@opengeni/core 0.28.1 → 1.0.1

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/workflow-wake-contract.ts","../src/transcription.ts","../src/sandbox/fleet.ts","../src/sandbox/routing.ts","../src/access/index.ts","../src/session-authorization.ts","../src/billing/limits.ts","../src/domain/capabilities.ts","../src/domain/fiken.ts","../src/domain/packs.ts","../src/domain/skill-imports.ts","../src/domain/environments.ts","../src/rigs/index.ts","../src/rigs/provider-images.ts","../src/domain/personal-connection-delegations.ts","../src/domain/resources.ts","../src/domain/session-tool-policy.ts","../src/domain/scheduled-tasks.ts","../src/domain/sessions.ts","../src/domain/timeline-annotations.ts","../src/domain/slack-bot.ts","../src/domain/insights.ts","../src/domain/memory-slack-publication.ts","../src/domain/slack-publication-secret-safety.ts","../src/domain/memory-slack-delivery.ts","../src/domain/durable-learning-slack-publication.ts","../src/domain/company-profile-durable-learning-adapter.ts","../src/domain/conversation-integrations.ts","../src/domain/workspace-members.ts","../src/domain/video-generation.ts","../src/domain/video-generation-capabilities.ts","../src/application/new-session-drafts.ts","../src/application/session-commands.ts"],"sourcesContent":["/** One global Temporal Schedule owns bounded delivery of committed session wakes. */\nexport const SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID =\n  \"opengeni-session-workflow-wake-dispatcher\";\nexport const SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE =\n  \"sessionWorkflowWakeDispatcherWorkflow\";\nexport const SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS = 10_000;\n\n/**\n * Temporal delivers activity cancellation through heartbeats. Keep both the\n * activity's local heartbeat timer and the worker's SDK throttle at this bound\n * so the end-to-end Pause/Steer physical-cancellation contract is not already\n * exhausted before sandbox/tool quiescence and replacement admission begin.\n */\nexport const TURN_ACTIVITY_CANCELLATION_HEARTBEAT_INTERVAL_MS = 500;\n","import type { TranscribeAudioResponse, VoiceInputErrorCode } from \"@opengeni/contracts\";\n\n/**\n * Server-owned upstream budget for one provider attempt. Resumable recording\n * claims remain fenced for longer than this budget before another worker may\n * reclaim them. Provider adapters must honor the supplied AbortSignal and must\n * not return while their upstream request is still live; OpenGeni does not\n * claim remote-side idempotency or cancellation for vendors that cannot meet\n * that adapter contract.\n */\nexport const TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS = 10 * 60 * 1_000;\n\nexport type TranscriptionLimits = {\n  maxDurationSeconds: number;\n  maxSizeBytes: number;\n  acceptedMimeTypes: readonly string[];\n};\n\nexport type TranscriptionRequest = {\n  workspaceId: string;\n  accountId: string;\n  /** Authenticated human/service subject used for provider-account authority. */\n  subjectId: string;\n  audio: Uint8Array;\n  mimeType: string;\n  /** Optional client-reported duration; enforced as a soft ceiling before upstream. */\n  durationSeconds?: number | undefined;\n  signal?: AbortSignal | undefined;\n  requestId: string;\n  /** Absolute server-owned provider deadline persisted for resumable attempts. */\n  providerDeadlineAt?: Date | undefined;\n  /** Exact provider selected before a resumable segment is first sent upstream. */\n  providerId?: string | undefined;\n};\n\nexport type TranscriptionResult = TranscribeAudioResponse & {\n  /** Server-private provider id for operational metrics only. Never returned to clients. */\n  providerId: string;\n  audioSeconds: number;\n  latencyMs: number;\n};\n\nexport class TranscriptionServiceError extends Error {\n  readonly code: VoiceInputErrorCode;\n  readonly status: number;\n  readonly retryable: boolean;\n\n  constructor(input: {\n    code: VoiceInputErrorCode;\n    message: string;\n    status?: number;\n    retryable?: boolean;\n  }) {\n    super(input.message);\n    this.name = \"TranscriptionServiceError\";\n    this.code = input.code;\n    this.status = input.status ?? statusForVoiceInputError(input.code);\n    this.retryable = input.retryable ?? false;\n  }\n}\n\nexport function statusForVoiceInputError(code: VoiceInputErrorCode): number {\n  switch (code) {\n    case \"permission_denied\":\n      return 403;\n    case \"policy_blocked\":\n      return 403;\n    case \"not_supported\":\n      return 415;\n    case \"unavailable\":\n      return 503;\n    case \"too_large\":\n      return 413;\n    case \"invalid_audio\":\n      return 400;\n    case \"timeout\":\n      return 504;\n    case \"cancelled\":\n      return 499;\n    case \"network\":\n    case \"provider\":\n      return 502;\n    case \"unknown\":\n    default:\n      return 500;\n  }\n}\n\n/** Optional workspace scope for readiness checks during provider selection. */\nexport type TranscriptionAvailabilityContext = {\n  workspaceId?: string | undefined;\n  subjectId?: string | undefined;\n};\n\n/**\n * Extensible transcription provider port. Implementations own credentials and\n * upstream request shape. Selection happens before audio is sent; providers must\n * not fall back to another vendor after an upstream request may have started.\n */\nexport type TranscriptionProvider = {\n  readonly id: string;\n  /** The adapter guarantees that its upstream transport honors AbortSignal. */\n  readonly supportsServerDeadline: true;\n  readonly experimental?: boolean | undefined;\n  /**\n   * Deployment readiness when called without a workspace. When `workspaceId` is\n   * provided, providers may require a workspace-attached credential (e.g. Codex).\n   */\n  available(context?: TranscriptionAvailabilityContext): boolean | Promise<boolean>;\n  transcribe(input: {\n    audio: Uint8Array;\n    mimeType: string;\n    filename: string;\n    workspaceId: string;\n    accountId: string;\n    subjectId: string;\n    requestId: string;\n    signal?: AbortSignal | undefined;\n  }): Promise<{ text: string; languages: string[] }>;\n};\n\nexport type TranscriptionService = {\n  limits(): TranscriptionLimits;\n  /** True when at least one ready provider can serve requests. */\n  available(context?: TranscriptionAvailabilityContext): boolean | Promise<boolean>;\n  /** Select one provider before a durable segment attempt; retries pin this id. */\n  selectProvider?(\n    context: TranscriptionAvailabilityContext,\n  ): string | null | Promise<string | null>;\n  transcribe(request: TranscriptionRequest): Promise<TranscriptionResult>;\n};\n\nexport type PreparedTranscriptionSegment = {\n  segmentNumber: number;\n  startMilliseconds: number;\n  durationMilliseconds: number;\n  mimeType: \"audio/wav\";\n  bytes: Uint8Array;\n};\n\nexport type TranscriptionSegmenter = {\n  available(): boolean | Promise<boolean>;\n  segment(input: {\n    sourceMimeType: string;\n    totalDurationMilliseconds: number;\n    providerSegmentSeconds: number;\n    chunks: AsyncIterable<Uint8Array>;\n    signal?: AbortSignal | undefined;\n  }): AsyncIterable<PreparedTranscriptionSegment>;\n};\n\nexport function normalizeMimeType(mimeType: string): string {\n  return mimeType.trim().toLowerCase();\n}\n\nexport function isAcceptedMimeType(mimeType: string, accepted: readonly string[]): boolean {\n  const normalized = normalizeMimeType(mimeType);\n  if (accepted.some((candidate) => normalizeMimeType(candidate) === normalized)) {\n    return true;\n  }\n  // Allow bare type matches against codec-qualified allowlist entries.\n  const bare = normalized.split(\";\")[0]?.trim() ?? normalized;\n  return accepted.some((candidate) => {\n    const allowed = normalizeMimeType(candidate);\n    return allowed === bare || allowed.split(\";\")[0]?.trim() === bare;\n  });\n}\n\nexport function filenameForMimeType(mimeType: string): string {\n  const bare = normalizeMimeType(mimeType).split(\";\")[0] ?? \"audio/webm\";\n  switch (bare) {\n    case \"audio/mp4\":\n    case \"audio/m4a\":\n      return \"audio.mp4\";\n    case \"audio/ogg\":\n      return \"audio.ogg\";\n    case \"audio/mpeg\":\n    case \"audio/mp3\":\n      return \"audio.mp3\";\n    case \"audio/wav\":\n    case \"audio/x-wav\":\n      return \"audio.wav\";\n    case \"audio/webm\":\n    default:\n      return \"audio.webm\";\n  }\n}\n","// apps/api/src/sandbox/fleet.ts — the FLEET service backing the fleet MCP tools\n// (M7): list / attach / swap / run_on / provision over the heterogeneous fleet\n// (the session's Modal group box + the workspace's enrolled selfhosted machines).\n//\n// Each operation is workspace-scoped (the caller's grant) and, for the\n// session-pointer mutations (attach/swap), session-scoped (the worker-signed\n// sessionId claim). The swap is the epoch-fenced CAS `setActiveSandbox`: it bumps\n// active_epoch + repoints active_sandbox_id, which the routing proxy reads on the\n// NEXT tool call. Liveness for a selfhosted target is a real ControlRpc ping over\n// the events bus (the subject IS the registry); a Modal box is \"live\" while its\n// session group exists. `run_on` builds a one-off backend session and runs a\n// single op WITHOUT touching the active pointer.\n\nimport type { Settings } from \"@opengeni/config\";\nimport {\n  getEnrollment,\n  getSandbox,\n  listSandboxes,\n  readActiveSandbox,\n  readLease,\n  requireSession,\n  setActiveSandbox,\n  type Database,\n  type EnrollmentRecord,\n  type SandboxRecord,\n} from \"@opengeni/db\";\nimport type { EventBus } from \"@opengeni/events\";\nimport {\n  NatsControlRpc,\n  NatsOpStreamTransport,\n  selfhostedLiveness,\n  SelfhostedSession,\n  swapTargetEstablishability,\n  type BackendUnresolvableCode,\n  type ControlRpc,\n  type NatsRequestConnection,\n  type SelfhostedRelayConfig,\n  type SelfhostedOpStreamDeps,\n} from \"@opengeni/runtime/sandbox\";\nimport { relayConfigFromSettings } from \"./routing\";\n\nexport type FleetServices = {\n  db: Database;\n  settings: Settings;\n  bus?: EventBus;\n  /** API-direct readiness owner for the session's home group. Production wires\n   * this to the same viewer/provider verification + rematerialization path; core\n   * tests may omit it when exercising pointer mechanics only. */\n  ensureSessionGroupReady?: (ctx: FleetContext) => Promise<FleetReadinessHold>;\n};\n\nexport type FleetReadinessHold = {\n  /** Release target liveness only after route publication settles. */\n  release: () => Promise<void>;\n};\n\nexport type FleetContext = {\n  accountId: string;\n  workspaceId: string;\n  /** The calling session (the pointer the attach/swap mutates + whose group box\n   *  is the default fleet member). */\n  sessionId: string;\n  /** The session's own group sandbox backend (modal/selfhosted/…). */\n  sessionBackend: string;\n  /** The session's own group sandbox id (the lease group). */\n  sessionGroupId: string;\n};\n\n/**\n * Build a session-scoped {@link FleetContext}: load the session (workspace-\n * scoped) and project its group backend/id. A backend:none session has no home\n * box, but it may still discover, run on, and attach an owned Connected Machine.\n * Shared\n * by the worker-signed MCP fleet tools and the user-authenticated swap REST\n * route so both resolve the SAME context (no drift). The `accountId`/`workspaceId`/\n * `sessionId` come from the trusted grant/route; the backend + group id come from\n * the session row.\n */\nexport async function buildFleetContextForSession(\n  deps: { db: Database },\n  ctx: { accountId: string; workspaceId: string; sessionId: string },\n): Promise<FleetContext> {\n  const session = await requireSession(deps.db, ctx.workspaceId, ctx.sessionId);\n  return {\n    accountId: ctx.accountId,\n    workspaceId: ctx.workspaceId,\n    sessionId: ctx.sessionId,\n    sessionBackend: session.sandboxBackend,\n    sessionGroupId: session.sandboxGroupId,\n  };\n}\n\n/** The dominant liveness of a fleet member, surfaced to the dock + the agent. */\nexport type FleetLiveness = \"online\" | \"reconnecting\" | \"offline\";\nexport type FleetOperationAvailability = \"ready\" | \"wakeable\" | \"recovering\" | \"unavailable\";\n\n/**\n * A fleet member as the agent + the dock see it (the M8b/M9 UI seam — the\n * `sandboxes_list` response entry the dock renders). STABLE shape: the dock keys\n * on `id`, renders `name`/`kind`/`liveness`, and marks `active`. The session's own\n * Modal group box is a synthetic entry with `id: groupId`, `kind: \"modal\"`, and a\n * null `enrollmentId`; an enrolled machine carries its sandbox + enrollment ids.\n */\nexport type FleetSandboxEntry = {\n  /** The sandbox id used as the attach/swap/run_on `target`. For the session's\n   *  own group box this is the group id (a null active pointer == this box). */\n  id: string;\n  kind: \"modal\" | \"selfhosted\";\n  name: string;\n  liveness: FleetLiveness;\n  /** True for the session's currently-active sandbox (the routing target). */\n  active: boolean;\n  /** True for the session's own group box (the default/home sandbox). */\n  isSessionGroup: boolean;\n  enrollmentId: string | null;\n  /** Whether this target can be attached/swapped to right now (live + addressable). */\n  attachable: boolean;\n  /** Whether an ordinary shell/files operation can use this target. This is\n   * deliberately separate from `attachable`: an idle managed home sandbox can\n   * be wakeable even while its holderless lease is cold/draining and therefore\n   * not an already-live swap target. */\n  operationAvailability: FleetOperationAvailability;\n  /** Selfhosted only: whether whole-machine + screen-control consent is acked. */\n  consented?: boolean;\n  /** Selfhosted only: whether a display (real/Xvfb) is present. */\n  hasDisplay?: boolean;\n  lastSeenAt?: string | null;\n  /** Orthogonal truth dimensions. `liveness` is only their conservative UI\n   * projection and is never evidence for a specific dimension. */\n  providerStatus: \"not_created\" | \"creating\" | \"exists\" | \"missing\" | \"unknown\";\n  leaseLiveness: \"cold\" | \"warming\" | \"warm\" | \"draining\" | null;\n  routeStatus: \"attached\" | \"detached\";\n  archiveStatus: \"none\" | \"available\" | \"unverified\" | \"invalid\";\n  restoreStatus:\n    | \"not_required\"\n    | \"pending\"\n    | \"restoring\"\n    | \"verifying\"\n    | \"ready\"\n    | \"degraded\"\n    | \"unrecoverable\";\n  workspaceStatus: \"unknown\" | \"not_ready\" | \"ready\" | \"degraded\" | \"unrecoverable\";\n  leaseEpoch: number | null;\n  routeEpoch: number;\n  /** Numeric/boolean persistence truth only. Archive locations, content hashes,\n   * provider identities, and storage handles are intentionally not projected. */\n  workspaceGeneration: number | null;\n  archiveGeneration: number | null;\n  archiveComplete: boolean;\n};\n\nexport type FleetListResult = {\n  /** The session's currently-active sandbox id, or null == the group box. */\n  activeSandboxId: string | null;\n  activeEpoch: number;\n  sandboxes: FleetSandboxEntry[];\n};\n\n/** A swap/attach outcome the tool returns. On a rejection, `code` carries the\n *  typed reason (issue #341 typed diagnostics) alongside the human `reason`. */\nexport type FleetSwapResult = {\n  swapped: boolean;\n  activeSandboxId: string | null;\n  activeEpoch: number;\n  reason?: string;\n  code?:\n    | BackendUnresolvableCode\n    | \"concurrent_swap\"\n    | \"recovery_in_progress\"\n    | \"recovery_degraded\"\n    | \"recovery_unrecoverable\";\n};\n\nconst PROBE_TIMEOUT_MS = 5_000;\n\nfunction controlRpc(bus: EventBus | undefined): ControlRpc {\n  return new NatsControlRpc(async (): Promise<NatsRequestConnection | null> => {\n    if (!bus) {\n      return null;\n    }\n    return bus.getRequestConnection();\n  });\n}\n\n/** Probe an enrolled machine's liveness: a real ControlRpc ping (the subject IS\n *  the registry), mapped through `selfhostedLiveness` (the enrollment row's\n *  status/consent/display + lastSeenAt disambiguate a probe-miss into\n *  reconnecting vs offline). A revoked/never-seen enrollment is offline without a\n *  probe. */\nasync function probeEnrollment(\n  services: FleetServices,\n  workspaceId: string,\n  enrollment: EnrollmentRecord,\n): Promise<{ liveness: FleetLiveness; consented: boolean; hasDisplay: boolean }> {\n  const { settings, bus } = services;\n  let probeResponded = false;\n  if (enrollment.status === \"active\") {\n    const session = new SelfhostedSession({\n      workspaceId,\n      agentId: enrollment.id,\n      controlRpc: controlRpc(bus),\n      relay: relayConfigFromSettings(settings),\n      timeoutMs: PROBE_TIMEOUT_MS,\n    });\n    try {\n      probeResponded = await session.ping();\n    } catch {\n      probeResponded = false;\n    }\n  }\n  const state = selfhostedLiveness({\n    enrollment: {\n      status: enrollment.status,\n      exposure: enrollment.exposure,\n      allowScreenControl: enrollment.allowScreenControl,\n      hasDisplay: enrollment.hasDisplay,\n      lastSeenAt: enrollment.lastSeenAt,\n      wentOfflineAt: enrollment.wentOfflineAt,\n      wentOfflineReason: enrollment.wentOfflineReason,\n    },\n    probeResponded,\n  });\n  return { liveness: state.state, consented: state.consented, hasDisplay: state.hasDisplay };\n}\n\n/**\n * List the fleet: the session's own group box when it has one (a synthetic\n * entry) + the workspace's first-class selfhosted sandboxes (each probed for\n * liveness), each with an `active` marker derived from the session's active\n * pointer. A backend:none session has no synthetic home entry; a null pointer\n * then means no compute is attached.\n */\nexport async function listFleet(\n  services: FleetServices,\n  ctx: FleetContext,\n): Promise<FleetListResult> {\n  const { db } = services;\n  const pointer = (await readActiveSandbox(db, ctx.workspaceId, ctx.sessionId)) ?? {\n    activeSandboxId: null,\n    activeEpoch: 0,\n  };\n\n  const entries: FleetSandboxEntry[] = [];\n\n  if (ctx.sessionBackend !== \"none\") {\n    // The session's own group box (the default/home sandbox; null active pointer ==\n    // this box). A session/group row is not provider existence. Online requires a\n    // warm lease, observed provider existence, and verified workspace readiness.\n    const groupActive = pointer.activeSandboxId === null;\n    const groupLease = await readLease(db, ctx.workspaceId, ctx.sessionGroupId);\n    const groupOnline = Boolean(\n      groupLease?.liveness === \"warm\" &&\n      groupLease.recovery.provider.status === \"exists\" &&\n      groupLease.recovery.workspace.status === \"ready\",\n    );\n    const groupRecovering = Boolean(\n      groupLease &&\n      (groupLease.liveness === \"warming\" ||\n        groupLease.recovery.restore.status === \"pending\" ||\n        groupLease.recovery.restore.status === \"restoring\" ||\n        groupLease.recovery.restore.status === \"verifying\"),\n    );\n    const groupRecoveryUnavailable = Boolean(\n      groupLease &&\n      (groupLease.recovery.restore.status === \"degraded\" ||\n        groupLease.recovery.restore.status === \"unrecoverable\" ||\n        groupLease.recovery.workspace.status === \"degraded\" ||\n        groupLease.recovery.workspace.status === \"unrecoverable\"),\n    );\n    const groupOperationAvailability: FleetOperationAvailability = groupOnline\n      ? \"ready\"\n      : groupRecoveryUnavailable\n        ? \"unavailable\"\n        : groupRecovering\n          ? \"recovering\"\n          : ctx.sessionBackend === \"selfhosted\"\n            ? \"unavailable\"\n            : \"wakeable\";\n    entries.push({\n      id: ctx.sessionGroupId,\n      kind: ctx.sessionBackend === \"selfhosted\" ? \"selfhosted\" : \"modal\",\n      name: \"session sandbox\",\n      liveness: groupOnline ? \"online\" : groupRecovering ? \"reconnecting\" : \"offline\",\n      active: groupActive,\n      isSessionGroup: true,\n      enrollmentId: null,\n      attachable: groupOnline,\n      operationAvailability: groupOperationAvailability,\n      providerStatus: groupLease?.recovery.provider.status ?? \"not_created\",\n      leaseLiveness: groupLease?.liveness ?? null,\n      routeStatus: groupActive ? \"attached\" : \"detached\",\n      archiveStatus: groupLease?.recovery.archive.status ?? \"none\",\n      restoreStatus: groupLease?.recovery.restore.status ?? \"not_required\",\n      workspaceStatus: groupLease?.recovery.workspace.status ?? \"unknown\",\n      leaseEpoch: groupLease?.leaseEpoch ?? null,\n      routeEpoch: pointer.activeEpoch,\n      workspaceGeneration: groupLease?.workspaceGeneration ?? null,\n      archiveGeneration: groupLease?.archiveGeneration ?? null,\n      archiveComplete: groupLease?.archiveComplete ?? false,\n    });\n  }\n\n  // The workspace's first-class selfhosted sandboxes (enrolled machines). Probe\n  // each for liveness; a missing enrollment is offline.\n  const sandboxes = await listSandboxes(db, ctx.workspaceId);\n  for (const sandbox of sandboxes) {\n    if (sandbox.kind !== \"selfhosted\" || !sandbox.enrollmentId) {\n      continue;\n    }\n    const enrollment = await getEnrollment(db, ctx.workspaceId, sandbox.enrollmentId);\n    if (!enrollment || enrollment.status !== \"active\") {\n      // Revoked enrollments remain durable audit/history records, but they are\n      // intentionally absent from the normal attach/run picker.\n      continue;\n    }\n    const probe = enrollment\n      ? await probeEnrollment(services, ctx.workspaceId, enrollment)\n      : { liveness: \"offline\" as FleetLiveness, consented: false, hasDisplay: false };\n    entries.push({\n      id: sandbox.id,\n      kind: \"selfhosted\",\n      name: sandbox.name,\n      liveness: probe.liveness,\n      active: pointer.activeSandboxId === sandbox.id,\n      isSessionGroup: false,\n      enrollmentId: sandbox.enrollmentId,\n      attachable: probe.liveness === \"online\",\n      operationAvailability:\n        probe.liveness === \"online\"\n          ? \"ready\"\n          : probe.liveness === \"reconnecting\"\n            ? \"recovering\"\n            : \"unavailable\",\n      consented: probe.consented,\n      hasDisplay: probe.hasDisplay,\n      lastSeenAt: enrollment?.lastSeenAt ?? null,\n      providerStatus:\n        probe.liveness === \"online\"\n          ? \"exists\"\n          : probe.liveness === \"reconnecting\"\n            ? \"unknown\"\n            : \"missing\",\n      leaseLiveness: null,\n      routeStatus: pointer.activeSandboxId === sandbox.id ? \"attached\" : \"detached\",\n      archiveStatus: \"none\",\n      restoreStatus: \"not_required\",\n      workspaceStatus: probe.liveness === \"online\" ? \"ready\" : \"not_ready\",\n      leaseEpoch: null,\n      routeEpoch: pointer.activeEpoch,\n      workspaceGeneration: null,\n      archiveGeneration: null,\n      archiveComplete: false,\n    });\n  }\n\n  return {\n    activeSandboxId: pointer.activeSandboxId,\n    activeEpoch: pointer.activeEpoch,\n    sandboxes: entries,\n  };\n}\n\n/** Resolve a swap target id → the value `setActiveSandbox` writes. The session's\n *  own group id maps to NULL (the default pointer); a first-class sandbox id is\n *  validated (workspace ownership + liveness) and written verbatim. */\nasync function resolveTarget(\n  services: FleetServices,\n  ctx: FleetContext,\n  target: string,\n): Promise<\n  | { ok: true; targetSandboxId: string | null }\n  | { ok: false; reason: string; code: BackendUnresolvableCode }\n> {\n  // The session's own group box → the default pointer (null).\n  if (target === ctx.sessionGroupId || target === \"session\" || target === \"default\") {\n    if (ctx.sessionBackend === \"none\") {\n      return {\n        ok: false,\n        reason: \"this session has no home sandbox; attach a Connected Machine\",\n        code: \"unsupported_backend_context\",\n      };\n    }\n    return { ok: true, targetSandboxId: null };\n  }\n  const sandbox = await getSandbox(services.db, ctx.workspaceId, target);\n  if (!sandbox) {\n    return {\n      ok: false,\n      reason: `sandbox ${target} not found in this workspace`,\n      code: \"stale_pointer\",\n    };\n  }\n  // ESTABLISHER-CAPABILITY GATE (issue #341 invariant A): a target must be\n  // establishable by a turn's routing context BEFORE the epoch-fenced CAS commits\n  // the pointer, or a \"successful\" swap strands every following op on a backend no\n  // turn can resume. `swapTargetEstablishability` is the SAME predicate the turn\n  // resolver consults, so admission and establishment never disagree. Any sandbox\n  // reaching here is NOT the session's own group box (handled above), so a Modal\n  // sibling is rejected pre-commit rather than admitted-then-stranded.\n  const establishable = swapTargetEstablishability({\n    kind: sandbox.kind,\n    isSessionGroup: false,\n  });\n  if (!establishable.ok) {\n    return { ok: false, reason: establishable.reason, code: establishable.code };\n  }\n  if (sandbox.kind === \"selfhosted\") {\n    if (!sandbox.enrollmentId) {\n      return {\n        ok: false,\n        reason: `selfhosted sandbox ${target} has no enrollment`,\n        code: \"offline_enrollment\",\n      };\n    }\n    const enrollment = await getEnrollment(services.db, ctx.workspaceId, sandbox.enrollmentId);\n    if (!enrollment) {\n      return {\n        ok: false,\n        reason: `enrollment for sandbox ${target} not found`,\n        code: \"offline_enrollment\",\n      };\n    }\n    const probe = await probeEnrollment(services, ctx.workspaceId, enrollment);\n    if (probe.liveness !== \"online\") {\n      return {\n        ok: false,\n        reason: `sandbox ${target} is ${probe.liveness}; cannot attach to a non-online machine`,\n        code: \"offline_enrollment\",\n      };\n    }\n  }\n  return { ok: true, targetSandboxId: sandbox.id };\n}\n\n/**\n * THE SWAP (and attach — identical mechanic). Validate the target's ownership +\n * liveness, then repoint the session via the epoch-fenced CAS `setActiveSandbox`:\n * read the current epoch, then CAS on it. A concurrent double-swap lets exactly\n * one win; the loser re-reads + may retry. The bumped epoch fences any in-flight\n * op cached against the old pointer, which then retries against the new active\n * sandbox (the routing proxy's fenced-retry role).\n */\nexport async function swapActiveSandbox(\n  services: FleetServices,\n  ctx: FleetContext,\n  target: string,\n  // The session's working directory to seed alongside the pointer (create-time\n  // machine targeting). OMITTED ⇒ the column is left unchanged (a live swap/attach\n  // never touches it); threaded straight into the epoch-fenced setActiveSandbox CAS.\n  workingDir?: string | null,\n): Promise<FleetSwapResult> {\n  const resolved = await resolveTarget(services, ctx, target);\n  if (!resolved.ok) {\n    const pointer = (await readActiveSandbox(services.db, ctx.workspaceId, ctx.sessionId)) ?? {\n      activeSandboxId: null,\n      activeEpoch: 0,\n    };\n    // Fail BEFORE the CAS: the pointer + epoch are read back unchanged and echoed,\n    // so an unestablishable target never mutates the session's routing state.\n    return {\n      swapped: false,\n      activeSandboxId: pointer.activeSandboxId,\n      activeEpoch: pointer.activeEpoch,\n      reason: resolved.reason,\n      code: resolved.code,\n    };\n  }\n\n  let readinessHold: FleetReadinessHold | undefined;\n  if (resolved.targetSandboxId === null && services.ensureSessionGroupReady) {\n    try {\n      readinessHold = await services.ensureSessionGroupReady(ctx);\n    } catch (error) {\n      const lease = await readLease(services.db, ctx.workspaceId, ctx.sessionGroupId);\n      const restore = lease?.recovery.restore.status;\n      const code =\n        restore === \"degraded\"\n          ? (\"recovery_degraded\" as const)\n          : restore === \"unrecoverable\"\n            ? (\"recovery_unrecoverable\" as const)\n            : (\"recovery_in_progress\" as const);\n      const pointer = (await readActiveSandbox(services.db, ctx.workspaceId, ctx.sessionId)) ?? {\n        activeSandboxId: null,\n        activeEpoch: 0,\n      };\n      return {\n        swapped: false,\n        activeSandboxId: pointer.activeSandboxId,\n        activeEpoch: pointer.activeEpoch,\n        reason:\n          error instanceof Error\n            ? error.message\n            : \"session sandbox did not reach verified readiness\",\n        code,\n      };\n    }\n  }\n\n  try {\n    // Read the current epoch, then CAS on it (the fence). One retry on a lost race\n    // (a concurrent swap bumped the epoch between read and write).\n    for (let attempt = 0; attempt < 2; attempt += 1) {\n      const pointer = (await readActiveSandbox(services.db, ctx.workspaceId, ctx.sessionId)) ?? {\n        activeSandboxId: null,\n        activeEpoch: 0,\n      };\n      // Even a same-target attach advances active_epoch. It is a repair/fence\n      // request, not a no-op acknowledgment: any cached stale route is invalidated\n      // only after target readiness has been proved above.\n      const result = await setActiveSandbox(services.db, {\n        accountId: ctx.accountId,\n        workspaceId: ctx.workspaceId,\n        sessionId: ctx.sessionId,\n        targetSandboxId: resolved.targetSandboxId,\n        expectedEpoch: pointer.activeEpoch,\n        ...(workingDir !== undefined ? { workingDir } : {}),\n      });\n      if (result.swapped && result.pointer) {\n        return {\n          swapped: true,\n          activeSandboxId: result.pointer.activeSandboxId,\n          activeEpoch: result.pointer.activeEpoch,\n        };\n      }\n      // CAS lost (a concurrent swap won) — re-read + retry once.\n    }\n    const pointer = (await readActiveSandbox(services.db, ctx.workspaceId, ctx.sessionId)) ?? {\n      activeSandboxId: null,\n      activeEpoch: 0,\n    };\n    return {\n      swapped: false,\n      activeSandboxId: pointer.activeSandboxId,\n      activeEpoch: pointer.activeEpoch,\n      reason: \"a concurrent swap won the epoch fence; re-read and retry\",\n      code: \"concurrent_swap\",\n    };\n  } finally {\n    // Do not let a cleanup failure turn an already-committed route CAS into a\n    // false failure. Viewer holders are TTL-bounded and will be reaped if this\n    // best-effort explicit release cannot complete.\n    await readinessHold?.release().catch(() => undefined);\n  }\n}\n\nexport type RunOnOp =\n  | { kind: \"exec\"; cmd: string; workdir?: string }\n  | { kind: \"read\"; path: string }\n  | { kind: \"write\"; path: string; content: string };\n\nexport type RunOnResult = {\n  target: string;\n  kind: string;\n  ok: boolean;\n  /** Display name of the target sandbox when known (from the sandboxes row). */\n  targetName?: string;\n  stdout?: string;\n  stderr?: string;\n  exitCode?: number | null;\n  /** Exec only: whether the machine killed the child at its process deadline. */\n  timedOut?: boolean;\n  /** Exec only: the effective clamped process deadline enforced by the machine. */\n  deadlineMs?: number;\n  content?: string;\n  bytesWritten?: number;\n  reason?: string;\n};\n\nexport type RunOnSelfhostedMachine = {\n  workspaceId: string;\n  agentId: string;\n  controlRpc: ControlRpc;\n  relay: SelfhostedRelayConfig;\n  /** Short request/reply deadline for read/write and other control operations. */\n  controlTimeoutMs: number;\n  /** Longer agent-side process deadline for exec. */\n  execTimeoutMs: number;\n  /** Streaming transport required when execTimeoutMs is 0 (unbounded). */\n  opStream?: SelfhostedOpStreamDeps;\n};\n\n/**\n * Execute the one-off machine operation once the workspace/enrollment lookup has\n * succeeded. Kept separate from {@link runOnSandbox} so the command/deadline\n * contract is deterministic against an in-memory ControlRpc without weakening\n * the production ownership lookup or requiring a real machine.\n */\nexport async function executeRunOnSelfhostedMachine(\n  machine: RunOnSelfhostedMachine,\n  target: string,\n  op: RunOnOp,\n): Promise<RunOnResult> {\n  const session = new SelfhostedSession({\n    workspaceId: machine.workspaceId,\n    agentId: machine.agentId,\n    controlRpc: machine.controlRpc,\n    relay: machine.relay,\n    timeoutMs: machine.controlTimeoutMs,\n    execTimeoutMs: machine.execTimeoutMs,\n    ...(machine.opStream !== undefined ? { opStream: machine.opStream } : {}),\n  });\n\n  try {\n    if (op.kind === \"exec\") {\n      const deadlineMs = session.effectiveExecDeadlineMs;\n      const res = await session.exec({\n        cmd: op.cmd,\n        ...(op.workdir ? { workdir: op.workdir } : {}),\n      });\n      const timedOut = res.timedOut === true;\n      const hasTerminalExit = res.exitCode !== null;\n      return {\n        target,\n        kind: \"exec\",\n        // `ok` means the one-off operation reached a terminal response. Preserve\n        // the established non-zero-exit behavior, but never claim success when\n        // the machine killed the child or returned no terminal exit proof.\n        ok: !timedOut && hasTerminalExit,\n        stdout: res.stdout,\n        stderr: res.stderr,\n        exitCode: res.exitCode,\n        timedOut,\n        deadlineMs,\n        ...(timedOut\n          ? { reason: `command exceeded the ${deadlineMs} ms execution deadline` }\n          : !hasTerminalExit\n            ? { reason: \"machine returned no terminal exit code\" }\n            : {}),\n      };\n    }\n    if (op.kind === \"read\") {\n      const bytes = await session.readFile({ path: op.path });\n      return { target, kind: \"read\", ok: true, content: new TextDecoder().decode(bytes) };\n    }\n    const bytesWritten = await session.writeFile({ path: op.path, content: op.content });\n    return { target, kind: \"write\", ok: true, bytesWritten };\n  } catch (error) {\n    const reason = error instanceof Error ? error.message : String(error);\n    return {\n      target,\n      kind: op.kind,\n      ok: false,\n      reason,\n      // A transport failure is not evidence that the process itself timed out,\n      // so leave `timedOut` absent while still reporting the enforced deadline.\n      ...(op.kind === \"exec\" ? { deadlineMs: session.effectiveExecDeadlineMs } : {}),\n    };\n  } finally {\n    // This one-off has no turn journal. Once its result has been accepted by\n    // this call, final-ack any settled stream so the runner can immediately\n    // release replay/output retention instead of waiting for TTL cleanup.\n    await session.finalizeOpStreamOps().catch(() => undefined);\n  }\n}\n\n/**\n * Run a ONE-OFF op against a SPECIFIC target WITHOUT changing the active pointer\n * (the design `run_on`). Only selfhosted targets are routable as a one-off here\n * (a Modal target is the session's group box, reached via the normal Channel-A /\n * turn path — `run_on` is for reaching a NON-active enrolled machine without\n * swapping). The op is fenced under the target's enrollment, addressed to its\n * agent subject; an offline machine surfaces a clear reason, never a wrong-box\n * landing.\n */\nexport async function runOnSandbox(\n  services: FleetServices,\n  ctx: FleetContext,\n  target: string,\n  op: RunOnOp,\n): Promise<RunOnResult> {\n  const sandbox = await getSandbox(services.db, ctx.workspaceId, target);\n  if (!sandbox) {\n    return {\n      target,\n      kind: op.kind,\n      ok: false,\n      reason: `sandbox ${target} not found in this workspace`,\n    };\n  }\n  if (sandbox.kind !== \"selfhosted\" || !sandbox.enrollmentId) {\n    return {\n      target,\n      targetName: sandbox.name,\n      kind: op.kind,\n      ok: false,\n      reason: `run_on routes one-off ops to enrolled selfhosted machines; ${sandbox.kind} targets are reached via the active sandbox (swap to it first)`,\n    };\n  }\n  const enrollment = await getEnrollment(services.db, ctx.workspaceId, sandbox.enrollmentId);\n  if (!enrollment || enrollment.status !== \"active\") {\n    return {\n      target,\n      targetName: sandbox.name,\n      kind: op.kind,\n      ok: false,\n      reason: `sandbox ${target} is not enrolled/active`,\n    };\n  }\n\n  const result = await executeRunOnSelfhostedMachine(\n    {\n      workspaceId: ctx.workspaceId,\n      agentId: sandbox.enrollmentId,\n      controlRpc: controlRpc(services.bus),\n      relay: relayConfigFromSettings(services.settings),\n      controlTimeoutMs: services.settings.sandboxSelfhostedControlTimeoutMs,\n      execTimeoutMs: services.settings.sandboxSelfhostedExecTimeoutMs,\n      ...(services.settings.agentOpStreamEnabled === true &&\n      enrollment.opStream === true &&\n      services.bus?.getOpStreamConnection\n        ? {\n            opStream: {\n              transport: new NatsOpStreamTransport(\n                async () => services.bus?.getOpStreamConnection?.() ?? null,\n              ),\n            },\n          }\n        : {}),\n    },\n    target,\n    op,\n  );\n  return { ...result, targetName: sandbox.name };\n}\n\nexport type ProvisionResult =\n  | {\n      kind: \"selfhosted\";\n      instructions: string;\n      installCommandUnix: string;\n      installCommandWindows: string;\n      verificationUri: string;\n      note: string;\n    }\n  | { kind: \"modal\"; sandbox: SandboxRecord; note: string };\n\n/**\n * Provision a new fleet member.\n *   - selfhosted → return the device-flow enrollment instructions (the agent\n *     surfaces them to a HUMAN, who installs the agent + enrolls — the agent\n *     cannot click the loud whole-machine consent itself).\n *   - modal → create a first-class named modal `sandboxes` record (a swap target).\n *     NOTE: the Modal BOX is materialized lazily when first swapped-to (Modal\n * lifecycle is owned by the lease — unchanged per).\n */\nexport async function provisionSandbox(\n  services: FleetServices,\n  ctx: FleetContext,\n  input: { kind: \"selfhosted\" | \"modal\"; name?: string },\n): Promise<ProvisionResult> {\n  if (input.kind === \"selfhosted\") {\n    const base = (services.settings.publicBaseUrl ?? \"https://get.opengeni.ai\").replace(/\\/+$/, \"\");\n    return {\n      kind: \"selfhosted\",\n      instructions:\n        \"Share these instructions with a human operator. They install the OpenGeni agent on the machine, run `opengeni-agent connect`, complete the device-flow at the verification URL (the loud whole-machine + screen-control consent), and the machine then appears here as an attachable selfhosted sandbox. Existing connections to other OpenGeni workspaces or deployments are preserved.\",\n      // Install from THIS control plane's origin (not a hardcoded public CDN): the\n      // served install script is rewritten to pull the per-SHA agent baked into\n      // this exact deployment (see apps/api/src/routes/install.ts), so a deployed\n      // env is self-contained and a private/air-gapped one works with no public DNS.\n      installCommandUnix: `curl -fsSL ${base}/install.sh | sh`,\n      installCommandWindows: `irm ${base}/install.ps1 | iex`,\n      verificationUri: `${base}/device`,\n      note: \"Whole-machine access requires explicit human consent in the device-flow web page; the agent cannot self-consent.\",\n    };\n  }\n  // modal: create a first-class named modal sandbox record. NOTE: a session cannot\n  // yet be swapped onto a second Modal box — cross-group Modal routing is not built,\n  // so `sandbox_swap` to this id is rejected (unsupported_backend_context). The\n  // response says so plainly rather than implying an attach that does not work.\n  const { createSandbox } = await import(\"@opengeni/db\");\n  const sandbox = await createSandbox(services.db, {\n    accountId: ctx.accountId,\n    workspaceId: ctx.workspaceId,\n    kind: \"modal\",\n    name: input.name?.trim() || \"modal-box\",\n  });\n  return {\n    kind: \"modal\",\n    sandbox,\n    note: \"A named Modal sandbox record was created, but it is NOT yet attachable as a swap target: routing a session onto a second Modal box is not supported yet, so a sandbox_swap to this id is rejected. Use the session's own box (the default) or attach a Connected Machine instead.\",\n  };\n}\n","// apps/api/src/sandbox/channel-a.ts — wire the agent-loop-free routing proxy to the\n// real DB pointer + the live NATS control plane for the API-DIRECT Channel-A path\n// (M7). Symmetric with apps/worker/src/sandbox-routing.ts (the turn path).\n//\n// A Channel-A op runs against one established home: either a lease-owned provider\n// box or a Connected Machine home that intentionally has no cloud lease. With\n// hot-swap, the op must land on the session's CURRENTLY-active sandbox. The\n// established session is wrapped in a `RoutingSandboxSession` that re-reads\n// (active_sandbox_id, active_epoch) and dispatches to the active backend.\n//\n// The DB-coupled glue (readActiveSandbox / getSandbox / the selfhosted ControlRpc\n// over the events bus) lives here, not in the leaf (which stays db-free).\n\nimport { sandboxLifecycleTransitionWaitMs, type Settings } from \"@opengeni/config\";\nimport {\n  advanceWorkspaceGenerationForDirectRequest,\n  advanceWorkspaceGenerationForRetainedProcess,\n  getEnrollment,\n  getRetainedProcess,\n  getSandbox,\n  markWarmLeaseInstanceLost,\n  readActiveSandbox,\n  retainWorkspaceMutationProcess,\n  retainedProcessSettlementIdentity,\n  settleRetainedProcess,\n  verifyDirectWorkspaceMutationSettlement,\n  verifyRetainedProcessMutationSettlement,\n  type Database,\n  type SandboxWorkspaceMutationAdmission,\n} from \"@opengeni/db\";\nimport { appendAndPublishEvents, type EventBus } from \"@opengeni/events\";\nimport {\n  isProviderSandboxGoneDuringRoutedOperation,\n  makeActiveBackendResolver,\n  NatsControlRpc,\n  NatsOpStreamTransport,\n  RoutingSandboxSession,\n  resolveModalCheckpointProviderBindingForSession,\n  type ControlRpc,\n  type EstablishedSandboxSession,\n  type NatsRequestConnection,\n  type ResolvedActiveBackend,\n  type RoutableBackendSession,\n  type RoutableSandbox,\n  type RoutingRetainedProcess,\n  type RoutingRetainedProcessTerminalProof,\n  type RoutingSandboxOperationObserver,\n  type SelfhostedRelayConfig,\n  type SelfhostedOpStreamDeps,\n} from \"@opengeni/runtime/sandbox\";\n\ntype PersistableMutationAdmission = {\n  admission: SandboxWorkspaceMutationAdmission;\n  providerBinding: Awaited<\n    ReturnType<typeof resolveModalCheckpointProviderBindingForSession>\n  > | null;\n};\n\nexport type ChannelARoutingServices = {\n  db: Database;\n  settings: Settings;\n  bus?: EventBus;\n  onSandboxOperation?: RoutingSandboxOperationObserver;\n  waitSignal?: AbortSignal;\n};\n\n/** Map the deployment relay URL to the leaf's `SelfhostedRelayConfig` shape. The\n *  relay URL (`OPENGENI_SELFHOSTED_RELAY_URL`) may carry a path (the relay's wss\n *  route); a path-less URL defaults to the relay's `/stream` route (M8b). */\nexport function relayConfigFromSettings(settings: Settings): SelfhostedRelayConfig {\n  const raw = settings.selfhostedRelayUrl?.trim();\n  if (!raw) {\n    return {\n      host: \"relay.opengeni.local\",\n      port: 443,\n      tls: true,\n      path: \"/stream\",\n    };\n  }\n  try {\n    const url = new URL(raw.includes(\"://\") ? raw : `wss://${raw}`);\n    const tls = url.protocol === \"wss:\" || url.protocol === \"https:\";\n    const port = url.port ? Number(url.port) : tls ? 443 : 80;\n    // Honor an explicit path in the configured URL; default the relay's /stream.\n    const path = url.pathname && url.pathname !== \"/\" ? url.pathname : \"/stream\";\n    return { host: url.hostname, port, tls, path };\n  } catch {\n    return { host: raw, port: 443, tls: true, path: \"/stream\" };\n  }\n}\n\n/** The canonical relay dial-BASE URL (`scheme://host[:port]/stream`) handed to the\n *  agent PRODUCER. The agent's relay channel appends ONLY its routing query to\n *  this base (`channel.rs`: `format!(\"{relay_url}{sep}{query}\")`) and relies on the\n *  base ALREADY carrying the relay's `/stream` route. `OPENGENI_SELFHOSTED_RELAY_URL`\n *  is frequently pathless (e.g. `wss://relay.<env>.app.opengeni.ai`), which made the\n *  producer dial a path-less URL the relay 400s. Derive the base from the SAME parser\n *  the CONSUMER uses (`relayConfigFromSettings`) so producer + consumer always agree\n *  on `/stream` — even when the configured URL omits it. An unconfigured relay maps to\n *  `\"\"` (graceful degrade: the agent reports no-relay rather than dialing a synthetic\n * host). Fixes preview AND managed prod with no agent rebuild. */\nexport function relayDialBaseFromSettings(settings: Settings): string {\n  if (!settings.selfhostedRelayUrl?.trim()) return \"\";\n  const { host, port, tls, path } = relayConfigFromSettings(settings);\n  const scheme = tls ? \"wss\" : \"ws\";\n  const defaultPort = tls ? 443 : 80;\n  const authority = port === defaultPort ? host : `${host}:${port}`;\n  return `${scheme}://${authority}${path}`;\n}\n\nfunction controlRpcFactory(bus: EventBus | undefined): () => ControlRpc {\n  return () =>\n    new NatsControlRpc(async (): Promise<NatsRequestConnection | null> => {\n      if (!bus) {\n        return null;\n      }\n      return bus.getRequestConnection();\n    });\n}\n\nasync function resolveSelfhostedOpStream(\n  services: ChannelARoutingServices,\n  workspaceId: string,\n  sandbox: RoutableSandbox,\n): Promise<SelfhostedOpStreamDeps | undefined> {\n  if (\n    services.settings.agentOpStreamEnabled !== true ||\n    !services.bus?.getOpStreamConnection ||\n    !sandbox.enrollmentId\n  ) {\n    return undefined;\n  }\n  const enrollment = await getEnrollment(services.db, workspaceId, sandbox.enrollmentId);\n  if (enrollment?.opStream !== true) return undefined;\n  return {\n    transport: new NatsOpStreamTransport(\n      async () => services.bus?.getOpStreamConnection?.() ?? null,\n    ),\n  };\n}\n\n/** Whether the routing proxy should wrap the Channel-A box: gated by the\n *  selfhosted flag (the active pointer + swap are only meaningful then). */\nexport function routingEnabled(settings: Settings): boolean {\n  return settings.sandboxSelfhostedEnabled === true;\n}\n\n/**\n * Wrap an established home session in a `RoutingSandboxSession` so a Channel-A\n * op routes to the session's currently-active sandbox. Provider homes supply a\n * lease; machine homes supply a pinned selfhosted identity and no lease. Returns\n * the established handle with its `session` replaced by the stable proxy.\n */\nexport function wrapChannelABoxWithRouting(\n  services: ChannelARoutingServices,\n  ids: {\n    accountId: string;\n    workspaceId: string;\n    sessionId: string;\n    homeLease?: {\n      sandboxGroupId: string;\n      leaseEpoch: number;\n      instanceId: string;\n      backend: string;\n    };\n    /** A machine-home Channel-A request has no cloud/home lease. Its already\n     * established SelfhostedSession is pinned to the durable active pointer so\n     * the first command uses the exact machine instance and epoch. */\n    pinnedSelfhosted?: {\n      sandboxId: string;\n      epoch: number;\n    };\n    directRequest: {\n      requestId: string;\n      holderId: string;\n    };\n  },\n  established: EstablishedSandboxSession,\n): EstablishedSandboxSession {\n  const { db, settings, bus } = services;\n  const homeLease = ids.homeLease;\n  const beforeMutation = homeLease\n    ? async ({\n        op,\n        backend,\n      }: {\n        op: string;\n        backend: ResolvedActiveBackend;\n      }): Promise<PersistableMutationAdmission | null> => {\n        // Connected Machines and other non-persistable targets intentionally do\n        // not dirty or advance the cloud-home archive generation.\n        if (\n          backend.sandboxId !== null ||\n          backend.leaseEpoch === undefined ||\n          backend.providerInstanceId === undefined\n        ) {\n          return null;\n        }\n        if (backend.activeEpoch === undefined) {\n          throw new Error(\"API-direct workspace mutation resolved without an active route epoch\");\n        }\n        const providerBinding =\n          homeLease.backend === \"modal\"\n            ? await resolveModalCheckpointProviderBindingForSession(settings, backend.session)\n            : null;\n        const admission = await advanceWorkspaceGenerationForDirectRequest(db, {\n          accountId: ids.accountId,\n          workspaceId: ids.workspaceId,\n          sessionId: ids.sessionId,\n          requestId: ids.directRequest.requestId,\n          holderId: ids.directRequest.holderId,\n          sandboxGroupId: homeLease.sandboxGroupId,\n          expectedEpoch: backend.leaseEpoch,\n          expectedInstanceId: backend.providerInstanceId,\n          routeTargetId: backend.sandboxId,\n          routeEpoch: backend.activeEpoch,\n          operation: op,\n          captureWaitMs: sandboxLifecycleTransitionWaitMs(settings),\n          ...(services.waitSignal ? { waitSignal: services.waitSignal } : {}),\n        });\n        return { admission, providerBinding };\n      }\n    : undefined;\n  const afterMutation = homeLease\n    ? async ({\n        op,\n        backend,\n        admission,\n        outcome,\n        retainedProcess,\n      }: {\n        op: string;\n        backend: ResolvedActiveBackend;\n        admission: unknown;\n        outcome: \"resolved\" | \"rejected\";\n        result?: unknown;\n        retainedProcess?: RoutingRetainedProcess;\n      }): Promise<void> => {\n        if (admission === null) return;\n        if (\n          !admission ||\n          typeof admission !== \"object\" ||\n          backend.leaseEpoch === undefined ||\n          backend.providerInstanceId === undefined ||\n          backend.activeEpoch === undefined\n        ) {\n          throw new Error(\"API-direct workspace mutation settlement lacked its exact admission\");\n        }\n        const boundAdmission = admission as Partial<PersistableMutationAdmission>;\n        const exactAdmission = boundAdmission.admission;\n        if (\n          !exactAdmission ||\n          typeof exactAdmission.id !== \"string\" ||\n          typeof exactAdmission.workspaceGeneration !== \"number\" ||\n          !(\"providerBinding\" in boundAdmission)\n        ) {\n          throw new Error(\"API-direct workspace mutation settlement lacked its bound admission\");\n        }\n        if (outcome === \"resolved\" && retainedProcess) {\n          await retainWorkspaceMutationProcess(db, {\n            accountId: ids.accountId,\n            workspaceId: ids.workspaceId,\n            sessionId: ids.sessionId,\n            processId: retainedProcess.id,\n            providerSessionId: retainedProcess.providerSessionId,\n            admissionId: exactAdmission.id,\n            admittedWorkspaceGeneration: exactAdmission.workspaceGeneration,\n            operation: op,\n            providerBinding: boundAdmission.providerBinding ?? null,\n            owner: {\n              kind: \"direct\",\n              requestId: ids.directRequest.requestId,\n              holderId: ids.directRequest.holderId,\n              sandboxGroupId: homeLease.sandboxGroupId,\n              expectedEpoch: backend.leaseEpoch,\n              expectedInstanceId: backend.providerInstanceId,\n              routeTargetId: exactAdmission.routeTargetId,\n              routeEpoch: exactAdmission.routeEpoch,\n            },\n          });\n          return;\n        }\n        await verifyDirectWorkspaceMutationSettlement(db, {\n          accountId: ids.accountId,\n          workspaceId: ids.workspaceId,\n          sessionId: ids.sessionId,\n          requestId: ids.directRequest.requestId,\n          holderId: ids.directRequest.holderId,\n          sandboxGroupId: homeLease.sandboxGroupId,\n          expectedEpoch: backend.leaseEpoch,\n          expectedInstanceId: backend.providerInstanceId,\n          routeTargetId: exactAdmission.routeTargetId,\n          routeEpoch: exactAdmission.routeEpoch,\n          admission: exactAdmission,\n          operation: op,\n          outcome,\n        });\n      }\n    : undefined;\n  const beforeProcessMutation = homeLease\n    ? async ({\n        op,\n        process,\n      }: {\n        op: string;\n        backend: ResolvedActiveBackend;\n        process: RoutingRetainedProcess;\n      }): Promise<SandboxWorkspaceMutationAdmission> =>\n        await advanceWorkspaceGenerationForRetainedProcess(db, {\n          accountId: ids.accountId,\n          workspaceId: ids.workspaceId,\n          sessionId: ids.sessionId,\n          processId: process.id,\n          operation: op,\n          captureWaitMs: sandboxLifecycleTransitionWaitMs(settings),\n          ...(services.waitSignal ? { waitSignal: services.waitSignal } : {}),\n        })\n    : undefined;\n  const afterProcessMutation = homeLease\n    ? async ({\n        op,\n        process,\n        admission,\n        outcome,\n      }: {\n        op: string;\n        backend: ResolvedActiveBackend;\n        process: RoutingRetainedProcess;\n        admission: unknown;\n        outcome: \"resolved\" | \"rejected\";\n        result?: unknown;\n      }): Promise<void> => {\n        if (\n          !admission ||\n          typeof admission !== \"object\" ||\n          typeof (admission as Partial<SandboxWorkspaceMutationAdmission>).id !== \"string\" ||\n          typeof (admission as Partial<SandboxWorkspaceMutationAdmission>).workspaceGeneration !==\n            \"number\"\n        ) {\n          throw new Error(\"API retained-process mutation settlement lacked its exact admission\");\n        }\n        await verifyRetainedProcessMutationSettlement(db, {\n          accountId: ids.accountId,\n          workspaceId: ids.workspaceId,\n          sessionId: ids.sessionId,\n          processId: process.id,\n          admission: admission as SandboxWorkspaceMutationAdmission,\n          operation: op,\n          outcome,\n        });\n      }\n    : undefined;\n  const settleProcess = homeLease\n    ? async ({\n        backend,\n        process,\n        proof,\n      }: {\n        backend: ResolvedActiveBackend;\n        process: RoutingRetainedProcess;\n        proof: RoutingRetainedProcessTerminalProof;\n      }): Promise<void> => {\n        if (\n          backend.sandboxId !== null ||\n          backend.leaseEpoch === undefined ||\n          backend.providerInstanceId === undefined ||\n          backend.activeEpoch === undefined\n        ) {\n          return;\n        }\n        const durable = await getRetainedProcess(db, {\n          workspaceId: ids.workspaceId,\n          sessionId: ids.sessionId,\n          processId: process.id,\n        });\n        if (\n          !durable ||\n          durable.providerSessionId !== process.providerSessionId ||\n          durable.providerBackend !== backend.kind ||\n          durable.providerInstanceId !== backend.providerInstanceId ||\n          durable.leaseEpoch !== backend.leaseEpoch ||\n          durable.routeKind !== (backend.sandboxId === null ? \"home\" : \"active\") ||\n          durable.routeTargetId !== backend.sandboxId ||\n          durable.routeEpoch !== backend.activeEpoch\n        ) {\n          throw new Error(\n            \"API retained-process settlement lost its exact durable backend identity\",\n          );\n        }\n        await settleRetainedProcess(db, {\n          accountId: ids.accountId,\n          workspaceId: ids.workspaceId,\n          sessionId: ids.sessionId,\n          processId: process.id,\n          expected: retainedProcessSettlementIdentity(durable),\n          outcome: proof.outcome,\n          exitCode: proof.exitCode,\n          reason: proof.reason,\n          idleGraceMs: settings.sandboxIdleGraceMs,\n        });\n      }\n    : undefined;\n  const resolver = makeActiveBackendResolver({\n    workspaceId: ids.workspaceId,\n    defaultBackend: established.session as RoutableBackendSession,\n    defaultKind: established.backendId,\n    getSandbox: async (sandboxId): Promise<RoutableSandbox | null> => {\n      const sandbox = await getSandbox(db, ids.workspaceId, sandboxId);\n      return sandbox\n        ? {\n            id: sandbox.id,\n            kind: sandbox.kind,\n            name: sandbox.name,\n            enrollmentId: sandbox.enrollmentId,\n          }\n        : null;\n    },\n    controlRpcFactory: controlRpcFactory(bus),\n    resolveSelfhostedOpStream: (sandbox) =>\n      resolveSelfhostedOpStream(services, ids.workspaceId, sandbox),\n    relay: relayConfigFromSettings(settings),\n    selfhostedTimeoutMs: settings.sandboxSelfhostedControlTimeoutMs,\n    selfhostedExecTimeoutMs: settings.sandboxSelfhostedExecTimeoutMs,\n    ...(ids.pinnedSelfhosted\n      ? {\n          pinnedSelfhosted: {\n            sandboxId: ids.pinnedSelfhosted.sandboxId,\n            epoch: ids.pinnedSelfhosted.epoch,\n            session: established.session as RoutableBackendSession,\n          },\n        }\n      : {}),\n    ...(homeLease\n      ? {\n          resolveDefaultBackend: async () => ({\n            session: established.session as RoutableBackendSession,\n            sandboxId: null,\n            kind: established.backendId,\n            leaseEpoch: homeLease.leaseEpoch,\n            providerInstanceId: homeLease.instanceId,\n          }),\n        }\n      : {}),\n  });\n\n  const proxy = new RoutingSandboxSession({\n    defaultResolved: {\n      session: established.session as RoutableBackendSession,\n      sandboxId: null,\n      kind: established.backendId,\n      ...(homeLease\n        ? {\n            leaseEpoch: homeLease.leaseEpoch,\n            providerInstanceId: homeLease.instanceId,\n          }\n        : {}),\n    },\n    readPointer: async () => {\n      if (!routingEnabled(settings)) {\n        return { activeSandboxId: null, activeEpoch: 0 };\n      }\n      const pointer = await readActiveSandbox(db, ids.workspaceId, ids.sessionId);\n      return pointer ?? { activeSandboxId: null, activeEpoch: 0 };\n    },\n    resolveActiveBackend: resolver,\n    ...(services.onSandboxOperation ? { onOperation: services.onSandboxOperation } : {}),\n    ...(beforeMutation ? { beforeMutation } : {}),\n    ...(afterMutation ? { afterMutation } : {}),\n    ...(beforeProcessMutation ? { beforeProcessMutation } : {}),\n    ...(afterProcessMutation ? { afterProcessMutation } : {}),\n    ...(settleProcess ? { settleProcess } : {}),\n    ...(homeLease\n      ? {\n          onDefaultBackendError: async ({ error }: { error: unknown }) => {\n            if (!isProviderSandboxGoneDuringRoutedOperation(homeLease.backend, error)) return null;\n            const marked = await markWarmLeaseInstanceLost(db, {\n              accountId: ids.accountId,\n              workspaceId: ids.workspaceId,\n              sandboxGroupId: homeLease.sandboxGroupId,\n              expectedEpoch: homeLease.leaseEpoch,\n              expectedInstanceId: homeLease.instanceId,\n              diagnostic: \"provider_not_found_during_routed_operation\",\n            });\n            if (marked.status === \"marked\" && bus) {\n              await appendAndPublishEvents(db, bus, ids.workspaceId, ids.sessionId, [\n                {\n                  type: \"sandbox.box.lost\",\n                  payload: { sandboxId: homeLease.instanceId },\n                },\n              ]).catch(() => undefined);\n            }\n            const lease = marked.lease;\n            const restore = lease?.recovery.restore.status;\n            return {\n              leaseEpoch: lease?.leaseEpoch ?? homeLease.leaseEpoch,\n              recovery:\n                marked.status === \"stale\"\n                  ? (\"superseded\" as const)\n                  : restore === \"pending\"\n                    ? (\"pending\" as const)\n                    : restore === \"degraded\"\n                      ? (\"degraded\" as const)\n                      : (\"unrecoverable\" as const),\n            };\n          },\n        }\n      : {}),\n  });\n\n  return { ...established, session: proxy };\n}\n","import { resolveFirstPartyDelegationSecret, type Settings } from \"@opengeni/config\";\nimport {\n  verifyDelegatedAccessToken,\n  type AccountGrant,\n  type AccessContext,\n  type AccessGrant,\n  type Permission,\n} from \"@opengeni/contracts\";\nimport {\n  bootstrapWorkspace,\n  ensureManagedAccessForUser,\n  findActiveApiKeyByHash,\n  getWorkspaceGrant,\n  requireWorkspace,\n  type Database,\n} from \"@opengeni/db\";\nimport type { Context } from \"hono\";\nimport { HTTPException } from \"hono/http-exception\";\nimport type { ManagedAuth } from \"../managed-auth-type\";\nimport { getManagedSession } from \"../managed-session\";\n\nconst bearerPrefix = \"Bearer \";\nconst accessContextByRequest = new WeakMap<Request, Promise<AccessContext | null>>();\n\nexport type AccessDeps = {\n  db: Database;\n  settings: Settings;\n  managedAuth?: ManagedAuth | null;\n};\n\nexport async function requireAccessContext(c: Context, deps: AccessDeps): Promise<AccessContext> {\n  let pending = accessContextByRequest.get(c.req.raw);\n  if (!pending) {\n    pending = resolveAccessContext(c, deps);\n    accessContextByRequest.set(c.req.raw, pending);\n  }\n  const context = await pending;\n  if (!context) {\n    throw new HTTPException(401, { message: \"authentication required\" });\n  }\n  return context;\n}\n\nexport async function requireAccessGrant(\n  c: Context,\n  deps: AccessDeps,\n  workspaceId: string,\n  permission?: Permission,\n): Promise<AccessGrant> {\n  return (await requireAccessGrantAuthorization(c, deps, workspaceId, permission)).grant;\n}\n\nexport type AccessGrantAuthorization = {\n  grant: AccessGrant;\n  accountGrant: AccountGrant | null;\n  authenticatedSubjectId: string;\n  contextIntegrity: boolean;\n};\n\nexport function accessGrantAuthorizationFromContext(\n  context: AccessContext,\n  grant: AccessGrant,\n): AccessGrantAuthorization {\n  const matchingAccountGrants = context.accountGrants.filter(\n    (candidate) => candidate.accountId === grant.accountId,\n  );\n  const delegated = grant.metadata?.delegated === true;\n  const contextIntegrity =\n    context.subjectId === grant.subjectId &&\n    context.accountGrants.every((candidate) => candidate.subjectId === context.subjectId) &&\n    context.workspaceGrants.every(\n      (candidate) =>\n        candidate.subjectId === context.subjectId &&\n        candidate.principalKind === grant.principalKind &&\n        (candidate.metadata?.delegated === true) === delegated &&\n        Boolean(candidate.serviceInitiator) === Boolean(grant.serviceInitiator) &&\n        Boolean(candidate.serviceInitiatorContext) === Boolean(grant.serviceInitiatorContext) &&\n        context.accountGrants.filter(\n          (accountGrant) => accountGrant.accountId === candidate.accountId,\n        ).length === 1,\n    ) &&\n    matchingAccountGrants.length === 1 &&\n    matchingAccountGrants[0]?.subjectId === context.subjectId;\n  return {\n    grant,\n    accountGrant: contextIntegrity ? matchingAccountGrants[0]! : null,\n    authenticatedSubjectId: context.subjectId,\n    contextIntegrity,\n  };\n}\n\nexport async function requireAccessGrantAuthorization(\n  c: Context,\n  deps: AccessDeps,\n  workspaceId: string,\n  permission?: Permission,\n): Promise<AccessGrantAuthorization> {\n  const context = await requireAccessContext(c, deps);\n  const principalKind = hostedHumanSessionPrincipalKind(context);\n  const grant =\n    context.workspaceGrants.find((candidate) => candidate.workspaceId === workspaceId) ??\n    (await getWorkspaceGrant(\n      deps.db,\n      context.subjectId,\n      workspaceId,\n      principalKind ? { principalKind } : undefined,\n    ));\n  if (!grant) {\n    const workspace = await requireWorkspace(deps.db, workspaceId).catch(() => null);\n    if (!workspace) {\n      throw new HTTPException(404, { message: \"workspace not found\" });\n    }\n    throw new HTTPException(403, { message: \"workspace access denied\" });\n  }\n  if (permission) {\n    requirePermission(grant, permission);\n  }\n  return accessGrantAuthorizationFromContext(context, grant);\n}\n\nfunction hostedHumanSessionPrincipalKind(context: AccessContext): \"human_session\" | undefined {\n  if (context.mode !== \"managed\" || context.workspaceGrants.length === 0) {\n    return undefined;\n  }\n  return context.workspaceGrants.every(\n    (grant) =>\n      grant.principalKind === \"human_session\" &&\n      grant.metadata?.delegated !== true &&\n      !grant.serviceInitiator,\n  )\n    ? \"human_session\"\n    : undefined;\n}\n\nexport function requirePermission(grant: AccessGrant, permission: Permission): void {\n  if (!hasPermission(grant.permissions, permission)) {\n    if (permission === \"variable-sets:use\") {\n      throw new HTTPException(403, {\n        message: \"missing permission: variable-sets:use (deprecated alias: environments:use)\",\n      });\n    }\n    if (permission === \"variable-sets:manage\") {\n      throw new HTTPException(403, {\n        message: \"missing permission: variable-sets:manage (deprecated alias: environments:manage)\",\n      });\n    }\n    throw new HTTPException(403, {\n      message: `missing permission: ${permission}`,\n    });\n  }\n}\n\n/**\n * Require a permission to be present literally on the grant. This deliberately\n * does not expand workspace:admin or deprecated aliases and is reserved for\n * authorities, such as plaintext secret reads, that old broad grants must not\n * acquire implicitly.\n */\nexport function requireLiteralPermission(grant: AccessGrant, permission: Permission): void {\n  if (!hasLiteralPermission(grant.permissions, permission)) {\n    throw new HTTPException(403, {\n      message: `missing literal permission: ${permission}`,\n    });\n  }\n}\n\nexport function hasLiteralPermission(permissions: Permission[], permission: Permission): boolean {\n  return permissions.includes(permission);\n}\n\nexport function hasPermission(permissions: Permission[], permission: Permission): boolean {\n  if (permission === \"secrets:read\") {\n    return permissions.includes(\"secrets:read\");\n  }\n  const aliases: Partial<Record<Permission, Permission[]>> = {\n    \"variable-sets:use\": [\"environments:use\" as Permission],\n    \"variable-sets:manage\": [\"environments:manage\" as Permission],\n    \"variable-sets:list\": [\n      \"variable-sets:use\",\n      \"variable-sets:manage\",\n      \"environments:use\" as Permission,\n      \"environments:manage\" as Permission,\n    ],\n    \"variable-sets:read\": [\n      \"variable-sets:use\",\n      \"variable-sets:manage\",\n      \"environments:use\" as Permission,\n      \"environments:manage\" as Permission,\n    ],\n    \"variable-sets:write\": [\"variable-sets:manage\", \"environments:manage\" as Permission],\n    \"secrets:list\": [\n      \"variable-sets:use\",\n      \"variable-sets:manage\",\n      \"environments:use\" as Permission,\n      \"environments:manage\" as Permission,\n    ],\n    \"secrets:write\": [\"variable-sets:manage\", \"environments:manage\" as Permission],\n  };\n  return (\n    permissions.includes(permission) ||\n    (aliases[permission]?.some((alias) => permissions.includes(alias)) ?? false) ||\n    permissions.includes(\"workspace:admin\")\n  );\n}\n\nasync function resolveAccessContext(c: Context, deps: AccessDeps): Promise<AccessContext | null> {\n  if (deps.settings.productAccessMode === \"local\") {\n    const delegated = await delegatedAccessContext(c, deps, \"local\");\n    if (delegated) {\n      return delegated;\n    }\n    return await bootstrapWorkspace(deps.db, {\n      accountExternalSource: \"opengeni:local\",\n      accountExternalId: \"default\",\n      accountName: \"Local\",\n      workspaceExternalSource: \"opengeni:local\",\n      workspaceExternalId: \"default\",\n      workspaceName: \"Local\",\n      subjectId: \"dev\",\n      subjectLabel: \"Local dev\",\n    });\n  }\n\n  if (deps.settings.productAccessMode === \"configured\") {\n    const delegated = await delegatedAccessContext(c, deps, \"configured\");\n    if (delegated) {\n      return delegated;\n    }\n    const apiKey = await apiKeyAccessContext(c, deps, \"configured\");\n    if (apiKey) {\n      return apiKey;\n    }\n    if (deps.settings.delegationSecret) {\n      return null;\n    }\n    return await bootstrapWorkspace(deps.db, {\n      accountExternalSource: \"opengeni:configured\",\n      accountExternalId: \"default\",\n      accountName: \"Configured\",\n      workspaceExternalSource: \"opengeni:configured\",\n      workspaceExternalId: \"default\",\n      workspaceName: \"Configured\",\n      subjectId: configuredSubject(c),\n      subjectLabel: \"Configured key\",\n    });\n  }\n\n  const bearer = bearerToken(c);\n  if (bearer) {\n    const delegated = await delegatedAccessContext(c, deps, \"managed\", bearer);\n    if (delegated) {\n      return delegated;\n    }\n    const apiKey = await apiKeyAccessContext(c, deps, \"managed\");\n    if (apiKey) {\n      return apiKey;\n    }\n  }\n\n  if (deps.managedAuth) {\n    const session = await getManagedSession(c, deps.managedAuth, { db: deps.db });\n    if (session?.user) {\n      return await ensureManagedAccessForUser(deps.db, {\n        userId: session.user.id,\n        email: session.user.email,\n        name: session.user.name,\n      });\n    }\n  }\n\n  return null;\n}\n\nasync function apiKeyAccessContext(\n  c: Context,\n  deps: AccessDeps,\n  mode: \"configured\" | \"managed\",\n): Promise<AccessContext | null> {\n  const bearer = bearerToken(c);\n  if (!bearer) {\n    return null;\n  }\n  const apiKey = await findActiveApiKeyByHash(deps.db, await sha256Hex(bearer));\n  if (!apiKey) {\n    return null;\n  }\n  const subjectId = `api_key:${apiKey.id}`;\n  const accountPermissions = apiKey.workspaceId\n    ? apiKey.permissions.filter(\n        (permission) => permission === \"billing:read\" || permission === \"billing:manage\",\n      )\n    : apiKey.permissions;\n  return {\n    mode,\n    subjectId,\n    subjectLabel: apiKey.name,\n    accountGrants: [\n      {\n        accountId: apiKey.accountId,\n        subjectId,\n        subjectLabel: apiKey.name,\n        permissions: accountPermissions,\n      },\n    ],\n    workspaceGrants: apiKey.workspaceId\n      ? [\n          {\n            workspaceId: apiKey.workspaceId,\n            accountId: apiKey.accountId,\n            subjectId,\n            subjectLabel: apiKey.name,\n            permissions: apiKey.permissions,\n            principalKind: \"api_key\",\n          },\n        ]\n      : [],\n    defaultAccountId: apiKey.accountId,\n    defaultWorkspaceId: apiKey.workspaceId,\n  } satisfies AccessContext;\n}\n\nasync function delegatedAccessContext(\n  c: Context,\n  deps: AccessDeps,\n  mode: \"local\" | \"configured\" | \"managed\",\n  token = bearerToken(c),\n): Promise<AccessContext | null> {\n  const delegationSecret = resolveFirstPartyDelegationSecret(deps.settings);\n  if (!token || !delegationSecret) {\n    return null;\n  }\n  const payload = await verifyDelegatedAccessToken(delegationSecret, token);\n  if (!payload) {\n    return null;\n  }\n  return {\n    mode,\n    subjectId: payload.subjectId,\n    ...(payload.subjectLabel ? { subjectLabel: payload.subjectLabel } : {}),\n    accountGrants: [\n      {\n        accountId: payload.accountId,\n        subjectId: payload.subjectId,\n        ...(payload.subjectLabel ? { subjectLabel: payload.subjectLabel } : {}),\n        permissions: payload.permissions,\n      },\n    ],\n    workspaceGrants: [\n      {\n        workspaceId: payload.workspaceId,\n        accountId: payload.accountId,\n        subjectId: payload.subjectId,\n        ...(payload.subjectLabel ? { subjectLabel: payload.subjectLabel } : {}),\n        permissions: payload.permissions,\n        principalKind: payload.principalKind,\n        // sessionId is worker-asserted (HMAC-signed token claim), not agent\n        // controlled; it scopes session-bound MCP tools such as goal management.\n        metadata: {\n          delegated: true,\n          ...(payload.sessionId ? { sessionId: payload.sessionId } : {}),\n          ...(payload.firstPartyMcpTools !== undefined\n            ? { firstPartyMcpTools: payload.firstPartyMcpTools }\n            : {}),\n          ...(payload.nestedAgentDepth !== undefined\n            ? { nestedAgentDepth: payload.nestedAgentDepth }\n            : {}),\n          ...(payload.effectiveMaxNestedAgentDepth !== undefined\n            ? { effectiveMaxNestedAgentDepth: payload.effectiveMaxNestedAgentDepth }\n            : {}),\n          // Caller identity: the turn that minted this token. Tools classify the\n          // CALLER from this instead of re-reading the live active pointer.\n          ...(payload.turnId ? { turnId: payload.turnId } : {}),\n          ...(payload.attemptId ? { attemptId: payload.attemptId } : {}),\n          ...(payload.executionGeneration\n            ? { executionGeneration: payload.executionGeneration }\n            : {}),\n        },\n        ...(payload.serviceInitiator ? { serviceInitiator: payload.serviceInitiator } : {}),\n        ...(payload.serviceInitiatorContext\n          ? { serviceInitiatorContext: payload.serviceInitiatorContext }\n          : {}),\n      },\n    ],\n    defaultAccountId: payload.accountId,\n    defaultWorkspaceId: payload.workspaceId,\n  };\n}\n\nfunction configuredSubject(c: Context): string {\n  const header = c.req.header(\"x-opengeni-subject\");\n  return header && header.trim().length > 0 ? `configured:${header.trim()}` : \"configured:key\";\n}\n\nfunction bearerToken(c: Context): string | null {\n  const authorization = c.req.header(\"authorization\");\n  return authorization?.startsWith(bearerPrefix) ? authorization.slice(bearerPrefix.length) : null;\n}\n\nasync function sha256Hex(value: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value));\n  return Array.from(new Uint8Array(digest))\n    .map((byte) => byte.toString(16).padStart(2, \"0\"))\n    .join(\"\");\n}\n","import {\n  SessionAuthorizationActor,\n  SessionAuthorizationDecision,\n  SessionAuthorizationListScope,\n  type AccessGrant,\n  type SessionAuthorizationOperation,\n  type SessionAuthorizationSurface,\n  type SessionAuthorizationTarget,\n} from \"@opengeni/contracts\";\nimport {\n  getSessionAuthorityProjection,\n  getSession,\n  getSessionTurnForAttempt,\n  getSlackInteractionSessionAccessForSession,\n  withSessionRlsActorContext,\n  type Database,\n  type SessionRlsActorContext,\n} from \"@opengeni/db\";\nimport type { AppDependencies } from \"./dependencies\";\n\nexport type SessionAuthorizationDependencies = Pick<AppDependencies, \"db\" | \"sessionAuthorization\">;\n\n/** Maximum time an omitted host hint leaves a live session stream unchecked. */\nexport const SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS = 15_000;\n\nexport class SessionAuthorizationDeniedError extends Error {\n  readonly code = \"SESSION_NOT_FOUND_OR_DENIED\";\n\n  constructor(readonly reason: \"not_found\" | \"forbidden\" | \"revoked\" | \"caller_stale\") {\n    super(\"Session not found or access denied\");\n    this.name = \"SessionAuthorizationDeniedError\";\n  }\n}\n\nexport class SessionAuthorizationUnavailableError extends Error {\n  readonly code = \"SESSION_AUTHORIZATION_UNAVAILABLE\";\n\n  constructor(options?: ErrorOptions) {\n    super(\"Session authorization is unavailable\", options);\n    this.name = \"SessionAuthorizationUnavailableError\";\n  }\n}\n\nexport type ResolvedSessionAuthorization = {\n  actor: SessionAuthorizationActor;\n  target: SessionAuthorizationTarget;\n  relatedSessionAccess: \"target\" | \"root\";\n  reauthorizeAfterMs: number | null;\n};\n\ntype ResolvedSessionAuthorizationActor = {\n  actor: SessionAuthorizationActor;\n  callerParentSessionId: string | null;\n};\n\ntype ResolvedSessionAuthorizationTarget = {\n  target: SessionAuthorizationTarget;\n  parentSessionId: string | null;\n};\n\nfunction grantHasAgentAttemptAuthority(grant: AccessGrant): boolean {\n  const hasAgentAttemptClaim =\n    grant.metadata?.[\"turnId\"] !== undefined ||\n    grant.metadata?.[\"attemptId\"] !== undefined ||\n    grant.metadata?.[\"executionGeneration\"] !== undefined;\n  return grant.principalKind ? grant.principalKind === \"agent_attempt\" : hasAgentAttemptClaim;\n}\n\n/**\n * Read-only access an immediate child may use against its parent. Upstream\n * mutation is deliberately limited to `session.append`: letting a child Pause,\n * Steer, or otherwise mutate its parent would let it influence siblings through\n * the parent's recursive control and shared state.\n */\nconst AGENT_PARENT_READ_OPERATIONS = new Set<SessionAuthorizationOperation>([\n  \"session.read\",\n  \"session.events.read\",\n  \"session.stream.read\",\n  \"session.turns.read\",\n  \"session.queue.read\",\n  \"session.composer.read\",\n  \"session.lineage.read\",\n  \"session.capture.read\",\n  \"session.files.read\",\n  \"session.git.read\",\n  \"session.terminal.read\",\n  \"session.viewer.read\",\n  \"session.goal.read\",\n  \"session.human_input.read\",\n]);\n\nfunction enforceAgentSessionHierarchy(\n  actor: Extract<SessionAuthorizationActor, { kind: \"agent_attempt\" }>,\n  callerParentSessionId: string | null,\n  target: ResolvedSessionAuthorizationTarget,\n  operation: SessionAuthorizationOperation,\n): \"target\" | \"root\" {\n  if (target.target.sessionId === actor.callerSessionId) return \"root\";\n\n  // A manager may inspect and operate an immediate child. Existing permission\n  // and host-policy checks still apply; lineage never grants a capability.\n  if (target.parentSessionId === actor.callerSessionId) return \"target\";\n\n  // A child may report to and inspect its immediate parent, but cannot mutate\n  // the parent except through the canonical machine-input message boundary.\n  if (callerParentSessionId === target.target.sessionId) {\n    if (operation === \"session.append\" || AGENT_PARENT_READ_OPERATIONS.has(operation)) {\n      return \"target\";\n    }\n    throw new SessionAuthorizationDeniedError(\"forbidden\");\n  }\n\n  // Siblings, skipped generations, other branches, and unrelated roots are\n  // never cross-session authority for a live agent attempt.\n  throw new SessionAuthorizationDeniedError(\"forbidden\");\n}\n\nexport function sessionRlsActorForAuthorization(\n  authorization: ResolvedSessionAuthorization,\n): SessionRlsActorContext {\n  return authorization.actor.kind === \"agent_attempt\"\n    ? {\n        subjectId: authorization.actor.subjectId,\n        initiatingHumanSubjectId: authorization.actor.initiatingHumanSubjectId,\n      }\n    : { subjectId: authorization.actor.subjectId };\n}\n\nexport async function withResolvedSessionAuthorization<T>(\n  authorization: ResolvedSessionAuthorization,\n  fn: () => Promise<T>,\n): Promise<T> {\n  return await withSessionRlsActorContext(sessionRlsActorForAuthorization(authorization), fn);\n}\n\n/**\n * Prove that a first-party request belongs to the exact currently active\n * attempt of the named caller session. Unlike the optional embedding-host ACL\n * port, this database fence is mandatory for high-trust operations.\n */\nexport async function requireLiveAgentAttemptAuthorization(\n  db: Database,\n  grant: AccessGrant,\n  callerSessionId: string,\n): Promise<Extract<SessionAuthorizationActor, { kind: \"agent_attempt\" }>> {\n  const { actor } = await resolveSessionAuthorizationActor(db, grant);\n  if (actor.kind !== \"agent_attempt\" || actor.callerSessionId !== callerSessionId) {\n    throw new SessionAuthorizationDeniedError(\"caller_stale\");\n  }\n  return actor;\n}\n\n/**\n * Resolve and enforce the host ACL for one session. The target and agent actor\n * are reconstructed from workspace-scoped durable state. A request can supply\n * an immediate target id and signed attempt claims, but can never nominate a\n * lineage root or frozen initiator.\n *\n * Slack-owned private sessions are enforced here even when no embedding-host\n * authorization port is bound. That durable ownership fence covers every\n * session surface which uses this shared seam, rather than relying on list/UI\n * filtering or caller-controlled session metadata.\n */\nexport async function requireSessionAuthorization(\n  deps: SessionAuthorizationDependencies,\n  grant: AccessGrant,\n  input: {\n    sessionId: string;\n    operation: SessionAuthorizationOperation;\n    surface: SessionAuthorizationSurface;\n  },\n): Promise<ResolvedSessionAuthorization | null> {\n  const port = deps.sessionAuthorization;\n  const isAgentAttempt = grantHasAgentAttemptAuthority(grant);\n  const [slackAccess, authority] = await Promise.all([\n    getSlackInteractionSessionAccessForSession(deps.db, {\n      accountId: grant.accountId,\n      workspaceId: grant.workspaceId,\n      sessionId: input.sessionId,\n    }),\n    getSessionAuthorityProjection(deps.db, grant.workspaceId, input.sessionId),\n  ]);\n\n  // Preserve the standalone workspace-shared path. Private sessions continue\n  // through the durable actor and ownership checks even without a host port.\n  if (\n    !port &&\n    !isAgentAttempt &&\n    slackAccess?.visibility !== \"private\" &&\n    authority?.visibility !== \"user_private\"\n  ) {\n    return null;\n  }\n  if (!authority) throw new SessionAuthorizationDeniedError(\"not_found\");\n\n  const [resolvedActor, resolvedTarget] = await Promise.all([\n    resolveSessionAuthorizationActor(deps.db, grant),\n    resolveSessionAuthorizationTarget(deps.db, grant, input.sessionId),\n  ]);\n  const actor = resolvedActor.actor;\n  const target = resolvedTarget.target;\n  const agentRelatedSessionAccess =\n    actor.kind === \"agent_attempt\"\n      ? enforceAgentSessionHierarchy(\n          actor,\n          resolvedActor.callerParentSessionId,\n          resolvedTarget,\n          input.operation,\n        )\n      : null;\n\n  if (authority.visibility === \"user_private\") {\n    const allowed =\n      authority.ownerSubjectId !== null &&\n      (actor.kind === \"subject\"\n        ? actor.subjectId === authority.ownerSubjectId\n        : actor.initiatingHumanSubjectId === authority.ownerSubjectId);\n    if (!allowed) throw new SessionAuthorizationDeniedError(\"forbidden\");\n  }\n  if (slackAccess?.visibility === \"private\") {\n    const allowed =\n      actor.kind === \"subject\"\n        ? actor.subjectId === slackAccess.owningSubjectId\n        : actor.callerRootSessionId === target.rootSessionId;\n    if (!allowed) throw new SessionAuthorizationDeniedError(\"forbidden\");\n  }\n  if (!port) {\n    return {\n      actor,\n      target,\n      relatedSessionAccess: agentRelatedSessionAccess ?? \"root\",\n      reauthorizeAfterMs: null,\n    };\n  }\n\n  let rawDecision: unknown;\n  try {\n    rawDecision = await port.authorizeSession({\n      accountId: grant.accountId,\n      workspaceId: grant.workspaceId,\n      actor,\n      target,\n      operation: input.operation,\n      surface: input.surface,\n    });\n  } catch (error) {\n    throw new SessionAuthorizationUnavailableError({ cause: error });\n  }\n  const parsed = SessionAuthorizationDecision.safeParse(rawDecision);\n  if (!parsed.success) {\n    throw new SessionAuthorizationUnavailableError({ cause: parsed.error });\n  }\n  if (!parsed.data.allowed) {\n    throw new SessionAuthorizationDeniedError(parsed.data.reason);\n  }\n  return {\n    actor,\n    target,\n    relatedSessionAccess:\n      agentRelatedSessionAccess === \"target\"\n        ? \"target\"\n        : (parsed.data.relatedSessionAccess ?? \"target\"),\n    reauthorizeAfterMs: parsed.data.reauthorizeAfterMs ?? null,\n  };\n}\n\n/** Resolve the host's complete current list scope for an in-database query. */\nexport async function requireSessionAuthorizationListScope(\n  deps: SessionAuthorizationDependencies,\n  grant: AccessGrant,\n  surface: SessionAuthorizationSurface,\n): Promise<SessionAuthorizationListScope | null> {\n  const port = deps.sessionAuthorization;\n  const isAgentAttempt = grantHasAgentAttemptAuthority(grant);\n  if (!port && !isAgentAttempt) return null;\n  const { actor } = await resolveSessionAuthorizationActor(deps.db, grant);\n  // Standalone agents may retain compact workspace discovery, but only while\n  // the signed caller attempt is still the exact live attempt.\n  if (!port) return null;\n  let rawScope: unknown;\n  try {\n    rawScope = await port.resolveListScope({\n      accountId: grant.accountId,\n      workspaceId: grant.workspaceId,\n      actor,\n      surface,\n    });\n  } catch (error) {\n    throw new SessionAuthorizationUnavailableError({ cause: error });\n  }\n  const parsed = SessionAuthorizationListScope.safeParse(rawScope);\n  if (!parsed.success) {\n    throw new SessionAuthorizationUnavailableError({ cause: parsed.error });\n  }\n  if (parsed.data.kind === \"all\") return parsed.data;\n  return {\n    kind: \"scoped\",\n    rootSessionIds: [...new Set(parsed.data.rootSessionIds)],\n    sessionIds: [...new Set(parsed.data.sessionIds)],\n  };\n}\n\nasync function resolveSessionAuthorizationTarget(\n  db: Database,\n  grant: AccessGrant,\n  sessionId: string,\n): Promise<ResolvedSessionAuthorizationTarget> {\n  const session = await getSession(db, grant.workspaceId, sessionId);\n  if (!session || session.accountId !== grant.accountId) {\n    throw new SessionAuthorizationDeniedError(\"not_found\");\n  }\n  return {\n    target: { sessionId: session.id, rootSessionId: session.rootSessionId },\n    parentSessionId: session.parentSessionId,\n  };\n}\nasync function resolveSessionAuthorizationActor(\n  db: Database,\n  grant: AccessGrant,\n): Promise<ResolvedSessionAuthorizationActor> {\n  const callerSessionId = grant.metadata?.[\"sessionId\"];\n  const turnId = grant.metadata?.[\"turnId\"];\n  const attemptId = grant.metadata?.[\"attemptId\"];\n  const executionGeneration = grant.metadata?.[\"executionGeneration\"];\n  const isAgentAttempt = grantHasAgentAttemptAuthority(grant);\n  if (!isAgentAttempt) {\n    return {\n      actor: SessionAuthorizationActor.parse({\n        kind: \"subject\",\n        subjectId: grant.subjectId,\n        ...(grant.subjectLabel ? { subjectLabel: grant.subjectLabel } : {}),\n      }),\n      callerParentSessionId: null,\n    };\n  }\n  if (\n    typeof callerSessionId !== \"string\" ||\n    typeof turnId !== \"string\" ||\n    typeof attemptId !== \"string\" ||\n    typeof executionGeneration !== \"number\" ||\n    !Number.isSafeInteger(executionGeneration) ||\n    executionGeneration < 1\n  ) {\n    throw new SessionAuthorizationDeniedError(\"caller_stale\");\n  }\n  const [callerSession, turn] = await Promise.all([\n    getSession(db, grant.workspaceId, callerSessionId),\n    getSessionTurnForAttempt(db, grant.workspaceId, callerSessionId, attemptId),\n  ]);\n  if (\n    !callerSession ||\n    callerSession.accountId !== grant.accountId ||\n    !turn ||\n    turn.id !== turnId ||\n    turn.executionGeneration !== executionGeneration ||\n    callerSession.activeTurnId !== turn.id\n  ) {\n    throw new SessionAuthorizationDeniedError(\"caller_stale\");\n  }\n  return {\n    actor: SessionAuthorizationActor.parse({\n      kind: \"agent_attempt\",\n      subjectId: grant.subjectId,\n      callerSessionId,\n      callerRootSessionId: callerSession.rootSessionId,\n      turnId,\n      attemptId,\n      executionGeneration,\n      initiator: turn.initiator,\n      initiatorContext: turn.initiatorContext,\n      initiatingHumanSubjectId:\n        turn.initiatingHumanSubjectId ??\n        (turn.initiator.kind === \"subject\" ? turn.initiator.subjectId : null),\n    }),\n    callerParentSessionId: callerSession.parentSessionId,\n  };\n}\n","import { configuredStaticUsageLimits } from \"@opengeni/config\";\nimport type {\n  LimitAction,\n  LimitDecision,\n  SessionTurnSource,\n  TurnInitiator,\n  TurnInitiatorContext,\n} from \"@opengeni/contracts\";\nimport {\n  countActiveApiKeysForWorkspace,\n  countScheduledTasksForWorkspace,\n  countWorkspacesForAccount,\n  getBillingBalance,\n  isCodexBilledTurn,\n  recordUsageEvent,\n  sumUsageQuantity,\n} from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\nimport type { ApiRouteDeps } from \"../dependencies\";\n\nexport type LimitDependencies = Pick<ApiRouteDeps, \"db\" | \"settings\">;\n\nexport type LimitCheckInput = {\n  accountId: string;\n  workspaceId?: string;\n  action: LimitAction;\n  quantity?: number;\n  // The turn's model id, when the action represents an agent turn. When this is a\n  // Codex-billed turn (codex/<slug> + feature enabled + active workspace\n  // credential) the turn is paid by the user's ChatGPT/Codex plan and consumes\n  // ZERO OpenGeni credits, so the credit-balance + model-cost + token gates are\n  // skipped. Non-model infra actions (workspace/api_key/schedule create) leave\n  // this undefined and are unaffected.\n  model?: string | null;\n};\n\nexport async function requireLimit(deps: LimitDependencies, input: LimitCheckInput): Promise<void> {\n  const decision = await checkLimit(deps, input);\n  if (decision.allowed) {\n    return;\n  }\n  throw new HTTPException(decision.code === \"insufficient_credits\" ? 402 : 429, {\n    message: decision.message,\n  });\n}\n\nexport async function checkLimit(\n  deps: LimitDependencies,\n  input: LimitCheckInput,\n): Promise<LimitDecision> {\n  // Resolve the canonical codex-billed predicate ONCE. Returns false for any\n  // action that carries no model (infra caps) or any codex/<slug> model without\n  // an active credential — so the bypass never triggers on the prefix alone.\n  const codexBilled = input.workspaceId\n    ? await isCodexBilledTurn({\n        db: deps.db,\n        settings: deps.settings,\n        workspaceId: input.workspaceId,\n        model: input.model,\n      })\n    : false;\n  const creditDecision = await checkCreditBalance(deps, input, codexBilled);\n  if (!creditDecision.allowed) {\n    return creditDecision;\n  }\n  if (deps.settings.usageLimitsMode !== \"static\" && deps.settings.usageLimitsMode !== \"managed\") {\n    return { allowed: true };\n  }\n  return await checkStaticCaps(deps, input, codexBilled);\n}\n\nasync function checkCreditBalance(\n  deps: LimitDependencies,\n  input: LimitCheckInput,\n  codexBilled: boolean,\n): Promise<LimitDecision> {\n  if (codexBilled) {\n    return { allowed: true }; // paid by the user's ChatGPT/Codex plan — zero OpenGeni credits\n  }\n  if (!usesCreditLimits(deps) || !isCostlyAction(input.action)) {\n    return { allowed: true };\n  }\n  const balance = await getBillingBalance(deps.db, input.accountId);\n  if (balance.balanceMicros > 0) {\n    return { allowed: true };\n  }\n  return { allowed: false, code: \"insufficient_credits\", message: \"insufficient OpenGeni credits\" };\n}\n\nasync function checkStaticCaps(\n  deps: LimitDependencies,\n  input: LimitCheckInput,\n  codexBilled: boolean,\n): Promise<LimitDecision> {\n  const limits = configuredStaticUsageLimits(deps.settings);\n  if (limits.maxMonthlyCostMicrosPerAccount && isCostlyAction(input.action) && !codexBilled) {\n    const used = await sumUsageQuantity(deps.db, {\n      accountId: input.accountId,\n      eventType: \"model.cost\",\n      since: startOfUtcMonth(),\n    });\n    if (used >= limits.maxMonthlyCostMicrosPerAccount) {\n      return blocked(\n        \"max_monthly_cost_micros_per_account\",\n        `monthly model cost limit reached (${limits.maxMonthlyCostMicrosPerAccount} micros)`,\n      );\n    }\n  }\n  switch (input.action) {\n    case \"workspace:create\": {\n      if (!limits.maxWorkspacesPerAccount) {\n        return { allowed: true };\n      }\n      const count = await countWorkspacesForAccount(deps.db, input.accountId);\n      return count < limits.maxWorkspacesPerAccount\n        ? { allowed: true }\n        : blocked(\n            \"max_workspaces_per_account\",\n            `workspace limit reached (${limits.maxWorkspacesPerAccount})`,\n          );\n    }\n    case \"api_key:create\": {\n      if (!limits.maxApiKeysPerWorkspace || !input.workspaceId) {\n        return { allowed: true };\n      }\n      const count = await countActiveApiKeysForWorkspace(deps.db, input.workspaceId);\n      return count < limits.maxApiKeysPerWorkspace\n        ? { allowed: true }\n        : blocked(\n            \"max_api_keys_per_workspace\",\n            `API key limit reached (${limits.maxApiKeysPerWorkspace})`,\n          );\n    }\n    case \"schedule:create\": {\n      if (!limits.maxSchedulesPerWorkspace || !input.workspaceId) {\n        return { allowed: true };\n      }\n      const count = await countScheduledTasksForWorkspace(deps.db, input.workspaceId);\n      return count < limits.maxSchedulesPerWorkspace\n        ? { allowed: true }\n        : blocked(\n            \"max_schedules_per_workspace\",\n            `scheduled task limit reached (${limits.maxSchedulesPerWorkspace})`,\n          );\n    }\n    case \"file:upload\": {\n      if (!limits.maxFileUploadBytes || !input.quantity) {\n        return { allowed: true };\n      }\n      return input.quantity <= limits.maxFileUploadBytes\n        ? { allowed: true }\n        : blocked(\n            \"max_file_upload_bytes\",\n            `file upload exceeds static limit of ${limits.maxFileUploadBytes} bytes`,\n          );\n    }\n    case \"agent_run:create\": {\n      if (!limits.maxMonthlyAgentRunsPerWorkspace || !input.workspaceId) {\n        return { allowed: true };\n      }\n      const used = await sumUsageQuantity(deps.db, {\n        workspaceId: input.workspaceId,\n        eventType: \"agent_run.created\",\n        since: startOfUtcMonth(),\n      });\n      const requested = input.quantity ?? 0;\n      return used + requested <= limits.maxMonthlyAgentRunsPerWorkspace\n        ? { allowed: true }\n        : blocked(\n            \"max_monthly_agent_runs_per_workspace\",\n            `monthly agent run limit reached (${limits.maxMonthlyAgentRunsPerWorkspace})`,\n          );\n    }\n    case \"tokens:consume\": {\n      if (codexBilled || !limits.maxMonthlyTokensPerWorkspace || !input.workspaceId) {\n        return { allowed: true };\n      }\n      const used = await sumUsageQuantity(deps.db, {\n        workspaceId: input.workspaceId,\n        eventType: \"model.tokens\",\n        since: startOfUtcMonth(),\n      });\n      const requested = input.quantity ?? 0;\n      return used + requested <= limits.maxMonthlyTokensPerWorkspace\n        ? { allowed: true }\n        : blocked(\n            \"max_monthly_tokens_per_workspace\",\n            `monthly token limit reached (${limits.maxMonthlyTokensPerWorkspace})`,\n          );\n    }\n    case \"document:index\": {\n      if (!limits.maxDocumentIndexedChunksPerWorkspace || !input.workspaceId) {\n        return { allowed: true };\n      }\n      const used = await sumUsageQuantity(deps.db, {\n        workspaceId: input.workspaceId,\n        eventType: \"document.indexed\",\n        since: startOfUtcMonth(),\n      });\n      const requested = input.quantity ?? 0;\n      return used + requested <= limits.maxDocumentIndexedChunksPerWorkspace\n        ? { allowed: true }\n        : blocked(\n            \"max_document_indexed_chunks_per_workspace\",\n            `monthly document indexing limit reached (${limits.maxDocumentIndexedChunksPerWorkspace} chunks)`,\n          );\n    }\n  }\n}\n\nexport async function recordWorkspaceUsage(\n  deps: LimitDependencies,\n  input: {\n    accountId: string;\n    workspaceId: string;\n    subjectId?: string | null;\n    eventType: \"agent_run.created\" | \"file.uploaded\" | \"document.indexed\" | \"scheduled_task.fired\";\n    quantity: number;\n    unit: string;\n    sourceResourceType: string;\n    sourceResourceId: string;\n    sessionId?: string | null;\n    turnId?: string | null;\n    turnAttemptId?: string | null;\n    initiator?: TurnInitiator | null;\n    initiatorContext?: TurnInitiatorContext;\n    origin?: SessionTurnSource | null;\n    idempotencyKey: string;\n  },\n): Promise<void> {\n  await recordUsageEvent(deps.db, {\n    accountId: input.accountId,\n    workspaceId: input.workspaceId,\n    subjectId: input.subjectId ?? null,\n    eventType: input.eventType,\n    quantity: input.quantity,\n    unit: input.unit,\n    sourceResourceType: input.sourceResourceType,\n    sourceResourceId: input.sourceResourceId,\n    sessionId: input.sessionId ?? null,\n    turnId: input.turnId ?? null,\n    turnAttemptId: input.turnAttemptId ?? null,\n    initiator:\n      input.initiator ?? (input.subjectId ? { kind: \"subject\", subjectId: input.subjectId } : null),\n    ...(input.initiatorContext ? { initiatorContext: input.initiatorContext } : {}),\n    origin: input.origin ?? null,\n    idempotencyKey: input.idempotencyKey,\n  });\n}\n\nfunction usesCreditLimits(deps: LimitDependencies): boolean {\n  return deps.settings.billingMode === \"stripe\" || deps.settings.usageLimitsMode === \"managed\";\n}\n\nfunction isCostlyAction(action: LimitAction): boolean {\n  return (\n    action === \"agent_run:create\" || action === \"tokens:consume\" || action === \"document:index\"\n  );\n}\n\nfunction blocked(code: string, message: string): LimitDecision {\n  return { allowed: false, code, message };\n}\n\nfunction startOfUtcMonth(): Date {\n  const now = new Date();\n  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));\n}\n","import { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport type { Transport } from \"@modelcontextprotocol/sdk/shared/transport.js\";\nimport { environmentsEncryptionKeyBytes, type Settings } from \"@opengeni/config\";\nimport {\n  CapabilityCatalogItem,\n  capabilityCatalogItemIsTrustedForExposure,\n  FIKEN_PROVIDER_DOMAIN,\n  FIRST_PARTY_MCP_TOOL_NAMES,\n  type AccessGrant,\n  type CapabilityAction,\n  type CapabilityCatalogResponse,\n  type CapabilityInstallation,\n  type ConnectionMetadata,\n  type CreateCapabilityCatalogItemRequest,\n  type EnableCapabilityRequest,\n  type McpServerConnectionRef,\n  type McpPersonalConnectionDelegation,\n  type SocialConnection,\n} from \"@opengeni/contracts\";\nimport {\n  CODEX_APPS_MCP_SERVER_ID,\n  CODEX_APPS_MCP_SERVER_NAME,\n  CODEX_APPS_MCP_URL,\n  CODEX_APPS_STARTUP_TIMEOUT_MS,\n} from \"@opengeni/codex\";\nimport {\n  decryptVariableSetValue,\n  decryptedCapabilityHeaders,\n  disableCapabilityInstallation,\n  enableCapabilityInstallation,\n  encryptVariableSetValue,\n  getCapabilityCatalogItem,\n  getCapabilityInstallation,\n  getConnectionMetadata,\n  getCodexAppsCredentialAuthorizationForRun,\n  getWorkspaceGrant,\n  getStoredCapabilityHeaderCiphertext,\n  listCapabilityCatalogItems,\n  listCapabilityInstallations,\n  listConnectionsMetadata,\n  listEnabledMcpCapabilityServers,\n  listInstalledApiIntegrations,\n  listInstalledSkills,\n  listPackInstallations,\n  listSocialConnections,\n  mcpServerIdForCapability,\n  upsertCapabilityCatalogItem,\n  type Database,\n  type ApiIntegrationRuntime,\n  type EnabledMcpCapabilityServer,\n  type InstalledSkillSummary,\n} from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\nimport { hasPermission } from \"../access\";\nimport { isFikenConnection, preferredFikenConnection } from \"./fiken\";\nimport { listSkillLibraryEntries, type SkillLibraryEntry } from \"@opengeni/runtime/skill-library\";\nimport { listCapabilityPacks, listWorkspaceCapabilityPacks } from \"./packs\";\n\nconst officialMcpRegistryUrl = \"https://registry.modelcontextprotocol.io\";\nconst firstPartyMcpServerIds = new Set([\"opengeni\", \"files\", \"docs\"]);\nconst mcpRegistryFetchTimeoutMs = 15000;\nconst mcpRegistryMaxPages = 3;\nconst mcpCapabilityProbeTimeoutMs = 15000;\nconst maxMcpCredentialHeaders = 16;\nconst maxMcpCredentialHeaderValueLength = 4096;\nconst officialGmailMcpUrl = \"https://gmailmcp.googleapis.com/mcp/v1\";\n// RFC 9110 field-name token characters.\nconst mcpCredentialHeaderName = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;\n\nexport async function buildCapabilityCatalog(input: {\n  db: Database;\n  workspaceId: string;\n  settings: Settings;\n  subjectId?: string | null;\n}): Promise<CapabilityCatalogResponse> {\n  const [\n    persistedItems,\n    capabilityInstallations,\n    packInstallations,\n    workspacePacks,\n    socialConnections,\n    workspaceConnections,\n    curatedLibrarySkills,\n    installedSkills,\n    codexAppsCredentialId,\n  ] = await Promise.all([\n    listCapabilityCatalogItems(input.db, input.workspaceId),\n    listCapabilityInstallations(input.db, input.workspaceId),\n    listPackInstallations(input.db, input.workspaceId),\n    listWorkspaceCapabilityPacks(input.db, input.workspaceId),\n    listSocialConnections(input.db, input.workspaceId, 500, input.subjectId),\n    listConnectionsMetadata(input.db, input.workspaceId, null),\n    discoverCuratedSkillLibraryItems(),\n    listInstalledSkills(input.db, input.workspaceId),\n    input.settings.codexConnectedAppsEnabled\n      ? resolveCodexAppsCredentialIdForRun(input.db, input.workspaceId)\n      : Promise.resolve(null),\n  ]);\n  const catalogInstallations = capabilityInstallations.filter(\n    (installation) => installation.kind === \"mcp\",\n  );\n  const capabilityInstallationById = new Map(\n    catalogInstallations.map((installation) => [installation.capabilityId, installation]),\n  );\n  const installedSkillById = new Map(\n    installedSkills\n      .filter((skill) => skill.owners.some((owner) => owner.kind === \"direct\"))\n      .map((skill) => [skill.capabilityId, skill]),\n  );\n  const activePackIds = new Set(\n    packInstallations\n      .filter((installation) => installation.status === \"active\")\n      .map((installation) => installation.packId),\n  );\n  const builtInPackIds = new Set(listCapabilityPacks().map((pack) => pack.id));\n  const builtIns = [\n    ...workspacePacks.map((pack) =>\n      packCatalogItem(pack, builtInPackIds.has(pack.id) ? \"built_in\" : \"manual\"),\n    ),\n    ...configuredMcpCatalogItems(input.settings),\n    ...providerIntegrationCatalogItems(socialConnections),\n    fikenCatalogItem(workspaceConnections.filter(isFikenConnection)),\n    ...curatedLibrarySkills,\n    ...installedSkills\n      .filter(\n        (skill) =>\n          skill.source !== \"library\" && skill.owners.some((owner) => owner.kind === \"direct\"),\n      )\n      .map(installedSkillCatalogItem),\n  ];\n  const codexApps = input.settings.codexConnectedAppsEnabled\n    ? codexAppsCatalogItem(codexAppsCredentialId !== null)\n    : null;\n  const items = dedupeCatalogItems([\n    ...builtIns,\n    ...persistedItems.filter(\n      (item) =>\n        item.kind !== \"skill\" &&\n        item.kind !== \"api\" &&\n        item.kind !== \"plugin\" &&\n        !isReservedCodexAppsCatalogItem(item),\n    ),\n    // Keep the reserved, server-derived item authoritative over any stale\n    // legacy catalog row with the same id.\n    ...(codexApps ? [codexApps] : []),\n  ])\n    .map((item) => {\n      const projected =\n        item.kind === \"skill\"\n          ? applyInstalledSkillEnablement(item, installedSkillById.get(item.id))\n          : applyCapabilityEnablement(item, capabilityInstallationById.get(item.id), activePackIds);\n      return applyCapabilityLifecycle(projected);\n    })\n    .sort(compareCatalogItems);\n  return {\n    items,\n    installations: catalogInstallations,\n  };\n}\n\nexport async function createCatalogItem(input: {\n  db: Database;\n  accountId: string;\n  workspaceId: string;\n  payload: CreateCapabilityCatalogItemRequest;\n}): Promise<CapabilityCatalogItem> {\n  const id = input.payload.id?.trim() || generatedCapabilityId(input.payload);\n  if (id.startsWith(\"pack:\")) {\n    throw new HTTPException(422, {\n      message: \"packs are managed by OpenGeni and cannot be manually created\",\n    });\n  }\n  if (id.startsWith(\"skill:\")) {\n    throw new HTTPException(422, {\n      message: \"Skills are installed through the Skill library or source import flow\",\n    });\n  }\n  if (id.startsWith(\"api:\")) {\n    throw new HTTPException(422, {\n      message: \"API Integrations are installed from typed Integration Definitions\",\n    });\n  }\n  if (id.startsWith(\"plugin:\")) {\n    throw new HTTPException(422, {\n      message: \"Plugins are installed through the Plugin Package flow\",\n    });\n  }\n  if (\n    input.payload.kind === \"mcp\" &&\n    (id === `mcp:${CODEX_APPS_MCP_SERVER_ID}` ||\n      (typeof input.payload.metadata.mcpServerId === \"string\" &&\n        input.payload.metadata.mcpServerId.trim() === CODEX_APPS_MCP_SERVER_ID))\n  ) {\n    throw new HTTPException(422, {\n      message: `${CODEX_APPS_MCP_SERVER_ID} is reserved for the canonical Codex Apps service`,\n    });\n  }\n  const source =\n    input.payload.source === \"built_in\" ||\n    input.payload.source === \"library\" ||\n    input.payload.source === \"configured\" ||\n    input.payload.source === \"registry\"\n      ? \"manual\"\n      : input.payload.source;\n  const metadata = {\n    ...input.payload.metadata,\n    ...(input.payload.kind === \"mcp\" &&\n    input.payload.endpointUrl &&\n    !input.payload.metadata.mcpServerId\n      ? { mcpServerId: mcpServerIdForCapability(id, input.payload.metadata) }\n      : {}),\n  };\n  return await upsertCapabilityCatalogItem(input.db, {\n    accountId: input.accountId,\n    workspaceId: input.workspaceId,\n    id,\n    kind: input.payload.kind,\n    source,\n    name: input.payload.name.trim(),\n    description: input.payload.description?.trim() || null,\n    category: input.payload.category.trim() || \"custom\",\n    tags: uniqueTags(input.payload.tags),\n    homepageUrl: input.payload.homepageUrl ?? null,\n    endpointUrl: input.payload.endpointUrl ?? null,\n    installUrl: input.payload.installUrl ?? null,\n    authModel: input.payload.authModel?.trim() || null,\n    metadata,\n  });\n}\n\nexport async function enableCapability(input: {\n  db: Database;\n  grant: AccessGrant;\n  accountId: string;\n  workspaceId: string;\n  settings: Settings;\n  capabilityId: string;\n  payload: EnableCapabilityRequest;\n  probeMcpServer?: McpCapabilityProbe;\n}): Promise<CapabilityInstallation> {\n  const item = await requireCatalogItem(\n    input.db,\n    input.workspaceId,\n    input.settings,\n    input.capabilityId,\n  );\n  if (item.kind === \"skill\") {\n    throw new HTTPException(409, {\n      message: \"Install Skills through the Skill library or source import flow\",\n    });\n  }\n  if (item.kind === \"api\") {\n    throw new HTTPException(409, {\n      message: \"Install API Integrations through the Integration Definitions flow\",\n    });\n  }\n  if (item.kind === \"plugin\") {\n    throw new HTTPException(409, {\n      message: \"Install Plugins through the Plugin Package flow\",\n    });\n  }\n  if (item.kind === \"pack\") {\n    throw new HTTPException(409, {\n      message: \"Install Packs through the Pack installation preview flow\",\n    });\n  }\n  if (item.kind === \"mcp\" && !item.runtime.available) {\n    throw new HTTPException(422, {\n      message: \"MCP capabilities need a remote streamable HTTP endpoint before they can be enabled\",\n    });\n  }\n  let installationMetadata = input.payload.metadata;\n  // Credential-header storage is written exclusively by this flow; strip the\n  // reserved keys from caller-provided config so the stored shape stays\n  // trustworthy and no plaintext credentials sneak in through config.headers.\n  let installationConfig: Record<string, unknown> = { ...input.payload.config };\n  delete installationConfig.headers;\n  delete installationConfig.headersEncrypted;\n  delete installationConfig.headerNames;\n  delete installationConfig.connectionRef;\n  if (item.kind === \"mcp\") {\n    const headers = await resolveMcpCredentialHeaders(input, item);\n    const connectionRef = input.payload.connectionRef\n      ? await validateMcpCapabilityConnectionRef(input, item, input.payload.connectionRef)\n      : null;\n    assertRequiredMcpCredentialHeaders(item, headers, connectionRef);\n    installationMetadata = {\n      ...installationMetadata,\n      ...(connectionRef && !headers\n        ? authDeferredMcpConnectivity()\n        : await validateMcpCapabilityConnection(item, input.probeMcpServer, headers ?? undefined)),\n    };\n    if (connectionRef) {\n      installationConfig.connectionRef = connectionRef;\n    }\n    if (headers) {\n      const key = requireCapabilityHeaderEncryption(input.settings);\n      installationConfig.headersEncrypted = Object.fromEntries(\n        Object.entries(headers).map(([name, value]) => [name, encryptVariableSetValue(key, value)]),\n      );\n    }\n  }\n  return await enableCapabilityInstallation(input.db, {\n    accountId: input.accountId,\n    workspaceId: input.workspaceId,\n    capabilityId: item.id,\n    kind: item.kind,\n    config: installationConfig,\n    metadata: installationMetadata,\n  });\n}\n\n/**\n * Resolves the plaintext credential headers an MCP enable should use: the\n * validated headers from the request when provided, otherwise headers stored\n * encrypted by a previous enable (so re-enabling never requires re-pasting\n * credentials). Returns null when neither exists.\n */\nasync function resolveMcpCredentialHeaders(\n  input: {\n    db: Database;\n    workspaceId: string;\n    settings: Settings;\n    payload: EnableCapabilityRequest;\n  },\n  item: CapabilityCatalogItem,\n): Promise<Record<string, string> | null> {\n  const provided = normalizedMcpCredentialHeaders(input.payload.headers);\n  if (provided) {\n    // Validate the key is configured before probing so a misconfigured\n    // deployment fails fast instead of after a successful remote probe.\n    requireCapabilityHeaderEncryption(input.settings);\n    return provided;\n  }\n  const storedCiphertext = await getStoredCapabilityHeaderCiphertext(\n    input.db,\n    input.workspaceId,\n    item.id,\n  );\n  if (!storedCiphertext) {\n    return null;\n  }\n  const key = requireCapabilityHeaderEncryption(input.settings);\n  try {\n    return Object.fromEntries(\n      Object.entries(storedCiphertext).map(([name, value]) => [\n        name,\n        decryptVariableSetValue(key, value),\n      ]),\n    );\n  } catch {\n    throw new HTTPException(422, {\n      message: `stored credential headers for \"${item.name}\" could not be decrypted; supply them again in the enable request \"headers\" field`,\n    });\n  }\n}\n\nfunction normalizedMcpCredentialHeaders(\n  headers: Record<string, string>,\n): Record<string, string> | null {\n  const entries = Object.entries(headers)\n    .map(([name, value]) => [name.trim(), value] as const)\n    .filter(([name]) => name.length > 0);\n  if (entries.length === 0) {\n    return null;\n  }\n  if (entries.length > maxMcpCredentialHeaders) {\n    throw new HTTPException(422, {\n      message: `an MCP capability supports at most ${maxMcpCredentialHeaders} credential headers`,\n    });\n  }\n  const seen = new Set<string>();\n  for (const [name, value] of entries) {\n    if (!mcpCredentialHeaderName.test(name)) {\n      throw new HTTPException(422, {\n        message: `invalid credential header name: ${name}`,\n      });\n    }\n    const lower = name.toLowerCase();\n    if (seen.has(lower)) {\n      throw new HTTPException(422, {\n        message: `duplicate credential header name: ${name}`,\n      });\n    }\n    seen.add(lower);\n    if (value.length === 0 || value.length > maxMcpCredentialHeaderValueLength) {\n      throw new HTTPException(422, {\n        message: `credential header ${name} must be 1-${maxMcpCredentialHeaderValueLength} characters`,\n      });\n    }\n    // RFC 9110 §5.5: field values are HTAB / printable characters — reject\n    // all other control characters (they would also fail at the HTTP client).\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u0008\\u000A-\\u001F\\u007F]/.test(value)) {\n      throw new HTTPException(422, {\n        message: `credential header ${name} contains forbidden control characters`,\n      });\n    }\n  }\n  return Object.fromEntries(entries);\n}\n\nasync function validateMcpCapabilityConnectionRef(\n  input: { db: Database; grant: AccessGrant; workspaceId: string },\n  item: CapabilityCatalogItem,\n  ref: McpServerConnectionRef,\n): Promise<McpServerConnectionRef> {\n  const subjectScope = ref.subjectScope ?? \"workspace\";\n  const personalOnly =\n    item.metadata.connectionOwnership === \"personal_only\" ||\n    item.endpointUrl?.replace(/\\/+$/, \"\") === officialGmailMcpUrl;\n  if (personalOnly && subjectScope !== \"subject\") {\n    throw new HTTPException(422, {\n      message:\n        \"this capability requires a personal connection; each workspace member must connect their own account\",\n    });\n  }\n  const normalized: McpServerConnectionRef = {\n    providerDomain: ref.providerDomain.trim(),\n    subjectScope,\n    ...(ref.connectionId ? { connectionId: ref.connectionId } : {}),\n    ...(ref.provider ? { provider: ref.provider.trim() } : {}),\n    ...(ref.kind ? { kind: ref.kind } : {}),\n    ...(ref.scopes ? { scopes: uniqueStrings(ref.scopes) } : {}),\n    ...(ref.resource ? { resource: ref.resource } : {}),\n    ...(ref.selectedResources\n      ? {\n          selectedResources: ref.selectedResources.map((resource) => ({\n            ...resource,\n          })),\n        }\n      : {}),\n  };\n  if (!normalized.providerDomain) {\n    throw new HTTPException(422, {\n      message: \"connectionRef.providerDomain is required\",\n    });\n  }\n  if (!item.endpointUrl || !item.runtime.mcpServerId) {\n    throw new HTTPException(422, {\n      message:\n        \"MCP capabilities need a remote streamable HTTP endpoint before they can use a connectionRef\",\n    });\n  }\n\n  let connection = normalized.connectionId\n    ? await getConnectionMetadata(\n        input.db,\n        input.workspaceId,\n        normalized.connectionId,\n        input.grant.subjectId,\n      )\n    : null;\n  if (!connection && subjectScope === \"subject\" && !normalized.connectionId) {\n    const visible = await listConnectionsMetadata(\n      input.db,\n      input.workspaceId,\n      input.grant.subjectId,\n    );\n    connection =\n      visible.find(\n        (candidate) =>\n          candidate.subjectId === input.grant.subjectId &&\n          candidate.providerDomain === normalized.providerDomain &&\n          (!normalized.kind || candidate.kind === normalized.kind) &&\n          candidate.status === \"active\",\n      ) ?? null;\n  }\n  if (!connection) {\n    throw new HTTPException(422, {\n      message: \"connectionRef does not reference a visible active connection\",\n    });\n  }\n  if (\n    (subjectScope === \"subject\" && connection.subjectId !== input.grant.subjectId) ||\n    (subjectScope === \"workspace\" && connection.subjectId !== null)\n  ) {\n    throw new HTTPException(422, {\n      message: `connectionRef does not reference a ${subjectScope}-owned connection`,\n    });\n  }\n  if (connection.status !== \"active\") {\n    throw new HTTPException(422, {\n      message: `connectionRef.connectionId is not active (${connection.status})`,\n    });\n  }\n  if (connection.providerDomain !== normalized.providerDomain) {\n    throw new HTTPException(422, {\n      message: \"connectionRef.providerDomain does not match the referenced connection\",\n    });\n  }\n  if (normalized.kind && connection.kind !== normalized.kind) {\n    throw new HTTPException(422, {\n      message: \"connectionRef.kind does not match the referenced connection\",\n    });\n  }\n  if (subjectScope === \"subject\") {\n    const genericSubjectRef = { ...normalized, kind: connection.kind };\n    delete genericSubjectRef.connectionId;\n    return genericSubjectRef;\n  }\n  return normalized;\n}\n\nfunction authDeferredMcpConnectivity(): Record<string, unknown> {\n  return {\n    mcpConnectivity: {\n      status: \"auth_deferred\",\n      checkedAt: new Date().toISOString(),\n    },\n  };\n}\n\nfunction assertRequiredMcpCredentialHeaders(\n  item: CapabilityCatalogItem,\n  headers: Record<string, string> | null,\n  connectionRef: McpServerConnectionRef | null,\n): void {\n  if (connectionRef) {\n    return;\n  }\n  const required = requiredCapabilityHeaders(item.metadata);\n  const names = new Set(Object.keys(headers ?? {}).map((name) => name.toLowerCase()));\n  const missing = required.filter((name) => !names.has(name.toLowerCase()));\n  if (missing.length > 0) {\n    throw new HTTPException(422, {\n      message: `MCP capability \"${item.name}\" requires credential header(s) ${missing.join(\", \")}; pass them in the enable request \"headers\" field`,\n    });\n  }\n  if (item.authModel && names.size === 0) {\n    throw new HTTPException(422, {\n      message: `MCP capability \"${item.name}\" requires credentials; pass them in the enable request \"headers\" field`,\n    });\n  }\n}\n\nfunction requiredCapabilityHeaders(metadata: Record<string, unknown>): string[] {\n  const value = metadata.requiredHeaders;\n  if (!Array.isArray(value)) {\n    return [];\n  }\n  return value\n    .filter((name): name is string => typeof name === \"string\" && name.trim().length > 0)\n    .map((name) => name.trim());\n}\n\nfunction requireCapabilityHeaderEncryption(settings: Settings): Uint8Array {\n  const key = environmentsEncryptionKeyBytes(settings);\n  if (!key) {\n    throw new HTTPException(503, {\n      message: \"MCP credential headers require OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY\",\n    });\n  }\n  return key;\n}\n\nexport type McpCapabilityProbeInput = {\n  id: string;\n  name: string;\n  url: string;\n  timeoutMs: number;\n  headers?: Record<string, string>;\n};\n\nexport type McpCapabilityProbeResult = {\n  toolCount: number;\n};\n\nexport type McpCapabilityProbe = (\n  input: McpCapabilityProbeInput,\n) => Promise<McpCapabilityProbeResult>;\n\nexport async function validateMcpCapabilityConnection(\n  item: CapabilityCatalogItem,\n  probe: McpCapabilityProbe = probeStreamableHttpMcpServer,\n  headers?: Record<string, string>,\n): Promise<Record<string, unknown>> {\n  if (item.kind !== \"mcp\") {\n    return {};\n  }\n  if (!item.endpointUrl || !item.runtime.mcpServerId) {\n    throw new HTTPException(422, {\n      message: \"MCP capabilities need a remote streamable HTTP endpoint before they can be enabled\",\n    });\n  }\n  try {\n    const result = await probe({\n      id: item.runtime.mcpServerId,\n      name: item.name,\n      url: item.endpointUrl,\n      timeoutMs: mcpCapabilityProbeTimeoutMs,\n      ...(headers ? { headers } : {}),\n    });\n    return {\n      mcpConnectivity: {\n        status: \"ok\",\n        checkedAt: new Date().toISOString(),\n        toolCount: result.toolCount,\n      },\n    };\n  } catch (error) {\n    throw new HTTPException(422, {\n      message: `MCP capability \"${item.name}\" could not be enabled because ${mcpProbeErrorMessage(error, item.endpointUrl)}`,\n    });\n  }\n}\n\nasync function probeStreamableHttpMcpServer(\n  input: McpCapabilityProbeInput,\n): Promise<McpCapabilityProbeResult> {\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), input.timeoutMs);\n  const client = new Client(\n    { name: \"opengeni-capability-probe\", version: \"0.1.0\" },\n    { capabilities: {} },\n  );\n  try {\n    const transport = new StreamableHTTPClientTransport(new URL(input.url), {\n      requestInit: {\n        signal: controller.signal,\n        ...(input.headers ? { headers: input.headers } : {}),\n      },\n    });\n    await client.connect(transport as unknown as Transport, {\n      timeout: input.timeoutMs,\n      maxTotalTimeout: input.timeoutMs,\n    });\n    const tools = await client.listTools(undefined, {\n      timeout: input.timeoutMs,\n      maxTotalTimeout: input.timeoutMs,\n    });\n    return { toolCount: tools.tools.length };\n  } finally {\n    clearTimeout(timeout);\n    await client.close().catch(() => undefined);\n  }\n}\n\nfunction mcpProbeErrorMessage(error: unknown, endpointUrl: string): string {\n  const message = error instanceof Error ? error.message : String(error);\n  const normalized = message.replace(/\\s+/g, \" \").trim();\n  const endpoint = safeEndpointLabel(endpointUrl);\n  if (\n    /404|405|not found|unexpected token|not valid json|invalid json|failed to parse|streamable http error|unable to connect|fetch failed|econnrefused|enotfound|timeout|aborted/i.test(\n      normalized,\n    )\n  ) {\n    return `OpenGeni could not reach a valid Streamable HTTP MCP server at ${endpoint}. Check the endpoint URL or choose a different catalog entry.`;\n  }\n  return `OpenGeni could not initialize ${endpoint}. Check the endpoint configuration or try again.`;\n}\n\nfunction safeEndpointLabel(endpointUrl: string): string {\n  try {\n    return new URL(endpointUrl).hostname || \"the configured endpoint\";\n  } catch {\n    return \"the configured endpoint\";\n  }\n}\n\nexport async function disableCapability(input: {\n  db: Database;\n  accountId: string;\n  workspaceId: string;\n  settings: Settings;\n  capabilityId: string;\n}): Promise<CapabilityInstallation> {\n  const item = await requireCatalogItem(\n    input.db,\n    input.workspaceId,\n    input.settings,\n    input.capabilityId,\n  );\n  if (item.kind === \"skill\") {\n    throw new HTTPException(409, {\n      message: \"Uninstall Skills through the Skill uninstall preview flow\",\n    });\n  }\n  if (item.kind === \"api\") {\n    throw new HTTPException(409, {\n      message: \"Remove API Integrations through the Integration instance flow\",\n    });\n  }\n  if (item.kind === \"plugin\") {\n    throw new HTTPException(409, {\n      message: \"Remove Plugins through the Plugin Package flow\",\n    });\n  }\n  if (item.kind === \"pack\") {\n    throw new HTTPException(409, {\n      message: \"Uninstall Packs through the Pack uninstall preview flow\",\n    });\n  }\n  if (item.source === \"built_in\" || item.source === \"configured\") {\n    throw new HTTPException(409, {\n      message:\n        \"built-in and configured capabilities are always available; remove them from configuration to disable them\",\n    });\n  }\n  if (!(await getCapabilityInstallation(input.db, input.workspaceId, item.id))) {\n    throw new HTTPException(409, {\n      message: \"capability is not currently enabled\",\n    });\n  }\n  return await disableCapabilityInstallation(input.db, input.workspaceId, item.id);\n}\n\nexport async function settingsWithEnabledCapabilityMcpServers(\n  db: Database,\n  workspaceId: string,\n  settings: Settings,\n  options?: {\n    subjectId?: string;\n    personalConnectionDelegations?: readonly McpPersonalConnectionDelegation[];\n    onResolvedApiIntegrations?: (integrations: readonly ApiIntegrationRuntime[]) => void;\n  },\n): Promise<Settings> {\n  const apiIntegrationsPromise = options?.subjectId\n    ? listInstalledApiIntegrations(db, workspaceId, options.subjectId)\n    : listInstalledApiIntegrationsForDelegations(\n        db,\n        workspaceId,\n        options?.personalConnectionDelegations ?? [],\n      );\n  const [enabled, apiIntegrations, codexAppsCredentialId] = await Promise.all([\n    listEnabledMcpCapabilityServers(db, workspaceId),\n    apiIntegrationsPromise,\n    resolveCodexAppsCredentialIdForRun(db, workspaceId),\n  ]);\n  options?.onResolvedApiIntegrations?.(apiIntegrations);\n  return settingsWithCodexAppsMcpServer(\n    settingsWithApiIntegrationServers(\n      settingsWithMcpCapabilityServers(settings, enabled),\n      apiIntegrations,\n    ),\n    codexAppsCredentialId !== null,\n  );\n}\n\nexport function apiIntegrationsMatchingDelegations(\n  integrations: readonly ApiIntegrationRuntime[],\n  delegations: readonly McpPersonalConnectionDelegation[],\n): ApiIntegrationRuntime[] {\n  const exact = new Set(\n    delegations.map((delegation) =>\n      [\n        delegation.serverId,\n        delegation.connectionId,\n        delegation.providerDomain.toLowerCase(),\n        delegation.kind ?? \"\",\n      ].join(\"\\u0000\"),\n    ),\n  );\n  return integrations.filter((integration) => {\n    const ref = integration.connectionRef;\n    if (!ref || ref.subjectScope !== \"subject\" || !ref.connectionId) return false;\n    return exact.has(\n      [\n        integration.serverId,\n        ref.connectionId,\n        ref.providerDomain.toLowerCase(),\n        ref.kind ?? \"\",\n      ].join(\"\\u0000\"),\n    );\n  });\n}\n\nasync function listInstalledApiIntegrationsForDelegations(\n  db: Database,\n  workspaceId: string,\n  delegations: readonly McpPersonalConnectionDelegation[],\n): Promise<ApiIntegrationRuntime[]> {\n  const workspace = await listInstalledApiIntegrations(db, workspaceId);\n  if (delegations.length === 0) return workspace;\n  const owners = [...new Set(delegations.map((delegation) => delegation.ownerSubjectId))];\n  const delegatedByOwner = await Promise.all(\n    owners.map(async (subjectId) =>\n      apiIntegrationsMatchingDelegations(\n        await listInstalledApiIntegrations(db, workspaceId, subjectId),\n        delegations.filter((delegation) => delegation.ownerSubjectId === subjectId),\n      ),\n    ),\n  );\n  const byServerId = new Map(workspace.map((integration) => [integration.serverId, integration]));\n  for (const integration of delegatedByOwner.flat())\n    byServerId.set(integration.serverId, integration);\n  return [...byServerId.values()];\n}\n\nexport function settingsWithApiIntegrationServers(\n  settings: Settings,\n  integrations: readonly ApiIntegrationRuntime[],\n): Settings {\n  if (integrations.length === 0) return settings;\n  const existingIds = new Set(settings.mcpServers.map((server) => server.id));\n  const dynamicServers = integrations\n    .filter((integration) => !existingIds.has(integration.serverId))\n    .map((integration) => ({\n      id: integration.serverId,\n      name: integration.name,\n      // Local adapters never send MCP traffic to this URL. Keeping the exact\n      // provider base URL in Settings preserves destination identity for policy,\n      // diagnostics, and the stable session-MCP approval fallback.\n      url: integration.baseUrl,\n      allowedTools: [...integration.allowedTools],\n      cacheToolsList: true,\n      requireApproval: integration.requireApproval,\n      ...(integration.connectionRef ? { connectionRef: integration.connectionRef } : {}),\n    }));\n  return dynamicServers.length\n    ? { ...settings, mcpServers: [...settings.mcpServers, ...dynamicServers] }\n    : settings;\n}\n\n/**\n * Resolve executable Apps authority. The connector must remain active and its\n * exact owner must still hold workspace connection-management permission.\n */\nexport async function resolveCodexAppsCredentialIdForRun(\n  db: Database,\n  workspaceId: string,\n): Promise<string | null> {\n  const authorization = await getCodexAppsCredentialAuthorizationForRun(db, workspaceId);\n  if (!authorization) return null;\n  const grant = await getWorkspaceGrant(db, authorization.ownerSubjectId, workspaceId);\n  return grant && hasPermission(grant.permissions, \"connections:write\")\n    ? authorization.credentialId\n    : null;\n}\n\n/**\n * Register Codex Apps as an optional runtime MCP only when the deployment is\n * enabled and this workspace has an active explicit Apps designation.\n * Registration only makes the server selectable; session policy decides\n * whether the model sees it.\n */\nexport function settingsWithCodexAppsMcpServer(\n  settings: Settings,\n  credentialAvailable: boolean,\n): Settings {\n  const canonicalServer = {\n    id: CODEX_APPS_MCP_SERVER_ID,\n    name: CODEX_APPS_MCP_SERVER_NAME,\n    url: CODEX_APPS_MCP_URL,\n    timeoutMs: CODEX_APPS_STARTUP_TIMEOUT_MS,\n    // Availability is credential-specific, so discover on every run.\n    cacheToolsList: false,\n  };\n  // The id is a credential-routing trust boundary. Discard every configured or\n  // capability-provided claimant before optionally appending the one canonical\n  // endpoint; preserving an existing id could send the designated bearer to an\n  // attacker-controlled URL.\n  const withoutReservedId = settings.mcpServers.filter(\n    (server) => server.id !== CODEX_APPS_MCP_SERVER_ID,\n  );\n  if (!settings.codexConnectedAppsEnabled || !credentialAvailable) {\n    return withoutReservedId.length === settings.mcpServers.length\n      ? settings\n      : { ...settings, mcpServers: withoutReservedId };\n  }\n  const existing = settings.mcpServers.at(-1);\n  if (\n    withoutReservedId.length === settings.mcpServers.length - 1 &&\n    existing !== undefined &&\n    Object.keys(existing).length === Object.keys(canonicalServer).length &&\n    Object.entries(canonicalServer).every(\n      ([key, value]) => existing[key as keyof typeof existing] === value,\n    )\n  ) {\n    return settings;\n  }\n  return {\n    ...settings,\n    mcpServers: [...withoutReservedId, canonicalServer],\n  };\n}\n\nexport function settingsWithMcpCapabilityServers(\n  settings: Settings,\n  enabled: EnabledMcpCapabilityServer[],\n): Settings {\n  if (enabled.length === 0) {\n    return settings;\n  }\n  const encryptionKey = environmentsEncryptionKeyBytes(settings);\n  const existingIds = new Set(settings.mcpServers.map((server) => server.id));\n  const dynamicServers = enabled\n    .filter((server) => !existingIds.has(server.id))\n    .flatMap((server) => {\n      const headers = decryptedCapabilityHeaders(server, encryptionKey);\n      if (headers === \"unavailable\" && !server.connectionRef) {\n        // Without its credential headers this server can only fail auth at\n        // connect time and break agent turns; leave it out of the run.\n        return [];\n      }\n      return [\n        {\n          id: server.id,\n          name: server.name,\n          url: server.url,\n          ...(server.allowedTools ? { allowedTools: server.allowedTools } : {}),\n          ...(server.timeoutMs ? { timeoutMs: server.timeoutMs } : {}),\n          cacheToolsList: server.cacheToolsList ?? false,\n          ...(server.requireApproval !== undefined\n            ? { requireApproval: server.requireApproval }\n            : {}),\n          ...(headers && headers !== \"unavailable\" ? { headers } : {}),\n          ...(server.connectionRef ? { connectionRef: server.connectionRef } : {}),\n        },\n      ];\n    });\n  return dynamicServers.length\n    ? { ...settings, mcpServers: [...settings.mcpServers, ...dynamicServers] }\n    : settings;\n}\n\nexport async function discoverMcpRegistryCapabilities(input: {\n  query?: string;\n  limit?: number;\n  fetchImpl?: McpRegistryFetch;\n  timeoutMs?: number;\n}): Promise<CapabilityCatalogItem[]> {\n  const query = (input.query ?? \"\").trim().toLowerCase();\n  const limit = Math.min(100, Math.max(1, Math.floor(input.limit ?? 50)));\n  const items: CapabilityCatalogItem[] = [];\n  const seen = new Set<string>();\n  const fetchOptions: { fetchImpl?: McpRegistryFetch; timeoutMs?: number } = {};\n  if (input.fetchImpl) {\n    fetchOptions.fetchImpl = input.fetchImpl;\n  }\n  if (input.timeoutMs !== undefined) {\n    fetchOptions.timeoutMs = input.timeoutMs;\n  }\n  let cursor: string | undefined;\n  let pages = 0;\n\n  while (items.length < limit && pages < mcpRegistryMaxPages) {\n    pages += 1;\n    const url = new URL(\"/v0.1/servers\", officialMcpRegistryUrl);\n    url.searchParams.set(\"limit\", String(limit));\n    url.searchParams.set(\"version\", \"latest\");\n    if (query) {\n      url.searchParams.set(\"search\", query);\n    }\n    if (cursor) {\n      url.searchParams.set(\"cursor\", cursor);\n    }\n    const page = await fetchMcpRegistryPage(url, fetchOptions);\n    for (const entry of page.servers ?? []) {\n      const item = mcpRegistryEntryToCatalogItem(entry);\n      if (!item || seen.has(item.id)) {\n        continue;\n      }\n      if (query && !catalogSearchText(item).includes(query)) {\n        continue;\n      }\n      seen.add(item.id);\n      items.push(item);\n      if (items.length >= limit) {\n        break;\n      }\n    }\n    cursor = typeof page.metadata?.nextCursor === \"string\" ? page.metadata.nextCursor : undefined;\n    if (!cursor) {\n      break;\n    }\n  }\n\n  return items;\n}\n\nexport { officialMcpRegistryUrl };\n\ntype McpRegistryFetch = (input: URL, init?: RequestInit) => Promise<Response>;\n\nasync function fetchMcpRegistryPage(\n  url: URL,\n  options: {\n    fetchImpl?: McpRegistryFetch;\n    timeoutMs?: number;\n  } = {},\n): Promise<McpRegistryPage> {\n  const fetchImpl = options.fetchImpl ?? fetch;\n  const controller = new AbortController();\n  const timeout = setTimeout(\n    () => controller.abort(),\n    options.timeoutMs ?? mcpRegistryFetchTimeoutMs,\n  );\n  try {\n    const response = await fetchImpl(url, { signal: controller.signal });\n    if (!response.ok) {\n      throw new HTTPException(502, {\n        message: `MCP registry returned ${response.status}`,\n      });\n    }\n    return (await response.json()) as McpRegistryPage;\n  } catch (error) {\n    if (error instanceof HTTPException) {\n      throw error;\n    }\n    if (error instanceof Error && error.name === \"AbortError\") {\n      throw new HTTPException(504, {\n        message: \"MCP registry request timed out\",\n      });\n    }\n    throw new HTTPException(502, {\n      message: `MCP registry request failed: ${error instanceof Error ? error.message : String(error)}`,\n    });\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\nasync function requireCatalogItem(\n  db: Database,\n  workspaceId: string,\n  settings: Settings,\n  capabilityId: string,\n): Promise<CapabilityCatalogItem> {\n  const catalog = await buildCapabilityCatalog({ db, workspaceId, settings });\n  const item =\n    catalog.items.find((candidate) => candidate.id === capabilityId) ??\n    (await getCapabilityCatalogItem(db, workspaceId, capabilityId));\n  if (!item) {\n    throw new HTTPException(404, { message: \"capability not found\" });\n  }\n  return item;\n}\n\nfunction packCatalogItem(\n  pack: ReturnType<typeof listCapabilityPacks>[number],\n  source: \"built_in\" | \"manual\",\n): CapabilityCatalogItem {\n  const customMetadata = { ...pack.metadata };\n  for (const key of [\n    \"packId\",\n    \"version\",\n    \"connectors\",\n    \"knowledge\",\n    \"scheduledTaskTemplates\",\n    \"sandboxImage\",\n    \"sandboxProviderImages\",\n    \"skills\",\n  ]) {\n    delete customMetadata[key];\n  }\n  return CapabilityCatalogItem.parse({\n    id: `pack:${pack.id}`,\n    kind: \"pack\",\n    source,\n    name: pack.name,\n    description: pack.description,\n    category: pack.category,\n    tags: [pack.role, pack.category, \"pack\"],\n    tools: pack.tools,\n    runtime: {\n      available: true,\n      notes: \"Enables role-scoped tools, connectors, knowledge, and scheduled-task templates.\",\n    },\n    metadata: {\n      ...customMetadata,\n      packId: pack.id,\n      version: pack.version,\n      connectors: pack.connectors,\n      knowledge: pack.knowledge,\n      scheduledTaskTemplates: pack.scheduledTaskTemplates,\n      ...(pack.variableSet ? { variableSet: pack.variableSet } : {}),\n      // Runtime composition surface only: skill names, never file content.\n      ...(pack.sandboxImage ? { sandboxImage: pack.sandboxImage } : {}),\n      ...(pack.sandboxProviderImages ? { sandboxProviderImages: pack.sandboxProviderImages } : {}),\n      ...(pack.skills.length > 0 ? { skills: pack.skills.map((skill) => skill.name) } : {}),\n    },\n  });\n}\n\nfunction configuredMcpCatalogItems(settings: Settings): CapabilityCatalogItem[] {\n  return (\n    settings.mcpServers\n      // OpenGeni, Files, and Document Search are native runtime surfaces. They\n      // remain available to sessions through configuration, but are not things a\n      // user installs, connects, or enables in the Capabilities control center.\n      .filter(\n        (server) =>\n          server.id !== CODEX_APPS_MCP_SERVER_ID && !firstPartyMcpServerIds.has(server.id),\n      )\n      .map((server) =>\n        CapabilityCatalogItem.parse({\n          id: `mcp:${server.id}`,\n          kind: \"mcp\",\n          source: \"configured\",\n          name: server.name ?? server.id,\n          description: null,\n          category: \"configured\",\n          tags: [\"mcp\", ...(server.allowedTools?.length ? [\"limited-tools\"] : [])],\n          endpointUrl: server.url,\n          tools: [{ kind: \"mcp\", id: server.id }],\n          runtime: {\n            available: true,\n            mcpServerId: server.id,\n            transport: \"streamable-http\",\n            notes: \"Managed by this OpenGeni deployment through OPENGENI_MCP_SERVERS.\",\n          },\n          metadata: {\n            mcpServerId: server.id,\n            allowedTools: server.allowedTools ?? [],\n            cacheToolsList: server.cacheToolsList,\n          },\n        }),\n      )\n  );\n}\n\nfunction isReservedCodexAppsCatalogItem(item: CapabilityCatalogItem): boolean {\n  return (\n    item.id === `mcp:${CODEX_APPS_MCP_SERVER_ID}` ||\n    (item.kind === \"mcp\" &&\n      (item.runtime.mcpServerId === CODEX_APPS_MCP_SERVER_ID ||\n        item.metadata.mcpServerId === CODEX_APPS_MCP_SERVER_ID))\n  );\n}\n\n/**\n * The Apps MCP is not a configured server and is not a user-installable\n * capability. It is a deployment-gated, workspace-designated runtime surface,\n * so project it into the same catalog the web picker already consumes while\n * keeping its authorization state server-derived and explicit.\n */\nexport function codexAppsCatalogItem(available: boolean): CapabilityCatalogItem {\n  return CapabilityCatalogItem.parse({\n    id: `mcp:${CODEX_APPS_MCP_SERVER_ID}`,\n    kind: \"mcp\",\n    source: \"built_in\",\n    name: \"Codex Apps\",\n    description:\n      \"Use the ChatGPT Apps designated for this workspace. Sessions include this surface by default when it is authorized; explicit policies can opt out.\",\n    category: \"productivity\",\n    tags: [\"mcp\", \"codex\", \"connected-apps\"],\n    providerDomain: \"chatgpt.com\",\n    surfaceType: \"codex_apps\",\n    transport: \"streamable-http\",\n    mcpUrl: CODEX_APPS_MCP_URL,\n    authKind: \"none\",\n    tools: [{ kind: \"mcp\", id: CODEX_APPS_MCP_SERVER_ID }],\n    runtime: {\n      available,\n      ...(available ? { mcpServerId: CODEX_APPS_MCP_SERVER_ID } : {}),\n      transport: \"streamable-http\",\n      notes: available\n        ? \"Available through the active workspace Apps designation.\"\n        : \"Unavailable until an active Codex Apps credential is designated for this workspace.\",\n    },\n    enabled: available,\n    enabledReason: available ? \"designated Apps credential\" : \"no active Apps designation\",\n    metadata: {\n      mcpServerId: CODEX_APPS_MCP_SERVER_ID,\n      authorization: \"workspace_designation\",\n    },\n  });\n}\n\ntype SocialProviderIntegrationDefinition = {\n  provider: \"x\" | \"reddit\";\n  name: string;\n  description: string;\n  providerDomain: string;\n  homepageUrl: string;\n  tags: string[];\n};\n\nconst SOCIAL_PROVIDER_INTEGRATIONS: readonly SocialProviderIntegrationDefinition[] = [\n  {\n    provider: \"x\",\n    name: \"X\",\n    description:\n      \"Connect one or more X accounts for live search, mentions, thread context, post sync, and permission-controlled replies.\",\n    providerDomain: \"x.com\",\n    homepageUrl: \"https://x.com\",\n    tags: [\"api\", \"x\", \"twitter\", \"social\", \"marketing\"],\n  },\n  {\n    provider: \"reddit\",\n    name: \"Reddit\",\n    description:\n      \"Connect one or more Reddit accounts for search, mentions, thread context, account sync, and permission-controlled replies.\",\n    providerDomain: \"reddit.com\",\n    homepageUrl: \"https://www.reddit.com\",\n    tags: [\"api\", \"reddit\", \"social\", \"community\", \"marketing\"],\n  },\n];\n\nconst SOCIAL_PROVIDER_TOOL_NAMES = {\n  x: [\n    \"x_accounts_list\",\n    \"x_search_live\",\n    \"x_mentions_live\",\n    \"x_thread_fetch\",\n    \"x_posts_sync\",\n    \"x_post_reply\",\n  ],\n  reddit: [\n    \"reddit_accounts_list\",\n    \"reddit_search_live\",\n    \"reddit_mentions_live\",\n    \"reddit_thread_fetch\",\n    \"reddit_posts_sync\",\n    \"reddit_post_reply\",\n  ],\n} as const;\n\n/**\n * The first-party Fiken accounting connector tile. Enablement is derived from\n * the workspace-shared verified Fiken connection (either lane), mirroring how\n * the social provider tiles derive theirs from social connections.\n */\nfunction fikenCatalogItem(fikenConnections: ConnectionMetadata[]): CapabilityCatalogItem {\n  const fikenConnection = preferredFikenConnection(fikenConnections);\n  const fikenEnabled =\n    fikenConnection?.status === \"active\" || fikenConnection?.status === \"needs_reauth\";\n  return CapabilityCatalogItem.parse({\n    id: \"api:fiken\",\n    kind: \"api\",\n    source: \"built_in\",\n    name: \"Fiken\",\n    description:\n      \"Connect Fiken accounting for contacts, products, invoices, invoice drafts, purchases, sales, and bank accounts.\",\n    category: \"finance\",\n    tags: [\"api\", \"fiken\", \"accounting\", \"invoicing\", \"norway\"],\n    homepageUrl: \"https://fiken.no\",\n    authModel: \"personal_api_token\",\n    providerDomain: FIKEN_PROVIDER_DOMAIN,\n    surfaceType: \"first_party_fiken\",\n    authKind: \"api_key\",\n    tools: [{ kind: \"mcp\", id: \"opengeni\" }],\n    runtime: {\n      available: true,\n      mcpServerId: \"opengeni\",\n      notes: \"Fiken access is provided through OpenGeni's first-party fiken tools.\",\n    },\n    enabled: fikenEnabled,\n    enabledReason: fikenEnabled\n      ? fikenConnection.status === \"active\"\n        ? \"workspace Fiken connection active\"\n        : \"workspace Fiken connection needs reconnection\"\n      : null,\n    metadata: {\n      connectorMode: \"first_party_fiken\",\n      ownership: \"workspace\",\n      // Derived from the contracts catalog so a new fiken_* tool cannot be\n      // registered without also appearing on the capability tile.\n      firstPartyMcpTools: FIRST_PARTY_MCP_TOOL_NAMES.filter((name) => name.startsWith(\"fiken_\")),\n    },\n  });\n}\n\nfunction providerIntegrationCatalogItems(\n  socialConnections: SocialConnection[],\n): CapabilityCatalogItem[] {\n  return SOCIAL_PROVIDER_INTEGRATIONS.map((definition) => {\n    const counts = socialConnectionCounts(socialConnections, definition.provider);\n    const enabled = counts.connected + counts.needsReauth > 0;\n    return CapabilityCatalogItem.parse({\n      id: `api:${definition.provider}`,\n      kind: \"api\",\n      source: \"built_in\",\n      name: definition.name,\n      description: definition.description,\n      category: \"social-media\",\n      tags: definition.tags,\n      homepageUrl: definition.homepageUrl,\n      authModel: \"oauth2_authorization_code_pkce\",\n      providerDomain: definition.providerDomain,\n      surfaceType: \"provider_integration\",\n      authKind: \"oauth2\",\n      tools: [{ kind: \"mcp\", id: \"opengeni\" }],\n      runtime: {\n        available: true,\n        mcpServerId: \"opengeni\",\n        notes:\n          \"OpenGeni's social provider adapter routes every call through an exact visible account Connection.\",\n      },\n      enabled,\n      enabledReason: socialConnectionSummary(counts),\n      provenance: \"OpenGeni provider adapter\",\n      metadata: {\n        providerAdapter: \"social\",\n        provider: definition.provider,\n        connectionCounts: counts,\n        runtimeNamespace: \"social\",\n        firstPartyMcpTools: SOCIAL_PROVIDER_TOOL_NAMES[definition.provider],\n      },\n    });\n  });\n}\n\n/**\n * Native product connection recommendations are intentionally separate from\n * the installable catalog returned to the Capabilities UI. Agents may still\n * recommend the owning product flow without manufacturing an enabled catalog\n * row for GitHub resources, Documents, schedules, or other platform features.\n */\nexport function nativeConnectionCapabilityRecommendations(): CapabilityCatalogItem[] {\n  return [\n    CapabilityCatalogItem.parse({\n      id: \"api:github-app\",\n      kind: \"api\",\n      source: \"built_in\",\n      name: \"GitHub App\",\n      description: \"Connect repositories through OpenGeni's GitHub resource picker.\",\n      category: \"source-control\",\n      tags: [\"github\", \"repositories\", \"source-control\"],\n      homepageUrl: \"https://github.com\",\n      providerDomain: \"github.com\",\n      authModel: \"github_app_owner_consent\",\n      authKind: \"oauth2\",\n      surfaceType: \"first_party_github\",\n      tools: [{ kind: \"mcp\", id: \"opengeni\" }],\n      runtime: {\n        available: true,\n        notes:\n          \"GitHub credentials stay host-owned; a workspace owner must approve repository access.\",\n      },\n      lifecycle: {\n        status: \"available\",\n        readiness: \"setup_required\",\n        detail: \"Connect GitHub from the repository resource flow.\",\n        managedBy: \"platform\",\n      },\n      actions: [\"connect\", \"inspect\"],\n      metadata: {\n        endpointPath: \"/v1/workspaces/{workspaceId}/github/app\",\n        firstPartyMcpTools: [\"github_connect_link\", \"github_repositories_list\"],\n        recommendationOnly: true,\n      },\n    }),\n  ];\n}\n\nfunction socialConnectionCounts(\n  connections: SocialConnection[],\n  provider: \"x\" | \"reddit\",\n): { connected: number; needsReauth: number; disabled: number; total: number } {\n  const matching = connections.filter((connection) => connection.provider === provider);\n  return {\n    connected: matching.filter((connection) => connection.status === \"connected\").length,\n    needsReauth: matching.filter((connection) => connection.status === \"needs_reauth\").length,\n    disabled: matching.filter((connection) => connection.status === \"disabled\").length,\n    total: matching.length,\n  };\n}\n\nfunction socialConnectionSummary(counts: ReturnType<typeof socialConnectionCounts>): string | null {\n  const parts: string[] = [];\n  if (counts.connected > 0) {\n    parts.push(`${counts.connected} connected account${counts.connected === 1 ? \"\" : \"s\"}`);\n  }\n  if (counts.needsReauth > 0) {\n    parts.push(\n      `${counts.needsReauth} account${counts.needsReauth === 1 ? \"\" : \"s\"} need${\n        counts.needsReauth === 1 ? \"s\" : \"\"\n      } reconnection`,\n    );\n  }\n  if (counts.disabled > 0) {\n    parts.push(`${counts.disabled} disconnected account${counts.disabled === 1 ? \"\" : \"s\"}`);\n  }\n  return parts.length > 0 ? parts.join(\"; \") : null;\n}\n\n/**\n * Curated skills are catalogued independently from the always-mounted bundle.\n * The runtime helper only returns entries whose reviewed artifact is present,\n * so a deployment that omits optional library assets does not advertise a\n * skill it cannot materialize.\n */\nasync function discoverCuratedSkillLibraryItems(): Promise<CapabilityCatalogItem[]> {\n  return listSkillLibraryEntries().map((entry) => curatedSkillCatalogItem(entry));\n}\n\nfunction curatedSkillCatalogItem(entry: SkillLibraryEntry): CapabilityCatalogItem {\n  return CapabilityCatalogItem.parse({\n    id: `skill:${entry.id}`,\n    kind: \"skill\",\n    source: \"library\",\n    name: entry.name,\n    description: entry.description,\n    category: entry.category,\n    tags: [...entry.tags],\n    homepageUrl: entry.sourceUrl,\n    provenance: entry.provenance,\n    tier: \"verified\",\n    runtime: {\n      available: true,\n      notes: \"Available as an explicit immutable opt-in skill selection.\",\n    },\n    metadata: {\n      libraryId: entry.id,\n      version: entry.version,\n      contentSha256: entry.contentSha256,\n      sourceCommit: entry.sourceCommit,\n      sourceUrl: entry.sourceUrl,\n      provenance: entry.provenance,\n      license: entry.license,\n      documentationUrl: entry.documentationUrl,\n      compatibility: entry.compatibility,\n      upgrade: entry.upgrade,\n      artifactPath: entry.relativePath,\n    },\n  });\n}\n\nfunction installedSkillCatalogItem(skill: InstalledSkillSummary): CapabilityCatalogItem {\n  return CapabilityCatalogItem.parse({\n    id: skill.capabilityId,\n    kind: \"skill\",\n    source: skill.source === \"library\" ? \"library\" : \"manual\",\n    name: skill.name,\n    description: skill.description,\n    category: skill.category,\n    tags: skill.tags,\n    homepageUrl: skill.repositoryUrl,\n    installUrl: skill.sourceUrl,\n    provenance: skill.provenance,\n    tier: skill.source === \"library\" ? \"verified\" : \"community\",\n    runtime: {\n      available: true,\n      notes: \"Available from an immutable Skill installation.\",\n    },\n    metadata: {\n      version: skill.version,\n      contentSha256: skill.contentSha256,\n      sourceCommit: skill.sourceCommit,\n      sourcePath: skill.sourcePath,\n      sourceUrl: skill.sourceUrl,\n      repositoryUrl: skill.repositoryUrl,\n      provenance: skill.provenance,\n      license: skill.license,\n      installedSkill: installedSkillMetadata(skill),\n    },\n  });\n}\n\nfunction installedSkillMetadata(skill: InstalledSkillSummary): Record<string, unknown> {\n  return {\n    pluginKey: skill.pluginKey,\n    installationVersion: skill.installationVersion,\n    source: skill.source,\n    version: skill.version,\n    sourceCommit: skill.sourceCommit,\n    contentSha256: skill.contentSha256,\n    fileCount: skill.fileCount,\n    totalBytes: skill.totalBytes,\n    installedAt: skill.installedAt,\n    updatedAt: skill.updatedAt,\n    owners: skill.owners.map((owner) => ({ ...owner })),\n  };\n}\n\nfunction stringMetadata(value: unknown): string | null {\n  return typeof value === \"string\" && value.trim().length > 0 ? value.trim() : null;\n}\n\nfunction isSocialProviderIntegration(item: CapabilityCatalogItem): boolean {\n  return (\n    item.surfaceType === \"first_party_social\" ||\n    (item.surfaceType === \"provider_integration\" && item.metadata.providerAdapter === \"social\")\n  );\n}\n\nfunction socialProviderConnectionCounts(item: CapabilityCatalogItem): {\n  connected: number;\n  needsReauth: number;\n} {\n  const value = item.metadata.connectionCounts;\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    return {\n      connected: item.enabled && !item.enabledReason?.includes(\"reconnection\") ? 1 : 0,\n      needsReauth: item.enabledReason?.includes(\"reconnection\") ? 1 : 0,\n    };\n  }\n  const record = value as Record<string, unknown>;\n  return {\n    connected:\n      typeof record.connected === \"number\" && Number.isInteger(record.connected)\n        ? Math.max(0, record.connected)\n        : 0,\n    needsReauth:\n      typeof record.needsReauth === \"number\" && Number.isInteger(record.needsReauth)\n        ? Math.max(0, record.needsReauth)\n        : 0,\n  };\n}\n\nexport function applyCapabilityEnablement(\n  item: CapabilityCatalogItem,\n  installation: CapabilityInstallation | undefined,\n  activePackIds: Set<string>,\n): CapabilityCatalogItem {\n  if (item.kind === \"skill\" || item.kind === \"api\" || item.kind === \"plugin\") {\n    return { ...item, enabled: false, enabledReason: null, connectionRef: null };\n  }\n  if (item.kind === \"pack\") {\n    const enabled = activePackIds.has(packIdFromCapabilityId(item.id));\n    return {\n      ...item,\n      enabled,\n      enabledReason: enabled ? \"enabled\" : null,\n    };\n  }\n  if (isSocialProviderIntegration(item)) {\n    // Provider-integration state is derived from every authoritative visible\n    // social Connection while the catalog is built. The catalog summary never\n    // publishes a personal connection UUID or collapses many accounts to one.\n    return { ...item, connectionRef: null };\n  }\n  if (item.surfaceType === \"first_party_fiken\") {\n    // Fiken connector state is derived from the authoritative workspace\n    // connection row while the catalog is built; browseable never means an\n    // account is already connected.\n    return { ...item, connectionRef: null };\n  }\n  if (item.surfaceType === \"codex_apps\") {\n    // Unlike ordinary built-ins, Apps availability is derived from the exact\n    // active workspace designation above. Do not overwrite it with the\n    // generic source-based \"built in\" enablement rule.\n    return { ...item, connectionRef: null };\n  }\n  if (item.source === \"configured\") {\n    return {\n      ...item,\n      enabled: true,\n      enabledReason: \"managed by deployment\",\n      connectionRef: null,\n    };\n  }\n  if (item.source === \"built_in\") {\n    // \"Built in\" describes provenance, not lifecycle. Native product\n    // surfaces and first-party connectors must project their authoritative\n    // state explicitly above rather than becoming enabled by taxonomy.\n    return { ...item, connectionRef: null };\n  }\n  const activeInstallation = installation?.status === \"active\";\n  const enabled = !!activeInstallation && capabilityInstallationRuntimeReady(item, installation);\n  return {\n    ...item,\n    enabled,\n    enabledReason: enabled ? \"enabled\" : null,\n    connectionRef: enabled && installation ? installationConnectionRef(installation.config) : null,\n  };\n}\n\nfunction applyCapabilityLifecycle(item: CapabilityCatalogItem): CapabilityCatalogItem {\n  if (item.source === \"configured\") {\n    return {\n      ...item,\n      lifecycle: {\n        status: \"managed\",\n        readiness: item.runtime.available ? \"ready\" : \"unavailable\",\n        detail: item.runtime.notes,\n        managedBy: \"deployment\",\n      },\n      actions: [\"inspect\"],\n    };\n  }\n\n  if (!item.runtime.available) {\n    return {\n      ...item,\n      lifecycle: {\n        status: \"unavailable\",\n        readiness: \"unavailable\",\n        detail: item.runtime.notes,\n        managedBy: item.source === \"built_in\" ? \"platform\" : null,\n      },\n      actions: [\"inspect\"],\n    };\n  }\n\n  if (isSocialProviderIntegration(item)) {\n    const counts = socialProviderConnectionCounts(item);\n    const needsAttention = counts.needsReauth > 0;\n    const connected = counts.connected > 0;\n    return {\n      ...item,\n      lifecycle: {\n        status: needsAttention ? \"needs_attention\" : connected ? \"connected\" : \"available\",\n        readiness: needsAttention ? \"attention\" : connected ? \"ready\" : \"setup_required\",\n        detail: item.enabledReason,\n        managedBy: null,\n      },\n      actions: needsAttention\n        ? [\"repair\", \"connect\", \"disconnect\", \"inspect\"]\n        : connected\n          ? [\"connect\", \"configure\", \"disconnect\", \"inspect\"]\n          : [\"connect\", \"inspect\"],\n    };\n  }\n\n  if (item.surfaceType === \"codex_apps\") {\n    return {\n      ...item,\n      lifecycle: {\n        status: item.enabled ? \"connected\" : \"available\",\n        readiness: item.enabled ? \"ready\" : \"setup_required\",\n        detail: item.enabledReason,\n        managedBy: \"platform\",\n      },\n      actions: item.enabled ? [\"configure\", \"disconnect\", \"inspect\"] : [\"connect\", \"inspect\"],\n    };\n  }\n\n  const installed = item.enabled;\n  const actions: CapabilityAction[] = installed\n    ? item.kind === \"pack\" || item.kind === \"skill\" || item.kind === \"plugin\"\n      ? [\"configure\", \"update\", \"uninstall\", \"inspect\"]\n      : [\"configure\", \"disconnect\", \"inspect\"]\n    : item.kind === \"mcp\" || item.kind === \"api\"\n      ? [\"connect\", \"inspect\"]\n      : [\"install\", \"inspect\"];\n  return {\n    ...item,\n    lifecycle: {\n      status: installed\n        ? item.kind === \"mcp\" || item.kind === \"api\"\n          ? \"ready\"\n          : \"installed\"\n        : \"available\",\n      readiness: installed ? \"ready\" : \"setup_required\",\n      detail: item.enabledReason,\n      managedBy: item.source === \"built_in\" ? \"platform\" : \"workspace\",\n    },\n    actions,\n  };\n}\n\nfunction applyInstalledSkillEnablement(\n  item: CapabilityCatalogItem,\n  installation: InstalledSkillSummary | undefined,\n): CapabilityCatalogItem {\n  if (!installation) {\n    return { ...item, enabled: false, enabledReason: null, connectionRef: null };\n  }\n  const catalogVersion = stringMetadata(item.metadata.version);\n  const current =\n    catalogVersion === null ||\n    (catalogVersion === installation.version &&\n      stringMetadata(item.metadata.contentSha256) === installation.contentSha256 &&\n      stringMetadata(item.metadata.sourceCommit) === installation.sourceCommit);\n  return {\n    ...item,\n    enabled: true,\n    enabledReason: current\n      ? \"explicitly installed\"\n      : `version ${installation.version} installed; update available`,\n    connectionRef: null,\n    metadata: {\n      ...item.metadata,\n      installedSkill: installedSkillMetadata(installation),\n      updateAvailable: !current,\n    },\n  };\n}\n\n/**\n * The connection an installation was enabled with, when the enable-time\n * connectionRef fully resolved to one (config.connectionRef is set only by\n * the enable path — see enableCapability). Headers-enabled and credential-\n * free installations never set it, so this returns null for them.\n */\nfunction installationConnectionRef(\n  config: Record<string, unknown>,\n): CapabilityCatalogItem[\"connectionRef\"] {\n  const ref = config.connectionRef;\n  if (!ref || typeof ref !== \"object\") {\n    return null;\n  }\n  const { connectionId, providerDomain, kind, subjectScope } = ref as Record<string, unknown>;\n  if (typeof providerDomain !== \"string\" || typeof kind !== \"string\") {\n    return null;\n  }\n  if (subjectScope === \"subject\") {\n    // Never project a personal connection UUID through workspace-visible\n    // capability configuration, including legacy rows that still contain one.\n    return { providerDomain, kind, subjectScope: \"subject\" };\n  }\n  if (typeof connectionId !== \"string\") {\n    return null;\n  }\n  return { connectionId, providerDomain, kind };\n}\n\nfunction dedupeCatalogItems(items: CapabilityCatalogItem[]): CapabilityCatalogItem[] {\n  const byId = new Map<string, CapabilityCatalogItem>();\n  for (const item of items) {\n    // Curated library entries are runtime-managed and must not be replaced by\n    // stale/manual rows with the same reserved skill id. Other catalog sources\n    // retain the historical last-write-wins behavior below.\n    if (item.kind === \"skill\" && item.source === \"library\" && byId.has(item.id)) {\n      byId.set(item.id, item);\n      continue;\n    }\n    const existing = byId.get(item.id);\n    if (existing?.kind === \"skill\" && existing.source === \"library\") {\n      continue;\n    }\n    byId.set(item.id, item);\n  }\n  return [...byId.values()];\n}\n\nfunction compareCatalogItems(a: CapabilityCatalogItem, b: CapabilityCatalogItem): number {\n  return `${a.kind}:${a.category}:${a.name}`.localeCompare(`${b.kind}:${b.category}:${b.name}`);\n}\n\nexport type CapabilityCatalogSearchMatch = {\n  item: CapabilityCatalogItem;\n  score: number;\n  matchedOn: Array<\"name\" | \"provider\" | \"tag\" | \"category\" | \"description\" | \"id\">;\n};\n\n/**\n * Deterministically rank the already-merged workspace catalog for an agent.\n * The caller still owns live authorization checks (GitHub binding, OAuth row,\n * and so on); this function searches metadata only and never probes a provider\n * or exposes credential/setup prose to the model.\n */\nexport function searchCapabilityCatalogItems(\n  items: readonly CapabilityCatalogItem[],\n  query: string,\n  limit = 8,\n): CapabilityCatalogSearchMatch[] {\n  const phrase = normalizeCapabilitySearchText(query);\n  const tokens = [...new Set(phrase.split(\" \").filter(Boolean))].slice(0, 24);\n  if (tokens.length === 0) return [];\n  const boundedLimit = Math.min(20, Math.max(1, Math.trunc(limit)));\n  const weightedFields = (item: CapabilityCatalogItem) =>\n    [\n      [\"name\", item.name, 100],\n      [\"provider\", item.providerDomain ?? \"\", 80],\n      [\"tag\", item.tags.join(\" \"), 50],\n      [\"category\", item.category, 30],\n      [\"id\", item.id, 25],\n      [\"description\", item.description ?? \"\", 15],\n    ] as const;\n\n  return items\n    .filter((item) => capabilityCatalogItemIsTrustedForExposure(item))\n    .flatMap((item): CapabilityCatalogSearchMatch[] => {\n      let score = 0;\n      const matchedOn = new Set<CapabilityCatalogSearchMatch[\"matchedOn\"][number]>();\n      for (const [field, raw, weight] of weightedFields(item)) {\n        const value = normalizeCapabilitySearchText(raw);\n        if (!value) continue;\n        const words = value.split(\" \");\n        if (value.includes(phrase)) {\n          score += Math.round(weight * 1.5);\n          matchedOn.add(field);\n        }\n        for (const token of tokens) {\n          if (words.includes(token)) {\n            score += weight;\n            matchedOn.add(field);\n          } else if (words.some((word) => word.startsWith(token) || token.startsWith(word))) {\n            score += Math.round(weight * 0.7);\n            matchedOn.add(field);\n          } else if (value.includes(token)) {\n            score += Math.round(weight * 0.4);\n            matchedOn.add(field);\n          }\n        }\n      }\n      if (score === 0) return [];\n      if (item.enabled) score += 12;\n      if (item.tier === \"verified\") score += 8;\n      if (item.source === \"built_in\") score += 6;\n      return [{ item, score, matchedOn: [...matchedOn] }];\n    })\n    .sort(\n      (left, right) =>\n        right.score - left.score ||\n        Number(right.item.enabled) - Number(left.item.enabled) ||\n        left.item.name.localeCompare(right.item.name) ||\n        left.item.id.localeCompare(right.item.id),\n    )\n    .slice(0, boundedLimit);\n}\n\nfunction normalizeCapabilitySearchText(value: string): string {\n  return value\n    .normalize(\"NFKD\")\n    .replace(/[\\u0300-\\u036f]/g, \"\")\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \" \")\n    .trim();\n}\n\nfunction generatedCapabilityId(payload: CreateCapabilityCatalogItemRequest): string {\n  const source = [\n    payload.kind,\n    payload.name,\n    payload.endpointUrl ?? payload.installUrl ?? payload.homepageUrl ?? \"\",\n  ].join(\":\");\n  return `${payload.kind}:${slugify(payload.name)}-${shortHash(source)}`;\n}\n\nfunction publicRegistryCapabilityId(name: string, version: string, endpointUrl: string): string {\n  return `mcp-registry:${slugify(name)}-${shortHash(`${name}:${version}:${endpointUrl}`)}`;\n}\n\nfunction packIdFromCapabilityId(capabilityId: string): string {\n  return capabilityId.replace(/^pack:/, \"\");\n}\n\nfunction uniqueTags(tags: string[]): string[] {\n  return [...new Set(tags.map((tag) => tag.trim()).filter(Boolean))];\n}\n\nfunction uniqueStrings(values: string[]): string[] {\n  return [...new Set(values.map((value) => value.trim()).filter(Boolean))];\n}\n\nfunction slugify(value: string): string {\n  return (\n    value\n      .toLowerCase()\n      .replace(/[^a-z0-9_-]+/g, \"-\")\n      .replace(/^-+|-+$/g, \"\")\n      .slice(0, 60) || \"capability\"\n  );\n}\n\nfunction shortHash(value: string): string {\n  let hash = 0x811c9dc5;\n  for (let index = 0; index < value.length; index += 1) {\n    hash ^= value.charCodeAt(index);\n    hash = Math.imul(hash, 0x01000193);\n  }\n  return (hash >>> 0).toString(36).padStart(7, \"0\").slice(0, 7);\n}\n\ntype McpRegistryPage = {\n  servers?: McpRegistryEntry[];\n  metadata?: {\n    nextCursor?: string;\n  };\n};\n\ntype McpRegistryEntry = {\n  server?: {\n    name?: string;\n    title?: string;\n    description?: string;\n    version?: string;\n    websiteUrl?: string;\n    repository?: {\n      url?: string;\n    };\n    remotes?: Array<{\n      type?: string;\n      url?: string;\n      headers?: Array<{\n        name?: string;\n        description?: string;\n        isRequired?: boolean;\n        isSecret?: boolean;\n      }>;\n    }>;\n    packages?: unknown[];\n  };\n  _meta?: {\n    \"io.modelcontextprotocol.registry/official\"?: {\n      status?: string;\n      isLatest?: boolean;\n      updatedAt?: string;\n    };\n  };\n};\n\ntype McpRegistryRemote = NonNullable<NonNullable<McpRegistryEntry[\"server\"]>[\"remotes\"]>[number];\n\nfunction mcpRegistryEntryToCatalogItem(entry: McpRegistryEntry): CapabilityCatalogItem | null {\n  const server = entry.server;\n  if (!server?.name) {\n    return null;\n  }\n  const official = entry._meta?.[\"io.modelcontextprotocol.registry/official\"];\n  if (official?.status && official.status !== \"active\") {\n    return null;\n  }\n  if (official?.isLatest === false) {\n    return null;\n  }\n  const remote = server.remotes?.find(\n    (candidate) => candidate.type === \"streamable-http\" && candidate.url,\n  );\n  const endpointUrl = validUrl(remote?.url);\n  if (!remote || !endpointUrl) {\n    return null;\n  }\n  const version = server.version ?? \"latest\";\n  const id = publicRegistryCapabilityId(server.name, version, endpointUrl);\n  const homepageUrl = validUrl(server.websiteUrl) ?? validUrl(server.repository?.url);\n  const requiredHeaders = requiredRemoteHeaders(remote);\n  const mcpServerId = mcpServerIdForCapability(id, {});\n  return CapabilityCatalogItem.parse({\n    id,\n    kind: \"mcp\",\n    source: \"public_registry\",\n    name: server.title || server.name,\n    description: server.description ?? null,\n    category: \"public-mcp\",\n    tags: [\n      \"mcp\",\n      \"public\",\n      \"registry\",\n      ...(requiredHeaders.length ? [\"requires-credentials\"] : []),\n    ],\n    homepageUrl,\n    endpointUrl,\n    installUrl: homepageUrl,\n    authModel: requiredHeaders.length ? \"credential_ref\" : null,\n    tools: [{ kind: \"mcp\", id: mcpServerId }],\n    runtime: {\n      available: true,\n      mcpServerId,\n      transport: \"streamable-http\",\n      notes:\n        requiredHeaders.length === 0\n          ? \"Remote MCP server from the official MCP Registry.\"\n          : `This MCP requires credential header(s) ${requiredHeaders.join(\", \")} supplied in the enable request.`,\n    },\n    metadata: {\n      registry: \"official_mcp_registry\",\n      registryName: server.name,\n      version,\n      updatedAt: official?.updatedAt,\n      packages: server.packages ?? [],\n      requiredHeaders,\n    },\n  });\n}\n\nfunction requiredRemoteHeaders(remote: McpRegistryRemote): string[] {\n  return (remote.headers ?? [])\n    .filter((header) => header.name && header.isRequired !== false)\n    .map((header) => header.name!.trim())\n    .filter(Boolean);\n}\n\nfunction validUrl(value: string | undefined): string | null {\n  if (!value) {\n    return null;\n  }\n  try {\n    return new URL(value).toString();\n  } catch {\n    return null;\n  }\n}\n\nfunction catalogSearchText(item: CapabilityCatalogItem): string {\n  return [\n    item.name,\n    item.description,\n    item.category,\n    ...item.tags,\n    item.endpointUrl,\n    item.homepageUrl,\n    item.installUrl,\n    JSON.stringify(item.metadata),\n  ]\n    .filter(Boolean)\n    .join(\" \")\n    .toLowerCase();\n}\n\nfunction capabilityInstallationRuntimeReady(\n  item: CapabilityCatalogItem,\n  installation: CapabilityInstallation | undefined,\n): boolean {\n  if (!installation || item.kind !== \"mcp\") {\n    return !!installation;\n  }\n  if (!item.runtime.available) {\n    return false;\n  }\n  if (!storedCredentialHeadersSatisfy(item, installation)) {\n    return false;\n  }\n  const connectivity = installation.metadata.mcpConnectivity;\n  return (\n    !!connectivity &&\n    typeof connectivity === \"object\" &&\n    \"status\" in connectivity &&\n    (connectivity.status === \"ok\" || connectivity.status === \"auth_deferred\")\n  );\n}\n\n/**\n * Checks the generic installation projection (header names only) against the\n * capability's declared credential requirements.\n */\nfunction storedCredentialHeadersSatisfy(\n  item: CapabilityCatalogItem,\n  installation: CapabilityInstallation,\n): boolean {\n  if (storedConnectionRef(installation.config)) {\n    return true;\n  }\n  const storedNames = new Set(\n    (Array.isArray(installation.config.headerNames) ? installation.config.headerNames : [])\n      .filter((name): name is string => typeof name === \"string\")\n      .map((name) => name.toLowerCase()),\n  );\n  const required = requiredCapabilityHeaders(item.metadata);\n  if (required.some((name) => !storedNames.has(name.toLowerCase()))) {\n    return false;\n  }\n  return !item.authModel || storedNames.size > 0;\n}\n\nfunction storedConnectionRef(config: Record<string, unknown>): boolean {\n  const ref = config.connectionRef;\n  return (\n    !!ref &&\n    typeof ref === \"object\" &&\n    !Array.isArray(ref) &&\n    typeof (ref as { providerDomain?: unknown }).providerDomain === \"string\"\n  );\n}\n","import {\n  FIKEN_CREDENTIAL_LABEL,\n  FIKEN_CREDENTIAL_ROLE,\n  FIKEN_PROVIDER_DOMAIN,\n  FikenConnectionMetadata,\n  type ConnectionMetadata,\n  type FikenCompanySummary,\n  type FikenConnectionMetadata as FikenMetadata,\n} from \"@opengeni/contracts\";\n\nexport function fikenConnectionMetadata(metadata: Record<string, unknown>): FikenMetadata | null {\n  const parsed = FikenConnectionMetadata.safeParse(metadata);\n  return parsed.success ? parsed.data : null;\n}\n\n/**\n * A workspace-shared Fiken connection created through one of the verified\n * install paths: the pasted personal API token (`api_key`) or the Fiken OAuth\n * app flow (`oauth2`). Both are deliberately workspace-owned; personal\n * (\"Connect only for me\") ownership needs the delegation-snapshot lane and is\n * not yet wired for the first-party fiken tools.\n */\nexport function isFikenConnection(connection: ConnectionMetadata): boolean {\n  return (\n    connection.subjectId === null &&\n    connection.providerDomain === FIKEN_PROVIDER_DOMAIN &&\n    (connection.kind === \"api_key\" || connection.kind === \"oauth2\") &&\n    fikenConnectionMetadata(connection.metadata)?.credentialRole === FIKEN_CREDENTIAL_ROLE\n  );\n}\n\n/**\n * The Fiken credential role is reserved for the verified install routes.\n * Generic connection create/update must reject it so a caller cannot forge a\n * \"verified\" Fiken row (with attacker-chosen companies metadata) that the\n * first-party fiken tools would then bind to. Mirrors the Slack bot guard.\n */\nexport function hasReservedFikenMetadata(\n  metadata: Record<string, unknown> | null | undefined,\n): boolean {\n  return (\n    metadata?.credentialRole === FIKEN_CREDENTIAL_ROLE ||\n    metadata?.credentialLabel === FIKEN_CREDENTIAL_LABEL\n  );\n}\n\n/**\n * One default-company rule for both verified lanes: an explicit request wins\n * when the credential can access it, then a still-accessible previous default\n * survives reconnect, then a single-company credential auto-selects. Returns\n * null (caller decides whether that is an error) when a requested slug is not\n * among the verified companies.\n */\nexport function resolveFikenDefaultCompanySlug(input: {\n  requested: string | null;\n  previous: string | null;\n  companies: readonly FikenCompanySummary[];\n}): string | null {\n  const accessible = (slug: string | null): slug is string =>\n    slug !== null && input.companies.some((company) => company.slug === slug);\n  if (input.requested !== null) {\n    return accessible(input.requested) ? input.requested : null;\n  }\n  if (accessible(input.previous)) {\n    return input.previous;\n  }\n  return input.companies.length === 1 ? input.companies[0]!.slug : null;\n}\n\n/**\n * The row a capability tile or tool default should bind to when several Fiken\n * connections exist: usable status first, then newest update, then immutable\n * UUID descending as the stable tie-breaker.\n */\nexport function preferredFikenConnection<\n  T extends Pick<ConnectionMetadata, \"status\" | \"updatedAt\" | \"id\">,\n>(connections: readonly T[]): T | null {\n  const statusRank = (status: ConnectionMetadata[\"status\"]): number =>\n    status === \"active\" ? 0 : status === \"needs_reauth\" ? 1 : 2;\n  return (\n    [...connections].sort(\n      (left, right) =>\n        statusRank(left.status) - statusRank(right.status) ||\n        right.updatedAt.localeCompare(left.updatedAt) ||\n        right.id.localeCompare(left.id),\n    )[0] ?? null\n  );\n}\n","import { createHash } from \"node:crypto\";\n\nimport {\n  CapabilityPack,\n  stableJson,\n  type CapabilityPackSkill,\n  type PackComponentResolution,\n  type PackInstallationPreview,\n  type PackRigResolution,\n  type ScheduledTaskAgentConfig,\n  type SocialConnection,\n} from \"@opengeni/contracts\";\nimport {\n  getPackInstallation,\n  getRig,\n  getVariableSet,\n  getWorkspacePack,\n  listPackInstallations,\n  listWorkspacePacks,\n  resolvePackComponentReferences,\n  resolvePackInlineSkillReferences,\n  type Database,\n} from \"@opengeni/db\";\nimport { buildPortableSkillArtifact } from \"@opengeni/runtime/skill-library\";\nimport { HTTPException } from \"hono/http-exception\";\n\nexport const MARKETING_SOCIAL_PACK_ID = \"marketing-social-daily-analysis\";\n\nconst marketingSocialPack: CapabilityPack = {\n  id: MARKETING_SOCIAL_PACK_ID,\n  name: \"Marketing social daily analysis\",\n  description:\n    \"Connect social accounts, attach marketing knowledge, and schedule agents to produce daily media performance analysis.\",\n  role: \"marketing\",\n  category: \"social-media\",\n  version: \"0.1.0\",\n  // Built-in packs deliberately declare no sandboxImage and no skills: the\n  // worker's pack-runtime resolution only reads manifest-registered packs\n  // (see apps/worker/src/activities/packs.ts), and a test enforces this.\n  skills: [],\n  components: [],\n  tools: [\n    { kind: \"mcp\", id: \"opengeni\" },\n    { kind: \"mcp\", id: \"docs\" },\n  ],\n  connectors: [\n    {\n      id: \"x\",\n      name: \"X\",\n      category: \"social-media\",\n      authModel: \"oauth2_authorization_code_pkce\",\n      providers: [\"x\"],\n      scopes: [\"tweet.read\", \"tweet.write\", \"users.read\", \"offline.access\"],\n      required: false,\n      metadata: {\n        docs: \"https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code\",\n        firstParty: true,\n        oauthStartPath: \"/social/oauth/start\",\n      },\n    },\n    {\n      id: \"reddit\",\n      name: \"Reddit\",\n      category: \"social-media\",\n      authModel: \"oauth2_authorization_code\",\n      providers: [\"reddit\"],\n      scopes: [\"identity\", \"read\", \"submit\", \"privatemessages\", \"history\"],\n      required: false,\n      metadata: {\n        docs: \"https://github.com/reddit-archive/reddit/wiki/OAuth2\",\n        firstParty: true,\n        oauthStartPath: \"/social/oauth/start\",\n      },\n    },\n    {\n      id: \"linkedin\",\n      name: \"LinkedIn\",\n      category: \"social-media\",\n      authModel: \"oauth2_authorization_code\",\n      providers: [\"linkedin\"],\n      scopes: [\"r_organization_social\", \"rw_organization_admin\"],\n      required: false,\n      metadata: {\n        docs: \"https://learn.microsoft.com/en-us/linkedin/marketing/community-management/community-management-overview\",\n      },\n    },\n    {\n      id: \"instagram\",\n      name: \"Instagram\",\n      category: \"social-media\",\n      authModel: \"oauth2_authorization_code\",\n      providers: [\"instagram\", \"facebook\"],\n      scopes: [\n        \"instagram_basic\",\n        \"instagram_manage_insights\",\n        \"pages_read_engagement\",\n        \"pages_show_list\",\n      ],\n      required: false,\n      metadata: {\n        docs: \"https://developers.facebook.com/docs/instagram-platform/instagram-graph-api/\",\n      },\n    },\n    {\n      id: \"tiktok\",\n      name: \"TikTok\",\n      category: \"social-media\",\n      authModel: \"oauth2_authorization_code\",\n      providers: [\"tiktok\"],\n      scopes: [\"user.info.basic\", \"video.list\"],\n      required: false,\n      metadata: {\n        docs: \"https://developers.tiktok.com/doc/tiktok-api-v2-introduction/\",\n      },\n    },\n    {\n      id: \"youtube\",\n      name: \"YouTube\",\n      category: \"social-media\",\n      authModel: \"oauth2_authorization_code\",\n      providers: [\"youtube\"],\n      scopes: [\n        \"https://www.googleapis.com/auth/youtube.readonly\",\n        \"https://www.googleapis.com/auth/yt-analytics.readonly\",\n      ],\n      required: false,\n      metadata: {\n        docs: \"https://developers.google.com/youtube/v3\",\n      },\n    },\n  ],\n  knowledge: [\n    {\n      type: \"document_base\",\n      id: \"marketing-playbook\",\n      name: \"Marketing playbook\",\n      description:\n        \"Optional workspace document base with brand voice, campaign calendars, audience research, and reporting rules.\",\n      required: false,\n    },\n  ],\n  scheduledTaskTemplates: [\n    {\n      id: \"daily-social-analysis\",\n      name: \"Daily social analysis\",\n      description: \"Review the latest social posts and account signals every day.\",\n      defaultSchedule: {\n        type: \"calendar\",\n        timeZone: \"UTC\",\n        hour: 9,\n        minute: 0,\n      },\n      defaultRunMode: \"new_session_per_run\",\n      defaultOverlapPolicy: \"skip\",\n    },\n  ],\n  metadata: {\n    skill: \"social-media-marketing\",\n    firstPartyMcpTools: [\n      \"social_connections_list\",\n      \"social_posts_recent\",\n      \"social_daily_analysis_context\",\n      \"x_accounts_list\",\n      \"x_search_live\",\n      \"x_mentions_live\",\n      \"x_thread_fetch\",\n      \"x_posts_sync\",\n      \"x_post_reply\",\n      \"reddit_accounts_list\",\n      \"reddit_search_live\",\n      \"reddit_mentions_live\",\n      \"reddit_thread_fetch\",\n      \"reddit_posts_sync\",\n      \"reddit_post_reply\",\n    ],\n  },\n};\n\nconst packs = [marketingSocialPack] satisfies CapabilityPack[];\n\nexport function listCapabilityPacks(): CapabilityPack[] {\n  return packs;\n}\n\nexport function getCapabilityPack(packId: string): CapabilityPack | null {\n  return packs.find((pack) => pack.id === packId) ?? null;\n}\n\nexport function isBuiltInCapabilityPack(packId: string): boolean {\n  return getCapabilityPack(packId) !== null;\n}\n\n/**\n * Built-in packs plus the manifests registered for this workspace. Stored\n * manifests were validated at registration time; rows that no longer parse\n * (for example after a contract tightening) are skipped instead of breaking\n * the whole catalog.\n */\nexport async function listWorkspaceCapabilityPacks(\n  db: Database,\n  workspaceId: string,\n): Promise<CapabilityPack[]> {\n  const registered = await listWorkspacePacks(db, workspaceId);\n  const builtInIds = new Set(packs.map((pack) => pack.id));\n  const registeredPacks = registered\n    .filter((registration) => !builtInIds.has(registration.pack.id))\n    .flatMap((registration) => {\n      const parsed = CapabilityPack.safeParse(registration.pack);\n      return parsed.success ? [parsed.data] : [];\n    });\n  return [...packs, ...registeredPacks];\n}\n\nexport async function resolveCapabilityPack(\n  db: Database,\n  workspaceId: string,\n  packId: string,\n): Promise<CapabilityPack | null> {\n  const builtIn = getCapabilityPack(packId);\n  if (builtIn) {\n    return builtIn;\n  }\n  const registration = await getWorkspacePack(db, workspaceId, packId);\n  if (!registration) {\n    return null;\n  }\n  const parsed = CapabilityPack.safeParse(registration.pack);\n  return parsed.success ? parsed.data : null;\n}\n\nexport function capabilityPackManifestDigest(pack: CapabilityPack): string {\n  return createHash(\"sha256\").update(stableJson(pack)).digest(\"hex\");\n}\n\n/** True when the Pack must use the owner-aware V2 preview/install lifecycle. */\nexport function capabilityPackRequiresInstallationPlan(pack: CapabilityPack): boolean {\n  return (\n    pack.components.length > 0 ||\n    pack.skills.length > 0 ||\n    pack.rig !== undefined ||\n    pack.sandboxImage !== undefined ||\n    pack.sandboxProviderImages !== undefined\n  );\n}\n\nexport type InlinePackSkillInstall = {\n  componentKey: string;\n  capabilityId: string;\n  pluginKey: string;\n  sourceUrl: string;\n  repositoryUrl: string;\n  sourceCommit: string;\n  sourcePath: string;\n  name: string;\n  description: string;\n  contentSha256: string;\n  totalBytes: number;\n  files: Array<{ path: string; content: string; byteSize: number; contentSha256: string }>;\n};\n\n/** Convert a legacy inline Pack Skill into the ordinary immutable Skill model. */\nexport function inlinePackSkillInstall(\n  pack: CapabilityPack,\n  skill: CapabilityPackSkill,\n): InlinePackSkillInstall {\n  const artifact = buildPortableSkillArtifact(skill.files);\n  if (artifact.name.toLowerCase() !== skill.name.toLowerCase()) {\n    throw new HTTPException(422, {\n      message: `Pack Skill ${skill.name} has SKILL.md name ${artifact.name}; the names must match`,\n    });\n  }\n  const normalizedName = skill.name.toLowerCase();\n  const encodedSkill = encodeURIComponent(normalizedName);\n  const sourceUrl = `https://opengeni.invalid/pack-inline-skills/${encodedSkill}/${artifact.contentSha256}`;\n  const capabilityId = `skill:pack-inline/${normalizedName}@${artifact.contentSha256}`;\n  return {\n    componentKey: `inline-skill/${normalizedName}`,\n    capabilityId,\n    pluginKey: `pack-skill/${normalizedName}/${artifact.contentSha256}`,\n    sourceUrl,\n    repositoryUrl: \"https://opengeni.invalid/pack-inline-skills\",\n    sourceCommit: artifact.contentSha256,\n    sourcePath: normalizedName,\n    name: artifact.name,\n    description: artifact.description,\n    contentSha256: artifact.contentSha256,\n    totalBytes: artifact.totalBytes,\n    files: artifact.files.map((file) => ({\n      path: file.path,\n      content: file.content,\n      byteSize: new TextEncoder().encode(file.content).byteLength,\n      contentSha256: createHash(\"sha256\").update(file.content).digest(\"hex\"),\n    })),\n  };\n}\n\nexport async function previewCapabilityPackInstallation(\n  db: Database,\n  workspaceId: string,\n  pack: CapabilityPack,\n  options: { rigId?: string; variableSetId?: string } = {},\n): Promise<PackInstallationPreview> {\n  const installation = await getPackInstallation(db, workspaceId, pack.id);\n  const inlineInstalls = pack.skills.map((skill) => inlinePackSkillInstall(pack, skill));\n  const [referencedComponents, inlineComponents] = await Promise.all([\n    resolvePackComponentReferences(db, workspaceId, pack.components),\n    resolvePackInlineSkillReferences(\n      db,\n      workspaceId,\n      inlineInstalls.map((inline) => ({\n        key: inline.componentKey,\n        capabilityId: inline.capabilityId,\n        name: inline.name,\n        contentSha256: inline.contentSha256,\n      })),\n      installation?.id,\n    ),\n  ]);\n  const manifestDigest = capabilityPackManifestDigest(pack);\n  const components: PackComponentResolution[] = [...referencedComponents, ...inlineComponents];\n  const blockers = components\n    .filter((component) => component.required && component.status !== \"ready\")\n    .map((component) =>\n      component.status === \"missing\"\n        ? `${component.label} is not installed in this workspace`\n        : `${component.label} does not match the Pack's pinned version`,\n    );\n  const rig = await resolvePackRig(\n    db,\n    workspaceId,\n    pack,\n    options.rigId,\n    installation?.selectedRigId,\n  );\n  if (\n    rig.status !== \"ready\" &&\n    rig.status !== \"not_required\" &&\n    (rig.required || rig.requestedRigId !== null || rig.rigId !== null)\n  ) {\n    blockers.push(packRigBlocker(rig, pack.sandboxImage ?? null));\n  }\n  const variableSetId =\n    options.variableSetId ?? storedVariableSetId(installation?.metadata) ?? null;\n  if (pack.variableSet?.required && !variableSetId) {\n    blockers.push(\"Choose saved configuration before installing this Pack\");\n  } else if (variableSetId) {\n    const variableSet = await getVariableSet(db, workspaceId, variableSetId);\n    if (!variableSet) {\n      blockers.push(\"The selected configuration no longer exists in this workspace\");\n    } else {\n      const missing = (pack.variableSet?.requiredVariables ?? []).filter(\n        (name) => !variableSet.variables.some((variable) => variable.name === name),\n      );\n      if (missing.length > 0) {\n        blockers.push(`Configuration is missing required value(s): ${missing.join(\", \")}`);\n      }\n    }\n  }\n  const action =\n    !installation || installation.status === \"disabled\"\n      ? \"install\"\n      : installation.manifestDigest === manifestDigest\n        ? \"repair\"\n        : \"update\";\n  return {\n    packId: pack.id,\n    packVersion: pack.version,\n    manifestDigest,\n    installationVersion: installation?.version ?? null,\n    action,\n    ready: blockers.length === 0,\n    blockers,\n    components,\n    rig,\n    variableSetId,\n    legacyInlineSkillCount: pack.skills.length,\n    legacySandboxImage: pack.sandboxImage ?? null,\n  };\n}\n\nasync function resolvePackRig(\n  db: Database,\n  workspaceId: string,\n  pack: CapabilityPack,\n  requestedRigId: string | undefined,\n  storedRigId: string | null | undefined,\n): Promise<PackRigResolution> {\n  const required = pack.rig?.required === true || Boolean(pack.sandboxImage);\n  const selectedRigId = pack.rig?.rigId ?? requestedRigId ?? storedRigId ?? null;\n  if (!required && !selectedRigId) {\n    return {\n      required: false,\n      status: \"not_required\",\n      requestedRigId: requestedRigId ?? null,\n      rigId: null,\n      rigVersionId: null,\n      name: null,\n      image: null,\n    };\n  }\n  if (pack.rig?.rigId && requestedRigId && pack.rig.rigId !== requestedRigId) {\n    return {\n      required,\n      status: \"mismatch\",\n      requestedRigId,\n      rigId: pack.rig.rigId,\n      rigVersionId: null,\n      name: null,\n      image: null,\n    };\n  }\n  if (!selectedRigId) {\n    return {\n      required,\n      status: \"missing\",\n      requestedRigId: requestedRigId ?? null,\n      rigId: null,\n      rigVersionId: null,\n      name: null,\n      image: null,\n    };\n  }\n  const rig = await getRig(db, workspaceId, selectedRigId);\n  if (!rig?.activeVersion) {\n    return {\n      required,\n      status: \"missing\",\n      requestedRigId: requestedRigId ?? null,\n      rigId: selectedRigId,\n      rigVersionId: null,\n      name: rig?.name ?? null,\n      image: null,\n    };\n  }\n  const image = rig.activeVersion.image ?? null;\n  const status =\n    pack.sandboxImage && image !== pack.sandboxImage\n      ? \"mismatch\"\n      : pack.rig?.requireVerified && rig.activeVersionHealth?.checkHealth !== \"passing\"\n        ? \"unverified\"\n        : \"ready\";\n  return {\n    required,\n    status,\n    requestedRigId: requestedRigId ?? null,\n    rigId: rig.id,\n    rigVersionId: rig.activeVersion.id,\n    name: rig.name,\n    image,\n  };\n}\n\nfunction packRigBlocker(rig: PackRigResolution, legacyImage: string | null): string {\n  if (rig.status === \"missing\") {\n    return \"Choose an available compute environment before installing this Pack\";\n  }\n  if (rig.status === \"unverified\") {\n    return \"Verify the selected compute environment before installing this Pack\";\n  }\n  if (legacyImage) {\n    return `The selected compute environment must use the Pack's previous image ${legacyImage}; the Pack will not replace workspace compute`;\n  }\n  return \"The selected compute environment does not satisfy this Pack's requirement\";\n}\n\nfunction storedVariableSetId(metadata: Record<string, unknown> | undefined): string | null {\n  const value = metadata?.variableSetId ?? metadata?.environmentId;\n  return typeof value === \"string\" && value.length > 0 ? value : null;\n}\n\n/**\n * v1 pack-scoped runtime rule: at most one enabled pack per workspace may\n * declare a `sandboxImage` — there is deliberately no image composition or\n * layering. Enforced when a pack is enabled (both the packs endpoint and the\n * generic capability enable path) and re-checked at session start by the\n * worker, which also covers manifests re-registered after enablement.\n */\nexport async function assertPackSandboxImageCompatible(\n  db: Database,\n  workspaceId: string,\n  pack: CapabilityPack,\n): Promise<void> {\n  if (!pack.sandboxImage) {\n    return;\n  }\n  const installations = await listPackInstallations(db, workspaceId);\n  for (const installation of installations) {\n    if (installation.status !== \"active\" || installation.packId === pack.id) {\n      continue;\n    }\n    const other = await resolveCapabilityPack(db, workspaceId, installation.packId);\n    if (other?.sandboxImage) {\n      throw new HTTPException(409, {\n        message: `pack ${pack.id} declares a sandbox image, but enabled pack ${other.id} already declares one; only one enabled pack per workspace may declare sandboxImage — disable ${other.id} first`,\n      });\n    }\n  }\n}\n\nexport function buildMarketingDailyAnalysisAgentConfig(input: {\n  connections: SocialConnection[];\n  documentBaseIds: string[];\n  promptInstructions?: string;\n}): ScheduledTaskAgentConfig {\n  const connectionIds = input.connections.map((connection) => connection.id);\n  return {\n    prompt: marketingDailyAnalysisPrompt({\n      connections: input.connections,\n      documentBaseIds: input.documentBaseIds,\n      ...(input.promptInstructions ? { promptInstructions: input.promptInstructions } : {}),\n    }),\n    resources: [],\n    tools: marketingSocialPack.tools,\n    metadata: {\n      packId: MARKETING_SOCIAL_PACK_ID,\n      packTemplateId: \"daily-social-analysis\",\n      socialConnectionIds: connectionIds,\n      documentBaseIds: input.documentBaseIds,\n      analysisWindowHours: 24,\n    },\n  };\n}\n\nfunction marketingDailyAnalysisPrompt(input: {\n  connections: SocialConnection[];\n  documentBaseIds: string[];\n  promptInstructions?: string;\n}): string {\n  const connectionLines = input.connections\n    .map((connection) => {\n      return `- ${connection.provider}: ${connection.accountHandle} (${connection.id})`;\n    })\n    .join(\"\\n\");\n  const knowledgeLine =\n    input.documentBaseIds.length > 0\n      ? `Use these document base IDs for brand/campaign knowledge through the docs MCP: ${input.documentBaseIds.join(\", \")}.`\n      : \"No document base IDs were selected; rely only on social context returned by tools.\";\n  const extra = input.promptInstructions\n    ? `\\nAdditional operator instructions:\\n${input.promptInstructions.trim()}\\n`\n    : \"\";\n\n  return [\n    \"Run the daily social media analysis for the selected accounts.\",\n    \"\",\n    \"First call the OpenGeni MCP tool social_daily_analysis_context with the selected connection IDs and a 24 hour analysis window. Use social_posts_recent only if you need a narrower follow-up query.\",\n    knowledgeLine,\n    \"\",\n    \"Selected accounts:\",\n    connectionLines,\n    extra,\n    \"Produce a concise report with these sections: executive summary, notable account changes, winning posts, underperforming posts, audience and content signals, recommended actions for the next 24 hours, and data gaps.\",\n    \"Use only metrics and posts returned by tools or document search. Do not invent metrics, posts, or account capabilities.\",\n  ]\n    .filter(Boolean)\n    .join(\"\\n\");\n}\n","import { createHash } from \"node:crypto\";\nimport type { SkillImportPreview, SkillImportSource } from \"@opengeni/contracts\";\nimport {\n  buildPortableSkillArtifact,\n  PORTABLE_SKILL_MAX_FILES,\n  PORTABLE_SKILL_MAX_TOTAL_BYTES,\n  type SkillLibraryFile,\n} from \"@opengeni/runtime/skill-library\";\nimport { HTTPException } from \"hono/http-exception\";\n\nexport type GitHubSkillTreeEntry = Readonly<{\n  path: string;\n  type: \"blob\" | \"tree\" | \"commit\";\n  mode: string;\n  sha: string;\n  size: number | null;\n}>;\n\nexport type GitHubSkillSourceClient = Readonly<{\n  resolveCommit(owner: string, repository: string, ref: string): Promise<string>;\n  listTree(\n    owner: string,\n    repository: string,\n    commit: string,\n  ): Promise<readonly GitHubSkillTreeEntry[]>;\n  readBlob(owner: string, repository: string, sha: string): Promise<Uint8Array>;\n}>;\n\nexport type ResolvedSkillImport = Readonly<{\n  preview: SkillImportPreview;\n  files: readonly SkillLibraryFile[];\n}>;\n\ntype ParsedSkillSource = Readonly<{\n  source: SkillImportSource;\n  owner: string;\n  repository: string;\n  ref: string;\n  requestedPath: string | null;\n  skillSlug: string | null;\n  inputUrl: string;\n}>;\n\nconst githubSegment = /^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,98}[A-Za-z0-9])?$/u;\nconst gitCommit = /^[0-9a-f]{40,64}$/u;\nconst maxConcurrentBlobReads = 8;\n\nexport async function resolveSkillImport(\n  rawUrl: string,\n  client: GitHubSkillSourceClient,\n): Promise<ResolvedSkillImport> {\n  const parsed = parseSkillSource(rawUrl);\n  const sourceCommit = await client.resolveCommit(parsed.owner, parsed.repository, parsed.ref);\n  if (!gitCommit.test(sourceCommit)) {\n    throw new HTTPException(422, { message: \"GitHub returned an invalid source commit\" });\n  }\n  const tree = await client.listTree(parsed.owner, parsed.repository, sourceCommit);\n  const sourcePath = selectSkillRoot(parsed, tree);\n  const entries = skillFilesUnderRoot(tree, sourcePath);\n  const declaredBytes = entries.reduce((sum, entry) => sum + (entry.size ?? 0), 0);\n  if (entries.length > PORTABLE_SKILL_MAX_FILES) {\n    throw new HTTPException(422, {\n      message: `Skill contains more than ${PORTABLE_SKILL_MAX_FILES} files`,\n    });\n  }\n  if (declaredBytes > PORTABLE_SKILL_MAX_TOTAL_BYTES) {\n    throw new HTTPException(422, {\n      message: `Skill exceeds ${PORTABLE_SKILL_MAX_TOTAL_BYTES} bytes`,\n    });\n  }\n  const files = await mapConcurrent(entries, maxConcurrentBlobReads, async (entry) => {\n    let content: string;\n    try {\n      content = new TextDecoder(\"utf-8\", { fatal: true }).decode(\n        await client.readBlob(parsed.owner, parsed.repository, entry.sha),\n      );\n    } catch {\n      throw new HTTPException(422, {\n        message: `Skill file is not valid UTF-8 text: ${relativeSkillPath(entry.path, sourcePath)}`,\n      });\n    }\n    return { path: relativeSkillPath(entry.path, sourcePath), content };\n  });\n  let artifact;\n  try {\n    artifact = buildPortableSkillArtifact(files);\n  } catch (error) {\n    throw new HTTPException(422, {\n      message: error instanceof Error ? error.message : \"Skill artifact is invalid\",\n    });\n  }\n  const repositoryUrl = `https://github.com/${parsed.owner}/${parsed.repository}`;\n  const sourceUrl =\n    sourcePath === \".\"\n      ? `${repositoryUrl}/tree/${sourceCommit}`\n      : `${repositoryUrl}/tree/${sourceCommit}/${encodeGitHubPath(sourcePath)}`;\n  const warnings: string[] = [];\n  if (!artifact.files.some((file) => /(^|\\/)licen[cs]e(?:\\.|$)/iu.test(file.path))) {\n    warnings.push(\"No license file was found inside the selected Skill folder.\");\n  }\n  const executableFiles = artifact.files.filter((file) => /(^|\\/)scripts?\\//u.test(file.path));\n  if (executableFiles.length > 0) {\n    warnings.push(\n      `${executableFiles.length} script file${executableFiles.length === 1 ? \"\" : \"s\"} will be available to the agent only after installation.`,\n    );\n  }\n  return {\n    preview: {\n      source: parsed.source,\n      sourceUrl,\n      repositoryUrl,\n      owner: parsed.owner,\n      repository: parsed.repository,\n      sourcePath,\n      sourceCommit,\n      name: artifact.name,\n      description: artifact.description,\n      contentSha256: artifact.contentSha256,\n      totalBytes: artifact.totalBytes,\n      files: artifact.files.map((file) => {\n        const bytes = new TextEncoder().encode(file.content);\n        return {\n          path: file.path,\n          byteSize: bytes.byteLength,\n          contentSha256: sha256Hex(bytes),\n        };\n      }),\n      warnings,\n      installed: false,\n      installationVersion: null,\n    },\n    files: artifact.files,\n  };\n}\n\nexport function portableSkillPluginKey(\n  source: Pick<SkillImportPreview, \"owner\" | \"repository\" | \"sourcePath\">,\n): string {\n  return `skill/${source.owner}/${source.repository}/${source.sourcePath}`.toLowerCase();\n}\n\nexport function portableSkillCapabilityId(\n  source: Pick<SkillImportPreview, \"name\" | \"owner\" | \"repository\" | \"sourcePath\">,\n): string {\n  const identity = portableSkillPluginKey(source);\n  const suffix = createHash(\"sha256\").update(identity).digest(\"hex\").slice(0, 12);\n  return `skill:${source.name.toLowerCase()}-${suffix}`;\n}\n\nexport function parseSkillSource(rawUrl: string): ParsedSkillSource {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    throw new HTTPException(422, { message: \"Enter a valid GitHub or skills.sh URL\" });\n  }\n  if (url.protocol !== \"https:\" || url.username || url.password || url.hash) {\n    throw new HTTPException(422, {\n      message: \"Skill imports require a credential-free HTTPS URL without a fragment\",\n    });\n  }\n  const segments = url.pathname.split(\"/\").filter(Boolean).map(decodeURIComponent);\n  if (url.hostname === \"skills.sh\" || url.hostname === \"www.skills.sh\") {\n    if (segments.length !== 3) {\n      throw new HTTPException(422, {\n        message: \"A skills.sh URL must identify one owner, repository, and Skill\",\n      });\n    }\n    const [owner, repository, skillSlug] = segments;\n    assertGitHubRepository(owner!, repository!);\n    if (!skillSlug || !githubSegment.test(skillSlug)) {\n      throw new HTTPException(422, { message: \"The skills.sh Skill name is invalid\" });\n    }\n    return {\n      source: \"skills_sh\",\n      owner: owner!,\n      repository: stripGitSuffix(repository!),\n      ref: \"HEAD\",\n      requestedPath: null,\n      skillSlug,\n      inputUrl: url.toString(),\n    };\n  }\n  if (url.hostname !== \"github.com\" && url.hostname !== \"www.github.com\") {\n    throw new HTTPException(422, {\n      message: \"Only github.com and skills.sh imports are supported\",\n    });\n  }\n  if (segments.length < 2) {\n    throw new HTTPException(422, { message: \"A GitHub URL must identify a repository\" });\n  }\n  const owner = segments[0]!;\n  const repository = stripGitSuffix(segments[1]!);\n  assertGitHubRepository(owner, repository);\n  if (segments.length === 2) {\n    return {\n      source: \"github\",\n      owner,\n      repository,\n      ref: \"HEAD\",\n      requestedPath: null,\n      skillSlug: null,\n      inputUrl: url.toString(),\n    };\n  }\n  const mode = segments[2];\n  if (mode !== \"tree\" && mode !== \"blob\") {\n    throw new HTTPException(422, {\n      message: \"Use a GitHub repository, tree, folder, or SKILL.md URL\",\n    });\n  }\n  const ref = segments[3];\n  if (!ref) throw new HTTPException(422, { message: \"The GitHub URL is missing a revision\" });\n  const pathSegments = segments.slice(4);\n  if (pathSegments.length === 0) {\n    throw new HTTPException(422, { message: \"The GitHub URL is missing a Skill folder\" });\n  }\n  const requestedPath = normalizeGitHubPath(\n    mode === \"blob\" && pathSegments.at(-1)?.toLowerCase() === \"skill.md\"\n      ? pathSegments.slice(0, -1)\n      : pathSegments,\n  );\n  return {\n    source: \"github\",\n    owner,\n    repository,\n    ref,\n    requestedPath,\n    skillSlug: null,\n    inputUrl: url.toString(),\n  };\n}\n\nfunction selectSkillRoot(source: ParsedSkillSource, tree: readonly GitHubSkillTreeEntry[]): string {\n  const skillFiles = tree\n    .filter(\n      (entry) =>\n        entry.type === \"blob\" &&\n        entry.mode !== \"120000\" &&\n        (entry.path === \"SKILL.md\" || entry.path.endsWith(\"/SKILL.md\")),\n    )\n    .map((entry) => entry.path.slice(0, -\"/SKILL.md\".length) || \".\")\n    .sort();\n  if (source.requestedPath) {\n    const root = source.requestedPath;\n    if (!skillFiles.includes(root)) {\n      throw new HTTPException(422, {\n        message: `No top-level SKILL.md was found in ${root}`,\n      });\n    }\n    return root;\n  }\n  const candidates = source.skillSlug\n    ? skillFiles.filter((path) => path.split(\"/\").at(-1) === source.skillSlug)\n    : skillFiles;\n  if (candidates.length === 0) {\n    throw new HTTPException(422, { message: \"No Skill folder with SKILL.md was found\" });\n  }\n  if (candidates.length > 1) {\n    throw new HTTPException(422, {\n      message: \"This source contains multiple Skills; paste the exact GitHub folder URL\",\n    });\n  }\n  return candidates[0]!;\n}\n\nfunction skillFilesUnderRoot(\n  tree: readonly GitHubSkillTreeEntry[],\n  root: string,\n): GitHubSkillTreeEntry[] {\n  const prefix = root === \".\" ? \"\" : `${root}/`;\n  const inside = tree.filter((entry) => entry.path.startsWith(prefix));\n  const unsupported = inside.find(\n    (entry) => entry.type === \"commit\" || (entry.type === \"blob\" && entry.mode === \"120000\"),\n  );\n  if (unsupported) {\n    throw new HTTPException(422, {\n      message: `Skill folders may not contain symbolic links or submodules (${unsupported.path})`,\n    });\n  }\n  const files = inside\n    .filter((entry) => entry.type === \"blob\")\n    .sort((left, right) => left.path.localeCompare(right.path));\n  if (files.length === 0) {\n    throw new HTTPException(422, { message: \"The selected Skill folder is empty\" });\n  }\n  return files;\n}\n\nfunction relativeSkillPath(path: string, root: string): string {\n  return root === \".\" ? path : path.slice(root.length + 1);\n}\n\nfunction normalizeGitHubPath(segments: readonly string[]): string {\n  if (\n    segments.length === 0 ||\n    segments.some(\n      (segment) =>\n        segment.length === 0 ||\n        segment === \".\" ||\n        segment === \"..\" ||\n        segment.includes(\"\\\\\") ||\n        /[\\u0000-\\u001f\\u007f]/u.test(segment),\n    )\n  ) {\n    throw new HTTPException(422, { message: \"The GitHub Skill path is invalid\" });\n  }\n  return segments.join(\"/\");\n}\n\nfunction encodeGitHubPath(path: string): string {\n  return path\n    .split(\"/\")\n    .map((segment) => encodeURIComponent(segment))\n    .join(\"/\");\n}\n\nfunction stripGitSuffix(value: string): string {\n  return value.replace(/\\.git$/iu, \"\");\n}\n\nfunction assertGitHubRepository(owner: string, repository: string): void {\n  if (!githubSegment.test(owner) || !githubSegment.test(stripGitSuffix(repository))) {\n    throw new HTTPException(422, { message: \"The GitHub owner or repository name is invalid\" });\n  }\n}\n\nasync function mapConcurrent<Input, Output>(\n  values: readonly Input[],\n  concurrency: number,\n  map: (value: Input) => Promise<Output>,\n): Promise<Output[]> {\n  const output = new Array<Output>(values.length);\n  let next = 0;\n  await Promise.all(\n    Array.from({ length: Math.min(concurrency, values.length) }, async () => {\n      for (;;) {\n        const index = next;\n        next += 1;\n        if (index >= values.length) return;\n        output[index] = await map(values[index]!);\n      }\n    }),\n  );\n  return output;\n}\n\nfunction sha256Hex(bytes: Uint8Array): string {\n  return createHash(\"sha256\").update(bytes).digest(\"hex\");\n}\n","import { environmentsEncryptionKeyBytes, type Settings } from \"@opengeni/config\";\nimport type { AccessGrant, VariableSet } from \"@opengeni/contracts\";\nimport { getVariableSet, recordAuditEvent, type Database } from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\nimport { requirePermission } from \"../access\";\n\nexport const MAX_ENVIRONMENTS_PER_WORKSPACE = 25;\nexport const MAX_VARIABLES_PER_ENVIRONMENT = 100;\n\n// Names the platform itself injects into sandboxes (sandboxEnvironmentForRun,\n// collectGitIdentityEnvironment) plus loader/startup-injection vectors. These\n// can never be set as variable set variables, so the run-scoped\n// git auth block and git identity always win without silent collisions.\nconst reservedExactNames = new Set([\n  \"HOME\",\n  \"PATH\",\n  \"SHELL\",\n  \"USER\",\n  \"LOGNAME\",\n  \"TMPDIR\",\n  \"IFS\",\n  \"ENV\",\n  \"BASH_ENV\",\n  \"NODE_OPTIONS\",\n  \"PYTHONPATH\",\n  \"PYTHONSTARTUP\",\n  \"PERL5OPT\",\n  \"PERL5LIB\",\n  \"GH_TOKEN\",\n  \"GITHUB_TOKEN\",\n  \"GITLAB_TOKEN\",\n  \"AZURE_DEVOPS_EXT_PAT\",\n  \"GIT_ASKPASS\",\n  \"GIT_TERMINAL_PROMPT\",\n]);\n\nconst reservedPrefixes = [\n  \"OPENGENI_\",\n  \"GIT_CONFIG_\",\n  \"GIT_AUTHOR_\",\n  \"GIT_COMMITTER_\",\n  \"LD_\",\n  \"DYLD_\",\n];\n\nexport function assertAllowedVariableSetVariableName(name: string): void {\n  if (reservedExactNames.has(name) || reservedPrefixes.some((prefix) => name.startsWith(prefix))) {\n    throw new HTTPException(422, {\n      message: `reserved variable set variable name / reserved environment variable name: ${name}`,\n    });\n  }\n}\n\n/** @deprecated use assertAllowedVariableSetVariableName */\nexport const assertAllowedEnvironmentVariableName = assertAllowedVariableSetVariableName;\n\nexport function requireVariableSetEncryption(settings: Settings): Uint8Array {\n  const key = environmentsEncryptionKeyBytes(settings);\n  if (!key) {\n    throw new HTTPException(503, {\n      message: \"variable sets require OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY\",\n    });\n  }\n  return key;\n}\n\n/** @deprecated use requireVariableSetEncryption */\nexport const requireEnvironmentEncryption = requireVariableSetEncryption;\n\nexport async function requireVariableSetForApi(\n  db: Database,\n  workspaceId: string,\n  variableSetId: string,\n): Promise<VariableSet> {\n  const variableSet = await getVariableSet(db, workspaceId, variableSetId);\n  if (!variableSet) {\n    throw new HTTPException(404, { message: \"variableSet not found\" });\n  }\n  return variableSet;\n}\n\n/**\n * Validates an variableSet attachment supplied in a request payload (session\n * create, scheduled task create/update, pack enable). Requires the\n * `variable-sets:use` permission unless the attachment was already authorized\n * (pack-installation-inherited attachments), and maps a missing or\n * cross-variable set to 422 because the id is payload, not the route\n * target. RLS plus the workspace_id clause make cross-workspace ids\n * indistinguishable from missing ones.\n */\nexport async function validateVariableSetAttachment(\n  deps: { settings: Settings; db: Database },\n  grant: AccessGrant,\n  workspaceId: string,\n  variableSetId: string,\n  options: { preauthorized?: boolean } = {},\n): Promise<VariableSet> {\n  requireVariableSetEncryption(deps.settings);\n  if (!options.preauthorized) {\n    requirePermission(grant, \"variable-sets:use\");\n  }\n  const variableSet = await getVariableSet(deps.db, workspaceId, variableSetId);\n  if (!variableSet) {\n    throw new HTTPException(422, { message: \"unknown variableSetId\" });\n  }\n  return variableSet;\n}\n\nexport async function recordVariableSetAuditEvent(\n  db: Database,\n  input: {\n    grant: AccessGrant;\n    action:\n      | \"variable_set.created\"\n      | \"variable_set.updated\"\n      | \"variable_set.deleted\"\n      | \"variable_set.variable.set\"\n      | \"variable_set.variable.deleted\";\n    variableSetId: string;\n    variableName?: string;\n  },\n): Promise<void> {\n  await recordAuditEvent(db, {\n    accountId: input.grant.accountId,\n    workspaceId: input.grant.workspaceId,\n    subjectId: input.grant.subjectId,\n    action: input.action,\n    targetType: \"workspace_variable_set\",\n    targetId: input.variableSetId,\n    metadata: {\n      variableSetId: input.variableSetId,\n      ...(input.variableName ? { name: input.variableName } : {}),\n    },\n  });\n}\n","// packages/core/src/rigs/index.ts — the rig domain: the workspace-scoped,\n// versioned sandbox-machine-definition business logic the REST routes (M2) and\n// (later) the MCP rig tools (M4) both call. Validation + audit events live here;\n// the raw RLS-scoped persistence lives in @opengeni/db. M4 adds verification /\n// auto-merge / promotion on top of the change substrate created here.\n\nimport type {\n  AccessGrant,\n  CreateRigRequest,\n  RigDefinitionEditPayload,\n  ProposeRigChangeRequest,\n  Rig,\n  RigChange,\n  RigVersion,\n  UpdateRigRequest,\n} from \"@opengeni/contracts\";\nimport {\n  activateRigVersion,\n  countRigs,\n  createRig,\n  createRigChange,\n  createRigVersion,\n  createRigVersionForChangePromotion,\n  deleteRigIfNoActiveSessions,\n  getRig,\n  getRigByName,\n  getRigChange,\n  getRigVersion,\n  getVariableSet,\n  listRigChanges,\n  listRigVersions,\n  recordAuditEvent,\n  RigActiveVersionChangedError,\n  RigChangeTransitionError,\n  updateRig,\n  type Database,\n} from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\nimport { rigProviderImagesFromVerification } from \"./provider-images\";\n\nexport * from \"./provider-images\";\n\nexport const MAX_RIGS_PER_WORKSPACE = 50;\nexport const MAX_CHECKS_PER_RIG = 100;\nexport const MAX_CREDENTIAL_HOOKS_PER_RIG = 50;\nexport const MAX_DEFAULT_VARIABLE_SETS_PER_RIG = 25;\n\nexport type RigServices = {\n  db: Database;\n};\n\ntype RigAuditAction =\n  | \"rig.created\"\n  | \"rig.updated\"\n  | \"rig.deleted\"\n  | \"rig.change.proposed\"\n  | \"rig.change.verified\"\n  | \"rig.change.rejected\"\n  | \"rig.change.failed\"\n  | \"rig.change.merged\"\n  | \"rig.verification.started\"\n  | \"rig.verification.passed\"\n  | \"rig.verification.failed\"\n  | \"rig.version.activated\"\n  | \"rig.version.promoted\";\n\nexport async function recordRigAuditEvent(\n  db: Database,\n  input: {\n    grant: AccessGrant;\n    action: RigAuditAction;\n    rigId: string;\n    metadata?: Record<string, unknown>;\n  },\n): Promise<void> {\n  await recordAuditEvent(db, {\n    accountId: input.grant.accountId,\n    workspaceId: input.grant.workspaceId,\n    subjectId: input.grant.subjectId,\n    action: input.action,\n    targetType: \"rig\",\n    targetId: input.rigId,\n    metadata: { rigId: input.rigId, ...(input.metadata ?? {}) },\n  });\n}\n\n// Version attribution string for an API (user-authenticated) mutation. The MCP\n// session path (M4) will use `session:<id>` instead.\nexport function rigActorForGrant(grant: AccessGrant): string {\n  return `user:${grant.subjectId}`;\n}\n\nexport async function requireRigForApi(\n  db: Database,\n  workspaceId: string,\n  rigId: string,\n): Promise<Rig> {\n  const rig = await getRig(db, workspaceId, rigId);\n  if (!rig) {\n    throw new HTTPException(404, { message: \"rig not found\" });\n  }\n  return rig;\n}\n\nexport async function requireRigChangeForApi(\n  db: Database,\n  workspaceId: string,\n  rigId: string,\n  changeId: string,\n): Promise<RigChange> {\n  const change = await getRigChange(db, workspaceId, changeId);\n  // RLS + the workspace clause make a cross-workspace id indistinguishable from\n  // missing; the rigId clause keeps the change addressable only under its rig.\n  if (!change || change.rigId !== rigId) {\n    throw new HTTPException(404, { message: \"rig change not found\" });\n  }\n  return change;\n}\n\nfunction trimmedRigName(name: string): string {\n  const trimmed = name.trim();\n  if (!trimmed) {\n    throw new HTTPException(422, { message: \"rig name is required\" });\n  }\n  return trimmed;\n}\n\n// Duplicate check names would make check results ambiguous; reject them.\nfunction assertUniqueCheckNames(checks: ReadonlyArray<{ name: string }> | undefined): void {\n  if (!checks) {\n    return;\n  }\n  const seen = new Set<string>();\n  for (const check of checks) {\n    if (seen.has(check.name)) {\n      throw new HTTPException(422, { message: `duplicate rig check name: ${check.name}` });\n    }\n    seen.add(check.name);\n  }\n}\n\n// Every referenced default variable set must exist in the workspace. RLS makes a\n// cross-workspace id indistinguishable from a missing one, so both map to 422.\nasync function assertVariableSetsExist(\n  db: Database,\n  workspaceId: string,\n  ids: ReadonlyArray<string> | undefined,\n): Promise<void> {\n  if (!ids || ids.length === 0) {\n    return;\n  }\n  const unique = [...new Set(ids)];\n  for (const id of unique) {\n    const variableSet = await getVariableSet(db, workspaceId, id);\n    if (!variableSet) {\n      throw new HTTPException(422, { message: `unknown defaultVariableSetId: ${id}` });\n    }\n  }\n}\n\nexport async function createRigForApi(\n  deps: RigServices,\n  grant: AccessGrant,\n  payload: CreateRigRequest,\n): Promise<Rig> {\n  const workspaceId = grant.workspaceId;\n  const name = trimmedRigName(payload.name);\n  assertUniqueCheckNames(payload.checks);\n  await assertVariableSetsExist(deps.db, workspaceId, payload.defaultVariableSetIds);\n  if ((await countRigs(deps.db, workspaceId)) >= MAX_RIGS_PER_WORKSPACE) {\n    throw new HTTPException(422, {\n      message: `a workspace supports at most ${MAX_RIGS_PER_WORKSPACE} rigs`,\n    });\n  }\n  if (await getRigByName(deps.db, workspaceId, name)) {\n    throw new HTTPException(409, { message: `rig name is already in use: ${name}` });\n  }\n  const createdBy = rigActorForGrant(grant);\n  const rig = await createRig(deps.db, {\n    accountId: grant.accountId,\n    workspaceId,\n    name,\n    description: payload.description ?? null,\n    createdBy,\n    initialVersion: {\n      image: payload.image ?? null,\n      setupScript: payload.setupScript ?? null,\n      checks: payload.checks,\n      credentialHooks: payload.credentialHooks,\n      defaultVariableSetIds: payload.defaultVariableSetIds,\n      changelog: \"Initial version\",\n      createdBy,\n    },\n  });\n  await recordRigAuditEvent(deps.db, { grant, action: \"rig.created\", rigId: rig.id });\n  return rig;\n}\n\nexport async function updateRigForApi(\n  deps: RigServices,\n  grant: AccessGrant,\n  rig: Rig,\n  payload: UpdateRigRequest,\n): Promise<Rig> {\n  const workspaceId = grant.workspaceId;\n  const name = payload.name !== undefined ? trimmedRigName(payload.name) : undefined;\n  if (name !== undefined && name !== rig.name) {\n    const existing = await getRigByName(deps.db, workspaceId, name);\n    if (existing && existing.id !== rig.id) {\n      throw new HTTPException(409, { message: `rig name is already in use: ${name}` });\n    }\n  }\n  const updated = await updateRig(deps.db, workspaceId, rig.id, {\n    ...(name !== undefined ? { name } : {}),\n    ...(payload.description !== undefined ? { description: payload.description } : {}),\n  });\n  await recordRigAuditEvent(deps.db, { grant, action: \"rig.updated\", rigId: rig.id });\n  return updated;\n}\n\nexport async function deleteRigForApi(\n  deps: RigServices,\n  grant: AccessGrant,\n  rig: Rig,\n): Promise<void> {\n  const workspaceId = grant.workspaceId;\n  const deleted = await deleteRigIfNoActiveSessions(deps.db, workspaceId, rig.id);\n  if (deleted.activeSessionCount > 0) {\n    throw new HTTPException(409, {\n      message: `rig is referenced by ${deleted.activeSessionCount} active session(s); it cannot be deleted`,\n    });\n  }\n  if (!deleted.deleted) {\n    throw new HTTPException(404, { message: \"rig not found\" });\n  }\n  await recordRigAuditEvent(deps.db, { grant, action: \"rig.deleted\", rigId: rig.id });\n}\n\n// Records a proposed change against the rig's CURRENT active version (the base\n// clean-replay minted new versions from). Verification / auto-merge is M4; here\n// the row is created in `proposed`. `proposedBy` overrides the actor string for\n// the session-scoped MCP path (M4).\nexport async function proposeRigChangeForApi(\n  deps: RigServices,\n  grant: AccessGrant,\n  rig: Rig,\n  request: ProposeRigChangeRequest,\n  options: { proposedBy?: string } = {},\n): Promise<RigChange> {\n  const workspaceId = grant.workspaceId;\n  if (!rig.activeVersion) {\n    throw new HTTPException(422, { message: \"rig has no active version to base a change on\" });\n  }\n  if (request.kind === \"definition_edit\") {\n    assertUniqueCheckNames(request.payload.checks);\n    await assertVariableSetsExist(\n      deps.db,\n      workspaceId,\n      request.payload.defaultVariableSetIds ?? undefined,\n    );\n  }\n  const change = await createRigChange(deps.db, {\n    accountId: grant.accountId,\n    workspaceId,\n    rigId: rig.id,\n    baseVersionId: rig.activeVersion.id,\n    kind: request.kind,\n    payload: request.payload as Record<string, unknown>,\n    proposedBy: options.proposedBy ?? rigActorForGrant(grant),\n  });\n  await recordRigAuditEvent(deps.db, {\n    grant,\n    action: \"rig.change.proposed\",\n    rigId: rig.id,\n    metadata: { changeId: change.id, kind: change.kind },\n  });\n  return change;\n}\n\nexport type RigVerificationClassification =\n  | { status: \"merged\"; action: \"auto_promote\" }\n  | { status: \"proposed\"; action: \"await_manage_promote\" }\n  | { status: \"rejected\"; action: \"reject\" }\n  | { status: \"failed\"; action: \"retryable_failure\" };\n\nexport function classifyRigVerificationOutcome(input: {\n  kind: \"setup_append\" | \"definition_edit\";\n  passed: boolean;\n  infraError?: boolean;\n}): RigVerificationClassification {\n  if (input.infraError) {\n    return { status: \"failed\", action: \"retryable_failure\" };\n  }\n  if (!input.passed) {\n    return { status: \"rejected\", action: \"reject\" };\n  }\n  if (input.kind === \"setup_append\") {\n    return { status: \"merged\", action: \"auto_promote\" };\n  }\n  return { status: \"proposed\", action: \"await_manage_promote\" };\n}\n\nexport function appendRigSetupCommand(\n  baseSetupScript: string | null | undefined,\n  command: string,\n): string {\n  const base = (baseSetupScript ?? \"\").trimEnd();\n  return base ? `${base}\\n${command}` : command;\n}\n\nasync function promoteChangeWithActiveCas(\n  deps: RigServices,\n  workspaceId: string,\n  rigId: string,\n  changeId: string,\n  input: Parameters<typeof createRigVersionForChangePromotion>[4],\n): Promise<{ version: RigVersion; change: RigChange }> {\n  try {\n    return await createRigVersionForChangePromotion(deps.db, workspaceId, rigId, changeId, input);\n  } catch (error) {\n    if (error instanceof RigActiveVersionChangedError) {\n      throw new HTTPException(409, {\n        message: `rig moved since this change was verified (base ${error.expectedVersionId}, now ${error.actualVersionId ?? \"none\"}); re-verify before promoting`,\n      });\n    }\n    if (error instanceof RigChangeTransitionError) {\n      throw new HTTPException(409, { message: error.message });\n    }\n    throw error;\n  }\n}\n\nexport async function promoteSetupAppendChange(\n  deps: RigServices,\n  grant: AccessGrant,\n  rig: Rig,\n  change: RigChange,\n): Promise<{ change: RigChange; version: RigVersion }> {\n  if (change.kind !== \"setup_append\") {\n    throw new HTTPException(422, {\n      message: \"only setup_append changes auto-promote through this path\",\n    });\n  }\n  if (change.status !== \"proposed\" && change.status !== \"verifying\") {\n    throw new HTTPException(409, { message: `rig change is ${change.status}; cannot promote` });\n  }\n  if (!change.baseVersionId) {\n    throw new HTTPException(422, { message: \"rig change has no base version\" });\n  }\n  const base = await getRigVersion(deps.db, grant.workspaceId, rig.id, change.baseVersionId);\n  if (!base) {\n    throw new HTTPException(404, { message: \"base rig version not found\" });\n  }\n  const payload = change.payload as { command?: unknown; note?: unknown };\n  if (typeof payload.command !== \"string\" || !payload.command.trim()) {\n    throw new HTTPException(422, { message: \"setup_append change is missing command\" });\n  }\n  const nextDefinition = {\n    image: base.image,\n    setupScript: appendRigSetupCommand(base.setupScript, payload.command),\n    checks: base.checks,\n    credentialHooks: base.credentialHooks,\n    defaultVariableSetIds: base.defaultVariableSetIds,\n  };\n  const { version, change: updated } = await promoteChangeWithActiveCas(\n    deps,\n    grant.workspaceId,\n    rig.id,\n    change.id,\n    {\n      expectedActiveVersionId: change.baseVersionId,\n      ...nextDefinition,\n      changelog:\n        typeof payload.note === \"string\" && payload.note.trim()\n          ? payload.note\n          : \"Verified setup append\",\n      createdBy: change.proposedBy ?? rigActorForGrant(grant),\n      providerImages: rigProviderImagesFromVerification(change.verification, nextDefinition),\n    },\n  );\n  await recordRigAuditEvent(deps.db, {\n    grant,\n    action: \"rig.change.merged\",\n    rigId: rig.id,\n    metadata: { changeId: change.id, versionId: version.id, version: version.version },\n  });\n  await recordRigAuditEvent(deps.db, {\n    grant,\n    action: \"rig.version.promoted\",\n    rigId: rig.id,\n    metadata: { changeId: change.id, versionId: version.id, version: version.version },\n  });\n  return { change: updated, version };\n}\n\nexport async function promoteVerifiedDefinitionEditChangeForApi(\n  deps: RigServices,\n  grant: AccessGrant,\n  rig: Rig,\n  change: RigChange,\n): Promise<{ change: RigChange; version: RigVersion }> {\n  if (change.kind !== \"definition_edit\") {\n    throw new HTTPException(422, { message: \"only definition_edit changes use explicit promote\" });\n  }\n  if (change.status !== \"proposed\") {\n    throw new HTTPException(409, { message: `rig change is ${change.status}; cannot promote` });\n  }\n  if (change.verification?.passed !== true) {\n    throw new HTTPException(422, {\n      message: \"definition_edit change must pass verification before promote\",\n    });\n  }\n  if (!change.baseVersionId) {\n    throw new HTTPException(422, { message: \"rig change has no base version\" });\n  }\n  const base = await getRigVersion(deps.db, grant.workspaceId, rig.id, change.baseVersionId);\n  if (!base) {\n    throw new HTTPException(404, { message: \"base rig version not found\" });\n  }\n  const payload = change.payload as {\n    image?: unknown;\n    setupScript?: unknown;\n    checks?: unknown;\n    credentialHooks?: unknown;\n    defaultVariableSetIds?: unknown;\n    changelog?: unknown;\n  };\n  const nextDefinition = {\n    image: payload.image === undefined ? base.image : (payload.image as string | null),\n    setupScript:\n      payload.setupScript === undefined ? base.setupScript : (payload.setupScript as string | null),\n    checks: Array.isArray(payload.checks) ? (payload.checks as RigVersion[\"checks\"]) : base.checks,\n    credentialHooks: Array.isArray(payload.credentialHooks)\n      ? (payload.credentialHooks as string[])\n      : base.credentialHooks,\n    defaultVariableSetIds: Array.isArray(payload.defaultVariableSetIds)\n      ? (payload.defaultVariableSetIds as string[])\n      : base.defaultVariableSetIds,\n  };\n  const { version, change: updated } = await promoteChangeWithActiveCas(\n    deps,\n    grant.workspaceId,\n    rig.id,\n    change.id,\n    {\n      expectedActiveVersionId: change.baseVersionId,\n      ...nextDefinition,\n      changelog:\n        typeof payload.changelog === \"string\" && payload.changelog.trim()\n          ? payload.changelog\n          : \"Verified definition edit\",\n      createdBy: rigActorForGrant(grant),\n      providerImages: rigProviderImagesFromVerification(change.verification, nextDefinition),\n    },\n  );\n  await recordRigAuditEvent(deps.db, {\n    grant,\n    action: \"rig.change.merged\",\n    rigId: rig.id,\n    metadata: { changeId: change.id, versionId: version.id, version: version.version },\n  });\n  await recordRigAuditEvent(deps.db, {\n    grant,\n    action: \"rig.version.promoted\",\n    rigId: rig.id,\n    metadata: { changeId: change.id, versionId: version.id, version: version.version },\n  });\n  return { change: updated, version };\n}\n\nexport async function createRigVersionForApi(\n  deps: RigServices,\n  grant: AccessGrant,\n  rig: Rig,\n  payload: RigDefinitionEditPayload,\n): Promise<RigVersion> {\n  if (!rig.activeVersion) {\n    throw new HTTPException(422, { message: \"rig has no active version\" });\n  }\n  assertUniqueCheckNames(payload.checks);\n  await assertVariableSetsExist(\n    deps.db,\n    grant.workspaceId,\n    payload.defaultVariableSetIds ?? undefined,\n  );\n  const base = rig.activeVersion;\n  const version = await createRigVersion(\n    deps.db,\n    grant.workspaceId,\n    rig.id,\n    {\n      image: payload.image === undefined ? base.image : payload.image,\n      setupScript: payload.setupScript === undefined ? base.setupScript : payload.setupScript,\n      checks: payload.checks ?? base.checks,\n      credentialHooks: payload.credentialHooks ?? base.credentialHooks,\n      defaultVariableSetIds: payload.defaultVariableSetIds ?? base.defaultVariableSetIds,\n      changelog: payload.changelog ?? \"Manager-created version\",\n      createdBy: rigActorForGrant(grant),\n    },\n    { activate: true },\n  );\n  await recordRigAuditEvent(deps.db, {\n    grant,\n    action: \"rig.version.promoted\",\n    rigId: rig.id,\n    metadata: { versionId: version.id, version: version.version, direct: true },\n  });\n  return version;\n}\n\n// Rollback / promote-activate: flips which existing version is active. Mints no\n// new version and never touches content.\nexport async function activateRigVersionForApi(\n  deps: RigServices,\n  grant: AccessGrant,\n  rig: Rig,\n  versionId: string,\n): Promise<RigVersion> {\n  const workspaceId = grant.workspaceId;\n  const version = await activateRigVersion(deps.db, workspaceId, rig.id, versionId);\n  await recordRigAuditEvent(deps.db, {\n    grant,\n    action: \"rig.version.activated\",\n    rigId: rig.id,\n    metadata: { versionId: version.id, version: version.version },\n  });\n  return version;\n}\n\n// Read pass-throughs (route-facing; keep the route thin and the imports in one\n// place). Versions/changes are always addressed under their rig.\nexport async function listRigVersionsForApi(\n  deps: RigServices,\n  workspaceId: string,\n  rigId: string,\n): Promise<RigVersion[]> {\n  return await listRigVersions(deps.db, workspaceId, rigId);\n}\n\nexport async function listRigChangesForApi(\n  deps: RigServices,\n  workspaceId: string,\n  rigId: string,\n  limit?: number,\n): Promise<RigChange[]> {\n  return await listRigChanges(deps.db, workspaceId, rigId, limit);\n}\n","import { createHash } from \"node:crypto\";\nimport {\n  RigProviderImage as RigProviderImageContract,\n  stableJson,\n  type RigChangeVerification,\n  type RigProviderImage,\n  type RigProviderImages,\n  type RigVersion,\n  type SandboxBackend,\n} from \"@opengeni/contracts\";\n\nexport type RigProviderImageDefinition = Pick<\n  RigVersion,\n  \"image\" | \"setupScript\" | \"checks\" | \"credentialHooks\" | \"defaultVariableSetIds\"\n>;\n\nfunction sha256(value: string): string {\n  return `sha256:${createHash(\"sha256\").update(value, \"utf8\").digest(\"hex\")}`;\n}\n\nexport function rigProviderImageProviderBindingKeyHash(bindingKey: string): string {\n  return sha256(bindingKey);\n}\n\nexport function rigProviderImageSetupHash(\n  definition: Pick<RigProviderImageDefinition, \"setupScript\">,\n): string {\n  return sha256(definition.setupScript ?? \"\");\n}\n\n/**\n * Hash every exact rig-definition input that can affect whether a provider\n * image may be reused. Credential values and variable-set contents are\n * intentionally absent: verification never injects them into the build box.\n * Their declared hook/set identities still participate so a new rig version\n * cannot silently inherit an older build record.\n */\nexport function rigProviderImageContentHash(input: {\n  backend: SandboxBackend;\n  sourceImage: string | null;\n  definition: RigProviderImageDefinition;\n}): string {\n  return sha256(\n    stableJson({\n      version: 1,\n      backend: input.backend,\n      sourceImage: input.sourceImage,\n      image: input.definition.image,\n      setupScript: input.definition.setupScript,\n      checks: input.definition.checks,\n      credentialHooks: input.definition.credentialHooks,\n      defaultVariableSetIds: input.definition.defaultVariableSetIds,\n    }),\n  );\n}\n\n/** Modal's patched snapshot API accepts a caller-owned UUID idempotency key.\n * v2 denotes images proven by a separate cold boot before publication. */\nexport function rigProviderImageBuildRequestId(input: {\n  targetId: string;\n  backend: SandboxBackend;\n  contentHash: string;\n}): string {\n  const bytes = createHash(\"sha256\")\n    .update(\"opengeni-rig-provider-image-build-v2\\0\", \"utf8\")\n    .update(input.targetId, \"utf8\")\n    .update(\"\\0\", \"utf8\")\n    .update(input.backend, \"utf8\")\n    .update(\"\\0\", \"utf8\")\n    .update(input.contentHash, \"utf8\")\n    .digest()\n    .subarray(0, 16);\n  // RFC 4122 variant + deterministic version-5-shaped UUID. The digest, not a\n  // provider response, is the idempotency identity.\n  bytes[6] = (bytes[6]! & 0x0f) | 0x50;\n  bytes[8] = (bytes[8]! & 0x3f) | 0x80;\n  const hex = bytes.toString(\"hex\");\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\nexport function rigProviderImageMatchesDefinition(\n  image: RigProviderImage,\n  definition: RigProviderImageDefinition,\n): boolean {\n  return (\n    image.setupHash === rigProviderImageSetupHash(definition) &&\n    image.contentHash ===\n      rigProviderImageContentHash({\n        backend: image.backend,\n        sourceImage: image.sourceImage,\n        definition,\n      })\n  );\n}\n\n/**\n * Promotion copies only a finalized, structurally valid build record whose\n * hashes match the exact version definition being inserted. A malformed or\n * stale optimization record is discarded; the version remains correct and\n * falls back to runtime setup.\n */\nexport function rigProviderImagesFromVerification(\n  verification: RigChangeVerification | null,\n  definition: RigProviderImageDefinition,\n): RigProviderImages {\n  const parsed = RigProviderImageContract.safeParse(verification?.providerImage);\n  if (!parsed.success || parsed.data.status === \"building\") return {};\n  if (!rigProviderImageMatchesDefinition(parsed.data, definition)) return {};\n  return { [parsed.data.backend]: parsed.data };\n}\n","import type { McpServerConfig, Settings } from \"@opengeni/config\";\nimport type {\n  AccessGrant,\n  ConnectionMetadata,\n  McpPersonalConnectionDelegation,\n  SessionTurn,\n  SocialConnection,\n  ToolRef,\n} from \"@opengeni/contracts\";\nimport {\n  getSessionTurnPersonalConnectionDelegations,\n  getConnectionMetadata,\n  getSocialConnection,\n  getWorkspaceGrant,\n  listConnectionsMetadata,\n  listSocialConnections,\n  type Database,\n  type ResolveConnectionCredentialInput,\n  type ResolveConnectionCredentialResult,\n} from \"@opengeni/db\";\n\nexport type PersonalConnectionDelegationSource =\n  | { kind: \"subject\"; subjectId: string }\n  | { kind: \"turn\"; sessionId: string; turnId: string }\n  | { kind: \"none\" };\nexport type AuthorizedSocialConnection = { connection: SocialConnection; subjectId: string | null };\nexport type AuthorizedAtlassianConnection = {\n  connection: ConnectionMetadata;\n  subjectId: string | null;\n};\n\nexport function directPersonalConnectionSubjectId(\n  turn: Pick<SessionTurn, \"source\" | \"initiator\" | \"initiatorContext\">,\n): string | undefined {\n  if ((turn.source !== \"user\" && turn.source !== \"api\") || turn.initiator.kind !== \"subject\") {\n    return undefined;\n  }\n  return [\"via\", \"viaTruncated\", \"provenanceError\", \"backfill\"].some((key) =>\n    Object.prototype.hasOwnProperty.call(turn.initiatorContext, key),\n  )\n    ? undefined\n    : turn.initiator.subjectId;\n}\n\nexport function personalConnectionDelegationSourceForGrant(\n  grant: AccessGrant,\n): PersonalConnectionDelegationSource {\n  const callerSessionId = grant.metadata?.[\"sessionId\"];\n  const callerTurnId = grant.metadata?.[\"turnId\"];\n  if (typeof callerSessionId === \"string\" && typeof callerTurnId === \"string\") {\n    return { kind: \"turn\", sessionId: callerSessionId, turnId: callerTurnId };\n  }\n  if (\n    grant.principalKind === \"agent_attempt\" ||\n    grant.principalKind === \"service\" ||\n    grant.serviceInitiator\n  ) {\n    return { kind: \"none\" };\n  }\n  return { kind: \"subject\", subjectId: grant.subjectId };\n}\n\nexport async function authorizedSocialConnectionsForGrant(input: {\n  db: Database;\n  grant: AccessGrant;\n  limit?: number;\n}): Promise<AuthorizedSocialConnection[]> {\n  const workspace = await listSocialConnections(\n    input.db,\n    input.grant.workspaceId,\n    input.limit ?? 500,\n    null,\n  );\n  const source = personalConnectionDelegationSourceForGrant(input.grant);\n  if (source.kind === \"none\")\n    return workspace.map((connection) => ({ connection, subjectId: null }));\n  if (source.kind === \"subject\") {\n    const visible = await listSocialConnections(\n      input.db,\n      input.grant.workspaceId,\n      input.limit ?? 500,\n      source.subjectId,\n    );\n    return visible.map((connection) => ({\n      connection,\n      subjectId: connection.ownership === \"personal\" ? source.subjectId : null,\n    }));\n  }\n  const delegations = (\n    await getSessionTurnPersonalConnectionDelegations(\n      input.db,\n      input.grant.workspaceId,\n      source.sessionId,\n      source.turnId,\n    )\n  ).filter((item) => item.connectionType === \"social\");\n  const personal: AuthorizedSocialConnection[] = [];\n  for (const delegation of delegations) {\n    if (!(await getWorkspaceGrant(input.db, delegation.ownerSubjectId, input.grant.workspaceId)))\n      continue;\n    const connection = await getSocialConnection(\n      input.db,\n      input.grant.workspaceId,\n      delegation.connectionId,\n      delegation.ownerSubjectId,\n    );\n    if (!connection || connection.ownership !== \"personal\") continue;\n    const domain = connection.provider === \"x\" ? \"x.com\" : `${connection.provider}.com`;\n    if (!sameProviderDomain(domain, delegation.providerDomain)) continue;\n    personal.push({ connection, subjectId: delegation.ownerSubjectId });\n  }\n  return [...workspace.map((connection) => ({ connection, subjectId: null })), ...personal];\n}\n\nexport async function authorizedAtlassianConnectionsForGrant(input: {\n  db: Database;\n  grant: AccessGrant;\n}): Promise<AuthorizedAtlassianConnection[]> {\n  const workspace = (await listConnectionsMetadata(input.db, input.grant.workspaceId, null)).filter(\n    (connection) =>\n      connection.subjectId === null &&\n      connection.status === \"active\" &&\n      sameProviderDomain(connection.providerDomain, \"api.atlassian.com\"),\n  );\n  const source = personalConnectionDelegationSourceForGrant(input.grant);\n  if (source.kind === \"none\") {\n    return workspace.map((connection) => ({ connection, subjectId: null }));\n  }\n  if (source.kind === \"subject\") {\n    const visible = await listConnectionsMetadata(\n      input.db,\n      input.grant.workspaceId,\n      source.subjectId,\n    );\n    return visible\n      .filter(\n        (connection) =>\n          connection.status === \"active\" &&\n          sameProviderDomain(connection.providerDomain, \"api.atlassian.com\"),\n      )\n      .map((connection) => ({\n        connection,\n        subjectId: connection.subjectId === null ? null : source.subjectId,\n      }));\n  }\n  const delegations = (\n    await getSessionTurnPersonalConnectionDelegations(\n      input.db,\n      input.grant.workspaceId,\n      source.sessionId,\n      source.turnId,\n    )\n  ).filter((item) => item.connectionType === \"atlassian\");\n  const personal: AuthorizedAtlassianConnection[] = [];\n  for (const delegation of delegations) {\n    if (!(await getWorkspaceGrant(input.db, delegation.ownerSubjectId, input.grant.workspaceId))) {\n      continue;\n    }\n    const connection = await getConnectionMetadata(\n      input.db,\n      input.grant.workspaceId,\n      delegation.connectionId,\n      delegation.ownerSubjectId,\n    );\n    if (\n      !connection ||\n      connection.subjectId !== delegation.ownerSubjectId ||\n      connection.status !== \"active\" ||\n      !sameProviderDomain(connection.providerDomain, delegation.providerDomain) ||\n      !sameProviderDomain(connection.providerDomain, \"api.atlassian.com\")\n    ) {\n      continue;\n    }\n    personal.push({ connection, subjectId: delegation.ownerSubjectId });\n  }\n  return [...workspace.map((connection) => ({ connection, subjectId: null })), ...personal];\n}\n\nexport function selectedPersonalConnectionServers(\n  settings: Pick<Settings, \"mcpServers\">,\n  tools: ToolRef[],\n): McpServerConfig[] {\n  const selected = new Set(tools.map((tool) => tool.id));\n  return settings.mcpServers.filter(\n    (server) => selected.has(server.id) && server.connectionRef?.subjectScope === \"subject\",\n  );\n}\n\nfunction canonicalPersonalConnections(connections: ConnectionMetadata[]): ConnectionMetadata[] {\n  return [...connections].sort((left, right) => {\n    const active = Number(right.status === \"active\") - Number(left.status === \"active\");\n    if (active !== 0) return active;\n    const updated = Date.parse(right.updatedAt) - Date.parse(left.updatedAt);\n    if (updated !== 0) return updated;\n    const created = Date.parse(right.createdAt) - Date.parse(left.createdAt);\n    if (created !== 0) return created;\n    return right.id.localeCompare(left.id);\n  });\n}\n\nfunction sameProviderDomain(left: string, right: string): boolean {\n  return left.toLowerCase() === right.toLowerCase();\n}\n\nexport function personalConnectionDelegationsFromVisibleConnections(input: {\n  servers: McpServerConfig[];\n  subjectId: string;\n  connections: ConnectionMetadata[];\n}): McpPersonalConnectionDelegation[] {\n  const delegations: McpPersonalConnectionDelegation[] = [];\n  const connections = canonicalPersonalConnections(input.connections);\n  for (const server of input.servers) {\n    const ref = server.connectionRef;\n    if (!ref || ref.subjectScope !== \"subject\") continue;\n    const connection = connections.find(\n      (candidate) =>\n        candidate.subjectId === input.subjectId &&\n        candidate.status === \"active\" &&\n        sameProviderDomain(candidate.providerDomain, ref.providerDomain) &&\n        (!ref.kind || candidate.kind === ref.kind) &&\n        (!ref.connectionId || candidate.id === ref.connectionId),\n    );\n    if (!connection) continue;\n    delegations.push({\n      serverId: server.id,\n      connectionId: connection.id,\n      ownerSubjectId: input.subjectId,\n      providerDomain: connection.providerDomain,\n      kind: connection.kind,\n    });\n  }\n  return delegations;\n}\n\nexport function personalConnectionDelegationsFromParent(input: {\n  servers: McpServerConfig[];\n  parentDelegations: McpPersonalConnectionDelegation[];\n}): McpPersonalConnectionDelegation[] {\n  const mcp = input.servers.flatMap((server) => {\n    const ref = server.connectionRef;\n    if (!ref || ref.subjectScope !== \"subject\") return [];\n    const delegation = input.parentDelegations.find(\n      (candidate) =>\n        candidate.serverId === server.id &&\n        sameProviderDomain(candidate.providerDomain, ref.providerDomain) &&\n        (!ref.kind || !candidate.kind || candidate.kind === ref.kind),\n    );\n    return delegation ? [{ ...delegation }] : [];\n  });\n  return [\n    ...mcp,\n    ...input.parentDelegations\n      .filter((item) => item.connectionType === \"social\" || item.connectionType === \"atlassian\")\n      .map((item) => ({ ...item })),\n  ];\n}\n\nexport function personalConnectionDelegationsEqual(\n  left: McpPersonalConnectionDelegation[],\n  right: McpPersonalConnectionDelegation[],\n): boolean {\n  if (left.length !== right.length) return false;\n  const byServer = new Map(right.map((delegation) => [delegation.serverId, delegation]));\n  return left.every((delegation) => {\n    const other = byServer.get(delegation.serverId);\n    return (\n      other?.connectionId === delegation.connectionId &&\n      other.ownerSubjectId === delegation.ownerSubjectId &&\n      sameProviderDomain(other.providerDomain, delegation.providerDomain) &&\n      other.kind === delegation.kind &&\n      other.connectionType === delegation.connectionType\n    );\n  });\n}\n\nexport function personalConnectionDelegationForServer(\n  delegations: McpPersonalConnectionDelegation[],\n  server: Pick<McpServerConfig, \"id\" | \"connectionRef\">,\n): McpPersonalConnectionDelegation | null {\n  const ref = server.connectionRef;\n  if (!ref || ref.subjectScope !== \"subject\") return null;\n  return (\n    delegations.find(\n      (delegation) =>\n        delegation.serverId === server.id &&\n        sameProviderDomain(delegation.providerDomain, ref.providerDomain) &&\n        (!ref.kind || !delegation.kind || delegation.kind === ref.kind),\n    ) ?? null\n  );\n}\n\ntype ConnectionCredentialResolver = (\n  request: ResolveConnectionCredentialInput,\n) => Promise<ResolveConnectionCredentialResult>;\n\nfunction personalAuthorityUnavailable(\n  request: ResolveConnectionCredentialInput,\n): ResolveConnectionCredentialResult {\n  const ref = request.connectionRef;\n  return {\n    status: \"auth_needed\",\n    reason: \"personal_authority_unavailable\",\n    providerDomain: ref.providerDomain,\n    ...(ref.provider ? { provider: ref.provider } : {}),\n    ...(ref.scopes ? { scopes: ref.scopes } : {}),\n    ...(ref.resource ? { resource: ref.resource } : {}),\n    ...(ref.selectedResources ? { selectedResources: ref.selectedResources } : {}),\n  };\n}\n\n/**\n * Resolves subject-owned MCP credentials only through the exact authority\n * frozen on the causal turn. A direct human subject, worker Codemode caller,\n * retry, or recovery can identify the caller, but none may widen or replace\n * the persisted connection UUID.\n */\nexport function withFrozenPersonalConnectionDelegations(input: {\n  resolveCredential: ConnectionCredentialResolver;\n  settings: Pick<Settings, \"mcpServers\">;\n  personalConnectionDelegations: McpPersonalConnectionDelegation[];\n  ownerHasWorkspaceMembership: (subjectId: string) => Promise<boolean>;\n}): ConnectionCredentialResolver {\n  return async (request) => {\n    let effectiveRequest = request;\n    if (request.connectionRef.subjectScope === \"subject\") {\n      const config = input.settings.mcpServers.find((server) => server.id === request.serverId);\n      const delegation = config\n        ? personalConnectionDelegationForServer(input.personalConnectionDelegations, config)\n        : null;\n      if (!delegation || !(await input.ownerHasWorkspaceMembership(delegation.ownerSubjectId))) {\n        return personalAuthorityUnavailable(request);\n      }\n      effectiveRequest = {\n        ...request,\n        subjectId: delegation.ownerSubjectId,\n        connectionRef: {\n          ...request.connectionRef,\n          providerDomain: delegation.providerDomain,\n          connectionId: delegation.connectionId,\n          ...(delegation.kind ? { kind: delegation.kind } : {}),\n        },\n      };\n    }\n    const result = await input.resolveCredential(effectiveRequest);\n    if (result.status === \"ok\" || request.connectionRef.subjectScope !== \"subject\") {\n      return result;\n    }\n    return personalAuthorityUnavailable(request);\n  };\n}\n\nexport async function freezePersonalConnectionDelegations(input: {\n  db: Database;\n  workspaceId: string;\n  settings: Pick<Settings, \"mcpServers\">;\n  tools: ToolRef[];\n  source: PersonalConnectionDelegationSource;\n}): Promise<McpPersonalConnectionDelegation[]> {\n  const servers = selectedPersonalConnectionServers(input.settings, input.tools);\n  const includeFirstPartyConnections = input.tools.some((tool) => tool.id === \"opengeni\");\n  if ((servers.length === 0 && !includeFirstPartyConnections) || input.source.kind === \"none\") {\n    return [];\n  }\n  if (input.source.kind === \"turn\") {\n    const inherited = personalConnectionDelegationsFromParent({\n      servers,\n      parentDelegations: await getSessionTurnPersonalConnectionDelegations(\n        input.db,\n        input.workspaceId,\n        input.source.sessionId,\n        input.source.turnId,\n      ),\n    });\n    return includeFirstPartyConnections\n      ? inherited\n      : inherited.filter(\n          (item) => item.connectionType !== \"social\" && item.connectionType !== \"atlassian\",\n        );\n  }\n  const membership = await getWorkspaceGrant(input.db, input.source.subjectId, input.workspaceId);\n  if (!membership) return [];\n  const mcp = personalConnectionDelegationsFromVisibleConnections({\n    servers,\n    subjectId: input.source.subjectId,\n    connections: await listConnectionsMetadata(input.db, input.workspaceId, input.source.subjectId),\n  });\n  if (!includeFirstPartyConnections) return mcp;\n  const ownerSubjectId = input.source.subjectId;\n  const visible = await listSocialConnections(input.db, input.workspaceId, 500, ownerSubjectId);\n  const latest = new Map<\"x\" | \"reddit\", (typeof visible)[number]>();\n  for (const connection of visible) {\n    if (\n      connection.ownership !== \"personal\" ||\n      connection.status !== \"connected\" ||\n      (connection.provider !== \"x\" && connection.provider !== \"reddit\")\n    )\n      continue;\n    const prior = latest.get(connection.provider);\n    if (!prior || connection.updatedAt > prior.updatedAt)\n      latest.set(connection.provider, connection);\n  }\n  const personalAtlassian = (\n    await listConnectionsMetadata(input.db, input.workspaceId, ownerSubjectId)\n  ).filter(\n    (connection) =>\n      connection.subjectId === ownerSubjectId &&\n      connection.status === \"active\" &&\n      sameProviderDomain(connection.providerDomain, \"api.atlassian.com\"),\n  );\n  return [\n    ...mcp,\n    ...[...latest.values()].map((connection) => ({\n      serverId: `social:${connection.provider}`,\n      connectionId: connection.id,\n      ownerSubjectId,\n      providerDomain: connection.provider === \"x\" ? \"x.com\" : `${connection.provider}.com`,\n      kind: \"oauth2\" as const,\n      connectionType: \"social\" as const,\n    })),\n    ...personalAtlassian.map((connection) => ({\n      serverId: `atlassian:${connection.id}`,\n      connectionId: connection.id,\n      ownerSubjectId,\n      providerDomain: connection.providerDomain,\n      kind: connection.kind,\n      connectionType: \"atlassian\" as const,\n    })),\n  ];\n}\n","import type { Settings } from \"@opengeni/config\";\nimport {\n  gitCredentialBindingIdForRepository,\n  gitCredentialProviderForRepository,\n  defaultRepositoryMountPath,\n  mergeResourceRefs as mergeContractResourceRefs,\n  mergeToolRefs,\n  normalizeRepositorySubpath,\n  normalizeRepositoryTransportUri,\n  normalizeResourceMountPath,\n  resourceIdentityKey,\n  resourceMountPath,\n  resourceMountPathCollisionKey,\n  ResourceRefConflictError,\n  ResourceMountPathError,\n  stableJson,\n  type ResourceRef,\n  type ToolRef,\n} from \"@opengeni/contracts\";\nimport { areGitHubRepositoriesAllowedForWorkspace, requireFile, type Database } from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\n\nexport function validateToolRefs(tools: ToolRef[], settings: McpSettings): ToolRef[] {\n  const mcpServerIds = new Set(settings.mcpServers.map((server) => server.id));\n  const out: ToolRef[] = [];\n  for (const tool of tools) {\n    if (tool.kind !== \"mcp\") {\n      throw new HTTPException(422, {\n        message: `unsupported tool kind: ${(tool as { kind?: string }).kind}`,\n      });\n    }\n    const optional = tool.optional === true;\n    if (!mcpServerIds.has(tool.id)) {\n      if (optional) {\n        continue;\n      }\n      throw new HTTPException(422, { message: `unknown MCP server id: ${tool.id}` });\n    }\n    // Tool refs are tri-state for pack portability across deployments:\n    //  - bare / optional:false is STRICT: the id must be configured here and\n    //    runtime connection failure fails the turn.\n    //  - optional:true + known id is preserved: runtime treats it like an\n    //    auto-attached capability MCP and skips connect/list failures.\n    //  - optional:true + unknown id is skipped above: the client explicitly\n    //    opted into graceful degradation for MCPs (for example docs servers\n    //    like context7) that only some deployments configure.\n    out.push(\n      optional ? { kind: \"mcp\", id: tool.id, optional: true } : { kind: \"mcp\", id: tool.id },\n    );\n  }\n  return mergeToolRefs([], out);\n}\n\ntype McpSettings = Pick<Settings, \"mcpServers\">;\n\nexport function enabledCapabilityMcpToolRefs(\n  settings: McpSettings,\n  runtimeSettings: McpSettings,\n): ToolRef[] {\n  const configuredIds = new Set(settings.mcpServers.map((server) => server.id));\n  return (\n    runtimeSettings.mcpServers\n      .filter((server) => !configuredIds.has(server.id))\n      // AUTO-ATTACHED (workspace-default) capability servers are marked optional:\n      // one of them having a broken/expired credential must SKIP that server, not\n      // fail the whole turn before the model runs. The caller only reaches here\n      // when the request omitted `tools`; an explicit list is never defaulted.\n      .map((server) => ({ kind: \"mcp\", id: server.id, optional: true }))\n  );\n}\n\nexport function withDefaultEnabledCapabilityMcpTools(\n  tools: ToolRef[],\n  settings: McpSettings,\n  runtimeSettings: McpSettings,\n): ToolRef[] {\n  return mergeToolRefs(tools, enabledCapabilityMcpToolRefs(settings, runtimeSettings));\n}\n\n/** Drop stored refs that are no longer present in the current runtime registry. */\nexport function availableToolRefs(tools: ToolRef[], settings: McpSettings): ToolRef[] {\n  const available = new Set(settings.mcpServers.map((server) => server.id));\n  return tools.filter((tool) => available.has(tool.id));\n}\n\n/** A child or fixed-policy follow-up may narrow its allow-list, never widen it. */\nexport function assertToolRefsSubset(\n  requested: ToolRef[],\n  allowed: ToolRef[],\n  message = \"requested tools exceed the session tool policy\",\n): void {\n  const allowedIds = new Set(allowed.map((tool) => `${tool.kind}:${tool.id}`));\n  const widened = requested.find((tool) => !allowedIds.has(`${tool.kind}:${tool.id}`));\n  if (widened) {\n    throw new HTTPException(403, { message: `${message}: ${widened.id}` });\n  }\n}\n\n/** Validate runtime availability and then enforce the durable policy fence. */\nexport function validateToolRefsForSessionPolicy(input: {\n  requested: ToolRef[];\n  settings: McpSettings;\n  allowedTools: ToolRef[];\n  message: string;\n}): ToolRef[] {\n  const validated = validateToolRefs(input.requested, input.settings);\n  assertToolRefsSubset(validated, input.allowedTools, input.message);\n  return validated;\n}\n\nexport function normalizeResources(resources: ResourceRef[]): ResourceRef[] {\n  const mountPaths = new Map<string, string>();\n  const identities = new Map<string, string>();\n  const credentialBindingProviders = new Map<string, string>();\n  const seenResources = new Set<string>();\n  const out: ResourceRef[] = [];\n  for (const resource of resources) {\n    let normalized: ResourceRef;\n    if (resource.kind === \"file\") {\n      const mountPath = normalizeMountPath(resourceMountPath(resource));\n      normalized = {\n        kind: \"file\",\n        fileId: resource.fileId,\n        mountPath,\n      };\n    } else {\n      const credentialProvider = gitCredentialProviderForRepository(resource);\n      let normalizedUri: string;\n      try {\n        normalizedUri = normalizeRepositoryTransportUri(resource.uri);\n      } catch (error) {\n        throw new HTTPException(422, {\n          message: error instanceof Error ? error.message : \"invalid repository URI\",\n        });\n      }\n      const mountPath = normalizeMountPath(\n        resource.mountPath ?? defaultRepositoryMountPath(normalizedUri, credentialProvider),\n      );\n      const credentialBindingId = gitCredentialBindingIdForRepository(resource, credentialProvider);\n      if (\n        (resource.credentialBindingId || resource.connectionId || resource.access) &&\n        !credentialProvider\n      ) {\n        throw new HTTPException(422, {\n          message: \"repository credential bindings and access intent require a Git provider\",\n        });\n      }\n      if (credentialProvider && credentialBindingId) {\n        const boundProvider = credentialBindingProviders.get(credentialBindingId);\n        if (boundProvider && boundProvider !== credentialProvider) {\n          throw new HTTPException(422, {\n            message: `credential binding ${credentialBindingId} is assigned to multiple Git providers`,\n          });\n        }\n        credentialBindingProviders.set(credentialBindingId, credentialProvider);\n      }\n      normalized = {\n        kind: \"repository\",\n        uri: normalizedUri,\n        ref: resource.ref.trim(),\n        mountPath,\n        ...(resource.subpath ? { subpath: normalizeRepositorySubpath(resource.subpath) } : {}),\n        ...(resource.provider ? { provider: resource.provider } : {}),\n        ...(resource.credentialBindingId\n          ? { credentialBindingId: resource.credentialBindingId }\n          : {}),\n        ...(resource.access ? { access: resource.access } : {}),\n        ...(resource.repositoryId !== undefined ? { repositoryId: resource.repositoryId } : {}),\n        ...(resource.installationId !== undefined\n          ? { installationId: resource.installationId }\n          : {}),\n        ...(resource.projectId !== undefined ? { projectId: resource.projectId } : {}),\n        ...(resource.connectionId ? { connectionId: resource.connectionId } : {}),\n        ...(resource.githubInstallationId\n          ? { githubInstallationId: resource.githubInstallationId }\n          : {}),\n        ...(resource.githubRepositoryId ? { githubRepositoryId: resource.githubRepositoryId } : {}),\n      };\n    }\n    const key = stableJson(normalized);\n    const mountCollisionKey = normalized.mountPath\n      ? resourceMountPathCollisionKey(normalized.mountPath)\n      : undefined;\n    const mounted = mountCollisionKey ? mountPaths.get(mountCollisionKey) : undefined;\n    if (mounted && mounted !== key) {\n      throw new HTTPException(422, {\n        message: `duplicate resource mount path: ${normalized.mountPath}`,\n      });\n    }\n    if (normalized.mountPath) {\n      mountPaths.set(mountCollisionKey!, key);\n    }\n    const identity = resourceIdentityKey(normalized);\n    const seenIdentity = identities.get(identity);\n    if (seenIdentity && seenIdentity !== key) {\n      throw new HTTPException(422, {\n        message: `duplicate resource with different settings: ${identity}`,\n      });\n    }\n    identities.set(identity, key);\n    if (!seenResources.has(key)) {\n      seenResources.add(key);\n      out.push(normalized);\n    }\n  }\n  return out;\n}\n\nexport function mergeResourceRefs(\n  existing: ResourceRef[],\n  additions: ResourceRef[],\n): ResourceRef[] {\n  try {\n    return mergeContractResourceRefs(existing, additions, { rejectConflicts: true });\n  } catch (error) {\n    if (error instanceof ResourceRefConflictError) {\n      throw new HTTPException(422, { message: error.message });\n    }\n    throw error;\n  }\n}\n\nexport function validateGitHubRepositorySelectionShapes(resources: ResourceRef[]): number[] {\n  const selected = gitHubRepositorySelections(resources);\n  if (selected.length === 0) {\n    return [];\n  }\n  return [...new Set(selected.map((item) => item.installationId))];\n}\n\n/** @deprecated Use validateGitHubRepositorySelectionShapes for multi-installation sessions. */\nexport function validateGitHubRepositorySelectionShape(resources: ResourceRef[]): number | null {\n  const installationIds = validateGitHubRepositorySelectionShapes(resources);\n  if (installationIds.length > 1) {\n    throw new HTTPException(422, {\n      message: \"GitHub App repository resources must belong to one installation\",\n    });\n  }\n  return installationIds[0] ?? null;\n}\n\nfunction gitHubRepositorySelections(\n  resources: ResourceRef[],\n): Array<{ installationId: number; repositoryId: number }> {\n  return resources.flatMap((resource) => {\n    if (resource.kind !== \"repository\") {\n      return [];\n    }\n    const installationRaw =\n      resource.githubInstallationId ??\n      (resource.provider === \"github\" ? resource.installationId : undefined);\n    const repositoryRaw =\n      resource.githubRepositoryId ??\n      (resource.provider === \"github\" ? resource.repositoryId : undefined);\n    if (installationRaw === null && repositoryRaw === null) {\n      return [];\n    }\n    if (installationRaw === undefined && repositoryRaw === undefined) {\n      return [];\n    }\n    const installationId = positiveInteger(installationRaw);\n    const repositoryId = positiveInteger(repositoryRaw);\n    if (!installationId || !repositoryId) {\n      throw new HTTPException(422, {\n        message:\n          \"GitHub App repository resources require positive github_installation_id and github_repository_id\",\n      });\n    }\n    return [{ installationId, repositoryId }];\n  });\n}\n\nexport async function validateGitHubRepositorySelection(\n  db: Database,\n  workspaceId: string,\n  resources: ResourceRef[],\n): Promise<void> {\n  const installationIds = validateGitHubRepositorySelectionShapes(resources);\n  if (installationIds.length === 0) {\n    return;\n  }\n  const selections = gitHubRepositorySelections(resources);\n  for (const installationId of installationIds) {\n    const repositoryIds = selections\n      .filter((selection) => selection.installationId === installationId)\n      .map((selection) => selection.repositoryId);\n    if (\n      !(await areGitHubRepositoriesAllowedForWorkspace(\n        db,\n        workspaceId,\n        installationId,\n        repositoryIds,\n      ))\n    ) {\n      throw new HTTPException(422, {\n        message:\n          \"GitHub App repository resources must be authorized for a GitHub App installation linked to this workspace\",\n      });\n    }\n  }\n}\n\n/**\n * A 422 from repository selection validation is an authoritative stale or\n * revoked identity. Other failures (for example a database/catalog outage)\n * leave the result unknown and must not cause draft hydration to delete it.\n */\nexport function isAuthoritativeGitHubRepositorySelectionError(error: unknown): boolean {\n  return error instanceof HTTPException && error.status === 422;\n}\n\nexport async function validateFileResources(\n  db: Database,\n  workspaceId: string,\n  resources: ResourceRef[],\n): Promise<void> {\n  const fileIds = new Set<string>();\n  for (const resource of resources) {\n    if (resource.kind !== \"file\") {\n      continue;\n    }\n    if (fileIds.has(resource.fileId)) {\n      throw new HTTPException(422, { message: `duplicate file resource: ${resource.fileId}` });\n    }\n    fileIds.add(resource.fileId);\n    const file = await requireFile(db, workspaceId, resource.fileId).catch(() => null);\n    if (!file) {\n      throw new HTTPException(422, { message: `unknown file resource: ${resource.fileId}` });\n    }\n    if (file.status !== \"ready\") {\n      throw new HTTPException(422, {\n        message: `file resource ${resource.fileId} is ${file.status}`,\n      });\n    }\n  }\n}\n\nfunction normalizeMountPath(path: string): string {\n  try {\n    return normalizeResourceMountPath(path);\n  } catch (error) {\n    if (!(error instanceof ResourceMountPathError)) throw error;\n    throw new HTTPException(422, { message: `invalid resource mount path: ${path}` });\n  }\n}\n\nfunction positiveInteger(value: unknown): number | null {\n  if (typeof value === \"number\" && Number.isInteger(value) && value > 0) {\n    return value;\n  }\n  if (typeof value === \"string\" && /^\\d+$/.test(value) && Number(value) > 0) {\n    return Number(value);\n  }\n  return null;\n}\n\nexport { mergeToolRefs, stableJson };\n","import type { Settings } from \"@opengeni/config\";\nimport {\n  SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT,\n  SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH,\n  mergeToolRefs,\n  type Session,\n  type SessionEffectiveToolPolicy,\n  type SessionToolPolicy,\n  type ToolRef,\n} from \"@opengeni/contracts\";\nimport type { Database } from \"@opengeni/db\";\nimport { settingsWithEnabledCapabilityMcpServers } from \"./capabilities\";\n\nconst MANDATORY_SESSION_MCP_SERVER_IDS = [\"opengeni\"] as const;\nconst PROJECTABLE_REGISTRY_ID = /^[A-Za-z0-9_-]+$/;\n\nexport type ResolvedSessionToolPolicy = {\n  toolRefs: ToolRef[];\n  effectivePolicy: SessionEffectiveToolPolicy;\n};\n\nexport type SessionToolPolicyInput = {\n  toolPolicy: SessionToolPolicy;\n  sessionTools: ToolRef[];\n  availableMcpServerIds: Iterable<string>;\n  /** Current omitted-tools defaults, intentionally narrower than all servers. */\n  defaultMcpServerIds?: Iterable<string>;\n};\n\nfunction sortedIds(ids: Iterable<string>): string[] {\n  return [...new Set(ids)].sort();\n}\n\n/** Every configured runtime MCP defaults on; mandatory carrier IDs are separate. */\nexport function defaultSessionMcpServerIds(servers: Iterable<{ id: string }>): string[] {\n  const mandatory = new Set<string>(MANDATORY_SESSION_MCP_SERVER_IDS);\n  return sortedIds([...servers].map((server) => server.id).filter((id) => !mandatory.has(id)));\n}\n\nfunction projectIds(ids: readonly string[]): { ids: string[]; truncated: boolean } {\n  const projectable = ids.filter(\n    (id) =>\n      id.length <= SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH && PROJECTABLE_REGISTRY_ID.test(id),\n  );\n  return {\n    ids: projectable.slice(0, SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT),\n    truncated:\n      projectable.length !== ids.length ||\n      projectable.length > SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT,\n  };\n}\n\n/**\n * Resolve the same ID-only policy used by API projections and worker turns.\n * This function never receives endpoint URLs, credentials, schemas, or live\n * probe results. `availableMcpServerIds` is the resolved runtime registry;\n * `defaultMcpServerIds` is the current configured omitted-tools default.\n */\nexport function resolveSessionToolPolicy(input: SessionToolPolicyInput): ResolvedSessionToolPolicy {\n  const policy = input.toolPolicy;\n  const availableIds = new Set(input.availableMcpServerIds);\n  const defaultIds = new Set(input.defaultMcpServerIds ?? []);\n  const mandatoryIds: string[] = MANDATORY_SESSION_MCP_SERVER_IDS.filter((id) =>\n    availableIds.has(id),\n  );\n  const mandatoryIdSet = new Set<string>(mandatoryIds);\n  const selectedRefs = mergeToolRefs([], input.sessionTools);\n  const tracksWorkspaceDefaults = policy.mode === \"workspace_default\";\n\n  // Persisted refs may outlive a capability installation, deployment config,\n  // or its credentials. Admission remains strict for newly requested refs, but\n  // turn-time materialization must not hand any no-longer-registered id to the\n  // runtime router: doing so fails before the model can respond and traps the\n  // session in an \"Unknown MCP server id\" loop. Keep the stale selection in the\n  // effective-policy projection below, while executable refs contain only the\n  // registry that is available for this exact turn.\n  let toolRefs = selectedRefs.filter((tool) => availableIds.has(tool.id));\n  if (tracksWorkspaceDefaults) {\n    toolRefs = mergeToolRefs(\n      toolRefs,\n      sortedIds(defaultIds)\n        .filter((id) => availableIds.has(id))\n        .map((id) => ({ kind: \"mcp\" as const, id, optional: true as const })),\n    );\n  }\n  toolRefs = mergeToolRefs(\n    toolRefs,\n    mandatoryIds.map((id) => ({ kind: \"mcp\" as const, id })),\n  );\n\n  // `effectiveIds` is the requested policy truth, including unavailable\n  // optional refs retained in the persisted selection. `toolRefs` above is\n  // the runtime-safe materialization, so projections can distinguish dropped\n  // history from what is actually handed to the MCP router.\n  const requestedEffectiveRefs = mergeToolRefs(\n    selectedRefs,\n    tracksWorkspaceDefaults\n      ? sortedIds(defaultIds)\n          .filter((id) => availableIds.has(id))\n          .map((id) => ({ kind: \"mcp\" as const, id, optional: true as const }))\n      : [],\n  );\n  const effectiveIds = sortedIds(\n    mergeToolRefs(\n      requestedEffectiveRefs,\n      mandatoryIds.map((id) => ({ kind: \"mcp\" as const, id })),\n    ).map((tool) => tool.id),\n  );\n  const configuredIds = effectiveIds.filter((id) => availableIds.has(id));\n  const configuredIdSet = new Set(configuredIds);\n  const droppedIds = effectiveIds.filter((id) => !configuredIdSet.has(id));\n  // Lazy discovery is scoped to the effective MCP allow-list, not only to\n  // workspace-default capability refs. An explicitly selected connector is\n  // directly callable from this same materialized list, so excluding it from\n  // the existing router creates a false \"no connected sources\" result. The\n  // mandatory first-party OpenGeni server stays eager; every other configured\n  // effective server is eligible for bounded schema disclosure.\n  const deferredIds = sortedIds(\n    toolRefs\n      .filter((tool) => configuredIdSet.has(tool.id) && !mandatoryIdSet.has(tool.id))\n      .map((tool) => tool.id),\n  );\n  const selectedIds = sortedIds(\n    selectedRefs\n      .filter(\n        (tool) =>\n          !mandatoryIdSet.has(tool.id) && !(tracksWorkspaceDefaults && tool.optional === true),\n      )\n      .map((tool) => tool.id),\n  );\n  const projections = {\n    selected: projectIds(selectedIds),\n    effective: projectIds(effectiveIds),\n    mandatory: projectIds(sortedIds(mandatoryIds)),\n    deferred: projectIds(deferredIds),\n    configured: projectIds(configuredIds),\n    dropped: projectIds(droppedIds),\n  };\n\n  return {\n    toolRefs,\n    effectivePolicy: {\n      mode: policy.mode,\n      inheritedFromSessionId: policy.inheritedFromSessionId,\n      selectedIds: projections.selected.ids,\n      effectiveIds: projections.effective.ids,\n      mandatoryIds: projections.mandatory.ids,\n      lazyRouter: {\n        state: deferredIds.length > 0 ? \"required\" : \"disabled\",\n        deferredIds: projections.deferred.ids,\n      },\n      configuredIds: projections.configured.ids,\n      droppedIds: projections.dropped.ids,\n      counts: {\n        selected: selectedIds.length,\n        effective: effectiveIds.length,\n        mandatory: mandatoryIds.length,\n        deferred: deferredIds.length,\n        configured: configuredIds.length,\n        dropped: droppedIds.length,\n      },\n      idsTruncated: Object.values(projections).some((projection) => projection.truncated),\n    },\n  };\n}\n\n/** Current full runtime registry IDs, including configured static servers. */\nexport async function workspaceSessionToolPolicyServerIds(\n  db: Database,\n  workspaceId: string,\n  settings: Settings,\n  subjectId?: string,\n): Promise<string[]> {\n  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {\n    ...(subjectId ? { subjectId } : {}),\n  });\n  return sortedIds(runtimeSettings.mcpServers.map((server) => server.id));\n}\n\n/** Current omitted-tools defaults: every configured runtime MCP is on. */\nexport async function workspaceSessionToolPolicyDefaultServerIds(\n  db: Database,\n  workspaceId: string,\n  settings: Settings,\n  subjectId?: string,\n): Promise<string[]> {\n  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {\n    ...(subjectId ? { subjectId } : {}),\n  });\n  return defaultSessionMcpServerIds(runtimeSettings.mcpServers);\n}\n\n/** Add a bounded, secret-safe effective projection to a session response. */\nexport function sessionWithEffectiveToolPolicy(\n  session: Session,\n  workspaceServerIds: Iterable<string>,\n  workspaceDefaultServerIds: Iterable<string> = [],\n): Session {\n  const availableIds = new Set(workspaceServerIds);\n  for (const server of session.mcpServers) {\n    availableIds.add(server.id);\n  }\n  return {\n    ...session,\n    effectiveToolPolicy: resolveSessionToolPolicy({\n      toolPolicy: session.toolPolicy,\n      sessionTools: session.tools,\n      availableMcpServerIds: availableIds,\n      defaultMcpServerIds: workspaceDefaultServerIds,\n    }).effectivePolicy,\n  };\n}\n","import type { Settings } from \"@opengeni/config\";\nimport type {\n  AccessGrant,\n  McpPersonalConnectionDelegation,\n  KnowledgeSourceSyncAction,\n  ScheduledTask,\n  ScheduledTaskAgentConfig,\n  Session,\n  SessionAuthorizationPort,\n  SessionAuthorizationSurface,\n  CreateScheduledTaskRequest as CreateScheduledTaskPayload,\n  UpdateScheduledTaskRequest as UpdateScheduledTaskPayload,\n  XaiProviderAccountAuthoritySnapshotV1,\n} from \"@opengeni/contracts\";\nimport { OPENGENI_SLACK_BOT_SESSION_METADATA_KEY } from \"@opengeni/contracts\";\nimport {\n  createScheduledTask,\n  deleteScheduledTask,\n  getConnectionMetadata,\n  getKnowledgeSourceForSyncAuthority,\n  getNestedAgentDepthDeploymentPolicy,\n  getRig,\n  getScheduledTask,\n  getScheduledTaskPersonalConnectionDelegations,\n  getSessionTurnXaiProviderAccountAuthoritySnapshot,\n  getSession,\n  requireWorkspace,\n  scopedKnowledgeScopeKey,\n  updateScheduledTask,\n  resolveXaiProviderAccountAuthoritySnapshotForAcceptance,\n  type Database,\n  type UpdateScheduledTaskInput,\n} from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\nimport { hasPermission, requirePermission } from \"../access\";\nimport {\n  requireSessionAuthorization,\n  SessionAuthorizationDeniedError,\n  SessionAuthorizationUnavailableError,\n} from \"../session-authorization\";\nimport type { SessionWorkflowClient } from \"../dependencies\";\nimport type { ObjectStorageDependency } from \"../dependencies\";\nimport { settingsWithEnabledCapabilityMcpServers } from \"./capabilities\";\nimport { validateVariableSetAttachment } from \"./environments\";\nimport {\n  freezePersonalConnectionDelegations,\n  personalConnectionDelegationSourceForGrant,\n  personalConnectionDelegationsEqual,\n} from \"./personal-connection-delegations\";\nimport {\n  assertWorkspaceModelPolicyAllows,\n  canonicalConfiguredModel,\n  creationInitiatorForGrant,\n} from \"./sessions\";\nimport {\n  hasReservedOpenGeniSlackBotSessionMetadata,\n  scheduledSlackBotConnectionId,\n  validateOpenGeniSlackBotConnectionSelection,\n} from \"./slack-bot\";\nimport {\n  normalizeResources,\n  validateFileResources,\n  validateGitHubRepositorySelection,\n  validateToolRefs,\n  withDefaultEnabledCapabilityMcpTools,\n} from \"./resources\";\n\n/**\n * Whether a raw scheduled-task payload explicitly set agentConfig.tools.\n * Zod's `.default([])` erases the distinction between \"absent\" and\n * \"explicitly empty\", so callers detect it on the raw payload — the same\n * contract sessions use: absent tools mean \"give me the workspace defaults\n * (enabled capability MCP servers)\", an explicit list (even empty) is taken\n * verbatim.\n */\nexport function scheduledTaskToolsProvided(rawPayload: unknown): boolean {\n  if (!rawPayload || typeof rawPayload !== \"object\") {\n    return false;\n  }\n  const agentConfig = (rawPayload as { agentConfig?: unknown }).agentConfig;\n  return Boolean(\n    agentConfig &&\n    typeof agentConfig === \"object\" &&\n    Object.prototype.hasOwnProperty.call(agentConfig, \"tools\"),\n  );\n}\n\nexport async function createValidatedScheduledTask(input: {\n  settings: Settings;\n  db: Database;\n  objectStorage: ObjectStorageDependency;\n  grant: AccessGrant;\n  payload: CreateScheduledTaskPayload;\n  // Whether the caller explicitly set agentConfig.tools (see\n  // scheduledTaskToolsProvided). Absent tools get the workspace's enabled\n  // capability MCP servers, mirroring session creation.\n  toolsProvided?: boolean;\n  // Set for pack-installation-inherited attachments that were already\n  // authorized with variable-sets:use when the pack was enabled.\n  variableSetPreauthorized?: boolean;\n  sessionAuthorization?: SessionAuthorizationPort | null | undefined;\n  authorizationSurface?: SessionAuthorizationSurface | undefined;\n}): Promise<ScheduledTask> {\n  // API parsing fills this default, but pack installers and older internal\n  // callers can still invoke the shared validator with the pre-action shape.\n  const action = input.payload.action ?? ({ kind: \"agent_turn\" } as const);\n  const knowledgeAction = action.kind === \"knowledge_source_sync\" ? action : null;\n  if (knowledgeAction) {\n    await validateKnowledgeSourceSyncAction({\n      db: input.db,\n      grant: input.grant,\n      action: knowledgeAction,\n    });\n  }\n  const agentConfig = knowledgeAction\n    ? input.payload.agentConfig\n    : await validateScheduledTaskAgentConfig({\n        ...input,\n        workspaceId: input.grant.workspaceId,\n      });\n  const id = crypto.randomUUID();\n  validateScheduledTaskSchedule(input.payload.schedule);\n  const target = knowledgeAction\n    ? null\n    : await validateScheduledTaskTarget({\n        db: input.db,\n        sessionAuthorization: input.sessionAuthorization,\n        authorizationSurface: input.authorizationSurface,\n        grant: input.grant,\n        targetSessionId: input.payload.targetSessionId,\n        runMode: input.payload.runMode,\n        variableSetId: input.payload.variableSetId,\n        rigId: input.payload.rigId,\n        agentConfig,\n      });\n  if (!knowledgeAction && input.payload.variableSetId) {\n    await validateVariableSetAttachment(\n      { settings: input.settings, db: input.db },\n      input.grant,\n      input.grant.workspaceId,\n      input.payload.variableSetId,\n      { preauthorized: input.variableSetPreauthorized ?? false },\n    );\n  }\n  // The rig is stored on the task and resolved to its ACTIVE version per fire\n  // (at dispatch), so validate only that the id names a rig in the workspace —\n  // NOT that it has an active version now (that is a fire-time concern). RLS\n  // makes a cross-workspace id indistinguishable from missing → both 422.\n  if (!knowledgeAction && input.payload.rigId) {\n    await requireScheduledTaskRig(input.db, input.grant.workspaceId, input.payload.rigId);\n  }\n  const personalConnectionDelegations = knowledgeAction\n    ? []\n    : await freezePersonalConnectionDelegations({\n        db: input.db,\n        workspaceId: input.grant.workspaceId,\n        settings: await settingsWithEnabledCapabilityMcpServers(\n          input.db,\n          input.grant.workspaceId,\n          input.settings,\n          { subjectId: input.grant.subjectId },\n        ),\n        tools: [...agentConfig.tools, { kind: \"mcp\", id: \"opengeni\" }],\n        source: personalConnectionDelegationSourceForGrant(input.grant),\n      });\n  const creationInitiator = creationInitiatorForGrant(input.grant);\n  const xaiProviderAccountAuthoritySnapshot: XaiProviderAccountAuthoritySnapshotV1 =\n    creationInitiator.actor\n      ? await getSessionTurnXaiProviderAccountAuthoritySnapshot(\n          input.db,\n          input.grant.workspaceId,\n          creationInitiator.actor.sessionId,\n          creationInitiator.actor.turnId,\n        )\n      : await resolveXaiProviderAccountAuthoritySnapshotForAcceptance(input.db, {\n          workspaceId: input.grant.workspaceId,\n          subjectId: input.grant.subjectId,\n        });\n  return await createScheduledTask(input.db, {\n    id,\n    accountId: input.grant.accountId,\n    workspaceId: input.grant.workspaceId,\n    name: trimmedScheduledTaskName(input.payload.name),\n    status: input.payload.status,\n    schedule: input.payload.schedule,\n    temporalScheduleId: scheduledTaskTemporalScheduleId(id),\n    runMode: input.payload.runMode,\n    overlapPolicy: input.payload.overlapPolicy,\n    action,\n    agentConfig,\n    ...(creationInitiator.initiator ? { createdBy: creationInitiator.initiator } : {}),\n    ...(creationInitiator.context ? { createdByContext: creationInitiator.context } : {}),\n    createdByActor: creationInitiator.actor ?? null,\n    personalConnectionDelegations,\n    xaiProviderAccountAuthoritySnapshot,\n    targetSessionId: target?.id ?? null,\n    variableSetId: input.payload.variableSetId ?? null,\n    rigId: input.payload.rigId ?? null,\n    metadata: input.payload.metadata,\n  });\n}\n\nexport async function validateScheduledTaskTarget(input: {\n  db: Database;\n  sessionAuthorization?: SessionAuthorizationPort | null | undefined;\n  authorizationSurface?: SessionAuthorizationSurface | undefined;\n  grant: AccessGrant;\n  targetSessionId: string | null | undefined;\n  runMode: ScheduledTask[\"runMode\"];\n  variableSetId: string | null | undefined;\n  rigId: string | null | undefined;\n  agentConfig: ScheduledTaskAgentConfig;\n  missingTargetStatus?: 404 | 422;\n}): Promise<Session | null> {\n  if (input.runMode !== \"existing_session\") {\n    if (input.targetSessionId) {\n      throw new HTTPException(422, {\n        message: \"targetSessionId requires runMode=existing_session\",\n      });\n    }\n    return null;\n  }\n  if (!input.targetSessionId) {\n    throw new HTTPException(input.missingTargetStatus ?? 422, {\n      message:\n        input.missingTargetStatus === 404\n          ? \"target session not found\"\n          : \"targetSessionId is required when runMode=existing_session\",\n    });\n  }\n  requirePermission(input.grant, \"sessions:control\");\n  if (input.agentConfig.goal) {\n    throw new HTTPException(422, {\n      message: \"agentConfig.goal cannot be used with an existing-session target\",\n    });\n  }\n  try {\n    await requireSessionAuthorization(\n      {\n        db: input.db,\n        ...(input.sessionAuthorization !== undefined\n          ? { sessionAuthorization: input.sessionAuthorization }\n          : {}),\n      },\n      input.grant,\n      {\n        sessionId: input.targetSessionId,\n        operation: \"session.control\",\n        surface: input.authorizationSurface ?? \"http\",\n      },\n    );\n  } catch (error) {\n    if (error instanceof SessionAuthorizationDeniedError) {\n      throw new HTTPException(404, { message: \"target session not found\" });\n    }\n    if (error instanceof SessionAuthorizationUnavailableError) {\n      throw new HTTPException(503, { message: \"session authorization is unavailable\" });\n    }\n    throw error;\n  }\n  const session = await getSession(input.db, input.grant.workspaceId, input.targetSessionId);\n  if (!session || session.accountId !== input.grant.accountId) {\n    throw new HTTPException(404, { message: \"target session not found\" });\n  }\n  if (session.status === \"cancelled\") {\n    throw new HTTPException(409, {\n      message: \"target session is cancelled; choose a revivable session\",\n    });\n  }\n  if ((session.variableSetId ?? null) !== (input.variableSetId ?? null)) {\n    throw new HTTPException(422, {\n      message: \"target session variableSet attachment does not match the scheduled task\",\n    });\n  }\n  if (input.rigId && input.rigId !== session.rigId) {\n    throw new HTTPException(422, {\n      message: \"target session rig does not match the scheduled task\",\n    });\n  }\n  if (\n    input.agentConfig.sandboxBackend !== undefined &&\n    input.agentConfig.sandboxBackend !== session.sandboxBackend\n  ) {\n    throw new HTTPException(422, {\n      message: \"target session sandbox backend does not match the scheduled task\",\n    });\n  }\n  if (\n    scheduledSlackBotConnectionId(session.metadata) !==\n    (input.agentConfig.slackBotConnectionId ?? null)\n  ) {\n    throw new HTTPException(422, {\n      message: \"target session OpenGeni Slack bot binding does not match the scheduled task\",\n    });\n  }\n  return session;\n}\n\nexport function scheduledTaskForGrant(task: ScheduledTask, grant: AccessGrant): ScheduledTask {\n  if (hasPermission(grant.permissions, \"sessions:control\") || task.targetSessionId === null) {\n    return task;\n  }\n  return { ...task, targetSessionId: null };\n}\n\nexport function scheduledTaskRunForGrant<T extends { sessionId: string | null }>(\n  run: T,\n  grant: AccessGrant,\n): T {\n  if (hasPermission(grant.permissions, \"sessions:control\") || run.sessionId === null) {\n    return run;\n  }\n  return { ...run, sessionId: null };\n}\n\n// Validate a scheduled task's rig reference: it must name a rig in the\n// workspace. A missing/cross-workspace id is a 422 (RLS-invisible == missing).\nasync function requireScheduledTaskRig(\n  db: Database,\n  workspaceId: string,\n  rigId: string,\n): Promise<void> {\n  const rig = await getRig(db, workspaceId, rigId);\n  if (!rig) {\n    throw new HTTPException(422, { message: `unknown rigId: ${rigId}` });\n  }\n}\n\nexport async function validatedScheduledTaskUpdate(input: {\n  settings: Settings;\n  db: Database;\n  objectStorage: ObjectStorageDependency;\n  grant: AccessGrant;\n  existing: ScheduledTask;\n  payload: UpdateScheduledTaskPayload;\n  /** See createValidatedScheduledTask; only consulted when agentConfig is updated. */\n  toolsProvided?: boolean;\n  sessionAuthorization?: SessionAuthorizationPort | null | undefined;\n  authorizationSurface?: SessionAuthorizationSurface | undefined;\n}): Promise<UpdateScheduledTaskInput> {\n  const update: UpdateScheduledTaskInput = {};\n  const existingKnowledge = input.existing.action.kind === \"knowledge_source_sync\";\n  if (input.payload.action && input.payload.action.kind !== input.existing.action.kind) {\n    throw new HTTPException(409, {\n      message: \"scheduled task action kind is immutable; create a new schedule\",\n    });\n  }\n  if (existingKnowledge) {\n    if (\n      input.payload.agentConfig !== undefined ||\n      input.payload.runMode !== undefined ||\n      input.payload.targetSessionId !== undefined ||\n      input.payload.variableSetId !== undefined ||\n      input.payload.rigId !== undefined\n    ) {\n      throw new HTTPException(422, {\n        message: \"knowledge source schedules do not accept agent/session configuration\",\n      });\n    }\n    if (input.payload.overlapPolicy === \"allow_concurrent\") {\n      throw new HTTPException(422, {\n        message: \"knowledge source schedules require skip or buffer_one overlap\",\n      });\n    }\n    if (input.payload.action?.kind === \"knowledge_source_sync\") {\n      await validateKnowledgeSourceSyncAction({\n        db: input.db,\n        grant: input.grant,\n        action: input.payload.action,\n      });\n      update.action = input.payload.action;\n    }\n    if (input.payload.name !== undefined)\n      update.name = trimmedScheduledTaskName(input.payload.name);\n    if (input.payload.status !== undefined) update.status = input.payload.status;\n    if (input.payload.schedule !== undefined) {\n      validateScheduledTaskSchedule(input.payload.schedule);\n      update.schedule = input.payload.schedule;\n    }\n    if (input.payload.overlapPolicy !== undefined) {\n      update.overlapPolicy = input.payload.overlapPolicy;\n    }\n    if (input.payload.metadata !== undefined) update.metadata = input.payload.metadata;\n    return update;\n  }\n  const existingTarget = input.existing.targetSessionId;\n  const nextRunMode = input.payload.runMode ?? input.existing.runMode;\n  const nextTargetSessionId =\n    input.payload.targetSessionId !== undefined\n      ? input.payload.targetSessionId\n      : nextRunMode === \"existing_session\"\n        ? existingTarget\n        : null;\n  if (\n    input.existing.runMode === \"reusable_session\" &&\n    input.existing.reusableSessionId &&\n    nextRunMode === \"existing_session\"\n  ) {\n    throw new HTTPException(409, {\n      message:\n        \"cannot target an existing session after this task created its reusable session; create a new task\",\n    });\n  }\n  if (input.payload.name !== undefined) {\n    update.name = trimmedScheduledTaskName(input.payload.name);\n  }\n  if (input.payload.status !== undefined) {\n    update.status = input.payload.status;\n  }\n  if (input.payload.schedule !== undefined) {\n    validateScheduledTaskSchedule(input.payload.schedule);\n    update.schedule = input.payload.schedule;\n  }\n  if (input.payload.runMode !== undefined) {\n    update.runMode = input.payload.runMode;\n  }\n  if (input.payload.overlapPolicy !== undefined) {\n    update.overlapPolicy = input.payload.overlapPolicy;\n  }\n  if (input.payload.metadata !== undefined) {\n    update.metadata = input.payload.metadata;\n  }\n  if (input.payload.variableSetId !== undefined) {\n    const nextVariableSetId = input.payload.variableSetId;\n    if (\n      (input.existing.variableSetId ?? null) !== (nextVariableSetId ?? null) &&\n      input.existing.runMode === \"reusable_session\" &&\n      input.existing.reusableSessionId\n    ) {\n      throw new HTTPException(409, {\n        message:\n          \"cannot change variableSet of a task with a live reusable session; recreate the task\",\n      });\n    }\n    if (nextVariableSetId === null) {\n      if (input.existing.variableSetId !== null) {\n        // Detaching is also an attachment change: it strips the secrets a\n        // task's instructions were designed around.\n        requirePermission(input.grant, \"variable-sets:use\");\n      }\n      update.variableSetId = null;\n    } else {\n      await validateVariableSetAttachment(\n        { settings: input.settings, db: input.db },\n        input.grant,\n        input.existing.workspaceId,\n        nextVariableSetId,\n      );\n      update.variableSetId = nextVariableSetId;\n    }\n  }\n  if (input.payload.rigId !== undefined) {\n    // The rig binds fresh per fire, so changing it on a reusable-session task is\n    // harmless for the LIVE session (which keeps its own frozen version) and\n    // only affects subsequent new-session fires — no live-session guard needed.\n    if (input.payload.rigId !== null) {\n      await requireScheduledTaskRig(input.db, input.existing.workspaceId, input.payload.rigId);\n    }\n    update.rigId = input.payload.rigId;\n  }\n  if (input.payload.agentConfig !== undefined) {\n    // Editing the instructions of a task that injects workspace secrets is\n    // equivalent to attaching those secrets to new instructions, so it\n    // requires variable-sets:use even though plain task edits do not.\n    const willHaveVariableSet =\n      input.payload.variableSetId !== undefined\n        ? input.payload.variableSetId !== null\n        : Boolean(input.existing.variableSetId);\n    if (willHaveVariableSet) {\n      requirePermission(input.grant, \"variable-sets:use\");\n    }\n    const nextAgentConfig = await validateScheduledTaskAgentConfig({\n      settings: input.settings,\n      db: input.db,\n      objectStorage: input.objectStorage,\n      grant: input.grant,\n      workspaceId: input.existing.workspaceId,\n      payload: { agentConfig: input.payload.agentConfig },\n      ...(input.toolsProvided !== undefined ? { toolsProvided: input.toolsProvided } : {}),\n    });\n    if (\n      input.existing.reusableSessionId &&\n      input.existing.runMode === \"reusable_session\" &&\n      (input.existing.agentConfig.slackBotConnectionId ?? null) !==\n        (nextAgentConfig.slackBotConnectionId ?? null)\n    ) {\n      throw new HTTPException(409, {\n        message:\n          \"cannot change the OpenGeni Slack bot connection of a task with a live reusable session; recreate the task\",\n      });\n    }\n    update.agentConfig = nextAgentConfig;\n    const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(\n      input.db,\n      input.existing.workspaceId,\n      input.settings,\n      { subjectId: input.grant.subjectId },\n    );\n    const personalConnectionDelegations = await freezePersonalConnectionDelegations({\n      db: input.db,\n      workspaceId: input.existing.workspaceId,\n      settings: runtimeSettings,\n      tools: [...nextAgentConfig.tools, { kind: \"mcp\", id: \"opengeni\" }],\n      source: personalConnectionDelegationSourceForGrant(input.grant),\n    });\n    if (input.existing.reusableSessionId && input.existing.runMode === \"reusable_session\") {\n      const existingDelegations = await getScheduledTaskPersonalConnectionDelegations(\n        input.db,\n        input.existing.workspaceId,\n        input.existing.id,\n      );\n      if (!personalConnectionDelegationsEqual(existingDelegations, personalConnectionDelegations)) {\n        throw new HTTPException(409, {\n          message:\n            \"cannot change personal MCP connections of a task with a live reusable session; recreate the task\",\n        });\n      }\n    }\n    update.personalConnectionDelegations = personalConnectionDelegations;\n  }\n  if (\n    existingTarget &&\n    (nextRunMode !== \"existing_session\" || nextTargetSessionId !== existingTarget)\n  ) {\n    await validateScheduledTaskTarget({\n      db: input.db,\n      sessionAuthorization: input.sessionAuthorization,\n      authorizationSurface: input.authorizationSurface,\n      grant: input.grant,\n      targetSessionId: existingTarget,\n      runMode: \"existing_session\",\n      variableSetId: input.existing.variableSetId,\n      rigId: input.existing.rigId,\n      agentConfig: input.existing.agentConfig,\n    });\n  }\n  await validateScheduledTaskTarget({\n    db: input.db,\n    sessionAuthorization: input.sessionAuthorization,\n    authorizationSurface: input.authorizationSurface,\n    grant: input.grant,\n    targetSessionId: nextTargetSessionId,\n    runMode: nextRunMode,\n    variableSetId:\n      input.payload.variableSetId !== undefined\n        ? input.payload.variableSetId\n        : input.existing.variableSetId,\n    rigId: input.payload.rigId !== undefined ? input.payload.rigId : input.existing.rigId,\n    agentConfig: update.agentConfig ?? input.existing.agentConfig,\n  });\n  if (\n    input.payload.targetSessionId !== undefined ||\n    input.existing.runMode === \"existing_session\" ||\n    nextRunMode === \"existing_session\"\n  ) {\n    update.targetSessionId = nextTargetSessionId;\n  }\n  return update;\n}\n\nexport async function requireScheduledTaskForApi(\n  db: Database,\n  workspaceId: string,\n  taskId: string,\n): Promise<ScheduledTask> {\n  const task = await getScheduledTask(db, workspaceId, taskId);\n  if (!task) {\n    throw new HTTPException(404, { message: \"scheduled task not found\" });\n  }\n  return task;\n}\n\nexport type ScheduledTaskRestoreState = {\n  task: ScheduledTask;\n  personalConnectionDelegations: McpPersonalConnectionDelegation[];\n};\n\nexport async function captureScheduledTaskRestoreState(\n  db: Database,\n  task: ScheduledTask,\n): Promise<ScheduledTaskRestoreState> {\n  return {\n    task,\n    personalConnectionDelegations: await getScheduledTaskPersonalConnectionDelegations(\n      db,\n      task.workspaceId,\n      task.id,\n    ),\n  };\n}\n\nexport async function restoreScheduledTask(\n  db: Database,\n  previous: ScheduledTaskRestoreState,\n): Promise<ScheduledTask> {\n  const { task } = previous;\n  return await updateScheduledTask(db, task.workspaceId, task.id, {\n    name: task.name,\n    status: task.status,\n    schedule: task.schedule,\n    runMode: task.runMode,\n    overlapPolicy: task.overlapPolicy,\n    action: task.action,\n    agentConfig: task.agentConfig,\n    personalConnectionDelegations: previous.personalConnectionDelegations,\n    ...(task.runMode === \"existing_session\"\n      ? { targetSessionId: task.targetSessionId }\n      : { reusableSessionId: task.reusableSessionId }),\n    variableSetId: task.variableSetId,\n    rigId: task.rigId,\n    metadata: task.metadata,\n  });\n}\n\nasync function validateKnowledgeSourceSyncAction(input: {\n  db: Database;\n  grant: AccessGrant;\n  action: KnowledgeSourceSyncAction;\n}): Promise<void> {\n  if (input.action.initiatingSubjectId !== input.grant.subjectId) {\n    throw new HTTPException(403, {\n      message: \"knowledge source sync must preserve the exact initiating subject\",\n    });\n  }\n  if (input.action.connection.ownerSubjectId !== input.grant.subjectId) {\n    throw new HTTPException(403, {\n      message: \"knowledge source connection must belong to the initiating subject\",\n    });\n  }\n  const resolved = await getKnowledgeSourceForSyncAuthority(input.db, {\n    accountId: input.grant.accountId,\n    workspaceId: input.grant.workspaceId,\n    sourceId: input.action.sourceId,\n    initiatingSubjectId: input.grant.subjectId,\n  });\n  if (!resolved || resolved.source.lifecycleState !== \"active\") {\n    throw new HTTPException(404, { message: \"knowledge source not found\" });\n  }\n  if (\n    resolved.source.syncGeneration !== input.action.sourceGeneration ||\n    resolved.source.lifecycleGeneration !== input.action.sourceLifecycleGeneration ||\n    scopedKnowledgeScopeKey(resolved.source.scope) !==\n      scopedKnowledgeScopeKey(input.action.destination)\n  ) {\n    throw new HTTPException(409, {\n      message: \"knowledge source authority or generation changed\",\n    });\n  }\n  const connection = await getConnectionMetadata(\n    input.db,\n    input.grant.workspaceId,\n    input.action.connection.connectionId,\n    input.grant.subjectId,\n  );\n  if (\n    !connection ||\n    connection.accountId !== input.grant.accountId ||\n    connection.workspaceId !== input.grant.workspaceId ||\n    connection.subjectId !== input.action.connection.ownerSubjectId ||\n    connection.version !== input.action.connection.connectionVersion ||\n    connection.providerDomain.toLowerCase() !==\n      input.action.connection.providerDomain.toLowerCase() ||\n    connection.kind !== input.action.connection.kind ||\n    connection.status !== \"active\"\n  ) {\n    throw new HTTPException(409, {\n      message: \"knowledge source connection authority changed or requires reconnect\",\n    });\n  }\n}\n\nexport class ScheduledTaskSyncError extends Error {\n  readonly persistenceRestored: boolean;\n\n  constructor(cause: unknown, persistenceRestored: boolean) {\n    super(cause instanceof Error ? cause.message : String(cause), { cause });\n    this.name = \"ScheduledTaskSyncError\";\n    this.persistenceRestored = persistenceRestored;\n  }\n}\n\nexport async function syncCreatedScheduledTask(input: {\n  db: Database;\n  workflowClient: SessionWorkflowClient;\n  task: ScheduledTask;\n}): Promise<void> {\n  try {\n    await input.workflowClient.syncScheduledTask({ task: input.task });\n  } catch (error) {\n    let persistenceRestored = true;\n    try {\n      await deleteScheduledTask(input.db, input.task.workspaceId, input.task.id);\n    } catch {\n      persistenceRestored = false;\n    }\n    throw new ScheduledTaskSyncError(error, persistenceRestored);\n  }\n}\n\nexport async function syncUpdatedScheduledTask(input: {\n  db: Database;\n  workflowClient: SessionWorkflowClient;\n  previous: ScheduledTaskRestoreState;\n  task: ScheduledTask;\n}): Promise<void> {\n  try {\n    await input.workflowClient.syncScheduledTask({ task: input.task });\n  } catch (error) {\n    let persistenceRestored = true;\n    try {\n      await restoreScheduledTask(input.db, input.previous);\n    } catch {\n      persistenceRestored = false;\n    }\n    throw new ScheduledTaskSyncError(error, persistenceRestored);\n  }\n}\n\nexport function scheduledTaskTemporalScheduleId(taskId: string): string {\n  return `scheduled-task-${taskId}`;\n}\n\n/**\n * Stable token that identifies a single logical manual trigger. A client that\n * retries a `/trigger` POST (network blip, lambda re-invocation) passes the\n * SAME token so the retry is idempotent — one usage charge, one workflow run.\n * When the client supplies nothing we mint one UUID PER REQUEST and reuse it\n * for both the idempotency key and the workflowId, so a single request stays\n * internally consistent while two genuinely-distinct manual triggers (no token,\n * fired a second apart) still each get their own run. The token is sanitized to\n * the Temporal workflow-id-safe charset so a client value cannot smuggle a\n * collision into a different task's id space.\n */\nexport function scheduledTaskTriggerToken(clientTriggerId?: string | null): string {\n  const trimmed = (clientTriggerId ?? \"\").trim();\n  if (!trimmed) {\n    return crypto.randomUUID();\n  }\n  const safe = trimmed.replace(/[^a-zA-Z0-9._-]/g, \"_\").slice(0, 128);\n  // A value that sanitizes to empty (only disallowed chars) is unusable as a\n  // stable id; fall back to a fresh token rather than collapse to a constant.\n  return safe.length > 0 ? safe : crypto.randomUUID();\n}\n\n/**\n * Deterministic Temporal workflow id for a manual trigger. Derived purely from\n * the task id and the stable trigger token, so a retry with the same token maps\n * to the same id and `workflowIdReusePolicy: \"REJECT_DUPLICATE\"` collapses the\n * second start into a no-op instead of spawning a second run.\n */\nexport function manualScheduledTaskTriggerWorkflowId(taskId: string, triggerToken: string): string {\n  return `scheduled-task-${taskId}-manual-${triggerToken}`;\n}\n\n/**\n * Deterministic usage idempotency key for a manual trigger's agent_run.created\n * charge. Shares the stable trigger token with the workflow id so the charge\n * and the run dedupe together under retry.\n */\nexport function manualScheduledTaskTriggerUsageKey(\n  workspaceId: string,\n  taskId: string,\n  triggerToken: string,\n): string {\n  return `agent_run.created:scheduled-trigger:${workspaceId}:${taskId}:${triggerToken}`;\n}\n\nasync function validateScheduledTaskAgentConfig(input: {\n  settings: Settings;\n  db: Database;\n  objectStorage: ObjectStorageDependency;\n  grant: AccessGrant;\n  payload: { agentConfig: ScheduledTaskAgentConfig };\n  workspaceId: string;\n  toolsProvided?: boolean;\n}): Promise<ScheduledTaskAgentConfig> {\n  // Reject a curated-out model before touching the DB: a scheduled task is a\n  // session the worker runs later, so it must pass the same allow-list as the\n  // session choke points (a `scheduled_tasks:manage` holder could otherwise set\n  // a model the host does not expose). An omitted model inherits the host\n  // default downstream, which is always configured.\n  const model = canonicalConfiguredModel(input.settings, input.payload.agentConfig.model);\n  // Same policy vetting as the session choke points; an omitted model flows\n  // through session creation later, where the effective default is vetted.\n  await assertWorkspaceModelPolicyAllows(input.db, input.settings, input.workspaceId, model);\n  const resources = normalizeResources(input.payload.agentConfig.resources ?? []);\n  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(\n    input.db,\n    input.workspaceId,\n    input.settings,\n    { subjectId: input.grant.subjectId },\n  );\n  const requestedTools = validateToolRefs(input.payload.agentConfig.tools ?? [], runtimeSettings);\n  // A task whose creator did not choose tools gets the workspace's enabled\n  // capability MCP servers, exactly like a session created without a tools\n  // key. Scheduled runs are sessions too; \"no MCP servers at all\" was a trap\n  // every pack/template instantiation path kept falling into (a maintenance\n  // task that cannot reach its workspace's notebook MCP cannot do its job).\n  const tools =\n    (input.toolsProvided ?? true)\n      ? requestedTools\n      : withDefaultEnabledCapabilityMcpTools(requestedTools, input.settings, runtimeSettings);\n  const prompt = input.payload.agentConfig.prompt.trim();\n  if (!prompt) {\n    throw new HTTPException(422, { message: \"scheduled task prompt is required\" });\n  }\n  if (hasReservedOpenGeniSlackBotSessionMetadata(input.payload.agentConfig.metadata)) {\n    throw new HTTPException(422, {\n      message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY} is reserved for scheduler routing`,\n    });\n  }\n  await validateGitHubRepositorySelection(input.db, input.workspaceId, resources);\n  if (resources.some((resource) => resource.kind === \"file\") && !input.objectStorage) {\n    throw new HTTPException(503, { message: \"object storage is not configured\" });\n  }\n  await validateFileResources(input.db, input.workspaceId, resources);\n  if (input.payload.agentConfig.slackBotConnectionId) {\n    await validateOpenGeniSlackBotConnectionSelection(\n      input.db,\n      input.grant,\n      input.workspaceId,\n      input.payload.agentConfig.slackBotConnectionId,\n    );\n  }\n  const requestedMaxDepth = input.payload.agentConfig.maxNestedAgentDepth;\n  if (requestedMaxDepth !== undefined) {\n    const workspace = await requireWorkspace(input.db, input.workspaceId);\n    const workspaceMaxDepth = workspace.settings.maxNestedAgentDepth;\n    const deploymentPolicy = await getNestedAgentDepthDeploymentPolicy(input.db);\n    const inheritedMaxDepth =\n      typeof workspaceMaxDepth === \"number\"\n        ? workspaceMaxDepth\n        : deploymentPolicy.maxNestedAgentDepth;\n    if (\n      requestedMaxDepth > inheritedMaxDepth &&\n      !hasPermission(input.grant.permissions, \"workspace:admin\")\n    ) {\n      throw new HTTPException(403, {\n        message: `scheduled task maxNestedAgentDepth ${requestedMaxDepth} exceeds inherited limit ${inheritedMaxDepth}; workspace:admin is required to increase it`,\n      });\n    }\n  }\n  return {\n    ...input.payload.agentConfig,\n    ...(model === undefined || model === null ? {} : { model }),\n    prompt,\n    resources,\n    tools,\n  };\n}\n\nfunction validateScheduledTaskSchedule(schedule: ScheduledTask[\"schedule\"]): void {\n  if (schedule.type !== \"interval\" || !schedule.startAt || !schedule.endAt) {\n    return;\n  }\n  if (new Date(schedule.startAt).getTime() >= new Date(schedule.endAt).getTime()) {\n    throw new HTTPException(422, { message: \"interval schedule endAt must be after startAt\" });\n  }\n}\n\nfunction trimmedScheduledTaskName(name: string): string {\n  const trimmed = name.trim();\n  if (!trimmed) {\n    throw new HTTPException(422, { message: \"scheduled task name is required\" });\n  }\n  return trimmed;\n}\n","import { CODEX_MODEL_ID_PREFIX, isCodexBilledModel } from \"@opengeni/codex\";\nimport {\n  canonicalizeConfiguredModelId,\n  configuredAllowedModels,\n  resolveFirstPartyMcpToolPolicy,\n  policyProviderIdForModel,\n  resolveTurnExecutionPolicyV1,\n  WORKSPACE_GATEWAY_MODEL_ID_PREFIX,\n  XAI_SUBSCRIPTION_MODEL_ID_PREFIX,\n  type Settings,\n} from \"@opengeni/config\";\nimport {\n  CreateSessionRequest,\n  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,\n  DEFAULT_FIRST_PARTY_MCP_TOOLS,\n  FIRST_PARTY_MCP_TOOL_NAMES,\n  OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,\n  SessionSpawnDenial,\n  ServiceTurnInitiator,\n  ServiceTurnInitiatorContext,\n  evaluateWorkspaceModelPolicy,\n  latencyModeForMetadata,\n  reasoningEffortForMetadata,\n  stableJson,\n  type AccessGrant,\n  type CreateSessionResponse,\n  type GoalSpec,\n  type FirstPartyMcpToolName,\n  type McpPersonalConnectionDelegation,\n  type Permission,\n  type ReasoningEffort,\n  type ResourceRef,\n  type Session,\n  type SessionSkill,\n  type SessionEvent,\n  SessionMcpApprovalPolicy,\n  type SessionMcpCredentialUpdateInput,\n  type SessionMcpServerInput,\n  type SessionMcpServerMetadata,\n  type SubmittedTimelineAnnotation,\n  type TimelineAnnotation,\n  type UpdateSessionMcpApprovalPolicyResponse,\n  type UpdateSessionToolPolicyRequest,\n  type SessionAuthorizationPort,\n  type SessionToolPolicy,\n  type SessionTurn,\n  type ToolRef,\n  type TurnInitiator,\n  type TurnInitiatorContext,\n  type TurnExecutionPolicyV1,\n  type XaiProviderAccountAuthoritySnapshotV1,\n} from \"@opengeni/contracts\";\nimport {\n  createSession,\n  createSessionWithIdempotencyKeyResult,\n  encryptVariableSetValue,\n  getAnySessionInGroup,\n  getEnrollment,\n  getChannel,\n  getRig,\n  getWorkspaceDefaultRigId,\n  listDistinctVariableSetIdsInGroup,\n  listDistinctRigVersionIdsInGroup,\n  getSandbox,\n  getSession,\n  SessionIdConflictError,\n  getSessionSpawnDenialByIdempotencyKey,\n  getWorkspaceControlEvent,\n  getSessionLineage,\n  getSessionTurn,\n  getSessionTurnXaiProviderAccountAuthoritySnapshot,\n  getWorkspaceModelPolicy,\n  initializeSessionStartAtomically,\n  listSessionTurns,\n  listSessionMcpServersForChildInheritance,\n  requireSession,\n  submitHumanPromptInTransaction,\n  appendSessionEventsWithLockedSessionUpdate,\n  updateSessionTitle as updateSessionTitleRow,\n  withWorkspaceSubjectSessionActivityRls,\n  type CreateSessionMcpServerInput,\n  type Database,\n  type UpdateSessionMcpServerCredentialsInput,\n  QueueCommandConflictError,\n  AgentCommandAuthorityError,\n  runIdempotentPersistenceTransaction,\n  SessionSpawnDeniedDbError,\n  SessionControlConflictError,\n  SessionToolPolicyVersionConflictError,\n  type SessionCommandActor,\n} from \"@opengeni/db\";\nimport {\n  appendAndPublishEvents,\n  publishDurableSessionEvents,\n  publishDurableWorkspaceControlEvent,\n  type EventBus,\n} from \"@opengeni/events\";\nimport { HTTPException } from \"hono/http-exception\";\nimport { hasPermission, requirePermission } from \"../access\";\nimport { recordWorkspaceUsage, requireLimit } from \"../billing/limits\";\nimport type {\n  AcceptSessionUserMessageDependencies,\n  ApiRouteDeps,\n  SessionWorkflowClient,\n} from \"../dependencies\";\nimport {\n  requireSessionAuthorization,\n  SessionAuthorizationDeniedError,\n} from \"../session-authorization\";\nimport { swapActiveSandbox, type FleetContext } from \"../sandbox/fleet\";\nimport { settingsWithEnabledCapabilityMcpServers } from \"./capabilities\";\nimport { validateSubmittedTimelineAnnotations } from \"./timeline-annotations\";\nimport { requireVariableSetEncryption, validateVariableSetAttachment } from \"./environments\";\nimport {\n  freezePersonalConnectionDelegations,\n  personalConnectionDelegationSourceForGrant,\n} from \"./personal-connection-delegations\";\nimport { hasReservedOpenGeniSlackBotSessionMetadata } from \"./slack-bot\";\nimport {\n  assertToolRefsSubset,\n  availableToolRefs,\n  mergeToolRefs,\n  normalizeResources,\n  validateFileResources,\n  validateGitHubRepositorySelection,\n  validateToolRefs,\n  withDefaultEnabledCapabilityMcpTools,\n} from \"./resources\";\n\nconst reservedSessionMcpServerIds = new Set([\"opengeni\", \"files\", \"docs\", \"codex_apps\"]);\nconst maxSessionMcpCredentialHeaders = 16;\nconst maxSessionMcpCredentialHeaderValueLength = 4096;\n// Keep the durable snapshot below the shared event-preview array boundary so\n// the generic lossy projection cannot silently rewrite this audit fact.\nconst maxToolPolicyAuditRefs = 40;\n// RFC 9110 field-name token characters.\nconst sessionMcpCredentialHeaderName = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;\n\n/** Transport-neutral typed denial raised only after its audit row committed. */\nexport class SessionSpawnDeniedError extends Error {\n  readonly denial: SessionSpawnDenial;\n\n  constructor(denial: SessionSpawnDenial) {\n    super(sessionSpawnDeniedMessage(denial));\n    this.name = \"SessionSpawnDeniedError\";\n    this.denial = denial;\n  }\n}\n\n/**\n * Resolve per-session first-party tool visibility without consulting\n * authorization. Top-level omission snapshots the complete runtime default;\n * child omission snapshots the parent's exact effective selection. Explicit\n * [] is authoritative and must never widen.\n */\nexport function resolveFirstPartyMcpToolsForCreate(\n  requested: FirstPartyMcpToolName[] | undefined,\n  parentStored: FirstPartyMcpToolName[] | null | undefined,\n  policy: {\n    default: readonly FirstPartyMcpToolName[];\n    allowed: readonly FirstPartyMcpToolName[];\n  } = {\n    default: DEFAULT_FIRST_PARTY_MCP_TOOLS,\n    allowed: FIRST_PARTY_MCP_TOOL_NAMES,\n  },\n): FirstPartyMcpToolName[] {\n  if (requested !== undefined) return [...requested];\n  const allowed = new Set(policy.allowed);\n  const inherited = parentStored === undefined ? policy.default : (parentStored ?? policy.default);\n  return [...inherited].filter((tool) => allowed.has(tool));\n}\n\nfunction sessionSpawnDeniedMessage(denial: SessionSpawnDenial): string {\n  if (denial.code === \"nested_agent_depth_override_forbidden\") {\n    return `requested nested-agent depth limit ${denial.requestedMaxNestedAgentDepthOverride ?? \"unknown\"} exceeds inherited limit ${denial.effectiveMaxNestedAgentDepth}; workspace:admin is required to increase it`;\n  }\n  return `nested-agent depth ${denial.attemptedDepth} exceeds effective limit ${denial.effectiveMaxNestedAgentDepth} (current parent depth ${denial.currentDepth})`;\n}\n\nexport function sessionSpawnDenialEnvelope(error: SessionSpawnDeniedError) {\n  return {\n    error: {\n      code: error.denial.code,\n      message: error.message,\n      details: { denial: error.denial },\n    },\n  } as const;\n}\n\ntype ValidatedSessionMcpServers = {\n  runtimeServers: Settings[\"mcpServers\"];\n  dbServers: CreateSessionMcpServerInput[];\n  metadata: SessionMcpServerMetadata[];\n};\n\nexport type FrozenCreationInitiator = {\n  initiator?: TurnInitiator;\n  context?: TurnInitiatorContext;\n  actor?: Extract<SessionCommandActor, { type: \"agent_attempt\" }>;\n};\n\nfunction serviceInitiatorForGrant(grant: AccessGrant): {\n  initiator: ServiceTurnInitiator;\n  context: ServiceTurnInitiatorContext;\n} | null {\n  if (!grant.serviceInitiator) {\n    if (grant.serviceInitiatorContext) {\n      throw new HTTPException(403, {\n        message: \"service initiator context requires a signed service initiator\",\n      });\n    }\n    return null;\n  }\n  const initiator = ServiceTurnInitiator.safeParse(grant.serviceInitiator);\n  if (!initiator.success) {\n    throw new HTTPException(403, {\n      message: \"a delegated command initiator must be a bounded service principal\",\n    });\n  }\n  const context = ServiceTurnInitiatorContext.safeParse(grant.serviceInitiatorContext ?? {});\n  if (!context.success) {\n    throw new HTTPException(403, {\n      message: \"delegated service initiator context is invalid or reserved\",\n    });\n  }\n  const callerTurnId = grant.metadata?.[\"turnId\"];\n  const callerAttemptId = grant.metadata?.[\"attemptId\"];\n  const callerExecutionGeneration = grant.metadata?.[\"executionGeneration\"];\n  if (\n    callerTurnId !== undefined ||\n    callerAttemptId !== undefined ||\n    callerExecutionGeneration !== undefined\n  ) {\n    throw new HTTPException(403, {\n      message: \"a service initiator cannot replace an exact agent-attempt initiator\",\n    });\n  }\n  return {\n    initiator: initiator.data,\n    context: context.data,\n  };\n}\n\nexport function creationInitiatorForGrant(grant: AccessGrant): FrozenCreationInitiator {\n  const serviceInitiator = serviceInitiatorForGrant(grant);\n  const callerSessionId = grant.metadata?.[\"sessionId\"];\n  const callerTurnId = grant.metadata?.[\"turnId\"];\n  const callerAttemptId = grant.metadata?.[\"attemptId\"];\n  const callerExecutionGeneration = grant.metadata?.[\"executionGeneration\"];\n  const hasCallerTurnClaim =\n    callerTurnId !== undefined ||\n    callerAttemptId !== undefined ||\n    callerExecutionGeneration !== undefined;\n  if (hasCallerTurnClaim) {\n    if (\n      typeof callerSessionId !== \"string\" ||\n      typeof callerTurnId !== \"string\" ||\n      typeof callerAttemptId !== \"string\" ||\n      typeof callerExecutionGeneration !== \"number\" ||\n      !Number.isSafeInteger(callerExecutionGeneration) ||\n      callerExecutionGeneration < 1\n    ) {\n      throw new HTTPException(403, {\n        message: \"caller attempt claims are incomplete\",\n      });\n    }\n    const actor = {\n      type: \"agent_attempt\",\n      sessionId: callerSessionId,\n      turnId: callerTurnId,\n      attemptId: callerAttemptId,\n      executionGeneration: callerExecutionGeneration,\n    } as const;\n    // The DB create transaction validates this exact attempt and derives the\n    // inherited subject under the same locks as the child-session insert.\n    return { actor };\n  }\n  if (serviceInitiator) {\n    return serviceInitiator;\n  }\n  return {\n    initiator: {\n      kind: \"subject\",\n      subjectId: grant.subjectId,\n      ...(grant.subjectLabel ? { label: grant.subjectLabel } : {}),\n    },\n    context: {},\n  };\n}\n\nfunction normalizedSessionMcpCredentialHeaders(\n  headers: Record<string, string> | undefined,\n): Record<string, string> {\n  if (!headers) {\n    return {};\n  }\n  const entries = Object.entries(headers)\n    .map(([name, value]) => [name.trim(), value] as const)\n    .filter(([name]) => name.length > 0);\n  if (entries.length > maxSessionMcpCredentialHeaders) {\n    throw new HTTPException(422, {\n      message: `a session MCP server supports at most ${maxSessionMcpCredentialHeaders} credential headers`,\n    });\n  }\n  const seen = new Set<string>();\n  for (const [name, value] of entries) {\n    if (!sessionMcpCredentialHeaderName.test(name)) {\n      throw new HTTPException(422, {\n        message: `invalid credential header name: ${name}`,\n      });\n    }\n    const lower = name.toLowerCase();\n    if (seen.has(lower)) {\n      throw new HTTPException(422, {\n        message: `duplicate credential header name: ${name}`,\n      });\n    }\n    seen.add(lower);\n    if (value.length === 0 || value.length > maxSessionMcpCredentialHeaderValueLength) {\n      throw new HTTPException(422, {\n        message: `credential header ${name} must be 1-${maxSessionMcpCredentialHeaderValueLength} characters`,\n      });\n    }\n    // RFC 9110 §5.5: field values are HTAB / printable characters.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u0008\\u000A-\\u001F\\u007F]/.test(value)) {\n      throw new HTTPException(422, {\n        message: `credential header ${name} contains forbidden control characters`,\n      });\n    }\n  }\n  return Object.fromEntries(entries);\n}\n\nfunction mcpServerConfigFromInput(server: SessionMcpServerInput): Settings[\"mcpServers\"][number] {\n  return {\n    id: server.id,\n    ...(server.name ? { name: server.name } : {}),\n    url: server.url,\n    ...(server.allowedTools ? { allowedTools: server.allowedTools } : {}),\n    ...(server.timeoutMs ? { timeoutMs: server.timeoutMs } : {}),\n    cacheToolsList: server.cacheToolsList ?? false,\n    ...(server.requireApproval !== undefined ? { requireApproval: server.requireApproval } : {}),\n    ...(server.connectionRef ? { connectionRef: server.connectionRef } : {}),\n  };\n}\n\nfunction mcpServerConfigFromStoredInput(\n  server: CreateSessionMcpServerInput,\n): Settings[\"mcpServers\"][number] {\n  return {\n    id: server.id,\n    ...(server.name ? { name: server.name } : {}),\n    url: server.url,\n    ...(server.allowedTools ? { allowedTools: server.allowedTools } : {}),\n    ...(server.timeoutMs ? { timeoutMs: server.timeoutMs } : {}),\n    cacheToolsList: server.cacheToolsList ?? false,\n    ...(server.requireApproval != null ? { requireApproval: server.requireApproval } : {}),\n    ...(server.connectionRef ? { connectionRef: server.connectionRef } : {}),\n  };\n}\n\nfunction mcpServerConfigFromMetadata(\n  server: SessionMcpServerMetadata,\n): Settings[\"mcpServers\"][number] {\n  return {\n    id: server.id,\n    ...(server.name ? { name: server.name } : {}),\n    url: server.url,\n    cacheToolsList: false,\n    requireApproval: server.requireApproval,\n    ...(server.connectionRef ? { connectionRef: server.connectionRef } : {}),\n  };\n}\n\nfunction settingsWithSessionMcpServerConfigs(\n  settings: Settings,\n  servers: Settings[\"mcpServers\"],\n): Settings {\n  if (servers.length === 0) {\n    return settings;\n  }\n  const sessionIds = new Set(servers.map((server) => server.id));\n  return {\n    ...settings,\n    mcpServers: [...settings.mcpServers.filter((server) => !sessionIds.has(server.id)), ...servers],\n  };\n}\n\nexport function settingsWithSessionMcpServerMetadata(\n  settings: Settings,\n  servers: SessionMcpServerMetadata[],\n): Settings {\n  return settingsWithSessionMcpServerConfigs(settings, servers.map(mcpServerConfigFromMetadata));\n}\n\nfunction validateSessionMcpServersForCreate(\n  settings: Settings,\n  grant: AccessGrant,\n  servers: SessionMcpServerInput[],\n): ValidatedSessionMcpServers {\n  if (servers.length === 0) {\n    return { runtimeServers: [], dbServers: [], metadata: [] };\n  }\n  requirePermission(grant, \"mcp_servers:attach\");\n  const encryptionKey = servers.some((server) => Object.keys(server.headers ?? {}).length > 0)\n    ? requireVariableSetEncryption(settings)\n    : null;\n  const existingIds = new Set(settings.mcpServers.map((server) => server.id));\n  const seenIds = new Set<string>();\n  const runtimeServers: Settings[\"mcpServers\"] = [];\n  const dbServers: CreateSessionMcpServerInput[] = [];\n  const metadata: SessionMcpServerMetadata[] = [];\n  for (const server of servers) {\n    if (seenIds.has(server.id)) {\n      throw new HTTPException(422, {\n        message: `duplicate session MCP server id: ${server.id}`,\n      });\n    }\n    seenIds.add(server.id);\n    if (reservedSessionMcpServerIds.has(server.id) || existingIds.has(server.id)) {\n      throw new HTTPException(422, {\n        message: `MCP server id already exists: ${server.id}`,\n      });\n    }\n    const headers = normalizedSessionMcpCredentialHeaders(server.headers);\n    const headersEncrypted = Object.fromEntries(\n      Object.entries(headers).map(([name, value]) => [\n        name,\n        encryptVariableSetValue(encryptionKey!, value),\n      ]),\n    );\n    runtimeServers.push(mcpServerConfigFromInput(server));\n    dbServers.push({\n      id: server.id,\n      name: server.name ?? null,\n      url: server.url,\n      allowedTools: server.allowedTools ?? null,\n      timeoutMs: server.timeoutMs ?? null,\n      cacheToolsList: server.cacheToolsList ?? false,\n      requireApproval: server.requireApproval ?? null,\n      connectionRef: server.connectionRef ?? null,\n      headersEncrypted,\n    });\n    metadata.push({\n      id: server.id,\n      name: server.name ?? null,\n      url: server.url,\n      headerNames: Object.keys(headersEncrypted).sort(),\n      credentialVersion: 1,\n      requireApproval: server.requireApproval ?? false,\n      connectionRef: server.connectionRef ?? null,\n    });\n  }\n  return { runtimeServers, dbServers, metadata };\n}\n\nfunction validateInheritedSessionMcpServersForCreate(\n  servers: CreateSessionMcpServerInput[],\n): ValidatedSessionMcpServers {\n  if (servers.length === 0) {\n    return { runtimeServers: [], dbServers: [], metadata: [] };\n  }\n  const seenIds = new Set<string>();\n  for (const server of servers) {\n    if (seenIds.has(server.id)) {\n      throw new HTTPException(422, {\n        message: `duplicate inherited session MCP server id: ${server.id}`,\n      });\n    }\n    seenIds.add(server.id);\n    if (reservedSessionMcpServerIds.has(server.id)) {\n      throw new HTTPException(422, {\n        message: `reserved inherited session MCP server id: ${server.id}`,\n      });\n    }\n  }\n  // A newly enabled deployment/workspace capability may now reuse an id that\n  // belonged to this parent attachment first. Preserve the parent's existing\n  // session-overlay precedence instead of making child creation depend on a\n  // later workspace setting; settingsWithSessionMcpServerConfigs performs that\n  // same overlay for ordinary parent turns.\n  return {\n    runtimeServers: servers.map(mcpServerConfigFromStoredInput),\n    dbServers: servers.map((server) => ({\n      ...server,\n      headersEncrypted: { ...(server.headersEncrypted ?? {}) },\n    })),\n    metadata: servers.map((server) => ({\n      id: server.id,\n      name: server.name ?? null,\n      url: server.url,\n      headerNames: Object.keys(server.headersEncrypted ?? {}).sort(),\n      credentialVersion: 1,\n      requireApproval: server.requireApproval ?? false,\n      connectionRef: server.connectionRef ?? null,\n    })),\n  };\n}\n\nfunction validateSessionMcpCredentialUpdates(input: {\n  settings: Settings;\n  grant: AccessGrant;\n  session: Session;\n  updates: SessionMcpCredentialUpdateInput[];\n}): UpdateSessionMcpServerCredentialsInput[] {\n  if (input.updates.length === 0) {\n    return [];\n  }\n  requirePermission(input.grant, \"mcp_servers:attach\");\n  const encryptionKey = requireVariableSetEncryption(input.settings);\n  const knownIds = new Set(input.session.mcpServers.map((server) => server.id));\n  const seenIds = new Set<string>();\n  const encryptedUpdates = input.updates.map((update) => {\n    if (seenIds.has(update.id)) {\n      throw new HTTPException(422, {\n        message: `duplicate session MCP credential update id: ${update.id}`,\n      });\n    }\n    seenIds.add(update.id);\n    if (!knownIds.has(update.id)) {\n      throw new HTTPException(422, {\n        message: `unknown session MCP server id: ${update.id}`,\n      });\n    }\n    const headers = normalizedSessionMcpCredentialHeaders(update.headers);\n    return {\n      id: update.id,\n      headersEncrypted: Object.fromEntries(\n        Object.entries(headers).map(([name, value]) => [\n          name,\n          encryptVariableSetValue(encryptionKey, value),\n        ]),\n      ),\n    };\n  });\n  return encryptedUpdates;\n}\n\nexport type CreateSessionOutcome = {\n  session: CreateSessionResponse;\n  /** The committed create/start effect represented by this request. */\n  outcome: \"created\" | \"repaired\" | \"replayed\";\n  /** Backward-compatible replay flag for existing entity-oriented callers. */\n  replay: boolean;\n  /** True when the request created/repaired start state or committed a new wake revision. */\n  changed: boolean;\n};\n\nexport type CreateSessionRequestOutcome = CreateSessionOutcome & {\n  /** Billing telemetry is recorded after the committed session start. */\n  usageRecording: \"recorded\" | \"failed\";\n};\n\nexport async function createAndStartSessionWithOutcome(input: {\n  requestedSessionId?: string;\n  db: Database;\n  bus: EventBus;\n  workflowClient: Pick<SessionWorkflowClient, \"wakeSessionWorkflow\">;\n  /** Internal database-only composition seam. The exact session shell and this\n   * linkage commit together before its first event/turn can be initialized. */\n  beforeCreateCommit?: (tx: Database, sessionId: string) => Promise<void>;\n  accountId: string;\n  workspaceId: string;\n  initialMessage: string;\n  /** Create the session shell without an initial user event/agent turn. */\n  deferInitialTurn?: boolean;\n  turnInstructions?: string | null;\n  resources: ResourceRef[];\n  skills?: SessionSkill[];\n  tools: ToolRef[];\n  // Public admission always supplies provenance; optional keeps internal\n  // callers that predate durable tool-policy provenance source-compatible\n  // during the rolling deploy.\n  toolPolicy: SessionToolPolicy;\n  clientEventId?: string;\n  model: string;\n  reasoningEffort: Settings[\"openaiReasoningEffort\"];\n  /** Session default Fast/standard; mirrored into metadata when set. */\n  latencyMode?: \"standard\" | \"priority\" | \"fast\";\n  turnExecutionPolicy: TurnExecutionPolicyV1;\n  sandboxBackend: Settings[\"sandboxBackend\"];\n  metadata: Record<string, unknown>;\n  createdBy?: TurnInitiator;\n  createdByContext?: TurnInitiatorContext;\n  createdByActor?: Extract<SessionCommandActor, { type: \"agent_attempt\" }> | null;\n  // Names/ids only; the session.created payload never carries variable values.\n  variableSet?: { id: string; name: string } | null;\n  // The rig + frozen active rig version resolved at create (M3). Both null ⇒ a\n  // rig-less session (byte-for-byte today's behavior). Frozen here so a later\n  // rig promote never moves an existing session's version.\n  rigId?: string | null;\n  rigVersionId?: string | null;\n  // The workspace channel the session is filed under (rail organization only;\n  // resolved workspace-scoped by the caller). Null/omitted ⇒ unfiled (inbox).\n  channelId?: string | null;\n  goal?: GoalSpec | null;\n  // Per-session agent persona/system instructions (org-visible metadata, not a\n  // secret). Persisted on the session row and composed system-level AFTER the\n  // workspace agentInstructions at turn time; never emitted as a timeline event.\n  // Null/omitted ⇒ the session carries none.\n  instructions?: string | null;\n  // Immutable normalized prompt-policy role. This never derives from a\n  // workspace membership role; null retains the bounded metadata.role fallback.\n  policyRole?: string | null;\n  // Validated against the creating grant before this is called.\n  firstPartyMcpPermissions?: Permission[] | null;\n  // Model-visible first-party tool names. Authorization remains controlled by\n  // firstPartyMcpPermissions and the target resource checks.\n  firstPartyMcpTools: FirstPartyMcpToolName[];\n  // Encrypted DB rows plus matching safe metadata for create-time per-session\n  // MCP servers. Metadata is the only shape emitted in events/responses.\n  mcpServers?: CreateSessionMcpServerInput[];\n  sessionMcpServers?: SessionMcpServerMetadata[];\n  personalConnectionDelegations?: McpPersonalConnectionDelegation[];\n  xaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;\n  // The manager session spawning this worker (a worker-signed sessionId claim\n  // on the creating grant); null for direct API creates and scheduled runs.\n  // When set, the worker's terminal-for-now transitions wake this parent.\n  parentSessionId?: string | null;\n  // Workspace-scoped CREATE idempotency key. When present, a double-fire with\n  // the same key (sequential retry OR concurrent race) collapses to a single\n  // session. Every caller repairs or re-delivers the winner's one atomic start;\n  // the durable initializer prevents duplicate events or turns.\n  createIdempotencyKey?: string | null;\n  // The shared-sandbox group this session's box joins (addendum 05 §D). Null/\n  // omitted ⇒ a singleton group (the new row's own id, today's 1:1 behavior); a\n  // shared/{groupId} spawn passes the resolved group so both run in ONE box.\n  sandboxGroupId?: string | null;\n  // The OS axis of the session's box (sessions.sandbox_os). Omitted ⇒ the\n  // \"linux\" default; set only for a machine-targeted top-level create, where the\n  // targeted machine's enrollment OS is threaded in so the row + resume path +\n  // OS-labeling surfaces honestly reflect the machine.\n  sandboxOs?: Session[\"sandboxOs\"];\n  // Create-time machine targeting (A-2a, RACE-FREE): the enrolled machine (a\n  // sandbox id) to run this session on. When set, the active-sandbox pointer is\n  // resolved+validated+seeded (epoch-fenced) INSIDE finishStartSession, AFTER the\n  // session row exists but BEFORE the first turn is enqueued/the workflow woken,\n  // so the FIRST turn routes to the chosen machine. An invalid/unowned/offline\n  // target fails the create (422) — never a silent fall-back to the default box.\n  // `workingDir` (optional) is the path/cwd base the chosen machine runs under,\n  // seeded alongside the pointer through the epoch-fenced CAS.\n  seedTargetSandbox?: {\n    sandboxId: string;\n    settings: Settings;\n    workingDir?: string | null;\n  } | null;\n  // Exact actor-private pre-session draft represented by this create. The\n  // initializer consumes it only after the first durable runnable unit commits.\n  consumeNewSessionDraft?: {\n    subjectId: string;\n    expectedRevision: number;\n  } | null;\n  // A child may lower its inherited nested-agent depth limit freely; increases\n  // are authorized by the caller's workspace:admin grant and checked again by\n  // the database admission transaction.\n  maxNestedAgentDepthOverride?: number | null;\n  allowNestedAgentDepthIncrease?: boolean;\n  subjectId?: string | null;\n}): Promise<CreateSessionOutcome> {\n  const sessionMetadata = {\n    ...input.metadata,\n    model: input.model,\n    reasoningEffort: input.reasoningEffort,\n    ...(input.latencyMode !== undefined ? { latencyMode: input.latencyMode } : {}),\n  };\n  // Keyed creation is intentionally handled only by the database admission\n  // transaction below. Its workspace/key lock replays either the successful\n  // session or the committed denial atomically; an application-side lookup\n  // cannot serialize those two source tables against an older writer.\n  if (input.createIdempotencyKey) {\n    const keyedResult = await createSessionWithIdempotencyKeyResult(input.db, {\n      ...(input.requestedSessionId ? { requestedSessionId: input.requestedSessionId } : {}),\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      initialMessage: input.initialMessage,\n      initialTurnInstructions: input.turnInstructions ?? null,\n      resources: input.resources,\n      skills: input.skills ?? [],\n      tools: input.tools,\n      toolPolicy: input.toolPolicy,\n      metadata: sessionMetadata,\n      ...(input.createdBy ? { createdBy: input.createdBy } : {}),\n      ...(input.createdByContext ? { createdByContext: input.createdByContext } : {}),\n      createdByActor: input.createdByActor ?? null,\n      model: input.model,\n      sandboxBackend: input.sandboxBackend,\n      variableSetId: input.variableSet?.id ?? null,\n      rigId: input.rigId ?? null,\n      rigVersionId: input.rigVersionId ?? null,\n      channelId: input.channelId ?? null,\n      firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,\n      firstPartyMcpTools: input.firstPartyMcpTools,\n      instructions: input.instructions ?? null,\n      policyRole: input.policyRole ?? null,\n      parentSessionId: input.parentSessionId ?? null,\n      createIdempotencyKey: input.createIdempotencyKey,\n      sandboxGroupId: input.sandboxGroupId ?? null,\n      ...(input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}),\n      mcpServers: input.mcpServers ?? [],\n      personalConnectionDelegations: input.personalConnectionDelegations ?? [],\n      ...(input.xaiProviderAccountAuthoritySnapshot\n        ? {\n            initialXaiProviderAccountAuthoritySnapshot: input.xaiProviderAccountAuthoritySnapshot,\n          }\n        : {}),\n      maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,\n      allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,\n      subjectId: input.subjectId ?? null,\n      ...(input.beforeCreateCommit ? { beforeCreateCommit: input.beforeCreateCommit } : {}),\n    });\n    if (keyedResult.denied) {\n      throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(keyedResult.denial));\n    }\n    const { session: keyed, created } = keyedResult;\n    if (!created) {\n      const finished = await finishStartSession(\n        keyed.temporalWorkflowId ? { ...input, seedTargetSandbox: null } : input,\n        keyed,\n      );\n      return {\n        session: finished.session,\n        outcome: finished.changed ? \"repaired\" : \"replayed\",\n        replay: !finished.changed,\n        changed: finished.changed,\n      };\n    }\n    const finished = await finishStartSession(input, keyed);\n    return {\n      session: finished.session,\n      outcome: \"created\",\n      replay: false,\n      changed: true,\n    };\n  }\n  let session: Session;\n  try {\n    session = await createSession(input.db, {\n      ...(input.requestedSessionId ? { requestedSessionId: input.requestedSessionId } : {}),\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      initialMessage: input.initialMessage,\n      initialTurnInstructions: input.turnInstructions ?? null,\n      resources: input.resources,\n      skills: input.skills ?? [],\n      tools: input.tools,\n      toolPolicy: input.toolPolicy,\n      metadata: sessionMetadata,\n      ...(input.createdBy ? { createdBy: input.createdBy } : {}),\n      ...(input.createdByContext ? { createdByContext: input.createdByContext } : {}),\n      createdByActor: input.createdByActor ?? null,\n      model: input.model,\n      sandboxBackend: input.sandboxBackend,\n      variableSetId: input.variableSet?.id ?? null,\n      rigId: input.rigId ?? null,\n      rigVersionId: input.rigVersionId ?? null,\n      channelId: input.channelId ?? null,\n      firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,\n      firstPartyMcpTools: input.firstPartyMcpTools,\n      instructions: input.instructions ?? null,\n      policyRole: input.policyRole ?? null,\n      parentSessionId: input.parentSessionId ?? null,\n      sandboxGroupId: input.sandboxGroupId ?? null,\n      ...(input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}),\n      mcpServers: input.mcpServers ?? [],\n      personalConnectionDelegations: input.personalConnectionDelegations ?? [],\n      ...(input.xaiProviderAccountAuthoritySnapshot\n        ? {\n            initialXaiProviderAccountAuthoritySnapshot: input.xaiProviderAccountAuthoritySnapshot,\n          }\n        : {}),\n      maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,\n      allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,\n      subjectId: input.subjectId ?? null,\n      ...(input.beforeCreateCommit ? { beforeCreateCommit: input.beforeCreateCommit } : {}),\n    });\n  } catch (error) {\n    if (error instanceof SessionSpawnDeniedDbError) {\n      throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(error.denial));\n    }\n    throw error;\n  }\n  const finished = await finishStartSession(input, session);\n  return {\n    session: finished.session,\n    outcome: \"created\",\n    replay: false,\n    changed: true,\n  };\n}\n\n/** Backward-compatible entity-returning create path used by existing callers. */\nexport async function createAndStartSession(\n  input: Parameters<typeof createAndStartSessionWithOutcome>[0],\n): Promise<CreateSessionResponse> {\n  return (await createAndStartSessionWithOutcome(input)).session;\n}\n\n/**\n * Complete or repair the post-insert half of {@link createAndStartSession}.\n * All durable initial state is installed by one idempotent transaction; every\n * caller may then advance and deliver the coalesced wake revision without\n * duplicating the goal, events, or first turn.\n */\nasync function finishStartSession(\n  input: {\n    db: Database;\n    bus: EventBus;\n    workflowClient: Pick<SessionWorkflowClient, \"wakeSessionWorkflow\">;\n    initialMessage: string;\n    deferInitialTurn?: boolean;\n    turnInstructions?: string | null;\n    resources: ResourceRef[];\n    tools: ToolRef[];\n    toolPolicy: SessionToolPolicy;\n    clientEventId?: string;\n    model: string;\n    reasoningEffort: Settings[\"openaiReasoningEffort\"];\n    turnExecutionPolicy: TurnExecutionPolicyV1;\n    sandboxBackend: Settings[\"sandboxBackend\"];\n    variableSet?: { id: string; name: string } | null;\n    goal?: GoalSpec | null;\n    sessionMcpServers?: SessionMcpServerMetadata[];\n    seedTargetSandbox?: {\n      sandboxId: string;\n      settings: Settings;\n      workingDir?: string | null;\n    } | null;\n    consumeNewSessionDraft?: {\n      subjectId: string;\n      expectedRevision: number;\n    } | null;\n  },\n  session: Session,\n): Promise<{ session: CreateSessionResponse; changed: boolean }> {\n  // Create-time machine targeting (A-2a): seed the active-sandbox pointer BEFORE\n  // the atomic initial turn transaction, so the FIRST turn routes to the chosen\n  // machine. swapActiveSandbox does\n  // the same ownership+liveness validation as the live swap; an invalid/unowned/\n  // offline target FAILS the create (422) — never a silent fall-back to the box.\n  if (input.seedTargetSandbox) {\n    if (session.sandboxBackend === \"none\") {\n      throw new HTTPException(422, {\n        message: \"cannot target a machine for a session with no sandbox (backend: none)\",\n      });\n    }\n    const ctx: FleetContext = {\n      accountId: session.accountId,\n      workspaceId: session.workspaceId,\n      sessionId: session.id,\n      sessionBackend: session.sandboxBackend,\n      sessionGroupId: session.sandboxGroupId,\n    };\n    const seeded = await swapActiveSandbox(\n      {\n        db: input.db,\n        settings: input.seedTargetSandbox.settings,\n        bus: input.bus,\n      },\n      ctx,\n      input.seedTargetSandbox.sandboxId,\n      // The working dir is committed in the SAME epoch-fenced CAS that seeds the\n      // pointer, so the first turn routes to the machine AND lands in working_dir.\n      input.seedTargetSandbox.workingDir ?? null,\n    );\n    if (!seeded.swapped) {\n      throw new HTTPException(422, {\n        message: `cannot target sandbox ${input.seedTargetSandbox.sandboxId}: ${seeded.reason ?? \"target is not attachable\"}`,\n      });\n    }\n  }\n  const started = await initializeSessionStartAtomically(input.db, {\n    accountId: session.accountId,\n    workspaceId: session.workspaceId,\n    sessionId: session.id,\n    ...(input.clientEventId ? { clientEventId: input.clientEventId } : {}),\n    reasoningEffortFallback: input.reasoningEffort,\n    turnExecutionPolicy: input.turnExecutionPolicy,\n    createdEventPayload: {\n      toolPolicy: input.toolPolicy,\n      ...(input.variableSet\n        ? {\n            variableSetId: input.variableSet.id,\n            variableSetName: input.variableSet.name,\n          }\n        : {}),\n      ...(input.sessionMcpServers?.length ? { mcpServers: input.sessionMcpServers } : {}),\n    },\n    goal: input.goal\n      ? {\n          text: input.goal.text,\n          ...(input.goal.successCriteria !== undefined\n            ? { successCriteria: input.goal.successCriteria }\n            : {}),\n          ...(input.goal.maxAutoContinuations !== undefined\n            ? { maxAutoContinuations: input.goal.maxAutoContinuations }\n            : {}),\n        }\n      : null,\n    consumeNewSessionDraft: input.consumeNewSessionDraft ?? null,\n    deferInitialTurn: input.deferInitialTurn === true,\n  });\n  await publishDurableSessionEvents(input.bus, session.workspaceId, session.id, started.events);\n  if (started.workflowWakeRevision !== null) {\n    await input.workflowClient.wakeSessionWorkflow({\n      accountId: session.accountId,\n      workspaceId: session.workspaceId,\n      sessionId: session.id,\n      workflowId: started.temporalWorkflowId,\n      wakeRevision: started.workflowWakeRevision,\n    });\n  }\n  const persisted = await requireSession(input.db, session.workspaceId, session.id);\n  const initialTurnId =\n    started.turn?.id ??\n    (await listSessionTurns(input.db, session.workspaceId, session.id, 1))[0]?.id ??\n    null;\n  return {\n    session: { ...persisted, initialTurnId },\n    changed: started.changed,\n  };\n}\n\nexport function workflowIdForSession(sessionId: string): string {\n  return `session-${sessionId}`;\n}\n\n/**\n * Reject an explicit model that the host does not expose. The set of usable\n * models is the union surfaced by `configuredAllowedModels` (the built-in\n * provider's allow-list plus every registry provider's ids); a `model` outside\n * it cannot be resolved to a provider at run time, so we fail the request at\n * the API edge with 422 rather than enqueuing a turn the worker can't honor.\n *\n * `model` is the effective value selected by the caller's boundary. Top-level\n * omission defaults to `settings.openaiModel`; child-session omission inherits\n * the worker-signed calling turn before reaching this helper. Centralized here\n * so every model-carrying choke point\n * (create-session, user-message/turn-accept, queued-turn update, and\n * scheduled-task agentConfig — a scheduled task is a session the worker runs\n * later) and the MCP surfaces that share them validate identically and cannot\n * drift.\n */\nexport function canonicalConfiguredModel(\n  settings: Settings,\n  model: string | null | undefined,\n): string | null | undefined {\n  if (model === null || model === undefined) {\n    return model;\n  }\n  const canonicalModel = canonicalizeConfiguredModelId(settings, model);\n  if (configuredAllowedModels(settings).includes(canonicalModel)) {\n    return canonicalModel;\n  }\n  // Codex subscription models (codex/<slug>) are injected per-workspace by the\n  // worker overlay at turn time, so they are never in the deployment-global\n  // allow-list. Accept them at the edge when the feature is enabled — the picker\n  // only surfaces them for a connected workspace, and the worker enforces the\n  // actual connection (an unconnected workspace fails the turn with a clear\n  // \"no Codex subscription connected\" error rather than a misleading 422 here).\n  if (settings.codexSubscriptionEnabled && canonicalModel.startsWith(CODEX_MODEL_ID_PREFIX)) {\n    return canonicalModel;\n  }\n  // SuperGrok subscription models are also discovered per workspace rather\n  // than stored in the deployment-global allow-list. Connection availability\n  // is enforced by the workspace policy and worker; this edge guard only needs\n  // to admit the product-model namespace when the feature is enabled.\n  if (\n    settings.supergrokSubscriptionEnabled &&\n    canonicalModel.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX)\n  ) {\n    return canonicalModel;\n  }\n  if (canonicalModel.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {\n    return canonicalModel;\n  }\n  throw new HTTPException(422, { message: `model is not available: ${model}` });\n}\n\nexport function assertConfiguredModel(settings: Settings, model: string | null | undefined): void {\n  canonicalConfiguredModel(settings, model);\n}\n\nexport const CODEX_COMPACTION_V2_PROVIDER_LOCKED = \"codex_compaction_v2_provider_locked\" as const;\n\n/** Session is frozen on Codex remote compaction v2; non-Codex models are refused. */\nexport class CodexCompactionV2ProviderLockedError extends Error {\n  readonly code = CODEX_COMPACTION_V2_PROVIDER_LOCKED;\n  readonly productModelId: string;\n\n  constructor(productModelId: string) {\n    super(\n      `session is locked to Codex remote compaction v2; model \"${productModelId}\" is not a Codex subscription model`,\n    );\n    this.name = \"CodexCompactionV2ProviderLockedError\";\n    this.productModelId = productModelId;\n  }\n}\n\n/**\n * Fail closed when a remote_v2 session would run a non-Codex product model.\n * Portable sessions and non-Codex sessions keep free mid-session provider swap.\n */\nexport function assertSessionAllowsProductModel(\n  session: Pick<Session, \"codexCompactionMode\">,\n  productModelId: string | null | undefined,\n): void {\n  if (productModelId === null || productModelId === undefined) return;\n  if (session.codexCompactionMode !== \"remote_v2\") return;\n  if (isCodexBilledModel(productModelId)) return;\n  throw new CodexCompactionV2ProviderLockedError(productModelId);\n}\n\n/**\n * Reject a model the WORKSPACE's model policy blocks, at the same choke points\n * as assertConfiguredModel — a 422 at the edge instead of a queued turn the\n * worker's authoritative post-resolution gate would fail. `model` is the\n * EFFECTIVE value the caller is about to persist: pass the explicit value at\n * message/turn-update/scheduled-task edges (omitted inherits an\n * already-validated stored default), but at session CREATION pass\n * `payload.model ?? settings.openaiModel` — an omitted model stamps the\n * deployment default onto the session, and under a restricted policy that\n * default may be exactly the provider the policy exists to block.\n */\nexport async function assertWorkspaceModelPolicyAllows(\n  db: Database,\n  settings: Settings,\n  workspaceId: string,\n  model: string | null | undefined,\n): Promise<void> {\n  if (model === null || model === undefined) {\n    return;\n  }\n  const canonicalModel = canonicalConfiguredModel(settings, model);\n  if (canonicalModel === null || canonicalModel === undefined) {\n    return;\n  }\n  const policy = await getWorkspaceModelPolicy(db, workspaceId);\n  if (!policy) {\n    return;\n  }\n  const providerId = policyProviderIdForModel(settings, canonicalModel);\n  const verdict = evaluateWorkspaceModelPolicy(policy, {\n    providerId,\n    modelId: canonicalModel,\n  });\n  if (!verdict.allowed) {\n    throw new HTTPException(422, {\n      message:\n        verdict.reason === \"provider\"\n          ? `model \"${canonicalModel}\" is not allowed by this workspace's model policy: provider \"${providerId}\" is not in the allowed providers`\n          : `model \"${canonicalModel}\" is not allowed by this workspace's model policy`,\n    });\n  }\n}\n\nexport async function requireQueuedTurnForApi(\n  db: Database,\n  workspaceId: string,\n  sessionId: string,\n  turnId: string,\n): Promise<SessionTurn> {\n  const turn = await getSessionTurn(db, workspaceId, turnId);\n  if (!turn || turn.sessionId !== sessionId) {\n    throw new HTTPException(404, { message: \"session turn not found\" });\n  }\n  if (turn.status !== \"queued\") {\n    throw new HTTPException(409, {\n      message: `turn is ${turn.status}; only queued turns can be changed`,\n    });\n  }\n  return turn;\n}\n\nexport function reasoningEffortForSession(\n  metadata: Record<string, unknown>,\n  fallback: Settings[\"openaiReasoningEffort\"],\n): Settings[\"openaiReasoningEffort\"] {\n  return reasoningEffortForMetadata(metadata, fallback);\n}\n\nexport function latencyModeForSession(\n  metadata: Record<string, unknown>,\n  fallback: \"standard\" | \"priority\" | \"fast\" = \"standard\",\n): \"standard\" | \"priority\" | \"fast\" {\n  return latencyModeForMetadata(metadata, fallback);\n}\n\n/**\n * Appends a `user.message` to an existing session and enqueues the resulting\n * turn, merging requested resources/tools into the session and waking the\n * workflow. Shared by the public events route and the first-party MCP\n * `session_send_message` tool so the two surfaces cannot drift. Callers own\n * resource/tool validation and the per-message usage limit before calling.\n */\nexport async function postUserMessageTurn(input: {\n  db: Database;\n  bus: EventBus;\n  workflowClient: Pick<SessionWorkflowClient, \"wakeSessionWorkflow\">;\n  settings: Settings;\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  text: string;\n  annotations?: TimelineAnnotation[];\n  turnInstructions?: string | null;\n  resources: ResourceRef[];\n  model?: string | null;\n  reasoningEffort?: Settings[\"openaiReasoningEffort\"] | null;\n  latencyMode?: \"standard\" | \"priority\" | \"fast\" | null;\n  clientEventId?: string;\n  mcpCredentialUpdates?: UpdateSessionMcpServerCredentialsInput[];\n  personalConnectionDelegations?: McpPersonalConnectionDelegation[];\n  delivery?: \"send\" | \"steer\";\n  origin?: \"human\" | \"operator\";\n  actor?: string;\n  actorLabel?: string;\n  commandActor?: SessionCommandActor;\n  controlEtag?: string | null;\n  expectedDraftRevision?: number | null;\n  reasoningEffortFallback?: Settings[\"openaiReasoningEffort\"];\n  turnExecutionPolicy: TurnExecutionPolicyV1;\n  recordAgentRunUsage?: boolean;\n  schedulePostCommit?: (task: () => Promise<void>) => void;\n}): Promise<{\n  accepted: SessionEvent;\n  turn: SessionTurn;\n  interruptionCount: number;\n  replay: boolean;\n}> {\n  const { db, bus, workflowClient, settings, accountId, workspaceId, sessionId } = input;\n  const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;\n  const requestedReasoningEffort = input.reasoningEffort ?? null;\n  // Reject an explicit per-message model the host does not expose; an omitted\n  // model inherits the session's model downstream (always a configured id).\n  assertConfiguredModel(settings, requestedModel);\n  await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, requestedModel);\n  const sessionForModelGate = await requireSession(db, workspaceId, sessionId);\n  const effectiveModelForGate = requestedModel ?? sessionForModelGate.model;\n  try {\n    assertSessionAllowsProductModel(sessionForModelGate, effectiveModelForGate);\n  } catch (error) {\n    if (error instanceof CodexCompactionV2ProviderLockedError) {\n      throw new HTTPException(422, { message: error.message, cause: error });\n    }\n    throw error;\n  }\n  const operationKey = input.clientEventId ?? crypto.randomUUID();\n  let result;\n  try {\n    result = await runIdempotentPersistenceTransaction(\n      {\n        stage: \"session.prompt.submit\",\n        eventTypes: [\"user.message\", \"turn.queued\", \"session.status.changed\"],\n        maxAttempts: 3,\n      },\n      async () =>\n        await withWorkspaceSubjectSessionActivityRls(\n          db,\n          workspaceId,\n          input.actor ?? accountId,\n          (scoped) =>\n            submitHumanPromptInTransaction(scoped, {\n              accountId,\n              workspaceId,\n              sessionId,\n              subjectId: input.actor ?? accountId,\n              ...(input.actorLabel ? { subjectLabel: input.actorLabel } : {}),\n              actor: input.commandActor ?? {\n                type: \"human\",\n                subjectId: input.actor ?? accountId,\n              },\n              operationKey,\n              delivery: input.delivery ?? \"send\",\n              controlEtag: input.controlEtag ?? null,\n              expectedDraftRevision: input.expectedDraftRevision ?? null,\n              text: input.text,\n              annotations: input.annotations ?? [],\n              turnInstructions: input.turnInstructions ?? null,\n              resources: input.resources,\n              model: requestedModel,\n              reasoningEffort: requestedReasoningEffort,\n              latencyMode: input.latencyMode ?? null,\n              reasoningEffortFallback:\n                input.reasoningEffortFallback ?? settings.openaiReasoningEffort,\n              turnExecutionPolicy: input.turnExecutionPolicy,\n              source: input.origin === \"operator\" ? \"api\" : \"user\",\n              ...(input.recordAgentRunUsage !== undefined\n                ? { recordAgentRunUsage: input.recordAgentRunUsage }\n                : {}),\n              personalConnectionDelegations: input.personalConnectionDelegations ?? [],\n              mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],\n            }),\n        ),\n    );\n  } catch (error) {\n    if (\n      error instanceof QueueCommandConflictError ||\n      error instanceof SessionControlConflictError\n    ) {\n      throw new HTTPException(409, { message: error.message });\n    }\n    if (error instanceof Error && error.message.includes(\"cancelled\")) {\n      throw new HTTPException(409, { message: error.message });\n    }\n    if (error instanceof Error && error.message.startsWith(\"Unknown session MCP server\")) {\n      throw new HTTPException(422, { message: error.message });\n    }\n    throw error;\n  }\n  const postCommitTask = async () => {\n    try {\n      await publishDurableSessionEvents(bus, workspaceId, sessionId, result.events);\n      if (result.workspaceControlEventId) {\n        const controlEvent = await getWorkspaceControlEvent(\n          db,\n          workspaceId,\n          result.workspaceControlEventId,\n        );\n        if (!controlEvent) {\n          throw new Error(\n            `Committed workspace control event disappeared: ${result.workspaceControlEventId}`,\n          );\n        }\n        await publishDurableWorkspaceControlEvent(bus, workspaceId, controlEvent);\n      }\n    } catch {\n      console.warn(\"[sessions] prompt event fanout failed; durable rows remain replayable\", {\n        errorClass: \"PromptEventFanoutOperationError\",\n        errorCode: \"session_prompt_event_fanout_failed\",\n        origin: \"core\",\n      });\n    }\n    try {\n      await workflowClient.wakeSessionWorkflow({\n        accountId,\n        workspaceId,\n        sessionId,\n        workflowId: result.turn.temporalWorkflowId,\n        wakeRevision: result.wakeRevision,\n        ...((input.delivery ?? \"send\") === \"steer\" || result.interruptionCount > 0\n          ? { interruptionRequested: true }\n          : {}),\n      });\n    } catch {\n      console.warn(\"[sessions] workflow wake failed; durable outbox will retry\", {\n        errorClass: \"WorkflowWakeOperationError\",\n        errorCode: \"session_workflow_wake_failed\",\n        origin: \"core\",\n      });\n    }\n  };\n  const schedulePostCommit =\n    input.schedulePostCommit ??\n    ((task: () => Promise<void>) => {\n      void task();\n    });\n  try {\n    schedulePostCommit(postCommitTask);\n  } catch {\n    console.warn(\"[sessions] prompt post-commit scheduling failed; durable recovery remains\", {\n      errorClass: \"PromptPostCommitScheduleError\",\n      errorCode: \"session_prompt_post_commit_schedule_failed\",\n      origin: \"core\",\n    });\n  }\n  return {\n    accepted: result.accepted,\n    turn: result.turn,\n    interruptionCount: result.interruptionCount,\n    replay: result.replay,\n  };\n}\n\n/**\n * Full create-session flow shared by `POST /sessions` and the first-party MCP\n * `session_create` tool: payload validation, resource/tool/variableSet\n * checks, usage limits, session start, and usage recording. `rawPayload` is\n * the unparsed request body so absent-vs-empty execution-context fields keep\n * their meaning: a child inherits omitted resources/tools/mcpServers from its\n * trusted immediate parent, while explicit arrays (including []) win. A\n * top-level create with omitted tools applies workspace-default capability MCPs.\n */\nexport async function createSessionForRequestWithOutcome(\n  deps: ApiRouteDeps,\n  grant: AccessGrant,\n  workspaceId: string,\n  rawPayload: unknown,\n): Promise<CreateSessionRequestOutcome> {\n  const { settings, db, bus, workflowClient, objectStorage } = deps;\n  const payload = CreateSessionRequest.parse(rawPayload);\n  if (hasReservedOpenGeniSlackBotSessionMetadata(payload.metadata)) {\n    throw new HTTPException(422, {\n      message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY} is reserved for scheduler routing`,\n    });\n  }\n  // A committed keyed denial is the idempotent outcome even if mutable\n  // resources, policy, authorization, or budget have changed since the first\n  // attempt. Replay it before any of those checks, just as a keyed successful\n  // session is returned rather than recreated later in createAndStartSession.\n  if (payload.idempotencyKey) {\n    const denial = await getSessionSpawnDenialByIdempotencyKey(\n      db,\n      workspaceId,\n      payload.idempotencyKey,\n    );\n    if (denial) {\n      throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(denial));\n    }\n  }\n  // Parent linkage and execution-context inheritance come ONLY from the\n  // worker-signed sessionId claim. A caller cannot nominate a parent in the\n  // payload, so inheriting an existing repository/tool/credential snapshot does\n  // not turn sessions:create into arbitrary cross-session read authority.\n  const parentSessionId =\n    typeof grant.metadata?.[\"sessionId\"] === \"string\"\n      ? (grant.metadata[\"sessionId\"] as string)\n      : null;\n  if (parentSessionId) {\n    try {\n      await requireSessionAuthorization(deps, grant, {\n        sessionId: parentSessionId,\n        operation: \"session.child.create\",\n        surface: \"core\",\n      });\n    } catch (error) {\n      if (error instanceof SessionAuthorizationDeniedError) {\n        throw new HTTPException(403, { message: error.message, cause: error });\n      }\n      throw error;\n    }\n  }\n  const parentSession = parentSessionId ? await getSession(db, workspaceId, parentSessionId) : null;\n  if (parentSessionId && !parentSession) {\n    throw new HTTPException(404, {\n      message: `parent session not found in workspace: ${parentSessionId}`,\n    });\n  }\n  const creationInitiator = creationInitiatorForGrant(grant);\n  const parentCallingTurn =\n    parentSession && creationInitiator.actor\n      ? await getSessionTurn(db, workspaceId, creationInitiator.actor.turnId)\n      : null;\n  if (\n    creationInitiator.actor &&\n    (!parentCallingTurn || parentCallingTurn.sessionId !== parentSession?.id)\n  ) {\n    throw new HTTPException(403, {\n      message: \"caller attempt does not belong to the parent session\",\n    });\n  }\n  const xaiProviderAccountAuthoritySnapshot =\n    parentSession && creationInitiator.actor\n      ? await getSessionTurnXaiProviderAccountAuthoritySnapshot(\n          db,\n          workspaceId,\n          parentSession.id,\n          creationInitiator.actor.turnId,\n        )\n      : undefined;\n  const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(\n    db,\n    workspaceId,\n    settings,\n    {\n      subjectId: grant.subjectId,\n    },\n  );\n  const sessionMcpServers = hasOwnProperty(rawPayload, \"mcpServers\")\n    ? validateSessionMcpServersForCreate(capabilityRuntimeSettings, grant, payload.mcpServers)\n    : parentSession\n      ? validateInheritedSessionMcpServersForCreate(\n          await listSessionMcpServersForChildInheritance(db, workspaceId, parentSession.id),\n        )\n      : validateSessionMcpServersForCreate(capabilityRuntimeSettings, grant, payload.mcpServers);\n  const runtimeSettings = settingsWithSessionMcpServerConfigs(\n    capabilityRuntimeSettings,\n    sessionMcpServers.runtimeServers,\n  );\n  const resources = normalizeResources(\n    hasOwnProperty(rawPayload, \"resources\")\n      ? payload.resources\n      : (parentSession?.resources ?? payload.resources),\n  );\n  const skills = hasOwnProperty(rawPayload, \"skills\")\n    ? payload.skills\n    : (parentSession?.skills ?? payload.skills);\n  const toolsProvided = hasOwnProperty(rawPayload, \"tools\");\n  const requestedTools = validateToolRefs(\n    toolsProvided ? payload.tools : (parentSession?.tools ?? payload.tools),\n    runtimeSettings,\n  );\n  let selectedTools: ToolRef[];\n  let toolPolicy: SessionToolPolicy;\n  if (parentSession) {\n    const parentTracksWorkspaceDefaults = parentSession.toolPolicy?.mode === \"workspace_default\";\n    const parentEffective = withFirstPartyTools(\n      parentTracksWorkspaceDefaults\n        ? withDefaultEnabledCapabilityMcpTools(\n            availableToolRefs(parentSession.tools, runtimeSettings),\n            settings,\n            runtimeSettings,\n          )\n        : parentSession.tools,\n      runtimeSettings,\n    );\n    if (toolsProvided) {\n      assertToolRefsSubset(\n        requestedTools,\n        parentEffective,\n        \"child tools may only narrow the parent session tool policy\",\n      );\n      selectedTools = requestedTools;\n      toolPolicy = {\n        mode: \"explicit\",\n        inheritedFromSessionId: parentSession.id,\n      };\n    } else {\n      selectedTools = parentEffective;\n      toolPolicy = {\n        mode: parentTracksWorkspaceDefaults ? \"workspace_default\" : \"inherited\",\n        inheritedFromSessionId: parentSession.id,\n      };\n    }\n  } else if (toolsProvided) {\n    selectedTools = requestedTools;\n    toolPolicy = { mode: \"explicit\", inheritedFromSessionId: null };\n  } else {\n    selectedTools = withDefaultEnabledCapabilityMcpTools(\n      requestedTools,\n      settings,\n      capabilityRuntimeSettings,\n    );\n    toolPolicy = { mode: \"workspace_default\", inheritedFromSessionId: null };\n  }\n  // The first-party MCP server is attached to EVERY session. Registration is\n  // independently intersected with the exact model-visible selection and the\n  // tool's permission/target authorization predicate, so attachment alone\n  // exposes nothing.\n  const tools = withFirstPartyTools(selectedTools, runtimeSettings);\n  const personalConnectionDelegations = await freezePersonalConnectionDelegations({\n    db,\n    workspaceId,\n    settings: runtimeSettings,\n    tools,\n    source: personalConnectionDelegationSourceForGrant(grant),\n  });\n  await validateGitHubRepositorySelection(db, workspaceId, resources);\n  if (resources.some((resource) => resource.kind === \"file\") && !objectStorage) {\n    throw new HTTPException(503, {\n      message: \"object storage is not configured\",\n    });\n  }\n  await validateFileResources(db, workspaceId, resources);\n  // VariableSet attachment requires variable-sets:use on the calling grant\n  // (validateVariableSetAttachment enforces it), preserving the invariant\n  // that sandboxed agents cannot self-attach workspace secrets.\n  const variableSet = payload.variableSetId\n    ? await validateVariableSetAttachment(\n        { settings, db },\n        grant,\n        workspaceId,\n        payload.variableSetId,\n      )\n    : null;\n  // RIG BINDING (M3). Resolve the rig this session rides — a UUID binds that\n  // rig, null explicitly opts out, and omission inherits the workspace default\n  // (workspaces.default_rig_id) — then FREEZE both the rig id and its currently-\n  // ACTIVE version onto the row.\n  // The session then rides that exact version for its whole life; a later\n  // promote never moves it. Rig-less (both null) when neither resolves, which is\n  // byte-for-byte today's behavior (zero extra work, zero row change).\n  //   - An EXPLICIT unknown/inactive rigId is a caller error → 422.\n  //   - A stale workspace-default rig (deleted → FK-nulled, or somehow with no\n  //     active version) degrades SILENTLY to rig-less: an operator-side default\n  //     must never brick every create in the workspace.\n  const requestedRigId =\n    payload.rigId === undefined ? await getWorkspaceDefaultRigId(db, workspaceId) : payload.rigId;\n  let frozenRigId: string | null = null;\n  let frozenRigVersionId: string | null = null;\n  if (requestedRigId) {\n    const rig = await getRig(db, workspaceId, requestedRigId);\n    if (!rig || !rig.activeVersion) {\n      if (payload.rigId) {\n        throw new HTTPException(422, {\n          message: rig\n            ? `rig ${payload.rigId} has no active version to bind`\n            : `unknown rigId: ${payload.rigId}`,\n        });\n      }\n      // else: workspace-default fallback that no longer resolves → rig-less.\n    } else {\n      frozenRigId = rig.id;\n      frozenRigVersionId = rig.activeVersion.id;\n    }\n  }\n  // CHANNEL FILING. Pure rail organization: a UUID files the session into that\n  // workspace channel, omission/null leaves it unfiled (inbox). Resolved\n  // workspace-scoped so a foreign channel id can never attach; an explicit\n  // unknown channelId is a caller error → 422.\n  let channelId: string | null = null;\n  if (payload.channelId) {\n    const channel = await getChannel(db, workspaceId, payload.channelId);\n    if (!channel) {\n      throw new HTTPException(422, {\n        message: `unknown channelId: ${payload.channelId}`,\n      });\n    }\n    channelId = channel.id;\n  }\n  // A spawned worker is causally part of the exact turn that created it. Omitted\n  // execution policy fields therefore inherit that calling turn rather than the\n  // deployment defaults. This is especially important for Codex subscription\n  // managers: falling back to the deployment model would silently move a child\n  // onto the OpenGeni-credits billing path. Legacy session-bound grants without\n  // exact attempt claims fall back to the parent session's persisted defaults.\n  const inheritedModel = parentCallingTurn?.model ?? parentSession?.model ?? settings.openaiModel;\n  const model = canonicalConfiguredModel(settings, payload.model ?? inheritedModel);\n  if (model === null || model === undefined) {\n    throw new Error(\"effective session model unexpectedly resolved to null\");\n  }\n  // Session creation persists the EFFECTIVE model — the explicit selection,\n  // inherited calling-turn model, or deployment default — so the policy must\n  // vet that effective value, not just explicit ones (a restricted workspace's\n  // inherited/default-model session would otherwise be born blocked).\n  await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model);\n  const inheritedReasoningEffort =\n    parentCallingTurn?.reasoningEffort ??\n    (parentSession\n      ? reasoningEffortForSession(parentSession.metadata, settings.openaiReasoningEffort)\n      : settings.openaiReasoningEffort);\n  const inheritedLatencyMode =\n    parentCallingTurn?.latencyMode ??\n    (parentSession ? latencyModeForSession(parentSession.metadata, \"standard\") : \"standard\");\n  const reasoningEffort = payload.reasoningEffort ?? inheritedReasoningEffort;\n  const latencyMode = payload.latencyMode ?? inheritedLatencyMode;\n  const inheritedFromParent = parentSession !== null;\n  const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {\n    modelId: model,\n    requestedModelId: payload.model ?? null,\n    modelSource:\n      payload.model === undefined\n        ? inheritedFromParent\n          ? \"continuation\"\n          : \"deployment\"\n        : \"explicit\",\n    reasoningEffort,\n    reasoningSource:\n      payload.reasoningEffort === undefined\n        ? inheritedFromParent\n          ? \"continuation\"\n          : \"deployment\"\n        : \"explicit\",\n    latencyMode,\n    latencyModeSource:\n      payload.latencyMode === undefined\n        ? inheritedFromParent\n          ? \"continuation\"\n          : \"deployment\"\n        : \"explicit\",\n  });\n  // Parent linkage was resolved above, before context validation. A child with\n  // no explicit permission override inherits the creating session's effective\n  // grant instead of silently expanding to standalone worker defaults.\n  // A session's first-party MCP token can carry a non-default permission set\n  // (how an operator hands a manager-style session the orchestration tools),\n  // but never one out-ranking its creator: every requested permission must be\n  // held by the creating grant. A top-level omission keeps the deployment's\n  // normal worker defaults. A child omission inherits its creator's exact\n  // effective grant, preserving a host/operator's narrowed capability boundary\n  // through the whole session tree.\n  const parentFirstPartyMcpPermissions = parentSession\n    ? [...(parentSession.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS)]\n    : null;\n  if (\n    parentFirstPartyMcpPermissions &&\n    payload.firstPartyMcpPermissions?.some(\n      (permission) => !hasPermission(parentFirstPartyMcpPermissions, permission),\n    )\n  ) {\n    throw new HTTPException(403, {\n      message: \"child first-party MCP permissions may only narrow the parent session grant\",\n    });\n  }\n  // A worker-signed creator may itself carry less authority than its parent\n  // session (for example a narrowly delegated spawn token). Inherit the\n  // intersection in the shared canonical default order so null/default parent\n  // policies cannot expand when runtime signing resolves them.\n  let firstPartyMcpPermissions =\n    payload.firstPartyMcpPermissions ??\n    (parentFirstPartyMcpPermissions\n      ? parentFirstPartyMcpPermissions.filter((permission) =>\n          hasPermission(grant.permissions, permission),\n        )\n      : null);\n  if (firstPartyMcpPermissions && firstPartyMcpPermissions.length === 0) {\n    // An empty set would sign an unusable zero-permission token; the default\n    // worker set is expressed by omitting the field.\n    throw new HTTPException(422, {\n      message:\n        \"firstPartyMcpPermissions must not be empty; omit it for the default worker permission set\",\n    });\n  }\n  for (const permission of firstPartyMcpPermissions ?? []) {\n    if (!hasPermission(grant.permissions, permission)) {\n      throw new HTTPException(403, {\n        message: `cannot grant first-party MCP permission beyond the creating grant: ${permission}`,\n      });\n    }\n  }\n  // A goal-bearing session with an explicit/effective permission set must\n  // already carry goals:manage. Without it the worker cannot stop its own\n  // continuation loop, but silently adding it would violate the child\n  // authority contract: a child inherits or narrows its creator's exact grant\n  // and never gains an unrequested permission. Top-level omission remains the\n  // deployment's worker default, which includes the goal tools.\n  if (\n    payload.goal &&\n    firstPartyMcpPermissions &&\n    !firstPartyMcpPermissions.includes(\"goals:manage\")\n  ) {\n    throw new HTTPException(422, {\n      message:\n        \"goal-bearing sessions require goals:manage in the resulting first-party MCP permission set\",\n    });\n  }\n  // Tool visibility is independent from permission authority. A child that\n  // omits the field inherits the parent's exact effective selection; a\n  // top-level omission selects the safe non-connector default catalog.\n  const deploymentFirstPartyMcpToolPolicy = resolveFirstPartyMcpToolPolicy(settings);\n  const disallowedFirstPartyMcpTool = payload.firstPartyMcpTools?.find(\n    (tool) => !deploymentFirstPartyMcpToolPolicy.allowed.includes(tool),\n  );\n  if (disallowedFirstPartyMcpTool) {\n    throw new HTTPException(422, {\n      message: `first-party MCP tool is disabled by deployment policy: ${disallowedFirstPartyMcpTool}`,\n    });\n  }\n  const firstPartyMcpTools = resolveFirstPartyMcpToolsForCreate(\n    payload.firstPartyMcpTools,\n    parentSession ? parentSession.firstPartyMcpTools : undefined,\n    deploymentFirstPartyMcpToolPolicy,\n  );\n  if (payload.goal) {\n    const missingGoalTools = [\"goal_update\", \"goal_progress\", \"goal_complete\", \"goal_pause\"].filter(\n      (name) => !firstPartyMcpTools.includes(name as FirstPartyMcpToolName),\n    );\n    if (missingGoalTools.length > 0) {\n      throw new HTTPException(422, {\n        message: `goal-bearing sessions require first-party MCP tools: ${missingGoalTools.join(\", \")}`,\n      });\n    }\n  }\n  // Parent linkage: a worker is linked to its manager ONLY from the\n  // worker-signed sessionId claim on the creating grant — the manager\n  // session's own id, signed into the delegated token by the worker and never\n  // agent- or caller-controlled. A grant without that claim (a workspace API\n  // key, any non-delegated grant) creates a parentless top-level session.\n  //\n  // We deliberately do NOT honor a caller-supplied parentSessionId: it would\n  // let any sessions:create grant aim a worker at an arbitrary session's id so\n  // its completion wake injects a user.message + queued turn into that session\n  // without holding sessions:control on it (a cross-session write escalation).\n  // The claim is the only trustworthy parent source.\n  // Shared-sandbox placement (addendum 05 §D.2/§D.3, decision I10/OD-S1).\n  //\n  // The DEFAULT rule is context-dependent and resolved server-side from the\n  // TRUSTED claim, never caller-supplied: when `sandbox` is omitted, a session\n  // spawned FROM INSIDE a session (parentSessionId present ⇒ a worker-signed\n  // sessionId claim) defaults to \"shared\" (join the creator's box); a top-level\n  // create (no parent) defaults to \"new\" (a private singleton box). Explicit\n  // values always win.\n  //\n  // null sandboxGroupId ⇒ createSession seeds the new row's own id (singleton,\n  // today's 1:1 behavior). A shared/{groupId} spawn inherits the box's backend\n  // (it is literally the same box; the child cannot pick its own). Cross-\n  // workspace sharing is forbidden by construction: getSession/\n  // getAnySessionInGroup are RLS-workspace-scoped, so a foreign parent/group\n  // returns null → 404; the group uuid is NOT an access boundary, the workspace\n  // filter is (stress (e)).\n  const sandboxChoice = payload.sandbox ?? (parentSessionId ? \"shared\" : \"new\");\n  let sandboxGroupId: string | null = null;\n  let inheritedBackend: Session[\"sandboxBackend\"] | undefined;\n  // ENV-AWARE GROUPING: under the CURRENT mechanics the workspace VariableSet is\n  // creation-time box state — the box's manifest env is fixed when it is cold-\n  // created, and the SDK's provided-session guard rejects any manifest-env delta\n  // at attach. A session carrying a DIFFERENT VariableSet than the box it joins\n  // is therefore a genuine shared-state conflict TODAY: its first turn on a warm\n  // box dies with \"Live sandbox sessions cannot change manifest variableSet\n  // variables\" (proven live, sessions 5aee77e9 + 63d18823). Until the VariableSet\n  // is evicted from the manifest (per-exec, like the git token), grouping must be\n  // env-aware: the INHERITED default falls back to an own box on mismatch (a\n  // credentialed worker spawned from a credential-less manager just works), and\n  // an EXPLICIT shared/{groupId} request with a mismatched VariableSet fails\n  // fast at create (422) instead of poisoning the session's first turn.\n  // The env conflict is a BOX property, so a boxless group is exempt: a\n  // backend:\"none\" session runs in-process with no sandbox, no manifest, and no\n  // provided-session attach — no shared box state exists to conflict, and\n  // env-differing spawns from such parents shared safely before the env-aware\n  // check. They keep sharing (and keep inheriting \"none\").\n  const requestedVariableSetId = payload.variableSetId ?? null;\n  const variableSetMatchesGroup = (memberVariableSetId: string | null): boolean =>\n    memberVariableSetId === requestedVariableSetId;\n  // RIG-AWARE GROUPING (M3), the exact sibling of the env-aware gate above: the\n  // box's rig-baked setup/tooling is fixed at cold-create, so a session joining a\n  // shared box must ride the SAME frozen rig_version_id. A mismatch is a genuine\n  // shared-state conflict (the box was set up for a different rig) — the INHERITED\n  // default falls back to an own box, an EXPLICIT shared/{groupId} request 422s at\n  // create rather than poisoning the first turn on the lease's rig-conflict guard.\n  // null on either side = compatible (a rig-less session shares with a rig-less\n  // box exactly as today); the boxless backend:'none' exemption is shared with the\n  // env gate (no box state to conflict).\n  const rigVersionMatchesGroup = (memberRigVersionId: string | null): boolean =>\n    memberRigVersionId === frozenRigVersionId;\n  if (sandboxChoice === \"shared\") {\n    if (!parentSessionId) {\n      throw new HTTPException(422, {\n        message:\n          \"sandbox:'shared' requires a parent session (spawn from inside a session); use 'new' for a top-level create.\",\n      });\n    }\n    if (!parentSession) {\n      throw new Error(\"trusted parent session was not resolved\");\n    }\n    const parent = parentSession;\n    const parentBoxed = parent.sandboxBackend !== \"none\";\n    const variableSetMismatch =\n      parentBoxed && !variableSetMatchesGroup(parent.variableSetId ?? null);\n    let rigMismatch = parentBoxed && !rigVersionMatchesGroup(parent.rigVersionId ?? null);\n    if (parentBoxed && !rigMismatch) {\n      const memberRigVersionIds = await listDistinctRigVersionIdsInGroup(\n        db,\n        workspaceId,\n        parent.sandboxGroupId,\n      );\n      rigMismatch = !memberRigVersionIds.every((memberRigVersionId) =>\n        rigVersionMatchesGroup(memberRigVersionId),\n      );\n    }\n    if (variableSetMismatch || rigMismatch) {\n      if (payload.sandbox === \"shared\") {\n        // The caller explicitly asked to share while carrying a different\n        // VariableSet / rig — surface the conflict at create time, not turn time.\n        // VariableSet is checked first so its (pre-rig) message is unchanged for\n        // the env-only mismatch the existing gate already covered.\n        throw new HTTPException(422, {\n          message: variableSetMismatch\n            ? \"sandbox:'shared' requires the same variableSet / same environment as the creator's box (the box variable set/environment is fixed at creation); omit sandbox or pass 'new' when attaching a different variableSet/environment.\"\n            : \"sandbox:'shared' requires the same rig as the creator's box (the box's rig setup is fixed at creation); omit sandbox or pass 'new' when binding a different rig.\",\n        });\n      }\n      // Inherited default: deterministic separation on the genuine shared-state\n      // conflict — the worker gets its own box (resolved like a top-level\n      // create: payload.sandboxBackend, else the deployment default) and its\n      // turn runs.\n    } else {\n      sandboxGroupId = parent.sandboxGroupId;\n      inheritedBackend = parent.sandboxBackend;\n    }\n  } else if (typeof sandboxChoice === \"object\") {\n    const member = await getAnySessionInGroup(db, workspaceId, sandboxChoice.groupId);\n    if (!member) {\n      throw new HTTPException(404, {\n        message: `sandbox group not found in workspace: ${sandboxChoice.groupId}`,\n      });\n    }\n    if (member.sandboxBackend !== \"none\") {\n      // Compare against EVERY member, not one arbitrary row: a legacy env-blind\n      // group can carry mixed variableSetIds, and an any-member read would make\n      // the join verdict nondeterministic. Post-env-aware groups are homogeneous\n      // (both join paths enforce equality), so this reads one distinct value in\n      // the common case; a mixed legacy group deterministically rejects.\n      const memberVariableSetIds = await listDistinctVariableSetIdsInGroup(\n        db,\n        workspaceId,\n        sandboxChoice.groupId,\n      );\n      if (\n        !memberVariableSetIds.every((memberVariableSetId) =>\n          variableSetMatchesGroup(memberVariableSetId),\n        )\n      ) {\n        throw new HTTPException(422, {\n          message: `sandbox group ${sandboxChoice.groupId} runs a different variableSet / different environment (the box variable set/environment is fixed at creation); create with the group's variableSet/environment or omit sandbox for an own box.`,\n        });\n      }\n      // Same deterministic all-members check for the frozen rig version (M3): the\n      // box's rig setup is fixed at creation, so every member must ride the rig\n      // this create resolved (or the group is rig-less and so is this create).\n      const memberRigVersionIds = await listDistinctRigVersionIdsInGroup(\n        db,\n        workspaceId,\n        sandboxChoice.groupId,\n      );\n      if (\n        !memberRigVersionIds.every((memberRigVersionId) =>\n          rigVersionMatchesGroup(memberRigVersionId),\n        )\n      ) {\n        throw new HTTPException(422, {\n          message: `sandbox group ${sandboxChoice.groupId} runs a different rig (the box's rig setup is fixed at creation); create with the group's rig or omit sandbox for an own box.`,\n        });\n      }\n    }\n    sandboxGroupId = sandboxChoice.groupId;\n    inheritedBackend = member.sandboxBackend;\n  }\n  // else \"new\": leave sandboxGroupId null → own singleton group (group ≡ id).\n  // A working dir is only meaningful for a TARGETED machine (it is the chosen\n  // box's path/cwd base). Present without a targetSandboxId is a malformed request\n  // — reject it at the edge (mirrors the backend:'none' guard) rather than silently\n  // dropping it, since the default group box has no working-dir seam yet.\n  if (payload.workingDir !== undefined && !payload.targetSandboxId) {\n    throw new HTTPException(422, {\n      message:\n        \"workingDir requires targetSandboxId (it is the targeted machine's working directory)\",\n    });\n  }\n  // Honest-label (Stage-D closure): a top-level session TARGETED at a Connected\n  // Machine (a selfhosted sandbox) runs machine-primary every turn, so its HOME\n  // sandbox_backend must read \"selfhosted\" — not the deployment cloud default —\n  // so the session row + first turn honestly reflect where the agent runs (the\n  // Machines dashboard, the turn's warm-metering, and the file-download plane all\n  // key off this). GUARDS: (1) only at a TOP-LEVEL create (inheritedBackend\n  // undefined) — a shared/{groupId} spawn is literally the creator's box and must\n  // NOT be relabeled; (2) only when the target's kind is actually \"selfhosted\" —\n  // targetSandboxId also accepts a first-class MODAL sandbox id (resolveTarget),\n  // which must never be mislabeled. A not-found / non-selfhosted / modal target\n  // falls through to the default; the seed swap in createAndStartSession still\n  // validates ownership/liveness and 422s a bad target. (3) only when the feature\n  // flags that make the worker actually take the machine-primary path are ON\n  // (sandboxOwnershipEnabled + sandboxSelfhostedEnabled/routing) — otherwise the\n  // worker ignores the active pointer and a home=\"selfhosted\" turn would fall to\n  // the registry client with no bound agentId and throw; with the flags off we\n  // keep the cloud default and the machine layers as a (pre-honest-label) overlay.\n  // sandbox_os (the OS axis the worker's group-box resume + the OS-labeling\n  // surfaces key off) must ALSO reflect the targeted machine, not the \"linux\"\n  // schema default — a session run on a macOS Connected Machine that labels\n  // itself linux lies to those surfaces. Derived under the SAME guards as the\n  // backend relabel; the enrollment (joined via the sandbox's enrollmentId)\n  // carries the OS. enrollmentOsValues and the sessions.sandbox_os value set are\n  // both (\"linux\",\"macos\",\"windows\"), so a known value maps 1:1; any other value\n  // is left to the \"linux\" default (never write a value no reader understands).\n  let machineHomeBackend: Session[\"sandboxBackend\"] | undefined;\n  let machineHomeOs: Session[\"sandboxOs\"] | undefined;\n  if (\n    payload.targetSandboxId &&\n    inheritedBackend === undefined &&\n    settings.sandboxOwnershipEnabled &&\n    settings.sandboxSelfhostedEnabled\n  ) {\n    const targetSandbox = await getSandbox(db, workspaceId, payload.targetSandboxId);\n    if (targetSandbox?.kind === \"selfhosted\") {\n      machineHomeBackend = \"selfhosted\";\n      if (targetSandbox.enrollmentId) {\n        const enrollment = await getEnrollment(db, workspaceId, targetSandbox.enrollmentId);\n        if (\n          enrollment &&\n          (enrollment.os === \"macos\" || enrollment.os === \"windows\" || enrollment.os === \"linux\")\n        ) {\n          machineHomeOs = enrollment.os;\n        }\n      }\n    }\n  }\n  if (payload.startMode !== \"realtime\") {\n    await requireLimit(deps, {\n      accountId: grant.accountId,\n      workspaceId,\n      action: \"agent_run:create\",\n      quantity: 1,\n      model,\n    });\n  }\n  let createOutcome: CreateSessionOutcome;\n  try {\n    createOutcome = await createAndStartSessionWithOutcome({\n      ...(payload.requestedSessionId ? { requestedSessionId: payload.requestedSessionId } : {}),\n      db,\n      bus,\n      workflowClient,\n      accountId: grant.accountId,\n      workspaceId,\n      initialMessage: payload.initialMessage ?? \"\",\n      deferInitialTurn: payload.startMode === \"realtime\",\n      turnInstructions: payload.turnInstructions ?? null,\n      resources,\n      skills,\n      tools,\n      toolPolicy,\n      ...(payload.clientEventId ? { clientEventId: payload.clientEventId } : {}),\n      model,\n      reasoningEffort,\n      latencyMode,\n      turnExecutionPolicy,\n      // A shared spawn inherits the box's backend; a caller-supplied\n      // sandboxBackend on a shared spawn is ignored (it is the same box). A\n      // machine-targeted top-level create labels the home \"selfhosted\"\n      // (machineHomeBackend), overriding the caller/deployment default so the row\n      // matches where the session actually runs.\n      sandboxBackend:\n        inheritedBackend ?? machineHomeBackend ?? payload.sandboxBackend ?? settings.sandboxBackend,\n      // Mirror the backend relabel on the OS axis: only a machine-targeted\n      // top-level create carries a derived OS; everything else is omitted and the\n      // \"linux\" default holds (shared spawns keep the parent-box behavior).\n      ...(machineHomeOs ? { sandboxOs: machineHomeOs } : {}),\n      sandboxGroupId,\n      metadata: payload.metadata,\n      ...(creationInitiator.initiator ? { createdBy: creationInitiator.initiator } : {}),\n      ...(creationInitiator.context ? { createdByContext: creationInitiator.context } : {}),\n      createdByActor: creationInitiator.actor ?? null,\n      variableSet: variableSet ? { id: variableSet.id, name: variableSet.name } : null,\n      // Frozen rig binding (M3): both null for a rig-less session (today's path).\n      rigId: frozenRigId,\n      rigVersionId: frozenRigVersionId,\n      channelId,\n      goal: payload.goal ?? null,\n      // Per-session persona instructions (already trimmed/validated by the\n      // contracts schema). Persisted on the row; composed system-level at turn\n      // time. Not surfaced as an event.\n      instructions: payload.instructions ?? null,\n      policyRole: payload.policyRole ?? null,\n      firstPartyMcpPermissions,\n      firstPartyMcpTools,\n      mcpServers: sessionMcpServers.dbServers,\n      sessionMcpServers: sessionMcpServers.metadata,\n      personalConnectionDelegations,\n      ...(xaiProviderAccountAuthoritySnapshot ? { xaiProviderAccountAuthoritySnapshot } : {}),\n      parentSessionId,\n      createIdempotencyKey: payload.idempotencyKey ?? null,\n      maxNestedAgentDepthOverride: payload.maxNestedAgentDepth ?? null,\n      allowNestedAgentDepthIncrease: hasPermission(grant.permissions, \"workspace:admin\"),\n      subjectId: grant.subjectId,\n      // Create-time machine targeting (A-2a): when a target sandbox is named, the\n      // active-sandbox pointer is seeded race-free inside createAndStartSession\n      // (after the row exists, before the first turn dispatches). Validation\n      // (ownership/liveness) lives in swapActiveSandbox; an invalid target 422s.\n      seedTargetSandbox: payload.targetSandboxId\n        ? {\n            sandboxId: payload.targetSandboxId,\n            settings,\n            workingDir: payload.workingDir ?? null,\n          }\n        : null,\n      consumeNewSessionDraft:\n        payload.expectedNewSessionDraftRevision !== undefined\n          ? {\n              subjectId: grant.subjectId,\n              expectedRevision: payload.expectedNewSessionDraftRevision,\n            }\n          : null,\n    });\n  } catch (error) {\n    if (error instanceof AgentCommandAuthorityError) {\n      throw new HTTPException(403, { message: error.message });\n    }\n    if (error instanceof SessionIdConflictError) {\n      throw new HTTPException(409, {\n        message: \"requested session id is already in use\",\n      });\n    }\n    throw error;\n  }\n  let usageRecording: CreateSessionRequestOutcome[\"usageRecording\"] = \"recorded\";\n  if (payload.startMode !== \"realtime\") {\n    try {\n      await recordWorkspaceUsage(deps, {\n        accountId: grant.accountId,\n        workspaceId,\n        subjectId: grant.subjectId,\n        eventType: \"agent_run.created\",\n        quantity: 1,\n        unit: \"run\",\n        sourceResourceType: \"session\",\n        sourceResourceId: createOutcome.session.id,\n        sessionId: createOutcome.session.id,\n        initiator: createOutcome.session.createdBy,\n        initiatorContext: createOutcome.session.createdByContext,\n        origin: creationInitiator.actor ? \"system\" : \"user\",\n        idempotencyKey: `agent_run.created:${workspaceId}:${createOutcome.session.id}`,\n      });\n    } catch (error) {\n      usageRecording = \"failed\";\n      reportSessionUsageRecordingFailure(error);\n    }\n  }\n  return { ...createOutcome, usageRecording };\n}\n\n/** @internal Fixed public projection; the committed session outcome remains authoritative. */\nexport function reportSessionUsageRecordingFailure(_error: unknown): void {\n  console.warn(\n    \"[sessions] usage recording failed after committed session create; returning committed outcome\",\n    {\n      errorClass: \"UsageRecordingError\",\n      errorCode: \"session_create_usage_recording_failed\",\n      origin: \"core\",\n    },\n  );\n}\n\n/** Backward-compatible entity-returning request path for REST and core callers. */\nexport async function createSessionForRequest(\n  deps: ApiRouteDeps,\n  grant: AccessGrant,\n  workspaceId: string,\n  rawPayload: unknown,\n): Promise<CreateSessionResponse> {\n  return (await createSessionForRequestWithOutcome(deps, grant, workspaceId, rawPayload)).session;\n}\n\n/**\n * Full accept-user-message flow shared by the `user.message` branch of\n * `POST /sessions/:id/events` and the first-party MCP `session_send_message`\n * tool: resource/tool validation, usage limits, the locked append + turn\n * enqueue, and usage recording. `toolsProvided: false` durably preserves an\n * Tool selection is durable session state and never rides a follow-up prompt.\n */\nexport async function acceptSessionUserMessageWithOutcome(\n  deps: AcceptSessionUserMessageDependencies,\n  grant: AccessGrant,\n  workspaceId: string,\n  sessionId: string,\n  input: {\n    text: string;\n    annotations?: SubmittedTimelineAnnotation[];\n    turnInstructions?: string | null;\n    resources?: ResourceRef[];\n    model?: string | null;\n    reasoningEffort?: ReasoningEffort | null;\n    latencyMode?: \"standard\" | \"priority\" | \"fast\" | null;\n    clientEventId?: string;\n    mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[];\n    delivery?: \"send\" | \"steer\";\n    origin?: \"human\" | \"operator\";\n    controlEtag?: string | null;\n    expectedDraftRevision?: number | null;\n  },\n): Promise<{\n  accepted: SessionEvent;\n  turn: SessionTurn;\n  interruptionCount: number;\n  replay: boolean;\n}> {\n  const { settings, db, bus, workflowClient, objectStorage } = deps;\n  const delegatedServiceInitiator = serviceInitiatorForGrant(grant);\n  await requireSessionAuthorization(deps, grant, {\n    sessionId,\n    operation: input.delivery === \"steer\" ? \"session.steer\" : \"session.append\",\n    surface: \"core\",\n  });\n  // Hoisted above requireLimit so the codex-billed predicate can resolve the\n  // turn's effective model (a follow-up turn inherits the session's model). A\n  // pure read with no side effects.\n  const existingSession = await requireSession(db, workspaceId, sessionId);\n  const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;\n  const effectiveModel =\n    canonicalConfiguredModel(settings, requestedModel ?? existingSession.model) ?? null;\n  if (effectiveModel === null) {\n    throw new Error(\"effective follow-up model unexpectedly resolved to null\");\n  }\n  try {\n    assertSessionAllowsProductModel(existingSession, effectiveModel);\n  } catch (error) {\n    if (error instanceof CodexCompactionV2ProviderLockedError) {\n      throw new HTTPException(422, { message: error.message, cause: error });\n    }\n    throw error;\n  }\n  const sessionReasoningEffort = reasoningEffortForSession(\n    existingSession.metadata,\n    settings.openaiReasoningEffort,\n  );\n  const effectiveReasoningEffort = input.reasoningEffort ?? sessionReasoningEffort;\n  const sessionLatencyMode = latencyModeForSession(existingSession.metadata, \"standard\");\n  const effectiveLatencyMode = input.latencyMode ?? sessionLatencyMode;\n  const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {\n    modelId: effectiveModel,\n    requestedModelId: input.model ?? null,\n    modelSource: input.model == null ? \"session\" : \"explicit\",\n    reasoningEffort: effectiveReasoningEffort,\n    reasoningSource: input.reasoningEffort == null ? \"session\" : \"explicit\",\n    latencyMode: effectiveLatencyMode,\n    latencyModeSource: input.latencyMode == null ? \"session\" : \"explicit\",\n  });\n  const requestedResources = normalizeResources(input.resources ?? []);\n  const annotations = await validateSubmittedTimelineAnnotations(\n    db,\n    workspaceId,\n    sessionId,\n    input.annotations ?? [],\n  );\n  await requireLimit(deps, {\n    accountId: grant.accountId,\n    workspaceId,\n    action: \"agent_run:create\",\n    quantity: 1,\n    model: effectiveModel,\n  });\n  if (requestedResources.some((resource) => resource.kind === \"file\") && !objectStorage) {\n    throw new HTTPException(503, {\n      message: \"object storage is not configured\",\n    });\n  }\n  await validateFileResources(db, workspaceId, requestedResources);\n  await validateGitHubRepositorySelection(db, workspaceId, [\n    ...existingSession.resources,\n    ...requestedResources,\n  ]);\n  const mcpCredentialUpdates = validateSessionMcpCredentialUpdates({\n    settings,\n    grant,\n    session: existingSession,\n    updates: input.mcpCredentialUpdates ?? [],\n  });\n  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {\n    subjectId: grant.subjectId,\n  });\n  const personalConnectionDelegations = await freezePersonalConnectionDelegations({\n    db,\n    workspaceId,\n    settings: runtimeSettings,\n    tools: existingSession.tools,\n    source: personalConnectionDelegationSourceForGrant(grant),\n  });\n  const { accepted, turn, interruptionCount, replay } = await postUserMessageTurn({\n    db,\n    bus,\n    workflowClient,\n    settings,\n    accountId: grant.accountId,\n    workspaceId,\n    sessionId,\n    text: input.text,\n    annotations,\n    turnInstructions: input.turnInstructions ?? null,\n    resources: requestedResources,\n    model: input.model ?? null,\n    reasoningEffort: input.reasoningEffort ?? null,\n    latencyMode: input.latencyMode ?? null,\n    reasoningEffortFallback: sessionReasoningEffort,\n    turnExecutionPolicy,\n    mcpCredentialUpdates,\n    personalConnectionDelegations,\n    delivery: input.delivery ?? \"send\",\n    origin: delegatedServiceInitiator ? \"operator\" : (input.origin ?? \"human\"),\n    actor: grant.subjectId,\n    ...(grant.subjectLabel ? { actorLabel: grant.subjectLabel } : {}),\n    ...(delegatedServiceInitiator\n      ? {\n          commandActor: {\n            type: \"service\" as const,\n            subjectId: delegatedServiceInitiator.initiator.subjectId,\n            ...(delegatedServiceInitiator.initiator.label\n              ? { subjectLabel: delegatedServiceInitiator.initiator.label }\n              : {}),\n            context: delegatedServiceInitiator.context,\n          },\n        }\n      : {}),\n    ...(input.controlEtag !== undefined ? { controlEtag: input.controlEtag } : {}),\n    ...(input.expectedDraftRevision !== undefined\n      ? { expectedDraftRevision: input.expectedDraftRevision }\n      : {}),\n    ...(input.clientEventId ? { clientEventId: input.clientEventId } : {}),\n    recordAgentRunUsage: true,\n    ...(deps.schedulePromptPostCommit ? { schedulePostCommit: deps.schedulePromptPostCommit } : {}),\n  });\n  return { accepted, turn, interruptionCount, replay };\n}\n\n/** Backward-compatible entity-returning path used by existing REST callers. */\nexport async function acceptSessionUserMessage(\n  deps: Parameters<typeof acceptSessionUserMessageWithOutcome>[0],\n  grant: Parameters<typeof acceptSessionUserMessageWithOutcome>[1],\n  workspaceId: Parameters<typeof acceptSessionUserMessageWithOutcome>[2],\n  sessionId: Parameters<typeof acceptSessionUserMessageWithOutcome>[3],\n  input: Parameters<typeof acceptSessionUserMessageWithOutcome>[4],\n): Promise<{\n  accepted: SessionEvent;\n  turn: SessionTurn;\n  interruptionCount: number;\n  replay: boolean;\n}> {\n  const { accepted, turn, interruptionCount, replay } = await acceptSessionUserMessageWithOutcome(\n    deps,\n    grant,\n    workspaceId,\n    sessionId,\n    input,\n  );\n  return { accepted, turn, interruptionCount, replay };\n}\n\n/**\n * Shared title-write path for the manual rename route AND both MCP tools\n * (set_session_title / set_other_session_title). The clobber guard lives in\n * the db `updateSessionTitle` UPDATE: an agent write is skipped when a user\n * title already pinned the session. On a real write we emit `session.title_set`\n * exactly like goal mutations emit their events; when nothing changed (agent\n * write blocked by the user lock) we emit nothing. Returns whether a write\n * happened so callers can avoid double work.\n */\nexport async function updateSessionTitle(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  grant: AccessGrant,\n  sessionId: string,\n  title: string,\n  source: \"user\" | \"agent\",\n): Promise<{\n  updated: boolean;\n  title: string | null;\n  relatedSessionAccess: \"target\" | \"root\";\n}> {\n  const { db, bus } = deps;\n  const authorization = await requireSessionAuthorization(deps, grant, {\n    sessionId,\n    operation: \"session.title.write\",\n    surface: \"core\",\n  });\n  const workspaceId = grant.workspaceId;\n  const result = await updateSessionTitleRow(db, {\n    workspaceId,\n    sessionId,\n    title,\n    source,\n  });\n  if (result.updated) {\n    await appendAndPublishEvents(db, bus, workspaceId, sessionId, [\n      {\n        type: \"session.title_set\",\n        payload: {\n          title: result.title ?? title,\n          source,\n        },\n      },\n    ]);\n  }\n  return {\n    ...result,\n    relatedSessionAccess: authorization?.relatedSessionAccess ?? \"root\",\n  };\n}\n\n/**\n * Update one existing session MCP server's approval policy. The database\n * serializes this write with attempt claim under the session lock: an already\n * claimed attempt retains its immutable snapshot, while the next claim captures\n * this value. No attempt is cancelled, restarted, or reinterpreted.\n */\nexport async function updateSessionMcpApprovalPolicy(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  grant: AccessGrant,\n  sessionId: string,\n  serverId: string,\n  requireApproval: SessionMcpApprovalPolicy,\n): Promise<UpdateSessionMcpApprovalPolicyResponse> {\n  const normalizedPolicy = SessionMcpApprovalPolicy.parse(requireApproval);\n  await requireSessionAuthorization(deps, grant, {\n    sessionId,\n    operation: \"session.mcp.approval_policy.write\",\n    surface: \"core\",\n  });\n  requirePermission(grant, \"sessions:control\");\n\n  const outcome: { server?: SessionMcpServerMetadata } = {};\n  const events = await appendSessionEventsWithLockedSessionUpdate(\n    deps.db,\n    grant.workspaceId,\n    sessionId,\n    async (_session, context) => {\n      const result = await context.updateSessionMcpApprovalPolicy(serverId, normalizedPolicy);\n      if (!result.server) {\n        throw new HTTPException(404, {\n          message: \"session MCP server not found\",\n        });\n      }\n      outcome.server = result.server;\n      return {\n        events: result.changed\n          ? [\n              {\n                type: \"session.mcp.approval_policy.updated\" as const,\n                payload: {\n                  serverId,\n                  effectiveFrom: \"next_attempt\",\n                },\n              },\n            ]\n          : [],\n      };\n    },\n    { activity: \"semantic\" },\n  );\n  const updatedServer = outcome.server;\n  if (!updatedServer) {\n    throw new Error(\"session MCP approval policy update returned no server\");\n  }\n  await publishDurableSessionEvents(deps.bus, grant.workspaceId, sessionId, events);\n  return {\n    server: updatedServer,\n    effectiveFrom: \"next_attempt\",\n  };\n}\n\nfunction toolPolicyAuditSnapshot(\n  session: Session,\n  tools: ToolRef[],\n  firstPartyMcpTools: FirstPartyMcpToolName[],\n  policy = session.toolPolicy,\n) {\n  // Tool policy refs contain only public server ids and the optional/strict\n  // execution mode; they never carry URLs, names, headers, credentials,\n  // schemas, or arguments. The request is capped at 64 refs and the mandatory\n  // first-party server can add one more, so the complete snapshot remains a\n  // small bounded payload rather than silently dropping security-relevant\n  // optional/strict changes.\n  const allToolRefs = mergeToolRefs([], tools)\n    .sort((left, right) => {\n      // Keep the mandatory first-party authority visible even when the\n      // bounded audit preview has to omit the middle of a large selection.\n      const leftMandatory = left.kind === \"mcp\" && left.id === \"opengeni\";\n      const rightMandatory = right.kind === \"mcp\" && right.id === \"opengeni\";\n      if (leftMandatory !== rightMandatory) return leftMandatory ? -1 : 1;\n      return `${left.kind}:${left.id}`.localeCompare(`${right.kind}:${right.id}`);\n    })\n    .map((tool) => ({\n      kind: tool.kind,\n      id: tool.id,\n      ...(tool.optional === undefined ? {} : { optional: tool.optional }),\n    }));\n  const toolRefs = allToolRefs.slice(0, maxToolPolicyAuditRefs);\n  return {\n    mode: policy.mode,\n    inheritedFromSessionId: policy.inheritedFromSessionId,\n    // IDs only: no MCP URLs, names, headers, credentials, schemas, or args.\n    toolIds: [...toolRefs]\n      .sort((left, right) => `${left.kind}:${left.id}`.localeCompare(`${right.kind}:${right.id}`))\n      .map((tool) => tool.id),\n    toolRefs,\n    toolCount: allToolRefs.length,\n    firstPartyMcpTools: [...firstPartyMcpTools].sort(),\n    firstPartyMcpToolCount: firstPartyMcpTools.length,\n    truncated: allToolRefs.length > toolRefs.length,\n  };\n}\n\n/**\n * Replace the durable session tool policy. The target and its parent (when\n * present) are locked by the DB event-writer helper, and the update/event are\n * committed under one version-fenced transaction. An already claimed turn\n * keeps its immutable snapshot; the next attempt observes this policy.\n */\nexport async function updateSessionToolPolicy(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    settings: Settings;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  grant: AccessGrant,\n  sessionId: string,\n  request: UpdateSessionToolPolicyRequest,\n): Promise<Session> {\n  await requireSessionAuthorization(deps, grant, {\n    sessionId,\n    operation: \"session.tool_policy.write\",\n    surface: \"core\",\n  });\n  requirePermission(grant, \"sessions:control\");\n\n  const existingSession = await requireSession(deps.db, grant.workspaceId, sessionId);\n  const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(\n    deps.db,\n    grant.workspaceId,\n    deps.settings,\n    { subjectId: grant.subjectId },\n  );\n  const runtimeSettings = settingsWithSessionMcpServerMetadata(\n    capabilityRuntimeSettings,\n    existingSession.mcpServers,\n  );\n  const explicitRequest = request.mode === \"workspace_default\" ? null : request;\n  const requestedMode = explicitRequest ? \"explicit\" : \"workspace_default\";\n  const explicitRequestedTools = explicitRequest\n    ? (() => {\n        const validatedTools = validateToolRefs(explicitRequest.tools, runtimeSettings);\n        const validatedIds = new Set(validatedTools.map((tool) => `${tool.kind}:${tool.id}`));\n        const unknown = explicitRequest.tools.find(\n          (tool) => !validatedIds.has(`${tool.kind}:${tool.id}`),\n        );\n        if (unknown) {\n          throw new HTTPException(422, {\n            message: `unknown MCP server id: ${unknown.id}`,\n          });\n        }\n        return withFirstPartyTools(validatedTools, runtimeSettings);\n      })()\n    : null;\n  const explicitRequestedFirstPartyTools = explicitRequest\n    ? [...explicitRequest.firstPartyMcpTools]\n    : null;\n  const deploymentFirstPartyMcpToolPolicy = resolveFirstPartyMcpToolPolicy(deps.settings);\n  const disallowedFirstPartyMcpTool = explicitRequestedFirstPartyTools?.find(\n    (tool) => !deploymentFirstPartyMcpToolPolicy.allowed.includes(tool),\n  );\n  if (disallowedFirstPartyMcpTool) {\n    throw new HTTPException(422, {\n      message: `first-party MCP tool is disabled by deployment policy: ${disallowedFirstPartyMcpTool}`,\n    });\n  }\n  const workspaceDefaultTools = withFirstPartyTools(\n    withDefaultEnabledCapabilityMcpTools([], deps.settings, capabilityRuntimeSettings),\n    runtimeSettings,\n  );\n  const workspaceDefaultFirstPartyTools = [...deploymentFirstPartyMcpToolPolicy.default];\n  const events = await appendSessionEventsWithLockedSessionUpdate(\n    deps.db,\n    grant.workspaceId,\n    sessionId,\n    async (session, context) => {\n      const currentVersion = session.toolPolicyVersion ?? 1;\n      if (request.expectedVersion !== currentVersion) {\n        throw new SessionToolPolicyVersionConflictError(currentVersion);\n      }\n\n      let nextTools: ToolRef[];\n      let nextFirstPartyMcpTools: FirstPartyMcpToolName[];\n      let nextPolicy: SessionToolPolicy;\n      if (session.parentSessionId) {\n        const parent = await context.getLockedSession(session.parentSessionId);\n        if (!parent) {\n          throw new HTTPException(409, {\n            message: \"parent session is no longer available\",\n          });\n        }\n        const parentTracksWorkspaceDefaults = parent.toolPolicy?.mode === \"workspace_default\";\n        const parentEffective = withFirstPartyTools(\n          parentTracksWorkspaceDefaults\n            ? withDefaultEnabledCapabilityMcpTools(\n                availableToolRefs(parent.tools, runtimeSettings),\n                deps.settings,\n                runtimeSettings,\n              )\n            : parent.tools,\n          runtimeSettings,\n        );\n        const deploymentAllowedFirstPartyMcpTools = new Set(\n          deploymentFirstPartyMcpToolPolicy.allowed,\n        );\n        const parentFirstPartyMcpTools = [\n          ...(parent.firstPartyMcpTools ?? deploymentFirstPartyMcpToolPolicy.default),\n        ].filter((tool) => deploymentAllowedFirstPartyMcpTools.has(tool));\n        if (requestedMode === \"workspace_default\") {\n          if (!parentTracksWorkspaceDefaults) {\n            throw new HTTPException(403, {\n              message:\n                \"a child may adopt workspace defaults only while its parent tracks workspace defaults\",\n            });\n          }\n          nextTools = parentEffective;\n          nextFirstPartyMcpTools = parentFirstPartyMcpTools;\n          nextPolicy = {\n            mode: \"workspace_default\",\n            inheritedFromSessionId: parent.id,\n          };\n        } else {\n          nextTools = explicitRequestedTools!;\n          assertToolRefsSubset(\n            nextTools,\n            parentEffective,\n            \"session tools may only narrow the parent session tool policy\",\n          );\n          const parentFirstPartySet = new Set(parentFirstPartyMcpTools);\n          const widenedFirstPartyTool = explicitRequestedFirstPartyTools!.find(\n            (tool) => !parentFirstPartySet.has(tool),\n          );\n          if (widenedFirstPartyTool) {\n            throw new HTTPException(403, {\n              message: `session OpenGeni tools may only narrow the parent policy: ${widenedFirstPartyTool}`,\n            });\n          }\n          nextFirstPartyMcpTools = explicitRequestedFirstPartyTools!;\n          nextPolicy = {\n            mode: \"explicit\",\n            inheritedFromSessionId: parent.id,\n          };\n        }\n      } else {\n        nextTools =\n          requestedMode === \"workspace_default\" ? workspaceDefaultTools : explicitRequestedTools!;\n        nextFirstPartyMcpTools =\n          requestedMode === \"workspace_default\"\n            ? workspaceDefaultFirstPartyTools\n            : explicitRequestedFirstPartyTools!;\n        nextPolicy = { mode: requestedMode, inheritedFromSessionId: null };\n      }\n\n      const currentPolicy = session.toolPolicy;\n      // JSONB normalizes object-key order on the round trip, so plain\n      // JSON.stringify would turn an identical retry into a second mutation\n      // (and version bump) merely because the persisted key order differs from\n      // the request object. Compare canonical JSON instead.\n      const unchanged =\n        stableJson({\n          tools: session.tools,\n          firstPartyMcpTools:\n            session.firstPartyMcpTools ?? deploymentFirstPartyMcpToolPolicy.default,\n          policy: currentPolicy,\n        }) ===\n        stableJson({\n          tools: nextTools,\n          firstPartyMcpTools: nextFirstPartyMcpTools,\n          policy: nextPolicy,\n        });\n      if (unchanged) {\n        return { events: [] };\n      }\n\n      const nextVersion = currentVersion + 1;\n      return {\n        events: [\n          {\n            type: \"session.tool_policy.updated\" as const,\n            payload: {\n              before: toolPolicyAuditSnapshot(\n                session,\n                session.tools,\n                [...(session.firstPartyMcpTools ?? deploymentFirstPartyMcpToolPolicy.default)],\n                currentPolicy,\n              ),\n              after: toolPolicyAuditSnapshot(\n                session,\n                nextTools,\n                nextFirstPartyMcpTools,\n                nextPolicy,\n              ),\n              version: nextVersion,\n              effectiveFrom: \"next_attempt\",\n            },\n          },\n        ],\n        update: {\n          tools: nextTools,\n          firstPartyMcpTools: nextFirstPartyMcpTools,\n          toolPolicy: nextPolicy,\n          toolPolicyVersion: nextVersion,\n          expectedToolPolicyVersion: request.expectedVersion,\n        },\n      };\n    },\n    { activity: \"semantic\", lockParentSession: true },\n  );\n  if (events.length > 0) {\n    await publishDurableSessionEvents(deps.bus, grant.workspaceId, sessionId, events);\n  }\n  return await requireSession(deps.db, grant.workspaceId, sessionId);\n}\n\nexport async function readSessionLineage(\n  deps: Pick<ApiRouteDeps, \"db\" | \"sessionAuthorization\">,\n  grant: AccessGrant,\n  sessionId: string,\n) {\n  const authorization = await requireSessionAuthorization(deps, grant, {\n    sessionId,\n    operation: \"session.lineage.read\",\n    surface: \"core\",\n  });\n  if (authorization?.relatedSessionAccess === \"target\") {\n    const session = await getSession(deps.db, grant.workspaceId, sessionId);\n    if (!session) {\n      throw new HTTPException(404, { message: \"session not found\" });\n    }\n    return { ancestors: [], children: [], truncated: false };\n  }\n  const lineage = await getSessionLineage(deps.db, grant.workspaceId, sessionId);\n  if (!lineage) {\n    throw new HTTPException(404, { message: \"session not found\" });\n  }\n  return lineage;\n}\n\nfunction withFirstPartyTools(\n  tools: ToolRef[],\n  runtimeSettings: { mcpServers: Array<{ id: string }> },\n): ToolRef[] {\n  if (!runtimeSettings.mcpServers.some((server) => server.id === \"opengeni\")) {\n    return tools;\n  }\n  return mergeToolRefs(tools, [{ kind: \"mcp\", id: \"opengeni\" }]);\n}\n\nfunction hasOwnProperty(value: unknown, key: string): boolean {\n  return Boolean(\n    value && typeof value === \"object\" && Object.prototype.hasOwnProperty.call(value, key),\n  );\n}\n","import {\n  DraftTimelineAnnotations,\n  SubmittedTimelineAnnotations,\n  numberTimelineAnnotations,\n  type DraftTimelineAnnotation,\n  type SessionEvent,\n  type SubmittedTimelineAnnotation,\n  type TimelineAnnotation,\n} from \"@opengeni/contracts\";\nimport { getSessionEvent, type Database } from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\n\nconst SOURCE_CONTEXT_BYTES = 160;\nconst ANSI_SEQUENCE = new RegExp(\"\\\\u001B\\\\[[0-?]*[ -/]*[@-~]\", \"g\");\n\ntype AnnotationValidationOptions = {\n  requireNotes: boolean;\n};\n\nfunction invalidAnnotationSource(): never {\n  throw new HTTPException(422, { message: \"Invalid timeline annotation source\" });\n}\n\nfunction safeJson(value: unknown): string {\n  try {\n    return JSON.stringify(value) ?? \"\";\n  } catch {\n    return String(value ?? \"\");\n  }\n}\n\nfunction firstMcpText(value: unknown): string | null {\n  if (!Array.isArray(value)) return null;\n  for (const part of value) {\n    if (\n      part !== null &&\n      typeof part === \"object\" &&\n      (part as { type?: unknown }).type === \"text\" &&\n      typeof (part as { text?: unknown }).text === \"string\"\n    ) {\n      return (part as { text: string }).text;\n    }\n  }\n  return null;\n}\n\nfunction normalizedToolOutput(value: unknown, depth = 0): string {\n  if (depth > 8 || value === null || value === undefined)\n    return value == null ? \"\" : safeJson(value);\n  if (typeof value === \"string\") return value;\n  if (typeof value !== \"object\" || Array.isArray(value)) return safeJson(value);\n  const record = value as Record<string, unknown>;\n  if (record.type === \"text\" && typeof record.text === \"string\") return record.text;\n  const contentText = firstMcpText(record.content);\n  if (contentText !== null) return contentText;\n  if (\"structuredContent\" in record) {\n    return contentText ?? normalizedToolOutput(record.structuredContent, depth + 1);\n  }\n  if (\"result\" in record) return normalizedToolOutput(record.result, depth + 1);\n  return safeJson(value);\n}\n\nfunction stripExecBanner(text: string): string {\n  const marker = text.indexOf(\"\\nOutput:\\n\");\n  if (marker >= 0) return text.slice(marker + \"\\nOutput:\\n\".length);\n  return text.startsWith(\"Output:\\n\") ? text.slice(\"Output:\\n\".length) : text;\n}\n\nexport function timelineAnnotationSourceText(event: SessionEvent): string | null {\n  if (!event.payload || typeof event.payload !== \"object\" || Array.isArray(event.payload)) {\n    return null;\n  }\n  const payload = event.payload as Record<string, unknown>;\n  if (event.type === \"user.message\" || event.type === \"agent.message.completed\") {\n    return typeof payload.text === \"string\" ? payload.text : null;\n  }\n  if (event.type !== \"agent.toolCall.output\") return null;\n  const output = Object.prototype.hasOwnProperty.call(payload, \"output\")\n    ? payload.output\n    : payload.preview;\n  const text = stripExecBanner(normalizedToolOutput(output)).replace(ANSI_SEQUENCE, \"\");\n  return text.length > 0 ? text : null;\n}\n\nfunction utf8Prefix(value: string, maxBytes: number): string {\n  let output = \"\";\n  let bytes = 0;\n  for (const character of value) {\n    const next = new TextEncoder().encode(character).byteLength;\n    if (bytes + next > maxBytes) break;\n    output += character;\n    bytes += next;\n  }\n  return output;\n}\n\nfunction utf8Suffix(value: string, maxBytes: number): string {\n  let output = \"\";\n  let bytes = 0;\n  for (const character of [...value].reverse()) {\n    const next = new TextEncoder().encode(character).byteLength;\n    if (bytes + next > maxBytes) break;\n    output = character + output;\n    bytes += next;\n  }\n  return output;\n}\n\nfunction candidateOffsets(sourceText: string, quote: string): number[] {\n  const matches: number[] = [];\n  let cursor = 0;\n  while (cursor <= sourceText.length - quote.length) {\n    const index = sourceText.indexOf(quote, cursor);\n    if (index < 0) break;\n    matches.push(index);\n    cursor = index + 1;\n  }\n  return matches;\n}\n\nfunction resolveQuoteOffset(sourceText: string, annotation: DraftTimelineAnnotation): number {\n  const { source, quote } = annotation;\n  if (\n    source.endOffset - source.startOffset === quote.length &&\n    sourceText.slice(source.startOffset, source.endOffset) === quote\n  ) {\n    return source.startOffset;\n  }\n  const matches = candidateOffsets(sourceText, quote);\n  if (matches.length === 1) return matches[0]!;\n  const contextual = matches.filter((start) => {\n    const before = sourceText.slice(Math.max(0, start - source.contextBefore.length), start);\n    const after = sourceText.slice(\n      start + quote.length,\n      start + quote.length + source.contextAfter.length,\n    );\n    return before === source.contextBefore && after === source.contextAfter;\n  });\n  if (contextual.length === 1) return contextual[0]!;\n  return invalidAnnotationSource();\n}\n\nasync function validateTimelineAnnotations(\n  db: Database,\n  workspaceId: string,\n  sessionId: string,\n  annotations: readonly DraftTimelineAnnotation[],\n  options: AnnotationValidationOptions,\n): Promise<DraftTimelineAnnotation[]> {\n  const parsed = options.requireNotes\n    ? SubmittedTimelineAnnotations.parse(annotations)\n    : DraftTimelineAnnotations.parse(annotations);\n  const validated: DraftTimelineAnnotation[] = [];\n  for (const annotation of parsed) {\n    const event = await getSessionEvent(db, workspaceId, annotation.source.eventId);\n    if (\n      !event ||\n      event.sessionId !== sessionId ||\n      event.type !== annotation.source.eventType ||\n      event.sequence !== annotation.source.sequence ||\n      (event.turnId ?? null) !== annotation.source.turnId\n    ) {\n      invalidAnnotationSource();\n    }\n    const sourceText = timelineAnnotationSourceText(event);\n    if (sourceText === null) invalidAnnotationSource();\n    const startOffset = resolveQuoteOffset(sourceText, annotation);\n    const endOffset = startOffset + annotation.quote.length;\n    validated.push({\n      ...annotation,\n      source: {\n        ...annotation.source,\n        startOffset,\n        endOffset,\n        contextBefore: utf8Suffix(sourceText.slice(0, startOffset), SOURCE_CONTEXT_BYTES),\n        contextAfter: utf8Prefix(sourceText.slice(endOffset), SOURCE_CONTEXT_BYTES),\n      },\n    });\n  }\n  return validated;\n}\n\nexport async function validateDraftTimelineAnnotations(\n  db: Database,\n  workspaceId: string,\n  sessionId: string,\n  annotations: readonly DraftTimelineAnnotation[],\n): Promise<DraftTimelineAnnotation[]> {\n  return await validateTimelineAnnotations(db, workspaceId, sessionId, annotations, {\n    requireNotes: false,\n  });\n}\n\nexport async function validateSubmittedTimelineAnnotations(\n  db: Database,\n  workspaceId: string,\n  sessionId: string,\n  annotations: readonly SubmittedTimelineAnnotation[],\n): Promise<TimelineAnnotation[]> {\n  const validated = await validateTimelineAnnotations(db, workspaceId, sessionId, annotations, {\n    requireNotes: true,\n  });\n  return numberTimelineAnnotations(validated as SubmittedTimelineAnnotation[]);\n}\n","import {\n  OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,\n  OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,\n  OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,\n  OpenGeniSlackBotConnectionMetadata,\n  areOpenGeniSlackBotScopesAccepted,\n  type AccessGrant,\n  type ConnectionMetadata,\n  type OpenGeniSlackBotConnectionMetadata as OpenGeniSlackBotMetadata,\n  type Session,\n} from \"@opengeni/contracts\";\nimport {\n  getConnectionMetadata,\n  type ConnectionMetadataWithVerification,\n  type Database,\n} from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\nimport { requirePermission } from \"../access\";\n\nexport function openGeniSlackBotMetadata(\n  metadata: Record<string, unknown>,\n): OpenGeniSlackBotMetadata | null {\n  const parsed = OpenGeniSlackBotConnectionMetadata.safeParse(metadata);\n  return parsed.success ? parsed.data : null;\n}\n\nexport function isOpenGeniSlackBotConnection(\n  connection: ConnectionMetadata &\n    Partial<\n      Pick<ConnectionMetadataWithVerification, \"verifiedInstallAt\" | \"verifiedInstallVersion\">\n    >,\n): boolean {\n  return (\n    connection.verifiedInstallAt != null &&\n    connection.verifiedInstallVersion === connection.version &&\n    connection.subjectId === null &&\n    connection.providerDomain === \"slack.com\" &&\n    connection.kind === \"app_install\" &&\n    areOpenGeniSlackBotScopesAccepted(connection.grantedScopes) &&\n    openGeniSlackBotMetadata(connection.metadata)?.credentialRole ===\n      OPENGENI_SLACK_BOT_CREDENTIAL_ROLE\n  );\n}\n\nexport function hasReservedOpenGeniSlackBotMetadata(\n  metadata: Record<string, unknown> | null | undefined,\n): boolean {\n  return (\n    metadata?.credentialRole === OPENGENI_SLACK_BOT_CREDENTIAL_ROLE ||\n    metadata?.credentialLabel === OPENGENI_SLACK_BOT_CREDENTIAL_LABEL\n  );\n}\n\nexport function hasReservedOpenGeniSlackBotSessionMetadata(\n  metadata: Record<string, unknown> | null | undefined,\n): boolean {\n  return Boolean(\n    metadata &&\n    Object.prototype.hasOwnProperty.call(metadata, OPENGENI_SLACK_BOT_SESSION_METADATA_KEY),\n  );\n}\n\n/**\n * Internal, pre-authorized lookup used by the scheduler and Slack tool adapter.\n * Public callers must perform their permission check before calling this helper.\n */\nexport async function requireOpenGeniSlackBotConnection(\n  db: Database,\n  workspaceId: string,\n  connectionId: string,\n): Promise<ConnectionMetadata> {\n  const connection = await getConnectionMetadata(db, workspaceId, connectionId, null);\n  if (!connection || !isOpenGeniSlackBotConnection(connection)) {\n    throw new HTTPException(422, {\n      message: \"slackBotConnectionId must reference an OpenGeni Slack bot connection\",\n    });\n  }\n  if (connection.status !== \"active\") {\n    throw new HTTPException(422, {\n      message: `OpenGeni Slack bot connection is not active (${connection.status})`,\n    });\n  }\n  return connection;\n}\n\nexport async function validateOpenGeniSlackBotConnectionSelection(\n  db: Database,\n  grant: AccessGrant,\n  workspaceId: string,\n  connectionId: string,\n): Promise<ConnectionMetadata> {\n  requirePermission(grant, \"connections:read\");\n  return await requireOpenGeniSlackBotConnection(db, workspaceId, connectionId);\n}\n\nexport function scheduledSlackBotConnectionId(\n  metadata: Record<string, unknown> | null | undefined,\n): string | null {\n  const value = metadata?.[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];\n  return typeof value === \"string\" && zUuid(value) ? value : null;\n}\n\n/**\n * The scheduler writes the connection pointer together with immutable creator\n * provenance. Requiring both prevents ordinary session metadata from becoming\n * an authorization mechanism for a workspace-shared bot credential.\n */\nexport function isTrustedScheduledSlackBotSession(\n  session: Pick<Session, \"createdBy\" | \"createdByContext\" | \"metadata\">,\n): boolean {\n  const scheduledTaskId = session.metadata.scheduledTaskId;\n  const scheduledTaskRunId = session.metadata.scheduledTaskRunId;\n  return (\n    session.createdBy?.kind === \"service\" &&\n    session.createdBy.subjectId === \"scheduler\" &&\n    typeof scheduledTaskId === \"string\" &&\n    zUuid(scheduledTaskId) &&\n    typeof scheduledTaskRunId === \"string\" &&\n    zUuid(scheduledTaskRunId) &&\n    session.createdByContext.scheduledTaskId === scheduledTaskId &&\n    session.createdByContext.scheduledTaskRunId === scheduledTaskRunId &&\n    scheduledSlackBotConnectionId(session.metadata) !== null\n  );\n}\n\nfunction zUuid(value: string): boolean {\n  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);\n}\n","import { configuredStaticUsageLimits, type Settings } from \"@opengeni/config\";\nimport {\n  WorkspaceInsightsSnapshot,\n  type InsightsRange,\n  type WorkspaceInsightsResponse,\n} from \"@opengeni/contracts\";\nimport {\n  aggregateModelCallFacts,\n  aggregateModelCallFactsByDay,\n  aggregateModelCallFactsByHour,\n  aggregateRootSessionDrivers,\n  aggregateScheduleFacts,\n  aggregateSessionDepth,\n  aggregateWarmSecondsByGroup,\n  countOnlineMachines,\n  countScheduledTaskFires,\n  countSessionsAttachedToGroups,\n  enumerateUtcDays,\n  enumerateUtcHours,\n  listFloorSessions,\n  listLiveWarmLeases,\n  listModelCallFacets,\n  listRecentModelCalls,\n  listScheduledTasks,\n  requireWorkspace,\n  sumUsageQuantity,\n  sumUsageQuantityByDay,\n  sumUsageQuantityByHour,\n  sumUsageQuantityInRange,\n  type Database,\n} from \"@opengeni/db\";\n\nconst MACHINE_HEARTBEAT_FRESH_MS = 120_000;\n\nexport type GetWorkspaceInsightsInput = {\n  workspaceId: string;\n  range: InsightsRange;\n  provider?: string | null;\n  model?: string | null;\n  now?: Date;\n};\n\nfunction microsToUsd(micros: number): number {\n  return micros / 1_000_000;\n}\n\nfunction cacheHitPct(cached: number, input: number): number {\n  if (input <= 0) return 0;\n  return Math.min(100, Math.max(0, Math.round((cached / input) * 100)));\n}\n\nfunction startOfUtcDay(date: Date): Date {\n  return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate()));\n}\n\nfunction startOfUtcMonth(date: Date): Date {\n  return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), 1));\n}\n\nfunction startOfUtcYear(date: Date): Date {\n  return new Date(Date.UTC(date.getUTCFullYear(), 0, 1));\n}\n\nfunction resolveRangeWindow(\n  range: InsightsRange,\n  now: Date,\n): {\n  since: Date;\n  until: Date;\n  priorSince: Date;\n  priorUntil: Date;\n  rangeLabel: string;\n  priorLabel: string;\n  seriesLabel: string;\n  cacheSeriesLabel: string;\n} {\n  const until = now;\n  let since: Date;\n  let rangeLabel: string;\n  let priorLabel: string;\n  let seriesLabel: string;\n  let cacheSeriesLabel: string;\n  switch (range) {\n    case \"today\":\n      since = startOfUtcDay(now);\n      rangeLabel = \"Today (UTC)\";\n      priorLabel = \"Prior equal window\";\n      seriesLabel = \"Credit $ / UTC hour\";\n      cacheSeriesLabel = \"Cache hit % / UTC hour\";\n      break;\n    case \"week\":\n      since = new Date(startOfUtcDay(now).getTime() - 6 * 24 * 60 * 60 * 1000);\n      rangeLabel = \"Last 7 days (UTC)\";\n      priorLabel = \"Prior 7 days\";\n      seriesLabel = \"Credit $ / UTC day\";\n      cacheSeriesLabel = \"Cache hit % / UTC day\";\n      break;\n    case \"month\":\n      since = startOfUtcMonth(now);\n      rangeLabel = \"This month (UTC)\";\n      priorLabel = \"Prior equal window\";\n      seriesLabel = \"Credit $ / UTC day\";\n      cacheSeriesLabel = \"Cache hit % / UTC day\";\n      break;\n    case \"ytd\":\n      since = startOfUtcYear(now);\n      rangeLabel = \"Year to date (UTC)\";\n      priorLabel = \"Prior equal window\";\n      seriesLabel = \"Credit $ / UTC day\";\n      cacheSeriesLabel = \"Cache hit % / UTC day\";\n      break;\n    default: {\n      const _exhaustive: never = range;\n      throw new Error(`Unknown insights range: ${_exhaustive}`);\n    }\n  }\n  const durationMs = until.getTime() - since.getTime();\n  const priorUntil = since;\n  const priorSince = new Date(priorUntil.getTime() - Math.max(durationMs, 1));\n  return {\n    since,\n    until,\n    priorSince,\n    priorUntil,\n    rangeLabel,\n    priorLabel,\n    seriesLabel,\n    cacheSeriesLabel,\n  };\n}\n\nfunction ageLabel(updatedAt: Date, now: Date): string {\n  const ms = Math.max(0, now.getTime() - updatedAt.getTime());\n  const minutes = Math.floor(ms / 60_000);\n  if (minutes < 1) return \"just now\";\n  if (minutes < 60) return `${minutes}m`;\n  const hours = Math.floor(minutes / 60);\n  if (hours < 48) return `${hours}h`;\n  return `${Math.floor(hours / 24)}d`;\n}\n\nfunction floorState(input: {\n  status: string;\n  directControlState: string;\n}): \"running\" | \"paused\" | \"failed\" | \"idle\" | \"compacting\" | \"waiting\" {\n  if (input.directControlState === \"paused\") return \"paused\";\n  switch (input.status) {\n    case \"running\":\n      return \"running\";\n    case \"failed\":\n      return \"failed\";\n    case \"requires_action\":\n    case \"waiting\":\n      return \"waiting\";\n    case \"compacting\":\n      return \"compacting\";\n    case \"completed\":\n    case \"idle\":\n    case \"queued\":\n      return \"idle\";\n    default:\n      return \"idle\";\n  }\n}\n\nfunction billingPathOf(value: string): \"opengeni_credits\" | \"external\" {\n  return value === \"external\" ? \"external\" : \"opengeni_credits\";\n}\n\nfunction pricingSourceOf(\n  value: string | null,\n): \"configured_list_price\" | \"gateway_reported\" | null {\n  return value === \"configured_list_price\" || value === \"gateway_reported\" ? value : null;\n}\n\nexport async function getWorkspaceInsights(\n  db: Database,\n  settings: Settings,\n  input: GetWorkspaceInsightsInput,\n): Promise<WorkspaceInsightsResponse> {\n  await requireWorkspace(db, input.workspaceId);\n  const now = input.now ?? new Date();\n  const window = resolveRangeWindow(input.range, now);\n  const provider = input.provider?.trim() || null;\n  const model = input.model?.trim() || null;\n  const modelFilterActive = Boolean(provider || model);\n  const filter = { provider, model };\n  const aggregateFactsForSeries =\n    input.range === \"today\" ? aggregateModelCallFactsByHour : aggregateModelCallFactsByDay;\n  const sumUsageForSeries =\n    input.range === \"today\" ? sumUsageQuantityByHour : sumUsageQuantityByDay;\n\n  const [\n    workspaceCreditMicros,\n    priorWorkspaceCreditMicros,\n    warmSeconds,\n    priorWarmSeconds,\n    modelRows,\n    priorModelRows,\n    factDays,\n    warmDays,\n    costDays,\n    warmGroups,\n    liveWarm,\n    rootDrivers,\n    scheduleFacts,\n    tasks,\n    depth,\n    floorRows,\n    machinesOnline,\n    billableTokensUsed,\n    agentRunsUsed,\n    facets,\n    recentCalls,\n  ] = await Promise.all([\n    sumUsageQuantityInRange(db, {\n      workspaceId: input.workspaceId,\n      eventType: \"model.cost\",\n      since: window.since,\n      until: window.until,\n    }),\n    sumUsageQuantityInRange(db, {\n      workspaceId: input.workspaceId,\n      eventType: \"model.cost\",\n      since: window.priorSince,\n      until: window.priorUntil,\n    }),\n    sumUsageQuantityInRange(db, {\n      workspaceId: input.workspaceId,\n      eventType: \"sandbox.warm_seconds\",\n      since: window.since,\n      until: window.until,\n    }),\n    sumUsageQuantityInRange(db, {\n      workspaceId: input.workspaceId,\n      eventType: \"sandbox.warm_seconds\",\n      since: window.priorSince,\n      until: window.priorUntil,\n    }),\n    aggregateModelCallFacts(db, {\n      workspaceId: input.workspaceId,\n      since: window.since,\n      until: window.until,\n      ...filter,\n    }),\n    aggregateModelCallFacts(db, {\n      workspaceId: input.workspaceId,\n      since: window.priorSince,\n      until: window.priorUntil,\n      ...filter,\n    }),\n    aggregateFactsForSeries(db, {\n      workspaceId: input.workspaceId,\n      since: window.since,\n      until: window.until,\n      ...filter,\n    }),\n    sumUsageForSeries(db, {\n      workspaceId: input.workspaceId,\n      eventType: \"sandbox.warm_seconds\",\n      since: window.since,\n      until: window.until,\n    }),\n    sumUsageForSeries(db, {\n      workspaceId: input.workspaceId,\n      eventType: \"model.cost\",\n      since: window.since,\n      until: window.until,\n    }),\n    aggregateWarmSecondsByGroup(db, {\n      workspaceId: input.workspaceId,\n      since: window.since,\n      until: window.until,\n      limit: 24,\n    }),\n    listLiveWarmLeases(db, input.workspaceId),\n    aggregateRootSessionDrivers(db, {\n      workspaceId: input.workspaceId,\n      since: window.since,\n      until: window.until,\n      ...filter,\n      limit: 8,\n    }),\n    aggregateScheduleFacts(db, {\n      workspaceId: input.workspaceId,\n      since: window.since,\n      until: window.until,\n      ...filter,\n    }),\n    listScheduledTasks(db, input.workspaceId, 100),\n    aggregateSessionDepth(db, input.workspaceId),\n    listFloorSessions(db, input.workspaceId, 24),\n    settings.sandboxSelfhostedEnabled\n      ? countOnlineMachines(db, input.workspaceId, MACHINE_HEARTBEAT_FRESH_MS, now)\n      : Promise.resolve(0),\n    sumUsageQuantity(db, {\n      workspaceId: input.workspaceId,\n      eventType: \"model.tokens\",\n      since: startOfUtcMonth(now),\n    }),\n    sumUsageQuantity(db, {\n      workspaceId: input.workspaceId,\n      eventType: \"agent_run.created\",\n      since: startOfUtcMonth(now),\n    }),\n    listModelCallFacets(db, {\n      workspaceId: input.workspaceId,\n      since: window.since,\n      until: window.until,\n    }),\n    listRecentModelCalls(db, {\n      workspaceId: input.workspaceId,\n      since: window.since,\n      until: window.until,\n      ...filter,\n      limit: 50,\n    }),\n  ]);\n\n  const [priorRootDrivers, attached, fireCounts] = await Promise.all([\n    // Exact prior costs for the current top drivers — never a separate top-N page that\n    // drops roots and invents +$full as \"new\" spend.\n    aggregateRootSessionDrivers(db, {\n      workspaceId: input.workspaceId,\n      since: window.priorSince,\n      until: window.priorUntil,\n      ...filter,\n      rootSessionIds: rootDrivers.map((row) => row.rootSessionId),\n    }),\n    countSessionsAttachedToGroups(\n      db,\n      input.workspaceId,\n      warmGroups.map((group) => group.groupId),\n    ),\n    countScheduledTaskFires(db, {\n      workspaceId: input.workspaceId,\n      since: window.since,\n      until: window.until,\n      taskIds: tasks.map((task) => task.id),\n    }),\n  ]);\n  const backendByGroup = new Map(liveWarm.map((lease) => [lease.groupId, lease.backend]));\n  const warmSecondsByGroup = new Map(warmGroups.map((group) => [group.groupId, group.warmSeconds]));\n\n  const models = modelRows\n    .map((row) => ({\n      id: `${row.provider}:${row.model}:${row.billingPath}`,\n      model: row.model,\n      provider: row.provider,\n      billing: billingPathOf(row.billingPath),\n      calls: row.calls,\n      inputTokens: row.inputTokens,\n      outputTokens: row.outputTokens,\n      cachedTokens: row.cachedTokens,\n      cacheInputTokens: row.cacheInputTokens,\n      cacheWriteTokens: row.cacheWriteTokens,\n      reasoningTokens: row.reasoningTokens,\n      totalTokens: row.totalTokens,\n      tokenKnownCalls: row.tokenKnownCalls,\n      cacheKnownCalls: row.cacheKnownCalls,\n      creditUsd: microsToUsd(row.pricedCostMicros),\n      estimatedProviderUsd: microsToUsd(row.estimatedProviderCostMicros),\n      estimatedProviderCostKnownCalls: row.estimatedProviderCostKnownCalls,\n    }))\n    .sort((a, b) => b.totalTokens - a.totalTokens);\n\n  const creditMicros = modelRows.reduce((sum, row) => sum + row.pricedCostMicros, 0);\n  const priorCreditMicros = priorModelRows.reduce((sum, row) => sum + row.pricedCostMicros, 0);\n  const estimatedProviderCostMicros = modelRows.reduce(\n    (sum, row) => sum + row.estimatedProviderCostMicros,\n    0,\n  );\n  const priorEstimatedProviderCostMicros = priorModelRows.reduce(\n    (sum, row) => sum + row.estimatedProviderCostMicros,\n    0,\n  );\n  const estimatedProviderCostKnownCalls = modelRows.reduce(\n    (sum, row) => sum + row.estimatedProviderCostKnownCalls,\n    0,\n  );\n  const priorEstimatedProviderCostKnownCalls = priorModelRows.reduce(\n    (sum, row) => sum + row.estimatedProviderCostKnownCalls,\n    0,\n  );\n  const modelCalls = modelRows.reduce((sum, row) => sum + row.calls, 0);\n  const priorInputTokens = priorModelRows.reduce((sum, row) => sum + row.inputTokens, 0);\n  const priorTotalTokens = priorModelRows.reduce((sum, row) => sum + row.totalTokens, 0);\n  const priorCachedTokens = priorModelRows.reduce((sum, row) => sum + row.cachedTokens, 0);\n  const priorCacheInputTokens = priorModelRows.reduce((sum, row) => sum + row.cacheInputTokens, 0);\n  const priorCalls = priorModelRows.reduce((sum, row) => sum + row.calls, 0);\n\n  const buckets =\n    input.range === \"today\"\n      ? enumerateUtcHours(window.since, window.until)\n      : enumerateUtcDays(window.since, window.until);\n  const series = buckets.map((bucket) => {\n    const facts = factDays.get(bucket) ?? {\n      costMicros: 0,\n      estimatedProviderCostMicros: 0,\n      estimatedProviderCostKnownCalls: 0,\n      inputTokens: 0,\n      outputTokens: 0,\n      cachedTokens: 0,\n      cacheInputTokens: 0,\n      cacheWriteTokens: 0,\n      reasoningTokens: 0,\n      totalTokens: 0,\n      tokenKnownCalls: 0,\n      cacheKnownCalls: 0,\n      calls: 0,\n    };\n    const modelCostMicros = modelFilterActive\n      ? facts.costMicros\n      : (costDays.get(bucket) ?? facts.costMicros);\n    return {\n      label: input.range === \"today\" ? bucket.slice(11) : bucket.slice(5),\n      modelCostUsd: microsToUsd(modelCostMicros),\n      estimatedProviderUsd: microsToUsd(facts.estimatedProviderCostMicros),\n      estimatedProviderCostKnownCalls: facts.estimatedProviderCostKnownCalls,\n      warmSeconds: warmDays.get(bucket) ?? 0,\n      inputTokens: facts.inputTokens,\n      outputTokens: facts.outputTokens,\n      cachedTokens: facts.cachedTokens,\n      cacheInputTokens: facts.cacheInputTokens,\n      cacheWriteTokens: facts.cacheWriteTokens,\n      reasoningTokens: facts.reasoningTokens,\n      totalTokens: facts.totalTokens,\n      tokenKnownCalls: facts.tokenKnownCalls,\n      cacheKnownCalls: facts.cacheKnownCalls,\n      cacheHitPct: cacheHitPct(facts.cachedTokens, facts.cacheInputTokens),\n      calls: facts.calls,\n    };\n  });\n\n  const priorDriverByRoot = new Map(\n    priorRootDrivers.map((row) => [row.rootSessionId, row.pricedCostMicros]),\n  );\n  const totalTokensForPct = Math.max(\n    rootDrivers.reduce((sum, row) => sum + row.totalTokens, 0),\n    1,\n  );\n  const drivers = rootDrivers.map((row) => {\n    const creditUsd = microsToUsd(row.pricedCostMicros);\n    const priorUsd = microsToUsd(priorDriverByRoot.get(row.rootSessionId) ?? 0);\n    return {\n      id: `root:${row.rootSessionId}`,\n      groupBy: \"root_session\" as const,\n      label: row.title?.trim() || row.rootSessionId.slice(0, 8),\n      creditUsd,\n      estimatedProviderUsd: microsToUsd(row.estimatedProviderCostMicros),\n      estimatedProviderCostKnownCalls: row.estimatedProviderCostKnownCalls,\n      tokens: row.totalTokens,\n      cacheHitPct: cacheHitPct(row.cachedTokens, row.cacheInputTokens),\n      pctOfCreditUsd:\n        creditMicros > 0\n          ? Math.min(100, Math.round((row.pricedCostMicros / creditMicros) * 100))\n          : 0,\n      pctOfTokens: Math.min(100, Math.round((row.totalTokens / totalTokensForPct) * 100)),\n      deltaUsdVsPrior: creditUsd - priorUsd,\n    };\n  });\n\n  const scheduleFactById = new Map(scheduleFacts.map((row) => [row.scheduledTaskId, row] as const));\n  const schedules = tasks.map((task) => {\n    const fact = scheduleFactById.get(task.id);\n    return {\n      id: task.id,\n      name: task.name,\n      fires: fireCounts.get(task.id) ?? 0,\n      creditUsd: fact ? microsToUsd(fact.pricedCostMicros) : null,\n      estimatedProviderUsd: fact ? microsToUsd(fact.estimatedProviderCostMicros) : null,\n      estimatedProviderCostKnownCalls: fact ? fact.estimatedProviderCostKnownCalls : null,\n      tokens: fact ? fact.totalTokens : null,\n      cacheHitPct: fact ? cacheHitPct(fact.cachedTokens, fact.cacheInputTokens) : null,\n      billing: fact ? billingPathOf(fact.billingPath) : null,\n    };\n  });\n\n  const limits = configuredStaticUsageLimits(settings);\n  // Floor sessions only carry product model, not provider. Filter when an exact\n  // model is selected; otherwise leave the list workspace-wide (captioned in UI).\n  const floor = floorRows\n    .filter((row) => {\n      if (!model) return true;\n      return row.model === model;\n    })\n    .map((row) => ({\n      id: row.id,\n      title: row.title?.trim() || \"Untitled session\",\n      state: floorState(row),\n      depth: row.nestedAgentDepth,\n      model: row.model,\n      provider: null,\n      ageLabel: ageLabel(row.updatedAt, now),\n      cacheHitPct: null,\n      route: row.sandboxBackend,\n    }));\n\n  const snapshot = WorkspaceInsightsSnapshot.parse({\n    range: input.range,\n    rangeLabel: window.rangeLabel,\n    priorLabel: window.priorLabel,\n    seriesLabel: window.seriesLabel,\n    cacheSeriesLabel: window.cacheSeriesLabel,\n    windowStart: window.since.toISOString(),\n    windowEnd: window.until.toISOString(),\n    generatedAt: now.toISOString(),\n    timezone: \"UTC\",\n    models,\n    facets,\n    series,\n    depth: depth.buckets.map((bucket) => ({\n      depth: bucket.depth,\n      sessions: bucket.sessions,\n    })),\n    drivers,\n    schedules,\n    recentCalls: recentCalls.map((row) => ({\n      id: row.id,\n      occurredAt: row.occurredAt.toISOString(),\n      recordedAt: row.recordedAt.toISOString(),\n      sessionId: row.sessionId,\n      sessionTitle: row.sessionTitle?.trim() || \"Untitled session\",\n      turnId: row.turnId,\n      provider: row.provider,\n      providerApi: row.providerApi,\n      model: row.model,\n      billing: billingPathOf(row.billingPath),\n      inputTokens: row.inputTokens,\n      outputTokens: row.outputTokens,\n      cachedTokens: row.cachedTokens,\n      cacheWriteTokens: row.cacheWriteTokens,\n      reasoningTokens: row.reasoningTokens,\n      totalTokens: row.totalTokens,\n      creditUsd: microsToUsd(row.pricedCostMicros),\n      estimatedProviderUsd:\n        row.estimatedProviderCostMicros == null\n          ? null\n          : microsToUsd(row.estimatedProviderCostMicros),\n      pricingSource: pricingSourceOf(row.pricingSource),\n    })),\n    warmSeconds,\n    priorWarmSeconds,\n    warmGroups: warmGroups.map((group) => ({\n      id: group.groupId,\n      groupId: group.groupId,\n      label: group.groupId.slice(0, 8),\n      backend: backendByGroup.get(group.groupId) ?? null,\n      warmSeconds: group.warmSeconds,\n      sessionsAttached: attached.get(group.groupId) ?? 0,\n    })),\n    liveWarm: liveWarm.map((lease) => ({\n      id: lease.id,\n      groupId: lease.groupId,\n      backend: lease.backend,\n      turnHolders: lease.turnHolders,\n      viewerHolders: lease.viewerHolders,\n      warmForLabel: lease.turnHolders > 0 ? \"in use\" : \"idle warm\",\n      warmSeconds: warmSecondsByGroup.get(lease.groupId) ?? 0,\n    })),\n    floor,\n    selfhostedEnabled: settings.sandboxSelfhostedEnabled,\n    machinesOnline,\n    workspaceCreditUsd: microsToUsd(workspaceCreditMicros),\n    priorWorkspaceCreditUsd: microsToUsd(priorWorkspaceCreditMicros),\n    creditUsd: microsToUsd(creditMicros),\n    priorCreditUsd: microsToUsd(priorCreditMicros),\n    estimatedProviderUsd: microsToUsd(estimatedProviderCostMicros),\n    priorEstimatedProviderUsd: microsToUsd(priorEstimatedProviderCostMicros),\n    estimatedProviderCostKnownCalls,\n    priorEstimatedProviderCostKnownCalls,\n    modelCalls,\n    priorInputTokens,\n    priorTotalTokens,\n    priorCacheHitPct: cacheHitPct(priorCachedTokens, priorCacheInputTokens),\n    priorCalls,\n    goalsActive: depth.goalsActive,\n    goalsCompleted: depth.goalsCompleted,\n    sessionsTouched: depth.sessionsTouched,\n    rootSessions: depth.rootSessions,\n    deepestDepth: depth.deepestDepth,\n    deepestSessionTitle: depth.deepestSessionTitle || \"\",\n    avgDepth: Math.round(depth.avgDepth * 10) / 10,\n    warmIdleNow: liveWarm.filter((lease) => lease.turnHolders === 0).length,\n    billableTokensUsed,\n    billableTokenCap: limits.maxMonthlyTokensPerWorkspace ?? null,\n    agentRunsUsed,\n    agentRunCap: limits.maxMonthlyAgentRunsPerWorkspace ?? null,\n    modelFilterActive,\n  });\n\n  return { snapshot };\n}\n","import { createHash } from \"node:crypto\";\nimport {\n  stableJson,\n  type KnowledgeMemoryKind,\n  type KnowledgeMemoryStatus,\n} from \"@opengeni/contracts\";\nimport { sanitizeSlackPublicationText } from \"./slack-publication-secret-safety\";\n\nconst UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;\nconst SELECTOR_SEGMENT_PATTERN = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/;\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\nexport const MEMORY_SLACK_PROJECTION_VERSION = 1;\nexport const MEMORY_SLACK_SUMMARY_MAX_UTF8_BYTES = 512;\nexport const MEMORY_SLACK_NAMESPACE_MAX_UTF8_BYTES = 128;\nexport const MEMORY_SLACK_LABEL_MAX_UTF8_BYTES = 64;\nexport const MEMORY_SLACK_LABEL_MAX_COUNT = 8;\nexport const MEMORY_SLACK_OWNER_MAX_UTF8_BYTES = 96;\nexport const MEMORY_SLACK_PROJECTION_MAX_UTF8_BYTES = 4096;\n\nexport type MemorySlackImportance = \"major\" | \"normal\" | \"minor\";\nexport type MemorySlackRequestedMode = \"auto\" | \"review\" | \"never\";\nexport type MemorySlackDeliveryMode = Exclude<MemorySlackRequestedMode, \"never\">;\nexport type MemorySlackChangeKind = \"created\" | \"corrected\" | \"superseded\";\nexport type MemorySlackOrigin = \"native\" | \"slack_derived\";\nexport type MemorySlackAudience = \"workspace\" | \"restricted\";\n\nexport type MemorySlackPublicationPolicy = {\n  enabled: boolean;\n  autoImportances: readonly MemorySlackImportance[];\n  reviewImportances: readonly MemorySlackImportance[];\n};\n\n/**\n * Nothing publishes without an explicit workspace-admin enablement. When\n * enabled without tuning, major changes may publish automatically, normal\n * changes require review, and minor changes stay quiet.\n */\nexport const DEFAULT_MEMORY_SLACK_PUBLICATION_POLICY = {\n  enabled: false,\n  autoImportances: [\"major\"],\n  reviewImportances: [\"normal\"],\n} as const satisfies MemorySlackPublicationPolicy;\n\nexport type MemorySlackPublicationInput = {\n  context: {\n    accountId: string;\n    workspaceId: string;\n    now: string;\n  };\n  policy?: MemorySlackPublicationPolicy | undefined;\n  memory: {\n    sourceType: \"workspace_memory\";\n    accountId: string;\n    workspaceId: string;\n    id: string;\n    version: number;\n    status: KnowledgeMemoryStatus;\n    kind: KnowledgeMemoryKind;\n    scopeType: \"workspace\" | \"user\" | \"role\" | \"session\" | \"ephemeral\" | \"legacy\";\n    namespace: string;\n    labels: readonly string[];\n    validFrom: string;\n    validUntil: string | null;\n    supersedesId: string | null;\n    supersededById: string | null;\n  };\n  change: {\n    kind: MemorySlackChangeKind;\n    relatedMemoryId: string | null;\n    occurredAt: string;\n    origin: MemorySlackOrigin;\n    ownerLabel?: string | null | undefined;\n  };\n  distribution: {\n    importance: MemorySlackImportance;\n    audience: MemorySlackAudience;\n    slackMode: MemorySlackRequestedMode;\n    shareSummary: string;\n  };\n};\n\nexport type MemorySlackPublicationDenialReason =\n  | \"disabled\"\n  | \"invalid_input\"\n  | \"unsupported_source\"\n  | \"tenant_mismatch\"\n  | \"not_decision\"\n  | \"status_ineligible\"\n  | \"restricted_scope\"\n  | \"restricted_audience\"\n  | \"not_yet_valid\"\n  | \"expired\"\n  | \"slack_origin_loop\"\n  | \"mode_never\"\n  | \"below_noise_policy\"\n  | \"missing_summary\"\n  | \"invalid_change_lineage\";\n\nexport type MemorySlackPublicationProjection = {\n  version: typeof MEMORY_SLACK_PROJECTION_VERSION;\n  workspaceId: string;\n  memoryId: string;\n  memoryVersion: number;\n  changeKind: MemorySlackChangeKind;\n  relatedMemoryId: string | null;\n  occurredAt: string;\n  importance: MemorySlackImportance;\n  deliveryMode: MemorySlackDeliveryMode;\n  summary: string;\n  summaryTruncated: boolean;\n  namespace: string;\n  labels: string[];\n  labelsTruncated: boolean;\n  ownerLabel: string | null;\n  ownerLabelTruncated: boolean;\n  authoritativeRecord: {\n    workspaceId: string;\n    memoryId: string;\n  };\n};\n\nexport type MemorySlackPublicationDecision =\n  | {\n      eligible: false;\n      reason: MemorySlackPublicationDenialReason;\n    }\n  | {\n      eligible: true;\n      deliveryMode: MemorySlackDeliveryMode;\n      idempotencyKey: string;\n      projection: MemorySlackPublicationProjection;\n    };\n\nconst IMPORTANCES = new Set<MemorySlackImportance>([\"major\", \"normal\", \"minor\"]);\nconst REQUESTED_MODES = new Set<MemorySlackRequestedMode>([\"auto\", \"review\", \"never\"]);\nconst CHANGE_KINDS = new Set<MemorySlackChangeKind>([\"created\", \"corrected\", \"superseded\"]);\nconst ORIGINS = new Set<MemorySlackOrigin>([\"native\", \"slack_derived\"]);\nconst AUDIENCES = new Set<MemorySlackAudience>([\"workspace\", \"restricted\"]);\nconst SCOPE_TYPES = new Set<MemorySlackPublicationInput[\"memory\"][\"scopeType\"]>([\n  \"workspace\",\n  \"user\",\n  \"role\",\n  \"session\",\n  \"ephemeral\",\n  \"legacy\",\n]);\nconst MEMORY_STATUSES = new Set<KnowledgeMemoryStatus>([\n  \"proposed\",\n  \"approved\",\n  \"rejected\",\n  \"active\",\n  \"superseded\",\n  \"archived\",\n]);\nconst MEMORY_KINDS = new Set<KnowledgeMemoryKind>([\n  \"semantic\",\n  \"episodic\",\n  \"procedural\",\n  \"decision\",\n  \"preference\",\n]);\nconst VISIBLE_STATUSES = new Set<KnowledgeMemoryStatus>([\"active\", \"approved\"]);\n\n/**\n * Produce the only data shape a later delivery slice may persist or\n * render. This is a deterministic policy/security boundary, not a persistence\n * hook: callers must durably bind the returned projection and key in a later\n * transaction/outbox slice.\n */\nexport function evaluateMemorySlackPublication(\n  input: MemorySlackPublicationInput,\n): MemorySlackPublicationDecision {\n  const policy = input.policy ?? DEFAULT_MEMORY_SLACK_PUBLICATION_POLICY;\n  if (!validPolicy(policy)) return denied(\"invalid_input\");\n  if (!policy.enabled) return denied(\"disabled\");\n\n  if (input.memory.sourceType !== \"workspace_memory\") return denied(\"unsupported_source\");\n  if (!validIdentity(input)) return denied(\"invalid_input\");\n  if (\n    input.memory.accountId !== input.context.accountId ||\n    input.memory.workspaceId !== input.context.workspaceId\n  ) {\n    return denied(\"tenant_mismatch\");\n  }\n  if (input.memory.kind !== \"decision\") return denied(\"not_decision\");\n  if (input.memory.scopeType !== \"workspace\") return denied(\"restricted_scope\");\n  if (input.distribution.audience !== \"workspace\") return denied(\"restricted_audience\");\n  if (input.change.origin === \"slack_derived\") return denied(\"slack_origin_loop\");\n  if (input.distribution.slackMode === \"never\") return denied(\"mode_never\");\n\n  const timeDecision = evaluateValidity(input);\n  if (timeDecision) return denied(timeDecision);\n  if (!statusEligibleForChange(input)) return denied(\"status_ineligible\");\n  if (!validChangeLineage(input)) return denied(\"invalid_change_lineage\");\n\n  const deliveryMode = effectiveDeliveryMode(policy, input.distribution);\n  if (!deliveryMode) return denied(\"below_noise_policy\");\n\n  const collapsedSummary = sanitizeSlackPublicationText(\n    collapseText(input.distribution.shareSummary),\n  );\n  if (!collapsedSummary) return denied(\"missing_summary\");\n  const summary = truncateUtf8(collapsedSummary, MEMORY_SLACK_SUMMARY_MAX_UTF8_BYTES);\n\n  const namespace = normalizeNamespace(input.memory.namespace);\n  const labels = normalizeLabels(input.memory.labels);\n  if (!namespace || !labels) return denied(\"invalid_input\");\n\n  const owner = boundedOptionalText(input.change.ownerLabel, MEMORY_SLACK_OWNER_MAX_UTF8_BYTES);\n  const projection: MemorySlackPublicationProjection = {\n    version: MEMORY_SLACK_PROJECTION_VERSION,\n    workspaceId: input.context.workspaceId,\n    memoryId: input.memory.id,\n    memoryVersion: input.memory.version,\n    changeKind: input.change.kind,\n    relatedMemoryId: input.change.relatedMemoryId,\n    occurredAt: new Date(input.change.occurredAt).toISOString(),\n    importance: input.distribution.importance,\n    deliveryMode,\n    summary: summary.value,\n    summaryTruncated: summary.truncated,\n    namespace,\n    labels: labels.values,\n    labelsTruncated: labels.truncated,\n    ownerLabel: owner.value,\n    ownerLabelTruncated: owner.truncated,\n    authoritativeRecord: {\n      workspaceId: input.context.workspaceId,\n      memoryId: input.memory.id,\n    },\n  };\n\n  if (utf8Bytes(stableJson(projection)) > MEMORY_SLACK_PROJECTION_MAX_UTF8_BYTES) {\n    return denied(\"invalid_input\");\n  }\n\n  const digest = createHash(\"sha256\").update(stableJson(projection), \"utf8\").digest(\"hex\");\n  return {\n    eligible: true,\n    deliveryMode,\n    idempotencyKey: `memory-slack:v${MEMORY_SLACK_PROJECTION_VERSION}:${digest}`,\n    projection,\n  };\n}\n\nfunction validPolicy(policy: MemorySlackPublicationPolicy): boolean {\n  return (\n    typeof policy.enabled === \"boolean\" &&\n    Array.isArray(policy.autoImportances) &&\n    Array.isArray(policy.reviewImportances) &&\n    policy.autoImportances.every((importance) => IMPORTANCES.has(importance)) &&\n    policy.reviewImportances.every((importance) => IMPORTANCES.has(importance))\n  );\n}\n\nfunction validIdentity(input: MemorySlackPublicationInput): boolean {\n  const uuids = [\n    input.context.accountId,\n    input.context.workspaceId,\n    input.memory.accountId,\n    input.memory.workspaceId,\n    input.memory.id,\n    input.memory.supersedesId,\n    input.memory.supersededById,\n    input.change.relatedMemoryId,\n  ].filter((value): value is string => value !== null);\n  return (\n    uuids.every((value) => UUID_PATTERN.test(value)) &&\n    Number.isSafeInteger(input.memory.version) &&\n    input.memory.version > 0 &&\n    typeof input.memory.namespace === \"string\" &&\n    Array.isArray(input.memory.labels) &&\n    input.memory.labels.every((label) => typeof label === \"string\") &&\n    (input.change.ownerLabel === undefined ||\n      input.change.ownerLabel === null ||\n      typeof input.change.ownerLabel === \"string\") &&\n    typeof input.distribution.shareSummary === \"string\" &&\n    IMPORTANCES.has(input.distribution.importance) &&\n    REQUESTED_MODES.has(input.distribution.slackMode) &&\n    CHANGE_KINDS.has(input.change.kind) &&\n    ORIGINS.has(input.change.origin) &&\n    AUDIENCES.has(input.distribution.audience) &&\n    SCOPE_TYPES.has(input.memory.scopeType) &&\n    MEMORY_STATUSES.has(input.memory.status) &&\n    MEMORY_KINDS.has(input.memory.kind)\n  );\n}\n\nfunction evaluateValidity(\n  input: MemorySlackPublicationInput,\n): \"invalid_input\" | \"not_yet_valid\" | \"expired\" | null {\n  const now = Date.parse(input.context.now);\n  const occurredAt = Date.parse(input.change.occurredAt);\n  const validFrom = Date.parse(input.memory.validFrom);\n  const validUntil = input.memory.validUntil === null ? null : Date.parse(input.memory.validUntil);\n  if (\n    !Number.isFinite(now) ||\n    !Number.isFinite(occurredAt) ||\n    !Number.isFinite(validFrom) ||\n    (validUntil !== null && !Number.isFinite(validUntil)) ||\n    (validUntil !== null && validUntil <= validFrom)\n  ) {\n    return \"invalid_input\";\n  }\n  if (now < validFrom) return \"not_yet_valid\";\n  if (validUntil !== null && now >= validUntil) return \"expired\";\n  return null;\n}\n\nfunction validChangeLineage(input: MemorySlackPublicationInput): boolean {\n  if (\n    input.memory.supersedesId === input.memory.id ||\n    input.memory.supersededById === input.memory.id ||\n    input.change.relatedMemoryId === input.memory.id\n  ) {\n    return false;\n  }\n\n  switch (input.change.kind) {\n    case \"created\":\n      return (\n        input.change.relatedMemoryId === null &&\n        input.memory.supersedesId === null &&\n        input.memory.supersededById === null\n      );\n    case \"corrected\":\n      return (\n        input.change.relatedMemoryId !== null &&\n        input.change.relatedMemoryId !== input.memory.id &&\n        input.memory.supersedesId === input.change.relatedMemoryId &&\n        input.memory.supersededById === null\n      );\n    case \"superseded\":\n      return (\n        input.change.relatedMemoryId !== null &&\n        input.change.relatedMemoryId !== input.memory.id &&\n        input.memory.supersededById === input.change.relatedMemoryId\n      );\n  }\n}\n\nfunction statusEligibleForChange(input: MemorySlackPublicationInput): boolean {\n  return input.change.kind === \"superseded\"\n    ? input.memory.status === \"superseded\"\n    : VISIBLE_STATUSES.has(input.memory.status);\n}\n\nfunction effectiveDeliveryMode(\n  policy: MemorySlackPublicationPolicy,\n  distribution: MemorySlackPublicationInput[\"distribution\"],\n): MemorySlackDeliveryMode | null {\n  const auto = new Set(policy.autoImportances);\n  const review = new Set(policy.reviewImportances);\n  if (distribution.slackMode === \"review\") {\n    return auto.has(distribution.importance) || review.has(distribution.importance)\n      ? \"review\"\n      : null;\n  }\n  if (auto.has(distribution.importance)) return \"auto\";\n  if (review.has(distribution.importance)) return \"review\";\n  return null;\n}\n\nfunction normalizeNamespace(value: string): string | null {\n  const trimmed = value.trim();\n  const namespace = trimmed.toLowerCase();\n  if (!namespace || utf8Bytes(namespace) > MEMORY_SLACK_NAMESPACE_MAX_UTF8_BYTES) return null;\n  const segments = namespace.split(\"/\");\n  if (segments.some((segment) => !SELECTOR_SEGMENT_PATTERN.test(segment))) return null;\n  return segments.join(\"/\");\n}\n\nfunction normalizeLabels(\n  values: readonly string[],\n): { values: string[]; truncated: boolean } | null {\n  if (!Array.isArray(values)) return null;\n  const labels = new Set<string>();\n  for (const value of values) {\n    if (typeof value !== \"string\") return null;\n    const trimmed = value.trim();\n    const label = trimmed.toLowerCase();\n    if (\n      !SELECTOR_SEGMENT_PATTERN.test(label) ||\n      utf8Bytes(label) > MEMORY_SLACK_LABEL_MAX_UTF8_BYTES\n    ) {\n      return null;\n    }\n    labels.add(label);\n  }\n  const sorted = [...labels].sort();\n  return {\n    values: sorted.slice(0, MEMORY_SLACK_LABEL_MAX_COUNT),\n    truncated: sorted.length > MEMORY_SLACK_LABEL_MAX_COUNT,\n  };\n}\n\nfunction boundedOptionalText(\n  value: string | null | undefined,\n  maxBytes: number,\n): { value: string | null; truncated: boolean } {\n  const collapsed = sanitizeSlackPublicationText(collapseText(value ?? \"\"));\n  if (!collapsed) return { value: null, truncated: false };\n  const bounded = truncateUtf8(collapsed, maxBytes);\n  return {\n    value: bounded.value || null,\n    truncated: bounded.truncated,\n  };\n}\n\nfunction collapseText(value: string): string {\n  // eslint-disable-next-line no-control-regex\n  return value\n    .replace(/[\\u0000-\\u001F\\u007F-\\u009F]/g, \" \")\n    .replace(/\\s+/g, \" \")\n    .trim();\n}\n\nfunction truncateUtf8(value: string, maxBytes: number): { value: string; truncated: boolean } {\n  const bytes = encoder.encode(value);\n  if (bytes.byteLength <= maxBytes) return { value, truncated: false };\n  const marker = \"…\";\n  const markerBytes = encoder.encode(marker);\n  let end = Math.max(0, maxBytes - markerBytes.byteLength);\n  while (end > 0 && (bytes[end]! & 0xc0) === 0x80) end -= 1;\n  return {\n    value: `${decoder.decode(bytes.subarray(0, end)).trimEnd()}${marker}`,\n    truncated: true,\n  };\n}\n\nfunction utf8Bytes(value: string): number {\n  return encoder.encode(value).byteLength;\n}\n\nfunction denied(reason: MemorySlackPublicationDenialReason): MemorySlackPublicationDecision {\n  return { eligible: false, reason };\n}\n","export const SLACK_PUBLICATION_CREDENTIAL_OMISSION = \"[credential omitted]\";\n\nconst CREDENTIAL_PATTERNS = [\n  /-----BEGIN(?: [A-Z0-9]+)* PRIVATE KEY-----[\\s\\S]*?(?:-----END(?: [A-Z0-9]+)* PRIVATE KEY-----|$)/gi,\n  /\\b(?:github_pat_[A-Za-z0-9_]{20,}|gh[pousr]_[A-Za-z0-9]{20,}|glpat-[A-Za-z0-9_-]{20,})/g,\n  /\\b(?:sk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}|(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,})/g,\n  /\\b(?:AKIA|ASIA)[A-Z0-9]{16}\\b/g,\n  /\\bxox[baprs]-[A-Za-z0-9-]{10,}/g,\n  /\\bAIza[0-9A-Za-z_-]{20,}/g,\n  /\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\b/g,\n] as const;\n\nconst BEARER_CREDENTIAL_PATTERN = /\\bBearer\\s+[A-Za-z0-9._~+/=-]{16,}/gi;\nconst CREDENTIAL_ASSIGNMENT_PATTERN =\n  /(^|[\\s,;([])((?:api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|password|passwd|secret|token))\\s*[:=]\\s*(?:\"[^\"]{8,}\"|'[^']{8,}'|[^\\s,;\\])}]{8,})/gi;\nconst CREDENTIAL_URL_PATTERN = /\\b([a-z][a-z0-9+.-]*:\\/\\/[^:\\s/@]+:)[^@\\s/]+@/gi;\n\n/**\n * Deterministic, sink-local protection for text that is about to be persisted\n * as a Slack publication projection or rendered to Slack. It intentionally\n * does not scan or mutate canonical Memory, durable-learning receipts, model\n * context, history, events, or any other internal OpenGeni content path.\n */\nexport function sanitizeSlackPublicationText(value: string): string {\n  let sanitized = value;\n  for (const pattern of CREDENTIAL_PATTERNS) {\n    sanitized = sanitized.replace(pattern, SLACK_PUBLICATION_CREDENTIAL_OMISSION);\n  }\n  sanitized = sanitized.replace(\n    BEARER_CREDENTIAL_PATTERN,\n    `Bearer ${SLACK_PUBLICATION_CREDENTIAL_OMISSION}`,\n  );\n  sanitized = sanitized.replace(\n    CREDENTIAL_ASSIGNMENT_PATTERN,\n    (_match, prefix: string, name: string) =>\n      `${prefix}${name}=${SLACK_PUBLICATION_CREDENTIAL_OMISSION}`,\n  );\n  return sanitized.replace(\n    CREDENTIAL_URL_PATTERN,\n    (_match, prefix: string) => `${prefix}${SLACK_PUBLICATION_CREDENTIAL_OMISSION}@`,\n  );\n}\n","import type { MemorySlackPublicationDistribution } from \"@opengeni/contracts\";\nimport {\n  correctWorkspaceMemory,\n  enqueueMemorySlackPublication,\n  getCurrentMemorySlackPublicationConfiguration,\n  getWorkspaceMemorySlackPublicationSnapshot,\n  saveWorkspaceMemory,\n  withWorkspaceRls,\n  type CorrectWorkspaceMemoryInput,\n  type CorrectWorkspaceMemoryResult,\n  type Database,\n  type EnqueueMemorySlackPublicationResult,\n  type MemoryEmbedder,\n  type MemorySlackPublicationActor,\n  type SaveWorkspaceMemoryInput,\n  type SaveWorkspaceMemoryResult,\n  type WorkspaceMemorySlackPublicationSnapshot,\n} from \"@opengeni/db\";\nimport {\n  evaluateMemorySlackPublication,\n  type MemorySlackOrigin,\n  type MemorySlackPublicationDecision,\n} from \"./memory-slack-publication\";\n\nexport type MemorySlackPublicationCommitRequest = {\n  distribution: MemorySlackPublicationDistribution;\n  actor: MemorySlackPublicationActor;\n  ownerLabel?: string | null;\n  origin?: MemorySlackOrigin;\n};\n\nexport type MemorySlackPublicationCommitResult = {\n  decision: MemorySlackPublicationDecision | null;\n  enqueue: EnqueueMemorySlackPublicationResult | null;\n};\n\nexport async function saveWorkspaceMemoryWithSlackPublication(\n  db: Database,\n  input: SaveWorkspaceMemoryInput,\n  publication: MemorySlackPublicationCommitRequest | null,\n  embedder?: MemoryEmbedder,\n): Promise<SaveWorkspaceMemoryResult & { slackPublication: MemorySlackPublicationCommitResult }> {\n  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {\n    const result = await saveWorkspaceMemory(scopedDb, input, embedder);\n    const slackPublication = publication\n      ? await publishSavedMemoryMutation(scopedDb, input, result, publication)\n      : { decision: null, enqueue: null };\n    return { ...result, slackPublication };\n  });\n}\n\nexport async function correctWorkspaceMemoryWithSlackPublication(\n  db: Database,\n  input: CorrectWorkspaceMemoryInput,\n  publication: MemorySlackPublicationCommitRequest | null,\n  embedder?: MemoryEmbedder,\n): Promise<\n  CorrectWorkspaceMemoryResult & { slackPublication: MemorySlackPublicationCommitResult }\n> {\n  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {\n    const result = await correctWorkspaceMemory(scopedDb, input, embedder);\n    if (!publication || result.action !== \"superseded\" || !result.replacement) {\n      return { ...result, slackPublication: { decision: null, enqueue: null } };\n    }\n    const replacement = await requiredSnapshot(scopedDb, input.workspaceId, result.replacement.id);\n    const slackPublication = await evaluateAndEnqueue(scopedDb, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      snapshot: replacement,\n      changeKind: \"corrected\",\n      relatedMemoryId: result.memory.id,\n      occurredAt: result.replacement.updatedAt,\n      publication,\n    });\n    return { ...result, slackPublication };\n  });\n}\n\nasync function publishSavedMemoryMutation(\n  db: Database,\n  input: SaveWorkspaceMemoryInput,\n  result: SaveWorkspaceMemoryResult,\n  publication: MemorySlackPublicationCommitRequest,\n): Promise<MemorySlackPublicationCommitResult> {\n  if (result.updated || (result.deduped && !result.superseded)) {\n    return { decision: null, enqueue: null };\n  }\n\n  if (result.superseded) {\n    const replacement = await requiredSnapshot(db, input.workspaceId, result.memory.id);\n    if (replacement.supersedesId === result.superseded.id) {\n      return await evaluateAndEnqueue(db, {\n        accountId: input.accountId,\n        workspaceId: input.workspaceId,\n        snapshot: replacement,\n        changeKind: \"corrected\",\n        relatedMemoryId: result.superseded.id,\n        occurredAt: result.memory.updatedAt,\n        publication,\n      });\n    }\n    const retired = await requiredSnapshot(db, input.workspaceId, result.superseded.id);\n    return await evaluateAndEnqueue(db, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      snapshot: retired,\n      changeKind: \"superseded\",\n      relatedMemoryId: result.memory.id,\n      occurredAt: result.superseded.updatedAt,\n      publication,\n    });\n  }\n\n  const created = await requiredSnapshot(db, input.workspaceId, result.memory.id);\n  return await evaluateAndEnqueue(db, {\n    accountId: input.accountId,\n    workspaceId: input.workspaceId,\n    snapshot: created,\n    changeKind: \"created\",\n    relatedMemoryId: null,\n    occurredAt: result.memory.createdAt,\n    publication,\n  });\n}\n\nasync function evaluateAndEnqueue(\n  db: Database,\n  input: {\n    accountId: string;\n    workspaceId: string;\n    snapshot: WorkspaceMemorySlackPublicationSnapshot;\n    changeKind: \"created\" | \"corrected\" | \"superseded\";\n    relatedMemoryId: string | null;\n    occurredAt: string;\n    publication: MemorySlackPublicationCommitRequest;\n  },\n): Promise<MemorySlackPublicationCommitResult> {\n  const configuration = await getCurrentMemorySlackPublicationConfiguration(db, input.workspaceId);\n  const decision = evaluateMemorySlackPublication({\n    context: {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      now: input.occurredAt,\n    },\n    policy: configuration\n      ? {\n          enabled: configuration.enabled,\n          autoImportances: configuration.autoImportances,\n          reviewImportances: configuration.reviewImportances,\n        }\n      : undefined,\n    memory: {\n      sourceType: \"workspace_memory\",\n      accountId: input.snapshot.accountId,\n      workspaceId: input.snapshot.workspaceId,\n      id: input.snapshot.id,\n      version: input.snapshot.version,\n      status: input.snapshot.status as Parameters<\n        typeof evaluateMemorySlackPublication\n      >[0][\"memory\"][\"status\"],\n      kind: input.snapshot.kind as Parameters<\n        typeof evaluateMemorySlackPublication\n      >[0][\"memory\"][\"kind\"],\n      scopeType: input.snapshot.scopeType as Parameters<\n        typeof evaluateMemorySlackPublication\n      >[0][\"memory\"][\"scopeType\"],\n      namespace: input.snapshot.namespace,\n      labels: input.snapshot.labels,\n      validFrom: input.snapshot.validFrom,\n      validUntil: input.snapshot.validUntil,\n      supersedesId: input.snapshot.supersedesId,\n      supersededById: input.snapshot.supersededById,\n    },\n    change: {\n      kind: input.changeKind,\n      relatedMemoryId: input.relatedMemoryId,\n      occurredAt: input.occurredAt,\n      origin: input.publication.origin ?? \"native\",\n      ownerLabel: input.publication.ownerLabel ?? null,\n    },\n    distribution: input.publication.distribution,\n  });\n  if (!decision.eligible) return { decision, enqueue: null };\n\n  const enqueue = await enqueueMemorySlackPublication(db, {\n    accountId: input.accountId,\n    workspaceId: input.workspaceId,\n    sourceType: \"workspace_memory\",\n    sourceId: input.snapshot.id,\n    sourceVersion: String(input.snapshot.version),\n    sourceIdempotencyKey: decision.idempotencyKey,\n    projection: decision.projection,\n    importance: decision.projection.importance,\n    deliveryMode: decision.deliveryMode,\n    actor: input.publication.actor,\n  });\n  return { decision, enqueue };\n}\n\nasync function requiredSnapshot(db: Database, workspaceId: string, memoryId: string) {\n  const snapshot = await getWorkspaceMemorySlackPublicationSnapshot(db, workspaceId, memoryId);\n  if (!snapshot) throw new Error(\"Memory Slack publication source disappeared before commit\");\n  return snapshot;\n}\n","import {\n  enqueueMemorySlackPublication,\n  getCurrentMemorySlackPublicationConfiguration,\n  type Database,\n  type EnqueueMemorySlackPublicationResult,\n} from \"@opengeni/db\";\nimport { sanitizeSlackPublicationText } from \"./slack-publication-secret-safety\";\n\n/**\n * Narrow post-persistence port for the immutable durable-learning v1 attempt/receipt contract.\n * The router owns validation, authority, routing, and persistence. This adapter\n * consumes only the fields required to create a bounded notification projection.\n */\nexport type DurableLearningSlackOutcome = {\n  attempt: {\n    id: string;\n    accountId: string;\n    workspaceId: string;\n    inputHash: string;\n    actor: { kind: \"human\" | \"agent\" | \"service\"; subjectId: string };\n    initiatingHumanSubjectId: string | null;\n    sessionId: string | null;\n    request:\n      | {\n          operation: \"write\";\n          subject: {\n            kind: string;\n            summary: string | null;\n          };\n          evidence: Array<{ kind: string }>;\n        }\n      | {\n          operation: \"rollback\";\n          targetAttemptId: string;\n        };\n  };\n  receipt: {\n    attemptId: string;\n    inputHash: string;\n    outcome:\n      | \"applied\"\n      | \"proposed\"\n      | \"evidence_recorded\"\n      | \"noop\"\n      | \"clarification_required\"\n      | \"rejected\"\n      | \"rolled_back\"\n      | \"failed\";\n    decision: {\n      code: string;\n      destination: string | null;\n      scope: { kind: string } | null;\n      authority: string | null;\n    };\n    resource: {\n      surface: string;\n      id: string;\n      version: string | null;\n      status: string;\n    } | null;\n    createdAt: string;\n  };\n};\n\nexport type DurableLearningSlackPublicationResult =\n  | {\n      kind:\n        | \"contract_mismatch\"\n        | \"not_workspace_scoped\"\n        | \"connector_evidence_untrusted\"\n        | \"summary_required\"\n        | \"policy_quiet\";\n      enqueue: null;\n    }\n  | { kind: \"enqueued\"; enqueue: EnqueueMemorySlackPublicationResult };\n\nexport type DurableLearningSlackProjection = {\n  summary: string;\n  outcome: DurableLearningSlackOutcome[\"receipt\"][\"outcome\"];\n  decisionCode: string;\n  destination: string | null;\n  authority: string | null;\n  resource: DurableLearningSlackOutcome[\"receipt\"][\"resource\"];\n  occurredAt: string;\n};\n\nexport async function publishDurableLearningOutcomeToSlack(\n  db: Database,\n  outcome: DurableLearningSlackOutcome,\n): Promise<DurableLearningSlackPublicationResult> {\n  const { attempt, receipt } = outcome;\n  if (attempt.id !== receipt.attemptId || attempt.inputHash !== receipt.inputHash) {\n    return { kind: \"contract_mismatch\", enqueue: null };\n  }\n  if (receipt.decision.scope?.kind !== \"workspace\") {\n    return { kind: \"not_workspace_scoped\", enqueue: null };\n  }\n  if (\n    attempt.request.operation === \"write\" &&\n    attempt.request.evidence.some((evidence) => evidence.kind === \"connector\")\n  ) {\n    // The v1 router contract intentionally does not identify connector providers.\n    // Fail closed rather than risk republishing a Slack-derived learning outcome.\n    return { kind: \"connector_evidence_untrusted\", enqueue: null };\n  }\n\n  const projection = durableLearningSlackProjection(outcome);\n  if (!projection) return { kind: \"summary_required\", enqueue: null };\n  const importance = durableLearningImportance(outcome);\n  const configuration = await getCurrentMemorySlackPublicationConfiguration(\n    db,\n    attempt.workspaceId,\n  );\n  const deliveryMode = configuration?.autoImportances.includes(importance)\n    ? \"auto\"\n    : configuration?.reviewImportances.includes(importance)\n      ? \"review\"\n      : null;\n  if (!configuration?.enabled || !deliveryMode) {\n    return { kind: \"policy_quiet\", enqueue: null };\n  }\n\n  const enqueue = await enqueueMemorySlackPublication(db, {\n    accountId: attempt.accountId,\n    workspaceId: attempt.workspaceId,\n    sourceType: \"durable_learning\",\n    sourceId: receipt.attemptId,\n    sourceVersion: receipt.inputHash,\n    sourceIdempotencyKey: `durable-learning:${receipt.attemptId}`,\n    projection,\n    importance,\n    deliveryMode,\n    actor: {\n      kind: attempt.actor.kind,\n      subjectId: attempt.actor.subjectId,\n      initiatingHumanSubjectId: attempt.initiatingHumanSubjectId,\n      sessionId: attempt.sessionId,\n      attemptId: attempt.id,\n    },\n  });\n  return { kind: \"enqueued\", enqueue };\n}\n\nexport function durableLearningImportance(\n  outcome: DurableLearningSlackOutcome,\n): \"major\" | \"normal\" | \"minor\" {\n  if (outcome.receipt.outcome === \"failed\" || outcome.receipt.outcome === \"rolled_back\") {\n    return \"major\";\n  }\n  if (outcome.receipt.outcome === \"noop\" || outcome.receipt.outcome === \"clarification_required\") {\n    return \"minor\";\n  }\n  if (\n    outcome.attempt.request.operation === \"write\" &&\n    [\"decision\", \"workspace_charter\", \"mandatory_operating_context\", \"workspace_goal\"].includes(\n      outcome.attempt.request.subject.kind,\n    )\n  ) {\n    return \"major\";\n  }\n  return \"normal\";\n}\n\nexport function durableLearningSlackProjection(\n  outcome: DurableLearningSlackOutcome,\n): DurableLearningSlackProjection | null {\n  const summary = durableLearningSummary(outcome);\n  if (!summary) return null;\n  return {\n    summary,\n    outcome: outcome.receipt.outcome,\n    decisionCode: outcome.receipt.decision.code,\n    destination: boundedSlackPublicationText(outcome.receipt.decision.destination, 128),\n    authority: outcome.receipt.decision.authority,\n    resource: outcome.receipt.resource\n      ? {\n          surface: outcome.receipt.resource.surface,\n          id: outcome.receipt.resource.id,\n          version: outcome.receipt.resource.version,\n          status: outcome.receipt.resource.status,\n        }\n      : null,\n    occurredAt: outcome.receipt.createdAt,\n  };\n}\n\nfunction durableLearningSummary(outcome: DurableLearningSlackOutcome): string | null {\n  if (outcome.attempt.request.operation === \"rollback\") {\n    const destination =\n      boundedSlackPublicationText(outcome.receipt.decision.destination, 128) ??\n      \"governed knowledge\";\n    return `Rolled back a durable learning change for ${destination}.`;\n  }\n  const summary = outcome.attempt.request.subject.summary?.replace(/\\s+/g, \" \").trim();\n  return summary ? sanitizeSlackPublicationText(summary).slice(0, 512) : null;\n}\n\nfunction boundedSlackPublicationText(value: string | null, maxChars: number): string | null {\n  if (!value) return null;\n  const sanitized = sanitizeSlackPublicationText(value.replace(/\\s+/g, \" \").trim());\n  return sanitized ? sanitized.slice(0, maxChars) : null;\n}\n","import {\n  CompanyProfileLearningSubjectKind,\n  CompanyProfileLearningWrite,\n  type CompanyProfileMutationResponse,\n} from \"@opengeni/contracts\";\nimport {\n  type CompanyProfileLearningWriteResult,\n  type Database,\n  rollbackCompanyProfileLearning,\n  writeCompanyProfileLearning,\n} from \"@opengeni/db\";\n\nexport type CompanyProfileDurableLearningResource = {\n  surface: \"company_profile\";\n  id: string;\n  version: string | null;\n  status: string;\n};\n\nexport type CompanyProfileDurableLearningWriteResult = {\n  outcome: \"applied\" | \"proposed\";\n  resource: CompanyProfileDurableLearningResource;\n  effectiveBoundary: \"next_accepted_attempt\";\n  rollback: {\n    supported: boolean;\n    targetAttemptId: null;\n    token: string | null;\n  };\n};\n\nexport type CompanyProfileDurableLearningRollbackResult = {\n  resource: CompanyProfileDurableLearningResource;\n  effectiveBoundary: \"next_accepted_attempt\";\n};\n\n/**\n * Structural match for canonical durable-learning router's DurableLearningAuthorityAdapter. The router\n * package owns its complete request/decision types; accepting unknown here\n * keeps this adapter assignable without copying or competing with that router.\n */\nexport type CompanyProfileDurableLearningAuthorityAdapter = {\n  write: (input: unknown) => Promise<CompanyProfileDurableLearningWriteResult>;\n  rollback: (input: unknown) => Promise<CompanyProfileDurableLearningRollbackResult>;\n};\n\nexport type CompanyProfileDurableLearningAdapterOptions = {\n  db: Database;\n  authority?: {\n    write: typeof writeCompanyProfileLearning;\n    rollback: typeof rollbackCompanyProfileLearning;\n  };\n};\n\nfunction record(value: unknown, name: string): Record<string, unknown> {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new Error(`${name} must be an object`);\n  }\n  return value as Record<string, unknown>;\n}\n\nfunction requiredString(value: unknown, name: string): string {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new Error(`${name} must be a non-empty string`);\n  }\n  return value;\n}\n\nfunction nullableString(value: unknown, name: string): string | null {\n  if (value === null) return null;\n  return requiredString(value, name);\n}\n\nfunction actorKind(value: unknown): \"human\" | \"agent\" | \"service\" {\n  if (value === \"human\" || value === \"agent\" || value === \"service\") return value;\n  throw new Error(\"durable-learning attempt actor kind is invalid\");\n}\n\nfunction parseAttempt(value: unknown) {\n  const attempt = record(value, \"durable-learning attempt\");\n  const actor = record(attempt.actor, \"durable-learning actor\");\n  return {\n    id: requiredString(attempt.id, \"durable-learning attempt id\"),\n    accountId: requiredString(attempt.accountId, \"durable-learning account id\"),\n    workspaceId: requiredString(attempt.workspaceId, \"durable-learning workspace id\"),\n    actor: {\n      kind: actorKind(actor.kind),\n      subjectId: requiredString(actor.subjectId, \"durable-learning actor subject\"),\n    },\n  };\n}\n\nfunction parseWriteInput(value: unknown) {\n  const input = record(value, \"company-profile durable-learning write\");\n  const attempt = parseAttempt(input.attempt);\n  const request = record(input.request, \"durable-learning write request\");\n  const decision = record(input.decision, \"durable-learning route decision\");\n  const scope = record(decision.scope, \"durable-learning resolved scope\");\n  const subject = record(request.subject, \"durable-learning subject\");\n  if (\n    request.operation !== \"write\" ||\n    request.attemptId !== attempt.id ||\n    request.targetSurface !== \"company_profile\" ||\n    decision.disposition !== \"route\" ||\n    decision.destination !== \"company_profile\" ||\n    scope.kind !== \"organization\" ||\n    (decision.authority !== \"active\" && decision.authority !== \"proposal\")\n  ) {\n    throw new Error(\n      \"The company-profile adapter accepts only matching routed active or proposal organization company_profile writes\",\n    );\n  }\n  return CompanyProfileLearningWrite.parse({\n    operationId: attempt.id,\n    accountId: attempt.accountId,\n    workspaceId: attempt.workspaceId,\n    actorSubjectId: attempt.actor.subjectId,\n    actorKind: attempt.actor.kind,\n    authority: decision.authority,\n    subject: {\n      kind: CompanyProfileLearningSubjectKind.parse(subject.kind),\n      content: requiredString(subject.content, \"durable-learning subject content\"),\n      stableKey: nullableString(subject.stableKey, \"durable-learning subject stable key\"),\n    },\n    sourceId: `durable-learning-attempt:${attempt.id}`,\n  });\n}\n\nfunction parseRollbackInput(value: unknown) {\n  const input = record(value, \"company-profile durable-learning rollback\");\n  const attempt = parseAttempt(input.attempt);\n  const targetAttempt = parseAttempt(input.targetAttempt);\n  const targetReceipt = record(input.targetReceipt, \"durable-learning target receipt\");\n  const targetResource = record(\n    targetReceipt.resource,\n    \"durable-learning target company-profile resource\",\n  );\n  const receiptRollback = record(\n    targetReceipt.rollback,\n    \"durable-learning target rollback receipt\",\n  );\n  const rollbackToken = requiredString(input.rollbackToken, \"company-profile rollback token\");\n  if (\n    targetReceipt.attemptId !== targetAttempt.id ||\n    targetResource.surface !== \"company_profile\" ||\n    receiptRollback.supported !== true ||\n    receiptRollback.token !== rollbackToken\n  ) {\n    throw new Error(\"The company-profile adapter cannot roll back another authority surface\");\n  }\n  return {\n    attempt,\n    rollbackToken,\n    reason: requiredString(input.reason, \"company-profile rollback reason\"),\n  };\n}\n\nfunction writeResource(\n  result: CompanyProfileLearningWriteResult,\n): CompanyProfileDurableLearningResource {\n  return {\n    surface: \"company_profile\",\n    id: result.revision.id,\n    version: String(result.revision.revision),\n    status: result.outcome === \"applied\" ? \"active\" : \"proposal\",\n  };\n}\n\nfunction rollbackResource(\n  result: CompanyProfileMutationResponse,\n): CompanyProfileDurableLearningResource {\n  if (!result.event) throw new Error(\"Company-profile rollback returned no activation event\");\n  return {\n    surface: \"company_profile\",\n    id: result.head?.revisionId ?? result.event.oldRevision?.id ?? result.event.id,\n    version: String(result.event.activationVersion),\n    status: result.head ? \"active\" : \"inactive\",\n  };\n}\n\n/** Install this under `authorities.company_profile` in the canonical durable-learning router ports. */\nexport function createCompanyProfileDurableLearningAdapter(\n  options: CompanyProfileDurableLearningAdapterOptions,\n): CompanyProfileDurableLearningAuthorityAdapter {\n  const authority = options.authority ?? {\n    write: writeCompanyProfileLearning,\n    rollback: rollbackCompanyProfileLearning,\n  };\n  return {\n    async write(rawInput) {\n      const input = parseWriteInput(rawInput);\n      const result = await authority.write(options.db, input);\n      return {\n        outcome: result.outcome,\n        resource: writeResource(result),\n        effectiveBoundary: result.effectiveBoundary,\n        rollback: {\n          supported: result.rollbackToken !== null,\n          targetAttemptId: null,\n          token: result.rollbackToken,\n        },\n      };\n    },\n\n    async rollback(rawInput) {\n      const input = parseRollbackInput(rawInput);\n      const result = await authority.rollback(options.db, {\n        operationId: input.attempt.id,\n        accountId: input.attempt.accountId,\n        workspaceId: input.attempt.workspaceId,\n        actorSubjectId: input.attempt.actor.subjectId,\n        actorKind: input.attempt.actor.kind,\n        token: input.rollbackToken,\n        reason: input.reason,\n      });\n      return {\n        resource: rollbackResource(result),\n        effectiveBoundary: \"next_accepted_attempt\",\n      };\n    },\n  };\n}\n","import { createHash } from \"node:crypto\";\n\ndeclare const conversationProviderNamespaceBrand: unique symbol;\ndeclare const conversationProviderOpaqueValueBrand: unique symbol;\ndeclare const conversationEventIdentityBrand: unique symbol;\ndeclare const conversationRouteIdentityBrand: unique symbol;\ndeclare const conversationActorIdentityBrand: unique symbol;\ndeclare const conversationOperationIdentityBrand: unique symbol;\ndeclare const conversationRequestDigestBrand: unique symbol;\n\nexport const CONVERSATION_INTEGRATION_SCHEMA_VERSION = 1 as const;\nexport const CONVERSATION_PROVIDER_NAMESPACE_MAX_UTF8_BYTES = 128;\nexport const CONVERSATION_PROVIDER_OPAQUE_ID_MAX_UTF8_BYTES = 512;\nexport const CONVERSATION_TEXT_MAX_UTF8_BYTES = 32 * 1024;\nexport const CONVERSATION_ATTACHMENT_MAX_COUNT = 16;\nexport const CONVERSATION_ATTACHMENT_NAME_MAX_UTF8_BYTES = 1024;\nexport const CONVERSATION_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES = 128;\nexport const CONVERSATION_OPERATION_KEY_MAX_UTF8_BYTES = 512;\nexport const CONVERSATION_OUTCOME_CODE_MAX_UTF8_BYTES = 128;\n\nconst PROVIDER_NAMESPACE_PATTERN = /^[a-z0-9]+(?:[.-][a-z0-9]+)*$/u;\nconst OUTCOME_CODE_PATTERN = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/u;\nconst MEDIA_TYPE_PATTERN = /^[a-z0-9][a-z0-9!#$&^_.+-]*\\/[a-z0-9][a-z0-9!#$&^_.+-]*$/iu;\nconst SHA256_PATTERN = /^[0-9a-f]{64}$/u;\nconst ABSOLUTE_URL_PATTERN = /^[a-z][a-z0-9+.-]*:\\/\\//iu;\nconst textEncoder = new TextEncoder();\n\nexport type ConversationProviderNamespace = string & {\n  readonly [conversationProviderNamespaceBrand]: true;\n};\n\nexport type ConversationProviderOpaqueValue = string & {\n  readonly [conversationProviderOpaqueValueBrand]: true;\n};\n\nexport type ConversationProviderOpaqueIdKind =\n  | \"installation\"\n  | \"actor\"\n  | \"conversation\"\n  | \"thread\"\n  | \"event\"\n  | \"message\"\n  | \"attachment\"\n  | \"receipt\";\n\nexport type ConversationProviderOpaqueId<\n  TKind extends ConversationProviderOpaqueIdKind = ConversationProviderOpaqueIdKind,\n> = Readonly<{\n  provider: ConversationProviderNamespace;\n  kind: TKind;\n  value: ConversationProviderOpaqueValue;\n}>;\n\nexport type ConversationInstallationIdentity = ConversationProviderOpaqueId<\"installation\">;\nexport type ConversationEventIdentity = `ciev1_${string}` & {\n  readonly [conversationEventIdentityBrand]: true;\n};\nexport type ConversationRouteIdentity = `cirt1_${string}` & {\n  readonly [conversationRouteIdentityBrand]: true;\n};\nexport type ConversationActorIdentity = `ciac1_${string}` & {\n  readonly [conversationActorIdentityBrand]: true;\n};\nexport type ConversationOperationIdentity = `ciop1_${string}` & {\n  readonly [conversationOperationIdentityBrand]: true;\n};\nexport type ConversationRequestDigest = `sha256:${string}` & {\n  readonly [conversationRequestDigestBrand]: true;\n};\n\nexport type ConversationActorKind = \"human\" | \"bot\" | \"system\";\n\nexport type ConversationActorInput = Readonly<{\n  providerActorId: string;\n  kind: ConversationActorKind;\n}>;\n\nexport type ConversationActor = Readonly<{\n  installation: ConversationInstallationIdentity;\n  providerActorId: ConversationProviderOpaqueId<\"actor\">;\n  kind: ConversationActorKind;\n  identity: ConversationActorIdentity;\n}>;\n\nexport type ConversationRoute = Readonly<{\n  installation: ConversationInstallationIdentity;\n  providerConversationId: ConversationProviderOpaqueId<\"conversation\">;\n  providerThreadId: ConversationProviderOpaqueId<\"thread\"> | null;\n  identity: ConversationRouteIdentity;\n}>;\n\nexport type ConversationRouteInput = Readonly<{\n  providerConversationId: string;\n  providerThreadId?: string | null;\n}>;\n\nexport type ConversationStartSignal = Readonly<{ kind: \"start\" }>;\nexport type ConversationContinueSignal = Readonly<{ kind: \"continue\" }>;\nexport type ConversationControlSignal = Readonly<{\n  kind: \"control\";\n  control: \"stop\" | \"resume\";\n}>;\nexport type ConversationSignal =\n  | ConversationStartSignal\n  | ConversationContinueSignal\n  | ConversationControlSignal;\n\nexport type ConversationAttachmentReference = Readonly<{\n  providerAttachmentId: ConversationProviderOpaqueId<\"attachment\">;\n  fileName: string | null;\n  mediaType: string | null;\n  byteSize: number | null;\n  contentSha256: string | null;\n}>;\n\nexport type ConversationAttachmentReferenceInput = Readonly<{\n  providerAttachmentId: string;\n  fileName?: string | null;\n  mediaType?: string | null;\n  byteSize?: number | null;\n  contentSha256?: string | null;\n}>;\n\nexport type ConversationInboundEnvelope = Readonly<{\n  schemaVersion: typeof CONVERSATION_INTEGRATION_SCHEMA_VERSION;\n  installation: ConversationInstallationIdentity;\n  actor: ConversationActor;\n  route: ConversationRoute;\n  providerEventId: ConversationProviderOpaqueId<\"event\">;\n  providerMessageId: ConversationProviderOpaqueId<\"message\">;\n  eventIdentity: ConversationEventIdentity;\n  occurredAt: string;\n  signal: ConversationSignal;\n  text: string;\n  attachments: readonly ConversationAttachmentReference[];\n}>;\n\nexport type ConversationInboundEnvelopeInput = Readonly<{\n  provider: string;\n  installationId: string;\n  actor: ConversationActorInput;\n  route: ConversationRouteInput;\n  providerEventId: string;\n  providerMessageId: string;\n  occurredAt: string;\n  signal: ConversationSignal;\n  text: string;\n  attachments?: readonly ConversationAttachmentReferenceInput[];\n}>;\n\ntype ConversationDeliveryCommandBase = Readonly<{\n  schemaVersion: typeof CONVERSATION_INTEGRATION_SCHEMA_VERSION;\n  operationId: ConversationOperationIdentity;\n  logicalOperationKey: string;\n  requestDigest: ConversationRequestDigest;\n  installation: ConversationInstallationIdentity;\n  route: ConversationRoute;\n}>;\n\nexport type ConversationPostCommand = ConversationDeliveryCommandBase &\n  Readonly<{\n    kind: \"post\";\n    targetProviderMessageId: null;\n    text: string;\n  }>;\n\nexport type ConversationUpdateCommand = ConversationDeliveryCommandBase &\n  Readonly<{\n    kind: \"update\";\n    targetProviderMessageId: ConversationProviderOpaqueId<\"message\">;\n    text: string;\n  }>;\n\nexport type ConversationDeleteCommand = ConversationDeliveryCommandBase &\n  Readonly<{\n    kind: \"delete\";\n    targetProviderMessageId: ConversationProviderOpaqueId<\"message\">;\n    text: null;\n  }>;\n\nexport type ConversationDeliveryCommand =\n  | ConversationPostCommand\n  | ConversationUpdateCommand\n  | ConversationDeleteCommand;\n\nexport type ConversationDeliveryCommandInput =\n  | Readonly<{\n      kind: \"post\";\n      logicalOperationKey: string;\n      installation: ConversationInstallationIdentity;\n      route: ConversationRoute;\n      text: string;\n    }>\n  | Readonly<{\n      kind: \"update\";\n      logicalOperationKey: string;\n      installation: ConversationInstallationIdentity;\n      route: ConversationRoute;\n      targetProviderMessageId: string;\n      text: string;\n    }>\n  | Readonly<{\n      kind: \"delete\";\n      logicalOperationKey: string;\n      installation: ConversationInstallationIdentity;\n      route: ConversationRoute;\n      targetProviderMessageId: string;\n    }>;\n\nexport type ConversationProviderReceipt = Readonly<{\n  schemaVersion: typeof CONVERSATION_INTEGRATION_SCHEMA_VERSION;\n  operationId: ConversationOperationIdentity;\n  requestDigest: ConversationRequestDigest;\n  installation: ConversationInstallationIdentity;\n  providerMessageId: ConversationProviderOpaqueId<\"message\">;\n  providerReceiptId: ConversationProviderOpaqueId<\"receipt\"> | null;\n  observedAt: string;\n}>;\n\nexport type ConversationProviderReceiptInput = Readonly<{\n  command: ConversationDeliveryCommand;\n  providerMessageId: string;\n  providerReceiptId?: string | null;\n  observedAt: string;\n}>;\n\nexport type ConversationDeliveryNotStarted = Readonly<{\n  status: \"not_started\";\n  code: string;\n}>;\nexport type ConversationDeliveryUnknown = Readonly<{\n  status: \"unknown\";\n  code: string;\n}>;\nexport type ConversationDeliveryRetryableFailure = Readonly<{\n  status: \"retryable_failure\";\n  code: string;\n  retryAfterMs: number | null;\n}>;\nexport type ConversationDeliveryPermanentFailure = Readonly<{\n  status: \"permanent_failure\";\n  code: string;\n}>;\nexport type ConversationDeliverySuccess = Readonly<{\n  status: \"success\";\n  receipt: ConversationProviderReceipt;\n}>;\n\nexport type ConversationDeliveryOutcome =\n  | ConversationDeliveryNotStarted\n  | ConversationDeliveryUnknown\n  | ConversationDeliveryRetryableFailure\n  | ConversationDeliveryPermanentFailure\n  | ConversationDeliverySuccess;\n\nexport type ConversationDeliveryOutcomeInput =\n  | ConversationDeliveryNotStarted\n  | ConversationDeliveryUnknown\n  | Readonly<{\n      status: \"retryable_failure\";\n      code: string;\n      retryAfterMs?: number | null;\n    }>\n  | ConversationDeliveryPermanentFailure\n  | ConversationDeliverySuccess;\n\nexport type ConversationDeliveryNextAction =\n  | \"retry_same_operation\"\n  | \"reconcile\"\n  | \"stop\"\n  | \"complete\";\n\nexport function normalizeConversationInboundEnvelope(\n  input: ConversationInboundEnvelopeInput,\n): ConversationInboundEnvelope {\n  assertExactObject(input, \"inbound envelope\", [\n    \"provider\",\n    \"installationId\",\n    \"actor\",\n    \"route\",\n    \"providerEventId\",\n    \"providerMessageId\",\n    \"occurredAt\",\n    \"signal\",\n    \"text\",\n    \"attachments\",\n  ]);\n  const provider = normalizeConversationProviderNamespace(input.provider);\n  const installation = normalizeConversationInstallationIdentity({\n    provider,\n    providerInstallationId: input.installationId,\n  });\n  const actor = normalizeConversationActor(installation, input.actor);\n  const route = normalizeConversationRoute(installation, input.route);\n  const providerEventId = providerOpaqueId(provider, \"event\", input.providerEventId);\n  const providerMessageId = providerOpaqueId(provider, \"message\", input.providerMessageId);\n  const occurredAt = canonicalTimestamp(input.occurredAt, \"inbound occurredAt\");\n  const signal = normalizeSignal(input.signal);\n  const text = boundedExactText(input.text, \"inbound text\", true);\n  const rawAttachments = input.attachments ?? [];\n  if (!Array.isArray(rawAttachments)) throw new TypeError(\"inbound attachments must be an array\");\n  if (rawAttachments.length > CONVERSATION_ATTACHMENT_MAX_COUNT) {\n    throw new RangeError(\n      `inbound attachments must contain at most ${CONVERSATION_ATTACHMENT_MAX_COUNT} entries`,\n    );\n  }\n  const attachments = Object.freeze(\n    rawAttachments.map((attachment) => normalizeAttachment(provider, attachment)),\n  );\n  if ((signal.kind === \"start\" || signal.kind === \"continue\") && !text && !attachments.length) {\n    throw new TypeError(\"start and continue signals require text or an attachment reference\");\n  }\n  return Object.freeze({\n    schemaVersion: CONVERSATION_INTEGRATION_SCHEMA_VERSION,\n    installation,\n    actor,\n    route,\n    providerEventId,\n    providerMessageId,\n    eventIdentity: deriveConversationEventIdentity(installation, providerEventId),\n    occurredAt,\n    signal,\n    text,\n    attachments,\n  });\n}\n\nexport function normalizeConversationProviderNamespace(\n  value: string,\n): ConversationProviderNamespace {\n  return providerNamespace(value);\n}\n\nexport function normalizeConversationInstallationIdentity(input: {\n  provider: string | ConversationProviderNamespace;\n  providerInstallationId: string;\n}): ConversationInstallationIdentity {\n  assertExactObject(input, \"installation identity\", [\"provider\", \"providerInstallationId\"]);\n  return providerOpaqueId(\n    providerNamespace(input.provider),\n    \"installation\",\n    input.providerInstallationId,\n  );\n}\n\nexport function normalizeConversationActor(\n  installation: ConversationInstallationIdentity,\n  input: ConversationActorInput,\n): ConversationActor {\n  assertConversationInstallationIdentity(installation);\n  assertExactObject(input, \"inbound actor\", [\"providerActorId\", \"kind\"]);\n  if (input.kind !== \"human\" && input.kind !== \"bot\" && input.kind !== \"system\") {\n    throw new TypeError(\"inbound actor kind is unsupported\");\n  }\n  const providerActorId = providerOpaqueId(installation.provider, \"actor\", input.providerActorId);\n  return Object.freeze({\n    installation,\n    providerActorId,\n    kind: input.kind,\n    identity: deriveConversationActorIdentity(installation, providerActorId),\n  });\n}\n\nexport function normalizeConversationRoute(\n  installation: ConversationInstallationIdentity,\n  input: ConversationRouteInput,\n): ConversationRoute {\n  assertConversationInstallationIdentity(installation);\n  assertExactObject(input, \"inbound route\", [\"providerConversationId\", \"providerThreadId\"]);\n  const providerConversationId = providerOpaqueId(\n    installation.provider,\n    \"conversation\",\n    input.providerConversationId,\n  );\n  const providerThreadId =\n    input.providerThreadId === undefined || input.providerThreadId === null\n      ? null\n      : providerOpaqueId(installation.provider, \"thread\", input.providerThreadId);\n  const identity = deriveConversationRouteIdentity(\n    installation,\n    providerConversationId,\n    providerThreadId,\n  );\n  return Object.freeze({ installation, providerConversationId, providerThreadId, identity });\n}\n\nexport function normalizeConversationDeliveryCommand(\n  input: ConversationDeliveryCommandInput,\n): ConversationDeliveryCommand {\n  const keys =\n    input.kind === \"post\"\n      ? [\"kind\", \"logicalOperationKey\", \"installation\", \"route\", \"text\"]\n      : input.kind === \"update\"\n        ? [\n            \"kind\",\n            \"logicalOperationKey\",\n            \"installation\",\n            \"route\",\n            \"targetProviderMessageId\",\n            \"text\",\n          ]\n        : [\"kind\", \"logicalOperationKey\", \"installation\", \"route\", \"targetProviderMessageId\"];\n  assertExactObject(input, \"delivery command\", keys);\n  if (input.kind !== \"post\" && input.kind !== \"update\" && input.kind !== \"delete\") {\n    throw new TypeError(\"delivery command kind is unsupported\");\n  }\n  assertConversationInstallationIdentity(input.installation);\n  assertConversationRoute(input.route);\n  assertSameInstallation(input.installation, input.route.installation, \"delivery route\");\n  const logicalOperationKey = boundedOpaqueString(\n    input.logicalOperationKey,\n    \"logical operation key\",\n    CONVERSATION_OPERATION_KEY_MAX_UTF8_BYTES,\n  );\n  const operationId = deriveConversationOperationIdentity(input.installation, logicalOperationKey);\n  const targetProviderMessageId =\n    input.kind === \"post\"\n      ? null\n      : providerOpaqueId(input.installation.provider, \"message\", input.targetProviderMessageId);\n  const text =\n    input.kind === \"delete\" ? null : boundedExactText(input.text, \"delivery text\", false);\n  const requestDigest = deliveryRequestDigest({\n    kind: input.kind,\n    installation: input.installation,\n    route: input.route,\n    targetProviderMessageId,\n    text,\n  });\n  return Object.freeze({\n    schemaVersion: CONVERSATION_INTEGRATION_SCHEMA_VERSION,\n    operationId,\n    logicalOperationKey,\n    requestDigest,\n    installation: input.installation,\n    route: input.route,\n    kind: input.kind,\n    targetProviderMessageId,\n    text,\n  }) as ConversationDeliveryCommand;\n}\n\nexport function normalizeConversationProviderReceipt(\n  input: ConversationProviderReceiptInput,\n): ConversationProviderReceipt {\n  assertExactObject(input, \"provider receipt\", [\n    \"command\",\n    \"providerMessageId\",\n    \"providerReceiptId\",\n    \"observedAt\",\n  ]);\n  assertConversationDeliveryCommand(input.command);\n  const providerMessageId = providerOpaqueId(\n    input.command.installation.provider,\n    \"message\",\n    input.providerMessageId,\n  );\n  if (\n    input.command.targetProviderMessageId &&\n    providerMessageId.value !== input.command.targetProviderMessageId.value\n  ) {\n    throw new TypeError(\"provider receipt message does not match the mutation target\");\n  }\n  const providerReceiptId =\n    input.providerReceiptId === undefined || input.providerReceiptId === null\n      ? null\n      : providerOpaqueId(input.command.installation.provider, \"receipt\", input.providerReceiptId);\n  return Object.freeze({\n    schemaVersion: CONVERSATION_INTEGRATION_SCHEMA_VERSION,\n    operationId: input.command.operationId,\n    requestDigest: input.command.requestDigest,\n    installation: input.command.installation,\n    providerMessageId,\n    providerReceiptId,\n    observedAt: canonicalTimestamp(input.observedAt, \"provider receipt observedAt\"),\n  });\n}\n\nexport function normalizeConversationDeliveryOutcome(\n  input: ConversationDeliveryOutcomeInput,\n): ConversationDeliveryOutcome {\n  if (input.status === \"success\") {\n    assertExactObject(input, \"delivery success\", [\"status\", \"receipt\"]);\n    assertConversationProviderReceipt(input.receipt);\n    return Object.freeze({ status: \"success\", receipt: input.receipt });\n  }\n  if (input.status === \"retryable_failure\") {\n    assertExactObject(input, \"retryable delivery failure\", [\"status\", \"code\", \"retryAfterMs\"]);\n    const retryAfterMs = input.retryAfterMs ?? null;\n    if (retryAfterMs !== null && (!Number.isSafeInteger(retryAfterMs) || retryAfterMs < 0)) {\n      throw new RangeError(\"retryAfterMs must be a non-negative safe integer or null\");\n    }\n    return Object.freeze({\n      status: \"retryable_failure\",\n      code: outcomeCode(input.code),\n      retryAfterMs,\n    });\n  }\n  if (\n    input.status !== \"not_started\" &&\n    input.status !== \"unknown\" &&\n    input.status !== \"permanent_failure\"\n  ) {\n    throw new TypeError(\"delivery outcome status is unsupported\");\n  }\n  assertExactObject(input, \"delivery outcome\", [\"status\", \"code\"]);\n  return Object.freeze({ status: input.status, code: outcomeCode(input.code) });\n}\n\nexport function conversationDeliveryNextAction(\n  outcome: ConversationDeliveryOutcome,\n): ConversationDeliveryNextAction {\n  assertConversationDeliveryOutcome(outcome);\n  if (outcome.status === \"unknown\") return \"reconcile\";\n  if (outcome.status === \"not_started\" || outcome.status === \"retryable_failure\") {\n    return \"retry_same_operation\";\n  }\n  return outcome.status === \"success\" ? \"complete\" : \"stop\";\n}\n\nexport function assertConversationDeliveryMayRetry(\n  outcome: ConversationDeliveryOutcome,\n): asserts outcome is ConversationDeliveryNotStarted | ConversationDeliveryRetryableFailure {\n  const action = conversationDeliveryNextAction(outcome);\n  if (action === \"retry_same_operation\") return;\n  if (action === \"reconcile\") {\n    throw new Error(\"unknown delivery outcome must be reconciled before retry\");\n  }\n  throw new Error(`delivery outcome ${outcome.status} may not be retried`);\n}\n\nexport function assertConversationDeliveryCommandMatches(\n  expected: ConversationDeliveryCommand,\n  candidate: ConversationDeliveryCommand,\n): void {\n  assertConversationDeliveryCommand(expected);\n  assertConversationDeliveryCommand(candidate);\n  if (expected.operationId !== candidate.operationId) {\n    throw new Error(\"delivery operation identity does not match\");\n  }\n  if (expected.requestDigest !== candidate.requestDigest) {\n    throw new Error(\"delivery operation identity was reused for different request content\");\n  }\n}\n\nexport function assertConversationInboundEnvelope(\n  value: unknown,\n): asserts value is ConversationInboundEnvelope {\n  assertExactObject(value, \"normalized inbound envelope\", [\n    \"schemaVersion\",\n    \"installation\",\n    \"actor\",\n    \"route\",\n    \"providerEventId\",\n    \"providerMessageId\",\n    \"eventIdentity\",\n    \"occurredAt\",\n    \"signal\",\n    \"text\",\n    \"attachments\",\n  ]);\n  if (value.schemaVersion !== CONVERSATION_INTEGRATION_SCHEMA_VERSION) {\n    throw new TypeError(\"inbound envelope schema version is unsupported\");\n  }\n  assertConversationInstallationIdentity(value.installation);\n  assertConversationActor(value.actor);\n  assertConversationRoute(value.route);\n  assertProviderOpaqueId(value.providerEventId, \"event\");\n  assertProviderOpaqueId(value.providerMessageId, \"message\");\n  assertSameInstallation(value.installation, value.actor.installation, \"inbound actor\");\n  assertSameInstallation(value.installation, value.route.installation, \"inbound route\");\n  assertSameProvider(value.installation.provider, value.providerEventId.provider, \"event id\");\n  assertSameProvider(value.installation.provider, value.providerMessageId.provider, \"message id\");\n  const expectedEventIdentity = deriveConversationEventIdentity(\n    value.installation,\n    value.providerEventId,\n  );\n  if (value.eventIdentity !== expectedEventIdentity) {\n    throw new TypeError(\"inbound event identity is not canonical\");\n  }\n  canonicalTimestamp(value.occurredAt, \"inbound occurredAt\");\n  const signal = normalizeSignal(value.signal);\n  const text = boundedExactText(value.text, \"inbound text\", true);\n  if (!Array.isArray(value.attachments))\n    throw new TypeError(\"inbound attachments must be an array\");\n  if (value.attachments.length > CONVERSATION_ATTACHMENT_MAX_COUNT) {\n    throw new RangeError(\"inbound attachment count exceeds the contract bound\");\n  }\n  for (const attachment of value.attachments) {\n    assertConversationAttachmentReference(attachment);\n    assertSameProvider(\n      value.installation.provider,\n      attachment.providerAttachmentId.provider,\n      \"attachment id\",\n    );\n  }\n  if (\n    (signal.kind === \"start\" || signal.kind === \"continue\") &&\n    !text &&\n    !value.attachments.length\n  ) {\n    throw new TypeError(\"start and continue signals require text or an attachment reference\");\n  }\n}\n\nexport function assertConversationDeliveryCommand(\n  value: unknown,\n): asserts value is ConversationDeliveryCommand {\n  assertExactObject(value, \"normalized delivery command\", [\n    \"schemaVersion\",\n    \"operationId\",\n    \"logicalOperationKey\",\n    \"requestDigest\",\n    \"installation\",\n    \"route\",\n    \"kind\",\n    \"targetProviderMessageId\",\n    \"text\",\n  ]);\n  if (value.schemaVersion !== CONVERSATION_INTEGRATION_SCHEMA_VERSION) {\n    throw new TypeError(\"delivery command schema version is unsupported\");\n  }\n  if (value.kind !== \"post\" && value.kind !== \"update\" && value.kind !== \"delete\") {\n    throw new TypeError(\"delivery command kind is unsupported\");\n  }\n  assertConversationInstallationIdentity(value.installation);\n  assertConversationRoute(value.route);\n  assertSameInstallation(value.installation, value.route.installation, \"delivery route\");\n  const logicalOperationKey = boundedOpaqueString(\n    value.logicalOperationKey,\n    \"logical operation key\",\n    CONVERSATION_OPERATION_KEY_MAX_UTF8_BYTES,\n  );\n  if (\n    value.operationId !==\n    deriveConversationOperationIdentity(value.installation, logicalOperationKey)\n  ) {\n    throw new TypeError(\"delivery operation identity is not canonical\");\n  }\n  let target: ConversationProviderOpaqueId<\"message\"> | null;\n  let text: string | null;\n  if (value.kind === \"post\") {\n    if (value.targetProviderMessageId !== null) {\n      throw new TypeError(\"post command cannot carry a target message\");\n    }\n    target = null;\n    text = boundedExactText(value.text, \"delivery text\", false);\n  } else {\n    assertProviderOpaqueId(value.targetProviderMessageId, \"message\");\n    target = value.targetProviderMessageId;\n    assertSameProvider(value.installation.provider, target.provider, \"delivery target\");\n    if (value.kind === \"delete\") {\n      if (value.text !== null) throw new TypeError(\"delete command cannot carry text\");\n      text = null;\n    } else {\n      text = boundedExactText(value.text, \"delivery text\", false);\n    }\n  }\n  const expectedDigest = deliveryRequestDigest({\n    kind: value.kind,\n    installation: value.installation,\n    route: value.route,\n    targetProviderMessageId: target,\n    text,\n  });\n  if (value.requestDigest !== expectedDigest) {\n    throw new TypeError(\"delivery request digest is not canonical\");\n  }\n}\n\nexport function assertConversationProviderReceipt(\n  value: unknown,\n): asserts value is ConversationProviderReceipt {\n  assertExactObject(value, \"normalized provider receipt\", [\n    \"schemaVersion\",\n    \"operationId\",\n    \"requestDigest\",\n    \"installation\",\n    \"providerMessageId\",\n    \"providerReceiptId\",\n    \"observedAt\",\n  ]);\n  if (value.schemaVersion !== CONVERSATION_INTEGRATION_SCHEMA_VERSION) {\n    throw new TypeError(\"provider receipt schema version is unsupported\");\n  }\n  assertIdentity(value.operationId, /^ciop1_[0-9a-f]{64}$/u, \"provider receipt operation id\");\n  assertIdentity(value.requestDigest, /^sha256:[0-9a-f]{64}$/u, \"provider receipt request digest\");\n  assertConversationInstallationIdentity(value.installation);\n  assertProviderOpaqueId(value.providerMessageId, \"message\");\n  assertSameProvider(\n    value.installation.provider,\n    value.providerMessageId.provider,\n    \"receipt message\",\n  );\n  if (value.providerReceiptId !== null) {\n    assertProviderOpaqueId(value.providerReceiptId, \"receipt\");\n    assertSameProvider(\n      value.installation.provider,\n      value.providerReceiptId.provider,\n      \"provider receipt id\",\n    );\n  }\n  canonicalTimestamp(value.observedAt, \"provider receipt observedAt\");\n}\n\nexport function assertConversationDeliveryOutcome(\n  value: unknown,\n): asserts value is ConversationDeliveryOutcome {\n  normalizeConversationDeliveryOutcome(value as ConversationDeliveryOutcomeInput);\n}\n\nexport function canonicalConversationInboundEnvelopeJson(\n  envelope: ConversationInboundEnvelope,\n): string {\n  assertConversationInboundEnvelope(envelope);\n  return JSON.stringify({\n    schemaVersion: envelope.schemaVersion,\n    installation: providerIdWire(envelope.installation),\n    actor: actorWire(envelope.actor),\n    route: routeWire(envelope.route),\n    providerEventId: providerIdWire(envelope.providerEventId),\n    providerMessageId: providerIdWire(envelope.providerMessageId),\n    eventIdentity: envelope.eventIdentity,\n    occurredAt: envelope.occurredAt,\n    signal: signalWire(envelope.signal),\n    text: envelope.text,\n    attachments: envelope.attachments.map(attachmentWire),\n  });\n}\n\nexport function canonicalConversationDeliveryCommandJson(\n  command: ConversationDeliveryCommand,\n): string {\n  assertConversationDeliveryCommand(command);\n  return JSON.stringify(deliveryCommandWire(command));\n}\n\nexport function canonicalConversationProviderReceiptJson(\n  receipt: ConversationProviderReceipt,\n): string {\n  assertConversationProviderReceipt(receipt);\n  return JSON.stringify(providerReceiptWire(receipt));\n}\n\nexport function canonicalConversationDeliveryOutcomeJson(\n  outcome: ConversationDeliveryOutcome,\n): string {\n  assertConversationDeliveryOutcome(outcome);\n  if (outcome.status === \"success\") {\n    return JSON.stringify({ status: \"success\", receipt: providerReceiptWire(outcome.receipt) });\n  }\n  if (outcome.status === \"retryable_failure\") {\n    return JSON.stringify({\n      status: outcome.status,\n      code: outcome.code,\n      retryAfterMs: outcome.retryAfterMs,\n    });\n  }\n  return JSON.stringify({ status: outcome.status, code: outcome.code });\n}\n\nfunction normalizeSignal(input: unknown): ConversationSignal {\n  assertExactObject(input, \"conversation signal\", [\"kind\", \"control\"]);\n  if (input.kind === \"start\" || input.kind === \"continue\") {\n    assertExactObject(input, \"conversation signal\", [\"kind\"]);\n    return Object.freeze({ kind: input.kind });\n  }\n  if (input.kind === \"control\") {\n    assertExactObject(input, \"conversation control signal\", [\"kind\", \"control\"]);\n    if (input.control !== \"stop\" && input.control !== \"resume\") {\n      throw new TypeError(\"conversation control signal is unsupported\");\n    }\n    return Object.freeze({ kind: \"control\", control: input.control });\n  }\n  throw new TypeError(\"conversation signal is unsupported\");\n}\n\nfunction normalizeAttachment(\n  provider: ConversationProviderNamespace,\n  input: ConversationAttachmentReferenceInput,\n): ConversationAttachmentReference {\n  assertExactObject(input, \"attachment reference\", [\n    \"providerAttachmentId\",\n    \"fileName\",\n    \"mediaType\",\n    \"byteSize\",\n    \"contentSha256\",\n  ]);\n  if (\n    ABSOLUTE_URL_PATTERN.test(input.providerAttachmentId) ||\n    input.providerAttachmentId.startsWith(\"//\")\n  ) {\n    throw new TypeError(\"attachment references cannot contain provider URLs\");\n  }\n  const providerAttachmentId = providerOpaqueId(provider, \"attachment\", input.providerAttachmentId);\n  const fileName = nullableBoundedString(\n    input.fileName,\n    \"attachment fileName\",\n    CONVERSATION_ATTACHMENT_NAME_MAX_UTF8_BYTES,\n  );\n  if (fileName?.includes(\"/\") || fileName?.includes(\"\\\\\")) {\n    throw new TypeError(\"attachment fileName must not contain a path\");\n  }\n  const mediaType = nullableBoundedString(\n    input.mediaType,\n    \"attachment mediaType\",\n    CONVERSATION_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES,\n  );\n  if (mediaType !== null && !MEDIA_TYPE_PATTERN.test(mediaType)) {\n    throw new TypeError(\"attachment mediaType is invalid\");\n  }\n  const byteSize = input.byteSize ?? null;\n  if (byteSize !== null && (!Number.isSafeInteger(byteSize) || byteSize < 0)) {\n    throw new RangeError(\"attachment byteSize must be a non-negative safe integer or null\");\n  }\n  const contentSha256 = input.contentSha256 ?? null;\n  if (contentSha256 !== null && !SHA256_PATTERN.test(contentSha256)) {\n    throw new TypeError(\"attachment contentSha256 must be 64 lowercase hexadecimal characters\");\n  }\n  return Object.freeze({\n    providerAttachmentId,\n    fileName,\n    mediaType,\n    byteSize,\n    contentSha256,\n  });\n}\n\nfunction providerNamespace(value: string): ConversationProviderNamespace {\n  const bounded = boundedOpaqueString(\n    value,\n    \"provider namespace\",\n    CONVERSATION_PROVIDER_NAMESPACE_MAX_UTF8_BYTES,\n  );\n  if (!PROVIDER_NAMESPACE_PATTERN.test(bounded)) {\n    throw new TypeError(\"provider namespace must be canonical lowercase segments\");\n  }\n  return bounded as ConversationProviderNamespace;\n}\n\nfunction providerOpaqueId<TKind extends ConversationProviderOpaqueIdKind>(\n  provider: ConversationProviderNamespace,\n  kind: TKind,\n  value: string,\n): ConversationProviderOpaqueId<TKind> {\n  return Object.freeze({\n    provider,\n    kind,\n    value: boundedOpaqueString(\n      value,\n      `provider ${kind} id`,\n      CONVERSATION_PROVIDER_OPAQUE_ID_MAX_UTF8_BYTES,\n    ) as ConversationProviderOpaqueValue,\n  });\n}\n\nfunction deriveConversationEventIdentity(\n  installation: ConversationInstallationIdentity,\n  providerEventId: ConversationProviderOpaqueId<\"event\">,\n): ConversationEventIdentity {\n  return `ciev1_${hashParts(\"opengeni:conversation-event:v1\", [\n    installation.provider,\n    installation.value,\n    providerEventId.value,\n  ])}` as ConversationEventIdentity;\n}\n\nfunction deriveConversationRouteIdentity(\n  installation: ConversationInstallationIdentity,\n  conversationId: ConversationProviderOpaqueId<\"conversation\">,\n  threadId: ConversationProviderOpaqueId<\"thread\"> | null,\n): ConversationRouteIdentity {\n  return `cirt1_${hashParts(\"opengeni:conversation-route:v1\", [\n    installation.provider,\n    installation.value,\n    conversationId.value,\n    threadId?.value ?? null,\n  ])}` as ConversationRouteIdentity;\n}\n\nfunction deriveConversationActorIdentity(\n  installation: ConversationInstallationIdentity,\n  actorId: ConversationProviderOpaqueId<\"actor\">,\n): ConversationActorIdentity {\n  return `ciac1_${hashParts(\"opengeni:conversation-actor:v1\", [\n    installation.provider,\n    installation.value,\n    actorId.value,\n  ])}` as ConversationActorIdentity;\n}\n\nfunction deriveConversationOperationIdentity(\n  installation: ConversationInstallationIdentity,\n  logicalOperationKey: string,\n): ConversationOperationIdentity {\n  return `ciop1_${hashParts(\"opengeni:conversation-operation:v1\", [\n    installation.provider,\n    installation.value,\n    logicalOperationKey,\n  ])}` as ConversationOperationIdentity;\n}\n\nfunction deliveryRequestDigest(input: {\n  kind: ConversationDeliveryCommand[\"kind\"];\n  installation: ConversationInstallationIdentity;\n  route: ConversationRoute;\n  targetProviderMessageId: ConversationProviderOpaqueId<\"message\"> | null;\n  text: string | null;\n}): ConversationRequestDigest {\n  return `sha256:${createHash(\"sha256\")\n    .update(\"opengeni:conversation-delivery-request:v1\\0\", \"utf8\")\n    .update(\n      JSON.stringify({\n        kind: input.kind,\n        installation: providerIdWire(input.installation),\n        route: routeWire(input.route),\n        targetProviderMessageId: input.targetProviderMessageId\n          ? providerIdWire(input.targetProviderMessageId)\n          : null,\n        text: input.text,\n      }),\n      \"utf8\",\n    )\n    .digest(\"hex\")}` as ConversationRequestDigest;\n}\n\nfunction hashParts(domain: string, parts: readonly (string | null)[]): string {\n  const hash = createHash(\"sha256\");\n  hash.update(domain, \"utf8\").update(\"\\0\", \"utf8\");\n  for (const part of parts) {\n    if (part === null) {\n      hash.update(\"n:\", \"utf8\");\n      continue;\n    }\n    const bytes = textEncoder.encode(part);\n    hash.update(`s:${bytes.byteLength}:`, \"utf8\").update(bytes);\n  }\n  return hash.digest(\"hex\");\n}\n\nfunction assertConversationInstallationIdentity(\n  value: unknown,\n): asserts value is ConversationInstallationIdentity {\n  assertProviderOpaqueId(value, \"installation\");\n}\n\nfunction assertConversationActor(value: unknown): asserts value is ConversationActor {\n  assertExactObject(value, \"normalized conversation actor\", [\n    \"installation\",\n    \"providerActorId\",\n    \"kind\",\n    \"identity\",\n  ]);\n  assertConversationInstallationIdentity(value.installation);\n  assertProviderOpaqueId(value.providerActorId, \"actor\");\n  if (value.kind !== \"human\" && value.kind !== \"bot\" && value.kind !== \"system\") {\n    throw new TypeError(\"conversation actor kind is unsupported\");\n  }\n  assertSameProvider(value.installation.provider, value.providerActorId.provider, \"actor id\");\n  if (\n    value.identity !== deriveConversationActorIdentity(value.installation, value.providerActorId)\n  ) {\n    throw new TypeError(\"conversation actor identity is not canonical\");\n  }\n}\n\nfunction assertConversationRoute(value: unknown): asserts value is ConversationRoute {\n  assertExactObject(value, \"normalized conversation route\", [\n    \"installation\",\n    \"providerConversationId\",\n    \"providerThreadId\",\n    \"identity\",\n  ]);\n  assertConversationInstallationIdentity(value.installation);\n  assertProviderOpaqueId(value.providerConversationId, \"conversation\");\n  if (value.providerThreadId !== null) assertProviderOpaqueId(value.providerThreadId, \"thread\");\n  assertSameProvider(\n    value.installation.provider,\n    value.providerConversationId.provider,\n    \"conversation id\",\n  );\n  if (value.providerThreadId) {\n    assertSameProvider(value.installation.provider, value.providerThreadId.provider, \"thread id\");\n  }\n  if (\n    value.identity !==\n    deriveConversationRouteIdentity(\n      value.installation,\n      value.providerConversationId,\n      value.providerThreadId,\n    )\n  ) {\n    throw new TypeError(\"conversation route identity is not canonical\");\n  }\n}\n\nfunction assertConversationAttachmentReference(\n  value: unknown,\n): asserts value is ConversationAttachmentReference {\n  assertExactObject(value, \"normalized attachment reference\", [\n    \"providerAttachmentId\",\n    \"fileName\",\n    \"mediaType\",\n    \"byteSize\",\n    \"contentSha256\",\n  ]);\n  assertProviderOpaqueId(value.providerAttachmentId, \"attachment\");\n  if (\n    ABSOLUTE_URL_PATTERN.test(value.providerAttachmentId.value) ||\n    value.providerAttachmentId.value.startsWith(\"//\")\n  ) {\n    throw new TypeError(\"attachment references cannot contain provider URLs\");\n  }\n  const fileName = nullableBoundedString(\n    value.fileName,\n    \"attachment fileName\",\n    CONVERSATION_ATTACHMENT_NAME_MAX_UTF8_BYTES,\n  );\n  if (fileName?.includes(\"/\") || fileName?.includes(\"\\\\\")) {\n    throw new TypeError(\"attachment fileName must not contain a path\");\n  }\n  const mediaType = nullableBoundedString(\n    value.mediaType,\n    \"attachment mediaType\",\n    CONVERSATION_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES,\n  );\n  if (mediaType !== null && !MEDIA_TYPE_PATTERN.test(mediaType)) {\n    throw new TypeError(\"attachment mediaType is invalid\");\n  }\n  const byteSize = value.byteSize;\n  if (byteSize !== null) {\n    if (typeof byteSize !== \"number\" || !Number.isSafeInteger(byteSize) || byteSize < 0) {\n      throw new RangeError(\"attachment byteSize must be a non-negative safe integer or null\");\n    }\n  }\n  const contentSha256 = value.contentSha256;\n  if (contentSha256 !== null) {\n    if (typeof contentSha256 !== \"string\" || !SHA256_PATTERN.test(contentSha256)) {\n      throw new TypeError(\"attachment contentSha256 must be 64 lowercase hexadecimal characters\");\n    }\n  }\n}\n\nfunction assertProviderOpaqueId<TKind extends ConversationProviderOpaqueIdKind>(\n  value: unknown,\n  kind: TKind,\n): asserts value is ConversationProviderOpaqueId<TKind> {\n  assertExactObject(value, `provider ${kind} id`, [\"provider\", \"kind\", \"value\"]);\n  providerNamespace(value.provider as string);\n  if (value.kind !== kind) throw new TypeError(`provider id must have kind ${kind}`);\n  boundedOpaqueString(\n    value.value,\n    `provider ${kind} id`,\n    CONVERSATION_PROVIDER_OPAQUE_ID_MAX_UTF8_BYTES,\n  );\n}\n\nfunction assertSameProvider(\n  expected: ConversationProviderNamespace,\n  actual: ConversationProviderNamespace,\n  label: string,\n): void {\n  if (expected !== actual) throw new TypeError(`${label} provider namespace does not match`);\n}\n\nfunction assertSameInstallation(\n  expected: ConversationInstallationIdentity,\n  actual: ConversationInstallationIdentity,\n  label: string,\n): void {\n  if (expected.provider !== actual.provider || expected.value !== actual.value) {\n    throw new TypeError(`${label} installation identity does not match`);\n  }\n}\n\nfunction boundedExactText(value: unknown, label: string, allowEmpty: boolean): string {\n  return boundedString(value, label, allowEmpty ? 0 : 1, CONVERSATION_TEXT_MAX_UTF8_BYTES, true);\n}\n\nfunction boundedOpaqueString(value: unknown, label: string, maxBytes: number): string {\n  const result = boundedString(value, label, 1, maxBytes, false);\n  if (result !== result.trim())\n    throw new TypeError(`${label} must not have surrounding whitespace`);\n  return result;\n}\n\nfunction nullableBoundedString(value: unknown, label: string, maxBytes: number): string | null {\n  if (value === undefined || value === null) return null;\n  return boundedString(value, label, 1, maxBytes, false);\n}\n\nfunction boundedString(\n  value: unknown,\n  label: string,\n  minBytes: number,\n  maxBytes: number,\n  allowNewlines: boolean,\n): string {\n  if (typeof value !== \"string\") throw new TypeError(`${label} must be a string`);\n  if (!isWellFormedUnicode(value)) throw new TypeError(`${label} must be well-formed Unicode`);\n  if (value.includes(\"\\0\")) throw new TypeError(`${label} must not contain NUL`);\n  if (!allowNewlines && /[\\u0001-\\u001f\\u007f]/u.test(value)) {\n    throw new TypeError(`${label} must not contain control characters`);\n  }\n  const byteLength = textEncoder.encode(value).byteLength;\n  if (byteLength < minBytes || byteLength > maxBytes) {\n    throw new RangeError(`${label} must contain ${minBytes}-${maxBytes} UTF-8 bytes`);\n  }\n  return value;\n}\n\nfunction isWellFormedUnicode(value: string): boolean {\n  for (let index = 0; index < value.length; index += 1) {\n    const code = value.charCodeAt(index);\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1);\n      if (!(next >= 0xdc00 && next <= 0xdfff)) return false;\n      index += 1;\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      return false;\n    }\n  }\n  return true;\n}\n\nfunction canonicalTimestamp(value: unknown, label: string): string {\n  const timestamp = boundedString(value, label, 20, 32, false);\n  const milliseconds = Date.parse(timestamp);\n  if (!Number.isFinite(milliseconds) || new Date(milliseconds).toISOString() !== timestamp) {\n    throw new TypeError(`${label} must be a canonical UTC timestamp`);\n  }\n  return timestamp;\n}\n\nfunction outcomeCode(value: unknown): string {\n  const code = boundedOpaqueString(\n    value,\n    \"delivery outcome code\",\n    CONVERSATION_OUTCOME_CODE_MAX_UTF8_BYTES,\n  );\n  if (!OUTCOME_CODE_PATTERN.test(code)) {\n    throw new TypeError(\"delivery outcome code must use canonical lowercase segments\");\n  }\n  return code;\n}\n\nfunction assertExactObject(\n  value: unknown,\n  label: string,\n  allowedKeys: readonly string[],\n): asserts value is Record<string, unknown> {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new TypeError(`${label} must be an object`);\n  }\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype !== Object.prototype && prototype !== null) {\n    throw new TypeError(`${label} must be a plain object`);\n  }\n  const allowed = new Set(allowedKeys);\n  for (const key of Reflect.ownKeys(value)) {\n    if (typeof key !== \"string\" || !allowed.has(key)) {\n      throw new TypeError(`${label} contains an unsupported field`);\n    }\n  }\n}\n\nfunction assertIdentity(value: unknown, pattern: RegExp, label: string): asserts value is string {\n  if (typeof value !== \"string\" || !pattern.test(value)) {\n    throw new TypeError(`${label} is invalid`);\n  }\n}\n\nfunction providerIdWire<TKind extends ConversationProviderOpaqueIdKind>(\n  id: ConversationProviderOpaqueId<TKind>,\n): { provider: string; kind: TKind; value: string } {\n  return { provider: id.provider, kind: id.kind, value: id.value };\n}\n\nfunction actorWire(actor: ConversationActor) {\n  return {\n    installation: providerIdWire(actor.installation),\n    providerActorId: providerIdWire(actor.providerActorId),\n    kind: actor.kind,\n    identity: actor.identity,\n  };\n}\n\nfunction routeWire(route: ConversationRoute) {\n  return {\n    installation: providerIdWire(route.installation),\n    providerConversationId: providerIdWire(route.providerConversationId),\n    providerThreadId: route.providerThreadId ? providerIdWire(route.providerThreadId) : null,\n    identity: route.identity,\n  };\n}\n\nfunction signalWire(signal: ConversationSignal) {\n  return signal.kind === \"control\"\n    ? { kind: \"control\" as const, control: signal.control }\n    : { kind: signal.kind };\n}\n\nfunction attachmentWire(attachment: ConversationAttachmentReference) {\n  return {\n    providerAttachmentId: providerIdWire(attachment.providerAttachmentId),\n    fileName: attachment.fileName,\n    mediaType: attachment.mediaType,\n    byteSize: attachment.byteSize,\n    contentSha256: attachment.contentSha256,\n  };\n}\n\nfunction deliveryCommandWire(command: ConversationDeliveryCommand) {\n  return {\n    schemaVersion: command.schemaVersion,\n    operationId: command.operationId,\n    logicalOperationKey: command.logicalOperationKey,\n    requestDigest: command.requestDigest,\n    installation: providerIdWire(command.installation),\n    route: routeWire(command.route),\n    kind: command.kind,\n    targetProviderMessageId: command.targetProviderMessageId\n      ? providerIdWire(command.targetProviderMessageId)\n      : null,\n    text: command.text,\n  };\n}\n\nfunction providerReceiptWire(receipt: ConversationProviderReceipt) {\n  return {\n    schemaVersion: receipt.schemaVersion,\n    operationId: receipt.operationId,\n    requestDigest: receipt.requestDigest,\n    installation: providerIdWire(receipt.installation),\n    providerMessageId: providerIdWire(receipt.providerMessageId),\n    providerReceiptId: receipt.providerReceiptId ? providerIdWire(receipt.providerReceiptId) : null,\n    observedAt: receipt.observedAt,\n  };\n}\n","// Pure, HTTP-shaped guard helpers for the workspace member + workspace delete\n// routes. Kept out of the route bodies so the don't-orphan rules (never remove\n// the last admin, never delete an account's last workspace or one with a live\n// session) are unit-testable without a database.\nimport type { Permission, WorkspaceMember } from \"@opengeni/contracts\";\nimport { HTTPException } from \"hono/http-exception\";\n\n/** The membership permission that grants member-management (admin is the wildcard). */\nconst MEMBER_ADMIN_PERMISSIONS: Permission[] = [\"workspace:admin\", \"members:manage\"];\n\n/** A member can manage other members (directly or via the admin wildcard). */\nexport function memberCanAdminister(member: Pick<WorkspaceMember, \"permissions\">): boolean {\n  return member.permissions.some((permission) => MEMBER_ADMIN_PERMISSIONS.includes(permission));\n}\n\n/** Only `user:` subjects are people; `api_key:` subjects belong to API keys. */\nexport function isUserMember(member: Pick<WorkspaceMember, \"subjectId\">): boolean {\n  return member.subjectId.startsWith(\"user:\");\n}\n\n/**\n * Turn an email lookup result into the membership subject id. A null id means\n * no registered user matched the email — email invites for not-yet-registered\n * users are deferred, so that is a 404 (not a 400) at the API surface.\n */\nexport function resolveMemberSubjectId(userId: string | null): string {\n  if (!userId) {\n    throw new HTTPException(404, { message: \"user is not registered\" });\n  }\n  return `user:${userId}`;\n}\n\n/**\n * Guard the member-remove path. Refuses (409) to remove the caller's own\n * membership and refuses to remove the last member that still holds an admin\n * permission, so a workspace can never be orphaned with no one able to manage\n * it. `members` is the full roster (every subject, including api_key ones —\n * an api_key with workspace:admin still counts as an administering subject).\n */\nexport function assertWorkspaceMemberRemovable(input: {\n  members: WorkspaceMember[];\n  subjectId: string;\n  callerSubjectId: string;\n}): void {\n  const { members, subjectId, callerSubjectId } = input;\n  if (subjectId === callerSubjectId) {\n    throw new HTTPException(409, { message: \"you cannot remove your own membership\" });\n  }\n  const target = members.find((member) => member.subjectId === subjectId);\n  if (!target) {\n    throw new HTTPException(404, { message: \"member not found\" });\n  }\n  if (memberCanAdminister(target)) {\n    const remainingAdmins = members.filter(\n      (member) => member.subjectId !== subjectId && memberCanAdminister(member),\n    );\n    if (remainingAdmins.length === 0) {\n      throw new HTTPException(409, {\n        message: \"cannot remove the last member who can manage this workspace\",\n      });\n    }\n  }\n}\n\n/**\n * Guard the workspace-delete path before any external/DB mutation. Refuses\n * (409) to delete the account's last workspace, and refuses while any session\n * could still be running in Temporal (there is no clean per-session terminate\n * to call first, so we will not orphan a workflow — the operator must stop the\n * sessions first).\n */\nexport function assertWorkspaceDeletable(input: {\n  workspaceCountForAccount: number;\n  activeSessionCount: number;\n}): void {\n  if (input.workspaceCountForAccount <= 1) {\n    throw new HTTPException(409, { message: \"cannot delete the account's only workspace\" });\n  }\n  if (input.activeSessionCount > 0) {\n    throw new HTTPException(409, {\n      message: \"stop the workspace's running sessions before deleting it\",\n    });\n  }\n}\n","import {\n  GenerateVideoToolInput,\n  VideoGenerationAspectRatio,\n  VideoGenerationResolution,\n  VideoGenerationSourceMode,\n  type GenerateVideoToolInput as GenerateVideoToolInputType,\n  type VideoGenerationFundingSource,\n  type VideoGenerationModelCapability,\n} from \"@opengeni/contracts\";\nimport { createHash } from \"node:crypto\";\n\nexport const VIDEO_GENERATION_ADAPTER_VERSION = \"gateway-video-v4/1\" as const;\n\nexport type SealedVideoReferenceRole =\n  | \"first_frame\"\n  | \"last_frame\"\n  | \"image_reference\"\n  | \"video_reference\";\n\nexport type SealedVideoReference = Readonly<{\n  role: SealedVideoReferenceRole;\n  contentSha256: string;\n  contentType: string;\n  byteSize: number;\n}>;\n\nexport type CanonicalVideoGenerationRequest = Readonly<{\n  schemaVersion: 1;\n  modelId: string;\n  prompt: string;\n  sourceMode: VideoGenerationSourceMode;\n  references: readonly SealedVideoReference[];\n  durationSeconds: number;\n  aspectRatio: VideoGenerationAspectRatio;\n  resolution: VideoGenerationResolution;\n  generateAudio: boolean;\n}>;\n\nexport type VideoGenerationOperationState =\n  | \"preparing\"\n  | \"prepared\"\n  | \"accepted\"\n  | \"submission_uncertain\"\n  | \"provider_started\"\n  | \"retaining\"\n  | \"completed\"\n  | \"provider_failed\"\n  | \"cancelled_before_submit\"\n  | \"outcome_unknown\"\n  | \"retention_failed\";\n\nconst TERMINAL_STATES = new Set<VideoGenerationOperationState>([\n  \"completed\",\n  \"provider_failed\",\n  \"cancelled_before_submit\",\n  \"outcome_unknown\",\n  \"retention_failed\",\n]);\n\nconst ALLOWED_TRANSITIONS: Readonly<\n  Record<VideoGenerationOperationState, readonly VideoGenerationOperationState[]>\n> = Object.freeze({\n  preparing: [\"prepared\", \"cancelled_before_submit\"],\n  prepared: [\"accepted\", \"cancelled_before_submit\"],\n  accepted: [\"submission_uncertain\", \"provider_started\", \"cancelled_before_submit\"],\n  submission_uncertain: [\"provider_started\", \"outcome_unknown\"],\n  provider_started: [\"retaining\", \"provider_failed\", \"outcome_unknown\"],\n  retaining: [\"completed\", \"retention_failed\"],\n  completed: [],\n  provider_failed: [],\n  cancelled_before_submit: [],\n  outcome_unknown: [],\n  retention_failed: [],\n});\n\nexport function normalizeVideoGenerationRequest(input: {\n  toolInput: GenerateVideoToolInputType;\n  model: VideoGenerationModelCapability;\n  sealedReferences: readonly SealedVideoReference[];\n}): CanonicalVideoGenerationRequest {\n  const toolInput = GenerateVideoToolInput.parse(input.toolInput);\n  if (toolInput.modelId !== undefined && toolInput.modelId !== input.model.modelId) {\n    throw new Error(\"Video generation model changed during admission\");\n  }\n  const sourceMode = toolInput.source?.mode ?? \"text\";\n  if (!input.model.sourceModes.includes(sourceMode)) {\n    throw new Error(`Video generation source mode ${sourceMode} is unavailable`);\n  }\n  assertReferenceRoles(sourceMode, input.sealedReferences);\n\n  const durationSeconds = toolInput.durationSeconds ?? input.model.duration.minSeconds;\n  if (\n    durationSeconds < input.model.duration.minSeconds ||\n    durationSeconds > input.model.duration.maxSeconds ||\n    (durationSeconds - input.model.duration.minSeconds) % input.model.duration.stepSeconds !== 0\n  ) {\n    throw new Error(\"Video generation duration is unavailable for the selected model\");\n  }\n  const aspectRatio = toolInput.aspectRatio ?? input.model.aspectRatios[0];\n  const resolution = toolInput.resolution ?? input.model.resolutions[0];\n  if (!aspectRatio || !input.model.aspectRatios.includes(aspectRatio)) {\n    throw new Error(\"Video generation aspect ratio is unavailable for the selected model\");\n  }\n  if (!resolution || !input.model.resolutions.includes(resolution)) {\n    throw new Error(\"Video generation resolution is unavailable for the selected model\");\n  }\n  const generateAudio = toolInput.generateAudio ?? input.model.supportsAudio;\n  if (generateAudio && !input.model.supportsAudio) {\n    throw new Error(\"Audio generation is unavailable for the selected model\");\n  }\n\n  return Object.freeze({\n    schemaVersion: 1,\n    modelId: input.model.modelId,\n    prompt: toolInput.prompt,\n    sourceMode,\n    references: Object.freeze(\n      input.sealedReferences.map((reference) => Object.freeze({ ...reference })),\n    ),\n    durationSeconds,\n    aspectRatio,\n    resolution,\n    generateAudio,\n  });\n}\n\nexport function canonicalVideoGenerationRequestJson(\n  request: CanonicalVideoGenerationRequest,\n): string {\n  return JSON.stringify({\n    schemaVersion: request.schemaVersion,\n    modelId: request.modelId,\n    prompt: request.prompt,\n    sourceMode: request.sourceMode,\n    references: request.references.map((reference) => ({\n      role: reference.role,\n      contentSha256: reference.contentSha256,\n      contentType: reference.contentType,\n      byteSize: reference.byteSize,\n    })),\n    durationSeconds: request.durationSeconds,\n    aspectRatio: request.aspectRatio,\n    resolution: request.resolution,\n    generateAudio: request.generateAudio,\n  });\n}\n\nexport function videoGenerationRequestDigest(request: CanonicalVideoGenerationRequest): string {\n  return sha256(\n    \"opengeni:video-generation-request:v1\\0\",\n    canonicalVideoGenerationRequestJson(request),\n  );\n}\n\n/** Stable only for one logical tool call; intentional identical calls remain distinct. */\nexport function videoGenerationAdmissionKey(input: {\n  workspaceId: string;\n  sessionId: string;\n  turnId: string;\n  toolCallId: string;\n}): string {\n  return sha256(\n    \"opengeni:video-generation-admission:v1\\0\",\n    input.workspaceId,\n    input.sessionId,\n    input.turnId,\n    input.toolCallId,\n  );\n}\n\nexport function videoGenerationProviderIdempotencyKey(input: {\n  operationId: string;\n  requestDigest: string;\n}): string {\n  return `ogvid_${sha256(\n    \"opengeni:video-generation-provider-start:v1\\0\",\n    input.operationId,\n    input.requestDigest,\n  ).slice(0, 48)}`;\n}\n\nexport function videoGenerationCapabilityRevision(input: {\n  policyRevision: number;\n  fundingSource: VideoGenerationFundingSource;\n  credentialVersion: number;\n  modelIds: readonly string[];\n}): string {\n  return sha256(\n    \"opengeni:video-generation-capability:v1\\0\",\n    String(input.policyRevision),\n    input.fundingSource,\n    String(input.credentialVersion),\n    JSON.stringify([...input.modelIds].sort()),\n    VIDEO_GENERATION_ADAPTER_VERSION,\n  );\n}\n\nexport function assertVideoGenerationTransition(\n  from: VideoGenerationOperationState,\n  to: VideoGenerationOperationState,\n): void {\n  if (from === to) return;\n  if (!ALLOWED_TRANSITIONS[from].includes(to)) {\n    throw new Error(`Invalid video generation transition ${from} -> ${to}`);\n  }\n}\n\nexport function isTerminalVideoGenerationState(state: VideoGenerationOperationState): boolean {\n  return TERMINAL_STATES.has(state);\n}\n\nfunction assertReferenceRoles(\n  sourceMode: VideoGenerationSourceMode,\n  references: readonly SealedVideoReference[],\n): void {\n  const expected: readonly SealedVideoReferenceRole[] =\n    sourceMode === \"text\"\n      ? []\n      : sourceMode === \"first_frame\"\n        ? [\"first_frame\"]\n        : sourceMode === \"first_and_last_frames\"\n          ? [\"first_frame\", \"last_frame\"]\n          : sourceMode === \"image_reference\"\n            ? [\"image_reference\"]\n            : [\"video_reference\"];\n  if (\n    references.length !== expected.length ||\n    references.some((reference, index) => reference.role !== expected[index])\n  ) {\n    throw new Error(`Sealed references do not match video source mode ${sourceMode}`);\n  }\n  for (const reference of references) {\n    if (!/^[0-9a-f]{64}$/u.test(reference.contentSha256)) {\n      throw new Error(\"Video reference has an invalid SHA-256 digest\");\n    }\n    if (!Number.isSafeInteger(reference.byteSize) || reference.byteSize <= 0) {\n      throw new Error(\"Video reference has an invalid byte size\");\n    }\n    if (!reference.contentType.includes(\"/\")) {\n      throw new Error(\"Video reference has an invalid content type\");\n    }\n  }\n}\n\nfunction sha256(prefix: string, ...parts: string[]): string {\n  const hash = createHash(\"sha256\").update(prefix);\n  for (const part of parts) hash.update(part).update(\"\\0\");\n  return hash.digest(\"hex\");\n}\n","import {\n  GROK_IMAGINE_VIDEO_1_5_MODEL_ID,\n  SEEDANCE_2_5_MODEL_ID,\n  VideoGenerationCapabilities,\n  VideoGenerationPolicy,\n  type VideoGenerationModelCapability,\n  type VideoGenerationPolicy as VideoGenerationPolicyType,\n} from \"@opengeni/contracts\";\nimport { videoGenerationCapabilityRevision } from \"./video-generation\";\n\n/** Reviewed executable catalog. Dynamic workspace policy never mutates tool schemas. */\nexport const VIDEO_GENERATION_MODEL_CATALOG: readonly VideoGenerationModelCapability[] =\n  Object.freeze([\n    Object.freeze({\n      modelId: SEEDANCE_2_5_MODEL_ID,\n      label: \"Seedance 2.5\",\n      providerLabel: \"Vercel AI Gateway\",\n      sourceModes: Object.freeze([\n        \"text\",\n        \"first_frame\",\n        \"first_and_last_frames\",\n        \"image_reference\",\n        \"video_reference\",\n      ]),\n      resolutions: Object.freeze([\"480p\", \"720p\"]),\n      aspectRatios: Object.freeze([\"16:9\", \"4:3\", \"1:1\", \"3:4\", \"9:16\", \"21:9\", \"adaptive\"]),\n      duration: Object.freeze({\n        minSeconds: 4,\n        maxSeconds: 30,\n        stepSeconds: 1,\n      }),\n      supportsAudio: true,\n    }) as VideoGenerationModelCapability,\n    Object.freeze({\n      modelId: GROK_IMAGINE_VIDEO_1_5_MODEL_ID,\n      label: \"Grok Imagine Video 1.5\",\n      providerLabel: \"Connected SuperGrok\",\n      sourceModes: Object.freeze([\"text\", \"first_frame\", \"image_reference\"]),\n      resolutions: Object.freeze([\"480p\", \"720p\"]),\n      aspectRatios: Object.freeze([\"16:9\", \"4:3\", \"1:1\", \"3:4\", \"9:16\"]),\n      duration: Object.freeze({\n        minSeconds: 4,\n        maxSeconds: 15,\n        stepSeconds: 1,\n      }),\n      // xAI emits audio but exposes no separate audio wire option.\n      supportsAudio: true,\n    }) as VideoGenerationModelCapability,\n  ]);\n\nexport function videoGenerationModelSupportsFundingSource(\n  modelId: string,\n  fundingSource: VideoGenerationPolicyType[\"fundingSource\"],\n): boolean {\n  return modelId === GROK_IMAGINE_VIDEO_1_5_MODEL_ID\n    ? fundingSource === \"supergrok_subscription\"\n    : modelId === SEEDANCE_2_5_MODEL_ID\n      ? fundingSource === \"opengeni_credits\" || fundingSource === \"workspace_gateway\"\n      : false;\n}\n\nexport function defaultVideoGenerationPolicy(): VideoGenerationPolicyType {\n  return VideoGenerationPolicy.parse({\n    schemaVersion: 1,\n    revision: 0,\n    fundingSource: \"workspace_gateway\",\n    enabledModelIds: [],\n    defaultModelId: null,\n  });\n}\n\nexport function videoGenerationCapabilitiesForPolicy(input: {\n  policy: VideoGenerationPolicyType;\n  credentialVersion: number;\n}): VideoGenerationCapabilities {\n  const policy = VideoGenerationPolicy.parse(input.policy);\n  const enabled = new Set(policy.enabledModelIds);\n  const models = VIDEO_GENERATION_MODEL_CATALOG.filter(\n    (model) =>\n      enabled.has(model.modelId) &&\n      videoGenerationModelSupportsFundingSource(model.modelId, policy.fundingSource),\n  );\n  if (models.length === 0 || policy.defaultModelId === null) {\n    throw new Error(\"Video generation is disabled for this workspace\");\n  }\n  return VideoGenerationCapabilities.parse({\n    schemaVersion: 1,\n    capabilityRevision: videoGenerationCapabilityRevision({\n      policyRevision: policy.revision,\n      fundingSource: policy.fundingSource,\n      credentialVersion: input.credentialVersion,\n      modelIds: models.map((model) => model.modelId),\n    }),\n    defaultModelId: policy.defaultModelId,\n    models,\n  });\n}\n\nexport function assertKnownVideoGenerationModelIds(modelIds: readonly string[]): void {\n  const known = new Set(VIDEO_GENERATION_MODEL_CATALOG.map((model) => model.modelId));\n  for (const modelId of modelIds) {\n    if (!known.has(modelId)) throw new Error(`Unknown video generation model: ${modelId}`);\n  }\n}\n","import {\n  NewSessionDraft,\n  SaveNewSessionDraftRequest,\n  type AccessGrant,\n  type NewSessionDraft as NewSessionDraftValue,\n} from \"@opengeni/contracts\";\nimport {\n  getNewSessionDraftInTransaction,\n  getEnrollment,\n  getRig,\n  getSandbox,\n  getVariableSet,\n  NewSessionDraftAccessError,\n  newSessionDraftToolsProvided,\n  publicNewSessionDraftOptions,\n  requireFile,\n  saveNewSessionDraftInTransaction,\n  withWorkspaceSubjectRls,\n} from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\nimport type { AppDependencies } from \"../dependencies\";\nimport { settingsWithEnabledCapabilityMcpServers } from \"../domain/capabilities\";\nimport {\n  isAuthoritativeGitHubRepositorySelectionError,\n  normalizeResources,\n  validateFileResources,\n  validateGitHubRepositorySelection,\n  validateToolRefs,\n} from \"../domain/resources\";\nimport { hasPermission } from \"../access\";\nimport { assertConfiguredModel, assertWorkspaceModelPolicyAllows } from \"../domain/sessions\";\n\ntype NewSessionDraftDependencies = Pick<AppDependencies, \"settings\" | \"db\" | \"objectStorage\">;\n\nfunction hasOwn(value: unknown, key: string): boolean {\n  return typeof value === \"object\" && value !== null && Object.hasOwn(value, key);\n}\n\nfunction mapNewSessionDraft(\n  row: Awaited<ReturnType<typeof getNewSessionDraftInTransaction>>,\n): NewSessionDraftValue | null {\n  if (!row) return null;\n  return NewSessionDraft.parse({\n    revision: row.revision,\n    text: row.text,\n    resources: row.resources,\n    tools: newSessionDraftToolsProvided(row) ? row.tools : [],\n    toolsProvided: newSessionDraftToolsProvided(row),\n    model: row.model,\n    reasoningEffort: row.reasoningEffort,\n    latencyMode: row.latencyMode,\n    options: publicNewSessionDraftOptions(row),\n    updatedAt: row.updatedAt.toISOString(),\n  });\n}\n\nasync function hydrateNewSessionDraft(\n  deps: Pick<NewSessionDraftDependencies, \"db\" | \"settings\">,\n  grant: AccessGrant,\n  workspaceId: string,\n  row: Awaited<ReturnType<typeof getNewSessionDraftInTransaction>>,\n): Promise<NewSessionDraftValue | null> {\n  if (!row) return null;\n  const mapped = mapNewSessionDraft(row);\n  if (!mapped) return null;\n  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(\n    deps.db,\n    workspaceId,\n    deps.settings,\n    { subjectId: grant.subjectId },\n  );\n  const resources = [] as NewSessionDraftValue[\"resources\"];\n  for (const resource of mapped.resources) {\n    if (resource.kind === \"repository\") {\n      try {\n        await validateGitHubRepositorySelection(deps.db, workspaceId, [resource]);\n        resources.push(resource);\n      } catch (error) {\n        if (isAuthoritativeGitHubRepositorySelectionError(error)) {\n          // Repository authorization can be revoked after the draft was saved.\n          // The next form must not present the stale identity as selectable.\n          continue;\n        }\n        // A catalog/database outage is not proof that a repository was revoked.\n        // Preserve the resource so a later retry cannot autosave its deletion.\n        resources.push(resource);\n      }\n      continue;\n    }\n    try {\n      const file = await requireFile(deps.db, workspaceId, resource.fileId);\n      if (file.status === \"ready\") resources.push(resource);\n    } catch {\n      // Missing, foreign, failed, and pending files are stale draft state.\n    }\n  }\n\n  const options = { ...mapped.options };\n  if (options.variableSetId) {\n    if (\n      !hasPermission(grant.permissions, \"variable-sets:use\") ||\n      !(await getVariableSet(deps.db, workspaceId, options.variableSetId))\n    ) {\n      delete options.variableSetId;\n    }\n  }\n  if (options.rigId) {\n    const rig = await getRig(deps.db, workspaceId, options.rigId);\n    if (!rig?.activeVersion) delete options.rigId;\n  }\n  if (options.targetSandboxId) {\n    const sandbox = await getSandbox(deps.db, workspaceId, options.targetSandboxId);\n    const enrollment = sandbox?.enrollmentId\n      ? await getEnrollment(deps.db, workspaceId, sandbox.enrollmentId)\n      : null;\n    if (\n      !sandbox ||\n      sandbox.kind !== \"selfhosted\" ||\n      !enrollment ||\n      enrollment.status !== \"active\"\n    ) {\n      delete options.targetSandboxId;\n      delete options.workingDir;\n      delete options.sandboxBackend;\n    }\n  }\n\n  let tools: NewSessionDraftValue[\"tools\"] = [];\n  if (mapped.toolsProvided) {\n    try {\n      tools = validateToolRefs(mapped.tools, runtimeSettings);\n    } catch {\n      // A revoked/disabled MCP selection is removed while explicitness remains\n      // true, so an explicit empty policy cannot silently widen to defaults.\n      tools = mapped.tools.filter((tool) => {\n        try {\n          validateToolRefs([tool], runtimeSettings);\n          return true;\n        } catch {\n          return false;\n        }\n      });\n    }\n  }\n  return {\n    ...mapped,\n    resources,\n    tools,\n    options,\n  };\n}\n\n/** Read the authenticated actor's server-authoritative pre-session composer state. */\nexport async function getActorNewSessionDraft(\n  deps: Pick<NewSessionDraftDependencies, \"settings\" | \"db\">,\n  grant: AccessGrant,\n  workspaceId: string,\n): Promise<NewSessionDraftValue> {\n  const row = await withWorkspaceSubjectRls(deps.db, workspaceId, grant.subjectId, (scoped) =>\n    getNewSessionDraftInTransaction(scoped, {\n      workspaceId,\n      subjectId: grant.subjectId,\n    }),\n  );\n  return (\n    (await hydrateNewSessionDraft(deps, grant, workspaceId, row)) ?? {\n      revision: 0,\n      text: \"\",\n      resources: [],\n      tools: [],\n      toolsProvided: false,\n      model: deps.settings.openaiModel,\n      reasoningEffort: deps.settings.openaiReasoningEffort,\n      latencyMode: \"standard\",\n      options: {},\n      updatedAt: null,\n    }\n  );\n}\n\n/**\n * Validate and save one exact actor-private draft revision. Create-time-only\n * checks (live machine target, rig/variable-set state, and permission\n * delegation) intentionally remain in createSessionForRequest: a recoverable\n * draft may represent incomplete options, while no invalid option can become a\n * session without passing that single canonical create boundary.\n */\nexport async function saveActorNewSessionDraft(\n  deps: NewSessionDraftDependencies,\n  grant: AccessGrant,\n  workspaceId: string,\n  rawInput: unknown,\n): Promise<NewSessionDraftValue> {\n  const input = SaveNewSessionDraftRequest.parse(rawInput);\n  // The pre-marker client contract required `tools` and had no\n  // `toolsProvided`. Its array—including []—was the user's complete selection.\n  // Do this presence check before Zod's default turns the missing marker into\n  // false, preserving old-client → new-server intent safely.\n  const toolsProvided = hasOwn(rawInput, \"toolsProvided\") ? input.toolsProvided : true;\n  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(\n    deps.db,\n    workspaceId,\n    deps.settings,\n    { subjectId: grant.subjectId },\n  );\n  const resources = normalizeResources(input.resources);\n  const tools = toolsProvided ? validateToolRefs(input.tools, runtimeSettings) : [];\n  await validateGitHubRepositorySelection(deps.db, workspaceId, resources);\n  if (resources.some((resource) => resource.kind === \"file\") && !deps.objectStorage) {\n    throw new HTTPException(503, { message: \"object storage is not configured\" });\n  }\n  await validateFileResources(deps.db, workspaceId, resources);\n  assertConfiguredModel(deps.settings, input.model);\n  await assertWorkspaceModelPolicyAllows(deps.db, deps.settings, workspaceId, input.model);\n\n  try {\n    const saved = await withWorkspaceSubjectRls(deps.db, workspaceId, grant.subjectId, (scoped) =>\n      scoped.transaction((tx) =>\n        saveNewSessionDraftInTransaction(tx as unknown as typeof scoped, {\n          accountId: grant.accountId,\n          workspaceId,\n          subjectId: grant.subjectId,\n          expectedRevision: input.expectedRevision,\n          text: input.text,\n          resources,\n          tools,\n          toolsProvided,\n          model: input.model,\n          reasoningEffort: input.reasoningEffort,\n          latencyMode: input.latencyMode,\n          options: input.options,\n          // Only managed people are removed through removeWorkspaceMember().\n          // API keys and delegated service actors (for example the first-party\n          // worker MCP principal) legitimately have no workspace_memberships\n          // row, so they must not be rejected by the human-removal fence.\n          requireWorkspaceMembership: grant.subjectId.startsWith(\"user:\"),\n        }),\n      ),\n    );\n    return mapNewSessionDraft(saved)!;\n  } catch (error) {\n    if (error instanceof NewSessionDraftAccessError) {\n      throw new HTTPException(403, { message: error.message });\n    }\n    throw error;\n  }\n}\n","import type {\n  ComposerDraft,\n  DeleteSessionQueueItemRequest,\n  EditSessionQueueItemRequest,\n  MoveSessionQueueItemRequest,\n  SaveComposerDraftRequest,\n  AccessGrant,\n  SessionAuthorizationOperation,\n  SessionAuthorizationPort,\n  SessionAuthorizationSurface,\n  SessionCommandReceipt,\n  SessionControlRequest,\n  SessionControlResponse,\n  SessionQueueMutationResponse,\n  SteerSessionQueueItemRequest,\n  WorkspaceInferenceControlRequest,\n  WorkspaceInferenceControlResponse,\n} from \"@opengeni/contracts\";\nimport {\n  DraftTimelineAnnotations,\n  latencyModeForMetadata,\n  reasoningEffortForMetadata,\n} from \"@opengeni/contracts\";\nimport {\n  deleteSessionQueueItemInTransaction,\n  editQueuedTurnInTransaction,\n  getComposerDraftInTransaction,\n  getSession,\n  getSessionEvent,\n  getWorkspaceControlEvent,\n  getSessionQueueSnapshot,\n  moveQueuedTurnInTransaction,\n  mutateSessionControlInTransaction,\n  mutateWorkspaceControlInTransaction,\n  projectEffectiveControlForRelatedAccess,\n  runIdempotentPersistenceTransaction,\n  saveComposerDraftInTransaction,\n  sendAgentMessageInTransaction,\n  serializeEffectiveSessionControl,\n  steerAgentSessionInTransaction,\n  steerQueuedTurnInTransaction,\n  withWorkspaceRls,\n  withWorkspaceSessionActivityRls,\n  withWorkspaceSubjectRls,\n  withWorkspaceSubjectSessionActivityRls,\n  type Database,\n  type SessionActivityDatabase,\n  type SessionCommandReceiptRow,\n} from \"@opengeni/db\";\nimport {\n  publishDurableSessionEvents,\n  publishDurableWorkspaceControlEvent,\n  type EventBus,\n} from \"@opengeni/events\";\nimport type { SessionWorkflowClient } from \"../dependencies\";\nimport { normalizeResources } from \"../domain/resources\";\nimport { validateDraftTimelineAnnotations } from \"../domain/timeline-annotations\";\nimport {\n  requireSessionAuthorization,\n  type ResolvedSessionAuthorization,\n} from \"../session-authorization\";\n\nexport type HumanSessionCommandContext = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  subjectId: string;\n  /** See AgentSessionCommandContext.authorizationSurface. */\n  authorizationSurface?: SessionAuthorizationSurface;\n};\n\nexport type AgentSessionCommandContext = {\n  accountId: string;\n  workspaceId: string;\n  subjectId: string;\n  callerSessionId: string;\n  callerTurnId: string;\n  callerAttemptId: string;\n  callerExecutionGeneration: number;\n  /**\n   * The trusted adapter surface that owns this command's one authorization\n   * decision. Direct core callers omit it and retain the canonical `core`\n   * surface; adapters that delegate the complete command set it explicitly so\n   * they do not authorize once at the edge and then repeat the host call here.\n   */\n  authorizationSurface?: SessionAuthorizationSurface;\n};\n\ntype SessionAuthorizationCommandDeps = {\n  db: Database;\n  sessionAuthorization?: SessionAuthorizationPort | null;\n};\n\nfunction humanAccessGrant(context: HumanSessionCommandContext): AccessGrant {\n  return {\n    accountId: context.accountId,\n    workspaceId: context.workspaceId,\n    subjectId: context.subjectId,\n    permissions: [],\n  };\n}\n\nfunction agentAccessGrant(context: AgentSessionCommandContext): AccessGrant {\n  return {\n    accountId: context.accountId,\n    workspaceId: context.workspaceId,\n    subjectId: context.subjectId,\n    permissions: [],\n    metadata: {\n      sessionId: context.callerSessionId,\n      turnId: context.callerTurnId,\n      attemptId: context.callerAttemptId,\n      executionGeneration: context.callerExecutionGeneration,\n    },\n  };\n}\n\nasync function authorizeHumanSessionCommand(\n  deps: SessionAuthorizationCommandDeps,\n  context: HumanSessionCommandContext,\n  operation: SessionAuthorizationOperation,\n): Promise<ResolvedSessionAuthorization | null> {\n  return await requireSessionAuthorization(deps, humanAccessGrant(context), {\n    sessionId: context.sessionId,\n    operation,\n    surface: context.authorizationSurface ?? \"core\",\n  });\n}\n\nasync function authorizeAgentSessionCommand(\n  deps: SessionAuthorizationCommandDeps,\n  context: AgentSessionCommandContext,\n  targetSessionId: string,\n  operation: SessionAuthorizationOperation,\n): Promise<ResolvedSessionAuthorization | null> {\n  return await requireSessionAuthorization(deps, agentAccessGrant(context), {\n    sessionId: targetSessionId,\n    operation,\n    surface: context.authorizationSurface ?? \"core\",\n  });\n}\n\nfunction agentActor(context: AgentSessionCommandContext) {\n  return {\n    type: \"agent_attempt\" as const,\n    sessionId: context.callerSessionId,\n    turnId: context.callerTurnId,\n    attemptId: context.callerAttemptId,\n    executionGeneration: context.callerExecutionGeneration,\n  };\n}\n\n/**\n * Retry only one operation-keyed session command transaction. Callers keep\n * event publication and Temporal wake delivery after this returns, so a\n * deadlock/serialization retry can never replay an external effect. Human\n * draft ownership is applied inside every retry attempt when required.\n */\nasync function runSessionCommandPersistenceTransaction<T>(\n  deps: { db: Database },\n  scope: { workspaceId: string; subjectId?: string },\n  input: {\n    stage: string;\n    eventTypes: string[];\n    transaction: (tx: SessionActivityDatabase) => Promise<T>;\n  },\n): Promise<T> {\n  return await runIdempotentPersistenceTransaction(\n    {\n      stage: input.stage,\n      eventTypes: input.eventTypes,\n      maxAttempts: 3,\n    },\n    async () => {\n      const run = async (scoped: SessionActivityDatabase) => await input.transaction(scoped);\n      return scope.subjectId === undefined\n        ? await withWorkspaceSessionActivityRls(deps.db, scope.workspaceId, run)\n        : await withWorkspaceSubjectSessionActivityRls(\n            deps.db,\n            scope.workspaceId,\n            scope.subjectId,\n            run,\n          );\n    },\n  );\n}\n\nasync function publishAndWakeAgentCommand(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    workflowClient: Pick<SessionWorkflowClient, \"wakeSessionWorkflow\">;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  input: {\n    accountId: string;\n    workspaceId: string;\n    sessionId: string;\n    eventIds: string[];\n    workflowId: string;\n    wakeRevision: number | null;\n    shouldSignal: boolean;\n    interruptionCount: number;\n    controlRequested?: boolean;\n  },\n): Promise<void> {\n  await publishSessionEventIds(deps, input.workspaceId, input.sessionId, input.eventIds);\n  if (!input.shouldSignal || input.wakeRevision === null) return;\n  try {\n    await deps.workflowClient.wakeSessionWorkflow({\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sessionId: input.sessionId,\n      workflowId: input.workflowId,\n      wakeRevision: input.wakeRevision,\n      ...(input.controlRequested || input.interruptionCount > 0\n        ? { interruptionRequested: true }\n        : {}),\n    });\n  } catch {\n    console.warn(\n      \"[session-commands] immediate Agent command wake failed; durable outbox will retry\",\n      {\n        errorClass: \"WorkflowWakeOperationError\",\n        errorCode: \"agent_command_wake_failed\",\n        origin: \"core\",\n      },\n    );\n  }\n}\n\n/**\n * Nudge the one bounded dispatcher after a set-based control transaction. The\n * API never materializes descendant session ids; Postgres remains the complete\n * wake ledger and the 10-second Schedule repairs a lost immediate trigger.\n */\nasync function requestControlWakeDispatch(\n  deps: {\n    workflowClient: Pick<SessionWorkflowClient, \"requestSessionWorkflowWakeDispatch\">;\n  },\n  wakeCount: number,\n): Promise<void> {\n  if (wakeCount === 0) return;\n  try {\n    await deps.workflowClient.requestSessionWorkflowWakeDispatch();\n  } catch {\n    console.warn(\n      \"[session-commands] immediate control wake dispatch failed; durable outbox will retry\",\n      {\n        errorClass: \"WorkflowWakeOperationError\",\n        errorCode: \"control_wake_dispatch_failed\",\n        origin: \"core\",\n        wakeCount,\n      },\n    );\n  }\n}\n\nasync function publishSessionEventIds(\n  deps: { db: Database; bus: EventBus },\n  workspaceId: string,\n  sessionId: string,\n  eventIds: string[],\n): Promise<void> {\n  if (eventIds.length === 0) return;\n  const events = await Promise.all(\n    eventIds.map((eventId) => getSessionEvent(deps.db, workspaceId, eventId)),\n  );\n  await publishDurableSessionEvents(\n    deps.bus,\n    workspaceId,\n    sessionId,\n    events.filter((event): event is NonNullable<typeof event> => event !== null),\n  );\n}\n\nasync function publishWorkspaceControlEvent(\n  deps: { db: Database; bus: EventBus },\n  workspaceId: string,\n  eventId: string | null,\n): Promise<void> {\n  if (!eventId) return;\n  const event = await getWorkspaceControlEvent(deps.db, workspaceId, eventId);\n  if (!event) {\n    throw new Error(`Committed workspace control event disappeared: ${eventId}`);\n  }\n  await publishDurableWorkspaceControlEvent(deps.bus, workspaceId, event);\n}\n\nexport async function sendAgentSessionMessage(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    workflowClient: Pick<SessionWorkflowClient, \"wakeSessionWorkflow\">;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  context: AgentSessionCommandContext,\n  input: { targetSessionId: string; text: string; idempotencyKey: string },\n) {\n  await authorizeAgentSessionCommand(deps, context, input.targetSessionId, \"session.append\");\n  const result = await runSessionCommandPersistenceTransaction(\n    deps,\n    { workspaceId: context.workspaceId },\n    {\n      stage: \"session_commands.agent_message\",\n      eventTypes: [\"system.update.pending\"],\n      transaction: async (tx) =>\n        await sendAgentMessageInTransaction(tx, {\n          accountId: context.accountId,\n          workspaceId: context.workspaceId,\n          targetSessionId: input.targetSessionId,\n          actor: agentActor(context),\n          operationKey: input.idempotencyKey,\n          text: input.text,\n        }),\n    },\n  );\n  await publishAndWakeAgentCommand(deps, {\n    accountId: context.accountId,\n    workspaceId: context.workspaceId,\n    sessionId: input.targetSessionId,\n    eventIds: result.eventIds,\n    workflowId: result.workflowId,\n    wakeRevision: result.wakeRevision,\n    shouldSignal: result.shouldSignal,\n    interruptionCount: 0,\n  });\n  await publishWorkspaceControlEvent(deps, context.workspaceId, result.workspaceControlEventId);\n  return result;\n}\n\nexport async function steerAgentSession(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    workflowClient: Pick<SessionWorkflowClient, \"wakeSessionWorkflow\">;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  context: AgentSessionCommandContext,\n  input: {\n    targetSessionId: string;\n    instruction: string;\n    idempotencyKey: string;\n  },\n) {\n  await authorizeAgentSessionCommand(deps, context, input.targetSessionId, \"session.steer\");\n  const result = await runSessionCommandPersistenceTransaction(\n    deps,\n    { workspaceId: context.workspaceId },\n    {\n      stage: \"session_commands.agent_steer\",\n      eventTypes: [\"session.control.steer_requested\", \"system.update.pending\", \"turn.superseded\"],\n      transaction: async (tx) =>\n        await steerAgentSessionInTransaction(tx, {\n          accountId: context.accountId,\n          workspaceId: context.workspaceId,\n          targetSessionId: input.targetSessionId,\n          actor: agentActor(context),\n          operationKey: input.idempotencyKey,\n          instruction: input.instruction,\n        }),\n    },\n  );\n  await publishAndWakeAgentCommand(deps, {\n    accountId: context.accountId,\n    workspaceId: context.workspaceId,\n    sessionId: input.targetSessionId,\n    eventIds: result.eventIds,\n    workflowId: result.workflowId,\n    wakeRevision: result.wakeRevision,\n    shouldSignal: result.shouldSignal,\n    interruptionCount: result.interruptionCount,\n    controlRequested: true,\n  });\n  await publishWorkspaceControlEvent(deps, context.workspaceId, result.workspaceControlEventId);\n  return result;\n}\n\nexport async function controlAgentSessionWorkstream(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    workflowClient: Pick<SessionWorkflowClient, \"requestSessionWorkflowWakeDispatch\">;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  context: AgentSessionCommandContext,\n  input: {\n    targetSessionId: string;\n    action: \"pause\" | \"resume\";\n    idempotencyKey: string;\n    reason?: string | null;\n  },\n) {\n  const authorization = await authorizeAgentSessionCommand(\n    deps,\n    context,\n    input.targetSessionId,\n    \"session.control\",\n  );\n  const result = await runSessionCommandPersistenceTransaction(\n    deps,\n    { workspaceId: context.workspaceId },\n    {\n      stage: \"session_commands.agent_control\",\n      eventTypes: [input.action === \"pause\" ? \"session.control.paused\" : \"session.control.resumed\"],\n      transaction: async (tx) =>\n        await mutateSessionControlInTransaction(tx, {\n          accountId: context.accountId,\n          workspaceId: context.workspaceId,\n          sessionId: input.targetSessionId,\n          actor: agentActor(context),\n          operationKey: input.idempotencyKey,\n          action: input.action,\n          reason: input.reason ?? null,\n        }),\n    },\n  );\n  await publishSessionEventIds(deps, context.workspaceId, input.targetSessionId, [\n    result.sessionControlEventId,\n  ]);\n  await publishWorkspaceControlEvent(deps, context.workspaceId, result.workspaceControlEventId);\n  await requestControlWakeDispatch(deps, result.wakeCount);\n  return { ...result, authorization };\n}\n\nfunction receipt(row: SessionCommandReceiptRow): SessionCommandReceipt {\n  return {\n    id: row.id,\n    action: row.action,\n    operationKey: row.operationKey,\n    targetSessionId: row.targetSessionId,\n    targetTurnId: row.targetTurnId,\n    appliedControlRevision: row.appliedControlRevision,\n    appliedQueueVersion: row.appliedQueueVersion,\n    appliedTurnVersion: row.appliedTurnVersion,\n    appliedDraftRevision: row.appliedDraftRevision,\n    createdAt: row.createdAt.toISOString(),\n  };\n}\n\nfunction composerDraft(\n  row: Awaited<ReturnType<typeof getComposerDraftInTransaction>>,\n): ComposerDraft | null {\n  if (!row) return null;\n  return {\n    revision: row.revision,\n    text: row.text,\n    annotations: DraftTimelineAnnotations.parse(row.annotations),\n    resources: row.resources as ComposerDraft[\"resources\"],\n    model: row.model,\n    reasoningEffort: row.reasoningEffort as ComposerDraft[\"reasoningEffort\"],\n    latencyMode: row.latencyMode as ComposerDraft[\"latencyMode\"],\n    sourceTurnId: row.sourceTurnId,\n    sourceTurnVersion: row.sourceTurnVersion,\n    updatedAt: row.updatedAt.toISOString(),\n  };\n}\n\nasync function authoritativeQueue(\n  db: Database,\n  workspaceId: string,\n  sessionId: string,\n  relatedSessionAccess: \"target\" | \"root\",\n) {\n  const snapshot = await getSessionQueueSnapshot(db, workspaceId, sessionId);\n  if (!snapshot) throw new Error(`Session not found: ${sessionId}`);\n  return {\n    ...snapshot,\n    effectiveControl: projectEffectiveControlForRelatedAccess(\n      snapshot.effectiveControl,\n      sessionId,\n      relatedSessionAccess,\n    ),\n  };\n}\n\nexport async function moveHumanQueuePrompt(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  context: HumanSessionCommandContext,\n  turnId: string,\n  input: MoveSessionQueueItemRequest,\n): Promise<SessionQueueMutationResponse> {\n  const authorization = await authorizeHumanSessionCommand(deps, context, \"session.queue.control\");\n  const result = await runSessionCommandPersistenceTransaction(\n    deps,\n    { workspaceId: context.workspaceId },\n    {\n      stage: \"session_commands.human_queue_move\",\n      eventTypes: [\"session.queue.changed\"],\n      transaction: async (tx) =>\n        await moveQueuedTurnInTransaction(tx, {\n          ...context,\n          turnId,\n          beforeTurnId: input.beforeTurnId,\n          expectedQueueVersion: input.expectedQueueVersion,\n          actor: { type: \"human\", subjectId: context.subjectId },\n          operationKey: input.clientEventId,\n        }),\n    },\n  );\n  const response = {\n    receipt: receipt(result.receipt),\n    snapshot: await authoritativeQueue(\n      deps.db,\n      context.workspaceId,\n      context.sessionId,\n      authorization?.relatedSessionAccess ?? \"root\",\n    ),\n  };\n  await publishSessionEventIds(deps, context.workspaceId, context.sessionId, result.eventIds);\n  return response;\n}\n\nexport async function deleteHumanQueuePrompt(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  context: HumanSessionCommandContext,\n  turnId: string,\n  input: DeleteSessionQueueItemRequest,\n): Promise<SessionQueueMutationResponse> {\n  const authorization = await authorizeHumanSessionCommand(deps, context, \"session.queue.control\");\n  const result = await runSessionCommandPersistenceTransaction(\n    deps,\n    { workspaceId: context.workspaceId },\n    {\n      stage: \"session_commands.human_queue_delete\",\n      eventTypes: [\"session.queue.changed\"],\n      transaction: async (tx) =>\n        await deleteSessionQueueItemInTransaction(tx, {\n          ...context,\n          turnId,\n          expectedTurnVersion: input.expectedTurnVersion,\n          actor: { type: \"human\", subjectId: context.subjectId },\n          operationKey: input.clientEventId,\n          reason: input.reason ?? null,\n        }),\n    },\n  );\n  const response = {\n    receipt: receipt(result.receipt),\n    snapshot: await authoritativeQueue(\n      deps.db,\n      context.workspaceId,\n      context.sessionId,\n      authorization?.relatedSessionAccess ?? \"root\",\n    ),\n  };\n  await publishSessionEventIds(deps, context.workspaceId, context.sessionId, result.eventIds);\n  return response;\n}\n\nexport async function editHumanQueuePrompt(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  context: HumanSessionCommandContext,\n  turnId: string,\n  input: EditSessionQueueItemRequest,\n): Promise<SessionQueueMutationResponse> {\n  const authorization = await authorizeHumanSessionCommand(deps, context, \"session.queue.control\");\n  const result = await runSessionCommandPersistenceTransaction(\n    deps,\n    { workspaceId: context.workspaceId, subjectId: context.subjectId },\n    {\n      stage: \"session_commands.human_queue_edit\",\n      eventTypes: [\"session.queue.changed\"],\n      transaction: async (tx) =>\n        await editQueuedTurnInTransaction(tx, {\n          ...context,\n          turnId,\n          expectedTurnVersion: input.expectedTurnVersion,\n          expectedDraftRevision: input.expectedDraftRevision,\n          replaceDraft: input.replaceDraft,\n          actor: { type: \"human\", subjectId: context.subjectId },\n          operationKey: input.clientEventId,\n        }),\n    },\n  );\n  const response = {\n    receipt: receipt(result.receipt),\n    snapshot: await authoritativeQueue(\n      deps.db,\n      context.workspaceId,\n      context.sessionId,\n      authorization?.relatedSessionAccess ?? \"root\",\n    ),\n    draft: composerDraft(result.draft)!,\n  };\n  await publishSessionEventIds(deps, context.workspaceId, context.sessionId, result.eventIds);\n  return response;\n}\n\nexport async function steerHumanQueuePrompt(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  context: HumanSessionCommandContext,\n  turnId: string,\n  input: SteerSessionQueueItemRequest,\n): Promise<SessionQueueMutationResponse> {\n  const authorization = await authorizeHumanSessionCommand(deps, context, \"session.queue.control\");\n  const result = await runSessionCommandPersistenceTransaction(\n    deps,\n    { workspaceId: context.workspaceId },\n    {\n      stage: \"session_commands.human_queue_steer\",\n      eventTypes: [\"session.control.steer_requested\", \"session.queue.changed\", \"turn.superseded\"],\n      transaction: async (tx) =>\n        await steerQueuedTurnInTransaction(tx, {\n          ...context,\n          turnId,\n          expectedTurnVersion: input.expectedTurnVersion,\n          controlEtag: input.controlEtag ?? null,\n          actor: { type: \"human\", subjectId: context.subjectId },\n          operationKey: input.clientEventId,\n        }),\n    },\n  );\n  const response = {\n    receipt: receipt(result.receipt),\n    snapshot: await authoritativeQueue(\n      deps.db,\n      context.workspaceId,\n      context.sessionId,\n      authorization?.relatedSessionAccess ?? \"root\",\n    ),\n  };\n  await publishSessionEventIds(deps, context.workspaceId, context.sessionId, result.eventIds);\n  await publishWorkspaceControlEvent(deps, context.workspaceId, result.workspaceControlEventId);\n  return response;\n}\n\nexport async function controlHumanSessionWorkstreamWithOutcome(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    workflowClient: Pick<SessionWorkflowClient, \"requestSessionWorkflowWakeDispatch\">;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  context: HumanSessionCommandContext,\n  input: SessionControlRequest,\n): Promise<{ response: SessionControlResponse; replay: boolean }> {\n  const authorization = await authorizeHumanSessionCommand(deps, context, \"session.control\");\n  const result = await runSessionCommandPersistenceTransaction(\n    deps,\n    { workspaceId: context.workspaceId },\n    {\n      stage: \"session_commands.human_control\",\n      eventTypes: [\n        input.action === \"resume\" ? \"session.control.resumed\" : \"session.control.paused\",\n      ],\n      transaction: async (tx) =>\n        await mutateSessionControlInTransaction(tx, {\n          accountId: context.accountId,\n          workspaceId: context.workspaceId,\n          sessionId: context.sessionId,\n          actor: { type: \"human\", subjectId: context.subjectId },\n          operationKey: input.clientEventId,\n          action: input.action,\n          reason: input.reason ?? null,\n          expectedControlEtag: input.expectedControlEtag ?? null,\n        }),\n    },\n  );\n  const response = {\n    receipt: receipt(result.receipt),\n    effectiveControl: projectEffectiveControlForRelatedAccess(\n      serializeEffectiveSessionControl(result.control),\n      context.sessionId,\n      authorization?.relatedSessionAccess ?? \"root\",\n    ),\n    interruptionCount: result.interruptionCount,\n    wakeCount: result.wakeCount,\n    cancelledSessionCount: result.cancelledSessionCount,\n    cancelledTurnCount: result.cancelledTurnCount,\n  };\n  for (const affected of result.affectedSessionEvents) {\n    await publishSessionEventIds(deps, context.workspaceId, affected.sessionId, affected.eventIds);\n  }\n  await publishWorkspaceControlEvent(deps, context.workspaceId, result.workspaceControlEventId);\n  await requestControlWakeDispatch(deps, result.wakeCount);\n  return { response, replay: result.replay };\n}\n\n/** Backward-compatible response path used by the REST control route. */\nexport async function controlHumanSessionWorkstream(\n  deps: Parameters<typeof controlHumanSessionWorkstreamWithOutcome>[0],\n  context: Parameters<typeof controlHumanSessionWorkstreamWithOutcome>[1],\n  input: Parameters<typeof controlHumanSessionWorkstreamWithOutcome>[2],\n): Promise<SessionControlResponse> {\n  return (await controlHumanSessionWorkstreamWithOutcome(deps, context, input)).response;\n}\n\nexport async function controlHumanWorkspace(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    workflowClient: Pick<SessionWorkflowClient, \"requestSessionWorkflowWakeDispatch\">;\n  },\n  context: Omit<HumanSessionCommandContext, \"sessionId\">,\n  input: WorkspaceInferenceControlRequest,\n): Promise<WorkspaceInferenceControlResponse> {\n  const result = await withWorkspaceRls(deps.db, context.workspaceId, (scoped) =>\n    scoped.transaction((tx) =>\n      mutateWorkspaceControlInTransaction(tx as unknown as Database, {\n        accountId: context.accountId,\n        workspaceId: context.workspaceId,\n        actor: { type: \"human\", subjectId: context.subjectId },\n        operationKey: input.clientEventId,\n        action: input.action,\n        reason: input.reason ?? null,\n        expectedRevision: input.expectedRevision ?? null,\n      }),\n    ),\n  );\n  const response = {\n    receipt: receipt(result.receipt),\n    state: result.workspaceState,\n    revision: result.revision,\n    interruptionCount: result.interruptionCount,\n    wakeCount: result.wakeCount,\n  };\n  await publishWorkspaceControlEvent(deps, context.workspaceId, result.workspaceControlEventId);\n  await requestControlWakeDispatch(deps, result.wakeCount);\n  return response;\n}\n\nexport async function getHumanComposerDraft(\n  deps: SessionAuthorizationCommandDeps,\n  context: HumanSessionCommandContext,\n): Promise<ComposerDraft> {\n  await authorizeHumanSessionCommand(deps, context, \"session.composer.read\");\n  const row = await withWorkspaceSubjectRls(\n    deps.db,\n    context.workspaceId,\n    context.subjectId,\n    (scoped) =>\n      getComposerDraftInTransaction(scoped, {\n        workspaceId: context.workspaceId,\n        sessionId: context.sessionId,\n        subjectId: context.subjectId,\n      }),\n  );\n  const mapped = composerDraft(row);\n  if (mapped) return mapped;\n  const session = await getSession(deps.db, context.workspaceId, context.sessionId);\n  if (!session) throw new Error(`Session not found: ${context.sessionId}`);\n  return {\n    revision: 0,\n    text: \"\",\n    annotations: [],\n    resources: [],\n    model: session.model,\n    reasoningEffort: reasoningEffortForMetadata(session.metadata, \"medium\"),\n    latencyMode: latencyModeForMetadata(session.metadata, \"standard\"),\n    sourceTurnId: null,\n    sourceTurnVersion: null,\n    updatedAt: null,\n  };\n}\n\nexport async function saveHumanComposerDraft(\n  deps: SessionAuthorizationCommandDeps,\n  context: HumanSessionCommandContext,\n  input: SaveComposerDraftRequest,\n): Promise<ComposerDraft> {\n  await authorizeHumanSessionCommand(deps, context, \"session.composer.write\");\n  const annotations = await validateDraftTimelineAnnotations(\n    deps.db,\n    context.workspaceId,\n    context.sessionId,\n    input.annotations ?? [],\n  );\n  const row = await withWorkspaceSubjectRls(\n    deps.db,\n    context.workspaceId,\n    context.subjectId,\n    (scoped) =>\n      scoped.transaction((tx) =>\n        saveComposerDraftInTransaction(tx as unknown as Database, {\n          ...context,\n          ...input,\n          annotations,\n          resources: normalizeResources(input.resources),\n          subjectId: context.subjectId,\n        }),\n      ),\n  );\n  return composerDraft(row)!;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACO,IAAM,+CACX;AACK,IAAM,iDACX;AACK,IAAM,6CAA6C;AAQnD,IAAM,mDAAmD;;;ACHzD,IAAM,sDAAsD,KAAK,KAAK;AAgCtE,IAAM,4BAAN,cAAwC,MAAM;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,OAKT;AACD,UAAM,MAAM,OAAO;AACnB,SAAK,OAAO;AACZ,SAAK,OAAO,MAAM;AAClB,SAAK,SAAS,MAAM,UAAU,yBAAyB,MAAM,IAAI;AACjE,SAAK,YAAY,MAAM,aAAa;AAAA,EACtC;AACF;AAEO,SAAS,yBAAyB,MAAmC;AAC1E,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL;AACE,aAAO;AAAA,EACX;AACF;AAiEO,SAAS,kBAAkB,UAA0B;AAC1D,SAAO,SAAS,KAAK,EAAE,YAAY;AACrC;AAEO,SAAS,mBAAmB,UAAkB,UAAsC;AACzF,QAAM,aAAa,kBAAkB,QAAQ;AAC7C,MAAI,SAAS,KAAK,CAAC,cAAc,kBAAkB,SAAS,MAAM,UAAU,GAAG;AAC7E,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,WAAW,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAAK;AACjD,SAAO,SAAS,KAAK,CAAC,cAAc;AAClC,UAAM,UAAU,kBAAkB,SAAS;AAC3C,WAAO,YAAY,QAAQ,QAAQ,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,MAAM;AAAA,EAC/D,CAAC;AACH;AAEO,SAAS,oBAAoB,UAA0B;AAC5D,QAAM,OAAO,kBAAkB,QAAQ,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK;AAC1D,UAAQ,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL;AACE,aAAO;AAAA,EACX;AACF;;;AC5KA;AAAA,EACE,iBAAAA;AAAA,EACA,cAAAC;AAAA,EACA;AAAA,EACA,qBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAEP;AAAA,EACE,kBAAAC;AAAA,EACA,yBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAMK;;;ACzBP,SAAS,wCAAuD;AAChE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,8BAA6C;AACtD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAYK;AAoBA,SAAS,wBAAwB,UAA2C;AACjF,QAAM,MAAM,SAAS,oBAAoB,KAAK;AAC9C,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,MACL,MAAM;AAAA,MACN,MAAM;AAAA,MACN,KAAK;AAAA,MACL,MAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,SAAS,KAAK,IAAI,MAAM,SAAS,GAAG,EAAE;AAC9D,UAAM,MAAM,IAAI,aAAa,UAAU,IAAI,aAAa;AACxD,UAAM,OAAO,IAAI,OAAO,OAAO,IAAI,IAAI,IAAI,MAAM,MAAM;AAEvD,UAAM,OAAO,IAAI,YAAY,IAAI,aAAa,MAAM,IAAI,WAAW;AACnE,WAAO,EAAE,MAAM,IAAI,UAAU,MAAM,KAAK,KAAK;AAAA,EAC/C,QAAQ;AACN,WAAO,EAAE,MAAM,KAAK,MAAM,KAAK,KAAK,MAAM,MAAM,UAAU;AAAA,EAC5D;AACF;AAYO,SAAS,0BAA0B,UAA4B;AACpE,MAAI,CAAC,SAAS,oBAAoB,KAAK,EAAG,QAAO;AACjD,QAAM,EAAE,MAAM,MAAM,KAAK,KAAK,IAAI,wBAAwB,QAAQ;AAClE,QAAM,SAAS,MAAM,QAAQ;AAC7B,QAAM,cAAc,MAAM,MAAM;AAChC,QAAM,YAAY,SAAS,cAAc,OAAO,GAAG,IAAI,IAAI,IAAI;AAC/D,SAAO,GAAG,MAAM,MAAM,SAAS,GAAG,IAAI;AACxC;AAEA,SAAS,kBAAkB,KAA6C;AACtE,SAAO,MACL,IAAI,eAAe,YAAmD;AACpE,QAAI,CAAC,KAAK;AACR,aAAO;AAAA,IACT;AACA,WAAO,IAAI,qBAAqB;AAAA,EAClC,CAAC;AACL;AAEA,eAAe,0BACb,UACA,aACA,SAC6C;AAC7C,MACE,SAAS,SAAS,yBAAyB,QAC3C,CAAC,SAAS,KAAK,yBACf,CAAC,QAAQ,cACT;AACA,WAAO;AAAA,EACT;AACA,QAAM,aAAa,MAAM,cAAc,SAAS,IAAI,aAAa,QAAQ,YAAY;AACrF,MAAI,YAAY,aAAa,KAAM,QAAO;AAC1C,SAAO;AAAA,IACL,WAAW,IAAI;AAAA,MACb,YAAY,SAAS,KAAK,wBAAwB,KAAK;AAAA,IACzD;AAAA,EACF;AACF;AAIO,SAAS,eAAe,UAA6B;AAC1D,SAAO,SAAS,6BAA6B;AAC/C;AAQO,SAAS,2BACd,UACA,KAsBA,aAC2B;AAC3B,QAAM,EAAE,IAAI,UAAU,IAAI,IAAI;AAC9B,QAAM,YAAY,IAAI;AACtB,QAAM,iBAAiB,YACnB,OAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF,MAGoD;AAGlD,QACE,QAAQ,cAAc,QACtB,QAAQ,eAAe,UACvB,QAAQ,uBAAuB,QAC/B;AACA,aAAO;AAAA,IACT;AACA,QAAI,QAAQ,gBAAgB,QAAW;AACrC,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AACA,UAAM,kBACJ,UAAU,YAAY,UAClB,MAAM,gDAAgD,UAAU,QAAQ,OAAO,IAC/E;AACN,UAAM,YAAY,MAAM,2CAA2C,IAAI;AAAA,MACrE,WAAW,IAAI;AAAA,MACf,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf,WAAW,IAAI,cAAc;AAAA,MAC7B,UAAU,IAAI,cAAc;AAAA,MAC5B,gBAAgB,UAAU;AAAA,MAC1B,eAAe,QAAQ;AAAA,MACvB,oBAAoB,QAAQ;AAAA,MAC5B,eAAe,QAAQ;AAAA,MACvB,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,iCAAiC,QAAQ;AAAA,MACxD,GAAI,SAAS,aAAa,EAAE,YAAY,SAAS,WAAW,IAAI,CAAC;AAAA,IACnE,CAAC;AACD,WAAO,EAAE,WAAW,gBAAgB;AAAA,EACtC,IACA;AACJ,QAAM,gBAAgB,YAClB,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,MAOqB;AACnB,QAAI,cAAc,KAAM;AACxB,QACE,CAAC,aACD,OAAO,cAAc,YACrB,QAAQ,eAAe,UACvB,QAAQ,uBAAuB,UAC/B,QAAQ,gBAAgB,QACxB;AACA,YAAM,IAAI,MAAM,qEAAqE;AAAA,IACvF;AACA,UAAM,iBAAiB;AACvB,UAAM,iBAAiB,eAAe;AACtC,QACE,CAAC,kBACD,OAAO,eAAe,OAAO,YAC7B,OAAO,eAAe,wBAAwB,YAC9C,EAAE,qBAAqB,iBACvB;AACA,YAAM,IAAI,MAAM,qEAAqE;AAAA,IACvF;AACA,QAAI,YAAY,cAAc,iBAAiB;AAC7C,YAAM,+BAA+B,IAAI;AAAA,QACvC,WAAW,IAAI;AAAA,QACf,aAAa,IAAI;AAAA,QACjB,WAAW,IAAI;AAAA,QACf,WAAW,gBAAgB;AAAA,QAC3B,mBAAmB,gBAAgB;AAAA,QACnC,aAAa,eAAe;AAAA,QAC5B,6BAA6B,eAAe;AAAA,QAC5C,WAAW;AAAA,QACX,iBAAiB,eAAe,mBAAmB;AAAA,QACnD,OAAO;AAAA,UACL,MAAM;AAAA,UACN,WAAW,IAAI,cAAc;AAAA,UAC7B,UAAU,IAAI,cAAc;AAAA,UAC5B,gBAAgB,UAAU;AAAA,UAC1B,eAAe,QAAQ;AAAA,UACvB,oBAAoB,QAAQ;AAAA,UAC5B,eAAe,eAAe;AAAA,UAC9B,YAAY,eAAe;AAAA,QAC7B;AAAA,MACF,CAAC;AACD;AAAA,IACF;AACA,UAAM,wCAAwC,IAAI;AAAA,MAChD,WAAW,IAAI;AAAA,MACf,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf,WAAW,IAAI,cAAc;AAAA,MAC7B,UAAU,IAAI,cAAc;AAAA,MAC5B,gBAAgB,UAAU;AAAA,MAC1B,eAAe,QAAQ;AAAA,MACvB,oBAAoB,QAAQ;AAAA,MAC5B,eAAe,eAAe;AAAA,MAC9B,YAAY,eAAe;AAAA,MAC3B,WAAW;AAAA,MACX,WAAW;AAAA,MACX;AAAA,IACF,CAAC;AAAA,EACH,IACA;AACJ,QAAM,wBAAwB,YAC1B,OAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF,MAKE,MAAM,6CAA6C,IAAI;AAAA,IACrD,WAAW,IAAI;AAAA,IACf,aAAa,IAAI;AAAA,IACjB,WAAW,IAAI;AAAA,IACf,WAAW,QAAQ;AAAA,IACnB,WAAW;AAAA,IACX,eAAe,iCAAiC,QAAQ;AAAA,IACxD,GAAI,SAAS,aAAa,EAAE,YAAY,SAAS,WAAW,IAAI,CAAC;AAAA,EACnE,CAAC,IACH;AACJ,QAAM,uBAAuB,YACzB,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,MAOqB;AACnB,QACE,CAAC,aACD,OAAO,cAAc,YACrB,OAAQ,UAAyD,OAAO,YACxE,OAAQ,UAAyD,wBAC/D,UACF;AACA,YAAM,IAAI,MAAM,qEAAqE;AAAA,IACvF;AACA,UAAM,wCAAwC,IAAI;AAAA,MAChD,WAAW,IAAI;AAAA,MACf,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA,WAAW;AAAA,MACX;AAAA,IACF,CAAC;AAAA,EACH,IACA;AACJ,QAAM,gBAAgB,YAClB,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF,MAIqB;AACnB,QACE,QAAQ,cAAc,QACtB,QAAQ,eAAe,UACvB,QAAQ,uBAAuB,UAC/B,QAAQ,gBAAgB,QACxB;AACA;AAAA,IACF;AACA,UAAM,UAAU,MAAM,mBAAmB,IAAI;AAAA,MAC3C,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf,WAAW,QAAQ;AAAA,IACrB,CAAC;AACD,QACE,CAAC,WACD,QAAQ,sBAAsB,QAAQ,qBACtC,QAAQ,oBAAoB,QAAQ,QACpC,QAAQ,uBAAuB,QAAQ,sBACvC,QAAQ,eAAe,QAAQ,cAC/B,QAAQ,eAAe,QAAQ,cAAc,OAAO,SAAS,aAC7D,QAAQ,kBAAkB,QAAQ,aAClC,QAAQ,eAAe,QAAQ,aAC/B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,sBAAsB,IAAI;AAAA,MAC9B,WAAW,IAAI;AAAA,MACf,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf,WAAW,QAAQ;AAAA,MACnB,UAAU,kCAAkC,OAAO;AAAA,MACnD,SAAS,MAAM;AAAA,MACf,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,MACd,aAAa,SAAS;AAAA,IACxB,CAAC;AAAA,EACH,IACA;AACJ,QAAM,WAAW,0BAA0B;AAAA,IACzC,aAAa,IAAI;AAAA,IACjB,gBAAgB,YAAY;AAAA,IAC5B,aAAa,YAAY;AAAA,IACzB,YAAY,OAAO,cAA+C;AAChE,YAAM,UAAU,MAAM,WAAW,IAAI,IAAI,aAAa,SAAS;AAC/D,aAAO,UACH;AAAA,QACE,IAAI,QAAQ;AAAA,QACZ,MAAM,QAAQ;AAAA,QACd,MAAM,QAAQ;AAAA,QACd,cAAc,QAAQ;AAAA,MACxB,IACA;AAAA,IACN;AAAA,IACA,mBAAmB,kBAAkB,GAAG;AAAA,IACxC,2BAA2B,CAAC,YAC1B,0BAA0B,UAAU,IAAI,aAAa,OAAO;AAAA,IAC9D,OAAO,wBAAwB,QAAQ;AAAA,IACvC,qBAAqB,SAAS;AAAA,IAC9B,yBAAyB,SAAS;AAAA,IAClC,GAAI,IAAI,mBACJ;AAAA,MACE,kBAAkB;AAAA,QAChB,WAAW,IAAI,iBAAiB;AAAA,QAChC,OAAO,IAAI,iBAAiB;AAAA,QAC5B,SAAS,YAAY;AAAA,MACvB;AAAA,IACF,IACA,CAAC;AAAA,IACL,GAAI,YACA;AAAA,MACE,uBAAuB,aAAa;AAAA,QAClC,SAAS,YAAY;AAAA,QACrB,WAAW;AAAA,QACX,MAAM,YAAY;AAAA,QAClB,YAAY,UAAU;AAAA,QACtB,oBAAoB,UAAU;AAAA,MAChC;AAAA,IACF,IACA,CAAC;AAAA,EACP,CAAC;AAED,QAAM,QAAQ,IAAI,sBAAsB;AAAA,IACtC,iBAAiB;AAAA,MACf,SAAS,YAAY;AAAA,MACrB,WAAW;AAAA,MACX,MAAM,YAAY;AAAA,MAClB,GAAI,YACA;AAAA,QACE,YAAY,UAAU;AAAA,QACtB,oBAAoB,UAAU;AAAA,MAChC,IACA,CAAC;AAAA,IACP;AAAA,IACA,aAAa,YAAY;AACvB,UAAI,CAAC,eAAe,QAAQ,GAAG;AAC7B,eAAO,EAAE,iBAAiB,MAAM,aAAa,EAAE;AAAA,MACjD;AACA,YAAM,UAAU,MAAM,kBAAkB,IAAI,IAAI,aAAa,IAAI,SAAS;AAC1E,aAAO,WAAW,EAAE,iBAAiB,MAAM,aAAa,EAAE;AAAA,IAC5D;AAAA,IACA,sBAAsB;AAAA,IACtB,GAAI,SAAS,qBAAqB,EAAE,aAAa,SAAS,mBAAmB,IAAI,CAAC;AAAA,IAClF,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,IAC3C,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA,IACzC,GAAI,wBAAwB,EAAE,sBAAsB,IAAI,CAAC;AAAA,IACzD,GAAI,uBAAuB,EAAE,qBAAqB,IAAI,CAAC;AAAA,IACvD,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA,IACzC,GAAI,YACA;AAAA,MACE,uBAAuB,OAAO,EAAE,MAAM,MAA0B;AAC9D,YAAI,CAAC,2CAA2C,UAAU,SAAS,KAAK,EAAG,QAAO;AAClF,cAAM,SAAS,MAAM,0BAA0B,IAAI;AAAA,UACjD,WAAW,IAAI;AAAA,UACf,aAAa,IAAI;AAAA,UACjB,gBAAgB,UAAU;AAAA,UAC1B,eAAe,UAAU;AAAA,UACzB,oBAAoB,UAAU;AAAA,UAC9B,YAAY;AAAA,QACd,CAAC;AACD,YAAI,OAAO,WAAW,YAAY,KAAK;AACrC,gBAAM,uBAAuB,IAAI,KAAK,IAAI,aAAa,IAAI,WAAW;AAAA,YACpE;AAAA,cACE,MAAM;AAAA,cACN,SAAS,EAAE,WAAW,UAAU,WAAW;AAAA,YAC7C;AAAA,UACF,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,QAC1B;AACA,cAAM,QAAQ,OAAO;AACrB,cAAM,UAAU,OAAO,SAAS,QAAQ;AACxC,eAAO;AAAA,UACL,YAAY,OAAO,cAAc,UAAU;AAAA,UAC3C,UACE,OAAO,WAAW,UACb,eACD,YAAY,YACT,YACD,YAAY,aACT,aACA;AAAA,QACb;AAAA,MACF;AAAA,IACF,IACA,CAAC;AAAA,EACP,CAAC;AAED,SAAO,EAAE,GAAG,aAAa,SAAS,MAAM;AAC1C;;;ADhbA,eAAsB,4BACpB,MACA,KACuB;AACvB,QAAM,UAAU,MAAM,eAAe,KAAK,IAAI,IAAI,aAAa,IAAI,SAAS;AAC5E,SAAO;AAAA,IACL,WAAW,IAAI;AAAA,IACf,aAAa,IAAI;AAAA,IACjB,WAAW,IAAI;AAAA,IACf,gBAAgB,QAAQ;AAAA,IACxB,gBAAgB,QAAQ;AAAA,EAC1B;AACF;AAmFA,IAAM,mBAAmB;AAEzB,SAAS,WAAW,KAAuC;AACzD,SAAO,IAAIC,gBAAe,YAAmD;AAC3E,QAAI,CAAC,KAAK;AACR,aAAO;AAAA,IACT;AACA,WAAO,IAAI,qBAAqB;AAAA,EAClC,CAAC;AACH;AAOA,eAAe,gBACb,UACA,aACA,YAC+E;AAC/E,QAAM,EAAE,UAAU,IAAI,IAAI;AAC1B,MAAI,iBAAiB;AACrB,MAAI,WAAW,WAAW,UAAU;AAClC,UAAM,UAAU,IAAI,kBAAkB;AAAA,MACpC;AAAA,MACA,SAAS,WAAW;AAAA,MACpB,YAAY,WAAW,GAAG;AAAA,MAC1B,OAAO,wBAAwB,QAAQ;AAAA,MACvC,WAAW;AAAA,IACb,CAAC;AACD,QAAI;AACF,uBAAiB,MAAM,QAAQ,KAAK;AAAA,IACtC,QAAQ;AACN,uBAAiB;AAAA,IACnB;AAAA,EACF;AACA,QAAM,QAAQ,mBAAmB;AAAA,IAC/B,YAAY;AAAA,MACV,QAAQ,WAAW;AAAA,MACnB,UAAU,WAAW;AAAA,MACrB,oBAAoB,WAAW;AAAA,MAC/B,YAAY,WAAW;AAAA,MACvB,YAAY,WAAW;AAAA,MACvB,eAAe,WAAW;AAAA,MAC1B,mBAAmB,WAAW;AAAA,IAChC;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO,EAAE,UAAU,MAAM,OAAO,WAAW,MAAM,WAAW,YAAY,MAAM,WAAW;AAC3F;AASA,eAAsB,UACpB,UACA,KAC0B;AAC1B,QAAM,EAAE,GAAG,IAAI;AACf,QAAM,UAAW,MAAMC,mBAAkB,IAAI,IAAI,aAAa,IAAI,SAAS,KAAM;AAAA,IAC/E,iBAAiB;AAAA,IACjB,aAAa;AAAA,EACf;AAEA,QAAM,UAA+B,CAAC;AAEtC,MAAI,IAAI,mBAAmB,QAAQ;AAIjC,UAAM,cAAc,QAAQ,oBAAoB;AAChD,UAAM,aAAa,MAAM,UAAU,IAAI,IAAI,aAAa,IAAI,cAAc;AAC1E,UAAM,cAAc;AAAA,MAClB,YAAY,aAAa,UACzB,WAAW,SAAS,SAAS,WAAW,YACxC,WAAW,SAAS,UAAU,WAAW;AAAA,IAC3C;AACA,UAAM,kBAAkB;AAAA,MACtB,eACC,WAAW,aAAa,aACvB,WAAW,SAAS,QAAQ,WAAW,aACvC,WAAW,SAAS,QAAQ,WAAW,eACvC,WAAW,SAAS,QAAQ,WAAW;AAAA,IAC3C;AACA,UAAM,2BAA2B;AAAA,MAC/B,eACC,WAAW,SAAS,QAAQ,WAAW,cACtC,WAAW,SAAS,QAAQ,WAAW,mBACvC,WAAW,SAAS,UAAU,WAAW,cACzC,WAAW,SAAS,UAAU,WAAW;AAAA,IAC7C;AACA,UAAM,6BAAyD,cAC3D,UACA,2BACE,gBACA,kBACE,eACA,IAAI,mBAAmB,eACrB,gBACA;AACV,YAAQ,KAAK;AAAA,MACX,IAAI,IAAI;AAAA,MACR,MAAM,IAAI,mBAAmB,eAAe,eAAe;AAAA,MAC3D,MAAM;AAAA,MACN,UAAU,cAAc,WAAW,kBAAkB,iBAAiB;AAAA,MACtE,QAAQ;AAAA,MACR,gBAAgB;AAAA,MAChB,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,uBAAuB;AAAA,MACvB,gBAAgB,YAAY,SAAS,SAAS,UAAU;AAAA,MACxD,eAAe,YAAY,YAAY;AAAA,MACvC,aAAa,cAAc,aAAa;AAAA,MACxC,eAAe,YAAY,SAAS,QAAQ,UAAU;AAAA,MACtD,eAAe,YAAY,SAAS,QAAQ,UAAU;AAAA,MACtD,iBAAiB,YAAY,SAAS,UAAU,UAAU;AAAA,MAC1D,YAAY,YAAY,cAAc;AAAA,MACtC,YAAY,QAAQ;AAAA,MACpB,qBAAqB,YAAY,uBAAuB;AAAA,MACxD,mBAAmB,YAAY,qBAAqB;AAAA,MACpD,iBAAiB,YAAY,mBAAmB;AAAA,IAClD,CAAC;AAAA,EACH;AAIA,QAAM,YAAY,MAAM,cAAc,IAAI,IAAI,WAAW;AACzD,aAAW,WAAW,WAAW;AAC/B,QAAI,QAAQ,SAAS,gBAAgB,CAAC,QAAQ,cAAc;AAC1D;AAAA,IACF;AACA,UAAM,aAAa,MAAMC,eAAc,IAAI,IAAI,aAAa,QAAQ,YAAY;AAChF,QAAI,CAAC,cAAc,WAAW,WAAW,UAAU;AAGjD;AAAA,IACF;AACA,UAAM,QAAQ,aACV,MAAM,gBAAgB,UAAU,IAAI,aAAa,UAAU,IAC3D,EAAE,UAAU,WAA4B,WAAW,OAAO,YAAY,MAAM;AAChF,YAAQ,KAAK;AAAA,MACX,IAAI,QAAQ;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,QAAQ;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,QAAQ,QAAQ,oBAAoB,QAAQ;AAAA,MAC5C,gBAAgB;AAAA,MAChB,cAAc,QAAQ;AAAA,MACtB,YAAY,MAAM,aAAa;AAAA,MAC/B,uBACE,MAAM,aAAa,WACf,UACA,MAAM,aAAa,iBACjB,eACA;AAAA,MACR,WAAW,MAAM;AAAA,MACjB,YAAY,MAAM;AAAA,MAClB,YAAY,YAAY,cAAc;AAAA,MACtC,gBACE,MAAM,aAAa,WACf,WACA,MAAM,aAAa,iBACjB,YACA;AAAA,MACR,eAAe;AAAA,MACf,aAAa,QAAQ,oBAAoB,QAAQ,KAAK,aAAa;AAAA,MACnE,eAAe;AAAA,MACf,eAAe;AAAA,MACf,iBAAiB,MAAM,aAAa,WAAW,UAAU;AAAA,MACzD,YAAY;AAAA,MACZ,YAAY,QAAQ;AAAA,MACpB,qBAAqB;AAAA,MACrB,mBAAmB;AAAA,MACnB,iBAAiB;AAAA,IACnB,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,iBAAiB,QAAQ;AAAA,IACzB,aAAa,QAAQ;AAAA,IACrB,WAAW;AAAA,EACb;AACF;AAKA,eAAe,cACb,UACA,KACA,QAIA;AAEA,MAAI,WAAW,IAAI,kBAAkB,WAAW,aAAa,WAAW,WAAW;AACjF,QAAI,IAAI,mBAAmB,QAAQ;AACjC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,MAAM;AAAA,MACR;AAAA,IACF;AACA,WAAO,EAAE,IAAI,MAAM,iBAAiB,KAAK;AAAA,EAC3C;AACA,QAAM,UAAU,MAAMC,YAAW,SAAS,IAAI,IAAI,aAAa,MAAM;AACrE,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,WAAW,MAAM;AAAA,MACzB,MAAM;AAAA,IACR;AAAA,EACF;AAQA,QAAM,gBAAgB,2BAA2B;AAAA,IAC/C,MAAM,QAAQ;AAAA,IACd,gBAAgB;AAAA,EAClB,CAAC;AACD,MAAI,CAAC,cAAc,IAAI;AACrB,WAAO,EAAE,IAAI,OAAO,QAAQ,cAAc,QAAQ,MAAM,cAAc,KAAK;AAAA,EAC7E;AACA,MAAI,QAAQ,SAAS,cAAc;AACjC,QAAI,CAAC,QAAQ,cAAc;AACzB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,sBAAsB,MAAM;AAAA,QACpC,MAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM,aAAa,MAAMD,eAAc,SAAS,IAAI,IAAI,aAAa,QAAQ,YAAY;AACzF,QAAI,CAAC,YAAY;AACf,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,0BAA0B,MAAM;AAAA,QACxC,MAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,gBAAgB,UAAU,IAAI,aAAa,UAAU;AACzE,QAAI,MAAM,aAAa,UAAU;AAC/B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,WAAW,MAAM,OAAO,MAAM,QAAQ;AAAA,QAC9C,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,iBAAiB,QAAQ,GAAG;AACjD;AAUA,eAAsB,kBACpB,UACA,KACA,QAIA,YAC0B;AAC1B,QAAM,WAAW,MAAM,cAAc,UAAU,KAAK,MAAM;AAC1D,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,UAAW,MAAMD,mBAAkB,SAAS,IAAI,IAAI,aAAa,IAAI,SAAS,KAAM;AAAA,MACxF,iBAAiB;AAAA,MACjB,aAAa;AAAA,IACf;AAGA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,iBAAiB,QAAQ;AAAA,MACzB,aAAa,QAAQ;AAAA,MACrB,QAAQ,SAAS;AAAA,MACjB,MAAM,SAAS;AAAA,IACjB;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,SAAS,oBAAoB,QAAQ,SAAS,yBAAyB;AACzE,QAAI;AACF,sBAAgB,MAAM,SAAS,wBAAwB,GAAG;AAAA,IAC5D,SAAS,OAAO;AACd,YAAM,QAAQ,MAAM,UAAU,SAAS,IAAI,IAAI,aAAa,IAAI,cAAc;AAC9E,YAAM,UAAU,OAAO,SAAS,QAAQ;AACxC,YAAM,OACJ,YAAY,aACP,sBACD,YAAY,kBACT,2BACA;AACT,YAAM,UAAW,MAAMA,mBAAkB,SAAS,IAAI,IAAI,aAAa,IAAI,SAAS,KAAM;AAAA,QACxF,iBAAiB;AAAA,QACjB,aAAa;AAAA,MACf;AACA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,iBAAiB,QAAQ;AAAA,QACzB,aAAa,QAAQ;AAAA,QACrB,QACE,iBAAiB,QACb,MAAM,UACN;AAAA,QACN;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AAGF,aAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,YAAMG,WAAW,MAAMH,mBAAkB,SAAS,IAAI,IAAI,aAAa,IAAI,SAAS,KAAM;AAAA,QACxF,iBAAiB;AAAA,QACjB,aAAa;AAAA,MACf;AAIA,YAAM,SAAS,MAAM,iBAAiB,SAAS,IAAI;AAAA,QACjD,WAAW,IAAI;AAAA,QACf,aAAa,IAAI;AAAA,QACjB,WAAW,IAAI;AAAA,QACf,iBAAiB,SAAS;AAAA,QAC1B,eAAeG,SAAQ;AAAA,QACvB,GAAI,eAAe,SAAY,EAAE,WAAW,IAAI,CAAC;AAAA,MACnD,CAAC;AACD,UAAI,OAAO,WAAW,OAAO,SAAS;AACpC,eAAO;AAAA,UACL,SAAS;AAAA,UACT,iBAAiB,OAAO,QAAQ;AAAA,UAChC,aAAa,OAAO,QAAQ;AAAA,QAC9B;AAAA,MACF;AAAA,IAEF;AACA,UAAM,UAAW,MAAMH,mBAAkB,SAAS,IAAI,IAAI,aAAa,IAAI,SAAS,KAAM;AAAA,MACxF,iBAAiB;AAAA,MACjB,aAAa;AAAA,IACf;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,iBAAiB,QAAQ;AAAA,MACzB,aAAa,QAAQ;AAAA,MACrB,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF,UAAE;AAIA,UAAM,eAAe,QAAQ,EAAE,MAAM,MAAM,MAAS;AAAA,EACtD;AACF;AA4CA,eAAsB,8BACpB,SACA,QACA,IACsB;AACtB,QAAM,UAAU,IAAI,kBAAkB;AAAA,IACpC,aAAa,QAAQ;AAAA,IACrB,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ;AAAA,IACpB,OAAO,QAAQ;AAAA,IACf,WAAW,QAAQ;AAAA,IACnB,eAAe,QAAQ;AAAA,IACvB,GAAI,QAAQ,aAAa,SAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,EACzE,CAAC;AAED,MAAI;AACF,QAAI,GAAG,SAAS,QAAQ;AACtB,YAAM,aAAa,QAAQ;AAC3B,YAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,QAC7B,KAAK,GAAG;AAAA,QACR,GAAI,GAAG,UAAU,EAAE,SAAS,GAAG,QAAQ,IAAI,CAAC;AAAA,MAC9C,CAAC;AACD,YAAM,WAAW,IAAI,aAAa;AAClC,YAAM,kBAAkB,IAAI,aAAa;AACzC,aAAO;AAAA,QACL;AAAA,QACA,MAAM;AAAA;AAAA;AAAA;AAAA,QAIN,IAAI,CAAC,YAAY;AAAA,QACjB,QAAQ,IAAI;AAAA,QACZ,QAAQ,IAAI;AAAA,QACZ,UAAU,IAAI;AAAA,QACd;AAAA,QACA;AAAA,QACA,GAAI,WACA,EAAE,QAAQ,wBAAwB,UAAU,yBAAyB,IACrE,CAAC,kBACC,EAAE,QAAQ,yCAAyC,IACnD,CAAC;AAAA,MACT;AAAA,IACF;AACA,QAAI,GAAG,SAAS,QAAQ;AACtB,YAAM,QAAQ,MAAM,QAAQ,SAAS,EAAE,MAAM,GAAG,KAAK,CAAC;AACtD,aAAO,EAAE,QAAQ,MAAM,QAAQ,IAAI,MAAM,SAAS,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AAAA,IACpF;AACA,UAAM,eAAe,MAAM,QAAQ,UAAU,EAAE,MAAM,GAAG,MAAM,SAAS,GAAG,QAAQ,CAAC;AACnF,WAAO,EAAE,QAAQ,MAAM,SAAS,IAAI,MAAM,aAAa;AAAA,EACzD,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,WAAO;AAAA,MACL;AAAA,MACA,MAAM,GAAG;AAAA,MACT,IAAI;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA,GAAI,GAAG,SAAS,SAAS,EAAE,YAAY,QAAQ,wBAAwB,IAAI,CAAC;AAAA,IAC9E;AAAA,EACF,UAAE;AAIA,UAAM,QAAQ,oBAAoB,EAAE,MAAM,MAAM,MAAS;AAAA,EAC3D;AACF;AAWA,eAAsB,aACpB,UACA,KACA,QACA,IACsB;AACtB,QAAM,UAAU,MAAME,YAAW,SAAS,IAAI,IAAI,aAAa,MAAM;AACrE,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,MACL;AAAA,MACA,MAAM,GAAG;AAAA,MACT,IAAI;AAAA,MACJ,QAAQ,WAAW,MAAM;AAAA,IAC3B;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,gBAAgB,CAAC,QAAQ,cAAc;AAC1D,WAAO;AAAA,MACL;AAAA,MACA,YAAY,QAAQ;AAAA,MACpB,MAAM,GAAG;AAAA,MACT,IAAI;AAAA,MACJ,QAAQ,8DAA8D,QAAQ,IAAI;AAAA,IACpF;AAAA,EACF;AACA,QAAM,aAAa,MAAMD,eAAc,SAAS,IAAI,IAAI,aAAa,QAAQ,YAAY;AACzF,MAAI,CAAC,cAAc,WAAW,WAAW,UAAU;AACjD,WAAO;AAAA,MACL;AAAA,MACA,YAAY,QAAQ;AAAA,MACpB,MAAM,GAAG;AAAA,MACT,IAAI;AAAA,MACJ,QAAQ,WAAW,MAAM;AAAA,IAC3B;AAAA,EACF;AAEA,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,MACE,aAAa,IAAI;AAAA,MACjB,SAAS,QAAQ;AAAA,MACjB,YAAY,WAAW,SAAS,GAAG;AAAA,MACnC,OAAO,wBAAwB,SAAS,QAAQ;AAAA,MAChD,kBAAkB,SAAS,SAAS;AAAA,MACpC,eAAe,SAAS,SAAS;AAAA,MACjC,GAAI,SAAS,SAAS,yBAAyB,QAC/C,WAAW,aAAa,QACxB,SAAS,KAAK,wBACV;AAAA,QACE,UAAU;AAAA,UACR,WAAW,IAAIG;AAAA,YACb,YAAY,SAAS,KAAK,wBAAwB,KAAK;AAAA,UACzD;AAAA,QACF;AAAA,MACF,IACA,CAAC;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,EAAE,GAAG,QAAQ,YAAY,QAAQ,KAAK;AAC/C;AAsBA,eAAsB,iBACpB,UACA,KACA,OAC0B;AAC1B,MAAI,MAAM,SAAS,cAAc;AAC/B,UAAM,QAAQ,SAAS,SAAS,iBAAiB,2BAA2B,QAAQ,QAAQ,EAAE;AAC9F,WAAO;AAAA,MACL,MAAM;AAAA,MACN,cACE;AAAA;AAAA;AAAA;AAAA;AAAA,MAKF,oBAAoB,cAAc,IAAI;AAAA,MACtC,uBAAuB,OAAO,IAAI;AAAA,MAClC,iBAAiB,GAAG,IAAI;AAAA,MACxB,MAAM;AAAA,IACR;AAAA,EACF;AAKA,QAAM,EAAE,cAAc,IAAI,MAAM,OAAO,cAAc;AACrD,QAAM,UAAU,MAAM,cAAc,SAAS,IAAI;AAAA,IAC/C,WAAW,IAAI;AAAA,IACf,aAAa,IAAI;AAAA,IACjB,MAAM;AAAA,IACN,MAAM,MAAM,MAAM,KAAK,KAAK;AAAA,EAC9B,CAAC;AACD,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,MAAM;AAAA,EACR;AACF;;;AE9wBA,SAAS,yCAAwD;AACjE;AAAA,EACE;AAAA,OAKK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,SAAS,qBAAqB;AAI9B,IAAM,eAAe;AACrB,IAAM,yBAAyB,oBAAI,QAAgD;AAQnF,eAAsB,qBAAqB,GAAY,MAA0C;AAC/F,MAAI,UAAU,uBAAuB,IAAI,EAAE,IAAI,GAAG;AAClD,MAAI,CAAC,SAAS;AACZ,cAAU,qBAAqB,GAAG,IAAI;AACtC,2BAAuB,IAAI,EAAE,IAAI,KAAK,OAAO;AAAA,EAC/C;AACA,QAAM,UAAU,MAAM;AACtB,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,cAAc,KAAK,EAAE,SAAS,0BAA0B,CAAC;AAAA,EACrE;AACA,SAAO;AACT;AAEA,eAAsB,mBACpB,GACA,MACA,aACA,YACsB;AACtB,UAAQ,MAAM,gCAAgC,GAAG,MAAM,aAAa,UAAU,GAAG;AACnF;AASO,SAAS,oCACd,SACA,OAC0B;AAC1B,QAAM,wBAAwB,QAAQ,cAAc;AAAA,IAClD,CAAC,cAAc,UAAU,cAAc,MAAM;AAAA,EAC/C;AACA,QAAM,YAAY,MAAM,UAAU,cAAc;AAChD,QAAM,mBACJ,QAAQ,cAAc,MAAM,aAC5B,QAAQ,cAAc,MAAM,CAAC,cAAc,UAAU,cAAc,QAAQ,SAAS,KACpF,QAAQ,gBAAgB;AAAA,IACtB,CAAC,cACC,UAAU,cAAc,QAAQ,aAChC,UAAU,kBAAkB,MAAM,iBACjC,UAAU,UAAU,cAAc,SAAU,aAC7C,QAAQ,UAAU,gBAAgB,MAAM,QAAQ,MAAM,gBAAgB,KACtE,QAAQ,UAAU,uBAAuB,MAAM,QAAQ,MAAM,uBAAuB,KACpF,QAAQ,cAAc;AAAA,MACpB,CAAC,iBAAiB,aAAa,cAAc,UAAU;AAAA,IACzD,EAAE,WAAW;AAAA,EACjB,KACA,sBAAsB,WAAW,KACjC,sBAAsB,CAAC,GAAG,cAAc,QAAQ;AAClD,SAAO;AAAA,IACL;AAAA,IACA,cAAc,mBAAmB,sBAAsB,CAAC,IAAK;AAAA,IAC7D,wBAAwB,QAAQ;AAAA,IAChC;AAAA,EACF;AACF;AAEA,eAAsB,gCACpB,GACA,MACA,aACA,YACmC;AACnC,QAAM,UAAU,MAAM,qBAAqB,GAAG,IAAI;AAClD,QAAM,gBAAgB,gCAAgC,OAAO;AAC7D,QAAM,QACJ,QAAQ,gBAAgB,KAAK,CAAC,cAAc,UAAU,gBAAgB,WAAW,KAChF,MAAM;AAAA,IACL,KAAK;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA,gBAAgB,EAAE,cAAc,IAAI;AAAA,EACtC;AACF,MAAI,CAAC,OAAO;AACV,UAAM,YAAY,MAAM,iBAAiB,KAAK,IAAI,WAAW,EAAE,MAAM,MAAM,IAAI;AAC/E,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,cAAc,KAAK,EAAE,SAAS,sBAAsB,CAAC;AAAA,IACjE;AACA,UAAM,IAAI,cAAc,KAAK,EAAE,SAAS,0BAA0B,CAAC;AAAA,EACrE;AACA,MAAI,YAAY;AACd,sBAAkB,OAAO,UAAU;AAAA,EACrC;AACA,SAAO,oCAAoC,SAAS,KAAK;AAC3D;AAEA,SAAS,gCAAgC,SAAqD;AAC5F,MAAI,QAAQ,SAAS,aAAa,QAAQ,gBAAgB,WAAW,GAAG;AACtE,WAAO;AAAA,EACT;AACA,SAAO,QAAQ,gBAAgB;AAAA,IAC7B,CAAC,UACC,MAAM,kBAAkB,mBACxB,MAAM,UAAU,cAAc,QAC9B,CAAC,MAAM;AAAA,EACX,IACI,kBACA;AACN;AAEO,SAAS,kBAAkB,OAAoB,YAA8B;AAClF,MAAI,CAAC,cAAc,MAAM,aAAa,UAAU,GAAG;AACjD,QAAI,eAAe,qBAAqB;AACtC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,eAAe,wBAAwB;AACzC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,SAAS,uBAAuB,UAAU;AAAA,IAC5C,CAAC;AAAA,EACH;AACF;AAQO,SAAS,yBAAyB,OAAoB,YAA8B;AACzF,MAAI,CAAC,qBAAqB,MAAM,aAAa,UAAU,GAAG;AACxD,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,SAAS,+BAA+B,UAAU;AAAA,IACpD,CAAC;AAAA,EACH;AACF;AAEO,SAAS,qBAAqB,aAA2B,YAAiC;AAC/F,SAAO,YAAY,SAAS,UAAU;AACxC;AAEO,SAAS,cAAc,aAA2B,YAAiC;AACxF,MAAI,eAAe,gBAAgB;AACjC,WAAO,YAAY,SAAS,cAAc;AAAA,EAC5C;AACA,QAAM,UAAqD;AAAA,IACzD,qBAAqB,CAAC,kBAAgC;AAAA,IACtD,wBAAwB,CAAC,qBAAmC;AAAA,IAC5D,sBAAsB;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,sBAAsB;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,uBAAuB,CAAC,wBAAwB,qBAAmC;AAAA,IACnF,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,iBAAiB,CAAC,wBAAwB,qBAAmC;AAAA,EAC/E;AACA,SACE,YAAY,SAAS,UAAU,MAC9B,QAAQ,UAAU,GAAG,KAAK,CAAC,UAAU,YAAY,SAAS,KAAK,CAAC,KAAK,UACtE,YAAY,SAAS,iBAAiB;AAE1C;AAEA,eAAe,qBAAqB,GAAY,MAAiD;AAC/F,MAAI,KAAK,SAAS,sBAAsB,SAAS;AAC/C,UAAM,YAAY,MAAM,uBAAuB,GAAG,MAAM,OAAO;AAC/D,QAAI,WAAW;AACb,aAAO;AAAA,IACT;AACA,WAAO,MAAM,mBAAmB,KAAK,IAAI;AAAA,MACvC,uBAAuB;AAAA,MACvB,mBAAmB;AAAA,MACnB,aAAa;AAAA,MACb,yBAAyB;AAAA,MACzB,qBAAqB;AAAA,MACrB,eAAe;AAAA,MACf,WAAW;AAAA,MACX,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,MAAI,KAAK,SAAS,sBAAsB,cAAc;AACpD,UAAM,YAAY,MAAM,uBAAuB,GAAG,MAAM,YAAY;AACpE,QAAI,WAAW;AACb,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM,oBAAoB,GAAG,MAAM,YAAY;AAC9D,QAAI,QAAQ;AACV,aAAO;AAAA,IACT;AACA,QAAI,KAAK,SAAS,kBAAkB;AAClC,aAAO;AAAA,IACT;AACA,WAAO,MAAM,mBAAmB,KAAK,IAAI;AAAA,MACvC,uBAAuB;AAAA,MACvB,mBAAmB;AAAA,MACnB,aAAa;AAAA,MACb,yBAAyB;AAAA,MACzB,qBAAqB;AAAA,MACrB,eAAe;AAAA,MACf,WAAW,kBAAkB,CAAC;AAAA,MAC9B,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,YAAY,CAAC;AAC5B,MAAI,QAAQ;AACV,UAAM,YAAY,MAAM,uBAAuB,GAAG,MAAM,WAAW,MAAM;AACzE,QAAI,WAAW;AACb,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM,oBAAoB,GAAG,MAAM,SAAS;AAC3D,QAAI,QAAQ;AACV,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,KAAK,aAAa;AACpB,UAAM,UAAU,MAAM,kBAAkB,GAAG,KAAK,aAAa,EAAE,IAAI,KAAK,GAAG,CAAC;AAC5E,QAAI,SAAS,MAAM;AACjB,aAAO,MAAM,2BAA2B,KAAK,IAAI;AAAA,QAC/C,QAAQ,QAAQ,KAAK;AAAA,QACrB,OAAO,QAAQ,KAAK;AAAA,QACpB,MAAM,QAAQ,KAAK;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAe,oBACb,GACA,MACA,MAC+B;AAC/B,QAAM,SAAS,YAAY,CAAC;AAC5B,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AACA,QAAM,SAAS,MAAM,uBAAuB,KAAK,IAAI,MAAM,UAAU,MAAM,CAAC;AAC5E,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AACA,QAAM,YAAY,WAAW,OAAO,EAAE;AACtC,QAAM,qBAAqB,OAAO,cAC9B,OAAO,YAAY;AAAA,IACjB,CAAC,eAAe,eAAe,kBAAkB,eAAe;AAAA,EAClE,IACA,OAAO;AACX,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,cAAc,OAAO;AAAA,IACrB,eAAe;AAAA,MACb;AAAA,QACE,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,cAAc,OAAO;AAAA,QACrB,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,iBAAiB,OAAO,cACpB;AAAA,MACE;AAAA,QACE,aAAa,OAAO;AAAA,QACpB,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,cAAc,OAAO;AAAA,QACrB,aAAa,OAAO;AAAA,QACpB,eAAe;AAAA,MACjB;AAAA,IACF,IACA,CAAC;AAAA,IACL,kBAAkB,OAAO;AAAA,IACzB,oBAAoB,OAAO;AAAA,EAC7B;AACF;AAEA,eAAe,uBACb,GACA,MACA,MACA,QAAQ,YAAY,CAAC,GACU;AAC/B,QAAM,mBAAmB,kCAAkC,KAAK,QAAQ;AACxE,MAAI,CAAC,SAAS,CAAC,kBAAkB;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,2BAA2B,kBAAkB,KAAK;AACxE,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL;AAAA,IACA,WAAW,QAAQ;AAAA,IACnB,GAAI,QAAQ,eAAe,EAAE,cAAc,QAAQ,aAAa,IAAI,CAAC;AAAA,IACrE,eAAe;AAAA,MACb;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,WAAW,QAAQ;AAAA,QACnB,GAAI,QAAQ,eAAe,EAAE,cAAc,QAAQ,aAAa,IAAI,CAAC;AAAA,QACrE,aAAa,QAAQ;AAAA,MACvB;AAAA,IACF;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,aAAa,QAAQ;AAAA,QACrB,WAAW,QAAQ;AAAA,QACnB,WAAW,QAAQ;AAAA,QACnB,GAAI,QAAQ,eAAe,EAAE,cAAc,QAAQ,aAAa,IAAI,CAAC;AAAA,QACrE,aAAa,QAAQ;AAAA,QACrB,eAAe,QAAQ;AAAA;AAAA;AAAA,QAGvB,UAAU;AAAA,UACR,WAAW;AAAA,UACX,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,UAC5D,GAAI,QAAQ,uBAAuB,SAC/B,EAAE,oBAAoB,QAAQ,mBAAmB,IACjD,CAAC;AAAA,UACL,GAAI,QAAQ,qBAAqB,SAC7B,EAAE,kBAAkB,QAAQ,iBAAiB,IAC7C,CAAC;AAAA,UACL,GAAI,QAAQ,iCAAiC,SACzC,EAAE,8BAA8B,QAAQ,6BAA6B,IACrE,CAAC;AAAA;AAAA;AAAA,UAGL,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,UACnD,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,UAC5D,GAAI,QAAQ,sBACR,EAAE,qBAAqB,QAAQ,oBAAoB,IACnD,CAAC;AAAA,QACP;AAAA,QACA,GAAI,QAAQ,mBAAmB,EAAE,kBAAkB,QAAQ,iBAAiB,IAAI,CAAC;AAAA,QACjF,GAAI,QAAQ,0BACR,EAAE,yBAAyB,QAAQ,wBAAwB,IAC3D,CAAC;AAAA,MACP;AAAA,IACF;AAAA,IACA,kBAAkB,QAAQ;AAAA,IAC1B,oBAAoB,QAAQ;AAAA,EAC9B;AACF;AAEA,SAAS,kBAAkB,GAAoB;AAC7C,QAAM,SAAS,EAAE,IAAI,OAAO,oBAAoB;AAChD,SAAO,UAAU,OAAO,KAAK,EAAE,SAAS,IAAI,cAAc,OAAO,KAAK,CAAC,KAAK;AAC9E;AAEA,SAAS,YAAY,GAA2B;AAC9C,QAAM,gBAAgB,EAAE,IAAI,OAAO,eAAe;AAClD,SAAO,eAAe,WAAW,YAAY,IAAI,cAAc,MAAM,aAAa,MAAM,IAAI;AAC9F;AAEA,eAAe,UAAU,OAAgC;AACvD,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACpF,SAAO,MAAM,KAAK,IAAI,WAAW,MAAM,CAAC,EACrC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE;AACZ;;;ACnZA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAMA,IAAM,+CAA+C;AAErD,IAAM,kCAAN,cAA8C,MAAM;AAAA,EAGzD,YAAqB,QAAgE;AACnF,UAAM,oCAAoC;AADvB;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EALS,OAAO;AAMlB;AAEO,IAAM,uCAAN,cAAmD,MAAM;AAAA,EACrD,OAAO;AAAA,EAEhB,YAAY,SAAwB;AAClC,UAAM,wCAAwC,OAAO;AACrD,SAAK,OAAO;AAAA,EACd;AACF;AAmBA,SAAS,8BAA8B,OAA6B;AAClE,QAAM,uBACJ,MAAM,WAAW,QAAQ,MAAM,UAC/B,MAAM,WAAW,WAAW,MAAM,UAClC,MAAM,WAAW,qBAAqB,MAAM;AAC9C,SAAO,MAAM,gBAAgB,MAAM,kBAAkB,kBAAkB;AACzE;AAQA,IAAM,+BAA+B,oBAAI,IAAmC;AAAA,EAC1E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,6BACP,OACA,uBACA,QACA,WACmB;AACnB,MAAI,OAAO,OAAO,cAAc,MAAM,gBAAiB,QAAO;AAI9D,MAAI,OAAO,oBAAoB,MAAM,gBAAiB,QAAO;AAI7D,MAAI,0BAA0B,OAAO,OAAO,WAAW;AACrD,QAAI,cAAc,oBAAoB,6BAA6B,IAAI,SAAS,GAAG;AACjF,aAAO;AAAA,IACT;AACA,UAAM,IAAI,gCAAgC,WAAW;AAAA,EACvD;AAIA,QAAM,IAAI,gCAAgC,WAAW;AACvD;AAEO,SAAS,gCACd,eACwB;AACxB,SAAO,cAAc,MAAM,SAAS,kBAChC;AAAA,IACE,WAAW,cAAc,MAAM;AAAA,IAC/B,0BAA0B,cAAc,MAAM;AAAA,EAChD,IACA,EAAE,WAAW,cAAc,MAAM,UAAU;AACjD;AAEA,eAAsB,iCACpB,eACA,IACY;AACZ,SAAO,MAAM,2BAA2B,gCAAgC,aAAa,GAAG,EAAE;AAC5F;AAOA,eAAsB,qCACpB,IACA,OACA,iBACwE;AACxE,QAAM,EAAE,MAAM,IAAI,MAAM,iCAAiC,IAAI,KAAK;AAClE,MAAI,MAAM,SAAS,mBAAmB,MAAM,oBAAoB,iBAAiB;AAC/E,UAAM,IAAI,gCAAgC,cAAc;AAAA,EAC1D;AACA,SAAO;AACT;AAaA,eAAsB,4BACpB,MACA,OACA,OAK8C;AAC9C,QAAM,OAAO,KAAK;AAClB,QAAM,iBAAiB,8BAA8B,KAAK;AAC1D,QAAM,CAAC,aAAa,SAAS,IAAI,MAAM,QAAQ,IAAI;AAAA,IACjD,2CAA2C,KAAK,IAAI;AAAA,MAClD,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,8BAA8B,KAAK,IAAI,MAAM,aAAa,MAAM,SAAS;AAAA,EAC3E,CAAC;AAID,MACE,CAAC,QACD,CAAC,kBACD,aAAa,eAAe,aAC5B,WAAW,eAAe,gBAC1B;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,UAAW,OAAM,IAAI,gCAAgC,WAAW;AAErE,QAAM,CAAC,eAAe,cAAc,IAAI,MAAM,QAAQ,IAAI;AAAA,IACxD,iCAAiC,KAAK,IAAI,KAAK;AAAA,IAC/C,kCAAkC,KAAK,IAAI,OAAO,MAAM,SAAS;AAAA,EACnE,CAAC;AACD,QAAM,QAAQ,cAAc;AAC5B,QAAM,SAAS,eAAe;AAC9B,QAAM,4BACJ,MAAM,SAAS,kBACX;AAAA,IACE;AAAA,IACA,cAAc;AAAA,IACd;AAAA,IACA,MAAM;AAAA,EACR,IACA;AAEN,MAAI,UAAU,eAAe,gBAAgB;AAC3C,UAAM,UACJ,UAAU,mBAAmB,SAC5B,MAAM,SAAS,YACZ,MAAM,cAAc,UAAU,iBAC9B,MAAM,6BAA6B,UAAU;AACnD,QAAI,CAAC,QAAS,OAAM,IAAI,gCAAgC,WAAW;AAAA,EACrE;AACA,MAAI,aAAa,eAAe,WAAW;AACzC,UAAM,UACJ,MAAM,SAAS,YACX,MAAM,cAAc,YAAY,kBAChC,MAAM,wBAAwB,OAAO;AAC3C,QAAI,CAAC,QAAS,OAAM,IAAI,gCAAgC,WAAW;AAAA,EACrE;AACA,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,sBAAsB,6BAA6B;AAAA,MACnD,oBAAoB;AAAA,IACtB;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,kBAAc,MAAM,KAAK,iBAAiB;AAAA,MACxC,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,WAAW,MAAM;AAAA,MACjB,SAAS,MAAM;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,IAAI,qCAAqC,EAAE,OAAO,MAAM,CAAC;AAAA,EACjE;AACA,QAAM,SAAS,6BAA6B,UAAU,WAAW;AACjE,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,qCAAqC,EAAE,OAAO,OAAO,MAAM,CAAC;AAAA,EACxE;AACA,MAAI,CAAC,OAAO,KAAK,SAAS;AACxB,UAAM,IAAI,gCAAgC,OAAO,KAAK,MAAM;AAAA,EAC9D;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,sBACE,8BAA8B,WAC1B,WACC,OAAO,KAAK,wBAAwB;AAAA,IAC3C,oBAAoB,OAAO,KAAK,sBAAsB;AAAA,EACxD;AACF;AAGA,eAAsB,qCACpB,MACA,OACA,SAC+C;AAC/C,QAAM,OAAO,KAAK;AAClB,QAAM,iBAAiB,8BAA8B,KAAK;AAC1D,MAAI,CAAC,QAAQ,CAAC,eAAgB,QAAO;AACrC,QAAM,EAAE,MAAM,IAAI,MAAM,iCAAiC,KAAK,IAAI,KAAK;AAGvE,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,KAAK,iBAAiB;AAAA,MACrC,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,IAAI,qCAAqC,EAAE,OAAO,MAAM,CAAC;AAAA,EACjE;AACA,QAAM,SAAS,8BAA8B,UAAU,QAAQ;AAC/D,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,qCAAqC,EAAE,OAAO,OAAO,MAAM,CAAC;AAAA,EACxE;AACA,MAAI,OAAO,KAAK,SAAS,MAAO,QAAO,OAAO;AAC9C,SAAO;AAAA,IACL,MAAM;AAAA,IACN,gBAAgB,CAAC,GAAG,IAAI,IAAI,OAAO,KAAK,cAAc,CAAC;AAAA,IACvD,YAAY,CAAC,GAAG,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC;AAAA,EACjD;AACF;AAEA,eAAe,kCACb,IACA,OACA,WAC6C;AAC7C,QAAM,UAAU,MAAM,WAAW,IAAI,MAAM,aAAa,SAAS;AACjE,MAAI,CAAC,WAAW,QAAQ,cAAc,MAAM,WAAW;AACrD,UAAM,IAAI,gCAAgC,WAAW;AAAA,EACvD;AACA,SAAO;AAAA,IACL,QAAQ,EAAE,WAAW,QAAQ,IAAI,eAAe,QAAQ,cAAc;AAAA,IACtE,iBAAiB,QAAQ;AAAA,EAC3B;AACF;AACA,eAAe,iCACb,IACA,OAC4C;AAC5C,QAAM,kBAAkB,MAAM,WAAW,WAAW;AACpD,QAAM,SAAS,MAAM,WAAW,QAAQ;AACxC,QAAM,YAAY,MAAM,WAAW,WAAW;AAC9C,QAAM,sBAAsB,MAAM,WAAW,qBAAqB;AAClE,QAAM,iBAAiB,8BAA8B,KAAK;AAC1D,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,MACL,OAAO,0BAA0B,MAAM;AAAA,QACrC,MAAM;AAAA,QACN,WAAW,MAAM;AAAA,QACjB,GAAI,MAAM,eAAe,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,MACnE,CAAC;AAAA,MACD,uBAAuB;AAAA,IACzB;AAAA,EACF;AACA,MACE,OAAO,oBAAoB,YAC3B,OAAO,WAAW,YAClB,OAAO,cAAc,YACrB,OAAO,wBAAwB,YAC/B,CAAC,OAAO,cAAc,mBAAmB,KACzC,sBAAsB,GACtB;AACA,UAAM,IAAI,gCAAgC,cAAc;AAAA,EAC1D;AACA,QAAM,CAAC,eAAe,IAAI,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC9C,WAAW,IAAI,MAAM,aAAa,eAAe;AAAA,IACjD,yBAAyB,IAAI,MAAM,aAAa,iBAAiB,SAAS;AAAA,EAC5E,CAAC;AACD,MACE,CAAC,iBACD,cAAc,cAAc,MAAM,aAClC,CAAC,QACD,KAAK,OAAO,UACZ,KAAK,wBAAwB,uBAC7B,cAAc,iBAAiB,KAAK,IACpC;AACA,UAAM,IAAI,gCAAgC,cAAc;AAAA,EAC1D;AACA,SAAO;AAAA,IACL,OAAO,0BAA0B,MAAM;AAAA,MACrC,MAAM;AAAA,MACN,WAAW,MAAM;AAAA,MACjB;AAAA,MACA,qBAAqB,cAAc;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,KAAK;AAAA,MAChB,kBAAkB,KAAK;AAAA,MACvB,0BACE,KAAK,6BACJ,KAAK,UAAU,SAAS,YAAY,KAAK,UAAU,YAAY;AAAA,IACpE,CAAC;AAAA,IACD,uBAAuB,cAAc;AAAA,EACvC;AACF;;;ACxXA,SAAS,mCAAmC;AAQ5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iBAAAC,sBAAqB;AAmB9B,eAAsB,aAAa,MAAyB,OAAuC;AACjG,QAAM,WAAW,MAAM,WAAW,MAAM,KAAK;AAC7C,MAAI,SAAS,SAAS;AACpB;AAAA,EACF;AACA,QAAM,IAAIA,eAAc,SAAS,SAAS,yBAAyB,MAAM,KAAK;AAAA,IAC5E,SAAS,SAAS;AAAA,EACpB,CAAC;AACH;AAEA,eAAsB,WACpB,MACA,OACwB;AAIxB,QAAM,cAAc,MAAM,cACtB,MAAM,kBAAkB;AAAA,IACtB,IAAI,KAAK;AAAA,IACT,UAAU,KAAK;AAAA,IACf,aAAa,MAAM;AAAA,IACnB,OAAO,MAAM;AAAA,EACf,CAAC,IACD;AACJ,QAAM,iBAAiB,MAAM,mBAAmB,MAAM,OAAO,WAAW;AACxE,MAAI,CAAC,eAAe,SAAS;AAC3B,WAAO;AAAA,EACT;AACA,MAAI,KAAK,SAAS,oBAAoB,YAAY,KAAK,SAAS,oBAAoB,WAAW;AAC7F,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,SAAO,MAAM,gBAAgB,MAAM,OAAO,WAAW;AACvD;AAEA,eAAe,mBACb,MACA,OACA,aACwB;AACxB,MAAI,aAAa;AACf,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,MAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,eAAe,MAAM,MAAM,GAAG;AAC5D,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,QAAM,UAAU,MAAM,kBAAkB,KAAK,IAAI,MAAM,SAAS;AAChE,MAAI,QAAQ,gBAAgB,GAAG;AAC7B,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,SAAO,EAAE,SAAS,OAAO,MAAM,wBAAwB,SAAS,gCAAgC;AAClG;AAEA,eAAe,gBACb,MACA,OACA,aACwB;AACxB,QAAM,SAAS,4BAA4B,KAAK,QAAQ;AACxD,MAAI,OAAO,kCAAkC,eAAe,MAAM,MAAM,KAAK,CAAC,aAAa;AACzF,UAAM,OAAO,MAAM,iBAAiB,KAAK,IAAI;AAAA,MAC3C,WAAW,MAAM;AAAA,MACjB,WAAW;AAAA,MACX,OAAO,gBAAgB;AAAA,IACzB,CAAC;AACD,QAAI,QAAQ,OAAO,gCAAgC;AACjD,aAAO;AAAA,QACL;AAAA,QACA,qCAAqC,OAAO,8BAA8B;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACA,UAAQ,MAAM,QAAQ;AAAA,IACpB,KAAK,oBAAoB;AACvB,UAAI,CAAC,OAAO,yBAAyB;AACnC,eAAO,EAAE,SAAS,KAAK;AAAA,MACzB;AACA,YAAM,QAAQ,MAAM,0BAA0B,KAAK,IAAI,MAAM,SAAS;AACtE,aAAO,QAAQ,OAAO,0BAClB,EAAE,SAAS,KAAK,IAChB;AAAA,QACE;AAAA,QACA,4BAA4B,OAAO,uBAAuB;AAAA,MAC5D;AAAA,IACN;AAAA,IACA,KAAK,kBAAkB;AACrB,UAAI,CAAC,OAAO,0BAA0B,CAAC,MAAM,aAAa;AACxD,eAAO,EAAE,SAAS,KAAK;AAAA,MACzB;AACA,YAAM,QAAQ,MAAM,+BAA+B,KAAK,IAAI,MAAM,WAAW;AAC7E,aAAO,QAAQ,OAAO,yBAClB,EAAE,SAAS,KAAK,IAChB;AAAA,QACE;AAAA,QACA,0BAA0B,OAAO,sBAAsB;AAAA,MACzD;AAAA,IACN;AAAA,IACA,KAAK,mBAAmB;AACtB,UAAI,CAAC,OAAO,4BAA4B,CAAC,MAAM,aAAa;AAC1D,eAAO,EAAE,SAAS,KAAK;AAAA,MACzB;AACA,YAAM,QAAQ,MAAM,gCAAgC,KAAK,IAAI,MAAM,WAAW;AAC9E,aAAO,QAAQ,OAAO,2BAClB,EAAE,SAAS,KAAK,IAChB;AAAA,QACE;AAAA,QACA,iCAAiC,OAAO,wBAAwB;AAAA,MAClE;AAAA,IACN;AAAA,IACA,KAAK,eAAe;AAClB,UAAI,CAAC,OAAO,sBAAsB,CAAC,MAAM,UAAU;AACjD,eAAO,EAAE,SAAS,KAAK;AAAA,MACzB;AACA,aAAO,MAAM,YAAY,OAAO,qBAC5B,EAAE,SAAS,KAAK,IAChB;AAAA,QACE;AAAA,QACA,uCAAuC,OAAO,kBAAkB;AAAA,MAClE;AAAA,IACN;AAAA,IACA,KAAK,oBAAoB;AACvB,UAAI,CAAC,OAAO,mCAAmC,CAAC,MAAM,aAAa;AACjE,eAAO,EAAE,SAAS,KAAK;AAAA,MACzB;AACA,YAAM,OAAO,MAAM,iBAAiB,KAAK,IAAI;AAAA,QAC3C,aAAa,MAAM;AAAA,QACnB,WAAW;AAAA,QACX,OAAO,gBAAgB;AAAA,MACzB,CAAC;AACD,YAAM,YAAY,MAAM,YAAY;AACpC,aAAO,OAAO,aAAa,OAAO,kCAC9B,EAAE,SAAS,KAAK,IAChB;AAAA,QACE;AAAA,QACA,oCAAoC,OAAO,+BAA+B;AAAA,MAC5E;AAAA,IACN;AAAA,IACA,KAAK,kBAAkB;AACrB,UAAI,eAAe,CAAC,OAAO,gCAAgC,CAAC,MAAM,aAAa;AAC7E,eAAO,EAAE,SAAS,KAAK;AAAA,MACzB;AACA,YAAM,OAAO,MAAM,iBAAiB,KAAK,IAAI;AAAA,QAC3C,aAAa,MAAM;AAAA,QACnB,WAAW;AAAA,QACX,OAAO,gBAAgB;AAAA,MACzB,CAAC;AACD,YAAM,YAAY,MAAM,YAAY;AACpC,aAAO,OAAO,aAAa,OAAO,+BAC9B,EAAE,SAAS,KAAK,IAChB;AAAA,QACE;AAAA,QACA,gCAAgC,OAAO,4BAA4B;AAAA,MACrE;AAAA,IACN;AAAA,IACA,KAAK,kBAAkB;AACrB,UAAI,CAAC,OAAO,wCAAwC,CAAC,MAAM,aAAa;AACtE,eAAO,EAAE,SAAS,KAAK;AAAA,MACzB;AACA,YAAM,OAAO,MAAM,iBAAiB,KAAK,IAAI;AAAA,QAC3C,aAAa,MAAM;AAAA,QACnB,WAAW;AAAA,QACX,OAAO,gBAAgB;AAAA,MACzB,CAAC;AACD,YAAM,YAAY,MAAM,YAAY;AACpC,aAAO,OAAO,aAAa,OAAO,uCAC9B,EAAE,SAAS,KAAK,IAChB;AAAA,QACE;AAAA,QACA,4CAA4C,OAAO,oCAAoC;AAAA,MACzF;AAAA,IACN;AAAA,EACF;AACF;AAEA,eAAsB,qBACpB,MACA,OAiBe;AACf,QAAM,iBAAiB,KAAK,IAAI;AAAA,IAC9B,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM,aAAa;AAAA,IAC9B,WAAW,MAAM;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,MAAM,MAAM;AAAA,IACZ,oBAAoB,MAAM;AAAA,IAC1B,kBAAkB,MAAM;AAAA,IACxB,WAAW,MAAM,aAAa;AAAA,IAC9B,QAAQ,MAAM,UAAU;AAAA,IACxB,eAAe,MAAM,iBAAiB;AAAA,IACtC,WACE,MAAM,cAAc,MAAM,YAAY,EAAE,MAAM,WAAW,WAAW,MAAM,UAAU,IAAI;AAAA,IAC1F,GAAI,MAAM,mBAAmB,EAAE,kBAAkB,MAAM,iBAAiB,IAAI,CAAC;AAAA,IAC7E,QAAQ,MAAM,UAAU;AAAA,IACxB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,iBAAiB,MAAkC;AAC1D,SAAO,KAAK,SAAS,gBAAgB,YAAY,KAAK,SAAS,oBAAoB;AACrF;AAEA,SAAS,eAAe,QAA8B;AACpD,SACE,WAAW,sBAAsB,WAAW,oBAAoB,WAAW;AAE/E;AAEA,SAAS,QAAQ,MAAc,SAAgC;AAC7D,SAAO,EAAE,SAAS,OAAO,MAAM,QAAQ;AACzC;AAEA,SAAS,kBAAwB;AAC/B,QAAM,MAAM,oBAAI,KAAK;AACrB,SAAO,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe,GAAG,IAAI,YAAY,GAAG,CAAC,CAAC;AACtE;;;AC3QA,SAAS,cAAc;AACvB,SAAS,qCAAqC;AAE9C,SAAS,sCAAqD;AAC9D;AAAA,EACE;AAAA,EACA;AAAA,EACA,yBAAAC;AAAA,EACA;AAAA,OAWK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,qBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,yBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP,SAAS,iBAAAC,sBAAqB;;;ACrD9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAEA,SAAS,wBAAwB,UAAyD;AAC/F,QAAM,SAAS,wBAAwB,UAAU,QAAQ;AACzD,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AASO,SAAS,kBAAkB,YAAyC;AACzE,SACE,WAAW,cAAc,QACzB,WAAW,mBAAmB,0BAC7B,WAAW,SAAS,aAAa,WAAW,SAAS,aACtD,wBAAwB,WAAW,QAAQ,GAAG,mBAAmB;AAErE;AAQO,SAAS,yBACd,UACS;AACT,SACE,UAAU,mBAAmB,yBAC7B,UAAU,oBAAoB;AAElC;AASO,SAAS,+BAA+B,OAI7B;AAChB,QAAM,aAAa,CAAC,SAClB,SAAS,QAAQ,MAAM,UAAU,KAAK,CAAC,YAAY,QAAQ,SAAS,IAAI;AAC1E,MAAI,MAAM,cAAc,MAAM;AAC5B,WAAO,WAAW,MAAM,SAAS,IAAI,MAAM,YAAY;AAAA,EACzD;AACA,MAAI,WAAW,MAAM,QAAQ,GAAG;AAC9B,WAAO,MAAM;AAAA,EACf;AACA,SAAO,MAAM,UAAU,WAAW,IAAI,MAAM,UAAU,CAAC,EAAG,OAAO;AACnE;AAOO,SAAS,yBAEd,aAAqC;AACrC,QAAM,aAAa,CAAC,WAClB,WAAW,WAAW,IAAI,WAAW,iBAAiB,IAAI;AAC5D,SACE,CAAC,GAAG,WAAW,EAAE;AAAA,IACf,CAAC,MAAM,UACL,WAAW,KAAK,MAAM,IAAI,WAAW,MAAM,MAAM,KACjD,MAAM,UAAU,cAAc,KAAK,SAAS,KAC5C,MAAM,GAAG,cAAc,KAAK,EAAE;AAAA,EAClC,EAAE,CAAC,KAAK;AAEZ;;;AD/BA,SAAS,+BAAuD;;;AExDhE,SAAS,kBAAkB;AAE3B;AAAA,EACE;AAAA,EACA;AAAA,OAOK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,kCAAkC;AAC3C,SAAS,iBAAAC,sBAAqB;AAEvB,IAAM,2BAA2B;AAExC,IAAM,sBAAsC;AAAA,EAC1C,IAAI;AAAA,EACJ,MAAM;AAAA,EACN,aACE;AAAA,EACF,MAAM;AAAA,EACN,UAAU;AAAA,EACV,SAAS;AAAA;AAAA;AAAA;AAAA,EAIT,QAAQ,CAAC;AAAA,EACT,YAAY,CAAC;AAAA,EACb,OAAO;AAAA,IACL,EAAE,MAAM,OAAO,IAAI,WAAW;AAAA,IAC9B,EAAE,MAAM,OAAO,IAAI,OAAO;AAAA,EAC5B;AAAA,EACA,YAAY;AAAA,IACV;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,WAAW,CAAC,GAAG;AAAA,MACf,QAAQ,CAAC,cAAc,eAAe,cAAc,gBAAgB;AAAA,MACpE,UAAU;AAAA,MACV,UAAU;AAAA,QACR,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,WAAW,CAAC,QAAQ;AAAA,MACpB,QAAQ,CAAC,YAAY,QAAQ,UAAU,mBAAmB,SAAS;AAAA,MACnE,UAAU;AAAA,MACV,UAAU;AAAA,QACR,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,WAAW,CAAC,UAAU;AAAA,MACtB,QAAQ,CAAC,yBAAyB,uBAAuB;AAAA,MACzD,UAAU;AAAA,MACV,UAAU;AAAA,QACR,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,WAAW,CAAC,aAAa,UAAU;AAAA,MACnC,QAAQ;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,UAAU;AAAA,MACV,UAAU;AAAA,QACR,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,WAAW,CAAC,QAAQ;AAAA,MACpB,QAAQ,CAAC,mBAAmB,YAAY;AAAA,MACxC,UAAU;AAAA,MACV,UAAU;AAAA,QACR,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,WAAW,CAAC,SAAS;AAAA,MACrB,QAAQ;AAAA,QACN;AAAA,QACA;AAAA,MACF;AAAA,MACA,UAAU;AAAA,MACV,UAAU;AAAA,QACR,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,MAAM;AAAA,MACN,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,aACE;AAAA,MACF,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA,wBAAwB;AAAA,IACtB;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,aAAa;AAAA,MACb,iBAAiB;AAAA,QACf,MAAM;AAAA,QACN,UAAU;AAAA,QACV,MAAM;AAAA,QACN,QAAQ;AAAA,MACV;AAAA,MACA,gBAAgB;AAAA,MAChB,sBAAsB;AAAA,IACxB;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,OAAO;AAAA,IACP,oBAAoB;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,QAAQ,CAAC,mBAAmB;AAE3B,SAAS,sBAAwC;AACtD,SAAO;AACT;AAEO,SAAS,kBAAkB,QAAuC;AACvE,SAAO,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,MAAM,KAAK;AACrD;AAEO,SAAS,wBAAwB,QAAyB;AAC/D,SAAO,kBAAkB,MAAM,MAAM;AACvC;AAQA,eAAsB,6BACpB,IACA,aAC2B;AAC3B,QAAM,aAAa,MAAM,mBAAmB,IAAI,WAAW;AAC3D,QAAM,aAAa,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AACvD,QAAM,kBAAkB,WACrB,OAAO,CAAC,iBAAiB,CAAC,WAAW,IAAI,aAAa,KAAK,EAAE,CAAC,EAC9D,QAAQ,CAAC,iBAAiB;AACzB,UAAM,SAAS,eAAe,UAAU,aAAa,IAAI;AACzD,WAAO,OAAO,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC;AAAA,EAC3C,CAAC;AACH,SAAO,CAAC,GAAG,OAAO,GAAG,eAAe;AACtC;AAEA,eAAsB,sBACpB,IACA,aACA,QACgC;AAChC,QAAM,UAAU,kBAAkB,MAAM;AACxC,MAAI,SAAS;AACX,WAAO;AAAA,EACT;AACA,QAAM,eAAe,MAAM,iBAAiB,IAAI,aAAa,MAAM;AACnE,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,EACT;AACA,QAAM,SAAS,eAAe,UAAU,aAAa,IAAI;AACzD,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEO,SAAS,6BAA6B,MAA8B;AACzE,SAAO,WAAW,QAAQ,EAAE,OAAO,WAAW,IAAI,CAAC,EAAE,OAAO,KAAK;AACnE;AAGO,SAAS,uCAAuC,MAA+B;AACpF,SACE,KAAK,WAAW,SAAS,KACzB,KAAK,OAAO,SAAS,KACrB,KAAK,QAAQ,UACb,KAAK,iBAAiB,UACtB,KAAK,0BAA0B;AAEnC;AAkBO,SAAS,uBACd,MACA,OACwB;AACxB,QAAM,WAAW,2BAA2B,MAAM,KAAK;AACvD,MAAI,SAAS,KAAK,YAAY,MAAM,MAAM,KAAK,YAAY,GAAG;AAC5D,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,cAAc,MAAM,IAAI,sBAAsB,SAAS,IAAI;AAAA,IACtE,CAAC;AAAA,EACH;AACA,QAAM,iBAAiB,MAAM,KAAK,YAAY;AAC9C,QAAM,eAAe,mBAAmB,cAAc;AACtD,QAAM,YAAY,+CAA+C,YAAY,IAAI,SAAS,aAAa;AACvG,QAAM,eAAe,qBAAqB,cAAc,IAAI,SAAS,aAAa;AAClF,SAAO;AAAA,IACL,cAAc,gBAAgB,cAAc;AAAA,IAC5C;AAAA,IACA,WAAW,cAAc,cAAc,IAAI,SAAS,aAAa;AAAA,IACjE;AAAA,IACA,eAAe;AAAA,IACf,cAAc,SAAS;AAAA,IACvB,YAAY;AAAA,IACZ,MAAM,SAAS;AAAA,IACf,aAAa,SAAS;AAAA,IACtB,eAAe,SAAS;AAAA,IACxB,YAAY,SAAS;AAAA,IACrB,OAAO,SAAS,MAAM,IAAI,CAAC,UAAU;AAAA,MACnC,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,UAAU,IAAI,YAAY,EAAE,OAAO,KAAK,OAAO,EAAE;AAAA,MACjD,eAAe,WAAW,QAAQ,EAAE,OAAO,KAAK,OAAO,EAAE,OAAO,KAAK;AAAA,IACvE,EAAE;AAAA,EACJ;AACF;AAEA,eAAsB,kCACpB,IACA,aACA,MACA,UAAsD,CAAC,GACrB;AAClC,QAAM,eAAe,MAAM,oBAAoB,IAAI,aAAa,KAAK,EAAE;AACvE,QAAM,iBAAiB,KAAK,OAAO,IAAI,CAAC,UAAU,uBAAuB,MAAM,KAAK,CAAC;AACrF,QAAM,CAAC,sBAAsB,gBAAgB,IAAI,MAAM,QAAQ,IAAI;AAAA,IACjE,+BAA+B,IAAI,aAAa,KAAK,UAAU;AAAA,IAC/D;AAAA,MACE;AAAA,MACA;AAAA,MACA,eAAe,IAAI,CAAC,YAAY;AAAA,QAC9B,KAAK,OAAO;AAAA,QACZ,cAAc,OAAO;AAAA,QACrB,MAAM,OAAO;AAAA,QACb,eAAe,OAAO;AAAA,MACxB,EAAE;AAAA,MACF,cAAc;AAAA,IAChB;AAAA,EACF,CAAC;AACD,QAAM,iBAAiB,6BAA6B,IAAI;AACxD,QAAM,aAAwC,CAAC,GAAG,sBAAsB,GAAG,gBAAgB;AAC3F,QAAM,WAAW,WACd,OAAO,CAAC,cAAc,UAAU,YAAY,UAAU,WAAW,OAAO,EACxE;AAAA,IAAI,CAAC,cACJ,UAAU,WAAW,YACjB,GAAG,UAAU,KAAK,wCAClB,GAAG,UAAU,KAAK;AAAA,EACxB;AACF,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,cAAc;AAAA,EAChB;AACA,MACE,IAAI,WAAW,WACf,IAAI,WAAW,mBACd,IAAI,YAAY,IAAI,mBAAmB,QAAQ,IAAI,UAAU,OAC9D;AACA,aAAS,KAAK,eAAe,KAAK,KAAK,gBAAgB,IAAI,CAAC;AAAA,EAC9D;AACA,QAAM,gBACJ,QAAQ,iBAAiB,oBAAoB,cAAc,QAAQ,KAAK;AAC1E,MAAI,KAAK,aAAa,YAAY,CAAC,eAAe;AAChD,aAAS,KAAK,wDAAwD;AAAA,EACxE,WAAW,eAAe;AACxB,UAAM,cAAc,MAAM,eAAe,IAAI,aAAa,aAAa;AACvE,QAAI,CAAC,aAAa;AAChB,eAAS,KAAK,+DAA+D;AAAA,IAC/E,OAAO;AACL,YAAM,WAAW,KAAK,aAAa,qBAAqB,CAAC,GAAG;AAAA,QAC1D,CAAC,SAAS,CAAC,YAAY,UAAU,KAAK,CAAC,aAAa,SAAS,SAAS,IAAI;AAAA,MAC5E;AACA,UAAI,QAAQ,SAAS,GAAG;AACtB,iBAAS,KAAK,+CAA+C,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACA,QAAM,SACJ,CAAC,gBAAgB,aAAa,WAAW,aACrC,YACA,aAAa,mBAAmB,iBAC9B,WACA;AACR,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,aAAa,KAAK;AAAA,IAClB;AAAA,IACA,qBAAqB,cAAc,WAAW;AAAA,IAC9C;AAAA,IACA,OAAO,SAAS,WAAW;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,wBAAwB,KAAK,OAAO;AAAA,IACpC,oBAAoB,KAAK,gBAAgB;AAAA,EAC3C;AACF;AAEA,eAAe,eACb,IACA,aACA,MACA,gBACA,aAC4B;AAC5B,QAAM,WAAW,KAAK,KAAK,aAAa,QAAQ,QAAQ,KAAK,YAAY;AACzE,QAAM,gBAAgB,KAAK,KAAK,SAAS,kBAAkB,eAAe;AAC1E,MAAI,CAAC,YAAY,CAAC,eAAe;AAC/B,WAAO;AAAA,MACL,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,gBAAgB,kBAAkB;AAAA,MAClC,OAAO;AAAA,MACP,cAAc;AAAA,MACd,MAAM;AAAA,MACN,OAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,KAAK,KAAK,SAAS,kBAAkB,KAAK,IAAI,UAAU,gBAAgB;AAC1E,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA,OAAO,KAAK,IAAI;AAAA,MAChB,cAAc;AAAA,MACd,MAAM;AAAA,MACN,OAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,MACR,gBAAgB,kBAAkB;AAAA,MAClC,OAAO;AAAA,MACP,cAAc;AAAA,MACd,MAAM;AAAA,MACN,OAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,MAAM,OAAO,IAAI,aAAa,aAAa;AACvD,MAAI,CAAC,KAAK,eAAe;AACvB,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,MACR,gBAAgB,kBAAkB;AAAA,MAClC,OAAO;AAAA,MACP,cAAc;AAAA,MACd,MAAM,KAAK,QAAQ;AAAA,MACnB,OAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,cAAc,SAAS;AACzC,QAAM,SACJ,KAAK,gBAAgB,UAAU,KAAK,eAChC,aACA,KAAK,KAAK,mBAAmB,IAAI,qBAAqB,gBAAgB,YACpE,eACA;AACR,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,gBAAgB,kBAAkB;AAAA,IAClC,OAAO,IAAI;AAAA,IACX,cAAc,IAAI,cAAc;AAAA,IAChC,MAAM,IAAI;AAAA,IACV;AAAA,EACF;AACF;AAEA,SAAS,eAAe,KAAwB,aAAoC;AAClF,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,EACT;AACA,MAAI,IAAI,WAAW,cAAc;AAC/B,WAAO;AAAA,EACT;AACA,MAAI,aAAa;AACf,WAAO,uEAAuE,WAAW;AAAA,EAC3F;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,UAA8D;AACzF,QAAM,QAAQ,UAAU,iBAAiB,UAAU;AACnD,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AASA,eAAsB,iCACpB,IACA,aACA,MACe;AACf,MAAI,CAAC,KAAK,cAAc;AACtB;AAAA,EACF;AACA,QAAM,gBAAgB,MAAM,sBAAsB,IAAI,WAAW;AACjE,aAAW,gBAAgB,eAAe;AACxC,QAAI,aAAa,WAAW,YAAY,aAAa,WAAW,KAAK,IAAI;AACvE;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,sBAAsB,IAAI,aAAa,aAAa,MAAM;AAC9E,QAAI,OAAO,cAAc;AACvB,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,QAAQ,KAAK,EAAE,+CAA+C,MAAM,EAAE,sGAAiG,MAAM,EAAE;AAAA,MAC1L,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,SAAS,uCAAuC,OAI1B;AAC3B,QAAM,gBAAgB,MAAM,YAAY,IAAI,CAAC,eAAe,WAAW,EAAE;AACzE,SAAO;AAAA,IACL,QAAQ,6BAA6B;AAAA,MACnC,aAAa,MAAM;AAAA,MACnB,iBAAiB,MAAM;AAAA,MACvB,GAAI,MAAM,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;AAAA,IACrF,CAAC;AAAA,IACD,WAAW,CAAC;AAAA,IACZ,OAAO,oBAAoB;AAAA,IAC3B,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,gBAAgB;AAAA,MAChB,qBAAqB;AAAA,MACrB,iBAAiB,MAAM;AAAA,MACvB,qBAAqB;AAAA,IACvB;AAAA,EACF;AACF;AAEA,SAAS,6BAA6B,OAI3B;AACT,QAAM,kBAAkB,MAAM,YAC3B,IAAI,CAAC,eAAe;AACnB,WAAO,KAAK,WAAW,QAAQ,KAAK,WAAW,aAAa,KAAK,WAAW,EAAE;AAAA,EAChF,CAAC,EACA,KAAK,IAAI;AACZ,QAAM,gBACJ,MAAM,gBAAgB,SAAS,IAC3B,kFAAkF,MAAM,gBAAgB,KAAK,IAAI,CAAC,MAClH;AACN,QAAM,QAAQ,MAAM,qBAChB;AAAA;AAAA,EAAwC,MAAM,mBAAmB,KAAK,CAAC;AAAA,IACvE;AAEJ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AACd;;;AFhfA,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB,oBAAI,IAAI,CAAC,YAAY,SAAS,MAAM,CAAC;AACpE,IAAM,4BAA4B;AAClC,IAAM,sBAAsB;AAC5B,IAAM,8BAA8B;AACpC,IAAM,0BAA0B;AAChC,IAAM,oCAAoC;AAC1C,IAAM,sBAAsB;AAE5B,IAAM,0BAA0B;AAEhC,eAAsB,uBAAuB,OAKN;AACrC,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,MAAM,QAAQ,IAAI;AAAA,IACpB,2BAA2B,MAAM,IAAI,MAAM,WAAW;AAAA,IACtD,4BAA4B,MAAM,IAAI,MAAM,WAAW;AAAA,IACvDC,uBAAsB,MAAM,IAAI,MAAM,WAAW;AAAA,IACjD,6BAA6B,MAAM,IAAI,MAAM,WAAW;AAAA,IACxD,sBAAsB,MAAM,IAAI,MAAM,aAAa,KAAK,MAAM,SAAS;AAAA,IACvE,wBAAwB,MAAM,IAAI,MAAM,aAAa,IAAI;AAAA,IACzD,iCAAiC;AAAA,IACjC,oBAAoB,MAAM,IAAI,MAAM,WAAW;AAAA,IAC/C,MAAM,SAAS,4BACX,mCAAmC,MAAM,IAAI,MAAM,WAAW,IAC9D,QAAQ,QAAQ,IAAI;AAAA,EAC1B,CAAC;AACD,QAAM,uBAAuB,wBAAwB;AAAA,IACnD,CAAC,iBAAiB,aAAa,SAAS;AAAA,EAC1C;AACA,QAAM,6BAA6B,IAAI;AAAA,IACrC,qBAAqB,IAAI,CAAC,iBAAiB,CAAC,aAAa,cAAc,YAAY,CAAC;AAAA,EACtF;AACA,QAAM,qBAAqB,IAAI;AAAA,IAC7B,gBACG,OAAO,CAAC,UAAU,MAAM,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,QAAQ,CAAC,EACvE,IAAI,CAAC,UAAU,CAAC,MAAM,cAAc,KAAK,CAAC;AAAA,EAC/C;AACA,QAAM,gBAAgB,IAAI;AAAA,IACxB,kBACG,OAAO,CAAC,iBAAiB,aAAa,WAAW,QAAQ,EACzD,IAAI,CAAC,iBAAiB,aAAa,MAAM;AAAA,EAC9C;AACA,QAAM,iBAAiB,IAAI,IAAI,oBAAoB,EAAE,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AAC3E,QAAM,WAAW;AAAA,IACf,GAAG,eAAe;AAAA,MAAI,CAAC,SACrB,gBAAgB,MAAM,eAAe,IAAI,KAAK,EAAE,IAAI,aAAa,QAAQ;AAAA,IAC3E;AAAA,IACA,GAAG,0BAA0B,MAAM,QAAQ;AAAA,IAC3C,GAAG,gCAAgC,iBAAiB;AAAA,IACpD,iBAAiB,qBAAqB,OAAO,iBAAiB,CAAC;AAAA,IAC/D,GAAG;AAAA,IACH,GAAG,gBACA;AAAA,MACC,CAAC,UACC,MAAM,WAAW,aAAa,MAAM,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,QAAQ;AAAA,IACtF,EACC,IAAI,yBAAyB;AAAA,EAClC;AACA,QAAM,YAAY,MAAM,SAAS,4BAC7B,qBAAqB,0BAA0B,IAAI,IACnD;AACJ,QAAM,QAAQ,mBAAmB;AAAA,IAC/B,GAAG;AAAA,IACH,GAAG,eAAe;AAAA,MAChB,CAAC,SACC,KAAK,SAAS,WACd,KAAK,SAAS,SACd,KAAK,SAAS,YACd,CAAC,+BAA+B,IAAI;AAAA,IACxC;AAAA;AAAA;AAAA,IAGA,GAAI,YAAY,CAAC,SAAS,IAAI,CAAC;AAAA,EACjC,CAAC,EACE,IAAI,CAAC,SAAS;AACb,UAAM,YACJ,KAAK,SAAS,UACV,8BAA8B,MAAM,mBAAmB,IAAI,KAAK,EAAE,CAAC,IACnE,0BAA0B,MAAM,2BAA2B,IAAI,KAAK,EAAE,GAAG,aAAa;AAC5F,WAAO,yBAAyB,SAAS;AAAA,EAC3C,CAAC,EACA,KAAK,mBAAmB;AAC3B,SAAO;AAAA,IACL;AAAA,IACA,eAAe;AAAA,EACjB;AACF;AAEA,eAAsB,kBAAkB,OAKL;AACjC,QAAM,KAAK,MAAM,QAAQ,IAAI,KAAK,KAAK,sBAAsB,MAAM,OAAO;AAC1E,MAAI,GAAG,WAAW,OAAO,GAAG;AAC1B,UAAM,IAAIC,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,GAAG,WAAW,QAAQ,GAAG;AAC3B,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,GAAG,WAAW,MAAM,GAAG;AACzB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,GAAG,WAAW,SAAS,GAAG;AAC5B,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,QAAQ,SAAS,UACtB,OAAO,OAAO,wBAAwB,MACpC,OAAO,MAAM,QAAQ,SAAS,gBAAgB,YAC7C,MAAM,QAAQ,SAAS,YAAY,KAAK,MAAM,2BAClD;AACA,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,GAAG,wBAAwB;AAAA,IACtC,CAAC;AAAA,EACH;AACA,QAAM,SACJ,MAAM,QAAQ,WAAW,cACzB,MAAM,QAAQ,WAAW,aACzB,MAAM,QAAQ,WAAW,gBACzB,MAAM,QAAQ,WAAW,aACrB,WACA,MAAM,QAAQ;AACpB,QAAM,WAAW;AAAA,IACf,GAAG,MAAM,QAAQ;AAAA,IACjB,GAAI,MAAM,QAAQ,SAAS,SAC3B,MAAM,QAAQ,eACd,CAAC,MAAM,QAAQ,SAAS,cACpB,EAAE,aAAa,yBAAyB,IAAI,MAAM,QAAQ,QAAQ,EAAE,IACpE,CAAC;AAAA,EACP;AACA,SAAO,MAAM,4BAA4B,MAAM,IAAI;AAAA,IACjD,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB;AAAA,IACA,MAAM,MAAM,QAAQ;AAAA,IACpB;AAAA,IACA,MAAM,MAAM,QAAQ,KAAK,KAAK;AAAA,IAC9B,aAAa,MAAM,QAAQ,aAAa,KAAK,KAAK;AAAA,IAClD,UAAU,MAAM,QAAQ,SAAS,KAAK,KAAK;AAAA,IAC3C,MAAM,WAAW,MAAM,QAAQ,IAAI;AAAA,IACnC,aAAa,MAAM,QAAQ,eAAe;AAAA,IAC1C,aAAa,MAAM,QAAQ,eAAe;AAAA,IAC1C,YAAY,MAAM,QAAQ,cAAc;AAAA,IACxC,WAAW,MAAM,QAAQ,WAAW,KAAK,KAAK;AAAA,IAC9C;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,iBAAiB,OASH;AAClC,QAAM,OAAO,MAAM;AAAA,IACjB,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACA,MAAI,KAAK,SAAS,SAAS;AACzB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,SAAS,OAAO;AACvB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,SAAS,UAAU;AAC1B,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,SAAS,QAAQ;AACxB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,SAAS,SAAS,CAAC,KAAK,QAAQ,WAAW;AAClD,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,uBAAuB,MAAM,QAAQ;AAIzC,MAAI,qBAA8C,EAAE,GAAG,MAAM,QAAQ,OAAO;AAC5E,SAAO,mBAAmB;AAC1B,SAAO,mBAAmB;AAC1B,SAAO,mBAAmB;AAC1B,SAAO,mBAAmB;AAC1B,MAAI,KAAK,SAAS,OAAO;AACvB,UAAM,UAAU,MAAM,4BAA4B,OAAO,IAAI;AAC7D,UAAM,gBAAgB,MAAM,QAAQ,gBAChC,MAAM,mCAAmC,OAAO,MAAM,MAAM,QAAQ,aAAa,IACjF;AACJ,uCAAmC,MAAM,SAAS,aAAa;AAC/D,2BAAuB;AAAA,MACrB,GAAG;AAAA,MACH,GAAI,iBAAiB,CAAC,UAClB,4BAA4B,IAC5B,MAAM,gCAAgC,MAAM,MAAM,gBAAgB,WAAW,MAAS;AAAA,IAC5F;AACA,QAAI,eAAe;AACjB,yBAAmB,gBAAgB;AAAA,IACrC;AACA,QAAI,SAAS;AACX,YAAM,MAAM,kCAAkC,MAAM,QAAQ;AAC5D,yBAAmB,mBAAmB,OAAO;AAAA,QAC3C,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,wBAAwB,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,6BAA6B,MAAM,IAAI;AAAA,IAClD,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,cAAc,KAAK;AAAA,IACnB,MAAM,KAAK;AAAA,IACX,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ,CAAC;AACH;AAQA,eAAe,4BACb,OAMA,MACwC;AACxC,QAAM,WAAW,+BAA+B,MAAM,QAAQ,OAAO;AACrE,MAAI,UAAU;AAGZ,sCAAkC,MAAM,QAAQ;AAChD,WAAO;AAAA,EACT;AACA,QAAM,mBAAmB,MAAM;AAAA,IAC7B,MAAM;AAAA,IACN,MAAM;AAAA,IACN,KAAK;AAAA,EACP;AACA,MAAI,CAAC,kBAAkB;AACrB,WAAO;AAAA,EACT;AACA,QAAM,MAAM,kCAAkC,MAAM,QAAQ;AAC5D,MAAI;AACF,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,gBAAgB,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AAAA,QACtD;AAAA,QACA,wBAAwB,KAAK,KAAK;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AACN,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,kCAAkC,KAAK,IAAI;AAAA,IACtD,CAAC;AAAA,EACH;AACF;AAEA,SAAS,+BACP,SAC+B;AAC/B,QAAM,UAAU,OAAO,QAAQ,OAAO,EACnC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,KAAK,GAAG,KAAK,CAAU,EACpD,OAAO,CAAC,CAAC,IAAI,MAAM,KAAK,SAAS,CAAC;AACrC,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,SAAS,yBAAyB;AAC5C,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,sCAAsC,uBAAuB;AAAA,IACxE,CAAC;AAAA,EACH;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,CAAC,MAAM,KAAK,KAAK,SAAS;AACnC,QAAI,CAAC,wBAAwB,KAAK,IAAI,GAAG;AACvC,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,mCAAmC,IAAI;AAAA,MAClD,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,KAAK,YAAY;AAC/B,QAAI,KAAK,IAAI,KAAK,GAAG;AACnB,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,qCAAqC,IAAI;AAAA,MACpD,CAAC;AAAA,IACH;AACA,SAAK,IAAI,KAAK;AACd,QAAI,MAAM,WAAW,KAAK,MAAM,SAAS,mCAAmC;AAC1E,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,qBAAqB,IAAI,cAAc,iCAAiC;AAAA,MACnF,CAAC;AAAA,IACH;AAIA,QAAI,qCAAqC,KAAK,KAAK,GAAG;AACpD,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,qBAAqB,IAAI;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,OAAO,YAAY,OAAO;AACnC;AAEA,eAAe,mCACb,OACA,MACA,KACiC;AACjC,QAAM,eAAe,IAAI,gBAAgB;AACzC,QAAM,eACJ,KAAK,SAAS,wBAAwB,mBACtC,KAAK,aAAa,QAAQ,QAAQ,EAAE,MAAM;AAC5C,MAAI,gBAAgB,iBAAiB,WAAW;AAC9C,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACA,QAAM,aAAqC;AAAA,IACzC,gBAAgB,IAAI,eAAe,KAAK;AAAA,IACxC;AAAA,IACA,GAAI,IAAI,eAAe,EAAE,cAAc,IAAI,aAAa,IAAI,CAAC;AAAA,IAC7D,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,KAAK,EAAE,IAAI,CAAC;AAAA,IACxD,GAAI,IAAI,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,IAAI,SAAS,EAAE,QAAQ,cAAc,IAAI,MAAM,EAAE,IAAI,CAAC;AAAA,IAC1D,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,IACjD,GAAI,IAAI,oBACJ;AAAA,MACE,mBAAmB,IAAI,kBAAkB,IAAI,CAAC,cAAc;AAAA,QAC1D,GAAG;AAAA,MACL,EAAE;AAAA,IACJ,IACA,CAAC;AAAA,EACP;AACA,MAAI,CAAC,WAAW,gBAAgB;AAC9B,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,KAAK,eAAe,CAAC,KAAK,QAAQ,aAAa;AAClD,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AAEA,MAAI,aAAa,WAAW,eACxB,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,MAAM;AAAA,IACN,WAAW;AAAA,IACX,MAAM,MAAM;AAAA,EACd,IACA;AACJ,MAAI,CAAC,cAAc,iBAAiB,aAAa,CAAC,WAAW,cAAc;AACzE,UAAM,UAAU,MAAM;AAAA,MACpB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,IACd;AACA,iBACE,QAAQ;AAAA,MACN,CAAC,cACC,UAAU,cAAc,MAAM,MAAM,aACpC,UAAU,mBAAmB,WAAW,mBACvC,CAAC,WAAW,QAAQ,UAAU,SAAS,WAAW,SACnD,UAAU,WAAW;AAAA,IACzB,KAAK;AAAA,EACT;AACA,MAAI,CAAC,YAAY;AACf,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACG,iBAAiB,aAAa,WAAW,cAAc,MAAM,MAAM,aACnE,iBAAiB,eAAe,WAAW,cAAc,MAC1D;AACA,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,sCAAsC,YAAY;AAAA,IAC7D,CAAC;AAAA,EACH;AACA,MAAI,WAAW,WAAW,UAAU;AAClC,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,6CAA6C,WAAW,MAAM;AAAA,IACzE,CAAC;AAAA,EACH;AACA,MAAI,WAAW,mBAAmB,WAAW,gBAAgB;AAC3D,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,WAAW,QAAQ,WAAW,SAAS,WAAW,MAAM;AAC1D,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,iBAAiB,WAAW;AAC9B,UAAM,oBAAoB,EAAE,GAAG,YAAY,MAAM,WAAW,KAAK;AACjE,WAAO,kBAAkB;AACzB,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,8BAAuD;AAC9D,SAAO;AAAA,IACL,iBAAiB;AAAA,MACf,QAAQ;AAAA,MACR,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC;AAAA,EACF;AACF;AAEA,SAAS,mCACP,MACA,SACA,eACM;AACN,MAAI,eAAe;AACjB;AAAA,EACF;AACA,QAAM,WAAW,0BAA0B,KAAK,QAAQ;AACxD,QAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC;AAClF,QAAM,UAAU,SAAS,OAAO,CAAC,SAAS,CAAC,MAAM,IAAI,KAAK,YAAY,CAAC,CAAC;AACxE,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,mBAAmB,KAAK,IAAI,mCAAmC,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC5F,CAAC;AAAA,EACH;AACA,MAAI,KAAK,aAAa,MAAM,SAAS,GAAG;AACtC,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,mBAAmB,KAAK,IAAI;AAAA,IACvC,CAAC;AAAA,EACH;AACF;AAEA,SAAS,0BAA0B,UAA6C;AAC9E,QAAM,QAAQ,SAAS;AACvB,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,WAAO,CAAC;AAAA,EACV;AACA,SAAO,MACJ,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC,EACnF,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;AAC9B;AAEA,SAAS,kCAAkC,UAAgC;AACzE,QAAM,MAAM,+BAA+B,QAAQ;AACnD,MAAI,CAAC,KAAK;AACR,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAkBA,eAAsB,gCACpB,MACA,QAA4B,8BAC5B,SACkC;AAClC,MAAI,KAAK,SAAS,OAAO;AACvB,WAAO,CAAC;AAAA,EACV;AACA,MAAI,CAAC,KAAK,eAAe,CAAC,KAAK,QAAQ,aAAa;AAClD,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI;AACF,UAAM,SAAS,MAAM,MAAM;AAAA,MACzB,IAAI,KAAK,QAAQ;AAAA,MACjB,MAAM,KAAK;AAAA,MACX,KAAK,KAAK;AAAA,MACV,WAAW;AAAA,MACX,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/B,CAAC;AACD,WAAO;AAAA,MACL,iBAAiB;AAAA,QACf,QAAQ;AAAA,QACR,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,WAAW,OAAO;AAAA,MACpB;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,mBAAmB,KAAK,IAAI,kCAAkC,qBAAqB,OAAO,KAAK,WAAW,CAAC;AAAA,IACtH,CAAC;AAAA,EACH;AACF;AAEA,eAAe,6BACb,OACmC;AACnC,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,MAAM,SAAS;AACpE,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,6BAA6B,SAAS,QAAQ;AAAA,IACtD,EAAE,cAAc,CAAC,EAAE;AAAA,EACrB;AACA,MAAI;AACF,UAAM,YAAY,IAAI,8BAA8B,IAAI,IAAI,MAAM,GAAG,GAAG;AAAA,MACtE,aAAa;AAAA,QACX,QAAQ,WAAW;AAAA,QACnB,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,MACpD;AAAA,IACF,CAAC;AACD,UAAM,OAAO,QAAQ,WAAmC;AAAA,MACtD,SAAS,MAAM;AAAA,MACf,iBAAiB,MAAM;AAAA,IACzB,CAAC;AACD,UAAM,QAAQ,MAAM,OAAO,UAAU,QAAW;AAAA,MAC9C,SAAS,MAAM;AAAA,MACf,iBAAiB,MAAM;AAAA,IACzB,CAAC;AACD,WAAO,EAAE,WAAW,MAAM,MAAM,OAAO;AAAA,EACzC,UAAE;AACA,iBAAa,OAAO;AACpB,UAAM,OAAO,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,EAC5C;AACF;AAEA,SAAS,qBAAqB,OAAgB,aAA6B;AACzE,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,QAAM,aAAa,QAAQ,QAAQ,QAAQ,GAAG,EAAE,KAAK;AACrD,QAAM,WAAW,kBAAkB,WAAW;AAC9C,MACE,8KAA8K;AAAA,IAC5K;AAAA,EACF,GACA;AACA,WAAO,kEAAkE,QAAQ;AAAA,EACnF;AACA,SAAO,iCAAiC,QAAQ;AAClD;AAEA,SAAS,kBAAkB,aAA6B;AACtD,MAAI;AACF,WAAO,IAAI,IAAI,WAAW,EAAE,YAAY;AAAA,EAC1C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,kBAAkB,OAMJ;AAClC,QAAM,OAAO,MAAM;AAAA,IACjB,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACA,MAAI,KAAK,SAAS,SAAS;AACzB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,SAAS,OAAO;AACvB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,SAAS,UAAU;AAC1B,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,SAAS,QAAQ;AACxB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,WAAW,cAAc,KAAK,WAAW,cAAc;AAC9D,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACA,MAAI,CAAE,MAAM,0BAA0B,MAAM,IAAI,MAAM,aAAa,KAAK,EAAE,GAAI;AAC5E,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO,MAAM,8BAA8B,MAAM,IAAI,MAAM,aAAa,KAAK,EAAE;AACjF;AAEA,eAAsB,wCACpB,IACA,aACA,UACA,SAKmB;AACnB,QAAM,yBAAyB,SAAS,YACpC,6BAA6B,IAAI,aAAa,QAAQ,SAAS,IAC/D;AAAA,IACE;AAAA,IACA;AAAA,IACA,SAAS,iCAAiC,CAAC;AAAA,EAC7C;AACJ,QAAM,CAAC,SAAS,iBAAiB,qBAAqB,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC1E,gCAAgC,IAAI,WAAW;AAAA,IAC/C;AAAA,IACA,mCAAmC,IAAI,WAAW;AAAA,EACpD,CAAC;AACD,WAAS,4BAA4B,eAAe;AACpD,SAAO;AAAA,IACL;AAAA,MACE,iCAAiC,UAAU,OAAO;AAAA,MAClD;AAAA,IACF;AAAA,IACA,0BAA0B;AAAA,EAC5B;AACF;AAEO,SAAS,mCACd,cACA,aACyB;AACzB,QAAM,QAAQ,IAAI;AAAA,IAChB,YAAY;AAAA,MAAI,CAAC,eACf;AAAA,QACE,WAAW;AAAA,QACX,WAAW;AAAA,QACX,WAAW,eAAe,YAAY;AAAA,QACtC,WAAW,QAAQ;AAAA,MACrB,EAAE,KAAK,IAAQ;AAAA,IACjB;AAAA,EACF;AACA,SAAO,aAAa,OAAO,CAAC,gBAAgB;AAC1C,UAAM,MAAM,YAAY;AACxB,QAAI,CAAC,OAAO,IAAI,iBAAiB,aAAa,CAAC,IAAI,aAAc,QAAO;AACxE,WAAO,MAAM;AAAA,MACX;AAAA,QACE,YAAY;AAAA,QACZ,IAAI;AAAA,QACJ,IAAI,eAAe,YAAY;AAAA,QAC/B,IAAI,QAAQ;AAAA,MACd,EAAE,KAAK,IAAQ;AAAA,IACjB;AAAA,EACF,CAAC;AACH;AAEA,eAAe,2CACb,IACA,aACA,aACkC;AAClC,QAAM,YAAY,MAAM,6BAA6B,IAAI,WAAW;AACpE,MAAI,YAAY,WAAW,EAAG,QAAO;AACrC,QAAM,SAAS,CAAC,GAAG,IAAI,IAAI,YAAY,IAAI,CAAC,eAAe,WAAW,cAAc,CAAC,CAAC;AACtF,QAAM,mBAAmB,MAAM,QAAQ;AAAA,IACrC,OAAO;AAAA,MAAI,OAAO,cAChB;AAAA,QACE,MAAM,6BAA6B,IAAI,aAAa,SAAS;AAAA,QAC7D,YAAY,OAAO,CAAC,eAAe,WAAW,mBAAmB,SAAS;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,IAAI,IAAI,UAAU,IAAI,CAAC,gBAAgB,CAAC,YAAY,UAAU,WAAW,CAAC,CAAC;AAC9F,aAAW,eAAe,iBAAiB,KAAK;AAC9C,eAAW,IAAI,YAAY,UAAU,WAAW;AAClD,SAAO,CAAC,GAAG,WAAW,OAAO,CAAC;AAChC;AAEO,SAAS,kCACd,UACA,cACU;AACV,MAAI,aAAa,WAAW,EAAG,QAAO;AACtC,QAAM,cAAc,IAAI,IAAI,SAAS,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AAC1E,QAAM,iBAAiB,aACpB,OAAO,CAAC,gBAAgB,CAAC,YAAY,IAAI,YAAY,QAAQ,CAAC,EAC9D,IAAI,CAAC,iBAAiB;AAAA,IACrB,IAAI,YAAY;AAAA,IAChB,MAAM,YAAY;AAAA;AAAA;AAAA;AAAA,IAIlB,KAAK,YAAY;AAAA,IACjB,cAAc,CAAC,GAAG,YAAY,YAAY;AAAA,IAC1C,gBAAgB;AAAA,IAChB,iBAAiB,YAAY;AAAA,IAC7B,GAAI,YAAY,gBAAgB,EAAE,eAAe,YAAY,cAAc,IAAI,CAAC;AAAA,EAClF,EAAE;AACJ,SAAO,eAAe,SAClB,EAAE,GAAG,UAAU,YAAY,CAAC,GAAG,SAAS,YAAY,GAAG,cAAc,EAAE,IACvE;AACN;AAMA,eAAsB,mCACpB,IACA,aACwB;AACxB,QAAM,gBAAgB,MAAM,0CAA0C,IAAI,WAAW;AACrF,MAAI,CAAC,cAAe,QAAO;AAC3B,QAAM,QAAQ,MAAMC,mBAAkB,IAAI,cAAc,gBAAgB,WAAW;AACnF,SAAO,SAAS,cAAc,MAAM,aAAa,mBAAmB,IAChE,cAAc,eACd;AACN;AAQO,SAAS,+BACd,UACA,qBACU;AACV,QAAM,kBAAkB;AAAA,IACtB,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,WAAW;AAAA;AAAA,IAEX,gBAAgB;AAAA,EAClB;AAKA,QAAM,oBAAoB,SAAS,WAAW;AAAA,IAC5C,CAAC,WAAW,OAAO,OAAO;AAAA,EAC5B;AACA,MAAI,CAAC,SAAS,6BAA6B,CAAC,qBAAqB;AAC/D,WAAO,kBAAkB,WAAW,SAAS,WAAW,SACpD,WACA,EAAE,GAAG,UAAU,YAAY,kBAAkB;AAAA,EACnD;AACA,QAAM,WAAW,SAAS,WAAW,GAAG,EAAE;AAC1C,MACE,kBAAkB,WAAW,SAAS,WAAW,SAAS,KAC1D,aAAa,UACb,OAAO,KAAK,QAAQ,EAAE,WAAW,OAAO,KAAK,eAAe,EAAE,UAC9D,OAAO,QAAQ,eAAe,EAAE;AAAA,IAC9B,CAAC,CAAC,KAAK,KAAK,MAAM,SAAS,GAA4B,MAAM;AAAA,EAC/D,GACA;AACA,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,CAAC,GAAG,mBAAmB,eAAe;AAAA,EACpD;AACF;AAEO,SAAS,iCACd,UACA,SACU;AACV,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,+BAA+B,QAAQ;AAC7D,QAAM,cAAc,IAAI,IAAI,SAAS,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AAC1E,QAAM,iBAAiB,QACpB,OAAO,CAAC,WAAW,CAAC,YAAY,IAAI,OAAO,EAAE,CAAC,EAC9C,QAAQ,CAAC,WAAW;AACnB,UAAM,UAAU,2BAA2B,QAAQ,aAAa;AAChE,QAAI,YAAY,iBAAiB,CAAC,OAAO,eAAe;AAGtD,aAAO,CAAC;AAAA,IACV;AACA,WAAO;AAAA,MACL;AAAA,QACE,IAAI,OAAO;AAAA,QACX,MAAM,OAAO;AAAA,QACb,KAAK,OAAO;AAAA,QACZ,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,QACnE,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,QAC1D,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,GAAI,OAAO,oBAAoB,SAC3B,EAAE,iBAAiB,OAAO,gBAAgB,IAC1C,CAAC;AAAA,QACL,GAAI,WAAW,YAAY,gBAAgB,EAAE,QAAQ,IAAI,CAAC;AAAA,QAC1D,GAAI,OAAO,gBAAgB,EAAE,eAAe,OAAO,cAAc,IAAI,CAAC;AAAA,MACxE;AAAA,IACF;AAAA,EACF,CAAC;AACH,SAAO,eAAe,SAClB,EAAE,GAAG,UAAU,YAAY,CAAC,GAAG,SAAS,YAAY,GAAG,cAAc,EAAE,IACvE;AACN;AAEA,eAAsB,gCAAgC,OAKjB;AACnC,QAAM,SAAS,MAAM,SAAS,IAAI,KAAK,EAAE,YAAY;AACrD,QAAM,QAAQ,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,MAAM,SAAS,EAAE,CAAC,CAAC;AACtE,QAAM,QAAiC,CAAC;AACxC,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,eAAqE,CAAC;AAC5E,MAAI,MAAM,WAAW;AACnB,iBAAa,YAAY,MAAM;AAAA,EACjC;AACA,MAAI,MAAM,cAAc,QAAW;AACjC,iBAAa,YAAY,MAAM;AAAA,EACjC;AACA,MAAI;AACJ,MAAI,QAAQ;AAEZ,SAAO,MAAM,SAAS,SAAS,QAAQ,qBAAqB;AAC1D,aAAS;AACT,UAAM,MAAM,IAAI,IAAI,iBAAiB,sBAAsB;AAC3D,QAAI,aAAa,IAAI,SAAS,OAAO,KAAK,CAAC;AAC3C,QAAI,aAAa,IAAI,WAAW,QAAQ;AACxC,QAAI,OAAO;AACT,UAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IACtC;AACA,QAAI,QAAQ;AACV,UAAI,aAAa,IAAI,UAAU,MAAM;AAAA,IACvC;AACA,UAAM,OAAO,MAAM,qBAAqB,KAAK,YAAY;AACzD,eAAW,SAAS,KAAK,WAAW,CAAC,GAAG;AACtC,YAAM,OAAO,8BAA8B,KAAK;AAChD,UAAI,CAAC,QAAQ,KAAK,IAAI,KAAK,EAAE,GAAG;AAC9B;AAAA,MACF;AACA,UAAI,SAAS,CAAC,kBAAkB,IAAI,EAAE,SAAS,KAAK,GAAG;AACrD;AAAA,MACF;AACA,WAAK,IAAI,KAAK,EAAE;AAChB,YAAM,KAAK,IAAI;AACf,UAAI,MAAM,UAAU,OAAO;AACzB;AAAA,MACF;AAAA,IACF;AACA,aAAS,OAAO,KAAK,UAAU,eAAe,WAAW,KAAK,SAAS,aAAa;AACpF,QAAI,CAAC,QAAQ;AACX;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAMA,eAAe,qBACb,KACA,UAGI,CAAC,GACqB;AAC1B,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,UAAU;AAAA,IACd,MAAM,WAAW,MAAM;AAAA,IACvB,QAAQ,aAAa;AAAA,EACvB;AACA,MAAI;AACF,UAAM,WAAW,MAAM,UAAU,KAAK,EAAE,QAAQ,WAAW,OAAO,CAAC;AACnE,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAIC,eAAc,KAAK;AAAA,QAC3B,SAAS,yBAAyB,SAAS,MAAM;AAAA,MACnD,CAAC;AAAA,IACH;AACA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B,SAAS,OAAO;AACd,QAAI,iBAAiBA,gBAAe;AAClC,YAAM;AAAA,IACR;AACA,QAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,gCAAgC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACjG,CAAC;AAAA,EACH,UAAE;AACA,iBAAa,OAAO;AAAA,EACtB;AACF;AAEA,eAAe,mBACb,IACA,aACA,UACA,cACgC;AAChC,QAAM,UAAU,MAAM,uBAAuB,EAAE,IAAI,aAAa,SAAS,CAAC;AAC1E,QAAM,OACJ,QAAQ,MAAM,KAAK,CAAC,cAAc,UAAU,OAAO,YAAY,KAC9D,MAAM,yBAAyB,IAAI,aAAa,YAAY;AAC/D,MAAI,CAAC,MAAM;AACT,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;AAAA,EAClE;AACA,SAAO;AACT;AAEA,SAAS,gBACP,MACA,QACuB;AACvB,QAAM,iBAAiB,EAAE,GAAG,KAAK,SAAS;AAC1C,aAAW,OAAO;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAG;AACD,WAAO,eAAe,GAAG;AAAA,EAC3B;AACA,SAAO,sBAAsB,MAAM;AAAA,IACjC,IAAI,QAAQ,KAAK,EAAE;AAAA,IACnB,MAAM;AAAA,IACN;AAAA,IACA,MAAM,KAAK;AAAA,IACX,aAAa,KAAK;AAAA,IAClB,UAAU,KAAK;AAAA,IACf,MAAM,CAAC,KAAK,MAAM,KAAK,UAAU,MAAM;AAAA,IACvC,OAAO,KAAK;AAAA,IACZ,SAAS;AAAA,MACP,WAAW;AAAA,MACX,OAAO;AAAA,IACT;AAAA,IACA,UAAU;AAAA,MACR,GAAG;AAAA,MACH,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,wBAAwB,KAAK;AAAA,MAC7B,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA;AAAA,MAE5D,GAAI,KAAK,eAAe,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;AAAA,MAC/D,GAAI,KAAK,wBAAwB,EAAE,uBAAuB,KAAK,sBAAsB,IAAI,CAAC;AAAA,MAC1F,GAAI,KAAK,OAAO,SAAS,IAAI,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC,UAAU,MAAM,IAAI,EAAE,IAAI,CAAC;AAAA,IACrF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,0BAA0B,UAA6C;AAC9E,SACE,SAAS,WAIN;AAAA,IACC,CAAC,WACC,OAAO,OAAO,4BAA4B,CAAC,uBAAuB,IAAI,OAAO,EAAE;AAAA,EACnF,EACC;AAAA,IAAI,CAAC,WACJ,sBAAsB,MAAM;AAAA,MAC1B,IAAI,OAAO,OAAO,EAAE;AAAA,MACpB,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,OAAO,QAAQ,OAAO;AAAA,MAC5B,aAAa;AAAA,MACb,UAAU;AAAA,MACV,MAAM,CAAC,OAAO,GAAI,OAAO,cAAc,SAAS,CAAC,eAAe,IAAI,CAAC,CAAE;AAAA,MACvE,aAAa,OAAO;AAAA,MACpB,OAAO,CAAC,EAAE,MAAM,OAAO,IAAI,OAAO,GAAG,CAAC;AAAA,MACtC,SAAS;AAAA,QACP,WAAW;AAAA,QACX,aAAa,OAAO;AAAA,QACpB,WAAW;AAAA,QACX,OAAO;AAAA,MACT;AAAA,MACA,UAAU;AAAA,QACR,aAAa,OAAO;AAAA,QACpB,cAAc,OAAO,gBAAgB,CAAC;AAAA,QACtC,gBAAgB,OAAO;AAAA,MACzB;AAAA,IACF,CAAC;AAAA,EACH;AAEN;AAEA,SAAS,+BAA+B,MAAsC;AAC5E,SACE,KAAK,OAAO,OAAO,wBAAwB,MAC1C,KAAK,SAAS,UACZ,KAAK,QAAQ,gBAAgB,4BAC5B,KAAK,SAAS,gBAAgB;AAEtC;AAQO,SAAS,qBAAqB,WAA2C;AAC9E,SAAO,sBAAsB,MAAM;AAAA,IACjC,IAAI,OAAO,wBAAwB;AAAA,IACnC,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,MAAM,CAAC,OAAO,SAAS,gBAAgB;AAAA,IACvC,gBAAgB;AAAA,IAChB,aAAa;AAAA,IACb,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,OAAO,CAAC,EAAE,MAAM,OAAO,IAAI,yBAAyB,CAAC;AAAA,IACrD,SAAS;AAAA,MACP;AAAA,MACA,GAAI,YAAY,EAAE,aAAa,yBAAyB,IAAI,CAAC;AAAA,MAC7D,WAAW;AAAA,MACX,OAAO,YACH,6DACA;AAAA,IACN;AAAA,IACA,SAAS;AAAA,IACT,eAAe,YAAY,+BAA+B;AAAA,IAC1D,UAAU;AAAA,MACR,aAAa;AAAA,MACb,eAAe;AAAA,IACjB;AAAA,EACF,CAAC;AACH;AAWA,IAAM,+BAA+E;AAAA,EACnF;AAAA,IACE,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aACE;AAAA,IACF,gBAAgB;AAAA,IAChB,aAAa;AAAA,IACb,MAAM,CAAC,OAAO,KAAK,WAAW,UAAU,WAAW;AAAA,EACrD;AAAA,EACA;AAAA,IACE,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aACE;AAAA,IACF,gBAAgB;AAAA,IAChB,aAAa;AAAA,IACb,MAAM,CAAC,OAAO,UAAU,UAAU,aAAa,WAAW;AAAA,EAC5D;AACF;AAEA,IAAM,6BAA6B;AAAA,EACjC,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAOA,SAAS,iBAAiB,kBAA+D;AACvF,QAAM,kBAAkB,yBAAyB,gBAAgB;AACjE,QAAM,eACJ,iBAAiB,WAAW,YAAY,iBAAiB,WAAW;AACtE,SAAO,sBAAsB,MAAM;AAAA,IACjC,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,MAAM,CAAC,OAAO,SAAS,cAAc,aAAa,QAAQ;AAAA,IAC1D,aAAa;AAAA,IACb,WAAW;AAAA,IACX,gBAAgBC;AAAA,IAChB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,OAAO,CAAC,EAAE,MAAM,OAAO,IAAI,WAAW,CAAC;AAAA,IACvC,SAAS;AAAA,MACP,WAAW;AAAA,MACX,aAAa;AAAA,MACb,OAAO;AAAA,IACT;AAAA,IACA,SAAS;AAAA,IACT,eAAe,eACX,gBAAgB,WAAW,WACzB,sCACA,kDACF;AAAA,IACJ,UAAU;AAAA,MACR,eAAe;AAAA,MACf,WAAW;AAAA;AAAA;AAAA,MAGX,oBAAoB,2BAA2B,OAAO,CAAC,SAAS,KAAK,WAAW,QAAQ,CAAC;AAAA,IAC3F;AAAA,EACF,CAAC;AACH;AAEA,SAAS,gCACP,mBACyB;AACzB,SAAO,6BAA6B,IAAI,CAAC,eAAe;AACtD,UAAM,SAAS,uBAAuB,mBAAmB,WAAW,QAAQ;AAC5E,UAAM,UAAU,OAAO,YAAY,OAAO,cAAc;AACxD,WAAO,sBAAsB,MAAM;AAAA,MACjC,IAAI,OAAO,WAAW,QAAQ;AAAA,MAC9B,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,WAAW;AAAA,MACjB,aAAa,WAAW;AAAA,MACxB,UAAU;AAAA,MACV,MAAM,WAAW;AAAA,MACjB,aAAa,WAAW;AAAA,MACxB,WAAW;AAAA,MACX,gBAAgB,WAAW;AAAA,MAC3B,aAAa;AAAA,MACb,UAAU;AAAA,MACV,OAAO,CAAC,EAAE,MAAM,OAAO,IAAI,WAAW,CAAC;AAAA,MACvC,SAAS;AAAA,QACP,WAAW;AAAA,QACX,aAAa;AAAA,QACb,OACE;AAAA,MACJ;AAAA,MACA;AAAA,MACA,eAAe,wBAAwB,MAAM;AAAA,MAC7C,YAAY;AAAA,MACZ,UAAU;AAAA,QACR,iBAAiB;AAAA,QACjB,UAAU,WAAW;AAAA,QACrB,kBAAkB;AAAA,QAClB,kBAAkB;AAAA,QAClB,oBAAoB,2BAA2B,WAAW,QAAQ;AAAA,MACpE;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAQO,SAAS,4CAAqE;AACnF,SAAO;AAAA,IACL,sBAAsB,MAAM;AAAA,MAC1B,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,MACV,MAAM,CAAC,UAAU,gBAAgB,gBAAgB;AAAA,MACjD,aAAa;AAAA,MACb,gBAAgB;AAAA,MAChB,WAAW;AAAA,MACX,UAAU;AAAA,MACV,aAAa;AAAA,MACb,OAAO,CAAC,EAAE,MAAM,OAAO,IAAI,WAAW,CAAC;AAAA,MACvC,SAAS;AAAA,QACP,WAAW;AAAA,QACX,OACE;AAAA,MACJ;AAAA,MACA,WAAW;AAAA,QACT,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,WAAW;AAAA,MACb;AAAA,MACA,SAAS,CAAC,WAAW,SAAS;AAAA,MAC9B,UAAU;AAAA,QACR,cAAc;AAAA,QACd,oBAAoB,CAAC,uBAAuB,0BAA0B;AAAA,QACtE,oBAAoB;AAAA,MACtB;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,SAAS,uBACP,aACA,UAC6E;AAC7E,QAAM,WAAW,YAAY,OAAO,CAAC,eAAe,WAAW,aAAa,QAAQ;AACpF,SAAO;AAAA,IACL,WAAW,SAAS,OAAO,CAAC,eAAe,WAAW,WAAW,WAAW,EAAE;AAAA,IAC9E,aAAa,SAAS,OAAO,CAAC,eAAe,WAAW,WAAW,cAAc,EAAE;AAAA,IACnF,UAAU,SAAS,OAAO,CAAC,eAAe,WAAW,WAAW,UAAU,EAAE;AAAA,IAC5E,OAAO,SAAS;AAAA,EAClB;AACF;AAEA,SAAS,wBAAwB,QAAkE;AACjG,QAAM,QAAkB,CAAC;AACzB,MAAI,OAAO,YAAY,GAAG;AACxB,UAAM,KAAK,GAAG,OAAO,SAAS,qBAAqB,OAAO,cAAc,IAAI,KAAK,GAAG,EAAE;AAAA,EACxF;AACA,MAAI,OAAO,cAAc,GAAG;AAC1B,UAAM;AAAA,MACJ,GAAG,OAAO,WAAW,WAAW,OAAO,gBAAgB,IAAI,KAAK,GAAG,QACjE,OAAO,gBAAgB,IAAI,MAAM,EACnC;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,KAAK,GAAG,OAAO,QAAQ,wBAAwB,OAAO,aAAa,IAAI,KAAK,GAAG,EAAE;AAAA,EACzF;AACA,SAAO,MAAM,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI;AAC/C;AAQA,eAAe,mCAAqE;AAClF,SAAO,wBAAwB,EAAE,IAAI,CAAC,UAAU,wBAAwB,KAAK,CAAC;AAChF;AAEA,SAAS,wBAAwB,OAAiD;AAChF,SAAO,sBAAsB,MAAM;AAAA,IACjC,IAAI,SAAS,MAAM,EAAE;AAAA,IACrB,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,UAAU,MAAM;AAAA,IAChB,MAAM,CAAC,GAAG,MAAM,IAAI;AAAA,IACpB,aAAa,MAAM;AAAA,IACnB,YAAY,MAAM;AAAA,IAClB,MAAM;AAAA,IACN,SAAS;AAAA,MACP,WAAW;AAAA,MACX,OAAO;AAAA,IACT;AAAA,IACA,UAAU;AAAA,MACR,WAAW,MAAM;AAAA,MACjB,SAAS,MAAM;AAAA,MACf,eAAe,MAAM;AAAA,MACrB,cAAc,MAAM;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM;AAAA,MACf,kBAAkB,MAAM;AAAA,MACxB,eAAe,MAAM;AAAA,MACrB,SAAS,MAAM;AAAA,MACf,cAAc,MAAM;AAAA,IACtB;AAAA,EACF,CAAC;AACH;AAEA,SAAS,0BAA0B,OAAqD;AACtF,SAAO,sBAAsB,MAAM;AAAA,IACjC,IAAI,MAAM;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,MAAM,WAAW,YAAY,YAAY;AAAA,IACjD,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,UAAU,MAAM;AAAA,IAChB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM,WAAW,YAAY,aAAa;AAAA,IAChD,SAAS;AAAA,MACP,WAAW;AAAA,MACX,OAAO;AAAA,IACT;AAAA,IACA,UAAU;AAAA,MACR,SAAS,MAAM;AAAA,MACf,eAAe,MAAM;AAAA,MACrB,cAAc,MAAM;AAAA,MACpB,YAAY,MAAM;AAAA,MAClB,WAAW,MAAM;AAAA,MACjB,eAAe,MAAM;AAAA,MACrB,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM;AAAA,MACf,gBAAgB,uBAAuB,KAAK;AAAA,IAC9C;AAAA,EACF,CAAC;AACH;AAEA,SAAS,uBAAuB,OAAuD;AACrF,SAAO;AAAA,IACL,WAAW,MAAM;AAAA,IACjB,qBAAqB,MAAM;AAAA,IAC3B,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,cAAc,MAAM;AAAA,IACpB,eAAe,MAAM;AAAA,IACrB,WAAW,MAAM;AAAA,IACjB,YAAY,MAAM;AAAA,IAClB,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB,QAAQ,MAAM,OAAO,IAAI,CAAC,WAAW,EAAE,GAAG,MAAM,EAAE;AAAA,EACpD;AACF;AAEA,SAAS,eAAe,OAA+B;AACrD,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;AAEA,SAAS,4BAA4B,MAAsC;AACzE,SACE,KAAK,gBAAgB,wBACpB,KAAK,gBAAgB,0BAA0B,KAAK,SAAS,oBAAoB;AAEtF;AAEA,SAAS,+BAA+B,MAGtC;AACA,QAAM,QAAQ,KAAK,SAAS;AAC5B,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,WAAO;AAAA,MACL,WAAW,KAAK,WAAW,CAAC,KAAK,eAAe,SAAS,cAAc,IAAI,IAAI;AAAA,MAC/E,aAAa,KAAK,eAAe,SAAS,cAAc,IAAI,IAAI;AAAA,IAClE;AAAA,EACF;AACA,QAAMC,UAAS;AACf,SAAO;AAAA,IACL,WACE,OAAOA,QAAO,cAAc,YAAY,OAAO,UAAUA,QAAO,SAAS,IACrE,KAAK,IAAI,GAAGA,QAAO,SAAS,IAC5B;AAAA,IACN,aACE,OAAOA,QAAO,gBAAgB,YAAY,OAAO,UAAUA,QAAO,WAAW,IACzE,KAAK,IAAI,GAAGA,QAAO,WAAW,IAC9B;AAAA,EACR;AACF;AAEO,SAAS,0BACd,MACA,cACA,eACuB;AACvB,MAAI,KAAK,SAAS,WAAW,KAAK,SAAS,SAAS,KAAK,SAAS,UAAU;AAC1E,WAAO,EAAE,GAAG,MAAM,SAAS,OAAO,eAAe,MAAM,eAAe,KAAK;AAAA,EAC7E;AACA,MAAI,KAAK,SAAS,QAAQ;AACxB,UAAMC,WAAU,cAAc,IAAI,uBAAuB,KAAK,EAAE,CAAC;AACjE,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAAA;AAAA,MACA,eAAeA,WAAU,YAAY;AAAA,IACvC;AAAA,EACF;AACA,MAAI,4BAA4B,IAAI,GAAG;AAIrC,WAAO,EAAE,GAAG,MAAM,eAAe,KAAK;AAAA,EACxC;AACA,MAAI,KAAK,gBAAgB,qBAAqB;AAI5C,WAAO,EAAE,GAAG,MAAM,eAAe,KAAK;AAAA,EACxC;AACA,MAAI,KAAK,gBAAgB,cAAc;AAIrC,WAAO,EAAE,GAAG,MAAM,eAAe,KAAK;AAAA,EACxC;AACA,MAAI,KAAK,WAAW,cAAc;AAChC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,MACT,eAAe;AAAA,MACf,eAAe;AAAA,IACjB;AAAA,EACF;AACA,MAAI,KAAK,WAAW,YAAY;AAI9B,WAAO,EAAE,GAAG,MAAM,eAAe,KAAK;AAAA,EACxC;AACA,QAAM,qBAAqB,cAAc,WAAW;AACpD,QAAM,UAAU,CAAC,CAAC,sBAAsB,mCAAmC,MAAM,YAAY;AAC7F,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,eAAe,UAAU,YAAY;AAAA,IACrC,eAAe,WAAW,eAAe,0BAA0B,aAAa,MAAM,IAAI;AAAA,EAC5F;AACF;AAEA,SAAS,yBAAyB,MAAoD;AACpF,MAAI,KAAK,WAAW,cAAc;AAChC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,WAAW;AAAA,QACT,QAAQ;AAAA,QACR,WAAW,KAAK,QAAQ,YAAY,UAAU;AAAA,QAC9C,QAAQ,KAAK,QAAQ;AAAA,QACrB,WAAW;AAAA,MACb;AAAA,MACA,SAAS,CAAC,SAAS;AAAA,IACrB;AAAA,EACF;AAEA,MAAI,CAAC,KAAK,QAAQ,WAAW;AAC3B,WAAO;AAAA,MACL,GAAG;AAAA,MACH,WAAW;AAAA,QACT,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,QAAQ,KAAK,QAAQ;AAAA,QACrB,WAAW,KAAK,WAAW,aAAa,aAAa;AAAA,MACvD;AAAA,MACA,SAAS,CAAC,SAAS;AAAA,IACrB;AAAA,EACF;AAEA,MAAI,4BAA4B,IAAI,GAAG;AACrC,UAAM,SAAS,+BAA+B,IAAI;AAClD,UAAM,iBAAiB,OAAO,cAAc;AAC5C,UAAM,YAAY,OAAO,YAAY;AACrC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,WAAW;AAAA,QACT,QAAQ,iBAAiB,oBAAoB,YAAY,cAAc;AAAA,QACvE,WAAW,iBAAiB,cAAc,YAAY,UAAU;AAAA,QAChE,QAAQ,KAAK;AAAA,QACb,WAAW;AAAA,MACb;AAAA,MACA,SAAS,iBACL,CAAC,UAAU,WAAW,cAAc,SAAS,IAC7C,YACE,CAAC,WAAW,aAAa,cAAc,SAAS,IAChD,CAAC,WAAW,SAAS;AAAA,IAC7B;AAAA,EACF;AAEA,MAAI,KAAK,gBAAgB,cAAc;AACrC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,WAAW;AAAA,QACT,QAAQ,KAAK,UAAU,cAAc;AAAA,QACrC,WAAW,KAAK,UAAU,UAAU;AAAA,QACpC,QAAQ,KAAK;AAAA,QACb,WAAW;AAAA,MACb;AAAA,MACA,SAAS,KAAK,UAAU,CAAC,aAAa,cAAc,SAAS,IAAI,CAAC,WAAW,SAAS;AAAA,IACxF;AAAA,EACF;AAEA,QAAM,YAAY,KAAK;AACvB,QAAM,UAA8B,YAChC,KAAK,SAAS,UAAU,KAAK,SAAS,WAAW,KAAK,SAAS,WAC7D,CAAC,aAAa,UAAU,aAAa,SAAS,IAC9C,CAAC,aAAa,cAAc,SAAS,IACvC,KAAK,SAAS,SAAS,KAAK,SAAS,QACnC,CAAC,WAAW,SAAS,IACrB,CAAC,WAAW,SAAS;AAC3B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW;AAAA,MACT,QAAQ,YACJ,KAAK,SAAS,SAAS,KAAK,SAAS,QACnC,UACA,cACF;AAAA,MACJ,WAAW,YAAY,UAAU;AAAA,MACjC,QAAQ,KAAK;AAAA,MACb,WAAW,KAAK,WAAW,aAAa,aAAa;AAAA,IACvD;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,8BACP,MACA,cACuB;AACvB,MAAI,CAAC,cAAc;AACjB,WAAO,EAAE,GAAG,MAAM,SAAS,OAAO,eAAe,MAAM,eAAe,KAAK;AAAA,EAC7E;AACA,QAAM,iBAAiB,eAAe,KAAK,SAAS,OAAO;AAC3D,QAAM,UACJ,mBAAmB,QAClB,mBAAmB,aAAa,WAC/B,eAAe,KAAK,SAAS,aAAa,MAAM,aAAa,iBAC7D,eAAe,KAAK,SAAS,YAAY,MAAM,aAAa;AAChE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS;AAAA,IACT,eAAe,UACX,yBACA,WAAW,aAAa,OAAO;AAAA,IACnC,eAAe;AAAA,IACf,UAAU;AAAA,MACR,GAAG,KAAK;AAAA,MACR,gBAAgB,uBAAuB,YAAY;AAAA,MACnD,iBAAiB,CAAC;AAAA,IACpB;AAAA,EACF;AACF;AAQA,SAAS,0BACP,QACwC;AACxC,QAAM,MAAM,OAAO;AACnB,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,WAAO;AAAA,EACT;AACA,QAAM,EAAE,cAAc,gBAAgB,MAAM,aAAa,IAAI;AAC7D,MAAI,OAAO,mBAAmB,YAAY,OAAO,SAAS,UAAU;AAClE,WAAO;AAAA,EACT;AACA,MAAI,iBAAiB,WAAW;AAG9B,WAAO,EAAE,gBAAgB,MAAM,cAAc,UAAU;AAAA,EACzD;AACA,MAAI,OAAO,iBAAiB,UAAU;AACpC,WAAO;AAAA,EACT;AACA,SAAO,EAAE,cAAc,gBAAgB,KAAK;AAC9C;AAEA,SAAS,mBAAmB,OAAyD;AACnF,QAAM,OAAO,oBAAI,IAAmC;AACpD,aAAW,QAAQ,OAAO;AAIxB,QAAI,KAAK,SAAS,WAAW,KAAK,WAAW,aAAa,KAAK,IAAI,KAAK,EAAE,GAAG;AAC3E,WAAK,IAAI,KAAK,IAAI,IAAI;AACtB;AAAA,IACF;AACA,UAAM,WAAW,KAAK,IAAI,KAAK,EAAE;AACjC,QAAI,UAAU,SAAS,WAAW,SAAS,WAAW,WAAW;AAC/D;AAAA,IACF;AACA,SAAK,IAAI,KAAK,IAAI,IAAI;AAAA,EACxB;AACA,SAAO,CAAC,GAAG,KAAK,OAAO,CAAC;AAC1B;AAEA,SAAS,oBAAoB,GAA0B,GAAkC;AACvF,SAAO,GAAG,EAAE,IAAI,IAAI,EAAE,QAAQ,IAAI,EAAE,IAAI,GAAG,cAAc,GAAG,EAAE,IAAI,IAAI,EAAE,QAAQ,IAAI,EAAE,IAAI,EAAE;AAC9F;AAcO,SAAS,6BACd,OACA,OACA,QAAQ,GACwB;AAChC,QAAM,SAAS,8BAA8B,KAAK;AAClD,QAAM,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,MAAM,GAAG,EAAE,OAAO,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,EAAE;AAC1E,MAAI,OAAO,WAAW,EAAG,QAAO,CAAC;AACjC,QAAM,eAAe,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,CAAC,CAAC;AAChE,QAAM,iBAAiB,CAAC,SACtB;AAAA,IACE,CAAC,QAAQ,KAAK,MAAM,GAAG;AAAA,IACvB,CAAC,YAAY,KAAK,kBAAkB,IAAI,EAAE;AAAA,IAC1C,CAAC,OAAO,KAAK,KAAK,KAAK,GAAG,GAAG,EAAE;AAAA,IAC/B,CAAC,YAAY,KAAK,UAAU,EAAE;AAAA,IAC9B,CAAC,MAAM,KAAK,IAAI,EAAE;AAAA,IAClB,CAAC,eAAe,KAAK,eAAe,IAAI,EAAE;AAAA,EAC5C;AAEF,SAAO,MACJ,OAAO,CAAC,SAAS,0CAA0C,IAAI,CAAC,EAChE,QAAQ,CAAC,SAAyC;AACjD,QAAI,QAAQ;AACZ,UAAM,YAAY,oBAAI,IAAuD;AAC7E,eAAW,CAAC,OAAO,KAAK,MAAM,KAAK,eAAe,IAAI,GAAG;AACvD,YAAM,QAAQ,8BAA8B,GAAG;AAC/C,UAAI,CAAC,MAAO;AACZ,YAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,UAAI,MAAM,SAAS,MAAM,GAAG;AAC1B,iBAAS,KAAK,MAAM,SAAS,GAAG;AAChC,kBAAU,IAAI,KAAK;AAAA,MACrB;AACA,iBAAW,SAAS,QAAQ;AAC1B,YAAI,MAAM,SAAS,KAAK,GAAG;AACzB,mBAAS;AACT,oBAAU,IAAI,KAAK;AAAA,QACrB,WAAW,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,KAAK,KAAK,MAAM,WAAW,IAAI,CAAC,GAAG;AACjF,mBAAS,KAAK,MAAM,SAAS,GAAG;AAChC,oBAAU,IAAI,KAAK;AAAA,QACrB,WAAW,MAAM,SAAS,KAAK,GAAG;AAChC,mBAAS,KAAK,MAAM,SAAS,GAAG;AAChC,oBAAU,IAAI,KAAK;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AACA,QAAI,UAAU,EAAG,QAAO,CAAC;AACzB,QAAI,KAAK,QAAS,UAAS;AAC3B,QAAI,KAAK,SAAS,WAAY,UAAS;AACvC,QAAI,KAAK,WAAW,WAAY,UAAS;AACzC,WAAO,CAAC,EAAE,MAAM,OAAO,WAAW,CAAC,GAAG,SAAS,EAAE,CAAC;AAAA,EACpD,CAAC,EACA;AAAA,IACC,CAAC,MAAM,UACL,MAAM,QAAQ,KAAK,SACnB,OAAO,MAAM,KAAK,OAAO,IAAI,OAAO,KAAK,KAAK,OAAO,KACrD,KAAK,KAAK,KAAK,cAAc,MAAM,KAAK,IAAI,KAC5C,KAAK,KAAK,GAAG,cAAc,MAAM,KAAK,EAAE;AAAA,EAC5C,EACC,MAAM,GAAG,YAAY;AAC1B;AAEA,SAAS,8BAA8B,OAAuB;AAC5D,SAAO,MACJ,UAAU,MAAM,EAChB,QAAQ,oBAAoB,EAAE,EAC9B,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,KAAK;AACV;AAEA,SAAS,sBAAsB,SAAqD;AAClF,QAAM,SAAS;AAAA,IACb,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ,eAAe,QAAQ,cAAc,QAAQ,eAAe;AAAA,EACtE,EAAE,KAAK,GAAG;AACV,SAAO,GAAG,QAAQ,IAAI,IAAI,QAAQ,QAAQ,IAAI,CAAC,IAAI,UAAU,MAAM,CAAC;AACtE;AAEA,SAAS,2BAA2B,MAAc,SAAiB,aAA6B;AAC9F,SAAO,gBAAgB,QAAQ,IAAI,CAAC,IAAI,UAAU,GAAG,IAAI,IAAI,OAAO,IAAI,WAAW,EAAE,CAAC;AACxF;AAEA,SAAS,uBAAuB,cAA8B;AAC5D,SAAO,aAAa,QAAQ,UAAU,EAAE;AAC1C;AAEA,SAAS,WAAW,MAA0B;AAC5C,SAAO,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AACnE;AAEA,SAAS,cAAc,QAA4B;AACjD,SAAO,CAAC,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AACzE;AAEA,SAAS,QAAQ,OAAuB;AACtC,SACE,MACG,YAAY,EACZ,QAAQ,iBAAiB,GAAG,EAC5B,QAAQ,YAAY,EAAE,EACtB,MAAM,GAAG,EAAE,KAAK;AAEvB;AAEA,SAAS,UAAU,OAAuB;AACxC,MAAI,OAAO;AACX,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,YAAQ,MAAM,WAAW,KAAK;AAC9B,WAAO,KAAK,KAAK,MAAM,QAAU;AAAA,EACnC;AACA,UAAQ,SAAS,GAAG,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,EAAE,MAAM,GAAG,CAAC;AAC9D;AA0CA,SAAS,8BAA8B,OAAuD;AAC5F,QAAM,SAAS,MAAM;AACrB,MAAI,CAAC,QAAQ,MAAM;AACjB,WAAO;AAAA,EACT;AACA,QAAM,WAAW,MAAM,QAAQ,2CAA2C;AAC1E,MAAI,UAAU,UAAU,SAAS,WAAW,UAAU;AACpD,WAAO;AAAA,EACT;AACA,MAAI,UAAU,aAAa,OAAO;AAChC,WAAO;AAAA,EACT;AACA,QAAM,SAAS,OAAO,SAAS;AAAA,IAC7B,CAAC,cAAc,UAAU,SAAS,qBAAqB,UAAU;AAAA,EACnE;AACA,QAAM,cAAc,SAAS,QAAQ,GAAG;AACxC,MAAI,CAAC,UAAU,CAAC,aAAa;AAC3B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,OAAO,WAAW;AAClC,QAAM,KAAK,2BAA2B,OAAO,MAAM,SAAS,WAAW;AACvE,QAAM,cAAc,SAAS,OAAO,UAAU,KAAK,SAAS,OAAO,YAAY,GAAG;AAClF,QAAM,kBAAkB,sBAAsB,MAAM;AACpD,QAAM,cAAc,yBAAyB,IAAI,CAAC,CAAC;AACnD,SAAO,sBAAsB,MAAM;AAAA,IACjC;AAAA,IACA,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,OAAO,SAAS,OAAO;AAAA,IAC7B,aAAa,OAAO,eAAe;AAAA,IACnC,UAAU;AAAA,IACV,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,gBAAgB,SAAS,CAAC,sBAAsB,IAAI,CAAC;AAAA,IAC3D;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,WAAW,gBAAgB,SAAS,mBAAmB;AAAA,IACvD,OAAO,CAAC,EAAE,MAAM,OAAO,IAAI,YAAY,CAAC;AAAA,IACxC,SAAS;AAAA,MACP,WAAW;AAAA,MACX;AAAA,MACA,WAAW;AAAA,MACX,OACE,gBAAgB,WAAW,IACvB,sDACA,0CAA0C,gBAAgB,KAAK,IAAI,CAAC;AAAA,IAC5E;AAAA,IACA,UAAU;AAAA,MACR,UAAU;AAAA,MACV,cAAc,OAAO;AAAA,MACrB;AAAA,MACA,WAAW,UAAU;AAAA,MACrB,UAAU,OAAO,YAAY,CAAC;AAAA,MAC9B;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,sBAAsB,QAAqC;AAClE,UAAQ,OAAO,WAAW,CAAC,GACxB,OAAO,CAAC,WAAW,OAAO,QAAQ,OAAO,eAAe,KAAK,EAC7D,IAAI,CAAC,WAAW,OAAO,KAAM,KAAK,CAAC,EACnC,OAAO,OAAO;AACnB;AAEA,SAAS,SAAS,OAA0C;AAC1D,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE,SAAS;AAAA,EACjC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,kBAAkB,MAAqC;AAC9D,SAAO;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,GAAG,KAAK;AAAA,IACR,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,UAAU,KAAK,QAAQ;AAAA,EAC9B,EACG,OAAO,OAAO,EACd,KAAK,GAAG,EACR,YAAY;AACjB;AAEA,SAAS,mCACP,MACA,cACS;AACT,MAAI,CAAC,gBAAgB,KAAK,SAAS,OAAO;AACxC,WAAO,CAAC,CAAC;AAAA,EACX;AACA,MAAI,CAAC,KAAK,QAAQ,WAAW;AAC3B,WAAO;AAAA,EACT;AACA,MAAI,CAAC,+BAA+B,MAAM,YAAY,GAAG;AACvD,WAAO;AAAA,EACT;AACA,QAAM,eAAe,aAAa,SAAS;AAC3C,SACE,CAAC,CAAC,gBACF,OAAO,iBAAiB,YACxB,YAAY,iBACX,aAAa,WAAW,QAAQ,aAAa,WAAW;AAE7D;AAMA,SAAS,+BACP,MACA,cACS;AACT,MAAI,oBAAoB,aAAa,MAAM,GAAG;AAC5C,WAAO;AAAA,EACT;AACA,QAAM,cAAc,IAAI;AAAA,KACrB,MAAM,QAAQ,aAAa,OAAO,WAAW,IAAI,aAAa,OAAO,cAAc,CAAC,GAClF,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ,EACzD,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC;AAAA,EACrC;AACA,QAAM,WAAW,0BAA0B,KAAK,QAAQ;AACxD,MAAI,SAAS,KAAK,CAAC,SAAS,CAAC,YAAY,IAAI,KAAK,YAAY,CAAC,CAAC,GAAG;AACjE,WAAO;AAAA,EACT;AACA,SAAO,CAAC,KAAK,aAAa,YAAY,OAAO;AAC/C;AAEA,SAAS,oBAAoB,QAA0C;AACrE,QAAM,MAAM,OAAO;AACnB,SACE,CAAC,CAAC,OACF,OAAO,QAAQ,YACf,CAAC,MAAM,QAAQ,GAAG,KAClB,OAAQ,IAAqC,mBAAmB;AAEpE;;;AG7+DA,SAAS,cAAAC,mBAAkB;AAE3B;AAAA,EACE,8BAAAC;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,iBAAAC,sBAAqB;AAmC9B,IAAM,gBAAgB;AACtB,IAAM,YAAY;AAClB,IAAM,yBAAyB;AAE/B,eAAsB,mBACpB,QACA,QAC8B;AAC9B,QAAM,SAAS,iBAAiB,MAAM;AACtC,QAAM,eAAe,MAAM,OAAO,cAAc,OAAO,OAAO,OAAO,YAAY,OAAO,GAAG;AAC3F,MAAI,CAAC,UAAU,KAAK,YAAY,GAAG;AACjC,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,2CAA2C,CAAC;AAAA,EACtF;AACA,QAAM,OAAO,MAAM,OAAO,SAAS,OAAO,OAAO,OAAO,YAAY,YAAY;AAChF,QAAM,aAAa,gBAAgB,QAAQ,IAAI;AAC/C,QAAM,UAAU,oBAAoB,MAAM,UAAU;AACpD,QAAM,gBAAgB,QAAQ,OAAO,CAAC,KAAK,UAAU,OAAO,MAAM,QAAQ,IAAI,CAAC;AAC/E,MAAI,QAAQ,SAAS,0BAA0B;AAC7C,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,4BAA4B,wBAAwB;AAAA,IAC/D,CAAC;AAAA,EACH;AACA,MAAI,gBAAgB,gCAAgC;AAClD,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,iBAAiB,8BAA8B;AAAA,IAC1D,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,MAAM,cAAc,SAAS,wBAAwB,OAAO,UAAU;AAClF,QAAI;AACJ,QAAI;AACF,gBAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE;AAAA,QAClD,MAAM,OAAO,SAAS,OAAO,OAAO,OAAO,YAAY,MAAM,GAAG;AAAA,MAClE;AAAA,IACF,QAAQ;AACN,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,uCAAuC,kBAAkB,MAAM,MAAM,UAAU,CAAC;AAAA,MAC3F,CAAC;AAAA,IACH;AACA,WAAO,EAAE,MAAM,kBAAkB,MAAM,MAAM,UAAU,GAAG,QAAQ;AAAA,EACpE,CAAC;AACD,MAAI;AACJ,MAAI;AACF,eAAWD,4BAA2B,KAAK;AAAA,EAC7C,SAAS,OAAO;AACd,UAAM,IAAIC,eAAc,KAAK;AAAA,MAC3B,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IACpD,CAAC;AAAA,EACH;AACA,QAAM,gBAAgB,sBAAsB,OAAO,KAAK,IAAI,OAAO,UAAU;AAC7E,QAAM,YACJ,eAAe,MACX,GAAG,aAAa,SAAS,YAAY,KACrC,GAAG,aAAa,SAAS,YAAY,IAAI,iBAAiB,UAAU,CAAC;AAC3E,QAAM,WAAqB,CAAC;AAC5B,MAAI,CAAC,SAAS,MAAM,KAAK,CAAC,SAAS,6BAA6B,KAAK,KAAK,IAAI,CAAC,GAAG;AAChF,aAAS,KAAK,6DAA6D;AAAA,EAC7E;AACA,QAAM,kBAAkB,SAAS,MAAM,OAAO,CAAC,SAAS,oBAAoB,KAAK,KAAK,IAAI,CAAC;AAC3F,MAAI,gBAAgB,SAAS,GAAG;AAC9B,aAAS;AAAA,MACP,GAAG,gBAAgB,MAAM,eAAe,gBAAgB,WAAW,IAAI,KAAK,GAAG;AAAA,IACjF;AAAA,EACF;AACA,SAAO;AAAA,IACL,SAAS;AAAA,MACP,QAAQ,OAAO;AAAA,MACf;AAAA,MACA;AAAA,MACA,OAAO,OAAO;AAAA,MACd,YAAY,OAAO;AAAA,MACnB;AAAA,MACA;AAAA,MACA,MAAM,SAAS;AAAA,MACf,aAAa,SAAS;AAAA,MACtB,eAAe,SAAS;AAAA,MACxB,YAAY,SAAS;AAAA,MACrB,OAAO,SAAS,MAAM,IAAI,CAAC,SAAS;AAClC,cAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,OAAO;AACnD,eAAO;AAAA,UACL,MAAM,KAAK;AAAA,UACX,UAAU,MAAM;AAAA,UAChB,eAAeC,WAAU,KAAK;AAAA,QAChC;AAAA,MACF,CAAC;AAAA,MACD;AAAA,MACA,WAAW;AAAA,MACX,qBAAqB;AAAA,IACvB;AAAA,IACA,OAAO,SAAS;AAAA,EAClB;AACF;AAEO,SAAS,uBACd,QACQ;AACR,SAAO,SAAS,OAAO,KAAK,IAAI,OAAO,UAAU,IAAI,OAAO,UAAU,GAAG,YAAY;AACvF;AAEO,SAAS,0BACd,QACQ;AACR,QAAM,WAAW,uBAAuB,MAAM;AAC9C,QAAM,SAASH,YAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC9E,SAAO,SAAS,OAAO,KAAK,YAAY,CAAC,IAAI,MAAM;AACrD;AAEO,SAAS,iBAAiB,QAAmC;AAClE,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,MAAM;AAAA,EACtB,QAAQ;AACN,UAAM,IAAIE,eAAc,KAAK,EAAE,SAAS,wCAAwC,CAAC;AAAA,EACnF;AACA,MAAI,IAAI,aAAa,YAAY,IAAI,YAAY,IAAI,YAAY,IAAI,MAAM;AACzE,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,WAAW,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,IAAI,kBAAkB;AAC/E,MAAI,IAAI,aAAa,eAAe,IAAI,aAAa,iBAAiB;AACpE,QAAI,SAAS,WAAW,GAAG;AACzB,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM,CAACE,QAAOC,aAAY,SAAS,IAAI;AACvC,2BAAuBD,QAAQC,WAAW;AAC1C,QAAI,CAAC,aAAa,CAAC,cAAc,KAAK,SAAS,GAAG;AAChD,YAAM,IAAIH,eAAc,KAAK,EAAE,SAAS,sCAAsC,CAAC;AAAA,IACjF;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAOE;AAAA,MACP,YAAY,eAAeC,WAAW;AAAA,MACtC,KAAK;AAAA,MACL,eAAe;AAAA,MACf;AAAA,MACA,UAAU,IAAI,SAAS;AAAA,IACzB;AAAA,EACF;AACA,MAAI,IAAI,aAAa,gBAAgB,IAAI,aAAa,kBAAkB;AACtE,UAAM,IAAIH,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,0CAA0C,CAAC;AAAA,EACrF;AACA,QAAM,QAAQ,SAAS,CAAC;AACxB,QAAM,aAAa,eAAe,SAAS,CAAC,CAAE;AAC9C,yBAAuB,OAAO,UAAU;AACxC,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,KAAK;AAAA,MACL,eAAe;AAAA,MACf,WAAW;AAAA,MACX,UAAU,IAAI,SAAS;AAAA,IACzB;AAAA,EACF;AACA,QAAM,OAAO,SAAS,CAAC;AACvB,MAAI,SAAS,UAAU,SAAS,QAAQ;AACtC,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,MAAM,SAAS,CAAC;AACtB,MAAI,CAAC,IAAK,OAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,uCAAuC,CAAC;AAC1F,QAAM,eAAe,SAAS,MAAM,CAAC;AACrC,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,2CAA2C,CAAC;AAAA,EACtF;AACA,QAAM,gBAAgB;AAAA,IACpB,SAAS,UAAU,aAAa,GAAG,EAAE,GAAG,YAAY,MAAM,aACtD,aAAa,MAAM,GAAG,EAAE,IACxB;AAAA,EACN;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX,UAAU,IAAI,SAAS;AAAA,EACzB;AACF;AAEA,SAAS,gBAAgB,QAA2B,MAA+C;AACjG,QAAM,aAAa,KAChB;AAAA,IACC,CAAC,UACC,MAAM,SAAS,UACf,MAAM,SAAS,aACd,MAAM,SAAS,cAAc,MAAM,KAAK,SAAS,WAAW;AAAA,EACjE,EACC,IAAI,CAAC,UAAU,MAAM,KAAK,MAAM,GAAG,CAAC,YAAY,MAAM,KAAK,GAAG,EAC9D,KAAK;AACR,MAAI,OAAO,eAAe;AACxB,UAAM,OAAO,OAAO;AACpB,QAAI,CAAC,WAAW,SAAS,IAAI,GAAG;AAC9B,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,sCAAsC,IAAI;AAAA,MACrD,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AACA,QAAM,aAAa,OAAO,YACtB,WAAW,OAAO,CAAC,SAAS,KAAK,MAAM,GAAG,EAAE,GAAG,EAAE,MAAM,OAAO,SAAS,IACvE;AACJ,MAAI,WAAW,WAAW,GAAG;AAC3B,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,0CAA0C,CAAC;AAAA,EACrF;AACA,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO,WAAW,CAAC;AACrB;AAEA,SAAS,oBACP,MACA,MACwB;AACxB,QAAM,SAAS,SAAS,MAAM,KAAK,GAAG,IAAI;AAC1C,QAAM,SAAS,KAAK,OAAO,CAAC,UAAU,MAAM,KAAK,WAAW,MAAM,CAAC;AACnE,QAAM,cAAc,OAAO;AAAA,IACzB,CAAC,UAAU,MAAM,SAAS,YAAa,MAAM,SAAS,UAAU,MAAM,SAAS;AAAA,EACjF;AACA,MAAI,aAAa;AACf,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,+DAA+D,YAAY,IAAI;AAAA,IAC1F,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,OACX,OAAO,CAAC,UAAU,MAAM,SAAS,MAAM,EACvC,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;AAC5D,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,qCAAqC,CAAC;AAAA,EAChF;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAAc,MAAsB;AAC7D,SAAO,SAAS,MAAM,OAAO,KAAK,MAAM,KAAK,SAAS,CAAC;AACzD;AAEA,SAAS,oBAAoB,UAAqC;AAChE,MACE,SAAS,WAAW,KACpB,SAAS;AAAA,IACP,CAAC,YACC,QAAQ,WAAW,KACnB,YAAY,OACZ,YAAY,QACZ,QAAQ,SAAS,IAAI,KACrB,yBAAyB,KAAK,OAAO;AAAA,EACzC,GACA;AACA,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,mCAAmC,CAAC;AAAA,EAC9E;AACA,SAAO,SAAS,KAAK,GAAG;AAC1B;AAEA,SAAS,iBAAiB,MAAsB;AAC9C,SAAO,KACJ,MAAM,GAAG,EACT,IAAI,CAAC,YAAY,mBAAmB,OAAO,CAAC,EAC5C,KAAK,GAAG;AACb;AAEA,SAAS,eAAe,OAAuB;AAC7C,SAAO,MAAM,QAAQ,YAAY,EAAE;AACrC;AAEA,SAAS,uBAAuB,OAAe,YAA0B;AACvE,MAAI,CAAC,cAAc,KAAK,KAAK,KAAK,CAAC,cAAc,KAAK,eAAe,UAAU,CAAC,GAAG;AACjF,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,iDAAiD,CAAC;AAAA,EAC5F;AACF;AAEA,eAAe,cACb,QACA,aACA,KACmB;AACnB,QAAM,SAAS,IAAI,MAAc,OAAO,MAAM;AAC9C,MAAI,OAAO;AACX,QAAM,QAAQ;AAAA,IACZ,MAAM,KAAK,EAAE,QAAQ,KAAK,IAAI,aAAa,OAAO,MAAM,EAAE,GAAG,YAAY;AACvE,iBAAS;AACP,cAAM,QAAQ;AACd,gBAAQ;AACR,YAAI,SAAS,OAAO,OAAQ;AAC5B,eAAO,KAAK,IAAI,MAAM,IAAI,OAAO,KAAK,CAAE;AAAA,MAC1C;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,SAASC,WAAU,OAA2B;AAC5C,SAAOH,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;;;AC7VA,SAAS,kCAAAM,uCAAqD;AAE9D,SAAS,kBAAAC,iBAAgB,wBAAuC;AAChE,SAAS,iBAAAC,sBAAqB;AAGvB,IAAM,iCAAiC;AACvC,IAAM,gCAAgC;AAM7C,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,mBAAmB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,qCAAqC,MAAoB;AACvE,MAAI,mBAAmB,IAAI,IAAI,KAAK,iBAAiB,KAAK,CAAC,WAAW,KAAK,WAAW,MAAM,CAAC,GAAG;AAC9F,UAAM,IAAIC,eAAc,KAAK;AAAA,MAC3B,SAAS,6EAA6E,IAAI;AAAA,IAC5F,CAAC;AAAA,EACH;AACF;AAGO,IAAM,uCAAuC;AAE7C,SAAS,6BAA6B,UAAgC;AAC3E,QAAM,MAAMC,gCAA+B,QAAQ;AACnD,MAAI,CAAC,KAAK;AACR,UAAM,IAAID,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAGO,IAAM,+BAA+B;AAE5C,eAAsB,yBACpB,IACA,aACA,eACsB;AACtB,QAAM,cAAc,MAAME,gBAAe,IAAI,aAAa,aAAa;AACvE,MAAI,CAAC,aAAa;AAChB,UAAM,IAAIF,eAAc,KAAK,EAAE,SAAS,wBAAwB,CAAC;AAAA,EACnE;AACA,SAAO;AACT;AAWA,eAAsB,8BACpB,MACA,OACA,aACA,eACA,UAAuC,CAAC,GAClB;AACtB,+BAA6B,KAAK,QAAQ;AAC1C,MAAI,CAAC,QAAQ,eAAe;AAC1B,sBAAkB,OAAO,mBAAmB;AAAA,EAC9C;AACA,QAAM,cAAc,MAAME,gBAAe,KAAK,IAAI,aAAa,aAAa;AAC5E,MAAI,CAAC,aAAa;AAChB,UAAM,IAAIF,eAAc,KAAK,EAAE,SAAS,wBAAwB,CAAC;AAAA,EACnE;AACA,SAAO;AACT;AAEA,eAAsB,4BACpB,IACA,OAWe;AACf,QAAM,iBAAiB,IAAI;AAAA,IACzB,WAAW,MAAM,MAAM;AAAA,IACvB,aAAa,MAAM,MAAM;AAAA,IACzB,WAAW,MAAM,MAAM;AAAA,IACvB,QAAQ,MAAM;AAAA,IACd,YAAY;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB,UAAU;AAAA,MACR,eAAe,MAAM;AAAA,MACrB,GAAI,MAAM,eAAe,EAAE,MAAM,MAAM,aAAa,IAAI,CAAC;AAAA,IAC3D;AAAA,EACF,CAAC;AACH;;;ACtHA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAAG;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,kBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,iBAAAC,sBAAqB;;;ACrC9B,SAAS,cAAAC,mBAAkB;AAC3B;AAAA,EACE,oBAAoB;AAAA,EACpB,cAAAC;AAAA,OAMK;AAOP,SAAS,OAAO,OAAuB;AACrC,SAAO,UAAUD,YAAW,QAAQ,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO,KAAK,CAAC;AAC3E;AAEO,SAAS,uCAAuC,YAA4B;AACjF,SAAO,OAAO,UAAU;AAC1B;AAEO,SAAS,0BACd,YACQ;AACR,SAAO,OAAO,WAAW,eAAe,EAAE;AAC5C;AASO,SAAS,4BAA4B,OAIjC;AACT,SAAO;AAAA,IACLC,YAAW;AAAA,MACT,SAAS;AAAA,MACT,SAAS,MAAM;AAAA,MACf,aAAa,MAAM;AAAA,MACnB,OAAO,MAAM,WAAW;AAAA,MACxB,aAAa,MAAM,WAAW;AAAA,MAC9B,QAAQ,MAAM,WAAW;AAAA,MACzB,iBAAiB,MAAM,WAAW;AAAA,MAClC,uBAAuB,MAAM,WAAW;AAAA,IAC1C,CAAC;AAAA,EACH;AACF;AAIO,SAAS,+BAA+B,OAIpC;AACT,QAAM,QAAQD,YAAW,QAAQ,EAC9B,OAAO,0CAA0C,MAAM,EACvD,OAAO,MAAM,UAAU,MAAM,EAC7B,OAAO,MAAM,MAAM,EACnB,OAAO,MAAM,SAAS,MAAM,EAC5B,OAAO,MAAM,MAAM,EACnB,OAAO,MAAM,aAAa,MAAM,EAChC,OAAO,EACP,SAAS,GAAG,EAAE;AAGjB,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,MAAM,MAAM,SAAS,KAAK;AAChC,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AAC1G;AAEO,SAAS,kCACd,OACA,YACS;AACT,SACE,MAAM,cAAc,0BAA0B,UAAU,KACxD,MAAM,gBACJ,4BAA4B;AAAA,IAC1B,SAAS,MAAM;AAAA,IACf,aAAa,MAAM;AAAA,IACnB;AAAA,EACF,CAAC;AAEP;AAQO,SAAS,kCACd,cACA,YACmB;AACnB,QAAM,SAAS,yBAAyB,UAAU,cAAc,aAAa;AAC7E,MAAI,CAAC,OAAO,WAAW,OAAO,KAAK,WAAW,WAAY,QAAO,CAAC;AAClE,MAAI,CAAC,kCAAkC,OAAO,MAAM,UAAU,EAAG,QAAO,CAAC;AACzE,SAAO,EAAE,CAAC,OAAO,KAAK,OAAO,GAAG,OAAO,KAAK;AAC9C;;;ADnEO,IAAM,yBAAyB;AAC/B,IAAM,qBAAqB;AAC3B,IAAM,+BAA+B;AACrC,IAAM,oCAAoC;AAqBjD,eAAsB,oBACpB,IACA,OAMe;AACf,QAAME,kBAAiB,IAAI;AAAA,IACzB,WAAW,MAAM,MAAM;AAAA,IACvB,aAAa,MAAM,MAAM;AAAA,IACzB,WAAW,MAAM,MAAM;AAAA,IACvB,QAAQ,MAAM;AAAA,IACd,YAAY;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB,UAAU,EAAE,OAAO,MAAM,OAAO,GAAI,MAAM,YAAY,CAAC,EAAG;AAAA,EAC5D,CAAC;AACH;AAIO,SAAS,iBAAiB,OAA4B;AAC3D,SAAO,QAAQ,MAAM,SAAS;AAChC;AAEA,eAAsB,iBACpB,IACA,aACA,OACc;AACd,QAAM,MAAM,MAAMC,QAAO,IAAI,aAAa,KAAK;AAC/C,MAAI,CAAC,KAAK;AACR,UAAM,IAAIC,eAAc,KAAK,EAAE,SAAS,gBAAgB,CAAC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,eAAsB,uBACpB,IACA,aACA,OACA,UACoB;AACpB,QAAM,SAAS,MAAM,aAAa,IAAI,aAAa,QAAQ;AAG3D,MAAI,CAAC,UAAU,OAAO,UAAU,OAAO;AACrC,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;AAAA,EAClE;AACA,SAAO;AACT;AAEA,SAAS,eAAe,MAAsB;AAC5C,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;AAAA,EAClE;AACA,SAAO;AACT;AAGA,SAAS,uBAAuB,QAA2D;AACzF,MAAI,CAAC,QAAQ;AACX;AAAA,EACF;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,SAAS,QAAQ;AAC1B,QAAI,KAAK,IAAI,MAAM,IAAI,GAAG;AACxB,YAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,6BAA6B,MAAM,IAAI,GAAG,CAAC;AAAA,IACrF;AACA,SAAK,IAAI,MAAM,IAAI;AAAA,EACrB;AACF;AAIA,eAAe,wBACb,IACA,aACA,KACe;AACf,MAAI,CAAC,OAAO,IAAI,WAAW,GAAG;AAC5B;AAAA,EACF;AACA,QAAM,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC;AAC/B,aAAW,MAAM,QAAQ;AACvB,UAAM,cAAc,MAAMC,gBAAe,IAAI,aAAa,EAAE;AAC5D,QAAI,CAAC,aAAa;AAChB,YAAM,IAAID,eAAc,KAAK,EAAE,SAAS,iCAAiC,EAAE,GAAG,CAAC;AAAA,IACjF;AAAA,EACF;AACF;AAEA,eAAsB,gBACpB,MACA,OACA,SACc;AACd,QAAM,cAAc,MAAM;AAC1B,QAAM,OAAO,eAAe,QAAQ,IAAI;AACxC,yBAAuB,QAAQ,MAAM;AACrC,QAAM,wBAAwB,KAAK,IAAI,aAAa,QAAQ,qBAAqB;AACjF,MAAK,MAAM,UAAU,KAAK,IAAI,WAAW,KAAM,wBAAwB;AACrE,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,gCAAgC,sBAAsB;AAAA,IACjE,CAAC;AAAA,EACH;AACA,MAAI,MAAM,aAAa,KAAK,IAAI,aAAa,IAAI,GAAG;AAClD,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,+BAA+B,IAAI,GAAG,CAAC;AAAA,EACjF;AACA,QAAM,YAAY,iBAAiB,KAAK;AACxC,QAAM,MAAM,MAAM,UAAU,KAAK,IAAI;AAAA,IACnC,WAAW,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,aAAa,QAAQ,eAAe;AAAA,IACpC;AAAA,IACA,gBAAgB;AAAA,MACd,OAAO,QAAQ,SAAS;AAAA,MACxB,aAAa,QAAQ,eAAe;AAAA,MACpC,QAAQ,QAAQ;AAAA,MAChB,iBAAiB,QAAQ;AAAA,MACzB,uBAAuB,QAAQ;AAAA,MAC/B,WAAW;AAAA,MACX;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,oBAAoB,KAAK,IAAI,EAAE,OAAO,QAAQ,eAAe,OAAO,IAAI,GAAG,CAAC;AAClF,SAAO;AACT;AAEA,eAAsB,gBACpB,MACA,OACA,KACA,SACc;AACd,QAAM,cAAc,MAAM;AAC1B,QAAM,OAAO,QAAQ,SAAS,SAAY,eAAe,QAAQ,IAAI,IAAI;AACzE,MAAI,SAAS,UAAa,SAAS,IAAI,MAAM;AAC3C,UAAM,WAAW,MAAM,aAAa,KAAK,IAAI,aAAa,IAAI;AAC9D,QAAI,YAAY,SAAS,OAAO,IAAI,IAAI;AACtC,YAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,+BAA+B,IAAI,GAAG,CAAC;AAAA,IACjF;AAAA,EACF;AACA,QAAM,UAAU,MAAM,UAAU,KAAK,IAAI,aAAa,IAAI,IAAI;AAAA,IAC5D,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,QAAQ,gBAAgB,SAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EAClF,CAAC;AACD,QAAM,oBAAoB,KAAK,IAAI,EAAE,OAAO,QAAQ,eAAe,OAAO,IAAI,GAAG,CAAC;AAClF,SAAO;AACT;AAEA,eAAsB,gBACpB,MACA,OACA,KACe;AACf,QAAM,cAAc,MAAM;AAC1B,QAAM,UAAU,MAAM,4BAA4B,KAAK,IAAI,aAAa,IAAI,EAAE;AAC9E,MAAI,QAAQ,qBAAqB,GAAG;AAClC,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,wBAAwB,QAAQ,kBAAkB;AAAA,IAC7D,CAAC;AAAA,EACH;AACA,MAAI,CAAC,QAAQ,SAAS;AACpB,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,gBAAgB,CAAC;AAAA,EAC3D;AACA,QAAM,oBAAoB,KAAK,IAAI,EAAE,OAAO,QAAQ,eAAe,OAAO,IAAI,GAAG,CAAC;AACpF;AAMA,eAAsB,uBACpB,MACA,OACA,KACA,SACA,UAAmC,CAAC,GAChB;AACpB,QAAM,cAAc,MAAM;AAC1B,MAAI,CAAC,IAAI,eAAe;AACtB,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,gDAAgD,CAAC;AAAA,EAC3F;AACA,MAAI,QAAQ,SAAS,mBAAmB;AACtC,2BAAuB,QAAQ,QAAQ,MAAM;AAC7C,UAAM;AAAA,MACJ,KAAK;AAAA,MACL;AAAA,MACA,QAAQ,QAAQ,yBAAyB;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,SAAS,MAAM,gBAAgB,KAAK,IAAI;AAAA,IAC5C,WAAW,MAAM;AAAA,IACjB;AAAA,IACA,OAAO,IAAI;AAAA,IACX,eAAe,IAAI,cAAc;AAAA,IACjC,MAAM,QAAQ;AAAA,IACd,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ,cAAc,iBAAiB,KAAK;AAAA,EAC1D,CAAC;AACD,QAAM,oBAAoB,KAAK,IAAI;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,OAAO,IAAI;AAAA,IACX,UAAU,EAAE,UAAU,OAAO,IAAI,MAAM,OAAO,KAAK;AAAA,EACrD,CAAC;AACD,SAAO;AACT;AAQO,SAAS,+BAA+B,OAIb;AAChC,MAAI,MAAM,YAAY;AACpB,WAAO,EAAE,QAAQ,UAAU,QAAQ,oBAAoB;AAAA,EACzD;AACA,MAAI,CAAC,MAAM,QAAQ;AACjB,WAAO,EAAE,QAAQ,YAAY,QAAQ,SAAS;AAAA,EAChD;AACA,MAAI,MAAM,SAAS,gBAAgB;AACjC,WAAO,EAAE,QAAQ,UAAU,QAAQ,eAAe;AAAA,EACpD;AACA,SAAO,EAAE,QAAQ,YAAY,QAAQ,uBAAuB;AAC9D;AAEO,SAAS,sBACd,iBACA,SACQ;AACR,QAAM,QAAQ,mBAAmB,IAAI,QAAQ;AAC7C,SAAO,OAAO,GAAG,IAAI;AAAA,EAAK,OAAO,KAAK;AACxC;AAEA,eAAe,2BACb,MACA,aACA,OACA,UACA,OACqD;AACrD,MAAI;AACF,WAAO,MAAM,mCAAmC,KAAK,IAAI,aAAa,OAAO,UAAU,KAAK;AAAA,EAC9F,SAAS,OAAO;AACd,QAAI,iBAAiB,8BAA8B;AACjD,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,kDAAkD,MAAM,iBAAiB,SAAS,MAAM,mBAAmB,MAAM;AAAA,MAC5H,CAAC;AAAA,IACH;AACA,QAAI,iBAAiB,0BAA0B;AAC7C,YAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,IACzD;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,yBACpB,MACA,OACA,KACA,QACqD;AACrD,MAAI,OAAO,SAAS,gBAAgB;AAClC,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,OAAO,WAAW,cAAc,OAAO,WAAW,aAAa;AACjE,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,iBAAiB,OAAO,MAAM,mBAAmB,CAAC;AAAA,EAC5F;AACA,MAAI,CAAC,OAAO,eAAe;AACzB,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,iCAAiC,CAAC;AAAA,EAC5E;AACA,QAAM,OAAO,MAAM,cAAc,KAAK,IAAI,MAAM,aAAa,IAAI,IAAI,OAAO,aAAa;AACzF,MAAI,CAAC,MAAM;AACT,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,6BAA6B,CAAC;AAAA,EACxE;AACA,QAAM,UAAU,OAAO;AACvB,MAAI,OAAO,QAAQ,YAAY,YAAY,CAAC,QAAQ,QAAQ,KAAK,GAAG;AAClE,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,yCAAyC,CAAC;AAAA,EACpF;AACA,QAAM,iBAAiB;AAAA,IACrB,OAAO,KAAK;AAAA,IACZ,aAAa,sBAAsB,KAAK,aAAa,QAAQ,OAAO;AAAA,IACpE,QAAQ,KAAK;AAAA,IACb,iBAAiB,KAAK;AAAA,IACtB,uBAAuB,KAAK;AAAA,EAC9B;AACA,QAAM,EAAE,SAAS,QAAQ,QAAQ,IAAI,MAAM;AAAA,IACzC;AAAA,IACA,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,OAAO;AAAA,IACP;AAAA,MACE,yBAAyB,OAAO;AAAA,MAChC,GAAG;AAAA,MACH,WACE,OAAO,QAAQ,SAAS,YAAY,QAAQ,KAAK,KAAK,IAClD,QAAQ,OACR;AAAA,MACN,WAAW,OAAO,cAAc,iBAAiB,KAAK;AAAA,MACtD,gBAAgB,kCAAkC,OAAO,cAAc,cAAc;AAAA,IACvF;AAAA,EACF;AACA,QAAM,oBAAoB,KAAK,IAAI;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,OAAO,IAAI;AAAA,IACX,UAAU,EAAE,UAAU,OAAO,IAAI,WAAW,QAAQ,IAAI,SAAS,QAAQ,QAAQ;AAAA,EACnF,CAAC;AACD,QAAM,oBAAoB,KAAK,IAAI;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,OAAO,IAAI;AAAA,IACX,UAAU,EAAE,UAAU,OAAO,IAAI,WAAW,QAAQ,IAAI,SAAS,QAAQ,QAAQ;AAAA,EACnF,CAAC;AACD,SAAO,EAAE,QAAQ,SAAS,QAAQ;AACpC;AAEA,eAAsB,0CACpB,MACA,OACA,KACA,QACqD;AACrD,MAAI,OAAO,SAAS,mBAAmB;AACrC,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,oDAAoD,CAAC;AAAA,EAC/F;AACA,MAAI,OAAO,WAAW,YAAY;AAChC,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,iBAAiB,OAAO,MAAM,mBAAmB,CAAC;AAAA,EAC5F;AACA,MAAI,OAAO,cAAc,WAAW,MAAM;AACxC,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,OAAO,eAAe;AACzB,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,iCAAiC,CAAC;AAAA,EAC5E;AACA,QAAM,OAAO,MAAM,cAAc,KAAK,IAAI,MAAM,aAAa,IAAI,IAAI,OAAO,aAAa;AACzF,MAAI,CAAC,MAAM;AACT,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,6BAA6B,CAAC;AAAA,EACxE;AACA,QAAM,UAAU,OAAO;AAQvB,QAAM,iBAAiB;AAAA,IACrB,OAAO,QAAQ,UAAU,SAAY,KAAK,QAAS,QAAQ;AAAA,IAC3D,aACE,QAAQ,gBAAgB,SAAY,KAAK,cAAe,QAAQ;AAAA,IAClE,QAAQ,MAAM,QAAQ,QAAQ,MAAM,IAAK,QAAQ,SAAkC,KAAK;AAAA,IACxF,iBAAiB,MAAM,QAAQ,QAAQ,eAAe,IACjD,QAAQ,kBACT,KAAK;AAAA,IACT,uBAAuB,MAAM,QAAQ,QAAQ,qBAAqB,IAC7D,QAAQ,wBACT,KAAK;AAAA,EACX;AACA,QAAM,EAAE,SAAS,QAAQ,QAAQ,IAAI,MAAM;AAAA,IACzC;AAAA,IACA,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,OAAO;AAAA,IACP;AAAA,MACE,yBAAyB,OAAO;AAAA,MAChC,GAAG;AAAA,MACH,WACE,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAC5D,QAAQ,YACR;AAAA,MACN,WAAW,iBAAiB,KAAK;AAAA,MACjC,gBAAgB,kCAAkC,OAAO,cAAc,cAAc;AAAA,IACvF;AAAA,EACF;AACA,QAAM,oBAAoB,KAAK,IAAI;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,OAAO,IAAI;AAAA,IACX,UAAU,EAAE,UAAU,OAAO,IAAI,WAAW,QAAQ,IAAI,SAAS,QAAQ,QAAQ;AAAA,EACnF,CAAC;AACD,QAAM,oBAAoB,KAAK,IAAI;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,OAAO,IAAI;AAAA,IACX,UAAU,EAAE,UAAU,OAAO,IAAI,WAAW,QAAQ,IAAI,SAAS,QAAQ,QAAQ;AAAA,EACnF,CAAC;AACD,SAAO,EAAE,QAAQ,SAAS,QAAQ;AACpC;AAEA,eAAsB,uBACpB,MACA,OACA,KACA,SACqB;AACrB,MAAI,CAAC,IAAI,eAAe;AACtB,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,4BAA4B,CAAC;AAAA,EACvE;AACA,yBAAuB,QAAQ,MAAM;AACrC,QAAM;AAAA,IACJ,KAAK;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,yBAAyB;AAAA,EACnC;AACA,QAAM,OAAO,IAAI;AACjB,QAAM,UAAU,MAAM;AAAA,IACpB,KAAK;AAAA,IACL,MAAM;AAAA,IACN,IAAI;AAAA,IACJ;AAAA,MACE,OAAO,QAAQ,UAAU,SAAY,KAAK,QAAQ,QAAQ;AAAA,MAC1D,aAAa,QAAQ,gBAAgB,SAAY,KAAK,cAAc,QAAQ;AAAA,MAC5E,QAAQ,QAAQ,UAAU,KAAK;AAAA,MAC/B,iBAAiB,QAAQ,mBAAmB,KAAK;AAAA,MACjD,uBAAuB,QAAQ,yBAAyB,KAAK;AAAA,MAC7D,WAAW,QAAQ,aAAa;AAAA,MAChC,WAAW,iBAAiB,KAAK;AAAA,IACnC;AAAA,IACA,EAAE,UAAU,KAAK;AAAA,EACnB;AACA,QAAM,oBAAoB,KAAK,IAAI;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,OAAO,IAAI;AAAA,IACX,UAAU,EAAE,WAAW,QAAQ,IAAI,SAAS,QAAQ,SAAS,QAAQ,KAAK;AAAA,EAC5E,CAAC;AACD,SAAO;AACT;AAIA,eAAsB,yBACpB,MACA,OACA,KACA,WACqB;AACrB,QAAM,cAAc,MAAM;AAC1B,QAAM,UAAU,MAAM,mBAAmB,KAAK,IAAI,aAAa,IAAI,IAAI,SAAS;AAChF,QAAM,oBAAoB,KAAK,IAAI;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,OAAO,IAAI;AAAA,IACX,UAAU,EAAE,WAAW,QAAQ,IAAI,SAAS,QAAQ,QAAQ;AAAA,EAC9D,CAAC;AACD,SAAO;AACT;AAIA,eAAsB,sBACpB,MACA,aACA,OACuB;AACvB,SAAO,MAAM,gBAAgB,KAAK,IAAI,aAAa,KAAK;AAC1D;AAEA,eAAsB,qBACpB,MACA,aACA,OACA,OACsB;AACtB,SAAO,MAAM,eAAe,KAAK,IAAI,aAAa,OAAO,KAAK;AAChE;;;AEzhBA;AAAA,EACE;AAAA,EACA,yBAAAE;AAAA,EACA;AAAA,EACA,qBAAAC;AAAA,EACA,2BAAAC;AAAA,EACA,yBAAAC;AAAA,OAIK;AAYA,SAAS,kCACd,MACoB;AACpB,MAAK,KAAK,WAAW,UAAU,KAAK,WAAW,SAAU,KAAK,UAAU,SAAS,WAAW;AAC1F,WAAO;AAAA,EACT;AACA,SAAO,CAAC,OAAO,gBAAgB,mBAAmB,UAAU,EAAE;AAAA,IAAK,CAAC,QAClE,OAAO,UAAU,eAAe,KAAK,KAAK,kBAAkB,GAAG;AAAA,EACjE,IACI,SACA,KAAK,UAAU;AACrB;AAEO,SAAS,2CACd,OACoC;AACpC,QAAM,kBAAkB,MAAM,WAAW,WAAW;AACpD,QAAM,eAAe,MAAM,WAAW,QAAQ;AAC9C,MAAI,OAAO,oBAAoB,YAAY,OAAO,iBAAiB,UAAU;AAC3E,WAAO,EAAE,MAAM,QAAQ,WAAW,iBAAiB,QAAQ,aAAa;AAAA,EAC1E;AACA,MACE,MAAM,kBAAkB,mBACxB,MAAM,kBAAkB,aACxB,MAAM,kBACN;AACA,WAAO,EAAE,MAAM,OAAO;AAAA,EACxB;AACA,SAAO,EAAE,MAAM,WAAW,WAAW,MAAM,UAAU;AACvD;AAEA,eAAsB,oCAAoC,OAIhB;AACxC,QAAM,YAAY,MAAMA;AAAA,IACtB,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,IACZ,MAAM,SAAS;AAAA,IACf;AAAA,EACF;AACA,QAAM,SAAS,2CAA2C,MAAM,KAAK;AACrE,MAAI,OAAO,SAAS;AAClB,WAAO,UAAU,IAAI,CAAC,gBAAgB,EAAE,YAAY,WAAW,KAAK,EAAE;AACxE,MAAI,OAAO,SAAS,WAAW;AAC7B,UAAM,UAAU,MAAMA;AAAA,MACpB,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,MAAM,SAAS;AAAA,MACf,OAAO;AAAA,IACT;AACA,WAAO,QAAQ,IAAI,CAAC,gBAAgB;AAAA,MAClC;AAAA,MACA,WAAW,WAAW,cAAc,aAAa,OAAO,YAAY;AAAA,IACtE,EAAE;AAAA,EACJ;AACA,QAAM,eACJ,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,IACZ,OAAO;AAAA,IACP,OAAO;AAAA,EACT,GACA,OAAO,CAAC,SAAS,KAAK,mBAAmB,QAAQ;AACnD,QAAM,WAAyC,CAAC;AAChD,aAAW,cAAc,aAAa;AACpC,QAAI,CAAE,MAAMF,mBAAkB,MAAM,IAAI,WAAW,gBAAgB,MAAM,MAAM,WAAW;AACxF;AACF,UAAM,aAAa,MAAM;AAAA,MACvB,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AACA,QAAI,CAAC,cAAc,WAAW,cAAc,WAAY;AACxD,UAAM,SAAS,WAAW,aAAa,MAAM,UAAU,GAAG,WAAW,QAAQ;AAC7E,QAAI,CAAC,mBAAmB,QAAQ,WAAW,cAAc,EAAG;AAC5D,aAAS,KAAK,EAAE,YAAY,WAAW,WAAW,eAAe,CAAC;AAAA,EACpE;AACA,SAAO,CAAC,GAAG,UAAU,IAAI,CAAC,gBAAgB,EAAE,YAAY,WAAW,KAAK,EAAE,GAAG,GAAG,QAAQ;AAC1F;AAEA,eAAsB,uCAAuC,OAGhB;AAC3C,QAAM,aAAa,MAAMC,yBAAwB,MAAM,IAAI,MAAM,MAAM,aAAa,IAAI,GAAG;AAAA,IACzF,CAAC,eACC,WAAW,cAAc,QACzB,WAAW,WAAW,YACtB,mBAAmB,WAAW,gBAAgB,mBAAmB;AAAA,EACrE;AACA,QAAM,SAAS,2CAA2C,MAAM,KAAK;AACrE,MAAI,OAAO,SAAS,QAAQ;AAC1B,WAAO,UAAU,IAAI,CAAC,gBAAgB,EAAE,YAAY,WAAW,KAAK,EAAE;AAAA,EACxE;AACA,MAAI,OAAO,SAAS,WAAW;AAC7B,UAAM,UAAU,MAAMA;AAAA,MACpB,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,OAAO;AAAA,IACT;AACA,WAAO,QACJ;AAAA,MACC,CAAC,eACC,WAAW,WAAW,YACtB,mBAAmB,WAAW,gBAAgB,mBAAmB;AAAA,IACrE,EACC,IAAI,CAAC,gBAAgB;AAAA,MACpB;AAAA,MACA,WAAW,WAAW,cAAc,OAAO,OAAO,OAAO;AAAA,IAC3D,EAAE;AAAA,EACN;AACA,QAAM,eACJ,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,IACZ,OAAO;AAAA,IACP,OAAO;AAAA,EACT,GACA,OAAO,CAAC,SAAS,KAAK,mBAAmB,WAAW;AACtD,QAAM,WAA4C,CAAC;AACnD,aAAW,cAAc,aAAa;AACpC,QAAI,CAAE,MAAMD,mBAAkB,MAAM,IAAI,WAAW,gBAAgB,MAAM,MAAM,WAAW,GAAI;AAC5F;AAAA,IACF;AACA,UAAM,aAAa,MAAMD;AAAA,MACvB,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AACA,QACE,CAAC,cACD,WAAW,cAAc,WAAW,kBACpC,WAAW,WAAW,YACtB,CAAC,mBAAmB,WAAW,gBAAgB,WAAW,cAAc,KACxE,CAAC,mBAAmB,WAAW,gBAAgB,mBAAmB,GAClE;AACA;AAAA,IACF;AACA,aAAS,KAAK,EAAE,YAAY,WAAW,WAAW,eAAe,CAAC;AAAA,EACpE;AACA,SAAO,CAAC,GAAG,UAAU,IAAI,CAAC,gBAAgB,EAAE,YAAY,WAAW,KAAK,EAAE,GAAG,GAAG,QAAQ;AAC1F;AAEO,SAAS,kCACd,UACA,OACmB;AACnB,QAAM,WAAW,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AACrD,SAAO,SAAS,WAAW;AAAA,IACzB,CAAC,WAAW,SAAS,IAAI,OAAO,EAAE,KAAK,OAAO,eAAe,iBAAiB;AAAA,EAChF;AACF;AAEA,SAAS,6BAA6B,aAAyD;AAC7F,SAAO,CAAC,GAAG,WAAW,EAAE,KAAK,CAAC,MAAM,UAAU;AAC5C,UAAM,SAAS,OAAO,MAAM,WAAW,QAAQ,IAAI,OAAO,KAAK,WAAW,QAAQ;AAClF,QAAI,WAAW,EAAG,QAAO;AACzB,UAAM,UAAU,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,MAAM,KAAK,SAAS;AACvE,QAAI,YAAY,EAAG,QAAO;AAC1B,UAAM,UAAU,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,MAAM,KAAK,SAAS;AACvE,QAAI,YAAY,EAAG,QAAO;AAC1B,WAAO,MAAM,GAAG,cAAc,KAAK,EAAE;AAAA,EACvC,CAAC;AACH;AAEA,SAAS,mBAAmB,MAAc,OAAwB;AAChE,SAAO,KAAK,YAAY,MAAM,MAAM,YAAY;AAClD;AAEO,SAAS,oDAAoD,OAI9B;AACpC,QAAM,cAAiD,CAAC;AACxD,QAAM,cAAc,6BAA6B,MAAM,WAAW;AAClE,aAAW,UAAU,MAAM,SAAS;AAClC,UAAM,MAAM,OAAO;AACnB,QAAI,CAAC,OAAO,IAAI,iBAAiB,UAAW;AAC5C,UAAM,aAAa,YAAY;AAAA,MAC7B,CAAC,cACC,UAAU,cAAc,MAAM,aAC9B,UAAU,WAAW,YACrB,mBAAmB,UAAU,gBAAgB,IAAI,cAAc,MAC9D,CAAC,IAAI,QAAQ,UAAU,SAAS,IAAI,UACpC,CAAC,IAAI,gBAAgB,UAAU,OAAO,IAAI;AAAA,IAC/C;AACA,QAAI,CAAC,WAAY;AACjB,gBAAY,KAAK;AAAA,MACf,UAAU,OAAO;AAAA,MACjB,cAAc,WAAW;AAAA,MACzB,gBAAgB,MAAM;AAAA,MACtB,gBAAgB,WAAW;AAAA,MAC3B,MAAM,WAAW;AAAA,IACnB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEO,SAAS,wCAAwC,OAGlB;AACpC,QAAM,MAAM,MAAM,QAAQ,QAAQ,CAAC,WAAW;AAC5C,UAAM,MAAM,OAAO;AACnB,QAAI,CAAC,OAAO,IAAI,iBAAiB,UAAW,QAAO,CAAC;AACpD,UAAM,aAAa,MAAM,kBAAkB;AAAA,MACzC,CAAC,cACC,UAAU,aAAa,OAAO,MAC9B,mBAAmB,UAAU,gBAAgB,IAAI,cAAc,MAC9D,CAAC,IAAI,QAAQ,CAAC,UAAU,QAAQ,UAAU,SAAS,IAAI;AAAA,IAC5D;AACA,WAAO,aAAa,CAAC,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC;AAAA,EAC7C,CAAC;AACD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAG,MAAM,kBACN,OAAO,CAAC,SAAS,KAAK,mBAAmB,YAAY,KAAK,mBAAmB,WAAW,EACxF,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,EAAE;AAAA,EAChC;AACF;AAEO,SAAS,mCACd,MACA,OACS;AACT,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,QAAM,WAAW,IAAI,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,UAAU,UAAU,CAAC,CAAC;AACrF,SAAO,KAAK,MAAM,CAAC,eAAe;AAChC,UAAM,QAAQ,SAAS,IAAI,WAAW,QAAQ;AAC9C,WACE,OAAO,iBAAiB,WAAW,gBACnC,MAAM,mBAAmB,WAAW,kBACpC,mBAAmB,MAAM,gBAAgB,WAAW,cAAc,KAClE,MAAM,SAAS,WAAW,QAC1B,MAAM,mBAAmB,WAAW;AAAA,EAExC,CAAC;AACH;AAEO,SAAS,sCACd,aACA,QACwC;AACxC,QAAM,MAAM,OAAO;AACnB,MAAI,CAAC,OAAO,IAAI,iBAAiB,UAAW,QAAO;AACnD,SACE,YAAY;AAAA,IACV,CAAC,eACC,WAAW,aAAa,OAAO,MAC/B,mBAAmB,WAAW,gBAAgB,IAAI,cAAc,MAC/D,CAAC,IAAI,QAAQ,CAAC,WAAW,QAAQ,WAAW,SAAS,IAAI;AAAA,EAC9D,KAAK;AAET;AAMA,SAAS,6BACP,SACmC;AACnC,QAAM,MAAM,QAAQ;AACpB,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,gBAAgB,IAAI;AAAA,IACpB,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,IACjD,GAAI,IAAI,SAAS,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC;AAAA,IAC3C,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,IACjD,GAAI,IAAI,oBAAoB,EAAE,mBAAmB,IAAI,kBAAkB,IAAI,CAAC;AAAA,EAC9E;AACF;AAQO,SAAS,wCAAwC,OAKvB;AAC/B,SAAO,OAAO,YAAY;AACxB,QAAI,mBAAmB;AACvB,QAAI,QAAQ,cAAc,iBAAiB,WAAW;AACpD,YAAM,SAAS,MAAM,SAAS,WAAW,KAAK,CAAC,WAAW,OAAO,OAAO,QAAQ,QAAQ;AACxF,YAAM,aAAa,SACf,sCAAsC,MAAM,+BAA+B,MAAM,IACjF;AACJ,UAAI,CAAC,cAAc,CAAE,MAAM,MAAM,4BAA4B,WAAW,cAAc,GAAI;AACxF,eAAO,6BAA6B,OAAO;AAAA,MAC7C;AACA,yBAAmB;AAAA,QACjB,GAAG;AAAA,QACH,WAAW,WAAW;AAAA,QACtB,eAAe;AAAA,UACb,GAAG,QAAQ;AAAA,UACX,gBAAgB,WAAW;AAAA,UAC3B,cAAc,WAAW;AAAA,UACzB,GAAI,WAAW,OAAO,EAAE,MAAM,WAAW,KAAK,IAAI,CAAC;AAAA,QACrD;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,MAAM,MAAM,kBAAkB,gBAAgB;AAC7D,QAAI,OAAO,WAAW,QAAQ,QAAQ,cAAc,iBAAiB,WAAW;AAC9E,aAAO;AAAA,IACT;AACA,WAAO,6BAA6B,OAAO;AAAA,EAC7C;AACF;AAEA,eAAsB,oCAAoC,OAMX;AAC7C,QAAM,UAAU,kCAAkC,MAAM,UAAU,MAAM,KAAK;AAC7E,QAAM,+BAA+B,MAAM,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,UAAU;AACtF,MAAK,QAAQ,WAAW,KAAK,CAAC,gCAAiC,MAAM,OAAO,SAAS,QAAQ;AAC3F,WAAO,CAAC;AAAA,EACV;AACA,MAAI,MAAM,OAAO,SAAS,QAAQ;AAChC,UAAM,YAAY,wCAAwC;AAAA,MACxD;AAAA,MACA,mBAAmB,MAAM;AAAA,QACvB,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,OAAO;AAAA,QACb,MAAM,OAAO;AAAA,MACf;AAAA,IACF,CAAC;AACD,WAAO,+BACH,YACA,UAAU;AAAA,MACR,CAAC,SAAS,KAAK,mBAAmB,YAAY,KAAK,mBAAmB;AAAA,IACxE;AAAA,EACN;AACA,QAAM,aAAa,MAAMC,mBAAkB,MAAM,IAAI,MAAM,OAAO,WAAW,MAAM,WAAW;AAC9F,MAAI,CAAC,WAAY,QAAO,CAAC;AACzB,QAAM,MAAM,oDAAoD;AAAA,IAC9D;AAAA,IACA,WAAW,MAAM,OAAO;AAAA,IACxB,aAAa,MAAMC,yBAAwB,MAAM,IAAI,MAAM,aAAa,MAAM,OAAO,SAAS;AAAA,EAChG,CAAC;AACD,MAAI,CAAC,6BAA8B,QAAO;AAC1C,QAAM,iBAAiB,MAAM,OAAO;AACpC,QAAM,UAAU,MAAMC,uBAAsB,MAAM,IAAI,MAAM,aAAa,KAAK,cAAc;AAC5F,QAAM,SAAS,oBAAI,IAA8C;AACjE,aAAW,cAAc,SAAS;AAChC,QACE,WAAW,cAAc,cACzB,WAAW,WAAW,eACrB,WAAW,aAAa,OAAO,WAAW,aAAa;AAExD;AACF,UAAM,QAAQ,OAAO,IAAI,WAAW,QAAQ;AAC5C,QAAI,CAAC,SAAS,WAAW,YAAY,MAAM;AACzC,aAAO,IAAI,WAAW,UAAU,UAAU;AAAA,EAC9C;AACA,QAAM,qBACJ,MAAMD,yBAAwB,MAAM,IAAI,MAAM,aAAa,cAAc,GACzE;AAAA,IACA,CAAC,eACC,WAAW,cAAc,kBACzB,WAAW,WAAW,YACtB,mBAAmB,WAAW,gBAAgB,mBAAmB;AAAA,EACrE;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAG,CAAC,GAAG,OAAO,OAAO,CAAC,EAAE,IAAI,CAAC,gBAAgB;AAAA,MAC3C,UAAU,UAAU,WAAW,QAAQ;AAAA,MACvC,cAAc,WAAW;AAAA,MACzB;AAAA,MACA,gBAAgB,WAAW,aAAa,MAAM,UAAU,GAAG,WAAW,QAAQ;AAAA,MAC9E,MAAM;AAAA,MACN,gBAAgB;AAAA,IAClB,EAAE;AAAA,IACF,GAAG,kBAAkB,IAAI,CAAC,gBAAgB;AAAA,MACxC,UAAU,aAAa,WAAW,EAAE;AAAA,MACpC,cAAc,WAAW;AAAA,MACzB;AAAA,MACA,gBAAgB,WAAW;AAAA,MAC3B,MAAM,WAAW;AAAA,MACjB,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AACF;;;AC3aA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,qBAAqB;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAAE;AAAA,OAGK;AACP,SAAS,0CAA0C,mBAAkC;AACrF,SAAS,iBAAAC,sBAAqB;AAEvB,SAAS,iBAAiB,OAAkB,UAAkC;AACnF,QAAM,eAAe,IAAI,IAAI,SAAS,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AAC3E,QAAM,MAAiB,CAAC;AACxB,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,SAAS,OAAO;AACvB,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,0BAA2B,KAA2B,IAAI;AAAA,MACrE,CAAC;AAAA,IACH;AACA,UAAM,WAAW,KAAK,aAAa;AACnC,QAAI,CAAC,aAAa,IAAI,KAAK,EAAE,GAAG;AAC9B,UAAI,UAAU;AACZ;AAAA,MACF;AACA,YAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,0BAA0B,KAAK,EAAE,GAAG,CAAC;AAAA,IAC/E;AASA,QAAI;AAAA,MACF,WAAW,EAAE,MAAM,OAAO,IAAI,KAAK,IAAI,UAAU,KAAK,IAAI,EAAE,MAAM,OAAO,IAAI,KAAK,GAAG;AAAA,IACvF;AAAA,EACF;AACA,SAAO,cAAc,CAAC,GAAG,GAAG;AAC9B;AAIO,SAAS,6BACd,UACA,iBACW;AACX,QAAM,gBAAgB,IAAI,IAAI,SAAS,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AAC5E,SACE,gBAAgB,WACb,OAAO,CAAC,WAAW,CAAC,cAAc,IAAI,OAAO,EAAE,CAAC,EAKhD,IAAI,CAAC,YAAY,EAAE,MAAM,OAAO,IAAI,OAAO,IAAI,UAAU,KAAK,EAAE;AAEvE;AAEO,SAAS,qCACd,OACA,UACA,iBACW;AACX,SAAO,cAAc,OAAO,6BAA6B,UAAU,eAAe,CAAC;AACrF;AAGO,SAAS,kBAAkB,OAAkB,UAAkC;AACpF,QAAM,YAAY,IAAI,IAAI,SAAS,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AACxE,SAAO,MAAM,OAAO,CAAC,SAAS,UAAU,IAAI,KAAK,EAAE,CAAC;AACtD;AAGO,SAAS,qBACd,WACA,SACA,UAAU,kDACJ;AACN,QAAM,aAAa,IAAI,IAAI,QAAQ,IAAI,CAAC,SAAS,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;AAC3E,QAAM,UAAU,UAAU,KAAK,CAAC,SAAS,CAAC,WAAW,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;AACnF,MAAI,SAAS;AACX,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,GAAG,OAAO,KAAK,QAAQ,EAAE,GAAG,CAAC;AAAA,EACvE;AACF;AAGO,SAAS,iCAAiC,OAKnC;AACZ,QAAM,YAAY,iBAAiB,MAAM,WAAW,MAAM,QAAQ;AAClE,uBAAqB,WAAW,MAAM,cAAc,MAAM,OAAO;AACjE,SAAO;AACT;AAEO,SAAS,mBAAmB,WAAyC;AAC1E,QAAM,aAAa,oBAAI,IAAoB;AAC3C,QAAM,aAAa,oBAAI,IAAoB;AAC3C,QAAM,6BAA6B,oBAAI,IAAoB;AAC3D,QAAM,gBAAgB,oBAAI,IAAY;AACtC,QAAM,MAAqB,CAAC;AAC5B,aAAW,YAAY,WAAW;AAChC,QAAI;AACJ,QAAI,SAAS,SAAS,QAAQ;AAC5B,YAAM,YAAY,mBAAmB,kBAAkB,QAAQ,CAAC;AAChE,mBAAa;AAAA,QACX,MAAM;AAAA,QACN,QAAQ,SAAS;AAAA,QACjB;AAAA,MACF;AAAA,IACF,OAAO;AACL,YAAM,qBAAqB,mCAAmC,QAAQ;AACtE,UAAI;AACJ,UAAI;AACF,wBAAgB,gCAAgC,SAAS,GAAG;AAAA,MAC9D,SAAS,OAAO;AACd,cAAM,IAAIA,eAAc,KAAK;AAAA,UAC3B,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AAAA,QACpD,CAAC;AAAA,MACH;AACA,YAAM,YAAY;AAAA,QAChB,SAAS,aAAa,2BAA2B,eAAe,kBAAkB;AAAA,MACpF;AACA,YAAM,sBAAsB,oCAAoC,UAAU,kBAAkB;AAC5F,WACG,SAAS,uBAAuB,SAAS,gBAAgB,SAAS,WACnE,CAAC,oBACD;AACA,cAAM,IAAIA,eAAc,KAAK;AAAA,UAC3B,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,UAAI,sBAAsB,qBAAqB;AAC7C,cAAM,gBAAgB,2BAA2B,IAAI,mBAAmB;AACxE,YAAI,iBAAiB,kBAAkB,oBAAoB;AACzD,gBAAM,IAAIA,eAAc,KAAK;AAAA,YAC3B,SAAS,sBAAsB,mBAAmB;AAAA,UACpD,CAAC;AAAA,QACH;AACA,mCAA2B,IAAI,qBAAqB,kBAAkB;AAAA,MACxE;AACA,mBAAa;AAAA,QACX,MAAM;AAAA,QACN,KAAK;AAAA,QACL,KAAK,SAAS,IAAI,KAAK;AAAA,QACvB;AAAA,QACA,GAAI,SAAS,UAAU,EAAE,SAAS,2BAA2B,SAAS,OAAO,EAAE,IAAI,CAAC;AAAA,QACpF,GAAI,SAAS,WAAW,EAAE,UAAU,SAAS,SAAS,IAAI,CAAC;AAAA,QAC3D,GAAI,SAAS,sBACT,EAAE,qBAAqB,SAAS,oBAAoB,IACpD,CAAC;AAAA,QACL,GAAI,SAAS,SAAS,EAAE,QAAQ,SAAS,OAAO,IAAI,CAAC;AAAA,QACrD,GAAI,SAAS,iBAAiB,SAAY,EAAE,cAAc,SAAS,aAAa,IAAI,CAAC;AAAA,QACrF,GAAI,SAAS,mBAAmB,SAC5B,EAAE,gBAAgB,SAAS,eAAe,IAC1C,CAAC;AAAA,QACL,GAAI,SAAS,cAAc,SAAY,EAAE,WAAW,SAAS,UAAU,IAAI,CAAC;AAAA,QAC5E,GAAI,SAAS,eAAe,EAAE,cAAc,SAAS,aAAa,IAAI,CAAC;AAAA,QACvE,GAAI,SAAS,uBACT,EAAE,sBAAsB,SAAS,qBAAqB,IACtD,CAAC;AAAA,QACL,GAAI,SAAS,qBAAqB,EAAE,oBAAoB,SAAS,mBAAmB,IAAI,CAAC;AAAA,MAC3F;AAAA,IACF;AACA,UAAM,MAAMD,YAAW,UAAU;AACjC,UAAM,oBAAoB,WAAW,YACjC,8BAA8B,WAAW,SAAS,IAClD;AACJ,UAAM,UAAU,oBAAoB,WAAW,IAAI,iBAAiB,IAAI;AACxE,QAAI,WAAW,YAAY,KAAK;AAC9B,YAAM,IAAIC,eAAc,KAAK;AAAA,QAC3B,SAAS,kCAAkC,WAAW,SAAS;AAAA,MACjE,CAAC;AAAA,IACH;AACA,QAAI,WAAW,WAAW;AACxB,iBAAW,IAAI,mBAAoB,GAAG;AAAA,IACxC;AACA,UAAM,WAAW,oBAAoB,UAAU;AAC/C,UAAM,eAAe,WAAW,IAAI,QAAQ;AAC5C,QAAI,gBAAgB,iBAAiB,KAAK;AACxC,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,+CAA+C,QAAQ;AAAA,MAClE,CAAC;AAAA,IACH;AACA,eAAW,IAAI,UAAU,GAAG;AAC5B,QAAI,CAAC,cAAc,IAAI,GAAG,GAAG;AAC3B,oBAAc,IAAI,GAAG;AACrB,UAAI,KAAK,UAAU;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,kBACd,UACA,WACe;AACf,MAAI;AACF,WAAO,0BAA0B,UAAU,WAAW,EAAE,iBAAiB,KAAK,CAAC;AAAA,EACjF,SAAS,OAAO;AACd,QAAI,iBAAiB,0BAA0B;AAC7C,YAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,IACzD;AACA,UAAM;AAAA,EACR;AACF;AAEO,SAAS,wCAAwC,WAAoC;AAC1F,QAAM,WAAW,2BAA2B,SAAS;AACrD,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO,CAAC;AAAA,EACV;AACA,SAAO,CAAC,GAAG,IAAI,IAAI,SAAS,IAAI,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC;AACjE;AAGO,SAAS,uCAAuC,WAAyC;AAC9F,QAAM,kBAAkB,wCAAwC,SAAS;AACzE,MAAI,gBAAgB,SAAS,GAAG;AAC9B,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO,gBAAgB,CAAC,KAAK;AAC/B;AAEA,SAAS,2BACP,WACyD;AACzD,SAAO,UAAU,QAAQ,CAAC,aAAa;AACrC,QAAI,SAAS,SAAS,cAAc;AAClC,aAAO,CAAC;AAAA,IACV;AACA,UAAM,kBACJ,SAAS,yBACR,SAAS,aAAa,WAAW,SAAS,iBAAiB;AAC9D,UAAM,gBACJ,SAAS,uBACR,SAAS,aAAa,WAAW,SAAS,eAAe;AAC5D,QAAI,oBAAoB,QAAQ,kBAAkB,MAAM;AACtD,aAAO,CAAC;AAAA,IACV;AACA,QAAI,oBAAoB,UAAa,kBAAkB,QAAW;AAChE,aAAO,CAAC;AAAA,IACV;AACA,UAAM,iBAAiB,gBAAgB,eAAe;AACtD,UAAM,eAAe,gBAAgB,aAAa;AAClD,QAAI,CAAC,kBAAkB,CAAC,cAAc;AACpC,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SACE;AAAA,MACJ,CAAC;AAAA,IACH;AACA,WAAO,CAAC,EAAE,gBAAgB,aAAa,CAAC;AAAA,EAC1C,CAAC;AACH;AAEA,eAAsB,kCACpB,IACA,aACA,WACe;AACf,QAAM,kBAAkB,wCAAwC,SAAS;AACzE,MAAI,gBAAgB,WAAW,GAAG;AAChC;AAAA,EACF;AACA,QAAM,aAAa,2BAA2B,SAAS;AACvD,aAAW,kBAAkB,iBAAiB;AAC5C,UAAM,gBAAgB,WACnB,OAAO,CAAC,cAAc,UAAU,mBAAmB,cAAc,EACjE,IAAI,CAAC,cAAc,UAAU,YAAY;AAC5C,QACE,CAAE,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,GACA;AACA,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SACE;AAAA,MACJ,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAOO,SAAS,8CAA8C,OAAyB;AACrF,SAAO,iBAAiBA,kBAAiB,MAAM,WAAW;AAC5D;AAEA,eAAsB,sBACpB,IACA,aACA,WACe;AACf,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,YAAY,WAAW;AAChC,QAAI,SAAS,SAAS,QAAQ;AAC5B;AAAA,IACF;AACA,QAAI,QAAQ,IAAI,SAAS,MAAM,GAAG;AAChC,YAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,4BAA4B,SAAS,MAAM,GAAG,CAAC;AAAA,IACzF;AACA,YAAQ,IAAI,SAAS,MAAM;AAC3B,UAAM,OAAO,MAAM,YAAY,IAAI,aAAa,SAAS,MAAM,EAAE,MAAM,MAAM,IAAI;AACjF,QAAI,CAAC,MAAM;AACT,YAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,0BAA0B,SAAS,MAAM,GAAG,CAAC;AAAA,IACvF;AACA,QAAI,KAAK,WAAW,SAAS;AAC3B,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,iBAAiB,SAAS,MAAM,OAAO,KAAK,MAAM;AAAA,MAC7D,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,MAAsB;AAChD,MAAI;AACF,WAAO,2BAA2B,IAAI;AAAA,EACxC,SAAS,OAAO;AACd,QAAI,EAAE,iBAAiB,wBAAyB,OAAM;AACtD,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,gCAAgC,IAAI,GAAG,CAAC;AAAA,EAClF;AACF;AAEA,SAAS,gBAAgB,OAA+B;AACtD,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,KAAK,QAAQ,GAAG;AACrE,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,KAAK,OAAO,KAAK,IAAI,GAAG;AACzE,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,SAAO;AACT;;;ACjWA;AAAA,EACE;AAAA,EACA;AAAA,EACA,iBAAAC;AAAA,OAKK;AAIP,IAAM,mCAAmC,CAAC,UAAU;AACpD,IAAM,0BAA0B;AAehC,SAAS,UAAU,KAAiC;AAClD,SAAO,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,EAAE,KAAK;AAChC;AAGO,SAAS,2BAA2B,SAA6C;AACtF,QAAM,YAAY,IAAI,IAAY,gCAAgC;AAClE,SAAO,UAAU,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,WAAW,OAAO,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;AAC7F;AAEA,SAAS,WAAW,KAA+D;AACjF,QAAM,cAAc,IAAI;AAAA,IACtB,CAAC,OACC,GAAG,UAAU,+CAA+C,wBAAwB,KAAK,EAAE;AAAA,EAC/F;AACA,SAAO;AAAA,IACL,KAAK,YAAY,MAAM,GAAG,sCAAsC;AAAA,IAChE,WACE,YAAY,WAAW,IAAI,UAC3B,YAAY,SAAS;AAAA,EACzB;AACF;AAQO,SAAS,yBAAyB,OAA0D;AACjG,QAAM,SAAS,MAAM;AACrB,QAAM,eAAe,IAAI,IAAI,MAAM,qBAAqB;AACxD,QAAM,aAAa,IAAI,IAAI,MAAM,uBAAuB,CAAC,CAAC;AAC1D,QAAM,eAAyB,iCAAiC;AAAA,IAAO,CAAC,OACtE,aAAa,IAAI,EAAE;AAAA,EACrB;AACA,QAAM,iBAAiB,IAAI,IAAY,YAAY;AACnD,QAAM,eAAeC,eAAc,CAAC,GAAG,MAAM,YAAY;AACzD,QAAM,0BAA0B,OAAO,SAAS;AAShD,MAAI,WAAW,aAAa,OAAO,CAAC,SAAS,aAAa,IAAI,KAAK,EAAE,CAAC;AACtE,MAAI,yBAAyB;AAC3B,eAAWA;AAAA,MACT;AAAA,MACA,UAAU,UAAU,EACjB,OAAO,CAAC,OAAO,aAAa,IAAI,EAAE,CAAC,EACnC,IAAI,CAAC,QAAQ,EAAE,MAAM,OAAgB,IAAI,UAAU,KAAc,EAAE;AAAA,IACxE;AAAA,EACF;AACA,aAAWA;AAAA,IACT;AAAA,IACA,aAAa,IAAI,CAAC,QAAQ,EAAE,MAAM,OAAgB,GAAG,EAAE;AAAA,EACzD;AAMA,QAAM,yBAAyBA;AAAA,IAC7B;AAAA,IACA,0BACI,UAAU,UAAU,EACjB,OAAO,CAAC,OAAO,aAAa,IAAI,EAAE,CAAC,EACnC,IAAI,CAAC,QAAQ,EAAE,MAAM,OAAgB,IAAI,UAAU,KAAc,EAAE,IACtE,CAAC;AAAA,EACP;AACA,QAAM,eAAe;AAAA,IACnBA;AAAA,MACE;AAAA,MACA,aAAa,IAAI,CAAC,QAAQ,EAAE,MAAM,OAAgB,GAAG,EAAE;AAAA,IACzD,EAAE,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,EACzB;AACA,QAAM,gBAAgB,aAAa,OAAO,CAAC,OAAO,aAAa,IAAI,EAAE,CAAC;AACtE,QAAM,kBAAkB,IAAI,IAAI,aAAa;AAC7C,QAAM,aAAa,aAAa,OAAO,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;AAOvE,QAAM,cAAc;AAAA,IAClB,SACG,OAAO,CAAC,SAAS,gBAAgB,IAAI,KAAK,EAAE,KAAK,CAAC,eAAe,IAAI,KAAK,EAAE,CAAC,EAC7E,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,EAC1B;AACA,QAAM,cAAc;AAAA,IAClB,aACG;AAAA,MACC,CAAC,SACC,CAAC,eAAe,IAAI,KAAK,EAAE,KAAK,EAAE,2BAA2B,KAAK,aAAa;AAAA,IACnF,EACC,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,EAC1B;AACA,QAAM,cAAc;AAAA,IAClB,UAAU,WAAW,WAAW;AAAA,IAChC,WAAW,WAAW,YAAY;AAAA,IAClC,WAAW,WAAW,UAAU,YAAY,CAAC;AAAA,IAC7C,UAAU,WAAW,WAAW;AAAA,IAChC,YAAY,WAAW,aAAa;AAAA,IACpC,SAAS,WAAW,UAAU;AAAA,EAChC;AAEA,SAAO;AAAA,IACL;AAAA,IACA,iBAAiB;AAAA,MACf,MAAM,OAAO;AAAA,MACb,wBAAwB,OAAO;AAAA,MAC/B,aAAa,YAAY,SAAS;AAAA,MAClC,cAAc,YAAY,UAAU;AAAA,MACpC,cAAc,YAAY,UAAU;AAAA,MACpC,YAAY;AAAA,QACV,OAAO,YAAY,SAAS,IAAI,aAAa;AAAA,QAC7C,aAAa,YAAY,SAAS;AAAA,MACpC;AAAA,MACA,eAAe,YAAY,WAAW;AAAA,MACtC,YAAY,YAAY,QAAQ;AAAA,MAChC,QAAQ;AAAA,QACN,UAAU,YAAY;AAAA,QACtB,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA,QACxB,UAAU,YAAY;AAAA,QACtB,YAAY,cAAc;AAAA,QAC1B,SAAS,WAAW;AAAA,MACtB;AAAA,MACA,cAAc,OAAO,OAAO,WAAW,EAAE,KAAK,CAAC,eAAe,WAAW,SAAS;AAAA,IACpF;AAAA,EACF;AACF;AAGA,eAAsB,oCACpB,IACA,aACA,UACA,WACmB;AACnB,QAAM,kBAAkB,MAAM,wCAAwC,IAAI,aAAa,UAAU;AAAA,IAC/F,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,EACnC,CAAC;AACD,SAAO,UAAU,gBAAgB,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AACxE;AAGA,eAAsB,2CACpB,IACA,aACA,UACA,WACmB;AACnB,QAAM,kBAAkB,MAAM,wCAAwC,IAAI,aAAa,UAAU;AAAA,IAC/F,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,EACnC,CAAC;AACD,SAAO,2BAA2B,gBAAgB,UAAU;AAC9D;AAGO,SAAS,+BACd,SACA,oBACA,4BAA8C,CAAC,GACtC;AACT,QAAM,eAAe,IAAI,IAAI,kBAAkB;AAC/C,aAAW,UAAU,QAAQ,YAAY;AACvC,iBAAa,IAAI,OAAO,EAAE;AAAA,EAC5B;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,qBAAqB,yBAAyB;AAAA,MAC5C,YAAY,QAAQ;AAAA,MACpB,cAAc,QAAQ;AAAA,MACtB,uBAAuB;AAAA,MACvB,qBAAqB;AAAA,IACvB,CAAC,EAAE;AAAA,EACL;AACF;;;ACrMA,SAAS,2CAAAC,gDAA+C;AACxD;AAAA,EACE;AAAA,EACA;AAAA,EACA,yBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,qDAAAC;AAAA,EACA,cAAAC;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,iBAAAC,uBAAqB;;;ACjC9B,SAAS,uBAAuB,0BAA0B;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,8BAAAC;AAAA,EACA,2CAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAAC;AAAA,EAYA;AAAA,OAgBK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA,2BAAAC;AAAA,EACA;AAAA,EACA,iBAAAC;AAAA,EACA;AAAA,EACA,UAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAAC;AAAA,EACA,cAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,kBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,sBAAsB;AAAA,EACtB;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE,0BAAAC;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,iBAAAC,uBAAqB;;;ACjG9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP,SAAS,uBAAsC;AAC/C,SAAS,iBAAAC,sBAAqB;AAE9B,IAAM,uBAAuB;AAC7B,IAAM,gBAAgB,IAAI,OAAO,+BAA+B,GAAG;AAMnE,SAAS,0BAAiC;AACxC,QAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,qCAAqC,CAAC;AAChF;AAEA,SAAS,SAAS,OAAwB;AACxC,MAAI;AACF,WAAO,KAAK,UAAU,KAAK,KAAK;AAAA,EAClC,QAAQ;AACN,WAAO,OAAO,SAAS,EAAE;AAAA,EAC3B;AACF;AAEA,SAAS,aAAa,OAA+B;AACnD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,aAAW,QAAQ,OAAO;AACxB,QACE,SAAS,QACT,OAAO,SAAS,YACf,KAA4B,SAAS,UACtC,OAAQ,KAA4B,SAAS,UAC7C;AACA,aAAQ,KAA0B;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAgB,QAAQ,GAAW;AAC/D,MAAI,QAAQ,KAAK,UAAU,QAAQ,UAAU;AAC3C,WAAO,SAAS,OAAO,KAAK,SAAS,KAAK;AAC5C,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO,SAAS,KAAK;AAC5E,QAAMC,UAAS;AACf,MAAIA,QAAO,SAAS,UAAU,OAAOA,QAAO,SAAS,SAAU,QAAOA,QAAO;AAC7E,QAAM,cAAc,aAAaA,QAAO,OAAO;AAC/C,MAAI,gBAAgB,KAAM,QAAO;AACjC,MAAI,uBAAuBA,SAAQ;AACjC,WAAO,eAAe,qBAAqBA,QAAO,mBAAmB,QAAQ,CAAC;AAAA,EAChF;AACA,MAAI,YAAYA,QAAQ,QAAO,qBAAqBA,QAAO,QAAQ,QAAQ,CAAC;AAC5E,SAAO,SAAS,KAAK;AACvB;AAEA,SAAS,gBAAgB,MAAsB;AAC7C,QAAM,SAAS,KAAK,QAAQ,aAAa;AACzC,MAAI,UAAU,EAAG,QAAO,KAAK,MAAM,SAAS,cAAc,MAAM;AAChE,SAAO,KAAK,WAAW,WAAW,IAAI,KAAK,MAAM,YAAY,MAAM,IAAI;AACzE;AAEO,SAAS,6BAA6B,OAAoC;AAC/E,MAAI,CAAC,MAAM,WAAW,OAAO,MAAM,YAAY,YAAY,MAAM,QAAQ,MAAM,OAAO,GAAG;AACvF,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM;AACtB,MAAI,MAAM,SAAS,kBAAkB,MAAM,SAAS,2BAA2B;AAC7E,WAAO,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,EAC3D;AACA,MAAI,MAAM,SAAS,wBAAyB,QAAO;AACnD,QAAM,SAAS,OAAO,UAAU,eAAe,KAAK,SAAS,QAAQ,IACjE,QAAQ,SACR,QAAQ;AACZ,QAAM,OAAO,gBAAgB,qBAAqB,MAAM,CAAC,EAAE,QAAQ,eAAe,EAAE;AACpF,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,SAAS,WAAW,OAAe,UAA0B;AAC3D,MAAI,SAAS;AACb,MAAI,QAAQ;AACZ,aAAW,aAAa,OAAO;AAC7B,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,SAAS,EAAE;AACjD,QAAI,QAAQ,OAAO,SAAU;AAC7B,cAAU;AACV,aAAS;AAAA,EACX;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAAe,UAA0B;AAC3D,MAAI,SAAS;AACb,MAAI,QAAQ;AACZ,aAAW,aAAa,CAAC,GAAG,KAAK,EAAE,QAAQ,GAAG;AAC5C,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,SAAS,EAAE;AACjD,QAAI,QAAQ,OAAO,SAAU;AAC7B,aAAS,YAAY;AACrB,aAAS;AAAA,EACX;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,YAAoB,OAAyB;AACrE,QAAM,UAAoB,CAAC;AAC3B,MAAI,SAAS;AACb,SAAO,UAAU,WAAW,SAAS,MAAM,QAAQ;AACjD,UAAM,QAAQ,WAAW,QAAQ,OAAO,MAAM;AAC9C,QAAI,QAAQ,EAAG;AACf,YAAQ,KAAK,KAAK;AAClB,aAAS,QAAQ;AAAA,EACnB;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,YAAoB,YAA6C;AAC3F,QAAM,EAAE,QAAQ,MAAM,IAAI;AAC1B,MACE,OAAO,YAAY,OAAO,gBAAgB,MAAM,UAChD,WAAW,MAAM,OAAO,aAAa,OAAO,SAAS,MAAM,OAC3D;AACA,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,UAAU,iBAAiB,YAAY,KAAK;AAClD,MAAI,QAAQ,WAAW,EAAG,QAAO,QAAQ,CAAC;AAC1C,QAAM,aAAa,QAAQ,OAAO,CAAC,UAAU;AAC3C,UAAM,SAAS,WAAW,MAAM,KAAK,IAAI,GAAG,QAAQ,OAAO,cAAc,MAAM,GAAG,KAAK;AACvF,UAAM,QAAQ,WAAW;AAAA,MACvB,QAAQ,MAAM;AAAA,MACd,QAAQ,MAAM,SAAS,OAAO,aAAa;AAAA,IAC7C;AACA,WAAO,WAAW,OAAO,iBAAiB,UAAU,OAAO;AAAA,EAC7D,CAAC;AACD,MAAI,WAAW,WAAW,EAAG,QAAO,WAAW,CAAC;AAChD,SAAO,wBAAwB;AACjC;AAEA,eAAe,4BACb,IACA,aACA,WACA,aACA,SACoC;AACpC,QAAM,SAAS,QAAQ,eACnB,6BAA6B,MAAM,WAAW,IAC9C,yBAAyB,MAAM,WAAW;AAC9C,QAAM,YAAuC,CAAC;AAC9C,aAAW,cAAc,QAAQ;AAC/B,UAAM,QAAQ,MAAM,gBAAgB,IAAI,aAAa,WAAW,OAAO,OAAO;AAC9E,QACE,CAAC,SACD,MAAM,cAAc,aACpB,MAAM,SAAS,WAAW,OAAO,aACjC,MAAM,aAAa,WAAW,OAAO,aACpC,MAAM,UAAU,UAAU,WAAW,OAAO,QAC7C;AACA,8BAAwB;AAAA,IAC1B;AACA,UAAM,aAAa,6BAA6B,KAAK;AACrD,QAAI,eAAe,KAAM,yBAAwB;AACjD,UAAM,cAAc,mBAAmB,YAAY,UAAU;AAC7D,UAAM,YAAY,cAAc,WAAW,MAAM;AACjD,cAAU,KAAK;AAAA,MACb,GAAG;AAAA,MACH,QAAQ;AAAA,QACN,GAAG,WAAW;AAAA,QACd;AAAA,QACA;AAAA,QACA,eAAe,WAAW,WAAW,MAAM,GAAG,WAAW,GAAG,oBAAoB;AAAA,QAChF,cAAc,WAAW,WAAW,MAAM,SAAS,GAAG,oBAAoB;AAAA,MAC5E;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAsB,iCACpB,IACA,aACA,WACA,aACoC;AACpC,SAAO,MAAM,4BAA4B,IAAI,aAAa,WAAW,aAAa;AAAA,IAChF,cAAc;AAAA,EAChB,CAAC;AACH;AAEA,eAAsB,qCACpB,IACA,aACA,WACA,aAC+B;AAC/B,QAAM,YAAY,MAAM,4BAA4B,IAAI,aAAa,WAAW,aAAa;AAAA,IAC3F,cAAc;AAAA,EAChB,CAAC;AACD,SAAO,0BAA0B,SAA0C;AAC7E;;;AC3MA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP;AAAA,EACE,yBAAAC;AAAA,OAGK;AACP,SAAS,iBAAAC,uBAAqB;AAGvB,SAAS,yBACd,UACiC;AACjC,QAAM,SAAS,mCAAmC,UAAU,QAAQ;AACpE,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEO,SAAS,6BACd,YAIS;AACT,SACE,WAAW,qBAAqB,QAChC,WAAW,2BAA2B,WAAW,WACjD,WAAW,cAAc,QACzB,WAAW,mBAAmB,eAC9B,WAAW,SAAS,iBACpB,kCAAkC,WAAW,aAAa,KAC1D,yBAAyB,WAAW,QAAQ,GAAG,mBAC7C;AAEN;AAEO,SAAS,oCACd,UACS;AACT,SACE,UAAU,mBAAmB,sCAC7B,UAAU,oBAAoB;AAElC;AAEO,SAAS,2CACd,UACS;AACT,SAAO;AAAA,IACL,YACA,OAAO,UAAU,eAAe,KAAK,UAAU,uCAAuC;AAAA,EACxF;AACF;AAMA,eAAsB,kCACpB,IACA,aACA,cAC6B;AAC7B,QAAM,aAAa,MAAMC,uBAAsB,IAAI,aAAa,cAAc,IAAI;AAClF,MAAI,CAAC,cAAc,CAAC,6BAA6B,UAAU,GAAG;AAC5D,UAAM,IAAIC,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,WAAW,WAAW,UAAU;AAClC,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS,gDAAgD,WAAW,MAAM;AAAA,IAC5E,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAsB,4CACpB,IACA,OACA,aACA,cAC6B;AAC7B,oBAAkB,OAAO,kBAAkB;AAC3C,SAAO,MAAM,kCAAkC,IAAI,aAAa,YAAY;AAC9E;AAEO,SAAS,8BACd,UACe;AACf,QAAM,QAAQ,WAAW,uCAAuC;AAChE,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,IAAI,QAAQ;AAC7D;AAOO,SAAS,kCACd,SACS;AACT,QAAM,kBAAkB,QAAQ,SAAS;AACzC,QAAM,qBAAqB,QAAQ,SAAS;AAC5C,SACE,QAAQ,WAAW,SAAS,aAC5B,QAAQ,UAAU,cAAc,eAChC,OAAO,oBAAoB,YAC3B,MAAM,eAAe,KACrB,OAAO,uBAAuB,YAC9B,MAAM,kBAAkB,KACxB,QAAQ,iBAAiB,oBAAoB,mBAC7C,QAAQ,iBAAiB,uBAAuB,sBAChD,8BAA8B,QAAQ,QAAQ,MAAM;AAExD;AAEA,SAAS,MAAM,OAAwB;AACrC,SAAO,6EAA6E,KAAK,KAAK;AAChG;;;AFEA,IAAM,8BAA8B,oBAAI,IAAI,CAAC,YAAY,SAAS,QAAQ,YAAY,CAAC;AACvF,IAAM,iCAAiC;AACvC,IAAM,2CAA2C;AAGjD,IAAM,yBAAyB;AAE/B,IAAM,iCAAiC;AAGhC,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACxC;AAAA,EAET,YAAY,QAA4B;AACtC,UAAM,0BAA0B,MAAM,CAAC;AACvC,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAQO,SAAS,mCACd,WACA,cACA,SAGI;AAAA,EACF,SAAS;AAAA,EACT,SAASC;AACX,GACyB;AACzB,MAAI,cAAc,OAAW,QAAO,CAAC,GAAG,SAAS;AACjD,QAAM,UAAU,IAAI,IAAI,OAAO,OAAO;AACtC,QAAM,YAAY,iBAAiB,SAAY,OAAO,UAAW,gBAAgB,OAAO;AACxF,SAAO,CAAC,GAAG,SAAS,EAAE,OAAO,CAAC,SAAS,QAAQ,IAAI,IAAI,CAAC;AAC1D;AAEA,SAAS,0BAA0B,QAAoC;AACrE,MAAI,OAAO,SAAS,yCAAyC;AAC3D,WAAO,sCAAsC,OAAO,wCAAwC,SAAS,4BAA4B,OAAO,4BAA4B;AAAA,EACtK;AACA,SAAO,sBAAsB,OAAO,cAAc,4BAA4B,OAAO,4BAA4B,0BAA0B,OAAO,YAAY;AAChK;AAEO,SAAS,2BAA2B,OAAgC;AACzE,SAAO;AAAA,IACL,OAAO;AAAA,MACL,MAAM,MAAM,OAAO;AAAA,MACnB,SAAS,MAAM;AAAA,MACf,SAAS,EAAE,QAAQ,MAAM,OAAO;AAAA,IAClC;AAAA,EACF;AACF;AAcA,SAAS,yBAAyB,OAGzB;AACP,MAAI,CAAC,MAAM,kBAAkB;AAC3B,QAAI,MAAM,yBAAyB;AACjC,YAAM,IAAIC,gBAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AACA,QAAM,YAAY,qBAAqB,UAAU,MAAM,gBAAgB;AACvE,MAAI,CAAC,UAAU,SAAS;AACtB,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,UAAU,4BAA4B,UAAU,MAAM,2BAA2B,CAAC,CAAC;AACzF,MAAI,CAAC,QAAQ,SAAS;AACpB,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,eAAe,MAAM,WAAW,QAAQ;AAC9C,QAAM,kBAAkB,MAAM,WAAW,WAAW;AACpD,QAAM,4BAA4B,MAAM,WAAW,qBAAqB;AACxE,MACE,iBAAiB,UACjB,oBAAoB,UACpB,8BAA8B,QAC9B;AACA,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,WAAW,UAAU;AAAA,IACrB,SAAS,QAAQ;AAAA,EACnB;AACF;AAEO,SAAS,0BAA0B,OAA6C;AACrF,QAAM,mBAAmB,yBAAyB,KAAK;AACvD,QAAM,kBAAkB,MAAM,WAAW,WAAW;AACpD,QAAM,eAAe,MAAM,WAAW,QAAQ;AAC9C,QAAM,kBAAkB,MAAM,WAAW,WAAW;AACpD,QAAM,4BAA4B,MAAM,WAAW,qBAAqB;AACxE,QAAM,qBACJ,iBAAiB,UACjB,oBAAoB,UACpB,8BAA8B;AAChC,MAAI,oBAAoB;AACtB,QACE,OAAO,oBAAoB,YAC3B,OAAO,iBAAiB,YACxB,OAAO,oBAAoB,YAC3B,OAAO,8BAA8B,YACrC,CAAC,OAAO,cAAc,yBAAyB,KAC/C,4BAA4B,GAC5B;AACA,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM,QAAQ;AAAA,MACZ,MAAM;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,qBAAqB;AAAA,IACvB;AAGA,WAAO,EAAE,MAAM;AAAA,EACjB;AACA,MAAI,kBAAkB;AACpB,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,WAAW;AAAA,MACT,MAAM;AAAA,MACN,WAAW,MAAM;AAAA,MACjB,GAAI,MAAM,eAAe,EAAE,OAAO,MAAM,aAAa,IAAI,CAAC;AAAA,IAC5D;AAAA,IACA,SAAS,CAAC;AAAA,EACZ;AACF;AAEA,SAAS,sCACP,SACwB;AACxB,MAAI,CAAC,SAAS;AACZ,WAAO,CAAC;AAAA,EACV;AACA,QAAM,UAAU,OAAO,QAAQ,OAAO,EACnC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,KAAK,GAAG,KAAK,CAAU,EACpD,OAAO,CAAC,CAAC,IAAI,MAAM,KAAK,SAAS,CAAC;AACrC,MAAI,QAAQ,SAAS,gCAAgC;AACnD,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS,yCAAyC,8BAA8B;AAAA,IAClF,CAAC;AAAA,EACH;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,CAAC,MAAM,KAAK,KAAK,SAAS;AACnC,QAAI,CAAC,+BAA+B,KAAK,IAAI,GAAG;AAC9C,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,mCAAmC,IAAI;AAAA,MAClD,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,KAAK,YAAY;AAC/B,QAAI,KAAK,IAAI,KAAK,GAAG;AACnB,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,qCAAqC,IAAI;AAAA,MACpD,CAAC;AAAA,IACH;AACA,SAAK,IAAI,KAAK;AACd,QAAI,MAAM,WAAW,KAAK,MAAM,SAAS,0CAA0C;AACjF,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,qBAAqB,IAAI,cAAc,wCAAwC;AAAA,MAC1F,CAAC;AAAA,IACH;AAGA,QAAI,qCAAqC,KAAK,KAAK,GAAG;AACpD,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,qBAAqB,IAAI;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,OAAO,YAAY,OAAO;AACnC;AAEA,SAAS,yBAAyB,QAA+D;AAC/F,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;AAAA,IAC3C,KAAK,OAAO;AAAA,IACZ,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,IACnE,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,IAC1D,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,GAAI,OAAO,oBAAoB,SAAY,EAAE,iBAAiB,OAAO,gBAAgB,IAAI,CAAC;AAAA,IAC1F,GAAI,OAAO,gBAAgB,EAAE,eAAe,OAAO,cAAc,IAAI,CAAC;AAAA,EACxE;AACF;AAEA,SAAS,+BACP,QACgC;AAChC,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;AAAA,IAC3C,KAAK,OAAO;AAAA,IACZ,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,IACnE,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,IAC1D,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,GAAI,OAAO,mBAAmB,OAAO,EAAE,iBAAiB,OAAO,gBAAgB,IAAI,CAAC;AAAA,IACpF,GAAI,OAAO,gBAAgB,EAAE,eAAe,OAAO,cAAc,IAAI,CAAC;AAAA,EACxE;AACF;AAEA,SAAS,4BACP,QACgC;AAChC,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;AAAA,IAC3C,KAAK,OAAO;AAAA,IACZ,gBAAgB;AAAA,IAChB,iBAAiB,OAAO;AAAA,IACxB,GAAI,OAAO,gBAAgB,EAAE,eAAe,OAAO,cAAc,IAAI,CAAC;AAAA,EACxE;AACF;AAEA,SAAS,oCACP,UACA,SACU;AACV,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,aAAa,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AAC7D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,CAAC,GAAG,SAAS,WAAW,OAAO,CAAC,WAAW,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC,GAAG,GAAG,OAAO;AAAA,EAChG;AACF;AAEO,SAAS,qCACd,UACA,SACU;AACV,SAAO,oCAAoC,UAAU,QAAQ,IAAI,2BAA2B,CAAC;AAC/F;AAEA,SAAS,mCACP,UACA,OACA,SAC4B;AAC5B,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,EAAE,gBAAgB,CAAC,GAAG,WAAW,CAAC,GAAG,UAAU,CAAC,EAAE;AAAA,EAC3D;AACA,oBAAkB,OAAO,oBAAoB;AAC7C,QAAM,gBAAgB,QAAQ,KAAK,CAAC,WAAW,OAAO,KAAK,OAAO,WAAW,CAAC,CAAC,EAAE,SAAS,CAAC,IACvF,6BAA6B,QAAQ,IACrC;AACJ,QAAM,cAAc,IAAI,IAAI,SAAS,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AAC1E,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,iBAAyC,CAAC;AAChD,QAAM,YAA2C,CAAC;AAClD,QAAM,WAAuC,CAAC;AAC9C,aAAW,UAAU,SAAS;AAC5B,QAAI,QAAQ,IAAI,OAAO,EAAE,GAAG;AAC1B,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,oCAAoC,OAAO,EAAE;AAAA,MACxD,CAAC;AAAA,IACH;AACA,YAAQ,IAAI,OAAO,EAAE;AACrB,QAAI,4BAA4B,IAAI,OAAO,EAAE,KAAK,YAAY,IAAI,OAAO,EAAE,GAAG;AAC5E,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,iCAAiC,OAAO,EAAE;AAAA,MACrD,CAAC;AAAA,IACH;AACA,UAAM,UAAU,sCAAsC,OAAO,OAAO;AACpE,UAAM,mBAAmB,OAAO;AAAA,MAC9B,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AAAA,QAC7C;AAAA,QACAC,yBAAwB,eAAgB,KAAK;AAAA,MAC/C,CAAC;AAAA,IACH;AACA,mBAAe,KAAK,yBAAyB,MAAM,CAAC;AACpD,cAAU,KAAK;AAAA,MACb,IAAI,OAAO;AAAA,MACX,MAAM,OAAO,QAAQ;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,cAAc,OAAO,gBAAgB;AAAA,MACrC,WAAW,OAAO,aAAa;AAAA,MAC/B,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,eAAe,OAAO,iBAAiB;AAAA,MACvC;AAAA,IACF,CAAC;AACD,aAAS,KAAK;AAAA,MACZ,IAAI,OAAO;AAAA,MACX,MAAM,OAAO,QAAQ;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,aAAa,OAAO,KAAK,gBAAgB,EAAE,KAAK;AAAA,MAChD,mBAAmB;AAAA,MACnB,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,eAAe,OAAO,iBAAiB;AAAA,IACzC,CAAC;AAAA,EACH;AACA,SAAO,EAAE,gBAAgB,WAAW,SAAS;AAC/C;AAEA,SAAS,4CACP,SAC4B;AAC5B,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,EAAE,gBAAgB,CAAC,GAAG,WAAW,CAAC,GAAG,UAAU,CAAC,EAAE;AAAA,EAC3D;AACA,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,UAAU,SAAS;AAC5B,QAAI,QAAQ,IAAI,OAAO,EAAE,GAAG;AAC1B,YAAM,IAAID,gBAAc,KAAK;AAAA,QAC3B,SAAS,8CAA8C,OAAO,EAAE;AAAA,MAClE,CAAC;AAAA,IACH;AACA,YAAQ,IAAI,OAAO,EAAE;AACrB,QAAI,4BAA4B,IAAI,OAAO,EAAE,GAAG;AAC9C,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,6CAA6C,OAAO,EAAE;AAAA,MACjE,CAAC;AAAA,IACH;AAAA,EACF;AAMA,SAAO;AAAA,IACL,gBAAgB,QAAQ,IAAI,8BAA8B;AAAA,IAC1D,WAAW,QAAQ,IAAI,CAAC,YAAY;AAAA,MAClC,GAAG;AAAA,MACH,kBAAkB,EAAE,GAAI,OAAO,oBAAoB,CAAC,EAAG;AAAA,IACzD,EAAE;AAAA,IACF,UAAU,QAAQ,IAAI,CAAC,YAAY;AAAA,MACjC,IAAI,OAAO;AAAA,MACX,MAAM,OAAO,QAAQ;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,aAAa,OAAO,KAAK,OAAO,oBAAoB,CAAC,CAAC,EAAE,KAAK;AAAA,MAC7D,mBAAmB;AAAA,MACnB,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,eAAe,OAAO,iBAAiB;AAAA,IACzC,EAAE;AAAA,EACJ;AACF;AAEA,SAAS,oCAAoC,OAKA;AAC3C,MAAI,MAAM,QAAQ,WAAW,GAAG;AAC9B,WAAO,CAAC;AAAA,EACV;AACA,oBAAkB,MAAM,OAAO,oBAAoB;AACnD,QAAM,gBAAgB,6BAA6B,MAAM,QAAQ;AACjE,QAAM,WAAW,IAAI,IAAI,MAAM,QAAQ,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AAC5E,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,mBAAmB,MAAM,QAAQ,IAAI,CAAC,WAAW;AACrD,QAAI,QAAQ,IAAI,OAAO,EAAE,GAAG;AAC1B,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,+CAA+C,OAAO,EAAE;AAAA,MACnE,CAAC;AAAA,IACH;AACA,YAAQ,IAAI,OAAO,EAAE;AACrB,QAAI,CAAC,SAAS,IAAI,OAAO,EAAE,GAAG;AAC5B,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,kCAAkC,OAAO,EAAE;AAAA,MACtD,CAAC;AAAA,IACH;AACA,UAAM,UAAU,sCAAsC,OAAO,OAAO;AACpE,WAAO;AAAA,MACL,IAAI,OAAO;AAAA,MACX,kBAAkB,OAAO;AAAA,QACvB,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AAAA,UAC7C;AAAA,UACAC,yBAAwB,eAAe,KAAK;AAAA,QAC9C,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAiBA,eAAsB,iCAAiC,OAyGrB;AAChC,QAAM,kBAAkB;AAAA,IACtB,GAAG,MAAM;AAAA,IACT,OAAO,MAAM;AAAA,IACb,iBAAiB,MAAM;AAAA,IACvB,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,EAC9E;AAKA,MAAI,MAAM,sBAAsB;AAC9B,UAAM,cAAc,MAAM,sCAAsC,MAAM,IAAI;AAAA,MACxE,GAAI,MAAM,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;AAAA,MACnF,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,gBAAgB,MAAM;AAAA,MACtB,yBAAyB,MAAM,oBAAoB;AAAA,MACnD,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM,UAAU,CAAC;AAAA,MACzB,OAAO,MAAM;AAAA,MACb,YAAY,MAAM;AAAA,MAClB,UAAU;AAAA,MACV,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,MACxD,GAAI,MAAM,mBAAmB,EAAE,kBAAkB,MAAM,iBAAiB,IAAI,CAAC;AAAA,MAC7E,gBAAgB,MAAM,kBAAkB;AAAA,MACxC,OAAO,MAAM;AAAA,MACb,gBAAgB,MAAM;AAAA,MACtB,eAAe,MAAM,aAAa,MAAM;AAAA,MACxC,OAAO,MAAM,SAAS;AAAA,MACtB,cAAc,MAAM,gBAAgB;AAAA,MACpC,WAAW,MAAM,aAAa;AAAA,MAC9B,0BAA0B,MAAM,4BAA4B;AAAA,MAC5D,oBAAoB,MAAM;AAAA,MAC1B,cAAc,MAAM,gBAAgB;AAAA,MACpC,YAAY,MAAM,cAAc;AAAA,MAChC,iBAAiB,MAAM,mBAAmB;AAAA,MAC1C,sBAAsB,MAAM;AAAA,MAC5B,gBAAgB,MAAM,kBAAkB;AAAA,MACxC,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,MACxD,YAAY,MAAM,cAAc,CAAC;AAAA,MACjC,+BAA+B,MAAM,iCAAiC,CAAC;AAAA,MACvE,GAAI,MAAM,sCACN;AAAA,QACE,4CAA4C,MAAM;AAAA,MACpD,IACA,CAAC;AAAA,MACL,6BAA6B,MAAM,+BAA+B;AAAA,MAClE,+BAA+B,MAAM,iCAAiC;AAAA,MACtE,WAAW,MAAM,aAAa;AAAA,MAC9B,GAAI,MAAM,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;AAAA,IACrF,CAAC;AACD,QAAI,YAAY,QAAQ;AACtB,YAAM,IAAI,wBAAwB,mBAAmB,MAAM,YAAY,MAAM,CAAC;AAAA,IAChF;AACA,UAAM,EAAE,SAAS,OAAO,QAAQ,IAAI;AACpC,QAAI,CAAC,SAAS;AACZ,YAAMC,YAAW,MAAM;AAAA,QACrB,MAAM,qBAAqB,EAAE,GAAG,OAAO,mBAAmB,KAAK,IAAI;AAAA,QACnE;AAAA,MACF;AACA,aAAO;AAAA,QACL,SAASA,UAAS;AAAA,QAClB,SAASA,UAAS,UAAU,aAAa;AAAA,QACzC,QAAQ,CAACA,UAAS;AAAA,QAClB,SAASA,UAAS;AAAA,MACpB;AAAA,IACF;AACA,UAAMA,YAAW,MAAM,mBAAmB,OAAO,KAAK;AACtD,WAAO;AAAA,MACL,SAASA,UAAS;AAAA,MAClB,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,SAAS;AAAA,IACX;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,cAAc,MAAM,IAAI;AAAA,MACtC,GAAI,MAAM,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;AAAA,MACnF,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,gBAAgB,MAAM;AAAA,MACtB,yBAAyB,MAAM,oBAAoB;AAAA,MACnD,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM,UAAU,CAAC;AAAA,MACzB,OAAO,MAAM;AAAA,MACb,YAAY,MAAM;AAAA,MAClB,UAAU;AAAA,MACV,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,MACxD,GAAI,MAAM,mBAAmB,EAAE,kBAAkB,MAAM,iBAAiB,IAAI,CAAC;AAAA,MAC7E,gBAAgB,MAAM,kBAAkB;AAAA,MACxC,OAAO,MAAM;AAAA,MACb,gBAAgB,MAAM;AAAA,MACtB,eAAe,MAAM,aAAa,MAAM;AAAA,MACxC,OAAO,MAAM,SAAS;AAAA,MACtB,cAAc,MAAM,gBAAgB;AAAA,MACpC,WAAW,MAAM,aAAa;AAAA,MAC9B,0BAA0B,MAAM,4BAA4B;AAAA,MAC5D,oBAAoB,MAAM;AAAA,MAC1B,cAAc,MAAM,gBAAgB;AAAA,MACpC,YAAY,MAAM,cAAc;AAAA,MAChC,iBAAiB,MAAM,mBAAmB;AAAA,MAC1C,gBAAgB,MAAM,kBAAkB;AAAA,MACxC,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,MACxD,YAAY,MAAM,cAAc,CAAC;AAAA,MACjC,+BAA+B,MAAM,iCAAiC,CAAC;AAAA,MACvE,GAAI,MAAM,sCACN;AAAA,QACE,4CAA4C,MAAM;AAAA,MACpD,IACA,CAAC;AAAA,MACL,6BAA6B,MAAM,+BAA+B;AAAA,MAClE,+BAA+B,MAAM,iCAAiC;AAAA,MACtE,WAAW,MAAM,aAAa;AAAA,MAC9B,GAAI,MAAM,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;AAAA,IACrF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,2BAA2B;AAC9C,YAAM,IAAI,wBAAwB,mBAAmB,MAAM,MAAM,MAAM,CAAC;AAAA,IAC1E;AACA,UAAM;AAAA,EACR;AACA,QAAM,WAAW,MAAM,mBAAmB,OAAO,OAAO;AACxD,SAAO;AAAA,IACL,SAAS,SAAS;AAAA,IAClB,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,SAAS;AAAA,EACX;AACF;AAGA,eAAsB,sBACpB,OACgC;AAChC,UAAQ,MAAM,iCAAiC,KAAK,GAAG;AACzD;AAQA,eAAe,mBACb,OA4BA,SAC+D;AAM/D,MAAI,MAAM,mBAAmB;AAC3B,QAAI,QAAQ,mBAAmB,QAAQ;AACrC,YAAM,IAAIF,gBAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM,MAAoB;AAAA,MACxB,WAAW,QAAQ;AAAA,MACnB,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,MACnB,gBAAgB,QAAQ;AAAA,MACxB,gBAAgB,QAAQ;AAAA,IAC1B;AACA,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,kBAAkB;AAAA,QAClC,KAAK,MAAM;AAAA,MACb;AAAA,MACA;AAAA,MACA,MAAM,kBAAkB;AAAA;AAAA;AAAA,MAGxB,MAAM,kBAAkB,cAAc;AAAA,IACxC;AACA,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,yBAAyB,MAAM,kBAAkB,SAAS,KAAK,OAAO,UAAU,0BAA0B;AAAA,MACrH,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,UAAU,MAAM,iCAAiC,MAAM,IAAI;AAAA,IAC/D,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,WAAW,QAAQ;AAAA,IACnB,GAAI,MAAM,gBAAgB,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,IACpE,yBAAyB,MAAM;AAAA,IAC/B,qBAAqB,MAAM;AAAA,IAC3B,qBAAqB;AAAA,MACnB,YAAY,MAAM;AAAA,MAClB,GAAI,MAAM,cACN;AAAA,QACE,eAAe,MAAM,YAAY;AAAA,QACjC,iBAAiB,MAAM,YAAY;AAAA,MACrC,IACA,CAAC;AAAA,MACL,GAAI,MAAM,mBAAmB,SAAS,EAAE,YAAY,MAAM,kBAAkB,IAAI,CAAC;AAAA,IACnF;AAAA,IACA,MAAM,MAAM,OACR;AAAA,MACE,MAAM,MAAM,KAAK;AAAA,MACjB,GAAI,MAAM,KAAK,oBAAoB,SAC/B,EAAE,iBAAiB,MAAM,KAAK,gBAAgB,IAC9C,CAAC;AAAA,MACL,GAAI,MAAM,KAAK,yBAAyB,SACpC,EAAE,sBAAsB,MAAM,KAAK,qBAAqB,IACxD,CAAC;AAAA,IACP,IACA;AAAA,IACJ,wBAAwB,MAAM,0BAA0B;AAAA,IACxD,kBAAkB,MAAM,qBAAqB;AAAA,EAC/C,CAAC;AACD,QAAM,4BAA4B,MAAM,KAAK,QAAQ,aAAa,QAAQ,IAAI,QAAQ,MAAM;AAC5F,MAAI,QAAQ,yBAAyB,MAAM;AACzC,UAAM,MAAM,eAAe,oBAAoB;AAAA,MAC7C,WAAW,QAAQ;AAAA,MACnB,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,MACnB,YAAY,QAAQ;AAAA,MACpB,cAAc,QAAQ;AAAA,IACxB,CAAC;AAAA,EACH;AACA,QAAM,YAAY,MAAMG,gBAAe,MAAM,IAAI,QAAQ,aAAa,QAAQ,EAAE;AAChF,QAAM,gBACJ,QAAQ,MAAM,OACb,MAAM,iBAAiB,MAAM,IAAI,QAAQ,aAAa,QAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,MAC3E;AACF,SAAO;AAAA,IACL,SAAS,EAAE,GAAG,WAAW,cAAc;AAAA,IACvC,SAAS,QAAQ;AAAA,EACnB;AACF;AAEO,SAAS,qBAAqB,WAA2B;AAC9D,SAAO,WAAW,SAAS;AAC7B;AAkBO,SAAS,yBACd,UACA,OAC2B;AAC3B,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,8BAA8B,UAAU,KAAK;AACpE,MAAI,wBAAwB,QAAQ,EAAE,SAAS,cAAc,GAAG;AAC9D,WAAO;AAAA,EACT;AAOA,MAAI,SAAS,4BAA4B,eAAe,WAAW,qBAAqB,GAAG;AACzF,WAAO;AAAA,EACT;AAKA,MACE,SAAS,gCACT,eAAe,WAAW,gCAAgC,GAC1D;AACA,WAAO;AAAA,EACT;AACA,MAAI,eAAe,WAAW,iCAAiC,GAAG;AAChE,WAAO;AAAA,EACT;AACA,QAAM,IAAIH,gBAAc,KAAK,EAAE,SAAS,2BAA2B,KAAK,GAAG,CAAC;AAC9E;AAEO,SAAS,sBAAsB,UAAoB,OAAwC;AAChG,2BAAyB,UAAU,KAAK;AAC1C;AAEO,IAAM,sCAAsC;AAG5C,IAAM,uCAAN,cAAmD,MAAM;AAAA,EACrD,OAAO;AAAA,EACP;AAAA,EAET,YAAY,gBAAwB;AAClC;AAAA,MACE,2DAA2D,cAAc;AAAA,IAC3E;AACA,SAAK,OAAO;AACZ,SAAK,iBAAiB;AAAA,EACxB;AACF;AAMO,SAAS,gCACd,SACA,gBACM;AACN,MAAI,mBAAmB,QAAQ,mBAAmB,OAAW;AAC7D,MAAI,QAAQ,wBAAwB,YAAa;AACjD,MAAI,mBAAmB,cAAc,EAAG;AACxC,QAAM,IAAI,qCAAqC,cAAc;AAC/D;AAaA,eAAsB,iCACpB,IACA,UACA,aACA,OACe;AACf,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC;AAAA,EACF;AACA,QAAM,iBAAiB,yBAAyB,UAAU,KAAK;AAC/D,MAAI,mBAAmB,QAAQ,mBAAmB,QAAW;AAC3D;AAAA,EACF;AACA,QAAM,SAAS,MAAM,wBAAwB,IAAI,WAAW;AAC5D,MAAI,CAAC,QAAQ;AACX;AAAA,EACF;AACA,QAAM,aAAa,yBAAyB,UAAU,cAAc;AACpE,QAAM,UAAU,6BAA6B,QAAQ;AAAA,IACnD;AAAA,IACA,SAAS;AAAA,EACX,CAAC;AACD,MAAI,CAAC,QAAQ,SAAS;AACpB,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SACE,QAAQ,WAAW,aACf,UAAU,cAAc,gEAAgE,UAAU,sCAClG,UAAU,cAAc;AAAA,IAChC,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,wBACpB,IACA,aACA,WACA,QACsB;AACtB,QAAM,OAAO,MAAM,eAAe,IAAI,aAAa,MAAM;AACzD,MAAI,CAAC,QAAQ,KAAK,cAAc,WAAW;AACzC,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,yBAAyB,CAAC;AAAA,EACpE;AACA,MAAI,KAAK,WAAW,UAAU;AAC5B,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS,WAAW,KAAK,MAAM;AAAA,IACjC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEO,SAAS,0BACd,UACA,UACmC;AACnC,SAAO,2BAA2B,UAAU,QAAQ;AACtD;AAEO,SAAS,sBACd,UACA,WAA6C,YACX;AAClC,SAAO,uBAAuB,UAAU,QAAQ;AAClD;AASA,eAAsB,oBAAoB,OAkCvC;AACD,QAAM,EAAE,IAAI,KAAK,gBAAgB,UAAU,WAAW,aAAa,UAAU,IAAI;AACjF,QAAM,iBAAiB,yBAAyB,UAAU,MAAM,SAAS,IAAI,KAAK;AAClF,QAAM,2BAA2B,MAAM,mBAAmB;AAG1D,wBAAsB,UAAU,cAAc;AAC9C,QAAM,iCAAiC,IAAI,UAAU,aAAa,cAAc;AAChF,QAAM,sBAAsB,MAAMG,gBAAe,IAAI,aAAa,SAAS;AAC3E,QAAM,wBAAwB,kBAAkB,oBAAoB;AACpE,MAAI;AACF,oCAAgC,qBAAqB,qBAAqB;AAAA,EAC5E,SAAS,OAAO;AACd,QAAI,iBAAiB,sCAAsC;AACzD,YAAM,IAAIH,gBAAc,KAAK,EAAE,SAAS,MAAM,SAAS,OAAO,MAAM,CAAC;AAAA,IACvE;AACA,UAAM;AAAA,EACR;AACA,QAAM,eAAe,MAAM,iBAAiB,OAAO,WAAW;AAC9D,MAAI;AACJ,MAAI;AACF,aAAS,MAAM;AAAA,MACb;AAAA,QACE,OAAO;AAAA,QACP,YAAY,CAAC,gBAAgB,eAAe,wBAAwB;AAAA,QACpE,aAAa;AAAA,MACf;AAAA,MACA,YACE,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA,MAAM,SAAS;AAAA,QACf,CAAC,WACC,+BAA+B,QAAQ;AAAA,UACrC;AAAA,UACA;AAAA,UACA;AAAA,UACA,WAAW,MAAM,SAAS;AAAA,UAC1B,GAAI,MAAM,aAAa,EAAE,cAAc,MAAM,WAAW,IAAI,CAAC;AAAA,UAC7D,OAAO,MAAM,gBAAgB;AAAA,YAC3B,MAAM;AAAA,YACN,WAAW,MAAM,SAAS;AAAA,UAC5B;AAAA,UACA;AAAA,UACA,UAAU,MAAM,YAAY;AAAA,UAC5B,aAAa,MAAM,eAAe;AAAA,UAClC,uBAAuB,MAAM,yBAAyB;AAAA,UACtD,MAAM,MAAM;AAAA,UACZ,aAAa,MAAM,eAAe,CAAC;AAAA,UACnC,kBAAkB,MAAM,oBAAoB;AAAA,UAC5C,WAAW,MAAM;AAAA,UACjB,OAAO;AAAA,UACP,iBAAiB;AAAA,UACjB,aAAa,MAAM,eAAe;AAAA,UAClC,yBACE,MAAM,2BAA2B,SAAS;AAAA,UAC5C,qBAAqB,MAAM;AAAA,UAC3B,QAAQ,MAAM,WAAW,aAAa,QAAQ;AAAA,UAC9C,GAAI,MAAM,wBAAwB,SAC9B,EAAE,qBAAqB,MAAM,oBAAoB,IACjD,CAAC;AAAA,UACL,+BAA+B,MAAM,iCAAiC,CAAC;AAAA,UACvE,sBAAsB,MAAM,wBAAwB,CAAC;AAAA,QACvD,CAAC;AAAA,MACL;AAAA,IACJ;AAAA,EACF,SAAS,OAAO;AACd,QACE,iBAAiB,6BACjB,iBAAiB,6BACjB;AACA,YAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,IACzD;AACA,QAAI,iBAAiB,SAAS,MAAM,QAAQ,SAAS,WAAW,GAAG;AACjE,YAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,IACzD;AACA,QAAI,iBAAiB,SAAS,MAAM,QAAQ,WAAW,4BAA4B,GAAG;AACpF,YAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,IACzD;AACA,UAAM;AAAA,EACR;AACA,QAAM,iBAAiB,YAAY;AACjC,QAAI;AACF,YAAM,4BAA4B,KAAK,aAAa,WAAW,OAAO,MAAM;AAC5E,UAAI,OAAO,yBAAyB;AAClC,cAAM,eAAe,MAAM;AAAA,UACzB;AAAA,UACA;AAAA,UACA,OAAO;AAAA,QACT;AACA,YAAI,CAAC,cAAc;AACjB,gBAAM,IAAI;AAAA,YACR,kDAAkD,OAAO,uBAAuB;AAAA,UAClF;AAAA,QACF;AACA,cAAM,oCAAoC,KAAK,aAAa,YAAY;AAAA,MAC1E;AAAA,IACF,QAAQ;AACN,cAAQ,KAAK,yEAAyE;AAAA,QACpF,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AACA,QAAI;AACF,YAAM,eAAe,oBAAoB;AAAA,QACvC;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,OAAO,KAAK;AAAA,QACxB,cAAc,OAAO;AAAA,QACrB,IAAK,MAAM,YAAY,YAAY,WAAW,OAAO,oBAAoB,IACrE,EAAE,uBAAuB,KAAK,IAC9B,CAAC;AAAA,MACP,CAAC;AAAA,IACH,QAAQ;AACN,cAAQ,KAAK,8DAA8D;AAAA,QACzE,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,qBACJ,MAAM,uBACL,CAAC,SAA8B;AAC9B,SAAK,KAAK;AAAA,EACZ;AACF,MAAI;AACF,uBAAmB,cAAc;AAAA,EACnC,QAAQ;AACN,YAAQ,KAAK,6EAA6E;AAAA,MACxF,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,UAAU,OAAO;AAAA,IACjB,MAAM,OAAO;AAAA,IACb,mBAAmB,OAAO;AAAA,IAC1B,QAAQ,OAAO;AAAA,EACjB;AACF;AAWA,eAAsB,mCACpB,MACA,OACA,aACA,YACsC;AACtC,QAAM,EAAE,UAAU,IAAI,KAAK,gBAAgB,cAAc,IAAI;AAC7D,QAAM,UAAU,qBAAqB,MAAM,UAAU;AACrD,MAAI,2CAA2C,QAAQ,QAAQ,GAAG;AAChE,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS,GAAGI,wCAAuC;AAAA,IACrD,CAAC;AAAA,EACH;AAKA,MAAI,QAAQ,gBAAgB;AAC1B,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IACV;AACA,QAAI,QAAQ;AACV,YAAM,IAAI,wBAAwB,mBAAmB,MAAM,MAAM,CAAC;AAAA,IACpE;AAAA,EACF;AAKA,QAAM,kBACJ,OAAO,MAAM,WAAW,WAAW,MAAM,WACpC,MAAM,SAAS,WAAW,IAC3B;AACN,MAAI,iBAAiB;AACnB,QAAI;AACF,YAAM,4BAA4B,MAAM,OAAO;AAAA,QAC7C,WAAW;AAAA,QACX,WAAW;AAAA,QACX,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,iBAAiB,iCAAiC;AACpD,cAAM,IAAIJ,gBAAc,KAAK,EAAE,SAAS,MAAM,SAAS,OAAO,MAAM,CAAC;AAAA,MACvE;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,gBAAgB,kBAAkB,MAAMK,YAAW,IAAI,aAAa,eAAe,IAAI;AAC7F,MAAI,mBAAmB,CAAC,eAAe;AACrC,UAAM,IAAIL,gBAAc,KAAK;AAAA,MAC3B,SAAS,0CAA0C,eAAe;AAAA,IACpE,CAAC;AAAA,EACH;AACA,QAAM,oBAAoB,0BAA0B,KAAK;AACzD,QAAM,oBACJ,iBAAiB,kBAAkB,QAC/B,MAAM,eAAe,IAAI,aAAa,kBAAkB,MAAM,MAAM,IACpE;AACN,MACE,kBAAkB,UACjB,CAAC,qBAAqB,kBAAkB,cAAc,eAAe,KACtE;AACA,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,sCACJ,iBAAiB,kBAAkB,QAC/B,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,kBAAkB,MAAM;AAAA,EAC1B,IACA;AACN,QAAM,4BAA4B,MAAM;AAAA,IACtC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,WAAW,MAAM;AAAA,IACnB;AAAA,EACF;AACA,QAAM,oBAAoB,eAAe,YAAY,YAAY,IAC7D,mCAAmC,2BAA2B,OAAO,QAAQ,UAAU,IACvF,gBACE;AAAA,IACE,MAAM,yCAAyC,IAAI,aAAa,cAAc,EAAE;AAAA,EAClF,IACA,mCAAmC,2BAA2B,OAAO,QAAQ,UAAU;AAC7F,QAAM,kBAAkB;AAAA,IACtB;AAAA,IACA,kBAAkB;AAAA,EACpB;AACA,QAAM,YAAY;AAAA,IAChB,eAAe,YAAY,WAAW,IAClC,QAAQ,YACP,eAAe,aAAa,QAAQ;AAAA,EAC3C;AACA,QAAM,SAAS,eAAe,YAAY,QAAQ,IAC9C,QAAQ,SACP,eAAe,UAAU,QAAQ;AACtC,QAAM,gBAAgB,eAAe,YAAY,OAAO;AACxD,QAAM,iBAAiB;AAAA,IACrB,gBAAgB,QAAQ,QAAS,eAAe,SAAS,QAAQ;AAAA,IACjE;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACJ,MAAI,eAAe;AACjB,UAAM,gCAAgC,cAAc,YAAY,SAAS;AACzE,UAAM,kBAAkB;AAAA,MACtB,gCACI;AAAA,QACE,kBAAkB,cAAc,OAAO,eAAe;AAAA,QACtD;AAAA,QACA;AAAA,MACF,IACA,cAAc;AAAA,MAClB;AAAA,IACF;AACA,QAAI,eAAe;AACjB;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,sBAAgB;AAChB,mBAAa;AAAA,QACX,MAAM;AAAA,QACN,wBAAwB,cAAc;AAAA,MACxC;AAAA,IACF,OAAO;AACL,sBAAgB;AAChB,mBAAa;AAAA,QACX,MAAM,gCAAgC,sBAAsB;AAAA,QAC5D,wBAAwB,cAAc;AAAA,MACxC;AAAA,IACF;AAAA,EACF,WAAW,eAAe;AACxB,oBAAgB;AAChB,iBAAa,EAAE,MAAM,YAAY,wBAAwB,KAAK;AAAA,EAChE,OAAO;AACL,oBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,iBAAa,EAAE,MAAM,qBAAqB,wBAAwB,KAAK;AAAA,EACzE;AAKA,QAAM,QAAQ,oBAAoB,eAAe,eAAe;AAChE,QAAM,gCAAgC,MAAM,oCAAoC;AAAA,IAC9E;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV;AAAA,IACA,QAAQ,2CAA2C,KAAK;AAAA,EAC1D,CAAC;AACD,QAAM,kCAAkC,IAAI,aAAa,SAAS;AAClE,MAAI,UAAU,KAAK,CAAC,aAAa,SAAS,SAAS,MAAM,KAAK,CAAC,eAAe;AAC5E,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,sBAAsB,IAAI,aAAa,SAAS;AAItD,QAAM,cAAc,QAAQ,gBACxB,MAAM;AAAA,IACJ,EAAE,UAAU,GAAG;AAAA,IACf;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACV,IACA;AAYJ,QAAM,iBACJ,QAAQ,UAAU,SAAY,MAAM,yBAAyB,IAAI,WAAW,IAAI,QAAQ;AAC1F,MAAI,cAA6B;AACjC,MAAI,qBAAoC;AACxC,MAAI,gBAAgB;AAClB,UAAM,MAAM,MAAMM,QAAO,IAAI,aAAa,cAAc;AACxD,QAAI,CAAC,OAAO,CAAC,IAAI,eAAe;AAC9B,UAAI,QAAQ,OAAO;AACjB,cAAM,IAAIN,gBAAc,KAAK;AAAA,UAC3B,SAAS,MACL,OAAO,QAAQ,KAAK,mCACpB,kBAAkB,QAAQ,KAAK;AAAA,QACrC,CAAC;AAAA,MACH;AAAA,IAEF,OAAO;AACL,oBAAc,IAAI;AAClB,2BAAqB,IAAI,cAAc;AAAA,IACzC;AAAA,EACF;AAKA,MAAI,YAA2B;AAC/B,MAAI,QAAQ,WAAW;AACrB,UAAM,UAAU,MAAM,WAAW,IAAI,aAAa,QAAQ,SAAS;AACnE,QAAI,CAAC,SAAS;AACZ,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,sBAAsB,QAAQ,SAAS;AAAA,MAClD,CAAC;AAAA,IACH;AACA,gBAAY,QAAQ;AAAA,EACtB;AAOA,QAAM,iBAAiB,mBAAmB,SAAS,eAAe,SAAS,SAAS;AACpF,QAAM,QAAQ,yBAAyB,UAAU,QAAQ,SAAS,cAAc;AAChF,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAKA,QAAM,iCAAiC,IAAI,UAAU,aAAa,KAAK;AACvE,QAAM,2BACJ,mBAAmB,oBAClB,gBACG,0BAA0B,cAAc,UAAU,SAAS,qBAAqB,IAChF,SAAS;AACf,QAAM,uBACJ,mBAAmB,gBAClB,gBAAgB,sBAAsB,cAAc,UAAU,UAAU,IAAI;AAC/E,QAAM,kBAAkB,QAAQ,mBAAmB;AACnD,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,sBAAsB,kBAAkB;AAC9C,QAAM,sBAAsB,6BAA6B,UAAU;AAAA,IACjE,SAAS;AAAA,IACT,kBAAkB,QAAQ,SAAS;AAAA,IACnC,aACE,QAAQ,UAAU,SACd,sBACE,iBACA,eACF;AAAA,IACN;AAAA,IACA,iBACE,QAAQ,oBAAoB,SACxB,sBACE,iBACA,eACF;AAAA,IACN;AAAA,IACA,mBACE,QAAQ,gBAAgB,SACpB,sBACE,iBACA,eACF;AAAA,EACR,CAAC;AAWD,QAAM,iCAAiC,gBACnC,CAAC,GAAI,cAAc,4BAA4B,mCAAoC,IACnF;AACJ,MACE,kCACA,QAAQ,0BAA0B;AAAA,IAChC,CAAC,eAAe,CAAC,cAAc,gCAAgC,UAAU;AAAA,EAC3E,GACA;AACA,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAKA,MAAI,2BACF,QAAQ,6BACP,iCACG,+BAA+B;AAAA,IAAO,CAAC,eACrC,cAAc,MAAM,aAAa,UAAU;AAAA,EAC7C,IACA;AACN,MAAI,4BAA4B,yBAAyB,WAAW,GAAG;AAGrE,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACA,aAAW,cAAc,4BAA4B,CAAC,GAAG;AACvD,QAAI,CAAC,cAAc,MAAM,aAAa,UAAU,GAAG;AACjD,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,sEAAsE,UAAU;AAAA,MAC3F,CAAC;AAAA,IACH;AAAA,EACF;AAOA,MACE,QAAQ,QACR,4BACA,CAAC,yBAAyB,SAAS,cAAc,GACjD;AACA,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AAIA,QAAM,oCAAoC,+BAA+B,QAAQ;AACjF,QAAM,8BAA8B,QAAQ,oBAAoB;AAAA,IAC9D,CAAC,SAAS,CAAC,kCAAkC,QAAQ,SAAS,IAAI;AAAA,EACpE;AACA,MAAI,6BAA6B;AAC/B,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS,0DAA0D,2BAA2B;AAAA,IAChG,CAAC;AAAA,EACH;AACA,QAAM,qBAAqB;AAAA,IACzB,QAAQ;AAAA,IACR,gBAAgB,cAAc,qBAAqB;AAAA,IACnD;AAAA,EACF;AACA,MAAI,QAAQ,MAAM;AAChB,UAAM,mBAAmB,CAAC,eAAe,iBAAiB,iBAAiB,YAAY,EAAE;AAAA,MACvF,CAAC,SAAS,CAAC,mBAAmB,SAAS,IAA6B;AAAA,IACtE;AACA,QAAI,iBAAiB,SAAS,GAAG;AAC/B,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,wDAAwD,iBAAiB,KAAK,IAAI,CAAC;AAAA,MAC9F,CAAC;AAAA,IACH;AAAA,EACF;AA4BA,QAAM,gBAAgB,QAAQ,YAAY,kBAAkB,WAAW;AACvE,MAAI,iBAAgC;AACpC,MAAI;AAkBJ,QAAM,yBAAyB,QAAQ,iBAAiB;AACxD,QAAM,0BAA0B,CAAC,wBAC/B,wBAAwB;AAU1B,QAAM,yBAAyB,CAAC,uBAC9B,uBAAuB;AACzB,MAAI,kBAAkB,UAAU;AAC9B,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SACE;AAAA,MACJ,CAAC;AAAA,IACH;AACA,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AACA,UAAM,SAAS;AACf,UAAM,cAAc,OAAO,mBAAmB;AAC9C,UAAM,sBACJ,eAAe,CAAC,wBAAwB,OAAO,iBAAiB,IAAI;AACtE,QAAI,cAAc,eAAe,CAAC,uBAAuB,OAAO,gBAAgB,IAAI;AACpF,QAAI,eAAe,CAAC,aAAa;AAC/B,YAAM,sBAAsB,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,QACA,OAAO;AAAA,MACT;AACA,oBAAc,CAAC,oBAAoB;AAAA,QAAM,CAAC,uBACxC,uBAAuB,kBAAkB;AAAA,MAC3C;AAAA,IACF;AACA,QAAI,uBAAuB,aAAa;AACtC,UAAI,QAAQ,YAAY,UAAU;AAKhC,cAAM,IAAIA,gBAAc,KAAK;AAAA,UAC3B,SAAS,sBACL,mOACA;AAAA,QACN,CAAC;AAAA,MACH;AAAA,IAKF,OAAO;AACL,uBAAiB,OAAO;AACxB,yBAAmB,OAAO;AAAA,IAC5B;AAAA,EACF,WAAW,OAAO,kBAAkB,UAAU;AAC5C,UAAM,SAAS,MAAM,qBAAqB,IAAI,aAAa,cAAc,OAAO;AAChF,QAAI,CAAC,QAAQ;AACX,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,yCAAyC,cAAc,OAAO;AAAA,MACzE,CAAC;AAAA,IACH;AACA,QAAI,OAAO,mBAAmB,QAAQ;AAMpC,YAAM,uBAAuB,MAAM;AAAA,QACjC;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AACA,UACE,CAAC,qBAAqB;AAAA,QAAM,CAAC,wBAC3B,wBAAwB,mBAAmB;AAAA,MAC7C,GACA;AACA,cAAM,IAAIA,gBAAc,KAAK;AAAA,UAC3B,SAAS,iBAAiB,cAAc,OAAO;AAAA,QACjD,CAAC;AAAA,MACH;AAIA,YAAM,sBAAsB,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AACA,UACE,CAAC,oBAAoB;AAAA,QAAM,CAAC,uBAC1B,uBAAuB,kBAAkB;AAAA,MAC3C,GACA;AACA,cAAM,IAAIA,gBAAc,KAAK;AAAA,UAC3B,SAAS,iBAAiB,cAAc,OAAO;AAAA,QACjD,CAAC;AAAA,MACH;AAAA,IACF;AACA,qBAAiB,cAAc;AAC/B,uBAAmB,OAAO;AAAA,EAC5B;AAMA,MAAI,QAAQ,eAAe,UAAa,CAAC,QAAQ,iBAAiB;AAChE,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AA0BA,MAAI;AACJ,MAAI;AACJ,MACE,QAAQ,mBACR,qBAAqB,UACrB,SAAS,2BACT,SAAS,0BACT;AACA,UAAM,gBAAgB,MAAMO,YAAW,IAAI,aAAa,QAAQ,eAAe;AAC/E,QAAI,eAAe,SAAS,cAAc;AACxC,2BAAqB;AACrB,UAAI,cAAc,cAAc;AAC9B,cAAM,aAAa,MAAMC,eAAc,IAAI,aAAa,cAAc,YAAY;AAClF,YACE,eACC,WAAW,OAAO,WAAW,WAAW,OAAO,aAAa,WAAW,OAAO,UAC/E;AACA,0BAAgB,WAAW;AAAA,QAC7B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,cAAc,YAAY;AACpC,UAAM,aAAa,MAAM;AAAA,MACvB,WAAW,MAAM;AAAA,MACjB;AAAA,MACA,QAAQ;AAAA,MACR,UAAU;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH;AACA,MAAI;AACJ,MAAI;AACF,oBAAgB,MAAM,iCAAiC;AAAA,MACrD,GAAI,QAAQ,qBAAqB,EAAE,oBAAoB,QAAQ,mBAAmB,IAAI,CAAC;AAAA,MACvF;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,MAAM;AAAA,MACjB;AAAA,MACA,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,kBAAkB,QAAQ,cAAc;AAAA,MACxC,kBAAkB,QAAQ,oBAAoB;AAAA,MAC9C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,QAAQ,gBAAgB,EAAE,eAAe,QAAQ,cAAc,IAAI,CAAC;AAAA,MACxE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,gBACE,oBAAoB,sBAAsB,QAAQ,kBAAkB,SAAS;AAAA;AAAA;AAAA;AAAA,MAI/E,GAAI,gBAAgB,EAAE,WAAW,cAAc,IAAI,CAAC;AAAA,MACpD;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,GAAI,kBAAkB,YAAY,EAAE,WAAW,kBAAkB,UAAU,IAAI,CAAC;AAAA,MAChF,GAAI,kBAAkB,UAAU,EAAE,kBAAkB,kBAAkB,QAAQ,IAAI,CAAC;AAAA,MACnF,gBAAgB,kBAAkB,SAAS;AAAA,MAC3C,aAAa,cAAc,EAAE,IAAI,YAAY,IAAI,MAAM,YAAY,KAAK,IAAI;AAAA;AAAA,MAE5E,OAAO;AAAA,MACP,cAAc;AAAA,MACd;AAAA,MACA,MAAM,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA,MAItB,cAAc,QAAQ,gBAAgB;AAAA,MACtC,YAAY,QAAQ,cAAc;AAAA,MAClC;AAAA,MACA;AAAA,MACA,YAAY,kBAAkB;AAAA,MAC9B,mBAAmB,kBAAkB;AAAA,MACrC;AAAA,MACA,GAAI,sCAAsC,EAAE,oCAAoC,IAAI,CAAC;AAAA,MACrF;AAAA,MACA,sBAAsB,QAAQ,kBAAkB;AAAA,MAChD,6BAA6B,QAAQ,uBAAuB;AAAA,MAC5D,+BAA+B,cAAc,MAAM,aAAa,iBAAiB;AAAA,MACjF,WAAW,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,MAKjB,mBAAmB,QAAQ,kBACvB;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB;AAAA,QACA,YAAY,QAAQ,cAAc;AAAA,MACpC,IACA;AAAA,MACJ,wBACE,QAAQ,oCAAoC,SACxC;AAAA,QACE,WAAW,MAAM;AAAA,QACjB,kBAAkB,QAAQ;AAAA,MAC5B,IACA;AAAA,IACR,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,4BAA4B;AAC/C,YAAM,IAAIR,gBAAc,KAAK,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,IACzD;AACA,QAAI,iBAAiB,wBAAwB;AAC3C,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR;AACA,MAAI,iBAAgE;AACpE,MAAI,QAAQ,cAAc,YAAY;AACpC,QAAI;AACF,YAAM,qBAAqB,MAAM;AAAA,QAC/B,WAAW,MAAM;AAAA,QACjB;AAAA,QACA,WAAW,MAAM;AAAA,QACjB,WAAW;AAAA,QACX,UAAU;AAAA,QACV,MAAM;AAAA,QACN,oBAAoB;AAAA,QACpB,kBAAkB,cAAc,QAAQ;AAAA,QACxC,WAAW,cAAc,QAAQ;AAAA,QACjC,WAAW,cAAc,QAAQ;AAAA,QACjC,kBAAkB,cAAc,QAAQ;AAAA,QACxC,QAAQ,kBAAkB,QAAQ,WAAW;AAAA,QAC7C,gBAAgB,qBAAqB,WAAW,IAAI,cAAc,QAAQ,EAAE;AAAA,MAC9E,CAAC;AAAA,IACH,SAAS,OAAO;AACd,uBAAiB;AACjB,yCAAmC,KAAK;AAAA,IAC1C;AAAA,EACF;AACA,SAAO,EAAE,GAAG,eAAe,eAAe;AAC5C;AAGO,SAAS,mCAAmC,QAAuB;AACxE,UAAQ;AAAA,IACN;AAAA,IACA;AAAA,MACE,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,QAAQ;AAAA,IACV;AAAA,EACF;AACF;AAGA,eAAsB,wBACpB,MACA,OACA,aACA,YACgC;AAChC,UAAQ,MAAM,mCAAmC,MAAM,OAAO,aAAa,UAAU,GAAG;AAC1F;AASA,eAAsB,oCACpB,MACA,OACA,aACA,WACA,OAoBC;AACD,QAAM,EAAE,UAAU,IAAI,KAAK,gBAAgB,cAAc,IAAI;AAC7D,QAAM,4BAA4B,yBAAyB,KAAK;AAChE,QAAM,4BAA4B,MAAM,OAAO;AAAA,IAC7C;AAAA,IACA,WAAW,MAAM,aAAa,UAAU,kBAAkB;AAAA,IAC1D,SAAS;AAAA,EACX,CAAC;AAID,QAAM,kBAAkB,MAAMG,gBAAe,IAAI,aAAa,SAAS;AACvE,QAAM,iBAAiB,yBAAyB,UAAU,MAAM,SAAS,IAAI,KAAK;AAClF,QAAM,iBACJ,yBAAyB,UAAU,kBAAkB,gBAAgB,KAAK,KAAK;AACjF,MAAI,mBAAmB,MAAM;AAC3B,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,MAAI;AACF,oCAAgC,iBAAiB,cAAc;AAAA,EACjE,SAAS,OAAO;AACd,QAAI,iBAAiB,sCAAsC;AACzD,YAAM,IAAIH,gBAAc,KAAK,EAAE,SAAS,MAAM,SAAS,OAAO,MAAM,CAAC;AAAA,IACvE;AACA,UAAM;AAAA,EACR;AACA,QAAM,yBAAyB;AAAA,IAC7B,gBAAgB;AAAA,IAChB,SAAS;AAAA,EACX;AACA,QAAM,2BAA2B,MAAM,mBAAmB;AAC1D,QAAM,qBAAqB,sBAAsB,gBAAgB,UAAU,UAAU;AACrF,QAAM,uBAAuB,MAAM,eAAe;AAClD,QAAM,sBAAsB,6BAA6B,UAAU;AAAA,IACjE,SAAS;AAAA,IACT,kBAAkB,MAAM,SAAS;AAAA,IACjC,aAAa,MAAM,SAAS,OAAO,YAAY;AAAA,IAC/C,iBAAiB;AAAA,IACjB,iBAAiB,MAAM,mBAAmB,OAAO,YAAY;AAAA,IAC7D,aAAa;AAAA,IACb,mBAAmB,MAAM,eAAe,OAAO,YAAY;AAAA,EAC7D,CAAC;AACD,QAAM,qBAAqB,mBAAmB,MAAM,aAAa,CAAC,CAAC;AACnE,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,eAAe,CAAC;AAAA,EACxB;AACA,QAAM,aAAa,MAAM;AAAA,IACvB,WAAW,MAAM;AAAA,IACjB;AAAA,IACA,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AACD,MAAI,mBAAmB,KAAK,CAAC,aAAa,SAAS,SAAS,MAAM,KAAK,CAAC,eAAe;AACrF,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,sBAAsB,IAAI,aAAa,kBAAkB;AAC/D,QAAM,kCAAkC,IAAI,aAAa;AAAA,IACvD,GAAG,gBAAgB;AAAA,IACnB,GAAG;AAAA,EACL,CAAC;AACD,QAAM,uBAAuB,oCAAoC;AAAA,IAC/D;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,SAAS,MAAM,wBAAwB,CAAC;AAAA,EAC1C,CAAC;AACD,QAAM,kBAAkB,MAAM,wCAAwC,IAAI,aAAa,UAAU;AAAA,IAC/F,WAAW,MAAM;AAAA,EACnB,CAAC;AACD,QAAM,gCAAgC,MAAM,oCAAoC;AAAA,IAC9E;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV,OAAO,gBAAgB;AAAA,IACvB,QAAQ,2CAA2C,KAAK;AAAA,EAC1D,CAAC;AACD,QAAM,EAAE,UAAU,MAAM,mBAAmB,OAAO,IAAI,MAAM,oBAAoB;AAAA,IAC9E;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,MAAM,MAAM;AAAA,IACZ;AAAA,IACA,kBAAkB,MAAM,oBAAoB;AAAA,IAC5C,WAAW;AAAA,IACX,OAAO,MAAM,SAAS;AAAA,IACtB,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,aAAa,MAAM,eAAe;AAAA,IAClC,yBAAyB;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,MAAM,YAAY;AAAA,IAC5B,QAAQ,4BAA4B,aAAc,MAAM,UAAU;AAAA,IAClE,OAAO,MAAM;AAAA,IACb,GAAI,MAAM,eAAe,EAAE,YAAY,MAAM,aAAa,IAAI,CAAC;AAAA,IAC/D,GAAI,4BACA;AAAA,MACE,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,WAAW,0BAA0B,UAAU;AAAA,QAC/C,GAAI,0BAA0B,UAAU,QACpC,EAAE,cAAc,0BAA0B,UAAU,MAAM,IAC1D,CAAC;AAAA,QACL,SAAS,0BAA0B;AAAA,MACrC;AAAA,IACF,IACA,CAAC;AAAA,IACL,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,IAC5E,GAAI,MAAM,0BAA0B,SAChC,EAAE,uBAAuB,MAAM,sBAAsB,IACrD,CAAC;AAAA,IACL,GAAI,MAAM,gBAAgB,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,IACpE,qBAAqB;AAAA,IACrB,GAAI,KAAK,2BAA2B,EAAE,oBAAoB,KAAK,yBAAyB,IAAI,CAAC;AAAA,EAC/F,CAAC;AACD,SAAO,EAAE,UAAU,MAAM,mBAAmB,OAAO;AACrD;AAGA,eAAsB,yBACpB,MACA,OACA,aACA,WACA,OAMC;AACD,QAAM,EAAE,UAAU,MAAM,mBAAmB,OAAO,IAAI,MAAM;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,EAAE,UAAU,MAAM,mBAAmB,OAAO;AACrD;AAWA,eAAsB,mBACpB,MAKA,OACA,WACA,OACA,QAKC;AACD,QAAM,EAAE,IAAI,IAAI,IAAI;AACpB,QAAM,gBAAgB,MAAM,4BAA4B,MAAM,OAAO;AAAA,IACnE;AAAA,IACA,WAAW;AAAA,IACX,SAAS;AAAA,EACX,CAAC;AACD,QAAM,cAAc,MAAM;AAC1B,QAAM,SAAS,MAAM,sBAAsB,IAAI;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,OAAO,SAAS;AAClB,UAAMS,wBAAuB,IAAI,KAAK,aAAa,WAAW;AAAA,MAC5D;AAAA,QACE,MAAM;AAAA,QACN,SAAS;AAAA,UACP,OAAO,OAAO,SAAS;AAAA,UACvB;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,sBAAsB,eAAe,wBAAwB;AAAA,EAC/D;AACF;AAQA,eAAsB,+BACpB,MAKA,OACA,WACA,UACA,iBACiD;AACjD,QAAM,mBAAmB,yBAAyB,MAAM,eAAe;AACvE,QAAM,4BAA4B,MAAM,OAAO;AAAA,IAC7C;AAAA,IACA,WAAW;AAAA,IACX,SAAS;AAAA,EACX,CAAC;AACD,oBAAkB,OAAO,kBAAkB;AAE3C,QAAM,UAAiD,CAAC;AACxD,QAAM,SAAS,MAAM;AAAA,IACnB,KAAK;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,OAAO,UAAU,YAAY;AAC3B,YAAM,SAAS,MAAM,QAAQ,+BAA+B,UAAU,gBAAgB;AACtF,UAAI,CAAC,OAAO,QAAQ;AAClB,cAAM,IAAIT,gBAAc,KAAK;AAAA,UAC3B,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,cAAQ,SAAS,OAAO;AACxB,aAAO;AAAA,QACL,QAAQ,OAAO,UACX;AAAA,UACE;AAAA,YACE,MAAM;AAAA,YACN,SAAS;AAAA,cACP;AAAA,cACA,eAAe;AAAA,YACjB;AAAA,UACF;AAAA,QACF,IACA,CAAC;AAAA,MACP;AAAA,IACF;AAAA,IACA,EAAE,UAAU,WAAW;AAAA,EACzB;AACA,QAAM,gBAAgB,QAAQ;AAC9B,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,QAAM,4BAA4B,KAAK,KAAK,MAAM,aAAa,WAAW,MAAM;AAChF,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,eAAe;AAAA,EACjB;AACF;AAEA,SAAS,wBACP,SACA,OACA,oBACA,SAAS,QAAQ,YACjB;AAOA,QAAM,cAAc,cAAc,CAAC,GAAG,KAAK,EACxC,KAAK,CAAC,MAAM,UAAU;AAGrB,UAAM,gBAAgB,KAAK,SAAS,SAAS,KAAK,OAAO;AACzD,UAAM,iBAAiB,MAAM,SAAS,SAAS,MAAM,OAAO;AAC5D,QAAI,kBAAkB,eAAgB,QAAO,gBAAgB,KAAK;AAClE,WAAO,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE,GAAG,cAAc,GAAG,MAAM,IAAI,IAAI,MAAM,EAAE,EAAE;AAAA,EAC5E,CAAC,EACA,IAAI,CAAC,UAAU;AAAA,IACd,MAAM,KAAK;AAAA,IACX,IAAI,KAAK;AAAA,IACT,GAAI,KAAK,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;AAAA,EACnE,EAAE;AACJ,QAAM,WAAW,YAAY,MAAM,GAAG,sBAAsB;AAC5D,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb,wBAAwB,OAAO;AAAA;AAAA,IAE/B,SAAS,CAAC,GAAG,QAAQ,EAClB,KAAK,CAAC,MAAM,UAAU,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE,GAAG,cAAc,GAAG,MAAM,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,EAC1F,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,IACxB;AAAA,IACA,WAAW,YAAY;AAAA,IACvB,oBAAoB,CAAC,GAAG,kBAAkB,EAAE,KAAK;AAAA,IACjD,wBAAwB,mBAAmB;AAAA,IAC3C,WAAW,YAAY,SAAS,SAAS;AAAA,EAC3C;AACF;AAQA,eAAsB,wBACpB,MAMA,OACA,WACA,SACkB;AAClB,QAAM,4BAA4B,MAAM,OAAO;AAAA,IAC7C;AAAA,IACA,WAAW;AAAA,IACX,SAAS;AAAA,EACX,CAAC;AACD,oBAAkB,OAAO,kBAAkB;AAE3C,QAAM,kBAAkB,MAAMG,gBAAe,KAAK,IAAI,MAAM,aAAa,SAAS;AAClF,QAAM,4BAA4B,MAAM;AAAA,IACtC,KAAK;AAAA,IACL,MAAM;AAAA,IACN,KAAK;AAAA,IACL,EAAE,WAAW,MAAM,UAAU;AAAA,EAC/B;AACA,QAAM,kBAAkB;AAAA,IACtB;AAAA,IACA,gBAAgB;AAAA,EAClB;AACA,QAAM,kBAAkB,QAAQ,SAAS,sBAAsB,OAAO;AACtE,QAAM,gBAAgB,kBAAkB,aAAa;AACrD,QAAM,yBAAyB,mBAC1B,MAAM;AACL,UAAM,iBAAiB,iBAAiB,gBAAgB,OAAO,eAAe;AAC9E,UAAM,eAAe,IAAI,IAAI,eAAe,IAAI,CAAC,SAAS,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;AACpF,UAAM,UAAU,gBAAgB,MAAM;AAAA,MACpC,CAAC,SAAS,CAAC,aAAa,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE,EAAE;AAAA,IACvD;AACA,QAAI,SAAS;AACX,YAAM,IAAIH,gBAAc,KAAK;AAAA,QAC3B,SAAS,0BAA0B,QAAQ,EAAE;AAAA,MAC/C,CAAC;AAAA,IACH;AACA,WAAO,oBAAoB,gBAAgB,eAAe;AAAA,EAC5D,GAAG,IACH;AACJ,QAAM,mCAAmC,kBACrC,CAAC,GAAG,gBAAgB,kBAAkB,IACtC;AACJ,QAAM,oCAAoC,+BAA+B,KAAK,QAAQ;AACtF,QAAM,8BAA8B,kCAAkC;AAAA,IACpE,CAAC,SAAS,CAAC,kCAAkC,QAAQ,SAAS,IAAI;AAAA,EACpE;AACA,MAAI,6BAA6B;AAC/B,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS,0DAA0D,2BAA2B;AAAA,IAChG,CAAC;AAAA,EACH;AACA,QAAM,wBAAwB;AAAA,IAC5B,qCAAqC,CAAC,GAAG,KAAK,UAAU,yBAAyB;AAAA,IACjF;AAAA,EACF;AACA,QAAM,kCAAkC,CAAC,GAAG,kCAAkC,OAAO;AACrF,QAAM,SAAS,MAAM;AAAA,IACnB,KAAK;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,OAAO,SAAS,YAAY;AAC1B,YAAM,iBAAiB,QAAQ,qBAAqB;AACpD,UAAI,QAAQ,oBAAoB,gBAAgB;AAC9C,cAAM,IAAI,sCAAsC,cAAc;AAAA,MAChE;AAEA,UAAI;AACJ,UAAI;AACJ,UAAI;AACJ,UAAI,QAAQ,iBAAiB;AAC3B,cAAM,SAAS,MAAM,QAAQ,iBAAiB,QAAQ,eAAe;AACrE,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAIA,gBAAc,KAAK;AAAA,YAC3B,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AACA,cAAM,gCAAgC,OAAO,YAAY,SAAS;AAClE,cAAM,kBAAkB;AAAA,UACtB,gCACI;AAAA,YACE,kBAAkB,OAAO,OAAO,eAAe;AAAA,YAC/C,KAAK;AAAA,YACL;AAAA,UACF,IACA,OAAO;AAAA,UACX;AAAA,QACF;AACA,cAAM,sCAAsC,IAAI;AAAA,UAC9C,kCAAkC;AAAA,QACpC;AACA,cAAM,2BAA2B;AAAA,UAC/B,GAAI,OAAO,sBAAsB,kCAAkC;AAAA,QACrE,EAAE,OAAO,CAAC,SAAS,oCAAoC,IAAI,IAAI,CAAC;AAChE,YAAI,kBAAkB,qBAAqB;AACzC,cAAI,CAAC,+BAA+B;AAClC,kBAAM,IAAIA,gBAAc,KAAK;AAAA,cAC3B,SACE;AAAA,YACJ,CAAC;AAAA,UACH;AACA,sBAAY;AACZ,mCAAyB;AACzB,uBAAa;AAAA,YACX,MAAM;AAAA,YACN,wBAAwB,OAAO;AAAA,UACjC;AAAA,QACF,OAAO;AACL,sBAAY;AACZ;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,gBAAM,sBAAsB,IAAI,IAAI,wBAAwB;AAC5D,gBAAM,wBAAwB,iCAAkC;AAAA,YAC9D,CAAC,SAAS,CAAC,oBAAoB,IAAI,IAAI;AAAA,UACzC;AACA,cAAI,uBAAuB;AACzB,kBAAM,IAAIA,gBAAc,KAAK;AAAA,cAC3B,SAAS,6DAA6D,qBAAqB;AAAA,YAC7F,CAAC;AAAA,UACH;AACA,mCAAyB;AACzB,uBAAa;AAAA,YACX,MAAM;AAAA,YACN,wBAAwB,OAAO;AAAA,UACjC;AAAA,QACF;AAAA,MACF,OAAO;AACL,oBACE,kBAAkB,sBAAsB,wBAAwB;AAClE,iCACE,kBAAkB,sBACd,kCACA;AACN,qBAAa,EAAE,MAAM,eAAe,wBAAwB,KAAK;AAAA,MACnE;AAEA,YAAM,gBAAgB,QAAQ;AAK9B,YAAM,YACJU,YAAW;AAAA,QACT,OAAO,QAAQ;AAAA,QACf,oBACE,QAAQ,sBAAsB,kCAAkC;AAAA,QAClE,QAAQ;AAAA,MACV,CAAC,MACDA,YAAW;AAAA,QACT,OAAO;AAAA,QACP,oBAAoB;AAAA,QACpB,QAAQ;AAAA,MACV,CAAC;AACH,UAAI,WAAW;AACb,eAAO,EAAE,QAAQ,CAAC,EAAE;AAAA,MACtB;AAEA,YAAM,cAAc,iBAAiB;AACrC,aAAO;AAAA,QACL,QAAQ;AAAA,UACN;AAAA,YACE,MAAM;AAAA,YACN,SAAS;AAAA,cACP,QAAQ;AAAA,gBACN;AAAA,gBACA,QAAQ;AAAA,gBACR,CAAC,GAAI,QAAQ,sBAAsB,kCAAkC,OAAQ;AAAA,gBAC7E;AAAA,cACF;AAAA,cACA,OAAO;AAAA,gBACL;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,cACA,SAAS;AAAA,cACT,eAAe;AAAA,YACjB;AAAA,UACF;AAAA,QACF;AAAA,QACA,QAAQ;AAAA,UACN,OAAO;AAAA,UACP,oBAAoB;AAAA,UACpB,YAAY;AAAA,UACZ,mBAAmB;AAAA,UACnB,2BAA2B,QAAQ;AAAA,QACrC;AAAA,MACF;AAAA,IACF;AAAA,IACA,EAAE,UAAU,YAAY,mBAAmB,KAAK;AAAA,EAClD;AACA,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,4BAA4B,KAAK,KAAK,MAAM,aAAa,WAAW,MAAM;AAAA,EAClF;AACA,SAAO,MAAMP,gBAAe,KAAK,IAAI,MAAM,aAAa,SAAS;AACnE;AAEA,eAAsB,mBACpB,MACA,OACA,WACA;AACA,QAAM,gBAAgB,MAAM,4BAA4B,MAAM,OAAO;AAAA,IACnE;AAAA,IACA,WAAW;AAAA,IACX,SAAS;AAAA,EACX,CAAC;AACD,MAAI,eAAe,yBAAyB,UAAU;AACpD,UAAM,UAAU,MAAME,YAAW,KAAK,IAAI,MAAM,aAAa,SAAS;AACtE,QAAI,CAAC,SAAS;AACZ,YAAM,IAAIL,gBAAc,KAAK,EAAE,SAAS,oBAAoB,CAAC;AAAA,IAC/D;AACA,WAAO,EAAE,WAAW,CAAC,GAAG,UAAU,CAAC,GAAG,WAAW,MAAM;AAAA,EACzD;AACA,QAAM,UAAU,MAAM,kBAAkB,KAAK,IAAI,MAAM,aAAa,SAAS;AAC7E,MAAI,CAAC,SAAS;AACZ,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,oBAAoB,CAAC;AAAA,EAC/D;AACA,SAAO;AACT;AAEA,SAAS,oBACP,OACA,iBACW;AACX,MAAI,CAAC,gBAAgB,WAAW,KAAK,CAAC,WAAW,OAAO,OAAO,UAAU,GAAG;AAC1E,WAAO;AAAA,EACT;AACA,SAAO,cAAc,OAAO,CAAC,EAAE,MAAM,OAAO,IAAI,WAAW,CAAC,CAAC;AAC/D;AAEA,SAAS,eAAe,OAAgB,KAAsB;AAC5D,SAAO;AAAA,IACL,SAAS,OAAO,UAAU,YAAY,OAAO,UAAU,eAAe,KAAK,OAAO,GAAG;AAAA,EACvF;AACF;;;ADl+EO,SAAS,2BAA2B,YAA8B;AACvE,MAAI,CAAC,cAAc,OAAO,eAAe,UAAU;AACjD,WAAO;AAAA,EACT;AACA,QAAM,cAAe,WAAyC;AAC9D,SAAO;AAAA,IACL,eACA,OAAO,gBAAgB,YACvB,OAAO,UAAU,eAAe,KAAK,aAAa,OAAO;AAAA,EAC3D;AACF;AAEA,eAAsB,6BAA6B,OAexB;AAGzB,QAAM,SAAS,MAAM,QAAQ,UAAW,EAAE,MAAM,aAAa;AAC7D,QAAM,kBAAkB,OAAO,SAAS,0BAA0B,SAAS;AAC3E,MAAI,iBAAiB;AACnB,UAAM,kCAAkC;AAAA,MACtC,IAAI,MAAM;AAAA,MACV,OAAO,MAAM;AAAA,MACb,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,QAAM,cAAc,kBAChB,MAAM,QAAQ,cACd,MAAM,iCAAiC;AAAA,IACrC,GAAG;AAAA,IACH,aAAa,MAAM,MAAM;AAAA,EAC3B,CAAC;AACL,QAAM,KAAK,OAAO,WAAW;AAC7B,gCAA8B,MAAM,QAAQ,QAAQ;AACpD,QAAM,SAAS,kBACX,OACA,MAAM,4BAA4B;AAAA,IAChC,IAAI,MAAM;AAAA,IACV,sBAAsB,MAAM;AAAA,IAC5B,sBAAsB,MAAM;AAAA,IAC5B,OAAO,MAAM;AAAA,IACb,iBAAiB,MAAM,QAAQ;AAAA,IAC/B,SAAS,MAAM,QAAQ;AAAA,IACvB,eAAe,MAAM,QAAQ;AAAA,IAC7B,OAAO,MAAM,QAAQ;AAAA,IACrB;AAAA,EACF,CAAC;AACL,MAAI,CAAC,mBAAmB,MAAM,QAAQ,eAAe;AACnD,UAAM;AAAA,MACJ,EAAE,UAAU,MAAM,UAAU,IAAI,MAAM,GAAG;AAAA,MACzC,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,MAAM,QAAQ;AAAA,MACd,EAAE,eAAe,MAAM,4BAA4B,MAAM;AAAA,IAC3D;AAAA,EACF;AAKA,MAAI,CAAC,mBAAmB,MAAM,QAAQ,OAAO;AAC3C,UAAM,wBAAwB,MAAM,IAAI,MAAM,MAAM,aAAa,MAAM,QAAQ,KAAK;AAAA,EACtF;AACA,QAAM,gCAAgC,kBAClC,CAAC,IACD,MAAM,oCAAoC;AAAA,IACxC,IAAI,MAAM;AAAA,IACV,aAAa,MAAM,MAAM;AAAA,IACzB,UAAU,MAAM;AAAA,MACd,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,MAAM;AAAA,MACN,EAAE,WAAW,MAAM,MAAM,UAAU;AAAA,IACrC;AAAA,IACA,OAAO,CAAC,GAAG,YAAY,OAAO,EAAE,MAAM,OAAO,IAAI,WAAW,CAAC;AAAA,IAC7D,QAAQ,2CAA2C,MAAM,KAAK;AAAA,EAChE,CAAC;AACL,QAAM,oBAAoB,0BAA0B,MAAM,KAAK;AAC/D,QAAM,sCACJ,kBAAkB,QACd,MAAMW;AAAA,IACJ,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,IACZ,kBAAkB,MAAM;AAAA,IACxB,kBAAkB,MAAM;AAAA,EAC1B,IACA,MAAM,wDAAwD,MAAM,IAAI;AAAA,IACtE,aAAa,MAAM,MAAM;AAAA,IACzB,WAAW,MAAM,MAAM;AAAA,EACzB,CAAC;AACP,SAAO,MAAM,oBAAoB,MAAM,IAAI;AAAA,IACzC;AAAA,IACA,WAAW,MAAM,MAAM;AAAA,IACvB,aAAa,MAAM,MAAM;AAAA,IACzB,MAAM,yBAAyB,MAAM,QAAQ,IAAI;AAAA,IACjD,QAAQ,MAAM,QAAQ;AAAA,IACtB,UAAU,MAAM,QAAQ;AAAA,IACxB,oBAAoB,gCAAgC,EAAE;AAAA,IACtD,SAAS,MAAM,QAAQ;AAAA,IACvB,eAAe,MAAM,QAAQ;AAAA,IAC7B;AAAA,IACA;AAAA,IACA,GAAI,kBAAkB,YAAY,EAAE,WAAW,kBAAkB,UAAU,IAAI,CAAC;AAAA,IAChF,GAAI,kBAAkB,UAAU,EAAE,kBAAkB,kBAAkB,QAAQ,IAAI,CAAC;AAAA,IACnF,gBAAgB,kBAAkB,SAAS;AAAA,IAC3C;AAAA,IACA;AAAA,IACA,iBAAiB,QAAQ,MAAM;AAAA,IAC/B,eAAe,MAAM,QAAQ,iBAAiB;AAAA,IAC9C,OAAO,MAAM,QAAQ,SAAS;AAAA,IAC9B,UAAU,MAAM,QAAQ;AAAA,EAC1B,CAAC;AACH;AAEA,eAAsB,4BAA4B,OAWtB;AAC1B,MAAI,MAAM,YAAY,oBAAoB;AACxC,QAAI,MAAM,iBAAiB;AACzB,YAAM,IAAIC,gBAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,iBAAiB;AAC1B,UAAM,IAAIA,gBAAc,MAAM,uBAAuB,KAAK;AAAA,MACxD,SACE,MAAM,wBAAwB,MAC1B,6BACA;AAAA,IACR,CAAC;AAAA,EACH;AACA,oBAAkB,MAAM,OAAO,kBAAkB;AACjD,MAAI,MAAM,YAAY,MAAM;AAC1B,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI;AACF,UAAM;AAAA,MACJ;AAAA,QACE,IAAI,MAAM;AAAA,QACV,GAAI,MAAM,yBAAyB,SAC/B,EAAE,sBAAsB,MAAM,qBAAqB,IACnD,CAAC;AAAA,MACP;AAAA,MACA,MAAM;AAAA,MACN;AAAA,QACE,WAAW,MAAM;AAAA,QACjB,WAAW;AAAA,QACX,SAAS,MAAM,wBAAwB;AAAA,MACzC;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,iCAAiC;AACpD,YAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,2BAA2B,CAAC;AAAA,IACtE;AACA,QAAI,iBAAiB,sCAAsC;AACzD,YAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,uCAAuC,CAAC;AAAA,IAClF;AACA,UAAM;AAAA,EACR;AACA,QAAM,UAAU,MAAMC,YAAW,MAAM,IAAI,MAAM,MAAM,aAAa,MAAM,eAAe;AACzF,MAAI,CAAC,WAAW,QAAQ,cAAc,MAAM,MAAM,WAAW;AAC3D,UAAM,IAAID,gBAAc,KAAK,EAAE,SAAS,2BAA2B,CAAC;AAAA,EACtE;AACA,MAAI,QAAQ,WAAW,aAAa;AAClC,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,OAAK,QAAQ,iBAAiB,WAAW,MAAM,iBAAiB,OAAO;AACrE,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,SAAS,MAAM,UAAU,QAAQ,OAAO;AAChD,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,YAAY,mBAAmB,UACrC,MAAM,YAAY,mBAAmB,QAAQ,gBAC7C;AACA,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,8BAA8B,QAAQ,QAAQ,OAC7C,MAAM,YAAY,wBAAwB,OAC3C;AACA,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEO,SAAS,sBAAsB,MAAqB,OAAmC;AAC5F,MAAI,cAAc,MAAM,aAAa,kBAAkB,KAAK,KAAK,oBAAoB,MAAM;AACzF,WAAO;AAAA,EACT;AACA,SAAO,EAAE,GAAG,MAAM,iBAAiB,KAAK;AAC1C;AAEO,SAAS,yBACd,KACA,OACG;AACH,MAAI,cAAc,MAAM,aAAa,kBAAkB,KAAK,IAAI,cAAc,MAAM;AAClF,WAAO;AAAA,EACT;AACA,SAAO,EAAE,GAAG,KAAK,WAAW,KAAK;AACnC;AAIA,eAAe,wBACb,IACA,aACA,OACe;AACf,QAAM,MAAM,MAAME,QAAO,IAAI,aAAa,KAAK;AAC/C,MAAI,CAAC,KAAK;AACR,UAAM,IAAIF,gBAAc,KAAK,EAAE,SAAS,kBAAkB,KAAK,GAAG,CAAC;AAAA,EACrE;AACF;AAEA,eAAsB,6BAA6B,OAWb;AACpC,QAAM,SAAmC,CAAC;AAC1C,QAAM,oBAAoB,MAAM,SAAS,OAAO,SAAS;AACzD,MAAI,MAAM,QAAQ,UAAU,MAAM,QAAQ,OAAO,SAAS,MAAM,SAAS,OAAO,MAAM;AACpF,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,mBAAmB;AACrB,QACE,MAAM,QAAQ,gBAAgB,UAC9B,MAAM,QAAQ,YAAY,UAC1B,MAAM,QAAQ,oBAAoB,UAClC,MAAM,QAAQ,kBAAkB,UAChC,MAAM,QAAQ,UAAU,QACxB;AACA,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,MAAM,QAAQ,kBAAkB,oBAAoB;AACtD,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,MAAM,QAAQ,QAAQ,SAAS,yBAAyB;AAC1D,YAAM,kCAAkC;AAAA,QACtC,IAAI,MAAM;AAAA,QACV,OAAO,MAAM;AAAA,QACb,QAAQ,MAAM,QAAQ;AAAA,MACxB,CAAC;AACD,aAAO,SAAS,MAAM,QAAQ;AAAA,IAChC;AACA,QAAI,MAAM,QAAQ,SAAS;AACzB,aAAO,OAAO,yBAAyB,MAAM,QAAQ,IAAI;AAC3D,QAAI,MAAM,QAAQ,WAAW,OAAW,QAAO,SAAS,MAAM,QAAQ;AACtE,QAAI,MAAM,QAAQ,aAAa,QAAW;AACxC,oCAA8B,MAAM,QAAQ,QAAQ;AACpD,aAAO,WAAW,MAAM,QAAQ;AAAA,IAClC;AACA,QAAI,MAAM,QAAQ,kBAAkB,QAAW;AAC7C,aAAO,gBAAgB,MAAM,QAAQ;AAAA,IACvC;AACA,QAAI,MAAM,QAAQ,aAAa,OAAW,QAAO,WAAW,MAAM,QAAQ;AAC1E,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,MAAM,SAAS;AACtC,QAAM,cAAc,MAAM,QAAQ,WAAW,MAAM,SAAS;AAC5D,QAAM,sBACJ,MAAM,QAAQ,oBAAoB,SAC9B,MAAM,QAAQ,kBACd,gBAAgB,qBACd,iBACA;AACR,MACE,MAAM,SAAS,YAAY,sBAC3B,MAAM,SAAS,qBACf,gBAAgB,oBAChB;AACA,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACA,MAAI,MAAM,QAAQ,SAAS,QAAW;AACpC,WAAO,OAAO,yBAAyB,MAAM,QAAQ,IAAI;AAAA,EAC3D;AACA,MAAI,MAAM,QAAQ,WAAW,QAAW;AACtC,WAAO,SAAS,MAAM,QAAQ;AAAA,EAChC;AACA,MAAI,MAAM,QAAQ,aAAa,QAAW;AACxC,kCAA8B,MAAM,QAAQ,QAAQ;AACpD,WAAO,WAAW,MAAM,QAAQ;AAAA,EAClC;AACA,MAAI,MAAM,QAAQ,YAAY,QAAW;AACvC,WAAO,UAAU,MAAM,QAAQ;AAAA,EACjC;AACA,MAAI,MAAM,QAAQ,kBAAkB,QAAW;AAC7C,WAAO,gBAAgB,MAAM,QAAQ;AAAA,EACvC;AACA,MAAI,MAAM,QAAQ,aAAa,QAAW;AACxC,WAAO,WAAW,MAAM,QAAQ;AAAA,EAClC;AACA,MAAI,MAAM,QAAQ,kBAAkB,QAAW;AAC7C,UAAM,oBAAoB,MAAM,QAAQ;AACxC,SACG,MAAM,SAAS,iBAAiB,WAAW,qBAAqB,SACjE,MAAM,SAAS,YAAY,sBAC3B,MAAM,SAAS,mBACf;AACA,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SACE;AAAA,MACJ,CAAC;AAAA,IACH;AACA,QAAI,sBAAsB,MAAM;AAC9B,UAAI,MAAM,SAAS,kBAAkB,MAAM;AAGzC,0BAAkB,MAAM,OAAO,mBAAmB;AAAA,MACpD;AACA,aAAO,gBAAgB;AAAA,IACzB,OAAO;AACL,YAAM;AAAA,QACJ,EAAE,UAAU,MAAM,UAAU,IAAI,MAAM,GAAG;AAAA,QACzC,MAAM;AAAA,QACN,MAAM,SAAS;AAAA,QACf;AAAA,MACF;AACA,aAAO,gBAAgB;AAAA,IACzB;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,UAAU,QAAW;AAIrC,QAAI,MAAM,QAAQ,UAAU,MAAM;AAChC,YAAM,wBAAwB,MAAM,IAAI,MAAM,SAAS,aAAa,MAAM,QAAQ,KAAK;AAAA,IACzF;AACA,WAAO,QAAQ,MAAM,QAAQ;AAAA,EAC/B;AACA,MAAI,MAAM,QAAQ,gBAAgB,QAAW;AAI3C,UAAM,sBACJ,MAAM,QAAQ,kBAAkB,SAC5B,MAAM,QAAQ,kBAAkB,OAChC,QAAQ,MAAM,SAAS,aAAa;AAC1C,QAAI,qBAAqB;AACvB,wBAAkB,MAAM,OAAO,mBAAmB;AAAA,IACpD;AACA,UAAM,kBAAkB,MAAM,iCAAiC;AAAA,MAC7D,UAAU,MAAM;AAAA,MAChB,IAAI,MAAM;AAAA,MACV,eAAe,MAAM;AAAA,MACrB,OAAO,MAAM;AAAA,MACb,aAAa,MAAM,SAAS;AAAA,MAC5B,SAAS,EAAE,aAAa,MAAM,QAAQ,YAAY;AAAA,MAClD,GAAI,MAAM,kBAAkB,SAAY,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,IACpF,CAAC;AACD,QACE,MAAM,SAAS,qBACf,MAAM,SAAS,YAAY,uBAC1B,MAAM,SAAS,YAAY,wBAAwB,WACjD,gBAAgB,wBAAwB,OAC3C;AACA,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SACE;AAAA,MACJ,CAAC;AAAA,IACH;AACA,WAAO,cAAc;AACrB,UAAM,kBAAkB,MAAM;AAAA,MAC5B,MAAM;AAAA,MACN,MAAM,SAAS;AAAA,MACf,MAAM;AAAA,MACN,EAAE,WAAW,MAAM,MAAM,UAAU;AAAA,IACrC;AACA,UAAM,gCAAgC,MAAM,oCAAoC;AAAA,MAC9E,IAAI,MAAM;AAAA,MACV,aAAa,MAAM,SAAS;AAAA,MAC5B,UAAU;AAAA,MACV,OAAO,CAAC,GAAG,gBAAgB,OAAO,EAAE,MAAM,OAAO,IAAI,WAAW,CAAC;AAAA,MACjE,QAAQ,2CAA2C,MAAM,KAAK;AAAA,IAChE,CAAC;AACD,QAAI,MAAM,SAAS,qBAAqB,MAAM,SAAS,YAAY,oBAAoB;AACrF,YAAM,sBAAsB,MAAM;AAAA,QAChC,MAAM;AAAA,QACN,MAAM,SAAS;AAAA,QACf,MAAM,SAAS;AAAA,MACjB;AACA,UAAI,CAAC,mCAAmC,qBAAqB,6BAA6B,GAAG;AAC3F,cAAM,IAAIA,gBAAc,KAAK;AAAA,UAC3B,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO,gCAAgC;AAAA,EACzC;AACA,MACE,mBACC,gBAAgB,sBAAsB,wBAAwB,iBAC/D;AACA,UAAM,4BAA4B;AAAA,MAChC,IAAI,MAAM;AAAA,MACV,sBAAsB,MAAM;AAAA,MAC5B,sBAAsB,MAAM;AAAA,MAC5B,OAAO,MAAM;AAAA,MACb,iBAAiB;AAAA,MACjB,SAAS;AAAA,MACT,eAAe,MAAM,SAAS;AAAA,MAC9B,OAAO,MAAM,SAAS;AAAA,MACtB,aAAa,MAAM,SAAS;AAAA,IAC9B,CAAC;AAAA,EACH;AACA,QAAM,4BAA4B;AAAA,IAChC,IAAI,MAAM;AAAA,IACV,sBAAsB,MAAM;AAAA,IAC5B,sBAAsB,MAAM;AAAA,IAC5B,OAAO,MAAM;AAAA,IACb,iBAAiB;AAAA,IACjB,SAAS;AAAA,IACT,eACE,MAAM,QAAQ,kBAAkB,SAC5B,MAAM,QAAQ,gBACd,MAAM,SAAS;AAAA,IACrB,OAAO,MAAM,QAAQ,UAAU,SAAY,MAAM,QAAQ,QAAQ,MAAM,SAAS;AAAA,IAChF,aAAa,OAAO,eAAe,MAAM,SAAS;AAAA,EACpD,CAAC;AACD,MACE,MAAM,QAAQ,oBAAoB,UAClC,MAAM,SAAS,YAAY,sBAC3B,gBAAgB,oBAChB;AACA,WAAO,kBAAkB;AAAA,EAC3B;AACA,SAAO;AACT;AAEA,eAAsB,2BACpB,IACA,aACA,QACwB;AACxB,QAAM,OAAO,MAAM,iBAAiB,IAAI,aAAa,MAAM;AAC3D,MAAI,CAAC,MAAM;AACT,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,2BAA2B,CAAC;AAAA,EACtE;AACA,SAAO;AACT;AAOA,eAAsB,iCACpB,IACA,MACoC;AACpC,SAAO;AAAA,IACL;AAAA,IACA,+BAA+B,MAAM;AAAA,MACnC;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AACF;AAEA,eAAsB,qBACpB,IACA,UACwB;AACxB,QAAM,EAAE,KAAK,IAAI;AACjB,SAAO,MAAM,oBAAoB,IAAI,KAAK,aAAa,KAAK,IAAI;AAAA,IAC9D,MAAM,KAAK;AAAA,IACX,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,IACf,SAAS,KAAK;AAAA,IACd,eAAe,KAAK;AAAA,IACpB,QAAQ,KAAK;AAAA,IACb,aAAa,KAAK;AAAA,IAClB,+BAA+B,SAAS;AAAA,IACxC,GAAI,KAAK,YAAY,qBACjB,EAAE,iBAAiB,KAAK,gBAAgB,IACxC,EAAE,mBAAmB,KAAK,kBAAkB;AAAA,IAChD,eAAe,KAAK;AAAA,IACpB,OAAO,KAAK;AAAA,IACZ,UAAU,KAAK;AAAA,EACjB,CAAC;AACH;AAEA,eAAe,kCAAkC,OAI/B;AAChB,MAAI,MAAM,OAAO,wBAAwB,MAAM,MAAM,WAAW;AAC9D,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,OAAO,WAAW,mBAAmB,MAAM,MAAM,WAAW;AACpE,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,WAAW,MAAM,mCAAmC,MAAM,IAAI;AAAA,IAClE,WAAW,MAAM,MAAM;AAAA,IACvB,aAAa,MAAM,MAAM;AAAA,IACzB,UAAU,MAAM,OAAO;AAAA,IACvB,qBAAqB,MAAM,MAAM;AAAA,EACnC,CAAC;AACD,MAAI,CAAC,YAAY,SAAS,OAAO,mBAAmB,UAAU;AAC5D,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,6BAA6B,CAAC;AAAA,EACxE;AACA,MACE,SAAS,OAAO,mBAAmB,MAAM,OAAO,oBAChD,SAAS,OAAO,wBAAwB,MAAM,OAAO,6BACrD,wBAAwB,SAAS,OAAO,KAAK,MAC3C,wBAAwB,MAAM,OAAO,WAAW,GAClD;AACA,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,aAAa,MAAMG;AAAA,IACvB,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,IACZ,MAAM,OAAO,WAAW;AAAA,IACxB,MAAM,MAAM;AAAA,EACd;AACA,MACE,CAAC,cACD,WAAW,cAAc,MAAM,MAAM,aACrC,WAAW,gBAAgB,MAAM,MAAM,eACvC,WAAW,cAAc,MAAM,OAAO,WAAW,kBACjD,WAAW,YAAY,MAAM,OAAO,WAAW,qBAC/C,WAAW,eAAe,YAAY,MACpC,MAAM,OAAO,WAAW,eAAe,YAAY,KACrD,WAAW,SAAS,MAAM,OAAO,WAAW,QAC5C,WAAW,WAAW,UACtB;AACA,UAAM,IAAIH,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAEO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACvC;AAAA,EAET,YAAY,OAAgB,qBAA8B;AACxD,UAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,EAAE,MAAM,CAAC;AACvE,SAAK,OAAO;AACZ,SAAK,sBAAsB;AAAA,EAC7B;AACF;AAEA,eAAsB,yBAAyB,OAI7B;AAChB,MAAI;AACF,UAAM,MAAM,eAAe,kBAAkB,EAAE,MAAM,MAAM,KAAK,CAAC;AAAA,EACnE,SAAS,OAAO;AACd,QAAI,sBAAsB;AAC1B,QAAI;AACF,YAAM,oBAAoB,MAAM,IAAI,MAAM,KAAK,aAAa,MAAM,KAAK,EAAE;AAAA,IAC3E,QAAQ;AACN,4BAAsB;AAAA,IACxB;AACA,UAAM,IAAI,uBAAuB,OAAO,mBAAmB;AAAA,EAC7D;AACF;AAEA,eAAsB,yBAAyB,OAK7B;AAChB,MAAI;AACF,UAAM,MAAM,eAAe,kBAAkB,EAAE,MAAM,MAAM,KAAK,CAAC;AAAA,EACnE,SAAS,OAAO;AACd,QAAI,sBAAsB;AAC1B,QAAI;AACF,YAAM,qBAAqB,MAAM,IAAI,MAAM,QAAQ;AAAA,IACrD,QAAQ;AACN,4BAAsB;AAAA,IACxB;AACA,UAAM,IAAI,uBAAuB,OAAO,mBAAmB;AAAA,EAC7D;AACF;AAEO,SAAS,gCAAgC,QAAwB;AACtE,SAAO,kBAAkB,MAAM;AACjC;AAaO,SAAS,0BAA0B,iBAAyC;AACjF,QAAM,WAAW,mBAAmB,IAAI,KAAK;AAC7C,MAAI,CAAC,SAAS;AACZ,WAAO,OAAO,WAAW;AAAA,EAC3B;AACA,QAAM,OAAO,QAAQ,QAAQ,oBAAoB,GAAG,EAAE,MAAM,GAAG,GAAG;AAGlE,SAAO,KAAK,SAAS,IAAI,OAAO,OAAO,WAAW;AACpD;AAQO,SAAS,qCAAqC,QAAgB,cAA8B;AACjG,SAAO,kBAAkB,MAAM,WAAW,YAAY;AACxD;AAOO,SAAS,mCACd,aACA,QACA,cACQ;AACR,SAAO,uCAAuC,WAAW,IAAI,MAAM,IAAI,YAAY;AACrF;AAEA,eAAe,iCAAiC,OAQV;AAMpC,QAAM,QAAQ,yBAAyB,MAAM,UAAU,MAAM,QAAQ,YAAY,KAAK;AAGtF,QAAM,iCAAiC,MAAM,IAAI,MAAM,UAAU,MAAM,aAAa,KAAK;AACzF,QAAM,YAAY,mBAAmB,MAAM,QAAQ,YAAY,aAAa,CAAC,CAAC;AAC9E,QAAM,kBAAkB,MAAM;AAAA,IAC5B,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,EAAE,WAAW,MAAM,MAAM,UAAU;AAAA,EACrC;AACA,QAAM,iBAAiB,iBAAiB,MAAM,QAAQ,YAAY,SAAS,CAAC,GAAG,eAAe;AAM9F,QAAM,QACH,MAAM,iBAAiB,OACpB,iBACA,qCAAqC,gBAAgB,MAAM,UAAU,eAAe;AAC1F,QAAM,SAAS,MAAM,QAAQ,YAAY,OAAO,KAAK;AACrD,MAAI,CAAC,QAAQ;AACX,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,oCAAoC,CAAC;AAAA,EAC/E;AACA,MAAI,2CAA2C,MAAM,QAAQ,YAAY,QAAQ,GAAG;AAClF,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS,GAAGI,wCAAuC;AAAA,IACrD,CAAC;AAAA,EACH;AACA,QAAM,kCAAkC,MAAM,IAAI,MAAM,aAAa,SAAS;AAC9E,MAAI,UAAU,KAAK,CAAC,aAAa,SAAS,SAAS,MAAM,KAAK,CAAC,MAAM,eAAe;AAClF,UAAM,IAAIJ,gBAAc,KAAK,EAAE,SAAS,mCAAmC,CAAC;AAAA,EAC9E;AACA,QAAM,sBAAsB,MAAM,IAAI,MAAM,aAAa,SAAS;AAClE,MAAI,MAAM,QAAQ,YAAY,sBAAsB;AAClD,UAAM;AAAA,MACJ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM,QAAQ,YAAY;AAAA,IAC5B;AAAA,EACF;AACA,QAAM,oBAAoB,MAAM,QAAQ,YAAY;AACpD,MAAI,sBAAsB,QAAW;AACnC,UAAM,YAAY,MAAMK,kBAAiB,MAAM,IAAI,MAAM,WAAW;AACpE,UAAM,oBAAoB,UAAU,SAAS;AAC7C,UAAM,mBAAmB,MAAM,oCAAoC,MAAM,EAAE;AAC3E,UAAM,oBACJ,OAAO,sBAAsB,WACzB,oBACA,iBAAiB;AACvB,QACE,oBAAoB,qBACpB,CAAC,cAAc,MAAM,MAAM,aAAa,iBAAiB,GACzD;AACA,YAAM,IAAIL,gBAAc,KAAK;AAAA,QAC3B,SAAS,sCAAsC,iBAAiB,4BAA4B,iBAAiB;AAAA,MAC/G,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AAAA,IACL,GAAG,MAAM,QAAQ;AAAA,IACjB,GAAI,UAAU,UAAa,UAAU,OAAO,CAAC,IAAI,EAAE,MAAM;AAAA,IACzD;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,8BAA8B,UAA2C;AAChF,MAAI,SAAS,SAAS,cAAc,CAAC,SAAS,WAAW,CAAC,SAAS,OAAO;AACxE;AAAA,EACF;AACA,MAAI,IAAI,KAAK,SAAS,OAAO,EAAE,QAAQ,KAAK,IAAI,KAAK,SAAS,KAAK,EAAE,QAAQ,GAAG;AAC9E,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,gDAAgD,CAAC;AAAA,EAC3F;AACF;AAEA,SAAS,yBAAyB,MAAsB;AACtD,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,kCAAkC,CAAC;AAAA,EAC7E;AACA,SAAO;AACT;;;AIl2BA,SAAS,+BAAAM,oCAAkD;AAC3D;AAAA,EACE;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,IAAM,6BAA6B;AAUnC,SAAS,YAAY,QAAwB;AAC3C,SAAO,SAAS;AAClB;AAEA,SAAS,YAAY,QAAgB,OAAuB;AAC1D,MAAI,SAAS,EAAG,QAAO;AACvB,SAAO,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,KAAK,MAAO,SAAS,QAAS,GAAG,CAAC,CAAC;AACtE;AAEA,SAAS,cAAc,MAAkB;AACvC,SAAO,IAAI,KAAK,KAAK,IAAI,KAAK,eAAe,GAAG,KAAK,YAAY,GAAG,KAAK,WAAW,CAAC,CAAC;AACxF;AAEA,SAASC,iBAAgB,MAAkB;AACzC,SAAO,IAAI,KAAK,KAAK,IAAI,KAAK,eAAe,GAAG,KAAK,YAAY,GAAG,CAAC,CAAC;AACxE;AAEA,SAAS,eAAe,MAAkB;AACxC,SAAO,IAAI,KAAK,KAAK,IAAI,KAAK,eAAe,GAAG,GAAG,CAAC,CAAC;AACvD;AAEA,SAAS,mBACP,OACA,KAUA;AACA,QAAM,QAAQ;AACd,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,cAAQ,cAAc,GAAG;AACzB,mBAAa;AACb,mBAAa;AACb,oBAAc;AACd,yBAAmB;AACnB;AAAA,IACF,KAAK;AACH,cAAQ,IAAI,KAAK,cAAc,GAAG,EAAE,QAAQ,IAAI,IAAI,KAAK,KAAK,KAAK,GAAI;AACvE,mBAAa;AACb,mBAAa;AACb,oBAAc;AACd,yBAAmB;AACnB;AAAA,IACF,KAAK;AACH,cAAQA,iBAAgB,GAAG;AAC3B,mBAAa;AACb,mBAAa;AACb,oBAAc;AACd,yBAAmB;AACnB;AAAA,IACF,KAAK;AACH,cAAQ,eAAe,GAAG;AAC1B,mBAAa;AACb,mBAAa;AACb,oBAAc;AACd,yBAAmB;AACnB;AAAA,IACF,SAAS;AACP,YAAM,cAAqB;AAC3B,YAAM,IAAI,MAAM,2BAA2B,WAAW,EAAE;AAAA,IAC1D;AAAA,EACF;AACA,QAAM,aAAa,MAAM,QAAQ,IAAI,MAAM,QAAQ;AACnD,QAAM,aAAa;AACnB,QAAM,aAAa,IAAI,KAAK,WAAW,QAAQ,IAAI,KAAK,IAAI,YAAY,CAAC,CAAC;AAC1E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,SAAS,WAAiB,KAAmB;AACpD,QAAM,KAAK,KAAK,IAAI,GAAG,IAAI,QAAQ,IAAI,UAAU,QAAQ,CAAC;AAC1D,QAAM,UAAU,KAAK,MAAM,KAAK,GAAM;AACtC,MAAI,UAAU,EAAG,QAAO;AACxB,MAAI,UAAU,GAAI,QAAO,GAAG,OAAO;AACnC,QAAM,QAAQ,KAAK,MAAM,UAAU,EAAE;AACrC,MAAI,QAAQ,GAAI,QAAO,GAAG,KAAK;AAC/B,SAAO,GAAG,KAAK,MAAM,QAAQ,EAAE,CAAC;AAClC;AAEA,SAAS,WAAW,OAGoD;AACtE,MAAI,MAAM,uBAAuB,SAAU,QAAO;AAClD,UAAQ,MAAM,QAAQ;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,cAAc,OAAgD;AACrE,SAAO,UAAU,aAAa,aAAa;AAC7C;AAEA,SAAS,gBACP,OACqD;AACrD,SAAO,UAAU,2BAA2B,UAAU,qBAAqB,QAAQ;AACrF;AAEA,eAAsB,qBACpB,IACA,UACA,OACoC;AACpC,QAAMF,kBAAiB,IAAI,MAAM,WAAW;AAC5C,QAAM,MAAM,MAAM,OAAO,oBAAI,KAAK;AAClC,QAAM,SAAS,mBAAmB,MAAM,OAAO,GAAG;AAClD,QAAM,WAAW,MAAM,UAAU,KAAK,KAAK;AAC3C,QAAM,QAAQ,MAAM,OAAO,KAAK,KAAK;AACrC,QAAM,oBAAoB,QAAQ,YAAY,KAAK;AACnD,QAAM,SAAS,EAAE,UAAU,MAAM;AACjC,QAAM,0BACJ,MAAM,UAAU,UAAU,gCAAgC;AAC5D,QAAM,oBACJ,MAAM,UAAU,UAAU,yBAAyB;AAErD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,MAAM,QAAQ,IAAI;AAAA,IACpB,wBAAwB,IAAI;AAAA,MAC1B,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AAAA,IACD,wBAAwB,IAAI;AAAA,MAC1B,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AAAA,IACD,wBAAwB,IAAI;AAAA,MAC1B,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AAAA,IACD,wBAAwB,IAAI;AAAA,MAC1B,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AAAA,IACD,wBAAwB,IAAI;AAAA,MAC1B,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,GAAG;AAAA,IACL,CAAC;AAAA,IACD,wBAAwB,IAAI;AAAA,MAC1B,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,GAAG;AAAA,IACL,CAAC;AAAA,IACD,wBAAwB,IAAI;AAAA,MAC1B,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,GAAG;AAAA,IACL,CAAC;AAAA,IACD,kBAAkB,IAAI;AAAA,MACpB,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AAAA,IACD,kBAAkB,IAAI;AAAA,MACpB,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AAAA,IACD,4BAA4B,IAAI;AAAA,MAC9B,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,OAAO;AAAA,IACT,CAAC;AAAA,IACD,mBAAmB,IAAI,MAAM,WAAW;AAAA,IACxC,4BAA4B,IAAI;AAAA,MAC9B,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,GAAG;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AAAA,IACD,uBAAuB,IAAI;AAAA,MACzB,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,GAAG;AAAA,IACL,CAAC;AAAA,IACD,mBAAmB,IAAI,MAAM,aAAa,GAAG;AAAA,IAC7C,sBAAsB,IAAI,MAAM,WAAW;AAAA,IAC3C,kBAAkB,IAAI,MAAM,aAAa,EAAE;AAAA,IAC3C,SAAS,2BACL,oBAAoB,IAAI,MAAM,aAAa,4BAA4B,GAAG,IAC1E,QAAQ,QAAQ,CAAC;AAAA,IACrBC,kBAAiB,IAAI;AAAA,MACnB,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,OAAOC,iBAAgB,GAAG;AAAA,IAC5B,CAAC;AAAA,IACDD,kBAAiB,IAAI;AAAA,MACnB,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,OAAOC,iBAAgB,GAAG;AAAA,IAC5B,CAAC;AAAA,IACD,oBAAoB,IAAI;AAAA,MACtB,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AAAA,IACD,qBAAqB,IAAI;AAAA,MACvB,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,GAAG;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AAAA,EACH,CAAC;AAED,QAAM,CAAC,kBAAkB,UAAU,UAAU,IAAI,MAAM,QAAQ,IAAI;AAAA;AAAA;AAAA,IAGjE,4BAA4B,IAAI;AAAA,MAC9B,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,GAAG;AAAA,MACH,gBAAgB,YAAY,IAAI,CAAC,QAAQ,IAAI,aAAa;AAAA,IAC5D,CAAC;AAAA,IACD;AAAA,MACE;AAAA,MACA,MAAM;AAAA,MACN,WAAW,IAAI,CAAC,UAAU,MAAM,OAAO;AAAA,IACzC;AAAA,IACA,wBAAwB,IAAI;AAAA,MAC1B,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,SAAS,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,IACtC,CAAC;AAAA,EACH,CAAC;AACD,QAAM,iBAAiB,IAAI,IAAI,SAAS,IAAI,CAAC,UAAU,CAAC,MAAM,SAAS,MAAM,OAAO,CAAC,CAAC;AACtF,QAAM,qBAAqB,IAAI,IAAI,WAAW,IAAI,CAAC,UAAU,CAAC,MAAM,SAAS,MAAM,WAAW,CAAC,CAAC;AAEhG,QAAM,SAAS,UACZ,IAAI,CAAC,SAAS;AAAA,IACb,IAAI,GAAG,IAAI,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,WAAW;AAAA,IACnD,OAAO,IAAI;AAAA,IACX,UAAU,IAAI;AAAA,IACd,SAAS,cAAc,IAAI,WAAW;AAAA,IACtC,OAAO,IAAI;AAAA,IACX,aAAa,IAAI;AAAA,IACjB,cAAc,IAAI;AAAA,IAClB,cAAc,IAAI;AAAA,IAClB,kBAAkB,IAAI;AAAA,IACtB,kBAAkB,IAAI;AAAA,IACtB,iBAAiB,IAAI;AAAA,IACrB,aAAa,IAAI;AAAA,IACjB,iBAAiB,IAAI;AAAA,IACrB,iBAAiB,IAAI;AAAA,IACrB,WAAW,YAAY,IAAI,gBAAgB;AAAA,IAC3C,sBAAsB,YAAY,IAAI,2BAA2B;AAAA,IACjE,iCAAiC,IAAI;AAAA,EACvC,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,EAAE,WAAW;AAE/C,QAAM,eAAe,UAAU,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,kBAAkB,CAAC;AACjF,QAAM,oBAAoB,eAAe,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,kBAAkB,CAAC;AAC3F,QAAM,8BAA8B,UAAU;AAAA,IAC5C,CAAC,KAAK,QAAQ,MAAM,IAAI;AAAA,IACxB;AAAA,EACF;AACA,QAAM,mCAAmC,eAAe;AAAA,IACtD,CAAC,KAAK,QAAQ,MAAM,IAAI;AAAA,IACxB;AAAA,EACF;AACA,QAAM,kCAAkC,UAAU;AAAA,IAChD,CAAC,KAAK,QAAQ,MAAM,IAAI;AAAA,IACxB;AAAA,EACF;AACA,QAAM,uCAAuC,eAAe;AAAA,IAC1D,CAAC,KAAK,QAAQ,MAAM,IAAI;AAAA,IACxB;AAAA,EACF;AACA,QAAM,aAAa,UAAU,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,OAAO,CAAC;AACpE,QAAM,mBAAmB,eAAe,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,aAAa,CAAC;AACrF,QAAM,mBAAmB,eAAe,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,aAAa,CAAC;AACrF,QAAM,oBAAoB,eAAe,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,cAAc,CAAC;AACvF,QAAM,wBAAwB,eAAe,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,kBAAkB,CAAC;AAC/F,QAAM,aAAa,eAAe,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,OAAO,CAAC;AAEzE,QAAM,UACJ,MAAM,UAAU,UACZ,kBAAkB,OAAO,OAAO,OAAO,KAAK,IAC5C,iBAAiB,OAAO,OAAO,OAAO,KAAK;AACjD,QAAM,SAAS,QAAQ,IAAI,CAAC,WAAW;AACrC,UAAM,QAAQ,SAAS,IAAI,MAAM,KAAK;AAAA,MACpC,YAAY;AAAA,MACZ,6BAA6B;AAAA,MAC7B,iCAAiC;AAAA,MACjC,aAAa;AAAA,MACb,cAAc;AAAA,MACd,cAAc;AAAA,MACd,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,MAClB,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,iBAAiB;AAAA,MACjB,iBAAiB;AAAA,MACjB,OAAO;AAAA,IACT;AACA,UAAM,kBAAkB,oBACpB,MAAM,aACL,SAAS,IAAI,MAAM,KAAK,MAAM;AACnC,WAAO;AAAA,MACL,OAAO,MAAM,UAAU,UAAU,OAAO,MAAM,EAAE,IAAI,OAAO,MAAM,CAAC;AAAA,MAClE,cAAc,YAAY,eAAe;AAAA,MACzC,sBAAsB,YAAY,MAAM,2BAA2B;AAAA,MACnE,iCAAiC,MAAM;AAAA,MACvC,aAAa,SAAS,IAAI,MAAM,KAAK;AAAA,MACrC,aAAa,MAAM;AAAA,MACnB,cAAc,MAAM;AAAA,MACpB,cAAc,MAAM;AAAA,MACpB,kBAAkB,MAAM;AAAA,MACxB,kBAAkB,MAAM;AAAA,MACxB,iBAAiB,MAAM;AAAA,MACvB,aAAa,MAAM;AAAA,MACnB,iBAAiB,MAAM;AAAA,MACvB,iBAAiB,MAAM;AAAA,MACvB,aAAa,YAAY,MAAM,cAAc,MAAM,gBAAgB;AAAA,MACnE,OAAO,MAAM;AAAA,IACf;AAAA,EACF,CAAC;AAED,QAAM,oBAAoB,IAAI;AAAA,IAC5B,iBAAiB,IAAI,CAAC,QAAQ,CAAC,IAAI,eAAe,IAAI,gBAAgB,CAAC;AAAA,EACzE;AACA,QAAM,oBAAoB,KAAK;AAAA,IAC7B,YAAY,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,aAAa,CAAC;AAAA,IACzD;AAAA,EACF;AACA,QAAM,UAAU,YAAY,IAAI,CAAC,QAAQ;AACvC,UAAM,YAAY,YAAY,IAAI,gBAAgB;AAClD,UAAM,WAAW,YAAY,kBAAkB,IAAI,IAAI,aAAa,KAAK,CAAC;AAC1E,WAAO;AAAA,MACL,IAAI,QAAQ,IAAI,aAAa;AAAA,MAC7B,SAAS;AAAA,MACT,OAAO,IAAI,OAAO,KAAK,KAAK,IAAI,cAAc,MAAM,GAAG,CAAC;AAAA,MACxD;AAAA,MACA,sBAAsB,YAAY,IAAI,2BAA2B;AAAA,MACjE,iCAAiC,IAAI;AAAA,MACrC,QAAQ,IAAI;AAAA,MACZ,aAAa,YAAY,IAAI,cAAc,IAAI,gBAAgB;AAAA,MAC/D,gBACE,eAAe,IACX,KAAK,IAAI,KAAK,KAAK,MAAO,IAAI,mBAAmB,eAAgB,GAAG,CAAC,IACrE;AAAA,MACN,aAAa,KAAK,IAAI,KAAK,KAAK,MAAO,IAAI,cAAc,oBAAqB,GAAG,CAAC;AAAA,MAClF,iBAAiB,YAAY;AAAA,IAC/B;AAAA,EACF,CAAC;AAED,QAAM,mBAAmB,IAAI,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,IAAI,iBAAiB,GAAG,CAAU,CAAC;AAChG,QAAM,YAAY,MAAM,IAAI,CAAC,SAAS;AACpC,UAAM,OAAO,iBAAiB,IAAI,KAAK,EAAE;AACzC,WAAO;AAAA,MACL,IAAI,KAAK;AAAA,MACT,MAAM,KAAK;AAAA,MACX,OAAO,WAAW,IAAI,KAAK,EAAE,KAAK;AAAA,MAClC,WAAW,OAAO,YAAY,KAAK,gBAAgB,IAAI;AAAA,MACvD,sBAAsB,OAAO,YAAY,KAAK,2BAA2B,IAAI;AAAA,MAC7E,iCAAiC,OAAO,KAAK,kCAAkC;AAAA,MAC/E,QAAQ,OAAO,KAAK,cAAc;AAAA,MAClC,aAAa,OAAO,YAAY,KAAK,cAAc,KAAK,gBAAgB,IAAI;AAAA,MAC5E,SAAS,OAAO,cAAc,KAAK,WAAW,IAAI;AAAA,IACpD;AAAA,EACF,CAAC;AAED,QAAM,SAASH,6BAA4B,QAAQ;AAGnD,QAAM,QAAQ,UACX,OAAO,CAAC,QAAQ;AACf,QAAI,CAAC,MAAO,QAAO;AACnB,WAAO,IAAI,UAAU;AAAA,EACvB,CAAC,EACA,IAAI,CAAC,SAAS;AAAA,IACb,IAAI,IAAI;AAAA,IACR,OAAO,IAAI,OAAO,KAAK,KAAK;AAAA,IAC5B,OAAO,WAAW,GAAG;AAAA,IACrB,OAAO,IAAI;AAAA,IACX,OAAO,IAAI;AAAA,IACX,UAAU;AAAA,IACV,UAAU,SAAS,IAAI,WAAW,GAAG;AAAA,IACrC,aAAa;AAAA,IACb,OAAO,IAAI;AAAA,EACb,EAAE;AAEJ,QAAM,WAAW,0BAA0B,MAAM;AAAA,IAC/C,OAAO,MAAM;AAAA,IACb,YAAY,OAAO;AAAA,IACnB,YAAY,OAAO;AAAA,IACnB,aAAa,OAAO;AAAA,IACpB,kBAAkB,OAAO;AAAA,IACzB,aAAa,OAAO,MAAM,YAAY;AAAA,IACtC,WAAW,OAAO,MAAM,YAAY;AAAA,IACpC,aAAa,IAAI,YAAY;AAAA,IAC7B,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,MAAM,QAAQ,IAAI,CAAC,YAAY;AAAA,MACpC,OAAO,OAAO;AAAA,MACd,UAAU,OAAO;AAAA,IACnB,EAAE;AAAA,IACF;AAAA,IACA;AAAA,IACA,aAAa,YAAY,IAAI,CAAC,SAAS;AAAA,MACrC,IAAI,IAAI;AAAA,MACR,YAAY,IAAI,WAAW,YAAY;AAAA,MACvC,YAAY,IAAI,WAAW,YAAY;AAAA,MACvC,WAAW,IAAI;AAAA,MACf,cAAc,IAAI,cAAc,KAAK,KAAK;AAAA,MAC1C,QAAQ,IAAI;AAAA,MACZ,UAAU,IAAI;AAAA,MACd,aAAa,IAAI;AAAA,MACjB,OAAO,IAAI;AAAA,MACX,SAAS,cAAc,IAAI,WAAW;AAAA,MACtC,aAAa,IAAI;AAAA,MACjB,cAAc,IAAI;AAAA,MAClB,cAAc,IAAI;AAAA,MAClB,kBAAkB,IAAI;AAAA,MACtB,iBAAiB,IAAI;AAAA,MACrB,aAAa,IAAI;AAAA,MACjB,WAAW,YAAY,IAAI,gBAAgB;AAAA,MAC3C,sBACE,IAAI,+BAA+B,OAC/B,OACA,YAAY,IAAI,2BAA2B;AAAA,MACjD,eAAe,gBAAgB,IAAI,aAAa;AAAA,IAClD,EAAE;AAAA,IACF;AAAA,IACA;AAAA,IACA,YAAY,WAAW,IAAI,CAAC,WAAW;AAAA,MACrC,IAAI,MAAM;AAAA,MACV,SAAS,MAAM;AAAA,MACf,OAAO,MAAM,QAAQ,MAAM,GAAG,CAAC;AAAA,MAC/B,SAAS,eAAe,IAAI,MAAM,OAAO,KAAK;AAAA,MAC9C,aAAa,MAAM;AAAA,MACnB,kBAAkB,SAAS,IAAI,MAAM,OAAO,KAAK;AAAA,IACnD,EAAE;AAAA,IACF,UAAU,SAAS,IAAI,CAAC,WAAW;AAAA,MACjC,IAAI,MAAM;AAAA,MACV,SAAS,MAAM;AAAA,MACf,SAAS,MAAM;AAAA,MACf,aAAa,MAAM;AAAA,MACnB,eAAe,MAAM;AAAA,MACrB,cAAc,MAAM,cAAc,IAAI,WAAW;AAAA,MACjD,aAAa,mBAAmB,IAAI,MAAM,OAAO,KAAK;AAAA,IACxD,EAAE;AAAA,IACF;AAAA,IACA,mBAAmB,SAAS;AAAA,IAC5B;AAAA,IACA,oBAAoB,YAAY,qBAAqB;AAAA,IACrD,yBAAyB,YAAY,0BAA0B;AAAA,IAC/D,WAAW,YAAY,YAAY;AAAA,IACnC,gBAAgB,YAAY,iBAAiB;AAAA,IAC7C,sBAAsB,YAAY,2BAA2B;AAAA,IAC7D,2BAA2B,YAAY,gCAAgC;AAAA,IACvE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,YAAY,mBAAmB,qBAAqB;AAAA,IACtE;AAAA,IACA,aAAa,MAAM;AAAA,IACnB,gBAAgB,MAAM;AAAA,IACtB,iBAAiB,MAAM;AAAA,IACvB,cAAc,MAAM;AAAA,IACpB,cAAc,MAAM;AAAA,IACpB,qBAAqB,MAAM,uBAAuB;AAAA,IAClD,UAAU,KAAK,MAAM,MAAM,WAAW,EAAE,IAAI;AAAA,IAC5C,aAAa,SAAS,OAAO,CAAC,UAAU,MAAM,gBAAgB,CAAC,EAAE;AAAA,IACjE;AAAA,IACA,kBAAkB,OAAO,gCAAgC;AAAA,IACzD;AAAA,IACA,aAAa,OAAO,mCAAmC;AAAA,IACvD;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS;AACpB;;;AChlBA,SAAS,cAAAI,mBAAkB;AAC3B;AAAA,EACE,cAAAC;AAAA,OAGK;;;ACLA,IAAM,wCAAwC;AAErD,IAAM,sBAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,4BAA4B;AAClC,IAAM,gCACJ;AACF,IAAM,yBAAyB;AAQxB,SAAS,6BAA6B,OAAuB;AAClE,MAAI,YAAY;AAChB,aAAW,WAAW,qBAAqB;AACzC,gBAAY,UAAU,QAAQ,SAAS,qCAAqC;AAAA,EAC9E;AACA,cAAY,UAAU;AAAA,IACpB;AAAA,IACA,UAAU,qCAAqC;AAAA,EACjD;AACA,cAAY,UAAU;AAAA,IACpB;AAAA,IACA,CAAC,QAAQ,QAAgB,SACvB,GAAG,MAAM,GAAG,IAAI,IAAI,qCAAqC;AAAA,EAC7D;AACA,SAAO,UAAU;AAAA,IACf;AAAA,IACA,CAAC,QAAQ,WAAmB,GAAG,MAAM,GAAG,qCAAqC;AAAA,EAC/E;AACF;;;ADjCA,IAAM,eAAe;AACrB,IAAM,2BAA2B;AACjC,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY;AAEzB,IAAM,kCAAkC;AACxC,IAAM,sCAAsC;AAC5C,IAAM,wCAAwC;AAC9C,IAAM,oCAAoC;AAC1C,IAAM,+BAA+B;AACrC,IAAM,oCAAoC;AAC1C,IAAM,yCAAyC;AAoB/C,IAAM,0CAA0C;AAAA,EACrD,SAAS;AAAA,EACT,iBAAiB,CAAC,OAAO;AAAA,EACzB,mBAAmB,CAAC,QAAQ;AAC9B;AA4FA,IAAM,cAAc,oBAAI,IAA2B,CAAC,SAAS,UAAU,OAAO,CAAC;AAC/E,IAAM,kBAAkB,oBAAI,IAA8B,CAAC,QAAQ,UAAU,OAAO,CAAC;AACrF,IAAM,eAAe,oBAAI,IAA2B,CAAC,WAAW,aAAa,YAAY,CAAC;AAC1F,IAAM,UAAU,oBAAI,IAAuB,CAAC,UAAU,eAAe,CAAC;AACtE,IAAM,YAAY,oBAAI,IAAyB,CAAC,aAAa,YAAY,CAAC;AAC1E,IAAM,cAAc,oBAAI,IAAwD;AAAA,EAC9E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,kBAAkB,oBAAI,IAA2B;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,eAAe,oBAAI,IAAyB;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,mBAAmB,oBAAI,IAA2B,CAAC,UAAU,UAAU,CAAC;AAQvE,SAAS,+BACd,OACgC;AAChC,QAAM,SAAS,MAAM,UAAU;AAC/B,MAAI,CAAC,YAAY,MAAM,EAAG,QAAO,OAAO,eAAe;AACvD,MAAI,CAAC,OAAO,QAAS,QAAO,OAAO,UAAU;AAE7C,MAAI,MAAM,OAAO,eAAe,mBAAoB,QAAO,OAAO,oBAAoB;AACtF,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO,OAAO,eAAe;AACxD,MACE,MAAM,OAAO,cAAc,MAAM,QAAQ,aACzC,MAAM,OAAO,gBAAgB,MAAM,QAAQ,aAC3C;AACA,WAAO,OAAO,iBAAiB;AAAA,EACjC;AACA,MAAI,MAAM,OAAO,SAAS,WAAY,QAAO,OAAO,cAAc;AAClE,MAAI,MAAM,OAAO,cAAc,YAAa,QAAO,OAAO,kBAAkB;AAC5E,MAAI,MAAM,aAAa,aAAa,YAAa,QAAO,OAAO,qBAAqB;AACpF,MAAI,MAAM,OAAO,WAAW,gBAAiB,QAAO,OAAO,mBAAmB;AAC9E,MAAI,MAAM,aAAa,cAAc,QAAS,QAAO,OAAO,YAAY;AAExE,QAAM,eAAe,iBAAiB,KAAK;AAC3C,MAAI,aAAc,QAAO,OAAO,YAAY;AAC5C,MAAI,CAAC,wBAAwB,KAAK,EAAG,QAAO,OAAO,mBAAmB;AACtE,MAAI,CAAC,mBAAmB,KAAK,EAAG,QAAO,OAAO,wBAAwB;AAEtE,QAAM,eAAe,sBAAsB,QAAQ,MAAM,YAAY;AACrE,MAAI,CAAC,aAAc,QAAO,OAAO,oBAAoB;AAErD,QAAM,mBAAmB;AAAA,IACvB,aAAa,MAAM,aAAa,YAAY;AAAA,EAC9C;AACA,MAAI,CAAC,iBAAkB,QAAO,OAAO,iBAAiB;AACtD,QAAM,UAAU,aAAa,kBAAkB,mCAAmC;AAElF,QAAM,YAAY,mBAAmB,MAAM,OAAO,SAAS;AAC3D,QAAM,SAAS,gBAAgB,MAAM,OAAO,MAAM;AAClD,MAAI,CAAC,aAAa,CAAC,OAAQ,QAAO,OAAO,eAAe;AAExD,QAAM,QAAQ,oBAAoB,MAAM,OAAO,YAAY,iCAAiC;AAC5F,QAAM,aAA+C;AAAA,IACnD,SAAS;AAAA,IACT,aAAa,MAAM,QAAQ;AAAA,IAC3B,UAAU,MAAM,OAAO;AAAA,IACvB,eAAe,MAAM,OAAO;AAAA,IAC5B,YAAY,MAAM,OAAO;AAAA,IACzB,iBAAiB,MAAM,OAAO;AAAA,IAC9B,YAAY,IAAI,KAAK,MAAM,OAAO,UAAU,EAAE,YAAY;AAAA,IAC1D,YAAY,MAAM,aAAa;AAAA,IAC/B;AAAA,IACA,SAAS,QAAQ;AAAA,IACjB,kBAAkB,QAAQ;AAAA,IAC1B;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,iBAAiB,OAAO;AAAA,IACxB,YAAY,MAAM;AAAA,IAClB,qBAAqB,MAAM;AAAA,IAC3B,qBAAqB;AAAA,MACnB,aAAa,MAAM,QAAQ;AAAA,MAC3B,UAAU,MAAM,OAAO;AAAA,IACzB;AAAA,EACF;AAEA,MAAI,UAAUC,YAAW,UAAU,CAAC,IAAI,wCAAwC;AAC9E,WAAO,OAAO,eAAe;AAAA,EAC/B;AAEA,QAAM,SAASC,YAAW,QAAQ,EAAE,OAAOD,YAAW,UAAU,GAAG,MAAM,EAAE,OAAO,KAAK;AACvF,SAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA,IACA,gBAAgB,iBAAiB,+BAA+B,IAAI,MAAM;AAAA,IAC1E;AAAA,EACF;AACF;AAEA,SAAS,YAAY,QAA+C;AAClE,SACE,OAAO,OAAO,YAAY,aAC1B,MAAM,QAAQ,OAAO,eAAe,KACpC,MAAM,QAAQ,OAAO,iBAAiB,KACtC,OAAO,gBAAgB,MAAM,CAAC,eAAe,YAAY,IAAI,UAAU,CAAC,KACxE,OAAO,kBAAkB,MAAM,CAAC,eAAe,YAAY,IAAI,UAAU,CAAC;AAE9E;AAEA,SAAS,cAAc,OAA6C;AAClE,QAAM,QAAQ;AAAA,IACZ,MAAM,QAAQ;AAAA,IACd,MAAM,QAAQ;AAAA,IACd,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,EACf,EAAE,OAAO,CAAC,UAA2B,UAAU,IAAI;AACnD,SACE,MAAM,MAAM,CAAC,UAAU,aAAa,KAAK,KAAK,CAAC,KAC/C,OAAO,cAAc,MAAM,OAAO,OAAO,KACzC,MAAM,OAAO,UAAU,KACvB,OAAO,MAAM,OAAO,cAAc,YAClC,MAAM,QAAQ,MAAM,OAAO,MAAM,KACjC,MAAM,OAAO,OAAO,MAAM,CAAC,UAAU,OAAO,UAAU,QAAQ,MAC7D,MAAM,OAAO,eAAe,UAC3B,MAAM,OAAO,eAAe,QAC5B,OAAO,MAAM,OAAO,eAAe,aACrC,OAAO,MAAM,aAAa,iBAAiB,YAC3C,YAAY,IAAI,MAAM,aAAa,UAAU,KAC7C,gBAAgB,IAAI,MAAM,aAAa,SAAS,KAChD,aAAa,IAAI,MAAM,OAAO,IAAI,KAClC,QAAQ,IAAI,MAAM,OAAO,MAAM,KAC/B,UAAU,IAAI,MAAM,aAAa,QAAQ,KACzC,YAAY,IAAI,MAAM,OAAO,SAAS,KACtC,gBAAgB,IAAI,MAAM,OAAO,MAAM,KACvC,aAAa,IAAI,MAAM,OAAO,IAAI;AAEtC;AAEA,SAAS,iBACP,OACsD;AACtD,QAAM,MAAM,KAAK,MAAM,MAAM,QAAQ,GAAG;AACxC,QAAM,aAAa,KAAK,MAAM,MAAM,OAAO,UAAU;AACrD,QAAM,YAAY,KAAK,MAAM,MAAM,OAAO,SAAS;AACnD,QAAM,aAAa,MAAM,OAAO,eAAe,OAAO,OAAO,KAAK,MAAM,MAAM,OAAO,UAAU;AAC/F,MACE,CAAC,OAAO,SAAS,GAAG,KACpB,CAAC,OAAO,SAAS,UAAU,KAC3B,CAAC,OAAO,SAAS,SAAS,KACzB,eAAe,QAAQ,CAAC,OAAO,SAAS,UAAU,KAClD,eAAe,QAAQ,cAAc,WACtC;AACA,WAAO;AAAA,EACT;AACA,MAAI,MAAM,UAAW,QAAO;AAC5B,MAAI,eAAe,QAAQ,OAAO,WAAY,QAAO;AACrD,SAAO;AACT;AAEA,SAAS,mBAAmB,OAA6C;AACvE,MACE,MAAM,OAAO,iBAAiB,MAAM,OAAO,MAC3C,MAAM,OAAO,mBAAmB,MAAM,OAAO,MAC7C,MAAM,OAAO,oBAAoB,MAAM,OAAO,IAC9C;AACA,WAAO;AAAA,EACT;AAEA,UAAQ,MAAM,OAAO,MAAM;AAAA,IACzB,KAAK;AACH,aACE,MAAM,OAAO,oBAAoB,QACjC,MAAM,OAAO,iBAAiB,QAC9B,MAAM,OAAO,mBAAmB;AAAA,IAEpC,KAAK;AACH,aACE,MAAM,OAAO,oBAAoB,QACjC,MAAM,OAAO,oBAAoB,MAAM,OAAO,MAC9C,MAAM,OAAO,iBAAiB,MAAM,OAAO,mBAC3C,MAAM,OAAO,mBAAmB;AAAA,IAEpC,KAAK;AACH,aACE,MAAM,OAAO,oBAAoB,QACjC,MAAM,OAAO,oBAAoB,MAAM,OAAO,MAC9C,MAAM,OAAO,mBAAmB,MAAM,OAAO;AAAA,EAEnD;AACF;AAEA,SAAS,wBAAwB,OAA6C;AAC5E,SAAO,MAAM,OAAO,SAAS,eACzB,MAAM,OAAO,WAAW,eACxB,iBAAiB,IAAI,MAAM,OAAO,MAAM;AAC9C;AAEA,SAAS,sBACP,QACA,cACgC;AAChC,QAAM,OAAO,IAAI,IAAI,OAAO,eAAe;AAC3C,QAAM,SAAS,IAAI,IAAI,OAAO,iBAAiB;AAC/C,MAAI,aAAa,cAAc,UAAU;AACvC,WAAO,KAAK,IAAI,aAAa,UAAU,KAAK,OAAO,IAAI,aAAa,UAAU,IAC1E,WACA;AAAA,EACN;AACA,MAAI,KAAK,IAAI,aAAa,UAAU,EAAG,QAAO;AAC9C,MAAI,OAAO,IAAI,aAAa,UAAU,EAAG,QAAO;AAChD,SAAO;AACT;AAEA,SAAS,mBAAmB,OAA8B;AACxD,QAAM,UAAU,MAAM,KAAK;AAC3B,QAAM,YAAY,QAAQ,YAAY;AACtC,MAAI,CAAC,aAAa,UAAU,SAAS,IAAI,sCAAuC,QAAO;AACvF,QAAM,WAAW,UAAU,MAAM,GAAG;AACpC,MAAI,SAAS,KAAK,CAAC,YAAY,CAAC,yBAAyB,KAAK,OAAO,CAAC,EAAG,QAAO;AAChF,SAAO,SAAS,KAAK,GAAG;AAC1B;AAEA,SAAS,gBACP,QACiD;AACjD,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO;AACnC,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,UAAU,MAAM,KAAK;AAC3B,UAAM,QAAQ,QAAQ,YAAY;AAClC,QACE,CAAC,yBAAyB,KAAK,KAAK,KACpC,UAAU,KAAK,IAAI,mCACnB;AACA,aAAO;AAAA,IACT;AACA,WAAO,IAAI,KAAK;AAAA,EAClB;AACA,QAAM,SAAS,CAAC,GAAG,MAAM,EAAE,KAAK;AAChC,SAAO;AAAA,IACL,QAAQ,OAAO,MAAM,GAAG,4BAA4B;AAAA,IACpD,WAAW,OAAO,SAAS;AAAA,EAC7B;AACF;AAEA,SAAS,oBACP,OACA,UAC8C;AAC9C,QAAM,YAAY,6BAA6B,aAAa,SAAS,EAAE,CAAC;AACxE,MAAI,CAAC,UAAW,QAAO,EAAE,OAAO,MAAM,WAAW,MAAM;AACvD,QAAM,UAAU,aAAa,WAAW,QAAQ;AAChD,SAAO;AAAA,IACL,OAAO,QAAQ,SAAS;AAAA,IACxB,WAAW,QAAQ;AAAA,EACrB;AACF;AAEA,SAAS,aAAa,OAAuB;AAE3C,SAAO,MACJ,QAAQ,iCAAiC,GAAG,EAC5C,QAAQ,QAAQ,GAAG,EACnB,KAAK;AACV;AAEA,SAAS,aAAa,OAAe,UAAyD;AAC5F,QAAM,QAAQ,QAAQ,OAAO,KAAK;AAClC,MAAI,MAAM,cAAc,SAAU,QAAO,EAAE,OAAO,WAAW,MAAM;AACnE,QAAM,SAAS;AACf,QAAM,cAAc,QAAQ,OAAO,MAAM;AACzC,MAAI,MAAM,KAAK,IAAI,GAAG,WAAW,YAAY,UAAU;AACvD,SAAO,MAAM,MAAM,MAAM,GAAG,IAAK,SAAU,IAAM,QAAO;AACxD,SAAO;AAAA,IACL,OAAO,GAAG,QAAQ,OAAO,MAAM,SAAS,GAAG,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,MAAM;AAAA,IACnE,WAAW;AAAA,EACb;AACF;AAEA,SAAS,UAAU,OAAuB;AACxC,SAAO,QAAQ,OAAO,KAAK,EAAE;AAC/B;AAEA,SAAS,OAAO,QAA4E;AAC1F,SAAO,EAAE,UAAU,OAAO,OAAO;AACnC;;;AErbA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAUK;AAmBP,eAAsB,wCACpB,IACA,OACA,aACA,UAC+F;AAC/F,SAAO,MAAM,iBAAiB,IAAI,MAAM,aAAa,OAAO,aAAa;AACvE,UAAM,SAAS,MAAM,oBAAoB,UAAU,OAAO,QAAQ;AAClE,UAAM,mBAAmB,cACrB,MAAM,2BAA2B,UAAU,OAAO,QAAQ,WAAW,IACrE,EAAE,UAAU,MAAM,SAAS,KAAK;AACpC,WAAO,EAAE,GAAG,QAAQ,iBAAiB;AAAA,EACvC,CAAC;AACH;AAEA,eAAsB,2CACpB,IACA,OACA,aACA,UAGA;AACA,SAAO,MAAM,iBAAiB,IAAI,MAAM,aAAa,OAAO,aAAa;AACvE,UAAM,SAAS,MAAM,uBAAuB,UAAU,OAAO,QAAQ;AACrE,QAAI,CAAC,eAAe,OAAO,WAAW,gBAAgB,CAAC,OAAO,aAAa;AACzE,aAAO,EAAE,GAAG,QAAQ,kBAAkB,EAAE,UAAU,MAAM,SAAS,KAAK,EAAE;AAAA,IAC1E;AACA,UAAM,cAAc,MAAM,iBAAiB,UAAU,MAAM,aAAa,OAAO,YAAY,EAAE;AAC7F,UAAM,mBAAmB,MAAM,mBAAmB,UAAU;AAAA,MAC1D,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,iBAAiB,OAAO,OAAO;AAAA,MAC/B,YAAY,OAAO,YAAY;AAAA,MAC/B;AAAA,IACF,CAAC;AACD,WAAO,EAAE,GAAG,QAAQ,iBAAiB;AAAA,EACvC,CAAC;AACH;AAEA,eAAe,2BACb,IACA,OACA,QACA,aAC6C;AAC7C,MAAI,OAAO,WAAY,OAAO,WAAW,CAAC,OAAO,YAAa;AAC5D,WAAO,EAAE,UAAU,MAAM,SAAS,KAAK;AAAA,EACzC;AAEA,MAAI,OAAO,YAAY;AACrB,UAAM,cAAc,MAAM,iBAAiB,IAAI,MAAM,aAAa,OAAO,OAAO,EAAE;AAClF,QAAI,YAAY,iBAAiB,OAAO,WAAW,IAAI;AACrD,aAAO,MAAM,mBAAmB,IAAI;AAAA,QAClC,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,iBAAiB,OAAO,WAAW;AAAA,QACnC,YAAY,OAAO,OAAO;AAAA,QAC1B;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,UAAU,MAAM,iBAAiB,IAAI,MAAM,aAAa,OAAO,WAAW,EAAE;AAClF,WAAO,MAAM,mBAAmB,IAAI;AAAA,MAClC,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,iBAAiB,OAAO,OAAO;AAAA,MAC/B,YAAY,OAAO,WAAW;AAAA,MAC9B;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,UAAU,MAAM,iBAAiB,IAAI,MAAM,aAAa,OAAO,OAAO,EAAE;AAC9E,SAAO,MAAM,mBAAmB,IAAI;AAAA,IAClC,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,iBAAiB;AAAA,IACjB,YAAY,OAAO,OAAO;AAAA,IAC1B;AAAA,EACF,CAAC;AACH;AAEA,eAAe,mBACb,IACA,OAS6C;AAC7C,QAAM,gBAAgB,MAAM,8CAA8C,IAAI,MAAM,WAAW;AAC/F,QAAM,WAAW,+BAA+B;AAAA,IAC9C,SAAS;AAAA,MACP,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,KAAK,MAAM;AAAA,IACb;AAAA,IACA,QAAQ,gBACJ;AAAA,MACE,SAAS,cAAc;AAAA,MACvB,iBAAiB,cAAc;AAAA,MAC/B,mBAAmB,cAAc;AAAA,IACnC,IACA;AAAA,IACJ,QAAQ;AAAA,MACN,YAAY;AAAA,MACZ,WAAW,MAAM,SAAS;AAAA,MAC1B,aAAa,MAAM,SAAS;AAAA,MAC5B,IAAI,MAAM,SAAS;AAAA,MACnB,SAAS,MAAM,SAAS;AAAA,MACxB,QAAQ,MAAM,SAAS;AAAA,MAGvB,MAAM,MAAM,SAAS;AAAA,MAGrB,WAAW,MAAM,SAAS;AAAA,MAG1B,WAAW,MAAM,SAAS;AAAA,MAC1B,QAAQ,MAAM,SAAS;AAAA,MACvB,WAAW,MAAM,SAAS;AAAA,MAC1B,YAAY,MAAM,SAAS;AAAA,MAC3B,cAAc,MAAM,SAAS;AAAA,MAC7B,gBAAgB,MAAM,SAAS;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,iBAAiB,MAAM;AAAA,MACvB,YAAY,MAAM;AAAA,MAClB,QAAQ,MAAM,YAAY,UAAU;AAAA,MACpC,YAAY,MAAM,YAAY,cAAc;AAAA,IAC9C;AAAA,IACA,cAAc,MAAM,YAAY;AAAA,EAClC,CAAC;AACD,MAAI,CAAC,SAAS,SAAU,QAAO,EAAE,UAAU,SAAS,KAAK;AAEzD,QAAM,UAAU,MAAM,8BAA8B,IAAI;AAAA,IACtD,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,YAAY;AAAA,IACZ,UAAU,MAAM,SAAS;AAAA,IACzB,eAAe,OAAO,MAAM,SAAS,OAAO;AAAA,IAC5C,sBAAsB,SAAS;AAAA,IAC/B,YAAY,SAAS;AAAA,IACrB,YAAY,SAAS,WAAW;AAAA,IAChC,cAAc,SAAS;AAAA,IACvB,OAAO,MAAM,YAAY;AAAA,EAC3B,CAAC;AACD,SAAO,EAAE,UAAU,QAAQ;AAC7B;AAEA,eAAe,iBAAiB,IAAc,aAAqB,UAAkB;AACnF,QAAM,WAAW,MAAM,2CAA2C,IAAI,aAAa,QAAQ;AAC3F,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,2DAA2D;AAC1F,SAAO;AACT;;;AC3MA;AAAA,EACE,iCAAAE;AAAA,EACA,iDAAAC;AAAA,OAGK;AAiFP,eAAsB,qCACpB,IACA,SACgD;AAChD,QAAM,EAAE,SAAS,SAAAC,SAAQ,IAAI;AAC7B,MAAI,QAAQ,OAAOA,SAAQ,aAAa,QAAQ,cAAcA,SAAQ,WAAW;AAC/E,WAAO,EAAE,MAAM,qBAAqB,SAAS,KAAK;AAAA,EACpD;AACA,MAAIA,SAAQ,SAAS,OAAO,SAAS,aAAa;AAChD,WAAO,EAAE,MAAM,wBAAwB,SAAS,KAAK;AAAA,EACvD;AACA,MACE,QAAQ,QAAQ,cAAc,WAC9B,QAAQ,QAAQ,SAAS,KAAK,CAAC,aAAa,SAAS,SAAS,WAAW,GACzE;AAGA,WAAO,EAAE,MAAM,gCAAgC,SAAS,KAAK;AAAA,EAC/D;AAEA,QAAM,aAAa,+BAA+B,OAAO;AACzD,MAAI,CAAC,WAAY,QAAO,EAAE,MAAM,oBAAoB,SAAS,KAAK;AAClE,QAAM,aAAa,0BAA0B,OAAO;AACpD,QAAM,gBAAgB,MAAMC;AAAA,IAC1B;AAAA,IACA,QAAQ;AAAA,EACV;AACA,QAAM,eAAe,eAAe,gBAAgB,SAAS,UAAU,IACnE,SACA,eAAe,kBAAkB,SAAS,UAAU,IAClD,WACA;AACN,MAAI,CAAC,eAAe,WAAW,CAAC,cAAc;AAC5C,WAAO,EAAE,MAAM,gBAAgB,SAAS,KAAK;AAAA,EAC/C;AAEA,QAAM,UAAU,MAAMC,+BAA8B,IAAI;AAAA,IACtD,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,YAAY;AAAA,IACZ,UAAUF,SAAQ;AAAA,IAClB,eAAeA,SAAQ;AAAA,IACvB,sBAAsB,oBAAoBA,SAAQ,SAAS;AAAA,IAC3D;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO;AAAA,MACL,MAAM,QAAQ,MAAM;AAAA,MACpB,WAAW,QAAQ,MAAM;AAAA,MACzB,0BAA0B,QAAQ;AAAA,MAClC,WAAW,QAAQ;AAAA,MACnB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF,CAAC;AACD,SAAO,EAAE,MAAM,YAAY,QAAQ;AACrC;AAEO,SAAS,0BACd,SAC8B;AAC9B,MAAI,QAAQ,QAAQ,YAAY,YAAY,QAAQ,QAAQ,YAAY,eAAe;AACrF,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,QAAQ,YAAY,UAAU,QAAQ,QAAQ,YAAY,0BAA0B;AAC9F,WAAO;AAAA,EACT;AACA,MACE,QAAQ,QAAQ,QAAQ,cAAc,WACtC,CAAC,YAAY,qBAAqB,+BAA+B,gBAAgB,EAAE;AAAA,IACjF,QAAQ,QAAQ,QAAQ,QAAQ;AAAA,EAClC,GACA;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,+BACd,SACuC;AACvC,QAAM,UAAU,uBAAuB,OAAO;AAC9C,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO;AAAA,IACL;AAAA,IACA,SAAS,QAAQ,QAAQ;AAAA,IACzB,cAAc,QAAQ,QAAQ,SAAS;AAAA,IACvC,aAAa,4BAA4B,QAAQ,QAAQ,SAAS,aAAa,GAAG;AAAA,IAClF,WAAW,QAAQ,QAAQ,SAAS;AAAA,IACpC,UAAU,QAAQ,QAAQ,WACtB;AAAA,MACE,SAAS,QAAQ,QAAQ,SAAS;AAAA,MAClC,IAAI,QAAQ,QAAQ,SAAS;AAAA,MAC7B,SAAS,QAAQ,QAAQ,SAAS;AAAA,MAClC,QAAQ,QAAQ,QAAQ,SAAS;AAAA,IACnC,IACA;AAAA,IACJ,YAAY,QAAQ,QAAQ;AAAA,EAC9B;AACF;AAEA,SAAS,uBAAuB,SAAqD;AACnF,MAAI,QAAQ,QAAQ,QAAQ,cAAc,YAAY;AACpD,UAAM,cACJ,4BAA4B,QAAQ,QAAQ,SAAS,aAAa,GAAG,KACrE;AACF,WAAO,6CAA6C,WAAW;AAAA,EACjE;AACA,QAAM,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,SAAS,QAAQ,QAAQ,GAAG,EAAE,KAAK;AACnF,SAAO,UAAU,6BAA6B,OAAO,EAAE,MAAM,GAAG,GAAG,IAAI;AACzE;AAEA,SAAS,4BAA4B,OAAsB,UAAiC;AAC1F,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,YAAY,6BAA6B,MAAM,QAAQ,QAAQ,GAAG,EAAE,KAAK,CAAC;AAChF,SAAO,YAAY,UAAU,MAAM,GAAG,QAAQ,IAAI;AACpD;;;ACzMA;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EAGE;AAAA,EACA;AAAA,OACK;AA2CP,SAAS,OAAO,OAAgB,MAAuC;AACrE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,UAAM,IAAI,MAAM,GAAG,IAAI,oBAAoB;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAgB,MAAsB;AAC5D,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,MAAM,GAAG,IAAI,6BAA6B;AAAA,EACtD;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAgB,MAA6B;AACnE,MAAI,UAAU,KAAM,QAAO;AAC3B,SAAO,eAAe,OAAO,IAAI;AACnC;AAEA,SAAS,UAAU,OAA+C;AAChE,MAAI,UAAU,WAAW,UAAU,WAAW,UAAU,UAAW,QAAO;AAC1E,QAAM,IAAI,MAAM,gDAAgD;AAClE;AAEA,SAAS,aAAa,OAAgB;AACpC,QAAM,UAAU,OAAO,OAAO,0BAA0B;AACxD,QAAM,QAAQ,OAAO,QAAQ,OAAO,wBAAwB;AAC5D,SAAO;AAAA,IACL,IAAI,eAAe,QAAQ,IAAI,6BAA6B;AAAA,IAC5D,WAAW,eAAe,QAAQ,WAAW,6BAA6B;AAAA,IAC1E,aAAa,eAAe,QAAQ,aAAa,+BAA+B;AAAA,IAChF,OAAO;AAAA,MACL,MAAM,UAAU,MAAM,IAAI;AAAA,MAC1B,WAAW,eAAe,MAAM,WAAW,gCAAgC;AAAA,IAC7E;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,OAAgB;AACvC,QAAM,QAAQ,OAAO,OAAO,wCAAwC;AACpE,QAAM,UAAU,aAAa,MAAM,OAAO;AAC1C,QAAM,UAAU,OAAO,MAAM,SAAS,gCAAgC;AACtE,QAAM,WAAW,OAAO,MAAM,UAAU,iCAAiC;AACzE,QAAM,QAAQ,OAAO,SAAS,OAAO,iCAAiC;AACtE,QAAM,UAAU,OAAO,QAAQ,SAAS,0BAA0B;AAClE,MACE,QAAQ,cAAc,WACtB,QAAQ,cAAc,QAAQ,MAC9B,QAAQ,kBAAkB,qBAC1B,SAAS,gBAAgB,WACzB,SAAS,gBAAgB,qBACzB,MAAM,SAAS,kBACd,SAAS,cAAc,YAAY,SAAS,cAAc,YAC3D;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,4BAA4B,MAAM;AAAA,IACvC,aAAa,QAAQ;AAAA,IACrB,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,gBAAgB,QAAQ,MAAM;AAAA,IAC9B,WAAW,QAAQ,MAAM;AAAA,IACzB,WAAW,SAAS;AAAA,IACpB,SAAS;AAAA,MACP,MAAM,kCAAkC,MAAM,QAAQ,IAAI;AAAA,MAC1D,SAAS,eAAe,QAAQ,SAAS,kCAAkC;AAAA,MAC3E,WAAW,eAAe,QAAQ,WAAW,qCAAqC;AAAA,IACpF;AAAA,IACA,UAAU,4BAA4B,QAAQ,EAAE;AAAA,EAClD,CAAC;AACH;AAEA,SAAS,mBAAmB,OAAgB;AAC1C,QAAM,QAAQ,OAAO,OAAO,2CAA2C;AACvE,QAAM,UAAU,aAAa,MAAM,OAAO;AAC1C,QAAM,gBAAgB,aAAa,MAAM,aAAa;AACtD,QAAM,gBAAgB,OAAO,MAAM,eAAe,iCAAiC;AACnF,QAAM,iBAAiB;AAAA,IACrB,cAAc;AAAA,IACd;AAAA,EACF;AACA,QAAM,kBAAkB;AAAA,IACtB,cAAc;AAAA,IACd;AAAA,EACF;AACA,QAAM,gBAAgB,eAAe,MAAM,eAAe,gCAAgC;AAC1F,MACE,cAAc,cAAc,cAAc,MAC1C,eAAe,YAAY,qBAC3B,gBAAgB,cAAc,QAC9B,gBAAgB,UAAU,eAC1B;AACA,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,QAAQ,eAAe,MAAM,QAAQ,iCAAiC;AAAA,EACxE;AACF;AAEA,SAAS,cACP,QACuC;AACvC,SAAO;AAAA,IACL,SAAS;AAAA,IACT,IAAI,OAAO,SAAS;AAAA,IACpB,SAAS,OAAO,OAAO,SAAS,QAAQ;AAAA,IACxC,QAAQ,OAAO,YAAY,YAAY,WAAW;AAAA,EACpD;AACF;AAEA,SAAS,iBACP,QACuC;AACvC,MAAI,CAAC,OAAO,MAAO,OAAM,IAAI,MAAM,uDAAuD;AAC1F,SAAO;AAAA,IACL,SAAS;AAAA,IACT,IAAI,OAAO,MAAM,cAAc,OAAO,MAAM,aAAa,MAAM,OAAO,MAAM;AAAA,IAC5E,SAAS,OAAO,OAAO,MAAM,iBAAiB;AAAA,IAC9C,QAAQ,OAAO,OAAO,WAAW;AAAA,EACnC;AACF;AAGO,SAAS,2CACd,SAC+C;AAC/C,QAAM,YAAY,QAAQ,aAAa;AAAA,IACrC,OAAO;AAAA,IACP,UAAU;AAAA,EACZ;AACA,SAAO;AAAA,IACL,MAAM,MAAM,UAAU;AACpB,YAAM,QAAQ,gBAAgB,QAAQ;AACtC,YAAM,SAAS,MAAM,UAAU,MAAM,QAAQ,IAAI,KAAK;AACtD,aAAO;AAAA,QACL,SAAS,OAAO;AAAA,QAChB,UAAU,cAAc,MAAM;AAAA,QAC9B,mBAAmB,OAAO;AAAA,QAC1B,UAAU;AAAA,UACR,WAAW,OAAO,kBAAkB;AAAA,UACpC,iBAAiB;AAAA,UACjB,OAAO,OAAO;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,UAAU;AACvB,YAAM,QAAQ,mBAAmB,QAAQ;AACzC,YAAM,SAAS,MAAM,UAAU,SAAS,QAAQ,IAAI;AAAA,QAClD,aAAa,MAAM,QAAQ;AAAA,QAC3B,WAAW,MAAM,QAAQ;AAAA,QACzB,aAAa,MAAM,QAAQ;AAAA,QAC3B,gBAAgB,MAAM,QAAQ,MAAM;AAAA,QACpC,WAAW,MAAM,QAAQ,MAAM;AAAA,QAC/B,OAAO,MAAM;AAAA,QACb,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,QACL,UAAU,iBAAiB,MAAM;AAAA,QACjC,mBAAmB;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACF;;;AC5NA,SAAS,cAAAG,mBAAkB;AAUpB,IAAM,0CAA0C;AAChD,IAAM,iDAAiD;AACvD,IAAM,iDAAiD;AACvD,IAAM,mCAAmC,KAAK;AAC9C,IAAM,oCAAoC;AAC1C,IAAM,8CAA8C;AACpD,IAAM,oDAAoD;AAC1D,IAAM,4CAA4C;AAClD,IAAM,2CAA2C;AAExD,IAAM,6BAA6B;AACnC,IAAM,uBAAuB;AAC7B,IAAM,qBAAqB;AAC3B,IAAM,iBAAiB;AACvB,IAAM,uBAAuB;AAC7B,IAAM,cAAc,IAAI,YAAY;AAuP7B,SAAS,qCACd,OAC6B;AAC7B,oBAAkB,OAAO,oBAAoB;AAAA,IAC3C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,WAAW,uCAAuC,MAAM,QAAQ;AACtE,QAAM,eAAe,0CAA0C;AAAA,IAC7D;AAAA,IACA,wBAAwB,MAAM;AAAA,EAChC,CAAC;AACD,QAAM,QAAQ,2BAA2B,cAAc,MAAM,KAAK;AAClE,QAAM,QAAQ,2BAA2B,cAAc,MAAM,KAAK;AAClE,QAAM,kBAAkB,iBAAiB,UAAU,SAAS,MAAM,eAAe;AACjF,QAAM,oBAAoB,iBAAiB,UAAU,WAAW,MAAM,iBAAiB;AACvF,QAAM,aAAa,mBAAmB,MAAM,YAAY,oBAAoB;AAC5E,QAAM,SAAS,gBAAgB,MAAM,MAAM;AAC3C,QAAM,OAAO,iBAAiB,MAAM,MAAM,gBAAgB,IAAI;AAC9D,QAAM,iBAAiB,MAAM,eAAe,CAAC;AAC7C,MAAI,CAAC,MAAM,QAAQ,cAAc,EAAG,OAAM,IAAI,UAAU,sCAAsC;AAC9F,MAAI,eAAe,SAAS,mCAAmC;AAC7D,UAAM,IAAI;AAAA,MACR,4CAA4C,iCAAiC;AAAA,IAC/E;AAAA,EACF;AACA,QAAM,cAAc,OAAO;AAAA,IACzB,eAAe,IAAI,CAAC,eAAe,oBAAoB,UAAU,UAAU,CAAC;AAAA,EAC9E;AACA,OAAK,OAAO,SAAS,WAAW,OAAO,SAAS,eAAe,CAAC,QAAQ,CAAC,YAAY,QAAQ;AAC3F,UAAM,IAAI,UAAU,oEAAoE;AAAA,EAC1F;AACA,SAAO,OAAO,OAAO;AAAA,IACnB,eAAe;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,eAAe,gCAAgC,cAAc,eAAe;AAAA,IAC5E;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEO,SAAS,uCACd,OAC+B;AAC/B,SAAO,kBAAkB,KAAK;AAChC;AAEO,SAAS,0CAA0C,OAGrB;AACnC,oBAAkB,OAAO,yBAAyB,CAAC,YAAY,wBAAwB,CAAC;AACxF,SAAO;AAAA,IACL,kBAAkB,MAAM,QAAQ;AAAA,IAChC;AAAA,IACA,MAAM;AAAA,EACR;AACF;AAEO,SAAS,2BACd,cACA,OACmB;AACnB,yCAAuC,YAAY;AACnD,oBAAkB,OAAO,iBAAiB,CAAC,mBAAmB,MAAM,CAAC;AACrE,MAAI,MAAM,SAAS,WAAW,MAAM,SAAS,SAAS,MAAM,SAAS,UAAU;AAC7E,UAAM,IAAI,UAAU,mCAAmC;AAAA,EACzD;AACA,QAAM,kBAAkB,iBAAiB,aAAa,UAAU,SAAS,MAAM,eAAe;AAC9F,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,UAAU,gCAAgC,cAAc,eAAe;AAAA,EACzE,CAAC;AACH;AAEO,SAAS,2BACd,cACA,OACmB;AACnB,yCAAuC,YAAY;AACnD,oBAAkB,OAAO,iBAAiB,CAAC,0BAA0B,kBAAkB,CAAC;AACxF,QAAM,yBAAyB;AAAA,IAC7B,aAAa;AAAA,IACb;AAAA,IACA,MAAM;AAAA,EACR;AACA,QAAM,mBACJ,MAAM,qBAAqB,UAAa,MAAM,qBAAqB,OAC/D,OACA,iBAAiB,aAAa,UAAU,UAAU,MAAM,gBAAgB;AAC9E,QAAM,WAAW;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,OAAO,OAAO,EAAE,cAAc,wBAAwB,kBAAkB,SAAS,CAAC;AAC3F;AAEO,SAAS,qCACd,OAC6B;AAC7B,QAAM,OACJ,MAAM,SAAS,SACX,CAAC,QAAQ,uBAAuB,gBAAgB,SAAS,MAAM,IAC/D,MAAM,SAAS,WACb;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IACA,CAAC,QAAQ,uBAAuB,gBAAgB,SAAS,yBAAyB;AAC1F,oBAAkB,OAAO,oBAAoB,IAAI;AACjD,MAAI,MAAM,SAAS,UAAU,MAAM,SAAS,YAAY,MAAM,SAAS,UAAU;AAC/E,UAAM,IAAI,UAAU,sCAAsC;AAAA,EAC5D;AACA,yCAAuC,MAAM,YAAY;AACzD,0BAAwB,MAAM,KAAK;AACnC,yBAAuB,MAAM,cAAc,MAAM,MAAM,cAAc,gBAAgB;AACrF,QAAM,sBAAsB;AAAA,IAC1B,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACA,QAAM,cAAc,oCAAoC,MAAM,cAAc,mBAAmB;AAC/F,QAAM,0BACJ,MAAM,SAAS,SACX,OACA,iBAAiB,MAAM,aAAa,UAAU,WAAW,MAAM,uBAAuB;AAC5F,QAAM,OACJ,MAAM,SAAS,WAAW,OAAO,iBAAiB,MAAM,MAAM,iBAAiB,KAAK;AACtF,QAAM,gBAAgB,sBAAsB;AAAA,IAC1C,MAAM,MAAM;AAAA,IACZ,cAAc,MAAM;AAAA,IACpB,OAAO,MAAM;AAAA,IACb;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO,OAAO,OAAO;AAAA,IACnB,eAAe;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc,MAAM;AAAA,IACpB,OAAO,MAAM;AAAA,IACb,MAAM,MAAM;AAAA,IACZ;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEO,SAAS,qCACd,OAC6B;AAC7B,oBAAkB,OAAO,oBAAoB;AAAA,IAC3C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,oCAAkC,MAAM,OAAO;AAC/C,QAAM,oBAAoB;AAAA,IACxB,MAAM,QAAQ,aAAa;AAAA,IAC3B;AAAA,IACA,MAAM;AAAA,EACR;AACA,MACE,MAAM,QAAQ,2BACd,kBAAkB,UAAU,MAAM,QAAQ,wBAAwB,OAClE;AACA,UAAM,IAAI,UAAU,6DAA6D;AAAA,EACnF;AACA,QAAM,oBACJ,MAAM,sBAAsB,UAAa,MAAM,sBAAsB,OACjE,OACA,iBAAiB,MAAM,QAAQ,aAAa,UAAU,WAAW,MAAM,iBAAiB;AAC9F,SAAO,OAAO,OAAO;AAAA,IACnB,eAAe;AAAA,IACf,aAAa,MAAM,QAAQ;AAAA,IAC3B,eAAe,MAAM,QAAQ;AAAA,IAC7B,cAAc,MAAM,QAAQ;AAAA,IAC5B;AAAA,IACA;AAAA,IACA,YAAY,mBAAmB,MAAM,YAAY,6BAA6B;AAAA,EAChF,CAAC;AACH;AAEO,SAAS,qCACd,OAC6B;AAC7B,MAAI,MAAM,WAAW,WAAW;AAC9B,sBAAkB,OAAO,oBAAoB,CAAC,UAAU,SAAS,CAAC;AAClE,sCAAkC,MAAM,OAAO;AAC/C,WAAO,OAAO,OAAO,EAAE,QAAQ,WAAW,SAAS,MAAM,QAAQ,CAAC;AAAA,EACpE;AACA,MAAI,MAAM,WAAW,qBAAqB;AACxC,sBAAkB,OAAO,8BAA8B,CAAC,UAAU,QAAQ,cAAc,CAAC;AACzF,UAAM,eAAe,MAAM,gBAAgB;AAC3C,QAAI,iBAAiB,SAAS,CAAC,OAAO,cAAc,YAAY,KAAK,eAAe,IAAI;AACtF,YAAM,IAAI,WAAW,0DAA0D;AAAA,IACjF;AACA,WAAO,OAAO,OAAO;AAAA,MACnB,QAAQ;AAAA,MACR,MAAM,YAAY,MAAM,IAAI;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH;AACA,MACE,MAAM,WAAW,iBACjB,MAAM,WAAW,aACjB,MAAM,WAAW,qBACjB;AACA,UAAM,IAAI,UAAU,wCAAwC;AAAA,EAC9D;AACA,oBAAkB,OAAO,oBAAoB,CAAC,UAAU,MAAM,CAAC;AAC/D,SAAO,OAAO,OAAO,EAAE,QAAQ,MAAM,QAAQ,MAAM,YAAY,MAAM,IAAI,EAAE,CAAC;AAC9E;AAEO,SAAS,+BACd,SACgC;AAChC,oCAAkC,OAAO;AACzC,MAAI,QAAQ,WAAW,UAAW,QAAO;AACzC,MAAI,QAAQ,WAAW,iBAAiB,QAAQ,WAAW,qBAAqB;AAC9E,WAAO;AAAA,EACT;AACA,SAAO,QAAQ,WAAW,YAAY,aAAa;AACrD;AAEO,SAAS,mCACd,SAC0F;AAC1F,QAAM,SAAS,+BAA+B,OAAO;AACrD,MAAI,WAAW,uBAAwB;AACvC,MAAI,WAAW,aAAa;AAC1B,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,QAAM,IAAI,MAAM,oBAAoB,QAAQ,MAAM,qBAAqB;AACzE;AAEO,SAAS,yCACd,UACA,WACM;AACN,oCAAkC,QAAQ;AAC1C,oCAAkC,SAAS;AAC3C,MAAI,SAAS,gBAAgB,UAAU,aAAa;AAClD,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AACA,MAAI,SAAS,kBAAkB,UAAU,eAAe;AACtD,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACF;AAEO,SAAS,kCACd,OAC8C;AAC9C,oBAAkB,OAAO,+BAA+B;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,MAAM,kBAAkB,yCAAyC;AACnE,UAAM,IAAI,UAAU,gDAAgD;AAAA,EACtE;AACA,yCAAuC,MAAM,YAAY;AACzD,0BAAwB,MAAM,KAAK;AACnC,0BAAwB,MAAM,KAAK;AACnC,yBAAuB,MAAM,iBAAiB,OAAO;AACrD,yBAAuB,MAAM,mBAAmB,SAAS;AACzD,yBAAuB,MAAM,cAAc,MAAM,MAAM,cAAc,eAAe;AACpF,yBAAuB,MAAM,cAAc,MAAM,MAAM,cAAc,eAAe;AACpF,qBAAmB,MAAM,aAAa,UAAU,MAAM,gBAAgB,UAAU,UAAU;AAC1F,qBAAmB,MAAM,aAAa,UAAU,MAAM,kBAAkB,UAAU,YAAY;AAC9F,QAAM,wBAAwB;AAAA,IAC5B,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACA,MAAI,MAAM,kBAAkB,uBAAuB;AACjD,UAAM,IAAI,UAAU,yCAAyC;AAAA,EAC/D;AACA,qBAAmB,MAAM,YAAY,oBAAoB;AACzD,QAAM,SAAS,gBAAgB,MAAM,MAAM;AAC3C,QAAM,OAAO,iBAAiB,MAAM,MAAM,gBAAgB,IAAI;AAC9D,MAAI,CAAC,MAAM,QAAQ,MAAM,WAAW;AAClC,UAAM,IAAI,UAAU,sCAAsC;AAC5D,MAAI,MAAM,YAAY,SAAS,mCAAmC;AAChE,UAAM,IAAI,WAAW,qDAAqD;AAAA,EAC5E;AACA,aAAW,cAAc,MAAM,aAAa;AAC1C,0CAAsC,UAAU;AAChD;AAAA,MACE,MAAM,aAAa;AAAA,MACnB,WAAW,qBAAqB;AAAA,MAChC;AAAA,IACF;AAAA,EACF;AACA,OACG,OAAO,SAAS,WAAW,OAAO,SAAS,eAC5C,CAAC,QACD,CAAC,MAAM,YAAY,QACnB;AACA,UAAM,IAAI,UAAU,oEAAoE;AAAA,EAC1F;AACF;AAEO,SAAS,kCACd,OAC8C;AAC9C,oBAAkB,OAAO,+BAA+B;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,MAAM,kBAAkB,yCAAyC;AACnE,UAAM,IAAI,UAAU,gDAAgD;AAAA,EACtE;AACA,MAAI,MAAM,SAAS,UAAU,MAAM,SAAS,YAAY,MAAM,SAAS,UAAU;AAC/E,UAAM,IAAI,UAAU,sCAAsC;AAAA,EAC5D;AACA,yCAAuC,MAAM,YAAY;AACzD,0BAAwB,MAAM,KAAK;AACnC,yBAAuB,MAAM,cAAc,MAAM,MAAM,cAAc,gBAAgB;AACrF,QAAM,sBAAsB;AAAA,IAC1B,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACA,MACE,MAAM,gBACN,oCAAoC,MAAM,cAAc,mBAAmB,GAC3E;AACA,UAAM,IAAI,UAAU,8CAA8C;AAAA,EACpE;AACA,MAAI;AACJ,MAAI;AACJ,MAAI,MAAM,SAAS,QAAQ;AACzB,QAAI,MAAM,4BAA4B,MAAM;AAC1C,YAAM,IAAI,UAAU,4CAA4C;AAAA,IAClE;AACA,aAAS;AACT,WAAO,iBAAiB,MAAM,MAAM,iBAAiB,KAAK;AAAA,EAC5D,OAAO;AACL,2BAAuB,MAAM,yBAAyB,SAAS;AAC/D,aAAS,MAAM;AACf,uBAAmB,MAAM,aAAa,UAAU,OAAO,UAAU,iBAAiB;AAClF,QAAI,MAAM,SAAS,UAAU;AAC3B,UAAI,MAAM,SAAS,KAAM,OAAM,IAAI,UAAU,kCAAkC;AAC/E,aAAO;AAAA,IACT,OAAO;AACL,aAAO,iBAAiB,MAAM,MAAM,iBAAiB,KAAK;AAAA,IAC5D;AAAA,EACF;AACA,QAAM,iBAAiB,sBAAsB;AAAA,IAC3C,MAAM,MAAM;AAAA,IACZ,cAAc,MAAM;AAAA,IACpB,OAAO,MAAM;AAAA,IACb,yBAAyB;AAAA,IACzB;AAAA,EACF,CAAC;AACD,MAAI,MAAM,kBAAkB,gBAAgB;AAC1C,UAAM,IAAI,UAAU,0CAA0C;AAAA,EAChE;AACF;AAEO,SAAS,kCACd,OAC8C;AAC9C,oBAAkB,OAAO,+BAA+B;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,MAAM,kBAAkB,yCAAyC;AACnE,UAAM,IAAI,UAAU,gDAAgD;AAAA,EACtE;AACA,iBAAe,MAAM,aAAa,yBAAyB,+BAA+B;AAC1F,iBAAe,MAAM,eAAe,0BAA0B,iCAAiC;AAC/F,yCAAuC,MAAM,YAAY;AACzD,yBAAuB,MAAM,mBAAmB,SAAS;AACzD;AAAA,IACE,MAAM,aAAa;AAAA,IACnB,MAAM,kBAAkB;AAAA,IACxB;AAAA,EACF;AACA,MAAI,MAAM,sBAAsB,MAAM;AACpC,2BAAuB,MAAM,mBAAmB,SAAS;AACzD;AAAA,MACE,MAAM,aAAa;AAAA,MACnB,MAAM,kBAAkB;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AACA,qBAAmB,MAAM,YAAY,6BAA6B;AACpE;AAEO,SAAS,kCACd,OAC8C;AAC9C,uCAAqC,KAAyC;AAChF;AAEO,SAAS,yCACd,UACQ;AACR,oCAAkC,QAAQ;AAC1C,SAAO,KAAK,UAAU;AAAA,IACpB,eAAe,SAAS;AAAA,IACxB,cAAc,eAAe,SAAS,YAAY;AAAA,IAClD,OAAO,UAAU,SAAS,KAAK;AAAA,IAC/B,OAAO,UAAU,SAAS,KAAK;AAAA,IAC/B,iBAAiB,eAAe,SAAS,eAAe;AAAA,IACxD,mBAAmB,eAAe,SAAS,iBAAiB;AAAA,IAC5D,eAAe,SAAS;AAAA,IACxB,YAAY,SAAS;AAAA,IACrB,QAAQ,WAAW,SAAS,MAAM;AAAA,IAClC,MAAM,SAAS;AAAA,IACf,aAAa,SAAS,YAAY,IAAI,cAAc;AAAA,EACtD,CAAC;AACH;AAEO,SAAS,yCACd,SACQ;AACR,oCAAkC,OAAO;AACzC,SAAO,KAAK,UAAU,oBAAoB,OAAO,CAAC;AACpD;AAEO,SAAS,yCACdC,UACQ;AACR,oCAAkCA,QAAO;AACzC,SAAO,KAAK,UAAU,oBAAoBA,QAAO,CAAC;AACpD;AAEO,SAAS,yCACd,SACQ;AACR,oCAAkC,OAAO;AACzC,MAAI,QAAQ,WAAW,WAAW;AAChC,WAAO,KAAK,UAAU,EAAE,QAAQ,WAAW,SAAS,oBAAoB,QAAQ,OAAO,EAAE,CAAC;AAAA,EAC5F;AACA,MAAI,QAAQ,WAAW,qBAAqB;AAC1C,WAAO,KAAK,UAAU;AAAA,MACpB,QAAQ,QAAQ;AAAA,MAChB,MAAM,QAAQ;AAAA,MACd,cAAc,QAAQ;AAAA,IACxB,CAAC;AAAA,EACH;AACA,SAAO,KAAK,UAAU,EAAE,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,KAAK,CAAC;AACtE;AAEA,SAAS,gBAAgB,OAAoC;AAC3D,oBAAkB,OAAO,uBAAuB,CAAC,QAAQ,SAAS,CAAC;AACnE,MAAI,MAAM,SAAS,WAAW,MAAM,SAAS,YAAY;AACvD,sBAAkB,OAAO,uBAAuB,CAAC,MAAM,CAAC;AACxD,WAAO,OAAO,OAAO,EAAE,MAAM,MAAM,KAAK,CAAC;AAAA,EAC3C;AACA,MAAI,MAAM,SAAS,WAAW;AAC5B,sBAAkB,OAAO,+BAA+B,CAAC,QAAQ,SAAS,CAAC;AAC3E,QAAI,MAAM,YAAY,UAAU,MAAM,YAAY,UAAU;AAC1D,YAAM,IAAI,UAAU,4CAA4C;AAAA,IAClE;AACA,WAAO,OAAO,OAAO,EAAE,MAAM,WAAW,SAAS,MAAM,QAAQ,CAAC;AAAA,EAClE;AACA,QAAM,IAAI,UAAU,oCAAoC;AAC1D;AAEA,SAAS,oBACP,UACA,OACiC;AACjC,oBAAkB,OAAO,wBAAwB;AAAA,IAC/C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MACE,qBAAqB,KAAK,MAAM,oBAAoB,KACpD,MAAM,qBAAqB,WAAW,IAAI,GAC1C;AACA,UAAM,IAAI,UAAU,oDAAoD;AAAA,EAC1E;AACA,QAAM,uBAAuB,iBAAiB,UAAU,cAAc,MAAM,oBAAoB;AAChG,QAAM,WAAW;AAAA,IACf,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACA,MAAI,UAAU,SAAS,GAAG,KAAK,UAAU,SAAS,IAAI,GAAG;AACvD,UAAM,IAAI,UAAU,6CAA6C;AAAA,EACnE;AACA,QAAM,YAAY;AAAA,IAChB,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACA,MAAI,cAAc,QAAQ,CAAC,mBAAmB,KAAK,SAAS,GAAG;AAC7D,UAAM,IAAI,UAAU,iCAAiC;AAAA,EACvD;AACA,QAAM,WAAW,MAAM,YAAY;AACnC,MAAI,aAAa,SAAS,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,IAAI;AAC1E,UAAM,IAAI,WAAW,iEAAiE;AAAA,EACxF;AACA,QAAM,gBAAgB,MAAM,iBAAiB;AAC7C,MAAI,kBAAkB,QAAQ,CAAC,eAAe,KAAK,aAAa,GAAG;AACjE,UAAM,IAAI,UAAU,sEAAsE;AAAA,EAC5F;AACA,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,SAAS,kBAAkB,OAA8C;AACvE,QAAM,UAAU;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,2BAA2B,KAAK,OAAO,GAAG;AAC7C,UAAM,IAAI,UAAU,yDAAyD;AAAA,EAC/E;AACA,SAAO;AACT;AAEA,SAAS,iBACP,UACA,MACA,OACqC;AACrC,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA,OAAO;AAAA,MACL;AAAA,MACA,YAAY,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,gCACP,cACA,iBAC2B;AAC3B,SAAO,SAAS,UAAU,kCAAkC;AAAA,IAC1D,aAAa;AAAA,IACb,aAAa;AAAA,IACb,gBAAgB;AAAA,EAClB,CAAC,CAAC;AACJ;AAEA,SAAS,gCACP,cACA,gBACA,UAC2B;AAC3B,SAAO,SAAS,UAAU,kCAAkC;AAAA,IAC1D,aAAa;AAAA,IACb,aAAa;AAAA,IACb,eAAe;AAAA,IACf,UAAU,SAAS;AAAA,EACrB,CAAC,CAAC;AACJ;AAEA,SAAS,gCACP,cACA,SAC2B;AAC3B,SAAO,SAAS,UAAU,kCAAkC;AAAA,IAC1D,aAAa;AAAA,IACb,aAAa;AAAA,IACb,QAAQ;AAAA,EACV,CAAC,CAAC;AACJ;AAEA,SAAS,oCACP,cACA,qBAC+B;AAC/B,SAAO,SAAS,UAAU,sCAAsC;AAAA,IAC9D,aAAa;AAAA,IACb,aAAa;AAAA,IACb;AAAA,EACF,CAAC,CAAC;AACJ;AAEA,SAAS,sBAAsB,OAMD;AAC5B,SAAO,UAAUD,YAAW,QAAQ,EACjC,OAAO,+CAA+C,MAAM,EAC5D;AAAA,IACC,KAAK,UAAU;AAAA,MACb,MAAM,MAAM;AAAA,MACZ,cAAc,eAAe,MAAM,YAAY;AAAA,MAC/C,OAAO,UAAU,MAAM,KAAK;AAAA,MAC5B,yBAAyB,MAAM,0BAC3B,eAAe,MAAM,uBAAuB,IAC5C;AAAA,MACJ,MAAM,MAAM;AAAA,IACd,CAAC;AAAA,IACD;AAAA,EACF,EACC,OAAO,KAAK,CAAC;AAClB;AAEA,SAAS,UAAU,QAAgB,OAA2C;AAC5E,QAAM,OAAOA,YAAW,QAAQ;AAChC,OAAK,OAAO,QAAQ,MAAM,EAAE,OAAO,MAAM,MAAM;AAC/C,aAAW,QAAQ,OAAO;AACxB,QAAI,SAAS,MAAM;AACjB,WAAK,OAAO,MAAM,MAAM;AACxB;AAAA,IACF;AACA,UAAM,QAAQ,YAAY,OAAO,IAAI;AACrC,SAAK,OAAO,KAAK,MAAM,UAAU,KAAK,MAAM,EAAE,OAAO,KAAK;AAAA,EAC5D;AACA,SAAO,KAAK,OAAO,KAAK;AAC1B;AAEA,SAAS,uCACP,OACmD;AACnD,yBAAuB,OAAO,cAAc;AAC9C;AAEA,SAAS,wBAAwB,OAAoD;AACnF,oBAAkB,OAAO,iCAAiC;AAAA,IACxD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,yCAAuC,MAAM,YAAY;AACzD,yBAAuB,MAAM,iBAAiB,OAAO;AACrD,MAAI,MAAM,SAAS,WAAW,MAAM,SAAS,SAAS,MAAM,SAAS,UAAU;AAC7E,UAAM,IAAI,UAAU,wCAAwC;AAAA,EAC9D;AACA,qBAAmB,MAAM,aAAa,UAAU,MAAM,gBAAgB,UAAU,UAAU;AAC1F,MACE,MAAM,aAAa,gCAAgC,MAAM,cAAc,MAAM,eAAe,GAC5F;AACA,UAAM,IAAI,UAAU,8CAA8C;AAAA,EACpE;AACF;AAEA,SAAS,wBAAwB,OAAoD;AACnF,oBAAkB,OAAO,iCAAiC;AAAA,IACxD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,yCAAuC,MAAM,YAAY;AACzD,yBAAuB,MAAM,wBAAwB,cAAc;AACnE,MAAI,MAAM,qBAAqB,KAAM,wBAAuB,MAAM,kBAAkB,QAAQ;AAC5F;AAAA,IACE,MAAM,aAAa;AAAA,IACnB,MAAM,uBAAuB;AAAA,IAC7B;AAAA,EACF;AACA,MAAI,MAAM,kBAAkB;AAC1B,uBAAmB,MAAM,aAAa,UAAU,MAAM,iBAAiB,UAAU,WAAW;AAAA,EAC9F;AACA,MACE,MAAM,aACN;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR,GACA;AACA,UAAM,IAAI,UAAU,8CAA8C;AAAA,EACpE;AACF;AAEA,SAAS,sCACP,OACkD;AAClD,oBAAkB,OAAO,mCAAmC;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,yBAAuB,MAAM,sBAAsB,YAAY;AAC/D,MACE,qBAAqB,KAAK,MAAM,qBAAqB,KAAK,KAC1D,MAAM,qBAAqB,MAAM,WAAW,IAAI,GAChD;AACA,UAAM,IAAI,UAAU,oDAAoD;AAAA,EAC1E;AACA,QAAM,WAAW;AAAA,IACf,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACA,MAAI,UAAU,SAAS,GAAG,KAAK,UAAU,SAAS,IAAI,GAAG;AACvD,UAAM,IAAI,UAAU,6CAA6C;AAAA,EACnE;AACA,QAAM,YAAY;AAAA,IAChB,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACA,MAAI,cAAc,QAAQ,CAAC,mBAAmB,KAAK,SAAS,GAAG;AAC7D,UAAM,IAAI,UAAU,iCAAiC;AAAA,EACvD;AACA,QAAM,WAAW,MAAM;AACvB,MAAI,aAAa,MAAM;AACrB,QAAI,OAAO,aAAa,YAAY,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,GAAG;AACnF,YAAM,IAAI,WAAW,iEAAiE;AAAA,IACxF;AAAA,EACF;AACA,QAAM,gBAAgB,MAAM;AAC5B,MAAI,kBAAkB,MAAM;AAC1B,QAAI,OAAO,kBAAkB,YAAY,CAAC,eAAe,KAAK,aAAa,GAAG;AAC5E,YAAM,IAAI,UAAU,sEAAsE;AAAA,IAC5F;AAAA,EACF;AACF;AAEA,SAAS,uBACP,OACA,MACsD;AACtD,oBAAkB,OAAO,YAAY,IAAI,OAAO,CAAC,YAAY,QAAQ,OAAO,CAAC;AAC7E,oBAAkB,MAAM,QAAkB;AAC1C,MAAI,MAAM,SAAS,KAAM,OAAM,IAAI,UAAU,8BAA8B,IAAI,EAAE;AACjF;AAAA,IACE,MAAM;AAAA,IACN,YAAY,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,mBACP,UACA,QACA,OACM;AACN,MAAI,aAAa,OAAQ,OAAM,IAAI,UAAU,GAAG,KAAK,oCAAoC;AAC3F;AAEA,SAAS,uBACP,UACA,QACA,OACM;AACN,MAAI,SAAS,aAAa,OAAO,YAAY,SAAS,UAAU,OAAO,OAAO;AAC5E,UAAM,IAAI,UAAU,GAAG,KAAK,uCAAuC;AAAA,EACrE;AACF;AAEA,SAAS,iBAAiB,OAAgB,OAAe,YAA6B;AACpF,SAAO,cAAc,OAAO,OAAO,aAAa,IAAI,GAAG,kCAAkC,IAAI;AAC/F;AAEA,SAAS,oBAAoB,OAAgB,OAAe,UAA0B;AACpF,QAAM,SAAS,cAAc,OAAO,OAAO,GAAG,UAAU,KAAK;AAC7D,MAAI,WAAW,OAAO,KAAK;AACzB,UAAM,IAAI,UAAU,GAAG,KAAK,uCAAuC;AACrE,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAgB,OAAe,UAAiC;AAC7F,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,SAAO,cAAc,OAAO,OAAO,GAAG,UAAU,KAAK;AACvD;AAEA,SAAS,cACP,OACA,OACA,UACA,UACA,eACQ;AACR,MAAI,OAAO,UAAU,SAAU,OAAM,IAAI,UAAU,GAAG,KAAK,mBAAmB;AAC9E,MAAI,CAAC,oBAAoB,KAAK,EAAG,OAAM,IAAI,UAAU,GAAG,KAAK,8BAA8B;AAC3F,MAAI,MAAM,SAAS,IAAI,EAAG,OAAM,IAAI,UAAU,GAAG,KAAK,uBAAuB;AAC7E,MAAI,CAAC,iBAAiB,yBAAyB,KAAK,KAAK,GAAG;AAC1D,UAAM,IAAI,UAAU,GAAG,KAAK,sCAAsC;AAAA,EACpE;AACA,QAAM,aAAa,YAAY,OAAO,KAAK,EAAE;AAC7C,MAAI,aAAa,YAAY,aAAa,UAAU;AAClD,UAAM,IAAI,WAAW,GAAG,KAAK,iBAAiB,QAAQ,IAAI,QAAQ,cAAc;AAAA,EAClF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAwB;AACnD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,YAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AACvC,UAAI,EAAE,QAAQ,SAAU,QAAQ,OAAS,QAAO;AAChD,eAAS;AAAA,IACX,WAAW,QAAQ,SAAU,QAAQ,OAAQ;AAC3C,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAgB,OAAuB;AACjE,QAAM,YAAY,cAAc,OAAO,OAAO,IAAI,IAAI,KAAK;AAC3D,QAAM,eAAe,KAAK,MAAM,SAAS;AACzC,MAAI,CAAC,OAAO,SAAS,YAAY,KAAK,IAAI,KAAK,YAAY,EAAE,YAAY,MAAM,WAAW;AACxF,UAAM,IAAI,UAAU,GAAG,KAAK,oCAAoC;AAAA,EAClE;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAwB;AAC3C,QAAM,OAAO;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,qBAAqB,KAAK,IAAI,GAAG;AACpC,UAAM,IAAI,UAAU,6DAA6D;AAAA,EACnF;AACA,SAAO;AACT;AAEA,SAAS,kBACP,OACA,OACA,aAC0C;AAC1C,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,UAAM,IAAI,UAAU,GAAG,KAAK,oBAAoB;AAAA,EAClD;AACA,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,MAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,UAAM,IAAI,UAAU,GAAG,KAAK,yBAAyB;AAAA,EACvD;AACA,QAAM,UAAU,IAAI,IAAI,WAAW;AACnC,aAAW,OAAO,QAAQ,QAAQ,KAAK,GAAG;AACxC,QAAI,OAAO,QAAQ,YAAY,CAAC,QAAQ,IAAI,GAAG,GAAG;AAChD,YAAM,IAAI,UAAU,GAAG,KAAK,gCAAgC;AAAA,IAC9D;AAAA,EACF;AACF;AAEA,SAAS,eAAe,OAAgB,SAAiB,OAAwC;AAC/F,MAAI,OAAO,UAAU,YAAY,CAAC,QAAQ,KAAK,KAAK,GAAG;AACrD,UAAM,IAAI,UAAU,GAAG,KAAK,aAAa;AAAA,EAC3C;AACF;AAEA,SAAS,eACP,IACkD;AAClD,SAAO,EAAE,UAAU,GAAG,UAAU,MAAM,GAAG,MAAM,OAAO,GAAG,MAAM;AACjE;AAEA,SAAS,UAAU,OAA0B;AAC3C,SAAO;AAAA,IACL,cAAc,eAAe,MAAM,YAAY;AAAA,IAC/C,iBAAiB,eAAe,MAAM,eAAe;AAAA,IACrD,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,EAClB;AACF;AAEA,SAAS,UAAU,OAA0B;AAC3C,SAAO;AAAA,IACL,cAAc,eAAe,MAAM,YAAY;AAAA,IAC/C,wBAAwB,eAAe,MAAM,sBAAsB;AAAA,IACnE,kBAAkB,MAAM,mBAAmB,eAAe,MAAM,gBAAgB,IAAI;AAAA,IACpF,UAAU,MAAM;AAAA,EAClB;AACF;AAEA,SAAS,WAAW,QAA4B;AAC9C,SAAO,OAAO,SAAS,YACnB,EAAE,MAAM,WAAoB,SAAS,OAAO,QAAQ,IACpD,EAAE,MAAM,OAAO,KAAK;AAC1B;AAEA,SAAS,eAAe,YAA6C;AACnE,SAAO;AAAA,IACL,sBAAsB,eAAe,WAAW,oBAAoB;AAAA,IACpE,UAAU,WAAW;AAAA,IACrB,WAAW,WAAW;AAAA,IACtB,UAAU,WAAW;AAAA,IACrB,eAAe,WAAW;AAAA,EAC5B;AACF;AAEA,SAAS,oBAAoB,SAAsC;AACjE,SAAO;AAAA,IACL,eAAe,QAAQ;AAAA,IACvB,aAAa,QAAQ;AAAA,IACrB,qBAAqB,QAAQ;AAAA,IAC7B,eAAe,QAAQ;AAAA,IACvB,cAAc,eAAe,QAAQ,YAAY;AAAA,IACjD,OAAO,UAAU,QAAQ,KAAK;AAAA,IAC9B,MAAM,QAAQ;AAAA,IACd,yBAAyB,QAAQ,0BAC7B,eAAe,QAAQ,uBAAuB,IAC9C;AAAA,IACJ,MAAM,QAAQ;AAAA,EAChB;AACF;AAEA,SAAS,oBAAoBC,UAAsC;AACjE,SAAO;AAAA,IACL,eAAeA,SAAQ;AAAA,IACvB,aAAaA,SAAQ;AAAA,IACrB,eAAeA,SAAQ;AAAA,IACvB,cAAc,eAAeA,SAAQ,YAAY;AAAA,IACjD,mBAAmB,eAAeA,SAAQ,iBAAiB;AAAA,IAC3D,mBAAmBA,SAAQ,oBAAoB,eAAeA,SAAQ,iBAAiB,IAAI;AAAA,IAC3F,YAAYA,SAAQ;AAAA,EACtB;AACF;;;AChtCA,SAAS,iBAAAC,uBAAqB;AAG9B,IAAM,2BAAyC,CAAC,mBAAmB,gBAAgB;AAG5E,SAAS,oBAAoB,QAAuD;AACzF,SAAO,OAAO,YAAY,KAAK,CAAC,eAAe,yBAAyB,SAAS,UAAU,CAAC;AAC9F;AAGO,SAAS,aAAa,QAAqD;AAChF,SAAO,OAAO,UAAU,WAAW,OAAO;AAC5C;AAOO,SAAS,uBAAuB,QAA+B;AACpE,MAAI,CAAC,QAAQ;AACX,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,yBAAyB,CAAC;AAAA,EACpE;AACA,SAAO,QAAQ,MAAM;AACvB;AASO,SAAS,+BAA+B,OAItC;AACP,QAAM,EAAE,SAAS,WAAW,gBAAgB,IAAI;AAChD,MAAI,cAAc,iBAAiB;AACjC,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,wCAAwC,CAAC;AAAA,EACnF;AACA,QAAM,SAAS,QAAQ,KAAK,CAAC,WAAW,OAAO,cAAc,SAAS;AACtE,MAAI,CAAC,QAAQ;AACX,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,mBAAmB,CAAC;AAAA,EAC9D;AACA,MAAI,oBAAoB,MAAM,GAAG;AAC/B,UAAM,kBAAkB,QAAQ;AAAA,MAC9B,CAAC,WAAW,OAAO,cAAc,aAAa,oBAAoB,MAAM;AAAA,IAC1E;AACA,QAAI,gBAAgB,WAAW,GAAG;AAChC,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF;AASO,SAAS,yBAAyB,OAGhC;AACP,MAAI,MAAM,4BAA4B,GAAG;AACvC,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,6CAA6C,CAAC;AAAA,EACxF;AACA,MAAI,MAAM,qBAAqB,GAAG;AAChC,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;;;ACnFA;AAAA,EACE;AAAA,OAOK;AACP,SAAS,cAAAC,mBAAkB;AAEpB,IAAM,mCAAmC;AAwChD,IAAM,kBAAkB,oBAAI,IAAmC;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,sBAEF,OAAO,OAAO;AAAA,EAChB,WAAW,CAAC,YAAY,yBAAyB;AAAA,EACjD,UAAU,CAAC,YAAY,yBAAyB;AAAA,EAChD,UAAU,CAAC,wBAAwB,oBAAoB,yBAAyB;AAAA,EAChF,sBAAsB,CAAC,oBAAoB,iBAAiB;AAAA,EAC5D,kBAAkB,CAAC,aAAa,mBAAmB,iBAAiB;AAAA,EACpE,WAAW,CAAC,aAAa,kBAAkB;AAAA,EAC3C,WAAW,CAAC;AAAA,EACZ,iBAAiB,CAAC;AAAA,EAClB,yBAAyB,CAAC;AAAA,EAC1B,iBAAiB,CAAC;AAAA,EAClB,kBAAkB,CAAC;AACrB,CAAC;AAEM,SAAS,gCAAgC,OAIZ;AAClC,QAAM,YAAY,uBAAuB,MAAM,MAAM,SAAS;AAC9D,MAAI,UAAU,YAAY,UAAa,UAAU,YAAY,MAAM,MAAM,SAAS;AAChF,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,QAAM,aAAa,UAAU,QAAQ,QAAQ;AAC7C,MAAI,CAAC,MAAM,MAAM,YAAY,SAAS,UAAU,GAAG;AACjD,UAAM,IAAI,MAAM,gCAAgC,UAAU,iBAAiB;AAAA,EAC7E;AACA,uBAAqB,YAAY,MAAM,gBAAgB;AAEvD,QAAM,kBAAkB,UAAU,mBAAmB,MAAM,MAAM,SAAS;AAC1E,MACE,kBAAkB,MAAM,MAAM,SAAS,cACvC,kBAAkB,MAAM,MAAM,SAAS,eACtC,kBAAkB,MAAM,MAAM,SAAS,cAAc,MAAM,MAAM,SAAS,gBAAgB,GAC3F;AACA,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,QAAM,cAAc,UAAU,eAAe,MAAM,MAAM,aAAa,CAAC;AACvE,QAAM,aAAa,UAAU,cAAc,MAAM,MAAM,YAAY,CAAC;AACpE,MAAI,CAAC,eAAe,CAAC,MAAM,MAAM,aAAa,SAAS,WAAW,GAAG;AACnE,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,MAAI,CAAC,cAAc,CAAC,MAAM,MAAM,YAAY,SAAS,UAAU,GAAG;AAChE,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,QAAM,gBAAgB,UAAU,iBAAiB,MAAM,MAAM;AAC7D,MAAI,iBAAiB,CAAC,MAAM,MAAM,eAAe;AAC/C,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,SAAO,OAAO,OAAO;AAAA,IACnB,eAAe;AAAA,IACf,SAAS,MAAM,MAAM;AAAA,IACrB,QAAQ,UAAU;AAAA,IAClB;AAAA,IACA,YAAY,OAAO;AAAA,MACjB,MAAM,iBAAiB,IAAI,CAAC,cAAc,OAAO,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEO,SAAS,oCACd,SACQ;AACR,SAAO,KAAK,UAAU;AAAA,IACpB,eAAe,QAAQ;AAAA,IACvB,SAAS,QAAQ;AAAA,IACjB,QAAQ,QAAQ;AAAA,IAChB,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ,WAAW,IAAI,CAAC,eAAe;AAAA,MACjD,MAAM,UAAU;AAAA,MAChB,eAAe,UAAU;AAAA,MACzB,aAAa,UAAU;AAAA,MACvB,UAAU,UAAU;AAAA,IACtB,EAAE;AAAA,IACF,iBAAiB,QAAQ;AAAA,IACzB,aAAa,QAAQ;AAAA,IACrB,YAAY,QAAQ;AAAA,IACpB,eAAe,QAAQ;AAAA,EACzB,CAAC;AACH;AAEO,SAAS,6BAA6B,SAAkD;AAC7F,SAAOC;AAAA,IACL;AAAA,IACA,oCAAoC,OAAO;AAAA,EAC7C;AACF;AAGO,SAAS,4BAA4B,OAKjC;AACT,SAAOA;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACF;AAEO,SAAS,sCAAsC,OAG3C;AACT,SAAO,SAASA;AAAA,IACd;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,EACR,EAAE,MAAM,GAAG,EAAE,CAAC;AAChB;AAEO,SAAS,kCAAkC,OAKvC;AACT,SAAOA;AAAA,IACL;AAAA,IACA,OAAO,MAAM,cAAc;AAAA,IAC3B,MAAM;AAAA,IACN,OAAO,MAAM,iBAAiB;AAAA,IAC9B,KAAK,UAAU,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK,CAAC;AAAA,IACzC;AAAA,EACF;AACF;AAEO,SAAS,gCACd,MACA,IACM;AACN,MAAI,SAAS,GAAI;AACjB,MAAI,CAAC,oBAAoB,IAAI,EAAE,SAAS,EAAE,GAAG;AAC3C,UAAM,IAAI,MAAM,uCAAuC,IAAI,OAAO,EAAE,EAAE;AAAA,EACxE;AACF;AAEO,SAAS,+BAA+B,OAA+C;AAC5F,SAAO,gBAAgB,IAAI,KAAK;AAClC;AAEA,SAAS,qBACP,YACA,YACM;AACN,QAAM,WACJ,eAAe,SACX,CAAC,IACD,eAAe,gBACb,CAAC,aAAa,IACd,eAAe,0BACb,CAAC,eAAe,YAAY,IAC5B,eAAe,oBACb,CAAC,iBAAiB,IAClB,CAAC,iBAAiB;AAC9B,MACE,WAAW,WAAW,SAAS,UAC/B,WAAW,KAAK,CAAC,WAAW,UAAU,UAAU,SAAS,SAAS,KAAK,CAAC,GACxE;AACA,UAAM,IAAI,MAAM,oDAAoD,UAAU,EAAE;AAAA,EAClF;AACA,aAAW,aAAa,YAAY;AAClC,QAAI,CAAC,kBAAkB,KAAK,UAAU,aAAa,GAAG;AACpD,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AACA,QAAI,CAAC,OAAO,cAAc,UAAU,QAAQ,KAAK,UAAU,YAAY,GAAG;AACxE,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AACA,QAAI,CAAC,UAAU,YAAY,SAAS,GAAG,GAAG;AACxC,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AAAA,EACF;AACF;AAEA,SAASA,QAAO,WAAmB,OAAyB;AAC1D,QAAM,OAAOD,YAAW,QAAQ,EAAE,OAAO,MAAM;AAC/C,aAAW,QAAQ,MAAO,MAAK,OAAO,IAAI,EAAE,OAAO,IAAI;AACvD,SAAO,KAAK,OAAO,KAAK;AAC1B;;;ACxPA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAIA,IAAM,iCACX,OAAO,OAAO;AAAA,EACZ,OAAO,OAAO;AAAA,IACZ,SAAS;AAAA,IACT,OAAO;AAAA,IACP,eAAe;AAAA,IACf,aAAa,OAAO,OAAO;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,OAAO,OAAO,CAAC,QAAQ,MAAM,CAAC;AAAA,IAC3C,cAAc,OAAO,OAAO,CAAC,QAAQ,OAAO,OAAO,OAAO,QAAQ,QAAQ,UAAU,CAAC;AAAA,IACrF,UAAU,OAAO,OAAO;AAAA,MACtB,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,aAAa;AAAA,IACf,CAAC;AAAA,IACD,eAAe;AAAA,EACjB,CAAC;AAAA,EACD,OAAO,OAAO;AAAA,IACZ,SAAS;AAAA,IACT,OAAO;AAAA,IACP,eAAe;AAAA,IACf,aAAa,OAAO,OAAO,CAAC,QAAQ,eAAe,iBAAiB,CAAC;AAAA,IACrE,aAAa,OAAO,OAAO,CAAC,QAAQ,MAAM,CAAC;AAAA,IAC3C,cAAc,OAAO,OAAO,CAAC,QAAQ,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,IACjE,UAAU,OAAO,OAAO;AAAA,MACtB,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,aAAa;AAAA,IACf,CAAC;AAAA;AAAA,IAED,eAAe;AAAA,EACjB,CAAC;AACH,CAAC;AAEI,SAAS,0CACd,SACA,eACS;AACT,SAAO,YAAY,kCACf,kBAAkB,2BAClB,YAAY,wBACV,kBAAkB,sBAAsB,kBAAkB,sBAC1D;AACR;AAEO,SAAS,+BAA0D;AACxE,SAAO,sBAAsB,MAAM;AAAA,IACjC,eAAe;AAAA,IACf,UAAU;AAAA,IACV,eAAe;AAAA,IACf,iBAAiB,CAAC;AAAA,IAClB,gBAAgB;AAAA,EAClB,CAAC;AACH;AAEO,SAAS,qCAAqC,OAGrB;AAC9B,QAAM,SAAS,sBAAsB,MAAM,MAAM,MAAM;AACvD,QAAM,UAAU,IAAI,IAAI,OAAO,eAAe;AAC9C,QAAM,SAAS,+BAA+B;AAAA,IAC5C,CAAC,UACC,QAAQ,IAAI,MAAM,OAAO,KACzB,0CAA0C,MAAM,SAAS,OAAO,aAAa;AAAA,EACjF;AACA,MAAI,OAAO,WAAW,KAAK,OAAO,mBAAmB,MAAM;AACzD,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,SAAO,4BAA4B,MAAM;AAAA,IACvC,eAAe;AAAA,IACf,oBAAoB,kCAAkC;AAAA,MACpD,gBAAgB,OAAO;AAAA,MACvB,eAAe,OAAO;AAAA,MACtB,mBAAmB,MAAM;AAAA,MACzB,UAAU,OAAO,IAAI,CAAC,UAAU,MAAM,OAAO;AAAA,IAC/C,CAAC;AAAA,IACD,gBAAgB,OAAO;AAAA,IACvB;AAAA,EACF,CAAC;AACH;AAEO,SAAS,mCAAmC,UAAmC;AACpF,QAAM,QAAQ,IAAI,IAAI,+BAA+B,IAAI,CAAC,UAAU,MAAM,OAAO,CAAC;AAClF,aAAW,WAAW,UAAU;AAC9B,QAAI,CAAC,MAAM,IAAI,OAAO,EAAG,OAAM,IAAI,MAAM,mCAAmC,OAAO,EAAE;AAAA,EACvF;AACF;;;ACvGA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA,iBAAAE;AAAA,EACA,UAAAC;AAAA,EACA,cAAAC;AAAA,EACA,kBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAAC;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iBAAAC,uBAAqB;AAe9B,SAAS,OAAO,OAAgB,KAAsB;AACpD,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,OAAO,OAAO,OAAO,GAAG;AAChF;AAEA,SAAS,mBACP,KAC6B;AAC7B,MAAI,CAAC,IAAK,QAAO;AACjB,SAAO,gBAAgB,MAAM;AAAA,IAC3B,UAAU,IAAI;AAAA,IACd,MAAM,IAAI;AAAA,IACV,WAAW,IAAI;AAAA,IACf,OAAO,6BAA6B,GAAG,IAAI,IAAI,QAAQ,CAAC;AAAA,IACxD,eAAe,6BAA6B,GAAG;AAAA,IAC/C,OAAO,IAAI;AAAA,IACX,iBAAiB,IAAI;AAAA,IACrB,aAAa,IAAI;AAAA,IACjB,SAAS,6BAA6B,GAAG;AAAA,IACzC,WAAW,IAAI,UAAU,YAAY;AAAA,EACvC,CAAC;AACH;AAEA,eAAe,uBACb,MACA,OACA,aACA,KACsC;AACtC,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,mBAAmB,GAAG;AACrC,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,kBAAkB,MAAM;AAAA,IAC5B,KAAK;AAAA,IACL;AAAA,IACA,KAAK;AAAA,IACL,EAAE,WAAW,MAAM,UAAU;AAAA,EAC/B;AACA,QAAM,YAAY,CAAC;AACnB,aAAW,YAAY,OAAO,WAAW;AACvC,QAAI,SAAS,SAAS,cAAc;AAClC,UAAI;AACF,cAAM,kCAAkC,KAAK,IAAI,aAAa,CAAC,QAAQ,CAAC;AACxE,kBAAU,KAAK,QAAQ;AAAA,MACzB,SAAS,OAAO;AACd,YAAI,8CAA8C,KAAK,GAAG;AAGxD;AAAA,QACF;AAGA,kBAAU,KAAK,QAAQ;AAAA,MACzB;AACA;AAAA,IACF;AACA,QAAI;AACF,YAAM,OAAO,MAAMC,aAAY,KAAK,IAAI,aAAa,SAAS,MAAM;AACpE,UAAI,KAAK,WAAW,QAAS,WAAU,KAAK,QAAQ;AAAA,IACtD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,UAAU,EAAE,GAAG,OAAO,QAAQ;AACpC,MAAI,QAAQ,eAAe;AACzB,QACE,CAAC,cAAc,MAAM,aAAa,mBAAmB,KACrD,CAAE,MAAMC,gBAAe,KAAK,IAAI,aAAa,QAAQ,aAAa,GAClE;AACA,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AACA,MAAI,QAAQ,OAAO;AACjB,UAAM,MAAM,MAAMC,QAAO,KAAK,IAAI,aAAa,QAAQ,KAAK;AAC5D,QAAI,CAAC,KAAK,cAAe,QAAO,QAAQ;AAAA,EAC1C;AACA,MAAI,QAAQ,iBAAiB;AAC3B,UAAM,UAAU,MAAMC,YAAW,KAAK,IAAI,aAAa,QAAQ,eAAe;AAC9E,UAAM,aAAa,SAAS,eACxB,MAAMC,eAAc,KAAK,IAAI,aAAa,QAAQ,YAAY,IAC9D;AACJ,QACE,CAAC,WACD,QAAQ,SAAS,gBACjB,CAAC,cACD,WAAW,WAAW,UACtB;AACA,aAAO,QAAQ;AACf,aAAO,QAAQ;AACf,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AAEA,MAAI,QAAuC,CAAC;AAC5C,MAAI,OAAO,eAAe;AACxB,QAAI;AACF,cAAQ,iBAAiB,OAAO,OAAO,eAAe;AAAA,IACxD,QAAQ;AAGN,cAAQ,OAAO,MAAM,OAAO,CAAC,SAAS;AACpC,YAAI;AACF,2BAAiB,CAAC,IAAI,GAAG,eAAe;AACxC,iBAAO;AAAA,QACT,QAAQ;AACN,iBAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAGA,eAAsB,wBACpB,MACA,OACA,aAC+B;AAC/B,QAAM,MAAM,MAAM;AAAA,IAAwB,KAAK;AAAA,IAAI;AAAA,IAAa,MAAM;AAAA,IAAW,CAAC,WAChF,gCAAgC,QAAQ;AAAA,MACtC;AAAA,MACA,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,EACH;AACA,SACG,MAAM,uBAAuB,MAAM,OAAO,aAAa,GAAG,KAAM;AAAA,IAC/D,UAAU;AAAA,IACV,MAAM;AAAA,IACN,WAAW,CAAC;AAAA,IACZ,OAAO,CAAC;AAAA,IACR,eAAe;AAAA,IACf,OAAO,KAAK,SAAS;AAAA,IACrB,iBAAiB,KAAK,SAAS;AAAA,IAC/B,aAAa;AAAA,IACb,SAAS,CAAC;AAAA,IACV,WAAW;AAAA,EACb;AAEJ;AASA,eAAsB,yBACpB,MACA,OACA,aACA,UAC+B;AAC/B,QAAM,QAAQ,2BAA2B,MAAM,QAAQ;AAKvD,QAAM,gBAAgB,OAAO,UAAU,eAAe,IAAI,MAAM,gBAAgB;AAChF,QAAM,kBAAkB,MAAM;AAAA,IAC5B,KAAK;AAAA,IACL;AAAA,IACA,KAAK;AAAA,IACL,EAAE,WAAW,MAAM,UAAU;AAAA,EAC/B;AACA,QAAM,YAAY,mBAAmB,MAAM,SAAS;AACpD,QAAM,QAAQ,gBAAgB,iBAAiB,MAAM,OAAO,eAAe,IAAI,CAAC;AAChF,QAAM,kCAAkC,KAAK,IAAI,aAAa,SAAS;AACvE,MAAI,UAAU,KAAK,CAAC,aAAa,SAAS,SAAS,MAAM,KAAK,CAAC,KAAK,eAAe;AACjF,UAAM,IAAIC,gBAAc,KAAK,EAAE,SAAS,mCAAmC,CAAC;AAAA,EAC9E;AACA,QAAM,sBAAsB,KAAK,IAAI,aAAa,SAAS;AAC3D,wBAAsB,KAAK,UAAU,MAAM,KAAK;AAChD,QAAM,iCAAiC,KAAK,IAAI,KAAK,UAAU,aAAa,MAAM,KAAK;AAEvF,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,MAAwB,KAAK;AAAA,MAAI;AAAA,MAAa,MAAM;AAAA,MAAW,CAAC,WAClF,OAAO;AAAA,QAAY,CAAC,OAClB,iCAAiC,IAAgC;AAAA,UAC/D,WAAW,MAAM;AAAA,UACjB;AAAA,UACA,WAAW,MAAM;AAAA,UACjB,kBAAkB,MAAM;AAAA,UACxB,MAAM,MAAM;AAAA,UACZ;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO,MAAM;AAAA,UACb,iBAAiB,MAAM;AAAA,UACvB,aAAa,MAAM;AAAA,UACnB,SAAS,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,4BAA4B,MAAM,UAAU,WAAW,OAAO;AAAA,QAChE,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO,mBAAmB,KAAK;AAAA,EACjC,SAAS,OAAO;AACd,QAAI,iBAAiB,4BAA4B;AAC/C,YAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,IACzD;AACA,UAAM;AAAA,EACR;AACF;;;ACpOA;AAAA,EACE,4BAAAC;AAAA,EACA,0BAAAC;AAAA,EACA,8BAAAC;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAAC;AAAA,EACA,mBAAAC;AAAA,EACA,4BAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,uCAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,EACA,2BAAAC;AAAA,EACA,0CAAAC;AAAA,OAIK;AACP;AAAA,EACE,+BAAAC;AAAA,EACA,uCAAAC;AAAA,OAEK;AAwCP,SAAS,iBAAiB,SAAkD;AAC1E,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,WAAW,QAAQ;AAAA,IACnB,aAAa,CAAC;AAAA,EAChB;AACF;AAEA,SAAS,iBAAiB,SAAkD;AAC1E,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,WAAW,QAAQ;AAAA,IACnB,aAAa,CAAC;AAAA,IACd,UAAU;AAAA,MACR,WAAW,QAAQ;AAAA,MACnB,QAAQ,QAAQ;AAAA,MAChB,WAAW,QAAQ;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B;AAAA,EACF;AACF;AAEA,eAAe,6BACb,MACA,SACA,WAC8C;AAC9C,SAAO,MAAM,4BAA4B,MAAM,iBAAiB,OAAO,GAAG;AAAA,IACxE,WAAW,QAAQ;AAAA,IACnB;AAAA,IACA,SAAS,QAAQ,wBAAwB;AAAA,EAC3C,CAAC;AACH;AAEA,eAAe,6BACb,MACA,SACA,iBACA,WAC8C;AAC9C,SAAO,MAAM,4BAA4B,MAAM,iBAAiB,OAAO,GAAG;AAAA,IACxE,WAAW;AAAA,IACX;AAAA,IACA,SAAS,QAAQ,wBAAwB;AAAA,EAC3C,CAAC;AACH;AAEA,SAAS,WAAW,SAAqC;AACvD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,QAAQ;AAAA,IACnB,QAAQ,QAAQ;AAAA,IAChB,WAAW,QAAQ;AAAA,IACnB,qBAAqB,QAAQ;AAAA,EAC/B;AACF;AAQA,eAAe,wCACb,MACA,OACA,OAKY;AACZ,SAAO,MAAMC;AAAA,IACX;AAAA,MACE,OAAO,MAAM;AAAA,MACb,YAAY,MAAM;AAAA,MAClB,aAAa;AAAA,IACf;AAAA,IACA,YAAY;AACV,YAAM,MAAM,OAAO,WAAoC,MAAM,MAAM,YAAY,MAAM;AACrF,aAAO,MAAM,cAAc,SACvB,MAAM,gCAAgC,KAAK,IAAI,MAAM,aAAa,GAAG,IACrE,MAAMC;AAAA,QACJ,KAAK;AAAA,QACL,MAAM;AAAA,QACN,MAAM;AAAA,QACN;AAAA,MACF;AAAA,IACN;AAAA,EACF;AACF;AAEA,eAAe,2BACb,MAMA,OAWe;AACf,QAAM,uBAAuB,MAAM,MAAM,aAAa,MAAM,WAAW,MAAM,QAAQ;AACrF,MAAI,CAAC,MAAM,gBAAgB,MAAM,iBAAiB,KAAM;AACxD,MAAI;AACF,UAAM,KAAK,eAAe,oBAAoB;AAAA,MAC5C,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,YAAY,MAAM;AAAA,MAClB,cAAc,MAAM;AAAA,MACpB,GAAI,MAAM,oBAAoB,MAAM,oBAAoB,IACpD,EAAE,uBAAuB,KAAK,IAC9B,CAAC;AAAA,IACP,CAAC;AAAA,EACH,QAAQ;AACN,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,QACE,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACF;AAOA,eAAe,2BACb,MAGA,WACe;AACf,MAAI,cAAc,EAAG;AACrB,MAAI;AACF,UAAM,KAAK,eAAe,mCAAmC;AAAA,EAC/D,QAAQ;AACN,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,QACE,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,QAAQ;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,uBACb,MACA,aACA,WACA,UACe;AACf,MAAI,SAAS,WAAW,EAAG;AAC3B,QAAM,SAAS,MAAM,QAAQ;AAAA,IAC3B,SAAS,IAAI,CAAC,YAAYC,iBAAgB,KAAK,IAAI,aAAa,OAAO,CAAC;AAAA,EAC1E;AACA,QAAMC;AAAA,IACJ,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,OAAO,CAAC,UAA8C,UAAU,IAAI;AAAA,EAC7E;AACF;AAEA,eAAe,6BACb,MACA,aACA,SACe;AACf,MAAI,CAAC,QAAS;AACd,QAAM,QAAQ,MAAMC,0BAAyB,KAAK,IAAI,aAAa,OAAO;AAC1E,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,kDAAkD,OAAO,EAAE;AAAA,EAC7E;AACA,QAAMC,qCAAoC,KAAK,KAAK,aAAa,KAAK;AACxE;AAEA,eAAsB,wBACpB,MAMA,SACA,OACA;AACA,QAAM,6BAA6B,MAAM,SAAS,MAAM,iBAAiB,gBAAgB;AACzF,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,aAAa,QAAQ,YAAY;AAAA,IACnC;AAAA,MACE,OAAO;AAAA,MACP,YAAY,CAAC,uBAAuB;AAAA,MACpC,aAAa,OAAO,OAClB,MAAM,8BAA8B,IAAI;AAAA,QACtC,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,iBAAiB,MAAM;AAAA,QACvB,OAAO,WAAW,OAAO;AAAA,QACzB,cAAc,MAAM;AAAA,QACpB,MAAM,MAAM;AAAA,MACd,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,2BAA2B,MAAM;AAAA,IACrC,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,WAAW,MAAM;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,IACnB,cAAc,OAAO;AAAA,IACrB,cAAc,OAAO;AAAA,IACrB,mBAAmB;AAAA,EACrB,CAAC;AACD,QAAM,6BAA6B,MAAM,QAAQ,aAAa,OAAO,uBAAuB;AAC5F,SAAO;AACT;AAEA,eAAsB,kBACpB,MAMA,SACA,OAKA;AACA,QAAM,6BAA6B,MAAM,SAAS,MAAM,iBAAiB,eAAe;AACxF,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,aAAa,QAAQ,YAAY;AAAA,IACnC;AAAA,MACE,OAAO;AAAA,MACP,YAAY,CAAC,mCAAmC,yBAAyB,iBAAiB;AAAA,MAC1F,aAAa,OAAO,OAClB,MAAM,+BAA+B,IAAI;AAAA,QACvC,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,iBAAiB,MAAM;AAAA,QACvB,OAAO,WAAW,OAAO;AAAA,QACzB,cAAc,MAAM;AAAA,QACpB,aAAa,MAAM;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,2BAA2B,MAAM;AAAA,IACrC,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,WAAW,MAAM;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,IACnB,cAAc,OAAO;AAAA,IACrB,cAAc,OAAO;AAAA,IACrB,mBAAmB,OAAO;AAAA,IAC1B,kBAAkB;AAAA,EACpB,CAAC;AACD,QAAM,6BAA6B,MAAM,QAAQ,aAAa,OAAO,uBAAuB;AAC5F,SAAO;AACT;AAEA,eAAsB,8BACpB,MAMA,SACA,OAMA;AACA,QAAM,gBAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,EACF;AACA,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,aAAa,QAAQ,YAAY;AAAA,IACnC;AAAA,MACE,OAAO;AAAA,MACP,YAAY,CAAC,MAAM,WAAW,UAAU,2BAA2B,yBAAyB;AAAA,MAC5F,aAAa,OAAO,OAClB,MAAM,kCAAkC,IAAI;AAAA,QAC1C,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,WAAW,MAAM;AAAA,QACjB,OAAO,WAAW,OAAO;AAAA,QACzB,cAAc,MAAM;AAAA,QACpB,QAAQ,MAAM;AAAA,QACd,QAAQ,MAAM,UAAU;AAAA,MAC1B,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,uBAAuB,MAAM,QAAQ,aAAa,MAAM,iBAAiB;AAAA,IAC7E,OAAO;AAAA,EACT,CAAC;AACD,QAAM,6BAA6B,MAAM,QAAQ,aAAa,OAAO,uBAAuB;AAC5F,QAAM,2BAA2B,MAAM,OAAO,SAAS;AACvD,SAAO,EAAE,GAAG,QAAQ,cAAc;AACpC;AAEA,SAAS,QAAQ,KAAsD;AACrE,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,QAAQ,IAAI;AAAA,IACZ,cAAc,IAAI;AAAA,IAClB,iBAAiB,IAAI;AAAA,IACrB,cAAc,IAAI;AAAA,IAClB,wBAAwB,IAAI;AAAA,IAC5B,qBAAqB,IAAI;AAAA,IACzB,oBAAoB,IAAI;AAAA,IACxB,sBAAsB,IAAI;AAAA,IAC1B,WAAW,IAAI,UAAU,YAAY;AAAA,EACvC;AACF;AAEA,SAAS,cACP,KACsB;AACtB,MAAI,CAAC,IAAK,QAAO;AACjB,SAAO;AAAA,IACL,UAAU,IAAI;AAAA,IACd,MAAM,IAAI;AAAA,IACV,aAAaC,0BAAyB,MAAM,IAAI,WAAW;AAAA,IAC3D,WAAW,IAAI;AAAA,IACf,OAAO,IAAI;AAAA,IACX,iBAAiB,IAAI;AAAA,IACrB,aAAa,IAAI;AAAA,IACjB,cAAc,IAAI;AAAA,IAClB,mBAAmB,IAAI;AAAA,IACvB,WAAW,IAAI,UAAU,YAAY;AAAA,EACvC;AACF;AAEA,eAAe,mBACb,IACA,aACA,WACA,sBACA;AACA,QAAM,WAAW,MAAM,wBAAwB,IAAI,aAAa,SAAS;AACzE,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,sBAAsB,SAAS,EAAE;AAChE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,kBAAkB;AAAA,MAChB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,qBACpB,MAKA,SACA,QACA,OACuC;AACvC,QAAM,gBAAgB,MAAM,6BAA6B,MAAM,SAAS,uBAAuB;AAC/F,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,aAAa,QAAQ,YAAY;AAAA,IACnC;AAAA,MACE,OAAO;AAAA,MACP,YAAY,CAAC,uBAAuB;AAAA,MACpC,aAAa,OAAO,OAClB,MAAM,4BAA4B,IAAI;AAAA,QACpC,GAAG;AAAA,QACH;AAAA,QACA,cAAc,MAAM;AAAA,QACpB,sBAAsB,MAAM;AAAA,QAC5B,OAAO,EAAE,MAAM,SAAS,WAAW,QAAQ,UAAU;AAAA,QACrD,cAAc,MAAM;AAAA,MACtB,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,SAAS,QAAQ,OAAO,OAAO;AAAA,IAC/B,UAAU,MAAM;AAAA,MACd,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,eAAe,wBAAwB;AAAA,IACzC;AAAA,EACF;AACA,QAAM,uBAAuB,MAAM,QAAQ,aAAa,QAAQ,WAAW,OAAO,QAAQ;AAC1F,SAAO;AACT;AAEA,eAAsB,uBACpB,MAKA,SACA,QACA,OACuC;AACvC,QAAM,gBAAgB,MAAM,6BAA6B,MAAM,SAAS,uBAAuB;AAC/F,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,aAAa,QAAQ,YAAY;AAAA,IACnC;AAAA,MACE,OAAO;AAAA,MACP,YAAY,CAAC,uBAAuB;AAAA,MACpC,aAAa,OAAO,OAClB,MAAM,oCAAoC,IAAI;AAAA,QAC5C,GAAG;AAAA,QACH;AAAA,QACA,qBAAqB,MAAM;AAAA,QAC3B,OAAO,EAAE,MAAM,SAAS,WAAW,QAAQ,UAAU;AAAA,QACrD,cAAc,MAAM;AAAA,QACpB,QAAQ,MAAM,UAAU;AAAA,MAC1B,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,SAAS,QAAQ,OAAO,OAAO;AAAA,IAC/B,UAAU,MAAM;AAAA,MACd,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,eAAe,wBAAwB;AAAA,IACzC;AAAA,EACF;AACA,QAAM,uBAAuB,MAAM,QAAQ,aAAa,QAAQ,WAAW,OAAO,QAAQ;AAC1F,SAAO;AACT;AAEA,eAAsB,qBACpB,MAKA,SACA,QACA,OACuC;AACvC,QAAM,gBAAgB,MAAM,6BAA6B,MAAM,SAAS,uBAAuB;AAC/F,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,aAAa,QAAQ,aAAa,WAAW,QAAQ,UAAU;AAAA,IACjE;AAAA,MACE,OAAO;AAAA,MACP,YAAY,CAAC,uBAAuB;AAAA,MACpC,aAAa,OAAO,OAClB,MAAM,4BAA4B,IAAI;AAAA,QACpC,GAAG;AAAA,QACH;AAAA,QACA,qBAAqB,MAAM;AAAA,QAC3B,uBAAuB,MAAM;AAAA,QAC7B,cAAc,MAAM;AAAA,QACpB,OAAO,EAAE,MAAM,SAAS,WAAW,QAAQ,UAAU;AAAA,QACrD,cAAc,MAAM;AAAA,MACtB,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,SAAS,QAAQ,OAAO,OAAO;AAAA,IAC/B,UAAU,MAAM;AAAA,MACd,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,eAAe,wBAAwB;AAAA,IACzC;AAAA,IACA,OAAO,cAAc,OAAO,KAAK;AAAA,EACnC;AACA,QAAM,uBAAuB,MAAM,QAAQ,aAAa,QAAQ,WAAW,OAAO,QAAQ;AAC1F,SAAO;AACT;AAEA,eAAsB,sBACpB,MAKA,SACA,QACA,OACuC;AACvC,QAAM,gBAAgB,MAAM,6BAA6B,MAAM,SAAS,uBAAuB;AAC/F,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,aAAa,QAAQ,YAAY;AAAA,IACnC;AAAA,MACE,OAAO;AAAA,MACP,YAAY,CAAC,mCAAmC,yBAAyB,iBAAiB;AAAA,MAC1F,aAAa,OAAO,OAClB,MAAM,6BAA6B,IAAI;AAAA,QACrC,GAAG;AAAA,QACH;AAAA,QACA,qBAAqB,MAAM;AAAA,QAC3B,aAAa,MAAM,eAAe;AAAA,QAClC,OAAO,EAAE,MAAM,SAAS,WAAW,QAAQ,UAAU;AAAA,QACrD,cAAc,MAAM;AAAA,MACtB,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,SAAS,QAAQ,OAAO,OAAO;AAAA,IAC/B,UAAU,MAAM;AAAA,MACd,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,eAAe,wBAAwB;AAAA,IACzC;AAAA,EACF;AACA,QAAM,uBAAuB,MAAM,QAAQ,aAAa,QAAQ,WAAW,OAAO,QAAQ;AAC1F,QAAM,6BAA6B,MAAM,QAAQ,aAAa,OAAO,uBAAuB;AAC5F,SAAO;AACT;AAEA,eAAsB,yCACpB,MAMA,SACA,OACgE;AAChE,QAAM,gBAAgB,MAAM,6BAA6B,MAAM,SAAS,iBAAiB;AACzF,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,aAAa,QAAQ,YAAY;AAAA,IACnC;AAAA,MACE,OAAO;AAAA,MACP,YAAY;AAAA,QACV,MAAM,WAAW,WAAW,4BAA4B;AAAA,MAC1D;AAAA,MACA,aAAa,OAAO,OAClB,MAAM,kCAAkC,IAAI;AAAA,QAC1C,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,WAAW,QAAQ;AAAA,QACnB,OAAO,EAAE,MAAM,SAAS,WAAW,QAAQ,UAAU;AAAA,QACrD,cAAc,MAAM;AAAA,QACpB,QAAQ,MAAM;AAAA,QACd,QAAQ,MAAM,UAAU;AAAA,QACxB,qBAAqB,MAAM,uBAAuB;AAAA,MACpD,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,SAAS,QAAQ,OAAO,OAAO;AAAA,IAC/B,kBAAkB;AAAA,MAChB,iCAAiC,OAAO,OAAO;AAAA,MAC/C,QAAQ;AAAA,MACR,eAAe,wBAAwB;AAAA,IACzC;AAAA,IACA,mBAAmB,OAAO;AAAA,IAC1B,WAAW,OAAO;AAAA,IAClB,uBAAuB,OAAO;AAAA,IAC9B,oBAAoB,OAAO;AAAA,EAC7B;AACA,aAAW,YAAY,OAAO,uBAAuB;AACnD,UAAM,uBAAuB,MAAM,QAAQ,aAAa,SAAS,WAAW,SAAS,QAAQ;AAAA,EAC/F;AACA,QAAM,6BAA6B,MAAM,QAAQ,aAAa,OAAO,uBAAuB;AAC5F,QAAM,2BAA2B,MAAM,OAAO,SAAS;AACvD,SAAO,EAAE,UAAU,QAAQ,OAAO,OAAO;AAC3C;AAGA,eAAsB,8BACpB,MACA,SACA,OACiC;AACjC,UAAQ,MAAM,yCAAyC,MAAM,SAAS,KAAK,GAAG;AAChF;AAEA,eAAsB,sBACpB,MAKA,SACA,OAC4C;AAC5C,QAAM,SAAS,MAAMC;AAAA,IAAiB,KAAK;AAAA,IAAI,QAAQ;AAAA,IAAa,CAAC,WACnE,OAAO;AAAA,MAAY,CAAC,OAClB,oCAAoC,IAA2B;AAAA,QAC7D,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,OAAO,EAAE,MAAM,SAAS,WAAW,QAAQ,UAAU;AAAA,QACrD,cAAc,MAAM;AAAA,QACpB,QAAQ,MAAM;AAAA,QACd,QAAQ,MAAM,UAAU;AAAA,QACxB,kBAAkB,MAAM,oBAAoB;AAAA,MAC9C,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,SAAS,QAAQ,OAAO,OAAO;AAAA,IAC/B,OAAO,OAAO;AAAA,IACd,UAAU,OAAO;AAAA,IACjB,mBAAmB,OAAO;AAAA,IAC1B,WAAW,OAAO;AAAA,EACpB;AACA,QAAM,6BAA6B,MAAM,QAAQ,aAAa,OAAO,uBAAuB;AAC5F,QAAM,2BAA2B,MAAM,OAAO,SAAS;AACvD,SAAO;AACT;AAEA,eAAsB,sBACpB,MACA,SACwB;AACxB,QAAM,6BAA6B,MAAM,SAAS,uBAAuB;AACzE,QAAM,MAAM,MAAMC;AAAA,IAChB,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,CAAC,WACC,8BAA8B,QAAQ;AAAA,MACpC,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,MACnB,WAAW,QAAQ;AAAA,IACrB,CAAC;AAAA,EACL;AACA,QAAM,SAAS,cAAc,GAAG;AAChC,MAAI,OAAQ,QAAO;AACnB,QAAM,UAAU,MAAMC,YAAW,KAAK,IAAI,QAAQ,aAAa,QAAQ,SAAS;AAChF,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,sBAAsB,QAAQ,SAAS,EAAE;AACvE,SAAO;AAAA,IACL,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa,CAAC;AAAA,IACd,WAAW,CAAC;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,iBAAiBC,4BAA2B,QAAQ,UAAU,QAAQ;AAAA,IACtE,aAAaC,wBAAuB,QAAQ,UAAU,UAAU;AAAA,IAChE,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB,WAAW;AAAA,EACb;AACF;AAEA,eAAsB,uBACpB,MACA,SACA,OACwB;AACxB,QAAM,6BAA6B,MAAM,SAAS,wBAAwB;AAC1E,QAAM,cAAc,MAAM;AAAA,IACxB,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,MAAM,eAAe,CAAC;AAAA,EACxB;AACA,QAAM,MAAM,MAAMH;AAAA,IAChB,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,CAAC,WACC,OAAO;AAAA,MAAY,CAAC,OAClB,+BAA+B,IAA2B;AAAA,QACxD,GAAG;AAAA,QACH,GAAG;AAAA,QACH;AAAA,QACA,WAAW,mBAAmB,MAAM,SAAS;AAAA,QAC7C,WAAW,QAAQ;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACJ;AACA,SAAO,cAAc,GAAG;AAC1B;","names":["getEnrollment","getSandbox","readActiveSandbox","NatsControlRpc","NatsOpStreamTransport","NatsControlRpc","readActiveSandbox","getEnrollment","getSandbox","pointer","NatsOpStreamTransport","HTTPException","FIKEN_PROVIDER_DOMAIN","getWorkspaceGrant","listPackInstallations","HTTPException","HTTPException","listPackInstallations","HTTPException","getWorkspaceGrant","HTTPException","FIKEN_PROVIDER_DOMAIN","record","enabled","createHash","buildPortableSkillArtifact","HTTPException","sha256Hex","owner","repository","environmentsEncryptionKeyBytes","getVariableSet","HTTPException","HTTPException","environmentsEncryptionKeyBytes","getVariableSet","getRig","getVariableSet","recordAuditEvent","HTTPException","createHash","stableJson","recordAuditEvent","getRig","HTTPException","getVariableSet","getConnectionMetadata","getWorkspaceGrant","listConnectionsMetadata","listSocialConnections","stableJson","HTTPException","mergeToolRefs","mergeToolRefs","OPENGENI_SLACK_BOT_SESSION_METADATA_KEY","getConnectionMetadata","getRig","getSessionTurnXaiProviderAccountAuthoritySnapshot","getSession","requireWorkspace","HTTPException","FIRST_PARTY_MCP_TOOL_NAMES","OPENGENI_SLACK_BOT_SESSION_METADATA_KEY","stableJson","encryptVariableSetValue","getEnrollment","getRig","getSandbox","getSession","requireSession","appendAndPublishEvents","HTTPException","HTTPException","record","getConnectionMetadata","HTTPException","getConnectionMetadata","HTTPException","FIRST_PARTY_MCP_TOOL_NAMES","HTTPException","encryptVariableSetValue","finished","requireSession","OPENGENI_SLACK_BOT_SESSION_METADATA_KEY","getSession","getRig","getSandbox","getEnrollment","appendAndPublishEvents","stableJson","getSessionTurnXaiProviderAccountAuthoritySnapshot","HTTPException","getSession","getRig","getConnectionMetadata","OPENGENI_SLACK_BOT_SESSION_METADATA_KEY","requireWorkspace","configuredStaticUsageLimits","requireWorkspace","sumUsageQuantity","startOfUtcMonth","createHash","stableJson","stableJson","createHash","enqueueMemorySlackPublication","getCurrentMemorySlackPublicationConfiguration","receipt","getCurrentMemorySlackPublicationConfiguration","enqueueMemorySlackPublication","createHash","receipt","HTTPException","createHash","sha256","getEnrollment","getRig","getSandbox","getVariableSet","requireFile","HTTPException","requireFile","getVariableSet","getRig","getSandbox","getEnrollment","HTTPException","DraftTimelineAnnotations","latencyModeForMetadata","reasoningEffortForMetadata","getSession","getSessionEvent","getWorkspaceControlEvent","runIdempotentPersistenceTransaction","withWorkspaceRls","withWorkspaceSubjectRls","withWorkspaceSubjectSessionActivityRls","publishDurableSessionEvents","publishDurableWorkspaceControlEvent","runIdempotentPersistenceTransaction","withWorkspaceSubjectSessionActivityRls","getSessionEvent","publishDurableSessionEvents","getWorkspaceControlEvent","publishDurableWorkspaceControlEvent","DraftTimelineAnnotations","withWorkspaceRls","withWorkspaceSubjectRls","getSession","reasoningEffortForMetadata","latencyModeForMetadata"]}
+{"version":3,"sources":["../src/workflow-wake-contract.ts","../src/transcription.ts","../src/sandbox/fleet.ts","../src/sandbox/routing.ts","../src/access/index.ts","../src/session-authorization.ts","../src/billing/limits.ts","../src/domain/capabilities.ts","../src/domain/fiken.ts","../src/domain/packs.ts","../src/domain/skill-imports.ts","../src/domain/environments.ts","../src/rigs/index.ts","../src/rigs/provider-images.ts","../src/domain/personal-connection-delegations.ts","../src/domain/resources.ts","../src/domain/session-tool-policy.ts","../src/domain/scheduled-tasks.ts","../src/domain/sessions.ts","../src/domain/timeline-annotations.ts","../src/domain/slack-bot.ts","../src/domain/insights.ts","../src/domain/memory-slack-publication.ts","../src/domain/slack-publication-secret-safety.ts","../src/domain/memory-slack-delivery.ts","../src/domain/durable-learning-slack-publication.ts","../src/domain/company-profile-durable-learning-adapter.ts","../src/domain/conversation-integrations.ts","../src/domain/workspace-members.ts","../src/domain/video-generation.ts","../src/domain/video-generation-capabilities.ts","../src/application/new-session-drafts.ts","../src/application/session-commands.ts"],"sourcesContent":["/** One global Temporal Schedule owns bounded delivery of committed session wakes. */\nexport const SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID =\n  \"opengeni-session-workflow-wake-dispatcher\";\nexport const SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE =\n  \"sessionWorkflowWakeDispatcherWorkflow\";\nexport const SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS = 10_000;\n\n/**\n * Temporal delivers activity cancellation through heartbeats. Keep both the\n * activity's local heartbeat timer and the worker's SDK throttle at this bound\n * so the end-to-end Pause/Steer physical-cancellation contract is not already\n * exhausted before sandbox/tool quiescence and replacement admission begin.\n */\nexport const TURN_ACTIVITY_CANCELLATION_HEARTBEAT_INTERVAL_MS = 500;\n","import type { TranscribeAudioResponse, VoiceInputErrorCode } from \"@opengeni/contracts\";\n\n/**\n * Server-owned upstream budget for one provider attempt. Resumable recording\n * claims remain fenced for longer than this budget before another worker may\n * reclaim them. Provider adapters must honor the supplied AbortSignal and must\n * not return while their upstream request is still live; OpenGeni does not\n * claim remote-side idempotency or cancellation for vendors that cannot meet\n * that adapter contract.\n */\nexport const TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS = 10 * 60 * 1_000;\n\nexport type TranscriptionLimits = {\n  maxDurationSeconds: number;\n  maxSizeBytes: number;\n  acceptedMimeTypes: readonly string[];\n};\n\nexport type TranscriptionRequest = {\n  workspaceId: string;\n  accountId: string;\n  /** Authenticated human/service subject used for provider-account authority. */\n  subjectId: string;\n  audio: Uint8Array;\n  mimeType: string;\n  /** Optional client-reported duration; enforced as a soft ceiling before upstream. */\n  durationSeconds?: number | undefined;\n  signal?: AbortSignal | undefined;\n  requestId: string;\n  /** Absolute server-owned provider deadline persisted for resumable attempts. */\n  providerDeadlineAt?: Date | undefined;\n  /** Exact provider selected before a resumable segment is first sent upstream. */\n  providerId?: string | undefined;\n};\n\nexport type TranscriptionResult = TranscribeAudioResponse & {\n  /** Server-private provider id for operational metrics only. Never returned to clients. */\n  providerId: string;\n  audioSeconds: number;\n  latencyMs: number;\n};\n\nexport class TranscriptionServiceError extends Error {\n  readonly code: VoiceInputErrorCode;\n  readonly status: number;\n  readonly retryable: boolean;\n\n  constructor(input: {\n    code: VoiceInputErrorCode;\n    message: string;\n    status?: number;\n    retryable?: boolean;\n  }) {\n    super(input.message);\n    this.name = \"TranscriptionServiceError\";\n    this.code = input.code;\n    this.status = input.status ?? statusForVoiceInputError(input.code);\n    this.retryable = input.retryable ?? false;\n  }\n}\n\nexport function statusForVoiceInputError(code: VoiceInputErrorCode): number {\n  switch (code) {\n    case \"permission_denied\":\n      return 403;\n    case \"policy_blocked\":\n      return 403;\n    case \"not_supported\":\n      return 415;\n    case \"unavailable\":\n      return 503;\n    case \"too_large\":\n      return 413;\n    case \"invalid_audio\":\n      return 400;\n    case \"timeout\":\n      return 504;\n    case \"cancelled\":\n      return 499;\n    case \"network\":\n    case \"provider\":\n      return 502;\n    case \"unknown\":\n    default:\n      return 500;\n  }\n}\n\n/** Optional workspace scope for readiness checks during provider selection. */\nexport type TranscriptionAvailabilityContext = {\n  workspaceId?: string | undefined;\n  subjectId?: string | undefined;\n};\n\n/**\n * Extensible transcription provider port. Implementations own credentials and\n * upstream request shape. Selection happens before audio is sent; providers must\n * not fall back to another vendor after an upstream request may have started.\n */\nexport type TranscriptionProvider = {\n  readonly id: string;\n  /** The adapter guarantees that its upstream transport honors AbortSignal. */\n  readonly supportsServerDeadline: true;\n  readonly experimental?: boolean | undefined;\n  /**\n   * Deployment readiness when called without a workspace. When `workspaceId` is\n   * provided, providers may require a workspace-attached credential (e.g. Codex).\n   */\n  available(context?: TranscriptionAvailabilityContext): boolean | Promise<boolean>;\n  transcribe(input: {\n    audio: Uint8Array;\n    mimeType: string;\n    filename: string;\n    workspaceId: string;\n    accountId: string;\n    subjectId: string;\n    requestId: string;\n    signal?: AbortSignal | undefined;\n  }): Promise<{ text: string; languages: string[] }>;\n};\n\nexport type TranscriptionService = {\n  limits(): TranscriptionLimits;\n  /** True when at least one ready provider can serve requests. */\n  available(context?: TranscriptionAvailabilityContext): boolean | Promise<boolean>;\n  /** Select one provider before a durable segment attempt; retries pin this id. */\n  selectProvider?(\n    context: TranscriptionAvailabilityContext,\n  ): string | null | Promise<string | null>;\n  transcribe(request: TranscriptionRequest): Promise<TranscriptionResult>;\n};\n\nexport type PreparedTranscriptionSegment = {\n  segmentNumber: number;\n  startMilliseconds: number;\n  durationMilliseconds: number;\n  mimeType: \"audio/wav\";\n  bytes: Uint8Array;\n};\n\nexport type TranscriptionSegmenter = {\n  available(): boolean | Promise<boolean>;\n  segment(input: {\n    sourceMimeType: string;\n    totalDurationMilliseconds: number;\n    providerSegmentSeconds: number;\n    chunks: AsyncIterable<Uint8Array>;\n    signal?: AbortSignal | undefined;\n  }): AsyncIterable<PreparedTranscriptionSegment>;\n};\n\nexport function normalizeMimeType(mimeType: string): string {\n  return mimeType.trim().toLowerCase();\n}\n\nexport function isAcceptedMimeType(mimeType: string, accepted: readonly string[]): boolean {\n  const normalized = normalizeMimeType(mimeType);\n  if (accepted.some((candidate) => normalizeMimeType(candidate) === normalized)) {\n    return true;\n  }\n  // Allow bare type matches against codec-qualified allowlist entries.\n  const bare = normalized.split(\";\")[0]?.trim() ?? normalized;\n  return accepted.some((candidate) => {\n    const allowed = normalizeMimeType(candidate);\n    return allowed === bare || allowed.split(\";\")[0]?.trim() === bare;\n  });\n}\n\nexport function filenameForMimeType(mimeType: string): string {\n  const bare = normalizeMimeType(mimeType).split(\";\")[0] ?? \"audio/webm\";\n  switch (bare) {\n    case \"audio/mp4\":\n    case \"audio/m4a\":\n      return \"audio.mp4\";\n    case \"audio/ogg\":\n      return \"audio.ogg\";\n    case \"audio/mpeg\":\n    case \"audio/mp3\":\n      return \"audio.mp3\";\n    case \"audio/wav\":\n    case \"audio/x-wav\":\n      return \"audio.wav\";\n    case \"audio/webm\":\n    default:\n      return \"audio.webm\";\n  }\n}\n","// apps/api/src/sandbox/fleet.ts — the FLEET service backing the fleet MCP tools\n// (M7): list / attach / swap / run_on / provision over the heterogeneous fleet\n// (the session's Modal group box + the workspace's enrolled selfhosted machines).\n//\n// Each operation is workspace-scoped (the caller's grant) and, for the\n// session-pointer mutations (attach/swap), session-scoped (the worker-signed\n// sessionId claim). The swap is the epoch-fenced CAS `setActiveSandbox`: it bumps\n// active_epoch + repoints active_sandbox_id, which the routing proxy reads on the\n// NEXT tool call. Liveness for a selfhosted target is a real ControlRpc ping over\n// the events bus (the subject IS the registry); a Modal box is \"live\" while its\n// session group exists. `run_on` builds a one-off backend session and runs a\n// single op WITHOUT touching the active pointer.\n\nimport type { Settings } from \"@opengeni/config\";\nimport {\n  getEnrollment,\n  getSandbox,\n  listSandboxes,\n  readActiveSandbox,\n  readLease,\n  requireSession,\n  setActiveSandbox,\n  type Database,\n  type EnrollmentRecord,\n  type SandboxRecord,\n} from \"@opengeni/db\";\nimport type { EventBus } from \"@opengeni/events\";\nimport {\n  NatsControlRpc,\n  NatsOpStreamTransport,\n  selfhostedLiveness,\n  SelfhostedSession,\n  swapTargetEstablishability,\n  type BackendUnresolvableCode,\n  type ControlRpc,\n  type NatsRequestConnection,\n  type SelfhostedRelayConfig,\n  type SelfhostedOpStreamDeps,\n} from \"@opengeni/runtime/sandbox\";\nimport { relayConfigFromSettings } from \"./routing\";\n\nexport type FleetServices = {\n  db: Database;\n  settings: Settings;\n  bus?: EventBus;\n  /** API-direct readiness owner for the session's home group. Production wires\n   * this to the same viewer/provider verification + rematerialization path; core\n   * tests may omit it when exercising pointer mechanics only. */\n  ensureSessionGroupReady?: (ctx: FleetContext) => Promise<FleetReadinessHold>;\n};\n\nexport type FleetReadinessHold = {\n  /** Release target liveness only after route publication settles. */\n  release: () => Promise<void>;\n};\n\nexport type FleetContext = {\n  accountId: string;\n  workspaceId: string;\n  /** The calling session (the pointer the attach/swap mutates + whose group box\n   *  is the default fleet member). */\n  sessionId: string;\n  /** The session's own group sandbox backend (modal/selfhosted/…). */\n  sessionBackend: string;\n  /** The session's own group sandbox id (the lease group). */\n  sessionGroupId: string;\n};\n\n/**\n * Build a session-scoped {@link FleetContext}: load the session (workspace-\n * scoped) and project its group backend/id. A backend:none session has no home\n * box, but it may still discover, run on, and attach an owned Connected Machine.\n * Shared\n * by the worker-signed MCP fleet tools and the user-authenticated swap REST\n * route so both resolve the SAME context (no drift). The `accountId`/`workspaceId`/\n * `sessionId` come from the trusted grant/route; the backend + group id come from\n * the session row.\n */\nexport async function buildFleetContextForSession(\n  deps: { db: Database },\n  ctx: { accountId: string; workspaceId: string; sessionId: string },\n): Promise<FleetContext> {\n  const session = await requireSession(deps.db, ctx.workspaceId, ctx.sessionId);\n  return {\n    accountId: ctx.accountId,\n    workspaceId: ctx.workspaceId,\n    sessionId: ctx.sessionId,\n    sessionBackend: session.sandboxBackend,\n    sessionGroupId: session.sandboxGroupId,\n  };\n}\n\n/** The dominant liveness of a fleet member, surfaced to the dock + the agent. */\nexport type FleetLiveness = \"online\" | \"reconnecting\" | \"offline\";\nexport type FleetOperationAvailability = \"ready\" | \"wakeable\" | \"recovering\" | \"unavailable\";\n\n/**\n * A fleet member as the agent + the dock see it (the M8b/M9 UI seam — the\n * `sandboxes_list` response entry the dock renders). STABLE shape: the dock keys\n * on `id`, renders `name`/`kind`/`liveness`, and marks `active`. The session's own\n * Modal group box is a synthetic entry with `id: groupId`, `kind: \"modal\"`, and a\n * null `enrollmentId`; an enrolled machine carries its sandbox + enrollment ids.\n */\nexport type FleetSandboxEntry = {\n  /** The sandbox id used as the attach/swap/run_on `target`. For the session's\n   *  own group box this is the group id (a null active pointer == this box). */\n  id: string;\n  kind: \"modal\" | \"selfhosted\";\n  name: string;\n  liveness: FleetLiveness;\n  /** True for the session's currently-active sandbox (the routing target). */\n  active: boolean;\n  /** True for the session's own group box (the default/home sandbox). */\n  isSessionGroup: boolean;\n  enrollmentId: string | null;\n  /** Whether this target can be attached/swapped to right now (live + addressable). */\n  attachable: boolean;\n  /** Whether an ordinary shell/files operation can use this target. This is\n   * deliberately separate from `attachable`: an idle managed home sandbox can\n   * be wakeable even while its holderless lease is cold/draining and therefore\n   * not an already-live swap target. */\n  operationAvailability: FleetOperationAvailability;\n  /** Selfhosted only: whether whole-machine + screen-control consent is acked. */\n  consented?: boolean;\n  /** Selfhosted only: whether a display (real/Xvfb) is present. */\n  hasDisplay?: boolean;\n  lastSeenAt?: string | null;\n  /** Orthogonal truth dimensions. `liveness` is only their conservative UI\n   * projection and is never evidence for a specific dimension. */\n  providerStatus: \"not_created\" | \"creating\" | \"exists\" | \"missing\" | \"unknown\";\n  leaseLiveness: \"cold\" | \"warming\" | \"warm\" | \"draining\" | null;\n  routeStatus: \"attached\" | \"detached\";\n  archiveStatus: \"none\" | \"available\" | \"unverified\" | \"invalid\";\n  restoreStatus:\n    | \"not_required\"\n    | \"pending\"\n    | \"restoring\"\n    | \"verifying\"\n    | \"ready\"\n    | \"degraded\"\n    | \"unrecoverable\";\n  workspaceStatus: \"unknown\" | \"not_ready\" | \"ready\" | \"degraded\" | \"unrecoverable\";\n  leaseEpoch: number | null;\n  routeEpoch: number;\n  /** Numeric/boolean persistence truth only. Archive locations, content hashes,\n   * provider identities, and storage handles are intentionally not projected. */\n  workspaceGeneration: number | null;\n  archiveGeneration: number | null;\n  archiveComplete: boolean;\n};\n\nexport type FleetListResult = {\n  /** The session's currently-active sandbox id, or null == the group box. */\n  activeSandboxId: string | null;\n  activeEpoch: number;\n  sandboxes: FleetSandboxEntry[];\n};\n\n/** A swap/attach outcome the tool returns. On a rejection, `code` carries the\n *  typed reason (issue #341 typed diagnostics) alongside the human `reason`. */\nexport type FleetSwapResult = {\n  swapped: boolean;\n  activeSandboxId: string | null;\n  activeEpoch: number;\n  reason?: string;\n  code?:\n    | BackendUnresolvableCode\n    | \"concurrent_swap\"\n    | \"recovery_in_progress\"\n    | \"recovery_degraded\"\n    | \"recovery_unrecoverable\";\n};\n\nconst PROBE_TIMEOUT_MS = 5_000;\n\nfunction controlRpc(bus: EventBus | undefined): ControlRpc {\n  return new NatsControlRpc(async (): Promise<NatsRequestConnection | null> => {\n    if (!bus) {\n      return null;\n    }\n    return bus.getRequestConnection();\n  });\n}\n\n/** Probe an enrolled machine's liveness: a real ControlRpc ping (the subject IS\n *  the registry), mapped through `selfhostedLiveness` (the enrollment row's\n *  status/consent/display + lastSeenAt disambiguate a probe-miss into\n *  reconnecting vs offline). A revoked/never-seen enrollment is offline without a\n *  probe. */\nasync function probeEnrollment(\n  services: FleetServices,\n  workspaceId: string,\n  enrollment: EnrollmentRecord,\n): Promise<{ liveness: FleetLiveness; consented: boolean; hasDisplay: boolean }> {\n  const { settings, bus } = services;\n  let probeResponded = false;\n  if (enrollment.status === \"active\") {\n    const session = new SelfhostedSession({\n      workspaceId,\n      agentId: enrollment.id,\n      controlRpc: controlRpc(bus),\n      relay: relayConfigFromSettings(settings),\n      timeoutMs: PROBE_TIMEOUT_MS,\n    });\n    try {\n      probeResponded = await session.ping();\n    } catch {\n      probeResponded = false;\n    }\n  }\n  const state = selfhostedLiveness({\n    enrollment: {\n      status: enrollment.status,\n      exposure: enrollment.exposure,\n      allowScreenControl: enrollment.allowScreenControl,\n      hasDisplay: enrollment.hasDisplay,\n      lastSeenAt: enrollment.lastSeenAt,\n      wentOfflineAt: enrollment.wentOfflineAt,\n      wentOfflineReason: enrollment.wentOfflineReason,\n    },\n    probeResponded,\n  });\n  return { liveness: state.state, consented: state.consented, hasDisplay: state.hasDisplay };\n}\n\n/**\n * List the fleet: the session's own group box when it has one (a synthetic\n * entry) + the workspace's first-class selfhosted sandboxes (each probed for\n * liveness), each with an `active` marker derived from the session's active\n * pointer. A backend:none session has no synthetic home entry; a null pointer\n * then means no compute is attached.\n */\nexport async function listFleet(\n  services: FleetServices,\n  ctx: FleetContext,\n): Promise<FleetListResult> {\n  const { db } = services;\n  const pointer = (await readActiveSandbox(db, ctx.workspaceId, ctx.sessionId)) ?? {\n    activeSandboxId: null,\n    activeEpoch: 0,\n  };\n\n  const entries: FleetSandboxEntry[] = [];\n\n  if (ctx.sessionBackend !== \"none\") {\n    // The session's own group box (the default/home sandbox; null active pointer ==\n    // this box). A session/group row is not provider existence. Online requires a\n    // warm lease, observed provider existence, and verified workspace readiness.\n    const groupActive = pointer.activeSandboxId === null;\n    const groupLease = await readLease(db, ctx.workspaceId, ctx.sessionGroupId);\n    const groupOnline = Boolean(\n      groupLease?.liveness === \"warm\" &&\n      groupLease.recovery.provider.status === \"exists\" &&\n      groupLease.recovery.workspace.status === \"ready\",\n    );\n    const groupRecovering = Boolean(\n      groupLease &&\n      (groupLease.liveness === \"warming\" ||\n        groupLease.recovery.restore.status === \"pending\" ||\n        groupLease.recovery.restore.status === \"restoring\" ||\n        groupLease.recovery.restore.status === \"verifying\"),\n    );\n    const groupRecoveryUnavailable = Boolean(\n      groupLease &&\n      (groupLease.recovery.restore.status === \"degraded\" ||\n        groupLease.recovery.restore.status === \"unrecoverable\" ||\n        groupLease.recovery.workspace.status === \"degraded\" ||\n        groupLease.recovery.workspace.status === \"unrecoverable\"),\n    );\n    const groupOperationAvailability: FleetOperationAvailability = groupOnline\n      ? \"ready\"\n      : groupRecoveryUnavailable\n        ? \"unavailable\"\n        : groupRecovering\n          ? \"recovering\"\n          : ctx.sessionBackend === \"selfhosted\"\n            ? \"unavailable\"\n            : \"wakeable\";\n    entries.push({\n      id: ctx.sessionGroupId,\n      kind: ctx.sessionBackend === \"selfhosted\" ? \"selfhosted\" : \"modal\",\n      name: \"session sandbox\",\n      liveness: groupOnline ? \"online\" : groupRecovering ? \"reconnecting\" : \"offline\",\n      active: groupActive,\n      isSessionGroup: true,\n      enrollmentId: null,\n      attachable: groupOnline,\n      operationAvailability: groupOperationAvailability,\n      providerStatus: groupLease?.recovery.provider.status ?? \"not_created\",\n      leaseLiveness: groupLease?.liveness ?? null,\n      routeStatus: groupActive ? \"attached\" : \"detached\",\n      archiveStatus: groupLease?.recovery.archive.status ?? \"none\",\n      restoreStatus: groupLease?.recovery.restore.status ?? \"not_required\",\n      workspaceStatus: groupLease?.recovery.workspace.status ?? \"unknown\",\n      leaseEpoch: groupLease?.leaseEpoch ?? null,\n      routeEpoch: pointer.activeEpoch,\n      workspaceGeneration: groupLease?.workspaceGeneration ?? null,\n      archiveGeneration: groupLease?.archiveGeneration ?? null,\n      archiveComplete: groupLease?.archiveComplete ?? false,\n    });\n  }\n\n  // The workspace's first-class selfhosted sandboxes (enrolled machines). Probe\n  // each for liveness; a missing enrollment is offline.\n  const sandboxes = await listSandboxes(db, ctx.workspaceId);\n  for (const sandbox of sandboxes) {\n    if (sandbox.kind !== \"selfhosted\" || !sandbox.enrollmentId) {\n      continue;\n    }\n    const enrollment = await getEnrollment(db, ctx.workspaceId, sandbox.enrollmentId);\n    if (!enrollment || enrollment.status !== \"active\") {\n      // Revoked enrollments remain durable audit/history records, but they are\n      // intentionally absent from the normal attach/run picker.\n      continue;\n    }\n    const probe = enrollment\n      ? await probeEnrollment(services, ctx.workspaceId, enrollment)\n      : { liveness: \"offline\" as FleetLiveness, consented: false, hasDisplay: false };\n    entries.push({\n      id: sandbox.id,\n      kind: \"selfhosted\",\n      name: sandbox.name,\n      liveness: probe.liveness,\n      active: pointer.activeSandboxId === sandbox.id,\n      isSessionGroup: false,\n      enrollmentId: sandbox.enrollmentId,\n      attachable: probe.liveness === \"online\",\n      operationAvailability:\n        probe.liveness === \"online\"\n          ? \"ready\"\n          : probe.liveness === \"reconnecting\"\n            ? \"recovering\"\n            : \"unavailable\",\n      consented: probe.consented,\n      hasDisplay: probe.hasDisplay,\n      lastSeenAt: enrollment?.lastSeenAt ?? null,\n      providerStatus:\n        probe.liveness === \"online\"\n          ? \"exists\"\n          : probe.liveness === \"reconnecting\"\n            ? \"unknown\"\n            : \"missing\",\n      leaseLiveness: null,\n      routeStatus: pointer.activeSandboxId === sandbox.id ? \"attached\" : \"detached\",\n      archiveStatus: \"none\",\n      restoreStatus: \"not_required\",\n      workspaceStatus: probe.liveness === \"online\" ? \"ready\" : \"not_ready\",\n      leaseEpoch: null,\n      routeEpoch: pointer.activeEpoch,\n      workspaceGeneration: null,\n      archiveGeneration: null,\n      archiveComplete: false,\n    });\n  }\n\n  return {\n    activeSandboxId: pointer.activeSandboxId,\n    activeEpoch: pointer.activeEpoch,\n    sandboxes: entries,\n  };\n}\n\n/** Resolve a swap target id → the value `setActiveSandbox` writes. The session's\n *  own group id maps to NULL (the default pointer); a first-class sandbox id is\n *  validated (workspace ownership + liveness) and written verbatim. */\nasync function resolveTarget(\n  services: FleetServices,\n  ctx: FleetContext,\n  target: string,\n): Promise<\n  | { ok: true; targetSandboxId: string | null }\n  | { ok: false; reason: string; code: BackendUnresolvableCode }\n> {\n  // The session's own group box → the default pointer (null).\n  if (target === ctx.sessionGroupId || target === \"session\" || target === \"default\") {\n    if (ctx.sessionBackend === \"none\") {\n      return {\n        ok: false,\n        reason: \"this session has no home sandbox; attach a Connected Machine\",\n        code: \"unsupported_backend_context\",\n      };\n    }\n    return { ok: true, targetSandboxId: null };\n  }\n  const sandbox = await getSandbox(services.db, ctx.workspaceId, target);\n  if (!sandbox) {\n    return {\n      ok: false,\n      reason: `sandbox ${target} not found in this workspace`,\n      code: \"stale_pointer\",\n    };\n  }\n  // ESTABLISHER-CAPABILITY GATE (issue #341 invariant A): a target must be\n  // establishable by a turn's routing context BEFORE the epoch-fenced CAS commits\n  // the pointer, or a \"successful\" swap strands every following op on a backend no\n  // turn can resume. `swapTargetEstablishability` is the SAME predicate the turn\n  // resolver consults, so admission and establishment never disagree. Any sandbox\n  // reaching here is NOT the session's own group box (handled above), so a Modal\n  // sibling is rejected pre-commit rather than admitted-then-stranded.\n  const establishable = swapTargetEstablishability({\n    kind: sandbox.kind,\n    isSessionGroup: false,\n  });\n  if (!establishable.ok) {\n    return { ok: false, reason: establishable.reason, code: establishable.code };\n  }\n  if (sandbox.kind === \"selfhosted\") {\n    if (!sandbox.enrollmentId) {\n      return {\n        ok: false,\n        reason: `selfhosted sandbox ${target} has no enrollment`,\n        code: \"offline_enrollment\",\n      };\n    }\n    const enrollment = await getEnrollment(services.db, ctx.workspaceId, sandbox.enrollmentId);\n    if (!enrollment) {\n      return {\n        ok: false,\n        reason: `enrollment for sandbox ${target} not found`,\n        code: \"offline_enrollment\",\n      };\n    }\n    const probe = await probeEnrollment(services, ctx.workspaceId, enrollment);\n    if (probe.liveness !== \"online\") {\n      return {\n        ok: false,\n        reason: `sandbox ${target} is ${probe.liveness}; cannot attach to a non-online machine`,\n        code: \"offline_enrollment\",\n      };\n    }\n  }\n  return { ok: true, targetSandboxId: sandbox.id };\n}\n\n/**\n * THE SWAP (and attach — identical mechanic). Validate the target's ownership +\n * liveness, then repoint the session via the epoch-fenced CAS `setActiveSandbox`:\n * read the current epoch, then CAS on it. A concurrent double-swap lets exactly\n * one win; the loser re-reads + may retry. The bumped epoch fences any in-flight\n * op cached against the old pointer, which then retries against the new active\n * sandbox (the routing proxy's fenced-retry role).\n */\nexport async function swapActiveSandbox(\n  services: FleetServices,\n  ctx: FleetContext,\n  target: string,\n  // The session's working directory to seed alongside the pointer (create-time\n  // machine targeting). OMITTED ⇒ the column is left unchanged (a live swap/attach\n  // never touches it); threaded straight into the epoch-fenced setActiveSandbox CAS.\n  workingDir?: string | null,\n): Promise<FleetSwapResult> {\n  const resolved = await resolveTarget(services, ctx, target);\n  if (!resolved.ok) {\n    const pointer = (await readActiveSandbox(services.db, ctx.workspaceId, ctx.sessionId)) ?? {\n      activeSandboxId: null,\n      activeEpoch: 0,\n    };\n    // Fail BEFORE the CAS: the pointer + epoch are read back unchanged and echoed,\n    // so an unestablishable target never mutates the session's routing state.\n    return {\n      swapped: false,\n      activeSandboxId: pointer.activeSandboxId,\n      activeEpoch: pointer.activeEpoch,\n      reason: resolved.reason,\n      code: resolved.code,\n    };\n  }\n\n  let readinessHold: FleetReadinessHold | undefined;\n  if (resolved.targetSandboxId === null && services.ensureSessionGroupReady) {\n    try {\n      readinessHold = await services.ensureSessionGroupReady(ctx);\n    } catch (error) {\n      const lease = await readLease(services.db, ctx.workspaceId, ctx.sessionGroupId);\n      const restore = lease?.recovery.restore.status;\n      const code =\n        restore === \"degraded\"\n          ? (\"recovery_degraded\" as const)\n          : restore === \"unrecoverable\"\n            ? (\"recovery_unrecoverable\" as const)\n            : (\"recovery_in_progress\" as const);\n      const pointer = (await readActiveSandbox(services.db, ctx.workspaceId, ctx.sessionId)) ?? {\n        activeSandboxId: null,\n        activeEpoch: 0,\n      };\n      return {\n        swapped: false,\n        activeSandboxId: pointer.activeSandboxId,\n        activeEpoch: pointer.activeEpoch,\n        reason:\n          error instanceof Error\n            ? error.message\n            : \"session sandbox did not reach verified readiness\",\n        code,\n      };\n    }\n  }\n\n  try {\n    // Read the current epoch, then CAS on it (the fence). One retry on a lost race\n    // (a concurrent swap bumped the epoch between read and write).\n    for (let attempt = 0; attempt < 2; attempt += 1) {\n      const pointer = (await readActiveSandbox(services.db, ctx.workspaceId, ctx.sessionId)) ?? {\n        activeSandboxId: null,\n        activeEpoch: 0,\n      };\n      // Even a same-target attach advances active_epoch. It is a repair/fence\n      // request, not a no-op acknowledgment: any cached stale route is invalidated\n      // only after target readiness has been proved above.\n      const result = await setActiveSandbox(services.db, {\n        accountId: ctx.accountId,\n        workspaceId: ctx.workspaceId,\n        sessionId: ctx.sessionId,\n        targetSandboxId: resolved.targetSandboxId,\n        expectedEpoch: pointer.activeEpoch,\n        ...(workingDir !== undefined ? { workingDir } : {}),\n      });\n      if (result.swapped && result.pointer) {\n        return {\n          swapped: true,\n          activeSandboxId: result.pointer.activeSandboxId,\n          activeEpoch: result.pointer.activeEpoch,\n        };\n      }\n      // CAS lost (a concurrent swap won) — re-read + retry once.\n    }\n    const pointer = (await readActiveSandbox(services.db, ctx.workspaceId, ctx.sessionId)) ?? {\n      activeSandboxId: null,\n      activeEpoch: 0,\n    };\n    return {\n      swapped: false,\n      activeSandboxId: pointer.activeSandboxId,\n      activeEpoch: pointer.activeEpoch,\n      reason: \"a concurrent swap won the epoch fence; re-read and retry\",\n      code: \"concurrent_swap\",\n    };\n  } finally {\n    // Do not let a cleanup failure turn an already-committed route CAS into a\n    // false failure. Viewer holders are TTL-bounded and will be reaped if this\n    // best-effort explicit release cannot complete.\n    await readinessHold?.release().catch(() => undefined);\n  }\n}\n\nexport type RunOnOp =\n  | { kind: \"exec\"; cmd: string; workdir?: string }\n  | { kind: \"read\"; path: string }\n  | { kind: \"write\"; path: string; content: string };\n\nexport type RunOnResult = {\n  target: string;\n  kind: string;\n  ok: boolean;\n  /** Display name of the target sandbox when known (from the sandboxes row). */\n  targetName?: string;\n  stdout?: string;\n  stderr?: string;\n  exitCode?: number | null;\n  /** Exec only: whether the machine killed the child at its process deadline. */\n  timedOut?: boolean;\n  /** Exec only: the effective clamped process deadline enforced by the machine. */\n  deadlineMs?: number;\n  content?: string;\n  bytesWritten?: number;\n  reason?: string;\n};\n\nexport type RunOnSelfhostedMachine = {\n  workspaceId: string;\n  agentId: string;\n  controlRpc: ControlRpc;\n  relay: SelfhostedRelayConfig;\n  /** Short request/reply deadline for read/write and other control operations. */\n  controlTimeoutMs: number;\n  /** Longer agent-side process deadline for exec. */\n  execTimeoutMs: number;\n  /** Streaming transport required when execTimeoutMs is 0 (unbounded). */\n  opStream?: SelfhostedOpStreamDeps;\n};\n\n/**\n * Execute the one-off machine operation once the workspace/enrollment lookup has\n * succeeded. Kept separate from {@link runOnSandbox} so the command/deadline\n * contract is deterministic against an in-memory ControlRpc without weakening\n * the production ownership lookup or requiring a real machine.\n */\nexport async function executeRunOnSelfhostedMachine(\n  machine: RunOnSelfhostedMachine,\n  target: string,\n  op: RunOnOp,\n): Promise<RunOnResult> {\n  const session = new SelfhostedSession({\n    workspaceId: machine.workspaceId,\n    agentId: machine.agentId,\n    controlRpc: machine.controlRpc,\n    relay: machine.relay,\n    timeoutMs: machine.controlTimeoutMs,\n    execTimeoutMs: machine.execTimeoutMs,\n    ...(machine.opStream !== undefined ? { opStream: machine.opStream } : {}),\n  });\n\n  try {\n    if (op.kind === \"exec\") {\n      const deadlineMs = session.effectiveExecDeadlineMs;\n      const res = await session.exec({\n        cmd: op.cmd,\n        ...(op.workdir ? { workdir: op.workdir } : {}),\n      });\n      const timedOut = res.timedOut === true;\n      const hasTerminalExit = res.exitCode !== null;\n      return {\n        target,\n        kind: \"exec\",\n        // `ok` means the one-off operation reached a terminal response. Preserve\n        // the established non-zero-exit behavior, but never claim success when\n        // the machine killed the child or returned no terminal exit proof.\n        ok: !timedOut && hasTerminalExit,\n        stdout: res.stdout,\n        stderr: res.stderr,\n        exitCode: res.exitCode,\n        timedOut,\n        deadlineMs,\n        ...(timedOut\n          ? { reason: `command exceeded the ${deadlineMs} ms execution deadline` }\n          : !hasTerminalExit\n            ? { reason: \"machine returned no terminal exit code\" }\n            : {}),\n      };\n    }\n    if (op.kind === \"read\") {\n      const bytes = await session.readFile({ path: op.path });\n      return { target, kind: \"read\", ok: true, content: new TextDecoder().decode(bytes) };\n    }\n    const bytesWritten = await session.writeFile({ path: op.path, content: op.content });\n    return { target, kind: \"write\", ok: true, bytesWritten };\n  } catch (error) {\n    const reason = error instanceof Error ? error.message : String(error);\n    return {\n      target,\n      kind: op.kind,\n      ok: false,\n      reason,\n      // A transport failure is not evidence that the process itself timed out,\n      // so leave `timedOut` absent while still reporting the enforced deadline.\n      ...(op.kind === \"exec\" ? { deadlineMs: session.effectiveExecDeadlineMs } : {}),\n    };\n  } finally {\n    // This one-off has no turn journal. Once its result has been accepted by\n    // this call, final-ack any settled stream so the runner can immediately\n    // release replay/output retention instead of waiting for TTL cleanup.\n    await session.finalizeOpStreamOps().catch(() => undefined);\n  }\n}\n\n/**\n * Run a ONE-OFF op against a SPECIFIC target WITHOUT changing the active pointer\n * (the design `run_on`). Only selfhosted targets are routable as a one-off here\n * (a Modal target is the session's group box, reached via the normal Channel-A /\n * turn path — `run_on` is for reaching a NON-active enrolled machine without\n * swapping). The op is fenced under the target's enrollment, addressed to its\n * agent subject; an offline machine surfaces a clear reason, never a wrong-box\n * landing.\n */\nexport async function runOnSandbox(\n  services: FleetServices,\n  ctx: FleetContext,\n  target: string,\n  op: RunOnOp,\n): Promise<RunOnResult> {\n  const sandbox = await getSandbox(services.db, ctx.workspaceId, target);\n  if (!sandbox) {\n    return {\n      target,\n      kind: op.kind,\n      ok: false,\n      reason: `sandbox ${target} not found in this workspace`,\n    };\n  }\n  if (sandbox.kind !== \"selfhosted\" || !sandbox.enrollmentId) {\n    return {\n      target,\n      targetName: sandbox.name,\n      kind: op.kind,\n      ok: false,\n      reason: `run_on routes one-off ops to enrolled selfhosted machines; ${sandbox.kind} targets are reached via the active sandbox (swap to it first)`,\n    };\n  }\n  const enrollment = await getEnrollment(services.db, ctx.workspaceId, sandbox.enrollmentId);\n  if (!enrollment || enrollment.status !== \"active\") {\n    return {\n      target,\n      targetName: sandbox.name,\n      kind: op.kind,\n      ok: false,\n      reason: `sandbox ${target} is not enrolled/active`,\n    };\n  }\n\n  const result = await executeRunOnSelfhostedMachine(\n    {\n      workspaceId: ctx.workspaceId,\n      agentId: sandbox.enrollmentId,\n      controlRpc: controlRpc(services.bus),\n      relay: relayConfigFromSettings(services.settings),\n      controlTimeoutMs: services.settings.sandboxSelfhostedControlTimeoutMs,\n      execTimeoutMs: services.settings.sandboxSelfhostedExecTimeoutMs,\n      ...(services.settings.agentOpStreamEnabled === true &&\n      enrollment.opStream === true &&\n      services.bus?.getOpStreamConnection\n        ? {\n            opStream: {\n              transport: new NatsOpStreamTransport(\n                async () => services.bus?.getOpStreamConnection?.() ?? null,\n              ),\n            },\n          }\n        : {}),\n    },\n    target,\n    op,\n  );\n  return { ...result, targetName: sandbox.name };\n}\n\nexport type ProvisionResult =\n  | {\n      kind: \"selfhosted\";\n      instructions: string;\n      installCommandUnix: string;\n      installCommandWindows: string;\n      verificationUri: string;\n      note: string;\n    }\n  | { kind: \"modal\"; sandbox: SandboxRecord; note: string };\n\n/**\n * Provision a new fleet member.\n *   - selfhosted → return the device-flow enrollment instructions (the agent\n *     surfaces them to a HUMAN, who installs the agent + enrolls — the agent\n *     cannot click the loud whole-machine consent itself).\n *   - modal → create a first-class named modal `sandboxes` record (a swap target).\n *     NOTE: the Modal BOX is materialized lazily when first swapped-to (Modal\n * lifecycle is owned by the lease — unchanged per).\n */\nexport async function provisionSandbox(\n  services: FleetServices,\n  ctx: FleetContext,\n  input: { kind: \"selfhosted\" | \"modal\"; name?: string },\n): Promise<ProvisionResult> {\n  if (input.kind === \"selfhosted\") {\n    const base = (services.settings.publicBaseUrl ?? \"https://get.opengeni.ai\").replace(/\\/+$/, \"\");\n    return {\n      kind: \"selfhosted\",\n      instructions:\n        \"Share these instructions with a human operator. They install the OpenGeni agent on the machine, run `opengeni-agent connect`, complete the device-flow at the verification URL (the loud whole-machine + screen-control consent), and the machine then appears here as an attachable selfhosted sandbox. Existing connections to other OpenGeni workspaces or deployments are preserved.\",\n      // Install from THIS control plane's origin (not a hardcoded public CDN): the\n      // served install script is rewritten to pull the per-SHA agent baked into\n      // this exact deployment (see apps/api/src/routes/install.ts), so a deployed\n      // env is self-contained and a private/air-gapped one works with no public DNS.\n      installCommandUnix: `curl -fsSL ${base}/install.sh | sh`,\n      installCommandWindows: `irm ${base}/install.ps1 | iex`,\n      verificationUri: `${base}/device`,\n      note: \"Whole-machine access requires explicit human consent in the device-flow web page; the agent cannot self-consent.\",\n    };\n  }\n  // modal: create a first-class named modal sandbox record. NOTE: a session cannot\n  // yet be swapped onto a second Modal box — cross-group Modal routing is not built,\n  // so `sandbox_swap` to this id is rejected (unsupported_backend_context). The\n  // response says so plainly rather than implying an attach that does not work.\n  const { createSandbox } = await import(\"@opengeni/db\");\n  const sandbox = await createSandbox(services.db, {\n    accountId: ctx.accountId,\n    workspaceId: ctx.workspaceId,\n    kind: \"modal\",\n    name: input.name?.trim() || \"modal-box\",\n  });\n  return {\n    kind: \"modal\",\n    sandbox,\n    note: \"A named Modal sandbox record was created, but it is NOT yet attachable as a swap target: routing a session onto a second Modal box is not supported yet, so a sandbox_swap to this id is rejected. Use the session's own box (the default) or attach a Connected Machine instead.\",\n  };\n}\n","// apps/api/src/sandbox/channel-a.ts — wire the agent-loop-free routing proxy to the\n// real DB pointer + the live NATS control plane for the API-DIRECT Channel-A path\n// (M7). Symmetric with apps/worker/src/sandbox-routing.ts (the turn path).\n//\n// A Channel-A op runs against one established home: either a lease-owned provider\n// box or a Connected Machine home that intentionally has no cloud lease. With\n// hot-swap, the op must land on the session's CURRENTLY-active sandbox. The\n// established session is wrapped in a `RoutingSandboxSession` that re-reads\n// (active_sandbox_id, active_epoch) and dispatches to the active backend.\n//\n// The DB-coupled glue (readActiveSandbox / getSandbox / the selfhosted ControlRpc\n// over the events bus) lives here, not in the leaf (which stays db-free).\n\nimport { sandboxLifecycleTransitionWaitMs, type Settings } from \"@opengeni/config\";\nimport {\n  advanceWorkspaceGenerationForDirectRequest,\n  advanceWorkspaceGenerationForRetainedProcess,\n  getEnrollment,\n  getRetainedProcess,\n  getSandbox,\n  markWarmLeaseInstanceLost,\n  readActiveSandbox,\n  retainWorkspaceMutationProcess,\n  retainedProcessSettlementIdentity,\n  settleRetainedProcess,\n  verifyDirectWorkspaceMutationSettlement,\n  verifyRetainedProcessMutationSettlement,\n  type Database,\n  type SandboxWorkspaceMutationAdmission,\n} from \"@opengeni/db\";\nimport { appendAndPublishEvents, type EventBus } from \"@opengeni/events\";\nimport {\n  isProviderSandboxGoneDuringRoutedOperation,\n  makeActiveBackendResolver,\n  NatsControlRpc,\n  NatsOpStreamTransport,\n  RoutingSandboxSession,\n  resolveModalCheckpointProviderBindingForSession,\n  type ControlRpc,\n  type EstablishedSandboxSession,\n  type NatsRequestConnection,\n  type ResolvedActiveBackend,\n  type RoutableBackendSession,\n  type RoutableSandbox,\n  type RoutingRetainedProcess,\n  type RoutingRetainedProcessTerminalProof,\n  type RoutingSandboxOperationObserver,\n  type SelfhostedRelayConfig,\n  type SelfhostedOpStreamDeps,\n} from \"@opengeni/runtime/sandbox\";\n\ntype PersistableMutationAdmission = {\n  admission: SandboxWorkspaceMutationAdmission;\n  providerBinding: Awaited<\n    ReturnType<typeof resolveModalCheckpointProviderBindingForSession>\n  > | null;\n};\n\nexport type ChannelARoutingServices = {\n  db: Database;\n  settings: Settings;\n  bus?: EventBus;\n  onSandboxOperation?: RoutingSandboxOperationObserver;\n  waitSignal?: AbortSignal;\n};\n\n/** Map the deployment relay URL to the leaf's `SelfhostedRelayConfig` shape. The\n *  relay URL (`OPENGENI_SELFHOSTED_RELAY_URL`) may carry a path (the relay's wss\n *  route); a path-less URL defaults to the relay's `/stream` route (M8b). */\nexport function relayConfigFromSettings(settings: Settings): SelfhostedRelayConfig {\n  const raw = settings.selfhostedRelayUrl?.trim();\n  if (!raw) {\n    return {\n      host: \"relay.opengeni.local\",\n      port: 443,\n      tls: true,\n      path: \"/stream\",\n    };\n  }\n  try {\n    const url = new URL(raw.includes(\"://\") ? raw : `wss://${raw}`);\n    const tls = url.protocol === \"wss:\" || url.protocol === \"https:\";\n    const port = url.port ? Number(url.port) : tls ? 443 : 80;\n    // Honor an explicit path in the configured URL; default the relay's /stream.\n    const path = url.pathname && url.pathname !== \"/\" ? url.pathname : \"/stream\";\n    return { host: url.hostname, port, tls, path };\n  } catch {\n    return { host: raw, port: 443, tls: true, path: \"/stream\" };\n  }\n}\n\n/** The canonical relay dial-BASE URL (`scheme://host[:port]/stream`) handed to the\n *  agent PRODUCER. The agent's relay channel appends ONLY its routing query to\n *  this base (`channel.rs`: `format!(\"{relay_url}{sep}{query}\")`) and relies on the\n *  base ALREADY carrying the relay's `/stream` route. `OPENGENI_SELFHOSTED_RELAY_URL`\n *  is frequently pathless (e.g. `wss://relay.<env>.app.opengeni.ai`), which made the\n *  producer dial a path-less URL the relay 400s. Derive the base from the SAME parser\n *  the CONSUMER uses (`relayConfigFromSettings`) so producer + consumer always agree\n *  on `/stream` — even when the configured URL omits it. An unconfigured relay maps to\n *  `\"\"` (graceful degrade: the agent reports no-relay rather than dialing a synthetic\n * host). Fixes preview AND managed prod with no agent rebuild. */\nexport function relayDialBaseFromSettings(settings: Settings): string {\n  if (!settings.selfhostedRelayUrl?.trim()) return \"\";\n  const { host, port, tls, path } = relayConfigFromSettings(settings);\n  const scheme = tls ? \"wss\" : \"ws\";\n  const defaultPort = tls ? 443 : 80;\n  const authority = port === defaultPort ? host : `${host}:${port}`;\n  return `${scheme}://${authority}${path}`;\n}\n\nfunction controlRpcFactory(bus: EventBus | undefined): () => ControlRpc {\n  return () =>\n    new NatsControlRpc(async (): Promise<NatsRequestConnection | null> => {\n      if (!bus) {\n        return null;\n      }\n      return bus.getRequestConnection();\n    });\n}\n\nasync function resolveSelfhostedOpStream(\n  services: ChannelARoutingServices,\n  workspaceId: string,\n  sandbox: RoutableSandbox,\n): Promise<SelfhostedOpStreamDeps | undefined> {\n  if (\n    services.settings.agentOpStreamEnabled !== true ||\n    !services.bus?.getOpStreamConnection ||\n    !sandbox.enrollmentId\n  ) {\n    return undefined;\n  }\n  const enrollment = await getEnrollment(services.db, workspaceId, sandbox.enrollmentId);\n  if (enrollment?.opStream !== true) return undefined;\n  return {\n    transport: new NatsOpStreamTransport(\n      async () => services.bus?.getOpStreamConnection?.() ?? null,\n    ),\n  };\n}\n\n/** Whether the routing proxy should wrap the Channel-A box: gated by the\n *  selfhosted flag (the active pointer + swap are only meaningful then). */\nexport function routingEnabled(settings: Settings): boolean {\n  return settings.sandboxSelfhostedEnabled === true;\n}\n\n/**\n * Wrap an established home session in a `RoutingSandboxSession` so a Channel-A\n * op routes to the session's currently-active sandbox. Provider homes supply a\n * lease; machine homes supply a pinned selfhosted identity and no lease. Returns\n * the established handle with its `session` replaced by the stable proxy.\n */\nexport function wrapChannelABoxWithRouting(\n  services: ChannelARoutingServices,\n  ids: {\n    accountId: string;\n    workspaceId: string;\n    sessionId: string;\n    homeLease?: {\n      sandboxGroupId: string;\n      leaseEpoch: number;\n      instanceId: string;\n      backend: string;\n    };\n    /** A machine-home Channel-A request has no cloud/home lease. Its already\n     * established SelfhostedSession is pinned to the durable active pointer so\n     * the first command uses the exact machine instance and epoch. */\n    pinnedSelfhosted?: {\n      sandboxId: string;\n      epoch: number;\n    };\n    directRequest: {\n      requestId: string;\n      holderId: string;\n    };\n  },\n  established: EstablishedSandboxSession,\n): EstablishedSandboxSession {\n  const { db, settings, bus } = services;\n  const homeLease = ids.homeLease;\n  const beforeMutation = homeLease\n    ? async ({\n        op,\n        backend,\n      }: {\n        op: string;\n        backend: ResolvedActiveBackend;\n      }): Promise<PersistableMutationAdmission | null> => {\n        // Connected Machines and other non-persistable targets intentionally do\n        // not dirty or advance the cloud-home archive generation.\n        if (\n          backend.sandboxId !== null ||\n          backend.leaseEpoch === undefined ||\n          backend.providerInstanceId === undefined\n        ) {\n          return null;\n        }\n        if (backend.activeEpoch === undefined) {\n          throw new Error(\"API-direct workspace mutation resolved without an active route epoch\");\n        }\n        const providerBinding =\n          homeLease.backend === \"modal\"\n            ? await resolveModalCheckpointProviderBindingForSession(settings, backend.session)\n            : null;\n        const admission = await advanceWorkspaceGenerationForDirectRequest(db, {\n          accountId: ids.accountId,\n          workspaceId: ids.workspaceId,\n          sessionId: ids.sessionId,\n          requestId: ids.directRequest.requestId,\n          holderId: ids.directRequest.holderId,\n          sandboxGroupId: homeLease.sandboxGroupId,\n          expectedEpoch: backend.leaseEpoch,\n          expectedInstanceId: backend.providerInstanceId,\n          routeTargetId: backend.sandboxId,\n          routeEpoch: backend.activeEpoch,\n          operation: op,\n          captureWaitMs: sandboxLifecycleTransitionWaitMs(settings),\n          ...(services.waitSignal ? { waitSignal: services.waitSignal } : {}),\n        });\n        return { admission, providerBinding };\n      }\n    : undefined;\n  const afterMutation = homeLease\n    ? async ({\n        op,\n        backend,\n        admission,\n        outcome,\n        retainedProcess,\n      }: {\n        op: string;\n        backend: ResolvedActiveBackend;\n        admission: unknown;\n        outcome: \"resolved\" | \"rejected\";\n        result?: unknown;\n        retainedProcess?: RoutingRetainedProcess;\n      }): Promise<void> => {\n        if (admission === null) return;\n        if (\n          !admission ||\n          typeof admission !== \"object\" ||\n          backend.leaseEpoch === undefined ||\n          backend.providerInstanceId === undefined ||\n          backend.activeEpoch === undefined\n        ) {\n          throw new Error(\"API-direct workspace mutation settlement lacked its exact admission\");\n        }\n        const boundAdmission = admission as Partial<PersistableMutationAdmission>;\n        const exactAdmission = boundAdmission.admission;\n        if (\n          !exactAdmission ||\n          typeof exactAdmission.id !== \"string\" ||\n          typeof exactAdmission.workspaceGeneration !== \"number\" ||\n          !(\"providerBinding\" in boundAdmission)\n        ) {\n          throw new Error(\"API-direct workspace mutation settlement lacked its bound admission\");\n        }\n        if (outcome === \"resolved\" && retainedProcess) {\n          await retainWorkspaceMutationProcess(db, {\n            accountId: ids.accountId,\n            workspaceId: ids.workspaceId,\n            sessionId: ids.sessionId,\n            processId: retainedProcess.id,\n            providerSessionId: retainedProcess.providerSessionId,\n            admissionId: exactAdmission.id,\n            admittedWorkspaceGeneration: exactAdmission.workspaceGeneration,\n            operation: op,\n            providerBinding: boundAdmission.providerBinding ?? null,\n            owner: {\n              kind: \"direct\",\n              requestId: ids.directRequest.requestId,\n              holderId: ids.directRequest.holderId,\n              sandboxGroupId: homeLease.sandboxGroupId,\n              expectedEpoch: backend.leaseEpoch,\n              expectedInstanceId: backend.providerInstanceId,\n              routeTargetId: exactAdmission.routeTargetId,\n              routeEpoch: exactAdmission.routeEpoch,\n            },\n          });\n          return;\n        }\n        await verifyDirectWorkspaceMutationSettlement(db, {\n          accountId: ids.accountId,\n          workspaceId: ids.workspaceId,\n          sessionId: ids.sessionId,\n          requestId: ids.directRequest.requestId,\n          holderId: ids.directRequest.holderId,\n          sandboxGroupId: homeLease.sandboxGroupId,\n          expectedEpoch: backend.leaseEpoch,\n          expectedInstanceId: backend.providerInstanceId,\n          routeTargetId: exactAdmission.routeTargetId,\n          routeEpoch: exactAdmission.routeEpoch,\n          admission: exactAdmission,\n          operation: op,\n          outcome,\n        });\n      }\n    : undefined;\n  const beforeProcessMutation = homeLease\n    ? async ({\n        op,\n        process,\n      }: {\n        op: string;\n        backend: ResolvedActiveBackend;\n        process: RoutingRetainedProcess;\n      }): Promise<SandboxWorkspaceMutationAdmission> =>\n        await advanceWorkspaceGenerationForRetainedProcess(db, {\n          accountId: ids.accountId,\n          workspaceId: ids.workspaceId,\n          sessionId: ids.sessionId,\n          processId: process.id,\n          operation: op,\n          captureWaitMs: sandboxLifecycleTransitionWaitMs(settings),\n          ...(services.waitSignal ? { waitSignal: services.waitSignal } : {}),\n        })\n    : undefined;\n  const afterProcessMutation = homeLease\n    ? async ({\n        op,\n        process,\n        admission,\n        outcome,\n      }: {\n        op: string;\n        backend: ResolvedActiveBackend;\n        process: RoutingRetainedProcess;\n        admission: unknown;\n        outcome: \"resolved\" | \"rejected\";\n        result?: unknown;\n      }): Promise<void> => {\n        if (\n          !admission ||\n          typeof admission !== \"object\" ||\n          typeof (admission as Partial<SandboxWorkspaceMutationAdmission>).id !== \"string\" ||\n          typeof (admission as Partial<SandboxWorkspaceMutationAdmission>).workspaceGeneration !==\n            \"number\"\n        ) {\n          throw new Error(\"API retained-process mutation settlement lacked its exact admission\");\n        }\n        await verifyRetainedProcessMutationSettlement(db, {\n          accountId: ids.accountId,\n          workspaceId: ids.workspaceId,\n          sessionId: ids.sessionId,\n          processId: process.id,\n          admission: admission as SandboxWorkspaceMutationAdmission,\n          operation: op,\n          outcome,\n        });\n      }\n    : undefined;\n  const settleProcess = homeLease\n    ? async ({\n        backend,\n        process,\n        proof,\n      }: {\n        backend: ResolvedActiveBackend;\n        process: RoutingRetainedProcess;\n        proof: RoutingRetainedProcessTerminalProof;\n      }): Promise<void> => {\n        if (\n          backend.sandboxId !== null ||\n          backend.leaseEpoch === undefined ||\n          backend.providerInstanceId === undefined ||\n          backend.activeEpoch === undefined\n        ) {\n          return;\n        }\n        const durable = await getRetainedProcess(db, {\n          workspaceId: ids.workspaceId,\n          sessionId: ids.sessionId,\n          processId: process.id,\n        });\n        if (\n          !durable ||\n          durable.providerSessionId !== process.providerSessionId ||\n          durable.providerBackend !== backend.kind ||\n          durable.providerInstanceId !== backend.providerInstanceId ||\n          durable.leaseEpoch !== backend.leaseEpoch ||\n          durable.routeKind !== (backend.sandboxId === null ? \"home\" : \"active\") ||\n          durable.routeTargetId !== backend.sandboxId ||\n          durable.routeEpoch !== backend.activeEpoch\n        ) {\n          throw new Error(\n            \"API retained-process settlement lost its exact durable backend identity\",\n          );\n        }\n        await settleRetainedProcess(db, {\n          accountId: ids.accountId,\n          workspaceId: ids.workspaceId,\n          sessionId: ids.sessionId,\n          processId: process.id,\n          expected: retainedProcessSettlementIdentity(durable),\n          outcome: proof.outcome,\n          exitCode: proof.exitCode,\n          reason: proof.reason,\n          idleGraceMs: settings.sandboxIdleGraceMs,\n        });\n      }\n    : undefined;\n  const resolver = makeActiveBackendResolver({\n    workspaceId: ids.workspaceId,\n    defaultBackend: established.session as RoutableBackendSession,\n    defaultKind: established.backendId,\n    getSandbox: async (sandboxId): Promise<RoutableSandbox | null> => {\n      const sandbox = await getSandbox(db, ids.workspaceId, sandboxId);\n      return sandbox\n        ? {\n            id: sandbox.id,\n            kind: sandbox.kind,\n            name: sandbox.name,\n            enrollmentId: sandbox.enrollmentId,\n          }\n        : null;\n    },\n    controlRpcFactory: controlRpcFactory(bus),\n    resolveSelfhostedOpStream: (sandbox) =>\n      resolveSelfhostedOpStream(services, ids.workspaceId, sandbox),\n    relay: relayConfigFromSettings(settings),\n    selfhostedTimeoutMs: settings.sandboxSelfhostedControlTimeoutMs,\n    selfhostedExecTimeoutMs: settings.sandboxSelfhostedExecTimeoutMs,\n    ...(ids.pinnedSelfhosted\n      ? {\n          pinnedSelfhosted: {\n            sandboxId: ids.pinnedSelfhosted.sandboxId,\n            epoch: ids.pinnedSelfhosted.epoch,\n            session: established.session as RoutableBackendSession,\n          },\n        }\n      : {}),\n    ...(homeLease\n      ? {\n          resolveDefaultBackend: async () => ({\n            session: established.session as RoutableBackendSession,\n            sandboxId: null,\n            kind: established.backendId,\n            leaseEpoch: homeLease.leaseEpoch,\n            providerInstanceId: homeLease.instanceId,\n          }),\n        }\n      : {}),\n  });\n\n  const proxy = new RoutingSandboxSession({\n    defaultResolved: {\n      session: established.session as RoutableBackendSession,\n      sandboxId: null,\n      kind: established.backendId,\n      ...(homeLease\n        ? {\n            leaseEpoch: homeLease.leaseEpoch,\n            providerInstanceId: homeLease.instanceId,\n          }\n        : {}),\n    },\n    readPointer: async () => {\n      if (!routingEnabled(settings)) {\n        return { activeSandboxId: null, activeEpoch: 0 };\n      }\n      const pointer = await readActiveSandbox(db, ids.workspaceId, ids.sessionId);\n      return pointer ?? { activeSandboxId: null, activeEpoch: 0 };\n    },\n    resolveActiveBackend: resolver,\n    ...(services.onSandboxOperation ? { onOperation: services.onSandboxOperation } : {}),\n    ...(beforeMutation ? { beforeMutation } : {}),\n    ...(afterMutation ? { afterMutation } : {}),\n    ...(beforeProcessMutation ? { beforeProcessMutation } : {}),\n    ...(afterProcessMutation ? { afterProcessMutation } : {}),\n    ...(settleProcess ? { settleProcess } : {}),\n    ...(homeLease\n      ? {\n          onDefaultBackendError: async ({ error }: { error: unknown }) => {\n            if (!isProviderSandboxGoneDuringRoutedOperation(homeLease.backend, error)) return null;\n            const marked = await markWarmLeaseInstanceLost(db, {\n              accountId: ids.accountId,\n              workspaceId: ids.workspaceId,\n              sandboxGroupId: homeLease.sandboxGroupId,\n              expectedEpoch: homeLease.leaseEpoch,\n              expectedInstanceId: homeLease.instanceId,\n              diagnostic: \"provider_not_found_during_routed_operation\",\n            });\n            if (marked.status === \"marked\" && bus) {\n              await appendAndPublishEvents(db, bus, ids.workspaceId, ids.sessionId, [\n                {\n                  type: \"sandbox.box.lost\",\n                  payload: { sandboxId: homeLease.instanceId },\n                },\n              ]).catch(() => undefined);\n            }\n            const lease = marked.lease;\n            const restore = lease?.recovery.restore.status;\n            return {\n              leaseEpoch: lease?.leaseEpoch ?? homeLease.leaseEpoch,\n              recovery:\n                marked.status === \"stale\"\n                  ? (\"superseded\" as const)\n                  : restore === \"pending\"\n                    ? (\"pending\" as const)\n                    : restore === \"degraded\"\n                      ? (\"degraded\" as const)\n                      : (\"unrecoverable\" as const),\n            };\n          },\n        }\n      : {}),\n  });\n\n  return { ...established, session: proxy };\n}\n","import { resolveFirstPartyDelegationSecret, type Settings } from \"@opengeni/config\";\nimport {\n  verifyDelegatedAccessToken,\n  type AccountGrant,\n  type AccessContext,\n  type AccessGrant,\n  type Permission,\n} from \"@opengeni/contracts\";\nimport {\n  bootstrapWorkspace,\n  ensureManagedAccessForUser,\n  findActiveApiKeyByHash,\n  getWorkspaceGrant,\n  requireWorkspace,\n  type Database,\n} from \"@opengeni/db\";\nimport type { Context } from \"hono\";\nimport { HTTPException } from \"hono/http-exception\";\nimport type { ManagedAuth } from \"../managed-auth-type\";\nimport { getManagedSession } from \"../managed-session\";\n\nconst bearerPrefix = \"Bearer \";\nconst accessContextByRequest = new WeakMap<Request, Promise<AccessContext | null>>();\n\nexport type AccessDeps = {\n  db: Database;\n  settings: Settings;\n  managedAuth?: ManagedAuth | null;\n};\n\nexport async function requireAccessContext(c: Context, deps: AccessDeps): Promise<AccessContext> {\n  let pending = accessContextByRequest.get(c.req.raw);\n  if (!pending) {\n    pending = resolveAccessContext(c, deps);\n    accessContextByRequest.set(c.req.raw, pending);\n  }\n  const context = await pending;\n  if (!context) {\n    throw new HTTPException(401, { message: \"authentication required\" });\n  }\n  return context;\n}\n\nexport async function requireAccessGrant(\n  c: Context,\n  deps: AccessDeps,\n  workspaceId: string,\n  permission?: Permission,\n): Promise<AccessGrant> {\n  return (await requireAccessGrantAuthorization(c, deps, workspaceId, permission)).grant;\n}\n\nexport type AccessGrantAuthorization = {\n  grant: AccessGrant;\n  accountGrant: AccountGrant | null;\n  authenticatedSubjectId: string;\n  contextIntegrity: boolean;\n};\n\nexport function accessGrantAuthorizationFromContext(\n  context: AccessContext,\n  grant: AccessGrant,\n): AccessGrantAuthorization {\n  const matchingAccountGrants = context.accountGrants.filter(\n    (candidate) => candidate.accountId === grant.accountId,\n  );\n  const delegated = grant.metadata?.delegated === true;\n  const contextIntegrity =\n    context.subjectId === grant.subjectId &&\n    context.accountGrants.every((candidate) => candidate.subjectId === context.subjectId) &&\n    context.workspaceGrants.every(\n      (candidate) =>\n        candidate.subjectId === context.subjectId &&\n        candidate.principalKind === grant.principalKind &&\n        (candidate.metadata?.delegated === true) === delegated &&\n        Boolean(candidate.serviceInitiator) === Boolean(grant.serviceInitiator) &&\n        Boolean(candidate.serviceInitiatorContext) === Boolean(grant.serviceInitiatorContext) &&\n        context.accountGrants.filter(\n          (accountGrant) => accountGrant.accountId === candidate.accountId,\n        ).length === 1,\n    ) &&\n    matchingAccountGrants.length === 1 &&\n    matchingAccountGrants[0]?.subjectId === context.subjectId;\n  return {\n    grant,\n    accountGrant: contextIntegrity ? matchingAccountGrants[0]! : null,\n    authenticatedSubjectId: context.subjectId,\n    contextIntegrity,\n  };\n}\n\nexport async function requireAccessGrantAuthorization(\n  c: Context,\n  deps: AccessDeps,\n  workspaceId: string,\n  permission?: Permission,\n): Promise<AccessGrantAuthorization> {\n  const context = await requireAccessContext(c, deps);\n  const principalKind = hostedHumanSessionPrincipalKind(context);\n  const grant =\n    context.workspaceGrants.find((candidate) => candidate.workspaceId === workspaceId) ??\n    (await getWorkspaceGrant(\n      deps.db,\n      context.subjectId,\n      workspaceId,\n      principalKind ? { principalKind } : undefined,\n    ));\n  if (!grant) {\n    const workspace = await requireWorkspace(deps.db, workspaceId).catch(() => null);\n    if (!workspace) {\n      throw new HTTPException(404, { message: \"workspace not found\" });\n    }\n    throw new HTTPException(403, { message: \"workspace access denied\" });\n  }\n  if (permission) {\n    requirePermission(grant, permission);\n  }\n  return accessGrantAuthorizationFromContext(context, grant);\n}\n\nfunction hostedHumanSessionPrincipalKind(context: AccessContext): \"human_session\" | undefined {\n  if (context.mode !== \"managed\" || context.workspaceGrants.length === 0) {\n    return undefined;\n  }\n  return context.workspaceGrants.every(\n    (grant) =>\n      grant.principalKind === \"human_session\" &&\n      grant.metadata?.delegated !== true &&\n      !grant.serviceInitiator,\n  )\n    ? \"human_session\"\n    : undefined;\n}\n\nexport function requirePermission(grant: AccessGrant, permission: Permission): void {\n  if (!hasPermission(grant.permissions, permission)) {\n    if (permission === \"variable-sets:use\") {\n      throw new HTTPException(403, {\n        message: \"missing permission: variable-sets:use (deprecated alias: environments:use)\",\n      });\n    }\n    if (permission === \"variable-sets:manage\") {\n      throw new HTTPException(403, {\n        message: \"missing permission: variable-sets:manage (deprecated alias: environments:manage)\",\n      });\n    }\n    throw new HTTPException(403, {\n      message: `missing permission: ${permission}`,\n    });\n  }\n}\n\n/**\n * Require a permission to be present literally on the grant. This deliberately\n * does not expand workspace:admin or deprecated aliases and is reserved for\n * authorities, such as plaintext secret reads, that old broad grants must not\n * acquire implicitly.\n */\nexport function requireLiteralPermission(grant: AccessGrant, permission: Permission): void {\n  if (!hasLiteralPermission(grant.permissions, permission)) {\n    throw new HTTPException(403, {\n      message: `missing literal permission: ${permission}`,\n    });\n  }\n}\n\nexport function hasLiteralPermission(permissions: Permission[], permission: Permission): boolean {\n  return permissions.includes(permission);\n}\n\nexport function hasPermission(permissions: Permission[], permission: Permission): boolean {\n  if (permission === \"secrets:read\") {\n    return permissions.includes(\"secrets:read\");\n  }\n  const aliases: Partial<Record<Permission, Permission[]>> = {\n    \"variable-sets:use\": [\"environments:use\" as Permission],\n    \"variable-sets:manage\": [\"environments:manage\" as Permission],\n    \"variable-sets:list\": [\n      \"variable-sets:use\",\n      \"variable-sets:manage\",\n      \"environments:use\" as Permission,\n      \"environments:manage\" as Permission,\n    ],\n    \"variable-sets:read\": [\n      \"variable-sets:use\",\n      \"variable-sets:manage\",\n      \"environments:use\" as Permission,\n      \"environments:manage\" as Permission,\n    ],\n    \"variable-sets:write\": [\"variable-sets:manage\", \"environments:manage\" as Permission],\n    \"secrets:list\": [\n      \"variable-sets:use\",\n      \"variable-sets:manage\",\n      \"environments:use\" as Permission,\n      \"environments:manage\" as Permission,\n    ],\n    \"secrets:write\": [\"variable-sets:manage\", \"environments:manage\" as Permission],\n  };\n  return (\n    permissions.includes(permission) ||\n    (aliases[permission]?.some((alias) => permissions.includes(alias)) ?? false) ||\n    permissions.includes(\"workspace:admin\")\n  );\n}\n\nasync function resolveAccessContext(c: Context, deps: AccessDeps): Promise<AccessContext | null> {\n  if (deps.settings.productAccessMode === \"local\") {\n    const delegated = await delegatedAccessContext(c, deps, \"local\");\n    if (delegated) {\n      return delegated;\n    }\n    return await bootstrapWorkspace(deps.db, {\n      accountExternalSource: \"opengeni:local\",\n      accountExternalId: \"default\",\n      accountName: \"Local\",\n      workspaceExternalSource: \"opengeni:local\",\n      workspaceExternalId: \"default\",\n      workspaceName: \"Local\",\n      subjectId: \"dev\",\n      subjectLabel: \"Local dev\",\n    });\n  }\n\n  if (deps.settings.productAccessMode === \"configured\") {\n    const delegated = await delegatedAccessContext(c, deps, \"configured\");\n    if (delegated) {\n      return delegated;\n    }\n    const apiKey = await apiKeyAccessContext(c, deps, \"configured\");\n    if (apiKey) {\n      return apiKey;\n    }\n    if (deps.settings.delegationSecret) {\n      return null;\n    }\n    return await bootstrapWorkspace(deps.db, {\n      accountExternalSource: \"opengeni:configured\",\n      accountExternalId: \"default\",\n      accountName: \"Configured\",\n      workspaceExternalSource: \"opengeni:configured\",\n      workspaceExternalId: \"default\",\n      workspaceName: \"Configured\",\n      subjectId: configuredSubject(c),\n      subjectLabel: \"Configured key\",\n    });\n  }\n\n  const bearer = bearerToken(c);\n  if (bearer) {\n    const delegated = await delegatedAccessContext(c, deps, \"managed\", bearer);\n    if (delegated) {\n      return delegated;\n    }\n    const apiKey = await apiKeyAccessContext(c, deps, \"managed\");\n    if (apiKey) {\n      return apiKey;\n    }\n  }\n\n  if (deps.managedAuth) {\n    const session = await getManagedSession(c, deps.managedAuth, { db: deps.db });\n    if (session?.user) {\n      return await ensureManagedAccessForUser(deps.db, {\n        userId: session.user.id,\n        email: session.user.email,\n        name: session.user.name,\n      });\n    }\n  }\n\n  return null;\n}\n\nasync function apiKeyAccessContext(\n  c: Context,\n  deps: AccessDeps,\n  mode: \"configured\" | \"managed\",\n): Promise<AccessContext | null> {\n  const bearer = bearerToken(c);\n  if (!bearer) {\n    return null;\n  }\n  const apiKey = await findActiveApiKeyByHash(deps.db, await sha256Hex(bearer));\n  if (!apiKey) {\n    return null;\n  }\n  const subjectId = `api_key:${apiKey.id}`;\n  const accountPermissions = apiKey.workspaceId\n    ? apiKey.permissions.filter(\n        (permission) => permission === \"billing:read\" || permission === \"billing:manage\",\n      )\n    : apiKey.permissions;\n  return {\n    mode,\n    subjectId,\n    subjectLabel: apiKey.name,\n    accountGrants: [\n      {\n        accountId: apiKey.accountId,\n        subjectId,\n        subjectLabel: apiKey.name,\n        permissions: accountPermissions,\n      },\n    ],\n    workspaceGrants: apiKey.workspaceId\n      ? [\n          {\n            workspaceId: apiKey.workspaceId,\n            accountId: apiKey.accountId,\n            subjectId,\n            subjectLabel: apiKey.name,\n            permissions: apiKey.permissions,\n            principalKind: \"api_key\",\n          },\n        ]\n      : [],\n    defaultAccountId: apiKey.accountId,\n    defaultWorkspaceId: apiKey.workspaceId,\n  } satisfies AccessContext;\n}\n\nasync function delegatedAccessContext(\n  c: Context,\n  deps: AccessDeps,\n  mode: \"local\" | \"configured\" | \"managed\",\n  token = bearerToken(c),\n): Promise<AccessContext | null> {\n  const delegationSecret = resolveFirstPartyDelegationSecret(deps.settings);\n  if (!token || !delegationSecret) {\n    return null;\n  }\n  const payload = await verifyDelegatedAccessToken(delegationSecret, token);\n  if (!payload) {\n    return null;\n  }\n  return {\n    mode,\n    subjectId: payload.subjectId,\n    ...(payload.subjectLabel ? { subjectLabel: payload.subjectLabel } : {}),\n    accountGrants: [\n      {\n        accountId: payload.accountId,\n        subjectId: payload.subjectId,\n        ...(payload.subjectLabel ? { subjectLabel: payload.subjectLabel } : {}),\n        permissions: payload.permissions,\n      },\n    ],\n    workspaceGrants: [\n      {\n        workspaceId: payload.workspaceId,\n        accountId: payload.accountId,\n        subjectId: payload.subjectId,\n        ...(payload.subjectLabel ? { subjectLabel: payload.subjectLabel } : {}),\n        permissions: payload.permissions,\n        principalKind: payload.principalKind,\n        // sessionId is worker-asserted (HMAC-signed token claim), not agent\n        // controlled; it scopes session-bound MCP tools such as goal management.\n        metadata: {\n          delegated: true,\n          ...(payload.sessionId ? { sessionId: payload.sessionId } : {}),\n          ...(payload.firstPartyMcpTools !== undefined\n            ? { firstPartyMcpTools: payload.firstPartyMcpTools }\n            : {}),\n          ...(payload.nestedAgentDepth !== undefined\n            ? { nestedAgentDepth: payload.nestedAgentDepth }\n            : {}),\n          ...(payload.effectiveMaxNestedAgentDepth !== undefined\n            ? { effectiveMaxNestedAgentDepth: payload.effectiveMaxNestedAgentDepth }\n            : {}),\n          // Caller identity: the turn that minted this token. Tools classify the\n          // CALLER from this instead of re-reading the live active pointer.\n          ...(payload.turnId ? { turnId: payload.turnId } : {}),\n          ...(payload.attemptId ? { attemptId: payload.attemptId } : {}),\n          ...(payload.executionGeneration\n            ? { executionGeneration: payload.executionGeneration }\n            : {}),\n        },\n        ...(payload.serviceInitiator ? { serviceInitiator: payload.serviceInitiator } : {}),\n        ...(payload.serviceInitiatorContext\n          ? { serviceInitiatorContext: payload.serviceInitiatorContext }\n          : {}),\n      },\n    ],\n    defaultAccountId: payload.accountId,\n    defaultWorkspaceId: payload.workspaceId,\n  };\n}\n\nfunction configuredSubject(c: Context): string {\n  const header = c.req.header(\"x-opengeni-subject\");\n  return header && header.trim().length > 0 ? `configured:${header.trim()}` : \"configured:key\";\n}\n\nfunction bearerToken(c: Context): string | null {\n  const authorization = c.req.header(\"authorization\");\n  return authorization?.startsWith(bearerPrefix) ? authorization.slice(bearerPrefix.length) : null;\n}\n\nasync function sha256Hex(value: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value));\n  return Array.from(new Uint8Array(digest))\n    .map((byte) => byte.toString(16).padStart(2, \"0\"))\n    .join(\"\");\n}\n","import {\n  SessionAuthorizationActor,\n  SessionAuthorizationDecision,\n  SessionAuthorizationListScope,\n  type AccessGrant,\n  type SessionAuthorizationOperation,\n  type SessionAuthorizationSurface,\n  type SessionAuthorizationTarget,\n} from \"@opengeni/contracts\";\nimport {\n  getSessionAuthorityProjection,\n  getSession,\n  getSessionTurnForAttempt,\n  getSlackInteractionSessionAccessForSession,\n  withSessionRlsActorContext,\n  type Database,\n  type SessionRlsActorContext,\n} from \"@opengeni/db\";\nimport type { AppDependencies } from \"./dependencies\";\n\nexport type SessionAuthorizationDependencies = Pick<AppDependencies, \"db\" | \"sessionAuthorization\">;\n\n/** Maximum time an omitted host hint leaves a live session stream unchecked. */\nexport const SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS = 15_000;\n\nexport class SessionAuthorizationDeniedError extends Error {\n  readonly code = \"SESSION_NOT_FOUND_OR_DENIED\";\n\n  constructor(readonly reason: \"not_found\" | \"forbidden\" | \"revoked\" | \"caller_stale\") {\n    super(\"Session not found or access denied\");\n    this.name = \"SessionAuthorizationDeniedError\";\n  }\n}\n\nexport class SessionAuthorizationUnavailableError extends Error {\n  readonly code = \"SESSION_AUTHORIZATION_UNAVAILABLE\";\n\n  constructor(options?: ErrorOptions) {\n    super(\"Session authorization is unavailable\", options);\n    this.name = \"SessionAuthorizationUnavailableError\";\n  }\n}\n\nexport type ResolvedSessionAuthorization = {\n  actor: SessionAuthorizationActor;\n  target: SessionAuthorizationTarget;\n  relatedSessionAccess: \"target\" | \"root\";\n  reauthorizeAfterMs: number | null;\n};\n\ntype ResolvedSessionAuthorizationActor = {\n  actor: SessionAuthorizationActor;\n  callerParentSessionId: string | null;\n};\n\ntype ResolvedSessionAuthorizationTarget = {\n  target: SessionAuthorizationTarget;\n  parentSessionId: string | null;\n};\n\nfunction grantHasAgentAttemptAuthority(grant: AccessGrant): boolean {\n  const hasAgentAttemptClaim =\n    grant.metadata?.[\"turnId\"] !== undefined ||\n    grant.metadata?.[\"attemptId\"] !== undefined ||\n    grant.metadata?.[\"executionGeneration\"] !== undefined;\n  return grant.principalKind ? grant.principalKind === \"agent_attempt\" : hasAgentAttemptClaim;\n}\n\n/**\n * Read-only access an immediate child may use against its parent. Upstream\n * mutation is deliberately limited to `session.append`: letting a child Pause,\n * Steer, or otherwise mutate its parent would let it influence siblings through\n * the parent's recursive control and shared state.\n */\nconst AGENT_PARENT_READ_OPERATIONS = new Set<SessionAuthorizationOperation>([\n  \"session.read\",\n  \"session.events.read\",\n  \"session.stream.read\",\n  \"session.turns.read\",\n  \"session.queue.read\",\n  \"session.composer.read\",\n  \"session.lineage.read\",\n  \"session.capture.read\",\n  \"session.files.read\",\n  \"session.git.read\",\n  \"session.terminal.read\",\n  \"session.viewer.read\",\n  \"session.goal.read\",\n  \"session.human_input.read\",\n]);\n\nfunction enforceAgentSessionHierarchy(\n  actor: Extract<SessionAuthorizationActor, { kind: \"agent_attempt\" }>,\n  callerParentSessionId: string | null,\n  target: ResolvedSessionAuthorizationTarget,\n  operation: SessionAuthorizationOperation,\n): \"target\" | \"root\" {\n  if (target.target.sessionId === actor.callerSessionId) return \"root\";\n\n  // A manager may inspect and operate an immediate child. Existing permission\n  // and host-policy checks still apply; lineage never grants a capability.\n  if (target.parentSessionId === actor.callerSessionId) return \"target\";\n\n  // A child may report to and inspect its immediate parent, but cannot mutate\n  // the parent except through the canonical machine-input message boundary.\n  if (callerParentSessionId === target.target.sessionId) {\n    if (operation === \"session.append\" || AGENT_PARENT_READ_OPERATIONS.has(operation)) {\n      return \"target\";\n    }\n    throw new SessionAuthorizationDeniedError(\"forbidden\");\n  }\n\n  // Siblings, skipped generations, other branches, and unrelated roots are\n  // never cross-session authority for a live agent attempt.\n  throw new SessionAuthorizationDeniedError(\"forbidden\");\n}\n\nexport function sessionRlsActorForAuthorization(\n  authorization: ResolvedSessionAuthorization,\n): SessionRlsActorContext {\n  return authorization.actor.kind === \"agent_attempt\"\n    ? {\n        subjectId: authorization.actor.subjectId,\n        initiatingHumanSubjectId: authorization.actor.initiatingHumanSubjectId,\n      }\n    : { subjectId: authorization.actor.subjectId };\n}\n\nexport async function withResolvedSessionAuthorization<T>(\n  authorization: ResolvedSessionAuthorization,\n  fn: () => Promise<T>,\n): Promise<T> {\n  return await withSessionRlsActorContext(sessionRlsActorForAuthorization(authorization), fn);\n}\n\n/**\n * Prove that a first-party request belongs to the exact currently active\n * attempt of the named caller session. Unlike the optional embedding-host ACL\n * port, this database fence is mandatory for high-trust operations.\n */\nexport async function requireLiveAgentAttemptAuthorization(\n  db: Database,\n  grant: AccessGrant,\n  callerSessionId: string,\n): Promise<Extract<SessionAuthorizationActor, { kind: \"agent_attempt\" }>> {\n  const { actor } = await resolveSessionAuthorizationActor(db, grant);\n  if (actor.kind !== \"agent_attempt\" || actor.callerSessionId !== callerSessionId) {\n    throw new SessionAuthorizationDeniedError(\"caller_stale\");\n  }\n  return actor;\n}\n\n/**\n * Resolve and enforce the host ACL for one session. The target and agent actor\n * are reconstructed from workspace-scoped durable state. A request can supply\n * an immediate target id and signed attempt claims, but can never nominate a\n * lineage root or frozen initiator.\n *\n * Slack-owned private sessions are enforced here even when no embedding-host\n * authorization port is bound. That durable ownership fence covers every\n * session surface which uses this shared seam, rather than relying on list/UI\n * filtering or caller-controlled session metadata.\n */\nexport async function requireSessionAuthorization(\n  deps: SessionAuthorizationDependencies,\n  grant: AccessGrant,\n  input: {\n    sessionId: string;\n    operation: SessionAuthorizationOperation;\n    surface: SessionAuthorizationSurface;\n  },\n): Promise<ResolvedSessionAuthorization | null> {\n  const port = deps.sessionAuthorization;\n  const isAgentAttempt = grantHasAgentAttemptAuthority(grant);\n  const [slackAccess, authority] = await Promise.all([\n    getSlackInteractionSessionAccessForSession(deps.db, {\n      accountId: grant.accountId,\n      workspaceId: grant.workspaceId,\n      sessionId: input.sessionId,\n    }),\n    getSessionAuthorityProjection(deps.db, grant.workspaceId, input.sessionId),\n  ]);\n\n  // Preserve the standalone workspace-shared path. Private sessions continue\n  // through the durable actor and ownership checks even without a host port.\n  if (\n    !port &&\n    !isAgentAttempt &&\n    slackAccess?.visibility !== \"private\" &&\n    authority?.visibility !== \"user_private\"\n  ) {\n    return null;\n  }\n  if (!authority) throw new SessionAuthorizationDeniedError(\"not_found\");\n\n  const [resolvedActor, resolvedTarget] = await Promise.all([\n    resolveSessionAuthorizationActor(deps.db, grant),\n    resolveSessionAuthorizationTarget(deps.db, grant, input.sessionId),\n  ]);\n  const actor = resolvedActor.actor;\n  const target = resolvedTarget.target;\n  const agentRelatedSessionAccess =\n    actor.kind === \"agent_attempt\"\n      ? enforceAgentSessionHierarchy(\n          actor,\n          resolvedActor.callerParentSessionId,\n          resolvedTarget,\n          input.operation,\n        )\n      : null;\n\n  if (authority.visibility === \"user_private\") {\n    const allowed =\n      authority.ownerSubjectId !== null &&\n      (actor.kind === \"subject\"\n        ? actor.subjectId === authority.ownerSubjectId\n        : actor.initiatingHumanSubjectId === authority.ownerSubjectId);\n    if (!allowed) throw new SessionAuthorizationDeniedError(\"forbidden\");\n  }\n  if (slackAccess?.visibility === \"private\") {\n    const allowed =\n      actor.kind === \"subject\"\n        ? actor.subjectId === slackAccess.owningSubjectId\n        : actor.callerRootSessionId === target.rootSessionId;\n    if (!allowed) throw new SessionAuthorizationDeniedError(\"forbidden\");\n  }\n  if (!port) {\n    return {\n      actor,\n      target,\n      relatedSessionAccess: agentRelatedSessionAccess ?? \"root\",\n      reauthorizeAfterMs: null,\n    };\n  }\n\n  let rawDecision: unknown;\n  try {\n    rawDecision = await port.authorizeSession({\n      accountId: grant.accountId,\n      workspaceId: grant.workspaceId,\n      actor,\n      target,\n      operation: input.operation,\n      surface: input.surface,\n    });\n  } catch (error) {\n    throw new SessionAuthorizationUnavailableError({ cause: error });\n  }\n  const parsed = SessionAuthorizationDecision.safeParse(rawDecision);\n  if (!parsed.success) {\n    throw new SessionAuthorizationUnavailableError({ cause: parsed.error });\n  }\n  if (!parsed.data.allowed) {\n    throw new SessionAuthorizationDeniedError(parsed.data.reason);\n  }\n  return {\n    actor,\n    target,\n    relatedSessionAccess:\n      agentRelatedSessionAccess === \"target\"\n        ? \"target\"\n        : (parsed.data.relatedSessionAccess ?? \"target\"),\n    reauthorizeAfterMs: parsed.data.reauthorizeAfterMs ?? null,\n  };\n}\n\n/** Resolve the host's complete current list scope for an in-database query. */\nexport async function requireSessionAuthorizationListScope(\n  deps: SessionAuthorizationDependencies,\n  grant: AccessGrant,\n  surface: SessionAuthorizationSurface,\n): Promise<SessionAuthorizationListScope | null> {\n  const port = deps.sessionAuthorization;\n  const isAgentAttempt = grantHasAgentAttemptAuthority(grant);\n  if (!port && !isAgentAttempt) return null;\n  const { actor } = await resolveSessionAuthorizationActor(deps.db, grant);\n  // Standalone agents may retain compact workspace discovery, but only while\n  // the signed caller attempt is still the exact live attempt.\n  if (!port) return null;\n  let rawScope: unknown;\n  try {\n    rawScope = await port.resolveListScope({\n      accountId: grant.accountId,\n      workspaceId: grant.workspaceId,\n      actor,\n      surface,\n    });\n  } catch (error) {\n    throw new SessionAuthorizationUnavailableError({ cause: error });\n  }\n  const parsed = SessionAuthorizationListScope.safeParse(rawScope);\n  if (!parsed.success) {\n    throw new SessionAuthorizationUnavailableError({ cause: parsed.error });\n  }\n  if (parsed.data.kind === \"all\") return parsed.data;\n  return {\n    kind: \"scoped\",\n    rootSessionIds: [...new Set(parsed.data.rootSessionIds)],\n    sessionIds: [...new Set(parsed.data.sessionIds)],\n  };\n}\n\nasync function resolveSessionAuthorizationTarget(\n  db: Database,\n  grant: AccessGrant,\n  sessionId: string,\n): Promise<ResolvedSessionAuthorizationTarget> {\n  const session = await getSession(db, grant.workspaceId, sessionId);\n  if (!session || session.accountId !== grant.accountId) {\n    throw new SessionAuthorizationDeniedError(\"not_found\");\n  }\n  return {\n    target: { sessionId: session.id, rootSessionId: session.rootSessionId },\n    parentSessionId: session.parentSessionId,\n  };\n}\nasync function resolveSessionAuthorizationActor(\n  db: Database,\n  grant: AccessGrant,\n): Promise<ResolvedSessionAuthorizationActor> {\n  const callerSessionId = grant.metadata?.[\"sessionId\"];\n  const turnId = grant.metadata?.[\"turnId\"];\n  const attemptId = grant.metadata?.[\"attemptId\"];\n  const executionGeneration = grant.metadata?.[\"executionGeneration\"];\n  const isAgentAttempt = grantHasAgentAttemptAuthority(grant);\n  if (!isAgentAttempt) {\n    return {\n      actor: SessionAuthorizationActor.parse({\n        kind: \"subject\",\n        subjectId: grant.subjectId,\n        ...(grant.subjectLabel ? { subjectLabel: grant.subjectLabel } : {}),\n      }),\n      callerParentSessionId: null,\n    };\n  }\n  if (\n    typeof callerSessionId !== \"string\" ||\n    typeof turnId !== \"string\" ||\n    typeof attemptId !== \"string\" ||\n    typeof executionGeneration !== \"number\" ||\n    !Number.isSafeInteger(executionGeneration) ||\n    executionGeneration < 1\n  ) {\n    throw new SessionAuthorizationDeniedError(\"caller_stale\");\n  }\n  const [callerSession, turn] = await Promise.all([\n    getSession(db, grant.workspaceId, callerSessionId),\n    getSessionTurnForAttempt(db, grant.workspaceId, callerSessionId, attemptId),\n  ]);\n  if (\n    !callerSession ||\n    callerSession.accountId !== grant.accountId ||\n    !turn ||\n    turn.id !== turnId ||\n    turn.executionGeneration !== executionGeneration ||\n    callerSession.activeTurnId !== turn.id\n  ) {\n    throw new SessionAuthorizationDeniedError(\"caller_stale\");\n  }\n  return {\n    actor: SessionAuthorizationActor.parse({\n      kind: \"agent_attempt\",\n      subjectId: grant.subjectId,\n      callerSessionId,\n      callerRootSessionId: callerSession.rootSessionId,\n      turnId,\n      attemptId,\n      executionGeneration,\n      initiator: turn.initiator,\n      initiatorContext: turn.initiatorContext,\n      initiatingHumanSubjectId:\n        turn.initiatingHumanSubjectId ??\n        (turn.initiator.kind === \"subject\" ? turn.initiator.subjectId : null),\n    }),\n    callerParentSessionId: callerSession.parentSessionId,\n  };\n}\n","import { configuredStaticUsageLimits } from \"@opengeni/config\";\nimport type {\n  LimitAction,\n  LimitDecision,\n  SessionTurnSource,\n  TurnInitiator,\n  TurnInitiatorContext,\n} from \"@opengeni/contracts\";\nimport {\n  countActiveApiKeysForWorkspace,\n  countScheduledTasksForWorkspace,\n  countWorkspacesForAccount,\n  getBillingBalance,\n  isCodexBilledTurn,\n  recordUsageEvent,\n  sumUsageQuantity,\n} from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\nimport type { ApiRouteDeps } from \"../dependencies\";\n\nexport type LimitDependencies = Pick<ApiRouteDeps, \"db\" | \"settings\">;\n\nexport type LimitCheckInput = {\n  accountId: string;\n  workspaceId?: string;\n  action: LimitAction;\n  quantity?: number;\n  // The turn's model id, when the action represents an agent turn. When this is a\n  // Codex-billed turn (codex/<slug> + feature enabled + active workspace\n  // credential) the turn is paid by the user's ChatGPT/Codex plan and consumes\n  // ZERO OpenGeni credits, so the credit-balance + model-cost + token gates are\n  // skipped. Non-model infra actions (workspace/api_key/schedule create) leave\n  // this undefined and are unaffected.\n  model?: string | null;\n};\n\nexport async function requireLimit(deps: LimitDependencies, input: LimitCheckInput): Promise<void> {\n  const decision = await checkLimit(deps, input);\n  if (decision.allowed) {\n    return;\n  }\n  throw new HTTPException(decision.code === \"insufficient_credits\" ? 402 : 429, {\n    message: decision.message,\n  });\n}\n\nexport async function checkLimit(\n  deps: LimitDependencies,\n  input: LimitCheckInput,\n): Promise<LimitDecision> {\n  // Resolve the canonical codex-billed predicate ONCE. Returns false for any\n  // action that carries no model (infra caps) or any codex/<slug> model without\n  // an active credential — so the bypass never triggers on the prefix alone.\n  const codexBilled = input.workspaceId\n    ? await isCodexBilledTurn({\n        db: deps.db,\n        settings: deps.settings,\n        workspaceId: input.workspaceId,\n        model: input.model,\n      })\n    : false;\n  const creditDecision = await checkCreditBalance(deps, input, codexBilled);\n  if (!creditDecision.allowed) {\n    return creditDecision;\n  }\n  if (deps.settings.usageLimitsMode !== \"static\" && deps.settings.usageLimitsMode !== \"managed\") {\n    return { allowed: true };\n  }\n  return await checkStaticCaps(deps, input, codexBilled);\n}\n\nasync function checkCreditBalance(\n  deps: LimitDependencies,\n  input: LimitCheckInput,\n  codexBilled: boolean,\n): Promise<LimitDecision> {\n  if (codexBilled) {\n    return { allowed: true }; // paid by the user's ChatGPT/Codex plan — zero OpenGeni credits\n  }\n  if (!usesCreditLimits(deps) || !isCostlyAction(input.action)) {\n    return { allowed: true };\n  }\n  const balance = await getBillingBalance(deps.db, input.accountId);\n  if (balance.balanceMicros > 0) {\n    return { allowed: true };\n  }\n  return { allowed: false, code: \"insufficient_credits\", message: \"insufficient OpenGeni credits\" };\n}\n\nasync function checkStaticCaps(\n  deps: LimitDependencies,\n  input: LimitCheckInput,\n  codexBilled: boolean,\n): Promise<LimitDecision> {\n  const limits = configuredStaticUsageLimits(deps.settings);\n  if (limits.maxMonthlyCostMicrosPerAccount && isCostlyAction(input.action) && !codexBilled) {\n    const used = await sumUsageQuantity(deps.db, {\n      accountId: input.accountId,\n      eventType: \"model.cost\",\n      since: startOfUtcMonth(),\n    });\n    if (used >= limits.maxMonthlyCostMicrosPerAccount) {\n      return blocked(\n        \"max_monthly_cost_micros_per_account\",\n        `monthly model cost limit reached (${limits.maxMonthlyCostMicrosPerAccount} micros)`,\n      );\n    }\n  }\n  switch (input.action) {\n    case \"workspace:create\": {\n      if (!limits.maxWorkspacesPerAccount) {\n        return { allowed: true };\n      }\n      const count = await countWorkspacesForAccount(deps.db, input.accountId);\n      return count < limits.maxWorkspacesPerAccount\n        ? { allowed: true }\n        : blocked(\n            \"max_workspaces_per_account\",\n            `workspace limit reached (${limits.maxWorkspacesPerAccount})`,\n          );\n    }\n    case \"api_key:create\": {\n      if (!limits.maxApiKeysPerWorkspace || !input.workspaceId) {\n        return { allowed: true };\n      }\n      const count = await countActiveApiKeysForWorkspace(deps.db, input.workspaceId);\n      return count < limits.maxApiKeysPerWorkspace\n        ? { allowed: true }\n        : blocked(\n            \"max_api_keys_per_workspace\",\n            `API key limit reached (${limits.maxApiKeysPerWorkspace})`,\n          );\n    }\n    case \"schedule:create\": {\n      if (!limits.maxSchedulesPerWorkspace || !input.workspaceId) {\n        return { allowed: true };\n      }\n      const count = await countScheduledTasksForWorkspace(deps.db, input.workspaceId);\n      return count < limits.maxSchedulesPerWorkspace\n        ? { allowed: true }\n        : blocked(\n            \"max_schedules_per_workspace\",\n            `scheduled task limit reached (${limits.maxSchedulesPerWorkspace})`,\n          );\n    }\n    case \"file:upload\": {\n      if (!limits.maxFileUploadBytes || !input.quantity) {\n        return { allowed: true };\n      }\n      return input.quantity <= limits.maxFileUploadBytes\n        ? { allowed: true }\n        : blocked(\n            \"max_file_upload_bytes\",\n            `file upload exceeds static limit of ${limits.maxFileUploadBytes} bytes`,\n          );\n    }\n    case \"agent_run:create\": {\n      if (!limits.maxMonthlyAgentRunsPerWorkspace || !input.workspaceId) {\n        return { allowed: true };\n      }\n      const used = await sumUsageQuantity(deps.db, {\n        workspaceId: input.workspaceId,\n        eventType: \"agent_run.created\",\n        since: startOfUtcMonth(),\n      });\n      const requested = input.quantity ?? 0;\n      return used + requested <= limits.maxMonthlyAgentRunsPerWorkspace\n        ? { allowed: true }\n        : blocked(\n            \"max_monthly_agent_runs_per_workspace\",\n            `monthly agent run limit reached (${limits.maxMonthlyAgentRunsPerWorkspace})`,\n          );\n    }\n    case \"tokens:consume\": {\n      if (codexBilled || !limits.maxMonthlyTokensPerWorkspace || !input.workspaceId) {\n        return { allowed: true };\n      }\n      const used = await sumUsageQuantity(deps.db, {\n        workspaceId: input.workspaceId,\n        eventType: \"model.tokens\",\n        since: startOfUtcMonth(),\n      });\n      const requested = input.quantity ?? 0;\n      return used + requested <= limits.maxMonthlyTokensPerWorkspace\n        ? { allowed: true }\n        : blocked(\n            \"max_monthly_tokens_per_workspace\",\n            `monthly token limit reached (${limits.maxMonthlyTokensPerWorkspace})`,\n          );\n    }\n    case \"document:index\": {\n      if (!limits.maxDocumentIndexedChunksPerWorkspace || !input.workspaceId) {\n        return { allowed: true };\n      }\n      const used = await sumUsageQuantity(deps.db, {\n        workspaceId: input.workspaceId,\n        eventType: \"document.indexed\",\n        since: startOfUtcMonth(),\n      });\n      const requested = input.quantity ?? 0;\n      return used + requested <= limits.maxDocumentIndexedChunksPerWorkspace\n        ? { allowed: true }\n        : blocked(\n            \"max_document_indexed_chunks_per_workspace\",\n            `monthly document indexing limit reached (${limits.maxDocumentIndexedChunksPerWorkspace} chunks)`,\n          );\n    }\n  }\n}\n\nexport async function recordWorkspaceUsage(\n  deps: LimitDependencies,\n  input: {\n    accountId: string;\n    workspaceId: string;\n    subjectId?: string | null;\n    eventType: \"agent_run.created\" | \"file.uploaded\" | \"document.indexed\" | \"scheduled_task.fired\";\n    quantity: number;\n    unit: string;\n    sourceResourceType: string;\n    sourceResourceId: string;\n    sessionId?: string | null;\n    turnId?: string | null;\n    turnAttemptId?: string | null;\n    initiator?: TurnInitiator | null;\n    initiatorContext?: TurnInitiatorContext;\n    origin?: SessionTurnSource | null;\n    idempotencyKey: string;\n  },\n): Promise<void> {\n  await recordUsageEvent(deps.db, {\n    accountId: input.accountId,\n    workspaceId: input.workspaceId,\n    subjectId: input.subjectId ?? null,\n    eventType: input.eventType,\n    quantity: input.quantity,\n    unit: input.unit,\n    sourceResourceType: input.sourceResourceType,\n    sourceResourceId: input.sourceResourceId,\n    sessionId: input.sessionId ?? null,\n    turnId: input.turnId ?? null,\n    turnAttemptId: input.turnAttemptId ?? null,\n    initiator:\n      input.initiator ?? (input.subjectId ? { kind: \"subject\", subjectId: input.subjectId } : null),\n    ...(input.initiatorContext ? { initiatorContext: input.initiatorContext } : {}),\n    origin: input.origin ?? null,\n    idempotencyKey: input.idempotencyKey,\n  });\n}\n\nfunction usesCreditLimits(deps: LimitDependencies): boolean {\n  return deps.settings.billingMode === \"stripe\" || deps.settings.usageLimitsMode === \"managed\";\n}\n\nfunction isCostlyAction(action: LimitAction): boolean {\n  return (\n    action === \"agent_run:create\" || action === \"tokens:consume\" || action === \"document:index\"\n  );\n}\n\nfunction blocked(code: string, message: string): LimitDecision {\n  return { allowed: false, code, message };\n}\n\nfunction startOfUtcMonth(): Date {\n  const now = new Date();\n  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));\n}\n","import { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport type { Transport } from \"@modelcontextprotocol/sdk/shared/transport.js\";\nimport { environmentsEncryptionKeyBytes, type Settings } from \"@opengeni/config\";\nimport {\n  CapabilityCatalogItem,\n  capabilityCatalogItemIsTrustedForExposure,\n  FIKEN_PROVIDER_DOMAIN,\n  FIRST_PARTY_MCP_TOOL_NAMES,\n  type AccessGrant,\n  type CapabilityAction,\n  type CapabilityCatalogResponse,\n  type CapabilityInstallation,\n  type ConnectionMetadata,\n  type CreateCapabilityCatalogItemRequest,\n  type EnableCapabilityRequest,\n  type McpServerConnectionRef,\n  type McpPersonalConnectionDelegation,\n  type SocialConnection,\n} from \"@opengeni/contracts\";\nimport {\n  CODEX_APPS_MCP_SERVER_ID,\n  CODEX_APPS_MCP_SERVER_NAME,\n  CODEX_APPS_MCP_URL,\n  CODEX_APPS_STARTUP_TIMEOUT_MS,\n} from \"@opengeni/codex\";\nimport {\n  decryptVariableSetValue,\n  decryptedCapabilityHeaders,\n  disableCapabilityInstallation,\n  enableCapabilityInstallation,\n  encryptVariableSetValue,\n  getCapabilityCatalogItem,\n  getCapabilityInstallation,\n  getConnectionMetadata,\n  getCodexAppsCredentialAuthorizationForRun,\n  getWorkspaceGrant,\n  getStoredCapabilityHeaderCiphertext,\n  listCapabilityCatalogItems,\n  listCapabilityInstallations,\n  listConnectionsMetadata,\n  listEnabledMcpCapabilityServers,\n  listInstalledApiIntegrations,\n  listInstalledSkills,\n  listPackInstallations,\n  listSocialConnections,\n  mcpServerIdForCapability,\n  upsertCapabilityCatalogItem,\n  type Database,\n  type ApiIntegrationRuntime,\n  type EnabledMcpCapabilityServer,\n  type InstalledSkillSummary,\n} from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\nimport { hasPermission } from \"../access\";\nimport { isFikenConnection, preferredFikenConnection } from \"./fiken\";\nimport { listSkillLibraryEntries, type SkillLibraryEntry } from \"@opengeni/runtime/skill-library\";\nimport { listCapabilityPacks, listWorkspaceCapabilityPacks } from \"./packs\";\n\nconst officialMcpRegistryUrl = \"https://registry.modelcontextprotocol.io\";\nconst firstPartyMcpServerIds = new Set([\"opengeni\", \"files\", \"docs\"]);\nconst mcpRegistryFetchTimeoutMs = 15000;\nconst mcpRegistryMaxPages = 3;\nconst mcpCapabilityProbeTimeoutMs = 15000;\nconst maxMcpCredentialHeaders = 16;\nconst maxMcpCredentialHeaderValueLength = 4096;\nconst officialGmailMcpUrl = \"https://gmailmcp.googleapis.com/mcp/v1\";\n// RFC 9110 field-name token characters.\nconst mcpCredentialHeaderName = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;\n\nexport async function buildCapabilityCatalog(input: {\n  db: Database;\n  workspaceId: string;\n  settings: Settings;\n  subjectId?: string | null;\n}): Promise<CapabilityCatalogResponse> {\n  const [\n    persistedItems,\n    capabilityInstallations,\n    packInstallations,\n    workspacePacks,\n    socialConnections,\n    workspaceConnections,\n    curatedLibrarySkills,\n    installedSkills,\n    codexAppsCredentialId,\n  ] = await Promise.all([\n    listCapabilityCatalogItems(input.db, input.workspaceId),\n    listCapabilityInstallations(input.db, input.workspaceId),\n    listPackInstallations(input.db, input.workspaceId),\n    listWorkspaceCapabilityPacks(input.db, input.workspaceId),\n    listSocialConnections(input.db, input.workspaceId, 500, input.subjectId),\n    listConnectionsMetadata(input.db, input.workspaceId, null),\n    discoverCuratedSkillLibraryItems(),\n    listInstalledSkills(input.db, input.workspaceId),\n    input.settings.codexConnectedAppsEnabled\n      ? resolveCodexAppsCredentialIdForRun(input.db, input.workspaceId)\n      : Promise.resolve(null),\n  ]);\n  const catalogInstallations = capabilityInstallations.filter(\n    (installation) => installation.kind === \"mcp\",\n  );\n  const capabilityInstallationById = new Map(\n    catalogInstallations.map((installation) => [installation.capabilityId, installation]),\n  );\n  const installedSkillById = new Map(\n    installedSkills\n      .filter((skill) => skill.owners.some((owner) => owner.kind === \"direct\"))\n      .map((skill) => [skill.capabilityId, skill]),\n  );\n  const activePackIds = new Set(\n    packInstallations\n      .filter((installation) => installation.status === \"active\")\n      .map((installation) => installation.packId),\n  );\n  const builtInPackIds = new Set(listCapabilityPacks().map((pack) => pack.id));\n  const builtIns = [\n    ...workspacePacks.map((pack) =>\n      packCatalogItem(pack, builtInPackIds.has(pack.id) ? \"built_in\" : \"manual\"),\n    ),\n    ...configuredMcpCatalogItems(input.settings),\n    ...providerIntegrationCatalogItems(socialConnections),\n    fikenCatalogItem(workspaceConnections.filter(isFikenConnection)),\n    ...curatedLibrarySkills,\n    ...installedSkills\n      .filter(\n        (skill) =>\n          skill.source !== \"library\" && skill.owners.some((owner) => owner.kind === \"direct\"),\n      )\n      .map(installedSkillCatalogItem),\n  ];\n  const codexApps = input.settings.codexConnectedAppsEnabled\n    ? codexAppsCatalogItem(codexAppsCredentialId !== null)\n    : null;\n  const items = dedupeCatalogItems([\n    ...builtIns,\n    ...persistedItems.filter(\n      (item) =>\n        item.kind !== \"skill\" &&\n        item.kind !== \"api\" &&\n        item.kind !== \"plugin\" &&\n        !isReservedCodexAppsCatalogItem(item),\n    ),\n    // Keep the reserved, server-derived item authoritative over any stale\n    // legacy catalog row with the same id.\n    ...(codexApps ? [codexApps] : []),\n  ])\n    .map((item) => {\n      const projected =\n        item.kind === \"skill\"\n          ? applyInstalledSkillEnablement(item, installedSkillById.get(item.id))\n          : applyCapabilityEnablement(item, capabilityInstallationById.get(item.id), activePackIds);\n      return applyCapabilityLifecycle(projected);\n    })\n    .sort(compareCatalogItems);\n  return {\n    items,\n    installations: catalogInstallations,\n  };\n}\n\nexport async function createCatalogItem(input: {\n  db: Database;\n  accountId: string;\n  workspaceId: string;\n  payload: CreateCapabilityCatalogItemRequest;\n}): Promise<CapabilityCatalogItem> {\n  const id = input.payload.id?.trim() || generatedCapabilityId(input.payload);\n  if (id.startsWith(\"pack:\")) {\n    throw new HTTPException(422, {\n      message: \"packs are managed by OpenGeni and cannot be manually created\",\n    });\n  }\n  if (id.startsWith(\"skill:\")) {\n    throw new HTTPException(422, {\n      message: \"Skills are installed through the Skill library or source import flow\",\n    });\n  }\n  if (id.startsWith(\"api:\")) {\n    throw new HTTPException(422, {\n      message: \"API Integrations are installed from typed Integration Definitions\",\n    });\n  }\n  if (id.startsWith(\"plugin:\")) {\n    throw new HTTPException(422, {\n      message: \"Plugins are installed through the Plugin Package flow\",\n    });\n  }\n  if (\n    input.payload.kind === \"mcp\" &&\n    (id === `mcp:${CODEX_APPS_MCP_SERVER_ID}` ||\n      (typeof input.payload.metadata.mcpServerId === \"string\" &&\n        input.payload.metadata.mcpServerId.trim() === CODEX_APPS_MCP_SERVER_ID))\n  ) {\n    throw new HTTPException(422, {\n      message: `${CODEX_APPS_MCP_SERVER_ID} is reserved for the canonical Codex Apps service`,\n    });\n  }\n  const source =\n    input.payload.source === \"built_in\" ||\n    input.payload.source === \"library\" ||\n    input.payload.source === \"configured\" ||\n    input.payload.source === \"registry\"\n      ? \"manual\"\n      : input.payload.source;\n  const metadata = {\n    ...input.payload.metadata,\n    ...(input.payload.kind === \"mcp\" &&\n    input.payload.endpointUrl &&\n    !input.payload.metadata.mcpServerId\n      ? { mcpServerId: mcpServerIdForCapability(id, input.payload.metadata) }\n      : {}),\n  };\n  return await upsertCapabilityCatalogItem(input.db, {\n    accountId: input.accountId,\n    workspaceId: input.workspaceId,\n    id,\n    kind: input.payload.kind,\n    source,\n    name: input.payload.name.trim(),\n    description: input.payload.description?.trim() || null,\n    category: input.payload.category.trim() || \"custom\",\n    tags: uniqueTags(input.payload.tags),\n    homepageUrl: input.payload.homepageUrl ?? null,\n    endpointUrl: input.payload.endpointUrl ?? null,\n    installUrl: input.payload.installUrl ?? null,\n    authModel: input.payload.authModel?.trim() || null,\n    metadata,\n  });\n}\n\nexport async function enableCapability(input: {\n  db: Database;\n  grant: AccessGrant;\n  accountId: string;\n  workspaceId: string;\n  settings: Settings;\n  capabilityId: string;\n  payload: EnableCapabilityRequest;\n  probeMcpServer?: McpCapabilityProbe;\n}): Promise<CapabilityInstallation> {\n  const item = await requireCatalogItem(\n    input.db,\n    input.workspaceId,\n    input.settings,\n    input.capabilityId,\n  );\n  if (item.kind === \"skill\") {\n    throw new HTTPException(409, {\n      message: \"Install Skills through the Skill library or source import flow\",\n    });\n  }\n  if (item.kind === \"api\") {\n    throw new HTTPException(409, {\n      message: \"Install API Integrations through the Integration Definitions flow\",\n    });\n  }\n  if (item.kind === \"plugin\") {\n    throw new HTTPException(409, {\n      message: \"Install Plugins through the Plugin Package flow\",\n    });\n  }\n  if (item.kind === \"pack\") {\n    throw new HTTPException(409, {\n      message: \"Install Packs through the Pack installation preview flow\",\n    });\n  }\n  if (item.kind === \"mcp\" && !item.runtime.available) {\n    throw new HTTPException(422, {\n      message: \"MCP capabilities need a remote streamable HTTP endpoint before they can be enabled\",\n    });\n  }\n  let installationMetadata = input.payload.metadata;\n  // Credential-header storage is written exclusively by this flow; strip the\n  // reserved keys from caller-provided config so the stored shape stays\n  // trustworthy and no plaintext credentials sneak in through config.headers.\n  let installationConfig: Record<string, unknown> = { ...input.payload.config };\n  delete installationConfig.headers;\n  delete installationConfig.headersEncrypted;\n  delete installationConfig.headerNames;\n  delete installationConfig.connectionRef;\n  if (item.kind === \"mcp\") {\n    const headers = await resolveMcpCredentialHeaders(input, item);\n    const connectionRef = input.payload.connectionRef\n      ? await validateMcpCapabilityConnectionRef(input, item, input.payload.connectionRef)\n      : null;\n    assertRequiredMcpCredentialHeaders(item, headers, connectionRef);\n    installationMetadata = {\n      ...installationMetadata,\n      ...(connectionRef && !headers\n        ? authDeferredMcpConnectivity()\n        : await validateMcpCapabilityConnection(item, input.probeMcpServer, headers ?? undefined)),\n    };\n    if (connectionRef) {\n      installationConfig.connectionRef = connectionRef;\n    }\n    if (headers) {\n      const key = requireCapabilityHeaderEncryption(input.settings);\n      installationConfig.headersEncrypted = Object.fromEntries(\n        Object.entries(headers).map(([name, value]) => [name, encryptVariableSetValue(key, value)]),\n      );\n    }\n  }\n  return await enableCapabilityInstallation(input.db, {\n    accountId: input.accountId,\n    workspaceId: input.workspaceId,\n    capabilityId: item.id,\n    kind: item.kind,\n    config: installationConfig,\n    metadata: installationMetadata,\n  });\n}\n\n/**\n * Resolves the plaintext credential headers an MCP enable should use: the\n * validated headers from the request when provided, otherwise headers stored\n * encrypted by a previous enable (so re-enabling never requires re-pasting\n * credentials). Returns null when neither exists.\n */\nasync function resolveMcpCredentialHeaders(\n  input: {\n    db: Database;\n    workspaceId: string;\n    settings: Settings;\n    payload: EnableCapabilityRequest;\n  },\n  item: CapabilityCatalogItem,\n): Promise<Record<string, string> | null> {\n  const provided = normalizedMcpCredentialHeaders(input.payload.headers);\n  if (provided) {\n    // Validate the key is configured before probing so a misconfigured\n    // deployment fails fast instead of after a successful remote probe.\n    requireCapabilityHeaderEncryption(input.settings);\n    return provided;\n  }\n  const storedCiphertext = await getStoredCapabilityHeaderCiphertext(\n    input.db,\n    input.workspaceId,\n    item.id,\n  );\n  if (!storedCiphertext) {\n    return null;\n  }\n  const key = requireCapabilityHeaderEncryption(input.settings);\n  try {\n    return Object.fromEntries(\n      Object.entries(storedCiphertext).map(([name, value]) => [\n        name,\n        decryptVariableSetValue(key, value),\n      ]),\n    );\n  } catch {\n    throw new HTTPException(422, {\n      message: `stored credential headers for \"${item.name}\" could not be decrypted; supply them again in the enable request \"headers\" field`,\n    });\n  }\n}\n\nfunction normalizedMcpCredentialHeaders(\n  headers: Record<string, string>,\n): Record<string, string> | null {\n  const entries = Object.entries(headers)\n    .map(([name, value]) => [name.trim(), value] as const)\n    .filter(([name]) => name.length > 0);\n  if (entries.length === 0) {\n    return null;\n  }\n  if (entries.length > maxMcpCredentialHeaders) {\n    throw new HTTPException(422, {\n      message: `an MCP capability supports at most ${maxMcpCredentialHeaders} credential headers`,\n    });\n  }\n  const seen = new Set<string>();\n  for (const [name, value] of entries) {\n    if (!mcpCredentialHeaderName.test(name)) {\n      throw new HTTPException(422, {\n        message: `invalid credential header name: ${name}`,\n      });\n    }\n    const lower = name.toLowerCase();\n    if (seen.has(lower)) {\n      throw new HTTPException(422, {\n        message: `duplicate credential header name: ${name}`,\n      });\n    }\n    seen.add(lower);\n    if (value.length === 0 || value.length > maxMcpCredentialHeaderValueLength) {\n      throw new HTTPException(422, {\n        message: `credential header ${name} must be 1-${maxMcpCredentialHeaderValueLength} characters`,\n      });\n    }\n    // RFC 9110 §5.5: field values are HTAB / printable characters — reject\n    // all other control characters (they would also fail at the HTTP client).\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u0008\\u000A-\\u001F\\u007F]/.test(value)) {\n      throw new HTTPException(422, {\n        message: `credential header ${name} contains forbidden control characters`,\n      });\n    }\n  }\n  return Object.fromEntries(entries);\n}\n\nasync function validateMcpCapabilityConnectionRef(\n  input: { db: Database; grant: AccessGrant; workspaceId: string },\n  item: CapabilityCatalogItem,\n  ref: McpServerConnectionRef,\n): Promise<McpServerConnectionRef> {\n  const subjectScope = ref.subjectScope ?? \"workspace\";\n  const personalOnly =\n    item.metadata.connectionOwnership === \"personal_only\" ||\n    item.endpointUrl?.replace(/\\/+$/, \"\") === officialGmailMcpUrl;\n  if (personalOnly && subjectScope !== \"subject\") {\n    throw new HTTPException(422, {\n      message:\n        \"this capability requires a personal connection; each workspace member must connect their own account\",\n    });\n  }\n  const normalized: McpServerConnectionRef = {\n    providerDomain: ref.providerDomain.trim(),\n    subjectScope,\n    ...(ref.connectionId ? { connectionId: ref.connectionId } : {}),\n    ...(ref.provider ? { provider: ref.provider.trim() } : {}),\n    ...(ref.kind ? { kind: ref.kind } : {}),\n    ...(ref.scopes ? { scopes: uniqueStrings(ref.scopes) } : {}),\n    ...(ref.resource ? { resource: ref.resource } : {}),\n    ...(ref.selectedResources\n      ? {\n          selectedResources: ref.selectedResources.map((resource) => ({\n            ...resource,\n          })),\n        }\n      : {}),\n  };\n  if (!normalized.providerDomain) {\n    throw new HTTPException(422, {\n      message: \"connectionRef.providerDomain is required\",\n    });\n  }\n  if (!item.endpointUrl || !item.runtime.mcpServerId) {\n    throw new HTTPException(422, {\n      message:\n        \"MCP capabilities need a remote streamable HTTP endpoint before they can use a connectionRef\",\n    });\n  }\n\n  let connection = normalized.connectionId\n    ? await getConnectionMetadata(\n        input.db,\n        input.workspaceId,\n        normalized.connectionId,\n        input.grant.subjectId,\n      )\n    : null;\n  if (!connection && subjectScope === \"subject\" && !normalized.connectionId) {\n    const visible = await listConnectionsMetadata(\n      input.db,\n      input.workspaceId,\n      input.grant.subjectId,\n    );\n    connection =\n      visible.find(\n        (candidate) =>\n          candidate.subjectId === input.grant.subjectId &&\n          candidate.providerDomain === normalized.providerDomain &&\n          (!normalized.kind || candidate.kind === normalized.kind) &&\n          candidate.status === \"active\",\n      ) ?? null;\n  }\n  if (!connection) {\n    throw new HTTPException(422, {\n      message: \"connectionRef does not reference a visible active connection\",\n    });\n  }\n  if (\n    (subjectScope === \"subject\" && connection.subjectId !== input.grant.subjectId) ||\n    (subjectScope === \"workspace\" && connection.subjectId !== null)\n  ) {\n    throw new HTTPException(422, {\n      message: `connectionRef does not reference a ${subjectScope}-owned connection`,\n    });\n  }\n  if (connection.status !== \"active\") {\n    throw new HTTPException(422, {\n      message: `connectionRef.connectionId is not active (${connection.status})`,\n    });\n  }\n  if (connection.providerDomain !== normalized.providerDomain) {\n    throw new HTTPException(422, {\n      message: \"connectionRef.providerDomain does not match the referenced connection\",\n    });\n  }\n  if (normalized.kind && connection.kind !== normalized.kind) {\n    throw new HTTPException(422, {\n      message: \"connectionRef.kind does not match the referenced connection\",\n    });\n  }\n  if (subjectScope === \"subject\") {\n    const genericSubjectRef = { ...normalized, kind: connection.kind };\n    delete genericSubjectRef.connectionId;\n    return genericSubjectRef;\n  }\n  return normalized;\n}\n\nfunction authDeferredMcpConnectivity(): Record<string, unknown> {\n  return {\n    mcpConnectivity: {\n      status: \"auth_deferred\",\n      checkedAt: new Date().toISOString(),\n    },\n  };\n}\n\nfunction assertRequiredMcpCredentialHeaders(\n  item: CapabilityCatalogItem,\n  headers: Record<string, string> | null,\n  connectionRef: McpServerConnectionRef | null,\n): void {\n  if (connectionRef) {\n    return;\n  }\n  const required = requiredCapabilityHeaders(item.metadata);\n  const names = new Set(Object.keys(headers ?? {}).map((name) => name.toLowerCase()));\n  const missing = required.filter((name) => !names.has(name.toLowerCase()));\n  if (missing.length > 0) {\n    throw new HTTPException(422, {\n      message: `MCP capability \"${item.name}\" requires credential header(s) ${missing.join(\", \")}; pass them in the enable request \"headers\" field`,\n    });\n  }\n  if (item.authModel && names.size === 0) {\n    throw new HTTPException(422, {\n      message: `MCP capability \"${item.name}\" requires credentials; pass them in the enable request \"headers\" field`,\n    });\n  }\n}\n\nfunction requiredCapabilityHeaders(metadata: Record<string, unknown>): string[] {\n  const value = metadata.requiredHeaders;\n  if (!Array.isArray(value)) {\n    return [];\n  }\n  return value\n    .filter((name): name is string => typeof name === \"string\" && name.trim().length > 0)\n    .map((name) => name.trim());\n}\n\nfunction requireCapabilityHeaderEncryption(settings: Settings): Uint8Array {\n  const key = environmentsEncryptionKeyBytes(settings);\n  if (!key) {\n    throw new HTTPException(503, {\n      message: \"MCP credential headers require OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY\",\n    });\n  }\n  return key;\n}\n\nexport type McpCapabilityProbeInput = {\n  id: string;\n  name: string;\n  url: string;\n  timeoutMs: number;\n  headers?: Record<string, string>;\n};\n\nexport type McpCapabilityProbeResult = {\n  toolCount: number;\n};\n\nexport type McpCapabilityProbe = (\n  input: McpCapabilityProbeInput,\n) => Promise<McpCapabilityProbeResult>;\n\nexport async function validateMcpCapabilityConnection(\n  item: CapabilityCatalogItem,\n  probe: McpCapabilityProbe = probeStreamableHttpMcpServer,\n  headers?: Record<string, string>,\n): Promise<Record<string, unknown>> {\n  if (item.kind !== \"mcp\") {\n    return {};\n  }\n  if (!item.endpointUrl || !item.runtime.mcpServerId) {\n    throw new HTTPException(422, {\n      message: \"MCP capabilities need a remote streamable HTTP endpoint before they can be enabled\",\n    });\n  }\n  try {\n    const result = await probe({\n      id: item.runtime.mcpServerId,\n      name: item.name,\n      url: item.endpointUrl,\n      timeoutMs: mcpCapabilityProbeTimeoutMs,\n      ...(headers ? { headers } : {}),\n    });\n    return {\n      mcpConnectivity: {\n        status: \"ok\",\n        checkedAt: new Date().toISOString(),\n        toolCount: result.toolCount,\n      },\n    };\n  } catch (error) {\n    throw new HTTPException(422, {\n      message: `MCP capability \"${item.name}\" could not be enabled because ${mcpProbeErrorMessage(error, item.endpointUrl)}`,\n    });\n  }\n}\n\nasync function probeStreamableHttpMcpServer(\n  input: McpCapabilityProbeInput,\n): Promise<McpCapabilityProbeResult> {\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), input.timeoutMs);\n  const client = new Client(\n    { name: \"opengeni-capability-probe\", version: \"0.1.0\" },\n    { capabilities: {} },\n  );\n  try {\n    const transport = new StreamableHTTPClientTransport(new URL(input.url), {\n      requestInit: {\n        signal: controller.signal,\n        ...(input.headers ? { headers: input.headers } : {}),\n      },\n    });\n    await client.connect(transport as unknown as Transport, {\n      timeout: input.timeoutMs,\n      maxTotalTimeout: input.timeoutMs,\n    });\n    const tools = await client.listTools(undefined, {\n      timeout: input.timeoutMs,\n      maxTotalTimeout: input.timeoutMs,\n    });\n    return { toolCount: tools.tools.length };\n  } finally {\n    clearTimeout(timeout);\n    await client.close().catch(() => undefined);\n  }\n}\n\nfunction mcpProbeErrorMessage(error: unknown, endpointUrl: string): string {\n  const message = error instanceof Error ? error.message : String(error);\n  const normalized = message.replace(/\\s+/g, \" \").trim();\n  const endpoint = safeEndpointLabel(endpointUrl);\n  if (\n    /404|405|not found|unexpected token|not valid json|invalid json|failed to parse|streamable http error|unable to connect|fetch failed|econnrefused|enotfound|timeout|aborted/i.test(\n      normalized,\n    )\n  ) {\n    return `OpenGeni could not reach a valid Streamable HTTP MCP server at ${endpoint}. Check the endpoint URL or choose a different catalog entry.`;\n  }\n  return `OpenGeni could not initialize ${endpoint}. Check the endpoint configuration or try again.`;\n}\n\nfunction safeEndpointLabel(endpointUrl: string): string {\n  try {\n    return new URL(endpointUrl).hostname || \"the configured endpoint\";\n  } catch {\n    return \"the configured endpoint\";\n  }\n}\n\nexport async function disableCapability(input: {\n  db: Database;\n  accountId: string;\n  workspaceId: string;\n  settings: Settings;\n  capabilityId: string;\n}): Promise<CapabilityInstallation> {\n  const item = await requireCatalogItem(\n    input.db,\n    input.workspaceId,\n    input.settings,\n    input.capabilityId,\n  );\n  if (item.kind === \"skill\") {\n    throw new HTTPException(409, {\n      message: \"Uninstall Skills through the Skill uninstall preview flow\",\n    });\n  }\n  if (item.kind === \"api\") {\n    throw new HTTPException(409, {\n      message: \"Remove API Integrations through the Integration instance flow\",\n    });\n  }\n  if (item.kind === \"plugin\") {\n    throw new HTTPException(409, {\n      message: \"Remove Plugins through the Plugin Package flow\",\n    });\n  }\n  if (item.kind === \"pack\") {\n    throw new HTTPException(409, {\n      message: \"Uninstall Packs through the Pack uninstall preview flow\",\n    });\n  }\n  if (item.source === \"built_in\" || item.source === \"configured\") {\n    throw new HTTPException(409, {\n      message:\n        \"built-in and configured capabilities are always available; remove them from configuration to disable them\",\n    });\n  }\n  if (!(await getCapabilityInstallation(input.db, input.workspaceId, item.id))) {\n    throw new HTTPException(409, {\n      message: \"capability is not currently enabled\",\n    });\n  }\n  return await disableCapabilityInstallation(input.db, input.workspaceId, item.id);\n}\n\nexport async function settingsWithEnabledCapabilityMcpServers(\n  db: Database,\n  workspaceId: string,\n  settings: Settings,\n  options?: {\n    subjectId?: string;\n    personalConnectionDelegations?: readonly McpPersonalConnectionDelegation[];\n    onResolvedApiIntegrations?: (integrations: readonly ApiIntegrationRuntime[]) => void;\n  },\n): Promise<Settings> {\n  const apiIntegrationsPromise = options?.subjectId\n    ? listInstalledApiIntegrations(db, workspaceId, options.subjectId)\n    : listInstalledApiIntegrationsForDelegations(\n        db,\n        workspaceId,\n        options?.personalConnectionDelegations ?? [],\n      );\n  const [enabled, apiIntegrations, codexAppsCredentialId] = await Promise.all([\n    listEnabledMcpCapabilityServers(db, workspaceId),\n    apiIntegrationsPromise,\n    resolveCodexAppsCredentialIdForRun(db, workspaceId),\n  ]);\n  options?.onResolvedApiIntegrations?.(apiIntegrations);\n  return settingsWithCodexAppsMcpServer(\n    settingsWithApiIntegrationServers(\n      settingsWithMcpCapabilityServers(settings, enabled),\n      apiIntegrations,\n    ),\n    codexAppsCredentialId !== null,\n  );\n}\n\nexport function apiIntegrationsMatchingDelegations(\n  integrations: readonly ApiIntegrationRuntime[],\n  delegations: readonly McpPersonalConnectionDelegation[],\n): ApiIntegrationRuntime[] {\n  const exact = new Set(\n    delegations.map((delegation) =>\n      [\n        delegation.serverId,\n        delegation.connectionId,\n        delegation.providerDomain.toLowerCase(),\n        delegation.kind ?? \"\",\n      ].join(\"\\u0000\"),\n    ),\n  );\n  return integrations.filter((integration) => {\n    const ref = integration.connectionRef;\n    if (!ref || ref.subjectScope !== \"subject\" || !ref.connectionId) return false;\n    return exact.has(\n      [\n        integration.serverId,\n        ref.connectionId,\n        ref.providerDomain.toLowerCase(),\n        ref.kind ?? \"\",\n      ].join(\"\\u0000\"),\n    );\n  });\n}\n\nasync function listInstalledApiIntegrationsForDelegations(\n  db: Database,\n  workspaceId: string,\n  delegations: readonly McpPersonalConnectionDelegation[],\n): Promise<ApiIntegrationRuntime[]> {\n  const workspace = await listInstalledApiIntegrations(db, workspaceId);\n  if (delegations.length === 0) return workspace;\n  const owners = [...new Set(delegations.map((delegation) => delegation.ownerSubjectId))];\n  const delegatedByOwner = await Promise.all(\n    owners.map(async (subjectId) =>\n      apiIntegrationsMatchingDelegations(\n        await listInstalledApiIntegrations(db, workspaceId, subjectId),\n        delegations.filter((delegation) => delegation.ownerSubjectId === subjectId),\n      ),\n    ),\n  );\n  const byServerId = new Map(workspace.map((integration) => [integration.serverId, integration]));\n  for (const integration of delegatedByOwner.flat())\n    byServerId.set(integration.serverId, integration);\n  return [...byServerId.values()];\n}\n\nexport function settingsWithApiIntegrationServers(\n  settings: Settings,\n  integrations: readonly ApiIntegrationRuntime[],\n): Settings {\n  if (integrations.length === 0) return settings;\n  const existingIds = new Set(settings.mcpServers.map((server) => server.id));\n  const dynamicServers = integrations\n    .filter((integration) => !existingIds.has(integration.serverId))\n    .map((integration) => ({\n      id: integration.serverId,\n      name: integration.name,\n      // Local adapters never send MCP traffic to this URL. Keeping the exact\n      // provider base URL in Settings preserves destination identity for policy,\n      // diagnostics, and the stable session-MCP approval fallback.\n      url: integration.baseUrl,\n      allowedTools: [...integration.allowedTools],\n      cacheToolsList: true,\n      requireApproval: integration.requireApproval,\n      ...(integration.connectionRef ? { connectionRef: integration.connectionRef } : {}),\n    }));\n  return dynamicServers.length\n    ? { ...settings, mcpServers: [...settings.mcpServers, ...dynamicServers] }\n    : settings;\n}\n\n/**\n * Resolve executable Apps authority. The connector must remain active and its\n * exact owner must still hold workspace connection-management permission.\n */\nexport async function resolveCodexAppsCredentialIdForRun(\n  db: Database,\n  workspaceId: string,\n): Promise<string | null> {\n  const authorization = await getCodexAppsCredentialAuthorizationForRun(db, workspaceId);\n  if (!authorization) return null;\n  const grant = await getWorkspaceGrant(db, authorization.ownerSubjectId, workspaceId);\n  return grant && hasPermission(grant.permissions, \"connections:write\")\n    ? authorization.credentialId\n    : null;\n}\n\n/**\n * Register Codex Apps as an optional runtime MCP only when the deployment is\n * enabled and this workspace has an active explicit Apps designation.\n * Registration only makes the server selectable; session policy decides\n * whether the model sees it.\n */\nexport function settingsWithCodexAppsMcpServer(\n  settings: Settings,\n  credentialAvailable: boolean,\n): Settings {\n  const canonicalServer = {\n    id: CODEX_APPS_MCP_SERVER_ID,\n    name: CODEX_APPS_MCP_SERVER_NAME,\n    url: CODEX_APPS_MCP_URL,\n    timeoutMs: CODEX_APPS_STARTUP_TIMEOUT_MS,\n    // Availability is credential-specific, so discover on every run.\n    cacheToolsList: false,\n  };\n  // The id is a credential-routing trust boundary. Discard every configured or\n  // capability-provided claimant before optionally appending the one canonical\n  // endpoint; preserving an existing id could send the designated bearer to an\n  // attacker-controlled URL.\n  const withoutReservedId = settings.mcpServers.filter(\n    (server) => server.id !== CODEX_APPS_MCP_SERVER_ID,\n  );\n  if (!settings.codexConnectedAppsEnabled || !credentialAvailable) {\n    return withoutReservedId.length === settings.mcpServers.length\n      ? settings\n      : { ...settings, mcpServers: withoutReservedId };\n  }\n  const existing = settings.mcpServers.at(-1);\n  if (\n    withoutReservedId.length === settings.mcpServers.length - 1 &&\n    existing !== undefined &&\n    Object.keys(existing).length === Object.keys(canonicalServer).length &&\n    Object.entries(canonicalServer).every(\n      ([key, value]) => existing[key as keyof typeof existing] === value,\n    )\n  ) {\n    return settings;\n  }\n  return {\n    ...settings,\n    mcpServers: [...withoutReservedId, canonicalServer],\n  };\n}\n\nexport function settingsWithMcpCapabilityServers(\n  settings: Settings,\n  enabled: EnabledMcpCapabilityServer[],\n): Settings {\n  if (enabled.length === 0) {\n    return settings;\n  }\n  const encryptionKey = environmentsEncryptionKeyBytes(settings);\n  const existingIds = new Set(settings.mcpServers.map((server) => server.id));\n  const dynamicServers = enabled\n    .filter((server) => !existingIds.has(server.id))\n    .flatMap((server) => {\n      const headers = decryptedCapabilityHeaders(server, encryptionKey);\n      if (headers === \"unavailable\" && !server.connectionRef) {\n        // Without its credential headers this server can only fail auth at\n        // connect time and break agent turns; leave it out of the run.\n        return [];\n      }\n      return [\n        {\n          id: server.id,\n          name: server.name,\n          url: server.url,\n          ...(server.allowedTools ? { allowedTools: server.allowedTools } : {}),\n          ...(server.timeoutMs ? { timeoutMs: server.timeoutMs } : {}),\n          cacheToolsList: server.cacheToolsList ?? false,\n          ...(server.requireApproval !== undefined\n            ? { requireApproval: server.requireApproval }\n            : {}),\n          ...(headers && headers !== \"unavailable\" ? { headers } : {}),\n          ...(server.connectionRef ? { connectionRef: server.connectionRef } : {}),\n        },\n      ];\n    });\n  return dynamicServers.length\n    ? { ...settings, mcpServers: [...settings.mcpServers, ...dynamicServers] }\n    : settings;\n}\n\nexport async function discoverMcpRegistryCapabilities(input: {\n  query?: string;\n  limit?: number;\n  fetchImpl?: McpRegistryFetch;\n  timeoutMs?: number;\n}): Promise<CapabilityCatalogItem[]> {\n  const query = (input.query ?? \"\").trim().toLowerCase();\n  const limit = Math.min(100, Math.max(1, Math.floor(input.limit ?? 50)));\n  const items: CapabilityCatalogItem[] = [];\n  const seen = new Set<string>();\n  const fetchOptions: { fetchImpl?: McpRegistryFetch; timeoutMs?: number } = {};\n  if (input.fetchImpl) {\n    fetchOptions.fetchImpl = input.fetchImpl;\n  }\n  if (input.timeoutMs !== undefined) {\n    fetchOptions.timeoutMs = input.timeoutMs;\n  }\n  let cursor: string | undefined;\n  let pages = 0;\n\n  while (items.length < limit && pages < mcpRegistryMaxPages) {\n    pages += 1;\n    const url = new URL(\"/v0.1/servers\", officialMcpRegistryUrl);\n    url.searchParams.set(\"limit\", String(limit));\n    url.searchParams.set(\"version\", \"latest\");\n    if (query) {\n      url.searchParams.set(\"search\", query);\n    }\n    if (cursor) {\n      url.searchParams.set(\"cursor\", cursor);\n    }\n    const page = await fetchMcpRegistryPage(url, fetchOptions);\n    for (const entry of page.servers ?? []) {\n      const item = mcpRegistryEntryToCatalogItem(entry);\n      if (!item || seen.has(item.id)) {\n        continue;\n      }\n      if (query && !catalogSearchText(item).includes(query)) {\n        continue;\n      }\n      seen.add(item.id);\n      items.push(item);\n      if (items.length >= limit) {\n        break;\n      }\n    }\n    cursor = typeof page.metadata?.nextCursor === \"string\" ? page.metadata.nextCursor : undefined;\n    if (!cursor) {\n      break;\n    }\n  }\n\n  return items;\n}\n\nexport { officialMcpRegistryUrl };\n\ntype McpRegistryFetch = (input: URL, init?: RequestInit) => Promise<Response>;\n\nasync function fetchMcpRegistryPage(\n  url: URL,\n  options: {\n    fetchImpl?: McpRegistryFetch;\n    timeoutMs?: number;\n  } = {},\n): Promise<McpRegistryPage> {\n  const fetchImpl = options.fetchImpl ?? fetch;\n  const controller = new AbortController();\n  const timeout = setTimeout(\n    () => controller.abort(),\n    options.timeoutMs ?? mcpRegistryFetchTimeoutMs,\n  );\n  try {\n    const response = await fetchImpl(url, { signal: controller.signal });\n    if (!response.ok) {\n      throw new HTTPException(502, {\n        message: `MCP registry returned ${response.status}`,\n      });\n    }\n    return (await response.json()) as McpRegistryPage;\n  } catch (error) {\n    if (error instanceof HTTPException) {\n      throw error;\n    }\n    if (error instanceof Error && error.name === \"AbortError\") {\n      throw new HTTPException(504, {\n        message: \"MCP registry request timed out\",\n      });\n    }\n    throw new HTTPException(502, {\n      message: `MCP registry request failed: ${error instanceof Error ? error.message : String(error)}`,\n    });\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\nasync function requireCatalogItem(\n  db: Database,\n  workspaceId: string,\n  settings: Settings,\n  capabilityId: string,\n): Promise<CapabilityCatalogItem> {\n  const catalog = await buildCapabilityCatalog({ db, workspaceId, settings });\n  const item =\n    catalog.items.find((candidate) => candidate.id === capabilityId) ??\n    (await getCapabilityCatalogItem(db, workspaceId, capabilityId));\n  if (!item) {\n    throw new HTTPException(404, { message: \"capability not found\" });\n  }\n  return item;\n}\n\nfunction packCatalogItem(\n  pack: ReturnType<typeof listCapabilityPacks>[number],\n  source: \"built_in\" | \"manual\",\n): CapabilityCatalogItem {\n  const customMetadata = { ...pack.metadata };\n  for (const key of [\n    \"packId\",\n    \"version\",\n    \"connectors\",\n    \"knowledge\",\n    \"scheduledTaskTemplates\",\n    \"sandboxImage\",\n    \"sandboxProviderImages\",\n    \"skills\",\n  ]) {\n    delete customMetadata[key];\n  }\n  return CapabilityCatalogItem.parse({\n    id: `pack:${pack.id}`,\n    kind: \"pack\",\n    source,\n    name: pack.name,\n    description: pack.description,\n    category: pack.category,\n    tags: [pack.role, pack.category, \"pack\"],\n    tools: pack.tools,\n    runtime: {\n      available: true,\n      notes: \"Enables role-scoped tools, connectors, knowledge, and scheduled-task templates.\",\n    },\n    metadata: {\n      ...customMetadata,\n      packId: pack.id,\n      version: pack.version,\n      connectors: pack.connectors,\n      knowledge: pack.knowledge,\n      scheduledTaskTemplates: pack.scheduledTaskTemplates,\n      ...(pack.variableSet ? { variableSet: pack.variableSet } : {}),\n      // Runtime composition surface only: skill names, never file content.\n      ...(pack.sandboxImage ? { sandboxImage: pack.sandboxImage } : {}),\n      ...(pack.sandboxProviderImages ? { sandboxProviderImages: pack.sandboxProviderImages } : {}),\n      ...(pack.skills.length > 0 ? { skills: pack.skills.map((skill) => skill.name) } : {}),\n    },\n  });\n}\n\nfunction configuredMcpCatalogItems(settings: Settings): CapabilityCatalogItem[] {\n  return (\n    settings.mcpServers\n      // OpenGeni, Files, and Document Search are native runtime surfaces. They\n      // remain available to sessions through configuration, but are not things a\n      // user installs, connects, or enables in the Capabilities control center.\n      .filter(\n        (server) =>\n          server.id !== CODEX_APPS_MCP_SERVER_ID && !firstPartyMcpServerIds.has(server.id),\n      )\n      .map((server) =>\n        CapabilityCatalogItem.parse({\n          id: `mcp:${server.id}`,\n          kind: \"mcp\",\n          source: \"configured\",\n          name: server.name ?? server.id,\n          description: null,\n          category: \"configured\",\n          tags: [\"mcp\", ...(server.allowedTools?.length ? [\"limited-tools\"] : [])],\n          endpointUrl: server.url,\n          tools: [{ kind: \"mcp\", id: server.id }],\n          runtime: {\n            available: true,\n            mcpServerId: server.id,\n            transport: \"streamable-http\",\n            notes: \"Managed by this OpenGeni deployment through OPENGENI_MCP_SERVERS.\",\n          },\n          metadata: {\n            mcpServerId: server.id,\n            allowedTools: server.allowedTools ?? [],\n            cacheToolsList: server.cacheToolsList,\n          },\n        }),\n      )\n  );\n}\n\nfunction isReservedCodexAppsCatalogItem(item: CapabilityCatalogItem): boolean {\n  return (\n    item.id === `mcp:${CODEX_APPS_MCP_SERVER_ID}` ||\n    (item.kind === \"mcp\" &&\n      (item.runtime.mcpServerId === CODEX_APPS_MCP_SERVER_ID ||\n        item.metadata.mcpServerId === CODEX_APPS_MCP_SERVER_ID))\n  );\n}\n\n/**\n * The Apps MCP is not a configured server and is not a user-installable\n * capability. It is a deployment-gated, workspace-designated runtime surface,\n * so project it into the same catalog the web picker already consumes while\n * keeping its authorization state server-derived and explicit.\n */\nexport function codexAppsCatalogItem(available: boolean): CapabilityCatalogItem {\n  return CapabilityCatalogItem.parse({\n    id: `mcp:${CODEX_APPS_MCP_SERVER_ID}`,\n    kind: \"mcp\",\n    source: \"built_in\",\n    name: \"Codex Apps\",\n    description:\n      \"Use the ChatGPT Apps designated for this workspace. Sessions include this surface by default when it is authorized; explicit policies can opt out.\",\n    category: \"productivity\",\n    tags: [\"mcp\", \"codex\", \"connected-apps\"],\n    providerDomain: \"chatgpt.com\",\n    surfaceType: \"codex_apps\",\n    transport: \"streamable-http\",\n    mcpUrl: CODEX_APPS_MCP_URL,\n    authKind: \"none\",\n    tools: [{ kind: \"mcp\", id: CODEX_APPS_MCP_SERVER_ID }],\n    runtime: {\n      available,\n      ...(available ? { mcpServerId: CODEX_APPS_MCP_SERVER_ID } : {}),\n      transport: \"streamable-http\",\n      notes: available\n        ? \"Available through the active workspace Apps designation.\"\n        : \"Unavailable until an active Codex Apps credential is designated for this workspace.\",\n    },\n    enabled: available,\n    enabledReason: available ? \"designated Apps credential\" : \"no active Apps designation\",\n    metadata: {\n      mcpServerId: CODEX_APPS_MCP_SERVER_ID,\n      authorization: \"workspace_designation\",\n    },\n  });\n}\n\ntype SocialProviderIntegrationDefinition = {\n  provider: \"x\" | \"reddit\";\n  name: string;\n  description: string;\n  providerDomain: string;\n  homepageUrl: string;\n  tags: string[];\n};\n\nconst SOCIAL_PROVIDER_INTEGRATIONS: readonly SocialProviderIntegrationDefinition[] = [\n  {\n    provider: \"x\",\n    name: \"X\",\n    description:\n      \"Connect one or more X accounts for live search, mentions, thread context, post sync, and permission-controlled replies.\",\n    providerDomain: \"x.com\",\n    homepageUrl: \"https://x.com\",\n    tags: [\"api\", \"x\", \"twitter\", \"social\", \"marketing\"],\n  },\n  {\n    provider: \"reddit\",\n    name: \"Reddit\",\n    description:\n      \"Connect one or more Reddit accounts for search, mentions, thread context, account sync, and permission-controlled replies.\",\n    providerDomain: \"reddit.com\",\n    homepageUrl: \"https://www.reddit.com\",\n    tags: [\"api\", \"reddit\", \"social\", \"community\", \"marketing\"],\n  },\n];\n\nconst SOCIAL_PROVIDER_TOOL_NAMES = {\n  x: [\n    \"x_accounts_list\",\n    \"x_search_live\",\n    \"x_mentions_live\",\n    \"x_thread_fetch\",\n    \"x_posts_sync\",\n    \"x_post_reply\",\n  ],\n  reddit: [\n    \"reddit_accounts_list\",\n    \"reddit_search_live\",\n    \"reddit_mentions_live\",\n    \"reddit_thread_fetch\",\n    \"reddit_posts_sync\",\n    \"reddit_post_reply\",\n  ],\n} as const;\n\n/**\n * The first-party Fiken accounting connector tile. Enablement is derived from\n * the workspace-shared verified Fiken connection (either lane), mirroring how\n * the social provider tiles derive theirs from social connections.\n */\nfunction fikenCatalogItem(fikenConnections: ConnectionMetadata[]): CapabilityCatalogItem {\n  const fikenConnection = preferredFikenConnection(fikenConnections);\n  const fikenEnabled =\n    fikenConnection?.status === \"active\" || fikenConnection?.status === \"needs_reauth\";\n  return CapabilityCatalogItem.parse({\n    id: \"api:fiken\",\n    kind: \"api\",\n    source: \"built_in\",\n    name: \"Fiken\",\n    description:\n      \"Connect Fiken accounting for contacts, products, invoices, invoice drafts, purchases, sales, and bank accounts.\",\n    category: \"finance\",\n    tags: [\"api\", \"fiken\", \"accounting\", \"invoicing\", \"norway\"],\n    homepageUrl: \"https://fiken.no\",\n    authModel: \"personal_api_token\",\n    providerDomain: FIKEN_PROVIDER_DOMAIN,\n    surfaceType: \"first_party_fiken\",\n    authKind: \"api_key\",\n    tools: [{ kind: \"mcp\", id: \"opengeni\" }],\n    runtime: {\n      available: true,\n      mcpServerId: \"opengeni\",\n      notes: \"Fiken access is provided through OpenGeni's first-party fiken tools.\",\n    },\n    enabled: fikenEnabled,\n    enabledReason: fikenEnabled\n      ? fikenConnection.status === \"active\"\n        ? \"workspace Fiken connection active\"\n        : \"workspace Fiken connection needs reconnection\"\n      : null,\n    metadata: {\n      connectorMode: \"first_party_fiken\",\n      ownership: \"workspace\",\n      // Derived from the contracts catalog so a new fiken_* tool cannot be\n      // registered without also appearing on the capability tile.\n      firstPartyMcpTools: FIRST_PARTY_MCP_TOOL_NAMES.filter((name) => name.startsWith(\"fiken_\")),\n    },\n  });\n}\n\nfunction providerIntegrationCatalogItems(\n  socialConnections: SocialConnection[],\n): CapabilityCatalogItem[] {\n  return SOCIAL_PROVIDER_INTEGRATIONS.map((definition) => {\n    const counts = socialConnectionCounts(socialConnections, definition.provider);\n    const enabled = counts.connected + counts.needsReauth > 0;\n    return CapabilityCatalogItem.parse({\n      id: `api:${definition.provider}`,\n      kind: \"api\",\n      source: \"built_in\",\n      name: definition.name,\n      description: definition.description,\n      category: \"social-media\",\n      tags: definition.tags,\n      homepageUrl: definition.homepageUrl,\n      authModel: \"oauth2_authorization_code_pkce\",\n      providerDomain: definition.providerDomain,\n      surfaceType: \"provider_integration\",\n      authKind: \"oauth2\",\n      tools: [{ kind: \"mcp\", id: \"opengeni\" }],\n      runtime: {\n        available: true,\n        mcpServerId: \"opengeni\",\n        notes:\n          \"OpenGeni's social provider adapter routes every call through an exact visible account Connection.\",\n      },\n      enabled,\n      enabledReason: socialConnectionSummary(counts),\n      provenance: \"OpenGeni provider adapter\",\n      metadata: {\n        providerAdapter: \"social\",\n        provider: definition.provider,\n        connectionCounts: counts,\n        runtimeNamespace: \"social\",\n        firstPartyMcpTools: SOCIAL_PROVIDER_TOOL_NAMES[definition.provider],\n      },\n    });\n  });\n}\n\n/**\n * Native product connection recommendations are intentionally separate from\n * the installable catalog returned to the Capabilities UI. Agents may still\n * recommend the owning product flow without manufacturing an enabled catalog\n * row for GitHub resources, Documents, schedules, or other platform features.\n */\nexport function nativeConnectionCapabilityRecommendations(): CapabilityCatalogItem[] {\n  return [\n    CapabilityCatalogItem.parse({\n      id: \"api:github-app\",\n      kind: \"api\",\n      source: \"built_in\",\n      name: \"GitHub App\",\n      description: \"Connect repositories through OpenGeni's GitHub resource picker.\",\n      category: \"source-control\",\n      tags: [\"github\", \"repositories\", \"source-control\"],\n      homepageUrl: \"https://github.com\",\n      providerDomain: \"github.com\",\n      authModel: \"github_app_owner_consent\",\n      authKind: \"oauth2\",\n      surfaceType: \"first_party_github\",\n      tools: [{ kind: \"mcp\", id: \"opengeni\" }],\n      runtime: {\n        available: true,\n        notes:\n          \"GitHub credentials stay host-owned; a workspace owner must approve repository access.\",\n      },\n      lifecycle: {\n        status: \"available\",\n        readiness: \"setup_required\",\n        detail: \"Connect GitHub from the repository resource flow.\",\n        managedBy: \"platform\",\n      },\n      actions: [\"connect\", \"inspect\"],\n      metadata: {\n        endpointPath: \"/v1/workspaces/{workspaceId}/github/app\",\n        firstPartyMcpTools: [\"github_connect_link\", \"github_repositories_list\"],\n        recommendationOnly: true,\n      },\n    }),\n  ];\n}\n\nfunction socialConnectionCounts(\n  connections: SocialConnection[],\n  provider: \"x\" | \"reddit\",\n): { connected: number; needsReauth: number; disabled: number; total: number } {\n  const matching = connections.filter((connection) => connection.provider === provider);\n  return {\n    connected: matching.filter((connection) => connection.status === \"connected\").length,\n    needsReauth: matching.filter((connection) => connection.status === \"needs_reauth\").length,\n    disabled: matching.filter((connection) => connection.status === \"disabled\").length,\n    total: matching.length,\n  };\n}\n\nfunction socialConnectionSummary(counts: ReturnType<typeof socialConnectionCounts>): string | null {\n  const parts: string[] = [];\n  if (counts.connected > 0) {\n    parts.push(`${counts.connected} connected account${counts.connected === 1 ? \"\" : \"s\"}`);\n  }\n  if (counts.needsReauth > 0) {\n    parts.push(\n      `${counts.needsReauth} account${counts.needsReauth === 1 ? \"\" : \"s\"} need${\n        counts.needsReauth === 1 ? \"s\" : \"\"\n      } reconnection`,\n    );\n  }\n  if (counts.disabled > 0) {\n    parts.push(`${counts.disabled} disconnected account${counts.disabled === 1 ? \"\" : \"s\"}`);\n  }\n  return parts.length > 0 ? parts.join(\"; \") : null;\n}\n\n/**\n * Curated skills are catalogued independently from the always-mounted bundle.\n * The runtime helper only returns entries whose reviewed artifact is present,\n * so a deployment that omits optional library assets does not advertise a\n * skill it cannot materialize.\n */\nasync function discoverCuratedSkillLibraryItems(): Promise<CapabilityCatalogItem[]> {\n  return listSkillLibraryEntries().map((entry) => curatedSkillCatalogItem(entry));\n}\n\nfunction curatedSkillCatalogItem(entry: SkillLibraryEntry): CapabilityCatalogItem {\n  return CapabilityCatalogItem.parse({\n    id: `skill:${entry.id}`,\n    kind: \"skill\",\n    source: \"library\",\n    name: entry.name,\n    description: entry.description,\n    category: entry.category,\n    tags: [...entry.tags],\n    homepageUrl: entry.sourceUrl,\n    provenance: entry.provenance,\n    tier: \"verified\",\n    runtime: {\n      available: true,\n      notes: \"Available as an explicit immutable opt-in skill selection.\",\n    },\n    metadata: {\n      libraryId: entry.id,\n      version: entry.version,\n      contentSha256: entry.contentSha256,\n      sourceCommit: entry.sourceCommit,\n      sourceUrl: entry.sourceUrl,\n      provenance: entry.provenance,\n      license: entry.license,\n      documentationUrl: entry.documentationUrl,\n      compatibility: entry.compatibility,\n      upgrade: entry.upgrade,\n      artifactPath: entry.relativePath,\n    },\n  });\n}\n\nfunction installedSkillCatalogItem(skill: InstalledSkillSummary): CapabilityCatalogItem {\n  return CapabilityCatalogItem.parse({\n    id: skill.capabilityId,\n    kind: \"skill\",\n    source: skill.source === \"library\" ? \"library\" : \"manual\",\n    name: skill.name,\n    description: skill.description,\n    category: skill.category,\n    tags: skill.tags,\n    homepageUrl: skill.repositoryUrl,\n    installUrl: skill.sourceUrl,\n    provenance: skill.provenance,\n    tier: skill.source === \"library\" ? \"verified\" : \"community\",\n    runtime: {\n      available: true,\n      notes: \"Available from an immutable Skill installation.\",\n    },\n    metadata: {\n      version: skill.version,\n      contentSha256: skill.contentSha256,\n      sourceCommit: skill.sourceCommit,\n      sourcePath: skill.sourcePath,\n      sourceUrl: skill.sourceUrl,\n      repositoryUrl: skill.repositoryUrl,\n      provenance: skill.provenance,\n      license: skill.license,\n      installedSkill: installedSkillMetadata(skill),\n    },\n  });\n}\n\nfunction installedSkillMetadata(skill: InstalledSkillSummary): Record<string, unknown> {\n  return {\n    pluginKey: skill.pluginKey,\n    installationVersion: skill.installationVersion,\n    source: skill.source,\n    version: skill.version,\n    sourceCommit: skill.sourceCommit,\n    contentSha256: skill.contentSha256,\n    fileCount: skill.fileCount,\n    totalBytes: skill.totalBytes,\n    installedAt: skill.installedAt,\n    updatedAt: skill.updatedAt,\n    owners: skill.owners.map((owner) => ({ ...owner })),\n  };\n}\n\nfunction stringMetadata(value: unknown): string | null {\n  return typeof value === \"string\" && value.trim().length > 0 ? value.trim() : null;\n}\n\nfunction isSocialProviderIntegration(item: CapabilityCatalogItem): boolean {\n  return (\n    item.surfaceType === \"first_party_social\" ||\n    (item.surfaceType === \"provider_integration\" && item.metadata.providerAdapter === \"social\")\n  );\n}\n\nfunction socialProviderConnectionCounts(item: CapabilityCatalogItem): {\n  connected: number;\n  needsReauth: number;\n} {\n  const value = item.metadata.connectionCounts;\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    return {\n      connected: item.enabled && !item.enabledReason?.includes(\"reconnection\") ? 1 : 0,\n      needsReauth: item.enabledReason?.includes(\"reconnection\") ? 1 : 0,\n    };\n  }\n  const record = value as Record<string, unknown>;\n  return {\n    connected:\n      typeof record.connected === \"number\" && Number.isInteger(record.connected)\n        ? Math.max(0, record.connected)\n        : 0,\n    needsReauth:\n      typeof record.needsReauth === \"number\" && Number.isInteger(record.needsReauth)\n        ? Math.max(0, record.needsReauth)\n        : 0,\n  };\n}\n\nexport function applyCapabilityEnablement(\n  item: CapabilityCatalogItem,\n  installation: CapabilityInstallation | undefined,\n  activePackIds: Set<string>,\n): CapabilityCatalogItem {\n  if (item.kind === \"skill\" || item.kind === \"api\" || item.kind === \"plugin\") {\n    return { ...item, enabled: false, enabledReason: null, connectionRef: null };\n  }\n  if (item.kind === \"pack\") {\n    const enabled = activePackIds.has(packIdFromCapabilityId(item.id));\n    return {\n      ...item,\n      enabled,\n      enabledReason: enabled ? \"enabled\" : null,\n    };\n  }\n  if (isSocialProviderIntegration(item)) {\n    // Provider-integration state is derived from every authoritative visible\n    // social Connection while the catalog is built. The catalog summary never\n    // publishes a personal connection UUID or collapses many accounts to one.\n    return { ...item, connectionRef: null };\n  }\n  if (item.surfaceType === \"first_party_fiken\") {\n    // Fiken connector state is derived from the authoritative workspace\n    // connection row while the catalog is built; browseable never means an\n    // account is already connected.\n    return { ...item, connectionRef: null };\n  }\n  if (item.surfaceType === \"codex_apps\") {\n    // Unlike ordinary built-ins, Apps availability is derived from the exact\n    // active workspace designation above. Do not overwrite it with the\n    // generic source-based \"built in\" enablement rule.\n    return { ...item, connectionRef: null };\n  }\n  if (item.source === \"configured\") {\n    return {\n      ...item,\n      enabled: true,\n      enabledReason: \"managed by deployment\",\n      connectionRef: null,\n    };\n  }\n  if (item.source === \"built_in\") {\n    // \"Built in\" describes provenance, not lifecycle. Native product\n    // surfaces and first-party connectors must project their authoritative\n    // state explicitly above rather than becoming enabled by taxonomy.\n    return { ...item, connectionRef: null };\n  }\n  const activeInstallation = installation?.status === \"active\";\n  const enabled = !!activeInstallation && capabilityInstallationRuntimeReady(item, installation);\n  return {\n    ...item,\n    enabled,\n    enabledReason: enabled ? \"enabled\" : null,\n    connectionRef: enabled && installation ? installationConnectionRef(installation.config) : null,\n  };\n}\n\nfunction applyCapabilityLifecycle(item: CapabilityCatalogItem): CapabilityCatalogItem {\n  if (item.source === \"configured\") {\n    return {\n      ...item,\n      lifecycle: {\n        status: \"managed\",\n        readiness: item.runtime.available ? \"ready\" : \"unavailable\",\n        detail: item.runtime.notes,\n        managedBy: \"deployment\",\n      },\n      actions: [\"inspect\"],\n    };\n  }\n\n  if (!item.runtime.available) {\n    return {\n      ...item,\n      lifecycle: {\n        status: \"unavailable\",\n        readiness: \"unavailable\",\n        detail: item.runtime.notes,\n        managedBy: item.source === \"built_in\" ? \"platform\" : null,\n      },\n      actions: [\"inspect\"],\n    };\n  }\n\n  if (isSocialProviderIntegration(item)) {\n    const counts = socialProviderConnectionCounts(item);\n    const needsAttention = counts.needsReauth > 0;\n    const connected = counts.connected > 0;\n    return {\n      ...item,\n      lifecycle: {\n        status: needsAttention ? \"needs_attention\" : connected ? \"connected\" : \"available\",\n        readiness: needsAttention ? \"attention\" : connected ? \"ready\" : \"setup_required\",\n        detail: item.enabledReason,\n        managedBy: null,\n      },\n      actions: needsAttention\n        ? [\"repair\", \"connect\", \"disconnect\", \"inspect\"]\n        : connected\n          ? [\"connect\", \"configure\", \"disconnect\", \"inspect\"]\n          : [\"connect\", \"inspect\"],\n    };\n  }\n\n  if (item.surfaceType === \"codex_apps\") {\n    return {\n      ...item,\n      lifecycle: {\n        status: item.enabled ? \"connected\" : \"available\",\n        readiness: item.enabled ? \"ready\" : \"setup_required\",\n        detail: item.enabledReason,\n        managedBy: \"platform\",\n      },\n      actions: item.enabled ? [\"configure\", \"disconnect\", \"inspect\"] : [\"connect\", \"inspect\"],\n    };\n  }\n\n  const installed = item.enabled;\n  const actions: CapabilityAction[] = installed\n    ? item.kind === \"pack\" || item.kind === \"skill\" || item.kind === \"plugin\"\n      ? [\"configure\", \"update\", \"uninstall\", \"inspect\"]\n      : [\"configure\", \"disconnect\", \"inspect\"]\n    : item.kind === \"mcp\" || item.kind === \"api\"\n      ? [\"connect\", \"inspect\"]\n      : [\"install\", \"inspect\"];\n  return {\n    ...item,\n    lifecycle: {\n      status: installed\n        ? item.kind === \"mcp\" || item.kind === \"api\"\n          ? \"ready\"\n          : \"installed\"\n        : \"available\",\n      readiness: installed ? \"ready\" : \"setup_required\",\n      detail: item.enabledReason,\n      managedBy: item.source === \"built_in\" ? \"platform\" : \"workspace\",\n    },\n    actions,\n  };\n}\n\nfunction applyInstalledSkillEnablement(\n  item: CapabilityCatalogItem,\n  installation: InstalledSkillSummary | undefined,\n): CapabilityCatalogItem {\n  if (!installation) {\n    return { ...item, enabled: false, enabledReason: null, connectionRef: null };\n  }\n  const catalogVersion = stringMetadata(item.metadata.version);\n  const current =\n    catalogVersion === null ||\n    (catalogVersion === installation.version &&\n      stringMetadata(item.metadata.contentSha256) === installation.contentSha256 &&\n      stringMetadata(item.metadata.sourceCommit) === installation.sourceCommit);\n  return {\n    ...item,\n    enabled: true,\n    enabledReason: current\n      ? \"explicitly installed\"\n      : `version ${installation.version} installed; update available`,\n    connectionRef: null,\n    metadata: {\n      ...item.metadata,\n      installedSkill: installedSkillMetadata(installation),\n      updateAvailable: !current,\n    },\n  };\n}\n\n/**\n * The connection an installation was enabled with, when the enable-time\n * connectionRef fully resolved to one (config.connectionRef is set only by\n * the enable path — see enableCapability). Headers-enabled and credential-\n * free installations never set it, so this returns null for them.\n */\nfunction installationConnectionRef(\n  config: Record<string, unknown>,\n): CapabilityCatalogItem[\"connectionRef\"] {\n  const ref = config.connectionRef;\n  if (!ref || typeof ref !== \"object\") {\n    return null;\n  }\n  const { connectionId, providerDomain, kind, subjectScope } = ref as Record<string, unknown>;\n  if (typeof providerDomain !== \"string\" || typeof kind !== \"string\") {\n    return null;\n  }\n  if (subjectScope === \"subject\") {\n    // Never project a personal connection UUID through workspace-visible\n    // capability configuration, including legacy rows that still contain one.\n    return { providerDomain, kind, subjectScope: \"subject\" };\n  }\n  if (typeof connectionId !== \"string\") {\n    return null;\n  }\n  return { connectionId, providerDomain, kind };\n}\n\nfunction dedupeCatalogItems(items: CapabilityCatalogItem[]): CapabilityCatalogItem[] {\n  const byId = new Map<string, CapabilityCatalogItem>();\n  for (const item of items) {\n    // Curated library entries are runtime-managed and must not be replaced by\n    // stale/manual rows with the same reserved skill id. Other catalog sources\n    // retain the historical last-write-wins behavior below.\n    if (item.kind === \"skill\" && item.source === \"library\" && byId.has(item.id)) {\n      byId.set(item.id, item);\n      continue;\n    }\n    const existing = byId.get(item.id);\n    if (existing?.kind === \"skill\" && existing.source === \"library\") {\n      continue;\n    }\n    byId.set(item.id, item);\n  }\n  return [...byId.values()];\n}\n\nfunction compareCatalogItems(a: CapabilityCatalogItem, b: CapabilityCatalogItem): number {\n  return `${a.kind}:${a.category}:${a.name}`.localeCompare(`${b.kind}:${b.category}:${b.name}`);\n}\n\nexport type CapabilityCatalogSearchMatch = {\n  item: CapabilityCatalogItem;\n  score: number;\n  matchedOn: Array<\"name\" | \"provider\" | \"tag\" | \"category\" | \"description\" | \"id\">;\n};\n\n/**\n * Deterministically rank the already-merged workspace catalog for an agent.\n * The caller still owns live authorization checks (GitHub binding, OAuth row,\n * and so on); this function searches metadata only and never probes a provider\n * or exposes credential/setup prose to the model.\n */\nexport function searchCapabilityCatalogItems(\n  items: readonly CapabilityCatalogItem[],\n  query: string,\n  limit = 8,\n): CapabilityCatalogSearchMatch[] {\n  const phrase = normalizeCapabilitySearchText(query);\n  const tokens = [...new Set(phrase.split(\" \").filter(Boolean))].slice(0, 24);\n  if (tokens.length === 0) return [];\n  const boundedLimit = Math.min(20, Math.max(1, Math.trunc(limit)));\n  const weightedFields = (item: CapabilityCatalogItem) =>\n    [\n      [\"name\", item.name, 100],\n      [\"provider\", item.providerDomain ?? \"\", 80],\n      [\"tag\", item.tags.join(\" \"), 50],\n      [\"category\", item.category, 30],\n      [\"id\", item.id, 25],\n      [\"description\", item.description ?? \"\", 15],\n    ] as const;\n\n  return items\n    .filter((item) => capabilityCatalogItemIsTrustedForExposure(item))\n    .flatMap((item): CapabilityCatalogSearchMatch[] => {\n      let score = 0;\n      const matchedOn = new Set<CapabilityCatalogSearchMatch[\"matchedOn\"][number]>();\n      for (const [field, raw, weight] of weightedFields(item)) {\n        const value = normalizeCapabilitySearchText(raw);\n        if (!value) continue;\n        const words = value.split(\" \");\n        if (value.includes(phrase)) {\n          score += Math.round(weight * 1.5);\n          matchedOn.add(field);\n        }\n        for (const token of tokens) {\n          if (words.includes(token)) {\n            score += weight;\n            matchedOn.add(field);\n          } else if (words.some((word) => word.startsWith(token) || token.startsWith(word))) {\n            score += Math.round(weight * 0.7);\n            matchedOn.add(field);\n          } else if (value.includes(token)) {\n            score += Math.round(weight * 0.4);\n            matchedOn.add(field);\n          }\n        }\n      }\n      if (score === 0) return [];\n      if (item.enabled) score += 12;\n      if (item.tier === \"verified\") score += 8;\n      if (item.source === \"built_in\") score += 6;\n      return [{ item, score, matchedOn: [...matchedOn] }];\n    })\n    .sort(\n      (left, right) =>\n        right.score - left.score ||\n        Number(right.item.enabled) - Number(left.item.enabled) ||\n        left.item.name.localeCompare(right.item.name) ||\n        left.item.id.localeCompare(right.item.id),\n    )\n    .slice(0, boundedLimit);\n}\n\nfunction normalizeCapabilitySearchText(value: string): string {\n  return value\n    .normalize(\"NFKD\")\n    .replace(/[\\u0300-\\u036f]/g, \"\")\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \" \")\n    .trim();\n}\n\nfunction generatedCapabilityId(payload: CreateCapabilityCatalogItemRequest): string {\n  const source = [\n    payload.kind,\n    payload.name,\n    payload.endpointUrl ?? payload.installUrl ?? payload.homepageUrl ?? \"\",\n  ].join(\":\");\n  return `${payload.kind}:${slugify(payload.name)}-${shortHash(source)}`;\n}\n\nfunction publicRegistryCapabilityId(name: string, version: string, endpointUrl: string): string {\n  return `mcp-registry:${slugify(name)}-${shortHash(`${name}:${version}:${endpointUrl}`)}`;\n}\n\nfunction packIdFromCapabilityId(capabilityId: string): string {\n  return capabilityId.replace(/^pack:/, \"\");\n}\n\nfunction uniqueTags(tags: string[]): string[] {\n  return [...new Set(tags.map((tag) => tag.trim()).filter(Boolean))];\n}\n\nfunction uniqueStrings(values: string[]): string[] {\n  return [...new Set(values.map((value) => value.trim()).filter(Boolean))];\n}\n\nfunction slugify(value: string): string {\n  return (\n    value\n      .toLowerCase()\n      .replace(/[^a-z0-9_-]+/g, \"-\")\n      .replace(/^-+|-+$/g, \"\")\n      .slice(0, 60) || \"capability\"\n  );\n}\n\nfunction shortHash(value: string): string {\n  let hash = 0x811c9dc5;\n  for (let index = 0; index < value.length; index += 1) {\n    hash ^= value.charCodeAt(index);\n    hash = Math.imul(hash, 0x01000193);\n  }\n  return (hash >>> 0).toString(36).padStart(7, \"0\").slice(0, 7);\n}\n\ntype McpRegistryPage = {\n  servers?: McpRegistryEntry[];\n  metadata?: {\n    nextCursor?: string;\n  };\n};\n\ntype McpRegistryEntry = {\n  server?: {\n    name?: string;\n    title?: string;\n    description?: string;\n    version?: string;\n    websiteUrl?: string;\n    repository?: {\n      url?: string;\n    };\n    remotes?: Array<{\n      type?: string;\n      url?: string;\n      headers?: Array<{\n        name?: string;\n        description?: string;\n        isRequired?: boolean;\n        isSecret?: boolean;\n      }>;\n    }>;\n    packages?: unknown[];\n  };\n  _meta?: {\n    \"io.modelcontextprotocol.registry/official\"?: {\n      status?: string;\n      isLatest?: boolean;\n      updatedAt?: string;\n    };\n  };\n};\n\ntype McpRegistryRemote = NonNullable<NonNullable<McpRegistryEntry[\"server\"]>[\"remotes\"]>[number];\n\nfunction mcpRegistryEntryToCatalogItem(entry: McpRegistryEntry): CapabilityCatalogItem | null {\n  const server = entry.server;\n  if (!server?.name) {\n    return null;\n  }\n  const official = entry._meta?.[\"io.modelcontextprotocol.registry/official\"];\n  if (official?.status && official.status !== \"active\") {\n    return null;\n  }\n  if (official?.isLatest === false) {\n    return null;\n  }\n  const remote = server.remotes?.find(\n    (candidate) => candidate.type === \"streamable-http\" && candidate.url,\n  );\n  const endpointUrl = validUrl(remote?.url);\n  if (!remote || !endpointUrl) {\n    return null;\n  }\n  const version = server.version ?? \"latest\";\n  const id = publicRegistryCapabilityId(server.name, version, endpointUrl);\n  const homepageUrl = validUrl(server.websiteUrl) ?? validUrl(server.repository?.url);\n  const requiredHeaders = requiredRemoteHeaders(remote);\n  const mcpServerId = mcpServerIdForCapability(id, {});\n  return CapabilityCatalogItem.parse({\n    id,\n    kind: \"mcp\",\n    source: \"public_registry\",\n    name: server.title || server.name,\n    description: server.description ?? null,\n    category: \"public-mcp\",\n    tags: [\n      \"mcp\",\n      \"public\",\n      \"registry\",\n      ...(requiredHeaders.length ? [\"requires-credentials\"] : []),\n    ],\n    homepageUrl,\n    endpointUrl,\n    installUrl: homepageUrl,\n    authModel: requiredHeaders.length ? \"credential_ref\" : null,\n    tools: [{ kind: \"mcp\", id: mcpServerId }],\n    runtime: {\n      available: true,\n      mcpServerId,\n      transport: \"streamable-http\",\n      notes:\n        requiredHeaders.length === 0\n          ? \"Remote MCP server from the official MCP Registry.\"\n          : `This MCP requires credential header(s) ${requiredHeaders.join(\", \")} supplied in the enable request.`,\n    },\n    metadata: {\n      registry: \"official_mcp_registry\",\n      registryName: server.name,\n      version,\n      updatedAt: official?.updatedAt,\n      packages: server.packages ?? [],\n      requiredHeaders,\n    },\n  });\n}\n\nfunction requiredRemoteHeaders(remote: McpRegistryRemote): string[] {\n  return (remote.headers ?? [])\n    .filter((header) => header.name && header.isRequired !== false)\n    .map((header) => header.name!.trim())\n    .filter(Boolean);\n}\n\nfunction validUrl(value: string | undefined): string | null {\n  if (!value) {\n    return null;\n  }\n  try {\n    return new URL(value).toString();\n  } catch {\n    return null;\n  }\n}\n\nfunction catalogSearchText(item: CapabilityCatalogItem): string {\n  return [\n    item.name,\n    item.description,\n    item.category,\n    ...item.tags,\n    item.endpointUrl,\n    item.homepageUrl,\n    item.installUrl,\n    JSON.stringify(item.metadata),\n  ]\n    .filter(Boolean)\n    .join(\" \")\n    .toLowerCase();\n}\n\nfunction capabilityInstallationRuntimeReady(\n  item: CapabilityCatalogItem,\n  installation: CapabilityInstallation | undefined,\n): boolean {\n  if (!installation || item.kind !== \"mcp\") {\n    return !!installation;\n  }\n  if (!item.runtime.available) {\n    return false;\n  }\n  if (!storedCredentialHeadersSatisfy(item, installation)) {\n    return false;\n  }\n  const connectivity = installation.metadata.mcpConnectivity;\n  return (\n    !!connectivity &&\n    typeof connectivity === \"object\" &&\n    \"status\" in connectivity &&\n    (connectivity.status === \"ok\" || connectivity.status === \"auth_deferred\")\n  );\n}\n\n/**\n * Checks the generic installation projection (header names only) against the\n * capability's declared credential requirements.\n */\nfunction storedCredentialHeadersSatisfy(\n  item: CapabilityCatalogItem,\n  installation: CapabilityInstallation,\n): boolean {\n  if (storedConnectionRef(installation.config)) {\n    return true;\n  }\n  const storedNames = new Set(\n    (Array.isArray(installation.config.headerNames) ? installation.config.headerNames : [])\n      .filter((name): name is string => typeof name === \"string\")\n      .map((name) => name.toLowerCase()),\n  );\n  const required = requiredCapabilityHeaders(item.metadata);\n  if (required.some((name) => !storedNames.has(name.toLowerCase()))) {\n    return false;\n  }\n  return !item.authModel || storedNames.size > 0;\n}\n\nfunction storedConnectionRef(config: Record<string, unknown>): boolean {\n  const ref = config.connectionRef;\n  return (\n    !!ref &&\n    typeof ref === \"object\" &&\n    !Array.isArray(ref) &&\n    typeof (ref as { providerDomain?: unknown }).providerDomain === \"string\"\n  );\n}\n","import {\n  FIKEN_CREDENTIAL_LABEL,\n  FIKEN_CREDENTIAL_ROLE,\n  FIKEN_PROVIDER_DOMAIN,\n  FikenConnectionMetadata,\n  type ConnectionMetadata,\n  type FikenCompanySummary,\n  type FikenConnectionMetadata as FikenMetadata,\n} from \"@opengeni/contracts\";\n\nexport function fikenConnectionMetadata(metadata: Record<string, unknown>): FikenMetadata | null {\n  const parsed = FikenConnectionMetadata.safeParse(metadata);\n  return parsed.success ? parsed.data : null;\n}\n\n/**\n * A workspace-shared Fiken connection created through one of the verified\n * install paths: the pasted personal API token (`api_key`) or the Fiken OAuth\n * app flow (`oauth2`). Both are deliberately workspace-owned; personal\n * (\"Connect only for me\") ownership needs the delegation-snapshot lane and is\n * not yet wired for the first-party fiken tools.\n */\nexport function isFikenConnection(connection: ConnectionMetadata): boolean {\n  return (\n    connection.subjectId === null &&\n    connection.providerDomain === FIKEN_PROVIDER_DOMAIN &&\n    (connection.kind === \"api_key\" || connection.kind === \"oauth2\") &&\n    fikenConnectionMetadata(connection.metadata)?.credentialRole === FIKEN_CREDENTIAL_ROLE\n  );\n}\n\n/**\n * The Fiken credential role is reserved for the verified install routes.\n * Generic connection create/update must reject it so a caller cannot forge a\n * \"verified\" Fiken row (with attacker-chosen companies metadata) that the\n * first-party fiken tools would then bind to. Mirrors the Slack bot guard.\n */\nexport function hasReservedFikenMetadata(\n  metadata: Record<string, unknown> | null | undefined,\n): boolean {\n  return (\n    metadata?.credentialRole === FIKEN_CREDENTIAL_ROLE ||\n    metadata?.credentialLabel === FIKEN_CREDENTIAL_LABEL\n  );\n}\n\n/**\n * One default-company rule for both verified lanes: an explicit request wins\n * when the credential can access it, then a still-accessible previous default\n * survives reconnect, then a single-company credential auto-selects. Returns\n * null (caller decides whether that is an error) when a requested slug is not\n * among the verified companies.\n */\nexport function resolveFikenDefaultCompanySlug(input: {\n  requested: string | null;\n  previous: string | null;\n  companies: readonly FikenCompanySummary[];\n}): string | null {\n  const accessible = (slug: string | null): slug is string =>\n    slug !== null && input.companies.some((company) => company.slug === slug);\n  if (input.requested !== null) {\n    return accessible(input.requested) ? input.requested : null;\n  }\n  if (accessible(input.previous)) {\n    return input.previous;\n  }\n  return input.companies.length === 1 ? input.companies[0]!.slug : null;\n}\n\n/**\n * The row a capability tile or tool default should bind to when several Fiken\n * connections exist: usable status first, then newest update, then immutable\n * UUID descending as the stable tie-breaker.\n */\nexport function preferredFikenConnection<\n  T extends Pick<ConnectionMetadata, \"status\" | \"updatedAt\" | \"id\">,\n>(connections: readonly T[]): T | null {\n  const statusRank = (status: ConnectionMetadata[\"status\"]): number =>\n    status === \"active\" ? 0 : status === \"needs_reauth\" ? 1 : 2;\n  return (\n    [...connections].sort(\n      (left, right) =>\n        statusRank(left.status) - statusRank(right.status) ||\n        right.updatedAt.localeCompare(left.updatedAt) ||\n        right.id.localeCompare(left.id),\n    )[0] ?? null\n  );\n}\n","import { createHash } from \"node:crypto\";\n\nimport {\n  CapabilityPack,\n  stableJson,\n  type CapabilityPackSkill,\n  type PackComponentResolution,\n  type PackInstallationPreview,\n  type PackRigResolution,\n  type ScheduledTaskAgentConfig,\n  type SocialConnection,\n} from \"@opengeni/contracts\";\nimport {\n  getPackInstallation,\n  getRig,\n  getVariableSet,\n  getWorkspacePack,\n  listPackInstallations,\n  listWorkspacePacks,\n  resolvePackComponentReferences,\n  resolvePackInlineSkillReferences,\n  type Database,\n} from \"@opengeni/db\";\nimport { buildPortableSkillArtifact } from \"@opengeni/runtime/skill-library\";\nimport { HTTPException } from \"hono/http-exception\";\n\nexport const MARKETING_SOCIAL_PACK_ID = \"marketing-social-daily-analysis\";\n\nconst marketingSocialPack: CapabilityPack = {\n  id: MARKETING_SOCIAL_PACK_ID,\n  name: \"Marketing social daily analysis\",\n  description:\n    \"Connect social accounts, attach marketing knowledge, and schedule agents to produce daily media performance analysis.\",\n  role: \"marketing\",\n  category: \"social-media\",\n  version: \"0.1.0\",\n  // Built-in packs deliberately declare no sandboxImage and no skills: the\n  // worker's pack-runtime resolution only reads manifest-registered packs\n  // (see apps/worker/src/activities/packs.ts), and a test enforces this.\n  skills: [],\n  components: [],\n  tools: [\n    { kind: \"mcp\", id: \"opengeni\" },\n    { kind: \"mcp\", id: \"docs\" },\n  ],\n  connectors: [\n    {\n      id: \"x\",\n      name: \"X\",\n      category: \"social-media\",\n      authModel: \"oauth2_authorization_code_pkce\",\n      providers: [\"x\"],\n      scopes: [\"tweet.read\", \"tweet.write\", \"users.read\", \"offline.access\"],\n      required: false,\n      metadata: {\n        docs: \"https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code\",\n        firstParty: true,\n        oauthStartPath: \"/social/oauth/start\",\n      },\n    },\n    {\n      id: \"reddit\",\n      name: \"Reddit\",\n      category: \"social-media\",\n      authModel: \"oauth2_authorization_code\",\n      providers: [\"reddit\"],\n      scopes: [\"identity\", \"read\", \"submit\", \"privatemessages\", \"history\"],\n      required: false,\n      metadata: {\n        docs: \"https://github.com/reddit-archive/reddit/wiki/OAuth2\",\n        firstParty: true,\n        oauthStartPath: \"/social/oauth/start\",\n      },\n    },\n    {\n      id: \"linkedin\",\n      name: \"LinkedIn\",\n      category: \"social-media\",\n      authModel: \"oauth2_authorization_code\",\n      providers: [\"linkedin\"],\n      scopes: [\"r_organization_social\", \"rw_organization_admin\"],\n      required: false,\n      metadata: {\n        docs: \"https://learn.microsoft.com/en-us/linkedin/marketing/community-management/community-management-overview\",\n      },\n    },\n    {\n      id: \"instagram\",\n      name: \"Instagram\",\n      category: \"social-media\",\n      authModel: \"oauth2_authorization_code\",\n      providers: [\"instagram\", \"facebook\"],\n      scopes: [\n        \"instagram_basic\",\n        \"instagram_manage_insights\",\n        \"pages_read_engagement\",\n        \"pages_show_list\",\n      ],\n      required: false,\n      metadata: {\n        docs: \"https://developers.facebook.com/docs/instagram-platform/instagram-graph-api/\",\n      },\n    },\n    {\n      id: \"tiktok\",\n      name: \"TikTok\",\n      category: \"social-media\",\n      authModel: \"oauth2_authorization_code\",\n      providers: [\"tiktok\"],\n      scopes: [\"user.info.basic\", \"video.list\"],\n      required: false,\n      metadata: {\n        docs: \"https://developers.tiktok.com/doc/tiktok-api-v2-introduction/\",\n      },\n    },\n    {\n      id: \"youtube\",\n      name: \"YouTube\",\n      category: \"social-media\",\n      authModel: \"oauth2_authorization_code\",\n      providers: [\"youtube\"],\n      scopes: [\n        \"https://www.googleapis.com/auth/youtube.readonly\",\n        \"https://www.googleapis.com/auth/yt-analytics.readonly\",\n      ],\n      required: false,\n      metadata: {\n        docs: \"https://developers.google.com/youtube/v3\",\n      },\n    },\n  ],\n  knowledge: [\n    {\n      type: \"document_base\",\n      id: \"marketing-playbook\",\n      name: \"Marketing playbook\",\n      description:\n        \"Optional workspace document base with brand voice, campaign calendars, audience research, and reporting rules.\",\n      required: false,\n    },\n  ],\n  scheduledTaskTemplates: [\n    {\n      id: \"daily-social-analysis\",\n      name: \"Daily social analysis\",\n      description: \"Review the latest social posts and account signals every day.\",\n      defaultSchedule: {\n        type: \"calendar\",\n        timeZone: \"UTC\",\n        hour: 9,\n        minute: 0,\n      },\n      defaultRunMode: \"new_session_per_run\",\n      defaultOverlapPolicy: \"skip\",\n    },\n  ],\n  metadata: {\n    skill: \"social-media-marketing\",\n    firstPartyMcpTools: [\n      \"social_connections_list\",\n      \"social_posts_recent\",\n      \"social_daily_analysis_context\",\n      \"x_accounts_list\",\n      \"x_search_live\",\n      \"x_mentions_live\",\n      \"x_thread_fetch\",\n      \"x_posts_sync\",\n      \"x_post_reply\",\n      \"reddit_accounts_list\",\n      \"reddit_search_live\",\n      \"reddit_mentions_live\",\n      \"reddit_thread_fetch\",\n      \"reddit_posts_sync\",\n      \"reddit_post_reply\",\n    ],\n  },\n};\n\nconst packs = [marketingSocialPack] satisfies CapabilityPack[];\n\nexport function listCapabilityPacks(): CapabilityPack[] {\n  return packs;\n}\n\nexport function getCapabilityPack(packId: string): CapabilityPack | null {\n  return packs.find((pack) => pack.id === packId) ?? null;\n}\n\nexport function isBuiltInCapabilityPack(packId: string): boolean {\n  return getCapabilityPack(packId) !== null;\n}\n\n/**\n * Built-in packs plus the manifests registered for this workspace. Stored\n * manifests were validated at registration time; rows that no longer parse\n * (for example after a contract tightening) are skipped instead of breaking\n * the whole catalog.\n */\nexport async function listWorkspaceCapabilityPacks(\n  db: Database,\n  workspaceId: string,\n): Promise<CapabilityPack[]> {\n  const registered = await listWorkspacePacks(db, workspaceId);\n  const builtInIds = new Set(packs.map((pack) => pack.id));\n  const registeredPacks = registered\n    .filter((registration) => !builtInIds.has(registration.pack.id))\n    .flatMap((registration) => {\n      const parsed = CapabilityPack.safeParse(registration.pack);\n      return parsed.success ? [parsed.data] : [];\n    });\n  return [...packs, ...registeredPacks];\n}\n\nexport async function resolveCapabilityPack(\n  db: Database,\n  workspaceId: string,\n  packId: string,\n): Promise<CapabilityPack | null> {\n  const builtIn = getCapabilityPack(packId);\n  if (builtIn) {\n    return builtIn;\n  }\n  const registration = await getWorkspacePack(db, workspaceId, packId);\n  if (!registration) {\n    return null;\n  }\n  const parsed = CapabilityPack.safeParse(registration.pack);\n  return parsed.success ? parsed.data : null;\n}\n\nexport function capabilityPackManifestDigest(pack: CapabilityPack): string {\n  return createHash(\"sha256\").update(stableJson(pack)).digest(\"hex\");\n}\n\n/** True when the Pack must use the owner-aware V2 preview/install lifecycle. */\nexport function capabilityPackRequiresInstallationPlan(pack: CapabilityPack): boolean {\n  return (\n    pack.components.length > 0 ||\n    pack.skills.length > 0 ||\n    pack.rig !== undefined ||\n    pack.sandboxImage !== undefined ||\n    pack.sandboxProviderImages !== undefined\n  );\n}\n\nexport type InlinePackSkillInstall = {\n  componentKey: string;\n  capabilityId: string;\n  pluginKey: string;\n  sourceUrl: string;\n  repositoryUrl: string;\n  sourceCommit: string;\n  sourcePath: string;\n  name: string;\n  description: string;\n  contentSha256: string;\n  totalBytes: number;\n  files: Array<{ path: string; content: string; byteSize: number; contentSha256: string }>;\n};\n\n/** Convert a legacy inline Pack Skill into the ordinary immutable Skill model. */\nexport function inlinePackSkillInstall(\n  pack: CapabilityPack,\n  skill: CapabilityPackSkill,\n): InlinePackSkillInstall {\n  const artifact = buildPortableSkillArtifact(skill.files);\n  if (artifact.name.toLowerCase() !== skill.name.toLowerCase()) {\n    throw new HTTPException(422, {\n      message: `Pack Skill ${skill.name} has SKILL.md name ${artifact.name}; the names must match`,\n    });\n  }\n  const normalizedName = skill.name.toLowerCase();\n  const encodedSkill = encodeURIComponent(normalizedName);\n  const sourceUrl = `https://opengeni.invalid/pack-inline-skills/${encodedSkill}/${artifact.contentSha256}`;\n  const capabilityId = `skill:pack-inline/${normalizedName}@${artifact.contentSha256}`;\n  return {\n    componentKey: `inline-skill/${normalizedName}`,\n    capabilityId,\n    pluginKey: `pack-skill/${normalizedName}/${artifact.contentSha256}`,\n    sourceUrl,\n    repositoryUrl: \"https://opengeni.invalid/pack-inline-skills\",\n    sourceCommit: artifact.contentSha256,\n    sourcePath: normalizedName,\n    name: artifact.name,\n    description: artifact.description,\n    contentSha256: artifact.contentSha256,\n    totalBytes: artifact.totalBytes,\n    files: artifact.files.map((file) => ({\n      path: file.path,\n      content: file.content,\n      byteSize: new TextEncoder().encode(file.content).byteLength,\n      contentSha256: createHash(\"sha256\").update(file.content).digest(\"hex\"),\n    })),\n  };\n}\n\nexport async function previewCapabilityPackInstallation(\n  db: Database,\n  workspaceId: string,\n  pack: CapabilityPack,\n  options: { rigId?: string; variableSetId?: string } = {},\n): Promise<PackInstallationPreview> {\n  const installation = await getPackInstallation(db, workspaceId, pack.id);\n  const inlineInstalls = pack.skills.map((skill) => inlinePackSkillInstall(pack, skill));\n  const [referencedComponents, inlineComponents] = await Promise.all([\n    resolvePackComponentReferences(db, workspaceId, pack.components),\n    resolvePackInlineSkillReferences(\n      db,\n      workspaceId,\n      inlineInstalls.map((inline) => ({\n        key: inline.componentKey,\n        capabilityId: inline.capabilityId,\n        name: inline.name,\n        contentSha256: inline.contentSha256,\n      })),\n      installation?.id,\n    ),\n  ]);\n  const manifestDigest = capabilityPackManifestDigest(pack);\n  const components: PackComponentResolution[] = [...referencedComponents, ...inlineComponents];\n  const blockers = components\n    .filter((component) => component.required && component.status !== \"ready\")\n    .map((component) =>\n      component.status === \"missing\"\n        ? `${component.label} is not installed in this workspace`\n        : `${component.label} does not match the Pack's pinned version`,\n    );\n  const rig = await resolvePackRig(\n    db,\n    workspaceId,\n    pack,\n    options.rigId,\n    installation?.selectedRigId,\n  );\n  if (\n    rig.status !== \"ready\" &&\n    rig.status !== \"not_required\" &&\n    (rig.required || rig.requestedRigId !== null || rig.rigId !== null)\n  ) {\n    blockers.push(packRigBlocker(rig, pack.sandboxImage ?? null));\n  }\n  const variableSetId =\n    options.variableSetId ?? storedVariableSetId(installation?.metadata) ?? null;\n  if (pack.variableSet?.required && !variableSetId) {\n    blockers.push(\"Choose saved configuration before installing this Pack\");\n  } else if (variableSetId) {\n    const variableSet = await getVariableSet(db, workspaceId, variableSetId);\n    if (!variableSet) {\n      blockers.push(\"The selected configuration no longer exists in this workspace\");\n    } else {\n      const missing = (pack.variableSet?.requiredVariables ?? []).filter(\n        (name) => !variableSet.variables.some((variable) => variable.name === name),\n      );\n      if (missing.length > 0) {\n        blockers.push(`Configuration is missing required value(s): ${missing.join(\", \")}`);\n      }\n    }\n  }\n  const action =\n    !installation || installation.status === \"disabled\"\n      ? \"install\"\n      : installation.manifestDigest === manifestDigest\n        ? \"repair\"\n        : \"update\";\n  return {\n    packId: pack.id,\n    packVersion: pack.version,\n    manifestDigest,\n    installationVersion: installation?.version ?? null,\n    action,\n    ready: blockers.length === 0,\n    blockers,\n    components,\n    rig,\n    variableSetId,\n    legacyInlineSkillCount: pack.skills.length,\n    legacySandboxImage: pack.sandboxImage ?? null,\n  };\n}\n\nasync function resolvePackRig(\n  db: Database,\n  workspaceId: string,\n  pack: CapabilityPack,\n  requestedRigId: string | undefined,\n  storedRigId: string | null | undefined,\n): Promise<PackRigResolution> {\n  const required = pack.rig?.required === true || Boolean(pack.sandboxImage);\n  const selectedRigId = pack.rig?.rigId ?? requestedRigId ?? storedRigId ?? null;\n  if (!required && !selectedRigId) {\n    return {\n      required: false,\n      status: \"not_required\",\n      requestedRigId: requestedRigId ?? null,\n      rigId: null,\n      rigVersionId: null,\n      name: null,\n      image: null,\n    };\n  }\n  if (pack.rig?.rigId && requestedRigId && pack.rig.rigId !== requestedRigId) {\n    return {\n      required,\n      status: \"mismatch\",\n      requestedRigId,\n      rigId: pack.rig.rigId,\n      rigVersionId: null,\n      name: null,\n      image: null,\n    };\n  }\n  if (!selectedRigId) {\n    return {\n      required,\n      status: \"missing\",\n      requestedRigId: requestedRigId ?? null,\n      rigId: null,\n      rigVersionId: null,\n      name: null,\n      image: null,\n    };\n  }\n  const rig = await getRig(db, workspaceId, selectedRigId);\n  if (!rig?.activeVersion) {\n    return {\n      required,\n      status: \"missing\",\n      requestedRigId: requestedRigId ?? null,\n      rigId: selectedRigId,\n      rigVersionId: null,\n      name: rig?.name ?? null,\n      image: null,\n    };\n  }\n  const image = rig.activeVersion.image ?? null;\n  const status =\n    pack.sandboxImage && image !== pack.sandboxImage\n      ? \"mismatch\"\n      : pack.rig?.requireVerified && rig.activeVersionHealth?.checkHealth !== \"passing\"\n        ? \"unverified\"\n        : \"ready\";\n  return {\n    required,\n    status,\n    requestedRigId: requestedRigId ?? null,\n    rigId: rig.id,\n    rigVersionId: rig.activeVersion.id,\n    name: rig.name,\n    image,\n  };\n}\n\nfunction packRigBlocker(rig: PackRigResolution, legacyImage: string | null): string {\n  if (rig.status === \"missing\") {\n    return \"Choose an available compute environment before installing this Pack\";\n  }\n  if (rig.status === \"unverified\") {\n    return \"Verify the selected compute environment before installing this Pack\";\n  }\n  if (legacyImage) {\n    return `The selected compute environment must use the Pack's previous image ${legacyImage}; the Pack will not replace workspace compute`;\n  }\n  return \"The selected compute environment does not satisfy this Pack's requirement\";\n}\n\nfunction storedVariableSetId(metadata: Record<string, unknown> | undefined): string | null {\n  const value = metadata?.variableSetId ?? metadata?.environmentId;\n  return typeof value === \"string\" && value.length > 0 ? value : null;\n}\n\n/**\n * v1 pack-scoped runtime rule: at most one enabled pack per workspace may\n * declare a `sandboxImage` — there is deliberately no image composition or\n * layering. Enforced when a pack is enabled (both the packs endpoint and the\n * generic capability enable path) and re-checked at session start by the\n * worker, which also covers manifests re-registered after enablement.\n */\nexport async function assertPackSandboxImageCompatible(\n  db: Database,\n  workspaceId: string,\n  pack: CapabilityPack,\n): Promise<void> {\n  if (!pack.sandboxImage) {\n    return;\n  }\n  const installations = await listPackInstallations(db, workspaceId);\n  for (const installation of installations) {\n    if (installation.status !== \"active\" || installation.packId === pack.id) {\n      continue;\n    }\n    const other = await resolveCapabilityPack(db, workspaceId, installation.packId);\n    if (other?.sandboxImage) {\n      throw new HTTPException(409, {\n        message: `pack ${pack.id} declares a sandbox image, but enabled pack ${other.id} already declares one; only one enabled pack per workspace may declare sandboxImage — disable ${other.id} first`,\n      });\n    }\n  }\n}\n\nexport function buildMarketingDailyAnalysisAgentConfig(input: {\n  connections: SocialConnection[];\n  documentBaseIds: string[];\n  promptInstructions?: string;\n}): ScheduledTaskAgentConfig {\n  const connectionIds = input.connections.map((connection) => connection.id);\n  return {\n    prompt: marketingDailyAnalysisPrompt({\n      connections: input.connections,\n      documentBaseIds: input.documentBaseIds,\n      ...(input.promptInstructions ? { promptInstructions: input.promptInstructions } : {}),\n    }),\n    resources: [],\n    tools: marketingSocialPack.tools,\n    metadata: {\n      packId: MARKETING_SOCIAL_PACK_ID,\n      packTemplateId: \"daily-social-analysis\",\n      socialConnectionIds: connectionIds,\n      documentBaseIds: input.documentBaseIds,\n      analysisWindowHours: 24,\n    },\n  };\n}\n\nfunction marketingDailyAnalysisPrompt(input: {\n  connections: SocialConnection[];\n  documentBaseIds: string[];\n  promptInstructions?: string;\n}): string {\n  const connectionLines = input.connections\n    .map((connection) => {\n      return `- ${connection.provider}: ${connection.accountHandle} (${connection.id})`;\n    })\n    .join(\"\\n\");\n  const knowledgeLine =\n    input.documentBaseIds.length > 0\n      ? `Use these document base IDs for brand/campaign knowledge through the docs MCP: ${input.documentBaseIds.join(\", \")}.`\n      : \"No document base IDs were selected; rely only on social context returned by tools.\";\n  const extra = input.promptInstructions\n    ? `\\nAdditional operator instructions:\\n${input.promptInstructions.trim()}\\n`\n    : \"\";\n\n  return [\n    \"Run the daily social media analysis for the selected accounts.\",\n    \"\",\n    \"First call the OpenGeni MCP tool social_daily_analysis_context with the selected connection IDs and a 24 hour analysis window. Use social_posts_recent only if you need a narrower follow-up query.\",\n    knowledgeLine,\n    \"\",\n    \"Selected accounts:\",\n    connectionLines,\n    extra,\n    \"Produce a concise report with these sections: executive summary, notable account changes, winning posts, underperforming posts, audience and content signals, recommended actions for the next 24 hours, and data gaps.\",\n    \"Use only metrics and posts returned by tools or document search. Do not invent metrics, posts, or account capabilities.\",\n  ]\n    .filter(Boolean)\n    .join(\"\\n\");\n}\n","import { createHash } from \"node:crypto\";\nimport type { SkillImportPreview, SkillImportSource } from \"@opengeni/contracts\";\nimport {\n  buildPortableSkillArtifact,\n  PORTABLE_SKILL_MAX_FILES,\n  PORTABLE_SKILL_MAX_TOTAL_BYTES,\n  type SkillLibraryFile,\n} from \"@opengeni/runtime/skill-library\";\nimport { HTTPException } from \"hono/http-exception\";\n\nexport type GitHubSkillTreeEntry = Readonly<{\n  path: string;\n  type: \"blob\" | \"tree\" | \"commit\";\n  mode: string;\n  sha: string;\n  size: number | null;\n}>;\n\nexport type GitHubSkillSourceClient = Readonly<{\n  resolveCommit(owner: string, repository: string, ref: string): Promise<string>;\n  listTree(\n    owner: string,\n    repository: string,\n    commit: string,\n  ): Promise<readonly GitHubSkillTreeEntry[]>;\n  readBlob(owner: string, repository: string, sha: string): Promise<Uint8Array>;\n}>;\n\nexport type ResolvedSkillImport = Readonly<{\n  preview: SkillImportPreview;\n  files: readonly SkillLibraryFile[];\n}>;\n\ntype ParsedSkillSource = Readonly<{\n  source: SkillImportSource;\n  owner: string;\n  repository: string;\n  ref: string;\n  requestedPath: string | null;\n  skillSlug: string | null;\n  inputUrl: string;\n}>;\n\nconst githubSegment = /^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,98}[A-Za-z0-9])?$/u;\nconst gitCommit = /^[0-9a-f]{40,64}$/u;\nconst maxConcurrentBlobReads = 8;\n\nexport async function resolveSkillImport(\n  rawUrl: string,\n  client: GitHubSkillSourceClient,\n): Promise<ResolvedSkillImport> {\n  const parsed = parseSkillSource(rawUrl);\n  const sourceCommit = await client.resolveCommit(parsed.owner, parsed.repository, parsed.ref);\n  if (!gitCommit.test(sourceCommit)) {\n    throw new HTTPException(422, { message: \"GitHub returned an invalid source commit\" });\n  }\n  const tree = await client.listTree(parsed.owner, parsed.repository, sourceCommit);\n  const sourcePath = selectSkillRoot(parsed, tree);\n  const entries = skillFilesUnderRoot(tree, sourcePath);\n  const declaredBytes = entries.reduce((sum, entry) => sum + (entry.size ?? 0), 0);\n  if (entries.length > PORTABLE_SKILL_MAX_FILES) {\n    throw new HTTPException(422, {\n      message: `Skill contains more than ${PORTABLE_SKILL_MAX_FILES} files`,\n    });\n  }\n  if (declaredBytes > PORTABLE_SKILL_MAX_TOTAL_BYTES) {\n    throw new HTTPException(422, {\n      message: `Skill exceeds ${PORTABLE_SKILL_MAX_TOTAL_BYTES} bytes`,\n    });\n  }\n  const files = await mapConcurrent(entries, maxConcurrentBlobReads, async (entry) => {\n    let content: string;\n    try {\n      content = new TextDecoder(\"utf-8\", { fatal: true }).decode(\n        await client.readBlob(parsed.owner, parsed.repository, entry.sha),\n      );\n    } catch {\n      throw new HTTPException(422, {\n        message: `Skill file is not valid UTF-8 text: ${relativeSkillPath(entry.path, sourcePath)}`,\n      });\n    }\n    return { path: relativeSkillPath(entry.path, sourcePath), content };\n  });\n  let artifact;\n  try {\n    artifact = buildPortableSkillArtifact(files);\n  } catch (error) {\n    throw new HTTPException(422, {\n      message: error instanceof Error ? error.message : \"Skill artifact is invalid\",\n    });\n  }\n  const repositoryUrl = `https://github.com/${parsed.owner}/${parsed.repository}`;\n  const sourceUrl =\n    sourcePath === \".\"\n      ? `${repositoryUrl}/tree/${sourceCommit}`\n      : `${repositoryUrl}/tree/${sourceCommit}/${encodeGitHubPath(sourcePath)}`;\n  const warnings: string[] = [];\n  if (!artifact.files.some((file) => /(^|\\/)licen[cs]e(?:\\.|$)/iu.test(file.path))) {\n    warnings.push(\"No license file was found inside the selected Skill folder.\");\n  }\n  const executableFiles = artifact.files.filter((file) => /(^|\\/)scripts?\\//u.test(file.path));\n  if (executableFiles.length > 0) {\n    warnings.push(\n      `${executableFiles.length} script file${executableFiles.length === 1 ? \"\" : \"s\"} will be available to the agent only after installation.`,\n    );\n  }\n  return {\n    preview: {\n      source: parsed.source,\n      sourceUrl,\n      repositoryUrl,\n      owner: parsed.owner,\n      repository: parsed.repository,\n      sourcePath,\n      sourceCommit,\n      name: artifact.name,\n      description: artifact.description,\n      contentSha256: artifact.contentSha256,\n      totalBytes: artifact.totalBytes,\n      files: artifact.files.map((file) => {\n        const bytes = new TextEncoder().encode(file.content);\n        return {\n          path: file.path,\n          byteSize: bytes.byteLength,\n          contentSha256: sha256Hex(bytes),\n        };\n      }),\n      warnings,\n      installed: false,\n      installationVersion: null,\n    },\n    files: artifact.files,\n  };\n}\n\nexport function portableSkillPluginKey(\n  source: Pick<SkillImportPreview, \"owner\" | \"repository\" | \"sourcePath\">,\n): string {\n  return `skill/${source.owner}/${source.repository}/${source.sourcePath}`.toLowerCase();\n}\n\nexport function portableSkillCapabilityId(\n  source: Pick<SkillImportPreview, \"name\" | \"owner\" | \"repository\" | \"sourcePath\">,\n): string {\n  const identity = portableSkillPluginKey(source);\n  const suffix = createHash(\"sha256\").update(identity).digest(\"hex\").slice(0, 12);\n  return `skill:${source.name.toLowerCase()}-${suffix}`;\n}\n\nexport function parseSkillSource(rawUrl: string): ParsedSkillSource {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    throw new HTTPException(422, { message: \"Enter a valid GitHub or skills.sh URL\" });\n  }\n  if (url.protocol !== \"https:\" || url.username || url.password || url.hash) {\n    throw new HTTPException(422, {\n      message: \"Skill imports require a credential-free HTTPS URL without a fragment\",\n    });\n  }\n  const segments = url.pathname.split(\"/\").filter(Boolean).map(decodeURIComponent);\n  if (url.hostname === \"skills.sh\" || url.hostname === \"www.skills.sh\") {\n    if (segments.length !== 3) {\n      throw new HTTPException(422, {\n        message: \"A skills.sh URL must identify one owner, repository, and Skill\",\n      });\n    }\n    const [owner, repository, skillSlug] = segments;\n    assertGitHubRepository(owner!, repository!);\n    if (!skillSlug || !githubSegment.test(skillSlug)) {\n      throw new HTTPException(422, { message: \"The skills.sh Skill name is invalid\" });\n    }\n    return {\n      source: \"skills_sh\",\n      owner: owner!,\n      repository: stripGitSuffix(repository!),\n      ref: \"HEAD\",\n      requestedPath: null,\n      skillSlug,\n      inputUrl: url.toString(),\n    };\n  }\n  if (url.hostname !== \"github.com\" && url.hostname !== \"www.github.com\") {\n    throw new HTTPException(422, {\n      message: \"Only github.com and skills.sh imports are supported\",\n    });\n  }\n  if (segments.length < 2) {\n    throw new HTTPException(422, { message: \"A GitHub URL must identify a repository\" });\n  }\n  const owner = segments[0]!;\n  const repository = stripGitSuffix(segments[1]!);\n  assertGitHubRepository(owner, repository);\n  if (segments.length === 2) {\n    return {\n      source: \"github\",\n      owner,\n      repository,\n      ref: \"HEAD\",\n      requestedPath: null,\n      skillSlug: null,\n      inputUrl: url.toString(),\n    };\n  }\n  const mode = segments[2];\n  if (mode !== \"tree\" && mode !== \"blob\") {\n    throw new HTTPException(422, {\n      message: \"Use a GitHub repository, tree, folder, or SKILL.md URL\",\n    });\n  }\n  const ref = segments[3];\n  if (!ref) throw new HTTPException(422, { message: \"The GitHub URL is missing a revision\" });\n  const pathSegments = segments.slice(4);\n  if (pathSegments.length === 0) {\n    throw new HTTPException(422, { message: \"The GitHub URL is missing a Skill folder\" });\n  }\n  const requestedPath = normalizeGitHubPath(\n    mode === \"blob\" && pathSegments.at(-1)?.toLowerCase() === \"skill.md\"\n      ? pathSegments.slice(0, -1)\n      : pathSegments,\n  );\n  return {\n    source: \"github\",\n    owner,\n    repository,\n    ref,\n    requestedPath,\n    skillSlug: null,\n    inputUrl: url.toString(),\n  };\n}\n\nfunction selectSkillRoot(source: ParsedSkillSource, tree: readonly GitHubSkillTreeEntry[]): string {\n  const skillFiles = tree\n    .filter(\n      (entry) =>\n        entry.type === \"blob\" &&\n        entry.mode !== \"120000\" &&\n        (entry.path === \"SKILL.md\" || entry.path.endsWith(\"/SKILL.md\")),\n    )\n    .map((entry) => entry.path.slice(0, -\"/SKILL.md\".length) || \".\")\n    .sort();\n  if (source.requestedPath) {\n    const root = source.requestedPath;\n    if (!skillFiles.includes(root)) {\n      throw new HTTPException(422, {\n        message: `No top-level SKILL.md was found in ${root}`,\n      });\n    }\n    return root;\n  }\n  const candidates = source.skillSlug\n    ? skillFiles.filter((path) => path.split(\"/\").at(-1) === source.skillSlug)\n    : skillFiles;\n  if (candidates.length === 0) {\n    throw new HTTPException(422, { message: \"No Skill folder with SKILL.md was found\" });\n  }\n  if (candidates.length > 1) {\n    throw new HTTPException(422, {\n      message: \"This source contains multiple Skills; paste the exact GitHub folder URL\",\n    });\n  }\n  return candidates[0]!;\n}\n\nfunction skillFilesUnderRoot(\n  tree: readonly GitHubSkillTreeEntry[],\n  root: string,\n): GitHubSkillTreeEntry[] {\n  const prefix = root === \".\" ? \"\" : `${root}/`;\n  const inside = tree.filter((entry) => entry.path.startsWith(prefix));\n  const unsupported = inside.find(\n    (entry) => entry.type === \"commit\" || (entry.type === \"blob\" && entry.mode === \"120000\"),\n  );\n  if (unsupported) {\n    throw new HTTPException(422, {\n      message: `Skill folders may not contain symbolic links or submodules (${unsupported.path})`,\n    });\n  }\n  const files = inside\n    .filter((entry) => entry.type === \"blob\")\n    .sort((left, right) => left.path.localeCompare(right.path));\n  if (files.length === 0) {\n    throw new HTTPException(422, { message: \"The selected Skill folder is empty\" });\n  }\n  return files;\n}\n\nfunction relativeSkillPath(path: string, root: string): string {\n  return root === \".\" ? path : path.slice(root.length + 1);\n}\n\nfunction normalizeGitHubPath(segments: readonly string[]): string {\n  if (\n    segments.length === 0 ||\n    segments.some(\n      (segment) =>\n        segment.length === 0 ||\n        segment === \".\" ||\n        segment === \"..\" ||\n        segment.includes(\"\\\\\") ||\n        /[\\u0000-\\u001f\\u007f]/u.test(segment),\n    )\n  ) {\n    throw new HTTPException(422, { message: \"The GitHub Skill path is invalid\" });\n  }\n  return segments.join(\"/\");\n}\n\nfunction encodeGitHubPath(path: string): string {\n  return path\n    .split(\"/\")\n    .map((segment) => encodeURIComponent(segment))\n    .join(\"/\");\n}\n\nfunction stripGitSuffix(value: string): string {\n  return value.replace(/\\.git$/iu, \"\");\n}\n\nfunction assertGitHubRepository(owner: string, repository: string): void {\n  if (!githubSegment.test(owner) || !githubSegment.test(stripGitSuffix(repository))) {\n    throw new HTTPException(422, { message: \"The GitHub owner or repository name is invalid\" });\n  }\n}\n\nasync function mapConcurrent<Input, Output>(\n  values: readonly Input[],\n  concurrency: number,\n  map: (value: Input) => Promise<Output>,\n): Promise<Output[]> {\n  const output = new Array<Output>(values.length);\n  let next = 0;\n  await Promise.all(\n    Array.from({ length: Math.min(concurrency, values.length) }, async () => {\n      for (;;) {\n        const index = next;\n        next += 1;\n        if (index >= values.length) return;\n        output[index] = await map(values[index]!);\n      }\n    }),\n  );\n  return output;\n}\n\nfunction sha256Hex(bytes: Uint8Array): string {\n  return createHash(\"sha256\").update(bytes).digest(\"hex\");\n}\n","import { environmentsEncryptionKeyBytes, type Settings } from \"@opengeni/config\";\nimport type { AccessGrant, VariableSet } from \"@opengeni/contracts\";\nimport { getVariableSet, recordAuditEvent, type Database } from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\nimport { requirePermission } from \"../access\";\n\nexport const MAX_ENVIRONMENTS_PER_WORKSPACE = 25;\nexport const MAX_VARIABLES_PER_ENVIRONMENT = 100;\n\n// Names the platform itself injects into sandboxes (sandboxEnvironmentForRun,\n// collectGitIdentityEnvironment) plus loader/startup-injection vectors. These\n// can never be set as variable set variables, so the run-scoped\n// git auth block and git identity always win without silent collisions.\nconst reservedExactNames = new Set([\n  \"HOME\",\n  \"PATH\",\n  \"SHELL\",\n  \"USER\",\n  \"LOGNAME\",\n  \"TMPDIR\",\n  \"IFS\",\n  \"ENV\",\n  \"BASH_ENV\",\n  \"NODE_OPTIONS\",\n  \"PYTHONPATH\",\n  \"PYTHONSTARTUP\",\n  \"PERL5OPT\",\n  \"PERL5LIB\",\n  \"GH_TOKEN\",\n  \"GITHUB_TOKEN\",\n  \"GITLAB_TOKEN\",\n  \"AZURE_DEVOPS_EXT_PAT\",\n  \"GIT_ASKPASS\",\n  \"GIT_TERMINAL_PROMPT\",\n]);\n\nconst reservedPrefixes = [\n  \"OPENGENI_\",\n  \"GIT_CONFIG_\",\n  \"GIT_AUTHOR_\",\n  \"GIT_COMMITTER_\",\n  \"LD_\",\n  \"DYLD_\",\n];\n\nexport function assertAllowedVariableSetVariableName(name: string): void {\n  if (reservedExactNames.has(name) || reservedPrefixes.some((prefix) => name.startsWith(prefix))) {\n    throw new HTTPException(422, {\n      message: `reserved variable set variable name / reserved environment variable name: ${name}`,\n    });\n  }\n}\n\n/** @deprecated use assertAllowedVariableSetVariableName */\nexport const assertAllowedEnvironmentVariableName = assertAllowedVariableSetVariableName;\n\nexport function requireVariableSetEncryption(settings: Settings): Uint8Array {\n  const key = environmentsEncryptionKeyBytes(settings);\n  if (!key) {\n    throw new HTTPException(503, {\n      message: \"variable sets require OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY\",\n    });\n  }\n  return key;\n}\n\n/** @deprecated use requireVariableSetEncryption */\nexport const requireEnvironmentEncryption = requireVariableSetEncryption;\n\nexport async function requireVariableSetForApi(\n  db: Database,\n  workspaceId: string,\n  variableSetId: string,\n): Promise<VariableSet> {\n  const variableSet = await getVariableSet(db, workspaceId, variableSetId);\n  if (!variableSet) {\n    throw new HTTPException(404, { message: \"variableSet not found\" });\n  }\n  return variableSet;\n}\n\n/**\n * Validates an variableSet attachment supplied in a request payload (session\n * create, scheduled task create/update, pack enable). Requires the\n * `variable-sets:use` permission unless the attachment was already authorized\n * (pack-installation-inherited attachments), and maps a missing or\n * cross-variable set to 422 because the id is payload, not the route\n * target. RLS plus the workspace_id clause make cross-workspace ids\n * indistinguishable from missing ones.\n */\nexport async function validateVariableSetAttachment(\n  deps: { settings: Settings; db: Database },\n  grant: AccessGrant,\n  workspaceId: string,\n  variableSetId: string,\n  options: { preauthorized?: boolean } = {},\n): Promise<VariableSet> {\n  requireVariableSetEncryption(deps.settings);\n  if (!options.preauthorized) {\n    requirePermission(grant, \"variable-sets:use\");\n  }\n  const variableSet = await getVariableSet(deps.db, workspaceId, variableSetId);\n  if (!variableSet) {\n    throw new HTTPException(422, { message: \"unknown variableSetId\" });\n  }\n  return variableSet;\n}\n\nexport async function recordVariableSetAuditEvent(\n  db: Database,\n  input: {\n    grant: AccessGrant;\n    action:\n      | \"variable_set.created\"\n      | \"variable_set.updated\"\n      | \"variable_set.deleted\"\n      | \"variable_set.variable.set\"\n      | \"variable_set.variable.deleted\";\n    variableSetId: string;\n    variableName?: string;\n  },\n): Promise<void> {\n  await recordAuditEvent(db, {\n    accountId: input.grant.accountId,\n    workspaceId: input.grant.workspaceId,\n    subjectId: input.grant.subjectId,\n    action: input.action,\n    targetType: \"workspace_variable_set\",\n    targetId: input.variableSetId,\n    metadata: {\n      variableSetId: input.variableSetId,\n      ...(input.variableName ? { name: input.variableName } : {}),\n    },\n  });\n}\n","// packages/core/src/rigs/index.ts — the rig domain: the workspace-scoped,\n// versioned sandbox-machine-definition business logic the REST routes (M2) and\n// (later) the MCP rig tools (M4) both call. Validation + audit events live here;\n// the raw RLS-scoped persistence lives in @opengeni/db. M4 adds verification /\n// auto-merge / promotion on top of the change substrate created here.\n\nimport type {\n  AccessGrant,\n  CreateRigRequest,\n  RigDefinitionEditPayload,\n  ProposeRigChangeRequest,\n  Rig,\n  RigChange,\n  RigVersion,\n  UpdateRigRequest,\n} from \"@opengeni/contracts\";\nimport {\n  activateRigVersion,\n  countRigs,\n  createRig,\n  createRigChange,\n  createRigVersion,\n  createRigVersionForChangePromotion,\n  deleteRigIfNoActiveSessions,\n  getRig,\n  getRigByName,\n  getRigChange,\n  getRigVersion,\n  getVariableSet,\n  listRigChanges,\n  listRigVersions,\n  recordAuditEvent,\n  RigActiveVersionChangedError,\n  RigChangeTransitionError,\n  updateRig,\n  type Database,\n} from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\nimport { rigProviderImagesFromVerification } from \"./provider-images\";\n\nexport * from \"./provider-images\";\n\nexport const MAX_RIGS_PER_WORKSPACE = 50;\nexport const MAX_CHECKS_PER_RIG = 100;\nexport const MAX_CREDENTIAL_HOOKS_PER_RIG = 50;\nexport const MAX_DEFAULT_VARIABLE_SETS_PER_RIG = 25;\n\nexport type RigServices = {\n  db: Database;\n};\n\ntype RigAuditAction =\n  | \"rig.created\"\n  | \"rig.updated\"\n  | \"rig.deleted\"\n  | \"rig.change.proposed\"\n  | \"rig.change.verified\"\n  | \"rig.change.rejected\"\n  | \"rig.change.failed\"\n  | \"rig.change.merged\"\n  | \"rig.verification.started\"\n  | \"rig.verification.passed\"\n  | \"rig.verification.failed\"\n  | \"rig.version.activated\"\n  | \"rig.version.promoted\";\n\nexport async function recordRigAuditEvent(\n  db: Database,\n  input: {\n    grant: AccessGrant;\n    action: RigAuditAction;\n    rigId: string;\n    metadata?: Record<string, unknown>;\n  },\n): Promise<void> {\n  await recordAuditEvent(db, {\n    accountId: input.grant.accountId,\n    workspaceId: input.grant.workspaceId,\n    subjectId: input.grant.subjectId,\n    action: input.action,\n    targetType: \"rig\",\n    targetId: input.rigId,\n    metadata: { rigId: input.rigId, ...(input.metadata ?? {}) },\n  });\n}\n\n// Version attribution string for an API (user-authenticated) mutation. The MCP\n// session path (M4) will use `session:<id>` instead.\nexport function rigActorForGrant(grant: AccessGrant): string {\n  return `user:${grant.subjectId}`;\n}\n\nexport async function requireRigForApi(\n  db: Database,\n  workspaceId: string,\n  rigId: string,\n): Promise<Rig> {\n  const rig = await getRig(db, workspaceId, rigId);\n  if (!rig) {\n    throw new HTTPException(404, { message: \"rig not found\" });\n  }\n  return rig;\n}\n\nexport async function requireRigChangeForApi(\n  db: Database,\n  workspaceId: string,\n  rigId: string,\n  changeId: string,\n): Promise<RigChange> {\n  const change = await getRigChange(db, workspaceId, changeId);\n  // RLS + the workspace clause make a cross-workspace id indistinguishable from\n  // missing; the rigId clause keeps the change addressable only under its rig.\n  if (!change || change.rigId !== rigId) {\n    throw new HTTPException(404, { message: \"rig change not found\" });\n  }\n  return change;\n}\n\nfunction trimmedRigName(name: string): string {\n  const trimmed = name.trim();\n  if (!trimmed) {\n    throw new HTTPException(422, { message: \"rig name is required\" });\n  }\n  return trimmed;\n}\n\n// Duplicate check names would make check results ambiguous; reject them.\nfunction assertUniqueCheckNames(checks: ReadonlyArray<{ name: string }> | undefined): void {\n  if (!checks) {\n    return;\n  }\n  const seen = new Set<string>();\n  for (const check of checks) {\n    if (seen.has(check.name)) {\n      throw new HTTPException(422, { message: `duplicate rig check name: ${check.name}` });\n    }\n    seen.add(check.name);\n  }\n}\n\n// Every referenced default variable set must exist in the workspace. RLS makes a\n// cross-workspace id indistinguishable from a missing one, so both map to 422.\nasync function assertVariableSetsExist(\n  db: Database,\n  workspaceId: string,\n  ids: ReadonlyArray<string> | undefined,\n): Promise<void> {\n  if (!ids || ids.length === 0) {\n    return;\n  }\n  const unique = [...new Set(ids)];\n  for (const id of unique) {\n    const variableSet = await getVariableSet(db, workspaceId, id);\n    if (!variableSet) {\n      throw new HTTPException(422, { message: `unknown defaultVariableSetId: ${id}` });\n    }\n  }\n}\n\nexport async function createRigForApi(\n  deps: RigServices,\n  grant: AccessGrant,\n  payload: CreateRigRequest,\n): Promise<Rig> {\n  const workspaceId = grant.workspaceId;\n  const name = trimmedRigName(payload.name);\n  assertUniqueCheckNames(payload.checks);\n  await assertVariableSetsExist(deps.db, workspaceId, payload.defaultVariableSetIds);\n  if ((await countRigs(deps.db, workspaceId)) >= MAX_RIGS_PER_WORKSPACE) {\n    throw new HTTPException(422, {\n      message: `a workspace supports at most ${MAX_RIGS_PER_WORKSPACE} rigs`,\n    });\n  }\n  if (await getRigByName(deps.db, workspaceId, name)) {\n    throw new HTTPException(409, { message: `rig name is already in use: ${name}` });\n  }\n  const createdBy = rigActorForGrant(grant);\n  const rig = await createRig(deps.db, {\n    accountId: grant.accountId,\n    workspaceId,\n    name,\n    description: payload.description ?? null,\n    createdBy,\n    initialVersion: {\n      image: payload.image ?? null,\n      setupScript: payload.setupScript ?? null,\n      checks: payload.checks,\n      credentialHooks: payload.credentialHooks,\n      defaultVariableSetIds: payload.defaultVariableSetIds,\n      changelog: \"Initial version\",\n      createdBy,\n    },\n  });\n  await recordRigAuditEvent(deps.db, { grant, action: \"rig.created\", rigId: rig.id });\n  return rig;\n}\n\nexport async function updateRigForApi(\n  deps: RigServices,\n  grant: AccessGrant,\n  rig: Rig,\n  payload: UpdateRigRequest,\n): Promise<Rig> {\n  const workspaceId = grant.workspaceId;\n  const name = payload.name !== undefined ? trimmedRigName(payload.name) : undefined;\n  if (name !== undefined && name !== rig.name) {\n    const existing = await getRigByName(deps.db, workspaceId, name);\n    if (existing && existing.id !== rig.id) {\n      throw new HTTPException(409, { message: `rig name is already in use: ${name}` });\n    }\n  }\n  const updated = await updateRig(deps.db, workspaceId, rig.id, {\n    ...(name !== undefined ? { name } : {}),\n    ...(payload.description !== undefined ? { description: payload.description } : {}),\n  });\n  await recordRigAuditEvent(deps.db, { grant, action: \"rig.updated\", rigId: rig.id });\n  return updated;\n}\n\nexport async function deleteRigForApi(\n  deps: RigServices,\n  grant: AccessGrant,\n  rig: Rig,\n): Promise<void> {\n  const workspaceId = grant.workspaceId;\n  const deleted = await deleteRigIfNoActiveSessions(deps.db, workspaceId, rig.id);\n  if (deleted.activeSessionCount > 0) {\n    throw new HTTPException(409, {\n      message: `rig is referenced by ${deleted.activeSessionCount} active session(s); it cannot be deleted`,\n    });\n  }\n  if (!deleted.deleted) {\n    throw new HTTPException(404, { message: \"rig not found\" });\n  }\n  await recordRigAuditEvent(deps.db, { grant, action: \"rig.deleted\", rigId: rig.id });\n}\n\n// Records a proposed change against the rig's CURRENT active version (the base\n// clean-replay minted new versions from). Verification / auto-merge is M4; here\n// the row is created in `proposed`. `proposedBy` overrides the actor string for\n// the session-scoped MCP path (M4).\nexport async function proposeRigChangeForApi(\n  deps: RigServices,\n  grant: AccessGrant,\n  rig: Rig,\n  request: ProposeRigChangeRequest,\n  options: { proposedBy?: string } = {},\n): Promise<RigChange> {\n  const workspaceId = grant.workspaceId;\n  if (!rig.activeVersion) {\n    throw new HTTPException(422, { message: \"rig has no active version to base a change on\" });\n  }\n  if (request.kind === \"definition_edit\") {\n    assertUniqueCheckNames(request.payload.checks);\n    await assertVariableSetsExist(\n      deps.db,\n      workspaceId,\n      request.payload.defaultVariableSetIds ?? undefined,\n    );\n  }\n  const change = await createRigChange(deps.db, {\n    accountId: grant.accountId,\n    workspaceId,\n    rigId: rig.id,\n    baseVersionId: rig.activeVersion.id,\n    kind: request.kind,\n    payload: request.payload as Record<string, unknown>,\n    proposedBy: options.proposedBy ?? rigActorForGrant(grant),\n  });\n  await recordRigAuditEvent(deps.db, {\n    grant,\n    action: \"rig.change.proposed\",\n    rigId: rig.id,\n    metadata: { changeId: change.id, kind: change.kind },\n  });\n  return change;\n}\n\nexport type RigVerificationClassification =\n  | { status: \"merged\"; action: \"auto_promote\" }\n  | { status: \"proposed\"; action: \"await_manage_promote\" }\n  | { status: \"rejected\"; action: \"reject\" }\n  | { status: \"failed\"; action: \"retryable_failure\" };\n\nexport function classifyRigVerificationOutcome(input: {\n  kind: \"setup_append\" | \"definition_edit\";\n  passed: boolean;\n  infraError?: boolean;\n}): RigVerificationClassification {\n  if (input.infraError) {\n    return { status: \"failed\", action: \"retryable_failure\" };\n  }\n  if (!input.passed) {\n    return { status: \"rejected\", action: \"reject\" };\n  }\n  if (input.kind === \"setup_append\") {\n    return { status: \"merged\", action: \"auto_promote\" };\n  }\n  return { status: \"proposed\", action: \"await_manage_promote\" };\n}\n\nexport function appendRigSetupCommand(\n  baseSetupScript: string | null | undefined,\n  command: string,\n): string {\n  const base = (baseSetupScript ?? \"\").trimEnd();\n  return base ? `${base}\\n${command}` : command;\n}\n\nasync function promoteChangeWithActiveCas(\n  deps: RigServices,\n  workspaceId: string,\n  rigId: string,\n  changeId: string,\n  input: Parameters<typeof createRigVersionForChangePromotion>[4],\n): Promise<{ version: RigVersion; change: RigChange }> {\n  try {\n    return await createRigVersionForChangePromotion(deps.db, workspaceId, rigId, changeId, input);\n  } catch (error) {\n    if (error instanceof RigActiveVersionChangedError) {\n      throw new HTTPException(409, {\n        message: `rig moved since this change was verified (base ${error.expectedVersionId}, now ${error.actualVersionId ?? \"none\"}); re-verify before promoting`,\n      });\n    }\n    if (error instanceof RigChangeTransitionError) {\n      throw new HTTPException(409, { message: error.message });\n    }\n    throw error;\n  }\n}\n\nexport async function promoteSetupAppendChange(\n  deps: RigServices,\n  grant: AccessGrant,\n  rig: Rig,\n  change: RigChange,\n): Promise<{ change: RigChange; version: RigVersion }> {\n  if (change.kind !== \"setup_append\") {\n    throw new HTTPException(422, {\n      message: \"only setup_append changes auto-promote through this path\",\n    });\n  }\n  if (change.status !== \"proposed\" && change.status !== \"verifying\") {\n    throw new HTTPException(409, { message: `rig change is ${change.status}; cannot promote` });\n  }\n  if (!change.baseVersionId) {\n    throw new HTTPException(422, { message: \"rig change has no base version\" });\n  }\n  const base = await getRigVersion(deps.db, grant.workspaceId, rig.id, change.baseVersionId);\n  if (!base) {\n    throw new HTTPException(404, { message: \"base rig version not found\" });\n  }\n  const payload = change.payload as { command?: unknown; note?: unknown };\n  if (typeof payload.command !== \"string\" || !payload.command.trim()) {\n    throw new HTTPException(422, { message: \"setup_append change is missing command\" });\n  }\n  const nextDefinition = {\n    image: base.image,\n    setupScript: appendRigSetupCommand(base.setupScript, payload.command),\n    checks: base.checks,\n    credentialHooks: base.credentialHooks,\n    defaultVariableSetIds: base.defaultVariableSetIds,\n  };\n  const { version, change: updated } = await promoteChangeWithActiveCas(\n    deps,\n    grant.workspaceId,\n    rig.id,\n    change.id,\n    {\n      expectedActiveVersionId: change.baseVersionId,\n      ...nextDefinition,\n      changelog:\n        typeof payload.note === \"string\" && payload.note.trim()\n          ? payload.note\n          : \"Verified setup append\",\n      createdBy: change.proposedBy ?? rigActorForGrant(grant),\n      providerImages: rigProviderImagesFromVerification(change.verification, nextDefinition),\n    },\n  );\n  await recordRigAuditEvent(deps.db, {\n    grant,\n    action: \"rig.change.merged\",\n    rigId: rig.id,\n    metadata: { changeId: change.id, versionId: version.id, version: version.version },\n  });\n  await recordRigAuditEvent(deps.db, {\n    grant,\n    action: \"rig.version.promoted\",\n    rigId: rig.id,\n    metadata: { changeId: change.id, versionId: version.id, version: version.version },\n  });\n  return { change: updated, version };\n}\n\nexport async function promoteVerifiedDefinitionEditChangeForApi(\n  deps: RigServices,\n  grant: AccessGrant,\n  rig: Rig,\n  change: RigChange,\n): Promise<{ change: RigChange; version: RigVersion }> {\n  if (change.kind !== \"definition_edit\") {\n    throw new HTTPException(422, { message: \"only definition_edit changes use explicit promote\" });\n  }\n  if (change.status !== \"proposed\") {\n    throw new HTTPException(409, { message: `rig change is ${change.status}; cannot promote` });\n  }\n  if (change.verification?.passed !== true) {\n    throw new HTTPException(422, {\n      message: \"definition_edit change must pass verification before promote\",\n    });\n  }\n  if (!change.baseVersionId) {\n    throw new HTTPException(422, { message: \"rig change has no base version\" });\n  }\n  const base = await getRigVersion(deps.db, grant.workspaceId, rig.id, change.baseVersionId);\n  if (!base) {\n    throw new HTTPException(404, { message: \"base rig version not found\" });\n  }\n  const payload = change.payload as {\n    image?: unknown;\n    setupScript?: unknown;\n    checks?: unknown;\n    credentialHooks?: unknown;\n    defaultVariableSetIds?: unknown;\n    changelog?: unknown;\n  };\n  const nextDefinition = {\n    image: payload.image === undefined ? base.image : (payload.image as string | null),\n    setupScript:\n      payload.setupScript === undefined ? base.setupScript : (payload.setupScript as string | null),\n    checks: Array.isArray(payload.checks) ? (payload.checks as RigVersion[\"checks\"]) : base.checks,\n    credentialHooks: Array.isArray(payload.credentialHooks)\n      ? (payload.credentialHooks as string[])\n      : base.credentialHooks,\n    defaultVariableSetIds: Array.isArray(payload.defaultVariableSetIds)\n      ? (payload.defaultVariableSetIds as string[])\n      : base.defaultVariableSetIds,\n  };\n  const { version, change: updated } = await promoteChangeWithActiveCas(\n    deps,\n    grant.workspaceId,\n    rig.id,\n    change.id,\n    {\n      expectedActiveVersionId: change.baseVersionId,\n      ...nextDefinition,\n      changelog:\n        typeof payload.changelog === \"string\" && payload.changelog.trim()\n          ? payload.changelog\n          : \"Verified definition edit\",\n      createdBy: rigActorForGrant(grant),\n      providerImages: rigProviderImagesFromVerification(change.verification, nextDefinition),\n    },\n  );\n  await recordRigAuditEvent(deps.db, {\n    grant,\n    action: \"rig.change.merged\",\n    rigId: rig.id,\n    metadata: { changeId: change.id, versionId: version.id, version: version.version },\n  });\n  await recordRigAuditEvent(deps.db, {\n    grant,\n    action: \"rig.version.promoted\",\n    rigId: rig.id,\n    metadata: { changeId: change.id, versionId: version.id, version: version.version },\n  });\n  return { change: updated, version };\n}\n\nexport async function createRigVersionForApi(\n  deps: RigServices,\n  grant: AccessGrant,\n  rig: Rig,\n  payload: RigDefinitionEditPayload,\n): Promise<RigVersion> {\n  if (!rig.activeVersion) {\n    throw new HTTPException(422, { message: \"rig has no active version\" });\n  }\n  assertUniqueCheckNames(payload.checks);\n  await assertVariableSetsExist(\n    deps.db,\n    grant.workspaceId,\n    payload.defaultVariableSetIds ?? undefined,\n  );\n  const base = rig.activeVersion;\n  const version = await createRigVersion(\n    deps.db,\n    grant.workspaceId,\n    rig.id,\n    {\n      image: payload.image === undefined ? base.image : payload.image,\n      setupScript: payload.setupScript === undefined ? base.setupScript : payload.setupScript,\n      checks: payload.checks ?? base.checks,\n      credentialHooks: payload.credentialHooks ?? base.credentialHooks,\n      defaultVariableSetIds: payload.defaultVariableSetIds ?? base.defaultVariableSetIds,\n      changelog: payload.changelog ?? \"Manager-created version\",\n      createdBy: rigActorForGrant(grant),\n    },\n    { activate: true },\n  );\n  await recordRigAuditEvent(deps.db, {\n    grant,\n    action: \"rig.version.promoted\",\n    rigId: rig.id,\n    metadata: { versionId: version.id, version: version.version, direct: true },\n  });\n  return version;\n}\n\n// Rollback / promote-activate: flips which existing version is active. Mints no\n// new version and never touches content.\nexport async function activateRigVersionForApi(\n  deps: RigServices,\n  grant: AccessGrant,\n  rig: Rig,\n  versionId: string,\n): Promise<RigVersion> {\n  const workspaceId = grant.workspaceId;\n  const version = await activateRigVersion(deps.db, workspaceId, rig.id, versionId);\n  await recordRigAuditEvent(deps.db, {\n    grant,\n    action: \"rig.version.activated\",\n    rigId: rig.id,\n    metadata: { versionId: version.id, version: version.version },\n  });\n  return version;\n}\n\n// Read pass-throughs (route-facing; keep the route thin and the imports in one\n// place). Versions/changes are always addressed under their rig.\nexport async function listRigVersionsForApi(\n  deps: RigServices,\n  workspaceId: string,\n  rigId: string,\n): Promise<RigVersion[]> {\n  return await listRigVersions(deps.db, workspaceId, rigId);\n}\n\nexport async function listRigChangesForApi(\n  deps: RigServices,\n  workspaceId: string,\n  rigId: string,\n  limit?: number,\n): Promise<RigChange[]> {\n  return await listRigChanges(deps.db, workspaceId, rigId, limit);\n}\n","import { createHash } from \"node:crypto\";\nimport {\n  RigProviderImage as RigProviderImageContract,\n  stableJson,\n  type RigChangeVerification,\n  type RigProviderImage,\n  type RigProviderImages,\n  type RigVersion,\n  type SandboxBackend,\n} from \"@opengeni/contracts\";\n\nexport type RigProviderImageDefinition = Pick<\n  RigVersion,\n  \"image\" | \"setupScript\" | \"checks\" | \"credentialHooks\" | \"defaultVariableSetIds\"\n>;\n\nfunction sha256(value: string): string {\n  return `sha256:${createHash(\"sha256\").update(value, \"utf8\").digest(\"hex\")}`;\n}\n\nexport function rigProviderImageProviderBindingKeyHash(bindingKey: string): string {\n  return sha256(bindingKey);\n}\n\nexport function rigProviderImageSetupHash(\n  definition: Pick<RigProviderImageDefinition, \"setupScript\">,\n): string {\n  return sha256(definition.setupScript ?? \"\");\n}\n\n/**\n * Hash every exact rig-definition input that can affect whether a provider\n * image may be reused. Credential values and variable-set contents are\n * intentionally absent: verification never injects them into the build box.\n * Their declared hook/set identities still participate so a new rig version\n * cannot silently inherit an older build record.\n */\nexport function rigProviderImageContentHash(input: {\n  backend: SandboxBackend;\n  sourceImage: string | null;\n  definition: RigProviderImageDefinition;\n}): string {\n  return sha256(\n    stableJson({\n      version: 1,\n      backend: input.backend,\n      sourceImage: input.sourceImage,\n      image: input.definition.image,\n      setupScript: input.definition.setupScript,\n      checks: input.definition.checks,\n      credentialHooks: input.definition.credentialHooks,\n      defaultVariableSetIds: input.definition.defaultVariableSetIds,\n    }),\n  );\n}\n\n/** Modal's patched snapshot API accepts a caller-owned UUID idempotency key.\n * v2 denotes images proven by a separate cold boot before publication. */\nexport function rigProviderImageBuildRequestId(input: {\n  targetId: string;\n  backend: SandboxBackend;\n  contentHash: string;\n}): string {\n  const bytes = createHash(\"sha256\")\n    .update(\"opengeni-rig-provider-image-build-v2\\0\", \"utf8\")\n    .update(input.targetId, \"utf8\")\n    .update(\"\\0\", \"utf8\")\n    .update(input.backend, \"utf8\")\n    .update(\"\\0\", \"utf8\")\n    .update(input.contentHash, \"utf8\")\n    .digest()\n    .subarray(0, 16);\n  // RFC 4122 variant + deterministic version-5-shaped UUID. The digest, not a\n  // provider response, is the idempotency identity.\n  bytes[6] = (bytes[6]! & 0x0f) | 0x50;\n  bytes[8] = (bytes[8]! & 0x3f) | 0x80;\n  const hex = bytes.toString(\"hex\");\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\nexport function rigProviderImageMatchesDefinition(\n  image: RigProviderImage,\n  definition: RigProviderImageDefinition,\n): boolean {\n  return (\n    image.setupHash === rigProviderImageSetupHash(definition) &&\n    image.contentHash ===\n      rigProviderImageContentHash({\n        backend: image.backend,\n        sourceImage: image.sourceImage,\n        definition,\n      })\n  );\n}\n\n/**\n * Promotion copies only a finalized, structurally valid build record whose\n * hashes match the exact version definition being inserted. A malformed or\n * stale optimization record is discarded; the version remains correct and\n * falls back to runtime setup.\n */\nexport function rigProviderImagesFromVerification(\n  verification: RigChangeVerification | null,\n  definition: RigProviderImageDefinition,\n): RigProviderImages {\n  const parsed = RigProviderImageContract.safeParse(verification?.providerImage);\n  if (!parsed.success || parsed.data.status === \"building\") return {};\n  if (!rigProviderImageMatchesDefinition(parsed.data, definition)) return {};\n  return { [parsed.data.backend]: parsed.data };\n}\n","import type { McpServerConfig, Settings } from \"@opengeni/config\";\nimport type {\n  AccessGrant,\n  ConnectionMetadata,\n  McpPersonalConnectionDelegation,\n  SessionTurn,\n  SocialConnection,\n  ToolRef,\n} from \"@opengeni/contracts\";\nimport {\n  GOOGLE_DRIVE_PROVIDER_DOMAIN,\n  GOOGLE_DRIVE_PUBLICATION_SERVER_ID,\n  GoogleDriveConnectionMetadata,\n  googleDriveScopesAllowCapability,\n} from \"@opengeni/contracts/google-drive\";\nimport {\n  getSessionTurnPersonalConnectionDelegations,\n  getConnectionMetadata,\n  getSocialConnection,\n  getWorkspaceGrant,\n  listConnectionsMetadata,\n  listSocialConnections,\n  type Database,\n  type ResolveConnectionCredentialInput,\n  type ResolveConnectionCredentialResult,\n} from \"@opengeni/db\";\n\nexport type PersonalConnectionDelegationSource =\n  | { kind: \"subject\"; subjectId: string }\n  | { kind: \"turn\"; sessionId: string; turnId: string }\n  | { kind: \"none\" };\nexport type AuthorizedSocialConnection = { connection: SocialConnection; subjectId: string | null };\nexport type AuthorizedAtlassianConnection = {\n  connection: ConnectionMetadata;\n  subjectId: string | null;\n};\n\nexport function directPersonalConnectionSubjectId(\n  turn: Pick<SessionTurn, \"source\" | \"initiator\" | \"initiatorContext\">,\n): string | undefined {\n  if ((turn.source !== \"user\" && turn.source !== \"api\") || turn.initiator.kind !== \"subject\") {\n    return undefined;\n  }\n  return [\"via\", \"viaTruncated\", \"provenanceError\", \"backfill\"].some((key) =>\n    Object.prototype.hasOwnProperty.call(turn.initiatorContext, key),\n  )\n    ? undefined\n    : turn.initiator.subjectId;\n}\n\nexport function personalConnectionDelegationSourceForGrant(\n  grant: AccessGrant,\n): PersonalConnectionDelegationSource {\n  const callerSessionId = grant.metadata?.[\"sessionId\"];\n  const callerTurnId = grant.metadata?.[\"turnId\"];\n  if (typeof callerSessionId === \"string\" && typeof callerTurnId === \"string\") {\n    return { kind: \"turn\", sessionId: callerSessionId, turnId: callerTurnId };\n  }\n  if (\n    grant.principalKind === \"agent_attempt\" ||\n    grant.principalKind === \"service\" ||\n    grant.serviceInitiator\n  ) {\n    return { kind: \"none\" };\n  }\n  return { kind: \"subject\", subjectId: grant.subjectId };\n}\n\nexport async function authorizedSocialConnectionsForGrant(input: {\n  db: Database;\n  grant: AccessGrant;\n  limit?: number;\n}): Promise<AuthorizedSocialConnection[]> {\n  const workspace = await listSocialConnections(\n    input.db,\n    input.grant.workspaceId,\n    input.limit ?? 500,\n    null,\n  );\n  const source = personalConnectionDelegationSourceForGrant(input.grant);\n  if (source.kind === \"none\")\n    return workspace.map((connection) => ({ connection, subjectId: null }));\n  if (source.kind === \"subject\") {\n    const visible = await listSocialConnections(\n      input.db,\n      input.grant.workspaceId,\n      input.limit ?? 500,\n      source.subjectId,\n    );\n    return visible.map((connection) => ({\n      connection,\n      subjectId: connection.ownership === \"personal\" ? source.subjectId : null,\n    }));\n  }\n  const delegations = (\n    await getSessionTurnPersonalConnectionDelegations(\n      input.db,\n      input.grant.workspaceId,\n      source.sessionId,\n      source.turnId,\n    )\n  ).filter((item) => item.connectionType === \"social\");\n  const personal: AuthorizedSocialConnection[] = [];\n  for (const delegation of delegations) {\n    if (!(await getWorkspaceGrant(input.db, delegation.ownerSubjectId, input.grant.workspaceId)))\n      continue;\n    const connection = await getSocialConnection(\n      input.db,\n      input.grant.workspaceId,\n      delegation.connectionId,\n      delegation.ownerSubjectId,\n    );\n    if (!connection || connection.ownership !== \"personal\") continue;\n    const domain = connection.provider === \"x\" ? \"x.com\" : `${connection.provider}.com`;\n    if (!sameProviderDomain(domain, delegation.providerDomain)) continue;\n    personal.push({ connection, subjectId: delegation.ownerSubjectId });\n  }\n  return [...workspace.map((connection) => ({ connection, subjectId: null })), ...personal];\n}\n\nexport async function authorizedAtlassianConnectionsForGrant(input: {\n  db: Database;\n  grant: AccessGrant;\n}): Promise<AuthorizedAtlassianConnection[]> {\n  const workspace = (await listConnectionsMetadata(input.db, input.grant.workspaceId, null)).filter(\n    (connection) =>\n      connection.subjectId === null &&\n      connection.status === \"active\" &&\n      sameProviderDomain(connection.providerDomain, \"api.atlassian.com\"),\n  );\n  const source = personalConnectionDelegationSourceForGrant(input.grant);\n  if (source.kind === \"none\") {\n    return workspace.map((connection) => ({ connection, subjectId: null }));\n  }\n  if (source.kind === \"subject\") {\n    const visible = await listConnectionsMetadata(\n      input.db,\n      input.grant.workspaceId,\n      source.subjectId,\n    );\n    return visible\n      .filter(\n        (connection) =>\n          connection.status === \"active\" &&\n          sameProviderDomain(connection.providerDomain, \"api.atlassian.com\"),\n      )\n      .map((connection) => ({\n        connection,\n        subjectId: connection.subjectId === null ? null : source.subjectId,\n      }));\n  }\n  const delegations = (\n    await getSessionTurnPersonalConnectionDelegations(\n      input.db,\n      input.grant.workspaceId,\n      source.sessionId,\n      source.turnId,\n    )\n  ).filter((item) => item.connectionType === \"atlassian\");\n  const personal: AuthorizedAtlassianConnection[] = [];\n  for (const delegation of delegations) {\n    if (!(await getWorkspaceGrant(input.db, delegation.ownerSubjectId, input.grant.workspaceId))) {\n      continue;\n    }\n    const connection = await getConnectionMetadata(\n      input.db,\n      input.grant.workspaceId,\n      delegation.connectionId,\n      delegation.ownerSubjectId,\n    );\n    if (\n      !connection ||\n      connection.subjectId !== delegation.ownerSubjectId ||\n      connection.status !== \"active\" ||\n      !sameProviderDomain(connection.providerDomain, delegation.providerDomain) ||\n      !sameProviderDomain(connection.providerDomain, \"api.atlassian.com\")\n    ) {\n      continue;\n    }\n    personal.push({ connection, subjectId: delegation.ownerSubjectId });\n  }\n  return [...workspace.map((connection) => ({ connection, subjectId: null })), ...personal];\n}\n\nexport function selectedPersonalConnectionServers(\n  settings: Pick<Settings, \"mcpServers\">,\n  tools: ToolRef[],\n): McpServerConfig[] {\n  const selected = new Set(tools.map((tool) => tool.id));\n  return settings.mcpServers.filter(\n    (server) => selected.has(server.id) && server.connectionRef?.subjectScope === \"subject\",\n  );\n}\n\nfunction canonicalPersonalConnections(connections: ConnectionMetadata[]): ConnectionMetadata[] {\n  return [...connections].sort((left, right) => {\n    const active = Number(right.status === \"active\") - Number(left.status === \"active\");\n    if (active !== 0) return active;\n    const updated = Date.parse(right.updatedAt) - Date.parse(left.updatedAt);\n    if (updated !== 0) return updated;\n    const created = Date.parse(right.createdAt) - Date.parse(left.createdAt);\n    if (created !== 0) return created;\n    return right.id.localeCompare(left.id);\n  });\n}\n\nfunction sameProviderDomain(left: string, right: string): boolean {\n  return left.toLowerCase() === right.toLowerCase();\n}\n\nexport function personalConnectionDelegationsFromVisibleConnections(input: {\n  servers: McpServerConfig[];\n  subjectId: string;\n  connections: ConnectionMetadata[];\n}): McpPersonalConnectionDelegation[] {\n  const delegations: McpPersonalConnectionDelegation[] = [];\n  const connections = canonicalPersonalConnections(input.connections);\n  for (const server of input.servers) {\n    const ref = server.connectionRef;\n    if (!ref || ref.subjectScope !== \"subject\") continue;\n    const connection = connections.find(\n      (candidate) =>\n        candidate.subjectId === input.subjectId &&\n        candidate.status === \"active\" &&\n        sameProviderDomain(candidate.providerDomain, ref.providerDomain) &&\n        (!ref.kind || candidate.kind === ref.kind) &&\n        (!ref.connectionId || candidate.id === ref.connectionId),\n    );\n    if (!connection) continue;\n    delegations.push({\n      serverId: server.id,\n      connectionId: connection.id,\n      ownerSubjectId: input.subjectId,\n      providerDomain: connection.providerDomain,\n      kind: connection.kind,\n    });\n  }\n  return delegations;\n}\n\nexport function personalConnectionDelegationsFromParent(input: {\n  servers: McpServerConfig[];\n  parentDelegations: McpPersonalConnectionDelegation[];\n}): McpPersonalConnectionDelegation[] {\n  const mcp = input.servers.flatMap((server) => {\n    const ref = server.connectionRef;\n    if (!ref || ref.subjectScope !== \"subject\") return [];\n    const delegation = input.parentDelegations.find(\n      (candidate) =>\n        candidate.serverId === server.id &&\n        sameProviderDomain(candidate.providerDomain, ref.providerDomain) &&\n        (!ref.kind || !candidate.kind || candidate.kind === ref.kind),\n    );\n    return delegation ? [{ ...delegation }] : [];\n  });\n  return [\n    ...mcp,\n    ...input.parentDelegations\n      .filter(\n        (item) =>\n          item.connectionType === \"social\" ||\n          item.connectionType === \"atlassian\" ||\n          item.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID,\n      )\n      .map((item) => ({ ...item })),\n  ];\n}\n\n/**\n * Freezes Google Drive publishing only when one exact subject-owned connection\n * is eligible. Multiple writable Google accounts are intentionally ambiguous:\n * callers must narrow the connection before a later turn can advertise or use\n * the private publication tool.\n */\nexport function googleDrivePublicationDelegationFromVisibleConnections(input: {\n  subjectId: string;\n  connections: ConnectionMetadata[];\n}): McpPersonalConnectionDelegation | null {\n  const eligible = input.connections.filter((connection) => {\n    if (\n      connection.subjectId !== input.subjectId ||\n      connection.status !== \"active\" ||\n      connection.kind !== \"oauth2\" ||\n      !sameProviderDomain(connection.providerDomain, GOOGLE_DRIVE_PROVIDER_DOMAIN) ||\n      !googleDriveScopesAllowCapability(connection.grantedScopes, \"publish_file\")\n    ) {\n      return false;\n    }\n    const metadata = GoogleDriveConnectionMetadata.safeParse(connection.metadata);\n    return Boolean(\n      metadata.success &&\n      metadata.data.outputDestination &&\n      metadata.data.lifecycle?.state !== \"paused\" &&\n      (!metadata.data.lifecycle || metadata.data.lifecycle.state === \"active\"),\n    );\n  });\n  if (eligible.length !== 1) return null;\n  const connection = eligible[0]!;\n  return {\n    serverId: GOOGLE_DRIVE_PUBLICATION_SERVER_ID,\n    connectionId: connection.id,\n    ownerSubjectId: input.subjectId,\n    providerDomain: connection.providerDomain,\n    kind: connection.kind,\n  };\n}\n\nexport function personalConnectionDelegationsEqual(\n  left: McpPersonalConnectionDelegation[],\n  right: McpPersonalConnectionDelegation[],\n): boolean {\n  if (left.length !== right.length) return false;\n  const byServer = new Map(right.map((delegation) => [delegation.serverId, delegation]));\n  return left.every((delegation) => {\n    const other = byServer.get(delegation.serverId);\n    return (\n      other?.connectionId === delegation.connectionId &&\n      other.ownerSubjectId === delegation.ownerSubjectId &&\n      sameProviderDomain(other.providerDomain, delegation.providerDomain) &&\n      other.kind === delegation.kind &&\n      other.connectionType === delegation.connectionType\n    );\n  });\n}\n\nexport function personalConnectionDelegationForServer(\n  delegations: McpPersonalConnectionDelegation[],\n  server: Pick<McpServerConfig, \"id\" | \"connectionRef\">,\n): McpPersonalConnectionDelegation | null {\n  const ref = server.connectionRef;\n  if (!ref || ref.subjectScope !== \"subject\") return null;\n  return (\n    delegations.find(\n      (delegation) =>\n        delegation.serverId === server.id &&\n        sameProviderDomain(delegation.providerDomain, ref.providerDomain) &&\n        (!ref.kind || !delegation.kind || delegation.kind === ref.kind),\n    ) ?? null\n  );\n}\n\ntype ConnectionCredentialResolver = (\n  request: ResolveConnectionCredentialInput,\n) => Promise<ResolveConnectionCredentialResult>;\n\nfunction personalAuthorityUnavailable(\n  request: ResolveConnectionCredentialInput,\n): ResolveConnectionCredentialResult {\n  const ref = request.connectionRef;\n  return {\n    status: \"auth_needed\",\n    reason: \"personal_authority_unavailable\",\n    providerDomain: ref.providerDomain,\n    ...(ref.provider ? { provider: ref.provider } : {}),\n    ...(ref.scopes ? { scopes: ref.scopes } : {}),\n    ...(ref.resource ? { resource: ref.resource } : {}),\n    ...(ref.selectedResources ? { selectedResources: ref.selectedResources } : {}),\n  };\n}\n\n/**\n * Resolves subject-owned MCP credentials only through the exact authority\n * frozen on the causal turn. A direct human subject, worker Codemode caller,\n * retry, or recovery can identify the caller, but none may widen or replace\n * the persisted connection UUID.\n */\nexport function withFrozenPersonalConnectionDelegations(input: {\n  resolveCredential: ConnectionCredentialResolver;\n  settings: Pick<Settings, \"mcpServers\">;\n  personalConnectionDelegations: McpPersonalConnectionDelegation[];\n  ownerHasWorkspaceMembership: (subjectId: string) => Promise<boolean>;\n}): ConnectionCredentialResolver {\n  return async (request) => {\n    let effectiveRequest = request;\n    if (request.connectionRef.subjectScope === \"subject\") {\n      const config = input.settings.mcpServers.find((server) => server.id === request.serverId);\n      const publicationDelegations =\n        request.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID &&\n        sameProviderDomain(request.connectionRef.providerDomain, GOOGLE_DRIVE_PROVIDER_DOMAIN)\n          ? input.personalConnectionDelegations.filter(\n              (candidate) =>\n                candidate.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID &&\n                sameProviderDomain(candidate.providerDomain, GOOGLE_DRIVE_PROVIDER_DOMAIN) &&\n                candidate.kind === \"oauth2\" &&\n                request.connectionRef.kind === \"oauth2\",\n            )\n          : [];\n      const delegation = config\n        ? personalConnectionDelegationForServer(input.personalConnectionDelegations, config)\n        : publicationDelegations.length === 1\n          ? publicationDelegations[0]!\n          : null;\n      if (!delegation || !(await input.ownerHasWorkspaceMembership(delegation.ownerSubjectId))) {\n        return personalAuthorityUnavailable(request);\n      }\n      effectiveRequest = {\n        ...request,\n        subjectId: delegation.ownerSubjectId,\n        connectionRef: {\n          ...request.connectionRef,\n          providerDomain: delegation.providerDomain,\n          connectionId: delegation.connectionId,\n          ...(delegation.kind ? { kind: delegation.kind } : {}),\n        },\n      };\n    }\n    const result = await input.resolveCredential(effectiveRequest);\n    if (result.status === \"ok\" || request.connectionRef.subjectScope !== \"subject\") {\n      return result;\n    }\n    return personalAuthorityUnavailable(request);\n  };\n}\n\nexport async function freezePersonalConnectionDelegations(input: {\n  db: Database;\n  workspaceId: string;\n  settings: Pick<Settings, \"mcpServers\">;\n  tools: ToolRef[];\n  source: PersonalConnectionDelegationSource;\n}): Promise<McpPersonalConnectionDelegation[]> {\n  const servers = selectedPersonalConnectionServers(input.settings, input.tools);\n  const includeFirstPartyConnections = input.tools.some((tool) => tool.id === \"opengeni\");\n  if ((servers.length === 0 && !includeFirstPartyConnections) || input.source.kind === \"none\") {\n    return [];\n  }\n  if (input.source.kind === \"turn\") {\n    const inherited = personalConnectionDelegationsFromParent({\n      servers,\n      parentDelegations: await getSessionTurnPersonalConnectionDelegations(\n        input.db,\n        input.workspaceId,\n        input.source.sessionId,\n        input.source.turnId,\n      ),\n    });\n    return includeFirstPartyConnections\n      ? inherited\n      : inherited.filter(\n          (item) =>\n            item.connectionType !== \"social\" &&\n            item.connectionType !== \"atlassian\" &&\n            item.serverId !== GOOGLE_DRIVE_PUBLICATION_SERVER_ID,\n        );\n  }\n  const membership = await getWorkspaceGrant(input.db, input.source.subjectId, input.workspaceId);\n  if (!membership) return [];\n  const visibleConnections = await listConnectionsMetadata(\n    input.db,\n    input.workspaceId,\n    input.source.subjectId,\n  );\n  const mcp = personalConnectionDelegationsFromVisibleConnections({\n    servers,\n    subjectId: input.source.subjectId,\n    connections: visibleConnections,\n  });\n  if (!includeFirstPartyConnections) return mcp;\n  const ownerSubjectId = input.source.subjectId;\n  const visible = await listSocialConnections(input.db, input.workspaceId, 500, ownerSubjectId);\n  const latest = new Map<\"x\" | \"reddit\", (typeof visible)[number]>();\n  for (const connection of visible) {\n    if (\n      connection.ownership !== \"personal\" ||\n      connection.status !== \"connected\" ||\n      (connection.provider !== \"x\" && connection.provider !== \"reddit\")\n    )\n      continue;\n    const prior = latest.get(connection.provider);\n    if (!prior || connection.updatedAt > prior.updatedAt)\n      latest.set(connection.provider, connection);\n  }\n  const personalAtlassian = visibleConnections.filter(\n    (connection) =>\n      connection.subjectId === ownerSubjectId &&\n      connection.status === \"active\" &&\n      sameProviderDomain(connection.providerDomain, \"api.atlassian.com\"),\n  );\n  const googleDrivePublication = googleDrivePublicationDelegationFromVisibleConnections({\n    subjectId: ownerSubjectId,\n    connections: visibleConnections,\n  });\n  return [\n    ...mcp,\n    ...(googleDrivePublication ? [googleDrivePublication] : []),\n    ...[...latest.values()].map((connection) => ({\n      serverId: `social:${connection.provider}`,\n      connectionId: connection.id,\n      ownerSubjectId,\n      providerDomain: connection.provider === \"x\" ? \"x.com\" : `${connection.provider}.com`,\n      kind: \"oauth2\" as const,\n      connectionType: \"social\" as const,\n    })),\n    ...personalAtlassian.map((connection) => ({\n      serverId: `atlassian:${connection.id}`,\n      connectionId: connection.id,\n      ownerSubjectId,\n      providerDomain: connection.providerDomain,\n      kind: connection.kind,\n      connectionType: \"atlassian\" as const,\n    })),\n  ];\n}\n","import type { Settings } from \"@opengeni/config\";\nimport {\n  gitCredentialBindingIdForRepository,\n  gitCredentialProviderForRepository,\n  defaultRepositoryMountPath,\n  mergeResourceRefs as mergeContractResourceRefs,\n  mergeToolRefs,\n  normalizeRepositorySubpath,\n  normalizeRepositoryTransportUri,\n  normalizeResourceMountPath,\n  resourceIdentityKey,\n  resourceMountPath,\n  resourceMountPathCollisionKey,\n  ResourceRefConflictError,\n  ResourceMountPathError,\n  stableJson,\n  type ResourceRef,\n  type ToolRef,\n} from \"@opengeni/contracts\";\nimport {\n  areGitHubRepositoriesAllowedForWorkspace,\n  requireFileForSubject,\n  type Database,\n} from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\n\nexport function validateToolRefs(tools: ToolRef[], settings: McpSettings): ToolRef[] {\n  const mcpServerIds = new Set(settings.mcpServers.map((server) => server.id));\n  const out: ToolRef[] = [];\n  for (const tool of tools) {\n    if (tool.kind !== \"mcp\") {\n      throw new HTTPException(422, {\n        message: `unsupported tool kind: ${(tool as { kind?: string }).kind}`,\n      });\n    }\n    const optional = tool.optional === true;\n    if (!mcpServerIds.has(tool.id)) {\n      if (optional) {\n        continue;\n      }\n      throw new HTTPException(422, { message: `unknown MCP server id: ${tool.id}` });\n    }\n    // Tool refs are tri-state for pack portability across deployments:\n    //  - bare / optional:false is STRICT: the id must be configured here and\n    //    runtime connection failure fails the turn.\n    //  - optional:true + known id is preserved: runtime treats it like an\n    //    auto-attached capability MCP and skips connect/list failures.\n    //  - optional:true + unknown id is skipped above: the client explicitly\n    //    opted into graceful degradation for MCPs (for example docs servers\n    //    like context7) that only some deployments configure.\n    out.push(\n      optional ? { kind: \"mcp\", id: tool.id, optional: true } : { kind: \"mcp\", id: tool.id },\n    );\n  }\n  return mergeToolRefs([], out);\n}\n\ntype McpSettings = Pick<Settings, \"mcpServers\">;\n\nexport function enabledCapabilityMcpToolRefs(\n  settings: McpSettings,\n  runtimeSettings: McpSettings,\n): ToolRef[] {\n  const configuredIds = new Set(settings.mcpServers.map((server) => server.id));\n  return (\n    runtimeSettings.mcpServers\n      .filter((server) => !configuredIds.has(server.id))\n      // AUTO-ATTACHED (workspace-default) capability servers are marked optional:\n      // one of them having a broken/expired credential must SKIP that server, not\n      // fail the whole turn before the model runs. The caller only reaches here\n      // when the request omitted `tools`; an explicit list is never defaulted.\n      .map((server) => ({ kind: \"mcp\", id: server.id, optional: true }))\n  );\n}\n\nexport function withDefaultEnabledCapabilityMcpTools(\n  tools: ToolRef[],\n  settings: McpSettings,\n  runtimeSettings: McpSettings,\n): ToolRef[] {\n  return mergeToolRefs(tools, enabledCapabilityMcpToolRefs(settings, runtimeSettings));\n}\n\n/** Drop stored refs that are no longer present in the current runtime registry. */\nexport function availableToolRefs(tools: ToolRef[], settings: McpSettings): ToolRef[] {\n  const available = new Set(settings.mcpServers.map((server) => server.id));\n  return tools.filter((tool) => available.has(tool.id));\n}\n\n/** A child or fixed-policy follow-up may narrow its allow-list, never widen it. */\nexport function assertToolRefsSubset(\n  requested: ToolRef[],\n  allowed: ToolRef[],\n  message = \"requested tools exceed the session tool policy\",\n): void {\n  const allowedIds = new Set(allowed.map((tool) => `${tool.kind}:${tool.id}`));\n  const widened = requested.find((tool) => !allowedIds.has(`${tool.kind}:${tool.id}`));\n  if (widened) {\n    throw new HTTPException(403, { message: `${message}: ${widened.id}` });\n  }\n}\n\n/** Validate runtime availability and then enforce the durable policy fence. */\nexport function validateToolRefsForSessionPolicy(input: {\n  requested: ToolRef[];\n  settings: McpSettings;\n  allowedTools: ToolRef[];\n  message: string;\n}): ToolRef[] {\n  const validated = validateToolRefs(input.requested, input.settings);\n  assertToolRefsSubset(validated, input.allowedTools, input.message);\n  return validated;\n}\n\nexport function normalizeResources(resources: ResourceRef[]): ResourceRef[] {\n  const mountPaths = new Map<string, string>();\n  const identities = new Map<string, string>();\n  const credentialBindingProviders = new Map<string, string>();\n  const seenResources = new Set<string>();\n  const out: ResourceRef[] = [];\n  for (const resource of resources) {\n    let normalized: ResourceRef;\n    if (resource.kind === \"file\") {\n      const mountPath = normalizeMountPath(resourceMountPath(resource));\n      normalized = {\n        kind: \"file\",\n        fileId: resource.fileId,\n        mountPath,\n      };\n    } else {\n      const credentialProvider = gitCredentialProviderForRepository(resource);\n      let normalizedUri: string;\n      try {\n        normalizedUri = normalizeRepositoryTransportUri(resource.uri);\n      } catch (error) {\n        throw new HTTPException(422, {\n          message: error instanceof Error ? error.message : \"invalid repository URI\",\n        });\n      }\n      const mountPath = normalizeMountPath(\n        resource.mountPath ?? defaultRepositoryMountPath(normalizedUri, credentialProvider),\n      );\n      const credentialBindingId = gitCredentialBindingIdForRepository(resource, credentialProvider);\n      if (\n        (resource.credentialBindingId || resource.connectionId || resource.access) &&\n        !credentialProvider\n      ) {\n        throw new HTTPException(422, {\n          message: \"repository credential bindings and access intent require a Git provider\",\n        });\n      }\n      if (credentialProvider && credentialBindingId) {\n        const boundProvider = credentialBindingProviders.get(credentialBindingId);\n        if (boundProvider && boundProvider !== credentialProvider) {\n          throw new HTTPException(422, {\n            message: `credential binding ${credentialBindingId} is assigned to multiple Git providers`,\n          });\n        }\n        credentialBindingProviders.set(credentialBindingId, credentialProvider);\n      }\n      normalized = {\n        kind: \"repository\",\n        uri: normalizedUri,\n        ref: resource.ref.trim(),\n        mountPath,\n        ...(resource.subpath ? { subpath: normalizeRepositorySubpath(resource.subpath) } : {}),\n        ...(resource.provider ? { provider: resource.provider } : {}),\n        ...(resource.credentialBindingId\n          ? { credentialBindingId: resource.credentialBindingId }\n          : {}),\n        ...(resource.access ? { access: resource.access } : {}),\n        ...(resource.repositoryId !== undefined ? { repositoryId: resource.repositoryId } : {}),\n        ...(resource.installationId !== undefined\n          ? { installationId: resource.installationId }\n          : {}),\n        ...(resource.projectId !== undefined ? { projectId: resource.projectId } : {}),\n        ...(resource.connectionId ? { connectionId: resource.connectionId } : {}),\n        ...(resource.githubInstallationId\n          ? { githubInstallationId: resource.githubInstallationId }\n          : {}),\n        ...(resource.githubRepositoryId ? { githubRepositoryId: resource.githubRepositoryId } : {}),\n      };\n    }\n    const key = stableJson(normalized);\n    const mountCollisionKey = normalized.mountPath\n      ? resourceMountPathCollisionKey(normalized.mountPath)\n      : undefined;\n    const mounted = mountCollisionKey ? mountPaths.get(mountCollisionKey) : undefined;\n    if (mounted && mounted !== key) {\n      throw new HTTPException(422, {\n        message: `duplicate resource mount path: ${normalized.mountPath}`,\n      });\n    }\n    if (normalized.mountPath) {\n      mountPaths.set(mountCollisionKey!, key);\n    }\n    const identity = resourceIdentityKey(normalized);\n    const seenIdentity = identities.get(identity);\n    if (seenIdentity && seenIdentity !== key) {\n      throw new HTTPException(422, {\n        message: `duplicate resource with different settings: ${identity}`,\n      });\n    }\n    identities.set(identity, key);\n    if (!seenResources.has(key)) {\n      seenResources.add(key);\n      out.push(normalized);\n    }\n  }\n  return out;\n}\n\nexport function mergeResourceRefs(\n  existing: ResourceRef[],\n  additions: ResourceRef[],\n): ResourceRef[] {\n  try {\n    return mergeContractResourceRefs(existing, additions, { rejectConflicts: true });\n  } catch (error) {\n    if (error instanceof ResourceRefConflictError) {\n      throw new HTTPException(422, { message: error.message });\n    }\n    throw error;\n  }\n}\n\nexport function validateGitHubRepositorySelectionShapes(resources: ResourceRef[]): number[] {\n  const selected = gitHubRepositorySelections(resources);\n  if (selected.length === 0) {\n    return [];\n  }\n  return [...new Set(selected.map((item) => item.installationId))];\n}\n\n/** @deprecated Use validateGitHubRepositorySelectionShapes for multi-installation sessions. */\nexport function validateGitHubRepositorySelectionShape(resources: ResourceRef[]): number | null {\n  const installationIds = validateGitHubRepositorySelectionShapes(resources);\n  if (installationIds.length > 1) {\n    throw new HTTPException(422, {\n      message: \"GitHub App repository resources must belong to one installation\",\n    });\n  }\n  return installationIds[0] ?? null;\n}\n\nfunction gitHubRepositorySelections(\n  resources: ResourceRef[],\n): Array<{ installationId: number; repositoryId: number }> {\n  return resources.flatMap((resource) => {\n    if (resource.kind !== \"repository\") {\n      return [];\n    }\n    const installationRaw =\n      resource.githubInstallationId ??\n      (resource.provider === \"github\" ? resource.installationId : undefined);\n    const repositoryRaw =\n      resource.githubRepositoryId ??\n      (resource.provider === \"github\" ? resource.repositoryId : undefined);\n    if (installationRaw === null && repositoryRaw === null) {\n      return [];\n    }\n    if (installationRaw === undefined && repositoryRaw === undefined) {\n      return [];\n    }\n    const installationId = positiveInteger(installationRaw);\n    const repositoryId = positiveInteger(repositoryRaw);\n    if (!installationId || !repositoryId) {\n      throw new HTTPException(422, {\n        message:\n          \"GitHub App repository resources require positive github_installation_id and github_repository_id\",\n      });\n    }\n    return [{ installationId, repositoryId }];\n  });\n}\n\nexport async function validateGitHubRepositorySelection(\n  db: Database,\n  workspaceId: string,\n  resources: ResourceRef[],\n): Promise<void> {\n  const installationIds = validateGitHubRepositorySelectionShapes(resources);\n  if (installationIds.length === 0) {\n    return;\n  }\n  const selections = gitHubRepositorySelections(resources);\n  for (const installationId of installationIds) {\n    const repositoryIds = selections\n      .filter((selection) => selection.installationId === installationId)\n      .map((selection) => selection.repositoryId);\n    if (\n      !(await areGitHubRepositoriesAllowedForWorkspace(\n        db,\n        workspaceId,\n        installationId,\n        repositoryIds,\n      ))\n    ) {\n      throw new HTTPException(422, {\n        message:\n          \"GitHub App repository resources must be authorized for a GitHub App installation linked to this workspace\",\n      });\n    }\n  }\n}\n\n/**\n * A 422 from repository selection validation is an authoritative stale or\n * revoked identity. Other failures (for example a database/catalog outage)\n * leave the result unknown and must not cause draft hydration to delete it.\n */\nexport function isAuthoritativeGitHubRepositorySelectionError(error: unknown): boolean {\n  return error instanceof HTTPException && error.status === 422;\n}\n\nexport async function validateFileResources(\n  db: Database,\n  accountId: string,\n  workspaceId: string,\n  subjectId: string,\n  resources: ResourceRef[],\n): Promise<void> {\n  const fileIds = new Set<string>();\n  for (const resource of resources) {\n    if (resource.kind !== \"file\") {\n      continue;\n    }\n    if (fileIds.has(resource.fileId)) {\n      throw new HTTPException(422, { message: `duplicate file resource: ${resource.fileId}` });\n    }\n    fileIds.add(resource.fileId);\n    const file = await requireFileForSubject(db, {\n      accountId,\n      workspaceId,\n      subjectId,\n      fileId: resource.fileId,\n    }).catch(() => null);\n    if (!file) {\n      throw new HTTPException(422, { message: `unknown file resource: ${resource.fileId}` });\n    }\n    if (file.status !== \"ready\") {\n      throw new HTTPException(422, {\n        message: `file resource ${resource.fileId} is ${file.status}`,\n      });\n    }\n  }\n}\n\nfunction normalizeMountPath(path: string): string {\n  try {\n    return normalizeResourceMountPath(path);\n  } catch (error) {\n    if (!(error instanceof ResourceMountPathError)) throw error;\n    throw new HTTPException(422, { message: `invalid resource mount path: ${path}` });\n  }\n}\n\nfunction positiveInteger(value: unknown): number | null {\n  if (typeof value === \"number\" && Number.isInteger(value) && value > 0) {\n    return value;\n  }\n  if (typeof value === \"string\" && /^\\d+$/.test(value) && Number(value) > 0) {\n    return Number(value);\n  }\n  return null;\n}\n\nexport { mergeToolRefs, stableJson };\n","import type { Settings } from \"@opengeni/config\";\nimport {\n  SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT,\n  SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH,\n  mergeToolRefs,\n  type Session,\n  type SessionEffectiveToolPolicy,\n  type SessionToolPolicy,\n  type ToolRef,\n} from \"@opengeni/contracts\";\nimport type { Database } from \"@opengeni/db\";\nimport { settingsWithEnabledCapabilityMcpServers } from \"./capabilities\";\n\nconst MANDATORY_SESSION_MCP_SERVER_IDS = [\"opengeni\"] as const;\nconst PROJECTABLE_REGISTRY_ID = /^[A-Za-z0-9_-]+$/;\n\nexport type ResolvedSessionToolPolicy = {\n  toolRefs: ToolRef[];\n  effectivePolicy: SessionEffectiveToolPolicy;\n};\n\nexport type SessionToolPolicyInput = {\n  toolPolicy: SessionToolPolicy;\n  sessionTools: ToolRef[];\n  availableMcpServerIds: Iterable<string>;\n  /** Current omitted-tools defaults, intentionally narrower than all servers. */\n  defaultMcpServerIds?: Iterable<string>;\n};\n\nfunction sortedIds(ids: Iterable<string>): string[] {\n  return [...new Set(ids)].sort();\n}\n\n/** Every configured runtime MCP defaults on; mandatory carrier IDs are separate. */\nexport function defaultSessionMcpServerIds(servers: Iterable<{ id: string }>): string[] {\n  const mandatory = new Set<string>(MANDATORY_SESSION_MCP_SERVER_IDS);\n  return sortedIds([...servers].map((server) => server.id).filter((id) => !mandatory.has(id)));\n}\n\nfunction projectIds(ids: readonly string[]): { ids: string[]; truncated: boolean } {\n  const projectable = ids.filter(\n    (id) =>\n      id.length <= SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH && PROJECTABLE_REGISTRY_ID.test(id),\n  );\n  return {\n    ids: projectable.slice(0, SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT),\n    truncated:\n      projectable.length !== ids.length ||\n      projectable.length > SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT,\n  };\n}\n\n/**\n * Resolve the same ID-only policy used by API projections and worker turns.\n * This function never receives endpoint URLs, credentials, schemas, or live\n * probe results. `availableMcpServerIds` is the resolved runtime registry;\n * `defaultMcpServerIds` is the current configured omitted-tools default.\n */\nexport function resolveSessionToolPolicy(input: SessionToolPolicyInput): ResolvedSessionToolPolicy {\n  const policy = input.toolPolicy;\n  const availableIds = new Set(input.availableMcpServerIds);\n  const defaultIds = new Set(input.defaultMcpServerIds ?? []);\n  const mandatoryIds: string[] = MANDATORY_SESSION_MCP_SERVER_IDS.filter((id) =>\n    availableIds.has(id),\n  );\n  const mandatoryIdSet = new Set<string>(mandatoryIds);\n  const selectedRefs = mergeToolRefs([], input.sessionTools);\n  const tracksWorkspaceDefaults = policy.mode === \"workspace_default\";\n\n  // Persisted refs may outlive a capability installation, deployment config,\n  // or its credentials. Admission remains strict for newly requested refs, but\n  // turn-time materialization must not hand any no-longer-registered id to the\n  // runtime router: doing so fails before the model can respond and traps the\n  // session in an \"Unknown MCP server id\" loop. Keep the stale selection in the\n  // effective-policy projection below, while executable refs contain only the\n  // registry that is available for this exact turn.\n  let toolRefs = selectedRefs.filter((tool) => availableIds.has(tool.id));\n  if (tracksWorkspaceDefaults) {\n    toolRefs = mergeToolRefs(\n      toolRefs,\n      sortedIds(defaultIds)\n        .filter((id) => availableIds.has(id))\n        .map((id) => ({ kind: \"mcp\" as const, id, optional: true as const })),\n    );\n  }\n  toolRefs = mergeToolRefs(\n    toolRefs,\n    mandatoryIds.map((id) => ({ kind: \"mcp\" as const, id })),\n  );\n\n  // `effectiveIds` is the requested policy truth, including unavailable\n  // optional refs retained in the persisted selection. `toolRefs` above is\n  // the runtime-safe materialization, so projections can distinguish dropped\n  // history from what is actually handed to the MCP router.\n  const requestedEffectiveRefs = mergeToolRefs(\n    selectedRefs,\n    tracksWorkspaceDefaults\n      ? sortedIds(defaultIds)\n          .filter((id) => availableIds.has(id))\n          .map((id) => ({ kind: \"mcp\" as const, id, optional: true as const }))\n      : [],\n  );\n  const effectiveIds = sortedIds(\n    mergeToolRefs(\n      requestedEffectiveRefs,\n      mandatoryIds.map((id) => ({ kind: \"mcp\" as const, id })),\n    ).map((tool) => tool.id),\n  );\n  const configuredIds = effectiveIds.filter((id) => availableIds.has(id));\n  const configuredIdSet = new Set(configuredIds);\n  const droppedIds = effectiveIds.filter((id) => !configuredIdSet.has(id));\n  // Lazy discovery is scoped to the effective MCP allow-list, not only to\n  // workspace-default capability refs. An explicitly selected connector is\n  // directly callable from this same materialized list, so excluding it from\n  // the existing router creates a false \"no connected sources\" result. The\n  // mandatory first-party OpenGeni server stays eager; every other configured\n  // effective server is eligible for bounded schema disclosure.\n  const deferredIds = sortedIds(\n    toolRefs\n      .filter((tool) => configuredIdSet.has(tool.id) && !mandatoryIdSet.has(tool.id))\n      .map((tool) => tool.id),\n  );\n  const selectedIds = sortedIds(\n    selectedRefs\n      .filter(\n        (tool) =>\n          !mandatoryIdSet.has(tool.id) && !(tracksWorkspaceDefaults && tool.optional === true),\n      )\n      .map((tool) => tool.id),\n  );\n  const projections = {\n    selected: projectIds(selectedIds),\n    effective: projectIds(effectiveIds),\n    mandatory: projectIds(sortedIds(mandatoryIds)),\n    deferred: projectIds(deferredIds),\n    configured: projectIds(configuredIds),\n    dropped: projectIds(droppedIds),\n  };\n\n  return {\n    toolRefs,\n    effectivePolicy: {\n      mode: policy.mode,\n      inheritedFromSessionId: policy.inheritedFromSessionId,\n      selectedIds: projections.selected.ids,\n      effectiveIds: projections.effective.ids,\n      mandatoryIds: projections.mandatory.ids,\n      lazyRouter: {\n        state: deferredIds.length > 0 ? \"required\" : \"disabled\",\n        deferredIds: projections.deferred.ids,\n      },\n      configuredIds: projections.configured.ids,\n      droppedIds: projections.dropped.ids,\n      counts: {\n        selected: selectedIds.length,\n        effective: effectiveIds.length,\n        mandatory: mandatoryIds.length,\n        deferred: deferredIds.length,\n        configured: configuredIds.length,\n        dropped: droppedIds.length,\n      },\n      idsTruncated: Object.values(projections).some((projection) => projection.truncated),\n    },\n  };\n}\n\n/** Current full runtime registry IDs, including configured static servers. */\nexport async function workspaceSessionToolPolicyServerIds(\n  db: Database,\n  workspaceId: string,\n  settings: Settings,\n  subjectId?: string,\n): Promise<string[]> {\n  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {\n    ...(subjectId ? { subjectId } : {}),\n  });\n  return sortedIds(runtimeSettings.mcpServers.map((server) => server.id));\n}\n\n/** Current omitted-tools defaults: every configured runtime MCP is on. */\nexport async function workspaceSessionToolPolicyDefaultServerIds(\n  db: Database,\n  workspaceId: string,\n  settings: Settings,\n  subjectId?: string,\n): Promise<string[]> {\n  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {\n    ...(subjectId ? { subjectId } : {}),\n  });\n  return defaultSessionMcpServerIds(runtimeSettings.mcpServers);\n}\n\n/** Add a bounded, secret-safe effective projection to a session response. */\nexport function sessionWithEffectiveToolPolicy(\n  session: Session,\n  workspaceServerIds: Iterable<string>,\n  workspaceDefaultServerIds: Iterable<string> = [],\n): Session {\n  const availableIds = new Set(workspaceServerIds);\n  for (const server of session.mcpServers) {\n    availableIds.add(server.id);\n  }\n  return {\n    ...session,\n    effectiveToolPolicy: resolveSessionToolPolicy({\n      toolPolicy: session.toolPolicy,\n      sessionTools: session.tools,\n      availableMcpServerIds: availableIds,\n      defaultMcpServerIds: workspaceDefaultServerIds,\n    }).effectivePolicy,\n  };\n}\n","import type { Settings } from \"@opengeni/config\";\nimport type {\n  AccessGrant,\n  McpPersonalConnectionDelegation,\n  KnowledgeSourceSyncAction,\n  ScheduledTask,\n  ScheduledTaskAgentConfig,\n  Session,\n  SessionAuthorizationPort,\n  SessionAuthorizationSurface,\n  CreateScheduledTaskRequest as CreateScheduledTaskPayload,\n  UpdateScheduledTaskRequest as UpdateScheduledTaskPayload,\n  XaiProviderAccountAuthoritySnapshotV1,\n} from \"@opengeni/contracts\";\nimport { OPENGENI_SLACK_BOT_SESSION_METADATA_KEY } from \"@opengeni/contracts\";\nimport {\n  createScheduledTask,\n  deleteScheduledTask,\n  getConnectionMetadata,\n  getKnowledgeSourceForSyncAuthority,\n  getNestedAgentDepthDeploymentPolicy,\n  getRig,\n  getScheduledTask,\n  getScheduledTaskPersonalConnectionDelegations,\n  getSessionTurnXaiProviderAccountAuthoritySnapshot,\n  getSession,\n  requireWorkspace,\n  scopedKnowledgeScopeKey,\n  updateScheduledTask,\n  resolveXaiProviderAccountAuthoritySnapshotForAcceptance,\n  type Database,\n  type UpdateScheduledTaskInput,\n} from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\nimport { hasPermission, requirePermission } from \"../access\";\nimport {\n  requireSessionAuthorization,\n  SessionAuthorizationDeniedError,\n  SessionAuthorizationUnavailableError,\n} from \"../session-authorization\";\nimport type { SessionWorkflowClient } from \"../dependencies\";\nimport type { ObjectStorageDependency } from \"../dependencies\";\nimport { settingsWithEnabledCapabilityMcpServers } from \"./capabilities\";\nimport { validateVariableSetAttachment } from \"./environments\";\nimport {\n  freezePersonalConnectionDelegations,\n  personalConnectionDelegationSourceForGrant,\n  personalConnectionDelegationsEqual,\n} from \"./personal-connection-delegations\";\nimport {\n  assertWorkspaceModelPolicyAllows,\n  canonicalConfiguredModel,\n  creationInitiatorForGrant,\n} from \"./sessions\";\nimport {\n  hasReservedOpenGeniSlackBotSessionMetadata,\n  scheduledSlackBotConnectionId,\n  validateOpenGeniSlackBotConnectionSelection,\n} from \"./slack-bot\";\nimport {\n  normalizeResources,\n  validateFileResources,\n  validateGitHubRepositorySelection,\n  validateToolRefs,\n  withDefaultEnabledCapabilityMcpTools,\n} from \"./resources\";\n\n/**\n * Whether a raw scheduled-task payload explicitly set agentConfig.tools.\n * Zod's `.default([])` erases the distinction between \"absent\" and\n * \"explicitly empty\", so callers detect it on the raw payload — the same\n * contract sessions use: absent tools mean \"give me the workspace defaults\n * (enabled capability MCP servers)\", an explicit list (even empty) is taken\n * verbatim.\n */\nexport function scheduledTaskToolsProvided(rawPayload: unknown): boolean {\n  if (!rawPayload || typeof rawPayload !== \"object\") {\n    return false;\n  }\n  const agentConfig = (rawPayload as { agentConfig?: unknown }).agentConfig;\n  return Boolean(\n    agentConfig &&\n    typeof agentConfig === \"object\" &&\n    Object.prototype.hasOwnProperty.call(agentConfig, \"tools\"),\n  );\n}\n\nexport async function createValidatedScheduledTask(input: {\n  settings: Settings;\n  db: Database;\n  objectStorage: ObjectStorageDependency;\n  grant: AccessGrant;\n  payload: CreateScheduledTaskPayload;\n  // Whether the caller explicitly set agentConfig.tools (see\n  // scheduledTaskToolsProvided). Absent tools get the workspace's enabled\n  // capability MCP servers, mirroring session creation.\n  toolsProvided?: boolean;\n  // Set for pack-installation-inherited attachments that were already\n  // authorized with variable-sets:use when the pack was enabled.\n  variableSetPreauthorized?: boolean;\n  sessionAuthorization?: SessionAuthorizationPort | null | undefined;\n  authorizationSurface?: SessionAuthorizationSurface | undefined;\n}): Promise<ScheduledTask> {\n  // API parsing fills this default, but pack installers and older internal\n  // callers can still invoke the shared validator with the pre-action shape.\n  const action = input.payload.action ?? ({ kind: \"agent_turn\" } as const);\n  const knowledgeAction = action.kind === \"knowledge_source_sync\" ? action : null;\n  if (knowledgeAction) {\n    await validateKnowledgeSourceSyncAction({\n      db: input.db,\n      grant: input.grant,\n      action: knowledgeAction,\n    });\n  }\n  const agentConfig = knowledgeAction\n    ? input.payload.agentConfig\n    : await validateScheduledTaskAgentConfig({\n        ...input,\n        workspaceId: input.grant.workspaceId,\n      });\n  const id = crypto.randomUUID();\n  validateScheduledTaskSchedule(input.payload.schedule);\n  const target = knowledgeAction\n    ? null\n    : await validateScheduledTaskTarget({\n        db: input.db,\n        sessionAuthorization: input.sessionAuthorization,\n        authorizationSurface: input.authorizationSurface,\n        grant: input.grant,\n        targetSessionId: input.payload.targetSessionId,\n        runMode: input.payload.runMode,\n        variableSetId: input.payload.variableSetId,\n        rigId: input.payload.rigId,\n        agentConfig,\n      });\n  if (!knowledgeAction && input.payload.variableSetId) {\n    await validateVariableSetAttachment(\n      { settings: input.settings, db: input.db },\n      input.grant,\n      input.grant.workspaceId,\n      input.payload.variableSetId,\n      { preauthorized: input.variableSetPreauthorized ?? false },\n    );\n  }\n  // The rig is stored on the task and resolved to its ACTIVE version per fire\n  // (at dispatch), so validate only that the id names a rig in the workspace —\n  // NOT that it has an active version now (that is a fire-time concern). RLS\n  // makes a cross-workspace id indistinguishable from missing → both 422.\n  if (!knowledgeAction && input.payload.rigId) {\n    await requireScheduledTaskRig(input.db, input.grant.workspaceId, input.payload.rigId);\n  }\n  const personalConnectionDelegations = knowledgeAction\n    ? []\n    : await freezePersonalConnectionDelegations({\n        db: input.db,\n        workspaceId: input.grant.workspaceId,\n        settings: await settingsWithEnabledCapabilityMcpServers(\n          input.db,\n          input.grant.workspaceId,\n          input.settings,\n          { subjectId: input.grant.subjectId },\n        ),\n        tools: [...agentConfig.tools, { kind: \"mcp\", id: \"opengeni\" }],\n        source: personalConnectionDelegationSourceForGrant(input.grant),\n      });\n  const creationInitiator = creationInitiatorForGrant(input.grant);\n  const xaiProviderAccountAuthoritySnapshot: XaiProviderAccountAuthoritySnapshotV1 =\n    creationInitiator.actor\n      ? await getSessionTurnXaiProviderAccountAuthoritySnapshot(\n          input.db,\n          input.grant.workspaceId,\n          creationInitiator.actor.sessionId,\n          creationInitiator.actor.turnId,\n        )\n      : await resolveXaiProviderAccountAuthoritySnapshotForAcceptance(input.db, {\n          workspaceId: input.grant.workspaceId,\n          subjectId: input.grant.subjectId,\n        });\n  return await createScheduledTask(input.db, {\n    id,\n    accountId: input.grant.accountId,\n    workspaceId: input.grant.workspaceId,\n    name: trimmedScheduledTaskName(input.payload.name),\n    status: input.payload.status,\n    schedule: input.payload.schedule,\n    temporalScheduleId: scheduledTaskTemporalScheduleId(id),\n    runMode: input.payload.runMode,\n    overlapPolicy: input.payload.overlapPolicy,\n    action,\n    agentConfig,\n    ...(creationInitiator.initiator ? { createdBy: creationInitiator.initiator } : {}),\n    ...(creationInitiator.context ? { createdByContext: creationInitiator.context } : {}),\n    createdByActor: creationInitiator.actor ?? null,\n    personalConnectionDelegations,\n    xaiProviderAccountAuthoritySnapshot,\n    targetSessionId: target?.id ?? null,\n    variableSetId: input.payload.variableSetId ?? null,\n    rigId: input.payload.rigId ?? null,\n    metadata: input.payload.metadata,\n  });\n}\n\nexport async function validateScheduledTaskTarget(input: {\n  db: Database;\n  sessionAuthorization?: SessionAuthorizationPort | null | undefined;\n  authorizationSurface?: SessionAuthorizationSurface | undefined;\n  grant: AccessGrant;\n  targetSessionId: string | null | undefined;\n  runMode: ScheduledTask[\"runMode\"];\n  variableSetId: string | null | undefined;\n  rigId: string | null | undefined;\n  agentConfig: ScheduledTaskAgentConfig;\n  missingTargetStatus?: 404 | 422;\n}): Promise<Session | null> {\n  if (input.runMode !== \"existing_session\") {\n    if (input.targetSessionId) {\n      throw new HTTPException(422, {\n        message: \"targetSessionId requires runMode=existing_session\",\n      });\n    }\n    return null;\n  }\n  if (!input.targetSessionId) {\n    throw new HTTPException(input.missingTargetStatus ?? 422, {\n      message:\n        input.missingTargetStatus === 404\n          ? \"target session not found\"\n          : \"targetSessionId is required when runMode=existing_session\",\n    });\n  }\n  requirePermission(input.grant, \"sessions:control\");\n  if (input.agentConfig.goal) {\n    throw new HTTPException(422, {\n      message: \"agentConfig.goal cannot be used with an existing-session target\",\n    });\n  }\n  try {\n    await requireSessionAuthorization(\n      {\n        db: input.db,\n        ...(input.sessionAuthorization !== undefined\n          ? { sessionAuthorization: input.sessionAuthorization }\n          : {}),\n      },\n      input.grant,\n      {\n        sessionId: input.targetSessionId,\n        operation: \"session.control\",\n        surface: input.authorizationSurface ?? \"http\",\n      },\n    );\n  } catch (error) {\n    if (error instanceof SessionAuthorizationDeniedError) {\n      throw new HTTPException(404, { message: \"target session not found\" });\n    }\n    if (error instanceof SessionAuthorizationUnavailableError) {\n      throw new HTTPException(503, { message: \"session authorization is unavailable\" });\n    }\n    throw error;\n  }\n  const session = await getSession(input.db, input.grant.workspaceId, input.targetSessionId);\n  if (!session || session.accountId !== input.grant.accountId) {\n    throw new HTTPException(404, { message: \"target session not found\" });\n  }\n  if (session.status === \"cancelled\") {\n    throw new HTTPException(409, {\n      message: \"target session is cancelled; choose a revivable session\",\n    });\n  }\n  if ((session.variableSetId ?? null) !== (input.variableSetId ?? null)) {\n    throw new HTTPException(422, {\n      message: \"target session variableSet attachment does not match the scheduled task\",\n    });\n  }\n  if (input.rigId && input.rigId !== session.rigId) {\n    throw new HTTPException(422, {\n      message: \"target session rig does not match the scheduled task\",\n    });\n  }\n  if (\n    input.agentConfig.sandboxBackend !== undefined &&\n    input.agentConfig.sandboxBackend !== session.sandboxBackend\n  ) {\n    throw new HTTPException(422, {\n      message: \"target session sandbox backend does not match the scheduled task\",\n    });\n  }\n  if (\n    scheduledSlackBotConnectionId(session.metadata) !==\n    (input.agentConfig.slackBotConnectionId ?? null)\n  ) {\n    throw new HTTPException(422, {\n      message: \"target session OpenGeni Slack bot binding does not match the scheduled task\",\n    });\n  }\n  return session;\n}\n\nexport function scheduledTaskForGrant(task: ScheduledTask, grant: AccessGrant): ScheduledTask {\n  if (hasPermission(grant.permissions, \"sessions:control\") || task.targetSessionId === null) {\n    return task;\n  }\n  return { ...task, targetSessionId: null };\n}\n\nexport function scheduledTaskRunForGrant<T extends { sessionId: string | null }>(\n  run: T,\n  grant: AccessGrant,\n): T {\n  if (hasPermission(grant.permissions, \"sessions:control\") || run.sessionId === null) {\n    return run;\n  }\n  return { ...run, sessionId: null };\n}\n\n// Validate a scheduled task's rig reference: it must name a rig in the\n// workspace. A missing/cross-workspace id is a 422 (RLS-invisible == missing).\nasync function requireScheduledTaskRig(\n  db: Database,\n  workspaceId: string,\n  rigId: string,\n): Promise<void> {\n  const rig = await getRig(db, workspaceId, rigId);\n  if (!rig) {\n    throw new HTTPException(422, { message: `unknown rigId: ${rigId}` });\n  }\n}\n\nexport async function validatedScheduledTaskUpdate(input: {\n  settings: Settings;\n  db: Database;\n  objectStorage: ObjectStorageDependency;\n  grant: AccessGrant;\n  existing: ScheduledTask;\n  payload: UpdateScheduledTaskPayload;\n  /** See createValidatedScheduledTask; only consulted when agentConfig is updated. */\n  toolsProvided?: boolean;\n  sessionAuthorization?: SessionAuthorizationPort | null | undefined;\n  authorizationSurface?: SessionAuthorizationSurface | undefined;\n}): Promise<UpdateScheduledTaskInput> {\n  const update: UpdateScheduledTaskInput = {};\n  const existingKnowledge = input.existing.action.kind === \"knowledge_source_sync\";\n  if (input.payload.action && input.payload.action.kind !== input.existing.action.kind) {\n    throw new HTTPException(409, {\n      message: \"scheduled task action kind is immutable; create a new schedule\",\n    });\n  }\n  if (existingKnowledge) {\n    if (\n      input.payload.agentConfig !== undefined ||\n      input.payload.runMode !== undefined ||\n      input.payload.targetSessionId !== undefined ||\n      input.payload.variableSetId !== undefined ||\n      input.payload.rigId !== undefined\n    ) {\n      throw new HTTPException(422, {\n        message: \"knowledge source schedules do not accept agent/session configuration\",\n      });\n    }\n    if (input.payload.overlapPolicy === \"allow_concurrent\") {\n      throw new HTTPException(422, {\n        message: \"knowledge source schedules require skip or buffer_one overlap\",\n      });\n    }\n    if (input.payload.action?.kind === \"knowledge_source_sync\") {\n      await validateKnowledgeSourceSyncAction({\n        db: input.db,\n        grant: input.grant,\n        action: input.payload.action,\n      });\n      update.action = input.payload.action;\n    }\n    if (input.payload.name !== undefined)\n      update.name = trimmedScheduledTaskName(input.payload.name);\n    if (input.payload.status !== undefined) update.status = input.payload.status;\n    if (input.payload.schedule !== undefined) {\n      validateScheduledTaskSchedule(input.payload.schedule);\n      update.schedule = input.payload.schedule;\n    }\n    if (input.payload.overlapPolicy !== undefined) {\n      update.overlapPolicy = input.payload.overlapPolicy;\n    }\n    if (input.payload.metadata !== undefined) update.metadata = input.payload.metadata;\n    return update;\n  }\n  const existingTarget = input.existing.targetSessionId;\n  const nextRunMode = input.payload.runMode ?? input.existing.runMode;\n  const nextTargetSessionId =\n    input.payload.targetSessionId !== undefined\n      ? input.payload.targetSessionId\n      : nextRunMode === \"existing_session\"\n        ? existingTarget\n        : null;\n  if (\n    input.existing.runMode === \"reusable_session\" &&\n    input.existing.reusableSessionId &&\n    nextRunMode === \"existing_session\"\n  ) {\n    throw new HTTPException(409, {\n      message:\n        \"cannot target an existing session after this task created its reusable session; create a new task\",\n    });\n  }\n  if (input.payload.name !== undefined) {\n    update.name = trimmedScheduledTaskName(input.payload.name);\n  }\n  if (input.payload.status !== undefined) {\n    update.status = input.payload.status;\n  }\n  if (input.payload.schedule !== undefined) {\n    validateScheduledTaskSchedule(input.payload.schedule);\n    update.schedule = input.payload.schedule;\n  }\n  if (input.payload.runMode !== undefined) {\n    update.runMode = input.payload.runMode;\n  }\n  if (input.payload.overlapPolicy !== undefined) {\n    update.overlapPolicy = input.payload.overlapPolicy;\n  }\n  if (input.payload.metadata !== undefined) {\n    update.metadata = input.payload.metadata;\n  }\n  if (input.payload.variableSetId !== undefined) {\n    const nextVariableSetId = input.payload.variableSetId;\n    if (\n      (input.existing.variableSetId ?? null) !== (nextVariableSetId ?? null) &&\n      input.existing.runMode === \"reusable_session\" &&\n      input.existing.reusableSessionId\n    ) {\n      throw new HTTPException(409, {\n        message:\n          \"cannot change variableSet of a task with a live reusable session; recreate the task\",\n      });\n    }\n    if (nextVariableSetId === null) {\n      if (input.existing.variableSetId !== null) {\n        // Detaching is also an attachment change: it strips the secrets a\n        // task's instructions were designed around.\n        requirePermission(input.grant, \"variable-sets:use\");\n      }\n      update.variableSetId = null;\n    } else {\n      await validateVariableSetAttachment(\n        { settings: input.settings, db: input.db },\n        input.grant,\n        input.existing.workspaceId,\n        nextVariableSetId,\n      );\n      update.variableSetId = nextVariableSetId;\n    }\n  }\n  if (input.payload.rigId !== undefined) {\n    // The rig binds fresh per fire, so changing it on a reusable-session task is\n    // harmless for the LIVE session (which keeps its own frozen version) and\n    // only affects subsequent new-session fires — no live-session guard needed.\n    if (input.payload.rigId !== null) {\n      await requireScheduledTaskRig(input.db, input.existing.workspaceId, input.payload.rigId);\n    }\n    update.rigId = input.payload.rigId;\n  }\n  if (input.payload.agentConfig !== undefined) {\n    // Editing the instructions of a task that injects workspace secrets is\n    // equivalent to attaching those secrets to new instructions, so it\n    // requires variable-sets:use even though plain task edits do not.\n    const willHaveVariableSet =\n      input.payload.variableSetId !== undefined\n        ? input.payload.variableSetId !== null\n        : Boolean(input.existing.variableSetId);\n    if (willHaveVariableSet) {\n      requirePermission(input.grant, \"variable-sets:use\");\n    }\n    const nextAgentConfig = await validateScheduledTaskAgentConfig({\n      settings: input.settings,\n      db: input.db,\n      objectStorage: input.objectStorage,\n      grant: input.grant,\n      workspaceId: input.existing.workspaceId,\n      payload: { agentConfig: input.payload.agentConfig },\n      ...(input.toolsProvided !== undefined ? { toolsProvided: input.toolsProvided } : {}),\n    });\n    if (\n      input.existing.reusableSessionId &&\n      input.existing.runMode === \"reusable_session\" &&\n      (input.existing.agentConfig.slackBotConnectionId ?? null) !==\n        (nextAgentConfig.slackBotConnectionId ?? null)\n    ) {\n      throw new HTTPException(409, {\n        message:\n          \"cannot change the OpenGeni Slack bot connection of a task with a live reusable session; recreate the task\",\n      });\n    }\n    update.agentConfig = nextAgentConfig;\n    const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(\n      input.db,\n      input.existing.workspaceId,\n      input.settings,\n      { subjectId: input.grant.subjectId },\n    );\n    const personalConnectionDelegations = await freezePersonalConnectionDelegations({\n      db: input.db,\n      workspaceId: input.existing.workspaceId,\n      settings: runtimeSettings,\n      tools: [...nextAgentConfig.tools, { kind: \"mcp\", id: \"opengeni\" }],\n      source: personalConnectionDelegationSourceForGrant(input.grant),\n    });\n    if (input.existing.reusableSessionId && input.existing.runMode === \"reusable_session\") {\n      const existingDelegations = await getScheduledTaskPersonalConnectionDelegations(\n        input.db,\n        input.existing.workspaceId,\n        input.existing.id,\n      );\n      if (!personalConnectionDelegationsEqual(existingDelegations, personalConnectionDelegations)) {\n        throw new HTTPException(409, {\n          message:\n            \"cannot change personal MCP connections of a task with a live reusable session; recreate the task\",\n        });\n      }\n    }\n    update.personalConnectionDelegations = personalConnectionDelegations;\n  }\n  if (\n    existingTarget &&\n    (nextRunMode !== \"existing_session\" || nextTargetSessionId !== existingTarget)\n  ) {\n    await validateScheduledTaskTarget({\n      db: input.db,\n      sessionAuthorization: input.sessionAuthorization,\n      authorizationSurface: input.authorizationSurface,\n      grant: input.grant,\n      targetSessionId: existingTarget,\n      runMode: \"existing_session\",\n      variableSetId: input.existing.variableSetId,\n      rigId: input.existing.rigId,\n      agentConfig: input.existing.agentConfig,\n    });\n  }\n  await validateScheduledTaskTarget({\n    db: input.db,\n    sessionAuthorization: input.sessionAuthorization,\n    authorizationSurface: input.authorizationSurface,\n    grant: input.grant,\n    targetSessionId: nextTargetSessionId,\n    runMode: nextRunMode,\n    variableSetId:\n      input.payload.variableSetId !== undefined\n        ? input.payload.variableSetId\n        : input.existing.variableSetId,\n    rigId: input.payload.rigId !== undefined ? input.payload.rigId : input.existing.rigId,\n    agentConfig: update.agentConfig ?? input.existing.agentConfig,\n  });\n  if (\n    input.payload.targetSessionId !== undefined ||\n    input.existing.runMode === \"existing_session\" ||\n    nextRunMode === \"existing_session\"\n  ) {\n    update.targetSessionId = nextTargetSessionId;\n  }\n  return update;\n}\n\nexport async function requireScheduledTaskForApi(\n  db: Database,\n  workspaceId: string,\n  taskId: string,\n): Promise<ScheduledTask> {\n  const task = await getScheduledTask(db, workspaceId, taskId);\n  if (!task) {\n    throw new HTTPException(404, { message: \"scheduled task not found\" });\n  }\n  return task;\n}\n\nexport type ScheduledTaskRestoreState = {\n  task: ScheduledTask;\n  personalConnectionDelegations: McpPersonalConnectionDelegation[];\n};\n\nexport async function captureScheduledTaskRestoreState(\n  db: Database,\n  task: ScheduledTask,\n): Promise<ScheduledTaskRestoreState> {\n  return {\n    task,\n    personalConnectionDelegations: await getScheduledTaskPersonalConnectionDelegations(\n      db,\n      task.workspaceId,\n      task.id,\n    ),\n  };\n}\n\nexport async function restoreScheduledTask(\n  db: Database,\n  previous: ScheduledTaskRestoreState,\n): Promise<ScheduledTask> {\n  const { task } = previous;\n  return await updateScheduledTask(db, task.workspaceId, task.id, {\n    name: task.name,\n    status: task.status,\n    schedule: task.schedule,\n    runMode: task.runMode,\n    overlapPolicy: task.overlapPolicy,\n    action: task.action,\n    agentConfig: task.agentConfig,\n    personalConnectionDelegations: previous.personalConnectionDelegations,\n    ...(task.runMode === \"existing_session\"\n      ? { targetSessionId: task.targetSessionId }\n      : { reusableSessionId: task.reusableSessionId }),\n    variableSetId: task.variableSetId,\n    rigId: task.rigId,\n    metadata: task.metadata,\n  });\n}\n\nasync function validateKnowledgeSourceSyncAction(input: {\n  db: Database;\n  grant: AccessGrant;\n  action: KnowledgeSourceSyncAction;\n}): Promise<void> {\n  if (input.action.initiatingSubjectId !== input.grant.subjectId) {\n    throw new HTTPException(403, {\n      message: \"knowledge source sync must preserve the exact initiating subject\",\n    });\n  }\n  if (input.action.connection.ownerSubjectId !== input.grant.subjectId) {\n    throw new HTTPException(403, {\n      message: \"knowledge source connection must belong to the initiating subject\",\n    });\n  }\n  const resolved = await getKnowledgeSourceForSyncAuthority(input.db, {\n    accountId: input.grant.accountId,\n    workspaceId: input.grant.workspaceId,\n    sourceId: input.action.sourceId,\n    initiatingSubjectId: input.grant.subjectId,\n  });\n  if (!resolved || resolved.source.lifecycleState !== \"active\") {\n    throw new HTTPException(404, { message: \"knowledge source not found\" });\n  }\n  if (\n    resolved.source.syncGeneration !== input.action.sourceGeneration ||\n    resolved.source.lifecycleGeneration !== input.action.sourceLifecycleGeneration ||\n    scopedKnowledgeScopeKey(resolved.source.scope) !==\n      scopedKnowledgeScopeKey(input.action.destination)\n  ) {\n    throw new HTTPException(409, {\n      message: \"knowledge source authority or generation changed\",\n    });\n  }\n  const connection = await getConnectionMetadata(\n    input.db,\n    input.grant.workspaceId,\n    input.action.connection.connectionId,\n    input.grant.subjectId,\n  );\n  if (\n    !connection ||\n    connection.accountId !== input.grant.accountId ||\n    connection.workspaceId !== input.grant.workspaceId ||\n    connection.subjectId !== input.action.connection.ownerSubjectId ||\n    connection.version !== input.action.connection.connectionVersion ||\n    connection.providerDomain.toLowerCase() !==\n      input.action.connection.providerDomain.toLowerCase() ||\n    connection.kind !== input.action.connection.kind ||\n    connection.status !== \"active\"\n  ) {\n    throw new HTTPException(409, {\n      message: \"knowledge source connection authority changed or requires reconnect\",\n    });\n  }\n}\n\nexport class ScheduledTaskSyncError extends Error {\n  readonly persistenceRestored: boolean;\n\n  constructor(cause: unknown, persistenceRestored: boolean) {\n    super(cause instanceof Error ? cause.message : String(cause), { cause });\n    this.name = \"ScheduledTaskSyncError\";\n    this.persistenceRestored = persistenceRestored;\n  }\n}\n\nexport async function syncCreatedScheduledTask(input: {\n  db: Database;\n  workflowClient: SessionWorkflowClient;\n  task: ScheduledTask;\n}): Promise<void> {\n  try {\n    await input.workflowClient.syncScheduledTask({ task: input.task });\n  } catch (error) {\n    let persistenceRestored = true;\n    try {\n      await deleteScheduledTask(input.db, input.task.workspaceId, input.task.id);\n    } catch {\n      persistenceRestored = false;\n    }\n    throw new ScheduledTaskSyncError(error, persistenceRestored);\n  }\n}\n\nexport async function syncUpdatedScheduledTask(input: {\n  db: Database;\n  workflowClient: SessionWorkflowClient;\n  previous: ScheduledTaskRestoreState;\n  task: ScheduledTask;\n}): Promise<void> {\n  try {\n    await input.workflowClient.syncScheduledTask({ task: input.task });\n  } catch (error) {\n    let persistenceRestored = true;\n    try {\n      await restoreScheduledTask(input.db, input.previous);\n    } catch {\n      persistenceRestored = false;\n    }\n    throw new ScheduledTaskSyncError(error, persistenceRestored);\n  }\n}\n\nexport function scheduledTaskTemporalScheduleId(taskId: string): string {\n  return `scheduled-task-${taskId}`;\n}\n\n/**\n * Stable token that identifies a single logical manual trigger. A client that\n * retries a `/trigger` POST (network blip, lambda re-invocation) passes the\n * SAME token so the retry is idempotent — one usage charge, one workflow run.\n * When the client supplies nothing we mint one UUID PER REQUEST and reuse it\n * for both the idempotency key and the workflowId, so a single request stays\n * internally consistent while two genuinely-distinct manual triggers (no token,\n * fired a second apart) still each get their own run. The token is sanitized to\n * the Temporal workflow-id-safe charset so a client value cannot smuggle a\n * collision into a different task's id space.\n */\nexport function scheduledTaskTriggerToken(clientTriggerId?: string | null): string {\n  const trimmed = (clientTriggerId ?? \"\").trim();\n  if (!trimmed) {\n    return crypto.randomUUID();\n  }\n  const safe = trimmed.replace(/[^a-zA-Z0-9._-]/g, \"_\").slice(0, 128);\n  // A value that sanitizes to empty (only disallowed chars) is unusable as a\n  // stable id; fall back to a fresh token rather than collapse to a constant.\n  return safe.length > 0 ? safe : crypto.randomUUID();\n}\n\n/**\n * Deterministic Temporal workflow id for a manual trigger. Derived purely from\n * the task id and the stable trigger token, so a retry with the same token maps\n * to the same id and `workflowIdReusePolicy: \"REJECT_DUPLICATE\"` collapses the\n * second start into a no-op instead of spawning a second run.\n */\nexport function manualScheduledTaskTriggerWorkflowId(taskId: string, triggerToken: string): string {\n  return `scheduled-task-${taskId}-manual-${triggerToken}`;\n}\n\n/**\n * Deterministic usage idempotency key for a manual trigger's agent_run.created\n * charge. Shares the stable trigger token with the workflow id so the charge\n * and the run dedupe together under retry.\n */\nexport function manualScheduledTaskTriggerUsageKey(\n  workspaceId: string,\n  taskId: string,\n  triggerToken: string,\n): string {\n  return `agent_run.created:scheduled-trigger:${workspaceId}:${taskId}:${triggerToken}`;\n}\n\nasync function validateScheduledTaskAgentConfig(input: {\n  settings: Settings;\n  db: Database;\n  objectStorage: ObjectStorageDependency;\n  grant: AccessGrant;\n  payload: { agentConfig: ScheduledTaskAgentConfig };\n  workspaceId: string;\n  toolsProvided?: boolean;\n}): Promise<ScheduledTaskAgentConfig> {\n  // Reject a curated-out model before touching the DB: a scheduled task is a\n  // session the worker runs later, so it must pass the same allow-list as the\n  // session choke points (a `scheduled_tasks:manage` holder could otherwise set\n  // a model the host does not expose). An omitted model inherits the host\n  // default downstream, which is always configured.\n  const model = canonicalConfiguredModel(input.settings, input.payload.agentConfig.model);\n  // Same policy vetting as the session choke points; an omitted model flows\n  // through session creation later, where the effective default is vetted.\n  await assertWorkspaceModelPolicyAllows(input.db, input.settings, input.workspaceId, model);\n  const resources = normalizeResources(input.payload.agentConfig.resources ?? []);\n  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(\n    input.db,\n    input.workspaceId,\n    input.settings,\n    { subjectId: input.grant.subjectId },\n  );\n  const requestedTools = validateToolRefs(input.payload.agentConfig.tools ?? [], runtimeSettings);\n  // A task whose creator did not choose tools gets the workspace's enabled\n  // capability MCP servers, exactly like a session created without a tools\n  // key. Scheduled runs are sessions too; \"no MCP servers at all\" was a trap\n  // every pack/template instantiation path kept falling into (a maintenance\n  // task that cannot reach its workspace's notebook MCP cannot do its job).\n  const tools =\n    (input.toolsProvided ?? true)\n      ? requestedTools\n      : withDefaultEnabledCapabilityMcpTools(requestedTools, input.settings, runtimeSettings);\n  const prompt = input.payload.agentConfig.prompt.trim();\n  if (!prompt) {\n    throw new HTTPException(422, { message: \"scheduled task prompt is required\" });\n  }\n  if (hasReservedOpenGeniSlackBotSessionMetadata(input.payload.agentConfig.metadata)) {\n    throw new HTTPException(422, {\n      message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY} is reserved for scheduler routing`,\n    });\n  }\n  await validateGitHubRepositorySelection(input.db, input.workspaceId, resources);\n  if (resources.some((resource) => resource.kind === \"file\") && !input.objectStorage) {\n    throw new HTTPException(503, { message: \"object storage is not configured\" });\n  }\n  await validateFileResources(\n    input.db,\n    input.grant.accountId,\n    input.workspaceId,\n    input.grant.subjectId,\n    resources,\n  );\n  if (input.payload.agentConfig.slackBotConnectionId) {\n    await validateOpenGeniSlackBotConnectionSelection(\n      input.db,\n      input.grant,\n      input.workspaceId,\n      input.payload.agentConfig.slackBotConnectionId,\n    );\n  }\n  const requestedMaxDepth = input.payload.agentConfig.maxNestedAgentDepth;\n  if (requestedMaxDepth !== undefined) {\n    const workspace = await requireWorkspace(input.db, input.workspaceId);\n    const workspaceMaxDepth = workspace.settings.maxNestedAgentDepth;\n    const deploymentPolicy = await getNestedAgentDepthDeploymentPolicy(input.db);\n    const inheritedMaxDepth =\n      typeof workspaceMaxDepth === \"number\"\n        ? workspaceMaxDepth\n        : deploymentPolicy.maxNestedAgentDepth;\n    if (\n      requestedMaxDepth > inheritedMaxDepth &&\n      !hasPermission(input.grant.permissions, \"workspace:admin\")\n    ) {\n      throw new HTTPException(403, {\n        message: `scheduled task maxNestedAgentDepth ${requestedMaxDepth} exceeds inherited limit ${inheritedMaxDepth}; workspace:admin is required to increase it`,\n      });\n    }\n  }\n  return {\n    ...input.payload.agentConfig,\n    ...(model === undefined || model === null ? {} : { model }),\n    prompt,\n    resources,\n    tools,\n  };\n}\n\nfunction validateScheduledTaskSchedule(schedule: ScheduledTask[\"schedule\"]): void {\n  if (schedule.type !== \"interval\" || !schedule.startAt || !schedule.endAt) {\n    return;\n  }\n  if (new Date(schedule.startAt).getTime() >= new Date(schedule.endAt).getTime()) {\n    throw new HTTPException(422, { message: \"interval schedule endAt must be after startAt\" });\n  }\n}\n\nfunction trimmedScheduledTaskName(name: string): string {\n  const trimmed = name.trim();\n  if (!trimmed) {\n    throw new HTTPException(422, { message: \"scheduled task name is required\" });\n  }\n  return trimmed;\n}\n","import { CODEX_MODEL_ID_PREFIX, isCodexBilledModel } from \"@opengeni/codex\";\nimport {\n  canonicalizeConfiguredModelId,\n  configuredAllowedModels,\n  resolveFirstPartyMcpToolPolicy,\n  policyProviderIdForModel,\n  resolveTurnExecutionPolicyV1,\n  WORKSPACE_GATEWAY_MODEL_ID_PREFIX,\n  XAI_SUBSCRIPTION_MODEL_ID_PREFIX,\n  type Settings,\n} from \"@opengeni/config\";\nimport {\n  CreateSessionRequest,\n  DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,\n  DEFAULT_FIRST_PARTY_MCP_TOOLS,\n  FIRST_PARTY_MCP_TOOL_NAMES,\n  OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,\n  SessionSpawnDenial,\n  ServiceTurnInitiator,\n  ServiceTurnInitiatorContext,\n  evaluateWorkspaceModelPolicy,\n  latencyModeForMetadata,\n  reasoningEffortForMetadata,\n  stableJson,\n  type AccessGrant,\n  type CreateSessionResponse,\n  type GoalSpec,\n  type FirstPartyMcpToolName,\n  type McpPersonalConnectionDelegation,\n  type Permission,\n  type ReasoningEffort,\n  type ResourceRef,\n  type Session,\n  type SessionSkill,\n  type SessionEvent,\n  SessionMcpApprovalPolicy,\n  type SessionMcpCredentialUpdateInput,\n  type SessionMcpServerInput,\n  type SessionMcpServerMetadata,\n  type SubmittedTimelineAnnotation,\n  type TimelineAnnotation,\n  type UpdateSessionMcpApprovalPolicyResponse,\n  type UpdateSessionToolPolicyRequest,\n  type SessionAuthorizationPort,\n  type SessionToolPolicy,\n  type SessionTurn,\n  type ToolRef,\n  type TurnInitiator,\n  type TurnInitiatorContext,\n  type TurnExecutionPolicyV1,\n  type XaiProviderAccountAuthoritySnapshotV1,\n} from \"@opengeni/contracts\";\nimport {\n  createSession,\n  createSessionWithIdempotencyKeyResult,\n  encryptVariableSetValue,\n  getAnySessionInGroup,\n  getEnrollment,\n  getChannel,\n  getRig,\n  getWorkspaceDefaultRigId,\n  listDistinctVariableSetIdsInGroup,\n  listDistinctRigVersionIdsInGroup,\n  getSandbox,\n  getSession,\n  SessionIdConflictError,\n  getSessionSpawnDenialByIdempotencyKey,\n  getWorkspaceControlEvent,\n  getSessionLineage,\n  getSessionTurn,\n  getSessionTurnXaiProviderAccountAuthoritySnapshot,\n  getWorkspaceModelPolicy,\n  initializeSessionStartAtomically,\n  listSessionTurns,\n  listSessionMcpServersForChildInheritance,\n  requireSession,\n  submitHumanPromptInTransaction,\n  appendSessionEventsWithLockedSessionUpdate,\n  updateSessionTitle as updateSessionTitleRow,\n  withWorkspaceSubjectSessionActivityRls,\n  type CreateSessionMcpServerInput,\n  type Database,\n  type UpdateSessionMcpServerCredentialsInput,\n  QueueCommandConflictError,\n  AgentCommandAuthorityError,\n  runIdempotentPersistenceTransaction,\n  SessionSpawnDeniedDbError,\n  SessionControlConflictError,\n  SessionToolPolicyVersionConflictError,\n  type SessionCommandActor,\n} from \"@opengeni/db\";\nimport {\n  appendAndPublishEvents,\n  publishDurableSessionEvents,\n  publishDurableWorkspaceControlEvent,\n  type EventBus,\n} from \"@opengeni/events\";\nimport { HTTPException } from \"hono/http-exception\";\nimport { hasPermission, requirePermission } from \"../access\";\nimport { recordWorkspaceUsage, requireLimit } from \"../billing/limits\";\nimport type {\n  AcceptSessionUserMessageDependencies,\n  ApiRouteDeps,\n  SessionWorkflowClient,\n} from \"../dependencies\";\nimport {\n  requireSessionAuthorization,\n  SessionAuthorizationDeniedError,\n} from \"../session-authorization\";\nimport { swapActiveSandbox, type FleetContext } from \"../sandbox/fleet\";\nimport { settingsWithEnabledCapabilityMcpServers } from \"./capabilities\";\nimport { validateSubmittedTimelineAnnotations } from \"./timeline-annotations\";\nimport { requireVariableSetEncryption, validateVariableSetAttachment } from \"./environments\";\nimport {\n  freezePersonalConnectionDelegations,\n  personalConnectionDelegationSourceForGrant,\n} from \"./personal-connection-delegations\";\nimport { hasReservedOpenGeniSlackBotSessionMetadata } from \"./slack-bot\";\nimport {\n  assertToolRefsSubset,\n  availableToolRefs,\n  mergeToolRefs,\n  normalizeResources,\n  validateFileResources,\n  validateGitHubRepositorySelection,\n  validateToolRefs,\n  withDefaultEnabledCapabilityMcpTools,\n} from \"./resources\";\n\nconst reservedSessionMcpServerIds = new Set([\"opengeni\", \"files\", \"docs\", \"codex_apps\"]);\nconst maxSessionMcpCredentialHeaders = 16;\nconst maxSessionMcpCredentialHeaderValueLength = 4096;\n// Keep the durable snapshot below the shared event-preview array boundary so\n// the generic lossy projection cannot silently rewrite this audit fact.\nconst maxToolPolicyAuditRefs = 40;\n// RFC 9110 field-name token characters.\nconst sessionMcpCredentialHeaderName = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;\n\n/** Transport-neutral typed denial raised only after its audit row committed. */\nexport class SessionSpawnDeniedError extends Error {\n  readonly denial: SessionSpawnDenial;\n\n  constructor(denial: SessionSpawnDenial) {\n    super(sessionSpawnDeniedMessage(denial));\n    this.name = \"SessionSpawnDeniedError\";\n    this.denial = denial;\n  }\n}\n\n/**\n * Resolve per-session first-party tool visibility without consulting\n * authorization. Top-level omission snapshots the complete runtime default;\n * child omission snapshots the parent's exact effective selection. Explicit\n * [] is authoritative and must never widen.\n */\nexport function resolveFirstPartyMcpToolsForCreate(\n  requested: FirstPartyMcpToolName[] | undefined,\n  parentStored: FirstPartyMcpToolName[] | null | undefined,\n  policy: {\n    default: readonly FirstPartyMcpToolName[];\n    allowed: readonly FirstPartyMcpToolName[];\n  } = {\n    default: DEFAULT_FIRST_PARTY_MCP_TOOLS,\n    allowed: FIRST_PARTY_MCP_TOOL_NAMES,\n  },\n): FirstPartyMcpToolName[] {\n  if (requested !== undefined) return [...requested];\n  const allowed = new Set(policy.allowed);\n  const inherited = parentStored === undefined ? policy.default : (parentStored ?? policy.default);\n  return [...inherited].filter((tool) => allowed.has(tool));\n}\n\nfunction sessionSpawnDeniedMessage(denial: SessionSpawnDenial): string {\n  if (denial.code === \"nested_agent_depth_override_forbidden\") {\n    return `requested nested-agent depth limit ${denial.requestedMaxNestedAgentDepthOverride ?? \"unknown\"} exceeds inherited limit ${denial.effectiveMaxNestedAgentDepth}; workspace:admin is required to increase it`;\n  }\n  return `nested-agent depth ${denial.attemptedDepth} exceeds effective limit ${denial.effectiveMaxNestedAgentDepth} (current parent depth ${denial.currentDepth})`;\n}\n\nexport function sessionSpawnDenialEnvelope(error: SessionSpawnDeniedError) {\n  return {\n    error: {\n      code: error.denial.code,\n      message: error.message,\n      details: { denial: error.denial },\n    },\n  } as const;\n}\n\ntype ValidatedSessionMcpServers = {\n  runtimeServers: Settings[\"mcpServers\"];\n  dbServers: CreateSessionMcpServerInput[];\n  metadata: SessionMcpServerMetadata[];\n};\n\nexport type FrozenCreationInitiator = {\n  initiator?: TurnInitiator;\n  context?: TurnInitiatorContext;\n  actor?: Extract<SessionCommandActor, { type: \"agent_attempt\" }>;\n};\n\nfunction serviceInitiatorForGrant(grant: AccessGrant): {\n  initiator: ServiceTurnInitiator;\n  context: ServiceTurnInitiatorContext;\n} | null {\n  if (!grant.serviceInitiator) {\n    if (grant.serviceInitiatorContext) {\n      throw new HTTPException(403, {\n        message: \"service initiator context requires a signed service initiator\",\n      });\n    }\n    return null;\n  }\n  const initiator = ServiceTurnInitiator.safeParse(grant.serviceInitiator);\n  if (!initiator.success) {\n    throw new HTTPException(403, {\n      message: \"a delegated command initiator must be a bounded service principal\",\n    });\n  }\n  const context = ServiceTurnInitiatorContext.safeParse(grant.serviceInitiatorContext ?? {});\n  if (!context.success) {\n    throw new HTTPException(403, {\n      message: \"delegated service initiator context is invalid or reserved\",\n    });\n  }\n  const callerTurnId = grant.metadata?.[\"turnId\"];\n  const callerAttemptId = grant.metadata?.[\"attemptId\"];\n  const callerExecutionGeneration = grant.metadata?.[\"executionGeneration\"];\n  if (\n    callerTurnId !== undefined ||\n    callerAttemptId !== undefined ||\n    callerExecutionGeneration !== undefined\n  ) {\n    throw new HTTPException(403, {\n      message: \"a service initiator cannot replace an exact agent-attempt initiator\",\n    });\n  }\n  return {\n    initiator: initiator.data,\n    context: context.data,\n  };\n}\n\nexport function creationInitiatorForGrant(grant: AccessGrant): FrozenCreationInitiator {\n  const serviceInitiator = serviceInitiatorForGrant(grant);\n  const callerSessionId = grant.metadata?.[\"sessionId\"];\n  const callerTurnId = grant.metadata?.[\"turnId\"];\n  const callerAttemptId = grant.metadata?.[\"attemptId\"];\n  const callerExecutionGeneration = grant.metadata?.[\"executionGeneration\"];\n  const hasCallerTurnClaim =\n    callerTurnId !== undefined ||\n    callerAttemptId !== undefined ||\n    callerExecutionGeneration !== undefined;\n  if (hasCallerTurnClaim) {\n    if (\n      typeof callerSessionId !== \"string\" ||\n      typeof callerTurnId !== \"string\" ||\n      typeof callerAttemptId !== \"string\" ||\n      typeof callerExecutionGeneration !== \"number\" ||\n      !Number.isSafeInteger(callerExecutionGeneration) ||\n      callerExecutionGeneration < 1\n    ) {\n      throw new HTTPException(403, {\n        message: \"caller attempt claims are incomplete\",\n      });\n    }\n    const actor = {\n      type: \"agent_attempt\",\n      sessionId: callerSessionId,\n      turnId: callerTurnId,\n      attemptId: callerAttemptId,\n      executionGeneration: callerExecutionGeneration,\n    } as const;\n    // The DB create transaction validates this exact attempt and derives the\n    // inherited subject under the same locks as the child-session insert.\n    return { actor };\n  }\n  if (serviceInitiator) {\n    return serviceInitiator;\n  }\n  return {\n    initiator: {\n      kind: \"subject\",\n      subjectId: grant.subjectId,\n      ...(grant.subjectLabel ? { label: grant.subjectLabel } : {}),\n    },\n    context: {},\n  };\n}\n\nfunction normalizedSessionMcpCredentialHeaders(\n  headers: Record<string, string> | undefined,\n): Record<string, string> {\n  if (!headers) {\n    return {};\n  }\n  const entries = Object.entries(headers)\n    .map(([name, value]) => [name.trim(), value] as const)\n    .filter(([name]) => name.length > 0);\n  if (entries.length > maxSessionMcpCredentialHeaders) {\n    throw new HTTPException(422, {\n      message: `a session MCP server supports at most ${maxSessionMcpCredentialHeaders} credential headers`,\n    });\n  }\n  const seen = new Set<string>();\n  for (const [name, value] of entries) {\n    if (!sessionMcpCredentialHeaderName.test(name)) {\n      throw new HTTPException(422, {\n        message: `invalid credential header name: ${name}`,\n      });\n    }\n    const lower = name.toLowerCase();\n    if (seen.has(lower)) {\n      throw new HTTPException(422, {\n        message: `duplicate credential header name: ${name}`,\n      });\n    }\n    seen.add(lower);\n    if (value.length === 0 || value.length > maxSessionMcpCredentialHeaderValueLength) {\n      throw new HTTPException(422, {\n        message: `credential header ${name} must be 1-${maxSessionMcpCredentialHeaderValueLength} characters`,\n      });\n    }\n    // RFC 9110 §5.5: field values are HTAB / printable characters.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u0008\\u000A-\\u001F\\u007F]/.test(value)) {\n      throw new HTTPException(422, {\n        message: `credential header ${name} contains forbidden control characters`,\n      });\n    }\n  }\n  return Object.fromEntries(entries);\n}\n\nfunction mcpServerConfigFromInput(server: SessionMcpServerInput): Settings[\"mcpServers\"][number] {\n  return {\n    id: server.id,\n    ...(server.name ? { name: server.name } : {}),\n    url: server.url,\n    ...(server.allowedTools ? { allowedTools: server.allowedTools } : {}),\n    ...(server.timeoutMs ? { timeoutMs: server.timeoutMs } : {}),\n    cacheToolsList: server.cacheToolsList ?? false,\n    ...(server.requireApproval !== undefined ? { requireApproval: server.requireApproval } : {}),\n    ...(server.connectionRef ? { connectionRef: server.connectionRef } : {}),\n  };\n}\n\nfunction mcpServerConfigFromStoredInput(\n  server: CreateSessionMcpServerInput,\n): Settings[\"mcpServers\"][number] {\n  return {\n    id: server.id,\n    ...(server.name ? { name: server.name } : {}),\n    url: server.url,\n    ...(server.allowedTools ? { allowedTools: server.allowedTools } : {}),\n    ...(server.timeoutMs ? { timeoutMs: server.timeoutMs } : {}),\n    cacheToolsList: server.cacheToolsList ?? false,\n    ...(server.requireApproval != null ? { requireApproval: server.requireApproval } : {}),\n    ...(server.connectionRef ? { connectionRef: server.connectionRef } : {}),\n  };\n}\n\nfunction mcpServerConfigFromMetadata(\n  server: SessionMcpServerMetadata,\n): Settings[\"mcpServers\"][number] {\n  return {\n    id: server.id,\n    ...(server.name ? { name: server.name } : {}),\n    url: server.url,\n    cacheToolsList: false,\n    requireApproval: server.requireApproval,\n    ...(server.connectionRef ? { connectionRef: server.connectionRef } : {}),\n  };\n}\n\nfunction settingsWithSessionMcpServerConfigs(\n  settings: Settings,\n  servers: Settings[\"mcpServers\"],\n): Settings {\n  if (servers.length === 0) {\n    return settings;\n  }\n  const sessionIds = new Set(servers.map((server) => server.id));\n  return {\n    ...settings,\n    mcpServers: [...settings.mcpServers.filter((server) => !sessionIds.has(server.id)), ...servers],\n  };\n}\n\nexport function settingsWithSessionMcpServerMetadata(\n  settings: Settings,\n  servers: SessionMcpServerMetadata[],\n): Settings {\n  return settingsWithSessionMcpServerConfigs(settings, servers.map(mcpServerConfigFromMetadata));\n}\n\nfunction validateSessionMcpServersForCreate(\n  settings: Settings,\n  grant: AccessGrant,\n  servers: SessionMcpServerInput[],\n): ValidatedSessionMcpServers {\n  if (servers.length === 0) {\n    return { runtimeServers: [], dbServers: [], metadata: [] };\n  }\n  requirePermission(grant, \"mcp_servers:attach\");\n  const encryptionKey = servers.some((server) => Object.keys(server.headers ?? {}).length > 0)\n    ? requireVariableSetEncryption(settings)\n    : null;\n  const existingIds = new Set(settings.mcpServers.map((server) => server.id));\n  const seenIds = new Set<string>();\n  const runtimeServers: Settings[\"mcpServers\"] = [];\n  const dbServers: CreateSessionMcpServerInput[] = [];\n  const metadata: SessionMcpServerMetadata[] = [];\n  for (const server of servers) {\n    if (seenIds.has(server.id)) {\n      throw new HTTPException(422, {\n        message: `duplicate session MCP server id: ${server.id}`,\n      });\n    }\n    seenIds.add(server.id);\n    if (reservedSessionMcpServerIds.has(server.id) || existingIds.has(server.id)) {\n      throw new HTTPException(422, {\n        message: `MCP server id already exists: ${server.id}`,\n      });\n    }\n    const headers = normalizedSessionMcpCredentialHeaders(server.headers);\n    const headersEncrypted = Object.fromEntries(\n      Object.entries(headers).map(([name, value]) => [\n        name,\n        encryptVariableSetValue(encryptionKey!, value),\n      ]),\n    );\n    runtimeServers.push(mcpServerConfigFromInput(server));\n    dbServers.push({\n      id: server.id,\n      name: server.name ?? null,\n      url: server.url,\n      allowedTools: server.allowedTools ?? null,\n      timeoutMs: server.timeoutMs ?? null,\n      cacheToolsList: server.cacheToolsList ?? false,\n      requireApproval: server.requireApproval ?? null,\n      connectionRef: server.connectionRef ?? null,\n      headersEncrypted,\n    });\n    metadata.push({\n      id: server.id,\n      name: server.name ?? null,\n      url: server.url,\n      headerNames: Object.keys(headersEncrypted).sort(),\n      credentialVersion: 1,\n      requireApproval: server.requireApproval ?? false,\n      connectionRef: server.connectionRef ?? null,\n    });\n  }\n  return { runtimeServers, dbServers, metadata };\n}\n\nfunction validateInheritedSessionMcpServersForCreate(\n  servers: CreateSessionMcpServerInput[],\n): ValidatedSessionMcpServers {\n  if (servers.length === 0) {\n    return { runtimeServers: [], dbServers: [], metadata: [] };\n  }\n  const seenIds = new Set<string>();\n  for (const server of servers) {\n    if (seenIds.has(server.id)) {\n      throw new HTTPException(422, {\n        message: `duplicate inherited session MCP server id: ${server.id}`,\n      });\n    }\n    seenIds.add(server.id);\n    if (reservedSessionMcpServerIds.has(server.id)) {\n      throw new HTTPException(422, {\n        message: `reserved inherited session MCP server id: ${server.id}`,\n      });\n    }\n  }\n  // A newly enabled deployment/workspace capability may now reuse an id that\n  // belonged to this parent attachment first. Preserve the parent's existing\n  // session-overlay precedence instead of making child creation depend on a\n  // later workspace setting; settingsWithSessionMcpServerConfigs performs that\n  // same overlay for ordinary parent turns.\n  return {\n    runtimeServers: servers.map(mcpServerConfigFromStoredInput),\n    dbServers: servers.map((server) => ({\n      ...server,\n      headersEncrypted: { ...(server.headersEncrypted ?? {}) },\n    })),\n    metadata: servers.map((server) => ({\n      id: server.id,\n      name: server.name ?? null,\n      url: server.url,\n      headerNames: Object.keys(server.headersEncrypted ?? {}).sort(),\n      credentialVersion: 1,\n      requireApproval: server.requireApproval ?? false,\n      connectionRef: server.connectionRef ?? null,\n    })),\n  };\n}\n\nfunction validateSessionMcpCredentialUpdates(input: {\n  settings: Settings;\n  grant: AccessGrant;\n  session: Session;\n  updates: SessionMcpCredentialUpdateInput[];\n}): UpdateSessionMcpServerCredentialsInput[] {\n  if (input.updates.length === 0) {\n    return [];\n  }\n  requirePermission(input.grant, \"mcp_servers:attach\");\n  const encryptionKey = requireVariableSetEncryption(input.settings);\n  const knownIds = new Set(input.session.mcpServers.map((server) => server.id));\n  const seenIds = new Set<string>();\n  const encryptedUpdates = input.updates.map((update) => {\n    if (seenIds.has(update.id)) {\n      throw new HTTPException(422, {\n        message: `duplicate session MCP credential update id: ${update.id}`,\n      });\n    }\n    seenIds.add(update.id);\n    if (!knownIds.has(update.id)) {\n      throw new HTTPException(422, {\n        message: `unknown session MCP server id: ${update.id}`,\n      });\n    }\n    const headers = normalizedSessionMcpCredentialHeaders(update.headers);\n    return {\n      id: update.id,\n      headersEncrypted: Object.fromEntries(\n        Object.entries(headers).map(([name, value]) => [\n          name,\n          encryptVariableSetValue(encryptionKey, value),\n        ]),\n      ),\n    };\n  });\n  return encryptedUpdates;\n}\n\nexport type CreateSessionOutcome = {\n  session: CreateSessionResponse;\n  /** The committed create/start effect represented by this request. */\n  outcome: \"created\" | \"repaired\" | \"replayed\";\n  /** Backward-compatible replay flag for existing entity-oriented callers. */\n  replay: boolean;\n  /** True when the request created/repaired start state or committed a new wake revision. */\n  changed: boolean;\n};\n\nexport type CreateSessionRequestOutcome = CreateSessionOutcome & {\n  /** Billing telemetry is recorded after the committed session start. */\n  usageRecording: \"recorded\" | \"failed\";\n};\n\nexport async function createAndStartSessionWithOutcome(input: {\n  requestedSessionId?: string;\n  db: Database;\n  bus: EventBus;\n  workflowClient: Pick<SessionWorkflowClient, \"wakeSessionWorkflow\">;\n  /** Internal database-only composition seam. The exact session shell and this\n   * linkage commit together before its first event/turn can be initialized. */\n  beforeCreateCommit?: (tx: Database, sessionId: string) => Promise<void>;\n  accountId: string;\n  workspaceId: string;\n  initialMessage: string;\n  /** Create the session shell without an initial user event/agent turn. */\n  deferInitialTurn?: boolean;\n  modelContext?: string | null;\n  resources: ResourceRef[];\n  skills?: SessionSkill[];\n  tools: ToolRef[];\n  // Public admission always supplies provenance; optional keeps internal\n  // callers that predate durable tool-policy provenance source-compatible\n  // during the rolling deploy.\n  toolPolicy: SessionToolPolicy;\n  clientEventId?: string;\n  model: string;\n  reasoningEffort: Settings[\"openaiReasoningEffort\"];\n  /** Session default Fast/standard; mirrored into metadata when set. */\n  latencyMode?: \"standard\" | \"priority\" | \"fast\";\n  turnExecutionPolicy: TurnExecutionPolicyV1;\n  sandboxBackend: Settings[\"sandboxBackend\"];\n  metadata: Record<string, unknown>;\n  createdBy?: TurnInitiator;\n  createdByContext?: TurnInitiatorContext;\n  createdByActor?: Extract<SessionCommandActor, { type: \"agent_attempt\" }> | null;\n  // Names/ids only; the session.created payload never carries variable values.\n  variableSet?: { id: string; name: string } | null;\n  // The rig + frozen active rig version resolved at create (M3). Both null ⇒ a\n  // rig-less session (byte-for-byte today's behavior). Frozen here so a later\n  // rig promote never moves an existing session's version.\n  rigId?: string | null;\n  rigVersionId?: string | null;\n  // The workspace channel the session is filed under (rail organization only;\n  // resolved workspace-scoped by the caller). Null/omitted ⇒ unfiled (inbox).\n  channelId?: string | null;\n  goal?: GoalSpec | null;\n  // Per-session agent persona/system instructions (org-visible metadata, not a\n  // secret). Persisted on the session row and composed system-level AFTER the\n  // workspace agentInstructions at turn time; never emitted as a timeline event.\n  // Null/omitted ⇒ the session carries none.\n  instructions?: string | null;\n  // Immutable normalized prompt-policy role. This never derives from a\n  // workspace membership role; null retains the bounded metadata.role fallback.\n  policyRole?: string | null;\n  // Validated against the creating grant before this is called.\n  firstPartyMcpPermissions?: Permission[] | null;\n  // Model-visible first-party tool names. Authorization remains controlled by\n  // firstPartyMcpPermissions and the target resource checks.\n  firstPartyMcpTools: FirstPartyMcpToolName[];\n  // Encrypted DB rows plus matching safe metadata for create-time per-session\n  // MCP servers. Metadata is the only shape emitted in events/responses.\n  mcpServers?: CreateSessionMcpServerInput[];\n  sessionMcpServers?: SessionMcpServerMetadata[];\n  personalConnectionDelegations?: McpPersonalConnectionDelegation[];\n  xaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;\n  // The manager session spawning this worker (a worker-signed sessionId claim\n  // on the creating grant); null for direct API creates and scheduled runs.\n  // When set, the worker's terminal-for-now transitions wake this parent.\n  parentSessionId?: string | null;\n  // Workspace-scoped CREATE idempotency key. When present, a double-fire with\n  // the same key (sequential retry OR concurrent race) collapses to a single\n  // session. Every caller repairs or re-delivers the winner's one atomic start;\n  // the durable initializer prevents duplicate events or turns.\n  createIdempotencyKey?: string | null;\n  // The shared-sandbox group this session's box joins (addendum 05 §D). Null/\n  // omitted ⇒ a singleton group (the new row's own id, today's 1:1 behavior); a\n  // shared/{groupId} spawn passes the resolved group so both run in ONE box.\n  sandboxGroupId?: string | null;\n  // The OS axis of the session's box (sessions.sandbox_os). Omitted ⇒ the\n  // \"linux\" default; set only for a machine-targeted top-level create, where the\n  // targeted machine's enrollment OS is threaded in so the row + resume path +\n  // OS-labeling surfaces honestly reflect the machine.\n  sandboxOs?: Session[\"sandboxOs\"];\n  // Create-time machine targeting (A-2a, RACE-FREE): the enrolled machine (a\n  // sandbox id) to run this session on. When set, the active-sandbox pointer is\n  // resolved+validated+seeded (epoch-fenced) INSIDE finishStartSession, AFTER the\n  // session row exists but BEFORE the first turn is enqueued/the workflow woken,\n  // so the FIRST turn routes to the chosen machine. An invalid/unowned/offline\n  // target fails the create (422) — never a silent fall-back to the default box.\n  // `workingDir` (optional) is the path/cwd base the chosen machine runs under,\n  // seeded alongside the pointer through the epoch-fenced CAS.\n  seedTargetSandbox?: {\n    sandboxId: string;\n    settings: Settings;\n    workingDir?: string | null;\n  } | null;\n  // Exact actor-private pre-session draft represented by this create. The\n  // initializer consumes it only after the first durable runnable unit commits.\n  consumeNewSessionDraft?: {\n    subjectId: string;\n    expectedRevision: number;\n  } | null;\n  // A child may lower its inherited nested-agent depth limit freely; increases\n  // are authorized by the caller's workspace:admin grant and checked again by\n  // the database admission transaction.\n  maxNestedAgentDepthOverride?: number | null;\n  allowNestedAgentDepthIncrease?: boolean;\n  subjectId?: string | null;\n}): Promise<CreateSessionOutcome> {\n  const sessionMetadata = {\n    ...input.metadata,\n    model: input.model,\n    reasoningEffort: input.reasoningEffort,\n    ...(input.latencyMode !== undefined ? { latencyMode: input.latencyMode } : {}),\n  };\n  // Keyed creation is intentionally handled only by the database admission\n  // transaction below. Its workspace/key lock replays either the successful\n  // session or the committed denial atomically; an application-side lookup\n  // cannot serialize those two source tables against an older writer.\n  if (input.createIdempotencyKey) {\n    const keyedResult = await createSessionWithIdempotencyKeyResult(input.db, {\n      ...(input.requestedSessionId ? { requestedSessionId: input.requestedSessionId } : {}),\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      initialMessage: input.initialMessage,\n      initialModelContext: input.modelContext ?? null,\n      resources: input.resources,\n      skills: input.skills ?? [],\n      tools: input.tools,\n      toolPolicy: input.toolPolicy,\n      metadata: sessionMetadata,\n      ...(input.createdBy ? { createdBy: input.createdBy } : {}),\n      ...(input.createdByContext ? { createdByContext: input.createdByContext } : {}),\n      createdByActor: input.createdByActor ?? null,\n      model: input.model,\n      sandboxBackend: input.sandboxBackend,\n      variableSetId: input.variableSet?.id ?? null,\n      rigId: input.rigId ?? null,\n      rigVersionId: input.rigVersionId ?? null,\n      channelId: input.channelId ?? null,\n      firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,\n      firstPartyMcpTools: input.firstPartyMcpTools,\n      instructions: input.instructions ?? null,\n      policyRole: input.policyRole ?? null,\n      parentSessionId: input.parentSessionId ?? null,\n      createIdempotencyKey: input.createIdempotencyKey,\n      sandboxGroupId: input.sandboxGroupId ?? null,\n      ...(input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}),\n      mcpServers: input.mcpServers ?? [],\n      personalConnectionDelegations: input.personalConnectionDelegations ?? [],\n      ...(input.xaiProviderAccountAuthoritySnapshot\n        ? {\n            initialXaiProviderAccountAuthoritySnapshot: input.xaiProviderAccountAuthoritySnapshot,\n          }\n        : {}),\n      maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,\n      allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,\n      subjectId: input.subjectId ?? null,\n      ...(input.beforeCreateCommit ? { beforeCreateCommit: input.beforeCreateCommit } : {}),\n    });\n    if (keyedResult.denied) {\n      throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(keyedResult.denial));\n    }\n    const { session: keyed, created } = keyedResult;\n    if (!created) {\n      const finished = await finishStartSession(\n        keyed.temporalWorkflowId ? { ...input, seedTargetSandbox: null } : input,\n        keyed,\n      );\n      return {\n        session: finished.session,\n        outcome: finished.changed ? \"repaired\" : \"replayed\",\n        replay: !finished.changed,\n        changed: finished.changed,\n      };\n    }\n    const finished = await finishStartSession(input, keyed);\n    return {\n      session: finished.session,\n      outcome: \"created\",\n      replay: false,\n      changed: true,\n    };\n  }\n  let session: Session;\n  try {\n    session = await createSession(input.db, {\n      ...(input.requestedSessionId ? { requestedSessionId: input.requestedSessionId } : {}),\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      initialMessage: input.initialMessage,\n      initialModelContext: input.modelContext ?? null,\n      resources: input.resources,\n      skills: input.skills ?? [],\n      tools: input.tools,\n      toolPolicy: input.toolPolicy,\n      metadata: sessionMetadata,\n      ...(input.createdBy ? { createdBy: input.createdBy } : {}),\n      ...(input.createdByContext ? { createdByContext: input.createdByContext } : {}),\n      createdByActor: input.createdByActor ?? null,\n      model: input.model,\n      sandboxBackend: input.sandboxBackend,\n      variableSetId: input.variableSet?.id ?? null,\n      rigId: input.rigId ?? null,\n      rigVersionId: input.rigVersionId ?? null,\n      channelId: input.channelId ?? null,\n      firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,\n      firstPartyMcpTools: input.firstPartyMcpTools,\n      instructions: input.instructions ?? null,\n      policyRole: input.policyRole ?? null,\n      parentSessionId: input.parentSessionId ?? null,\n      sandboxGroupId: input.sandboxGroupId ?? null,\n      ...(input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}),\n      mcpServers: input.mcpServers ?? [],\n      personalConnectionDelegations: input.personalConnectionDelegations ?? [],\n      ...(input.xaiProviderAccountAuthoritySnapshot\n        ? {\n            initialXaiProviderAccountAuthoritySnapshot: input.xaiProviderAccountAuthoritySnapshot,\n          }\n        : {}),\n      maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,\n      allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,\n      subjectId: input.subjectId ?? null,\n      ...(input.beforeCreateCommit ? { beforeCreateCommit: input.beforeCreateCommit } : {}),\n    });\n  } catch (error) {\n    if (error instanceof SessionSpawnDeniedDbError) {\n      throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(error.denial));\n    }\n    throw error;\n  }\n  const finished = await finishStartSession(input, session);\n  return {\n    session: finished.session,\n    outcome: \"created\",\n    replay: false,\n    changed: true,\n  };\n}\n\n/** Backward-compatible entity-returning create path used by existing callers. */\nexport async function createAndStartSession(\n  input: Parameters<typeof createAndStartSessionWithOutcome>[0],\n): Promise<CreateSessionResponse> {\n  return (await createAndStartSessionWithOutcome(input)).session;\n}\n\n/**\n * Complete or repair the post-insert half of {@link createAndStartSession}.\n * All durable initial state is installed by one idempotent transaction; every\n * caller may then advance and deliver the coalesced wake revision without\n * duplicating the goal, events, or first turn.\n */\nasync function finishStartSession(\n  input: {\n    db: Database;\n    bus: EventBus;\n    workflowClient: Pick<SessionWorkflowClient, \"wakeSessionWorkflow\">;\n    initialMessage: string;\n    deferInitialTurn?: boolean;\n    modelContext?: string | null;\n    resources: ResourceRef[];\n    tools: ToolRef[];\n    toolPolicy: SessionToolPolicy;\n    clientEventId?: string;\n    model: string;\n    reasoningEffort: Settings[\"openaiReasoningEffort\"];\n    turnExecutionPolicy: TurnExecutionPolicyV1;\n    sandboxBackend: Settings[\"sandboxBackend\"];\n    variableSet?: { id: string; name: string } | null;\n    goal?: GoalSpec | null;\n    sessionMcpServers?: SessionMcpServerMetadata[];\n    seedTargetSandbox?: {\n      sandboxId: string;\n      settings: Settings;\n      workingDir?: string | null;\n    } | null;\n    consumeNewSessionDraft?: {\n      subjectId: string;\n      expectedRevision: number;\n    } | null;\n  },\n  session: Session,\n): Promise<{ session: CreateSessionResponse; changed: boolean }> {\n  // Create-time machine targeting (A-2a): seed the active-sandbox pointer BEFORE\n  // the atomic initial turn transaction, so the FIRST turn routes to the chosen\n  // machine. swapActiveSandbox does\n  // the same ownership+liveness validation as the live swap; an invalid/unowned/\n  // offline target FAILS the create (422) — never a silent fall-back to the box.\n  if (input.seedTargetSandbox) {\n    if (session.sandboxBackend === \"none\") {\n      throw new HTTPException(422, {\n        message: \"cannot target a machine for a session with no sandbox (backend: none)\",\n      });\n    }\n    const ctx: FleetContext = {\n      accountId: session.accountId,\n      workspaceId: session.workspaceId,\n      sessionId: session.id,\n      sessionBackend: session.sandboxBackend,\n      sessionGroupId: session.sandboxGroupId,\n    };\n    const seeded = await swapActiveSandbox(\n      {\n        db: input.db,\n        settings: input.seedTargetSandbox.settings,\n        bus: input.bus,\n      },\n      ctx,\n      input.seedTargetSandbox.sandboxId,\n      // The working dir is committed in the SAME epoch-fenced CAS that seeds the\n      // pointer, so the first turn routes to the machine AND lands in working_dir.\n      input.seedTargetSandbox.workingDir ?? null,\n    );\n    if (!seeded.swapped) {\n      throw new HTTPException(422, {\n        message: `cannot target sandbox ${input.seedTargetSandbox.sandboxId}: ${seeded.reason ?? \"target is not attachable\"}`,\n      });\n    }\n  }\n  const started = await initializeSessionStartAtomically(input.db, {\n    accountId: session.accountId,\n    workspaceId: session.workspaceId,\n    sessionId: session.id,\n    ...(input.clientEventId ? { clientEventId: input.clientEventId } : {}),\n    reasoningEffortFallback: input.reasoningEffort,\n    turnExecutionPolicy: input.turnExecutionPolicy,\n    createdEventPayload: {\n      toolPolicy: input.toolPolicy,\n      ...(input.variableSet\n        ? {\n            variableSetId: input.variableSet.id,\n            variableSetName: input.variableSet.name,\n          }\n        : {}),\n      ...(input.sessionMcpServers?.length ? { mcpServers: input.sessionMcpServers } : {}),\n    },\n    goal: input.goal\n      ? {\n          text: input.goal.text,\n          ...(input.goal.successCriteria !== undefined\n            ? { successCriteria: input.goal.successCriteria }\n            : {}),\n          ...(input.goal.maxAutoContinuations !== undefined\n            ? { maxAutoContinuations: input.goal.maxAutoContinuations }\n            : {}),\n        }\n      : null,\n    consumeNewSessionDraft: input.consumeNewSessionDraft ?? null,\n    deferInitialTurn: input.deferInitialTurn === true,\n  });\n  await publishDurableSessionEvents(input.bus, session.workspaceId, session.id, started.events);\n  if (started.workflowWakeRevision !== null) {\n    await input.workflowClient.wakeSessionWorkflow({\n      accountId: session.accountId,\n      workspaceId: session.workspaceId,\n      sessionId: session.id,\n      workflowId: started.temporalWorkflowId,\n      wakeRevision: started.workflowWakeRevision,\n    });\n  }\n  const persisted = await requireSession(input.db, session.workspaceId, session.id);\n  const initialTurnId =\n    started.turn?.id ??\n    (await listSessionTurns(input.db, session.workspaceId, session.id, 1))[0]?.id ??\n    null;\n  return {\n    session: { ...persisted, initialTurnId },\n    changed: started.changed,\n  };\n}\n\nexport function workflowIdForSession(sessionId: string): string {\n  return `session-${sessionId}`;\n}\n\n/**\n * Reject an explicit model that the host does not expose. The set of usable\n * models is the union surfaced by `configuredAllowedModels` (the built-in\n * provider's allow-list plus every registry provider's ids); a `model` outside\n * it cannot be resolved to a provider at run time, so we fail the request at\n * the API edge with 422 rather than enqueuing a turn the worker can't honor.\n *\n * `model` is the effective value selected by the caller's boundary. Top-level\n * omission defaults to `settings.openaiModel`; child-session omission inherits\n * the worker-signed calling turn before reaching this helper. Centralized here\n * so every model-carrying choke point\n * (create-session, user-message/turn-accept, queued-turn update, and\n * scheduled-task agentConfig — a scheduled task is a session the worker runs\n * later) and the MCP surfaces that share them validate identically and cannot\n * drift.\n */\nexport function canonicalConfiguredModel(\n  settings: Settings,\n  model: string | null | undefined,\n): string | null | undefined {\n  if (model === null || model === undefined) {\n    return model;\n  }\n  const canonicalModel = canonicalizeConfiguredModelId(settings, model);\n  if (configuredAllowedModels(settings).includes(canonicalModel)) {\n    return canonicalModel;\n  }\n  // Codex subscription models (codex/<slug>) are injected per-workspace by the\n  // worker overlay at turn time, so they are never in the deployment-global\n  // allow-list. Accept them at the edge when the feature is enabled — the picker\n  // only surfaces them for a connected workspace, and the worker enforces the\n  // actual connection (an unconnected workspace fails the turn with a clear\n  // \"no Codex subscription connected\" error rather than a misleading 422 here).\n  if (settings.codexSubscriptionEnabled && canonicalModel.startsWith(CODEX_MODEL_ID_PREFIX)) {\n    return canonicalModel;\n  }\n  // SuperGrok subscription models are also discovered per workspace rather\n  // than stored in the deployment-global allow-list. Connection availability\n  // is enforced by the workspace policy and worker; this edge guard only needs\n  // to admit the product-model namespace when the feature is enabled.\n  if (\n    settings.supergrokSubscriptionEnabled &&\n    canonicalModel.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX)\n  ) {\n    return canonicalModel;\n  }\n  if (canonicalModel.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {\n    return canonicalModel;\n  }\n  throw new HTTPException(422, { message: `model is not available: ${model}` });\n}\n\nexport function assertConfiguredModel(settings: Settings, model: string | null | undefined): void {\n  canonicalConfiguredModel(settings, model);\n}\n\nexport const CODEX_COMPACTION_V2_PROVIDER_LOCKED = \"codex_compaction_v2_provider_locked\" as const;\n\n/** Session is frozen on Codex remote compaction v2; non-Codex models are refused. */\nexport class CodexCompactionV2ProviderLockedError extends Error {\n  readonly code = CODEX_COMPACTION_V2_PROVIDER_LOCKED;\n  readonly productModelId: string;\n\n  constructor(productModelId: string) {\n    super(\n      `session is locked to Codex remote compaction v2; model \"${productModelId}\" is not a Codex subscription model`,\n    );\n    this.name = \"CodexCompactionV2ProviderLockedError\";\n    this.productModelId = productModelId;\n  }\n}\n\n/**\n * Fail closed when a remote_v2 session would run a non-Codex product model.\n * Portable sessions and non-Codex sessions keep free mid-session provider swap.\n */\nexport function assertSessionAllowsProductModel(\n  session: Pick<Session, \"codexCompactionMode\">,\n  productModelId: string | null | undefined,\n): void {\n  if (productModelId === null || productModelId === undefined) return;\n  if (session.codexCompactionMode !== \"remote_v2\") return;\n  if (isCodexBilledModel(productModelId)) return;\n  throw new CodexCompactionV2ProviderLockedError(productModelId);\n}\n\n/**\n * Reject a model the WORKSPACE's model policy blocks, at the same choke points\n * as assertConfiguredModel — a 422 at the edge instead of a queued turn the\n * worker's authoritative post-resolution gate would fail. `model` is the\n * EFFECTIVE value the caller is about to persist: pass the explicit value at\n * message/turn-update/scheduled-task edges (omitted inherits an\n * already-validated stored default), but at session CREATION pass\n * `payload.model ?? settings.openaiModel` — an omitted model stamps the\n * deployment default onto the session, and under a restricted policy that\n * default may be exactly the provider the policy exists to block.\n */\nexport async function assertWorkspaceModelPolicyAllows(\n  db: Database,\n  settings: Settings,\n  workspaceId: string,\n  model: string | null | undefined,\n): Promise<void> {\n  if (model === null || model === undefined) {\n    return;\n  }\n  const canonicalModel = canonicalConfiguredModel(settings, model);\n  if (canonicalModel === null || canonicalModel === undefined) {\n    return;\n  }\n  const policy = await getWorkspaceModelPolicy(db, workspaceId);\n  if (!policy) {\n    return;\n  }\n  const providerId = policyProviderIdForModel(settings, canonicalModel);\n  const verdict = evaluateWorkspaceModelPolicy(policy, {\n    providerId,\n    modelId: canonicalModel,\n  });\n  if (!verdict.allowed) {\n    throw new HTTPException(422, {\n      message:\n        verdict.reason === \"provider\"\n          ? `model \"${canonicalModel}\" is not allowed by this workspace's model policy: provider \"${providerId}\" is not in the allowed providers`\n          : `model \"${canonicalModel}\" is not allowed by this workspace's model policy`,\n    });\n  }\n}\n\nexport async function requireQueuedTurnForApi(\n  db: Database,\n  workspaceId: string,\n  sessionId: string,\n  turnId: string,\n): Promise<SessionTurn> {\n  const turn = await getSessionTurn(db, workspaceId, turnId);\n  if (!turn || turn.sessionId !== sessionId) {\n    throw new HTTPException(404, { message: \"session turn not found\" });\n  }\n  if (turn.status !== \"queued\") {\n    throw new HTTPException(409, {\n      message: `turn is ${turn.status}; only queued turns can be changed`,\n    });\n  }\n  return turn;\n}\n\nexport function reasoningEffortForSession(\n  metadata: Record<string, unknown>,\n  fallback: Settings[\"openaiReasoningEffort\"],\n): Settings[\"openaiReasoningEffort\"] {\n  return reasoningEffortForMetadata(metadata, fallback);\n}\n\nexport function latencyModeForSession(\n  metadata: Record<string, unknown>,\n  fallback: \"standard\" | \"priority\" | \"fast\" = \"standard\",\n): \"standard\" | \"priority\" | \"fast\" {\n  return latencyModeForMetadata(metadata, fallback);\n}\n\n/**\n * Appends a `user.message` to an existing session and enqueues the resulting\n * turn, merging requested resources/tools into the session and waking the\n * workflow. Shared by the public events route and the first-party MCP\n * `session_send_message` tool so the two surfaces cannot drift. Callers own\n * resource/tool validation and the per-message usage limit before calling.\n */\nexport async function postUserMessageTurn(input: {\n  db: Database;\n  bus: EventBus;\n  workflowClient: Pick<SessionWorkflowClient, \"wakeSessionWorkflow\">;\n  settings: Settings;\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  text: string;\n  annotations?: TimelineAnnotation[];\n  modelContext?: string | null;\n  resources: ResourceRef[];\n  model?: string | null;\n  reasoningEffort?: Settings[\"openaiReasoningEffort\"] | null;\n  latencyMode?: \"standard\" | \"priority\" | \"fast\" | null;\n  clientEventId?: string;\n  mcpCredentialUpdates?: UpdateSessionMcpServerCredentialsInput[];\n  personalConnectionDelegations?: McpPersonalConnectionDelegation[];\n  delivery?: \"send\" | \"steer\";\n  origin?: \"human\" | \"operator\";\n  actor?: string;\n  actorLabel?: string;\n  commandActor?: SessionCommandActor;\n  controlEtag?: string | null;\n  expectedDraftRevision?: number | null;\n  reasoningEffortFallback?: Settings[\"openaiReasoningEffort\"];\n  turnExecutionPolicy: TurnExecutionPolicyV1;\n  recordAgentRunUsage?: boolean;\n  schedulePostCommit?: (task: () => Promise<void>) => void;\n}): Promise<{\n  accepted: SessionEvent;\n  turn: SessionTurn;\n  interruptionCount: number;\n  replay: boolean;\n}> {\n  const { db, bus, workflowClient, settings, accountId, workspaceId, sessionId } = input;\n  const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;\n  const requestedReasoningEffort = input.reasoningEffort ?? null;\n  // Reject an explicit per-message model the host does not expose; an omitted\n  // model inherits the session's model downstream (always a configured id).\n  assertConfiguredModel(settings, requestedModel);\n  await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, requestedModel);\n  const sessionForModelGate = await requireSession(db, workspaceId, sessionId);\n  const effectiveModelForGate = requestedModel ?? sessionForModelGate.model;\n  try {\n    assertSessionAllowsProductModel(sessionForModelGate, effectiveModelForGate);\n  } catch (error) {\n    if (error instanceof CodexCompactionV2ProviderLockedError) {\n      throw new HTTPException(422, { message: error.message, cause: error });\n    }\n    throw error;\n  }\n  const operationKey = input.clientEventId ?? crypto.randomUUID();\n  let result;\n  try {\n    result = await runIdempotentPersistenceTransaction(\n      {\n        stage: \"session.prompt.submit\",\n        eventTypes: [\"user.message\", \"turn.queued\", \"session.status.changed\"],\n        maxAttempts: 3,\n      },\n      async () =>\n        await withWorkspaceSubjectSessionActivityRls(\n          db,\n          workspaceId,\n          input.actor ?? accountId,\n          (scoped) =>\n            submitHumanPromptInTransaction(scoped, {\n              accountId,\n              workspaceId,\n              sessionId,\n              subjectId: input.actor ?? accountId,\n              ...(input.actorLabel ? { subjectLabel: input.actorLabel } : {}),\n              actor: input.commandActor ?? {\n                type: \"human\",\n                subjectId: input.actor ?? accountId,\n              },\n              operationKey,\n              delivery: input.delivery ?? \"send\",\n              controlEtag: input.controlEtag ?? null,\n              expectedDraftRevision: input.expectedDraftRevision ?? null,\n              text: input.text,\n              annotations: input.annotations ?? [],\n              modelContext: input.modelContext ?? null,\n              resources: input.resources,\n              model: requestedModel,\n              reasoningEffort: requestedReasoningEffort,\n              latencyMode: input.latencyMode ?? null,\n              reasoningEffortFallback:\n                input.reasoningEffortFallback ?? settings.openaiReasoningEffort,\n              turnExecutionPolicy: input.turnExecutionPolicy,\n              source: input.origin === \"operator\" ? \"api\" : \"user\",\n              ...(input.recordAgentRunUsage !== undefined\n                ? { recordAgentRunUsage: input.recordAgentRunUsage }\n                : {}),\n              personalConnectionDelegations: input.personalConnectionDelegations ?? [],\n              mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],\n            }),\n        ),\n    );\n  } catch (error) {\n    if (\n      error instanceof QueueCommandConflictError ||\n      error instanceof SessionControlConflictError\n    ) {\n      throw new HTTPException(409, { message: error.message });\n    }\n    if (error instanceof Error && error.message.includes(\"cancelled\")) {\n      throw new HTTPException(409, { message: error.message });\n    }\n    if (error instanceof Error && error.message.startsWith(\"Unknown session MCP server\")) {\n      throw new HTTPException(422, { message: error.message });\n    }\n    throw error;\n  }\n  const postCommitTask = async () => {\n    try {\n      await publishDurableSessionEvents(bus, workspaceId, sessionId, result.events);\n      if (result.workspaceControlEventId) {\n        const controlEvent = await getWorkspaceControlEvent(\n          db,\n          workspaceId,\n          result.workspaceControlEventId,\n        );\n        if (!controlEvent) {\n          throw new Error(\n            `Committed workspace control event disappeared: ${result.workspaceControlEventId}`,\n          );\n        }\n        await publishDurableWorkspaceControlEvent(bus, workspaceId, controlEvent);\n      }\n    } catch {\n      console.warn(\"[sessions] prompt event fanout failed; durable rows remain replayable\", {\n        errorClass: \"PromptEventFanoutOperationError\",\n        errorCode: \"session_prompt_event_fanout_failed\",\n        origin: \"core\",\n      });\n    }\n    try {\n      await workflowClient.wakeSessionWorkflow({\n        accountId,\n        workspaceId,\n        sessionId,\n        workflowId: result.turn.temporalWorkflowId,\n        wakeRevision: result.wakeRevision,\n        ...((input.delivery ?? \"send\") === \"steer\" || result.interruptionCount > 0\n          ? { interruptionRequested: true }\n          : {}),\n      });\n    } catch {\n      console.warn(\"[sessions] workflow wake failed; durable outbox will retry\", {\n        errorClass: \"WorkflowWakeOperationError\",\n        errorCode: \"session_workflow_wake_failed\",\n        origin: \"core\",\n      });\n    }\n  };\n  const schedulePostCommit =\n    input.schedulePostCommit ??\n    ((task: () => Promise<void>) => {\n      void task();\n    });\n  try {\n    schedulePostCommit(postCommitTask);\n  } catch {\n    console.warn(\"[sessions] prompt post-commit scheduling failed; durable recovery remains\", {\n      errorClass: \"PromptPostCommitScheduleError\",\n      errorCode: \"session_prompt_post_commit_schedule_failed\",\n      origin: \"core\",\n    });\n  }\n  return {\n    accepted: result.accepted,\n    turn: result.turn,\n    interruptionCount: result.interruptionCount,\n    replay: result.replay,\n  };\n}\n\n/**\n * Full create-session flow shared by `POST /sessions` and the first-party MCP\n * `session_create` tool: payload validation, resource/tool/variableSet\n * checks, usage limits, session start, and usage recording. `rawPayload` is\n * the unparsed request body so absent-vs-empty execution-context fields keep\n * their meaning: a child inherits omitted resources/tools/mcpServers from its\n * trusted immediate parent, while explicit arrays (including []) win. A\n * top-level create with omitted tools applies workspace-default capability MCPs.\n */\nexport async function createSessionForRequestWithOutcome(\n  deps: ApiRouteDeps,\n  grant: AccessGrant,\n  workspaceId: string,\n  rawPayload: unknown,\n): Promise<CreateSessionRequestOutcome> {\n  const { settings, db, bus, workflowClient, objectStorage } = deps;\n  const payload = CreateSessionRequest.parse(rawPayload);\n  if (hasReservedOpenGeniSlackBotSessionMetadata(payload.metadata)) {\n    throw new HTTPException(422, {\n      message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY} is reserved for scheduler routing`,\n    });\n  }\n  // A committed keyed denial is the idempotent outcome even if mutable\n  // resources, policy, authorization, or budget have changed since the first\n  // attempt. Replay it before any of those checks, just as a keyed successful\n  // session is returned rather than recreated later in createAndStartSession.\n  if (payload.idempotencyKey) {\n    const denial = await getSessionSpawnDenialByIdempotencyKey(\n      db,\n      workspaceId,\n      payload.idempotencyKey,\n    );\n    if (denial) {\n      throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(denial));\n    }\n  }\n  // Parent linkage and execution-context inheritance come ONLY from the\n  // worker-signed sessionId claim. A caller cannot nominate a parent in the\n  // payload, so inheriting an existing repository/tool/credential snapshot does\n  // not turn sessions:create into arbitrary cross-session read authority.\n  const parentSessionId =\n    typeof grant.metadata?.[\"sessionId\"] === \"string\"\n      ? (grant.metadata[\"sessionId\"] as string)\n      : null;\n  if (parentSessionId) {\n    try {\n      await requireSessionAuthorization(deps, grant, {\n        sessionId: parentSessionId,\n        operation: \"session.child.create\",\n        surface: \"core\",\n      });\n    } catch (error) {\n      if (error instanceof SessionAuthorizationDeniedError) {\n        throw new HTTPException(403, { message: error.message, cause: error });\n      }\n      throw error;\n    }\n  }\n  const parentSession = parentSessionId ? await getSession(db, workspaceId, parentSessionId) : null;\n  if (parentSessionId && !parentSession) {\n    throw new HTTPException(404, {\n      message: `parent session not found in workspace: ${parentSessionId}`,\n    });\n  }\n  const creationInitiator = creationInitiatorForGrant(grant);\n  const parentCallingTurn =\n    parentSession && creationInitiator.actor\n      ? await getSessionTurn(db, workspaceId, creationInitiator.actor.turnId)\n      : null;\n  if (\n    creationInitiator.actor &&\n    (!parentCallingTurn || parentCallingTurn.sessionId !== parentSession?.id)\n  ) {\n    throw new HTTPException(403, {\n      message: \"caller attempt does not belong to the parent session\",\n    });\n  }\n  const xaiProviderAccountAuthoritySnapshot =\n    parentSession && creationInitiator.actor\n      ? await getSessionTurnXaiProviderAccountAuthoritySnapshot(\n          db,\n          workspaceId,\n          parentSession.id,\n          creationInitiator.actor.turnId,\n        )\n      : undefined;\n  const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(\n    db,\n    workspaceId,\n    settings,\n    {\n      subjectId: grant.subjectId,\n    },\n  );\n  const sessionMcpServers = hasOwnProperty(rawPayload, \"mcpServers\")\n    ? validateSessionMcpServersForCreate(capabilityRuntimeSettings, grant, payload.mcpServers)\n    : parentSession\n      ? validateInheritedSessionMcpServersForCreate(\n          await listSessionMcpServersForChildInheritance(db, workspaceId, parentSession.id),\n        )\n      : validateSessionMcpServersForCreate(capabilityRuntimeSettings, grant, payload.mcpServers);\n  const runtimeSettings = settingsWithSessionMcpServerConfigs(\n    capabilityRuntimeSettings,\n    sessionMcpServers.runtimeServers,\n  );\n  const resources = normalizeResources(\n    hasOwnProperty(rawPayload, \"resources\")\n      ? payload.resources\n      : (parentSession?.resources ?? payload.resources),\n  );\n  const skills = hasOwnProperty(rawPayload, \"skills\")\n    ? payload.skills\n    : (parentSession?.skills ?? payload.skills);\n  const toolsProvided = hasOwnProperty(rawPayload, \"tools\");\n  const requestedTools = validateToolRefs(\n    toolsProvided ? payload.tools : (parentSession?.tools ?? payload.tools),\n    runtimeSettings,\n  );\n  let selectedTools: ToolRef[];\n  let toolPolicy: SessionToolPolicy;\n  if (parentSession) {\n    const parentTracksWorkspaceDefaults = parentSession.toolPolicy?.mode === \"workspace_default\";\n    const parentEffective = withFirstPartyTools(\n      parentTracksWorkspaceDefaults\n        ? withDefaultEnabledCapabilityMcpTools(\n            availableToolRefs(parentSession.tools, runtimeSettings),\n            settings,\n            runtimeSettings,\n          )\n        : parentSession.tools,\n      runtimeSettings,\n    );\n    if (toolsProvided) {\n      assertToolRefsSubset(\n        requestedTools,\n        parentEffective,\n        \"child tools may only narrow the parent session tool policy\",\n      );\n      selectedTools = requestedTools;\n      toolPolicy = {\n        mode: \"explicit\",\n        inheritedFromSessionId: parentSession.id,\n      };\n    } else {\n      selectedTools = parentEffective;\n      toolPolicy = {\n        mode: parentTracksWorkspaceDefaults ? \"workspace_default\" : \"inherited\",\n        inheritedFromSessionId: parentSession.id,\n      };\n    }\n  } else if (toolsProvided) {\n    selectedTools = requestedTools;\n    toolPolicy = { mode: \"explicit\", inheritedFromSessionId: null };\n  } else {\n    selectedTools = withDefaultEnabledCapabilityMcpTools(\n      requestedTools,\n      settings,\n      capabilityRuntimeSettings,\n    );\n    toolPolicy = { mode: \"workspace_default\", inheritedFromSessionId: null };\n  }\n  // The first-party MCP server is attached to EVERY session. Registration is\n  // independently intersected with the exact model-visible selection and the\n  // tool's permission/target authorization predicate, so attachment alone\n  // exposes nothing.\n  const tools = withFirstPartyTools(selectedTools, runtimeSettings);\n  const personalConnectionDelegations = await freezePersonalConnectionDelegations({\n    db,\n    workspaceId,\n    settings: runtimeSettings,\n    tools,\n    source: personalConnectionDelegationSourceForGrant(grant),\n  });\n  await validateGitHubRepositorySelection(db, workspaceId, resources);\n  if (resources.some((resource) => resource.kind === \"file\") && !objectStorage) {\n    throw new HTTPException(503, {\n      message: \"object storage is not configured\",\n    });\n  }\n  await validateFileResources(db, grant.accountId, workspaceId, grant.subjectId, resources);\n  // VariableSet attachment requires variable-sets:use on the calling grant\n  // (validateVariableSetAttachment enforces it), preserving the invariant\n  // that sandboxed agents cannot self-attach workspace secrets.\n  const variableSet = payload.variableSetId\n    ? await validateVariableSetAttachment(\n        { settings, db },\n        grant,\n        workspaceId,\n        payload.variableSetId,\n      )\n    : null;\n  // RIG BINDING (M3). Resolve the rig this session rides — a UUID binds that\n  // rig, null explicitly opts out, and omission inherits the workspace default\n  // (workspaces.default_rig_id) — then FREEZE both the rig id and its currently-\n  // ACTIVE version onto the row.\n  // The session then rides that exact version for its whole life; a later\n  // promote never moves it. Rig-less (both null) when neither resolves, which is\n  // byte-for-byte today's behavior (zero extra work, zero row change).\n  //   - An EXPLICIT unknown/inactive rigId is a caller error → 422.\n  //   - A stale workspace-default rig (deleted → FK-nulled, or somehow with no\n  //     active version) degrades SILENTLY to rig-less: an operator-side default\n  //     must never brick every create in the workspace.\n  const requestedRigId =\n    payload.rigId === undefined ? await getWorkspaceDefaultRigId(db, workspaceId) : payload.rigId;\n  let frozenRigId: string | null = null;\n  let frozenRigVersionId: string | null = null;\n  if (requestedRigId) {\n    const rig = await getRig(db, workspaceId, requestedRigId);\n    if (!rig || !rig.activeVersion) {\n      if (payload.rigId) {\n        throw new HTTPException(422, {\n          message: rig\n            ? `rig ${payload.rigId} has no active version to bind`\n            : `unknown rigId: ${payload.rigId}`,\n        });\n      }\n      // else: workspace-default fallback that no longer resolves → rig-less.\n    } else {\n      frozenRigId = rig.id;\n      frozenRigVersionId = rig.activeVersion.id;\n    }\n  }\n  // CHANNEL FILING. Pure rail organization: a UUID files the session into that\n  // workspace channel, omission/null leaves it unfiled (inbox). Resolved\n  // workspace-scoped so a foreign channel id can never attach; an explicit\n  // unknown channelId is a caller error → 422.\n  let channelId: string | null = null;\n  if (payload.channelId) {\n    const channel = await getChannel(db, workspaceId, payload.channelId);\n    if (!channel) {\n      throw new HTTPException(422, {\n        message: `unknown channelId: ${payload.channelId}`,\n      });\n    }\n    channelId = channel.id;\n  }\n  // A spawned worker is causally part of the exact turn that created it. Omitted\n  // execution policy fields therefore inherit that calling turn rather than the\n  // deployment defaults. This is especially important for Codex subscription\n  // managers: falling back to the deployment model would silently move a child\n  // onto the OpenGeni-credits billing path. Legacy session-bound grants without\n  // exact attempt claims fall back to the parent session's persisted defaults.\n  const inheritedModel = parentCallingTurn?.model ?? parentSession?.model ?? settings.openaiModel;\n  const model = canonicalConfiguredModel(settings, payload.model ?? inheritedModel);\n  if (model === null || model === undefined) {\n    throw new Error(\"effective session model unexpectedly resolved to null\");\n  }\n  // Session creation persists the EFFECTIVE model — the explicit selection,\n  // inherited calling-turn model, or deployment default — so the policy must\n  // vet that effective value, not just explicit ones (a restricted workspace's\n  // inherited/default-model session would otherwise be born blocked).\n  await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model);\n  const inheritedReasoningEffort =\n    parentCallingTurn?.reasoningEffort ??\n    (parentSession\n      ? reasoningEffortForSession(parentSession.metadata, settings.openaiReasoningEffort)\n      : settings.openaiReasoningEffort);\n  const inheritedLatencyMode =\n    parentCallingTurn?.latencyMode ??\n    (parentSession ? latencyModeForSession(parentSession.metadata, \"standard\") : \"standard\");\n  const reasoningEffort = payload.reasoningEffort ?? inheritedReasoningEffort;\n  const latencyMode = payload.latencyMode ?? inheritedLatencyMode;\n  const inheritedFromParent = parentSession !== null;\n  const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {\n    modelId: model,\n    requestedModelId: payload.model ?? null,\n    modelSource:\n      payload.model === undefined\n        ? inheritedFromParent\n          ? \"continuation\"\n          : \"deployment\"\n        : \"explicit\",\n    reasoningEffort,\n    reasoningSource:\n      payload.reasoningEffort === undefined\n        ? inheritedFromParent\n          ? \"continuation\"\n          : \"deployment\"\n        : \"explicit\",\n    latencyMode,\n    latencyModeSource:\n      payload.latencyMode === undefined\n        ? inheritedFromParent\n          ? \"continuation\"\n          : \"deployment\"\n        : \"explicit\",\n  });\n  // Parent linkage was resolved above, before context validation. A child with\n  // no explicit permission override inherits the creating session's effective\n  // grant instead of silently expanding to standalone worker defaults.\n  // A session's first-party MCP token can carry a non-default permission set\n  // (how an operator hands a manager-style session the orchestration tools),\n  // but never one out-ranking its creator: every requested permission must be\n  // held by the creating grant. A top-level omission keeps the deployment's\n  // normal worker defaults. A child omission inherits its creator's exact\n  // effective grant, preserving a host/operator's narrowed capability boundary\n  // through the whole session tree.\n  const parentFirstPartyMcpPermissions = parentSession\n    ? [...(parentSession.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS)]\n    : null;\n  if (\n    parentFirstPartyMcpPermissions &&\n    payload.firstPartyMcpPermissions?.some(\n      (permission) => !hasPermission(parentFirstPartyMcpPermissions, permission),\n    )\n  ) {\n    throw new HTTPException(403, {\n      message: \"child first-party MCP permissions may only narrow the parent session grant\",\n    });\n  }\n  // A worker-signed creator may itself carry less authority than its parent\n  // session (for example a narrowly delegated spawn token). Inherit the\n  // intersection in the shared canonical default order so null/default parent\n  // policies cannot expand when runtime signing resolves them.\n  let firstPartyMcpPermissions =\n    payload.firstPartyMcpPermissions ??\n    (parentFirstPartyMcpPermissions\n      ? parentFirstPartyMcpPermissions.filter((permission) =>\n          hasPermission(grant.permissions, permission),\n        )\n      : null);\n  if (firstPartyMcpPermissions && firstPartyMcpPermissions.length === 0) {\n    // An empty set would sign an unusable zero-permission token; the default\n    // worker set is expressed by omitting the field.\n    throw new HTTPException(422, {\n      message:\n        \"firstPartyMcpPermissions must not be empty; omit it for the default worker permission set\",\n    });\n  }\n  for (const permission of firstPartyMcpPermissions ?? []) {\n    if (!hasPermission(grant.permissions, permission)) {\n      throw new HTTPException(403, {\n        message: `cannot grant first-party MCP permission beyond the creating grant: ${permission}`,\n      });\n    }\n  }\n  // A goal-bearing session with an explicit/effective permission set must\n  // already carry goals:manage. Without it the worker cannot stop its own\n  // continuation loop, but silently adding it would violate the child\n  // authority contract: a child inherits or narrows its creator's exact grant\n  // and never gains an unrequested permission. Top-level omission remains the\n  // deployment's worker default, which includes the goal tools.\n  if (\n    payload.goal &&\n    firstPartyMcpPermissions &&\n    !firstPartyMcpPermissions.includes(\"goals:manage\")\n  ) {\n    throw new HTTPException(422, {\n      message:\n        \"goal-bearing sessions require goals:manage in the resulting first-party MCP permission set\",\n    });\n  }\n  // Tool visibility is independent from permission authority. A child that\n  // omits the field inherits the parent's exact effective selection; a\n  // top-level omission selects the safe non-connector default catalog.\n  const deploymentFirstPartyMcpToolPolicy = resolveFirstPartyMcpToolPolicy(settings);\n  const disallowedFirstPartyMcpTool = payload.firstPartyMcpTools?.find(\n    (tool) => !deploymentFirstPartyMcpToolPolicy.allowed.includes(tool),\n  );\n  if (disallowedFirstPartyMcpTool) {\n    throw new HTTPException(422, {\n      message: `first-party MCP tool is disabled by deployment policy: ${disallowedFirstPartyMcpTool}`,\n    });\n  }\n  const firstPartyMcpTools = resolveFirstPartyMcpToolsForCreate(\n    payload.firstPartyMcpTools,\n    parentSession ? parentSession.firstPartyMcpTools : undefined,\n    deploymentFirstPartyMcpToolPolicy,\n  );\n  if (payload.goal) {\n    const missingGoalTools = [\"goal_update\", \"goal_progress\", \"goal_complete\", \"goal_pause\"].filter(\n      (name) => !firstPartyMcpTools.includes(name as FirstPartyMcpToolName),\n    );\n    if (missingGoalTools.length > 0) {\n      throw new HTTPException(422, {\n        message: `goal-bearing sessions require first-party MCP tools: ${missingGoalTools.join(\", \")}`,\n      });\n    }\n  }\n  // Parent linkage: a worker is linked to its manager ONLY from the\n  // worker-signed sessionId claim on the creating grant — the manager\n  // session's own id, signed into the delegated token by the worker and never\n  // agent- or caller-controlled. A grant without that claim (a workspace API\n  // key, any non-delegated grant) creates a parentless top-level session.\n  //\n  // We deliberately do NOT honor a caller-supplied parentSessionId: it would\n  // let any sessions:create grant aim a worker at an arbitrary session's id so\n  // its completion wake injects a user.message + queued turn into that session\n  // without holding sessions:control on it (a cross-session write escalation).\n  // The claim is the only trustworthy parent source.\n  // Shared-sandbox placement (addendum 05 §D.2/§D.3, decision I10/OD-S1).\n  //\n  // The DEFAULT rule is context-dependent and resolved server-side from the\n  // TRUSTED claim, never caller-supplied: when `sandbox` is omitted, a session\n  // spawned FROM INSIDE a session (parentSessionId present ⇒ a worker-signed\n  // sessionId claim) defaults to \"shared\" (join the creator's box); a top-level\n  // create (no parent) defaults to \"new\" (a private singleton box). Explicit\n  // values always win.\n  //\n  // null sandboxGroupId ⇒ createSession seeds the new row's own id (singleton,\n  // today's 1:1 behavior). A shared/{groupId} spawn inherits the box's backend\n  // (it is literally the same box; the child cannot pick its own). Cross-\n  // workspace sharing is forbidden by construction: getSession/\n  // getAnySessionInGroup are RLS-workspace-scoped, so a foreign parent/group\n  // returns null → 404; the group uuid is NOT an access boundary, the workspace\n  // filter is (stress (e)).\n  const sandboxChoice = payload.sandbox ?? (parentSessionId ? \"shared\" : \"new\");\n  let sandboxGroupId: string | null = null;\n  let inheritedBackend: Session[\"sandboxBackend\"] | undefined;\n  // ENV-AWARE GROUPING: under the CURRENT mechanics the workspace VariableSet is\n  // creation-time box state — the box's manifest env is fixed when it is cold-\n  // created, and the SDK's provided-session guard rejects any manifest-env delta\n  // at attach. A session carrying a DIFFERENT VariableSet than the box it joins\n  // is therefore a genuine shared-state conflict TODAY: its first turn on a warm\n  // box dies with \"Live sandbox sessions cannot change manifest variableSet\n  // variables\" (proven live, sessions 5aee77e9 + 63d18823). Until the VariableSet\n  // is evicted from the manifest (per-exec, like the git token), grouping must be\n  // env-aware: the INHERITED default falls back to an own box on mismatch (a\n  // credentialed worker spawned from a credential-less manager just works), and\n  // an EXPLICIT shared/{groupId} request with a mismatched VariableSet fails\n  // fast at create (422) instead of poisoning the session's first turn.\n  // The env conflict is a BOX property, so a boxless group is exempt: a\n  // backend:\"none\" session runs in-process with no sandbox, no manifest, and no\n  // provided-session attach — no shared box state exists to conflict, and\n  // env-differing spawns from such parents shared safely before the env-aware\n  // check. They keep sharing (and keep inheriting \"none\").\n  const requestedVariableSetId = payload.variableSetId ?? null;\n  const variableSetMatchesGroup = (memberVariableSetId: string | null): boolean =>\n    memberVariableSetId === requestedVariableSetId;\n  // RIG-AWARE GROUPING (M3), the exact sibling of the env-aware gate above: the\n  // box's rig-baked setup/tooling is fixed at cold-create, so a session joining a\n  // shared box must ride the SAME frozen rig_version_id. A mismatch is a genuine\n  // shared-state conflict (the box was set up for a different rig) — the INHERITED\n  // default falls back to an own box, an EXPLICIT shared/{groupId} request 422s at\n  // create rather than poisoning the first turn on the lease's rig-conflict guard.\n  // null on either side = compatible (a rig-less session shares with a rig-less\n  // box exactly as today); the boxless backend:'none' exemption is shared with the\n  // env gate (no box state to conflict).\n  const rigVersionMatchesGroup = (memberRigVersionId: string | null): boolean =>\n    memberRigVersionId === frozenRigVersionId;\n  if (sandboxChoice === \"shared\") {\n    if (!parentSessionId) {\n      throw new HTTPException(422, {\n        message:\n          \"sandbox:'shared' requires a parent session (spawn from inside a session); use 'new' for a top-level create.\",\n      });\n    }\n    if (!parentSession) {\n      throw new Error(\"trusted parent session was not resolved\");\n    }\n    const parent = parentSession;\n    const parentBoxed = parent.sandboxBackend !== \"none\";\n    const variableSetMismatch =\n      parentBoxed && !variableSetMatchesGroup(parent.variableSetId ?? null);\n    let rigMismatch = parentBoxed && !rigVersionMatchesGroup(parent.rigVersionId ?? null);\n    if (parentBoxed && !rigMismatch) {\n      const memberRigVersionIds = await listDistinctRigVersionIdsInGroup(\n        db,\n        workspaceId,\n        parent.sandboxGroupId,\n      );\n      rigMismatch = !memberRigVersionIds.every((memberRigVersionId) =>\n        rigVersionMatchesGroup(memberRigVersionId),\n      );\n    }\n    if (variableSetMismatch || rigMismatch) {\n      if (payload.sandbox === \"shared\") {\n        // The caller explicitly asked to share while carrying a different\n        // VariableSet / rig — surface the conflict at create time, not turn time.\n        // VariableSet is checked first so its (pre-rig) message is unchanged for\n        // the env-only mismatch the existing gate already covered.\n        throw new HTTPException(422, {\n          message: variableSetMismatch\n            ? \"sandbox:'shared' requires the same variableSet / same environment as the creator's box (the box variable set/environment is fixed at creation); omit sandbox or pass 'new' when attaching a different variableSet/environment.\"\n            : \"sandbox:'shared' requires the same rig as the creator's box (the box's rig setup is fixed at creation); omit sandbox or pass 'new' when binding a different rig.\",\n        });\n      }\n      // Inherited default: deterministic separation on the genuine shared-state\n      // conflict — the worker gets its own box (resolved like a top-level\n      // create: payload.sandboxBackend, else the deployment default) and its\n      // turn runs.\n    } else {\n      sandboxGroupId = parent.sandboxGroupId;\n      inheritedBackend = parent.sandboxBackend;\n    }\n  } else if (typeof sandboxChoice === \"object\") {\n    const member = await getAnySessionInGroup(db, workspaceId, sandboxChoice.groupId);\n    if (!member) {\n      throw new HTTPException(404, {\n        message: `sandbox group not found in workspace: ${sandboxChoice.groupId}`,\n      });\n    }\n    if (member.sandboxBackend !== \"none\") {\n      // Compare against EVERY member, not one arbitrary row: a legacy env-blind\n      // group can carry mixed variableSetIds, and an any-member read would make\n      // the join verdict nondeterministic. Post-env-aware groups are homogeneous\n      // (both join paths enforce equality), so this reads one distinct value in\n      // the common case; a mixed legacy group deterministically rejects.\n      const memberVariableSetIds = await listDistinctVariableSetIdsInGroup(\n        db,\n        workspaceId,\n        sandboxChoice.groupId,\n      );\n      if (\n        !memberVariableSetIds.every((memberVariableSetId) =>\n          variableSetMatchesGroup(memberVariableSetId),\n        )\n      ) {\n        throw new HTTPException(422, {\n          message: `sandbox group ${sandboxChoice.groupId} runs a different variableSet / different environment (the box variable set/environment is fixed at creation); create with the group's variableSet/environment or omit sandbox for an own box.`,\n        });\n      }\n      // Same deterministic all-members check for the frozen rig version (M3): the\n      // box's rig setup is fixed at creation, so every member must ride the rig\n      // this create resolved (or the group is rig-less and so is this create).\n      const memberRigVersionIds = await listDistinctRigVersionIdsInGroup(\n        db,\n        workspaceId,\n        sandboxChoice.groupId,\n      );\n      if (\n        !memberRigVersionIds.every((memberRigVersionId) =>\n          rigVersionMatchesGroup(memberRigVersionId),\n        )\n      ) {\n        throw new HTTPException(422, {\n          message: `sandbox group ${sandboxChoice.groupId} runs a different rig (the box's rig setup is fixed at creation); create with the group's rig or omit sandbox for an own box.`,\n        });\n      }\n    }\n    sandboxGroupId = sandboxChoice.groupId;\n    inheritedBackend = member.sandboxBackend;\n  }\n  // else \"new\": leave sandboxGroupId null → own singleton group (group ≡ id).\n  // A working dir is only meaningful for a TARGETED machine (it is the chosen\n  // box's path/cwd base). Present without a targetSandboxId is a malformed request\n  // — reject it at the edge (mirrors the backend:'none' guard) rather than silently\n  // dropping it, since the default group box has no working-dir seam yet.\n  if (payload.workingDir !== undefined && !payload.targetSandboxId) {\n    throw new HTTPException(422, {\n      message:\n        \"workingDir requires targetSandboxId (it is the targeted machine's working directory)\",\n    });\n  }\n  // Honest-label (Stage-D closure): a top-level session TARGETED at a Connected\n  // Machine (a selfhosted sandbox) runs machine-primary every turn, so its HOME\n  // sandbox_backend must read \"selfhosted\" — not the deployment cloud default —\n  // so the session row + first turn honestly reflect where the agent runs (the\n  // Machines dashboard, the turn's warm-metering, and the file-download plane all\n  // key off this). GUARDS: (1) only at a TOP-LEVEL create (inheritedBackend\n  // undefined) — a shared/{groupId} spawn is literally the creator's box and must\n  // NOT be relabeled; (2) only when the target's kind is actually \"selfhosted\" —\n  // targetSandboxId also accepts a first-class MODAL sandbox id (resolveTarget),\n  // which must never be mislabeled. A not-found / non-selfhosted / modal target\n  // falls through to the default; the seed swap in createAndStartSession still\n  // validates ownership/liveness and 422s a bad target. (3) only when the feature\n  // flags that make the worker actually take the machine-primary path are ON\n  // (sandboxOwnershipEnabled + sandboxSelfhostedEnabled/routing) — otherwise the\n  // worker ignores the active pointer and a home=\"selfhosted\" turn would fall to\n  // the registry client with no bound agentId and throw; with the flags off we\n  // keep the cloud default and the machine layers as a (pre-honest-label) overlay.\n  // sandbox_os (the OS axis the worker's group-box resume + the OS-labeling\n  // surfaces key off) must ALSO reflect the targeted machine, not the \"linux\"\n  // schema default — a session run on a macOS Connected Machine that labels\n  // itself linux lies to those surfaces. Derived under the SAME guards as the\n  // backend relabel; the enrollment (joined via the sandbox's enrollmentId)\n  // carries the OS. enrollmentOsValues and the sessions.sandbox_os value set are\n  // both (\"linux\",\"macos\",\"windows\"), so a known value maps 1:1; any other value\n  // is left to the \"linux\" default (never write a value no reader understands).\n  let machineHomeBackend: Session[\"sandboxBackend\"] | undefined;\n  let machineHomeOs: Session[\"sandboxOs\"] | undefined;\n  if (\n    payload.targetSandboxId &&\n    inheritedBackend === undefined &&\n    settings.sandboxOwnershipEnabled &&\n    settings.sandboxSelfhostedEnabled\n  ) {\n    const targetSandbox = await getSandbox(db, workspaceId, payload.targetSandboxId);\n    if (targetSandbox?.kind === \"selfhosted\") {\n      machineHomeBackend = \"selfhosted\";\n      if (targetSandbox.enrollmentId) {\n        const enrollment = await getEnrollment(db, workspaceId, targetSandbox.enrollmentId);\n        if (\n          enrollment &&\n          (enrollment.os === \"macos\" || enrollment.os === \"windows\" || enrollment.os === \"linux\")\n        ) {\n          machineHomeOs = enrollment.os;\n        }\n      }\n    }\n  }\n  if (payload.startMode !== \"realtime\") {\n    await requireLimit(deps, {\n      accountId: grant.accountId,\n      workspaceId,\n      action: \"agent_run:create\",\n      quantity: 1,\n      model,\n    });\n  }\n  let createOutcome: CreateSessionOutcome;\n  try {\n    createOutcome = await createAndStartSessionWithOutcome({\n      ...(payload.requestedSessionId ? { requestedSessionId: payload.requestedSessionId } : {}),\n      db,\n      bus,\n      workflowClient,\n      accountId: grant.accountId,\n      workspaceId,\n      initialMessage: payload.initialMessage ?? \"\",\n      deferInitialTurn: payload.startMode === \"realtime\",\n      modelContext: payload.modelContext ?? null,\n      resources,\n      skills,\n      tools,\n      toolPolicy,\n      ...(payload.clientEventId ? { clientEventId: payload.clientEventId } : {}),\n      model,\n      reasoningEffort,\n      latencyMode,\n      turnExecutionPolicy,\n      // A shared spawn inherits the box's backend; a caller-supplied\n      // sandboxBackend on a shared spawn is ignored (it is the same box). A\n      // machine-targeted top-level create labels the home \"selfhosted\"\n      // (machineHomeBackend), overriding the caller/deployment default so the row\n      // matches where the session actually runs.\n      sandboxBackend:\n        inheritedBackend ?? machineHomeBackend ?? payload.sandboxBackend ?? settings.sandboxBackend,\n      // Mirror the backend relabel on the OS axis: only a machine-targeted\n      // top-level create carries a derived OS; everything else is omitted and the\n      // \"linux\" default holds (shared spawns keep the parent-box behavior).\n      ...(machineHomeOs ? { sandboxOs: machineHomeOs } : {}),\n      sandboxGroupId,\n      metadata: payload.metadata,\n      ...(creationInitiator.initiator ? { createdBy: creationInitiator.initiator } : {}),\n      ...(creationInitiator.context ? { createdByContext: creationInitiator.context } : {}),\n      createdByActor: creationInitiator.actor ?? null,\n      variableSet: variableSet ? { id: variableSet.id, name: variableSet.name } : null,\n      // Frozen rig binding (M3): both null for a rig-less session (today's path).\n      rigId: frozenRigId,\n      rigVersionId: frozenRigVersionId,\n      channelId,\n      goal: payload.goal ?? null,\n      // Per-session persona instructions (already trimmed/validated by the\n      // contracts schema). Persisted on the row; composed system-level at turn\n      // time. Not surfaced as an event.\n      instructions: payload.instructions ?? null,\n      policyRole: payload.policyRole ?? null,\n      firstPartyMcpPermissions,\n      firstPartyMcpTools,\n      mcpServers: sessionMcpServers.dbServers,\n      sessionMcpServers: sessionMcpServers.metadata,\n      personalConnectionDelegations,\n      ...(xaiProviderAccountAuthoritySnapshot ? { xaiProviderAccountAuthoritySnapshot } : {}),\n      parentSessionId,\n      createIdempotencyKey: payload.idempotencyKey ?? null,\n      maxNestedAgentDepthOverride: payload.maxNestedAgentDepth ?? null,\n      allowNestedAgentDepthIncrease: hasPermission(grant.permissions, \"workspace:admin\"),\n      subjectId: grant.subjectId,\n      // Create-time machine targeting (A-2a): when a target sandbox is named, the\n      // active-sandbox pointer is seeded race-free inside createAndStartSession\n      // (after the row exists, before the first turn dispatches). Validation\n      // (ownership/liveness) lives in swapActiveSandbox; an invalid target 422s.\n      seedTargetSandbox: payload.targetSandboxId\n        ? {\n            sandboxId: payload.targetSandboxId,\n            settings,\n            workingDir: payload.workingDir ?? null,\n          }\n        : null,\n      consumeNewSessionDraft:\n        payload.expectedNewSessionDraftRevision !== undefined\n          ? {\n              subjectId: grant.subjectId,\n              expectedRevision: payload.expectedNewSessionDraftRevision,\n            }\n          : null,\n    });\n  } catch (error) {\n    if (error instanceof AgentCommandAuthorityError) {\n      throw new HTTPException(403, { message: error.message });\n    }\n    if (error instanceof SessionIdConflictError) {\n      throw new HTTPException(409, {\n        message: \"requested session id is already in use\",\n      });\n    }\n    throw error;\n  }\n  let usageRecording: CreateSessionRequestOutcome[\"usageRecording\"] = \"recorded\";\n  if (payload.startMode !== \"realtime\") {\n    try {\n      await recordWorkspaceUsage(deps, {\n        accountId: grant.accountId,\n        workspaceId,\n        subjectId: grant.subjectId,\n        eventType: \"agent_run.created\",\n        quantity: 1,\n        unit: \"run\",\n        sourceResourceType: \"session\",\n        sourceResourceId: createOutcome.session.id,\n        sessionId: createOutcome.session.id,\n        initiator: createOutcome.session.createdBy,\n        initiatorContext: createOutcome.session.createdByContext,\n        origin: creationInitiator.actor ? \"system\" : \"user\",\n        idempotencyKey: `agent_run.created:${workspaceId}:${createOutcome.session.id}`,\n      });\n    } catch (error) {\n      usageRecording = \"failed\";\n      reportSessionUsageRecordingFailure(error);\n    }\n  }\n  return { ...createOutcome, usageRecording };\n}\n\n/** @internal Fixed public projection; the committed session outcome remains authoritative. */\nexport function reportSessionUsageRecordingFailure(_error: unknown): void {\n  console.warn(\n    \"[sessions] usage recording failed after committed session create; returning committed outcome\",\n    {\n      errorClass: \"UsageRecordingError\",\n      errorCode: \"session_create_usage_recording_failed\",\n      origin: \"core\",\n    },\n  );\n}\n\n/** Backward-compatible entity-returning request path for REST and core callers. */\nexport async function createSessionForRequest(\n  deps: ApiRouteDeps,\n  grant: AccessGrant,\n  workspaceId: string,\n  rawPayload: unknown,\n): Promise<CreateSessionResponse> {\n  return (await createSessionForRequestWithOutcome(deps, grant, workspaceId, rawPayload)).session;\n}\n\n/**\n * Full accept-user-message flow shared by the `user.message` branch of\n * `POST /sessions/:id/events` and the first-party MCP `session_send_message`\n * tool: resource/tool validation, usage limits, the locked append + turn\n * enqueue, and usage recording. `toolsProvided: false` durably preserves an\n * Tool selection is durable session state and never rides a follow-up prompt.\n */\nexport async function acceptSessionUserMessageWithOutcome(\n  deps: AcceptSessionUserMessageDependencies,\n  grant: AccessGrant,\n  workspaceId: string,\n  sessionId: string,\n  input: {\n    text: string;\n    annotations?: SubmittedTimelineAnnotation[];\n    modelContext?: string | null;\n    resources?: ResourceRef[];\n    model?: string | null;\n    reasoningEffort?: ReasoningEffort | null;\n    latencyMode?: \"standard\" | \"priority\" | \"fast\" | null;\n    clientEventId?: string;\n    mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[];\n    delivery?: \"send\" | \"steer\";\n    origin?: \"human\" | \"operator\";\n    controlEtag?: string | null;\n    expectedDraftRevision?: number | null;\n  },\n): Promise<{\n  accepted: SessionEvent;\n  turn: SessionTurn;\n  interruptionCount: number;\n  replay: boolean;\n}> {\n  const { settings, db, bus, workflowClient, objectStorage } = deps;\n  const delegatedServiceInitiator = serviceInitiatorForGrant(grant);\n  await requireSessionAuthorization(deps, grant, {\n    sessionId,\n    operation: input.delivery === \"steer\" ? \"session.steer\" : \"session.append\",\n    surface: \"core\",\n  });\n  // Hoisted above requireLimit so the codex-billed predicate can resolve the\n  // turn's effective model (a follow-up turn inherits the session's model). A\n  // pure read with no side effects.\n  const existingSession = await requireSession(db, workspaceId, sessionId);\n  const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;\n  const effectiveModel =\n    canonicalConfiguredModel(settings, requestedModel ?? existingSession.model) ?? null;\n  if (effectiveModel === null) {\n    throw new Error(\"effective follow-up model unexpectedly resolved to null\");\n  }\n  try {\n    assertSessionAllowsProductModel(existingSession, effectiveModel);\n  } catch (error) {\n    if (error instanceof CodexCompactionV2ProviderLockedError) {\n      throw new HTTPException(422, { message: error.message, cause: error });\n    }\n    throw error;\n  }\n  const sessionReasoningEffort = reasoningEffortForSession(\n    existingSession.metadata,\n    settings.openaiReasoningEffort,\n  );\n  const effectiveReasoningEffort = input.reasoningEffort ?? sessionReasoningEffort;\n  const sessionLatencyMode = latencyModeForSession(existingSession.metadata, \"standard\");\n  const effectiveLatencyMode = input.latencyMode ?? sessionLatencyMode;\n  const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {\n    modelId: effectiveModel,\n    requestedModelId: input.model ?? null,\n    modelSource: input.model == null ? \"session\" : \"explicit\",\n    reasoningEffort: effectiveReasoningEffort,\n    reasoningSource: input.reasoningEffort == null ? \"session\" : \"explicit\",\n    latencyMode: effectiveLatencyMode,\n    latencyModeSource: input.latencyMode == null ? \"session\" : \"explicit\",\n  });\n  const requestedResources = normalizeResources(input.resources ?? []);\n  const annotations = await validateSubmittedTimelineAnnotations(\n    db,\n    workspaceId,\n    sessionId,\n    input.annotations ?? [],\n  );\n  await requireLimit(deps, {\n    accountId: grant.accountId,\n    workspaceId,\n    action: \"agent_run:create\",\n    quantity: 1,\n    model: effectiveModel,\n  });\n  if (requestedResources.some((resource) => resource.kind === \"file\") && !objectStorage) {\n    throw new HTTPException(503, {\n      message: \"object storage is not configured\",\n    });\n  }\n  await validateFileResources(\n    db,\n    grant.accountId,\n    workspaceId,\n    grant.subjectId,\n    requestedResources,\n  );\n  await validateGitHubRepositorySelection(db, workspaceId, [\n    ...existingSession.resources,\n    ...requestedResources,\n  ]);\n  const mcpCredentialUpdates = validateSessionMcpCredentialUpdates({\n    settings,\n    grant,\n    session: existingSession,\n    updates: input.mcpCredentialUpdates ?? [],\n  });\n  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {\n    subjectId: grant.subjectId,\n  });\n  const personalConnectionDelegations = await freezePersonalConnectionDelegations({\n    db,\n    workspaceId,\n    settings: runtimeSettings,\n    tools: existingSession.tools,\n    source: personalConnectionDelegationSourceForGrant(grant),\n  });\n  const { accepted, turn, interruptionCount, replay } = await postUserMessageTurn({\n    db,\n    bus,\n    workflowClient,\n    settings,\n    accountId: grant.accountId,\n    workspaceId,\n    sessionId,\n    text: input.text,\n    annotations,\n    modelContext: input.modelContext ?? null,\n    resources: requestedResources,\n    model: input.model ?? null,\n    reasoningEffort: input.reasoningEffort ?? null,\n    latencyMode: input.latencyMode ?? null,\n    reasoningEffortFallback: sessionReasoningEffort,\n    turnExecutionPolicy,\n    mcpCredentialUpdates,\n    personalConnectionDelegations,\n    delivery: input.delivery ?? \"send\",\n    origin: delegatedServiceInitiator ? \"operator\" : (input.origin ?? \"human\"),\n    actor: grant.subjectId,\n    ...(grant.subjectLabel ? { actorLabel: grant.subjectLabel } : {}),\n    ...(delegatedServiceInitiator\n      ? {\n          commandActor: {\n            type: \"service\" as const,\n            subjectId: delegatedServiceInitiator.initiator.subjectId,\n            ...(delegatedServiceInitiator.initiator.label\n              ? { subjectLabel: delegatedServiceInitiator.initiator.label }\n              : {}),\n            context: delegatedServiceInitiator.context,\n          },\n        }\n      : {}),\n    ...(input.controlEtag !== undefined ? { controlEtag: input.controlEtag } : {}),\n    ...(input.expectedDraftRevision !== undefined\n      ? { expectedDraftRevision: input.expectedDraftRevision }\n      : {}),\n    ...(input.clientEventId ? { clientEventId: input.clientEventId } : {}),\n    recordAgentRunUsage: true,\n    ...(deps.schedulePromptPostCommit ? { schedulePostCommit: deps.schedulePromptPostCommit } : {}),\n  });\n  return { accepted, turn, interruptionCount, replay };\n}\n\n/** Backward-compatible entity-returning path used by existing REST callers. */\nexport async function acceptSessionUserMessage(\n  deps: Parameters<typeof acceptSessionUserMessageWithOutcome>[0],\n  grant: Parameters<typeof acceptSessionUserMessageWithOutcome>[1],\n  workspaceId: Parameters<typeof acceptSessionUserMessageWithOutcome>[2],\n  sessionId: Parameters<typeof acceptSessionUserMessageWithOutcome>[3],\n  input: Parameters<typeof acceptSessionUserMessageWithOutcome>[4],\n): Promise<{\n  accepted: SessionEvent;\n  turn: SessionTurn;\n  interruptionCount: number;\n  replay: boolean;\n}> {\n  const { accepted, turn, interruptionCount, replay } = await acceptSessionUserMessageWithOutcome(\n    deps,\n    grant,\n    workspaceId,\n    sessionId,\n    input,\n  );\n  return { accepted, turn, interruptionCount, replay };\n}\n\n/**\n * Shared title-write path for the manual rename route AND both MCP tools\n * (set_session_title / set_other_session_title). The clobber guard lives in\n * the db `updateSessionTitle` UPDATE: an agent write is skipped when a user\n * title already pinned the session. On a real write we emit `session.title_set`\n * exactly like goal mutations emit their events; when nothing changed (agent\n * write blocked by the user lock) we emit nothing. Returns whether a write\n * happened so callers can avoid double work.\n */\nexport async function updateSessionTitle(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  grant: AccessGrant,\n  sessionId: string,\n  title: string,\n  source: \"user\" | \"agent\",\n): Promise<{\n  updated: boolean;\n  title: string | null;\n  relatedSessionAccess: \"target\" | \"root\";\n}> {\n  const { db, bus } = deps;\n  const authorization = await requireSessionAuthorization(deps, grant, {\n    sessionId,\n    operation: \"session.title.write\",\n    surface: \"core\",\n  });\n  const workspaceId = grant.workspaceId;\n  const result = await updateSessionTitleRow(db, {\n    workspaceId,\n    sessionId,\n    title,\n    source,\n  });\n  if (result.updated) {\n    await appendAndPublishEvents(db, bus, workspaceId, sessionId, [\n      {\n        type: \"session.title_set\",\n        payload: {\n          title: result.title ?? title,\n          source,\n        },\n      },\n    ]);\n  }\n  return {\n    ...result,\n    relatedSessionAccess: authorization?.relatedSessionAccess ?? \"root\",\n  };\n}\n\n/**\n * Update one existing session MCP server's approval policy. The database\n * serializes this write with attempt claim under the session lock: an already\n * claimed attempt retains its immutable snapshot, while the next claim captures\n * this value. No attempt is cancelled, restarted, or reinterpreted.\n */\nexport async function updateSessionMcpApprovalPolicy(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  grant: AccessGrant,\n  sessionId: string,\n  serverId: string,\n  requireApproval: SessionMcpApprovalPolicy,\n): Promise<UpdateSessionMcpApprovalPolicyResponse> {\n  const normalizedPolicy = SessionMcpApprovalPolicy.parse(requireApproval);\n  await requireSessionAuthorization(deps, grant, {\n    sessionId,\n    operation: \"session.mcp.approval_policy.write\",\n    surface: \"core\",\n  });\n  requirePermission(grant, \"sessions:control\");\n\n  const outcome: { server?: SessionMcpServerMetadata } = {};\n  const events = await appendSessionEventsWithLockedSessionUpdate(\n    deps.db,\n    grant.workspaceId,\n    sessionId,\n    async (_session, context) => {\n      const result = await context.updateSessionMcpApprovalPolicy(serverId, normalizedPolicy);\n      if (!result.server) {\n        throw new HTTPException(404, {\n          message: \"session MCP server not found\",\n        });\n      }\n      outcome.server = result.server;\n      return {\n        events: result.changed\n          ? [\n              {\n                type: \"session.mcp.approval_policy.updated\" as const,\n                payload: {\n                  serverId,\n                  effectiveFrom: \"next_attempt\",\n                },\n              },\n            ]\n          : [],\n      };\n    },\n    { activity: \"semantic\" },\n  );\n  const updatedServer = outcome.server;\n  if (!updatedServer) {\n    throw new Error(\"session MCP approval policy update returned no server\");\n  }\n  await publishDurableSessionEvents(deps.bus, grant.workspaceId, sessionId, events);\n  return {\n    server: updatedServer,\n    effectiveFrom: \"next_attempt\",\n  };\n}\n\nfunction toolPolicyAuditSnapshot(\n  session: Session,\n  tools: ToolRef[],\n  firstPartyMcpTools: FirstPartyMcpToolName[],\n  policy = session.toolPolicy,\n) {\n  // Tool policy refs contain only public server ids and the optional/strict\n  // execution mode; they never carry URLs, names, headers, credentials,\n  // schemas, or arguments. The request is capped at 64 refs and the mandatory\n  // first-party server can add one more, so the complete snapshot remains a\n  // small bounded payload rather than silently dropping security-relevant\n  // optional/strict changes.\n  const allToolRefs = mergeToolRefs([], tools)\n    .sort((left, right) => {\n      // Keep the mandatory first-party authority visible even when the\n      // bounded audit preview has to omit the middle of a large selection.\n      const leftMandatory = left.kind === \"mcp\" && left.id === \"opengeni\";\n      const rightMandatory = right.kind === \"mcp\" && right.id === \"opengeni\";\n      if (leftMandatory !== rightMandatory) return leftMandatory ? -1 : 1;\n      return `${left.kind}:${left.id}`.localeCompare(`${right.kind}:${right.id}`);\n    })\n    .map((tool) => ({\n      kind: tool.kind,\n      id: tool.id,\n      ...(tool.optional === undefined ? {} : { optional: tool.optional }),\n    }));\n  const toolRefs = allToolRefs.slice(0, maxToolPolicyAuditRefs);\n  return {\n    mode: policy.mode,\n    inheritedFromSessionId: policy.inheritedFromSessionId,\n    // IDs only: no MCP URLs, names, headers, credentials, schemas, or args.\n    toolIds: [...toolRefs]\n      .sort((left, right) => `${left.kind}:${left.id}`.localeCompare(`${right.kind}:${right.id}`))\n      .map((tool) => tool.id),\n    toolRefs,\n    toolCount: allToolRefs.length,\n    firstPartyMcpTools: [...firstPartyMcpTools].sort(),\n    firstPartyMcpToolCount: firstPartyMcpTools.length,\n    truncated: allToolRefs.length > toolRefs.length,\n  };\n}\n\n/**\n * Replace the durable session tool policy. The target and its parent (when\n * present) are locked by the DB event-writer helper, and the update/event are\n * committed under one version-fenced transaction. An already claimed turn\n * keeps its immutable snapshot; the next attempt observes this policy.\n */\nexport async function updateSessionToolPolicy(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    settings: Settings;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  grant: AccessGrant,\n  sessionId: string,\n  request: UpdateSessionToolPolicyRequest,\n): Promise<Session> {\n  await requireSessionAuthorization(deps, grant, {\n    sessionId,\n    operation: \"session.tool_policy.write\",\n    surface: \"core\",\n  });\n  requirePermission(grant, \"sessions:control\");\n\n  const existingSession = await requireSession(deps.db, grant.workspaceId, sessionId);\n  const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(\n    deps.db,\n    grant.workspaceId,\n    deps.settings,\n    { subjectId: grant.subjectId },\n  );\n  const runtimeSettings = settingsWithSessionMcpServerMetadata(\n    capabilityRuntimeSettings,\n    existingSession.mcpServers,\n  );\n  const explicitRequest = request.mode === \"workspace_default\" ? null : request;\n  const requestedMode = explicitRequest ? \"explicit\" : \"workspace_default\";\n  const explicitRequestedTools = explicitRequest\n    ? (() => {\n        const validatedTools = validateToolRefs(explicitRequest.tools, runtimeSettings);\n        const validatedIds = new Set(validatedTools.map((tool) => `${tool.kind}:${tool.id}`));\n        const unknown = explicitRequest.tools.find(\n          (tool) => !validatedIds.has(`${tool.kind}:${tool.id}`),\n        );\n        if (unknown) {\n          throw new HTTPException(422, {\n            message: `unknown MCP server id: ${unknown.id}`,\n          });\n        }\n        return withFirstPartyTools(validatedTools, runtimeSettings);\n      })()\n    : null;\n  const explicitRequestedFirstPartyTools = explicitRequest\n    ? [...explicitRequest.firstPartyMcpTools]\n    : null;\n  const deploymentFirstPartyMcpToolPolicy = resolveFirstPartyMcpToolPolicy(deps.settings);\n  const disallowedFirstPartyMcpTool = explicitRequestedFirstPartyTools?.find(\n    (tool) => !deploymentFirstPartyMcpToolPolicy.allowed.includes(tool),\n  );\n  if (disallowedFirstPartyMcpTool) {\n    throw new HTTPException(422, {\n      message: `first-party MCP tool is disabled by deployment policy: ${disallowedFirstPartyMcpTool}`,\n    });\n  }\n  const workspaceDefaultTools = withFirstPartyTools(\n    withDefaultEnabledCapabilityMcpTools([], deps.settings, capabilityRuntimeSettings),\n    runtimeSettings,\n  );\n  const workspaceDefaultFirstPartyTools = [...deploymentFirstPartyMcpToolPolicy.default];\n  const events = await appendSessionEventsWithLockedSessionUpdate(\n    deps.db,\n    grant.workspaceId,\n    sessionId,\n    async (session, context) => {\n      const currentVersion = session.toolPolicyVersion ?? 1;\n      if (request.expectedVersion !== currentVersion) {\n        throw new SessionToolPolicyVersionConflictError(currentVersion);\n      }\n\n      let nextTools: ToolRef[];\n      let nextFirstPartyMcpTools: FirstPartyMcpToolName[];\n      let nextPolicy: SessionToolPolicy;\n      if (session.parentSessionId) {\n        const parent = await context.getLockedSession(session.parentSessionId);\n        if (!parent) {\n          throw new HTTPException(409, {\n            message: \"parent session is no longer available\",\n          });\n        }\n        const parentTracksWorkspaceDefaults = parent.toolPolicy?.mode === \"workspace_default\";\n        const parentEffective = withFirstPartyTools(\n          parentTracksWorkspaceDefaults\n            ? withDefaultEnabledCapabilityMcpTools(\n                availableToolRefs(parent.tools, runtimeSettings),\n                deps.settings,\n                runtimeSettings,\n              )\n            : parent.tools,\n          runtimeSettings,\n        );\n        const deploymentAllowedFirstPartyMcpTools = new Set(\n          deploymentFirstPartyMcpToolPolicy.allowed,\n        );\n        const parentFirstPartyMcpTools = [\n          ...(parent.firstPartyMcpTools ?? deploymentFirstPartyMcpToolPolicy.default),\n        ].filter((tool) => deploymentAllowedFirstPartyMcpTools.has(tool));\n        if (requestedMode === \"workspace_default\") {\n          if (!parentTracksWorkspaceDefaults) {\n            throw new HTTPException(403, {\n              message:\n                \"a child may adopt workspace defaults only while its parent tracks workspace defaults\",\n            });\n          }\n          nextTools = parentEffective;\n          nextFirstPartyMcpTools = parentFirstPartyMcpTools;\n          nextPolicy = {\n            mode: \"workspace_default\",\n            inheritedFromSessionId: parent.id,\n          };\n        } else {\n          nextTools = explicitRequestedTools!;\n          assertToolRefsSubset(\n            nextTools,\n            parentEffective,\n            \"session tools may only narrow the parent session tool policy\",\n          );\n          const parentFirstPartySet = new Set(parentFirstPartyMcpTools);\n          const widenedFirstPartyTool = explicitRequestedFirstPartyTools!.find(\n            (tool) => !parentFirstPartySet.has(tool),\n          );\n          if (widenedFirstPartyTool) {\n            throw new HTTPException(403, {\n              message: `session OpenGeni tools may only narrow the parent policy: ${widenedFirstPartyTool}`,\n            });\n          }\n          nextFirstPartyMcpTools = explicitRequestedFirstPartyTools!;\n          nextPolicy = {\n            mode: \"explicit\",\n            inheritedFromSessionId: parent.id,\n          };\n        }\n      } else {\n        nextTools =\n          requestedMode === \"workspace_default\" ? workspaceDefaultTools : explicitRequestedTools!;\n        nextFirstPartyMcpTools =\n          requestedMode === \"workspace_default\"\n            ? workspaceDefaultFirstPartyTools\n            : explicitRequestedFirstPartyTools!;\n        nextPolicy = { mode: requestedMode, inheritedFromSessionId: null };\n      }\n\n      const currentPolicy = session.toolPolicy;\n      // JSONB normalizes object-key order on the round trip, so plain\n      // JSON.stringify would turn an identical retry into a second mutation\n      // (and version bump) merely because the persisted key order differs from\n      // the request object. Compare canonical JSON instead.\n      const unchanged =\n        stableJson({\n          tools: session.tools,\n          firstPartyMcpTools:\n            session.firstPartyMcpTools ?? deploymentFirstPartyMcpToolPolicy.default,\n          policy: currentPolicy,\n        }) ===\n        stableJson({\n          tools: nextTools,\n          firstPartyMcpTools: nextFirstPartyMcpTools,\n          policy: nextPolicy,\n        });\n      if (unchanged) {\n        return { events: [] };\n      }\n\n      const nextVersion = currentVersion + 1;\n      return {\n        events: [\n          {\n            type: \"session.tool_policy.updated\" as const,\n            payload: {\n              before: toolPolicyAuditSnapshot(\n                session,\n                session.tools,\n                [...(session.firstPartyMcpTools ?? deploymentFirstPartyMcpToolPolicy.default)],\n                currentPolicy,\n              ),\n              after: toolPolicyAuditSnapshot(\n                session,\n                nextTools,\n                nextFirstPartyMcpTools,\n                nextPolicy,\n              ),\n              version: nextVersion,\n              effectiveFrom: \"next_attempt\",\n            },\n          },\n        ],\n        update: {\n          tools: nextTools,\n          firstPartyMcpTools: nextFirstPartyMcpTools,\n          toolPolicy: nextPolicy,\n          toolPolicyVersion: nextVersion,\n          expectedToolPolicyVersion: request.expectedVersion,\n        },\n      };\n    },\n    { activity: \"semantic\", lockParentSession: true },\n  );\n  if (events.length > 0) {\n    await publishDurableSessionEvents(deps.bus, grant.workspaceId, sessionId, events);\n  }\n  return await requireSession(deps.db, grant.workspaceId, sessionId);\n}\n\nexport async function readSessionLineage(\n  deps: Pick<ApiRouteDeps, \"db\" | \"sessionAuthorization\">,\n  grant: AccessGrant,\n  sessionId: string,\n) {\n  const authorization = await requireSessionAuthorization(deps, grant, {\n    sessionId,\n    operation: \"session.lineage.read\",\n    surface: \"core\",\n  });\n  if (authorization?.relatedSessionAccess === \"target\") {\n    const session = await getSession(deps.db, grant.workspaceId, sessionId);\n    if (!session) {\n      throw new HTTPException(404, { message: \"session not found\" });\n    }\n    return { ancestors: [], children: [], truncated: false };\n  }\n  const lineage = await getSessionLineage(deps.db, grant.workspaceId, sessionId);\n  if (!lineage) {\n    throw new HTTPException(404, { message: \"session not found\" });\n  }\n  return lineage;\n}\n\nfunction withFirstPartyTools(\n  tools: ToolRef[],\n  runtimeSettings: { mcpServers: Array<{ id: string }> },\n): ToolRef[] {\n  if (!runtimeSettings.mcpServers.some((server) => server.id === \"opengeni\")) {\n    return tools;\n  }\n  return mergeToolRefs(tools, [{ kind: \"mcp\", id: \"opengeni\" }]);\n}\n\nfunction hasOwnProperty(value: unknown, key: string): boolean {\n  return Boolean(\n    value && typeof value === \"object\" && Object.prototype.hasOwnProperty.call(value, key),\n  );\n}\n","import {\n  DraftTimelineAnnotations,\n  SubmittedTimelineAnnotations,\n  numberTimelineAnnotations,\n  type DraftTimelineAnnotation,\n  type SessionEvent,\n  type SubmittedTimelineAnnotation,\n  type TimelineAnnotation,\n} from \"@opengeni/contracts\";\nimport { getSessionEvent, type Database } from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\n\nconst SOURCE_CONTEXT_BYTES = 160;\nconst ANSI_SEQUENCE = new RegExp(\"\\\\u001B\\\\[[0-?]*[ -/]*[@-~]\", \"g\");\n\ntype AnnotationValidationOptions = {\n  requireNotes: boolean;\n};\n\nfunction invalidAnnotationSource(): never {\n  throw new HTTPException(422, { message: \"Invalid timeline annotation source\" });\n}\n\nfunction safeJson(value: unknown): string {\n  try {\n    return JSON.stringify(value) ?? \"\";\n  } catch {\n    return String(value ?? \"\");\n  }\n}\n\nfunction firstMcpText(value: unknown): string | null {\n  if (!Array.isArray(value)) return null;\n  for (const part of value) {\n    if (\n      part !== null &&\n      typeof part === \"object\" &&\n      (part as { type?: unknown }).type === \"text\" &&\n      typeof (part as { text?: unknown }).text === \"string\"\n    ) {\n      return (part as { text: string }).text;\n    }\n  }\n  return null;\n}\n\nfunction normalizedToolOutput(value: unknown, depth = 0): string {\n  if (depth > 8 || value === null || value === undefined)\n    return value == null ? \"\" : safeJson(value);\n  if (typeof value === \"string\") return value;\n  if (typeof value !== \"object\" || Array.isArray(value)) return safeJson(value);\n  const record = value as Record<string, unknown>;\n  if (record.type === \"text\" && typeof record.text === \"string\") return record.text;\n  const contentText = firstMcpText(record.content);\n  if (contentText !== null) return contentText;\n  if (\"structuredContent\" in record) {\n    return contentText ?? normalizedToolOutput(record.structuredContent, depth + 1);\n  }\n  if (\"result\" in record) return normalizedToolOutput(record.result, depth + 1);\n  return safeJson(value);\n}\n\nfunction stripExecBanner(text: string): string {\n  const marker = text.indexOf(\"\\nOutput:\\n\");\n  if (marker >= 0) return text.slice(marker + \"\\nOutput:\\n\".length);\n  return text.startsWith(\"Output:\\n\") ? text.slice(\"Output:\\n\".length) : text;\n}\n\nexport function timelineAnnotationSourceText(event: SessionEvent): string | null {\n  if (!event.payload || typeof event.payload !== \"object\" || Array.isArray(event.payload)) {\n    return null;\n  }\n  const payload = event.payload as Record<string, unknown>;\n  if (event.type === \"user.message\" || event.type === \"agent.message.completed\") {\n    return typeof payload.text === \"string\" ? payload.text : null;\n  }\n  if (event.type !== \"agent.toolCall.output\") return null;\n  const output = Object.prototype.hasOwnProperty.call(payload, \"output\")\n    ? payload.output\n    : payload.preview;\n  const text = stripExecBanner(normalizedToolOutput(output)).replace(ANSI_SEQUENCE, \"\");\n  return text.length > 0 ? text : null;\n}\n\nfunction utf8Prefix(value: string, maxBytes: number): string {\n  let output = \"\";\n  let bytes = 0;\n  for (const character of value) {\n    const next = new TextEncoder().encode(character).byteLength;\n    if (bytes + next > maxBytes) break;\n    output += character;\n    bytes += next;\n  }\n  return output;\n}\n\nfunction utf8Suffix(value: string, maxBytes: number): string {\n  let output = \"\";\n  let bytes = 0;\n  for (const character of [...value].reverse()) {\n    const next = new TextEncoder().encode(character).byteLength;\n    if (bytes + next > maxBytes) break;\n    output = character + output;\n    bytes += next;\n  }\n  return output;\n}\n\nfunction candidateOffsets(sourceText: string, quote: string): number[] {\n  const matches: number[] = [];\n  let cursor = 0;\n  while (cursor <= sourceText.length - quote.length) {\n    const index = sourceText.indexOf(quote, cursor);\n    if (index < 0) break;\n    matches.push(index);\n    cursor = index + 1;\n  }\n  return matches;\n}\n\nfunction resolveQuoteOffset(sourceText: string, annotation: DraftTimelineAnnotation): number {\n  const { source, quote } = annotation;\n  if (\n    source.endOffset - source.startOffset === quote.length &&\n    sourceText.slice(source.startOffset, source.endOffset) === quote\n  ) {\n    return source.startOffset;\n  }\n  const matches = candidateOffsets(sourceText, quote);\n  if (matches.length === 1) return matches[0]!;\n  const contextual = matches.filter((start) => {\n    const before = sourceText.slice(Math.max(0, start - source.contextBefore.length), start);\n    const after = sourceText.slice(\n      start + quote.length,\n      start + quote.length + source.contextAfter.length,\n    );\n    return before === source.contextBefore && after === source.contextAfter;\n  });\n  if (contextual.length === 1) return contextual[0]!;\n  return invalidAnnotationSource();\n}\n\nasync function validateTimelineAnnotations(\n  db: Database,\n  workspaceId: string,\n  sessionId: string,\n  annotations: readonly DraftTimelineAnnotation[],\n  options: AnnotationValidationOptions,\n): Promise<DraftTimelineAnnotation[]> {\n  const parsed = options.requireNotes\n    ? SubmittedTimelineAnnotations.parse(annotations)\n    : DraftTimelineAnnotations.parse(annotations);\n  const validated: DraftTimelineAnnotation[] = [];\n  for (const annotation of parsed) {\n    const event = await getSessionEvent(db, workspaceId, annotation.source.eventId);\n    if (\n      !event ||\n      event.sessionId !== sessionId ||\n      event.type !== annotation.source.eventType ||\n      event.sequence !== annotation.source.sequence ||\n      (event.turnId ?? null) !== annotation.source.turnId\n    ) {\n      invalidAnnotationSource();\n    }\n    const sourceText = timelineAnnotationSourceText(event);\n    if (sourceText === null) invalidAnnotationSource();\n    const startOffset = resolveQuoteOffset(sourceText, annotation);\n    const endOffset = startOffset + annotation.quote.length;\n    validated.push({\n      ...annotation,\n      source: {\n        ...annotation.source,\n        startOffset,\n        endOffset,\n        contextBefore: utf8Suffix(sourceText.slice(0, startOffset), SOURCE_CONTEXT_BYTES),\n        contextAfter: utf8Prefix(sourceText.slice(endOffset), SOURCE_CONTEXT_BYTES),\n      },\n    });\n  }\n  return validated;\n}\n\nexport async function validateDraftTimelineAnnotations(\n  db: Database,\n  workspaceId: string,\n  sessionId: string,\n  annotations: readonly DraftTimelineAnnotation[],\n): Promise<DraftTimelineAnnotation[]> {\n  return await validateTimelineAnnotations(db, workspaceId, sessionId, annotations, {\n    requireNotes: false,\n  });\n}\n\nexport async function validateSubmittedTimelineAnnotations(\n  db: Database,\n  workspaceId: string,\n  sessionId: string,\n  annotations: readonly SubmittedTimelineAnnotation[],\n): Promise<TimelineAnnotation[]> {\n  const validated = await validateTimelineAnnotations(db, workspaceId, sessionId, annotations, {\n    requireNotes: true,\n  });\n  return numberTimelineAnnotations(validated as SubmittedTimelineAnnotation[]);\n}\n","import {\n  OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,\n  OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,\n  OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,\n  OpenGeniSlackBotConnectionMetadata,\n  areOpenGeniSlackBotScopesAccepted,\n  type AccessGrant,\n  type ConnectionMetadata,\n  type OpenGeniSlackBotConnectionMetadata as OpenGeniSlackBotMetadata,\n  type Session,\n} from \"@opengeni/contracts\";\nimport {\n  getConnectionMetadata,\n  type ConnectionMetadataWithVerification,\n  type Database,\n} from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\nimport { requirePermission } from \"../access\";\n\nexport function openGeniSlackBotMetadata(\n  metadata: Record<string, unknown>,\n): OpenGeniSlackBotMetadata | null {\n  const parsed = OpenGeniSlackBotConnectionMetadata.safeParse(metadata);\n  return parsed.success ? parsed.data : null;\n}\n\nexport function isOpenGeniSlackBotConnection(\n  connection: ConnectionMetadata &\n    Partial<\n      Pick<ConnectionMetadataWithVerification, \"verifiedInstallAt\" | \"verifiedInstallVersion\">\n    >,\n): boolean {\n  return (\n    connection.verifiedInstallAt != null &&\n    connection.verifiedInstallVersion === connection.version &&\n    connection.subjectId === null &&\n    connection.providerDomain === \"slack.com\" &&\n    connection.kind === \"app_install\" &&\n    areOpenGeniSlackBotScopesAccepted(connection.grantedScopes) &&\n    openGeniSlackBotMetadata(connection.metadata)?.credentialRole ===\n      OPENGENI_SLACK_BOT_CREDENTIAL_ROLE\n  );\n}\n\nexport function hasReservedOpenGeniSlackBotMetadata(\n  metadata: Record<string, unknown> | null | undefined,\n): boolean {\n  return (\n    metadata?.credentialRole === OPENGENI_SLACK_BOT_CREDENTIAL_ROLE ||\n    metadata?.credentialLabel === OPENGENI_SLACK_BOT_CREDENTIAL_LABEL\n  );\n}\n\nexport function hasReservedOpenGeniSlackBotSessionMetadata(\n  metadata: Record<string, unknown> | null | undefined,\n): boolean {\n  return Boolean(\n    metadata &&\n    Object.prototype.hasOwnProperty.call(metadata, OPENGENI_SLACK_BOT_SESSION_METADATA_KEY),\n  );\n}\n\n/**\n * Internal, pre-authorized lookup used by the scheduler and Slack tool adapter.\n * Public callers must perform their permission check before calling this helper.\n */\nexport async function requireOpenGeniSlackBotConnection(\n  db: Database,\n  workspaceId: string,\n  connectionId: string,\n): Promise<ConnectionMetadata> {\n  const connection = await getConnectionMetadata(db, workspaceId, connectionId, null);\n  if (!connection || !isOpenGeniSlackBotConnection(connection)) {\n    throw new HTTPException(422, {\n      message: \"slackBotConnectionId must reference an OpenGeni Slack bot connection\",\n    });\n  }\n  if (connection.status !== \"active\") {\n    throw new HTTPException(422, {\n      message: `OpenGeni Slack bot connection is not active (${connection.status})`,\n    });\n  }\n  return connection;\n}\n\nexport async function validateOpenGeniSlackBotConnectionSelection(\n  db: Database,\n  grant: AccessGrant,\n  workspaceId: string,\n  connectionId: string,\n): Promise<ConnectionMetadata> {\n  requirePermission(grant, \"connections:read\");\n  return await requireOpenGeniSlackBotConnection(db, workspaceId, connectionId);\n}\n\nexport function scheduledSlackBotConnectionId(\n  metadata: Record<string, unknown> | null | undefined,\n): string | null {\n  const value = metadata?.[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];\n  return typeof value === \"string\" && zUuid(value) ? value : null;\n}\n\n/**\n * The scheduler writes the connection pointer together with immutable creator\n * provenance. Requiring both prevents ordinary session metadata from becoming\n * an authorization mechanism for a workspace-shared bot credential.\n */\nexport function isTrustedScheduledSlackBotSession(\n  session: Pick<Session, \"createdBy\" | \"createdByContext\" | \"metadata\">,\n): boolean {\n  const scheduledTaskId = session.metadata.scheduledTaskId;\n  const scheduledTaskRunId = session.metadata.scheduledTaskRunId;\n  return (\n    session.createdBy?.kind === \"service\" &&\n    session.createdBy.subjectId === \"scheduler\" &&\n    typeof scheduledTaskId === \"string\" &&\n    zUuid(scheduledTaskId) &&\n    typeof scheduledTaskRunId === \"string\" &&\n    zUuid(scheduledTaskRunId) &&\n    session.createdByContext.scheduledTaskId === scheduledTaskId &&\n    session.createdByContext.scheduledTaskRunId === scheduledTaskRunId &&\n    scheduledSlackBotConnectionId(session.metadata) !== null\n  );\n}\n\nfunction zUuid(value: string): boolean {\n  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);\n}\n","import { configuredStaticUsageLimits, type Settings } from \"@opengeni/config\";\nimport {\n  WorkspaceInsightsSnapshot,\n  type InsightsRange,\n  type WorkspaceInsightsResponse,\n} from \"@opengeni/contracts\";\nimport {\n  aggregateModelCallFacts,\n  aggregateModelCallFactsByDay,\n  aggregateModelCallFactsByHour,\n  aggregateRootSessionDrivers,\n  aggregateScheduleFacts,\n  aggregateSessionDepth,\n  aggregateWarmSecondsByGroup,\n  countOnlineMachines,\n  countScheduledTaskFires,\n  countSessionsAttachedToGroups,\n  enumerateUtcDays,\n  enumerateUtcHours,\n  listFloorSessions,\n  listLiveWarmLeases,\n  listModelCallFacets,\n  listRecentModelCalls,\n  listScheduledTasks,\n  requireWorkspace,\n  sumUsageQuantity,\n  sumUsageQuantityByDay,\n  sumUsageQuantityByHour,\n  sumUsageQuantityInRange,\n  type Database,\n} from \"@opengeni/db\";\n\nconst MACHINE_HEARTBEAT_FRESH_MS = 120_000;\n\nexport type GetWorkspaceInsightsInput = {\n  workspaceId: string;\n  range: InsightsRange;\n  provider?: string | null;\n  model?: string | null;\n  now?: Date;\n};\n\nfunction microsToUsd(micros: number): number {\n  return micros / 1_000_000;\n}\n\nfunction cacheHitPct(cached: number, input: number): number {\n  if (input <= 0) return 0;\n  return Math.min(100, Math.max(0, Math.round((cached / input) * 100)));\n}\n\nfunction startOfUtcDay(date: Date): Date {\n  return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate()));\n}\n\nfunction startOfUtcMonth(date: Date): Date {\n  return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), 1));\n}\n\nfunction startOfUtcYear(date: Date): Date {\n  return new Date(Date.UTC(date.getUTCFullYear(), 0, 1));\n}\n\nfunction resolveRangeWindow(\n  range: InsightsRange,\n  now: Date,\n): {\n  since: Date;\n  until: Date;\n  priorSince: Date;\n  priorUntil: Date;\n  rangeLabel: string;\n  priorLabel: string;\n  seriesLabel: string;\n  cacheSeriesLabel: string;\n} {\n  const until = now;\n  let since: Date;\n  let rangeLabel: string;\n  let priorLabel: string;\n  let seriesLabel: string;\n  let cacheSeriesLabel: string;\n  switch (range) {\n    case \"today\":\n      since = startOfUtcDay(now);\n      rangeLabel = \"Today (UTC)\";\n      priorLabel = \"Prior equal window\";\n      seriesLabel = \"Credit $ / UTC hour\";\n      cacheSeriesLabel = \"Cache hit % / UTC hour\";\n      break;\n    case \"week\":\n      since = new Date(startOfUtcDay(now).getTime() - 6 * 24 * 60 * 60 * 1000);\n      rangeLabel = \"Last 7 days (UTC)\";\n      priorLabel = \"Prior 7 days\";\n      seriesLabel = \"Credit $ / UTC day\";\n      cacheSeriesLabel = \"Cache hit % / UTC day\";\n      break;\n    case \"month\":\n      since = startOfUtcMonth(now);\n      rangeLabel = \"This month (UTC)\";\n      priorLabel = \"Prior equal window\";\n      seriesLabel = \"Credit $ / UTC day\";\n      cacheSeriesLabel = \"Cache hit % / UTC day\";\n      break;\n    case \"ytd\":\n      since = startOfUtcYear(now);\n      rangeLabel = \"Year to date (UTC)\";\n      priorLabel = \"Prior equal window\";\n      seriesLabel = \"Credit $ / UTC day\";\n      cacheSeriesLabel = \"Cache hit % / UTC day\";\n      break;\n    default: {\n      const _exhaustive: never = range;\n      throw new Error(`Unknown insights range: ${_exhaustive}`);\n    }\n  }\n  const durationMs = until.getTime() - since.getTime();\n  const priorUntil = since;\n  const priorSince = new Date(priorUntil.getTime() - Math.max(durationMs, 1));\n  return {\n    since,\n    until,\n    priorSince,\n    priorUntil,\n    rangeLabel,\n    priorLabel,\n    seriesLabel,\n    cacheSeriesLabel,\n  };\n}\n\nfunction ageLabel(updatedAt: Date, now: Date): string {\n  const ms = Math.max(0, now.getTime() - updatedAt.getTime());\n  const minutes = Math.floor(ms / 60_000);\n  if (minutes < 1) return \"just now\";\n  if (minutes < 60) return `${minutes}m`;\n  const hours = Math.floor(minutes / 60);\n  if (hours < 48) return `${hours}h`;\n  return `${Math.floor(hours / 24)}d`;\n}\n\nfunction floorState(input: {\n  status: string;\n  directControlState: string;\n}): \"running\" | \"paused\" | \"failed\" | \"idle\" | \"compacting\" | \"waiting\" {\n  if (input.directControlState === \"paused\") return \"paused\";\n  switch (input.status) {\n    case \"running\":\n      return \"running\";\n    case \"failed\":\n      return \"failed\";\n    case \"requires_action\":\n    case \"waiting\":\n      return \"waiting\";\n    case \"compacting\":\n      return \"compacting\";\n    case \"completed\":\n    case \"idle\":\n    case \"queued\":\n      return \"idle\";\n    default:\n      return \"idle\";\n  }\n}\n\nfunction billingPathOf(value: string): \"opengeni_credits\" | \"external\" {\n  return value === \"external\" ? \"external\" : \"opengeni_credits\";\n}\n\nfunction pricingSourceOf(\n  value: string | null,\n): \"configured_list_price\" | \"gateway_reported\" | null {\n  return value === \"configured_list_price\" || value === \"gateway_reported\" ? value : null;\n}\n\nexport async function getWorkspaceInsights(\n  db: Database,\n  settings: Settings,\n  input: GetWorkspaceInsightsInput,\n): Promise<WorkspaceInsightsResponse> {\n  await requireWorkspace(db, input.workspaceId);\n  const now = input.now ?? new Date();\n  const window = resolveRangeWindow(input.range, now);\n  const provider = input.provider?.trim() || null;\n  const model = input.model?.trim() || null;\n  const modelFilterActive = Boolean(provider || model);\n  const filter = { provider, model };\n  const aggregateFactsForSeries =\n    input.range === \"today\" ? aggregateModelCallFactsByHour : aggregateModelCallFactsByDay;\n  const sumUsageForSeries =\n    input.range === \"today\" ? sumUsageQuantityByHour : sumUsageQuantityByDay;\n\n  const [\n    workspaceCreditMicros,\n    priorWorkspaceCreditMicros,\n    warmSeconds,\n    priorWarmSeconds,\n    modelRows,\n    priorModelRows,\n    factDays,\n    warmDays,\n    costDays,\n    warmGroups,\n    liveWarm,\n    rootDrivers,\n    scheduleFacts,\n    tasks,\n    depth,\n    floorRows,\n    machinesOnline,\n    billableTokensUsed,\n    agentRunsUsed,\n    facets,\n    recentCalls,\n  ] = await Promise.all([\n    sumUsageQuantityInRange(db, {\n      workspaceId: input.workspaceId,\n      eventType: \"model.cost\",\n      since: window.since,\n      until: window.until,\n    }),\n    sumUsageQuantityInRange(db, {\n      workspaceId: input.workspaceId,\n      eventType: \"model.cost\",\n      since: window.priorSince,\n      until: window.priorUntil,\n    }),\n    sumUsageQuantityInRange(db, {\n      workspaceId: input.workspaceId,\n      eventType: \"sandbox.warm_seconds\",\n      since: window.since,\n      until: window.until,\n    }),\n    sumUsageQuantityInRange(db, {\n      workspaceId: input.workspaceId,\n      eventType: \"sandbox.warm_seconds\",\n      since: window.priorSince,\n      until: window.priorUntil,\n    }),\n    aggregateModelCallFacts(db, {\n      workspaceId: input.workspaceId,\n      since: window.since,\n      until: window.until,\n      ...filter,\n    }),\n    aggregateModelCallFacts(db, {\n      workspaceId: input.workspaceId,\n      since: window.priorSince,\n      until: window.priorUntil,\n      ...filter,\n    }),\n    aggregateFactsForSeries(db, {\n      workspaceId: input.workspaceId,\n      since: window.since,\n      until: window.until,\n      ...filter,\n    }),\n    sumUsageForSeries(db, {\n      workspaceId: input.workspaceId,\n      eventType: \"sandbox.warm_seconds\",\n      since: window.since,\n      until: window.until,\n    }),\n    sumUsageForSeries(db, {\n      workspaceId: input.workspaceId,\n      eventType: \"model.cost\",\n      since: window.since,\n      until: window.until,\n    }),\n    aggregateWarmSecondsByGroup(db, {\n      workspaceId: input.workspaceId,\n      since: window.since,\n      until: window.until,\n      limit: 24,\n    }),\n    listLiveWarmLeases(db, input.workspaceId),\n    aggregateRootSessionDrivers(db, {\n      workspaceId: input.workspaceId,\n      since: window.since,\n      until: window.until,\n      ...filter,\n      limit: 8,\n    }),\n    aggregateScheduleFacts(db, {\n      workspaceId: input.workspaceId,\n      since: window.since,\n      until: window.until,\n      ...filter,\n    }),\n    listScheduledTasks(db, input.workspaceId, 100),\n    aggregateSessionDepth(db, input.workspaceId),\n    listFloorSessions(db, input.workspaceId, 24),\n    settings.sandboxSelfhostedEnabled\n      ? countOnlineMachines(db, input.workspaceId, MACHINE_HEARTBEAT_FRESH_MS, now)\n      : Promise.resolve(0),\n    sumUsageQuantity(db, {\n      workspaceId: input.workspaceId,\n      eventType: \"model.tokens\",\n      since: startOfUtcMonth(now),\n    }),\n    sumUsageQuantity(db, {\n      workspaceId: input.workspaceId,\n      eventType: \"agent_run.created\",\n      since: startOfUtcMonth(now),\n    }),\n    listModelCallFacets(db, {\n      workspaceId: input.workspaceId,\n      since: window.since,\n      until: window.until,\n    }),\n    listRecentModelCalls(db, {\n      workspaceId: input.workspaceId,\n      since: window.since,\n      until: window.until,\n      ...filter,\n      limit: 50,\n    }),\n  ]);\n\n  const [priorRootDrivers, attached, fireCounts] = await Promise.all([\n    // Exact prior costs for the current top drivers — never a separate top-N page that\n    // drops roots and invents +$full as \"new\" spend.\n    aggregateRootSessionDrivers(db, {\n      workspaceId: input.workspaceId,\n      since: window.priorSince,\n      until: window.priorUntil,\n      ...filter,\n      rootSessionIds: rootDrivers.map((row) => row.rootSessionId),\n    }),\n    countSessionsAttachedToGroups(\n      db,\n      input.workspaceId,\n      warmGroups.map((group) => group.groupId),\n    ),\n    countScheduledTaskFires(db, {\n      workspaceId: input.workspaceId,\n      since: window.since,\n      until: window.until,\n      taskIds: tasks.map((task) => task.id),\n    }),\n  ]);\n  const backendByGroup = new Map(liveWarm.map((lease) => [lease.groupId, lease.backend]));\n  const warmSecondsByGroup = new Map(warmGroups.map((group) => [group.groupId, group.warmSeconds]));\n\n  const models = modelRows\n    .map((row) => ({\n      id: `${row.provider}:${row.model}:${row.billingPath}`,\n      model: row.model,\n      provider: row.provider,\n      billing: billingPathOf(row.billingPath),\n      calls: row.calls,\n      inputTokens: row.inputTokens,\n      outputTokens: row.outputTokens,\n      cachedTokens: row.cachedTokens,\n      cacheInputTokens: row.cacheInputTokens,\n      cacheWriteTokens: row.cacheWriteTokens,\n      reasoningTokens: row.reasoningTokens,\n      totalTokens: row.totalTokens,\n      tokenKnownCalls: row.tokenKnownCalls,\n      cacheKnownCalls: row.cacheKnownCalls,\n      creditUsd: microsToUsd(row.pricedCostMicros),\n      estimatedProviderUsd: microsToUsd(row.estimatedProviderCostMicros),\n      estimatedProviderCostKnownCalls: row.estimatedProviderCostKnownCalls,\n    }))\n    .sort((a, b) => b.totalTokens - a.totalTokens);\n\n  const creditMicros = modelRows.reduce((sum, row) => sum + row.pricedCostMicros, 0);\n  const priorCreditMicros = priorModelRows.reduce((sum, row) => sum + row.pricedCostMicros, 0);\n  const estimatedProviderCostMicros = modelRows.reduce(\n    (sum, row) => sum + row.estimatedProviderCostMicros,\n    0,\n  );\n  const priorEstimatedProviderCostMicros = priorModelRows.reduce(\n    (sum, row) => sum + row.estimatedProviderCostMicros,\n    0,\n  );\n  const estimatedProviderCostKnownCalls = modelRows.reduce(\n    (sum, row) => sum + row.estimatedProviderCostKnownCalls,\n    0,\n  );\n  const priorEstimatedProviderCostKnownCalls = priorModelRows.reduce(\n    (sum, row) => sum + row.estimatedProviderCostKnownCalls,\n    0,\n  );\n  const modelCalls = modelRows.reduce((sum, row) => sum + row.calls, 0);\n  const priorInputTokens = priorModelRows.reduce((sum, row) => sum + row.inputTokens, 0);\n  const priorTotalTokens = priorModelRows.reduce((sum, row) => sum + row.totalTokens, 0);\n  const priorCachedTokens = priorModelRows.reduce((sum, row) => sum + row.cachedTokens, 0);\n  const priorCacheInputTokens = priorModelRows.reduce((sum, row) => sum + row.cacheInputTokens, 0);\n  const priorCalls = priorModelRows.reduce((sum, row) => sum + row.calls, 0);\n\n  const buckets =\n    input.range === \"today\"\n      ? enumerateUtcHours(window.since, window.until)\n      : enumerateUtcDays(window.since, window.until);\n  const series = buckets.map((bucket) => {\n    const facts = factDays.get(bucket) ?? {\n      costMicros: 0,\n      estimatedProviderCostMicros: 0,\n      estimatedProviderCostKnownCalls: 0,\n      inputTokens: 0,\n      outputTokens: 0,\n      cachedTokens: 0,\n      cacheInputTokens: 0,\n      cacheWriteTokens: 0,\n      reasoningTokens: 0,\n      totalTokens: 0,\n      tokenKnownCalls: 0,\n      cacheKnownCalls: 0,\n      calls: 0,\n    };\n    const modelCostMicros = modelFilterActive\n      ? facts.costMicros\n      : (costDays.get(bucket) ?? facts.costMicros);\n    return {\n      label: input.range === \"today\" ? bucket.slice(11) : bucket.slice(5),\n      modelCostUsd: microsToUsd(modelCostMicros),\n      estimatedProviderUsd: microsToUsd(facts.estimatedProviderCostMicros),\n      estimatedProviderCostKnownCalls: facts.estimatedProviderCostKnownCalls,\n      warmSeconds: warmDays.get(bucket) ?? 0,\n      inputTokens: facts.inputTokens,\n      outputTokens: facts.outputTokens,\n      cachedTokens: facts.cachedTokens,\n      cacheInputTokens: facts.cacheInputTokens,\n      cacheWriteTokens: facts.cacheWriteTokens,\n      reasoningTokens: facts.reasoningTokens,\n      totalTokens: facts.totalTokens,\n      tokenKnownCalls: facts.tokenKnownCalls,\n      cacheKnownCalls: facts.cacheKnownCalls,\n      cacheHitPct: cacheHitPct(facts.cachedTokens, facts.cacheInputTokens),\n      calls: facts.calls,\n    };\n  });\n\n  const priorDriverByRoot = new Map(\n    priorRootDrivers.map((row) => [row.rootSessionId, row.pricedCostMicros]),\n  );\n  const totalTokensForPct = Math.max(\n    rootDrivers.reduce((sum, row) => sum + row.totalTokens, 0),\n    1,\n  );\n  const drivers = rootDrivers.map((row) => {\n    const creditUsd = microsToUsd(row.pricedCostMicros);\n    const priorUsd = microsToUsd(priorDriverByRoot.get(row.rootSessionId) ?? 0);\n    return {\n      id: `root:${row.rootSessionId}`,\n      groupBy: \"root_session\" as const,\n      label: row.title?.trim() || row.rootSessionId.slice(0, 8),\n      creditUsd,\n      estimatedProviderUsd: microsToUsd(row.estimatedProviderCostMicros),\n      estimatedProviderCostKnownCalls: row.estimatedProviderCostKnownCalls,\n      tokens: row.totalTokens,\n      cacheHitPct: cacheHitPct(row.cachedTokens, row.cacheInputTokens),\n      pctOfCreditUsd:\n        creditMicros > 0\n          ? Math.min(100, Math.round((row.pricedCostMicros / creditMicros) * 100))\n          : 0,\n      pctOfTokens: Math.min(100, Math.round((row.totalTokens / totalTokensForPct) * 100)),\n      deltaUsdVsPrior: creditUsd - priorUsd,\n    };\n  });\n\n  const scheduleFactById = new Map(scheduleFacts.map((row) => [row.scheduledTaskId, row] as const));\n  const schedules = tasks.map((task) => {\n    const fact = scheduleFactById.get(task.id);\n    return {\n      id: task.id,\n      name: task.name,\n      fires: fireCounts.get(task.id) ?? 0,\n      creditUsd: fact ? microsToUsd(fact.pricedCostMicros) : null,\n      estimatedProviderUsd: fact ? microsToUsd(fact.estimatedProviderCostMicros) : null,\n      estimatedProviderCostKnownCalls: fact ? fact.estimatedProviderCostKnownCalls : null,\n      tokens: fact ? fact.totalTokens : null,\n      cacheHitPct: fact ? cacheHitPct(fact.cachedTokens, fact.cacheInputTokens) : null,\n      billing: fact ? billingPathOf(fact.billingPath) : null,\n    };\n  });\n\n  const limits = configuredStaticUsageLimits(settings);\n  // Floor sessions only carry product model, not provider. Filter when an exact\n  // model is selected; otherwise leave the list workspace-wide (captioned in UI).\n  const floor = floorRows\n    .filter((row) => {\n      if (!model) return true;\n      return row.model === model;\n    })\n    .map((row) => ({\n      id: row.id,\n      title: row.title?.trim() || \"Untitled session\",\n      state: floorState(row),\n      depth: row.nestedAgentDepth,\n      model: row.model,\n      provider: null,\n      ageLabel: ageLabel(row.updatedAt, now),\n      cacheHitPct: null,\n      route: row.sandboxBackend,\n    }));\n\n  const snapshot = WorkspaceInsightsSnapshot.parse({\n    range: input.range,\n    rangeLabel: window.rangeLabel,\n    priorLabel: window.priorLabel,\n    seriesLabel: window.seriesLabel,\n    cacheSeriesLabel: window.cacheSeriesLabel,\n    windowStart: window.since.toISOString(),\n    windowEnd: window.until.toISOString(),\n    generatedAt: now.toISOString(),\n    timezone: \"UTC\",\n    models,\n    facets,\n    series,\n    depth: depth.buckets.map((bucket) => ({\n      depth: bucket.depth,\n      sessions: bucket.sessions,\n    })),\n    drivers,\n    schedules,\n    recentCalls: recentCalls.map((row) => ({\n      id: row.id,\n      occurredAt: row.occurredAt.toISOString(),\n      recordedAt: row.recordedAt.toISOString(),\n      sessionId: row.sessionId,\n      sessionTitle: row.sessionTitle?.trim() || \"Untitled session\",\n      turnId: row.turnId,\n      provider: row.provider,\n      providerApi: row.providerApi,\n      model: row.model,\n      billing: billingPathOf(row.billingPath),\n      inputTokens: row.inputTokens,\n      outputTokens: row.outputTokens,\n      cachedTokens: row.cachedTokens,\n      cacheWriteTokens: row.cacheWriteTokens,\n      reasoningTokens: row.reasoningTokens,\n      totalTokens: row.totalTokens,\n      creditUsd: microsToUsd(row.pricedCostMicros),\n      estimatedProviderUsd:\n        row.estimatedProviderCostMicros == null\n          ? null\n          : microsToUsd(row.estimatedProviderCostMicros),\n      pricingSource: pricingSourceOf(row.pricingSource),\n    })),\n    warmSeconds,\n    priorWarmSeconds,\n    warmGroups: warmGroups.map((group) => ({\n      id: group.groupId,\n      groupId: group.groupId,\n      label: group.groupId.slice(0, 8),\n      backend: backendByGroup.get(group.groupId) ?? null,\n      warmSeconds: group.warmSeconds,\n      sessionsAttached: attached.get(group.groupId) ?? 0,\n    })),\n    liveWarm: liveWarm.map((lease) => ({\n      id: lease.id,\n      groupId: lease.groupId,\n      backend: lease.backend,\n      turnHolders: lease.turnHolders,\n      viewerHolders: lease.viewerHolders,\n      warmForLabel: lease.turnHolders > 0 ? \"in use\" : \"idle warm\",\n      warmSeconds: warmSecondsByGroup.get(lease.groupId) ?? 0,\n    })),\n    floor,\n    selfhostedEnabled: settings.sandboxSelfhostedEnabled,\n    machinesOnline,\n    workspaceCreditUsd: microsToUsd(workspaceCreditMicros),\n    priorWorkspaceCreditUsd: microsToUsd(priorWorkspaceCreditMicros),\n    creditUsd: microsToUsd(creditMicros),\n    priorCreditUsd: microsToUsd(priorCreditMicros),\n    estimatedProviderUsd: microsToUsd(estimatedProviderCostMicros),\n    priorEstimatedProviderUsd: microsToUsd(priorEstimatedProviderCostMicros),\n    estimatedProviderCostKnownCalls,\n    priorEstimatedProviderCostKnownCalls,\n    modelCalls,\n    priorInputTokens,\n    priorTotalTokens,\n    priorCacheHitPct: cacheHitPct(priorCachedTokens, priorCacheInputTokens),\n    priorCalls,\n    goalsActive: depth.goalsActive,\n    goalsCompleted: depth.goalsCompleted,\n    sessionsTouched: depth.sessionsTouched,\n    rootSessions: depth.rootSessions,\n    deepestDepth: depth.deepestDepth,\n    deepestSessionTitle: depth.deepestSessionTitle || \"\",\n    avgDepth: Math.round(depth.avgDepth * 10) / 10,\n    warmIdleNow: liveWarm.filter((lease) => lease.turnHolders === 0).length,\n    billableTokensUsed,\n    billableTokenCap: limits.maxMonthlyTokensPerWorkspace ?? null,\n    agentRunsUsed,\n    agentRunCap: limits.maxMonthlyAgentRunsPerWorkspace ?? null,\n    modelFilterActive,\n  });\n\n  return { snapshot };\n}\n","import { createHash } from \"node:crypto\";\nimport {\n  stableJson,\n  type KnowledgeMemoryKind,\n  type KnowledgeMemoryStatus,\n} from \"@opengeni/contracts\";\nimport { sanitizeSlackPublicationText } from \"./slack-publication-secret-safety\";\n\nconst UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;\nconst SELECTOR_SEGMENT_PATTERN = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/;\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\nexport const MEMORY_SLACK_PROJECTION_VERSION = 1;\nexport const MEMORY_SLACK_SUMMARY_MAX_UTF8_BYTES = 512;\nexport const MEMORY_SLACK_NAMESPACE_MAX_UTF8_BYTES = 128;\nexport const MEMORY_SLACK_LABEL_MAX_UTF8_BYTES = 64;\nexport const MEMORY_SLACK_LABEL_MAX_COUNT = 8;\nexport const MEMORY_SLACK_OWNER_MAX_UTF8_BYTES = 96;\nexport const MEMORY_SLACK_PROJECTION_MAX_UTF8_BYTES = 4096;\n\nexport type MemorySlackImportance = \"major\" | \"normal\" | \"minor\";\nexport type MemorySlackRequestedMode = \"auto\" | \"review\" | \"never\";\nexport type MemorySlackDeliveryMode = Exclude<MemorySlackRequestedMode, \"never\">;\nexport type MemorySlackChangeKind = \"created\" | \"corrected\" | \"superseded\";\nexport type MemorySlackOrigin = \"native\" | \"slack_derived\";\nexport type MemorySlackAudience = \"workspace\" | \"restricted\";\n\nexport type MemorySlackPublicationPolicy = {\n  enabled: boolean;\n  autoImportances: readonly MemorySlackImportance[];\n  reviewImportances: readonly MemorySlackImportance[];\n};\n\n/**\n * Nothing publishes without an explicit workspace-admin enablement. When\n * enabled without tuning, major changes may publish automatically, normal\n * changes require review, and minor changes stay quiet.\n */\nexport const DEFAULT_MEMORY_SLACK_PUBLICATION_POLICY = {\n  enabled: false,\n  autoImportances: [\"major\"],\n  reviewImportances: [\"normal\"],\n} as const satisfies MemorySlackPublicationPolicy;\n\nexport type MemorySlackPublicationInput = {\n  context: {\n    accountId: string;\n    workspaceId: string;\n    now: string;\n  };\n  policy?: MemorySlackPublicationPolicy | undefined;\n  memory: {\n    sourceType: \"workspace_memory\";\n    accountId: string;\n    workspaceId: string;\n    id: string;\n    version: number;\n    status: KnowledgeMemoryStatus;\n    kind: KnowledgeMemoryKind;\n    scopeType: \"workspace\" | \"user\" | \"role\" | \"session\" | \"ephemeral\" | \"legacy\";\n    namespace: string;\n    labels: readonly string[];\n    validFrom: string;\n    validUntil: string | null;\n    supersedesId: string | null;\n    supersededById: string | null;\n  };\n  change: {\n    kind: MemorySlackChangeKind;\n    relatedMemoryId: string | null;\n    occurredAt: string;\n    origin: MemorySlackOrigin;\n    ownerLabel?: string | null | undefined;\n  };\n  distribution: {\n    importance: MemorySlackImportance;\n    audience: MemorySlackAudience;\n    slackMode: MemorySlackRequestedMode;\n    shareSummary: string;\n  };\n};\n\nexport type MemorySlackPublicationDenialReason =\n  | \"disabled\"\n  | \"invalid_input\"\n  | \"unsupported_source\"\n  | \"tenant_mismatch\"\n  | \"not_decision\"\n  | \"status_ineligible\"\n  | \"restricted_scope\"\n  | \"restricted_audience\"\n  | \"not_yet_valid\"\n  | \"expired\"\n  | \"slack_origin_loop\"\n  | \"mode_never\"\n  | \"below_noise_policy\"\n  | \"missing_summary\"\n  | \"invalid_change_lineage\";\n\nexport type MemorySlackPublicationProjection = {\n  version: typeof MEMORY_SLACK_PROJECTION_VERSION;\n  workspaceId: string;\n  memoryId: string;\n  memoryVersion: number;\n  changeKind: MemorySlackChangeKind;\n  relatedMemoryId: string | null;\n  occurredAt: string;\n  importance: MemorySlackImportance;\n  deliveryMode: MemorySlackDeliveryMode;\n  summary: string;\n  summaryTruncated: boolean;\n  namespace: string;\n  labels: string[];\n  labelsTruncated: boolean;\n  ownerLabel: string | null;\n  ownerLabelTruncated: boolean;\n  authoritativeRecord: {\n    workspaceId: string;\n    memoryId: string;\n  };\n};\n\nexport type MemorySlackPublicationDecision =\n  | {\n      eligible: false;\n      reason: MemorySlackPublicationDenialReason;\n    }\n  | {\n      eligible: true;\n      deliveryMode: MemorySlackDeliveryMode;\n      idempotencyKey: string;\n      projection: MemorySlackPublicationProjection;\n    };\n\nconst IMPORTANCES = new Set<MemorySlackImportance>([\"major\", \"normal\", \"minor\"]);\nconst REQUESTED_MODES = new Set<MemorySlackRequestedMode>([\"auto\", \"review\", \"never\"]);\nconst CHANGE_KINDS = new Set<MemorySlackChangeKind>([\"created\", \"corrected\", \"superseded\"]);\nconst ORIGINS = new Set<MemorySlackOrigin>([\"native\", \"slack_derived\"]);\nconst AUDIENCES = new Set<MemorySlackAudience>([\"workspace\", \"restricted\"]);\nconst SCOPE_TYPES = new Set<MemorySlackPublicationInput[\"memory\"][\"scopeType\"]>([\n  \"workspace\",\n  \"user\",\n  \"role\",\n  \"session\",\n  \"ephemeral\",\n  \"legacy\",\n]);\nconst MEMORY_STATUSES = new Set<KnowledgeMemoryStatus>([\n  \"proposed\",\n  \"approved\",\n  \"rejected\",\n  \"active\",\n  \"superseded\",\n  \"archived\",\n]);\nconst MEMORY_KINDS = new Set<KnowledgeMemoryKind>([\n  \"semantic\",\n  \"episodic\",\n  \"procedural\",\n  \"decision\",\n  \"preference\",\n]);\nconst VISIBLE_STATUSES = new Set<KnowledgeMemoryStatus>([\"active\", \"approved\"]);\n\n/**\n * Produce the only data shape a later delivery slice may persist or\n * render. This is a deterministic policy/security boundary, not a persistence\n * hook: callers must durably bind the returned projection and key in a later\n * transaction/outbox slice.\n */\nexport function evaluateMemorySlackPublication(\n  input: MemorySlackPublicationInput,\n): MemorySlackPublicationDecision {\n  const policy = input.policy ?? DEFAULT_MEMORY_SLACK_PUBLICATION_POLICY;\n  if (!validPolicy(policy)) return denied(\"invalid_input\");\n  if (!policy.enabled) return denied(\"disabled\");\n\n  if (input.memory.sourceType !== \"workspace_memory\") return denied(\"unsupported_source\");\n  if (!validIdentity(input)) return denied(\"invalid_input\");\n  if (\n    input.memory.accountId !== input.context.accountId ||\n    input.memory.workspaceId !== input.context.workspaceId\n  ) {\n    return denied(\"tenant_mismatch\");\n  }\n  if (input.memory.kind !== \"decision\") return denied(\"not_decision\");\n  if (input.memory.scopeType !== \"workspace\") return denied(\"restricted_scope\");\n  if (input.distribution.audience !== \"workspace\") return denied(\"restricted_audience\");\n  if (input.change.origin === \"slack_derived\") return denied(\"slack_origin_loop\");\n  if (input.distribution.slackMode === \"never\") return denied(\"mode_never\");\n\n  const timeDecision = evaluateValidity(input);\n  if (timeDecision) return denied(timeDecision);\n  if (!statusEligibleForChange(input)) return denied(\"status_ineligible\");\n  if (!validChangeLineage(input)) return denied(\"invalid_change_lineage\");\n\n  const deliveryMode = effectiveDeliveryMode(policy, input.distribution);\n  if (!deliveryMode) return denied(\"below_noise_policy\");\n\n  const collapsedSummary = sanitizeSlackPublicationText(\n    collapseText(input.distribution.shareSummary),\n  );\n  if (!collapsedSummary) return denied(\"missing_summary\");\n  const summary = truncateUtf8(collapsedSummary, MEMORY_SLACK_SUMMARY_MAX_UTF8_BYTES);\n\n  const namespace = normalizeNamespace(input.memory.namespace);\n  const labels = normalizeLabels(input.memory.labels);\n  if (!namespace || !labels) return denied(\"invalid_input\");\n\n  const owner = boundedOptionalText(input.change.ownerLabel, MEMORY_SLACK_OWNER_MAX_UTF8_BYTES);\n  const projection: MemorySlackPublicationProjection = {\n    version: MEMORY_SLACK_PROJECTION_VERSION,\n    workspaceId: input.context.workspaceId,\n    memoryId: input.memory.id,\n    memoryVersion: input.memory.version,\n    changeKind: input.change.kind,\n    relatedMemoryId: input.change.relatedMemoryId,\n    occurredAt: new Date(input.change.occurredAt).toISOString(),\n    importance: input.distribution.importance,\n    deliveryMode,\n    summary: summary.value,\n    summaryTruncated: summary.truncated,\n    namespace,\n    labels: labels.values,\n    labelsTruncated: labels.truncated,\n    ownerLabel: owner.value,\n    ownerLabelTruncated: owner.truncated,\n    authoritativeRecord: {\n      workspaceId: input.context.workspaceId,\n      memoryId: input.memory.id,\n    },\n  };\n\n  if (utf8Bytes(stableJson(projection)) > MEMORY_SLACK_PROJECTION_MAX_UTF8_BYTES) {\n    return denied(\"invalid_input\");\n  }\n\n  const digest = createHash(\"sha256\").update(stableJson(projection), \"utf8\").digest(\"hex\");\n  return {\n    eligible: true,\n    deliveryMode,\n    idempotencyKey: `memory-slack:v${MEMORY_SLACK_PROJECTION_VERSION}:${digest}`,\n    projection,\n  };\n}\n\nfunction validPolicy(policy: MemorySlackPublicationPolicy): boolean {\n  return (\n    typeof policy.enabled === \"boolean\" &&\n    Array.isArray(policy.autoImportances) &&\n    Array.isArray(policy.reviewImportances) &&\n    policy.autoImportances.every((importance) => IMPORTANCES.has(importance)) &&\n    policy.reviewImportances.every((importance) => IMPORTANCES.has(importance))\n  );\n}\n\nfunction validIdentity(input: MemorySlackPublicationInput): boolean {\n  const uuids = [\n    input.context.accountId,\n    input.context.workspaceId,\n    input.memory.accountId,\n    input.memory.workspaceId,\n    input.memory.id,\n    input.memory.supersedesId,\n    input.memory.supersededById,\n    input.change.relatedMemoryId,\n  ].filter((value): value is string => value !== null);\n  return (\n    uuids.every((value) => UUID_PATTERN.test(value)) &&\n    Number.isSafeInteger(input.memory.version) &&\n    input.memory.version > 0 &&\n    typeof input.memory.namespace === \"string\" &&\n    Array.isArray(input.memory.labels) &&\n    input.memory.labels.every((label) => typeof label === \"string\") &&\n    (input.change.ownerLabel === undefined ||\n      input.change.ownerLabel === null ||\n      typeof input.change.ownerLabel === \"string\") &&\n    typeof input.distribution.shareSummary === \"string\" &&\n    IMPORTANCES.has(input.distribution.importance) &&\n    REQUESTED_MODES.has(input.distribution.slackMode) &&\n    CHANGE_KINDS.has(input.change.kind) &&\n    ORIGINS.has(input.change.origin) &&\n    AUDIENCES.has(input.distribution.audience) &&\n    SCOPE_TYPES.has(input.memory.scopeType) &&\n    MEMORY_STATUSES.has(input.memory.status) &&\n    MEMORY_KINDS.has(input.memory.kind)\n  );\n}\n\nfunction evaluateValidity(\n  input: MemorySlackPublicationInput,\n): \"invalid_input\" | \"not_yet_valid\" | \"expired\" | null {\n  const now = Date.parse(input.context.now);\n  const occurredAt = Date.parse(input.change.occurredAt);\n  const validFrom = Date.parse(input.memory.validFrom);\n  const validUntil = input.memory.validUntil === null ? null : Date.parse(input.memory.validUntil);\n  if (\n    !Number.isFinite(now) ||\n    !Number.isFinite(occurredAt) ||\n    !Number.isFinite(validFrom) ||\n    (validUntil !== null && !Number.isFinite(validUntil)) ||\n    (validUntil !== null && validUntil <= validFrom)\n  ) {\n    return \"invalid_input\";\n  }\n  if (now < validFrom) return \"not_yet_valid\";\n  if (validUntil !== null && now >= validUntil) return \"expired\";\n  return null;\n}\n\nfunction validChangeLineage(input: MemorySlackPublicationInput): boolean {\n  if (\n    input.memory.supersedesId === input.memory.id ||\n    input.memory.supersededById === input.memory.id ||\n    input.change.relatedMemoryId === input.memory.id\n  ) {\n    return false;\n  }\n\n  switch (input.change.kind) {\n    case \"created\":\n      return (\n        input.change.relatedMemoryId === null &&\n        input.memory.supersedesId === null &&\n        input.memory.supersededById === null\n      );\n    case \"corrected\":\n      return (\n        input.change.relatedMemoryId !== null &&\n        input.change.relatedMemoryId !== input.memory.id &&\n        input.memory.supersedesId === input.change.relatedMemoryId &&\n        input.memory.supersededById === null\n      );\n    case \"superseded\":\n      return (\n        input.change.relatedMemoryId !== null &&\n        input.change.relatedMemoryId !== input.memory.id &&\n        input.memory.supersededById === input.change.relatedMemoryId\n      );\n  }\n}\n\nfunction statusEligibleForChange(input: MemorySlackPublicationInput): boolean {\n  return input.change.kind === \"superseded\"\n    ? input.memory.status === \"superseded\"\n    : VISIBLE_STATUSES.has(input.memory.status);\n}\n\nfunction effectiveDeliveryMode(\n  policy: MemorySlackPublicationPolicy,\n  distribution: MemorySlackPublicationInput[\"distribution\"],\n): MemorySlackDeliveryMode | null {\n  const auto = new Set(policy.autoImportances);\n  const review = new Set(policy.reviewImportances);\n  if (distribution.slackMode === \"review\") {\n    return auto.has(distribution.importance) || review.has(distribution.importance)\n      ? \"review\"\n      : null;\n  }\n  if (auto.has(distribution.importance)) return \"auto\";\n  if (review.has(distribution.importance)) return \"review\";\n  return null;\n}\n\nfunction normalizeNamespace(value: string): string | null {\n  const trimmed = value.trim();\n  const namespace = trimmed.toLowerCase();\n  if (!namespace || utf8Bytes(namespace) > MEMORY_SLACK_NAMESPACE_MAX_UTF8_BYTES) return null;\n  const segments = namespace.split(\"/\");\n  if (segments.some((segment) => !SELECTOR_SEGMENT_PATTERN.test(segment))) return null;\n  return segments.join(\"/\");\n}\n\nfunction normalizeLabels(\n  values: readonly string[],\n): { values: string[]; truncated: boolean } | null {\n  if (!Array.isArray(values)) return null;\n  const labels = new Set<string>();\n  for (const value of values) {\n    if (typeof value !== \"string\") return null;\n    const trimmed = value.trim();\n    const label = trimmed.toLowerCase();\n    if (\n      !SELECTOR_SEGMENT_PATTERN.test(label) ||\n      utf8Bytes(label) > MEMORY_SLACK_LABEL_MAX_UTF8_BYTES\n    ) {\n      return null;\n    }\n    labels.add(label);\n  }\n  const sorted = [...labels].sort();\n  return {\n    values: sorted.slice(0, MEMORY_SLACK_LABEL_MAX_COUNT),\n    truncated: sorted.length > MEMORY_SLACK_LABEL_MAX_COUNT,\n  };\n}\n\nfunction boundedOptionalText(\n  value: string | null | undefined,\n  maxBytes: number,\n): { value: string | null; truncated: boolean } {\n  const collapsed = sanitizeSlackPublicationText(collapseText(value ?? \"\"));\n  if (!collapsed) return { value: null, truncated: false };\n  const bounded = truncateUtf8(collapsed, maxBytes);\n  return {\n    value: bounded.value || null,\n    truncated: bounded.truncated,\n  };\n}\n\nfunction collapseText(value: string): string {\n  // eslint-disable-next-line no-control-regex\n  return value\n    .replace(/[\\u0000-\\u001F\\u007F-\\u009F]/g, \" \")\n    .replace(/\\s+/g, \" \")\n    .trim();\n}\n\nfunction truncateUtf8(value: string, maxBytes: number): { value: string; truncated: boolean } {\n  const bytes = encoder.encode(value);\n  if (bytes.byteLength <= maxBytes) return { value, truncated: false };\n  const marker = \"…\";\n  const markerBytes = encoder.encode(marker);\n  let end = Math.max(0, maxBytes - markerBytes.byteLength);\n  while (end > 0 && (bytes[end]! & 0xc0) === 0x80) end -= 1;\n  return {\n    value: `${decoder.decode(bytes.subarray(0, end)).trimEnd()}${marker}`,\n    truncated: true,\n  };\n}\n\nfunction utf8Bytes(value: string): number {\n  return encoder.encode(value).byteLength;\n}\n\nfunction denied(reason: MemorySlackPublicationDenialReason): MemorySlackPublicationDecision {\n  return { eligible: false, reason };\n}\n","export const SLACK_PUBLICATION_CREDENTIAL_OMISSION = \"[credential omitted]\";\n\nconst CREDENTIAL_PATTERNS = [\n  /-----BEGIN(?: [A-Z0-9]+)* PRIVATE KEY-----[\\s\\S]*?(?:-----END(?: [A-Z0-9]+)* PRIVATE KEY-----|$)/gi,\n  /\\b(?:github_pat_[A-Za-z0-9_]{20,}|gh[pousr]_[A-Za-z0-9]{20,}|glpat-[A-Za-z0-9_-]{20,})/g,\n  /\\b(?:sk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}|(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,})/g,\n  /\\b(?:AKIA|ASIA)[A-Z0-9]{16}\\b/g,\n  /\\bxox[baprs]-[A-Za-z0-9-]{10,}/g,\n  /\\bAIza[0-9A-Za-z_-]{20,}/g,\n  /\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\b/g,\n] as const;\n\nconst BEARER_CREDENTIAL_PATTERN = /\\bBearer\\s+[A-Za-z0-9._~+/=-]{16,}/gi;\nconst CREDENTIAL_ASSIGNMENT_PATTERN =\n  /(^|[\\s,;([])((?:api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|password|passwd|secret|token))\\s*[:=]\\s*(?:\"[^\"]{8,}\"|'[^']{8,}'|[^\\s,;\\])}]{8,})/gi;\nconst CREDENTIAL_URL_PATTERN = /\\b([a-z][a-z0-9+.-]*:\\/\\/[^:\\s/@]+:)[^@\\s/]+@/gi;\n\n/**\n * Deterministic, sink-local protection for text that is about to be persisted\n * as a Slack publication projection or rendered to Slack. It intentionally\n * does not scan or mutate canonical Memory, durable-learning receipts, model\n * context, history, events, or any other internal OpenGeni content path.\n */\nexport function sanitizeSlackPublicationText(value: string): string {\n  let sanitized = value;\n  for (const pattern of CREDENTIAL_PATTERNS) {\n    sanitized = sanitized.replace(pattern, SLACK_PUBLICATION_CREDENTIAL_OMISSION);\n  }\n  sanitized = sanitized.replace(\n    BEARER_CREDENTIAL_PATTERN,\n    `Bearer ${SLACK_PUBLICATION_CREDENTIAL_OMISSION}`,\n  );\n  sanitized = sanitized.replace(\n    CREDENTIAL_ASSIGNMENT_PATTERN,\n    (_match, prefix: string, name: string) =>\n      `${prefix}${name}=${SLACK_PUBLICATION_CREDENTIAL_OMISSION}`,\n  );\n  return sanitized.replace(\n    CREDENTIAL_URL_PATTERN,\n    (_match, prefix: string) => `${prefix}${SLACK_PUBLICATION_CREDENTIAL_OMISSION}@`,\n  );\n}\n","import type { MemorySlackPublicationDistribution } from \"@opengeni/contracts\";\nimport {\n  correctWorkspaceMemory,\n  enqueueMemorySlackPublication,\n  getCurrentMemorySlackPublicationConfiguration,\n  getWorkspaceMemorySlackPublicationSnapshot,\n  saveWorkspaceMemory,\n  withWorkspaceRls,\n  type CorrectWorkspaceMemoryInput,\n  type CorrectWorkspaceMemoryResult,\n  type Database,\n  type EnqueueMemorySlackPublicationResult,\n  type MemoryEmbedder,\n  type MemorySlackPublicationActor,\n  type SaveWorkspaceMemoryInput,\n  type SaveWorkspaceMemoryResult,\n  type WorkspaceMemorySlackPublicationSnapshot,\n} from \"@opengeni/db\";\nimport {\n  evaluateMemorySlackPublication,\n  type MemorySlackOrigin,\n  type MemorySlackPublicationDecision,\n} from \"./memory-slack-publication\";\n\nexport type MemorySlackPublicationCommitRequest = {\n  distribution: MemorySlackPublicationDistribution;\n  actor: MemorySlackPublicationActor;\n  ownerLabel?: string | null;\n  origin?: MemorySlackOrigin;\n};\n\nexport type MemorySlackPublicationCommitResult = {\n  decision: MemorySlackPublicationDecision | null;\n  enqueue: EnqueueMemorySlackPublicationResult | null;\n};\n\nexport async function saveWorkspaceMemoryWithSlackPublication(\n  db: Database,\n  input: SaveWorkspaceMemoryInput,\n  publication: MemorySlackPublicationCommitRequest | null,\n  embedder?: MemoryEmbedder,\n): Promise<SaveWorkspaceMemoryResult & { slackPublication: MemorySlackPublicationCommitResult }> {\n  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {\n    const result = await saveWorkspaceMemory(scopedDb, input, embedder);\n    const slackPublication = publication\n      ? await publishSavedMemoryMutation(scopedDb, input, result, publication)\n      : { decision: null, enqueue: null };\n    return { ...result, slackPublication };\n  });\n}\n\nexport async function correctWorkspaceMemoryWithSlackPublication(\n  db: Database,\n  input: CorrectWorkspaceMemoryInput,\n  publication: MemorySlackPublicationCommitRequest | null,\n  embedder?: MemoryEmbedder,\n): Promise<\n  CorrectWorkspaceMemoryResult & { slackPublication: MemorySlackPublicationCommitResult }\n> {\n  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {\n    const result = await correctWorkspaceMemory(scopedDb, input, embedder);\n    if (!publication || result.action !== \"superseded\" || !result.replacement) {\n      return { ...result, slackPublication: { decision: null, enqueue: null } };\n    }\n    const replacement = await requiredSnapshot(scopedDb, input.workspaceId, result.replacement.id);\n    const slackPublication = await evaluateAndEnqueue(scopedDb, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      snapshot: replacement,\n      changeKind: \"corrected\",\n      relatedMemoryId: result.memory.id,\n      occurredAt: result.replacement.updatedAt,\n      publication,\n    });\n    return { ...result, slackPublication };\n  });\n}\n\nasync function publishSavedMemoryMutation(\n  db: Database,\n  input: SaveWorkspaceMemoryInput,\n  result: SaveWorkspaceMemoryResult,\n  publication: MemorySlackPublicationCommitRequest,\n): Promise<MemorySlackPublicationCommitResult> {\n  if (result.updated || (result.deduped && !result.superseded)) {\n    return { decision: null, enqueue: null };\n  }\n\n  if (result.superseded) {\n    const replacement = await requiredSnapshot(db, input.workspaceId, result.memory.id);\n    if (replacement.supersedesId === result.superseded.id) {\n      return await evaluateAndEnqueue(db, {\n        accountId: input.accountId,\n        workspaceId: input.workspaceId,\n        snapshot: replacement,\n        changeKind: \"corrected\",\n        relatedMemoryId: result.superseded.id,\n        occurredAt: result.memory.updatedAt,\n        publication,\n      });\n    }\n    const retired = await requiredSnapshot(db, input.workspaceId, result.superseded.id);\n    return await evaluateAndEnqueue(db, {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      snapshot: retired,\n      changeKind: \"superseded\",\n      relatedMemoryId: result.memory.id,\n      occurredAt: result.superseded.updatedAt,\n      publication,\n    });\n  }\n\n  const created = await requiredSnapshot(db, input.workspaceId, result.memory.id);\n  return await evaluateAndEnqueue(db, {\n    accountId: input.accountId,\n    workspaceId: input.workspaceId,\n    snapshot: created,\n    changeKind: \"created\",\n    relatedMemoryId: null,\n    occurredAt: result.memory.createdAt,\n    publication,\n  });\n}\n\nasync function evaluateAndEnqueue(\n  db: Database,\n  input: {\n    accountId: string;\n    workspaceId: string;\n    snapshot: WorkspaceMemorySlackPublicationSnapshot;\n    changeKind: \"created\" | \"corrected\" | \"superseded\";\n    relatedMemoryId: string | null;\n    occurredAt: string;\n    publication: MemorySlackPublicationCommitRequest;\n  },\n): Promise<MemorySlackPublicationCommitResult> {\n  const configuration = await getCurrentMemorySlackPublicationConfiguration(db, input.workspaceId);\n  const decision = evaluateMemorySlackPublication({\n    context: {\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      now: input.occurredAt,\n    },\n    policy: configuration\n      ? {\n          enabled: configuration.enabled,\n          autoImportances: configuration.autoImportances,\n          reviewImportances: configuration.reviewImportances,\n        }\n      : undefined,\n    memory: {\n      sourceType: \"workspace_memory\",\n      accountId: input.snapshot.accountId,\n      workspaceId: input.snapshot.workspaceId,\n      id: input.snapshot.id,\n      version: input.snapshot.version,\n      status: input.snapshot.status as Parameters<\n        typeof evaluateMemorySlackPublication\n      >[0][\"memory\"][\"status\"],\n      kind: input.snapshot.kind as Parameters<\n        typeof evaluateMemorySlackPublication\n      >[0][\"memory\"][\"kind\"],\n      scopeType: input.snapshot.scopeType as Parameters<\n        typeof evaluateMemorySlackPublication\n      >[0][\"memory\"][\"scopeType\"],\n      namespace: input.snapshot.namespace,\n      labels: input.snapshot.labels,\n      validFrom: input.snapshot.validFrom,\n      validUntil: input.snapshot.validUntil,\n      supersedesId: input.snapshot.supersedesId,\n      supersededById: input.snapshot.supersededById,\n    },\n    change: {\n      kind: input.changeKind,\n      relatedMemoryId: input.relatedMemoryId,\n      occurredAt: input.occurredAt,\n      origin: input.publication.origin ?? \"native\",\n      ownerLabel: input.publication.ownerLabel ?? null,\n    },\n    distribution: input.publication.distribution,\n  });\n  if (!decision.eligible) return { decision, enqueue: null };\n\n  const enqueue = await enqueueMemorySlackPublication(db, {\n    accountId: input.accountId,\n    workspaceId: input.workspaceId,\n    sourceType: \"workspace_memory\",\n    sourceId: input.snapshot.id,\n    sourceVersion: String(input.snapshot.version),\n    sourceIdempotencyKey: decision.idempotencyKey,\n    projection: decision.projection,\n    importance: decision.projection.importance,\n    deliveryMode: decision.deliveryMode,\n    actor: input.publication.actor,\n  });\n  return { decision, enqueue };\n}\n\nasync function requiredSnapshot(db: Database, workspaceId: string, memoryId: string) {\n  const snapshot = await getWorkspaceMemorySlackPublicationSnapshot(db, workspaceId, memoryId);\n  if (!snapshot) throw new Error(\"Memory Slack publication source disappeared before commit\");\n  return snapshot;\n}\n","import {\n  enqueueMemorySlackPublication,\n  getCurrentMemorySlackPublicationConfiguration,\n  type Database,\n  type EnqueueMemorySlackPublicationResult,\n} from \"@opengeni/db\";\nimport { sanitizeSlackPublicationText } from \"./slack-publication-secret-safety\";\n\n/**\n * Narrow post-persistence port for the immutable durable-learning v1 attempt/receipt contract.\n * The router owns validation, authority, routing, and persistence. This adapter\n * consumes only the fields required to create a bounded notification projection.\n */\nexport type DurableLearningSlackOutcome = {\n  attempt: {\n    id: string;\n    accountId: string;\n    workspaceId: string;\n    inputHash: string;\n    actor: { kind: \"human\" | \"agent\" | \"service\"; subjectId: string };\n    initiatingHumanSubjectId: string | null;\n    sessionId: string | null;\n    request:\n      | {\n          operation: \"write\";\n          subject: {\n            kind: string;\n            summary: string | null;\n          };\n          evidence: Array<{ kind: string }>;\n        }\n      | {\n          operation: \"rollback\";\n          targetAttemptId: string;\n        };\n  };\n  receipt: {\n    attemptId: string;\n    inputHash: string;\n    outcome:\n      | \"applied\"\n      | \"proposed\"\n      | \"evidence_recorded\"\n      | \"noop\"\n      | \"clarification_required\"\n      | \"rejected\"\n      | \"rolled_back\"\n      | \"failed\";\n    decision: {\n      code: string;\n      destination: string | null;\n      scope: { kind: string } | null;\n      authority: string | null;\n    };\n    resource: {\n      surface: string;\n      id: string;\n      version: string | null;\n      status: string;\n    } | null;\n    createdAt: string;\n  };\n};\n\nexport type DurableLearningSlackPublicationResult =\n  | {\n      kind:\n        | \"contract_mismatch\"\n        | \"not_workspace_scoped\"\n        | \"connector_evidence_untrusted\"\n        | \"summary_required\"\n        | \"policy_quiet\";\n      enqueue: null;\n    }\n  | { kind: \"enqueued\"; enqueue: EnqueueMemorySlackPublicationResult };\n\nexport type DurableLearningSlackProjection = {\n  summary: string;\n  outcome: DurableLearningSlackOutcome[\"receipt\"][\"outcome\"];\n  decisionCode: string;\n  destination: string | null;\n  authority: string | null;\n  resource: DurableLearningSlackOutcome[\"receipt\"][\"resource\"];\n  occurredAt: string;\n};\n\nexport async function publishDurableLearningOutcomeToSlack(\n  db: Database,\n  outcome: DurableLearningSlackOutcome,\n): Promise<DurableLearningSlackPublicationResult> {\n  const { attempt, receipt } = outcome;\n  if (attempt.id !== receipt.attemptId || attempt.inputHash !== receipt.inputHash) {\n    return { kind: \"contract_mismatch\", enqueue: null };\n  }\n  if (receipt.decision.scope?.kind !== \"workspace\") {\n    return { kind: \"not_workspace_scoped\", enqueue: null };\n  }\n  if (\n    attempt.request.operation === \"write\" &&\n    attempt.request.evidence.some((evidence) => evidence.kind === \"connector\")\n  ) {\n    // The v1 router contract intentionally does not identify connector providers.\n    // Fail closed rather than risk republishing a Slack-derived learning outcome.\n    return { kind: \"connector_evidence_untrusted\", enqueue: null };\n  }\n\n  const projection = durableLearningSlackProjection(outcome);\n  if (!projection) return { kind: \"summary_required\", enqueue: null };\n  const importance = durableLearningImportance(outcome);\n  const configuration = await getCurrentMemorySlackPublicationConfiguration(\n    db,\n    attempt.workspaceId,\n  );\n  const deliveryMode = configuration?.autoImportances.includes(importance)\n    ? \"auto\"\n    : configuration?.reviewImportances.includes(importance)\n      ? \"review\"\n      : null;\n  if (!configuration?.enabled || !deliveryMode) {\n    return { kind: \"policy_quiet\", enqueue: null };\n  }\n\n  const enqueue = await enqueueMemorySlackPublication(db, {\n    accountId: attempt.accountId,\n    workspaceId: attempt.workspaceId,\n    sourceType: \"durable_learning\",\n    sourceId: receipt.attemptId,\n    sourceVersion: receipt.inputHash,\n    sourceIdempotencyKey: `durable-learning:${receipt.attemptId}`,\n    projection,\n    importance,\n    deliveryMode,\n    actor: {\n      kind: attempt.actor.kind,\n      subjectId: attempt.actor.subjectId,\n      initiatingHumanSubjectId: attempt.initiatingHumanSubjectId,\n      sessionId: attempt.sessionId,\n      attemptId: attempt.id,\n    },\n  });\n  return { kind: \"enqueued\", enqueue };\n}\n\nexport function durableLearningImportance(\n  outcome: DurableLearningSlackOutcome,\n): \"major\" | \"normal\" | \"minor\" {\n  if (outcome.receipt.outcome === \"failed\" || outcome.receipt.outcome === \"rolled_back\") {\n    return \"major\";\n  }\n  if (outcome.receipt.outcome === \"noop\" || outcome.receipt.outcome === \"clarification_required\") {\n    return \"minor\";\n  }\n  if (\n    outcome.attempt.request.operation === \"write\" &&\n    [\"decision\", \"workspace_charter\", \"mandatory_operating_context\", \"workspace_goal\"].includes(\n      outcome.attempt.request.subject.kind,\n    )\n  ) {\n    return \"major\";\n  }\n  return \"normal\";\n}\n\nexport function durableLearningSlackProjection(\n  outcome: DurableLearningSlackOutcome,\n): DurableLearningSlackProjection | null {\n  const summary = durableLearningSummary(outcome);\n  if (!summary) return null;\n  return {\n    summary,\n    outcome: outcome.receipt.outcome,\n    decisionCode: outcome.receipt.decision.code,\n    destination: boundedSlackPublicationText(outcome.receipt.decision.destination, 128),\n    authority: outcome.receipt.decision.authority,\n    resource: outcome.receipt.resource\n      ? {\n          surface: outcome.receipt.resource.surface,\n          id: outcome.receipt.resource.id,\n          version: outcome.receipt.resource.version,\n          status: outcome.receipt.resource.status,\n        }\n      : null,\n    occurredAt: outcome.receipt.createdAt,\n  };\n}\n\nfunction durableLearningSummary(outcome: DurableLearningSlackOutcome): string | null {\n  if (outcome.attempt.request.operation === \"rollback\") {\n    const destination =\n      boundedSlackPublicationText(outcome.receipt.decision.destination, 128) ??\n      \"governed knowledge\";\n    return `Rolled back a durable learning change for ${destination}.`;\n  }\n  const summary = outcome.attempt.request.subject.summary?.replace(/\\s+/g, \" \").trim();\n  return summary ? sanitizeSlackPublicationText(summary).slice(0, 512) : null;\n}\n\nfunction boundedSlackPublicationText(value: string | null, maxChars: number): string | null {\n  if (!value) return null;\n  const sanitized = sanitizeSlackPublicationText(value.replace(/\\s+/g, \" \").trim());\n  return sanitized ? sanitized.slice(0, maxChars) : null;\n}\n","import {\n  CompanyProfileLearningSubjectKind,\n  CompanyProfileLearningWrite,\n  type CompanyProfileMutationResponse,\n} from \"@opengeni/contracts\";\nimport {\n  type CompanyProfileLearningWriteResult,\n  type Database,\n  rollbackCompanyProfileLearning,\n  writeCompanyProfileLearning,\n} from \"@opengeni/db\";\n\nexport type CompanyProfileDurableLearningResource = {\n  surface: \"company_profile\";\n  id: string;\n  version: string | null;\n  status: string;\n};\n\nexport type CompanyProfileDurableLearningWriteResult = {\n  outcome: \"applied\" | \"proposed\";\n  resource: CompanyProfileDurableLearningResource;\n  effectiveBoundary: \"next_accepted_attempt\";\n  rollback: {\n    supported: boolean;\n    targetAttemptId: null;\n    token: string | null;\n  };\n};\n\nexport type CompanyProfileDurableLearningRollbackResult = {\n  resource: CompanyProfileDurableLearningResource;\n  effectiveBoundary: \"next_accepted_attempt\";\n};\n\n/**\n * Structural match for canonical durable-learning router's DurableLearningAuthorityAdapter. The router\n * package owns its complete request/decision types; accepting unknown here\n * keeps this adapter assignable without copying or competing with that router.\n */\nexport type CompanyProfileDurableLearningAuthorityAdapter = {\n  write: (input: unknown) => Promise<CompanyProfileDurableLearningWriteResult>;\n  rollback: (input: unknown) => Promise<CompanyProfileDurableLearningRollbackResult>;\n};\n\nexport type CompanyProfileDurableLearningAdapterOptions = {\n  db: Database;\n  authority?: {\n    write: typeof writeCompanyProfileLearning;\n    rollback: typeof rollbackCompanyProfileLearning;\n  };\n};\n\nfunction record(value: unknown, name: string): Record<string, unknown> {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new Error(`${name} must be an object`);\n  }\n  return value as Record<string, unknown>;\n}\n\nfunction requiredString(value: unknown, name: string): string {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new Error(`${name} must be a non-empty string`);\n  }\n  return value;\n}\n\nfunction nullableString(value: unknown, name: string): string | null {\n  if (value === null) return null;\n  return requiredString(value, name);\n}\n\nfunction actorKind(value: unknown): \"human\" | \"agent\" | \"service\" {\n  if (value === \"human\" || value === \"agent\" || value === \"service\") return value;\n  throw new Error(\"durable-learning attempt actor kind is invalid\");\n}\n\nfunction parseAttempt(value: unknown) {\n  const attempt = record(value, \"durable-learning attempt\");\n  const actor = record(attempt.actor, \"durable-learning actor\");\n  return {\n    id: requiredString(attempt.id, \"durable-learning attempt id\"),\n    accountId: requiredString(attempt.accountId, \"durable-learning account id\"),\n    workspaceId: requiredString(attempt.workspaceId, \"durable-learning workspace id\"),\n    actor: {\n      kind: actorKind(actor.kind),\n      subjectId: requiredString(actor.subjectId, \"durable-learning actor subject\"),\n    },\n  };\n}\n\nfunction parseWriteInput(value: unknown) {\n  const input = record(value, \"company-profile durable-learning write\");\n  const attempt = parseAttempt(input.attempt);\n  const request = record(input.request, \"durable-learning write request\");\n  const decision = record(input.decision, \"durable-learning route decision\");\n  const scope = record(decision.scope, \"durable-learning resolved scope\");\n  const subject = record(request.subject, \"durable-learning subject\");\n  if (\n    request.operation !== \"write\" ||\n    request.attemptId !== attempt.id ||\n    request.targetSurface !== \"company_profile\" ||\n    decision.disposition !== \"route\" ||\n    decision.destination !== \"company_profile\" ||\n    scope.kind !== \"organization\" ||\n    (decision.authority !== \"active\" && decision.authority !== \"proposal\")\n  ) {\n    throw new Error(\n      \"The company-profile adapter accepts only matching routed active or proposal organization company_profile writes\",\n    );\n  }\n  return CompanyProfileLearningWrite.parse({\n    operationId: attempt.id,\n    accountId: attempt.accountId,\n    workspaceId: attempt.workspaceId,\n    actorSubjectId: attempt.actor.subjectId,\n    actorKind: attempt.actor.kind,\n    authority: decision.authority,\n    subject: {\n      kind: CompanyProfileLearningSubjectKind.parse(subject.kind),\n      content: requiredString(subject.content, \"durable-learning subject content\"),\n      stableKey: nullableString(subject.stableKey, \"durable-learning subject stable key\"),\n    },\n    sourceId: `durable-learning-attempt:${attempt.id}`,\n  });\n}\n\nfunction parseRollbackInput(value: unknown) {\n  const input = record(value, \"company-profile durable-learning rollback\");\n  const attempt = parseAttempt(input.attempt);\n  const targetAttempt = parseAttempt(input.targetAttempt);\n  const targetReceipt = record(input.targetReceipt, \"durable-learning target receipt\");\n  const targetResource = record(\n    targetReceipt.resource,\n    \"durable-learning target company-profile resource\",\n  );\n  const receiptRollback = record(\n    targetReceipt.rollback,\n    \"durable-learning target rollback receipt\",\n  );\n  const rollbackToken = requiredString(input.rollbackToken, \"company-profile rollback token\");\n  if (\n    targetReceipt.attemptId !== targetAttempt.id ||\n    targetResource.surface !== \"company_profile\" ||\n    receiptRollback.supported !== true ||\n    receiptRollback.token !== rollbackToken\n  ) {\n    throw new Error(\"The company-profile adapter cannot roll back another authority surface\");\n  }\n  return {\n    attempt,\n    rollbackToken,\n    reason: requiredString(input.reason, \"company-profile rollback reason\"),\n  };\n}\n\nfunction writeResource(\n  result: CompanyProfileLearningWriteResult,\n): CompanyProfileDurableLearningResource {\n  return {\n    surface: \"company_profile\",\n    id: result.revision.id,\n    version: String(result.revision.revision),\n    status: result.outcome === \"applied\" ? \"active\" : \"proposal\",\n  };\n}\n\nfunction rollbackResource(\n  result: CompanyProfileMutationResponse,\n): CompanyProfileDurableLearningResource {\n  if (!result.event) throw new Error(\"Company-profile rollback returned no activation event\");\n  return {\n    surface: \"company_profile\",\n    id: result.head?.revisionId ?? result.event.oldRevision?.id ?? result.event.id,\n    version: String(result.event.activationVersion),\n    status: result.head ? \"active\" : \"inactive\",\n  };\n}\n\n/** Install this under `authorities.company_profile` in the canonical durable-learning router ports. */\nexport function createCompanyProfileDurableLearningAdapter(\n  options: CompanyProfileDurableLearningAdapterOptions,\n): CompanyProfileDurableLearningAuthorityAdapter {\n  const authority = options.authority ?? {\n    write: writeCompanyProfileLearning,\n    rollback: rollbackCompanyProfileLearning,\n  };\n  return {\n    async write(rawInput) {\n      const input = parseWriteInput(rawInput);\n      const result = await authority.write(options.db, input);\n      return {\n        outcome: result.outcome,\n        resource: writeResource(result),\n        effectiveBoundary: result.effectiveBoundary,\n        rollback: {\n          supported: result.rollbackToken !== null,\n          targetAttemptId: null,\n          token: result.rollbackToken,\n        },\n      };\n    },\n\n    async rollback(rawInput) {\n      const input = parseRollbackInput(rawInput);\n      const result = await authority.rollback(options.db, {\n        operationId: input.attempt.id,\n        accountId: input.attempt.accountId,\n        workspaceId: input.attempt.workspaceId,\n        actorSubjectId: input.attempt.actor.subjectId,\n        actorKind: input.attempt.actor.kind,\n        token: input.rollbackToken,\n        reason: input.reason,\n      });\n      return {\n        resource: rollbackResource(result),\n        effectiveBoundary: \"next_accepted_attempt\",\n      };\n    },\n  };\n}\n","import { createHash } from \"node:crypto\";\n\ndeclare const conversationProviderNamespaceBrand: unique symbol;\ndeclare const conversationProviderOpaqueValueBrand: unique symbol;\ndeclare const conversationEventIdentityBrand: unique symbol;\ndeclare const conversationRouteIdentityBrand: unique symbol;\ndeclare const conversationActorIdentityBrand: unique symbol;\ndeclare const conversationOperationIdentityBrand: unique symbol;\ndeclare const conversationRequestDigestBrand: unique symbol;\n\nexport const CONVERSATION_INTEGRATION_SCHEMA_VERSION = 1 as const;\nexport const CONVERSATION_PROVIDER_NAMESPACE_MAX_UTF8_BYTES = 128;\nexport const CONVERSATION_PROVIDER_OPAQUE_ID_MAX_UTF8_BYTES = 512;\nexport const CONVERSATION_TEXT_MAX_UTF8_BYTES = 32 * 1024;\nexport const CONVERSATION_ATTACHMENT_MAX_COUNT = 16;\nexport const CONVERSATION_ATTACHMENT_NAME_MAX_UTF8_BYTES = 1024;\nexport const CONVERSATION_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES = 128;\nexport const CONVERSATION_OPERATION_KEY_MAX_UTF8_BYTES = 512;\nexport const CONVERSATION_OUTCOME_CODE_MAX_UTF8_BYTES = 128;\n\nconst PROVIDER_NAMESPACE_PATTERN = /^[a-z0-9]+(?:[.-][a-z0-9]+)*$/u;\nconst OUTCOME_CODE_PATTERN = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/u;\nconst MEDIA_TYPE_PATTERN = /^[a-z0-9][a-z0-9!#$&^_.+-]*\\/[a-z0-9][a-z0-9!#$&^_.+-]*$/iu;\nconst SHA256_PATTERN = /^[0-9a-f]{64}$/u;\nconst ABSOLUTE_URL_PATTERN = /^[a-z][a-z0-9+.-]*:\\/\\//iu;\nconst textEncoder = new TextEncoder();\n\nexport type ConversationProviderNamespace = string & {\n  readonly [conversationProviderNamespaceBrand]: true;\n};\n\nexport type ConversationProviderOpaqueValue = string & {\n  readonly [conversationProviderOpaqueValueBrand]: true;\n};\n\nexport type ConversationProviderOpaqueIdKind =\n  | \"installation\"\n  | \"actor\"\n  | \"conversation\"\n  | \"thread\"\n  | \"event\"\n  | \"message\"\n  | \"attachment\"\n  | \"receipt\";\n\nexport type ConversationProviderOpaqueId<\n  TKind extends ConversationProviderOpaqueIdKind = ConversationProviderOpaqueIdKind,\n> = Readonly<{\n  provider: ConversationProviderNamespace;\n  kind: TKind;\n  value: ConversationProviderOpaqueValue;\n}>;\n\nexport type ConversationInstallationIdentity = ConversationProviderOpaqueId<\"installation\">;\nexport type ConversationEventIdentity = `ciev1_${string}` & {\n  readonly [conversationEventIdentityBrand]: true;\n};\nexport type ConversationRouteIdentity = `cirt1_${string}` & {\n  readonly [conversationRouteIdentityBrand]: true;\n};\nexport type ConversationActorIdentity = `ciac1_${string}` & {\n  readonly [conversationActorIdentityBrand]: true;\n};\nexport type ConversationOperationIdentity = `ciop1_${string}` & {\n  readonly [conversationOperationIdentityBrand]: true;\n};\nexport type ConversationRequestDigest = `sha256:${string}` & {\n  readonly [conversationRequestDigestBrand]: true;\n};\n\nexport type ConversationActorKind = \"human\" | \"bot\" | \"system\";\n\nexport type ConversationActorInput = Readonly<{\n  providerActorId: string;\n  kind: ConversationActorKind;\n}>;\n\nexport type ConversationActor = Readonly<{\n  installation: ConversationInstallationIdentity;\n  providerActorId: ConversationProviderOpaqueId<\"actor\">;\n  kind: ConversationActorKind;\n  identity: ConversationActorIdentity;\n}>;\n\nexport type ConversationRoute = Readonly<{\n  installation: ConversationInstallationIdentity;\n  providerConversationId: ConversationProviderOpaqueId<\"conversation\">;\n  providerThreadId: ConversationProviderOpaqueId<\"thread\"> | null;\n  identity: ConversationRouteIdentity;\n}>;\n\nexport type ConversationRouteInput = Readonly<{\n  providerConversationId: string;\n  providerThreadId?: string | null;\n}>;\n\nexport type ConversationStartSignal = Readonly<{ kind: \"start\" }>;\nexport type ConversationContinueSignal = Readonly<{ kind: \"continue\" }>;\nexport type ConversationControlSignal = Readonly<{\n  kind: \"control\";\n  control: \"stop\" | \"resume\";\n}>;\nexport type ConversationSignal =\n  | ConversationStartSignal\n  | ConversationContinueSignal\n  | ConversationControlSignal;\n\nexport type ConversationAttachmentReference = Readonly<{\n  providerAttachmentId: ConversationProviderOpaqueId<\"attachment\">;\n  fileName: string | null;\n  mediaType: string | null;\n  byteSize: number | null;\n  contentSha256: string | null;\n}>;\n\nexport type ConversationAttachmentReferenceInput = Readonly<{\n  providerAttachmentId: string;\n  fileName?: string | null;\n  mediaType?: string | null;\n  byteSize?: number | null;\n  contentSha256?: string | null;\n}>;\n\nexport type ConversationInboundEnvelope = Readonly<{\n  schemaVersion: typeof CONVERSATION_INTEGRATION_SCHEMA_VERSION;\n  installation: ConversationInstallationIdentity;\n  actor: ConversationActor;\n  route: ConversationRoute;\n  providerEventId: ConversationProviderOpaqueId<\"event\">;\n  providerMessageId: ConversationProviderOpaqueId<\"message\">;\n  eventIdentity: ConversationEventIdentity;\n  occurredAt: string;\n  signal: ConversationSignal;\n  text: string;\n  attachments: readonly ConversationAttachmentReference[];\n}>;\n\nexport type ConversationInboundEnvelopeInput = Readonly<{\n  provider: string;\n  installationId: string;\n  actor: ConversationActorInput;\n  route: ConversationRouteInput;\n  providerEventId: string;\n  providerMessageId: string;\n  occurredAt: string;\n  signal: ConversationSignal;\n  text: string;\n  attachments?: readonly ConversationAttachmentReferenceInput[];\n}>;\n\ntype ConversationDeliveryCommandBase = Readonly<{\n  schemaVersion: typeof CONVERSATION_INTEGRATION_SCHEMA_VERSION;\n  operationId: ConversationOperationIdentity;\n  logicalOperationKey: string;\n  requestDigest: ConversationRequestDigest;\n  installation: ConversationInstallationIdentity;\n  route: ConversationRoute;\n}>;\n\nexport type ConversationPostCommand = ConversationDeliveryCommandBase &\n  Readonly<{\n    kind: \"post\";\n    targetProviderMessageId: null;\n    text: string;\n  }>;\n\nexport type ConversationUpdateCommand = ConversationDeliveryCommandBase &\n  Readonly<{\n    kind: \"update\";\n    targetProviderMessageId: ConversationProviderOpaqueId<\"message\">;\n    text: string;\n  }>;\n\nexport type ConversationDeleteCommand = ConversationDeliveryCommandBase &\n  Readonly<{\n    kind: \"delete\";\n    targetProviderMessageId: ConversationProviderOpaqueId<\"message\">;\n    text: null;\n  }>;\n\nexport type ConversationDeliveryCommand =\n  | ConversationPostCommand\n  | ConversationUpdateCommand\n  | ConversationDeleteCommand;\n\nexport type ConversationDeliveryCommandInput =\n  | Readonly<{\n      kind: \"post\";\n      logicalOperationKey: string;\n      installation: ConversationInstallationIdentity;\n      route: ConversationRoute;\n      text: string;\n    }>\n  | Readonly<{\n      kind: \"update\";\n      logicalOperationKey: string;\n      installation: ConversationInstallationIdentity;\n      route: ConversationRoute;\n      targetProviderMessageId: string;\n      text: string;\n    }>\n  | Readonly<{\n      kind: \"delete\";\n      logicalOperationKey: string;\n      installation: ConversationInstallationIdentity;\n      route: ConversationRoute;\n      targetProviderMessageId: string;\n    }>;\n\nexport type ConversationProviderReceipt = Readonly<{\n  schemaVersion: typeof CONVERSATION_INTEGRATION_SCHEMA_VERSION;\n  operationId: ConversationOperationIdentity;\n  requestDigest: ConversationRequestDigest;\n  installation: ConversationInstallationIdentity;\n  providerMessageId: ConversationProviderOpaqueId<\"message\">;\n  providerReceiptId: ConversationProviderOpaqueId<\"receipt\"> | null;\n  observedAt: string;\n}>;\n\nexport type ConversationProviderReceiptInput = Readonly<{\n  command: ConversationDeliveryCommand;\n  providerMessageId: string;\n  providerReceiptId?: string | null;\n  observedAt: string;\n}>;\n\nexport type ConversationDeliveryNotStarted = Readonly<{\n  status: \"not_started\";\n  code: string;\n}>;\nexport type ConversationDeliveryUnknown = Readonly<{\n  status: \"unknown\";\n  code: string;\n}>;\nexport type ConversationDeliveryRetryableFailure = Readonly<{\n  status: \"retryable_failure\";\n  code: string;\n  retryAfterMs: number | null;\n}>;\nexport type ConversationDeliveryPermanentFailure = Readonly<{\n  status: \"permanent_failure\";\n  code: string;\n}>;\nexport type ConversationDeliverySuccess = Readonly<{\n  status: \"success\";\n  receipt: ConversationProviderReceipt;\n}>;\n\nexport type ConversationDeliveryOutcome =\n  | ConversationDeliveryNotStarted\n  | ConversationDeliveryUnknown\n  | ConversationDeliveryRetryableFailure\n  | ConversationDeliveryPermanentFailure\n  | ConversationDeliverySuccess;\n\nexport type ConversationDeliveryOutcomeInput =\n  | ConversationDeliveryNotStarted\n  | ConversationDeliveryUnknown\n  | Readonly<{\n      status: \"retryable_failure\";\n      code: string;\n      retryAfterMs?: number | null;\n    }>\n  | ConversationDeliveryPermanentFailure\n  | ConversationDeliverySuccess;\n\nexport type ConversationDeliveryNextAction =\n  | \"retry_same_operation\"\n  | \"reconcile\"\n  | \"stop\"\n  | \"complete\";\n\nexport function normalizeConversationInboundEnvelope(\n  input: ConversationInboundEnvelopeInput,\n): ConversationInboundEnvelope {\n  assertExactObject(input, \"inbound envelope\", [\n    \"provider\",\n    \"installationId\",\n    \"actor\",\n    \"route\",\n    \"providerEventId\",\n    \"providerMessageId\",\n    \"occurredAt\",\n    \"signal\",\n    \"text\",\n    \"attachments\",\n  ]);\n  const provider = normalizeConversationProviderNamespace(input.provider);\n  const installation = normalizeConversationInstallationIdentity({\n    provider,\n    providerInstallationId: input.installationId,\n  });\n  const actor = normalizeConversationActor(installation, input.actor);\n  const route = normalizeConversationRoute(installation, input.route);\n  const providerEventId = providerOpaqueId(provider, \"event\", input.providerEventId);\n  const providerMessageId = providerOpaqueId(provider, \"message\", input.providerMessageId);\n  const occurredAt = canonicalTimestamp(input.occurredAt, \"inbound occurredAt\");\n  const signal = normalizeSignal(input.signal);\n  const text = boundedExactText(input.text, \"inbound text\", true);\n  const rawAttachments = input.attachments ?? [];\n  if (!Array.isArray(rawAttachments)) throw new TypeError(\"inbound attachments must be an array\");\n  if (rawAttachments.length > CONVERSATION_ATTACHMENT_MAX_COUNT) {\n    throw new RangeError(\n      `inbound attachments must contain at most ${CONVERSATION_ATTACHMENT_MAX_COUNT} entries`,\n    );\n  }\n  const attachments = Object.freeze(\n    rawAttachments.map((attachment) => normalizeAttachment(provider, attachment)),\n  );\n  if ((signal.kind === \"start\" || signal.kind === \"continue\") && !text && !attachments.length) {\n    throw new TypeError(\"start and continue signals require text or an attachment reference\");\n  }\n  return Object.freeze({\n    schemaVersion: CONVERSATION_INTEGRATION_SCHEMA_VERSION,\n    installation,\n    actor,\n    route,\n    providerEventId,\n    providerMessageId,\n    eventIdentity: deriveConversationEventIdentity(installation, providerEventId),\n    occurredAt,\n    signal,\n    text,\n    attachments,\n  });\n}\n\nexport function normalizeConversationProviderNamespace(\n  value: string,\n): ConversationProviderNamespace {\n  return providerNamespace(value);\n}\n\nexport function normalizeConversationInstallationIdentity(input: {\n  provider: string | ConversationProviderNamespace;\n  providerInstallationId: string;\n}): ConversationInstallationIdentity {\n  assertExactObject(input, \"installation identity\", [\"provider\", \"providerInstallationId\"]);\n  return providerOpaqueId(\n    providerNamespace(input.provider),\n    \"installation\",\n    input.providerInstallationId,\n  );\n}\n\nexport function normalizeConversationActor(\n  installation: ConversationInstallationIdentity,\n  input: ConversationActorInput,\n): ConversationActor {\n  assertConversationInstallationIdentity(installation);\n  assertExactObject(input, \"inbound actor\", [\"providerActorId\", \"kind\"]);\n  if (input.kind !== \"human\" && input.kind !== \"bot\" && input.kind !== \"system\") {\n    throw new TypeError(\"inbound actor kind is unsupported\");\n  }\n  const providerActorId = providerOpaqueId(installation.provider, \"actor\", input.providerActorId);\n  return Object.freeze({\n    installation,\n    providerActorId,\n    kind: input.kind,\n    identity: deriveConversationActorIdentity(installation, providerActorId),\n  });\n}\n\nexport function normalizeConversationRoute(\n  installation: ConversationInstallationIdentity,\n  input: ConversationRouteInput,\n): ConversationRoute {\n  assertConversationInstallationIdentity(installation);\n  assertExactObject(input, \"inbound route\", [\"providerConversationId\", \"providerThreadId\"]);\n  const providerConversationId = providerOpaqueId(\n    installation.provider,\n    \"conversation\",\n    input.providerConversationId,\n  );\n  const providerThreadId =\n    input.providerThreadId === undefined || input.providerThreadId === null\n      ? null\n      : providerOpaqueId(installation.provider, \"thread\", input.providerThreadId);\n  const identity = deriveConversationRouteIdentity(\n    installation,\n    providerConversationId,\n    providerThreadId,\n  );\n  return Object.freeze({ installation, providerConversationId, providerThreadId, identity });\n}\n\nexport function normalizeConversationDeliveryCommand(\n  input: ConversationDeliveryCommandInput,\n): ConversationDeliveryCommand {\n  const keys =\n    input.kind === \"post\"\n      ? [\"kind\", \"logicalOperationKey\", \"installation\", \"route\", \"text\"]\n      : input.kind === \"update\"\n        ? [\n            \"kind\",\n            \"logicalOperationKey\",\n            \"installation\",\n            \"route\",\n            \"targetProviderMessageId\",\n            \"text\",\n          ]\n        : [\"kind\", \"logicalOperationKey\", \"installation\", \"route\", \"targetProviderMessageId\"];\n  assertExactObject(input, \"delivery command\", keys);\n  if (input.kind !== \"post\" && input.kind !== \"update\" && input.kind !== \"delete\") {\n    throw new TypeError(\"delivery command kind is unsupported\");\n  }\n  assertConversationInstallationIdentity(input.installation);\n  assertConversationRoute(input.route);\n  assertSameInstallation(input.installation, input.route.installation, \"delivery route\");\n  const logicalOperationKey = boundedOpaqueString(\n    input.logicalOperationKey,\n    \"logical operation key\",\n    CONVERSATION_OPERATION_KEY_MAX_UTF8_BYTES,\n  );\n  const operationId = deriveConversationOperationIdentity(input.installation, logicalOperationKey);\n  const targetProviderMessageId =\n    input.kind === \"post\"\n      ? null\n      : providerOpaqueId(input.installation.provider, \"message\", input.targetProviderMessageId);\n  const text =\n    input.kind === \"delete\" ? null : boundedExactText(input.text, \"delivery text\", false);\n  const requestDigest = deliveryRequestDigest({\n    kind: input.kind,\n    installation: input.installation,\n    route: input.route,\n    targetProviderMessageId,\n    text,\n  });\n  return Object.freeze({\n    schemaVersion: CONVERSATION_INTEGRATION_SCHEMA_VERSION,\n    operationId,\n    logicalOperationKey,\n    requestDigest,\n    installation: input.installation,\n    route: input.route,\n    kind: input.kind,\n    targetProviderMessageId,\n    text,\n  }) as ConversationDeliveryCommand;\n}\n\nexport function normalizeConversationProviderReceipt(\n  input: ConversationProviderReceiptInput,\n): ConversationProviderReceipt {\n  assertExactObject(input, \"provider receipt\", [\n    \"command\",\n    \"providerMessageId\",\n    \"providerReceiptId\",\n    \"observedAt\",\n  ]);\n  assertConversationDeliveryCommand(input.command);\n  const providerMessageId = providerOpaqueId(\n    input.command.installation.provider,\n    \"message\",\n    input.providerMessageId,\n  );\n  if (\n    input.command.targetProviderMessageId &&\n    providerMessageId.value !== input.command.targetProviderMessageId.value\n  ) {\n    throw new TypeError(\"provider receipt message does not match the mutation target\");\n  }\n  const providerReceiptId =\n    input.providerReceiptId === undefined || input.providerReceiptId === null\n      ? null\n      : providerOpaqueId(input.command.installation.provider, \"receipt\", input.providerReceiptId);\n  return Object.freeze({\n    schemaVersion: CONVERSATION_INTEGRATION_SCHEMA_VERSION,\n    operationId: input.command.operationId,\n    requestDigest: input.command.requestDigest,\n    installation: input.command.installation,\n    providerMessageId,\n    providerReceiptId,\n    observedAt: canonicalTimestamp(input.observedAt, \"provider receipt observedAt\"),\n  });\n}\n\nexport function normalizeConversationDeliveryOutcome(\n  input: ConversationDeliveryOutcomeInput,\n): ConversationDeliveryOutcome {\n  if (input.status === \"success\") {\n    assertExactObject(input, \"delivery success\", [\"status\", \"receipt\"]);\n    assertConversationProviderReceipt(input.receipt);\n    return Object.freeze({ status: \"success\", receipt: input.receipt });\n  }\n  if (input.status === \"retryable_failure\") {\n    assertExactObject(input, \"retryable delivery failure\", [\"status\", \"code\", \"retryAfterMs\"]);\n    const retryAfterMs = input.retryAfterMs ?? null;\n    if (retryAfterMs !== null && (!Number.isSafeInteger(retryAfterMs) || retryAfterMs < 0)) {\n      throw new RangeError(\"retryAfterMs must be a non-negative safe integer or null\");\n    }\n    return Object.freeze({\n      status: \"retryable_failure\",\n      code: outcomeCode(input.code),\n      retryAfterMs,\n    });\n  }\n  if (\n    input.status !== \"not_started\" &&\n    input.status !== \"unknown\" &&\n    input.status !== \"permanent_failure\"\n  ) {\n    throw new TypeError(\"delivery outcome status is unsupported\");\n  }\n  assertExactObject(input, \"delivery outcome\", [\"status\", \"code\"]);\n  return Object.freeze({ status: input.status, code: outcomeCode(input.code) });\n}\n\nexport function conversationDeliveryNextAction(\n  outcome: ConversationDeliveryOutcome,\n): ConversationDeliveryNextAction {\n  assertConversationDeliveryOutcome(outcome);\n  if (outcome.status === \"unknown\") return \"reconcile\";\n  if (outcome.status === \"not_started\" || outcome.status === \"retryable_failure\") {\n    return \"retry_same_operation\";\n  }\n  return outcome.status === \"success\" ? \"complete\" : \"stop\";\n}\n\nexport function assertConversationDeliveryMayRetry(\n  outcome: ConversationDeliveryOutcome,\n): asserts outcome is ConversationDeliveryNotStarted | ConversationDeliveryRetryableFailure {\n  const action = conversationDeliveryNextAction(outcome);\n  if (action === \"retry_same_operation\") return;\n  if (action === \"reconcile\") {\n    throw new Error(\"unknown delivery outcome must be reconciled before retry\");\n  }\n  throw new Error(`delivery outcome ${outcome.status} may not be retried`);\n}\n\nexport function assertConversationDeliveryCommandMatches(\n  expected: ConversationDeliveryCommand,\n  candidate: ConversationDeliveryCommand,\n): void {\n  assertConversationDeliveryCommand(expected);\n  assertConversationDeliveryCommand(candidate);\n  if (expected.operationId !== candidate.operationId) {\n    throw new Error(\"delivery operation identity does not match\");\n  }\n  if (expected.requestDigest !== candidate.requestDigest) {\n    throw new Error(\"delivery operation identity was reused for different request content\");\n  }\n}\n\nexport function assertConversationInboundEnvelope(\n  value: unknown,\n): asserts value is ConversationInboundEnvelope {\n  assertExactObject(value, \"normalized inbound envelope\", [\n    \"schemaVersion\",\n    \"installation\",\n    \"actor\",\n    \"route\",\n    \"providerEventId\",\n    \"providerMessageId\",\n    \"eventIdentity\",\n    \"occurredAt\",\n    \"signal\",\n    \"text\",\n    \"attachments\",\n  ]);\n  if (value.schemaVersion !== CONVERSATION_INTEGRATION_SCHEMA_VERSION) {\n    throw new TypeError(\"inbound envelope schema version is unsupported\");\n  }\n  assertConversationInstallationIdentity(value.installation);\n  assertConversationActor(value.actor);\n  assertConversationRoute(value.route);\n  assertProviderOpaqueId(value.providerEventId, \"event\");\n  assertProviderOpaqueId(value.providerMessageId, \"message\");\n  assertSameInstallation(value.installation, value.actor.installation, \"inbound actor\");\n  assertSameInstallation(value.installation, value.route.installation, \"inbound route\");\n  assertSameProvider(value.installation.provider, value.providerEventId.provider, \"event id\");\n  assertSameProvider(value.installation.provider, value.providerMessageId.provider, \"message id\");\n  const expectedEventIdentity = deriveConversationEventIdentity(\n    value.installation,\n    value.providerEventId,\n  );\n  if (value.eventIdentity !== expectedEventIdentity) {\n    throw new TypeError(\"inbound event identity is not canonical\");\n  }\n  canonicalTimestamp(value.occurredAt, \"inbound occurredAt\");\n  const signal = normalizeSignal(value.signal);\n  const text = boundedExactText(value.text, \"inbound text\", true);\n  if (!Array.isArray(value.attachments))\n    throw new TypeError(\"inbound attachments must be an array\");\n  if (value.attachments.length > CONVERSATION_ATTACHMENT_MAX_COUNT) {\n    throw new RangeError(\"inbound attachment count exceeds the contract bound\");\n  }\n  for (const attachment of value.attachments) {\n    assertConversationAttachmentReference(attachment);\n    assertSameProvider(\n      value.installation.provider,\n      attachment.providerAttachmentId.provider,\n      \"attachment id\",\n    );\n  }\n  if (\n    (signal.kind === \"start\" || signal.kind === \"continue\") &&\n    !text &&\n    !value.attachments.length\n  ) {\n    throw new TypeError(\"start and continue signals require text or an attachment reference\");\n  }\n}\n\nexport function assertConversationDeliveryCommand(\n  value: unknown,\n): asserts value is ConversationDeliveryCommand {\n  assertExactObject(value, \"normalized delivery command\", [\n    \"schemaVersion\",\n    \"operationId\",\n    \"logicalOperationKey\",\n    \"requestDigest\",\n    \"installation\",\n    \"route\",\n    \"kind\",\n    \"targetProviderMessageId\",\n    \"text\",\n  ]);\n  if (value.schemaVersion !== CONVERSATION_INTEGRATION_SCHEMA_VERSION) {\n    throw new TypeError(\"delivery command schema version is unsupported\");\n  }\n  if (value.kind !== \"post\" && value.kind !== \"update\" && value.kind !== \"delete\") {\n    throw new TypeError(\"delivery command kind is unsupported\");\n  }\n  assertConversationInstallationIdentity(value.installation);\n  assertConversationRoute(value.route);\n  assertSameInstallation(value.installation, value.route.installation, \"delivery route\");\n  const logicalOperationKey = boundedOpaqueString(\n    value.logicalOperationKey,\n    \"logical operation key\",\n    CONVERSATION_OPERATION_KEY_MAX_UTF8_BYTES,\n  );\n  if (\n    value.operationId !==\n    deriveConversationOperationIdentity(value.installation, logicalOperationKey)\n  ) {\n    throw new TypeError(\"delivery operation identity is not canonical\");\n  }\n  let target: ConversationProviderOpaqueId<\"message\"> | null;\n  let text: string | null;\n  if (value.kind === \"post\") {\n    if (value.targetProviderMessageId !== null) {\n      throw new TypeError(\"post command cannot carry a target message\");\n    }\n    target = null;\n    text = boundedExactText(value.text, \"delivery text\", false);\n  } else {\n    assertProviderOpaqueId(value.targetProviderMessageId, \"message\");\n    target = value.targetProviderMessageId;\n    assertSameProvider(value.installation.provider, target.provider, \"delivery target\");\n    if (value.kind === \"delete\") {\n      if (value.text !== null) throw new TypeError(\"delete command cannot carry text\");\n      text = null;\n    } else {\n      text = boundedExactText(value.text, \"delivery text\", false);\n    }\n  }\n  const expectedDigest = deliveryRequestDigest({\n    kind: value.kind,\n    installation: value.installation,\n    route: value.route,\n    targetProviderMessageId: target,\n    text,\n  });\n  if (value.requestDigest !== expectedDigest) {\n    throw new TypeError(\"delivery request digest is not canonical\");\n  }\n}\n\nexport function assertConversationProviderReceipt(\n  value: unknown,\n): asserts value is ConversationProviderReceipt {\n  assertExactObject(value, \"normalized provider receipt\", [\n    \"schemaVersion\",\n    \"operationId\",\n    \"requestDigest\",\n    \"installation\",\n    \"providerMessageId\",\n    \"providerReceiptId\",\n    \"observedAt\",\n  ]);\n  if (value.schemaVersion !== CONVERSATION_INTEGRATION_SCHEMA_VERSION) {\n    throw new TypeError(\"provider receipt schema version is unsupported\");\n  }\n  assertIdentity(value.operationId, /^ciop1_[0-9a-f]{64}$/u, \"provider receipt operation id\");\n  assertIdentity(value.requestDigest, /^sha256:[0-9a-f]{64}$/u, \"provider receipt request digest\");\n  assertConversationInstallationIdentity(value.installation);\n  assertProviderOpaqueId(value.providerMessageId, \"message\");\n  assertSameProvider(\n    value.installation.provider,\n    value.providerMessageId.provider,\n    \"receipt message\",\n  );\n  if (value.providerReceiptId !== null) {\n    assertProviderOpaqueId(value.providerReceiptId, \"receipt\");\n    assertSameProvider(\n      value.installation.provider,\n      value.providerReceiptId.provider,\n      \"provider receipt id\",\n    );\n  }\n  canonicalTimestamp(value.observedAt, \"provider receipt observedAt\");\n}\n\nexport function assertConversationDeliveryOutcome(\n  value: unknown,\n): asserts value is ConversationDeliveryOutcome {\n  normalizeConversationDeliveryOutcome(value as ConversationDeliveryOutcomeInput);\n}\n\nexport function canonicalConversationInboundEnvelopeJson(\n  envelope: ConversationInboundEnvelope,\n): string {\n  assertConversationInboundEnvelope(envelope);\n  return JSON.stringify({\n    schemaVersion: envelope.schemaVersion,\n    installation: providerIdWire(envelope.installation),\n    actor: actorWire(envelope.actor),\n    route: routeWire(envelope.route),\n    providerEventId: providerIdWire(envelope.providerEventId),\n    providerMessageId: providerIdWire(envelope.providerMessageId),\n    eventIdentity: envelope.eventIdentity,\n    occurredAt: envelope.occurredAt,\n    signal: signalWire(envelope.signal),\n    text: envelope.text,\n    attachments: envelope.attachments.map(attachmentWire),\n  });\n}\n\nexport function canonicalConversationDeliveryCommandJson(\n  command: ConversationDeliveryCommand,\n): string {\n  assertConversationDeliveryCommand(command);\n  return JSON.stringify(deliveryCommandWire(command));\n}\n\nexport function canonicalConversationProviderReceiptJson(\n  receipt: ConversationProviderReceipt,\n): string {\n  assertConversationProviderReceipt(receipt);\n  return JSON.stringify(providerReceiptWire(receipt));\n}\n\nexport function canonicalConversationDeliveryOutcomeJson(\n  outcome: ConversationDeliveryOutcome,\n): string {\n  assertConversationDeliveryOutcome(outcome);\n  if (outcome.status === \"success\") {\n    return JSON.stringify({ status: \"success\", receipt: providerReceiptWire(outcome.receipt) });\n  }\n  if (outcome.status === \"retryable_failure\") {\n    return JSON.stringify({\n      status: outcome.status,\n      code: outcome.code,\n      retryAfterMs: outcome.retryAfterMs,\n    });\n  }\n  return JSON.stringify({ status: outcome.status, code: outcome.code });\n}\n\nfunction normalizeSignal(input: unknown): ConversationSignal {\n  assertExactObject(input, \"conversation signal\", [\"kind\", \"control\"]);\n  if (input.kind === \"start\" || input.kind === \"continue\") {\n    assertExactObject(input, \"conversation signal\", [\"kind\"]);\n    return Object.freeze({ kind: input.kind });\n  }\n  if (input.kind === \"control\") {\n    assertExactObject(input, \"conversation control signal\", [\"kind\", \"control\"]);\n    if (input.control !== \"stop\" && input.control !== \"resume\") {\n      throw new TypeError(\"conversation control signal is unsupported\");\n    }\n    return Object.freeze({ kind: \"control\", control: input.control });\n  }\n  throw new TypeError(\"conversation signal is unsupported\");\n}\n\nfunction normalizeAttachment(\n  provider: ConversationProviderNamespace,\n  input: ConversationAttachmentReferenceInput,\n): ConversationAttachmentReference {\n  assertExactObject(input, \"attachment reference\", [\n    \"providerAttachmentId\",\n    \"fileName\",\n    \"mediaType\",\n    \"byteSize\",\n    \"contentSha256\",\n  ]);\n  if (\n    ABSOLUTE_URL_PATTERN.test(input.providerAttachmentId) ||\n    input.providerAttachmentId.startsWith(\"//\")\n  ) {\n    throw new TypeError(\"attachment references cannot contain provider URLs\");\n  }\n  const providerAttachmentId = providerOpaqueId(provider, \"attachment\", input.providerAttachmentId);\n  const fileName = nullableBoundedString(\n    input.fileName,\n    \"attachment fileName\",\n    CONVERSATION_ATTACHMENT_NAME_MAX_UTF8_BYTES,\n  );\n  if (fileName?.includes(\"/\") || fileName?.includes(\"\\\\\")) {\n    throw new TypeError(\"attachment fileName must not contain a path\");\n  }\n  const mediaType = nullableBoundedString(\n    input.mediaType,\n    \"attachment mediaType\",\n    CONVERSATION_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES,\n  );\n  if (mediaType !== null && !MEDIA_TYPE_PATTERN.test(mediaType)) {\n    throw new TypeError(\"attachment mediaType is invalid\");\n  }\n  const byteSize = input.byteSize ?? null;\n  if (byteSize !== null && (!Number.isSafeInteger(byteSize) || byteSize < 0)) {\n    throw new RangeError(\"attachment byteSize must be a non-negative safe integer or null\");\n  }\n  const contentSha256 = input.contentSha256 ?? null;\n  if (contentSha256 !== null && !SHA256_PATTERN.test(contentSha256)) {\n    throw new TypeError(\"attachment contentSha256 must be 64 lowercase hexadecimal characters\");\n  }\n  return Object.freeze({\n    providerAttachmentId,\n    fileName,\n    mediaType,\n    byteSize,\n    contentSha256,\n  });\n}\n\nfunction providerNamespace(value: string): ConversationProviderNamespace {\n  const bounded = boundedOpaqueString(\n    value,\n    \"provider namespace\",\n    CONVERSATION_PROVIDER_NAMESPACE_MAX_UTF8_BYTES,\n  );\n  if (!PROVIDER_NAMESPACE_PATTERN.test(bounded)) {\n    throw new TypeError(\"provider namespace must be canonical lowercase segments\");\n  }\n  return bounded as ConversationProviderNamespace;\n}\n\nfunction providerOpaqueId<TKind extends ConversationProviderOpaqueIdKind>(\n  provider: ConversationProviderNamespace,\n  kind: TKind,\n  value: string,\n): ConversationProviderOpaqueId<TKind> {\n  return Object.freeze({\n    provider,\n    kind,\n    value: boundedOpaqueString(\n      value,\n      `provider ${kind} id`,\n      CONVERSATION_PROVIDER_OPAQUE_ID_MAX_UTF8_BYTES,\n    ) as ConversationProviderOpaqueValue,\n  });\n}\n\nfunction deriveConversationEventIdentity(\n  installation: ConversationInstallationIdentity,\n  providerEventId: ConversationProviderOpaqueId<\"event\">,\n): ConversationEventIdentity {\n  return `ciev1_${hashParts(\"opengeni:conversation-event:v1\", [\n    installation.provider,\n    installation.value,\n    providerEventId.value,\n  ])}` as ConversationEventIdentity;\n}\n\nfunction deriveConversationRouteIdentity(\n  installation: ConversationInstallationIdentity,\n  conversationId: ConversationProviderOpaqueId<\"conversation\">,\n  threadId: ConversationProviderOpaqueId<\"thread\"> | null,\n): ConversationRouteIdentity {\n  return `cirt1_${hashParts(\"opengeni:conversation-route:v1\", [\n    installation.provider,\n    installation.value,\n    conversationId.value,\n    threadId?.value ?? null,\n  ])}` as ConversationRouteIdentity;\n}\n\nfunction deriveConversationActorIdentity(\n  installation: ConversationInstallationIdentity,\n  actorId: ConversationProviderOpaqueId<\"actor\">,\n): ConversationActorIdentity {\n  return `ciac1_${hashParts(\"opengeni:conversation-actor:v1\", [\n    installation.provider,\n    installation.value,\n    actorId.value,\n  ])}` as ConversationActorIdentity;\n}\n\nfunction deriveConversationOperationIdentity(\n  installation: ConversationInstallationIdentity,\n  logicalOperationKey: string,\n): ConversationOperationIdentity {\n  return `ciop1_${hashParts(\"opengeni:conversation-operation:v1\", [\n    installation.provider,\n    installation.value,\n    logicalOperationKey,\n  ])}` as ConversationOperationIdentity;\n}\n\nfunction deliveryRequestDigest(input: {\n  kind: ConversationDeliveryCommand[\"kind\"];\n  installation: ConversationInstallationIdentity;\n  route: ConversationRoute;\n  targetProviderMessageId: ConversationProviderOpaqueId<\"message\"> | null;\n  text: string | null;\n}): ConversationRequestDigest {\n  return `sha256:${createHash(\"sha256\")\n    .update(\"opengeni:conversation-delivery-request:v1\\0\", \"utf8\")\n    .update(\n      JSON.stringify({\n        kind: input.kind,\n        installation: providerIdWire(input.installation),\n        route: routeWire(input.route),\n        targetProviderMessageId: input.targetProviderMessageId\n          ? providerIdWire(input.targetProviderMessageId)\n          : null,\n        text: input.text,\n      }),\n      \"utf8\",\n    )\n    .digest(\"hex\")}` as ConversationRequestDigest;\n}\n\nfunction hashParts(domain: string, parts: readonly (string | null)[]): string {\n  const hash = createHash(\"sha256\");\n  hash.update(domain, \"utf8\").update(\"\\0\", \"utf8\");\n  for (const part of parts) {\n    if (part === null) {\n      hash.update(\"n:\", \"utf8\");\n      continue;\n    }\n    const bytes = textEncoder.encode(part);\n    hash.update(`s:${bytes.byteLength}:`, \"utf8\").update(bytes);\n  }\n  return hash.digest(\"hex\");\n}\n\nfunction assertConversationInstallationIdentity(\n  value: unknown,\n): asserts value is ConversationInstallationIdentity {\n  assertProviderOpaqueId(value, \"installation\");\n}\n\nfunction assertConversationActor(value: unknown): asserts value is ConversationActor {\n  assertExactObject(value, \"normalized conversation actor\", [\n    \"installation\",\n    \"providerActorId\",\n    \"kind\",\n    \"identity\",\n  ]);\n  assertConversationInstallationIdentity(value.installation);\n  assertProviderOpaqueId(value.providerActorId, \"actor\");\n  if (value.kind !== \"human\" && value.kind !== \"bot\" && value.kind !== \"system\") {\n    throw new TypeError(\"conversation actor kind is unsupported\");\n  }\n  assertSameProvider(value.installation.provider, value.providerActorId.provider, \"actor id\");\n  if (\n    value.identity !== deriveConversationActorIdentity(value.installation, value.providerActorId)\n  ) {\n    throw new TypeError(\"conversation actor identity is not canonical\");\n  }\n}\n\nfunction assertConversationRoute(value: unknown): asserts value is ConversationRoute {\n  assertExactObject(value, \"normalized conversation route\", [\n    \"installation\",\n    \"providerConversationId\",\n    \"providerThreadId\",\n    \"identity\",\n  ]);\n  assertConversationInstallationIdentity(value.installation);\n  assertProviderOpaqueId(value.providerConversationId, \"conversation\");\n  if (value.providerThreadId !== null) assertProviderOpaqueId(value.providerThreadId, \"thread\");\n  assertSameProvider(\n    value.installation.provider,\n    value.providerConversationId.provider,\n    \"conversation id\",\n  );\n  if (value.providerThreadId) {\n    assertSameProvider(value.installation.provider, value.providerThreadId.provider, \"thread id\");\n  }\n  if (\n    value.identity !==\n    deriveConversationRouteIdentity(\n      value.installation,\n      value.providerConversationId,\n      value.providerThreadId,\n    )\n  ) {\n    throw new TypeError(\"conversation route identity is not canonical\");\n  }\n}\n\nfunction assertConversationAttachmentReference(\n  value: unknown,\n): asserts value is ConversationAttachmentReference {\n  assertExactObject(value, \"normalized attachment reference\", [\n    \"providerAttachmentId\",\n    \"fileName\",\n    \"mediaType\",\n    \"byteSize\",\n    \"contentSha256\",\n  ]);\n  assertProviderOpaqueId(value.providerAttachmentId, \"attachment\");\n  if (\n    ABSOLUTE_URL_PATTERN.test(value.providerAttachmentId.value) ||\n    value.providerAttachmentId.value.startsWith(\"//\")\n  ) {\n    throw new TypeError(\"attachment references cannot contain provider URLs\");\n  }\n  const fileName = nullableBoundedString(\n    value.fileName,\n    \"attachment fileName\",\n    CONVERSATION_ATTACHMENT_NAME_MAX_UTF8_BYTES,\n  );\n  if (fileName?.includes(\"/\") || fileName?.includes(\"\\\\\")) {\n    throw new TypeError(\"attachment fileName must not contain a path\");\n  }\n  const mediaType = nullableBoundedString(\n    value.mediaType,\n    \"attachment mediaType\",\n    CONVERSATION_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES,\n  );\n  if (mediaType !== null && !MEDIA_TYPE_PATTERN.test(mediaType)) {\n    throw new TypeError(\"attachment mediaType is invalid\");\n  }\n  const byteSize = value.byteSize;\n  if (byteSize !== null) {\n    if (typeof byteSize !== \"number\" || !Number.isSafeInteger(byteSize) || byteSize < 0) {\n      throw new RangeError(\"attachment byteSize must be a non-negative safe integer or null\");\n    }\n  }\n  const contentSha256 = value.contentSha256;\n  if (contentSha256 !== null) {\n    if (typeof contentSha256 !== \"string\" || !SHA256_PATTERN.test(contentSha256)) {\n      throw new TypeError(\"attachment contentSha256 must be 64 lowercase hexadecimal characters\");\n    }\n  }\n}\n\nfunction assertProviderOpaqueId<TKind extends ConversationProviderOpaqueIdKind>(\n  value: unknown,\n  kind: TKind,\n): asserts value is ConversationProviderOpaqueId<TKind> {\n  assertExactObject(value, `provider ${kind} id`, [\"provider\", \"kind\", \"value\"]);\n  providerNamespace(value.provider as string);\n  if (value.kind !== kind) throw new TypeError(`provider id must have kind ${kind}`);\n  boundedOpaqueString(\n    value.value,\n    `provider ${kind} id`,\n    CONVERSATION_PROVIDER_OPAQUE_ID_MAX_UTF8_BYTES,\n  );\n}\n\nfunction assertSameProvider(\n  expected: ConversationProviderNamespace,\n  actual: ConversationProviderNamespace,\n  label: string,\n): void {\n  if (expected !== actual) throw new TypeError(`${label} provider namespace does not match`);\n}\n\nfunction assertSameInstallation(\n  expected: ConversationInstallationIdentity,\n  actual: ConversationInstallationIdentity,\n  label: string,\n): void {\n  if (expected.provider !== actual.provider || expected.value !== actual.value) {\n    throw new TypeError(`${label} installation identity does not match`);\n  }\n}\n\nfunction boundedExactText(value: unknown, label: string, allowEmpty: boolean): string {\n  return boundedString(value, label, allowEmpty ? 0 : 1, CONVERSATION_TEXT_MAX_UTF8_BYTES, true);\n}\n\nfunction boundedOpaqueString(value: unknown, label: string, maxBytes: number): string {\n  const result = boundedString(value, label, 1, maxBytes, false);\n  if (result !== result.trim())\n    throw new TypeError(`${label} must not have surrounding whitespace`);\n  return result;\n}\n\nfunction nullableBoundedString(value: unknown, label: string, maxBytes: number): string | null {\n  if (value === undefined || value === null) return null;\n  return boundedString(value, label, 1, maxBytes, false);\n}\n\nfunction boundedString(\n  value: unknown,\n  label: string,\n  minBytes: number,\n  maxBytes: number,\n  allowNewlines: boolean,\n): string {\n  if (typeof value !== \"string\") throw new TypeError(`${label} must be a string`);\n  if (!isWellFormedUnicode(value)) throw new TypeError(`${label} must be well-formed Unicode`);\n  if (value.includes(\"\\0\")) throw new TypeError(`${label} must not contain NUL`);\n  if (!allowNewlines && /[\\u0001-\\u001f\\u007f]/u.test(value)) {\n    throw new TypeError(`${label} must not contain control characters`);\n  }\n  const byteLength = textEncoder.encode(value).byteLength;\n  if (byteLength < minBytes || byteLength > maxBytes) {\n    throw new RangeError(`${label} must contain ${minBytes}-${maxBytes} UTF-8 bytes`);\n  }\n  return value;\n}\n\nfunction isWellFormedUnicode(value: string): boolean {\n  for (let index = 0; index < value.length; index += 1) {\n    const code = value.charCodeAt(index);\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1);\n      if (!(next >= 0xdc00 && next <= 0xdfff)) return false;\n      index += 1;\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      return false;\n    }\n  }\n  return true;\n}\n\nfunction canonicalTimestamp(value: unknown, label: string): string {\n  const timestamp = boundedString(value, label, 20, 32, false);\n  const milliseconds = Date.parse(timestamp);\n  if (!Number.isFinite(milliseconds) || new Date(milliseconds).toISOString() !== timestamp) {\n    throw new TypeError(`${label} must be a canonical UTC timestamp`);\n  }\n  return timestamp;\n}\n\nfunction outcomeCode(value: unknown): string {\n  const code = boundedOpaqueString(\n    value,\n    \"delivery outcome code\",\n    CONVERSATION_OUTCOME_CODE_MAX_UTF8_BYTES,\n  );\n  if (!OUTCOME_CODE_PATTERN.test(code)) {\n    throw new TypeError(\"delivery outcome code must use canonical lowercase segments\");\n  }\n  return code;\n}\n\nfunction assertExactObject(\n  value: unknown,\n  label: string,\n  allowedKeys: readonly string[],\n): asserts value is Record<string, unknown> {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new TypeError(`${label} must be an object`);\n  }\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype !== Object.prototype && prototype !== null) {\n    throw new TypeError(`${label} must be a plain object`);\n  }\n  const allowed = new Set(allowedKeys);\n  for (const key of Reflect.ownKeys(value)) {\n    if (typeof key !== \"string\" || !allowed.has(key)) {\n      throw new TypeError(`${label} contains an unsupported field`);\n    }\n  }\n}\n\nfunction assertIdentity(value: unknown, pattern: RegExp, label: string): asserts value is string {\n  if (typeof value !== \"string\" || !pattern.test(value)) {\n    throw new TypeError(`${label} is invalid`);\n  }\n}\n\nfunction providerIdWire<TKind extends ConversationProviderOpaqueIdKind>(\n  id: ConversationProviderOpaqueId<TKind>,\n): { provider: string; kind: TKind; value: string } {\n  return { provider: id.provider, kind: id.kind, value: id.value };\n}\n\nfunction actorWire(actor: ConversationActor) {\n  return {\n    installation: providerIdWire(actor.installation),\n    providerActorId: providerIdWire(actor.providerActorId),\n    kind: actor.kind,\n    identity: actor.identity,\n  };\n}\n\nfunction routeWire(route: ConversationRoute) {\n  return {\n    installation: providerIdWire(route.installation),\n    providerConversationId: providerIdWire(route.providerConversationId),\n    providerThreadId: route.providerThreadId ? providerIdWire(route.providerThreadId) : null,\n    identity: route.identity,\n  };\n}\n\nfunction signalWire(signal: ConversationSignal) {\n  return signal.kind === \"control\"\n    ? { kind: \"control\" as const, control: signal.control }\n    : { kind: signal.kind };\n}\n\nfunction attachmentWire(attachment: ConversationAttachmentReference) {\n  return {\n    providerAttachmentId: providerIdWire(attachment.providerAttachmentId),\n    fileName: attachment.fileName,\n    mediaType: attachment.mediaType,\n    byteSize: attachment.byteSize,\n    contentSha256: attachment.contentSha256,\n  };\n}\n\nfunction deliveryCommandWire(command: ConversationDeliveryCommand) {\n  return {\n    schemaVersion: command.schemaVersion,\n    operationId: command.operationId,\n    logicalOperationKey: command.logicalOperationKey,\n    requestDigest: command.requestDigest,\n    installation: providerIdWire(command.installation),\n    route: routeWire(command.route),\n    kind: command.kind,\n    targetProviderMessageId: command.targetProviderMessageId\n      ? providerIdWire(command.targetProviderMessageId)\n      : null,\n    text: command.text,\n  };\n}\n\nfunction providerReceiptWire(receipt: ConversationProviderReceipt) {\n  return {\n    schemaVersion: receipt.schemaVersion,\n    operationId: receipt.operationId,\n    requestDigest: receipt.requestDigest,\n    installation: providerIdWire(receipt.installation),\n    providerMessageId: providerIdWire(receipt.providerMessageId),\n    providerReceiptId: receipt.providerReceiptId ? providerIdWire(receipt.providerReceiptId) : null,\n    observedAt: receipt.observedAt,\n  };\n}\n","// Pure, HTTP-shaped guard helpers for the workspace member + workspace delete\n// routes. Kept out of the route bodies so the don't-orphan rules (never remove\n// the last admin, never delete an account's last workspace or one with a live\n// session) are unit-testable without a database.\nimport type { Permission, WorkspaceMember } from \"@opengeni/contracts\";\nimport { HTTPException } from \"hono/http-exception\";\n\n/** The membership permission that grants member-management (admin is the wildcard). */\nconst MEMBER_ADMIN_PERMISSIONS: Permission[] = [\"workspace:admin\", \"members:manage\"];\n\n/** A member can manage other members (directly or via the admin wildcard). */\nexport function memberCanAdminister(member: Pick<WorkspaceMember, \"permissions\">): boolean {\n  return member.permissions.some((permission) => MEMBER_ADMIN_PERMISSIONS.includes(permission));\n}\n\n/** Only `user:` subjects are people; `api_key:` subjects belong to API keys. */\nexport function isUserMember(member: Pick<WorkspaceMember, \"subjectId\">): boolean {\n  return member.subjectId.startsWith(\"user:\");\n}\n\n/**\n * Turn an email lookup result into the membership subject id. A null id means\n * no registered user matched the email — email invites for not-yet-registered\n * users are deferred, so that is a 404 (not a 400) at the API surface.\n */\nexport function resolveMemberSubjectId(userId: string | null): string {\n  if (!userId) {\n    throw new HTTPException(404, { message: \"user is not registered\" });\n  }\n  return `user:${userId}`;\n}\n\n/**\n * Guard the member-remove path. Refuses (409) to remove the caller's own\n * membership and refuses to remove the last member that still holds an admin\n * permission, so a workspace can never be orphaned with no one able to manage\n * it. `members` is the full roster (every subject, including api_key ones —\n * an api_key with workspace:admin still counts as an administering subject).\n */\nexport function assertWorkspaceMemberRemovable(input: {\n  members: WorkspaceMember[];\n  subjectId: string;\n  callerSubjectId: string;\n}): void {\n  const { members, subjectId, callerSubjectId } = input;\n  if (subjectId === callerSubjectId) {\n    throw new HTTPException(409, { message: \"you cannot remove your own membership\" });\n  }\n  const target = members.find((member) => member.subjectId === subjectId);\n  if (!target) {\n    throw new HTTPException(404, { message: \"member not found\" });\n  }\n  if (memberCanAdminister(target)) {\n    const remainingAdmins = members.filter(\n      (member) => member.subjectId !== subjectId && memberCanAdminister(member),\n    );\n    if (remainingAdmins.length === 0) {\n      throw new HTTPException(409, {\n        message: \"cannot remove the last member who can manage this workspace\",\n      });\n    }\n  }\n}\n\n/**\n * Guard the workspace-delete path before any external/DB mutation. Refuses\n * (409) to delete the account's last workspace, and refuses while any session\n * could still be running in Temporal (there is no clean per-session terminate\n * to call first, so we will not orphan a workflow — the operator must stop the\n * sessions first).\n */\nexport function assertWorkspaceDeletable(input: {\n  workspaceCountForAccount: number;\n  activeSessionCount: number;\n}): void {\n  if (input.workspaceCountForAccount <= 1) {\n    throw new HTTPException(409, { message: \"cannot delete the account's only workspace\" });\n  }\n  if (input.activeSessionCount > 0) {\n    throw new HTTPException(409, {\n      message: \"stop the workspace's running sessions before deleting it\",\n    });\n  }\n}\n","import {\n  GenerateVideoToolInput,\n  VideoGenerationAspectRatio,\n  VideoGenerationResolution,\n  VideoGenerationSourceMode,\n  type GenerateVideoToolInput as GenerateVideoToolInputType,\n  type VideoGenerationFundingSource,\n  type VideoGenerationModelCapability,\n} from \"@opengeni/contracts\";\nimport { createHash } from \"node:crypto\";\n\nexport const VIDEO_GENERATION_ADAPTER_VERSION = \"gateway-video-v4/1\" as const;\n\nexport type SealedVideoReferenceRole =\n  | \"first_frame\"\n  | \"last_frame\"\n  | \"image_reference\"\n  | \"video_reference\";\n\nexport type SealedVideoReference = Readonly<{\n  role: SealedVideoReferenceRole;\n  contentSha256: string;\n  contentType: string;\n  byteSize: number;\n}>;\n\nexport type CanonicalVideoGenerationRequest = Readonly<{\n  schemaVersion: 1;\n  modelId: string;\n  prompt: string;\n  sourceMode: VideoGenerationSourceMode;\n  references: readonly SealedVideoReference[];\n  durationSeconds: number;\n  aspectRatio: VideoGenerationAspectRatio;\n  resolution: VideoGenerationResolution;\n  generateAudio: boolean;\n}>;\n\nexport type VideoGenerationOperationState =\n  | \"preparing\"\n  | \"prepared\"\n  | \"accepted\"\n  | \"submission_uncertain\"\n  | \"provider_started\"\n  | \"retaining\"\n  | \"completed\"\n  | \"provider_failed\"\n  | \"cancelled_before_submit\"\n  | \"outcome_unknown\"\n  | \"retention_failed\";\n\nconst TERMINAL_STATES = new Set<VideoGenerationOperationState>([\n  \"completed\",\n  \"provider_failed\",\n  \"cancelled_before_submit\",\n  \"outcome_unknown\",\n  \"retention_failed\",\n]);\n\nconst ALLOWED_TRANSITIONS: Readonly<\n  Record<VideoGenerationOperationState, readonly VideoGenerationOperationState[]>\n> = Object.freeze({\n  preparing: [\"prepared\", \"cancelled_before_submit\"],\n  prepared: [\"accepted\", \"cancelled_before_submit\"],\n  accepted: [\"submission_uncertain\", \"provider_started\", \"cancelled_before_submit\"],\n  submission_uncertain: [\"provider_started\", \"outcome_unknown\"],\n  provider_started: [\"retaining\", \"provider_failed\", \"outcome_unknown\"],\n  retaining: [\"completed\", \"retention_failed\"],\n  completed: [],\n  provider_failed: [],\n  cancelled_before_submit: [],\n  outcome_unknown: [],\n  retention_failed: [],\n});\n\nexport function normalizeVideoGenerationRequest(input: {\n  toolInput: GenerateVideoToolInputType;\n  model: VideoGenerationModelCapability;\n  sealedReferences: readonly SealedVideoReference[];\n}): CanonicalVideoGenerationRequest {\n  const toolInput = GenerateVideoToolInput.parse(input.toolInput);\n  if (toolInput.modelId !== undefined && toolInput.modelId !== input.model.modelId) {\n    throw new Error(\"Video generation model changed during admission\");\n  }\n  const sourceMode = toolInput.source?.mode ?? \"text\";\n  if (!input.model.sourceModes.includes(sourceMode)) {\n    throw new Error(`Video generation source mode ${sourceMode} is unavailable`);\n  }\n  assertReferenceRoles(sourceMode, input.sealedReferences);\n\n  const durationSeconds = toolInput.durationSeconds ?? input.model.duration.minSeconds;\n  if (\n    durationSeconds < input.model.duration.minSeconds ||\n    durationSeconds > input.model.duration.maxSeconds ||\n    (durationSeconds - input.model.duration.minSeconds) % input.model.duration.stepSeconds !== 0\n  ) {\n    throw new Error(\"Video generation duration is unavailable for the selected model\");\n  }\n  const aspectRatio = toolInput.aspectRatio ?? input.model.aspectRatios[0];\n  const resolution = toolInput.resolution ?? input.model.resolutions[0];\n  if (!aspectRatio || !input.model.aspectRatios.includes(aspectRatio)) {\n    throw new Error(\"Video generation aspect ratio is unavailable for the selected model\");\n  }\n  if (!resolution || !input.model.resolutions.includes(resolution)) {\n    throw new Error(\"Video generation resolution is unavailable for the selected model\");\n  }\n  const generateAudio = toolInput.generateAudio ?? input.model.supportsAudio;\n  if (generateAudio && !input.model.supportsAudio) {\n    throw new Error(\"Audio generation is unavailable for the selected model\");\n  }\n\n  return Object.freeze({\n    schemaVersion: 1,\n    modelId: input.model.modelId,\n    prompt: toolInput.prompt,\n    sourceMode,\n    references: Object.freeze(\n      input.sealedReferences.map((reference) => Object.freeze({ ...reference })),\n    ),\n    durationSeconds,\n    aspectRatio,\n    resolution,\n    generateAudio,\n  });\n}\n\nexport function canonicalVideoGenerationRequestJson(\n  request: CanonicalVideoGenerationRequest,\n): string {\n  return JSON.stringify({\n    schemaVersion: request.schemaVersion,\n    modelId: request.modelId,\n    prompt: request.prompt,\n    sourceMode: request.sourceMode,\n    references: request.references.map((reference) => ({\n      role: reference.role,\n      contentSha256: reference.contentSha256,\n      contentType: reference.contentType,\n      byteSize: reference.byteSize,\n    })),\n    durationSeconds: request.durationSeconds,\n    aspectRatio: request.aspectRatio,\n    resolution: request.resolution,\n    generateAudio: request.generateAudio,\n  });\n}\n\nexport function videoGenerationRequestDigest(request: CanonicalVideoGenerationRequest): string {\n  return sha256(\n    \"opengeni:video-generation-request:v1\\0\",\n    canonicalVideoGenerationRequestJson(request),\n  );\n}\n\n/** Stable only for one logical tool call; intentional identical calls remain distinct. */\nexport function videoGenerationAdmissionKey(input: {\n  workspaceId: string;\n  sessionId: string;\n  turnId: string;\n  toolCallId: string;\n}): string {\n  return sha256(\n    \"opengeni:video-generation-admission:v1\\0\",\n    input.workspaceId,\n    input.sessionId,\n    input.turnId,\n    input.toolCallId,\n  );\n}\n\nexport function videoGenerationProviderIdempotencyKey(input: {\n  operationId: string;\n  requestDigest: string;\n}): string {\n  return `ogvid_${sha256(\n    \"opengeni:video-generation-provider-start:v1\\0\",\n    input.operationId,\n    input.requestDigest,\n  ).slice(0, 48)}`;\n}\n\nexport function videoGenerationCapabilityRevision(input: {\n  policyRevision: number;\n  fundingSource: VideoGenerationFundingSource;\n  credentialVersion: number;\n  modelIds: readonly string[];\n}): string {\n  return sha256(\n    \"opengeni:video-generation-capability:v1\\0\",\n    String(input.policyRevision),\n    input.fundingSource,\n    String(input.credentialVersion),\n    JSON.stringify([...input.modelIds].sort()),\n    VIDEO_GENERATION_ADAPTER_VERSION,\n  );\n}\n\nexport function assertVideoGenerationTransition(\n  from: VideoGenerationOperationState,\n  to: VideoGenerationOperationState,\n): void {\n  if (from === to) return;\n  if (!ALLOWED_TRANSITIONS[from].includes(to)) {\n    throw new Error(`Invalid video generation transition ${from} -> ${to}`);\n  }\n}\n\nexport function isTerminalVideoGenerationState(state: VideoGenerationOperationState): boolean {\n  return TERMINAL_STATES.has(state);\n}\n\nfunction assertReferenceRoles(\n  sourceMode: VideoGenerationSourceMode,\n  references: readonly SealedVideoReference[],\n): void {\n  const expected: readonly SealedVideoReferenceRole[] =\n    sourceMode === \"text\"\n      ? []\n      : sourceMode === \"first_frame\"\n        ? [\"first_frame\"]\n        : sourceMode === \"first_and_last_frames\"\n          ? [\"first_frame\", \"last_frame\"]\n          : sourceMode === \"image_reference\"\n            ? [\"image_reference\"]\n            : [\"video_reference\"];\n  if (\n    references.length !== expected.length ||\n    references.some((reference, index) => reference.role !== expected[index])\n  ) {\n    throw new Error(`Sealed references do not match video source mode ${sourceMode}`);\n  }\n  for (const reference of references) {\n    if (!/^[0-9a-f]{64}$/u.test(reference.contentSha256)) {\n      throw new Error(\"Video reference has an invalid SHA-256 digest\");\n    }\n    if (!Number.isSafeInteger(reference.byteSize) || reference.byteSize <= 0) {\n      throw new Error(\"Video reference has an invalid byte size\");\n    }\n    if (!reference.contentType.includes(\"/\")) {\n      throw new Error(\"Video reference has an invalid content type\");\n    }\n  }\n}\n\nfunction sha256(prefix: string, ...parts: string[]): string {\n  const hash = createHash(\"sha256\").update(prefix);\n  for (const part of parts) hash.update(part).update(\"\\0\");\n  return hash.digest(\"hex\");\n}\n","import {\n  GROK_IMAGINE_VIDEO_1_5_MODEL_ID,\n  SEEDANCE_2_5_MODEL_ID,\n  VideoGenerationCapabilities,\n  VideoGenerationPolicy,\n  type VideoGenerationModelCapability,\n  type VideoGenerationPolicy as VideoGenerationPolicyType,\n} from \"@opengeni/contracts\";\nimport { videoGenerationCapabilityRevision } from \"./video-generation\";\n\n/** Reviewed executable catalog. Dynamic workspace policy never mutates tool schemas. */\nexport const VIDEO_GENERATION_MODEL_CATALOG: readonly VideoGenerationModelCapability[] =\n  Object.freeze([\n    Object.freeze({\n      modelId: SEEDANCE_2_5_MODEL_ID,\n      label: \"Seedance 2.5\",\n      providerLabel: \"Vercel AI Gateway\",\n      sourceModes: Object.freeze([\n        \"text\",\n        \"first_frame\",\n        \"first_and_last_frames\",\n        \"image_reference\",\n        \"video_reference\",\n      ]),\n      resolutions: Object.freeze([\"480p\", \"720p\"]),\n      aspectRatios: Object.freeze([\"16:9\", \"4:3\", \"1:1\", \"3:4\", \"9:16\", \"21:9\", \"adaptive\"]),\n      duration: Object.freeze({\n        minSeconds: 4,\n        maxSeconds: 30,\n        stepSeconds: 1,\n      }),\n      supportsAudio: true,\n    }) as VideoGenerationModelCapability,\n    Object.freeze({\n      modelId: GROK_IMAGINE_VIDEO_1_5_MODEL_ID,\n      label: \"Grok Imagine Video 1.5\",\n      providerLabel: \"Connected SuperGrok\",\n      sourceModes: Object.freeze([\"text\", \"first_frame\", \"image_reference\"]),\n      resolutions: Object.freeze([\"480p\", \"720p\"]),\n      aspectRatios: Object.freeze([\"16:9\", \"4:3\", \"1:1\", \"3:4\", \"9:16\"]),\n      duration: Object.freeze({\n        minSeconds: 4,\n        maxSeconds: 15,\n        stepSeconds: 1,\n      }),\n      // xAI emits audio but exposes no separate audio wire option.\n      supportsAudio: true,\n    }) as VideoGenerationModelCapability,\n  ]);\n\nexport function videoGenerationModelSupportsFundingSource(\n  modelId: string,\n  fundingSource: VideoGenerationPolicyType[\"fundingSource\"],\n): boolean {\n  return modelId === GROK_IMAGINE_VIDEO_1_5_MODEL_ID\n    ? fundingSource === \"supergrok_subscription\"\n    : modelId === SEEDANCE_2_5_MODEL_ID\n      ? fundingSource === \"opengeni_credits\" || fundingSource === \"workspace_gateway\"\n      : false;\n}\n\nexport function defaultVideoGenerationPolicy(): VideoGenerationPolicyType {\n  return VideoGenerationPolicy.parse({\n    schemaVersion: 1,\n    revision: 0,\n    fundingSource: \"workspace_gateway\",\n    enabledModelIds: [],\n    defaultModelId: null,\n  });\n}\n\nexport function videoGenerationCapabilitiesForPolicy(input: {\n  policy: VideoGenerationPolicyType;\n  credentialVersion: number;\n}): VideoGenerationCapabilities {\n  const policy = VideoGenerationPolicy.parse(input.policy);\n  const enabled = new Set(policy.enabledModelIds);\n  const models = VIDEO_GENERATION_MODEL_CATALOG.filter(\n    (model) =>\n      enabled.has(model.modelId) &&\n      videoGenerationModelSupportsFundingSource(model.modelId, policy.fundingSource),\n  );\n  if (models.length === 0 || policy.defaultModelId === null) {\n    throw new Error(\"Video generation is disabled for this workspace\");\n  }\n  return VideoGenerationCapabilities.parse({\n    schemaVersion: 1,\n    capabilityRevision: videoGenerationCapabilityRevision({\n      policyRevision: policy.revision,\n      fundingSource: policy.fundingSource,\n      credentialVersion: input.credentialVersion,\n      modelIds: models.map((model) => model.modelId),\n    }),\n    defaultModelId: policy.defaultModelId,\n    models,\n  });\n}\n\nexport function assertKnownVideoGenerationModelIds(modelIds: readonly string[]): void {\n  const known = new Set(VIDEO_GENERATION_MODEL_CATALOG.map((model) => model.modelId));\n  for (const modelId of modelIds) {\n    if (!known.has(modelId)) throw new Error(`Unknown video generation model: ${modelId}`);\n  }\n}\n","import {\n  NewSessionDraft,\n  SaveNewSessionDraftRequest,\n  type AccessGrant,\n  type NewSessionDraft as NewSessionDraftValue,\n} from \"@opengeni/contracts\";\nimport {\n  getNewSessionDraftInTransaction,\n  getEnrollment,\n  getRig,\n  getSandbox,\n  getVariableSet,\n  NewSessionDraftAccessError,\n  newSessionDraftToolsProvided,\n  publicNewSessionDraftOptions,\n  requireFileForSubject,\n  saveNewSessionDraftInTransaction,\n  withWorkspaceSubjectRls,\n} from \"@opengeni/db\";\nimport { HTTPException } from \"hono/http-exception\";\nimport type { AppDependencies } from \"../dependencies\";\nimport { settingsWithEnabledCapabilityMcpServers } from \"../domain/capabilities\";\nimport {\n  isAuthoritativeGitHubRepositorySelectionError,\n  normalizeResources,\n  validateFileResources,\n  validateGitHubRepositorySelection,\n  validateToolRefs,\n} from \"../domain/resources\";\nimport { hasPermission } from \"../access\";\nimport { assertConfiguredModel, assertWorkspaceModelPolicyAllows } from \"../domain/sessions\";\n\ntype NewSessionDraftDependencies = Pick<AppDependencies, \"settings\" | \"db\" | \"objectStorage\">;\n\nfunction hasOwn(value: unknown, key: string): boolean {\n  return typeof value === \"object\" && value !== null && Object.hasOwn(value, key);\n}\n\nfunction mapNewSessionDraft(\n  row: Awaited<ReturnType<typeof getNewSessionDraftInTransaction>>,\n): NewSessionDraftValue | null {\n  if (!row) return null;\n  return NewSessionDraft.parse({\n    revision: row.revision,\n    text: row.text,\n    resources: row.resources,\n    tools: newSessionDraftToolsProvided(row) ? row.tools : [],\n    toolsProvided: newSessionDraftToolsProvided(row),\n    model: row.model,\n    reasoningEffort: row.reasoningEffort,\n    latencyMode: row.latencyMode,\n    options: publicNewSessionDraftOptions(row),\n    updatedAt: row.updatedAt.toISOString(),\n  });\n}\n\nasync function hydrateNewSessionDraft(\n  deps: Pick<NewSessionDraftDependencies, \"db\" | \"settings\">,\n  grant: AccessGrant,\n  workspaceId: string,\n  row: Awaited<ReturnType<typeof getNewSessionDraftInTransaction>>,\n): Promise<NewSessionDraftValue | null> {\n  if (!row) return null;\n  const mapped = mapNewSessionDraft(row);\n  if (!mapped) return null;\n  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(\n    deps.db,\n    workspaceId,\n    deps.settings,\n    { subjectId: grant.subjectId },\n  );\n  const resources = [] as NewSessionDraftValue[\"resources\"];\n  for (const resource of mapped.resources) {\n    if (resource.kind === \"repository\") {\n      try {\n        await validateGitHubRepositorySelection(deps.db, workspaceId, [resource]);\n        resources.push(resource);\n      } catch (error) {\n        if (isAuthoritativeGitHubRepositorySelectionError(error)) {\n          // Repository authorization can be revoked after the draft was saved.\n          // The next form must not present the stale identity as selectable.\n          continue;\n        }\n        // A catalog/database outage is not proof that a repository was revoked.\n        // Preserve the resource so a later retry cannot autosave its deletion.\n        resources.push(resource);\n      }\n      continue;\n    }\n    try {\n      const file = await requireFileForSubject(deps.db, {\n        accountId: grant.accountId,\n        workspaceId,\n        subjectId: grant.subjectId,\n        fileId: resource.fileId,\n      });\n      if (file.status === \"ready\") resources.push(resource);\n    } catch {\n      // Missing, foreign, failed, and pending files are stale draft state.\n    }\n  }\n\n  const options = { ...mapped.options };\n  if (options.variableSetId) {\n    if (\n      !hasPermission(grant.permissions, \"variable-sets:use\") ||\n      !(await getVariableSet(deps.db, workspaceId, options.variableSetId))\n    ) {\n      delete options.variableSetId;\n    }\n  }\n  if (options.rigId) {\n    const rig = await getRig(deps.db, workspaceId, options.rigId);\n    if (!rig?.activeVersion) delete options.rigId;\n  }\n  if (options.targetSandboxId) {\n    const sandbox = await getSandbox(deps.db, workspaceId, options.targetSandboxId);\n    const enrollment = sandbox?.enrollmentId\n      ? await getEnrollment(deps.db, workspaceId, sandbox.enrollmentId)\n      : null;\n    if (\n      !sandbox ||\n      sandbox.kind !== \"selfhosted\" ||\n      !enrollment ||\n      enrollment.status !== \"active\"\n    ) {\n      delete options.targetSandboxId;\n      delete options.workingDir;\n      delete options.sandboxBackend;\n    }\n  }\n\n  let tools: NewSessionDraftValue[\"tools\"] = [];\n  if (mapped.toolsProvided) {\n    try {\n      tools = validateToolRefs(mapped.tools, runtimeSettings);\n    } catch {\n      // A revoked/disabled MCP selection is removed while explicitness remains\n      // true, so an explicit empty policy cannot silently widen to defaults.\n      tools = mapped.tools.filter((tool) => {\n        try {\n          validateToolRefs([tool], runtimeSettings);\n          return true;\n        } catch {\n          return false;\n        }\n      });\n    }\n  }\n  return {\n    ...mapped,\n    resources,\n    tools,\n    options,\n  };\n}\n\n/** Read the authenticated actor's server-authoritative pre-session composer state. */\nexport async function getActorNewSessionDraft(\n  deps: Pick<NewSessionDraftDependencies, \"settings\" | \"db\">,\n  grant: AccessGrant,\n  workspaceId: string,\n): Promise<NewSessionDraftValue> {\n  const row = await withWorkspaceSubjectRls(deps.db, workspaceId, grant.subjectId, (scoped) =>\n    getNewSessionDraftInTransaction(scoped, {\n      workspaceId,\n      subjectId: grant.subjectId,\n    }),\n  );\n  return (\n    (await hydrateNewSessionDraft(deps, grant, workspaceId, row)) ?? {\n      revision: 0,\n      text: \"\",\n      resources: [],\n      tools: [],\n      toolsProvided: false,\n      model: deps.settings.openaiModel,\n      reasoningEffort: deps.settings.openaiReasoningEffort,\n      latencyMode: \"standard\",\n      options: {},\n      updatedAt: null,\n    }\n  );\n}\n\n/**\n * Validate and save one exact actor-private draft revision. Create-time-only\n * checks (live machine target, rig/variable-set state, and permission\n * delegation) intentionally remain in createSessionForRequest: a recoverable\n * draft may represent incomplete options, while no invalid option can become a\n * session without passing that single canonical create boundary.\n */\nexport async function saveActorNewSessionDraft(\n  deps: NewSessionDraftDependencies,\n  grant: AccessGrant,\n  workspaceId: string,\n  rawInput: unknown,\n): Promise<NewSessionDraftValue> {\n  const input = SaveNewSessionDraftRequest.parse(rawInput);\n  // The pre-marker client contract required `tools` and had no\n  // `toolsProvided`. Its array—including []—was the user's complete selection.\n  // Do this presence check before Zod's default turns the missing marker into\n  // false, preserving old-client → new-server intent safely.\n  const toolsProvided = hasOwn(rawInput, \"toolsProvided\") ? input.toolsProvided : true;\n  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(\n    deps.db,\n    workspaceId,\n    deps.settings,\n    { subjectId: grant.subjectId },\n  );\n  const resources = normalizeResources(input.resources);\n  const tools = toolsProvided ? validateToolRefs(input.tools, runtimeSettings) : [];\n  await validateGitHubRepositorySelection(deps.db, workspaceId, resources);\n  if (resources.some((resource) => resource.kind === \"file\") && !deps.objectStorage) {\n    throw new HTTPException(503, { message: \"object storage is not configured\" });\n  }\n  await validateFileResources(deps.db, grant.accountId, workspaceId, grant.subjectId, resources);\n  assertConfiguredModel(deps.settings, input.model);\n  await assertWorkspaceModelPolicyAllows(deps.db, deps.settings, workspaceId, input.model);\n\n  try {\n    const saved = await withWorkspaceSubjectRls(deps.db, workspaceId, grant.subjectId, (scoped) =>\n      scoped.transaction((tx) =>\n        saveNewSessionDraftInTransaction(tx as unknown as typeof scoped, {\n          accountId: grant.accountId,\n          workspaceId,\n          subjectId: grant.subjectId,\n          expectedRevision: input.expectedRevision,\n          text: input.text,\n          resources,\n          tools,\n          toolsProvided,\n          model: input.model,\n          reasoningEffort: input.reasoningEffort,\n          latencyMode: input.latencyMode,\n          options: input.options,\n          // Only managed people are removed through removeWorkspaceMember().\n          // API keys and delegated service actors (for example the first-party\n          // worker MCP principal) legitimately have no workspace_memberships\n          // row, so they must not be rejected by the human-removal fence.\n          requireWorkspaceMembership: grant.subjectId.startsWith(\"user:\"),\n        }),\n      ),\n    );\n    return mapNewSessionDraft(saved)!;\n  } catch (error) {\n    if (error instanceof NewSessionDraftAccessError) {\n      throw new HTTPException(403, { message: error.message });\n    }\n    throw error;\n  }\n}\n","import type {\n  ComposerDraft,\n  DeleteSessionQueueItemRequest,\n  EditSessionQueueItemRequest,\n  MoveSessionQueueItemRequest,\n  SaveComposerDraftRequest,\n  AccessGrant,\n  SessionAuthorizationOperation,\n  SessionAuthorizationPort,\n  SessionAuthorizationSurface,\n  SessionCommandReceipt,\n  SessionControlRequest,\n  SessionControlResponse,\n  SessionQueueMutationResponse,\n  SteerSessionQueueItemRequest,\n  WorkspaceInferenceControlRequest,\n  WorkspaceInferenceControlResponse,\n} from \"@opengeni/contracts\";\nimport {\n  DraftTimelineAnnotations,\n  latencyModeForMetadata,\n  reasoningEffortForMetadata,\n} from \"@opengeni/contracts\";\nimport {\n  deleteSessionQueueItemInTransaction,\n  editQueuedTurnInTransaction,\n  getComposerDraftInTransaction,\n  getSession,\n  getSessionEvent,\n  getWorkspaceControlEvent,\n  getSessionQueueSnapshot,\n  moveQueuedTurnInTransaction,\n  mutateSessionControlInTransaction,\n  mutateWorkspaceControlInTransaction,\n  projectEffectiveControlForRelatedAccess,\n  runIdempotentPersistenceTransaction,\n  saveComposerDraftInTransaction,\n  sendAgentMessageInTransaction,\n  serializeEffectiveSessionControl,\n  steerAgentSessionInTransaction,\n  steerQueuedTurnInTransaction,\n  withWorkspaceRls,\n  withWorkspaceSessionActivityRls,\n  withWorkspaceSubjectRls,\n  withWorkspaceSubjectSessionActivityRls,\n  type Database,\n  type SessionActivityDatabase,\n  type SessionCommandReceiptRow,\n} from \"@opengeni/db\";\nimport {\n  publishDurableSessionEvents,\n  publishDurableWorkspaceControlEvent,\n  type EventBus,\n} from \"@opengeni/events\";\nimport type { SessionWorkflowClient } from \"../dependencies\";\nimport { normalizeResources } from \"../domain/resources\";\nimport { validateDraftTimelineAnnotations } from \"../domain/timeline-annotations\";\nimport {\n  requireSessionAuthorization,\n  type ResolvedSessionAuthorization,\n} from \"../session-authorization\";\n\nexport type HumanSessionCommandContext = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  subjectId: string;\n  /** See AgentSessionCommandContext.authorizationSurface. */\n  authorizationSurface?: SessionAuthorizationSurface;\n};\n\nexport type AgentSessionCommandContext = {\n  accountId: string;\n  workspaceId: string;\n  subjectId: string;\n  callerSessionId: string;\n  callerTurnId: string;\n  callerAttemptId: string;\n  callerExecutionGeneration: number;\n  /**\n   * The trusted adapter surface that owns this command's one authorization\n   * decision. Direct core callers omit it and retain the canonical `core`\n   * surface; adapters that delegate the complete command set it explicitly so\n   * they do not authorize once at the edge and then repeat the host call here.\n   */\n  authorizationSurface?: SessionAuthorizationSurface;\n};\n\ntype SessionAuthorizationCommandDeps = {\n  db: Database;\n  sessionAuthorization?: SessionAuthorizationPort | null;\n};\n\nfunction humanAccessGrant(context: HumanSessionCommandContext): AccessGrant {\n  return {\n    accountId: context.accountId,\n    workspaceId: context.workspaceId,\n    subjectId: context.subjectId,\n    permissions: [],\n  };\n}\n\nfunction agentAccessGrant(context: AgentSessionCommandContext): AccessGrant {\n  return {\n    accountId: context.accountId,\n    workspaceId: context.workspaceId,\n    subjectId: context.subjectId,\n    permissions: [],\n    metadata: {\n      sessionId: context.callerSessionId,\n      turnId: context.callerTurnId,\n      attemptId: context.callerAttemptId,\n      executionGeneration: context.callerExecutionGeneration,\n    },\n  };\n}\n\nasync function authorizeHumanSessionCommand(\n  deps: SessionAuthorizationCommandDeps,\n  context: HumanSessionCommandContext,\n  operation: SessionAuthorizationOperation,\n): Promise<ResolvedSessionAuthorization | null> {\n  return await requireSessionAuthorization(deps, humanAccessGrant(context), {\n    sessionId: context.sessionId,\n    operation,\n    surface: context.authorizationSurface ?? \"core\",\n  });\n}\n\nasync function authorizeAgentSessionCommand(\n  deps: SessionAuthorizationCommandDeps,\n  context: AgentSessionCommandContext,\n  targetSessionId: string,\n  operation: SessionAuthorizationOperation,\n): Promise<ResolvedSessionAuthorization | null> {\n  return await requireSessionAuthorization(deps, agentAccessGrant(context), {\n    sessionId: targetSessionId,\n    operation,\n    surface: context.authorizationSurface ?? \"core\",\n  });\n}\n\nfunction agentActor(context: AgentSessionCommandContext) {\n  return {\n    type: \"agent_attempt\" as const,\n    sessionId: context.callerSessionId,\n    turnId: context.callerTurnId,\n    attemptId: context.callerAttemptId,\n    executionGeneration: context.callerExecutionGeneration,\n  };\n}\n\n/**\n * Retry only one operation-keyed session command transaction. Callers keep\n * event publication and Temporal wake delivery after this returns, so a\n * deadlock/serialization retry can never replay an external effect. Human\n * draft ownership is applied inside every retry attempt when required.\n */\nasync function runSessionCommandPersistenceTransaction<T>(\n  deps: { db: Database },\n  scope: { workspaceId: string; subjectId?: string },\n  input: {\n    stage: string;\n    eventTypes: string[];\n    transaction: (tx: SessionActivityDatabase) => Promise<T>;\n  },\n): Promise<T> {\n  return await runIdempotentPersistenceTransaction(\n    {\n      stage: input.stage,\n      eventTypes: input.eventTypes,\n      maxAttempts: 3,\n    },\n    async () => {\n      const run = async (scoped: SessionActivityDatabase) => await input.transaction(scoped);\n      return scope.subjectId === undefined\n        ? await withWorkspaceSessionActivityRls(deps.db, scope.workspaceId, run)\n        : await withWorkspaceSubjectSessionActivityRls(\n            deps.db,\n            scope.workspaceId,\n            scope.subjectId,\n            run,\n          );\n    },\n  );\n}\n\nasync function publishAndWakeAgentCommand(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    workflowClient: Pick<SessionWorkflowClient, \"wakeSessionWorkflow\">;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  input: {\n    accountId: string;\n    workspaceId: string;\n    sessionId: string;\n    eventIds: string[];\n    workflowId: string;\n    wakeRevision: number | null;\n    shouldSignal: boolean;\n    interruptionCount: number;\n    controlRequested?: boolean;\n  },\n): Promise<void> {\n  await publishSessionEventIds(deps, input.workspaceId, input.sessionId, input.eventIds);\n  if (!input.shouldSignal || input.wakeRevision === null) return;\n  try {\n    await deps.workflowClient.wakeSessionWorkflow({\n      accountId: input.accountId,\n      workspaceId: input.workspaceId,\n      sessionId: input.sessionId,\n      workflowId: input.workflowId,\n      wakeRevision: input.wakeRevision,\n      ...(input.controlRequested || input.interruptionCount > 0\n        ? { interruptionRequested: true }\n        : {}),\n    });\n  } catch {\n    console.warn(\n      \"[session-commands] immediate Agent command wake failed; durable outbox will retry\",\n      {\n        errorClass: \"WorkflowWakeOperationError\",\n        errorCode: \"agent_command_wake_failed\",\n        origin: \"core\",\n      },\n    );\n  }\n}\n\n/**\n * Nudge the one bounded dispatcher after a set-based control transaction. The\n * API never materializes descendant session ids; Postgres remains the complete\n * wake ledger and the 10-second Schedule repairs a lost immediate trigger.\n */\nasync function requestControlWakeDispatch(\n  deps: {\n    workflowClient: Pick<SessionWorkflowClient, \"requestSessionWorkflowWakeDispatch\">;\n  },\n  wakeCount: number,\n): Promise<void> {\n  if (wakeCount === 0) return;\n  try {\n    await deps.workflowClient.requestSessionWorkflowWakeDispatch();\n  } catch {\n    console.warn(\n      \"[session-commands] immediate control wake dispatch failed; durable outbox will retry\",\n      {\n        errorClass: \"WorkflowWakeOperationError\",\n        errorCode: \"control_wake_dispatch_failed\",\n        origin: \"core\",\n        wakeCount,\n      },\n    );\n  }\n}\n\nasync function publishSessionEventIds(\n  deps: { db: Database; bus: EventBus },\n  workspaceId: string,\n  sessionId: string,\n  eventIds: string[],\n): Promise<void> {\n  if (eventIds.length === 0) return;\n  const events = await Promise.all(\n    eventIds.map((eventId) => getSessionEvent(deps.db, workspaceId, eventId)),\n  );\n  await publishDurableSessionEvents(\n    deps.bus,\n    workspaceId,\n    sessionId,\n    events.filter((event): event is NonNullable<typeof event> => event !== null),\n  );\n}\n\nasync function publishWorkspaceControlEvent(\n  deps: { db: Database; bus: EventBus },\n  workspaceId: string,\n  eventId: string | null,\n): Promise<void> {\n  if (!eventId) return;\n  const event = await getWorkspaceControlEvent(deps.db, workspaceId, eventId);\n  if (!event) {\n    throw new Error(`Committed workspace control event disappeared: ${eventId}`);\n  }\n  await publishDurableWorkspaceControlEvent(deps.bus, workspaceId, event);\n}\n\nexport async function sendAgentSessionMessage(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    workflowClient: Pick<SessionWorkflowClient, \"wakeSessionWorkflow\">;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  context: AgentSessionCommandContext,\n  input: { targetSessionId: string; text: string; idempotencyKey: string },\n) {\n  await authorizeAgentSessionCommand(deps, context, input.targetSessionId, \"session.append\");\n  const result = await runSessionCommandPersistenceTransaction(\n    deps,\n    { workspaceId: context.workspaceId },\n    {\n      stage: \"session_commands.agent_message\",\n      eventTypes: [\"system.update.pending\"],\n      transaction: async (tx) =>\n        await sendAgentMessageInTransaction(tx, {\n          accountId: context.accountId,\n          workspaceId: context.workspaceId,\n          targetSessionId: input.targetSessionId,\n          actor: agentActor(context),\n          operationKey: input.idempotencyKey,\n          text: input.text,\n        }),\n    },\n  );\n  await publishAndWakeAgentCommand(deps, {\n    accountId: context.accountId,\n    workspaceId: context.workspaceId,\n    sessionId: input.targetSessionId,\n    eventIds: result.eventIds,\n    workflowId: result.workflowId,\n    wakeRevision: result.wakeRevision,\n    shouldSignal: result.shouldSignal,\n    interruptionCount: 0,\n  });\n  await publishWorkspaceControlEvent(deps, context.workspaceId, result.workspaceControlEventId);\n  return result;\n}\n\nexport async function steerAgentSession(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    workflowClient: Pick<SessionWorkflowClient, \"wakeSessionWorkflow\">;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  context: AgentSessionCommandContext,\n  input: {\n    targetSessionId: string;\n    instruction: string;\n    idempotencyKey: string;\n  },\n) {\n  await authorizeAgentSessionCommand(deps, context, input.targetSessionId, \"session.steer\");\n  const result = await runSessionCommandPersistenceTransaction(\n    deps,\n    { workspaceId: context.workspaceId },\n    {\n      stage: \"session_commands.agent_steer\",\n      eventTypes: [\"session.control.steer_requested\", \"system.update.pending\", \"turn.superseded\"],\n      transaction: async (tx) =>\n        await steerAgentSessionInTransaction(tx, {\n          accountId: context.accountId,\n          workspaceId: context.workspaceId,\n          targetSessionId: input.targetSessionId,\n          actor: agentActor(context),\n          operationKey: input.idempotencyKey,\n          instruction: input.instruction,\n        }),\n    },\n  );\n  await publishAndWakeAgentCommand(deps, {\n    accountId: context.accountId,\n    workspaceId: context.workspaceId,\n    sessionId: input.targetSessionId,\n    eventIds: result.eventIds,\n    workflowId: result.workflowId,\n    wakeRevision: result.wakeRevision,\n    shouldSignal: result.shouldSignal,\n    interruptionCount: result.interruptionCount,\n    controlRequested: true,\n  });\n  await publishWorkspaceControlEvent(deps, context.workspaceId, result.workspaceControlEventId);\n  return result;\n}\n\nexport async function controlAgentSessionWorkstream(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    workflowClient: Pick<SessionWorkflowClient, \"requestSessionWorkflowWakeDispatch\">;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  context: AgentSessionCommandContext,\n  input: {\n    targetSessionId: string;\n    action: \"pause\" | \"resume\";\n    idempotencyKey: string;\n    reason?: string | null;\n  },\n) {\n  const authorization = await authorizeAgentSessionCommand(\n    deps,\n    context,\n    input.targetSessionId,\n    \"session.control\",\n  );\n  const result = await runSessionCommandPersistenceTransaction(\n    deps,\n    { workspaceId: context.workspaceId },\n    {\n      stage: \"session_commands.agent_control\",\n      eventTypes: [input.action === \"pause\" ? \"session.control.paused\" : \"session.control.resumed\"],\n      transaction: async (tx) =>\n        await mutateSessionControlInTransaction(tx, {\n          accountId: context.accountId,\n          workspaceId: context.workspaceId,\n          sessionId: input.targetSessionId,\n          actor: agentActor(context),\n          operationKey: input.idempotencyKey,\n          action: input.action,\n          reason: input.reason ?? null,\n        }),\n    },\n  );\n  await publishSessionEventIds(deps, context.workspaceId, input.targetSessionId, [\n    result.sessionControlEventId,\n  ]);\n  await publishWorkspaceControlEvent(deps, context.workspaceId, result.workspaceControlEventId);\n  await requestControlWakeDispatch(deps, result.wakeCount);\n  return { ...result, authorization };\n}\n\nfunction receipt(row: SessionCommandReceiptRow): SessionCommandReceipt {\n  return {\n    id: row.id,\n    action: row.action,\n    operationKey: row.operationKey,\n    targetSessionId: row.targetSessionId,\n    targetTurnId: row.targetTurnId,\n    appliedControlRevision: row.appliedControlRevision,\n    appliedQueueVersion: row.appliedQueueVersion,\n    appliedTurnVersion: row.appliedTurnVersion,\n    appliedDraftRevision: row.appliedDraftRevision,\n    createdAt: row.createdAt.toISOString(),\n  };\n}\n\nfunction composerDraft(\n  row: Awaited<ReturnType<typeof getComposerDraftInTransaction>>,\n): ComposerDraft | null {\n  if (!row) return null;\n  return {\n    revision: row.revision,\n    text: row.text,\n    annotations: DraftTimelineAnnotations.parse(row.annotations),\n    resources: row.resources as ComposerDraft[\"resources\"],\n    model: row.model,\n    reasoningEffort: row.reasoningEffort as ComposerDraft[\"reasoningEffort\"],\n    latencyMode: row.latencyMode as ComposerDraft[\"latencyMode\"],\n    sourceTurnId: row.sourceTurnId,\n    sourceTurnVersion: row.sourceTurnVersion,\n    updatedAt: row.updatedAt.toISOString(),\n  };\n}\n\nasync function authoritativeQueue(\n  db: Database,\n  workspaceId: string,\n  sessionId: string,\n  relatedSessionAccess: \"target\" | \"root\",\n) {\n  const snapshot = await getSessionQueueSnapshot(db, workspaceId, sessionId);\n  if (!snapshot) throw new Error(`Session not found: ${sessionId}`);\n  return {\n    ...snapshot,\n    effectiveControl: projectEffectiveControlForRelatedAccess(\n      snapshot.effectiveControl,\n      sessionId,\n      relatedSessionAccess,\n    ),\n  };\n}\n\nexport async function moveHumanQueuePrompt(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  context: HumanSessionCommandContext,\n  turnId: string,\n  input: MoveSessionQueueItemRequest,\n): Promise<SessionQueueMutationResponse> {\n  const authorization = await authorizeHumanSessionCommand(deps, context, \"session.queue.control\");\n  const result = await runSessionCommandPersistenceTransaction(\n    deps,\n    { workspaceId: context.workspaceId },\n    {\n      stage: \"session_commands.human_queue_move\",\n      eventTypes: [\"session.queue.changed\"],\n      transaction: async (tx) =>\n        await moveQueuedTurnInTransaction(tx, {\n          ...context,\n          turnId,\n          beforeTurnId: input.beforeTurnId,\n          expectedQueueVersion: input.expectedQueueVersion,\n          actor: { type: \"human\", subjectId: context.subjectId },\n          operationKey: input.clientEventId,\n        }),\n    },\n  );\n  const response = {\n    receipt: receipt(result.receipt),\n    snapshot: await authoritativeQueue(\n      deps.db,\n      context.workspaceId,\n      context.sessionId,\n      authorization?.relatedSessionAccess ?? \"root\",\n    ),\n  };\n  await publishSessionEventIds(deps, context.workspaceId, context.sessionId, result.eventIds);\n  return response;\n}\n\nexport async function deleteHumanQueuePrompt(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  context: HumanSessionCommandContext,\n  turnId: string,\n  input: DeleteSessionQueueItemRequest,\n): Promise<SessionQueueMutationResponse> {\n  const authorization = await authorizeHumanSessionCommand(deps, context, \"session.queue.control\");\n  const result = await runSessionCommandPersistenceTransaction(\n    deps,\n    { workspaceId: context.workspaceId },\n    {\n      stage: \"session_commands.human_queue_delete\",\n      eventTypes: [\"session.queue.changed\"],\n      transaction: async (tx) =>\n        await deleteSessionQueueItemInTransaction(tx, {\n          ...context,\n          turnId,\n          expectedTurnVersion: input.expectedTurnVersion,\n          actor: { type: \"human\", subjectId: context.subjectId },\n          operationKey: input.clientEventId,\n          reason: input.reason ?? null,\n        }),\n    },\n  );\n  const response = {\n    receipt: receipt(result.receipt),\n    snapshot: await authoritativeQueue(\n      deps.db,\n      context.workspaceId,\n      context.sessionId,\n      authorization?.relatedSessionAccess ?? \"root\",\n    ),\n  };\n  await publishSessionEventIds(deps, context.workspaceId, context.sessionId, result.eventIds);\n  return response;\n}\n\nexport async function editHumanQueuePrompt(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  context: HumanSessionCommandContext,\n  turnId: string,\n  input: EditSessionQueueItemRequest,\n): Promise<SessionQueueMutationResponse> {\n  const authorization = await authorizeHumanSessionCommand(deps, context, \"session.queue.control\");\n  const result = await runSessionCommandPersistenceTransaction(\n    deps,\n    { workspaceId: context.workspaceId, subjectId: context.subjectId },\n    {\n      stage: \"session_commands.human_queue_edit\",\n      eventTypes: [\"session.queue.changed\"],\n      transaction: async (tx) =>\n        await editQueuedTurnInTransaction(tx, {\n          ...context,\n          turnId,\n          expectedTurnVersion: input.expectedTurnVersion,\n          expectedDraftRevision: input.expectedDraftRevision,\n          replaceDraft: input.replaceDraft,\n          actor: { type: \"human\", subjectId: context.subjectId },\n          operationKey: input.clientEventId,\n        }),\n    },\n  );\n  const response = {\n    receipt: receipt(result.receipt),\n    snapshot: await authoritativeQueue(\n      deps.db,\n      context.workspaceId,\n      context.sessionId,\n      authorization?.relatedSessionAccess ?? \"root\",\n    ),\n    draft: composerDraft(result.draft)!,\n  };\n  await publishSessionEventIds(deps, context.workspaceId, context.sessionId, result.eventIds);\n  return response;\n}\n\nexport async function steerHumanQueuePrompt(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  context: HumanSessionCommandContext,\n  turnId: string,\n  input: SteerSessionQueueItemRequest,\n): Promise<SessionQueueMutationResponse> {\n  const authorization = await authorizeHumanSessionCommand(deps, context, \"session.queue.control\");\n  const result = await runSessionCommandPersistenceTransaction(\n    deps,\n    { workspaceId: context.workspaceId },\n    {\n      stage: \"session_commands.human_queue_steer\",\n      eventTypes: [\"session.control.steer_requested\", \"session.queue.changed\", \"turn.superseded\"],\n      transaction: async (tx) =>\n        await steerQueuedTurnInTransaction(tx, {\n          ...context,\n          turnId,\n          expectedTurnVersion: input.expectedTurnVersion,\n          controlEtag: input.controlEtag ?? null,\n          actor: { type: \"human\", subjectId: context.subjectId },\n          operationKey: input.clientEventId,\n        }),\n    },\n  );\n  const response = {\n    receipt: receipt(result.receipt),\n    snapshot: await authoritativeQueue(\n      deps.db,\n      context.workspaceId,\n      context.sessionId,\n      authorization?.relatedSessionAccess ?? \"root\",\n    ),\n  };\n  await publishSessionEventIds(deps, context.workspaceId, context.sessionId, result.eventIds);\n  await publishWorkspaceControlEvent(deps, context.workspaceId, result.workspaceControlEventId);\n  return response;\n}\n\nexport async function controlHumanSessionWorkstreamWithOutcome(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    workflowClient: Pick<SessionWorkflowClient, \"requestSessionWorkflowWakeDispatch\">;\n    sessionAuthorization?: SessionAuthorizationPort | null;\n  },\n  context: HumanSessionCommandContext,\n  input: SessionControlRequest,\n): Promise<{ response: SessionControlResponse; replay: boolean }> {\n  const authorization = await authorizeHumanSessionCommand(deps, context, \"session.control\");\n  const result = await runSessionCommandPersistenceTransaction(\n    deps,\n    { workspaceId: context.workspaceId },\n    {\n      stage: \"session_commands.human_control\",\n      eventTypes: [\n        input.action === \"resume\" ? \"session.control.resumed\" : \"session.control.paused\",\n      ],\n      transaction: async (tx) =>\n        await mutateSessionControlInTransaction(tx, {\n          accountId: context.accountId,\n          workspaceId: context.workspaceId,\n          sessionId: context.sessionId,\n          actor: { type: \"human\", subjectId: context.subjectId },\n          operationKey: input.clientEventId,\n          action: input.action,\n          reason: input.reason ?? null,\n          expectedControlEtag: input.expectedControlEtag ?? null,\n        }),\n    },\n  );\n  const response = {\n    receipt: receipt(result.receipt),\n    effectiveControl: projectEffectiveControlForRelatedAccess(\n      serializeEffectiveSessionControl(result.control),\n      context.sessionId,\n      authorization?.relatedSessionAccess ?? \"root\",\n    ),\n    interruptionCount: result.interruptionCount,\n    wakeCount: result.wakeCount,\n    cancelledSessionCount: result.cancelledSessionCount,\n    cancelledTurnCount: result.cancelledTurnCount,\n  };\n  for (const affected of result.affectedSessionEvents) {\n    await publishSessionEventIds(deps, context.workspaceId, affected.sessionId, affected.eventIds);\n  }\n  await publishWorkspaceControlEvent(deps, context.workspaceId, result.workspaceControlEventId);\n  await requestControlWakeDispatch(deps, result.wakeCount);\n  return { response, replay: result.replay };\n}\n\n/** Backward-compatible response path used by the REST control route. */\nexport async function controlHumanSessionWorkstream(\n  deps: Parameters<typeof controlHumanSessionWorkstreamWithOutcome>[0],\n  context: Parameters<typeof controlHumanSessionWorkstreamWithOutcome>[1],\n  input: Parameters<typeof controlHumanSessionWorkstreamWithOutcome>[2],\n): Promise<SessionControlResponse> {\n  return (await controlHumanSessionWorkstreamWithOutcome(deps, context, input)).response;\n}\n\nexport async function controlHumanWorkspace(\n  deps: {\n    db: Database;\n    bus: EventBus;\n    workflowClient: Pick<SessionWorkflowClient, \"requestSessionWorkflowWakeDispatch\">;\n  },\n  context: Omit<HumanSessionCommandContext, \"sessionId\">,\n  input: WorkspaceInferenceControlRequest,\n): Promise<WorkspaceInferenceControlResponse> {\n  const result = await withWorkspaceRls(deps.db, context.workspaceId, (scoped) =>\n    scoped.transaction((tx) =>\n      mutateWorkspaceControlInTransaction(tx as unknown as Database, {\n        accountId: context.accountId,\n        workspaceId: context.workspaceId,\n        actor: { type: \"human\", subjectId: context.subjectId },\n        operationKey: input.clientEventId,\n        action: input.action,\n        reason: input.reason ?? null,\n        expectedRevision: input.expectedRevision ?? null,\n      }),\n    ),\n  );\n  const response = {\n    receipt: receipt(result.receipt),\n    state: result.workspaceState,\n    revision: result.revision,\n    interruptionCount: result.interruptionCount,\n    wakeCount: result.wakeCount,\n  };\n  await publishWorkspaceControlEvent(deps, context.workspaceId, result.workspaceControlEventId);\n  await requestControlWakeDispatch(deps, result.wakeCount);\n  return response;\n}\n\nexport async function getHumanComposerDraft(\n  deps: SessionAuthorizationCommandDeps,\n  context: HumanSessionCommandContext,\n): Promise<ComposerDraft> {\n  await authorizeHumanSessionCommand(deps, context, \"session.composer.read\");\n  const row = await withWorkspaceSubjectRls(\n    deps.db,\n    context.workspaceId,\n    context.subjectId,\n    (scoped) =>\n      getComposerDraftInTransaction(scoped, {\n        workspaceId: context.workspaceId,\n        sessionId: context.sessionId,\n        subjectId: context.subjectId,\n      }),\n  );\n  const mapped = composerDraft(row);\n  if (mapped) return mapped;\n  const session = await getSession(deps.db, context.workspaceId, context.sessionId);\n  if (!session) throw new Error(`Session not found: ${context.sessionId}`);\n  return {\n    revision: 0,\n    text: \"\",\n    annotations: [],\n    resources: [],\n    model: session.model,\n    reasoningEffort: reasoningEffortForMetadata(session.metadata, \"medium\"),\n    latencyMode: latencyModeForMetadata(session.metadata, \"standard\"),\n    sourceTurnId: null,\n    sourceTurnVersion: null,\n    updatedAt: null,\n  };\n}\n\nexport async function saveHumanComposerDraft(\n  deps: SessionAuthorizationCommandDeps,\n  context: HumanSessionCommandContext,\n  input: SaveComposerDraftRequest,\n): Promise<ComposerDraft> {\n  await authorizeHumanSessionCommand(deps, context, \"session.composer.write\");\n  const annotations = await validateDraftTimelineAnnotations(\n    deps.db,\n    context.workspaceId,\n    context.sessionId,\n    input.annotations ?? [],\n  );\n  const row = await withWorkspaceSubjectRls(\n    deps.db,\n    context.workspaceId,\n    context.subjectId,\n    (scoped) =>\n      scoped.transaction((tx) =>\n        saveComposerDraftInTransaction(tx as unknown as Database, {\n          ...context,\n          ...input,\n          annotations,\n          resources: normalizeResources(input.resources),\n          subjectId: context.subjectId,\n        }),\n      ),\n  );\n  return composerDraft(row)!;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACO,IAAM,+CACX;AACK,IAAM,iDACX;AACK,IAAM,6CAA6C;AAQnD,IAAM,mDAAmD;;;ACHzD,IAAM,sDAAsD,KAAK,KAAK;AAgCtE,IAAM,4BAAN,cAAwC,MAAM;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,OAKT;AACD,UAAM,MAAM,OAAO;AACnB,SAAK,OAAO;AACZ,SAAK,OAAO,MAAM;AAClB,SAAK,SAAS,MAAM,UAAU,yBAAyB,MAAM,IAAI;AACjE,SAAK,YAAY,MAAM,aAAa;AAAA,EACtC;AACF;AAEO,SAAS,yBAAyB,MAAmC;AAC1E,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL;AACE,aAAO;AAAA,EACX;AACF;AAiEO,SAAS,kBAAkB,UAA0B;AAC1D,SAAO,SAAS,KAAK,EAAE,YAAY;AACrC;AAEO,SAAS,mBAAmB,UAAkB,UAAsC;AACzF,QAAM,aAAa,kBAAkB,QAAQ;AAC7C,MAAI,SAAS,KAAK,CAAC,cAAc,kBAAkB,SAAS,MAAM,UAAU,GAAG;AAC7E,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,WAAW,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAAK;AACjD,SAAO,SAAS,KAAK,CAAC,cAAc;AAClC,UAAM,UAAU,kBAAkB,SAAS;AAC3C,WAAO,YAAY,QAAQ,QAAQ,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,MAAM;AAAA,EAC/D,CAAC;AACH;AAEO,SAAS,oBAAoB,UAA0B;AAC5D,QAAM,OAAO,kBAAkB,QAAQ,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK;AAC1D,UAAQ,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL;AACE,aAAO;AAAA,EACX;AACF;;;AC5KA;AAAA,EACE,iBAAAA;AAAA,EACA,cAAAC;AAAA,EACA;AAAA,EACA,qBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAEP;AAAA,EACE,kBAAAC;AAAA,EACA,yBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAMK;;;ACzBP,SAAS,wCAAuD;AAChE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,8BAA6C;AACtD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAYK;AAoBA,SAAS,wBAAwB,UAA2C;AACjF,QAAM,MAAM,SAAS,oBAAoB,KAAK;AAC9C,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,MACL,MAAM;AAAA,MACN,MAAM;AAAA,MACN,KAAK;AAAA,MACL,MAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,SAAS,KAAK,IAAI,MAAM,SAAS,GAAG,EAAE;AAC9D,UAAM,MAAM,IAAI,aAAa,UAAU,IAAI,aAAa;AACxD,UAAM,OAAO,IAAI,OAAO,OAAO,IAAI,IAAI,IAAI,MAAM,MAAM;AAEvD,UAAM,OAAO,IAAI,YAAY,IAAI,aAAa,MAAM,IAAI,WAAW;AACnE,WAAO,EAAE,MAAM,IAAI,UAAU,MAAM,KAAK,KAAK;AAAA,EAC/C,QAAQ;AACN,WAAO,EAAE,MAAM,KAAK,MAAM,KAAK,KAAK,MAAM,MAAM,UAAU;AAAA,EAC5D;AACF;AAYO,SAAS,0BAA0B,UAA4B;AACpE,MAAI,CAAC,SAAS,oBAAoB,KAAK,EAAG,QAAO;AACjD,QAAM,EAAE,MAAM,MAAM,KAAK,KAAK,IAAI,wBAAwB,QAAQ;AAClE,QAAM,SAAS,MAAM,QAAQ;AAC7B,QAAM,cAAc,MAAM,MAAM;AAChC,QAAM,YAAY,SAAS,cAAc,OAAO,GAAG,IAAI,IAAI,IAAI;AAC/D,SAAO,GAAG,MAAM,MAAM,SAAS,GAAG,IAAI;AACxC;AAEA,SAAS,kBAAkB,KAA6C;AACtE,SAAO,MACL,IAAI,eAAe,YAAmD;AACpE,QAAI,CAAC,KAAK;AACR,aAAO;AAAA,IACT;AACA,WAAO,IAAI,qBAAqB;AAAA,EAClC,CAAC;AACL;AAEA,eAAe,0BACb,UACA,aACA,SAC6C;AAC7C,MACE,SAAS,SAAS,yBAAyB,QAC3C,CAAC,SAAS,KAAK,yBACf,CAAC,QAAQ,cACT;AACA,WAAO;AAAA,EACT;AACA,QAAM,aAAa,MAAM,cAAc,SAAS,IAAI,aAAa,QAAQ,YAAY;AACrF,MAAI,YAAY,aAAa,KAAM,QAAO;AAC1C,SAAO;AAAA,IACL,WAAW,IAAI;AAAA,MACb,YAAY,SAAS,KAAK,wBAAwB,KAAK;AAAA,IACzD;AAAA,EACF;AACF;AAIO,SAAS,eAAe,UAA6B;AAC1D,SAAO,SAAS,6BAA6B;AAC/C;AAQO,SAAS,2BACd,UACA,KAsBA,aAC2B;AAC3B,QAAM,EAAE,IAAI,UAAU,IAAI,IAAI;AAC9B,QAAM,YAAY,IAAI;AACtB,QAAM,iBAAiB,YACnB,OAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF,MAGoD;AAGlD,QACE,QAAQ,cAAc,QACtB,QAAQ,eAAe,UACvB,QAAQ,uBAAuB,QAC/B;AACA,aAAO;AAAA,IACT;AACA,QAAI,QAAQ,gBAAgB,QAAW;AACrC,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AACA,UAAM,kBACJ,UAAU,YAAY,UAClB,MAAM,gDAAgD,UAAU,QAAQ,OAAO,IAC/E;AACN,UAAM,YAAY,MAAM,2CAA2C,IAAI;AAAA,MACrE,WAAW,IAAI;AAAA,MACf,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf,WAAW,IAAI,cAAc;AAAA,MAC7B,UAAU,IAAI,cAAc;AAAA,MAC5B,gBAAgB,UAAU;AAAA,MAC1B,eAAe,QAAQ;AAAA,MACvB,oBAAoB,QAAQ;AAAA,MAC5B,eAAe,QAAQ;AAAA,MACvB,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,iCAAiC,QAAQ;AAAA,MACxD,GAAI,SAAS,aAAa,EAAE,YAAY,SAAS,WAAW,IAAI,CAAC;AAAA,IACnE,CAAC;AACD,WAAO,EAAE,WAAW,gBAAgB;AAAA,EACtC,IACA;AACJ,QAAM,gBAAgB,YAClB,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,MAOqB;AACnB,QAAI,cAAc,KAAM;AACxB,QACE,CAAC,aACD,OAAO,cAAc,YACrB,QAAQ,eAAe,UACvB,QAAQ,uBAAuB,UAC/B,QAAQ,gBAAgB,QACxB;AACA,YAAM,IAAI,MAAM,qEAAqE;AAAA,IACvF;AACA,UAAM,iBAAiB;AACvB,UAAM,iBAAiB,eAAe;AACtC,QACE,CAAC,kBACD,OAAO,eAAe,OAAO,YAC7B,OAAO,eAAe,wBAAwB,YAC9C,EAAE,qBAAqB,iBACvB;AACA,YAAM,IAAI,MAAM,qEAAqE;AAAA,IACvF;AACA,QAAI,YAAY,cAAc,iBAAiB;AAC7C,YAAM,+BAA+B,IAAI;AAAA,QACvC,WAAW,IAAI;AAAA,QACf,aAAa,IAAI;AAAA,QACjB,WAAW,IAAI;AAAA,QACf,WAAW,gBAAgB;AAAA,QAC3B,mBAAmB,gBAAgB;AAAA,QACnC,aAAa,eAAe;AAAA,QAC5B,6BAA6B,eAAe;AAAA,QAC5C,WAAW;AAAA,QACX,iBAAiB,eAAe,mBAAmB;AAAA,QACnD,OAAO;AAAA,UACL,MAAM;AAAA,UACN,WAAW,IAAI,cAAc;AAAA,UAC7B,UAAU,IAAI,cAAc;AAAA,UAC5B,gBAAgB,UAAU;AAAA,UAC1B,eAAe,QAAQ;AAAA,UACvB,oBAAoB,QAAQ;AAAA,UAC5B,eAAe,eAAe;AAAA,UAC9B,YAAY,eAAe;AAAA,QAC7B;AAAA,MACF,CAAC;AACD;AAAA,IACF;AACA,UAAM,wCAAwC,IAAI;AAAA,MAChD,WAAW,IAAI;AAAA,MACf,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf,WAAW,IAAI,cAAc;AAAA,MAC7B,UAAU,IAAI,cAAc;AAAA,MAC5B,gBAAgB,UAAU;AAAA,MAC1B,eAAe,QAAQ;AAAA,MACvB,oBAAoB,QAAQ;AAAA,MAC5B,eAAe,eAAe;AAAA,MAC9B,YAAY,eAAe;AAAA,MAC3B,WAAW;AAAA,MACX,WAAW;AAAA,MACX;AAAA,IACF,CAAC;AAAA,EACH,IACA;AACJ,QAAM,wBAAwB,YAC1B,OAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF,MAKE,MAAM,6CAA6C,IAAI;AAAA,IACrD,WAAW,IAAI;AAAA,IACf,aAAa,IAAI;AAAA,IACjB,WAAW,IAAI;AAAA,IACf,WAAW,QAAQ;AAAA,IACnB,WAAW;AAAA,IACX,eAAe,iCAAiC,QAAQ;AAAA,IACxD,GAAI,SAAS,aAAa,EAAE,YAAY,SAAS,WAAW,IAAI,CAAC;AAAA,EACnE,CAAC,IACH;AACJ,QAAM,uBAAuB,YACzB,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,MAOqB;AACnB,QACE,CAAC,aACD,OAAO,cAAc,YACrB,OAAQ,UAAyD,OAAO,YACxE,OAAQ,UAAyD,wBAC/D,UACF;AACA,YAAM,IAAI,MAAM,qEAAqE;AAAA,IACvF;AACA,UAAM,wCAAwC,IAAI;AAAA,MAChD,WAAW,IAAI;AAAA,MACf,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA,WAAW;AAAA,MACX;AAAA,IACF,CAAC;AAAA,EACH,IACA;AACJ,QAAM,gBAAgB,YAClB,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF,MAIqB;AACnB,QACE,QAAQ,cAAc,QACtB,QAAQ,eAAe,UACvB,QAAQ,uBAAuB,UAC/B,QAAQ,gBAAgB,QACxB;AACA;AAAA,IACF;AACA,UAAM,UAAU,MAAM,mBAAmB,IAAI;AAAA,MAC3C,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf,WAAW,QAAQ;AAAA,IACrB,CAAC;AACD,QACE,CAAC,WACD,QAAQ,sBAAsB,QAAQ,qBACtC,QAAQ,oBAAoB,QAAQ,QACpC,QAAQ,uBAAuB,QAAQ,sBACvC,QAAQ,eAAe,QAAQ,cAC/B,QAAQ,eAAe,QAAQ,cAAc,OAAO,SAAS,aAC7D,QAAQ,kBAAkB,QAAQ,aAClC,QAAQ,eAAe,QAAQ,aAC/B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,sBAAsB,IAAI;AAAA,MAC9B,WAAW,IAAI;AAAA,MACf,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf,WAAW,QAAQ;AAAA,MACnB,UAAU,kCAAkC,OAAO;AAAA,MACnD,SAAS,MAAM;AAAA,MACf,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,MACd,aAAa,SAAS;AAAA,IACxB,CAAC;AAAA,EACH,IACA;AACJ,QAAM,WAAW,0BAA0B;AAAA,IACzC,aAAa,IAAI;AAAA,IACjB,gBAAgB,YAAY;AAAA,IAC5B,aAAa,YAAY;AAAA,IACzB,YAAY,OAAO,cAA+C;AAChE,YAAM,UAAU,MAAM,WAAW,IAAI,IAAI,aAAa,SAAS;AAC/D,aAAO,UACH;AAAA,QACE,IAAI,QAAQ;AAAA,QACZ,MAAM,QAAQ;AAAA,QACd,MAAM,QAAQ;AAAA,QACd,cAAc,QAAQ;AAAA,MACxB,IACA;AAAA,IACN;AAAA,IACA,mBAAmB,kBAAkB,GAAG;AAAA,IACxC,2BAA2B,CAAC,YAC1B,0BAA0B,UAAU,IAAI,aAAa,OAAO;AAAA,IAC9D,OAAO,wBAAwB,QAAQ;AAAA,IACvC,qBAAqB,SAAS;AAAA,IAC9B,yBAAyB,SAAS;AAAA,IAClC,GAAI,IAAI,mBACJ;AAAA,MACE,kBAAkB;AAAA,QAChB,WAAW,IAAI,iBAAiB;AAAA,QAChC,OAAO,IAAI,iBAAiB;AAAA,QAC5B,SAAS,YAAY;AAAA,MACvB;AAAA,IACF,IACA,CAAC;AAAA,IACL,GAAI,YACA;AAAA,MACE,uBAAuB,aAAa;AAAA,QAClC,SAAS,YAAY;AAAA,QACrB,WAAW;AAAA,QACX,MAAM,YAAY;AAAA,QAClB,YAAY,UAAU;AAAA,QACtB,oBAAoB,UAAU;AAAA,MAChC;AAAA,IACF,IACA,CAAC;AAAA,EACP,CAAC;AAED,QAAM,QAAQ,IAAI,sBAAsB;AAAA,IACtC,iBAAiB;AAAA,MACf,SAAS,YAAY;AAAA,MACrB,WAAW;AAAA,MACX,MAAM,YAAY;AAAA,MAClB,GAAI,YACA;AAAA,QACE,YAAY,UAAU;AAAA,QACtB,oBAAoB,UAAU;AAAA,MAChC,IACA,CAAC;AAAA,IACP;AAAA,IACA,aAAa,YAAY;AACvB,UAAI,CAAC,eAAe,QAAQ,GAAG;AAC7B,eAAO,EAAE,iBAAiB,MAAM,aAAa,EAAE;AAAA,MACjD;AACA,YAAM,UAAU,MAAM,kBAAkB,IAAI,IAAI,aAAa,IAAI,SAAS;AAC1E,aAAO,WAAW,EAAE,iBAAiB,MAAM,aAAa,EAAE;AAAA,IAC5D;AAAA,IACA,sBAAsB;AAAA,IACtB,GAAI,SAAS,qBAAqB,EAAE,aAAa,SAAS,mBAAmB,IAAI,CAAC;AAAA,IAClF,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,IAC3C,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA,IACzC,GAAI,wBAAwB,EAAE,sBAAsB,IAAI,CAAC;AAAA,IACzD,GAAI,uBAAuB,EAAE,qBAAqB,IAAI,CAAC;AAAA,IACvD,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA,IACzC,GAAI,YACA;AAAA,MACE,uBAAuB,OAAO,EAAE,MAAM,MAA0B;AAC9D,YAAI,CAAC,2CAA2C,UAAU,SAAS,KAAK,EAAG,QAAO;AAClF,cAAM,SAAS,MAAM,0BAA0B,IAAI;AAAA,UACjD,WAAW,IAAI;AAAA,UACf,aAAa,IAAI;AAAA,UACjB,gBAAgB,UAAU;AAAA,UAC1B,eAAe,UAAU;AAAA,UACzB,oBAAoB,UAAU;AAAA,UAC9B,YAAY;AAAA,QACd,CAAC;AACD,YAAI,OAAO,WAAW,YAAY,KAAK;AACrC,gBAAM,uBAAuB,IAAI,KAAK,IAAI,aAAa,IAAI,WAAW;AAAA,YACpE;AAAA,cACE,MAAM;AAAA,cACN,SAAS,EAAE,WAAW,UAAU,WAAW;AAAA,YAC7C;AAAA,UACF,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,QAC1B;AACA,cAAM,QAAQ,OAAO;AACrB,cAAM,UAAU,OAAO,SAAS,QAAQ;AACxC,eAAO;AAAA,UACL,YAAY,OAAO,cAAc,UAAU;AAAA,UAC3C,UACE,OAAO,WAAW,UACb,eACD,YAAY,YACT,YACD,YAAY,aACT,aACA;AAAA,QACb;AAAA,MACF;AAAA,IACF,IACA,CAAC;AAAA,EACP,CAAC;AAED,SAAO,EAAE,GAAG,aAAa,SAAS,MAAM;AAC1C;;;ADhbA,eAAsB,4BACpB,MACA,KACuB;AACvB,QAAM,UAAU,MAAM,eAAe,KAAK,IAAI,IAAI,aAAa,IAAI,SAAS;AAC5E,SAAO;AAAA,IACL,WAAW,IAAI;AAAA,IACf,aAAa,IAAI;AAAA,IACjB,WAAW,IAAI;AAAA,IACf,gBAAgB,QAAQ;AAAA,IACxB,gBAAgB,QAAQ;AAAA,EAC1B;AACF;AAmFA,IAAM,mBAAmB;AAEzB,SAAS,WAAW,KAAuC;AACzD,SAAO,IAAIC,gBAAe,YAAmD;AAC3E,QAAI,CAAC,KAAK;AACR,aAAO;AAAA,IACT;AACA,WAAO,IAAI,qBAAqB;AAAA,EAClC,CAAC;AACH;AAOA,eAAe,gBACb,UACA,aACA,YAC+E;AAC/E,QAAM,EAAE,UAAU,IAAI,IAAI;AAC1B,MAAI,iBAAiB;AACrB,MAAI,WAAW,WAAW,UAAU;AAClC,UAAM,UAAU,IAAI,kBAAkB;AAAA,MACpC;AAAA,MACA,SAAS,WAAW;AAAA,MACpB,YAAY,WAAW,GAAG;AAAA,MAC1B,OAAO,wBAAwB,QAAQ;AAAA,MACvC,WAAW;AAAA,IACb,CAAC;AACD,QAAI;AACF,uBAAiB,MAAM,QAAQ,KAAK;AAAA,IACtC,QAAQ;AACN,uBAAiB;AAAA,IACnB;AAAA,EACF;AACA,QAAM,QAAQ,mBAAmB;AAAA,IAC/B,YAAY;AAAA,MACV,QAAQ,WAAW;AAAA,MACnB,UAAU,WAAW;AAAA,MACrB,oBAAoB,WAAW;AAAA,MAC/B,YAAY,WAAW;AAAA,MACvB,YAAY,WAAW;AAAA,MACvB,eAAe,WAAW;AAAA,MAC1B,mBAAmB,WAAW;AAAA,IAChC;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO,EAAE,UAAU,MAAM,OAAO,WAAW,MAAM,WAAW,YAAY,MAAM,WAAW;AAC3F;AASA,eAAsB,UACpB,UACA,KAC0B;AAC1B,QAAM,EAAE,GAAG,IAAI;AACf,QAAM,UAAW,MAAMC,mBAAkB,IAAI,IAAI,aAAa,IAAI,SAAS,KAAM;AAAA,IAC/E,iBAAiB;AAAA,IACjB,aAAa;AAAA,EACf;AAEA,QAAM,UAA+B,CAAC;AAEtC,MAAI,IAAI,mBAAmB,QAAQ;AAIjC,UAAM,cAAc,QAAQ,oBAAoB;AAChD,UAAM,aAAa,MAAM,UAAU,IAAI,IAAI,aAAa,IAAI,cAAc;AAC1E,UAAM,cAAc;AAAA,MAClB,YAAY,aAAa,UACzB,WAAW,SAAS,SAAS,WAAW,YACxC,WAAW,SAAS,UAAU,WAAW;AAAA,IAC3C;AACA,UAAM,kBAAkB;AAAA,MACtB,eACC,WAAW,aAAa,aACvB,WAAW,SAAS,QAAQ,WAAW,aACvC,WAAW,SAAS,QAAQ,WAAW,eACvC,WAAW,SAAS,QAAQ,WAAW;AAAA,IAC3C;AACA,UAAM,2BAA2B;AAAA,MAC/B,eACC,WAAW,SAAS,QAAQ,WAAW,cACtC,WAAW,SAAS,QAAQ,WAAW,mBACvC,WAAW,SAAS,UAAU,WAAW,cACzC,WAAW,SAAS,UAAU,WAAW;AAAA,IAC7C;AACA,UAAM,6BAAyD,cAC3D,UACA,2BACE,gBACA,kBACE,eACA,IAAI,mBAAmB,eACrB,gBACA;AACV,YAAQ,KAAK;AAAA,MACX,IAAI,IAAI;AAAA,MACR,MAAM,IAAI,mBAAmB,eAAe,eAAe;AAAA,MAC3D,MAAM;AAAA,MACN,UAAU,cAAc,WAAW,kBAAkB,iBAAiB;AAAA,MACtE,QAAQ;AAAA,MACR,gBAAgB;AAAA,MAChB,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,uBAAuB;AAAA,MACvB,gBAAgB,YAAY,SAAS,SAAS,UAAU;AAAA,MACxD,eAAe,YAAY,YAAY;AAAA,MACvC,aAAa,cAAc,aAAa;AAAA,MACxC,eAAe,YAAY,SAAS,QAAQ,UAAU;AAAA,MACtD,eAAe,YAAY,SAAS,QAAQ,UAAU;AAAA,MACtD,iBAAiB,YAAY,SAAS,UAAU,UAAU;AAAA,MAC1D,YAAY,YAAY,cAAc;AAAA,MACtC,YAAY,QAAQ;AAAA,MACpB,qBAAqB,YAAY,uBAAuB;AAAA,MACxD,mBAAmB,YAAY,qBAAqB;AAAA,MACpD,iBAAiB,YAAY,mBAAmB;AAAA,IAClD,CAAC;AAAA,EACH;AAIA,QAAM,YAAY,MAAM,cAAc,IAAI,IAAI,WAAW;AACzD,aAAW,WAAW,WAAW;AAC/B,QAAI,QAAQ,SAAS,gBAAgB,CAAC,QAAQ,cAAc;AAC1D;AAAA,IACF;AACA,UAAM,aAAa,MAAMC,eAAc,IAAI,IAAI,aAAa,QAAQ,YAAY;AAChF,QAAI,CAAC,cAAc,WAAW,WAAW,UAAU;AAGjD;AAAA,IACF;AACA,UAAM,QAAQ,aACV,MAAM,gBAAgB,UAAU,IAAI,aAAa,UAAU,IAC3D,EAAE,UAAU,WAA4B,WAAW,OAAO,YAAY,MAAM;AAChF,YAAQ,KAAK;AAAA,MACX,IAAI,QAAQ;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,QAAQ;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,QAAQ,QAAQ,oBAAoB,QAAQ;AAAA,MAC5C,gBAAgB;AAAA,MAChB,cAAc,QAAQ;AAAA,MACtB,YAAY,MAAM,aAAa;AAAA,MAC/B,uBACE,MAAM,aAAa,WACf,UACA,MAAM,aAAa,iBACjB,eACA;AAAA,MACR,WAAW,MAAM;AAAA,MACjB,YAAY,MAAM;AAAA,MAClB,YAAY,YAAY,cAAc;AAAA,MACtC,gBACE,MAAM,aAAa,WACf,WACA,MAAM,aAAa,iBACjB,YACA;AAAA,MACR,eAAe;AAAA,MACf,aAAa,QAAQ,oBAAoB,QAAQ,KAAK,aAAa;AAAA,MACnE,eAAe;AAAA,MACf,eAAe;AAAA,MACf,iBAAiB,MAAM,aAAa,WAAW,UAAU;AAAA,MACzD,YAAY;AAAA,MACZ,YAAY,QAAQ;AAAA,MACpB,qBAAqB;AAAA,MACrB,mBAAmB;AAAA,MACnB,iBAAiB;AAAA,IACnB,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,iBAAiB,QAAQ;AAAA,IACzB,aAAa,QAAQ;AAAA,IACrB,WAAW;AAAA,EACb;AACF;AAKA,eAAe,cACb,UACA,KACA,QAIA;AAEA,MAAI,WAAW,IAAI,kBAAkB,WAAW,aAAa,WAAW,WAAW;AACjF,QAAI,IAAI,mBAAmB,QAAQ;AACjC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,MAAM;AAAA,MACR;AAAA,IACF;AACA,WAAO,EAAE,IAAI,MAAM,iBAAiB,KAAK;AAAA,EAC3C;AACA,QAAM,UAAU,MAAMC,YAAW,SAAS,IAAI,IAAI,aAAa,MAAM;AACrE,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,WAAW,MAAM;AAAA,MACzB,MAAM;AAAA,IACR;AAAA,EACF;AAQA,QAAM,gBAAgB,2BAA2B;AAAA,IAC/C,MAAM,QAAQ;AAAA,IACd,gBAAgB;AAAA,EAClB,CAAC;AACD,MAAI,CAAC,cAAc,IAAI;AACrB,WAAO,EAAE,IAAI,OAAO,QAAQ,cAAc,QAAQ,MAAM,cAAc,KAAK;AAAA,EAC7E;AACA,MAAI,QAAQ,SAAS,cAAc;AACjC,QAAI,CAAC,QAAQ,cAAc;AACzB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,sBAAsB,MAAM;AAAA,QACpC,MAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM,aAAa,MAAMD,eAAc,SAAS,IAAI,IAAI,aAAa,QAAQ,YAAY;AACzF,QAAI,CAAC,YAAY;AACf,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,0BAA0B,MAAM;AAAA,QACxC,MAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,gBAAgB,UAAU,IAAI,aAAa,UAAU;AACzE,QAAI,MAAM,aAAa,UAAU;AAC/B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,WAAW,MAAM,OAAO,MAAM,QAAQ;AAAA,QAC9C,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,iBAAiB,QAAQ,GAAG;AACjD;AAUA,eAAsB,kBACpB,UACA,KACA,QAIA,YAC0B;AAC1B,QAAM,WAAW,MAAM,cAAc,UAAU,KAAK,MAAM;AAC1D,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,UAAW,MAAMD,mBAAkB,SAAS,IAAI,IAAI,aAAa,IAAI,SAAS,KAAM;AAAA,MACxF,iBAAiB;AAAA,MACjB,aAAa;AAAA,IACf;AAGA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,iBAAiB,QAAQ;AAAA,MACzB,aAAa,QAAQ;AAAA,MACrB,QAAQ,SAAS;AAAA,MACjB,MAAM,SAAS;AAAA,IACjB;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,SAAS,oBAAoB,QAAQ,SAAS,yBAAyB;AACzE,QAAI;AACF,sBAAgB,MAAM,SAAS,wBAAwB,GAAG;AAAA,IAC5D,SAAS,OAAO;AACd,YAAM,QAAQ,MAAM,UAAU,SAAS,IAAI,IAAI,aAAa,IAAI,cAAc;AAC9E,YAAM,UAAU,OAAO,SAAS,QAAQ;AACxC,YAAM,OACJ,YAAY,aACP,sBACD,YAAY,kBACT,2BACA;AACT,YAAM,UAAW,MAAMA,mBAAkB,SAAS,IAAI,IAAI,aAAa,IAAI,SAAS,KAAM;AAAA,QACxF,iBAAiB;AAAA,QACjB,aAAa;AAAA,MACf;AACA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,iBAAiB,QAAQ;AAAA,QACzB,aAAa,QAAQ;AAAA,QACrB,QACE,iBAAiB,QACb,MAAM,UACN;AAAA,QACN;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AAGF,aAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,YAAMG,WAAW,MAAMH,mBAAkB,SAAS,IAAI,IAAI,aAAa,IAAI,SAAS,KAAM;AAAA,QACxF,iBAAiB;AAAA,QACjB,aAAa;AAAA,MACf;AAIA,YAAM,SAAS,MAAM,iBAAiB,SAAS,IAAI;AAAA,QACjD,WAAW,IAAI;AAAA,QACf,aAAa,IAAI;AAAA,QACjB,WAAW,IAAI;AAAA,QACf,iBAAiB,SAAS;AAAA,QAC1B,eAAeG,SAAQ;AAAA,QACvB,GAAI,eAAe,SAAY,EAAE,WAAW,IAAI,CAAC;AAAA,MACnD,CAAC;AACD,UAAI,OAAO,WAAW,OAAO,SAAS;AACpC,eAAO;AAAA,UACL,SAAS;AAAA,UACT,iBAAiB,OAAO,QAAQ;AAAA,UAChC,aAAa,OAAO,QAAQ;AAAA,QAC9B;AAAA,MACF;AAAA,IAEF;AACA,UAAM,UAAW,MAAMH,mBAAkB,SAAS,IAAI,IAAI,aAAa,IAAI,SAAS,KAAM;AAAA,MACxF,iBAAiB;AAAA,MACjB,aAAa;AAAA,IACf;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,iBAAiB,QAAQ;AAAA,MACzB,aAAa,QAAQ;AAAA,MACrB,QAAQ;AAAA,MACR,MAAM;AAAA,IACR;AAAA,EACF,UAAE;AAIA,UAAM,eAAe,QAAQ,EAAE,MAAM,MAAM,MAAS;AAAA,EACtD;AACF;AA4CA,eAAsB,8BACpB,SACA,QACA,IACsB;AACtB,QAAM,UAAU,IAAI,kBAAkB;AAAA,IACpC,aAAa,QAAQ;AAAA,IACrB,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ;AAAA,IACpB,OAAO,QAAQ;AAAA,IACf,WAAW,QAAQ;AAAA,IACnB,eAAe,QAAQ;AAAA,IACvB,GAAI,QAAQ,aAAa,SAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,EACzE,CAAC;AAED,MAAI;AACF,QAAI,GAAG,SAAS,QAAQ;AACtB,YAAM,aAAa,QAAQ;AAC3B,YAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,QAC7B,KAAK,GAAG;AAAA,QACR,GAAI,GAAG,UAAU,EAAE,SAAS,GAAG,QAAQ,IAAI,CAAC;AAAA,MAC9C,CAAC;AACD,YAAM,WAAW,IAAI,aAAa;AAClC,YAAM,kBAAkB,IAAI,aAAa;AACzC,aAAO;AAAA,QACL;AAAA,QACA,MAAM;AAAA;AAAA;AAAA;AAAA,QAIN,IAAI,CAAC,YAAY;AAAA,QACjB,QAAQ,IAAI;AAAA,QACZ,QAAQ,IAAI;AAAA,QACZ,UAAU,IAAI;AAAA,QACd;AAAA,QACA;AAAA,QACA,GAAI,WACA,EAAE,QAAQ,wBAAwB,UAAU,yBAAyB,IACrE,CAAC,kBACC,EAAE,QAAQ,yCAAyC,IACnD,CAAC;AAAA,MACT;AAAA,IACF;AACA,QAAI,GAAG,SAAS,QAAQ;AACtB,YAAM,QAAQ,MAAM,QAAQ,SAAS,EAAE,MAAM,GAAG,KAAK,CAAC;AACtD,aAAO,EAAE,QAAQ,MAAM,QAAQ,IAAI,MAAM,SAAS,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AAAA,IACpF;AACA,UAAM,eAAe,MAAM,QAAQ,UAAU,EAAE,MAAM,GAAG,MAAM,SAAS,GAAG,QAAQ,CAAC;AACnF,WAAO,EAAE,QAAQ,MAAM,SAAS,IAAI,MAAM,aAAa;AAAA,EACzD,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,WAAO;AAAA,MACL;AAAA,MACA,MAAM,GAAG;AAAA,MACT,IAAI;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA,GAAI,GAAG,SAAS,SAAS,EAAE,YAAY,QAAQ,wBAAwB,IAAI,CAAC;AAAA,IAC9E;AAAA,EACF,UAAE;AAIA,UAAM,QAAQ,oBAAoB,EAAE,MAAM,MAAM,MAAS;AAAA,EAC3D;AACF;AAWA,eAAsB,aACpB,UACA,KACA,QACA,IACsB;AACtB,QAAM,UAAU,MAAME,YAAW,SAAS,IAAI,IAAI,aAAa,MAAM;AACrE,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,MACL;AAAA,MACA,MAAM,GAAG;AAAA,MACT,IAAI;AAAA,MACJ,QAAQ,WAAW,MAAM;AAAA,IAC3B;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,gBAAgB,CAAC,QAAQ,cAAc;AAC1D,WAAO;AAAA,MACL;AAAA,MACA,YAAY,QAAQ;AAAA,MACpB,MAAM,GAAG;AAAA,MACT,IAAI;AAAA,MACJ,QAAQ,8DAA8D,QAAQ,IAAI;AAAA,IACpF;AAAA,EACF;AACA,QAAM,aAAa,MAAMD,eAAc,SAAS,IAAI,IAAI,aAAa,QAAQ,YAAY;AACzF,MAAI,CAAC,cAAc,WAAW,WAAW,UAAU;AACjD,WAAO;AAAA,MACL;AAAA,MACA,YAAY,QAAQ;AAAA,MACpB,MAAM,GAAG;AAAA,MACT,IAAI;AAAA,MACJ,QAAQ,WAAW,MAAM;AAAA,IAC3B;AAAA,EACF;AAEA,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,MACE,aAAa,IAAI;AAAA,MACjB,SAAS,QAAQ;AAAA,MACjB,YAAY,WAAW,SAAS,GAAG;AAAA,MACnC,OAAO,wBAAwB,SAAS,QAAQ;AAAA,MAChD,kBAAkB,SAAS,SAAS;AAAA,MACpC,eAAe,SAAS,SAAS;AAAA,MACjC,GAAI,SAAS,SAAS,yBAAyB,QAC/C,WAAW,aAAa,QACxB,SAAS,KAAK,wBACV;AAAA,QACE,UAAU;AAAA,UACR,WAAW,IAAIG;AAAA,YACb,YAAY,SAAS,KAAK,wBAAwB,KAAK;AAAA,UACzD;AAAA,QACF;AAAA,MACF,IACA,CAAC;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,EAAE,GAAG,QAAQ,YAAY,QAAQ,KAAK;AAC/C;AAsBA,eAAsB,iBACpB,UACA,KACA,OAC0B;AAC1B,MAAI,MAAM,SAAS,cAAc;AAC/B,UAAM,QAAQ,SAAS,SAAS,iBAAiB,2BAA2B,QAAQ,QAAQ,EAAE;AAC9F,WAAO;AAAA,MACL,MAAM;AAAA,MACN,cACE;AAAA;AAAA;AAAA;AAAA;AAAA,MAKF,oBAAoB,cAAc,IAAI;AAAA,MACtC,uBAAuB,OAAO,IAAI;AAAA,MAClC,iBAAiB,GAAG,IAAI;AAAA,MACxB,MAAM;AAAA,IACR;AAAA,EACF;AAKA,QAAM,EAAE,cAAc,IAAI,MAAM,OAAO,cAAc;AACrD,QAAM,UAAU,MAAM,cAAc,SAAS,IAAI;AAAA,IAC/C,WAAW,IAAI;AAAA,IACf,aAAa,IAAI;AAAA,IACjB,MAAM;AAAA,IACN,MAAM,MAAM,MAAM,KAAK,KAAK;AAAA,EAC9B,CAAC;AACD,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,MAAM;AAAA,EACR;AACF;;;AE9wBA,SAAS,yCAAwD;AACjE;AAAA,EACE;AAAA,OAKK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,SAAS,qBAAqB;AAI9B,IAAM,eAAe;AACrB,IAAM,yBAAyB,oBAAI,QAAgD;AAQnF,eAAsB,qBAAqB,GAAY,MAA0C;AAC/F,MAAI,UAAU,uBAAuB,IAAI,EAAE,IAAI,GAAG;AAClD,MAAI,CAAC,SAAS;AACZ,cAAU,qBAAqB,GAAG,IAAI;AACtC,2BAAuB,IAAI,EAAE,IAAI,KAAK,OAAO;AAAA,EAC/C;AACA,QAAM,UAAU,MAAM;AACtB,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,cAAc,KAAK,EAAE,SAAS,0BAA0B,CAAC;AAAA,EACrE;AACA,SAAO;AACT;AAEA,eAAsB,mBACpB,GACA,MACA,aACA,YACsB;AACtB,UAAQ,MAAM,gCAAgC,GAAG,MAAM,aAAa,UAAU,GAAG;AACnF;AASO,SAAS,oCACd,SACA,OAC0B;AAC1B,QAAM,wBAAwB,QAAQ,cAAc;AAAA,IAClD,CAAC,cAAc,UAAU,cAAc,MAAM;AAAA,EAC/C;AACA,QAAM,YAAY,MAAM,UAAU,cAAc;AAChD,QAAM,mBACJ,QAAQ,cAAc,MAAM,aAC5B,QAAQ,cAAc,MAAM,CAAC,cAAc,UAAU,cAAc,QAAQ,SAAS,KACpF,QAAQ,gBAAgB;AAAA,IACtB,CAAC,cACC,UAAU,cAAc,QAAQ,aAChC,UAAU,kBAAkB,MAAM,iBACjC,UAAU,UAAU,cAAc,SAAU,aAC7C,QAAQ,UAAU,gBAAgB,MAAM,QAAQ,MAAM,gBAAgB,KACtE,QAAQ,UAAU,uBAAuB,MAAM,QAAQ,MAAM,uBAAuB,KACpF,QAAQ,cAAc;AAAA,MACpB,CAAC,iBAAiB,aAAa,cAAc,UAAU;AAAA,IACzD,EAAE,WAAW;AAAA,EACjB,KACA,sBAAsB,WAAW,KACjC,sBAAsB,CAAC,GAAG,cAAc,QAAQ;AAClD,SAAO;AAAA,IACL;AAAA,IACA,cAAc,mBAAmB,sBAAsB,CAAC,IAAK;AAAA,IAC7D,wBAAwB,QAAQ;AAAA,IAChC;AAAA,EACF;AACF;AAEA,eAAsB,gCACpB,GACA,MACA,aACA,YACmC;AACnC,QAAM,UAAU,MAAM,qBAAqB,GAAG,IAAI;AAClD,QAAM,gBAAgB,gCAAgC,OAAO;AAC7D,QAAM,QACJ,QAAQ,gBAAgB,KAAK,CAAC,cAAc,UAAU,gBAAgB,WAAW,KAChF,MAAM;AAAA,IACL,KAAK;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA,gBAAgB,EAAE,cAAc,IAAI;AAAA,EACtC;AACF,MAAI,CAAC,OAAO;AACV,UAAM,YAAY,MAAM,iBAAiB,KAAK,IAAI,WAAW,EAAE,MAAM,MAAM,IAAI;AAC/E,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,cAAc,KAAK,EAAE,SAAS,sBAAsB,CAAC;AAAA,IACjE;AACA,UAAM,IAAI,cAAc,KAAK,EAAE,SAAS,0BAA0B,CAAC;AAAA,EACrE;AACA,MAAI,YAAY;AACd,sBAAkB,OAAO,UAAU;AAAA,EACrC;AACA,SAAO,oCAAoC,SAAS,KAAK;AAC3D;AAEA,SAAS,gCAAgC,SAAqD;AAC5F,MAAI,QAAQ,SAAS,aAAa,QAAQ,gBAAgB,WAAW,GAAG;AACtE,WAAO;AAAA,EACT;AACA,SAAO,QAAQ,gBAAgB;AAAA,IAC7B,CAAC,UACC,MAAM,kBAAkB,mBACxB,MAAM,UAAU,cAAc,QAC9B,CAAC,MAAM;AAAA,EACX,IACI,kBACA;AACN;AAEO,SAAS,kBAAkB,OAAoB,YAA8B;AAClF,MAAI,CAAC,cAAc,MAAM,aAAa,UAAU,GAAG;AACjD,QAAI,eAAe,qBAAqB;AACtC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,eAAe,wBAAwB;AACzC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,SAAS,uBAAuB,UAAU;AAAA,IAC5C,CAAC;AAAA,EACH;AACF;AAQO,SAAS,yBAAyB,OAAoB,YAA8B;AACzF,MAAI,CAAC,qBAAqB,MAAM,aAAa,UAAU,GAAG;AACxD,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,SAAS,+BAA+B,UAAU;AAAA,IACpD,CAAC;AAAA,EACH;AACF;AAEO,SAAS,qBAAqB,aAA2B,YAAiC;AAC/F,SAAO,YAAY,SAAS,UAAU;AACxC;AAEO,SAAS,cAAc,aAA2B,YAAiC;AACxF,MAAI,eAAe,gBAAgB;AACjC,WAAO,YAAY,SAAS,cAAc;AAAA,EAC5C;AACA,QAAM,UAAqD;AAAA,IACzD,qBAAqB,CAAC,kBAAgC;AAAA,IACtD,wBAAwB,CAAC,qBAAmC;AAAA,IAC5D,sBAAsB;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,sBAAsB;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,uBAAuB,CAAC,wBAAwB,qBAAmC;AAAA,IACnF,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,iBAAiB,CAAC,wBAAwB,qBAAmC;AAAA,EAC/E;AACA,SACE,YAAY,SAAS,UAAU,MAC9B,QAAQ,UAAU,GAAG,KAAK,CAAC,UAAU,YAAY,SAAS,KAAK,CAAC,KAAK,UACtE,YAAY,SAAS,iBAAiB;AAE1C;AAEA,eAAe,qBAAqB,GAAY,MAAiD;AAC/F,MAAI,KAAK,SAAS,sBAAsB,SAAS;AAC/C,UAAM,YAAY,MAAM,uBAAuB,GAAG,MAAM,OAAO;AAC/D,QAAI,WAAW;AACb,aAAO;AAAA,IACT;AACA,WAAO,MAAM,mBAAmB,KAAK,IAAI;AAAA,MACvC,uBAAuB;AAAA,MACvB,mBAAmB;AAAA,MACnB,aAAa;AAAA,MACb,yBAAyB;AAAA,MACzB,qBAAqB;AAAA,MACrB,eAAe;AAAA,MACf,WAAW;AAAA,MACX,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,MAAI,KAAK,SAAS,sBAAsB,cAAc;AACpD,UAAM,YAAY,MAAM,uBAAuB,GAAG,MAAM,YAAY;AACpE,QAAI,WAAW;AACb,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM,oBAAoB,GAAG,MAAM,YAAY;AAC9D,QAAI,QAAQ;AACV,aAAO;AAAA,IACT;AACA,QAAI,KAAK,SAAS,kBAAkB;AAClC,aAAO;AAAA,IACT;AACA,WAAO,MAAM,mBAAmB,KAAK,IAAI;AAAA,MACvC,uBAAuB;AAAA,MACvB,mBAAmB;AAAA,MACnB,aAAa;AAAA,MACb,yBAAyB;AAAA,MACzB,qBAAqB;AAAA,MACrB,eAAe;AAAA,MACf,WAAW,kBAAkB,CAAC;AAAA,MAC9B,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,YAAY,CAAC;AAC5B,MAAI,QAAQ;AACV,UAAM,YAAY,MAAM,uBAAuB,GAAG,MAAM,WAAW,MAAM;AACzE,QAAI,WAAW;AACb,aAAO;AAAA,IACT;AACA,UAAM,SAAS,MAAM,oBAAoB,GAAG,MAAM,SAAS;AAC3D,QAAI,QAAQ;AACV,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,KAAK,aAAa;AACpB,UAAM,UAAU,MAAM,kBAAkB,GAAG,KAAK,aAAa,EAAE,IAAI,KAAK,GAAG,CAAC;AAC5E,QAAI,SAAS,MAAM;AACjB,aAAO,MAAM,2BAA2B,KAAK,IAAI;AAAA,QAC/C,QAAQ,QAAQ,KAAK;AAAA,QACrB,OAAO,QAAQ,KAAK;AAAA,QACpB,MAAM,QAAQ,KAAK;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAe,oBACb,GACA,MACA,MAC+B;AAC/B,QAAM,SAAS,YAAY,CAAC;AAC5B,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AACA,QAAM,SAAS,MAAM,uBAAuB,KAAK,IAAI,MAAM,UAAU,MAAM,CAAC;AAC5E,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AACA,QAAM,YAAY,WAAW,OAAO,EAAE;AACtC,QAAM,qBAAqB,OAAO,cAC9B,OAAO,YAAY;AAAA,IACjB,CAAC,eAAe,eAAe,kBAAkB,eAAe;AAAA,EAClE,IACA,OAAO;AACX,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,cAAc,OAAO;AAAA,IACrB,eAAe;AAAA,MACb;AAAA,QACE,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,cAAc,OAAO;AAAA,QACrB,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,iBAAiB,OAAO,cACpB;AAAA,MACE;AAAA,QACE,aAAa,OAAO;AAAA,QACpB,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,cAAc,OAAO;AAAA,QACrB,aAAa,OAAO;AAAA,QACpB,eAAe;AAAA,MACjB;AAAA,IACF,IACA,CAAC;AAAA,IACL,kBAAkB,OAAO;AAAA,IACzB,oBAAoB,OAAO;AAAA,EAC7B;AACF;AAEA,eAAe,uBACb,GACA,MACA,MACA,QAAQ,YAAY,CAAC,GACU;AAC/B,QAAM,mBAAmB,kCAAkC,KAAK,QAAQ;AACxE,MAAI,CAAC,SAAS,CAAC,kBAAkB;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,2BAA2B,kBAAkB,KAAK;AACxE,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL;AAAA,IACA,WAAW,QAAQ;AAAA,IACnB,GAAI,QAAQ,eAAe,EAAE,cAAc,QAAQ,aAAa,IAAI,CAAC;AAAA,IACrE,eAAe;AAAA,MACb;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,WAAW,QAAQ;AAAA,QACnB,GAAI,QAAQ,eAAe,EAAE,cAAc,QAAQ,aAAa,IAAI,CAAC;AAAA,QACrE,aAAa,QAAQ;AAAA,MACvB;AAAA,IACF;AAAA,IACA,iBAAiB;AAAA,MACf;AAAA,QACE,aAAa,QAAQ;AAAA,QACrB,WAAW,QAAQ;AAAA,QACnB,WAAW,QAAQ;AAAA,QACnB,GAAI,QAAQ,eAAe,EAAE,cAAc,QAAQ,aAAa,IAAI,CAAC;AAAA,QACrE,aAAa,QAAQ;AAAA,QACrB,eAAe,QAAQ;AAAA;AAAA;AAAA,QAGvB,UAAU;AAAA,UACR,WAAW;AAAA,UACX,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,UAC5D,GAAI,QAAQ,uBAAuB,SAC/B,EAAE,oBAAoB,QAAQ,mBAAmB,IACjD,CAAC;AAAA,UACL,GAAI,QAAQ,qBAAqB,SAC7B,EAAE,kBAAkB,QAAQ,iBAAiB,IAC7C,CAAC;AAAA,UACL,GAAI,QAAQ,iCAAiC,SACzC,EAAE,8BAA8B,QAAQ,6BAA6B,IACrE,CAAC;AAAA;AAAA;AAAA,UAGL,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,UACnD,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,UAC5D,GAAI,QAAQ,sBACR,EAAE,qBAAqB,QAAQ,oBAAoB,IACnD,CAAC;AAAA,QACP;AAAA,QACA,GAAI,QAAQ,mBAAmB,EAAE,kBAAkB,QAAQ,iBAAiB,IAAI,CAAC;AAAA,QACjF,GAAI,QAAQ,0BACR,EAAE,yBAAyB,QAAQ,wBAAwB,IAC3D,CAAC;AAAA,MACP;AAAA,IACF;AAAA,IACA,kBAAkB,QAAQ;AAAA,IAC1B,oBAAoB,QAAQ;AAAA,EAC9B;AACF;AAEA,SAAS,kBAAkB,GAAoB;AAC7C,QAAM,SAAS,EAAE,IAAI,OAAO,oBAAoB;AAChD,SAAO,UAAU,OAAO,KAAK,EAAE,SAAS,IAAI,cAAc,OAAO,KAAK,CAAC,KAAK;AAC9E;AAEA,SAAS,YAAY,GAA2B;AAC9C,QAAM,gBAAgB,EAAE,IAAI,OAAO,eAAe;AAClD,SAAO,eAAe,WAAW,YAAY,IAAI,cAAc,MAAM,aAAa,MAAM,IAAI;AAC9F;AAEA,eAAe,UAAU,OAAgC;AACvD,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACpF,SAAO,MAAM,KAAK,IAAI,WAAW,MAAM,CAAC,EACrC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE;AACZ;;;ACnZA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAMA,IAAM,+CAA+C;AAErD,IAAM,kCAAN,cAA8C,MAAM;AAAA,EAGzD,YAAqB,QAAgE;AACnF,UAAM,oCAAoC;AADvB;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EALS,OAAO;AAMlB;AAEO,IAAM,uCAAN,cAAmD,MAAM;AAAA,EACrD,OAAO;AAAA,EAEhB,YAAY,SAAwB;AAClC,UAAM,wCAAwC,OAAO;AACrD,SAAK,OAAO;AAAA,EACd;AACF;AAmBA,SAAS,8BAA8B,OAA6B;AAClE,QAAM,uBACJ,MAAM,WAAW,QAAQ,MAAM,UAC/B,MAAM,WAAW,WAAW,MAAM,UAClC,MAAM,WAAW,qBAAqB,MAAM;AAC9C,SAAO,MAAM,gBAAgB,MAAM,kBAAkB,kBAAkB;AACzE;AAQA,IAAM,+BAA+B,oBAAI,IAAmC;AAAA,EAC1E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,6BACP,OACA,uBACA,QACA,WACmB;AACnB,MAAI,OAAO,OAAO,cAAc,MAAM,gBAAiB,QAAO;AAI9D,MAAI,OAAO,oBAAoB,MAAM,gBAAiB,QAAO;AAI7D,MAAI,0BAA0B,OAAO,OAAO,WAAW;AACrD,QAAI,cAAc,oBAAoB,6BAA6B,IAAI,SAAS,GAAG;AACjF,aAAO;AAAA,IACT;AACA,UAAM,IAAI,gCAAgC,WAAW;AAAA,EACvD;AAIA,QAAM,IAAI,gCAAgC,WAAW;AACvD;AAEO,SAAS,gCACd,eACwB;AACxB,SAAO,cAAc,MAAM,SAAS,kBAChC;AAAA,IACE,WAAW,cAAc,MAAM;AAAA,IAC/B,0BAA0B,cAAc,MAAM;AAAA,EAChD,IACA,EAAE,WAAW,cAAc,MAAM,UAAU;AACjD;AAEA,eAAsB,iCACpB,eACA,IACY;AACZ,SAAO,MAAM,2BAA2B,gCAAgC,aAAa,GAAG,EAAE;AAC5F;AAOA,eAAsB,qCACpB,IACA,OACA,iBACwE;AACxE,QAAM,EAAE,MAAM,IAAI,MAAM,iCAAiC,IAAI,KAAK;AAClE,MAAI,MAAM,SAAS,mBAAmB,MAAM,oBAAoB,iBAAiB;AAC/E,UAAM,IAAI,gCAAgC,cAAc;AAAA,EAC1D;AACA,SAAO;AACT;AAaA,eAAsB,4BACpB,MACA,OACA,OAK8C;AAC9C,QAAM,OAAO,KAAK;AAClB,QAAM,iBAAiB,8BAA8B,KAAK;AAC1D,QAAM,CAAC,aAAa,SAAS,IAAI,MAAM,QAAQ,IAAI;AAAA,IACjD,2CAA2C,KAAK,IAAI;AAAA,MAClD,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,8BAA8B,KAAK,IAAI,MAAM,aAAa,MAAM,SAAS;AAAA,EAC3E,CAAC;AAID,MACE,CAAC,QACD,CAAC,kBACD,aAAa,eAAe,aAC5B,WAAW,eAAe,gBAC1B;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,UAAW,OAAM,IAAI,gCAAgC,WAAW;AAErE,QAAM,CAAC,eAAe,cAAc,IAAI,MAAM,QAAQ,IAAI;AAAA,IACxD,iCAAiC,KAAK,IAAI,KAAK;AAAA,IAC/C,kCAAkC,KAAK,IAAI,OAAO,MAAM,SAAS;AAAA,EACnE,CAAC;AACD,QAAM,QAAQ,cAAc;AAC5B,QAAM,SAAS,eAAe;AAC9B,QAAM,4BACJ,MAAM,SAAS,kBACX;AAAA,IACE;AAAA,IACA,cAAc;AAAA,IACd;AAAA,IACA,MAAM;AAAA,EACR,IACA;AAEN,MAAI,UAAU,eAAe,gBAAgB;AAC3C,UAAM,UACJ,UAAU,mBAAmB,SAC5B,MAAM,SAAS,YACZ,MAAM,cAAc,UAAU,iBAC9B,MAAM,6BAA6B,UAAU;AACnD,QAAI,CAAC,QAAS,OAAM,IAAI,gCAAgC,WAAW;AAAA,EACrE;AACA,MAAI,aAAa,eAAe,WAAW;AACzC,UAAM,UACJ,MAAM,SAAS,YACX,MAAM,cAAc,YAAY,kBAChC,MAAM,wBAAwB,OAAO;AAC3C,QAAI,CAAC,QAAS,OAAM,IAAI,gCAAgC,WAAW;AAAA,EACrE;AACA,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,sBAAsB,6BAA6B;AAAA,MACnD,oBAAoB;AAAA,IACtB;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,kBAAc,MAAM,KAAK,iBAAiB;AAAA,MACxC,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,WAAW,MAAM;AAAA,MACjB,SAAS,MAAM;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,IAAI,qCAAqC,EAAE,OAAO,MAAM,CAAC;AAAA,EACjE;AACA,QAAM,SAAS,6BAA6B,UAAU,WAAW;AACjE,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,qCAAqC,EAAE,OAAO,OAAO,MAAM,CAAC;AAAA,EACxE;AACA,MAAI,CAAC,OAAO,KAAK,SAAS;AACxB,UAAM,IAAI,gCAAgC,OAAO,KAAK,MAAM;AAAA,EAC9D;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,sBACE,8BAA8B,WAC1B,WACC,OAAO,KAAK,wBAAwB;AAAA,IAC3C,oBAAoB,OAAO,KAAK,sBAAsB;AAAA,EACxD;AACF;AAGA,eAAsB,qCACpB,MACA,OACA,SAC+C;AAC/C,QAAM,OAAO,KAAK;AAClB,QAAM,iBAAiB,8BAA8B,KAAK;AAC1D,MAAI,CAAC,QAAQ,CAAC,eAAgB,QAAO;AACrC,QAAM,EAAE,MAAM,IAAI,MAAM,iCAAiC,KAAK,IAAI,KAAK;AAGvE,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,KAAK,iBAAiB;AAAA,MACrC,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,IAAI,qCAAqC,EAAE,OAAO,MAAM,CAAC;AAAA,EACjE;AACA,QAAM,SAAS,8BAA8B,UAAU,QAAQ;AAC/D,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,qCAAqC,EAAE,OAAO,OAAO,MAAM,CAAC;AAAA,EACxE;AACA,MAAI,OAAO,KAAK,SAAS,MAAO,QAAO,OAAO;AAC9C,SAAO;AAAA,IACL,MAAM;AAAA,IACN,gBAAgB,CAAC,GAAG,IAAI,IAAI,OAAO,KAAK,cAAc,CAAC;AAAA,IACvD,YAAY,CAAC,GAAG,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC;AAAA,EACjD;AACF;AAEA,eAAe,kCACb,IACA,OACA,WAC6C;AAC7C,QAAM,UAAU,MAAM,WAAW,IAAI,MAAM,aAAa,SAAS;AACjE,MAAI,CAAC,WAAW,QAAQ,cAAc,MAAM,WAAW;AACrD,UAAM,IAAI,gCAAgC,WAAW;AAAA,EACvD;AACA,SAAO;AAAA,IACL,QAAQ,EAAE,WAAW,QAAQ,IAAI,eAAe,QAAQ,cAAc;AAAA,IACtE,iBAAiB,QAAQ;AAAA,EAC3B;AACF;AACA,eAAe,iCACb,IACA,OAC4C;AAC5C,QAAM,kBAAkB,MAAM,WAAW,WAAW;AACpD,QAAM,SAAS,MAAM,WAAW,QAAQ;AACxC,QAAM,YAAY,MAAM,WAAW,WAAW;AAC9C,QAAM,sBAAsB,MAAM,WAAW,qBAAqB;AAClE,QAAM,iBAAiB,8BAA8B,KAAK;AAC1D,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,MACL,OAAO,0BAA0B,MAAM;AAAA,QACrC,MAAM;AAAA,QACN,WAAW,MAAM;AAAA,QACjB,GAAI,MAAM,eAAe,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,MACnE,CAAC;AAAA,MACD,uBAAuB;AAAA,IACzB;AAAA,EACF;AACA,MACE,OAAO,oBAAoB,YAC3B,OAAO,WAAW,YAClB,OAAO,cAAc,YACrB,OAAO,wBAAwB,YAC/B,CAAC,OAAO,cAAc,mBAAmB,KACzC,sBAAsB,GACtB;AACA,UAAM,IAAI,gCAAgC,cAAc;AAAA,EAC1D;AACA,QAAM,CAAC,eAAe,IAAI,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC9C,WAAW,IAAI,MAAM,aAAa,eAAe;AAAA,IACjD,yBAAyB,IAAI,MAAM,aAAa,iBAAiB,SAAS;AAAA,EAC5E,CAAC;AACD,MACE,CAAC,iBACD,cAAc,cAAc,MAAM,aAClC,CAAC,QACD,KAAK,OAAO,UACZ,KAAK,wBAAwB,uBAC7B,cAAc,iBAAiB,KAAK,IACpC;AACA,UAAM,IAAI,gCAAgC,cAAc;AAAA,EAC1D;AACA,SAAO;AAAA,IACL,OAAO,0BAA0B,MAAM;AAAA,MACrC,MAAM;AAAA,MACN,WAAW,MAAM;AAAA,MACjB;AAAA,MACA,qBAAqB,cAAc;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,KAAK;AAAA,MAChB,kBAAkB,KAAK;AAAA,MACvB,0BACE,KAAK,6BACJ,KAAK,UAAU,SAAS,YAAY,KAAK,UAAU,YAAY;AAAA,IACpE,CAAC;AAAA,IACD,uBAAuB,cAAc;AAAA,EACvC;AACF;;;ACxXA,SAAS,mCAAmC;AAQ5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iBAAAC,sBAAqB;AAmB9B,eAAsB,aAAa,MAAyB,OAAuC;AACjG,QAAM,WAAW,MAAM,WAAW,MAAM,KAAK;AAC7C,MAAI,SAAS,SAAS;AACpB;AAAA,EACF;AACA,QAAM,IAAIA,eAAc,SAAS,SAAS,yBAAyB,MAAM,KAAK;AAAA,IAC5E,SAAS,SAAS;AAAA,EACpB,CAAC;AACH;AAEA,eAAsB,WACpB,MACA,OACwB;AAIxB,QAAM,cAAc,MAAM,cACtB,MAAM,kBAAkB;AAAA,IACtB,IAAI,KAAK;AAAA,IACT,UAAU,KAAK;AAAA,IACf,aAAa,MAAM;AAAA,IACnB,OAAO,MAAM;AAAA,EACf,CAAC,IACD;AACJ,QAAM,iBAAiB,MAAM,mBAAmB,MAAM,OAAO,WAAW;AACxE,MAAI,CAAC,eAAe,SAAS;AAC3B,WAAO;AAAA,EACT;AACA,MAAI,KAAK,SAAS,oBAAoB,YAAY,KAAK,SAAS,oBAAoB,WAAW;AAC7F,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,SAAO,MAAM,gBAAgB,MAAM,OAAO,WAAW;AACvD;AAEA,eAAe,mBACb,MACA,OACA,aACwB;AACxB,MAAI,aAAa;AACf,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,MAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,eAAe,MAAM,MAAM,GAAG;AAC5D,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,QAAM,UAAU,MAAM,kBAAkB,KAAK,IAAI,MAAM,SAAS;AAChE,MAAI,QAAQ,gBAAgB,GAAG;AAC7B,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,SAAO,EAAE,SAAS,OAAO,MAAM,wBAAwB,SAAS,gCAAgC;AAClG;AAEA,eAAe,gBACb,MACA,OACA,aACwB;AACxB,QAAM,SAAS,4BAA4B,KAAK,QAAQ;AACxD,MAAI,OAAO,kCAAkC,eAAe,MAAM,MAAM,KAAK,CAAC,aAAa;AACzF,UAAM,OAAO,MAAM,iBAAiB,KAAK,IAAI;AAAA,MAC3C,WAAW,MAAM;AAAA,MACjB,WAAW;AAAA,MACX,OAAO,gBAAgB;AAAA,IACzB,CAAC;AACD,QAAI,QAAQ,OAAO,gCAAgC;AACjD,aAAO;AAAA,QACL;AAAA,QACA,qCAAqC,OAAO,8BAA8B;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACA,UAAQ,MAAM,QAAQ;AAAA,IACpB,KAAK,oBAAoB;AACvB,UAAI,CAAC,OAAO,yBAAyB;AACnC,eAAO,EAAE,SAAS,KAAK;AAAA,MACzB;AACA,YAAM,QAAQ,MAAM,0BAA0B,KAAK,IAAI,MAAM,SAAS;AACtE,aAAO,QAAQ,OAAO,0BAClB,EAAE,SAAS,KAAK,IAChB;AAAA,QACE;AAAA,QACA,4BAA4B,OAAO,uBAAuB;AAAA,MAC5D;AAAA,IACN;AAAA,IACA,KAAK,kBAAkB;AACrB,UAAI,CAAC,OAAO,0BAA0B,CAAC,MAAM,aAAa;AACxD,eAAO,EAAE,SAAS,KAAK;AAAA,MACzB;AACA,YAAM,QAAQ,MAAM,+BAA+B,KAAK,IAAI,MAAM,WAAW;AAC7E,aAAO,QAAQ,OAAO,yBAClB,EAAE,SAAS,KAAK,IAChB;AAAA,QACE;AAAA,QACA,0BAA0B,OAAO,sBAAsB;AAAA,MACzD;AAAA,IACN;AAAA,IACA,KAAK,mBAAmB;AACtB,UAAI,CAAC,OAAO,4BAA4B,CAAC,MAAM,aAAa;AAC1D,eAAO,EAAE,SAAS,KAAK;AAAA,MACzB;AACA,YAAM,QAAQ,MAAM,gCAAgC,KAAK,IAAI,MAAM,WAAW;AAC9E,aAAO,QAAQ,OAAO,2BAClB,EAAE,SAAS,KAAK,IAChB;AAAA,QACE;AAAA,QACA,iCAAiC,OAAO,wBAAwB;AAAA,MAClE;AAAA,IACN;AAAA,IACA,KAAK,eAAe;AAClB,UAAI,CAAC,OAAO,sBAAsB,CAAC,MAAM,UAAU;AACjD,eAAO,EAAE,SAAS,KAAK;AAAA,MACzB;AACA,aAAO,MAAM,YAAY,OAAO,qBAC5B,EAAE,SAAS,KAAK,IAChB;AAAA,QACE;AAAA,QACA,uCAAuC,OAAO,kBAAkB;AAAA,MAClE;AAAA,IACN;AAAA,IACA,KAAK,oBAAoB;AACvB,UAAI,CAAC,OAAO,mCAAmC,CAAC,MAAM,aAAa;AACjE,eAAO,EAAE,SAAS,KAAK;AAAA,MACzB;AACA,YAAM,OAAO,MAAM,iBAAiB,KAAK,IAAI;AAAA,QAC3C,aAAa,MAAM;AAAA,QACnB,WAAW;AAAA,QACX,OAAO,gBAAgB;AAAA,MACzB,CAAC;AACD,YAAM,YAAY,MAAM,YAAY;AACpC,aAAO,OAAO,aAAa,OAAO,kCAC9B,EAAE,SAAS,KAAK,IAChB;AAAA,QACE;AAAA,QACA,oCAAoC,OAAO,+BAA+B;AAAA,MAC5E;AAAA,IACN;AAAA,IACA,KAAK,kBAAkB;AACrB,UAAI,eAAe,CAAC,OAAO,gCAAgC,CAAC,MAAM,aAAa;AAC7E,eAAO,EAAE,SAAS,KAAK;AAAA,MACzB;AACA,YAAM,OAAO,MAAM,iBAAiB,KAAK,IAAI;AAAA,QAC3C,aAAa,MAAM;AAAA,QACnB,WAAW;AAAA,QACX,OAAO,gBAAgB;AAAA,MACzB,CAAC;AACD,YAAM,YAAY,MAAM,YAAY;AACpC,aAAO,OAAO,aAAa,OAAO,+BAC9B,EAAE,SAAS,KAAK,IAChB;AAAA,QACE;AAAA,QACA,gCAAgC,OAAO,4BAA4B;AAAA,MACrE;AAAA,IACN;AAAA,IACA,KAAK,kBAAkB;AACrB,UAAI,CAAC,OAAO,wCAAwC,CAAC,MAAM,aAAa;AACtE,eAAO,EAAE,SAAS,KAAK;AAAA,MACzB;AACA,YAAM,OAAO,MAAM,iBAAiB,KAAK,IAAI;AAAA,QAC3C,aAAa,MAAM;AAAA,QACnB,WAAW;AAAA,QACX,OAAO,gBAAgB;AAAA,MACzB,CAAC;AACD,YAAM,YAAY,MAAM,YAAY;AACpC,aAAO,OAAO,aAAa,OAAO,uCAC9B,EAAE,SAAS,KAAK,IAChB;AAAA,QACE;AAAA,QACA,4CAA4C,OAAO,oCAAoC;AAAA,MACzF;AAAA,IACN;AAAA,EACF;AACF;AAEA,eAAsB,qBACpB,MACA,OAiBe;AACf,QAAM,iBAAiB,KAAK,IAAI;AAAA,IAC9B,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM,aAAa;AAAA,IAC9B,WAAW,MAAM;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,MAAM,MAAM;AAAA,IACZ,oBAAoB,MAAM;AAAA,IAC1B,kBAAkB,MAAM;AAAA,IACxB,WAAW,MAAM,aAAa;AAAA,IAC9B,QAAQ,MAAM,UAAU;AAAA,IACxB,eAAe,MAAM,iBAAiB;AAAA,IACtC,WACE,MAAM,cAAc,MAAM,YAAY,EAAE,MAAM,WAAW,WAAW,MAAM,UAAU,IAAI;AAAA,IAC1F,GAAI,MAAM,mBAAmB,EAAE,kBAAkB,MAAM,iBAAiB,IAAI,CAAC;AAAA,IAC7E,QAAQ,MAAM,UAAU;AAAA,IACxB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,iBAAiB,MAAkC;AAC1D,SAAO,KAAK,SAAS,gBAAgB,YAAY,KAAK,SAAS,oBAAoB;AACrF;AAEA,SAAS,eAAe,QAA8B;AACpD,SACE,WAAW,sBAAsB,WAAW,oBAAoB,WAAW;AAE/E;AAEA,SAAS,QAAQ,MAAc,SAAgC;AAC7D,SAAO,EAAE,SAAS,OAAO,MAAM,QAAQ;AACzC;AAEA,SAAS,kBAAwB;AAC/B,QAAM,MAAM,oBAAI,KAAK;AACrB,SAAO,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe,GAAG,IAAI,YAAY,GAAG,CAAC,CAAC;AACtE;;;AC3QA,SAAS,cAAc;AACvB,SAAS,qCAAqC;AAE9C,SAAS,sCAAqD;AAC9D;AAAA,EACE;AAAA,EACA;AAAA,EACA,yBAAAC;AAAA,EACA;AAAA,OAWK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,qBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,yBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP,SAAS,iBAAAC,sBAAqB;;;ACrD9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAEA,SAAS,wBAAwB,UAAyD;AAC/F,QAAM,SAAS,wBAAwB,UAAU,QAAQ;AACzD,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AASO,SAAS,kBAAkB,YAAyC;AACzE,SACE,WAAW,cAAc,QACzB,WAAW,mBAAmB,0BAC7B,WAAW,SAAS,aAAa,WAAW,SAAS,aACtD,wBAAwB,WAAW,QAAQ,GAAG,mBAAmB;AAErE;AAQO,SAAS,yBACd,UACS;AACT,SACE,UAAU,mBAAmB,yBAC7B,UAAU,oBAAoB;AAElC;AASO,SAAS,+BAA+B,OAI7B;AAChB,QAAM,aAAa,CAAC,SAClB,SAAS,QAAQ,MAAM,UAAU,KAAK,CAAC,YAAY,QAAQ,SAAS,IAAI;AAC1E,MAAI,MAAM,cAAc,MAAM;AAC5B,WAAO,WAAW,MAAM,SAAS,IAAI,MAAM,YAAY;AAAA,EACzD;AACA,MAAI,WAAW,MAAM,QAAQ,GAAG;AAC9B,WAAO,MAAM;AAAA,EACf;AACA,SAAO,MAAM,UAAU,WAAW,IAAI,MAAM,UAAU,CAAC,EAAG,OAAO;AACnE;AAOO,SAAS,yBAEd,aAAqC;AACrC,QAAM,aAAa,CAAC,WAClB,WAAW,WAAW,IAAI,WAAW,iBAAiB,IAAI;AAC5D,SACE,CAAC,GAAG,WAAW,EAAE;AAAA,IACf,CAAC,MAAM,UACL,WAAW,KAAK,MAAM,IAAI,WAAW,MAAM,MAAM,KACjD,MAAM,UAAU,cAAc,KAAK,SAAS,KAC5C,MAAM,GAAG,cAAc,KAAK,EAAE;AAAA,EAClC,EAAE,CAAC,KAAK;AAEZ;;;AD/BA,SAAS,+BAAuD;;;AExDhE,SAAS,kBAAkB;AAE3B;AAAA,EACE;AAAA,EACA;AAAA,OAOK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,kCAAkC;AAC3C,SAAS,iBAAAC,sBAAqB;AAEvB,IAAM,2BAA2B;AAExC,IAAM,sBAAsC;AAAA,EAC1C,IAAI;AAAA,EACJ,MAAM;AAAA,EACN,aACE;AAAA,EACF,MAAM;AAAA,EACN,UAAU;AAAA,EACV,SAAS;AAAA;AAAA;AAAA;AAAA,EAIT,QAAQ,CAAC;AAAA,EACT,YAAY,CAAC;AAAA,EACb,OAAO;AAAA,IACL,EAAE,MAAM,OAAO,IAAI,WAAW;AAAA,IAC9B,EAAE,MAAM,OAAO,IAAI,OAAO;AAAA,EAC5B;AAAA,EACA,YAAY;AAAA,IACV;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,WAAW,CAAC,GAAG;AAAA,MACf,QAAQ,CAAC,cAAc,eAAe,cAAc,gBAAgB;AAAA,MACpE,UAAU;AAAA,MACV,UAAU;AAAA,QACR,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,WAAW,CAAC,QAAQ;AAAA,MACpB,QAAQ,CAAC,YAAY,QAAQ,UAAU,mBAAmB,SAAS;AAAA,MACnE,UAAU;AAAA,MACV,UAAU;AAAA,QACR,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,WAAW,CAAC,UAAU;AAAA,MACtB,QAAQ,CAAC,yBAAyB,uBAAuB;AAAA,MACzD,UAAU;AAAA,MACV,UAAU;AAAA,QACR,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,WAAW,CAAC,aAAa,UAAU;AAAA,MACnC,QAAQ;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,UAAU;AAAA,MACV,UAAU;AAAA,QACR,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,WAAW,CAAC,QAAQ;AAAA,MACpB,QAAQ,CAAC,mBAAmB,YAAY;AAAA,MACxC,UAAU;AAAA,MACV,UAAU;AAAA,QACR,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,WAAW,CAAC,SAAS;AAAA,MACrB,QAAQ;AAAA,QACN;AAAA,QACA;AAAA,MACF;AAAA,MACA,UAAU;AAAA,MACV,UAAU;AAAA,QACR,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,MAAM;AAAA,MACN,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,aACE;AAAA,MACF,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA,wBAAwB;AAAA,IACtB;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,aAAa;AAAA,MACb,iBAAiB;AAAA,QACf,MAAM;AAAA,QACN,UAAU;AAAA,QACV,MAAM;AAAA,QACN,QAAQ;AAAA,MACV;AAAA,MACA,gBAAgB;AAAA,MAChB,sBAAsB;AAAA,IACxB;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,OAAO;AAAA,IACP,oBAAoB;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,QAAQ,CAAC,mBAAmB;AAE3B,SAAS,sBAAwC;AACtD,SAAO;AACT;AAEO,SAAS,kBAAkB,QAAuC;AACvE,SAAO,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,MAAM,KAAK;AACrD;AAEO,SAAS,wBAAwB,QAAyB;AAC/D,SAAO,kBAAkB,MAAM,MAAM;AACvC;AAQA,eAAsB,6BACpB,IACA,aAC2B;AAC3B,QAAM,aAAa,MAAM,mBAAmB,IAAI,WAAW;AAC3D,QAAM,aAAa,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AACvD,QAAM,kBAAkB,WACrB,OAAO,CAAC,iBAAiB,CAAC,WAAW,IAAI,aAAa,KAAK,EAAE,CAAC,EAC9D,QAAQ,CAAC,iBAAiB;AACzB,UAAM,SAAS,eAAe,UAAU,aAAa,IAAI;AACzD,WAAO,OAAO,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC;AAAA,EAC3C,CAAC;AACH,SAAO,CAAC,GAAG,OAAO,GAAG,eAAe;AACtC;AAEA,eAAsB,sBACpB,IACA,aACA,QACgC;AAChC,QAAM,UAAU,kBAAkB,MAAM;AACxC,MAAI,SAAS;AACX,WAAO;AAAA,EACT;AACA,QAAM,eAAe,MAAM,iBAAiB,IAAI,aAAa,MAAM;AACnE,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,EACT;AACA,QAAM,SAAS,eAAe,UAAU,aAAa,IAAI;AACzD,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEO,SAAS,6BAA6B,MAA8B;AACzE,SAAO,WAAW,QAAQ,EAAE,OAAO,WAAW,IAAI,CAAC,EAAE,OAAO,KAAK;AACnE;AAGO,SAAS,uCAAuC,MAA+B;AACpF,SACE,KAAK,WAAW,SAAS,KACzB,KAAK,OAAO,SAAS,KACrB,KAAK,QAAQ,UACb,KAAK,iBAAiB,UACtB,KAAK,0BAA0B;AAEnC;AAkBO,SAAS,uBACd,MACA,OACwB;AACxB,QAAM,WAAW,2BAA2B,MAAM,KAAK;AACvD,MAAI,SAAS,KAAK,YAAY,MAAM,MAAM,KAAK,YAAY,GAAG;AAC5D,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,cAAc,MAAM,IAAI,sBAAsB,SAAS,IAAI;AAAA,IACtE,CAAC;AAAA,EACH;AACA,QAAM,iBAAiB,MAAM,KAAK,YAAY;AAC9C,QAAM,eAAe,mBAAmB,cAAc;AACtD,QAAM,YAAY,+CAA+C,YAAY,IAAI,SAAS,aAAa;AACvG,QAAM,eAAe,qBAAqB,cAAc,IAAI,SAAS,aAAa;AAClF,SAAO;AAAA,IACL,cAAc,gBAAgB,cAAc;AAAA,IAC5C;AAAA,IACA,WAAW,cAAc,cAAc,IAAI,SAAS,aAAa;AAAA,IACjE;AAAA,IACA,eAAe;AAAA,IACf,cAAc,SAAS;AAAA,IACvB,YAAY;AAAA,IACZ,MAAM,SAAS;AAAA,IACf,aAAa,SAAS;AAAA,IACtB,eAAe,SAAS;AAAA,IACxB,YAAY,SAAS;AAAA,IACrB,OAAO,SAAS,MAAM,IAAI,CAAC,UAAU;AAAA,MACnC,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,UAAU,IAAI,YAAY,EAAE,OAAO,KAAK,OAAO,EAAE;AAAA,MACjD,eAAe,WAAW,QAAQ,EAAE,OAAO,KAAK,OAAO,EAAE,OAAO,KAAK;AAAA,IACvE,EAAE;AAAA,EACJ;AACF;AAEA,eAAsB,kCACpB,IACA,aACA,MACA,UAAsD,CAAC,GACrB;AAClC,QAAM,eAAe,MAAM,oBAAoB,IAAI,aAAa,KAAK,EAAE;AACvE,QAAM,iBAAiB,KAAK,OAAO,IAAI,CAAC,UAAU,uBAAuB,MAAM,KAAK,CAAC;AACrF,QAAM,CAAC,sBAAsB,gBAAgB,IAAI,MAAM,QAAQ,IAAI;AAAA,IACjE,+BAA+B,IAAI,aAAa,KAAK,UAAU;AAAA,IAC/D;AAAA,MACE;AAAA,MACA;AAAA,MACA,eAAe,IAAI,CAAC,YAAY;AAAA,QAC9B,KAAK,OAAO;AAAA,QACZ,cAAc,OAAO;AAAA,QACrB,MAAM,OAAO;AAAA,QACb,eAAe,OAAO;AAAA,MACxB,EAAE;AAAA,MACF,cAAc;AAAA,IAChB;AAAA,EACF,CAAC;AACD,QAAM,iBAAiB,6BAA6B,IAAI;AACxD,QAAM,aAAwC,CAAC,GAAG,sBAAsB,GAAG,gBAAgB;AAC3F,QAAM,WAAW,WACd,OAAO,CAAC,cAAc,UAAU,YAAY,UAAU,WAAW,OAAO,EACxE;AAAA,IAAI,CAAC,cACJ,UAAU,WAAW,YACjB,GAAG,UAAU,KAAK,wCAClB,GAAG,UAAU,KAAK;AAAA,EACxB;AACF,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,cAAc;AAAA,EAChB;AACA,MACE,IAAI,WAAW,WACf,IAAI,WAAW,mBACd,IAAI,YAAY,IAAI,mBAAmB,QAAQ,IAAI,UAAU,OAC9D;AACA,aAAS,KAAK,eAAe,KAAK,KAAK,gBAAgB,IAAI,CAAC;AAAA,EAC9D;AACA,QAAM,gBACJ,QAAQ,iBAAiB,oBAAoB,cAAc,QAAQ,KAAK;AAC1E,MAAI,KAAK,aAAa,YAAY,CAAC,eAAe;AAChD,aAAS,KAAK,wDAAwD;AAAA,EACxE,WAAW,eAAe;AACxB,UAAM,cAAc,MAAM,eAAe,IAAI,aAAa,aAAa;AACvE,QAAI,CAAC,aAAa;AAChB,eAAS,KAAK,+DAA+D;AAAA,IAC/E,OAAO;AACL,YAAM,WAAW,KAAK,aAAa,qBAAqB,CAAC,GAAG;AAAA,QAC1D,CAAC,SAAS,CAAC,YAAY,UAAU,KAAK,CAAC,aAAa,SAAS,SAAS,IAAI;AAAA,MAC5E;AACA,UAAI,QAAQ,SAAS,GAAG;AACtB,iBAAS,KAAK,+CAA+C,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACA,QAAM,SACJ,CAAC,gBAAgB,aAAa,WAAW,aACrC,YACA,aAAa,mBAAmB,iBAC9B,WACA;AACR,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,aAAa,KAAK;AAAA,IAClB;AAAA,IACA,qBAAqB,cAAc,WAAW;AAAA,IAC9C;AAAA,IACA,OAAO,SAAS,WAAW;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,wBAAwB,KAAK,OAAO;AAAA,IACpC,oBAAoB,KAAK,gBAAgB;AAAA,EAC3C;AACF;AAEA,eAAe,eACb,IACA,aACA,MACA,gBACA,aAC4B;AAC5B,QAAM,WAAW,KAAK,KAAK,aAAa,QAAQ,QAAQ,KAAK,YAAY;AACzE,QAAM,gBAAgB,KAAK,KAAK,SAAS,kBAAkB,eAAe;AAC1E,MAAI,CAAC,YAAY,CAAC,eAAe;AAC/B,WAAO;AAAA,MACL,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,gBAAgB,kBAAkB;AAAA,MAClC,OAAO;AAAA,MACP,cAAc;AAAA,MACd,MAAM;AAAA,MACN,OAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,KAAK,KAAK,SAAS,kBAAkB,KAAK,IAAI,UAAU,gBAAgB;AAC1E,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA,OAAO,KAAK,IAAI;AAAA,MAChB,cAAc;AAAA,MACd,MAAM;AAAA,MACN,OAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,MACR,gBAAgB,kBAAkB;AAAA,MAClC,OAAO;AAAA,MACP,cAAc;AAAA,MACd,MAAM;AAAA,MACN,OAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,MAAM,OAAO,IAAI,aAAa,aAAa;AACvD,MAAI,CAAC,KAAK,eAAe;AACvB,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,MACR,gBAAgB,kBAAkB;AAAA,MAClC,OAAO;AAAA,MACP,cAAc;AAAA,MACd,MAAM,KAAK,QAAQ;AAAA,MACnB,OAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,cAAc,SAAS;AACzC,QAAM,SACJ,KAAK,gBAAgB,UAAU,KAAK,eAChC,aACA,KAAK,KAAK,mBAAmB,IAAI,qBAAqB,gBAAgB,YACpE,eACA;AACR,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,gBAAgB,kBAAkB;AAAA,IAClC,OAAO,IAAI;AAAA,IACX,cAAc,IAAI,cAAc;AAAA,IAChC,MAAM,IAAI;AAAA,IACV;AAAA,EACF;AACF;AAEA,SAAS,eAAe,KAAwB,aAAoC;AAClF,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,EACT;AACA,MAAI,IAAI,WAAW,cAAc;AAC/B,WAAO;AAAA,EACT;AACA,MAAI,aAAa;AACf,WAAO,uEAAuE,WAAW;AAAA,EAC3F;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,UAA8D;AACzF,QAAM,QAAQ,UAAU,iBAAiB,UAAU;AACnD,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AASA,eAAsB,iCACpB,IACA,aACA,MACe;AACf,MAAI,CAAC,KAAK,cAAc;AACtB;AAAA,EACF;AACA,QAAM,gBAAgB,MAAM,sBAAsB,IAAI,WAAW;AACjE,aAAW,gBAAgB,eAAe;AACxC,QAAI,aAAa,WAAW,YAAY,aAAa,WAAW,KAAK,IAAI;AACvE;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,sBAAsB,IAAI,aAAa,aAAa,MAAM;AAC9E,QAAI,OAAO,cAAc;AACvB,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,QAAQ,KAAK,EAAE,+CAA+C,MAAM,EAAE,sGAAiG,MAAM,EAAE;AAAA,MAC1L,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,SAAS,uCAAuC,OAI1B;AAC3B,QAAM,gBAAgB,MAAM,YAAY,IAAI,CAAC,eAAe,WAAW,EAAE;AACzE,SAAO;AAAA,IACL,QAAQ,6BAA6B;AAAA,MACnC,aAAa,MAAM;AAAA,MACnB,iBAAiB,MAAM;AAAA,MACvB,GAAI,MAAM,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;AAAA,IACrF,CAAC;AAAA,IACD,WAAW,CAAC;AAAA,IACZ,OAAO,oBAAoB;AAAA,IAC3B,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,gBAAgB;AAAA,MAChB,qBAAqB;AAAA,MACrB,iBAAiB,MAAM;AAAA,MACvB,qBAAqB;AAAA,IACvB;AAAA,EACF;AACF;AAEA,SAAS,6BAA6B,OAI3B;AACT,QAAM,kBAAkB,MAAM,YAC3B,IAAI,CAAC,eAAe;AACnB,WAAO,KAAK,WAAW,QAAQ,KAAK,WAAW,aAAa,KAAK,WAAW,EAAE;AAAA,EAChF,CAAC,EACA,KAAK,IAAI;AACZ,QAAM,gBACJ,MAAM,gBAAgB,SAAS,IAC3B,kFAAkF,MAAM,gBAAgB,KAAK,IAAI,CAAC,MAClH;AACN,QAAM,QAAQ,MAAM,qBAChB;AAAA;AAAA,EAAwC,MAAM,mBAAmB,KAAK,CAAC;AAAA,IACvE;AAEJ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AACd;;;AFhfA,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB,oBAAI,IAAI,CAAC,YAAY,SAAS,MAAM,CAAC;AACpE,IAAM,4BAA4B;AAClC,IAAM,sBAAsB;AAC5B,IAAM,8BAA8B;AACpC,IAAM,0BAA0B;AAChC,IAAM,oCAAoC;AAC1C,IAAM,sBAAsB;AAE5B,IAAM,0BAA0B;AAEhC,eAAsB,uBAAuB,OAKN;AACrC,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,MAAM,QAAQ,IAAI;AAAA,IACpB,2BAA2B,MAAM,IAAI,MAAM,WAAW;AAAA,IACtD,4BAA4B,MAAM,IAAI,MAAM,WAAW;AAAA,IACvDC,uBAAsB,MAAM,IAAI,MAAM,WAAW;AAAA,IACjD,6BAA6B,MAAM,IAAI,MAAM,WAAW;AAAA,IACxD,sBAAsB,MAAM,IAAI,MAAM,aAAa,KAAK,MAAM,SAAS;AAAA,IACvE,wBAAwB,MAAM,IAAI,MAAM,aAAa,IAAI;AAAA,IACzD,iCAAiC;AAAA,IACjC,oBAAoB,MAAM,IAAI,MAAM,WAAW;AAAA,IAC/C,MAAM,SAAS,4BACX,mCAAmC,MAAM,IAAI,MAAM,WAAW,IAC9D,QAAQ,QAAQ,IAAI;AAAA,EAC1B,CAAC;AACD,QAAM,uBAAuB,wBAAwB;AAAA,IACnD,CAAC,iBAAiB,aAAa,SAAS;AAAA,EAC1C;AACA,QAAM,6BAA6B,IAAI;AAAA,IACrC,qBAAqB,IAAI,CAAC,iBAAiB,CAAC,aAAa,cAAc,YAAY,CAAC;AAAA,EACtF;AACA,QAAM,qBAAqB,IAAI;AAAA,IAC7B,gBACG,OAAO,CAAC,UAAU,MAAM,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,QAAQ,CAAC,EACvE,IAAI,CAAC,UAAU,CAAC,MAAM,cAAc,KAAK,CAAC;AAAA,EAC/C;AACA,QAAM,gBAAgB,IAAI;AAAA,IACxB,kBACG,OAAO,CAAC,iBAAiB,aAAa,WAAW,QAAQ,EACzD,IAAI,CAAC,iBAAiB,aAAa,MAAM;AAAA,EAC9C;AACA,QAAM,iBAAiB,IAAI,IAAI,oBAAoB,EAAE,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AAC3E,QAAM,WAAW;AAAA,IACf,GAAG,eAAe;AAAA,MAAI,CAAC,SACrB,gBAAgB,MAAM,eAAe,IAAI,KAAK,EAAE,IAAI,aAAa,QAAQ;AAAA,IAC3E;AAAA,IACA,GAAG,0BAA0B,MAAM,QAAQ;AAAA,IAC3C,GAAG,gCAAgC,iBAAiB;AAAA,IACpD,iBAAiB,qBAAqB,OAAO,iBAAiB,CAAC;AAAA,IAC/D,GAAG;AAAA,IACH,GAAG,gBACA;AAAA,MACC,CAAC,UACC,MAAM,WAAW,aAAa,MAAM,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,QAAQ;AAAA,IACtF,EACC,IAAI,yBAAyB;AAAA,EAClC;AACA,QAAM,YAAY,MAAM,SAAS,4BAC7B,qBAAqB,0BAA0B,IAAI,IACnD;AACJ,QAAM,QAAQ,mBAAmB;AAAA,IAC/B,GAAG;AAAA,IACH,GAAG,eAAe;AAAA,MAChB,CAAC,SACC,KAAK,SAAS,WACd,KAAK,SAAS,SACd,KAAK,SAAS,YACd,CAAC,+BAA+B,IAAI;AAAA,IACxC;AAAA;AAAA;AAAA,IAGA,GAAI,YAAY,CAAC,SAAS,IAAI,CAAC;AAAA,EACjC,CAAC,EACE,IAAI,CAAC,SAAS;AACb,UAAM,YACJ,KAAK,SAAS,UACV,8BAA8B,MAAM,mBAAmB,IAAI,KAAK,EAAE,CAAC,IACnE,0BAA0B,MAAM,2BAA2B,IAAI,KAAK,EAAE,GAAG,aAAa;AAC5F,WAAO,yBAAyB,SAAS;AAAA,EAC3C,CAAC,EACA,KAAK,mBAAmB;AAC3B,SAAO;AAAA,IACL;AAAA,IACA,eAAe;AAAA,EACjB;AACF;AAEA,eAAsB,kBAAkB,OAKL;AACjC,QAAM,KAAK,MAAM,QAAQ,IAAI,KAAK,KAAK,sBAAsB,MAAM,OAAO;AAC1E,MAAI,GAAG,WAAW,OAAO,GAAG;AAC1B,UAAM,IAAIC,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,GAAG,WAAW,QAAQ,GAAG;AAC3B,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,GAAG,WAAW,MAAM,GAAG;AACzB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,GAAG,WAAW,SAAS,GAAG;AAC5B,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,QAAQ,SAAS,UACtB,OAAO,OAAO,wBAAwB,MACpC,OAAO,MAAM,QAAQ,SAAS,gBAAgB,YAC7C,MAAM,QAAQ,SAAS,YAAY,KAAK,MAAM,2BAClD;AACA,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,GAAG,wBAAwB;AAAA,IACtC,CAAC;AAAA,EACH;AACA,QAAM,SACJ,MAAM,QAAQ,WAAW,cACzB,MAAM,QAAQ,WAAW,aACzB,MAAM,QAAQ,WAAW,gBACzB,MAAM,QAAQ,WAAW,aACrB,WACA,MAAM,QAAQ;AACpB,QAAM,WAAW;AAAA,IACf,GAAG,MAAM,QAAQ;AAAA,IACjB,GAAI,MAAM,QAAQ,SAAS,SAC3B,MAAM,QAAQ,eACd,CAAC,MAAM,QAAQ,SAAS,cACpB,EAAE,aAAa,yBAAyB,IAAI,MAAM,QAAQ,QAAQ,EAAE,IACpE,CAAC;AAAA,EACP;AACA,SAAO,MAAM,4BAA4B,MAAM,IAAI;AAAA,IACjD,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB;AAAA,IACA,MAAM,MAAM,QAAQ;AAAA,IACpB;AAAA,IACA,MAAM,MAAM,QAAQ,KAAK,KAAK;AAAA,IAC9B,aAAa,MAAM,QAAQ,aAAa,KAAK,KAAK;AAAA,IAClD,UAAU,MAAM,QAAQ,SAAS,KAAK,KAAK;AAAA,IAC3C,MAAM,WAAW,MAAM,QAAQ,IAAI;AAAA,IACnC,aAAa,MAAM,QAAQ,eAAe;AAAA,IAC1C,aAAa,MAAM,QAAQ,eAAe;AAAA,IAC1C,YAAY,MAAM,QAAQ,cAAc;AAAA,IACxC,WAAW,MAAM,QAAQ,WAAW,KAAK,KAAK;AAAA,IAC9C;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,iBAAiB,OASH;AAClC,QAAM,OAAO,MAAM;AAAA,IACjB,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACA,MAAI,KAAK,SAAS,SAAS;AACzB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,SAAS,OAAO;AACvB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,SAAS,UAAU;AAC1B,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,SAAS,QAAQ;AACxB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,SAAS,SAAS,CAAC,KAAK,QAAQ,WAAW;AAClD,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,uBAAuB,MAAM,QAAQ;AAIzC,MAAI,qBAA8C,EAAE,GAAG,MAAM,QAAQ,OAAO;AAC5E,SAAO,mBAAmB;AAC1B,SAAO,mBAAmB;AAC1B,SAAO,mBAAmB;AAC1B,SAAO,mBAAmB;AAC1B,MAAI,KAAK,SAAS,OAAO;AACvB,UAAM,UAAU,MAAM,4BAA4B,OAAO,IAAI;AAC7D,UAAM,gBAAgB,MAAM,QAAQ,gBAChC,MAAM,mCAAmC,OAAO,MAAM,MAAM,QAAQ,aAAa,IACjF;AACJ,uCAAmC,MAAM,SAAS,aAAa;AAC/D,2BAAuB;AAAA,MACrB,GAAG;AAAA,MACH,GAAI,iBAAiB,CAAC,UAClB,4BAA4B,IAC5B,MAAM,gCAAgC,MAAM,MAAM,gBAAgB,WAAW,MAAS;AAAA,IAC5F;AACA,QAAI,eAAe;AACjB,yBAAmB,gBAAgB;AAAA,IACrC;AACA,QAAI,SAAS;AACX,YAAM,MAAM,kCAAkC,MAAM,QAAQ;AAC5D,yBAAmB,mBAAmB,OAAO;AAAA,QAC3C,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,wBAAwB,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,6BAA6B,MAAM,IAAI;AAAA,IAClD,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,cAAc,KAAK;AAAA,IACnB,MAAM,KAAK;AAAA,IACX,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ,CAAC;AACH;AAQA,eAAe,4BACb,OAMA,MACwC;AACxC,QAAM,WAAW,+BAA+B,MAAM,QAAQ,OAAO;AACrE,MAAI,UAAU;AAGZ,sCAAkC,MAAM,QAAQ;AAChD,WAAO;AAAA,EACT;AACA,QAAM,mBAAmB,MAAM;AAAA,IAC7B,MAAM;AAAA,IACN,MAAM;AAAA,IACN,KAAK;AAAA,EACP;AACA,MAAI,CAAC,kBAAkB;AACrB,WAAO;AAAA,EACT;AACA,QAAM,MAAM,kCAAkC,MAAM,QAAQ;AAC5D,MAAI;AACF,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,gBAAgB,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AAAA,QACtD;AAAA,QACA,wBAAwB,KAAK,KAAK;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AACN,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,kCAAkC,KAAK,IAAI;AAAA,IACtD,CAAC;AAAA,EACH;AACF;AAEA,SAAS,+BACP,SAC+B;AAC/B,QAAM,UAAU,OAAO,QAAQ,OAAO,EACnC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,KAAK,GAAG,KAAK,CAAU,EACpD,OAAO,CAAC,CAAC,IAAI,MAAM,KAAK,SAAS,CAAC;AACrC,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,SAAS,yBAAyB;AAC5C,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,sCAAsC,uBAAuB;AAAA,IACxE,CAAC;AAAA,EACH;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,CAAC,MAAM,KAAK,KAAK,SAAS;AACnC,QAAI,CAAC,wBAAwB,KAAK,IAAI,GAAG;AACvC,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,mCAAmC,IAAI;AAAA,MAClD,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,KAAK,YAAY;AAC/B,QAAI,KAAK,IAAI,KAAK,GAAG;AACnB,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,qCAAqC,IAAI;AAAA,MACpD,CAAC;AAAA,IACH;AACA,SAAK,IAAI,KAAK;AACd,QAAI,MAAM,WAAW,KAAK,MAAM,SAAS,mCAAmC;AAC1E,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,qBAAqB,IAAI,cAAc,iCAAiC;AAAA,MACnF,CAAC;AAAA,IACH;AAIA,QAAI,qCAAqC,KAAK,KAAK,GAAG;AACpD,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,qBAAqB,IAAI;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,OAAO,YAAY,OAAO;AACnC;AAEA,eAAe,mCACb,OACA,MACA,KACiC;AACjC,QAAM,eAAe,IAAI,gBAAgB;AACzC,QAAM,eACJ,KAAK,SAAS,wBAAwB,mBACtC,KAAK,aAAa,QAAQ,QAAQ,EAAE,MAAM;AAC5C,MAAI,gBAAgB,iBAAiB,WAAW;AAC9C,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACA,QAAM,aAAqC;AAAA,IACzC,gBAAgB,IAAI,eAAe,KAAK;AAAA,IACxC;AAAA,IACA,GAAI,IAAI,eAAe,EAAE,cAAc,IAAI,aAAa,IAAI,CAAC;AAAA,IAC7D,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,KAAK,EAAE,IAAI,CAAC;AAAA,IACxD,GAAI,IAAI,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,IAAI,SAAS,EAAE,QAAQ,cAAc,IAAI,MAAM,EAAE,IAAI,CAAC;AAAA,IAC1D,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,IACjD,GAAI,IAAI,oBACJ;AAAA,MACE,mBAAmB,IAAI,kBAAkB,IAAI,CAAC,cAAc;AAAA,QAC1D,GAAG;AAAA,MACL,EAAE;AAAA,IACJ,IACA,CAAC;AAAA,EACP;AACA,MAAI,CAAC,WAAW,gBAAgB;AAC9B,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,KAAK,eAAe,CAAC,KAAK,QAAQ,aAAa;AAClD,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AAEA,MAAI,aAAa,WAAW,eACxB,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,MAAM;AAAA,IACN,WAAW;AAAA,IACX,MAAM,MAAM;AAAA,EACd,IACA;AACJ,MAAI,CAAC,cAAc,iBAAiB,aAAa,CAAC,WAAW,cAAc;AACzE,UAAM,UAAU,MAAM;AAAA,MACpB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,IACd;AACA,iBACE,QAAQ;AAAA,MACN,CAAC,cACC,UAAU,cAAc,MAAM,MAAM,aACpC,UAAU,mBAAmB,WAAW,mBACvC,CAAC,WAAW,QAAQ,UAAU,SAAS,WAAW,SACnD,UAAU,WAAW;AAAA,IACzB,KAAK;AAAA,EACT;AACA,MAAI,CAAC,YAAY;AACf,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACG,iBAAiB,aAAa,WAAW,cAAc,MAAM,MAAM,aACnE,iBAAiB,eAAe,WAAW,cAAc,MAC1D;AACA,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,sCAAsC,YAAY;AAAA,IAC7D,CAAC;AAAA,EACH;AACA,MAAI,WAAW,WAAW,UAAU;AAClC,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,6CAA6C,WAAW,MAAM;AAAA,IACzE,CAAC;AAAA,EACH;AACA,MAAI,WAAW,mBAAmB,WAAW,gBAAgB;AAC3D,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,WAAW,QAAQ,WAAW,SAAS,WAAW,MAAM;AAC1D,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,iBAAiB,WAAW;AAC9B,UAAM,oBAAoB,EAAE,GAAG,YAAY,MAAM,WAAW,KAAK;AACjE,WAAO,kBAAkB;AACzB,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,8BAAuD;AAC9D,SAAO;AAAA,IACL,iBAAiB;AAAA,MACf,QAAQ;AAAA,MACR,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC;AAAA,EACF;AACF;AAEA,SAAS,mCACP,MACA,SACA,eACM;AACN,MAAI,eAAe;AACjB;AAAA,EACF;AACA,QAAM,WAAW,0BAA0B,KAAK,QAAQ;AACxD,QAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC;AAClF,QAAM,UAAU,SAAS,OAAO,CAAC,SAAS,CAAC,MAAM,IAAI,KAAK,YAAY,CAAC,CAAC;AACxE,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,mBAAmB,KAAK,IAAI,mCAAmC,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC5F,CAAC;AAAA,EACH;AACA,MAAI,KAAK,aAAa,MAAM,SAAS,GAAG;AACtC,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,mBAAmB,KAAK,IAAI;AAAA,IACvC,CAAC;AAAA,EACH;AACF;AAEA,SAAS,0BAA0B,UAA6C;AAC9E,QAAM,QAAQ,SAAS;AACvB,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AACzB,WAAO,CAAC;AAAA,EACV;AACA,SAAO,MACJ,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC,EACnF,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;AAC9B;AAEA,SAAS,kCAAkC,UAAgC;AACzE,QAAM,MAAM,+BAA+B,QAAQ;AACnD,MAAI,CAAC,KAAK;AACR,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAkBA,eAAsB,gCACpB,MACA,QAA4B,8BAC5B,SACkC;AAClC,MAAI,KAAK,SAAS,OAAO;AACvB,WAAO,CAAC;AAAA,EACV;AACA,MAAI,CAAC,KAAK,eAAe,CAAC,KAAK,QAAQ,aAAa;AAClD,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI;AACF,UAAM,SAAS,MAAM,MAAM;AAAA,MACzB,IAAI,KAAK,QAAQ;AAAA,MACjB,MAAM,KAAK;AAAA,MACX,KAAK,KAAK;AAAA,MACV,WAAW;AAAA,MACX,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/B,CAAC;AACD,WAAO;AAAA,MACL,iBAAiB;AAAA,QACf,QAAQ;AAAA,QACR,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,WAAW,OAAO;AAAA,MACpB;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,mBAAmB,KAAK,IAAI,kCAAkC,qBAAqB,OAAO,KAAK,WAAW,CAAC;AAAA,IACtH,CAAC;AAAA,EACH;AACF;AAEA,eAAe,6BACb,OACmC;AACnC,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,MAAM,SAAS;AACpE,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,6BAA6B,SAAS,QAAQ;AAAA,IACtD,EAAE,cAAc,CAAC,EAAE;AAAA,EACrB;AACA,MAAI;AACF,UAAM,YAAY,IAAI,8BAA8B,IAAI,IAAI,MAAM,GAAG,GAAG;AAAA,MACtE,aAAa;AAAA,QACX,QAAQ,WAAW;AAAA,QACnB,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,MACpD;AAAA,IACF,CAAC;AACD,UAAM,OAAO,QAAQ,WAAmC;AAAA,MACtD,SAAS,MAAM;AAAA,MACf,iBAAiB,MAAM;AAAA,IACzB,CAAC;AACD,UAAM,QAAQ,MAAM,OAAO,UAAU,QAAW;AAAA,MAC9C,SAAS,MAAM;AAAA,MACf,iBAAiB,MAAM;AAAA,IACzB,CAAC;AACD,WAAO,EAAE,WAAW,MAAM,MAAM,OAAO;AAAA,EACzC,UAAE;AACA,iBAAa,OAAO;AACpB,UAAM,OAAO,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,EAC5C;AACF;AAEA,SAAS,qBAAqB,OAAgB,aAA6B;AACzE,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,QAAM,aAAa,QAAQ,QAAQ,QAAQ,GAAG,EAAE,KAAK;AACrD,QAAM,WAAW,kBAAkB,WAAW;AAC9C,MACE,8KAA8K;AAAA,IAC5K;AAAA,EACF,GACA;AACA,WAAO,kEAAkE,QAAQ;AAAA,EACnF;AACA,SAAO,iCAAiC,QAAQ;AAClD;AAEA,SAAS,kBAAkB,aAA6B;AACtD,MAAI;AACF,WAAO,IAAI,IAAI,WAAW,EAAE,YAAY;AAAA,EAC1C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,kBAAkB,OAMJ;AAClC,QAAM,OAAO,MAAM;AAAA,IACjB,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACA,MAAI,KAAK,SAAS,SAAS;AACzB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,SAAS,OAAO;AACvB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,SAAS,UAAU;AAC1B,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,SAAS,QAAQ;AACxB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,WAAW,cAAc,KAAK,WAAW,cAAc;AAC9D,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACA,MAAI,CAAE,MAAM,0BAA0B,MAAM,IAAI,MAAM,aAAa,KAAK,EAAE,GAAI;AAC5E,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO,MAAM,8BAA8B,MAAM,IAAI,MAAM,aAAa,KAAK,EAAE;AACjF;AAEA,eAAsB,wCACpB,IACA,aACA,UACA,SAKmB;AACnB,QAAM,yBAAyB,SAAS,YACpC,6BAA6B,IAAI,aAAa,QAAQ,SAAS,IAC/D;AAAA,IACE;AAAA,IACA;AAAA,IACA,SAAS,iCAAiC,CAAC;AAAA,EAC7C;AACJ,QAAM,CAAC,SAAS,iBAAiB,qBAAqB,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC1E,gCAAgC,IAAI,WAAW;AAAA,IAC/C;AAAA,IACA,mCAAmC,IAAI,WAAW;AAAA,EACpD,CAAC;AACD,WAAS,4BAA4B,eAAe;AACpD,SAAO;AAAA,IACL;AAAA,MACE,iCAAiC,UAAU,OAAO;AAAA,MAClD;AAAA,IACF;AAAA,IACA,0BAA0B;AAAA,EAC5B;AACF;AAEO,SAAS,mCACd,cACA,aACyB;AACzB,QAAM,QAAQ,IAAI;AAAA,IAChB,YAAY;AAAA,MAAI,CAAC,eACf;AAAA,QACE,WAAW;AAAA,QACX,WAAW;AAAA,QACX,WAAW,eAAe,YAAY;AAAA,QACtC,WAAW,QAAQ;AAAA,MACrB,EAAE,KAAK,IAAQ;AAAA,IACjB;AAAA,EACF;AACA,SAAO,aAAa,OAAO,CAAC,gBAAgB;AAC1C,UAAM,MAAM,YAAY;AACxB,QAAI,CAAC,OAAO,IAAI,iBAAiB,aAAa,CAAC,IAAI,aAAc,QAAO;AACxE,WAAO,MAAM;AAAA,MACX;AAAA,QACE,YAAY;AAAA,QACZ,IAAI;AAAA,QACJ,IAAI,eAAe,YAAY;AAAA,QAC/B,IAAI,QAAQ;AAAA,MACd,EAAE,KAAK,IAAQ;AAAA,IACjB;AAAA,EACF,CAAC;AACH;AAEA,eAAe,2CACb,IACA,aACA,aACkC;AAClC,QAAM,YAAY,MAAM,6BAA6B,IAAI,WAAW;AACpE,MAAI,YAAY,WAAW,EAAG,QAAO;AACrC,QAAM,SAAS,CAAC,GAAG,IAAI,IAAI,YAAY,IAAI,CAAC,eAAe,WAAW,cAAc,CAAC,CAAC;AACtF,QAAM,mBAAmB,MAAM,QAAQ;AAAA,IACrC,OAAO;AAAA,MAAI,OAAO,cAChB;AAAA,QACE,MAAM,6BAA6B,IAAI,aAAa,SAAS;AAAA,QAC7D,YAAY,OAAO,CAAC,eAAe,WAAW,mBAAmB,SAAS;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,IAAI,IAAI,UAAU,IAAI,CAAC,gBAAgB,CAAC,YAAY,UAAU,WAAW,CAAC,CAAC;AAC9F,aAAW,eAAe,iBAAiB,KAAK;AAC9C,eAAW,IAAI,YAAY,UAAU,WAAW;AAClD,SAAO,CAAC,GAAG,WAAW,OAAO,CAAC;AAChC;AAEO,SAAS,kCACd,UACA,cACU;AACV,MAAI,aAAa,WAAW,EAAG,QAAO;AACtC,QAAM,cAAc,IAAI,IAAI,SAAS,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AAC1E,QAAM,iBAAiB,aACpB,OAAO,CAAC,gBAAgB,CAAC,YAAY,IAAI,YAAY,QAAQ,CAAC,EAC9D,IAAI,CAAC,iBAAiB;AAAA,IACrB,IAAI,YAAY;AAAA,IAChB,MAAM,YAAY;AAAA;AAAA;AAAA;AAAA,IAIlB,KAAK,YAAY;AAAA,IACjB,cAAc,CAAC,GAAG,YAAY,YAAY;AAAA,IAC1C,gBAAgB;AAAA,IAChB,iBAAiB,YAAY;AAAA,IAC7B,GAAI,YAAY,gBAAgB,EAAE,eAAe,YAAY,cAAc,IAAI,CAAC;AAAA,EAClF,EAAE;AACJ,SAAO,eAAe,SAClB,EAAE,GAAG,UAAU,YAAY,CAAC,GAAG,SAAS,YAAY,GAAG,cAAc,EAAE,IACvE;AACN;AAMA,eAAsB,mCACpB,IACA,aACwB;AACxB,QAAM,gBAAgB,MAAM,0CAA0C,IAAI,WAAW;AACrF,MAAI,CAAC,cAAe,QAAO;AAC3B,QAAM,QAAQ,MAAMC,mBAAkB,IAAI,cAAc,gBAAgB,WAAW;AACnF,SAAO,SAAS,cAAc,MAAM,aAAa,mBAAmB,IAChE,cAAc,eACd;AACN;AAQO,SAAS,+BACd,UACA,qBACU;AACV,QAAM,kBAAkB;AAAA,IACtB,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,WAAW;AAAA;AAAA,IAEX,gBAAgB;AAAA,EAClB;AAKA,QAAM,oBAAoB,SAAS,WAAW;AAAA,IAC5C,CAAC,WAAW,OAAO,OAAO;AAAA,EAC5B;AACA,MAAI,CAAC,SAAS,6BAA6B,CAAC,qBAAqB;AAC/D,WAAO,kBAAkB,WAAW,SAAS,WAAW,SACpD,WACA,EAAE,GAAG,UAAU,YAAY,kBAAkB;AAAA,EACnD;AACA,QAAM,WAAW,SAAS,WAAW,GAAG,EAAE;AAC1C,MACE,kBAAkB,WAAW,SAAS,WAAW,SAAS,KAC1D,aAAa,UACb,OAAO,KAAK,QAAQ,EAAE,WAAW,OAAO,KAAK,eAAe,EAAE,UAC9D,OAAO,QAAQ,eAAe,EAAE;AAAA,IAC9B,CAAC,CAAC,KAAK,KAAK,MAAM,SAAS,GAA4B,MAAM;AAAA,EAC/D,GACA;AACA,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,CAAC,GAAG,mBAAmB,eAAe;AAAA,EACpD;AACF;AAEO,SAAS,iCACd,UACA,SACU;AACV,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,+BAA+B,QAAQ;AAC7D,QAAM,cAAc,IAAI,IAAI,SAAS,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AAC1E,QAAM,iBAAiB,QACpB,OAAO,CAAC,WAAW,CAAC,YAAY,IAAI,OAAO,EAAE,CAAC,EAC9C,QAAQ,CAAC,WAAW;AACnB,UAAM,UAAU,2BAA2B,QAAQ,aAAa;AAChE,QAAI,YAAY,iBAAiB,CAAC,OAAO,eAAe;AAGtD,aAAO,CAAC;AAAA,IACV;AACA,WAAO;AAAA,MACL;AAAA,QACE,IAAI,OAAO;AAAA,QACX,MAAM,OAAO;AAAA,QACb,KAAK,OAAO;AAAA,QACZ,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,QACnE,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,QAC1D,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,GAAI,OAAO,oBAAoB,SAC3B,EAAE,iBAAiB,OAAO,gBAAgB,IAC1C,CAAC;AAAA,QACL,GAAI,WAAW,YAAY,gBAAgB,EAAE,QAAQ,IAAI,CAAC;AAAA,QAC1D,GAAI,OAAO,gBAAgB,EAAE,eAAe,OAAO,cAAc,IAAI,CAAC;AAAA,MACxE;AAAA,IACF;AAAA,EACF,CAAC;AACH,SAAO,eAAe,SAClB,EAAE,GAAG,UAAU,YAAY,CAAC,GAAG,SAAS,YAAY,GAAG,cAAc,EAAE,IACvE;AACN;AAEA,eAAsB,gCAAgC,OAKjB;AACnC,QAAM,SAAS,MAAM,SAAS,IAAI,KAAK,EAAE,YAAY;AACrD,QAAM,QAAQ,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,MAAM,SAAS,EAAE,CAAC,CAAC;AACtE,QAAM,QAAiC,CAAC;AACxC,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,eAAqE,CAAC;AAC5E,MAAI,MAAM,WAAW;AACnB,iBAAa,YAAY,MAAM;AAAA,EACjC;AACA,MAAI,MAAM,cAAc,QAAW;AACjC,iBAAa,YAAY,MAAM;AAAA,EACjC;AACA,MAAI;AACJ,MAAI,QAAQ;AAEZ,SAAO,MAAM,SAAS,SAAS,QAAQ,qBAAqB;AAC1D,aAAS;AACT,UAAM,MAAM,IAAI,IAAI,iBAAiB,sBAAsB;AAC3D,QAAI,aAAa,IAAI,SAAS,OAAO,KAAK,CAAC;AAC3C,QAAI,aAAa,IAAI,WAAW,QAAQ;AACxC,QAAI,OAAO;AACT,UAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IACtC;AACA,QAAI,QAAQ;AACV,UAAI,aAAa,IAAI,UAAU,MAAM;AAAA,IACvC;AACA,UAAM,OAAO,MAAM,qBAAqB,KAAK,YAAY;AACzD,eAAW,SAAS,KAAK,WAAW,CAAC,GAAG;AACtC,YAAM,OAAO,8BAA8B,KAAK;AAChD,UAAI,CAAC,QAAQ,KAAK,IAAI,KAAK,EAAE,GAAG;AAC9B;AAAA,MACF;AACA,UAAI,SAAS,CAAC,kBAAkB,IAAI,EAAE,SAAS,KAAK,GAAG;AACrD;AAAA,MACF;AACA,WAAK,IAAI,KAAK,EAAE;AAChB,YAAM,KAAK,IAAI;AACf,UAAI,MAAM,UAAU,OAAO;AACzB;AAAA,MACF;AAAA,IACF;AACA,aAAS,OAAO,KAAK,UAAU,eAAe,WAAW,KAAK,SAAS,aAAa;AACpF,QAAI,CAAC,QAAQ;AACX;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAMA,eAAe,qBACb,KACA,UAGI,CAAC,GACqB;AAC1B,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,UAAU;AAAA,IACd,MAAM,WAAW,MAAM;AAAA,IACvB,QAAQ,aAAa;AAAA,EACvB;AACA,MAAI;AACF,UAAM,WAAW,MAAM,UAAU,KAAK,EAAE,QAAQ,WAAW,OAAO,CAAC;AACnE,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAIC,eAAc,KAAK;AAAA,QAC3B,SAAS,yBAAyB,SAAS,MAAM;AAAA,MACnD,CAAC;AAAA,IACH;AACA,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B,SAAS,OAAO;AACd,QAAI,iBAAiBA,gBAAe;AAClC,YAAM;AAAA,IACR;AACA,QAAI,iBAAiB,SAAS,MAAM,SAAS,cAAc;AACzD,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,gCAAgC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACjG,CAAC;AAAA,EACH,UAAE;AACA,iBAAa,OAAO;AAAA,EACtB;AACF;AAEA,eAAe,mBACb,IACA,aACA,UACA,cACgC;AAChC,QAAM,UAAU,MAAM,uBAAuB,EAAE,IAAI,aAAa,SAAS,CAAC;AAC1E,QAAM,OACJ,QAAQ,MAAM,KAAK,CAAC,cAAc,UAAU,OAAO,YAAY,KAC9D,MAAM,yBAAyB,IAAI,aAAa,YAAY;AAC/D,MAAI,CAAC,MAAM;AACT,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;AAAA,EAClE;AACA,SAAO;AACT;AAEA,SAAS,gBACP,MACA,QACuB;AACvB,QAAM,iBAAiB,EAAE,GAAG,KAAK,SAAS;AAC1C,aAAW,OAAO;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAG;AACD,WAAO,eAAe,GAAG;AAAA,EAC3B;AACA,SAAO,sBAAsB,MAAM;AAAA,IACjC,IAAI,QAAQ,KAAK,EAAE;AAAA,IACnB,MAAM;AAAA,IACN;AAAA,IACA,MAAM,KAAK;AAAA,IACX,aAAa,KAAK;AAAA,IAClB,UAAU,KAAK;AAAA,IACf,MAAM,CAAC,KAAK,MAAM,KAAK,UAAU,MAAM;AAAA,IACvC,OAAO,KAAK;AAAA,IACZ,SAAS;AAAA,MACP,WAAW;AAAA,MACX,OAAO;AAAA,IACT;AAAA,IACA,UAAU;AAAA,MACR,GAAG;AAAA,MACH,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,wBAAwB,KAAK;AAAA,MAC7B,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA;AAAA,MAE5D,GAAI,KAAK,eAAe,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;AAAA,MAC/D,GAAI,KAAK,wBAAwB,EAAE,uBAAuB,KAAK,sBAAsB,IAAI,CAAC;AAAA,MAC1F,GAAI,KAAK,OAAO,SAAS,IAAI,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC,UAAU,MAAM,IAAI,EAAE,IAAI,CAAC;AAAA,IACrF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,0BAA0B,UAA6C;AAC9E,SACE,SAAS,WAIN;AAAA,IACC,CAAC,WACC,OAAO,OAAO,4BAA4B,CAAC,uBAAuB,IAAI,OAAO,EAAE;AAAA,EACnF,EACC;AAAA,IAAI,CAAC,WACJ,sBAAsB,MAAM;AAAA,MAC1B,IAAI,OAAO,OAAO,EAAE;AAAA,MACpB,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,OAAO,QAAQ,OAAO;AAAA,MAC5B,aAAa;AAAA,MACb,UAAU;AAAA,MACV,MAAM,CAAC,OAAO,GAAI,OAAO,cAAc,SAAS,CAAC,eAAe,IAAI,CAAC,CAAE;AAAA,MACvE,aAAa,OAAO;AAAA,MACpB,OAAO,CAAC,EAAE,MAAM,OAAO,IAAI,OAAO,GAAG,CAAC;AAAA,MACtC,SAAS;AAAA,QACP,WAAW;AAAA,QACX,aAAa,OAAO;AAAA,QACpB,WAAW;AAAA,QACX,OAAO;AAAA,MACT;AAAA,MACA,UAAU;AAAA,QACR,aAAa,OAAO;AAAA,QACpB,cAAc,OAAO,gBAAgB,CAAC;AAAA,QACtC,gBAAgB,OAAO;AAAA,MACzB;AAAA,IACF,CAAC;AAAA,EACH;AAEN;AAEA,SAAS,+BAA+B,MAAsC;AAC5E,SACE,KAAK,OAAO,OAAO,wBAAwB,MAC1C,KAAK,SAAS,UACZ,KAAK,QAAQ,gBAAgB,4BAC5B,KAAK,SAAS,gBAAgB;AAEtC;AAQO,SAAS,qBAAqB,WAA2C;AAC9E,SAAO,sBAAsB,MAAM;AAAA,IACjC,IAAI,OAAO,wBAAwB;AAAA,IACnC,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,MAAM,CAAC,OAAO,SAAS,gBAAgB;AAAA,IACvC,gBAAgB;AAAA,IAChB,aAAa;AAAA,IACb,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,OAAO,CAAC,EAAE,MAAM,OAAO,IAAI,yBAAyB,CAAC;AAAA,IACrD,SAAS;AAAA,MACP;AAAA,MACA,GAAI,YAAY,EAAE,aAAa,yBAAyB,IAAI,CAAC;AAAA,MAC7D,WAAW;AAAA,MACX,OAAO,YACH,6DACA;AAAA,IACN;AAAA,IACA,SAAS;AAAA,IACT,eAAe,YAAY,+BAA+B;AAAA,IAC1D,UAAU;AAAA,MACR,aAAa;AAAA,MACb,eAAe;AAAA,IACjB;AAAA,EACF,CAAC;AACH;AAWA,IAAM,+BAA+E;AAAA,EACnF;AAAA,IACE,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aACE;AAAA,IACF,gBAAgB;AAAA,IAChB,aAAa;AAAA,IACb,MAAM,CAAC,OAAO,KAAK,WAAW,UAAU,WAAW;AAAA,EACrD;AAAA,EACA;AAAA,IACE,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aACE;AAAA,IACF,gBAAgB;AAAA,IAChB,aAAa;AAAA,IACb,MAAM,CAAC,OAAO,UAAU,UAAU,aAAa,WAAW;AAAA,EAC5D;AACF;AAEA,IAAM,6BAA6B;AAAA,EACjC,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAOA,SAAS,iBAAiB,kBAA+D;AACvF,QAAM,kBAAkB,yBAAyB,gBAAgB;AACjE,QAAM,eACJ,iBAAiB,WAAW,YAAY,iBAAiB,WAAW;AACtE,SAAO,sBAAsB,MAAM;AAAA,IACjC,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aACE;AAAA,IACF,UAAU;AAAA,IACV,MAAM,CAAC,OAAO,SAAS,cAAc,aAAa,QAAQ;AAAA,IAC1D,aAAa;AAAA,IACb,WAAW;AAAA,IACX,gBAAgBC;AAAA,IAChB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,OAAO,CAAC,EAAE,MAAM,OAAO,IAAI,WAAW,CAAC;AAAA,IACvC,SAAS;AAAA,MACP,WAAW;AAAA,MACX,aAAa;AAAA,MACb,OAAO;AAAA,IACT;AAAA,IACA,SAAS;AAAA,IACT,eAAe,eACX,gBAAgB,WAAW,WACzB,sCACA,kDACF;AAAA,IACJ,UAAU;AAAA,MACR,eAAe;AAAA,MACf,WAAW;AAAA;AAAA;AAAA,MAGX,oBAAoB,2BAA2B,OAAO,CAAC,SAAS,KAAK,WAAW,QAAQ,CAAC;AAAA,IAC3F;AAAA,EACF,CAAC;AACH;AAEA,SAAS,gCACP,mBACyB;AACzB,SAAO,6BAA6B,IAAI,CAAC,eAAe;AACtD,UAAM,SAAS,uBAAuB,mBAAmB,WAAW,QAAQ;AAC5E,UAAM,UAAU,OAAO,YAAY,OAAO,cAAc;AACxD,WAAO,sBAAsB,MAAM;AAAA,MACjC,IAAI,OAAO,WAAW,QAAQ;AAAA,MAC9B,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,MAAM,WAAW;AAAA,MACjB,aAAa,WAAW;AAAA,MACxB,UAAU;AAAA,MACV,MAAM,WAAW;AAAA,MACjB,aAAa,WAAW;AAAA,MACxB,WAAW;AAAA,MACX,gBAAgB,WAAW;AAAA,MAC3B,aAAa;AAAA,MACb,UAAU;AAAA,MACV,OAAO,CAAC,EAAE,MAAM,OAAO,IAAI,WAAW,CAAC;AAAA,MACvC,SAAS;AAAA,QACP,WAAW;AAAA,QACX,aAAa;AAAA,QACb,OACE;AAAA,MACJ;AAAA,MACA;AAAA,MACA,eAAe,wBAAwB,MAAM;AAAA,MAC7C,YAAY;AAAA,MACZ,UAAU;AAAA,QACR,iBAAiB;AAAA,QACjB,UAAU,WAAW;AAAA,QACrB,kBAAkB;AAAA,QAClB,kBAAkB;AAAA,QAClB,oBAAoB,2BAA2B,WAAW,QAAQ;AAAA,MACpE;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAQO,SAAS,4CAAqE;AACnF,SAAO;AAAA,IACL,sBAAsB,MAAM;AAAA,MAC1B,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,MACV,MAAM,CAAC,UAAU,gBAAgB,gBAAgB;AAAA,MACjD,aAAa;AAAA,MACb,gBAAgB;AAAA,MAChB,WAAW;AAAA,MACX,UAAU;AAAA,MACV,aAAa;AAAA,MACb,OAAO,CAAC,EAAE,MAAM,OAAO,IAAI,WAAW,CAAC;AAAA,MACvC,SAAS;AAAA,QACP,WAAW;AAAA,QACX,OACE;AAAA,MACJ;AAAA,MACA,WAAW;AAAA,QACT,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,WAAW;AAAA,MACb;AAAA,MACA,SAAS,CAAC,WAAW,SAAS;AAAA,MAC9B,UAAU;AAAA,QACR,cAAc;AAAA,QACd,oBAAoB,CAAC,uBAAuB,0BAA0B;AAAA,QACtE,oBAAoB;AAAA,MACtB;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,SAAS,uBACP,aACA,UAC6E;AAC7E,QAAM,WAAW,YAAY,OAAO,CAAC,eAAe,WAAW,aAAa,QAAQ;AACpF,SAAO;AAAA,IACL,WAAW,SAAS,OAAO,CAAC,eAAe,WAAW,WAAW,WAAW,EAAE;AAAA,IAC9E,aAAa,SAAS,OAAO,CAAC,eAAe,WAAW,WAAW,cAAc,EAAE;AAAA,IACnF,UAAU,SAAS,OAAO,CAAC,eAAe,WAAW,WAAW,UAAU,EAAE;AAAA,IAC5E,OAAO,SAAS;AAAA,EAClB;AACF;AAEA,SAAS,wBAAwB,QAAkE;AACjG,QAAM,QAAkB,CAAC;AACzB,MAAI,OAAO,YAAY,GAAG;AACxB,UAAM,KAAK,GAAG,OAAO,SAAS,qBAAqB,OAAO,cAAc,IAAI,KAAK,GAAG,EAAE;AAAA,EACxF;AACA,MAAI,OAAO,cAAc,GAAG;AAC1B,UAAM;AAAA,MACJ,GAAG,OAAO,WAAW,WAAW,OAAO,gBAAgB,IAAI,KAAK,GAAG,QACjE,OAAO,gBAAgB,IAAI,MAAM,EACnC;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,KAAK,GAAG,OAAO,QAAQ,wBAAwB,OAAO,aAAa,IAAI,KAAK,GAAG,EAAE;AAAA,EACzF;AACA,SAAO,MAAM,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI;AAC/C;AAQA,eAAe,mCAAqE;AAClF,SAAO,wBAAwB,EAAE,IAAI,CAAC,UAAU,wBAAwB,KAAK,CAAC;AAChF;AAEA,SAAS,wBAAwB,OAAiD;AAChF,SAAO,sBAAsB,MAAM;AAAA,IACjC,IAAI,SAAS,MAAM,EAAE;AAAA,IACrB,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,UAAU,MAAM;AAAA,IAChB,MAAM,CAAC,GAAG,MAAM,IAAI;AAAA,IACpB,aAAa,MAAM;AAAA,IACnB,YAAY,MAAM;AAAA,IAClB,MAAM;AAAA,IACN,SAAS;AAAA,MACP,WAAW;AAAA,MACX,OAAO;AAAA,IACT;AAAA,IACA,UAAU;AAAA,MACR,WAAW,MAAM;AAAA,MACjB,SAAS,MAAM;AAAA,MACf,eAAe,MAAM;AAAA,MACrB,cAAc,MAAM;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM;AAAA,MACf,kBAAkB,MAAM;AAAA,MACxB,eAAe,MAAM;AAAA,MACrB,SAAS,MAAM;AAAA,MACf,cAAc,MAAM;AAAA,IACtB;AAAA,EACF,CAAC;AACH;AAEA,SAAS,0BAA0B,OAAqD;AACtF,SAAO,sBAAsB,MAAM;AAAA,IACjC,IAAI,MAAM;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,MAAM,WAAW,YAAY,YAAY;AAAA,IACjD,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,UAAU,MAAM;AAAA,IAChB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM,WAAW,YAAY,aAAa;AAAA,IAChD,SAAS;AAAA,MACP,WAAW;AAAA,MACX,OAAO;AAAA,IACT;AAAA,IACA,UAAU;AAAA,MACR,SAAS,MAAM;AAAA,MACf,eAAe,MAAM;AAAA,MACrB,cAAc,MAAM;AAAA,MACpB,YAAY,MAAM;AAAA,MAClB,WAAW,MAAM;AAAA,MACjB,eAAe,MAAM;AAAA,MACrB,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM;AAAA,MACf,gBAAgB,uBAAuB,KAAK;AAAA,IAC9C;AAAA,EACF,CAAC;AACH;AAEA,SAAS,uBAAuB,OAAuD;AACrF,SAAO;AAAA,IACL,WAAW,MAAM;AAAA,IACjB,qBAAqB,MAAM;AAAA,IAC3B,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,cAAc,MAAM;AAAA,IACpB,eAAe,MAAM;AAAA,IACrB,WAAW,MAAM;AAAA,IACjB,YAAY,MAAM;AAAA,IAClB,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB,QAAQ,MAAM,OAAO,IAAI,CAAC,WAAW,EAAE,GAAG,MAAM,EAAE;AAAA,EACpD;AACF;AAEA,SAAS,eAAe,OAA+B;AACrD,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;AAEA,SAAS,4BAA4B,MAAsC;AACzE,SACE,KAAK,gBAAgB,wBACpB,KAAK,gBAAgB,0BAA0B,KAAK,SAAS,oBAAoB;AAEtF;AAEA,SAAS,+BAA+B,MAGtC;AACA,QAAM,QAAQ,KAAK,SAAS;AAC5B,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,WAAO;AAAA,MACL,WAAW,KAAK,WAAW,CAAC,KAAK,eAAe,SAAS,cAAc,IAAI,IAAI;AAAA,MAC/E,aAAa,KAAK,eAAe,SAAS,cAAc,IAAI,IAAI;AAAA,IAClE;AAAA,EACF;AACA,QAAMC,UAAS;AACf,SAAO;AAAA,IACL,WACE,OAAOA,QAAO,cAAc,YAAY,OAAO,UAAUA,QAAO,SAAS,IACrE,KAAK,IAAI,GAAGA,QAAO,SAAS,IAC5B;AAAA,IACN,aACE,OAAOA,QAAO,gBAAgB,YAAY,OAAO,UAAUA,QAAO,WAAW,IACzE,KAAK,IAAI,GAAGA,QAAO,WAAW,IAC9B;AAAA,EACR;AACF;AAEO,SAAS,0BACd,MACA,cACA,eACuB;AACvB,MAAI,KAAK,SAAS,WAAW,KAAK,SAAS,SAAS,KAAK,SAAS,UAAU;AAC1E,WAAO,EAAE,GAAG,MAAM,SAAS,OAAO,eAAe,MAAM,eAAe,KAAK;AAAA,EAC7E;AACA,MAAI,KAAK,SAAS,QAAQ;AACxB,UAAMC,WAAU,cAAc,IAAI,uBAAuB,KAAK,EAAE,CAAC;AACjE,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAAA;AAAA,MACA,eAAeA,WAAU,YAAY;AAAA,IACvC;AAAA,EACF;AACA,MAAI,4BAA4B,IAAI,GAAG;AAIrC,WAAO,EAAE,GAAG,MAAM,eAAe,KAAK;AAAA,EACxC;AACA,MAAI,KAAK,gBAAgB,qBAAqB;AAI5C,WAAO,EAAE,GAAG,MAAM,eAAe,KAAK;AAAA,EACxC;AACA,MAAI,KAAK,gBAAgB,cAAc;AAIrC,WAAO,EAAE,GAAG,MAAM,eAAe,KAAK;AAAA,EACxC;AACA,MAAI,KAAK,WAAW,cAAc;AAChC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,MACT,eAAe;AAAA,MACf,eAAe;AAAA,IACjB;AAAA,EACF;AACA,MAAI,KAAK,WAAW,YAAY;AAI9B,WAAO,EAAE,GAAG,MAAM,eAAe,KAAK;AAAA,EACxC;AACA,QAAM,qBAAqB,cAAc,WAAW;AACpD,QAAM,UAAU,CAAC,CAAC,sBAAsB,mCAAmC,MAAM,YAAY;AAC7F,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,eAAe,UAAU,YAAY;AAAA,IACrC,eAAe,WAAW,eAAe,0BAA0B,aAAa,MAAM,IAAI;AAAA,EAC5F;AACF;AAEA,SAAS,yBAAyB,MAAoD;AACpF,MAAI,KAAK,WAAW,cAAc;AAChC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,WAAW;AAAA,QACT,QAAQ;AAAA,QACR,WAAW,KAAK,QAAQ,YAAY,UAAU;AAAA,QAC9C,QAAQ,KAAK,QAAQ;AAAA,QACrB,WAAW;AAAA,MACb;AAAA,MACA,SAAS,CAAC,SAAS;AAAA,IACrB;AAAA,EACF;AAEA,MAAI,CAAC,KAAK,QAAQ,WAAW;AAC3B,WAAO;AAAA,MACL,GAAG;AAAA,MACH,WAAW;AAAA,QACT,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,QAAQ,KAAK,QAAQ;AAAA,QACrB,WAAW,KAAK,WAAW,aAAa,aAAa;AAAA,MACvD;AAAA,MACA,SAAS,CAAC,SAAS;AAAA,IACrB;AAAA,EACF;AAEA,MAAI,4BAA4B,IAAI,GAAG;AACrC,UAAM,SAAS,+BAA+B,IAAI;AAClD,UAAM,iBAAiB,OAAO,cAAc;AAC5C,UAAM,YAAY,OAAO,YAAY;AACrC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,WAAW;AAAA,QACT,QAAQ,iBAAiB,oBAAoB,YAAY,cAAc;AAAA,QACvE,WAAW,iBAAiB,cAAc,YAAY,UAAU;AAAA,QAChE,QAAQ,KAAK;AAAA,QACb,WAAW;AAAA,MACb;AAAA,MACA,SAAS,iBACL,CAAC,UAAU,WAAW,cAAc,SAAS,IAC7C,YACE,CAAC,WAAW,aAAa,cAAc,SAAS,IAChD,CAAC,WAAW,SAAS;AAAA,IAC7B;AAAA,EACF;AAEA,MAAI,KAAK,gBAAgB,cAAc;AACrC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,WAAW;AAAA,QACT,QAAQ,KAAK,UAAU,cAAc;AAAA,QACrC,WAAW,KAAK,UAAU,UAAU;AAAA,QACpC,QAAQ,KAAK;AAAA,QACb,WAAW;AAAA,MACb;AAAA,MACA,SAAS,KAAK,UAAU,CAAC,aAAa,cAAc,SAAS,IAAI,CAAC,WAAW,SAAS;AAAA,IACxF;AAAA,EACF;AAEA,QAAM,YAAY,KAAK;AACvB,QAAM,UAA8B,YAChC,KAAK,SAAS,UAAU,KAAK,SAAS,WAAW,KAAK,SAAS,WAC7D,CAAC,aAAa,UAAU,aAAa,SAAS,IAC9C,CAAC,aAAa,cAAc,SAAS,IACvC,KAAK,SAAS,SAAS,KAAK,SAAS,QACnC,CAAC,WAAW,SAAS,IACrB,CAAC,WAAW,SAAS;AAC3B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW;AAAA,MACT,QAAQ,YACJ,KAAK,SAAS,SAAS,KAAK,SAAS,QACnC,UACA,cACF;AAAA,MACJ,WAAW,YAAY,UAAU;AAAA,MACjC,QAAQ,KAAK;AAAA,MACb,WAAW,KAAK,WAAW,aAAa,aAAa;AAAA,IACvD;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,8BACP,MACA,cACuB;AACvB,MAAI,CAAC,cAAc;AACjB,WAAO,EAAE,GAAG,MAAM,SAAS,OAAO,eAAe,MAAM,eAAe,KAAK;AAAA,EAC7E;AACA,QAAM,iBAAiB,eAAe,KAAK,SAAS,OAAO;AAC3D,QAAM,UACJ,mBAAmB,QAClB,mBAAmB,aAAa,WAC/B,eAAe,KAAK,SAAS,aAAa,MAAM,aAAa,iBAC7D,eAAe,KAAK,SAAS,YAAY,MAAM,aAAa;AAChE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS;AAAA,IACT,eAAe,UACX,yBACA,WAAW,aAAa,OAAO;AAAA,IACnC,eAAe;AAAA,IACf,UAAU;AAAA,MACR,GAAG,KAAK;AAAA,MACR,gBAAgB,uBAAuB,YAAY;AAAA,MACnD,iBAAiB,CAAC;AAAA,IACpB;AAAA,EACF;AACF;AAQA,SAAS,0BACP,QACwC;AACxC,QAAM,MAAM,OAAO;AACnB,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,WAAO;AAAA,EACT;AACA,QAAM,EAAE,cAAc,gBAAgB,MAAM,aAAa,IAAI;AAC7D,MAAI,OAAO,mBAAmB,YAAY,OAAO,SAAS,UAAU;AAClE,WAAO;AAAA,EACT;AACA,MAAI,iBAAiB,WAAW;AAG9B,WAAO,EAAE,gBAAgB,MAAM,cAAc,UAAU;AAAA,EACzD;AACA,MAAI,OAAO,iBAAiB,UAAU;AACpC,WAAO;AAAA,EACT;AACA,SAAO,EAAE,cAAc,gBAAgB,KAAK;AAC9C;AAEA,SAAS,mBAAmB,OAAyD;AACnF,QAAM,OAAO,oBAAI,IAAmC;AACpD,aAAW,QAAQ,OAAO;AAIxB,QAAI,KAAK,SAAS,WAAW,KAAK,WAAW,aAAa,KAAK,IAAI,KAAK,EAAE,GAAG;AAC3E,WAAK,IAAI,KAAK,IAAI,IAAI;AACtB;AAAA,IACF;AACA,UAAM,WAAW,KAAK,IAAI,KAAK,EAAE;AACjC,QAAI,UAAU,SAAS,WAAW,SAAS,WAAW,WAAW;AAC/D;AAAA,IACF;AACA,SAAK,IAAI,KAAK,IAAI,IAAI;AAAA,EACxB;AACA,SAAO,CAAC,GAAG,KAAK,OAAO,CAAC;AAC1B;AAEA,SAAS,oBAAoB,GAA0B,GAAkC;AACvF,SAAO,GAAG,EAAE,IAAI,IAAI,EAAE,QAAQ,IAAI,EAAE,IAAI,GAAG,cAAc,GAAG,EAAE,IAAI,IAAI,EAAE,QAAQ,IAAI,EAAE,IAAI,EAAE;AAC9F;AAcO,SAAS,6BACd,OACA,OACA,QAAQ,GACwB;AAChC,QAAM,SAAS,8BAA8B,KAAK;AAClD,QAAM,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,MAAM,GAAG,EAAE,OAAO,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,EAAE;AAC1E,MAAI,OAAO,WAAW,EAAG,QAAO,CAAC;AACjC,QAAM,eAAe,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,CAAC,CAAC;AAChE,QAAM,iBAAiB,CAAC,SACtB;AAAA,IACE,CAAC,QAAQ,KAAK,MAAM,GAAG;AAAA,IACvB,CAAC,YAAY,KAAK,kBAAkB,IAAI,EAAE;AAAA,IAC1C,CAAC,OAAO,KAAK,KAAK,KAAK,GAAG,GAAG,EAAE;AAAA,IAC/B,CAAC,YAAY,KAAK,UAAU,EAAE;AAAA,IAC9B,CAAC,MAAM,KAAK,IAAI,EAAE;AAAA,IAClB,CAAC,eAAe,KAAK,eAAe,IAAI,EAAE;AAAA,EAC5C;AAEF,SAAO,MACJ,OAAO,CAAC,SAAS,0CAA0C,IAAI,CAAC,EAChE,QAAQ,CAAC,SAAyC;AACjD,QAAI,QAAQ;AACZ,UAAM,YAAY,oBAAI,IAAuD;AAC7E,eAAW,CAAC,OAAO,KAAK,MAAM,KAAK,eAAe,IAAI,GAAG;AACvD,YAAM,QAAQ,8BAA8B,GAAG;AAC/C,UAAI,CAAC,MAAO;AACZ,YAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,UAAI,MAAM,SAAS,MAAM,GAAG;AAC1B,iBAAS,KAAK,MAAM,SAAS,GAAG;AAChC,kBAAU,IAAI,KAAK;AAAA,MACrB;AACA,iBAAW,SAAS,QAAQ;AAC1B,YAAI,MAAM,SAAS,KAAK,GAAG;AACzB,mBAAS;AACT,oBAAU,IAAI,KAAK;AAAA,QACrB,WAAW,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,KAAK,KAAK,MAAM,WAAW,IAAI,CAAC,GAAG;AACjF,mBAAS,KAAK,MAAM,SAAS,GAAG;AAChC,oBAAU,IAAI,KAAK;AAAA,QACrB,WAAW,MAAM,SAAS,KAAK,GAAG;AAChC,mBAAS,KAAK,MAAM,SAAS,GAAG;AAChC,oBAAU,IAAI,KAAK;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AACA,QAAI,UAAU,EAAG,QAAO,CAAC;AACzB,QAAI,KAAK,QAAS,UAAS;AAC3B,QAAI,KAAK,SAAS,WAAY,UAAS;AACvC,QAAI,KAAK,WAAW,WAAY,UAAS;AACzC,WAAO,CAAC,EAAE,MAAM,OAAO,WAAW,CAAC,GAAG,SAAS,EAAE,CAAC;AAAA,EACpD,CAAC,EACA;AAAA,IACC,CAAC,MAAM,UACL,MAAM,QAAQ,KAAK,SACnB,OAAO,MAAM,KAAK,OAAO,IAAI,OAAO,KAAK,KAAK,OAAO,KACrD,KAAK,KAAK,KAAK,cAAc,MAAM,KAAK,IAAI,KAC5C,KAAK,KAAK,GAAG,cAAc,MAAM,KAAK,EAAE;AAAA,EAC5C,EACC,MAAM,GAAG,YAAY;AAC1B;AAEA,SAAS,8BAA8B,OAAuB;AAC5D,SAAO,MACJ,UAAU,MAAM,EAChB,QAAQ,oBAAoB,EAAE,EAC9B,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,KAAK;AACV;AAEA,SAAS,sBAAsB,SAAqD;AAClF,QAAM,SAAS;AAAA,IACb,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ,eAAe,QAAQ,cAAc,QAAQ,eAAe;AAAA,EACtE,EAAE,KAAK,GAAG;AACV,SAAO,GAAG,QAAQ,IAAI,IAAI,QAAQ,QAAQ,IAAI,CAAC,IAAI,UAAU,MAAM,CAAC;AACtE;AAEA,SAAS,2BAA2B,MAAc,SAAiB,aAA6B;AAC9F,SAAO,gBAAgB,QAAQ,IAAI,CAAC,IAAI,UAAU,GAAG,IAAI,IAAI,OAAO,IAAI,WAAW,EAAE,CAAC;AACxF;AAEA,SAAS,uBAAuB,cAA8B;AAC5D,SAAO,aAAa,QAAQ,UAAU,EAAE;AAC1C;AAEA,SAAS,WAAW,MAA0B;AAC5C,SAAO,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AACnE;AAEA,SAAS,cAAc,QAA4B;AACjD,SAAO,CAAC,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AACzE;AAEA,SAAS,QAAQ,OAAuB;AACtC,SACE,MACG,YAAY,EACZ,QAAQ,iBAAiB,GAAG,EAC5B,QAAQ,YAAY,EAAE,EACtB,MAAM,GAAG,EAAE,KAAK;AAEvB;AAEA,SAAS,UAAU,OAAuB;AACxC,MAAI,OAAO;AACX,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,YAAQ,MAAM,WAAW,KAAK;AAC9B,WAAO,KAAK,KAAK,MAAM,QAAU;AAAA,EACnC;AACA,UAAQ,SAAS,GAAG,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,EAAE,MAAM,GAAG,CAAC;AAC9D;AA0CA,SAAS,8BAA8B,OAAuD;AAC5F,QAAM,SAAS,MAAM;AACrB,MAAI,CAAC,QAAQ,MAAM;AACjB,WAAO;AAAA,EACT;AACA,QAAM,WAAW,MAAM,QAAQ,2CAA2C;AAC1E,MAAI,UAAU,UAAU,SAAS,WAAW,UAAU;AACpD,WAAO;AAAA,EACT;AACA,MAAI,UAAU,aAAa,OAAO;AAChC,WAAO;AAAA,EACT;AACA,QAAM,SAAS,OAAO,SAAS;AAAA,IAC7B,CAAC,cAAc,UAAU,SAAS,qBAAqB,UAAU;AAAA,EACnE;AACA,QAAM,cAAc,SAAS,QAAQ,GAAG;AACxC,MAAI,CAAC,UAAU,CAAC,aAAa;AAC3B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,OAAO,WAAW;AAClC,QAAM,KAAK,2BAA2B,OAAO,MAAM,SAAS,WAAW;AACvE,QAAM,cAAc,SAAS,OAAO,UAAU,KAAK,SAAS,OAAO,YAAY,GAAG;AAClF,QAAM,kBAAkB,sBAAsB,MAAM;AACpD,QAAM,cAAc,yBAAyB,IAAI,CAAC,CAAC;AACnD,SAAO,sBAAsB,MAAM;AAAA,IACjC;AAAA,IACA,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,OAAO,SAAS,OAAO;AAAA,IAC7B,aAAa,OAAO,eAAe;AAAA,IACnC,UAAU;AAAA,IACV,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,gBAAgB,SAAS,CAAC,sBAAsB,IAAI,CAAC;AAAA,IAC3D;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,WAAW,gBAAgB,SAAS,mBAAmB;AAAA,IACvD,OAAO,CAAC,EAAE,MAAM,OAAO,IAAI,YAAY,CAAC;AAAA,IACxC,SAAS;AAAA,MACP,WAAW;AAAA,MACX;AAAA,MACA,WAAW;AAAA,MACX,OACE,gBAAgB,WAAW,IACvB,sDACA,0CAA0C,gBAAgB,KAAK,IAAI,CAAC;AAAA,IAC5E;AAAA,IACA,UAAU;AAAA,MACR,UAAU;AAAA,MACV,cAAc,OAAO;AAAA,MACrB;AAAA,MACA,WAAW,UAAU;AAAA,MACrB,UAAU,OAAO,YAAY,CAAC;AAAA,MAC9B;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,sBAAsB,QAAqC;AAClE,UAAQ,OAAO,WAAW,CAAC,GACxB,OAAO,CAAC,WAAW,OAAO,QAAQ,OAAO,eAAe,KAAK,EAC7D,IAAI,CAAC,WAAW,OAAO,KAAM,KAAK,CAAC,EACnC,OAAO,OAAO;AACnB;AAEA,SAAS,SAAS,OAA0C;AAC1D,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE,SAAS;AAAA,EACjC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,kBAAkB,MAAqC;AAC9D,SAAO;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,GAAG,KAAK;AAAA,IACR,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,UAAU,KAAK,QAAQ;AAAA,EAC9B,EACG,OAAO,OAAO,EACd,KAAK,GAAG,EACR,YAAY;AACjB;AAEA,SAAS,mCACP,MACA,cACS;AACT,MAAI,CAAC,gBAAgB,KAAK,SAAS,OAAO;AACxC,WAAO,CAAC,CAAC;AAAA,EACX;AACA,MAAI,CAAC,KAAK,QAAQ,WAAW;AAC3B,WAAO;AAAA,EACT;AACA,MAAI,CAAC,+BAA+B,MAAM,YAAY,GAAG;AACvD,WAAO;AAAA,EACT;AACA,QAAM,eAAe,aAAa,SAAS;AAC3C,SACE,CAAC,CAAC,gBACF,OAAO,iBAAiB,YACxB,YAAY,iBACX,aAAa,WAAW,QAAQ,aAAa,WAAW;AAE7D;AAMA,SAAS,+BACP,MACA,cACS;AACT,MAAI,oBAAoB,aAAa,MAAM,GAAG;AAC5C,WAAO;AAAA,EACT;AACA,QAAM,cAAc,IAAI;AAAA,KACrB,MAAM,QAAQ,aAAa,OAAO,WAAW,IAAI,aAAa,OAAO,cAAc,CAAC,GAClF,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ,EACzD,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC;AAAA,EACrC;AACA,QAAM,WAAW,0BAA0B,KAAK,QAAQ;AACxD,MAAI,SAAS,KAAK,CAAC,SAAS,CAAC,YAAY,IAAI,KAAK,YAAY,CAAC,CAAC,GAAG;AACjE,WAAO;AAAA,EACT;AACA,SAAO,CAAC,KAAK,aAAa,YAAY,OAAO;AAC/C;AAEA,SAAS,oBAAoB,QAA0C;AACrE,QAAM,MAAM,OAAO;AACnB,SACE,CAAC,CAAC,OACF,OAAO,QAAQ,YACf,CAAC,MAAM,QAAQ,GAAG,KAClB,OAAQ,IAAqC,mBAAmB;AAEpE;;;AG7+DA,SAAS,cAAAC,mBAAkB;AAE3B;AAAA,EACE,8BAAAC;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,iBAAAC,sBAAqB;AAmC9B,IAAM,gBAAgB;AACtB,IAAM,YAAY;AAClB,IAAM,yBAAyB;AAE/B,eAAsB,mBACpB,QACA,QAC8B;AAC9B,QAAM,SAAS,iBAAiB,MAAM;AACtC,QAAM,eAAe,MAAM,OAAO,cAAc,OAAO,OAAO,OAAO,YAAY,OAAO,GAAG;AAC3F,MAAI,CAAC,UAAU,KAAK,YAAY,GAAG;AACjC,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,2CAA2C,CAAC;AAAA,EACtF;AACA,QAAM,OAAO,MAAM,OAAO,SAAS,OAAO,OAAO,OAAO,YAAY,YAAY;AAChF,QAAM,aAAa,gBAAgB,QAAQ,IAAI;AAC/C,QAAM,UAAU,oBAAoB,MAAM,UAAU;AACpD,QAAM,gBAAgB,QAAQ,OAAO,CAAC,KAAK,UAAU,OAAO,MAAM,QAAQ,IAAI,CAAC;AAC/E,MAAI,QAAQ,SAAS,0BAA0B;AAC7C,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,4BAA4B,wBAAwB;AAAA,IAC/D,CAAC;AAAA,EACH;AACA,MAAI,gBAAgB,gCAAgC;AAClD,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,iBAAiB,8BAA8B;AAAA,IAC1D,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,MAAM,cAAc,SAAS,wBAAwB,OAAO,UAAU;AAClF,QAAI;AACJ,QAAI;AACF,gBAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE;AAAA,QAClD,MAAM,OAAO,SAAS,OAAO,OAAO,OAAO,YAAY,MAAM,GAAG;AAAA,MAClE;AAAA,IACF,QAAQ;AACN,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,uCAAuC,kBAAkB,MAAM,MAAM,UAAU,CAAC;AAAA,MAC3F,CAAC;AAAA,IACH;AACA,WAAO,EAAE,MAAM,kBAAkB,MAAM,MAAM,UAAU,GAAG,QAAQ;AAAA,EACpE,CAAC;AACD,MAAI;AACJ,MAAI;AACF,eAAWD,4BAA2B,KAAK;AAAA,EAC7C,SAAS,OAAO;AACd,UAAM,IAAIC,eAAc,KAAK;AAAA,MAC3B,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IACpD,CAAC;AAAA,EACH;AACA,QAAM,gBAAgB,sBAAsB,OAAO,KAAK,IAAI,OAAO,UAAU;AAC7E,QAAM,YACJ,eAAe,MACX,GAAG,aAAa,SAAS,YAAY,KACrC,GAAG,aAAa,SAAS,YAAY,IAAI,iBAAiB,UAAU,CAAC;AAC3E,QAAM,WAAqB,CAAC;AAC5B,MAAI,CAAC,SAAS,MAAM,KAAK,CAAC,SAAS,6BAA6B,KAAK,KAAK,IAAI,CAAC,GAAG;AAChF,aAAS,KAAK,6DAA6D;AAAA,EAC7E;AACA,QAAM,kBAAkB,SAAS,MAAM,OAAO,CAAC,SAAS,oBAAoB,KAAK,KAAK,IAAI,CAAC;AAC3F,MAAI,gBAAgB,SAAS,GAAG;AAC9B,aAAS;AAAA,MACP,GAAG,gBAAgB,MAAM,eAAe,gBAAgB,WAAW,IAAI,KAAK,GAAG;AAAA,IACjF;AAAA,EACF;AACA,SAAO;AAAA,IACL,SAAS;AAAA,MACP,QAAQ,OAAO;AAAA,MACf;AAAA,MACA;AAAA,MACA,OAAO,OAAO;AAAA,MACd,YAAY,OAAO;AAAA,MACnB;AAAA,MACA;AAAA,MACA,MAAM,SAAS;AAAA,MACf,aAAa,SAAS;AAAA,MACtB,eAAe,SAAS;AAAA,MACxB,YAAY,SAAS;AAAA,MACrB,OAAO,SAAS,MAAM,IAAI,CAAC,SAAS;AAClC,cAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,OAAO;AACnD,eAAO;AAAA,UACL,MAAM,KAAK;AAAA,UACX,UAAU,MAAM;AAAA,UAChB,eAAeC,WAAU,KAAK;AAAA,QAChC;AAAA,MACF,CAAC;AAAA,MACD;AAAA,MACA,WAAW;AAAA,MACX,qBAAqB;AAAA,IACvB;AAAA,IACA,OAAO,SAAS;AAAA,EAClB;AACF;AAEO,SAAS,uBACd,QACQ;AACR,SAAO,SAAS,OAAO,KAAK,IAAI,OAAO,UAAU,IAAI,OAAO,UAAU,GAAG,YAAY;AACvF;AAEO,SAAS,0BACd,QACQ;AACR,QAAM,WAAW,uBAAuB,MAAM;AAC9C,QAAM,SAASH,YAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC9E,SAAO,SAAS,OAAO,KAAK,YAAY,CAAC,IAAI,MAAM;AACrD;AAEO,SAAS,iBAAiB,QAAmC;AAClE,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,MAAM;AAAA,EACtB,QAAQ;AACN,UAAM,IAAIE,eAAc,KAAK,EAAE,SAAS,wCAAwC,CAAC;AAAA,EACnF;AACA,MAAI,IAAI,aAAa,YAAY,IAAI,YAAY,IAAI,YAAY,IAAI,MAAM;AACzE,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,WAAW,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,IAAI,kBAAkB;AAC/E,MAAI,IAAI,aAAa,eAAe,IAAI,aAAa,iBAAiB;AACpE,QAAI,SAAS,WAAW,GAAG;AACzB,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM,CAACE,QAAOC,aAAY,SAAS,IAAI;AACvC,2BAAuBD,QAAQC,WAAW;AAC1C,QAAI,CAAC,aAAa,CAAC,cAAc,KAAK,SAAS,GAAG;AAChD,YAAM,IAAIH,eAAc,KAAK,EAAE,SAAS,sCAAsC,CAAC;AAAA,IACjF;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAOE;AAAA,MACP,YAAY,eAAeC,WAAW;AAAA,MACtC,KAAK;AAAA,MACL,eAAe;AAAA,MACf;AAAA,MACA,UAAU,IAAI,SAAS;AAAA,IACzB;AAAA,EACF;AACA,MAAI,IAAI,aAAa,gBAAgB,IAAI,aAAa,kBAAkB;AACtE,UAAM,IAAIH,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,0CAA0C,CAAC;AAAA,EACrF;AACA,QAAM,QAAQ,SAAS,CAAC;AACxB,QAAM,aAAa,eAAe,SAAS,CAAC,CAAE;AAC9C,yBAAuB,OAAO,UAAU;AACxC,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,KAAK;AAAA,MACL,eAAe;AAAA,MACf,WAAW;AAAA,MACX,UAAU,IAAI,SAAS;AAAA,IACzB;AAAA,EACF;AACA,QAAM,OAAO,SAAS,CAAC;AACvB,MAAI,SAAS,UAAU,SAAS,QAAQ;AACtC,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,MAAM,SAAS,CAAC;AACtB,MAAI,CAAC,IAAK,OAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,uCAAuC,CAAC;AAC1F,QAAM,eAAe,SAAS,MAAM,CAAC;AACrC,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,2CAA2C,CAAC;AAAA,EACtF;AACA,QAAM,gBAAgB;AAAA,IACpB,SAAS,UAAU,aAAa,GAAG,EAAE,GAAG,YAAY,MAAM,aACtD,aAAa,MAAM,GAAG,EAAE,IACxB;AAAA,EACN;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX,UAAU,IAAI,SAAS;AAAA,EACzB;AACF;AAEA,SAAS,gBAAgB,QAA2B,MAA+C;AACjG,QAAM,aAAa,KAChB;AAAA,IACC,CAAC,UACC,MAAM,SAAS,UACf,MAAM,SAAS,aACd,MAAM,SAAS,cAAc,MAAM,KAAK,SAAS,WAAW;AAAA,EACjE,EACC,IAAI,CAAC,UAAU,MAAM,KAAK,MAAM,GAAG,CAAC,YAAY,MAAM,KAAK,GAAG,EAC9D,KAAK;AACR,MAAI,OAAO,eAAe;AACxB,UAAM,OAAO,OAAO;AACpB,QAAI,CAAC,WAAW,SAAS,IAAI,GAAG;AAC9B,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,sCAAsC,IAAI;AAAA,MACrD,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AACA,QAAM,aAAa,OAAO,YACtB,WAAW,OAAO,CAAC,SAAS,KAAK,MAAM,GAAG,EAAE,GAAG,EAAE,MAAM,OAAO,SAAS,IACvE;AACJ,MAAI,WAAW,WAAW,GAAG;AAC3B,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,0CAA0C,CAAC;AAAA,EACrF;AACA,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO,WAAW,CAAC;AACrB;AAEA,SAAS,oBACP,MACA,MACwB;AACxB,QAAM,SAAS,SAAS,MAAM,KAAK,GAAG,IAAI;AAC1C,QAAM,SAAS,KAAK,OAAO,CAAC,UAAU,MAAM,KAAK,WAAW,MAAM,CAAC;AACnE,QAAM,cAAc,OAAO;AAAA,IACzB,CAAC,UAAU,MAAM,SAAS,YAAa,MAAM,SAAS,UAAU,MAAM,SAAS;AAAA,EACjF;AACA,MAAI,aAAa;AACf,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,+DAA+D,YAAY,IAAI;AAAA,IAC1F,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,OACX,OAAO,CAAC,UAAU,MAAM,SAAS,MAAM,EACvC,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;AAC5D,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,qCAAqC,CAAC;AAAA,EAChF;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAAc,MAAsB;AAC7D,SAAO,SAAS,MAAM,OAAO,KAAK,MAAM,KAAK,SAAS,CAAC;AACzD;AAEA,SAAS,oBAAoB,UAAqC;AAChE,MACE,SAAS,WAAW,KACpB,SAAS;AAAA,IACP,CAAC,YACC,QAAQ,WAAW,KACnB,YAAY,OACZ,YAAY,QACZ,QAAQ,SAAS,IAAI,KACrB,yBAAyB,KAAK,OAAO;AAAA,EACzC,GACA;AACA,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,mCAAmC,CAAC;AAAA,EAC9E;AACA,SAAO,SAAS,KAAK,GAAG;AAC1B;AAEA,SAAS,iBAAiB,MAAsB;AAC9C,SAAO,KACJ,MAAM,GAAG,EACT,IAAI,CAAC,YAAY,mBAAmB,OAAO,CAAC,EAC5C,KAAK,GAAG;AACb;AAEA,SAAS,eAAe,OAAuB;AAC7C,SAAO,MAAM,QAAQ,YAAY,EAAE;AACrC;AAEA,SAAS,uBAAuB,OAAe,YAA0B;AACvE,MAAI,CAAC,cAAc,KAAK,KAAK,KAAK,CAAC,cAAc,KAAK,eAAe,UAAU,CAAC,GAAG;AACjF,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,iDAAiD,CAAC;AAAA,EAC5F;AACF;AAEA,eAAe,cACb,QACA,aACA,KACmB;AACnB,QAAM,SAAS,IAAI,MAAc,OAAO,MAAM;AAC9C,MAAI,OAAO;AACX,QAAM,QAAQ;AAAA,IACZ,MAAM,KAAK,EAAE,QAAQ,KAAK,IAAI,aAAa,OAAO,MAAM,EAAE,GAAG,YAAY;AACvE,iBAAS;AACP,cAAM,QAAQ;AACd,gBAAQ;AACR,YAAI,SAAS,OAAO,OAAQ;AAC5B,eAAO,KAAK,IAAI,MAAM,IAAI,OAAO,KAAK,CAAE;AAAA,MAC1C;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,SAASC,WAAU,OAA2B;AAC5C,SAAOH,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;;;AC7VA,SAAS,kCAAAM,uCAAqD;AAE9D,SAAS,kBAAAC,iBAAgB,wBAAuC;AAChE,SAAS,iBAAAC,sBAAqB;AAGvB,IAAM,iCAAiC;AACvC,IAAM,gCAAgC;AAM7C,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,mBAAmB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,qCAAqC,MAAoB;AACvE,MAAI,mBAAmB,IAAI,IAAI,KAAK,iBAAiB,KAAK,CAAC,WAAW,KAAK,WAAW,MAAM,CAAC,GAAG;AAC9F,UAAM,IAAIC,eAAc,KAAK;AAAA,MAC3B,SAAS,6EAA6E,IAAI;AAAA,IAC5F,CAAC;AAAA,EACH;AACF;AAGO,IAAM,uCAAuC;AAE7C,SAAS,6BAA6B,UAAgC;AAC3E,QAAM,MAAMC,gCAA+B,QAAQ;AACnD,MAAI,CAAC,KAAK;AACR,UAAM,IAAID,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAGO,IAAM,+BAA+B;AAE5C,eAAsB,yBACpB,IACA,aACA,eACsB;AACtB,QAAM,cAAc,MAAME,gBAAe,IAAI,aAAa,aAAa;AACvE,MAAI,CAAC,aAAa;AAChB,UAAM,IAAIF,eAAc,KAAK,EAAE,SAAS,wBAAwB,CAAC;AAAA,EACnE;AACA,SAAO;AACT;AAWA,eAAsB,8BACpB,MACA,OACA,aACA,eACA,UAAuC,CAAC,GAClB;AACtB,+BAA6B,KAAK,QAAQ;AAC1C,MAAI,CAAC,QAAQ,eAAe;AAC1B,sBAAkB,OAAO,mBAAmB;AAAA,EAC9C;AACA,QAAM,cAAc,MAAME,gBAAe,KAAK,IAAI,aAAa,aAAa;AAC5E,MAAI,CAAC,aAAa;AAChB,UAAM,IAAIF,eAAc,KAAK,EAAE,SAAS,wBAAwB,CAAC;AAAA,EACnE;AACA,SAAO;AACT;AAEA,eAAsB,4BACpB,IACA,OAWe;AACf,QAAM,iBAAiB,IAAI;AAAA,IACzB,WAAW,MAAM,MAAM;AAAA,IACvB,aAAa,MAAM,MAAM;AAAA,IACzB,WAAW,MAAM,MAAM;AAAA,IACvB,QAAQ,MAAM;AAAA,IACd,YAAY;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB,UAAU;AAAA,MACR,eAAe,MAAM;AAAA,MACrB,GAAI,MAAM,eAAe,EAAE,MAAM,MAAM,aAAa,IAAI,CAAC;AAAA,IAC3D;AAAA,EACF,CAAC;AACH;;;ACtHA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAAG;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,kBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,iBAAAC,sBAAqB;;;ACrC9B,SAAS,cAAAC,mBAAkB;AAC3B;AAAA,EACE,oBAAoB;AAAA,EACpB,cAAAC;AAAA,OAMK;AAOP,SAAS,OAAO,OAAuB;AACrC,SAAO,UAAUD,YAAW,QAAQ,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO,KAAK,CAAC;AAC3E;AAEO,SAAS,uCAAuC,YAA4B;AACjF,SAAO,OAAO,UAAU;AAC1B;AAEO,SAAS,0BACd,YACQ;AACR,SAAO,OAAO,WAAW,eAAe,EAAE;AAC5C;AASO,SAAS,4BAA4B,OAIjC;AACT,SAAO;AAAA,IACLC,YAAW;AAAA,MACT,SAAS;AAAA,MACT,SAAS,MAAM;AAAA,MACf,aAAa,MAAM;AAAA,MACnB,OAAO,MAAM,WAAW;AAAA,MACxB,aAAa,MAAM,WAAW;AAAA,MAC9B,QAAQ,MAAM,WAAW;AAAA,MACzB,iBAAiB,MAAM,WAAW;AAAA,MAClC,uBAAuB,MAAM,WAAW;AAAA,IAC1C,CAAC;AAAA,EACH;AACF;AAIO,SAAS,+BAA+B,OAIpC;AACT,QAAM,QAAQD,YAAW,QAAQ,EAC9B,OAAO,0CAA0C,MAAM,EACvD,OAAO,MAAM,UAAU,MAAM,EAC7B,OAAO,MAAM,MAAM,EACnB,OAAO,MAAM,SAAS,MAAM,EAC5B,OAAO,MAAM,MAAM,EACnB,OAAO,MAAM,aAAa,MAAM,EAChC,OAAO,EACP,SAAS,GAAG,EAAE;AAGjB,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,MAAM,MAAM,SAAS,KAAK;AAChC,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AAC1G;AAEO,SAAS,kCACd,OACA,YACS;AACT,SACE,MAAM,cAAc,0BAA0B,UAAU,KACxD,MAAM,gBACJ,4BAA4B;AAAA,IAC1B,SAAS,MAAM;AAAA,IACf,aAAa,MAAM;AAAA,IACnB;AAAA,EACF,CAAC;AAEP;AAQO,SAAS,kCACd,cACA,YACmB;AACnB,QAAM,SAAS,yBAAyB,UAAU,cAAc,aAAa;AAC7E,MAAI,CAAC,OAAO,WAAW,OAAO,KAAK,WAAW,WAAY,QAAO,CAAC;AAClE,MAAI,CAAC,kCAAkC,OAAO,MAAM,UAAU,EAAG,QAAO,CAAC;AACzE,SAAO,EAAE,CAAC,OAAO,KAAK,OAAO,GAAG,OAAO,KAAK;AAC9C;;;ADnEO,IAAM,yBAAyB;AAC/B,IAAM,qBAAqB;AAC3B,IAAM,+BAA+B;AACrC,IAAM,oCAAoC;AAqBjD,eAAsB,oBACpB,IACA,OAMe;AACf,QAAME,kBAAiB,IAAI;AAAA,IACzB,WAAW,MAAM,MAAM;AAAA,IACvB,aAAa,MAAM,MAAM;AAAA,IACzB,WAAW,MAAM,MAAM;AAAA,IACvB,QAAQ,MAAM;AAAA,IACd,YAAY;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB,UAAU,EAAE,OAAO,MAAM,OAAO,GAAI,MAAM,YAAY,CAAC,EAAG;AAAA,EAC5D,CAAC;AACH;AAIO,SAAS,iBAAiB,OAA4B;AAC3D,SAAO,QAAQ,MAAM,SAAS;AAChC;AAEA,eAAsB,iBACpB,IACA,aACA,OACc;AACd,QAAM,MAAM,MAAMC,QAAO,IAAI,aAAa,KAAK;AAC/C,MAAI,CAAC,KAAK;AACR,UAAM,IAAIC,eAAc,KAAK,EAAE,SAAS,gBAAgB,CAAC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,eAAsB,uBACpB,IACA,aACA,OACA,UACoB;AACpB,QAAM,SAAS,MAAM,aAAa,IAAI,aAAa,QAAQ;AAG3D,MAAI,CAAC,UAAU,OAAO,UAAU,OAAO;AACrC,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;AAAA,EAClE;AACA,SAAO;AACT;AAEA,SAAS,eAAe,MAAsB;AAC5C,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,uBAAuB,CAAC;AAAA,EAClE;AACA,SAAO;AACT;AAGA,SAAS,uBAAuB,QAA2D;AACzF,MAAI,CAAC,QAAQ;AACX;AAAA,EACF;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,SAAS,QAAQ;AAC1B,QAAI,KAAK,IAAI,MAAM,IAAI,GAAG;AACxB,YAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,6BAA6B,MAAM,IAAI,GAAG,CAAC;AAAA,IACrF;AACA,SAAK,IAAI,MAAM,IAAI;AAAA,EACrB;AACF;AAIA,eAAe,wBACb,IACA,aACA,KACe;AACf,MAAI,CAAC,OAAO,IAAI,WAAW,GAAG;AAC5B;AAAA,EACF;AACA,QAAM,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC;AAC/B,aAAW,MAAM,QAAQ;AACvB,UAAM,cAAc,MAAMC,gBAAe,IAAI,aAAa,EAAE;AAC5D,QAAI,CAAC,aAAa;AAChB,YAAM,IAAID,eAAc,KAAK,EAAE,SAAS,iCAAiC,EAAE,GAAG,CAAC;AAAA,IACjF;AAAA,EACF;AACF;AAEA,eAAsB,gBACpB,MACA,OACA,SACc;AACd,QAAM,cAAc,MAAM;AAC1B,QAAM,OAAO,eAAe,QAAQ,IAAI;AACxC,yBAAuB,QAAQ,MAAM;AACrC,QAAM,wBAAwB,KAAK,IAAI,aAAa,QAAQ,qBAAqB;AACjF,MAAK,MAAM,UAAU,KAAK,IAAI,WAAW,KAAM,wBAAwB;AACrE,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,gCAAgC,sBAAsB;AAAA,IACjE,CAAC;AAAA,EACH;AACA,MAAI,MAAM,aAAa,KAAK,IAAI,aAAa,IAAI,GAAG;AAClD,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,+BAA+B,IAAI,GAAG,CAAC;AAAA,EACjF;AACA,QAAM,YAAY,iBAAiB,KAAK;AACxC,QAAM,MAAM,MAAM,UAAU,KAAK,IAAI;AAAA,IACnC,WAAW,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,aAAa,QAAQ,eAAe;AAAA,IACpC;AAAA,IACA,gBAAgB;AAAA,MACd,OAAO,QAAQ,SAAS;AAAA,MACxB,aAAa,QAAQ,eAAe;AAAA,MACpC,QAAQ,QAAQ;AAAA,MAChB,iBAAiB,QAAQ;AAAA,MACzB,uBAAuB,QAAQ;AAAA,MAC/B,WAAW;AAAA,MACX;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,oBAAoB,KAAK,IAAI,EAAE,OAAO,QAAQ,eAAe,OAAO,IAAI,GAAG,CAAC;AAClF,SAAO;AACT;AAEA,eAAsB,gBACpB,MACA,OACA,KACA,SACc;AACd,QAAM,cAAc,MAAM;AAC1B,QAAM,OAAO,QAAQ,SAAS,SAAY,eAAe,QAAQ,IAAI,IAAI;AACzE,MAAI,SAAS,UAAa,SAAS,IAAI,MAAM;AAC3C,UAAM,WAAW,MAAM,aAAa,KAAK,IAAI,aAAa,IAAI;AAC9D,QAAI,YAAY,SAAS,OAAO,IAAI,IAAI;AACtC,YAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,+BAA+B,IAAI,GAAG,CAAC;AAAA,IACjF;AAAA,EACF;AACA,QAAM,UAAU,MAAM,UAAU,KAAK,IAAI,aAAa,IAAI,IAAI;AAAA,IAC5D,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,QAAQ,gBAAgB,SAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EAClF,CAAC;AACD,QAAM,oBAAoB,KAAK,IAAI,EAAE,OAAO,QAAQ,eAAe,OAAO,IAAI,GAAG,CAAC;AAClF,SAAO;AACT;AAEA,eAAsB,gBACpB,MACA,OACA,KACe;AACf,QAAM,cAAc,MAAM;AAC1B,QAAM,UAAU,MAAM,4BAA4B,KAAK,IAAI,aAAa,IAAI,EAAE;AAC9E,MAAI,QAAQ,qBAAqB,GAAG;AAClC,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS,wBAAwB,QAAQ,kBAAkB;AAAA,IAC7D,CAAC;AAAA,EACH;AACA,MAAI,CAAC,QAAQ,SAAS;AACpB,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,gBAAgB,CAAC;AAAA,EAC3D;AACA,QAAM,oBAAoB,KAAK,IAAI,EAAE,OAAO,QAAQ,eAAe,OAAO,IAAI,GAAG,CAAC;AACpF;AAMA,eAAsB,uBACpB,MACA,OACA,KACA,SACA,UAAmC,CAAC,GAChB;AACpB,QAAM,cAAc,MAAM;AAC1B,MAAI,CAAC,IAAI,eAAe;AACtB,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,gDAAgD,CAAC;AAAA,EAC3F;AACA,MAAI,QAAQ,SAAS,mBAAmB;AACtC,2BAAuB,QAAQ,QAAQ,MAAM;AAC7C,UAAM;AAAA,MACJ,KAAK;AAAA,MACL;AAAA,MACA,QAAQ,QAAQ,yBAAyB;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,SAAS,MAAM,gBAAgB,KAAK,IAAI;AAAA,IAC5C,WAAW,MAAM;AAAA,IACjB;AAAA,IACA,OAAO,IAAI;AAAA,IACX,eAAe,IAAI,cAAc;AAAA,IACjC,MAAM,QAAQ;AAAA,IACd,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ,cAAc,iBAAiB,KAAK;AAAA,EAC1D,CAAC;AACD,QAAM,oBAAoB,KAAK,IAAI;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,OAAO,IAAI;AAAA,IACX,UAAU,EAAE,UAAU,OAAO,IAAI,MAAM,OAAO,KAAK;AAAA,EACrD,CAAC;AACD,SAAO;AACT;AAQO,SAAS,+BAA+B,OAIb;AAChC,MAAI,MAAM,YAAY;AACpB,WAAO,EAAE,QAAQ,UAAU,QAAQ,oBAAoB;AAAA,EACzD;AACA,MAAI,CAAC,MAAM,QAAQ;AACjB,WAAO,EAAE,QAAQ,YAAY,QAAQ,SAAS;AAAA,EAChD;AACA,MAAI,MAAM,SAAS,gBAAgB;AACjC,WAAO,EAAE,QAAQ,UAAU,QAAQ,eAAe;AAAA,EACpD;AACA,SAAO,EAAE,QAAQ,YAAY,QAAQ,uBAAuB;AAC9D;AAEO,SAAS,sBACd,iBACA,SACQ;AACR,QAAM,QAAQ,mBAAmB,IAAI,QAAQ;AAC7C,SAAO,OAAO,GAAG,IAAI;AAAA,EAAK,OAAO,KAAK;AACxC;AAEA,eAAe,2BACb,MACA,aACA,OACA,UACA,OACqD;AACrD,MAAI;AACF,WAAO,MAAM,mCAAmC,KAAK,IAAI,aAAa,OAAO,UAAU,KAAK;AAAA,EAC9F,SAAS,OAAO;AACd,QAAI,iBAAiB,8BAA8B;AACjD,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,kDAAkD,MAAM,iBAAiB,SAAS,MAAM,mBAAmB,MAAM;AAAA,MAC5H,CAAC;AAAA,IACH;AACA,QAAI,iBAAiB,0BAA0B;AAC7C,YAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,IACzD;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,yBACpB,MACA,OACA,KACA,QACqD;AACrD,MAAI,OAAO,SAAS,gBAAgB;AAClC,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,OAAO,WAAW,cAAc,OAAO,WAAW,aAAa;AACjE,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,iBAAiB,OAAO,MAAM,mBAAmB,CAAC;AAAA,EAC5F;AACA,MAAI,CAAC,OAAO,eAAe;AACzB,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,iCAAiC,CAAC;AAAA,EAC5E;AACA,QAAM,OAAO,MAAM,cAAc,KAAK,IAAI,MAAM,aAAa,IAAI,IAAI,OAAO,aAAa;AACzF,MAAI,CAAC,MAAM;AACT,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,6BAA6B,CAAC;AAAA,EACxE;AACA,QAAM,UAAU,OAAO;AACvB,MAAI,OAAO,QAAQ,YAAY,YAAY,CAAC,QAAQ,QAAQ,KAAK,GAAG;AAClE,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,yCAAyC,CAAC;AAAA,EACpF;AACA,QAAM,iBAAiB;AAAA,IACrB,OAAO,KAAK;AAAA,IACZ,aAAa,sBAAsB,KAAK,aAAa,QAAQ,OAAO;AAAA,IACpE,QAAQ,KAAK;AAAA,IACb,iBAAiB,KAAK;AAAA,IACtB,uBAAuB,KAAK;AAAA,EAC9B;AACA,QAAM,EAAE,SAAS,QAAQ,QAAQ,IAAI,MAAM;AAAA,IACzC;AAAA,IACA,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,OAAO;AAAA,IACP;AAAA,MACE,yBAAyB,OAAO;AAAA,MAChC,GAAG;AAAA,MACH,WACE,OAAO,QAAQ,SAAS,YAAY,QAAQ,KAAK,KAAK,IAClD,QAAQ,OACR;AAAA,MACN,WAAW,OAAO,cAAc,iBAAiB,KAAK;AAAA,MACtD,gBAAgB,kCAAkC,OAAO,cAAc,cAAc;AAAA,IACvF;AAAA,EACF;AACA,QAAM,oBAAoB,KAAK,IAAI;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,OAAO,IAAI;AAAA,IACX,UAAU,EAAE,UAAU,OAAO,IAAI,WAAW,QAAQ,IAAI,SAAS,QAAQ,QAAQ;AAAA,EACnF,CAAC;AACD,QAAM,oBAAoB,KAAK,IAAI;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,OAAO,IAAI;AAAA,IACX,UAAU,EAAE,UAAU,OAAO,IAAI,WAAW,QAAQ,IAAI,SAAS,QAAQ,QAAQ;AAAA,EACnF,CAAC;AACD,SAAO,EAAE,QAAQ,SAAS,QAAQ;AACpC;AAEA,eAAsB,0CACpB,MACA,OACA,KACA,QACqD;AACrD,MAAI,OAAO,SAAS,mBAAmB;AACrC,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,oDAAoD,CAAC;AAAA,EAC/F;AACA,MAAI,OAAO,WAAW,YAAY;AAChC,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,iBAAiB,OAAO,MAAM,mBAAmB,CAAC;AAAA,EAC5F;AACA,MAAI,OAAO,cAAc,WAAW,MAAM;AACxC,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,OAAO,eAAe;AACzB,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,iCAAiC,CAAC;AAAA,EAC5E;AACA,QAAM,OAAO,MAAM,cAAc,KAAK,IAAI,MAAM,aAAa,IAAI,IAAI,OAAO,aAAa;AACzF,MAAI,CAAC,MAAM;AACT,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,6BAA6B,CAAC;AAAA,EACxE;AACA,QAAM,UAAU,OAAO;AAQvB,QAAM,iBAAiB;AAAA,IACrB,OAAO,QAAQ,UAAU,SAAY,KAAK,QAAS,QAAQ;AAAA,IAC3D,aACE,QAAQ,gBAAgB,SAAY,KAAK,cAAe,QAAQ;AAAA,IAClE,QAAQ,MAAM,QAAQ,QAAQ,MAAM,IAAK,QAAQ,SAAkC,KAAK;AAAA,IACxF,iBAAiB,MAAM,QAAQ,QAAQ,eAAe,IACjD,QAAQ,kBACT,KAAK;AAAA,IACT,uBAAuB,MAAM,QAAQ,QAAQ,qBAAqB,IAC7D,QAAQ,wBACT,KAAK;AAAA,EACX;AACA,QAAM,EAAE,SAAS,QAAQ,QAAQ,IAAI,MAAM;AAAA,IACzC;AAAA,IACA,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,OAAO;AAAA,IACP;AAAA,MACE,yBAAyB,OAAO;AAAA,MAChC,GAAG;AAAA,MACH,WACE,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAC5D,QAAQ,YACR;AAAA,MACN,WAAW,iBAAiB,KAAK;AAAA,MACjC,gBAAgB,kCAAkC,OAAO,cAAc,cAAc;AAAA,IACvF;AAAA,EACF;AACA,QAAM,oBAAoB,KAAK,IAAI;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,OAAO,IAAI;AAAA,IACX,UAAU,EAAE,UAAU,OAAO,IAAI,WAAW,QAAQ,IAAI,SAAS,QAAQ,QAAQ;AAAA,EACnF,CAAC;AACD,QAAM,oBAAoB,KAAK,IAAI;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,OAAO,IAAI;AAAA,IACX,UAAU,EAAE,UAAU,OAAO,IAAI,WAAW,QAAQ,IAAI,SAAS,QAAQ,QAAQ;AAAA,EACnF,CAAC;AACD,SAAO,EAAE,QAAQ,SAAS,QAAQ;AACpC;AAEA,eAAsB,uBACpB,MACA,OACA,KACA,SACqB;AACrB,MAAI,CAAC,IAAI,eAAe;AACtB,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,4BAA4B,CAAC;AAAA,EACvE;AACA,yBAAuB,QAAQ,MAAM;AACrC,QAAM;AAAA,IACJ,KAAK;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,yBAAyB;AAAA,EACnC;AACA,QAAM,OAAO,IAAI;AACjB,QAAM,UAAU,MAAM;AAAA,IACpB,KAAK;AAAA,IACL,MAAM;AAAA,IACN,IAAI;AAAA,IACJ;AAAA,MACE,OAAO,QAAQ,UAAU,SAAY,KAAK,QAAQ,QAAQ;AAAA,MAC1D,aAAa,QAAQ,gBAAgB,SAAY,KAAK,cAAc,QAAQ;AAAA,MAC5E,QAAQ,QAAQ,UAAU,KAAK;AAAA,MAC/B,iBAAiB,QAAQ,mBAAmB,KAAK;AAAA,MACjD,uBAAuB,QAAQ,yBAAyB,KAAK;AAAA,MAC7D,WAAW,QAAQ,aAAa;AAAA,MAChC,WAAW,iBAAiB,KAAK;AAAA,IACnC;AAAA,IACA,EAAE,UAAU,KAAK;AAAA,EACnB;AACA,QAAM,oBAAoB,KAAK,IAAI;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,OAAO,IAAI;AAAA,IACX,UAAU,EAAE,WAAW,QAAQ,IAAI,SAAS,QAAQ,SAAS,QAAQ,KAAK;AAAA,EAC5E,CAAC;AACD,SAAO;AACT;AAIA,eAAsB,yBACpB,MACA,OACA,KACA,WACqB;AACrB,QAAM,cAAc,MAAM;AAC1B,QAAM,UAAU,MAAM,mBAAmB,KAAK,IAAI,aAAa,IAAI,IAAI,SAAS;AAChF,QAAM,oBAAoB,KAAK,IAAI;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,OAAO,IAAI;AAAA,IACX,UAAU,EAAE,WAAW,QAAQ,IAAI,SAAS,QAAQ,QAAQ;AAAA,EAC9D,CAAC;AACD,SAAO;AACT;AAIA,eAAsB,sBACpB,MACA,aACA,OACuB;AACvB,SAAO,MAAM,gBAAgB,KAAK,IAAI,aAAa,KAAK;AAC1D;AAEA,eAAsB,qBACpB,MACA,aACA,OACA,OACsB;AACtB,SAAO,MAAM,eAAe,KAAK,IAAI,aAAa,OAAO,KAAK;AAChE;;;AEzhBA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA,yBAAAE;AAAA,EACA;AAAA,EACA,qBAAAC;AAAA,EACA,2BAAAC;AAAA,EACA,yBAAAC;AAAA,OAIK;AAYA,SAAS,kCACd,MACoB;AACpB,MAAK,KAAK,WAAW,UAAU,KAAK,WAAW,SAAU,KAAK,UAAU,SAAS,WAAW;AAC1F,WAAO;AAAA,EACT;AACA,SAAO,CAAC,OAAO,gBAAgB,mBAAmB,UAAU,EAAE;AAAA,IAAK,CAAC,QAClE,OAAO,UAAU,eAAe,KAAK,KAAK,kBAAkB,GAAG;AAAA,EACjE,IACI,SACA,KAAK,UAAU;AACrB;AAEO,SAAS,2CACd,OACoC;AACpC,QAAM,kBAAkB,MAAM,WAAW,WAAW;AACpD,QAAM,eAAe,MAAM,WAAW,QAAQ;AAC9C,MAAI,OAAO,oBAAoB,YAAY,OAAO,iBAAiB,UAAU;AAC3E,WAAO,EAAE,MAAM,QAAQ,WAAW,iBAAiB,QAAQ,aAAa;AAAA,EAC1E;AACA,MACE,MAAM,kBAAkB,mBACxB,MAAM,kBAAkB,aACxB,MAAM,kBACN;AACA,WAAO,EAAE,MAAM,OAAO;AAAA,EACxB;AACA,SAAO,EAAE,MAAM,WAAW,WAAW,MAAM,UAAU;AACvD;AAEA,eAAsB,oCAAoC,OAIhB;AACxC,QAAM,YAAY,MAAMA;AAAA,IACtB,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,IACZ,MAAM,SAAS;AAAA,IACf;AAAA,EACF;AACA,QAAM,SAAS,2CAA2C,MAAM,KAAK;AACrE,MAAI,OAAO,SAAS;AAClB,WAAO,UAAU,IAAI,CAAC,gBAAgB,EAAE,YAAY,WAAW,KAAK,EAAE;AACxE,MAAI,OAAO,SAAS,WAAW;AAC7B,UAAM,UAAU,MAAMA;AAAA,MACpB,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,MAAM,SAAS;AAAA,MACf,OAAO;AAAA,IACT;AACA,WAAO,QAAQ,IAAI,CAAC,gBAAgB;AAAA,MAClC;AAAA,MACA,WAAW,WAAW,cAAc,aAAa,OAAO,YAAY;AAAA,IACtE,EAAE;AAAA,EACJ;AACA,QAAM,eACJ,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,IACZ,OAAO;AAAA,IACP,OAAO;AAAA,EACT,GACA,OAAO,CAAC,SAAS,KAAK,mBAAmB,QAAQ;AACnD,QAAM,WAAyC,CAAC;AAChD,aAAW,cAAc,aAAa;AACpC,QAAI,CAAE,MAAMF,mBAAkB,MAAM,IAAI,WAAW,gBAAgB,MAAM,MAAM,WAAW;AACxF;AACF,UAAM,aAAa,MAAM;AAAA,MACvB,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AACA,QAAI,CAAC,cAAc,WAAW,cAAc,WAAY;AACxD,UAAM,SAAS,WAAW,aAAa,MAAM,UAAU,GAAG,WAAW,QAAQ;AAC7E,QAAI,CAAC,mBAAmB,QAAQ,WAAW,cAAc,EAAG;AAC5D,aAAS,KAAK,EAAE,YAAY,WAAW,WAAW,eAAe,CAAC;AAAA,EACpE;AACA,SAAO,CAAC,GAAG,UAAU,IAAI,CAAC,gBAAgB,EAAE,YAAY,WAAW,KAAK,EAAE,GAAG,GAAG,QAAQ;AAC1F;AAEA,eAAsB,uCAAuC,OAGhB;AAC3C,QAAM,aAAa,MAAMC,yBAAwB,MAAM,IAAI,MAAM,MAAM,aAAa,IAAI,GAAG;AAAA,IACzF,CAAC,eACC,WAAW,cAAc,QACzB,WAAW,WAAW,YACtB,mBAAmB,WAAW,gBAAgB,mBAAmB;AAAA,EACrE;AACA,QAAM,SAAS,2CAA2C,MAAM,KAAK;AACrE,MAAI,OAAO,SAAS,QAAQ;AAC1B,WAAO,UAAU,IAAI,CAAC,gBAAgB,EAAE,YAAY,WAAW,KAAK,EAAE;AAAA,EACxE;AACA,MAAI,OAAO,SAAS,WAAW;AAC7B,UAAM,UAAU,MAAMA;AAAA,MACpB,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,OAAO;AAAA,IACT;AACA,WAAO,QACJ;AAAA,MACC,CAAC,eACC,WAAW,WAAW,YACtB,mBAAmB,WAAW,gBAAgB,mBAAmB;AAAA,IACrE,EACC,IAAI,CAAC,gBAAgB;AAAA,MACpB;AAAA,MACA,WAAW,WAAW,cAAc,OAAO,OAAO,OAAO;AAAA,IAC3D,EAAE;AAAA,EACN;AACA,QAAM,eACJ,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,IACZ,OAAO;AAAA,IACP,OAAO;AAAA,EACT,GACA,OAAO,CAAC,SAAS,KAAK,mBAAmB,WAAW;AACtD,QAAM,WAA4C,CAAC;AACnD,aAAW,cAAc,aAAa;AACpC,QAAI,CAAE,MAAMD,mBAAkB,MAAM,IAAI,WAAW,gBAAgB,MAAM,MAAM,WAAW,GAAI;AAC5F;AAAA,IACF;AACA,UAAM,aAAa,MAAMD;AAAA,MACvB,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AACA,QACE,CAAC,cACD,WAAW,cAAc,WAAW,kBACpC,WAAW,WAAW,YACtB,CAAC,mBAAmB,WAAW,gBAAgB,WAAW,cAAc,KACxE,CAAC,mBAAmB,WAAW,gBAAgB,mBAAmB,GAClE;AACA;AAAA,IACF;AACA,aAAS,KAAK,EAAE,YAAY,WAAW,WAAW,eAAe,CAAC;AAAA,EACpE;AACA,SAAO,CAAC,GAAG,UAAU,IAAI,CAAC,gBAAgB,EAAE,YAAY,WAAW,KAAK,EAAE,GAAG,GAAG,QAAQ;AAC1F;AAEO,SAAS,kCACd,UACA,OACmB;AACnB,QAAM,WAAW,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AACrD,SAAO,SAAS,WAAW;AAAA,IACzB,CAAC,WAAW,SAAS,IAAI,OAAO,EAAE,KAAK,OAAO,eAAe,iBAAiB;AAAA,EAChF;AACF;AAEA,SAAS,6BAA6B,aAAyD;AAC7F,SAAO,CAAC,GAAG,WAAW,EAAE,KAAK,CAAC,MAAM,UAAU;AAC5C,UAAM,SAAS,OAAO,MAAM,WAAW,QAAQ,IAAI,OAAO,KAAK,WAAW,QAAQ;AAClF,QAAI,WAAW,EAAG,QAAO;AACzB,UAAM,UAAU,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,MAAM,KAAK,SAAS;AACvE,QAAI,YAAY,EAAG,QAAO;AAC1B,UAAM,UAAU,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,MAAM,KAAK,SAAS;AACvE,QAAI,YAAY,EAAG,QAAO;AAC1B,WAAO,MAAM,GAAG,cAAc,KAAK,EAAE;AAAA,EACvC,CAAC;AACH;AAEA,SAAS,mBAAmB,MAAc,OAAwB;AAChE,SAAO,KAAK,YAAY,MAAM,MAAM,YAAY;AAClD;AAEO,SAAS,oDAAoD,OAI9B;AACpC,QAAM,cAAiD,CAAC;AACxD,QAAM,cAAc,6BAA6B,MAAM,WAAW;AAClE,aAAW,UAAU,MAAM,SAAS;AAClC,UAAM,MAAM,OAAO;AACnB,QAAI,CAAC,OAAO,IAAI,iBAAiB,UAAW;AAC5C,UAAM,aAAa,YAAY;AAAA,MAC7B,CAAC,cACC,UAAU,cAAc,MAAM,aAC9B,UAAU,WAAW,YACrB,mBAAmB,UAAU,gBAAgB,IAAI,cAAc,MAC9D,CAAC,IAAI,QAAQ,UAAU,SAAS,IAAI,UACpC,CAAC,IAAI,gBAAgB,UAAU,OAAO,IAAI;AAAA,IAC/C;AACA,QAAI,CAAC,WAAY;AACjB,gBAAY,KAAK;AAAA,MACf,UAAU,OAAO;AAAA,MACjB,cAAc,WAAW;AAAA,MACzB,gBAAgB,MAAM;AAAA,MACtB,gBAAgB,WAAW;AAAA,MAC3B,MAAM,WAAW;AAAA,IACnB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEO,SAAS,wCAAwC,OAGlB;AACpC,QAAM,MAAM,MAAM,QAAQ,QAAQ,CAAC,WAAW;AAC5C,UAAM,MAAM,OAAO;AACnB,QAAI,CAAC,OAAO,IAAI,iBAAiB,UAAW,QAAO,CAAC;AACpD,UAAM,aAAa,MAAM,kBAAkB;AAAA,MACzC,CAAC,cACC,UAAU,aAAa,OAAO,MAC9B,mBAAmB,UAAU,gBAAgB,IAAI,cAAc,MAC9D,CAAC,IAAI,QAAQ,CAAC,UAAU,QAAQ,UAAU,SAAS,IAAI;AAAA,IAC5D;AACA,WAAO,aAAa,CAAC,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC;AAAA,EAC7C,CAAC;AACD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAG,MAAM,kBACN;AAAA,MACC,CAAC,SACC,KAAK,mBAAmB,YACxB,KAAK,mBAAmB,eACxB,KAAK,aAAa;AAAA,IACtB,EACC,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,EAAE;AAAA,EAChC;AACF;AAQO,SAAS,uDAAuD,OAG5B;AACzC,QAAM,WAAW,MAAM,YAAY,OAAO,CAACI,gBAAe;AACxD,QACEA,YAAW,cAAc,MAAM,aAC/BA,YAAW,WAAW,YACtBA,YAAW,SAAS,YACpB,CAAC,mBAAmBA,YAAW,gBAAgB,4BAA4B,KAC3E,CAAC,iCAAiCA,YAAW,eAAe,cAAc,GAC1E;AACA,aAAO;AAAA,IACT;AACA,UAAM,WAAW,8BAA8B,UAAUA,YAAW,QAAQ;AAC5E,WAAO;AAAA,MACL,SAAS,WACT,SAAS,KAAK,qBACd,SAAS,KAAK,WAAW,UAAU,aAClC,CAAC,SAAS,KAAK,aAAa,SAAS,KAAK,UAAU,UAAU;AAAA,IACjE;AAAA,EACF,CAAC;AACD,MAAI,SAAS,WAAW,EAAG,QAAO;AAClC,QAAM,aAAa,SAAS,CAAC;AAC7B,SAAO;AAAA,IACL,UAAU;AAAA,IACV,cAAc,WAAW;AAAA,IACzB,gBAAgB,MAAM;AAAA,IACtB,gBAAgB,WAAW;AAAA,IAC3B,MAAM,WAAW;AAAA,EACnB;AACF;AAEO,SAAS,mCACd,MACA,OACS;AACT,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,QAAM,WAAW,IAAI,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,UAAU,UAAU,CAAC,CAAC;AACrF,SAAO,KAAK,MAAM,CAAC,eAAe;AAChC,UAAM,QAAQ,SAAS,IAAI,WAAW,QAAQ;AAC9C,WACE,OAAO,iBAAiB,WAAW,gBACnC,MAAM,mBAAmB,WAAW,kBACpC,mBAAmB,MAAM,gBAAgB,WAAW,cAAc,KAClE,MAAM,SAAS,WAAW,QAC1B,MAAM,mBAAmB,WAAW;AAAA,EAExC,CAAC;AACH;AAEO,SAAS,sCACd,aACA,QACwC;AACxC,QAAM,MAAM,OAAO;AACnB,MAAI,CAAC,OAAO,IAAI,iBAAiB,UAAW,QAAO;AACnD,SACE,YAAY;AAAA,IACV,CAAC,eACC,WAAW,aAAa,OAAO,MAC/B,mBAAmB,WAAW,gBAAgB,IAAI,cAAc,MAC/D,CAAC,IAAI,QAAQ,CAAC,WAAW,QAAQ,WAAW,SAAS,IAAI;AAAA,EAC9D,KAAK;AAET;AAMA,SAAS,6BACP,SACmC;AACnC,QAAM,MAAM,QAAQ;AACpB,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,gBAAgB,IAAI;AAAA,IACpB,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,IACjD,GAAI,IAAI,SAAS,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC;AAAA,IAC3C,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,IACjD,GAAI,IAAI,oBAAoB,EAAE,mBAAmB,IAAI,kBAAkB,IAAI,CAAC;AAAA,EAC9E;AACF;AAQO,SAAS,wCAAwC,OAKvB;AAC/B,SAAO,OAAO,YAAY;AACxB,QAAI,mBAAmB;AACvB,QAAI,QAAQ,cAAc,iBAAiB,WAAW;AACpD,YAAM,SAAS,MAAM,SAAS,WAAW,KAAK,CAAC,WAAW,OAAO,OAAO,QAAQ,QAAQ;AACxF,YAAM,yBACJ,QAAQ,aAAa,sCACrB,mBAAmB,QAAQ,cAAc,gBAAgB,4BAA4B,IACjF,MAAM,8BAA8B;AAAA,QAClC,CAAC,cACC,UAAU,aAAa,sCACvB,mBAAmB,UAAU,gBAAgB,4BAA4B,KACzE,UAAU,SAAS,YACnB,QAAQ,cAAc,SAAS;AAAA,MACnC,IACA,CAAC;AACP,YAAM,aAAa,SACf,sCAAsC,MAAM,+BAA+B,MAAM,IACjF,uBAAuB,WAAW,IAChC,uBAAuB,CAAC,IACxB;AACN,UAAI,CAAC,cAAc,CAAE,MAAM,MAAM,4BAA4B,WAAW,cAAc,GAAI;AACxF,eAAO,6BAA6B,OAAO;AAAA,MAC7C;AACA,yBAAmB;AAAA,QACjB,GAAG;AAAA,QACH,WAAW,WAAW;AAAA,QACtB,eAAe;AAAA,UACb,GAAG,QAAQ;AAAA,UACX,gBAAgB,WAAW;AAAA,UAC3B,cAAc,WAAW;AAAA,UACzB,GAAI,WAAW,OAAO,EAAE,MAAM,WAAW,KAAK,IAAI,CAAC;AAAA,QACrD;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,MAAM,MAAM,kBAAkB,gBAAgB;AAC7D,QAAI,OAAO,WAAW,QAAQ,QAAQ,cAAc,iBAAiB,WAAW;AAC9E,aAAO;AAAA,IACT;AACA,WAAO,6BAA6B,OAAO;AAAA,EAC7C;AACF;AAEA,eAAsB,oCAAoC,OAMX;AAC7C,QAAM,UAAU,kCAAkC,MAAM,UAAU,MAAM,KAAK;AAC7E,QAAM,+BAA+B,MAAM,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,UAAU;AACtF,MAAK,QAAQ,WAAW,KAAK,CAAC,gCAAiC,MAAM,OAAO,SAAS,QAAQ;AAC3F,WAAO,CAAC;AAAA,EACV;AACA,MAAI,MAAM,OAAO,SAAS,QAAQ;AAChC,UAAM,YAAY,wCAAwC;AAAA,MACxD;AAAA,MACA,mBAAmB,MAAM;AAAA,QACvB,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,OAAO;AAAA,QACb,MAAM,OAAO;AAAA,MACf;AAAA,IACF,CAAC;AACD,WAAO,+BACH,YACA,UAAU;AAAA,MACR,CAAC,SACC,KAAK,mBAAmB,YACxB,KAAK,mBAAmB,eACxB,KAAK,aAAa;AAAA,IACtB;AAAA,EACN;AACA,QAAM,aAAa,MAAMH,mBAAkB,MAAM,IAAI,MAAM,OAAO,WAAW,MAAM,WAAW;AAC9F,MAAI,CAAC,WAAY,QAAO,CAAC;AACzB,QAAM,qBAAqB,MAAMC;AAAA,IAC/B,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM,OAAO;AAAA,EACf;AACA,QAAM,MAAM,oDAAoD;AAAA,IAC9D;AAAA,IACA,WAAW,MAAM,OAAO;AAAA,IACxB,aAAa;AAAA,EACf,CAAC;AACD,MAAI,CAAC,6BAA8B,QAAO;AAC1C,QAAM,iBAAiB,MAAM,OAAO;AACpC,QAAM,UAAU,MAAMC,uBAAsB,MAAM,IAAI,MAAM,aAAa,KAAK,cAAc;AAC5F,QAAM,SAAS,oBAAI,IAA8C;AACjE,aAAW,cAAc,SAAS;AAChC,QACE,WAAW,cAAc,cACzB,WAAW,WAAW,eACrB,WAAW,aAAa,OAAO,WAAW,aAAa;AAExD;AACF,UAAM,QAAQ,OAAO,IAAI,WAAW,QAAQ;AAC5C,QAAI,CAAC,SAAS,WAAW,YAAY,MAAM;AACzC,aAAO,IAAI,WAAW,UAAU,UAAU;AAAA,EAC9C;AACA,QAAM,oBAAoB,mBAAmB;AAAA,IAC3C,CAAC,eACC,WAAW,cAAc,kBACzB,WAAW,WAAW,YACtB,mBAAmB,WAAW,gBAAgB,mBAAmB;AAAA,EACrE;AACA,QAAM,yBAAyB,uDAAuD;AAAA,IACpF,WAAW;AAAA,IACX,aAAa;AAAA,EACf,CAAC;AACD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAI,yBAAyB,CAAC,sBAAsB,IAAI,CAAC;AAAA,IACzD,GAAG,CAAC,GAAG,OAAO,OAAO,CAAC,EAAE,IAAI,CAAC,gBAAgB;AAAA,MAC3C,UAAU,UAAU,WAAW,QAAQ;AAAA,MACvC,cAAc,WAAW;AAAA,MACzB;AAAA,MACA,gBAAgB,WAAW,aAAa,MAAM,UAAU,GAAG,WAAW,QAAQ;AAAA,MAC9E,MAAM;AAAA,MACN,gBAAgB;AAAA,IAClB,EAAE;AAAA,IACF,GAAG,kBAAkB,IAAI,CAAC,gBAAgB;AAAA,MACxC,UAAU,aAAa,WAAW,EAAE;AAAA,MACpC,cAAc,WAAW;AAAA,MACzB;AAAA,MACA,gBAAgB,WAAW;AAAA,MAC3B,MAAM,WAAW;AAAA,MACjB,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AACF;;;ACrfA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,qBAAqB;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAAE;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,iBAAAC,sBAAqB;AAEvB,SAAS,iBAAiB,OAAkB,UAAkC;AACnF,QAAM,eAAe,IAAI,IAAI,SAAS,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AAC3E,QAAM,MAAiB,CAAC;AACxB,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,SAAS,OAAO;AACvB,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,0BAA2B,KAA2B,IAAI;AAAA,MACrE,CAAC;AAAA,IACH;AACA,UAAM,WAAW,KAAK,aAAa;AACnC,QAAI,CAAC,aAAa,IAAI,KAAK,EAAE,GAAG;AAC9B,UAAI,UAAU;AACZ;AAAA,MACF;AACA,YAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,0BAA0B,KAAK,EAAE,GAAG,CAAC;AAAA,IAC/E;AASA,QAAI;AAAA,MACF,WAAW,EAAE,MAAM,OAAO,IAAI,KAAK,IAAI,UAAU,KAAK,IAAI,EAAE,MAAM,OAAO,IAAI,KAAK,GAAG;AAAA,IACvF;AAAA,EACF;AACA,SAAO,cAAc,CAAC,GAAG,GAAG;AAC9B;AAIO,SAAS,6BACd,UACA,iBACW;AACX,QAAM,gBAAgB,IAAI,IAAI,SAAS,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AAC5E,SACE,gBAAgB,WACb,OAAO,CAAC,WAAW,CAAC,cAAc,IAAI,OAAO,EAAE,CAAC,EAKhD,IAAI,CAAC,YAAY,EAAE,MAAM,OAAO,IAAI,OAAO,IAAI,UAAU,KAAK,EAAE;AAEvE;AAEO,SAAS,qCACd,OACA,UACA,iBACW;AACX,SAAO,cAAc,OAAO,6BAA6B,UAAU,eAAe,CAAC;AACrF;AAGO,SAAS,kBAAkB,OAAkB,UAAkC;AACpF,QAAM,YAAY,IAAI,IAAI,SAAS,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AACxE,SAAO,MAAM,OAAO,CAAC,SAAS,UAAU,IAAI,KAAK,EAAE,CAAC;AACtD;AAGO,SAAS,qBACd,WACA,SACA,UAAU,kDACJ;AACN,QAAM,aAAa,IAAI,IAAI,QAAQ,IAAI,CAAC,SAAS,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;AAC3E,QAAM,UAAU,UAAU,KAAK,CAAC,SAAS,CAAC,WAAW,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;AACnF,MAAI,SAAS;AACX,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,GAAG,OAAO,KAAK,QAAQ,EAAE,GAAG,CAAC;AAAA,EACvE;AACF;AAGO,SAAS,iCAAiC,OAKnC;AACZ,QAAM,YAAY,iBAAiB,MAAM,WAAW,MAAM,QAAQ;AAClE,uBAAqB,WAAW,MAAM,cAAc,MAAM,OAAO;AACjE,SAAO;AACT;AAEO,SAAS,mBAAmB,WAAyC;AAC1E,QAAM,aAAa,oBAAI,IAAoB;AAC3C,QAAM,aAAa,oBAAI,IAAoB;AAC3C,QAAM,6BAA6B,oBAAI,IAAoB;AAC3D,QAAM,gBAAgB,oBAAI,IAAY;AACtC,QAAM,MAAqB,CAAC;AAC5B,aAAW,YAAY,WAAW;AAChC,QAAI;AACJ,QAAI,SAAS,SAAS,QAAQ;AAC5B,YAAM,YAAY,mBAAmB,kBAAkB,QAAQ,CAAC;AAChE,mBAAa;AAAA,QACX,MAAM;AAAA,QACN,QAAQ,SAAS;AAAA,QACjB;AAAA,MACF;AAAA,IACF,OAAO;AACL,YAAM,qBAAqB,mCAAmC,QAAQ;AACtE,UAAI;AACJ,UAAI;AACF,wBAAgB,gCAAgC,SAAS,GAAG;AAAA,MAC9D,SAAS,OAAO;AACd,cAAM,IAAIA,eAAc,KAAK;AAAA,UAC3B,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AAAA,QACpD,CAAC;AAAA,MACH;AACA,YAAM,YAAY;AAAA,QAChB,SAAS,aAAa,2BAA2B,eAAe,kBAAkB;AAAA,MACpF;AACA,YAAM,sBAAsB,oCAAoC,UAAU,kBAAkB;AAC5F,WACG,SAAS,uBAAuB,SAAS,gBAAgB,SAAS,WACnE,CAAC,oBACD;AACA,cAAM,IAAIA,eAAc,KAAK;AAAA,UAC3B,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,UAAI,sBAAsB,qBAAqB;AAC7C,cAAM,gBAAgB,2BAA2B,IAAI,mBAAmB;AACxE,YAAI,iBAAiB,kBAAkB,oBAAoB;AACzD,gBAAM,IAAIA,eAAc,KAAK;AAAA,YAC3B,SAAS,sBAAsB,mBAAmB;AAAA,UACpD,CAAC;AAAA,QACH;AACA,mCAA2B,IAAI,qBAAqB,kBAAkB;AAAA,MACxE;AACA,mBAAa;AAAA,QACX,MAAM;AAAA,QACN,KAAK;AAAA,QACL,KAAK,SAAS,IAAI,KAAK;AAAA,QACvB;AAAA,QACA,GAAI,SAAS,UAAU,EAAE,SAAS,2BAA2B,SAAS,OAAO,EAAE,IAAI,CAAC;AAAA,QACpF,GAAI,SAAS,WAAW,EAAE,UAAU,SAAS,SAAS,IAAI,CAAC;AAAA,QAC3D,GAAI,SAAS,sBACT,EAAE,qBAAqB,SAAS,oBAAoB,IACpD,CAAC;AAAA,QACL,GAAI,SAAS,SAAS,EAAE,QAAQ,SAAS,OAAO,IAAI,CAAC;AAAA,QACrD,GAAI,SAAS,iBAAiB,SAAY,EAAE,cAAc,SAAS,aAAa,IAAI,CAAC;AAAA,QACrF,GAAI,SAAS,mBAAmB,SAC5B,EAAE,gBAAgB,SAAS,eAAe,IAC1C,CAAC;AAAA,QACL,GAAI,SAAS,cAAc,SAAY,EAAE,WAAW,SAAS,UAAU,IAAI,CAAC;AAAA,QAC5E,GAAI,SAAS,eAAe,EAAE,cAAc,SAAS,aAAa,IAAI,CAAC;AAAA,QACvE,GAAI,SAAS,uBACT,EAAE,sBAAsB,SAAS,qBAAqB,IACtD,CAAC;AAAA,QACL,GAAI,SAAS,qBAAqB,EAAE,oBAAoB,SAAS,mBAAmB,IAAI,CAAC;AAAA,MAC3F;AAAA,IACF;AACA,UAAM,MAAMD,YAAW,UAAU;AACjC,UAAM,oBAAoB,WAAW,YACjC,8BAA8B,WAAW,SAAS,IAClD;AACJ,UAAM,UAAU,oBAAoB,WAAW,IAAI,iBAAiB,IAAI;AACxE,QAAI,WAAW,YAAY,KAAK;AAC9B,YAAM,IAAIC,eAAc,KAAK;AAAA,QAC3B,SAAS,kCAAkC,WAAW,SAAS;AAAA,MACjE,CAAC;AAAA,IACH;AACA,QAAI,WAAW,WAAW;AACxB,iBAAW,IAAI,mBAAoB,GAAG;AAAA,IACxC;AACA,UAAM,WAAW,oBAAoB,UAAU;AAC/C,UAAM,eAAe,WAAW,IAAI,QAAQ;AAC5C,QAAI,gBAAgB,iBAAiB,KAAK;AACxC,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,+CAA+C,QAAQ;AAAA,MAClE,CAAC;AAAA,IACH;AACA,eAAW,IAAI,UAAU,GAAG;AAC5B,QAAI,CAAC,cAAc,IAAI,GAAG,GAAG;AAC3B,oBAAc,IAAI,GAAG;AACrB,UAAI,KAAK,UAAU;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,kBACd,UACA,WACe;AACf,MAAI;AACF,WAAO,0BAA0B,UAAU,WAAW,EAAE,iBAAiB,KAAK,CAAC;AAAA,EACjF,SAAS,OAAO;AACd,QAAI,iBAAiB,0BAA0B;AAC7C,YAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,IACzD;AACA,UAAM;AAAA,EACR;AACF;AAEO,SAAS,wCAAwC,WAAoC;AAC1F,QAAM,WAAW,2BAA2B,SAAS;AACrD,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO,CAAC;AAAA,EACV;AACA,SAAO,CAAC,GAAG,IAAI,IAAI,SAAS,IAAI,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC;AACjE;AAGO,SAAS,uCAAuC,WAAyC;AAC9F,QAAM,kBAAkB,wCAAwC,SAAS;AACzE,MAAI,gBAAgB,SAAS,GAAG;AAC9B,UAAM,IAAIA,eAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO,gBAAgB,CAAC,KAAK;AAC/B;AAEA,SAAS,2BACP,WACyD;AACzD,SAAO,UAAU,QAAQ,CAAC,aAAa;AACrC,QAAI,SAAS,SAAS,cAAc;AAClC,aAAO,CAAC;AAAA,IACV;AACA,UAAM,kBACJ,SAAS,yBACR,SAAS,aAAa,WAAW,SAAS,iBAAiB;AAC9D,UAAM,gBACJ,SAAS,uBACR,SAAS,aAAa,WAAW,SAAS,eAAe;AAC5D,QAAI,oBAAoB,QAAQ,kBAAkB,MAAM;AACtD,aAAO,CAAC;AAAA,IACV;AACA,QAAI,oBAAoB,UAAa,kBAAkB,QAAW;AAChE,aAAO,CAAC;AAAA,IACV;AACA,UAAM,iBAAiB,gBAAgB,eAAe;AACtD,UAAM,eAAe,gBAAgB,aAAa;AAClD,QAAI,CAAC,kBAAkB,CAAC,cAAc;AACpC,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SACE;AAAA,MACJ,CAAC;AAAA,IACH;AACA,WAAO,CAAC,EAAE,gBAAgB,aAAa,CAAC;AAAA,EAC1C,CAAC;AACH;AAEA,eAAsB,kCACpB,IACA,aACA,WACe;AACf,QAAM,kBAAkB,wCAAwC,SAAS;AACzE,MAAI,gBAAgB,WAAW,GAAG;AAChC;AAAA,EACF;AACA,QAAM,aAAa,2BAA2B,SAAS;AACvD,aAAW,kBAAkB,iBAAiB;AAC5C,UAAM,gBAAgB,WACnB,OAAO,CAAC,cAAc,UAAU,mBAAmB,cAAc,EACjE,IAAI,CAAC,cAAc,UAAU,YAAY;AAC5C,QACE,CAAE,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,GACA;AACA,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SACE;AAAA,MACJ,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAOO,SAAS,8CAA8C,OAAyB;AACrF,SAAO,iBAAiBA,kBAAiB,MAAM,WAAW;AAC5D;AAEA,eAAsB,sBACpB,IACA,WACA,aACA,WACA,WACe;AACf,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,YAAY,WAAW;AAChC,QAAI,SAAS,SAAS,QAAQ;AAC5B;AAAA,IACF;AACA,QAAI,QAAQ,IAAI,SAAS,MAAM,GAAG;AAChC,YAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,4BAA4B,SAAS,MAAM,GAAG,CAAC;AAAA,IACzF;AACA,YAAQ,IAAI,SAAS,MAAM;AAC3B,UAAM,OAAO,MAAM,sBAAsB,IAAI;AAAA,MAC3C;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,SAAS;AAAA,IACnB,CAAC,EAAE,MAAM,MAAM,IAAI;AACnB,QAAI,CAAC,MAAM;AACT,YAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,0BAA0B,SAAS,MAAM,GAAG,CAAC;AAAA,IACvF;AACA,QAAI,KAAK,WAAW,SAAS;AAC3B,YAAM,IAAIA,eAAc,KAAK;AAAA,QAC3B,SAAS,iBAAiB,SAAS,MAAM,OAAO,KAAK,MAAM;AAAA,MAC7D,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,MAAsB;AAChD,MAAI;AACF,WAAO,2BAA2B,IAAI;AAAA,EACxC,SAAS,OAAO;AACd,QAAI,EAAE,iBAAiB,wBAAyB,OAAM;AACtD,UAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,gCAAgC,IAAI,GAAG,CAAC;AAAA,EAClF;AACF;AAEA,SAAS,gBAAgB,OAA+B;AACtD,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,KAAK,QAAQ,GAAG;AACrE,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,QAAQ,KAAK,KAAK,KAAK,OAAO,KAAK,IAAI,GAAG;AACzE,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,SAAO;AACT;;;AC5WA;AAAA,EACE;AAAA,EACA;AAAA,EACA,iBAAAC;AAAA,OAKK;AAIP,IAAM,mCAAmC,CAAC,UAAU;AACpD,IAAM,0BAA0B;AAehC,SAAS,UAAU,KAAiC;AAClD,SAAO,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,EAAE,KAAK;AAChC;AAGO,SAAS,2BAA2B,SAA6C;AACtF,QAAM,YAAY,IAAI,IAAY,gCAAgC;AAClE,SAAO,UAAU,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,WAAW,OAAO,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;AAC7F;AAEA,SAAS,WAAW,KAA+D;AACjF,QAAM,cAAc,IAAI;AAAA,IACtB,CAAC,OACC,GAAG,UAAU,+CAA+C,wBAAwB,KAAK,EAAE;AAAA,EAC/F;AACA,SAAO;AAAA,IACL,KAAK,YAAY,MAAM,GAAG,sCAAsC;AAAA,IAChE,WACE,YAAY,WAAW,IAAI,UAC3B,YAAY,SAAS;AAAA,EACzB;AACF;AAQO,SAAS,yBAAyB,OAA0D;AACjG,QAAM,SAAS,MAAM;AACrB,QAAM,eAAe,IAAI,IAAI,MAAM,qBAAqB;AACxD,QAAM,aAAa,IAAI,IAAI,MAAM,uBAAuB,CAAC,CAAC;AAC1D,QAAM,eAAyB,iCAAiC;AAAA,IAAO,CAAC,OACtE,aAAa,IAAI,EAAE;AAAA,EACrB;AACA,QAAM,iBAAiB,IAAI,IAAY,YAAY;AACnD,QAAM,eAAeC,eAAc,CAAC,GAAG,MAAM,YAAY;AACzD,QAAM,0BAA0B,OAAO,SAAS;AAShD,MAAI,WAAW,aAAa,OAAO,CAAC,SAAS,aAAa,IAAI,KAAK,EAAE,CAAC;AACtE,MAAI,yBAAyB;AAC3B,eAAWA;AAAA,MACT;AAAA,MACA,UAAU,UAAU,EACjB,OAAO,CAAC,OAAO,aAAa,IAAI,EAAE,CAAC,EACnC,IAAI,CAAC,QAAQ,EAAE,MAAM,OAAgB,IAAI,UAAU,KAAc,EAAE;AAAA,IACxE;AAAA,EACF;AACA,aAAWA;AAAA,IACT;AAAA,IACA,aAAa,IAAI,CAAC,QAAQ,EAAE,MAAM,OAAgB,GAAG,EAAE;AAAA,EACzD;AAMA,QAAM,yBAAyBA;AAAA,IAC7B;AAAA,IACA,0BACI,UAAU,UAAU,EACjB,OAAO,CAAC,OAAO,aAAa,IAAI,EAAE,CAAC,EACnC,IAAI,CAAC,QAAQ,EAAE,MAAM,OAAgB,IAAI,UAAU,KAAc,EAAE,IACtE,CAAC;AAAA,EACP;AACA,QAAM,eAAe;AAAA,IACnBA;AAAA,MACE;AAAA,MACA,aAAa,IAAI,CAAC,QAAQ,EAAE,MAAM,OAAgB,GAAG,EAAE;AAAA,IACzD,EAAE,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,EACzB;AACA,QAAM,gBAAgB,aAAa,OAAO,CAAC,OAAO,aAAa,IAAI,EAAE,CAAC;AACtE,QAAM,kBAAkB,IAAI,IAAI,aAAa;AAC7C,QAAM,aAAa,aAAa,OAAO,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;AAOvE,QAAM,cAAc;AAAA,IAClB,SACG,OAAO,CAAC,SAAS,gBAAgB,IAAI,KAAK,EAAE,KAAK,CAAC,eAAe,IAAI,KAAK,EAAE,CAAC,EAC7E,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,EAC1B;AACA,QAAM,cAAc;AAAA,IAClB,aACG;AAAA,MACC,CAAC,SACC,CAAC,eAAe,IAAI,KAAK,EAAE,KAAK,EAAE,2BAA2B,KAAK,aAAa;AAAA,IACnF,EACC,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,EAC1B;AACA,QAAM,cAAc;AAAA,IAClB,UAAU,WAAW,WAAW;AAAA,IAChC,WAAW,WAAW,YAAY;AAAA,IAClC,WAAW,WAAW,UAAU,YAAY,CAAC;AAAA,IAC7C,UAAU,WAAW,WAAW;AAAA,IAChC,YAAY,WAAW,aAAa;AAAA,IACpC,SAAS,WAAW,UAAU;AAAA,EAChC;AAEA,SAAO;AAAA,IACL;AAAA,IACA,iBAAiB;AAAA,MACf,MAAM,OAAO;AAAA,MACb,wBAAwB,OAAO;AAAA,MAC/B,aAAa,YAAY,SAAS;AAAA,MAClC,cAAc,YAAY,UAAU;AAAA,MACpC,cAAc,YAAY,UAAU;AAAA,MACpC,YAAY;AAAA,QACV,OAAO,YAAY,SAAS,IAAI,aAAa;AAAA,QAC7C,aAAa,YAAY,SAAS;AAAA,MACpC;AAAA,MACA,eAAe,YAAY,WAAW;AAAA,MACtC,YAAY,YAAY,QAAQ;AAAA,MAChC,QAAQ;AAAA,QACN,UAAU,YAAY;AAAA,QACtB,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA,QACxB,UAAU,YAAY;AAAA,QACtB,YAAY,cAAc;AAAA,QAC1B,SAAS,WAAW;AAAA,MACtB;AAAA,MACA,cAAc,OAAO,OAAO,WAAW,EAAE,KAAK,CAAC,eAAe,WAAW,SAAS;AAAA,IACpF;AAAA,EACF;AACF;AAGA,eAAsB,oCACpB,IACA,aACA,UACA,WACmB;AACnB,QAAM,kBAAkB,MAAM,wCAAwC,IAAI,aAAa,UAAU;AAAA,IAC/F,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,EACnC,CAAC;AACD,SAAO,UAAU,gBAAgB,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AACxE;AAGA,eAAsB,2CACpB,IACA,aACA,UACA,WACmB;AACnB,QAAM,kBAAkB,MAAM,wCAAwC,IAAI,aAAa,UAAU;AAAA,IAC/F,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,EACnC,CAAC;AACD,SAAO,2BAA2B,gBAAgB,UAAU;AAC9D;AAGO,SAAS,+BACd,SACA,oBACA,4BAA8C,CAAC,GACtC;AACT,QAAM,eAAe,IAAI,IAAI,kBAAkB;AAC/C,aAAW,UAAU,QAAQ,YAAY;AACvC,iBAAa,IAAI,OAAO,EAAE;AAAA,EAC5B;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,qBAAqB,yBAAyB;AAAA,MAC5C,YAAY,QAAQ;AAAA,MACpB,cAAc,QAAQ;AAAA,MACtB,uBAAuB;AAAA,MACvB,qBAAqB;AAAA,IACvB,CAAC,EAAE;AAAA,EACL;AACF;;;ACrMA,SAAS,2CAAAC,gDAA+C;AACxD;AAAA,EACE;AAAA,EACA;AAAA,EACA,yBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,qDAAAC;AAAA,EACA,cAAAC;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,iBAAAC,uBAAqB;;;ACjC9B,SAAS,uBAAuB,0BAA0B;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,8BAAAC;AAAA,EACA,2CAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAAC;AAAA,EAYA;AAAA,OAgBK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA,2BAAAC;AAAA,EACA;AAAA,EACA,iBAAAC;AAAA,EACA;AAAA,EACA,UAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAAC;AAAA,EACA,cAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,kBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,sBAAsB;AAAA,EACtB;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE,0BAAAC;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,iBAAAC,uBAAqB;;;ACjG9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP,SAAS,uBAAsC;AAC/C,SAAS,iBAAAC,sBAAqB;AAE9B,IAAM,uBAAuB;AAC7B,IAAM,gBAAgB,IAAI,OAAO,+BAA+B,GAAG;AAMnE,SAAS,0BAAiC;AACxC,QAAM,IAAIA,eAAc,KAAK,EAAE,SAAS,qCAAqC,CAAC;AAChF;AAEA,SAAS,SAAS,OAAwB;AACxC,MAAI;AACF,WAAO,KAAK,UAAU,KAAK,KAAK;AAAA,EAClC,QAAQ;AACN,WAAO,OAAO,SAAS,EAAE;AAAA,EAC3B;AACF;AAEA,SAAS,aAAa,OAA+B;AACnD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,aAAW,QAAQ,OAAO;AACxB,QACE,SAAS,QACT,OAAO,SAAS,YACf,KAA4B,SAAS,UACtC,OAAQ,KAA4B,SAAS,UAC7C;AACA,aAAQ,KAA0B;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAgB,QAAQ,GAAW;AAC/D,MAAI,QAAQ,KAAK,UAAU,QAAQ,UAAU;AAC3C,WAAO,SAAS,OAAO,KAAK,SAAS,KAAK;AAC5C,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO,SAAS,KAAK;AAC5E,QAAMC,UAAS;AACf,MAAIA,QAAO,SAAS,UAAU,OAAOA,QAAO,SAAS,SAAU,QAAOA,QAAO;AAC7E,QAAM,cAAc,aAAaA,QAAO,OAAO;AAC/C,MAAI,gBAAgB,KAAM,QAAO;AACjC,MAAI,uBAAuBA,SAAQ;AACjC,WAAO,eAAe,qBAAqBA,QAAO,mBAAmB,QAAQ,CAAC;AAAA,EAChF;AACA,MAAI,YAAYA,QAAQ,QAAO,qBAAqBA,QAAO,QAAQ,QAAQ,CAAC;AAC5E,SAAO,SAAS,KAAK;AACvB;AAEA,SAAS,gBAAgB,MAAsB;AAC7C,QAAM,SAAS,KAAK,QAAQ,aAAa;AACzC,MAAI,UAAU,EAAG,QAAO,KAAK,MAAM,SAAS,cAAc,MAAM;AAChE,SAAO,KAAK,WAAW,WAAW,IAAI,KAAK,MAAM,YAAY,MAAM,IAAI;AACzE;AAEO,SAAS,6BAA6B,OAAoC;AAC/E,MAAI,CAAC,MAAM,WAAW,OAAO,MAAM,YAAY,YAAY,MAAM,QAAQ,MAAM,OAAO,GAAG;AACvF,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM;AACtB,MAAI,MAAM,SAAS,kBAAkB,MAAM,SAAS,2BAA2B;AAC7E,WAAO,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,EAC3D;AACA,MAAI,MAAM,SAAS,wBAAyB,QAAO;AACnD,QAAM,SAAS,OAAO,UAAU,eAAe,KAAK,SAAS,QAAQ,IACjE,QAAQ,SACR,QAAQ;AACZ,QAAM,OAAO,gBAAgB,qBAAqB,MAAM,CAAC,EAAE,QAAQ,eAAe,EAAE;AACpF,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,SAAS,WAAW,OAAe,UAA0B;AAC3D,MAAI,SAAS;AACb,MAAI,QAAQ;AACZ,aAAW,aAAa,OAAO;AAC7B,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,SAAS,EAAE;AACjD,QAAI,QAAQ,OAAO,SAAU;AAC7B,cAAU;AACV,aAAS;AAAA,EACX;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAAe,UAA0B;AAC3D,MAAI,SAAS;AACb,MAAI,QAAQ;AACZ,aAAW,aAAa,CAAC,GAAG,KAAK,EAAE,QAAQ,GAAG;AAC5C,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,SAAS,EAAE;AACjD,QAAI,QAAQ,OAAO,SAAU;AAC7B,aAAS,YAAY;AACrB,aAAS;AAAA,EACX;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,YAAoB,OAAyB;AACrE,QAAM,UAAoB,CAAC;AAC3B,MAAI,SAAS;AACb,SAAO,UAAU,WAAW,SAAS,MAAM,QAAQ;AACjD,UAAM,QAAQ,WAAW,QAAQ,OAAO,MAAM;AAC9C,QAAI,QAAQ,EAAG;AACf,YAAQ,KAAK,KAAK;AAClB,aAAS,QAAQ;AAAA,EACnB;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,YAAoB,YAA6C;AAC3F,QAAM,EAAE,QAAQ,MAAM,IAAI;AAC1B,MACE,OAAO,YAAY,OAAO,gBAAgB,MAAM,UAChD,WAAW,MAAM,OAAO,aAAa,OAAO,SAAS,MAAM,OAC3D;AACA,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,UAAU,iBAAiB,YAAY,KAAK;AAClD,MAAI,QAAQ,WAAW,EAAG,QAAO,QAAQ,CAAC;AAC1C,QAAM,aAAa,QAAQ,OAAO,CAAC,UAAU;AAC3C,UAAM,SAAS,WAAW,MAAM,KAAK,IAAI,GAAG,QAAQ,OAAO,cAAc,MAAM,GAAG,KAAK;AACvF,UAAM,QAAQ,WAAW;AAAA,MACvB,QAAQ,MAAM;AAAA,MACd,QAAQ,MAAM,SAAS,OAAO,aAAa;AAAA,IAC7C;AACA,WAAO,WAAW,OAAO,iBAAiB,UAAU,OAAO;AAAA,EAC7D,CAAC;AACD,MAAI,WAAW,WAAW,EAAG,QAAO,WAAW,CAAC;AAChD,SAAO,wBAAwB;AACjC;AAEA,eAAe,4BACb,IACA,aACA,WACA,aACA,SACoC;AACpC,QAAM,SAAS,QAAQ,eACnB,6BAA6B,MAAM,WAAW,IAC9C,yBAAyB,MAAM,WAAW;AAC9C,QAAM,YAAuC,CAAC;AAC9C,aAAW,cAAc,QAAQ;AAC/B,UAAM,QAAQ,MAAM,gBAAgB,IAAI,aAAa,WAAW,OAAO,OAAO;AAC9E,QACE,CAAC,SACD,MAAM,cAAc,aACpB,MAAM,SAAS,WAAW,OAAO,aACjC,MAAM,aAAa,WAAW,OAAO,aACpC,MAAM,UAAU,UAAU,WAAW,OAAO,QAC7C;AACA,8BAAwB;AAAA,IAC1B;AACA,UAAM,aAAa,6BAA6B,KAAK;AACrD,QAAI,eAAe,KAAM,yBAAwB;AACjD,UAAM,cAAc,mBAAmB,YAAY,UAAU;AAC7D,UAAM,YAAY,cAAc,WAAW,MAAM;AACjD,cAAU,KAAK;AAAA,MACb,GAAG;AAAA,MACH,QAAQ;AAAA,QACN,GAAG,WAAW;AAAA,QACd;AAAA,QACA;AAAA,QACA,eAAe,WAAW,WAAW,MAAM,GAAG,WAAW,GAAG,oBAAoB;AAAA,QAChF,cAAc,WAAW,WAAW,MAAM,SAAS,GAAG,oBAAoB;AAAA,MAC5E;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAsB,iCACpB,IACA,aACA,WACA,aACoC;AACpC,SAAO,MAAM,4BAA4B,IAAI,aAAa,WAAW,aAAa;AAAA,IAChF,cAAc;AAAA,EAChB,CAAC;AACH;AAEA,eAAsB,qCACpB,IACA,aACA,WACA,aAC+B;AAC/B,QAAM,YAAY,MAAM,4BAA4B,IAAI,aAAa,WAAW,aAAa;AAAA,IAC3F,cAAc;AAAA,EAChB,CAAC;AACD,SAAO,0BAA0B,SAA0C;AAC7E;;;AC3MA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP;AAAA,EACE,yBAAAC;AAAA,OAGK;AACP,SAAS,iBAAAC,uBAAqB;AAGvB,SAAS,yBACd,UACiC;AACjC,QAAM,SAAS,mCAAmC,UAAU,QAAQ;AACpE,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEO,SAAS,6BACd,YAIS;AACT,SACE,WAAW,qBAAqB,QAChC,WAAW,2BAA2B,WAAW,WACjD,WAAW,cAAc,QACzB,WAAW,mBAAmB,eAC9B,WAAW,SAAS,iBACpB,kCAAkC,WAAW,aAAa,KAC1D,yBAAyB,WAAW,QAAQ,GAAG,mBAC7C;AAEN;AAEO,SAAS,oCACd,UACS;AACT,SACE,UAAU,mBAAmB,sCAC7B,UAAU,oBAAoB;AAElC;AAEO,SAAS,2CACd,UACS;AACT,SAAO;AAAA,IACL,YACA,OAAO,UAAU,eAAe,KAAK,UAAU,uCAAuC;AAAA,EACxF;AACF;AAMA,eAAsB,kCACpB,IACA,aACA,cAC6B;AAC7B,QAAM,aAAa,MAAMC,uBAAsB,IAAI,aAAa,cAAc,IAAI;AAClF,MAAI,CAAC,cAAc,CAAC,6BAA6B,UAAU,GAAG;AAC5D,UAAM,IAAIC,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,WAAW,WAAW,UAAU;AAClC,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS,gDAAgD,WAAW,MAAM;AAAA,IAC5E,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAsB,4CACpB,IACA,OACA,aACA,cAC6B;AAC7B,oBAAkB,OAAO,kBAAkB;AAC3C,SAAO,MAAM,kCAAkC,IAAI,aAAa,YAAY;AAC9E;AAEO,SAAS,8BACd,UACe;AACf,QAAM,QAAQ,WAAW,uCAAuC;AAChE,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,IAAI,QAAQ;AAC7D;AAOO,SAAS,kCACd,SACS;AACT,QAAM,kBAAkB,QAAQ,SAAS;AACzC,QAAM,qBAAqB,QAAQ,SAAS;AAC5C,SACE,QAAQ,WAAW,SAAS,aAC5B,QAAQ,UAAU,cAAc,eAChC,OAAO,oBAAoB,YAC3B,MAAM,eAAe,KACrB,OAAO,uBAAuB,YAC9B,MAAM,kBAAkB,KACxB,QAAQ,iBAAiB,oBAAoB,mBAC7C,QAAQ,iBAAiB,uBAAuB,sBAChD,8BAA8B,QAAQ,QAAQ,MAAM;AAExD;AAEA,SAAS,MAAM,OAAwB;AACrC,SAAO,6EAA6E,KAAK,KAAK;AAChG;;;AFEA,IAAM,8BAA8B,oBAAI,IAAI,CAAC,YAAY,SAAS,QAAQ,YAAY,CAAC;AACvF,IAAM,iCAAiC;AACvC,IAAM,2CAA2C;AAGjD,IAAM,yBAAyB;AAE/B,IAAM,iCAAiC;AAGhC,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACxC;AAAA,EAET,YAAY,QAA4B;AACtC,UAAM,0BAA0B,MAAM,CAAC;AACvC,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAQO,SAAS,mCACd,WACA,cACA,SAGI;AAAA,EACF,SAAS;AAAA,EACT,SAASC;AACX,GACyB;AACzB,MAAI,cAAc,OAAW,QAAO,CAAC,GAAG,SAAS;AACjD,QAAM,UAAU,IAAI,IAAI,OAAO,OAAO;AACtC,QAAM,YAAY,iBAAiB,SAAY,OAAO,UAAW,gBAAgB,OAAO;AACxF,SAAO,CAAC,GAAG,SAAS,EAAE,OAAO,CAAC,SAAS,QAAQ,IAAI,IAAI,CAAC;AAC1D;AAEA,SAAS,0BAA0B,QAAoC;AACrE,MAAI,OAAO,SAAS,yCAAyC;AAC3D,WAAO,sCAAsC,OAAO,wCAAwC,SAAS,4BAA4B,OAAO,4BAA4B;AAAA,EACtK;AACA,SAAO,sBAAsB,OAAO,cAAc,4BAA4B,OAAO,4BAA4B,0BAA0B,OAAO,YAAY;AAChK;AAEO,SAAS,2BAA2B,OAAgC;AACzE,SAAO;AAAA,IACL,OAAO;AAAA,MACL,MAAM,MAAM,OAAO;AAAA,MACnB,SAAS,MAAM;AAAA,MACf,SAAS,EAAE,QAAQ,MAAM,OAAO;AAAA,IAClC;AAAA,EACF;AACF;AAcA,SAAS,yBAAyB,OAGzB;AACP,MAAI,CAAC,MAAM,kBAAkB;AAC3B,QAAI,MAAM,yBAAyB;AACjC,YAAM,IAAIC,gBAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AACA,QAAM,YAAY,qBAAqB,UAAU,MAAM,gBAAgB;AACvE,MAAI,CAAC,UAAU,SAAS;AACtB,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,UAAU,4BAA4B,UAAU,MAAM,2BAA2B,CAAC,CAAC;AACzF,MAAI,CAAC,QAAQ,SAAS;AACpB,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,eAAe,MAAM,WAAW,QAAQ;AAC9C,QAAM,kBAAkB,MAAM,WAAW,WAAW;AACpD,QAAM,4BAA4B,MAAM,WAAW,qBAAqB;AACxE,MACE,iBAAiB,UACjB,oBAAoB,UACpB,8BAA8B,QAC9B;AACA,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,WAAW,UAAU;AAAA,IACrB,SAAS,QAAQ;AAAA,EACnB;AACF;AAEO,SAAS,0BAA0B,OAA6C;AACrF,QAAM,mBAAmB,yBAAyB,KAAK;AACvD,QAAM,kBAAkB,MAAM,WAAW,WAAW;AACpD,QAAM,eAAe,MAAM,WAAW,QAAQ;AAC9C,QAAM,kBAAkB,MAAM,WAAW,WAAW;AACpD,QAAM,4BAA4B,MAAM,WAAW,qBAAqB;AACxE,QAAM,qBACJ,iBAAiB,UACjB,oBAAoB,UACpB,8BAA8B;AAChC,MAAI,oBAAoB;AACtB,QACE,OAAO,oBAAoB,YAC3B,OAAO,iBAAiB,YACxB,OAAO,oBAAoB,YAC3B,OAAO,8BAA8B,YACrC,CAAC,OAAO,cAAc,yBAAyB,KAC/C,4BAA4B,GAC5B;AACA,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM,QAAQ;AAAA,MACZ,MAAM;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,qBAAqB;AAAA,IACvB;AAGA,WAAO,EAAE,MAAM;AAAA,EACjB;AACA,MAAI,kBAAkB;AACpB,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,WAAW;AAAA,MACT,MAAM;AAAA,MACN,WAAW,MAAM;AAAA,MACjB,GAAI,MAAM,eAAe,EAAE,OAAO,MAAM,aAAa,IAAI,CAAC;AAAA,IAC5D;AAAA,IACA,SAAS,CAAC;AAAA,EACZ;AACF;AAEA,SAAS,sCACP,SACwB;AACxB,MAAI,CAAC,SAAS;AACZ,WAAO,CAAC;AAAA,EACV;AACA,QAAM,UAAU,OAAO,QAAQ,OAAO,EACnC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,KAAK,GAAG,KAAK,CAAU,EACpD,OAAO,CAAC,CAAC,IAAI,MAAM,KAAK,SAAS,CAAC;AACrC,MAAI,QAAQ,SAAS,gCAAgC;AACnD,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS,yCAAyC,8BAA8B;AAAA,IAClF,CAAC;AAAA,EACH;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,CAAC,MAAM,KAAK,KAAK,SAAS;AACnC,QAAI,CAAC,+BAA+B,KAAK,IAAI,GAAG;AAC9C,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,mCAAmC,IAAI;AAAA,MAClD,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,KAAK,YAAY;AAC/B,QAAI,KAAK,IAAI,KAAK,GAAG;AACnB,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,qCAAqC,IAAI;AAAA,MACpD,CAAC;AAAA,IACH;AACA,SAAK,IAAI,KAAK;AACd,QAAI,MAAM,WAAW,KAAK,MAAM,SAAS,0CAA0C;AACjF,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,qBAAqB,IAAI,cAAc,wCAAwC;AAAA,MAC1F,CAAC;AAAA,IACH;AAGA,QAAI,qCAAqC,KAAK,KAAK,GAAG;AACpD,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,qBAAqB,IAAI;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,OAAO,YAAY,OAAO;AACnC;AAEA,SAAS,yBAAyB,QAA+D;AAC/F,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;AAAA,IAC3C,KAAK,OAAO;AAAA,IACZ,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,IACnE,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,IAC1D,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,GAAI,OAAO,oBAAoB,SAAY,EAAE,iBAAiB,OAAO,gBAAgB,IAAI,CAAC;AAAA,IAC1F,GAAI,OAAO,gBAAgB,EAAE,eAAe,OAAO,cAAc,IAAI,CAAC;AAAA,EACxE;AACF;AAEA,SAAS,+BACP,QACgC;AAChC,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;AAAA,IAC3C,KAAK,OAAO;AAAA,IACZ,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,IACnE,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,IAC1D,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,GAAI,OAAO,mBAAmB,OAAO,EAAE,iBAAiB,OAAO,gBAAgB,IAAI,CAAC;AAAA,IACpF,GAAI,OAAO,gBAAgB,EAAE,eAAe,OAAO,cAAc,IAAI,CAAC;AAAA,EACxE;AACF;AAEA,SAAS,4BACP,QACgC;AAChC,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;AAAA,IAC3C,KAAK,OAAO;AAAA,IACZ,gBAAgB;AAAA,IAChB,iBAAiB,OAAO;AAAA,IACxB,GAAI,OAAO,gBAAgB,EAAE,eAAe,OAAO,cAAc,IAAI,CAAC;AAAA,EACxE;AACF;AAEA,SAAS,oCACP,UACA,SACU;AACV,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,aAAa,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AAC7D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,CAAC,GAAG,SAAS,WAAW,OAAO,CAAC,WAAW,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC,GAAG,GAAG,OAAO;AAAA,EAChG;AACF;AAEO,SAAS,qCACd,UACA,SACU;AACV,SAAO,oCAAoC,UAAU,QAAQ,IAAI,2BAA2B,CAAC;AAC/F;AAEA,SAAS,mCACP,UACA,OACA,SAC4B;AAC5B,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,EAAE,gBAAgB,CAAC,GAAG,WAAW,CAAC,GAAG,UAAU,CAAC,EAAE;AAAA,EAC3D;AACA,oBAAkB,OAAO,oBAAoB;AAC7C,QAAM,gBAAgB,QAAQ,KAAK,CAAC,WAAW,OAAO,KAAK,OAAO,WAAW,CAAC,CAAC,EAAE,SAAS,CAAC,IACvF,6BAA6B,QAAQ,IACrC;AACJ,QAAM,cAAc,IAAI,IAAI,SAAS,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AAC1E,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,iBAAyC,CAAC;AAChD,QAAM,YAA2C,CAAC;AAClD,QAAM,WAAuC,CAAC;AAC9C,aAAW,UAAU,SAAS;AAC5B,QAAI,QAAQ,IAAI,OAAO,EAAE,GAAG;AAC1B,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,oCAAoC,OAAO,EAAE;AAAA,MACxD,CAAC;AAAA,IACH;AACA,YAAQ,IAAI,OAAO,EAAE;AACrB,QAAI,4BAA4B,IAAI,OAAO,EAAE,KAAK,YAAY,IAAI,OAAO,EAAE,GAAG;AAC5E,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,iCAAiC,OAAO,EAAE;AAAA,MACrD,CAAC;AAAA,IACH;AACA,UAAM,UAAU,sCAAsC,OAAO,OAAO;AACpE,UAAM,mBAAmB,OAAO;AAAA,MAC9B,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AAAA,QAC7C;AAAA,QACAC,yBAAwB,eAAgB,KAAK;AAAA,MAC/C,CAAC;AAAA,IACH;AACA,mBAAe,KAAK,yBAAyB,MAAM,CAAC;AACpD,cAAU,KAAK;AAAA,MACb,IAAI,OAAO;AAAA,MACX,MAAM,OAAO,QAAQ;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,cAAc,OAAO,gBAAgB;AAAA,MACrC,WAAW,OAAO,aAAa;AAAA,MAC/B,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,eAAe,OAAO,iBAAiB;AAAA,MACvC;AAAA,IACF,CAAC;AACD,aAAS,KAAK;AAAA,MACZ,IAAI,OAAO;AAAA,MACX,MAAM,OAAO,QAAQ;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,aAAa,OAAO,KAAK,gBAAgB,EAAE,KAAK;AAAA,MAChD,mBAAmB;AAAA,MACnB,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,eAAe,OAAO,iBAAiB;AAAA,IACzC,CAAC;AAAA,EACH;AACA,SAAO,EAAE,gBAAgB,WAAW,SAAS;AAC/C;AAEA,SAAS,4CACP,SAC4B;AAC5B,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,EAAE,gBAAgB,CAAC,GAAG,WAAW,CAAC,GAAG,UAAU,CAAC,EAAE;AAAA,EAC3D;AACA,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,UAAU,SAAS;AAC5B,QAAI,QAAQ,IAAI,OAAO,EAAE,GAAG;AAC1B,YAAM,IAAID,gBAAc,KAAK;AAAA,QAC3B,SAAS,8CAA8C,OAAO,EAAE;AAAA,MAClE,CAAC;AAAA,IACH;AACA,YAAQ,IAAI,OAAO,EAAE;AACrB,QAAI,4BAA4B,IAAI,OAAO,EAAE,GAAG;AAC9C,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,6CAA6C,OAAO,EAAE;AAAA,MACjE,CAAC;AAAA,IACH;AAAA,EACF;AAMA,SAAO;AAAA,IACL,gBAAgB,QAAQ,IAAI,8BAA8B;AAAA,IAC1D,WAAW,QAAQ,IAAI,CAAC,YAAY;AAAA,MAClC,GAAG;AAAA,MACH,kBAAkB,EAAE,GAAI,OAAO,oBAAoB,CAAC,EAAG;AAAA,IACzD,EAAE;AAAA,IACF,UAAU,QAAQ,IAAI,CAAC,YAAY;AAAA,MACjC,IAAI,OAAO;AAAA,MACX,MAAM,OAAO,QAAQ;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,aAAa,OAAO,KAAK,OAAO,oBAAoB,CAAC,CAAC,EAAE,KAAK;AAAA,MAC7D,mBAAmB;AAAA,MACnB,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,eAAe,OAAO,iBAAiB;AAAA,IACzC,EAAE;AAAA,EACJ;AACF;AAEA,SAAS,oCAAoC,OAKA;AAC3C,MAAI,MAAM,QAAQ,WAAW,GAAG;AAC9B,WAAO,CAAC;AAAA,EACV;AACA,oBAAkB,MAAM,OAAO,oBAAoB;AACnD,QAAM,gBAAgB,6BAA6B,MAAM,QAAQ;AACjE,QAAM,WAAW,IAAI,IAAI,MAAM,QAAQ,WAAW,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC;AAC5E,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,mBAAmB,MAAM,QAAQ,IAAI,CAAC,WAAW;AACrD,QAAI,QAAQ,IAAI,OAAO,EAAE,GAAG;AAC1B,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,+CAA+C,OAAO,EAAE;AAAA,MACnE,CAAC;AAAA,IACH;AACA,YAAQ,IAAI,OAAO,EAAE;AACrB,QAAI,CAAC,SAAS,IAAI,OAAO,EAAE,GAAG;AAC5B,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,kCAAkC,OAAO,EAAE;AAAA,MACtD,CAAC;AAAA,IACH;AACA,UAAM,UAAU,sCAAsC,OAAO,OAAO;AACpE,WAAO;AAAA,MACL,IAAI,OAAO;AAAA,MACX,kBAAkB,OAAO;AAAA,QACvB,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AAAA,UAC7C;AAAA,UACAC,yBAAwB,eAAe,KAAK;AAAA,QAC9C,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAiBA,eAAsB,iCAAiC,OAyGrB;AAChC,QAAM,kBAAkB;AAAA,IACtB,GAAG,MAAM;AAAA,IACT,OAAO,MAAM;AAAA,IACb,iBAAiB,MAAM;AAAA,IACvB,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,EAC9E;AAKA,MAAI,MAAM,sBAAsB;AAC9B,UAAM,cAAc,MAAM,sCAAsC,MAAM,IAAI;AAAA,MACxE,GAAI,MAAM,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;AAAA,MACnF,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,gBAAgB,MAAM;AAAA,MACtB,qBAAqB,MAAM,gBAAgB;AAAA,MAC3C,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM,UAAU,CAAC;AAAA,MACzB,OAAO,MAAM;AAAA,MACb,YAAY,MAAM;AAAA,MAClB,UAAU;AAAA,MACV,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,MACxD,GAAI,MAAM,mBAAmB,EAAE,kBAAkB,MAAM,iBAAiB,IAAI,CAAC;AAAA,MAC7E,gBAAgB,MAAM,kBAAkB;AAAA,MACxC,OAAO,MAAM;AAAA,MACb,gBAAgB,MAAM;AAAA,MACtB,eAAe,MAAM,aAAa,MAAM;AAAA,MACxC,OAAO,MAAM,SAAS;AAAA,MACtB,cAAc,MAAM,gBAAgB;AAAA,MACpC,WAAW,MAAM,aAAa;AAAA,MAC9B,0BAA0B,MAAM,4BAA4B;AAAA,MAC5D,oBAAoB,MAAM;AAAA,MAC1B,cAAc,MAAM,gBAAgB;AAAA,MACpC,YAAY,MAAM,cAAc;AAAA,MAChC,iBAAiB,MAAM,mBAAmB;AAAA,MAC1C,sBAAsB,MAAM;AAAA,MAC5B,gBAAgB,MAAM,kBAAkB;AAAA,MACxC,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,MACxD,YAAY,MAAM,cAAc,CAAC;AAAA,MACjC,+BAA+B,MAAM,iCAAiC,CAAC;AAAA,MACvE,GAAI,MAAM,sCACN;AAAA,QACE,4CAA4C,MAAM;AAAA,MACpD,IACA,CAAC;AAAA,MACL,6BAA6B,MAAM,+BAA+B;AAAA,MAClE,+BAA+B,MAAM,iCAAiC;AAAA,MACtE,WAAW,MAAM,aAAa;AAAA,MAC9B,GAAI,MAAM,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;AAAA,IACrF,CAAC;AACD,QAAI,YAAY,QAAQ;AACtB,YAAM,IAAI,wBAAwB,mBAAmB,MAAM,YAAY,MAAM,CAAC;AAAA,IAChF;AACA,UAAM,EAAE,SAAS,OAAO,QAAQ,IAAI;AACpC,QAAI,CAAC,SAAS;AACZ,YAAMC,YAAW,MAAM;AAAA,QACrB,MAAM,qBAAqB,EAAE,GAAG,OAAO,mBAAmB,KAAK,IAAI;AAAA,QACnE;AAAA,MACF;AACA,aAAO;AAAA,QACL,SAASA,UAAS;AAAA,QAClB,SAASA,UAAS,UAAU,aAAa;AAAA,QACzC,QAAQ,CAACA,UAAS;AAAA,QAClB,SAASA,UAAS;AAAA,MACpB;AAAA,IACF;AACA,UAAMA,YAAW,MAAM,mBAAmB,OAAO,KAAK;AACtD,WAAO;AAAA,MACL,SAASA,UAAS;AAAA,MAClB,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,SAAS;AAAA,IACX;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,cAAc,MAAM,IAAI;AAAA,MACtC,GAAI,MAAM,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;AAAA,MACnF,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,gBAAgB,MAAM;AAAA,MACtB,qBAAqB,MAAM,gBAAgB;AAAA,MAC3C,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM,UAAU,CAAC;AAAA,MACzB,OAAO,MAAM;AAAA,MACb,YAAY,MAAM;AAAA,MAClB,UAAU;AAAA,MACV,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,MACxD,GAAI,MAAM,mBAAmB,EAAE,kBAAkB,MAAM,iBAAiB,IAAI,CAAC;AAAA,MAC7E,gBAAgB,MAAM,kBAAkB;AAAA,MACxC,OAAO,MAAM;AAAA,MACb,gBAAgB,MAAM;AAAA,MACtB,eAAe,MAAM,aAAa,MAAM;AAAA,MACxC,OAAO,MAAM,SAAS;AAAA,MACtB,cAAc,MAAM,gBAAgB;AAAA,MACpC,WAAW,MAAM,aAAa;AAAA,MAC9B,0BAA0B,MAAM,4BAA4B;AAAA,MAC5D,oBAAoB,MAAM;AAAA,MAC1B,cAAc,MAAM,gBAAgB;AAAA,MACpC,YAAY,MAAM,cAAc;AAAA,MAChC,iBAAiB,MAAM,mBAAmB;AAAA,MAC1C,gBAAgB,MAAM,kBAAkB;AAAA,MACxC,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,MACxD,YAAY,MAAM,cAAc,CAAC;AAAA,MACjC,+BAA+B,MAAM,iCAAiC,CAAC;AAAA,MACvE,GAAI,MAAM,sCACN;AAAA,QACE,4CAA4C,MAAM;AAAA,MACpD,IACA,CAAC;AAAA,MACL,6BAA6B,MAAM,+BAA+B;AAAA,MAClE,+BAA+B,MAAM,iCAAiC;AAAA,MACtE,WAAW,MAAM,aAAa;AAAA,MAC9B,GAAI,MAAM,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;AAAA,IACrF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,2BAA2B;AAC9C,YAAM,IAAI,wBAAwB,mBAAmB,MAAM,MAAM,MAAM,CAAC;AAAA,IAC1E;AACA,UAAM;AAAA,EACR;AACA,QAAM,WAAW,MAAM,mBAAmB,OAAO,OAAO;AACxD,SAAO;AAAA,IACL,SAAS,SAAS;AAAA,IAClB,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,SAAS;AAAA,EACX;AACF;AAGA,eAAsB,sBACpB,OACgC;AAChC,UAAQ,MAAM,iCAAiC,KAAK,GAAG;AACzD;AAQA,eAAe,mBACb,OA4BA,SAC+D;AAM/D,MAAI,MAAM,mBAAmB;AAC3B,QAAI,QAAQ,mBAAmB,QAAQ;AACrC,YAAM,IAAIF,gBAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM,MAAoB;AAAA,MACxB,WAAW,QAAQ;AAAA,MACnB,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,MACnB,gBAAgB,QAAQ;AAAA,MACxB,gBAAgB,QAAQ;AAAA,IAC1B;AACA,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,kBAAkB;AAAA,QAClC,KAAK,MAAM;AAAA,MACb;AAAA,MACA;AAAA,MACA,MAAM,kBAAkB;AAAA;AAAA;AAAA,MAGxB,MAAM,kBAAkB,cAAc;AAAA,IACxC;AACA,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,yBAAyB,MAAM,kBAAkB,SAAS,KAAK,OAAO,UAAU,0BAA0B;AAAA,MACrH,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,UAAU,MAAM,iCAAiC,MAAM,IAAI;AAAA,IAC/D,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,WAAW,QAAQ;AAAA,IACnB,GAAI,MAAM,gBAAgB,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,IACpE,yBAAyB,MAAM;AAAA,IAC/B,qBAAqB,MAAM;AAAA,IAC3B,qBAAqB;AAAA,MACnB,YAAY,MAAM;AAAA,MAClB,GAAI,MAAM,cACN;AAAA,QACE,eAAe,MAAM,YAAY;AAAA,QACjC,iBAAiB,MAAM,YAAY;AAAA,MACrC,IACA,CAAC;AAAA,MACL,GAAI,MAAM,mBAAmB,SAAS,EAAE,YAAY,MAAM,kBAAkB,IAAI,CAAC;AAAA,IACnF;AAAA,IACA,MAAM,MAAM,OACR;AAAA,MACE,MAAM,MAAM,KAAK;AAAA,MACjB,GAAI,MAAM,KAAK,oBAAoB,SAC/B,EAAE,iBAAiB,MAAM,KAAK,gBAAgB,IAC9C,CAAC;AAAA,MACL,GAAI,MAAM,KAAK,yBAAyB,SACpC,EAAE,sBAAsB,MAAM,KAAK,qBAAqB,IACxD,CAAC;AAAA,IACP,IACA;AAAA,IACJ,wBAAwB,MAAM,0BAA0B;AAAA,IACxD,kBAAkB,MAAM,qBAAqB;AAAA,EAC/C,CAAC;AACD,QAAM,4BAA4B,MAAM,KAAK,QAAQ,aAAa,QAAQ,IAAI,QAAQ,MAAM;AAC5F,MAAI,QAAQ,yBAAyB,MAAM;AACzC,UAAM,MAAM,eAAe,oBAAoB;AAAA,MAC7C,WAAW,QAAQ;AAAA,MACnB,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,MACnB,YAAY,QAAQ;AAAA,MACpB,cAAc,QAAQ;AAAA,IACxB,CAAC;AAAA,EACH;AACA,QAAM,YAAY,MAAMG,gBAAe,MAAM,IAAI,QAAQ,aAAa,QAAQ,EAAE;AAChF,QAAM,gBACJ,QAAQ,MAAM,OACb,MAAM,iBAAiB,MAAM,IAAI,QAAQ,aAAa,QAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,MAC3E;AACF,SAAO;AAAA,IACL,SAAS,EAAE,GAAG,WAAW,cAAc;AAAA,IACvC,SAAS,QAAQ;AAAA,EACnB;AACF;AAEO,SAAS,qBAAqB,WAA2B;AAC9D,SAAO,WAAW,SAAS;AAC7B;AAkBO,SAAS,yBACd,UACA,OAC2B;AAC3B,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,8BAA8B,UAAU,KAAK;AACpE,MAAI,wBAAwB,QAAQ,EAAE,SAAS,cAAc,GAAG;AAC9D,WAAO;AAAA,EACT;AAOA,MAAI,SAAS,4BAA4B,eAAe,WAAW,qBAAqB,GAAG;AACzF,WAAO;AAAA,EACT;AAKA,MACE,SAAS,gCACT,eAAe,WAAW,gCAAgC,GAC1D;AACA,WAAO;AAAA,EACT;AACA,MAAI,eAAe,WAAW,iCAAiC,GAAG;AAChE,WAAO;AAAA,EACT;AACA,QAAM,IAAIH,gBAAc,KAAK,EAAE,SAAS,2BAA2B,KAAK,GAAG,CAAC;AAC9E;AAEO,SAAS,sBAAsB,UAAoB,OAAwC;AAChG,2BAAyB,UAAU,KAAK;AAC1C;AAEO,IAAM,sCAAsC;AAG5C,IAAM,uCAAN,cAAmD,MAAM;AAAA,EACrD,OAAO;AAAA,EACP;AAAA,EAET,YAAY,gBAAwB;AAClC;AAAA,MACE,2DAA2D,cAAc;AAAA,IAC3E;AACA,SAAK,OAAO;AACZ,SAAK,iBAAiB;AAAA,EACxB;AACF;AAMO,SAAS,gCACd,SACA,gBACM;AACN,MAAI,mBAAmB,QAAQ,mBAAmB,OAAW;AAC7D,MAAI,QAAQ,wBAAwB,YAAa;AACjD,MAAI,mBAAmB,cAAc,EAAG;AACxC,QAAM,IAAI,qCAAqC,cAAc;AAC/D;AAaA,eAAsB,iCACpB,IACA,UACA,aACA,OACe;AACf,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC;AAAA,EACF;AACA,QAAM,iBAAiB,yBAAyB,UAAU,KAAK;AAC/D,MAAI,mBAAmB,QAAQ,mBAAmB,QAAW;AAC3D;AAAA,EACF;AACA,QAAM,SAAS,MAAM,wBAAwB,IAAI,WAAW;AAC5D,MAAI,CAAC,QAAQ;AACX;AAAA,EACF;AACA,QAAM,aAAa,yBAAyB,UAAU,cAAc;AACpE,QAAM,UAAU,6BAA6B,QAAQ;AAAA,IACnD;AAAA,IACA,SAAS;AAAA,EACX,CAAC;AACD,MAAI,CAAC,QAAQ,SAAS;AACpB,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SACE,QAAQ,WAAW,aACf,UAAU,cAAc,gEAAgE,UAAU,sCAClG,UAAU,cAAc;AAAA,IAChC,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,wBACpB,IACA,aACA,WACA,QACsB;AACtB,QAAM,OAAO,MAAM,eAAe,IAAI,aAAa,MAAM;AACzD,MAAI,CAAC,QAAQ,KAAK,cAAc,WAAW;AACzC,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,yBAAyB,CAAC;AAAA,EACpE;AACA,MAAI,KAAK,WAAW,UAAU;AAC5B,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS,WAAW,KAAK,MAAM;AAAA,IACjC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEO,SAAS,0BACd,UACA,UACmC;AACnC,SAAO,2BAA2B,UAAU,QAAQ;AACtD;AAEO,SAAS,sBACd,UACA,WAA6C,YACX;AAClC,SAAO,uBAAuB,UAAU,QAAQ;AAClD;AASA,eAAsB,oBAAoB,OAkCvC;AACD,QAAM,EAAE,IAAI,KAAK,gBAAgB,UAAU,WAAW,aAAa,UAAU,IAAI;AACjF,QAAM,iBAAiB,yBAAyB,UAAU,MAAM,SAAS,IAAI,KAAK;AAClF,QAAM,2BAA2B,MAAM,mBAAmB;AAG1D,wBAAsB,UAAU,cAAc;AAC9C,QAAM,iCAAiC,IAAI,UAAU,aAAa,cAAc;AAChF,QAAM,sBAAsB,MAAMG,gBAAe,IAAI,aAAa,SAAS;AAC3E,QAAM,wBAAwB,kBAAkB,oBAAoB;AACpE,MAAI;AACF,oCAAgC,qBAAqB,qBAAqB;AAAA,EAC5E,SAAS,OAAO;AACd,QAAI,iBAAiB,sCAAsC;AACzD,YAAM,IAAIH,gBAAc,KAAK,EAAE,SAAS,MAAM,SAAS,OAAO,MAAM,CAAC;AAAA,IACvE;AACA,UAAM;AAAA,EACR;AACA,QAAM,eAAe,MAAM,iBAAiB,OAAO,WAAW;AAC9D,MAAI;AACJ,MAAI;AACF,aAAS,MAAM;AAAA,MACb;AAAA,QACE,OAAO;AAAA,QACP,YAAY,CAAC,gBAAgB,eAAe,wBAAwB;AAAA,QACpE,aAAa;AAAA,MACf;AAAA,MACA,YACE,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA,MAAM,SAAS;AAAA,QACf,CAAC,WACC,+BAA+B,QAAQ;AAAA,UACrC;AAAA,UACA;AAAA,UACA;AAAA,UACA,WAAW,MAAM,SAAS;AAAA,UAC1B,GAAI,MAAM,aAAa,EAAE,cAAc,MAAM,WAAW,IAAI,CAAC;AAAA,UAC7D,OAAO,MAAM,gBAAgB;AAAA,YAC3B,MAAM;AAAA,YACN,WAAW,MAAM,SAAS;AAAA,UAC5B;AAAA,UACA;AAAA,UACA,UAAU,MAAM,YAAY;AAAA,UAC5B,aAAa,MAAM,eAAe;AAAA,UAClC,uBAAuB,MAAM,yBAAyB;AAAA,UACtD,MAAM,MAAM;AAAA,UACZ,aAAa,MAAM,eAAe,CAAC;AAAA,UACnC,cAAc,MAAM,gBAAgB;AAAA,UACpC,WAAW,MAAM;AAAA,UACjB,OAAO;AAAA,UACP,iBAAiB;AAAA,UACjB,aAAa,MAAM,eAAe;AAAA,UAClC,yBACE,MAAM,2BAA2B,SAAS;AAAA,UAC5C,qBAAqB,MAAM;AAAA,UAC3B,QAAQ,MAAM,WAAW,aAAa,QAAQ;AAAA,UAC9C,GAAI,MAAM,wBAAwB,SAC9B,EAAE,qBAAqB,MAAM,oBAAoB,IACjD,CAAC;AAAA,UACL,+BAA+B,MAAM,iCAAiC,CAAC;AAAA,UACvE,sBAAsB,MAAM,wBAAwB,CAAC;AAAA,QACvD,CAAC;AAAA,MACL;AAAA,IACJ;AAAA,EACF,SAAS,OAAO;AACd,QACE,iBAAiB,6BACjB,iBAAiB,6BACjB;AACA,YAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,IACzD;AACA,QAAI,iBAAiB,SAAS,MAAM,QAAQ,SAAS,WAAW,GAAG;AACjE,YAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,IACzD;AACA,QAAI,iBAAiB,SAAS,MAAM,QAAQ,WAAW,4BAA4B,GAAG;AACpF,YAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,IACzD;AACA,UAAM;AAAA,EACR;AACA,QAAM,iBAAiB,YAAY;AACjC,QAAI;AACF,YAAM,4BAA4B,KAAK,aAAa,WAAW,OAAO,MAAM;AAC5E,UAAI,OAAO,yBAAyB;AAClC,cAAM,eAAe,MAAM;AAAA,UACzB;AAAA,UACA;AAAA,UACA,OAAO;AAAA,QACT;AACA,YAAI,CAAC,cAAc;AACjB,gBAAM,IAAI;AAAA,YACR,kDAAkD,OAAO,uBAAuB;AAAA,UAClF;AAAA,QACF;AACA,cAAM,oCAAoC,KAAK,aAAa,YAAY;AAAA,MAC1E;AAAA,IACF,QAAQ;AACN,cAAQ,KAAK,yEAAyE;AAAA,QACpF,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AACA,QAAI;AACF,YAAM,eAAe,oBAAoB;AAAA,QACvC;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,OAAO,KAAK;AAAA,QACxB,cAAc,OAAO;AAAA,QACrB,IAAK,MAAM,YAAY,YAAY,WAAW,OAAO,oBAAoB,IACrE,EAAE,uBAAuB,KAAK,IAC9B,CAAC;AAAA,MACP,CAAC;AAAA,IACH,QAAQ;AACN,cAAQ,KAAK,8DAA8D;AAAA,QACzE,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,qBACJ,MAAM,uBACL,CAAC,SAA8B;AAC9B,SAAK,KAAK;AAAA,EACZ;AACF,MAAI;AACF,uBAAmB,cAAc;AAAA,EACnC,QAAQ;AACN,YAAQ,KAAK,6EAA6E;AAAA,MACxF,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,UAAU,OAAO;AAAA,IACjB,MAAM,OAAO;AAAA,IACb,mBAAmB,OAAO;AAAA,IAC1B,QAAQ,OAAO;AAAA,EACjB;AACF;AAWA,eAAsB,mCACpB,MACA,OACA,aACA,YACsC;AACtC,QAAM,EAAE,UAAU,IAAI,KAAK,gBAAgB,cAAc,IAAI;AAC7D,QAAM,UAAU,qBAAqB,MAAM,UAAU;AACrD,MAAI,2CAA2C,QAAQ,QAAQ,GAAG;AAChE,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS,GAAGI,wCAAuC;AAAA,IACrD,CAAC;AAAA,EACH;AAKA,MAAI,QAAQ,gBAAgB;AAC1B,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IACV;AACA,QAAI,QAAQ;AACV,YAAM,IAAI,wBAAwB,mBAAmB,MAAM,MAAM,CAAC;AAAA,IACpE;AAAA,EACF;AAKA,QAAM,kBACJ,OAAO,MAAM,WAAW,WAAW,MAAM,WACpC,MAAM,SAAS,WAAW,IAC3B;AACN,MAAI,iBAAiB;AACnB,QAAI;AACF,YAAM,4BAA4B,MAAM,OAAO;AAAA,QAC7C,WAAW;AAAA,QACX,WAAW;AAAA,QACX,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,iBAAiB,iCAAiC;AACpD,cAAM,IAAIJ,gBAAc,KAAK,EAAE,SAAS,MAAM,SAAS,OAAO,MAAM,CAAC;AAAA,MACvE;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,gBAAgB,kBAAkB,MAAMK,YAAW,IAAI,aAAa,eAAe,IAAI;AAC7F,MAAI,mBAAmB,CAAC,eAAe;AACrC,UAAM,IAAIL,gBAAc,KAAK;AAAA,MAC3B,SAAS,0CAA0C,eAAe;AAAA,IACpE,CAAC;AAAA,EACH;AACA,QAAM,oBAAoB,0BAA0B,KAAK;AACzD,QAAM,oBACJ,iBAAiB,kBAAkB,QAC/B,MAAM,eAAe,IAAI,aAAa,kBAAkB,MAAM,MAAM,IACpE;AACN,MACE,kBAAkB,UACjB,CAAC,qBAAqB,kBAAkB,cAAc,eAAe,KACtE;AACA,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,sCACJ,iBAAiB,kBAAkB,QAC/B,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,kBAAkB,MAAM;AAAA,EAC1B,IACA;AACN,QAAM,4BAA4B,MAAM;AAAA,IACtC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,WAAW,MAAM;AAAA,IACnB;AAAA,EACF;AACA,QAAM,oBAAoB,eAAe,YAAY,YAAY,IAC7D,mCAAmC,2BAA2B,OAAO,QAAQ,UAAU,IACvF,gBACE;AAAA,IACE,MAAM,yCAAyC,IAAI,aAAa,cAAc,EAAE;AAAA,EAClF,IACA,mCAAmC,2BAA2B,OAAO,QAAQ,UAAU;AAC7F,QAAM,kBAAkB;AAAA,IACtB;AAAA,IACA,kBAAkB;AAAA,EACpB;AACA,QAAM,YAAY;AAAA,IAChB,eAAe,YAAY,WAAW,IAClC,QAAQ,YACP,eAAe,aAAa,QAAQ;AAAA,EAC3C;AACA,QAAM,SAAS,eAAe,YAAY,QAAQ,IAC9C,QAAQ,SACP,eAAe,UAAU,QAAQ;AACtC,QAAM,gBAAgB,eAAe,YAAY,OAAO;AACxD,QAAM,iBAAiB;AAAA,IACrB,gBAAgB,QAAQ,QAAS,eAAe,SAAS,QAAQ;AAAA,IACjE;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACJ,MAAI,eAAe;AACjB,UAAM,gCAAgC,cAAc,YAAY,SAAS;AACzE,UAAM,kBAAkB;AAAA,MACtB,gCACI;AAAA,QACE,kBAAkB,cAAc,OAAO,eAAe;AAAA,QACtD;AAAA,QACA;AAAA,MACF,IACA,cAAc;AAAA,MAClB;AAAA,IACF;AACA,QAAI,eAAe;AACjB;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,sBAAgB;AAChB,mBAAa;AAAA,QACX,MAAM;AAAA,QACN,wBAAwB,cAAc;AAAA,MACxC;AAAA,IACF,OAAO;AACL,sBAAgB;AAChB,mBAAa;AAAA,QACX,MAAM,gCAAgC,sBAAsB;AAAA,QAC5D,wBAAwB,cAAc;AAAA,MACxC;AAAA,IACF;AAAA,EACF,WAAW,eAAe;AACxB,oBAAgB;AAChB,iBAAa,EAAE,MAAM,YAAY,wBAAwB,KAAK;AAAA,EAChE,OAAO;AACL,oBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,iBAAa,EAAE,MAAM,qBAAqB,wBAAwB,KAAK;AAAA,EACzE;AAKA,QAAM,QAAQ,oBAAoB,eAAe,eAAe;AAChE,QAAM,gCAAgC,MAAM,oCAAoC;AAAA,IAC9E;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV;AAAA,IACA,QAAQ,2CAA2C,KAAK;AAAA,EAC1D,CAAC;AACD,QAAM,kCAAkC,IAAI,aAAa,SAAS;AAClE,MAAI,UAAU,KAAK,CAAC,aAAa,SAAS,SAAS,MAAM,KAAK,CAAC,eAAe;AAC5E,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,sBAAsB,IAAI,MAAM,WAAW,aAAa,MAAM,WAAW,SAAS;AAIxF,QAAM,cAAc,QAAQ,gBACxB,MAAM;AAAA,IACJ,EAAE,UAAU,GAAG;AAAA,IACf;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACV,IACA;AAYJ,QAAM,iBACJ,QAAQ,UAAU,SAAY,MAAM,yBAAyB,IAAI,WAAW,IAAI,QAAQ;AAC1F,MAAI,cAA6B;AACjC,MAAI,qBAAoC;AACxC,MAAI,gBAAgB;AAClB,UAAM,MAAM,MAAMM,QAAO,IAAI,aAAa,cAAc;AACxD,QAAI,CAAC,OAAO,CAAC,IAAI,eAAe;AAC9B,UAAI,QAAQ,OAAO;AACjB,cAAM,IAAIN,gBAAc,KAAK;AAAA,UAC3B,SAAS,MACL,OAAO,QAAQ,KAAK,mCACpB,kBAAkB,QAAQ,KAAK;AAAA,QACrC,CAAC;AAAA,MACH;AAAA,IAEF,OAAO;AACL,oBAAc,IAAI;AAClB,2BAAqB,IAAI,cAAc;AAAA,IACzC;AAAA,EACF;AAKA,MAAI,YAA2B;AAC/B,MAAI,QAAQ,WAAW;AACrB,UAAM,UAAU,MAAM,WAAW,IAAI,aAAa,QAAQ,SAAS;AACnE,QAAI,CAAC,SAAS;AACZ,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,sBAAsB,QAAQ,SAAS;AAAA,MAClD,CAAC;AAAA,IACH;AACA,gBAAY,QAAQ;AAAA,EACtB;AAOA,QAAM,iBAAiB,mBAAmB,SAAS,eAAe,SAAS,SAAS;AACpF,QAAM,QAAQ,yBAAyB,UAAU,QAAQ,SAAS,cAAc;AAChF,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAKA,QAAM,iCAAiC,IAAI,UAAU,aAAa,KAAK;AACvE,QAAM,2BACJ,mBAAmB,oBAClB,gBACG,0BAA0B,cAAc,UAAU,SAAS,qBAAqB,IAChF,SAAS;AACf,QAAM,uBACJ,mBAAmB,gBAClB,gBAAgB,sBAAsB,cAAc,UAAU,UAAU,IAAI;AAC/E,QAAM,kBAAkB,QAAQ,mBAAmB;AACnD,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,sBAAsB,kBAAkB;AAC9C,QAAM,sBAAsB,6BAA6B,UAAU;AAAA,IACjE,SAAS;AAAA,IACT,kBAAkB,QAAQ,SAAS;AAAA,IACnC,aACE,QAAQ,UAAU,SACd,sBACE,iBACA,eACF;AAAA,IACN;AAAA,IACA,iBACE,QAAQ,oBAAoB,SACxB,sBACE,iBACA,eACF;AAAA,IACN;AAAA,IACA,mBACE,QAAQ,gBAAgB,SACpB,sBACE,iBACA,eACF;AAAA,EACR,CAAC;AAWD,QAAM,iCAAiC,gBACnC,CAAC,GAAI,cAAc,4BAA4B,mCAAoC,IACnF;AACJ,MACE,kCACA,QAAQ,0BAA0B;AAAA,IAChC,CAAC,eAAe,CAAC,cAAc,gCAAgC,UAAU;AAAA,EAC3E,GACA;AACA,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAKA,MAAI,2BACF,QAAQ,6BACP,iCACG,+BAA+B;AAAA,IAAO,CAAC,eACrC,cAAc,MAAM,aAAa,UAAU;AAAA,EAC7C,IACA;AACN,MAAI,4BAA4B,yBAAyB,WAAW,GAAG;AAGrE,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACA,aAAW,cAAc,4BAA4B,CAAC,GAAG;AACvD,QAAI,CAAC,cAAc,MAAM,aAAa,UAAU,GAAG;AACjD,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,sEAAsE,UAAU;AAAA,MAC3F,CAAC;AAAA,IACH;AAAA,EACF;AAOA,MACE,QAAQ,QACR,4BACA,CAAC,yBAAyB,SAAS,cAAc,GACjD;AACA,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AAIA,QAAM,oCAAoC,+BAA+B,QAAQ;AACjF,QAAM,8BAA8B,QAAQ,oBAAoB;AAAA,IAC9D,CAAC,SAAS,CAAC,kCAAkC,QAAQ,SAAS,IAAI;AAAA,EACpE;AACA,MAAI,6BAA6B;AAC/B,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS,0DAA0D,2BAA2B;AAAA,IAChG,CAAC;AAAA,EACH;AACA,QAAM,qBAAqB;AAAA,IACzB,QAAQ;AAAA,IACR,gBAAgB,cAAc,qBAAqB;AAAA,IACnD;AAAA,EACF;AACA,MAAI,QAAQ,MAAM;AAChB,UAAM,mBAAmB,CAAC,eAAe,iBAAiB,iBAAiB,YAAY,EAAE;AAAA,MACvF,CAAC,SAAS,CAAC,mBAAmB,SAAS,IAA6B;AAAA,IACtE;AACA,QAAI,iBAAiB,SAAS,GAAG;AAC/B,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,wDAAwD,iBAAiB,KAAK,IAAI,CAAC;AAAA,MAC9F,CAAC;AAAA,IACH;AAAA,EACF;AA4BA,QAAM,gBAAgB,QAAQ,YAAY,kBAAkB,WAAW;AACvE,MAAI,iBAAgC;AACpC,MAAI;AAkBJ,QAAM,yBAAyB,QAAQ,iBAAiB;AACxD,QAAM,0BAA0B,CAAC,wBAC/B,wBAAwB;AAU1B,QAAM,yBAAyB,CAAC,uBAC9B,uBAAuB;AACzB,MAAI,kBAAkB,UAAU;AAC9B,QAAI,CAAC,iBAAiB;AACpB,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SACE;AAAA,MACJ,CAAC;AAAA,IACH;AACA,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AACA,UAAM,SAAS;AACf,UAAM,cAAc,OAAO,mBAAmB;AAC9C,UAAM,sBACJ,eAAe,CAAC,wBAAwB,OAAO,iBAAiB,IAAI;AACtE,QAAI,cAAc,eAAe,CAAC,uBAAuB,OAAO,gBAAgB,IAAI;AACpF,QAAI,eAAe,CAAC,aAAa;AAC/B,YAAM,sBAAsB,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,QACA,OAAO;AAAA,MACT;AACA,oBAAc,CAAC,oBAAoB;AAAA,QAAM,CAAC,uBACxC,uBAAuB,kBAAkB;AAAA,MAC3C;AAAA,IACF;AACA,QAAI,uBAAuB,aAAa;AACtC,UAAI,QAAQ,YAAY,UAAU;AAKhC,cAAM,IAAIA,gBAAc,KAAK;AAAA,UAC3B,SAAS,sBACL,mOACA;AAAA,QACN,CAAC;AAAA,MACH;AAAA,IAKF,OAAO;AACL,uBAAiB,OAAO;AACxB,yBAAmB,OAAO;AAAA,IAC5B;AAAA,EACF,WAAW,OAAO,kBAAkB,UAAU;AAC5C,UAAM,SAAS,MAAM,qBAAqB,IAAI,aAAa,cAAc,OAAO;AAChF,QAAI,CAAC,QAAQ;AACX,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS,yCAAyC,cAAc,OAAO;AAAA,MACzE,CAAC;AAAA,IACH;AACA,QAAI,OAAO,mBAAmB,QAAQ;AAMpC,YAAM,uBAAuB,MAAM;AAAA,QACjC;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AACA,UACE,CAAC,qBAAqB;AAAA,QAAM,CAAC,wBAC3B,wBAAwB,mBAAmB;AAAA,MAC7C,GACA;AACA,cAAM,IAAIA,gBAAc,KAAK;AAAA,UAC3B,SAAS,iBAAiB,cAAc,OAAO;AAAA,QACjD,CAAC;AAAA,MACH;AAIA,YAAM,sBAAsB,MAAM;AAAA,QAChC;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AACA,UACE,CAAC,oBAAoB;AAAA,QAAM,CAAC,uBAC1B,uBAAuB,kBAAkB;AAAA,MAC3C,GACA;AACA,cAAM,IAAIA,gBAAc,KAAK;AAAA,UAC3B,SAAS,iBAAiB,cAAc,OAAO;AAAA,QACjD,CAAC;AAAA,MACH;AAAA,IACF;AACA,qBAAiB,cAAc;AAC/B,uBAAmB,OAAO;AAAA,EAC5B;AAMA,MAAI,QAAQ,eAAe,UAAa,CAAC,QAAQ,iBAAiB;AAChE,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AA0BA,MAAI;AACJ,MAAI;AACJ,MACE,QAAQ,mBACR,qBAAqB,UACrB,SAAS,2BACT,SAAS,0BACT;AACA,UAAM,gBAAgB,MAAMO,YAAW,IAAI,aAAa,QAAQ,eAAe;AAC/E,QAAI,eAAe,SAAS,cAAc;AACxC,2BAAqB;AACrB,UAAI,cAAc,cAAc;AAC9B,cAAM,aAAa,MAAMC,eAAc,IAAI,aAAa,cAAc,YAAY;AAClF,YACE,eACC,WAAW,OAAO,WAAW,WAAW,OAAO,aAAa,WAAW,OAAO,UAC/E;AACA,0BAAgB,WAAW;AAAA,QAC7B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,cAAc,YAAY;AACpC,UAAM,aAAa,MAAM;AAAA,MACvB,WAAW,MAAM;AAAA,MACjB;AAAA,MACA,QAAQ;AAAA,MACR,UAAU;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH;AACA,MAAI;AACJ,MAAI;AACF,oBAAgB,MAAM,iCAAiC;AAAA,MACrD,GAAI,QAAQ,qBAAqB,EAAE,oBAAoB,QAAQ,mBAAmB,IAAI,CAAC;AAAA,MACvF;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,MAAM;AAAA,MACjB;AAAA,MACA,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,kBAAkB,QAAQ,cAAc;AAAA,MACxC,cAAc,QAAQ,gBAAgB;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,QAAQ,gBAAgB,EAAE,eAAe,QAAQ,cAAc,IAAI,CAAC;AAAA,MACxE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,gBACE,oBAAoB,sBAAsB,QAAQ,kBAAkB,SAAS;AAAA;AAAA;AAAA;AAAA,MAI/E,GAAI,gBAAgB,EAAE,WAAW,cAAc,IAAI,CAAC;AAAA,MACpD;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,GAAI,kBAAkB,YAAY,EAAE,WAAW,kBAAkB,UAAU,IAAI,CAAC;AAAA,MAChF,GAAI,kBAAkB,UAAU,EAAE,kBAAkB,kBAAkB,QAAQ,IAAI,CAAC;AAAA,MACnF,gBAAgB,kBAAkB,SAAS;AAAA,MAC3C,aAAa,cAAc,EAAE,IAAI,YAAY,IAAI,MAAM,YAAY,KAAK,IAAI;AAAA;AAAA,MAE5E,OAAO;AAAA,MACP,cAAc;AAAA,MACd;AAAA,MACA,MAAM,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA,MAItB,cAAc,QAAQ,gBAAgB;AAAA,MACtC,YAAY,QAAQ,cAAc;AAAA,MAClC;AAAA,MACA;AAAA,MACA,YAAY,kBAAkB;AAAA,MAC9B,mBAAmB,kBAAkB;AAAA,MACrC;AAAA,MACA,GAAI,sCAAsC,EAAE,oCAAoC,IAAI,CAAC;AAAA,MACrF;AAAA,MACA,sBAAsB,QAAQ,kBAAkB;AAAA,MAChD,6BAA6B,QAAQ,uBAAuB;AAAA,MAC5D,+BAA+B,cAAc,MAAM,aAAa,iBAAiB;AAAA,MACjF,WAAW,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,MAKjB,mBAAmB,QAAQ,kBACvB;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB;AAAA,QACA,YAAY,QAAQ,cAAc;AAAA,MACpC,IACA;AAAA,MACJ,wBACE,QAAQ,oCAAoC,SACxC;AAAA,QACE,WAAW,MAAM;AAAA,QACjB,kBAAkB,QAAQ;AAAA,MAC5B,IACA;AAAA,IACR,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,4BAA4B;AAC/C,YAAM,IAAIR,gBAAc,KAAK,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,IACzD;AACA,QAAI,iBAAiB,wBAAwB;AAC3C,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR;AACA,MAAI,iBAAgE;AACpE,MAAI,QAAQ,cAAc,YAAY;AACpC,QAAI;AACF,YAAM,qBAAqB,MAAM;AAAA,QAC/B,WAAW,MAAM;AAAA,QACjB;AAAA,QACA,WAAW,MAAM;AAAA,QACjB,WAAW;AAAA,QACX,UAAU;AAAA,QACV,MAAM;AAAA,QACN,oBAAoB;AAAA,QACpB,kBAAkB,cAAc,QAAQ;AAAA,QACxC,WAAW,cAAc,QAAQ;AAAA,QACjC,WAAW,cAAc,QAAQ;AAAA,QACjC,kBAAkB,cAAc,QAAQ;AAAA,QACxC,QAAQ,kBAAkB,QAAQ,WAAW;AAAA,QAC7C,gBAAgB,qBAAqB,WAAW,IAAI,cAAc,QAAQ,EAAE;AAAA,MAC9E,CAAC;AAAA,IACH,SAAS,OAAO;AACd,uBAAiB;AACjB,yCAAmC,KAAK;AAAA,IAC1C;AAAA,EACF;AACA,SAAO,EAAE,GAAG,eAAe,eAAe;AAC5C;AAGO,SAAS,mCAAmC,QAAuB;AACxE,UAAQ;AAAA,IACN;AAAA,IACA;AAAA,MACE,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,QAAQ;AAAA,IACV;AAAA,EACF;AACF;AAGA,eAAsB,wBACpB,MACA,OACA,aACA,YACgC;AAChC,UAAQ,MAAM,mCAAmC,MAAM,OAAO,aAAa,UAAU,GAAG;AAC1F;AASA,eAAsB,oCACpB,MACA,OACA,aACA,WACA,OAoBC;AACD,QAAM,EAAE,UAAU,IAAI,KAAK,gBAAgB,cAAc,IAAI;AAC7D,QAAM,4BAA4B,yBAAyB,KAAK;AAChE,QAAM,4BAA4B,MAAM,OAAO;AAAA,IAC7C;AAAA,IACA,WAAW,MAAM,aAAa,UAAU,kBAAkB;AAAA,IAC1D,SAAS;AAAA,EACX,CAAC;AAID,QAAM,kBAAkB,MAAMG,gBAAe,IAAI,aAAa,SAAS;AACvE,QAAM,iBAAiB,yBAAyB,UAAU,MAAM,SAAS,IAAI,KAAK;AAClF,QAAM,iBACJ,yBAAyB,UAAU,kBAAkB,gBAAgB,KAAK,KAAK;AACjF,MAAI,mBAAmB,MAAM;AAC3B,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,MAAI;AACF,oCAAgC,iBAAiB,cAAc;AAAA,EACjE,SAAS,OAAO;AACd,QAAI,iBAAiB,sCAAsC;AACzD,YAAM,IAAIH,gBAAc,KAAK,EAAE,SAAS,MAAM,SAAS,OAAO,MAAM,CAAC;AAAA,IACvE;AACA,UAAM;AAAA,EACR;AACA,QAAM,yBAAyB;AAAA,IAC7B,gBAAgB;AAAA,IAChB,SAAS;AAAA,EACX;AACA,QAAM,2BAA2B,MAAM,mBAAmB;AAC1D,QAAM,qBAAqB,sBAAsB,gBAAgB,UAAU,UAAU;AACrF,QAAM,uBAAuB,MAAM,eAAe;AAClD,QAAM,sBAAsB,6BAA6B,UAAU;AAAA,IACjE,SAAS;AAAA,IACT,kBAAkB,MAAM,SAAS;AAAA,IACjC,aAAa,MAAM,SAAS,OAAO,YAAY;AAAA,IAC/C,iBAAiB;AAAA,IACjB,iBAAiB,MAAM,mBAAmB,OAAO,YAAY;AAAA,IAC7D,aAAa;AAAA,IACb,mBAAmB,MAAM,eAAe,OAAO,YAAY;AAAA,EAC7D,CAAC;AACD,QAAM,qBAAqB,mBAAmB,MAAM,aAAa,CAAC,CAAC;AACnE,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,eAAe,CAAC;AAAA,EACxB;AACA,QAAM,aAAa,MAAM;AAAA,IACvB,WAAW,MAAM;AAAA,IACjB;AAAA,IACA,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AACD,MAAI,mBAAmB,KAAK,CAAC,aAAa,SAAS,SAAS,MAAM,KAAK,CAAC,eAAe;AACrF,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM;AAAA,IACJ;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,MAAM;AAAA,IACN;AAAA,EACF;AACA,QAAM,kCAAkC,IAAI,aAAa;AAAA,IACvD,GAAG,gBAAgB;AAAA,IACnB,GAAG;AAAA,EACL,CAAC;AACD,QAAM,uBAAuB,oCAAoC;AAAA,IAC/D;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,SAAS,MAAM,wBAAwB,CAAC;AAAA,EAC1C,CAAC;AACD,QAAM,kBAAkB,MAAM,wCAAwC,IAAI,aAAa,UAAU;AAAA,IAC/F,WAAW,MAAM;AAAA,EACnB,CAAC;AACD,QAAM,gCAAgC,MAAM,oCAAoC;AAAA,IAC9E;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV,OAAO,gBAAgB;AAAA,IACvB,QAAQ,2CAA2C,KAAK;AAAA,EAC1D,CAAC;AACD,QAAM,EAAE,UAAU,MAAM,mBAAmB,OAAO,IAAI,MAAM,oBAAoB;AAAA,IAC9E;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,MAAM,MAAM;AAAA,IACZ;AAAA,IACA,cAAc,MAAM,gBAAgB;AAAA,IACpC,WAAW;AAAA,IACX,OAAO,MAAM,SAAS;AAAA,IACtB,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,aAAa,MAAM,eAAe;AAAA,IAClC,yBAAyB;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,MAAM,YAAY;AAAA,IAC5B,QAAQ,4BAA4B,aAAc,MAAM,UAAU;AAAA,IAClE,OAAO,MAAM;AAAA,IACb,GAAI,MAAM,eAAe,EAAE,YAAY,MAAM,aAAa,IAAI,CAAC;AAAA,IAC/D,GAAI,4BACA;AAAA,MACE,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,WAAW,0BAA0B,UAAU;AAAA,QAC/C,GAAI,0BAA0B,UAAU,QACpC,EAAE,cAAc,0BAA0B,UAAU,MAAM,IAC1D,CAAC;AAAA,QACL,SAAS,0BAA0B;AAAA,MACrC;AAAA,IACF,IACA,CAAC;AAAA,IACL,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,IAC5E,GAAI,MAAM,0BAA0B,SAChC,EAAE,uBAAuB,MAAM,sBAAsB,IACrD,CAAC;AAAA,IACL,GAAI,MAAM,gBAAgB,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,IACpE,qBAAqB;AAAA,IACrB,GAAI,KAAK,2BAA2B,EAAE,oBAAoB,KAAK,yBAAyB,IAAI,CAAC;AAAA,EAC/F,CAAC;AACD,SAAO,EAAE,UAAU,MAAM,mBAAmB,OAAO;AACrD;AAGA,eAAsB,yBACpB,MACA,OACA,aACA,WACA,OAMC;AACD,QAAM,EAAE,UAAU,MAAM,mBAAmB,OAAO,IAAI,MAAM;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,EAAE,UAAU,MAAM,mBAAmB,OAAO;AACrD;AAWA,eAAsB,mBACpB,MAKA,OACA,WACA,OACA,QAKC;AACD,QAAM,EAAE,IAAI,IAAI,IAAI;AACpB,QAAM,gBAAgB,MAAM,4BAA4B,MAAM,OAAO;AAAA,IACnE;AAAA,IACA,WAAW;AAAA,IACX,SAAS;AAAA,EACX,CAAC;AACD,QAAM,cAAc,MAAM;AAC1B,QAAM,SAAS,MAAM,sBAAsB,IAAI;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,OAAO,SAAS;AAClB,UAAMS,wBAAuB,IAAI,KAAK,aAAa,WAAW;AAAA,MAC5D;AAAA,QACE,MAAM;AAAA,QACN,SAAS;AAAA,UACP,OAAO,OAAO,SAAS;AAAA,UACvB;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,sBAAsB,eAAe,wBAAwB;AAAA,EAC/D;AACF;AAQA,eAAsB,+BACpB,MAKA,OACA,WACA,UACA,iBACiD;AACjD,QAAM,mBAAmB,yBAAyB,MAAM,eAAe;AACvE,QAAM,4BAA4B,MAAM,OAAO;AAAA,IAC7C;AAAA,IACA,WAAW;AAAA,IACX,SAAS;AAAA,EACX,CAAC;AACD,oBAAkB,OAAO,kBAAkB;AAE3C,QAAM,UAAiD,CAAC;AACxD,QAAM,SAAS,MAAM;AAAA,IACnB,KAAK;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,OAAO,UAAU,YAAY;AAC3B,YAAM,SAAS,MAAM,QAAQ,+BAA+B,UAAU,gBAAgB;AACtF,UAAI,CAAC,OAAO,QAAQ;AAClB,cAAM,IAAIT,gBAAc,KAAK;AAAA,UAC3B,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,cAAQ,SAAS,OAAO;AACxB,aAAO;AAAA,QACL,QAAQ,OAAO,UACX;AAAA,UACE;AAAA,YACE,MAAM;AAAA,YACN,SAAS;AAAA,cACP;AAAA,cACA,eAAe;AAAA,YACjB;AAAA,UACF;AAAA,QACF,IACA,CAAC;AAAA,MACP;AAAA,IACF;AAAA,IACA,EAAE,UAAU,WAAW;AAAA,EACzB;AACA,QAAM,gBAAgB,QAAQ;AAC9B,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,QAAM,4BAA4B,KAAK,KAAK,MAAM,aAAa,WAAW,MAAM;AAChF,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,eAAe;AAAA,EACjB;AACF;AAEA,SAAS,wBACP,SACA,OACA,oBACA,SAAS,QAAQ,YACjB;AAOA,QAAM,cAAc,cAAc,CAAC,GAAG,KAAK,EACxC,KAAK,CAAC,MAAM,UAAU;AAGrB,UAAM,gBAAgB,KAAK,SAAS,SAAS,KAAK,OAAO;AACzD,UAAM,iBAAiB,MAAM,SAAS,SAAS,MAAM,OAAO;AAC5D,QAAI,kBAAkB,eAAgB,QAAO,gBAAgB,KAAK;AAClE,WAAO,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE,GAAG,cAAc,GAAG,MAAM,IAAI,IAAI,MAAM,EAAE,EAAE;AAAA,EAC5E,CAAC,EACA,IAAI,CAAC,UAAU;AAAA,IACd,MAAM,KAAK;AAAA,IACX,IAAI,KAAK;AAAA,IACT,GAAI,KAAK,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;AAAA,EACnE,EAAE;AACJ,QAAM,WAAW,YAAY,MAAM,GAAG,sBAAsB;AAC5D,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb,wBAAwB,OAAO;AAAA;AAAA,IAE/B,SAAS,CAAC,GAAG,QAAQ,EAClB,KAAK,CAAC,MAAM,UAAU,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE,GAAG,cAAc,GAAG,MAAM,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,EAC1F,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,IACxB;AAAA,IACA,WAAW,YAAY;AAAA,IACvB,oBAAoB,CAAC,GAAG,kBAAkB,EAAE,KAAK;AAAA,IACjD,wBAAwB,mBAAmB;AAAA,IAC3C,WAAW,YAAY,SAAS,SAAS;AAAA,EAC3C;AACF;AAQA,eAAsB,wBACpB,MAMA,OACA,WACA,SACkB;AAClB,QAAM,4BAA4B,MAAM,OAAO;AAAA,IAC7C;AAAA,IACA,WAAW;AAAA,IACX,SAAS;AAAA,EACX,CAAC;AACD,oBAAkB,OAAO,kBAAkB;AAE3C,QAAM,kBAAkB,MAAMG,gBAAe,KAAK,IAAI,MAAM,aAAa,SAAS;AAClF,QAAM,4BAA4B,MAAM;AAAA,IACtC,KAAK;AAAA,IACL,MAAM;AAAA,IACN,KAAK;AAAA,IACL,EAAE,WAAW,MAAM,UAAU;AAAA,EAC/B;AACA,QAAM,kBAAkB;AAAA,IACtB;AAAA,IACA,gBAAgB;AAAA,EAClB;AACA,QAAM,kBAAkB,QAAQ,SAAS,sBAAsB,OAAO;AACtE,QAAM,gBAAgB,kBAAkB,aAAa;AACrD,QAAM,yBAAyB,mBAC1B,MAAM;AACL,UAAM,iBAAiB,iBAAiB,gBAAgB,OAAO,eAAe;AAC9E,UAAM,eAAe,IAAI,IAAI,eAAe,IAAI,CAAC,SAAS,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;AACpF,UAAM,UAAU,gBAAgB,MAAM;AAAA,MACpC,CAAC,SAAS,CAAC,aAAa,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE,EAAE;AAAA,IACvD;AACA,QAAI,SAAS;AACX,YAAM,IAAIH,gBAAc,KAAK;AAAA,QAC3B,SAAS,0BAA0B,QAAQ,EAAE;AAAA,MAC/C,CAAC;AAAA,IACH;AACA,WAAO,oBAAoB,gBAAgB,eAAe;AAAA,EAC5D,GAAG,IACH;AACJ,QAAM,mCAAmC,kBACrC,CAAC,GAAG,gBAAgB,kBAAkB,IACtC;AACJ,QAAM,oCAAoC,+BAA+B,KAAK,QAAQ;AACtF,QAAM,8BAA8B,kCAAkC;AAAA,IACpE,CAAC,SAAS,CAAC,kCAAkC,QAAQ,SAAS,IAAI;AAAA,EACpE;AACA,MAAI,6BAA6B;AAC/B,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS,0DAA0D,2BAA2B;AAAA,IAChG,CAAC;AAAA,EACH;AACA,QAAM,wBAAwB;AAAA,IAC5B,qCAAqC,CAAC,GAAG,KAAK,UAAU,yBAAyB;AAAA,IACjF;AAAA,EACF;AACA,QAAM,kCAAkC,CAAC,GAAG,kCAAkC,OAAO;AACrF,QAAM,SAAS,MAAM;AAAA,IACnB,KAAK;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,OAAO,SAAS,YAAY;AAC1B,YAAM,iBAAiB,QAAQ,qBAAqB;AACpD,UAAI,QAAQ,oBAAoB,gBAAgB;AAC9C,cAAM,IAAI,sCAAsC,cAAc;AAAA,MAChE;AAEA,UAAI;AACJ,UAAI;AACJ,UAAI;AACJ,UAAI,QAAQ,iBAAiB;AAC3B,cAAM,SAAS,MAAM,QAAQ,iBAAiB,QAAQ,eAAe;AACrE,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAIA,gBAAc,KAAK;AAAA,YAC3B,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AACA,cAAM,gCAAgC,OAAO,YAAY,SAAS;AAClE,cAAM,kBAAkB;AAAA,UACtB,gCACI;AAAA,YACE,kBAAkB,OAAO,OAAO,eAAe;AAAA,YAC/C,KAAK;AAAA,YACL;AAAA,UACF,IACA,OAAO;AAAA,UACX;AAAA,QACF;AACA,cAAM,sCAAsC,IAAI;AAAA,UAC9C,kCAAkC;AAAA,QACpC;AACA,cAAM,2BAA2B;AAAA,UAC/B,GAAI,OAAO,sBAAsB,kCAAkC;AAAA,QACrE,EAAE,OAAO,CAAC,SAAS,oCAAoC,IAAI,IAAI,CAAC;AAChE,YAAI,kBAAkB,qBAAqB;AACzC,cAAI,CAAC,+BAA+B;AAClC,kBAAM,IAAIA,gBAAc,KAAK;AAAA,cAC3B,SACE;AAAA,YACJ,CAAC;AAAA,UACH;AACA,sBAAY;AACZ,mCAAyB;AACzB,uBAAa;AAAA,YACX,MAAM;AAAA,YACN,wBAAwB,OAAO;AAAA,UACjC;AAAA,QACF,OAAO;AACL,sBAAY;AACZ;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,gBAAM,sBAAsB,IAAI,IAAI,wBAAwB;AAC5D,gBAAM,wBAAwB,iCAAkC;AAAA,YAC9D,CAAC,SAAS,CAAC,oBAAoB,IAAI,IAAI;AAAA,UACzC;AACA,cAAI,uBAAuB;AACzB,kBAAM,IAAIA,gBAAc,KAAK;AAAA,cAC3B,SAAS,6DAA6D,qBAAqB;AAAA,YAC7F,CAAC;AAAA,UACH;AACA,mCAAyB;AACzB,uBAAa;AAAA,YACX,MAAM;AAAA,YACN,wBAAwB,OAAO;AAAA,UACjC;AAAA,QACF;AAAA,MACF,OAAO;AACL,oBACE,kBAAkB,sBAAsB,wBAAwB;AAClE,iCACE,kBAAkB,sBACd,kCACA;AACN,qBAAa,EAAE,MAAM,eAAe,wBAAwB,KAAK;AAAA,MACnE;AAEA,YAAM,gBAAgB,QAAQ;AAK9B,YAAM,YACJU,YAAW;AAAA,QACT,OAAO,QAAQ;AAAA,QACf,oBACE,QAAQ,sBAAsB,kCAAkC;AAAA,QAClE,QAAQ;AAAA,MACV,CAAC,MACDA,YAAW;AAAA,QACT,OAAO;AAAA,QACP,oBAAoB;AAAA,QACpB,QAAQ;AAAA,MACV,CAAC;AACH,UAAI,WAAW;AACb,eAAO,EAAE,QAAQ,CAAC,EAAE;AAAA,MACtB;AAEA,YAAM,cAAc,iBAAiB;AACrC,aAAO;AAAA,QACL,QAAQ;AAAA,UACN;AAAA,YACE,MAAM;AAAA,YACN,SAAS;AAAA,cACP,QAAQ;AAAA,gBACN;AAAA,gBACA,QAAQ;AAAA,gBACR,CAAC,GAAI,QAAQ,sBAAsB,kCAAkC,OAAQ;AAAA,gBAC7E;AAAA,cACF;AAAA,cACA,OAAO;AAAA,gBACL;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA,cACA,SAAS;AAAA,cACT,eAAe;AAAA,YACjB;AAAA,UACF;AAAA,QACF;AAAA,QACA,QAAQ;AAAA,UACN,OAAO;AAAA,UACP,oBAAoB;AAAA,UACpB,YAAY;AAAA,UACZ,mBAAmB;AAAA,UACnB,2BAA2B,QAAQ;AAAA,QACrC;AAAA,MACF;AAAA,IACF;AAAA,IACA,EAAE,UAAU,YAAY,mBAAmB,KAAK;AAAA,EAClD;AACA,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,4BAA4B,KAAK,KAAK,MAAM,aAAa,WAAW,MAAM;AAAA,EAClF;AACA,SAAO,MAAMP,gBAAe,KAAK,IAAI,MAAM,aAAa,SAAS;AACnE;AAEA,eAAsB,mBACpB,MACA,OACA,WACA;AACA,QAAM,gBAAgB,MAAM,4BAA4B,MAAM,OAAO;AAAA,IACnE;AAAA,IACA,WAAW;AAAA,IACX,SAAS;AAAA,EACX,CAAC;AACD,MAAI,eAAe,yBAAyB,UAAU;AACpD,UAAM,UAAU,MAAME,YAAW,KAAK,IAAI,MAAM,aAAa,SAAS;AACtE,QAAI,CAAC,SAAS;AACZ,YAAM,IAAIL,gBAAc,KAAK,EAAE,SAAS,oBAAoB,CAAC;AAAA,IAC/D;AACA,WAAO,EAAE,WAAW,CAAC,GAAG,UAAU,CAAC,GAAG,WAAW,MAAM;AAAA,EACzD;AACA,QAAM,UAAU,MAAM,kBAAkB,KAAK,IAAI,MAAM,aAAa,SAAS;AAC7E,MAAI,CAAC,SAAS;AACZ,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,oBAAoB,CAAC;AAAA,EAC/D;AACA,SAAO;AACT;AAEA,SAAS,oBACP,OACA,iBACW;AACX,MAAI,CAAC,gBAAgB,WAAW,KAAK,CAAC,WAAW,OAAO,OAAO,UAAU,GAAG;AAC1E,WAAO;AAAA,EACT;AACA,SAAO,cAAc,OAAO,CAAC,EAAE,MAAM,OAAO,IAAI,WAAW,CAAC,CAAC;AAC/D;AAEA,SAAS,eAAe,OAAgB,KAAsB;AAC5D,SAAO;AAAA,IACL,SAAS,OAAO,UAAU,YAAY,OAAO,UAAU,eAAe,KAAK,OAAO,GAAG;AAAA,EACvF;AACF;;;ADx+EO,SAAS,2BAA2B,YAA8B;AACvE,MAAI,CAAC,cAAc,OAAO,eAAe,UAAU;AACjD,WAAO;AAAA,EACT;AACA,QAAM,cAAe,WAAyC;AAC9D,SAAO;AAAA,IACL,eACA,OAAO,gBAAgB,YACvB,OAAO,UAAU,eAAe,KAAK,aAAa,OAAO;AAAA,EAC3D;AACF;AAEA,eAAsB,6BAA6B,OAexB;AAGzB,QAAM,SAAS,MAAM,QAAQ,UAAW,EAAE,MAAM,aAAa;AAC7D,QAAM,kBAAkB,OAAO,SAAS,0BAA0B,SAAS;AAC3E,MAAI,iBAAiB;AACnB,UAAM,kCAAkC;AAAA,MACtC,IAAI,MAAM;AAAA,MACV,OAAO,MAAM;AAAA,MACb,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,QAAM,cAAc,kBAChB,MAAM,QAAQ,cACd,MAAM,iCAAiC;AAAA,IACrC,GAAG;AAAA,IACH,aAAa,MAAM,MAAM;AAAA,EAC3B,CAAC;AACL,QAAM,KAAK,OAAO,WAAW;AAC7B,gCAA8B,MAAM,QAAQ,QAAQ;AACpD,QAAM,SAAS,kBACX,OACA,MAAM,4BAA4B;AAAA,IAChC,IAAI,MAAM;AAAA,IACV,sBAAsB,MAAM;AAAA,IAC5B,sBAAsB,MAAM;AAAA,IAC5B,OAAO,MAAM;AAAA,IACb,iBAAiB,MAAM,QAAQ;AAAA,IAC/B,SAAS,MAAM,QAAQ;AAAA,IACvB,eAAe,MAAM,QAAQ;AAAA,IAC7B,OAAO,MAAM,QAAQ;AAAA,IACrB;AAAA,EACF,CAAC;AACL,MAAI,CAAC,mBAAmB,MAAM,QAAQ,eAAe;AACnD,UAAM;AAAA,MACJ,EAAE,UAAU,MAAM,UAAU,IAAI,MAAM,GAAG;AAAA,MACzC,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,MAAM,QAAQ;AAAA,MACd,EAAE,eAAe,MAAM,4BAA4B,MAAM;AAAA,IAC3D;AAAA,EACF;AAKA,MAAI,CAAC,mBAAmB,MAAM,QAAQ,OAAO;AAC3C,UAAM,wBAAwB,MAAM,IAAI,MAAM,MAAM,aAAa,MAAM,QAAQ,KAAK;AAAA,EACtF;AACA,QAAM,gCAAgC,kBAClC,CAAC,IACD,MAAM,oCAAoC;AAAA,IACxC,IAAI,MAAM;AAAA,IACV,aAAa,MAAM,MAAM;AAAA,IACzB,UAAU,MAAM;AAAA,MACd,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,MAAM;AAAA,MACN,EAAE,WAAW,MAAM,MAAM,UAAU;AAAA,IACrC;AAAA,IACA,OAAO,CAAC,GAAG,YAAY,OAAO,EAAE,MAAM,OAAO,IAAI,WAAW,CAAC;AAAA,IAC7D,QAAQ,2CAA2C,MAAM,KAAK;AAAA,EAChE,CAAC;AACL,QAAM,oBAAoB,0BAA0B,MAAM,KAAK;AAC/D,QAAM,sCACJ,kBAAkB,QACd,MAAMW;AAAA,IACJ,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,IACZ,kBAAkB,MAAM;AAAA,IACxB,kBAAkB,MAAM;AAAA,EAC1B,IACA,MAAM,wDAAwD,MAAM,IAAI;AAAA,IACtE,aAAa,MAAM,MAAM;AAAA,IACzB,WAAW,MAAM,MAAM;AAAA,EACzB,CAAC;AACP,SAAO,MAAM,oBAAoB,MAAM,IAAI;AAAA,IACzC;AAAA,IACA,WAAW,MAAM,MAAM;AAAA,IACvB,aAAa,MAAM,MAAM;AAAA,IACzB,MAAM,yBAAyB,MAAM,QAAQ,IAAI;AAAA,IACjD,QAAQ,MAAM,QAAQ;AAAA,IACtB,UAAU,MAAM,QAAQ;AAAA,IACxB,oBAAoB,gCAAgC,EAAE;AAAA,IACtD,SAAS,MAAM,QAAQ;AAAA,IACvB,eAAe,MAAM,QAAQ;AAAA,IAC7B;AAAA,IACA;AAAA,IACA,GAAI,kBAAkB,YAAY,EAAE,WAAW,kBAAkB,UAAU,IAAI,CAAC;AAAA,IAChF,GAAI,kBAAkB,UAAU,EAAE,kBAAkB,kBAAkB,QAAQ,IAAI,CAAC;AAAA,IACnF,gBAAgB,kBAAkB,SAAS;AAAA,IAC3C;AAAA,IACA;AAAA,IACA,iBAAiB,QAAQ,MAAM;AAAA,IAC/B,eAAe,MAAM,QAAQ,iBAAiB;AAAA,IAC9C,OAAO,MAAM,QAAQ,SAAS;AAAA,IAC9B,UAAU,MAAM,QAAQ;AAAA,EAC1B,CAAC;AACH;AAEA,eAAsB,4BAA4B,OAWtB;AAC1B,MAAI,MAAM,YAAY,oBAAoB;AACxC,QAAI,MAAM,iBAAiB;AACzB,YAAM,IAAIC,gBAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,iBAAiB;AAC1B,UAAM,IAAIA,gBAAc,MAAM,uBAAuB,KAAK;AAAA,MACxD,SACE,MAAM,wBAAwB,MAC1B,6BACA;AAAA,IACR,CAAC;AAAA,EACH;AACA,oBAAkB,MAAM,OAAO,kBAAkB;AACjD,MAAI,MAAM,YAAY,MAAM;AAC1B,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI;AACF,UAAM;AAAA,MACJ;AAAA,QACE,IAAI,MAAM;AAAA,QACV,GAAI,MAAM,yBAAyB,SAC/B,EAAE,sBAAsB,MAAM,qBAAqB,IACnD,CAAC;AAAA,MACP;AAAA,MACA,MAAM;AAAA,MACN;AAAA,QACE,WAAW,MAAM;AAAA,QACjB,WAAW;AAAA,QACX,SAAS,MAAM,wBAAwB;AAAA,MACzC;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,iCAAiC;AACpD,YAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,2BAA2B,CAAC;AAAA,IACtE;AACA,QAAI,iBAAiB,sCAAsC;AACzD,YAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,uCAAuC,CAAC;AAAA,IAClF;AACA,UAAM;AAAA,EACR;AACA,QAAM,UAAU,MAAMC,YAAW,MAAM,IAAI,MAAM,MAAM,aAAa,MAAM,eAAe;AACzF,MAAI,CAAC,WAAW,QAAQ,cAAc,MAAM,MAAM,WAAW;AAC3D,UAAM,IAAID,gBAAc,KAAK,EAAE,SAAS,2BAA2B,CAAC;AAAA,EACtE;AACA,MAAI,QAAQ,WAAW,aAAa;AAClC,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,OAAK,QAAQ,iBAAiB,WAAW,MAAM,iBAAiB,OAAO;AACrE,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,SAAS,MAAM,UAAU,QAAQ,OAAO;AAChD,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,YAAY,mBAAmB,UACrC,MAAM,YAAY,mBAAmB,QAAQ,gBAC7C;AACA,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,8BAA8B,QAAQ,QAAQ,OAC7C,MAAM,YAAY,wBAAwB,OAC3C;AACA,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEO,SAAS,sBAAsB,MAAqB,OAAmC;AAC5F,MAAI,cAAc,MAAM,aAAa,kBAAkB,KAAK,KAAK,oBAAoB,MAAM;AACzF,WAAO;AAAA,EACT;AACA,SAAO,EAAE,GAAG,MAAM,iBAAiB,KAAK;AAC1C;AAEO,SAAS,yBACd,KACA,OACG;AACH,MAAI,cAAc,MAAM,aAAa,kBAAkB,KAAK,IAAI,cAAc,MAAM;AAClF,WAAO;AAAA,EACT;AACA,SAAO,EAAE,GAAG,KAAK,WAAW,KAAK;AACnC;AAIA,eAAe,wBACb,IACA,aACA,OACe;AACf,QAAM,MAAM,MAAME,QAAO,IAAI,aAAa,KAAK;AAC/C,MAAI,CAAC,KAAK;AACR,UAAM,IAAIF,gBAAc,KAAK,EAAE,SAAS,kBAAkB,KAAK,GAAG,CAAC;AAAA,EACrE;AACF;AAEA,eAAsB,6BAA6B,OAWb;AACpC,QAAM,SAAmC,CAAC;AAC1C,QAAM,oBAAoB,MAAM,SAAS,OAAO,SAAS;AACzD,MAAI,MAAM,QAAQ,UAAU,MAAM,QAAQ,OAAO,SAAS,MAAM,SAAS,OAAO,MAAM;AACpF,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,mBAAmB;AACrB,QACE,MAAM,QAAQ,gBAAgB,UAC9B,MAAM,QAAQ,YAAY,UAC1B,MAAM,QAAQ,oBAAoB,UAClC,MAAM,QAAQ,kBAAkB,UAChC,MAAM,QAAQ,UAAU,QACxB;AACA,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,MAAM,QAAQ,kBAAkB,oBAAoB;AACtD,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,MAAM,QAAQ,QAAQ,SAAS,yBAAyB;AAC1D,YAAM,kCAAkC;AAAA,QACtC,IAAI,MAAM;AAAA,QACV,OAAO,MAAM;AAAA,QACb,QAAQ,MAAM,QAAQ;AAAA,MACxB,CAAC;AACD,aAAO,SAAS,MAAM,QAAQ;AAAA,IAChC;AACA,QAAI,MAAM,QAAQ,SAAS;AACzB,aAAO,OAAO,yBAAyB,MAAM,QAAQ,IAAI;AAC3D,QAAI,MAAM,QAAQ,WAAW,OAAW,QAAO,SAAS,MAAM,QAAQ;AACtE,QAAI,MAAM,QAAQ,aAAa,QAAW;AACxC,oCAA8B,MAAM,QAAQ,QAAQ;AACpD,aAAO,WAAW,MAAM,QAAQ;AAAA,IAClC;AACA,QAAI,MAAM,QAAQ,kBAAkB,QAAW;AAC7C,aAAO,gBAAgB,MAAM,QAAQ;AAAA,IACvC;AACA,QAAI,MAAM,QAAQ,aAAa,OAAW,QAAO,WAAW,MAAM,QAAQ;AAC1E,WAAO;AAAA,EACT;AACA,QAAM,iBAAiB,MAAM,SAAS;AACtC,QAAM,cAAc,MAAM,QAAQ,WAAW,MAAM,SAAS;AAC5D,QAAM,sBACJ,MAAM,QAAQ,oBAAoB,SAC9B,MAAM,QAAQ,kBACd,gBAAgB,qBACd,iBACA;AACR,MACE,MAAM,SAAS,YAAY,sBAC3B,MAAM,SAAS,qBACf,gBAAgB,oBAChB;AACA,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACA,MAAI,MAAM,QAAQ,SAAS,QAAW;AACpC,WAAO,OAAO,yBAAyB,MAAM,QAAQ,IAAI;AAAA,EAC3D;AACA,MAAI,MAAM,QAAQ,WAAW,QAAW;AACtC,WAAO,SAAS,MAAM,QAAQ;AAAA,EAChC;AACA,MAAI,MAAM,QAAQ,aAAa,QAAW;AACxC,kCAA8B,MAAM,QAAQ,QAAQ;AACpD,WAAO,WAAW,MAAM,QAAQ;AAAA,EAClC;AACA,MAAI,MAAM,QAAQ,YAAY,QAAW;AACvC,WAAO,UAAU,MAAM,QAAQ;AAAA,EACjC;AACA,MAAI,MAAM,QAAQ,kBAAkB,QAAW;AAC7C,WAAO,gBAAgB,MAAM,QAAQ;AAAA,EACvC;AACA,MAAI,MAAM,QAAQ,aAAa,QAAW;AACxC,WAAO,WAAW,MAAM,QAAQ;AAAA,EAClC;AACA,MAAI,MAAM,QAAQ,kBAAkB,QAAW;AAC7C,UAAM,oBAAoB,MAAM,QAAQ;AACxC,SACG,MAAM,SAAS,iBAAiB,WAAW,qBAAqB,SACjE,MAAM,SAAS,YAAY,sBAC3B,MAAM,SAAS,mBACf;AACA,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SACE;AAAA,MACJ,CAAC;AAAA,IACH;AACA,QAAI,sBAAsB,MAAM;AAC9B,UAAI,MAAM,SAAS,kBAAkB,MAAM;AAGzC,0BAAkB,MAAM,OAAO,mBAAmB;AAAA,MACpD;AACA,aAAO,gBAAgB;AAAA,IACzB,OAAO;AACL,YAAM;AAAA,QACJ,EAAE,UAAU,MAAM,UAAU,IAAI,MAAM,GAAG;AAAA,QACzC,MAAM;AAAA,QACN,MAAM,SAAS;AAAA,QACf;AAAA,MACF;AACA,aAAO,gBAAgB;AAAA,IACzB;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,UAAU,QAAW;AAIrC,QAAI,MAAM,QAAQ,UAAU,MAAM;AAChC,YAAM,wBAAwB,MAAM,IAAI,MAAM,SAAS,aAAa,MAAM,QAAQ,KAAK;AAAA,IACzF;AACA,WAAO,QAAQ,MAAM,QAAQ;AAAA,EAC/B;AACA,MAAI,MAAM,QAAQ,gBAAgB,QAAW;AAI3C,UAAM,sBACJ,MAAM,QAAQ,kBAAkB,SAC5B,MAAM,QAAQ,kBAAkB,OAChC,QAAQ,MAAM,SAAS,aAAa;AAC1C,QAAI,qBAAqB;AACvB,wBAAkB,MAAM,OAAO,mBAAmB;AAAA,IACpD;AACA,UAAM,kBAAkB,MAAM,iCAAiC;AAAA,MAC7D,UAAU,MAAM;AAAA,MAChB,IAAI,MAAM;AAAA,MACV,eAAe,MAAM;AAAA,MACrB,OAAO,MAAM;AAAA,MACb,aAAa,MAAM,SAAS;AAAA,MAC5B,SAAS,EAAE,aAAa,MAAM,QAAQ,YAAY;AAAA,MAClD,GAAI,MAAM,kBAAkB,SAAY,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;AAAA,IACpF,CAAC;AACD,QACE,MAAM,SAAS,qBACf,MAAM,SAAS,YAAY,uBAC1B,MAAM,SAAS,YAAY,wBAAwB,WACjD,gBAAgB,wBAAwB,OAC3C;AACA,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SACE;AAAA,MACJ,CAAC;AAAA,IACH;AACA,WAAO,cAAc;AACrB,UAAM,kBAAkB,MAAM;AAAA,MAC5B,MAAM;AAAA,MACN,MAAM,SAAS;AAAA,MACf,MAAM;AAAA,MACN,EAAE,WAAW,MAAM,MAAM,UAAU;AAAA,IACrC;AACA,UAAM,gCAAgC,MAAM,oCAAoC;AAAA,MAC9E,IAAI,MAAM;AAAA,MACV,aAAa,MAAM,SAAS;AAAA,MAC5B,UAAU;AAAA,MACV,OAAO,CAAC,GAAG,gBAAgB,OAAO,EAAE,MAAM,OAAO,IAAI,WAAW,CAAC;AAAA,MACjE,QAAQ,2CAA2C,MAAM,KAAK;AAAA,IAChE,CAAC;AACD,QAAI,MAAM,SAAS,qBAAqB,MAAM,SAAS,YAAY,oBAAoB;AACrF,YAAM,sBAAsB,MAAM;AAAA,QAChC,MAAM;AAAA,QACN,MAAM,SAAS;AAAA,QACf,MAAM,SAAS;AAAA,MACjB;AACA,UAAI,CAAC,mCAAmC,qBAAqB,6BAA6B,GAAG;AAC3F,cAAM,IAAIA,gBAAc,KAAK;AAAA,UAC3B,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO,gCAAgC;AAAA,EACzC;AACA,MACE,mBACC,gBAAgB,sBAAsB,wBAAwB,iBAC/D;AACA,UAAM,4BAA4B;AAAA,MAChC,IAAI,MAAM;AAAA,MACV,sBAAsB,MAAM;AAAA,MAC5B,sBAAsB,MAAM;AAAA,MAC5B,OAAO,MAAM;AAAA,MACb,iBAAiB;AAAA,MACjB,SAAS;AAAA,MACT,eAAe,MAAM,SAAS;AAAA,MAC9B,OAAO,MAAM,SAAS;AAAA,MACtB,aAAa,MAAM,SAAS;AAAA,IAC9B,CAAC;AAAA,EACH;AACA,QAAM,4BAA4B;AAAA,IAChC,IAAI,MAAM;AAAA,IACV,sBAAsB,MAAM;AAAA,IAC5B,sBAAsB,MAAM;AAAA,IAC5B,OAAO,MAAM;AAAA,IACb,iBAAiB;AAAA,IACjB,SAAS;AAAA,IACT,eACE,MAAM,QAAQ,kBAAkB,SAC5B,MAAM,QAAQ,gBACd,MAAM,SAAS;AAAA,IACrB,OAAO,MAAM,QAAQ,UAAU,SAAY,MAAM,QAAQ,QAAQ,MAAM,SAAS;AAAA,IAChF,aAAa,OAAO,eAAe,MAAM,SAAS;AAAA,EACpD,CAAC;AACD,MACE,MAAM,QAAQ,oBAAoB,UAClC,MAAM,SAAS,YAAY,sBAC3B,gBAAgB,oBAChB;AACA,WAAO,kBAAkB;AAAA,EAC3B;AACA,SAAO;AACT;AAEA,eAAsB,2BACpB,IACA,aACA,QACwB;AACxB,QAAM,OAAO,MAAM,iBAAiB,IAAI,aAAa,MAAM;AAC3D,MAAI,CAAC,MAAM;AACT,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,2BAA2B,CAAC;AAAA,EACtE;AACA,SAAO;AACT;AAOA,eAAsB,iCACpB,IACA,MACoC;AACpC,SAAO;AAAA,IACL;AAAA,IACA,+BAA+B,MAAM;AAAA,MACnC;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AACF;AAEA,eAAsB,qBACpB,IACA,UACwB;AACxB,QAAM,EAAE,KAAK,IAAI;AACjB,SAAO,MAAM,oBAAoB,IAAI,KAAK,aAAa,KAAK,IAAI;AAAA,IAC9D,MAAM,KAAK;AAAA,IACX,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,IACf,SAAS,KAAK;AAAA,IACd,eAAe,KAAK;AAAA,IACpB,QAAQ,KAAK;AAAA,IACb,aAAa,KAAK;AAAA,IAClB,+BAA+B,SAAS;AAAA,IACxC,GAAI,KAAK,YAAY,qBACjB,EAAE,iBAAiB,KAAK,gBAAgB,IACxC,EAAE,mBAAmB,KAAK,kBAAkB;AAAA,IAChD,eAAe,KAAK;AAAA,IACpB,OAAO,KAAK;AAAA,IACZ,UAAU,KAAK;AAAA,EACjB,CAAC;AACH;AAEA,eAAe,kCAAkC,OAI/B;AAChB,MAAI,MAAM,OAAO,wBAAwB,MAAM,MAAM,WAAW;AAC9D,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,OAAO,WAAW,mBAAmB,MAAM,MAAM,WAAW;AACpE,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,WAAW,MAAM,mCAAmC,MAAM,IAAI;AAAA,IAClE,WAAW,MAAM,MAAM;AAAA,IACvB,aAAa,MAAM,MAAM;AAAA,IACzB,UAAU,MAAM,OAAO;AAAA,IACvB,qBAAqB,MAAM,MAAM;AAAA,EACnC,CAAC;AACD,MAAI,CAAC,YAAY,SAAS,OAAO,mBAAmB,UAAU;AAC5D,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,6BAA6B,CAAC;AAAA,EACxE;AACA,MACE,SAAS,OAAO,mBAAmB,MAAM,OAAO,oBAChD,SAAS,OAAO,wBAAwB,MAAM,OAAO,6BACrD,wBAAwB,SAAS,OAAO,KAAK,MAC3C,wBAAwB,MAAM,OAAO,WAAW,GAClD;AACA,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,aAAa,MAAMG;AAAA,IACvB,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,IACZ,MAAM,OAAO,WAAW;AAAA,IACxB,MAAM,MAAM;AAAA,EACd;AACA,MACE,CAAC,cACD,WAAW,cAAc,MAAM,MAAM,aACrC,WAAW,gBAAgB,MAAM,MAAM,eACvC,WAAW,cAAc,MAAM,OAAO,WAAW,kBACjD,WAAW,YAAY,MAAM,OAAO,WAAW,qBAC/C,WAAW,eAAe,YAAY,MACpC,MAAM,OAAO,WAAW,eAAe,YAAY,KACrD,WAAW,SAAS,MAAM,OAAO,WAAW,QAC5C,WAAW,WAAW,UACtB;AACA,UAAM,IAAIH,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAEO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACvC;AAAA,EAET,YAAY,OAAgB,qBAA8B;AACxD,UAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,EAAE,MAAM,CAAC;AACvE,SAAK,OAAO;AACZ,SAAK,sBAAsB;AAAA,EAC7B;AACF;AAEA,eAAsB,yBAAyB,OAI7B;AAChB,MAAI;AACF,UAAM,MAAM,eAAe,kBAAkB,EAAE,MAAM,MAAM,KAAK,CAAC;AAAA,EACnE,SAAS,OAAO;AACd,QAAI,sBAAsB;AAC1B,QAAI;AACF,YAAM,oBAAoB,MAAM,IAAI,MAAM,KAAK,aAAa,MAAM,KAAK,EAAE;AAAA,IAC3E,QAAQ;AACN,4BAAsB;AAAA,IACxB;AACA,UAAM,IAAI,uBAAuB,OAAO,mBAAmB;AAAA,EAC7D;AACF;AAEA,eAAsB,yBAAyB,OAK7B;AAChB,MAAI;AACF,UAAM,MAAM,eAAe,kBAAkB,EAAE,MAAM,MAAM,KAAK,CAAC;AAAA,EACnE,SAAS,OAAO;AACd,QAAI,sBAAsB;AAC1B,QAAI;AACF,YAAM,qBAAqB,MAAM,IAAI,MAAM,QAAQ;AAAA,IACrD,QAAQ;AACN,4BAAsB;AAAA,IACxB;AACA,UAAM,IAAI,uBAAuB,OAAO,mBAAmB;AAAA,EAC7D;AACF;AAEO,SAAS,gCAAgC,QAAwB;AACtE,SAAO,kBAAkB,MAAM;AACjC;AAaO,SAAS,0BAA0B,iBAAyC;AACjF,QAAM,WAAW,mBAAmB,IAAI,KAAK;AAC7C,MAAI,CAAC,SAAS;AACZ,WAAO,OAAO,WAAW;AAAA,EAC3B;AACA,QAAM,OAAO,QAAQ,QAAQ,oBAAoB,GAAG,EAAE,MAAM,GAAG,GAAG;AAGlE,SAAO,KAAK,SAAS,IAAI,OAAO,OAAO,WAAW;AACpD;AAQO,SAAS,qCAAqC,QAAgB,cAA8B;AACjG,SAAO,kBAAkB,MAAM,WAAW,YAAY;AACxD;AAOO,SAAS,mCACd,aACA,QACA,cACQ;AACR,SAAO,uCAAuC,WAAW,IAAI,MAAM,IAAI,YAAY;AACrF;AAEA,eAAe,iCAAiC,OAQV;AAMpC,QAAM,QAAQ,yBAAyB,MAAM,UAAU,MAAM,QAAQ,YAAY,KAAK;AAGtF,QAAM,iCAAiC,MAAM,IAAI,MAAM,UAAU,MAAM,aAAa,KAAK;AACzF,QAAM,YAAY,mBAAmB,MAAM,QAAQ,YAAY,aAAa,CAAC,CAAC;AAC9E,QAAM,kBAAkB,MAAM;AAAA,IAC5B,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,EAAE,WAAW,MAAM,MAAM,UAAU;AAAA,EACrC;AACA,QAAM,iBAAiB,iBAAiB,MAAM,QAAQ,YAAY,SAAS,CAAC,GAAG,eAAe;AAM9F,QAAM,QACH,MAAM,iBAAiB,OACpB,iBACA,qCAAqC,gBAAgB,MAAM,UAAU,eAAe;AAC1F,QAAM,SAAS,MAAM,QAAQ,YAAY,OAAO,KAAK;AACrD,MAAI,CAAC,QAAQ;AACX,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,oCAAoC,CAAC;AAAA,EAC/E;AACA,MAAI,2CAA2C,MAAM,QAAQ,YAAY,QAAQ,GAAG;AAClF,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS,GAAGI,wCAAuC;AAAA,IACrD,CAAC;AAAA,EACH;AACA,QAAM,kCAAkC,MAAM,IAAI,MAAM,aAAa,SAAS;AAC9E,MAAI,UAAU,KAAK,CAAC,aAAa,SAAS,SAAS,MAAM,KAAK,CAAC,MAAM,eAAe;AAClF,UAAM,IAAIJ,gBAAc,KAAK,EAAE,SAAS,mCAAmC,CAAC;AAAA,EAC9E;AACA,QAAM;AAAA,IACJ,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,IACZ,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,IACZ;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,YAAY,sBAAsB;AAClD,UAAM;AAAA,MACJ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM,QAAQ,YAAY;AAAA,IAC5B;AAAA,EACF;AACA,QAAM,oBAAoB,MAAM,QAAQ,YAAY;AACpD,MAAI,sBAAsB,QAAW;AACnC,UAAM,YAAY,MAAMK,kBAAiB,MAAM,IAAI,MAAM,WAAW;AACpE,UAAM,oBAAoB,UAAU,SAAS;AAC7C,UAAM,mBAAmB,MAAM,oCAAoC,MAAM,EAAE;AAC3E,UAAM,oBACJ,OAAO,sBAAsB,WACzB,oBACA,iBAAiB;AACvB,QACE,oBAAoB,qBACpB,CAAC,cAAc,MAAM,MAAM,aAAa,iBAAiB,GACzD;AACA,YAAM,IAAIL,gBAAc,KAAK;AAAA,QAC3B,SAAS,sCAAsC,iBAAiB,4BAA4B,iBAAiB;AAAA,MAC/G,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AAAA,IACL,GAAG,MAAM,QAAQ;AAAA,IACjB,GAAI,UAAU,UAAa,UAAU,OAAO,CAAC,IAAI,EAAE,MAAM;AAAA,IACzD;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,8BAA8B,UAA2C;AAChF,MAAI,SAAS,SAAS,cAAc,CAAC,SAAS,WAAW,CAAC,SAAS,OAAO;AACxE;AAAA,EACF;AACA,MAAI,IAAI,KAAK,SAAS,OAAO,EAAE,QAAQ,KAAK,IAAI,KAAK,SAAS,KAAK,EAAE,QAAQ,GAAG;AAC9E,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,gDAAgD,CAAC;AAAA,EAC3F;AACF;AAEA,SAAS,yBAAyB,MAAsB;AACtD,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,kCAAkC,CAAC;AAAA,EAC7E;AACA,SAAO;AACT;;;AIx2BA,SAAS,+BAAAM,oCAAkD;AAC3D;AAAA,EACE;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,IAAM,6BAA6B;AAUnC,SAAS,YAAY,QAAwB;AAC3C,SAAO,SAAS;AAClB;AAEA,SAAS,YAAY,QAAgB,OAAuB;AAC1D,MAAI,SAAS,EAAG,QAAO;AACvB,SAAO,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,KAAK,MAAO,SAAS,QAAS,GAAG,CAAC,CAAC;AACtE;AAEA,SAAS,cAAc,MAAkB;AACvC,SAAO,IAAI,KAAK,KAAK,IAAI,KAAK,eAAe,GAAG,KAAK,YAAY,GAAG,KAAK,WAAW,CAAC,CAAC;AACxF;AAEA,SAASC,iBAAgB,MAAkB;AACzC,SAAO,IAAI,KAAK,KAAK,IAAI,KAAK,eAAe,GAAG,KAAK,YAAY,GAAG,CAAC,CAAC;AACxE;AAEA,SAAS,eAAe,MAAkB;AACxC,SAAO,IAAI,KAAK,KAAK,IAAI,KAAK,eAAe,GAAG,GAAG,CAAC,CAAC;AACvD;AAEA,SAAS,mBACP,OACA,KAUA;AACA,QAAM,QAAQ;AACd,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,cAAQ,cAAc,GAAG;AACzB,mBAAa;AACb,mBAAa;AACb,oBAAc;AACd,yBAAmB;AACnB;AAAA,IACF,KAAK;AACH,cAAQ,IAAI,KAAK,cAAc,GAAG,EAAE,QAAQ,IAAI,IAAI,KAAK,KAAK,KAAK,GAAI;AACvE,mBAAa;AACb,mBAAa;AACb,oBAAc;AACd,yBAAmB;AACnB;AAAA,IACF,KAAK;AACH,cAAQA,iBAAgB,GAAG;AAC3B,mBAAa;AACb,mBAAa;AACb,oBAAc;AACd,yBAAmB;AACnB;AAAA,IACF,KAAK;AACH,cAAQ,eAAe,GAAG;AAC1B,mBAAa;AACb,mBAAa;AACb,oBAAc;AACd,yBAAmB;AACnB;AAAA,IACF,SAAS;AACP,YAAM,cAAqB;AAC3B,YAAM,IAAI,MAAM,2BAA2B,WAAW,EAAE;AAAA,IAC1D;AAAA,EACF;AACA,QAAM,aAAa,MAAM,QAAQ,IAAI,MAAM,QAAQ;AACnD,QAAM,aAAa;AACnB,QAAM,aAAa,IAAI,KAAK,WAAW,QAAQ,IAAI,KAAK,IAAI,YAAY,CAAC,CAAC;AAC1E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,SAAS,WAAiB,KAAmB;AACpD,QAAM,KAAK,KAAK,IAAI,GAAG,IAAI,QAAQ,IAAI,UAAU,QAAQ,CAAC;AAC1D,QAAM,UAAU,KAAK,MAAM,KAAK,GAAM;AACtC,MAAI,UAAU,EAAG,QAAO;AACxB,MAAI,UAAU,GAAI,QAAO,GAAG,OAAO;AACnC,QAAM,QAAQ,KAAK,MAAM,UAAU,EAAE;AACrC,MAAI,QAAQ,GAAI,QAAO,GAAG,KAAK;AAC/B,SAAO,GAAG,KAAK,MAAM,QAAQ,EAAE,CAAC;AAClC;AAEA,SAAS,WAAW,OAGoD;AACtE,MAAI,MAAM,uBAAuB,SAAU,QAAO;AAClD,UAAQ,MAAM,QAAQ;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,cAAc,OAAgD;AACrE,SAAO,UAAU,aAAa,aAAa;AAC7C;AAEA,SAAS,gBACP,OACqD;AACrD,SAAO,UAAU,2BAA2B,UAAU,qBAAqB,QAAQ;AACrF;AAEA,eAAsB,qBACpB,IACA,UACA,OACoC;AACpC,QAAMF,kBAAiB,IAAI,MAAM,WAAW;AAC5C,QAAM,MAAM,MAAM,OAAO,oBAAI,KAAK;AAClC,QAAM,SAAS,mBAAmB,MAAM,OAAO,GAAG;AAClD,QAAM,WAAW,MAAM,UAAU,KAAK,KAAK;AAC3C,QAAM,QAAQ,MAAM,OAAO,KAAK,KAAK;AACrC,QAAM,oBAAoB,QAAQ,YAAY,KAAK;AACnD,QAAM,SAAS,EAAE,UAAU,MAAM;AACjC,QAAM,0BACJ,MAAM,UAAU,UAAU,gCAAgC;AAC5D,QAAM,oBACJ,MAAM,UAAU,UAAU,yBAAyB;AAErD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,MAAM,QAAQ,IAAI;AAAA,IACpB,wBAAwB,IAAI;AAAA,MAC1B,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AAAA,IACD,wBAAwB,IAAI;AAAA,MAC1B,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AAAA,IACD,wBAAwB,IAAI;AAAA,MAC1B,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AAAA,IACD,wBAAwB,IAAI;AAAA,MAC1B,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AAAA,IACD,wBAAwB,IAAI;AAAA,MAC1B,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,GAAG;AAAA,IACL,CAAC;AAAA,IACD,wBAAwB,IAAI;AAAA,MAC1B,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,GAAG;AAAA,IACL,CAAC;AAAA,IACD,wBAAwB,IAAI;AAAA,MAC1B,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,GAAG;AAAA,IACL,CAAC;AAAA,IACD,kBAAkB,IAAI;AAAA,MACpB,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AAAA,IACD,kBAAkB,IAAI;AAAA,MACpB,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AAAA,IACD,4BAA4B,IAAI;AAAA,MAC9B,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,OAAO;AAAA,IACT,CAAC;AAAA,IACD,mBAAmB,IAAI,MAAM,WAAW;AAAA,IACxC,4BAA4B,IAAI;AAAA,MAC9B,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,GAAG;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AAAA,IACD,uBAAuB,IAAI;AAAA,MACzB,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,GAAG;AAAA,IACL,CAAC;AAAA,IACD,mBAAmB,IAAI,MAAM,aAAa,GAAG;AAAA,IAC7C,sBAAsB,IAAI,MAAM,WAAW;AAAA,IAC3C,kBAAkB,IAAI,MAAM,aAAa,EAAE;AAAA,IAC3C,SAAS,2BACL,oBAAoB,IAAI,MAAM,aAAa,4BAA4B,GAAG,IAC1E,QAAQ,QAAQ,CAAC;AAAA,IACrBC,kBAAiB,IAAI;AAAA,MACnB,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,OAAOC,iBAAgB,GAAG;AAAA,IAC5B,CAAC;AAAA,IACDD,kBAAiB,IAAI;AAAA,MACnB,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,OAAOC,iBAAgB,GAAG;AAAA,IAC5B,CAAC;AAAA,IACD,oBAAoB,IAAI;AAAA,MACtB,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,IAChB,CAAC;AAAA,IACD,qBAAqB,IAAI;AAAA,MACvB,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,GAAG;AAAA,MACH,OAAO;AAAA,IACT,CAAC;AAAA,EACH,CAAC;AAED,QAAM,CAAC,kBAAkB,UAAU,UAAU,IAAI,MAAM,QAAQ,IAAI;AAAA;AAAA;AAAA,IAGjE,4BAA4B,IAAI;AAAA,MAC9B,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,GAAG;AAAA,MACH,gBAAgB,YAAY,IAAI,CAAC,QAAQ,IAAI,aAAa;AAAA,IAC5D,CAAC;AAAA,IACD;AAAA,MACE;AAAA,MACA,MAAM;AAAA,MACN,WAAW,IAAI,CAAC,UAAU,MAAM,OAAO;AAAA,IACzC;AAAA,IACA,wBAAwB,IAAI;AAAA,MAC1B,aAAa,MAAM;AAAA,MACnB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,SAAS,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,IACtC,CAAC;AAAA,EACH,CAAC;AACD,QAAM,iBAAiB,IAAI,IAAI,SAAS,IAAI,CAAC,UAAU,CAAC,MAAM,SAAS,MAAM,OAAO,CAAC,CAAC;AACtF,QAAM,qBAAqB,IAAI,IAAI,WAAW,IAAI,CAAC,UAAU,CAAC,MAAM,SAAS,MAAM,WAAW,CAAC,CAAC;AAEhG,QAAM,SAAS,UACZ,IAAI,CAAC,SAAS;AAAA,IACb,IAAI,GAAG,IAAI,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,WAAW;AAAA,IACnD,OAAO,IAAI;AAAA,IACX,UAAU,IAAI;AAAA,IACd,SAAS,cAAc,IAAI,WAAW;AAAA,IACtC,OAAO,IAAI;AAAA,IACX,aAAa,IAAI;AAAA,IACjB,cAAc,IAAI;AAAA,IAClB,cAAc,IAAI;AAAA,IAClB,kBAAkB,IAAI;AAAA,IACtB,kBAAkB,IAAI;AAAA,IACtB,iBAAiB,IAAI;AAAA,IACrB,aAAa,IAAI;AAAA,IACjB,iBAAiB,IAAI;AAAA,IACrB,iBAAiB,IAAI;AAAA,IACrB,WAAW,YAAY,IAAI,gBAAgB;AAAA,IAC3C,sBAAsB,YAAY,IAAI,2BAA2B;AAAA,IACjE,iCAAiC,IAAI;AAAA,EACvC,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,EAAE,WAAW;AAE/C,QAAM,eAAe,UAAU,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,kBAAkB,CAAC;AACjF,QAAM,oBAAoB,eAAe,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,kBAAkB,CAAC;AAC3F,QAAM,8BAA8B,UAAU;AAAA,IAC5C,CAAC,KAAK,QAAQ,MAAM,IAAI;AAAA,IACxB;AAAA,EACF;AACA,QAAM,mCAAmC,eAAe;AAAA,IACtD,CAAC,KAAK,QAAQ,MAAM,IAAI;AAAA,IACxB;AAAA,EACF;AACA,QAAM,kCAAkC,UAAU;AAAA,IAChD,CAAC,KAAK,QAAQ,MAAM,IAAI;AAAA,IACxB;AAAA,EACF;AACA,QAAM,uCAAuC,eAAe;AAAA,IAC1D,CAAC,KAAK,QAAQ,MAAM,IAAI;AAAA,IACxB;AAAA,EACF;AACA,QAAM,aAAa,UAAU,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,OAAO,CAAC;AACpE,QAAM,mBAAmB,eAAe,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,aAAa,CAAC;AACrF,QAAM,mBAAmB,eAAe,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,aAAa,CAAC;AACrF,QAAM,oBAAoB,eAAe,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,cAAc,CAAC;AACvF,QAAM,wBAAwB,eAAe,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,kBAAkB,CAAC;AAC/F,QAAM,aAAa,eAAe,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,OAAO,CAAC;AAEzE,QAAM,UACJ,MAAM,UAAU,UACZ,kBAAkB,OAAO,OAAO,OAAO,KAAK,IAC5C,iBAAiB,OAAO,OAAO,OAAO,KAAK;AACjD,QAAM,SAAS,QAAQ,IAAI,CAAC,WAAW;AACrC,UAAM,QAAQ,SAAS,IAAI,MAAM,KAAK;AAAA,MACpC,YAAY;AAAA,MACZ,6BAA6B;AAAA,MAC7B,iCAAiC;AAAA,MACjC,aAAa;AAAA,MACb,cAAc;AAAA,MACd,cAAc;AAAA,MACd,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,MAClB,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,iBAAiB;AAAA,MACjB,iBAAiB;AAAA,MACjB,OAAO;AAAA,IACT;AACA,UAAM,kBAAkB,oBACpB,MAAM,aACL,SAAS,IAAI,MAAM,KAAK,MAAM;AACnC,WAAO;AAAA,MACL,OAAO,MAAM,UAAU,UAAU,OAAO,MAAM,EAAE,IAAI,OAAO,MAAM,CAAC;AAAA,MAClE,cAAc,YAAY,eAAe;AAAA,MACzC,sBAAsB,YAAY,MAAM,2BAA2B;AAAA,MACnE,iCAAiC,MAAM;AAAA,MACvC,aAAa,SAAS,IAAI,MAAM,KAAK;AAAA,MACrC,aAAa,MAAM;AAAA,MACnB,cAAc,MAAM;AAAA,MACpB,cAAc,MAAM;AAAA,MACpB,kBAAkB,MAAM;AAAA,MACxB,kBAAkB,MAAM;AAAA,MACxB,iBAAiB,MAAM;AAAA,MACvB,aAAa,MAAM;AAAA,MACnB,iBAAiB,MAAM;AAAA,MACvB,iBAAiB,MAAM;AAAA,MACvB,aAAa,YAAY,MAAM,cAAc,MAAM,gBAAgB;AAAA,MACnE,OAAO,MAAM;AAAA,IACf;AAAA,EACF,CAAC;AAED,QAAM,oBAAoB,IAAI;AAAA,IAC5B,iBAAiB,IAAI,CAAC,QAAQ,CAAC,IAAI,eAAe,IAAI,gBAAgB,CAAC;AAAA,EACzE;AACA,QAAM,oBAAoB,KAAK;AAAA,IAC7B,YAAY,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,aAAa,CAAC;AAAA,IACzD;AAAA,EACF;AACA,QAAM,UAAU,YAAY,IAAI,CAAC,QAAQ;AACvC,UAAM,YAAY,YAAY,IAAI,gBAAgB;AAClD,UAAM,WAAW,YAAY,kBAAkB,IAAI,IAAI,aAAa,KAAK,CAAC;AAC1E,WAAO;AAAA,MACL,IAAI,QAAQ,IAAI,aAAa;AAAA,MAC7B,SAAS;AAAA,MACT,OAAO,IAAI,OAAO,KAAK,KAAK,IAAI,cAAc,MAAM,GAAG,CAAC;AAAA,MACxD;AAAA,MACA,sBAAsB,YAAY,IAAI,2BAA2B;AAAA,MACjE,iCAAiC,IAAI;AAAA,MACrC,QAAQ,IAAI;AAAA,MACZ,aAAa,YAAY,IAAI,cAAc,IAAI,gBAAgB;AAAA,MAC/D,gBACE,eAAe,IACX,KAAK,IAAI,KAAK,KAAK,MAAO,IAAI,mBAAmB,eAAgB,GAAG,CAAC,IACrE;AAAA,MACN,aAAa,KAAK,IAAI,KAAK,KAAK,MAAO,IAAI,cAAc,oBAAqB,GAAG,CAAC;AAAA,MAClF,iBAAiB,YAAY;AAAA,IAC/B;AAAA,EACF,CAAC;AAED,QAAM,mBAAmB,IAAI,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,IAAI,iBAAiB,GAAG,CAAU,CAAC;AAChG,QAAM,YAAY,MAAM,IAAI,CAAC,SAAS;AACpC,UAAM,OAAO,iBAAiB,IAAI,KAAK,EAAE;AACzC,WAAO;AAAA,MACL,IAAI,KAAK;AAAA,MACT,MAAM,KAAK;AAAA,MACX,OAAO,WAAW,IAAI,KAAK,EAAE,KAAK;AAAA,MAClC,WAAW,OAAO,YAAY,KAAK,gBAAgB,IAAI;AAAA,MACvD,sBAAsB,OAAO,YAAY,KAAK,2BAA2B,IAAI;AAAA,MAC7E,iCAAiC,OAAO,KAAK,kCAAkC;AAAA,MAC/E,QAAQ,OAAO,KAAK,cAAc;AAAA,MAClC,aAAa,OAAO,YAAY,KAAK,cAAc,KAAK,gBAAgB,IAAI;AAAA,MAC5E,SAAS,OAAO,cAAc,KAAK,WAAW,IAAI;AAAA,IACpD;AAAA,EACF,CAAC;AAED,QAAM,SAASH,6BAA4B,QAAQ;AAGnD,QAAM,QAAQ,UACX,OAAO,CAAC,QAAQ;AACf,QAAI,CAAC,MAAO,QAAO;AACnB,WAAO,IAAI,UAAU;AAAA,EACvB,CAAC,EACA,IAAI,CAAC,SAAS;AAAA,IACb,IAAI,IAAI;AAAA,IACR,OAAO,IAAI,OAAO,KAAK,KAAK;AAAA,IAC5B,OAAO,WAAW,GAAG;AAAA,IACrB,OAAO,IAAI;AAAA,IACX,OAAO,IAAI;AAAA,IACX,UAAU;AAAA,IACV,UAAU,SAAS,IAAI,WAAW,GAAG;AAAA,IACrC,aAAa;AAAA,IACb,OAAO,IAAI;AAAA,EACb,EAAE;AAEJ,QAAM,WAAW,0BAA0B,MAAM;AAAA,IAC/C,OAAO,MAAM;AAAA,IACb,YAAY,OAAO;AAAA,IACnB,YAAY,OAAO;AAAA,IACnB,aAAa,OAAO;AAAA,IACpB,kBAAkB,OAAO;AAAA,IACzB,aAAa,OAAO,MAAM,YAAY;AAAA,IACtC,WAAW,OAAO,MAAM,YAAY;AAAA,IACpC,aAAa,IAAI,YAAY;AAAA,IAC7B,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,MAAM,QAAQ,IAAI,CAAC,YAAY;AAAA,MACpC,OAAO,OAAO;AAAA,MACd,UAAU,OAAO;AAAA,IACnB,EAAE;AAAA,IACF;AAAA,IACA;AAAA,IACA,aAAa,YAAY,IAAI,CAAC,SAAS;AAAA,MACrC,IAAI,IAAI;AAAA,MACR,YAAY,IAAI,WAAW,YAAY;AAAA,MACvC,YAAY,IAAI,WAAW,YAAY;AAAA,MACvC,WAAW,IAAI;AAAA,MACf,cAAc,IAAI,cAAc,KAAK,KAAK;AAAA,MAC1C,QAAQ,IAAI;AAAA,MACZ,UAAU,IAAI;AAAA,MACd,aAAa,IAAI;AAAA,MACjB,OAAO,IAAI;AAAA,MACX,SAAS,cAAc,IAAI,WAAW;AAAA,MACtC,aAAa,IAAI;AAAA,MACjB,cAAc,IAAI;AAAA,MAClB,cAAc,IAAI;AAAA,MAClB,kBAAkB,IAAI;AAAA,MACtB,iBAAiB,IAAI;AAAA,MACrB,aAAa,IAAI;AAAA,MACjB,WAAW,YAAY,IAAI,gBAAgB;AAAA,MAC3C,sBACE,IAAI,+BAA+B,OAC/B,OACA,YAAY,IAAI,2BAA2B;AAAA,MACjD,eAAe,gBAAgB,IAAI,aAAa;AAAA,IAClD,EAAE;AAAA,IACF;AAAA,IACA;AAAA,IACA,YAAY,WAAW,IAAI,CAAC,WAAW;AAAA,MACrC,IAAI,MAAM;AAAA,MACV,SAAS,MAAM;AAAA,MACf,OAAO,MAAM,QAAQ,MAAM,GAAG,CAAC;AAAA,MAC/B,SAAS,eAAe,IAAI,MAAM,OAAO,KAAK;AAAA,MAC9C,aAAa,MAAM;AAAA,MACnB,kBAAkB,SAAS,IAAI,MAAM,OAAO,KAAK;AAAA,IACnD,EAAE;AAAA,IACF,UAAU,SAAS,IAAI,CAAC,WAAW;AAAA,MACjC,IAAI,MAAM;AAAA,MACV,SAAS,MAAM;AAAA,MACf,SAAS,MAAM;AAAA,MACf,aAAa,MAAM;AAAA,MACnB,eAAe,MAAM;AAAA,MACrB,cAAc,MAAM,cAAc,IAAI,WAAW;AAAA,MACjD,aAAa,mBAAmB,IAAI,MAAM,OAAO,KAAK;AAAA,IACxD,EAAE;AAAA,IACF;AAAA,IACA,mBAAmB,SAAS;AAAA,IAC5B;AAAA,IACA,oBAAoB,YAAY,qBAAqB;AAAA,IACrD,yBAAyB,YAAY,0BAA0B;AAAA,IAC/D,WAAW,YAAY,YAAY;AAAA,IACnC,gBAAgB,YAAY,iBAAiB;AAAA,IAC7C,sBAAsB,YAAY,2BAA2B;AAAA,IAC7D,2BAA2B,YAAY,gCAAgC;AAAA,IACvE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,YAAY,mBAAmB,qBAAqB;AAAA,IACtE;AAAA,IACA,aAAa,MAAM;AAAA,IACnB,gBAAgB,MAAM;AAAA,IACtB,iBAAiB,MAAM;AAAA,IACvB,cAAc,MAAM;AAAA,IACpB,cAAc,MAAM;AAAA,IACpB,qBAAqB,MAAM,uBAAuB;AAAA,IAClD,UAAU,KAAK,MAAM,MAAM,WAAW,EAAE,IAAI;AAAA,IAC5C,aAAa,SAAS,OAAO,CAAC,UAAU,MAAM,gBAAgB,CAAC,EAAE;AAAA,IACjE;AAAA,IACA,kBAAkB,OAAO,gCAAgC;AAAA,IACzD;AAAA,IACA,aAAa,OAAO,mCAAmC;AAAA,IACvD;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS;AACpB;;;AChlBA,SAAS,cAAAI,mBAAkB;AAC3B;AAAA,EACE,cAAAC;AAAA,OAGK;;;ACLA,IAAM,wCAAwC;AAErD,IAAM,sBAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,4BAA4B;AAClC,IAAM,gCACJ;AACF,IAAM,yBAAyB;AAQxB,SAAS,6BAA6B,OAAuB;AAClE,MAAI,YAAY;AAChB,aAAW,WAAW,qBAAqB;AACzC,gBAAY,UAAU,QAAQ,SAAS,qCAAqC;AAAA,EAC9E;AACA,cAAY,UAAU;AAAA,IACpB;AAAA,IACA,UAAU,qCAAqC;AAAA,EACjD;AACA,cAAY,UAAU;AAAA,IACpB;AAAA,IACA,CAAC,QAAQ,QAAgB,SACvB,GAAG,MAAM,GAAG,IAAI,IAAI,qCAAqC;AAAA,EAC7D;AACA,SAAO,UAAU;AAAA,IACf;AAAA,IACA,CAAC,QAAQ,WAAmB,GAAG,MAAM,GAAG,qCAAqC;AAAA,EAC/E;AACF;;;ADjCA,IAAM,eAAe;AACrB,IAAM,2BAA2B;AACjC,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY;AAEzB,IAAM,kCAAkC;AACxC,IAAM,sCAAsC;AAC5C,IAAM,wCAAwC;AAC9C,IAAM,oCAAoC;AAC1C,IAAM,+BAA+B;AACrC,IAAM,oCAAoC;AAC1C,IAAM,yCAAyC;AAoB/C,IAAM,0CAA0C;AAAA,EACrD,SAAS;AAAA,EACT,iBAAiB,CAAC,OAAO;AAAA,EACzB,mBAAmB,CAAC,QAAQ;AAC9B;AA4FA,IAAM,cAAc,oBAAI,IAA2B,CAAC,SAAS,UAAU,OAAO,CAAC;AAC/E,IAAM,kBAAkB,oBAAI,IAA8B,CAAC,QAAQ,UAAU,OAAO,CAAC;AACrF,IAAM,eAAe,oBAAI,IAA2B,CAAC,WAAW,aAAa,YAAY,CAAC;AAC1F,IAAM,UAAU,oBAAI,IAAuB,CAAC,UAAU,eAAe,CAAC;AACtE,IAAM,YAAY,oBAAI,IAAyB,CAAC,aAAa,YAAY,CAAC;AAC1E,IAAM,cAAc,oBAAI,IAAwD;AAAA,EAC9E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,kBAAkB,oBAAI,IAA2B;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,eAAe,oBAAI,IAAyB;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,mBAAmB,oBAAI,IAA2B,CAAC,UAAU,UAAU,CAAC;AAQvE,SAAS,+BACd,OACgC;AAChC,QAAM,SAAS,MAAM,UAAU;AAC/B,MAAI,CAAC,YAAY,MAAM,EAAG,QAAO,OAAO,eAAe;AACvD,MAAI,CAAC,OAAO,QAAS,QAAO,OAAO,UAAU;AAE7C,MAAI,MAAM,OAAO,eAAe,mBAAoB,QAAO,OAAO,oBAAoB;AACtF,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO,OAAO,eAAe;AACxD,MACE,MAAM,OAAO,cAAc,MAAM,QAAQ,aACzC,MAAM,OAAO,gBAAgB,MAAM,QAAQ,aAC3C;AACA,WAAO,OAAO,iBAAiB;AAAA,EACjC;AACA,MAAI,MAAM,OAAO,SAAS,WAAY,QAAO,OAAO,cAAc;AAClE,MAAI,MAAM,OAAO,cAAc,YAAa,QAAO,OAAO,kBAAkB;AAC5E,MAAI,MAAM,aAAa,aAAa,YAAa,QAAO,OAAO,qBAAqB;AACpF,MAAI,MAAM,OAAO,WAAW,gBAAiB,QAAO,OAAO,mBAAmB;AAC9E,MAAI,MAAM,aAAa,cAAc,QAAS,QAAO,OAAO,YAAY;AAExE,QAAM,eAAe,iBAAiB,KAAK;AAC3C,MAAI,aAAc,QAAO,OAAO,YAAY;AAC5C,MAAI,CAAC,wBAAwB,KAAK,EAAG,QAAO,OAAO,mBAAmB;AACtE,MAAI,CAAC,mBAAmB,KAAK,EAAG,QAAO,OAAO,wBAAwB;AAEtE,QAAM,eAAe,sBAAsB,QAAQ,MAAM,YAAY;AACrE,MAAI,CAAC,aAAc,QAAO,OAAO,oBAAoB;AAErD,QAAM,mBAAmB;AAAA,IACvB,aAAa,MAAM,aAAa,YAAY;AAAA,EAC9C;AACA,MAAI,CAAC,iBAAkB,QAAO,OAAO,iBAAiB;AACtD,QAAM,UAAU,aAAa,kBAAkB,mCAAmC;AAElF,QAAM,YAAY,mBAAmB,MAAM,OAAO,SAAS;AAC3D,QAAM,SAAS,gBAAgB,MAAM,OAAO,MAAM;AAClD,MAAI,CAAC,aAAa,CAAC,OAAQ,QAAO,OAAO,eAAe;AAExD,QAAM,QAAQ,oBAAoB,MAAM,OAAO,YAAY,iCAAiC;AAC5F,QAAM,aAA+C;AAAA,IACnD,SAAS;AAAA,IACT,aAAa,MAAM,QAAQ;AAAA,IAC3B,UAAU,MAAM,OAAO;AAAA,IACvB,eAAe,MAAM,OAAO;AAAA,IAC5B,YAAY,MAAM,OAAO;AAAA,IACzB,iBAAiB,MAAM,OAAO;AAAA,IAC9B,YAAY,IAAI,KAAK,MAAM,OAAO,UAAU,EAAE,YAAY;AAAA,IAC1D,YAAY,MAAM,aAAa;AAAA,IAC/B;AAAA,IACA,SAAS,QAAQ;AAAA,IACjB,kBAAkB,QAAQ;AAAA,IAC1B;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,iBAAiB,OAAO;AAAA,IACxB,YAAY,MAAM;AAAA,IAClB,qBAAqB,MAAM;AAAA,IAC3B,qBAAqB;AAAA,MACnB,aAAa,MAAM,QAAQ;AAAA,MAC3B,UAAU,MAAM,OAAO;AAAA,IACzB;AAAA,EACF;AAEA,MAAI,UAAUC,YAAW,UAAU,CAAC,IAAI,wCAAwC;AAC9E,WAAO,OAAO,eAAe;AAAA,EAC/B;AAEA,QAAM,SAASC,YAAW,QAAQ,EAAE,OAAOD,YAAW,UAAU,GAAG,MAAM,EAAE,OAAO,KAAK;AACvF,SAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA,IACA,gBAAgB,iBAAiB,+BAA+B,IAAI,MAAM;AAAA,IAC1E;AAAA,EACF;AACF;AAEA,SAAS,YAAY,QAA+C;AAClE,SACE,OAAO,OAAO,YAAY,aAC1B,MAAM,QAAQ,OAAO,eAAe,KACpC,MAAM,QAAQ,OAAO,iBAAiB,KACtC,OAAO,gBAAgB,MAAM,CAAC,eAAe,YAAY,IAAI,UAAU,CAAC,KACxE,OAAO,kBAAkB,MAAM,CAAC,eAAe,YAAY,IAAI,UAAU,CAAC;AAE9E;AAEA,SAAS,cAAc,OAA6C;AAClE,QAAM,QAAQ;AAAA,IACZ,MAAM,QAAQ;AAAA,IACd,MAAM,QAAQ;AAAA,IACd,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,EACf,EAAE,OAAO,CAAC,UAA2B,UAAU,IAAI;AACnD,SACE,MAAM,MAAM,CAAC,UAAU,aAAa,KAAK,KAAK,CAAC,KAC/C,OAAO,cAAc,MAAM,OAAO,OAAO,KACzC,MAAM,OAAO,UAAU,KACvB,OAAO,MAAM,OAAO,cAAc,YAClC,MAAM,QAAQ,MAAM,OAAO,MAAM,KACjC,MAAM,OAAO,OAAO,MAAM,CAAC,UAAU,OAAO,UAAU,QAAQ,MAC7D,MAAM,OAAO,eAAe,UAC3B,MAAM,OAAO,eAAe,QAC5B,OAAO,MAAM,OAAO,eAAe,aACrC,OAAO,MAAM,aAAa,iBAAiB,YAC3C,YAAY,IAAI,MAAM,aAAa,UAAU,KAC7C,gBAAgB,IAAI,MAAM,aAAa,SAAS,KAChD,aAAa,IAAI,MAAM,OAAO,IAAI,KAClC,QAAQ,IAAI,MAAM,OAAO,MAAM,KAC/B,UAAU,IAAI,MAAM,aAAa,QAAQ,KACzC,YAAY,IAAI,MAAM,OAAO,SAAS,KACtC,gBAAgB,IAAI,MAAM,OAAO,MAAM,KACvC,aAAa,IAAI,MAAM,OAAO,IAAI;AAEtC;AAEA,SAAS,iBACP,OACsD;AACtD,QAAM,MAAM,KAAK,MAAM,MAAM,QAAQ,GAAG;AACxC,QAAM,aAAa,KAAK,MAAM,MAAM,OAAO,UAAU;AACrD,QAAM,YAAY,KAAK,MAAM,MAAM,OAAO,SAAS;AACnD,QAAM,aAAa,MAAM,OAAO,eAAe,OAAO,OAAO,KAAK,MAAM,MAAM,OAAO,UAAU;AAC/F,MACE,CAAC,OAAO,SAAS,GAAG,KACpB,CAAC,OAAO,SAAS,UAAU,KAC3B,CAAC,OAAO,SAAS,SAAS,KACzB,eAAe,QAAQ,CAAC,OAAO,SAAS,UAAU,KAClD,eAAe,QAAQ,cAAc,WACtC;AACA,WAAO;AAAA,EACT;AACA,MAAI,MAAM,UAAW,QAAO;AAC5B,MAAI,eAAe,QAAQ,OAAO,WAAY,QAAO;AACrD,SAAO;AACT;AAEA,SAAS,mBAAmB,OAA6C;AACvE,MACE,MAAM,OAAO,iBAAiB,MAAM,OAAO,MAC3C,MAAM,OAAO,mBAAmB,MAAM,OAAO,MAC7C,MAAM,OAAO,oBAAoB,MAAM,OAAO,IAC9C;AACA,WAAO;AAAA,EACT;AAEA,UAAQ,MAAM,OAAO,MAAM;AAAA,IACzB,KAAK;AACH,aACE,MAAM,OAAO,oBAAoB,QACjC,MAAM,OAAO,iBAAiB,QAC9B,MAAM,OAAO,mBAAmB;AAAA,IAEpC,KAAK;AACH,aACE,MAAM,OAAO,oBAAoB,QACjC,MAAM,OAAO,oBAAoB,MAAM,OAAO,MAC9C,MAAM,OAAO,iBAAiB,MAAM,OAAO,mBAC3C,MAAM,OAAO,mBAAmB;AAAA,IAEpC,KAAK;AACH,aACE,MAAM,OAAO,oBAAoB,QACjC,MAAM,OAAO,oBAAoB,MAAM,OAAO,MAC9C,MAAM,OAAO,mBAAmB,MAAM,OAAO;AAAA,EAEnD;AACF;AAEA,SAAS,wBAAwB,OAA6C;AAC5E,SAAO,MAAM,OAAO,SAAS,eACzB,MAAM,OAAO,WAAW,eACxB,iBAAiB,IAAI,MAAM,OAAO,MAAM;AAC9C;AAEA,SAAS,sBACP,QACA,cACgC;AAChC,QAAM,OAAO,IAAI,IAAI,OAAO,eAAe;AAC3C,QAAM,SAAS,IAAI,IAAI,OAAO,iBAAiB;AAC/C,MAAI,aAAa,cAAc,UAAU;AACvC,WAAO,KAAK,IAAI,aAAa,UAAU,KAAK,OAAO,IAAI,aAAa,UAAU,IAC1E,WACA;AAAA,EACN;AACA,MAAI,KAAK,IAAI,aAAa,UAAU,EAAG,QAAO;AAC9C,MAAI,OAAO,IAAI,aAAa,UAAU,EAAG,QAAO;AAChD,SAAO;AACT;AAEA,SAAS,mBAAmB,OAA8B;AACxD,QAAM,UAAU,MAAM,KAAK;AAC3B,QAAM,YAAY,QAAQ,YAAY;AACtC,MAAI,CAAC,aAAa,UAAU,SAAS,IAAI,sCAAuC,QAAO;AACvF,QAAM,WAAW,UAAU,MAAM,GAAG;AACpC,MAAI,SAAS,KAAK,CAAC,YAAY,CAAC,yBAAyB,KAAK,OAAO,CAAC,EAAG,QAAO;AAChF,SAAO,SAAS,KAAK,GAAG;AAC1B;AAEA,SAAS,gBACP,QACiD;AACjD,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO;AACnC,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,UAAU,MAAM,KAAK;AAC3B,UAAM,QAAQ,QAAQ,YAAY;AAClC,QACE,CAAC,yBAAyB,KAAK,KAAK,KACpC,UAAU,KAAK,IAAI,mCACnB;AACA,aAAO;AAAA,IACT;AACA,WAAO,IAAI,KAAK;AAAA,EAClB;AACA,QAAM,SAAS,CAAC,GAAG,MAAM,EAAE,KAAK;AAChC,SAAO;AAAA,IACL,QAAQ,OAAO,MAAM,GAAG,4BAA4B;AAAA,IACpD,WAAW,OAAO,SAAS;AAAA,EAC7B;AACF;AAEA,SAAS,oBACP,OACA,UAC8C;AAC9C,QAAM,YAAY,6BAA6B,aAAa,SAAS,EAAE,CAAC;AACxE,MAAI,CAAC,UAAW,QAAO,EAAE,OAAO,MAAM,WAAW,MAAM;AACvD,QAAM,UAAU,aAAa,WAAW,QAAQ;AAChD,SAAO;AAAA,IACL,OAAO,QAAQ,SAAS;AAAA,IACxB,WAAW,QAAQ;AAAA,EACrB;AACF;AAEA,SAAS,aAAa,OAAuB;AAE3C,SAAO,MACJ,QAAQ,iCAAiC,GAAG,EAC5C,QAAQ,QAAQ,GAAG,EACnB,KAAK;AACV;AAEA,SAAS,aAAa,OAAe,UAAyD;AAC5F,QAAM,QAAQ,QAAQ,OAAO,KAAK;AAClC,MAAI,MAAM,cAAc,SAAU,QAAO,EAAE,OAAO,WAAW,MAAM;AACnE,QAAM,SAAS;AACf,QAAM,cAAc,QAAQ,OAAO,MAAM;AACzC,MAAI,MAAM,KAAK,IAAI,GAAG,WAAW,YAAY,UAAU;AACvD,SAAO,MAAM,MAAM,MAAM,GAAG,IAAK,SAAU,IAAM,QAAO;AACxD,SAAO;AAAA,IACL,OAAO,GAAG,QAAQ,OAAO,MAAM,SAAS,GAAG,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,MAAM;AAAA,IACnE,WAAW;AAAA,EACb;AACF;AAEA,SAAS,UAAU,OAAuB;AACxC,SAAO,QAAQ,OAAO,KAAK,EAAE;AAC/B;AAEA,SAAS,OAAO,QAA4E;AAC1F,SAAO,EAAE,UAAU,OAAO,OAAO;AACnC;;;AErbA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAUK;AAmBP,eAAsB,wCACpB,IACA,OACA,aACA,UAC+F;AAC/F,SAAO,MAAM,iBAAiB,IAAI,MAAM,aAAa,OAAO,aAAa;AACvE,UAAM,SAAS,MAAM,oBAAoB,UAAU,OAAO,QAAQ;AAClE,UAAM,mBAAmB,cACrB,MAAM,2BAA2B,UAAU,OAAO,QAAQ,WAAW,IACrE,EAAE,UAAU,MAAM,SAAS,KAAK;AACpC,WAAO,EAAE,GAAG,QAAQ,iBAAiB;AAAA,EACvC,CAAC;AACH;AAEA,eAAsB,2CACpB,IACA,OACA,aACA,UAGA;AACA,SAAO,MAAM,iBAAiB,IAAI,MAAM,aAAa,OAAO,aAAa;AACvE,UAAM,SAAS,MAAM,uBAAuB,UAAU,OAAO,QAAQ;AACrE,QAAI,CAAC,eAAe,OAAO,WAAW,gBAAgB,CAAC,OAAO,aAAa;AACzE,aAAO,EAAE,GAAG,QAAQ,kBAAkB,EAAE,UAAU,MAAM,SAAS,KAAK,EAAE;AAAA,IAC1E;AACA,UAAM,cAAc,MAAM,iBAAiB,UAAU,MAAM,aAAa,OAAO,YAAY,EAAE;AAC7F,UAAM,mBAAmB,MAAM,mBAAmB,UAAU;AAAA,MAC1D,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,iBAAiB,OAAO,OAAO;AAAA,MAC/B,YAAY,OAAO,YAAY;AAAA,MAC/B;AAAA,IACF,CAAC;AACD,WAAO,EAAE,GAAG,QAAQ,iBAAiB;AAAA,EACvC,CAAC;AACH;AAEA,eAAe,2BACb,IACA,OACA,QACA,aAC6C;AAC7C,MAAI,OAAO,WAAY,OAAO,WAAW,CAAC,OAAO,YAAa;AAC5D,WAAO,EAAE,UAAU,MAAM,SAAS,KAAK;AAAA,EACzC;AAEA,MAAI,OAAO,YAAY;AACrB,UAAM,cAAc,MAAM,iBAAiB,IAAI,MAAM,aAAa,OAAO,OAAO,EAAE;AAClF,QAAI,YAAY,iBAAiB,OAAO,WAAW,IAAI;AACrD,aAAO,MAAM,mBAAmB,IAAI;AAAA,QAClC,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,iBAAiB,OAAO,WAAW;AAAA,QACnC,YAAY,OAAO,OAAO;AAAA,QAC1B;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,UAAU,MAAM,iBAAiB,IAAI,MAAM,aAAa,OAAO,WAAW,EAAE;AAClF,WAAO,MAAM,mBAAmB,IAAI;AAAA,MAClC,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,iBAAiB,OAAO,OAAO;AAAA,MAC/B,YAAY,OAAO,WAAW;AAAA,MAC9B;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,UAAU,MAAM,iBAAiB,IAAI,MAAM,aAAa,OAAO,OAAO,EAAE;AAC9E,SAAO,MAAM,mBAAmB,IAAI;AAAA,IAClC,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,iBAAiB;AAAA,IACjB,YAAY,OAAO,OAAO;AAAA,IAC1B;AAAA,EACF,CAAC;AACH;AAEA,eAAe,mBACb,IACA,OAS6C;AAC7C,QAAM,gBAAgB,MAAM,8CAA8C,IAAI,MAAM,WAAW;AAC/F,QAAM,WAAW,+BAA+B;AAAA,IAC9C,SAAS;AAAA,MACP,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,KAAK,MAAM;AAAA,IACb;AAAA,IACA,QAAQ,gBACJ;AAAA,MACE,SAAS,cAAc;AAAA,MACvB,iBAAiB,cAAc;AAAA,MAC/B,mBAAmB,cAAc;AAAA,IACnC,IACA;AAAA,IACJ,QAAQ;AAAA,MACN,YAAY;AAAA,MACZ,WAAW,MAAM,SAAS;AAAA,MAC1B,aAAa,MAAM,SAAS;AAAA,MAC5B,IAAI,MAAM,SAAS;AAAA,MACnB,SAAS,MAAM,SAAS;AAAA,MACxB,QAAQ,MAAM,SAAS;AAAA,MAGvB,MAAM,MAAM,SAAS;AAAA,MAGrB,WAAW,MAAM,SAAS;AAAA,MAG1B,WAAW,MAAM,SAAS;AAAA,MAC1B,QAAQ,MAAM,SAAS;AAAA,MACvB,WAAW,MAAM,SAAS;AAAA,MAC1B,YAAY,MAAM,SAAS;AAAA,MAC3B,cAAc,MAAM,SAAS;AAAA,MAC7B,gBAAgB,MAAM,SAAS;AAAA,IACjC;AAAA,IACA,QAAQ;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,iBAAiB,MAAM;AAAA,MACvB,YAAY,MAAM;AAAA,MAClB,QAAQ,MAAM,YAAY,UAAU;AAAA,MACpC,YAAY,MAAM,YAAY,cAAc;AAAA,IAC9C;AAAA,IACA,cAAc,MAAM,YAAY;AAAA,EAClC,CAAC;AACD,MAAI,CAAC,SAAS,SAAU,QAAO,EAAE,UAAU,SAAS,KAAK;AAEzD,QAAM,UAAU,MAAM,8BAA8B,IAAI;AAAA,IACtD,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,YAAY;AAAA,IACZ,UAAU,MAAM,SAAS;AAAA,IACzB,eAAe,OAAO,MAAM,SAAS,OAAO;AAAA,IAC5C,sBAAsB,SAAS;AAAA,IAC/B,YAAY,SAAS;AAAA,IACrB,YAAY,SAAS,WAAW;AAAA,IAChC,cAAc,SAAS;AAAA,IACvB,OAAO,MAAM,YAAY;AAAA,EAC3B,CAAC;AACD,SAAO,EAAE,UAAU,QAAQ;AAC7B;AAEA,eAAe,iBAAiB,IAAc,aAAqB,UAAkB;AACnF,QAAM,WAAW,MAAM,2CAA2C,IAAI,aAAa,QAAQ;AAC3F,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,2DAA2D;AAC1F,SAAO;AACT;;;AC3MA;AAAA,EACE,iCAAAE;AAAA,EACA,iDAAAC;AAAA,OAGK;AAiFP,eAAsB,qCACpB,IACA,SACgD;AAChD,QAAM,EAAE,SAAS,SAAAC,SAAQ,IAAI;AAC7B,MAAI,QAAQ,OAAOA,SAAQ,aAAa,QAAQ,cAAcA,SAAQ,WAAW;AAC/E,WAAO,EAAE,MAAM,qBAAqB,SAAS,KAAK;AAAA,EACpD;AACA,MAAIA,SAAQ,SAAS,OAAO,SAAS,aAAa;AAChD,WAAO,EAAE,MAAM,wBAAwB,SAAS,KAAK;AAAA,EACvD;AACA,MACE,QAAQ,QAAQ,cAAc,WAC9B,QAAQ,QAAQ,SAAS,KAAK,CAAC,aAAa,SAAS,SAAS,WAAW,GACzE;AAGA,WAAO,EAAE,MAAM,gCAAgC,SAAS,KAAK;AAAA,EAC/D;AAEA,QAAM,aAAa,+BAA+B,OAAO;AACzD,MAAI,CAAC,WAAY,QAAO,EAAE,MAAM,oBAAoB,SAAS,KAAK;AAClE,QAAM,aAAa,0BAA0B,OAAO;AACpD,QAAM,gBAAgB,MAAMC;AAAA,IAC1B;AAAA,IACA,QAAQ;AAAA,EACV;AACA,QAAM,eAAe,eAAe,gBAAgB,SAAS,UAAU,IACnE,SACA,eAAe,kBAAkB,SAAS,UAAU,IAClD,WACA;AACN,MAAI,CAAC,eAAe,WAAW,CAAC,cAAc;AAC5C,WAAO,EAAE,MAAM,gBAAgB,SAAS,KAAK;AAAA,EAC/C;AAEA,QAAM,UAAU,MAAMC,+BAA8B,IAAI;AAAA,IACtD,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,YAAY;AAAA,IACZ,UAAUF,SAAQ;AAAA,IAClB,eAAeA,SAAQ;AAAA,IACvB,sBAAsB,oBAAoBA,SAAQ,SAAS;AAAA,IAC3D;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO;AAAA,MACL,MAAM,QAAQ,MAAM;AAAA,MACpB,WAAW,QAAQ,MAAM;AAAA,MACzB,0BAA0B,QAAQ;AAAA,MAClC,WAAW,QAAQ;AAAA,MACnB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF,CAAC;AACD,SAAO,EAAE,MAAM,YAAY,QAAQ;AACrC;AAEO,SAAS,0BACd,SAC8B;AAC9B,MAAI,QAAQ,QAAQ,YAAY,YAAY,QAAQ,QAAQ,YAAY,eAAe;AACrF,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,QAAQ,YAAY,UAAU,QAAQ,QAAQ,YAAY,0BAA0B;AAC9F,WAAO;AAAA,EACT;AACA,MACE,QAAQ,QAAQ,QAAQ,cAAc,WACtC,CAAC,YAAY,qBAAqB,+BAA+B,gBAAgB,EAAE;AAAA,IACjF,QAAQ,QAAQ,QAAQ,QAAQ;AAAA,EAClC,GACA;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,+BACd,SACuC;AACvC,QAAM,UAAU,uBAAuB,OAAO;AAC9C,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO;AAAA,IACL;AAAA,IACA,SAAS,QAAQ,QAAQ;AAAA,IACzB,cAAc,QAAQ,QAAQ,SAAS;AAAA,IACvC,aAAa,4BAA4B,QAAQ,QAAQ,SAAS,aAAa,GAAG;AAAA,IAClF,WAAW,QAAQ,QAAQ,SAAS;AAAA,IACpC,UAAU,QAAQ,QAAQ,WACtB;AAAA,MACE,SAAS,QAAQ,QAAQ,SAAS;AAAA,MAClC,IAAI,QAAQ,QAAQ,SAAS;AAAA,MAC7B,SAAS,QAAQ,QAAQ,SAAS;AAAA,MAClC,QAAQ,QAAQ,QAAQ,SAAS;AAAA,IACnC,IACA;AAAA,IACJ,YAAY,QAAQ,QAAQ;AAAA,EAC9B;AACF;AAEA,SAAS,uBAAuB,SAAqD;AACnF,MAAI,QAAQ,QAAQ,QAAQ,cAAc,YAAY;AACpD,UAAM,cACJ,4BAA4B,QAAQ,QAAQ,SAAS,aAAa,GAAG,KACrE;AACF,WAAO,6CAA6C,WAAW;AAAA,EACjE;AACA,QAAM,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,SAAS,QAAQ,QAAQ,GAAG,EAAE,KAAK;AACnF,SAAO,UAAU,6BAA6B,OAAO,EAAE,MAAM,GAAG,GAAG,IAAI;AACzE;AAEA,SAAS,4BAA4B,OAAsB,UAAiC;AAC1F,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,YAAY,6BAA6B,MAAM,QAAQ,QAAQ,GAAG,EAAE,KAAK,CAAC;AAChF,SAAO,YAAY,UAAU,MAAM,GAAG,QAAQ,IAAI;AACpD;;;ACzMA;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EAGE;AAAA,EACA;AAAA,OACK;AA2CP,SAAS,OAAO,OAAgB,MAAuC;AACrE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,UAAM,IAAI,MAAM,GAAG,IAAI,oBAAoB;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAgB,MAAsB;AAC5D,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,MAAM,GAAG,IAAI,6BAA6B;AAAA,EACtD;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAgB,MAA6B;AACnE,MAAI,UAAU,KAAM,QAAO;AAC3B,SAAO,eAAe,OAAO,IAAI;AACnC;AAEA,SAAS,UAAU,OAA+C;AAChE,MAAI,UAAU,WAAW,UAAU,WAAW,UAAU,UAAW,QAAO;AAC1E,QAAM,IAAI,MAAM,gDAAgD;AAClE;AAEA,SAAS,aAAa,OAAgB;AACpC,QAAM,UAAU,OAAO,OAAO,0BAA0B;AACxD,QAAM,QAAQ,OAAO,QAAQ,OAAO,wBAAwB;AAC5D,SAAO;AAAA,IACL,IAAI,eAAe,QAAQ,IAAI,6BAA6B;AAAA,IAC5D,WAAW,eAAe,QAAQ,WAAW,6BAA6B;AAAA,IAC1E,aAAa,eAAe,QAAQ,aAAa,+BAA+B;AAAA,IAChF,OAAO;AAAA,MACL,MAAM,UAAU,MAAM,IAAI;AAAA,MAC1B,WAAW,eAAe,MAAM,WAAW,gCAAgC;AAAA,IAC7E;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,OAAgB;AACvC,QAAM,QAAQ,OAAO,OAAO,wCAAwC;AACpE,QAAM,UAAU,aAAa,MAAM,OAAO;AAC1C,QAAM,UAAU,OAAO,MAAM,SAAS,gCAAgC;AACtE,QAAM,WAAW,OAAO,MAAM,UAAU,iCAAiC;AACzE,QAAM,QAAQ,OAAO,SAAS,OAAO,iCAAiC;AACtE,QAAM,UAAU,OAAO,QAAQ,SAAS,0BAA0B;AAClE,MACE,QAAQ,cAAc,WACtB,QAAQ,cAAc,QAAQ,MAC9B,QAAQ,kBAAkB,qBAC1B,SAAS,gBAAgB,WACzB,SAAS,gBAAgB,qBACzB,MAAM,SAAS,kBACd,SAAS,cAAc,YAAY,SAAS,cAAc,YAC3D;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,4BAA4B,MAAM;AAAA,IACvC,aAAa,QAAQ;AAAA,IACrB,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,gBAAgB,QAAQ,MAAM;AAAA,IAC9B,WAAW,QAAQ,MAAM;AAAA,IACzB,WAAW,SAAS;AAAA,IACpB,SAAS;AAAA,MACP,MAAM,kCAAkC,MAAM,QAAQ,IAAI;AAAA,MAC1D,SAAS,eAAe,QAAQ,SAAS,kCAAkC;AAAA,MAC3E,WAAW,eAAe,QAAQ,WAAW,qCAAqC;AAAA,IACpF;AAAA,IACA,UAAU,4BAA4B,QAAQ,EAAE;AAAA,EAClD,CAAC;AACH;AAEA,SAAS,mBAAmB,OAAgB;AAC1C,QAAM,QAAQ,OAAO,OAAO,2CAA2C;AACvE,QAAM,UAAU,aAAa,MAAM,OAAO;AAC1C,QAAM,gBAAgB,aAAa,MAAM,aAAa;AACtD,QAAM,gBAAgB,OAAO,MAAM,eAAe,iCAAiC;AACnF,QAAM,iBAAiB;AAAA,IACrB,cAAc;AAAA,IACd;AAAA,EACF;AACA,QAAM,kBAAkB;AAAA,IACtB,cAAc;AAAA,IACd;AAAA,EACF;AACA,QAAM,gBAAgB,eAAe,MAAM,eAAe,gCAAgC;AAC1F,MACE,cAAc,cAAc,cAAc,MAC1C,eAAe,YAAY,qBAC3B,gBAAgB,cAAc,QAC9B,gBAAgB,UAAU,eAC1B;AACA,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,QAAQ,eAAe,MAAM,QAAQ,iCAAiC;AAAA,EACxE;AACF;AAEA,SAAS,cACP,QACuC;AACvC,SAAO;AAAA,IACL,SAAS;AAAA,IACT,IAAI,OAAO,SAAS;AAAA,IACpB,SAAS,OAAO,OAAO,SAAS,QAAQ;AAAA,IACxC,QAAQ,OAAO,YAAY,YAAY,WAAW;AAAA,EACpD;AACF;AAEA,SAAS,iBACP,QACuC;AACvC,MAAI,CAAC,OAAO,MAAO,OAAM,IAAI,MAAM,uDAAuD;AAC1F,SAAO;AAAA,IACL,SAAS;AAAA,IACT,IAAI,OAAO,MAAM,cAAc,OAAO,MAAM,aAAa,MAAM,OAAO,MAAM;AAAA,IAC5E,SAAS,OAAO,OAAO,MAAM,iBAAiB;AAAA,IAC9C,QAAQ,OAAO,OAAO,WAAW;AAAA,EACnC;AACF;AAGO,SAAS,2CACd,SAC+C;AAC/C,QAAM,YAAY,QAAQ,aAAa;AAAA,IACrC,OAAO;AAAA,IACP,UAAU;AAAA,EACZ;AACA,SAAO;AAAA,IACL,MAAM,MAAM,UAAU;AACpB,YAAM,QAAQ,gBAAgB,QAAQ;AACtC,YAAM,SAAS,MAAM,UAAU,MAAM,QAAQ,IAAI,KAAK;AACtD,aAAO;AAAA,QACL,SAAS,OAAO;AAAA,QAChB,UAAU,cAAc,MAAM;AAAA,QAC9B,mBAAmB,OAAO;AAAA,QAC1B,UAAU;AAAA,UACR,WAAW,OAAO,kBAAkB;AAAA,UACpC,iBAAiB;AAAA,UACjB,OAAO,OAAO;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,UAAU;AACvB,YAAM,QAAQ,mBAAmB,QAAQ;AACzC,YAAM,SAAS,MAAM,UAAU,SAAS,QAAQ,IAAI;AAAA,QAClD,aAAa,MAAM,QAAQ;AAAA,QAC3B,WAAW,MAAM,QAAQ;AAAA,QACzB,aAAa,MAAM,QAAQ;AAAA,QAC3B,gBAAgB,MAAM,QAAQ,MAAM;AAAA,QACpC,WAAW,MAAM,QAAQ,MAAM;AAAA,QAC/B,OAAO,MAAM;AAAA,QACb,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,QACL,UAAU,iBAAiB,MAAM;AAAA,QACjC,mBAAmB;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACF;;;AC5NA,SAAS,cAAAG,mBAAkB;AAUpB,IAAM,0CAA0C;AAChD,IAAM,iDAAiD;AACvD,IAAM,iDAAiD;AACvD,IAAM,mCAAmC,KAAK;AAC9C,IAAM,oCAAoC;AAC1C,IAAM,8CAA8C;AACpD,IAAM,oDAAoD;AAC1D,IAAM,4CAA4C;AAClD,IAAM,2CAA2C;AAExD,IAAM,6BAA6B;AACnC,IAAM,uBAAuB;AAC7B,IAAM,qBAAqB;AAC3B,IAAM,iBAAiB;AACvB,IAAM,uBAAuB;AAC7B,IAAM,cAAc,IAAI,YAAY;AAuP7B,SAAS,qCACd,OAC6B;AAC7B,oBAAkB,OAAO,oBAAoB;AAAA,IAC3C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,WAAW,uCAAuC,MAAM,QAAQ;AACtE,QAAM,eAAe,0CAA0C;AAAA,IAC7D;AAAA,IACA,wBAAwB,MAAM;AAAA,EAChC,CAAC;AACD,QAAM,QAAQ,2BAA2B,cAAc,MAAM,KAAK;AAClE,QAAM,QAAQ,2BAA2B,cAAc,MAAM,KAAK;AAClE,QAAM,kBAAkB,iBAAiB,UAAU,SAAS,MAAM,eAAe;AACjF,QAAM,oBAAoB,iBAAiB,UAAU,WAAW,MAAM,iBAAiB;AACvF,QAAM,aAAa,mBAAmB,MAAM,YAAY,oBAAoB;AAC5E,QAAM,SAAS,gBAAgB,MAAM,MAAM;AAC3C,QAAM,OAAO,iBAAiB,MAAM,MAAM,gBAAgB,IAAI;AAC9D,QAAM,iBAAiB,MAAM,eAAe,CAAC;AAC7C,MAAI,CAAC,MAAM,QAAQ,cAAc,EAAG,OAAM,IAAI,UAAU,sCAAsC;AAC9F,MAAI,eAAe,SAAS,mCAAmC;AAC7D,UAAM,IAAI;AAAA,MACR,4CAA4C,iCAAiC;AAAA,IAC/E;AAAA,EACF;AACA,QAAM,cAAc,OAAO;AAAA,IACzB,eAAe,IAAI,CAAC,eAAe,oBAAoB,UAAU,UAAU,CAAC;AAAA,EAC9E;AACA,OAAK,OAAO,SAAS,WAAW,OAAO,SAAS,eAAe,CAAC,QAAQ,CAAC,YAAY,QAAQ;AAC3F,UAAM,IAAI,UAAU,oEAAoE;AAAA,EAC1F;AACA,SAAO,OAAO,OAAO;AAAA,IACnB,eAAe;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,eAAe,gCAAgC,cAAc,eAAe;AAAA,IAC5E;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEO,SAAS,uCACd,OAC+B;AAC/B,SAAO,kBAAkB,KAAK;AAChC;AAEO,SAAS,0CAA0C,OAGrB;AACnC,oBAAkB,OAAO,yBAAyB,CAAC,YAAY,wBAAwB,CAAC;AACxF,SAAO;AAAA,IACL,kBAAkB,MAAM,QAAQ;AAAA,IAChC;AAAA,IACA,MAAM;AAAA,EACR;AACF;AAEO,SAAS,2BACd,cACA,OACmB;AACnB,yCAAuC,YAAY;AACnD,oBAAkB,OAAO,iBAAiB,CAAC,mBAAmB,MAAM,CAAC;AACrE,MAAI,MAAM,SAAS,WAAW,MAAM,SAAS,SAAS,MAAM,SAAS,UAAU;AAC7E,UAAM,IAAI,UAAU,mCAAmC;AAAA,EACzD;AACA,QAAM,kBAAkB,iBAAiB,aAAa,UAAU,SAAS,MAAM,eAAe;AAC9F,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,UAAU,gCAAgC,cAAc,eAAe;AAAA,EACzE,CAAC;AACH;AAEO,SAAS,2BACd,cACA,OACmB;AACnB,yCAAuC,YAAY;AACnD,oBAAkB,OAAO,iBAAiB,CAAC,0BAA0B,kBAAkB,CAAC;AACxF,QAAM,yBAAyB;AAAA,IAC7B,aAAa;AAAA,IACb;AAAA,IACA,MAAM;AAAA,EACR;AACA,QAAM,mBACJ,MAAM,qBAAqB,UAAa,MAAM,qBAAqB,OAC/D,OACA,iBAAiB,aAAa,UAAU,UAAU,MAAM,gBAAgB;AAC9E,QAAM,WAAW;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,OAAO,OAAO,EAAE,cAAc,wBAAwB,kBAAkB,SAAS,CAAC;AAC3F;AAEO,SAAS,qCACd,OAC6B;AAC7B,QAAM,OACJ,MAAM,SAAS,SACX,CAAC,QAAQ,uBAAuB,gBAAgB,SAAS,MAAM,IAC/D,MAAM,SAAS,WACb;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IACA,CAAC,QAAQ,uBAAuB,gBAAgB,SAAS,yBAAyB;AAC1F,oBAAkB,OAAO,oBAAoB,IAAI;AACjD,MAAI,MAAM,SAAS,UAAU,MAAM,SAAS,YAAY,MAAM,SAAS,UAAU;AAC/E,UAAM,IAAI,UAAU,sCAAsC;AAAA,EAC5D;AACA,yCAAuC,MAAM,YAAY;AACzD,0BAAwB,MAAM,KAAK;AACnC,yBAAuB,MAAM,cAAc,MAAM,MAAM,cAAc,gBAAgB;AACrF,QAAM,sBAAsB;AAAA,IAC1B,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACA,QAAM,cAAc,oCAAoC,MAAM,cAAc,mBAAmB;AAC/F,QAAM,0BACJ,MAAM,SAAS,SACX,OACA,iBAAiB,MAAM,aAAa,UAAU,WAAW,MAAM,uBAAuB;AAC5F,QAAM,OACJ,MAAM,SAAS,WAAW,OAAO,iBAAiB,MAAM,MAAM,iBAAiB,KAAK;AACtF,QAAM,gBAAgB,sBAAsB;AAAA,IAC1C,MAAM,MAAM;AAAA,IACZ,cAAc,MAAM;AAAA,IACpB,OAAO,MAAM;AAAA,IACb;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO,OAAO,OAAO;AAAA,IACnB,eAAe;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc,MAAM;AAAA,IACpB,OAAO,MAAM;AAAA,IACb,MAAM,MAAM;AAAA,IACZ;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEO,SAAS,qCACd,OAC6B;AAC7B,oBAAkB,OAAO,oBAAoB;AAAA,IAC3C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,oCAAkC,MAAM,OAAO;AAC/C,QAAM,oBAAoB;AAAA,IACxB,MAAM,QAAQ,aAAa;AAAA,IAC3B;AAAA,IACA,MAAM;AAAA,EACR;AACA,MACE,MAAM,QAAQ,2BACd,kBAAkB,UAAU,MAAM,QAAQ,wBAAwB,OAClE;AACA,UAAM,IAAI,UAAU,6DAA6D;AAAA,EACnF;AACA,QAAM,oBACJ,MAAM,sBAAsB,UAAa,MAAM,sBAAsB,OACjE,OACA,iBAAiB,MAAM,QAAQ,aAAa,UAAU,WAAW,MAAM,iBAAiB;AAC9F,SAAO,OAAO,OAAO;AAAA,IACnB,eAAe;AAAA,IACf,aAAa,MAAM,QAAQ;AAAA,IAC3B,eAAe,MAAM,QAAQ;AAAA,IAC7B,cAAc,MAAM,QAAQ;AAAA,IAC5B;AAAA,IACA;AAAA,IACA,YAAY,mBAAmB,MAAM,YAAY,6BAA6B;AAAA,EAChF,CAAC;AACH;AAEO,SAAS,qCACd,OAC6B;AAC7B,MAAI,MAAM,WAAW,WAAW;AAC9B,sBAAkB,OAAO,oBAAoB,CAAC,UAAU,SAAS,CAAC;AAClE,sCAAkC,MAAM,OAAO;AAC/C,WAAO,OAAO,OAAO,EAAE,QAAQ,WAAW,SAAS,MAAM,QAAQ,CAAC;AAAA,EACpE;AACA,MAAI,MAAM,WAAW,qBAAqB;AACxC,sBAAkB,OAAO,8BAA8B,CAAC,UAAU,QAAQ,cAAc,CAAC;AACzF,UAAM,eAAe,MAAM,gBAAgB;AAC3C,QAAI,iBAAiB,SAAS,CAAC,OAAO,cAAc,YAAY,KAAK,eAAe,IAAI;AACtF,YAAM,IAAI,WAAW,0DAA0D;AAAA,IACjF;AACA,WAAO,OAAO,OAAO;AAAA,MACnB,QAAQ;AAAA,MACR,MAAM,YAAY,MAAM,IAAI;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH;AACA,MACE,MAAM,WAAW,iBACjB,MAAM,WAAW,aACjB,MAAM,WAAW,qBACjB;AACA,UAAM,IAAI,UAAU,wCAAwC;AAAA,EAC9D;AACA,oBAAkB,OAAO,oBAAoB,CAAC,UAAU,MAAM,CAAC;AAC/D,SAAO,OAAO,OAAO,EAAE,QAAQ,MAAM,QAAQ,MAAM,YAAY,MAAM,IAAI,EAAE,CAAC;AAC9E;AAEO,SAAS,+BACd,SACgC;AAChC,oCAAkC,OAAO;AACzC,MAAI,QAAQ,WAAW,UAAW,QAAO;AACzC,MAAI,QAAQ,WAAW,iBAAiB,QAAQ,WAAW,qBAAqB;AAC9E,WAAO;AAAA,EACT;AACA,SAAO,QAAQ,WAAW,YAAY,aAAa;AACrD;AAEO,SAAS,mCACd,SAC0F;AAC1F,QAAM,SAAS,+BAA+B,OAAO;AACrD,MAAI,WAAW,uBAAwB;AACvC,MAAI,WAAW,aAAa;AAC1B,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,QAAM,IAAI,MAAM,oBAAoB,QAAQ,MAAM,qBAAqB;AACzE;AAEO,SAAS,yCACd,UACA,WACM;AACN,oCAAkC,QAAQ;AAC1C,oCAAkC,SAAS;AAC3C,MAAI,SAAS,gBAAgB,UAAU,aAAa;AAClD,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AACA,MAAI,SAAS,kBAAkB,UAAU,eAAe;AACtD,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACF;AAEO,SAAS,kCACd,OAC8C;AAC9C,oBAAkB,OAAO,+BAA+B;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,MAAM,kBAAkB,yCAAyC;AACnE,UAAM,IAAI,UAAU,gDAAgD;AAAA,EACtE;AACA,yCAAuC,MAAM,YAAY;AACzD,0BAAwB,MAAM,KAAK;AACnC,0BAAwB,MAAM,KAAK;AACnC,yBAAuB,MAAM,iBAAiB,OAAO;AACrD,yBAAuB,MAAM,mBAAmB,SAAS;AACzD,yBAAuB,MAAM,cAAc,MAAM,MAAM,cAAc,eAAe;AACpF,yBAAuB,MAAM,cAAc,MAAM,MAAM,cAAc,eAAe;AACpF,qBAAmB,MAAM,aAAa,UAAU,MAAM,gBAAgB,UAAU,UAAU;AAC1F,qBAAmB,MAAM,aAAa,UAAU,MAAM,kBAAkB,UAAU,YAAY;AAC9F,QAAM,wBAAwB;AAAA,IAC5B,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACA,MAAI,MAAM,kBAAkB,uBAAuB;AACjD,UAAM,IAAI,UAAU,yCAAyC;AAAA,EAC/D;AACA,qBAAmB,MAAM,YAAY,oBAAoB;AACzD,QAAM,SAAS,gBAAgB,MAAM,MAAM;AAC3C,QAAM,OAAO,iBAAiB,MAAM,MAAM,gBAAgB,IAAI;AAC9D,MAAI,CAAC,MAAM,QAAQ,MAAM,WAAW;AAClC,UAAM,IAAI,UAAU,sCAAsC;AAC5D,MAAI,MAAM,YAAY,SAAS,mCAAmC;AAChE,UAAM,IAAI,WAAW,qDAAqD;AAAA,EAC5E;AACA,aAAW,cAAc,MAAM,aAAa;AAC1C,0CAAsC,UAAU;AAChD;AAAA,MACE,MAAM,aAAa;AAAA,MACnB,WAAW,qBAAqB;AAAA,MAChC;AAAA,IACF;AAAA,EACF;AACA,OACG,OAAO,SAAS,WAAW,OAAO,SAAS,eAC5C,CAAC,QACD,CAAC,MAAM,YAAY,QACnB;AACA,UAAM,IAAI,UAAU,oEAAoE;AAAA,EAC1F;AACF;AAEO,SAAS,kCACd,OAC8C;AAC9C,oBAAkB,OAAO,+BAA+B;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,MAAM,kBAAkB,yCAAyC;AACnE,UAAM,IAAI,UAAU,gDAAgD;AAAA,EACtE;AACA,MAAI,MAAM,SAAS,UAAU,MAAM,SAAS,YAAY,MAAM,SAAS,UAAU;AAC/E,UAAM,IAAI,UAAU,sCAAsC;AAAA,EAC5D;AACA,yCAAuC,MAAM,YAAY;AACzD,0BAAwB,MAAM,KAAK;AACnC,yBAAuB,MAAM,cAAc,MAAM,MAAM,cAAc,gBAAgB;AACrF,QAAM,sBAAsB;AAAA,IAC1B,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACA,MACE,MAAM,gBACN,oCAAoC,MAAM,cAAc,mBAAmB,GAC3E;AACA,UAAM,IAAI,UAAU,8CAA8C;AAAA,EACpE;AACA,MAAI;AACJ,MAAI;AACJ,MAAI,MAAM,SAAS,QAAQ;AACzB,QAAI,MAAM,4BAA4B,MAAM;AAC1C,YAAM,IAAI,UAAU,4CAA4C;AAAA,IAClE;AACA,aAAS;AACT,WAAO,iBAAiB,MAAM,MAAM,iBAAiB,KAAK;AAAA,EAC5D,OAAO;AACL,2BAAuB,MAAM,yBAAyB,SAAS;AAC/D,aAAS,MAAM;AACf,uBAAmB,MAAM,aAAa,UAAU,OAAO,UAAU,iBAAiB;AAClF,QAAI,MAAM,SAAS,UAAU;AAC3B,UAAI,MAAM,SAAS,KAAM,OAAM,IAAI,UAAU,kCAAkC;AAC/E,aAAO;AAAA,IACT,OAAO;AACL,aAAO,iBAAiB,MAAM,MAAM,iBAAiB,KAAK;AAAA,IAC5D;AAAA,EACF;AACA,QAAM,iBAAiB,sBAAsB;AAAA,IAC3C,MAAM,MAAM;AAAA,IACZ,cAAc,MAAM;AAAA,IACpB,OAAO,MAAM;AAAA,IACb,yBAAyB;AAAA,IACzB;AAAA,EACF,CAAC;AACD,MAAI,MAAM,kBAAkB,gBAAgB;AAC1C,UAAM,IAAI,UAAU,0CAA0C;AAAA,EAChE;AACF;AAEO,SAAS,kCACd,OAC8C;AAC9C,oBAAkB,OAAO,+BAA+B;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,MAAM,kBAAkB,yCAAyC;AACnE,UAAM,IAAI,UAAU,gDAAgD;AAAA,EACtE;AACA,iBAAe,MAAM,aAAa,yBAAyB,+BAA+B;AAC1F,iBAAe,MAAM,eAAe,0BAA0B,iCAAiC;AAC/F,yCAAuC,MAAM,YAAY;AACzD,yBAAuB,MAAM,mBAAmB,SAAS;AACzD;AAAA,IACE,MAAM,aAAa;AAAA,IACnB,MAAM,kBAAkB;AAAA,IACxB;AAAA,EACF;AACA,MAAI,MAAM,sBAAsB,MAAM;AACpC,2BAAuB,MAAM,mBAAmB,SAAS;AACzD;AAAA,MACE,MAAM,aAAa;AAAA,MACnB,MAAM,kBAAkB;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AACA,qBAAmB,MAAM,YAAY,6BAA6B;AACpE;AAEO,SAAS,kCACd,OAC8C;AAC9C,uCAAqC,KAAyC;AAChF;AAEO,SAAS,yCACd,UACQ;AACR,oCAAkC,QAAQ;AAC1C,SAAO,KAAK,UAAU;AAAA,IACpB,eAAe,SAAS;AAAA,IACxB,cAAc,eAAe,SAAS,YAAY;AAAA,IAClD,OAAO,UAAU,SAAS,KAAK;AAAA,IAC/B,OAAO,UAAU,SAAS,KAAK;AAAA,IAC/B,iBAAiB,eAAe,SAAS,eAAe;AAAA,IACxD,mBAAmB,eAAe,SAAS,iBAAiB;AAAA,IAC5D,eAAe,SAAS;AAAA,IACxB,YAAY,SAAS;AAAA,IACrB,QAAQ,WAAW,SAAS,MAAM;AAAA,IAClC,MAAM,SAAS;AAAA,IACf,aAAa,SAAS,YAAY,IAAI,cAAc;AAAA,EACtD,CAAC;AACH;AAEO,SAAS,yCACd,SACQ;AACR,oCAAkC,OAAO;AACzC,SAAO,KAAK,UAAU,oBAAoB,OAAO,CAAC;AACpD;AAEO,SAAS,yCACdC,UACQ;AACR,oCAAkCA,QAAO;AACzC,SAAO,KAAK,UAAU,oBAAoBA,QAAO,CAAC;AACpD;AAEO,SAAS,yCACd,SACQ;AACR,oCAAkC,OAAO;AACzC,MAAI,QAAQ,WAAW,WAAW;AAChC,WAAO,KAAK,UAAU,EAAE,QAAQ,WAAW,SAAS,oBAAoB,QAAQ,OAAO,EAAE,CAAC;AAAA,EAC5F;AACA,MAAI,QAAQ,WAAW,qBAAqB;AAC1C,WAAO,KAAK,UAAU;AAAA,MACpB,QAAQ,QAAQ;AAAA,MAChB,MAAM,QAAQ;AAAA,MACd,cAAc,QAAQ;AAAA,IACxB,CAAC;AAAA,EACH;AACA,SAAO,KAAK,UAAU,EAAE,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,KAAK,CAAC;AACtE;AAEA,SAAS,gBAAgB,OAAoC;AAC3D,oBAAkB,OAAO,uBAAuB,CAAC,QAAQ,SAAS,CAAC;AACnE,MAAI,MAAM,SAAS,WAAW,MAAM,SAAS,YAAY;AACvD,sBAAkB,OAAO,uBAAuB,CAAC,MAAM,CAAC;AACxD,WAAO,OAAO,OAAO,EAAE,MAAM,MAAM,KAAK,CAAC;AAAA,EAC3C;AACA,MAAI,MAAM,SAAS,WAAW;AAC5B,sBAAkB,OAAO,+BAA+B,CAAC,QAAQ,SAAS,CAAC;AAC3E,QAAI,MAAM,YAAY,UAAU,MAAM,YAAY,UAAU;AAC1D,YAAM,IAAI,UAAU,4CAA4C;AAAA,IAClE;AACA,WAAO,OAAO,OAAO,EAAE,MAAM,WAAW,SAAS,MAAM,QAAQ,CAAC;AAAA,EAClE;AACA,QAAM,IAAI,UAAU,oCAAoC;AAC1D;AAEA,SAAS,oBACP,UACA,OACiC;AACjC,oBAAkB,OAAO,wBAAwB;AAAA,IAC/C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,MACE,qBAAqB,KAAK,MAAM,oBAAoB,KACpD,MAAM,qBAAqB,WAAW,IAAI,GAC1C;AACA,UAAM,IAAI,UAAU,oDAAoD;AAAA,EAC1E;AACA,QAAM,uBAAuB,iBAAiB,UAAU,cAAc,MAAM,oBAAoB;AAChG,QAAM,WAAW;AAAA,IACf,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACA,MAAI,UAAU,SAAS,GAAG,KAAK,UAAU,SAAS,IAAI,GAAG;AACvD,UAAM,IAAI,UAAU,6CAA6C;AAAA,EACnE;AACA,QAAM,YAAY;AAAA,IAChB,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACA,MAAI,cAAc,QAAQ,CAAC,mBAAmB,KAAK,SAAS,GAAG;AAC7D,UAAM,IAAI,UAAU,iCAAiC;AAAA,EACvD;AACA,QAAM,WAAW,MAAM,YAAY;AACnC,MAAI,aAAa,SAAS,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,IAAI;AAC1E,UAAM,IAAI,WAAW,iEAAiE;AAAA,EACxF;AACA,QAAM,gBAAgB,MAAM,iBAAiB;AAC7C,MAAI,kBAAkB,QAAQ,CAAC,eAAe,KAAK,aAAa,GAAG;AACjE,UAAM,IAAI,UAAU,sEAAsE;AAAA,EAC5F;AACA,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,SAAS,kBAAkB,OAA8C;AACvE,QAAM,UAAU;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,2BAA2B,KAAK,OAAO,GAAG;AAC7C,UAAM,IAAI,UAAU,yDAAyD;AAAA,EAC/E;AACA,SAAO;AACT;AAEA,SAAS,iBACP,UACA,MACA,OACqC;AACrC,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA,OAAO;AAAA,MACL;AAAA,MACA,YAAY,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,gCACP,cACA,iBAC2B;AAC3B,SAAO,SAAS,UAAU,kCAAkC;AAAA,IAC1D,aAAa;AAAA,IACb,aAAa;AAAA,IACb,gBAAgB;AAAA,EAClB,CAAC,CAAC;AACJ;AAEA,SAAS,gCACP,cACA,gBACA,UAC2B;AAC3B,SAAO,SAAS,UAAU,kCAAkC;AAAA,IAC1D,aAAa;AAAA,IACb,aAAa;AAAA,IACb,eAAe;AAAA,IACf,UAAU,SAAS;AAAA,EACrB,CAAC,CAAC;AACJ;AAEA,SAAS,gCACP,cACA,SAC2B;AAC3B,SAAO,SAAS,UAAU,kCAAkC;AAAA,IAC1D,aAAa;AAAA,IACb,aAAa;AAAA,IACb,QAAQ;AAAA,EACV,CAAC,CAAC;AACJ;AAEA,SAAS,oCACP,cACA,qBAC+B;AAC/B,SAAO,SAAS,UAAU,sCAAsC;AAAA,IAC9D,aAAa;AAAA,IACb,aAAa;AAAA,IACb;AAAA,EACF,CAAC,CAAC;AACJ;AAEA,SAAS,sBAAsB,OAMD;AAC5B,SAAO,UAAUD,YAAW,QAAQ,EACjC,OAAO,+CAA+C,MAAM,EAC5D;AAAA,IACC,KAAK,UAAU;AAAA,MACb,MAAM,MAAM;AAAA,MACZ,cAAc,eAAe,MAAM,YAAY;AAAA,MAC/C,OAAO,UAAU,MAAM,KAAK;AAAA,MAC5B,yBAAyB,MAAM,0BAC3B,eAAe,MAAM,uBAAuB,IAC5C;AAAA,MACJ,MAAM,MAAM;AAAA,IACd,CAAC;AAAA,IACD;AAAA,EACF,EACC,OAAO,KAAK,CAAC;AAClB;AAEA,SAAS,UAAU,QAAgB,OAA2C;AAC5E,QAAM,OAAOA,YAAW,QAAQ;AAChC,OAAK,OAAO,QAAQ,MAAM,EAAE,OAAO,MAAM,MAAM;AAC/C,aAAW,QAAQ,OAAO;AACxB,QAAI,SAAS,MAAM;AACjB,WAAK,OAAO,MAAM,MAAM;AACxB;AAAA,IACF;AACA,UAAM,QAAQ,YAAY,OAAO,IAAI;AACrC,SAAK,OAAO,KAAK,MAAM,UAAU,KAAK,MAAM,EAAE,OAAO,KAAK;AAAA,EAC5D;AACA,SAAO,KAAK,OAAO,KAAK;AAC1B;AAEA,SAAS,uCACP,OACmD;AACnD,yBAAuB,OAAO,cAAc;AAC9C;AAEA,SAAS,wBAAwB,OAAoD;AACnF,oBAAkB,OAAO,iCAAiC;AAAA,IACxD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,yCAAuC,MAAM,YAAY;AACzD,yBAAuB,MAAM,iBAAiB,OAAO;AACrD,MAAI,MAAM,SAAS,WAAW,MAAM,SAAS,SAAS,MAAM,SAAS,UAAU;AAC7E,UAAM,IAAI,UAAU,wCAAwC;AAAA,EAC9D;AACA,qBAAmB,MAAM,aAAa,UAAU,MAAM,gBAAgB,UAAU,UAAU;AAC1F,MACE,MAAM,aAAa,gCAAgC,MAAM,cAAc,MAAM,eAAe,GAC5F;AACA,UAAM,IAAI,UAAU,8CAA8C;AAAA,EACpE;AACF;AAEA,SAAS,wBAAwB,OAAoD;AACnF,oBAAkB,OAAO,iCAAiC;AAAA,IACxD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,yCAAuC,MAAM,YAAY;AACzD,yBAAuB,MAAM,wBAAwB,cAAc;AACnE,MAAI,MAAM,qBAAqB,KAAM,wBAAuB,MAAM,kBAAkB,QAAQ;AAC5F;AAAA,IACE,MAAM,aAAa;AAAA,IACnB,MAAM,uBAAuB;AAAA,IAC7B;AAAA,EACF;AACA,MAAI,MAAM,kBAAkB;AAC1B,uBAAmB,MAAM,aAAa,UAAU,MAAM,iBAAiB,UAAU,WAAW;AAAA,EAC9F;AACA,MACE,MAAM,aACN;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR,GACA;AACA,UAAM,IAAI,UAAU,8CAA8C;AAAA,EACpE;AACF;AAEA,SAAS,sCACP,OACkD;AAClD,oBAAkB,OAAO,mCAAmC;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,yBAAuB,MAAM,sBAAsB,YAAY;AAC/D,MACE,qBAAqB,KAAK,MAAM,qBAAqB,KAAK,KAC1D,MAAM,qBAAqB,MAAM,WAAW,IAAI,GAChD;AACA,UAAM,IAAI,UAAU,oDAAoD;AAAA,EAC1E;AACA,QAAM,WAAW;AAAA,IACf,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACA,MAAI,UAAU,SAAS,GAAG,KAAK,UAAU,SAAS,IAAI,GAAG;AACvD,UAAM,IAAI,UAAU,6CAA6C;AAAA,EACnE;AACA,QAAM,YAAY;AAAA,IAChB,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACA,MAAI,cAAc,QAAQ,CAAC,mBAAmB,KAAK,SAAS,GAAG;AAC7D,UAAM,IAAI,UAAU,iCAAiC;AAAA,EACvD;AACA,QAAM,WAAW,MAAM;AACvB,MAAI,aAAa,MAAM;AACrB,QAAI,OAAO,aAAa,YAAY,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,GAAG;AACnF,YAAM,IAAI,WAAW,iEAAiE;AAAA,IACxF;AAAA,EACF;AACA,QAAM,gBAAgB,MAAM;AAC5B,MAAI,kBAAkB,MAAM;AAC1B,QAAI,OAAO,kBAAkB,YAAY,CAAC,eAAe,KAAK,aAAa,GAAG;AAC5E,YAAM,IAAI,UAAU,sEAAsE;AAAA,IAC5F;AAAA,EACF;AACF;AAEA,SAAS,uBACP,OACA,MACsD;AACtD,oBAAkB,OAAO,YAAY,IAAI,OAAO,CAAC,YAAY,QAAQ,OAAO,CAAC;AAC7E,oBAAkB,MAAM,QAAkB;AAC1C,MAAI,MAAM,SAAS,KAAM,OAAM,IAAI,UAAU,8BAA8B,IAAI,EAAE;AACjF;AAAA,IACE,MAAM;AAAA,IACN,YAAY,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,mBACP,UACA,QACA,OACM;AACN,MAAI,aAAa,OAAQ,OAAM,IAAI,UAAU,GAAG,KAAK,oCAAoC;AAC3F;AAEA,SAAS,uBACP,UACA,QACA,OACM;AACN,MAAI,SAAS,aAAa,OAAO,YAAY,SAAS,UAAU,OAAO,OAAO;AAC5E,UAAM,IAAI,UAAU,GAAG,KAAK,uCAAuC;AAAA,EACrE;AACF;AAEA,SAAS,iBAAiB,OAAgB,OAAe,YAA6B;AACpF,SAAO,cAAc,OAAO,OAAO,aAAa,IAAI,GAAG,kCAAkC,IAAI;AAC/F;AAEA,SAAS,oBAAoB,OAAgB,OAAe,UAA0B;AACpF,QAAM,SAAS,cAAc,OAAO,OAAO,GAAG,UAAU,KAAK;AAC7D,MAAI,WAAW,OAAO,KAAK;AACzB,UAAM,IAAI,UAAU,GAAG,KAAK,uCAAuC;AACrE,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAgB,OAAe,UAAiC;AAC7F,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,SAAO,cAAc,OAAO,OAAO,GAAG,UAAU,KAAK;AACvD;AAEA,SAAS,cACP,OACA,OACA,UACA,UACA,eACQ;AACR,MAAI,OAAO,UAAU,SAAU,OAAM,IAAI,UAAU,GAAG,KAAK,mBAAmB;AAC9E,MAAI,CAAC,oBAAoB,KAAK,EAAG,OAAM,IAAI,UAAU,GAAG,KAAK,8BAA8B;AAC3F,MAAI,MAAM,SAAS,IAAI,EAAG,OAAM,IAAI,UAAU,GAAG,KAAK,uBAAuB;AAC7E,MAAI,CAAC,iBAAiB,yBAAyB,KAAK,KAAK,GAAG;AAC1D,UAAM,IAAI,UAAU,GAAG,KAAK,sCAAsC;AAAA,EACpE;AACA,QAAM,aAAa,YAAY,OAAO,KAAK,EAAE;AAC7C,MAAI,aAAa,YAAY,aAAa,UAAU;AAClD,UAAM,IAAI,WAAW,GAAG,KAAK,iBAAiB,QAAQ,IAAI,QAAQ,cAAc;AAAA,EAClF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAwB;AACnD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,YAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AACvC,UAAI,EAAE,QAAQ,SAAU,QAAQ,OAAS,QAAO;AAChD,eAAS;AAAA,IACX,WAAW,QAAQ,SAAU,QAAQ,OAAQ;AAC3C,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAgB,OAAuB;AACjE,QAAM,YAAY,cAAc,OAAO,OAAO,IAAI,IAAI,KAAK;AAC3D,QAAM,eAAe,KAAK,MAAM,SAAS;AACzC,MAAI,CAAC,OAAO,SAAS,YAAY,KAAK,IAAI,KAAK,YAAY,EAAE,YAAY,MAAM,WAAW;AACxF,UAAM,IAAI,UAAU,GAAG,KAAK,oCAAoC;AAAA,EAClE;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAwB;AAC3C,QAAM,OAAO;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,qBAAqB,KAAK,IAAI,GAAG;AACpC,UAAM,IAAI,UAAU,6DAA6D;AAAA,EACnF;AACA,SAAO;AACT;AAEA,SAAS,kBACP,OACA,OACA,aAC0C;AAC1C,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,UAAM,IAAI,UAAU,GAAG,KAAK,oBAAoB;AAAA,EAClD;AACA,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,MAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,UAAM,IAAI,UAAU,GAAG,KAAK,yBAAyB;AAAA,EACvD;AACA,QAAM,UAAU,IAAI,IAAI,WAAW;AACnC,aAAW,OAAO,QAAQ,QAAQ,KAAK,GAAG;AACxC,QAAI,OAAO,QAAQ,YAAY,CAAC,QAAQ,IAAI,GAAG,GAAG;AAChD,YAAM,IAAI,UAAU,GAAG,KAAK,gCAAgC;AAAA,IAC9D;AAAA,EACF;AACF;AAEA,SAAS,eAAe,OAAgB,SAAiB,OAAwC;AAC/F,MAAI,OAAO,UAAU,YAAY,CAAC,QAAQ,KAAK,KAAK,GAAG;AACrD,UAAM,IAAI,UAAU,GAAG,KAAK,aAAa;AAAA,EAC3C;AACF;AAEA,SAAS,eACP,IACkD;AAClD,SAAO,EAAE,UAAU,GAAG,UAAU,MAAM,GAAG,MAAM,OAAO,GAAG,MAAM;AACjE;AAEA,SAAS,UAAU,OAA0B;AAC3C,SAAO;AAAA,IACL,cAAc,eAAe,MAAM,YAAY;AAAA,IAC/C,iBAAiB,eAAe,MAAM,eAAe;AAAA,IACrD,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,EAClB;AACF;AAEA,SAAS,UAAU,OAA0B;AAC3C,SAAO;AAAA,IACL,cAAc,eAAe,MAAM,YAAY;AAAA,IAC/C,wBAAwB,eAAe,MAAM,sBAAsB;AAAA,IACnE,kBAAkB,MAAM,mBAAmB,eAAe,MAAM,gBAAgB,IAAI;AAAA,IACpF,UAAU,MAAM;AAAA,EAClB;AACF;AAEA,SAAS,WAAW,QAA4B;AAC9C,SAAO,OAAO,SAAS,YACnB,EAAE,MAAM,WAAoB,SAAS,OAAO,QAAQ,IACpD,EAAE,MAAM,OAAO,KAAK;AAC1B;AAEA,SAAS,eAAe,YAA6C;AACnE,SAAO;AAAA,IACL,sBAAsB,eAAe,WAAW,oBAAoB;AAAA,IACpE,UAAU,WAAW;AAAA,IACrB,WAAW,WAAW;AAAA,IACtB,UAAU,WAAW;AAAA,IACrB,eAAe,WAAW;AAAA,EAC5B;AACF;AAEA,SAAS,oBAAoB,SAAsC;AACjE,SAAO;AAAA,IACL,eAAe,QAAQ;AAAA,IACvB,aAAa,QAAQ;AAAA,IACrB,qBAAqB,QAAQ;AAAA,IAC7B,eAAe,QAAQ;AAAA,IACvB,cAAc,eAAe,QAAQ,YAAY;AAAA,IACjD,OAAO,UAAU,QAAQ,KAAK;AAAA,IAC9B,MAAM,QAAQ;AAAA,IACd,yBAAyB,QAAQ,0BAC7B,eAAe,QAAQ,uBAAuB,IAC9C;AAAA,IACJ,MAAM,QAAQ;AAAA,EAChB;AACF;AAEA,SAAS,oBAAoBC,UAAsC;AACjE,SAAO;AAAA,IACL,eAAeA,SAAQ;AAAA,IACvB,aAAaA,SAAQ;AAAA,IACrB,eAAeA,SAAQ;AAAA,IACvB,cAAc,eAAeA,SAAQ,YAAY;AAAA,IACjD,mBAAmB,eAAeA,SAAQ,iBAAiB;AAAA,IAC3D,mBAAmBA,SAAQ,oBAAoB,eAAeA,SAAQ,iBAAiB,IAAI;AAAA,IAC3F,YAAYA,SAAQ;AAAA,EACtB;AACF;;;AChtCA,SAAS,iBAAAC,uBAAqB;AAG9B,IAAM,2BAAyC,CAAC,mBAAmB,gBAAgB;AAG5E,SAAS,oBAAoB,QAAuD;AACzF,SAAO,OAAO,YAAY,KAAK,CAAC,eAAe,yBAAyB,SAAS,UAAU,CAAC;AAC9F;AAGO,SAAS,aAAa,QAAqD;AAChF,SAAO,OAAO,UAAU,WAAW,OAAO;AAC5C;AAOO,SAAS,uBAAuB,QAA+B;AACpE,MAAI,CAAC,QAAQ;AACX,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,yBAAyB,CAAC;AAAA,EACpE;AACA,SAAO,QAAQ,MAAM;AACvB;AASO,SAAS,+BAA+B,OAItC;AACP,QAAM,EAAE,SAAS,WAAW,gBAAgB,IAAI;AAChD,MAAI,cAAc,iBAAiB;AACjC,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,wCAAwC,CAAC;AAAA,EACnF;AACA,QAAM,SAAS,QAAQ,KAAK,CAAC,WAAW,OAAO,cAAc,SAAS;AACtE,MAAI,CAAC,QAAQ;AACX,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,mBAAmB,CAAC;AAAA,EAC9D;AACA,MAAI,oBAAoB,MAAM,GAAG;AAC/B,UAAM,kBAAkB,QAAQ;AAAA,MAC9B,CAAC,WAAW,OAAO,cAAc,aAAa,oBAAoB,MAAM;AAAA,IAC1E;AACA,QAAI,gBAAgB,WAAW,GAAG;AAChC,YAAM,IAAIA,gBAAc,KAAK;AAAA,QAC3B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF;AASO,SAAS,yBAAyB,OAGhC;AACP,MAAI,MAAM,4BAA4B,GAAG;AACvC,UAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,6CAA6C,CAAC;AAAA,EACxF;AACA,MAAI,MAAM,qBAAqB,GAAG;AAChC,UAAM,IAAIA,gBAAc,KAAK;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;;;ACnFA;AAAA,EACE;AAAA,OAOK;AACP,SAAS,cAAAC,mBAAkB;AAEpB,IAAM,mCAAmC;AAwChD,IAAM,kBAAkB,oBAAI,IAAmC;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,sBAEF,OAAO,OAAO;AAAA,EAChB,WAAW,CAAC,YAAY,yBAAyB;AAAA,EACjD,UAAU,CAAC,YAAY,yBAAyB;AAAA,EAChD,UAAU,CAAC,wBAAwB,oBAAoB,yBAAyB;AAAA,EAChF,sBAAsB,CAAC,oBAAoB,iBAAiB;AAAA,EAC5D,kBAAkB,CAAC,aAAa,mBAAmB,iBAAiB;AAAA,EACpE,WAAW,CAAC,aAAa,kBAAkB;AAAA,EAC3C,WAAW,CAAC;AAAA,EACZ,iBAAiB,CAAC;AAAA,EAClB,yBAAyB,CAAC;AAAA,EAC1B,iBAAiB,CAAC;AAAA,EAClB,kBAAkB,CAAC;AACrB,CAAC;AAEM,SAAS,gCAAgC,OAIZ;AAClC,QAAM,YAAY,uBAAuB,MAAM,MAAM,SAAS;AAC9D,MAAI,UAAU,YAAY,UAAa,UAAU,YAAY,MAAM,MAAM,SAAS;AAChF,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,QAAM,aAAa,UAAU,QAAQ,QAAQ;AAC7C,MAAI,CAAC,MAAM,MAAM,YAAY,SAAS,UAAU,GAAG;AACjD,UAAM,IAAI,MAAM,gCAAgC,UAAU,iBAAiB;AAAA,EAC7E;AACA,uBAAqB,YAAY,MAAM,gBAAgB;AAEvD,QAAM,kBAAkB,UAAU,mBAAmB,MAAM,MAAM,SAAS;AAC1E,MACE,kBAAkB,MAAM,MAAM,SAAS,cACvC,kBAAkB,MAAM,MAAM,SAAS,eACtC,kBAAkB,MAAM,MAAM,SAAS,cAAc,MAAM,MAAM,SAAS,gBAAgB,GAC3F;AACA,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,QAAM,cAAc,UAAU,eAAe,MAAM,MAAM,aAAa,CAAC;AACvE,QAAM,aAAa,UAAU,cAAc,MAAM,MAAM,YAAY,CAAC;AACpE,MAAI,CAAC,eAAe,CAAC,MAAM,MAAM,aAAa,SAAS,WAAW,GAAG;AACnE,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,MAAI,CAAC,cAAc,CAAC,MAAM,MAAM,YAAY,SAAS,UAAU,GAAG;AAChE,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,QAAM,gBAAgB,UAAU,iBAAiB,MAAM,MAAM;AAC7D,MAAI,iBAAiB,CAAC,MAAM,MAAM,eAAe;AAC/C,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,SAAO,OAAO,OAAO;AAAA,IACnB,eAAe;AAAA,IACf,SAAS,MAAM,MAAM;AAAA,IACrB,QAAQ,UAAU;AAAA,IAClB;AAAA,IACA,YAAY,OAAO;AAAA,MACjB,MAAM,iBAAiB,IAAI,CAAC,cAAc,OAAO,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC;AAAA,IAC3E;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEO,SAAS,oCACd,SACQ;AACR,SAAO,KAAK,UAAU;AAAA,IACpB,eAAe,QAAQ;AAAA,IACvB,SAAS,QAAQ;AAAA,IACjB,QAAQ,QAAQ;AAAA,IAChB,YAAY,QAAQ;AAAA,IACpB,YAAY,QAAQ,WAAW,IAAI,CAAC,eAAe;AAAA,MACjD,MAAM,UAAU;AAAA,MAChB,eAAe,UAAU;AAAA,MACzB,aAAa,UAAU;AAAA,MACvB,UAAU,UAAU;AAAA,IACtB,EAAE;AAAA,IACF,iBAAiB,QAAQ;AAAA,IACzB,aAAa,QAAQ;AAAA,IACrB,YAAY,QAAQ;AAAA,IACpB,eAAe,QAAQ;AAAA,EACzB,CAAC;AACH;AAEO,SAAS,6BAA6B,SAAkD;AAC7F,SAAOC;AAAA,IACL;AAAA,IACA,oCAAoC,OAAO;AAAA,EAC7C;AACF;AAGO,SAAS,4BAA4B,OAKjC;AACT,SAAOA;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACF;AAEO,SAAS,sCAAsC,OAG3C;AACT,SAAO,SAASA;AAAA,IACd;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,EACR,EAAE,MAAM,GAAG,EAAE,CAAC;AAChB;AAEO,SAAS,kCAAkC,OAKvC;AACT,SAAOA;AAAA,IACL;AAAA,IACA,OAAO,MAAM,cAAc;AAAA,IAC3B,MAAM;AAAA,IACN,OAAO,MAAM,iBAAiB;AAAA,IAC9B,KAAK,UAAU,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK,CAAC;AAAA,IACzC;AAAA,EACF;AACF;AAEO,SAAS,gCACd,MACA,IACM;AACN,MAAI,SAAS,GAAI;AACjB,MAAI,CAAC,oBAAoB,IAAI,EAAE,SAAS,EAAE,GAAG;AAC3C,UAAM,IAAI,MAAM,uCAAuC,IAAI,OAAO,EAAE,EAAE;AAAA,EACxE;AACF;AAEO,SAAS,+BAA+B,OAA+C;AAC5F,SAAO,gBAAgB,IAAI,KAAK;AAClC;AAEA,SAAS,qBACP,YACA,YACM;AACN,QAAM,WACJ,eAAe,SACX,CAAC,IACD,eAAe,gBACb,CAAC,aAAa,IACd,eAAe,0BACb,CAAC,eAAe,YAAY,IAC5B,eAAe,oBACb,CAAC,iBAAiB,IAClB,CAAC,iBAAiB;AAC9B,MACE,WAAW,WAAW,SAAS,UAC/B,WAAW,KAAK,CAAC,WAAW,UAAU,UAAU,SAAS,SAAS,KAAK,CAAC,GACxE;AACA,UAAM,IAAI,MAAM,oDAAoD,UAAU,EAAE;AAAA,EAClF;AACA,aAAW,aAAa,YAAY;AAClC,QAAI,CAAC,kBAAkB,KAAK,UAAU,aAAa,GAAG;AACpD,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AACA,QAAI,CAAC,OAAO,cAAc,UAAU,QAAQ,KAAK,UAAU,YAAY,GAAG;AACxE,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AACA,QAAI,CAAC,UAAU,YAAY,SAAS,GAAG,GAAG;AACxC,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AAAA,EACF;AACF;AAEA,SAASA,QAAO,WAAmB,OAAyB;AAC1D,QAAM,OAAOD,YAAW,QAAQ,EAAE,OAAO,MAAM;AAC/C,aAAW,QAAQ,MAAO,MAAK,OAAO,IAAI,EAAE,OAAO,IAAI;AACvD,SAAO,KAAK,OAAO,KAAK;AAC1B;;;ACxPA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAIA,IAAM,iCACX,OAAO,OAAO;AAAA,EACZ,OAAO,OAAO;AAAA,IACZ,SAAS;AAAA,IACT,OAAO;AAAA,IACP,eAAe;AAAA,IACf,aAAa,OAAO,OAAO;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,OAAO,OAAO,CAAC,QAAQ,MAAM,CAAC;AAAA,IAC3C,cAAc,OAAO,OAAO,CAAC,QAAQ,OAAO,OAAO,OAAO,QAAQ,QAAQ,UAAU,CAAC;AAAA,IACrF,UAAU,OAAO,OAAO;AAAA,MACtB,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,aAAa;AAAA,IACf,CAAC;AAAA,IACD,eAAe;AAAA,EACjB,CAAC;AAAA,EACD,OAAO,OAAO;AAAA,IACZ,SAAS;AAAA,IACT,OAAO;AAAA,IACP,eAAe;AAAA,IACf,aAAa,OAAO,OAAO,CAAC,QAAQ,eAAe,iBAAiB,CAAC;AAAA,IACrE,aAAa,OAAO,OAAO,CAAC,QAAQ,MAAM,CAAC;AAAA,IAC3C,cAAc,OAAO,OAAO,CAAC,QAAQ,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,IACjE,UAAU,OAAO,OAAO;AAAA,MACtB,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,aAAa;AAAA,IACf,CAAC;AAAA;AAAA,IAED,eAAe;AAAA,EACjB,CAAC;AACH,CAAC;AAEI,SAAS,0CACd,SACA,eACS;AACT,SAAO,YAAY,kCACf,kBAAkB,2BAClB,YAAY,wBACV,kBAAkB,sBAAsB,kBAAkB,sBAC1D;AACR;AAEO,SAAS,+BAA0D;AACxE,SAAO,sBAAsB,MAAM;AAAA,IACjC,eAAe;AAAA,IACf,UAAU;AAAA,IACV,eAAe;AAAA,IACf,iBAAiB,CAAC;AAAA,IAClB,gBAAgB;AAAA,EAClB,CAAC;AACH;AAEO,SAAS,qCAAqC,OAGrB;AAC9B,QAAM,SAAS,sBAAsB,MAAM,MAAM,MAAM;AACvD,QAAM,UAAU,IAAI,IAAI,OAAO,eAAe;AAC9C,QAAM,SAAS,+BAA+B;AAAA,IAC5C,CAAC,UACC,QAAQ,IAAI,MAAM,OAAO,KACzB,0CAA0C,MAAM,SAAS,OAAO,aAAa;AAAA,EACjF;AACA,MAAI,OAAO,WAAW,KAAK,OAAO,mBAAmB,MAAM;AACzD,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,SAAO,4BAA4B,MAAM;AAAA,IACvC,eAAe;AAAA,IACf,oBAAoB,kCAAkC;AAAA,MACpD,gBAAgB,OAAO;AAAA,MACvB,eAAe,OAAO;AAAA,MACtB,mBAAmB,MAAM;AAAA,MACzB,UAAU,OAAO,IAAI,CAAC,UAAU,MAAM,OAAO;AAAA,IAC/C,CAAC;AAAA,IACD,gBAAgB,OAAO;AAAA,IACvB;AAAA,EACF,CAAC;AACH;AAEO,SAAS,mCAAmC,UAAmC;AACpF,QAAM,QAAQ,IAAI,IAAI,+BAA+B,IAAI,CAAC,UAAU,MAAM,OAAO,CAAC;AAClF,aAAW,WAAW,UAAU;AAC9B,QAAI,CAAC,MAAM,IAAI,OAAO,EAAG,OAAM,IAAI,MAAM,mCAAmC,OAAO,EAAE;AAAA,EACvF;AACF;;;ACvGA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA,iBAAAE;AAAA,EACA,UAAAC;AAAA,EACA,cAAAC;AAAA,EACA,kBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,yBAAAC;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iBAAAC,uBAAqB;AAe9B,SAAS,OAAO,OAAgB,KAAsB;AACpD,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,OAAO,OAAO,OAAO,GAAG;AAChF;AAEA,SAAS,mBACP,KAC6B;AAC7B,MAAI,CAAC,IAAK,QAAO;AACjB,SAAO,gBAAgB,MAAM;AAAA,IAC3B,UAAU,IAAI;AAAA,IACd,MAAM,IAAI;AAAA,IACV,WAAW,IAAI;AAAA,IACf,OAAO,6BAA6B,GAAG,IAAI,IAAI,QAAQ,CAAC;AAAA,IACxD,eAAe,6BAA6B,GAAG;AAAA,IAC/C,OAAO,IAAI;AAAA,IACX,iBAAiB,IAAI;AAAA,IACrB,aAAa,IAAI;AAAA,IACjB,SAAS,6BAA6B,GAAG;AAAA,IACzC,WAAW,IAAI,UAAU,YAAY;AAAA,EACvC,CAAC;AACH;AAEA,eAAe,uBACb,MACA,OACA,aACA,KACsC;AACtC,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,mBAAmB,GAAG;AACrC,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,kBAAkB,MAAM;AAAA,IAC5B,KAAK;AAAA,IACL;AAAA,IACA,KAAK;AAAA,IACL,EAAE,WAAW,MAAM,UAAU;AAAA,EAC/B;AACA,QAAM,YAAY,CAAC;AACnB,aAAW,YAAY,OAAO,WAAW;AACvC,QAAI,SAAS,SAAS,cAAc;AAClC,UAAI;AACF,cAAM,kCAAkC,KAAK,IAAI,aAAa,CAAC,QAAQ,CAAC;AACxE,kBAAU,KAAK,QAAQ;AAAA,MACzB,SAAS,OAAO;AACd,YAAI,8CAA8C,KAAK,GAAG;AAGxD;AAAA,QACF;AAGA,kBAAU,KAAK,QAAQ;AAAA,MACzB;AACA;AAAA,IACF;AACA,QAAI;AACF,YAAM,OAAO,MAAMC,uBAAsB,KAAK,IAAI;AAAA,QAChD,WAAW,MAAM;AAAA,QACjB;AAAA,QACA,WAAW,MAAM;AAAA,QACjB,QAAQ,SAAS;AAAA,MACnB,CAAC;AACD,UAAI,KAAK,WAAW,QAAS,WAAU,KAAK,QAAQ;AAAA,IACtD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,UAAU,EAAE,GAAG,OAAO,QAAQ;AACpC,MAAI,QAAQ,eAAe;AACzB,QACE,CAAC,cAAc,MAAM,aAAa,mBAAmB,KACrD,CAAE,MAAMC,gBAAe,KAAK,IAAI,aAAa,QAAQ,aAAa,GAClE;AACA,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AACA,MAAI,QAAQ,OAAO;AACjB,UAAM,MAAM,MAAMC,QAAO,KAAK,IAAI,aAAa,QAAQ,KAAK;AAC5D,QAAI,CAAC,KAAK,cAAe,QAAO,QAAQ;AAAA,EAC1C;AACA,MAAI,QAAQ,iBAAiB;AAC3B,UAAM,UAAU,MAAMC,YAAW,KAAK,IAAI,aAAa,QAAQ,eAAe;AAC9E,UAAM,aAAa,SAAS,eACxB,MAAMC,eAAc,KAAK,IAAI,aAAa,QAAQ,YAAY,IAC9D;AACJ,QACE,CAAC,WACD,QAAQ,SAAS,gBACjB,CAAC,cACD,WAAW,WAAW,UACtB;AACA,aAAO,QAAQ;AACf,aAAO,QAAQ;AACf,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AAEA,MAAI,QAAuC,CAAC;AAC5C,MAAI,OAAO,eAAe;AACxB,QAAI;AACF,cAAQ,iBAAiB,OAAO,OAAO,eAAe;AAAA,IACxD,QAAQ;AAGN,cAAQ,OAAO,MAAM,OAAO,CAAC,SAAS;AACpC,YAAI;AACF,2BAAiB,CAAC,IAAI,GAAG,eAAe;AACxC,iBAAO;AAAA,QACT,QAAQ;AACN,iBAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAGA,eAAsB,wBACpB,MACA,OACA,aAC+B;AAC/B,QAAM,MAAM,MAAM;AAAA,IAAwB,KAAK;AAAA,IAAI;AAAA,IAAa,MAAM;AAAA,IAAW,CAAC,WAChF,gCAAgC,QAAQ;AAAA,MACtC;AAAA,MACA,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,EACH;AACA,SACG,MAAM,uBAAuB,MAAM,OAAO,aAAa,GAAG,KAAM;AAAA,IAC/D,UAAU;AAAA,IACV,MAAM;AAAA,IACN,WAAW,CAAC;AAAA,IACZ,OAAO,CAAC;AAAA,IACR,eAAe;AAAA,IACf,OAAO,KAAK,SAAS;AAAA,IACrB,iBAAiB,KAAK,SAAS;AAAA,IAC/B,aAAa;AAAA,IACb,SAAS,CAAC;AAAA,IACV,WAAW;AAAA,EACb;AAEJ;AASA,eAAsB,yBACpB,MACA,OACA,aACA,UAC+B;AAC/B,QAAM,QAAQ,2BAA2B,MAAM,QAAQ;AAKvD,QAAM,gBAAgB,OAAO,UAAU,eAAe,IAAI,MAAM,gBAAgB;AAChF,QAAM,kBAAkB,MAAM;AAAA,IAC5B,KAAK;AAAA,IACL;AAAA,IACA,KAAK;AAAA,IACL,EAAE,WAAW,MAAM,UAAU;AAAA,EAC/B;AACA,QAAM,YAAY,mBAAmB,MAAM,SAAS;AACpD,QAAM,QAAQ,gBAAgB,iBAAiB,MAAM,OAAO,eAAe,IAAI,CAAC;AAChF,QAAM,kCAAkC,KAAK,IAAI,aAAa,SAAS;AACvE,MAAI,UAAU,KAAK,CAAC,aAAa,SAAS,SAAS,MAAM,KAAK,CAAC,KAAK,eAAe;AACjF,UAAM,IAAIC,gBAAc,KAAK,EAAE,SAAS,mCAAmC,CAAC;AAAA,EAC9E;AACA,QAAM,sBAAsB,KAAK,IAAI,MAAM,WAAW,aAAa,MAAM,WAAW,SAAS;AAC7F,wBAAsB,KAAK,UAAU,MAAM,KAAK;AAChD,QAAM,iCAAiC,KAAK,IAAI,KAAK,UAAU,aAAa,MAAM,KAAK;AAEvF,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,MAAwB,KAAK;AAAA,MAAI;AAAA,MAAa,MAAM;AAAA,MAAW,CAAC,WAClF,OAAO;AAAA,QAAY,CAAC,OAClB,iCAAiC,IAAgC;AAAA,UAC/D,WAAW,MAAM;AAAA,UACjB;AAAA,UACA,WAAW,MAAM;AAAA,UACjB,kBAAkB,MAAM;AAAA,UACxB,MAAM,MAAM;AAAA,UACZ;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO,MAAM;AAAA,UACb,iBAAiB,MAAM;AAAA,UACvB,aAAa,MAAM;AAAA,UACnB,SAAS,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,4BAA4B,MAAM,UAAU,WAAW,OAAO;AAAA,QAChE,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO,mBAAmB,KAAK;AAAA,EACjC,SAAS,OAAO;AACd,QAAI,iBAAiB,4BAA4B;AAC/C,YAAM,IAAIA,gBAAc,KAAK,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,IACzD;AACA,UAAM;AAAA,EACR;AACF;;;ACzOA;AAAA,EACE,4BAAAC;AAAA,EACA,0BAAAC;AAAA,EACA,8BAAAC;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAAC;AAAA,EACA,mBAAAC;AAAA,EACA,4BAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,uCAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,EACA,2BAAAC;AAAA,EACA,0CAAAC;AAAA,OAIK;AACP;AAAA,EACE,+BAAAC;AAAA,EACA,uCAAAC;AAAA,OAEK;AAwCP,SAAS,iBAAiB,SAAkD;AAC1E,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,WAAW,QAAQ;AAAA,IACnB,aAAa,CAAC;AAAA,EAChB;AACF;AAEA,SAAS,iBAAiB,SAAkD;AAC1E,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,WAAW,QAAQ;AAAA,IACnB,aAAa,CAAC;AAAA,IACd,UAAU;AAAA,MACR,WAAW,QAAQ;AAAA,MACnB,QAAQ,QAAQ;AAAA,MAChB,WAAW,QAAQ;AAAA,MACnB,qBAAqB,QAAQ;AAAA,IAC/B;AAAA,EACF;AACF;AAEA,eAAe,6BACb,MACA,SACA,WAC8C;AAC9C,SAAO,MAAM,4BAA4B,MAAM,iBAAiB,OAAO,GAAG;AAAA,IACxE,WAAW,QAAQ;AAAA,IACnB;AAAA,IACA,SAAS,QAAQ,wBAAwB;AAAA,EAC3C,CAAC;AACH;AAEA,eAAe,6BACb,MACA,SACA,iBACA,WAC8C;AAC9C,SAAO,MAAM,4BAA4B,MAAM,iBAAiB,OAAO,GAAG;AAAA,IACxE,WAAW;AAAA,IACX;AAAA,IACA,SAAS,QAAQ,wBAAwB;AAAA,EAC3C,CAAC;AACH;AAEA,SAAS,WAAW,SAAqC;AACvD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,QAAQ;AAAA,IACnB,QAAQ,QAAQ;AAAA,IAChB,WAAW,QAAQ;AAAA,IACnB,qBAAqB,QAAQ;AAAA,EAC/B;AACF;AAQA,eAAe,wCACb,MACA,OACA,OAKY;AACZ,SAAO,MAAMC;AAAA,IACX;AAAA,MACE,OAAO,MAAM;AAAA,MACb,YAAY,MAAM;AAAA,MAClB,aAAa;AAAA,IACf;AAAA,IACA,YAAY;AACV,YAAM,MAAM,OAAO,WAAoC,MAAM,MAAM,YAAY,MAAM;AACrF,aAAO,MAAM,cAAc,SACvB,MAAM,gCAAgC,KAAK,IAAI,MAAM,aAAa,GAAG,IACrE,MAAMC;AAAA,QACJ,KAAK;AAAA,QACL,MAAM;AAAA,QACN,MAAM;AAAA,QACN;AAAA,MACF;AAAA,IACN;AAAA,EACF;AACF;AAEA,eAAe,2BACb,MAMA,OAWe;AACf,QAAM,uBAAuB,MAAM,MAAM,aAAa,MAAM,WAAW,MAAM,QAAQ;AACrF,MAAI,CAAC,MAAM,gBAAgB,MAAM,iBAAiB,KAAM;AACxD,MAAI;AACF,UAAM,KAAK,eAAe,oBAAoB;AAAA,MAC5C,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM;AAAA,MACjB,YAAY,MAAM;AAAA,MAClB,cAAc,MAAM;AAAA,MACpB,GAAI,MAAM,oBAAoB,MAAM,oBAAoB,IACpD,EAAE,uBAAuB,KAAK,IAC9B,CAAC;AAAA,IACP,CAAC;AAAA,EACH,QAAQ;AACN,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,QACE,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACF;AAOA,eAAe,2BACb,MAGA,WACe;AACf,MAAI,cAAc,EAAG;AACrB,MAAI;AACF,UAAM,KAAK,eAAe,mCAAmC;AAAA,EAC/D,QAAQ;AACN,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,QACE,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,QAAQ;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,uBACb,MACA,aACA,WACA,UACe;AACf,MAAI,SAAS,WAAW,EAAG;AAC3B,QAAM,SAAS,MAAM,QAAQ;AAAA,IAC3B,SAAS,IAAI,CAAC,YAAYC,iBAAgB,KAAK,IAAI,aAAa,OAAO,CAAC;AAAA,EAC1E;AACA,QAAMC;AAAA,IACJ,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,OAAO,CAAC,UAA8C,UAAU,IAAI;AAAA,EAC7E;AACF;AAEA,eAAe,6BACb,MACA,aACA,SACe;AACf,MAAI,CAAC,QAAS;AACd,QAAM,QAAQ,MAAMC,0BAAyB,KAAK,IAAI,aAAa,OAAO;AAC1E,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,kDAAkD,OAAO,EAAE;AAAA,EAC7E;AACA,QAAMC,qCAAoC,KAAK,KAAK,aAAa,KAAK;AACxE;AAEA,eAAsB,wBACpB,MAMA,SACA,OACA;AACA,QAAM,6BAA6B,MAAM,SAAS,MAAM,iBAAiB,gBAAgB;AACzF,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,aAAa,QAAQ,YAAY;AAAA,IACnC;AAAA,MACE,OAAO;AAAA,MACP,YAAY,CAAC,uBAAuB;AAAA,MACpC,aAAa,OAAO,OAClB,MAAM,8BAA8B,IAAI;AAAA,QACtC,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,iBAAiB,MAAM;AAAA,QACvB,OAAO,WAAW,OAAO;AAAA,QACzB,cAAc,MAAM;AAAA,QACpB,MAAM,MAAM;AAAA,MACd,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,2BAA2B,MAAM;AAAA,IACrC,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,WAAW,MAAM;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,IACnB,cAAc,OAAO;AAAA,IACrB,cAAc,OAAO;AAAA,IACrB,mBAAmB;AAAA,EACrB,CAAC;AACD,QAAM,6BAA6B,MAAM,QAAQ,aAAa,OAAO,uBAAuB;AAC5F,SAAO;AACT;AAEA,eAAsB,kBACpB,MAMA,SACA,OAKA;AACA,QAAM,6BAA6B,MAAM,SAAS,MAAM,iBAAiB,eAAe;AACxF,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,aAAa,QAAQ,YAAY;AAAA,IACnC;AAAA,MACE,OAAO;AAAA,MACP,YAAY,CAAC,mCAAmC,yBAAyB,iBAAiB;AAAA,MAC1F,aAAa,OAAO,OAClB,MAAM,+BAA+B,IAAI;AAAA,QACvC,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,iBAAiB,MAAM;AAAA,QACvB,OAAO,WAAW,OAAO;AAAA,QACzB,cAAc,MAAM;AAAA,QACpB,aAAa,MAAM;AAAA,MACrB,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,2BAA2B,MAAM;AAAA,IACrC,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,WAAW,MAAM;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,IACnB,cAAc,OAAO;AAAA,IACrB,cAAc,OAAO;AAAA,IACrB,mBAAmB,OAAO;AAAA,IAC1B,kBAAkB;AAAA,EACpB,CAAC;AACD,QAAM,6BAA6B,MAAM,QAAQ,aAAa,OAAO,uBAAuB;AAC5F,SAAO;AACT;AAEA,eAAsB,8BACpB,MAMA,SACA,OAMA;AACA,QAAM,gBAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,EACF;AACA,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,aAAa,QAAQ,YAAY;AAAA,IACnC;AAAA,MACE,OAAO;AAAA,MACP,YAAY,CAAC,MAAM,WAAW,UAAU,2BAA2B,yBAAyB;AAAA,MAC5F,aAAa,OAAO,OAClB,MAAM,kCAAkC,IAAI;AAAA,QAC1C,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,WAAW,MAAM;AAAA,QACjB,OAAO,WAAW,OAAO;AAAA,QACzB,cAAc,MAAM;AAAA,QACpB,QAAQ,MAAM;AAAA,QACd,QAAQ,MAAM,UAAU;AAAA,MAC1B,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,uBAAuB,MAAM,QAAQ,aAAa,MAAM,iBAAiB;AAAA,IAC7E,OAAO;AAAA,EACT,CAAC;AACD,QAAM,6BAA6B,MAAM,QAAQ,aAAa,OAAO,uBAAuB;AAC5F,QAAM,2BAA2B,MAAM,OAAO,SAAS;AACvD,SAAO,EAAE,GAAG,QAAQ,cAAc;AACpC;AAEA,SAAS,QAAQ,KAAsD;AACrE,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,QAAQ,IAAI;AAAA,IACZ,cAAc,IAAI;AAAA,IAClB,iBAAiB,IAAI;AAAA,IACrB,cAAc,IAAI;AAAA,IAClB,wBAAwB,IAAI;AAAA,IAC5B,qBAAqB,IAAI;AAAA,IACzB,oBAAoB,IAAI;AAAA,IACxB,sBAAsB,IAAI;AAAA,IAC1B,WAAW,IAAI,UAAU,YAAY;AAAA,EACvC;AACF;AAEA,SAAS,cACP,KACsB;AACtB,MAAI,CAAC,IAAK,QAAO;AACjB,SAAO;AAAA,IACL,UAAU,IAAI;AAAA,IACd,MAAM,IAAI;AAAA,IACV,aAAaC,0BAAyB,MAAM,IAAI,WAAW;AAAA,IAC3D,WAAW,IAAI;AAAA,IACf,OAAO,IAAI;AAAA,IACX,iBAAiB,IAAI;AAAA,IACrB,aAAa,IAAI;AAAA,IACjB,cAAc,IAAI;AAAA,IAClB,mBAAmB,IAAI;AAAA,IACvB,WAAW,IAAI,UAAU,YAAY;AAAA,EACvC;AACF;AAEA,eAAe,mBACb,IACA,aACA,WACA,sBACA;AACA,QAAM,WAAW,MAAM,wBAAwB,IAAI,aAAa,SAAS;AACzE,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,sBAAsB,SAAS,EAAE;AAChE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,kBAAkB;AAAA,MAChB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,qBACpB,MAKA,SACA,QACA,OACuC;AACvC,QAAM,gBAAgB,MAAM,6BAA6B,MAAM,SAAS,uBAAuB;AAC/F,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,aAAa,QAAQ,YAAY;AAAA,IACnC;AAAA,MACE,OAAO;AAAA,MACP,YAAY,CAAC,uBAAuB;AAAA,MACpC,aAAa,OAAO,OAClB,MAAM,4BAA4B,IAAI;AAAA,QACpC,GAAG;AAAA,QACH;AAAA,QACA,cAAc,MAAM;AAAA,QACpB,sBAAsB,MAAM;AAAA,QAC5B,OAAO,EAAE,MAAM,SAAS,WAAW,QAAQ,UAAU;AAAA,QACrD,cAAc,MAAM;AAAA,MACtB,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,SAAS,QAAQ,OAAO,OAAO;AAAA,IAC/B,UAAU,MAAM;AAAA,MACd,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,eAAe,wBAAwB;AAAA,IACzC;AAAA,EACF;AACA,QAAM,uBAAuB,MAAM,QAAQ,aAAa,QAAQ,WAAW,OAAO,QAAQ;AAC1F,SAAO;AACT;AAEA,eAAsB,uBACpB,MAKA,SACA,QACA,OACuC;AACvC,QAAM,gBAAgB,MAAM,6BAA6B,MAAM,SAAS,uBAAuB;AAC/F,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,aAAa,QAAQ,YAAY;AAAA,IACnC;AAAA,MACE,OAAO;AAAA,MACP,YAAY,CAAC,uBAAuB;AAAA,MACpC,aAAa,OAAO,OAClB,MAAM,oCAAoC,IAAI;AAAA,QAC5C,GAAG;AAAA,QACH;AAAA,QACA,qBAAqB,MAAM;AAAA,QAC3B,OAAO,EAAE,MAAM,SAAS,WAAW,QAAQ,UAAU;AAAA,QACrD,cAAc,MAAM;AAAA,QACpB,QAAQ,MAAM,UAAU;AAAA,MAC1B,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,SAAS,QAAQ,OAAO,OAAO;AAAA,IAC/B,UAAU,MAAM;AAAA,MACd,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,eAAe,wBAAwB;AAAA,IACzC;AAAA,EACF;AACA,QAAM,uBAAuB,MAAM,QAAQ,aAAa,QAAQ,WAAW,OAAO,QAAQ;AAC1F,SAAO;AACT;AAEA,eAAsB,qBACpB,MAKA,SACA,QACA,OACuC;AACvC,QAAM,gBAAgB,MAAM,6BAA6B,MAAM,SAAS,uBAAuB;AAC/F,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,aAAa,QAAQ,aAAa,WAAW,QAAQ,UAAU;AAAA,IACjE;AAAA,MACE,OAAO;AAAA,MACP,YAAY,CAAC,uBAAuB;AAAA,MACpC,aAAa,OAAO,OAClB,MAAM,4BAA4B,IAAI;AAAA,QACpC,GAAG;AAAA,QACH;AAAA,QACA,qBAAqB,MAAM;AAAA,QAC3B,uBAAuB,MAAM;AAAA,QAC7B,cAAc,MAAM;AAAA,QACpB,OAAO,EAAE,MAAM,SAAS,WAAW,QAAQ,UAAU;AAAA,QACrD,cAAc,MAAM;AAAA,MACtB,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,SAAS,QAAQ,OAAO,OAAO;AAAA,IAC/B,UAAU,MAAM;AAAA,MACd,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,eAAe,wBAAwB;AAAA,IACzC;AAAA,IACA,OAAO,cAAc,OAAO,KAAK;AAAA,EACnC;AACA,QAAM,uBAAuB,MAAM,QAAQ,aAAa,QAAQ,WAAW,OAAO,QAAQ;AAC1F,SAAO;AACT;AAEA,eAAsB,sBACpB,MAKA,SACA,QACA,OACuC;AACvC,QAAM,gBAAgB,MAAM,6BAA6B,MAAM,SAAS,uBAAuB;AAC/F,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,aAAa,QAAQ,YAAY;AAAA,IACnC;AAAA,MACE,OAAO;AAAA,MACP,YAAY,CAAC,mCAAmC,yBAAyB,iBAAiB;AAAA,MAC1F,aAAa,OAAO,OAClB,MAAM,6BAA6B,IAAI;AAAA,QACrC,GAAG;AAAA,QACH;AAAA,QACA,qBAAqB,MAAM;AAAA,QAC3B,aAAa,MAAM,eAAe;AAAA,QAClC,OAAO,EAAE,MAAM,SAAS,WAAW,QAAQ,UAAU;AAAA,QACrD,cAAc,MAAM;AAAA,MACtB,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,SAAS,QAAQ,OAAO,OAAO;AAAA,IAC/B,UAAU,MAAM;AAAA,MACd,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,eAAe,wBAAwB;AAAA,IACzC;AAAA,EACF;AACA,QAAM,uBAAuB,MAAM,QAAQ,aAAa,QAAQ,WAAW,OAAO,QAAQ;AAC1F,QAAM,6BAA6B,MAAM,QAAQ,aAAa,OAAO,uBAAuB;AAC5F,SAAO;AACT;AAEA,eAAsB,yCACpB,MAMA,SACA,OACgE;AAChE,QAAM,gBAAgB,MAAM,6BAA6B,MAAM,SAAS,iBAAiB;AACzF,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA,EAAE,aAAa,QAAQ,YAAY;AAAA,IACnC;AAAA,MACE,OAAO;AAAA,MACP,YAAY;AAAA,QACV,MAAM,WAAW,WAAW,4BAA4B;AAAA,MAC1D;AAAA,MACA,aAAa,OAAO,OAClB,MAAM,kCAAkC,IAAI;AAAA,QAC1C,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,WAAW,QAAQ;AAAA,QACnB,OAAO,EAAE,MAAM,SAAS,WAAW,QAAQ,UAAU;AAAA,QACrD,cAAc,MAAM;AAAA,QACpB,QAAQ,MAAM;AAAA,QACd,QAAQ,MAAM,UAAU;AAAA,QACxB,qBAAqB,MAAM,uBAAuB;AAAA,MACpD,CAAC;AAAA,IACL;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,SAAS,QAAQ,OAAO,OAAO;AAAA,IAC/B,kBAAkB;AAAA,MAChB,iCAAiC,OAAO,OAAO;AAAA,MAC/C,QAAQ;AAAA,MACR,eAAe,wBAAwB;AAAA,IACzC;AAAA,IACA,mBAAmB,OAAO;AAAA,IAC1B,WAAW,OAAO;AAAA,IAClB,uBAAuB,OAAO;AAAA,IAC9B,oBAAoB,OAAO;AAAA,EAC7B;AACA,aAAW,YAAY,OAAO,uBAAuB;AACnD,UAAM,uBAAuB,MAAM,QAAQ,aAAa,SAAS,WAAW,SAAS,QAAQ;AAAA,EAC/F;AACA,QAAM,6BAA6B,MAAM,QAAQ,aAAa,OAAO,uBAAuB;AAC5F,QAAM,2BAA2B,MAAM,OAAO,SAAS;AACvD,SAAO,EAAE,UAAU,QAAQ,OAAO,OAAO;AAC3C;AAGA,eAAsB,8BACpB,MACA,SACA,OACiC;AACjC,UAAQ,MAAM,yCAAyC,MAAM,SAAS,KAAK,GAAG;AAChF;AAEA,eAAsB,sBACpB,MAKA,SACA,OAC4C;AAC5C,QAAM,SAAS,MAAMC;AAAA,IAAiB,KAAK;AAAA,IAAI,QAAQ;AAAA,IAAa,CAAC,WACnE,OAAO;AAAA,MAAY,CAAC,OAClB,oCAAoC,IAA2B;AAAA,QAC7D,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,OAAO,EAAE,MAAM,SAAS,WAAW,QAAQ,UAAU;AAAA,QACrD,cAAc,MAAM;AAAA,QACpB,QAAQ,MAAM;AAAA,QACd,QAAQ,MAAM,UAAU;AAAA,QACxB,kBAAkB,MAAM,oBAAoB;AAAA,MAC9C,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,SAAS,QAAQ,OAAO,OAAO;AAAA,IAC/B,OAAO,OAAO;AAAA,IACd,UAAU,OAAO;AAAA,IACjB,mBAAmB,OAAO;AAAA,IAC1B,WAAW,OAAO;AAAA,EACpB;AACA,QAAM,6BAA6B,MAAM,QAAQ,aAAa,OAAO,uBAAuB;AAC5F,QAAM,2BAA2B,MAAM,OAAO,SAAS;AACvD,SAAO;AACT;AAEA,eAAsB,sBACpB,MACA,SACwB;AACxB,QAAM,6BAA6B,MAAM,SAAS,uBAAuB;AACzE,QAAM,MAAM,MAAMC;AAAA,IAChB,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,CAAC,WACC,8BAA8B,QAAQ;AAAA,MACpC,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,MACnB,WAAW,QAAQ;AAAA,IACrB,CAAC;AAAA,EACL;AACA,QAAM,SAAS,cAAc,GAAG;AAChC,MAAI,OAAQ,QAAO;AACnB,QAAM,UAAU,MAAMC,YAAW,KAAK,IAAI,QAAQ,aAAa,QAAQ,SAAS;AAChF,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,sBAAsB,QAAQ,SAAS,EAAE;AACvE,SAAO;AAAA,IACL,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa,CAAC;AAAA,IACd,WAAW,CAAC;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,iBAAiBC,4BAA2B,QAAQ,UAAU,QAAQ;AAAA,IACtE,aAAaC,wBAAuB,QAAQ,UAAU,UAAU;AAAA,IAChE,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB,WAAW;AAAA,EACb;AACF;AAEA,eAAsB,uBACpB,MACA,SACA,OACwB;AACxB,QAAM,6BAA6B,MAAM,SAAS,wBAAwB;AAC1E,QAAM,cAAc,MAAM;AAAA,IACxB,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,MAAM,eAAe,CAAC;AAAA,EACxB;AACA,QAAM,MAAM,MAAMH;AAAA,IAChB,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,CAAC,WACC,OAAO;AAAA,MAAY,CAAC,OAClB,+BAA+B,IAA2B;AAAA,QACxD,GAAG;AAAA,QACH,GAAG;AAAA,QACH;AAAA,QACA,WAAW,mBAAmB,MAAM,SAAS;AAAA,QAC7C,WAAW,QAAQ;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACJ;AACA,SAAO,cAAc,GAAG;AAC1B;","names":["getEnrollment","getSandbox","readActiveSandbox","NatsControlRpc","NatsOpStreamTransport","NatsControlRpc","readActiveSandbox","getEnrollment","getSandbox","pointer","NatsOpStreamTransport","HTTPException","FIKEN_PROVIDER_DOMAIN","getWorkspaceGrant","listPackInstallations","HTTPException","HTTPException","listPackInstallations","HTTPException","getWorkspaceGrant","HTTPException","FIKEN_PROVIDER_DOMAIN","record","enabled","createHash","buildPortableSkillArtifact","HTTPException","sha256Hex","owner","repository","environmentsEncryptionKeyBytes","getVariableSet","HTTPException","HTTPException","environmentsEncryptionKeyBytes","getVariableSet","getRig","getVariableSet","recordAuditEvent","HTTPException","createHash","stableJson","recordAuditEvent","getRig","HTTPException","getVariableSet","getConnectionMetadata","getWorkspaceGrant","listConnectionsMetadata","listSocialConnections","connection","stableJson","HTTPException","mergeToolRefs","mergeToolRefs","OPENGENI_SLACK_BOT_SESSION_METADATA_KEY","getConnectionMetadata","getRig","getSessionTurnXaiProviderAccountAuthoritySnapshot","getSession","requireWorkspace","HTTPException","FIRST_PARTY_MCP_TOOL_NAMES","OPENGENI_SLACK_BOT_SESSION_METADATA_KEY","stableJson","encryptVariableSetValue","getEnrollment","getRig","getSandbox","getSession","requireSession","appendAndPublishEvents","HTTPException","HTTPException","record","getConnectionMetadata","HTTPException","getConnectionMetadata","HTTPException","FIRST_PARTY_MCP_TOOL_NAMES","HTTPException","encryptVariableSetValue","finished","requireSession","OPENGENI_SLACK_BOT_SESSION_METADATA_KEY","getSession","getRig","getSandbox","getEnrollment","appendAndPublishEvents","stableJson","getSessionTurnXaiProviderAccountAuthoritySnapshot","HTTPException","getSession","getRig","getConnectionMetadata","OPENGENI_SLACK_BOT_SESSION_METADATA_KEY","requireWorkspace","configuredStaticUsageLimits","requireWorkspace","sumUsageQuantity","startOfUtcMonth","createHash","stableJson","stableJson","createHash","enqueueMemorySlackPublication","getCurrentMemorySlackPublicationConfiguration","receipt","getCurrentMemorySlackPublicationConfiguration","enqueueMemorySlackPublication","createHash","receipt","HTTPException","createHash","sha256","getEnrollment","getRig","getSandbox","getVariableSet","requireFileForSubject","HTTPException","requireFileForSubject","getVariableSet","getRig","getSandbox","getEnrollment","HTTPException","DraftTimelineAnnotations","latencyModeForMetadata","reasoningEffortForMetadata","getSession","getSessionEvent","getWorkspaceControlEvent","runIdempotentPersistenceTransaction","withWorkspaceRls","withWorkspaceSubjectRls","withWorkspaceSubjectSessionActivityRls","publishDurableSessionEvents","publishDurableWorkspaceControlEvent","runIdempotentPersistenceTransaction","withWorkspaceSubjectSessionActivityRls","getSessionEvent","publishDurableSessionEvents","getWorkspaceControlEvent","publishDurableWorkspaceControlEvent","DraftTimelineAnnotations","withWorkspaceRls","withWorkspaceSubjectRls","getSession","reasoningEffortForMetadata","latencyModeForMetadata"]}