EVENT_UUID_PATTERN.test(field.value)\n    ? field.value\n    : null;\n}\n\nfunction canonicalSessionEventGeneration(field: SessionEventOwnField): number | null {\n  return field.readable &&\n    typeof field.value === \"number\" &&\n    Number.isSafeInteger(field.value) &&\n    field.value >= 0\n    ? field.value\n    : null;\n}\n\nfunction sessionEventShouldEmitOptionalField(field: SessionEventOwnField): boolean {\n  return !field.readable || field.value !== undefined;\n}\n\nfunction sessionEventCanonicalFieldProjections(\n  source: SessionEventOwnDataFields,\n  delivered: {\n    id: string;\n    workspaceId: string;\n    sessionId: string;\n    sequence: number;\n    occurredAt: string;\n  },\n): Array<{\n  field: string;\n  originalBytes: number | null;\n  deliveredBytes: number;\n}> {\n  return ([\"id\", \"workspaceId\", \"sessionId\", \"sequence\", \"occurredAt\"] as const).flatMap(\n    (field) => {\n      const original = source[field].readable ? source[field].value : undefined;\n      return source[field].readable && original === delivered[field]\n        ? []\n        : [\n            sessionEventEnvelopeFieldProjection(\n              field,\n              original,\n              delivered[field],\n              source[field].readable,\n            ),\n          ];\n    },\n  );\n}\n\nfunction sessionEventOptionalFieldProjections(\n  source: SessionEventOwnDataFields,\n  delivered: {\n    turnId: string | null;\n    turnGeneration: number | null;\n    turnAttemptId: string | null;\n    duplicateOfEventId: string | null;\n  },\n): Array<{\n  field: string;\n  originalBytes: number | null;\n  deliveredBytes: number;\n}> {\n  return ([\"turnId\", \"turnGeneration\", \"turnAttemptId\", \"duplicateOfEventId\"] as const).flatMap(\n    (field) => {\n      const original = source[field].readable ? source[field].value : undefined;\n      const canonicalOriginal = original ?? null;\n      return source[field].readable && canonicalOriginal === delivered[field]\n        ? []\n        : [\n            sessionEventEnvelopeFieldProjection(\n              field,\n              original,\n              delivered[field],\n              source[field].readable,\n            ),\n          ];\n    },\n  );\n}\n\nfunction boundOptionalSessionEventText<T extends string | null | undefined>(\n  value: T,\n  maxBytes: number,\n): T {\n  return (typeof value === \"string\" ? boundSessionEventText(value, maxBytes) : value) as T;\n}\n\nfunction boundSessionEventText(value: string, maxBytes: number): string {\n  const encoder = new TextEncoder();\n  const decoder = new TextDecoder();\n  const bytes = encoder.encode(value);\n  if (bytes.byteLength <= maxBytes) return value;\n  const marker = \"…[truncated]\";\n  const markerBytes = encoder.encode(marker).byteLength;\n  const prefixBudget = Math.max(0, maxBytes - markerBytes);\n  let prefixEnd = Math.min(prefixBudget, bytes.byteLength);\n  while (prefixEnd > 0 && prefixEnd < bytes.byteLength && (bytes[prefixEnd]! & 0xc0) === 0x80) {\n    prefixEnd -= 1;\n  }\n  return `${decoder.decode(bytes.subarray(0, prefixEnd))}${marker}`;\n}\n\nfunction sessionEventUtf8Bytes(value: string): number {\n  return new TextEncoder().encode(value).byteLength;\n}\n\nexport const SessionQueueMutationResponse = z.object({\n  receipt: SessionCommandReceipt,\n  snapshot: SessionQueueSnapshot,\n  draft: ComposerDraft.optional(),\n});\nexport type SessionQueueMutationResponse = z.infer<typeof SessionQueueMutationResponse>;\n\nexport const SessionControlResponse = z.object({\n  receipt: SessionCommandReceipt,\n  effectiveControl: EffectiveSessionControl,\n  interruptionCount: z.number().int().nonnegative(),\n  wakeCount: z.number().int().nonnegative(),\n});\nexport type SessionControlResponse = z.infer<typeof SessionControlResponse>;\n\nexport const CreateSessionRequest = withVariableSetIdAlias({\n  /**\n   * Optional UUID preallocated by an embedding host. This lets the host durably\n   * link its own projection before OpenGeni admits the initial turn. Replays\n   * must pair it with the same idempotency key; OpenGeni never derives host\n   * identity or authorization from the UUID.\n   */\n  requestedSessionId: z.string().uuid().optional(),\n  initialMessage: z.string().min(1),\n  // System-level host context for the initial turn only. Unlike `instructions`,\n  // this does not persist into later turns and is never emitted as a user event.\n  turnInstructions: z.string().trim().min(1).max(32768).optional(),\n  // Per-session agent persona/system instructions (org-visible metadata, NOT a\n  // secret). Rides the SAME system-level instructions channel the per-workspace\n  // agentInstructions rides, composed AFTER the workspace persona so it refines\n  // it for this one session — how a host delivers per-agent-type prompts without\n  // leaking them into the user-visible timeline (it is NEVER emitted as an\n  // event, unlike goal/initialMessage). Trimmed, non-empty. The 32768-char cap\n  // matches the codebase's largest free-form string convention (workspace\n  // variable set variable values). Absent ⇒ byte-identical to today.\n  instructions: z.string().trim().min(1).max(32768).optional(),\n  // For an agent-created child, omission inherits the trusted immediate\n  // parent's repository/file context. An explicit array, including [], is\n  // authoritative. Top-level omission remains []. Presence is resolved from\n  // the raw request because this Zod default erases absent-vs-empty.\n  resources: z.array(ResourceRef).default([]),\n  // Inline skills are fixed onto the session. Child omission inherits the\n  // trusted parent's selection; an explicit array, including [], wins.\n  skills: SessionSkills.default([]),\n  // The same child omission rule applies to selected MCP tool refs. Top-level\n  // omission still applies workspace-default capability MCP tools; explicit []\n  // suppresses those defaults (the first-party OpenGeni server remains added).\n  tools: z.array(ToolRef).default([]),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  model: z.string().min(1).optional(),\n  reasoningEffort: ReasoningEffort.optional(),\n  sandboxBackend: SandboxBackend.optional(),\n  // The enrolled machine (a sandbox id) to run this session on; seeds the\n  // active-sandbox pointer at creation so the FIRST turn routes to the chosen\n  // machine (race-free: the pointer is committed before the worker turn\n  // workflow can read it). An invalid/unowned/offline target fails the create.\n  targetSandboxId: z.string().uuid().optional(),\n  // The working directory the targeted machine runs the session under — the\n  // path/cwd base for its agent exec, terminal, and file dock. Free-form pass-\n  // through: a launch-workspace_root-relative subdir or an absolute machine path\n  // (the agent's resolve_cwd handles both). Only valid WITH targetSandboxId\n  // (workingDir alone is a 422); omitted ⇒ the machine's default workspace_root.\n  workingDir: z.string().min(1).optional(),\n  // Variable set attachment is fixed at session creation; follow-up\n  // user.message events cannot switch or add one.\n  variableSetId: z.string().uuid().optional(),\n  environmentId: z.string().uuid().optional(),\n  // The rig to bind this session to (M3). Its ACTIVE version is resolved and\n  // FROZEN onto the session at create. Omitted ⇒ the workspace's default rig\n  // (workspaces.default_rig_id) when set, else a rig-less session (today's\n  // behavior). An id that does not name a rig in the workspace is a 422.\n  rigId: z.string().uuid().optional(),\n  goal: GoalSpec.optional(),\n  clientEventId: SessionOperationKey.optional(),\n  // Workspace-scoped CREATE idempotency key: collapses concurrent/retried\n  // create calls carrying the same key to a single session (partial unique\n  // index on (workspace_id, create_idempotency_key)). Distinct from\n  // clientEventId, whose uniqueness is per-session and so cannot dedup the\n  // creation of a brand-new session. Absent means no create-dedup (each call\n  // is an independent create).\n  idempotencyKey: z.string().min(1).max(200).optional(),\n  // The exact actor-private pre-session draft revision represented by this\n  // create. The durable initializer consumes only this revision. A newer draft\n  // written by a sibling tab survives, while every failed pre-initialization\n  // create leaves the submitted draft intact.\n  expectedNewSessionDraftRevision: z.number().int().nonnegative().optional(),\n  // A child may lower its inherited limit freely; an increase requires\n  // workspace:admin and is checked again at the DB transaction boundary.\n  maxNestedAgentDepth: NestedAgentDepthValue.optional(),\n  // Permissions the session's first-party MCP token should carry. A top-level\n  // omission uses the deployment's worker default; a child omission inherits\n  // the creating session's effective grant. An explicit set is capped at\n  // creation: every requested permission must be held by the creating grant.\n  // A goal-bearing session whose explicit/effective set omits goals:manage is\n  // rejected; creation never silently expands a child beyond that set.\n  firstPartyMcpPermissions: z.array(Permission).optional(),\n  // Exact model-visible selection from the broad first-party OpenGeni MCP\n  // catalog. Omit for the minimal default; [] intentionally exposes none.\n  // This does not grant authority: every registered tool is permission-gated.\n  firstPartyMcpTools: z.array(FirstPartyMcpToolName).optional(),\n  // Third-party MCP servers attached only to this session. For an agent-created\n  // child, omission snapshots its trusted immediate parent's server definitions,\n  // policies, connection refs, and encrypted credentials. Explicit arrays,\n  // including [], are authoritative; non-empty explicit arrays require attach\n  // permission. Credential headers are write-only: create responses and events\n  // expose only SessionMcpServerMetadata.\n  mcpServers: z.array(SessionMcpServerInput).max(SESSION_MCP_SERVERS_MAX).default([]),\n  // Shared-sandbox placement (addendum 05 §D.1). Three-way union; OMITTED ⇒\n  // today's behavior (a context-dependent default resolved server-side: from\n  // inside a session → \"shared\" with the creator's box, top-level → \"new\").\n  //   - \"shared\":  join the CREATOR's box. Requires a parent session (inferred\n  //                from the worker-signed sessionId claim, never caller-supplied);\n  //                top-level \"shared\" is a 422.\n  //   - \"new\":     mint a fresh singleton box (group ≡ the new session's id).\n  //   - {groupId}: join a SPECIFIC sibling group in THIS workspace (manager\n  //                fan-out). Validated workspace-scoped (cross-workspace → 404).\n  // A shared spawn inherits the box's (backend, os) — it is literally the same\n  // box; the child cannot pick its own backend. Cross-workspace sharing is\n  // forbidden by construction (the parent/group reads are RLS-workspace-scoped).\n  // ENV-AWARE: the box's variable set is fixed at creation, so a share requires\n  // the SAME variableSetId as the creator's box. On a mismatch the inherited\n  // default silently falls back to an own box; an explicit \"shared\"/{groupId}\n  // request 422s at create (instead of the first turn dying on the SDK's\n  // manifest-env guard).\n  sandbox: z\n    .union([z.literal(\"shared\"), z.literal(\"new\"), z.object({ groupId: z.string().uuid() })])\n    .optional(),\n});\nexport type CreateSessionRequest = z.infer<typeof CreateSessionRequest>;\n\n// Generic, host-neutral structured human input. One model tool call creates one\n// request containing one or more questions; the durable response resumes that\n// exact call. This is deliberately distinct from tool approval: an answer,\n// skip, or expiry is structured tool output, never an approve/reject decision.\nexport const HumanInputQuestionKind = z.enum([\"text\", \"single_select\", \"multi_select\"]);\nexport type HumanInputQuestionKind = z.infer<typeof HumanInputQuestionKind>;\n\nexport const HumanInputOption = z.object({\n  id: z.string().min(1).max(64),\n  label: z.string().min(1).max(256),\n  description: z.string().max(2048).nullable().optional(),\n});\nexport type HumanInputOption = z.infer<typeof HumanInputOption>;\n\nexport const HumanInputQuestion = z\n  .object({\n    id: z.string().min(1).max(64),\n    kind: HumanInputQuestionKind,\n    prompt: z.string().min(1).max(4096),\n    label: z.string().min(1).max(128).nullable().optional(),\n    helpText: z.string().max(2048).nullable().optional(),\n    options: z.array(HumanInputOption).max(20).default([]),\n    required: z.boolean().default(true),\n    allowOther: z.boolean().default(false),\n    validation: z\n      .object({\n        minLength: z.number().int().nonnegative().max(8192).nullable().optional(),\n        maxLength: z.number().int().positive().max(8192).nullable().optional(),\n        minSelections: z.number().int().nonnegative().max(20).nullable().optional(),\n        maxSelections: z.number().int().positive().max(20).nullable().optional(),\n      })\n      .nullable()\n      .optional(),\n  })\n  .superRefine((question, ctx) => {\n    const optionIds = new Set(question.options.map((option) => option.id));\n    if (optionIds.size !== question.options.length) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"options\"],\n        message: \"option ids must be unique\",\n      });\n    }\n    if (question.kind === \"text\") {\n      if (question.options.length > 0) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"options\"],\n          message: \"text questions cannot have options\",\n        });\n      }\n      if (question.allowOther) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"allowOther\"],\n          message: \"text questions do not use Other\",\n        });\n      }\n    } else if (question.options.length === 0) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"options\"],\n        message: \"select questions require options\",\n      });\n    }\n    const validation = question.validation;\n    if (\n      validation?.minLength != null &&\n      validation?.maxLength != null &&\n      validation.minLength > validation.maxLength\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"validation\"],\n        message: \"minLength exceeds maxLength\",\n      });\n    }\n    if (\n      validation?.minSelections != null &&\n      validation?.maxSelections != null &&\n      validation.minSelections > validation.maxSelections\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"validation\"],\n        message: \"minSelections exceeds maxSelections\",\n      });\n    }\n  });\nexport type HumanInputQuestion = z.infer<typeof HumanInputQuestion>;\n\nexport const HumanInputRequestStatus = z.enum([\n  \"pending\",\n  \"answered\",\n  \"skipped\",\n  \"expired\",\n  \"cancelled\",\n]);\nexport type HumanInputRequestStatus = z.infer<typeof HumanInputRequestStatus>;\n\nexport const RequestHumanInputToolInput = z.object({\n  questions: z.array(HumanInputQuestion).min(1).max(20),\n  allowSkip: z.boolean().default(false),\n  expiresInSeconds: z\n    .number()\n    .int()\n    .positive()\n    .max(30 * 24 * 60 * 60)\n    .nullable()\n    .optional(),\n});\nexport type RequestHumanInputToolInput = z.infer<typeof RequestHumanInputToolInput>;\n\nexport const HumanInputAnswer = z.object({\n  questionId: z.string().min(1).max(64),\n  values: z.array(z.string().max(8192)).max(20),\n  other: z.string().max(8192).nullable().optional(),\n});\nexport type HumanInputAnswer = z.infer<typeof HumanInputAnswer>;\n\nexport const HumanInputResponse = z.discriminatedUnion(\"outcome\", [\n  z.object({\n    outcome: z.literal(\"answered\"),\n    answers: z.array(HumanInputAnswer).max(20),\n  }),\n  z.object({ outcome: z.literal(\"skipped\") }),\n  z.object({ outcome: z.literal(\"expired\") }),\n  z.object({ outcome: z.literal(\"cancelled\") }),\n]);\nexport type HumanInputResponse = z.infer<typeof HumanInputResponse>;\n\nexport const SubmitHumanInputResponseRequest = z.discriminatedUnion(\"outcome\", [\n  z.object({\n    outcome: z.literal(\"answered\"),\n    answers: z.array(HumanInputAnswer).max(20),\n  }),\n  z.object({ outcome: z.literal(\"skipped\") }),\n]);\nexport type SubmitHumanInputResponseRequest = z.infer<typeof SubmitHumanInputResponseRequest>;\n\nexport const SessionHumanInputRequest = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  turnId: z.string().uuid(),\n  turnGeneration: z.number().int().positive(),\n  creationAttemptId: z.string().uuid(),\n  toolCallId: z.string().min(1).max(1024),\n  status: HumanInputRequestStatus,\n  questions: z.array(HumanInputQuestion).min(1).max(20),\n  allowSkip: z.boolean(),\n  response: HumanInputResponse.nullable(),\n  respondedBy: z.string().max(1024).nullable(),\n  respondedAt: z.string().nullable(),\n  expiresAt: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type SessionHumanInputRequest = z.infer<typeof SessionHumanInputRequest>;\n\n/**\n * Extract the stable approval identity used by both durable admission and\n * runtime resume. Serialized SDK interruptions may place it on the wrapper or\n * its raw item; malformed entries fail closed instead of inventing an id.\n */\nexport function approvalIdentifier(value: unknown): string | null {\n  if (!value || typeof value !== \"object\") return null;\n  const approval = value as Record<string, unknown>;\n  const rawItem =\n    approval.rawItem && typeof approval.rawItem === \"object\"\n      ? (approval.rawItem as Record<string, unknown>)\n      : null;\n  const candidate = rawItem?.callId ?? rawItem?.id ?? approval.id ?? approval.name;\n  if (typeof candidate !== \"string\" && typeof candidate !== \"number\") return null;\n  return String(candidate);\n}\n\nexport const ClientSessionEvent = z.discriminatedUnion(\"type\", [\n  z.object({\n    type: z.literal(\"user.message\"),\n    clientEventId: SessionOperationKey.optional(),\n    payload: z.object({\n      text: z.string().min(1),\n      // System-level host context for this exact turn only. Persisted on the\n      // turn for retry/recovery, never copied into the visible user message.\n      turnInstructions: z.string().trim().min(1).max(32768).optional(),\n      resources: z.array(ResourceRef).default([]),\n      tools: z.array(ToolRef).default([]),\n      model: z.string().min(1).optional(),\n      reasoningEffort: ReasoningEffort.optional(),\n      controlEtag: z.string().min(1).optional(),\n      expectedDraftRevision: z.number().int().nonnegative().optional(),\n      // Header-value rotation only. URL/name/tool settings are immutable after\n      // session create; persisted events expose metadata, never header values.\n      mcpCredentialUpdates: z.array(SessionMcpCredentialUpdateInput).optional(),\n    }),\n  }),\n  z.object({\n    type: z.literal(\"user.approvalDecision\"),\n    clientEventId: SessionOperationKey.optional(),\n    payload: z.object({\n      approvalId: z.string().min(1).max(SESSION_OPERATION_KEY_MAX_CHARS),\n      decision: z.enum([\"approve\", \"reject\"]),\n      message: z.string().optional(),\n    }),\n  }),\n  z.object({\n    type: z.literal(\"user.humanInputResponse\"),\n    clientEventId: SessionOperationKey.optional(),\n    payload: z.object({\n      requestId: z.string().uuid(),\n      response: SubmitHumanInputResponseRequest,\n    }),\n  }),\n]);\nexport type ClientSessionEvent = z.infer<typeof ClientSessionEvent>;\n\nexport const SteerSessionMessageRequest = z.object({\n  text: z.string().min(1),\n  // Same per-turn system-level context as a queued user.message.\n  turnInstructions: z.string().trim().min(1).max(32768).optional(),\n  resources: z.array(ResourceRef).default([]),\n  tools: z.array(ToolRef).default([]),\n  model: z.string().min(1).optional(),\n  reasoningEffort: ReasoningEffort.optional(),\n  clientEventId: SessionOperationKey.optional(),\n  controlEtag: z.string().min(1).optional(),\n  expectedDraftRevision: z.number().int().nonnegative().optional(),\n  mcpCredentialUpdates: z.array(SessionMcpCredentialUpdateInput).optional(),\n});\nexport type SteerSessionMessageRequest = z.infer<typeof SteerSessionMessageRequest>;\n\nexport const SteerSessionMessageResponse = z.object({\n  accepted: SessionEvent,\n  turn: SessionTurn,\n});\nexport type SteerSessionMessageResponse = z.infer<typeof SteerSessionMessageResponse>;\n\nexport const SessionBusMessage = z.object({\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  events: z.array(SessionEvent).min(1),\n});\nexport type SessionBusMessage = z.infer<typeof SessionBusMessage>;\n\nexport const GitHubAppManifestCreate = z.object({\n  appName: z.string().optional(),\n  organization: z.string().optional(),\n  public: z.boolean().default(false),\n  includeCiPermissions: z.boolean().default(true),\n});\nexport type GitHubAppManifestCreate = z.infer<typeof GitHubAppManifestCreate>;\n\nexport const GitHubRepository = z.object({\n  id: z.number().int(),\n  installationId: z.number().int(),\n  fullName: z.string(),\n  name: z.string(),\n  private: z.boolean(),\n  htmlUrl: z.string(),\n  cloneUrl: z.string(),\n  defaultBranch: z.string(),\n  accountLogin: z.string(),\n  accountType: z.string().nullable(),\n});\nexport type GitHubRepository = z.infer<typeof GitHubRepository>;\n\nexport const GitHubRepositoryScope = z.enum([\"all\", \"selected\"]);\nexport type GitHubRepositoryScope = z.infer<typeof GitHubRepositoryScope>;\n\nexport const GitHubBindingStatus = z.enum([\"disabled\", \"unbound\", \"bound\"]);\nexport type GitHubBindingStatus = z.infer<typeof GitHubBindingStatus>;\n\nexport const GitHubInstallationLifecycle = z.enum([\"active\", \"suspended\", \"deleted\", \"unverified\"]);\nexport type GitHubInstallationLifecycle = z.infer<typeof GitHubInstallationLifecycle>;\n\nexport const GitHubInstallationBinding = z.object({\n  installationId: z.number().int().positive(),\n  githubAccountId: z.number().int().positive().nullable(),\n  accountLogin: z.string().nullable(),\n  accountType: z.string().nullable(),\n  lifecycle: GitHubInstallationLifecycle,\n  repositoryScope: GitHubRepositoryScope,\n  repositoryCount: z.number().int().nonnegative(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type GitHubInstallationBinding = z.infer<typeof GitHubInstallationBinding>;\n\nexport const GitHubAppInfo = z.object({\n  configured: z.boolean(),\n  status: GitHubBindingStatus,\n  appId: z.string().nullable(),\n  clientId: z.string().nullable(),\n  appSlug: z.string().nullable(),\n  installUrl: z.string().nullable(),\n  linkUrl: z.string().nullable(),\n  installations: z.array(GitHubInstallationBinding),\n  missing: z.array(z.string()),\n});\nexport type GitHubAppInfo = z.infer<typeof GitHubAppInfo>;\n\nexport const GitHubRepositoriesResponse = z.object({\n  repositories: z.array(GitHubRepository),\n});\nexport type GitHubRepositoriesResponse = z.infer<typeof GitHubRepositoriesResponse>;\n\nexport const ClientAuthConfig = z.discriminatedUnion(\"mode\", [\n  z.object({\n    mode: z.literal(\"none\"),\n  }),\n  z.object({\n    mode: z.literal(\"deploymentKey\"),\n    headerName: z.literal(\"x-opengeni-access-key\"),\n  }),\n  z.object({\n    mode: z.literal(\"configuredToken\"),\n    headerName: z.literal(\"authorization\"),\n    scheme: z.literal(\"bearer\"),\n  }),\n  z.object({\n    mode: z.literal(\"managedSession\"),\n    session: z.literal(\"cookie\"),\n  }),\n]);\nexport type ClientAuthConfig = z.infer<typeof ClientAuthConfig>;\n\n// The negotiated capability handshake document (sandbox contract C.3). ONE shape;\n// collapses the parallel per-module definitions. A capability cell is always\n// present with `available`/`transport` + a `reason` when unavailable — never\n// absent.\nexport const CapabilityUnavailableReason = z.enum([\n  \"backend_unsupported\",\n  \"os_unsupported\",\n  \"not_provisioned\",\n  \"disabled_by_policy\",\n  \"lease_cold\",\n  \"tier_headless\",\n  // Selfhosted (bring-your-own-compute) negotiation states (M1 additive; the\n  // selfhosted negotiation in select.ts wires them in M3):\n  \"agent_offline\", // the enrolled agent process is not running / unreachable\n  \"agent_reconnecting\", // a transient blip — the agent is reconnecting (warmable)\n  \"consent_required\", // whole-machine / screen-control consent not yet acknowledged\n  \"display_unavailable\", // headless machine with no display stack (no DesktopStream)\n]);\nexport type CapabilityUnavailableReason = z.infer<typeof CapabilityUnavailableReason>;\n\nexport const SessionCapabilities = z.object({\n  sessionId: z.string().uuid(),\n  backend: SandboxBackend,\n  os: SandboxOs,\n  liveness: z.enum([\"cold\", \"warming\", \"warm\", \"draining\"]),\n  // Echoed on viewer heartbeats (the split-brain fence).\n  leaseEpoch: z.number().int().nonnegative(),\n  workspaceGeneration: z.number().int().nonnegative().nullable().default(null),\n  archiveGeneration: z.number().int().nonnegative().nullable().default(null),\n  archiveComplete: z.boolean().default(false),\n  viewerHeartbeatIntervalMs: z.number().int().positive().default(30_000),\n  FileSystem: z.object({\n    available: z.boolean(),\n    readOnly: z.boolean(),\n    root: z.string(),\n    pathSep: z.enum([\"/\", \"\\\\\"]),\n    treeMode: z.enum([\"lazy\", \"snapshot\"]),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  Terminal: z.object({\n    transport: z.enum([\"sse-events\", \"pty-ws\"]).nullable(),\n    ptyCapable: z.boolean(),\n    shell: z.string(),\n    // The direct-to-provider ttyd PTY-over-websocket URL (pty-ws) resolved on the\n    // SAME tunnel as the desktop; null on a cold lease / read-only sse-events\n    // firehose / degraded terminal. The scoped stream token is recorded against\n    // the holder (NEVER a URL query param), symmetric with DesktopStream.\n    url: z.string().url().nullable(),\n    token: z.string().nullable(),\n    // ISO absolute expiry of the minted stream token (symmetric with\n    // DesktopStream.expiresAt). Null when no live URL/token is minted.\n    expiresAt: z.string().nullable(),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  Git: z.object({\n    available: z.boolean(),\n    repos: z.array(z.string()),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  DesktopStream: z.object({\n    // \"relay-frames\" is the selfhosted framebuffer stream: PNG-per-frame protobuf\n    // datagrams spliced over the relay (NOT RFB). The viewer renders it with the\n    // \"frames\" client (a canvas painter), distinct from Modal's \"vnc-ws\"/\"novnc\".\n    transport: z.enum([\"vnc-ws\", \"rdp-ws\", \"webrtc\", \"relay-frames\"]).nullable(),\n    client: z.enum([\"novnc\", \"web-rdp\", \"frames\"]).nullable(),\n    mode: z.enum([\"read-only\", \"interactive\"]).default(\"read-only\"),\n    url: z.string().url().nullable(),\n    token: z.string().nullable(),\n    expiresAt: z.string().nullable(),\n    resolution: z\n      .tuple([z.number().int().positive(), z.number().int().positive()])\n      .default([1024, 768]),\n    // REQUIRED, no default (the server must assert un-redacted pixels).\n    unredacted: z.boolean(),\n    requiresAcknowledgment: z.boolean(),\n    acknowledged: z.boolean(),\n    // SHARED-EXPOSURE disclosure (addendum E.1). `shared` is true when the box's\n    // group has >1 session: watching this desktop ALSO shows the sibling\n    // sessions' agents on the one :0 framebuffer (the pixels cannot be redacted).\n    // `sharedSessionIds` lists the OTHER sessions whose agents may appear — IDS\n    // ONLY, never their goal/metadata/conversation (a viewer of A must not be\n    // able to use \"I can see B's id\" to subscribe to B's events; stress g). When\n    // shared, the consent gate requires the shared-exposure acknowledgment (409\n    // shared_acknowledgment_required) before the desktop path is handed out.\n    shared: z.boolean().default(false),\n    sharedSessionIds: z.array(z.string().uuid()).default([]),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  Recording: z.object({\n    available: z.boolean(),\n    modes: z.array(z.enum([\"manual\", \"on-turn\", \"on-verify\"])),\n    codecs: z.array(z.enum([\"h264-mp4\", \"vp9-webm\"])),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  // The AGENT drives the SAME :0 (xdotool/XTEST + scrot) the human watches; the\n  // human viewer plane is read-only by default (§6). `available` == desktop-\n  // capable backend && computerUseEnabled; `readOnly` reports whether the agent\n  // driver itself is gated to no-op input (v1 default false — the agent clicks).\n  ComputerUse: z.object({\n    available: z.boolean(),\n    readOnly: z.boolean(),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  negotiatedAt: z.string(),\n});\nexport type SessionCapabilities = z.infer<typeof SessionCapabilities>;\n\n// ── API-direct viewer attach (P1.4) ─────────────────────────────────────────\n// A viewer holds the GROUP lease (keeping the box warm while watched). These\n// shape the in-process attach/heartbeat/detach handlers. The scoped stream\n// token + the un-redacted-pixel acknowledgment are P3/P4 — here it is the\n// viewer-HOLDER lifecycle only.\n\n// POST .../viewers — acquire a viewer holder. An omitted viewerId mints a fresh\n// one (returned in the response, to carry through heartbeats + detach).\n//\n// `desktop` declares intent to attach the UN-REDACTED pixel plane (noVNC). ONLY\n// that plane carries the consent gate (the un-redacted/shared acknowledgment). A\n// terminal-only warm attach (`desktop:false`, the default) needs NO consent — a\n// shell is interactive by nature and the gate is the scoped tunnel URL + stream\n// token — so it warms the box and mints the pty-ws terminal cell WITHOUT a 409.\n// Omitted defaults to `false` so a terminal-only client never trips the gate.\nexport const AttachViewerRequest = z.object({\n  viewerId: z.string().uuid().optional(),\n  desktop: z.boolean().optional(),\n});\nexport type AttachViewerRequest = z.infer<typeof AttachViewerRequest>;\n\nexport const ViewerHolder = z.object({\n  viewerId: z.string().uuid(),\n  sandboxGroupId: z.string().uuid(),\n  liveness: z.enum([\"cold\", \"warming\", \"warm\", \"draining\"]),\n  // The epoch the viewer is fenced on; echoed back on heartbeats.\n  leaseEpoch: z.number().int().nonnegative(),\n  workspaceGeneration: z.number().int().nonnegative().nullable(),\n  archiveGeneration: z.number().int().nonnegative().nullable(),\n  archiveComplete: z.boolean(),\n  viewerHeartbeatIntervalMs: z.number().int().positive(),\n  // The desktop pixel tunnel URL the viewer connects to directly; null until\n  // a viewer grant is minted (gated until then).\n  dataPlaneUrl: z.string().nullable(),\n});\nexport type ViewerHolder = z.infer<typeof ViewerHolder>;\n\n// POST .../stream-capabilities/acknowledge — record the calling principal's\n// acknowledgment of the un-redacted pixel plane. Reuses the acknowledgment\n// machinery — no new endpoint\n// shape beyond this body, no new permission beyond stream:acknowledge.\n//\n// `acknowledgeShared` MUST be true when the box is shared (the group has >1\n// session): the un-redacted desktop path returns 409 shared_acknowledgment_required\n// until a shared box is acknowledged WITH the shared-exposure consent. For a\n// solo box `acknowledgeShared` is irrelevant (the un-redacted ack alone gates).\nexport const AcknowledgeStreamRequest = z.object({\n  // The principal accepts that the desktop pixel plane is un-redacted (can show\n  // cloud creds the agent cat's into a terminal). Always true to record consent;\n  // present for self-documentation + a future explicit withdraw.\n  acknowledgeUnredacted: z.boolean().default(true),\n  // The principal accepts the shared-exposure disclosure: watching this desktop\n  // also shows sibling sessions' agents on the one framebuffer.\n  acknowledgeShared: z.boolean().default(false),\n});\nexport type AcknowledgeStreamRequest = z.infer<typeof AcknowledgeStreamRequest>;\n\nexport const AcknowledgeStreamResponse = z.object({\n  acknowledged: z.boolean(),\n  acknowledgedShared: z.boolean(),\n});\nexport type AcknowledgeStreamResponse = z.infer<typeof AcknowledgeStreamResponse>;\n\n// POST .../viewers/:viewerId/heartbeat — refresh the holder TTL. Epoch-fenced:\n// a stale-epoch beat (a box re-established under a newer epoch) is rejected.\nexport const ViewerHeartbeatRequest = z.object({\n  leaseEpoch: z.number().int().nonnegative(),\n});\nexport type ViewerHeartbeatRequest = z.infer<typeof ViewerHeartbeatRequest>;\n\nexport const ViewerHeartbeatResponse = z.object({\n  // false ⇒ the holder was reaped or the epoch is stale; the client re-attaches.\n  alive: z.boolean(),\n});\nexport type ViewerHeartbeatResponse = z.infer<typeof ViewerHeartbeatResponse>;\n\n// =============================================================================\n// Bring-your-own-compute (M5) — enrollment device-flow HTTP contract.\n//\n// The HTTP shapes mirror the @opengeni/agent-proto device-flow messages\n// (DeviceAuthStart*, DeviceAuthPoll*, EnrollmentCredentials) so the Rust agent's\n// `enroll` command (which runs the flow over HTTP before it has NATS creds)\n// decodes the SAME field names (the proto's ts-proto JSON is camelCase). The\n// request bodies additionally carry the consent-relevant fields the design brief\n// mandates (the agent ed25519 pubkey + can-offer-display + requests-screen-control).\n// =============================================================================\n\nexport const EnrollmentOs = z.enum([\"linux\", \"macos\", \"windows\"]);\nexport type EnrollmentOs = z.infer<typeof EnrollmentOs>;\nexport const EnrollmentArch = z.enum([\"x86_64\", \"aarch64\"]);\nexport type EnrollmentArch = z.infer<typeof EnrollmentArch>;\n\n// POST /enrollments/device/start (agent-side, unauthenticated-at-the-user-level,\n// rate-limited). The agent presents its ed25519 public key + os/arch + the\n// requested whole-machine exposure + whether it can offer a display + whether it\n// requests screen control.\nexport const DeviceEnrollmentStartRequest = z.object({\n  // The agent's ed25519 public key (the machine identity the enrollment binds to).\n  publicKey: z.string().min(1).max(1024),\n  os: EnrollmentOs.default(\"linux\"),\n  arch: EnrollmentArch.default(\"x86_64\"),\n  // Human-friendly machine name (hostname by default).\n  machineName: z.string().min(1).max(256).optional(),\n  // v1 only supports whole-machine; kept explicit so the consent is recorded.\n  exposure: z.literal(\"whole-machine\").default(\"whole-machine\"),\n  // The agent can offer a display (a real screen / Xvfb is available).\n  canOfferDisplay: z.boolean().default(false),\n  // The agent requests screen control (computer-use); the user's allow_screen_control\n  // at approve is the AUTHORITATIVE consent.\n  requestsScreenControl: z.boolean().default(false),\n  // The workspace this machine is enrolling into. The agent is told this at install\n  // (the user picks the workspace, or the install/enroll token carries it). The user\n  // who approves must hold a grant in THIS workspace — that binding is what makes\n  // the (user-unauthenticated) start safe: it cannot grant access to a workspace no\n  // authorized user later approves in.\n  workspaceId: z.string().uuid(),\n});\nexport type DeviceEnrollmentStartRequest = z.infer<typeof DeviceEnrollmentStartRequest>;\n\n// The DeviceAuthStart response (field names match the proto's JSON).\nexport const DeviceEnrollmentStartResponse = z.object({\n  deviceCode: z.string(),\n  userCode: z.string(),\n  verificationUri: z.string(),\n  verificationUriComplete: z.string(),\n  intervalSeconds: z.number().int().positive(),\n  expiresInSeconds: z.number().int().positive(),\n});\nexport type DeviceEnrollmentStartResponse = z.infer<typeof DeviceEnrollmentStartResponse>;\n\n// POST /enrollments/device/approve (USER-authenticated, workspace-gated). The\n// LOUD CONSENT step. whole-machine is mandatory (implicit); screen-control is\n// opt-in per allow_screen_control.\nexport const DeviceEnrollmentApproveRequest = z.object({\n  userCode: z.string().min(1).max(64),\n  allowScreenControl: z.boolean().default(false),\n});\nexport type DeviceEnrollmentApproveRequest = z.infer<typeof DeviceEnrollmentApproveRequest>;\n\nexport const DeviceEnrollmentApproveResponse = z.object({\n  approved: z.boolean(),\n  enrollmentId: z.string().uuid(),\n  sandboxId: z.string().uuid(),\n  allowScreenControl: z.boolean(),\n});\nexport type DeviceEnrollmentApproveResponse = z.infer<typeof DeviceEnrollmentApproveResponse>;\n\n// POST /enrollments/device/poll (agent-side). The poll state machine.\nexport const DeviceEnrollmentPollRequest = z.object({\n  deviceCode: z.string().min(1).max(256),\n});\nexport type DeviceEnrollmentPollRequest = z.infer<typeof DeviceEnrollmentPollRequest>;\n\nexport const DeviceEnrollmentState = z.enum([\n  \"pending\",\n  \"authorized\",\n  \"denied\",\n  \"expired\",\n  \"disabled\",\n]);\nexport type DeviceEnrollmentState = z.infer<typeof DeviceEnrollmentState>;\n\n// The EnrollmentCredentials (field names match the proto's JSON). natsAccountCreds\n// is a PLACEHOLDER — the real per-workspace NATS Account creds binding is\n// infra-deferred (M4/relay); the bearer + subjectPrefix are the application-tier\n// identity the agent presents today.\nexport const EnrollmentCredentialsResponse = z.object({\n  agentId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  // The signed bearer the agent presents to the control plane (the `oge_` token).\n  bearer: z.string(),\n  // The Account-scoped control-plane subject prefix the agent subscribes to:\n  // agent.<workspaceId>.<agentId>.\n  subjectPrefix: z.string(),\n  // Connect info for the control plane + stream relay (may be empty when not yet\n  // configured for this deployment — the agent surfaces \"control plane unconfigured\").\n  natsUrls: z.array(z.string()),\n  relayUrl: z.string(),\n  // The agent's PRODUCER token for the relay edge (the `ogr_` token; M8b). Presented\n  // as StreamOpen.token when the agent registers a pty/desktop channel; the relay\n  // verifies it then pairs the producer with the viewer (whose `ogs_` token the\n  // relay also verifies). Empty when the relay-token plane is unconfigured for this\n  // deployment (graceful degrade — the agent then presents an empty token the relay\n  // rejects, surfacing the gap loudly rather than silently producing a dead stream).\n  relayToken: z.string(),\n  // VESTIGIAL (M-AUTH): there is no per-machine NATS Account creds file. The agent\n  // presents the `bearer` above as the NATS connect AUTH-TOKEN; the server's\n  // auth-callout responder validates it and mints a workspace-scoped user JWT. This\n  // field echoes the bearer so a consumer reading it as the connect credential still\n  // works; new consumers should read `bearer` directly.\n  natsAccountCreds: z.string(),\n  // The minisign public key the agent pins for self-update verification.\n  updatePublicKey: z.string(),\n  consentedWholeMachine: z.boolean(),\n  consentedScreenControl: z.boolean(),\n});\nexport type EnrollmentCredentialsResponse = z.infer<typeof EnrollmentCredentialsResponse>;\n\nexport const DeviceEnrollmentPollResponse = z.object({\n  state: DeviceEnrollmentState,\n  // Present only when state === \"authorized\".\n  credentials: EnrollmentCredentialsResponse.optional(),\n});\nexport type DeviceEnrollmentPollResponse = z.infer<typeof DeviceEnrollmentPollResponse>;\n\n// GET /enrollments — a workspace's machines (the Machines dashboard surface).\nexport const EnrollmentSummary = z.object({\n  id: z.string().uuid(),\n  pubkey: z.string(),\n  exposure: z.literal(\"whole-machine\"),\n  hasDisplay: z.boolean(),\n  // Present (non-null) only when a display EXISTS but capture is blocked (macOS\n  // Screen Recording / TCC not granted): a human, actionable reason so the UI can\n  // show \"display: capture not granted\" instead of a bare \"headless\". null == capture\n  // permitted OR genuinely headless.\n  desktopUnavailableReason: z.string().nullish(),\n  allowScreenControl: z.boolean(),\n  status: z.enum([\"active\", \"revoked\"]),\n  os: EnrollmentOs,\n  arch: z.string(),\n  lastSeenAt: z.string().nullable(),\n  createdAt: z.string(),\n  revokedAt: z.string().nullable(),\n});\nexport type EnrollmentSummary = z.infer<typeof EnrollmentSummary>;\n\nexport const ListEnrollmentsResponse = z.object({\n  enrollments: z.array(EnrollmentSummary),\n});\nexport type ListEnrollmentsResponse = z.infer<typeof ListEnrollmentsResponse>;\n\nexport const RevokeEnrollmentResponse = z.object({\n  revoked: z.boolean(),\n});\nexport type RevokeEnrollmentResponse = z.infer<typeof RevokeEnrollmentResponse>;\n\n// =============================================================================\n// Enrollment UX (self-hosted enrollment UX, design 11): the click-Grant approve\n// page lookup/deny + the headless enroll-token mint/exchange. These sit beside the\n// device-flow contracts above and REUSE EnrollmentCredentialsResponse for the\n// exchange's credential payload (identical shape to the poll authorized branch).\n// =============================================================================\n\n// POST /v1/enrollments/device/lookup (USER-authenticated, NO workspace in the\n// path). The approve page (EnrollmentConsent) needs the machine details for a\n// user_code WITHOUT consuming the request. The user_code is globally unique among\n// pending rows; the route resolves its workspace, authorizes (enrollments:read),\n// and returns the machine details — or 404 (never revealing cross-workspace\n// existence) when the grant check fails or no live pending row matches.\nexport const DeviceEnrollmentLookupRequest = z.object({\n  userCode: z.string().min(1).max(64),\n});\nexport type DeviceEnrollmentLookupRequest = z.infer<typeof DeviceEnrollmentLookupRequest>;\n\n// The presentational machine details the consent screen renders (a subset of the\n// pending request — NO secrets, NO device_code).\nexport const DeviceEnrollmentLookupMachine = z.object({\n  machineName: z.string().nullable(),\n  os: EnrollmentOs,\n  arch: z.string(),\n  canOfferDisplay: z.boolean(),\n  requestsScreenControl: z.boolean(),\n});\nexport type DeviceEnrollmentLookupMachine = z.infer<typeof DeviceEnrollmentLookupMachine>;\n\nexport const DeviceEnrollmentLookupResponse = z.object({\n  workspaceId: z.string().uuid(),\n  userCode: z.string(),\n  machine: DeviceEnrollmentLookupMachine,\n  expiresAt: z.string(),\n});\nexport type DeviceEnrollmentLookupResponse = z.infer<typeof DeviceEnrollmentLookupResponse>;\n\n// POST /v1/workspaces/:workspaceId/enrollments/device/deny (USER-authenticated,\n// enrollments:manage). The explicit \"no\" at the approve page — mirrors approve.\nexport const DeviceEnrollmentDenyRequest = z.object({\n  userCode: z.string().min(1).max(64),\n});\nexport type DeviceEnrollmentDenyRequest = z.infer<typeof DeviceEnrollmentDenyRequest>;\n\nexport const DeviceEnrollmentDenyResponse = z.object({\n  denied: z.boolean(),\n});\nexport type DeviceEnrollmentDenyResponse = z.infer<typeof DeviceEnrollmentDenyResponse>;\n\n// POST /v1/workspaces/:workspaceId/enrollments/token (USER-authenticated,\n// enrollments:manage). Mints the short-TTL headless enroll token (the `oget_`\n// token). allowScreenControl bakes the screen-control consent into the token.\nexport const MintEnrollTokenRequest = z.object({\n  allowScreenControl: z.boolean().default(false),\n});\nexport type MintEnrollTokenRequest = z.infer<typeof MintEnrollTokenRequest>;\n\nexport const MintEnrollTokenResponse = z.object({\n  // The `oget_` token. SECRET — the UI shows it once with a copy-now warning.\n  token: z.string(),\n  expiresAt: z.string(),\n  expiresInSeconds: z.number().int().positive(),\n});\nexport type MintEnrollTokenResponse = z.infer<typeof MintEnrollTokenResponse>;\n\n// POST /v1/enrollments/token/exchange (UNAUTHENTICATED — the token IS the auth).\n// The agent presents the same identity fields it sends to device/start plus the\n// enroll token. On a valid token the control plane performs the SAME finalize as\n// approve and returns the IDENTICAL EnrollmentCredentialsResponse shape (so the\n// agent's existing credential parsing is reused).\nexport const EnrollTokenExchangeRequest = z.object({\n  // The `oget_` enroll token (the auth + the workspace/account/consent grant).\n  token: z.string().min(1),\n  // The agent's ed25519 public key (the machine identity the enrollment binds to).\n  publicKey: z.string().min(1).max(1024),\n  os: EnrollmentOs.default(\"linux\"),\n  arch: EnrollmentArch.default(\"x86_64\"),\n  machineName: z.string().min(1).max(256).optional(),\n  // v1 only supports whole-machine; kept explicit so the consent is recorded.\n  exposure: z.literal(\"whole-machine\").default(\"whole-machine\"),\n  canOfferDisplay: z.boolean().default(false),\n  // The agent's REQUEST; the token's allowScreenControl is the AUTHORITATIVE consent.\n  requestsScreenControl: z.boolean().default(false),\n});\nexport type EnrollTokenExchangeRequest = z.infer<typeof EnrollTokenExchangeRequest>;\n\n// The exchange wraps the EXISTING EnrollmentCredentialsResponse — IDENTICAL to the\n// poll authorized branch's `credentials` (NOT a redefined credential shape).\nexport const EnrollTokenExchangeResponse = z.object({\n  credentials: EnrollmentCredentialsResponse,\n});\nexport type EnrollTokenExchangeResponse = z.infer<typeof EnrollTokenExchangeResponse>;\n\n// ── Machines dashboard + per-machine metrics (M10) ────────────\n//\n// The SHARED data contract M10 (backend) implements + M9 (UI) renders. THE\n// orchestrator owns this shape; M9 imports these types so the dashboard never\n// drifts from the API. The fields mirror the agent's MetricsSample wire shape\n// (`@opengeni/agent-proto`) projected to the dashboard's JSON, plus the derived\n// machine state matrix (the M3 liveness + the consent/display reasons).\n\n/**\n * A point-in-time machine metrics sample as the dashboard reads it. `cpuPct` and\n * the load averages are 0..N doubles; the byte figures are integers; `gpuUtilPct`\n * / `gpuMemBytes` are null when no GPU was present at sample time (the wire\n * contract: absence == not-reported, NEVER a real zero). `runQueue` is the\n * runnable-count contention signal. `sampledAt` is an ISO-8601 instant.\n */\nexport const MetricSample = z.object({\n  cpuPct: z.number(),\n  load1: z.number(),\n  load5: z.number(),\n  load15: z.number(),\n  memUsedBytes: z.number().int(),\n  memTotalBytes: z.number().int(),\n  diskUsedBytes: z.number().int(),\n  diskTotalBytes: z.number().int(),\n  gpuUtilPct: z.number().nullable(),\n  gpuMemBytes: z.number().int().nullable(),\n  runQueue: z.number(),\n  sampledAt: z.string(),\n});\nexport type MetricSample = z.infer<typeof MetricSample>;\n\n/** The derived dashboard state of a machine. The M3 liveness\n *  (online/reconnecting/offline) plus the enrollment-derived consent/display\n *  reasons (consent_required / display_unavailable) and the in-flight device-flow\n *  (enrolling). */\nexport const MachineState = z.enum([\n  \"online\",\n  \"reconnecting\",\n  \"offline\",\n  \"consent_required\",\n  \"display_unavailable\",\n  \"enrolling\",\n]);\nexport type MachineState = z.infer<typeof MachineState>;\n\nexport const MachineKind = z.enum([\"modal\", \"selfhosted\"]);\nexport type MachineKind = z.infer<typeof MachineKind>;\n\n/**\n * A machine as the Machines dashboard renders it. The workspace's enrolled\n * selfhosted machines PLUS the session's synthetic Modal group box\n * (`isSessionGroup: true`). `active` marks the session's currently-active\n * routing target. `sharedSessionCount` is the lease refcount (how many sessions\n * share this whole machine). `metrics` is the latest sample, or null when none\n * has landed yet (just enrolled / offline before a first heartbeat).\n */\nexport const MachineView = z.object({\n  sandboxId: z.string(),\n  enrollmentId: z.string().nullable(),\n  name: z.string(),\n  kind: MachineKind,\n  state: MachineState,\n  active: z.boolean(),\n  isSessionGroup: z.boolean(),\n  workspaceGeneration: z.number().int().nonnegative().nullable(),\n  archiveGeneration: z.number().int().nonnegative().nullable(),\n  archiveComplete: z.boolean(),\n  os: z.string(),\n  arch: z.string(),\n  hasDisplay: z.boolean(),\n  // Non-null only when a display exists but capture is blocked (macOS Screen\n  // Recording / TCC not granted) — the UI can surface \"display: capture not granted\".\n  // null == capture permitted OR headless.\n  desktopUnavailableReason: z.string().nullish(),\n  allowScreenControl: z.boolean(),\n  sharedSessionCount: z.number().int(),\n  lastSeenAt: z.string().nullable(),\n  metrics: MetricSample.nullable(),\n});\nexport type MachineView = z.infer<typeof MachineView>;\n\n/**\n * GET /v1/workspaces/:ws/machines — the dashboard list. `activeSandboxId` /\n * `activeEpoch` echo the session's epoch-fenced active-sandbox pointer (null\n * activeSandboxId == the session's own group box is active).\n */\nexport const MachinesResponse = z.object({\n  activeSandboxId: z.string().nullable(),\n  activeEpoch: z.number().int(),\n  machines: z.array(MachineView),\n});\nexport type MachinesResponse = z.infer<typeof MachinesResponse>;\n\n/**\n * POST /v1/workspaces/:ws/sessions/:sessionId/active-sandbox — the user-\n * authenticated swap of a session's active sandbox (the same epoch-fenced\n * mechanic the M7 `sandbox_swap` MCP tool exposes to the agent). `target` is a\n * `MachinesResponse` machine's `sandboxId`, or \"session\"/\"default\" to swap back\n * to the session's own group box.\n */\nexport const SwapActiveSandboxRequest = z.object({\n  target: z.string().min(1),\n});\nexport type SwapActiveSandboxRequest = z.infer<typeof SwapActiveSandboxRequest>;\n\n/**\n * The swap outcome (mirrors the server `FleetSwapResult`). `swapped` is true on a\n * successful repoint OR a no-op (already pointed there); `reason` carries the\n * failure detail (unowned/offline target, or a lost epoch fence) when false.\n */\nexport const SwapActiveSandboxResponse = z.object({\n  swapped: z.boolean(),\n  activeSandboxId: z.string().nullable(),\n  activeEpoch: z.number().int(),\n  reason: z.string().optional(),\n  // Typed rejection discriminant (issue #341). Present only when swapped is false,\n  // so a client distinguishes a deleted/absent target from an unaddressable\n  // enrollment from a backend the turn cannot establish from a lost epoch race —\n  // without parsing the human reason string.\n  code: z\n    .enum([\n      \"stale_pointer\",\n      \"offline_enrollment\",\n      \"unsupported_backend_context\",\n      \"transient_establishment\",\n      \"concurrent_swap\",\n      \"recovery_in_progress\",\n      \"recovery_degraded\",\n      \"recovery_unrecoverable\",\n    ])\n    .optional(),\n});\nexport type SwapActiveSandboxResponse = z.infer<typeof SwapActiveSandboxResponse>;\n\n/**\n * GET /v1/workspaces/:ws/machines/:enrollmentId/metrics/series?window=1h — the\n * downsampled (~1/min) history the dashboard time-range reads.\n */\nexport const MachineMetricsSeriesResponse = z.object({\n  samples: z.array(MetricSample),\n});\nexport type MachineMetricsSeriesResponse = z.infer<typeof MachineMetricsSeriesResponse>;\n\n/**\n * Keep this server-facing schema graph eager when imported while allowing\n * browser bundlers to discard it when contracts is used only for unrelated\n * helpers. Keep each call site annotated as pure; the factory argument itself\n * is side-effect-free until invoked.\n */\nfunction defineModelContractSchema<Schema>(factory: () => Schema): Schema {\n  return factory();\n}\n\nexport const ModelCapabilitySupportV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.enum([\"supported\", \"unsupported\", \"unknown\"]),\n);\nexport type ModelCapabilitySupportV1 = z.infer<typeof ModelCapabilitySupportV1>;\n\nexport const ModelCapabilityStateV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.object({\n    upstream: ModelCapabilitySupportV1,\n    runnable: z.boolean(),\n  }),\n);\nexport type ModelCapabilityStateV1 = z.infer<typeof ModelCapabilityStateV1>;\n\nexport const ModelCapabilitiesV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.object({\n    reasoning: ModelCapabilityStateV1.extend({\n      efforts: z.array(ReasoningEffort),\n      defaultEffort: ReasoningEffort.nullable(),\n      required: z.boolean(),\n    }),\n    functionCalling: ModelCapabilityStateV1,\n    structuredOutput: ModelCapabilityStateV1,\n    hostedTools: z.object({\n      webSearch: ModelCapabilityStateV1,\n      xSearch: ModelCapabilityStateV1,\n      codeExecution: ModelCapabilityStateV1,\n    }),\n    inputModalities: z.array(z.enum([\"text\", \"image\", \"audio\"])),\n    outputModalities: z.array(z.enum([\"text\", \"image\", \"audio\"])),\n    transports: z.object({\n      sse: ModelCapabilityStateV1,\n      responsesWebSocket: ModelCapabilityStateV1,\n      realtimeAudio: ModelCapabilityStateV1,\n    }),\n    latencyModes: z.array(\n      z.object({\n        id: z.enum([\"standard\", \"priority\", \"fast\"]),\n        upstream: ModelCapabilitySupportV1,\n        runnable: z.boolean(),\n        billingMultiplierBps: z.number().int().positive().optional(),\n      }),\n    ),\n  }),\n);\nexport type ModelCapabilitiesV1 = z.infer<typeof ModelCapabilitiesV1>;\n\nexport const ModelCredentialSourceV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.union([\n    z\n      .object({ kind: z.literal(\"deployment\"), mechanism: z.enum([\"api_key\", \"azure_ad_bearer\"]) })\n      .strict(),\n    z.object({ kind: z.literal(\"connected_subscription\"), provider: z.literal(\"codex\") }).strict(),\n    z.object({ kind: z.literal(\"workspace_connection\"), mechanism: z.literal(\"api_key\") }).strict(),\n  ]),\n);\nexport type ModelCredentialSourceV1 = z.infer<typeof ModelCredentialSourceV1>;\n\nexport const ModelBillingAttributionV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z\n    .object({\n      upstreamPayer: z.enum([\"deployment\", \"workspace\", \"connected_subscription\"]),\n      metering: z.enum([\"opengeni_credits\", \"external\"]),\n    })\n    .strict(),\n);\nexport type ModelBillingAttributionV1 = z.infer<typeof ModelBillingAttributionV1>;\n\nexport const TURN_EXECUTION_POLICY_METADATA_KEY = \"turnExecutionPolicyV1\" as const;\n\nexport const TurnExecutionModelSourceV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.enum([\"explicit\", \"session\", \"deployment\", \"continuation\"]),\n);\nexport type TurnExecutionModelSourceV1 = z.infer<typeof TurnExecutionModelSourceV1>;\n\nexport const TurnExecutionReasoningSourceV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.enum([\"explicit\", \"session\", \"deployment\", \"continuation\"]),\n);\nexport type TurnExecutionReasoningSourceV1 = z.infer<typeof TurnExecutionReasoningSourceV1>;\n\n/**\n * Secret-safe execution identity frozen onto one accepted logical turn.\n *\n * This is deliberately a strict, normalized reference to the deployment\n * definition rather than a serialized provider client. It must never contain\n * a key/token, concrete connected credential id, account label, authorization\n * header, or credential-bearing URL/query value.\n */\nexport const TurnExecutionPolicyV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z\n    .object({\n      schemaVersion: z.literal(1),\n      productModelId: z.string().min(1),\n      requestedModelId: z.string().min(1).nullable(),\n      modelSource: TurnExecutionModelSourceV1,\n      reasoningEffort: ReasoningEffort,\n      reasoningSource: TurnExecutionReasoningSourceV1,\n      providerId: z.string().min(1),\n      upstreamModelId: z.string().min(1),\n      wireApi: z.enum([\"responses\", \"chat\"]),\n      credentialSource: ModelCredentialSourceV1,\n      billing: ModelBillingAttributionV1,\n      definitionVersion: z.string().regex(/^sha256:[a-f0-9]{64}$/u),\n    })\n    .strict()\n    .superRefine((policy, context) => {\n      if (policy.modelSource === \"explicit\" && policy.requestedModelId === null) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"requestedModelId\"],\n          message: \"an explicit model source requires a requested model id\",\n        });\n      }\n      if (policy.modelSource !== \"explicit\" && policy.requestedModelId !== null) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"requestedModelId\"],\n          message: \"only an explicit model source may retain a requested model id\",\n        });\n      }\n    }),\n);\nexport type TurnExecutionPolicyV1 = z.infer<typeof TurnExecutionPolicyV1>;\n\nexport type TurnExecutionPolicyReadV1 =\n  | { kind: \"absent\" }\n  | { kind: \"valid\"; policy: TurnExecutionPolicyV1 };\n\n/**\n * Read the policy from turn metadata. Only a literally absent key is legacy;\n * null, undefined, an unknown schema version, extra fields, and every other\n * malformed present value fail closed. Error text reports paths only and never\n * reflects the untrusted value into logs or events.\n */\nexport function readTurnExecutionPolicyV1(metadata: unknown): TurnExecutionPolicyReadV1 {\n  if (metadata === null || metadata === undefined) {\n    return { kind: \"absent\" };\n  }\n  if (typeof metadata !== \"object\" || Array.isArray(metadata)) {\n    throw new Error(\"Malformed turn execution policy metadata: turn metadata is not an object\");\n  }\n  const record = metadata as Record<string, unknown>;\n  if (!Object.prototype.hasOwnProperty.call(record, TURN_EXECUTION_POLICY_METADATA_KEY)) {\n    return { kind: \"absent\" };\n  }\n  const parsed = TurnExecutionPolicyV1.safeParse(record[TURN_EXECUTION_POLICY_METADATA_KEY]);\n  if (!parsed.success) {\n    const paths = [\n      ...new Set(\n        parsed.error.issues.map((issue) =>\n          issue.path.length === 0 ? \"policy\" : `policy.${issue.path.join(\".\")}`,\n        ),\n      ),\n    ].join(\", \");\n    throw new Error(`Malformed turn execution policy metadata at ${paths || \"policy\"}`);\n  }\n  return { kind: \"valid\", policy: parsed.data };\n}\n\n/** Merge a trusted policy into metadata without disturbing dispatch/recovery state. */\nexport function metadataWithTurnExecutionPolicyV1(\n  metadata: Readonly<Record<string, unknown>> | null | undefined,\n  policy: TurnExecutionPolicyV1,\n): Record<string, unknown> {\n  return {\n    ...(metadata ?? {}),\n    [TURN_EXECUTION_POLICY_METADATA_KEY]: TurnExecutionPolicyV1.parse(policy),\n  };\n}\n\n/**\n * Minimal, stable evidence projection for command receipts and audit events.\n * It intentionally excludes aliases, URLs, request metadata, and all concrete\n * credential-selection identity.\n */\nexport function turnExecutionPolicyAuditMetadata(\n  policy: TurnExecutionPolicyV1,\n  turnId: string,\n): Record<string, unknown> {\n  const parsed = TurnExecutionPolicyV1.parse(policy);\n  return {\n    turnId,\n    requestedModelId: parsed.requestedModelId,\n    effectiveModelId: parsed.productModelId,\n    modelSource: parsed.modelSource,\n    effectiveReasoningEffort: parsed.reasoningEffort,\n    reasoningSource: parsed.reasoningSource,\n    providerId: parsed.providerId,\n    credentialSourceKind: parsed.credentialSource.kind,\n    credentialSourceMechanism:\n      parsed.credentialSource.kind === \"connected_subscription\"\n        ? parsed.credentialSource.provider\n        : parsed.credentialSource.mechanism,\n    billingOwner: parsed.billing.upstreamPayer,\n    billingMetering: parsed.billing.metering,\n    definitionVersion: parsed.definitionVersion,\n  };\n}\n\nexport const ModelPricingV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.object({\n    inputMicrosPerMillionTokens: z.number().int().nonnegative(),\n    cachedInputMicrosPerMillionTokens: z.number().int().nonnegative().optional(),\n    outputMicrosPerMillionTokens: z.number().int().nonnegative(),\n    marginBps: z.number().int().min(0).max(100_000).optional(),\n  }),\n);\nexport type ModelPricingV1 = z.infer<typeof ModelPricingV1>;\n\nexport const ModelPricingScheduleV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.object({\n    default: ModelPricingV1,\n    inputTokenTiers: z\n      .array(\n        z.object({\n          minimumInputTokens: z.number().int().nonnegative(),\n          pricing: ModelPricingV1,\n        }),\n      )\n      .optional(),\n  }),\n);\nexport type ModelPricingScheduleV1 = z.infer<typeof ModelPricingScheduleV1>;\n\n/**\n * A single host-exposed model + the provider that serves it, as surfaced to\n * clients (SDK + React composer) by GET /v1/config/client. The wire `api`\n * (\"responses\" | \"chat\") lets a client reason about provider capabilities; the\n * provider id/label drive the picker's grouping. This mirrors the runtime's\n * ConfiguredModel (packages/config) projected to the client-safe fields.\n */\nexport const ClientModel = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.object({\n    id: z.string(),\n    label: z.string(),\n    provider: z.string(), // provider id\n    providerLabel: z.string(),\n    api: z.enum([\"responses\", \"chat\"]),\n    contextWindowTokens: z.number().int().positive().optional(),\n    // Additive normalized definition metadata. Optional so older server payloads\n    // remain parseable; current servers project the complete V1 set.\n    schemaVersion: z.literal(1).optional(),\n    aliases: z.array(z.string()).optional(),\n    deployment: z\n      .object({\n        upstreamModelId: z.string().min(1),\n        wireApi: z.enum([\"responses\", \"chat\"]),\n      })\n      .optional(),\n    executionLimits: z\n      .object({\n        contextWindowTokens: z.number().int().positive().nullable(),\n        effectiveContextWindowTokens: z.number().int().positive().nullable(),\n        autoCompactTokenLimit: z.number().int().positive().nullable(),\n        toolOutputTruncationTokens: z.number().int().positive().nullable(),\n      })\n      .optional(),\n    credentialSource: ModelCredentialSourceV1.optional(),\n    billing: ModelBillingAttributionV1.optional(),\n    capabilities: ModelCapabilitiesV1.optional(),\n    pricing: ModelPricingScheduleV1.optional(),\n    definitionVersion: z\n      .string()\n      .regex(/^sha256:[a-f0-9]{64}$/u)\n      .optional(),\n  }),\n);\nexport type ClientModel = z.infer<typeof ClientModel>;\n\nexport const ModelCredentialReadinessV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z\n    .object({\n      status: z.enum([\"ready\", \"not_ready\", \"error\"]),\n      reason: z\n        .enum([\n          \"missing_credential\",\n          \"needs_reauth\",\n          \"prerequisites_missing\",\n          \"resolver_error\",\n          \"observation_stale\",\n        ])\n        .nullable(),\n      basis: z.enum([\"configuration\", \"connection\", \"resolver\"]),\n      checkedAt: z.string().datetime().nullable(),\n    })\n    .strict()\n    .superRefine((readiness, context) => {\n      if ((readiness.status === \"ready\") !== (readiness.reason === null)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"reason\"],\n          message: \"ready credential state requires no reason; non-ready state requires a reason\",\n        });\n      }\n      if ((readiness.status === \"error\") !== (readiness.reason === \"resolver_error\")) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"reason\"],\n          message:\n            \"credential errors require resolver_error and resolver_error requires error status\",\n        });\n      }\n      if (\n        readiness.basis === \"resolver\" &&\n        readiness.status === \"ready\" &&\n        readiness.checkedAt === null\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"checkedAt\"],\n          message: \"resolver readiness requires an observation timestamp\",\n        });\n      }\n      if (readiness.reason === \"observation_stale\" && readiness.checkedAt === null) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"checkedAt\"],\n          message: \"a stale observation requires its observation timestamp\",\n        });\n      }\n    }),\n);\nexport type ModelCredentialReadinessV1 = z.infer<typeof ModelCredentialReadinessV1>;\n\nexport const ModelAvailabilityV1 = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.object({\n    status: z.enum([\"available\", \"unavailable\", \"degraded\", \"unknown\"]),\n    selectable: z.boolean(),\n    reason: z\n      .enum([\n        \"missing_credential\",\n        \"needs_reauth\",\n        \"credential_not_ready\",\n        \"not_entitled\",\n        \"provider_unhealthy\",\n        \"policy_blocked\",\n        \"unsupported\",\n      ])\n      .nullable(),\n    checkedAt: z.string().datetime().nullable(),\n  }),\n);\nexport type ModelAvailabilityV1 = z.infer<typeof ModelAvailabilityV1>;\n\nexport const WorkspaceModelCatalogModel = /* @__PURE__ */ defineModelContractSchema(() =>\n  ClientModel.extend({\n    credentialReadiness: ModelCredentialReadinessV1,\n    availability: ModelAvailabilityV1,\n  }),\n);\nexport type WorkspaceModelCatalogModel = z.infer<typeof WorkspaceModelCatalogModel>;\n\nexport const WorkspaceModelCatalogResponse = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.object({\n    models: z.array(WorkspaceModelCatalogModel),\n  }),\n);\nexport type WorkspaceModelCatalogResponse = z.infer<typeof WorkspaceModelCatalogResponse>;\n\n/**\n * Exact public HTTP protocol revision spoken by this release train.\n *\n * This is deliberately independent from a deployment SHA: API and web may roll\n * at different instants, while incompatible request shapes must never cross\n * that rollout boundary. Mutating clients send this value in\n * `x-opengeni-api-contract`; the API rejects any other value before routing.\n */\nexport const OPENGENI_API_CONTRACT_REVISION = \"2026-07-turn-instructions-v1\" as const;\nexport const OPENGENI_API_CONTRACT_HEADER = \"x-opengeni-api-contract\" as const;\n/** Bounded request/response identifier shared by browser, ingress, and API diagnostics. */\nexport const OPENGENI_CORRELATION_HEADER = \"x-opengeni-correlation-id\" as const;\n\nexport const ClientConfig = /* @__PURE__ */ defineModelContractSchema(() =>\n  z.object({\n    deploymentRevision: z.string(),\n    apiContractRevision: z.literal(OPENGENI_API_CONTRACT_REVISION),\n    // Release-train version of the server (absent on dev/source builds). The\n    // compatibility policy lives in docs/architecture.md — clients within the\n    // same major are supported; evolution is additive within a major.\n    serverVersion: z.string().optional(),\n    defaultModel: z.string(),\n    allowedModels: z.array(z.string()).min(1),\n    // Richer model list (provider-grouped) for the picker. Defaults to [] for\n    // back-compat: callers that only read allowedModels are unaffected.\n    models: z.array(ClientModel).default([]),\n    defaultReasoningEffort: ReasoningEffort,\n    allowedReasoningEfforts: z.array(ReasoningEffort).min(1),\n    mcpServers: z\n      .array(\n        z.object({\n          id: z.string(),\n          name: z.string(),\n        }),\n      )\n      .default([]),\n    fileUploads: z.object({\n      enabled: z.boolean(),\n      maxSizeBytes: z.number().int().positive(),\n    }),\n    productAccessMode: ProductAccessMode,\n    auth: ClientAuthConfig.default({ mode: \"none\" }),\n    // Server-wide hint: does this deployment support Channel-A structured services\n    // at all (P4.4). Per-session availability is negotiated on /stream-capabilities\n    // (it depends on the session's pinned backend); this is the coarse on/off the\n    // client uses to decide whether to even attempt the fs/git/terminal panels.\n    structuredServices: z\n      .object({\n        fileSystem: z.boolean(),\n        git: z.boolean(),\n        terminalEvents: z.boolean(),\n      })\n      .default({ fileSystem: false, git: false, terminalEvents: false }),\n  }),\n);\nexport type ClientConfig = z.infer<typeof ClientConfig>;\n\nfunction base64UrlEncode(value: string): string {\n  return Buffer.from(value, \"utf8\").toString(\"base64url\");\n}\n\nfunction base64UrlDecode(value: string): string {\n  return Buffer.from(value, \"base64url\").toString(\"utf8\");\n}\n\nasync function hmacSha256Base64Url(secret: string, value: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    new TextEncoder().encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const signature = await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(value));\n  return Buffer.from(signature).toString(\"base64url\");\n}\n\nfunction constantTimeEqual(actual: string, expected: string): boolean {\n  const actualBytes = new TextEncoder().encode(actual);\n  const expectedBytes = new TextEncoder().encode(expected);\n  if (actualBytes.length !== expectedBytes.length) {\n    return false;\n  }\n  let diff = 0;\n  for (let index = 0; index < actualBytes.length; index += 1) {\n    diff |= actualBytes[index]! ^ expectedBytes[index]!;\n  }\n  return diff === 0;\n}\n\nexport type HealthResponse = {\n  service: string;\n  variableSet: string;\n  ok: boolean;\n};\n\n/**\n * Per-workspace model/provider availability policy (see @opengeni/db\n * workspace_model_policies). NULL fields = unrestricted; a non-null\n * allowedProviders is a strict allowlist over RESOLVED provider identities\n * (the built-in OpenAI/Azure client's id — \"openai\"/\"azure\" — including the\n * legacy null-resolution fallback; \"codex-subscription\" for the ChatGPT/Codex\n * overlay; registry providers by their declared ids); a non-null allowedModels\n * is an additional exact-model-id allowlist. Pure and shared so the API edge\n * (422) and the worker's authoritative post-resolution gate (fail-loud\n * turn.failed, never a silent remap) can never disagree on semantics.\n */\nexport type WorkspaceModelPolicyContract = {\n  allowedProviders: string[] | null;\n  allowedModels: string[] | null;\n};\n\nexport type WorkspaceModelPolicyVerdict =\n  | { allowed: true }\n  | { allowed: false; reason: \"provider\" | \"model\" };\n\nexport function evaluateWorkspaceModelPolicy(\n  policy: WorkspaceModelPolicyContract | null | undefined,\n  candidate: { providerId: string; modelId: string },\n): WorkspaceModelPolicyVerdict {\n  if (!policy) {\n    return { allowed: true };\n  }\n  if (policy.allowedProviders !== null && !policy.allowedProviders.includes(candidate.providerId)) {\n    return { allowed: false, reason: \"provider\" };\n  }\n  if (policy.allowedModels !== null && !policy.allowedModels.includes(candidate.modelId)) {\n    return { allowed: false, reason: \"model\" };\n  }\n  return { allowed: true };\n}\n\nexport * from \"./codex-fleet-policy\";\nexport * from \"./secret-redaction\";\nexport * from \"./workspace-instruction-policies\";\n","import { z } from \"zod\";\n\n/** Hard server-side ceiling for one retained-output response body. */\nexport const RETAINED_OUTPUT_MAX_PAGE_BYTES = 1024 * 1024;\n/** Default first page when the client does not send a Range header. */\nexport const RETAINED_OUTPUT_DEFAULT_PAGE_BYTES = 256 * 1024;\n/** Receipts are timeline references, never an extensible metadata bag. */\nexport const RETAINED_OUTPUT_RECEIPT_MAX_BYTES = 2 * 1024;\n\nconst encoder = new TextEncoder();\nconst LOWERCASE_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;\nconst LOWERCASE_SHA256 = /^[0-9a-f]{64}$/;\nconst CANONICAL_MEDIA_TYPE = /^[a-z0-9][a-z0-9!#$&^_.+-]{0,62}\\/[a-z0-9][a-z0-9!#$&^_.+-]{0,62}$/;\nconst RETRIEVAL_PATH = /^\\/v1\\/workspaces\\/([0-9a-f-]+)\\/artifacts\\/([0-9a-f-]+)\\/content$/;\n\nexport const RetainedOutputKind = z.enum([\n  \"tool_result\",\n  \"assistant_completion\",\n  \"internal_update\",\n  \"event_media\",\n  \"file\",\n]);\nexport type RetainedOutputKind = z.infer<typeof RetainedOutputKind>;\n\nexport const RetainedOutputUnavailableReason = z.enum([\n  \"not_retained\",\n  \"pending\",\n  \"failed\",\n  \"expired\",\n  \"deleted\",\n  \"missing_storage\",\n  \"storage_write_failed\",\n  \"unsupported\",\n]);\nexport type RetainedOutputUnavailableReason = z.infer<typeof RetainedOutputUnavailableReason>;\n\nconst RetainedOutputUnavailableEvidenceSchema = z\n  .object({\n    available: z.literal(false),\n    reason: RetainedOutputUnavailableReason,\n  })\n  .strict();\n\nexport const RetainedArtifactReferenceSchema = z\n  .object({\n    available: z.literal(true),\n    artifactId: z.string().regex(LOWERCASE_UUID),\n    kind: RetainedOutputKind,\n    contentType: z.string().max(127).regex(CANONICAL_MEDIA_TYPE),\n    originalBytes: z.number().int().nonnegative().safe(),\n    sha256: z.string().regex(LOWERCASE_SHA256),\n    retainedAt: z.string().datetime({ offset: true }),\n    retention: z\n      .object({\n        policy: z.literal(\"workspace_file\"),\n        expiresAt: z.null(),\n      })\n      .strict(),\n    retrieval: z\n      .object({\n        method: z.literal(\"GET\"),\n        path: z.string().max(256),\n        acceptRanges: z.literal(\"bytes\"),\n        maxRangeBytes: z.number().int().positive().max(RETAINED_OUTPUT_MAX_PAGE_BYTES),\n      })\n      .strict(),\n  })\n  .strict()\n  .superRefine((value, ctx) => {\n    const match = RETRIEVAL_PATH.exec(value.retrieval.path);\n    if (!match || !LOWERCASE_UUID.test(match[1] ?? \"\") || match[2] !== value.artifactId) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"retrieval\", \"path\"],\n        message: \"retrieval path must be a workspace API content path for this artifact\",\n      });\n    }\n\n    if (encoder.encode(JSON.stringify(value)).byteLength > RETAINED_OUTPUT_RECEIPT_MAX_BYTES) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: \"retained-output receipt exceeds its byte envelope\",\n      });\n    }\n  });\n\n/**\n * Canonical evidence fact carried by bounded audit/NATS/SSE/UI previews.\n *\n * The available variant is intentionally provider-neutral and closed: no bucket,\n * object key, signed URL, arbitrary metadata, or producer-controlled labels can\n * cross this boundary.\n */\nexport const RetainedOutputEvidenceSchema = z.discriminatedUnion(\"available\", [\n  RetainedOutputUnavailableEvidenceSchema,\n  RetainedArtifactReferenceSchema,\n]);\nexport type RetainedOutputEvidence = z.infer<typeof RetainedOutputEvidenceSchema>;\nexport type RetainedArtifactReference = z.infer<typeof RetainedArtifactReferenceSchema>;\n/** @deprecated use RetainedArtifactReference. */\nexport type RetainedOutputAvailableEvidence = RetainedArtifactReference;\n\nexport const RetainedArtifactUnavailableSchema = z\n  .object({\n    available: z.literal(false),\n    artifactId: z.string().regex(LOWERCASE_UUID),\n    reason: RetainedOutputUnavailableReason,\n  })\n  .strict();\nexport type RetainedArtifactUnavailable = z.infer<typeof RetainedArtifactUnavailableSchema>;\n\n/** Authenticated metadata result for one opaque workspace file identity. */\nexport const RetainedArtifactMetadataSchema = z.union([\n  RetainedArtifactReferenceSchema,\n  RetainedArtifactUnavailableSchema,\n]);\nexport type RetainedArtifactMetadata = z.infer<typeof RetainedArtifactMetadataSchema>;\n\nexport type RetainedArtifactFileInput = {\n  id: string;\n  workspaceId: string;\n  status: string;\n  contentType: string;\n  sizeBytes: number;\n  sha256: string | null;\n  updatedAt: string;\n};\n\n/**\n * Convert a ready, integrity-addressed workspace file into the only available\n * retained-output receipt shape. Invalid, pending, or checksum-less files fail\n * closed instead of implying that full evidence is retrievable.\n */\nexport function retainedArtifactReferenceFromFile(\n  file: RetainedArtifactFileInput,\n  kind: RetainedOutputKind = \"file\",\n): RetainedArtifactReference | null {\n  if (file.status !== \"ready\" || !file.sha256) return null;\n  const value = {\n    available: true as const,\n    artifactId: file.id,\n    kind,\n    contentType: canonicalRetainedContentType(file.contentType),\n    originalBytes: file.sizeBytes,\n    sha256: file.sha256,\n    retainedAt: file.updatedAt,\n    retention: {\n      policy: \"workspace_file\" as const,\n      expiresAt: null,\n    },\n    retrieval: {\n      method: \"GET\" as const,\n      path: `/v1/workspaces/${file.workspaceId}/artifacts/${file.id}/content`,\n      acceptRanges: \"bytes\" as const,\n      maxRangeBytes: RETAINED_OUTPUT_MAX_PAGE_BYTES,\n    },\n  };\n  const parsed = RetainedArtifactReferenceSchema.safeParse(value);\n  return parsed.success ? parsed.data : null;\n}\n\nfunction canonicalRetainedContentType(value: string): string {\n  const mediaType = value.split(\";\", 1)[0]?.trim().toLowerCase() ?? \"\";\n  return CANONICAL_MEDIA_TYPE.test(mediaType) ? mediaType : \"application/octet-stream\";\n}\n\n/** Parse and clone a trusted server receipt; invalid/untrusted data fails closed. */\nexport function validateRetainedOutputEvidence(value: unknown): RetainedOutputEvidence | null {\n  const parsed = RetainedOutputEvidenceSchema.safeParse(value);\n  return parsed.success ? parsed.data : null;\n}\n\nexport function retainedOutputUnavailable(\n  reason: RetainedOutputUnavailableReason = \"not_retained\",\n): RetainedOutputEvidence {\n  return { available: false, reason };\n}\n\nexport type RetainedOutputResolvedRange = {\n  kind: \"range\";\n  start: number;\n  end: number;\n  length: number;\n  totalBytes: number;\n  status: 200 | 206;\n  contentRange: string | null;\n  acceptRanges: \"bytes\";\n};\n\nexport type RetainedOutputRangeResolution =\n  | RetainedOutputResolvedRange\n  | {\n      kind: \"empty\";\n      length: 0;\n      totalBytes: 0;\n      status: 200;\n      contentRange: null;\n      acceptRanges: \"bytes\";\n    }\n  | {\n      kind: \"invalid\";\n      reason: \"malformed\" | \"multipart_not_supported\" | \"numeric_overflow\" | \"range_too_large\";\n      maxPageBytes: number;\n    }\n  | {\n      kind: \"unsatisfiable\";\n      reason: \"empty_artifact\" | \"start_out_of_bounds\" | \"end_before_start\" | \"zero_suffix\";\n      totalBytes: number;\n      contentRange: string;\n    };\n\n/**\n * Resolve one RFC-style bytes range without ever licensing a response larger\n * than `maxPageBytes`. Multipart ranges and oversized explicit/suffix requests\n * fail closed. An omitted or open-ended range becomes one resumable bounded page.\n */\nexport function resolveRetainedOutputRange(\n  rangeHeader: string | null | undefined,\n  totalBytes: number,\n  maxPageBytes = RETAINED_OUTPUT_DEFAULT_PAGE_BYTES,\n): RetainedOutputRangeResolution {\n  assertRangeInputs(totalBytes, maxPageBytes);\n\n  if (rangeHeader === null || rangeHeader === undefined || rangeHeader === \"\") {\n    if (totalBytes === 0) {\n      return {\n        kind: \"empty\",\n        length: 0,\n        totalBytes: 0,\n        status: 200,\n        contentRange: null,\n        acceptRanges: \"bytes\",\n      };\n    }\n    const end = Math.min(totalBytes - 1, maxPageBytes - 1);\n    const partial = end + 1 < totalBytes;\n    return resolvedRange(0, end, totalBytes, partial ? 206 : 200);\n  }\n\n  if (rangeHeader.length > 128 || /[^\\x20-\\x7e]/.test(rangeHeader)) {\n    return invalidRange(\"malformed\", maxPageBytes);\n  }\n  if (rangeHeader.includes(\",\")) {\n    return invalidRange(\"multipart_not_supported\", maxPageBytes);\n  }\n  const match = /^bytes=(\\d*)-(\\d*)$/.exec(rangeHeader);\n  if (!match || (!match[1] && !match[2])) {\n    return invalidRange(\"malformed\", maxPageBytes);\n  }\n\n  const first = parseRangeInteger(match[1]);\n  const second = parseRangeInteger(match[2]);\n  if (first === \"overflow\" || second === \"overflow\") {\n    return invalidRange(\"numeric_overflow\", maxPageBytes);\n  }\n\n  if (first === null) {\n    const suffixLength = second;\n    if (suffixLength === null) return invalidRange(\"malformed\", maxPageBytes);\n    if (suffixLength === 0) return unsatisfiableRange(\"zero_suffix\", totalBytes);\n    if (suffixLength > maxPageBytes) return invalidRange(\"range_too_large\", maxPageBytes);\n    if (totalBytes === 0) return unsatisfiableRange(\"empty_artifact\", totalBytes);\n    const length = Math.min(suffixLength, totalBytes);\n    return resolvedRange(totalBytes - length, totalBytes - 1, totalBytes, 206);\n  }\n\n  if (totalBytes === 0) return unsatisfiableRange(\"empty_artifact\", totalBytes);\n  if (first >= totalBytes) return unsatisfiableRange(\"start_out_of_bounds\", totalBytes);\n\n  if (second === null) {\n    const end = Math.min(totalBytes - 1, first + maxPageBytes - 1);\n    return resolvedRange(first, end, totalBytes, 206);\n  }\n  if (second < first) return unsatisfiableRange(\"end_before_start\", totalBytes);\n  if (second - first >= maxPageBytes) {\n    return invalidRange(\"range_too_large\", maxPageBytes);\n  }\n  return resolvedRange(first, Math.min(second, totalBytes - 1), totalBytes, 206);\n}\n\nfunction assertRangeInputs(totalBytes: number, maxPageBytes: number): void {\n  if (!Number.isSafeInteger(totalBytes) || totalBytes < 0) {\n    throw new RangeError(\"totalBytes must be a nonnegative safe integer\");\n  }\n  if (\n    !Number.isSafeInteger(maxPageBytes) ||\n    maxPageBytes <= 0 ||\n    maxPageBytes > RETAINED_OUTPUT_MAX_PAGE_BYTES\n  ) {\n    throw new RangeError(\n      `maxPageBytes must be an integer between 1 and ${RETAINED_OUTPUT_MAX_PAGE_BYTES}`,\n    );\n  }\n}\n\nfunction parseRangeInteger(value: string | undefined): number | null | \"overflow\" {\n  if (!value) return null;\n  // Avoid both precision loss and work proportional to an adversarial digit run.\n  if (value.length > 16) return \"overflow\";\n  const parsed = Number(value);\n  return Number.isSafeInteger(parsed) ? parsed : \"overflow\";\n}\n\nfunction resolvedRange(\n  start: number,\n  end: number,\n  totalBytes: number,\n  status: 200 | 206,\n): RetainedOutputResolvedRange {\n  return {\n    kind: \"range\",\n    start,\n    end,\n    length: end - start + 1,\n    totalBytes,\n    status,\n    contentRange: status === 206 ? `bytes ${start}-${end}/${totalBytes}` : null,\n    acceptRanges: \"bytes\",\n  };\n}\n\nfunction invalidRange(\n  reason: Extract<RetainedOutputRangeResolution, { kind: \"invalid\" }>[\"reason\"],\n  maxPageBytes: number,\n): RetainedOutputRangeResolution {\n  return { kind: \"invalid\", reason, maxPageBytes };\n}\n\nfunction unsatisfiableRange(\n  reason: Extract<RetainedOutputRangeResolution, { kind: \"unsatisfiable\" }>[\"reason\"],\n  totalBytes: number,\n): RetainedOutputRangeResolution {\n  return {\n    kind: \"unsatisfiable\",\n    reason,\n    totalBytes,\n    contentRange: `bytes */${totalBytes}`,\n  };\n}\n","/**\n * Canonical bounded representation for `session_events.payload`.\n *\n * Session events are the lossy human/audit projection, not model memory and not\n * an evidence blob store. This helper keeps that projection useful while making\n * the loss explicit. It deliberately has no server-only dependency so the DB,\n * realtime transports, SDK/React, and tests can share one wire contract.\n */\n\nimport {\n  retainedOutputUnavailable,\n  validateRetainedOutputEvidence,\n  type RetainedOutputEvidence,\n} from \"./retained-output\";\n\nexport const SESSION_EVENT_PAYLOAD_MAX_BYTES = 64 * 1024;\n\nconst TARGET_PAYLOAD_BYTES = 60 * 1024;\nconst DEFAULT_STRING_BYTES = 8 * 1024;\nconst RETRY_STRING_BYTES = 1024;\nconst DEFAULT_ARRAY_ENTRIES = 40;\nconst RETRY_ARRAY_ENTRIES = 12;\nconst DEFAULT_OBJECT_FIELDS = 80;\nconst RETRY_OBJECT_FIELDS = 32;\nconst MAX_PREVIEW_DEPTH = 12;\nconst MAX_PREVIEW_NODES = 512;\nconst MAX_MEASUREMENT_NODES = 2_048;\nconst MAX_MEASUREMENT_DEPTH = 64;\nconst MAX_DETAIL_RECORDS = 24;\nconst APPROX_BYTES_PER_TOKEN = 4;\nconst encoder = new TextEncoder();\n\nconst IDENTITY_FIELDS = new Set([\n  \"id\",\n  \"callId\",\n  \"call_id\",\n  \"name\",\n  \"toolName\",\n  \"type\",\n  \"status\",\n  \"code\",\n  \"isError\",\n  \"stream\",\n  \"commandId\",\n  \"sequence\",\n]);\n\nexport type SessionEventBoundarySurface =\n  | \"durable_audit\"\n  | \"database_guard\"\n  | \"database_read_projection\"\n  | \"http_projection\"\n  | \"nats_legacy_guard\"\n  | \"sse_legacy_guard\"\n  | \"browser_legacy_guard\";\n\nexport type SessionEventPayloadTruncation = {\n  truncated: true;\n  surface: SessionEventBoundarySurface;\n  reason:\n    | \"payload_bytes_exceeded\"\n    | \"payload_not_serializable\"\n    | \"payload_measurement_bounded\"\n    | \"inline_media_not_retained\"\n    | \"database_guard\";\n  originalBytes: number | null;\n  deliveredBytes: number;\n  omittedBytes: number | null;\n  estimatedOriginalTokens: number | null;\n  estimatedDeliveredTokens: number;\n  fullEvidence: RetainedOutputEvidence;\n  details: Array<{\n    path: string;\n    kind:\n      | \"string\"\n      | \"array\"\n      | \"object\"\n      | \"depth\"\n      | \"budget\"\n      | \"media\"\n      | \"binary\"\n      | \"unserializable\";\n    originalBytes?: number;\n    deliveredBytes?: number;\n    omittedEntries?: number | null;\n    mediaType?: string;\n  }>;\n};\n\nexport type BoundSessionEventPayloadOptions = {\n  surface?: SessionEventBoundarySurface;\n  maxBytes?: number;\n  /**\n   * Separately trusted durable receipt. Producer payload fields never populate\n   * this slot; invalid values fail closed to not_retained.\n   */\n  fullEvidence?: unknown;\n};\n\nexport type SessionEventJsonMeasurement =\n  | { bytes: number; reason: null }\n  | {\n      bytes: null;\n      reason: \"payload_not_serializable\" | \"payload_measurement_bounded\";\n    };\n\nexport type SessionEventMediaPreview = {\n  type: \"media_preview\";\n  mediaType: string;\n  inlineBytes: number | null;\n  fullOutputAvailable: false;\n  preview: string;\n};\n\ntype PreviewState = {\n  changed: boolean;\n  sawMedia: boolean;\n  details: SessionEventPayloadTruncation[\"details\"];\n  stringBytes: number;\n  arrayEntries: number;\n  objectFields: number;\n  remainingNodes: number;\n};\n\n/** UTF-8 bytes used by the JSON wire/storage representation. */\nexport function sessionEventJsonBytes(value: unknown): number {\n  return encoder.encode(stringifyForBoundary(value)).byteLength;\n}\n\n/**\n * Inspect a prospective event value without invoking accessors, custom\n * serializers, or allocating its complete JSON representation. A null byte\n * count is explicit: the traversal stopped at the global work/depth boundary\n * or found serialization behavior that must first be normalized.\n */\nexport function measureSessionEventJson(value: unknown): SessionEventJsonMeasurement {\n  return measureJsonBytes(value);\n}\n\n/** The same deliberately coarse bytes/4 token estimate used by Codex parity code. */\nexport function approximateSessionEventTokens(bytes: number): number {\n  return Math.ceil(Math.max(0, bytes) / APPROX_BYTES_PER_TOKEN);\n}\n\n/** Truthful audit fact for inline media whose source bytes are not durably retained. */\nexport function sessionEventMediaPreview(\n  mediaType: string,\n  inlineBytes: number | null,\n): SessionEventMediaPreview {\n  return {\n    type: \"media_preview\",\n    mediaType: mediaType || \"application/octet-stream\",\n    inlineBytes:\n      inlineBytes === null\n        ? null\n        : Math.max(0, Math.floor(Number.isFinite(inlineBytes) ? inlineBytes : 0)),\n    fullOutputAvailable: false,\n    preview: \"Inline media omitted from the audit timeline; source bytes were not retained.\",\n  };\n}\n\n/** Parse a base64 data URL into a compact audit fact without decoding/copying its bytes. */\nexport function sessionEventMediaPreviewFromDataUrl(\n  value: string,\n): SessionEventMediaPreview | null {\n  const match = /^data:([^;,]+)(?:;[^,]*)?;base64,/i.exec(value);\n  if (!match) return null;\n  const encodedLength = Math.max(0, value.length - match[0].length);\n  const padding = value.endsWith(\"==\") ? 2 : value.endsWith(\"=\") ? 1 : 0;\n  return sessionEventMediaPreview(\n    match[1] ?? \"application/octet-stream\",\n    Math.max(0, Math.floor((encodedLength * 3) / 4) - padding),\n  );\n}\n\n/** Read explicit truncation metadata from a bounded object payload. */\nexport function sessionEventPayloadTruncation(\n  payload: unknown,\n): SessionEventPayloadTruncation | null {\n  if (!isPlainRecord(payload)) return null;\n  const value = payload.truncation;\n  if (!isPlainRecord(value) || value.truncated !== true) return null;\n  return value as SessionEventPayloadTruncation;\n}\n\n/**\n * Return a byte-bounded audit payload. Unchanged ordinary payloads retain their\n * reference. Oversized strings/containers get deterministic head+tail previews;\n * inline images/binary values become metadata because `session_events` does not\n * durably retain their source bytes as independently retrievable evidence.\n */\nexport function boundSessionEventPayload<T>(\n  payload: T,\n  options: BoundSessionEventPayloadOptions = {},\n): T {\n  const maxBytes = Math.max(1024, Math.floor(options.maxBytes ?? SESSION_EVENT_PAYLOAD_MAX_BYTES));\n  const surface = options.surface ?? \"durable_audit\";\n  const fullEvidence =\n    validateRetainedOutputEvidence(options.fullEvidence) ?? retainedOutputUnavailable();\n  const originalMeasurement = measureJsonBytes(payload);\n  const originalBytes = originalMeasurement.bytes;\n\n  let state = previewState(DEFAULT_STRING_BYTES, DEFAULT_ARRAY_ENTRIES, DEFAULT_OBJECT_FIELDS);\n  let preview = previewValue(payload, state, \"$\", 0);\n  if (!state.changed && originalBytes !== null && originalBytes <= maxBytes) {\n    return payload;\n  }\n\n  let reason = payloadTruncationReason(originalMeasurement, state);\n  let bounded = attachTruncation(\n    preview,\n    boundaryMetadata(surface, reason, originalBytes, state, fullEvidence),\n  );\n\n  if (sessionEventJsonBytes(bounded) > Math.min(maxBytes, TARGET_PAYLOAD_BYTES)) {\n    state = previewState(RETRY_STRING_BYTES, RETRY_ARRAY_ENTRIES, RETRY_OBJECT_FIELDS);\n    preview = previewValue(payload, state, \"$\", 0);\n    reason = payloadTruncationReason(originalMeasurement, state);\n    bounded = attachTruncation(\n      preview,\n      boundaryMetadata(surface, reason, originalBytes, state, fullEvidence),\n    );\n  }\n\n  if (sessionEventJsonBytes(bounded) > maxBytes) {\n    const identity = identityPreview(payload);\n    state.changed = true;\n    recordDetail(state, {\n      path: \"$\",\n      kind: \"object\",\n      ...(originalBytes === null ? {} : { originalBytes }),\n    });\n    bounded = attachTruncation(\n      {\n        ...identity,\n        preview: \"[event payload omitted: bounded audit preview exceeded the storage envelope]\",\n      },\n      boundaryMetadata(surface, reason, originalBytes, state, fullEvidence),\n    );\n  }\n\n  settleDeliveredSizes(bounded, maxBytes);\n  return bounded as T;\n}\n\nfunction previewState(\n  stringBytes: number,\n  arrayEntries: number,\n  objectFields: number,\n): PreviewState {\n  return {\n    changed: false,\n    sawMedia: false,\n    details: [],\n    stringBytes,\n    arrayEntries,\n    objectFields,\n    remainingNodes: MAX_PREVIEW_NODES,\n  };\n}\n\nfunction payloadTruncationReason(\n  measurement: JsonMeasurement,\n  state: PreviewState,\n): SessionEventPayloadTruncation[\"reason\"] {\n  if (state.sawMedia) return \"inline_media_not_retained\";\n  return measurement.bytes === null ? measurement.reason : \"payload_bytes_exceeded\";\n}\n\nfunction previewValue(value: unknown, state: PreviewState, path: string, depth: number): unknown {\n  if (state.remainingNodes <= 0) {\n    state.changed = true;\n    recordDetail(state, { path, kind: \"budget\" });\n    return \"[nested value omitted at audit preview traversal boundary]\";\n  }\n  state.remainingNodes -= 1;\n  if (typeof value === \"string\") {\n    const media = inlineMediaFact(value);\n    if (media) {\n      state.changed = true;\n      state.sawMedia = true;\n      recordDetail(state, {\n        path,\n        kind: \"media\",\n        originalBytes: utf8Bytes(value),\n        deliveredBytes: sessionEventJsonBytes(media),\n        mediaType: media.mediaType,\n      });\n      return media;\n    }\n    const originalBytes = utf8Bytes(value);\n    if (originalBytes <= state.stringBytes) return value;\n    state.changed = true;\n    const delivered = truncateUtf8Middle(value, state.stringBytes, originalBytes);\n    recordDetail(state, {\n      path,\n      kind: \"string\",\n      originalBytes,\n      deliveredBytes: utf8Bytes(delivered),\n    });\n    return delivered;\n  }\n  if (typeof value === \"bigint\" || typeof value === \"function\" || typeof value === \"symbol\") {\n    state.changed = true;\n    recordDetail(state, { path, kind: \"unserializable\" });\n    return `[${typeof value} value omitted at audit serialization boundary]`;\n  }\n  if (value === null || typeof value !== \"object\") return value;\n\n  const binary = binaryFact(value);\n  if (binary) {\n    state.changed = true;\n    recordDetail(state, {\n      path,\n      kind: \"binary\",\n      originalBytes: binary.originalBytes,\n      deliveredBytes: sessionEventJsonBytes(binary.preview),\n    });\n    return binary.preview;\n  }\n\n  if (depth >= MAX_PREVIEW_DEPTH) {\n    state.changed = true;\n    recordDetail(state, { path, kind: \"depth\" });\n    return \"[nested value omitted at audit preview depth boundary]\";\n  }\n\n  if (Array.isArray(value)) {\n    const keep = Math.max(2, state.arrayEntries);\n    if (value.length <= keep) {\n      return Array.from({ length: value.length }, (_, index) =>\n        previewArrayEntry(value, index, state, path, depth),\n      );\n    }\n    state.changed = true;\n    const head = Math.ceil(keep / 2);\n    const tail = Math.floor(keep / 2);\n    const omitted = value.length - head - tail;\n    recordDetail(state, { path, kind: \"array\", omittedEntries: omitted });\n    return [\n      ...Array.from({ length: head }, (_, index) =>\n        previewArrayEntry(value, index, state, path, depth),\n      ),\n      { omittedEntries: omitted, preview: \"[middle array entries omitted]\" },\n      ...Array.from({ length: tail }, (_, index) =>\n        previewArrayEntry(value, value.length - tail + index, state, path, depth),\n      ),\n    ];\n  }\n\n  if (value instanceof Date) {\n    if (!hasCanonicalDateSerialization(value)) {\n      state.changed = true;\n      recordDetail(state, { path, kind: \"unserializable\" });\n      return \"[Date value with custom serialization omitted at audit boundary]\";\n    }\n    try {\n      const epoch = Date.prototype.getTime.call(value);\n      return Number.isFinite(epoch) ? Date.prototype.toISOString.call(value) : null;\n    } catch {\n      state.changed = true;\n      recordDetail(state, { path, kind: \"unserializable\" });\n      return \"[Date value omitted at audit serialization boundary]\";\n    }\n  }\n\n  const record = value as Record<string, unknown>;\n  const { entries, omitted, accessorKeys } = selectObjectEntries(record, state.objectFields);\n  for (const key of accessorKeys) {\n    state.changed = true;\n    recordDetail(state, {\n      path: `${path}.${key}`,\n      kind: \"unserializable\",\n    });\n  }\n  if (omitted) {\n    state.changed = true;\n    recordDetail(state, {\n      path,\n      kind: \"object\",\n      // Counting every remaining field would defeat the traversal bound. `null`\n      // is deliberate: at least one field was omitted, but its exact count is\n      // unknown because the source was not fully enumerated.\n      omittedEntries: null,\n    });\n  }\n  const out: Record<string, unknown> = {};\n  for (const [key, entry] of entries) {\n    out[key] = previewValue(entry, state, `${path}.${key}`, depth + 1);\n  }\n  if (omitted) {\n    out.omittedFields = \"additional fields omitted; exact count not measured\";\n  }\n  return out;\n}\n\nfunction previewArrayEntry(\n  value: unknown[],\n  index: number,\n  state: PreviewState,\n  path: string,\n  depth: number,\n): unknown {\n  let descriptor: PropertyDescriptor | undefined;\n  try {\n    descriptor = Object.getOwnPropertyDescriptor(value, String(index));\n  } catch {\n    state.changed = true;\n    recordDetail(state, { path: `${path}[${index}]`, kind: \"unserializable\" });\n    return \"[array element omitted at audit serialization boundary]\";\n  }\n  if (descriptor && !(\"value\" in descriptor)) {\n    state.changed = true;\n    recordDetail(state, { path: `${path}[${index}]`, kind: \"unserializable\" });\n    return \"[array accessor value omitted at audit serialization boundary]\";\n  }\n  return previewValue(\n    descriptor && \"value\" in descriptor ? descriptor.value : undefined,\n    state,\n    `${path}[${index}]`,\n    depth + 1,\n  );\n}\n\nfunction selectObjectEntries(\n  record: Record<string, unknown>,\n  maxFields: number,\n): {\n  entries: Array<[string, unknown]>;\n  omitted: boolean;\n  accessorKeys: string[];\n} {\n  const entries: Array<[string, unknown]> = [];\n  const selected = new Set<string>();\n  const accessorKeys: string[] = [];\n  const select = (key: string): boolean => {\n    const descriptor = Object.getOwnPropertyDescriptor(record, key);\n    if (!descriptor?.enumerable) return false;\n    selected.add(key);\n    if (\"value\" in descriptor) {\n      entries.push([key, descriptor.value]);\n    } else {\n      entries.push([key, \"[accessor value omitted at audit serialization boundary]\"]);\n      accessorKeys.push(key);\n    }\n    return true;\n  };\n  try {\n    for (const key of IDENTITY_FIELDS) {\n      if (entries.length >= maxFields) break;\n      select(key);\n    }\n    for (const key in record) {\n      if (!Object.prototype.hasOwnProperty.call(record, key) || selected.has(key)) continue;\n      if (entries.length >= maxFields) {\n        return { entries, omitted: true, accessorKeys };\n      }\n      select(key);\n    }\n  } catch {\n    return { entries, omitted: true, accessorKeys };\n  }\n  return { entries, omitted: false, accessorKeys };\n}\n\nfunction attachTruncation(\n  preview: unknown,\n  truncation: SessionEventPayloadTruncation,\n): Record<string, unknown> {\n  if (isPlainRecord(preview)) {\n    // `truncation` is reserved boundary metadata. A producer-supplied value is\n    // intentionally replaced when the boundary actually omits content.\n    return { ...preview, truncation };\n  }\n  return { value: preview, truncation };\n}\n\nfunction boundaryMetadata(\n  surface: SessionEventBoundarySurface,\n  reason: SessionEventPayloadTruncation[\"reason\"],\n  originalBytes: number | null,\n  state: PreviewState,\n  fullEvidence: RetainedOutputEvidence,\n): SessionEventPayloadTruncation {\n  return {\n    truncated: true,\n    surface,\n    reason,\n    originalBytes,\n    deliveredBytes: 0,\n    omittedBytes: originalBytes,\n    estimatedOriginalTokens:\n      originalBytes === null ? null : approximateSessionEventTokens(originalBytes),\n    estimatedDeliveredTokens: 0,\n    fullEvidence,\n    details: state.details,\n  };\n}\n\nfunction settleDeliveredSizes(payload: Record<string, unknown>, maxBytes: number): void {\n  const truncation = payload.truncation as SessionEventPayloadTruncation;\n  convergeDeliveredSizes(payload, truncation);\n  // This should only be reachable when a caller supplies an unusually tiny\n  // custom maxBytes. Preserve explicit metadata over an accidental overshoot.\n  if (sessionEventJsonBytes(payload) > maxBytes) {\n    payload.preview = \"[event payload omitted at audit byte boundary]\";\n    for (const key of Object.keys(payload)) {\n      if (key !== \"preview\" && key !== \"truncation\" && IDENTITY_FIELDS.has(key) === false) {\n        delete payload[key];\n      }\n    }\n    truncation.details = truncation.details.slice(0, 4);\n    convergeDeliveredSizes(payload, truncation);\n  }\n}\n\nfunction convergeDeliveredSizes(\n  payload: Record<string, unknown>,\n  truncation: SessionEventPayloadTruncation,\n): void {\n  for (let attempt = 0; attempt < 16; attempt += 1) {\n    const deliveredBytes = sessionEventJsonBytes(payload);\n    const omittedBytes =\n      truncation.originalBytes === null\n        ? null\n        : Math.max(0, truncation.originalBytes - deliveredBytes);\n    const estimatedDeliveredTokens = approximateSessionEventTokens(deliveredBytes);\n    if (\n      truncation.deliveredBytes === deliveredBytes &&\n      truncation.omittedBytes === omittedBytes &&\n      truncation.estimatedDeliveredTokens === estimatedDeliveredTokens\n    ) {\n      return;\n    }\n    truncation.deliveredBytes = deliveredBytes;\n    truncation.omittedBytes = omittedBytes;\n    truncation.estimatedDeliveredTokens = estimatedDeliveredTokens;\n  }\n  throw new RangeError(\"Session event byte accounting did not converge\");\n}\n\nfunction recordDetail(\n  state: PreviewState,\n  detail: SessionEventPayloadTruncation[\"details\"][number],\n): void {\n  if (state.details.length < MAX_DETAIL_RECORDS) state.details.push(detail);\n}\n\nfunction identityPreview(value: unknown): Record<string, unknown> {\n  if (!isPlainRecord(value)) return {};\n  const out: Record<string, unknown> = {};\n  for (const key of IDENTITY_FIELDS) {\n    let field: unknown;\n    try {\n      const descriptor = Object.getOwnPropertyDescriptor(value, key);\n      if (!descriptor?.enumerable || !(\"value\" in descriptor)) continue;\n      field = descriptor.value;\n    } catch {\n      continue;\n    }\n    if (typeof field === \"string\") {\n      out[key] = truncateUtf8Middle(field, 256, utf8Bytes(field));\n    } else if (typeof field === \"number\" || typeof field === \"boolean\" || field === null) {\n      out[key] = field;\n    }\n  }\n  return out;\n}\n\nfunction inlineMediaFact(value: string): SessionEventMediaPreview | null {\n  return sessionEventMediaPreviewFromDataUrl(value);\n}\n\nfunction binaryFact(value: object): {\n  originalBytes: number;\n  preview: {\n    type: \"binary_preview\";\n    byteLength: number;\n    fullOutputAvailable: false;\n    preview: string;\n  };\n} | null {\n  if (ArrayBuffer.isView(value)) {\n    return {\n      originalBytes: value.byteLength,\n      preview: {\n        type: \"binary_preview\",\n        byteLength: value.byteLength,\n        fullOutputAvailable: false,\n        preview: \"Inline binary value omitted from the audit timeline; bytes were not retained.\",\n      },\n    };\n  }\n  if (value instanceof ArrayBuffer) {\n    return {\n      originalBytes: value.byteLength,\n      preview: {\n        type: \"binary_preview\",\n        byteLength: value.byteLength,\n        fullOutputAvailable: false,\n        preview: \"Inline binary value omitted from the audit timeline; bytes were not retained.\",\n      },\n    };\n  }\n  return null;\n}\n\nfunction truncateUtf8Middle(\n  value: string,\n  maxBytes: number,\n  knownBytes = utf8Bytes(value),\n): string {\n  if (knownBytes <= maxBytes) return value;\n  let omittedBytes = Math.max(0, knownBytes - maxBytes);\n  for (let attempt = 0; attempt < 4; attempt += 1) {\n    const marker = `…[${omittedBytes} bytes omitted]…`;\n    const contentBudget = Math.max(0, maxBytes - utf8Bytes(marker));\n    if (contentBudget === 0) return marker;\n    const left = utf8Prefix(value, Math.floor(contentBudget / 2));\n    const right = utf8Suffix(value, contentBudget - left.bytes);\n    const exactOmittedBytes = Math.max(0, knownBytes - left.bytes - right.bytes);\n    if (exactOmittedBytes === omittedBytes) {\n      return `${value.slice(0, left.end)}${marker}${value.slice(right.start)}`;\n    }\n    omittedBytes = exactOmittedBytes;\n  }\n\n  const marker = `…[${omittedBytes} bytes omitted]…`;\n  const contentBudget = Math.max(0, maxBytes - utf8Bytes(marker));\n  const left = utf8Prefix(value, Math.floor(contentBudget / 2));\n  const right = utf8Suffix(value, contentBudget - left.bytes);\n  return `${value.slice(0, left.end)}${marker}${value.slice(right.start)}`;\n}\n\nfunction utf8Prefix(value: string, maxBytes: number): { end: number; bytes: number } {\n  let end = 0;\n  let bytes = 0;\n  while (end < value.length) {\n    const unit = utf8UnitAt(value, end);\n    if (bytes + unit.bytes > maxBytes) break;\n    bytes += unit.bytes;\n    end += unit.codeUnits;\n  }\n  return { end, bytes };\n}\n\nfunction utf8Suffix(value: string, maxBytes: number): { start: number; bytes: number } {\n  let start = value.length;\n  let bytes = 0;\n  while (start > 0) {\n    const unit = utf8UnitBefore(value, start);\n    if (bytes + unit.bytes > maxBytes) break;\n    bytes += unit.bytes;\n    start -= unit.codeUnits;\n  }\n  return { start, bytes };\n}\n\nfunction utf8UnitAt(value: string, index: number): { codeUnits: number; bytes: number } {\n  const code = value.charCodeAt(index);\n  if (code <= 0x7f) return { codeUnits: 1, bytes: 1 };\n  if (code <= 0x7ff) return { codeUnits: 1, bytes: 2 };\n  if (code >= 0xd800 && code <= 0xdbff) {\n    const next = index + 1 < value.length ? value.charCodeAt(index + 1) : 0;\n    if (next >= 0xdc00 && next <= 0xdfff) {\n      return { codeUnits: 2, bytes: 4 };\n    }\n  }\n  return { codeUnits: 1, bytes: 3 };\n}\n\nfunction utf8UnitBefore(value: string, end: number): { codeUnits: number; bytes: number } {\n  const code = value.charCodeAt(end - 1);\n  if (code >= 0xdc00 && code <= 0xdfff && end >= 2) {\n    const previous = value.charCodeAt(end - 2);\n    if (previous >= 0xd800 && previous <= 0xdbff) {\n      return { codeUnits: 2, bytes: 4 };\n    }\n  }\n  if (code <= 0x7f) return { codeUnits: 1, bytes: 1 };\n  if (code <= 0x7ff) return { codeUnits: 1, bytes: 2 };\n  return { codeUnits: 1, bytes: 3 };\n}\n\nfunction utf8Bytes(value: string): number {\n  let bytes = 0;\n  for (let index = 0; index < value.length;) {\n    const unit = utf8UnitAt(value, index);\n    bytes += unit.bytes;\n    index += unit.codeUnits;\n  }\n  return bytes;\n}\n\n/**\n * Count the JSON wire bytes without first allocating the complete JSON string.\n * A global node budget prevents an adversarial broad graph from moving the\n * durable 64 KiB bound into an unbounded measurement pass. `null` means exact\n * source size is unknown; callers expose that truth instead of measuring a\n * placeholder or claiming a lower bound is exact.\n */\ntype JsonMeasurement = SessionEventJsonMeasurement;\n\nfunction measureJsonBytes(value: unknown): JsonMeasurement {\n  const state: JsonMeasurementState = {\n    remainingNodes: MAX_MEASUREMENT_NODES,\n    seen: new WeakSet<object>(),\n    failureReason: null,\n  };\n  try {\n    const bytes = measureJsonValue(value, state, \"top\", 0);\n    return bytes === null\n      ? {\n          bytes: null,\n          reason: state.failureReason ?? \"payload_measurement_bounded\",\n        }\n      : { bytes, reason: null };\n  } catch {\n    return { bytes: null, reason: \"payload_measurement_bounded\" };\n  }\n}\n\ntype JsonMeasurementState = {\n  remainingNodes: number;\n  seen: WeakSet<object>;\n  failureReason: \"payload_not_serializable\" | \"payload_measurement_bounded\" | null;\n};\n\nfunction measureJsonValue(\n  value: unknown,\n  state: JsonMeasurementState,\n  position: \"top\" | \"array\" | \"object\",\n  depth: number,\n): number | null {\n  if (state.remainingNodes <= 0 || depth > MAX_MEASUREMENT_DEPTH) {\n    return failJsonMeasurement(state, \"payload_measurement_bounded\");\n  }\n  state.remainingNodes -= 1;\n  if (value === null) return 4;\n  if (typeof value === \"string\") return jsonStringBytes(value);\n  if (typeof value === \"boolean\") return value ? 4 : 5;\n  if (typeof value === \"number\") {\n    const serialized = JSON.stringify(value);\n    return serialized === undefined ? null : serialized.length;\n  }\n  if (typeof value === \"undefined\" || typeof value === \"function\" || typeof value === \"symbol\") {\n    return position === \"array\" ? 4 : failJsonMeasurement(state, \"payload_not_serializable\");\n  }\n  if (typeof value === \"bigint\") {\n    return failJsonMeasurement(state, \"payload_not_serializable\");\n  }\n  if (typeof value !== \"object\") {\n    return failJsonMeasurement(state, \"payload_not_serializable\");\n  }\n  if (value instanceof Date) {\n    if (!hasCanonicalDateSerialization(value)) {\n      return failJsonMeasurement(state, \"payload_measurement_bounded\");\n    }\n    try {\n      const epoch = Date.prototype.getTime.call(value);\n      return Number.isFinite(epoch) ? jsonStringBytes(Date.prototype.toISOString.call(value)) : 4;\n    } catch {\n      return failJsonMeasurement(state, \"payload_not_serializable\");\n    }\n  }\n  if (ArrayBuffer.isView(value) || value instanceof ArrayBuffer) {\n    return failJsonMeasurement(state, \"payload_measurement_bounded\");\n  }\n  if (state.seen.has(value)) {\n    return failJsonMeasurement(state, \"payload_not_serializable\");\n  }\n  state.seen.add(value);\n  try {\n    if (Array.isArray(value)) {\n      if (Object.getPrototypeOf(value) !== Array.prototype) {\n        return failJsonMeasurement(state, \"payload_measurement_bounded\");\n      }\n      const toJson = Object.getOwnPropertyDescriptor(value, \"toJSON\");\n      if (toJson && (\"get\" in toJson || typeof toJson.value === \"function\")) {\n        return failJsonMeasurement(state, \"payload_measurement_bounded\");\n      }\n      if (value.length > state.remainingNodes) {\n        return failJsonMeasurement(state, \"payload_measurement_bounded\");\n      }\n      let bytes = 2;\n      for (let index = 0; index < value.length; index += 1) {\n        if (index > 0) bytes += 1;\n        const descriptor = Object.getOwnPropertyDescriptor(value, String(index));\n        if (descriptor && !(\"value\" in descriptor)) {\n          return failJsonMeasurement(state, \"payload_measurement_bounded\");\n        }\n        const entry = descriptor && \"value\" in descriptor ? descriptor.value : undefined;\n        const measured = measureJsonValue(entry, state, \"array\", depth + 1);\n        if (measured === null) return null;\n        bytes += measured;\n      }\n      return bytes;\n    }\n\n    const prototype = Object.getPrototypeOf(value);\n    if (prototype !== Object.prototype && prototype !== null) {\n      return failJsonMeasurement(state, \"payload_measurement_bounded\");\n    }\n    const toJson = Object.getOwnPropertyDescriptor(value, \"toJSON\");\n    if (toJson && (\"get\" in toJson || typeof toJson.value === \"function\")) {\n      return failJsonMeasurement(state, \"payload_measurement_bounded\");\n    }\n    let bytes = 2;\n    let fields = 0;\n    try {\n      for (const key in value as Record<string, unknown>) {\n        if (!Object.prototype.hasOwnProperty.call(value, key)) continue;\n        if (state.remainingNodes <= 0) {\n          return failJsonMeasurement(state, \"payload_measurement_bounded\");\n        }\n        // A property consumes traversal work even when JSON.stringify would\n        // omit its value. Without this decrement a broad object containing\n        // only undefined/functions/symbols bypasses the global node budget.\n        state.remainingNodes -= 1;\n        const descriptor = Object.getOwnPropertyDescriptor(value, key);\n        if (!descriptor || !(\"value\" in descriptor)) {\n          return failJsonMeasurement(state, \"payload_measurement_bounded\");\n        }\n        const entry = descriptor.value;\n        if (\n          typeof entry === \"undefined\" ||\n          typeof entry === \"function\" ||\n          typeof entry === \"symbol\"\n        ) {\n          continue;\n        }\n        const measured = measureJsonValue(entry, state, \"object\", depth + 1);\n        if (measured === null) return null;\n        if (fields > 0) bytes += 1;\n        bytes += jsonStringBytes(key) + 1 + measured;\n        fields += 1;\n      }\n    } catch {\n      return null;\n    }\n    return bytes;\n  } finally {\n    state.seen.delete(value);\n  }\n}\n\nfunction hasCanonicalDateSerialization(value: Date): boolean {\n  try {\n    if (Object.getPrototypeOf(value) !== Date.prototype) return false;\n    // JSON.stringify performs an ordinary property lookup for toJSON. Any own\n    // shadow (data or accessor) changes that behavior and must not be invoked.\n    return Object.getOwnPropertyDescriptor(value, \"toJSON\") === undefined;\n  } catch {\n    return false;\n  }\n}\n\nfunction failJsonMeasurement(\n  state: JsonMeasurementState,\n  reason: Exclude<JsonMeasurement, { bytes: number }>[\"reason\"],\n): null {\n  state.failureReason ??= reason;\n  return null;\n}\n\nfunction jsonStringBytes(value: string): number {\n  let bytes = 2;\n  for (let index = 0; index < value.length; index += 1) {\n    const code = value.charCodeAt(index);\n    if (\n      code === 0x22 ||\n      code === 0x5c ||\n      code === 0x08 ||\n      code === 0x09 ||\n      code === 0x0a ||\n      code === 0x0c ||\n      code === 0x0d\n    ) {\n      bytes += 2;\n    } else if (code <= 0x1f) {\n      bytes += 6;\n    } else if (code <= 0x7f) {\n      bytes += 1;\n    } else if (code <= 0x7ff) {\n      bytes += 2;\n    } else if (code >= 0xd800 && code <= 0xdbff) {\n      const next = index + 1 < value.length ? value.charCodeAt(index + 1) : 0;\n      if (next >= 0xdc00 && next <= 0xdfff) {\n        bytes += 4;\n        index += 1;\n      } else {\n        // JSON.stringify escapes lone surrogates as six ASCII bytes.\n        bytes += 6;\n      }\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      bytes += 6;\n    } else {\n      bytes += 3;\n    }\n  }\n  return bytes;\n}\n\nfunction serializeForBoundary(value: unknown): {\n  value: string;\n  serializable: boolean;\n} {\n  try {\n    const serialized = JSON.stringify(value);\n    return {\n      value: serialized === undefined ? \"null\" : serialized,\n      serializable: serialized !== undefined,\n    };\n  } catch {\n    return {\n      value: JSON.stringify(\"[unserializable event payload omitted]\"),\n      serializable: false,\n    };\n  }\n}\n\nfunction stringifyForBoundary(value: unknown): string {\n  return serializeForBoundary(value).value;\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value && typeof value === \"object\" && !Array.isArray(value));\n}\n","/**\n * Adaptive Codex fleet policy, replay contract, and shadow evaluator.\n *\n * This module is deliberately pure and browser-safe. It accepts only bounded,\n * metadata-only snapshots whose candidate keys are opaque aliases assigned by\n * the caller. It never accepts credential ids, account emails, labels, token\n * material, prompts, or tenant activity. The same normalized snapshot can be\n * persisted in a session event, replayed offline, and compared byte-for-byte.\n *\n * V1 is shadow-only at the runtime integration boundary. The evaluator models\n * later placement, admission, manager priority, borrowing, emergency-fuse, and\n * named-overlay semantics so they can be proven with deterministic simulations\n * before any independent kill switch is allowed to affect a live allocation.\n */\n\nimport { sha256 } from \"@noble/hashes/sha256\";\nimport { bytesToHex } from \"@noble/hashes/utils\";\n\nexport const CODEX_FLEET_POLICY_SCHEMA_VERSION = 1 as const;\nexport const CODEX_FLEET_POLICY_VERSION = \"adaptive-shadow-v1\" as const;\nexport const CODEX_FLEET_POLICY_MAX_CANDIDATES = 32;\nexport const CODEX_FLEET_POLICY_MAX_OVERLAYS_PER_CANDIDATE = 4;\n\nconst MAX_DURATION_MS = 31 * 24 * 60 * 60_000;\nconst MAX_COUNT = 1_000_000;\nconst SCORE_SCALE = 100;\n\n/**\n * Replay-integrity ordering for bounded ASCII-safe fleet keys and aliases.\n *\n * Locale-aware collation is intentionally forbidden here because its result\n * can depend on locale and ICU data. Relational string comparison uses\n * ECMAScript UTF-16 code-unit ordering and is therefore identical in Bun,\n * Node, and browsers.\n */\nexport function compareCodexFleetCanonicalStringsV1(left: string, right: string): number {\n  return left < right ? -1 : left > right ? 1 : 0;\n}\n\nexport type CodexFleetConfidence = \"unknown\" | \"low\" | \"medium\" | \"high\";\nexport type CodexFleetCandidateStatus = \"active\" | \"needs_relogin\" | \"error\" | \"unknown\";\nexport type CodexFleetCacheState = \"unknown\" | \"healthy\" | \"collapsed\";\nexport type CodexFleetPriority = \"standard\" | \"manager\";\nexport type CodexFleetPlacementKind = \"new\" | \"fenced_in_flight\";\nexport type CodexFleetOverlayMode = \"none\" | \"prefer\" | \"isolate\";\n\nexport type CodexFleetQuotaWindowV1 = {\n  /** Provider-reported percentage from a workspace-local cache, never inferred tenant truth. */\n  usedPercent: number | null;\n  /** Relative to input.observedAtMs. Zero means the reported window has reset. */\n  resetRemainingMs: number | null;\n};\n\nexport type CodexFleetCandidateV1 = {\n  /** Opaque, event-local alias such as c00. Never a credential/account id. */\n  key: string;\n  status: CodexFleetCandidateStatus;\n  allocatorEnabled: boolean;\n  /** Relative cooldown. A positive value excludes only NEW placements. */\n  cooldownRemainingMs: number | null;\n  activeLeaseCount: number;\n  quota: {\n    primary: CodexFleetQuotaWindowV1;\n    secondary: CodexFleetQuotaWindowV1;\n    checkedAgeMs: number | null;\n    confidence: CodexFleetConfidence;\n  };\n  /**\n   * Runtime-observed cache evidence. It may be absent because the production\n   * baseline currently exists as aggregate metrics/logs rather than allocator\n   * state. Absence is explicit uncertainty, not a zero cache hit.\n   */\n  cache: {\n    hitRatio: number | null;\n    sampledTokens: number | null;\n    checkedAgeMs: number | null;\n    confidence: CodexFleetConfidence;\n    /** Previously latched state; the evaluator applies dwell and recovery thresholds. */\n    state: CodexFleetCacheState;\n    /** Duration of the current continuous below/above-threshold observation. */\n    thresholdObservedForMs: number | null;\n  };\n  /** Workspace-local observed burn, separate from unexplained/external inference. */\n  observedBurn: {\n    primaryPercentPerHour: number | null;\n    secondaryPercentPerHour: number | null;\n    confidence: CodexFleetConfidence;\n  };\n  /**\n   * Unexplained/external burn is an inference only. The name and confidence are\n   * load-bearing: consumers must never relabel it as provider or tenant truth.\n   */\n  inferredUnexplainedBurn: {\n    primaryPercentPerHour: number | null;\n    secondaryPercentPerHour: number | null;\n    confidence: CodexFleetConfidence;\n  };\n  /** Opaque named-policy keys. Ignored unless overlaysEnabled is independently true. */\n  overlayKeys: string[];\n};\n\nexport type CodexFleetAdmissionSnapshotV1 = {\n  /** Dynamically observed capacity, not a static per-account slot allocation. */\n  dynamicCapacityUnits: number | null;\n  inUseUnits: number;\n  queuedManagerCount: number;\n  emergencyFuseActive: boolean;\n};\n\nexport type CodexFleetDecisionInputV1 = {\n  observedAtMs: number;\n  request: {\n    placement: CodexFleetPlacementKind;\n    priority: CodexFleetPriority;\n    currentCandidateKey: string | null;\n    waitAgeMs: number;\n    overlayKey: string | null;\n    overlayMode: CodexFleetOverlayMode;\n  };\n  admission: CodexFleetAdmissionSnapshotV1;\n  candidates: CodexFleetCandidateV1[];\n};\n\nexport type CodexFleetPolicyConfigV1 = {\n  maxCandidates: number;\n  quotaFreshForMs: number;\n  quotaStaleAfterMs: number;\n  placementUsageCeilingPercent: number;\n  cacheFreshForMs: number;\n  cacheCollapseThreshold: number;\n  cacheCollapseRecoveryThreshold: number;\n  cacheMinimumSampledTokens: number;\n  cacheCollapseDwellMs: number;\n  cacheRecoveryDwellMs: number;\n  activeLeaseScore: number;\n  unknownQuotaScore: number;\n  lowQuotaConfidenceScore: number;\n  mediumQuotaConfidenceScore: number;\n  inferredBurnScorePerPercentHour: number;\n  observedBurnScorePerPercentHour: number;\n  /** Maximum exhaustion-before-reset gap that contributes placement pressure. */\n  runwayRiskCapHours: number;\n  runwayScorePerAtRiskHour: number;\n  healthyCacheAffinityBenefit: number;\n  unknownCacheAffinityBenefit: number;\n  collapsedCacheAffinityBenefit: number;\n  switchHysteresisScore: number;\n  admissionPacingEnabled: boolean;\n  managerPriorityEnabled: boolean;\n  managerStandardStarvationMs: number;\n  emergencyFuseEnabled: boolean;\n  overlaysEnabled: boolean;\n  overlayPreferenceScore: number;\n};\n\n/**\n * Experimental shadow defaults. None of the boolean control fields is enabled;\n * production behavior therefore remains sticky-sharded until operators enable\n * each independently after shadow acceptance.\n */\nexport const DEFAULT_CODEX_FLEET_POLICY_V1: CodexFleetPolicyConfigV1 = Object.freeze({\n  maxCandidates: CODEX_FLEET_POLICY_MAX_CANDIDATES,\n  quotaFreshForMs: 15 * 60_000,\n  quotaStaleAfterMs: 60 * 60_000,\n  placementUsageCeilingPercent: 90,\n  cacheFreshForMs: 30 * 60_000,\n  cacheCollapseThreshold: 0.4,\n  cacheCollapseRecoveryThreshold: 0.65,\n  cacheMinimumSampledTokens: 4_096,\n  cacheCollapseDwellMs: 5 * 60_000,\n  cacheRecoveryDwellMs: 10 * 60_000,\n  activeLeaseScore: 8 * SCORE_SCALE,\n  unknownQuotaScore: 16 * SCORE_SCALE,\n  lowQuotaConfidenceScore: 10 * SCORE_SCALE,\n  mediumQuotaConfidenceScore: 4 * SCORE_SCALE,\n  inferredBurnScorePerPercentHour: 0.2 * SCORE_SCALE,\n  observedBurnScorePerPercentHour: 0.1 * SCORE_SCALE,\n  runwayRiskCapHours: 2,\n  runwayScorePerAtRiskHour: 8 * SCORE_SCALE,\n  healthyCacheAffinityBenefit: 32 * SCORE_SCALE,\n  unknownCacheAffinityBenefit: 24 * SCORE_SCALE,\n  collapsedCacheAffinityBenefit: 6 * SCORE_SCALE,\n  switchHysteresisScore: 8 * SCORE_SCALE,\n  admissionPacingEnabled: false,\n  managerPriorityEnabled: false,\n  managerStandardStarvationMs: 2 * 60_000,\n  emergencyFuseEnabled: false,\n  overlaysEnabled: false,\n  overlayPreferenceScore: 12 * SCORE_SCALE,\n});\n\nexport type CodexFleetScoreV1 = {\n  candidateKey: string;\n  eligible: boolean;\n  rejectionReason:\n    | \"allocator_disabled\"\n    | \"unavailable\"\n    | \"cooling\"\n    | \"quota_ceiling\"\n    | \"overlay_isolation\"\n    | null;\n  quotaPressure: number;\n  leasePressure: number;\n  observedBurnPressure: number;\n  inferredBurnPressure: number;\n  runwayPressure: number;\n  uncertaintyPressure: number;\n  cacheAffinityBenefit: number;\n  cacheState: CodexFleetCacheState;\n  overlayPreferenceBenefit: number;\n  total: number;\n  confidence: CodexFleetConfidence;\n};\n\nexport type CodexFleetAdmissionDecisionV1 = {\n  outcome: \"admit\" | \"pace\";\n  reason:\n    | \"fenced_in_flight\"\n    | \"pacing_disabled\"\n    | \"capacity_unknown\"\n    | \"capacity_available\"\n    | \"work_conserving_borrow\"\n    | \"manager_priority\"\n    | \"standard_starvation_bound\"\n    | \"capacity_saturated\"\n    | \"emergency_fuse\";\n  /** True only when standard work uses otherwise-idle capacity with no manager backlog. */\n  borrowedIdleCapacity: boolean;\n};\n\nexport type CodexFleetDecisionV1 = {\n  outcome: \"selected\" | \"paced\" | \"none\";\n  selectedCandidateKey: string | null;\n  reason:\n    | \"fenced_in_flight\"\n    | \"fenced_candidate_missing\"\n    | \"admission_paced\"\n    | \"no_eligible_candidate\"\n    | \"overlay_isolated_empty\"\n    | \"best_score\"\n    | \"affinity_best\"\n    | \"hysteresis_hold\";\n  admission: CodexFleetAdmissionDecisionV1;\n  borrowedOverlayCapacity: boolean;\n  strandedEligibleCount: number;\n  confidence: CodexFleetConfidence;\n  scores: CodexFleetScoreV1[];\n};\n\nexport type CodexFleetReplayRecordV1 = {\n  schemaVersion: typeof CODEX_FLEET_POLICY_SCHEMA_VERSION;\n  policyVersion: typeof CODEX_FLEET_POLICY_VERSION;\n  mode: \"shadow\";\n  policy: CodexFleetPolicyConfigV1;\n  input: CodexFleetDecisionInputV1;\n  truncatedCandidateCount: number;\n  policyFingerprint: string;\n  inputFingerprint: string;\n  decision: CodexFleetDecisionV1;\n  decisionFingerprint: string;\n};\n\nexport type CodexFleetReplayVerdictV1 = {\n  matches: boolean;\n  policyFingerprintMatches: boolean;\n  inputFingerprintMatches: boolean;\n  decisionFingerprintMatches: boolean;\n  recordedDecisionFingerprintMatches: boolean;\n  decision: CodexFleetDecisionV1;\n};\n\ntype NormalizedInput = {\n  input: CodexFleetDecisionInputV1;\n  truncatedCandidateCount: number;\n};\n\nexport function createCodexFleetReplayRecordV1(\n  input: CodexFleetDecisionInputV1,\n  policy: CodexFleetPolicyConfigV1 = DEFAULT_CODEX_FLEET_POLICY_V1,\n): CodexFleetReplayRecordV1 {\n  const normalizedPolicy = normalizePolicy(policy);\n  const normalized = normalizeInput(input, normalizedPolicy.maxCandidates);\n  const decision = evaluateCodexFleetDecisionV1(normalized.input, normalizedPolicy);\n  return {\n    schemaVersion: CODEX_FLEET_POLICY_SCHEMA_VERSION,\n    policyVersion: CODEX_FLEET_POLICY_VERSION,\n    mode: \"shadow\",\n    policy: normalizedPolicy,\n    input: normalized.input,\n    truncatedCandidateCount: normalized.truncatedCandidateCount,\n    policyFingerprint: fingerprint(normalizedPolicy),\n    inputFingerprint: fingerprintReplayInput(normalized.input, normalized.truncatedCandidateCount),\n    decision,\n    decisionFingerprint: fingerprint(decision),\n  };\n}\n\nexport function replayCodexFleetDecisionV1(value: unknown): CodexFleetReplayVerdictV1 {\n  const record = readCodexFleetReplayRecordV1(value);\n  const policyFingerprintMatches = fingerprint(record.policy) === record.policyFingerprint;\n  const inputFingerprintMatches =\n    fingerprintReplayInput(record.input, record.truncatedCandidateCount) ===\n    record.inputFingerprint;\n  const decision = evaluateCodexFleetDecisionV1(record.input, record.policy);\n  const replayedDecisionFingerprint = fingerprint(decision);\n  const recordedDecisionFingerprintMatches =\n    fingerprint(record.decision) === record.decisionFingerprint;\n  const decisionFingerprintMatches =\n    recordedDecisionFingerprintMatches &&\n    replayedDecisionFingerprint === record.decisionFingerprint;\n  return {\n    matches:\n      policyFingerprintMatches &&\n      inputFingerprintMatches &&\n      decisionFingerprintMatches &&\n      canonicalJson(decision) === canonicalJson(record.decision),\n    policyFingerprintMatches,\n    inputFingerprintMatches,\n    decisionFingerprintMatches,\n    recordedDecisionFingerprintMatches,\n    decision,\n  };\n}\n\n/**\n * Canonical replay bytes for already-bounded, identity-free fleet values.\n * This is exported so offline tools can prove the exact bytes across runtimes;\n * it performs no redaction and must not be used with raw account metadata.\n */\nexport function canonicalCodexFleetReplayJsonV1(value: CodexFleetReplayRecordV1): string {\n  return canonicalJson(value);\n}\n\n/**\n * Strict reader for durable/offline replay. Unknown fields, lossy normalization,\n * malformed decisions, and non-SHA-256 digests are rejected before comparison.\n */\nexport function readCodexFleetReplayRecordV1(value: unknown): CodexFleetReplayRecordV1 {\n  const record = strictRecord(value, [\n    \"schemaVersion\",\n    \"policyVersion\",\n    \"mode\",\n    \"policy\",\n    \"input\",\n    \"truncatedCandidateCount\",\n    \"policyFingerprint\",\n    \"inputFingerprint\",\n    \"decision\",\n    \"decisionFingerprint\",\n  ]);\n  if (\n    record.schemaVersion !== CODEX_FLEET_POLICY_SCHEMA_VERSION ||\n    record.policyVersion !== CODEX_FLEET_POLICY_VERSION ||\n    record.mode !== \"shadow\"\n  ) {\n    throw new Error(\"Unsupported Codex fleet replay envelope\");\n  }\n\n  const policy = normalizePolicy(record.policy as CodexFleetPolicyConfigV1);\n  if (canonicalJson(policy) !== canonicalJson(record.policy)) {\n    throw new Error(\"Codex fleet replay policy is not in canonical bounded form\");\n  }\n  const normalizedInput = normalizeInput(\n    record.input as CodexFleetDecisionInputV1,\n    policy.maxCandidates,\n  );\n  if (\n    normalizedInput.truncatedCandidateCount !== 0 ||\n    canonicalJson(normalizedInput.input) !== canonicalJson(record.input)\n  ) {\n    throw new Error(\"Codex fleet replay input is not in canonical bounded form\");\n  }\n\n  return {\n    schemaVersion: CODEX_FLEET_POLICY_SCHEMA_VERSION,\n    policyVersion: CODEX_FLEET_POLICY_VERSION,\n    mode: \"shadow\",\n    policy,\n    input: normalizedInput.input,\n    truncatedCandidateCount: strictInteger(record.truncatedCandidateCount, 0, MAX_COUNT),\n    policyFingerprint: strictSha256(record.policyFingerprint),\n    inputFingerprint: strictSha256(record.inputFingerprint),\n    decision: readCodexFleetDecisionV1(\n      record.decision,\n      new Set(normalizedInput.input.candidates.map((candidate) => candidate.key)),\n    ),\n    decisionFingerprint: strictSha256(record.decisionFingerprint),\n  };\n}\n\nexport function evaluateCodexFleetDecisionV1(\n  input: CodexFleetDecisionInputV1,\n  policy: CodexFleetPolicyConfigV1 = DEFAULT_CODEX_FLEET_POLICY_V1,\n): CodexFleetDecisionV1 {\n  const admission = evaluateAdmission(input, policy);\n  const current = input.request.currentCandidateKey\n    ? input.candidates.find((candidate) => candidate.key === input.request.currentCandidateKey)\n    : undefined;\n\n  // A fenced turn is immutable under every overlay, pacing rule, manager class,\n  // or emergency fuse. If its candidate vanished, fail closed instead of moving.\n  if (input.request.placement === \"fenced_in_flight\") {\n    if (!current) {\n      return emptyDecision(\"fenced_candidate_missing\", admission, \"unknown\");\n    }\n    return {\n      outcome: \"selected\",\n      selectedCandidateKey: current.key,\n      reason: \"fenced_in_flight\",\n      admission,\n      borrowedOverlayCapacity: false,\n      strandedEligibleCount: 0,\n      confidence: candidateConfidence(current, policy),\n      scores: [scoreCandidate(current, input, policy, false)],\n    };\n  }\n\n  if (admission.outcome === \"pace\") {\n    return emptyDecision(\"admission_paced\", admission, \"unknown\");\n  }\n\n  const scored = input.candidates.map((candidate) =>\n    scoreCandidate(candidate, input, policy, false),\n  );\n  const baseEligibleKeys = new Set(\n    scored.filter((candidate) => candidate.eligible).map((candidate) => candidate.candidateKey),\n  );\n  const overlay = selectOverlayScope(input, policy, baseEligibleKeys);\n  const scopedScores = input.candidates\n    .map((candidate) =>\n      scoreCandidate(\n        candidate,\n        input,\n        policy,\n        overlay.rejectedByIsolation.has(candidate.key),\n        overlay.preferredMembers.has(candidate.key),\n      ),\n    )\n    .sort((a, b) => compareCodexFleetCanonicalStringsV1(a.candidateKey, b.candidateKey));\n  const eligible = scopedScores\n    .filter((candidate) => candidate.eligible)\n    .sort(\n      (a, b) =>\n        a.total - b.total || compareCodexFleetCanonicalStringsV1(a.candidateKey, b.candidateKey),\n    );\n\n  if (eligible.length === 0) {\n    return {\n      ...emptyDecision(\n        overlay.isolatedEmpty ? \"overlay_isolated_empty\" : \"no_eligible_candidate\",\n        admission,\n        aggregateConfidence(scopedScores),\n      ),\n      strandedEligibleCount: overlay.strandedEligibleCount,\n      scores: scopedScores,\n    };\n  }\n\n  let selected = eligible[0]!;\n  let reason: CodexFleetDecisionV1[\"reason\"] = \"best_score\";\n  const currentScore = input.request.currentCandidateKey\n    ? eligible.find((candidate) => candidate.candidateKey === input.request.currentCandidateKey)\n    : undefined;\n  if (currentScore) {\n    if (selected.candidateKey === currentScore.candidateKey) {\n      reason = \"affinity_best\";\n    } else if (selected.total + policy.switchHysteresisScore >= currentScore.total) {\n      selected = currentScore;\n      reason = \"hysteresis_hold\";\n    }\n  }\n\n  return {\n    outcome: \"selected\",\n    selectedCandidateKey: selected.candidateKey,\n    reason,\n    admission,\n    borrowedOverlayCapacity:\n      policy.overlaysEnabled &&\n      input.request.overlayMode === \"prefer\" &&\n      input.request.overlayKey !== null &&\n      !overlay.preferredMembers.has(selected.candidateKey),\n    strandedEligibleCount: overlay.strandedEligibleCount,\n    confidence: aggregateConfidence(eligible),\n    scores: scopedScores,\n  };\n}\n\nfunction evaluateAdmission(\n  input: CodexFleetDecisionInputV1,\n  policy: CodexFleetPolicyConfigV1,\n): CodexFleetAdmissionDecisionV1 {\n  if (input.request.placement === \"fenced_in_flight\") {\n    return {\n      outcome: \"admit\",\n      reason: \"fenced_in_flight\",\n      borrowedIdleCapacity: false,\n    };\n  }\n  if (policy.emergencyFuseEnabled && input.admission.emergencyFuseActive) {\n    return {\n      outcome: \"pace\",\n      reason: \"emergency_fuse\",\n      borrowedIdleCapacity: false,\n    };\n  }\n  if (!policy.admissionPacingEnabled) {\n    return {\n      outcome: \"admit\",\n      reason: \"pacing_disabled\",\n      borrowedIdleCapacity: false,\n    };\n  }\n  if (input.admission.dynamicCapacityUnits === null) {\n    // Observability-first fail-open: unknown soft capacity never invents a hard slot.\n    return {\n      outcome: \"admit\",\n      reason: \"capacity_unknown\",\n      borrowedIdleCapacity: false,\n    };\n  }\n  const available = Math.max(0, input.admission.dynamicCapacityUnits - input.admission.inUseUnits);\n  if (available === 0) {\n    return {\n      outcome: \"pace\",\n      reason: \"capacity_saturated\",\n      borrowedIdleCapacity: false,\n    };\n  }\n  if (\n    policy.managerPriorityEnabled &&\n    input.request.priority === \"standard\" &&\n    input.admission.queuedManagerCount > 0 &&\n    available <= input.admission.queuedManagerCount\n  ) {\n    if (input.request.waitAgeMs >= policy.managerStandardStarvationMs) {\n      return {\n        outcome: \"admit\",\n        reason: \"standard_starvation_bound\",\n        borrowedIdleCapacity: false,\n      };\n    }\n    return {\n      outcome: \"pace\",\n      reason: \"manager_priority\",\n      borrowedIdleCapacity: false,\n    };\n  }\n  if (input.request.priority === \"standard\" && input.admission.queuedManagerCount === 0) {\n    return {\n      outcome: \"admit\",\n      reason: \"work_conserving_borrow\",\n      borrowedIdleCapacity: true,\n    };\n  }\n  return {\n    outcome: \"admit\",\n    reason: \"capacity_available\",\n    borrowedIdleCapacity: false,\n  };\n}\n\nfunction scoreCandidate(\n  candidate: CodexFleetCandidateV1,\n  input: CodexFleetDecisionInputV1,\n  policy: CodexFleetPolicyConfigV1,\n  rejectedByIsolation: boolean,\n  preferredOverlayMember = false,\n): CodexFleetScoreV1 {\n  const confidence = candidateConfidence(candidate, policy);\n  const bindingUsed = bindingUsedPercent(candidate);\n  const hardQuotaKnown = confidence === \"high\" || confidence === \"medium\";\n  const rejectionReason: CodexFleetScoreV1[\"rejectionReason\"] = !candidate.allocatorEnabled\n    ? \"allocator_disabled\"\n    : candidate.status !== \"active\"\n      ? \"unavailable\"\n      : (candidate.cooldownRemainingMs ?? 0) > 0\n        ? \"cooling\"\n        : hardQuotaKnown &&\n            bindingUsed !== null &&\n            bindingUsed >= policy.placementUsageCeilingPercent\n          ? \"quota_ceiling\"\n          : rejectedByIsolation\n            ? \"overlay_isolation\"\n            : null;\n\n  const confidenceFactor = confidenceWeight(confidence);\n  // Missing quota is not treated as pristine 0% or as a hard exclusion. Blend\n  // toward neutral 50% and add an explicit uncertainty component instead.\n  const quotaPressure = Math.round(\n    ((bindingUsed ?? 50) * confidenceFactor + 50 * (1 - confidenceFactor)) * SCORE_SCALE,\n  );\n  const leasePressure = candidate.activeLeaseCount * policy.activeLeaseScore;\n  const observedBurnConfidence = confidenceWeight(candidate.observedBurn.confidence);\n  const observedBurn = maximumWindowBurn(candidate.observedBurn);\n  const observedBurnPressure = Math.round(\n    observedBurn * policy.observedBurnScorePerPercentHour * observedBurnConfidence,\n  );\n  const burnConfidence = confidenceWeight(candidate.inferredUnexplainedBurn.confidence);\n  const inferredBurn = maximumWindowBurn(candidate.inferredUnexplainedBurn);\n  const inferredBurnPressure = Math.round(\n    inferredBurn * policy.inferredBurnScorePerPercentHour * burnConfidence,\n  );\n  const runwayPressure = runwayRiskPressure(candidate, confidence, policy);\n  const uncertaintyPressure = quotaUncertaintyScore(confidence, policy);\n  const cacheState = effectiveCodexFleetCacheStateV1(candidate.cache, policy);\n  const cacheAffinityBenefit =\n    candidate.key === input.request.currentCandidateKey\n      ? cacheAffinityBenefitFor(cacheState, policy)\n      : 0;\n  const overlayPreferenceBenefit = preferredOverlayMember ? policy.overlayPreferenceScore : 0;\n  return {\n    candidateKey: candidate.key,\n    eligible: rejectionReason === null,\n    rejectionReason,\n    quotaPressure,\n    leasePressure,\n    observedBurnPressure,\n    inferredBurnPressure,\n    runwayPressure,\n    uncertaintyPressure,\n    cacheAffinityBenefit,\n    cacheState,\n    overlayPreferenceBenefit,\n    total:\n      quotaPressure +\n      leasePressure +\n      observedBurnPressure +\n      inferredBurnPressure +\n      runwayPressure +\n      uncertaintyPressure -\n      cacheAffinityBenefit -\n      overlayPreferenceBenefit,\n    confidence,\n  };\n}\n\ntype CodexFleetBurnSnapshotV1 = CodexFleetCandidateV1[\"observedBurn\"];\ntype CodexFleetWindowKey = \"primary\" | \"secondary\";\n\nfunction maximumWindowBurn(burn: CodexFleetBurnSnapshotV1): number {\n  return Math.max(burn.primaryPercentPerHour ?? 0, burn.secondaryPercentPerHour ?? 0);\n}\n\nfunction windowBurn(burn: CodexFleetBurnSnapshotV1, window: CodexFleetWindowKey): number {\n  return window === \"primary\"\n    ? (burn.primaryPercentPerHour ?? 0)\n    : (burn.secondaryPercentPerHour ?? 0);\n}\n\n/**\n * Score only a confidence-bounded exhaustion risk that occurs before the\n * corresponding provider reset. Each quota window has its own percentage burn\n * denominator and reset horizon; the highest-risk complete window binds.\n * Missing/stale observations contribute uncertainty elsewhere, never invented\n * burn. A zero reset horizon means that reported window has already reset.\n */\nfunction runwayRiskPressure(\n  candidate: CodexFleetCandidateV1,\n  quotaConfidence: CodexFleetConfidence,\n  policy: CodexFleetPolicyConfigV1,\n): number {\n  if (quotaConfidence === \"unknown\") return 0;\n  const windows: Array<[CodexFleetWindowKey, CodexFleetQuotaWindowV1]> = [\n    [\"primary\", candidate.quota.primary],\n    [\"secondary\", candidate.quota.secondary],\n  ];\n  let maximumPressure = 0;\n  for (const [windowKey, window] of windows) {\n    if (\n      window.usedPercent === null ||\n      window.resetRemainingMs === null ||\n      window.resetRemainingMs === 0\n    ) {\n      continue;\n    }\n    const observedConfidence = confidenceWeight(\n      lowerConfidence(candidate.observedBurn.confidence, quotaConfidence),\n    );\n    const inferredConfidence = confidenceWeight(\n      lowerConfidence(candidate.inferredUnexplainedBurn.confidence, quotaConfidence),\n    );\n    const confidenceBoundedBurn =\n      windowBurn(candidate.observedBurn, windowKey) * observedConfidence +\n      windowBurn(candidate.inferredUnexplainedBurn, windowKey) * inferredConfidence;\n    if (confidenceBoundedBurn <= 0) continue;\n\n    const exhaustionRunwayHours = Math.max(0, 100 - window.usedPercent) / confidenceBoundedBurn;\n    const resetHorizonHours = window.resetRemainingMs / 60 / 60_000;\n    const atRiskHours = Math.min(\n      policy.runwayRiskCapHours,\n      Math.max(0, resetHorizonHours - exhaustionRunwayHours),\n    );\n    maximumPressure = Math.max(\n      maximumPressure,\n      Math.round(atRiskHours * policy.runwayScorePerAtRiskHour),\n    );\n  }\n  return maximumPressure;\n}\n\nfunction selectOverlayScope(\n  input: CodexFleetDecisionInputV1,\n  policy: CodexFleetPolicyConfigV1,\n  baseEligibleKeys: Set<string>,\n): {\n  rejectedByIsolation: Set<string>;\n  preferredMembers: Set<string>;\n  isolatedEmpty: boolean;\n  strandedEligibleCount: number;\n} {\n  if (\n    !policy.overlaysEnabled ||\n    input.request.overlayMode === \"none\" ||\n    input.request.overlayKey === null\n  ) {\n    return {\n      rejectedByIsolation: new Set(),\n      preferredMembers: new Set(),\n      isolatedEmpty: false,\n      strandedEligibleCount: 0,\n    };\n  }\n  const members = new Set(\n    input.candidates\n      .filter(\n        (candidate) =>\n          baseEligibleKeys.has(candidate.key) &&\n          candidate.overlayKeys.includes(input.request.overlayKey!),\n      )\n      .map((candidate) => candidate.key),\n  );\n  if (input.request.overlayMode === \"prefer\") {\n    if (members.size === 0) {\n      return {\n        rejectedByIsolation: new Set(),\n        preferredMembers: members,\n        isolatedEmpty: false,\n        strandedEligibleCount: 0,\n      };\n    }\n    return {\n      // Preference is a bounded score benefit, never a hard partition. Healthy\n      // authorized outsiders remain eligible and borrowable.\n      rejectedByIsolation: new Set(),\n      preferredMembers: members,\n      isolatedEmpty: false,\n      strandedEligibleCount: 0,\n    };\n  }\n  const outside = [...baseEligibleKeys].filter((candidateKey) => !members.has(candidateKey));\n  return {\n    rejectedByIsolation: new Set(outside),\n    preferredMembers: members,\n    isolatedEmpty: members.size === 0,\n    strandedEligibleCount: outside.length,\n  };\n}\n\nfunction candidateConfidence(\n  candidate: CodexFleetCandidateV1,\n  policy: CodexFleetPolicyConfigV1,\n): CodexFleetConfidence {\n  const age = candidate.quota.checkedAgeMs;\n  if (age === null || age > policy.quotaStaleAfterMs) return \"unknown\";\n  const windows = [candidate.quota.primary, candidate.quota.secondary];\n  const completeWindowCount = windows.filter(\n    (window) => window.usedPercent !== null && window.resetRemainingMs !== null,\n  ).length;\n  const hasPartialWindow = windows.some(\n    (window) => (window.usedPercent === null) !== (window.resetRemainingMs === null),\n  );\n  if (completeWindowCount === 0) return \"unknown\";\n  const completenessCeiling: CodexFleetConfidence = hasPartialWindow\n    ? \"low\"\n    : completeWindowCount === windows.length\n      ? \"high\"\n      : \"medium\";\n  const completeConfidence = lowerConfidence(candidate.quota.confidence, completenessCeiling);\n  if (age > policy.quotaFreshForMs) {\n    return lowerConfidence(completeConfidence, \"low\");\n  }\n  return completeConfidence;\n}\n\nexport function effectiveCodexFleetCacheStateV1(\n  cache: CodexFleetCandidateV1[\"cache\"],\n  policy: CodexFleetPolicyConfigV1,\n): CodexFleetCacheState {\n  const { hitRatio, sampledTokens, checkedAgeMs, confidence, state, thresholdObservedForMs } =\n    cache;\n  if (\n    hitRatio === null ||\n    sampledTokens === null ||\n    sampledTokens < policy.cacheMinimumSampledTokens ||\n    checkedAgeMs === null ||\n    checkedAgeMs > policy.cacheFreshForMs ||\n    confidenceWeight(confidence) < confidenceWeight(\"medium\")\n  ) {\n    return \"unknown\";\n  }\n  const observedForMs = thresholdObservedForMs ?? 0;\n  if (state === \"healthy\") {\n    return hitRatio < policy.cacheCollapseThreshold && observedForMs >= policy.cacheCollapseDwellMs\n      ? \"collapsed\"\n      : \"healthy\";\n  }\n  if (state === \"collapsed\") {\n    return hitRatio >= policy.cacheCollapseRecoveryThreshold &&\n      observedForMs >= policy.cacheRecoveryDwellMs\n      ? \"healthy\"\n      : \"collapsed\";\n  }\n  if (hitRatio < policy.cacheCollapseThreshold && observedForMs >= policy.cacheCollapseDwellMs) {\n    return \"collapsed\";\n  }\n  if (\n    hitRatio >= policy.cacheCollapseRecoveryThreshold &&\n    observedForMs >= policy.cacheRecoveryDwellMs\n  ) {\n    return \"healthy\";\n  }\n  return \"unknown\";\n}\n\nfunction cacheAffinityBenefitFor(\n  state: CodexFleetCacheState,\n  policy: CodexFleetPolicyConfigV1,\n): number {\n  if (state === \"healthy\") return policy.healthyCacheAffinityBenefit;\n  if (state === \"collapsed\") return policy.collapsedCacheAffinityBenefit;\n  return policy.unknownCacheAffinityBenefit;\n}\n\nfunction bindingUsedPercent(candidate: CodexFleetCandidateV1): number | null {\n  const windows = [candidate.quota.primary, candidate.quota.secondary]\n    .filter((window) => window.usedPercent !== null && window.resetRemainingMs !== null)\n    .map((window) => (window.resetRemainingMs === 0 ? 0 : window.usedPercent))\n    .filter((used): used is number => used !== null);\n  return windows.length > 0 ? Math.max(...windows) : null;\n}\n\nfunction quotaUncertaintyScore(\n  confidence: CodexFleetConfidence,\n  policy: CodexFleetPolicyConfigV1,\n): number {\n  if (confidence === \"unknown\") return policy.unknownQuotaScore;\n  if (confidence === \"low\") return policy.lowQuotaConfidenceScore;\n  if (confidence === \"medium\") return policy.mediumQuotaConfidenceScore;\n  return 0;\n}\n\nfunction emptyDecision(\n  reason: CodexFleetDecisionV1[\"reason\"],\n  admission: CodexFleetAdmissionDecisionV1,\n  confidence: CodexFleetConfidence,\n): CodexFleetDecisionV1 {\n  return {\n    outcome: admission.outcome === \"pace\" ? \"paced\" : \"none\",\n    selectedCandidateKey: null,\n    reason,\n    admission,\n    borrowedOverlayCapacity: false,\n    strandedEligibleCount: 0,\n    confidence,\n    scores: [],\n  };\n}\n\nfunction aggregateConfidence(scores: CodexFleetScoreV1[]): CodexFleetConfidence {\n  if (scores.length === 0) return \"unknown\";\n  return scores.reduce<CodexFleetConfidence>(\n    (lowest, score) =>\n      confidenceWeight(score.confidence) < confidenceWeight(lowest) ? score.confidence : lowest,\n    \"high\",\n  );\n}\n\nfunction normalizeInput(input: CodexFleetDecisionInputV1, maxCandidates: number): NormalizedInput {\n  const currentCandidateKey = normalizeOptionalKey(input.request.currentCandidateKey);\n  const candidates = input.candidates\n    .map(normalizeCandidate)\n    .sort((a, b) => compareCodexFleetCanonicalStringsV1(a.key, b.key));\n  for (let index = 1; index < candidates.length; index += 1) {\n    if (candidates[index - 1]!.key === candidates[index]!.key) {\n      throw new Error(`Duplicate Codex fleet candidate key: ${candidates[index]!.key}`);\n    }\n  }\n  let bounded = candidates.slice(0, maxCandidates);\n  if (\n    currentCandidateKey &&\n    candidates.some((candidate) => candidate.key === currentCandidateKey) &&\n    !bounded.some((candidate) => candidate.key === currentCandidateKey)\n  ) {\n    bounded = [\n      ...bounded.slice(0, Math.max(0, maxCandidates - 1)),\n      candidates.find((candidate) => candidate.key === currentCandidateKey)!,\n    ].sort((a, b) => compareCodexFleetCanonicalStringsV1(a.key, b.key));\n  }\n  return {\n    input: {\n      observedAtMs: normalizeInteger(input.observedAtMs, 0, Number.MAX_SAFE_INTEGER),\n      request: {\n        placement: input.request.placement === \"fenced_in_flight\" ? \"fenced_in_flight\" : \"new\",\n        priority: input.request.priority === \"manager\" ? \"manager\" : \"standard\",\n        currentCandidateKey,\n        waitAgeMs: normalizeInteger(input.request.waitAgeMs, 0, MAX_DURATION_MS),\n        overlayKey: normalizeOptionalKey(input.request.overlayKey),\n        overlayMode:\n          input.request.overlayMode === \"isolate\"\n            ? \"isolate\"\n            : input.request.overlayMode === \"prefer\"\n              ? \"prefer\"\n              : \"none\",\n      },\n      admission: {\n        dynamicCapacityUnits:\n          input.admission.dynamicCapacityUnits === null\n            ? null\n            : normalizeInteger(input.admission.dynamicCapacityUnits, 0, MAX_COUNT),\n        inUseUnits: normalizeInteger(input.admission.inUseUnits, 0, MAX_COUNT),\n        queuedManagerCount: normalizeInteger(input.admission.queuedManagerCount, 0, MAX_COUNT),\n        emergencyFuseActive: input.admission.emergencyFuseActive === true,\n      },\n      candidates: bounded,\n    },\n    truncatedCandidateCount: candidates.length - bounded.length,\n  };\n}\n\nfunction normalizeCandidate(candidate: CodexFleetCandidateV1): CodexFleetCandidateV1 {\n  return {\n    key: normalizeKey(candidate.key),\n    status:\n      candidate.status === \"active\" ||\n      candidate.status === \"needs_relogin\" ||\n      candidate.status === \"error\"\n        ? candidate.status\n        : \"unknown\",\n    allocatorEnabled: candidate.allocatorEnabled === true,\n    cooldownRemainingMs: normalizeNullableInteger(\n      candidate.cooldownRemainingMs,\n      0,\n      MAX_DURATION_MS,\n    ),\n    activeLeaseCount: normalizeInteger(candidate.activeLeaseCount, 0, MAX_COUNT),\n    quota: {\n      primary: normalizeQuotaWindow(candidate.quota.primary),\n      secondary: normalizeQuotaWindow(candidate.quota.secondary),\n      checkedAgeMs: normalizeNullableInteger(candidate.quota.checkedAgeMs, 0, MAX_DURATION_MS),\n      confidence: normalizeConfidence(candidate.quota.confidence),\n    },\n    cache: {\n      hitRatio: normalizeNullableNumber(candidate.cache.hitRatio, 0, 1, 4),\n      sampledTokens: normalizeNullableInteger(candidate.cache.sampledTokens, 0, MAX_COUNT),\n      checkedAgeMs: normalizeNullableInteger(candidate.cache.checkedAgeMs, 0, MAX_DURATION_MS),\n      confidence: normalizeConfidence(candidate.cache.confidence),\n      state: normalizeCacheState(candidate.cache.state),\n      thresholdObservedForMs: normalizeNullableInteger(\n        candidate.cache.thresholdObservedForMs,\n        0,\n        MAX_DURATION_MS,\n      ),\n    },\n    observedBurn: {\n      primaryPercentPerHour: normalizeNullableNumber(\n        candidate.observedBurn.primaryPercentPerHour,\n        0,\n        100,\n        3,\n      ),\n      secondaryPercentPerHour: normalizeNullableNumber(\n        candidate.observedBurn.secondaryPercentPerHour,\n        0,\n        100,\n        3,\n      ),\n      confidence: normalizeConfidence(candidate.observedBurn.confidence),\n    },\n    inferredUnexplainedBurn: {\n      primaryPercentPerHour: normalizeNullableNumber(\n        candidate.inferredUnexplainedBurn.primaryPercentPerHour,\n        0,\n        100,\n        3,\n      ),\n      secondaryPercentPerHour: normalizeNullableNumber(\n        candidate.inferredUnexplainedBurn.secondaryPercentPerHour,\n        0,\n        100,\n        3,\n      ),\n      confidence: normalizeConfidence(candidate.inferredUnexplainedBurn.confidence),\n    },\n    overlayKeys: [...new Set(candidate.overlayKeys.map(normalizeKey))]\n      .sort(compareCodexFleetCanonicalStringsV1)\n      .slice(0, CODEX_FLEET_POLICY_MAX_OVERLAYS_PER_CANDIDATE),\n  };\n}\n\nfunction normalizeQuotaWindow(window: CodexFleetQuotaWindowV1): CodexFleetQuotaWindowV1 {\n  return {\n    usedPercent: normalizeNullableNumber(window.usedPercent, 0, 100, 3),\n    resetRemainingMs: normalizeNullableInteger(window.resetRemainingMs, 0, MAX_DURATION_MS),\n  };\n}\n\nfunction normalizePolicy(policy: CodexFleetPolicyConfigV1): CodexFleetPolicyConfigV1 {\n  const quotaFreshForMs = normalizeInteger(policy.quotaFreshForMs, 1, MAX_DURATION_MS);\n  const cacheCollapseThreshold = normalizeNumber(policy.cacheCollapseThreshold, 0, 1, 4);\n  return {\n    maxCandidates: normalizeInteger(policy.maxCandidates, 1, CODEX_FLEET_POLICY_MAX_CANDIDATES),\n    quotaFreshForMs,\n    quotaStaleAfterMs: normalizeInteger(policy.quotaStaleAfterMs, quotaFreshForMs, MAX_DURATION_MS),\n    placementUsageCeilingPercent: normalizeNumber(policy.placementUsageCeilingPercent, 1, 100, 3),\n    cacheFreshForMs: normalizeInteger(policy.cacheFreshForMs, 1, MAX_DURATION_MS),\n    cacheCollapseThreshold,\n    cacheCollapseRecoveryThreshold: normalizeNumber(\n      policy.cacheCollapseRecoveryThreshold,\n      cacheCollapseThreshold,\n      1,\n      4,\n    ),\n    cacheMinimumSampledTokens: normalizeInteger(policy.cacheMinimumSampledTokens, 1, MAX_COUNT),\n    cacheCollapseDwellMs: normalizeInteger(policy.cacheCollapseDwellMs, 1, MAX_DURATION_MS),\n    cacheRecoveryDwellMs: normalizeInteger(policy.cacheRecoveryDwellMs, 1, MAX_DURATION_MS),\n    activeLeaseScore: normalizeNumber(policy.activeLeaseScore, 0, MAX_COUNT, 3),\n    unknownQuotaScore: normalizeNumber(policy.unknownQuotaScore, 0, MAX_COUNT, 3),\n    lowQuotaConfidenceScore: normalizeNumber(policy.lowQuotaConfidenceScore, 0, MAX_COUNT, 3),\n    mediumQuotaConfidenceScore: normalizeNumber(policy.mediumQuotaConfidenceScore, 0, MAX_COUNT, 3),\n    inferredBurnScorePerPercentHour: normalizeNumber(\n      policy.inferredBurnScorePerPercentHour,\n      0,\n      MAX_COUNT,\n      3,\n    ),\n    observedBurnScorePerPercentHour: normalizeNumber(\n      policy.observedBurnScorePerPercentHour,\n      0,\n      MAX_COUNT,\n      3,\n    ),\n    runwayRiskCapHours: normalizeNumber(policy.runwayRiskCapHours, 0, 24 * 31, 3),\n    runwayScorePerAtRiskHour: normalizeNumber(policy.runwayScorePerAtRiskHour, 0, MAX_COUNT, 3),\n    healthyCacheAffinityBenefit: normalizeNumber(\n      policy.healthyCacheAffinityBenefit,\n      0,\n      MAX_COUNT,\n      3,\n    ),\n    unknownCacheAffinityBenefit: normalizeNumber(\n      policy.unknownCacheAffinityBenefit,\n      0,\n      MAX_COUNT,\n      3,\n    ),\n    collapsedCacheAffinityBenefit: normalizeNumber(\n      policy.collapsedCacheAffinityBenefit,\n      0,\n      MAX_COUNT,\n      3,\n    ),\n    switchHysteresisScore: normalizeNumber(policy.switchHysteresisScore, 0, MAX_COUNT, 3),\n    admissionPacingEnabled: policy.admissionPacingEnabled === true,\n    managerPriorityEnabled: policy.managerPriorityEnabled === true,\n    managerStandardStarvationMs: normalizeInteger(\n      policy.managerStandardStarvationMs,\n      1,\n      MAX_DURATION_MS,\n    ),\n    emergencyFuseEnabled: policy.emergencyFuseEnabled === true,\n    overlaysEnabled: policy.overlaysEnabled === true,\n    overlayPreferenceScore: normalizeNumber(policy.overlayPreferenceScore, 0, MAX_COUNT, 3),\n  };\n}\n\nfunction normalizeConfidence(value: CodexFleetConfidence): CodexFleetConfidence {\n  return value === \"high\" || value === \"medium\" || value === \"low\" ? value : \"unknown\";\n}\n\nfunction normalizeCacheState(value: CodexFleetCacheState): CodexFleetCacheState {\n  return value === \"healthy\" || value === \"collapsed\" ? value : \"unknown\";\n}\n\nfunction confidenceWeight(confidence: CodexFleetConfidence): number {\n  if (confidence === \"high\") return 1;\n  if (confidence === \"medium\") return 0.6;\n  if (confidence === \"low\") return 0.25;\n  return 0;\n}\n\nfunction lowerConfidence(\n  value: CodexFleetConfidence,\n  ceiling: CodexFleetConfidence,\n): CodexFleetConfidence {\n  return confidenceWeight(value) < confidenceWeight(ceiling) ? value : ceiling;\n}\n\nfunction normalizeKey(value: string): string {\n  if (!/^[a-zA-Z0-9._:-]{1,32}$/.test(value)) {\n    throw new Error(\"Codex fleet candidate/overlay keys must be 1-32 opaque safe characters\");\n  }\n  return value;\n}\n\nfunction normalizeOptionalKey(value: string | null): string | null {\n  return value === null ? null : normalizeKey(value);\n}\n\nfunction normalizeNullableNumber(\n  value: number | null,\n  min: number,\n  max: number,\n  decimals: number,\n): number | null {\n  return value === null ? null : normalizeNumber(value, min, max, decimals);\n}\n\nfunction normalizeNumber(value: number, min: number, max: number, decimals: number): number {\n  const finite = Number.isFinite(value) ? value : min;\n  const clamped = Math.min(max, Math.max(min, finite));\n  const scale = 10 ** decimals;\n  return Math.round(clamped * scale) / scale;\n}\n\nfunction normalizeNullableInteger(value: number | null, min: number, max: number): number | null {\n  return value === null ? null : normalizeInteger(value, min, max);\n}\n\nfunction normalizeInteger(value: number, min: number, max: number): number {\n  return Math.round(normalizeNumber(value, min, max, 0));\n}\n\nfunction readCodexFleetDecisionV1(\n  value: unknown,\n  candidateKeys: ReadonlySet<string>,\n): CodexFleetDecisionV1 {\n  const decision = strictRecord(value, [\n    \"outcome\",\n    \"selectedCandidateKey\",\n    \"reason\",\n    \"admission\",\n    \"borrowedOverlayCapacity\",\n    \"strandedEligibleCount\",\n    \"confidence\",\n    \"scores\",\n  ]);\n  const outcome = strictEnum(decision.outcome, [\"selected\", \"paced\", \"none\"] as const);\n  const selectedCandidateKey = strictOptionalKey(decision.selectedCandidateKey);\n  const reason = strictEnum(decision.reason, [\n    \"fenced_in_flight\",\n    \"fenced_candidate_missing\",\n    \"admission_paced\",\n    \"no_eligible_candidate\",\n    \"overlay_isolated_empty\",\n    \"best_score\",\n    \"affinity_best\",\n    \"hysteresis_hold\",\n  ] as const);\n  const admissionRecord = strictRecord(decision.admission, [\n    \"outcome\",\n    \"reason\",\n    \"borrowedIdleCapacity\",\n  ]);\n  const admission: CodexFleetAdmissionDecisionV1 = {\n    outcome: strictEnum(admissionRecord.outcome, [\"admit\", \"pace\"] as const),\n    reason: strictEnum(admissionRecord.reason, [\n      \"fenced_in_flight\",\n      \"pacing_disabled\",\n      \"capacity_unknown\",\n      \"capacity_available\",\n      \"work_conserving_borrow\",\n      \"manager_priority\",\n      \"standard_starvation_bound\",\n      \"capacity_saturated\",\n      \"emergency_fuse\",\n    ] as const),\n    borrowedIdleCapacity: strictBoolean(admissionRecord.borrowedIdleCapacity),\n  };\n  if (!Array.isArray(decision.scores) || decision.scores.length > candidateKeys.size) {\n    throw new Error(\"Codex fleet replay decision scores are not a bounded array\");\n  }\n  const scores = decision.scores.map(readCodexFleetScoreV1);\n  if (\n    new Set(scores.map((score) => score.candidateKey)).size !== scores.length ||\n    scores.some((score) => !candidateKeys.has(score.candidateKey))\n  ) {\n    throw new Error(\"Codex fleet replay decision has invalid candidate scores\");\n  }\n  const borrowedOverlayCapacity = strictBoolean(decision.borrowedOverlayCapacity);\n  const strandedEligibleCount = strictInteger(decision.strandedEligibleCount, 0, MAX_COUNT);\n\n  const selectedReasons = [\n    \"fenced_in_flight\",\n    \"best_score\",\n    \"affinity_best\",\n    \"hysteresis_hold\",\n  ] as const;\n  const noneReasons = [\n    \"fenced_candidate_missing\",\n    \"no_eligible_candidate\",\n    \"overlay_isolated_empty\",\n  ] as const;\n  const paceReasons = [\"manager_priority\", \"capacity_saturated\", \"emergency_fuse\"] as const;\n  const consistent =\n    outcome === \"selected\"\n      ? selectedCandidateKey !== null &&\n        admission.outcome === \"admit\" &&\n        selectedReasons.includes(reason as (typeof selectedReasons)[number]) &&\n        scores.some((score) => score.candidateKey === selectedCandidateKey)\n      : outcome === \"paced\"\n        ? selectedCandidateKey === null &&\n          reason === \"admission_paced\" &&\n          admission.outcome === \"pace\" &&\n          paceReasons.includes(admission.reason as (typeof paceReasons)[number])\n        : selectedCandidateKey === null &&\n          admission.outcome === \"admit\" &&\n          noneReasons.includes(reason as (typeof noneReasons)[number]);\n  if (\n    !consistent ||\n    strandedEligibleCount > candidateKeys.size ||\n    admission.borrowedIdleCapacity !== (admission.reason === \"work_conserving_borrow\") ||\n    (borrowedOverlayCapacity && (outcome !== \"selected\" || strandedEligibleCount !== 0))\n  ) {\n    throw new Error(\"Codex fleet replay decision is internally inconsistent\");\n  }\n\n  return {\n    outcome,\n    selectedCandidateKey,\n    reason,\n    admission,\n    borrowedOverlayCapacity,\n    strandedEligibleCount,\n    confidence: strictConfidence(decision.confidence),\n    scores,\n  };\n}\n\nfunction readCodexFleetScoreV1(value: unknown): CodexFleetScoreV1 {\n  const score = strictRecord(value, [\n    \"candidateKey\",\n    \"eligible\",\n    \"rejectionReason\",\n    \"quotaPressure\",\n    \"leasePressure\",\n    \"observedBurnPressure\",\n    \"inferredBurnPressure\",\n    \"runwayPressure\",\n    \"uncertaintyPressure\",\n    \"cacheAffinityBenefit\",\n    \"cacheState\",\n    \"overlayPreferenceBenefit\",\n    \"total\",\n    \"confidence\",\n  ]);\n  const parsed: CodexFleetScoreV1 = {\n    candidateKey: normalizeKey(strictString(score.candidateKey)),\n    eligible: strictBoolean(score.eligible),\n    rejectionReason:\n      score.rejectionReason === null\n        ? null\n        : strictEnum(score.rejectionReason, [\n            \"allocator_disabled\",\n            \"unavailable\",\n            \"cooling\",\n            \"quota_ceiling\",\n            \"overlay_isolation\",\n          ] as const),\n    quotaPressure: strictFiniteNumber(score.quotaPressure, 0, Number.MAX_SAFE_INTEGER),\n    leasePressure: strictFiniteNumber(score.leasePressure, 0, Number.MAX_SAFE_INTEGER),\n    observedBurnPressure: strictFiniteNumber(\n      score.observedBurnPressure,\n      0,\n      Number.MAX_SAFE_INTEGER,\n    ),\n    inferredBurnPressure: strictFiniteNumber(\n      score.inferredBurnPressure,\n      0,\n      Number.MAX_SAFE_INTEGER,\n    ),\n    runwayPressure: strictFiniteNumber(score.runwayPressure, 0, Number.MAX_SAFE_INTEGER),\n    uncertaintyPressure: strictFiniteNumber(score.uncertaintyPressure, 0, Number.MAX_SAFE_INTEGER),\n    cacheAffinityBenefit: strictFiniteNumber(\n      score.cacheAffinityBenefit,\n      0,\n      Number.MAX_SAFE_INTEGER,\n    ),\n    cacheState: strictEnum(score.cacheState, [\"unknown\", \"healthy\", \"collapsed\"] as const),\n    overlayPreferenceBenefit: strictFiniteNumber(\n      score.overlayPreferenceBenefit,\n      0,\n      Number.MAX_SAFE_INTEGER,\n    ),\n    total: strictFiniteNumber(score.total, -Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER),\n    confidence: strictConfidence(score.confidence),\n  };\n  const expectedTotal =\n    parsed.quotaPressure +\n    parsed.leasePressure +\n    parsed.observedBurnPressure +\n    parsed.inferredBurnPressure +\n    parsed.runwayPressure +\n    parsed.uncertaintyPressure -\n    parsed.cacheAffinityBenefit -\n    parsed.overlayPreferenceBenefit;\n  if (parsed.eligible !== (parsed.rejectionReason === null) || parsed.total !== expectedTotal) {\n    throw new Error(\"Codex fleet replay score is internally inconsistent\");\n  }\n  return parsed;\n}\n\nfunction strictRecord(value: unknown, expectedKeys: readonly string[]): Record<string, unknown> {\n  if (\n    value === null ||\n    typeof value !== \"object\" ||\n    Array.isArray(value) ||\n    ![Object.prototype, null].includes(Object.getPrototypeOf(value))\n  ) {\n    throw new Error(\"Codex fleet replay value must be a plain object\");\n  }\n  const record = value as Record<string, unknown>;\n  const actualKeys = Object.keys(record).sort(compareCodexFleetCanonicalStringsV1);\n  const canonicalExpected = [...expectedKeys].sort(compareCodexFleetCanonicalStringsV1);\n  if (canonicalJson(actualKeys) !== canonicalJson(canonicalExpected)) {\n    throw new Error(\"Codex fleet replay object has missing or unknown fields\");\n  }\n  return record;\n}\n\nfunction strictEnum<const T extends readonly string[]>(value: unknown, values: T): T[number] {\n  if (typeof value !== \"string\" || !values.includes(value)) {\n    throw new Error(\"Codex fleet replay enum value is invalid\");\n  }\n  return value as T[number];\n}\n\nfunction strictConfidence(value: unknown): CodexFleetConfidence {\n  return strictEnum(value, [\"unknown\", \"low\", \"medium\", \"high\"] as const);\n}\n\nfunction strictString(value: unknown): string {\n  if (typeof value !== \"string\") throw new Error(\"Codex fleet replay value must be a string\");\n  return value;\n}\n\nfunction strictOptionalKey(value: unknown): string | null {\n  return value === null ? null : normalizeKey(strictString(value));\n}\n\nfunction strictBoolean(value: unknown): boolean {\n  if (typeof value !== \"boolean\") throw new Error(\"Codex fleet replay value must be boolean\");\n  return value;\n}\n\nfunction strictFiniteNumber(value: unknown, min: number, max: number): number {\n  if (typeof value !== \"number\" || !Number.isFinite(value) || value < min || value > max) {\n    throw new Error(\"Codex fleet replay numeric value is invalid\");\n  }\n  return value;\n}\n\nfunction strictInteger(value: unknown, min: number, max: number): number {\n  const number = strictFiniteNumber(value, min, max);\n  if (!Number.isInteger(number)) throw new Error(\"Codex fleet replay value must be an integer\");\n  return number;\n}\n\nfunction strictSha256(value: unknown): string {\n  if (typeof value !== \"string\" || !/^[a-f0-9]{64}$/.test(value)) {\n    throw new Error(\"Codex fleet replay fingerprint must be lowercase SHA-256\");\n  }\n  return value;\n}\n\nfunction fingerprint(value: unknown): string {\n  const serialized = canonicalJson(value);\n  return bytesToHex(sha256(new TextEncoder().encode(serialized)));\n}\n\nfunction fingerprintReplayInput(\n  input: CodexFleetDecisionInputV1,\n  truncatedCandidateCount: number,\n): string {\n  // Truncation affects actual-vs-shadow comparability and the UI explanation,\n  // so it is part of the replay input's integrity boundary rather than mutable\n  // envelope metadata.\n  return fingerprint({ input, truncatedCandidateCount });\n}\n\nfunction canonicalJson(value: unknown): string {\n  return JSON.stringify(sortJson(value));\n}\n\nfunction sortJson(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(sortJson);\n  if (value && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value as Record<string, unknown>)\n        .sort(([left], [right]) => compareCodexFleetCanonicalStringsV1(left, right))\n        .map(([key, child]) => [key, sortJson(child)]),\n    );\n  }\n  return value;\n}\n","const MIN_REDACTABLE_VALUE_LENGTH = 6;\nconst REDACTED = \"[redacted]\";\nconst MAX_REDACTION_DEPTH = 64;\nconst CYCLE_MARKER = \"[OpenGeni omitted cyclic value during secret redaction]\";\nconst DEPTH_MARKER = \"[OpenGeni omitted value beyond secret-redaction depth]\";\n\nexport type SecretForRedaction = {\n  name: string;\n  value: string;\n};\n\ntype PreparedSecret = {\n  marker: string;\n  value: string;\n};\n\nconst SENSITIVE_FIELD_NAMES = new Set([\n  \"authorization\",\n  \"proxyauthorization\",\n  \"cookie\",\n  \"setcookie\",\n  \"accesstoken\",\n  \"refreshtoken\",\n  \"idtoken\",\n  \"apikey\",\n  \"secret\",\n  \"clientsecret\",\n  \"password\",\n  \"passwd\",\n  \"privatekey\",\n  \"credential\",\n  \"credentials\",\n  \"credentialencrypted\",\n  \"encryptedcredential\",\n  \"headersencrypted\",\n  \"encryptedpkceverifier\",\n  \"codeverifier\",\n  \"signingkey\",\n]);\n\nconst CREDENTIAL_HEADER_PATTERNS = [\n  /^(?:proxy-)?authorization$/i,\n  /^(?:set-)?cookie$/i,\n  /^(?:x[-_])?api[-_]?key$/i,\n  /^(?:x[-_])?(?:access|refresh|id)[-_]?token$/i,\n  /^(?:x[-_])?(?:auth|session)[-_]?(?:token|key|secret)$/i,\n  /^(?:x[-_])?(?:client|app|consumer)[-_]?secret$/i,\n  /^x-opengeni-access-key$/i,\n] as const;\n\nconst SECRET_KEY_SOURCE =\n  \"(?:proxy[-_ ]?authorization|authorization|set[-_ ]?cookie|cookie|access[-_ ]?token|refresh[-_ ]?token|id[-_ ]?token|api[-_ ]?key|client[-_ ]?secret|secret|password|passwd|private[-_ ]?key|credential(?:s|[-_ ]?encrypted)?|encrypted[-_ ]?credential|encrypted[-_ ]?pkce[-_ ]?verifier|code[-_ ]?verifier|signing[-_ ]?key)\";\nconst UNQUOTED_SECRET_KEY_SOURCE =\n  \"(?:access[-_ ]?token|refresh[-_ ]?token|id[-_ ]?token|api[-_ ]?key|client[-_ ]?secret|secret|password|passwd|private[-_ ]?key|credential(?:s|[-_ ]?encrypted)?|encrypted[-_ ]?credential|encrypted[-_ ]?pkce[-_ ]?verifier|code[-_ ]?verifier|signing[-_ ]?key)\";\n\nconst AUTHORIZATION_HEADER_PATTERN =\n  /(\\b(?:proxy-)?authorization[^\\S\\r\\n]*:[^\\S\\r\\n]*)([^\\r\\n'\"`]+)/gi;\nconst COOKIE_HEADER_PATTERN = /(\\b(?:set-cookie|cookie)\\s*:\\s*)([^\\r\\n'\"`]+)/gi;\nconst API_KEY_HEADER_PATTERN = /(\\b(?:x[-_])?api[-_]?key[^\\S\\r\\n]*:[^\\S\\r\\n]*)([^\\r\\n'\"`]+)/gi;\nconst CURL_USER_PATTERN = /((?:^|\\s)(?:-u|--user)(?:=|\\s+))(?:(\"[^\"]*\")|('[^']*')|([^\\s]+))/gm;\nconst URL_USERINFO_PATTERN = /(https?:\\/\\/)[^\\s/@]+@/gi;\nconst SIGNED_QUERY_PATTERN = new RegExp(\n  `([?&](?:sig|signature|x-amz-signature|x-amz-credential|x-amz-security-token|x-goog-signature|x-goog-credential|access_token|refresh_token|token)=)([^&#\\\\s'\"<>]+)`,\n  \"gi\",\n);\nconst QUOTED_SECRET_ASSIGNMENT_PATTERN = new RegExp(\n  `((?:[\"']${SECRET_KEY_SOURCE}[\"']|\\\\b${SECRET_KEY_SOURCE})\\\\s*[:=]\\\\s*)([\"'])(.*?)\\\\2`,\n  \"gi\",\n);\nconst UNQUOTED_SECRET_ASSIGNMENT_PATTERN = new RegExp(\n  `((?:\\\\b${UNQUOTED_SECRET_KEY_SOURCE})\\\\s*[:=]\\\\s*)([^\\\\s,;}&]+)`,\n  \"gi\",\n);\nconst SECRET_ENV_ASSIGNMENT_PATTERN =\n  /((?:^|[\\s;])(?:export\\s+)?[A-Za-z_][A-Za-z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|PRIVATE_KEY|CREDENTIAL|AUTHORIZATION|COOKIE)[A-Za-z0-9_]*\\s*=\\s*)(?:(\"[^\"]*\")|('[^']*')|([^\\s;]+))/gim;\n\nconst PROVIDER_TOKEN_PATTERNS = [\n  /\\bgithub_pat_[A-Za-z0-9_]{20,}\\b/g,\n  /\\bgh[pousr]_[A-Za-z0-9]{20,}\\b/g,\n  /\\bglpat-[A-Za-z0-9_-]{20,}\\b/g,\n  /\\bsk-[A-Za-z0-9_-]{20,}\\b/g,\n  /\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b/g,\n  /\\bAIza[0-9A-Za-z_-]{30,}\\b/g,\n  /\\b(?:AKIA|ASIA)[A-Z0-9]{16}\\b/g,\n  /\\bogd_[A-Za-z0-9._~-]{10,}\\b/g,\n  /\\beyJ[A-Za-z0-9_-]{5,}\\.[A-Za-z0-9_-]{6,}\\.[A-Za-z0-9_-]{6,}\\b/g,\n] as const;\n\n/**\n * Returns true only for fields whose value is itself credential material.\n * Container fields such as `headers` and URL fields are intentionally not\n * included: their nested/value sanitizers retain useful names, hosts, paths,\n * and non-sensitive query parameters.\n */\nexport function isSensitiveFieldName(name: string): boolean {\n  return SENSITIVE_FIELD_NAMES.has(normalizeFieldName(name));\n}\n\n/**\n * Return true only for header names whose values are credential material.\n * Ordinary protocol metadata (`content-type`, `accept`, `user-agent`, and\n * pagination/signature headers outside this allowlist) must remain intact.\n */\nexport function isCredentialHeaderName(name: string): boolean {\n  return CREDENTIAL_HEADER_PATTERNS.some((pattern) => pattern.test(name));\n}\n\n/**\n * Redact only exact known-secret provenance from a structured object key.\n * Generic field/header heuristics intentionally do not run here: a key is\n * metadata unless the caller has proved that its bytes are secret material.\n */\nexport function redactSensitiveKey(\n  key: string,\n  knownSecrets: readonly SecretForRedaction[] = [],\n): string {\n  return replacePreparedSecrets(key, prepareSecrets(knownSecrets));\n}\n\n/**\n * Redact known secret provenance and common credential-bearing text shapes.\n * This is deliberately a conservative safety boundary, not a promise of\n * general-purpose DLP. It never includes a matched value in a marker or error.\n */\nexport function redactSensitiveText(\n  text: string,\n  knownSecrets: readonly SecretForRedaction[] = [],\n): string {\n  let redacted = replacePreparedSecrets(text, prepareSecrets(knownSecrets));\n\n  redacted = redacted.replace(\n    AUTHORIZATION_HEADER_PATTERN,\n    (match, prefix: string, rawValue: string) => {\n      const value = rawValue.trimEnd();\n      const trailingWhitespace = rawValue.slice(value.length);\n      const schemeMatch = value.match(/^([A-Za-z][A-Za-z0-9_-]*)(\\s+)(.+)$/);\n      if (schemeMatch) {\n        const scheme = schemeMatch[1];\n        const whitespace = schemeMatch[2];\n        const credential = schemeMatch[3];\n        if (scheme && whitespace && credential) {\n          return isRedactionMarker(credential.trim())\n            ? match\n            : `${prefix}${scheme}${whitespace}${REDACTED}${trailingWhitespace}`;\n        }\n      }\n      return isRedactionMarker(value) ? match : `${prefix}${REDACTED}${trailingWhitespace}`;\n    },\n  );\n  redacted = redacted.replace(COOKIE_HEADER_PATTERN, `$1${REDACTED}`);\n  redacted = redacted.replace(API_KEY_HEADER_PATTERN, `$1${REDACTED}`);\n  redacted = redacted.replace(CURL_USER_PATTERN, (_match, prefix: string) => {\n    return `${prefix}${REDACTED}`;\n  });\n  redacted = redacted.replace(URL_USERINFO_PATTERN, `$1${REDACTED}@`);\n  redacted = redacted.replace(SIGNED_QUERY_PATTERN, `$1${REDACTED}`);\n  redacted = redacted.replace(\n    QUOTED_SECRET_ASSIGNMENT_PATTERN,\n    (match, prefix: string, quote: string, value: string) =>\n      isRedactionMarker(value) ? match : `${prefix}${quote}${REDACTED}${quote}`,\n  );\n  redacted = redacted.replace(\n    UNQUOTED_SECRET_ASSIGNMENT_PATTERN,\n    (match, prefix: string, value: string) =>\n      isRedactionMarker(value) ? match : `${prefix}${REDACTED}`,\n  );\n  redacted = redacted.replace(\n    SECRET_ENV_ASSIGNMENT_PATTERN,\n    (\n      match,\n      prefix: string,\n      doubleQuoted: string | undefined,\n      singleQuoted: string | undefined,\n      bare: string | undefined,\n    ) => {\n      const value = doubleQuoted ?? singleQuoted ?? bare ?? \"\";\n      return isRedactionMarker(stripMatchingQuotes(value)) ? match : `${prefix}${REDACTED}`;\n    },\n  );\n  for (const pattern of PROVIDER_TOKEN_PATTERNS) {\n    redacted = redacted.replace(pattern, REDACTED);\n  }\n  return redacted;\n}\n\n/** Deeply redact plain structured data while retaining its diagnostic shape. */\nexport function redactSensitiveData<T>(\n  value: T,\n  knownSecrets: readonly SecretForRedaction[] = [],\n): T {\n  return redactSensitiveDataDeep(value, knownSecrets, new WeakSet<object>(), 0);\n}\n\n/** Build the worker-friendly single-argument redactor used at turn boundaries. */\nexport function createSecretRedactor(\n  knownSecrets: readonly SecretForRedaction[],\n): (value: unknown) => unknown {\n  const prepared = prepareSecrets(knownSecrets).map(({ marker, value }) => ({\n    name: marker.slice(\"[redacted:\".length, -1),\n    value,\n  }));\n  return (value: unknown) => redactSensitiveData(value, prepared);\n}\n\n/**\n * Redact a serialized JSON checkpoint without requiring it to be valid JSON.\n * Valid JSON retains structure; malformed/opaque text still receives text\n * classification and exact-known-value replacement.\n */\nexport function redactSerializedJson(\n  serialized: string,\n  knownSecrets: readonly SecretForRedaction[] = [],\n): string {\n  try {\n    return JSON.stringify(redactSensitiveData(JSON.parse(serialized), knownSecrets));\n  } catch {\n    return redactSensitiveText(serialized, knownSecrets);\n  }\n}\n\nexport function identityRedactor<T>(value: T): T {\n  return value;\n}\n\nfunction redactSensitiveDataDeep<T>(\n  value: T,\n  knownSecrets: readonly SecretForRedaction[],\n  seen: WeakSet<object>,\n  depth: number,\n): T {\n  if (typeof value === \"string\") {\n    return redactSensitiveText(value, knownSecrets) as T;\n  }\n  if (!value || typeof value !== \"object\" || value instanceof Date) {\n    return value;\n  }\n  if (depth >= MAX_REDACTION_DEPTH) {\n    return DEPTH_MARKER as T;\n  }\n  if (seen.has(value)) {\n    return CYCLE_MARKER as T;\n  }\n  seen.add(value);\n  try {\n    if (Array.isArray(value)) {\n      return value.map((item) => redactSensitiveDataDeep(item, knownSecrets, seen, depth + 1)) as T;\n    }\n    if (!isPlainObject(value)) {\n      return value;\n    }\n    const usedKeys = new Set<string>();\n    return Object.fromEntries(\n      Object.entries(value).map(([key, child]) => {\n        const safeKey = nextUniqueKey(redactSensitiveKey(key, knownSecrets), usedKeys);\n        if (isSensitiveFieldName(key)) {\n          return [safeKey, REDACTED] as const;\n        }\n        if (normalizeFieldName(key) === \"headers\") {\n          return [safeKey, redactHeaderMap(child, knownSecrets, seen, depth + 1)] as const;\n        }\n        return [safeKey, redactSensitiveDataDeep(child, knownSecrets, seen, depth + 1)] as const;\n      }),\n    ) as T;\n  } finally {\n    seen.delete(value);\n  }\n}\n\nfunction redactHeaderMap(\n  value: unknown,\n  knownSecrets: readonly SecretForRedaction[],\n  seen: WeakSet<object>,\n  depth: number,\n): unknown {\n  if (!isPlainObject(value)) {\n    return redactSensitiveDataDeep(value, knownSecrets, seen, depth);\n  }\n  if (depth >= MAX_REDACTION_DEPTH) return DEPTH_MARKER;\n  if (seen.has(value)) return CYCLE_MARKER;\n  seen.add(value);\n  try {\n    const usedKeys = new Set<string>();\n    return Object.fromEntries(\n      Object.entries(value).map(([key, child]) => {\n        const safeKey = nextUniqueKey(redactSensitiveKey(key, knownSecrets), usedKeys);\n        return [\n          safeKey,\n          isCredentialHeaderName(key)\n            ? REDACTED\n            : redactSensitiveDataDeep(child, knownSecrets, seen, depth + 1),\n        ];\n      }),\n    );\n  } finally {\n    seen.delete(value);\n  }\n}\n\nfunction prepareSecrets(knownSecrets: readonly SecretForRedaction[]): PreparedSecret[] {\n  const unique = new Map<string, string>();\n  for (const secret of knownSecrets) {\n    if (secret.value.length < MIN_REDACTABLE_VALUE_LENGTH || unique.has(secret.value)) {\n      continue;\n    }\n    unique.set(secret.value, `[redacted:${safeSecretName(secret.name)}]`);\n  }\n  return [...unique]\n    .map(([value, marker]) => ({ marker, value }))\n    .sort((a, b) => b.value.length - a.value.length || a.marker.localeCompare(b.marker));\n}\n\nfunction replacePreparedSecrets(text: string, prepared: readonly PreparedSecret[]): string {\n  let redacted = text;\n  for (const secret of prepared) {\n    if (redacted.includes(secret.value)) {\n      redacted = redacted.split(secret.value).join(secret.marker);\n    }\n  }\n  return redacted;\n}\n\nfunction nextUniqueKey(base: string, usedKeys: Set<string>): string {\n  let candidate = base;\n  let suffix = 2;\n  while (usedKeys.has(candidate)) {\n    candidate = `${base}#${suffix}`;\n    suffix += 1;\n  }\n  usedKeys.add(candidate);\n  return candidate;\n}\n\nfunction safeSecretName(name: string): string {\n  const safe = name\n    .toUpperCase()\n    .replace(/[^A-Z0-9_]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n  return safe.slice(0, 64) || \"KNOWN_SECRET\";\n}\n\nfunction normalizeFieldName(name: string): string {\n  return name.toLowerCase().replace(/[-_\\s]/g, \"\");\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (!value || typeof value !== \"object\") return false;\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\n\nfunction isRedactionMarker(value: string): boolean {\n  return /^\\[redacted(?::[A-Z0-9_]{1,64})?\\]$/.test(value);\n}\n\nfunction stripMatchingQuotes(value: string): string {\n  if (\n    value.length >= 2 &&\n    ((value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\")))\n  ) {\n    return value.slice(1, -1);\n  }\n  return value;\n}\n","import { z } from \"zod\";\n\nexport const WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS = 262_144;\nexport const WORKSPACE_INSTRUCTION_POLICY_REASON_MAX_CHARS = 4_096;\nexport const WORKSPACE_INSTRUCTION_POLICY_ROLE_KEY_MAX_CHARS = 64;\nexport const WORKSPACE_INSTRUCTION_POLICY_SOURCE_ID_MAX_CHARS = 512;\n\nexport const WorkspaceInstructionPolicyKind = z.enum([\"charter\", \"policy\"]);\nexport type WorkspaceInstructionPolicyKind = z.infer<typeof WorkspaceInstructionPolicyKind>;\n\nexport const WorkspaceInstructionPolicyScope = z.enum([\"global\", \"role\"]);\nexport type WorkspaceInstructionPolicyScope = z.infer<typeof WorkspaceInstructionPolicyScope>;\n\nexport const WorkspaceInstructionPolicyProvenanceSource = z.enum([\n  \"human\",\n  \"onboarding\",\n  \"knowledge_proposal\",\n  \"legacy_import\",\n]);\nexport type WorkspaceInstructionPolicyProvenanceSource = z.infer<\n  typeof WorkspaceInstructionPolicyProvenanceSource\n>;\n\nexport const WorkspaceInstructionPolicyDraftProvenanceSource = z.enum([\n  \"human\",\n  \"onboarding\",\n  \"knowledge_proposal\",\n]);\nexport type WorkspaceInstructionPolicyDraftProvenanceSource = z.infer<\n  typeof WorkspaceInstructionPolicyDraftProvenanceSource\n>;\n\nexport const WorkspaceInstructionPolicyActivationType = z.enum([\"activate\", \"rollback\"]);\nexport type WorkspaceInstructionPolicyActivationType = z.infer<\n  typeof WorkspaceInstructionPolicyActivationType\n>;\n\nexport const WorkspaceInstructionPolicyRoleKey = z\n  .string()\n  .min(1)\n  .max(WORKSPACE_INSTRUCTION_POLICY_ROLE_KEY_MAX_CHARS)\n  .regex(/^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$/);\nexport type WorkspaceInstructionPolicyRoleKey = z.infer<typeof WorkspaceInstructionPolicyRoleKey>;\n\n/**\n * Role-policy keys are identifiers rather than display names. Normalize once\n * at ingress so activation uniqueness and every client use the same key.\n */\nexport function normalizeWorkspaceInstructionPolicyRoleKey(value: string): string {\n  return value.normalize(\"NFKC\").trim().toLowerCase().replace(/\\s+/gu, \"-\").replace(/-+/g, \"-\");\n}\n\nconst RequestRoleKey = z\n  .string()\n  .transform(normalizeWorkspaceInstructionPolicyRoleKey)\n  .pipe(WorkspaceInstructionPolicyRoleKey);\n\nconst targetShape = {\n  kind: WorkspaceInstructionPolicyKind,\n  scope: WorkspaceInstructionPolicyScope,\n  roleKey: WorkspaceInstructionPolicyRoleKey.nullable(),\n};\n\nfunction validateTarget(\n  value: {\n    kind: WorkspaceInstructionPolicyKind;\n    scope: WorkspaceInstructionPolicyScope;\n    roleKey: string | null;\n  },\n  context: z.RefinementCtx,\n): void {\n  if (value.kind === \"charter\" && (value.scope !== \"global\" || value.roleKey !== null)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"scope\"],\n      message: \"a charter must use global scope with no role key\",\n    });\n  }\n  if (value.scope === \"global\" && value.roleKey !== null) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"roleKey\"],\n      message: \"a global instruction policy must not have a role key\",\n    });\n  }\n  if (value.scope === \"role\" && (value.kind !== \"policy\" || value.roleKey === null)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"roleKey\"],\n      message: \"role scope requires a policy and a normalized role key\",\n    });\n  }\n}\n\nexport const WorkspaceInstructionPolicyTarget = z.object(targetShape).superRefine(validateTarget);\nexport type WorkspaceInstructionPolicyTarget = z.infer<typeof WorkspaceInstructionPolicyTarget>;\n\nexport const WorkspaceInstructionPolicyProvenance = z.object({\n  source: WorkspaceInstructionPolicyProvenanceSource,\n  sourceId: z.string().min(1).max(WORKSPACE_INSTRUCTION_POLICY_SOURCE_ID_MAX_CHARS).nullable(),\n});\nexport type WorkspaceInstructionPolicyProvenance = z.infer<\n  typeof WorkspaceInstructionPolicyProvenance\n>;\n\nconst revisionIdentityShape = {\n  id: z.string().uuid(),\n  revision: z.number().int().positive(),\n  contentHash: z.string().regex(/^[0-9a-f]{64}$/),\n};\n\nexport const WorkspaceInstructionPolicyRevisionIdentity = z.object(revisionIdentityShape);\nexport type WorkspaceInstructionPolicyRevisionIdentity = z.infer<\n  typeof WorkspaceInstructionPolicyRevisionIdentity\n>;\n\nexport const WorkspaceInstructionPolicyRevision = z.object({\n  ...revisionIdentityShape,\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  ...targetShape,\n  content: z.string().min(1).max(WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS),\n  provenance: WorkspaceInstructionPolicyProvenance,\n  supersedesRevisionId: z.string().uuid().nullable(),\n  createdBySubjectId: z.string().min(1),\n  createdAt: z.string().datetime(),\n});\nexport type WorkspaceInstructionPolicyRevision = z.infer<typeof WorkspaceInstructionPolicyRevision>;\n\nexport const WorkspaceInstructionPolicyHead = z.object({\n  workspaceId: z.string().uuid(),\n  ...targetShape,\n  revisionId: z.string().uuid(),\n  revision: z.number().int().positive(),\n  contentHash: z.string().regex(/^[0-9a-f]{64}$/),\n  activationVersion: z.number().int().positive(),\n  activatedAt: z.string().datetime(),\n});\nexport type WorkspaceInstructionPolicyHead = z.infer<typeof WorkspaceInstructionPolicyHead>;\n\nexport const WorkspaceInstructionPolicyActivationEvent = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  ...targetShape,\n  type: WorkspaceInstructionPolicyActivationType,\n  activationVersion: z.number().int().positive(),\n  oldRevision: WorkspaceInstructionPolicyRevisionIdentity.nullable(),\n  newRevision: WorkspaceInstructionPolicyRevisionIdentity,\n  actorSubjectId: z.string().min(1),\n  reason: z.string().min(1).max(WORKSPACE_INSTRUCTION_POLICY_REASON_MAX_CHARS),\n  createdAt: z.string().datetime(),\n});\nexport type WorkspaceInstructionPolicyActivationEvent = z.infer<\n  typeof WorkspaceInstructionPolicyActivationEvent\n>;\n\nexport const CreateWorkspaceInstructionPolicyDraftRequest = z\n  .object({\n    kind: WorkspaceInstructionPolicyKind,\n    scope: WorkspaceInstructionPolicyScope,\n    roleKey: RequestRoleKey.nullable().default(null),\n    content: z\n      .string()\n      .min(1)\n      .max(WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS)\n      .refine((value) => value.trim().length > 0, \"instruction policy content must not be blank\"),\n    provenanceSource: WorkspaceInstructionPolicyDraftProvenanceSource.default(\"human\"),\n    provenanceSourceId: z\n      .string()\n      .min(1)\n      .max(WORKSPACE_INSTRUCTION_POLICY_SOURCE_ID_MAX_CHARS)\n      .nullable()\n      .default(null),\n    supersedesRevisionId: z.string().uuid().nullable().default(null),\n  })\n  .superRefine(validateTarget);\nexport type CreateWorkspaceInstructionPolicyDraftRequest = z.infer<\n  typeof CreateWorkspaceInstructionPolicyDraftRequest\n>;\n\nexport const ImportLegacyWorkspaceInstructionPolicyDraftRequest = z\n  .object({\n    supersedesRevisionId: z.string().uuid().nullable().default(null),\n  })\n  .strict();\nexport type ImportLegacyWorkspaceInstructionPolicyDraftRequest = z.infer<\n  typeof ImportLegacyWorkspaceInstructionPolicyDraftRequest\n>;\n\nexport const WorkspaceInstructionPolicyListQuery = z.object({\n  kind: WorkspaceInstructionPolicyKind.optional(),\n  scope: WorkspaceInstructionPolicyScope.optional(),\n  roleKey: RequestRoleKey.nullable().optional(),\n  afterRevision: z.coerce.number().int().positive().optional(),\n  limit: z.coerce.number().int().min(1).max(100).default(50),\n});\nexport type WorkspaceInstructionPolicyListQuery = z.infer<\n  typeof WorkspaceInstructionPolicyListQuery\n>;\n\nexport const WorkspaceInstructionPolicyListResponse = z.object({\n  revisions: z.array(WorkspaceInstructionPolicyRevision),\n  activeHeads: z.array(WorkspaceInstructionPolicyHead),\n  activationEvents: z.array(WorkspaceInstructionPolicyActivationEvent),\n  nextAfterRevision: z.number().int().positive().nullable(),\n});\nexport type WorkspaceInstructionPolicyListResponse = z.infer<\n  typeof WorkspaceInstructionPolicyListResponse\n>;\n\nexport const WorkspaceInstructionPolicyDiffRequest = z\n  .object({\n    fromRevisionId: z.string().uuid(),\n    toRevisionId: z.string().uuid(),\n  })\n  .refine((value) => value.fromRevisionId !== value.toRevisionId, {\n    message: \"diff revisions must be different\",\n    path: [\"toRevisionId\"],\n  });\nexport type WorkspaceInstructionPolicyDiffRequest = z.infer<\n  typeof WorkspaceInstructionPolicyDiffRequest\n>;\n\nexport const WorkspaceInstructionPolicyDiffResponse = z.object({\n  from: WorkspaceInstructionPolicyRevision,\n  to: WorkspaceInstructionPolicyRevision,\n  format: z.literal(\"unified\"),\n  diff: z.string(),\n});\nexport type WorkspaceInstructionPolicyDiffResponse = z.infer<\n  typeof WorkspaceInstructionPolicyDiffResponse\n>;\n\nexport const ActivateWorkspaceInstructionPolicyRequest = z.object({\n  expectedCurrentRevisionId: z.string().uuid().nullable(),\n  reason: z.string().trim().min(1).max(WORKSPACE_INSTRUCTION_POLICY_REASON_MAX_CHARS),\n});\nexport type ActivateWorkspaceInstructionPolicyRequest = z.infer<\n  typeof ActivateWorkspaceInstructionPolicyRequest\n>;\n\nexport const RollbackWorkspaceInstructionPolicyRequest = z.object({\n  targetRevisionId: z.string().uuid(),\n  expectedCurrentRevisionId: z.string().uuid(),\n  reason: z.string().trim().min(1).max(WORKSPACE_INSTRUCTION_POLICY_REASON_MAX_CHARS),\n});\nexport type RollbackWorkspaceInstructionPolicyRequest = z.infer<\n  typeof RollbackWorkspaceInstructionPolicyRequest\n>;\n\nexport const WorkspaceInstructionPolicyActivationResponse = z.object({\n  head: WorkspaceInstructionPolicyHead,\n  event: WorkspaceInstructionPolicyActivationEvent,\n});\nexport type WorkspaceInstructionPolicyActivationResponse = z.infer<\n  typeof WorkspaceInstructionPolicyActivationResponse\n>;\n\nexport const WorkspaceInstructionPolicyConflictResponse = z.object({\n  code: z.literal(\"WORKSPACE_INSTRUCTION_POLICY_CONFLICT\"),\n  message: z.string(),\n  currentHead: WorkspaceInstructionPolicyHead.nullable(),\n});\nexport type WorkspaceInstructionPolicyConflictResponse = z.infer<\n  typeof WorkspaceInstructionPolicyConflictResponse\n>;\n"],"mappings":";AAAA,SAAS,KAAAA,UAAS;;;ACAlB,SAAS,SAAS;AAGX,IAAM,iCAAiC,OAAO;AAE9C,IAAM,qCAAqC,MAAM;AAEjD,IAAM,oCAAoC,IAAI;AAErD,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,iBAAiB;AACvB,IAAM,mBAAmB;AACzB,IAAM,uBAAuB;AAC7B,IAAM,iBAAiB;AAEhB,IAAM,qBAAqB,EAAE,KAAK;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,kCAAkC,EAAE,KAAK;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,0CAA0C,EAC7C,OAAO;AAAA,EACN,WAAW,EAAE,QAAQ,KAAK;AAAA,EAC1B,QAAQ;AACV,CAAC,EACA,OAAO;AAEH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,WAAW,EAAE,QAAQ,IAAI;AAAA,EACzB,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc;AAAA,EAC3C,MAAM;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,MAAM,oBAAoB;AAAA,EAC3D,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK;AAAA,EACnD,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EACzC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,WAAW,EACR,OAAO;AAAA,IACN,QAAQ,EAAE,QAAQ,gBAAgB;AAAA,IAClC,WAAW,EAAE,KAAK;AAAA,EACpB,CAAC,EACA,OAAO;AAAA,EACV,WAAW,EACR,OAAO;AAAA,IACN,QAAQ,EAAE,QAAQ,KAAK;AAAA,IACvB,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,IACxB,cAAc,EAAE,QAAQ,OAAO;AAAA,IAC/B,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,8BAA8B;AAAA,EAC/E,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,QAAQ;AAC3B,QAAM,QAAQ,eAAe,KAAK,MAAM,UAAU,IAAI;AACtD,MAAI,CAAC,SAAS,CAAC,eAAe,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,MAAM,CAAC,MAAM,MAAM,YAAY;AACnF,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,aAAa,MAAM;AAAA,MAC1B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,MAAI,QAAQ,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa,mCAAmC;AACxF,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AASI,IAAM,+BAA+B,EAAE,mBAAmB,aAAa;AAAA,EAC5E;AAAA,EACA;AACF,CAAC;AAMM,IAAM,oCAAoC,EAC9C,OAAO;AAAA,EACN,WAAW,EAAE,QAAQ,KAAK;AAAA,EAC1B,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc;AAAA,EAC3C,QAAQ;AACV,CAAC,EACA,OAAO;AAIH,IAAM,iCAAiC,EAAE,MAAM;AAAA,EACpD;AAAA,EACA;AACF,CAAC;AAkBM,SAAS,kCACd,MACA,OAA2B,QACO;AAClC,MAAI,KAAK,WAAW,WAAW,CAAC,KAAK,OAAQ,QAAO;AACpD,QAAM,QAAQ;AAAA,IACZ,WAAW;AAAA,IACX,YAAY,KAAK;AAAA,IACjB;AAAA,IACA,aAAa,6BAA6B,KAAK,WAAW;AAAA,IAC1D,eAAe,KAAK;AAAA,IACpB,QAAQ,KAAK;AAAA,IACb,YAAY,KAAK;AAAA,IACjB,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,MAAM,kBAAkB,KAAK,WAAW,cAAc,KAAK,EAAE;AAAA,MAC7D,cAAc;AAAA,MACd,eAAe;AAAA,IACjB;AAAA,EACF;AACA,QAAM,SAAS,gCAAgC,UAAU,KAAK;AAC9D,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,SAAS,6BAA6B,OAAuB;AAC3D,QAAM,YAAY,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,YAAY,KAAK;AAClE,SAAO,qBAAqB,KAAK,SAAS,IAAI,YAAY;AAC5D;AAGO,SAAS,+BAA+B,OAA+C;AAC5F,QAAM,SAAS,6BAA6B,UAAU,KAAK;AAC3D,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEO,SAAS,0BACd,SAA0C,gBAClB;AACxB,SAAO,EAAE,WAAW,OAAO,OAAO;AACpC;AAwCO,SAAS,2BACd,aACA,YACA,eAAe,oCACgB;AAC/B,oBAAkB,YAAY,YAAY;AAE1C,MAAI,gBAAgB,QAAQ,gBAAgB,UAAa,gBAAgB,IAAI;AAC3E,QAAI,eAAe,GAAG;AACpB,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,IACF;AACA,UAAM,MAAM,KAAK,IAAI,aAAa,GAAG,eAAe,CAAC;AACrD,UAAM,UAAU,MAAM,IAAI;AAC1B,WAAO,cAAc,GAAG,KAAK,YAAY,UAAU,MAAM,GAAG;AAAA,EAC9D;AAEA,MAAI,YAAY,SAAS,OAAO,eAAe,KAAK,WAAW,GAAG;AAChE,WAAO,aAAa,aAAa,YAAY;AAAA,EAC/C;AACA,MAAI,YAAY,SAAS,GAAG,GAAG;AAC7B,WAAO,aAAa,2BAA2B,YAAY;AAAA,EAC7D;AACA,QAAM,QAAQ,sBAAsB,KAAK,WAAW;AACpD,MAAI,CAAC,SAAU,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAI;AACtC,WAAO,aAAa,aAAa,YAAY;AAAA,EAC/C;AAEA,QAAM,QAAQ,kBAAkB,MAAM,CAAC,CAAC;AACxC,QAAM,SAAS,kBAAkB,MAAM,CAAC,CAAC;AACzC,MAAI,UAAU,cAAc,WAAW,YAAY;AACjD,WAAO,aAAa,oBAAoB,YAAY;AAAA,EACtD;AAEA,MAAI,UAAU,MAAM;AAClB,UAAM,eAAe;AACrB,QAAI,iBAAiB,KAAM,QAAO,aAAa,aAAa,YAAY;AACxE,QAAI,iBAAiB,EAAG,QAAO,mBAAmB,eAAe,UAAU;AAC3E,QAAI,eAAe,aAAc,QAAO,aAAa,mBAAmB,YAAY;AACpF,QAAI,eAAe,EAAG,QAAO,mBAAmB,kBAAkB,UAAU;AAC5E,UAAM,SAAS,KAAK,IAAI,cAAc,UAAU;AAChD,WAAO,cAAc,aAAa,QAAQ,aAAa,GAAG,YAAY,GAAG;AAAA,EAC3E;AAEA,MAAI,eAAe,EAAG,QAAO,mBAAmB,kBAAkB,UAAU;AAC5E,MAAI,SAAS,WAAY,QAAO,mBAAmB,uBAAuB,UAAU;AAEpF,MAAI,WAAW,MAAM;AACnB,UAAM,MAAM,KAAK,IAAI,aAAa,GAAG,QAAQ,eAAe,CAAC;AAC7D,WAAO,cAAc,OAAO,KAAK,YAAY,GAAG;AAAA,EAClD;AACA,MAAI,SAAS,MAAO,QAAO,mBAAmB,oBAAoB,UAAU;AAC5E,MAAI,SAAS,SAAS,cAAc;AAClC,WAAO,aAAa,mBAAmB,YAAY;AAAA,EACrD;AACA,SAAO,cAAc,OAAO,KAAK,IAAI,QAAQ,aAAa,CAAC,GAAG,YAAY,GAAG;AAC/E;AAEA,SAAS,kBAAkB,YAAoB,cAA4B;AACzE,MAAI,CAAC,OAAO,cAAc,UAAU,KAAK,aAAa,GAAG;AACvD,UAAM,IAAI,WAAW,+CAA+C;AAAA,EACtE;AACA,MACE,CAAC,OAAO,cAAc,YAAY,KAClC,gBAAgB,KAChB,eAAe,gCACf;AACA,UAAM,IAAI;AAAA,MACR,iDAAiD,8BAA8B;AAAA,IACjF;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,OAAuD;AAChF,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI,MAAM,SAAS,GAAI,QAAO;AAC9B,QAAM,SAAS,OAAO,KAAK;AAC3B,SAAO,OAAO,cAAc,MAAM,IAAI,SAAS;AACjD;AAEA,SAAS,cACP,OACA,KACA,YACA,QAC6B;AAC7B,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,QAAQ,MAAM,QAAQ;AAAA,IACtB;AAAA,IACA;AAAA,IACA,cAAc,WAAW,MAAM,SAAS,KAAK,IAAI,GAAG,IAAI,UAAU,KAAK;AAAA,IACvE,cAAc;AAAA,EAChB;AACF;AAEA,SAAS,aACP,QACA,cAC+B;AAC/B,SAAO,EAAE,MAAM,WAAW,QAAQ,aAAa;AACjD;AAEA,SAAS,mBACP,QACA,YAC+B;AAC/B,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,cAAc,WAAW,UAAU;AAAA,EACrC;AACF;;;ACnUO,IAAM,kCAAkC,KAAK;AAEpD,IAAM,uBAAuB,KAAK;AAClC,IAAM,uBAAuB,IAAI;AACjC,IAAM,qBAAqB;AAC3B,IAAM,wBAAwB;AAC9B,IAAM,sBAAsB;AAC5B,IAAM,wBAAwB;AAC9B,IAAM,sBAAsB;AAC5B,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB;AAC9B,IAAM,wBAAwB;AAC9B,IAAM,qBAAqB;AAC3B,IAAM,yBAAyB;AAC/B,IAAMC,WAAU,IAAI,YAAY;AAEhC,IAAM,kBAAkB,oBAAI,IAAI;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAgFM,SAAS,sBAAsB,OAAwB;AAC5D,SAAOA,SAAQ,OAAO,qBAAqB,KAAK,CAAC,EAAE;AACrD;AAQO,SAAS,wBAAwB,OAA6C;AACnF,SAAO,iBAAiB,KAAK;AAC/B;AAGO,SAAS,8BAA8B,OAAuB;AACnE,SAAO,KAAK,KAAK,KAAK,IAAI,GAAG,KAAK,IAAI,sBAAsB;AAC9D;AAGO,SAAS,yBACd,WACA,aAC0B;AAC1B,SAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,aAAa;AAAA,IACxB,aACE,gBAAgB,OACZ,OACA,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,SAAS,WAAW,IAAI,cAAc,CAAC,CAAC;AAAA,IAC5E,qBAAqB;AAAA,IACrB,SAAS;AAAA,EACX;AACF;AAGO,SAAS,oCACd,OACiC;AACjC,QAAM,QAAQ,qCAAqC,KAAK,KAAK;AAC7D,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,gBAAgB,KAAK,IAAI,GAAG,MAAM,SAAS,MAAM,CAAC,EAAE,MAAM;AAChE,QAAM,UAAU,MAAM,SAAS,IAAI,IAAI,IAAI,MAAM,SAAS,GAAG,IAAI,IAAI;AACrE,SAAO;AAAA,IACL,MAAM,CAAC,KAAK;AAAA,IACZ,KAAK,IAAI,GAAG,KAAK,MAAO,gBAAgB,IAAK,CAAC,IAAI,OAAO;AAAA,EAC3D;AACF;AAGO,SAAS,8BACd,SACsC;AACtC,MAAI,CAAC,cAAc,OAAO,EAAG,QAAO;AACpC,QAAM,QAAQ,QAAQ;AACtB,MAAI,CAAC,cAAc,KAAK,KAAK,MAAM,cAAc,KAAM,QAAO;AAC9D,SAAO;AACT;AAQO,SAAS,yBACd,SACA,UAA2C,CAAC,GACzC;AACH,QAAM,WAAW,KAAK,IAAI,MAAM,KAAK,MAAM,QAAQ,YAAY,+BAA+B,CAAC;AAC/F,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,eACJ,+BAA+B,QAAQ,YAAY,KAAK,0BAA0B;AACpF,QAAM,sBAAsB,iBAAiB,OAAO;AACpD,QAAM,gBAAgB,oBAAoB;AAE1C,MAAI,QAAQ,aAAa,sBAAsB,uBAAuB,qBAAqB;AAC3F,MAAI,UAAU,aAAa,SAAS,OAAO,KAAK,CAAC;AACjD,MAAI,CAAC,MAAM,WAAW,kBAAkB,QAAQ,iBAAiB,UAAU;AACzE,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,wBAAwB,qBAAqB,KAAK;AAC/D,MAAI,UAAU;AAAA,IACZ;AAAA,IACA,iBAAiB,SAAS,QAAQ,eAAe,OAAO,YAAY;AAAA,EACtE;AAEA,MAAI,sBAAsB,OAAO,IAAI,KAAK,IAAI,UAAU,oBAAoB,GAAG;AAC7E,YAAQ,aAAa,oBAAoB,qBAAqB,mBAAmB;AACjF,cAAU,aAAa,SAAS,OAAO,KAAK,CAAC;AAC7C,aAAS,wBAAwB,qBAAqB,KAAK;AAC3D,cAAU;AAAA,MACR;AAAA,MACA,iBAAiB,SAAS,QAAQ,eAAe,OAAO,YAAY;AAAA,IACtE;AAAA,EACF;AAEA,MAAI,sBAAsB,OAAO,IAAI,UAAU;AAC7C,UAAM,WAAW,gBAAgB,OAAO;AACxC,UAAM,UAAU;AAChB,iBAAa,OAAO;AAAA,MAClB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,GAAI,kBAAkB,OAAO,CAAC,IAAI,EAAE,cAAc;AAAA,IACpD,CAAC;AACD,cAAU;AAAA,MACR;AAAA,QACE,GAAG;AAAA,QACH,SAAS;AAAA,MACX;AAAA,MACA,iBAAiB,SAAS,QAAQ,eAAe,OAAO,YAAY;AAAA,IACtE;AAAA,EACF;AAEA,uBAAqB,SAAS,QAAQ;AACtC,SAAO;AACT;AAEA,SAAS,aACP,aACA,cACA,cACc;AACd,SAAO;AAAA,IACL,SAAS;AAAA,IACT,UAAU;AAAA,IACV,SAAS,CAAC;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,EAClB;AACF;AAEA,SAAS,wBACP,aACA,OACyC;AACzC,MAAI,MAAM,SAAU,QAAO;AAC3B,SAAO,YAAY,UAAU,OAAO,YAAY,SAAS;AAC3D;AAEA,SAAS,aAAa,OAAgB,OAAqB,MAAc,OAAwB;AAC/F,MAAI,MAAM,kBAAkB,GAAG;AAC7B,UAAM,UAAU;AAChB,iBAAa,OAAO,EAAE,MAAM,MAAM,SAAS,CAAC;AAC5C,WAAO;AAAA,EACT;AACA,QAAM,kBAAkB;AACxB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,QAAQ,gBAAgB,KAAK;AACnC,QAAI,OAAO;AACT,YAAM,UAAU;AAChB,YAAM,WAAW;AACjB,mBAAa,OAAO;AAAA,QAClB;AAAA,QACA,MAAM;AAAA,QACN,eAAe,UAAU,KAAK;AAAA,QAC9B,gBAAgB,sBAAsB,KAAK;AAAA,QAC3C,WAAW,MAAM;AAAA,MACnB,CAAC;AACD,aAAO;AAAA,IACT;AACA,UAAM,gBAAgB,UAAU,KAAK;AACrC,QAAI,iBAAiB,MAAM,YAAa,QAAO;AAC/C,UAAM,UAAU;AAChB,UAAM,YAAY,mBAAmB,OAAO,MAAM,aAAa,aAAa;AAC5E,iBAAa,OAAO;AAAA,MAClB;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,gBAAgB,UAAU,SAAS;AAAA,IACrC,CAAC;AACD,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,cAAc,OAAO,UAAU,UAAU;AACzF,UAAM,UAAU;AAChB,iBAAa,OAAO,EAAE,MAAM,MAAM,iBAAiB,CAAC;AACpD,WAAO,IAAI,OAAO,KAAK;AAAA,EACzB;AACA,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AAExD,QAAM,SAAS,WAAW,KAAK;AAC/B,MAAI,QAAQ;AACV,UAAM,UAAU;AAChB,iBAAa,OAAO;AAAA,MAClB;AAAA,MACA,MAAM;AAAA,MACN,eAAe,OAAO;AAAA,MACtB,gBAAgB,sBAAsB,OAAO,OAAO;AAAA,IACtD,CAAC;AACD,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,SAAS,mBAAmB;AAC9B,UAAM,UAAU;AAChB,iBAAa,OAAO,EAAE,MAAM,MAAM,QAAQ,CAAC;AAC3C,WAAO;AAAA,EACT;AAEA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,OAAO,KAAK,IAAI,GAAG,MAAM,YAAY;AAC3C,QAAI,MAAM,UAAU,MAAM;AACxB,aAAO,MAAM;AAAA,QAAK,EAAE,QAAQ,MAAM,OAAO;AAAA,QAAG,CAAC,GAAG,UAC9C,kBAAkB,OAAO,OAAO,OAAO,MAAM,KAAK;AAAA,MACpD;AAAA,IACF;AACA,UAAM,UAAU;AAChB,UAAM,OAAO,KAAK,KAAK,OAAO,CAAC;AAC/B,UAAM,OAAO,KAAK,MAAM,OAAO,CAAC;AAChC,UAAMC,WAAU,MAAM,SAAS,OAAO;AACtC,iBAAa,OAAO,EAAE,MAAM,MAAM,SAAS,gBAAgBA,SAAQ,CAAC;AACpE,WAAO;AAAA,MACL,GAAG,MAAM;AAAA,QAAK,EAAE,QAAQ,KAAK;AAAA,QAAG,CAAC,GAAG,UAClC,kBAAkB,OAAO,OAAO,OAAO,MAAM,KAAK;AAAA,MACpD;AAAA,MACA,EAAE,gBAAgBA,UAAS,SAAS,iCAAiC;AAAA,MACrE,GAAG,MAAM;AAAA,QAAK,EAAE,QAAQ,KAAK;AAAA,QAAG,CAAC,GAAG,UAClC,kBAAkB,OAAO,MAAM,SAAS,OAAO,OAAO,OAAO,MAAM,KAAK;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEA,MAAI,iBAAiB,MAAM;AACzB,QAAI,CAAC,8BAA8B,KAAK,GAAG;AACzC,YAAM,UAAU;AAChB,mBAAa,OAAO,EAAE,MAAM,MAAM,iBAAiB,CAAC;AACpD,aAAO;AAAA,IACT;AACA,QAAI;AACF,YAAM,QAAQ,KAAK,UAAU,QAAQ,KAAK,KAAK;AAC/C,aAAO,OAAO,SAAS,KAAK,IAAI,KAAK,UAAU,YAAY,KAAK,KAAK,IAAI;AAAA,IAC3E,QAAQ;AACN,YAAM,UAAU;AAChB,mBAAa,OAAO,EAAE,MAAM,MAAM,iBAAiB,CAAC;AACpD,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,SAAS;AACf,QAAM,EAAE,SAAS,SAAS,aAAa,IAAI,oBAAoB,QAAQ,MAAM,YAAY;AACzF,aAAW,OAAO,cAAc;AAC9B,UAAM,UAAU;AAChB,iBAAa,OAAO;AAAA,MAClB,MAAM,GAAG,IAAI,IAAI,GAAG;AAAA,MACpB,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,SAAS;AACX,UAAM,UAAU;AAChB,iBAAa,OAAO;AAAA,MAClB;AAAA,MACA,MAAM;AAAA;AAAA;AAAA;AAAA,MAIN,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,KAAK,KAAK,SAAS;AAClC,QAAI,GAAG,IAAI,aAAa,OAAO,OAAO,GAAG,IAAI,IAAI,GAAG,IAAI,QAAQ,CAAC;AAAA,EACnE;AACA,MAAI,SAAS;AACX,QAAI,gBAAgB;AAAA,EACtB;AACA,SAAO;AACT;AAEA,SAAS,kBACP,OACA,OACA,OACA,MACA,OACS;AACT,MAAI;AACJ,MAAI;AACF,iBAAa,OAAO,yBAAyB,OAAO,OAAO,KAAK,CAAC;AAAA,EACnE,QAAQ;AACN,UAAM,UAAU;AAChB,iBAAa,OAAO,EAAE,MAAM,GAAG,IAAI,IAAI,KAAK,KAAK,MAAM,iBAAiB,CAAC;AACzE,WAAO;AAAA,EACT;AACA,MAAI,cAAc,EAAE,WAAW,aAAa;AAC1C,UAAM,UAAU;AAChB,iBAAa,OAAO,EAAE,MAAM,GAAG,IAAI,IAAI,KAAK,KAAK,MAAM,iBAAiB,CAAC;AACzE,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,cAAc,WAAW,aAAa,WAAW,QAAQ;AAAA,IACzD;AAAA,IACA,GAAG,IAAI,IAAI,KAAK;AAAA,IAChB,QAAQ;AAAA,EACV;AACF;AAEA,SAAS,oBACP,QACA,WAKA;AACA,QAAM,UAAoC,CAAC;AAC3C,QAAM,WAAW,oBAAI,IAAY;AACjC,QAAM,eAAyB,CAAC;AAChC,QAAM,SAAS,CAAC,QAAyB;AACvC,UAAM,aAAa,OAAO,yBAAyB,QAAQ,GAAG;AAC9D,QAAI,CAAC,YAAY,WAAY,QAAO;AACpC,aAAS,IAAI,GAAG;AAChB,QAAI,WAAW,YAAY;AACzB,cAAQ,KAAK,CAAC,KAAK,WAAW,KAAK,CAAC;AAAA,IACtC,OAAO;AACL,cAAQ,KAAK,CAAC,KAAK,0DAA0D,CAAC;AAC9E,mBAAa,KAAK,GAAG;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AACA,MAAI;AACF,eAAW,OAAO,iBAAiB;AACjC,UAAI,QAAQ,UAAU,UAAW;AACjC,aAAO,GAAG;AAAA,IACZ;AACA,eAAW,OAAO,QAAQ;AACxB,UAAI,CAAC,OAAO,UAAU,eAAe,KAAK,QAAQ,GAAG,KAAK,SAAS,IAAI,GAAG,EAAG;AAC7E,UAAI,QAAQ,UAAU,WAAW;AAC/B,eAAO,EAAE,SAAS,SAAS,MAAM,aAAa;AAAA,MAChD;AACA,aAAO,GAAG;AAAA,IACZ;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,SAAS,SAAS,MAAM,aAAa;AAAA,EAChD;AACA,SAAO,EAAE,SAAS,SAAS,OAAO,aAAa;AACjD;AAEA,SAAS,iBACP,SACA,YACyB;AACzB,MAAI,cAAc,OAAO,GAAG;AAG1B,WAAO,EAAE,GAAG,SAAS,WAAW;AAAA,EAClC;AACA,SAAO,EAAE,OAAO,SAAS,WAAW;AACtC;AAEA,SAAS,iBACP,SACA,QACA,eACA,OACA,cAC+B;AAC/B,SAAO;AAAA,IACL,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB,cAAc;AAAA,IACd,yBACE,kBAAkB,OAAO,OAAO,8BAA8B,aAAa;AAAA,IAC7E,0BAA0B;AAAA,IAC1B;AAAA,IACA,SAAS,MAAM;AAAA,EACjB;AACF;AAEA,SAAS,qBAAqB,SAAkC,UAAwB;AACtF,QAAM,aAAa,QAAQ;AAC3B,yBAAuB,SAAS,UAAU;AAG1C,MAAI,sBAAsB,OAAO,IAAI,UAAU;AAC7C,YAAQ,UAAU;AAClB,eAAW,OAAO,OAAO,KAAK,OAAO,GAAG;AACtC,UAAI,QAAQ,aAAa,QAAQ,gBAAgB,gBAAgB,IAAI,GAAG,MAAM,OAAO;AACnF,eAAO,QAAQ,GAAG;AAAA,MACpB;AAAA,IACF;AACA,eAAW,UAAU,WAAW,QAAQ,MAAM,GAAG,CAAC;AAClD,2BAAuB,SAAS,UAAU;AAAA,EAC5C;AACF;AAEA,SAAS,uBACP,SACA,YACM;AACN,WAAS,UAAU,GAAG,UAAU,IAAI,WAAW,GAAG;AAChD,UAAM,iBAAiB,sBAAsB,OAAO;AACpD,UAAM,eACJ,WAAW,kBAAkB,OACzB,OACA,KAAK,IAAI,GAAG,WAAW,gBAAgB,cAAc;AAC3D,UAAM,2BAA2B,8BAA8B,cAAc;AAC7E,QACE,WAAW,mBAAmB,kBAC9B,WAAW,iBAAiB,gBAC5B,WAAW,6BAA6B,0BACxC;AACA;AAAA,IACF;AACA,eAAW,iBAAiB;AAC5B,eAAW,eAAe;AAC1B,eAAW,2BAA2B;AAAA,EACxC;AACA,QAAM,IAAI,WAAW,gDAAgD;AACvE;AAEA,SAAS,aACP,OACA,QACM;AACN,MAAI,MAAM,QAAQ,SAAS,mBAAoB,OAAM,QAAQ,KAAK,MAAM;AAC1E;AAEA,SAAS,gBAAgB,OAAyC;AAChE,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,iBAAiB;AACjC,QAAI;AACJ,QAAI;AACF,YAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,UAAI,CAAC,YAAY,cAAc,EAAE,WAAW,YAAa;AACzD,cAAQ,WAAW;AAAA,IACrB,QAAQ;AACN;AAAA,IACF;AACA,QAAI,OAAO,UAAU,UAAU;AAC7B,UAAI,GAAG,IAAI,mBAAmB,OAAO,KAAK,UAAU,KAAK,CAAC;AAAA,IAC5D,WAAW,OAAO,UAAU,YAAY,OAAO,UAAU,aAAa,UAAU,MAAM;AACpF,UAAI,GAAG,IAAI;AAAA,IACb;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAgD;AACvE,SAAO,oCAAoC,KAAK;AAClD;AAEA,SAAS,WAAW,OAQX;AACP,MAAI,YAAY,OAAO,KAAK,GAAG;AAC7B,WAAO;AAAA,MACL,eAAe,MAAM;AAAA,MACrB,SAAS;AAAA,QACP,MAAM;AAAA,QACN,YAAY,MAAM;AAAA,QAClB,qBAAqB;AAAA,QACrB,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AACA,MAAI,iBAAiB,aAAa;AAChC,WAAO;AAAA,MACL,eAAe,MAAM;AAAA,MACrB,SAAS;AAAA,QACP,MAAM;AAAA,QACN,YAAY,MAAM;AAAA,QAClB,qBAAqB;AAAA,QACrB,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBACP,OACA,UACA,aAAa,UAAU,KAAK,GACpB;AACR,MAAI,cAAc,SAAU,QAAO;AACnC,MAAI,eAAe,KAAK,IAAI,GAAG,aAAa,QAAQ;AACpD,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,UAAMC,UAAS,UAAK,YAAY;AAChC,UAAMC,iBAAgB,KAAK,IAAI,GAAG,WAAW,UAAUD,OAAM,CAAC;AAC9D,QAAIC,mBAAkB,EAAG,QAAOD;AAChC,UAAME,QAAO,WAAW,OAAO,KAAK,MAAMD,iBAAgB,CAAC,CAAC;AAC5D,UAAME,SAAQ,WAAW,OAAOF,iBAAgBC,MAAK,KAAK;AAC1D,UAAM,oBAAoB,KAAK,IAAI,GAAG,aAAaA,MAAK,QAAQC,OAAM,KAAK;AAC3E,QAAI,sBAAsB,cAAc;AACtC,aAAO,GAAG,MAAM,MAAM,GAAGD,MAAK,GAAG,CAAC,GAAGF,OAAM,GAAG,MAAM,MAAMG,OAAM,KAAK,CAAC;AAAA,IACxE;AACA,mBAAe;AAAA,EACjB;AAEA,QAAM,SAAS,UAAK,YAAY;AAChC,QAAM,gBAAgB,KAAK,IAAI,GAAG,WAAW,UAAU,MAAM,CAAC;AAC9D,QAAM,OAAO,WAAW,OAAO,KAAK,MAAM,gBAAgB,CAAC,CAAC;AAC5D,QAAM,QAAQ,WAAW,OAAO,gBAAgB,KAAK,KAAK;AAC1D,SAAO,GAAG,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,GAAG,MAAM,GAAG,MAAM,MAAM,MAAM,KAAK,CAAC;AACxE;AAEA,SAAS,WAAW,OAAe,UAAkD;AACnF,MAAI,MAAM;AACV,MAAI,QAAQ;AACZ,SAAO,MAAM,MAAM,QAAQ;AACzB,UAAM,OAAO,WAAW,OAAO,GAAG;AAClC,QAAI,QAAQ,KAAK,QAAQ,SAAU;AACnC,aAAS,KAAK;AACd,WAAO,KAAK;AAAA,EACd;AACA,SAAO,EAAE,KAAK,MAAM;AACtB;AAEA,SAAS,WAAW,OAAe,UAAoD;AACrF,MAAI,QAAQ,MAAM;AAClB,MAAI,QAAQ;AACZ,SAAO,QAAQ,GAAG;AAChB,UAAM,OAAO,eAAe,OAAO,KAAK;AACxC,QAAI,QAAQ,KAAK,QAAQ,SAAU;AACnC,aAAS,KAAK;AACd,aAAS,KAAK;AAAA,EAChB;AACA,SAAO,EAAE,OAAO,MAAM;AACxB;AAEA,SAAS,WAAW,OAAe,OAAqD;AACtF,QAAM,OAAO,MAAM,WAAW,KAAK;AACnC,MAAI,QAAQ,IAAM,QAAO,EAAE,WAAW,GAAG,OAAO,EAAE;AAClD,MAAI,QAAQ,KAAO,QAAO,EAAE,WAAW,GAAG,OAAO,EAAE;AACnD,MAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,UAAM,OAAO,QAAQ,IAAI,MAAM,SAAS,MAAM,WAAW,QAAQ,CAAC,IAAI;AACtE,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,aAAO,EAAE,WAAW,GAAG,OAAO,EAAE;AAAA,IAClC;AAAA,EACF;AACA,SAAO,EAAE,WAAW,GAAG,OAAO,EAAE;AAClC;AAEA,SAAS,eAAe,OAAe,KAAmD;AACxF,QAAM,OAAO,MAAM,WAAW,MAAM,CAAC;AACrC,MAAI,QAAQ,SAAU,QAAQ,SAAU,OAAO,GAAG;AAChD,UAAM,WAAW,MAAM,WAAW,MAAM,CAAC;AACzC,QAAI,YAAY,SAAU,YAAY,OAAQ;AAC5C,aAAO,EAAE,WAAW,GAAG,OAAO,EAAE;AAAA,IAClC;AAAA,EACF;AACA,MAAI,QAAQ,IAAM,QAAO,EAAE,WAAW,GAAG,OAAO,EAAE;AAClD,MAAI,QAAQ,KAAO,QAAO,EAAE,WAAW,GAAG,OAAO,EAAE;AACnD,SAAO,EAAE,WAAW,GAAG,OAAO,EAAE;AAClC;AAEA,SAAS,UAAU,OAAuB;AACxC,MAAI,QAAQ;AACZ,WAAS,QAAQ,GAAG,QAAQ,MAAM,UAAS;AACzC,UAAM,OAAO,WAAW,OAAO,KAAK;AACpC,aAAS,KAAK;AACd,aAAS,KAAK;AAAA,EAChB;AACA,SAAO;AACT;AAWA,SAAS,iBAAiB,OAAiC;AACzD,QAAM,QAA8B;AAAA,IAClC,gBAAgB;AAAA,IAChB,MAAM,oBAAI,QAAgB;AAAA,IAC1B,eAAe;AAAA,EACjB;AACA,MAAI;AACF,UAAM,QAAQ,iBAAiB,OAAO,OAAO,OAAO,CAAC;AACrD,WAAO,UAAU,OACb;AAAA,MACE,OAAO;AAAA,MACP,QAAQ,MAAM,iBAAiB;AAAA,IACjC,IACA,EAAE,OAAO,QAAQ,KAAK;AAAA,EAC5B,QAAQ;AACN,WAAO,EAAE,OAAO,MAAM,QAAQ,8BAA8B;AAAA,EAC9D;AACF;AAQA,SAAS,iBACP,OACA,OACA,UACA,OACe;AACf,MAAI,MAAM,kBAAkB,KAAK,QAAQ,uBAAuB;AAC9D,WAAO,oBAAoB,OAAO,6BAA6B;AAAA,EACjE;AACA,QAAM,kBAAkB;AACxB,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,SAAU,QAAO,gBAAgB,KAAK;AAC3D,MAAI,OAAO,UAAU,UAAW,QAAO,QAAQ,IAAI;AACnD,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,aAAa,KAAK,UAAU,KAAK;AACvC,WAAO,eAAe,SAAY,OAAO,WAAW;AAAA,EACtD;AACA,MAAI,OAAO,UAAU,eAAe,OAAO,UAAU,cAAc,OAAO,UAAU,UAAU;AAC5F,WAAO,aAAa,UAAU,IAAI,oBAAoB,OAAO,0BAA0B;AAAA,EACzF;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,oBAAoB,OAAO,0BAA0B;AAAA,EAC9D;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,oBAAoB,OAAO,0BAA0B;AAAA,EAC9D;AACA,MAAI,iBAAiB,MAAM;AACzB,QAAI,CAAC,8BAA8B,KAAK,GAAG;AACzC,aAAO,oBAAoB,OAAO,6BAA6B;AAAA,IACjE;AACA,QAAI;AACF,YAAM,QAAQ,KAAK,UAAU,QAAQ,KAAK,KAAK;AAC/C,aAAO,OAAO,SAAS,KAAK,IAAI,gBAAgB,KAAK,UAAU,YAAY,KAAK,KAAK,CAAC,IAAI;AAAA,IAC5F,QAAQ;AACN,aAAO,oBAAoB,OAAO,0BAA0B;AAAA,IAC9D;AAAA,EACF;AACA,MAAI,YAAY,OAAO,KAAK,KAAK,iBAAiB,aAAa;AAC7D,WAAO,oBAAoB,OAAO,6BAA6B;AAAA,EACjE;AACA,MAAI,MAAM,KAAK,IAAI,KAAK,GAAG;AACzB,WAAO,oBAAoB,OAAO,0BAA0B;AAAA,EAC9D;AACA,QAAM,KAAK,IAAI,KAAK;AACpB,MAAI;AACF,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAI,OAAO,eAAe,KAAK,MAAM,MAAM,WAAW;AACpD,eAAO,oBAAoB,OAAO,6BAA6B;AAAA,MACjE;AACA,YAAMC,UAAS,OAAO,yBAAyB,OAAO,QAAQ;AAC9D,UAAIA,YAAW,SAASA,WAAU,OAAOA,QAAO,UAAU,aAAa;AACrE,eAAO,oBAAoB,OAAO,6BAA6B;AAAA,MACjE;AACA,UAAI,MAAM,SAAS,MAAM,gBAAgB;AACvC,eAAO,oBAAoB,OAAO,6BAA6B;AAAA,MACjE;AACA,UAAIC,SAAQ;AACZ,eAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,YAAI,QAAQ,EAAG,CAAAA,UAAS;AACxB,cAAM,aAAa,OAAO,yBAAyB,OAAO,OAAO,KAAK,CAAC;AACvE,YAAI,cAAc,EAAE,WAAW,aAAa;AAC1C,iBAAO,oBAAoB,OAAO,6BAA6B;AAAA,QACjE;AACA,cAAM,QAAQ,cAAc,WAAW,aAAa,WAAW,QAAQ;AACvE,cAAM,WAAW,iBAAiB,OAAO,OAAO,SAAS,QAAQ,CAAC;AAClE,YAAI,aAAa,KAAM,QAAO;AAC9B,QAAAA,UAAS;AAAA,MACX;AACA,aAAOA;AAAA,IACT;AAEA,UAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,QAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,aAAO,oBAAoB,OAAO,6BAA6B;AAAA,IACjE;AACA,UAAM,SAAS,OAAO,yBAAyB,OAAO,QAAQ;AAC9D,QAAI,WAAW,SAAS,UAAU,OAAO,OAAO,UAAU,aAAa;AACrE,aAAO,oBAAoB,OAAO,6BAA6B;AAAA,IACjE;AACA,QAAI,QAAQ;AACZ,QAAI,SAAS;AACb,QAAI;AACF,iBAAW,OAAO,OAAkC;AAClD,YAAI,CAAC,OAAO,UAAU,eAAe,KAAK,OAAO,GAAG,EAAG;AACvD,YAAI,MAAM,kBAAkB,GAAG;AAC7B,iBAAO,oBAAoB,OAAO,6BAA6B;AAAA,QACjE;AAIA,cAAM,kBAAkB;AACxB,cAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,YAAI,CAAC,cAAc,EAAE,WAAW,aAAa;AAC3C,iBAAO,oBAAoB,OAAO,6BAA6B;AAAA,QACjE;AACA,cAAM,QAAQ,WAAW;AACzB,YACE,OAAO,UAAU,eACjB,OAAO,UAAU,cACjB,OAAO,UAAU,UACjB;AACA;AAAA,QACF;AACA,cAAM,WAAW,iBAAiB,OAAO,OAAO,UAAU,QAAQ,CAAC;AACnE,YAAI,aAAa,KAAM,QAAO;AAC9B,YAAI,SAAS,EAAG,UAAS;AACzB,iBAAS,gBAAgB,GAAG,IAAI,IAAI;AACpC,kBAAU;AAAA,MACZ;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,UAAE;AACA,UAAM,KAAK,OAAO,KAAK;AAAA,EACzB;AACF;AAEA,SAAS,8BAA8B,OAAsB;AAC3D,MAAI;AACF,QAAI,OAAO,eAAe,KAAK,MAAM,KAAK,UAAW,QAAO;AAG5D,WAAO,OAAO,yBAAyB,OAAO,QAAQ,MAAM;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBACP,OACA,QACM;AACN,QAAM,kBAAkB;AACxB,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,MAAI,QAAQ;AACZ,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QACE,SAAS,MACT,SAAS,MACT,SAAS,KACT,SAAS,KACT,SAAS,MACT,SAAS,MACT,SAAS,IACT;AACA,eAAS;AAAA,IACX,WAAW,QAAQ,IAAM;AACvB,eAAS;AAAA,IACX,WAAW,QAAQ,KAAM;AACvB,eAAS;AAAA,IACX,WAAW,QAAQ,MAAO;AACxB,eAAS;AAAA,IACX,WAAW,QAAQ,SAAU,QAAQ,OAAQ;AAC3C,YAAM,OAAO,QAAQ,IAAI,MAAM,SAAS,MAAM,WAAW,QAAQ,CAAC,IAAI;AACtE,UAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,iBAAS;AACT,iBAAS;AAAA,MACX,OAAO;AAEL,iBAAS;AAAA,MACX;AAAA,IACF,WAAW,QAAQ,SAAU,QAAQ,OAAQ;AAC3C,eAAS;AAAA,IACX,OAAO;AACL,eAAS;AAAA,IACX;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAG5B;AACA,MAAI;AACF,UAAM,aAAa,KAAK,UAAU,KAAK;AACvC,WAAO;AAAA,MACL,OAAO,eAAe,SAAY,SAAS;AAAA,MAC3C,cAAc,eAAe;AAAA,IAC/B;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL,OAAO,KAAK,UAAU,wCAAwC;AAAA,MAC9D,cAAc;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,OAAwB;AACpD,SAAO,qBAAqB,KAAK,EAAE;AACrC;AAEA,SAAS,cAAc,OAAkD;AACvE,SAAO,QAAQ,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,CAAC;AAC5E;;;ACh5BA,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAEpB,IAAM,oCAAoC;AAC1C,IAAM,6BAA6B;AACnC,IAAM,oCAAoC;AAC1C,IAAM,gDAAgD;AAE7D,IAAM,kBAAkB,KAAK,KAAK,KAAK;AACvC,IAAM,YAAY;AAClB,IAAM,cAAc;AAUb,SAAS,oCAAoC,MAAc,OAAuB;AACvF,SAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAChD;AA2HO,IAAM,gCAA0D,OAAO,OAAO;AAAA,EACnF,eAAe;AAAA,EACf,iBAAiB,KAAK;AAAA,EACtB,mBAAmB,KAAK;AAAA,EACxB,8BAA8B;AAAA,EAC9B,iBAAiB,KAAK;AAAA,EACtB,wBAAwB;AAAA,EACxB,gCAAgC;AAAA,EAChC,2BAA2B;AAAA,EAC3B,sBAAsB,IAAI;AAAA,EAC1B,sBAAsB,KAAK;AAAA,EAC3B,kBAAkB,IAAI;AAAA,EACtB,mBAAmB,KAAK;AAAA,EACxB,yBAAyB,KAAK;AAAA,EAC9B,4BAA4B,IAAI;AAAA,EAChC,iCAAiC,MAAM;AAAA,EACvC,iCAAiC,MAAM;AAAA,EACvC,oBAAoB;AAAA,EACpB,0BAA0B,IAAI;AAAA,EAC9B,6BAA6B,KAAK;AAAA,EAClC,6BAA6B,KAAK;AAAA,EAClC,+BAA+B,IAAI;AAAA,EACnC,uBAAuB,IAAI;AAAA,EAC3B,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,6BAA6B,IAAI;AAAA,EACjC,sBAAsB;AAAA,EACtB,iBAAiB;AAAA,EACjB,wBAAwB,KAAK;AAC/B,CAAC;AAuFM,SAAS,+BACd,OACA,SAAmC,+BACT;AAC1B,QAAM,mBAAmB,gBAAgB,MAAM;AAC/C,QAAM,aAAa,eAAe,OAAO,iBAAiB,aAAa;AACvE,QAAM,WAAW,6BAA6B,WAAW,OAAO,gBAAgB;AAChF,SAAO;AAAA,IACL,eAAe;AAAA,IACf,eAAe;AAAA,IACf,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,WAAW;AAAA,IAClB,yBAAyB,WAAW;AAAA,IACpC,mBAAmB,YAAY,gBAAgB;AAAA,IAC/C,kBAAkB,uBAAuB,WAAW,OAAO,WAAW,uBAAuB;AAAA,IAC7F;AAAA,IACA,qBAAqB,YAAY,QAAQ;AAAA,EAC3C;AACF;AAEO,SAAS,2BAA2B,OAA2C;AACpF,QAAM,SAAS,6BAA6B,KAAK;AACjD,QAAM,2BAA2B,YAAY,OAAO,MAAM,MAAM,OAAO;AACvE,QAAM,0BACJ,uBAAuB,OAAO,OAAO,OAAO,uBAAuB,MACnE,OAAO;AACT,QAAM,WAAW,6BAA6B,OAAO,OAAO,OAAO,MAAM;AACzE,QAAM,8BAA8B,YAAY,QAAQ;AACxD,QAAM,qCACJ,YAAY,OAAO,QAAQ,MAAM,OAAO;AAC1C,QAAM,6BACJ,sCACA,gCAAgC,OAAO;AACzC,SAAO;AAAA,IACL,SACE,4BACA,2BACA,8BACA,cAAc,QAAQ,MAAM,cAAc,OAAO,QAAQ;AAAA,IAC3D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAOO,SAAS,gCAAgC,OAAyC;AACvF,SAAO,cAAc,KAAK;AAC5B;AAMO,SAAS,6BAA6B,OAA0C;AACrF,QAAM,SAAS,aAAa,OAAO;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MACE,OAAO,kBAAkB,qCACzB,OAAO,kBAAkB,8BACzB,OAAO,SAAS,UAChB;AACA,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAEA,QAAM,SAAS,gBAAgB,OAAO,MAAkC;AACxE,MAAI,cAAc,MAAM,MAAM,cAAc,OAAO,MAAM,GAAG;AAC1D,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,QAAM,kBAAkB;AAAA,IACtB,OAAO;AAAA,IACP,OAAO;AAAA,EACT;AACA,MACE,gBAAgB,4BAA4B,KAC5C,cAAc,gBAAgB,KAAK,MAAM,cAAc,OAAO,KAAK,GACnE;AACA,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AAEA,SAAO;AAAA,IACL,eAAe;AAAA,IACf,eAAe;AAAA,IACf,MAAM;AAAA,IACN;AAAA,IACA,OAAO,gBAAgB;AAAA,IACvB,yBAAyB,cAAc,OAAO,yBAAyB,GAAG,SAAS;AAAA,IACnF,mBAAmB,aAAa,OAAO,iBAAiB;AAAA,IACxD,kBAAkB,aAAa,OAAO,gBAAgB;AAAA,IACtD,UAAU;AAAA,MACR,OAAO;AAAA,MACP,IAAI,IAAI,gBAAgB,MAAM,WAAW,IAAI,CAAC,cAAc,UAAU,GAAG,CAAC;AAAA,IAC5E;AAAA,IACA,qBAAqB,aAAa,OAAO,mBAAmB;AAAA,EAC9D;AACF;AAEO,SAAS,6BACd,OACA,SAAmC,+BACb;AACtB,QAAM,YAAY,kBAAkB,OAAO,MAAM;AACjD,QAAM,UAAU,MAAM,QAAQ,sBAC1B,MAAM,WAAW,KAAK,CAAC,cAAc,UAAU,QAAQ,MAAM,QAAQ,mBAAmB,IACxF;AAIJ,MAAI,MAAM,QAAQ,cAAc,oBAAoB;AAClD,QAAI,CAAC,SAAS;AACZ,aAAO,cAAc,4BAA4B,WAAW,SAAS;AAAA,IACvE;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,sBAAsB,QAAQ;AAAA,MAC9B,QAAQ;AAAA,MACR;AAAA,MACA,yBAAyB;AAAA,MACzB,uBAAuB;AAAA,MACvB,YAAY,oBAAoB,SAAS,MAAM;AAAA,MAC/C,QAAQ,CAAC,eAAe,SAAS,OAAO,QAAQ,KAAK,CAAC;AAAA,IACxD;AAAA,EACF;AAEA,MAAI,UAAU,YAAY,QAAQ;AAChC,WAAO,cAAc,mBAAmB,WAAW,SAAS;AAAA,EAC9D;AAEA,QAAM,SAAS,MAAM,WAAW;AAAA,IAAI,CAAC,cACnC,eAAe,WAAW,OAAO,QAAQ,KAAK;AAAA,EAChD;AACA,QAAM,mBAAmB,IAAI;AAAA,IAC3B,OAAO,OAAO,CAAC,cAAc,UAAU,QAAQ,EAAE,IAAI,CAAC,cAAc,UAAU,YAAY;AAAA,EAC5F;AACA,QAAM,UAAU,mBAAmB,OAAO,QAAQ,gBAAgB;AAClE,QAAM,eAAe,MAAM,WACxB;AAAA,IAAI,CAAC,cACJ;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,oBAAoB,IAAI,UAAU,GAAG;AAAA,MAC7C,QAAQ,iBAAiB,IAAI,UAAU,GAAG;AAAA,IAC5C;AAAA,EACF,EACC,KAAK,CAAC,GAAG,MAAM,oCAAoC,EAAE,cAAc,EAAE,YAAY,CAAC;AACrF,QAAM,WAAW,aACd,OAAO,CAAC,cAAc,UAAU,QAAQ,EACxC;AAAA,IACC,CAAC,GAAG,MACF,EAAE,QAAQ,EAAE,SAAS,oCAAoC,EAAE,cAAc,EAAE,YAAY;AAAA,EAC3F;AAEF,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO;AAAA,MACL,GAAG;AAAA,QACD,QAAQ,gBAAgB,2BAA2B;AAAA,QACnD;AAAA,QACA,oBAAoB,YAAY;AAAA,MAClC;AAAA,MACA,uBAAuB,QAAQ;AAAA,MAC/B,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,MAAI,WAAW,SAAS,CAAC;AACzB,MAAI,SAAyC;AAC7C,QAAM,eAAe,MAAM,QAAQ,sBAC/B,SAAS,KAAK,CAAC,cAAc,UAAU,iBAAiB,MAAM,QAAQ,mBAAmB,IACzF;AACJ,MAAI,cAAc;AAChB,QAAI,SAAS,iBAAiB,aAAa,cAAc;AACvD,eAAS;AAAA,IACX,WAAW,SAAS,QAAQ,OAAO,yBAAyB,aAAa,OAAO;AAC9E,iBAAW;AACX,eAAS;AAAA,IACX;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,sBAAsB,SAAS;AAAA,IAC/B;AAAA,IACA;AAAA,IACA,yBACE,OAAO,mBACP,MAAM,QAAQ,gBAAgB,YAC9B,MAAM,QAAQ,eAAe,QAC7B,CAAC,QAAQ,iBAAiB,IAAI,SAAS,YAAY;AAAA,IACrD,uBAAuB,QAAQ;AAAA,IAC/B,YAAY,oBAAoB,QAAQ;AAAA,IACxC,QAAQ;AAAA,EACV;AACF;AAEA,SAAS,kBACP,OACA,QAC+B;AAC/B,MAAI,MAAM,QAAQ,cAAc,oBAAoB;AAClD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,sBAAsB;AAAA,IACxB;AAAA,EACF;AACA,MAAI,OAAO,wBAAwB,MAAM,UAAU,qBAAqB;AACtE,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,sBAAsB;AAAA,IACxB;AAAA,EACF;AACA,MAAI,CAAC,OAAO,wBAAwB;AAClC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,sBAAsB;AAAA,IACxB;AAAA,EACF;AACA,MAAI,MAAM,UAAU,yBAAyB,MAAM;AAEjD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,sBAAsB;AAAA,IACxB;AAAA,EACF;AACA,QAAM,YAAY,KAAK,IAAI,GAAG,MAAM,UAAU,uBAAuB,MAAM,UAAU,UAAU;AAC/F,MAAI,cAAc,GAAG;AACnB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,sBAAsB;AAAA,IACxB;AAAA,EACF;AACA,MACE,OAAO,0BACP,MAAM,QAAQ,aAAa,cAC3B,MAAM,UAAU,qBAAqB,KACrC,aAAa,MAAM,UAAU,oBAC7B;AACA,QAAI,MAAM,QAAQ,aAAa,OAAO,6BAA6B;AACjE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,sBAAsB;AAAA,MACxB;AAAA,IACF;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,sBAAsB;AAAA,IACxB;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,aAAa,cAAc,MAAM,UAAU,uBAAuB,GAAG;AACrF,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,sBAAsB;AAAA,IACxB;AAAA,EACF;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,sBAAsB;AAAA,EACxB;AACF;AAEA,SAAS,eACP,WACA,OACA,QACA,qBACA,yBAAyB,OACN;AACnB,QAAM,aAAa,oBAAoB,WAAW,MAAM;AACxD,QAAM,cAAc,mBAAmB,SAAS;AAChD,QAAM,iBAAiB,eAAe,UAAU,eAAe;AAC/D,QAAM,kBAAwD,CAAC,UAAU,mBACrE,uBACA,UAAU,WAAW,WACnB,iBACC,UAAU,uBAAuB,KAAK,IACrC,YACA,kBACE,gBAAgB,QAChB,eAAe,OAAO,+BACtB,kBACA,sBACE,sBACA;AAEZ,QAAM,mBAAmB,iBAAiB,UAAU;AAGpD,QAAM,gBAAgB,KAAK;AAAA,MACvB,eAAe,MAAM,mBAAmB,MAAM,IAAI,qBAAqB;AAAA,EAC3E;AACA,QAAM,gBAAgB,UAAU,mBAAmB,OAAO;AAC1D,QAAM,yBAAyB,iBAAiB,UAAU,aAAa,UAAU;AACjF,QAAM,eAAe,kBAAkB,UAAU,YAAY;AAC7D,QAAM,uBAAuB,KAAK;AAAA,IAChC,eAAe,OAAO,kCAAkC;AAAA,EAC1D;AACA,QAAM,iBAAiB,iBAAiB,UAAU,wBAAwB,UAAU;AACpF,QAAM,eAAe,kBAAkB,UAAU,uBAAuB;AACxE,QAAM,uBAAuB,KAAK;AAAA,IAChC,eAAe,OAAO,kCAAkC;AAAA,EAC1D;AACA,QAAM,iBAAiB,mBAAmB,WAAW,YAAY,MAAM;AACvE,QAAM,sBAAsB,sBAAsB,YAAY,MAAM;AACpE,QAAM,aAAa,gCAAgC,UAAU,OAAO,MAAM;AAC1E,QAAM,uBACJ,UAAU,QAAQ,MAAM,QAAQ,sBAC5B,wBAAwB,YAAY,MAAM,IAC1C;AACN,QAAM,2BAA2B,yBAAyB,OAAO,yBAAyB;AAC1F,SAAO;AAAA,IACL,cAAc,UAAU;AAAA,IACxB,UAAU,oBAAoB;AAAA,IAC9B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,OACE,gBACA,gBACA,uBACA,uBACA,iBACA,sBACA,uBACA;AAAA,IACF;AAAA,EACF;AACF;AAKA,SAAS,kBAAkB,MAAwC;AACjE,SAAO,KAAK,IAAI,KAAK,yBAAyB,GAAG,KAAK,2BAA2B,CAAC;AACpF;AAEA,SAAS,WAAW,MAAgC,QAAqC;AACvF,SAAO,WAAW,YACb,KAAK,yBAAyB,IAC9B,KAAK,2BAA2B;AACvC;AASA,SAAS,mBACP,WACA,iBACA,QACQ;AACR,MAAI,oBAAoB,UAAW,QAAO;AAC1C,QAAM,UAAiE;AAAA,IACrE,CAAC,WAAW,UAAU,MAAM,OAAO;AAAA,IACnC,CAAC,aAAa,UAAU,MAAM,SAAS;AAAA,EACzC;AACA,MAAI,kBAAkB;AACtB,aAAW,CAAC,WAAW,MAAM,KAAK,SAAS;AACzC,QACE,OAAO,gBAAgB,QACvB,OAAO,qBAAqB,QAC5B,OAAO,qBAAqB,GAC5B;AACA;AAAA,IACF;AACA,UAAM,qBAAqB;AAAA,MACzB,gBAAgB,UAAU,aAAa,YAAY,eAAe;AAAA,IACpE;AACA,UAAM,qBAAqB;AAAA,MACzB,gBAAgB,UAAU,wBAAwB,YAAY,eAAe;AAAA,IAC/E;AACA,UAAM,wBACJ,WAAW,UAAU,cAAc,SAAS,IAAI,qBAChD,WAAW,UAAU,yBAAyB,SAAS,IAAI;AAC7D,QAAI,yBAAyB,EAAG;AAEhC,UAAM,wBAAwB,KAAK,IAAI,GAAG,MAAM,OAAO,WAAW,IAAI;AACtE,UAAM,oBAAoB,OAAO,mBAAmB,KAAK;AACzD,UAAM,cAAc,KAAK;AAAA,MACvB,OAAO;AAAA,MACP,KAAK,IAAI,GAAG,oBAAoB,qBAAqB;AAAA,IACvD;AACA,sBAAkB,KAAK;AAAA,MACrB;AAAA,MACA,KAAK,MAAM,cAAc,OAAO,wBAAwB;AAAA,IAC1D;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBACP,OACA,QACA,kBAMA;AACA,MACE,CAAC,OAAO,mBACR,MAAM,QAAQ,gBAAgB,UAC9B,MAAM,QAAQ,eAAe,MAC7B;AACA,WAAO;AAAA,MACL,qBAAqB,oBAAI,IAAI;AAAA,MAC7B,kBAAkB,oBAAI,IAAI;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,IACzB;AAAA,EACF;AACA,QAAM,UAAU,IAAI;AAAA,IAClB,MAAM,WACH;AAAA,MACC,CAAC,cACC,iBAAiB,IAAI,UAAU,GAAG,KAClC,UAAU,YAAY,SAAS,MAAM,QAAQ,UAAW;AAAA,IAC5D,EACC,IAAI,CAAC,cAAc,UAAU,GAAG;AAAA,EACrC;AACA,MAAI,MAAM,QAAQ,gBAAgB,UAAU;AAC1C,QAAI,QAAQ,SAAS,GAAG;AACtB,aAAO;AAAA,QACL,qBAAqB,oBAAI,IAAI;AAAA,QAC7B,kBAAkB;AAAA,QAClB,eAAe;AAAA,QACf,uBAAuB;AAAA,MACzB;AAAA,IACF;AACA,WAAO;AAAA;AAAA;AAAA,MAGL,qBAAqB,oBAAI,IAAI;AAAA,MAC7B,kBAAkB;AAAA,MAClB,eAAe;AAAA,MACf,uBAAuB;AAAA,IACzB;AAAA,EACF;AACA,QAAM,UAAU,CAAC,GAAG,gBAAgB,EAAE,OAAO,CAAC,iBAAiB,CAAC,QAAQ,IAAI,YAAY,CAAC;AACzF,SAAO;AAAA,IACL,qBAAqB,IAAI,IAAI,OAAO;AAAA,IACpC,kBAAkB;AAAA,IAClB,eAAe,QAAQ,SAAS;AAAA,IAChC,uBAAuB,QAAQ;AAAA,EACjC;AACF;AAEA,SAAS,oBACP,WACA,QACsB;AACtB,QAAM,MAAM,UAAU,MAAM;AAC5B,MAAI,QAAQ,QAAQ,MAAM,OAAO,kBAAmB,QAAO;AAC3D,QAAM,UAAU,CAAC,UAAU,MAAM,SAAS,UAAU,MAAM,SAAS;AACnE,QAAM,sBAAsB,QAAQ;AAAA,IAClC,CAAC,WAAW,OAAO,gBAAgB,QAAQ,OAAO,qBAAqB;AAAA,EACzE,EAAE;AACF,QAAM,mBAAmB,QAAQ;AAAA,IAC/B,CAAC,WAAY,OAAO,gBAAgB,UAAW,OAAO,qBAAqB;AAAA,EAC7E;AACA,MAAI,wBAAwB,EAAG,QAAO;AACtC,QAAM,sBAA4C,mBAC9C,QACA,wBAAwB,QAAQ,SAC9B,SACA;AACN,QAAM,qBAAqB,gBAAgB,UAAU,MAAM,YAAY,mBAAmB;AAC1F,MAAI,MAAM,OAAO,iBAAiB;AAChC,WAAO,gBAAgB,oBAAoB,KAAK;AAAA,EAClD;AACA,SAAO;AACT;AAEO,SAAS,gCACd,OACA,QACsB;AACtB,QAAM,EAAE,UAAU,eAAe,cAAc,YAAY,OAAO,uBAAuB,IACvF;AACF,MACE,aAAa,QACb,kBAAkB,QAClB,gBAAgB,OAAO,6BACvB,iBAAiB,QACjB,eAAe,OAAO,mBACtB,iBAAiB,UAAU,IAAI,iBAAiB,QAAQ,GACxD;AACA,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,0BAA0B;AAChD,MAAI,UAAU,WAAW;AACvB,WAAO,WAAW,OAAO,0BAA0B,iBAAiB,OAAO,uBACvE,cACA;AAAA,EACN;AACA,MAAI,UAAU,aAAa;AACzB,WAAO,YAAY,OAAO,kCACxB,iBAAiB,OAAO,uBACtB,YACA;AAAA,EACN;AACA,MAAI,WAAW,OAAO,0BAA0B,iBAAiB,OAAO,sBAAsB;AAC5F,WAAO;AAAA,EACT;AACA,MACE,YAAY,OAAO,kCACnB,iBAAiB,OAAO,sBACxB;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,wBACP,OACA,QACQ;AACR,MAAI,UAAU,UAAW,QAAO,OAAO;AACvC,MAAI,UAAU,YAAa,QAAO,OAAO;AACzC,SAAO,OAAO;AAChB;AAEA,SAAS,mBAAmB,WAAiD;AAC3E,QAAM,UAAU,CAAC,UAAU,MAAM,SAAS,UAAU,MAAM,SAAS,EAChE,OAAO,CAAC,WAAW,OAAO,gBAAgB,QAAQ,OAAO,qBAAqB,IAAI,EAClF,IAAI,CAAC,WAAY,OAAO,qBAAqB,IAAI,IAAI,OAAO,WAAY,EACxE,OAAO,CAAC,SAAyB,SAAS,IAAI;AACjD,SAAO,QAAQ,SAAS,IAAI,KAAK,IAAI,GAAG,OAAO,IAAI;AACrD;AAEA,SAAS,sBACP,YACA,QACQ;AACR,MAAI,eAAe,UAAW,QAAO,OAAO;AAC5C,MAAI,eAAe,MAAO,QAAO,OAAO;AACxC,MAAI,eAAe,SAAU,QAAO,OAAO;AAC3C,SAAO;AACT;AAEA,SAAS,cACP,QACA,WACA,YACsB;AACtB,SAAO;AAAA,IACL,SAAS,UAAU,YAAY,SAAS,UAAU;AAAA,IAClD,sBAAsB;AAAA,IACtB;AAAA,IACA;AAAA,IACA,yBAAyB;AAAA,IACzB,uBAAuB;AAAA,IACvB;AAAA,IACA,QAAQ,CAAC;AAAA,EACX;AACF;AAEA,SAAS,oBAAoB,QAAmD;AAC9E,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SAAO,OAAO;AAAA,IACZ,CAAC,QAAQ,UACP,iBAAiB,MAAM,UAAU,IAAI,iBAAiB,MAAM,IAAI,MAAM,aAAa;AAAA,IACrF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,OAAkC,eAAwC;AAChG,QAAM,sBAAsB,qBAAqB,MAAM,QAAQ,mBAAmB;AAClF,QAAM,aAAa,MAAM,WACtB,IAAI,kBAAkB,EACtB,KAAK,CAAC,GAAG,MAAM,oCAAoC,EAAE,KAAK,EAAE,GAAG,CAAC;AACnE,WAAS,QAAQ,GAAG,QAAQ,WAAW,QAAQ,SAAS,GAAG;AACzD,QAAI,WAAW,QAAQ,CAAC,EAAG,QAAQ,WAAW,KAAK,EAAG,KAAK;AACzD,YAAM,IAAI,MAAM,wCAAwC,WAAW,KAAK,EAAG,GAAG,EAAE;AAAA,IAClF;AAAA,EACF;AACA,MAAI,UAAU,WAAW,MAAM,GAAG,aAAa;AAC/C,MACE,uBACA,WAAW,KAAK,CAAC,cAAc,UAAU,QAAQ,mBAAmB,KACpE,CAAC,QAAQ,KAAK,CAAC,cAAc,UAAU,QAAQ,mBAAmB,GAClE;AACA,cAAU;AAAA,MACR,GAAG,QAAQ,MAAM,GAAG,KAAK,IAAI,GAAG,gBAAgB,CAAC,CAAC;AAAA,MAClD,WAAW,KAAK,CAAC,cAAc,UAAU,QAAQ,mBAAmB;AAAA,IACtE,EAAE,KAAK,CAAC,GAAG,MAAM,oCAAoC,EAAE,KAAK,EAAE,GAAG,CAAC;AAAA,EACpE;AACA,SAAO;AAAA,IACL,OAAO;AAAA,MACL,cAAc,iBAAiB,MAAM,cAAc,GAAG,OAAO,gBAAgB;AAAA,MAC7E,SAAS;AAAA,QACP,WAAW,MAAM,QAAQ,cAAc,qBAAqB,qBAAqB;AAAA,QACjF,UAAU,MAAM,QAAQ,aAAa,YAAY,YAAY;AAAA,QAC7D;AAAA,QACA,WAAW,iBAAiB,MAAM,QAAQ,WAAW,GAAG,eAAe;AAAA,QACvE,YAAY,qBAAqB,MAAM,QAAQ,UAAU;AAAA,QACzD,aACE,MAAM,QAAQ,gBAAgB,YAC1B,YACA,MAAM,QAAQ,gBAAgB,WAC5B,WACA;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,sBACE,MAAM,UAAU,yBAAyB,OACrC,OACA,iBAAiB,MAAM,UAAU,sBAAsB,GAAG,SAAS;AAAA,QACzE,YAAY,iBAAiB,MAAM,UAAU,YAAY,GAAG,SAAS;AAAA,QACrE,oBAAoB,iBAAiB,MAAM,UAAU,oBAAoB,GAAG,SAAS;AAAA,QACrF,qBAAqB,MAAM,UAAU,wBAAwB;AAAA,MAC/D;AAAA,MACA,YAAY;AAAA,IACd;AAAA,IACA,yBAAyB,WAAW,SAAS,QAAQ;AAAA,EACvD;AACF;AAEA,SAAS,mBAAmB,WAAyD;AACnF,SAAO;AAAA,IACL,KAAK,aAAa,UAAU,GAAG;AAAA,IAC/B,QACE,UAAU,WAAW,YACrB,UAAU,WAAW,mBACrB,UAAU,WAAW,UACjB,UAAU,SACV;AAAA,IACN,kBAAkB,UAAU,qBAAqB;AAAA,IACjD,qBAAqB;AAAA,MACnB,UAAU;AAAA,MACV;AAAA,MACA;AAAA,IACF;AAAA,IACA,kBAAkB,iBAAiB,UAAU,kBAAkB,GAAG,SAAS;AAAA,IAC3E,OAAO;AAAA,MACL,SAAS,qBAAqB,UAAU,MAAM,OAAO;AAAA,MACrD,WAAW,qBAAqB,UAAU,MAAM,SAAS;AAAA,MACzD,cAAc,yBAAyB,UAAU,MAAM,cAAc,GAAG,eAAe;AAAA,MACvF,YAAY,oBAAoB,UAAU,MAAM,UAAU;AAAA,IAC5D;AAAA,IACA,OAAO;AAAA,MACL,UAAU,wBAAwB,UAAU,MAAM,UAAU,GAAG,GAAG,CAAC;AAAA,MACnE,eAAe,yBAAyB,UAAU,MAAM,eAAe,GAAG,SAAS;AAAA,MACnF,cAAc,yBAAyB,UAAU,MAAM,cAAc,GAAG,eAAe;AAAA,MACvF,YAAY,oBAAoB,UAAU,MAAM,UAAU;AAAA,MAC1D,OAAO,oBAAoB,UAAU,MAAM,KAAK;AAAA,MAChD,wBAAwB;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,uBAAuB;AAAA,QACrB,UAAU,aAAa;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,yBAAyB;AAAA,QACvB,UAAU,aAAa;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,YAAY,oBAAoB,UAAU,aAAa,UAAU;AAAA,IACnE;AAAA,IACA,yBAAyB;AAAA,MACvB,uBAAuB;AAAA,QACrB,UAAU,wBAAwB;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,yBAAyB;AAAA,QACvB,UAAU,wBAAwB;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,YAAY,oBAAoB,UAAU,wBAAwB,UAAU;AAAA,IAC9E;AAAA,IACA,aAAa,CAAC,GAAG,IAAI,IAAI,UAAU,YAAY,IAAI,YAAY,CAAC,CAAC,EAC9D,KAAK,mCAAmC,EACxC,MAAM,GAAG,6CAA6C;AAAA,EAC3D;AACF;AAEA,SAAS,qBAAqB,QAA0D;AACtF,SAAO;AAAA,IACL,aAAa,wBAAwB,OAAO,aAAa,GAAG,KAAK,CAAC;AAAA,IAClE,kBAAkB,yBAAyB,OAAO,kBAAkB,GAAG,eAAe;AAAA,EACxF;AACF;AAEA,SAAS,gBAAgB,QAA4D;AACnF,QAAM,kBAAkB,iBAAiB,OAAO,iBAAiB,GAAG,eAAe;AACnF,QAAM,yBAAyB,gBAAgB,OAAO,wBAAwB,GAAG,GAAG,CAAC;AACrF,SAAO;AAAA,IACL,eAAe,iBAAiB,OAAO,eAAe,GAAG,iCAAiC;AAAA,IAC1F;AAAA,IACA,mBAAmB,iBAAiB,OAAO,mBAAmB,iBAAiB,eAAe;AAAA,IAC9F,8BAA8B,gBAAgB,OAAO,8BAA8B,GAAG,KAAK,CAAC;AAAA,IAC5F,iBAAiB,iBAAiB,OAAO,iBAAiB,GAAG,eAAe;AAAA,IAC5E;AAAA,IACA,gCAAgC;AAAA,MAC9B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,2BAA2B,iBAAiB,OAAO,2BAA2B,GAAG,SAAS;AAAA,IAC1F,sBAAsB,iBAAiB,OAAO,sBAAsB,GAAG,eAAe;AAAA,IACtF,sBAAsB,iBAAiB,OAAO,sBAAsB,GAAG,eAAe;AAAA,IACtF,kBAAkB,gBAAgB,OAAO,kBAAkB,GAAG,WAAW,CAAC;AAAA,IAC1E,mBAAmB,gBAAgB,OAAO,mBAAmB,GAAG,WAAW,CAAC;AAAA,IAC5E,yBAAyB,gBAAgB,OAAO,yBAAyB,GAAG,WAAW,CAAC;AAAA,IACxF,4BAA4B,gBAAgB,OAAO,4BAA4B,GAAG,WAAW,CAAC;AAAA,IAC9F,iCAAiC;AAAA,MAC/B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,iCAAiC;AAAA,MAC/B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,oBAAoB,gBAAgB,OAAO,oBAAoB,GAAG,KAAK,IAAI,CAAC;AAAA,IAC5E,0BAA0B,gBAAgB,OAAO,0BAA0B,GAAG,WAAW,CAAC;AAAA,IAC1F,6BAA6B;AAAA,MAC3B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,6BAA6B;AAAA,MAC3B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,+BAA+B;AAAA,MAC7B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,uBAAuB,gBAAgB,OAAO,uBAAuB,GAAG,WAAW,CAAC;AAAA,IACpF,wBAAwB,OAAO,2BAA2B;AAAA,IAC1D,wBAAwB,OAAO,2BAA2B;AAAA,IAC1D,6BAA6B;AAAA,MAC3B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,IACA,sBAAsB,OAAO,yBAAyB;AAAA,IACtD,iBAAiB,OAAO,oBAAoB;AAAA,IAC5C,wBAAwB,gBAAgB,OAAO,wBAAwB,GAAG,WAAW,CAAC;AAAA,EACxF;AACF;AAEA,SAAS,oBAAoB,OAAmD;AAC9E,SAAO,UAAU,UAAU,UAAU,YAAY,UAAU,QAAQ,QAAQ;AAC7E;AAEA,SAAS,oBAAoB,OAAmD;AAC9E,SAAO,UAAU,aAAa,UAAU,cAAc,QAAQ;AAChE;AAEA,SAAS,iBAAiB,YAA0C;AAClE,MAAI,eAAe,OAAQ,QAAO;AAClC,MAAI,eAAe,SAAU,QAAO;AACpC,MAAI,eAAe,MAAO,QAAO;AACjC,SAAO;AACT;AAEA,SAAS,gBACP,OACA,SACsB;AACtB,SAAO,iBAAiB,KAAK,IAAI,iBAAiB,OAAO,IAAI,QAAQ;AACvE;AAEA,SAAS,aAAa,OAAuB;AAC3C,MAAI,CAAC,0BAA0B,KAAK,KAAK,GAAG;AAC1C,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAqC;AACjE,SAAO,UAAU,OAAO,OAAO,aAAa,KAAK;AACnD;AAEA,SAAS,wBACP,OACA,KACA,KACA,UACe;AACf,SAAO,UAAU,OAAO,OAAO,gBAAgB,OAAO,KAAK,KAAK,QAAQ;AAC1E;AAEA,SAAS,gBAAgB,OAAe,KAAa,KAAa,UAA0B;AAC1F,QAAM,SAAS,OAAO,SAAS,KAAK,IAAI,QAAQ;AAChD,QAAM,UAAU,KAAK,IAAI,KAAK,KAAK,IAAI,KAAK,MAAM,CAAC;AACnD,QAAM,QAAQ,MAAM;AACpB,SAAO,KAAK,MAAM,UAAU,KAAK,IAAI;AACvC;AAEA,SAAS,yBAAyB,OAAsB,KAAa,KAA4B;AAC/F,SAAO,UAAU,OAAO,OAAO,iBAAiB,OAAO,KAAK,GAAG;AACjE;AAEA,SAAS,iBAAiB,OAAe,KAAa,KAAqB;AACzE,SAAO,KAAK,MAAM,gBAAgB,OAAO,KAAK,KAAK,CAAC,CAAC;AACvD;AAEA,SAAS,yBACP,OACA,eACsB;AACtB,QAAM,WAAW,aAAa,OAAO;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,UAAU,WAAW,SAAS,SAAS,CAAC,YAAY,SAAS,MAAM,CAAU;AACnF,QAAM,uBAAuB,kBAAkB,SAAS,oBAAoB;AAC5E,QAAM,SAAS,WAAW,SAAS,QAAQ;AAAA,IACzC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAU;AACV,QAAM,kBAAkB,aAAa,SAAS,WAAW;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,YAA2C;AAAA,IAC/C,SAAS,WAAW,gBAAgB,SAAS,CAAC,SAAS,MAAM,CAAU;AAAA,IACvE,QAAQ,WAAW,gBAAgB,QAAQ;AAAA,MACzC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAU;AAAA,IACV,sBAAsB,cAAc,gBAAgB,oBAAoB;AAAA,EAC1E;AACA,MAAI,CAAC,MAAM,QAAQ,SAAS,MAAM,KAAK,SAAS,OAAO,SAAS,cAAc,MAAM;AAClF,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,QAAM,SAAS,SAAS,OAAO,IAAI,qBAAqB;AACxD,MACE,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,YAAY,CAAC,EAAE,SAAS,OAAO,UACnE,OAAO,KAAK,CAAC,UAAU,CAAC,cAAc,IAAI,MAAM,YAAY,CAAC,GAC7D;AACA,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,QAAM,0BAA0B,cAAc,SAAS,uBAAuB;AAC9E,QAAM,wBAAwB,cAAc,SAAS,uBAAuB,GAAG,SAAS;AAExF,QAAM,kBAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,cAAc,CAAC,oBAAoB,sBAAsB,gBAAgB;AAC/E,QAAM,aACJ,YAAY,aACR,yBAAyB,QACzB,UAAU,YAAY,WACtB,gBAAgB,SAAS,MAA0C,KACnE,OAAO,KAAK,CAAC,UAAU,MAAM,iBAAiB,oBAAoB,IAClE,YAAY,UACV,yBAAyB,QACzB,WAAW,qBACX,UAAU,YAAY,UACtB,YAAY,SAAS,UAAU,MAAsC,IACrE,yBAAyB,QACzB,UAAU,YAAY,WACtB,YAAY,SAAS,MAAsC;AACnE,MACE,CAAC,cACD,wBAAwB,cAAc,QACtC,UAAU,0BAA0B,UAAU,WAAW,6BACxD,4BAA4B,YAAY,cAAc,0BAA0B,IACjF;AACA,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,iBAAiB,SAAS,UAAU;AAAA,IAChD;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,OAAmC;AAChE,QAAM,QAAQ,aAAa,OAAO;AAAA,IAChC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,SAA4B;AAAA,IAChC,cAAc,aAAa,aAAa,MAAM,YAAY,CAAC;AAAA,IAC3D,UAAU,cAAc,MAAM,QAAQ;AAAA,IACtC,iBACE,MAAM,oBAAoB,OACtB,OACA,WAAW,MAAM,iBAAiB;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAU;AAAA,IAChB,eAAe,mBAAmB,MAAM,eAAe,GAAG,OAAO,gBAAgB;AAAA,IACjF,eAAe,mBAAmB,MAAM,eAAe,GAAG,OAAO,gBAAgB;AAAA,IACjF,sBAAsB;AAAA,MACpB,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IACA,sBAAsB;AAAA,MACpB,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IACA,gBAAgB,mBAAmB,MAAM,gBAAgB,GAAG,OAAO,gBAAgB;AAAA,IACnF,qBAAqB,mBAAmB,MAAM,qBAAqB,GAAG,OAAO,gBAAgB;AAAA,IAC7F,sBAAsB;AAAA,MACpB,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IACA,YAAY,WAAW,MAAM,YAAY,CAAC,WAAW,WAAW,WAAW,CAAU;AAAA,IACrF,0BAA0B;AAAA,MACxB,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IACA,OAAO,mBAAmB,MAAM,OAAO,CAAC,OAAO,kBAAkB,OAAO,gBAAgB;AAAA,IACxF,YAAY,iBAAiB,MAAM,UAAU;AAAA,EAC/C;AACA,QAAM,gBACJ,OAAO,gBACP,OAAO,gBACP,OAAO,uBACP,OAAO,uBACP,OAAO,iBACP,OAAO,sBACP,OAAO,uBACP,OAAO;AACT,MAAI,OAAO,cAAc,OAAO,oBAAoB,SAAS,OAAO,UAAU,eAAe;AAC3F,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAgB,cAA0D;AAC9F,MACE,UAAU,QACV,OAAO,UAAU,YACjB,MAAM,QAAQ,KAAK,KACnB,CAAC,CAAC,OAAO,WAAW,IAAI,EAAE,SAAS,OAAO,eAAe,KAAK,CAAC,GAC/D;AACA,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,QAAM,SAAS;AACf,QAAM,aAAa,OAAO,KAAK,MAAM,EAAE,KAAK,mCAAmC;AAC/E,QAAM,oBAAoB,CAAC,GAAG,YAAY,EAAE,KAAK,mCAAmC;AACpF,MAAI,cAAc,UAAU,MAAM,cAAc,iBAAiB,GAAG;AAClE,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,SAAO;AACT;AAEA,SAAS,WAA8C,OAAgB,QAAsB;AAC3F,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,GAAG;AACxD,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,OAAsC;AAC9D,SAAO,WAAW,OAAO,CAAC,WAAW,OAAO,UAAU,MAAM,CAAU;AACxE;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI,OAAO,UAAU,SAAU,OAAM,IAAI,MAAM,2CAA2C;AAC1F,SAAO;AACT;AAEA,SAAS,kBAAkB,OAA+B;AACxD,SAAO,UAAU,OAAO,OAAO,aAAa,aAAa,KAAK,CAAC;AACjE;AAEA,SAAS,cAAc,OAAyB;AAC9C,MAAI,OAAO,UAAU,UAAW,OAAM,IAAI,MAAM,0CAA0C;AAC1F,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAgB,KAAa,KAAqB;AAC5E,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,OAAO,QAAQ,KAAK;AACtF,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,SAAO;AACT;AAEA,SAAS,cAAc,OAAgB,KAAa,KAAqB;AACvE,QAAM,SAAS,mBAAmB,OAAO,KAAK,GAAG;AACjD,MAAI,CAAC,OAAO,UAAU,MAAM,EAAG,OAAM,IAAI,MAAM,6CAA6C;AAC5F,SAAO;AACT;AAEA,SAAS,aAAa,OAAwB;AAC5C,MAAI,OAAO,UAAU,YAAY,CAAC,iBAAiB,KAAK,KAAK,GAAG;AAC9D,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAwB;AAC3C,QAAM,aAAa,cAAc,KAAK;AACtC,SAAO,WAAW,OAAO,IAAI,YAAY,EAAE,OAAO,UAAU,CAAC,CAAC;AAChE;AAEA,SAAS,uBACP,OACA,yBACQ;AAIR,SAAO,YAAY,EAAE,OAAO,wBAAwB,CAAC;AACvD;AAEA,SAAS,cAAc,OAAwB;AAC7C,SAAO,KAAK,UAAU,SAAS,KAAK,CAAC;AACvC;AAEA,SAAS,SAAS,OAAyB;AACzC,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,QAAQ;AACnD,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAgC,EAC5C,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,oCAAoC,MAAM,KAAK,CAAC,EAC1E,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,SAAS,KAAK,CAAC,CAAC;AAAA,IACjD;AAAA,EACF;AACA,SAAO;AACT;;;AC53CA,IAAM,8BAA8B;AACpC,IAAM,WAAW;AACjB,IAAM,sBAAsB;AAC5B,IAAM,eAAe;AACrB,IAAM,eAAe;AAYrB,IAAM,wBAAwB,oBAAI,IAAI;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,6BAA6B;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,oBACJ;AACF,IAAM,6BACJ;AAEF,IAAM,+BACJ;AACF,IAAM,wBAAwB;AAC9B,IAAM,yBAAyB;AAC/B,IAAM,oBAAoB;AAC1B,IAAM,uBAAuB;AAC7B,IAAM,uBAAuB,IAAI;AAAA,EAC/B;AAAA,EACA;AACF;AACA,IAAM,mCAAmC,IAAI;AAAA,EAC3C,WAAW,iBAAiB,WAAW,iBAAiB;AAAA,EACxD;AACF;AACA,IAAM,qCAAqC,IAAI;AAAA,EAC7C,UAAU,0BAA0B;AAAA,EACpC;AACF;AACA,IAAM,gCACJ;AAEF,IAAM,0BAA0B;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAQO,SAAS,qBAAqB,MAAuB;AAC1D,SAAO,sBAAsB,IAAI,mBAAmB,IAAI,CAAC;AAC3D;AAOO,SAAS,uBAAuB,MAAuB;AAC5D,SAAO,2BAA2B,KAAK,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC;AACxE;AAOO,SAAS,mBACd,KACA,eAA8C,CAAC,GACvC;AACR,SAAO,uBAAuB,KAAK,eAAe,YAAY,CAAC;AACjE;AAOO,SAAS,oBACd,MACA,eAA8C,CAAC,GACvC;AACR,MAAI,WAAW,uBAAuB,MAAM,eAAe,YAAY,CAAC;AAExE,aAAW,SAAS;AAAA,IAClB;AAAA,IACA,CAAC,OAAO,QAAgB,aAAqB;AAC3C,YAAM,QAAQ,SAAS,QAAQ;AAC/B,YAAM,qBAAqB,SAAS,MAAM,MAAM,MAAM;AACtD,YAAM,cAAc,MAAM,MAAM,qCAAqC;AACrE,UAAI,aAAa;AACf,cAAM,SAAS,YAAY,CAAC;AAC5B,cAAM,aAAa,YAAY,CAAC;AAChC,cAAM,aAAa,YAAY,CAAC;AAChC,YAAI,UAAU,cAAc,YAAY;AACtC,iBAAO,kBAAkB,WAAW,KAAK,CAAC,IACtC,QACA,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,kBAAkB;AAAA,QACrE;AAAA,MACF;AACA,aAAO,kBAAkB,KAAK,IAAI,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,kBAAkB;AAAA,IACrF;AAAA,EACF;AACA,aAAW,SAAS,QAAQ,uBAAuB,KAAK,QAAQ,EAAE;AAClE,aAAW,SAAS,QAAQ,wBAAwB,KAAK,QAAQ,EAAE;AACnE,aAAW,SAAS,QAAQ,mBAAmB,CAAC,QAAQ,WAAmB;AACzE,WAAO,GAAG,MAAM,GAAG,QAAQ;AAAA,EAC7B,CAAC;AACD,aAAW,SAAS,QAAQ,sBAAsB,KAAK,QAAQ,GAAG;AAClE,aAAW,SAAS,QAAQ,sBAAsB,KAAK,QAAQ,EAAE;AACjE,aAAW,SAAS;AAAA,IAClB;AAAA,IACA,CAAC,OAAO,QAAgB,OAAe,UACrC,kBAAkB,KAAK,IAAI,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,KAAK;AAAA,EAC3E;AACA,aAAW,SAAS;AAAA,IAClB;AAAA,IACA,CAAC,OAAO,QAAgB,UACtB,kBAAkB,KAAK,IAAI,QAAQ,GAAG,MAAM,GAAG,QAAQ;AAAA,EAC3D;AACA,aAAW,SAAS;AAAA,IAClB;AAAA,IACA,CACE,OACA,QACA,cACA,cACA,SACG;AACH,YAAM,QAAQ,gBAAgB,gBAAgB,QAAQ;AACtD,aAAO,kBAAkB,oBAAoB,KAAK,CAAC,IAAI,QAAQ,GAAG,MAAM,GAAG,QAAQ;AAAA,IACrF;AAAA,EACF;AACA,aAAW,WAAW,yBAAyB;AAC7C,eAAW,SAAS,QAAQ,SAAS,QAAQ;AAAA,EAC/C;AACA,SAAO;AACT;AAGO,SAAS,oBACd,OACA,eAA8C,CAAC,GAC5C;AACH,SAAO,wBAAwB,OAAO,cAAc,oBAAI,QAAgB,GAAG,CAAC;AAC9E;AAGO,SAAS,qBACd,cAC6B;AAC7B,QAAM,WAAW,eAAe,YAAY,EAAE,IAAI,CAAC,EAAE,QAAQ,MAAM,OAAO;AAAA,IACxE,MAAM,OAAO,MAAM,aAAa,QAAQ,EAAE;AAAA,IAC1C;AAAA,EACF,EAAE;AACF,SAAO,CAAC,UAAmB,oBAAoB,OAAO,QAAQ;AAChE;AAOO,SAAS,qBACd,YACA,eAA8C,CAAC,GACvC;AACR,MAAI;AACF,WAAO,KAAK,UAAU,oBAAoB,KAAK,MAAM,UAAU,GAAG,YAAY,CAAC;AAAA,EACjF,QAAQ;AACN,WAAO,oBAAoB,YAAY,YAAY;AAAA,EACrD;AACF;AAEO,SAAS,iBAAoB,OAAa;AAC/C,SAAO;AACT;AAEA,SAAS,wBACP,OACA,cACA,MACA,OACG;AACH,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,oBAAoB,OAAO,YAAY;AAAA,EAChD;AACA,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,iBAAiB,MAAM;AAChE,WAAO;AAAA,EACT;AACA,MAAI,SAAS,qBAAqB;AAChC,WAAO;AAAA,EACT;AACA,MAAI,KAAK,IAAI,KAAK,GAAG;AACnB,WAAO;AAAA,EACT;AACA,OAAK,IAAI,KAAK;AACd,MAAI;AACF,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,aAAO,MAAM,IAAI,CAAC,SAAS,wBAAwB,MAAM,cAAc,MAAM,QAAQ,CAAC,CAAC;AAAA,IACzF;AACA,QAAI,CAAC,cAAc,KAAK,GAAG;AACzB,aAAO;AAAA,IACT;AACA,UAAM,WAAW,oBAAI,IAAY;AACjC,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAC1C,cAAM,UAAU,cAAc,mBAAmB,KAAK,YAAY,GAAG,QAAQ;AAC7E,YAAI,qBAAqB,GAAG,GAAG;AAC7B,iBAAO,CAAC,SAAS,QAAQ;AAAA,QAC3B;AACA,YAAI,mBAAmB,GAAG,MAAM,WAAW;AACzC,iBAAO,CAAC,SAAS,gBAAgB,OAAO,cAAc,MAAM,QAAQ,CAAC,CAAC;AAAA,QACxE;AACA,eAAO,CAAC,SAAS,wBAAwB,OAAO,cAAc,MAAM,QAAQ,CAAC,CAAC;AAAA,MAChF,CAAC;AAAA,IACH;AAAA,EACF,UAAE;AACA,SAAK,OAAO,KAAK;AAAA,EACnB;AACF;AAEA,SAAS,gBACP,OACA,cACA,MACA,OACS;AACT,MAAI,CAAC,cAAc,KAAK,GAAG;AACzB,WAAO,wBAAwB,OAAO,cAAc,MAAM,KAAK;AAAA,EACjE;AACA,MAAI,SAAS,oBAAqB,QAAO;AACzC,MAAI,KAAK,IAAI,KAAK,EAAG,QAAO;AAC5B,OAAK,IAAI,KAAK;AACd,MAAI;AACF,UAAM,WAAW,oBAAI,IAAY;AACjC,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAC1C,cAAM,UAAU,cAAc,mBAAmB,KAAK,YAAY,GAAG,QAAQ;AAC7E,eAAO;AAAA,UACL;AAAA,UACA,uBAAuB,GAAG,IACtB,WACA,wBAAwB,OAAO,cAAc,MAAM,QAAQ,CAAC;AAAA,QAClE;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,UAAE;AACA,SAAK,OAAO,KAAK;AAAA,EACnB;AACF;AAEA,SAAS,eAAe,cAA+D;AACrF,QAAM,SAAS,oBAAI,IAAoB;AACvC,aAAW,UAAU,cAAc;AACjC,QAAI,OAAO,MAAM,SAAS,+BAA+B,OAAO,IAAI,OAAO,KAAK,GAAG;AACjF;AAAA,IACF;AACA,WAAO,IAAI,OAAO,OAAO,aAAa,eAAe,OAAO,IAAI,CAAC,GAAG;AAAA,EACtE;AACA,SAAO,CAAC,GAAG,MAAM,EACd,IAAI,CAAC,CAAC,OAAO,MAAM,OAAO,EAAE,QAAQ,MAAM,EAAE,EAC5C,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,SAAS,EAAE,MAAM,UAAU,EAAE,OAAO,cAAc,EAAE,MAAM,CAAC;AACvF;AAEA,SAAS,uBAAuB,MAAc,UAA6C;AACzF,MAAI,WAAW;AACf,aAAW,UAAU,UAAU;AAC7B,QAAI,SAAS,SAAS,OAAO,KAAK,GAAG;AACnC,iBAAW,SAAS,MAAM,OAAO,KAAK,EAAE,KAAK,OAAO,MAAM;AAAA,IAC5D;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,MAAc,UAA+B;AAClE,MAAI,YAAY;AAChB,MAAI,SAAS;AACb,SAAO,SAAS,IAAI,SAAS,GAAG;AAC9B,gBAAY,GAAG,IAAI,IAAI,MAAM;AAC7B,cAAU;AAAA,EACZ;AACA,WAAS,IAAI,SAAS;AACtB,SAAO;AACT;AAEA,SAAS,eAAe,MAAsB;AAC5C,QAAM,OAAO,KACV,YAAY,EACZ,QAAQ,gBAAgB,GAAG,EAC3B,QAAQ,YAAY,EAAE;AACzB,SAAO,KAAK,MAAM,GAAG,EAAE,KAAK;AAC9B;AAEA,SAAS,mBAAmB,MAAsB;AAChD,SAAO,KAAK,YAAY,EAAE,QAAQ,WAAW,EAAE;AACjD;AAEA,SAAS,cAAc,OAAkD;AACvE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,SAAO,cAAc,OAAO,aAAa,cAAc;AACzD;AAEA,SAAS,kBAAkB,OAAwB;AACjD,SAAO,sCAAsC,KAAK,KAAK;AACzD;AAEA,SAAS,oBAAoB,OAAuB;AAClD,MACE,MAAM,UAAU,MACd,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,KAC1C,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,IAC9C;AACA,WAAO,MAAM,MAAM,GAAG,EAAE;AAAA,EAC1B;AACA,SAAO;AACT;;;AC3WA,SAAS,KAAAC,UAAS;AAEX,IAAM,iDAAiD;AACvD,IAAM,gDAAgD;AACtD,IAAM,kDAAkD;AACxD,IAAM,mDAAmD;AAEzD,IAAM,iCAAiCA,GAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;AAGnE,IAAM,kCAAkCA,GAAE,KAAK,CAAC,UAAU,MAAM,CAAC;AAGjE,IAAM,6CAA6CA,GAAE,KAAK;AAAA,EAC/D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKM,IAAM,kDAAkDA,GAAE,KAAK;AAAA,EACpE;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKM,IAAM,2CAA2CA,GAAE,KAAK,CAAC,YAAY,UAAU,CAAC;AAKhF,IAAM,oCAAoCA,GAC9C,OAAO,EACP,IAAI,CAAC,EACL,IAAI,+CAA+C,EACnD,MAAM,qCAAqC;AAOvC,SAAS,2CAA2C,OAAuB;AAChF,SAAO,MAAM,UAAU,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,SAAS,GAAG,EAAE,QAAQ,OAAO,GAAG;AAC9F;AAEA,IAAM,iBAAiBA,GACpB,OAAO,EACP,UAAU,0CAA0C,EACpD,KAAK,iCAAiC;AAEzC,IAAM,cAAc;AAAA,EAClB,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS,kCAAkC,SAAS;AACtD;AAEA,SAAS,eACP,OAKA,SACM;AACN,MAAI,MAAM,SAAS,cAAc,MAAM,UAAU,YAAY,MAAM,YAAY,OAAO;AACpF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,OAAO;AAAA,MACd,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,UAAU,YAAY,MAAM,YAAY,MAAM;AACtD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,UAAU,WAAW,MAAM,SAAS,YAAY,MAAM,YAAY,OAAO;AACjF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAEO,IAAM,mCAAmCA,GAAE,OAAO,WAAW,EAAE,YAAY,cAAc;AAGzF,IAAM,uCAAuCA,GAAE,OAAO;AAAA,EAC3D,QAAQ;AAAA,EACR,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,gDAAgD,EAAE,SAAS;AAC7F,CAAC;AAKD,IAAM,wBAAwB;AAAA,EAC5B,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,aAAaA,GAAE,OAAO,EAAE,MAAM,gBAAgB;AAChD;AAEO,IAAM,6CAA6CA,GAAE,OAAO,qBAAqB;AAKjF,IAAM,qCAAqCA,GAAE,OAAO;AAAA,EACzD,GAAG;AAAA,EACH,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,GAAG;AAAA,EACH,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,8CAA8C;AAAA,EAC7E,YAAY;AAAA,EACZ,sBAAsBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACjD,oBAAoBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpC,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,iCAAiCA,GAAE,OAAO;AAAA,EACrD,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,GAAG;AAAA,EACH,YAAYA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,aAAaA,GAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EAC9C,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC7C,aAAaA,GAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAGM,IAAM,4CAA4CA,GAAE,OAAO;AAAA,EAChE,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,GAAG;AAAA,EACH,MAAM;AAAA,EACN,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC7C,aAAa,2CAA2C,SAAS;AAAA,EACjE,aAAa;AAAA,EACb,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAChC,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,6CAA6C;AAAA,EAC3E,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAKM,IAAM,+CAA+CA,GACzD,OAAO;AAAA,EACN,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS,eAAe,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC/C,SAASA,GACN,OAAO,EACP,IAAI,CAAC,EACL,IAAI,8CAA8C,EAClD,OAAO,CAAC,UAAU,MAAM,KAAK,EAAE,SAAS,GAAG,8CAA8C;AAAA,EAC5F,kBAAkB,gDAAgD,QAAQ,OAAO;AAAA,EACjF,oBAAoBA,GACjB,OAAO,EACP,IAAI,CAAC,EACL,IAAI,gDAAgD,EACpD,SAAS,EACT,QAAQ,IAAI;AAAA,EACf,sBAAsBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AACjE,CAAC,EACA,YAAY,cAAc;AAKtB,IAAM,qDAAqDA,GAC/D,OAAO;AAAA,EACN,sBAAsBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AACjE,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsCA,GAAE,OAAO;AAAA,EAC1D,MAAM,+BAA+B,SAAS;AAAA,EAC9C,OAAO,gCAAgC,SAAS;AAAA,EAChD,SAAS,eAAe,SAAS,EAAE,SAAS;AAAA,EAC5C,eAAeA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3D,OAAOA,GAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAC3D,CAAC;AAKM,IAAM,yCAAyCA,GAAE,OAAO;AAAA,EAC7D,WAAWA,GAAE,MAAM,kCAAkC;AAAA,EACrD,aAAaA,GAAE,MAAM,8BAA8B;AAAA,EACnD,kBAAkBA,GAAE,MAAM,yCAAyC;AAAA,EACnE,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC1D,CAAC;AAKM,IAAM,wCAAwCA,GAClD,OAAO;AAAA,EACN,gBAAgBA,GAAE,OAAO,EAAE,KAAK;AAAA,EAChC,cAAcA,GAAE,OAAO,EAAE,KAAK;AAChC,CAAC,EACA,OAAO,CAAC,UAAU,MAAM,mBAAmB,MAAM,cAAc;AAAA,EAC9D,SAAS;AAAA,EACT,MAAM,CAAC,cAAc;AACvB,CAAC;AAKI,IAAM,yCAAyCA,GAAE,OAAO;AAAA,EAC7D,MAAM;AAAA,EACN,IAAI;AAAA,EACJ,QAAQA,GAAE,QAAQ,SAAS;AAAA,EAC3B,MAAMA,GAAE,OAAO;AACjB,CAAC;AAKM,IAAM,4CAA4CA,GAAE,OAAO;AAAA,EAChE,2BAA2BA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtD,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,6CAA6C;AACpF,CAAC;AAKM,IAAM,4CAA4CA,GAAE,OAAO;AAAA,EAChE,kBAAkBA,GAAE,OAAO,EAAE,KAAK;AAAA,EAClC,2BAA2BA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3C,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,6CAA6C;AACpF,CAAC;AAKM,IAAM,+CAA+CA,GAAE,OAAO;AAAA,EACnE,MAAM;AAAA,EACN,OAAO;AACT,CAAC;AAKM,IAAM,6CAA6CA,GAAE,OAAO;AAAA,EACjE,MAAMA,GAAE,QAAQ,uCAAuC;AAAA,EACvD,SAASA,GAAE,OAAO;AAAA,EAClB,aAAa,+BAA+B,SAAS;AACvD,CAAC;;;ALvNM,IAAM,gBAAgBC,GAAE,KAAK;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQM,IAAM,iBAAiBA,GAAE,KAAK;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAIM,IAAM,YAAYA,GAAE,KAAK,CAAC,SAAS,SAAS,SAAS,CAAC;AAItD,IAAM,wBAAwBA,GAAE,KAAK;AAAA,EAC1C;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF,CAAC;AAoDM,IAAM,sBAAsB;AAM5B,IAAM,uBAAuB;AAM7B,IAAM,yBAAuE;AAAA,EAClF,OAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,gBAAgB,KAAK,KAAK,KAAK;AAAA,MAC/B,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,aAAa,gBAAgB,KAAK;AAAA,IACpD,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,MAAM;AAAA;AAAA,IACtE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,SAAS;AAAA,IACP,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,sBAAsB,gBAAgB,KAAK;AAAA,IAC7D,cAAc,EAAE,MAAM,eAAe,uBAAuB,MAAM;AAAA,IAClE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,SAAS;AAAA,IACP,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA,MACjE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,sBAAsB,gBAAgB,KAAK;AAAA,IAC7D,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,MAAM;AAAA;AAAA,IACtE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,KAAK;AAAA,IACH,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA;AAAA,MACjE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,sBAAsB,gBAAgB,KAAK;AAAA,IAC7D,cAAc,EAAE,MAAM,eAAe,uBAAuB,MAAM;AAAA,IAClE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA;AAAA,MACjE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,YAAY,gBAAgB,KAAK;AAAA,IACnD,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,KAAK;AAAA;AAAA,IACrE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,YAAY;AAAA,IACV,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,YAAY,gBAAgB,KAAK;AAAA,IACnD,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,MAAM;AAAA,IACtE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA,MACjE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,gBAAgB,IAAI,KAAK,KAAK;AAAA,MAC9B,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,YAAY,gBAAgB,KAAK;AAAA,IACnD,cAAc,EAAE,MAAM,eAAe,uBAAuB,MAAM;AAAA,IAClE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,cAAc,gBAAgB,KAAK;AAAA,IACrD,cAAc,EAAE,MAAM,cAAc,uBAAuB,MAAM;AAAA,IACjE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,OAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA,IAGT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,cAAc,gBAAgB,KAAK;AAAA,IACrD,cAAc,EAAE,MAAM,cAAc,uBAAuB,MAAM;AAAA,IACjE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,MAAM;AAAA,IACJ,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,OAAO,UAAU,KAAK;AAAA,MAC/C,UAAU,EAAE,WAAW,OAAO,WAAW,MAAM,KAAK,MAAM;AAAA,MAC1D,KAAK,EAAE,WAAW,MAAM;AAAA,MACxB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,QAAQ,gBAAgB,MAAM;AAAA,IAChD,cAAc,EAAE,MAAM,QAAQ,uBAAuB,MAAM;AAAA,IAC3D,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,YAAY;AAAA,IACV,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,SAAS,SAAS,SAAS,GAAG,SAAS,QAAQ;AAAA,IACjE,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,UAAU,KAAK,KAAK;AAAA;AAAA,MAC5D,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,MAKR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA;AAAA,IACpB;AAAA;AAAA;AAAA;AAAA,IAIA,UAAU,EAAE,MAAM,QAAQ,gBAAgB,MAAM;AAAA,IAChD,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,KAAK;AAAA,IACrE,eAAe;AAAA;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AACF;AAEO,IAAM,kBAAkBA,GAAE,KAAK,CAAC,QAAQ,WAAW,OAAO,UAAU,QAAQ,OAAO,CAAC;AAGpF,IAAM,YAAYA,GAAE,KAAK;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,OAAOA,GAAE,OAAO;AAAA,IACd,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,GAAG;AAAA,IACzC,MAAM;AAAA,IACN,SAASA,GAAE,OAAO;AAAA,IAClB,WAAWA,GAAE,QAAQ;AAAA,IACrB,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACtD,CAAC;AACH,CAAC;AAIM,IAAM,yBAAyB;AAC/B,IAAM,wBAAwBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,sBAAsB;AAGvF,IAAM,+BAA+BA,GACzC,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,IAAI,yBAAyB,CAAC;AAE1B,IAAM,+BAA+BA,GAAE,KAAK;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAIM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,8BAA8B;AAAA,EAC9B,sCAAsC,sBAAsB,SAAS;AAAA,EACrE,cAAc;AAAA,EACd,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,MAAMA,GAAE,KAAK,CAAC,+BAA+B,uCAAuC,CAAC;AAAA,EACrF,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACpC,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,aAAaA,GAAE,KAAK;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA,EACA;AACF,CAAC;AAWM,IAAM,sCAAsC;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAUO,IAAM,6BAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACO,IAAM,wBAAwBA,GAAE,KAAK,0BAA0B;AAO/D,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,oBAAoBC,aAAoB,UAA0B;AAChF,SAAO,GAAGA,WAAU,KAAK,QAAQ;AACnC;AAEO,IAAM,oBAAoBD,GAAE,KAAK,CAAC,SAAS,cAAc,SAAS,CAAC;AAGnE,IAAM,cAAcA,GAAE,KAAK,CAAC,YAAY,QAAQ,CAAC;AAGjD,IAAM,mBAAmBA,GAAE,KAAK,CAAC,QAAQ,UAAU,SAAS,CAAC;AAG7D,IAAM,kBAAkBA,GAAE,KAAK,CAAC,QAAQ,UAAU,SAAS,CAAC;AAG5D,IAAM,cAAcA,GAAE,KAAK,CAAC,SAAS,SAAS,QAAQ,CAAC;AAGvD,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAMA,GAAE,OAAO;AAAA,EACf,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACpC,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,YAAYA,GAAE,OAAO;AAAA,EAChC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,MAAMA,GAAE,OAAO;AAAA,EACf,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACpC,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhC,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIvC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,kBAAkBA,GAAE,OAAO;AAAA,IACzB,OAAOA,GAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAAA,IAClC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACvC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC5B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC;AAAA;AAAA,EAED,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,+BAA+BA,GACzC,OAAO;AAAA,EACN,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAClD,gBAAgBA,GAAE,KAAK,CAAC,WAAW,MAAM,CAAC;AAAA;AAAA,EAE1C,wBAAwBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnD,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACrD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,QAAQ,YAAY;AAChC,MAAI,OAAO,aAAa,kBAAkB,OAAO,mBAAmB,QAAQ;AAC1E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,OAAO,mBAAmB,UAAU,OAAO,2BAA2B,MAAM;AAC9E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,wBAAwB;AAAA,MAC/B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,OAAO,mBAAmB,aAAa,OAAO,2BAA2B,MAAM;AACjF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,wBAAwB;AAAA,MAC/B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,yBAAyBA,GAAE,KAAK;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,wBAAwBA,GAClC,OAAO;AAAA,EACN,mBAAmBA,GAAE,OAAO,EAAE,OAAO,EAAE,YAAY;AAAA,EACnD,iBAAiBA,GAAE,OAAO,EAAE,OAAO,EAAE,YAAY;AACnD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,MAAM,YAAY;AAC9B,MAAI,KAAK,kBAAkB,KAAK,mBAAmB;AACjD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,uBAAuBA,GACjC,OAAO;AAAA,EACN,IAAIA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACpC,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACpD,CAAC,EACA,OAAO;AAGH,IAAM,oBAAoBA,GAC9B,OAAO;AAAA,EACN,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,MAAM;AAAA,EACN,YAAYA,GAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvD,SAAS,qBAAqB,SAAS;AACzC,CAAC,EACA,OAAO;AAGH,IAAM,8BAA8BA,GACxC,OAAO;AAAA,EACN,kBAAkBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC5D,MAAM,sBAAsB,SAAS;AAAA,EACrC,YAAYA,GAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvD,SAAS,qBAAqB,SAAS;AAAA,EACvC,OAAOA,GAAE,MAAM,iBAAiB,EAAE,IAAI,GAAM,EAAE,SAAS;AACzD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,UAAU,YAAY;AAClC,MAAI,gBAAgB;AACpB,aAAW,CAAC,OAAO,IAAI,MAAM,SAAS,SAAS,CAAC,GAAG,QAAQ,GAAG;AAC5D,QAAI,KAAK,KAAK,oBAAoB,eAAe;AAC/C,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,SAAS,OAAO,QAAQ,mBAAmB;AAAA,QAClD,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,oBAAgB,KAAK,KAAK;AAC1B,QACE,SAAS,SACR,KAAK,KAAK,oBAAoB,SAAS,KAAK,qBAC3C,KAAK,KAAK,kBAAkB,SAAS,KAAK,kBAC5C;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,SAAS,OAAO,MAAM;AAAA,QAC7B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAGH,IAAM,yBAAyBA,GAC5B,OAAO;AAAA,EACN,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,OAAO,gBAAgB;AAAA,EACpE,YAAYA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EACA,OAAO;AAGH,IAAM,qBAAqBA,GAAE,mBAAmB,QAAQ;AAAA,EAC7D,uBAAuB,OAAO,EAAE,MAAMA,GAAE,QAAQ,sBAAsB,EAAE,CAAC;AAAA,EACzE,uBAAuB,OAAO;AAAA,IAC5B,MAAMA,GAAE,QAAQ,gBAAgB;AAAA,IAChC,mBAAmBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC9C,CAAC;AAAA,EACD,uBAAuB,OAAO;AAAA,IAC5B,MAAMA,GAAE,QAAQ,oBAAoB;AAAA,IACpC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACpC,MAAMA,GAAE,OAAO,EAAE,IAAI,GAAS;AAAA,IAC9B,UAAU,4BAA4B,SAAS;AAAA,EACjD,CAAC;AAAA,EACD,uBAAuB,OAAO;AAAA,IAC5B,MAAMA,GAAE,QAAQ,kBAAkB;AAAA,IAClC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACpC,MAAMA,GAAE,OAAO,EAAE,IAAI,GAAS;AAAA,IAC9B,sBAAsBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IAC/C,UAAU,4BAA4B,SAAS;AAAA,EACjD,CAAC;AAAA,EACD,uBAAuB,OAAO;AAAA,IAC5B,MAAMA,GAAE,QAAQ,OAAO;AAAA,IACvB,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,OAAO,gBAAgB;AAAA,IAC7E,SAASA,GAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,GAAa,EAAE,SAAS;AAAA,EACzE,CAAC;AAAA,EACD,uBAAuB,OAAO;AAAA,IAC5B,MAAMA,GAAE,QAAQ,sBAAsB;AAAA,IACtC,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,GAAM;AAAA,IAClD,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,CAAC;AAAA,EACD,uBAAuB,OAAO;AAAA,IAC5B,MAAMA,GAAE,QAAQ,eAAe;AAAA,IAC/B,MAAM;AAAA,IACN,aAAaA,GAAE,QAAQ;AAAA,EACzB,CAAC;AAAA,EACD,uBAAuB,OAAO;AAAA,IAC5B,MAAMA,GAAE,QAAQ,gBAAgB;AAAA,IAChC,QAAQA,GAAE,KAAK,CAAC,aAAa,aAAa,SAAS,UAAU,CAAC;AAAA,EAChE,CAAC;AACH,CAAC;AASM,IAAM,+BAA+BA,GACzC,OAAO;AAAA,EACN,SAASA,GAAE,QAAQ;AAAA,EACnB,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,SAAS,6BAA6B,SAAS;AAAA,EAC/C,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACpD,oBAAoBA,GAAE,QAAQ;AAAA,EAC9B,aAAaA,GACV,OAAO;AAAA,IACN,SAASA,GAAE,QAAQ;AAAA,IACnB,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACzD,CAAC,EACA,OAAO;AAAA,EACV,WAAWA,GACR,OAAO;AAAA,IACN,MAAMA,GAAE,KAAK,CAAC,QAAQ,iBAAiB,CAAC;AAAA,IACxC,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAC7D,CAAC,EACA,OAAO;AAAA,EACV,SAASA,GACN,OAAO;AAAA,IACN,sBAAsBA,GAAE,QAAQ;AAAA,IAChC,uBAAuBA,GAAE,QAAQ;AAAA,EACnC,CAAC,EACA,OAAO;AAAA,EACV,UAAUA,GACP,OAAO;AAAA,IACN,MAAMA,GAAE,KAAK,CAAC,YAAY,UAAU,CAAC;AAAA,IACrC,SAASA,GAAE,MAAM,4BAA4B,EAAE,IAAI,CAAC;AAAA,EACtD,CAAC,EACA,OAAO;AAAA,EACV,MAAMA,GACH,OAAO;AAAA,IACN,UAAUA,GAAE,QAAQ,KAAK;AAAA,IACzB,YAAYA,GAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,GAAM,EAAE,SAAS;AAAA,IACnE,aAAaA,GAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,GAAS,EAAE,SAAS;AAAA,EACzE,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO,EACP,YAAY,CAAC,QAAQ,YAAY;AAChC,MAAI,OAAO,WAAW,OAAO,iBAAiB,MAAM;AAClD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,OAAO,WAAW,OAAO,YAAY,MAAM;AAC7C,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,OAAO,WAAW,CAAC,OAAO,sBAAsB,OAAO,aAAa,MAAM;AAC5E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,UAAU;AAAA,MACjB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,OAAO,sBAAsB,OAAO,aAAa,MAAM;AACzD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,UAAU;AAAA,MACjB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,OAAO,YAAY,WAAW,OAAO,YAAY,gBAAgB,MAAM;AAC1E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,eAAe,aAAa;AAAA,MACnC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,OAAO,SAAS,SAAS,cAAc,OAAO,SAAS,QAAQ,SAAS,GAAG;AAC7E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,YAAY,SAAS;AAAA,MAC5B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,OAAO,SAAS,SAAS,cAAc,OAAO,SAAS,QAAQ,WAAW,GAAG;AAC/E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,YAAY,SAAS;AAAA,MAC5B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,aAAa,CAAC,OAAO,SAAS,GAAG,OAAO,SAAS,OAAO,EAC3D,OAAO,CAAC,WAAmD,WAAW,IAAI,EAC1E;AAAA,IAAI,CAAC,WACJ;AAAA,MACE,OAAO;AAAA,MACP,OAAO,SAAS;AAAA,MAChB,OAAO;AAAA,MACP,OAAO,0BAA0B;AAAA,MACjC,OAAO,UAAU;AAAA,IACnB,EAAE,KAAK,IAAQ;AAAA,EACjB;AACF,MAAI,IAAI,IAAI,UAAU,EAAE,SAAS,WAAW,QAAQ;AAClD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,YAAY,SAAS;AAAA,MAC5B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAMI,IAAM,0BAA0BA,GACpC,OAAO;AAAA,EACN,eAAeA,GAAE,QAAQ,EAAE,SAAS;AAAA,EACpC,eAAe,6BAA6B,SAAS;AAAA;AAAA;AAAA,EAGrD,qBAAqB,sBAAsB,SAAS,EAAE,SAAS;AACjE,CAAC,EACA,YAAY;AAIR,SAAS,8BAA8B,UAA4B;AACxE,QAAM,SAAS,wBAAwB,UAAU,YAAY,CAAC,CAAC;AAC/D,SAAO,OAAO,UAAU,OAAO,KAAK,kBAAkB,OAAO;AAC/D;AAKO,IAAM,iCAAiCA,GAC3C,OAAO;AAAA,EACN,eAAeA,GAAE,QAAQ,EAAE,SAAS;AAAA,EACpC,eAAe,6BAA6B,SAAS;AAAA,EACrD,qBAAqB,sBAAsB,SAAS,EAAE,SAAS;AACjE,CAAC,EACA,YAAY;AAGR,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACpC,CAAC;AAOM,IAAM,oCAAoCA,GAAE,OAAO;AAAA,EACxD,kBAAkBA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EAClF,eAAeA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAClF,CAAC;AAGD,IAAM,8BAA8B;AAAA,EAClC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAE3B,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACpC;AAGO,IAAM,2CAA2C;AAQjD,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,MAAMA,GAAE,QAAQ,SAAS;AAAA,EACzB,WAAWA,GACR,OAAO,EACP,IAAI,CAAC,EACL,IAAI,IAAI,EACR,OAAO,CAAC,UAAU,UAAU,0CAA0C;AAAA,IACrE,SAAS;AAAA,EACX,CAAC;AAAA;AAAA,EAEH,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAC7C,CAAC;AAQM,IAAM,uBAAuBA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAGpE,IAAM,0CAA0C,oBAAI,IAAI;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,8BAA8B,qBAAqB,YAAY,CAAC,OAAO,QAAQ;AAC1F,aAAW,OAAO,yCAAyC;AACzD,QAAI,OAAO,UAAU,eAAe,KAAK,OAAO,GAAG,GAAG;AACpD,UAAI,SAAS;AAAA,QACX,MAAMA,GAAE,aAAa;AAAA,QACrB,MAAM,CAAC,GAAG;AAAA,QACV,SAAS,GAAG,GAAG;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI;AACF,QAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa,MAAM;AACrE,UAAI,SAAS;AAAA,QACX,MAAMA,GAAE,aAAa;AAAA,QACrB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AACN,QAAI,SAAS;AAAA,MACX,MAAMA,GAAE,aAAa;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGM,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,MAAM,YAAY,SAAS;AAAA,EAC3B,aAAaA,GAAE,MAAM,UAAU;AAAA,EAC/B,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,SAAS;AACvD,CAAC;AAGM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,aAAaA,GAAE,MAAM,UAAU;AAAA,EAC/B,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGrD,kBAAkB,qBAAqB,SAAS;AAAA,EAChD,yBAAyB,4BAA4B,SAAS;AAChE,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,MAAM;AAAA,EACN,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,eAAeA,GAAE,MAAM,YAAY;AAAA,EACnC,iBAAiBA,GAAE,MAAM,WAAW;AAAA,EACpC,kBAAkBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,oBAAoBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACjD,CAAC;AAGM,IAAM,8BAA8BA,GACxC,OAAO;AAAA,EACN,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,aAAaA,GAAE,MAAM,UAAU,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,EAItC,kBAAkB,qBAAqB,SAAS;AAAA,EAChD,yBAAyB,4BAA4B,SAAS;AAAA;AAAA;AAAA,EAG9D,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA,EAGtC,oBAAoBA,GAAE,MAAM,qBAAqB,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM5D,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA,EAGnC,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC,EACA,YAAY,CAAC,SAAS,QAAQ;AAC7B,MAAI,QAAQ,2BAA2B,CAAC,QAAQ,kBAAkB;AAChE,QAAI,SAAS;AAAA,MACX,MAAMA,GAAE,aAAa;AAAA,MACrB,MAAM,CAAC,yBAAyB;AAAA,MAChC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,QAAQ,qBACP,QAAQ,WAAW,UAClB,QAAQ,cAAc,UACtB,QAAQ,wBAAwB,SAClC;AACA,QAAI,SAAS;AAAA,MACX,MAAMA,GAAE,aAAa;AAAA,MACrB,MAAM,CAAC,kBAAkB;AAAA,MACzB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGH,IAAM,6BAA6B;AACnC,IAAM,oCAAoC;AAE1C,eAAsB,yBACpB,QACA,SACiB;AACjB,QAAM,SAAS,4BAA4B,MAAM,OAAO;AACxD,QAAM,SAAS,OAAO,mBAClB,oCACA;AACJ,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,MAAM,CAAC;AAI7D,QAAM,YAAY,MAAM;AAAA,IACtB;AAAA,IACA,WAAW,oCAAoC,GAAG,MAAM,GAAG,cAAc,KAAK;AAAA,EAChF;AACA,SAAO,GAAG,MAAM,GAAG,cAAc,IAAI,SAAS;AAChD;AAEA,eAAsB,2BACpB,QACA,OACA,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACI;AAC7C,QAAM,SAAS,MAAM,WAAW,iCAAiC,IAC7D,oCACA,MAAM,WAAW,0BAA0B,IACzC,6BACA;AACN,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,OAAO,MAAM;AAC/C,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA,WAAW,oCAAoC,GAAG,MAAM,GAAG,cAAc,KAAK;AAAA,EAChF;AACA,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,4BAA4B,UAAU,OAAO;AAC7D,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,MACG,WAAW,uCACX,QAAQ,KAAK,qBAAqB,SACnC;AACA,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAaO,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,SAASA,GAAE,OAAO,EAAE,KAAK;AAAA,EACzB,cAAcA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE9B,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,qBACpB,QACA,SACiB;AACjB,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,wBAAwB,MAAM,OAAO,CAAC,CAAC;AAC7F,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,OAAO,cAAc,IAAI,SAAS;AAC3C;AAEA,eAAsB,uBACpB,QACA,OACA,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACA;AACzC,MAAI,CAAC,MAAM,WAAW,MAAM,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,OAAO,MAAM;AAC/C,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,QAAM,UAAU,wBAAwB,UAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC,CAAC;AAC7F,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAgBO,IAAM,qBAAqBA,GAAE,OAAO;AAAA;AAAA;AAAA,EAGzC,KAAKA,GAAE,QAAQ,QAAQ;AAAA,EACvB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA,EAG3B,oBAAoBA,GAAE,QAAQ;AAAA,EAC9B,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAClC,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,gBACpB,QACA,SACiB;AACjB,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,mBAAmB,MAAM,OAAO,CAAC,CAAC;AACxF,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,QAAQ,cAAc,IAAI,SAAS;AAC5C;AAUA,eAAsB,kBACpB,QACA,OACA,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACL;AACpC,MAAI,CAAC,MAAM,WAAW,OAAO,GAAG;AAC9B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,QAAQ,MAAM;AAChD,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,mBAAmB,UAAU,OAAO;AACpD,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAmBO,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE3B,UAAUA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE1B,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EAEzC,MAAMA,GAAE,KAAK,CAAC,QAAQ,SAAS,CAAC;AAAA;AAAA,EAEhC,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAGhC,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,gBACpB,QACA,SACiB;AACjB,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,mBAAmB,MAAM,OAAO,CAAC,CAAC;AACxF,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,OAAO,cAAc,IAAI,SAAS;AAC3C;AAYA,eAAsB,kBACpB,QACA,OACA,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACL;AACpC,MAAI,CAAC,MAAM,WAAW,MAAM,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,OAAO,MAAM;AAC/C,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,mBAAmB,UAAU,OAAO;AACpD,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAyBO,IAAM,oBAAoBA,GAAE,OAAO;AAAA;AAAA;AAAA,EAGxC,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE7B,SAASA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAEzB,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,eAAe,QAAgB,SAA6C;AAChG,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,kBAAkB,MAAM,OAAO,CAAC,CAAC;AACvF,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,OAAO,cAAc,IAAI,SAAS;AAC3C;AAWA,eAAsB,iBACpB,QACA,OACA,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACN;AACnC,MAAI,CAAC,MAAM,WAAW,MAAM,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,OAAO,MAAM;AAC/C,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,kBAAkB,UAAU,OAAO;AACnD,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAEO,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvC,mBAAmBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAC3D,CAAC;AAGM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAG5C,mBAAmBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAC3D,CAAC;AAGM,IAAM,SAASA,GAAE,OAAO;AAAA,EAC7B,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,MAAMA,GAAE,OAAO;AAAA,EACf,QAAQA,GAAE,OAAO;AAAA,EACjB,aAAaA,GAAE,MAAM,UAAU;AAAA,EAC/B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAaA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,aAAaA,GAAE,MAAM,UAAU,EAAE,IAAI,CAAC;AAAA,EACtC,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC;AAGM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,QAAQ;AAAA,EACR,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AACzB,CAAC;AAMM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,MAAMA,GAAE,OAAO;AAAA,EACf,aAAaA,GAAE,MAAM,UAAU;AAAA,EAC/B,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,SAASA,GAAE,MAAM,eAAe;AAClC,CAAC;AAGM,IAAM,4BAA4BA,GAAE,OAAO;AAAA;AAAA;AAAA,EAGhD,OAAOA,GAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,aAAaA,GAAE,MAAM,UAAU;AACjC,CAAC;AAGM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,aAAaA,GAAE,MAAM,UAAU;AACjC,CAAC;AAGM,IAAM,iBAAiBA,GAAE,KAAK;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA;AAAA,EAEA;AACF,CAAC;AAGM,IAAM,aAAaA,GAAE,OAAO;AAAA,EACjC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW;AAAA,EACX,UAAUA,GAAE,OAAO;AAAA,EACnB,MAAMA,GAAE,OAAO;AAAA,EACf,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxC,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,gBAAgBA,GAAE,OAAO;AAAA,EACzB,YAAYA,GAAE,OAAO;AAAA,EACrB,YAAYA,GAAE,OAAO;AAAA,EACrB,qBAAqBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzC,wBAAwBA,GAAE,OAAO,EAAE,SAAS;AAC9C,CAAC;AAGM,IAAM,cAAcA,GAAE,KAAK;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,yBAAyBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9D,wBAAwBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7D,0BAA0BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACzD,iCAAiCA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACtE,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,gCAAgCA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACrE,sCAAsCA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC7E,CAAC;AAGM,IAAM,mBAAmBA,GAAE,MAAM,CAACA,GAAE,QAAQ,GAAGA,GAAE,OAAO,GAAGA,GAAE,OAAO,GAAGA,GAAE,MAAMA,GAAE,OAAO,CAAC,CAAC,CAAC;AAG3F,IAAM,eAAeA,GAAE,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,GAAG,gBAAgB;AAGjE,IAAM,gBAAgBA,GAAE,mBAAmB,WAAW;AAAA,EAC3DA,GAAE,OAAO,EAAE,SAASA,GAAE,QAAQ,IAAI,EAAE,CAAC;AAAA,EACrCA,GAAE,OAAO;AAAA,IACP,SAASA,GAAE,QAAQ,KAAK;AAAA,IACxB,MAAMA,GAAE,OAAO;AAAA,IACf,SAASA,GAAE,OAAO;AAAA,EACpB,CAAC;AACH,CAAC;AAsBM,IAAM,sBAAsBA,GAAE,mBAAmB,WAAW;AAAA,EACjEA,GAAE,OAAO,EAAE,SAASA,GAAE,QAAQ,IAAI,GAAG,UAAUA,GAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAAA,EACtEA,GAAE,OAAO;AAAA,IACP,SAASA,GAAE,QAAQ,KAAK;AAAA,IACxB,QAAQA,GAAE,OAAO;AAAA,IACjB,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC1B,UAAUA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,CAAC;AACH,CAAC;AAcM,IAAM,wBAAwBA,GAAE,KAAK,CAAC,UAAU,UAAU,cAAc,CAAC;AAMzE,IAAM,yBAAyBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAGxD,IAAM,sBAAsBA,GAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAG3D,IAAM,0BAA0BA,GAAE,MAAM,CAACA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAGA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjF,IAAM,6BAA6BA,GAAE,OAAO;AAAA,EACjD,UAAU,sBAAsB,SAAS;AAAA,EACzC,qBAAqB,uBAAuB,SAAS;AAAA,EACrD,QAAQ,oBAAoB,SAAS;AAAA,EACrC,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,cAAc,wBAAwB,SAAS;AAAA,EAC/C,gBAAgB,wBAAwB,SAAS;AAAA,EACjD,WAAW,wBAAwB,SAAS;AAAA,EAC5C,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAC3C,CAAC;AA+OM,IAAM,6BAA6BA,GACvC,OAAO;AAAA;AAAA,EAEN,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAMA,GAAE,QAAQ,YAAY;AAC9B,CAAC,EACA,OAAO;AAGV,IAAM,8BAA8BA,GACjC,MAAM,0BAA0B,EAChC,IAAI,CAAC,EACL,IAAI,GAAG,EACP,YAAY,CAAC,WAAW,YAAY;AACnC,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,CAAC,OAAO,QAAQ,KAAK,UAAU,QAAQ,GAAG;AACnD,UAAM,MAAM,GAAG,SAAS,IAAI,KAAK,SAAS,EAAE;AAC5C,QAAI,KAAK,IAAI,GAAG,GAAG;AACjB,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM,CAAC,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AACA,SAAK,IAAI,GAAG;AAAA,EACd;AACF,CAAC;AAEI,IAAM,yBAAyBA,GACnC,OAAO;AAAA;AAAA,EAEN,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAEzC,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAE9C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAChC,MAAMA,GAAE,KAAK,CAAC,UAAU,WAAW,eAAe,WAAW,CAAC,EAAE,SAAS;AAAA,EACzE,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA,EAE5C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAErC,mBAAmB,4BAA4B,SAAS;AAAA,EACxD,cAAcA,GAAE,KAAK,CAAC,aAAa,SAAS,CAAC,EAAE,SAAS;AAC1D,CAAC,EACA,OAAO,EACP,YAAY,CAAC,WAAW,YAAY;AACnC,MAAI,CAAC,UAAU,kBAAmB;AAClC,MAAI,CAAC,UAAU,cAAc;AAC3B,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM,CAAC,cAAc;AAAA,IACvB,CAAC;AAAA,EACH;AACA,MAAI,CAAC,UAAU,UAAU;AACvB,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM,CAAC,UAAU;AAAA,IACnB,CAAC;AAAA,EACH;AACF,CAAC;AAuKI,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,eAAeA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC9B,UAAUA,GAAE,QAAQ,KAAK;AAAA,EACzB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,WAAWA,GACR,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAM,EACV;AAAA,IACC,CAAC,UAAU,OAAO,SAAS,KAAK,KAAK,KAAK,IAAI,QAAQ,KAAK,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI;AAAA,IACvF,EAAE,SAAS,oCAAoC;AAAA,EACjD;AAAA,EACF,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACvC,CAAC;AAGM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,mBAAmBA,GAAE,OAAO;AAAA,EAC5B,KAAKA,GAAE,OAAO,EAAE,IAAI;AACtB,CAAC;AAGM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,MAAMA,GAAE,QAAQ,YAAY;AAAA,EAC5B,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACpC,UAAU,sBAAsB,SAAS;AAAA,EACzC,qBAAqB,uBAAuB,SAAS;AAAA,EACrD,QAAQ,oBAAoB,SAAS;AAAA,EACrC,cAAc,wBAAwB,SAAS;AAAA,EAC/C,gBAAgB,wBAAwB,SAAS;AAAA,EACjD,WAAW,wBAAwB,SAAS;AAAA,EAC5C,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3D,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC3D,CAAC;AAGD,SAAS,2BAA2B,OAA+B;AACjE,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,KAAK,QAAQ,EAAG,QAAO;AAC9E,MAAI,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,KAAK,OAAO,KAAK,IAAI,GAAG;AACzE,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,SAAO;AACT;AAOO,SAAS,mCACd,UAC8B;AAC9B,MAAI,SAAS,SAAU,QAAO,SAAS;AACvC,MACE,2BAA2B,SAAS,oBAAoB,KACxD,2BAA2B,SAAS,kBAAkB,GACtD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOO,SAAS,oCACd,UACA,WAAyC,mCAAmC,QAAQ,GACrD;AAC/B,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,iBACJ,aAAa,WACT,2BAA2B,SAAS,wBAAwB,SAAS,cAAc,IACnF;AACN,SACE,SAAS,uBACT,SAAS,iBACR,iBAAiB,uBAAuB,cAAc,KAAK;AAEhE;AAEO,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,MAAMA,GAAE,QAAQ,MAAM;AAAA,EACtB,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACxC,CAAC;AAGM,IAAM,cAAcA,GAAE,mBAAmB,QAAQ,CAAC,uBAAuB,eAAe,CAAC;AAGzF,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAUO,SAAS,2BAA2B,MAAsB;AAC/D,QAAM,uBAAuB,KAAK,KAAK,EAAE,QAAQ,OAAO,GAAG;AAC3D,MACE,CAAC,wBACD,qBAAqB,WAAW,GAAG,KACnC,eAAe,KAAK,oBAAoB,KACxC,qBAAqB,SAAS,IAAI,GAClC;AACA,UAAM,IAAI,uBAAuB,gCAAgC,IAAI,EAAE;AAAA,EACzE;AACA,QAAM,WAAW,qBAAqB,MAAM,GAAG;AAC/C,MACE,SAAS;AAAA,IACP,CAAC,YACC,CAAC,WACD,YAAY,OACZ,YAAY,QACZ,yBAAyB,KAAK,OAAO,KACrC,QAAQ,KAAK,OAAO,KACpB,kDAAkD,KAAK,OAAO;AAAA,EAClE,GACA;AACA,UAAM,IAAI,uBAAuB,gCAAgC,IAAI,EAAE;AAAA,EACzE;AACA,SAAO,SAAS,KAAK,GAAG;AAC1B;AAGO,SAAS,2BAA2B,MAAsB;AAC/D,QAAM,WAAW,KACd,KAAK,EACL,QAAQ,OAAO,GAAG,EAClB,QAAQ,cAAc,EAAE;AAC3B,SAAO,2BAA2B,QAAQ;AAC5C;AAGO,SAAS,8BAA8B,MAAsB;AAClE,SAAO,2BAA2B,IAAI,EAAE,UAAU,MAAM,EAAE,YAAY;AACxE;AAQO,SAAS,2BAA2B,KAAqB;AAC9D,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,GAAG;AAAA,EACnB,QAAQ;AACN,UAAM,IAAI,uBAAuB,0CAA0C,GAAG,EAAE;AAAA,EAClF;AACA,MAAI,IAAI,aAAa,YAAY,CAAC,IAAI,MAAM;AAC1C,UAAM,IAAI,uBAAuB,0CAA0C,GAAG,EAAE;AAAA,EAClF;AACA,QAAM,iBAAiB,IAAI,SAAS,QAAQ,cAAc,EAAE,EAAE,QAAQ,UAAU,EAAE;AAClF,QAAM,WAAW,eAAe,MAAM,GAAG,EAAE,OAAO,OAAO;AACzD,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,IAAI,uBAAuB,+CAA+C,GAAG,EAAE;AAAA,EACvF;AACA,SAAO;AAAA,IACL,SAAS,mBAAmB,IAAI,KAAK,YAAY,CAAC,CAAC,IAAI,SAAS,KAAK,GAAG,CAAC;AAAA,EAC3E;AACF;AAGO,SAAS,kBAAkB,UAA+B;AAC/D,MAAI,SAAS,UAAW,QAAO,2BAA2B,SAAS,SAAS;AAC5E,SAAO,SAAS,SAAS,SACrB,2BAA2B,SAAS,SAAS,MAAM,EAAE,IACrD,2BAA2B,SAAS,GAAG;AAC7C;AAGO,SAAS,+BAA+B,WAAyC;AACtF,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,YAAY,WAAW;AAChC,UAAM,OAAO,kBAAkB,QAAQ;AACvC,UAAM,MAAM,8BAA8B,IAAI;AAC9C,QAAI,QAAQ,IAAI,GAAG,GAAG;AACpB,YAAM,IAAI,yBAAyB,4CAA4C,IAAI,EAAE;AAAA,IACvF;AACA,YAAQ,IAAI,GAAG;AAAA,EACjB;AACF;AAEO,IAAM,aAAaA,GAAE,KAAK,CAAC,kBAAkB,SAAS,UAAU,WAAW,SAAS,CAAC;AAGrF,IAAM,mBAAmBA,GAAE,KAAK;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,YAAYA,GAAE,OAAO;AAAA,EAChC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ;AAAA,EACR,UAAUA,GAAE,OAAO;AAAA,EACnB,cAAcA,GAAE,OAAO;AAAA,EACvB,aAAaA,GAAE,OAAO;AAAA,EACtB,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,QAAQA,GAAE,OAAO;AAAA,EACjB,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrC,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACrC,CAAC;AAGM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAUA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,QAAQA,GAAE,OAAO,EAAE,IAAI;AAAA,EACvB,iBAAiBA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC;AAAA,EAChD,WAAWA,GAAE,OAAO;AAAA,EACpB,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC1C,CAAC;AAGM,IAAM,6BAA6BA,GAAE,OAAO;AAAA,EACjD,MAAM;AACR,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,KAAKA,GAAE,OAAO,EAAE,IAAI;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,iBAAiBA,GAAE,KAAK,CAAC,UAAU,YAAY,SAAS,QAAQ,CAAC;AAGvE,IAAM,sBAAsBA,GAAE,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,qBAAqBA,GAAE,KAAK,CAAC,UAAU,UAAU,SAAS,CAAC;AAKjE,IAAM,qBAAqBA,GAAE,KAAK,CAAC,aAAa,SAAS,CAAC;AAS1D,IAAM,yBAAyBA,GAAE,KAAK;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAIM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EACnC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,OAAOA,GAAE,OAAO,EAAE,SAAS;AAC7B,CAAC;AAGM,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAMA,GAAE,OAAO;AAAA,EACf,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,WAAWA,GAAE,OAAO;AAAA,EAC/B,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ;AAAA,EACR,OAAOA,GAAE,OAAO;AAAA,EAChB,QAAQA,GAAE,OAAO;AAAA,EACjB,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,YAAY;AAAA,EACZ,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EAC3B,YAAY;AAAA,EACZ,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,aAAaA,GAAE,QAAQ;AAAA,EACvB,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,QAAQA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EAC1B,gBAAgB;AAAA,EAChB,UAAU,iBAAiB,SAAS;AAAA,EACpC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,SAASA,GAAE,OAAO,EAAE,KAAK;AAAA,EACzB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAYA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,OAAOA,GAAE,OAAO;AAAA,EAChB,MAAMA,GAAE,OAAO;AAAA,EACf,OAAOA,GAAE,OAAO;AAAA,EAChB,WAAW;AAAA,EACX,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,YAAY;AAAA,EACZ,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,kBAAkBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACtC,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAC7B,CAAC;AAGM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAaA,GAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAGM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,YAAY,oBAAoB,SAAS;AAAA,EACzC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,kBAAkBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC7C,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,iBAAiBA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EAChE,iBAAiBA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EAChE,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC1C,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC7C,YAAY,mBAAmB,SAAS;AAAA,EACxC,aAAaA,GAAE,QAAQ,EAAE,SAAS;AACpC,CAAC;AAQM,IAAM,6BAA6BA,GACvC,OAAO;AAAA,EACN,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAS,EAAE,SAAS;AAAA,EAChD,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,YAAY,mBAAmB,SAAS;AAAA,EACxC,aAAaA,GAAE,QAAQ,EAAE,SAAS;AACpC,CAAC,EACA,OAAO,CAAC,UAAW,MAAM,SAAS,YAAgB,MAAM,WAAW,SAAY;AAAA,EAC9E,SAAS;AACX,CAAC;AAKI,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC3C,CAAC;AAGM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAC7C,MAAM,mBAAmB,SAAS;AAAA,EAClC,aAAaA,GAAE,MAAM,mBAAmB,EAAE,SAAS;AAAA,EACnD,SAASA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC7C,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AACtD,CAAC;AAQM,IAAM,wBAAwBA,GAAE,KAAK;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,sBAAsBA,GAAE,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,MAAMA,GAAE,KAAK,CAAC,kBAAkB,YAAY,iBAAiB,UAAU,UAAU,CAAC;AAAA,EAClF,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,KAAKA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAChC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,OAAOA,GAAE,OAAO;AAAA,EAChB,MAAMA,GAAE,OAAO;AAAA,EACf,YAAYA,GAAE,MAAM,kBAAkB;AAAA,EACtC,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EACnC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,oBAAoBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/C,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKhC,QAAQA,GAAE,QAAQ;AAAA,EAClB,YAAYA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC3B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,gBAAgBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,WAAWA,GAAE,OAAO;AAAA,EACpB,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAQM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,QAAQ,sBAAsB,QAAQ,QAAQ;AAAA,EAC9C,MAAM,oBAAoB,QAAQ,UAAU;AAAA,EAC5C,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,WAAW;AAAA,EAC5C,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,YAAYA,GAAE,MAAM,kBAAkB,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClD,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA,EAChD,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,oBAAoBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/C,QAAQA,GAAE,QAAQ,EAAE,SAAS;AAAA,EAC7B,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACzC,CAAC;AAGM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,QAAQ,sBAAsB,SAAS;AAAA,EACvC,MAAM,oBAAoB,SAAS;AAAA,EACnC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,YAAYA,GAAE,MAAM,kBAAkB,EAAE,SAAS;AAAA,EACjD,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC9C,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACrD,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAEvC,QAAQA,GAAE,QAAQ,EAAE,SAAS;AAC/B,CAAC;AAIM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,QAAQ,sBAAsB,SAAS;AAAA,EACvC,MAAM,oBAAoB,SAAS;AAAA,EACnC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AACxD,CAAC;AAGM,IAAM,4BAA4BA,GAAE,KAAK,CAAC,UAAU,UAAU,SAAS,CAAC;AAIxE,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,MAAM,oBAAoB,SAAS;AAAA,EACnC,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACpD,MAAM,0BAA0B,SAAS;AAC3C,CAAC;AAGM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,QAAQ;AAAA,EACR,OAAOA,GAAE,OAAO;AAAA,EAChB,WAAW;AAAA,EACX,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAcA,GAAE,OAAO,EAAE,SAAS;AACpC,CAAC;AAGM,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,SAASA,GAAE,MAAM,2BAA2B;AAC9C,CAAC;AAGM,IAAM,UAAUA,GAAE,OAAO;AAAA,EAC9B,MAAMA,GAAE,QAAQ,KAAK;AAAA,EACrB,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOpB,UAAUA,GAAE,QAAQ,EAAE,SAAS;AACjC,CAAC;AAGD,IAAM,aAAa;AACZ,IAAM,qBAAqBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,UAAU;AAO7D,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,MAAMA,GAAE,KAAK,CAAC,qBAAqB,YAAY,aAAa,QAAQ,CAAC;AAAA,EACrE,wBAAwBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACrD,CAAC;AAGM,IAAM,yCAAyC;AAC/C,IAAM,8CAA8C;AAC3D,IAAM,+BAA+BA,GAClC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,2CAA2C,EAC/C,MAAM,UAAU;AACnB,IAAM,gCAAgCA,GACnC,MAAM,4BAA4B,EAClC,IAAI,sCAAsC;AAMtC,IAAM,6BAA6BA,GACvC,OAAO;AAAA,EACN,MAAMA,GAAE,KAAK,CAAC,qBAAqB,YAAY,aAAa,QAAQ,CAAC;AAAA,EACrE,wBAAwBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnD,aAAa;AAAA,EACb,cAAc;AAAA,EACd,cAAc;AAAA,EACd,YAAYA,GACT,OAAO;AAAA,IACN,OAAOA,GAAE,KAAK,CAAC,YAAY,UAAU,CAAC;AAAA,IACtC,aAAa;AAAA,EACf,CAAC,EACA,OAAO;AAAA,EACV,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,QAAQA,GACL,OAAO;AAAA,IACN,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACvC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACxC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACxC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACvC,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACzC,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,CAAC,EACA,OAAO;AAAA,EACV,cAAcA,GAAE,QAAQ;AAC1B,CAAC,EACA,OAAO;AAEV,IAAM,WAAWA,GACd,OAAO,EACP,IAAI,EACJ;AAAA,EACC,CAAC,UAAU;AACT,QAAI;AACF,aAAO,IAAI,IAAI,KAAK,EAAE,aAAa;AAAA,IACrC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,EAAE,SAAS,qBAAqB;AAClC;AAMK,IAAM,6CAA6C;AACnD,IAAM,wCAAwC,MAAM;AACpD,IAAM,2CAA2C;AACjD,IAAM,0BAA0B;AAEvC,IAAM,6BAA6BA,GAChC,OAAO,EACP,IAAI,CAAC,EACL,YAAY,CAAC,MAAM,QAAQ;AAC1B,MAAI,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,aAAa,0CAA0C;AACxF,QAAI,SAAS;AAAA,MACX,MAAMA,GAAE,aAAa;AAAA,MACrB,SAAS,2CAA2C,wCAAwC;AAAA,IAC9F,CAAC;AAAA,EACH;AACF,CAAC;AACH,IAAM,oCAAoCA,GACvC,MAAM,0BAA0B,EAChC,IAAI,0CAA0C,EAC9C,YAAY,CAAC,OAAO,QAAQ;AAC3B,QAAM,QAAQ,MAAM;AAAA,IAClB,CAAC,OAAO,SAAS,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE;AAAA,IACxD;AAAA,EACF;AACA,MAAI,QAAQ,uCAAuC;AACjD,QAAI,SAAS;AAAA,MACX,MAAMA,GAAE,aAAa;AAAA,MACrB,SAAS,yCAAyC,qCAAqC;AAAA,IACzF,CAAC;AAAA,EACH;AACF,CAAC,EACA,UAAU,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK,CAAC;AAC3C,IAAM,2BAA2BA,GAAE,MAAM,CAACA,GAAE,QAAQ,GAAG,iCAAiC,CAAC;AAGzF,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,IAAI;AAAA,EACJ,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,KAAK;AAAA,EACL,cAAcA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAClD,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,gBAAgBA,GAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAErC,iBAAiB,yBAAyB,SAAS;AAAA;AAAA;AAAA,EAGnD,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGnD,eAAe,uBAAuB,SAAS;AACjD,CAAC;AAGM,IAAM,kCAAkCA,GAAE,OAAO;AAAA,EACtD,IAAI;AAAA,EACJ,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC;AAC1C,CAAC;AAGM,IAAM,2BAA2BA,GACrC,OAAO;AAAA,EACN,IAAI;AAAA,EACJ,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,KAAK;AAAA,EACL,aAAaA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3C,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC7C,iBAAiB,yBAAyB,QAAQ,KAAK;AAAA,EACvD,eAAe,uBAAuB,SAAS,EAAE,QAAQ,IAAI;AAC/D,CAAC,EACA,OAAO;AAGH,IAAM,wCAAwCA,GAClD,OAAO;AAAA,EACN,iBAAiB;AACnB,CAAC,EACA,OAAO;AAKH,IAAM,yCAAyCA,GACnD,OAAO;AAAA,EACN,QAAQ;AAAA,EACR,eAAeA,GAAE,QAAQ,cAAc;AACzC,CAAC,EACA,OAAO;AAKH,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,cAAc,UAAqB,WAAiC;AAClF,QAAM,QAAQ,oBAAI,IAAqB;AACvC,QAAM,QAAkB,CAAC;AACzB,aAAW,QAAQ,CAAC,GAAG,UAAU,GAAG,SAAS,GAAG;AAC9C,UAAM,MAAM,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE;AACnC,UAAM,QAAQ,MAAM,IAAI,GAAG;AAC3B,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,KAAK,IAAI;AACnB,YAAM,KAAK,GAAG;AACd;AAAA,IACF;AAKA,QAAI,MAAM,aAAa,QAAQ,KAAK,aAAa,MAAM;AACrD,YAAM,EAAE,UAAU,UAAU,GAAG,OAAO,IAAI;AAC1C,YAAM,IAAI,KAAK,MAAM;AAAA,IACvB;AAAA,EACF;AACA,SAAO,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,GAAG,CAAE;AAC3C;AAEO,SAAS,kBACd,UACA,WACA,UAAyC,CAAC,GAC3B;AACf,MAAI,QAAQ,iBAAiB;AAC3B,mCAA+B,QAAQ;AAAA,EACzC;AACA,QAAM,MAAM,CAAC,GAAG,QAAQ;AACxB,QAAM,aAAa,IAAI;AAAA,IACrB,SAAS;AAAA,MACP,CAAC,aACC,CAAC,8BAA8B,kBAAkB,QAAQ,CAAC,GAAG,WAAW,QAAQ,CAAC;AAAA,IACrF;AAAA,EACF;AACA,QAAM,aAAa,IAAI;AAAA,IACrB,SAAS,IAAI,CAAC,aAAa,CAAC,oBAAoB,QAAQ,GAAG,WAAW,QAAQ,CAAC,CAAU;AAAA,EAC3F;AACA,QAAM,QAAQ,IAAI,IAAI,SAAS,IAAI,UAAU,CAAC;AAE9C,aAAW,YAAY,WAAW;AAChC,UAAM,aAAa,WAAW,QAAQ;AACtC,QAAI,MAAM,IAAI,UAAU,GAAG;AACzB;AAAA,IACF;AACA,QAAI,QAAQ,iBAAiB;AAC3B,YAAM,YAAY,kBAAkB,QAAQ;AAC5C,YAAM,kBAAkB,WAAW,IAAI,8BAA8B,SAAS,CAAC;AAC/E,UAAI,mBAAmB,oBAAoB,YAAY;AACrD,cAAM,IAAI,yBAAyB,4CAA4C,SAAS,EAAE;AAAA,MAC5F;AACA,YAAM,WAAW,oBAAoB,QAAQ;AAC7C,YAAM,mBAAmB,WAAW,IAAI,QAAQ;AAChD,UAAI,oBAAoB,qBAAqB,YAAY;AACvD,cAAM,IAAI;AAAA,UACR,yDAAyD,QAAQ;AAAA,QACnE;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,QAAQ;AACjB,UAAM,IAAI,UAAU;AACpB,eAAW,IAAI,oBAAoB,QAAQ,GAAG,UAAU;AACxD,eAAW,IAAI,8BAA8B,kBAAkB,QAAQ,CAAC,GAAG,UAAU;AAAA,EACvF;AACA,SAAO;AACT;AAEO,SAAS,2BACd,UACA,UACiB;AACjB,QAAM,QAAQ,SAAS;AACvB,SAAO,UAAU,UACf,UAAU,aACV,UAAU,SACV,UAAU,YACV,UAAU,UACV,UAAU,UACR,QACA;AACN;AAEO,SAAS,WAAW,OAAwB;AACjD,SAAO,KAAK,UAAUE,UAAS,KAAK,CAAC;AACvC;AAEO,SAAS,oBAAoB,UAA+B;AACjE,MAAI,SAAS,SAAS,QAAQ;AAC5B,WAAO,QAAQ,SAAS,MAAM;AAAA,EAChC;AACA,SAAO,cAAc,SAAS,GAAG;AACnC;AAEA,SAASA,UAAS,OAAyB;AACzC,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAIA,SAAQ;AAAA,EAC3B;AACA,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAK,EACjB,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EACrC,IAAI,CAAC,CAAC,KAAK,MAAM,MAAM,CAAC,KAAKA,UAAS,MAAM,CAAC,CAAC;AAAA,IACnD;AAAA,EACF;AACA,SAAO;AACT;AAEO,IAAM,oBAAoBF,GAAE,KAAK;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,oBAAoBA,GAAE,KAAK;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,sBAAsBA,GAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAGvD,IAAM,0BAA0BA,GAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAG3D,IAAM,oBAAoBA,GAAE,KAAK,CAAC,UAAU,UAAU,WAAW,CAAC;AAGlE,IAAM,uBAAuBA,GAAE,KAAK,CAAC,OAAO,SAAS,gBAAgB,CAAC;AAGtE,IAAM,0BAA0BA,GAAE,KAAK;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,+BAA+BA,GAAE,KAAK;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,gCAAgCA,GAAE,KAAK;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC3C,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC/C,eAAeA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EAC9D,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ;AAAA,EACR,MAAMA,GAAE,OAAO;AAAA,EACf,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,UAAUA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW;AAAA,EACX,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnC,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAChD,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC/C,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3D,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA;AAAA;AAAA,EAG1C,cAAc,wBAAwB,SAAS;AAAA,EAC/C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,WAAWA,GAAE,OAAO;AAAA,EAC/B,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC5C,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC7D,CAAC;AAGM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,QAAQA,GAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAAA,EACnC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACxC,CAAC;AAGM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClC,CAAC;AASM,IAAM,iCAAiCA,GAAE,MAAM;AAAA,EACpDA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,mBAAmB;AAAA,IACnC,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC7C,CAAC,EACA,OAAO;AAAA,EACVA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,UAAU,EAAE,SAAS;AAAA,IACrC,OAAOA,GAAE,MAAM,OAAO,EAAE,IAAI,EAAE;AAAA,IAC9B,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC7C,CAAC,EACA,OAAO;AACZ,CAAC;AASM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,QAAQA,GAAE,QAAQ;AAAA,EAClB,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAC3D,CAAC;AAYM,IAAM,6BAA6BA,GAAE,OAAO;AAAA,EACjD,SAASA,GAAE,QAAQ,IAAI;AACzB,CAAC;AAYM,IAAM,2BAA2B;AAGjC,IAAM,yBAAyB,KAAK,UAAU;AAAA,EACnD,CAAC,wBAAwB,GAAG;AAC9B,CAAC;AAUM,SAAS,sBAAsB,YAAgD;AACpF,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,UAAU;AACpC,WACE,OAAO,WAAW,YAClB,WAAW,QACV,OAAmC,wBAAwB,MAAM;AAAA,EAEtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,IAAM,+BAA+BA,GAAE,OAAO,CAAC,CAAC,EAAE,OAAO;AAIzD,IAAM,8BAA8BA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA,EAIlD,QAAQA,GAAE,KAAK,CAAC,WAAW,aAAa,MAAM,CAAC;AAAA,EAC/C,SAASA,GAAE,OAAO;AACpB,CAAC;AAQM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,MAAMA,GAAE,KAAK,CAAC,WAAW,SAAS,CAAC;AAAA,EACnC,GAAG;AACL,CAAC;AAYM,IAAM,8BAA8BA,GAAE,KAAK;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,gCAAgCA,GAAE,KAAK;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,4BAA4BA,GAAE,mBAAmB,QAAQ;AAAA,EACpEA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,SAAS;AAAA,IACzB,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC3B,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,eAAe;AAAA;AAAA,IAE/B,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC3B,iBAAiBA,GAAE,OAAO,EAAE,KAAK;AAAA,IACjC,qBAAqBA,GAAE,OAAO,EAAE,KAAK;AAAA,IACrC,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,IACxB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,IAC3B,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,IAE/C,WAAW;AAAA,IACX,kBAAkB;AAAA,EACpB,CAAC;AACH,CAAC;AAGM,IAAM,6BAA6BA,GAAE,OAAO;AAAA,EACjD,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE3B,eAAeA,GAAE,OAAO,EAAE,KAAK;AACjC,CAAC;AAYM,IAAM,+BAA+BA,GAAE,mBAAmB,WAAW;AAAA,EAC1EA,GAAE,OAAO;AAAA,IACP,SAASA,GAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOvB,sBAAsBA,GAAE,KAAK,CAAC,UAAU,MAAM,CAAC,EAAE,SAAS;AAAA;AAAA,IAE1D,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAK,EAAE,IAAI,GAAM,EAAE,SAAS;AAAA,EACvE,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,SAASA,GAAE,QAAQ,KAAK;AAAA,IACxB,QAAQA,GAAE,KAAK,CAAC,aAAa,aAAa,SAAS,CAAC;AAAA,EACtD,CAAC;AACH,CAAC;AAUM,IAAM,2CAA2C;AAEjD,IAAM,gCAAgCA,GAAE,mBAAmB,QAAQ;AAAA,EACxEA,GAAE,OAAO,EAAE,MAAMA,GAAE,QAAQ,KAAK,EAAE,CAAC;AAAA,EACnCA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,QAAQ;AAAA,IACxB,gBAAgBA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,wCAAwC;AAAA,IACvF,YAAYA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,wCAAwC;AAAA,EACrF,CAAC;AACH,CAAC;AAsBM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,gBAAgBA,GAAE,OAAO,EAAE,KAAK;AAAA,EAChC,oBAAoBA,GAAE,OAAO;AAAA,EAC7B,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,UAAUA,GAAE,OAAO,EAAE,IAAI;AAAA,EACzB,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,WAAWA,GAAE,MAAM,WAAW;AAAA,EAC9B,OAAOA,GAAE,MAAM,OAAO;AAAA;AAAA;AAAA;AAAA,EAItB,eAAeA,GAAE,QAAQ,EAAE,SAAS;AAAA,EACpC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,iBAAiB;AAAA,EACjB,gBAAgB;AAAA;AAAA,EAEhB,WAAW,UAAU,SAAS;AAAA,EAC9B,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnC,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAClD,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EACzC,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,MAAMA,GAAE,KAAK,CAAC,WAAW,WAAW,CAAC;AAAA,EACrC,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAGM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,OAAOA,GAAE,KAAK,CAAC,YAAY,WAAW,WAAW,CAAC;AAAA,EAClD,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,oBAAoB;AAAA,EACpB,yBAAyB,wBAAwB,SAAS;AAAA,EAC1D,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC;AAC9B,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,OAAO;AAAA,EACP,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC7C,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,aAAa;AAAA,EACb,gBAAgB,wBAAwB,SAAS;AAAA,EACjD,wBAAwBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACrD,UAAUA,GAAE,MAAM,uBAAuB;AAAA,EACzC,eAAeA,GAAE,MAAM,4BAA4B;AAAA,EACnD,UAAUA,GACP,OAAO;AAAA,IACN,eAAeA,GAAE,OAAO,EAAE,KAAK;AAAA,IAC/B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,CAAC,EACA,SAAS;AAAA,EACZ,YAAYA,GACT,OAAO;AAAA,IACN,OAAOA,GAAE,QAAQ,UAAU;AAAA,IAC3B,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACxC,0BAA0BA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACvD,wBAAwBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvD,CAAC,EACA,SAAS;AACd,CAAC;AAGM,IAAM,kCAAkC;AAC/C,IAAM,sBAAsBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,+BAA+B;AAE1E,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,+BAA+B;AAAA,EACnE,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,wBAAwBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAChE,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC7D,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACzD,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3D,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,MAAMA,GAAE,OAAO;AAAA,EACf,WAAWA,GAAE,MAAM,WAAW;AAAA,EAC9B,OAAOA,GAAE,MAAM,OAAO;AAAA;AAAA;AAAA,EAGtB,eAAeA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACxC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,iBAAiB;AAAA,EACjB,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,eAAe;AAAA,EACf,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACnD,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC3C,CAAC;AAGM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,eAAe;AAAA,EACf,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpD,cAAcA,GAAE,QAAQ;AAC1B,CAAC;AAGM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,eAAe;AAAA,EACf,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAC1C,CAAC;AAGM,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,eAAe;AAAA,EACf,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACrC,CAAC;AAGM,IAAM,2BAA2B,cAAc,KAAK;AAAA,EACzD,MAAM;AAAA,EACN,WAAW;AAAA,EACX,OAAO;AAAA,EACP,eAAe;AAAA,EACf,OAAO;AAAA,EACP,iBAAiB;AACnB,CAAC,EAAE,OAAO,EAAE,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAQvD,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,gBAAgB,eAAe,SAAS;AAAA,EACxC,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAClC,MAAM,SAAS,SAAS;AAAA,EACxB,0BAA0BA,GAAE,MAAM,UAAU,EAAE,SAAS;AACzD,CAAC;AAIM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,MAAMA,GAAE,OAAO;AAAA,EACf,WAAWA,GAAE,MAAM,WAAW;AAAA,EAC9B,OAAOA,GAAE,MAAM,OAAO;AAAA;AAAA,EAEtB,eAAeA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACxC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,iBAAiB;AAAA,EACjB,SAAS;AAAA,EACT,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,6BAA6B,gBAAgB,KAAK;AAAA,EAC7D,MAAM;AAAA,EACN,WAAW;AAAA,EACX,OAAO;AAAA,EACP,eAAe;AAAA,EACf,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB,SAAS;AACX,CAAC,EAAE,OAAO,EAAE,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAGvD,IAAM,qCAAqC,IAAI;AAC/C,IAAM,oCAAoC;AAC1C,IAAM,oCAAoC,KAAK;AAEtD,IAAM,yBAAyBA,GAC5B,OAAO,EACP,IAAI,CAAC,EACL,OAAO,CAAC,UAAU,CAAC,MAAM,SAAS,IAAQ,GAAG,mCAAmC,EAChF;AAAA,EACC,CAAC,UAAU,0BAA0B,KAAK,KAAK;AAAA,EAC/C,0BAA0B,kCAAkC;AAC9D;AAEK,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,QAAQA,GAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,EAClC,QAAQ,uBAAuB,SAAS;AAAA,EACxC,eAAe;AAAA,EACf,qBAAqBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAClD,CAAC;AAGM,IAAM,mCAAmCA,GAAE,OAAO;AAAA,EACvD,QAAQA,GAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,EAClC,QAAQ,uBAAuB,SAAS;AAAA,EACxC,eAAe;AAAA,EACf,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAC5D,CAAC;AAGM,IAAM,oCAAoCA,GAAE,OAAO;AAAA,EACxD,SAAS;AAAA,EACT,OAAO;AAAA,EACP,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAChD,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC1C,CAAC;AAQM,IAAM,kCAAkCA,GAAE,OAAO;AAAA,EACtD,WAAWA,GAAE,QAAQ,IAAI;AAAA,EACzB,SAASA,GAAE,KAAK;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC7C,QAAQA,GAAE;AAAA,IACRA,GAAE,OAAO;AAAA,MACP,OAAOA,GAAE,KAAK,CAAC,UAAU,OAAO,CAAC;AAAA,MACjC,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MAC5C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,MAC7C,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IAC7C,CAAC;AAAA,EACH;AAAA,EACA,cAAcA,GAAE,OAAO;AAAA,IACrB,WAAWA,GAAE,QAAQ,KAAK;AAAA,IAC1B,QAAQA,GAAE,QAAQ,cAAc;AAAA,EAClC,CAAC;AACH,CAAC;AAGM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,MAAMA,GAAE,QAAQ,2BAA2B;AAAA,EAC3C,OAAOA,GAAE,KAAK,CAAC,aAAa,SAAS,CAAC;AAAA,EACtC,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,QAAQA,GAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,EAClC,WAAWA,GAAE,QAAQ;AAAA,EACrB,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,YAAYA,GAAE,OAAO;AAAA,EACrB,YAAY,gCAAgC,SAAS,EAAE,SAAS;AAClE,CAAC;AAYM,SAAS,0BAA0B,OAAuB;AAC/D,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AACzC;AAOO,SAAS,2BACd,OACA,UAA6C,CAAC,GACvB;AACvB,QAAM,iBAAiB,IAAI;AAAA,KACxB,MAAM,YAAY,UAAU,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,OAAO,KAAK,CAAU;AAAA,EAC/E;AACA,QAAM,SACJ,MAAM,WAAW,OACb,OACA,0BAA0B,MAAM,QAAQ,kCAAkC;AAChF,QAAM,QAAQ,0BAA0B,MAAM,OAAO,iCAAiC;AACtF,QAAM,cAAc,WAAW,OAAO,IAAI,0BAA0B,MAAM;AAC1E,QAAM,aAAa,0BAA0B,KAAK;AAClD,QAAM,sBACJ,MAAM,WAAW,OACb,OACA,KAAK;AAAA,IACH,0BAA0B,MAAM,MAAM;AAAA,IACtC,wCAAwC,QAAQ,mBAAmB;AAAA,IACnE,eAAe,IAAI,QAAQ,GAAG,iBAAiB;AAAA,EACjD;AACN,QAAM,qBAAqB,KAAK;AAAA,IAC9B,0BAA0B,MAAM,KAAK;AAAA,IACrC,wCAAwC,QAAQ,kBAAkB;AAAA,IAClE,eAAe,IAAI,OAAO,GAAG,iBAAiB;AAAA,EAChD;AACA,QAAM,SAAoD,CAAC;AAC3D,MAAI,wBAAwB,QAAQ,sBAAsB,aAAa;AACrE,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,eAAe;AAAA,MACf,gBAAgB;AAAA,MAChB,cAAc,sBAAsB;AAAA,IACtC,CAAC;AAAA,EACH;AACA,MAAI,qBAAqB,YAAY;AACnC,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,eAAe;AAAA,MACf,gBAAgB;AAAA,MAChB,cAAc,qBAAqB;AAAA,IACrC,CAAC;AAAA,EACH;AACA,MAAI,OAAO,WAAW,KAAK,MAAM,cAAc,MAAM;AACnD,QAAI,sBAAsB,KAAK,IAAI,mCAAmC;AACpE,YAAM,IAAI,WAAW,sDAAsD;AAAA,IAC7E;AACA,WAAO;AAAA,EACT;AAEA,QAAM,aAA8C;AAAA,IAClD,WAAW;AAAA,IACX,SAAS,MAAM,YAAY,WAAW,QAAQ,WAAW;AAAA,IACzD,gBAAgB;AAAA,IAChB;AAAA,IACA,cAAc,EAAE,WAAW,OAAO,QAAQ,eAAe;AAAA,EAC3D;AACA,QAAM,UAAiC;AAAA,IACrC,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,uCAAqC,SAAS,UAAU;AACxD,QAAM,iBAAiB,sBAAsB,OAAO;AACpD,MAAI,iBAAiB,mCAAmC;AACtD,UAAM,IAAI;AAAA,MACR,+DAA+D,cAAc,MAAM,iCAAiC;AAAA,IACtH;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,0BAA0B,OAAe,UAA0B;AAC1E,QAAMG,WAAU,IAAI,YAAY;AAChC,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,QAAQA,SAAQ,OAAO,KAAK;AAClC,MAAI,MAAM,cAAc,SAAU,QAAO;AACzC,QAAM,SAAS;AACf,QAAM,eAAe,KAAK,IAAI,GAAG,WAAWA,SAAQ,OAAO,MAAM,EAAE,UAAU;AAC7E,MAAI,YAAY,KAAK,IAAI,cAAc,MAAM,UAAU;AACvD,SAAO,YAAY,KAAK,YAAY,MAAM,eAAe,MAAM,SAAS,IAAK,SAAU,KAAM;AAC3F,iBAAa;AAAA,EACf;AACA,SAAO,GAAG,QAAQ,OAAO,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,GAAG,MAAM;AACjE;AAEA,SAAS,wCAAwC,OAA0C;AACzF,SAAO,UAAU,QAAQ,UAAU,UAAa,CAAC,OAAO,SAAS,KAAK,IAClE,IACA,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,CAAC;AACnC;AAEA,SAAS,qCACP,OACA,YACM;AACN,WAAS,UAAU,GAAG,UAAU,IAAI,WAAW,GAAG;AAChD,UAAMC,kBAAiB,sBAAsB,KAAK;AAClD,QAAI,WAAW,mBAAmBA,gBAAgB;AAClD,eAAW,iBAAiBA;AAAA,EAC9B;AACA,QAAM,iBAAiB,sBAAsB,KAAK;AAClD,MAAI,WAAW,mBAAmB,gBAAgB;AAChD,UAAM,IAAI,WAAW,0DAA0D;AAAA,EACjF;AACF;AAEO,IAAM,6BAA6BJ,GAAE,KAAK,CAAC,WAAW,WAAW,mBAAmB,MAAM,CAAC;AAG3F,IAAM,0BAA0BA,GAAE,KAAK;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,6BAA6BA,GAAE,mBAAmB,QAAQ;AAAA,EACrEA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,sBAAsB;AAAA,IACtC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACtB,iBAAiBA,GAAE,OAAO,EAAE,KAAK;AAAA,IACjC,oBAAoBA,GAAE,OAAO,EAAE,KAAK;AAAA,IACpC,WAAWA,GAAE,MAAM,WAAW,EAAE,SAAS;AAAA,IACzC,OAAOA,GAAE,MAAM,OAAO,EAAE,SAAS;AAAA,EACnC,CAAC,EACA,YAAY;AAAA,EACfA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,mBAAmB;AAAA,IACnC,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,IACxB,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACvC,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACxB,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,CAAC,EACA,YAAY;AAAA,EACfA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,eAAe;AAAA,IAC/B,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACtB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,CAAC,EACA,YAAY;AAAA,EACfA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,yBAAyB;AAAA,IACzC,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC7B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,CAAC,EACA,YAAY;AAAA,EACfA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,uBAAuB;AAAA,IACvC,gBAAgBA,GAAE,OAAO,EAAE,KAAK;AAAA,IAChC,QAAQA,GAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;AAAA,EACnC,CAAC,EACA,YAAY;AACjB,CAAC;AAGM,IAAM,2BAA2BA,GAAE,KAAK;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,MAAM;AAAA,EACN,gBAAgB;AAAA,EAChB,UAAUA,GAAE,OAAO;AAAA,EACnB,WAAWA,GAAE,OAAO;AAAA,EACpB,SAASA,GAAE,OAAO;AAAA,EAClB,SAAS;AAAA,EACT,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EACzC,OAAO;AAAA,EACP,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM5C,wBAAwBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnD,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAWA,GAAE,OAAO;AACtB,CAAC;AAQM,IAAM,6BAA6B,oBAAoB,KAAK;AAAA,EACjE,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,MAAM;AAAA,EACN,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,SAAS;AAAA,EACT,WAAW;AACb,CAAC;AAGM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACtC,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQlB,yBAAyBA,GAAE,QAAQ;AAAA,EACnC,OAAOA,GAAE,MAAM,WAAW;AAAA;AAAA,EAE1B,eAAeA,GAAE,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjD,wBAAwBA,GACrB,OAAO;AAAA,IACN,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,IACxB,UAAUA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;AAAA,EAC5C,CAAC,EACA,SAAS;AACd,CAAC;AAQM,SAAS,+BACd,SAMQ;AACR,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,IAAI,UAAU,4DAA4D;AAAA,EAClF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,KAAK,UAAU;AAAA,MACb,SAAS,QAAQ,IAAI,CAAC,YAAY;AAAA,QAChC,IAAI,OAAO;AAAA,QACX,MAAM,OAAO;AAAA,QACb,gBAAgB,OAAO;AAAA,QACvB,UAAU,OAAO;AAAA,QACjB,SAAS,OAAO;AAAA,QAChB,SAAS,OAAO;AAAA,QAChB,SAAS,OAAO;AAAA,MAClB,EAAE;AAAA,IACJ,CAAC;AAAA,EACH,EAAE,KAAK,IAAI;AACb;AAEO,SAAS,oCACd,SACsD;AACtD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS,+BAA+B,OAAO;AAAA,EACjD;AACF;AAEO,IAAM,0BAA0BA,GACpC,OAAO,EACP,MAAM,mBAAmB,EACzB,IAAI,GAAG;AAGV,SAAS,uBAAgD,OAAU;AACjE,SAAOA,GAAE,WAAW,CAAC,UAAU;AAC7B,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,aAAO;AAAA,IACT;AACA,UAAM,SAAS;AACf,QAAI,OAAO,kBAAkB,UAAa,OAAO,kBAAkB,QAAW;AAC5E,aAAO;AAAA,IACT;AACA,WAAO,EAAE,GAAG,QAAQ,eAAe,OAAO,cAAc;AAAA,EAC1D,GAAGA,GAAE,OAAO,KAAK,CAAC;AACpB;AAKO,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,MAAM;AAAA,EACN,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,uCAAuC;AAI7C,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAMA,GAAE,OAAO;AAAA,EACf,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAWA,GAAE,MAAM,2BAA2B;AAAA,EAC9C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,uBAAuB;AAI7B,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,aAAaA,GAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC3C,WAAWA,GACR;AAAA,IACCA,GAAE,OAAO;AAAA,MACP,MAAM;AAAA,MACN,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK;AAAA,IACpC,CAAC;AAAA,EACH,EACC,QAAQ,CAAC,CAAC;AACf,CAAC;AAGM,IAAM,oCAAoC;AAI1C,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,aAAaA,GAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,SAAS;AACxD,CAAC;AAGM,IAAM,oCAAoC;AAI1C,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK;AACpC,CAAC;AAGM,IAAM,yCAAyC;AAU/C,IAAM,WAAWA,GAAE,OAAO;AAAA,EAC/B,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AACrC,CAAC;AAGM,IAAM,aAAaA,GAAE,OAAO;AAAA,EACjC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAOA,GAAE,OAAO,EAAE,KAAK;AAAA,EACvB,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnC,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,QAAQA,GAAE,MAAM,QAAQ;AAAA,EACxB,iBAAiBA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EACnC,uBAAuBA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EAChD,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE/B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,QAAQA,GAAE,QAAQ;AAAA,EAClB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,aAAaA,GAAE,KAAK,CAAC,WAAW,WAAW,SAAS,CAAC;AAAA,EACrD,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AACtC,CAAC;AAGM,IAAM,MAAMA,GAAE,OAAO;AAAA,EAC1B,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAMA,GAAE,OAAO;AAAA,EACf,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAG/B,eAAe,WAAW,SAAS;AAAA;AAAA;AAAA,EAGnC,qBAAqB,sBAAsB,SAAS;AAAA,EACpD,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC3C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,gBAAgBA,GAAE,KAAK,CAAC,gBAAgB,iBAAiB,CAAC;AAGhE,IAAM,kBAAkBA,GAAE,KAAK,CAAC,YAAY,aAAa,UAAU,YAAY,QAAQ,CAAC;AAIxF,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,OAAO;AAAA,EAClB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAKM,IAAM,wBAAwBA,GAClC,OAAO;AAAA,EACN,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzB,cAAcA,GAAE,MAAM,cAAc,EAAE,SAAS;AACjD,CAAC,EACA,YAAY;AAGR,IAAM,YAAYA,GAAE,OAAO;AAAA,EAChC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAOA,GAAE,OAAO,EAAE,KAAK;AAAA,EACvB,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,MAAM;AAAA,EACN,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EACzC,QAAQ;AAAA,EACR,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,cAAc,sBAAsB,SAAS;AAAA,EAC7C,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,aAAaA,GAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA;AAAA,EAE3C,OAAOA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACrC,aAAaA,GAAE,OAAO,EAAE,IAAI,MAAM,EAAE,SAAS;AAAA,EAC7C,QAAQA,GAAE,MAAM,QAAQ,EAAE,IAAI,GAAG,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC7C,iBAAiBA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;AAAA,EACvE,uBAAuBA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;AACtE,CAAC;AAGM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,aAAaA,GAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,SAAS;AACxD,CAAC;AAIM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACnC,MAAMA,GAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AACtC,CAAC;AAKM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,OAAOA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,QAAQ;AAAA,EACpC,aAAaA,GAAE,OAAO,EAAE,IAAI,MAAM,EAAE,QAAQ;AAAA,EAC5C,QAAQA,GAAE,MAAM,QAAQ,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC5C,iBAAiBA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACtE,uBAAuBA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACnE,WAAWA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,QAAQ;AAC1C,CAAC;AAGM,IAAM,0BAA0BA,GAAE,mBAAmB,QAAQ;AAAA,EAClEA,GAAE,OAAO,EAAE,MAAMA,GAAE,QAAQ,cAAc,GAAG,SAAS,sBAAsB,CAAC;AAAA,EAC5EA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,iBAAiB;AAAA,IACjC,SAAS;AAAA,EACX,CAAC;AACH,CAAC;AAGM,IAAM,sBAAsBA,GAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAGvD,IAAM,yBAAyBA,GAAE,KAAK,CAAC,UAAU,cAAc,QAAQ,CAAC;AAGxE,IAAM,uBAAuBA,GAAE,KAAK,CAAC,uBAAuB,kBAAkB,CAAC;AAG/E,IAAM,6BAA6BA,GAAE,KAAK,CAAC,oBAAoB,QAAQ,YAAY,CAAC;AAGpF,IAAM,2BAA2BA,GAAE,KAAK,CAAC,aAAa,QAAQ,CAAC;AAG/D,IAAM,4BAA4BA,GAAE,mBAAmB,QAAQ;AAAA,EACpEA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,MAAM;AAAA,IACtB,OAAOA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,IAC3C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,KAAK;AAAA,EAC3C,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,UAAU;AAAA,IAC1B,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACxC,SAASA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,IACxD,OAAOA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EACxD,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,UAAU;AAAA,IAC1B,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,KAAK;AAAA,IACzC,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,IACpC,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,IACtC,YAAYA,GACT,MAAMA,GAAE,KAAK,CAAC,UAAU,UAAU,WAAW,aAAa,YAAY,UAAU,UAAU,CAAC,CAAC,EAC5F,IAAI,CAAC,EACL,SAAS;AAAA,EACd,CAAC;AACH,CAAC;AAGM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,WAAWA,GAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC1C,OAAOA,GAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA,EAItD,sBAAsBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACjD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,iBAAiB,gBAAgB,SAAS;AAAA,EAC1C,gBAAgB,eAAe,SAAS;AAAA,EACxC,MAAM,SAAS,SAAS;AAAA;AAAA;AAAA,EAGxB,qBAAqB,sBAAsB,SAAS;AACtD,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAMA,GAAE,OAAO;AAAA,EACf,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,oBAAoBA,GAAE,OAAO;AAAA,EAC7B,SAAS;AAAA,EACT,eAAe;AAAA,EACf,aAAa;AAAA,EACb,mBAAmBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC9C,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA,EAExD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAIxD,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAChD,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,SAASA,GAAE,OAAO;AAAA,EAClB,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,gBAAgBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,6BAA6B,uBAAuB;AAAA,EAC/D,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,UAAU;AAAA,EACV,SAAS,qBAAqB,QAAQ,qBAAqB;AAAA,EAC3D,eAAe,2BAA2B,QAAQ,kBAAkB;AAAA,EACpE,aAAa;AAAA,EACb,QAAQ,oBAAoB,QAAQ,QAAQ;AAAA,EAC5C,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErD,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,6BAA6B,uBAAuB;AAAA,EAC/D,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,UAAU,0BAA0B,SAAS;AAAA,EAC7C,SAAS,qBAAqB,SAAS;AAAA,EACvC,eAAe,2BAA2B,SAAS;AAAA,EACnD,aAAa,yBAAyB,SAAS;AAAA,EAC/C,QAAQ,oBAAoB,SAAS;AAAA,EACrC,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAGrD,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,SAAS;AACvD,CAAC;AAQM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACjD,CAAC;AAGM,IAAM,mCAAmCA,GAAE,KAAK;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,WAAW;AAAA,EACX,WAAWA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAChD,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC7C,UAAUA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACnC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,MAAMA,GAAE,QAAQ,eAAe;AAAA,EAC/B,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAaA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC/C,UAAUA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AACrC,CAAC;AAGM,IAAM,sCAAsCA,GAAE,OAAO;AAAA,EAC1D,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,iBAAiB;AAAA,EACjB,gBAAgB,qBAAqB,QAAQ,qBAAqB;AAAA,EAClE,sBAAsB,2BAA2B,QAAQ,MAAM;AAAA;AAAA;AAAA,EAG/D,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACrC,CAAC;AAUM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,OAAO,6BAA6B;AAAA,IACnE,SAAS;AAAA,EACX,CAAC;AAAA,EACD,SAASA,GAAE,OAAO,EAAE,IAAI,MAAM,IAAI;AACpC,CAAC;AAMM,IAAM,sBAAsBA,GAChC,OAAO;AAAA,EACN,MAAMA,GACH,OAAO,EACP,IAAI,CAAC,EACL,IAAI,EAAE,EACN,MAAM,gCAAgC;AAAA,IACrC,SAAS;AAAA,EACX,CAAC;AAAA,EACH,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAClD,OAAOA,GAAE,MAAM,uBAAuB,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AACvD,CAAC,EACA,YAAY,CAAC,OAAO,QAAQ;AAC3B,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAM,QAAQ,CAAC,MAAM,UAAU;AACnC,QAAI,KAAK,IAAI,KAAK,IAAI,GAAG;AACvB,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SAAS,8BAA8B,KAAK,IAAI;AAAA,QAChD,MAAM,CAAC,SAAS,OAAO,MAAM;AAAA,MAC/B,CAAC;AAAA,IACH;AACA,SAAK,IAAI,KAAK,IAAI;AAAA,EACpB,CAAC;AACD,MAAI,CAAC,MAAM,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,UAAU,GAAG;AACzD,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM,CAAC,OAAO;AAAA,IAChB,CAAC;AAAA,EACH;AACF,CAAC;AAOI,IAAM,eAAe;AAGrB,IAAM,gBAAgBA,GAC1B,MAAM,YAAY,EAClB,IAAI,EAAE,EACN,UAAU,CAAC,QAAQ,QAAQ;AAC1B,QAAM,WAAW,oBAAI,IAA0D;AAC/E,aAAW,SAAS,QAAQ;AAC1B,UAAM,MAAM,MAAM,KAAK,YAAY;AACnC,UAAMK,eAAc,KAAK,UAAU;AAAA,MACjC,aAAa,MAAM,eAAe;AAAA,MAClC,OAAO,CAAC,GAAG,MAAM,KAAK,EACnB,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC,EACzD,IAAI,CAAC,EAAE,MAAM,QAAQ,OAAO,EAAE,MAAM,QAAQ,EAAE;AAAA,IACnD,CAAC;AACD,UAAM,WAAW,SAAS,IAAI,GAAG;AACjC,QAAI,CAAC,UAAU;AACb,eAAS,IAAI,KAAK,EAAE,aAAAA,cAAa,MAAM,CAAC;AACxC;AAAA,IACF;AACA,QAAI,SAAS,gBAAgBA,cAAa;AACxC,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SAAS,0CAA0C,MAAM,IAAI;AAAA,MAC/D,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,MAAM,KAAK;AACxD,CAAC;AAEH,SAAS,4BAA4B,MAAuB;AAC1D,MAAI,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,IAAI,GAAG;AAC/C,WAAO;AAAA,EACT;AACA,SAAO,KACJ,MAAM,GAAG,EACT,MAAM,CAAC,YAAY,QAAQ,SAAS,KAAK,YAAY,OAAO,YAAY,IAAI;AACjF;AAEA,IAAM,4BAA4BL,GAAE,OAAO;AAAA,EACzC,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,mBAAmBA,GAAE,MAAM,uBAAuB,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC9D,UAAUA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AACrC,CAAC;AAEM,IAAM,iBAAiBA,GAAE;AAAA,EAC9B,CAAC,UAAU;AACT,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,aAAO;AAAA,IACT;AACA,UAAM,SAAS;AACf,QAAI,OAAO,gBAAgB,QAAW;AACpC,aAAO;AAAA,IACT;AACA,QAAI,OAAO,gBAAgB,QAAW;AACpC,YAAM,EAAE,aAAa,cAAc,GAAG,KAAK,IAAI;AAC/C,aAAO,EAAE,GAAG,MAAM,aAAa,OAAO,YAAY;AAAA,IACpD;AACA,QAAI,OAAO,sBAAsB,QAAW;AAC1C,YAAM,EAAE,mBAAmB,oBAAoB,GAAG,KAAK,IAAI;AAC3D,aAAO;AAAA,QACL,GAAG;AAAA,QACH,aAAa;AAAA,UACX,aAAa;AAAA,UACb,mBAAmB,OAAO;AAAA,UAC1B,UAAU,MAAM,QAAQ,OAAO,iBAAiB,KAAK,OAAO,kBAAkB,SAAS;AAAA,QACzF;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EACAA,GAAE,OAAO;AAAA,IACP,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACpB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACtB,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC7B,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACtB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC1B,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,IAIzB,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,IAEzD,QAAQA,GACL,MAAM,mBAAmB,EACzB,IAAI,EAAE,EACN,YAAY,CAAC,QAAQ,QAAQ;AAC5B,YAAM,OAAO,oBAAI,IAAY;AAC7B,aAAO,QAAQ,CAAC,OAAO,UAAU;AAC/B,cAAM,MAAM,MAAM,KAAK,YAAY;AACnC,YAAI,KAAK,IAAI,GAAG,GAAG;AACjB,cAAI,SAAS;AAAA,YACX,MAAM;AAAA,YACN,SAAS,8BAA8B,MAAM,IAAI;AAAA,YACjD,MAAM,CAAC,OAAO,MAAM;AAAA,UACtB,CAAC;AAAA,QACH;AACA,aAAK,IAAI,GAAG;AAAA,MACd,CAAC;AAAA,IACH,CAAC,EACA,QAAQ,CAAC,CAAC;AAAA,IACb,OAAOA,GAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,IAClC,YAAYA,GAAE,MAAM,uBAAuB,EAAE,QAAQ,CAAC,CAAC;AAAA,IACvD,WAAWA,GAAE,MAAM,uBAAuB,EAAE,QAAQ,CAAC,CAAC;AAAA,IACtD,wBAAwBA,GAAE,MAAM,mCAAmC,EAAE,QAAQ,CAAC,CAAC;AAAA,IAC/E,aAAa,0BAA0B,SAAS;AAAA,IAChD,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACxD,CAAC;AACH;AAKO,IAAM,gCAAgC;AAGtC,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAM;AAAA,EACN,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,yBAAyBA,GAAE,KAAK,CAAC,UAAU,UAAU,CAAC;AAG5D,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,QAAQ;AAAA,EACR,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,oBAAoB,uBAAuB;AAAA,EACtD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,iBAAiBA,GAAE,KAAK;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,yBAAyBA,GAAE,KAAK,CAAC,aAAa,gBAAgB,UAAU,CAAC;AAG/E,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,UAAU;AAAA,EACV,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,mBAAmBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACvC,QAAQ;AAAA,EACR,QAAQA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EAC1B,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,eAAeA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC/C,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,UAAU;AAAA,EACV,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,mBAAmBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC9C,QAAQ,uBAAuB,QAAQ,WAAW;AAAA,EAClD,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC7C,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC1C,eAAeA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3D,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,aAAaA,GAAE,OAAO;AAAA,EACjC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,cAAcA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,UAAU;AAAA,EACV,gBAAgBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACpC,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,MAAMA,GAAE,OAAO;AAAA,EACf,aAAaA,GAAE,OAAO;AAAA,EACtB,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC;AAAA,EACxC,KAAKA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EACrC,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,cAAcA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAaA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACpD,KAAKA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAGM,IAAM,iBAAiBA,GAAE,KAAK,CAAC,UAAU,WAAW,eAAe,WAAW,CAAC;AAG/E,IAAM,mBAAmBA,GAAE,KAAK,CAAC,UAAU,gBAAgB,WAAW,OAAO,CAAC;AAG9E,IAAM,qCAAqC;AAC3C,IAAM,sCAAsC;AAC5C,IAAM,0CAA0C;AAChD,IAAM,qCAAqC;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACO,IAAM,sCAAsC,CAAC,iBAAiB,mBAAmB;AAEjF,IAAM,qCAAqCA,GAC/C,OAAO;AAAA,EACN,gBAAgBA,GAAE,QAAQ,kCAAkC;AAAA,EAC5D,iBAAiBA,GAAE,QAAQ,mCAAmC;AAAA,EAC9D,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACrC,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACnC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAC/B,gBAAgBA,GAAE,QAAQ,UAAU;AAAA,EACpC,YAAYA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EACA,YAAY;AAGR,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,gBAAgBA,GAAE,OAAO;AAAA,EACzB,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,eAAeA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EACjC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnC,mBAAmBA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7E,wBAAwBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxC,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,6BAA6BA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAGnE,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAChC,MAAM;AAAA,EACN,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,YAAY;AAAA,EACZ,eAAeA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACpD,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACrE,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,iCAAiCA,GAAE,OAAO;AAAA,EACrD,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC3C,CAAC;AAGM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,kBAAkBA,GAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,MAAM,eAAe,SAAS;AAAA,EAC9B,QAAQ,iBAAiB,SAAS;AAAA,EAClC,YAAY,2BAA2B,SAAS;AAAA,EAChD,eAAeA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EACnD,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACrE,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,SAAS;AACvD,CAAC;AAGM,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,YAAY;AACd,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,aAAaA,GAAE,MAAM,kBAAkB;AACzC,CAAC;AAGM,IAAM,oBAAoBA,GAC9B,OAAO;AAAA,EACN,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAClC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,iBAAiBA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,aAAaA,GACV,OAAO;AAAA,IACN,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC1B,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IACzC,yBAAyBA,GACtB,KAAK,CAAC,QAAQ,sBAAsB,qBAAqB,CAAC,EAC1D,SAAS;AAAA,EACd,CAAC,EACA,SAAS;AACd,CAAC,EACA,OAAO,CAAC,UAAU,QAAQ,MAAM,UAAU,MAAM,QAAQ,GAAG;AAAA,EAC1D,SAAS;AAAA,EACT,MAAM,CAAC,QAAQ;AACjB,CAAC;AAGI,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EACzC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5C,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,aAAaA,GAAE,QAAQ,UAAU;AAAA,EACjC,eAAeA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvC,4BAA4BA,GAAE,QAAQ,MAAM;AAAA,EAC5C,aAAaA,GAAE,MAAMA,GAAE,KAAK,CAAC,sBAAsB,eAAe,CAAC,CAAC;AAAA,EACpE,gBAAgBA,GAAE,MAAMA,GAAE,QAAQ,MAAM,CAAC;AAC3C,CAAC;AAGM,IAAM,oCAAoCA,GAAE,OAAO;AAAA,EACxD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,eAAeA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACpD,iBAAiBA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,KAAK;AAAA,EACzC,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EACjD,oBAAoBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC/C,QAAQ,oBAAoB,QAAQ,QAAQ;AAAA,EAC5C,SAAS,qBAAqB,QAAQ,qBAAqB;AAAA,EAC3D,eAAe,2BAA2B,QAAQ,MAAM;AAC1D,CAAC;AAGM,IAAM,iBAAiBA,GAAE,KAAK,CAAC,QAAQ,OAAO,OAAO,SAAS,QAAQ,CAAC;AAGvE,IAAM,mBAAmBA,GAAE,KAAK;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,+BAA+BA,GAAE,KAAK,CAAC,UAAU,UAAU,CAAC;AAGlE,IAAM,4BAA4BA,GAAE,KAAK,CAAC,UAAU,WAAW,QAAQ,SAAS,CAAC;AAGjF,IAAM,wBAAwBA,GAAE,KAAK,CAAC,YAAY,WAAW,CAAC;AAG9D,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,WAAWA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACpC,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,OAAOA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA,EAGzC,cAAcA,GACX,OAAO;AAAA,IACN,OAAOA,GAAE,KAAK,CAAC,WAAW,iBAAiB,YAAY,CAAC;AAAA,IACxD,QAAQA,GAAE,KAAK;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,CAAC,EACA,SAAS;AACd,CAAC;AAGM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,aAAaA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAaA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC/C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC5C,MAAMA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3C,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACrD,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACrD,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACpD,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACpD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACzD,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACtD,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACpD,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAChD,UAAU,0BAA0B,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC3D,iBAAiBA,GAAE,MAAMA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtE,MAAM,sBAAsB,SAAS,EAAE,QAAQ,IAAI;AAAA,EACnD,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACrD,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACxD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACxD,OAAOA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAChC,SAASA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC3C,OAAOA,GAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClC,SAAS,kBAAkB,QAAQ,EAAE,WAAW,OAAO,OAAO,KAAK,CAAC;AAAA,EACpE,SAASA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAClC,eAAeA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAIjD,eAAeA,GACZ,OAAO;AAAA,IACN,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IACzC,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAChC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACtB,cAAcA,GAAE,KAAK,CAAC,aAAa,SAAS,CAAC,EAAE,SAAS;AAAA,EAC1D,CAAC,EACA,SAAS,EACT,QAAQ,IAAI;AAAA,EACf,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAUM,SAAS,0CACd,MACS;AACT,MAAI,KAAK,MAAO,QAAO;AACvB,MAAI,KAAK,WAAW,WAAY,QAAO;AACvC,QAAM,QAAQ,KAAK,SAAS;AAC5B,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,MAAK,MAAkC,WAAW,OAAQ,QAAO;AACjE,MAAI,KAAK,aAAa,QAAQ,KAAK,aAAa,UAAW,QAAO;AAClE,MAAI,KAAK,aAAa,UAAW,QAAO;AACxC,QAAM,WAAW,KAAK,SAAS;AAC/B,MAAI,CAAC,YAAY,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACjF,QAAM,SAAS;AACf,SACE,OAAO,OAAO,eAAe,YAC7B,gCAAgC,KAAK,OAAO,UAAU,KACtD,OAAO,OAAO,WAAW,YACzB,OAAO,OAAO,KAAK,EAAE,SAAS;AAElC;AAEO,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EACxC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA,EAC1C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,qCAAqCA,GAAE,OAAO;AAAA,EACzD,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC/B,MAAM,eAAe,QAAQ,CAAC,MAAM,CAAC;AAAA,EACrC,QAAQ,iBAAiB,QAAQ,QAAQ;AAAA,EACzC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC5C,MAAMA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3C,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvC,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvC,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,0BAA0B,uBAAuB;AAAA,EAC5D,QAAQA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACpD,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,eAAe,uBAAuB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO/C,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOpD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC5C,CAAC;AAGM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,OAAOA,GAAE,MAAM,qBAAqB;AAAA,EACpC,eAAeA,GAAE,MAAM,sBAAsB;AAC/C,CAAC;AAGM,IAAM,kCAAkCA,GAAE,OAAO;AAAA,EACtD,OAAOA,GAAE,MAAM,qBAAqB;AAAA,EACpC,QAAQA,GAAE,QAAQ,uBAAuB;AAAA,EACzC,WAAWA,GAAE,OAAO,EAAE,IAAI;AAC5B,CAAC;AAGM,IAAM,UAAUA,GAAE,OAAO;AAAA,EAC9B,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ;AAAA,EACR,gBAAgBA,GAAE,OAAO;AAAA,EACzB,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,aAAaA,GAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIhD,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAWA,GAAE,MAAM,WAAW;AAAA,EAC9B,QAAQ,cAAc,QAAQ,CAAC,CAAC;AAAA,EAChC,OAAOA,GAAE,MAAM,OAAO;AAAA;AAAA;AAAA,EAGtB,YAAY,kBAAkB,SAAS;AAAA;AAAA;AAAA;AAAA,EAIvC,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIxD,qBAAqB,2BAA2B,SAAS;AAAA,EACzD,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC;AAAA;AAAA,EAE1C,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,OAAOA,GAAE,OAAO;AAAA,EAChB,gBAAgB;AAAA;AAAA,EAEhB,WAAW;AAAA;AAAA;AAAA;AAAA,EAIX,gBAAgBA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhC,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1C,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA,EAExD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMxD,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAChD,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA,EAGvD,0BAA0BA,GAAE,MAAM,UAAU,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvD,oBAAoBA,GAAE,MAAM,qBAAqB,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA,EAG1E,YAAYA,GAAE,MAAM,wBAAwB,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxD,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA,EAG5C,eAAeA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,kBAAkB;AAAA,EAClB,6BAA6B,sBAAsB,SAAS;AAAA,EAC5D,8BAA8B;AAAA,EAC9B,8BAA8B;AAAA,EAC9B,iCAAiCA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI5D,sBAAsBA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1C,oBAAoBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACxC,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIzC,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACzD,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC3C,mBAAmBA,GAAE,OAAO,EAAE,IAAI;AAAA,EAClC,mBAAmBA,GAAE,OAAO,EAAE,IAAI;AAAA,EAClC,kBAAkB;AAAA,EAClB,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3C,yBAAyBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACpD,uBAAuBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAElD,QAAQA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAEjC,UAAUA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA,EAE5C,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMpD,WAAWA,GACR,OAAO;AAAA,IACN,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IAC7C,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IAC/C,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACjD,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IAChD,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACnD,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IAChD,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,IAEhD,WAAWA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,CAAC,EACA,SAAS;AAAA,EACZ,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAQM,IAAM,wBAAwB,QAAQ,OAAO;AAAA,EAClD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC5C,CAAC;AAaM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,QAAQA,GAAE,MAAM,OAAO;AAAA;AAAA,EAEvB,iBAAiBA,GAAE,QAAQ,EAAE,SAAS;AAAA,EACtC,UAAUA,GAAE,MAAM,OAAO;AAAA,EACzB,YAAYA,GAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAUM,IAAM,cAAsCA,GAAE;AAAA,EAAK,MACxDA,GAAE,OAAO;AAAA,IACP,SAAS;AAAA,IACT,UAAUA,GAAE,MAAM,WAAW;AAAA,EAC/B,CAAC;AACH;AAEO,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,WAAWA,GAAE,MAAM,OAAO;AAAA,EAC1B,UAAUA,GAAE,MAAM,WAAW;AAAA,EAC7B,WAAWA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AACtC,CAAC;AAGM,IAAM,mBAAmBA,GAAE,KAAK;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQM,IAAM,4BAA4BA,GAAE,KAAK;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQM,IAAM,0BAA0BA,GAAE,KAAK;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,SAAS,uCACd,OAC2B;AAC3B,SAAO,UAAU,YAAY,iBAAiB;AAChD;AAEO,IAAM,0BAA0BA,GAAE,KAAK,CAAC,QAAQ,WAAW,MAAM,CAAC;AAIlE,IAAM,yBAAyBA,GAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAG3D,IAAM,uBAAuBA,GAAE,KAAK,CAAC,cAAc,UAAU,CAAC;AAG9D,IAAM,4BAA4BA,GAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAG5D,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,qCAAqC;AAAA,EAChD,SAAS;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,YAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,cAAc;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAYO,SAAS,+BAA+B,OAG7C;AACA,QAAM,WAAW,IAAI,IAAsB,MAAM,gBAAgB,CAAC,CAAC;AACnE,aAAW,iBAAiB,MAAM,kBAAkB,CAAC,GAAG;AACtD,eAAW,QAAQ,mCAAmC,aAAa,EAAG,UAAS,IAAI,IAAI;AAAA,EACzF;AAEA,QAAM,WAAW,IAAI,IAAsB,MAAM,gBAAgB,CAAC,CAAC;AACnE,aAAW,iBAAiB,MAAM,kBAAkB,CAAC,GAAG;AACtD,eAAW,QAAQ,mCAAmC,aAAa,EAAG,UAAS,IAAI,IAAI;AAAA,EACzF;AACA,aAAW,QAAQ,MAAM,uBAAuB,CAAC,GAAG;AAClD,QAAI,CAAC,SAAS,IAAI,IAAI,EAAG,UAAS,IAAI,IAAI;AAAA,EAC5C;AAGA,aAAW,QAAQ,SAAU,UAAS,OAAO,IAAI;AACjD,SAAO,EAAE,cAAc,CAAC,GAAG,QAAQ,GAAG,cAAc,CAAC,GAAG,QAAQ,EAAE;AACpE;AAEO,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAChC,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA;AAAA,EAG9C,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACpD,QAAQA,GAAE,KAAK;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC5C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,mBAAmB,4BAA4B,SAAS;AAAA,EACxD,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5C,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AACnD,CAAC;AAIM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,iBAAiBA,GAAE,QAAQ,KAAK;AAAA,EAChC,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,QAAQA,GAAE,KAAK,CAAC,sBAAsB,WAAW,sBAAsB,gBAAgB,CAAC;AAAA,EACxF,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC5C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5C,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACtC,CAAC;AAQM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,KAAKA,GAAE,OAAO,EAAE,IAAI;AAAA,EACpB,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI1C,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,WAAWA,GAAE,QAAQ,QAAQ;AAAA;AAAA,EAE7B,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AACrD,CAAC;AAGM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,UAAUA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,QAAQA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjC,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC5C,CAAC;AAGM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,UAAUA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,QAAQA,GAAE,KAAK,CAAC,qBAAqB,UAAU,WAAW,cAAc,CAAC;AAAA,EACzE,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC5C,CAAC;AAGM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACnD,QAAQA,GAAE,KAAK,CAAC,iBAAiB,kBAAkB,OAAO,CAAC;AAC7D,CAAC;AAQM,IAAM,gBAAgBA,GAAE,KAAK,CAAC,UAAU,WAAW,WAAW,CAAC;AAE/D,IAAM,iBAAiBA,GAAE,KAAK,CAAC,YAAY,UAAU,CAAC;AAEtD,IAAM,uBAAuBA,GAAE,KAAK,CAAC,aAAa,YAAY,CAAC;AAG/D,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,MAAM;AAAA,EACN,OAAO;AAAA,EACP,YAAYA,GAAE,MAAM,CAACA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAGA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAAA,EAC9E,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrC,WAAWA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA,EAGpB,QAAQA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AACzC,CAAC;AAGM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,OAAO;AAAA,EACP,aAAa;AAAA;AAAA;AAAA,EAGb,YAAYA,GAAE,OAAO;AAAA,EACrB,iBAAiBA,GAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,EACnD,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,YAAYA,GAAE,MAAM,CAACA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAGA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAChF,CAAC;AAKM,IAAM,wBAAwBA,GAAE,KAAK;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,QAAQ;AAAA;AAAA;AAAA,EAGR,QAAQA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AACzC,CAAC;AAcM,IAAM,mCAAmCA,GAAE,OAAO;AAAA,EACvD,QAAQA,GAAE,KAAK,CAAC,UAAU,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA,EACrD,OAAOA,GAAE,OAAO;AAAA;AAAA,EAChB,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC/B,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAC/C,CAAC;AAGM,IAAM,eAAeA,GAAE,KAAK,CAAC,WAAW,YAAY,WAAW,SAAS,CAAC;AAEzE,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,SAASA,GACN;AAAA,IACCA,GAAE,OAAO;AAAA,MACP,MAAMA,GAAE,OAAO;AAAA;AAAA,MACf,MAAM;AAAA,MACN,OAAOA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,MAChC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,MACjE,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,IAC/B,CAAC;AAAA,EACH,EACC,IAAI,CAAC;AAAA,EACR,QAAQA,GAAE,KAAK,CAAC,SAAS,SAAS,OAAO,CAAC,EAAE,QAAQ,OAAO;AAAA;AAAA,EAE3D,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA;AAAA;AAAA,EAIvC,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AACtD,CAAC;AAGM,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC1B,OAAOA,GAAE,QAAQ;AAAA;AAAA,EACjB,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAChD,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC/C,QAAQA,GACL,KAAK,CAAC,UAAU,YAAY,SAAS,YAAY,SAAS,SAAS,CAAC,EACpE,QAAQ,SAAS;AAAA,EACpB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAClD,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AACtD,CAAC;AAGM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,OAAOA,GAAE,OAAO,EAAE,KAAK;AAAA,EACvB,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,OAAOA,GAAE,OAAO;AAAA;AAAA,EAChB,KAAKA,GAAE,OAAO;AAChB,CAAC;AAGM,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,OAAOA,GAAE,OAAO,EAAE,KAAK;AAAA,EACvB,QAAQA,GAAE,KAAK,CAAC,UAAU,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA,EACrD,OAAOA,GAAE,OAAO;AAAA;AAAA,EAChB,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AACpC,CAAC;AAGM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,OAAOA,GAAE,OAAO,EAAE,KAAK;AAAA,EACvB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,QAAQA,GAAE,KAAK,CAAC,QAAQ,UAAU,cAAc,WAAW,MAAM,CAAC;AACpE,CAAC;AAIM,IAAM,aAAaA,GAAE,KAAK,CAAC,QAAQ,OAAO,WAAW,OAAO,CAAC;AAc7D,IAAM,aAAoCA,GAAE;AAAA,EAAK,MACtDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,OAAO;AAAA,IACf,MAAMA,GAAE,OAAO;AAAA,IACf,MAAM;AAAA,IACN,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,IACnD,SAASA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,IACjD,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAChC,UAAUA,GAAE,MAAM,UAAU,EAAE,SAAS;AAAA,IACvC,WAAWA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,CAAC;AACH;AAEO,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,MAAMA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA,EAC3B,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EAC/C,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAK;AAAA,EACjE,eAAeA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AACzC,CAAC;AAEM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAM;AAAA,EACN,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,WAAWA,GAAE,QAAQ;AAAA;AACvB,CAAC;AAGM,IAAM,aAAaA,GAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;AAE5C,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,MAAMA,GAAE,OAAO;AAAA,EACf,UAAU,WAAW,QAAQ,MAAM;AAAA,EACnC,UAAUA,GACP,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,OAAO,IAAI,EACpB,QAAQ,IAAI,OAAO,IAAI;AAC5B,CAAC;AAEM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO;AAAA,EACf,UAAU;AAAA,EACV,SAASA,GAAE,OAAO;AAAA;AAAA,EAClB,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EACxC,WAAWA,GAAE,QAAQ;AAAA;AAAA,EACrB,UAAUA,GAAE,QAAQ;AAAA;AAAA,EACpB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAGM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO;AAAA,EACf,UAAU,WAAW,QAAQ,MAAM;AAAA,EACnC,SAASA,GAAE,OAAO;AAAA,EAClB,WAAWA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EACnC,eAAeA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AACzC,CAAC;AAEM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,MAAMA,GAAE,OAAO;AAAA,EACf,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AACzC,CAAC;AAGM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,MAAMA,GAAE,OAAO;AAAA,EACf,WAAWA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AACtC,CAAC;AAEM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,OAAO;AAAA,EAClB,WAAWA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EACpC,eAAeA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AACzC,CAAC;AAEM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,OAAO;AAAA,EAClB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AACzC,CAAC;AAGM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO;AAAA,EACf,WAAWA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AACrC,CAAC;AAEM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,MAAMA,GAAE,OAAO;AAAA,EACf,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AACzC,CAAC;AAIM,IAAM,oBAAoBA,GAAE,KAAK;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC7B,OAAO,kBAAkB,SAAS;AAAA;AAAA,EAClC,UAAU,kBAAkB,SAAS;AAAA;AAAA,EACrC,cAAcA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AACzC,CAAC;AAEM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,MAAMA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAC7B,CAAC;AAEM,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,QAAQA,GAAE,QAAQ;AAAA,EAClB,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC1B,UAAUA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACnC,UAAUA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAChD,OAAOA,GAAE,MAAM,aAAa;AAAA,EAC5B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAIM,IAAM,kBAAkBA,GAAE,KAAK,CAAC,WAAW,OAAO,OAAO,MAAM,CAAC;AAEhE,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,MAAM;AAAA;AAAA,EAEN,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,MAAMA,GAAE,OAAO;AAAA;AACjB,CAAC;AAEM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,QAAQA,GAAE,OAAO;AAAA;AAAA,EACjB,OAAOA,GAAE,MAAM,WAAW;AAC5B,CAAC;AAEM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,QAAQ;AAAA,EACR,UAAUA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACnC,SAASA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAClC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,OAAOA,GAAE,MAAM,WAAW;AAAA;AAAA,EAC1B,WAAWA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AACtC,CAAC;AAEM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA,EAE3B,QAAQA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAGjC,kBAAkBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAC3C,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,UAAUA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACxC,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EACvD,iBAAiBA,GACd,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,IAAI,OAAO,IAAI,EACnB,QAAQ,MAAM,IAAI;AACvB,CAAC;AAEM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,OAAOA,GAAE,MAAM,WAAW;AAAA,EAC1B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAeM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,MAAMA,GAAE,OAAO;AAAA,EACf,QAAQ;AAAA;AAAA,EAER,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAG1B,UAAUA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,EAG9B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,UAAUA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAEnC,UAAUA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACnC,SAASA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AACpC,CAAC;AAOM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,MAAMA,GAAE,OAAO;AAAA,EACf,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,UAAUA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACnC,UAAUA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAChD,QAAQA,GAAE,MAAM,aAAa;AAAA,EAC7B,MAAMA,GAAE,MAAM,WAAW;AAC3B,CAAC;AAGM,IAAM,iCAAiCA,GAAE,KAAK;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKM,IAAM,wBAAwBA,GAAE,OAAO;AAAA,EAC5C,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC5C,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC7C,eAAeA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACxC,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzC,aAAaA,GAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAMM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,SAASA,GAAE,QAAQ,CAAC;AAAA,EACpB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,YAAYA,GAAE,OAAO;AAAA,EACrB,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,WAAW;AAAA,EACX,eAAeA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACxC,OAAOA,GAAE,MAAM,oBAAoB;AAAA,EACnC,OAAOA,GAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO;AACT,CAAC;AAIM,IAAM,mCAAmCA,GAAE,OAAO;AAAA,EACvD,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAYA,GAAE,OAAO;AAAA,EACrB,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,OAAO;AACT,CAAC;AAGM,IAAM,mCAAmCA,GAAE,OAAO;AAAA,EACvD,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAYA,GAAE,OAAO;AAAA,EACrB,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,QAAQ;AACV,CAAC;AAOM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,KAAKA,GAAE,OAAO,EAAE,IAAI;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AASM,IAAM,8BAA8BA,GAAE,mBAAmB,aAAa;AAAA,EAC3EA,GAAE,OAAO;AAAA,IACP,WAAWA,GAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,IAI1B,gBAAgB,+BAA+B,SAAS,EAAE,SAAS;AAAA,IACnE,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS;AAAA,IAC7D,YAAYA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC3C,QAAQA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACvC,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS;AAAA,EACjE,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,WAAWA,GAAE,QAAQ,IAAI;AAAA,IACzB,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACvC,YAAYA,GAAE,OAAO;AAAA,IACrB,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC5B,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACzC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACxC,OAAO;AAAA,IACP,UAAU,yBAAyB,SAAS,EAAE,QAAQ,IAAI;AAAA,IAC1D,aAAa,0BAA0B,SAAS,EAAE,QAAQ,IAAI;AAAA,EAChE,CAAC;AACH,CAAC;AAWM,IAAM,kCAAkCA,GAAE,OAAO;AAAA,EACtD,MAAMA,GAAE,OAAO;AAAA,EACf,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,QAAQ;AAAA,EACR,MAAMA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,UAAUA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,UAAUA,GAAE,QAAQ;AAAA,EACpB,UAAUA,GAAE,QAAQ;AAAA,EACpB,UAAU,WAAW,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA,EAC5C,SAASA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA,EAC3C,YAAY,0BAA0B,SAAS,EAAE,QAAQ,IAAI;AAAA;AAC/D,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,MAAMA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC3B,KAAKA,GAAE,OAAO,EAAE,QAAQ,MAAM;AAAA,EAC9B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAK,EAAE,QAAQ,GAAG;AAAA,EAC5D,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC9C,UAAUA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAEM,IAAM,YAAYA,GAAE,OAAO;AAAA,EAChC,KAAKA,GAAE,OAAO;AAAA,EACd,UAAUA,GAAE,OAAO;AAAA,EACnB,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EAC3B,QAAQA,GAAE,OAAO;AAAA,IACf,MAAMA,GAAE,OAAO;AAAA,IACf,OAAOA,GAAE,OAAO;AAAA,IAChB,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,CAAC;AAAA,EACD,WAAWA,GAAE,OAAO;AAAA,IAClB,MAAMA,GAAE,OAAO;AAAA,IACf,OAAOA,GAAE,OAAO;AAAA,IAChB,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,CAAC;AAAA,EACD,SAASA,GAAE,OAAO;AAAA,EAClB,MAAMA,GAAE,OAAO;AAAA,EACf,MAAMA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AACtC,CAAC;AAEM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,SAASA,GAAE,MAAM,SAAS;AAAA,EAC1B,SAASA,GAAE,QAAQ;AACrB,CAAC;AAGM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC3B,KAAKA,GAAE,OAAO;AAAA;AAAA,EACd,UAAUA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC9B,UAAU,WAAW,QAAQ,MAAM;AAAA,EACnC,iBAAiBA,GACd,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,IAAI,OAAO,IAAI,EACnB,QAAQ,MAAM,IAAI;AACvB,CAAC;AAEM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,QAAQ,UAAU,SAAS;AAAA;AAAA,EAC3B,OAAOA,GAAE,MAAM,WAAW;AAAA;AAAA,EAC1B,MAAMA,GACH,OAAO;AAAA,IACN,SAASA,GAAE,OAAO;AAAA,IAClB,UAAU;AAAA,IACV,WAAWA,GAAE,OAAO,EAAE,IAAI;AAAA,IAC1B,WAAWA,GAAE,QAAQ;AAAA,EACvB,CAAC,EACA,SAAS;AAAA,EACZ,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAQM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,KAAKA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA,EAG1B,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAO,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA,EAGlE,YAAYA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AACtC,CAAC;AAEM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,QAAQA,GAAE,OAAO;AAAA,EACjB,QAAQA,GAAE,OAAO;AAAA,EACjB,UAAUA,GAAE,OAAO,EAAE,IAAI;AAAA;AAAA;AAAA,EAGzB,SAASA,GAAE,QAAQ,KAAK;AAAA,EACxB,iBAAiBA,GAAE,OAAO,EAAE,YAAY;AAC1C,CAAC;AAIM,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EACrC,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACrD,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACrD,KAAKA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA,EAC1B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA;AAC7B,CAAC;AAEM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,OAAOA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAEvB,WAAWA,GAAE,QAAQ,YAAY;AAAA,EACjC,eAAeA,GAAE,QAAQ;AAAA;AAC3B,CAAC;AAEM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,OAAOA,GAAE,OAAO,EAAE,KAAK;AAAA,EACvB,MAAMA,GAAE,OAAO;AACjB,CAAC;AAEM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,OAAOA,GAAE,OAAO,EAAE,KAAK;AAAA,EACvB,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAClC,CAAC;AAEM,IAAM,kBAAkBA,GAAE,OAAO,EAAE,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAM7D,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,YAAYA,GAAE,OAAO;AAAA,IACnB,WAAWA,GAAE,QAAQ;AAAA,IACrB,UAAUA,GAAE,QAAQ;AAAA,IACpB,MAAMA,GAAE,OAAO;AAAA,EACjB,CAAC;AAAA,EACD,UAAUA,GAAE,OAAO;AAAA,IACjB,QAAQA,GAAE,QAAQ;AAAA;AAAA,IAClB,MAAMA,GAAE,QAAQ;AAAA;AAAA,IAChB,KAAKA,GAAE,OAAO,EAAE,WAAWA,GAAE,QAAQ,EAAE,CAAC;AAAA;AAAA,EAC1C,CAAC;AAAA,EACD,KAAKA,GAAE,OAAO,EAAE,WAAWA,GAAE,QAAQ,GAAG,OAAOA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,CAAC;AACtE,CAAC;AAGM,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,MAAM;AAAA,EACN,SAASA,GAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC/B,YAAYA,GAAE,OAAO;AAAA,EACrB,eAAe,oBAAoB,SAAS,EAAE,SAAS;AAAA,EACvD,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,iBAAiBA,GAAE,KAAK,CAAC,WAAW,iBAAiB,WAAW,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACvF,oBAAoBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AACnE,CAAC;AAsDD,IAAM,8CAA8C,KAAK;AAGzD,IAAM,+CAA+C,IAAI;AAkBlD,SAAS,0BACd,OACA,eACA,kBAAmD;AAAA,EACjD,OAAO,MAAM;AAAA,EACb,MAAM,MAAM;AACd,GAC2B;AAC3B,QAAM,UAAU,yBAAyB,MAAM,OAAO,IAAI,MAAM,UAAU,CAAC;AAC3E,QAAM,SAAmB,CAAC;AAC1B,MAAI,gBAAgB;AAEpB,QAAM,gBAAgB,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AACxE,QAAM,kBAAkB,OAAO,UAAU,eAAe,KAAK,SAAS,QAAQ,IAC1E,QAAQ,SACR;AACJ,QAAM,kBAAkB,OAAO,UAAU,eAAe,KAAK,SAAS,QAAQ,IAC1E,QAAQ,SACR;AACJ,QAAM,YAAY,kBAAkB,OAAO,oBAAoB,WAAW,kBAAkB;AAC5F,QAAM,OAAO,cAAc,OAAO,OAAO,kBAAkB,SAAS;AACpE,MAAI,QAAQ,KAAK,WAAW;AAC1B,WAAO,KAAK,MAAM;AAClB,qBAAiB,KAAK,iBAAiB;AAAA,EACzC;AAEA,QAAM,SAAS,mBAAmB,eAAe;AACjD,MAAI,oBAAoB,QAAQ,OAAO,WAAW;AAChD,WAAO,KAAK,QAAQ;AACpB,qBAAiB,OAAO,iBAAiB;AAAA,EAC3C;AAEA,QAAM,SAAS;AAAA,IACb,oBAAoB,SAAa,aAAa,kBAAmB;AAAA,EACnE;AACA,MAAI,oBAAoB,UAAa,OAAO,WAAW;AACrD,WAAO,KAAK,QAAQ;AACpB,qBAAiB,OAAO,iBAAiB;AAAA,EAC3C;AAEA,QAAM,kBAAkB,qBAAqB,SAAS,CAAC,cAAc,WAAW,UAAU,CAAC;AAC3F,QAAM,sBACJ,oBAAoB,SAChB,kBACA,kBAAkB,eAChB,UACA;AACR,QAAM,aAAa,mBAAmB,mBAAmB;AACzD,MAAI,wBAAwB,QAAQ,WAAW,WAAW;AACxD,WAAO,KAAK,YAAY;AACxB,qBAAiB,WAAW,iBAAiB;AAAA,EAC/C;AAEA,QAAM,mBAAmB,qBAAqB,SAAS,CAAC,WAAW,aAAa,CAAC;AACjF,QAAM,UAAU;AAAA,IACd,qBAAqB,SACjB,mBACA,kBAAkB,iBAChB,UACA;AAAA,EACR;AACA,MAAI,QAAQ,WAAW;AACrB,WAAO,KAAK,SAAS;AACrB,qBAAiB,QAAQ,iBAAiB;AAAA,EAC5C;AAEA,QAAM,UAAU,eAAe,SAAS,MAAM,IAAI;AAClD,MAAI,QAAQ,WAAW;AACrB,WAAO,KAAK,SAAS;AACrB,qBAAiB,QAAQ,iBAAiB;AAAA,EAC5C;AAEA,MAAI,yBAAyB,QAAQ,UAAU,KAAK,QAAQ,WAAW,cAAc,MAAM;AACzF,WAAO,KAAK,SAAS;AAAA,EACvB;AAEA,QAAM,SAAS;AAAA,IACb,IAAI,MAAM;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB,YAAY,MAAM;AAAA,IAClB,QAAQ,MAAM,UAAU;AAAA,IACxB,gBAAgB,MAAM,kBAAkB;AAAA,IACxC,eAAe,MAAM,iBAAiB;AAAA,IACtC,iBAAiB,MAAM,mBAAmB;AAAA,EAC5C;AACA,QAAM,SAAS,oBAAoB,MAAM,MAAM,eAAe,OAAO;AACrE,QAAM,cAAc,oBAAoB,OAAO,OAAO,OAAO;AAC7D,QAAM,cAAc,OAAO;AAC3B,QAAM,kBAAkB,wBAAwB,OAAO,OAAO,WAAW;AACzE,QAAM,eACJ,qBAAqB,QAAQ,kBAAkB,iBAAiB,OAAO,QAAQ;AACjF,QAAM,UAAqC;AAAA,IACzC,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,IAAI,OAAO;AAAA,IACX,MAAM,OAAO;AAAA,IACb,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,IACnB,QAAQ,OAAO;AAAA,IACf,gBAAgB,OAAO;AAAA,IACvB,eAAe,OAAO;AAAA,IACtB,iBAAiB,OAAO;AAAA,IACxB;AAAA,IACA;AAAA,IACA,MAAM,MAAM,SAAS;AAAA,IACrB,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,SAAS,QAAQ;AAAA,IACjB,YAAY;AAAA,IACZ,SAAS;AAAA,IACT,YAAY;AAAA,MACV,WAAW,OAAO,SAAS;AAAA,MAC3B,QAAQ,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC;AAAA,MAC3B,eAAe,OAAO,SAAS,IAAI,iBAAiB,OAAO;AAAA,MAC3D,gBAAgB,sBAAsB;AAAA,QACpC,MAAM,MAAM,SAAS;AAAA,QACrB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,SAAS,QAAQ;AAAA,QACjB,YAAY;AAAA,QACZ,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,OAAqC;AACrE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,qBAAqB,SAAqB,MAA8C;AAC/F,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,UAAU,eAAe,KAAK,SAAS,GAAG,EAAG,QAAO,QAAQ,GAAG;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAiD;AAC1E,QAAM,gBAAgB,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AACtD,MAAI,iBAAiB,6CAA6C;AAChE,WAAO,EAAE,OAAO,WAAW,OAAO,cAAc;AAAA,EAClD;AACA,MAAI,eAAe,gBAAgB;AACnC,MAAI,YAAY;AAChB,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,UAAM,SAAS,UAAK,YAAY;AAChC,UAAM,SAAS,KAAK,IAAI,GAAG,8CAA8CM,WAAU,MAAM,CAAC;AAC1F,UAAM,OAAO,oBAAoB,OAAO,KAAK,MAAM,SAAS,GAAG,CAAC;AAChE,UAAM,OAAO,oBAAoB,OAAO,SAASA,WAAU,IAAI,CAAC;AAChE,gBAAY,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI;AACnC,UAAM,cAAc,KAAK,IAAI,GAAG,gBAAgBA,WAAU,IAAI,IAAIA,WAAU,IAAI,CAAC;AACjF,QAAI,gBAAgB,aAAc;AAClC,mBAAe;AAAA,EACjB;AACA,SAAO,EAAE,OAAO,WAAW,WAAW,MAAM,cAAc;AAC5D;AAEA,SAAS,mBAAmB,OAA8B;AACxD,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,WAAO,EAAE,OAAO,MAAM,WAAW,OAAO,eAAe,KAAK;AAAA,EAC9D;AACA,QAAM,cAAc,wBAAwB,KAAK;AACjD,QAAM,UAAU,yBAAyB,OAAO;AAAA,IAC9C,SAAS;AAAA,IACT,UAAU;AAAA,EACZ,CAAC;AACD,QAAM,iBAAiB,wBAAwB,OAAO,EAAE;AACxD,SAAO;AAAA,IACL,OAAO;AAAA,IACP,WACE,YAAY,UAAU,QAAQ,mBAAmB,QAAQ,YAAY,UAAU;AAAA,IACjF,eAAe,YAAY;AAAA,EAC7B;AACF;AAEA,SAAS,eACP,SACA,WAGA;AACA,QAAM,YACJ,cAAc,iBACd,cAAc,oBACd,cAAc;AAChB,QAAM,kBAAkB,CAAC,SAAS,QAAQ,aAAa,UAAU,EAAE;AAAA,IAAK,CAAC,QACvE,OAAO,UAAU,eAAe,KAAK,SAAS,GAAG;AAAA,EACnD;AACA,MAAI,CAAC,aAAa,CAAC,iBAAiB;AAClC,WAAO,EAAE,OAAO,MAAM,WAAW,OAAO,eAAe,KAAK;AAAA,EAC9D;AACA,QAAM,QAAQ,yBAAyB,QAAQ,KAAK;AACpD,QAAM,OAAO,yBAAyB,QAAQ,IAAI;AAClD,QAAM,WAAW,yBAAyB,QAAQ,QAAQ;AAC1D,QAAM,YAAY,OAAO,QAAQ,cAAc,YAAY,QAAQ,YAAY;AAC/E,QAAM,QAAQ,EAAE,OAAO,MAAM,OAAO,MAAM,KAAK,OAAO,WAAW,UAAU,SAAS,MAAM;AAC1F,QAAM,gBAAgB,CAAC,OAAO,MAAM,QAAQ,EACzC,IAAI,CAAC,UAAU,MAAM,iBAAiB,CAAC,EACvC,OAAO,CAAC,KAAK,UAAU,MAAM,OAAO,CAAC;AACxC,SAAO;AAAA,IACL;AAAA,IACA,WAAW,MAAM,aAAa,KAAK,aAAa,SAAS;AAAA,IACzD,eAAe,iBAAiB;AAAA,EAClC;AACF;AAEA,SAAS,yBAAyB,OAAyD;AACzF,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,EAAE,OAAO,MAAM,WAAW,OAAO,eAAe,KAAK;AAAA,EAC9D;AACA,SAAO,kBAAkB,KAAK;AAChC;AAEA,SAAS,oBACP,WACA,eACA,SACqC;AACrC,MAAI,cAAc,cAAe,QAAO;AACxC,MAAI,cAAc,iBAAkB,QAAO;AAC3C,MAAI,cAAc,kBAAmB,QAAO;AAC5C,MAAI,cAAc,oBAAoB,cAAc,2BAA2B;AAC7E,WAAO;AAAA,EACT;AACA,MAAI,kBAAkB,aAAc,QAAO;AAC3C,MACE,kBAAkB,kBAClB,cAAc,sBACd,cAAc,uBACd;AACA,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,WAAW,SAAU,QAAO;AACxC,MAAI,QAAQ,WAAW,YAAa,QAAO;AAC3C,SAAO;AACT;AAEA,SAASA,WAAU,OAAuB;AACxC,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AACzC;AAEA,SAAS,oBAAoB,OAAe,UAA0B;AACpE,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,SAAO,QAAQ,MAAM,QAAQ;AAC3B,UAAM,YAAY,MAAM,YAAY,KAAK;AACzC,QAAI,cAAc,OAAW;AAC7B,UAAM,YAAY,OAAO,cAAc,SAAS;AAChD,UAAM,OAAOA,WAAU,SAAS;AAChC,QAAI,QAAQ,OAAO,SAAU;AAC7B,aAAS;AACT,aAAS,UAAU;AAAA,EACrB;AACA,SAAO,MAAM,MAAM,GAAG,KAAK;AAC7B;AAEA,SAAS,oBAAoB,OAAe,UAA0B;AACpE,MAAI,QAAQ;AACZ,MAAI,QAAQ,MAAM;AAClB,SAAO,QAAQ,GAAG;AAChB,UAAM,QACJ,QAAQ,KAAK,MAAM,WAAW,QAAQ,CAAC,KAAK,SAAU,MAAM,WAAW,QAAQ,CAAC,KAAK,QACjF,IACA;AACN,UAAM,YAAY,MAAM,MAAM,QAAQ,OAAO,KAAK;AAClD,UAAM,OAAOA,WAAU,SAAS;AAChC,QAAI,QAAQ,OAAO,SAAU;AAC7B,aAAS;AACT,aAAS;AAAA,EACX;AACA,SAAO,MAAM,MAAM,KAAK;AAC1B;AAKO,IAAM,uCAAuC;AAM7C,IAAM,mBAAmBN,GAAE,OAAO,EAAE,MAAM,mBAAmB;AAG7D,IAAM,uBAAuBA,GACjC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,+BAA+B;AAGjC,IAAM,sBAAsB,cAAc,OAAO;AAAA,EACtD,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACrC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,6BAA6B,qBAAqB;AAAA,EAC7D,CAAC,UAAU;AACT,QAAI;AACF,aAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,cAAc;AAAA,IACvE,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,EAAE,SAAS,yDAAyD;AACtE;AAGA,IAAM,wBAAwB;AAAA,EAC5B,WAAW,oBAAoB,SAAS;AAAA,EACxC,kBAAkB;AAAA,EAClB,QAAQ,kBAAkB,SAAS;AACrC;AASO,IAAM,mBAAmB,aAAa,OAAO;AAAA,EAClD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,eAAeA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,iBAAiBA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAC5D,CAAC;AAIM,IAAM,iBAAiB,WAAW,OAAO;AAAA,EAC9C,WAAWA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACzC,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACpC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,oBAAoBA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,kBAAkBA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAChD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC1C,wBAAwBA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AACxD,CAAC;AAQM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,gBAAgBA,GAAE,QAAQ,oCAAoC;AAAA,EAC9D,QAAQ;AAAA,EACR,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC1C,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7B,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,GAAG;AAAA,EACH,OAAO;AACT,CAAC;AAIM,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EACtC,gBAAgBA,GAAE,QAAQ,oCAAoC;AAAA,EAC9D,QAAQ;AAAA,EACR,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAEtC,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,QAAQA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,GAAG;AAAA,EACH,OAAO;AACT,CAAC;AAGM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,gBAAgBA,GAAE,QAAQ,oCAAoC;AAAA,EAC9D,YAAY;AAAA,EACZ,YAAYA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,QAAQA,GAAE,MAAM,eAAe,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACjD,CAAC;AAGM,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,gBAAgBA,GAAE,QAAQ,oCAAoC;AAAA,EAC9D,YAAY;AAAA,EACZ,YAAYA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,QAAQA,GAAE,MAAM,eAAe,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACjD,CAAC;AAkBM,IAAM,+BAA+B;AACrC,IAAM,0CAA0C,kCAAkC;AAClF,IAAM,2CAA2C;AACjD,IAAM,2CAA2C,IAAI;AACrD,IAAM,mCAAmC,KAAK;AAa9C,SAAS,kBACd,OACA,UAAoC,CAAC,GACvB;AACd,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,WAAW,KAAK,IAAI,IAAI,MAAM,QAAQ,YAAY,gCAAgC;AAIxF,QAAM,gBAAgB,wBAAwB,KAAK,EAAE;AACrD,QAAM,SAAS,0BAA0B,KAAK;AAC9C,QAAM,KAAK,0BAA0B,OAAO,IAAI,uBAAuB;AACvE,QAAM,cAAc,0BAA0B,OAAO,aAAa,uBAAuB;AACzF,QAAM,YAAY,0BAA0B,OAAO,WAAW,uBAAuB;AACrF,QAAM,WACJ,OAAO,SAAS,YAChB,OAAO,OAAO,SAAS,UAAU,YACjC,OAAO,cAAc,OAAO,SAAS,KAAK,KAC1C,OAAO,SAAS,QAAQ,IACpB,OAAO,SAAS,QAChB;AACN,QAAM,aACJ,OAAO,WAAW,YAClB,OAAO,OAAO,WAAW,UAAU,YACnC,sBAAsB,OAAO,WAAW,KAAK,KAAK,MAC9C,OAAO,WAAW,QAClB;AACN,QAAM,UAAU,OAAO,KAAK,WAAW,OAAO,KAAK,QAAQ;AAC3D,QAAM,aACJ,OAAO,YAAY,YACnB,sBAAsB,OAAO,KAAK,gCAClC,CAAC,QAAQ,SAAS,IAAI,KACtB,CAAC,QAAQ,SAAS,IAAI;AACxB,QAAM,mBAAmB,OAAO,cAAc,WAAW,OAAO,cAAc,QAAQ;AACtF,QAAM,gBAAgB;AAAA,IACpB,OAAO,qBAAqB,YAAY,qBAAqB,OACzD,mBACA;AAAA,IACJ;AAAA,EACF;AACA,QAAM,qBAAqB,OAAO,gBAAgB,WAC9C,OAAO,gBAAgB,QACvB;AACJ,QAAM,kBACJ,uBAAuB,QACvB,uBAAuB,UACvB,uBAAuB,aACvB,uBAAuB,mBACvB,uBAAuB,cACnB,qBACA;AACN,QAAM,qBAAqB,OAAO,gBAAgB,WAC9C,OAAO,gBAAgB,QACvB;AACJ,QAAM,kBAAkB;AAAA,IACtB,OAAO,uBAAuB,YAAY,uBAAuB,OAC7D,qBACA;AAAA,IACJ;AAAA,EACF;AACA,QAAM,SAAS,kCAAkC,OAAO,MAAM;AAC9D,QAAM,iBAAiB,gCAAgC,OAAO,cAAc;AAC5E,QAAM,gBAAgB,kCAAkC,OAAO,aAAa;AAC5E,QAAM,qBAAqB,kCAAkC,OAAO,kBAAkB;AACtF,QAAM,iBAAiB;AAAA,IACrB,uCAAuC,KAAK;AAAA,IAC5C,8CAA8C,KAAK;AAAA,IACnD,CAAC,aACG;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,KAAK;AAAA,IACd,IACA;AAAA,IACJ,CAAC,OAAO,cAAc,YAAY,qBAAqB,gBACnD;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,cAAc;AAAA,IACvB,IACA;AAAA,IACJ,CAAC,OAAO,gBAAgB,YAAY,uBAAuB,kBACvD;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,gBAAgB;AAAA,IACzB,IACA;AAAA,IACJ,CAAC,OAAO,gBAAgB,YAAY,uBAAuB,kBACvD;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,gBAAgB;AAAA,IACzB,IACA;AAAA,IACJ,GAAG,sCAAsC,QAAQ;AAAA,MAC/C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,GAAG,qCAAqC,QAAQ;AAAA,MAC9C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,CAAC,OAAO,QAAQ,WACZ,oCAAoC,WAAW,QAAW,MAAM,KAAK,IACrE;AAAA,EACN,EAAE,OAAO,CAAC,UAAU,UAAU,IAAI;AAClC,QAAM,aAAa,OAAO,QAAQ,WAC9B,OAAO,QAAQ,QACf;AACJ,QAAM,UACJ,eAAe,WAAW,IACtB,yBAAyB,YAAY,EAAE,QAAQ,CAAC,IAChD;AAAA,IACE;AAAA,MACE,SAAS;AAAA,MACT,oBAAoB;AAAA,MACpB,cAAc,OAAO,YAAY,WAAW,sBAAsB,SAAS,GAAG,IAAI;AAAA,MAClF,oBAAoB;AAAA,QAClB,WAAW;AAAA,QACX;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,MACA,cAAc,EAAE,WAAW,OAAO,QAAQ,eAAe;AAAA,IAC3D;AAAA,IACA,EAAE,SAAS,UAAU,IAAI,KAAK;AAAA,EAChC;AACN,QAAM,UAAwB;AAAA,IAC5B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,aAAc,UAAmC;AAAA,IACvD;AAAA,IACA;AAAA,IACA,GAAI,oCAAoC,OAAO,aAAa,IAAI,EAAE,cAAc,IAAI,CAAC;AAAA,IACrF,GAAI,oCAAoC,OAAO,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC;AAAA,IACvE,GAAI,oCAAoC,OAAO,cAAc,IAAI,EAAE,eAAe,IAAI,CAAC;AAAA,IACvF,GAAI,oCAAoC,OAAO,aAAa,IAAI,EAAE,cAAc,IAAI,CAAC;AAAA,IACrF,GAAI,oCAAoC,OAAO,eAAe,IAAI,EAAE,gBAAgB,IAAI,CAAC;AAAA,IACzF,GAAI,oCAAoC,OAAO,kBAAkB,IAC7D,EAAE,mBAAmB,IACrB,CAAC;AAAA,IACL,GAAI,oCAAoC,OAAO,eAAe,IAAI,EAAE,gBAAgB,IAAI,CAAC;AAAA,EAC3F;AACA,MAAI,sBAAsB,OAAO,KAAK,SAAU,QAAO;AAEvD,QAAM,WAAyB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,SAAS;AAAA,MACP;AAAA,QACE,SAAS;AAAA,QACT,oBAAoB;AAAA,QACpB,cAAc,OAAO,YAAY,WAAW,sBAAsB,SAAS,GAAG,IAAI;AAAA,QAClF,cAAc,EAAE,WAAW,OAAO,QAAQ,eAAe;AAAA,MAC3D;AAAA,MACA,EAAE,SAAS,UAAU,IAAI,KAAK;AAAA,IAChC;AAAA,IACA;AAAA,IACA,GAAI,oCAAoC,OAAO,aAAa,IAAI,EAAE,cAAc,IAAI,CAAC;AAAA,IACrF,GAAI,oCAAoC,OAAO,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC;AAAA,IACvE,GAAI,oCAAoC,OAAO,cAAc,IAAI,EAAE,eAAe,IAAI,CAAC;AAAA,IACvF,GAAI,oCAAoC,OAAO,aAAa,IAAI,EAAE,cAAc,IAAI,CAAC;AAAA,IACrF,GAAI,oCAAoC,OAAO,eAAe,IAAI,EAAE,gBAAgB,IAAI,CAAC;AAAA,IACzF,GAAI,oCAAoC,OAAO,kBAAkB,IAC7D,EAAE,mBAAmB,IACrB,CAAC;AAAA,IACL,GAAI,oCAAoC,OAAO,eAAe,IAAI,EAAE,gBAAgB,IAAI,CAAC;AAAA,EAC3F;AACA,QAAM,iBAAiB,sBAAsB,QAAQ;AACrD,MAAI,iBAAiB,UAAU;AAC7B,UAAM,IAAI;AAAA,MACR,qDAAqD,cAAc,MAAM,QAAQ;AAAA,IACnF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oCACP,OACA,UACA,WACA,mBAAmB,MACsD;AACzE,SAAO;AAAA,IACL;AAAA,IACA,eAAe,mBACX,OAAO,aAAa,WAClB,sBAAsB,QAAQ,IAC9B,OAAO,aAAa,YAAY,OAAO,aAAa,YAClD,sBAAsB,QAAQ,IAC9B,aAAa,QAAQ,aAAa,SAChC,IACA,OACN;AAAA,IACJ,gBACE,OAAO,cAAc,WACjB,sBAAsB,SAAS,IAC/B,OAAO,cAAc,YAAY,OAAO,cAAc,YACpD,sBAAsB,SAAS,IAC/B;AAAA,EACV;AACF;AAEA,SAAS,uCACP,OACkE;AAClE,QAAM,aAAa;AAAA,IACjB,OAAO;AAAA,IACP,eAAe;AAAA,IACf,gBAAgB;AAAA,EAClB;AACA,MAAI,YAA2B;AAC/B,MAAI;AACF,aAAS,QAAQ,GAAG,SAAS,mCAAmC,SAAS,GAAG;AAC1E,UAAI,cAAc,KAAM,QAAO;AAC/B,YAAM,aAAa,OAAO,yBAAyB,WAAW,QAAQ;AACtE,UAAI,YAAY;AAKd,eAAO,EAAE,WAAW,eAAe,OAAO,WAAW,UAAU,aAC3D,aACA;AAAA,MACN;AACA,kBAAY,OAAO,eAAe,SAAS;AAAA,IAC7C;AAGA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,oCAAoC;AAC1C,IAAM,0BAA0B;AAChC,IAAM,6BACJ;AAEF,IAAM,gCAAgC;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,wCAAwC,oBAAI,IAAY;AAAA,EAC5D,GAAG;AAAA,EACH;AACF,CAAC;AAQD,SAAS,8CACP,OACkE;AAClE,QAAM,aAAa;AAAA,IACjB,OAAO;AAAA,IACP,eAAe;AAAA,IACf,gBAAgB;AAAA,EAClB;AACA,MAAI,YAAY;AAChB,MAAI;AACF,eAAW,OAAO,OAAiD;AACjE,mBAAa;AACb,UAAI,YAAY,sCAAsC,OAAO,EAAG,QAAO;AACvE,YAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,UAAI,YAAY,cAAc,CAAC,sCAAsC,IAAI,GAAG,GAAG;AAC7E,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKA,SAAS,0BAA0B,OAAgD;AACjF,SAAO,OAAO;AAAA,IACZ,8BAA8B,IAAI,CAAC,QAAQ;AACzC,UAAI;AACF,cAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,YAAI,CAAC,WAAY,QAAO,CAAC,KAAK,EAAE,UAAU,MAAM,OAAO,OAAU,CAAC;AAClE,eAAO;AAAA,UACL;AAAA,UACA,WAAW,aAAa,EAAE,UAAU,MAAM,OAAO,WAAW,MAAM,IAAI,EAAE,UAAU,MAAM;AAAA,QAC1F;AAAA,MACF,QAAQ;AACN,eAAO,CAAC,KAAK,EAAE,UAAU,MAAM,CAAC;AAAA,MAClC;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,SAAS,0BAA0B,OAA6B,UAA0B;AACxF,SAAO,MAAM,YACX,OAAO,MAAM,UAAU,YACvB,2BAA2B,KAAK,MAAM,KAAK,IACzC,MAAM,QACN;AACN;AAEA,SAAS,kCAAkC,OAA4C;AACrF,SAAO,MAAM,YACX,OAAO,MAAM,UAAU,YACvB,2BAA2B,KAAK,MAAM,KAAK,IACzC,MAAM,QACN;AACN;AAEA,SAAS,gCAAgC,OAA4C;AACnF,SAAO,MAAM,YACX,OAAO,MAAM,UAAU,YACvB,OAAO,cAAc,MAAM,KAAK,KAChC,MAAM,SAAS,IACb,MAAM,QACN;AACN;AAEA,SAAS,oCAAoC,OAAsC;AACjF,SAAO,CAAC,MAAM,YAAY,MAAM,UAAU;AAC5C;AAEA,SAAS,sCACP,QACA,WAWC;AACD,SAAQ,CAAC,MAAM,eAAe,aAAa,YAAY,YAAY,EAAY;AAAA,IAC7E,CAAC,UAAU;AACT,YAAM,WAAW,OAAO,KAAK,EAAE,WAAW,OAAO,KAAK,EAAE,QAAQ;AAChE,aAAO,OAAO,KAAK,EAAE,YAAY,aAAa,UAAU,KAAK,IACzD,CAAC,IACD;AAAA,QACE;AAAA,UACE;AAAA,UACA;AAAA,UACA,UAAU,KAAK;AAAA,UACf,OAAO,KAAK,EAAE;AAAA,QAChB;AAAA,MACF;AAAA,IACN;AAAA,EACF;AACF;AAEA,SAAS,qCACP,QACA,WAUC;AACD,SAAQ,CAAC,UAAU,kBAAkB,iBAAiB,oBAAoB,EAAY;AAAA,IACpF,CAAC,UAAU;AACT,YAAM,WAAW,OAAO,KAAK,EAAE,WAAW,OAAO,KAAK,EAAE,QAAQ;AAChE,YAAM,oBAAoB,YAAY;AACtC,aAAO,OAAO,KAAK,EAAE,YAAY,sBAAsB,UAAU,KAAK,IAClE,CAAC,IACD;AAAA,QACE;AAAA,UACE;AAAA,UACA;AAAA,UACA,UAAU,KAAK;AAAA,UACf,OAAO,KAAK,EAAE;AAAA,QAChB;AAAA,MACF;AAAA,IACN;AAAA,EACF;AACF;AAEA,SAAS,8BACP,OACA,UACG;AACH,SAAQ,OAAO,UAAU,WAAW,sBAAsB,OAAO,QAAQ,IAAI;AAC/E;AAEA,SAAS,sBAAsB,OAAe,UAA0B;AACtE,QAAMG,WAAU,IAAI,YAAY;AAChC,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,QAAQA,SAAQ,OAAO,KAAK;AAClC,MAAI,MAAM,cAAc,SAAU,QAAO;AACzC,QAAM,SAAS;AACf,QAAM,cAAcA,SAAQ,OAAO,MAAM,EAAE;AAC3C,QAAM,eAAe,KAAK,IAAI,GAAG,WAAW,WAAW;AACvD,MAAI,YAAY,KAAK,IAAI,cAAc,MAAM,UAAU;AACvD,SAAO,YAAY,KAAK,YAAY,MAAM,eAAe,MAAM,SAAS,IAAK,SAAU,KAAM;AAC3F,iBAAa;AAAA,EACf;AACA,SAAO,GAAG,QAAQ,OAAO,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,GAAG,MAAM;AACjE;AAEA,SAAS,sBAAsB,OAAuB;AACpD,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AACzC;AAEO,IAAM,+BAA+BH,GAAE,OAAO;AAAA,EACnD,SAAS;AAAA,EACT,UAAU;AAAA,EACV,OAAO,cAAc,SAAS;AAChC,CAAC;AAGM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,SAAS;AAAA,EACT,kBAAkB;AAAA,EAClB,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAChD,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC1C,CAAC;AAGM,IAAM,uBAAuB,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOzD,oBAAoBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,EAGhC,kBAAkBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS/D,cAAcA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3D,WAAWA,GAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA,EAG1C,QAAQ,cAAc,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA,EAIhC,OAAOA,GAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClC,UAAUA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,iBAAiB,gBAAgB,SAAS;AAAA,EAC1C,gBAAgB,eAAe,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxC,iBAAiBA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM5C,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvC,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1C,OAAOA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAClC,MAAM,SAAS,SAAS;AAAA,EACxB,eAAe,oBAAoB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO5C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKpD,iCAAiCA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA;AAAA,EAGzE,qBAAqB,sBAAsB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOpD,0BAA0BA,GAAE,MAAM,UAAU,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIvD,oBAAoBA,GAAE,MAAM,qBAAqB,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO5D,YAAYA,GAAE,MAAM,qBAAqB,EAAE,IAAI,uBAAuB,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBlF,SAASA,GACN,MAAM,CAACA,GAAE,QAAQ,QAAQ,GAAGA,GAAE,QAAQ,KAAK,GAAGA,GAAE,OAAO,EAAE,SAASA,GAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EACvF,SAAS;AACd,CAAC;AAOM,IAAM,yBAAyBA,GAAE,KAAK,CAAC,QAAQ,iBAAiB,cAAc,CAAC;AAG/E,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAC5B,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,aAAaA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AACxD,CAAC;AAGM,IAAM,qBAAqBA,GAC/B,OAAO;AAAA,EACN,IAAIA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAC5B,MAAM;AAAA,EACN,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAClC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,UAAUA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,SAASA,GAAE,MAAM,gBAAgB,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;AAAA,EACrD,UAAUA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAClC,YAAYA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACrC,YAAYA,GACT,OAAO;AAAA,IACN,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IACxE,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IACrE,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,IAC1E,eAAeA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EACzE,CAAC,EACA,SAAS,EACT,SAAS;AACd,CAAC,EACA,YAAY,CAAC,UAAU,QAAQ;AAC9B,QAAM,YAAY,IAAI,IAAI,SAAS,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AACrE,MAAI,UAAU,SAAS,SAAS,QAAQ,QAAQ;AAC9C,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,SAAS,SAAS,QAAQ;AAC5B,QAAI,SAAS,QAAQ,SAAS,GAAG;AAC/B,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,SAAS;AAAA,QAChB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,SAAS,YAAY;AACvB,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,YAAY;AAAA,QACnB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,WAAW,SAAS,QAAQ,WAAW,GAAG;AACxC,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,aAAa,SAAS;AAC5B,MACE,YAAY,aAAa,QACzB,YAAY,aAAa,QACzB,WAAW,YAAY,WAAW,WAClC;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,YAAY;AAAA,MACnB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,YAAY,iBAAiB,QAC7B,YAAY,iBAAiB,QAC7B,WAAW,gBAAgB,WAAW,eACtC;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,YAAY;AAAA,MACnB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,0BAA0BA,GAAE,KAAK;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,6BAA6BA,GAAE,OAAO;AAAA,EACjD,WAAWA,GAAE,MAAM,kBAAkB,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACpD,WAAWA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACpC,kBAAkBA,GACf,OAAO,EACP,IAAI,EACJ,SAAS,EACT,IAAI,KAAK,KAAK,KAAK,EAAE,EACrB,SAAS,EACT,SAAS;AACd,CAAC;AAGM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACpC,QAAQA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAC5C,OAAOA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,SAAS;AAClD,CAAC;AAGM,IAAM,qBAAqBA,GAAE,mBAAmB,WAAW;AAAA,EAChEA,GAAE,OAAO;AAAA,IACP,SAASA,GAAE,QAAQ,UAAU;AAAA,IAC7B,SAASA,GAAE,MAAM,gBAAgB,EAAE,IAAI,EAAE;AAAA,EAC3C,CAAC;AAAA,EACDA,GAAE,OAAO,EAAE,SAASA,GAAE,QAAQ,SAAS,EAAE,CAAC;AAAA,EAC1CA,GAAE,OAAO,EAAE,SAASA,GAAE,QAAQ,SAAS,EAAE,CAAC;AAAA,EAC1CA,GAAE,OAAO,EAAE,SAASA,GAAE,QAAQ,WAAW,EAAE,CAAC;AAC9C,CAAC;AAGM,IAAM,kCAAkCA,GAAE,mBAAmB,WAAW;AAAA,EAC7EA,GAAE,OAAO;AAAA,IACP,SAASA,GAAE,QAAQ,UAAU;AAAA,IAC7B,SAASA,GAAE,MAAM,gBAAgB,EAAE,IAAI,EAAE;AAAA,EAC3C,CAAC;AAAA,EACDA,GAAE,OAAO,EAAE,SAASA,GAAE,QAAQ,SAAS,EAAE,CAAC;AAC5C,CAAC;AAGM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQA,GAAE,OAAO,EAAE,KAAK;AAAA,EACxB,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC1C,mBAAmBA,GAAE,OAAO,EAAE,KAAK;AAAA,EACnC,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACtC,QAAQ;AAAA,EACR,WAAWA,GAAE,MAAM,kBAAkB,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACpD,WAAWA,GAAE,QAAQ;AAAA,EACrB,UAAU,mBAAmB,SAAS;AAAA,EACtC,aAAaA,GAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAC3C,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAQM,SAAS,mBAAmB,OAA+B;AAChE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,WAAW;AACjB,QAAM,UACJ,SAAS,WAAW,OAAO,SAAS,YAAY,WAC3C,SAAS,UACV;AACN,QAAM,YAAY,SAAS,UAAU,SAAS,MAAM,SAAS,MAAM,SAAS;AAC5E,MAAI,OAAO,cAAc,YAAY,OAAO,cAAc,SAAU,QAAO;AAC3E,SAAO,OAAO,SAAS;AACzB;AAEO,IAAM,qBAAqBA,GAAE,mBAAmB,QAAQ;AAAA,EAC7DA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,cAAc;AAAA,IAC9B,eAAe,oBAAoB,SAAS;AAAA,IAC5C,SAASA,GAAE,OAAO;AAAA,MAChB,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,MAGtB,kBAAkBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA,MAC/D,WAAWA,GAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA,MAC1C,OAAOA,GAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,MAClC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAClC,iBAAiB,gBAAgB,SAAS;AAAA,MAC1C,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACxC,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAAA;AAAA,MAG/D,sBAAsBA,GAAE,MAAM,+BAA+B,EAAE,SAAS;AAAA,IAC1E,CAAC;AAAA,EACH,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,uBAAuB;AAAA,IACvC,eAAe,oBAAoB,SAAS;AAAA,IAC5C,SAASA,GAAE,OAAO;AAAA,MAChB,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,+BAA+B;AAAA,MACjE,UAAUA,GAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;AAAA,MACtC,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,CAAC;AAAA,EACH,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,yBAAyB;AAAA,IACzC,eAAe,oBAAoB,SAAS;AAAA,IAC5C,SAASA,GAAE,OAAO;AAAA,MAChB,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,MAC3B,UAAU;AAAA,IACZ,CAAC;AAAA,EACH,CAAC;AACH,CAAC;AAGM,IAAM,6BAA6BA,GAAE,OAAO;AAAA,EACjD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,kBAAkBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA,EAC/D,WAAWA,GAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC1C,OAAOA,GAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,iBAAiB,gBAAgB,SAAS;AAAA,EAC1C,eAAe,oBAAoB,SAAS;AAAA,EAC5C,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC/D,sBAAsBA,GAAE,MAAM,+BAA+B,EAAE,SAAS;AAC1E,CAAC;AAGM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,UAAU;AAAA,EACV,MAAM;AACR,CAAC;AAGM,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQA,GAAE,MAAM,YAAY,EAAE,IAAI,CAAC;AACrC,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,QAAQA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjC,sBAAsBA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAChD,CAAC;AAGM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,IAAIA,GAAE,OAAO,EAAE,IAAI;AAAA,EACnB,gBAAgBA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,UAAUA,GAAE,OAAO;AAAA,EACnB,MAAMA,GAAE,OAAO;AAAA,EACf,SAASA,GAAE,QAAQ;AAAA,EACnB,SAASA,GAAE,OAAO;AAAA,EAClB,UAAUA,GAAE,OAAO;AAAA,EACnB,eAAeA,GAAE,OAAO;AAAA,EACxB,cAAcA,GAAE,OAAO;AAAA,EACvB,aAAaA,GAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAGM,IAAM,wBAAwBA,GAAE,KAAK,CAAC,OAAO,UAAU,CAAC;AAGxD,IAAM,sBAAsBA,GAAE,KAAK,CAAC,YAAY,WAAW,OAAO,CAAC;AAGnE,IAAM,8BAA8BA,GAAE,KAAK,CAAC,UAAU,aAAa,WAAW,YAAY,CAAC;AAG3F,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,gBAAgBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC1C,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC9C,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAGM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,YAAYA,GAAE,QAAQ;AAAA,EACtB,QAAQ;AAAA,EACR,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,UAAUA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,eAAeA,GAAE,MAAM,yBAAyB;AAAA,EAChD,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAC7B,CAAC;AAGM,IAAM,6BAA6BA,GAAE,OAAO;AAAA,EACjD,cAAcA,GAAE,MAAM,gBAAgB;AACxC,CAAC;AAGM,IAAM,mBAAmBA,GAAE,mBAAmB,QAAQ;AAAA,EAC3DA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,MAAM;AAAA,EACxB,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,eAAe;AAAA,IAC/B,YAAYA,GAAE,QAAQ,uBAAuB;AAAA,EAC/C,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,iBAAiB;AAAA,IACjC,YAAYA,GAAE,QAAQ,eAAe;AAAA,IACrC,QAAQA,GAAE,QAAQ,QAAQ;AAAA,EAC5B,CAAC;AAAA,EACDA,GAAE,OAAO;AAAA,IACP,MAAMA,GAAE,QAAQ,gBAAgB;AAAA,IAChC,SAASA,GAAE,QAAQ,QAAQ;AAAA,EAC7B,CAAC;AACH,CAAC;AAOM,IAAM,8BAA8BA,GAAE,KAAK;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF,CAAC;AAGM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,SAAS;AAAA,EACT,IAAI;AAAA,EACJ,UAAUA,GAAE,KAAK,CAAC,QAAQ,WAAW,QAAQ,UAAU,CAAC;AAAA;AAAA,EAExD,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC3E,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACzE,iBAAiBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAC1C,2BAA2BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EACrE,YAAYA,GAAE,OAAO;AAAA,IACnB,WAAWA,GAAE,QAAQ;AAAA,IACrB,UAAUA,GAAE,QAAQ;AAAA,IACpB,MAAMA,GAAE,OAAO;AAAA,IACf,SAASA,GAAE,KAAK,CAAC,KAAK,IAAI,CAAC;AAAA,IAC3B,UAAUA,GAAE,KAAK,CAAC,QAAQ,UAAU,CAAC;AAAA,IACrC,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,UAAUA,GAAE,OAAO;AAAA,IACjB,WAAWA,GAAE,KAAK,CAAC,cAAc,QAAQ,CAAC,EAAE,SAAS;AAAA,IACrD,YAAYA,GAAE,QAAQ;AAAA,IACtB,OAAOA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKhB,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC/B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,IAG3B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,KAAKA,GAAE,OAAO;AAAA,IACZ,WAAWA,GAAE,QAAQ;AAAA,IACrB,OAAOA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,IACzB,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,eAAeA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA,IAItB,WAAWA,GAAE,KAAK,CAAC,UAAU,UAAU,UAAU,cAAc,CAAC,EAAE,SAAS;AAAA,IAC3E,QAAQA,GAAE,KAAK,CAAC,SAAS,WAAW,QAAQ,CAAC,EAAE,SAAS;AAAA,IACxD,MAAMA,GAAE,KAAK,CAAC,aAAa,aAAa,CAAC,EAAE,QAAQ,WAAW;AAAA,IAC9D,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC/B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,YAAYA,GACT,MAAM,CAACA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAGA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,EAChE,QAAQ,CAAC,MAAM,GAAG,CAAC;AAAA;AAAA,IAEtB,YAAYA,GAAE,QAAQ;AAAA,IACtB,wBAAwBA,GAAE,QAAQ;AAAA,IAClC,cAAcA,GAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASxB,QAAQA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,IACjC,kBAAkBA,GAAE,MAAMA,GAAE,OAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,IACvD,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,WAAWA,GAAE,OAAO;AAAA,IAClB,WAAWA,GAAE,QAAQ;AAAA,IACrB,OAAOA,GAAE,MAAMA,GAAE,KAAK,CAAC,UAAU,WAAW,WAAW,CAAC,CAAC;AAAA,IACzD,QAAQA,GAAE,MAAMA,GAAE,KAAK,CAAC,YAAY,UAAU,CAAC,CAAC;AAAA,IAChD,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKD,aAAaA,GAAE,OAAO;AAAA,IACpB,WAAWA,GAAE,QAAQ;AAAA,IACrB,UAAUA,GAAE,QAAQ;AAAA,IACpB,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,cAAcA,GAAE,OAAO;AACzB,CAAC;AAkBM,IAAM,sBAAsBA,GAAE,OAAO;AAAA,EAC1C,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,SAASA,GAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAGM,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,UAAUA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,gBAAgBA,GAAE,OAAO,EAAE,KAAK;AAAA,EAChC,UAAUA,GAAE,KAAK,CAAC,QAAQ,WAAW,QAAQ,UAAU,CAAC;AAAA;AAAA,EAExD,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC7D,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC3D,iBAAiBA,GAAE,QAAQ;AAAA,EAC3B,2BAA2BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAGrD,cAAcA,GAAE,OAAO,EAAE,SAAS;AACpC,CAAC;AAYM,IAAM,2BAA2BA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA,EAI/C,uBAAuBA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA,EAG/C,mBAAmBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAC9C,CAAC;AAGM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,cAAcA,GAAE,QAAQ;AAAA,EACxB,oBAAoBA,GAAE,QAAQ;AAChC,CAAC;AAKM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC3C,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA;AAAA,EAE9C,OAAOA,GAAE,QAAQ;AACnB,CAAC;AAcM,IAAM,eAAeA,GAAE,KAAK,CAAC,SAAS,SAAS,SAAS,CAAC;AAEzD,IAAM,iBAAiBA,GAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAOnD,IAAM,+BAA+BA,GAAE,OAAO;AAAA;AAAA,EAEnD,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACrC,IAAI,aAAa,QAAQ,OAAO;AAAA,EAChC,MAAM,eAAe,QAAQ,QAAQ;AAAA;AAAA,EAErC,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEjD,UAAUA,GAAE,QAAQ,eAAe,EAAE,QAAQ,eAAe;AAAA;AAAA,EAE5D,iBAAiBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA,EAG1C,uBAAuBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhD,aAAaA,GAAE,OAAO,EAAE,KAAK;AAC/B,CAAC;AAIM,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,YAAYA,GAAE,OAAO;AAAA,EACrB,UAAUA,GAAE,OAAO;AAAA,EACnB,iBAAiBA,GAAE,OAAO;AAAA,EAC1B,yBAAyBA,GAAE,OAAO;AAAA,EAClC,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC9C,CAAC;AAMM,IAAM,iCAAiCA,GAAE,OAAO;AAAA,EACrD,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAClC,oBAAoBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAC/C,CAAC;AAGM,IAAM,kCAAkCA,GAAE,OAAO;AAAA,EACtD,UAAUA,GAAE,QAAQ;AAAA,EACpB,cAAcA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,WAAWA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,oBAAoBA,GAAE,QAAQ;AAChC,CAAC;AAIM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACvC,CAAC;AAGM,IAAM,wBAAwBA,GAAE,KAAK;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,SAASA,GAAE,OAAO,EAAE,KAAK;AAAA,EACzB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE7B,QAAQA,GAAE,OAAO;AAAA;AAAA;AAAA,EAGjB,eAAeA,GAAE,OAAO;AAAA;AAAA;AAAA,EAGxB,UAAUA,GAAE,MAAMA,GAAE,OAAO,CAAC;AAAA,EAC5B,UAAUA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOnB,YAAYA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMrB,kBAAkBA,GAAE,OAAO;AAAA;AAAA,EAE3B,iBAAiBA,GAAE,OAAO;AAAA,EAC1B,uBAAuBA,GAAE,QAAQ;AAAA,EACjC,wBAAwBA,GAAE,QAAQ;AACpC,CAAC;AAGM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,OAAO;AAAA;AAAA,EAEP,aAAa,8BAA8B,SAAS;AACtD,CAAC;AAIM,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,IAAIA,GAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQA,GAAE,OAAO;AAAA,EACjB,UAAUA,GAAE,QAAQ,eAAe;AAAA,EACnC,YAAYA,GAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtB,0BAA0BA,GAAE,OAAO,EAAE,QAAQ;AAAA,EAC7C,oBAAoBA,GAAE,QAAQ;AAAA,EAC9B,QAAQA,GAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,IAAI;AAAA,EACJ,MAAMA,GAAE,OAAO;AAAA,EACf,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO;AAAA,EACpB,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA,EAC9C,aAAaA,GAAE,MAAM,iBAAiB;AACxC,CAAC;AAGM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,SAASA,GAAE,QAAQ;AACrB,CAAC;AAgBM,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AACpC,CAAC;AAKM,IAAM,gCAAgCA,GAAE,OAAO;AAAA,EACpD,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,EACjC,IAAI;AAAA,EACJ,MAAMA,GAAE,OAAO;AAAA,EACf,iBAAiBA,GAAE,QAAQ;AAAA,EAC3B,uBAAuBA,GAAE,QAAQ;AACnC,CAAC;AAGM,IAAM,iCAAiCA,GAAE,OAAO;AAAA,EACrD,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,UAAUA,GAAE,OAAO;AAAA,EACnB,SAAS;AAAA,EACT,WAAWA,GAAE,OAAO;AACtB,CAAC;AAKM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AACpC,CAAC;AAGM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,QAAQA,GAAE,QAAQ;AACpB,CAAC;AAMM,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EAC7C,oBAAoBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAC/C,CAAC;AAGM,IAAM,0BAA0BA,GAAE,OAAO;AAAA;AAAA,EAE9C,OAAOA,GAAE,OAAO;AAAA,EAChB,WAAWA,GAAE,OAAO;AAAA,EACpB,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC9C,CAAC;AAQM,IAAM,6BAA6BA,GAAE,OAAO;AAAA;AAAA,EAEjD,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEvB,WAAWA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACrC,IAAI,aAAa,QAAQ,OAAO;AAAA,EAChC,MAAM,eAAe,QAAQ,QAAQ;AAAA,EACrC,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEjD,UAAUA,GAAE,QAAQ,eAAe,EAAE,QAAQ,eAAe;AAAA,EAC5D,iBAAiBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAE1C,uBAAuBA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAClD,CAAC;AAKM,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAClD,aAAa;AACf,CAAC;AAkBM,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,QAAQA,GAAE,OAAO;AAAA,EACjB,OAAOA,GAAE,OAAO;AAAA,EAChB,OAAOA,GAAE,OAAO;AAAA,EAChB,QAAQA,GAAE,OAAO;AAAA,EACjB,cAAcA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,eAAeA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC9B,eAAeA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC9B,gBAAgBA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvC,UAAUA,GAAE,OAAO;AAAA,EACnB,WAAWA,GAAE,OAAO;AACtB,CAAC;AAOM,IAAM,eAAeA,GAAE,KAAK;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,cAAcA,GAAE,KAAK,CAAC,SAAS,YAAY,CAAC;AAWlD,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,WAAWA,GAAE,OAAO;AAAA,EACpB,cAAcA,GAAE,OAAO,EAAE,SAAS;AAAA,EAClC,MAAMA,GAAE,OAAO;AAAA,EACf,MAAM;AAAA,EACN,OAAO;AAAA,EACP,QAAQA,GAAE,QAAQ;AAAA,EAClB,gBAAgBA,GAAE,QAAQ;AAAA,EAC1B,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC7D,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC3D,iBAAiBA,GAAE,QAAQ;AAAA,EAC3B,IAAIA,GAAE,OAAO;AAAA,EACb,MAAMA,GAAE,OAAO;AAAA,EACf,YAAYA,GAAE,QAAQ;AAAA;AAAA;AAAA;AAAA,EAItB,0BAA0BA,GAAE,OAAO,EAAE,QAAQ;AAAA,EAC7C,oBAAoBA,GAAE,QAAQ;AAAA,EAC9B,oBAAoBA,GAAE,OAAO,EAAE,IAAI;AAAA,EACnC,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,SAAS,aAAa,SAAS;AACjC,CAAC;AAQM,IAAM,mBAAmBA,GAAE,OAAO;AAAA,EACvC,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,aAAaA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,UAAUA,GAAE,MAAM,WAAW;AAC/B,CAAC;AAUM,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EAC/C,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAC1B,CAAC;AAQM,IAAM,4BAA4BA,GAAE,OAAO;AAAA,EAChD,SAASA,GAAE,QAAQ;AAAA,EACnB,iBAAiBA,GAAE,OAAO,EAAE,SAAS;AAAA,EACrC,aAAaA,GAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK5B,MAAMA,GACH,KAAK;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,SAAS;AACd,CAAC;AAOM,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EACnD,SAASA,GAAE,MAAM,YAAY;AAC/B,CAAC;AASD,SAAS,0BAAkC,SAA+B;AACxE,SAAO,QAAQ;AACjB;AAEO,IAAM,2BAA2C;AAAA,EAA0B,MAChFA,GAAE,KAAK,CAAC,aAAa,eAAe,SAAS,CAAC;AAChD;AAGO,IAAM,yBAAyC;AAAA,EAA0B,MAC9EA,GAAE,OAAO;AAAA,IACP,UAAU;AAAA,IACV,UAAUA,GAAE,QAAQ;AAAA,EACtB,CAAC;AACH;AAGO,IAAM,sBAAsC;AAAA,EAA0B,MAC3EA,GAAE,OAAO;AAAA,IACP,WAAW,uBAAuB,OAAO;AAAA,MACvC,SAASA,GAAE,MAAM,eAAe;AAAA,MAChC,eAAe,gBAAgB,SAAS;AAAA,MACxC,UAAUA,GAAE,QAAQ;AAAA,IACtB,CAAC;AAAA,IACD,iBAAiB;AAAA,IACjB,kBAAkB;AAAA,IAClB,aAAaA,GAAE,OAAO;AAAA,MACpB,WAAW;AAAA,MACX,SAAS;AAAA,MACT,eAAe;AAAA,IACjB,CAAC;AAAA,IACD,iBAAiBA,GAAE,MAAMA,GAAE,KAAK,CAAC,QAAQ,SAAS,OAAO,CAAC,CAAC;AAAA,IAC3D,kBAAkBA,GAAE,MAAMA,GAAE,KAAK,CAAC,QAAQ,SAAS,OAAO,CAAC,CAAC;AAAA,IAC5D,YAAYA,GAAE,OAAO;AAAA,MACnB,KAAK;AAAA,MACL,oBAAoB;AAAA,MACpB,eAAe;AAAA,IACjB,CAAC;AAAA,IACD,cAAcA,GAAE;AAAA,MACdA,GAAE,OAAO;AAAA,QACP,IAAIA,GAAE,KAAK,CAAC,YAAY,YAAY,MAAM,CAAC;AAAA,QAC3C,UAAU;AAAA,QACV,UAAUA,GAAE,QAAQ;AAAA,QACpB,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,MAC7D,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAGO,IAAM,0BAA0C;AAAA,EAA0B,MAC/EA,GAAE,MAAM;AAAA,IACNA,GACG,OAAO,EAAE,MAAMA,GAAE,QAAQ,YAAY,GAAG,WAAWA,GAAE,KAAK,CAAC,WAAW,iBAAiB,CAAC,EAAE,CAAC,EAC3F,OAAO;AAAA,IACVA,GAAE,OAAO,EAAE,MAAMA,GAAE,QAAQ,wBAAwB,GAAG,UAAUA,GAAE,QAAQ,OAAO,EAAE,CAAC,EAAE,OAAO;AAAA,IAC7FA,GAAE,OAAO,EAAE,MAAMA,GAAE,QAAQ,sBAAsB,GAAG,WAAWA,GAAE,QAAQ,SAAS,EAAE,CAAC,EAAE,OAAO;AAAA,EAChG,CAAC;AACH;AAGO,IAAM,4BAA4C;AAAA,EAA0B,MACjFA,GACG,OAAO;AAAA,IACN,eAAeA,GAAE,KAAK,CAAC,cAAc,aAAa,wBAAwB,CAAC;AAAA,IAC3E,UAAUA,GAAE,KAAK,CAAC,oBAAoB,UAAU,CAAC;AAAA,EACnD,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,qCAAqC;AAE3C,IAAM,6BAA6C;AAAA,EAA0B,MAClFA,GAAE,KAAK,CAAC,YAAY,WAAW,cAAc,cAAc,CAAC;AAC9D;AAGO,IAAM,iCAAiD;AAAA,EAA0B,MACtFA,GAAE,KAAK,CAAC,YAAY,WAAW,cAAc,cAAc,CAAC;AAC9D;AAWO,IAAM,wBAAwC;AAAA,EAA0B,MAC7EA,GACG,OAAO;AAAA,IACN,eAAeA,GAAE,QAAQ,CAAC;AAAA,IAC1B,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAChC,kBAAkBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAC7C,aAAa;AAAA,IACb,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,IACjB,YAAYA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC5B,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACjC,SAASA,GAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,IACrC,kBAAkB;AAAA,IAClB,SAAS;AAAA,IACT,mBAAmBA,GAAE,OAAO,EAAE,MAAM,wBAAwB;AAAA,EAC9D,CAAC,EACA,OAAO,EACP,YAAY,CAAC,QAAQ,YAAY;AAChC,QAAI,OAAO,gBAAgB,cAAc,OAAO,qBAAqB,MAAM;AACzE,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,kBAAkB;AAAA,QACzB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,OAAO,gBAAgB,cAAc,OAAO,qBAAqB,MAAM;AACzE,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,kBAAkB;AAAA,QACzB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACL;AAaO,SAAS,0BAA0B,UAA8C;AACtF,MAAI,aAAa,QAAQ,aAAa,QAAW;AAC/C,WAAO,EAAE,MAAM,SAAS;AAAA,EAC1B;AACA,MAAI,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,GAAG;AAC3D,UAAM,IAAI,MAAM,0EAA0E;AAAA,EAC5F;AACA,QAAM,SAAS;AACf,MAAI,CAAC,OAAO,UAAU,eAAe,KAAK,QAAQ,kCAAkC,GAAG;AACrF,WAAO,EAAE,MAAM,SAAS;AAAA,EAC1B;AACA,QAAM,SAAS,sBAAsB,UAAU,OAAO,kCAAkC,CAAC;AACzF,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,QAAQ;AAAA,MACZ,GAAG,IAAI;AAAA,QACL,OAAO,MAAM,OAAO;AAAA,UAAI,CAAC,UACvB,MAAM,KAAK,WAAW,IAAI,WAAW,UAAU,MAAM,KAAK,KAAK,GAAG,CAAC;AAAA,QACrE;AAAA,MACF;AAAA,IACF,EAAE,KAAK,IAAI;AACX,UAAM,IAAI,MAAM,+CAA+C,SAAS,QAAQ,EAAE;AAAA,EACpF;AACA,SAAO,EAAE,MAAM,SAAS,QAAQ,OAAO,KAAK;AAC9C;AAGO,SAAS,kCACd,UACA,QACyB;AACzB,SAAO;AAAA,IACL,GAAI,YAAY,CAAC;AAAA,IACjB,CAAC,kCAAkC,GAAG,sBAAsB,MAAM,MAAM;AAAA,EAC1E;AACF;AAOO,SAAS,iCACd,QACA,QACyB;AACzB,QAAM,SAAS,sBAAsB,MAAM,MAAM;AACjD,SAAO;AAAA,IACL;AAAA,IACA,kBAAkB,OAAO;AAAA,IACzB,kBAAkB,OAAO;AAAA,IACzB,aAAa,OAAO;AAAA,IACpB,0BAA0B,OAAO;AAAA,IACjC,iBAAiB,OAAO;AAAA,IACxB,YAAY,OAAO;AAAA,IACnB,sBAAsB,OAAO,iBAAiB;AAAA,IAC9C,2BACE,OAAO,iBAAiB,SAAS,2BAC7B,OAAO,iBAAiB,WACxB,OAAO,iBAAiB;AAAA,IAC9B,cAAc,OAAO,QAAQ;AAAA,IAC7B,iBAAiB,OAAO,QAAQ;AAAA,IAChC,mBAAmB,OAAO;AAAA,EAC5B;AACF;AAEO,IAAM,iBAAiC;AAAA,EAA0B,MACtEA,GAAE,OAAO;AAAA,IACP,6BAA6BA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IAC1D,mCAAmCA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,IAC3E,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IAC3D,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO,EAAE,SAAS;AAAA,EAC3D,CAAC;AACH;AAGO,IAAM,yBAAyC;AAAA,EAA0B,MAC9EA,GAAE,OAAO;AAAA,IACP,SAAS;AAAA,IACT,iBAAiBA,GACd;AAAA,MACCA,GAAE,OAAO;AAAA,QACP,oBAAoBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,QACjD,SAAS;AAAA,MACX,CAAC;AAAA,IACH,EACC,SAAS;AAAA,EACd,CAAC;AACH;AAUO,IAAM,cAA8B;AAAA,EAA0B,MACnEA,GAAE,OAAO;AAAA,IACP,IAAIA,GAAE,OAAO;AAAA,IACb,OAAOA,GAAE,OAAO;AAAA,IAChB,UAAUA,GAAE,OAAO;AAAA;AAAA,IACnB,eAAeA,GAAE,OAAO;AAAA,IACxB,KAAKA,GAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,IACjC,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,IAG1D,eAAeA,GAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,IACrC,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IACtC,YAAYA,GACT,OAAO;AAAA,MACN,iBAAiBA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACjC,SAASA,GAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,IACvC,CAAC,EACA,SAAS;AAAA,IACZ,iBAAiBA,GACd,OAAO;AAAA,MACN,qBAAqBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,MAC1D,8BAA8BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,MACnE,uBAAuBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,MAC5D,4BAA4BA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IACnE,CAAC,EACA,SAAS;AAAA,IACZ,kBAAkB,wBAAwB,SAAS;AAAA,IACnD,SAAS,0BAA0B,SAAS;AAAA,IAC5C,cAAc,oBAAoB,SAAS;AAAA,IAC3C,SAAS,uBAAuB,SAAS;AAAA,IACzC,mBAAmBA,GAChB,OAAO,EACP,MAAM,wBAAwB,EAC9B,SAAS;AAAA,EACd,CAAC;AACH;AAGO,IAAM,6BAA6C;AAAA,EAA0B,MAClFA,GACG,OAAO;AAAA,IACN,QAAQA,GAAE,KAAK,CAAC,SAAS,aAAa,OAAO,CAAC;AAAA,IAC9C,QAAQA,GACL,KAAK;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,EACA,SAAS;AAAA,IACZ,OAAOA,GAAE,KAAK,CAAC,iBAAiB,cAAc,UAAU,CAAC;AAAA,IACzD,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,CAAC,EACA,OAAO,EACP,YAAY,CAAC,WAAW,YAAY;AACnC,QAAK,UAAU,WAAW,aAAc,UAAU,WAAW,OAAO;AAClE,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,QAAQ;AAAA,QACf,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAK,UAAU,WAAW,aAAc,UAAU,WAAW,mBAAmB;AAC9E,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,QAAQ;AAAA,QACf,SACE;AAAA,MACJ,CAAC;AAAA,IACH;AACA,QACE,UAAU,UAAU,cACpB,UAAU,WAAW,WACrB,UAAU,cAAc,MACxB;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,WAAW;AAAA,QAClB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,UAAU,WAAW,uBAAuB,UAAU,cAAc,MAAM;AAC5E,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,WAAW;AAAA,QAClB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACL;AAGO,IAAM,sBAAsC;AAAA,EAA0B,MAC3EA,GAAE,OAAO;AAAA,IACP,QAAQA,GAAE,KAAK,CAAC,aAAa,eAAe,YAAY,SAAS,CAAC;AAAA,IAClE,YAAYA,GAAE,QAAQ;AAAA,IACtB,QAAQA,GACL,KAAK;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,EACA,SAAS;AAAA,IACZ,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,CAAC;AACH;AAGO,IAAM,6BAA6C;AAAA,EAA0B,MAClF,YAAY,OAAO;AAAA,IACjB,qBAAqB;AAAA,IACrB,cAAc;AAAA,EAChB,CAAC;AACH;AAGO,IAAM,gCAAgD;AAAA,EAA0B,MACrFA,GAAE,OAAO;AAAA,IACP,QAAQA,GAAE,MAAM,0BAA0B;AAAA,EAC5C,CAAC;AACH;AAWO,IAAM,iCAAiC;AACvC,IAAM,+BAA+B;AAErC,IAAM,8BAA8B;AAEpC,IAAM,eAA+B;AAAA,EAA0B,MACpEA,GAAE,OAAO;AAAA,IACP,oBAAoBA,GAAE,OAAO;AAAA,IAC7B,qBAAqBA,GAAE,QAAQ,8BAA8B;AAAA;AAAA;AAAA;AAAA,IAI7D,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,IACnC,cAAcA,GAAE,OAAO;AAAA,IACvB,eAAeA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,IAGxC,QAAQA,GAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA,IACvC,wBAAwB;AAAA,IACxB,yBAAyBA,GAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AAAA,IACvD,YAAYA,GACT;AAAA,MACCA,GAAE,OAAO;AAAA,QACP,IAAIA,GAAE,OAAO;AAAA,QACb,MAAMA,GAAE,OAAO;AAAA,MACjB,CAAC;AAAA,IACH,EACC,QAAQ,CAAC,CAAC;AAAA,IACb,aAAaA,GAAE,OAAO;AAAA,MACpB,SAASA,GAAE,QAAQ;AAAA,MACnB,cAAcA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC1C,CAAC;AAAA,IACD,mBAAmB;AAAA,IACnB,MAAM,iBAAiB,QAAQ,EAAE,MAAM,OAAO,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,IAK/C,oBAAoBA,GACjB,OAAO;AAAA,MACN,YAAYA,GAAE,QAAQ;AAAA,MACtB,KAAKA,GAAE,QAAQ;AAAA,MACf,gBAAgBA,GAAE,QAAQ;AAAA,IAC5B,CAAC,EACA,QAAQ,EAAE,YAAY,OAAO,KAAK,OAAO,gBAAgB,MAAM,CAAC;AAAA,EACrE,CAAC;AACH;AAGA,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,WAAW;AACxD;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM;AACxD;AAEA,eAAe,oBAAoB,QAAgB,OAAgC;AACjF,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,IAC/B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACvF,SAAO,OAAO,KAAK,SAAS,EAAE,SAAS,WAAW;AACpD;AAEA,SAAS,kBAAkB,QAAgB,UAA2B;AACpE,QAAM,cAAc,IAAI,YAAY,EAAE,OAAO,MAAM;AACnD,QAAM,gBAAgB,IAAI,YAAY,EAAE,OAAO,QAAQ;AACvD,MAAI,YAAY,WAAW,cAAc,QAAQ;AAC/C,WAAO;AAAA,EACT;AACA,MAAI,OAAO;AACX,WAAS,QAAQ,GAAG,QAAQ,YAAY,QAAQ,SAAS,GAAG;AAC1D,YAAQ,YAAY,KAAK,IAAK,cAAc,KAAK;AAAA,EACnD;AACA,SAAO,SAAS;AAClB;AA4BO,SAAS,6BACd,QACA,WAC6B;AAC7B,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,MAAI,OAAO,qBAAqB,QAAQ,CAAC,OAAO,iBAAiB,SAAS,UAAU,UAAU,GAAG;AAC/F,WAAO,EAAE,SAAS,OAAO,QAAQ,WAAW;AAAA,EAC9C;AACA,MAAI,OAAO,kBAAkB,QAAQ,CAAC,OAAO,cAAc,SAAS,UAAU,OAAO,GAAG;AACtF,WAAO,EAAE,SAAS,OAAO,QAAQ,QAAQ;AAAA,EAC3C;AACA,SAAO,EAAE,SAAS,KAAK;AACzB;","names":["z","encoder","omitted","marker","contentBudget","left","right","toJson","bytes","z","z","registryId","sortJson","encoder","deliveredBytes","fingerprint","utf8Bytes"]}