@opengeni/contracts 0.6.0 → 0.9.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const SessionStatus = z.enum([\n  \"queued\",\n  \"running\",\n  \"idle\",\n  \"requires_action\",\n  \"failed\",\n  \"cancelled\",\n]);\nexport type SessionStatus = z.infer<typeof SessionStatus>;\n\n// 11 backends; 3-way enum parity (contracts / sdk / deployment) is pinned by\n// `packages/sdk/test/contract-parity.test.ts`. Every member is ADDITIVE AT THE\n// END (the parity test pins positions): the original four, then the six cloud\n// backends, then `selfhosted` (bring-your-own-compute — a user's own machine\n// enrolled as a first-class sandbox).\nexport const SandboxBackend = z.enum([\n  \"docker\",\n  \"modal\",\n  \"local\",\n  \"none\",\n  \"daytona\",\n  \"runloop\",\n  \"e2b\",\n  \"blaxel\",\n  \"cloudflare\",\n  \"vercel\",\n  \"selfhosted\",\n]);\nexport type SandboxBackend = z.infer<typeof SandboxBackend>;\n\n// OS axis. Only \"linux\" is reachable in v1; macos/windows are seam placeholders.\nexport const SandboxOs = z.enum([\"linux\", \"macos\", \"windows\"]);\nexport type SandboxOs = z.infer<typeof SandboxOs>;\n\n// The five surfaceable sandbox capabilities (PascalCase, the canonical names).\nexport const SandboxCapabilityName = z.enum([\n  \"FileSystem\", // Channel A: list/read/write/search (Pierre tree)\n  \"Terminal\", // Channel A: command-output firehose (+ future pty-ws)\n  \"Git\", // Channel A: status/diff/log/show (Pierre diff)\n  \"DesktopStream\", // Channel B: noVNC pixels over a scoped tunnel URL\n  \"Recording\", // ffmpeg x11grab -> object storage\n]);\nexport type SandboxCapabilityName = z.infer<typeof SandboxCapabilityName>;\n\n// How a backend exposes a network port to the data plane.\nexport type PortExposureKind = \"provider-tunnel\" | \"preview-url\" | \"local-port\" | \"none\";\n\n// Static per-backend metadata — pure data, no runtime state. This table lives\n// in CONTRACTS (not runtime) so config can read it without an import cycle\n// through runtime (ledger CR8). Everything downstream (config boot-validation,\n// OS image selection, capability negotiation, env/mount branch) reads this\n// data, never a hard-coded backend name.\nexport type CapabilityDescriptor = {\n  backend: SandboxBackend;\n  backendId: string; // asserted === SDK client.backendId at registry build (deferred to P0.3)\n  tier: \"desktop\" | \"headless\" | \"dev\" | \"none\";\n  os: { supported: SandboxOs[]; default: SandboxOs };\n  capabilities: {\n    FileSystem: { available: boolean; readOnly: boolean };\n    Terminal: { available: boolean; transport: \"sse-events\" | \"pty-ws\" | null; pty: boolean };\n    Git: { available: boolean };\n    DesktopStream: { available: boolean; transport: \"vnc-ws\" | \"rdp-ws\" | \"webrtc\" | null };\n    // Feasibility only (== DesktopStream.available && os==linux); NOT a request.\n    Recording: { available: boolean };\n  };\n  lifetime: {\n    hardLifetimeMs?: number; // modal 24h, vercel 5h\n    requiresSnapshotRollover: boolean;\n    hasIdleKiller: boolean;\n    supportsSuspendResume: boolean; // runloop/e2b/vercel/modal true\n    resumeIsLockFree: boolean; // modal true (fromId, no lock)\n    idleKillDisableHint?: string;\n  };\n  snapshot: {\n    kind: \"native-fs\" | \"native-dir\" | \"native-snapshot-id\" | \"tar-only\" | \"none\";\n    hasTarFallback: boolean;\n  };\n  portExposure: { kind: PortExposureKind; supportsOnDemandPorts: boolean }; // runloop=false; blaxel only true\n  workspaceRoot: string; // os-overridable; per-backend default (providers owns; os defers)\n  nativeBucketMount: boolean; // modal true -> mount/signed-download branch\n  persistable: boolean;\n  supportsRunAs: boolean;\n};\n\n// The websockify/noVNC desktop port that is merged into `exposedPorts` for\n// every desktop-capable (backend, os). Asserted present by boot-validation.\nexport const DESKTOP_STREAM_PORT = 6080;\n\n// The ttyd PTY-over-websocket port that is exposed over the SAME Modal raw-TLS\n// tunnel as the desktop, for the REAL interactive terminal (Channel-B-symmetric).\n// ttyd's default; the box bakes ttyd and launches it on this port. The pty-ws\n// Terminal cell's `url` is the tunnel address resolved against this port.\nexport const TERMINAL_STREAM_PORT = 7681;\n\n// The Part-D matrix (master-spine PART D + module 03-providers). One row per\n// backend (10 rows). v1 reachable cells are all Linux; macos/windows are seam\n// placeholders (no enum members shipped). Reading rule: a capability cell is\n// `available:false` + a reason in the negotiated doc, never absent.\nexport const CAPABILITY_DESCRIPTORS: Record<SandboxBackend, CapabilityDescriptor> = {\n  modal: {\n    backend: \"modal\",\n    backendId: \"modal\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      hardLifetimeMs: 24 * 60 * 60 * 1000,\n      requiresSnapshotRollover: true,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: true,\n    },\n    snapshot: { kind: \"native-fs\", hasTarFallback: true },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: false }, // pre-declare 6080\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: true,\n    persistable: true,\n    supportsRunAs: true,\n  },\n  daytona: {\n    backend: \"daytona\",\n    backendId: \"daytona\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"native-snapshot-id\", hasTarFallback: true },\n    portExposure: { kind: \"preview-url\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: true,\n  },\n  runloop: {\n    backend: \"runloop\",\n    backendId: \"runloop\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: false },\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"native-snapshot-id\", hasTarFallback: true },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: false }, // CR9: pre-declare 6080\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: false,\n  },\n  e2b: {\n    backend: \"e2b\",\n    backendId: \"e2b\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: false }, // pty-until-proven=no\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"native-snapshot-id\", hasTarFallback: true },\n    portExposure: { kind: \"preview-url\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/home/user\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: false,\n  },\n  blaxel: {\n    backend: \"blaxel\",\n    backendId: \"blaxel\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: false }, // pty-until-proven=no\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: false,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"tar-only\", hasTarFallback: true },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: true }, // only on-demand backend\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: false,\n  },\n  cloudflare: {\n    backend: \"cloudflare\",\n    backendId: \"cloudflare\",\n    tier: \"headless\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: false, transport: null },\n      Recording: { available: false },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: false,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"tar-only\", hasTarFallback: true },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: true,\n  },\n  vercel: {\n    backend: \"vercel\",\n    backendId: \"vercel\",\n    tier: \"headless\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: false },\n      Git: { available: true },\n      DesktopStream: { available: false, transport: null },\n      Recording: { available: false },\n    },\n    lifetime: {\n      hardLifetimeMs: 5 * 60 * 60 * 1000,\n      requiresSnapshotRollover: true,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"tar-only\", hasTarFallback: true },\n    portExposure: { kind: \"preview-url\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/vercel/sandbox\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: false,\n  },\n  docker: {\n    backend: \"docker\",\n    backendId: \"docker\",\n    tier: \"dev\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: false, transport: null }, // local\n      Recording: { available: false },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: false,\n      supportsSuspendResume: false,\n      resumeIsLockFree: true,\n    },\n    snapshot: { kind: \"native-dir\", hasTarFallback: true },\n    portExposure: { kind: \"local-port\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: true,\n  },\n  local: {\n    backend: \"local\",\n    // The SDK's UnixLocalSandboxClient reports backendId \"unix_local\" — this MUST\n    // match it (it is the resume-fence field compared against client.backendId).\n    backendId: \"unix_local\",\n    tier: \"dev\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: false, transport: null },\n      Recording: { available: false },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: false,\n      supportsSuspendResume: false,\n      resumeIsLockFree: true,\n    },\n    snapshot: { kind: \"native-dir\", hasTarFallback: true },\n    portExposure: { kind: \"local-port\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: false,\n    supportsRunAs: false,\n  },\n  none: {\n    backend: \"none\",\n    backendId: \"none\",\n    tier: \"none\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: false, readOnly: true },\n      Terminal: { available: false, transport: null, pty: false },\n      Git: { available: false },\n      DesktopStream: { available: false, transport: null },\n      Recording: { available: false },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: false,\n      supportsSuspendResume: false,\n      resumeIsLockFree: true,\n    },\n    snapshot: { kind: \"none\", hasTarFallback: false },\n    portExposure: { kind: \"none\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: false,\n    supportsRunAs: false,\n  },\n  // Bring-your-own-compute: the user's OWN machine, enrolled via a Rust agent,\n  // becomes ONE shared whole-machine sandbox (the agent IS the box). It is the\n  // first backend to make macOS/Windows reachable (default linux). Desktop is\n  // capability-PROCLAIMED (\"vnc-ws\") — the agent serves a native display stack\n  // (Linux X11/Xvfb, macOS CGEvent/ScreenCaptureKit) consent-gated at enroll;\n  // the online/offline/consent/display negotiation lives in select.ts (M3), this\n  // row is the static feasibility ceiling. Always-on (process-lifetime, never\n  // idle-reaped) and NOT persistable — OpenGeni cannot snapshot the user's disk,\n  // so resume = \"is the agent's subject live?\", never a cold re-create. Ports\n  // surface on-demand through the stateless relay edge, which lands behind the\n  // `resolveExposedPort` swap-seam later; until then it reuses the existing\n  // `provider-tunnel` exposure kind (the relay IS the provider tunnel for the\n  // agent) so no new PortExposureKind literal — and no new switch arms — are\n  // introduced. supportsOnDemandPorts:true: the agent opens a stream channel for\n  // a port on request rather than pre-declaring 6080/7681 at construction.\n  selfhosted: {\n    backend: \"selfhosted\",\n    backendId: \"selfhosted\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\", \"macos\", \"windows\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"pty-ws\", pty: true }, // real PTY over the relay\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" }, // proclaimed; consent-gated at enroll\n      Recording: { available: true }, // boot invariant: == DesktopStream.available\n    },\n    lifetime: {\n      // Whole-machine, always-there: online while the agent process runs, offline\n      // when it stops. The lease is NEVER idle-killed (it's the user's machine,\n      // not a reapable cloud box) and there is nothing to suspend/resume — the\n      // machine simply is or isn't reachable.\n      requiresSnapshotRollover: false,\n      hasIdleKiller: false,\n      supportsSuspendResume: false,\n      resumeIsLockFree: true, // resume = address the live NATS subject; no provider lock\n    },\n    // persistable:false forces snapshot.kind:\"none\" (the descriptor invariant\n    // `persistable ⇒ snapshot.kind!==\"none\"`): OpenGeni cannot snapshot the\n    // user's disk — the machine itself is the persistence.\n    snapshot: { kind: \"none\", hasTarFallback: false },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: true },\n    workspaceRoot: \"/\", // agent-reported machine root (the whole machine is the sandbox)\n    nativeBucketMount: false,\n    persistable: false,\n    supportsRunAs: false,\n  },\n};\n\nexport const ReasoningEffort = z.enum([\"none\", \"minimal\", \"low\", \"medium\", \"high\", \"xhigh\"]);\nexport type ReasoningEffort = z.infer<typeof ReasoningEffort>;\n\nexport const ErrorCode = z.enum([\n  \"unauthenticated\",\n  \"forbidden\",\n  \"not_found\",\n  \"validation_failed\",\n  \"conflict\",\n  \"idempotency_conflict\",\n  \"limit_exceeded\",\n  \"provider_verification_failed\",\n  \"upstream_unavailable\",\n  \"internal_error\",\n]);\nexport type ErrorCode = z.infer<typeof ErrorCode>;\n\nexport const ErrorEnvelope = z.object({\n  error: z.object({\n    code: ErrorCode,\n    message: z.string(),\n    requestId: z.string().optional(),\n    details: z.record(z.string(), z.unknown()).optional(),\n  }),\n});\nexport type ErrorEnvelope = z.infer<typeof ErrorEnvelope>;\n\nexport const PageInfo = z.object({\n  limit: z.number().int().positive(),\n  nextCursor: z.string().nullable(),\n  hasMore: z.boolean(),\n});\nexport type PageInfo = z.infer<typeof PageInfo>;\n\nexport function paginated<T extends z.ZodTypeAny>(item: T) {\n  return z.object({\n    data: z.array(item),\n    page: PageInfo,\n  });\n}\n\nexport const Permission = z.enum([\n  \"account:read\",\n  \"account:admin\",\n  \"members:manage\",\n  \"workspace:create\",\n  \"billing:read\",\n  \"billing:manage\",\n  \"workspace:read\",\n  \"workspace:admin\",\n  \"sessions:create\",\n  \"sessions:read\",\n  \"sessions:control\",\n  // Sandbox-surfacing (master-spine §C.3 / crosscut PART 1.2). stream:view is a\n  // REAL, distinct permission — strictly BROADER than sessions:read — because the\n  // pixel plane (Channel B) is UN-REDACTED: a viewer of raw pixels can see cloud\n  // creds the agent cat's into a terminal, which the redacted Channel-A event log\n  // never exposes. sessions:read is NOT permission to watch raw pixels.\n  \"stream:view\",\n  // SEPARATE from stream:view: raw input to the desktop (bypasses approvalQueue /\n  // interrupt). NEVER granted by default in v1 (the input plane is OFF —\n  // streamControlEnabled=false); the permission exists so later hardening is a\n  // flag flip, not a redesign.\n  \"stream:control\",\n  // Accept the pixel-plane secret-leak acknowledgment (consent gate before the\n  // un-redacted desktop URL is handed out).\n  \"stream:acknowledge\",\n  \"files:upload\",\n  \"files:read\",\n  // Channel-A structured write surface (FS writes / apply-patch); distinct from\n  // files:read so a read-only viewer can't mutate the box filesystem.\n  \"files:write\",\n  // Attach to an interactive PTY (terminal-as-pty, Channel A); distinct from\n  // sessions:read which only reads the command-output firehose.\n  \"terminal:attach\",\n  \"documents:manage\",\n  \"documents:search\",\n  \"scheduled_tasks:manage\",\n  \"scheduled_tasks:run\",\n  \"github:manage\",\n  \"github:use\",\n  \"api_keys:manage\",\n  \"environments:manage\",\n  \"environments:use\",\n  // Attach or rotate per-session third-party MCP server credentials. Deliberately\n  // not part of the worker's default first-party MCP permission set: a sandboxed\n  // agent must not be able to hand itself new bearer credentials.\n  \"mcp_servers:attach\",\n  \"goals:manage\",\n  // Bring-your-own-compute (M5). enrollments:read lists a workspace's machines;\n  // enrollments:manage approves a device-flow enrollment (the LOUD whole-machine\n  // consent) + revokes a machine. Distinct from sessions/stream perms because an\n  // enrollment grants WHOLE-MACHINE access to a user's own hardware — a high-trust,\n  // admin-shaped action. workspace:admin is the super-wildcard over both.\n  \"enrollments:read\",\n  \"enrollments:manage\",\n]);\nexport type Permission = z.infer<typeof Permission>;\n\nexport const ProductAccessMode = z.enum([\"local\", \"configured\", \"managed\"]);\nexport type ProductAccessMode = z.infer<typeof ProductAccessMode>;\n\nexport const BillingMode = z.enum([\"disabled\", \"stripe\"]);\nexport type BillingMode = z.infer<typeof BillingMode>;\n\nexport const EntitlementsMode = z.enum([\"none\", \"static\", \"managed\"]);\nexport type EntitlementsMode = z.infer<typeof EntitlementsMode>;\n\nexport const UsageLimitsMode = z.enum([\"none\", \"static\", \"managed\"]);\nexport type UsageLimitsMode = z.infer<typeof UsageLimitsMode>;\n\nexport const AccountRole = z.enum([\"owner\", \"admin\", \"member\"]);\nexport type AccountRole = z.infer<typeof AccountRole>;\n\nexport const ManagedAccount = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  externalSource: z.string().nullable(),\n  externalId: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ManagedAccount = z.infer<typeof ManagedAccount>;\n\nexport const Workspace = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  name: z.string(),\n  slug: z.string().nullable(),\n  externalSource: z.string().nullable(),\n  externalId: z.string().nullable(),\n  // Per-workspace agent persona template (white-label override). null means\n  // the deployment default (OPENGENI_AGENT_INSTRUCTIONS_TEMPLATE /\n  // DEFAULT_AGENT_INSTRUCTIONS) is used. The runtime always injects the\n  // non-bypassable CORE (goal-loop ownership + environment block), so an\n  // override restyles the persona without dropping that contract.\n  agentInstructions: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type Workspace = z.infer<typeof Workspace>;\n\nexport const AccountGrant = z.object({\n  accountId: z.string().uuid(),\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().optional(),\n  role: AccountRole.optional(),\n  permissions: z.array(Permission),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\nexport type AccountGrant = z.infer<typeof AccountGrant>;\n\nexport const AccessGrant = z.object({\n  workspaceId: z.string().uuid(),\n  accountId: z.string().uuid(),\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().optional(),\n  permissions: z.array(Permission),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\nexport type AccessGrant = z.infer<typeof AccessGrant>;\n\nexport const AccessContext = z.object({\n  mode: ProductAccessMode,\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().optional(),\n  accountGrants: z.array(AccountGrant),\n  workspaceGrants: z.array(AccessGrant),\n  defaultAccountId: z.string().uuid().nullable(),\n  defaultWorkspaceId: z.string().uuid().nullable(),\n});\nexport type AccessContext = z.infer<typeof AccessContext>;\n\nexport const DelegatedAccessTokenPayload = z.object({\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().optional(),\n  permissions: z.array(Permission).min(1),\n  // Worker-asserted session scope for first-party MCP calls (HMAC-signed, not\n  // agent-controlled); enables session-scoped tools such as goal management.\n  sessionId: z.string().uuid().optional(),\n  exp: z.number().int().positive(),\n});\nexport type DelegatedAccessTokenPayload = z.infer<typeof DelegatedAccessTokenPayload>;\n\nexport async function signDelegatedAccessToken(secret: string, payload: DelegatedAccessTokenPayload): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(DelegatedAccessTokenPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `ogd_${encodedPayload}.${signature}`;\n}\n\nexport async function verifyDelegatedAccessToken(secret: string, token: string, nowSeconds = Math.floor(Date.now() / 1000)): Promise<DelegatedAccessTokenPayload | null> {\n  if (!token.startsWith(\"ogd_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"ogd_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  const payload = DelegatedAccessTokenPayload.safeParse(JSON.parse(base64UrlDecode(encodedPayload)));\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\n// --- Enrollment bearer credential (bring-your-own-compute M5, dossier §10.2) ---\n//\n// The signed bearer the agent presents to the control plane after enrollment (the\n// EnrollmentCredentials.bearer the poll returns). REUSES the SAME HMAC envelope as\n// the delegated/stream tokens (base64Url payload + hmacSha256Base64Url) with a\n// distinct `oge_` prefix so it can never be confused with an `ogd_` access token or\n// an `ogs_` stream token. It binds (workspaceId, agentId, enrollmentId) so the\n// control plane can verify the agent owns the subject `agent.<ws>.<id>` it\n// subscribes to. Signed with resolveEnrollmentSigningSecret; the secret value is\n// NEVER logged. The real per-workspace NATS Account creds binding is infra-deferred\n// (M4/relay) — this bearer is the application-tier identity proof.\nexport const EnrollmentBearerPayload = z.object({\n  workspaceId: z.string().uuid(),\n  agentId: z.string().uuid(),\n  enrollmentId: z.string().uuid(),\n  // The Account-scoped control-plane subject prefix the agent subscribes to.\n  subjectPrefix: z.string().min(1),\n  exp: z.number().int().positive(),\n});\nexport type EnrollmentBearerPayload = z.infer<typeof EnrollmentBearerPayload>;\n\nexport async function signEnrollmentBearer(secret: string, payload: EnrollmentBearerPayload): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(EnrollmentBearerPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `oge_${encodedPayload}.${signature}`;\n}\n\nexport async function verifyEnrollmentBearer(secret: string, token: string, nowSeconds = Math.floor(Date.now() / 1000)): Promise<EnrollmentBearerPayload | null> {\n  if (!token.startsWith(\"oge_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"oge_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  const payload = EnrollmentBearerPayload.safeParse(JSON.parse(base64UrlDecode(encodedPayload)));\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\n// --- Non-interactive enroll token (self-hosted enrollment UX §A2.1) ----------\n//\n// The SHORT-TTL, secret, workspace-scoped token the headless/fleet enroll path\n// presents to /v1/enrollments/token/exchange. The token IS the grant — there is\n// no human approve step — so it is stateless-signed (no DB row): the holder of an\n// unexpired token can enroll ONE machine identity into ONE workspace.\n//\n// It REUSES the SAME HMAC envelope as signEnrollmentBearer (base64Url payload +\n// hmacSha256Base64Url) with a DISTINCT `oget_` prefix and a `typ: \"enroll\"` claim.\n// DOMAIN SEPARATION: even though it shares the signing secret with the `oge_`\n// bearer, the prefix + typ claim make an enroll token unusable as an `oge_`\n// bearer (verifyEnrollmentBearer's `oge_` prefix check rejects it) and vice-versa\n// (verifyEnrollToken's `oget_` prefix + typ check rejects an `oge_` bearer). The\n// secret value is NEVER logged.\nexport const EnrollTokenPayload = z.object({\n  // Domain-separation claim — fixed \"enroll\" so an `oge_`/`ogd_`/`ogs_` payload (no\n  // typ, or a different typ) can never satisfy verifyEnrollToken even past the prefix.\n  typ: z.literal(\"enroll\"),\n  workspaceId: z.string().uuid(),\n  accountId: z.string().uuid(),\n  // The screen-control consent baked into the token at mint (the minting user's\n  // decision); the exchange records it as consentedScreenControl on the enrollment.\n  allowScreenControl: z.boolean(),\n  iat: z.number().int().nonnegative(),\n  exp: z.number().int().positive(),\n});\nexport type EnrollTokenPayload = z.infer<typeof EnrollTokenPayload>;\n\nexport async function signEnrollToken(secret: string, payload: EnrollTokenPayload): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(EnrollTokenPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `oget_${encodedPayload}.${signature}`;\n}\n\n/**\n * Verify an enroll token: rejects (returns null) on a bad prefix (NOT `oget_`),\n * a malformed envelope, a bad HMAC signature (constant-time), schema-invalid\n * claims (which includes `typ !== \"enroll\"` — the `z.literal` rejects it), or an\n * expired token (`exp < now`). Mirrors verifyEnrollmentBearer exactly. An `oge_`\n * bearer fails the prefix gate; a same-secret token that lacks the typ claim fails\n * the schema gate — both halves of the domain separation are enforced here.\n */\nexport async function verifyEnrollToken(secret: string, token: string, nowSeconds = Math.floor(Date.now() / 1000)): Promise<EnrollTokenPayload | null> {\n  if (!token.startsWith(\"oget_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"oget_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(base64UrlDecode(encodedPayload));\n  } catch {\n    return null;\n  }\n  const payload = EnrollTokenPayload.safeParse(decoded);\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\n// --- Scoped data-plane stream token (master-spine §C.3 / crosscut PART 1.3) ---\n//\n// REUSES the existing HMAC envelope (sign/verifyDelegatedAccessToken's\n// base64Url + hmacSha256Base64Url) — NOT a second crypto — but with a distinct\n// `ogs_` prefix and a HARD-NARROW claim set. The token is a CLAIM the OpenGeni\n// control plane mints; it is NOT the provider's tunnel secret. The browser\n// receives { providerUrl, streamToken }; the provider tunnel URL is the\n// transport, the streamToken is what the in-box edge validates (websockify\n// TokenFile is later-hardening; in v1 the URL's short TTL + the acknowledged\n// stream:view gate are the real boundary). The token is minted + recorded\n// against the holder from day one. It is NEVER appended to the URL as a query\n// param (the provider's own scoped token already lives in the URL).\n//\n// `leaseEpoch` is the fence: when the box is re-elected (warming→warm bumps the\n// epoch) the URL is re-minted with epoch+1 and the old tunnel is torn down, so a\n// stale token points at a dead tunnel. Epoch mismatch is enforced at USE (by the\n// caller comparing the claim against the live lease), not inside verify.\nexport const StreamTokenPayload = z.object({\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  // Identifies the sandbox_lease_holders row (the viewer holder).\n  viewerId: z.string().uuid(),\n  // Fence: the token logically dies when the box is re-elected (epoch++).\n  leaseEpoch: z.number().int().nonnegative(),\n  // v1 is always \"view\"; \"control\" is the never-granted raw-input plane.\n  mode: z.enum([\"view\", \"control\"]),\n  // 6080 (noVNC); pins the token to ONE exposed port.\n  port: z.number().int().positive(),\n  // Short TTL (120s default); rotation is event-driven under the epoch fence,\n  // not on a keepalive clock.\n  exp: z.number().int().positive(),\n});\nexport type StreamTokenPayload = z.infer<typeof StreamTokenPayload>;\n\nexport async function signStreamToken(secret: string, payload: StreamTokenPayload): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(StreamTokenPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `ogs_${encodedPayload}.${signature}`;\n}\n\n/**\n * Verify a stream token: rejects (returns null) on a bad prefix, malformed\n * envelope, bad HMAC signature (constant-time), schema-invalid claims, or an\n * expired token (`exp < now`). Mirrors verifyDelegatedAccessToken exactly.\n *\n * The epoch fence (claim.leaseEpoch vs the LIVE lease epoch) and the\n * workspace/session scope are checked by the CALLER at use against the live\n * lease + route params — verify proves the token is authentic + unexpired, the\n * caller proves it is for THIS box's current epoch and THIS workspace+session.\n */\nexport async function verifyStreamToken(secret: string, token: string, nowSeconds = Math.floor(Date.now() / 1000)): Promise<StreamTokenPayload | null> {\n  if (!token.startsWith(\"ogs_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"ogs_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(base64UrlDecode(encodedPayload));\n  } catch {\n    return null;\n  }\n  const payload = StreamTokenPayload.safeParse(decoded);\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\n// --- Relay PRODUCER token (bring-your-own-compute M8b, dossier §10.5) ---\n//\n// The token the AGENT presents to the relay edge when it registers a pty/desktop\n// stream channel (role=AGENT) — distinct from the viewer's `ogs_` token. It is\n// minted by the control plane at enrollment and threaded into EnrollmentCredentials\n// (proto field `relay_token`); the relay verifies it on its own merits, then pairs\n// the producer with the consumer by the shared channel key.\n//\n// REUSES the EXACT SAME HMAC envelope as the `ogs_`/`ogd_`/`oge_` tokens\n// (base64Url JSON payload + hmacSha256Base64Url) — NOT a second crypto — with a\n// distinct `ogr_` prefix so it can never be confused with the others. The claim\n// set binds (workspaceId, agentId): the relay reads the channel-key's ws+agent\n// from the StreamOpen and asserts the producer token claims the SAME pair, so a\n// producer token for workspace A can never register a channel for workspace B.\n// Signed with resolveRelayTokenSecret (the relay-token HMAC secret); the value is\n// NEVER logged. Long-lived by design (it is enrollment-scoped, not per-stream —\n// the agent presents it on every channel registration for the life of the\n// enrollment); the relay additionally validates the channel key + (for the\n// viewer's `ogs_`) the lease/active-epoch fence.\n//\n// The Rust relay re-implements this verify (the same base64url(JSON) + HMAC-SHA256\n// + prefix split) so TS-mint and Rust-verify provably agree — see the cross-stack\n// fixture in agent/crates/opengeni-relay/tests and the relay's `token` module doc.\nexport const RelayTokenPayload = z.object({\n  // The workspace the agent (and its channels) belong to — the relay asserts this\n  // equals the channel-key's ws so a producer can only register its own channels.\n  workspaceId: z.string().uuid(),\n  // The agent (machine) id — the relay asserts this equals the channel-key's agent.\n  agentId: z.string().uuid(),\n  // Expiry (unix seconds). Enrollment-scoped horizon (re-minted on re-enroll).\n  exp: z.number().int().positive(),\n});\nexport type RelayTokenPayload = z.infer<typeof RelayTokenPayload>;\n\nexport async function signRelayToken(secret: string, payload: RelayTokenPayload): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(RelayTokenPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `ogr_${encodedPayload}.${signature}`;\n}\n\n/**\n * Verify a relay producer token: rejects (returns null) on a bad prefix, malformed\n * envelope, bad HMAC signature (constant-time), schema-invalid claims, or expiry.\n * Mirrors verifyStreamToken exactly. The relay (Rust) re-implements this verify;\n * the TS verify here proves the format for the cross-stack fixture + any TS caller.\n *\n * The channel-key scope (claim.workspaceId/agentId vs the StreamOpen channel key)\n * is enforced by the relay at USE — verify proves authenticity + freshness only.\n */\nexport async function verifyRelayToken(secret: string, token: string, nowSeconds = Math.floor(Date.now() / 1000)): Promise<RelayTokenPayload | null> {\n  if (!token.startsWith(\"ogr_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"ogr_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(base64UrlDecode(encodedPayload));\n  } catch {\n    return null;\n  }\n  const payload = RelayTokenPayload.safeParse(decoded);\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\nexport const CreateWorkspaceRequest = z.object({\n  accountId: z.string().uuid().optional(),\n  name: z.string().min(1),\n  slug: z.string().min(1).optional(),\n  externalSource: z.string().min(1).optional(),\n  externalId: z.string().min(1).optional(),\n  // White-label persona override for this workspace's agent. null/omitted uses\n  // the deployment default template.\n  agentInstructions: z.string().min(1).nullable().optional(),\n});\nexport type CreateWorkspaceRequest = z.infer<typeof CreateWorkspaceRequest>;\n\nexport const UpdateWorkspaceRequest = z.object({\n  name: z.string().min(1).optional(),\n  slug: z.string().min(1).nullable().optional(),\n  // White-label persona override. Pass null to clear it back to the deployment\n  // default; omit to leave it unchanged.\n  agentInstructions: z.string().min(1).nullable().optional(),\n});\nexport type UpdateWorkspaceRequest = z.infer<typeof UpdateWorkspaceRequest>;\n\nexport const ApiKey = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid().nullable(),\n  name: z.string(),\n  prefix: z.string(),\n  permissions: z.array(Permission),\n  expiresAt: z.string().nullable(),\n  revokedAt: z.string().nullable(),\n  lastUsedAt: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ApiKey = z.infer<typeof ApiKey>;\n\nexport const CreateApiKeyRequest = z.object({\n  name: z.string().min(1),\n  workspaceId: z.string().uuid().optional(),\n  permissions: z.array(Permission).min(1),\n  expiresAt: z.string().datetime({ offset: true }).optional(),\n});\nexport type CreateApiKeyRequest = z.infer<typeof CreateApiKeyRequest>;\n\nexport const CreateApiKeyResponse = z.object({\n  apiKey: ApiKey,\n  token: z.string().min(1),\n});\nexport type CreateApiKeyResponse = z.infer<typeof CreateApiKeyResponse>;\n\n// A person (or API key) with access to a workspace: one workspace_memberships\n// row. `subjectId` is `user:<betterAuthUserId>` or `api_key:<id>`; the People\n// surface lists the `user:` subjects (api_key subjects belong to API keys).\nexport const WorkspaceMember = z.object({\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().nullable(),\n  role: z.string(),\n  permissions: z.array(Permission),\n  createdAt: z.string(),\n});\nexport type WorkspaceMember = z.infer<typeof WorkspaceMember>;\n\nexport const ListWorkspaceMembersResponse = z.object({\n  members: z.array(WorkspaceMember),\n});\nexport type ListWorkspaceMembersResponse = z.infer<typeof ListWorkspaceMembersResponse>;\n\nexport const AddWorkspaceMemberRequest = z.object({\n  // Resolved against the managed (Better Auth) users; email invites for\n  // not-yet-registered users are deferred, so an unknown email returns 404.\n  email: z.string().email(),\n  role: z.string().min(1).optional(),\n  permissions: z.array(Permission),\n});\nexport type AddWorkspaceMemberRequest = z.infer<typeof AddWorkspaceMemberRequest>;\n\nexport const UpdateWorkspaceMemberRequest = z.object({\n  role: z.string().min(1).optional(),\n  permissions: z.array(Permission),\n});\nexport type UpdateWorkspaceMemberRequest = z.infer<typeof UpdateWorkspaceMemberRequest>;\n\nexport const UsageEventType = z.enum([\n  \"agent_run.created\",\n  \"agent_run.completed\",\n  \"model.tokens\",\n  \"model.cost\",\n  \"file.uploaded\",\n  \"file.deleted\",\n  \"document.indexed\",\n  \"scheduled_task.fired\",\n  \"api_key.request\",\n  // --- sandbox warm-time metering (P2.1) ---\n  // Wall-clock seconds a box was warm — the billable warm-time meter. Accrued on\n  // the two stateless ticks (turn heartbeat + reaper sweep), idempotent on\n  // (sandbox_group_id, lease_epoch, tick) so a shared box (N sessions) is metered\n  // EXACTLY ONCE per tick (N sessions != N x bill). Orthogonal to model.tokens /\n  // model.cost (model API cost vs provider compute cost — both real, no overlap).\n  \"sandbox.warm_seconds\",\n  // usd_micros: warm-seconds x the per-provider per-second warm rate.\n  \"sandbox.warm_cost\",\n]);\nexport type UsageEventType = z.infer<typeof UsageEventType>;\n\nexport const UsageEvent = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  accountId: z.string().uuid(),\n  subjectId: z.string().nullable(),\n  eventType: UsageEventType,\n  quantity: z.number(),\n  unit: z.string(),\n  sourceResourceType: z.string().nullable(),\n  sourceResourceId: z.string().nullable(),\n  idempotencyKey: z.string(),\n  occurredAt: z.string(),\n  recordedAt: z.string(),\n  exportedToBillingAt: z.string().nullable(),\n  billingProviderEventId: z.string().nullable(),\n});\nexport type UsageEvent = z.infer<typeof UsageEvent>;\n\nexport const LimitAction = z.enum([\n  \"agent_run:create\",\n  \"tokens:consume\",\n  \"file:upload\",\n  \"document:index\",\n  \"schedule:create\",\n  \"workspace:create\",\n  \"api_key:create\",\n]);\nexport type LimitAction = z.infer<typeof LimitAction>;\n\nexport const StaticUsageLimits = z.object({\n  maxWorkspacesPerAccount: z.number().int().positive().optional(),\n  maxApiKeysPerWorkspace: z.number().int().positive().optional(),\n  maxSchedulesPerWorkspace: z.number().int().positive().optional(),\n  maxFileUploadBytes: z.number().int().positive().optional(),\n  maxMonthlyAgentRunsPerWorkspace: z.number().int().positive().optional(),\n  maxMonthlyTokensPerWorkspace: z.number().int().positive().optional(),\n  maxMonthlyCostMicrosPerAccount: z.number().int().positive().optional(),\n  maxDocumentIndexedChunksPerWorkspace: z.number().int().positive().optional(),\n});\nexport type StaticUsageLimits = z.infer<typeof StaticUsageLimits>;\n\nexport const EntitlementValue = z.union([z.boolean(), z.string(), z.number(), z.array(z.string())]);\nexport type EntitlementValue = z.infer<typeof EntitlementValue>;\n\nexport const Entitlements = z.record(z.string().min(1), EntitlementValue);\nexport type Entitlements = z.infer<typeof Entitlements>;\n\nexport const LimitDecision = z.discriminatedUnion(\"allowed\", [\n  z.object({ allowed: z.literal(true) }),\n  z.object({ allowed: z.literal(false), code: z.string(), message: z.string() }),\n]);\nexport type LimitDecision = z.infer<typeof LimitDecision>;\n\n// ============ P3 — Entitlements port (§7.5) ============\n//\n// The host-providable admission seam over OpenGeni's TWO existing admission\n// sites: the API edge (`checkLimit`/`requireLimit`, billing/limits.ts) AND the\n// worker edge (`ensureRunAllowed`, agent-turn.ts — both turn-entry and the\n// mid-stream budget valve). A host that owns its OWN ledger/meter binds this to\n// keep OpenGeni from re-deriving admission from its local ledger.\n//\n// CRITICAL CONTRACT: `admitRun` returns a transport-neutral allow/deny decision\n// (+ optional structured reason + the echoed quantity it admitted) and NEVER\n// exposes `getBillingBalance` or any ledger internals — the host's balance math\n// stays on the host side of the boundary. This is what lets the same port serve\n// both PUSH (host funds OpenGeni's ledger; admission is a LOCAL read of that\n// funded ledger) and PULL (a network callback to the host's own meter).\n//\n// `action` is a free `string` (NOT the internal `LimitAction` enum) so a host\n// meter can key on actions OpenGeni does not model. `quantity` is the units the\n// caller is about to consume (tokens, bytes, 1 run, …); the decision MAY echo\n// the admitted quantity so a PULL host can grant a partial allowance.\nexport const EntitlementDecision = z.discriminatedUnion(\"allowed\", [\n  z.object({ allowed: z.literal(true), quantity: z.number().optional() }),\n  z.object({ allowed: z.literal(false), reason: z.string(), code: z.string().optional(), quantity: z.number().optional() }),\n]);\nexport type EntitlementDecision = z.infer<typeof EntitlementDecision>;\n\nexport type AdmitRunInput = {\n  accountId: string;\n  workspaceId: string;\n  action: string;\n  quantity: number;\n};\n\nexport type EntitlementsPort = {\n  admitRun(input: AdmitRunInput): Promise<EntitlementDecision>;\n};\n\n// ============ P4a — Connection-credential provider (§7.6) ============\n//\n// The host-providable per-run credential-mint seam over OpenGeni's TWO\n// run-scoped credential sites in the worker:\n//   - GIT credentials: the GitHub App installation token minted in\n//     `sandboxEnvironmentForRun` (today `createGitHubAppInstallationToken`\n//     from `settings`) and injected as `GH_TOKEN`/`GITHUB_TOKEN`/the git\n//     extraheader.\n//   - SANDBOX secrets: the decrypted workspace environment values loaded in\n//     `loadWorkspaceEnvironmentForRun` (today decrypted with\n//     `environmentsEncryptionKeyBytes(settings)`).\n//\n// In embedded/separate topologies the HOST owns these external connections\n// (its GitHub App, its secret vault + encryption key). When a host binds this\n// port, OpenGeni asks the host to mint/decrypt per-run instead of self-minting\n// from `settings`. Unset (standalone default) → byte-for-byte today's\n// self-mint.\n//\n// FORK-7 CROSS-CHECK (the host-mapping safety guardrail): a credential\n// provider returns the `workspaceId` it scoped the credential to, and the\n// activity ASSERTS it agrees with the run's workspace BEFORE injecting\n// `GH_TOKEN` (or applying the decrypted values). A host mapping bug that\n// returns tenant B's creds while the run is tenant A is thereby caught at the\n// seam, never silently injected into tenant A's sandbox.\n\nexport type GitCredentialsRequest = {\n  accountId: string;\n  workspaceId: string;\n  // The GitHub App installation the run's repository resources resolved to,\n  // and the specific repositories the token must be scoped to. Mirrors the\n  // shape `createGitHubAppInstallationToken` consumes today.\n  installationId: number;\n  repositoryIds: number[];\n};\n\nexport type GitCredentials = {\n  // The minted installation token the activity injects as GH_TOKEN/GITHUB_TOKEN\n  // and into the git http extraheader (identical downstream handling to the\n  // self-mint path).\n  token: string;\n  // FORK-7 echo: the workspace the provider scoped this token to. The activity\n  // asserts `workspaceId === request.workspaceId` before injecting.\n  workspaceId: string;\n  // Optional git identity override. When omitted the activity falls back to\n  // today's `githubAppBotIdentity(settings)`.\n  identity?: { name: string; email: string } | null;\n};\n\nexport type SandboxSecretsRequest = {\n  accountId: string;\n  workspaceId: string;\n  // The workspace environment the run's session declares (null = unattached;\n  // the provider, like the self-mint path, returns null values for it).\n  environmentId: string;\n};\n\nexport type SandboxSecrets = {\n  // The decrypted environment values the run injects, replacing the local\n  // `environmentsEncryptionKeyBytes` decrypt. Same shape the self-mint path\n  // produces (plaintext name→value).\n  values: Record<string, string>;\n  // FORK-7 echo: the workspace the provider scoped these secrets to.\n  workspaceId: string;\n  // Optional environment metadata; when omitted the activity uses the\n  // environmentId as both id and name (the local decrypt carries the row's\n  // id/name/description, but only `id` is load-bearing downstream).\n  id?: string;\n  name?: string;\n  description?: string | null;\n};\n\nexport type ConnectionCredentialsPort = {\n  // Both legs are optional: a host may drive ONLY git creds (BYO-GitHub-App)\n  // and leave sandbox secrets to OpenGeni's local decrypt, or vice-versa. An\n  // unset leg falls through to today's self-mint for THAT leg only.\n  gitCredentials?: (input: GitCredentialsRequest) => Promise<GitCredentials>;\n  sandboxSecrets?: (input: SandboxSecretsRequest) => Promise<SandboxSecrets>;\n};\n\n// ============ P4a — GitHub App API port (BYO-App, §7.6 / SPIKE-2 remainder) ===\n//\n// The host-driven GitHub-API credential leg. SPIKE-2 closed the establishment +\n// gate (storage) axis; this closes the credential leg by making the two live\n// GitHub-API calls host-PROVIDABLE so a BYO-GitHub-App host drives its OWN App\n// credentials (its own JWT-signing key, its own OAuth client) instead of\n// OpenGeni self-minting from `settings`:\n//   - verifyInstallationAccessForUser: the OAuth code→token + installation\n//     lookup that PROVES the install is real (today\n//     `verifyGitHubInstallationAccessForUser(settings, …)`).\n//   - listRepositories: the installation-scoped repo listing behind\n//     `GET /v1/workspaces/:id/github/repositories` (today\n//     `listGitHubAppRepositories(settings, …)`).\n//\n// Unset (standalone default) → today's `settings`-based self-mint runs\n// byte-for-byte (the live GitHub-API verify/list against OpenGeni's own App).\n\nexport type GitHubInstallationSummary = {\n  installationId: number;\n  accountLogin: string | null;\n  accountType: string | null;\n  suspended: boolean;\n};\n\nexport type GitHubAppApiPort = {\n  verifyInstallationAccessForUser?: (input: {\n    code: string;\n    installationId: number;\n  }) => Promise<GitHubInstallationSummary>;\n  listRepositories?: (input: {\n    installationIds?: number[];\n  }) => Promise<GitHubRepository[]>;\n};\n\nexport const BillingBalance = z.object({\n  accountId: z.string().uuid(),\n  balanceMicros: z.number().int(),\n  currency: z.literal(\"usd\"),\n  updatedAt: z.string(),\n});\nexport type BillingBalance = z.infer<typeof BillingBalance>;\n\nexport const CreateCheckoutRequest = z.object({\n  accountId: z.string().uuid().optional(),\n  amountUsd: z.number().min(5).max(10_000).refine(\n    (value) => Number.isFinite(value) && Math.abs(value - Math.round(value * 100) / 100) < 1e-9,\n    { message: \"amountUsd must use cent precision\" },\n  ),\n  successUrl: z.string().url().optional(),\n  cancelUrl: z.string().url().optional(),\n});\nexport type CreateCheckoutRequest = z.infer<typeof CreateCheckoutRequest>;\n\nexport const CreateCheckoutResponse = z.object({\n  checkoutSessionId: z.string(),\n  url: z.string().url(),\n});\nexport type CreateCheckoutResponse = z.infer<typeof CreateCheckoutResponse>;\n\nexport const RepositoryResourceRef = z.object({\n  kind: z.literal(\"repository\"),\n  uri: z.string().min(1),\n  ref: z.string().min(1),\n  mountPath: z.string().min(1).optional(),\n  subpath: z.string().min(1).optional(),\n  githubInstallationId: z.number().int().positive().optional(),\n  githubRepositoryId: z.number().int().positive().optional(),\n});\nexport type RepositoryResourceRef = z.infer<typeof RepositoryResourceRef>;\n\nexport const FileResourceRef = z.object({\n  kind: z.literal(\"file\"),\n  fileId: z.string().uuid(),\n  mountPath: z.string().min(1).optional(),\n});\nexport type FileResourceRef = z.infer<typeof FileResourceRef>;\n\nexport const ResourceRef = z.discriminatedUnion(\"kind\", [RepositoryResourceRef, FileResourceRef]);\nexport type ResourceRef = z.infer<typeof ResourceRef>;\n\nexport const FileStatus = z.enum([\"pending_upload\", \"ready\", \"failed\", \"expired\", \"deleted\"]);\nexport type FileStatus = z.infer<typeof FileStatus>;\n\nexport const FileUploadStatus = z.enum([\"pending\", \"completed\", \"expired\", \"failed\"]);\nexport type FileUploadStatus = z.infer<typeof FileUploadStatus>;\n\nexport const FileAsset = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  status: FileStatus,\n  filename: z.string(),\n  safeFilename: z.string(),\n  contentType: z.string(),\n  sizeBytes: z.number().int().nonnegative(),\n  sha256: z.string().nullable(),\n  bucket: z.string(),\n  objectKey: z.string(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type FileAsset = z.infer<typeof FileAsset>;\n\nexport const CreateFileUploadRequest = z.object({\n  filename: z.string().min(1),\n  contentType: z.string().min(1),\n  sizeBytes: z.number().int().positive(),\n  sha256: z.string().min(1).optional(),\n});\nexport type CreateFileUploadRequest = z.infer<typeof CreateFileUploadRequest>;\n\nexport const CreateFileUploadResponse = z.object({\n  fileId: z.string().uuid(),\n  uploadId: z.string().uuid(),\n  putUrl: z.string().url(),\n  requiredHeaders: z.record(z.string(), z.string()),\n  expiresAt: z.string(),\n  maxSizeBytes: z.number().int().positive(),\n});\nexport type CreateFileUploadResponse = z.infer<typeof CreateFileUploadResponse>;\n\nexport const CompleteFileUploadResponse = z.object({\n  file: FileAsset,\n});\nexport type CompleteFileUploadResponse = z.infer<typeof CompleteFileUploadResponse>;\n\nexport const FileDownloadUrlResponse = z.object({\n  url: z.string().url(),\n  expiresAt: z.string(),\n});\nexport type FileDownloadUrlResponse = z.infer<typeof FileDownloadUrlResponse>;\n\nexport const DocumentStatus = z.enum([\"queued\", \"indexing\", \"ready\", \"failed\"]);\nexport type DocumentStatus = z.infer<typeof DocumentStatus>;\n\nexport const DocumentBase = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  name: z.string(),\n  description: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type DocumentBase = z.infer<typeof DocumentBase>;\n\nexport const Document = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  baseId: z.string().uuid(),\n  fileId: z.string().uuid(),\n  status: DocumentStatus,\n  title: z.string(),\n  parser: z.string(),\n  chunkCount: z.number().int().nonnegative(),\n  error: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type Document = z.infer<typeof Document>;\n\nexport const DocumentSearchResult = z.object({\n  chunkId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  documentId: z.string().uuid(),\n  baseId: z.string().uuid(),\n  fileId: z.string().uuid(),\n  title: z.string(),\n  text: z.string(),\n  score: z.number(),\n  chunkIndex: z.number().int().nonnegative(),\n  metadata: z.record(z.string(), z.unknown()),\n});\nexport type DocumentSearchResult = z.infer<typeof DocumentSearchResult>;\n\nexport const CreateDocumentBaseRequest = z.object({\n  name: z.string().min(1),\n  description: z.string().optional(),\n});\nexport type CreateDocumentBaseRequest = z.infer<typeof CreateDocumentBaseRequest>;\n\nexport const AddDocumentRequest = z.object({\n  fileId: z.string().uuid(),\n});\nexport type AddDocumentRequest = z.infer<typeof AddDocumentRequest>;\n\nexport const DocumentSearchRequest = z.object({\n  query: z.string().min(1),\n  limit: z.number().int().positive().max(20).default(5),\n});\nexport type DocumentSearchRequest = z.infer<typeof DocumentSearchRequest>;\n\nexport const ToolRef = z.object({\n  kind: z.literal(\"mcp\"),\n  id: z.string().min(1),\n  // Non-fatal-on-connect marker for MCP server refs that can degrade\n  // gracefully. Absent/false is STRICT: the id must be configured and an\n  // unavailable server fails the turn. `optional:true` is preserved for known\n  // servers and makes runtime connect/list failures skip that server; if the\n  // deployment does not configure the id, validation drops the ref. The server\n  // also sets this for auto-attached workspace-default capability MCPs.\n  optional: z.boolean().optional(),\n});\nexport type ToolRef = z.infer<typeof ToolRef>;\n\nconst registryId = /^[A-Za-z0-9_-]+$/;\nconst httpsUrl = z.string().url().refine((value) => {\n  try {\n    return new URL(value).protocol === \"https:\";\n  } catch {\n    return false;\n  }\n}, { message: \"URL must use https\" });\n\nexport const SessionMcpServerInput = z.object({\n  id: z.string().min(1).regex(registryId),\n  name: z.string().min(1).optional(),\n  url: httpsUrl,\n  allowedTools: z.array(z.string().min(1)).optional(),\n  timeoutMs: z.number().int().positive().optional(),\n  cacheToolsList: z.boolean().optional(),\n  // Write-only credential headers. Values are encrypted at rest and never\n  // returned in session responses or events; response metadata exposes names.\n  headers: z.record(z.string(), z.string()).optional(),\n});\nexport type SessionMcpServerInput = z.infer<typeof SessionMcpServerInput>;\n\nexport const SessionMcpCredentialUpdateInput = z.object({\n  id: z.string().min(1).regex(registryId),\n  headers: z.record(z.string(), z.string()),\n});\nexport type SessionMcpCredentialUpdateInput = z.infer<typeof SessionMcpCredentialUpdateInput>;\n\nexport const SessionMcpServerMetadata = z.object({\n  id: z.string().min(1).regex(registryId),\n  name: z.string().min(1).nullable(),\n  url: httpsUrl,\n  headerNames: z.array(z.string()).default([]),\n  credentialVersion: z.number().int().positive(),\n}).strict();\nexport type SessionMcpServerMetadata = z.infer<typeof SessionMcpServerMetadata>;\n\nexport class ResourceRefConflictError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResourceRefConflictError\";\n  }\n}\n\nexport function mergeToolRefs(existing: ToolRef[], additions: ToolRef[]): ToolRef[] {\n  const byKey = new Map<string, ToolRef>();\n  const order: string[] = [];\n  for (const tool of [...existing, ...additions]) {\n    const key = `${tool.kind}:${tool.id}`;\n    const prior = byKey.get(key);\n    if (!prior) {\n      byKey.set(key, tool);\n      order.push(key);\n      continue;\n    }\n    // Strict wins: if the same server appears both optional and strict, the\n    // strict occurrence upgrades the merged ref so an unavailable server fails\n    // the turn. This preserves the fail-loud default when defaults, packs, and\n    // per-turn tool selections are combined.\n    if (prior.optional === true && tool.optional !== true) {\n      const { optional: _dropped, ...strict } = prior;\n      byKey.set(key, strict);\n    }\n  }\n  return order.map((key) => byKey.get(key)!);\n}\n\nexport function mergeResourceRefs(\n  existing: ResourceRef[],\n  additions: ResourceRef[],\n  options: { rejectConflicts?: boolean } = {},\n): ResourceRef[] {\n  const out = [...existing];\n  const mountPaths = new Map(existing.flatMap((resource) => resource.mountPath ? [[resource.mountPath, stableJson(resource)] as const] : []));\n  const identities = new Map(existing.map((resource) => [resourceIdentityKey(resource), stableJson(resource)] as const));\n  const exact = new Set(existing.map(stableJson));\n\n  for (const resource of additions) {\n    const serialized = stableJson(resource);\n    if (exact.has(serialized)) {\n      continue;\n    }\n    if (options.rejectConflicts) {\n      const existingAtMount = resource.mountPath ? mountPaths.get(resource.mountPath) : undefined;\n      if (existingAtMount && existingAtMount !== serialized) {\n        throw new ResourceRefConflictError(`resource mount path is already attached: ${resource.mountPath}`);\n      }\n      const identity = resourceIdentityKey(resource);\n      const existingIdentity = identities.get(identity);\n      if (existingIdentity && existingIdentity !== serialized) {\n        throw new ResourceRefConflictError(`resource is already attached with different settings: ${identity}`);\n      }\n    }\n    out.push(resource);\n    exact.add(serialized);\n    identities.set(resourceIdentityKey(resource), serialized);\n    if (resource.mountPath) {\n      mountPaths.set(resource.mountPath, serialized);\n    }\n  }\n  return out;\n}\n\nexport function reasoningEffortForMetadata(metadata: Record<string, unknown>, fallback: ReasoningEffort): ReasoningEffort {\n  const value = metadata.reasoningEffort;\n  return value === \"none\" || value === \"minimal\" || value === \"low\" || value === \"medium\" || value === \"high\" || value === \"xhigh\"\n    ? value\n    : fallback;\n}\n\nexport function stableJson(value: unknown): string {\n  return JSON.stringify(sortJson(value));\n}\n\nexport function resourceIdentityKey(resource: ResourceRef): string {\n  if (resource.kind === \"file\") {\n    return `file:${resource.fileId}`;\n  }\n  return `repository:${resource.uri}`;\n}\n\nfunction sortJson(value: unknown): unknown {\n  if (Array.isArray(value)) {\n    return value.map(sortJson);\n  }\n  if (value && typeof value === \"object\") {\n    return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, nested]) => [key, sortJson(nested)]));\n  }\n  return value;\n}\n\nexport const SessionTurnStatus = z.enum([\"queued\", \"running\", \"requires_action\", \"completed\", \"failed\", \"cancelled\"]);\nexport type SessionTurnStatus = z.infer<typeof SessionTurnStatus>;\n\nexport const SessionTurnSource = z.enum([\"user\", \"scheduled_task\", \"api\", \"goal\"]);\nexport type SessionTurnSource = z.infer<typeof SessionTurnSource>;\n\nexport const SessionGoalStatus = z.enum([\"active\", \"paused\", \"completed\"]);\nexport type SessionGoalStatus = z.infer<typeof SessionGoalStatus>;\n\nexport const SessionGoalCreatedBy = z.enum([\"api\", \"agent\", \"scheduled_task\"]);\nexport type SessionGoalCreatedBy = z.infer<typeof SessionGoalCreatedBy>;\n\nexport const SessionGoalPausedReason = z.enum([\n  \"agent\",\n  \"user_interrupt\",\n  \"api\",\n  \"no_progress\",\n  \"max_auto_continuations\",\n  \"limits\",\n]);\nexport type SessionGoalPausedReason = z.infer<typeof SessionGoalPausedReason>;\n\nexport const SessionGoal = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  status: SessionGoalStatus,\n  text: z.string(),\n  successCriteria: z.string().nullable(),\n  evidence: z.string().nullable(),\n  rationale: z.string().nullable(),\n  pausedReason: z.string().nullable(),\n  createdBy: SessionGoalCreatedBy,\n  version: z.number().int().positive(),\n  autoContinuations: z.number().int().nonnegative(),\n  noProgressStreak: z.number().int().nonnegative(),\n  maxAutoContinuations: z.number().int().positive().nullable(),\n  metadata: z.record(z.string(), z.unknown()),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type SessionGoal = z.infer<typeof SessionGoal>;\n\nexport const GoalSpec = z.object({\n  text: z.string().min(1),\n  successCriteria: z.string().min(1).optional(),\n  maxAutoContinuations: z.number().int().positive().optional(),\n});\nexport type GoalSpec = z.infer<typeof GoalSpec>;\n\nexport const UpdateSessionGoalRequest = z.object({\n  status: z.enum([\"paused\", \"active\"]),\n  rationale: z.string().min(1).optional(),\n});\nexport type UpdateSessionGoalRequest = z.infer<typeof UpdateSessionGoalRequest>;\n\nexport const UpdateSessionRequest = z.object({\n  title: z.string().min(1).max(200),\n});\nexport type UpdateSessionRequest = z.infer<typeof UpdateSessionRequest>;\n\n// Operator context controls (slash-command palette: /clear, /compact). These\n// are session/operator actions, NOT a structured way to talk to the agent —\n// the human↔agent channel stays plain chat. Both require `sessions:control`.\n\n/**\n * Clear a session's conversation context. `confirm` must be the literal `true`\n * so an accidental/empty POST cannot wipe context — the destructive intent is\n * explicit on the wire, mirroring the client-side confirm affordance.\n */\nexport const ClearSessionContextRequest = z.object({\n  confirm: z.literal(true),\n});\nexport type ClearSessionContextRequest = z.infer<typeof ClearSessionContextRequest>;\n\n/**\n * The marker key on the sentinel run-state blob written by a context clear. The\n * blob ({@link CLEARED_RUN_STATE_BLOB}) is NOT a real Agents-SDK serialized run\n * state — it carries no `$schemaVersion`/history, so `RunState.fromString` would\n * throw on it. Every read path that deserializes a run-state blob MUST first\n * check {@link isClearedRunStateBlob} and treat a match as \"no prior state\"\n * (a fresh, empty start), which is exactly what a clear means. This is the\n * shared contract that keeps the db (writer) and the runtime (reader) in sync.\n */\nexport const CLEARED_RUN_STATE_MARKER = \"$opengeniCleared\" as const;\n\n/** The canonical sentinel serializedRunState value a context clear stores. */\nexport const CLEARED_RUN_STATE_BLOB = JSON.stringify({ [CLEARED_RUN_STATE_MARKER]: true });\n\n/**\n * True when a serialized run-state blob is the cleared sentinel rather than a\n * real Agents-SDK run state. Recognized leniently (any object carrying the\n * marker key set truthy) so a future field addition to the sentinel does not\n * resurrect the pre-clear context. Anything that is not the sentinel — including\n * malformed JSON — returns false so genuine blobs/corruption are handled by the\n * normal deserialize path.\n */\nexport function isClearedRunStateBlob(serialized: string | null | undefined): boolean {\n  if (!serialized) {\n    return false;\n  }\n  try {\n    const parsed = JSON.parse(serialized) as unknown;\n    return typeof parsed === \"object\"\n      && parsed !== null\n      && (parsed as Record<string, unknown>)[CLEARED_RUN_STATE_MARKER] === true;\n  } catch {\n    return false;\n  }\n}\n\n/** Trigger conversation compaction now. No body fields today (forward-room). */\nexport const CompactSessionContextRequest = z.object({}).strict();\nexport type CompactSessionContextRequest = z.infer<typeof CompactSessionContextRequest>;\n\n/** Outcome of a manual /compact trigger. */\nexport const CompactSessionContextResult = z.object({\n  // queued: a client-side (Azure) compaction will run before the next turn.\n  // noop:   nothing to do (server-managed provider, mode off, or no history).\n  status: z.enum([\"queued\", \"noop\"]),\n  message: z.string(),\n});\nexport type CompactSessionContextResult = z.infer<typeof CompactSessionContextResult>;\n\nexport const SessionTurn = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  triggerEventId: z.string().uuid(),\n  temporalWorkflowId: z.string(),\n  status: SessionTurnStatus,\n  source: SessionTurnSource,\n  position: z.number().int().positive(),\n  prompt: z.string().min(1),\n  resources: z.array(ResourceRef),\n  tools: z.array(ToolRef),\n  model: z.string().min(1),\n  reasoningEffort: ReasoningEffort,\n  sandboxBackend: SandboxBackend,\n  // Per-turn OS override. NULL = inherit the session's sandboxOs.\n  sandboxOs: SandboxOs.nullable(),\n  metadata: z.record(z.string(), z.unknown()),\n  startedAt: z.string().nullable(),\n  finishedAt: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type SessionTurn = z.infer<typeof SessionTurn>;\n\nexport const UpdateSessionTurnRequest = z.object({\n  prompt: z.string().min(1).optional(),\n  resources: z.array(ResourceRef).optional(),\n  tools: z.array(ToolRef).optional(),\n  model: z.string().min(1).optional(),\n  reasoningEffort: ReasoningEffort.optional(),\n  sandboxBackend: SandboxBackend.optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\nexport type UpdateSessionTurnRequest = z.infer<typeof UpdateSessionTurnRequest>;\n\nexport const ReorderSessionTurnsRequest = z.object({\n  turnIds: z.array(z.string().uuid()).min(1),\n});\nexport type ReorderSessionTurnsRequest = z.infer<typeof ReorderSessionTurnsRequest>;\n\nexport const WorkspaceEnvironmentVariableName = z.string().regex(/^[A-Z][A-Z0-9_]*$/).max(128);\nexport type WorkspaceEnvironmentVariableName = z.infer<typeof WorkspaceEnvironmentVariableName>;\n\n// Metadata only by design: no schema in this file ever carries a variable value\n// back to a client. Values are write-only and decrypted exclusively inside the\n// worker at sandbox materialization time.\nexport const WorkspaceEnvironmentVariableMetadata = z.object({\n  name: WorkspaceEnvironmentVariableName,\n  version: z.number().int().positive(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type WorkspaceEnvironmentVariableMetadata = z.infer<typeof WorkspaceEnvironmentVariableMetadata>;\n\nexport const WorkspaceEnvironment = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  name: z.string(),\n  description: z.string().nullable(),\n  variables: z.array(WorkspaceEnvironmentVariableMetadata),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type WorkspaceEnvironment = z.infer<typeof WorkspaceEnvironment>;\n\nexport const CreateWorkspaceEnvironmentRequest = z.object({\n  name: z.string().min(1).max(120),\n  description: z.string().max(2000).optional(),\n  variables: z.array(z.object({\n    name: WorkspaceEnvironmentVariableName,\n    value: z.string().min(1).max(32768),\n  })).default([]),\n});\nexport type CreateWorkspaceEnvironmentRequest = z.infer<typeof CreateWorkspaceEnvironmentRequest>;\n\nexport const UpdateWorkspaceEnvironmentRequest = z.object({\n  name: z.string().min(1).max(120).optional(),\n  description: z.string().max(2000).nullable().optional(),\n});\nexport type UpdateWorkspaceEnvironmentRequest = z.infer<typeof UpdateWorkspaceEnvironmentRequest>;\n\nexport const SetWorkspaceEnvironmentVariableRequest = z.object({\n  value: z.string().min(1).max(32768),\n});\nexport type SetWorkspaceEnvironmentVariableRequest = z.infer<typeof SetWorkspaceEnvironmentVariableRequest>;\n\nexport const ScheduledTaskStatus = z.enum([\"active\", \"paused\"]);\nexport type ScheduledTaskStatus = z.infer<typeof ScheduledTaskStatus>;\n\nexport const ScheduledTaskRunStatus = z.enum([\"queued\", \"dispatched\", \"failed\"]);\nexport type ScheduledTaskRunStatus = z.infer<typeof ScheduledTaskRunStatus>;\n\nexport const ScheduledTaskRunMode = z.enum([\"new_session_per_run\", \"reusable_session\"]);\nexport type ScheduledTaskRunMode = z.infer<typeof ScheduledTaskRunMode>;\n\nexport const ScheduledTaskOverlapPolicy = z.enum([\"allow_concurrent\", \"skip\", \"buffer_one\"]);\nexport type ScheduledTaskOverlapPolicy = z.infer<typeof ScheduledTaskOverlapPolicy>;\n\nexport const ScheduledTaskTriggerType = z.enum([\"scheduled\", \"manual\"]);\nexport type ScheduledTaskTriggerType = z.infer<typeof ScheduledTaskTriggerType>;\n\nexport const ScheduledTaskScheduleSpec = z.discriminatedUnion(\"type\", [\n  z.object({\n    type: z.literal(\"once\"),\n    runAt: z.string().datetime({ offset: true }),\n    timeZone: z.string().min(1).default(\"UTC\"),\n  }),\n  z.object({\n    type: z.literal(\"interval\"),\n    everySeconds: z.number().int().positive(),\n    startAt: z.string().datetime({ offset: true }).optional(),\n    endAt: z.string().datetime({ offset: true }).optional(),\n  }),\n  z.object({\n    type: z.literal(\"calendar\"),\n    timeZone: z.string().min(1).default(\"UTC\"),\n    hour: z.number().int().min(0).max(23),\n    minute: z.number().int().min(0).max(59),\n    daysOfWeek: z.array(z.enum([\"SUNDAY\", \"MONDAY\", \"TUESDAY\", \"WEDNESDAY\", \"THURSDAY\", \"FRIDAY\", \"SATURDAY\"])).min(1).optional(),\n  }),\n]);\nexport type ScheduledTaskScheduleSpec = z.infer<typeof ScheduledTaskScheduleSpec>;\n\nexport const ScheduledTaskAgentConfig = z.object({\n  prompt: z.string().min(1),\n  resources: z.array(ResourceRef).default([]),\n  tools: z.array(ToolRef).default([]),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  model: z.string().min(1).optional(),\n  reasoningEffort: ReasoningEffort.optional(),\n  sandboxBackend: SandboxBackend.optional(),\n  goal: GoalSpec.optional(),\n});\nexport type ScheduledTaskAgentConfig = z.infer<typeof ScheduledTaskAgentConfig>;\n\nexport const ScheduledTask = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  name: z.string(),\n  status: ScheduledTaskStatus,\n  schedule: ScheduledTaskScheduleSpec,\n  temporalScheduleId: z.string(),\n  runMode: ScheduledTaskRunMode,\n  overlapPolicy: ScheduledTaskOverlapPolicy,\n  agentConfig: ScheduledTaskAgentConfig,\n  reusableSessionId: z.string().uuid().nullable(),\n  environmentId: z.string().uuid().nullable(),\n  metadata: z.record(z.string(), z.unknown()),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ScheduledTask = z.infer<typeof ScheduledTask>;\n\nexport const ScheduledTaskRun = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  taskId: z.string().uuid(),\n  status: ScheduledTaskRunStatus,\n  triggerType: ScheduledTaskTriggerType,\n  scheduledAt: z.string().nullable(),\n  firedAt: z.string(),\n  sessionId: z.string().uuid().nullable(),\n  triggerEventId: z.string().uuid().nullable(),\n  error: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ScheduledTaskRun = z.infer<typeof ScheduledTaskRun>;\n\nexport const CreateScheduledTaskRequest = z.object({\n  name: z.string().min(1),\n  schedule: ScheduledTaskScheduleSpec,\n  runMode: ScheduledTaskRunMode.default(\"new_session_per_run\"),\n  overlapPolicy: ScheduledTaskOverlapPolicy.default(\"allow_concurrent\"),\n  agentConfig: ScheduledTaskAgentConfig,\n  status: ScheduledTaskStatus.default(\"active\"),\n  environmentId: z.string().uuid().nullable().optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateScheduledTaskRequest = z.infer<typeof CreateScheduledTaskRequest>;\n\nexport const UpdateScheduledTaskRequest = z.object({\n  name: z.string().min(1).optional(),\n  schedule: ScheduledTaskScheduleSpec.optional(),\n  runMode: ScheduledTaskRunMode.optional(),\n  overlapPolicy: ScheduledTaskOverlapPolicy.optional(),\n  agentConfig: ScheduledTaskAgentConfig.optional(),\n  status: ScheduledTaskStatus.optional(),\n  environmentId: z.string().uuid().nullable().optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\nexport type UpdateScheduledTaskRequest = z.infer<typeof UpdateScheduledTaskRequest>;\n\n/**\n * Manual-trigger body. `triggerId` is a client-supplied idempotency token: a\n * retried trigger that reuses the same token charges once and starts one run.\n * Omitting it makes each call a distinct trigger (the server mints a token).\n */\nexport const TriggerScheduledTaskRequest = z.object({\n  triggerId: z.string().min(1).max(128).optional(),\n});\nexport type TriggerScheduledTaskRequest = z.infer<typeof TriggerScheduledTaskRequest>;\n\nexport const CapabilityPackConnectorAuthModel = z.enum([\n  \"oauth2_authorization_code_pkce\",\n  \"oauth2_authorization_code\",\n  \"api_key\",\n  \"credential_ref\",\n]);\nexport type CapabilityPackConnectorAuthModel = z.infer<typeof CapabilityPackConnectorAuthModel>;\n\nexport const CapabilityPackConnector = z.object({\n  id: z.string().min(1),\n  name: z.string().min(1),\n  category: z.string().min(1),\n  authModel: CapabilityPackConnectorAuthModel,\n  providers: z.array(z.string().min(1)).default([]),\n  scopes: z.array(z.string().min(1)).default([]),\n  required: z.boolean().default(false),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CapabilityPackConnector = z.infer<typeof CapabilityPackConnector>;\n\nexport const CapabilityPackKnowledge = z.object({\n  type: z.literal(\"document_base\"),\n  id: z.string().min(1),\n  name: z.string().min(1),\n  description: z.string().nullable().default(null),\n  required: z.boolean().default(false),\n});\nexport type CapabilityPackKnowledge = z.infer<typeof CapabilityPackKnowledge>;\n\nexport const CapabilityPackScheduledTaskTemplate = z.object({\n  id: z.string().min(1),\n  name: z.string().min(1),\n  description: z.string().min(1),\n  defaultSchedule: ScheduledTaskScheduleSpec,\n  defaultRunMode: ScheduledTaskRunMode.default(\"new_session_per_run\"),\n  defaultOverlapPolicy: ScheduledTaskOverlapPolicy.default(\"skip\"),\n  // Optional default agent prompt so registered pack manifests can ship fully\n  // instantiable templates; built-in packs may instead build prompts in code.\n  prompt: z.string().min(1).optional(),\n});\nexport type CapabilityPackScheduledTaskTemplate = z.infer<typeof CapabilityPackScheduledTaskTemplate>;\n\n// One file inside a pack skill directory. Paths are workspace-relative POSIX\n// paths inside the skill directory (for example \"SKILL.md\" or\n// \"references/runbook.md\"); content is UTF-8 text carried inline in the pack\n// manifest, which is also how registered packs persist it (the manifest JSONB\n// row in workspace_packs is the storage of record for pack skills).\nexport const CapabilityPackSkillFile = z.object({\n  path: z.string().min(1).max(512).refine(isSafePackSkillRelativePath, {\n    message: \"skill file path must be a safe relative POSIX path without '..' segments\",\n  }),\n  content: z.string().max(256 * 1024),\n});\nexport type CapabilityPackSkillFile = z.infer<typeof CapabilityPackSkillFile>;\n\n// A skill delivered by a capability pack. The name doubles as the skill\n// directory under the sandbox skill index (skills/<name>), so it must be a\n// single safe path segment. Every skill must ship a top-level SKILL.md.\nexport const CapabilityPackSkill = z.object({\n  name: z.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, {\n    message: \"skill name must be a single path segment of letters, digits, '.', '_' or '-'\",\n  }),\n  description: z.string().min(1).max(2048).optional(),\n  files: z.array(CapabilityPackSkillFile).min(1).max(64),\n}).superRefine((skill, ctx) => {\n  const seen = new Set<string>();\n  skill.files.forEach((file, index) => {\n    if (seen.has(file.path)) {\n      ctx.addIssue({ code: \"custom\", message: `duplicate skill file path: ${file.path}`, path: [\"files\", index, \"path\"] });\n    }\n    seen.add(file.path);\n  });\n  if (!skill.files.some((file) => file.path === \"SKILL.md\")) {\n    ctx.addIssue({ code: \"custom\", message: \"skill must include a top-level SKILL.md file\", path: [\"files\"] });\n  }\n});\nexport type CapabilityPackSkill = z.infer<typeof CapabilityPackSkill>;\n\nfunction isSafePackSkillRelativePath(path: string): boolean {\n  if (path.startsWith(\"/\") || path.includes(\"\\\\\")) {\n    return false;\n  }\n  return path.split(\"/\").every((segment) => segment.length > 0 && segment !== \".\" && segment !== \"..\");\n}\n\nexport const CapabilityPack = z.object({\n  id: z.string().min(1),\n  name: z.string().min(1),\n  description: z.string().min(1),\n  role: z.string().min(1),\n  category: z.string().min(1),\n  version: z.string().min(1),\n  // Container image ref (digest-pinned recommended) the pack's sessions run\n  // in. At most one enabled pack per workspace may declare one; with none,\n  // sessions use the deployment-wide image settings.\n  sandboxImage: z.string().trim().min(1).max(512).optional(),\n  // Skills delivered into the sandbox skill index when the pack is enabled.\n  skills: z.array(CapabilityPackSkill).max(32).superRefine((skills, ctx) => {\n    const seen = new Set<string>();\n    skills.forEach((skill, index) => {\n      const key = skill.name.toLowerCase();\n      if (seen.has(key)) {\n        ctx.addIssue({ code: \"custom\", message: `duplicate pack skill name: ${skill.name}`, path: [index, \"name\"] });\n      }\n      seen.add(key);\n    });\n  }).default([]),\n  tools: z.array(ToolRef).default([]),\n  connectors: z.array(CapabilityPackConnector).default([]),\n  knowledge: z.array(CapabilityPackKnowledge).default([]),\n  scheduledTaskTemplates: z.array(CapabilityPackScheduledTaskTemplate).default([]),\n  environment: z.object({\n    description: z.string().min(1),\n    requiredVariables: z.array(WorkspaceEnvironmentVariableName).default([]),\n    required: z.boolean().default(false),\n  }).optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CapabilityPack = z.infer<typeof CapabilityPack>;\n\n// Registering a pack stores the manifest itself; the request body is a full\n// CapabilityPack manifest.\nexport const RegisterCapabilityPackRequest = CapabilityPack;\nexport type RegisterCapabilityPackRequest = z.infer<typeof RegisterCapabilityPackRequest>;\n\nexport const WorkspaceRegisteredPack = z.object({\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  pack: CapabilityPack,\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type WorkspaceRegisteredPack = z.infer<typeof WorkspaceRegisteredPack>;\n\nexport const PackInstallationStatus = z.enum([\"active\", \"disabled\"]);\nexport type PackInstallationStatus = z.infer<typeof PackInstallationStatus>;\n\nexport const PackInstallation = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  packId: z.string().min(1),\n  status: PackInstallationStatus,\n  metadata: z.record(z.string(), z.unknown()),\n  enabledAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type PackInstallation = z.infer<typeof PackInstallation>;\n\nexport const EnablePackRequest = z.object({\n  environmentId: z.string().uuid().optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type EnablePackRequest = z.infer<typeof EnablePackRequest>;\n\nexport const SocialProvider = z.enum([\n  \"x\",\n  \"linkedin\",\n  \"instagram\",\n  \"facebook\",\n  \"tiktok\",\n  \"youtube\",\n  \"custom\",\n]);\nexport type SocialProvider = z.infer<typeof SocialProvider>;\n\nexport const SocialConnectionStatus = z.enum([\"connected\", \"needs_reauth\", \"disabled\"]);\nexport type SocialConnectionStatus = z.infer<typeof SocialConnectionStatus>;\n\nexport const SocialConnection = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  provider: SocialProvider,\n  accountHandle: z.string().min(1),\n  accountName: z.string().nullable(),\n  externalAccountId: z.string().nullable(),\n  status: SocialConnectionStatus,\n  scopes: z.array(z.string()),\n  credentialRef: z.string().nullable(),\n  tokenMetadata: z.record(z.string(), z.unknown()),\n  metadata: z.record(z.string(), z.unknown()),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type SocialConnection = z.infer<typeof SocialConnection>;\n\nexport const CreateSocialConnectionRequest = z.object({\n  provider: SocialProvider,\n  accountHandle: z.string().min(1),\n  accountName: z.string().min(1).optional(),\n  externalAccountId: z.string().min(1).optional(),\n  status: SocialConnectionStatus.default(\"connected\"),\n  scopes: z.array(z.string().min(1)).default([]),\n  credentialRef: z.string().min(1).optional(),\n  tokenMetadata: z.record(z.string(), z.unknown()).default({}),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateSocialConnectionRequest = z.infer<typeof CreateSocialConnectionRequest>;\n\nexport const SocialPost = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  connectionId: z.string().uuid(),\n  provider: SocialProvider,\n  externalPostId: z.string().nullable(),\n  url: z.string().url().nullable(),\n  authorHandle: z.string().nullable(),\n  text: z.string(),\n  publishedAt: z.string(),\n  metrics: z.record(z.string(), z.number()),\n  raw: z.record(z.string(), z.unknown()),\n  createdAt: z.string(),\n});\nexport type SocialPost = z.infer<typeof SocialPost>;\n\nexport const CreateSocialPostRequest = z.object({\n  connectionId: z.string().uuid(),\n  externalPostId: z.string().min(1).optional(),\n  url: z.string().url().optional(),\n  authorHandle: z.string().min(1).optional(),\n  text: z.string().min(1),\n  publishedAt: z.string().datetime({ offset: true }),\n  metrics: z.record(z.string(), z.number()).default({}),\n  raw: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateSocialPostRequest = z.infer<typeof CreateSocialPostRequest>;\n\nexport const MarketingDailyAnalysisTaskRequest = z.object({\n  name: z.string().min(1).optional(),\n  connectionIds: z.array(z.string().uuid()).default([]),\n  documentBaseIds: z.array(z.string().uuid()).default([]),\n  timeZone: z.string().min(1).default(\"UTC\"),\n  hour: z.number().int().min(0).max(23).default(9),\n  minute: z.number().int().min(0).max(59).default(0),\n  promptInstructions: z.string().min(1).optional(),\n  status: ScheduledTaskStatus.default(\"active\"),\n  runMode: ScheduledTaskRunMode.default(\"new_session_per_run\"),\n  overlapPolicy: ScheduledTaskOverlapPolicy.default(\"skip\"),\n});\nexport type MarketingDailyAnalysisTaskRequest = z.infer<typeof MarketingDailyAnalysisTaskRequest>;\n\nexport const CapabilityKind = z.enum([\"pack\", \"mcp\", \"api\", \"skill\", \"plugin\"]);\nexport type CapabilityKind = z.infer<typeof CapabilityKind>;\n\nexport const CapabilitySource = z.enum([\"built_in\", \"configured\", \"public_registry\", \"manual\"]);\nexport type CapabilitySource = z.infer<typeof CapabilitySource>;\n\nexport const CapabilityInstallationStatus = z.enum([\"active\", \"disabled\"]);\nexport type CapabilityInstallationStatus = z.infer<typeof CapabilityInstallationStatus>;\n\nexport const CapabilityRuntime = z.object({\n  available: z.boolean().default(false),\n  mcpServerId: z.string().min(1).optional(),\n  transport: z.string().min(1).optional(),\n  notes: z.string().nullable().default(null),\n});\nexport type CapabilityRuntime = z.infer<typeof CapabilityRuntime>;\n\nexport const CapabilityCatalogItem = z.object({\n  id: z.string().min(1),\n  accountId: z.string().uuid().optional(),\n  workspaceId: z.string().uuid().optional(),\n  kind: CapabilityKind,\n  source: CapabilitySource,\n  name: z.string().min(1),\n  description: z.string().nullable().default(null),\n  category: z.string().min(1).default(\"custom\"),\n  tags: z.array(z.string().min(1)).default([]),\n  homepageUrl: z.string().url().nullable().default(null),\n  endpointUrl: z.string().url().nullable().default(null),\n  installUrl: z.string().url().nullable().default(null),\n  authModel: z.string().min(1).nullable().default(null),\n  tools: z.array(ToolRef).default([]),\n  runtime: CapabilityRuntime.default({ available: false, notes: null }),\n  enabled: z.boolean().default(false),\n  enabledReason: z.string().nullable().default(null),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  createdAt: z.string().optional(),\n  updatedAt: z.string().optional(),\n});\nexport type CapabilityCatalogItem = z.infer<typeof CapabilityCatalogItem>;\n\nexport const CapabilityInstallation = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  capabilityId: z.string().min(1),\n  kind: CapabilityKind,\n  status: CapabilityInstallationStatus,\n  config: z.record(z.string(), z.unknown()),\n  metadata: z.record(z.string(), z.unknown()),\n  enabledAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type CapabilityInstallation = z.infer<typeof CapabilityInstallation>;\n\nexport const CreateCapabilityCatalogItemRequest = z.object({\n  id: z.string().min(1).optional(),\n  kind: CapabilityKind.exclude([\"pack\"]),\n  source: CapabilitySource.default(\"manual\"),\n  name: z.string().min(1),\n  description: z.string().min(1).optional(),\n  category: z.string().min(1).default(\"custom\"),\n  tags: z.array(z.string().min(1)).default([]),\n  homepageUrl: z.string().url().optional(),\n  endpointUrl: z.string().url().optional(),\n  installUrl: z.string().url().optional(),\n  authModel: z.string().min(1).optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateCapabilityCatalogItemRequest = z.infer<typeof CreateCapabilityCatalogItemRequest>;\n\nexport const EnableCapabilityRequest = z.object({\n  config: z.record(z.string(), z.unknown()).default({}),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  /**\n   * Credential headers for remote MCP capabilities (for example an\n   * Authorization bearer token). Values are encrypted at rest with the\n   * workspace-environments key, injected only into the runtime MCP client,\n   * and never returned by the API — responses expose header names only.\n   */\n  headers: z.record(z.string(), z.string()).default({}),\n  /**\n   * Initial environment attachment for kind=pack capabilities. Mirrors the\n   * dedicated POST /packs/:id/enable body: required to enable an\n   * environment.required pack through the unified capability-enable path,\n   * optional otherwise. Ignored by non-pack capabilities.\n   */\n  environmentId: z.string().uuid().optional(),\n});\nexport type EnableCapabilityRequest = z.infer<typeof EnableCapabilityRequest>;\n\nexport const CapabilityCatalogResponse = z.object({\n  items: z.array(CapabilityCatalogItem),\n  installations: z.array(CapabilityInstallation),\n});\nexport type CapabilityCatalogResponse = z.infer<typeof CapabilityCatalogResponse>;\n\nexport const DiscoverMcpCapabilitiesResponse = z.object({\n  items: z.array(CapabilityCatalogItem),\n  source: z.literal(\"official_mcp_registry\"),\n  sourceUrl: z.string().url(),\n});\nexport type DiscoverMcpCapabilitiesResponse = z.infer<typeof DiscoverMcpCapabilitiesResponse>;\n\nexport const Session = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  accountId: z.string().uuid(),\n  status: SessionStatus,\n  initialMessage: z.string(),\n  title: z.string().nullable(),\n  titleSource: z.enum([\"user\", \"agent\"]).nullable(),\n  // Per-session agent persona/system instructions supplied at create. Org-visible\n  // metadata (exposed like title/goal), never a secret and never a timeline event.\n  // null when the session carried none.\n  instructions: z.string().nullable(),\n  resources: z.array(ResourceRef),\n  tools: z.array(ToolRef),\n  metadata: z.record(z.string(), z.unknown()),\n  model: z.string(),\n  sandboxBackend: SandboxBackend,\n  // The OS the session's box runs. Defaults to 'linux' (today's only OS).\n  sandboxOs: SandboxOs,\n  // The shared-sandbox group the session's box belongs to. Equals the session's\n  // own id for a singleton group (today's 1:1 default); equals the parent's\n  // group when spawned shared (both sessions run in ONE box).\n  sandboxGroupId: z.string().uuid(),\n  // The first-class swappable-sandbox POINTER (bring-your-own-compute M2). NULL\n  // resolves to the session's own group sandbox (the backward-compat default);\n  // a swap sets it to the target sandbox row. active_epoch is the second epoch\n  // ABOVE the lease epoch, bumped on every swap so the routing proxy can fence a\n  // stale in-flight op and retry against the new active sandbox.\n  activeSandboxId: z.string().uuid().nullable(),\n  activeEpoch: z.number().int().nonnegative(),\n  environmentId: z.string().uuid().nullable(),\n  // Non-default first-party MCP token permissions (manager-style sessions);\n  // null means the fixed worker default set.\n  firstPartyMcpPermissions: z.array(Permission).nullable(),\n  // Per-session third-party MCP servers, metadata only. Credential values are\n  // write-only and never appear here.\n  mcpServers: z.array(SessionMcpServerMetadata).default([]),\n  // The manager session that spawned this one via session_create (set only\n  // when the creating grant carried a worker-signed sessionId claim); null for\n  // direct API creates and scheduled-task runs. When set, this session's\n  // terminal-for-now transitions wake the parent.\n  parentSessionId: z.string().uuid().nullable(),\n  // Workspace-scoped CREATE idempotency key the session was created under (the\n  // dedup target collapsing double-submit/retry races to one session); null\n  // when the create carried no key.\n  createIdempotencyKey: z.string().nullable(),\n  temporalWorkflowId: z.string().nullable(),\n  activeTurnId: z.string().uuid().nullable(),\n  // Actual input tokens of the last model call of the most recent turn; the\n  // pre-turn client-side context-compaction trigger reads it as its budget\n  // signal. Null until a turn with usage has completed.\n  lastInputTokens: z.number().int().nonnegative().nullable(),\n  lastSequence: z.number().int().nonnegative(),\n  // Multi-account Codex (P1). codexPinnedCredentialId: the account this session is\n  // manually PINNED to (null ⇒ follow the workspace active pointer).\n  // codexLastCredentialId: the account the most recent turn actually ran on (the\n  // \"Running on:\" indicator's source). Both are credential-row ids, null until set.\n  codexPinnedCredentialId: z.string().uuid().nullable(),\n  codexLastCredentialId: z.string().uuid().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type Session = z.infer<typeof Session>;\n\nexport const SessionEventType = z.enum([\n  \"session.created\",\n  \"session.status.changed\",\n  \"session.requiresAction\",\n  \"session.context.compacted\",\n  \"session.context.cleared\",\n  \"user.message\",\n  \"user.interrupt\",\n  \"user.approvalDecision\",\n  \"turn.queued\",\n  \"turn.updated\",\n  \"turn.started\",\n  \"turn.completed\",\n  \"turn.failed\",\n  \"turn.cancelled\",\n  \"turn.preempted\",\n  \"agent.message.delta\",\n  \"agent.message.completed\",\n  \"agent.reasoning.delta\",\n  \"agent.toolCall.created\",\n  \"agent.toolCall.output\",\n  \"agent.updated\",\n  \"sandbox.operation.started\",\n  \"sandbox.operation.completed\",\n  \"sandbox.operation.failed\",\n  \"sandbox.command.output.delta\",\n  \"artifact.created\",\n  \"goal.set\",\n  \"goal.updated\",\n  \"goal.completed\",\n  \"goal.paused\",\n  \"goal.resumed\",\n  \"goal.continuation\",\n  // Channel-B desktop pixel-plane signals (07-channel-b §1.2). The pixel socket\n  // carries opaque RFB and cannot carry a control message the client can act on,\n  // so these ride the durable, sequenced, gap-filled Channel-A SSE spine.\n  \"stream.url.rotated\", // re-minted {url,token,expiresAt} on box rollover (event-driven)\n  \"stream.opened\", // a viewer attached (audit + refcount visibility)\n  \"stream.closed\", // a viewer detached / was reaped\n  \"stream.revoked\", // a grant was revoked → connected clients MUST disconnect now\n  // Channel-B recording signals (P4.3 / module 05 §3.4). The \"agent films itself\n  // proving the fix\" loop: ffmpeg x11grab of the SAME :0 humans watch → artifact\n  // → storage. The artifact ref rides the AVAILABLE event (storageKey, NOT a\n  // long-lived URL — clients mint a short-TTL signed GET via the route).\n  \"recording.started\", // ffmpeg launched on :0 (mode/codec/dimensions)\n  \"recording.available\", // finalized: bytes PUT to storage, replayable\n  \"recording.failed\", // ffmpeg/box-death/rollover/upload error — no artifact\n  // Channel-A structured-service notifications (P4.4 / modules/08-channel-a.md\n  // §2.2). The A2 reads (fs/git/terminal exec) are SYNCHRONOUS API-direct point\n  // queries (their result is the HTTP response, NEVER an event). What rides A1\n  // here are the side-effect NOTIFICATIONS — a path changed, git state changed,\n  // a pty opened/printed/exited — durable, sequenced, gap-filled like every\n  // other session event, so any viewer's Pierre tree / diff / terminal stays\n  // live. fs.changed/git.changed are cache-invalidation signals; the pty.*\n  // events carry the interactive terminal byte stream.\n  \"fs.changed\", // a path was created/modified/deleted (write or agent mutation)\n  \"git.changed\", // working-tree/index/HEAD changed (debounced re-probe)\n  \"terminal.pty.started\", // an interactive PTY session opened (carries ptyId)\n  \"terminal.pty.output.delta\", // PTY stdout/stderr bytes (separate from command.output)\n  \"terminal.pty.exited\", // PTY session ended (exitCode/reason)\n  \"session.title_set\",\n  // Multi-account Codex (P1): the account a session's turn runs on changed\n  // (manual switch in P1; failover/rotation in P3 reuse the same event). Drives\n  // the in-session \"Running on:\" indicator's live flip.\n  \"codex.account.switched\",\n]);\nexport type SessionEventType = z.infer<typeof SessionEventType>;\n\n// Channel-B stream-event payloads (07-channel-b §1.2). SessionEvent.payload is\n// z.unknown() (NOT a discriminated union) — these are standalone schemas parsed\n// explicitly at the producer (the API-direct handshake/rotation) and the SDK/\n// React consumer. The rotation payload carries the freshly-minted data-plane URL\n// + the scoped stream token so a connected client hot-swaps its noVNC socket.\nexport const StreamUrlRotatedPayload = z.object({\n  url: z.string().url(),\n  token: z.string().nullable(),\n  expiresAt: z.string().datetime().nullable(),\n  // The epoch the new URL was minted under (the box-rollover fence the client\n  // reconciles against). A client must drop a rotation event whose epoch it has\n  // already advanced past.\n  leaseEpoch: z.number().int().nonnegative(),\n  transport: z.literal(\"vnc-ws\"),\n  // The viewer holder this URL is for (so a client filters out other viewers').\n  viewerId: z.string().uuid().nullable().default(null),\n});\nexport type StreamUrlRotatedPayload = z.infer<typeof StreamUrlRotatedPayload>;\n\nexport const StreamOpenedPayload = z.object({\n  viewerId: z.string().uuid(),\n  shared: z.boolean().default(false),\n  viewerCount: z.number().int().nonnegative(),\n});\nexport type StreamOpenedPayload = z.infer<typeof StreamOpenedPayload>;\n\nexport const StreamClosedPayload = z.object({\n  viewerId: z.string().uuid(),\n  reason: z.enum([\"client-disconnect\", \"reaped\", \"revoked\", \"box-rollover\"]),\n  viewerCount: z.number().int().nonnegative(),\n});\nexport type StreamClosedPayload = z.infer<typeof StreamClosedPayload>;\n\nexport const StreamRevokedPayload = z.object({\n  viewerId: z.string().uuid().nullable().default(null),\n  reason: z.enum([\"grant-revoked\", \"session-failed\", \"admin\"]),\n});\nexport type StreamRevokedPayload = z.infer<typeof StreamRevokedPayload>;\n\n// ── Recording payloads (P4.3 / module 05 §3.4) ──────────────────────────────\n// SessionEvent.payload is z.unknown() (NOT a discriminated union) — these are\n// standalone schemas parsed explicitly at the producer (the recording activity)\n// and the SDK/React consumer. The codec/contentType pair stays consistent\n// (h264-mp4↔video/mp4, vp9-webm↔video/webm).\nexport const RecordingMode = z.enum([\"manual\", \"on-turn\", \"on-verify\"]);\nexport type RecordingMode = z.infer<typeof RecordingMode>;\nexport const RecordingCodec = z.enum([\"h264-mp4\", \"vp9-webm\"]);\nexport type RecordingCodec = z.infer<typeof RecordingCodec>;\nexport const RecordingContentType = z.enum([\"video/mp4\", \"video/webm\"]);\nexport type RecordingContentType = z.infer<typeof RecordingContentType>;\n\nexport const RecordingStartedPayload = z.object({\n  recordingId: z.string().uuid(),\n  turnId: z.string().uuid().nullable(),\n  mode: RecordingMode,\n  codec: RecordingCodec,\n  dimensions: z.tuple([z.number().int().positive(), z.number().int().positive()]),\n  framerate: z.number().int().positive(),\n  startedAt: z.string(), // ISO\n  // The verification rationale (\"agent-verification: tf apply succeeded\"). Agent-\n  // authored free text — the producer caps + scrubs it before emit.\n  reason: z.string().nullable().optional(),\n});\nexport type RecordingStartedPayload = z.infer<typeof RecordingStartedPayload>;\n\nexport const RecordingAvailablePayload = z.object({\n  recordingId: z.string().uuid(),\n  turnId: z.string().uuid().nullable(),\n  codec: RecordingCodec,\n  contentType: RecordingContentType,\n  // The @opengeni/storage object key. NO long-lived URL in the event — clients\n  // mint a short-TTL signed GET via GET …/recordings/:id/url.\n  storageKey: z.string(),\n  durationSeconds: z.number().nonnegative().nullable(),\n  sizeBytes: z.number().int().nonnegative(),\n  dimensions: z.tuple([z.number().int().positive(), z.number().int().positive()]),\n});\nexport type RecordingAvailablePayload = z.infer<typeof RecordingAvailablePayload>;\n\n// `max-bytes-exceeded` is distinct from `timeout` (the -t ceiling hitting is a\n// SUCCESSFUL finalize, never a failure) — the adversarial-review F7 fix.\nexport const RecordingFailedReason = z.enum([\n  \"ffmpeg-error\",\n  \"box-death\",\n  \"box-rollover\",\n  \"upload-failed\",\n  \"max-bytes-exceeded\",\n  \"display-unavailable\",\n]);\nexport type RecordingFailedReason = z.infer<typeof RecordingFailedReason>;\n\nexport const RecordingFailedPayload = z.object({\n  recordingId: z.string().uuid(),\n  turnId: z.string().uuid().nullable(),\n  reason: RecordingFailedReason,\n  // ffmpeg-stderr tail / error detail — agent/ffmpeg-controlled, so the producer\n  // caps + scrubs it before emit (it rides redact() like every payload).\n  detail: z.string().nullable().optional(),\n});\nexport type RecordingFailedPayload = z.infer<typeof RecordingFailedPayload>;\n\n// ── Channel-A structured services (P4.4 / modules/08-channel-a.md) ───────────\n// Two transports on one spine: the A2 request/response shapes (FsNode tree,\n// GitDiff hunks, terminal exec) are returned INLINE on synchronous API-direct\n// routes (never the bus); the A1 notification payloads below ride the durable\n// SSE event log so every viewer's Pierre tree / diff / terminal stays live.\n\n// --- A1 event payloads -------------------------------------------------------\n\n// The agent's command-output firehose, enriched. Backward-compatible widening\n// of the existing sandbox.command.output.delta (consumers read `chunk`); the\n// producer may now also stamp stream/commandId/seq for finer terminal rendering.\nexport const SandboxCommandOutputDeltaPayload = z.object({\n  stream: z.enum([\"stdout\", \"stderr\"]).default(\"stdout\"),\n  chunk: z.string(), // raw bytes, utf-8 (lossy) — terminal is opaque-ish\n  commandId: z.string().optional(), // groups deltas to one agent command\n  seq: z.number().int().nonnegative().optional(), // intra-command ordering hint\n});\nexport type SandboxCommandOutputDeltaPayload = z.infer<typeof SandboxCommandOutputDeltaPayload>;\n\nexport const FsChangeKind = z.enum([\"created\", \"modified\", \"deleted\", \"renamed\"]);\nexport type FsChangeKind = z.infer<typeof FsChangeKind>;\nexport const FsChangedPayload = z.object({\n  changes: z.array(z.object({\n    path: z.string(), // workspace-relative POSIX path\n    kind: FsChangeKind,\n    isDir: z.boolean().default(false),\n    sizeBytes: z.number().int().nonnegative().nullable().default(null),\n    oldPath: z.string().optional(), // for \"renamed\"\n  })).min(1),\n  source: z.enum([\"write\", \"watch\", \"agent\"]).default(\"write\"),\n  // Monotonic FS revision (per-lease, paired with leaseEpoch for staleness).\n  revision: z.number().int().nonnegative(),\n  // The lease epoch the revision was minted under: a client invalidates on a\n  // (leaseEpoch, revision) tuple change, never a bare revision compare (H3 —\n  // revision resets to 0 on box re-key, so a bare monotonic compare goes stale).\n  leaseEpoch: z.number().int().nonnegative().default(0),\n});\nexport type FsChangedPayload = z.infer<typeof FsChangedPayload>;\n\nexport const GitChangedPayload = z.object({\n  head: z.string().nullable(), // current branch or detached SHA\n  dirty: z.boolean(), // working tree has uncommitted changes\n  ahead: z.number().int().nonnegative().default(0),\n  behind: z.number().int().nonnegative().default(0),\n  changedFileCount: z.number().int().nonnegative(),\n  reason: z.enum([\"commit\", \"checkout\", \"stage\", \"worktree\", \"fetch\", \"unknown\"]).default(\"unknown\"),\n  revision: z.number().int().nonnegative().default(0),\n  leaseEpoch: z.number().int().nonnegative().default(0),\n});\nexport type GitChangedPayload = z.infer<typeof GitChangedPayload>;\n\nexport const TerminalPtyStartedPayload = z.object({\n  ptyId: z.string().uuid(),\n  cols: z.number().int().positive(),\n  rows: z.number().int().positive(),\n  shell: z.string(), // resolved shell, e.g. \"/bin/bash\"\n  cwd: z.string(),\n});\nexport type TerminalPtyStartedPayload = z.infer<typeof TerminalPtyStartedPayload>;\n\nexport const TerminalPtyOutputDeltaPayload = z.object({\n  ptyId: z.string().uuid(),\n  stream: z.enum([\"stdout\", \"stderr\"]).default(\"stdout\"),\n  chunk: z.string(), // raw terminal bytes (incl. ANSI), utf-8 lossy\n  seq: z.number().int().nonnegative(), // strict per-pty ordering (owner-assigned)\n});\nexport type TerminalPtyOutputDeltaPayload = z.infer<typeof TerminalPtyOutputDeltaPayload>;\n\nexport const TerminalPtyExitedPayload = z.object({\n  ptyId: z.string().uuid(),\n  exitCode: z.number().int().nullable(),\n  reason: z.enum([\"exit\", \"killed\", \"owner_gone\", \"timeout\"]),\n});\nexport type TerminalPtyExitedPayload = z.infer<typeof TerminalPtyExitedPayload>;\n\n// --- A2 FileSystem request/response (NOT events; returned inline) ------------\nexport const FsNodeType = z.enum([\"file\", \"dir\", \"symlink\", \"other\"]);\nexport type FsNodeType = z.infer<typeof FsNodeType>;\n// The Pierre-tree node. `children` is present only when the dir was listed with\n// depth>0; the tree lazy-expands via repeated depth-1 lists at deeper paths.\nexport interface FsTreeNode {\n  name: string;\n  path: string; // workspace-relative POSIX, no leading slash\n  type: z.infer<typeof FsNodeType>;\n  sizeBytes: number | null; // null for dirs\n  mtimeMs: number | null;\n  mode: number | null; // unix mode bits, for Pierre tree icons/perms\n  children?: FsTreeNode[] | undefined;\n  truncated: boolean; // dir had more entries than the cap\n}\nexport const FsTreeNode: z.ZodType<FsTreeNode> = z.lazy(() => z.object({\n  name: z.string(),\n  path: z.string(),\n  type: FsNodeType,\n  sizeBytes: z.number().int().nonnegative().nullable(),\n  mtimeMs: z.number().int().nonnegative().nullable(),\n  mode: z.number().int().nullable(),\n  children: z.array(FsTreeNode).optional(),\n  truncated: z.boolean().default(false),\n})) as z.ZodType<FsTreeNode>;\n\nexport const FsListRequest = z.object({\n  path: z.string().default(\"\"), // \"\" = workspace root\n  depth: z.number().int().min(0).max(8).default(1),\n  maxEntries: z.number().int().positive().max(20_000).default(2_000),\n  includeHidden: z.boolean().default(true),\n});\nexport type FsListRequest = z.infer<typeof FsListRequest>;\nexport const FsListResponse = z.object({\n  root: FsTreeNode,\n  revision: z.number().int().nonnegative(),\n  truncated: z.boolean(), // global cap hit\n});\nexport type FsListResponse = z.infer<typeof FsListResponse>;\n\nexport const FsEncoding = z.enum([\"utf8\", \"base64\"]);\nexport type FsEncoding = z.infer<typeof FsEncoding>;\nexport const FsReadRequest = z.object({\n  path: z.string(),\n  encoding: FsEncoding.default(\"utf8\"),\n  maxBytes: z.number().int().positive().max(25 * 1024 * 1024).default(5 * 1024 * 1024),\n});\nexport type FsReadRequest = z.infer<typeof FsReadRequest>;\nexport const FsReadResponse = z.object({\n  path: z.string(),\n  encoding: FsEncoding,\n  content: z.string(), // text or base64 per encoding\n  sizeBytes: z.number().int().nonnegative(), // bytes returned (== content size)\n  truncated: z.boolean(), // sizeBytes hit maxBytes; content is the prefix\n  isBinary: z.boolean(), // sniffed NUL byte in first 8KB\n  revision: z.number().int().nonnegative(),\n});\nexport type FsReadResponse = z.infer<typeof FsReadResponse>;\n\nexport const FsWriteRequest = z.object({\n  path: z.string(),\n  encoding: FsEncoding.default(\"utf8\"),\n  content: z.string(),\n  overwrite: z.boolean().default(true), // false + existing path => 409\n  createParents: z.boolean().default(true),\n});\nexport type FsWriteRequest = z.infer<typeof FsWriteRequest>;\nexport const FsWriteResponse = z.object({\n  path: z.string(),\n  sizeBytes: z.number().int().nonnegative(),\n  revision: z.number().int().nonnegative(), // == the fs.changed revision\n});\nexport type FsWriteResponse = z.infer<typeof FsWriteResponse>;\n\nexport const FsDeleteRequest = z.object({\n  path: z.string(),\n  recursive: z.boolean().default(false), // required true to delete a non-empty dir\n});\nexport type FsDeleteRequest = z.infer<typeof FsDeleteRequest>;\nexport const FsDeleteResponse = z.object({ revision: z.number().int().nonnegative() });\nexport type FsDeleteResponse = z.infer<typeof FsDeleteResponse>;\n\nexport const FsMoveRequest = z.object({\n  path: z.string(),\n  newPath: z.string(),\n  overwrite: z.boolean().default(false), // false + existing destination => 409\n  createParents: z.boolean().default(true),\n});\nexport type FsMoveRequest = z.infer<typeof FsMoveRequest>;\nexport const FsMoveResponse = z.object({\n  path: z.string(),\n  newPath: z.string(),\n  revision: z.number().int().nonnegative(), // == the fs.changed revision\n});\nexport type FsMoveResponse = z.infer<typeof FsMoveResponse>;\n\nexport const FsMkdirRequest = z.object({\n  path: z.string(),\n  recursive: z.boolean().default(true), // false + existing path => 400\n});\nexport type FsMkdirRequest = z.infer<typeof FsMkdirRequest>;\nexport const FsMkdirResponse = z.object({\n  path: z.string(),\n  revision: z.number().int().nonnegative(), // == the fs.changed revision\n});\nexport type FsMkdirResponse = z.infer<typeof FsMkdirResponse>;\n\n// --- A2 Git request/response (read-only; feeds Pierre diff/tree) -------------\nexport const GitFileStatusCode = z.enum([\n  \"added\", \"modified\", \"deleted\", \"renamed\", \"copied\", \"untracked\", \"ignored\", \"conflicted\", \"typechange\",\n]);\nexport type GitFileStatusCode = z.infer<typeof GitFileStatusCode>;\nexport const GitFileStatus = z.object({\n  path: z.string(),\n  oldPath: z.string().nullable(), // for renamed/copied\n  index: GitFileStatusCode.nullable(), // staged change (X in porcelain XY)\n  worktree: GitFileStatusCode.nullable(), // unstaged change (Y in porcelain XY)\n  isConflicted: z.boolean().default(false),\n});\nexport type GitFileStatus = z.infer<typeof GitFileStatus>;\nexport const GitStatusRequest = z.object({\n  path: z.string().default(\"\"), // repo root within workspace (multi-repo support)\n});\nexport type GitStatusRequest = z.infer<typeof GitStatusRequest>;\nexport const GitStatusResponse = z.object({\n  isRepo: z.boolean(),\n  head: z.string().nullable(), // branch name\n  detached: z.boolean().default(false),\n  upstream: z.string().nullable(),\n  ahead: z.number().int().nonnegative().default(0),\n  behind: z.number().int().nonnegative().default(0),\n  files: z.array(GitFileStatus),\n  revision: z.number().int().nonnegative(),\n});\nexport type GitStatusResponse = z.infer<typeof GitStatusResponse>;\n\n// The structured hunk shape that feeds Pierre diff — the whole point of Git.\nexport const GitDiffLineType = z.enum([\"context\", \"add\", \"del\", \"meta\"]);\nexport type GitDiffLineType = z.infer<typeof GitDiffLineType>;\nexport const GitDiffLine = z.object({\n  type: GitDiffLineType,\n  // null on the side that doesn't have the line (add => oldNo null; del => newNo null)\n  oldNo: z.number().int().positive().nullable(),\n  newNo: z.number().int().positive().nullable(),\n  text: z.string(), // line WITHOUT leading +/-/space marker\n});\nexport type GitDiffLine = z.infer<typeof GitDiffLine>;\nexport const GitDiffHunk = z.object({\n  oldStart: z.number().int().nonnegative(),\n  oldLines: z.number().int().nonnegative(),\n  newStart: z.number().int().nonnegative(),\n  newLines: z.number().int().nonnegative(),\n  header: z.string(), // the @@ ... @@ section heading\n  lines: z.array(GitDiffLine),\n});\nexport type GitDiffHunk = z.infer<typeof GitDiffHunk>;\nexport const GitFileDiff = z.object({\n  path: z.string(),\n  oldPath: z.string().nullable(),\n  status: GitFileStatusCode,\n  isBinary: z.boolean().default(false),\n  isImage: z.boolean().default(false),\n  additions: z.number().int().nonnegative(),\n  deletions: z.number().int().nonnegative(),\n  hunks: z.array(GitDiffHunk), // empty if binary or truncated\n  truncated: z.boolean().default(false), // diff exceeded maxBytes; hunks omitted\n});\nexport type GitFileDiff = z.infer<typeof GitFileDiff>;\nexport const GitDiffRequest = z.object({\n  path: z.string().default(\"\"), // repo root\n  // diff selectors, mutually exclusive precedence: refs > staged > worktree\n  staged: z.boolean().default(false), // --cached (index vs HEAD)\n  fromRef: z.string().optional(),\n  toRef: z.string().optional(),\n  pathspec: z.array(z.string()).default([]),\n  contextLines: z.number().int().min(0).max(10).default(3),\n  maxBytesPerFile: z.number().int().positive().max(2 * 1024 * 1024).default(512 * 1024),\n});\nexport type GitDiffRequest = z.infer<typeof GitDiffRequest>;\nexport const GitDiffResponse = z.object({\n  files: z.array(GitFileDiff),\n  revision: z.number().int().nonnegative(),\n});\nexport type GitDiffResponse = z.infer<typeof GitDiffResponse>;\n\nexport const GitLogRequest = z.object({\n  path: z.string().default(\"\"),\n  ref: z.string().default(\"HEAD\"),\n  maxCount: z.number().int().positive().max(1_000).default(100),\n  skip: z.number().int().nonnegative().default(0),\n  pathspec: z.array(z.string()).default([]),\n});\nexport type GitLogRequest = z.infer<typeof GitLogRequest>;\nexport const GitCommit = z.object({\n  sha: z.string(),\n  shortSha: z.string(),\n  parents: z.array(z.string()),\n  author: z.object({ name: z.string(), email: z.string(), timestamp: z.number().int() }),\n  committer: z.object({ name: z.string(), email: z.string(), timestamp: z.number().int() }),\n  subject: z.string(),\n  body: z.string(),\n  refs: z.array(z.string()).default([]), // decorations: branch/tag pointers\n});\nexport type GitCommit = z.infer<typeof GitCommit>;\nexport const GitLogResponse = z.object({ commits: z.array(GitCommit), hasMore: z.boolean() });\nexport type GitLogResponse = z.infer<typeof GitLogResponse>;\n\nexport const GitShowRequest = z.object({\n  path: z.string().default(\"\"),\n  ref: z.string(), // a commit/tag/tree-ish\n  filePath: z.string().optional(), // ref + filePath => raw blob (\"open file at commit\")\n  encoding: FsEncoding.default(\"utf8\"),\n  maxBytesPerFile: z.number().int().positive().max(2 * 1024 * 1024).default(512 * 1024),\n});\nexport type GitShowRequest = z.infer<typeof GitShowRequest>;\nexport const GitShowResponse = z.object({\n  commit: GitCommit.nullable(), // null when fetching a raw blob\n  files: z.array(GitFileDiff), // commit diff vs first parent\n  blob: z.object({ content: z.string(), encoding: FsEncoding, sizeBytes: z.number().int(), truncated: z.boolean() }).nullable(),\n  revision: z.number().int().nonnegative(),\n});\nexport type GitShowResponse = z.infer<typeof GitShowResponse>;\n\n// --- A2 Terminal exec (run a command in-box, stream stdout/stderr) -----------\n// The command-output FIREHOSE rides A1 (sandbox.command.output.delta). This is\n// the SYNCHRONOUS exec: run a bounded command and return its stdout/stderr +\n// exit code inline (the result IS the HTTP response). Full interactive PTY\n// (open/write/resize) layers on top via the pty.* events; exec ships now.\nexport const TerminalExecRequest = z.object({\n  command: z.string().min(1),\n  cwd: z.string().default(\"\"), // workspace-relative\n  // Soft per-call wall-clock bound (the box yields output back when reached).\n  timeoutMs: z.number().int().positive().max(120_000).default(30_000),\n  // Stream the deltas onto A1 as the agent firehose (so other viewers see it),\n  // in addition to returning the buffered result inline.\n  emitStream: z.boolean().default(true),\n});\nexport type TerminalExecRequest = z.infer<typeof TerminalExecRequest>;\nexport const TerminalExecResponse = z.object({\n  stdout: z.string(),\n  stderr: z.string(),\n  exitCode: z.number().int().nullable(),\n  // True when the process was still running when the call yielded (a long\n  // command); the remaining output drains onto A1 if emitStream was set.\n  running: z.boolean(),\n  wallTimeSeconds: z.number().nonnegative(),\n});\nexport type TerminalExecResponse = z.infer<typeof TerminalExecResponse>;\n\n// --- A2 Terminal PTY control (output rides A1) -------------------------------\nexport const PtyOpenRequest = z.object({\n  cols: z.number().int().positive().max(500).default(80),\n  rows: z.number().int().positive().max(300).default(24),\n  cwd: z.string().default(\"\"), // workspace-relative\n  shell: z.string().optional(), // default: resolved login shell\n});\nexport type PtyOpenRequest = z.infer<typeof PtyOpenRequest>;\nexport const PtyOpenResponse = z.object({\n  ptyId: z.string().uuid(),\n  // output streams as terminal.pty.output.delta on the SSE channel the client holds\n  streamVia: z.literal(\"sse-events\"),\n  supportsInput: z.boolean(), // false on backends without writeStdin\n});\nexport type PtyOpenResponse = z.infer<typeof PtyOpenResponse>;\nexport const PtyWriteRequest = z.object({ ptyId: z.string().uuid(), data: z.string() }); // utf-8 stdin\nexport type PtyWriteRequest = z.infer<typeof PtyWriteRequest>;\nexport const PtyResizeRequest = z.object({ ptyId: z.string().uuid(), cols: z.number().int().positive(), rows: z.number().int().positive() });\nexport type PtyResizeRequest = z.infer<typeof PtyResizeRequest>;\nexport const PtyCloseRequest = z.object({ ptyId: z.string().uuid() });\nexport type PtyCloseRequest = z.infer<typeof PtyCloseRequest>;\n\n// Per-session structured-service capabilities (the Channel-A slice of the\n// negotiation). The full SessionCapabilities doc already carries FileSystem /\n// Terminal / Git blocks (P0.1); this is the compact projection the SDK mirrors.\nexport const SessionStructuredCapabilities = z.object({\n  FileSystem: z.object({ available: z.boolean(), readOnly: z.boolean(), root: z.string() }),\n  Terminal: z.object({\n    events: z.boolean(), // command.output firehose (always on if a box exists)\n    exec: z.boolean(), // synchronous terminal exec\n    pty: z.object({ available: z.boolean() }), // interactive stdin (writeStdin)\n  }),\n  Git: z.object({ available: z.boolean(), repos: z.array(z.string()) }),\n});\nexport type SessionStructuredCapabilities = z.infer<typeof SessionStructuredCapabilities>;\n\nexport const SessionEvent = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  sequence: z.number().int().positive(),\n  type: SessionEventType,\n  payload: z.unknown().default({}),\n  occurredAt: z.string(),\n  clientEventId: z.string().min(1).nullable().optional(),\n  turnId: z.string().uuid().nullable().optional(),\n});\nexport type SessionEvent = z.infer<typeof SessionEvent>;\n\nexport const CreateSessionRequest = z.object({\n  initialMessage: z.string().min(1),\n  // Per-session agent persona/system instructions (org-visible metadata, NOT a\n  // secret). Rides the SAME system-level instructions channel the per-workspace\n  // agentInstructions rides, composed AFTER the workspace persona so it refines\n  // it for this one session — how a host delivers per-agent-type prompts without\n  // leaking them into the user-visible timeline (it is NEVER emitted as an\n  // event, unlike goal/initialMessage). Trimmed, non-empty. The 32768-char cap\n  // matches the codebase's largest free-form string convention (workspace\n  // environment variable values). Absent ⇒ byte-identical to today.\n  instructions: z.string().trim().min(1).max(32768).optional(),\n  resources: z.array(ResourceRef).default([]),\n  tools: z.array(ToolRef).default([]),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  model: z.string().min(1).optional(),\n  reasoningEffort: ReasoningEffort.optional(),\n  sandboxBackend: SandboxBackend.optional(),\n  // The enrolled machine (a sandbox id) to run this session on; seeds the\n  // active-sandbox pointer at creation so the FIRST turn routes to the chosen\n  // machine (race-free: the pointer is committed before the worker turn\n  // workflow can read it). An invalid/unowned/offline target fails the create.\n  targetSandboxId: z.string().uuid().optional(),\n  // The working directory the targeted machine runs the session under — the\n  // path/cwd base for its agent exec, terminal, and file dock. Free-form pass-\n  // through: a launch-workspace_root-relative subdir or an absolute machine path\n  // (the agent's resolve_cwd handles both). Only valid WITH targetSandboxId\n  // (workingDir alone is a 422); omitted ⇒ the machine's default workspace_root.\n  workingDir: z.string().min(1).optional(),\n  // Workspace environment attachment is fixed at session creation; follow-up\n  // user.message events cannot switch or add one.\n  environmentId: z.string().uuid().optional(),\n  goal: GoalSpec.optional(),\n  clientEventId: z.string().min(1).optional(),\n  // Workspace-scoped CREATE idempotency key: collapses concurrent/retried\n  // create calls carrying the same key to a single session (partial unique\n  // index on (workspace_id, create_idempotency_key)). Distinct from\n  // clientEventId, whose uniqueness is per-session and so cannot dedup the\n  // creation of a brand-new session. Absent means no create-dedup (each call\n  // is an independent create).\n  idempotencyKey: z.string().min(1).max(200).optional(),\n  // Permissions the session's first-party MCP token should carry instead of\n  // the fixed worker default — how an operator hands a manager-style session\n  // the orchestration/environment/github tools. Capped at creation: every\n  // requested permission must be held by the creating grant (no escalation).\n  firstPartyMcpPermissions: z.array(Permission).optional(),\n  // Third-party MCP servers attached only to this session. Credential headers are\n  // write-only: create responses and events expose only SessionMcpServerMetadata.\n  mcpServers: z.array(SessionMcpServerInput).default([]),\n  // Shared-sandbox placement (addendum 05 §D.1). Three-way union; OMITTED ⇒\n  // today's behavior (a context-dependent default resolved server-side: from\n  // inside a session → \"shared\" with the creator's box, top-level → \"new\").\n  //   - \"shared\":  join the CREATOR's box. Requires a parent session (inferred\n  //                from the worker-signed sessionId claim, never caller-supplied);\n  //                top-level \"shared\" is a 422.\n  //   - \"new\":     mint a fresh singleton box (group ≡ the new session's id).\n  //   - {groupId}: join a SPECIFIC sibling group in THIS workspace (manager\n  //                fan-out). Validated workspace-scoped (cross-workspace → 404).\n  // A shared spawn inherits the box's (backend, os) — it is literally the same\n  // box; the child cannot pick its own backend. Cross-workspace sharing is\n  // forbidden by construction (the parent/group reads are RLS-workspace-scoped).\n  // ENV-AWARE: the box's environment is fixed at creation, so a share requires\n  // the SAME environmentId as the creator's box. On a mismatch the inherited\n  // default silently falls back to an own box; an explicit \"shared\"/{groupId}\n  // request 422s at create (instead of the first turn dying on the SDK's\n  // manifest-env guard).\n  sandbox: z.union([\n    z.literal(\"shared\"),\n    z.literal(\"new\"),\n    z.object({ groupId: z.string().uuid() }),\n  ]).optional(),\n});\nexport type CreateSessionRequest = z.infer<typeof CreateSessionRequest>;\n\nexport const ClientSessionEvent = z.discriminatedUnion(\"type\", [\n  z.object({\n    type: z.literal(\"user.message\"),\n    clientEventId: z.string().min(1).optional(),\n    payload: z.object({\n      text: z.string().min(1),\n      resources: z.array(ResourceRef).default([]),\n      tools: z.array(ToolRef).default([]),\n      model: z.string().min(1).optional(),\n      reasoningEffort: ReasoningEffort.optional(),\n      // Header-value rotation only. URL/name/tool settings are immutable after\n      // session create; persisted events expose metadata, never header values.\n      mcpCredentialUpdates: z.array(SessionMcpCredentialUpdateInput).optional(),\n    }),\n  }),\n  z.object({\n    type: z.literal(\"user.interrupt\"),\n    clientEventId: z.string().min(1).optional(),\n    payload: z.object({ reason: z.string().optional() }).default({}),\n  }),\n  z.object({\n    type: z.literal(\"user.approvalDecision\"),\n    clientEventId: z.string().min(1).optional(),\n    payload: z.object({\n      approvalId: z.string().min(1),\n      decision: z.enum([\"approve\", \"reject\"]),\n      message: z.string().optional(),\n    }),\n  }),\n]);\nexport type ClientSessionEvent = z.infer<typeof ClientSessionEvent>;\n\nexport const SessionBusMessage = z.object({\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  events: z.array(SessionEvent).min(1),\n});\nexport type SessionBusMessage = z.infer<typeof SessionBusMessage>;\n\nexport const GitHubAppManifestCreate = z.object({\n  appName: z.string().optional(),\n  organization: z.string().optional(),\n  public: z.boolean().default(false),\n  includeCiPermissions: z.boolean().default(true),\n});\nexport type GitHubAppManifestCreate = z.infer<typeof GitHubAppManifestCreate>;\n\nexport const GitHubRepository = z.object({\n  id: z.number().int(),\n  installationId: z.number().int(),\n  fullName: z.string(),\n  name: z.string(),\n  private: z.boolean(),\n  htmlUrl: z.string(),\n  cloneUrl: z.string(),\n  defaultBranch: z.string(),\n  accountLogin: z.string(),\n  accountType: z.string().nullable(),\n});\nexport type GitHubRepository = z.infer<typeof GitHubRepository>;\n\nexport const ClientAuthConfig = z.discriminatedUnion(\"mode\", [\n  z.object({\n    mode: z.literal(\"none\"),\n  }),\n  z.object({\n    mode: z.literal(\"deploymentKey\"),\n    headerName: z.literal(\"x-opengeni-access-key\"),\n  }),\n  z.object({\n    mode: z.literal(\"configuredToken\"),\n    headerName: z.literal(\"authorization\"),\n    scheme: z.literal(\"bearer\"),\n  }),\n  z.object({\n    mode: z.literal(\"managedSession\"),\n    session: z.literal(\"cookie\"),\n  }),\n]);\nexport type ClientAuthConfig = z.infer<typeof ClientAuthConfig>;\n\n// The negotiated capability handshake document (master-spine C.3). ONE shape;\n// collapses the parallel per-module definitions. A capability cell is always\n// present with `available`/`transport` + a `reason` when unavailable — never\n// absent.\nexport const CapabilityUnavailableReason = z.enum([\n  \"backend_unsupported\",\n  \"os_unsupported\",\n  \"not_provisioned\",\n  \"disabled_by_policy\",\n  \"lease_cold\",\n  \"tier_headless\",\n  // Selfhosted (bring-your-own-compute) negotiation states (M1 additive; the\n  // selfhosted negotiation in select.ts wires them in M3):\n  \"agent_offline\", // the enrolled agent process is not running / unreachable\n  \"agent_reconnecting\", // a transient blip — the agent is reconnecting (warmable)\n  \"consent_required\", // whole-machine / screen-control consent not yet acknowledged\n  \"display_unavailable\", // headless machine with no display stack (no DesktopStream)\n]);\nexport type CapabilityUnavailableReason = z.infer<typeof CapabilityUnavailableReason>;\n\nexport const SessionCapabilities = z.object({\n  sessionId: z.string().uuid(),\n  backend: SandboxBackend,\n  os: SandboxOs,\n  liveness: z.enum([\"cold\", \"warming\", \"warm\", \"draining\"]),\n  // Echoed on viewer heartbeats (the split-brain fence).\n  leaseEpoch: z.number().int().nonnegative(),\n  viewerHeartbeatIntervalMs: z.number().int().positive().default(30_000),\n  FileSystem: z.object({\n    available: z.boolean(),\n    readOnly: z.boolean(),\n    root: z.string(),\n    pathSep: z.enum([\"/\", \"\\\\\"]),\n    treeMode: z.enum([\"lazy\", \"snapshot\"]),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  Terminal: z.object({\n    transport: z.enum([\"sse-events\", \"pty-ws\"]).nullable(),\n    ptyCapable: z.boolean(),\n    shell: z.string(),\n    // The direct-to-provider ttyd PTY-over-websocket URL (pty-ws) resolved on the\n    // SAME tunnel as the desktop; null on a cold lease / read-only sse-events\n    // firehose / degraded terminal. The scoped stream token is recorded against\n    // the holder (NEVER a URL query param), symmetric with DesktopStream.\n    url: z.string().url().nullable(),\n    token: z.string().nullable(),\n    // ISO absolute expiry of the minted stream token (symmetric with\n    // DesktopStream.expiresAt). Null when no live URL/token is minted.\n    expiresAt: z.string().nullable(),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  Git: z.object({\n    available: z.boolean(),\n    repos: z.array(z.string()),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  DesktopStream: z.object({\n    // \"relay-frames\" is the selfhosted framebuffer stream: PNG-per-frame protobuf\n    // datagrams spliced over the relay (NOT RFB). The viewer renders it with the\n    // \"frames\" client (a canvas painter), distinct from Modal's \"vnc-ws\"/\"novnc\".\n    transport: z.enum([\"vnc-ws\", \"rdp-ws\", \"webrtc\", \"relay-frames\"]).nullable(),\n    client: z.enum([\"novnc\", \"web-rdp\", \"frames\"]).nullable(),\n    mode: z.enum([\"read-only\", \"interactive\"]).default(\"read-only\"),\n    url: z.string().url().nullable(),\n    token: z.string().nullable(),\n    expiresAt: z.string().nullable(),\n    resolution: z\n      .tuple([z.number().int().positive(), z.number().int().positive()])\n      .default([1024, 768]),\n    // REQUIRED, no default (the server must assert un-redacted pixels).\n    unredacted: z.boolean(),\n    requiresAcknowledgment: z.boolean(),\n    acknowledged: z.boolean(),\n    // SHARED-EXPOSURE disclosure (addendum E.1). `shared` is true when the box's\n    // group has >1 session: watching this desktop ALSO shows the sibling\n    // sessions' agents on the one :0 framebuffer (the pixels cannot be redacted).\n    // `sharedSessionIds` lists the OTHER sessions whose agents may appear — IDS\n    // ONLY, never their goal/metadata/conversation (a viewer of A must not be\n    // able to use \"I can see B's id\" to subscribe to B's events; stress g). When\n    // shared, the consent gate requires the shared-exposure acknowledgment (409\n    // shared_acknowledgment_required) before the desktop path is handed out.\n    shared: z.boolean().default(false),\n    sharedSessionIds: z.array(z.string().uuid()).default([]),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  Recording: z.object({\n    available: z.boolean(),\n    modes: z.array(z.enum([\"manual\", \"on-turn\", \"on-verify\"])),\n    codecs: z.array(z.enum([\"h264-mp4\", \"vp9-webm\"])),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  // The AGENT drives the SAME :0 (xdotool/XTEST + scrot) the human watches; the\n  // human viewer plane is read-only by default (§6). `available` == desktop-\n  // capable backend && computerUseEnabled; `readOnly` reports whether the agent\n  // driver itself is gated to no-op input (v1 default false — the agent clicks).\n  ComputerUse: z.object({\n    available: z.boolean(),\n    readOnly: z.boolean(),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  negotiatedAt: z.string(),\n});\nexport type SessionCapabilities = z.infer<typeof SessionCapabilities>;\n\n// ── API-direct viewer attach (P1.4) ─────────────────────────────────────────\n// A viewer holds the GROUP lease (keeping the box warm while watched). These\n// shape the in-process attach/heartbeat/detach handlers. The scoped stream\n// token + the un-redacted-pixel acknowledgment are P3/P4 — here it is the\n// viewer-HOLDER lifecycle only.\n\n// POST .../viewers — acquire a viewer holder. An omitted viewerId mints a fresh\n// one (returned in the response, to carry through heartbeats + detach).\n//\n// `desktop` declares intent to attach the UN-REDACTED pixel plane (noVNC). ONLY\n// that plane carries the consent gate (the un-redacted/shared acknowledgment). A\n// terminal-only warm attach (`desktop:false`, the default) needs NO consent — a\n// shell is interactive by nature and the gate is the scoped tunnel URL + stream\n// token — so it warms the box and mints the pty-ws terminal cell WITHOUT a 409.\n// Omitted defaults to `false` so a terminal-only client never trips the gate.\nexport const AttachViewerRequest = z.object({\n  viewerId: z.string().uuid().optional(),\n  desktop: z.boolean().optional(),\n});\nexport type AttachViewerRequest = z.infer<typeof AttachViewerRequest>;\n\nexport const ViewerHolder = z.object({\n  viewerId: z.string().uuid(),\n  sandboxGroupId: z.string().uuid(),\n  liveness: z.enum([\"cold\", \"warming\", \"warm\", \"draining\"]),\n  // The epoch the viewer is fenced on; echoed back on heartbeats.\n  leaseEpoch: z.number().int().nonnegative(),\n  viewerHeartbeatIntervalMs: z.number().int().positive(),\n  // The desktop pixel tunnel URL the viewer connects to directly; null until\n  // P4 mints it (gated until then).\n  dataPlaneUrl: z.string().nullable(),\n});\nexport type ViewerHolder = z.infer<typeof ViewerHolder>;\n\n// POST .../stream-capabilities/acknowledge — record the calling principal's\n// acknowledgment of the un-redacted pixel plane (P3.2; modules/07-channel-b.md\n// §6 + addendum E.1). Reuses the acknowledgment machinery — no new endpoint\n// shape beyond this body, no new permission beyond stream:acknowledge.\n//\n// `acknowledgeShared` MUST be true when the box is shared (the group has >1\n// session): the un-redacted desktop path returns 409 shared_acknowledgment_required\n// until a shared box is acknowledged WITH the shared-exposure consent. For a\n// solo box `acknowledgeShared` is irrelevant (the un-redacted ack alone gates).\nexport const AcknowledgeStreamRequest = z.object({\n  // The principal accepts that the desktop pixel plane is un-redacted (can show\n  // cloud creds the agent cat's into a terminal). Always true to record consent;\n  // present for self-documentation + a future explicit withdraw.\n  acknowledgeUnredacted: z.boolean().default(true),\n  // The principal accepts the shared-exposure disclosure: watching this desktop\n  // also shows sibling sessions' agents on the one framebuffer.\n  acknowledgeShared: z.boolean().default(false),\n});\nexport type AcknowledgeStreamRequest = z.infer<typeof AcknowledgeStreamRequest>;\n\nexport const AcknowledgeStreamResponse = z.object({\n  acknowledged: z.boolean(),\n  acknowledgedShared: z.boolean(),\n});\nexport type AcknowledgeStreamResponse = z.infer<typeof AcknowledgeStreamResponse>;\n\n// POST .../viewers/:viewerId/heartbeat — refresh the holder TTL. Epoch-fenced:\n// a stale-epoch beat (a box re-established under a newer epoch) is rejected.\nexport const ViewerHeartbeatRequest = z.object({\n  leaseEpoch: z.number().int().nonnegative(),\n});\nexport type ViewerHeartbeatRequest = z.infer<typeof ViewerHeartbeatRequest>;\n\nexport const ViewerHeartbeatResponse = z.object({\n  // false ⇒ the holder was reaped or the epoch is stale; the client re-attaches.\n  alive: z.boolean(),\n});\nexport type ViewerHeartbeatResponse = z.infer<typeof ViewerHeartbeatResponse>;\n\n// =============================================================================\n// Bring-your-own-compute (M5) — enrollment device-flow HTTP contract.\n//\n// The HTTP shapes mirror the @opengeni/agent-proto device-flow messages\n// (DeviceAuthStart*, DeviceAuthPoll*, EnrollmentCredentials) so the Rust agent's\n// `enroll` command (which runs the flow over HTTP before it has NATS creds)\n// decodes the SAME field names (the proto's ts-proto JSON is camelCase). The\n// request bodies additionally carry the consent-relevant fields the dossier brief\n// mandates (the agent ed25519 pubkey + can-offer-display + requests-screen-control).\n// =============================================================================\n\nexport const EnrollmentOs = z.enum([\"linux\", \"macos\", \"windows\"]);\nexport type EnrollmentOs = z.infer<typeof EnrollmentOs>;\nexport const EnrollmentArch = z.enum([\"x86_64\", \"aarch64\"]);\nexport type EnrollmentArch = z.infer<typeof EnrollmentArch>;\n\n// POST /enrollments/device/start (agent-side, unauthenticated-at-the-user-level,\n// rate-limited). The agent presents its ed25519 public key + os/arch + the\n// requested whole-machine exposure + whether it can offer a display + whether it\n// requests screen control.\nexport const DeviceEnrollmentStartRequest = z.object({\n  // The agent's ed25519 public key (the machine identity the enrollment binds to).\n  publicKey: z.string().min(1).max(1024),\n  os: EnrollmentOs.default(\"linux\"),\n  arch: EnrollmentArch.default(\"x86_64\"),\n  // Human-friendly machine name (hostname by default).\n  machineName: z.string().min(1).max(256).optional(),\n  // v1 only supports whole-machine; kept explicit so the consent is recorded.\n  exposure: z.literal(\"whole-machine\").default(\"whole-machine\"),\n  // The agent can offer a display (a real screen / Xvfb is available).\n  canOfferDisplay: z.boolean().default(false),\n  // The agent requests screen control (computer-use); the user's allow_screen_control\n  // at approve is the AUTHORITATIVE consent.\n  requestsScreenControl: z.boolean().default(false),\n  // The workspace this machine is enrolling into. The agent is told this at install\n  // (the user picks the workspace, or the install/enroll token carries it). The user\n  // who approves must hold a grant in THIS workspace — that binding is what makes\n  // the (user-unauthenticated) start safe: it cannot grant access to a workspace no\n  // authorized user later approves in.\n  workspaceId: z.string().uuid(),\n});\nexport type DeviceEnrollmentStartRequest = z.infer<typeof DeviceEnrollmentStartRequest>;\n\n// The DeviceAuthStart response (field names match the proto's JSON).\nexport const DeviceEnrollmentStartResponse = z.object({\n  deviceCode: z.string(),\n  userCode: z.string(),\n  verificationUri: z.string(),\n  verificationUriComplete: z.string(),\n  intervalSeconds: z.number().int().positive(),\n  expiresInSeconds: z.number().int().positive(),\n});\nexport type DeviceEnrollmentStartResponse = z.infer<typeof DeviceEnrollmentStartResponse>;\n\n// POST /enrollments/device/approve (USER-authenticated, workspace-gated). The\n// LOUD CONSENT step. whole-machine is mandatory (implicit); screen-control is\n// opt-in per allow_screen_control.\nexport const DeviceEnrollmentApproveRequest = z.object({\n  userCode: z.string().min(1).max(64),\n  allowScreenControl: z.boolean().default(false),\n});\nexport type DeviceEnrollmentApproveRequest = z.infer<typeof DeviceEnrollmentApproveRequest>;\n\nexport const DeviceEnrollmentApproveResponse = z.object({\n  approved: z.boolean(),\n  enrollmentId: z.string().uuid(),\n  sandboxId: z.string().uuid(),\n  allowScreenControl: z.boolean(),\n});\nexport type DeviceEnrollmentApproveResponse = z.infer<typeof DeviceEnrollmentApproveResponse>;\n\n// POST /enrollments/device/poll (agent-side). The poll state machine.\nexport const DeviceEnrollmentPollRequest = z.object({\n  deviceCode: z.string().min(1).max(256),\n});\nexport type DeviceEnrollmentPollRequest = z.infer<typeof DeviceEnrollmentPollRequest>;\n\nexport const DeviceEnrollmentState = z.enum([\"pending\", \"authorized\", \"denied\", \"expired\", \"disabled\"]);\nexport type DeviceEnrollmentState = z.infer<typeof DeviceEnrollmentState>;\n\n// The EnrollmentCredentials (field names match the proto's JSON). natsAccountCreds\n// is a PLACEHOLDER — the real per-workspace NATS Account creds binding is\n// infra-deferred (M4/relay); the bearer + subjectPrefix are the application-tier\n// identity the agent presents today.\nexport const EnrollmentCredentialsResponse = z.object({\n  agentId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  // The signed bearer the agent presents to the control plane (the `oge_` token).\n  bearer: z.string(),\n  // The Account-scoped control-plane subject prefix the agent subscribes to:\n  // agent.<workspaceId>.<agentId>.\n  subjectPrefix: z.string(),\n  // Connect info for the control plane + stream relay (may be empty when not yet\n  // configured for this deployment — the agent surfaces \"control plane unconfigured\").\n  natsUrls: z.array(z.string()),\n  relayUrl: z.string(),\n  // The agent's PRODUCER token for the relay edge (the `ogr_` token; M8b). Presented\n  // as StreamOpen.token when the agent registers a pty/desktop channel; the relay\n  // verifies it then pairs the producer with the viewer (whose `ogs_` token the\n  // relay also verifies). Empty when the relay-token plane is unconfigured for this\n  // deployment (graceful degrade — the agent then presents an empty token the relay\n  // rejects, surfacing the gap loudly rather than silently producing a dead stream).\n  relayToken: z.string(),\n  // VESTIGIAL (M-AUTH): there is no per-machine NATS Account creds file. The agent\n  // presents the `bearer` above as the NATS connect AUTH-TOKEN; the server's\n  // auth-callout responder validates it and mints a workspace-scoped user JWT. This\n  // field echoes the bearer so a consumer reading it as the connect credential still\n  // works; new consumers should read `bearer` directly.\n  natsAccountCreds: z.string(),\n  // The minisign public key the agent pins for self-update verification.\n  updatePublicKey: z.string(),\n  consentedWholeMachine: z.boolean(),\n  consentedScreenControl: z.boolean(),\n});\nexport type EnrollmentCredentialsResponse = z.infer<typeof EnrollmentCredentialsResponse>;\n\nexport const DeviceEnrollmentPollResponse = z.object({\n  state: DeviceEnrollmentState,\n  // Present only when state === \"authorized\".\n  credentials: EnrollmentCredentialsResponse.optional(),\n});\nexport type DeviceEnrollmentPollResponse = z.infer<typeof DeviceEnrollmentPollResponse>;\n\n// GET /enrollments — a workspace's machines (the Machines dashboard surface).\nexport const EnrollmentSummary = z.object({\n  id: z.string().uuid(),\n  pubkey: z.string(),\n  exposure: z.literal(\"whole-machine\"),\n  hasDisplay: z.boolean(),\n  allowScreenControl: z.boolean(),\n  status: z.enum([\"active\", \"revoked\"]),\n  os: EnrollmentOs,\n  arch: z.string(),\n  lastSeenAt: z.string().nullable(),\n  createdAt: z.string(),\n  revokedAt: z.string().nullable(),\n});\nexport type EnrollmentSummary = z.infer<typeof EnrollmentSummary>;\n\nexport const ListEnrollmentsResponse = z.object({\n  enrollments: z.array(EnrollmentSummary),\n});\nexport type ListEnrollmentsResponse = z.infer<typeof ListEnrollmentsResponse>;\n\nexport const RevokeEnrollmentResponse = z.object({\n  revoked: z.boolean(),\n});\nexport type RevokeEnrollmentResponse = z.infer<typeof RevokeEnrollmentResponse>;\n\n// =============================================================================\n// Enrollment UX (self-hosted enrollment UX, design 11): the click-Grant approve\n// page lookup/deny + the headless enroll-token mint/exchange. These sit beside the\n// device-flow contracts above and REUSE EnrollmentCredentialsResponse for the\n// exchange's credential payload (identical shape to the poll authorized branch).\n// =============================================================================\n\n// POST /v1/enrollments/device/lookup (USER-authenticated, NO workspace in the\n// path). The approve page (EnrollmentConsent) needs the machine details for a\n// user_code WITHOUT consuming the request. The user_code is globally unique among\n// pending rows; the route resolves its workspace, authorizes (enrollments:read),\n// and returns the machine details — or 404 (never revealing cross-workspace\n// existence) when the grant check fails or no live pending row matches.\nexport const DeviceEnrollmentLookupRequest = z.object({\n  userCode: z.string().min(1).max(64),\n});\nexport type DeviceEnrollmentLookupRequest = z.infer<typeof DeviceEnrollmentLookupRequest>;\n\n// The presentational machine details the consent screen renders (a subset of the\n// pending request — NO secrets, NO device_code).\nexport const DeviceEnrollmentLookupMachine = z.object({\n  machineName: z.string().nullable(),\n  os: EnrollmentOs,\n  arch: z.string(),\n  canOfferDisplay: z.boolean(),\n  requestsScreenControl: z.boolean(),\n});\nexport type DeviceEnrollmentLookupMachine = z.infer<typeof DeviceEnrollmentLookupMachine>;\n\nexport const DeviceEnrollmentLookupResponse = z.object({\n  workspaceId: z.string().uuid(),\n  userCode: z.string(),\n  machine: DeviceEnrollmentLookupMachine,\n  expiresAt: z.string(),\n});\nexport type DeviceEnrollmentLookupResponse = z.infer<typeof DeviceEnrollmentLookupResponse>;\n\n// POST /v1/workspaces/:workspaceId/enrollments/device/deny (USER-authenticated,\n// enrollments:manage). The explicit \"no\" at the approve page — mirrors approve.\nexport const DeviceEnrollmentDenyRequest = z.object({\n  userCode: z.string().min(1).max(64),\n});\nexport type DeviceEnrollmentDenyRequest = z.infer<typeof DeviceEnrollmentDenyRequest>;\n\nexport const DeviceEnrollmentDenyResponse = z.object({\n  denied: z.boolean(),\n});\nexport type DeviceEnrollmentDenyResponse = z.infer<typeof DeviceEnrollmentDenyResponse>;\n\n// POST /v1/workspaces/:workspaceId/enrollments/token (USER-authenticated,\n// enrollments:manage). Mints the short-TTL headless enroll token (the `oget_`\n// token). allowScreenControl bakes the screen-control consent into the token.\nexport const MintEnrollTokenRequest = z.object({\n  allowScreenControl: z.boolean().default(false),\n});\nexport type MintEnrollTokenRequest = z.infer<typeof MintEnrollTokenRequest>;\n\nexport const MintEnrollTokenResponse = z.object({\n  // The `oget_` token. SECRET — the UI shows it once with a copy-now warning.\n  token: z.string(),\n  expiresAt: z.string(),\n  expiresInSeconds: z.number().int().positive(),\n});\nexport type MintEnrollTokenResponse = z.infer<typeof MintEnrollTokenResponse>;\n\n// POST /v1/enrollments/token/exchange (UNAUTHENTICATED — the token IS the auth).\n// The agent presents the same identity fields it sends to device/start plus the\n// enroll token. On a valid token the control plane performs the SAME finalize as\n// approve and returns the IDENTICAL EnrollmentCredentialsResponse shape (so the\n// agent's existing credential parsing is reused).\nexport const EnrollTokenExchangeRequest = z.object({\n  // The `oget_` enroll token (the auth + the workspace/account/consent grant).\n  token: z.string().min(1),\n  // The agent's ed25519 public key (the machine identity the enrollment binds to).\n  publicKey: z.string().min(1).max(1024),\n  os: EnrollmentOs.default(\"linux\"),\n  arch: EnrollmentArch.default(\"x86_64\"),\n  machineName: z.string().min(1).max(256).optional(),\n  // v1 only supports whole-machine; kept explicit so the consent is recorded.\n  exposure: z.literal(\"whole-machine\").default(\"whole-machine\"),\n  canOfferDisplay: z.boolean().default(false),\n  // The agent's REQUEST; the token's allowScreenControl is the AUTHORITATIVE consent.\n  requestsScreenControl: z.boolean().default(false),\n});\nexport type EnrollTokenExchangeRequest = z.infer<typeof EnrollTokenExchangeRequest>;\n\n// The exchange wraps the EXISTING EnrollmentCredentialsResponse — IDENTICAL to the\n// poll authorized branch's `credentials` (NOT a redefined credential shape).\nexport const EnrollTokenExchangeResponse = z.object({\n  credentials: EnrollmentCredentialsResponse,\n});\nexport type EnrollTokenExchangeResponse = z.infer<typeof EnrollTokenExchangeResponse>;\n\n// ── Machines dashboard + per-machine metrics (M10, dossier §10.7) ────────────\n//\n// The SHARED data contract M10 (backend) implements + M9 (UI) renders. THE\n// orchestrator owns this shape; M9 imports these types so the dashboard never\n// drifts from the API. The fields mirror the agent's MetricsSample wire shape\n// (`@opengeni/agent-proto`) projected to the dashboard's JSON, plus the derived\n// machine state matrix (the M3 liveness + the consent/display reasons).\n\n/**\n * A point-in-time machine metrics sample as the dashboard reads it. `cpuPct` and\n * the load averages are 0..N doubles; the byte figures are integers; `gpuUtilPct`\n * / `gpuMemBytes` are null when no GPU was present at sample time (the wire\n * contract: absence == not-reported, NEVER a real zero). `runQueue` is the\n * runnable-count contention signal. `sampledAt` is an ISO-8601 instant.\n */\nexport const MetricSample = z.object({\n  cpuPct: z.number(),\n  load1: z.number(),\n  load5: z.number(),\n  load15: z.number(),\n  memUsedBytes: z.number().int(),\n  memTotalBytes: z.number().int(),\n  diskUsedBytes: z.number().int(),\n  diskTotalBytes: z.number().int(),\n  gpuUtilPct: z.number().nullable(),\n  gpuMemBytes: z.number().int().nullable(),\n  runQueue: z.number(),\n  sampledAt: z.string(),\n});\nexport type MetricSample = z.infer<typeof MetricSample>;\n\n/** The derived dashboard state of a machine. The M3 liveness\n *  (online/reconnecting/offline) plus the enrollment-derived consent/display\n *  reasons (consent_required / display_unavailable) and the in-flight device-flow\n *  (enrolling). */\nexport const MachineState = z.enum([\n  \"online\",\n  \"reconnecting\",\n  \"offline\",\n  \"consent_required\",\n  \"display_unavailable\",\n  \"enrolling\",\n]);\nexport type MachineState = z.infer<typeof MachineState>;\n\nexport const MachineKind = z.enum([\"modal\", \"selfhosted\"]);\nexport type MachineKind = z.infer<typeof MachineKind>;\n\n/**\n * A machine as the Machines dashboard renders it. The workspace's enrolled\n * selfhosted machines PLUS the session's synthetic Modal group box\n * (`isSessionGroup: true`). `active` marks the session's currently-active\n * routing target. `sharedSessionCount` is the lease refcount (how many sessions\n * share this whole machine). `metrics` is the latest sample, or null when none\n * has landed yet (just enrolled / offline before a first heartbeat).\n */\nexport const MachineView = z.object({\n  sandboxId: z.string(),\n  enrollmentId: z.string().nullable(),\n  name: z.string(),\n  kind: MachineKind,\n  state: MachineState,\n  active: z.boolean(),\n  isSessionGroup: z.boolean(),\n  os: z.string(),\n  arch: z.string(),\n  hasDisplay: z.boolean(),\n  allowScreenControl: z.boolean(),\n  sharedSessionCount: z.number().int(),\n  lastSeenAt: z.string().nullable(),\n  metrics: MetricSample.nullable(),\n});\nexport type MachineView = z.infer<typeof MachineView>;\n\n/**\n * GET /v1/workspaces/:ws/machines — the dashboard list. `activeSandboxId` /\n * `activeEpoch` echo the session's epoch-fenced active-sandbox pointer (null\n * activeSandboxId == the session's own group box is active).\n */\nexport const MachinesResponse = z.object({\n  activeSandboxId: z.string().nullable(),\n  activeEpoch: z.number().int(),\n  machines: z.array(MachineView),\n});\nexport type MachinesResponse = z.infer<typeof MachinesResponse>;\n\n/**\n * POST /v1/workspaces/:ws/sessions/:sessionId/active-sandbox — the user-\n * authenticated swap of a session's active sandbox (the same epoch-fenced\n * mechanic the M7 `sandbox_swap` MCP tool exposes to the agent). `target` is a\n * `MachinesResponse` machine's `sandboxId`, or \"session\"/\"default\" to swap back\n * to the session's own group box.\n */\nexport const SwapActiveSandboxRequest = z.object({\n  target: z.string().min(1),\n});\nexport type SwapActiveSandboxRequest = z.infer<typeof SwapActiveSandboxRequest>;\n\n/**\n * The swap outcome (mirrors the server `FleetSwapResult`). `swapped` is true on a\n * successful repoint OR a no-op (already pointed there); `reason` carries the\n * failure detail (unowned/offline target, or a lost epoch fence) when false.\n */\nexport const SwapActiveSandboxResponse = z.object({\n  swapped: z.boolean(),\n  activeSandboxId: z.string().nullable(),\n  activeEpoch: z.number().int(),\n  reason: z.string().optional(),\n});\nexport type SwapActiveSandboxResponse = z.infer<typeof SwapActiveSandboxResponse>;\n\n/**\n * GET /v1/workspaces/:ws/machines/:enrollmentId/metrics/series?window=1h — the\n * downsampled (~1/min) history the dashboard time-range reads.\n */\nexport const MachineMetricsSeriesResponse = z.object({\n  samples: z.array(MetricSample),\n});\nexport type MachineMetricsSeriesResponse = z.infer<typeof MachineMetricsSeriesResponse>;\n\n/**\n * A single host-exposed model + the provider that serves it, as surfaced to\n * clients (SDK + React composer) by GET /v1/config/client. The wire `api`\n * (\"responses\" | \"chat\") lets a client reason about provider capabilities; the\n * provider id/label drive the picker's grouping. This mirrors the runtime's\n * ConfiguredModel (packages/config) projected to the client-safe fields.\n */\nexport const ClientModel = z.object({\n  id: z.string(),\n  label: z.string(),\n  provider: z.string(),        // provider id\n  providerLabel: z.string(),\n  api: z.enum([\"responses\", \"chat\"]),\n  contextWindowTokens: z.number().int().positive().optional(),\n});\nexport type ClientModel = z.infer<typeof ClientModel>;\n\nexport const ClientConfig = z.object({\n  deploymentRevision: z.string(),\n  defaultModel: z.string(),\n  allowedModels: z.array(z.string()).min(1),\n  // Richer model list (provider-grouped) for the picker. Defaults to [] for\n  // back-compat: callers that only read allowedModels are unaffected.\n  models: z.array(ClientModel).default([]),\n  defaultReasoningEffort: ReasoningEffort,\n  allowedReasoningEfforts: z.array(ReasoningEffort).min(1),\n  mcpServers: z.array(z.object({\n    id: z.string(),\n    name: z.string(),\n  })).default([]),\n  fileUploads: z.object({\n    enabled: z.boolean(),\n    maxSizeBytes: z.number().int().positive(),\n  }),\n  productAccessMode: ProductAccessMode,\n  auth: ClientAuthConfig.default({ mode: \"none\" }),\n  // Server-wide hint: does this deployment support Channel-A structured services\n  // at all (P4.4). Per-session availability is negotiated on /stream-capabilities\n  // (it depends on the session's pinned backend); this is the coarse on/off the\n  // client uses to decide whether to even attempt the fs/git/terminal panels.\n  structuredServices: z.object({\n    fileSystem: z.boolean(),\n    git: z.boolean(),\n    terminalEvents: z.boolean(),\n  }).default({ fileSystem: false, git: false, terminalEvents: false }),\n});\nexport type ClientConfig = z.infer<typeof ClientConfig>;\n\nfunction base64UrlEncode(value: string): string {\n  return Buffer.from(value, \"utf8\").toString(\"base64url\");\n}\n\nfunction base64UrlDecode(value: string): string {\n  return Buffer.from(value, \"base64url\").toString(\"utf8\");\n}\n\nasync function hmacSha256Base64Url(secret: string, value: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    new TextEncoder().encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const signature = await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(value));\n  return Buffer.from(signature).toString(\"base64url\");\n}\n\nfunction constantTimeEqual(actual: string, expected: string): boolean {\n  const actualBytes = new TextEncoder().encode(actual);\n  const expectedBytes = new TextEncoder().encode(expected);\n  if (actualBytes.length !== expectedBytes.length) {\n    return false;\n  }\n  let diff = 0;\n  for (let index = 0; index < actualBytes.length; index += 1) {\n    diff |= actualBytes[index]! ^ expectedBytes[index]!;\n  }\n  return diff === 0;\n}\n\nexport type HealthResponse = {\n  service: string;\n  environment: string;\n  ok: boolean;\n};\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,gBAAgB,EAAE,KAAK;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQM,IAAM,iBAAiB,EAAE,KAAK;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAIM,IAAM,YAAY,EAAE,KAAK,CAAC,SAAS,SAAS,SAAS,CAAC;AAItD,IAAM,wBAAwB,EAAE,KAAK;AAAA,EAC1C;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF,CAAC;AA6CM,IAAM,sBAAsB;AAM5B,IAAM,uBAAuB;AAM7B,IAAM,yBAAuE;AAAA,EAClF,OAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,gBAAgB,KAAK,KAAK,KAAK;AAAA,MAC/B,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,aAAa,gBAAgB,KAAK;AAAA,IACpD,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,MAAM;AAAA;AAAA,IACtE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,SAAS;AAAA,IACP,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,sBAAsB,gBAAgB,KAAK;AAAA,IAC7D,cAAc,EAAE,MAAM,eAAe,uBAAuB,MAAM;AAAA,IAClE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,SAAS;AAAA,IACP,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA,MACjE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,sBAAsB,gBAAgB,KAAK;AAAA,IAC7D,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,MAAM;AAAA;AAAA,IACtE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,KAAK;AAAA,IACH,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA;AAAA,MACjE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,sBAAsB,gBAAgB,KAAK;AAAA,IAC7D,cAAc,EAAE,MAAM,eAAe,uBAAuB,MAAM;AAAA,IAClE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA;AAAA,MACjE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,YAAY,gBAAgB,KAAK;AAAA,IACnD,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,KAAK;AAAA;AAAA,IACrE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,YAAY;AAAA,IACV,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,YAAY,gBAAgB,KAAK;AAAA,IACnD,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,MAAM;AAAA,IACtE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA,MACjE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,gBAAgB,IAAI,KAAK,KAAK;AAAA,MAC9B,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,YAAY,gBAAgB,KAAK;AAAA,IACnD,cAAc,EAAE,MAAM,eAAe,uBAAuB,MAAM;AAAA,IAClE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,cAAc,gBAAgB,KAAK;AAAA,IACrD,cAAc,EAAE,MAAM,cAAc,uBAAuB,MAAM;AAAA,IACjE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,OAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA,IAGT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,cAAc,gBAAgB,KAAK;AAAA,IACrD,cAAc,EAAE,MAAM,cAAc,uBAAuB,MAAM;AAAA,IACjE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,MAAM;AAAA,IACJ,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,OAAO,UAAU,KAAK;AAAA,MAC/C,UAAU,EAAE,WAAW,OAAO,WAAW,MAAM,KAAK,MAAM;AAAA,MAC1D,KAAK,EAAE,WAAW,MAAM;AAAA,MACxB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,QAAQ,gBAAgB,MAAM;AAAA,IAChD,cAAc,EAAE,MAAM,QAAQ,uBAAuB,MAAM;AAAA,IAC3D,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,YAAY;AAAA,IACV,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,SAAS,SAAS,SAAS,GAAG,SAAS,QAAQ;AAAA,IACjE,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,UAAU,KAAK,KAAK;AAAA;AAAA,MAC5D,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,MAKR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA;AAAA,IACpB;AAAA;AAAA;AAAA;AAAA,IAIA,UAAU,EAAE,MAAM,QAAQ,gBAAgB,MAAM;AAAA,IAChD,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,KAAK;AAAA,IACrE,eAAe;AAAA;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AACF;AAEO,IAAM,kBAAkB,EAAE,KAAK,CAAC,QAAQ,WAAW,OAAO,UAAU,QAAQ,OAAO,CAAC;AAGpF,IAAM,YAAY,EAAE,KAAK;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,OAAO,EAAE,OAAO;AAAA,IACd,MAAM;AAAA,IACN,SAAS,EAAE,OAAO;AAAA,IAClB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACtD,CAAC;AACH,CAAC;AAGM,IAAM,WAAW,EAAE,OAAO;AAAA,EAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,SAAS,EAAE,QAAQ;AACrB,CAAC;AAGM,SAAS,UAAkC,MAAS;AACzD,SAAO,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,MAAM,IAAI;AAAA,IAClB,MAAM;AAAA,EACR,CAAC;AACH;AAEO,IAAM,aAAa,EAAE,KAAK;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,oBAAoB,EAAE,KAAK,CAAC,SAAS,cAAc,SAAS,CAAC;AAGnE,IAAM,cAAc,EAAE,KAAK,CAAC,YAAY,QAAQ,CAAC;AAGjD,IAAM,mBAAmB,EAAE,KAAK,CAAC,QAAQ,UAAU,SAAS,CAAC;AAG7D,IAAM,kBAAkB,EAAE,KAAK,CAAC,QAAQ,UAAU,SAAS,CAAC;AAG5D,IAAM,cAAc,EAAE,KAAK,CAAC,SAAS,SAAS,QAAQ,CAAC;AAGvD,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,YAAY,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,eAAe,EAAE,OAAO;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,MAAM,YAAY,SAAS;AAAA,EAC3B,aAAa,EAAE,MAAM,UAAU;AAAA,EAC/B,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AACvD,CAAC;AAGM,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,aAAa,EAAE,MAAM,UAAU;AAAA,EAC/B,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AACvD,CAAC;AAGM,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,MAAM;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,eAAe,EAAE,MAAM,YAAY;AAAA,EACnC,iBAAiB,EAAE,MAAM,WAAW;AAAA,EACpC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACjD,CAAC;AAGM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,aAAa,EAAE,MAAM,UAAU,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,EAGtC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,yBAAyB,QAAgB,SAAuD;AACpH,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,4BAA4B,MAAM,OAAO,CAAC,CAAC;AACjG,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,OAAO,cAAc,IAAI,SAAS;AAC3C;AAEA,eAAsB,2BAA2B,QAAgB,OAAe,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAgD;AACvK,MAAI,CAAC,MAAM,WAAW,MAAM,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,OAAO,MAAM;AAC/C,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,QAAM,UAAU,4BAA4B,UAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC,CAAC;AACjG,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAaO,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE9B,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,qBAAqB,QAAgB,SAAmD;AAC5G,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,wBAAwB,MAAM,OAAO,CAAC,CAAC;AAC7F,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,OAAO,cAAc,IAAI,SAAS;AAC3C;AAEA,eAAsB,uBAAuB,QAAgB,OAAe,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAA4C;AAC/J,MAAI,CAAC,MAAM,WAAW,MAAM,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,OAAO,MAAM;AAC/C,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,QAAM,UAAU,wBAAwB,UAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC,CAAC;AAC7F,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAgBO,IAAM,qBAAqB,EAAE,OAAO;AAAA;AAAA;AAAA,EAGzC,KAAK,EAAE,QAAQ,QAAQ;AAAA,EACvB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA,EAG3B,oBAAoB,EAAE,QAAQ;AAAA,EAC9B,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAClC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,gBAAgB,QAAgB,SAA8C;AAClG,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,mBAAmB,MAAM,OAAO,CAAC,CAAC;AACxF,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,QAAQ,cAAc,IAAI,SAAS;AAC5C;AAUA,eAAsB,kBAAkB,QAAgB,OAAe,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAuC;AACrJ,MAAI,CAAC,MAAM,WAAW,OAAO,GAAG;AAC9B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,QAAQ,MAAM;AAChD,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,mBAAmB,UAAU,OAAO;AACpD,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAmBO,IAAM,qBAAqB,EAAE,OAAO;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE3B,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE1B,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EAEzC,MAAM,EAAE,KAAK,CAAC,QAAQ,SAAS,CAAC;AAAA;AAAA,EAEhC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAGhC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,gBAAgB,QAAgB,SAA8C;AAClG,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,mBAAmB,MAAM,OAAO,CAAC,CAAC;AACxF,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,OAAO,cAAc,IAAI,SAAS;AAC3C;AAYA,eAAsB,kBAAkB,QAAgB,OAAe,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAuC;AACrJ,MAAI,CAAC,MAAM,WAAW,MAAM,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,OAAO,MAAM;AAC/C,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,mBAAmB,UAAU,OAAO;AACpD,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAyBO,IAAM,oBAAoB,EAAE,OAAO;AAAA;AAAA;AAAA,EAGxC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE7B,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAEzB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,eAAe,QAAgB,SAA6C;AAChG,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,kBAAkB,MAAM,OAAO,CAAC,CAAC;AACvF,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,OAAO,cAAc,IAAI,SAAS;AAC3C;AAWA,eAAsB,iBAAiB,QAAgB,OAAe,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAsC;AACnJ,MAAI,CAAC,MAAM,WAAW,MAAM,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,OAAO,MAAM;AAC/C,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,kBAAkB,UAAU,OAAO;AACnD,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAEO,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAC3D,CAAC;AAGM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAG5C,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAC3D,CAAC;AAGM,IAAM,SAAS,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,MAAM,EAAE,OAAO;AAAA,EACf,QAAQ,EAAE,OAAO;AAAA,EACjB,aAAa,EAAE,MAAM,UAAU;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,aAAa,EAAE,MAAM,UAAU,EAAE,IAAI,CAAC;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC;AAGM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,QAAQ;AAAA,EACR,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AACzB,CAAC;AAMM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,MAAM,EAAE,OAAO;AAAA,EACf,aAAa,EAAE,MAAM,UAAU;AAAA,EAC/B,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,SAAS,EAAE,MAAM,eAAe;AAClC,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA;AAAA;AAAA,EAGhD,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,aAAa,EAAE,MAAM,UAAU;AACjC,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,aAAa,EAAE,MAAM,UAAU;AACjC,CAAC;AAGM,IAAM,iBAAiB,EAAE,KAAK;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA;AAAA,EAEA;AACF,CAAC;AAGM,IAAM,aAAa,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW;AAAA,EACX,UAAU,EAAE,OAAO;AAAA,EACnB,MAAM,EAAE,OAAO;AAAA,EACf,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,gBAAgB,EAAE,OAAO;AAAA,EACzB,YAAY,EAAE,OAAO;AAAA,EACrB,YAAY,EAAE,OAAO;AAAA,EACrB,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAC9C,CAAC;AAGM,IAAM,cAAc,EAAE,KAAK;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,yBAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9D,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7D,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACzD,iCAAiC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACtE,8BAA8B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,gCAAgC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACrE,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC7E,CAAC;AAGM,IAAM,mBAAmB,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,EAAE,OAAO,GAAG,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAG3F,IAAM,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,gBAAgB;AAGjE,IAAM,gBAAgB,EAAE,mBAAmB,WAAW;AAAA,EAC3D,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;AAAA,EACrC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,GAAG,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC;AAC/E,CAAC;AAsBM,IAAM,sBAAsB,EAAE,mBAAmB,WAAW;AAAA,EACjE,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI,GAAG,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAAA,EACtE,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,GAAG,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC1H,CAAC;AA+HM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,eAAe,EAAE,OAAO,EAAE,IAAI;AAAA,EAC9B,UAAU,EAAE,QAAQ,KAAK;AAAA,EACzB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAM,EAAE;AAAA,IACvC,CAAC,UAAU,OAAO,SAAS,KAAK,KAAK,KAAK,IAAI,QAAQ,KAAK,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI;AAAA,IACvF,EAAE,SAAS,oCAAoC;AAAA,EACjD;AAAA,EACA,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACvC,CAAC;AAGM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,mBAAmB,EAAE,OAAO;AAAA,EAC5B,KAAK,EAAE,OAAO,EAAE,IAAI;AACtB,CAAC;AAGM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,MAAM,EAAE,QAAQ,YAAY;AAAA,EAC5B,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACpC,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3D,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC3D,CAAC;AAGM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,QAAQ,MAAM;AAAA,EACtB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACxC,CAAC;AAGM,IAAM,cAAc,EAAE,mBAAmB,QAAQ,CAAC,uBAAuB,eAAe,CAAC;AAGzF,IAAM,aAAa,EAAE,KAAK,CAAC,kBAAkB,SAAS,UAAU,WAAW,SAAS,CAAC;AAGrF,IAAM,mBAAmB,EAAE,KAAK,CAAC,WAAW,aAAa,WAAW,QAAQ,CAAC;AAG7E,IAAM,YAAY,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ;AAAA,EACR,UAAU,EAAE,OAAO;AAAA,EACnB,cAAc,EAAE,OAAO;AAAA,EACvB,aAAa,EAAE,OAAO;AAAA,EACtB,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,QAAQ,EAAE,OAAO;AAAA,EACjB,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACrC,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,EACvB,iBAAiB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAAA,EAChD,WAAW,EAAE,OAAO;AAAA,EACpB,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC1C,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,MAAM;AACR,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,KAAK,EAAE,OAAO,EAAE,IAAI;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,iBAAiB,EAAE,KAAK,CAAC,UAAU,YAAY,SAAS,QAAQ,CAAC;AAGvE,IAAM,eAAe,EAAE,OAAO;AAAA,EACnC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAM,EAAE,OAAO;AAAA,EACf,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,WAAW,EAAE,OAAO;AAAA,EAC/B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ;AAAA,EACR,OAAO,EAAE,OAAO;AAAA,EAChB,QAAQ,EAAE,OAAO;AAAA,EACjB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO;AAAA,EAChB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAC5C,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAGM,IAAM,qBAAqB,EAAE,OAAO;AAAA,EACzC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAC1B,CAAC;AAGM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AACtD,CAAC;AAGM,IAAM,UAAU,EAAE,OAAO;AAAA,EAC9B,MAAM,EAAE,QAAQ,KAAK;AAAA,EACrB,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOpB,UAAU,EAAE,QAAQ,EAAE,SAAS;AACjC,CAAC;AAGD,IAAM,aAAa;AACnB,IAAM,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU;AAClD,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE,aAAa;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF,GAAG,EAAE,SAAS,qBAAqB,CAAC;AAE7B,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,UAAU;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,KAAK;AAAA,EACL,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAClD,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,gBAAgB,EAAE,QAAQ,EAAE,SAAS;AAAA;AAAA;AAAA,EAGrC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS;AACrD,CAAC;AAGM,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,UAAU;AAAA,EACtC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAC1C,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,UAAU;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,KAAK;AAAA,EACL,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3C,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC/C,CAAC,EAAE,OAAO;AAGH,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,cAAc,UAAqB,WAAiC;AAClF,QAAM,QAAQ,oBAAI,IAAqB;AACvC,QAAM,QAAkB,CAAC;AACzB,aAAW,QAAQ,CAAC,GAAG,UAAU,GAAG,SAAS,GAAG;AAC9C,UAAM,MAAM,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE;AACnC,UAAM,QAAQ,MAAM,IAAI,GAAG;AAC3B,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,KAAK,IAAI;AACnB,YAAM,KAAK,GAAG;AACd;AAAA,IACF;AAKA,QAAI,MAAM,aAAa,QAAQ,KAAK,aAAa,MAAM;AACrD,YAAM,EAAE,UAAU,UAAU,GAAG,OAAO,IAAI;AAC1C,YAAM,IAAI,KAAK,MAAM;AAAA,IACvB;AAAA,EACF;AACA,SAAO,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,GAAG,CAAE;AAC3C;AAEO,SAAS,kBACd,UACA,WACA,UAAyC,CAAC,GAC3B;AACf,QAAM,MAAM,CAAC,GAAG,QAAQ;AACxB,QAAM,aAAa,IAAI,IAAI,SAAS,QAAQ,CAAC,aAAa,SAAS,YAAY,CAAC,CAAC,SAAS,WAAW,WAAW,QAAQ,CAAC,CAAU,IAAI,CAAC,CAAC,CAAC;AAC1I,QAAM,aAAa,IAAI,IAAI,SAAS,IAAI,CAAC,aAAa,CAAC,oBAAoB,QAAQ,GAAG,WAAW,QAAQ,CAAC,CAAU,CAAC;AACrH,QAAM,QAAQ,IAAI,IAAI,SAAS,IAAI,UAAU,CAAC;AAE9C,aAAW,YAAY,WAAW;AAChC,UAAM,aAAa,WAAW,QAAQ;AACtC,QAAI,MAAM,IAAI,UAAU,GAAG;AACzB;AAAA,IACF;AACA,QAAI,QAAQ,iBAAiB;AAC3B,YAAM,kBAAkB,SAAS,YAAY,WAAW,IAAI,SAAS,SAAS,IAAI;AAClF,UAAI,mBAAmB,oBAAoB,YAAY;AACrD,cAAM,IAAI,yBAAyB,4CAA4C,SAAS,SAAS,EAAE;AAAA,MACrG;AACA,YAAM,WAAW,oBAAoB,QAAQ;AAC7C,YAAM,mBAAmB,WAAW,IAAI,QAAQ;AAChD,UAAI,oBAAoB,qBAAqB,YAAY;AACvD,cAAM,IAAI,yBAAyB,yDAAyD,QAAQ,EAAE;AAAA,MACxG;AAAA,IACF;AACA,QAAI,KAAK,QAAQ;AACjB,UAAM,IAAI,UAAU;AACpB,eAAW,IAAI,oBAAoB,QAAQ,GAAG,UAAU;AACxD,QAAI,SAAS,WAAW;AACtB,iBAAW,IAAI,SAAS,WAAW,UAAU;AAAA,IAC/C;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,2BAA2B,UAAmC,UAA4C;AACxH,QAAM,QAAQ,SAAS;AACvB,SAAO,UAAU,UAAU,UAAU,aAAa,UAAU,SAAS,UAAU,YAAY,UAAU,UAAU,UAAU,UACrH,QACA;AACN;AAEO,SAAS,WAAW,OAAwB;AACjD,SAAO,KAAK,UAAU,SAAS,KAAK,CAAC;AACvC;AAEO,SAAS,oBAAoB,UAA+B;AACjE,MAAI,SAAS,SAAS,QAAQ;AAC5B,WAAO,QAAQ,SAAS,MAAM;AAAA,EAChC;AACA,SAAO,cAAc,SAAS,GAAG;AACnC;AAEA,SAAS,SAAS,OAAyB;AACzC,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,QAAQ;AAAA,EAC3B;AACA,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,MAAM,MAAM,CAAC,KAAK,SAAS,MAAM,CAAC,CAAC,CAAC;AAAA,EACxI;AACA,SAAO;AACT;AAEO,IAAM,oBAAoB,EAAE,KAAK,CAAC,UAAU,WAAW,mBAAmB,aAAa,UAAU,WAAW,CAAC;AAG7G,IAAM,oBAAoB,EAAE,KAAK,CAAC,QAAQ,kBAAkB,OAAO,MAAM,CAAC;AAG1E,IAAM,oBAAoB,EAAE,KAAK,CAAC,UAAU,UAAU,WAAW,CAAC;AAGlE,IAAM,uBAAuB,EAAE,KAAK,CAAC,OAAO,SAAS,gBAAgB,CAAC;AAGtE,IAAM,0BAA0B,EAAE,KAAK;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ;AAAA,EACR,MAAM,EAAE,OAAO;AAAA,EACf,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW;AAAA,EACX,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAChD,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC/C,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3D,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,WAAW,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC5C,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC7D,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,QAAQ,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACxC,CAAC;AAGM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClC,CAAC;AAYM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,SAAS,EAAE,QAAQ,IAAI;AACzB,CAAC;AAYM,IAAM,2BAA2B;AAGjC,IAAM,yBAAyB,KAAK,UAAU,EAAE,CAAC,wBAAwB,GAAG,KAAK,CAAC;AAUlF,SAAS,sBAAsB,YAAgD;AACpF,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,UAAU;AACpC,WAAO,OAAO,WAAW,YACpB,WAAW,QACV,OAAmC,wBAAwB,MAAM;AAAA,EACzE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,IAAM,+BAA+B,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO;AAIzD,IAAM,8BAA8B,EAAE,OAAO;AAAA;AAAA;AAAA,EAGlD,QAAQ,EAAE,KAAK,CAAC,UAAU,MAAM,CAAC;AAAA,EACjC,SAAS,EAAE,OAAO;AACpB,CAAC;AAGM,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,oBAAoB,EAAE,OAAO;AAAA,EAC7B,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,WAAW,EAAE,MAAM,WAAW;AAAA,EAC9B,OAAO,EAAE,MAAM,OAAO;AAAA,EACtB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,iBAAiB;AAAA,EACjB,gBAAgB;AAAA;AAAA,EAEhB,WAAW,UAAU,SAAS;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnC,WAAW,EAAE,MAAM,WAAW,EAAE,SAAS;AAAA,EACzC,OAAO,EAAE,MAAM,OAAO,EAAE,SAAS;AAAA,EACjC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,iBAAiB,gBAAgB,SAAS;AAAA,EAC1C,gBAAgB,eAAe,SAAS;AAAA,EACxC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AACvD,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;AAC3C,CAAC;AAGM,IAAM,mCAAmC,EAAE,OAAO,EAAE,MAAM,mBAAmB,EAAE,IAAI,GAAG;AAMtF,IAAM,uCAAuC,EAAE,OAAO;AAAA,EAC3D,MAAM;AAAA,EACN,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAM,EAAE,OAAO;AAAA,EACf,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,MAAM,oCAAoC;AAAA,EACvD,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC3C,WAAW,EAAE,MAAM,EAAE,OAAO;AAAA,IAC1B,MAAM;AAAA,IACN,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK;AAAA,EACpC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAChB,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,SAAS;AACxD,CAAC;AAGM,IAAM,yCAAyC,EAAE,OAAO;AAAA,EAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK;AACpC,CAAC;AAGM,IAAM,sBAAsB,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAGvD,IAAM,yBAAyB,EAAE,KAAK,CAAC,UAAU,cAAc,QAAQ,CAAC;AAGxE,IAAM,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,kBAAkB,CAAC;AAG/E,IAAM,6BAA6B,EAAE,KAAK,CAAC,oBAAoB,QAAQ,YAAY,CAAC;AAGpF,IAAM,2BAA2B,EAAE,KAAK,CAAC,aAAa,QAAQ,CAAC;AAG/D,IAAM,4BAA4B,EAAE,mBAAmB,QAAQ;AAAA,EACpE,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,MAAM;AAAA,IACtB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,IAC3C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,KAAK;AAAA,EAC3C,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,UAAU;AAAA,IAC1B,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACxC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,IACxD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EACxD,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,UAAU;AAAA,IAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,KAAK;AAAA,IACzC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,IACpC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,IACtC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,UAAU,WAAW,aAAa,YAAY,UAAU,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC9H,CAAC;AACH,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,WAAW,EAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC1C,OAAO,EAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,iBAAiB,gBAAgB,SAAS;AAAA,EAC1C,gBAAgB,eAAe,SAAS;AAAA,EACxC,MAAM,SAAS,SAAS;AAC1B,CAAC;AAGM,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAM,EAAE,OAAO;AAAA,EACf,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,oBAAoB,EAAE,OAAO;AAAA,EAC7B,SAAS;AAAA,EACT,eAAe;AAAA,EACf,aAAa;AAAA,EACb,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC9C,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,SAAS,EAAE,OAAO;AAAA,EAClB,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,UAAU;AAAA,EACV,SAAS,qBAAqB,QAAQ,qBAAqB;AAAA,EAC3D,eAAe,2BAA2B,QAAQ,kBAAkB;AAAA,EACpE,aAAa;AAAA,EACb,QAAQ,oBAAoB,QAAQ,QAAQ;AAAA,EAC5C,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,UAAU,0BAA0B,SAAS;AAAA,EAC7C,SAAS,qBAAqB,SAAS;AAAA,EACvC,eAAe,2BAA2B,SAAS;AAAA,EACnD,aAAa,yBAAyB,SAAS;AAAA,EAC/C,QAAQ,oBAAoB,SAAS;AAAA,EACrC,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AACvD,CAAC;AAQM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACjD,CAAC;AAGM,IAAM,mCAAmC,EAAE,KAAK;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,WAAW;AAAA,EACX,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAChD,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC7C,UAAU,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,MAAM,EAAE,QAAQ,eAAe;AAAA,EAC/B,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC/C,UAAU,EAAE,QAAQ,EAAE,QAAQ,KAAK;AACrC,CAAC;AAGM,IAAM,sCAAsC,EAAE,OAAO;AAAA,EAC1D,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,iBAAiB;AAAA,EACjB,gBAAgB,qBAAqB,QAAQ,qBAAqB;AAAA,EAClE,sBAAsB,2BAA2B,QAAQ,MAAM;AAAA;AAAA;AAAA,EAG/D,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACrC,CAAC;AAQM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,OAAO,6BAA6B;AAAA,IACnE,SAAS;AAAA,EACX,CAAC;AAAA,EACD,SAAS,EAAE,OAAO,EAAE,IAAI,MAAM,IAAI;AACpC,CAAC;AAMM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,gCAAgC;AAAA,IACpE,SAAS;AAAA,EACX,CAAC;AAAA,EACD,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAClD,OAAO,EAAE,MAAM,uBAAuB,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AACvD,CAAC,EAAE,YAAY,CAAC,OAAO,QAAQ;AAC7B,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAM,QAAQ,CAAC,MAAM,UAAU;AACnC,QAAI,KAAK,IAAI,KAAK,IAAI,GAAG;AACvB,UAAI,SAAS,EAAE,MAAM,UAAU,SAAS,8BAA8B,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,OAAO,MAAM,EAAE,CAAC;AAAA,IACrH;AACA,SAAK,IAAI,KAAK,IAAI;AAAA,EACpB,CAAC;AACD,MAAI,CAAC,MAAM,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,UAAU,GAAG;AACzD,QAAI,SAAS,EAAE,MAAM,UAAU,SAAS,gDAAgD,MAAM,CAAC,OAAO,EAAE,CAAC;AAAA,EAC3G;AACF,CAAC;AAGD,SAAS,4BAA4B,MAAuB;AAC1D,MAAI,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,IAAI,GAAG;AAC/C,WAAO;AAAA,EACT;AACA,SAAO,KAAK,MAAM,GAAG,EAAE,MAAM,CAAC,YAAY,QAAQ,SAAS,KAAK,YAAY,OAAO,YAAY,IAAI;AACrG;AAEO,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,EAIzB,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEzD,QAAQ,EAAE,MAAM,mBAAmB,EAAE,IAAI,EAAE,EAAE,YAAY,CAAC,QAAQ,QAAQ;AACxE,UAAM,OAAO,oBAAI,IAAY;AAC7B,WAAO,QAAQ,CAAC,OAAO,UAAU;AAC/B,YAAM,MAAM,MAAM,KAAK,YAAY;AACnC,UAAI,KAAK,IAAI,GAAG,GAAG;AACjB,YAAI,SAAS,EAAE,MAAM,UAAU,SAAS,8BAA8B,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,MAAM,EAAE,CAAC;AAAA,MAC7G;AACA,WAAK,IAAI,GAAG;AAAA,IACd,CAAC;AAAA,EACH,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACb,OAAO,EAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClC,YAAY,EAAE,MAAM,uBAAuB,EAAE,QAAQ,CAAC,CAAC;AAAA,EACvD,WAAW,EAAE,MAAM,uBAAuB,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,wBAAwB,EAAE,MAAM,mCAAmC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC/E,aAAa,EAAE,OAAO;AAAA,IACpB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC7B,mBAAmB,EAAE,MAAM,gCAAgC,EAAE,QAAQ,CAAC,CAAC;AAAA,IACvE,UAAU,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACrC,CAAC,EAAE,SAAS;AAAA,EACZ,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAKM,IAAM,gCAAgC;AAGtC,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAM;AAAA,EACN,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,yBAAyB,EAAE,KAAK,CAAC,UAAU,UAAU,CAAC;AAG5D,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,QAAQ;AAAA,EACR,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,iBAAiB,EAAE,KAAK;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,yBAAyB,EAAE,KAAK,CAAC,aAAa,gBAAgB,UAAU,CAAC;AAG/E,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,UAAU;AAAA,EACV,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,QAAQ;AAAA,EACR,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC1B,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC/C,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,UAAU;AAAA,EACV,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC9C,QAAQ,uBAAuB,QAAQ,WAAW;AAAA,EAClD,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC7C,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC1C,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3D,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,aAAa,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,UAAU;AAAA,EACV,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,MAAM,EAAE,OAAO;AAAA,EACf,aAAa,EAAE,OAAO;AAAA,EACtB,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAAA,EACxC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EACrC,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACpD,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACpD,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,KAAK;AAAA,EACzC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EACjD,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC/C,QAAQ,oBAAoB,QAAQ,QAAQ;AAAA,EAC5C,SAAS,qBAAqB,QAAQ,qBAAqB;AAAA,EAC3D,eAAe,2BAA2B,QAAQ,MAAM;AAC1D,CAAC;AAGM,IAAM,iBAAiB,EAAE,KAAK,CAAC,QAAQ,OAAO,OAAO,SAAS,QAAQ,CAAC;AAGvE,IAAM,mBAAmB,EAAE,KAAK,CAAC,YAAY,cAAc,mBAAmB,QAAQ,CAAC;AAGvF,IAAM,+BAA+B,EAAE,KAAK,CAAC,UAAU,UAAU,CAAC;AAGlE,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,WAAW,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAC3C,CAAC;AAGM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC/C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC5C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3C,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACrD,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACrD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACpD,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACpD,OAAO,EAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClC,SAAS,kBAAkB,QAAQ,EAAE,WAAW,OAAO,OAAO,KAAK,CAAC;AAAA,EACpE,SAAS,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAClC,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACjD,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,qCAAqC,EAAE,OAAO;AAAA,EACzD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC/B,MAAM,eAAe,QAAQ,CAAC,MAAM,CAAC;AAAA,EACrC,QAAQ,iBAAiB,QAAQ,QAAQ;AAAA,EACzC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC5C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3C,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACpD,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtD,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOpD,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC5C,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,OAAO,EAAE,MAAM,qBAAqB;AAAA,EACpC,eAAe,EAAE,MAAM,sBAAsB;AAC/C,CAAC;AAGM,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,OAAO,EAAE,MAAM,qBAAqB;AAAA,EACpC,QAAQ,EAAE,QAAQ,uBAAuB;AAAA,EACzC,WAAW,EAAE,OAAO,EAAE,IAAI;AAC5B,CAAC;AAGM,IAAM,UAAU,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ;AAAA,EACR,gBAAgB,EAAE,OAAO;AAAA,EACzB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,aAAa,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIhD,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW,EAAE,MAAM,WAAW;AAAA,EAC9B,OAAO,EAAE,MAAM,OAAO;AAAA,EACtB,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,OAAO,EAAE,OAAO;AAAA,EAChB,gBAAgB;AAAA;AAAA,EAEhB,WAAW;AAAA;AAAA;AAAA;AAAA,EAIX,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1C,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA,EAG1C,0BAA0B,EAAE,MAAM,UAAU,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvD,YAAY,EAAE,MAAM,wBAAwB,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI5C,sBAAsB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1C,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIzC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACzD,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3C,yBAAyB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACpD,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAClD,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,mBAAmB,EAAE,KAAK;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AACF,CAAC;AAQM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,KAAK,EAAE,OAAO,EAAE,IAAI;AAAA,EACpB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI1C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,WAAW,EAAE,QAAQ,QAAQ;AAAA;AAAA,EAE7B,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AACrD,CAAC;AAGM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,QAAQ,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC5C,CAAC;AAGM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,QAAQ,EAAE,KAAK,CAAC,qBAAqB,UAAU,WAAW,cAAc,CAAC;AAAA,EACzE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC5C,CAAC;AAGM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACnD,QAAQ,EAAE,KAAK,CAAC,iBAAiB,kBAAkB,OAAO,CAAC;AAC7D,CAAC;AAQM,IAAM,gBAAgB,EAAE,KAAK,CAAC,UAAU,WAAW,WAAW,CAAC;AAE/D,IAAM,iBAAiB,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC;AAEtD,IAAM,uBAAuB,EAAE,KAAK,CAAC,aAAa,YAAY,CAAC;AAG/D,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,MAAM;AAAA,EACN,OAAO;AAAA,EACP,YAAY,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAAA,EAC9E,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrC,WAAW,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA,EAGpB,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AACzC,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,OAAO;AAAA,EACP,aAAa;AAAA;AAAA;AAAA,EAGb,YAAY,EAAE,OAAO;AAAA,EACrB,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,EACnD,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,YAAY,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAChF,CAAC;AAKM,IAAM,wBAAwB,EAAE,KAAK;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,QAAQ;AAAA;AAAA;AAAA,EAGR,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AACzC,CAAC;AAcM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,QAAQ,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA,EACrD,OAAO,EAAE,OAAO;AAAA;AAAA,EAChB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC/B,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAC/C,CAAC;AAGM,IAAM,eAAe,EAAE,KAAK,CAAC,WAAW,YAAY,WAAW,SAAS,CAAC;AAEzE,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,SAAS,EAAE,MAAM,EAAE,OAAO;AAAA,IACxB,MAAM,EAAE,OAAO;AAAA;AAAA,IACf,MAAM;AAAA,IACN,OAAO,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,IAChC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,IACjE,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC/B,CAAC,CAAC,EAAE,IAAI,CAAC;AAAA,EACT,QAAQ,EAAE,KAAK,CAAC,SAAS,SAAS,OAAO,CAAC,EAAE,QAAQ,OAAO;AAAA;AAAA,EAE3D,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA;AAAA;AAAA,EAIvC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AACtD,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC1B,OAAO,EAAE,QAAQ;AAAA;AAAA,EACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAChD,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC/C,QAAQ,EAAE,KAAK,CAAC,UAAU,YAAY,SAAS,YAAY,SAAS,SAAS,CAAC,EAAE,QAAQ,SAAS;AAAA,EACjG,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAClD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AACtD,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACvB,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,OAAO,EAAE,OAAO;AAAA;AAAA,EAChB,KAAK,EAAE,OAAO;AAChB,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACvB,QAAQ,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA,EACrD,OAAO,EAAE,OAAO;AAAA;AAAA,EAChB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AACpC,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACvB,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ,UAAU,cAAc,SAAS,CAAC;AAC5D,CAAC;AAIM,IAAM,aAAa,EAAE,KAAK,CAAC,QAAQ,OAAO,WAAW,OAAO,CAAC;AAc7D,IAAM,aAAoC,EAAE,KAAK,MAAM,EAAE,OAAO;AAAA,EACrE,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO;AAAA,EACf,MAAM;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACnD,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACjD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,MAAM,UAAU,EAAE,SAAS;AAAA,EACvC,WAAW,EAAE,QAAQ,EAAE,QAAQ,KAAK;AACtC,CAAC,CAAC;AAEK,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA,EAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAK;AAAA,EACjE,eAAe,EAAE,QAAQ,EAAE,QAAQ,IAAI;AACzC,CAAC;AAEM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,WAAW,EAAE,QAAQ;AAAA;AACvB,CAAC;AAGM,IAAM,aAAa,EAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;AAE5C,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,WAAW,QAAQ,MAAM;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,OAAO,IAAI,EAAE,QAAQ,IAAI,OAAO,IAAI;AACrF,CAAC;AAEM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM,EAAE,OAAO;AAAA,EACf,UAAU;AAAA,EACV,SAAS,EAAE,OAAO;AAAA;AAAA,EAClB,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EACxC,WAAW,EAAE,QAAQ;AAAA;AAAA,EACrB,UAAU,EAAE,QAAQ;AAAA;AAAA,EACpB,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAGM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,WAAW,QAAQ,MAAM;AAAA,EACnC,SAAS,EAAE,OAAO;AAAA,EAClB,WAAW,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EACnC,eAAe,EAAE,QAAQ,EAAE,QAAQ,IAAI;AACzC,CAAC;AAEM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AACzC,CAAC;AAGM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AACtC,CAAC;AAEM,IAAM,mBAAmB,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAG9E,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,OAAO;AAAA,EACf,SAAS,EAAE,OAAO;AAAA,EAClB,WAAW,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EACpC,eAAe,EAAE,QAAQ,EAAE,QAAQ,IAAI;AACzC,CAAC;AAEM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM,EAAE,OAAO;AAAA,EACf,SAAS,EAAE,OAAO;AAAA,EAClB,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AACzC,CAAC;AAGM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AACrC,CAAC;AAEM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AACzC,CAAC;AAIM,IAAM,oBAAoB,EAAE,KAAK;AAAA,EACtC;AAAA,EAAS;AAAA,EAAY;AAAA,EAAW;AAAA,EAAW;AAAA,EAAU;AAAA,EAAa;AAAA,EAAW;AAAA,EAAc;AAC7F,CAAC;AAEM,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,OAAO;AAAA,EACf,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC7B,OAAO,kBAAkB,SAAS;AAAA;AAAA,EAClC,UAAU,kBAAkB,SAAS;AAAA;AAAA,EACrC,cAAc,EAAE,QAAQ,EAAE,QAAQ,KAAK;AACzC,CAAC;AAEM,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAC7B,CAAC;AAEM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,QAAQ,EAAE,QAAQ;AAAA,EAClB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC1B,UAAU,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAChD,OAAO,EAAE,MAAM,aAAa;AAAA,EAC5B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAIM,IAAM,kBAAkB,EAAE,KAAK,CAAC,WAAW,OAAO,OAAO,MAAM,CAAC;AAEhE,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,MAAM;AAAA;AAAA,EAEN,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,MAAM,EAAE,OAAO;AAAA;AACjB,CAAC;AAEM,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,QAAQ,EAAE,OAAO;AAAA;AAAA,EACjB,OAAO,EAAE,MAAM,WAAW;AAC5B,CAAC;AAEM,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,MAAM,EAAE,OAAO;AAAA,EACf,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,QAAQ;AAAA,EACR,UAAU,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACnC,SAAS,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,OAAO,EAAE,MAAM,WAAW;AAAA;AAAA,EAC1B,WAAW,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AACtC,CAAC;AAEM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA,EAE3B,QAAQ,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EACjC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACxC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EACvD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,OAAO,IAAI,EAAE,QAAQ,MAAM,IAAI;AACtF,CAAC;AAEM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,MAAM,WAAW;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAGM,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC3B,KAAK,EAAE,OAAO,EAAE,QAAQ,MAAM;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAK,EAAE,QAAQ,GAAG;AAAA,EAC5D,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC9C,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAEM,IAAM,YAAY,EAAE,OAAO;AAAA,EAChC,KAAK,EAAE,OAAO;AAAA,EACd,UAAU,EAAE,OAAO;AAAA,EACnB,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAAA,EACrF,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAAA,EACxF,SAAS,EAAE,OAAO;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AACtC,CAAC;AAEM,IAAM,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,GAAG,SAAS,EAAE,QAAQ,EAAE,CAAC;AAGrF,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC3B,KAAK,EAAE,OAAO;AAAA;AAAA,EACd,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC9B,UAAU,WAAW,QAAQ,MAAM;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,OAAO,IAAI,EAAE,QAAQ,MAAM,IAAI;AACtF,CAAC;AAEM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,QAAQ,UAAU,SAAS;AAAA;AAAA,EAC3B,OAAO,EAAE,MAAM,WAAW;AAAA;AAAA,EAC1B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,UAAU,YAAY,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS;AAAA,EAC5H,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAQM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA,EAE1B,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAO,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA,EAGlE,YAAY,EAAE,QAAQ,EAAE,QAAQ,IAAI;AACtC,CAAC;AAEM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,QAAQ,EAAE,OAAO;AAAA,EACjB,QAAQ,EAAE,OAAO;AAAA,EACjB,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAGpC,SAAS,EAAE,QAAQ;AAAA,EACnB,iBAAiB,EAAE,OAAO,EAAE,YAAY;AAC1C,CAAC;AAIM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACrD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACrD,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA,EAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA;AAC7B,CAAC;AAEM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAEvB,WAAW,EAAE,QAAQ,YAAY;AAAA,EACjC,eAAe,EAAE,QAAQ;AAAA;AAC3B,CAAC;AAEM,IAAM,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;AAE/E,IAAM,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAEpI,IAAM,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAM7D,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,GAAG,UAAU,EAAE,QAAQ,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;AAAA,EACxF,UAAU,EAAE,OAAO;AAAA,IACjB,QAAQ,EAAE,QAAQ;AAAA;AAAA,IAClB,MAAM,EAAE,QAAQ;AAAA;AAAA,IAChB,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAAA;AAAA,EAC1C,CAAC;AAAA,EACD,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AACtE,CAAC;AAGM,IAAM,eAAe,EAAE,OAAO;AAAA,EACnC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,MAAM;AAAA,EACN,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC/B,YAAY,EAAE,OAAO;AAAA,EACrB,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAChD,CAAC;AAGM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAShC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA,EAC3D,WAAW,EAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC1C,OAAO,EAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,iBAAiB,gBAAgB,SAAS;AAAA,EAC1C,gBAAgB,eAAe,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM5C,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvC,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,MAAM,SAAS,SAAS;AAAA,EACxB,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO1C,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKpD,0BAA0B,EAAE,MAAM,UAAU,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvD,YAAY,EAAE,MAAM,qBAAqB,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBrD,SAAS,EAAE,MAAM;AAAA,IACf,EAAE,QAAQ,QAAQ;AAAA,IAClB,EAAE,QAAQ,KAAK;AAAA,IACf,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EACzC,CAAC,EAAE,SAAS;AACd,CAAC;AAGM,IAAM,qBAAqB,EAAE,mBAAmB,QAAQ;AAAA,EAC7D,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,cAAc;AAAA,IAC9B,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAC1C,SAAS,EAAE,OAAO;AAAA,MAChB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,WAAW,EAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA,MAC1C,OAAO,EAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,MAClC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAClC,iBAAiB,gBAAgB,SAAS;AAAA;AAAA;AAAA,MAG1C,sBAAsB,EAAE,MAAM,+BAA+B,EAAE,SAAS;AAAA,IAC1E,CAAC;AAAA,EACH,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,gBAAgB;AAAA,IAChC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAC1C,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACjE,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,uBAAuB;AAAA,IACvC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAC1C,SAAS,EAAE,OAAO;AAAA,MAChB,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC5B,UAAU,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;AAAA,MACtC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,CAAC;AAAA,EACH,CAAC;AACH,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ,EAAE,MAAM,YAAY,EAAE,IAAI,CAAC;AACrC,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjC,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAChD,CAAC;AAGM,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,IAAI;AAAA,EACnB,gBAAgB,EAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,UAAU,EAAE,OAAO;AAAA,EACnB,MAAM,EAAE,OAAO;AAAA,EACf,SAAS,EAAE,QAAQ;AAAA,EACnB,SAAS,EAAE,OAAO;AAAA,EAClB,UAAU,EAAE,OAAO;AAAA,EACnB,eAAe,EAAE,OAAO;AAAA,EACxB,cAAc,EAAE,OAAO;AAAA,EACvB,aAAa,EAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAGM,IAAM,mBAAmB,EAAE,mBAAmB,QAAQ;AAAA,EAC3D,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,MAAM;AAAA,EACxB,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,eAAe;AAAA,IAC/B,YAAY,EAAE,QAAQ,uBAAuB;AAAA,EAC/C,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,iBAAiB;AAAA,IACjC,YAAY,EAAE,QAAQ,eAAe;AAAA,IACrC,QAAQ,EAAE,QAAQ,QAAQ;AAAA,EAC5B,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,gBAAgB;AAAA,IAChC,SAAS,EAAE,QAAQ,QAAQ;AAAA,EAC7B,CAAC;AACH,CAAC;AAOM,IAAM,8BAA8B,EAAE,KAAK;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF,CAAC;AAGM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,SAAS;AAAA,EACT,IAAI;AAAA,EACJ,UAAU,EAAE,KAAK,CAAC,QAAQ,WAAW,QAAQ,UAAU,CAAC;AAAA;AAAA,EAExD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,2BAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EACrE,YAAY,EAAE,OAAO;AAAA,IACnB,WAAW,EAAE,QAAQ;AAAA,IACrB,UAAU,EAAE,QAAQ;AAAA,IACpB,MAAM,EAAE,OAAO;AAAA,IACf,SAAS,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC;AAAA,IAC3B,UAAU,EAAE,KAAK,CAAC,QAAQ,UAAU,CAAC;AAAA,IACrC,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,UAAU,EAAE,OAAO;AAAA,IACjB,WAAW,EAAE,KAAK,CAAC,cAAc,QAAQ,CAAC,EAAE,SAAS;AAAA,IACrD,YAAY,EAAE,QAAQ;AAAA,IACtB,OAAO,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKhB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC/B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,IAG3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,KAAK,EAAE,OAAO;AAAA,IACZ,WAAW,EAAE,QAAQ;AAAA,IACrB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,IACzB,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,eAAe,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA,IAItB,WAAW,EAAE,KAAK,CAAC,UAAU,UAAU,UAAU,cAAc,CAAC,EAAE,SAAS;AAAA,IAC3E,QAAQ,EAAE,KAAK,CAAC,SAAS,WAAW,QAAQ,CAAC,EAAE,SAAS;AAAA,IACxD,MAAM,EAAE,KAAK,CAAC,aAAa,aAAa,CAAC,EAAE,QAAQ,WAAW;AAAA,IAC9D,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC/B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,YAAY,EACT,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,EAChE,QAAQ,CAAC,MAAM,GAAG,CAAC;AAAA;AAAA,IAEtB,YAAY,EAAE,QAAQ;AAAA,IACtB,wBAAwB,EAAE,QAAQ;AAAA,IAClC,cAAc,EAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASxB,QAAQ,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,IACjC,kBAAkB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,IACvD,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,WAAW,EAAE,OAAO;AAAA,IAClB,WAAW,EAAE,QAAQ;AAAA,IACrB,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,WAAW,WAAW,CAAC,CAAC;AAAA,IACzD,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC,CAAC;AAAA,IAChD,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKD,aAAa,EAAE,OAAO;AAAA,IACpB,WAAW,EAAE,QAAQ;AAAA,IACrB,UAAU,EAAE,QAAQ;AAAA,IACpB,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,cAAc,EAAE,OAAO;AACzB,CAAC;AAkBM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAGM,IAAM,eAAe,EAAE,OAAO;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,UAAU,EAAE,KAAK,CAAC,QAAQ,WAAW,QAAQ,UAAU,CAAC;AAAA;AAAA,EAExD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,2BAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAGrD,cAAc,EAAE,OAAO,EAAE,SAAS;AACpC,CAAC;AAYM,IAAM,2BAA2B,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA,EAI/C,uBAAuB,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA,EAG/C,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAC9C,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,cAAc,EAAE,QAAQ;AAAA,EACxB,oBAAoB,EAAE,QAAQ;AAChC,CAAC;AAKM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC3C,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA;AAAA,EAE9C,OAAO,EAAE,QAAQ;AACnB,CAAC;AAcM,IAAM,eAAe,EAAE,KAAK,CAAC,SAAS,SAAS,SAAS,CAAC;AAEzD,IAAM,iBAAiB,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAOnD,IAAM,+BAA+B,EAAE,OAAO;AAAA;AAAA,EAEnD,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACrC,IAAI,aAAa,QAAQ,OAAO;AAAA,EAChC,MAAM,eAAe,QAAQ,QAAQ;AAAA;AAAA,EAErC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEjD,UAAU,EAAE,QAAQ,eAAe,EAAE,QAAQ,eAAe;AAAA;AAAA,EAE5D,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA,EAG1C,uBAAuB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhD,aAAa,EAAE,OAAO,EAAE,KAAK;AAC/B,CAAC;AAIM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,YAAY,EAAE,OAAO;AAAA,EACrB,UAAU,EAAE,OAAO;AAAA,EACnB,iBAAiB,EAAE,OAAO;AAAA,EAC1B,yBAAyB,EAAE,OAAO;AAAA,EAClC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC9C,CAAC;AAMM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAClC,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAC/C,CAAC;AAGM,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,UAAU,EAAE,QAAQ;AAAA,EACpB,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,oBAAoB,EAAE,QAAQ;AAChC,CAAC;AAIM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACvC,CAAC;AAGM,IAAM,wBAAwB,EAAE,KAAK,CAAC,WAAW,cAAc,UAAU,WAAW,UAAU,CAAC;AAO/F,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE7B,QAAQ,EAAE,OAAO;AAAA;AAAA;AAAA,EAGjB,eAAe,EAAE,OAAO;AAAA;AAAA;AAAA,EAGxB,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC5B,UAAU,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOnB,YAAY,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMrB,kBAAkB,EAAE,OAAO;AAAA;AAAA,EAE3B,iBAAiB,EAAE,OAAO;AAAA,EAC1B,uBAAuB,EAAE,QAAQ;AAAA,EACjC,wBAAwB,EAAE,QAAQ;AACpC,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,OAAO;AAAA;AAAA,EAEP,aAAa,8BAA8B,SAAS;AACtD,CAAC;AAIM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,OAAO;AAAA,EACjB,UAAU,EAAE,QAAQ,eAAe;AAAA,EACnC,YAAY,EAAE,QAAQ;AAAA,EACtB,oBAAoB,EAAE,QAAQ;AAAA,EAC9B,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,IAAI;AAAA,EACJ,MAAM,EAAE,OAAO;AAAA,EACf,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,aAAa,EAAE,MAAM,iBAAiB;AACxC,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,SAAS,EAAE,QAAQ;AACrB,CAAC;AAgBM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AACpC,CAAC;AAKM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,IAAI;AAAA,EACJ,MAAM,EAAE,OAAO;AAAA,EACf,iBAAiB,EAAE,QAAQ;AAAA,EAC3B,uBAAuB,EAAE,QAAQ;AACnC,CAAC;AAGM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,UAAU,EAAE,OAAO;AAAA,EACnB,SAAS;AAAA,EACT,WAAW,EAAE,OAAO;AACtB,CAAC;AAKM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AACpC,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,QAAQ,EAAE,QAAQ;AACpB,CAAC;AAMM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAC/C,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA;AAAA,EAE9C,OAAO,EAAE,OAAO;AAAA,EAChB,WAAW,EAAE,OAAO;AAAA,EACpB,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC9C,CAAC;AAQM,IAAM,6BAA6B,EAAE,OAAO;AAAA;AAAA,EAEjD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEvB,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACrC,IAAI,aAAa,QAAQ,OAAO;AAAA,EAChC,MAAM,eAAe,QAAQ,QAAQ;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEjD,UAAU,EAAE,QAAQ,eAAe,EAAE,QAAQ,eAAe;AAAA,EAC5D,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAE1C,uBAAuB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAClD,CAAC;AAKM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,aAAa;AACf,CAAC;AAkBM,IAAM,eAAe,EAAE,OAAO;AAAA,EACnC,QAAQ,EAAE,OAAO;AAAA,EACjB,OAAO,EAAE,OAAO;AAAA,EAChB,OAAO,EAAE,OAAO;AAAA,EAChB,QAAQ,EAAE,OAAO;AAAA,EACjB,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,eAAe,EAAE,OAAO,EAAE,IAAI;AAAA,EAC9B,eAAe,EAAE,OAAO,EAAE,IAAI;AAAA,EAC9B,gBAAgB,EAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvC,UAAU,EAAE,OAAO;AAAA,EACnB,WAAW,EAAE,OAAO;AACtB,CAAC;AAOM,IAAM,eAAe,EAAE,KAAK;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,cAAc,EAAE,KAAK,CAAC,SAAS,YAAY,CAAC;AAWlD,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,WAAW,EAAE,OAAO;AAAA,EACpB,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,MAAM,EAAE,OAAO;AAAA,EACf,MAAM;AAAA,EACN,OAAO;AAAA,EACP,QAAQ,EAAE,QAAQ;AAAA,EAClB,gBAAgB,EAAE,QAAQ;AAAA,EAC1B,IAAI,EAAE,OAAO;AAAA,EACb,MAAM,EAAE,OAAO;AAAA,EACf,YAAY,EAAE,QAAQ;AAAA,EACtB,oBAAoB,EAAE,QAAQ;AAAA,EAC9B,oBAAoB,EAAE,OAAO,EAAE,IAAI;AAAA,EACnC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,SAAS,aAAa,SAAS;AACjC,CAAC;AAQM,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,UAAU,EAAE,MAAM,WAAW;AAC/B,CAAC;AAUM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAC1B,CAAC;AAQM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,SAAS,EAAE,QAAQ;AAAA,EACnB,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAOM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,SAAS,EAAE,MAAM,YAAY;AAC/B,CAAC;AAUM,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO;AAAA,EACb,OAAO,EAAE,OAAO;AAAA,EAChB,UAAU,EAAE,OAAO;AAAA;AAAA,EACnB,eAAe,EAAE,OAAO;AAAA,EACxB,KAAK,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,EACjC,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC5D,CAAC;AAGM,IAAM,eAAe,EAAE,OAAO;AAAA,EACnC,oBAAoB,EAAE,OAAO;AAAA,EAC7B,cAAc,EAAE,OAAO;AAAA,EACvB,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,EAGxC,QAAQ,EAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA,EACvC,wBAAwB;AAAA,EACxB,yBAAyB,EAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AAAA,EACvD,YAAY,EAAE,MAAM,EAAE,OAAO;AAAA,IAC3B,IAAI,EAAE,OAAO;AAAA,IACb,MAAM,EAAE,OAAO;AAAA,EACjB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACd,aAAa,EAAE,OAAO;AAAA,IACpB,SAAS,EAAE,QAAQ;AAAA,IACnB,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC1C,CAAC;AAAA,EACD,mBAAmB;AAAA,EACnB,MAAM,iBAAiB,QAAQ,EAAE,MAAM,OAAO,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/C,oBAAoB,EAAE,OAAO;AAAA,IAC3B,YAAY,EAAE,QAAQ;AAAA,IACtB,KAAK,EAAE,QAAQ;AAAA,IACf,gBAAgB,EAAE,QAAQ;AAAA,EAC5B,CAAC,EAAE,QAAQ,EAAE,YAAY,OAAO,KAAK,OAAO,gBAAgB,MAAM,CAAC;AACrE,CAAC;AAGD,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,WAAW;AACxD;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM;AACxD;AAEA,eAAe,oBAAoB,QAAgB,OAAgC;AACjF,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,IAC/B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACvF,SAAO,OAAO,KAAK,SAAS,EAAE,SAAS,WAAW;AACpD;AAEA,SAAS,kBAAkB,QAAgB,UAA2B;AACpE,QAAM,cAAc,IAAI,YAAY,EAAE,OAAO,MAAM;AACnD,QAAM,gBAAgB,IAAI,YAAY,EAAE,OAAO,QAAQ;AACvD,MAAI,YAAY,WAAW,cAAc,QAAQ;AAC/C,WAAO;AAAA,EACT;AACA,MAAI,OAAO;AACX,WAAS,QAAQ,GAAG,QAAQ,YAAY,QAAQ,SAAS,GAAG;AAC1D,YAAQ,YAAY,KAAK,IAAK,cAAc,KAAK;AAAA,EACnD;AACA,SAAO,SAAS;AAClB;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const SessionStatus = z.enum([\n  \"queued\",\n  \"running\",\n  \"idle\",\n  \"requires_action\",\n  \"failed\",\n  \"cancelled\",\n]);\nexport type SessionStatus = z.infer<typeof SessionStatus>;\n\n// 11 backends; 3-way enum parity (contracts / sdk / deployment) is pinned by\n// `packages/sdk/test/contract-parity.test.ts`. Every member is ADDITIVE AT THE\n// END (the parity test pins positions): the original four, then the six cloud\n// backends, then `selfhosted` (bring-your-own-compute — a user's own machine\n// enrolled as a first-class sandbox).\nexport const SandboxBackend = z.enum([\n  \"docker\",\n  \"modal\",\n  \"local\",\n  \"none\",\n  \"daytona\",\n  \"runloop\",\n  \"e2b\",\n  \"blaxel\",\n  \"cloudflare\",\n  \"vercel\",\n  \"selfhosted\",\n]);\nexport type SandboxBackend = z.infer<typeof SandboxBackend>;\n\n// OS axis. Only \"linux\" is reachable in v1; macos/windows are seam placeholders.\nexport const SandboxOs = z.enum([\"linux\", \"macos\", \"windows\"]);\nexport type SandboxOs = z.infer<typeof SandboxOs>;\n\n// The five surfaceable sandbox capabilities (PascalCase, the canonical names).\nexport const SandboxCapabilityName = z.enum([\n  \"FileSystem\", // Channel A: list/read/write/search (Pierre tree)\n  \"Terminal\", // Channel A: command-output firehose (+ future pty-ws)\n  \"Git\", // Channel A: status/diff/log/show (Pierre diff)\n  \"DesktopStream\", // Channel B: noVNC pixels over a scoped tunnel URL\n  \"Recording\", // ffmpeg x11grab -> object storage\n]);\nexport type SandboxCapabilityName = z.infer<typeof SandboxCapabilityName>;\n\n// How a backend exposes a network port to the data plane.\nexport type PortExposureKind = \"provider-tunnel\" | \"preview-url\" | \"local-port\" | \"none\";\n\n// Static per-backend metadata — pure data, no runtime state. This table lives\n// in CONTRACTS (not runtime) so config can read it without an import cycle\n// through runtime (ledger CR8). Everything downstream (config boot-validation,\n// OS image selection, capability negotiation, env/mount branch) reads this\n// data, never a hard-coded backend name.\nexport type CapabilityDescriptor = {\n  backend: SandboxBackend;\n  backendId: string; // asserted === SDK client.backendId at registry build (deferred to P0.3)\n  tier: \"desktop\" | \"headless\" | \"dev\" | \"none\";\n  os: { supported: SandboxOs[]; default: SandboxOs };\n  capabilities: {\n    FileSystem: { available: boolean; readOnly: boolean };\n    Terminal: { available: boolean; transport: \"sse-events\" | \"pty-ws\" | null; pty: boolean };\n    Git: { available: boolean };\n    DesktopStream: { available: boolean; transport: \"vnc-ws\" | \"rdp-ws\" | \"webrtc\" | null };\n    // Feasibility only (== DesktopStream.available && os==linux); NOT a request.\n    Recording: { available: boolean };\n  };\n  lifetime: {\n    hardLifetimeMs?: number; // modal 24h, vercel 5h\n    requiresSnapshotRollover: boolean;\n    hasIdleKiller: boolean;\n    supportsSuspendResume: boolean; // runloop/e2b/vercel/modal true\n    resumeIsLockFree: boolean; // modal true (fromId, no lock)\n    idleKillDisableHint?: string;\n  };\n  snapshot: {\n    kind: \"native-fs\" | \"native-dir\" | \"native-snapshot-id\" | \"tar-only\" | \"none\";\n    hasTarFallback: boolean;\n  };\n  portExposure: { kind: PortExposureKind; supportsOnDemandPorts: boolean }; // runloop=false; blaxel only true\n  workspaceRoot: string; // os-overridable; per-backend default (providers owns; os defers)\n  nativeBucketMount: boolean; // modal true -> mount/signed-download branch\n  persistable: boolean;\n  supportsRunAs: boolean;\n};\n\n// The websockify/noVNC desktop port that is merged into `exposedPorts` for\n// every desktop-capable (backend, os). Asserted present by boot-validation.\nexport const DESKTOP_STREAM_PORT = 6080;\n\n// The ttyd PTY-over-websocket port that is exposed over the SAME Modal raw-TLS\n// tunnel as the desktop, for the REAL interactive terminal (Channel-B-symmetric).\n// ttyd's default; the box bakes ttyd and launches it on this port. The pty-ws\n// Terminal cell's `url` is the tunnel address resolved against this port.\nexport const TERMINAL_STREAM_PORT = 7681;\n\n// The Part-D matrix (master-spine PART D + module 03-providers). One row per\n// backend (10 rows). v1 reachable cells are all Linux; macos/windows are seam\n// placeholders (no enum members shipped). Reading rule: a capability cell is\n// `available:false` + a reason in the negotiated doc, never absent.\nexport const CAPABILITY_DESCRIPTORS: Record<SandboxBackend, CapabilityDescriptor> = {\n  modal: {\n    backend: \"modal\",\n    backendId: \"modal\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      hardLifetimeMs: 24 * 60 * 60 * 1000,\n      requiresSnapshotRollover: true,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: true,\n    },\n    snapshot: { kind: \"native-fs\", hasTarFallback: true },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: false }, // pre-declare 6080\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: true,\n    persistable: true,\n    supportsRunAs: true,\n  },\n  daytona: {\n    backend: \"daytona\",\n    backendId: \"daytona\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"native-snapshot-id\", hasTarFallback: true },\n    portExposure: { kind: \"preview-url\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: true,\n  },\n  runloop: {\n    backend: \"runloop\",\n    backendId: \"runloop\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: false },\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"native-snapshot-id\", hasTarFallback: true },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: false }, // CR9: pre-declare 6080\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: false,\n  },\n  e2b: {\n    backend: \"e2b\",\n    backendId: \"e2b\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: false }, // pty-until-proven=no\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"native-snapshot-id\", hasTarFallback: true },\n    portExposure: { kind: \"preview-url\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/home/user\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: false,\n  },\n  blaxel: {\n    backend: \"blaxel\",\n    backendId: \"blaxel\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: false }, // pty-until-proven=no\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" },\n      Recording: { available: true },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: false,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"tar-only\", hasTarFallback: true },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: true }, // only on-demand backend\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: false,\n  },\n  cloudflare: {\n    backend: \"cloudflare\",\n    backendId: \"cloudflare\",\n    tier: \"headless\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: false, transport: null },\n      Recording: { available: false },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: true,\n      supportsSuspendResume: false,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"tar-only\", hasTarFallback: true },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: true,\n  },\n  vercel: {\n    backend: \"vercel\",\n    backendId: \"vercel\",\n    tier: \"headless\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: false },\n      Git: { available: true },\n      DesktopStream: { available: false, transport: null },\n      Recording: { available: false },\n    },\n    lifetime: {\n      hardLifetimeMs: 5 * 60 * 60 * 1000,\n      requiresSnapshotRollover: true,\n      hasIdleKiller: true,\n      supportsSuspendResume: true,\n      resumeIsLockFree: false,\n    },\n    snapshot: { kind: \"tar-only\", hasTarFallback: true },\n    portExposure: { kind: \"preview-url\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/vercel/sandbox\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: false,\n  },\n  docker: {\n    backend: \"docker\",\n    backendId: \"docker\",\n    tier: \"dev\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: false, transport: null }, // local\n      Recording: { available: false },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: false,\n      supportsSuspendResume: false,\n      resumeIsLockFree: true,\n    },\n    snapshot: { kind: \"native-dir\", hasTarFallback: true },\n    portExposure: { kind: \"local-port\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: true,\n    supportsRunAs: true,\n  },\n  local: {\n    backend: \"local\",\n    // The SDK's UnixLocalSandboxClient reports backendId \"unix_local\" — this MUST\n    // match it (it is the resume-fence field compared against client.backendId).\n    backendId: \"unix_local\",\n    tier: \"dev\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"sse-events\", pty: true },\n      Git: { available: true },\n      DesktopStream: { available: false, transport: null },\n      Recording: { available: false },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: false,\n      supportsSuspendResume: false,\n      resumeIsLockFree: true,\n    },\n    snapshot: { kind: \"native-dir\", hasTarFallback: true },\n    portExposure: { kind: \"local-port\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: false,\n    supportsRunAs: false,\n  },\n  none: {\n    backend: \"none\",\n    backendId: \"none\",\n    tier: \"none\",\n    os: { supported: [\"linux\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: false, readOnly: true },\n      Terminal: { available: false, transport: null, pty: false },\n      Git: { available: false },\n      DesktopStream: { available: false, transport: null },\n      Recording: { available: false },\n    },\n    lifetime: {\n      requiresSnapshotRollover: false,\n      hasIdleKiller: false,\n      supportsSuspendResume: false,\n      resumeIsLockFree: true,\n    },\n    snapshot: { kind: \"none\", hasTarFallback: false },\n    portExposure: { kind: \"none\", supportsOnDemandPorts: false },\n    workspaceRoot: \"/workspace\",\n    nativeBucketMount: false,\n    persistable: false,\n    supportsRunAs: false,\n  },\n  // Bring-your-own-compute: the user's OWN machine, enrolled via a Rust agent,\n  // becomes ONE shared whole-machine sandbox (the agent IS the box). It is the\n  // first backend to make macOS/Windows reachable (default linux). Desktop is\n  // capability-PROCLAIMED (\"vnc-ws\") — the agent serves a native display stack\n  // (Linux X11/Xvfb, macOS CGEvent/ScreenCaptureKit) consent-gated at enroll;\n  // the online/offline/consent/display negotiation lives in select.ts (M3), this\n  // row is the static feasibility ceiling. Always-on (process-lifetime, never\n  // idle-reaped) and NOT persistable — OpenGeni cannot snapshot the user's disk,\n  // so resume = \"is the agent's subject live?\", never a cold re-create. Ports\n  // surface on-demand through the stateless relay edge, which lands behind the\n  // `resolveExposedPort` swap-seam later; until then it reuses the existing\n  // `provider-tunnel` exposure kind (the relay IS the provider tunnel for the\n  // agent) so no new PortExposureKind literal — and no new switch arms — are\n  // introduced. supportsOnDemandPorts:true: the agent opens a stream channel for\n  // a port on request rather than pre-declaring 6080/7681 at construction.\n  selfhosted: {\n    backend: \"selfhosted\",\n    backendId: \"selfhosted\",\n    tier: \"desktop\",\n    os: { supported: [\"linux\", \"macos\", \"windows\"], default: \"linux\" },\n    capabilities: {\n      FileSystem: { available: true, readOnly: false },\n      Terminal: { available: true, transport: \"pty-ws\", pty: true }, // real PTY over the relay\n      Git: { available: true },\n      DesktopStream: { available: true, transport: \"vnc-ws\" }, // proclaimed; consent-gated at enroll\n      Recording: { available: true }, // boot invariant: == DesktopStream.available\n    },\n    lifetime: {\n      // Whole-machine, always-there: online while the agent process runs, offline\n      // when it stops. The lease is NEVER idle-killed (it's the user's machine,\n      // not a reapable cloud box) and there is nothing to suspend/resume — the\n      // machine simply is or isn't reachable.\n      requiresSnapshotRollover: false,\n      hasIdleKiller: false,\n      supportsSuspendResume: false,\n      resumeIsLockFree: true, // resume = address the live NATS subject; no provider lock\n    },\n    // persistable:false forces snapshot.kind:\"none\" (the descriptor invariant\n    // `persistable ⇒ snapshot.kind!==\"none\"`): OpenGeni cannot snapshot the\n    // user's disk — the machine itself is the persistence.\n    snapshot: { kind: \"none\", hasTarFallback: false },\n    portExposure: { kind: \"provider-tunnel\", supportsOnDemandPorts: true },\n    workspaceRoot: \"/\", // agent-reported machine root (the whole machine is the sandbox)\n    nativeBucketMount: false,\n    persistable: false,\n    supportsRunAs: false,\n  },\n};\n\nexport const ReasoningEffort = z.enum([\"none\", \"minimal\", \"low\", \"medium\", \"high\", \"xhigh\"]);\nexport type ReasoningEffort = z.infer<typeof ReasoningEffort>;\n\nexport const ErrorCode = z.enum([\n  \"unauthenticated\",\n  \"forbidden\",\n  \"not_found\",\n  \"validation_failed\",\n  \"conflict\",\n  \"idempotency_conflict\",\n  \"limit_exceeded\",\n  \"provider_verification_failed\",\n  \"upstream_unavailable\",\n  \"internal_error\",\n]);\nexport type ErrorCode = z.infer<typeof ErrorCode>;\n\nexport const ErrorEnvelope = z.object({\n  error: z.object({\n    code: ErrorCode,\n    message: z.string(),\n    requestId: z.string().optional(),\n    details: z.record(z.string(), z.unknown()).optional(),\n  }),\n});\nexport type ErrorEnvelope = z.infer<typeof ErrorEnvelope>;\n\nexport const Permission = z.enum([\n  \"account:read\",\n  \"account:admin\",\n  \"members:manage\",\n  \"workspace:create\",\n  \"billing:read\",\n  \"billing:manage\",\n  \"workspace:read\",\n  \"workspace:admin\",\n  \"sessions:create\",\n  \"sessions:read\",\n  \"sessions:control\",\n  // Sandbox-surfacing (master-spine §C.3 / crosscut PART 1.2). stream:view is a\n  // REAL, distinct permission — strictly BROADER than sessions:read — because the\n  // pixel plane (Channel B) is UN-REDACTED: a viewer of raw pixels can see cloud\n  // creds the agent cat's into a terminal, which the redacted Channel-A event log\n  // never exposes. sessions:read is NOT permission to watch raw pixels.\n  \"stream:view\",\n  // SEPARATE from stream:view: raw input to the desktop (bypasses approvalQueue /\n  // interrupt). NEVER granted by default in v1 (the input plane is OFF —\n  // streamControlEnabled=false); the permission exists so later hardening is a\n  // flag flip, not a redesign.\n  \"stream:control\",\n  // Accept the pixel-plane secret-leak acknowledgment (consent gate before the\n  // un-redacted desktop URL is handed out).\n  \"stream:acknowledge\",\n  \"files:upload\",\n  \"files:read\",\n  // Channel-A structured write surface (FS writes / apply-patch); distinct from\n  // files:read so a read-only viewer can't mutate the box filesystem.\n  \"files:write\",\n  // Attach to an interactive PTY (terminal-as-pty, Channel A); distinct from\n  // sessions:read which only reads the command-output firehose.\n  \"terminal:attach\",\n  \"documents:manage\",\n  \"documents:search\",\n  \"scheduled_tasks:manage\",\n  \"scheduled_tasks:run\",\n  \"github:manage\",\n  \"github:use\",\n  \"api_keys:manage\",\n  \"connections:read\",\n  \"connections:write\",\n  \"environments:manage\",\n  \"environments:use\",\n  // Attach or rotate per-session third-party MCP server credentials. Deliberately\n  // not part of the worker's default first-party MCP permission set: a sandboxed\n  // agent must not be able to hand itself new bearer credentials.\n  \"mcp_servers:attach\",\n  // Programmatic sandbox -> tool access through the first-party MCP gate. This is\n  // intentionally narrow and is never part of first-party MCP defaults; callers\n  // must receive it through an explicit delegated `ogd_` mint carrying sessionId.\n  \"toolspace:call\",\n  \"goals:manage\",\n  // Bring-your-own-compute (M5). enrollments:read lists a workspace's machines;\n  // enrollments:manage approves a device-flow enrollment (the LOUD whole-machine\n  // consent) + revokes a machine. Distinct from sessions/stream perms because an\n  // enrollment grants WHOLE-MACHINE access to a user's own hardware — a high-trust,\n  // admin-shaped action. workspace:admin is the super-wildcard over both.\n  \"enrollments:read\",\n  \"enrollments:manage\",\n]);\nexport type Permission = z.infer<typeof Permission>;\n\nexport function prefixedMcpToolName(registryId: string, toolName: string): string {\n  return `${registryId}__${toolName}`;\n}\n\nexport const ProductAccessMode = z.enum([\"local\", \"configured\", \"managed\"]);\nexport type ProductAccessMode = z.infer<typeof ProductAccessMode>;\n\nexport const BillingMode = z.enum([\"disabled\", \"stripe\"]);\nexport type BillingMode = z.infer<typeof BillingMode>;\n\nexport const EntitlementsMode = z.enum([\"none\", \"static\", \"managed\"]);\nexport type EntitlementsMode = z.infer<typeof EntitlementsMode>;\n\nexport const UsageLimitsMode = z.enum([\"none\", \"static\", \"managed\"]);\nexport type UsageLimitsMode = z.infer<typeof UsageLimitsMode>;\n\nexport const AccountRole = z.enum([\"owner\", \"admin\", \"member\"]);\nexport type AccountRole = z.infer<typeof AccountRole>;\n\nexport const ManagedAccount = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  externalSource: z.string().nullable(),\n  externalId: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ManagedAccount = z.infer<typeof ManagedAccount>;\n\nexport const Workspace = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  name: z.string(),\n  slug: z.string().nullable(),\n  externalSource: z.string().nullable(),\n  externalId: z.string().nullable(),\n  // Per-workspace agent persona template (white-label override). null means\n  // the deployment default (OPENGENI_AGENT_INSTRUCTIONS_TEMPLATE /\n  // DEFAULT_AGENT_INSTRUCTIONS) is used. The runtime always injects the\n  // non-bypassable CORE (goal-loop ownership + environment block), so an\n  // override restyles the persona without dropping that contract.\n  agentInstructions: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type Workspace = z.infer<typeof Workspace>;\n\nexport const AccountGrant = z.object({\n  accountId: z.string().uuid(),\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().optional(),\n  role: AccountRole.optional(),\n  permissions: z.array(Permission),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\nexport type AccountGrant = z.infer<typeof AccountGrant>;\n\nexport const AccessGrant = z.object({\n  workspaceId: z.string().uuid(),\n  accountId: z.string().uuid(),\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().optional(),\n  permissions: z.array(Permission),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\nexport type AccessGrant = z.infer<typeof AccessGrant>;\n\nexport const AccessContext = z.object({\n  mode: ProductAccessMode,\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().optional(),\n  accountGrants: z.array(AccountGrant),\n  workspaceGrants: z.array(AccessGrant),\n  defaultAccountId: z.string().uuid().nullable(),\n  defaultWorkspaceId: z.string().uuid().nullable(),\n});\nexport type AccessContext = z.infer<typeof AccessContext>;\n\nexport const DelegatedAccessTokenPayload = z.object({\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().optional(),\n  permissions: z.array(Permission).min(1),\n  // Worker-asserted session scope for first-party MCP calls (HMAC-signed, not\n  // agent-controlled); enables session-scoped tools such as goal management.\n  sessionId: z.string().uuid().optional(),\n  exp: z.number().int().positive(),\n});\nexport type DelegatedAccessTokenPayload = z.infer<typeof DelegatedAccessTokenPayload>;\n\nexport async function signDelegatedAccessToken(secret: string, payload: DelegatedAccessTokenPayload): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(DelegatedAccessTokenPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `ogd_${encodedPayload}.${signature}`;\n}\n\nexport async function verifyDelegatedAccessToken(secret: string, token: string, nowSeconds = Math.floor(Date.now() / 1000)): Promise<DelegatedAccessTokenPayload | null> {\n  if (!token.startsWith(\"ogd_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"ogd_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  const payload = DelegatedAccessTokenPayload.safeParse(JSON.parse(base64UrlDecode(encodedPayload)));\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\n// --- Enrollment bearer credential (bring-your-own-compute M5, dossier §10.2) ---\n//\n// The signed bearer the agent presents to the control plane after enrollment (the\n// EnrollmentCredentials.bearer the poll returns). REUSES the SAME HMAC envelope as\n// the delegated/stream tokens (base64Url payload + hmacSha256Base64Url) with a\n// distinct `oge_` prefix so it can never be confused with an `ogd_` access token or\n// an `ogs_` stream token. It binds (workspaceId, agentId, enrollmentId) so the\n// control plane can verify the agent owns the subject `agent.<ws>.<id>` it\n// subscribes to. Signed with resolveEnrollmentSigningSecret; the secret value is\n// NEVER logged. The real per-workspace NATS Account creds binding is infra-deferred\n// (M4/relay) — this bearer is the application-tier identity proof.\nexport const EnrollmentBearerPayload = z.object({\n  workspaceId: z.string().uuid(),\n  agentId: z.string().uuid(),\n  enrollmentId: z.string().uuid(),\n  // The Account-scoped control-plane subject prefix the agent subscribes to.\n  subjectPrefix: z.string().min(1),\n  exp: z.number().int().positive(),\n});\nexport type EnrollmentBearerPayload = z.infer<typeof EnrollmentBearerPayload>;\n\nexport async function signEnrollmentBearer(secret: string, payload: EnrollmentBearerPayload): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(EnrollmentBearerPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `oge_${encodedPayload}.${signature}`;\n}\n\nexport async function verifyEnrollmentBearer(secret: string, token: string, nowSeconds = Math.floor(Date.now() / 1000)): Promise<EnrollmentBearerPayload | null> {\n  if (!token.startsWith(\"oge_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"oge_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  const payload = EnrollmentBearerPayload.safeParse(JSON.parse(base64UrlDecode(encodedPayload)));\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\n// --- Non-interactive enroll token (self-hosted enrollment UX §A2.1) ----------\n//\n// The SHORT-TTL, secret, workspace-scoped token the headless/fleet enroll path\n// presents to /v1/enrollments/token/exchange. The token IS the grant — there is\n// no human approve step — so it is stateless-signed (no DB row): the holder of an\n// unexpired token can enroll ONE machine identity into ONE workspace.\n//\n// It REUSES the SAME HMAC envelope as signEnrollmentBearer (base64Url payload +\n// hmacSha256Base64Url) with a DISTINCT `oget_` prefix and a `typ: \"enroll\"` claim.\n// DOMAIN SEPARATION: even though it shares the signing secret with the `oge_`\n// bearer, the prefix + typ claim make an enroll token unusable as an `oge_`\n// bearer (verifyEnrollmentBearer's `oge_` prefix check rejects it) and vice-versa\n// (verifyEnrollToken's `oget_` prefix + typ check rejects an `oge_` bearer). The\n// secret value is NEVER logged.\nexport const EnrollTokenPayload = z.object({\n  // Domain-separation claim — fixed \"enroll\" so an `oge_`/`ogd_`/`ogs_` payload (no\n  // typ, or a different typ) can never satisfy verifyEnrollToken even past the prefix.\n  typ: z.literal(\"enroll\"),\n  workspaceId: z.string().uuid(),\n  accountId: z.string().uuid(),\n  // The screen-control consent baked into the token at mint (the minting user's\n  // decision); the exchange records it as consentedScreenControl on the enrollment.\n  allowScreenControl: z.boolean(),\n  iat: z.number().int().nonnegative(),\n  exp: z.number().int().positive(),\n});\nexport type EnrollTokenPayload = z.infer<typeof EnrollTokenPayload>;\n\nexport async function signEnrollToken(secret: string, payload: EnrollTokenPayload): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(EnrollTokenPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `oget_${encodedPayload}.${signature}`;\n}\n\n/**\n * Verify an enroll token: rejects (returns null) on a bad prefix (NOT `oget_`),\n * a malformed envelope, a bad HMAC signature (constant-time), schema-invalid\n * claims (which includes `typ !== \"enroll\"` — the `z.literal` rejects it), or an\n * expired token (`exp < now`). Mirrors verifyEnrollmentBearer exactly. An `oge_`\n * bearer fails the prefix gate; a same-secret token that lacks the typ claim fails\n * the schema gate — both halves of the domain separation are enforced here.\n */\nexport async function verifyEnrollToken(secret: string, token: string, nowSeconds = Math.floor(Date.now() / 1000)): Promise<EnrollTokenPayload | null> {\n  if (!token.startsWith(\"oget_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"oget_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(base64UrlDecode(encodedPayload));\n  } catch {\n    return null;\n  }\n  const payload = EnrollTokenPayload.safeParse(decoded);\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\n// --- Scoped data-plane stream token (master-spine §C.3 / crosscut PART 1.3) ---\n//\n// REUSES the existing HMAC envelope (sign/verifyDelegatedAccessToken's\n// base64Url + hmacSha256Base64Url) — NOT a second crypto — but with a distinct\n// `ogs_` prefix and a HARD-NARROW claim set. The token is a CLAIM the OpenGeni\n// control plane mints; it is NOT the provider's tunnel secret. The browser\n// receives { providerUrl, streamToken }; the provider tunnel URL is the\n// transport, the streamToken is what the in-box edge validates (websockify\n// TokenFile is later-hardening; in v1 the URL's short TTL + the acknowledged\n// stream:view gate are the real boundary). The token is minted + recorded\n// against the holder from day one. It is NEVER appended to the URL as a query\n// param (the provider's own scoped token already lives in the URL).\n//\n// `leaseEpoch` is the fence: when the box is re-elected (warming→warm bumps the\n// epoch) the URL is re-minted with epoch+1 and the old tunnel is torn down, so a\n// stale token points at a dead tunnel. Epoch mismatch is enforced at USE (by the\n// caller comparing the claim against the live lease), not inside verify.\nexport const StreamTokenPayload = z.object({\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  // Identifies the sandbox_lease_holders row (the viewer holder).\n  viewerId: z.string().uuid(),\n  // Fence: the token logically dies when the box is re-elected (epoch++).\n  leaseEpoch: z.number().int().nonnegative(),\n  // v1 is always \"view\"; \"control\" is the never-granted raw-input plane.\n  mode: z.enum([\"view\", \"control\"]),\n  // 6080 (noVNC); pins the token to ONE exposed port.\n  port: z.number().int().positive(),\n  // Short TTL (120s default); rotation is event-driven under the epoch fence,\n  // not on a keepalive clock.\n  exp: z.number().int().positive(),\n});\nexport type StreamTokenPayload = z.infer<typeof StreamTokenPayload>;\n\nexport async function signStreamToken(secret: string, payload: StreamTokenPayload): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(StreamTokenPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `ogs_${encodedPayload}.${signature}`;\n}\n\n/**\n * Verify a stream token: rejects (returns null) on a bad prefix, malformed\n * envelope, bad HMAC signature (constant-time), schema-invalid claims, or an\n * expired token (`exp < now`). Mirrors verifyDelegatedAccessToken exactly.\n *\n * The epoch fence (claim.leaseEpoch vs the LIVE lease epoch) and the\n * workspace/session scope are checked by the CALLER at use against the live\n * lease + route params — verify proves the token is authentic + unexpired, the\n * caller proves it is for THIS box's current epoch and THIS workspace+session.\n */\nexport async function verifyStreamToken(secret: string, token: string, nowSeconds = Math.floor(Date.now() / 1000)): Promise<StreamTokenPayload | null> {\n  if (!token.startsWith(\"ogs_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"ogs_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(base64UrlDecode(encodedPayload));\n  } catch {\n    return null;\n  }\n  const payload = StreamTokenPayload.safeParse(decoded);\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\n// --- Relay PRODUCER token (bring-your-own-compute M8b, dossier §10.5) ---\n//\n// The token the AGENT presents to the relay edge when it registers a pty/desktop\n// stream channel (role=AGENT) — distinct from the viewer's `ogs_` token. It is\n// minted by the control plane at enrollment and threaded into EnrollmentCredentials\n// (proto field `relay_token`); the relay verifies it on its own merits, then pairs\n// the producer with the consumer by the shared channel key.\n//\n// REUSES the EXACT SAME HMAC envelope as the `ogs_`/`ogd_`/`oge_` tokens\n// (base64Url JSON payload + hmacSha256Base64Url) — NOT a second crypto — with a\n// distinct `ogr_` prefix so it can never be confused with the others. The claim\n// set binds (workspaceId, agentId): the relay reads the channel-key's ws+agent\n// from the StreamOpen and asserts the producer token claims the SAME pair, so a\n// producer token for workspace A can never register a channel for workspace B.\n// Signed with resolveRelayTokenSecret (the relay-token HMAC secret); the value is\n// NEVER logged. Long-lived by design (it is enrollment-scoped, not per-stream —\n// the agent presents it on every channel registration for the life of the\n// enrollment); the relay additionally validates the channel key + (for the\n// viewer's `ogs_`) the lease/active-epoch fence.\n//\n// The Rust relay re-implements this verify (the same base64url(JSON) + HMAC-SHA256\n// + prefix split) so TS-mint and Rust-verify provably agree — see the cross-stack\n// fixture in agent/crates/opengeni-relay/tests and the relay's `token` module doc.\nexport const RelayTokenPayload = z.object({\n  // The workspace the agent (and its channels) belong to — the relay asserts this\n  // equals the channel-key's ws so a producer can only register its own channels.\n  workspaceId: z.string().uuid(),\n  // The agent (machine) id — the relay asserts this equals the channel-key's agent.\n  agentId: z.string().uuid(),\n  // Expiry (unix seconds). Enrollment-scoped horizon (re-minted on re-enroll).\n  exp: z.number().int().positive(),\n});\nexport type RelayTokenPayload = z.infer<typeof RelayTokenPayload>;\n\nexport async function signRelayToken(secret: string, payload: RelayTokenPayload): Promise<string> {\n  const encodedPayload = base64UrlEncode(JSON.stringify(RelayTokenPayload.parse(payload)));\n  const signature = await hmacSha256Base64Url(secret, encodedPayload);\n  return `ogr_${encodedPayload}.${signature}`;\n}\n\n/**\n * Verify a relay producer token: rejects (returns null) on a bad prefix, malformed\n * envelope, bad HMAC signature (constant-time), schema-invalid claims, or expiry.\n * Mirrors verifyStreamToken exactly. The relay (Rust) re-implements this verify;\n * the TS verify here proves the format for the cross-stack fixture + any TS caller.\n *\n * The channel-key scope (claim.workspaceId/agentId vs the StreamOpen channel key)\n * is enforced by the relay at USE — verify proves authenticity + freshness only.\n */\nexport async function verifyRelayToken(secret: string, token: string, nowSeconds = Math.floor(Date.now() / 1000)): Promise<RelayTokenPayload | null> {\n  if (!token.startsWith(\"ogr_\")) {\n    return null;\n  }\n  const withoutPrefix = token.slice(\"ogr_\".length);\n  const dot = withoutPrefix.lastIndexOf(\".\");\n  if (dot <= 0) {\n    return null;\n  }\n  const encodedPayload = withoutPrefix.slice(0, dot);\n  const signature = withoutPrefix.slice(dot + 1);\n  const expected = await hmacSha256Base64Url(secret, encodedPayload);\n  if (!constantTimeEqual(signature, expected)) {\n    return null;\n  }\n  let decoded: unknown;\n  try {\n    decoded = JSON.parse(base64UrlDecode(encodedPayload));\n  } catch {\n    return null;\n  }\n  const payload = RelayTokenPayload.safeParse(decoded);\n  if (!payload.success || payload.data.exp < nowSeconds) {\n    return null;\n  }\n  return payload.data;\n}\n\nexport const CreateWorkspaceRequest = z.object({\n  accountId: z.string().uuid().optional(),\n  name: z.string().min(1),\n  slug: z.string().min(1).optional(),\n  externalSource: z.string().min(1).optional(),\n  externalId: z.string().min(1).optional(),\n  // White-label persona override for this workspace's agent. null/omitted uses\n  // the deployment default template.\n  agentInstructions: z.string().min(1).nullable().optional(),\n});\nexport type CreateWorkspaceRequest = z.infer<typeof CreateWorkspaceRequest>;\n\nexport const UpdateWorkspaceRequest = z.object({\n  name: z.string().min(1).optional(),\n  slug: z.string().min(1).nullable().optional(),\n  // White-label persona override. Pass null to clear it back to the deployment\n  // default; omit to leave it unchanged.\n  agentInstructions: z.string().min(1).nullable().optional(),\n});\nexport type UpdateWorkspaceRequest = z.infer<typeof UpdateWorkspaceRequest>;\n\nexport const ApiKey = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid().nullable(),\n  name: z.string(),\n  prefix: z.string(),\n  permissions: z.array(Permission),\n  expiresAt: z.string().nullable(),\n  revokedAt: z.string().nullable(),\n  lastUsedAt: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ApiKey = z.infer<typeof ApiKey>;\n\nexport const CreateApiKeyRequest = z.object({\n  name: z.string().min(1),\n  workspaceId: z.string().uuid().optional(),\n  permissions: z.array(Permission).min(1),\n  expiresAt: z.string().datetime({ offset: true }).optional(),\n});\nexport type CreateApiKeyRequest = z.infer<typeof CreateApiKeyRequest>;\n\nexport const CreateApiKeyResponse = z.object({\n  apiKey: ApiKey,\n  token: z.string().min(1),\n});\nexport type CreateApiKeyResponse = z.infer<typeof CreateApiKeyResponse>;\n\n// A person (or API key) with access to a workspace: one workspace_memberships\n// row. `subjectId` is `user:<betterAuthUserId>` or `api_key:<id>`; the People\n// surface lists the `user:` subjects (api_key subjects belong to API keys).\nexport const WorkspaceMember = z.object({\n  subjectId: z.string().min(1),\n  subjectLabel: z.string().nullable(),\n  role: z.string(),\n  permissions: z.array(Permission),\n  createdAt: z.string(),\n});\nexport type WorkspaceMember = z.infer<typeof WorkspaceMember>;\n\nexport const ListWorkspaceMembersResponse = z.object({\n  members: z.array(WorkspaceMember),\n});\nexport type ListWorkspaceMembersResponse = z.infer<typeof ListWorkspaceMembersResponse>;\n\nexport const AddWorkspaceMemberRequest = z.object({\n  // Resolved against the managed (Better Auth) users; email invites for\n  // not-yet-registered users are deferred, so an unknown email returns 404.\n  email: z.string().email(),\n  role: z.string().min(1).optional(),\n  permissions: z.array(Permission),\n});\nexport type AddWorkspaceMemberRequest = z.infer<typeof AddWorkspaceMemberRequest>;\n\nexport const UpdateWorkspaceMemberRequest = z.object({\n  role: z.string().min(1).optional(),\n  permissions: z.array(Permission),\n});\nexport type UpdateWorkspaceMemberRequest = z.infer<typeof UpdateWorkspaceMemberRequest>;\n\nexport const UsageEventType = z.enum([\n  \"agent_run.created\",\n  \"agent_run.completed\",\n  \"model.tokens\",\n  \"model.cost\",\n  \"file.uploaded\",\n  \"file.deleted\",\n  \"document.indexed\",\n  \"scheduled_task.fired\",\n  \"api_key.request\",\n  // --- sandbox warm-time metering (P2.1) ---\n  // Wall-clock seconds a box was warm — the billable warm-time meter. Accrued on\n  // the two stateless ticks (turn heartbeat + reaper sweep), idempotent on\n  // (sandbox_group_id, lease_epoch, tick) so a shared box (N sessions) is metered\n  // EXACTLY ONCE per tick (N sessions != N x bill). Orthogonal to model.tokens /\n  // model.cost (model API cost vs provider compute cost — both real, no overlap).\n  \"sandbox.warm_seconds\",\n  // usd_micros: warm-seconds x the per-provider per-second warm rate.\n  \"sandbox.warm_cost\",\n]);\nexport type UsageEventType = z.infer<typeof UsageEventType>;\n\nexport const UsageEvent = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  accountId: z.string().uuid(),\n  subjectId: z.string().nullable(),\n  eventType: UsageEventType,\n  quantity: z.number(),\n  unit: z.string(),\n  sourceResourceType: z.string().nullable(),\n  sourceResourceId: z.string().nullable(),\n  idempotencyKey: z.string(),\n  occurredAt: z.string(),\n  recordedAt: z.string(),\n  exportedToBillingAt: z.string().nullable(),\n  billingProviderEventId: z.string().nullable(),\n});\nexport type UsageEvent = z.infer<typeof UsageEvent>;\n\nexport const LimitAction = z.enum([\n  \"agent_run:create\",\n  \"tokens:consume\",\n  \"file:upload\",\n  \"document:index\",\n  \"schedule:create\",\n  \"workspace:create\",\n  \"api_key:create\",\n]);\nexport type LimitAction = z.infer<typeof LimitAction>;\n\nexport const StaticUsageLimits = z.object({\n  maxWorkspacesPerAccount: z.number().int().positive().optional(),\n  maxApiKeysPerWorkspace: z.number().int().positive().optional(),\n  maxSchedulesPerWorkspace: z.number().int().positive().optional(),\n  maxFileUploadBytes: z.number().int().positive().optional(),\n  maxMonthlyAgentRunsPerWorkspace: z.number().int().positive().optional(),\n  maxMonthlyTokensPerWorkspace: z.number().int().positive().optional(),\n  maxMonthlyCostMicrosPerAccount: z.number().int().positive().optional(),\n  maxDocumentIndexedChunksPerWorkspace: z.number().int().positive().optional(),\n});\nexport type StaticUsageLimits = z.infer<typeof StaticUsageLimits>;\n\nexport const EntitlementValue = z.union([z.boolean(), z.string(), z.number(), z.array(z.string())]);\nexport type EntitlementValue = z.infer<typeof EntitlementValue>;\n\nexport const Entitlements = z.record(z.string().min(1), EntitlementValue);\nexport type Entitlements = z.infer<typeof Entitlements>;\n\nexport const LimitDecision = z.discriminatedUnion(\"allowed\", [\n  z.object({ allowed: z.literal(true) }),\n  z.object({ allowed: z.literal(false), code: z.string(), message: z.string() }),\n]);\nexport type LimitDecision = z.infer<typeof LimitDecision>;\n\n// ============ P3 — Entitlements port (§7.5) ============\n//\n// The host-providable admission seam over OpenGeni's TWO existing admission\n// sites: the API edge (`checkLimit`/`requireLimit`, billing/limits.ts) AND the\n// worker edge (`ensureRunAllowed`, agent-turn.ts — both turn-entry and the\n// mid-stream budget valve). A host that owns its OWN ledger/meter binds this to\n// keep OpenGeni from re-deriving admission from its local ledger.\n//\n// CRITICAL CONTRACT: `admitRun` returns a transport-neutral allow/deny decision\n// (+ optional structured reason + the echoed quantity it admitted) and NEVER\n// exposes `getBillingBalance` or any ledger internals — the host's balance math\n// stays on the host side of the boundary. This is what lets the same port serve\n// both PUSH (host funds OpenGeni's ledger; admission is a LOCAL read of that\n// funded ledger) and PULL (a network callback to the host's own meter).\n//\n// `action` is a free `string` (NOT the internal `LimitAction` enum) so a host\n// meter can key on actions OpenGeni does not model. `quantity` is the units the\n// caller is about to consume (tokens, bytes, 1 run, …); the decision MAY echo\n// the admitted quantity so a PULL host can grant a partial allowance.\nexport const EntitlementDecision = z.discriminatedUnion(\"allowed\", [\n  z.object({ allowed: z.literal(true), quantity: z.number().optional() }),\n  z.object({ allowed: z.literal(false), reason: z.string(), code: z.string().optional(), quantity: z.number().optional() }),\n]);\nexport type EntitlementDecision = z.infer<typeof EntitlementDecision>;\n\nexport type AdmitRunInput = {\n  accountId: string;\n  workspaceId: string;\n  action: string;\n  quantity: number;\n};\n\nexport type EntitlementsPort = {\n  admitRun(input: AdmitRunInput): Promise<EntitlementDecision>;\n};\n\n// ============ P4a — Connection-credential provider (§7.6) ============\n//\n// The host-providable per-run credential-mint seam over OpenGeni's TWO\n// run-scoped credential sites in the worker:\n//   - GIT credentials: the GitHub App installation token minted in\n//     `sandboxEnvironmentForRun` (today `createGitHubAppInstallationToken`\n//     from `settings`) and injected as `GH_TOKEN`/`GITHUB_TOKEN`/the git\n//     extraheader.\n//   - SANDBOX secrets: the decrypted workspace environment values loaded in\n//     `loadWorkspaceEnvironmentForRun` (today decrypted with\n//     `environmentsEncryptionKeyBytes(settings)`).\n//\n// In embedded/separate topologies the HOST owns these external connections\n// (its GitHub App, its secret vault + encryption key). When a host binds this\n// port, OpenGeni asks the host to mint/decrypt per-run instead of self-minting\n// from `settings`. Unset (standalone default) → byte-for-byte today's\n// self-mint.\n//\n// FORK-7 CROSS-CHECK (the host-mapping safety guardrail): a credential\n// provider returns the `workspaceId` it scoped the credential to, and the\n// activity ASSERTS it agrees with the run's workspace BEFORE injecting\n// `GH_TOKEN` (or applying the decrypted values). A host mapping bug that\n// returns tenant B's creds while the run is tenant A is thereby caught at the\n// seam, never silently injected into tenant A's sandbox.\n\nexport type GitCredentialsRequest = {\n  accountId: string;\n  workspaceId: string;\n  // The GitHub App installation the run's repository resources resolved to,\n  // and the specific repositories the token must be scoped to. Mirrors the\n  // shape `createGitHubAppInstallationToken` consumes today.\n  installationId: number;\n  repositoryIds: number[];\n};\n\nexport type GitCredentials = {\n  // The minted installation token the activity injects as GH_TOKEN/GITHUB_TOKEN\n  // and into the git http extraheader (identical downstream handling to the\n  // self-mint path).\n  token: string;\n  // FORK-7 echo: the workspace the provider scoped this token to. The activity\n  // asserts `workspaceId === request.workspaceId` before injecting.\n  workspaceId: string;\n  // Optional git identity override. When omitted the activity falls back to\n  // today's `githubAppBotIdentity(settings)`.\n  identity?: { name: string; email: string } | null;\n};\n\nexport type SandboxSecretsRequest = {\n  accountId: string;\n  workspaceId: string;\n  // The workspace environment the run's session declares (null = unattached;\n  // the provider, like the self-mint path, returns null values for it).\n  environmentId: string;\n};\n\nexport type SandboxSecrets = {\n  // The decrypted environment values the run injects, replacing the local\n  // `environmentsEncryptionKeyBytes` decrypt. Same shape the self-mint path\n  // produces (plaintext name→value).\n  values: Record<string, string>;\n  // FORK-7 echo: the workspace the provider scoped these secrets to.\n  workspaceId: string;\n  // Optional environment metadata; when omitted the activity uses the\n  // environmentId as both id and name (the local decrypt carries the row's\n  // id/name/description, but only `id` is load-bearing downstream).\n  id?: string;\n  name?: string;\n  description?: string | null;\n};\n\nexport type ConnectionCredentialsPort = {\n  // Both legs are optional: a host may drive ONLY git creds (BYO-GitHub-App)\n  // and leave sandbox secrets to OpenGeni's local decrypt, or vice-versa. An\n  // unset leg falls through to today's self-mint for THAT leg only.\n  gitCredentials?: (input: GitCredentialsRequest) => Promise<GitCredentials>;\n  sandboxSecrets?: (input: SandboxSecretsRequest) => Promise<SandboxSecrets>;\n};\n\n// ============ P4a — GitHub App API port (BYO-App, §7.6 / SPIKE-2 remainder) ===\n//\n// The host-driven GitHub-API credential leg. SPIKE-2 closed the establishment +\n// gate (storage) axis; this closes the credential leg by making the two live\n// GitHub-API calls host-PROVIDABLE so a BYO-GitHub-App host drives its OWN App\n// credentials (its own JWT-signing key, its own OAuth client) instead of\n// OpenGeni self-minting from `settings`:\n//   - verifyInstallationAccessForUser: the OAuth code→token + installation\n//     lookup that PROVES the install is real (today\n//     `verifyGitHubInstallationAccessForUser(settings, …)`).\n//   - listRepositories: the installation-scoped repo listing behind\n//     `GET /v1/workspaces/:id/github/repositories` (today\n//     `listGitHubAppRepositories(settings, …)`).\n//\n// Unset (standalone default) → today's `settings`-based self-mint runs\n// byte-for-byte (the live GitHub-API verify/list against OpenGeni's own App).\n\nexport type GitHubInstallationSummary = {\n  installationId: number;\n  accountLogin: string | null;\n  accountType: string | null;\n  suspended: boolean;\n};\n\nexport type GitHubAppApiPort = {\n  verifyInstallationAccessForUser?: (input: {\n    code: string;\n    installationId: number;\n  }) => Promise<GitHubInstallationSummary>;\n  listRepositories?: (input: {\n    installationIds?: number[];\n  }) => Promise<GitHubRepository[]>;\n};\n\nexport const BillingBalance = z.object({\n  accountId: z.string().uuid(),\n  balanceMicros: z.number().int(),\n  currency: z.literal(\"usd\"),\n  updatedAt: z.string(),\n});\nexport type BillingBalance = z.infer<typeof BillingBalance>;\n\nexport const CreateCheckoutRequest = z.object({\n  accountId: z.string().uuid().optional(),\n  amountUsd: z.number().min(5).max(10_000).refine(\n    (value) => Number.isFinite(value) && Math.abs(value - Math.round(value * 100) / 100) < 1e-9,\n    { message: \"amountUsd must use cent precision\" },\n  ),\n  successUrl: z.string().url().optional(),\n  cancelUrl: z.string().url().optional(),\n});\nexport type CreateCheckoutRequest = z.infer<typeof CreateCheckoutRequest>;\n\nexport const CreateCheckoutResponse = z.object({\n  checkoutSessionId: z.string(),\n  url: z.string().url(),\n});\nexport type CreateCheckoutResponse = z.infer<typeof CreateCheckoutResponse>;\n\nexport const RepositoryResourceRef = z.object({\n  kind: z.literal(\"repository\"),\n  uri: z.string().min(1),\n  ref: z.string().min(1),\n  mountPath: z.string().min(1).optional(),\n  subpath: z.string().min(1).optional(),\n  githubInstallationId: z.number().int().positive().optional(),\n  githubRepositoryId: z.number().int().positive().optional(),\n});\nexport type RepositoryResourceRef = z.infer<typeof RepositoryResourceRef>;\n\nexport const FileResourceRef = z.object({\n  kind: z.literal(\"file\"),\n  fileId: z.string().uuid(),\n  mountPath: z.string().min(1).optional(),\n});\nexport type FileResourceRef = z.infer<typeof FileResourceRef>;\n\nexport const ResourceRef = z.discriminatedUnion(\"kind\", [RepositoryResourceRef, FileResourceRef]);\nexport type ResourceRef = z.infer<typeof ResourceRef>;\n\nexport const FileStatus = z.enum([\"pending_upload\", \"ready\", \"failed\", \"expired\", \"deleted\"]);\nexport type FileStatus = z.infer<typeof FileStatus>;\n\nexport const FileUploadStatus = z.enum([\"pending\", \"completed\", \"expired\", \"failed\"]);\nexport type FileUploadStatus = z.infer<typeof FileUploadStatus>;\n\nexport const FileAsset = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  status: FileStatus,\n  filename: z.string(),\n  safeFilename: z.string(),\n  contentType: z.string(),\n  sizeBytes: z.number().int().nonnegative(),\n  sha256: z.string().nullable(),\n  bucket: z.string(),\n  objectKey: z.string(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type FileAsset = z.infer<typeof FileAsset>;\n\nexport const CreateFileUploadRequest = z.object({\n  filename: z.string().min(1),\n  contentType: z.string().min(1),\n  sizeBytes: z.number().int().positive(),\n  sha256: z.string().min(1).optional(),\n});\nexport type CreateFileUploadRequest = z.infer<typeof CreateFileUploadRequest>;\n\nexport const CreateFileUploadResponse = z.object({\n  fileId: z.string().uuid(),\n  uploadId: z.string().uuid(),\n  putUrl: z.string().url(),\n  requiredHeaders: z.record(z.string(), z.string()),\n  expiresAt: z.string(),\n  maxSizeBytes: z.number().int().positive(),\n});\nexport type CreateFileUploadResponse = z.infer<typeof CreateFileUploadResponse>;\n\nexport const CompleteFileUploadResponse = z.object({\n  file: FileAsset,\n});\nexport type CompleteFileUploadResponse = z.infer<typeof CompleteFileUploadResponse>;\n\nexport const FileDownloadUrlResponse = z.object({\n  url: z.string().url(),\n  expiresAt: z.string(),\n});\nexport type FileDownloadUrlResponse = z.infer<typeof FileDownloadUrlResponse>;\n\nexport const DocumentStatus = z.enum([\"queued\", \"indexing\", \"ready\", \"failed\"]);\nexport type DocumentStatus = z.infer<typeof DocumentStatus>;\n\nexport const KnowledgeSourceKind = z.enum([\"manual_upload\", \"meeting_transcript\", \"repository\", \"email\", \"chat\", \"document\", \"web\", \"other\"]);\nexport type KnowledgeSourceKind = z.infer<typeof KnowledgeSourceKind>;\n\nexport const DocumentSearchMode = z.enum([\"hybrid\", \"vector\", \"keyword\"]);\nexport type DocumentSearchMode = z.infer<typeof DocumentSearchMode>;\n\nexport const DocumentBase = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  name: z.string(),\n  description: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type DocumentBase = z.infer<typeof DocumentBase>;\n\nexport const Document = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  baseId: z.string().uuid(),\n  fileId: z.string().uuid(),\n  status: DocumentStatus,\n  title: z.string(),\n  parser: z.string(),\n  chunkCount: z.number().int().nonnegative(),\n  error: z.string().nullable(),\n  sourceKind: KnowledgeSourceKind,\n  sourceUri: z.string().nullable(),\n  sourceExternalId: z.string().nullable(),\n  sourceTitle: z.string().nullable(),\n  sourceAuthor: z.string().nullable(),\n  sourceCreatedAt: z.string().nullable(),\n  sourceUpdatedAt: z.string().nullable(),\n  sourceVersion: z.string().nullable(),\n  aclTags: z.array(z.string()),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type Document = z.infer<typeof Document>;\n\nexport const DocumentSearchResult = z.object({\n  chunkId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  documentId: z.string().uuid(),\n  baseId: z.string().uuid(),\n  fileId: z.string().uuid(),\n  title: z.string(),\n  text: z.string(),\n  score: z.number(),\n  matchType: DocumentSearchMode,\n  vectorScore: z.number().nullable(),\n  keywordScore: z.number().nullable(),\n  chunkIndex: z.number().int().nonnegative(),\n  metadata: z.record(z.string(), z.unknown()),\n  sourceKind: KnowledgeSourceKind,\n  sourceUri: z.string().nullable(),\n  sourceExternalId: z.string().nullable(),\n  sourceTitle: z.string().nullable(),\n  sourceAuthor: z.string().nullable(),\n  sourceCreatedAt: z.string().nullable(),\n  sourceUpdatedAt: z.string().nullable(),\n  sourceVersion: z.string().nullable(),\n  aclTags: z.array(z.string()),\n});\nexport type DocumentSearchResult = z.infer<typeof DocumentSearchResult>;\n\nexport const CreateDocumentBaseRequest = z.object({\n  name: z.string().min(1),\n  description: z.string().optional(),\n});\nexport type CreateDocumentBaseRequest = z.infer<typeof CreateDocumentBaseRequest>;\n\nexport const AddDocumentRequest = z.object({\n  fileId: z.string().uuid(),\n  title: z.string().min(1).optional(),\n  sourceKind: KnowledgeSourceKind.optional(),\n  sourceUri: z.string().min(1).optional(),\n  sourceExternalId: z.string().min(1).optional(),\n  sourceTitle: z.string().min(1).optional(),\n  sourceAuthor: z.string().min(1).optional(),\n  sourceCreatedAt: z.string().datetime({ offset: true }).optional(),\n  sourceUpdatedAt: z.string().datetime({ offset: true }).optional(),\n  sourceVersion: z.string().min(1).optional(),\n  aclTags: z.array(z.string().min(1)).optional(),\n});\nexport type AddDocumentRequest = z.infer<typeof AddDocumentRequest>;\n\nexport const DocumentSearchRequest = z.object({\n  query: z.string().min(1),\n  baseIds: z.array(z.string().uuid()).optional(),\n  mode: DocumentSearchMode.optional(),\n  sourceKinds: z.array(KnowledgeSourceKind).optional(),\n  aclTags: z.array(z.string().min(1)).optional(),\n  limit: z.number().int().positive().max(50).default(5),\n});\nexport type DocumentSearchRequest = z.infer<typeof DocumentSearchRequest>;\n\nexport const KnowledgeMemoryStatus = z.enum([\"proposed\", \"approved\", \"rejected\"]);\nexport type KnowledgeMemoryStatus = z.infer<typeof KnowledgeMemoryStatus>;\n\nexport const KnowledgeMemoryKind = z.enum([\"semantic\", \"episodic\", \"procedural\", \"decision\", \"preference\"]);\nexport type KnowledgeMemoryKind = z.infer<typeof KnowledgeMemoryKind>;\n\nexport const KnowledgeSourceRef = z.object({\n  kind: z.enum([\"document_chunk\", \"document\", \"session_event\", \"memory\", \"external\"]),\n  id: z.string().min(1),\n  uri: z.string().min(1).optional(),\n  title: z.string().min(1).optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type KnowledgeSourceRef = z.infer<typeof KnowledgeSourceRef>;\n\nexport const KnowledgeMemory = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  status: KnowledgeMemoryStatus,\n  kind: KnowledgeMemoryKind,\n  scope: z.string(),\n  text: z.string(),\n  sourceRefs: z.array(KnowledgeSourceRef),\n  confidence: z.number().min(0).max(1),\n  metadata: z.record(z.string(), z.unknown()),\n  createdBySessionId: z.string().uuid().nullable(),\n  reviewedBy: z.string().nullable(),\n  reviewedAt: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type KnowledgeMemory = z.infer<typeof KnowledgeMemory>;\n\nexport const CreateKnowledgeMemoryRequest = z.object({\n  status: KnowledgeMemoryStatus.default(\"proposed\"),\n  kind: KnowledgeMemoryKind.default(\"semantic\"),\n  scope: z.string().min(1).default(\"workspace\"),\n  text: z.string().min(1),\n  sourceRefs: z.array(KnowledgeSourceRef).default([]),\n  confidence: z.number().min(0).max(1).default(0.5),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  createdBySessionId: z.string().uuid().optional(),\n});\nexport type CreateKnowledgeMemoryRequest = z.infer<typeof CreateKnowledgeMemoryRequest>;\n\nexport const UpdateKnowledgeMemoryRequest = z.object({\n  status: KnowledgeMemoryStatus.optional(),\n  kind: KnowledgeMemoryKind.optional(),\n  scope: z.string().min(1).optional(),\n  text: z.string().min(1).optional(),\n  sourceRefs: z.array(KnowledgeSourceRef).optional(),\n  confidence: z.number().min(0).max(1).optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n  reviewedBy: z.string().min(1).optional(),\n});\nexport type UpdateKnowledgeMemoryRequest = z.infer<typeof UpdateKnowledgeMemoryRequest>;\n\nexport const KnowledgeMemorySearchRequest = z.object({\n  query: z.string().min(1).optional(),\n  status: KnowledgeMemoryStatus.optional(),\n  kind: KnowledgeMemoryKind.optional(),\n  scope: z.string().min(1).optional(),\n  limit: z.number().int().positive().max(100).default(20),\n});\nexport type KnowledgeMemorySearchRequest = z.infer<typeof KnowledgeMemorySearchRequest>;\n\nexport const ToolRef = z.object({\n  kind: z.literal(\"mcp\"),\n  id: z.string().min(1),\n  // Non-fatal-on-connect marker for MCP server refs that can degrade\n  // gracefully. Absent/false is STRICT: the id must be configured and an\n  // unavailable server fails the turn. `optional:true` is preserved for known\n  // servers and makes runtime connect/list failures skip that server; if the\n  // deployment does not configure the id, validation drops the ref. The server\n  // also sets this for auto-attached workspace-default capability MCPs.\n  optional: z.boolean().optional(),\n});\nexport type ToolRef = z.infer<typeof ToolRef>;\n\nconst registryId = /^[A-Za-z0-9_-]+$/;\nconst httpsUrl = z.string().url().refine((value) => {\n  try {\n    return new URL(value).protocol === \"https:\";\n  } catch {\n    return false;\n  }\n}, { message: \"URL must use https\" });\n\nexport const SessionMcpServerInput = z.object({\n  id: z.string().min(1).regex(registryId),\n  name: z.string().min(1).optional(),\n  url: httpsUrl,\n  allowedTools: z.array(z.string().min(1)).optional(),\n  timeoutMs: z.number().int().positive().optional(),\n  cacheToolsList: z.boolean().optional(),\n  // Human-approval policy for this server's tools. `true` = every tool of this\n  // server requires approval before it runs (a `session.requiresAction` pause\n  // the caller resolves with `user.approvalDecision`); a string[] = ONLY the\n  // listed UNPREFIXED tool names require approval (e.g. reads auto-run, writes\n  // ask); absent / `false` = auto-run everything (the historical default).\n  requireApproval: z.union([z.boolean(), z.array(z.string().min(1))]).optional(),\n  // Write-only credential headers. Values are encrypted at rest and never\n  // returned in session responses or events; response metadata exposes names.\n  headers: z.record(z.string(), z.string()).optional(),\n});\nexport type SessionMcpServerInput = z.infer<typeof SessionMcpServerInput>;\n\nexport const SessionMcpCredentialUpdateInput = z.object({\n  id: z.string().min(1).regex(registryId),\n  headers: z.record(z.string(), z.string()),\n});\nexport type SessionMcpCredentialUpdateInput = z.infer<typeof SessionMcpCredentialUpdateInput>;\n\nexport const SessionMcpServerMetadata = z.object({\n  id: z.string().min(1).regex(registryId),\n  name: z.string().min(1).nullable(),\n  url: httpsUrl,\n  headerNames: z.array(z.string()).default([]),\n  credentialVersion: z.number().int().positive(),\n}).strict();\nexport type SessionMcpServerMetadata = z.infer<typeof SessionMcpServerMetadata>;\n\nexport class ResourceRefConflictError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResourceRefConflictError\";\n  }\n}\n\nexport function mergeToolRefs(existing: ToolRef[], additions: ToolRef[]): ToolRef[] {\n  const byKey = new Map<string, ToolRef>();\n  const order: string[] = [];\n  for (const tool of [...existing, ...additions]) {\n    const key = `${tool.kind}:${tool.id}`;\n    const prior = byKey.get(key);\n    if (!prior) {\n      byKey.set(key, tool);\n      order.push(key);\n      continue;\n    }\n    // Strict wins: if the same server appears both optional and strict, the\n    // strict occurrence upgrades the merged ref so an unavailable server fails\n    // the turn. This preserves the fail-loud default when defaults, packs, and\n    // per-turn tool selections are combined.\n    if (prior.optional === true && tool.optional !== true) {\n      const { optional: _dropped, ...strict } = prior;\n      byKey.set(key, strict);\n    }\n  }\n  return order.map((key) => byKey.get(key)!);\n}\n\nexport function mergeResourceRefs(\n  existing: ResourceRef[],\n  additions: ResourceRef[],\n  options: { rejectConflicts?: boolean } = {},\n): ResourceRef[] {\n  const out = [...existing];\n  const mountPaths = new Map(existing.flatMap((resource) => resource.mountPath ? [[resource.mountPath, stableJson(resource)] as const] : []));\n  const identities = new Map(existing.map((resource) => [resourceIdentityKey(resource), stableJson(resource)] as const));\n  const exact = new Set(existing.map(stableJson));\n\n  for (const resource of additions) {\n    const serialized = stableJson(resource);\n    if (exact.has(serialized)) {\n      continue;\n    }\n    if (options.rejectConflicts) {\n      const existingAtMount = resource.mountPath ? mountPaths.get(resource.mountPath) : undefined;\n      if (existingAtMount && existingAtMount !== serialized) {\n        throw new ResourceRefConflictError(`resource mount path is already attached: ${resource.mountPath}`);\n      }\n      const identity = resourceIdentityKey(resource);\n      const existingIdentity = identities.get(identity);\n      if (existingIdentity && existingIdentity !== serialized) {\n        throw new ResourceRefConflictError(`resource is already attached with different settings: ${identity}`);\n      }\n    }\n    out.push(resource);\n    exact.add(serialized);\n    identities.set(resourceIdentityKey(resource), serialized);\n    if (resource.mountPath) {\n      mountPaths.set(resource.mountPath, serialized);\n    }\n  }\n  return out;\n}\n\nexport function reasoningEffortForMetadata(metadata: Record<string, unknown>, fallback: ReasoningEffort): ReasoningEffort {\n  const value = metadata.reasoningEffort;\n  return value === \"none\" || value === \"minimal\" || value === \"low\" || value === \"medium\" || value === \"high\" || value === \"xhigh\"\n    ? value\n    : fallback;\n}\n\nexport function stableJson(value: unknown): string {\n  return JSON.stringify(sortJson(value));\n}\n\nexport function resourceIdentityKey(resource: ResourceRef): string {\n  if (resource.kind === \"file\") {\n    return `file:${resource.fileId}`;\n  }\n  return `repository:${resource.uri}`;\n}\n\nfunction sortJson(value: unknown): unknown {\n  if (Array.isArray(value)) {\n    return value.map(sortJson);\n  }\n  if (value && typeof value === \"object\") {\n    return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, nested]) => [key, sortJson(nested)]));\n  }\n  return value;\n}\n\nexport const SessionTurnStatus = z.enum([\"queued\", \"running\", \"requires_action\", \"completed\", \"failed\", \"cancelled\"]);\nexport type SessionTurnStatus = z.infer<typeof SessionTurnStatus>;\n\nexport const SessionTurnSource = z.enum([\"user\", \"scheduled_task\", \"api\", \"goal\"]);\nexport type SessionTurnSource = z.infer<typeof SessionTurnSource>;\n\nexport const SessionGoalStatus = z.enum([\"active\", \"paused\", \"completed\"]);\nexport type SessionGoalStatus = z.infer<typeof SessionGoalStatus>;\n\nexport const SessionGoalCreatedBy = z.enum([\"api\", \"agent\", \"scheduled_task\"]);\nexport type SessionGoalCreatedBy = z.infer<typeof SessionGoalCreatedBy>;\n\nexport const SessionGoalPausedReason = z.enum([\n  \"agent\",\n  \"user_interrupt\",\n  \"api\",\n  \"no_progress\",\n  \"max_auto_continuations\",\n  \"limits\",\n]);\nexport type SessionGoalPausedReason = z.infer<typeof SessionGoalPausedReason>;\n\nexport const SessionGoal = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  status: SessionGoalStatus,\n  text: z.string(),\n  successCriteria: z.string().nullable(),\n  evidence: z.string().nullable(),\n  rationale: z.string().nullable(),\n  pausedReason: z.string().nullable(),\n  createdBy: SessionGoalCreatedBy,\n  version: z.number().int().positive(),\n  autoContinuations: z.number().int().nonnegative(),\n  noProgressStreak: z.number().int().nonnegative(),\n  maxAutoContinuations: z.number().int().positive().nullable(),\n  metadata: z.record(z.string(), z.unknown()),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type SessionGoal = z.infer<typeof SessionGoal>;\n\nexport const GoalSpec = z.object({\n  text: z.string().min(1),\n  successCriteria: z.string().min(1).optional(),\n  maxAutoContinuations: z.number().int().positive().optional(),\n});\nexport type GoalSpec = z.infer<typeof GoalSpec>;\n\nexport const UpdateSessionGoalRequest = z.object({\n  status: z.enum([\"paused\", \"active\"]),\n  rationale: z.string().min(1).optional(),\n});\nexport type UpdateSessionGoalRequest = z.infer<typeof UpdateSessionGoalRequest>;\n\nexport const UpdateSessionRequest = z.object({\n  title: z.string().min(1).max(200),\n});\nexport type UpdateSessionRequest = z.infer<typeof UpdateSessionRequest>;\n\n// Operator context controls (slash-command palette: /clear, /compact). These\n// are session/operator actions, NOT a structured way to talk to the agent —\n// the human↔agent channel stays plain chat. Both require `sessions:control`.\n\n/**\n * Clear a session's conversation context. `confirm` must be the literal `true`\n * so an accidental/empty POST cannot wipe context — the destructive intent is\n * explicit on the wire, mirroring the client-side confirm affordance.\n */\nexport const ClearSessionContextRequest = z.object({\n  confirm: z.literal(true),\n});\nexport type ClearSessionContextRequest = z.infer<typeof ClearSessionContextRequest>;\n\n/**\n * The marker key on the sentinel run-state blob written by a context clear. The\n * blob ({@link CLEARED_RUN_STATE_BLOB}) is NOT a real Agents-SDK serialized run\n * state — it carries no `$schemaVersion`/history, so `RunState.fromString` would\n * throw on it. Every read path that deserializes a run-state blob MUST first\n * check {@link isClearedRunStateBlob} and treat a match as \"no prior state\"\n * (a fresh, empty start), which is exactly what a clear means. This is the\n * shared contract that keeps the db (writer) and the runtime (reader) in sync.\n */\nexport const CLEARED_RUN_STATE_MARKER = \"$opengeniCleared\" as const;\n\n/** The canonical sentinel serializedRunState value a context clear stores. */\nexport const CLEARED_RUN_STATE_BLOB = JSON.stringify({ [CLEARED_RUN_STATE_MARKER]: true });\n\n/**\n * True when a serialized run-state blob is the cleared sentinel rather than a\n * real Agents-SDK run state. Recognized leniently (any object carrying the\n * marker key set truthy) so a future field addition to the sentinel does not\n * resurrect the pre-clear context. Anything that is not the sentinel — including\n * malformed JSON — returns false so genuine blobs/corruption are handled by the\n * normal deserialize path.\n */\nexport function isClearedRunStateBlob(serialized: string | null | undefined): boolean {\n  if (!serialized) {\n    return false;\n  }\n  try {\n    const parsed = JSON.parse(serialized) as unknown;\n    return typeof parsed === \"object\"\n      && parsed !== null\n      && (parsed as Record<string, unknown>)[CLEARED_RUN_STATE_MARKER] === true;\n  } catch {\n    return false;\n  }\n}\n\n/** Trigger conversation compaction now. No body fields today (forward-room). */\nexport const CompactSessionContextRequest = z.object({}).strict();\nexport type CompactSessionContextRequest = z.infer<typeof CompactSessionContextRequest>;\n\n/** Outcome of a manual /compact trigger. */\nexport const CompactSessionContextResult = z.object({\n  // queued: a client-side (Azure) compaction will run before the next turn.\n  // noop:   nothing to do (server-managed provider, mode off, or no history).\n  status: z.enum([\"queued\", \"noop\"]),\n  message: z.string(),\n});\nexport type CompactSessionContextResult = z.infer<typeof CompactSessionContextResult>;\n\nexport const SessionTurn = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  triggerEventId: z.string().uuid(),\n  temporalWorkflowId: z.string(),\n  status: SessionTurnStatus,\n  source: SessionTurnSource,\n  position: z.number().int().positive(),\n  prompt: z.string().min(1),\n  resources: z.array(ResourceRef),\n  tools: z.array(ToolRef),\n  model: z.string().min(1),\n  reasoningEffort: ReasoningEffort,\n  sandboxBackend: SandboxBackend,\n  // Per-turn OS override. NULL = inherit the session's sandboxOs.\n  sandboxOs: SandboxOs.nullable(),\n  metadata: z.record(z.string(), z.unknown()),\n  startedAt: z.string().nullable(),\n  finishedAt: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type SessionTurn = z.infer<typeof SessionTurn>;\n\nexport const UpdateSessionTurnRequest = z.object({\n  prompt: z.string().min(1).optional(),\n  resources: z.array(ResourceRef).optional(),\n  tools: z.array(ToolRef).optional(),\n  model: z.string().min(1).optional(),\n  reasoningEffort: ReasoningEffort.optional(),\n  sandboxBackend: SandboxBackend.optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\nexport type UpdateSessionTurnRequest = z.infer<typeof UpdateSessionTurnRequest>;\n\nexport const ReorderSessionTurnsRequest = z.object({\n  turnIds: z.array(z.string().uuid()).min(1),\n});\nexport type ReorderSessionTurnsRequest = z.infer<typeof ReorderSessionTurnsRequest>;\n\nexport const WorkspaceEnvironmentVariableName = z.string().regex(/^[A-Z][A-Z0-9_]*$/).max(128);\nexport type WorkspaceEnvironmentVariableName = z.infer<typeof WorkspaceEnvironmentVariableName>;\n\n// Metadata only by design: no schema in this file ever carries a variable value\n// back to a client. Values are write-only and decrypted exclusively inside the\n// worker at sandbox materialization time.\nexport const WorkspaceEnvironmentVariableMetadata = z.object({\n  name: WorkspaceEnvironmentVariableName,\n  version: z.number().int().positive(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type WorkspaceEnvironmentVariableMetadata = z.infer<typeof WorkspaceEnvironmentVariableMetadata>;\n\nexport const WorkspaceEnvironment = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  name: z.string(),\n  description: z.string().nullable(),\n  variables: z.array(WorkspaceEnvironmentVariableMetadata),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type WorkspaceEnvironment = z.infer<typeof WorkspaceEnvironment>;\n\nexport const CreateWorkspaceEnvironmentRequest = z.object({\n  name: z.string().min(1).max(120),\n  description: z.string().max(2000).optional(),\n  variables: z.array(z.object({\n    name: WorkspaceEnvironmentVariableName,\n    value: z.string().min(1).max(32768),\n  })).default([]),\n});\nexport type CreateWorkspaceEnvironmentRequest = z.infer<typeof CreateWorkspaceEnvironmentRequest>;\n\nexport const UpdateWorkspaceEnvironmentRequest = z.object({\n  name: z.string().min(1).max(120).optional(),\n  description: z.string().max(2000).nullable().optional(),\n});\nexport type UpdateWorkspaceEnvironmentRequest = z.infer<typeof UpdateWorkspaceEnvironmentRequest>;\n\nexport const SetWorkspaceEnvironmentVariableRequest = z.object({\n  value: z.string().min(1).max(32768),\n});\nexport type SetWorkspaceEnvironmentVariableRequest = z.infer<typeof SetWorkspaceEnvironmentVariableRequest>;\n\nexport const ScheduledTaskStatus = z.enum([\"active\", \"paused\"]);\nexport type ScheduledTaskStatus = z.infer<typeof ScheduledTaskStatus>;\n\nexport const ScheduledTaskRunStatus = z.enum([\"queued\", \"dispatched\", \"failed\"]);\nexport type ScheduledTaskRunStatus = z.infer<typeof ScheduledTaskRunStatus>;\n\nexport const ScheduledTaskRunMode = z.enum([\"new_session_per_run\", \"reusable_session\"]);\nexport type ScheduledTaskRunMode = z.infer<typeof ScheduledTaskRunMode>;\n\nexport const ScheduledTaskOverlapPolicy = z.enum([\"allow_concurrent\", \"skip\", \"buffer_one\"]);\nexport type ScheduledTaskOverlapPolicy = z.infer<typeof ScheduledTaskOverlapPolicy>;\n\nexport const ScheduledTaskTriggerType = z.enum([\"scheduled\", \"manual\"]);\nexport type ScheduledTaskTriggerType = z.infer<typeof ScheduledTaskTriggerType>;\n\nexport const ScheduledTaskScheduleSpec = z.discriminatedUnion(\"type\", [\n  z.object({\n    type: z.literal(\"once\"),\n    runAt: z.string().datetime({ offset: true }),\n    timeZone: z.string().min(1).default(\"UTC\"),\n  }),\n  z.object({\n    type: z.literal(\"interval\"),\n    everySeconds: z.number().int().positive(),\n    startAt: z.string().datetime({ offset: true }).optional(),\n    endAt: z.string().datetime({ offset: true }).optional(),\n  }),\n  z.object({\n    type: z.literal(\"calendar\"),\n    timeZone: z.string().min(1).default(\"UTC\"),\n    hour: z.number().int().min(0).max(23),\n    minute: z.number().int().min(0).max(59),\n    daysOfWeek: z.array(z.enum([\"SUNDAY\", \"MONDAY\", \"TUESDAY\", \"WEDNESDAY\", \"THURSDAY\", \"FRIDAY\", \"SATURDAY\"])).min(1).optional(),\n  }),\n]);\nexport type ScheduledTaskScheduleSpec = z.infer<typeof ScheduledTaskScheduleSpec>;\n\nexport const ScheduledTaskAgentConfig = z.object({\n  prompt: z.string().min(1),\n  resources: z.array(ResourceRef).default([]),\n  tools: z.array(ToolRef).default([]),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  model: z.string().min(1).optional(),\n  reasoningEffort: ReasoningEffort.optional(),\n  sandboxBackend: SandboxBackend.optional(),\n  goal: GoalSpec.optional(),\n});\nexport type ScheduledTaskAgentConfig = z.infer<typeof ScheduledTaskAgentConfig>;\n\nexport const ScheduledTask = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  name: z.string(),\n  status: ScheduledTaskStatus,\n  schedule: ScheduledTaskScheduleSpec,\n  temporalScheduleId: z.string(),\n  runMode: ScheduledTaskRunMode,\n  overlapPolicy: ScheduledTaskOverlapPolicy,\n  agentConfig: ScheduledTaskAgentConfig,\n  reusableSessionId: z.string().uuid().nullable(),\n  environmentId: z.string().uuid().nullable(),\n  metadata: z.record(z.string(), z.unknown()),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ScheduledTask = z.infer<typeof ScheduledTask>;\n\nexport const ScheduledTaskRun = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  taskId: z.string().uuid(),\n  status: ScheduledTaskRunStatus,\n  triggerType: ScheduledTaskTriggerType,\n  scheduledAt: z.string().nullable(),\n  firedAt: z.string(),\n  sessionId: z.string().uuid().nullable(),\n  triggerEventId: z.string().uuid().nullable(),\n  error: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ScheduledTaskRun = z.infer<typeof ScheduledTaskRun>;\n\nexport const CreateScheduledTaskRequest = z.object({\n  name: z.string().min(1),\n  schedule: ScheduledTaskScheduleSpec,\n  runMode: ScheduledTaskRunMode.default(\"new_session_per_run\"),\n  overlapPolicy: ScheduledTaskOverlapPolicy.default(\"allow_concurrent\"),\n  agentConfig: ScheduledTaskAgentConfig,\n  status: ScheduledTaskStatus.default(\"active\"),\n  environmentId: z.string().uuid().nullable().optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateScheduledTaskRequest = z.infer<typeof CreateScheduledTaskRequest>;\n\nexport const UpdateScheduledTaskRequest = z.object({\n  name: z.string().min(1).optional(),\n  schedule: ScheduledTaskScheduleSpec.optional(),\n  runMode: ScheduledTaskRunMode.optional(),\n  overlapPolicy: ScheduledTaskOverlapPolicy.optional(),\n  agentConfig: ScheduledTaskAgentConfig.optional(),\n  status: ScheduledTaskStatus.optional(),\n  environmentId: z.string().uuid().nullable().optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\nexport type UpdateScheduledTaskRequest = z.infer<typeof UpdateScheduledTaskRequest>;\n\n/**\n * Manual-trigger body. `triggerId` is a client-supplied idempotency token: a\n * retried trigger that reuses the same token charges once and starts one run.\n * Omitting it makes each call a distinct trigger (the server mints a token).\n */\nexport const TriggerScheduledTaskRequest = z.object({\n  triggerId: z.string().min(1).max(128).optional(),\n});\nexport type TriggerScheduledTaskRequest = z.infer<typeof TriggerScheduledTaskRequest>;\n\nexport const CapabilityPackConnectorAuthModel = z.enum([\n  \"oauth2_authorization_code_pkce\",\n  \"oauth2_authorization_code\",\n  \"api_key\",\n  \"credential_ref\",\n]);\nexport type CapabilityPackConnectorAuthModel = z.infer<typeof CapabilityPackConnectorAuthModel>;\n\nexport const CapabilityPackConnector = z.object({\n  id: z.string().min(1),\n  name: z.string().min(1),\n  category: z.string().min(1),\n  authModel: CapabilityPackConnectorAuthModel,\n  providers: z.array(z.string().min(1)).default([]),\n  scopes: z.array(z.string().min(1)).default([]),\n  required: z.boolean().default(false),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CapabilityPackConnector = z.infer<typeof CapabilityPackConnector>;\n\nexport const CapabilityPackKnowledge = z.object({\n  type: z.literal(\"document_base\"),\n  id: z.string().min(1),\n  name: z.string().min(1),\n  description: z.string().nullable().default(null),\n  required: z.boolean().default(false),\n});\nexport type CapabilityPackKnowledge = z.infer<typeof CapabilityPackKnowledge>;\n\nexport const CapabilityPackScheduledTaskTemplate = z.object({\n  id: z.string().min(1),\n  name: z.string().min(1),\n  description: z.string().min(1),\n  defaultSchedule: ScheduledTaskScheduleSpec,\n  defaultRunMode: ScheduledTaskRunMode.default(\"new_session_per_run\"),\n  defaultOverlapPolicy: ScheduledTaskOverlapPolicy.default(\"skip\"),\n  // Optional default agent prompt so registered pack manifests can ship fully\n  // instantiable templates; built-in packs may instead build prompts in code.\n  prompt: z.string().min(1).optional(),\n});\nexport type CapabilityPackScheduledTaskTemplate = z.infer<typeof CapabilityPackScheduledTaskTemplate>;\n\n// One file inside a pack skill directory. Paths are workspace-relative POSIX\n// paths inside the skill directory (for example \"SKILL.md\" or\n// \"references/runbook.md\"); content is UTF-8 text carried inline in the pack\n// manifest, which is also how registered packs persist it (the manifest JSONB\n// row in workspace_packs is the storage of record for pack skills).\nexport const CapabilityPackSkillFile = z.object({\n  path: z.string().min(1).max(512).refine(isSafePackSkillRelativePath, {\n    message: \"skill file path must be a safe relative POSIX path without '..' segments\",\n  }),\n  content: z.string().max(256 * 1024),\n});\nexport type CapabilityPackSkillFile = z.infer<typeof CapabilityPackSkillFile>;\n\n// A skill delivered by a capability pack. The name doubles as the skill\n// directory under the sandbox skill index (skills/<name>), so it must be a\n// single safe path segment. Every skill must ship a top-level SKILL.md.\nexport const CapabilityPackSkill = z.object({\n  name: z.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, {\n    message: \"skill name must be a single path segment of letters, digits, '.', '_' or '-'\",\n  }),\n  description: z.string().min(1).max(2048).optional(),\n  files: z.array(CapabilityPackSkillFile).min(1).max(64),\n}).superRefine((skill, ctx) => {\n  const seen = new Set<string>();\n  skill.files.forEach((file, index) => {\n    if (seen.has(file.path)) {\n      ctx.addIssue({ code: \"custom\", message: `duplicate skill file path: ${file.path}`, path: [\"files\", index, \"path\"] });\n    }\n    seen.add(file.path);\n  });\n  if (!skill.files.some((file) => file.path === \"SKILL.md\")) {\n    ctx.addIssue({ code: \"custom\", message: \"skill must include a top-level SKILL.md file\", path: [\"files\"] });\n  }\n});\nexport type CapabilityPackSkill = z.infer<typeof CapabilityPackSkill>;\n\nfunction isSafePackSkillRelativePath(path: string): boolean {\n  if (path.startsWith(\"/\") || path.includes(\"\\\\\")) {\n    return false;\n  }\n  return path.split(\"/\").every((segment) => segment.length > 0 && segment !== \".\" && segment !== \"..\");\n}\n\nexport const CapabilityPack = z.object({\n  id: z.string().min(1),\n  name: z.string().min(1),\n  description: z.string().min(1),\n  role: z.string().min(1),\n  category: z.string().min(1),\n  version: z.string().min(1),\n  // Container image ref (digest-pinned recommended) the pack's sessions run\n  // in. At most one enabled pack per workspace may declare one; with none,\n  // sessions use the deployment-wide image settings.\n  sandboxImage: z.string().trim().min(1).max(512).optional(),\n  // Skills delivered into the sandbox skill index when the pack is enabled.\n  skills: z.array(CapabilityPackSkill).max(32).superRefine((skills, ctx) => {\n    const seen = new Set<string>();\n    skills.forEach((skill, index) => {\n      const key = skill.name.toLowerCase();\n      if (seen.has(key)) {\n        ctx.addIssue({ code: \"custom\", message: `duplicate pack skill name: ${skill.name}`, path: [index, \"name\"] });\n      }\n      seen.add(key);\n    });\n  }).default([]),\n  tools: z.array(ToolRef).default([]),\n  connectors: z.array(CapabilityPackConnector).default([]),\n  knowledge: z.array(CapabilityPackKnowledge).default([]),\n  scheduledTaskTemplates: z.array(CapabilityPackScheduledTaskTemplate).default([]),\n  environment: z.object({\n    description: z.string().min(1),\n    requiredVariables: z.array(WorkspaceEnvironmentVariableName).default([]),\n    required: z.boolean().default(false),\n  }).optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CapabilityPack = z.infer<typeof CapabilityPack>;\n\n// Registering a pack stores the manifest itself; the request body is a full\n// CapabilityPack manifest.\nexport const RegisterCapabilityPackRequest = CapabilityPack;\nexport type RegisterCapabilityPackRequest = z.infer<typeof RegisterCapabilityPackRequest>;\n\nexport const WorkspaceRegisteredPack = z.object({\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  pack: CapabilityPack,\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type WorkspaceRegisteredPack = z.infer<typeof WorkspaceRegisteredPack>;\n\nexport const PackInstallationStatus = z.enum([\"active\", \"disabled\"]);\nexport type PackInstallationStatus = z.infer<typeof PackInstallationStatus>;\n\nexport const PackInstallation = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  packId: z.string().min(1),\n  status: PackInstallationStatus,\n  metadata: z.record(z.string(), z.unknown()),\n  enabledAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type PackInstallation = z.infer<typeof PackInstallation>;\n\nexport const EnablePackRequest = z.object({\n  environmentId: z.string().uuid().optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type EnablePackRequest = z.infer<typeof EnablePackRequest>;\n\nexport const SocialProvider = z.enum([\n  \"x\",\n  \"linkedin\",\n  \"instagram\",\n  \"facebook\",\n  \"tiktok\",\n  \"youtube\",\n  \"custom\",\n]);\nexport type SocialProvider = z.infer<typeof SocialProvider>;\n\nexport const SocialConnectionStatus = z.enum([\"connected\", \"needs_reauth\", \"disabled\"]);\nexport type SocialConnectionStatus = z.infer<typeof SocialConnectionStatus>;\n\nexport const SocialConnection = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  provider: SocialProvider,\n  accountHandle: z.string().min(1),\n  accountName: z.string().nullable(),\n  externalAccountId: z.string().nullable(),\n  status: SocialConnectionStatus,\n  scopes: z.array(z.string()),\n  credentialRef: z.string().nullable(),\n  tokenMetadata: z.record(z.string(), z.unknown()),\n  metadata: z.record(z.string(), z.unknown()),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type SocialConnection = z.infer<typeof SocialConnection>;\n\nexport const CreateSocialConnectionRequest = z.object({\n  provider: SocialProvider,\n  accountHandle: z.string().min(1),\n  accountName: z.string().min(1).optional(),\n  externalAccountId: z.string().min(1).optional(),\n  status: SocialConnectionStatus.default(\"connected\"),\n  scopes: z.array(z.string().min(1)).default([]),\n  credentialRef: z.string().min(1).optional(),\n  tokenMetadata: z.record(z.string(), z.unknown()).default({}),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateSocialConnectionRequest = z.infer<typeof CreateSocialConnectionRequest>;\n\nexport const SocialPost = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  connectionId: z.string().uuid(),\n  provider: SocialProvider,\n  externalPostId: z.string().nullable(),\n  url: z.string().url().nullable(),\n  authorHandle: z.string().nullable(),\n  text: z.string(),\n  publishedAt: z.string(),\n  metrics: z.record(z.string(), z.number()),\n  raw: z.record(z.string(), z.unknown()),\n  createdAt: z.string(),\n});\nexport type SocialPost = z.infer<typeof SocialPost>;\n\nexport const CreateSocialPostRequest = z.object({\n  connectionId: z.string().uuid(),\n  externalPostId: z.string().min(1).optional(),\n  url: z.string().url().optional(),\n  authorHandle: z.string().min(1).optional(),\n  text: z.string().min(1),\n  publishedAt: z.string().datetime({ offset: true }),\n  metrics: z.record(z.string(), z.number()).default({}),\n  raw: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateSocialPostRequest = z.infer<typeof CreateSocialPostRequest>;\n\nexport const ConnectionKind = z.enum([\"oauth2\", \"api_key\", \"app_install\", \"delegated\"]);\nexport type ConnectionKind = z.infer<typeof ConnectionKind>;\n\nexport const ConnectionStatus = z.enum([\"active\", \"needs_reauth\", \"revoked\", \"error\"]);\nexport type ConnectionStatus = z.infer<typeof ConnectionStatus>;\n\nexport const McpServerConnectionRef = z.object({\n  connectionId: z.string().uuid().optional(),\n  providerDomain: z.string().min(1),\n  kind: ConnectionKind.optional(),\n  scopes: z.array(z.string().min(1)).optional(),\n  resource: z.string().min(1).optional(),\n  subjectScope: z.enum([\"workspace\", \"subject\"]).optional(),\n}).strict();\nexport type McpServerConnectionRef = z.infer<typeof McpServerConnectionRef>;\n\nexport const ConnectionMetadata = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  subjectId: z.string().nullable(),\n  providerDomain: z.string(),\n  kind: ConnectionKind,\n  status: ConnectionStatus,\n  grantedScopes: z.array(z.string()),\n  expiresAt: z.string().nullable(),\n  lastRefreshAt: z.string().nullable(),\n  lastUsedAt: z.string().nullable(),\n  lastError: z.string().nullable(),\n  version: z.number().int().positive(),\n  metadata: z.record(z.string(), z.unknown()),\n  createdBySubjectId: z.string().nullable(),\n  updatedBySubjectId: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type ConnectionMetadata = z.infer<typeof ConnectionMetadata>;\n\nexport const ConnectionCredentialBundle = z.record(z.string(), z.unknown());\nexport type ConnectionCredentialBundle = z.infer<typeof ConnectionCredentialBundle>;\n\nexport const CreateConnectionRequest = z.object({\n  providerDomain: z.string().min(1),\n  kind: ConnectionKind,\n  subjectId: z.string().min(1).nullable().optional(),\n  credential: ConnectionCredentialBundle,\n  grantedScopes: z.array(z.string().min(1)).default([]),\n  expiresAt: z.string().datetime({ offset: true }).nullable().optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateConnectionRequest = z.infer<typeof CreateConnectionRequest>;\n\nexport const UpdateConnectionRequest = z.object({\n  providerDomain: z.string().min(1).optional(),\n  subjectId: z.string().min(1).nullable().optional(),\n  kind: ConnectionKind.optional(),\n  status: ConnectionStatus.optional(),\n  credential: ConnectionCredentialBundle.optional(),\n  grantedScopes: z.array(z.string().min(1)).optional(),\n  expiresAt: z.string().datetime({ offset: true }).nullable().optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n});\nexport type UpdateConnectionRequest = z.infer<typeof UpdateConnectionRequest>;\n\nexport const ConnectionResponse = z.object({\n  connection: ConnectionMetadata,\n});\nexport type ConnectionResponse = z.infer<typeof ConnectionResponse>;\n\nexport const ListConnectionsResponse = z.object({\n  connections: z.array(ConnectionMetadata),\n});\nexport type ListConnectionsResponse = z.infer<typeof ListConnectionsResponse>;\n\nexport const OAuthStartRequest = z.object({\n  providerDomain: z.string().min(1).optional(),\n  mcpUrl: z.string().url().optional(),\n  resource: z.string().url().optional(),\n  requestedScopes: z.array(z.string().min(1)).default([]),\n  returnPath: z.string().min(1).optional(),\n  connectionId: z.string().uuid().optional(),\n}).refine((value) => Boolean(value.mcpUrl ?? value.resource), {\n  message: \"mcpUrl is required\",\n  path: [\"mcpUrl\"],\n});\nexport type OAuthStartRequest = z.infer<typeof OAuthStartRequest>;\n\nexport const OAuthStartResponse = z.object({\n  state: z.string().min(1),\n  authorizationUrl: z.string().url().nullable(),\n  expiresAt: z.string(),\n});\nexport type OAuthStartResponse = z.infer<typeof OAuthStartResponse>;\n\nexport const IntegrationClientMetadata = z.object({\n  client_id: z.string().url(),\n  client_name: z.literal(\"OpenGeni\"),\n  redirect_uris: z.array(z.string().url()),\n  token_endpoint_auth_method: z.literal(\"none\"),\n  grant_types: z.array(z.enum([\"authorization_code\", \"refresh_token\"])),\n  response_types: z.array(z.literal(\"code\")),\n});\nexport type IntegrationClientMetadata = z.infer<typeof IntegrationClientMetadata>;\n\nexport const MarketingDailyAnalysisTaskRequest = z.object({\n  name: z.string().min(1).optional(),\n  connectionIds: z.array(z.string().uuid()).default([]),\n  documentBaseIds: z.array(z.string().uuid()).default([]),\n  timeZone: z.string().min(1).default(\"UTC\"),\n  hour: z.number().int().min(0).max(23).default(9),\n  minute: z.number().int().min(0).max(59).default(0),\n  promptInstructions: z.string().min(1).optional(),\n  status: ScheduledTaskStatus.default(\"active\"),\n  runMode: ScheduledTaskRunMode.default(\"new_session_per_run\"),\n  overlapPolicy: ScheduledTaskOverlapPolicy.default(\"skip\"),\n});\nexport type MarketingDailyAnalysisTaskRequest = z.infer<typeof MarketingDailyAnalysisTaskRequest>;\n\nexport const CapabilityKind = z.enum([\"pack\", \"mcp\", \"api\", \"skill\", \"plugin\"]);\nexport type CapabilityKind = z.infer<typeof CapabilityKind>;\n\nexport const CapabilitySource = z.enum([\"built_in\", \"configured\", \"public_registry\", \"registry\", \"manual\"]);\nexport type CapabilitySource = z.infer<typeof CapabilitySource>;\n\nexport const CapabilityInstallationStatus = z.enum([\"active\", \"disabled\"]);\nexport type CapabilityInstallationStatus = z.infer<typeof CapabilityInstallationStatus>;\n\nexport const CapabilityCatalogAuthKind = z.enum([\"oauth2\", \"api_key\", \"none\", \"unknown\"]);\nexport type CapabilityCatalogAuthKind = z.infer<typeof CapabilityCatalogAuthKind>;\n\nexport const CapabilityCatalogTier = z.enum([\"verified\", \"community\"]);\nexport type CapabilityCatalogTier = z.infer<typeof CapabilityCatalogTier>;\n\nexport const CapabilityRuntime = z.object({\n  available: z.boolean().default(false),\n  mcpServerId: z.string().min(1).optional(),\n  transport: z.string().min(1).optional(),\n  notes: z.string().nullable().default(null),\n});\nexport type CapabilityRuntime = z.infer<typeof CapabilityRuntime>;\n\nexport const CapabilityCatalogItem = z.object({\n  id: z.string().min(1),\n  accountId: z.string().uuid().optional(),\n  workspaceId: z.string().uuid().optional(),\n  kind: CapabilityKind,\n  source: CapabilitySource,\n  name: z.string().min(1),\n  description: z.string().nullable().default(null),\n  category: z.string().min(1).default(\"custom\"),\n  tags: z.array(z.string().min(1)).default([]),\n  homepageUrl: z.string().url().nullable().default(null),\n  endpointUrl: z.string().url().nullable().default(null),\n  installUrl: z.string().url().nullable().default(null),\n  authModel: z.string().min(1).nullable().default(null),\n  providerDomain: z.string().min(1).nullable().default(null),\n  surfaceType: z.string().min(1).nullable().default(null),\n  transport: z.string().min(1).nullable().default(null),\n  mcpUrl: z.string().url().nullable().default(null),\n  authKind: CapabilityCatalogAuthKind.nullable().default(null),\n  credentialFacts: z.array(z.record(z.string(), z.unknown())).default([]),\n  tier: CapabilityCatalogTier.nullable().default(null),\n  provenance: z.string().min(1).nullable().default(null),\n  logoAssetPath: z.string().min(1).nullable().default(null),\n  importBatchId: z.string().uuid().nullable().default(null),\n  stale: z.boolean().default(false),\n  staleAt: z.string().nullable().default(null),\n  tools: z.array(ToolRef).default([]),\n  runtime: CapabilityRuntime.default({ available: false, notes: null }),\n  enabled: z.boolean().default(false),\n  enabledReason: z.string().nullable().default(null),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  createdAt: z.string().optional(),\n  updatedAt: z.string().optional(),\n});\nexport type CapabilityCatalogItem = z.infer<typeof CapabilityCatalogItem>;\n\nexport const CapabilityInstallation = z.object({\n  id: z.string().uuid(),\n  accountId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  capabilityId: z.string().min(1),\n  kind: CapabilityKind,\n  status: CapabilityInstallationStatus,\n  config: z.record(z.string(), z.unknown()),\n  metadata: z.record(z.string(), z.unknown()),\n  enabledAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type CapabilityInstallation = z.infer<typeof CapabilityInstallation>;\n\nexport const CreateCapabilityCatalogItemRequest = z.object({\n  id: z.string().min(1).optional(),\n  kind: CapabilityKind.exclude([\"pack\"]),\n  source: CapabilitySource.default(\"manual\"),\n  name: z.string().min(1),\n  description: z.string().min(1).optional(),\n  category: z.string().min(1).default(\"custom\"),\n  tags: z.array(z.string().min(1)).default([]),\n  homepageUrl: z.string().url().optional(),\n  endpointUrl: z.string().url().optional(),\n  installUrl: z.string().url().optional(),\n  authModel: z.string().min(1).optional(),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n});\nexport type CreateCapabilityCatalogItemRequest = z.infer<typeof CreateCapabilityCatalogItemRequest>;\n\nexport const EnableCapabilityRequest = z.object({\n  config: z.record(z.string(), z.unknown()).default({}),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  connectionRef: McpServerConnectionRef.optional(),\n  /**\n   * Credential headers for remote MCP capabilities (for example an\n   * Authorization bearer token). Values are encrypted at rest with the\n   * workspace-environments key, injected only into the runtime MCP client,\n   * and never returned by the API — responses expose header names only.\n   */\n  headers: z.record(z.string(), z.string()).default({}),\n  /**\n   * Initial environment attachment for kind=pack capabilities. Mirrors the\n   * dedicated POST /packs/:id/enable body: required to enable an\n   * environment.required pack through the unified capability-enable path,\n   * optional otherwise. Ignored by non-pack capabilities.\n   */\n  environmentId: z.string().uuid().optional(),\n});\nexport type EnableCapabilityRequest = z.infer<typeof EnableCapabilityRequest>;\n\nexport const CapabilityCatalogResponse = z.object({\n  items: z.array(CapabilityCatalogItem),\n  installations: z.array(CapabilityInstallation),\n});\nexport type CapabilityCatalogResponse = z.infer<typeof CapabilityCatalogResponse>;\n\nexport const DiscoverMcpCapabilitiesResponse = z.object({\n  items: z.array(CapabilityCatalogItem),\n  source: z.literal(\"official_mcp_registry\"),\n  sourceUrl: z.string().url(),\n});\nexport type DiscoverMcpCapabilitiesResponse = z.infer<typeof DiscoverMcpCapabilitiesResponse>;\n\nexport const Session = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  accountId: z.string().uuid(),\n  status: SessionStatus,\n  initialMessage: z.string(),\n  title: z.string().nullable(),\n  titleSource: z.enum([\"user\", \"agent\"]).nullable(),\n  // Per-session agent persona/system instructions supplied at create. Org-visible\n  // metadata (exposed like title/goal), never a secret and never a timeline event.\n  // null when the session carried none.\n  instructions: z.string().nullable(),\n  resources: z.array(ResourceRef),\n  tools: z.array(ToolRef),\n  metadata: z.record(z.string(), z.unknown()),\n  model: z.string(),\n  sandboxBackend: SandboxBackend,\n  // The OS the session's box runs. Defaults to 'linux' (today's only OS).\n  sandboxOs: SandboxOs,\n  // The shared-sandbox group the session's box belongs to. Equals the session's\n  // own id for a singleton group (today's 1:1 default); equals the parent's\n  // group when spawned shared (both sessions run in ONE box).\n  sandboxGroupId: z.string().uuid(),\n  // The first-class swappable-sandbox POINTER (bring-your-own-compute M2). NULL\n  // resolves to the session's own group sandbox (the backward-compat default);\n  // a swap sets it to the target sandbox row. active_epoch is the second epoch\n  // ABOVE the lease epoch, bumped on every swap so the routing proxy can fence a\n  // stale in-flight op and retry against the new active sandbox.\n  activeSandboxId: z.string().uuid().nullable(),\n  activeEpoch: z.number().int().nonnegative(),\n  environmentId: z.string().uuid().nullable(),\n  // Non-default first-party MCP token permissions (manager-style sessions);\n  // null means the fixed worker default set.\n  firstPartyMcpPermissions: z.array(Permission).nullable(),\n  // Per-session third-party MCP servers, metadata only. Credential values are\n  // write-only and never appear here.\n  mcpServers: z.array(SessionMcpServerMetadata).default([]),\n  // The manager session that spawned this one via session_create (set only\n  // when the creating grant carried a worker-signed sessionId claim); null for\n  // direct API creates and scheduled-task runs. When set, this session's\n  // terminal-for-now transitions wake the parent.\n  parentSessionId: z.string().uuid().nullable(),\n  // Workspace-scoped CREATE idempotency key the session was created under (the\n  // dedup target collapsing double-submit/retry races to one session); null\n  // when the create carried no key.\n  createIdempotencyKey: z.string().nullable(),\n  temporalWorkflowId: z.string().nullable(),\n  activeTurnId: z.string().uuid().nullable(),\n  // Actual input tokens of the last model call of the most recent turn; the\n  // pre-turn client-side context-compaction trigger reads it as its budget\n  // signal. Null until a turn with usage has completed.\n  lastInputTokens: z.number().int().nonnegative().nullable(),\n  lastSequence: z.number().int().nonnegative(),\n  // Multi-account Codex (P1). codexPinnedCredentialId: the account this session is\n  // manually PINNED to (null ⇒ follow the workspace active pointer).\n  // codexLastCredentialId: the account the most recent turn actually ran on (the\n  // \"Running on:\" indicator's source). Both are credential-row ids, null until set.\n  codexPinnedCredentialId: z.string().uuid().nullable(),\n  codexLastCredentialId: z.string().uuid().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type Session = z.infer<typeof Session>;\n\nexport const SessionEventType = z.enum([\n  \"session.created\",\n  \"session.status.changed\",\n  \"session.requiresAction\",\n  \"session.context.compacted\",\n  \"session.context.cleared\",\n  \"user.message\",\n  \"user.interrupt\",\n  \"user.approvalDecision\",\n  \"turn.queued\",\n  \"turn.updated\",\n  \"turn.started\",\n  \"turn.completed\",\n  \"turn.failed\",\n  \"turn.cancelled\",\n  \"turn.preempted\",\n  \"agent.message.delta\",\n  \"agent.message.completed\",\n  \"agent.reasoning.delta\",\n  \"agent.toolCall.created\",\n  \"agent.toolCall.output\",\n  \"tool.auth_needed\",\n  \"agent.updated\",\n  \"sandbox.operation.started\",\n  \"sandbox.operation.completed\",\n  \"sandbox.operation.failed\",\n  \"sandbox.command.output.delta\",\n  \"artifact.created\",\n  \"goal.set\",\n  \"goal.updated\",\n  \"goal.completed\",\n  \"goal.paused\",\n  \"goal.resumed\",\n  \"goal.continuation\",\n  // Channel-B desktop pixel-plane signals (07-channel-b §1.2). The pixel socket\n  // carries opaque RFB and cannot carry a control message the client can act on,\n  // so these ride the durable, sequenced, gap-filled Channel-A SSE spine.\n  \"stream.url.rotated\", // re-minted {url,token,expiresAt} on box rollover (event-driven)\n  \"stream.opened\", // a viewer attached (audit + refcount visibility)\n  \"stream.closed\", // a viewer detached / was reaped\n  \"stream.revoked\", // a grant was revoked → connected clients MUST disconnect now\n  // Channel-B recording signals (P4.3 / module 05 §3.4). The \"agent films itself\n  // proving the fix\" loop: ffmpeg x11grab of the SAME :0 humans watch → artifact\n  // → storage. The artifact ref rides the AVAILABLE event (storageKey, NOT a\n  // long-lived URL — clients mint a short-TTL signed GET via the route).\n  \"recording.started\", // ffmpeg launched on :0 (mode/codec/dimensions)\n  \"recording.available\", // finalized: bytes PUT to storage, replayable\n  \"recording.failed\", // ffmpeg/box-death/rollover/upload error — no artifact\n  // Channel-A structured-service notifications (P4.4 / modules/08-channel-a.md\n  // §2.2). The A2 reads (fs/git/terminal exec) are SYNCHRONOUS API-direct point\n  // queries (their result is the HTTP response, NEVER an event). What rides A1\n  // here are the side-effect NOTIFICATIONS — a path changed, git state changed,\n  // a pty opened/printed/exited — durable, sequenced, gap-filled like every\n  // other session event, so any viewer's Pierre tree / diff / terminal stays\n  // live. fs.changed/git.changed are cache-invalidation signals; the pty.*\n  // events carry the interactive terminal byte stream.\n  \"fs.changed\", // a path was created/modified/deleted (write or agent mutation)\n  \"git.changed\", // working-tree/index/HEAD changed (debounced re-probe)\n  \"terminal.pty.started\", // an interactive PTY session opened (carries ptyId)\n  \"terminal.pty.output.delta\", // PTY stdout/stderr bytes (separate from command.output)\n  \"terminal.pty.exited\", // PTY session ended (exitCode/reason)\n  \"session.title_set\",\n  // Multi-account Codex (P1): the account a session's turn runs on changed\n  // (manual switch in P1; failover/rotation in P3 reuse the same event). Drives\n  // the in-session \"Running on:\" indicator's live flip.\n  \"codex.account.switched\",\n]);\nexport type SessionEventType = z.infer<typeof SessionEventType>;\n\nexport const ToolAuthNeededPayload = z.object({\n  serverId: z.string().min(1),\n  toolName: z.string().min(1).nullable().optional(),\n  providerDomain: z.string().min(1),\n  connectionId: z.string().uuid().nullable().optional(),\n  reason: z.enum([\"missing_connection\", \"expired\", \"insufficient_scope\", \"refresh_failed\"]),\n  scopes: z.array(z.string().min(1)).optional(),\n  resource: z.string().min(1).optional(),\n  authorizationUrl: z.string().url().optional(),\n  subjectId: z.string().min(1).nullable().optional(),\n});\nexport type ToolAuthNeededPayload = z.infer<typeof ToolAuthNeededPayload>;\n\n// Channel-B stream-event payloads (07-channel-b §1.2). SessionEvent.payload is\n// z.unknown() (NOT a discriminated union) — these are standalone schemas parsed\n// explicitly at the producer (the API-direct handshake/rotation) and the SDK/\n// React consumer. The rotation payload carries the freshly-minted data-plane URL\n// + the scoped stream token so a connected client hot-swaps its noVNC socket.\nexport const StreamUrlRotatedPayload = z.object({\n  url: z.string().url(),\n  token: z.string().nullable(),\n  expiresAt: z.string().datetime().nullable(),\n  // The epoch the new URL was minted under (the box-rollover fence the client\n  // reconciles against). A client must drop a rotation event whose epoch it has\n  // already advanced past.\n  leaseEpoch: z.number().int().nonnegative(),\n  transport: z.literal(\"vnc-ws\"),\n  // The viewer holder this URL is for (so a client filters out other viewers').\n  viewerId: z.string().uuid().nullable().default(null),\n});\nexport type StreamUrlRotatedPayload = z.infer<typeof StreamUrlRotatedPayload>;\n\nexport const StreamOpenedPayload = z.object({\n  viewerId: z.string().uuid(),\n  shared: z.boolean().default(false),\n  viewerCount: z.number().int().nonnegative(),\n});\nexport type StreamOpenedPayload = z.infer<typeof StreamOpenedPayload>;\n\nexport const StreamClosedPayload = z.object({\n  viewerId: z.string().uuid(),\n  reason: z.enum([\"client-disconnect\", \"reaped\", \"revoked\", \"box-rollover\"]),\n  viewerCount: z.number().int().nonnegative(),\n});\nexport type StreamClosedPayload = z.infer<typeof StreamClosedPayload>;\n\nexport const StreamRevokedPayload = z.object({\n  viewerId: z.string().uuid().nullable().default(null),\n  reason: z.enum([\"grant-revoked\", \"session-failed\", \"admin\"]),\n});\nexport type StreamRevokedPayload = z.infer<typeof StreamRevokedPayload>;\n\n// ── Recording payloads (P4.3 / module 05 §3.4) ──────────────────────────────\n// SessionEvent.payload is z.unknown() (NOT a discriminated union) — these are\n// standalone schemas parsed explicitly at the producer (the recording activity)\n// and the SDK/React consumer. The codec/contentType pair stays consistent\n// (h264-mp4↔video/mp4, vp9-webm↔video/webm).\nexport const RecordingMode = z.enum([\"manual\", \"on-turn\", \"on-verify\"]);\nexport type RecordingMode = z.infer<typeof RecordingMode>;\nexport const RecordingCodec = z.enum([\"h264-mp4\", \"vp9-webm\"]);\nexport type RecordingCodec = z.infer<typeof RecordingCodec>;\nexport const RecordingContentType = z.enum([\"video/mp4\", \"video/webm\"]);\nexport type RecordingContentType = z.infer<typeof RecordingContentType>;\n\nexport const RecordingStartedPayload = z.object({\n  recordingId: z.string().uuid(),\n  turnId: z.string().uuid().nullable(),\n  mode: RecordingMode,\n  codec: RecordingCodec,\n  dimensions: z.tuple([z.number().int().positive(), z.number().int().positive()]),\n  framerate: z.number().int().positive(),\n  startedAt: z.string(), // ISO\n  // The verification rationale (\"agent-verification: tf apply succeeded\"). Agent-\n  // authored free text — the producer caps + scrubs it before emit.\n  reason: z.string().nullable().optional(),\n});\nexport type RecordingStartedPayload = z.infer<typeof RecordingStartedPayload>;\n\nexport const RecordingAvailablePayload = z.object({\n  recordingId: z.string().uuid(),\n  turnId: z.string().uuid().nullable(),\n  codec: RecordingCodec,\n  contentType: RecordingContentType,\n  // The @opengeni/storage object key. NO long-lived URL in the event — clients\n  // mint a short-TTL signed GET via GET …/recordings/:id/url.\n  storageKey: z.string(),\n  durationSeconds: z.number().nonnegative().nullable(),\n  sizeBytes: z.number().int().nonnegative(),\n  dimensions: z.tuple([z.number().int().positive(), z.number().int().positive()]),\n});\nexport type RecordingAvailablePayload = z.infer<typeof RecordingAvailablePayload>;\n\n// `max-bytes-exceeded` is distinct from `timeout` (the -t ceiling hitting is a\n// SUCCESSFUL finalize, never a failure) — the adversarial-review F7 fix.\nexport const RecordingFailedReason = z.enum([\n  \"ffmpeg-error\",\n  \"box-death\",\n  \"box-rollover\",\n  \"upload-failed\",\n  \"max-bytes-exceeded\",\n  \"display-unavailable\",\n]);\nexport type RecordingFailedReason = z.infer<typeof RecordingFailedReason>;\n\nexport const RecordingFailedPayload = z.object({\n  recordingId: z.string().uuid(),\n  turnId: z.string().uuid().nullable(),\n  reason: RecordingFailedReason,\n  // ffmpeg-stderr tail / error detail — agent/ffmpeg-controlled, so the producer\n  // caps + scrubs it before emit (it rides redact() like every payload).\n  detail: z.string().nullable().optional(),\n});\nexport type RecordingFailedPayload = z.infer<typeof RecordingFailedPayload>;\n\n// ── Channel-A structured services (P4.4 / modules/08-channel-a.md) ───────────\n// Two transports on one spine: the A2 request/response shapes (FsNode tree,\n// GitDiff hunks, terminal exec) are returned INLINE on synchronous API-direct\n// routes (never the bus); the A1 notification payloads below ride the durable\n// SSE event log so every viewer's Pierre tree / diff / terminal stays live.\n\n// --- A1 event payloads -------------------------------------------------------\n\n// The agent's command-output firehose, enriched. Backward-compatible widening\n// of the existing sandbox.command.output.delta (consumers read `chunk`); the\n// producer may now also stamp stream/commandId/seq for finer terminal rendering.\nexport const SandboxCommandOutputDeltaPayload = z.object({\n  stream: z.enum([\"stdout\", \"stderr\"]).default(\"stdout\"),\n  chunk: z.string(), // raw bytes, utf-8 (lossy) — terminal is opaque-ish\n  commandId: z.string().optional(), // groups deltas to one agent command\n  seq: z.number().int().nonnegative().optional(), // intra-command ordering hint\n});\nexport type SandboxCommandOutputDeltaPayload = z.infer<typeof SandboxCommandOutputDeltaPayload>;\n\nexport const FsChangeKind = z.enum([\"created\", \"modified\", \"deleted\", \"renamed\"]);\nexport type FsChangeKind = z.infer<typeof FsChangeKind>;\nexport const FsChangedPayload = z.object({\n  changes: z.array(z.object({\n    path: z.string(), // workspace-relative POSIX path\n    kind: FsChangeKind,\n    isDir: z.boolean().default(false),\n    sizeBytes: z.number().int().nonnegative().nullable().default(null),\n    oldPath: z.string().optional(), // for \"renamed\"\n  })).min(1),\n  source: z.enum([\"write\", \"watch\", \"agent\"]).default(\"write\"),\n  // Monotonic FS revision (per-lease, paired with leaseEpoch for staleness).\n  revision: z.number().int().nonnegative(),\n  // The lease epoch the revision was minted under: a client invalidates on a\n  // (leaseEpoch, revision) tuple change, never a bare revision compare (H3 —\n  // revision resets to 0 on box re-key, so a bare monotonic compare goes stale).\n  leaseEpoch: z.number().int().nonnegative().default(0),\n});\nexport type FsChangedPayload = z.infer<typeof FsChangedPayload>;\n\nexport const GitChangedPayload = z.object({\n  head: z.string().nullable(), // current branch or detached SHA\n  dirty: z.boolean(), // working tree has uncommitted changes\n  ahead: z.number().int().nonnegative().default(0),\n  behind: z.number().int().nonnegative().default(0),\n  changedFileCount: z.number().int().nonnegative(),\n  reason: z.enum([\"commit\", \"checkout\", \"stage\", \"worktree\", \"fetch\", \"unknown\"]).default(\"unknown\"),\n  revision: z.number().int().nonnegative().default(0),\n  leaseEpoch: z.number().int().nonnegative().default(0),\n});\nexport type GitChangedPayload = z.infer<typeof GitChangedPayload>;\n\nexport const TerminalPtyStartedPayload = z.object({\n  ptyId: z.string().uuid(),\n  cols: z.number().int().positive(),\n  rows: z.number().int().positive(),\n  shell: z.string(), // resolved shell, e.g. \"/bin/bash\"\n  cwd: z.string(),\n});\nexport type TerminalPtyStartedPayload = z.infer<typeof TerminalPtyStartedPayload>;\n\nexport const TerminalPtyOutputDeltaPayload = z.object({\n  ptyId: z.string().uuid(),\n  stream: z.enum([\"stdout\", \"stderr\"]).default(\"stdout\"),\n  chunk: z.string(), // raw terminal bytes (incl. ANSI), utf-8 lossy\n  seq: z.number().int().nonnegative(), // strict per-pty ordering (owner-assigned)\n});\nexport type TerminalPtyOutputDeltaPayload = z.infer<typeof TerminalPtyOutputDeltaPayload>;\n\nexport const TerminalPtyExitedPayload = z.object({\n  ptyId: z.string().uuid(),\n  exitCode: z.number().int().nullable(),\n  reason: z.enum([\"exit\", \"killed\", \"owner_gone\", \"timeout\"]),\n});\nexport type TerminalPtyExitedPayload = z.infer<typeof TerminalPtyExitedPayload>;\n\n// --- A2 FileSystem request/response (NOT events; returned inline) ------------\nexport const FsNodeType = z.enum([\"file\", \"dir\", \"symlink\", \"other\"]);\nexport type FsNodeType = z.infer<typeof FsNodeType>;\n// The Pierre-tree node. `children` is present only when the dir was listed with\n// depth>0; the tree lazy-expands via repeated depth-1 lists at deeper paths.\nexport interface FsTreeNode {\n  name: string;\n  path: string; // workspace-relative POSIX, no leading slash\n  type: z.infer<typeof FsNodeType>;\n  sizeBytes: number | null; // null for dirs\n  mtimeMs: number | null;\n  mode: number | null; // unix mode bits, for Pierre tree icons/perms\n  children?: FsTreeNode[] | undefined;\n  truncated: boolean; // dir had more entries than the cap\n}\nexport const FsTreeNode: z.ZodType<FsTreeNode> = z.lazy(() => z.object({\n  name: z.string(),\n  path: z.string(),\n  type: FsNodeType,\n  sizeBytes: z.number().int().nonnegative().nullable(),\n  mtimeMs: z.number().int().nonnegative().nullable(),\n  mode: z.number().int().nullable(),\n  children: z.array(FsTreeNode).optional(),\n  truncated: z.boolean().default(false),\n})) as z.ZodType<FsTreeNode>;\n\nexport const FsListRequest = z.object({\n  path: z.string().default(\"\"), // \"\" = workspace root\n  depth: z.number().int().min(0).max(8).default(1),\n  maxEntries: z.number().int().positive().max(20_000).default(2_000),\n  includeHidden: z.boolean().default(true),\n});\nexport type FsListRequest = z.infer<typeof FsListRequest>;\nexport const FsListResponse = z.object({\n  root: FsTreeNode,\n  revision: z.number().int().nonnegative(),\n  truncated: z.boolean(), // global cap hit\n});\nexport type FsListResponse = z.infer<typeof FsListResponse>;\n\nexport const FsEncoding = z.enum([\"utf8\", \"base64\"]);\nexport type FsEncoding = z.infer<typeof FsEncoding>;\nexport const FsReadRequest = z.object({\n  path: z.string(),\n  encoding: FsEncoding.default(\"utf8\"),\n  maxBytes: z.number().int().positive().max(25 * 1024 * 1024).default(5 * 1024 * 1024),\n});\nexport type FsReadRequest = z.infer<typeof FsReadRequest>;\nexport const FsReadResponse = z.object({\n  path: z.string(),\n  encoding: FsEncoding,\n  content: z.string(), // text or base64 per encoding\n  sizeBytes: z.number().int().nonnegative(), // bytes returned (== content size)\n  truncated: z.boolean(), // sizeBytes hit maxBytes; content is the prefix\n  isBinary: z.boolean(), // sniffed NUL byte in first 8KB\n  revision: z.number().int().nonnegative(),\n});\nexport type FsReadResponse = z.infer<typeof FsReadResponse>;\n\nexport const FsWriteRequest = z.object({\n  path: z.string(),\n  encoding: FsEncoding.default(\"utf8\"),\n  content: z.string(),\n  overwrite: z.boolean().default(true), // false + existing path => 409\n  createParents: z.boolean().default(true),\n});\nexport type FsWriteRequest = z.infer<typeof FsWriteRequest>;\nexport const FsWriteResponse = z.object({\n  path: z.string(),\n  sizeBytes: z.number().int().nonnegative(),\n  revision: z.number().int().nonnegative(), // == the fs.changed revision\n});\nexport type FsWriteResponse = z.infer<typeof FsWriteResponse>;\n\nexport const FsDeleteRequest = z.object({\n  path: z.string(),\n  recursive: z.boolean().default(false), // required true to delete a non-empty dir\n});\nexport type FsDeleteRequest = z.infer<typeof FsDeleteRequest>;\nexport const FsDeleteResponse = z.object({ revision: z.number().int().nonnegative() });\nexport type FsDeleteResponse = z.infer<typeof FsDeleteResponse>;\n\nexport const FsMoveRequest = z.object({\n  path: z.string(),\n  newPath: z.string(),\n  overwrite: z.boolean().default(false), // false + existing destination => 409\n  createParents: z.boolean().default(true),\n});\nexport type FsMoveRequest = z.infer<typeof FsMoveRequest>;\nexport const FsMoveResponse = z.object({\n  path: z.string(),\n  newPath: z.string(),\n  revision: z.number().int().nonnegative(), // == the fs.changed revision\n});\nexport type FsMoveResponse = z.infer<typeof FsMoveResponse>;\n\nexport const FsMkdirRequest = z.object({\n  path: z.string(),\n  recursive: z.boolean().default(true), // false + existing path => 400\n});\nexport type FsMkdirRequest = z.infer<typeof FsMkdirRequest>;\nexport const FsMkdirResponse = z.object({\n  path: z.string(),\n  revision: z.number().int().nonnegative(), // == the fs.changed revision\n});\nexport type FsMkdirResponse = z.infer<typeof FsMkdirResponse>;\n\n// --- A2 Git request/response (read-only; feeds Pierre diff/tree) -------------\nexport const GitFileStatusCode = z.enum([\n  \"added\", \"modified\", \"deleted\", \"renamed\", \"copied\", \"untracked\", \"ignored\", \"conflicted\", \"typechange\",\n]);\nexport type GitFileStatusCode = z.infer<typeof GitFileStatusCode>;\nexport const GitFileStatus = z.object({\n  path: z.string(),\n  oldPath: z.string().nullable(), // for renamed/copied\n  index: GitFileStatusCode.nullable(), // staged change (X in porcelain XY)\n  worktree: GitFileStatusCode.nullable(), // unstaged change (Y in porcelain XY)\n  isConflicted: z.boolean().default(false),\n});\nexport type GitFileStatus = z.infer<typeof GitFileStatus>;\nexport const GitStatusRequest = z.object({\n  path: z.string().default(\"\"), // repo root within workspace (multi-repo support)\n});\nexport type GitStatusRequest = z.infer<typeof GitStatusRequest>;\nexport const GitStatusResponse = z.object({\n  isRepo: z.boolean(),\n  head: z.string().nullable(), // branch name\n  detached: z.boolean().default(false),\n  upstream: z.string().nullable(),\n  ahead: z.number().int().nonnegative().default(0),\n  behind: z.number().int().nonnegative().default(0),\n  files: z.array(GitFileStatus),\n  revision: z.number().int().nonnegative(),\n});\nexport type GitStatusResponse = z.infer<typeof GitStatusResponse>;\n\n// The structured hunk shape that feeds Pierre diff — the whole point of Git.\nexport const GitDiffLineType = z.enum([\"context\", \"add\", \"del\", \"meta\"]);\nexport type GitDiffLineType = z.infer<typeof GitDiffLineType>;\nexport const GitDiffLine = z.object({\n  type: GitDiffLineType,\n  // null on the side that doesn't have the line (add => oldNo null; del => newNo null)\n  oldNo: z.number().int().positive().nullable(),\n  newNo: z.number().int().positive().nullable(),\n  text: z.string(), // line WITHOUT leading +/-/space marker\n});\nexport type GitDiffLine = z.infer<typeof GitDiffLine>;\nexport const GitDiffHunk = z.object({\n  oldStart: z.number().int().nonnegative(),\n  oldLines: z.number().int().nonnegative(),\n  newStart: z.number().int().nonnegative(),\n  newLines: z.number().int().nonnegative(),\n  header: z.string(), // the @@ ... @@ section heading\n  lines: z.array(GitDiffLine),\n});\nexport type GitDiffHunk = z.infer<typeof GitDiffHunk>;\nexport const GitFileDiff = z.object({\n  path: z.string(),\n  oldPath: z.string().nullable(),\n  status: GitFileStatusCode,\n  isBinary: z.boolean().default(false),\n  isImage: z.boolean().default(false),\n  additions: z.number().int().nonnegative(),\n  deletions: z.number().int().nonnegative(),\n  hunks: z.array(GitDiffHunk), // empty if binary or truncated\n  truncated: z.boolean().default(false), // diff exceeded maxBytes; hunks omitted\n});\nexport type GitFileDiff = z.infer<typeof GitFileDiff>;\nexport const GitDiffRequest = z.object({\n  path: z.string().default(\"\"), // repo root\n  // diff selectors, mutually exclusive precedence: refs > staged > worktree\n  staged: z.boolean().default(false), // --cached (index vs HEAD)\n  fromRef: z.string().optional(),\n  toRef: z.string().optional(),\n  pathspec: z.array(z.string()).default([]),\n  contextLines: z.number().int().min(0).max(10).default(3),\n  maxBytesPerFile: z.number().int().positive().max(2 * 1024 * 1024).default(512 * 1024),\n});\nexport type GitDiffRequest = z.infer<typeof GitDiffRequest>;\nexport const GitDiffResponse = z.object({\n  files: z.array(GitFileDiff),\n  revision: z.number().int().nonnegative(),\n});\nexport type GitDiffResponse = z.infer<typeof GitDiffResponse>;\n\nexport const GitLogRequest = z.object({\n  path: z.string().default(\"\"),\n  ref: z.string().default(\"HEAD\"),\n  maxCount: z.number().int().positive().max(1_000).default(100),\n  skip: z.number().int().nonnegative().default(0),\n  pathspec: z.array(z.string()).default([]),\n});\nexport type GitLogRequest = z.infer<typeof GitLogRequest>;\nexport const GitCommit = z.object({\n  sha: z.string(),\n  shortSha: z.string(),\n  parents: z.array(z.string()),\n  author: z.object({ name: z.string(), email: z.string(), timestamp: z.number().int() }),\n  committer: z.object({ name: z.string(), email: z.string(), timestamp: z.number().int() }),\n  subject: z.string(),\n  body: z.string(),\n  refs: z.array(z.string()).default([]), // decorations: branch/tag pointers\n});\nexport type GitCommit = z.infer<typeof GitCommit>;\nexport const GitLogResponse = z.object({ commits: z.array(GitCommit), hasMore: z.boolean() });\nexport type GitLogResponse = z.infer<typeof GitLogResponse>;\n\nexport const GitShowRequest = z.object({\n  path: z.string().default(\"\"),\n  ref: z.string(), // a commit/tag/tree-ish\n  filePath: z.string().optional(), // ref + filePath => raw blob (\"open file at commit\")\n  encoding: FsEncoding.default(\"utf8\"),\n  maxBytesPerFile: z.number().int().positive().max(2 * 1024 * 1024).default(512 * 1024),\n});\nexport type GitShowRequest = z.infer<typeof GitShowRequest>;\nexport const GitShowResponse = z.object({\n  commit: GitCommit.nullable(), // null when fetching a raw blob\n  files: z.array(GitFileDiff), // commit diff vs first parent\n  blob: z.object({ content: z.string(), encoding: FsEncoding, sizeBytes: z.number().int(), truncated: z.boolean() }).nullable(),\n  revision: z.number().int().nonnegative(),\n});\nexport type GitShowResponse = z.infer<typeof GitShowResponse>;\n\n// --- A2 Terminal exec (run a command in-box, stream stdout/stderr) -----------\n// The command-output FIREHOSE rides A1 (sandbox.command.output.delta). This is\n// the SYNCHRONOUS exec: run a bounded command and return its stdout/stderr +\n// exit code inline (the result IS the HTTP response). Full interactive PTY\n// (open/write/resize) layers on top via the pty.* events; exec ships now.\nexport const TerminalExecRequest = z.object({\n  command: z.string().min(1),\n  cwd: z.string().default(\"\"), // workspace-relative\n  // Soft per-call wall-clock bound (the box yields output back when reached).\n  timeoutMs: z.number().int().positive().max(120_000).default(30_000),\n  // Stream the deltas onto A1 as the agent firehose (so other viewers see it),\n  // in addition to returning the buffered result inline.\n  emitStream: z.boolean().default(true),\n});\nexport type TerminalExecRequest = z.infer<typeof TerminalExecRequest>;\nexport const TerminalExecResponse = z.object({\n  stdout: z.string(),\n  stderr: z.string(),\n  exitCode: z.number().int().nullable(),\n  // True when the process was still running when the call yielded (a long\n  // command); the remaining output drains onto A1 if emitStream was set.\n  running: z.boolean(),\n  wallTimeSeconds: z.number().nonnegative(),\n});\nexport type TerminalExecResponse = z.infer<typeof TerminalExecResponse>;\n\n// --- A2 Terminal PTY control (output rides A1) -------------------------------\nexport const PtyOpenRequest = z.object({\n  cols: z.number().int().positive().max(500).default(80),\n  rows: z.number().int().positive().max(300).default(24),\n  cwd: z.string().default(\"\"), // workspace-relative\n  shell: z.string().optional(), // default: resolved login shell\n});\nexport type PtyOpenRequest = z.infer<typeof PtyOpenRequest>;\nexport const PtyOpenResponse = z.object({\n  ptyId: z.string().uuid(),\n  // output streams as terminal.pty.output.delta on the SSE channel the client holds\n  streamVia: z.literal(\"sse-events\"),\n  supportsInput: z.boolean(), // false on backends without writeStdin\n});\nexport type PtyOpenResponse = z.infer<typeof PtyOpenResponse>;\nexport const PtyWriteRequest = z.object({ ptyId: z.string().uuid(), data: z.string() }); // utf-8 stdin\nexport type PtyWriteRequest = z.infer<typeof PtyWriteRequest>;\nexport const PtyResizeRequest = z.object({ ptyId: z.string().uuid(), cols: z.number().int().positive(), rows: z.number().int().positive() });\nexport type PtyResizeRequest = z.infer<typeof PtyResizeRequest>;\nexport const PtyCloseRequest = z.object({ ptyId: z.string().uuid() });\nexport type PtyCloseRequest = z.infer<typeof PtyCloseRequest>;\n\n// Per-session structured-service capabilities (the Channel-A slice of the\n// negotiation). The full SessionCapabilities doc already carries FileSystem /\n// Terminal / Git blocks (P0.1); this is the compact projection the SDK mirrors.\nexport const SessionStructuredCapabilities = z.object({\n  FileSystem: z.object({ available: z.boolean(), readOnly: z.boolean(), root: z.string() }),\n  Terminal: z.object({\n    events: z.boolean(), // command.output firehose (always on if a box exists)\n    exec: z.boolean(), // synchronous terminal exec\n    pty: z.object({ available: z.boolean() }), // interactive stdin (writeStdin)\n  }),\n  Git: z.object({ available: z.boolean(), repos: z.array(z.string()) }),\n});\nexport type SessionStructuredCapabilities = z.infer<typeof SessionStructuredCapabilities>;\n\nexport const SessionEvent = z.object({\n  id: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  sequence: z.number().int().positive(),\n  type: SessionEventType,\n  payload: z.unknown().default({}),\n  occurredAt: z.string(),\n  clientEventId: z.string().min(1).nullable().optional(),\n  turnId: z.string().uuid().nullable().optional(),\n});\nexport type SessionEvent = z.infer<typeof SessionEvent>;\n\nexport const CreateSessionRequest = z.object({\n  initialMessage: z.string().min(1),\n  // Per-session agent persona/system instructions (org-visible metadata, NOT a\n  // secret). Rides the SAME system-level instructions channel the per-workspace\n  // agentInstructions rides, composed AFTER the workspace persona so it refines\n  // it for this one session — how a host delivers per-agent-type prompts without\n  // leaking them into the user-visible timeline (it is NEVER emitted as an\n  // event, unlike goal/initialMessage). Trimmed, non-empty. The 32768-char cap\n  // matches the codebase's largest free-form string convention (workspace\n  // environment variable values). Absent ⇒ byte-identical to today.\n  instructions: z.string().trim().min(1).max(32768).optional(),\n  resources: z.array(ResourceRef).default([]),\n  tools: z.array(ToolRef).default([]),\n  metadata: z.record(z.string(), z.unknown()).default({}),\n  model: z.string().min(1).optional(),\n  reasoningEffort: ReasoningEffort.optional(),\n  sandboxBackend: SandboxBackend.optional(),\n  // The enrolled machine (a sandbox id) to run this session on; seeds the\n  // active-sandbox pointer at creation so the FIRST turn routes to the chosen\n  // machine (race-free: the pointer is committed before the worker turn\n  // workflow can read it). An invalid/unowned/offline target fails the create.\n  targetSandboxId: z.string().uuid().optional(),\n  // The working directory the targeted machine runs the session under — the\n  // path/cwd base for its agent exec, terminal, and file dock. Free-form pass-\n  // through: a launch-workspace_root-relative subdir or an absolute machine path\n  // (the agent's resolve_cwd handles both). Only valid WITH targetSandboxId\n  // (workingDir alone is a 422); omitted ⇒ the machine's default workspace_root.\n  workingDir: z.string().min(1).optional(),\n  // Workspace environment attachment is fixed at session creation; follow-up\n  // user.message events cannot switch or add one.\n  environmentId: z.string().uuid().optional(),\n  goal: GoalSpec.optional(),\n  clientEventId: z.string().min(1).optional(),\n  // Workspace-scoped CREATE idempotency key: collapses concurrent/retried\n  // create calls carrying the same key to a single session (partial unique\n  // index on (workspace_id, create_idempotency_key)). Distinct from\n  // clientEventId, whose uniqueness is per-session and so cannot dedup the\n  // creation of a brand-new session. Absent means no create-dedup (each call\n  // is an independent create).\n  idempotencyKey: z.string().min(1).max(200).optional(),\n  // Permissions the session's first-party MCP token should carry instead of\n  // the fixed worker default — how an operator hands a manager-style session\n  // the orchestration/environment/github tools. Capped at creation: every\n  // requested permission must be held by the creating grant (no escalation).\n  firstPartyMcpPermissions: z.array(Permission).optional(),\n  // Third-party MCP servers attached only to this session. Credential headers are\n  // write-only: create responses and events expose only SessionMcpServerMetadata.\n  mcpServers: z.array(SessionMcpServerInput).default([]),\n  // Shared-sandbox placement (addendum 05 §D.1). Three-way union; OMITTED ⇒\n  // today's behavior (a context-dependent default resolved server-side: from\n  // inside a session → \"shared\" with the creator's box, top-level → \"new\").\n  //   - \"shared\":  join the CREATOR's box. Requires a parent session (inferred\n  //                from the worker-signed sessionId claim, never caller-supplied);\n  //                top-level \"shared\" is a 422.\n  //   - \"new\":     mint a fresh singleton box (group ≡ the new session's id).\n  //   - {groupId}: join a SPECIFIC sibling group in THIS workspace (manager\n  //                fan-out). Validated workspace-scoped (cross-workspace → 404).\n  // A shared spawn inherits the box's (backend, os) — it is literally the same\n  // box; the child cannot pick its own backend. Cross-workspace sharing is\n  // forbidden by construction (the parent/group reads are RLS-workspace-scoped).\n  // ENV-AWARE: the box's environment is fixed at creation, so a share requires\n  // the SAME environmentId as the creator's box. On a mismatch the inherited\n  // default silently falls back to an own box; an explicit \"shared\"/{groupId}\n  // request 422s at create (instead of the first turn dying on the SDK's\n  // manifest-env guard).\n  sandbox: z.union([\n    z.literal(\"shared\"),\n    z.literal(\"new\"),\n    z.object({ groupId: z.string().uuid() }),\n  ]).optional(),\n});\nexport type CreateSessionRequest = z.infer<typeof CreateSessionRequest>;\n\nexport const ClientSessionEvent = z.discriminatedUnion(\"type\", [\n  z.object({\n    type: z.literal(\"user.message\"),\n    clientEventId: z.string().min(1).optional(),\n    payload: z.object({\n      text: z.string().min(1),\n      resources: z.array(ResourceRef).default([]),\n      tools: z.array(ToolRef).default([]),\n      model: z.string().min(1).optional(),\n      reasoningEffort: ReasoningEffort.optional(),\n      // Header-value rotation only. URL/name/tool settings are immutable after\n      // session create; persisted events expose metadata, never header values.\n      mcpCredentialUpdates: z.array(SessionMcpCredentialUpdateInput).optional(),\n    }),\n  }),\n  z.object({\n    type: z.literal(\"user.interrupt\"),\n    clientEventId: z.string().min(1).optional(),\n    payload: z.object({ reason: z.string().optional() }).default({}),\n  }),\n  z.object({\n    type: z.literal(\"user.approvalDecision\"),\n    clientEventId: z.string().min(1).optional(),\n    payload: z.object({\n      approvalId: z.string().min(1),\n      decision: z.enum([\"approve\", \"reject\"]),\n      message: z.string().optional(),\n    }),\n  }),\n]);\nexport type ClientSessionEvent = z.infer<typeof ClientSessionEvent>;\n\nexport const SessionBusMessage = z.object({\n  workspaceId: z.string().uuid(),\n  sessionId: z.string().uuid(),\n  events: z.array(SessionEvent).min(1),\n});\nexport type SessionBusMessage = z.infer<typeof SessionBusMessage>;\n\nexport const GitHubAppManifestCreate = z.object({\n  appName: z.string().optional(),\n  organization: z.string().optional(),\n  public: z.boolean().default(false),\n  includeCiPermissions: z.boolean().default(true),\n});\nexport type GitHubAppManifestCreate = z.infer<typeof GitHubAppManifestCreate>;\n\nexport const GitHubRepository = z.object({\n  id: z.number().int(),\n  installationId: z.number().int(),\n  fullName: z.string(),\n  name: z.string(),\n  private: z.boolean(),\n  htmlUrl: z.string(),\n  cloneUrl: z.string(),\n  defaultBranch: z.string(),\n  accountLogin: z.string(),\n  accountType: z.string().nullable(),\n});\nexport type GitHubRepository = z.infer<typeof GitHubRepository>;\n\nexport const ClientAuthConfig = z.discriminatedUnion(\"mode\", [\n  z.object({\n    mode: z.literal(\"none\"),\n  }),\n  z.object({\n    mode: z.literal(\"deploymentKey\"),\n    headerName: z.literal(\"x-opengeni-access-key\"),\n  }),\n  z.object({\n    mode: z.literal(\"configuredToken\"),\n    headerName: z.literal(\"authorization\"),\n    scheme: z.literal(\"bearer\"),\n  }),\n  z.object({\n    mode: z.literal(\"managedSession\"),\n    session: z.literal(\"cookie\"),\n  }),\n]);\nexport type ClientAuthConfig = z.infer<typeof ClientAuthConfig>;\n\n// The negotiated capability handshake document (master-spine C.3). ONE shape;\n// collapses the parallel per-module definitions. A capability cell is always\n// present with `available`/`transport` + a `reason` when unavailable — never\n// absent.\nexport const CapabilityUnavailableReason = z.enum([\n  \"backend_unsupported\",\n  \"os_unsupported\",\n  \"not_provisioned\",\n  \"disabled_by_policy\",\n  \"lease_cold\",\n  \"tier_headless\",\n  // Selfhosted (bring-your-own-compute) negotiation states (M1 additive; the\n  // selfhosted negotiation in select.ts wires them in M3):\n  \"agent_offline\", // the enrolled agent process is not running / unreachable\n  \"agent_reconnecting\", // a transient blip — the agent is reconnecting (warmable)\n  \"consent_required\", // whole-machine / screen-control consent not yet acknowledged\n  \"display_unavailable\", // headless machine with no display stack (no DesktopStream)\n]);\nexport type CapabilityUnavailableReason = z.infer<typeof CapabilityUnavailableReason>;\n\nexport const SessionCapabilities = z.object({\n  sessionId: z.string().uuid(),\n  backend: SandboxBackend,\n  os: SandboxOs,\n  liveness: z.enum([\"cold\", \"warming\", \"warm\", \"draining\"]),\n  // Echoed on viewer heartbeats (the split-brain fence).\n  leaseEpoch: z.number().int().nonnegative(),\n  viewerHeartbeatIntervalMs: z.number().int().positive().default(30_000),\n  FileSystem: z.object({\n    available: z.boolean(),\n    readOnly: z.boolean(),\n    root: z.string(),\n    pathSep: z.enum([\"/\", \"\\\\\"]),\n    treeMode: z.enum([\"lazy\", \"snapshot\"]),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  Terminal: z.object({\n    transport: z.enum([\"sse-events\", \"pty-ws\"]).nullable(),\n    ptyCapable: z.boolean(),\n    shell: z.string(),\n    // The direct-to-provider ttyd PTY-over-websocket URL (pty-ws) resolved on the\n    // SAME tunnel as the desktop; null on a cold lease / read-only sse-events\n    // firehose / degraded terminal. The scoped stream token is recorded against\n    // the holder (NEVER a URL query param), symmetric with DesktopStream.\n    url: z.string().url().nullable(),\n    token: z.string().nullable(),\n    // ISO absolute expiry of the minted stream token (symmetric with\n    // DesktopStream.expiresAt). Null when no live URL/token is minted.\n    expiresAt: z.string().nullable(),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  Git: z.object({\n    available: z.boolean(),\n    repos: z.array(z.string()),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  DesktopStream: z.object({\n    // \"relay-frames\" is the selfhosted framebuffer stream: PNG-per-frame protobuf\n    // datagrams spliced over the relay (NOT RFB). The viewer renders it with the\n    // \"frames\" client (a canvas painter), distinct from Modal's \"vnc-ws\"/\"novnc\".\n    transport: z.enum([\"vnc-ws\", \"rdp-ws\", \"webrtc\", \"relay-frames\"]).nullable(),\n    client: z.enum([\"novnc\", \"web-rdp\", \"frames\"]).nullable(),\n    mode: z.enum([\"read-only\", \"interactive\"]).default(\"read-only\"),\n    url: z.string().url().nullable(),\n    token: z.string().nullable(),\n    expiresAt: z.string().nullable(),\n    resolution: z\n      .tuple([z.number().int().positive(), z.number().int().positive()])\n      .default([1024, 768]),\n    // REQUIRED, no default (the server must assert un-redacted pixels).\n    unredacted: z.boolean(),\n    requiresAcknowledgment: z.boolean(),\n    acknowledged: z.boolean(),\n    // SHARED-EXPOSURE disclosure (addendum E.1). `shared` is true when the box's\n    // group has >1 session: watching this desktop ALSO shows the sibling\n    // sessions' agents on the one :0 framebuffer (the pixels cannot be redacted).\n    // `sharedSessionIds` lists the OTHER sessions whose agents may appear — IDS\n    // ONLY, never their goal/metadata/conversation (a viewer of A must not be\n    // able to use \"I can see B's id\" to subscribe to B's events; stress g). When\n    // shared, the consent gate requires the shared-exposure acknowledgment (409\n    // shared_acknowledgment_required) before the desktop path is handed out.\n    shared: z.boolean().default(false),\n    sharedSessionIds: z.array(z.string().uuid()).default([]),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  Recording: z.object({\n    available: z.boolean(),\n    modes: z.array(z.enum([\"manual\", \"on-turn\", \"on-verify\"])),\n    codecs: z.array(z.enum([\"h264-mp4\", \"vp9-webm\"])),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  // The AGENT drives the SAME :0 (xdotool/XTEST + scrot) the human watches; the\n  // human viewer plane is read-only by default (§6). `available` == desktop-\n  // capable backend && computerUseEnabled; `readOnly` reports whether the agent\n  // driver itself is gated to no-op input (v1 default false — the agent clicks).\n  ComputerUse: z.object({\n    available: z.boolean(),\n    readOnly: z.boolean(),\n    reason: CapabilityUnavailableReason.nullable(),\n  }),\n  negotiatedAt: z.string(),\n});\nexport type SessionCapabilities = z.infer<typeof SessionCapabilities>;\n\n// ── API-direct viewer attach (P1.4) ─────────────────────────────────────────\n// A viewer holds the GROUP lease (keeping the box warm while watched). These\n// shape the in-process attach/heartbeat/detach handlers. The scoped stream\n// token + the un-redacted-pixel acknowledgment are P3/P4 — here it is the\n// viewer-HOLDER lifecycle only.\n\n// POST .../viewers — acquire a viewer holder. An omitted viewerId mints a fresh\n// one (returned in the response, to carry through heartbeats + detach).\n//\n// `desktop` declares intent to attach the UN-REDACTED pixel plane (noVNC). ONLY\n// that plane carries the consent gate (the un-redacted/shared acknowledgment). A\n// terminal-only warm attach (`desktop:false`, the default) needs NO consent — a\n// shell is interactive by nature and the gate is the scoped tunnel URL + stream\n// token — so it warms the box and mints the pty-ws terminal cell WITHOUT a 409.\n// Omitted defaults to `false` so a terminal-only client never trips the gate.\nexport const AttachViewerRequest = z.object({\n  viewerId: z.string().uuid().optional(),\n  desktop: z.boolean().optional(),\n});\nexport type AttachViewerRequest = z.infer<typeof AttachViewerRequest>;\n\nexport const ViewerHolder = z.object({\n  viewerId: z.string().uuid(),\n  sandboxGroupId: z.string().uuid(),\n  liveness: z.enum([\"cold\", \"warming\", \"warm\", \"draining\"]),\n  // The epoch the viewer is fenced on; echoed back on heartbeats.\n  leaseEpoch: z.number().int().nonnegative(),\n  viewerHeartbeatIntervalMs: z.number().int().positive(),\n  // The desktop pixel tunnel URL the viewer connects to directly; null until\n  // P4 mints it (gated until then).\n  dataPlaneUrl: z.string().nullable(),\n});\nexport type ViewerHolder = z.infer<typeof ViewerHolder>;\n\n// POST .../stream-capabilities/acknowledge — record the calling principal's\n// acknowledgment of the un-redacted pixel plane (P3.2; modules/07-channel-b.md\n// §6 + addendum E.1). Reuses the acknowledgment machinery — no new endpoint\n// shape beyond this body, no new permission beyond stream:acknowledge.\n//\n// `acknowledgeShared` MUST be true when the box is shared (the group has >1\n// session): the un-redacted desktop path returns 409 shared_acknowledgment_required\n// until a shared box is acknowledged WITH the shared-exposure consent. For a\n// solo box `acknowledgeShared` is irrelevant (the un-redacted ack alone gates).\nexport const AcknowledgeStreamRequest = z.object({\n  // The principal accepts that the desktop pixel plane is un-redacted (can show\n  // cloud creds the agent cat's into a terminal). Always true to record consent;\n  // present for self-documentation + a future explicit withdraw.\n  acknowledgeUnredacted: z.boolean().default(true),\n  // The principal accepts the shared-exposure disclosure: watching this desktop\n  // also shows sibling sessions' agents on the one framebuffer.\n  acknowledgeShared: z.boolean().default(false),\n});\nexport type AcknowledgeStreamRequest = z.infer<typeof AcknowledgeStreamRequest>;\n\nexport const AcknowledgeStreamResponse = z.object({\n  acknowledged: z.boolean(),\n  acknowledgedShared: z.boolean(),\n});\nexport type AcknowledgeStreamResponse = z.infer<typeof AcknowledgeStreamResponse>;\n\n// POST .../viewers/:viewerId/heartbeat — refresh the holder TTL. Epoch-fenced:\n// a stale-epoch beat (a box re-established under a newer epoch) is rejected.\nexport const ViewerHeartbeatRequest = z.object({\n  leaseEpoch: z.number().int().nonnegative(),\n});\nexport type ViewerHeartbeatRequest = z.infer<typeof ViewerHeartbeatRequest>;\n\nexport const ViewerHeartbeatResponse = z.object({\n  // false ⇒ the holder was reaped or the epoch is stale; the client re-attaches.\n  alive: z.boolean(),\n});\nexport type ViewerHeartbeatResponse = z.infer<typeof ViewerHeartbeatResponse>;\n\n// =============================================================================\n// Bring-your-own-compute (M5) — enrollment device-flow HTTP contract.\n//\n// The HTTP shapes mirror the @opengeni/agent-proto device-flow messages\n// (DeviceAuthStart*, DeviceAuthPoll*, EnrollmentCredentials) so the Rust agent's\n// `enroll` command (which runs the flow over HTTP before it has NATS creds)\n// decodes the SAME field names (the proto's ts-proto JSON is camelCase). The\n// request bodies additionally carry the consent-relevant fields the dossier brief\n// mandates (the agent ed25519 pubkey + can-offer-display + requests-screen-control).\n// =============================================================================\n\nexport const EnrollmentOs = z.enum([\"linux\", \"macos\", \"windows\"]);\nexport type EnrollmentOs = z.infer<typeof EnrollmentOs>;\nexport const EnrollmentArch = z.enum([\"x86_64\", \"aarch64\"]);\nexport type EnrollmentArch = z.infer<typeof EnrollmentArch>;\n\n// POST /enrollments/device/start (agent-side, unauthenticated-at-the-user-level,\n// rate-limited). The agent presents its ed25519 public key + os/arch + the\n// requested whole-machine exposure + whether it can offer a display + whether it\n// requests screen control.\nexport const DeviceEnrollmentStartRequest = z.object({\n  // The agent's ed25519 public key (the machine identity the enrollment binds to).\n  publicKey: z.string().min(1).max(1024),\n  os: EnrollmentOs.default(\"linux\"),\n  arch: EnrollmentArch.default(\"x86_64\"),\n  // Human-friendly machine name (hostname by default).\n  machineName: z.string().min(1).max(256).optional(),\n  // v1 only supports whole-machine; kept explicit so the consent is recorded.\n  exposure: z.literal(\"whole-machine\").default(\"whole-machine\"),\n  // The agent can offer a display (a real screen / Xvfb is available).\n  canOfferDisplay: z.boolean().default(false),\n  // The agent requests screen control (computer-use); the user's allow_screen_control\n  // at approve is the AUTHORITATIVE consent.\n  requestsScreenControl: z.boolean().default(false),\n  // The workspace this machine is enrolling into. The agent is told this at install\n  // (the user picks the workspace, or the install/enroll token carries it). The user\n  // who approves must hold a grant in THIS workspace — that binding is what makes\n  // the (user-unauthenticated) start safe: it cannot grant access to a workspace no\n  // authorized user later approves in.\n  workspaceId: z.string().uuid(),\n});\nexport type DeviceEnrollmentStartRequest = z.infer<typeof DeviceEnrollmentStartRequest>;\n\n// The DeviceAuthStart response (field names match the proto's JSON).\nexport const DeviceEnrollmentStartResponse = z.object({\n  deviceCode: z.string(),\n  userCode: z.string(),\n  verificationUri: z.string(),\n  verificationUriComplete: z.string(),\n  intervalSeconds: z.number().int().positive(),\n  expiresInSeconds: z.number().int().positive(),\n});\nexport type DeviceEnrollmentStartResponse = z.infer<typeof DeviceEnrollmentStartResponse>;\n\n// POST /enrollments/device/approve (USER-authenticated, workspace-gated). The\n// LOUD CONSENT step. whole-machine is mandatory (implicit); screen-control is\n// opt-in per allow_screen_control.\nexport const DeviceEnrollmentApproveRequest = z.object({\n  userCode: z.string().min(1).max(64),\n  allowScreenControl: z.boolean().default(false),\n});\nexport type DeviceEnrollmentApproveRequest = z.infer<typeof DeviceEnrollmentApproveRequest>;\n\nexport const DeviceEnrollmentApproveResponse = z.object({\n  approved: z.boolean(),\n  enrollmentId: z.string().uuid(),\n  sandboxId: z.string().uuid(),\n  allowScreenControl: z.boolean(),\n});\nexport type DeviceEnrollmentApproveResponse = z.infer<typeof DeviceEnrollmentApproveResponse>;\n\n// POST /enrollments/device/poll (agent-side). The poll state machine.\nexport const DeviceEnrollmentPollRequest = z.object({\n  deviceCode: z.string().min(1).max(256),\n});\nexport type DeviceEnrollmentPollRequest = z.infer<typeof DeviceEnrollmentPollRequest>;\n\nexport const DeviceEnrollmentState = z.enum([\"pending\", \"authorized\", \"denied\", \"expired\", \"disabled\"]);\nexport type DeviceEnrollmentState = z.infer<typeof DeviceEnrollmentState>;\n\n// The EnrollmentCredentials (field names match the proto's JSON). natsAccountCreds\n// is a PLACEHOLDER — the real per-workspace NATS Account creds binding is\n// infra-deferred (M4/relay); the bearer + subjectPrefix are the application-tier\n// identity the agent presents today.\nexport const EnrollmentCredentialsResponse = z.object({\n  agentId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  // The signed bearer the agent presents to the control plane (the `oge_` token).\n  bearer: z.string(),\n  // The Account-scoped control-plane subject prefix the agent subscribes to:\n  // agent.<workspaceId>.<agentId>.\n  subjectPrefix: z.string(),\n  // Connect info for the control plane + stream relay (may be empty when not yet\n  // configured for this deployment — the agent surfaces \"control plane unconfigured\").\n  natsUrls: z.array(z.string()),\n  relayUrl: z.string(),\n  // The agent's PRODUCER token for the relay edge (the `ogr_` token; M8b). Presented\n  // as StreamOpen.token when the agent registers a pty/desktop channel; the relay\n  // verifies it then pairs the producer with the viewer (whose `ogs_` token the\n  // relay also verifies). Empty when the relay-token plane is unconfigured for this\n  // deployment (graceful degrade — the agent then presents an empty token the relay\n  // rejects, surfacing the gap loudly rather than silently producing a dead stream).\n  relayToken: z.string(),\n  // VESTIGIAL (M-AUTH): there is no per-machine NATS Account creds file. The agent\n  // presents the `bearer` above as the NATS connect AUTH-TOKEN; the server's\n  // auth-callout responder validates it and mints a workspace-scoped user JWT. This\n  // field echoes the bearer so a consumer reading it as the connect credential still\n  // works; new consumers should read `bearer` directly.\n  natsAccountCreds: z.string(),\n  // The minisign public key the agent pins for self-update verification.\n  updatePublicKey: z.string(),\n  consentedWholeMachine: z.boolean(),\n  consentedScreenControl: z.boolean(),\n});\nexport type EnrollmentCredentialsResponse = z.infer<typeof EnrollmentCredentialsResponse>;\n\nexport const DeviceEnrollmentPollResponse = z.object({\n  state: DeviceEnrollmentState,\n  // Present only when state === \"authorized\".\n  credentials: EnrollmentCredentialsResponse.optional(),\n});\nexport type DeviceEnrollmentPollResponse = z.infer<typeof DeviceEnrollmentPollResponse>;\n\n// GET /enrollments — a workspace's machines (the Machines dashboard surface).\nexport const EnrollmentSummary = z.object({\n  id: z.string().uuid(),\n  pubkey: z.string(),\n  exposure: z.literal(\"whole-machine\"),\n  hasDisplay: z.boolean(),\n  // Present (non-null) only when a display EXISTS but capture is blocked (macOS\n  // Screen Recording / TCC not granted): a human, actionable reason so the UI can\n  // show \"display: capture not granted\" instead of a bare \"headless\". null == capture\n  // permitted OR genuinely headless.\n  desktopUnavailableReason: z.string().nullish(),\n  allowScreenControl: z.boolean(),\n  status: z.enum([\"active\", \"revoked\"]),\n  os: EnrollmentOs,\n  arch: z.string(),\n  lastSeenAt: z.string().nullable(),\n  createdAt: z.string(),\n  revokedAt: z.string().nullable(),\n});\nexport type EnrollmentSummary = z.infer<typeof EnrollmentSummary>;\n\nexport const ListEnrollmentsResponse = z.object({\n  enrollments: z.array(EnrollmentSummary),\n});\nexport type ListEnrollmentsResponse = z.infer<typeof ListEnrollmentsResponse>;\n\nexport const RevokeEnrollmentResponse = z.object({\n  revoked: z.boolean(),\n});\nexport type RevokeEnrollmentResponse = z.infer<typeof RevokeEnrollmentResponse>;\n\n// =============================================================================\n// Enrollment UX (self-hosted enrollment UX, design 11): the click-Grant approve\n// page lookup/deny + the headless enroll-token mint/exchange. These sit beside the\n// device-flow contracts above and REUSE EnrollmentCredentialsResponse for the\n// exchange's credential payload (identical shape to the poll authorized branch).\n// =============================================================================\n\n// POST /v1/enrollments/device/lookup (USER-authenticated, NO workspace in the\n// path). The approve page (EnrollmentConsent) needs the machine details for a\n// user_code WITHOUT consuming the request. The user_code is globally unique among\n// pending rows; the route resolves its workspace, authorizes (enrollments:read),\n// and returns the machine details — or 404 (never revealing cross-workspace\n// existence) when the grant check fails or no live pending row matches.\nexport const DeviceEnrollmentLookupRequest = z.object({\n  userCode: z.string().min(1).max(64),\n});\nexport type DeviceEnrollmentLookupRequest = z.infer<typeof DeviceEnrollmentLookupRequest>;\n\n// The presentational machine details the consent screen renders (a subset of the\n// pending request — NO secrets, NO device_code).\nexport const DeviceEnrollmentLookupMachine = z.object({\n  machineName: z.string().nullable(),\n  os: EnrollmentOs,\n  arch: z.string(),\n  canOfferDisplay: z.boolean(),\n  requestsScreenControl: z.boolean(),\n});\nexport type DeviceEnrollmentLookupMachine = z.infer<typeof DeviceEnrollmentLookupMachine>;\n\nexport const DeviceEnrollmentLookupResponse = z.object({\n  workspaceId: z.string().uuid(),\n  userCode: z.string(),\n  machine: DeviceEnrollmentLookupMachine,\n  expiresAt: z.string(),\n});\nexport type DeviceEnrollmentLookupResponse = z.infer<typeof DeviceEnrollmentLookupResponse>;\n\n// POST /v1/workspaces/:workspaceId/enrollments/device/deny (USER-authenticated,\n// enrollments:manage). The explicit \"no\" at the approve page — mirrors approve.\nexport const DeviceEnrollmentDenyRequest = z.object({\n  userCode: z.string().min(1).max(64),\n});\nexport type DeviceEnrollmentDenyRequest = z.infer<typeof DeviceEnrollmentDenyRequest>;\n\nexport const DeviceEnrollmentDenyResponse = z.object({\n  denied: z.boolean(),\n});\nexport type DeviceEnrollmentDenyResponse = z.infer<typeof DeviceEnrollmentDenyResponse>;\n\n// POST /v1/workspaces/:workspaceId/enrollments/token (USER-authenticated,\n// enrollments:manage). Mints the short-TTL headless enroll token (the `oget_`\n// token). allowScreenControl bakes the screen-control consent into the token.\nexport const MintEnrollTokenRequest = z.object({\n  allowScreenControl: z.boolean().default(false),\n});\nexport type MintEnrollTokenRequest = z.infer<typeof MintEnrollTokenRequest>;\n\nexport const MintEnrollTokenResponse = z.object({\n  // The `oget_` token. SECRET — the UI shows it once with a copy-now warning.\n  token: z.string(),\n  expiresAt: z.string(),\n  expiresInSeconds: z.number().int().positive(),\n});\nexport type MintEnrollTokenResponse = z.infer<typeof MintEnrollTokenResponse>;\n\n// POST /v1/enrollments/token/exchange (UNAUTHENTICATED — the token IS the auth).\n// The agent presents the same identity fields it sends to device/start plus the\n// enroll token. On a valid token the control plane performs the SAME finalize as\n// approve and returns the IDENTICAL EnrollmentCredentialsResponse shape (so the\n// agent's existing credential parsing is reused).\nexport const EnrollTokenExchangeRequest = z.object({\n  // The `oget_` enroll token (the auth + the workspace/account/consent grant).\n  token: z.string().min(1),\n  // The agent's ed25519 public key (the machine identity the enrollment binds to).\n  publicKey: z.string().min(1).max(1024),\n  os: EnrollmentOs.default(\"linux\"),\n  arch: EnrollmentArch.default(\"x86_64\"),\n  machineName: z.string().min(1).max(256).optional(),\n  // v1 only supports whole-machine; kept explicit so the consent is recorded.\n  exposure: z.literal(\"whole-machine\").default(\"whole-machine\"),\n  canOfferDisplay: z.boolean().default(false),\n  // The agent's REQUEST; the token's allowScreenControl is the AUTHORITATIVE consent.\n  requestsScreenControl: z.boolean().default(false),\n});\nexport type EnrollTokenExchangeRequest = z.infer<typeof EnrollTokenExchangeRequest>;\n\n// The exchange wraps the EXISTING EnrollmentCredentialsResponse — IDENTICAL to the\n// poll authorized branch's `credentials` (NOT a redefined credential shape).\nexport const EnrollTokenExchangeResponse = z.object({\n  credentials: EnrollmentCredentialsResponse,\n});\nexport type EnrollTokenExchangeResponse = z.infer<typeof EnrollTokenExchangeResponse>;\n\n// ── Machines dashboard + per-machine metrics (M10, dossier §10.7) ────────────\n//\n// The SHARED data contract M10 (backend) implements + M9 (UI) renders. THE\n// orchestrator owns this shape; M9 imports these types so the dashboard never\n// drifts from the API. The fields mirror the agent's MetricsSample wire shape\n// (`@opengeni/agent-proto`) projected to the dashboard's JSON, plus the derived\n// machine state matrix (the M3 liveness + the consent/display reasons).\n\n/**\n * A point-in-time machine metrics sample as the dashboard reads it. `cpuPct` and\n * the load averages are 0..N doubles; the byte figures are integers; `gpuUtilPct`\n * / `gpuMemBytes` are null when no GPU was present at sample time (the wire\n * contract: absence == not-reported, NEVER a real zero). `runQueue` is the\n * runnable-count contention signal. `sampledAt` is an ISO-8601 instant.\n */\nexport const MetricSample = z.object({\n  cpuPct: z.number(),\n  load1: z.number(),\n  load5: z.number(),\n  load15: z.number(),\n  memUsedBytes: z.number().int(),\n  memTotalBytes: z.number().int(),\n  diskUsedBytes: z.number().int(),\n  diskTotalBytes: z.number().int(),\n  gpuUtilPct: z.number().nullable(),\n  gpuMemBytes: z.number().int().nullable(),\n  runQueue: z.number(),\n  sampledAt: z.string(),\n});\nexport type MetricSample = z.infer<typeof MetricSample>;\n\n/** The derived dashboard state of a machine. The M3 liveness\n *  (online/reconnecting/offline) plus the enrollment-derived consent/display\n *  reasons (consent_required / display_unavailable) and the in-flight device-flow\n *  (enrolling). */\nexport const MachineState = z.enum([\n  \"online\",\n  \"reconnecting\",\n  \"offline\",\n  \"consent_required\",\n  \"display_unavailable\",\n  \"enrolling\",\n]);\nexport type MachineState = z.infer<typeof MachineState>;\n\nexport const MachineKind = z.enum([\"modal\", \"selfhosted\"]);\nexport type MachineKind = z.infer<typeof MachineKind>;\n\n/**\n * A machine as the Machines dashboard renders it. The workspace's enrolled\n * selfhosted machines PLUS the session's synthetic Modal group box\n * (`isSessionGroup: true`). `active` marks the session's currently-active\n * routing target. `sharedSessionCount` is the lease refcount (how many sessions\n * share this whole machine). `metrics` is the latest sample, or null when none\n * has landed yet (just enrolled / offline before a first heartbeat).\n */\nexport const MachineView = z.object({\n  sandboxId: z.string(),\n  enrollmentId: z.string().nullable(),\n  name: z.string(),\n  kind: MachineKind,\n  state: MachineState,\n  active: z.boolean(),\n  isSessionGroup: z.boolean(),\n  os: z.string(),\n  arch: z.string(),\n  hasDisplay: z.boolean(),\n  // Non-null only when a display exists but capture is blocked (macOS Screen\n  // Recording / TCC not granted) — the UI can surface \"display: capture not granted\".\n  // null == capture permitted OR headless.\n  desktopUnavailableReason: z.string().nullish(),\n  allowScreenControl: z.boolean(),\n  sharedSessionCount: z.number().int(),\n  lastSeenAt: z.string().nullable(),\n  metrics: MetricSample.nullable(),\n});\nexport type MachineView = z.infer<typeof MachineView>;\n\n/**\n * GET /v1/workspaces/:ws/machines — the dashboard list. `activeSandboxId` /\n * `activeEpoch` echo the session's epoch-fenced active-sandbox pointer (null\n * activeSandboxId == the session's own group box is active).\n */\nexport const MachinesResponse = z.object({\n  activeSandboxId: z.string().nullable(),\n  activeEpoch: z.number().int(),\n  machines: z.array(MachineView),\n});\nexport type MachinesResponse = z.infer<typeof MachinesResponse>;\n\n/**\n * POST /v1/workspaces/:ws/sessions/:sessionId/active-sandbox — the user-\n * authenticated swap of a session's active sandbox (the same epoch-fenced\n * mechanic the M7 `sandbox_swap` MCP tool exposes to the agent). `target` is a\n * `MachinesResponse` machine's `sandboxId`, or \"session\"/\"default\" to swap back\n * to the session's own group box.\n */\nexport const SwapActiveSandboxRequest = z.object({\n  target: z.string().min(1),\n});\nexport type SwapActiveSandboxRequest = z.infer<typeof SwapActiveSandboxRequest>;\n\n/**\n * The swap outcome (mirrors the server `FleetSwapResult`). `swapped` is true on a\n * successful repoint OR a no-op (already pointed there); `reason` carries the\n * failure detail (unowned/offline target, or a lost epoch fence) when false.\n */\nexport const SwapActiveSandboxResponse = z.object({\n  swapped: z.boolean(),\n  activeSandboxId: z.string().nullable(),\n  activeEpoch: z.number().int(),\n  reason: z.string().optional(),\n});\nexport type SwapActiveSandboxResponse = z.infer<typeof SwapActiveSandboxResponse>;\n\n/**\n * GET /v1/workspaces/:ws/machines/:enrollmentId/metrics/series?window=1h — the\n * downsampled (~1/min) history the dashboard time-range reads.\n */\nexport const MachineMetricsSeriesResponse = z.object({\n  samples: z.array(MetricSample),\n});\nexport type MachineMetricsSeriesResponse = z.infer<typeof MachineMetricsSeriesResponse>;\n\n/**\n * A single host-exposed model + the provider that serves it, as surfaced to\n * clients (SDK + React composer) by GET /v1/config/client. The wire `api`\n * (\"responses\" | \"chat\") lets a client reason about provider capabilities; the\n * provider id/label drive the picker's grouping. This mirrors the runtime's\n * ConfiguredModel (packages/config) projected to the client-safe fields.\n */\nexport const ClientModel = z.object({\n  id: z.string(),\n  label: z.string(),\n  provider: z.string(),        // provider id\n  providerLabel: z.string(),\n  api: z.enum([\"responses\", \"chat\"]),\n  contextWindowTokens: z.number().int().positive().optional(),\n});\nexport type ClientModel = z.infer<typeof ClientModel>;\n\nexport const ClientConfig = z.object({\n  deploymentRevision: z.string(),\n  // Release-train version of the server (absent on dev/source builds). The\n  // compatibility policy lives in docs/architecture.md — clients within the\n  // same major are supported; evolution is additive within a major.\n  serverVersion: z.string().optional(),\n  defaultModel: z.string(),\n  allowedModels: z.array(z.string()).min(1),\n  // Richer model list (provider-grouped) for the picker. Defaults to [] for\n  // back-compat: callers that only read allowedModels are unaffected.\n  models: z.array(ClientModel).default([]),\n  defaultReasoningEffort: ReasoningEffort,\n  allowedReasoningEfforts: z.array(ReasoningEffort).min(1),\n  mcpServers: z.array(z.object({\n    id: z.string(),\n    name: z.string(),\n  })).default([]),\n  fileUploads: z.object({\n    enabled: z.boolean(),\n    maxSizeBytes: z.number().int().positive(),\n  }),\n  productAccessMode: ProductAccessMode,\n  auth: ClientAuthConfig.default({ mode: \"none\" }),\n  // Server-wide hint: does this deployment support Channel-A structured services\n  // at all (P4.4). Per-session availability is negotiated on /stream-capabilities\n  // (it depends on the session's pinned backend); this is the coarse on/off the\n  // client uses to decide whether to even attempt the fs/git/terminal panels.\n  structuredServices: z.object({\n    fileSystem: z.boolean(),\n    git: z.boolean(),\n    terminalEvents: z.boolean(),\n  }).default({ fileSystem: false, git: false, terminalEvents: false }),\n});\nexport type ClientConfig = z.infer<typeof ClientConfig>;\n\nfunction base64UrlEncode(value: string): string {\n  return Buffer.from(value, \"utf8\").toString(\"base64url\");\n}\n\nfunction base64UrlDecode(value: string): string {\n  return Buffer.from(value, \"base64url\").toString(\"utf8\");\n}\n\nasync function hmacSha256Base64Url(secret: string, value: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    new TextEncoder().encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const signature = await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(value));\n  return Buffer.from(signature).toString(\"base64url\");\n}\n\nfunction constantTimeEqual(actual: string, expected: string): boolean {\n  const actualBytes = new TextEncoder().encode(actual);\n  const expectedBytes = new TextEncoder().encode(expected);\n  if (actualBytes.length !== expectedBytes.length) {\n    return false;\n  }\n  let diff = 0;\n  for (let index = 0; index < actualBytes.length; index += 1) {\n    diff |= actualBytes[index]! ^ expectedBytes[index]!;\n  }\n  return diff === 0;\n}\n\nexport type HealthResponse = {\n  service: string;\n  environment: string;\n  ok: boolean;\n};\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,gBAAgB,EAAE,KAAK;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQM,IAAM,iBAAiB,EAAE,KAAK;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAIM,IAAM,YAAY,EAAE,KAAK,CAAC,SAAS,SAAS,SAAS,CAAC;AAItD,IAAM,wBAAwB,EAAE,KAAK;AAAA,EAC1C;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF,CAAC;AA6CM,IAAM,sBAAsB;AAM5B,IAAM,uBAAuB;AAM7B,IAAM,yBAAuE;AAAA,EAClF,OAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,gBAAgB,KAAK,KAAK,KAAK;AAAA,MAC/B,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,aAAa,gBAAgB,KAAK;AAAA,IACpD,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,MAAM;AAAA;AAAA,IACtE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,SAAS;AAAA,IACP,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,sBAAsB,gBAAgB,KAAK;AAAA,IAC7D,cAAc,EAAE,MAAM,eAAe,uBAAuB,MAAM;AAAA,IAClE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,SAAS;AAAA,IACP,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA,MACjE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,sBAAsB,gBAAgB,KAAK;AAAA,IAC7D,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,MAAM;AAAA;AAAA,IACtE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,KAAK;AAAA,IACH,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA;AAAA,MACjE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,sBAAsB,gBAAgB,KAAK;AAAA,IAC7D,cAAc,EAAE,MAAM,eAAe,uBAAuB,MAAM;AAAA,IAClE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA;AAAA,MACjE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,YAAY,gBAAgB,KAAK;AAAA,IACnD,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,KAAK;AAAA;AAAA,IACrE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,YAAY;AAAA,IACV,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,YAAY,gBAAgB,KAAK;AAAA,IACnD,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,MAAM;AAAA,IACtE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA,MACjE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,gBAAgB,IAAI,KAAK,KAAK;AAAA,MAC9B,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,YAAY,gBAAgB,KAAK;AAAA,IACnD,cAAc,EAAE,MAAM,eAAe,uBAAuB,MAAM;AAAA,IAClE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,cAAc,gBAAgB,KAAK;AAAA,IACrD,cAAc,EAAE,MAAM,cAAc,uBAAuB,MAAM;AAAA,IACjE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,OAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA,IAGT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,cAAc,KAAK,KAAK;AAAA,MAChE,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,cAAc,gBAAgB,KAAK;AAAA,IACrD,cAAc,EAAE,MAAM,cAAc,uBAAuB,MAAM;AAAA,IACjE,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA,MAAM;AAAA,IACJ,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,SAAS,QAAQ;AAAA,IAC7C,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,OAAO,UAAU,KAAK;AAAA,MAC/C,UAAU,EAAE,WAAW,OAAO,WAAW,MAAM,KAAK,MAAM;AAAA,MAC1D,KAAK,EAAE,WAAW,MAAM;AAAA,MACxB,eAAe,EAAE,WAAW,OAAO,WAAW,KAAK;AAAA,MACnD,WAAW,EAAE,WAAW,MAAM;AAAA,IAChC;AAAA,IACA,UAAU;AAAA,MACR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU,EAAE,MAAM,QAAQ,gBAAgB,MAAM;AAAA,IAChD,cAAc,EAAE,MAAM,QAAQ,uBAAuB,MAAM;AAAA,IAC3D,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,YAAY;AAAA,IACV,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,IAAI,EAAE,WAAW,CAAC,SAAS,SAAS,SAAS,GAAG,SAAS,QAAQ;AAAA,IACjE,cAAc;AAAA,MACZ,YAAY,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,MAC/C,UAAU,EAAE,WAAW,MAAM,WAAW,UAAU,KAAK,KAAK;AAAA;AAAA,MAC5D,KAAK,EAAE,WAAW,KAAK;AAAA,MACvB,eAAe,EAAE,WAAW,MAAM,WAAW,SAAS;AAAA;AAAA,MACtD,WAAW,EAAE,WAAW,KAAK;AAAA;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,MAKR,0BAA0B;AAAA,MAC1B,eAAe;AAAA,MACf,uBAAuB;AAAA,MACvB,kBAAkB;AAAA;AAAA,IACpB;AAAA;AAAA;AAAA;AAAA,IAIA,UAAU,EAAE,MAAM,QAAQ,gBAAgB,MAAM;AAAA,IAChD,cAAc,EAAE,MAAM,mBAAmB,uBAAuB,KAAK;AAAA,IACrE,eAAe;AAAA;AAAA,IACf,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AACF;AAEO,IAAM,kBAAkB,EAAE,KAAK,CAAC,QAAQ,WAAW,OAAO,UAAU,QAAQ,OAAO,CAAC;AAGpF,IAAM,YAAY,EAAE,KAAK;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,OAAO,EAAE,OAAO;AAAA,IACd,MAAM;AAAA,IACN,SAAS,EAAE,OAAO;AAAA,IAClB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACtD,CAAC;AACH,CAAC;AAGM,IAAM,aAAa,EAAE,KAAK;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA,EACA;AACF,CAAC;AAGM,SAAS,oBAAoBA,aAAoB,UAA0B;AAChF,SAAO,GAAGA,WAAU,KAAK,QAAQ;AACnC;AAEO,IAAM,oBAAoB,EAAE,KAAK,CAAC,SAAS,cAAc,SAAS,CAAC;AAGnE,IAAM,cAAc,EAAE,KAAK,CAAC,YAAY,QAAQ,CAAC;AAGjD,IAAM,mBAAmB,EAAE,KAAK,CAAC,QAAQ,UAAU,SAAS,CAAC;AAG7D,IAAM,kBAAkB,EAAE,KAAK,CAAC,QAAQ,UAAU,SAAS,CAAC;AAG5D,IAAM,cAAc,EAAE,KAAK,CAAC,SAAS,SAAS,QAAQ,CAAC;AAGvD,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,YAAY,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,eAAe,EAAE,OAAO;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,MAAM,YAAY,SAAS;AAAA,EAC3B,aAAa,EAAE,MAAM,UAAU;AAAA,EAC/B,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AACvD,CAAC;AAGM,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,aAAa,EAAE,MAAM,UAAU;AAAA,EAC/B,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AACvD,CAAC;AAGM,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,MAAM;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,eAAe,EAAE,MAAM,YAAY;AAAA,EACnC,iBAAiB,EAAE,MAAM,WAAW;AAAA,EACpC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACjD,CAAC;AAGM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,aAAa,EAAE,MAAM,UAAU,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,EAGtC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,yBAAyB,QAAgB,SAAuD;AACpH,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,4BAA4B,MAAM,OAAO,CAAC,CAAC;AACjG,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,OAAO,cAAc,IAAI,SAAS;AAC3C;AAEA,eAAsB,2BAA2B,QAAgB,OAAe,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAgD;AACvK,MAAI,CAAC,MAAM,WAAW,MAAM,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,OAAO,MAAM;AAC/C,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,QAAM,UAAU,4BAA4B,UAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC,CAAC;AACjG,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAaO,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE9B,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,qBAAqB,QAAgB,SAAmD;AAC5G,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,wBAAwB,MAAM,OAAO,CAAC,CAAC;AAC7F,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,OAAO,cAAc,IAAI,SAAS;AAC3C;AAEA,eAAsB,uBAAuB,QAAgB,OAAe,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAA4C;AAC/J,MAAI,CAAC,MAAM,WAAW,MAAM,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,OAAO,MAAM;AAC/C,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,QAAM,UAAU,wBAAwB,UAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC,CAAC;AAC7F,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAgBO,IAAM,qBAAqB,EAAE,OAAO;AAAA;AAAA;AAAA,EAGzC,KAAK,EAAE,QAAQ,QAAQ;AAAA,EACvB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA,EAG3B,oBAAoB,EAAE,QAAQ;AAAA,EAC9B,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAClC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,gBAAgB,QAAgB,SAA8C;AAClG,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,mBAAmB,MAAM,OAAO,CAAC,CAAC;AACxF,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,QAAQ,cAAc,IAAI,SAAS;AAC5C;AAUA,eAAsB,kBAAkB,QAAgB,OAAe,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAuC;AACrJ,MAAI,CAAC,MAAM,WAAW,OAAO,GAAG;AAC9B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,QAAQ,MAAM;AAChD,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,mBAAmB,UAAU,OAAO;AACpD,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAmBO,IAAM,qBAAqB,EAAE,OAAO;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE3B,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE1B,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EAEzC,MAAM,EAAE,KAAK,CAAC,QAAQ,SAAS,CAAC;AAAA;AAAA,EAEhC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAGhC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,gBAAgB,QAAgB,SAA8C;AAClG,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,mBAAmB,MAAM,OAAO,CAAC,CAAC;AACxF,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,OAAO,cAAc,IAAI,SAAS;AAC3C;AAYA,eAAsB,kBAAkB,QAAgB,OAAe,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAuC;AACrJ,MAAI,CAAC,MAAM,WAAW,MAAM,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,OAAO,MAAM;AAC/C,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,mBAAmB,UAAU,OAAO;AACpD,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAyBO,IAAM,oBAAoB,EAAE,OAAO;AAAA;AAAA;AAAA,EAGxC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE7B,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAEzB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACjC,CAAC;AAGD,eAAsB,eAAe,QAAgB,SAA6C;AAChG,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,kBAAkB,MAAM,OAAO,CAAC,CAAC;AACvF,QAAM,YAAY,MAAM,oBAAoB,QAAQ,cAAc;AAClE,SAAO,OAAO,cAAc,IAAI,SAAS;AAC3C;AAWA,eAAsB,iBAAiB,QAAgB,OAAe,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAsC;AACnJ,MAAI,CAAC,MAAM,WAAW,MAAM,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,MAAM,MAAM,OAAO,MAAM;AAC/C,QAAM,MAAM,cAAc,YAAY,GAAG;AACzC,MAAI,OAAO,GAAG;AACZ,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,cAAc,MAAM,GAAG,GAAG;AACjD,QAAM,YAAY,cAAc,MAAM,MAAM,CAAC;AAC7C,QAAM,WAAW,MAAM,oBAAoB,QAAQ,cAAc;AACjE,MAAI,CAAC,kBAAkB,WAAW,QAAQ,GAAG;AAC3C,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,UAAU,kBAAkB,UAAU,OAAO;AACnD,MAAI,CAAC,QAAQ,WAAW,QAAQ,KAAK,MAAM,YAAY;AACrD,WAAO;AAAA,EACT;AACA,SAAO,QAAQ;AACjB;AAEO,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAC3D,CAAC;AAGM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAG5C,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAC3D,CAAC;AAGM,IAAM,SAAS,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,MAAM,EAAE,OAAO;AAAA,EACf,QAAQ,EAAE,OAAO;AAAA,EACjB,aAAa,EAAE,MAAM,UAAU;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,aAAa,EAAE,MAAM,UAAU,EAAE,IAAI,CAAC;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC;AAGM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,QAAQ;AAAA,EACR,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AACzB,CAAC;AAMM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,MAAM,EAAE,OAAO;AAAA,EACf,aAAa,EAAE,MAAM,UAAU;AAAA,EAC/B,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,SAAS,EAAE,MAAM,eAAe;AAClC,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA;AAAA;AAAA,EAGhD,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,aAAa,EAAE,MAAM,UAAU;AACjC,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,aAAa,EAAE,MAAM,UAAU;AACjC,CAAC;AAGM,IAAM,iBAAiB,EAAE,KAAK;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA;AAAA,EAEA;AACF,CAAC;AAGM,IAAM,aAAa,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW;AAAA,EACX,UAAU,EAAE,OAAO;AAAA,EACnB,MAAM,EAAE,OAAO;AAAA,EACf,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,gBAAgB,EAAE,OAAO;AAAA,EACzB,YAAY,EAAE,OAAO;AAAA,EACrB,YAAY,EAAE,OAAO;AAAA,EACrB,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAC9C,CAAC;AAGM,IAAM,cAAc,EAAE,KAAK;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,yBAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9D,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7D,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACzD,iCAAiC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACtE,8BAA8B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,gCAAgC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACrE,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC7E,CAAC;AAGM,IAAM,mBAAmB,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,EAAE,OAAO,GAAG,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAG3F,IAAM,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,gBAAgB;AAGjE,IAAM,gBAAgB,EAAE,mBAAmB,WAAW;AAAA,EAC3D,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;AAAA,EACrC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,GAAG,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC;AAC/E,CAAC;AAsBM,IAAM,sBAAsB,EAAE,mBAAmB,WAAW;AAAA,EACjE,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI,GAAG,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAAA,EACtE,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,GAAG,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC1H,CAAC;AA+HM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,eAAe,EAAE,OAAO,EAAE,IAAI;AAAA,EAC9B,UAAU,EAAE,QAAQ,KAAK;AAAA,EACzB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAM,EAAE;AAAA,IACvC,CAAC,UAAU,OAAO,SAAS,KAAK,KAAK,KAAK,IAAI,QAAQ,KAAK,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI;AAAA,IACvF,EAAE,SAAS,oCAAoC;AAAA,EACjD;AAAA,EACA,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACvC,CAAC;AAGM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,mBAAmB,EAAE,OAAO;AAAA,EAC5B,KAAK,EAAE,OAAO,EAAE,IAAI;AACtB,CAAC;AAGM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,MAAM,EAAE,QAAQ,YAAY;AAAA,EAC5B,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACpC,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3D,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC3D,CAAC;AAGM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,QAAQ,MAAM;AAAA,EACtB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACxC,CAAC;AAGM,IAAM,cAAc,EAAE,mBAAmB,QAAQ,CAAC,uBAAuB,eAAe,CAAC;AAGzF,IAAM,aAAa,EAAE,KAAK,CAAC,kBAAkB,SAAS,UAAU,WAAW,SAAS,CAAC;AAGrF,IAAM,mBAAmB,EAAE,KAAK,CAAC,WAAW,aAAa,WAAW,QAAQ,CAAC;AAG7E,IAAM,YAAY,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ;AAAA,EACR,UAAU,EAAE,OAAO;AAAA,EACnB,cAAc,EAAE,OAAO;AAAA,EACvB,aAAa,EAAE,OAAO;AAAA,EACtB,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,QAAQ,EAAE,OAAO;AAAA,EACjB,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACrC,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,EACvB,iBAAiB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAAA,EAChD,WAAW,EAAE,OAAO;AAAA,EACpB,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC1C,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,MAAM;AACR,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,KAAK,EAAE,OAAO,EAAE,IAAI;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,iBAAiB,EAAE,KAAK,CAAC,UAAU,YAAY,SAAS,QAAQ,CAAC;AAGvE,IAAM,sBAAsB,EAAE,KAAK,CAAC,iBAAiB,sBAAsB,cAAc,SAAS,QAAQ,YAAY,OAAO,OAAO,CAAC;AAGrI,IAAM,qBAAqB,EAAE,KAAK,CAAC,UAAU,UAAU,SAAS,CAAC;AAGjE,IAAM,eAAe,EAAE,OAAO;AAAA,EACnC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAM,EAAE,OAAO;AAAA,EACf,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,WAAW,EAAE,OAAO;AAAA,EAC/B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ;AAAA,EACR,OAAO,EAAE,OAAO;AAAA,EAChB,QAAQ,EAAE,OAAO;AAAA,EACjB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,YAAY;AAAA,EACZ,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC3B,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO;AAAA,EAChB,WAAW;AAAA,EACX,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,YAAY;AAAA,EACZ,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;AAC7B,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAGM,IAAM,qBAAqB,EAAE,OAAO;AAAA,EACzC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,YAAY,oBAAoB,SAAS;AAAA,EACzC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC7C,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EAChE,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EAChE,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC1C,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAC/C,CAAC;AAGM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS;AAAA,EAC7C,MAAM,mBAAmB,SAAS;AAAA,EAClC,aAAa,EAAE,MAAM,mBAAmB,EAAE,SAAS;AAAA,EACnD,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AACtD,CAAC;AAGM,IAAM,wBAAwB,EAAE,KAAK,CAAC,YAAY,YAAY,UAAU,CAAC;AAGzE,IAAM,sBAAsB,EAAE,KAAK,CAAC,YAAY,YAAY,cAAc,YAAY,YAAY,CAAC;AAGnG,IAAM,qBAAqB,EAAE,OAAO;AAAA,EACzC,MAAM,EAAE,KAAK,CAAC,kBAAkB,YAAY,iBAAiB,UAAU,UAAU,CAAC;AAAA,EAClF,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,EACf,YAAY,EAAE,MAAM,kBAAkB;AAAA,EACtC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,QAAQ,sBAAsB,QAAQ,UAAU;AAAA,EAChD,MAAM,oBAAoB,QAAQ,UAAU;AAAA,EAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,WAAW;AAAA,EAC5C,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,YAAY,EAAE,MAAM,kBAAkB,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClD,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACjD,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,QAAQ,sBAAsB,SAAS;AAAA,EACvC,MAAM,oBAAoB,SAAS;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,MAAM,kBAAkB,EAAE,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC9C,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACrD,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACzC,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,QAAQ,sBAAsB,SAAS;AAAA,EACvC,MAAM,oBAAoB,SAAS;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AACxD,CAAC;AAGM,IAAM,UAAU,EAAE,OAAO;AAAA,EAC9B,MAAM,EAAE,QAAQ,KAAK;AAAA,EACrB,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOpB,UAAU,EAAE,QAAQ,EAAE,SAAS;AACjC,CAAC;AAGD,IAAM,aAAa;AACnB,IAAM,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU;AAClD,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE,aAAa;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF,GAAG,EAAE,SAAS,qBAAqB,CAAC;AAE7B,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,UAAU;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,KAAK;AAAA,EACL,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAClD,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,gBAAgB,EAAE,QAAQ,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMrC,iBAAiB,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAG7E,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS;AACrD,CAAC;AAGM,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,UAAU;AAAA,EACtC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAC1C,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,UAAU;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,KAAK;AAAA,EACL,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3C,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC/C,CAAC,EAAE,OAAO;AAGH,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,cAAc,UAAqB,WAAiC;AAClF,QAAM,QAAQ,oBAAI,IAAqB;AACvC,QAAM,QAAkB,CAAC;AACzB,aAAW,QAAQ,CAAC,GAAG,UAAU,GAAG,SAAS,GAAG;AAC9C,UAAM,MAAM,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE;AACnC,UAAM,QAAQ,MAAM,IAAI,GAAG;AAC3B,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,KAAK,IAAI;AACnB,YAAM,KAAK,GAAG;AACd;AAAA,IACF;AAKA,QAAI,MAAM,aAAa,QAAQ,KAAK,aAAa,MAAM;AACrD,YAAM,EAAE,UAAU,UAAU,GAAG,OAAO,IAAI;AAC1C,YAAM,IAAI,KAAK,MAAM;AAAA,IACvB;AAAA,EACF;AACA,SAAO,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,GAAG,CAAE;AAC3C;AAEO,SAAS,kBACd,UACA,WACA,UAAyC,CAAC,GAC3B;AACf,QAAM,MAAM,CAAC,GAAG,QAAQ;AACxB,QAAM,aAAa,IAAI,IAAI,SAAS,QAAQ,CAAC,aAAa,SAAS,YAAY,CAAC,CAAC,SAAS,WAAW,WAAW,QAAQ,CAAC,CAAU,IAAI,CAAC,CAAC,CAAC;AAC1I,QAAM,aAAa,IAAI,IAAI,SAAS,IAAI,CAAC,aAAa,CAAC,oBAAoB,QAAQ,GAAG,WAAW,QAAQ,CAAC,CAAU,CAAC;AACrH,QAAM,QAAQ,IAAI,IAAI,SAAS,IAAI,UAAU,CAAC;AAE9C,aAAW,YAAY,WAAW;AAChC,UAAM,aAAa,WAAW,QAAQ;AACtC,QAAI,MAAM,IAAI,UAAU,GAAG;AACzB;AAAA,IACF;AACA,QAAI,QAAQ,iBAAiB;AAC3B,YAAM,kBAAkB,SAAS,YAAY,WAAW,IAAI,SAAS,SAAS,IAAI;AAClF,UAAI,mBAAmB,oBAAoB,YAAY;AACrD,cAAM,IAAI,yBAAyB,4CAA4C,SAAS,SAAS,EAAE;AAAA,MACrG;AACA,YAAM,WAAW,oBAAoB,QAAQ;AAC7C,YAAM,mBAAmB,WAAW,IAAI,QAAQ;AAChD,UAAI,oBAAoB,qBAAqB,YAAY;AACvD,cAAM,IAAI,yBAAyB,yDAAyD,QAAQ,EAAE;AAAA,MACxG;AAAA,IACF;AACA,QAAI,KAAK,QAAQ;AACjB,UAAM,IAAI,UAAU;AACpB,eAAW,IAAI,oBAAoB,QAAQ,GAAG,UAAU;AACxD,QAAI,SAAS,WAAW;AACtB,iBAAW,IAAI,SAAS,WAAW,UAAU;AAAA,IAC/C;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,2BAA2B,UAAmC,UAA4C;AACxH,QAAM,QAAQ,SAAS;AACvB,SAAO,UAAU,UAAU,UAAU,aAAa,UAAU,SAAS,UAAU,YAAY,UAAU,UAAU,UAAU,UACrH,QACA;AACN;AAEO,SAAS,WAAW,OAAwB;AACjD,SAAO,KAAK,UAAU,SAAS,KAAK,CAAC;AACvC;AAEO,SAAS,oBAAoB,UAA+B;AACjE,MAAI,SAAS,SAAS,QAAQ;AAC5B,WAAO,QAAQ,SAAS,MAAM;AAAA,EAChC;AACA,SAAO,cAAc,SAAS,GAAG;AACnC;AAEA,SAAS,SAAS,OAAyB;AACzC,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,QAAQ;AAAA,EAC3B;AACA,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,MAAM,MAAM,CAAC,KAAK,SAAS,MAAM,CAAC,CAAC,CAAC;AAAA,EACxI;AACA,SAAO;AACT;AAEO,IAAM,oBAAoB,EAAE,KAAK,CAAC,UAAU,WAAW,mBAAmB,aAAa,UAAU,WAAW,CAAC;AAG7G,IAAM,oBAAoB,EAAE,KAAK,CAAC,QAAQ,kBAAkB,OAAO,MAAM,CAAC;AAG1E,IAAM,oBAAoB,EAAE,KAAK,CAAC,UAAU,UAAU,WAAW,CAAC;AAGlE,IAAM,uBAAuB,EAAE,KAAK,CAAC,OAAO,SAAS,gBAAgB,CAAC;AAGtE,IAAM,0BAA0B,EAAE,KAAK;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ;AAAA,EACR,MAAM,EAAE,OAAO;AAAA,EACf,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW;AAAA,EACX,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAChD,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC/C,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3D,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,WAAW,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC5C,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC7D,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,QAAQ,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACxC,CAAC;AAGM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClC,CAAC;AAYM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,SAAS,EAAE,QAAQ,IAAI;AACzB,CAAC;AAYM,IAAM,2BAA2B;AAGjC,IAAM,yBAAyB,KAAK,UAAU,EAAE,CAAC,wBAAwB,GAAG,KAAK,CAAC;AAUlF,SAAS,sBAAsB,YAAgD;AACpF,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,UAAU;AACpC,WAAO,OAAO,WAAW,YACpB,WAAW,QACV,OAAmC,wBAAwB,MAAM;AAAA,EACzE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,IAAM,+BAA+B,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO;AAIzD,IAAM,8BAA8B,EAAE,OAAO;AAAA;AAAA;AAAA,EAGlD,QAAQ,EAAE,KAAK,CAAC,UAAU,MAAM,CAAC;AAAA,EACjC,SAAS,EAAE,OAAO;AACpB,CAAC;AAGM,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,oBAAoB,EAAE,OAAO;AAAA,EAC7B,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,WAAW,EAAE,MAAM,WAAW;AAAA,EAC9B,OAAO,EAAE,MAAM,OAAO;AAAA,EACtB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,iBAAiB;AAAA,EACjB,gBAAgB;AAAA;AAAA,EAEhB,WAAW,UAAU,SAAS;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnC,WAAW,EAAE,MAAM,WAAW,EAAE,SAAS;AAAA,EACzC,OAAO,EAAE,MAAM,OAAO,EAAE,SAAS;AAAA,EACjC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,iBAAiB,gBAAgB,SAAS;AAAA,EAC1C,gBAAgB,eAAe,SAAS;AAAA,EACxC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AACvD,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;AAC3C,CAAC;AAGM,IAAM,mCAAmC,EAAE,OAAO,EAAE,MAAM,mBAAmB,EAAE,IAAI,GAAG;AAMtF,IAAM,uCAAuC,EAAE,OAAO;AAAA,EAC3D,MAAM;AAAA,EACN,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAM,EAAE,OAAO;AAAA,EACf,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,MAAM,oCAAoC;AAAA,EACvD,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC3C,WAAW,EAAE,MAAM,EAAE,OAAO;AAAA,IAC1B,MAAM;AAAA,IACN,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK;AAAA,EACpC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAChB,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,SAAS;AACxD,CAAC;AAGM,IAAM,yCAAyC,EAAE,OAAO;AAAA,EAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK;AACpC,CAAC;AAGM,IAAM,sBAAsB,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAGvD,IAAM,yBAAyB,EAAE,KAAK,CAAC,UAAU,cAAc,QAAQ,CAAC;AAGxE,IAAM,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,kBAAkB,CAAC;AAG/E,IAAM,6BAA6B,EAAE,KAAK,CAAC,oBAAoB,QAAQ,YAAY,CAAC;AAGpF,IAAM,2BAA2B,EAAE,KAAK,CAAC,aAAa,QAAQ,CAAC;AAG/D,IAAM,4BAA4B,EAAE,mBAAmB,QAAQ;AAAA,EACpE,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,MAAM;AAAA,IACtB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,IAC3C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,KAAK;AAAA,EAC3C,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,UAAU;AAAA,IAC1B,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACxC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,IACxD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EACxD,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,UAAU;AAAA,IAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,KAAK;AAAA,IACzC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,IACpC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,IACtC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,UAAU,WAAW,aAAa,YAAY,UAAU,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC9H,CAAC;AACH,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,WAAW,EAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC1C,OAAO,EAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,iBAAiB,gBAAgB,SAAS;AAAA,EAC1C,gBAAgB,eAAe,SAAS;AAAA,EACxC,MAAM,SAAS,SAAS;AAC1B,CAAC;AAGM,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAM,EAAE,OAAO;AAAA,EACf,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,oBAAoB,EAAE,OAAO;AAAA,EAC7B,SAAS;AAAA,EACT,eAAe;AAAA,EACf,aAAa;AAAA,EACb,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC9C,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,SAAS,EAAE,OAAO;AAAA,EAClB,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,UAAU;AAAA,EACV,SAAS,qBAAqB,QAAQ,qBAAqB;AAAA,EAC3D,eAAe,2BAA2B,QAAQ,kBAAkB;AAAA,EACpE,aAAa;AAAA,EACb,QAAQ,oBAAoB,QAAQ,QAAQ;AAAA,EAC5C,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,UAAU,0BAA0B,SAAS;AAAA,EAC7C,SAAS,qBAAqB,SAAS;AAAA,EACvC,eAAe,2BAA2B,SAAS;AAAA,EACnD,aAAa,yBAAyB,SAAS;AAAA,EAC/C,QAAQ,oBAAoB,SAAS;AAAA,EACrC,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AACvD,CAAC;AAQM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACjD,CAAC;AAGM,IAAM,mCAAmC,EAAE,KAAK;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,WAAW;AAAA,EACX,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAChD,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC7C,UAAU,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,MAAM,EAAE,QAAQ,eAAe;AAAA,EAC/B,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC/C,UAAU,EAAE,QAAQ,EAAE,QAAQ,KAAK;AACrC,CAAC;AAGM,IAAM,sCAAsC,EAAE,OAAO;AAAA,EAC1D,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,iBAAiB;AAAA,EACjB,gBAAgB,qBAAqB,QAAQ,qBAAqB;AAAA,EAClE,sBAAsB,2BAA2B,QAAQ,MAAM;AAAA;AAAA;AAAA,EAG/D,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACrC,CAAC;AAQM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,OAAO,6BAA6B;AAAA,IACnE,SAAS;AAAA,EACX,CAAC;AAAA,EACD,SAAS,EAAE,OAAO,EAAE,IAAI,MAAM,IAAI;AACpC,CAAC;AAMM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,gCAAgC;AAAA,IACpE,SAAS;AAAA,EACX,CAAC;AAAA,EACD,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAClD,OAAO,EAAE,MAAM,uBAAuB,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AACvD,CAAC,EAAE,YAAY,CAAC,OAAO,QAAQ;AAC7B,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAM,QAAQ,CAAC,MAAM,UAAU;AACnC,QAAI,KAAK,IAAI,KAAK,IAAI,GAAG;AACvB,UAAI,SAAS,EAAE,MAAM,UAAU,SAAS,8BAA8B,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,OAAO,MAAM,EAAE,CAAC;AAAA,IACrH;AACA,SAAK,IAAI,KAAK,IAAI;AAAA,EACpB,CAAC;AACD,MAAI,CAAC,MAAM,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,UAAU,GAAG;AACzD,QAAI,SAAS,EAAE,MAAM,UAAU,SAAS,gDAAgD,MAAM,CAAC,OAAO,EAAE,CAAC;AAAA,EAC3G;AACF,CAAC;AAGD,SAAS,4BAA4B,MAAuB;AAC1D,MAAI,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,IAAI,GAAG;AAC/C,WAAO;AAAA,EACT;AACA,SAAO,KAAK,MAAM,GAAG,EAAE,MAAM,CAAC,YAAY,QAAQ,SAAS,KAAK,YAAY,OAAO,YAAY,IAAI;AACrG;AAEO,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,EAIzB,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEzD,QAAQ,EAAE,MAAM,mBAAmB,EAAE,IAAI,EAAE,EAAE,YAAY,CAAC,QAAQ,QAAQ;AACxE,UAAM,OAAO,oBAAI,IAAY;AAC7B,WAAO,QAAQ,CAAC,OAAO,UAAU;AAC/B,YAAM,MAAM,MAAM,KAAK,YAAY;AACnC,UAAI,KAAK,IAAI,GAAG,GAAG;AACjB,YAAI,SAAS,EAAE,MAAM,UAAU,SAAS,8BAA8B,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,MAAM,EAAE,CAAC;AAAA,MAC7G;AACA,WAAK,IAAI,GAAG;AAAA,IACd,CAAC;AAAA,EACH,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACb,OAAO,EAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClC,YAAY,EAAE,MAAM,uBAAuB,EAAE,QAAQ,CAAC,CAAC;AAAA,EACvD,WAAW,EAAE,MAAM,uBAAuB,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,wBAAwB,EAAE,MAAM,mCAAmC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC/E,aAAa,EAAE,OAAO;AAAA,IACpB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC7B,mBAAmB,EAAE,MAAM,gCAAgC,EAAE,QAAQ,CAAC,CAAC;AAAA,IACvE,UAAU,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACrC,CAAC,EAAE,SAAS;AAAA,EACZ,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAKM,IAAM,gCAAgC;AAGtC,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,MAAM;AAAA,EACN,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,yBAAyB,EAAE,KAAK,CAAC,UAAU,UAAU,CAAC;AAG5D,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,QAAQ;AAAA,EACR,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,iBAAiB,EAAE,KAAK;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,yBAAyB,EAAE,KAAK,CAAC,aAAa,gBAAgB,UAAU,CAAC;AAG/E,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,UAAU;AAAA,EACV,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,QAAQ;AAAA,EACR,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC1B,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC/C,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,UAAU;AAAA,EACV,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC9C,QAAQ,uBAAuB,QAAQ,WAAW;AAAA,EAClD,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC7C,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC1C,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3D,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,aAAa,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,UAAU;AAAA,EACV,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,MAAM,EAAE,OAAO;AAAA,EACf,aAAa,EAAE,OAAO;AAAA,EACtB,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAAA,EACxC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EACrC,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/B,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACpD,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAGM,IAAM,iBAAiB,EAAE,KAAK,CAAC,UAAU,WAAW,eAAe,WAAW,CAAC;AAG/E,IAAM,mBAAmB,EAAE,KAAK,CAAC,UAAU,gBAAgB,WAAW,OAAO,CAAC;AAG9E,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAChC,MAAM,eAAe,SAAS;AAAA,EAC9B,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC5C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,cAAc,EAAE,KAAK,CAAC,aAAa,SAAS,CAAC,EAAE,SAAS;AAC1D,CAAC,EAAE,OAAO;AAGH,IAAM,qBAAqB,EAAE,OAAO;AAAA,EACzC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,gBAAgB,EAAE,OAAO;AAAA,EACzB,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAGnE,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAChC,MAAM;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,YAAY;AAAA,EACZ,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACpD,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACrE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,MAAM,eAAe,SAAS;AAAA,EAC9B,QAAQ,iBAAiB,SAAS;AAAA,EAClC,YAAY,2BAA2B,SAAS;AAAA,EAChD,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EACnD,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACrE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AACvD,CAAC;AAGM,IAAM,qBAAqB,EAAE,OAAO;AAAA,EACzC,YAAY;AACd,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,aAAa,EAAE,MAAM,kBAAkB;AACzC,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAClC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC3C,CAAC,EAAE,OAAO,CAAC,UAAU,QAAQ,MAAM,UAAU,MAAM,QAAQ,GAAG;AAAA,EAC5D,SAAS;AAAA,EACT,MAAM,CAAC,QAAQ;AACjB,CAAC;AAGM,IAAM,qBAAqB,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5C,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,WAAW,EAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,aAAa,EAAE,QAAQ,UAAU;AAAA,EACjC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvC,4BAA4B,EAAE,QAAQ,MAAM;AAAA,EAC5C,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,sBAAsB,eAAe,CAAC,CAAC;AAAA,EACpE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,MAAM,CAAC;AAC3C,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACpD,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,KAAK;AAAA,EACzC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EACjD,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC/C,QAAQ,oBAAoB,QAAQ,QAAQ;AAAA,EAC5C,SAAS,qBAAqB,QAAQ,qBAAqB;AAAA,EAC3D,eAAe,2BAA2B,QAAQ,MAAM;AAC1D,CAAC;AAGM,IAAM,iBAAiB,EAAE,KAAK,CAAC,QAAQ,OAAO,OAAO,SAAS,QAAQ,CAAC;AAGvE,IAAM,mBAAmB,EAAE,KAAK,CAAC,YAAY,cAAc,mBAAmB,YAAY,QAAQ,CAAC;AAGnG,IAAM,+BAA+B,EAAE,KAAK,CAAC,UAAU,UAAU,CAAC;AAGlE,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,WAAW,QAAQ,SAAS,CAAC;AAGjF,IAAM,wBAAwB,EAAE,KAAK,CAAC,YAAY,WAAW,CAAC;AAG9D,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,WAAW,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAC3C,CAAC;AAGM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC/C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC5C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3C,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACrD,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACrD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACpD,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACpD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACzD,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACtD,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACpD,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAChD,UAAU,0BAA0B,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC3D,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtE,MAAM,sBAAsB,SAAS,EAAE,QAAQ,IAAI;AAAA,EACnD,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACrD,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACxD,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACxD,OAAO,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAChC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC3C,OAAO,EAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClC,SAAS,kBAAkB,QAAQ,EAAE,WAAW,OAAO,OAAO,KAAK,CAAC;AAAA,EACpE,SAAS,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAClC,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACjD,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,qCAAqC,EAAE,OAAO;AAAA,EACzD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC/B,MAAM,eAAe,QAAQ,CAAC,MAAM,CAAC;AAAA,EACrC,QAAQ,iBAAiB,QAAQ,QAAQ;AAAA,EACzC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC5C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3C,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACpD,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,eAAe,uBAAuB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO/C,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOpD,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC5C,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,OAAO,EAAE,MAAM,qBAAqB;AAAA,EACpC,eAAe,EAAE,MAAM,sBAAsB;AAC/C,CAAC;AAGM,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,OAAO,EAAE,MAAM,qBAAqB;AAAA,EACpC,QAAQ,EAAE,QAAQ,uBAAuB;AAAA,EACzC,WAAW,EAAE,OAAO,EAAE,IAAI;AAC5B,CAAC;AAGM,IAAM,UAAU,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ;AAAA,EACR,gBAAgB,EAAE,OAAO;AAAA,EACzB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,aAAa,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIhD,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW,EAAE,MAAM,WAAW;AAAA,EAC9B,OAAO,EAAE,MAAM,OAAO;AAAA,EACtB,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,OAAO,EAAE,OAAO;AAAA,EAChB,gBAAgB;AAAA;AAAA,EAEhB,WAAW;AAAA;AAAA;AAAA;AAAA,EAIX,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1C,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA,EAG1C,0BAA0B,EAAE,MAAM,UAAU,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvD,YAAY,EAAE,MAAM,wBAAwB,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI5C,sBAAsB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1C,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAIzC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACzD,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3C,yBAAyB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACpD,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAClD,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,mBAAmB,EAAE,KAAK;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AACF,CAAC;AAGM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAChC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACpD,QAAQ,EAAE,KAAK,CAAC,sBAAsB,WAAW,sBAAsB,gBAAgB,CAAC;AAAA,EACxF,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EAC5C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AACnD,CAAC;AAQM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,KAAK,EAAE,OAAO,EAAE,IAAI;AAAA,EACpB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI1C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,WAAW,EAAE,QAAQ,QAAQ;AAAA;AAAA,EAE7B,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AACrD,CAAC;AAGM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,QAAQ,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC5C,CAAC;AAGM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,QAAQ,EAAE,KAAK,CAAC,qBAAqB,UAAU,WAAW,cAAc,CAAC;AAAA,EACzE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC5C,CAAC;AAGM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACnD,QAAQ,EAAE,KAAK,CAAC,iBAAiB,kBAAkB,OAAO,CAAC;AAC7D,CAAC;AAQM,IAAM,gBAAgB,EAAE,KAAK,CAAC,UAAU,WAAW,WAAW,CAAC;AAE/D,IAAM,iBAAiB,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC;AAEtD,IAAM,uBAAuB,EAAE,KAAK,CAAC,aAAa,YAAY,CAAC;AAG/D,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,MAAM;AAAA,EACN,OAAO;AAAA,EACP,YAAY,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAAA,EAC9E,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrC,WAAW,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA,EAGpB,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AACzC,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,OAAO;AAAA,EACP,aAAa;AAAA;AAAA;AAAA,EAGb,YAAY,EAAE,OAAO;AAAA,EACrB,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,EACnD,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,YAAY,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAChF,CAAC;AAKM,IAAM,wBAAwB,EAAE,KAAK;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,QAAQ;AAAA;AAAA;AAAA,EAGR,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AACzC,CAAC;AAcM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,QAAQ,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA,EACrD,OAAO,EAAE,OAAO;AAAA;AAAA,EAChB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC/B,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA;AAC/C,CAAC;AAGM,IAAM,eAAe,EAAE,KAAK,CAAC,WAAW,YAAY,WAAW,SAAS,CAAC;AAEzE,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,SAAS,EAAE,MAAM,EAAE,OAAO;AAAA,IACxB,MAAM,EAAE,OAAO;AAAA;AAAA,IACf,MAAM;AAAA,IACN,OAAO,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,IAChC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,IACjE,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC/B,CAAC,CAAC,EAAE,IAAI,CAAC;AAAA,EACT,QAAQ,EAAE,KAAK,CAAC,SAAS,SAAS,OAAO,CAAC,EAAE,QAAQ,OAAO;AAAA;AAAA,EAE3D,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA;AAAA;AAAA,EAIvC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AACtD,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC1B,OAAO,EAAE,QAAQ;AAAA;AAAA,EACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAChD,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC/C,QAAQ,EAAE,KAAK,CAAC,UAAU,YAAY,SAAS,YAAY,SAAS,SAAS,CAAC,EAAE,QAAQ,SAAS;AAAA,EACjG,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAClD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AACtD,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACvB,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,OAAO,EAAE,OAAO;AAAA;AAAA,EAChB,KAAK,EAAE,OAAO;AAChB,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACvB,QAAQ,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA,EACrD,OAAO,EAAE,OAAO;AAAA;AAAA,EAChB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AACpC,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACvB,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ,UAAU,cAAc,SAAS,CAAC;AAC5D,CAAC;AAIM,IAAM,aAAa,EAAE,KAAK,CAAC,QAAQ,OAAO,WAAW,OAAO,CAAC;AAc7D,IAAM,aAAoC,EAAE,KAAK,MAAM,EAAE,OAAO;AAAA,EACrE,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO;AAAA,EACf,MAAM;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACnD,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EACjD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,MAAM,UAAU,EAAE,SAAS;AAAA,EACvC,WAAW,EAAE,QAAQ,EAAE,QAAQ,KAAK;AACtC,CAAC,CAAC;AAEK,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA,EAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAK;AAAA,EACjE,eAAe,EAAE,QAAQ,EAAE,QAAQ,IAAI;AACzC,CAAC;AAEM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,WAAW,EAAE,QAAQ;AAAA;AACvB,CAAC;AAGM,IAAM,aAAa,EAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;AAE5C,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,WAAW,QAAQ,MAAM;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,OAAO,IAAI,EAAE,QAAQ,IAAI,OAAO,IAAI;AACrF,CAAC;AAEM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM,EAAE,OAAO;AAAA,EACf,UAAU;AAAA,EACV,SAAS,EAAE,OAAO;AAAA;AAAA,EAClB,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EACxC,WAAW,EAAE,QAAQ;AAAA;AAAA,EACrB,UAAU,EAAE,QAAQ;AAAA;AAAA,EACpB,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAGM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,WAAW,QAAQ,MAAM;AAAA,EACnC,SAAS,EAAE,OAAO;AAAA,EAClB,WAAW,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EACnC,eAAe,EAAE,QAAQ,EAAE,QAAQ,IAAI;AACzC,CAAC;AAEM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AACzC,CAAC;AAGM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AACtC,CAAC;AAEM,IAAM,mBAAmB,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAG9E,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,OAAO;AAAA,EACf,SAAS,EAAE,OAAO;AAAA,EAClB,WAAW,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EACpC,eAAe,EAAE,QAAQ,EAAE,QAAQ,IAAI;AACzC,CAAC;AAEM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM,EAAE,OAAO;AAAA,EACf,SAAS,EAAE,OAAO;AAAA,EAClB,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AACzC,CAAC;AAGM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AACrC,CAAC;AAEM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AACzC,CAAC;AAIM,IAAM,oBAAoB,EAAE,KAAK;AAAA,EACtC;AAAA,EAAS;AAAA,EAAY;AAAA,EAAW;AAAA,EAAW;AAAA,EAAU;AAAA,EAAa;AAAA,EAAW;AAAA,EAAc;AAC7F,CAAC;AAEM,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,OAAO;AAAA,EACf,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC7B,OAAO,kBAAkB,SAAS;AAAA;AAAA,EAClC,UAAU,kBAAkB,SAAS;AAAA;AAAA,EACrC,cAAc,EAAE,QAAQ,EAAE,QAAQ,KAAK;AACzC,CAAC;AAEM,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAC7B,CAAC;AAEM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,QAAQ,EAAE,QAAQ;AAAA,EAClB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC1B,UAAU,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAChD,OAAO,EAAE,MAAM,aAAa;AAAA,EAC5B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAIM,IAAM,kBAAkB,EAAE,KAAK,CAAC,WAAW,OAAO,OAAO,MAAM,CAAC;AAEhE,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,MAAM;AAAA;AAAA,EAEN,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,MAAM,EAAE,OAAO;AAAA;AACjB,CAAC;AAEM,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,QAAQ,EAAE,OAAO;AAAA;AAAA,EACjB,OAAO,EAAE,MAAM,WAAW;AAC5B,CAAC;AAEM,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,MAAM,EAAE,OAAO;AAAA,EACf,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,QAAQ;AAAA,EACR,UAAU,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACnC,SAAS,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,OAAO,EAAE,MAAM,WAAW;AAAA;AAAA,EAC1B,WAAW,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AACtC,CAAC;AAEM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA,EAE3B,QAAQ,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EACjC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACxC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAAA,EACvD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,OAAO,IAAI,EAAE,QAAQ,MAAM,IAAI;AACtF,CAAC;AAEM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,MAAM,WAAW;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAGM,IAAM,gBAAgB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC3B,KAAK,EAAE,OAAO,EAAE,QAAQ,MAAM;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAK,EAAE,QAAQ,GAAG;AAAA,EAC5D,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,EAC9C,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAEM,IAAM,YAAY,EAAE,OAAO;AAAA,EAChC,KAAK,EAAE,OAAO;AAAA,EACd,UAAU,EAAE,OAAO;AAAA,EACnB,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAAA,EACrF,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAAA,EACxF,SAAS,EAAE,OAAO;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AACtC,CAAC;AAEM,IAAM,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,GAAG,SAAS,EAAE,QAAQ,EAAE,CAAC;AAGrF,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA,EAC3B,KAAK,EAAE,OAAO;AAAA;AAAA,EACd,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAC9B,UAAU,WAAW,QAAQ,MAAM;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,OAAO,IAAI,EAAE,QAAQ,MAAM,IAAI;AACtF,CAAC;AAEM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,QAAQ,UAAU,SAAS;AAAA;AAAA,EAC3B,OAAO,EAAE,MAAM,WAAW;AAAA;AAAA,EAC1B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,UAAU,YAAY,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS;AAAA,EAC5H,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAQM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACzB,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA,EAE1B,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAO,EAAE,QAAQ,GAAM;AAAA;AAAA;AAAA,EAGlE,YAAY,EAAE,QAAQ,EAAE,QAAQ,IAAI;AACtC,CAAC;AAEM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,QAAQ,EAAE,OAAO;AAAA,EACjB,QAAQ,EAAE,OAAO;AAAA,EACjB,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAGpC,SAAS,EAAE,QAAQ;AAAA,EACnB,iBAAiB,EAAE,OAAO,EAAE,YAAY;AAC1C,CAAC;AAIM,IAAM,iBAAiB,EAAE,OAAO;AAAA,EACrC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACrD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACrD,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA,EAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA;AAC7B,CAAC;AAEM,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAEvB,WAAW,EAAE,QAAQ,YAAY;AAAA,EACjC,eAAe,EAAE,QAAQ;AAAA;AAC3B,CAAC;AAEM,IAAM,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;AAE/E,IAAM,mBAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAEpI,IAAM,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAM7D,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,GAAG,UAAU,EAAE,QAAQ,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;AAAA,EACxF,UAAU,EAAE,OAAO;AAAA,IACjB,QAAQ,EAAE,QAAQ;AAAA;AAAA,IAClB,MAAM,EAAE,QAAQ;AAAA;AAAA,IAChB,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAAA;AAAA,EAC1C,CAAC;AAAA,EACD,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AACtE,CAAC;AAGM,IAAM,eAAe,EAAE,OAAO;AAAA,EACnC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,MAAM;AAAA,EACN,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC/B,YAAY,EAAE,OAAO;AAAA,EACrB,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAChD,CAAC;AAGM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAShC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA,EAC3D,WAAW,EAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC1C,OAAO,EAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,EAClC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACtD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,iBAAiB,gBAAgB,SAAS;AAAA,EAC1C,gBAAgB,eAAe,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM5C,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvC,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,MAAM,SAAS,SAAS;AAAA,EACxB,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO1C,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKpD,0BAA0B,EAAE,MAAM,UAAU,EAAE,SAAS;AAAA;AAAA;AAAA,EAGvD,YAAY,EAAE,MAAM,qBAAqB,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBrD,SAAS,EAAE,MAAM;AAAA,IACf,EAAE,QAAQ,QAAQ;AAAA,IAClB,EAAE,QAAQ,KAAK;AAAA,IACf,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EACzC,CAAC,EAAE,SAAS;AACd,CAAC;AAGM,IAAM,qBAAqB,EAAE,mBAAmB,QAAQ;AAAA,EAC7D,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,cAAc;AAAA,IAC9B,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAC1C,SAAS,EAAE,OAAO;AAAA,MAChB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,WAAW,EAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA,MAC1C,OAAO,EAAE,MAAM,OAAO,EAAE,QAAQ,CAAC,CAAC;AAAA,MAClC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAClC,iBAAiB,gBAAgB,SAAS;AAAA;AAAA;AAAA,MAG1C,sBAAsB,EAAE,MAAM,+BAA+B,EAAE,SAAS;AAAA,IAC1E,CAAC;AAAA,EACH,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,gBAAgB;AAAA,IAChC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAC1C,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACjE,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,uBAAuB;AAAA,IACvC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAC1C,SAAS,EAAE,OAAO;AAAA,MAChB,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC5B,UAAU,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;AAAA,MACtC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,CAAC;AAAA,EACH,CAAC;AACH,CAAC;AAGM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ,EAAE,MAAM,YAAY,EAAE,IAAI,CAAC;AACrC,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACjC,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAChD,CAAC;AAGM,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,IAAI;AAAA,EACnB,gBAAgB,EAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,UAAU,EAAE,OAAO;AAAA,EACnB,MAAM,EAAE,OAAO;AAAA,EACf,SAAS,EAAE,QAAQ;AAAA,EACnB,SAAS,EAAE,OAAO;AAAA,EAClB,UAAU,EAAE,OAAO;AAAA,EACnB,eAAe,EAAE,OAAO;AAAA,EACxB,cAAc,EAAE,OAAO;AAAA,EACvB,aAAa,EAAE,OAAO,EAAE,SAAS;AACnC,CAAC;AAGM,IAAM,mBAAmB,EAAE,mBAAmB,QAAQ;AAAA,EAC3D,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,MAAM;AAAA,EACxB,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,eAAe;AAAA,IAC/B,YAAY,EAAE,QAAQ,uBAAuB;AAAA,EAC/C,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,iBAAiB;AAAA,IACjC,YAAY,EAAE,QAAQ,eAAe;AAAA,IACrC,QAAQ,EAAE,QAAQ,QAAQ;AAAA,EAC5B,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,gBAAgB;AAAA,IAChC,SAAS,EAAE,QAAQ,QAAQ;AAAA,EAC7B,CAAC;AACH,CAAC;AAOM,IAAM,8BAA8B,EAAE,KAAK;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF,CAAC;AAGM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,SAAS;AAAA,EACT,IAAI;AAAA,EACJ,UAAU,EAAE,KAAK,CAAC,QAAQ,WAAW,QAAQ,UAAU,CAAC;AAAA;AAAA,EAExD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,2BAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA,EACrE,YAAY,EAAE,OAAO;AAAA,IACnB,WAAW,EAAE,QAAQ;AAAA,IACrB,UAAU,EAAE,QAAQ;AAAA,IACpB,MAAM,EAAE,OAAO;AAAA,IACf,SAAS,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC;AAAA,IAC3B,UAAU,EAAE,KAAK,CAAC,QAAQ,UAAU,CAAC;AAAA,IACrC,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,UAAU,EAAE,OAAO;AAAA,IACjB,WAAW,EAAE,KAAK,CAAC,cAAc,QAAQ,CAAC,EAAE,SAAS;AAAA,IACrD,YAAY,EAAE,QAAQ;AAAA,IACtB,OAAO,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKhB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC/B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,IAG3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,KAAK,EAAE,OAAO;AAAA,IACZ,WAAW,EAAE,QAAQ;AAAA,IACrB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,IACzB,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,eAAe,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA,IAItB,WAAW,EAAE,KAAK,CAAC,UAAU,UAAU,UAAU,cAAc,CAAC,EAAE,SAAS;AAAA,IAC3E,QAAQ,EAAE,KAAK,CAAC,SAAS,WAAW,QAAQ,CAAC,EAAE,SAAS;AAAA,IACxD,MAAM,EAAE,KAAK,CAAC,aAAa,aAAa,CAAC,EAAE,QAAQ,WAAW;AAAA,IAC9D,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC/B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,YAAY,EACT,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,EAChE,QAAQ,CAAC,MAAM,GAAG,CAAC;AAAA;AAAA,IAEtB,YAAY,EAAE,QAAQ;AAAA,IACtB,wBAAwB,EAAE,QAAQ;AAAA,IAClC,cAAc,EAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASxB,QAAQ,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,IACjC,kBAAkB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,IACvD,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,WAAW,EAAE,OAAO;AAAA,IAClB,WAAW,EAAE,QAAQ;AAAA,IACrB,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,WAAW,WAAW,CAAC,CAAC;AAAA,IACzD,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC,CAAC;AAAA,IAChD,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKD,aAAa,EAAE,OAAO;AAAA,IACpB,WAAW,EAAE,QAAQ;AAAA,IACrB,UAAU,EAAE,QAAQ;AAAA,IACpB,QAAQ,4BAA4B,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,cAAc,EAAE,OAAO;AACzB,CAAC;AAkBM,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAGM,IAAM,eAAe,EAAE,OAAO;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,UAAU,EAAE,KAAK,CAAC,QAAQ,WAAW,QAAQ,UAAU,CAAC;AAAA;AAAA,EAExD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACzC,2BAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA,EAGrD,cAAc,EAAE,OAAO,EAAE,SAAS;AACpC,CAAC;AAYM,IAAM,2BAA2B,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA,EAI/C,uBAAuB,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA,EAG/C,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAC9C,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,cAAc,EAAE,QAAQ;AAAA,EACxB,oBAAoB,EAAE,QAAQ;AAChC,CAAC;AAKM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC3C,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA;AAAA,EAE9C,OAAO,EAAE,QAAQ;AACnB,CAAC;AAcM,IAAM,eAAe,EAAE,KAAK,CAAC,SAAS,SAAS,SAAS,CAAC;AAEzD,IAAM,iBAAiB,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAOnD,IAAM,+BAA+B,EAAE,OAAO;AAAA;AAAA,EAEnD,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACrC,IAAI,aAAa,QAAQ,OAAO;AAAA,EAChC,MAAM,eAAe,QAAQ,QAAQ;AAAA;AAAA,EAErC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEjD,UAAU,EAAE,QAAQ,eAAe,EAAE,QAAQ,eAAe;AAAA;AAAA,EAE5D,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA,EAG1C,uBAAuB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhD,aAAa,EAAE,OAAO,EAAE,KAAK;AAC/B,CAAC;AAIM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,YAAY,EAAE,OAAO;AAAA,EACrB,UAAU,EAAE,OAAO;AAAA,EACnB,iBAAiB,EAAE,OAAO;AAAA,EAC1B,yBAAyB,EAAE,OAAO;AAAA,EAClC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC9C,CAAC;AAMM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAClC,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAC/C,CAAC;AAGM,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,UAAU,EAAE,QAAQ;AAAA,EACpB,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,oBAAoB,EAAE,QAAQ;AAChC,CAAC;AAIM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACvC,CAAC;AAGM,IAAM,wBAAwB,EAAE,KAAK,CAAC,WAAW,cAAc,UAAU,WAAW,UAAU,CAAC;AAO/F,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE7B,QAAQ,EAAE,OAAO;AAAA;AAAA;AAAA,EAGjB,eAAe,EAAE,OAAO;AAAA;AAAA;AAAA,EAGxB,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC5B,UAAU,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOnB,YAAY,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMrB,kBAAkB,EAAE,OAAO;AAAA;AAAA,EAE3B,iBAAiB,EAAE,OAAO;AAAA,EAC1B,uBAAuB,EAAE,QAAQ;AAAA,EACjC,wBAAwB,EAAE,QAAQ;AACpC,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,OAAO;AAAA;AAAA,EAEP,aAAa,8BAA8B,SAAS;AACtD,CAAC;AAIM,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,OAAO;AAAA,EACjB,UAAU,EAAE,QAAQ,eAAe;AAAA,EACnC,YAAY,EAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtB,0BAA0B,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC7C,oBAAoB,EAAE,QAAQ;AAAA,EAC9B,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,IAAI;AAAA,EACJ,MAAM,EAAE,OAAO;AAAA,EACf,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,aAAa,EAAE,MAAM,iBAAiB;AACxC,CAAC;AAGM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,SAAS,EAAE,QAAQ;AACrB,CAAC;AAgBM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AACpC,CAAC;AAKM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,IAAI;AAAA,EACJ,MAAM,EAAE,OAAO;AAAA,EACf,iBAAiB,EAAE,QAAQ;AAAA,EAC3B,uBAAuB,EAAE,QAAQ;AACnC,CAAC;AAGM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,UAAU,EAAE,OAAO;AAAA,EACnB,SAAS;AAAA,EACT,WAAW,EAAE,OAAO;AACtB,CAAC;AAKM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AACpC,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,QAAQ,EAAE,QAAQ;AACpB,CAAC;AAMM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAC/C,CAAC;AAGM,IAAM,0BAA0B,EAAE,OAAO;AAAA;AAAA,EAE9C,OAAO,EAAE,OAAO;AAAA,EAChB,WAAW,EAAE,OAAO;AAAA,EACpB,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC9C,CAAC;AAQM,IAAM,6BAA6B,EAAE,OAAO;AAAA;AAAA,EAEjD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEvB,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACrC,IAAI,aAAa,QAAQ,OAAO;AAAA,EAChC,MAAM,eAAe,QAAQ,QAAQ;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEjD,UAAU,EAAE,QAAQ,eAAe,EAAE,QAAQ,eAAe;AAAA,EAC5D,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAE1C,uBAAuB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAClD,CAAC;AAKM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,aAAa;AACf,CAAC;AAkBM,IAAM,eAAe,EAAE,OAAO;AAAA,EACnC,QAAQ,EAAE,OAAO;AAAA,EACjB,OAAO,EAAE,OAAO;AAAA,EAChB,OAAO,EAAE,OAAO;AAAA,EAChB,QAAQ,EAAE,OAAO;AAAA,EACjB,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,eAAe,EAAE,OAAO,EAAE,IAAI;AAAA,EAC9B,eAAe,EAAE,OAAO,EAAE,IAAI;AAAA,EAC9B,gBAAgB,EAAE,OAAO,EAAE,IAAI;AAAA,EAC/B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvC,UAAU,EAAE,OAAO;AAAA,EACnB,WAAW,EAAE,OAAO;AACtB,CAAC;AAOM,IAAM,eAAe,EAAE,KAAK;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,cAAc,EAAE,KAAK,CAAC,SAAS,YAAY,CAAC;AAWlD,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,WAAW,EAAE,OAAO;AAAA,EACpB,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,MAAM,EAAE,OAAO;AAAA,EACf,MAAM;AAAA,EACN,OAAO;AAAA,EACP,QAAQ,EAAE,QAAQ;AAAA,EAClB,gBAAgB,EAAE,QAAQ;AAAA,EAC1B,IAAI,EAAE,OAAO;AAAA,EACb,MAAM,EAAE,OAAO;AAAA,EACf,YAAY,EAAE,QAAQ;AAAA;AAAA;AAAA;AAAA,EAItB,0BAA0B,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC7C,oBAAoB,EAAE,QAAQ;AAAA,EAC9B,oBAAoB,EAAE,OAAO,EAAE,IAAI;AAAA,EACnC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,SAAS,aAAa,SAAS;AACjC,CAAC;AAQM,IAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,UAAU,EAAE,MAAM,WAAW;AAC/B,CAAC;AAUM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAC1B,CAAC;AAQM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,SAAS,EAAE,QAAQ;AAAA,EACnB,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAOM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,SAAS,EAAE,MAAM,YAAY;AAC/B,CAAC;AAUM,IAAM,cAAc,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO;AAAA,EACb,OAAO,EAAE,OAAO;AAAA,EAChB,UAAU,EAAE,OAAO;AAAA;AAAA,EACnB,eAAe,EAAE,OAAO;AAAA,EACxB,KAAK,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,EACjC,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC5D,CAAC;AAGM,IAAM,eAAe,EAAE,OAAO;AAAA,EACnC,oBAAoB,EAAE,OAAO;AAAA;AAAA;AAAA;AAAA,EAI7B,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,cAAc,EAAE,OAAO;AAAA,EACvB,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA;AAAA;AAAA,EAGxC,QAAQ,EAAE,MAAM,WAAW,EAAE,QAAQ,CAAC,CAAC;AAAA,EACvC,wBAAwB;AAAA,EACxB,yBAAyB,EAAE,MAAM,eAAe,EAAE,IAAI,CAAC;AAAA,EACvD,YAAY,EAAE,MAAM,EAAE,OAAO;AAAA,IAC3B,IAAI,EAAE,OAAO;AAAA,IACb,MAAM,EAAE,OAAO;AAAA,EACjB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACd,aAAa,EAAE,OAAO;AAAA,IACpB,SAAS,EAAE,QAAQ;AAAA,IACnB,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC1C,CAAC;AAAA,EACD,mBAAmB;AAAA,EACnB,MAAM,iBAAiB,QAAQ,EAAE,MAAM,OAAO,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/C,oBAAoB,EAAE,OAAO;AAAA,IAC3B,YAAY,EAAE,QAAQ;AAAA,IACtB,KAAK,EAAE,QAAQ;AAAA,IACf,gBAAgB,EAAE,QAAQ;AAAA,EAC5B,CAAC,EAAE,QAAQ,EAAE,YAAY,OAAO,KAAK,OAAO,gBAAgB,MAAM,CAAC;AACrE,CAAC;AAGD,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,WAAW;AACxD;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM;AACxD;AAEA,eAAe,oBAAoB,QAAgB,OAAgC;AACjF,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,IAC/B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACvF,SAAO,OAAO,KAAK,SAAS,EAAE,SAAS,WAAW;AACpD;AAEA,SAAS,kBAAkB,QAAgB,UAA2B;AACpE,QAAM,cAAc,IAAI,YAAY,EAAE,OAAO,MAAM;AACnD,QAAM,gBAAgB,IAAI,YAAY,EAAE,OAAO,QAAQ;AACvD,MAAI,YAAY,WAAW,cAAc,QAAQ;AAC/C,WAAO;AAAA,EACT;AACA,MAAI,OAAO;AACX,WAAS,QAAQ,GAAG,QAAQ,YAAY,QAAQ,SAAS,GAAG;AAC1D,YAAQ,YAAY,KAAK,IAAK,cAAc,KAAK;AAAA,EACnD;AACA,SAAO,SAAS;AAClB;","names":["registryId"]}